From ea629a175ec5f99e0a691e6c79a95e1546bc3a26 Mon Sep 17 00:00:00 2001 From: Aarni Koskela Date: Wed, 25 Jan 2023 11:44:11 +0200 Subject: [PATCH 001/822] Move and spell-check Kubernetes 1.22 migration FAQ (#9544) * Move Kubernetes 1.22 migration guide to a separate file * Reformat and spell-check Kubernetes 1.22 migration doc --- docs/index.md | 232 +------------------------ docs/user-guide/k8s-122-migration.md | 245 +++++++++++++++++++++++++++ 2 files changed, 248 insertions(+), 229 deletions(-) create mode 100644 docs/user-guide/k8s-122-migration.md diff --git a/docs/index.md b/docs/index.md index fded1b2bc..bcf4a4018 100644 --- a/docs/index.md +++ b/docs/index.md @@ -11,233 +11,7 @@ You can learn more about using [Ingress](http://kubernetes.io/docs/user-guide/in See [Deployment](./deploy/) for a whirlwind tour that will get you started. -# FAQ - Migration to apiVersion `networking.k8s.io/v1` +# FAQ - Kubernetes 1.22 Migration -If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), and you plan to upgrade to Kubernetes v1.22, this section is relevant to you. - -- Please read this [official blog on deprecated Ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) - -- Please read this [official documentation on the IngressClass object](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) - -## What is an IngressClass and why is it important for users of Ingress-NGINX controller now ? - -IngressClass is a Kubernetes resource. See the description below. It's important because until now, a default install of the Ingress-NGINX controller did not require any IngressClass object. From version 1.0.0 of the Ingress-NGINX Controller, an IngressClass object is required. - -On clusters with more than one instance of the Ingress-NGINX controller, all instances of the controllers must be aware of which Ingress objects they serve. The `ingressClassName` field of an Ingress is the way to let the controller know about that. - -```console -kubectl explain ingressclass -``` -``` -KIND: IngressClass -VERSION: networking.k8s.io/v1 - -DESCRIPTION: - IngressClass represents the class of the Ingress, referenced by the Ingress - Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be - used to indicate that an IngressClass should be considered default. When a - single IngressClass resource has this annotation set to true, new Ingress - resources without a class specified will be assigned this default class. - -FIELDS: - apiVersion - APIVersion defines the versioned schema of this representation of an - object. Servers should convert recognized schemas to the latest internal - value, and may reject unrecognized values. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - - kind - Kind is a string value representing the REST resource this object - represents. Servers may infer this from the endpoint the client submits - requests to. Cannot be updated. In CamelCase. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - - metadata - Standard object's metadata. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - - spec - Spec is the desired state of the IngressClass. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status` - -``` - -## What has caused this change in behavior? - -There are 2 reasons primarily. - -### Reason #1 - -Until K8s version 1.21, it was possible to create an Ingress resource using deprecated versions of the Ingress API, such as: - - - `extensions/v1beta1` - - `networking.k8s.io/v1beta1` - -You would get a message about deprecation, but the Ingress resource would get created. - -From K8s version 1.22 onwards, you can **only** access the Ingress API via the stable, `networking.k8s.io/v1` API. The reason is explained in the [official blog on deprecated ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/). - -### Reason #2 - -If you are already using the Ingress-NGINX controller and then upgrade to K8s version v1.22 , there are several scenarios where your existing Ingress objects will not work how you expect. Read this FAQ to check which scenario matches your use case. - -## What is ingressClassName field ? - -`ingressClassName` is a field in the specs of an Ingress object. - -```shell -kubectl explain ingress.spec.ingressClassName -``` -```console -KIND: Ingress -VERSION: networking.k8s.io/v1 - -FIELD: ingressClassName - -DESCRIPTION: - IngressClassName is the name of the IngressClass cluster resource. The - associated IngressClass defines which controller will implement the - resource. This replaces the deprecated `kubernetes.io/ingress.class` - annotation. For backwards compatibility, when that annotation is set, it - must be given precedence over this field. The controller may emit a warning - if the field and annotation have different values. Implementations of this - API should ignore Ingresses without a class specified. An IngressClass - resource may be marked as default, which can be used to set a default value - for this field. For more information, refer to the IngressClass - documentation. -``` - -The `.spec.ingressClassName` behavior has precedence over the deprecated `kubernetes.io/ingress.class` annotation. - - -## I have only one ingress controller in my cluster. What should I do? - -If a single instance of the Ingress-NGINX controller is the sole Ingress controller running in your cluster, you should add the annotation "ingressclass.kubernetes.io/is-default-class" in your IngressClass, so any new Ingress objects will have this one as default IngressClass. - -When using Helm, you can enable this annotation by setting `.controller.ingressClassResource.default: true` in your Helm chart installation's values file. - -If you have any old Ingress objects remaining without an IngressClass set, you can do one or more of the following to make the Ingress-NGINX controller aware of the old objects: - -- You can manually set the [`.spec.ingressClassName`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec) field in the manifest of your own Ingress resources. -- You can re-create them after setting the `ingressclass.kubernetes.io/is-default-class` annotation to `true` on the IngressClass -- Alternatively you can make the Ingress-NGINX controller watch Ingress objects without the ingressClassName field set by starting your Ingress-NGINX with the flag [--watch-ingress-without-class=true](#what-is-the-flag-watch-ingress-without-class) . When using Helm, you can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true` - -You can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true`. - -We recommend that you create the IngressClass as shown below: -``` ---- -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - app.kubernetes.io/component: controller - name: nginx - annotations: - ingressclass.kubernetes.io/is-default-class: "true" -spec: - controller: k8s.io/ingress-nginx -``` - -And add the value `spec.ingressClassName=nginx` in your Ingress objects. - - -## I have multiple ingress objects in my cluster. What should I do ? -- If you have lot of ingress objects without ingressClass configuration, you can run the ingress-controller with the flag `--watch-ingress-without-class=true`. - - -### What is the flag '--watch-ingress-without-class' ? -- Its a flag that is passed,as an argument, to the `nginx-ingress-controller` executable. In the configuration, it looks like this: -``` -... -... -args: - - /nginx-ingress-controller - - --watch-ingress-without-class=true - - --publish-service=$(POD_NAMESPACE)/ingress-nginx-dev-v1-test-controller - - --election-id=ingress-controller-leader - - --controller-class=k8s.io/ingress-nginx - - --configmap=$(POD_NAMESPACE)/ingress-nginx-dev-v1-test-controller - - --validating-webhook=:8443 - - --validating-webhook-certificate=/usr/local/certificates/cert - - --validating-webhook-key=/usr/local/certificates/key -... -... -``` - -## I have more than one controller in my cluster and already use the annotation ? - -No problem. This should still keep working, but we highly recommend you to test! - -Even though `kubernetes.io/ingress.class` is deprecated, the Ingress-NGINX controller still understands that annotation. -If you want to follow good practice, you should consider migrating to use IngressClass and `.spec.ingressClassName`. - -## I have more than one controller running in my cluster, and I want to use the new API ? - -In this scenario, you need to create multiple IngressClasses (see example one). But be aware that IngressClass works in a very specific way: you will need to change the `.spec.controller` value in your IngressClass and configure the controller to expect the exact same value. - -Let's see some example, supposing that you have three IngressClasses: - -- IngressClass `ingress-nginx-one`, with `.spec.controller` equal to `example.com/ingress-nginx1` -- IngressClass `ingress-nginx-two`, with `.spec.controller` equal to `example.com/ingress-nginx2` -- IngressClass `ingress-nginx-three`, with `.spec.controller` equal to `example.com/ingress-nginx1` - -(for private use, you can also use a controller name that doesn't contain a `/`; for example: `ingress-nginx1`) - -When deploying your ingress controllers, you will have to change the `--controller-class` field as follows: - -- Ingress-Nginx A, configured to use controller class name `example.com/ingress-nginx1` -- Ingress-Nginx B, configured to use controller class name `example.com/ingress-nginx2` - -Then, when you create an Ingress object with its `ingressClassName` set to `ingress-nginx-two`, only controllers looking for the `example.com/ingress-nginx2` controller class pay attention to the new object. Given that Ingress-Nginx B is set up that way, it will serve that object, whereas Ingress-Nginx A ignores the new Ingress. - -Bear in mind that, if you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true`, then it will serve: - -1. Ingresses without any `ingressClassName` set -2. Ingresses where the deprecated annotation (`kubernetes.io/ingress.class`) matches the value set in the command line argument `--ingress-class` -3. Ingresses that refer to any IngressClass that has the same `spec.controller` as configured in `--controller-class` - -If you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true` and you run Ingress-Nginx A with the command line argument `--watch-ingress-without-class=false` then this is a supported configuration. If you have two Ingress-NGINX controllers for the same cluster, both running with `--watch-ingress-without-class=true` then there is likely to be a conflict. - -## I am seeing this error message in the logs of the Ingress-NGINX controller: "ingress class annotation is not equal to the expected by Ingress Controller". Why ? - -- It is highly likely that you will also see the name of the ingress resource in the same error message. This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in a Ingress resource manifest. It is recommended to use the `.spec.ingressClassName` field of the Ingress resource, to specify the name of the IngressClass of the Ingress you are defining. - -## How to easily install multiple instances of the ingress-NGINX controller in the same cluster ? -- Create a new namespace - ``` - kubectl create namespace ingress-nginx-2 - ``` -- Use Helm to install the additional instance of the ingress controller -- Ensure you have Helm working (refer to the [Helm documentation](https://helm.sh/docs/)) -- We have to assume that you have the helm repo for the ingress-NGINX controller already added to your Helm config. But, if you have not added the helm repo then you can do this to add the repo to your helm config; - ``` - helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx - ``` -- Make sure you have updated the helm repo data; - ``` - helm repo update - ``` -- Now, install an additional instance of the ingress-NGINX controller like this: - ``` - helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ - --namespace ingress-nginx-2 \ - --set controller.ingressClassResource.name=nginx-two \ - --set controller.ingressClass=nginx-two \ - --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ - --set controller.ingressClassResource.enabled=true \ - --set controller.ingressClassByName=true - ``` -- If you need to install yet another instance, then repeat the procedure to create a new namespace, change the values such as names & namespaces (for example from "-2" to "-3"), or anything else that meets your needs. -- If you need to install all instances in the same namespace, then you need to specify a different **election id**, like this: - ``` - helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ - --namespace kube-system \ - --set controller.electionID=nginx-two-leader \ - --set controller.ingressClassResource.name=nginx-two \ - --set controller.ingressClass=nginx-two \ - --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ - --set controller.ingressClassResource.enabled=true \ - --set controller.ingressClassByName=true - ``` - - Note, controller.ingressClassResource.name and controller.ingressClass have to be set with the value of the new class as the first is to create the IngressClass object and the other is to modify the deployment of the actuall ingress controller pod. +If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), +and you plan to upgrade to Kubernetes v1.22, please read [the migration guide here](./user-guide/k8s-122-migration.md). diff --git a/docs/user-guide/k8s-122-migration.md b/docs/user-guide/k8s-122-migration.md new file mode 100644 index 000000000..34893f931 --- /dev/null +++ b/docs/user-guide/k8s-122-migration.md @@ -0,0 +1,245 @@ +# FAQ - Migration to Kubernetes 1.22 and apiVersion `networking.k8s.io/v1` + +If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), +and you plan to upgrade to Kubernetes v1.22, this page is relevant to you. + +- Please read this [official blog on deprecated Ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) +- Please read this [official documentation on the IngressClass object](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) + +## What is an IngressClass and why is it important for users of ingress-nginx controller now? + +IngressClass is a Kubernetes resource. See the description below. +It's important because until now, a default install of the ingress-nginx controller did not require a IngressClass object. +From version 1.0.0 of the ingress-nginx controller, an IngressClass object is required. + +On clusters with more than one instance of the ingress-nginx controller, all instances of the controllers must be aware of which Ingress objects they serve. +The `ingressClassName` field of an Ingress is the way to let the controller know about that. + +```console +kubectl explain ingressclass +``` + +``` +KIND: IngressClass +VERSION: networking.k8s.io/v1 +DESCRIPTION: + IngressClass represents the class of the Ingress, referenced by the Ingress + Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be + used to indicate that an IngressClass should be considered default. When a + single IngressClass resource has this annotation set to true, new Ingress + resources without a class specified will be assigned this default class. +FIELDS: + apiVersion + APIVersion defines the versioned schema of this representation of an + object. Servers should convert recognized schemas to the latest internal + value, and may reject unrecognized values. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + kind + Kind is a string value representing the REST resource this object + represents. Servers may infer this from the endpoint the client submits + requests to. Cannot be updated. In CamelCase. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + metadata + Standard object's metadata. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + spec + Spec is the desired state of the IngressClass. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status` +``` + +## What has caused this change in behavior? + +There are 2 primary reasons. + +### Reason 1 + +Until K8s version 1.21, it was possible to create an Ingress resource using deprecated versions of the Ingress API, such as: + +- `extensions/v1beta1` +- `networking.k8s.io/v1beta1` + You would get a message about deprecation, but the Ingress resource would get created. + +From K8s version 1.22 onwards, you can **only** access the Ingress API via the stable, `networking.k8s.io/v1` API. +The reason is explained in the [official blog on deprecated ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/). + +### Reason #2 + +If you are already using the ingress-nginx controller and then upgrade to Kubernetes 1.22, +there are several scenarios where your existing Ingress objects will not work how you expect. + +Read this FAQ to check which scenario matches your use case. + +## What is the `ingressClassName` field? + +`ingressClassName` is a field in the spec of an Ingress object. + +```shell +kubectl explain ingress.spec.ingressClassName +``` + +```console +KIND: Ingress +VERSION: networking.k8s.io/v1 +FIELD: ingressClassName +DESCRIPTION: + IngressClassName is the name of the IngressClass cluster resource. The + associated IngressClass defines which controller will implement the + resource. This replaces the deprecated `kubernetes.io/ingress.class` + annotation. For backwards compatibility, when that annotation is set, it + must be given precedence over this field. The controller may emit a warning + if the field and annotation have different values. Implementations of this + API should ignore Ingresses without a class specified. An IngressClass + resource may be marked as default, which can be used to set a default value + for this field. For more information, refer to the IngressClass + documentation. +``` + +The `.spec.ingressClassName` behavior has precedence over the deprecated `kubernetes.io/ingress.class` annotation. + +## I have only one ingress controller in my cluster. What should I do? + +If a single instance of the ingress-nginx controller is the sole Ingress controller running in your cluster, +you should add the annotation "ingressclass.kubernetes.io/is-default-class" in your IngressClass, +so any new Ingress objects will have this one as default IngressClass. + +When using Helm, you can enable this annotation by setting `.controller.ingressClassResource.default: true` in your Helm chart installation's values file. + +If you have any old Ingress objects remaining without an IngressClass set, you can do one or more of the following to make the ingress-nginx controller aware of the old objects: + +- You can manually set the [`.spec.ingressClassName`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec) field in the manifest of your own Ingress resources. +- You can re-create them after setting the `ingressclass.kubernetes.io/is-default-class` annotation to `true` on the IngressClass +- Alternatively you can make the ingress-nginx controller watch Ingress objects without the ingressClassName field set by starting your ingress-nginx with the flag [--watch-ingress-without-class=true](#what-is-the-flag-watch-ingress-without-class). + When using Helm, you can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true`. + +We recommend that you create the IngressClass as shown below: + +``` +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + app.kubernetes.io/component: controller + name: nginx + annotations: + ingressclass.kubernetes.io/is-default-class: "true" +spec: + controller: k8s.io/ingress-nginx +``` + +and add the value `spec.ingressClassName=nginx` in your Ingress objects. + +## I have many ingress objects in my cluster. What should I do? + +If you have lot of ingress objects without ingressClass configuration, +you can run the ingress controller with the flag `--watch-ingress-without-class=true`. + +### What is the flag `--watch-ingress-without-class`? + +It's a flag that is passed, as an argument, to the `nginx-ingress-controller` executable. +In the configuration, it looks like this: + +```yaml +# ... +args: + - /nginx-ingress-controller + - --watch-ingress-without-class=true + - --controller-class=k8s.io/ingress-nginx + # ... +# ... +``` + +## I have more than one controller in my cluster, and I'm already using the annotation + +No problem. This should still keep working, but we highly recommend you to test! +Even though `kubernetes.io/ingress.class` is deprecated, the ingress-nginx controller still understands that annotation. +If you want to follow good practice, you should consider migrating to use IngressClass and `.spec.ingressClassName`. + +## I have more than one controller running in my cluster, and I want to use the new API + +In this scenario, you need to create multiple IngressClasses (see the example above). + +Be aware that IngressClass works in a very specific way: you will need to change the `.spec.controller` value in your IngressClass and configure the controller to expect the exact same value. + +Let's see an example, supposing that you have three IngressClasses: + +- IngressClass `ingress-nginx-one`, with `.spec.controller` equal to `example.com/ingress-nginx1` +- IngressClass `ingress-nginx-two`, with `.spec.controller` equal to `example.com/ingress-nginx2` +- IngressClass `ingress-nginx-three`, with `.spec.controller` equal to `example.com/ingress-nginx1` + +For private use, you can also use a controller name that doesn't contain a `/`, e.g. `ingress-nginx1`. + +When deploying your ingress controllers, you will have to change the `--controller-class` field as follows: + +- Ingress-Nginx A, configured to use controller class name `example.com/ingress-nginx1` +- Ingress-Nginx B, configured to use controller class name `example.com/ingress-nginx2` + +When you create an Ingress object with its `ingressClassName` set to `ingress-nginx-two`, +only controllers looking for the `example.com/ingress-nginx2` controller class pay attention to the new object. + +Given that Ingress-Nginx B is set up that way, it will serve that object, whereas Ingress-Nginx A ignores the new Ingress. + +Bear in mind that if you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true`, it will serve: + +1. Ingresses without any `ingressClassName` set +2. Ingresses where the deprecated annotation (`kubernetes.io/ingress.class`) matches the value set in the command line argument `--ingress-class` +3. Ingresses that refer to any IngressClass that has the same `spec.controller` as configured in `--controller-class` +4. If you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true` and you run Ingress-Nginx A with the command line argument `--watch-ingress-without-class=false` then this is a supported configuration. + If you have two ingress-nginx controllers for the same cluster, both running with `--watch-ingress-without-class=true` then there is likely to be a conflict. + +## Why am I am seeing "ingress class annotation is not equal to the expected by Ingress Controller" in my controller logs? + +It is highly likely that you will also see the name of the ingress resource in the same error message. +This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in a Ingress resource manifest. +It is recommended to use the `.spec.ingressClassName` field of the Ingress resource, to specify the name of the IngressClass of the Ingress you are defining. + +## How can I easily install multiple instances of the ingress-nginx controller in the same cluster? + +You can install them in different namespaces. + +- Create a new namespace + ``` + kubectl create namespace ingress-nginx-2 + ``` +- Use Helm to install the additional instance of the ingress controller +- Ensure you have Helm working (refer to the [Helm documentation](https://helm.sh/docs/)) +- We have to assume that you have the helm repo for the ingress-nginx controller already added to your Helm config. + But, if you have not added the helm repo then you can do this to add the repo to your helm config; + ``` + helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx + ``` +- Make sure you have updated the helm repo data; + ``` + helm repo update + ``` +- Now, install an additional instance of the ingress-nginx controller like this: + ``` + helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ + --namespace ingress-nginx-2 \ + --set controller.ingressClassResource.name=nginx-two \ + --set controller.ingressClass=nginx-two \ + --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ + --set controller.ingressClassResource.enabled=true \ + --set controller.ingressClassByName=true + ``` + +If you need to install yet another instance, then repeat the procedure to create a new namespace, +change the values such as names & namespaces (for example from "-2" to "-3"), or anything else that meets your needs. + +Note that `controller.ingressClassResource.name` and `controller.ingressClass` have to be set correctly. +The first is to create the IngressClass object and the other is to modify the deployment of the actual ingress controller pod. + +### I can't use multiple namespaces, what should I do? + +If you need to install all instances in the same namespace, then you need to specify a different **election id**, like this: + +``` +helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ +--namespace kube-system \ +--set controller.electionID=nginx-two-leader \ +--set controller.ingressClassResource.name=nginx-two \ +--set controller.ingressClass=nginx-two \ +--set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ +--set controller.ingressClassResource.enabled=true \ +--set controller.ingressClassByName=true +``` From 5628f765fe883dd8c13ccd3084e9003ffd3e28d5 Mon Sep 17 00:00:00 2001 From: Ismayil Mirzali Date: Fri, 27 Jan 2023 17:12:27 +0200 Subject: [PATCH 002/822] tcpproxy: increase buffer size to 16K (#9548) --- pkg/tcpproxy/tcp.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/tcpproxy/tcp.go b/pkg/tcpproxy/tcp.go index 4c34e1f7b..86850ad54 100644 --- a/pkg/tcpproxy/tcp.go +++ b/pkg/tcpproxy/tcp.go @@ -59,11 +59,12 @@ func (p *TCPProxy) Get(host string) *TCPServer { // and open a connection to the passthrough server. func (p *TCPProxy) Handle(conn net.Conn) { defer conn.Close() - data := make([]byte, 4096) + // See: https://www.ibm.com/docs/en/ztpf/1.1.0.15?topic=sessions-ssl-record-format + data := make([]byte, 16384) length, err := conn.Read(data) if err != nil { - klog.V(4).ErrorS(err, "Error reading the first 4k of the connection") + klog.V(4).ErrorS(err, "Error reading data from the connection") return } From f90f37bed66d343e6c57ea981d6c4e90e4955975 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 30 Jan 2023 12:44:50 -0800 Subject: [PATCH 003/822] Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.13.1 to 0.14.2. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/master/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.13.1...v0.14.2) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 22 ++++++++++---------- go.sum | 65 +++++++++++++++++++++++++++++++++++++--------------------- 2 files changed, 53 insertions(+), 34 deletions(-) diff --git a/go.mod b/go.mod index 6f90615ff..03b3ebdb7 100644 --- a/go.mod +++ b/go.mod @@ -30,17 +30,17 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.0 - k8s.io/apiextensions-apiserver v0.26.0 - k8s.io/apimachinery v0.26.0 - k8s.io/apiserver v0.26.0 + k8s.io/api v0.26.1 + k8s.io/apiextensions-apiserver v0.26.1 + k8s.io/apimachinery v0.26.1 + k8s.io/apiserver v0.26.1 k8s.io/cli-runtime v0.26.0 - k8s.io/client-go v0.26.0 - k8s.io/code-generator v0.26.0 - k8s.io/component-base v0.26.0 + k8s.io/client-go v0.26.1 + k8s.io/code-generator v0.26.1 + k8s.io/component-base v0.26.1 k8s.io/klog/v2 v2.80.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 - sigs.k8s.io/controller-runtime v0.13.1 + sigs.k8s.io/controller-runtime v0.14.2 sigs.k8s.io/mdtoc v1.1.0 ) @@ -77,7 +77,6 @@ require ( github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect - github.com/magefile/mage v1.14.0 // indirect github.com/mailru/easyjson v0.7.6 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect @@ -88,6 +87,7 @@ require ( github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833 // indirect + github.com/onsi/ginkgo v1.16.5 // indirect github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/errors v0.9.1 // indirect @@ -104,7 +104,7 @@ require ( golang.org/x/sys v0.4.0 // indirect golang.org/x/term v0.4.0 // indirect golang.org/x/text v0.6.0 // indirect - golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect + golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 // indirect @@ -115,7 +115,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect - k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect + k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect sigs.k8s.io/kustomize/api v0.12.1 // indirect sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect diff --git a/go.sum b/go.sum index 8a32d3e00..7588a51fb 100644 --- a/go.sum +++ b/go.sum @@ -87,6 +87,8 @@ github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQL github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b h1:074/xhloHUBOpTZwlIzQ28rbPY8pNJvzY7Gcx5KnNOk= @@ -116,6 +118,7 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro= github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= @@ -195,6 +198,7 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWet github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= @@ -231,8 +235,6 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= -github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= -github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= @@ -276,10 +278,17 @@ github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833/go.mod h1:0CznHmX github.com/ncabatoff/process-exporter v0.7.10 h1:+Ere7+3se6QqP54gg7aBRagWcL8bq3u5zNi/GRSWeKQ= github.com/ncabatoff/process-exporter v0.7.10/go.mod h1:DHZRZjqxw9LCOpLlX0DjBuyn6d5plh41Jv6Tmttj7Ek= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= +github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= +github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= +github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= +github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= github.com/onsi/ginkgo/v2 v2.6.1 h1:1xQPCjcqYw/J5LchOcp4/2q/jzJFjiAOc25chhnDw+Q= github.com/onsi/ginkgo/v2 v2.6.1/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo= +github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= +github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.24.1 h1:KORJXNNTzJXzu4ScJWssJfJMnJ+2QJqhoQSRwNlze9E= github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= @@ -385,7 +394,7 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee33 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o= go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= -go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8= +go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60= golang.org/dl v0.0.0-20190829154251-82a15e2f2ead/go.mod h1:IUMfjQLJQd4UTqG1Z90tenwKoCX93Gn3MAQJMOSBsDQ= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= @@ -430,6 +439,7 @@ golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -452,6 +462,7 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/ golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= @@ -482,6 +493,7 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -493,10 +505,13 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -517,6 +532,7 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -542,8 +558,8 @@ golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.0.0-20220609170525-579cf78fd858 h1:Dpdu/EMxGMFgq0CeYMh4fazTD2vtlZRYE7wyynxJb9U= -golang.org/x/time v0.0.0-20220609170525-579cf78fd858/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= +golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= @@ -586,6 +602,7 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= @@ -689,6 +706,7 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/go-playground/assert.v1 v1.2.1 h1:xoYuJVE7KT85PYWrN730RguIQO0ePzVRfFMXadIrXTM= gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE= gopkg.in/go-playground/pool.v3 v3.1.1 h1:4Qcj91IsYTpIeRhe/eo6Fz+w6uKWPEghx8vHFTYMfhw= @@ -698,6 +716,7 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/mcuadros/go-syslog.v2 v2.3.0 h1:kcsiS+WsTKyIEPABJBJtoG0KkOS6yzvJ+/eZlhD79kk= gopkg.in/mcuadros/go-syslog.v2 v2.3.0/go.mod h1:l5LPIyOOyIdQquNg+oU6Z3524YwrcqEm0aKH+5zpt2U= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= @@ -718,22 +737,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I= -k8s.io/api v0.26.0/go.mod h1:k6HDTaIFC8yn1i6pSClSqIwLABIcLV9l5Q4EcngKnQg= -k8s.io/apiextensions-apiserver v0.26.0 h1:Gy93Xo1eg2ZIkNX/8vy5xviVSxwQulsnUdQ00nEdpDo= -k8s.io/apiextensions-apiserver v0.26.0/go.mod h1:7ez0LTiyW5nq3vADtK6C3kMESxadD51Bh6uz3JOlqWQ= -k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg= -k8s.io/apimachinery v0.26.0/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= -k8s.io/apiserver v0.26.0 h1:q+LqIK5EZwdznGZb8bq0+a+vCqdeEEe4Ux3zsOjbc4o= -k8s.io/apiserver v0.26.0/go.mod h1:aWhlLD+mU+xRo+zhkvP/gFNbShI4wBDHS33o0+JGI84= +k8s.io/api v0.26.1 h1:f+SWYiPd/GsiWwVRz+NbFyCgvv75Pk9NK6dlkZgpCRQ= +k8s.io/api v0.26.1/go.mod h1:xd/GBNgR0f707+ATNyPmQ1oyKSgndzXij81FzWGsejg= +k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI= +k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM= +k8s.io/apimachinery v0.26.1 h1:8EZ/eGJL+hY/MYCNwhmDzVqq2lPl3N3Bo8rvweJwXUQ= +k8s.io/apimachinery v0.26.1/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= +k8s.io/apiserver v0.26.1 h1:6vmnAqCDO194SVCPU3MU8NcDgSqsUA62tBUSWrFXhsc= +k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg= k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= -k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8= -k8s.io/client-go v0.26.0/go.mod h1:I2Sh57A79EQsDmn7F7ASpmru1cceh3ocVT9KlX2jEZg= -k8s.io/code-generator v0.26.0 h1:ZDY+7Gic9p/lACgD1G72gQg2CvNGeAYZTPIncv+iALM= -k8s.io/code-generator v0.26.0/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= -k8s.io/component-base v0.26.0 h1:0IkChOCohtDHttmKuz+EP3j3+qKmV55rM9gIFTXA7Vs= -k8s.io/component-base v0.26.0/go.mod h1:lqHwlfV1/haa14F/Z5Zizk5QmzaVf23nQzCwVOQpfC8= +k8s.io/client-go v0.26.1 h1:87CXzYJnAMGaa/IDDfRdhTzxk/wzGZ+/HUQpqgVSZXU= +k8s.io/client-go v0.26.1/go.mod h1:IWNSglg+rQ3OcvDkhY6+QLeasV4OYHDjdqeWkDQZwGE= +k8s.io/code-generator v0.26.1 h1:dusFDsnNSKlMFYhzIM0jAO1OlnTN5WYwQQ+Ai12IIlo= +k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= +k8s.io/component-base v0.26.1 h1:4ahudpeQXHZL5kko+iDHqLj/FSGAEUnSVO0EBbgDd+4= +k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/kAWU= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= @@ -741,15 +760,15 @@ k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= +k8s.io/utils v0.0.0-20221128185143-99ec85e7a448/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 h1:SAElp8THCfmBdM+4lmWX5gebiSSkEr7PAYDVF91qpfg= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R5A2EgsVzG8RTt4RfPoQuRAcDmg= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg= -sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI= +sigs.k8s.io/controller-runtime v0.14.2 h1:P6IwDhbsRWsBClt/8/h8Zy36bCuGuW5Op7MHpFrN/60= +sigs.k8s.io/controller-runtime v0.14.2/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= From 7d1c47ab5408a40993993b1b47954a4fd44d39f3 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 31 Jan 2023 20:09:06 -0500 Subject: [PATCH 004/822] Switch logic on path type validation and setting it to false (#9543) * update path type validation to be false and update e2e test scripts Signed-off-by: James Strong * update to make tests clear Signed-off-by: James Strong * update test params Signed-off-by: James Strong * Adding else per pr comments Signed-off-by: James Strong --------- Signed-off-by: James Strong Signed-off-by: James Strong --- Makefile | 4 +- charts/ingress-nginx/README.md | 2 +- .../templates/controller-configmap.yaml | 2 +- charts/ingress-nginx/values.yaml | 6 +- .../nginx-configuration/configmap.md | 394 +++++++++--------- internal/ingress/controller/config/config.go | 11 +- internal/ingress/controller/controller.go | 2 +- .../ingress/controller/controller_test.go | 6 +- internal/ingress/controller/store/store.go | 2 +- pkg/util/ingress/ingress.go | 43 +- pkg/util/ingress/ingress_test.go | 66 +-- test/e2e/admission/admission.go | 28 +- {build => test/e2e}/run-e2e-suite.sh | 15 +- test/e2e/{run.sh => run-kind-e2e.sh} | 92 ++-- 14 files changed, 354 insertions(+), 319 deletions(-) rename {build => test/e2e}/run-e2e-suite.sh (97%) rename test/e2e/{run.sh => run-kind-e2e.sh} (62%) diff --git a/Makefile b/Makefile index 0ce3e3cef..25855a224 100644 --- a/Makefile +++ b/Makefile @@ -153,11 +153,11 @@ lua-test: ## Run lua unit tests. .PHONY: e2e-test e2e-test: ## Run e2e tests (expects access to a working Kubernetes cluster). - @build/run-e2e-suite.sh + @test/e2e/run-e2e-suite.sh .PHONY: kind-e2e-test kind-e2e-test: ## Run e2e tests using kind. - @test/e2e/run.sh + @test/e2e/run-kind-e2e.sh .PHONY: kind-e2e-chart-tests kind-e2e-chart-tests: ## Run helm chart e2e tests diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 174a8870d..7f3ea1866 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -253,6 +253,7 @@ Kubernetes: `>=1.20.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | commonLabels | object | `{}` | | +| controller.EnablePathTypeValidation | bool | `false` | This configuration defines if Ingress Controller should validate pathType. If false, special characters will be allowed on paths of any pathType. If true, special characters are only allowed on paths with pathType = ImplementationSpecific | | controller.addHeaders | object | `{}` | Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers | | controller.admissionWebhooks.annotations | object | `{}` | | | controller.admissionWebhooks.certManager.admissionCert.duration | string | `""` | | @@ -311,7 +312,6 @@ Kubernetes: `>=1.20.0-0` | controller.containerPort | object | `{"http":80,"https":443}` | Configures the ports that the nginx-controller listens on | | controller.customTemplate.configMapKey | string | `""` | | | controller.customTemplate.configMapName | string | `""` | | -| controller.disablePathTypeValidation | bool | `false` | This configuration defines if Ingress Controller should validate pathType. If this is true, special characters will be allowed on paths of any pathType. If false, special characters are only allowed on paths with pathType = ImplementationSpecific | | controller.dnsConfig | object | `{}` | Optionally customize the pod dnsConfig. | | controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. | | controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' | diff --git a/charts/ingress-nginx/templates/controller-configmap.yaml b/charts/ingress-nginx/templates/controller-configmap.yaml index ffd003ee8..a1fbdf549 100644 --- a/charts/ingress-nginx/templates/controller-configmap.yaml +++ b/charts/ingress-nginx/templates/controller-configmap.yaml @@ -14,7 +14,7 @@ metadata: namespace: {{ .Release.Namespace }} data: allow-snippet-annotations: "{{ .Values.controller.allowSnippetAnnotations }}" - disable-pathtype-validation: "{{ .Values.controller.disablePathTypeValidation }}" + enable-pathtype-validation: "{{ .Values.controller.EnablePathTypeValidation }}" {{- if .Values.controller.addHeaders }} add-headers: {{ .Release.Namespace }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 072493ccc..4c587ee88 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -88,9 +88,9 @@ controller: allowSnippetAnnotations: true # -- This configuration defines if Ingress Controller should validate pathType. - # If this is true, special characters will be allowed on paths of any pathType. If - # false, special characters are only allowed on paths with pathType = ImplementationSpecific - disablePathTypeValidation: false + # If false, special characters will be allowed on paths of any pathType. + # If true, special characters are only allowed on paths with pathType = ImplementationSpecific + EnablePathTypeValidation: false # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index baefa7c72..3832bba16 100755 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -25,199 +25,199 @@ data: The following table shows a configuration option's name, type, and the default value: -|name|type|default| -|:---|:---|:------| -|[add-headers](#add-headers)|string|""| -|[allow-backend-server-header](#allow-backend-server-header)|bool|"false"| -|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true| -|[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""| -|[hide-headers](#hide-headers)|string array|empty| -|[access-log-params](#access-log-params)|string|""| -|[access-log-path](#access-log-path)|string|"/var/log/nginx/access.log"| -|[http-access-log-path](#http-access-log-path)|string|""| -|[stream-access-log-path](#stream-access-log-path)|string|""| -|[enable-access-log-for-default-backend](#enable-access-log-for-default-backend)|bool|"false"| -|[error-log-path](#error-log-path)|string|"/var/log/nginx/error.log"| -|[enable-modsecurity](#enable-modsecurity)|bool|"false"| -|[modsecurity-snippet](#modsecurity-snippet)|string|""| -|[enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs)|bool|"false"| -|[client-header-buffer-size](#client-header-buffer-size)|string|"1k"| -|[client-header-timeout](#client-header-timeout)|int|60| -|[client-body-buffer-size](#client-body-buffer-size)|string|"8k"| -|[client-body-timeout](#client-body-timeout)|int|60| -|[disable-access-log](#disable-access-log)|bool|false| -|[disable-ipv6](#disable-ipv6)|bool|false| -|[disable-ipv6-dns](#disable-ipv6-dns)|bool|false| -|[enable-underscores-in-headers](#enable-underscores-in-headers)|bool|false| -|[enable-ocsp](#enable-ocsp)|bool|false| -|[ignore-invalid-headers](#ignore-invalid-headers)|bool|true| -|[retry-non-idempotent](#retry-non-idempotent)|bool|"false"| -|[error-log-level](#error-log-level)|string|"notice"| -|[http2-max-field-size](#http2-max-field-size)|string|"4k"| -|[http2-max-header-size](#http2-max-header-size)|string|"16k"| -|[http2-max-requests](#http2-max-requests)|int|1000| -|[http2-max-concurrent-streams](#http2-max-concurrent-streams)|int|128| -|[hsts](#hsts)|bool|"true"| -|[hsts-include-subdomains](#hsts-include-subdomains)|bool|"true"| -|[hsts-max-age](#hsts-max-age)|string|"15724800"| -|[hsts-preload](#hsts-preload)|bool|"false"| -|[keep-alive](#keep-alive)|int|75| -|[keep-alive-requests](#keep-alive-requests)|int|1000| -|[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"| -|[log-format-escape-none](#log-format-escape-none)|bool|"false"| -|[log-format-escape-json](#log-format-escape-json)|bool|"false"| -|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`| -|[log-format-stream](#log-format-stream)|string|`[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time`| -|[enable-multi-accept](#enable-multi-accept)|bool|"true"| -|[max-worker-connections](#max-worker-connections)|int|16384| -|[max-worker-open-files](#max-worker-open-files)|int|0| -|[map-hash-bucket-size](#max-hash-bucket-size)|int|64| -|[nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist)|[]string|"127.0.0.1"| -|[nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist)|[]string|"::1"| -|[proxy-real-ip-cidr](#proxy-real-ip-cidr)|[]string|"0.0.0.0/0"| -|[proxy-set-headers](#proxy-set-headers)|string|""| -|[server-name-hash-max-size](#server-name-hash-max-size)|int|1024| -|[server-name-hash-bucket-size](#server-name-hash-bucket-size)|int|`` -|[proxy-headers-hash-max-size](#proxy-headers-hash-max-size)|int|512| -|[proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size)|int|64| -|[plugins](#plugins)|[]string| | -|[reuse-port](#reuse-port)|bool|"true"| -|[server-tokens](#server-tokens)|bool|"false"| -|[ssl-ciphers](#ssl-ciphers)|string|"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"| -|[ssl-ecdh-curve](#ssl-ecdh-curve)|string|"auto"| -|[ssl-dh-param](#ssl-dh-param)|string|""| -|[ssl-protocols](#ssl-protocols)|string|"TLSv1.2 TLSv1.3"| -|[ssl-session-cache](#ssl-session-cache)|bool|"true"| -|[ssl-session-cache-size](#ssl-session-cache-size)|string|"10m"| -|[ssl-session-tickets](#ssl-session-tickets)|bool|"false"| -|[ssl-session-ticket-key](#ssl-session-ticket-key)|string|`` -|[ssl-session-timeout](#ssl-session-timeout)|string|"10m"| -|[ssl-buffer-size](#ssl-buffer-size)|string|"4k"| -|[use-proxy-protocol](#use-proxy-protocol)|bool|"false"| -|[proxy-protocol-header-timeout](#proxy-protocol-header-timeout)|string|"5s"| -|[use-gzip](#use-gzip)|bool|"false"| -|[use-geoip](#use-geoip)|bool|"true"| -|[use-geoip2](#use-geoip2)|bool|"false"| -|[enable-brotli](#enable-brotli)|bool|"false"| -|[brotli-level](#brotli-level)|int|4| -|[brotli-min-length](#brotli-min-length)|int|20| -|[brotli-types](#brotli-types)|string|"application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| -|[use-http2](#use-http2)|bool|"true"| -|[gzip-disable](#gzip-disable)|string|""| -|[gzip-level](#gzip-level)|int|1| -|[gzip-min-length](#gzip-min-length)|int|256| -|[gzip-types](#gzip-types)|string|"application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| -|[worker-processes](#worker-processes)|string|``| -|[worker-cpu-affinity](#worker-cpu-affinity)|string|""| -|[worker-shutdown-timeout](#worker-shutdown-timeout)|string|"240s"| -|[load-balance](#load-balance)|string|"round_robin"| -|[variables-hash-bucket-size](#variables-hash-bucket-size)|int|128| -|[variables-hash-max-size](#variables-hash-max-size)|int|2048| -|[upstream-keepalive-connections](#upstream-keepalive-connections)|int|320| -|[upstream-keepalive-time](#upstream-keepalive-time)|string|"1h"| -|[upstream-keepalive-timeout](#upstream-keepalive-timeout)|int|60| -|[upstream-keepalive-requests](#upstream-keepalive-requests)|int|10000| -|[limit-conn-zone-variable](#limit-conn-zone-variable)|string|"$binary_remote_addr"| -|[proxy-stream-timeout](#proxy-stream-timeout)|string|"600s"| -|[proxy-stream-next-upstream](#proxy-stream-next-upstream)|bool|"true"| -|[proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout)|string|"600s"| -|[proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries)|int|3| -|[proxy-stream-responses](#proxy-stream-responses)|int|1| -|[bind-address](#bind-address)|[]string|""| -|[use-forwarded-headers](#use-forwarded-headers)|bool|"false"| -|[enable-real-ip](#enable-real-ip)|bool|"false"| -|[forwarded-for-header](#forwarded-for-header)|string|"X-Forwarded-For"| -|[compute-full-forwarded-for](#compute-full-forwarded-for)|bool|"false"| -|[proxy-add-original-uri-header](#proxy-add-original-uri-header)|bool|"false"| -|[generate-request-id](#generate-request-id)|bool|"true"| -|[enable-opentracing](#enable-opentracing)|bool|"false"| -|[opentracing-operation-name](#opentracing-operation-name)|string|""| -|[opentracing-location-operation-name](#opentracing-location-operation-name)|string|""| -|[zipkin-collector-host](#zipkin-collector-host)|string|""| -|[zipkin-collector-port](#zipkin-collector-port)|int|9411| -|[zipkin-service-name](#zipkin-service-name)|string|"nginx"| -|[zipkin-sample-rate](#zipkin-sample-rate)|float|1.0| -|[jaeger-collector-host](#jaeger-collector-host)|string|""| -|[jaeger-collector-port](#jaeger-collector-port)|int|6831| -|[jaeger-endpoint](#jaeger-endpoint)|string|""| -|[jaeger-service-name](#jaeger-service-name)|string|"nginx"| -|[jaeger-propagation-format](#jaeger-propagation-format)|string|"jaeger"| -|[jaeger-sampler-type](#jaeger-sampler-type)|string|"const"| -|[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"| -|[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"| -|[jaeger-sampler-port](#jaeger-sampler-port)|int|5778| -|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id| -|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id| -|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage| -|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-| -|[datadog-collector-host](#datadog-collector-host)|string|""| -|[datadog-collector-port](#datadog-collector-port)|int|8126| -|[datadog-service-name](#datadog-service-name)|string|"nginx"| -|[datadog-environment](#datadog-environment)|string|"prod"| -|[datadog-operation-name-override](#datadog-operation-name-override)|string|"nginx.handle"| -|[datadog-priority-sampling](#datadog-priority-sampling)|bool|"true"| -|[datadog-sample-rate](#datadog-sample-rate)|float|1.0| -|[main-snippet](#main-snippet)|string|""| -|[http-snippet](#http-snippet)|string|""| -|[server-snippet](#server-snippet)|string|""| -|[stream-snippet](#stream-snippet)|string|""| -|[location-snippet](#location-snippet)|string|""| -|[custom-http-errors](#custom-http-errors)|[]int|[]int{}| -|[proxy-body-size](#proxy-body-size)|string|"1m"| -|[proxy-connect-timeout](#proxy-connect-timeout)|int|5| -|[proxy-read-timeout](#proxy-read-timeout)|int|60| -|[proxy-send-timeout](#proxy-send-timeout)|int|60| -|[proxy-buffers-number](#proxy-buffers-number)|int|4| -|[proxy-buffer-size](#proxy-buffer-size)|string|"4k"| -|[proxy-cookie-path](#proxy-cookie-path)|string|"off"| -|[proxy-cookie-domain](#proxy-cookie-domain)|string|"off"| -|[proxy-next-upstream](#proxy-next-upstream)|string|"error timeout"| -|[proxy-next-upstream-timeout](#proxy-next-upstream-timeout)|int|0| -|[proxy-next-upstream-tries](#proxy-next-upstream-tries)|int|3| -|[proxy-redirect-from](#proxy-redirect-from)|string|"off"| -|[proxy-request-buffering](#proxy-request-buffering)|string|"on"| -|[ssl-redirect](#ssl-redirect)|bool|"true"| -|[force-ssl-redirect](#force-ssl-redirect)|bool|"false"| -|[denylist-source-range](#denylist-source-range)|[]string|[]string{}| -|[whitelist-source-range](#whitelist-source-range)|[]string|[]string{}| -|[skip-access-log-urls](#skip-access-log-urls)|[]string|[]string{}| -|[limit-rate](#limit-rate)|int|0| -|[limit-rate-after](#limit-rate-after)|int|0| -|[lua-shared-dicts](#lua-shared-dicts)|string|""| -|[http-redirect-code](#http-redirect-code)|int|308| -|[proxy-buffering](#proxy-buffering)|string|"off"| -|[limit-req-status-code](#limit-req-status-code)|int|503| -|[limit-conn-status-code](#limit-conn-status-code)|int|503| -|[enable-syslog](#enable-syslog)|bool|false| -|[syslog-host](#syslog-host)|string|""| -|[syslog-port](#syslog-port)|int|514| -|[no-tls-redirect-locations](#no-tls-redirect-locations)|string|"/.well-known/acme-challenge"| -|[global-auth-url](#global-auth-url)|string|""| -|[global-auth-method](#global-auth-method)|string|""| -|[global-auth-signin](#global-auth-signin)|string|""| -|[global-auth-signin-redirect-param](#global-auth-signin-redirect-param)|string|"rd"| -|[global-auth-response-headers](#global-auth-response-headers)|string|""| -|[global-auth-request-redirect](#global-auth-request-redirect)|string|""| -|[global-auth-snippet](#global-auth-snippet)|string|""| -|[global-auth-cache-key](#global-auth-cache-key)|string|""| -|[global-auth-cache-duration](#global-auth-cache-duration)|string|"200 202 401 5m"| -|[no-auth-locations](#no-auth-locations)|string|"/.well-known/acme-challenge"| -|[block-cidrs](#block-cidrs)|[]string|""| -|[block-user-agents](#block-user-agents)|[]string|""| -|[block-referers](#block-referers)|[]string|""| -|[proxy-ssl-location-only](#proxy-ssl-location-only)|bool|"false"| -|[default-type](#default-type)|string|"text/html"| -|[global-rate-limit-memcached-host](#global-rate-limit)|string|""| -|[global-rate-limit-memcached-port](#global-rate-limit)|int|11211| -|[global-rate-limit-memcached-connect-timeout](#global-rate-limit)|int|50| -|[global-rate-limit-memcached-max-idle-timeout](#global-rate-limit)|int|10000| -|[global-rate-limit-memcached-pool-size](#global-rate-limit)|int|50| -|[global-rate-limit-status-code](#global-rate-limit)|int|429| -|[service-upstream](#service-upstream)|bool|"false"| -|[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"| -|[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"| -|[disable-pathtype-validation](#disable-pathtype-validation)|bool|"false"| -|[path-additional-allowed-chars](#path-additional-allowed-chars)|string|"^%$[](){}*+?"| +| name | type | default | +|:--------------------------------------------------------------------------------|:-------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [add-headers](#add-headers) | string | "" | +| [allow-backend-server-header](#allow-backend-server-header) | bool | "false" | +| [allow-snippet-annotations](#allow-snippet-annotations) | bool | true | +| [annotation-value-word-blocklist](#annotation-value-word-blocklist) | string array | "" | +| [hide-headers](#hide-headers) | string array | empty | +| [access-log-params](#access-log-params) | string | "" | +| [access-log-path](#access-log-path) | string | "/var/log/nginx/access.log" | +| [http-access-log-path](#http-access-log-path) | string | "" | +| [stream-access-log-path](#stream-access-log-path) | string | "" | +| [enable-access-log-for-default-backend](#enable-access-log-for-default-backend) | bool | "false" | +| [error-log-path](#error-log-path) | string | "/var/log/nginx/error.log" | +| [enable-modsecurity](#enable-modsecurity) | bool | "false" | +| [modsecurity-snippet](#modsecurity-snippet) | string | "" | +| [enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs) | bool | "false" | +| [client-header-buffer-size](#client-header-buffer-size) | string | "1k" | +| [client-header-timeout](#client-header-timeout) | int | 60 | +| [client-body-buffer-size](#client-body-buffer-size) | string | "8k" | +| [client-body-timeout](#client-body-timeout) | int | 60 | +| [disable-access-log](#disable-access-log) | bool | false | +| [disable-ipv6](#disable-ipv6) | bool | false | +| [disable-ipv6-dns](#disable-ipv6-dns) | bool | false | +| [enable-underscores-in-headers](#enable-underscores-in-headers) | bool | false | +| [enable-ocsp](#enable-ocsp) | bool | false | +| [ignore-invalid-headers](#ignore-invalid-headers) | bool | true | +| [retry-non-idempotent](#retry-non-idempotent) | bool | "false" | +| [error-log-level](#error-log-level) | string | "notice" | +| [http2-max-field-size](#http2-max-field-size) | string | "4k" | +| [http2-max-header-size](#http2-max-header-size) | string | "16k" | +| [http2-max-requests](#http2-max-requests) | int | 1000 | +| [http2-max-concurrent-streams](#http2-max-concurrent-streams) | int | 128 | +| [hsts](#hsts) | bool | "true" | +| [hsts-include-subdomains](#hsts-include-subdomains) | bool | "true" | +| [hsts-max-age](#hsts-max-age) | string | "15724800" | +| [hsts-preload](#hsts-preload) | bool | "false" | +| [keep-alive](#keep-alive) | int | 75 | +| [keep-alive-requests](#keep-alive-requests) | int | 1000 | +| [large-client-header-buffers](#large-client-header-buffers) | string | "4 8k" | +| [log-format-escape-none](#log-format-escape-none) | bool | "false" | +| [log-format-escape-json](#log-format-escape-json) | bool | "false" | +| [log-format-upstream](#log-format-upstream) | string | `$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id` | +| [log-format-stream](#log-format-stream) | string | `[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time` | +| [enable-multi-accept](#enable-multi-accept) | bool | "true" | +| [max-worker-connections](#max-worker-connections) | int | 16384 | +| [max-worker-open-files](#max-worker-open-files) | int | 0 | +| [map-hash-bucket-size](#max-hash-bucket-size) | int | 64 | +| [nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist) | []string | "127.0.0.1" | +| [nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist) | []string | "::1" | +| [proxy-real-ip-cidr](#proxy-real-ip-cidr) | []string | "0.0.0.0/0" | +| [proxy-set-headers](#proxy-set-headers) | string | "" | +| [server-name-hash-max-size](#server-name-hash-max-size) | int | 1024 | +| [server-name-hash-bucket-size](#server-name-hash-bucket-size) | int | `` | +| [proxy-headers-hash-max-size](#proxy-headers-hash-max-size) | int | 512 | +| [proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size) | int | 64 | +| [plugins](#plugins) | []string | | +| [reuse-port](#reuse-port) | bool | "true" | +| [server-tokens](#server-tokens) | bool | "false" | +| [ssl-ciphers](#ssl-ciphers) | string | "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" | +| [ssl-ecdh-curve](#ssl-ecdh-curve) | string | "auto" | +| [ssl-dh-param](#ssl-dh-param) | string | "" | +| [ssl-protocols](#ssl-protocols) | string | "TLSv1.2 TLSv1.3" | +| [ssl-session-cache](#ssl-session-cache) | bool | "true" | +| [ssl-session-cache-size](#ssl-session-cache-size) | string | "10m" | +| [ssl-session-tickets](#ssl-session-tickets) | bool | "false" | +| [ssl-session-ticket-key](#ssl-session-ticket-key) | string | `` | +| [ssl-session-timeout](#ssl-session-timeout) | string | "10m" | +| [ssl-buffer-size](#ssl-buffer-size) | string | "4k" | +| [use-proxy-protocol](#use-proxy-protocol) | bool | "false" | +| [proxy-protocol-header-timeout](#proxy-protocol-header-timeout) | string | "5s" | +| [use-gzip](#use-gzip) | bool | "false" | +| [use-geoip](#use-geoip) | bool | "true" | +| [use-geoip2](#use-geoip2) | bool | "false" | +| [enable-brotli](#enable-brotli) | bool | "false" | +| [brotli-level](#brotli-level) | int | 4 | +| [brotli-min-length](#brotli-min-length) | int | 20 | +| [brotli-types](#brotli-types) | string | "application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" | +| [use-http2](#use-http2) | bool | "true" | +| [gzip-disable](#gzip-disable) | string | "" | +| [gzip-level](#gzip-level) | int | 1 | +| [gzip-min-length](#gzip-min-length) | int | 256 | +| [gzip-types](#gzip-types) | string | "application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" | +| [worker-processes](#worker-processes) | string | `` | +| [worker-cpu-affinity](#worker-cpu-affinity) | string | "" | +| [worker-shutdown-timeout](#worker-shutdown-timeout) | string | "240s" | +| [load-balance](#load-balance) | string | "round_robin" | +| [variables-hash-bucket-size](#variables-hash-bucket-size) | int | 128 | +| [variables-hash-max-size](#variables-hash-max-size) | int | 2048 | +| [upstream-keepalive-connections](#upstream-keepalive-connections) | int | 320 | +| [upstream-keepalive-time](#upstream-keepalive-time) | string | "1h" | +| [upstream-keepalive-timeout](#upstream-keepalive-timeout) | int | 60 | +| [upstream-keepalive-requests](#upstream-keepalive-requests) | int | 10000 | +| [limit-conn-zone-variable](#limit-conn-zone-variable) | string | "$binary_remote_addr" | +| [proxy-stream-timeout](#proxy-stream-timeout) | string | "600s" | +| [proxy-stream-next-upstream](#proxy-stream-next-upstream) | bool | "true" | +| [proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout) | string | "600s" | +| [proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries) | int | 3 | +| [proxy-stream-responses](#proxy-stream-responses) | int | 1 | +| [bind-address](#bind-address) | []string | "" | +| [use-forwarded-headers](#use-forwarded-headers) | bool | "false" | +| [enable-real-ip](#enable-real-ip) | bool | "false" | +| [forwarded-for-header](#forwarded-for-header) | string | "X-Forwarded-For" | +| [compute-full-forwarded-for](#compute-full-forwarded-for) | bool | "false" | +| [proxy-add-original-uri-header](#proxy-add-original-uri-header) | bool | "false" | +| [generate-request-id](#generate-request-id) | bool | "true" | +| [enable-opentracing](#enable-opentracing) | bool | "false" | +| [opentracing-operation-name](#opentracing-operation-name) | string | "" | +| [opentracing-location-operation-name](#opentracing-location-operation-name) | string | "" | +| [zipkin-collector-host](#zipkin-collector-host) | string | "" | +| [zipkin-collector-port](#zipkin-collector-port) | int | 9411 | +| [zipkin-service-name](#zipkin-service-name) | string | "nginx" | +| [zipkin-sample-rate](#zipkin-sample-rate) | float | 1.0 | +| [jaeger-collector-host](#jaeger-collector-host) | string | "" | +| [jaeger-collector-port](#jaeger-collector-port) | int | 6831 | +| [jaeger-endpoint](#jaeger-endpoint) | string | "" | +| [jaeger-service-name](#jaeger-service-name) | string | "nginx" | +| [jaeger-propagation-format](#jaeger-propagation-format) | string | "jaeger" | +| [jaeger-sampler-type](#jaeger-sampler-type) | string | "const" | +| [jaeger-sampler-param](#jaeger-sampler-param) | string | "1" | +| [jaeger-sampler-host](#jaeger-sampler-host) | string | "http://127.0.0.1" | +| [jaeger-sampler-port](#jaeger-sampler-port) | int | 5778 | +| [jaeger-trace-context-header-name](#jaeger-trace-context-header-name) | string | uber-trace-id | +| [jaeger-debug-header](#jaeger-debug-header) | string | uber-debug-id | +| [jaeger-baggage-header](#jaeger-baggage-header) | string | jaeger-baggage | +| [jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix) | string | uberctx- | +| [datadog-collector-host](#datadog-collector-host) | string | "" | +| [datadog-collector-port](#datadog-collector-port) | int | 8126 | +| [datadog-service-name](#datadog-service-name) | string | "nginx" | +| [datadog-environment](#datadog-environment) | string | "prod" | +| [datadog-operation-name-override](#datadog-operation-name-override) | string | "nginx.handle" | +| [datadog-priority-sampling](#datadog-priority-sampling) | bool | "true" | +| [datadog-sample-rate](#datadog-sample-rate) | float | 1.0 | +| [main-snippet](#main-snippet) | string | "" | +| [http-snippet](#http-snippet) | string | "" | +| [server-snippet](#server-snippet) | string | "" | +| [stream-snippet](#stream-snippet) | string | "" | +| [location-snippet](#location-snippet) | string | "" | +| [custom-http-errors](#custom-http-errors) | []int | []int{} | +| [proxy-body-size](#proxy-body-size) | string | "1m" | +| [proxy-connect-timeout](#proxy-connect-timeout) | int | 5 | +| [proxy-read-timeout](#proxy-read-timeout) | int | 60 | +| [proxy-send-timeout](#proxy-send-timeout) | int | 60 | +| [proxy-buffers-number](#proxy-buffers-number) | int | 4 | +| [proxy-buffer-size](#proxy-buffer-size) | string | "4k" | +| [proxy-cookie-path](#proxy-cookie-path) | string | "off" | +| [proxy-cookie-domain](#proxy-cookie-domain) | string | "off" | +| [proxy-next-upstream](#proxy-next-upstream) | string | "error timeout" | +| [proxy-next-upstream-timeout](#proxy-next-upstream-timeout) | int | 0 | +| [proxy-next-upstream-tries](#proxy-next-upstream-tries) | int | 3 | +| [proxy-redirect-from](#proxy-redirect-from) | string | "off" | +| [proxy-request-buffering](#proxy-request-buffering) | string | "on" | +| [ssl-redirect](#ssl-redirect) | bool | "true" | +| [force-ssl-redirect](#force-ssl-redirect) | bool | "false" | +| [denylist-source-range](#denylist-source-range) | []string | []string{} | +| [whitelist-source-range](#whitelist-source-range) | []string | []string{} | +| [skip-access-log-urls](#skip-access-log-urls) | []string | []string{} | +| [limit-rate](#limit-rate) | int | 0 | +| [limit-rate-after](#limit-rate-after) | int | 0 | +| [lua-shared-dicts](#lua-shared-dicts) | string | "" | +| [http-redirect-code](#http-redirect-code) | int | 308 | +| [proxy-buffering](#proxy-buffering) | string | "off" | +| [limit-req-status-code](#limit-req-status-code) | int | 503 | +| [limit-conn-status-code](#limit-conn-status-code) | int | 503 | +| [enable-syslog](#enable-syslog) | bool | false | +| [syslog-host](#syslog-host) | string | "" | +| [syslog-port](#syslog-port) | int | 514 | +| [no-tls-redirect-locations](#no-tls-redirect-locations) | string | "/.well-known/acme-challenge" | +| [global-auth-url](#global-auth-url) | string | "" | +| [global-auth-method](#global-auth-method) | string | "" | +| [global-auth-signin](#global-auth-signin) | string | "" | +| [global-auth-signin-redirect-param](#global-auth-signin-redirect-param) | string | "rd" | +| [global-auth-response-headers](#global-auth-response-headers) | string | "" | +| [global-auth-request-redirect](#global-auth-request-redirect) | string | "" | +| [global-auth-snippet](#global-auth-snippet) | string | "" | +| [global-auth-cache-key](#global-auth-cache-key) | string | "" | +| [global-auth-cache-duration](#global-auth-cache-duration) | string | "200 202 401 5m" | +| [no-auth-locations](#no-auth-locations) | string | "/.well-known/acme-challenge" | +| [block-cidrs](#block-cidrs) | []string | "" | +| [block-user-agents](#block-user-agents) | []string | "" | +| [block-referers](#block-referers) | []string | "" | +| [proxy-ssl-location-only](#proxy-ssl-location-only) | bool | "false" | +| [default-type](#default-type) | string | "text/html" | +| [global-rate-limit-memcached-host](#global-rate-limit) | string | "" | +| [global-rate-limit-memcached-port](#global-rate-limit) | int | 11211 | +| [global-rate-limit-memcached-connect-timeout](#global-rate-limit) | int | 50 | +| [global-rate-limit-memcached-max-idle-timeout](#global-rate-limit) | int | 10000 | +| [global-rate-limit-memcached-pool-size](#global-rate-limit) | int | 50 | +| [global-rate-limit-status-code](#global-rate-limit) | int | 429 | +| [service-upstream](#service-upstream) | bool | "false" | +| [ssl-reject-handshake](#ssl-reject-handshake) | bool | "false" | +| [debug-connections](#debug-connections) | []string | "127.0.0.1,1.1.1.1/24" | +| [enable-pathtype-validation](#enable-pathtype-validation) | bool | "false" | +| [path-additional-allowed-chars](#path-additional-allowed-chars) | string | "^%$[](){}*+?" | ## add-headers @@ -1329,7 +1329,7 @@ _**default:**_ "" _References:_ [http://nginx.org/en/docs/ngx_core_module.html#debug_connection](http://nginx.org/en/docs/ngx_core_module.html#debug_connection) -## disable-pathtype-validation +## enable-pathtype-validation Ingress Controller validates the pathType, and only allows special characters on "path" if pathType is ImplementationSpecific. @@ -1339,13 +1339,11 @@ will be 0-9, a-z, A-Z, "-", ".", "_", "~", "/". If the validation is disabled, the [#path-additional-allowed-chars](#path-additional-allowed-chars) will be allowed on any pathType. -This behavior can be disabled, so special characters are accepted regardless of pathType +This behavior is disabled by default, so special characters are accepted regardless of pathType _**default:**_ "false" ## path-additional-allowed-chars -When validating path on Ingress resources, defines the additional set of special characters that +When [enable-pathtype-validation](enable-pathtype-validation) is set to true [#path-additional-allowed-chars](#path-additional-allowed-chars) defines the additional set of special characters that will be allowed. -See also [#disable-pathtype-validation](#disable-pathtype-validation). - _**default:**_ "^%$[](){}*+?|" diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 8be92167d..b02e5998e 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -783,14 +783,15 @@ type Configuration struct { // Default: "" DebugConnections []string `json:"debug-connections"` - // DisablePathTypeValidation allows the admin to disable the pathType validation. - // If PathTypeValidation is enabled, the Controller will only allow alphanumeric + // EnablePathTypeValidation allows the admin to enable the pathType validation. + // If EnablePathTypeValidation is enabled, the Controller will only allow alphanumeric // characters on path (0-9, a-z, A-Z, "-", ".", "_", "~", "/") - DisablePathTypeValidation bool `json:"disable-pathtype-validation"` + // to control what characters are allowed set them with PathAdditionalAllowedChars + EnablePathTypeValidation bool `json:"enable-pathtype-validation"` // PathAdditionalAllowedChars allows the admin to specify what are the additional // characters allowed in case of pathType=ImplementationSpecific. - // Case disable-pathtype-validation=true, this characters will be allowed on any path. + // Case enable-pathtype-validation=true, this characters will be only allowed on ImplementationSpecific. // Defaults to: "^%$[](){}*+?" PathAdditionalAllowedChars string `json:"path-additional-allowed-chars"` } @@ -828,7 +829,7 @@ func NewDefault() Configuration { ClientHeaderTimeout: 60, ClientBodyBufferSize: "8k", ClientBodyTimeout: 60, - DisablePathTypeValidation: false, + EnablePathTypeValidation: false, PathAdditionalAllowedChars: "^%$[](){}*+?|", EnableUnderscoresInHeaders: false, ErrorLogLevel: errorLevel, diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 5b22fd17a..9812bd97e 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -325,7 +325,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { k8s.SetDefaultNGINXPathType(ing) - if err := utilingress.ValidateIngressPath(ing, cfg.DisablePathTypeValidation, cfg.PathAdditionalAllowedChars); err != nil { + if err := utilingress.ValidateIngressPath(ing, cfg.EnablePathTypeValidation, cfg.PathAdditionalAllowedChars); err != nil { return fmt.Errorf("ingress contains invalid characters: %s", err) } diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index d91760552..dab1e6e37 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -203,11 +203,11 @@ func TestCheckIngress(t *testing.T) { } t.Run("when validating pathType", func(t *testing.T) { - t.Run("When ingress contains invalid path and pathType validation is not disabled", func(t *testing.T) { + t.Run("When ingress contains invalid path and pathType validation is enabled", func(t *testing.T) { nginx.store = fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ - DisablePathTypeValidation: false, + EnablePathTypeValidation: true, }, } nginx.command = testNginxTestCommand{ @@ -253,7 +253,7 @@ func TestCheckIngress(t *testing.T) { nginx.store = fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ - DisablePathTypeValidation: true, + EnablePathTypeValidation: false, PathAdditionalAllowedChars: "^%$[](){}*+?|", }, } diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index 1006858e8..e0f6cfb54 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -846,7 +846,7 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) { copyIng := &networkingv1.Ingress{} ing.ObjectMeta.DeepCopyInto(©Ing.ObjectMeta) - if err := ingressutils.ValidateIngressPath(ing, s.backendConfig.DisablePathTypeValidation, s.backendConfig.PathAdditionalAllowedChars); err != nil { + if err := ingressutils.ValidateIngressPath(ing, s.backendConfig.EnablePathTypeValidation, s.backendConfig.PathAdditionalAllowedChars); err != nil { klog.Errorf("ingress %s contains invalid path and will be skipped: %s", key, err) return } diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index e16518251..acadad432 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -246,44 +246,65 @@ func BuildRedirects(servers []*ingress.Server) []*redirect { return redirectServers } -func ValidateIngressPath(copyIng *networkingv1.Ingress, disablePathTypeValidation bool, additionalChars string) error { +func ValidateIngressPath(copyIng *networkingv1.Ingress, enablePathTypeValidation bool, pathAdditionalAllowedChars string) error { if copyIng == nil { return nil } - escapedAdditionalChars := regexp.QuoteMeta(additionalChars) - regexPath, err := regexp.Compile("^[" + alphaNumericChars + escapedAdditionalChars + "]*$") + escapedPathAdditionalAllowedChars := regexp.QuoteMeta(pathAdditionalAllowedChars) + regexPath, err := regexp.Compile("^[" + alphaNumericChars + escapedPathAdditionalAllowedChars + "]*$") if err != nil { - return fmt.Errorf("ingress has misconfigured validation regex on configmap: %s - %w", additionalChars, err) + return fmt.Errorf("ingress has misconfigured validation regex on configmap: %s - %w", pathAdditionalAllowedChars, err) } for _, rule := range copyIng.Spec.Rules { + if rule.HTTP == nil { continue } - if err := checkPath(rule.HTTP.Paths, disablePathTypeValidation, regexPath); err != nil { + + if err := checkPath(rule.HTTP.Paths, enablePathTypeValidation, regexPath); err != nil { return fmt.Errorf("error validating ingressPath: %w", err) } } return nil } -func checkPath(paths []networkingv1.HTTPIngressPath, disablePathTypeValidation bool, regexSpecificChars *regexp.Regexp) error { +func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bool, regexSpecificChars *regexp.Regexp) error { + for _, path := range paths { if path.PathType == nil { path.PathType = &defaultPathType } - if disablePathTypeValidation || *path.PathType == networkingv1.PathTypeImplementationSpecific { + klog.V(9).InfoS("PathType Validation", "enablePathTypeValidation", enablePathTypeValidation, "regexSpecificChars", regexSpecificChars.String(), "Path", path.Path) + + switch pathType := *path.PathType; pathType { + case networkingv1.PathTypeImplementationSpecific: + //only match on regex chars per Ingress spec when path is implementation specific if !regexSpecificChars.MatchString(path.Path) { return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) } - continue - } - if !pathAlphaNumericRegex(path.Path) { - return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) + case networkingv1.PathTypeExact, networkingv1.PathTypePrefix: + //enforce path type validation + if enablePathTypeValidation { + //only allow alphanumeric chars, no regex chars + if !pathAlphaNumericRegex(path.Path) { + return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) + } + continue + } else { + //path validation is disabled, so we check what regex chars are allowed by user + if !regexSpecificChars.MatchString(path.Path) { + return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) + } + continue + } + + default: + return fmt.Errorf("unknown path type %v on path %v", *path.PathType, path.Path) } } return nil diff --git a/pkg/util/ingress/ingress_test.go b/pkg/util/ingress/ingress_test.go index a79da6b6f..3bd7f1230 100644 --- a/pkg/util/ingress/ingress_test.go +++ b/pkg/util/ingress/ingress_test.go @@ -212,11 +212,11 @@ const ( func TestValidateIngressPath(t *testing.T) { tests := []struct { - name string - copyIng *networkingv1.Ingress - disablePathTypeValidation bool - additionalChars string - wantErr bool + name string + copyIng *networkingv1.Ingress + EnablePathTypeValidation bool + additionalChars string + wantErr bool }{ { name: "should return nil when ingress = nil", @@ -251,49 +251,53 @@ func TestValidateIngressPath(t *testing.T) { { name: "should deny path with bad characters and pathType not implementationSpecific", wantErr: true, - additionalChars: defaultAdditionalChars, + additionalChars: "()", copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"), }, { - name: "should accept path with regex characters and pathType implementationSpecific", - wantErr: false, - additionalChars: defaultAdditionalChars, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), + name: "should accept path with regex characters and pathType implementationSpecific", + wantErr: false, + additionalChars: defaultAdditionalChars, + EnablePathTypeValidation: false, + copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), }, { - name: "should accept path with regex characters and pathType exact, but pathType validation disabled", - wantErr: false, - additionalChars: defaultAdditionalChars, - disablePathTypeValidation: true, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), + name: "should accept path with regex characters and pathType exact, but pathType validation disabled", + wantErr: false, + additionalChars: defaultAdditionalChars, + EnablePathTypeValidation: false, + copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"), }, { - name: "should reject path when the allowed additional set does not match", - wantErr: true, - additionalChars: "().?", - disablePathTypeValidation: false, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), + name: "should reject path when the allowed additional set does not match", + wantErr: true, + additionalChars: "().?", + EnablePathTypeValidation: false, + copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), }, { - name: "should accept path when the allowed additional set does match", - wantErr: false, - additionalChars: "().?", - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)"), + name: "should accept path when the allowed additional set does match", + wantErr: false, + additionalChars: "().?", + EnablePathTypeValidation: false, + copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)"), }, { - name: "should block if at least one path is bad", - wantErr: true, - copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.?)")), + name: "should block if at least one path is bad", + wantErr: true, + EnablePathTypeValidation: false, + copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.?)")), }, { - name: "should block if at least one path is bad", - wantErr: true, - copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")), + name: "should block if at least one path is bad", + wantErr: true, + EnablePathTypeValidation: false, + copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")), }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - if err := ValidateIngressPath(tt.copyIng, tt.disablePathTypeValidation, tt.additionalChars); (err != nil) != tt.wantErr { + if err := ValidateIngressPath(tt.copyIng, tt.EnablePathTypeValidation, tt.additionalChars); (err != nil) != tt.wantErr { t.Errorf("ValidateIngressPath() error = %v, wantErr %v", err, tt.wantErr) } }) diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index 5c037a0c5..e0f55df4e 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -160,9 +160,22 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid annotation value should return an error") }) - ginkgo.It("should reject ingress with bad characters and pathType != ImplementationSpecific", func() { + ginkgo.It("ADMISSION should not validate characters on ingress when validation of pathType is disabled", func() { host := "admission-test" + f.UpdateNginxConfigMapData("enable-pathtype-validation", "false") + + firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil) + firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix + _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex chars on path and pathType validation disabled should be accepted") + }) + + ginkgo.It("ADMISSION should reject ingress with bad characters and pathType != ImplementationSpecific", func() { + host := "admission-test" + + f.UpdateNginxConfigMapData("enable-pathtype-validation", "true") + firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil) firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) @@ -175,18 +188,7 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { }) - ginkgo.It("should not validate characters on ingress when validation of pathType is disabled", func() { - host := "admission-test" - - f.UpdateNginxConfigMapData("disable-pathtype-validation", "true") - - firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil) - firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix - _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex chars on path and pathType validation disabled should be accepted") - }) - - ginkgo.It("should return an error if there is a forbidden value in some annotation", func() { + ginkgo.It("ADMISSION should return an error if there is a forbidden value in some annotation", func() { host := "admission-test" annotations := map[string]string{ diff --git a/build/run-e2e-suite.sh b/test/e2e/run-e2e-suite.sh similarity index 97% rename from build/run-e2e-suite.sh rename to test/e2e/run-e2e-suite.sh index ae38b5fcc..7920c0523 100755 --- a/build/run-e2e-suite.sh +++ b/test/e2e/run-e2e-suite.sh @@ -14,10 +14,16 @@ # See the License for the specific language governing permissions and # limitations under the License. -if ! [ -z "$DEBUG" ]; then +if [ -n "$DEBUG" ]; then set -x +else + trap cleanup EXIT fi +function cleanup { + kubectl delete pod e2e 2>/dev/null || true +} + set -o errexit set -o nounset set -o pipefail @@ -43,16 +49,11 @@ if [ "$missing" = true ]; then exit 1 fi -function cleanup { - kubectl delete pod e2e 2>/dev/null || true -} -trap cleanup EXIT - E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS:-} FOCUS=${FOCUS:-.*} BASEDIR=$(dirname "$0") -NGINX_BASE_IMAGE=$(cat $BASEDIR/../NGINX_BASE) +NGINX_BASE_IMAGE=$(cat $BASEDIR/../../NGINX_BASE) export E2E_CHECK_LEAKS export FOCUS diff --git a/test/e2e/run.sh b/test/e2e/run-kind-e2e.sh similarity index 62% rename from test/e2e/run.sh rename to test/e2e/run-kind-e2e.sh index 17dad6c39..bb61706b4 100755 --- a/test/e2e/run.sh +++ b/test/e2e/run-kind-e2e.sh @@ -14,13 +14,6 @@ # See the License for the specific language governing permissions and # limitations under the License. -KIND_LOG_LEVEL="1" - -if ! [ -z $DEBUG ]; then - set -x - KIND_LOG_LEVEL="6" -fi - set -o errexit set -o nounset set -o pipefail @@ -31,45 +24,56 @@ cleanup() { fi kind delete cluster \ - --verbosity=${KIND_LOG_LEVEL} \ - --name ${KIND_CLUSTER_NAME} + --verbosity="${KIND_LOG_LEVEL}" \ + --name "${KIND_CLUSTER_NAME}" } -trap cleanup EXIT +DEBUG=${DEBUG:=false} +if [ "${DEBUG}" = "true" ]; then + set -x + KIND_LOG_LEVEL="6" +else + trap cleanup EXIT +fi + +KIND_LOG_LEVEL="1" +IS_CHROOT="${IS_CHROOT:-false}" export KIND_CLUSTER_NAME=${KIND_CLUSTER_NAME:-ingress-nginx-dev} +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +# Use 1.0.0-dev to make sure we use the latest configuration in the helm template +export TAG=1.0.0-dev +export ARCH=${ARCH:-amd64} +export REGISTRY=ingress-controller +NGINX_BASE_IMAGE=$(cat "$DIR"/../../NGINX_BASE) +export NGINX_BASE_IMAGE=$NGINX_BASE_IMAGE +export DOCKER_CLI_EXPERIMENTAL=enabled +export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/kind-config-$KIND_CLUSTER_NAME}" +SKIP_INGRESS_IMAGE_CREATION="${SKIP_INGRESS_IMAGE_CREATION:-false}" +SKIP_E2E_IMAGE_CREATION="${SKIP_E2E_IMAGE_CREATION:=false}" +SKIP_CLUSTER_CREATION="${SKIP_CLUSTER_CREATION:-false}" if ! command -v kind --version &> /dev/null; then echo "kind is not installed. Use the package manager or visit the official site https://kind.sigs.k8s.io/" exit 1 fi -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" - -# Use 1.0.0-dev to make sure we use the latest configuration in the helm template -export TAG=1.0.0-dev -export ARCH=${ARCH:-amd64} -export REGISTRY=ingress-controller - -NGINX_BASE_IMAGE=$(cat $DIR/../../NGINX_BASE) - echo "Running e2e with nginx base image ${NGINX_BASE_IMAGE}" -export NGINX_BASE_IMAGE=$NGINX_BASE_IMAGE - -export DOCKER_CLI_EXPERIMENTAL=enabled - -export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/kind-config-$KIND_CLUSTER_NAME}" - -if [ "${SKIP_CLUSTER_CREATION:-false}" = "false" ]; then +if [ "${SKIP_CLUSTER_CREATION}" = "false" ]; then echo "[dev-env] creating Kubernetes cluster with kind" export K8S_VERSION=${K8S_VERSION:-v1.25.2@sha256:9be91e9e9cdf116809841fc77ebdb8845443c4c72fe5218f3ae9eb57fdb4bace} + # delete the cluster if it exists + if kind get clusters | grep "${KIND_CLUSTER_NAME}"; then + kind delete cluster --name "${KIND_CLUSTER_NAME}" + fi + kind create cluster \ - --verbosity=${KIND_LOG_LEVEL} \ - --name ${KIND_CLUSTER_NAME} \ - --config ${DIR}/kind.yaml \ + --verbosity="${KIND_LOG_LEVEL}" \ + --name "${KIND_CLUSTER_NAME}" \ + --config "${DIR}"/kind.yaml \ --retain \ --image "kindest/node:${K8S_VERSION}" @@ -77,16 +81,26 @@ if [ "${SKIP_CLUSTER_CREATION:-false}" = "false" ]; then kubectl get nodes -o wide fi -if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then +if [ "${SKIP_INGRESS_IMAGE_CREATION}" = "false" ]; then + echo "[dev-env] building image" + if [ "${IS_CHROOT}" = "true" ]; then + make -C "${DIR}"/../../ clean-image build image-chroot + docker tag ${REGISTRY}/controller-chroot:${TAG} ${REGISTRY}/controller:${TAG} + else + make -C "${DIR}"/../../ clean-image build image + fi + + echo "[dev-env] .. done building controller images" +fi + +if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then go get github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 fi - echo "[dev-env] building image" - make -C ${DIR}/../../ clean-image build image image-chroot echo "[dev-env] .. done building controller images" echo "[dev-env] now building e2e-image.." - make -C ${DIR}/../e2e-image image + make -C "${DIR}"/../e2e-image image echo "[dev-env] ..done building e2e-image" fi @@ -95,13 +109,7 @@ KIND_WORKERS=$(kind get nodes --name="${KIND_CLUSTER_NAME}" | grep worker | awk echo "[dev-env] copying docker images to cluster..." -kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes=${KIND_WORKERS} nginx-ingress-controller:e2e - -if [ "${IS_CHROOT:-false}" = "true" ]; then - docker tag ${REGISTRY}/controller-chroot:${TAG} ${REGISTRY}/controller:${TAG} -fi - -kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes=${KIND_WORKERS} ${REGISTRY}/controller:${TAG} - +kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes="${KIND_WORKERS}" nginx-ingress-controller:e2e +kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes="${KIND_WORKERS}" "${REGISTRY}"/controller:"${TAG}" echo "[dev-env] running e2e tests..." -make -C ${DIR}/../../ e2e-test +make -C "${DIR}"/../../ e2e-test \ No newline at end of file From 8918135eeacbe90696ec8fd7f24e8c04203b46d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 31 Jan 2023 17:31:05 -0800 Subject: [PATCH 005/822] Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553) Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.80.1 to 2.90.0. - [Release notes](https://github.com/kubernetes/klog/releases) - [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes/klog/compare/v2.80.1...v2.90.0) --- updated-dependencies: - dependency-name: k8s.io/klog/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 03b3ebdb7..5224aefbe 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( k8s.io/client-go v0.26.1 k8s.io/code-generator v0.26.1 k8s.io/component-base v0.26.1 - k8s.io/klog/v2 v2.80.1 + k8s.io/klog/v2 v2.90.0 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.2 sigs.k8s.io/mdtoc v1.1.0 diff --git a/go.sum b/go.sum index 7588a51fb..0a7ed9440 100644 --- a/go.sum +++ b/go.sum @@ -756,8 +756,8 @@ k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/k k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= -k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/klog/v2 v2.90.0 h1:VkTxIV/FjRXn1fgNNcKGM8cfmL1Z33ZjXRTVxKCoF5M= +k8s.io/klog/v2 v2.90.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= From 141da0b1ec92d2fa959db539d849a0bde0c74e20 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 31 Jan 2023 17:33:06 -0800 Subject: [PATCH 006/822] Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.52.0 to 1.52.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.52.0...v1.52.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5224aefbe..10b9e2fda 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.5.0 - google.golang.org/grpc v1.52.0 + google.golang.org/grpc v1.52.3 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 0a7ed9440..6e370c655 100644 --- a/go.sum +++ b/go.sum @@ -679,8 +679,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk= -google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= +google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ= +google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 90c857d8e59124fc600be89ac80ee3fc6e9d930a Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 31 Jan 2023 21:16:48 -0500 Subject: [PATCH 007/822] build release 1.6.1 image Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index b7c0a9b1d..023604509 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.6.0 +v1.6.1 From 254b814985f8b46510fb1ab2c7f492ac76ad3b4f Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 1 Feb 2023 16:51:36 -0500 Subject: [PATCH 008/822] add lint on chart before release (#9570) Signed-off-by: James Strong --- .github/workflows/helm.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 5d96507a1..2bd271bb2 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -25,6 +25,18 @@ jobs: - name: Checkout uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + - name: Run Artifact Hub lint + run: | + wget https://github.com/artifacthub/hub/releases/download/v1.5.0/ah_1.5.0_linux_amd64.tar.gz + echo 'ad0e44c6ea058ab6b85dbf582e88bad9fdbc64ded0d1dd4edbac65133e5c87da *ah_1.5.0_linux_amd64.tar.gz' | shasum -c + tar -xzvf ah_1.5.0_linux_amd64.tar.gz ah + ./ah lint -p charts/ingress-nginx || exit 1 + rm -f ./ah ./ah_1.5.0_linux_amd64.tar.gz + + - name: Lint + run: | + ./build/run-in-docker.sh ./hack/verify-chart-lint.sh + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: From 6c41f19b55ae950885eecd34511f4f1567f11f6a Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 2 Feb 2023 14:28:43 -0500 Subject: [PATCH 009/822] add path validation to implementation specific as well (#9573) Signed-off-by: James Strong --- pkg/util/ingress/ingress.go | 8 +++++--- pkg/util/ingress/ingress_test.go | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index acadad432..91243e2cc 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -282,9 +282,11 @@ func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bo switch pathType := *path.PathType; pathType { case networkingv1.PathTypeImplementationSpecific: - //only match on regex chars per Ingress spec when path is implementation specific - if !regexSpecificChars.MatchString(path.Path) { - return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) + if enablePathTypeValidation { + //only match on regex chars per Ingress spec when path is implementation specific + if !regexSpecificChars.MatchString(path.Path) { + return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) + } } case networkingv1.PathTypeExact, networkingv1.PathTypePrefix: diff --git a/pkg/util/ingress/ingress_test.go b/pkg/util/ingress/ingress_test.go index 3bd7f1230..12c2ff1da 100644 --- a/pkg/util/ingress/ingress_test.go +++ b/pkg/util/ingress/ingress_test.go @@ -272,7 +272,7 @@ func TestValidateIngressPath(t *testing.T) { name: "should reject path when the allowed additional set does not match", wantErr: true, additionalChars: "().?", - EnablePathTypeValidation: false, + EnablePathTypeValidation: true, copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), }, { @@ -291,7 +291,7 @@ func TestValidateIngressPath(t *testing.T) { { name: "should block if at least one path is bad", wantErr: true, - EnablePathTypeValidation: false, + EnablePathTypeValidation: true, copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")), }, } From 3348a6038edb72e19681ce273148d26ba54abea9 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 2 Feb 2023 14:48:36 -0500 Subject: [PATCH 010/822] build 1.6.2 to fix #9569 Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index 023604509..98610aa42 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.6.1 +v1.6.2 \ No newline at end of file From 60d9716b1f075c4eebc957cff831a5d351f8cfa2 Mon Sep 17 00:00:00 2001 From: Jongwoo Han Date: Mon, 6 Feb 2023 16:37:00 +0900 Subject: [PATCH 011/822] Replace deprecated command with environment file (#9581) Signed-off-by: jongwooo --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 67fad3187..b19031ff6 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -42,7 +42,7 @@ jobs: echo "${SHORT_TAGS[0]},${SHORT_TAGS[1]},${SHORT_TAGS[2]}" TAGS_JSON="[\"${SHORT_TAGS[0]}\",\"${SHORT_TAGS[1]}\",\"${SHORT_TAGS[2]}\"]" echo "${TAGS_JSON}" - echo "::set-output name=TAGS::${TAGS_JSON}" + echo "TAGS=${TAGS_JSON}" >> $GITHUB_OUTPUT scan: runs-on: ubuntu-latest From 460181b1de53f191df6d3f0a19915193cb253642 Mon Sep 17 00:00:00 2001 From: Ismayil Mirzali Date: Wed, 18 Jan 2023 15:10:34 +0200 Subject: [PATCH 012/822] Bump `client-go` to remove dependence on go-autorest dependency (#9488) * deps: bump k8s dependencies to remove go-autorest * fix: update use of apiv1.LoadBalancerIngress Due to changes in the Kubernetes API, we needed to switch to using v1.IngressLoadBalancerIngress instead of apiv1.LoadBalancerIngress. The struct is otherwise identical despite the name change. * fix ingress status test cases Signed-off-by: Jintao Zhang Signed-off-by: Ismayil Mirzali Signed-off-by: Jintao Zhang Signed-off-by: Ismayil Mirzali Co-authored-by: Jintao Zhang --- go.mod | 35 ++++----- go.sum | 83 +++++++-------------- internal/ingress/status/status.go | 45 ++++++------ internal/ingress/status/status_test.go | 99 +++++++++++++------------- test/e2e/status/update.go | 8 +-- 5 files changed, 114 insertions(+), 156 deletions(-) diff --git a/go.mod b/go.mod index 2daf8e667..780cac648 100644 --- a/go.mod +++ b/go.mod @@ -30,14 +30,14 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.25.4 - k8s.io/apiextensions-apiserver v0.25.0 - k8s.io/apimachinery v0.25.4 - k8s.io/apiserver v0.25.0 - k8s.io/cli-runtime v0.25.0 - k8s.io/client-go v0.25.4 - k8s.io/code-generator v0.25.0 - k8s.io/component-base v0.25.4 + k8s.io/api v0.26.0 + k8s.io/apiextensions-apiserver v0.26.0 + k8s.io/apimachinery v0.26.0 + k8s.io/apiserver v0.26.0 + k8s.io/cli-runtime v0.26.0 + k8s.io/client-go v0.26.0 + k8s.io/code-generator v0.26.0 + k8s.io/component-base v0.26.0 k8s.io/klog/v2 v2.80.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.13.1 @@ -45,17 +45,7 @@ require ( ) require ( - cloud.google.com/go/compute v1.12.1 // indirect - cloud.google.com/go/compute/metadata v0.2.1 // indirect - github.com/Azure/go-autorest v14.2.0+incompatible // indirect - github.com/Azure/go-autorest/autorest v0.11.27 // indirect - github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect - github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect - github.com/Azure/go-autorest/logger v0.2.1 // indirect - github.com/Azure/go-autorest/tracing v0.6.0 // indirect github.com/BurntSushi/toml v1.0.0 // indirect - github.com/PuerkitoBio/purell v1.1.1 // indirect - github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/cespare/xxhash/v2 v2.1.2 // indirect @@ -70,11 +60,10 @@ require ( github.com/go-errors/errors v1.0.1 // indirect github.com/go-logr/logr v1.2.3 // indirect github.com/go-openapi/jsonpointer v0.19.5 // indirect - github.com/go-openapi/jsonreference v0.19.5 // indirect + github.com/go-openapi/jsonreference v0.20.0 // indirect github.com/go-openapi/swag v0.19.14 // indirect github.com/godbus/dbus/v5 v5.0.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang-jwt/jwt/v4 v4.2.0 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.2 // indirect github.com/gomarkdown/markdown v0.0.0-20210514010506-3b9f47219fe7 // indirect @@ -123,9 +112,9 @@ require ( gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - k8s.io/gengo v0.0.0-20211129171323-c02415ce4185 // indirect - k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect - k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect + k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect + k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect + k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect sigs.k8s.io/kustomize/api v0.12.1 // indirect sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect diff --git a/go.sum b/go.sum index 84a8bb106..f03756bab 100644 --- a/go.sum +++ b/go.sum @@ -19,10 +19,6 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= -cloud.google.com/go/compute v1.12.1 h1:gKVJMEyqV5c/UnpzjjQbo3Rjvvqpr9B1DFSbJC4OXr0= -cloud.google.com/go/compute v1.12.1/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU= -cloud.google.com/go/compute/metadata v0.2.1 h1:efOwf5ymceDhK6PKMnnrTHP4pppY5L22mle96M1yP48= -cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM= cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= @@ -35,30 +31,10 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= -github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs= -github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24= -github.com/Azure/go-autorest/autorest v0.11.27 h1:F3R3q42aWytozkV8ihzcgMO4OA4cuqr3bNlsEuF6//A= -github.com/Azure/go-autorest/autorest v0.11.27/go.mod h1:7l8ybrIdUmGqZMTD0sRtAr8NvbHjfofbf8RSP2q7w7U= -github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ= -github.com/Azure/go-autorest/autorest/adal v0.9.20 h1:gJ3E98kMpFB1MFqQCvA1yFab8vthOeD4VlFRQULxahg= -github.com/Azure/go-autorest/autorest/adal v0.9.20/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ= -github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw= -github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74= -github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k= -github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw= -github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU= -github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg= -github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= -github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo= -github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v1.0.0 h1:dtDWrepsVPfW9H/4y7dDgFc2MBUSeJhlaDtK13CxFlU= github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= -github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI= -github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= -github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M= -github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= @@ -126,7 +102,6 @@ github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vb github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= -github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= @@ -135,8 +110,8 @@ github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY= github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonreference v0.19.5 h1:1WJP/wi4OjB4iV8KVbH73rQaoialJrqv8gitZLxGLtM= -github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg= +github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA= +github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo= github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= @@ -147,9 +122,6 @@ github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= -github.com/golang-jwt/jwt/v4 v4.2.0 h1:besgBTC8w8HjP6NzQdxwKH9Z5oQMZ24ThTrHp3cZ8eU= -github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= @@ -362,7 +334,6 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE= github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= -github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA= github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= @@ -421,8 +392,6 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE= golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -471,7 +440,6 @@ golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -490,7 +458,6 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw= golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= @@ -511,7 +478,6 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -750,32 +716,31 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.25.4 h1:3YO8J4RtmG7elEgaWMb4HgmpS2CfY1QlaOz9nwB+ZSs= -k8s.io/api v0.25.4/go.mod h1:IG2+RzyPQLllQxnhzD8KQNEu4c4YvyDTpSMztf4A0OQ= -k8s.io/apiextensions-apiserver v0.25.0 h1:CJ9zlyXAbq0FIW8CD7HHyozCMBpDSiH7EdrSTCZcZFY= -k8s.io/apiextensions-apiserver v0.25.0/go.mod h1:3pAjZiN4zw7R8aZC5gR0y3/vCkGlAjCazcg1me8iB/E= -k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc= -k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo= -k8s.io/apiserver v0.25.0 h1:8kl2ifbNffD440MyvHtPaIz1mw4mGKVgWqM0nL+oyu4= -k8s.io/apiserver v0.25.0/go.mod h1:BKwsE+PTC+aZK+6OJQDPr0v6uS91/HWxX7evElAH6xo= -k8s.io/cli-runtime v0.25.0 h1:XBnTc2Fi+w818jcJGzhiJKQuXl8479sZ4FhtV5hVJ1Q= -k8s.io/cli-runtime v0.25.0/go.mod h1:bHOI5ZZInRHhbq12OdUiYZQN8ml8aKZLwQgt9QlLINw= -k8s.io/client-go v0.25.4 h1:3RNRDffAkNU56M/a7gUfXaEzdhZlYhoW8dgViGy5fn8= -k8s.io/client-go v0.25.4/go.mod h1:8trHCAC83XKY0wsBIpbirZU4NTUpbuhc2JnI7OruGZw= -k8s.io/code-generator v0.25.0 h1:QP8fJuXu882ztf6dsqJsso/Btm94pMd68TAZC1rE6KI= -k8s.io/code-generator v0.25.0/go.mod h1:B6jZgI3DvDFAualltPitbYMQ74NjaCFxum3YeKZZ+3w= -k8s.io/component-base v0.25.4 h1:n1bjg9Yt+G1C0WnIDJmg2fo6wbEU1UGMRiQSjmj7hNQ= -k8s.io/component-base v0.25.4/go.mod h1:nnZJU8OP13PJEm6/p5V2ztgX2oyteIaAGKGMYb2L2cY= -k8s.io/gengo v0.0.0-20211129171323-c02415ce4185 h1:TT1WdmqqXareKxZ/oNXEUSwKlLiHzPMyB0t8BaFeBYI= -k8s.io/gengo v0.0.0-20211129171323-c02415ce4185/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= -k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE= +k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I= +k8s.io/api v0.26.0/go.mod h1:k6HDTaIFC8yn1i6pSClSqIwLABIcLV9l5Q4EcngKnQg= +k8s.io/apiextensions-apiserver v0.26.0 h1:Gy93Xo1eg2ZIkNX/8vy5xviVSxwQulsnUdQ00nEdpDo= +k8s.io/apiextensions-apiserver v0.26.0/go.mod h1:7ez0LTiyW5nq3vADtK6C3kMESxadD51Bh6uz3JOlqWQ= +k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg= +k8s.io/apimachinery v0.26.0/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= +k8s.io/apiserver v0.26.0 h1:q+LqIK5EZwdznGZb8bq0+a+vCqdeEEe4Ux3zsOjbc4o= +k8s.io/apiserver v0.26.0/go.mod h1:aWhlLD+mU+xRo+zhkvP/gFNbShI4wBDHS33o0+JGI84= +k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= +k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= +k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8= +k8s.io/client-go v0.26.0/go.mod h1:I2Sh57A79EQsDmn7F7ASpmru1cceh3ocVT9KlX2jEZg= +k8s.io/code-generator v0.26.0 h1:ZDY+7Gic9p/lACgD1G72gQg2CvNGeAYZTPIncv+iALM= +k8s.io/code-generator v0.26.0/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= +k8s.io/component-base v0.26.0 h1:0IkChOCohtDHttmKuz+EP3j3+qKmV55rM9gIFTXA7Vs= +k8s.io/component-base v0.26.0/go.mod h1:lqHwlfV1/haa14F/Z5Zizk5QmzaVf23nQzCwVOQpfC8= +k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= +k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= -k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 h1:MQ8BAZPZlWk3S9K4a9NCkIFQtZShWqoha7snGixVgEA= -k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU= -k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed h1:jAne/RjBTyawwAy0utX5eqigAwz/lQhTmy+Hr/Cpue4= -k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= +k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= +k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= +k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs= +k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 h1:SAElp8THCfmBdM+4lmWX5gebiSSkEr7PAYDVF91qpfg= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R5A2EgsVzG8RTt4RfPoQuRAcDmg= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= diff --git a/internal/ingress/status/status.go b/internal/ingress/status/status.go index 2e53682a0..eac1f6cb0 100644 --- a/internal/ingress/status/status.go +++ b/internal/ingress/status/status.go @@ -19,6 +19,7 @@ package status import ( "context" "fmt" + v1 "k8s.io/api/networking/v1" "net" "regexp" "sort" @@ -128,7 +129,7 @@ func (s statusSync) Shutdown() { } klog.InfoS("removing value from ingress status", "address", addrs) - s.updateStatus([]apiv1.LoadBalancerIngress{}) + s.updateStatus([]v1.IngressLoadBalancerIngress{}) } func (s *statusSync) sync(key interface{}) error { @@ -160,21 +161,21 @@ func NewStatusSyncer(config Config) Syncer { return st } -func nameOrIPToLoadBalancerIngress(nameOrIP string) apiv1.LoadBalancerIngress { +func nameOrIPToLoadBalancerIngress(nameOrIP string) v1.IngressLoadBalancerIngress { if net.ParseIP(nameOrIP) != nil { - return apiv1.LoadBalancerIngress{IP: nameOrIP} + return v1.IngressLoadBalancerIngress{IP: nameOrIP} } - return apiv1.LoadBalancerIngress{Hostname: nameOrIP} + return v1.IngressLoadBalancerIngress{Hostname: nameOrIP} } // runningAddresses returns a list of IP addresses and/or FQDN where the // ingress controller is currently running -func (s *statusSync) runningAddresses() ([]apiv1.LoadBalancerIngress, error) { +func (s *statusSync) runningAddresses() ([]v1.IngressLoadBalancerIngress, error) { if s.PublishStatusAddress != "" { re := regexp.MustCompile(`,\s*`) multipleAddrs := re.Split(s.PublishStatusAddress, -1) - addrs := make([]apiv1.LoadBalancerIngress, len(multipleAddrs)) + addrs := make([]v1.IngressLoadBalancerIngress, len(multipleAddrs)) for i, addr := range multipleAddrs { addrs[i] = nameOrIPToLoadBalancerIngress(addr) } @@ -193,7 +194,7 @@ func (s *statusSync) runningAddresses() ([]apiv1.LoadBalancerIngress, error) { return nil, err } - addrs := make([]apiv1.LoadBalancerIngress, 0) + addrs := make([]v1.IngressLoadBalancerIngress, 0) for i := range pods.Items { pod := pods.Items[i] // only Running pods are valid @@ -250,7 +251,7 @@ func (s *statusSync) isRunningMultiplePods() bool { // standardizeLoadBalancerIngresses sorts the list of loadbalancer by // IP -func standardizeLoadBalancerIngresses(lbi []apiv1.LoadBalancerIngress) []apiv1.LoadBalancerIngress { +func standardizeLoadBalancerIngresses(lbi []v1.IngressLoadBalancerIngress) []v1.IngressLoadBalancerIngress { sort.SliceStable(lbi, func(a, b int) bool { return lbi[a].IP < lbi[b].IP }) @@ -259,7 +260,7 @@ func standardizeLoadBalancerIngresses(lbi []apiv1.LoadBalancerIngress) []apiv1.L } // updateStatus changes the status information of Ingress rules -func (s *statusSync) updateStatus(newIngressPoint []apiv1.LoadBalancerIngress) { +func (s *statusSync) updateStatus(newIngressPoint []v1.IngressLoadBalancerIngress) { ings := s.IngressLister.ListIngresses() p := pool.NewLimited(10) @@ -283,7 +284,7 @@ func (s *statusSync) updateStatus(newIngressPoint []apiv1.LoadBalancerIngress) { batch.WaitAll() } -func runUpdate(ing *ingress.Ingress, status []apiv1.LoadBalancerIngress, +func runUpdate(ing *ingress.Ingress, status []v1.IngressLoadBalancerIngress, client clientset.Interface) pool.WorkFunc { return func(wu pool.WorkUnit) (interface{}, error) { if wu.IsCancelled() { @@ -307,7 +308,7 @@ func runUpdate(ing *ingress.Ingress, status []apiv1.LoadBalancerIngress, } } -func lessLoadBalancerIngress(addrs []apiv1.LoadBalancerIngress) func(int, int) bool { +func lessLoadBalancerIngress(addrs []v1.IngressLoadBalancerIngress) func(int, int) bool { return func(a, b int) bool { switch strings.Compare(addrs[a].Hostname, addrs[b].Hostname) { case -1: @@ -319,7 +320,7 @@ func lessLoadBalancerIngress(addrs []apiv1.LoadBalancerIngress) func(int, int) b } } -func ingressSliceEqual(lhs, rhs []apiv1.LoadBalancerIngress) bool { +func ingressSliceEqual(lhs, rhs []v1.IngressLoadBalancerIngress) bool { if len(lhs) != len(rhs) { return false } @@ -336,7 +337,7 @@ func ingressSliceEqual(lhs, rhs []apiv1.LoadBalancerIngress) bool { return true } -func statusAddressFromService(service string, kubeClient clientset.Interface) ([]apiv1.LoadBalancerIngress, error) { +func statusAddressFromService(service string, kubeClient clientset.Interface) ([]v1.IngressLoadBalancerIngress, error) { ns, name, _ := k8s.ParseNameNS(service) svc, err := kubeClient.CoreV1().Services(ns).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { @@ -345,28 +346,28 @@ func statusAddressFromService(service string, kubeClient clientset.Interface) ([ switch svc.Spec.Type { case apiv1.ServiceTypeExternalName: - return []apiv1.LoadBalancerIngress{{ + return []v1.IngressLoadBalancerIngress{{ Hostname: svc.Spec.ExternalName, }}, nil case apiv1.ServiceTypeClusterIP: - return []apiv1.LoadBalancerIngress{{ + return []v1.IngressLoadBalancerIngress{{ IP: svc.Spec.ClusterIP, }}, nil case apiv1.ServiceTypeNodePort: if svc.Spec.ExternalIPs == nil { - return []apiv1.LoadBalancerIngress{{ + return []v1.IngressLoadBalancerIngress{{ IP: svc.Spec.ClusterIP, }}, nil } - addrs := make([]apiv1.LoadBalancerIngress, len(svc.Spec.ExternalIPs)) + addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Spec.ExternalIPs)) for i, ip := range svc.Spec.ExternalIPs { - addrs[i] = apiv1.LoadBalancerIngress{IP: ip} + addrs[i] = v1.IngressLoadBalancerIngress{IP: ip} } return addrs, nil case apiv1.ServiceTypeLoadBalancer: - addrs := make([]apiv1.LoadBalancerIngress, len(svc.Status.LoadBalancer.Ingress)) + addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Status.LoadBalancer.Ingress)) for i, ingress := range svc.Status.LoadBalancer.Ingress { - addrs[i] = apiv1.LoadBalancerIngress{} + addrs[i] = v1.IngressLoadBalancerIngress{} if ingress.Hostname != "" { addrs[i].Hostname = ingress.Hostname } @@ -376,7 +377,7 @@ func statusAddressFromService(service string, kubeClient clientset.Interface) ([ } for _, ip := range svc.Spec.ExternalIPs { if !stringInIngresses(ip, addrs) { - addrs = append(addrs, apiv1.LoadBalancerIngress{IP: ip}) + addrs = append(addrs, v1.IngressLoadBalancerIngress{IP: ip}) } } return addrs, nil @@ -386,7 +387,7 @@ func statusAddressFromService(service string, kubeClient clientset.Interface) ([ } // stringInSlice returns true if s is in list -func stringInIngresses(s string, list []apiv1.LoadBalancerIngress) bool { +func stringInIngresses(s string, list []v1.IngressLoadBalancerIngress) bool { for _, v := range list { if v.IP == s || v.Hostname == s { return true diff --git a/internal/ingress/status/status_test.go b/internal/ingress/status/status_test.go index d4ef09e7c..3dd56f37d 100644 --- a/internal/ingress/status/status_test.go +++ b/internal/ingress/status/status_test.go @@ -34,8 +34,8 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) -func buildLoadBalancerIngressByIP() []apiv1.LoadBalancerIngress { - return []apiv1.LoadBalancerIngress{ +func buildLoadBalancerIngressByIP() []networking.IngressLoadBalancerIngress { + return []networking.IngressLoadBalancerIngress{ { IP: "10.0.0.1", Hostname: "foo1", @@ -123,17 +123,20 @@ func buildSimpleClientSet() *testclient.Clientset { }, }}, &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Status: apiv1.ServiceStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: buildLoadBalancerIngressByIP(), - }, - }, - }, + // This is commented out as the ServiceStatus.LoadBalancer field expects a LoadBalancerStatus object + // which is incompatible with the current Ingress struct which expects a IngressLoadBalancerStatus object + // TODO: update this service when the ServiceStatus struct gets updated + //{ + // ObjectMeta: metav1.ObjectMeta{ + // Name: "foo", + // Namespace: apiv1.NamespaceDefault, + // }, + // Status: apiv1.ServiceStatus{ + // LoadBalancer: apiv1.LoadBalancerStatus{ + // Ingress: buildLoadBalancerIngressByIP(), + // }, + // }, + //}, { ObjectMeta: metav1.ObjectMeta{ Name: "foo_non_exist", @@ -199,8 +202,8 @@ func buildExtensionsIngresses() []networking.Ingress { Namespace: apiv1.NamespaceDefault, }, Status: networking.IngressStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ + LoadBalancer: networking.IngressLoadBalancerStatus{ + Ingress: []networking.IngressLoadBalancerIngress{ { IP: "10.0.0.1", Hostname: "foo1", @@ -218,8 +221,8 @@ func buildExtensionsIngresses() []networking.Ingress { }, }, Status: networking.IngressStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ + LoadBalancer: networking.IngressLoadBalancerStatus{ + Ingress: []networking.IngressLoadBalancerIngress{ { IP: "0.0.0.0", Hostname: "foo.bar.com", @@ -234,8 +237,8 @@ func buildExtensionsIngresses() []networking.Ingress { Namespace: apiv1.NamespaceDefault, }, Status: networking.IngressStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{}, + LoadBalancer: networking.IngressLoadBalancerStatus{ + Ingress: []networking.IngressLoadBalancerIngress{}, }, }, }, @@ -261,7 +264,7 @@ func (til *testIngressLister) ListIngresses() []*ingress.Ingress { Namespace: apiv1.NamespaceDefault, }, Status: networking.IngressStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ + LoadBalancer: networking.IngressLoadBalancerStatus{ Ingress: buildLoadBalancerIngressByIP(), }, }, @@ -325,7 +328,7 @@ func TestStatusActions(t *testing.T) { fk.sync("just-test") // PublishService is empty, so the running address is: ["11.0.0.2"] // after updated, the ingress's ip should only be "11.0.0.2" - newIPs := []apiv1.LoadBalancerIngress{{ + newIPs := []networking.IngressLoadBalancerIngress{{ IP: "11.0.0.2", }} fooIngress1, err1 := fk.Client.NetworkingV1().Ingresses(apiv1.NamespaceDefault).Get(context.TODO(), "foo_ingress_1", metav1.GetOptions{}) @@ -342,7 +345,7 @@ func TestStatusActions(t *testing.T) { // execute shutdown fk.Shutdown() // ingress should be empty - newIPs2 := []apiv1.LoadBalancerIngress{} + var newIPs2 []networking.IngressLoadBalancerIngress fooIngress2, err2 := fk.Client.NetworkingV1().Ingresses(apiv1.NamespaceDefault).Get(context.TODO(), "foo_ingress_1", metav1.GetOptions{}) if err2 != nil { t.Fatalf("unexpected error") @@ -382,7 +385,7 @@ func TestKeyfunc(t *testing.T) { func TestRunningAddressesWithPublishService(t *testing.T) { testCases := map[string]struct { fakeClient *testclient.Clientset - expected []apiv1.LoadBalancerIngress + expected []networking.IngressLoadBalancerIngress errExpected bool }{ "service type ClusterIP": { @@ -416,7 +419,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, }, ), - []apiv1.LoadBalancerIngress{ + []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, }, false, @@ -437,7 +440,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, }, ), - []apiv1.LoadBalancerIngress{ + []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, }, false, @@ -458,7 +461,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, }, ), - []apiv1.LoadBalancerIngress{ + []networking.IngressLoadBalancerIngress{ {Hostname: "foo.bar"}, }, false, @@ -495,7 +498,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, }, ), - []apiv1.LoadBalancerIngress{ + []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, {Hostname: "foo"}, { @@ -530,7 +533,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, }, ), - []apiv1.LoadBalancerIngress{ + []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, }, false, @@ -568,7 +571,7 @@ func TestRunningAddressesWithPublishService(t *testing.T) { } if ra == nil { - t.Fatalf("returned nil but expected valid []apiv1.LoadBalancerIngress") + t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } if !reflect.DeepEqual(tc.expected, ra) { @@ -584,7 +587,7 @@ func TestRunningAddressesWithPods(t *testing.T) { r, _ := fk.runningAddresses() if r == nil { - t.Fatalf("returned nil but expected valid []apiv1.LoadBalancerIngress") + t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } rl := len(r) if len(r) != 1 { @@ -592,7 +595,7 @@ func TestRunningAddressesWithPods(t *testing.T) { } rv := r[0] if rv.IP != "11.0.0.2" { - t.Errorf("returned %v but expected %v", rv, apiv1.LoadBalancerIngress{IP: "11.0.0.2"}) + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "11.0.0.2"}) } } @@ -602,7 +605,7 @@ func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { ra, _ := fk.runningAddresses() if ra == nil { - t.Fatalf("returned nil but expected valid []apiv1.LoadBalancerIngress") + t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } rl := len(ra) if len(ra) != 1 { @@ -610,7 +613,7 @@ func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { } rv := ra[0] if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, apiv1.LoadBalancerIngress{IP: "127.0.0.1"}) + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) } } @@ -620,7 +623,7 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { ra, _ := fk.runningAddresses() if ra == nil { - t.Fatalf("returned nil but expected valid []apiv1.LoadBalancerIngress") + t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } rl := len(ra) if len(ra) != 2 { @@ -629,10 +632,10 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { rv := ra[0] rv2 := ra[1] if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, apiv1.LoadBalancerIngress{IP: "127.0.0.1"}) + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) } if rv2.IP != "1.1.1.1" { - t.Errorf("returned %v but expected %v", rv2, apiv1.LoadBalancerIngress{IP: "1.1.1.1"}) + t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) } } @@ -642,7 +645,7 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { ra, _ := fk.runningAddresses() if ra == nil { - t.Fatalf("returned nil but expected valid []apiv1.LoadBalancerIngresst") + t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngresst") } rl := len(ra) if len(ra) != 2 { @@ -651,15 +654,15 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { rv := ra[0] rv2 := ra[1] if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, apiv1.LoadBalancerIngress{IP: "127.0.0.1"}) + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) } if rv2.IP != "1.1.1.1" { - t.Errorf("returned %v but expected %v", rv2, apiv1.LoadBalancerIngress{IP: "1.1.1.1"}) + t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) } } func TestStandardizeLoadBalancerIngresses(t *testing.T) { - fkEndpoints := []apiv1.LoadBalancerIngress{ + fkEndpoints := []networking.IngressLoadBalancerIngress{ {IP: "2001:db8::68"}, {IP: "10.0.0.1"}, {Hostname: "opensource-k8s-ingress"}, @@ -668,7 +671,7 @@ func TestStandardizeLoadBalancerIngresses(t *testing.T) { r := standardizeLoadBalancerIngresses(fkEndpoints) if r == nil { - t.Fatalf("returned nil but expected a valid []apiv1.LoadBalancerIngress") + t.Fatalf("returned nil but expected a valid []networking.IngressLoadBalancerIngress") } rl := len(r) if rl != 3 { @@ -676,21 +679,21 @@ func TestStandardizeLoadBalancerIngresses(t *testing.T) { } re1 := r[0] if re1.Hostname != "opensource-k8s-ingress" { - t.Fatalf("returned %v but expected %v", re1, apiv1.LoadBalancerIngress{Hostname: "opensource-k8s-ingress"}) + t.Fatalf("returned %v but expected %v", re1, networking.IngressLoadBalancerIngress{Hostname: "opensource-k8s-ingress"}) } re2 := r[1] if re2.IP != "10.0.0.1" { - t.Fatalf("returned %v but expected %v", re2, apiv1.LoadBalancerIngress{IP: "10.0.0.1"}) + t.Fatalf("returned %v but expected %v", re2, networking.IngressLoadBalancerIngress{IP: "10.0.0.1"}) } re3 := r[2] if re3.IP != "2001:db8::68" { - t.Fatalf("returned %v but expected %v", re3, apiv1.LoadBalancerIngress{IP: "2001:db8::68"}) + t.Fatalf("returned %v but expected %v", re3, networking.IngressLoadBalancerIngress{IP: "2001:db8::68"}) } } func TestIngressSliceEqual(t *testing.T) { fk1 := buildLoadBalancerIngressByIP() - fk2 := append(buildLoadBalancerIngressByIP(), apiv1.LoadBalancerIngress{ + fk2 := append(buildLoadBalancerIngressByIP(), networking.IngressLoadBalancerIngress{ IP: "10.0.0.5", Hostname: "foo5", }) @@ -700,8 +703,8 @@ func TestIngressSliceEqual(t *testing.T) { fk4[2].IP = "11.0.0.3" fooTests := []struct { - lhs []apiv1.LoadBalancerIngress - rhs []apiv1.LoadBalancerIngress + lhs []networking.IngressLoadBalancerIngress + rhs []networking.IngressLoadBalancerIngress er bool }{ {fk1, fk1, true}, @@ -710,7 +713,7 @@ func TestIngressSliceEqual(t *testing.T) { {fk4, fk1, false}, {fk1, nil, false}, {nil, nil, true}, - {[]apiv1.LoadBalancerIngress{}, []apiv1.LoadBalancerIngress{}, true}, + {[]networking.IngressLoadBalancerIngress{}, []networking.IngressLoadBalancerIngress{}, true}, } for _, fooTest := range fooTests { diff --git a/test/e2e/status/update.go b/test/e2e/status/update.go index c9c6ef333..8bedc4d4e 100644 --- a/test/e2e/status/update.go +++ b/test/e2e/status/update.go @@ -19,6 +19,7 @@ package settings import ( "context" "fmt" + v1 "k8s.io/api/networking/v1" "log" "net" "strings" @@ -28,7 +29,6 @@ import ( "github.com/stretchr/testify/assert" appsv1 "k8s.io/api/apps/v1" - apiv1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/wait" @@ -87,7 +87,7 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { ing, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Get(context.TODO(), host, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error getting %s/%v Ingress", f.Namespace, host) - ing.Status.LoadBalancer.Ingress = []apiv1.LoadBalancerIngress{} + ing.Status.LoadBalancer.Ingress = []v1.IngressLoadBalancerIngress{} _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).UpdateStatus(context.TODO(), ing, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error cleaning Ingress status") framework.Sleep(10 * time.Second) @@ -121,9 +121,9 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { return true, nil }) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error waiting for ingress status") - assert.Equal(ginkgo.GinkgoT(), ing.Status.LoadBalancer.Ingress, ([]apiv1.LoadBalancerIngress{ + assert.Equal(ginkgo.GinkgoT(), ing.Status.LoadBalancer.Ingress, []v1.IngressLoadBalancerIngress{ {IP: "1.1.0.0"}, - })) + }) }) }) From 7f8f5f8f68a435948e86b78b76616a67d9d6a652 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 13 Jan 2023 08:54:28 -0500 Subject: [PATCH 013/822] start 1.6.0 release Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index c9b3c015f..05f629f1b 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.5.1 \ No newline at end of file +v1.6.0 \ No newline at end of file From 45632e586397520afee83449737b85de822e8b24 Mon Sep 17 00:00:00 2001 From: Zadkiel Aharonian Date: Thu, 19 Jan 2023 15:36:38 +0100 Subject: [PATCH 014/822] fix(grafana-dashboard): remove hardcoded namespace references (#9523) --- deploy/grafana/dashboards/nginx.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/deploy/grafana/dashboards/nginx.json b/deploy/grafana/dashboards/nginx.json index 85f93c9eb..3c3205b4a 100644 --- a/deploy/grafana/dashboards/nginx.json +++ b/deploy/grafana/dashboards/nginx.json @@ -1312,7 +1312,7 @@ "targets": [ { "exemplar": true, - "expr": "histogram_quantile(0.80, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\",exported_namespace=\"uat\"}[2m])) by (le))", + "expr": "histogram_quantile(0.80, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le))", "format": "time_series", "hide": false, "instant": false, @@ -1323,7 +1323,7 @@ }, { "exemplar": true, - "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\",exported_namespace=\"uat\"}[2m])) by (le))", + "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le))", "format": "time_series", "hide": false, "instant": false, @@ -1335,7 +1335,7 @@ { "editorMode": "code", "exemplar": true, - "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\",exported_namespace=\"uat\"}[2m])) by (le))", + "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le))", "format": "time_series", "hide": false, "instant": false, @@ -1377,7 +1377,7 @@ "targets": [ { "exemplar": true, - "expr": "sum(increase(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\",exported_namespace=\"uat\"}[2m])) by (le)", + "expr": "sum(increase(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le)", "format": "heatmap", "interval": "", "legendFormat": "{{le}}", From 87a9f1e007d9f37f194d699914a46409492d324a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 19 Jan 2023 06:48:35 -0800 Subject: [PATCH 015/822] Bump google.golang.org/grpc from 1.51.0 to 1.52.0 (#9512) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 780cac648..2412ad6db 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.5.0 - google.golang.org/grpc v1.51.0 + google.golang.org/grpc v1.52.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index f03756bab..6dc3d7f54 100644 --- a/go.sum +++ b/go.sum @@ -660,8 +660,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.51.0 h1:E1eGv1FTqoLIdnBCZufiSHgKjlqG6fKFf6pPWtMTh8U= -google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww= +google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk= +google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 82720c8e1dc1489a03d2a3bbfc949f49bacc5dc3 Mon Sep 17 00:00:00 2001 From: Harpreet singh Date: Thu, 19 Jan 2023 22:58:36 +0800 Subject: [PATCH 016/822] Add CORS template check inside location for externalAuth.SignURL (#8814) * Add CORS template check inside location for externalAuth.SignURL * Add testcase for CORS header for auth-signin redirect with CORS enabled. --- rootfs/etc/nginx/template/nginx.tmpl | 4 +++ test/e2e/annotations/auth.go | 45 ++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 911cf75ea..958397dd5 100755 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -1180,6 +1180,10 @@ stream { add_header Set-Cookie $auth_cookie; + {{ if $location.CorsConfig.CorsEnabled }} + {{ template "CORS" $location }} + {{ end }} + # Ensure that modsecurity will not run on an internal location as this is not accessible from outside {{ if $all.Cfg.EnableModsecurity }} modsecurity off; diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 1f0f4c3b2..e26fcbd46 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -720,6 +720,51 @@ http { }) }) + ginkgo.Context("when external authentication is configured along with CORS enabled", func() { + host := "auth" + var annotations map[string]string + var ing *networking.Ingress + + ginkgo.BeforeEach(func() { + f.NewHttpbinDeployment() + + var httpbinIP string + + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + assert.Nil(ginkgo.GinkgoT(), err) + + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + assert.Nil(ginkgo.GinkgoT(), err) + + httpbinIP = e.Subsets[0].Addresses[0].IP + + annotations = map[string]string{ + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", + "nginx.ingress.kubernetes.io/enable-cors": "true", + } + + ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, func(server string) bool { + return strings.Contains(server, "server_name auth") + }) + }) + + ginkgo.It("should redirect to signin url when not signed in along With CORS headers in response", func() { + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + WithQuery("a", "b"). + WithQuery("c", "d"). + Expect(). + Status(http.StatusFound). + Header("Access-Control-Allow-Origin").Equal(fmt.Sprintf("*")) + + }) + }) + ginkgo.Context("when external authentication with caching is configured", func() { thisHost := "auth" thatHost := "different" From c015c628b5e4e07078a04a5f8c3ced8441c255a3 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 9 Nov 2022 16:05:42 -0500 Subject: [PATCH 017/822] testing auto change Signed-off-by: James Strong --- hack/changelog.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100755 hack/changelog.sh diff --git a/hack/changelog.sh b/hack/changelog.sh new file mode 100755 index 000000000..6ecd9f890 --- /dev/null +++ b/hack/changelog.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash + +set -o errexit +set -o nounset +set -o pipefail + +declare -a mandatory +mandatory=( + LINES + RELEASE +) + +gh pr list -R kubernetes/ingress-nginx -s merged -L ${LINES} -B main | cut -f1,2 | awk '{ printf "* [%s](https://github.com/kubernetes/ingress-nginx/pull/%s) %s\n",$1,$1, substr($0,6)}' + + From 71e9bdcb685acbfb14d3d7afa56189d7f0f8258f Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 11 Nov 2022 09:23:19 -0500 Subject: [PATCH 018/822] Add mage files for changelog Signed-off-by: James Strong --- Changelog.md.gotmpl | 15 + RELEASE.md => MANUAL_RELEASE.md | 10 +- NEW_RELEASE_PROCESS.md | 9 + TAG | 2 +- changelog/Changelog-1.5.2.md | 36 ++ charts/ingress-nginx/changelog/.gitkeep | 0 .../changelog/Changelog-1.5.2.md | 12 + go.mod | 1 + go.sum | 2 + hack/changelog.sh | 15 - ingress-nginx.yaml | 68 ++ magefiles/common.go | 66 ++ magefiles/docker.go | 3 + magefiles/go.go | 15 + magefiles/go.mod | 32 + magefiles/go.sum | 105 +++ magefiles/helm.go | 608 ++++++++++++++++++ magefiles/mage.go | 13 + magefiles/release.go | 526 +++++++++++++++ magefiles/tags.go | 130 ++++ magefiles/yaml.go | 3 + 21 files changed, 1650 insertions(+), 21 deletions(-) create mode 100644 Changelog.md.gotmpl rename RELEASE.md => MANUAL_RELEASE.md (96%) create mode 100644 NEW_RELEASE_PROCESS.md create mode 100644 charts/ingress-nginx/changelog/.gitkeep create mode 100644 charts/ingress-nginx/changelog/Changelog-1.5.2.md delete mode 100755 hack/changelog.sh create mode 100644 ingress-nginx.yaml create mode 100644 magefiles/common.go create mode 100644 magefiles/docker.go create mode 100644 magefiles/go.go create mode 100644 magefiles/go.mod create mode 100644 magefiles/go.sum create mode 100644 magefiles/helm.go create mode 100644 magefiles/mage.go create mode 100644 magefiles/release.go create mode 100644 magefiles/tags.go create mode 100644 magefiles/yaml.go diff --git a/Changelog.md.gotmpl b/Changelog.md.gotmpl new file mode 100644 index 000000000..d35df8ade --- /dev/null +++ b/Changelog.md.gotmpl @@ -0,0 +1,15 @@ +# Changelog + +### {{ .Version }} +Images: +{{ with .ControllerImages }} +{{ range . }} * {{ .Registry }}/{{ .Name }}:{{ .Tag}}@{{ .Digest }} +{{ end }} {{ end }} +### All Changes: +{{ with .Updates }} +{{ range . }}* {{ . }} +{{ end }}{{ end }} +### Dependencies updates: {{ with .DepUpdates }} +{{ range . }}* {{ . }} +{{ end }} {{ end }} +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-{{ .PreviousControllerVersion }}...controller-{{ .NewControllerVersion }} diff --git a/RELEASE.md b/MANUAL_RELEASE.md similarity index 96% rename from RELEASE.md rename to MANUAL_RELEASE.md index ca0faa4e1..d7144b85d 100644 --- a/RELEASE.md +++ b/MANUAL_RELEASE.md @@ -103,7 +103,7 @@ Promoting the images basically means that images, that were pushed to staging co - Fork that other project (if you don't have a fork already). -- Other project to fork [Github repo kubernetes/k8s.io](http://github.com/kubernetes/k8s.io) +- Other project to fork [GitHub repo kubernetes/k8s.io](http://github.com/kubernetes/k8s.io) - Fetch --all and rebase to upstream if already forked. @@ -111,7 +111,7 @@ Promoting the images basically means that images, that were pushed to staging co - In the related branch, of your fork, edit the file /registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml. -- For making it easier, you can edit your branch directly in the browser. But be careful about making any mistake. +- For making, it easier, you can edit your branch directly in the browser. But be careful about making any mistake. - Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml) Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/2536) to see how it was done before @@ -132,7 +132,7 @@ Promoting the images basically means that images, that were pushed to staging co - Make sure to get the tag and sha of the promoted image from the step before, either from cloudbuild or from [here](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/ingress-nginx/controller). -- This involves editing of several different files. So carefully follow the steps below and double check all changes with diff/grep etc., repeatedly. Mistakes here impact endusers. +- This involves editing of several files. So carefully follow the steps below and double check all changes with diff/grep etc., repeatedly. Mistakes here impact endusers. ### a. Make sure your git workspace is ready @@ -160,7 +160,7 @@ Promoting the images basically means that images, that were pushed to staging co - [TAG](https://github.com/kubernetes/ingress-nginx/blob/main/TAG#L1) ### c. Edit the helm Chart - - Change the below mentioned [Fields in Chart.yaml](https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/Chart.yaml) + - Change the below-mentioned [Fields in Chart.yaml](https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/Chart.yaml) - version - appVersion - kubeVersion (**ONLY if applicable**) @@ -168,7 +168,7 @@ Promoting the images basically means that images, that were pushed to staging co - artifacthub.io/prerelease: "true" - artifacthub.io/changes: | - Replace this line and other lines under this annotation with the Changelog. One process to generate the Changelog is described below - - Install and configure github cli as per the docs of gh-cli https://cli.github.com/, + - Install and configure GitHub cli as per the docs of gh-cli https://cli.github.com/, - Change dir to your clone, of your fork, of the ingress-nginx project - Run the below command and save the output to a txt file diff --git a/NEW_RELEASE_PROCESS.md b/NEW_RELEASE_PROCESS.md new file mode 100644 index 000000000..cdb683abf --- /dev/null +++ b/NEW_RELEASE_PROCESS.md @@ -0,0 +1,9 @@ +# Semi-Automated Release Process + +1. Update TAG +2. Cloud Build +3. k8s.io PR +4. git pull origin main +5. git checkout -b $RELEASE_VERSION +6. mage release:newrelease $RELEASE_VERSION +7. Wait for PR \ No newline at end of file diff --git a/TAG b/TAG index 05f629f1b..b7c0a9b1d 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.6.0 \ No newline at end of file +v1.6.0 diff --git a/changelog/Changelog-1.5.2.md b/changelog/Changelog-1.5.2.md index 8b2617924..ed8532374 100644 --- a/changelog/Changelog-1.5.2.md +++ b/changelog/Changelog-1.5.2.md @@ -3,6 +3,7 @@ ### 1.5.2 Images: +<<<<<<< HEAD * registry.k8s.io/ingress-nginx/controller:controller-v1.5.2@sha256:3870522ed937c9efb94bfa31a7eb16009831567a0d4cbe01846fc5486d622655 * registry.k8s.io/ingress-nginx/controller-chroot:controller-v1.5.2@sha256:84613555694f2c59a8b2551126d226c9aa648544ebf0cde1e0df942f7dbce42b @@ -19,6 +20,24 @@ Images: * update the nginx run container for alpine:3.17.0 (#9430) * cleanup: remove ioutil for new go version (#9427) * start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417) +======= + * registry.k8s.io/controller:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7g098v62f60a87868d12452529bad0d178fb36143346 + * registry.k8s.io/controller-chroot:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529b350d178fb36147345 + +### All Changes: + +<<<<<<< HEAD +>>>>>>> f4164ae0b (THE CHANGELOG WORKS) +======= +* upgrade nginx base image (#9436) +* test the new e2e test images (#9444) +* avoid builds and tests for non-code changes (#9392) +* CI updates (#9440) +* HPA: Add `controller.autoscaling.annotations` to `values.yaml`. (#9253) +* update the nginx run container for alpine:3.17.0 (#9430) +* cleanup: remove ioutil for new go version (#9427) +* start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417) +>>>>>>> 9ecab7d85 (e2e doc updates work now) * ci: remove setup-helm step (#9404) * ci: remove setup-kind step (#9401) * Add reporter for all tests (#9395) @@ -54,6 +73,10 @@ Images: * add containerSecurityContext to extraModules init containers (kubernetes#9016) (#9242) ### Dependencies updates: +<<<<<<< HEAD +<<<<<<< HEAD +======= +>>>>>>> 9ecab7d85 (e2e doc updates work now) * Bump golang.org/x/crypto from 0.3.0 to 0.4.0 (#9397) * Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9432) * Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9421) @@ -62,6 +85,11 @@ Images: * Bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (#9426) * Bump actions/dependency-review-action from 3.0.1 to 3.0.2 (#9424) * Bump ossf/scorecard-action from 2.0.6 to 2.1.0 (#9422) +<<<<<<< HEAD +======= +>>>>>>> f4164ae0b (THE CHANGELOG WORKS) +======= +>>>>>>> 9ecab7d85 (e2e doc updates work now) * Bump github.com/prometheus/common from 0.37.0 to 0.39.0 (#9416) * Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9408) * Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9398) @@ -76,4 +104,12 @@ Images: * Bump actions/dependency-review-action from 2.5.1 to 3.0.0 (#9301) * Bump k8s.io/component-base from 0.25.3 to 0.25.4 (#9300) +<<<<<<< HEAD +<<<<<<< HEAD **Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2 +======= +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.2...controller-controller-v1.5.1 +>>>>>>> f4164ae0b (THE CHANGELOG WORKS) +======= +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2 +>>>>>>> 9ecab7d85 (e2e doc updates work now) diff --git a/charts/ingress-nginx/changelog/.gitkeep b/charts/ingress-nginx/changelog/.gitkeep new file mode 100644 index 000000000..e69de29bb diff --git a/charts/ingress-nginx/changelog/Changelog-1.5.2.md b/charts/ingress-nginx/changelog/Changelog-1.5.2.md new file mode 100644 index 000000000..5e0563858 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-1.5.2.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.4.1 + +* ci: remove setup-helm step (#9404) +* feat(helm): Optionally use cert-manager instead admission patch (#9279) +* run helm release on main only and when the chart/value changes only (#9290) +* Update Ingress-Nginx version controller-v1.5.2 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.1...helm-chart-4.4.1 diff --git a/go.mod b/go.mod index 2412ad6db..6f90615ff 100644 --- a/go.mod +++ b/go.mod @@ -77,6 +77,7 @@ require ( github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect + github.com/magefile/mage v1.14.0 // indirect github.com/mailru/easyjson v0.7.6 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect diff --git a/go.sum b/go.sum index 6dc3d7f54..8a32d3e00 100644 --- a/go.sum +++ b/go.sum @@ -231,6 +231,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= +github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= +github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= diff --git a/hack/changelog.sh b/hack/changelog.sh deleted file mode 100755 index 6ecd9f890..000000000 --- a/hack/changelog.sh +++ /dev/null @@ -1,15 +0,0 @@ -#!/usr/bin/env bash - -set -o errexit -set -o nounset -set -o pipefail - -declare -a mandatory -mandatory=( - LINES - RELEASE -) - -gh pr list -R kubernetes/ingress-nginx -s merged -L ${LINES} -B main | cut -f1,2 | awk '{ printf "* [%s](https://github.com/kubernetes/ingress-nginx/pull/%s) %s\n",$1,$1, substr($0,6)}' - - diff --git a/ingress-nginx.yaml b/ingress-nginx.yaml new file mode 100644 index 000000000..be66255e0 --- /dev/null +++ b/ingress-nginx.yaml @@ -0,0 +1,68 @@ +CURRENT_VERSION: "v1.5.1" +GOLANG_VERSION: "1.19.2" +GIT_TAG: "controller-v1.5.1" +NGINX_BASE_IMAGE: "registry.k8s.io/ingress-nginx/nginx:0b5e0685112e4537ee20a0bdbba451e9f6158aa3@sha256:3f5e28bb248d5170e77b77fc2a1a385724aeff41a0b34b5afad7dd9cf93de000" +NGINX_VERSION: "1.21.6" +VERSION_TABLE: + - "v1.5.1": + - Alpine: "3.16.2" + - Kubernetes: ["1.25","1.24","1.23"] + - NGINX: "1.21.6" + - CONTROLLER_IMAGE: "registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629" + - CHROOT_CONTROLLER_IMAGE: "registry.k8s.io/ingress-nginx/controller-chroot:v1.5.1@sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345" + - "v1.4.0": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.3.1": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.3.0": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.2.1": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.1.3": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.1.2": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.1.1": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.1.0": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.5": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.4": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.3": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.2": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.1": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" + - "v1.0.0": + - Alpine: "3.16.2" + - Kubernetes: [ "1.24","1.23", "1.22", "1.21", "1.20" ] + - NGINX: "1.19.10" diff --git a/magefiles/common.go b/magefiles/common.go new file mode 100644 index 000000000..ae2fed0c4 --- /dev/null +++ b/magefiles/common.go @@ -0,0 +1,66 @@ +//go:build mage + +package main + +import ( + "fmt" + "os" + "strings" + "time" +) + +var DEBUG bool + +func init() { + DEBUG = false + debugENV := os.Getenv("MAGE_DEBUG") + if debugENV == "true" { + DEBUG = true + } +} + +// CheckArgs should be used to ensure the right command line arguments are +// passed before executing an example. +func CheckArgs(arg ...string) { + if len(os.Args) < len(arg)+1 { + ErrorF("Usage: %s %s", os.Args[0], strings.Join(arg, " ")) + os.Exit(1) + } +} + +// CheckIfError should be used to naively panics if an error is not nil. +func CheckIfError(err error, format string, args ...interface{}) { + if err == nil { + return + } + + fmt.Printf("\x1b[31;1m%s ERROR %s %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...), err) + os.Exit(1) +} + +// Info should be used to describe the example commands that are about to run. +func Info(format string, args ...interface{}) { + fmt.Printf("\x1b[34;1m%s INFO: %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...)) +} + +func timeStamp() string { + t := time.Now() + return t.Format(time.RFC3339) +} + +// Warning should be used to display a warning +func Warning(format string, args ...interface{}) { + fmt.Printf("\x1b[36;1m%s WARNING: %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...)) +} + +// Info should be used to describe the example commands that are about to run. +func Debug(format string, args ...interface{}) { + if DEBUG { + fmt.Printf("\x1b[34;1m%s DEBUG: %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...)) + } +} + +// Info should be used to describe the example commands that are about to run. +func ErrorF(format string, args ...interface{}) { + fmt.Printf("\x1b[31;1m%s ERROR: %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...)) +} diff --git a/magefiles/docker.go b/magefiles/docker.go new file mode 100644 index 000000000..7353508f3 --- /dev/null +++ b/magefiles/docker.go @@ -0,0 +1,3 @@ +//go:build mage + +package main diff --git a/magefiles/go.go b/magefiles/go.go new file mode 100644 index 000000000..352b8fb1e --- /dev/null +++ b/magefiles/go.go @@ -0,0 +1,15 @@ +//go:build mage + +package main + +//import ( +// "github.com/magefile/mage/mg" +// "github.com/mysteriumnetwork/go-ci/commands" +//) +// +//type Go mg.Namespace +// +//// Checks for issues with go imports +//func (Go) CheckGoImports() error { +// return commands.GoImports("./...") +//} diff --git a/magefiles/go.mod b/magefiles/go.mod new file mode 100644 index 000000000..31c11a061 --- /dev/null +++ b/magefiles/go.mod @@ -0,0 +1,32 @@ +module github.com/kubernetes/ingress-nginx/magefiles + +go 1.19 + +require ( + github.com/blang/semver/v4 v4.0.0 + github.com/google/go-github/v48 v48.2.0 + github.com/helm/helm v2.17.0+incompatible + github.com/magefile/mage v1.14.0 + github.com/vmware-labs/yaml-jsonpath v0.3.2 + golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be + gopkg.in/yaml.v3 v3.0.1 +) + +require ( + github.com/BurntSushi/toml v1.2.1 // indirect + github.com/Masterminds/semver v1.5.0 // indirect + github.com/cyphar/filepath-securejoin v0.2.3 // indirect + github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect + github.com/ghodss/yaml v1.0.0 // indirect + github.com/gobwas/glob v0.2.3 // indirect + github.com/golang/protobuf v1.5.2 // indirect + github.com/google/go-querystring v1.1.0 // indirect + github.com/stretchr/testify v1.8.1 // indirect + golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect + golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect + google.golang.org/appengine v1.6.7 // indirect + google.golang.org/protobuf v1.28.0 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect + k8s.io/apimachinery v0.25.4 // indirect + k8s.io/helm v2.17.0+incompatible // indirect +) diff --git a/magefiles/go.sum b/magefiles/go.sum new file mode 100644 index 000000000..38a4235f6 --- /dev/null +++ b/magefiles/go.sum @@ -0,0 +1,105 @@ +github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak= +github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= +github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww= +github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y= +github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= +github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= +github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI= +github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 h1:aRd8M7HJVZOqn/vhOzrGcQH0lNAMkqMn+pXUYkatmcA= +github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= +github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= +github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= +github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= +github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= +github.com/google/go-github/v48 v48.2.0 h1:68puzySE6WqUY9KWmpOsDEQfDZsso98rT6pZcz9HqcE= +github.com/google/go-github/v48 v48.2.0/go.mod h1:dDlehKBDo850ZPvCTK0sEqTCVWcrGl2LcDiajkYi89Y= +github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= +github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= +github.com/helm/helm v2.17.0+incompatible h1:0iy95yMXrfWpwaoOA9XRP+cTvitTrq+LcJV9DvR5n1Y= +github.com/helm/helm v2.17.0+incompatible/go.mod h1:ahXhuvluW4YnSL6W6hDVetZsVK8Pv4BP8OwKli7aMqo= +github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI= +github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= +github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= +github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= +github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94= +github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= +github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= +github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= +github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 h1:HWj/xjIHfjYU5nVXpTM0s39J9CbLn7Cc5a7IC5rwsMQ= +golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be h1:vEDujvNQGv4jgYKudGeI/+DAX4Jffq6hpD55MmoEvKs= +golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= +golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= +google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw= +google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= +gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4= +gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= +gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= +gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc= +k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo= +k8s.io/helm v2.17.0+incompatible h1:Bpn6o1wKLYqKM3+Osh8e+1/K2g/GsQJ4F4yNF2+deao= +k8s.io/helm v2.17.0+incompatible/go.mod h1:LZzlS4LQBHfciFOurYBFkCMTaZ0D1l+p0teMg7TSULI= diff --git a/magefiles/helm.go b/magefiles/helm.go new file mode 100644 index 000000000..87966dea0 --- /dev/null +++ b/magefiles/helm.go @@ -0,0 +1,608 @@ +//go:build mage + +package main + +import ( + "fmt" + semver "github.com/blang/semver/v4" + "github.com/helm/helm/pkg/chartutil" + "github.com/magefile/mage/mg" + "github.com/magefile/mage/sh" + yamlpath "github.com/vmware-labs/yaml-jsonpath/pkg/yamlpath" + "gopkg.in/yaml.v3" + "os" + "strings" +) + +const HelmChartPath = "charts/ingress-nginx/Chart.yaml" +const HelmChartValues = "charts/ingress-nginx/values.yaml" + +type Helm mg.Namespace + +// UpdateAppVersion Updates the Helm App Version of Ingress Nginx Controller +func (Helm) UpdateAppVersion() { + updateAppVersion() +} + +func updateAppVersion() { + +} + +// UpdateVersion Update Helm Version of the Chart +func (Helm) UpdateVersion(version string) { + updateVersion(version) +} + +func currentChartVersion() string { + chart, err := chartutil.LoadChartfile(HelmChartPath) + CheckIfError(err, "HELM Could not Load Chart") + return chart.Version +} + +func currentChartAppVersion() string { + chart, err := chartutil.LoadChartfile(HelmChartPath) + CheckIfError(err, "HELM Could not Load Chart") + return chart.AppVersion +} + +func updateVersion(version string) { + Info("HELM Reading File %v", HelmChartPath) + + chart, err := chartutil.LoadChartfile(HelmChartPath) + CheckIfError(err, "HELM Could not Load Chart") + + //Get the current tag + //appVersionV, err := getIngressNGINXVersion() + //CheckIfError(err, "HELM Issue Retrieving the Current Ingress Nginx Version") + + //remove the v from TAG + appVersion := version + + Info("HELM Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) + if appVersion == chart.AppVersion { + Warning("HELM Ingress NGINX Version didnt change Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) + return + } + + //Update the helm chart + chart.AppVersion = appVersion + cTag, err := semver.Make(chart.Version) + CheckIfError(err, "HELM Creating Chart Version: %v", err) + + if err = cTag.IncrementPatch(); err != nil { + ErrorF("HELM Incrementing Chart Version: %v", err) + os.Exit(1) + } + chart.Version = cTag.String() + Debug("HELM Updated Chart Version: %v", chart.Version) + + err = chartutil.SaveChartfile(HelmChartPath, chart) + CheckIfError(err, "HELM Saving new Chart") +} + +func updateChartReleaseNotes(releasesNotes []string) { + Info("HELM Updating the Chart Release notes") + chart, err := chartutil.LoadChartfile(HelmChartPath) + CheckIfError(err, "HELM Could not Load Chart to update release notes %s", HelmChartPath) + var releaseNoteString string + for i := range releasesNotes { + releaseNoteString = fmt.Sprintf("%s - %s\n", releaseNoteString, releasesNotes[i]) + } + Info("HLEM Release note string %s", releaseNoteString) + chart.Annotations["artifacthub.io/changes"] = releaseNoteString + err = chartutil.SaveChartfile(HelmChartPath, chart) + CheckIfError(err, "HELM Saving updated release notes for Chart") +} + +func UpdateChartChangelog() { + +} + +// UpdateAppVersion Updates the Helm App Version of Ingress Nginx Controller +func (Helm) UpdateChartValue(key, value string) { + updateChartValue(key, value) +} + +func updateChartValue(key, value string) { + Info("HELM Updating Chart %s %s:%s", HelmChartValues, key, value) + + //read current values.yaml + data, err := os.ReadFile(HelmChartValues) + CheckIfError(err, "HELM Could not Load Helm Chart Values files %s", HelmChartValues) + + //var valuesStruct IngressChartValue + var n yaml.Node + CheckIfError(yaml.Unmarshal(data, &n), "HELM Could not Unmarshal %s", HelmChartValues) + + //update value + //keyParse := parsePath(key) + p, err := yamlpath.NewPath(key) + CheckIfError(err, "HELM cannot create path") + + q, err := p.Find(&n) + CheckIfError(err, "HELM unexpected error finding path") + + for _, i := range q { + Info("HELM Found %s at %s", i.Value, key) + i.Value = value + Info("HELM Updated %s at %s", i.Value, key) + } + + //// write to file + newValueFile, err := yaml.Marshal(&n) + CheckIfError(err, "HELM Could not Marshal new Values file") + err = os.WriteFile(HelmChartValues, newValueFile, 0644) + CheckIfError(err, "HELM Could not write new Values file to %s", HelmChartValues) + + Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) +} + +func runHelmDocs() error { + err := installHelmDocs() + if err != nil { + return err + } + err = sh.RunV("helm-docs", "--chart-search-root=${PWD}/charts") + if err != nil { + return err + } + return nil +} + +func installHelmDocs() error { + Info("HELM Install HelmDocs") + var g0 = sh.RunCmd("go") + + err := g0("install", "github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0") + if err != nil { + return err + } + return nil +} +func parsePath(key string) []string { return strings.Split(key, ".") } + +func updateHelmDocs() { + +} + +type IngressChartValue struct { + CommonLabels struct { + } `yaml:"commonLabels"` + Controller struct { + Name string `yaml:"name"` + Image struct { + Chroot bool `yaml:"chroot"` + Registry string `yaml:"registry"` + Image string `yaml:"image"` + Tag string `yaml:"tag"` + Digest string `yaml:"digest"` + DigestChroot string `yaml:"digestChroot"` + PullPolicy string `yaml:"pullPolicy"` + RunAsUser int `yaml:"runAsUser"` + AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` + } `yaml:"image"` + ExistingPsp string `yaml:"existingPsp"` + ContainerName string `yaml:"containerName"` + ContainerPort struct { + HTTP int `yaml:"http"` + HTTPS int `yaml:"https"` + } `yaml:"containerPort"` + Config struct { + } `yaml:"config"` + ConfigAnnotations struct { + } `yaml:"configAnnotations"` + ProxySetHeaders struct { + } `yaml:"proxySetHeaders"` + AddHeaders struct { + } `yaml:"addHeaders"` + DNSConfig struct { + } `yaml:"dnsConfig"` + Hostname struct { + } `yaml:"hostname"` + DNSPolicy string `yaml:"dnsPolicy"` + ReportNodeInternalIP bool `yaml:"reportNodeInternalIp"` + WatchIngressWithoutClass bool `yaml:"watchIngressWithoutClass"` + IngressClassByName bool `yaml:"ingressClassByName"` + AllowSnippetAnnotations bool `yaml:"allowSnippetAnnotations"` + HostNetwork bool `yaml:"hostNetwork"` + HostPort struct { + Enabled bool `yaml:"enabled"` + Ports struct { + HTTP int `yaml:"http"` + HTTPS int `yaml:"https"` + } `yaml:"ports"` + } `yaml:"hostPort"` + ElectionID string `yaml:"electionID"` + IngressClassResource struct { + Name string `yaml:"name"` + Enabled bool `yaml:"enabled"` + Default bool `yaml:"default"` + ControllerValue string `yaml:"controllerValue"` + Parameters struct { + } `yaml:"parameters"` + } `yaml:"ingressClassResource"` + IngressClass string `yaml:"ingressClass"` + PodLabels struct { + } `yaml:"podLabels"` + PodSecurityContext struct { + } `yaml:"podSecurityContext"` + Sysctls struct { + } `yaml:"sysctls"` + PublishService struct { + Enabled bool `yaml:"enabled"` + PathOverride string `yaml:"pathOverride"` + } `yaml:"publishService"` + Scope struct { + Enabled bool `yaml:"enabled"` + Namespace string `yaml:"namespace"` + NamespaceSelector string `yaml:"namespaceSelector"` + } `yaml:"scope"` + ConfigMapNamespace string `yaml:"configMapNamespace"` + TCP struct { + ConfigMapNamespace string `yaml:"configMapNamespace"` + Annotations struct { + } `yaml:"annotations"` + } `yaml:"tcp"` + UDP struct { + ConfigMapNamespace string `yaml:"configMapNamespace"` + Annotations struct { + } `yaml:"annotations"` + } `yaml:"udp"` + MaxmindLicenseKey string `yaml:"maxmindLicenseKey"` + ExtraArgs struct { + } `yaml:"extraArgs"` + ExtraEnvs []interface{} `yaml:"extraEnvs"` + Kind string `yaml:"kind"` + Annotations struct { + } `yaml:"annotations"` + Labels struct { + } `yaml:"labels"` + UpdateStrategy struct { + } `yaml:"updateStrategy"` + MinReadySeconds int `yaml:"minReadySeconds"` + Tolerations []interface{} `yaml:"tolerations"` + Affinity struct { + } `yaml:"affinity"` + TopologySpreadConstraints []interface{} `yaml:"topologySpreadConstraints"` + TerminationGracePeriodSeconds int `yaml:"terminationGracePeriodSeconds"` + NodeSelector struct { + KubernetesIoOs string `yaml:"kubernetes.io/os"` + } `yaml:"nodeSelector"` + LivenessProbe struct { + HTTPGet struct { + Path string `yaml:"path"` + Port int `yaml:"port"` + Scheme string `yaml:"scheme"` + } `yaml:"httpGet"` + InitialDelaySeconds int `yaml:"initialDelaySeconds"` + PeriodSeconds int `yaml:"periodSeconds"` + TimeoutSeconds int `yaml:"timeoutSeconds"` + SuccessThreshold int `yaml:"successThreshold"` + FailureThreshold int `yaml:"failureThreshold"` + } `yaml:"livenessProbe"` + ReadinessProbe struct { + HTTPGet struct { + Path string `yaml:"path"` + Port int `yaml:"port"` + Scheme string `yaml:"scheme"` + } `yaml:"httpGet"` + InitialDelaySeconds int `yaml:"initialDelaySeconds"` + PeriodSeconds int `yaml:"periodSeconds"` + TimeoutSeconds int `yaml:"timeoutSeconds"` + SuccessThreshold int `yaml:"successThreshold"` + FailureThreshold int `yaml:"failureThreshold"` + } `yaml:"readinessProbe"` + HealthCheckPath string `yaml:"healthCheckPath"` + HealthCheckHost string `yaml:"healthCheckHost"` + PodAnnotations struct { + } `yaml:"podAnnotations"` + ReplicaCount int `yaml:"replicaCount"` + MinAvailable int `yaml:"minAvailable"` + Resources struct { + Requests struct { + CPU string `yaml:"cpu"` + Memory string `yaml:"memory"` + } `yaml:"requests"` + } `yaml:"resources"` + Autoscaling struct { + APIVersion string `yaml:"apiVersion"` + Enabled bool `yaml:"enabled"` + Annotations struct { + } `yaml:"annotations"` + MinReplicas int `yaml:"minReplicas"` + MaxReplicas int `yaml:"maxReplicas"` + TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` + TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` + Behavior struct { + } `yaml:"behavior"` + } `yaml:"autoscaling"` + AutoscalingTemplate []interface{} `yaml:"autoscalingTemplate"` + Keda struct { + APIVersion string `yaml:"apiVersion"` + Enabled bool `yaml:"enabled"` + MinReplicas int `yaml:"minReplicas"` + MaxReplicas int `yaml:"maxReplicas"` + PollingInterval int `yaml:"pollingInterval"` + CooldownPeriod int `yaml:"cooldownPeriod"` + RestoreToOriginalReplicaCount bool `yaml:"restoreToOriginalReplicaCount"` + ScaledObject struct { + Annotations struct { + } `yaml:"annotations"` + } `yaml:"scaledObject"` + Triggers []interface{} `yaml:"triggers"` + Behavior struct { + } `yaml:"behavior"` + } `yaml:"keda"` + EnableMimalloc bool `yaml:"enableMimalloc"` + CustomTemplate struct { + ConfigMapName string `yaml:"configMapName"` + ConfigMapKey string `yaml:"configMapKey"` + } `yaml:"customTemplate"` + Service struct { + Enabled bool `yaml:"enabled"` + AppProtocol bool `yaml:"appProtocol"` + Annotations struct { + } `yaml:"annotations"` + Labels struct { + } `yaml:"labels"` + ExternalIPs []interface{} `yaml:"externalIPs"` + LoadBalancerIP string `yaml:"loadBalancerIP"` + LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` + EnableHTTP bool `yaml:"enableHttp"` + EnableHTTPS bool `yaml:"enableHttps"` + IPFamilyPolicy string `yaml:"ipFamilyPolicy"` + IPFamilies []string `yaml:"ipFamilies"` + Ports struct { + HTTP int `yaml:"http"` + HTTPS int `yaml:"https"` + } `yaml:"ports"` + TargetPorts struct { + HTTP string `yaml:"http"` + HTTPS string `yaml:"https"` + } `yaml:"targetPorts"` + Type string `yaml:"type"` + NodePorts struct { + HTTP string `yaml:"http"` + HTTPS string `yaml:"https"` + TCP struct { + } `yaml:"tcp"` + UDP struct { + } `yaml:"udp"` + } `yaml:"nodePorts"` + External struct { + Enabled bool `yaml:"enabled"` + } `yaml:"external"` + Internal struct { + Enabled bool `yaml:"enabled"` + Annotations struct { + } `yaml:"annotations"` + LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` + } `yaml:"internal"` + } `yaml:"service"` + ShareProcessNamespace bool `yaml:"shareProcessNamespace"` + ExtraContainers []interface{} `yaml:"extraContainers"` + ExtraVolumeMounts []interface{} `yaml:"extraVolumeMounts"` + ExtraVolumes []interface{} `yaml:"extraVolumes"` + ExtraInitContainers []interface{} `yaml:"extraInitContainers"` + ExtraModules []interface{} `yaml:"extraModules"` + Opentelemetry struct { + Enabled bool `yaml:"enabled"` + Image string `yaml:"image"` + ContainerSecurityContext struct { + AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` + } `yaml:"containerSecurityContext"` + } `yaml:"opentelemetry"` + AdmissionWebhooks struct { + Annotations struct { + } `yaml:"annotations"` + Enabled bool `yaml:"enabled"` + ExtraEnvs []interface{} `yaml:"extraEnvs"` + FailurePolicy string `yaml:"failurePolicy"` + Port int `yaml:"port"` + Certificate string `yaml:"certificate"` + Key string `yaml:"key"` + NamespaceSelector struct { + } `yaml:"namespaceSelector"` + ObjectSelector struct { + } `yaml:"objectSelector"` + Labels struct { + } `yaml:"labels"` + ExistingPsp string `yaml:"existingPsp"` + NetworkPolicyEnabled bool `yaml:"networkPolicyEnabled"` + Service struct { + Annotations struct { + } `yaml:"annotations"` + ExternalIPs []interface{} `yaml:"externalIPs"` + LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` + ServicePort int `yaml:"servicePort"` + Type string `yaml:"type"` + } `yaml:"service"` + CreateSecretJob struct { + SecurityContext struct { + AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` + } `yaml:"securityContext"` + Resources struct { + } `yaml:"resources"` + } `yaml:"createSecretJob"` + PatchWebhookJob struct { + SecurityContext struct { + AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` + } `yaml:"securityContext"` + Resources struct { + } `yaml:"resources"` + } `yaml:"patchWebhookJob"` + Patch struct { + Enabled bool `yaml:"enabled"` + Image struct { + Registry string `yaml:"registry"` + Image string `yaml:"image"` + Tag string `yaml:"tag"` + Digest string `yaml:"digest"` + PullPolicy string `yaml:"pullPolicy"` + } `yaml:"image"` + PriorityClassName string `yaml:"priorityClassName"` + PodAnnotations struct { + } `yaml:"podAnnotations"` + NodeSelector struct { + KubernetesIoOs string `yaml:"kubernetes.io/os"` + } `yaml:"nodeSelector"` + Tolerations []interface{} `yaml:"tolerations"` + Labels struct { + } `yaml:"labels"` + SecurityContext struct { + RunAsNonRoot bool `yaml:"runAsNonRoot"` + RunAsUser int `yaml:"runAsUser"` + FsGroup int `yaml:"fsGroup"` + } `yaml:"securityContext"` + } `yaml:"patch"` + CertManager struct { + Enabled bool `yaml:"enabled"` + RootCert struct { + Duration string `yaml:"duration"` + } `yaml:"rootCert"` + AdmissionCert struct { + Duration string `yaml:"duration"` + } `yaml:"admissionCert"` + } `yaml:"certManager"` + } `yaml:"admissionWebhooks"` + Metrics struct { + Port int `yaml:"port"` + PortName string `yaml:"portName"` + Enabled bool `yaml:"enabled"` + Service struct { + Annotations struct { + } `yaml:"annotations"` + ExternalIPs []interface{} `yaml:"externalIPs"` + LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` + ServicePort int `yaml:"servicePort"` + Type string `yaml:"type"` + } `yaml:"service"` + ServiceMonitor struct { + Enabled bool `yaml:"enabled"` + AdditionalLabels struct { + } `yaml:"additionalLabels"` + Namespace string `yaml:"namespace"` + NamespaceSelector struct { + } `yaml:"namespaceSelector"` + ScrapeInterval string `yaml:"scrapeInterval"` + TargetLabels []interface{} `yaml:"targetLabels"` + Relabelings []interface{} `yaml:"relabelings"` + MetricRelabelings []interface{} `yaml:"metricRelabelings"` + } `yaml:"serviceMonitor"` + PrometheusRule struct { + Enabled bool `yaml:"enabled"` + AdditionalLabels struct { + } `yaml:"additionalLabels"` + Rules []interface{} `yaml:"rules"` + } `yaml:"prometheusRule"` + } `yaml:"metrics"` + Lifecycle struct { + PreStop struct { + Exec struct { + Command []string `yaml:"command"` + } `yaml:"exec"` + } `yaml:"preStop"` + } `yaml:"lifecycle"` + PriorityClassName string `yaml:"priorityClassName"` + } `yaml:"controller"` + RevisionHistoryLimit int `yaml:"revisionHistoryLimit"` + DefaultBackend struct { + Enabled bool `yaml:"enabled"` + Name string `yaml:"name"` + Image struct { + Registry string `yaml:"registry"` + Image string `yaml:"image"` + Tag string `yaml:"tag"` + PullPolicy string `yaml:"pullPolicy"` + RunAsUser int `yaml:"runAsUser"` + RunAsNonRoot bool `yaml:"runAsNonRoot"` + ReadOnlyRootFilesystem bool `yaml:"readOnlyRootFilesystem"` + AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` + } `yaml:"image"` + ExistingPsp string `yaml:"existingPsp"` + ExtraArgs struct { + } `yaml:"extraArgs"` + ServiceAccount struct { + Create bool `yaml:"create"` + Name string `yaml:"name"` + AutomountServiceAccountToken bool `yaml:"automountServiceAccountToken"` + } `yaml:"serviceAccount"` + ExtraEnvs []interface{} `yaml:"extraEnvs"` + Port int `yaml:"port"` + LivenessProbe struct { + FailureThreshold int `yaml:"failureThreshold"` + InitialDelaySeconds int `yaml:"initialDelaySeconds"` + PeriodSeconds int `yaml:"periodSeconds"` + SuccessThreshold int `yaml:"successThreshold"` + TimeoutSeconds int `yaml:"timeoutSeconds"` + } `yaml:"livenessProbe"` + ReadinessProbe struct { + FailureThreshold int `yaml:"failureThreshold"` + InitialDelaySeconds int `yaml:"initialDelaySeconds"` + PeriodSeconds int `yaml:"periodSeconds"` + SuccessThreshold int `yaml:"successThreshold"` + TimeoutSeconds int `yaml:"timeoutSeconds"` + } `yaml:"readinessProbe"` + Tolerations []interface{} `yaml:"tolerations"` + Affinity struct { + } `yaml:"affinity"` + PodSecurityContext struct { + } `yaml:"podSecurityContext"` + ContainerSecurityContext struct { + } `yaml:"containerSecurityContext"` + PodLabels struct { + } `yaml:"podLabels"` + NodeSelector struct { + KubernetesIoOs string `yaml:"kubernetes.io/os"` + } `yaml:"nodeSelector"` + PodAnnotations struct { + } `yaml:"podAnnotations"` + ReplicaCount int `yaml:"replicaCount"` + MinAvailable int `yaml:"minAvailable"` + Resources struct { + } `yaml:"resources"` + ExtraVolumeMounts []interface{} `yaml:"extraVolumeMounts"` + ExtraVolumes []interface{} `yaml:"extraVolumes"` + Autoscaling struct { + Annotations struct { + } `yaml:"annotations"` + Enabled bool `yaml:"enabled"` + MinReplicas int `yaml:"minReplicas"` + MaxReplicas int `yaml:"maxReplicas"` + TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` + TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` + } `yaml:"autoscaling"` + Service struct { + Annotations struct { + } `yaml:"annotations"` + ExternalIPs []interface{} `yaml:"externalIPs"` + LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` + ServicePort int `yaml:"servicePort"` + Type string `yaml:"type"` + } `yaml:"service"` + PriorityClassName string `yaml:"priorityClassName"` + Labels struct { + } `yaml:"labels"` + } `yaml:"defaultBackend"` + Rbac struct { + Create bool `yaml:"create"` + Scope bool `yaml:"scope"` + } `yaml:"rbac"` + PodSecurityPolicy struct { + Enabled bool `yaml:"enabled"` + } `yaml:"podSecurityPolicy"` + ServiceAccount struct { + Create bool `yaml:"create"` + Name string `yaml:"name"` + AutomountServiceAccountToken bool `yaml:"automountServiceAccountToken"` + Annotations struct { + } `yaml:"annotations"` + } `yaml:"serviceAccount"` + ImagePullSecrets []interface{} `yaml:"imagePullSecrets"` + TCP struct { + } `yaml:"tcp"` + UDP struct { + } `yaml:"udp"` + PortNamePrefix string `yaml:"portNamePrefix"` + DhParam interface{} `yaml:"dhParam"` +} diff --git a/magefiles/mage.go b/magefiles/mage.go new file mode 100644 index 000000000..97ab4712a --- /dev/null +++ b/magefiles/mage.go @@ -0,0 +1,13 @@ +//go:build ignore +// +build ignore + +package main + +import ( + "github.com/magefile/mage/mage" + "os" +) + +func main() { + os.Exit(mage.Main()) +} diff --git a/magefiles/release.go b/magefiles/release.go new file mode 100644 index 000000000..a48a9dbd0 --- /dev/null +++ b/magefiles/release.go @@ -0,0 +1,526 @@ +//go:build mage + +package main + +import ( + "context" + "errors" + "fmt" + "github.com/google/go-github/v48/github" + "github.com/magefile/mage/mg" + "github.com/magefile/mage/sh" + "golang.org/x/oauth2" + "gopkg.in/yaml.v3" + "io" + "net" + "net/http" + "os" + "text/template" + + "regexp" + "strings" + "time" +) + +type Release mg.Namespace + +var INGRESS_ORG = "strongjz" // the owner so we can test from forks +var INGRESS_REPO = "ingress-nginx" // the repo to pull from +var RELEASE_BRANCH = "main" //we only release from main +var GITHUB_TOKEN string // the Google/gogithub lib needs an PAT to access the GitHub API +var K8S_IO_ORG = "strongjz" //the owner or organization for the k8s.io repo +var K8S_IO_REPO = "k8s.io" //the repo that holds the images yaml for production promotion +var INGRESS_REGISTRY = "registry.k8s.io" //Container registry for storage Ingress-nginx images + +// ingress-nginx releases start with a TAG then a cloudbuild, then a promotion through a PR, this the location of that PR +// var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" +var IMAGES_YAML = "https://raw.githubusercontent.com/strongjz/k8s.io/testing/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" + +var ctx = context.Background() // Context used for GitHub Client + +const CHANGELOG = "Changelog.md" //Name of the changelog + +func init() { + GITHUB_TOKEN = os.Getenv("GITHUB_TOKEN") +} + +// PromoteImage Creates PR into the k8s.io repo for promotion of ingress from staging to production +func (Release) PromoteImage(version, sha string) { + +} + +// Release Create a new release of ingress nginx controller +func (Release) NewRelease(version string) { + //newRelease := Release{} + + //update ingress-nginx version + //This is the step that kicks all the release process + //it is already done, so it kicks off the gcloud build of the controller images + //mg.Deps(mg.F(Tag.BumpNginx, version)) + + tag, err := getIngressNGINXVersion() + CheckIfError(err, "RELEASE Retrieving the current Ingress Nginx Version") + + Info("RELEASE Checking Current Version %s to New Version %s", tag, version) + //if the version were upgrading does not match the TAG file, lets update the TAG file + if tag != version { + Warning("RELEASE Ingress Nginx TAG %s and new version %s do not match", tag, version) + mg.Deps(mg.F(Tag.BumpNginx, fmt.Sprintf("v%s", version))) + } + + //update git controller tag controller-v$version + mg.Deps(mg.F(Tag.NewControllerTag, version)) + + //make release notes + releaseNotes, err := makeReleaseNotes(version) + CheckIfError(err, "RELEASE Creating Release Notes for version %s", version) + Info("RELEASE Release Notes %s completed", releaseNotes.Version) + + //update chart values.yaml new controller tag and image digest + releaseNotes.PreviousHelmChartVersion = currentChartVersion() + + //controller tag + updateChartValue("controller.image.tag", fmt.Sprintf("v%s", releaseNotes.Version)) + //controller digest + if releaseNotes.ControllerImages[0].Name == "controller" { + updateChartValue("controller.image.digest", releaseNotes.ControllerImages[0].Digest) + } + //controller chroot digest + if releaseNotes.ControllerImages[1].Name == "controller-chroot" { + updateChartValue("controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) + } + + //update helm chart app version + mg.Deps(mg.F(Helm.UpdateVersion, version)) + + releaseNotes.NewHelmChartVersion = currentChartVersion() + + //update helm chart release notes + updateChartReleaseNotes(releaseNotes.HelmUpdates) + + //Run helm docs update + CheckIfError(runHelmDocs(), "Error Updating Helm Docs ") + + releaseNotes.helmTemplate() + + //update static manifest + CheckIfError(updateStaticManifest(), "Error Updating Static manifests") + + ////update e2e docs TODO + updateE2EDocs() + + //update documentation with ingress-nginx version + CheckIfError(updateIndexMD(releaseNotes.PreviousControllerVersion, releaseNotes.NewControllerVersion), "Error Updating %s", INDEX_DOCS) + + //git commit TODO + + //make Pull Request TODO + + //make release TODO + //mg.Deps(mg.F(Release.CreateRelease, version)) +} + +const INDEX_DOCS = "docs/deploy/index.md" + +func updateIndexMD(old, new string) error { + Info("Updating Deploy docs with new version") + data, err := os.ReadFile(INDEX_DOCS) + CheckIfError(err, "Could not read INDEX_DOCS file %s", INDEX_DOCS) + datString := string(data) + datString = strings.Replace(datString, old, new, -1) + err = os.WriteFile(INDEX_DOCS, []byte(datString), 644) + if err != nil { + ErrorF("Could not write new %s %s", INDEX_DOCS, err) + return err + } + return nil +} + +func updateE2EDocs() { + //hack/generate-deploy-scripts.sh + updates, err := sh.Output("./hack/generate-e2e-suite-doc.sh") + CheckIfError(err, "Could not run update hack script") + err = os.WriteFile("docs/e2e-tests.md", []byte(updates), 644) + CheckIfError(err, "Could not write new e2e test file ") +} + +func installKustomize() error { + Info("Install Kustomize") + var g0 = sh.RunCmd("go") + + // somewhere in your main code + err := g0("install", "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4") + if err != nil { + return err + } + return nil +} + +func updateStaticManifest() error { + CheckIfError(installKustomize(), "error installing kustomize") + + //hack/generate-deploy-scripts.sh + err := sh.RunV("./hack/generate-deploy-scripts.sh") + if err != nil { + return err + } + return nil +} + +//// CreateRelease Creates a new GitHub Release +//func (Release) CreateRelease(name string) { +// releaser, err := gh_release.NewReleaser(INGRESS_ORG, INGRESS_REPO, GITHUB_TOKEN) +// CheckIfError(err, "GitHub Release Client error") +// newRelease, err := releaser.Create(fmt.Sprintf("controller-%s", name)) +// CheckIfError(err, "Create release error") +// Info("New Release: Tag %v, ID: %v", newRelease.TagName, newRelease.ID) +//} + +type ControllerImage struct { + Tag string + Digest string + Registry string + Name string +} + +type IngressRelease struct { + ControllerVersion string + ControllerImage ControllerImage + ReleaseNote ReleaseNote + Release *github.RepositoryRelease +} + +type ReleaseNote struct { + Version string + NewControllerVersion string + PreviousControllerVersion string + ControllerImages []ControllerImage + DepUpdates []string + Updates []string + HelmUpdates []string + NewHelmChartVersion string + PreviousHelmChartVersion string +} + +// Returns a GitHub client ready for use +func githubClient() *github.Client { + ts := oauth2.StaticTokenSource( + &oauth2.Token{AccessToken: GITHUB_TOKEN}, + ) + oauthClient := oauth2.NewClient(ctx, ts) + return github.NewClient(oauthClient) +} + +// LatestCommitLogs Retrieves the commit log between the latest two controller versions. +func (Release) LatestCommitLogs() { + commitLog := commitsBetweenTags() + for i, s := range commitLog { + Info("#%v Version %v", i, s) + } +} + +func commitsBetweenTags() []string { + tags := getAllControllerTags() + Info("Getting Commits between %v and %v", tags[0], tags[1]) + commitLog, err := git("log", "--full-history", "--pretty", "--oneline", fmt.Sprintf("%v..%v", tags[1], tags[0])) + + if commitLog == "" { + Warning("All Controller Tags is empty") + } + CheckIfError(err, "Retrieving Commit log") + return strings.Split(commitLog, "\n") +} + +// Generate Release Notes +func (Release) ReleaseNotes(newVersion string) error { + notes, err := makeReleaseNotes(newVersion) + CheckIfError(err, "Creating Release Notes for version %s", newVersion) + Info("Release Notes %s completed", notes.Version) + return nil +} + +func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { + var newReleaseNotes = ReleaseNote{} + + newReleaseNotes.Version = newVersion + allControllerTags := getAllControllerTags() + + //new version + newReleaseNotes.NewControllerVersion = allControllerTags[0] + newControllerVersion := fmt.Sprintf("controller-v%s", newVersion) + + //the newControllerVersion should match the latest tag + if newControllerVersion != allControllerTags[0] { + return nil, errors.New(fmt.Sprintf("Generating release new version %s didnt match the current latest tag %s", newControllerVersion, allControllerTags[0])) + } + //previous version + newReleaseNotes.PreviousControllerVersion = allControllerTags[1] + + Info("New Version: %s Old Version: %s", newReleaseNotes.NewControllerVersion, newReleaseNotes.PreviousControllerVersion) + + commits := commitsBetweenTags() + + //dependency_updates + //all_updates + var allUpdates []string + var depUpdates []string + var helmUpdates []string + prRegex := regexp.MustCompile("\\(#\\d+\\)") + depBot := regexp.MustCompile("^(\\w){1,10} Bump ") + helmRegex := regexp.MustCompile("helm|chart") + for i, s := range commits { + //matches on PR + if prRegex.Match([]byte(s)) { + //matches a dependant bot update + if depBot.Match([]byte(s)) { // + Debug("#%v DEPENDABOT %v", i, s) + u := strings.SplitN(s, " ", 2) + depUpdates = append(depUpdates, u[1]) + } else { // add it to the all updates slice + Debug("#%v ALL UPDATES %v", i, s) + u := strings.SplitN(s, " ", 2) + allUpdates = append(allUpdates, u[1]) + + //helm chart updates + if helmRegex.Match([]byte(s)) { + u := strings.SplitN(s, " ", 2) + helmUpdates = append(helmUpdates, u[1]) + } + } + + } + } + helmUpdates = append(helmUpdates, fmt.Sprintf("Update Ingress-Nginx version %s", newReleaseNotes.NewControllerVersion)) + + newReleaseNotes.Updates = allUpdates + newReleaseNotes.DepUpdates = depUpdates + newReleaseNotes.HelmUpdates = helmUpdates + + //controller_image_digests + imagesYaml, err := downloadFile(IMAGES_YAML) + if err != nil { + ErrorF("Could not download file %s : %s", IMAGES_YAML, err) + return nil, err + } + Debug("%s", imagesYaml) + + data := ImageYamls{} + + err = yaml.Unmarshal([]byte(imagesYaml), &data) + if err != nil { + ErrorF("Could not unmarshal images yaml %s", err) + return nil, err + } + + //controller + controllerDigest := findImageDigest(data, "controller", newVersion) + if len(controllerDigest) == 0 { + ErrorF("Controller Digest could not be found") + return nil, errors.New("Controller digest could not be found") + } + + controllerChrootDigest := findImageDigest(data, "controller-chroot", newVersion) + if len(controllerChrootDigest) == 0 { + ErrorF("Controller Chroot Digest could not be found") + return nil, errors.New("Controller Chroot digest could not be found") + } + + Debug("Latest Controller Digest %v", controllerDigest) + Debug("Latest Controller Chroot Digest %v", controllerChrootDigest) + c1 := ControllerImage{ + Digest: controllerDigest, + Registry: INGRESS_REGISTRY, + Name: "controller", + Tag: newReleaseNotes.NewControllerVersion, + } + c2 := ControllerImage{ + Digest: controllerChrootDigest, + Registry: INGRESS_REGISTRY, + Name: "controller-chroot", + Tag: newReleaseNotes.NewControllerVersion, + } + newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c1) + newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c2) + Debug("New Release Controller Images %s %s", newReleaseNotes.ControllerImages[0].Digest, newReleaseNotes.ControllerImages[1].Digest) + + if DEBUG { + newReleaseNotes.printRelease() + } + + //write it all out to the changelog file + newReleaseNotes.template() + + return &newReleaseNotes, nil +} + +func (i ControllerImage) print() string { + return fmt.Sprintf("%s/%s:%s@%s", i.Registry, i.Name, i.Tag, i.Digest) +} + +func (r ReleaseNote) template() { + // Files are provided as a slice of strings. + changelogTemplate, err := os.ReadFile("Changelog.md.gotmpl") + if err != nil { + ErrorF("Could not read changelog template file %s", err) + } + Debug("ChangeLog Templates %s", string(changelogTemplate)) + t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) + // create a new file + file, err := os.Create(fmt.Sprintf("changelog/Changelog-%s.md", r.Version)) + if err != nil { + ErrorF("Could not create changelog file %s", err) + } + defer file.Close() + + err = t.Execute(file, r) + if err != nil { + ErrorF("executing template:", err) + } +} + +func (r ReleaseNote) helmTemplate() { + // Files are provided as a slice of strings. + changelogTemplate, err := os.ReadFile("charts/ingress-nginx/changelog.md.gotmpl") + if err != nil { + ErrorF("Could not read changelog template file %s", err) + } + Debug("ChangeLog Templates %s", string(changelogTemplate)) + t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) + // create a new file + file, err := os.Create(fmt.Sprintf("charts/ingress-nginx/changelog/Changelog-%s.md", r.Version)) + if err != nil { + ErrorF("Could not create changelog file %s", err) + } + defer file.Close() + + err = t.Execute(file, r) + if err != nil { + ErrorF("executing template:", err) + } +} + +func (r ReleaseNote) printRelease() { + Info("Release Version: %v", r.NewControllerVersion) + Info("Previous Version: %v", r.PreviousControllerVersion) + Info("Controller Image: %v", r.ControllerImages[0].print()) + Info("Controller Chroot Image: %v", r.ControllerImages[1].print()) + for i := range r.Updates { + Info("Update #%v - %v", i, r.Updates[i]) + } + for j := range r.DepUpdates { + Info("Dependabot Update #%v - %v", j, r.DepUpdates[j]) + } +} + +type ImageYamls []ImageElement + +type ImageElement struct { + Name string `json:"name"` + Dmap map[string][]string `json:"dmap"` +} + +func findImageDigest(yaml ImageYamls, image, version string) string { + version = fmt.Sprintf("v%s", version) + Info("Searching Digest for %s:%s", image, version) + for i := range yaml { + if yaml[i].Name == image { + for k, v := range yaml[i].Dmap { + if v[0] == version { + return k + } + } + return "" + } + } + return "" +} + +func downloadFile(url string) (string, error) { + client := &http.Client{ + Transport: &http.Transport{ + DialContext: (&net.Dialer{ + Timeout: 5 * time.Second, + KeepAlive: 5 * time.Second, + }).DialContext, + TLSHandshakeTimeout: 5 * time.Second, + ResponseHeaderTimeout: 5 * time.Second, + ExpectContinueTimeout: 1 * time.Second, + MaxIdleConnsPerHost: -1, + }, + } + resp, err := client.Get(url) + if err != nil { + return "", nil + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return "", errors.New(fmt.Sprintf("Could not retrieve file, response from server %s for file %s", resp.StatusCode, url)) + } + bodyBytes, err := io.ReadAll(resp.Body) + if err != nil { + return "", nil + } + return string(bodyBytes), nil +} + +// Latest returns latest Github Release +func (Release) Latest() error { + r, _, err := latestRelease() + if err != nil { + ErrorF("Latest Release error %s", err) + return err + } + Info("Latest Release %v", r.String()) + return nil +} + +func (Release) ReleaseByTag(tag string) error { + r, _, err := releaseByTag(tag) + if err != nil { + ErrorF("Release retrieve tag error %s", tag, err) + return err + } + + Info("Latest Release %v", r.String()) + + return nil +} + +func releaseByTag(tag string) (*github.RepositoryRelease, *github.Response, error) { + ghClient := githubClient() + return ghClient.Repositories.GetReleaseByTag(ctx, INGRESS_ORG, INGRESS_REPO, tag) +} + +func latestRelease() (*github.RepositoryRelease, *github.Response, error) { + ghClient := githubClient() + return ghClient.Repositories.GetLatestRelease(ctx, INGRESS_ORG, INGRESS_REPO) +} + +// Copy Test function to copy a release +func (Release) Copy() error { + ghClient := githubClient() + kRelease, _, err := ghClient.Repositories.GetLatestRelease(ctx, "kubernetes", "ingress-nginx") + if err != nil { + ErrorF("Get Release from kubernetes %s", err) + return err + } + + sRelease := &github.RepositoryRelease{ + TagName: kRelease.TagName, + Name: kRelease.Name, + Body: kRelease.Body, + Draft: kRelease.Draft, + Prerelease: kRelease.GenerateReleaseNotes, + DiscussionCategoryName: kRelease.DiscussionCategoryName, + GenerateReleaseNotes: kRelease.GenerateReleaseNotes, + } + + sRelease, _, err = ghClient.Repositories.CreateRelease(ctx, "strongjz", "ingress-nginx", sRelease) + if err != nil { + ErrorF("Creating Strongjz release %s", err) + return err + } + Info("Copied over Kubernetes Release %v to Strongjz %v", &kRelease.Name, &sRelease.Name) + return nil +} diff --git a/magefiles/tags.go b/magefiles/tags.go new file mode 100644 index 000000000..858677ba5 --- /dev/null +++ b/magefiles/tags.go @@ -0,0 +1,130 @@ +//go:build mage + +package main + +import ( + "fmt" + semver "github.com/blang/semver/v4" + "github.com/magefile/mage/mg" + "github.com/magefile/mage/sh" + "os" + "strings" +) + +type Tag mg.Namespace + +var git = sh.OutCmd("git") + +// Nginx returns the ingress-nginx current version +func (Tag) Nginx() { + tag, err := getIngressNGINXVersion() + CheckIfError(err, "") + fmt.Printf("%v", tag) +} + +func getIngressNGINXVersion() (string, error) { + dat, err := os.ReadFile("TAG") + CheckIfError(err, "Could not read TAG file") + datString := string(dat) + //remove newline + datString = strings.Replace(datString, "\n", "", -1) + return datString, nil +} + +func checkSemVer(currentVersion, newVersion string) bool { + Info("Checking Sem Ver between current %s and new %s", currentVersion, newVersion) + cVersion, err := semver.Make(currentVersion[1:]) + if err != nil { + ErrorF("TAG Error Current Tag %v Making Semver : %v", currentVersion[1:], err) + return false + } + nVersion, err := semver.Make(newVersion) + if err != nil { + ErrorF("TAG %v Error Making Semver %v \n", newVersion, err) + return false + } + + err = nVersion.Validate() + if err != nil { + ErrorF("TAG %v not a valid Semver %v \n", newVersion, err) + return false + } + + //The result will be + //0 if newVersion == currentVersion + //-1 if newVersion < currentVersion + //+1 if newVersion > currentVersion. + Info("TAG Comparing Old %s to New %s", cVersion.String(), nVersion.String()) + comp := nVersion.Compare(cVersion) + if comp <= 0 { + Warning("SemVer:%v is not an update\n", newVersion) + return false + } + return true +} + +// BumpNginx will update the nginx TAG +func (Tag) BumpNginx(newTag string) { + Info("TAG BumpNginx version %v", newTag) + currentTag, err := getIngressNGINXVersion() + CheckIfError(err, "Getting Ingress-nginx Version") + bump(currentTag, newTag) +} + +func bump(currentTag, newTag string) { + //check if semver is valid + if !checkSemVer(currentTag, newTag) { + ErrorF("ERROR: Semver is not valid %v", newTag) + os.Exit(1) + } + + Info("Updating Tag %v to %v", currentTag, newTag) + err := os.WriteFile("TAG", []byte(newTag), 0666) + CheckIfError(err, "Error Writing New Tag File") +} + +// Git Returns the latest git tag +func (Tag) Git() { + tag, err := getGitTag() + CheckIfError(err, "Retrieving Git Tag") + Info("Git tag: %v", tag) +} + +func getGitTag() (string, error) { + return git("describe", "--tags", "--match", "controller-v*", "--abbrev=0") +} + +// ControllerTag Creates a new Git Tag for the ingress controller +func (Tag) NewControllerTag(version string) { + Info("Create Ingress Nginx Controller Tag v%s", version) + tag, err := controllerTag(version) + CheckIfError(err, "Creating git tag") + Debug("Git Tag: %s", tag) +} + +func controllerTag(version string) (string, error) { + return git("tag", "-a", "-m", fmt.Sprintf("-m \"Automated Controller release %v\"", version), fmt.Sprintf("controller-v%s", version)) +} + +func (Tag) AllControllerTags() { + tags := getAllControllerTags() + for i, s := range tags { + Info("#%v Version %v", i, s) + } +} + +func getAllControllerTags() []string { + allControllerTags, err := git("tag", "-l", "--sort=-v:refname", "controller-v*") + CheckIfError(err, "Retrieving git tags") + if !sh.CmdRan(err) { + Warning("Issue Running Command") + } + if allControllerTags == "" { + Warning("All Controller Tags is empty") + } + Debug("Controller Tags: %v", allControllerTags) + + temp := strings.Split(allControllerTags, "\n") + Debug("There are %v controller tags", len(temp)) + return temp +} diff --git a/magefiles/yaml.go b/magefiles/yaml.go new file mode 100644 index 000000000..7353508f3 --- /dev/null +++ b/magefiles/yaml.go @@ -0,0 +1,3 @@ +//go:build mage + +package main From 76a5fdfecf40391e58e0f9e9f079f48d7d31df45 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 17 Jan 2023 14:13:50 -0500 Subject: [PATCH 019/822] change format Signed-off-by: James Strong --- magefiles/common.go | 14 ++++++++++++++ magefiles/docker.go | 14 ++++++++++++++ magefiles/go.go | 14 ++++++++++++++ magefiles/helm.go | 14 ++++++++++++++ magefiles/mage.go | 14 ++++++++++++++ magefiles/release.go | 14 ++++++++++++++ magefiles/tags.go | 14 ++++++++++++++ magefiles/yaml.go | 14 ++++++++++++++ 8 files changed, 112 insertions(+) diff --git a/magefiles/common.go b/magefiles/common.go index ae2fed0c4..772e5527c 100644 --- a/magefiles/common.go +++ b/magefiles/common.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/docker.go b/magefiles/docker.go index 7353508f3..443722de1 100644 --- a/magefiles/docker.go +++ b/magefiles/docker.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/go.go b/magefiles/go.go index 352b8fb1e..9ef4d9fdc 100644 --- a/magefiles/go.go +++ b/magefiles/go.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/helm.go b/magefiles/helm.go index 87966dea0..2ac2fc573 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/mage.go b/magefiles/mage.go index 97ab4712a..c6d4a2587 100644 --- a/magefiles/mage.go +++ b/magefiles/mage.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build ignore // +build ignore diff --git a/magefiles/release.go b/magefiles/release.go index a48a9dbd0..714c24334 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/tags.go b/magefiles/tags.go index 858677ba5..b8dc86f88 100644 --- a/magefiles/tags.go +++ b/magefiles/tags.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main diff --git a/magefiles/yaml.go b/magefiles/yaml.go index 7353508f3..443722de1 100644 --- a/magefiles/yaml.go +++ b/magefiles/yaml.go @@ -1,3 +1,17 @@ +//Copyright 2023 The Kubernetes Authors. +// +//Licensed under the Apache License, Version 2.0 (the "License"); +//you may not use this file except in compliance with the License. +//You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +//Unless required by applicable law or agreed to in writing, software +//distributed under the License is distributed on an "AS IS" BASIS, +//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +//See the License for the specific language governing permissions and +//limitations under the License. + //go:build mage package main From 22d9c35edec8faeca4cf4f8b72e8f08da20c1618 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 17 Jan 2023 14:22:38 -0500 Subject: [PATCH 020/822] fixed boiler plate lint Signed-off-by: James Strong --- magefiles/common.go | 30 ++++++++++++++++-------------- magefiles/docker.go | 30 ++++++++++++++++-------------- magefiles/go.go | 30 ++++++++++++++++-------------- magefiles/helm.go | 30 ++++++++++++++++-------------- magefiles/mage.go | 30 ++++++++++++++++-------------- magefiles/release.go | 30 ++++++++++++++++-------------- magefiles/tags.go | 30 ++++++++++++++++-------------- magefiles/yaml.go | 30 ++++++++++++++++-------------- 8 files changed, 128 insertions(+), 112 deletions(-) diff --git a/magefiles/common.go b/magefiles/common.go index 772e5527c..c5c33f989 100644 --- a/magefiles/common.go +++ b/magefiles/common.go @@ -1,19 +1,21 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main import ( diff --git a/magefiles/docker.go b/magefiles/docker.go index 443722de1..d7c7f588e 100644 --- a/magefiles/docker.go +++ b/magefiles/docker.go @@ -1,17 +1,19 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main diff --git a/magefiles/go.go b/magefiles/go.go index 9ef4d9fdc..2385b089e 100644 --- a/magefiles/go.go +++ b/magefiles/go.go @@ -1,19 +1,21 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main //import ( diff --git a/magefiles/helm.go b/magefiles/helm.go index 2ac2fc573..f9bf09cb5 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -1,19 +1,21 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main import ( diff --git a/magefiles/mage.go b/magefiles/mage.go index c6d4a2587..605d687a9 100644 --- a/magefiles/mage.go +++ b/magefiles/mage.go @@ -1,20 +1,22 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build ignore // +build ignore +/* +Copyright 2021 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main import ( diff --git a/magefiles/release.go b/magefiles/release.go index 714c24334..cbc4d51de 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -1,19 +1,21 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main import ( diff --git a/magefiles/tags.go b/magefiles/tags.go index b8dc86f88..02bbbcb37 100644 --- a/magefiles/tags.go +++ b/magefiles/tags.go @@ -1,19 +1,21 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main import ( diff --git a/magefiles/yaml.go b/magefiles/yaml.go index 443722de1..d7c7f588e 100644 --- a/magefiles/yaml.go +++ b/magefiles/yaml.go @@ -1,17 +1,19 @@ -//Copyright 2023 The Kubernetes Authors. -// -//Licensed under the Apache License, Version 2.0 (the "License"); -//you may not use this file except in compliance with the License. -//You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -//Unless required by applicable law or agreed to in writing, software -//distributed under the License is distributed on an "AS IS" BASIS, -//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -//See the License for the specific language governing permissions and -//limitations under the License. - //go:build mage +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package main From 87baa3e99e1cb9021455cea02c0a98706d095561 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 18 Jan 2023 15:54:44 -0500 Subject: [PATCH 021/822] update docs, and production urls Signed-off-by: James Strong --- magefiles/helm.go | 2 +- magefiles/release.go | 112 ++++++++++++++++++++++--------------------- 2 files changed, 59 insertions(+), 55 deletions(-) diff --git a/magefiles/helm.go b/magefiles/helm.go index f9bf09cb5..a57c46813 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -104,7 +104,7 @@ func updateChartReleaseNotes(releasesNotes []string) { for i := range releasesNotes { releaseNoteString = fmt.Sprintf("%s - %s\n", releaseNoteString, releasesNotes[i]) } - Info("HLEM Release note string %s", releaseNoteString) + Info("HELM Release note string %s", releaseNoteString) chart.Annotations["artifacthub.io/changes"] = releaseNoteString err = chartutil.SaveChartfile(HelmChartPath, chart) CheckIfError(err, "HELM Saving updated release notes for Chart") diff --git a/magefiles/release.go b/magefiles/release.go index cbc4d51de..3340a99ff 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -40,22 +40,61 @@ import ( type Release mg.Namespace -var INGRESS_ORG = "strongjz" // the owner so we can test from forks -var INGRESS_REPO = "ingress-nginx" // the repo to pull from -var RELEASE_BRANCH = "main" //we only release from main -var GITHUB_TOKEN string // the Google/gogithub lib needs an PAT to access the GitHub API -var K8S_IO_ORG = "strongjz" //the owner or organization for the k8s.io repo -var K8S_IO_REPO = "k8s.io" //the repo that holds the images yaml for production promotion -var INGRESS_REGISTRY = "registry.k8s.io" //Container registry for storage Ingress-nginx images +var INGRESS_ORG = "kubernetes" // the owner so we can test from forks +var INGRESS_REPO = "ingress-nginx" // the repo to pull from +var RELEASE_BRANCH = "main" //we only release from main +var GITHUB_TOKEN string // the Google/gogithub lib needs an PAT to access the GitHub API +var K8S_IO_ORG = "kubernetes" //the owner or organization for the k8s.io repo +var K8S_IO_REPO = "k8s.io" //the repo that holds the images yaml for production promotion +var INGRESS_REGISTRY = "registry.k8s.io" //Container registry for storage Ingress-nginx images +var KUSTOMIZE_INSTALL_VERSION = "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4" //static deploys needs kustomize to generate the template // ingress-nginx releases start with a TAG then a cloudbuild, then a promotion through a PR, this the location of that PR -// var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" -var IMAGES_YAML = "https://raw.githubusercontent.com/strongjz/k8s.io/testing/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" - +var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" var ctx = context.Background() // Context used for GitHub Client -const CHANGELOG = "Changelog.md" //Name of the changelog +const INDEX_DOCS = "docs/deploy/index.md" //index.md has a version of the controller and needs to updated +const CHANGELOG = "Changelog.md" //Name of the changelog +//ControllerImage - struct with info about controllers +type ControllerImage struct { + Tag string + Digest string + Registry string + Name string +} + +//IngressRelease All the information about an ingress-nginx release that gets updated +type IngressRelease struct { + ControllerVersion string + ControllerImage ControllerImage + ReleaseNote ReleaseNote + Release *github.RepositoryRelease +} + +//ReleaseNote - All the pieces of information/documents that get updated during a release +type ReleaseNote struct { + Version string + NewControllerVersion string + PreviousControllerVersion string + ControllerImages []ControllerImage + DepUpdates []string + Updates []string + HelmUpdates []string + NewHelmChartVersion string + PreviousHelmChartVersion string +} + +//IMAGES_YAML returns this data structure +type ImageYamls []ImageElement + +//ImageElement - a specific image and it's data structure the dmap is a list of shas and container versions +type ImageElement struct { + Name string `json:"name"` + Dmap map[string][]string `json:"dmap"` +} + +//init will set the GitHub token from the committers/releasers env var func init() { GITHUB_TOKEN = os.Getenv("GITHUB_TOKEN") } @@ -79,7 +118,7 @@ func (Release) NewRelease(version string) { Info("RELEASE Checking Current Version %s to New Version %s", tag, version) //if the version were upgrading does not match the TAG file, lets update the TAG file - if tag != version { + if tag[1:] != version { Warning("RELEASE Ingress Nginx TAG %s and new version %s do not match", tag, version) mg.Deps(mg.F(Tag.BumpNginx, fmt.Sprintf("v%s", version))) } @@ -122,22 +161,20 @@ func (Release) NewRelease(version string) { //update static manifest CheckIfError(updateStaticManifest(), "Error Updating Static manifests") - ////update e2e docs TODO + ////update e2e docs updateE2EDocs() //update documentation with ingress-nginx version CheckIfError(updateIndexMD(releaseNotes.PreviousControllerVersion, releaseNotes.NewControllerVersion), "Error Updating %s", INDEX_DOCS) + //keeping these manual for now //git commit TODO - //make Pull Request TODO - //make release TODO //mg.Deps(mg.F(Release.CreateRelease, version)) } -const INDEX_DOCS = "docs/deploy/index.md" - +// the index.md doc needs the controller version updated func updateIndexMD(old, new string) error { Info("Updating Deploy docs with new version") data, err := os.ReadFile(INDEX_DOCS) @@ -152,29 +189,29 @@ func updateIndexMD(old, new string) error { return nil } +//runs the hack/generate-deploy-scripts.sh func updateE2EDocs() { - //hack/generate-deploy-scripts.sh updates, err := sh.Output("./hack/generate-e2e-suite-doc.sh") CheckIfError(err, "Could not run update hack script") err = os.WriteFile("docs/e2e-tests.md", []byte(updates), 644) CheckIfError(err, "Could not write new e2e test file ") } +//The static deploy scripts use kustomize to generate them, this function ensures kustomize is installed func installKustomize() error { Info("Install Kustomize") var g0 = sh.RunCmd("go") - // somewhere in your main code - err := g0("install", "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4") + err := g0("install", KUSTOMIZE_INSTALL_VERSION) if err != nil { return err } return nil } +// func updateStaticManifest() error { CheckIfError(installKustomize(), "error installing kustomize") - //hack/generate-deploy-scripts.sh err := sh.RunV("./hack/generate-deploy-scripts.sh") if err != nil { @@ -192,32 +229,6 @@ func updateStaticManifest() error { // Info("New Release: Tag %v, ID: %v", newRelease.TagName, newRelease.ID) //} -type ControllerImage struct { - Tag string - Digest string - Registry string - Name string -} - -type IngressRelease struct { - ControllerVersion string - ControllerImage ControllerImage - ReleaseNote ReleaseNote - Release *github.RepositoryRelease -} - -type ReleaseNote struct { - Version string - NewControllerVersion string - PreviousControllerVersion string - ControllerImages []ControllerImage - DepUpdates []string - Updates []string - HelmUpdates []string - NewHelmChartVersion string - PreviousHelmChartVersion string -} - // Returns a GitHub client ready for use func githubClient() *github.Client { ts := oauth2.StaticTokenSource( @@ -428,13 +439,6 @@ func (r ReleaseNote) printRelease() { } } -type ImageYamls []ImageElement - -type ImageElement struct { - Name string `json:"name"` - Dmap map[string][]string `json:"dmap"` -} - func findImageDigest(yaml ImageYamls, image, version string) string { version = fmt.Sprintf("v%s", version) Info("Searching Digest for %s:%s", image, version) From 3885a823a01573b904a762cadd0e9f794280a255 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 19 Jan 2023 11:50:27 -0500 Subject: [PATCH 022/822] go fmt Signed-off-by: James Strong --- magefiles/release.go | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/magefiles/release.go b/magefiles/release.go index 3340a99ff..3c715bc07 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -56,7 +56,7 @@ var ctx = context.Background() // Context used for GitHub Client const INDEX_DOCS = "docs/deploy/index.md" //index.md has a version of the controller and needs to updated const CHANGELOG = "Changelog.md" //Name of the changelog -//ControllerImage - struct with info about controllers +// ControllerImage - struct with info about controllers type ControllerImage struct { Tag string Digest string @@ -64,7 +64,7 @@ type ControllerImage struct { Name string } -//IngressRelease All the information about an ingress-nginx release that gets updated +// IngressRelease All the information about an ingress-nginx release that gets updated type IngressRelease struct { ControllerVersion string ControllerImage ControllerImage @@ -72,7 +72,7 @@ type IngressRelease struct { Release *github.RepositoryRelease } -//ReleaseNote - All the pieces of information/documents that get updated during a release +// ReleaseNote - All the pieces of information/documents that get updated during a release type ReleaseNote struct { Version string NewControllerVersion string @@ -85,16 +85,16 @@ type ReleaseNote struct { PreviousHelmChartVersion string } -//IMAGES_YAML returns this data structure +// IMAGES_YAML returns this data structure type ImageYamls []ImageElement -//ImageElement - a specific image and it's data structure the dmap is a list of shas and container versions +// ImageElement - a specific image and it's data structure the dmap is a list of shas and container versions type ImageElement struct { Name string `json:"name"` Dmap map[string][]string `json:"dmap"` } -//init will set the GitHub token from the committers/releasers env var +// init will set the GitHub token from the committers/releasers env var func init() { GITHUB_TOKEN = os.Getenv("GITHUB_TOKEN") } @@ -189,7 +189,7 @@ func updateIndexMD(old, new string) error { return nil } -//runs the hack/generate-deploy-scripts.sh +// runs the hack/generate-deploy-scripts.sh func updateE2EDocs() { updates, err := sh.Output("./hack/generate-e2e-suite-doc.sh") CheckIfError(err, "Could not run update hack script") @@ -197,7 +197,7 @@ func updateE2EDocs() { CheckIfError(err, "Could not write new e2e test file ") } -//The static deploy scripts use kustomize to generate them, this function ensures kustomize is installed +// The static deploy scripts use kustomize to generate them, this function ensures kustomize is installed func installKustomize() error { Info("Install Kustomize") var g0 = sh.RunCmd("go") @@ -209,7 +209,6 @@ func installKustomize() error { return nil } -// func updateStaticManifest() error { CheckIfError(installKustomize(), "error installing kustomize") //hack/generate-deploy-scripts.sh From 4e85acce99fa27d56cc30aa2ef440e5d3c8f3359 Mon Sep 17 00:00:00 2001 From: Aarni Koskela Date: Wed, 25 Jan 2023 11:44:11 +0200 Subject: [PATCH 023/822] Move and spell-check Kubernetes 1.22 migration FAQ (#9544) * Move Kubernetes 1.22 migration guide to a separate file * Reformat and spell-check Kubernetes 1.22 migration doc --- docs/index.md | 232 +------------------------ docs/user-guide/k8s-122-migration.md | 245 +++++++++++++++++++++++++++ 2 files changed, 248 insertions(+), 229 deletions(-) create mode 100644 docs/user-guide/k8s-122-migration.md diff --git a/docs/index.md b/docs/index.md index fded1b2bc..bcf4a4018 100644 --- a/docs/index.md +++ b/docs/index.md @@ -11,233 +11,7 @@ You can learn more about using [Ingress](http://kubernetes.io/docs/user-guide/in See [Deployment](./deploy/) for a whirlwind tour that will get you started. -# FAQ - Migration to apiVersion `networking.k8s.io/v1` +# FAQ - Kubernetes 1.22 Migration -If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), and you plan to upgrade to Kubernetes v1.22, this section is relevant to you. - -- Please read this [official blog on deprecated Ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) - -- Please read this [official documentation on the IngressClass object](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) - -## What is an IngressClass and why is it important for users of Ingress-NGINX controller now ? - -IngressClass is a Kubernetes resource. See the description below. It's important because until now, a default install of the Ingress-NGINX controller did not require any IngressClass object. From version 1.0.0 of the Ingress-NGINX Controller, an IngressClass object is required. - -On clusters with more than one instance of the Ingress-NGINX controller, all instances of the controllers must be aware of which Ingress objects they serve. The `ingressClassName` field of an Ingress is the way to let the controller know about that. - -```console -kubectl explain ingressclass -``` -``` -KIND: IngressClass -VERSION: networking.k8s.io/v1 - -DESCRIPTION: - IngressClass represents the class of the Ingress, referenced by the Ingress - Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be - used to indicate that an IngressClass should be considered default. When a - single IngressClass resource has this annotation set to true, new Ingress - resources without a class specified will be assigned this default class. - -FIELDS: - apiVersion - APIVersion defines the versioned schema of this representation of an - object. Servers should convert recognized schemas to the latest internal - value, and may reject unrecognized values. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - - kind - Kind is a string value representing the REST resource this object - represents. Servers may infer this from the endpoint the client submits - requests to. Cannot be updated. In CamelCase. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - - metadata - Standard object's metadata. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata - - spec - Spec is the desired state of the IngressClass. More info: - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status` - -``` - -## What has caused this change in behavior? - -There are 2 reasons primarily. - -### Reason #1 - -Until K8s version 1.21, it was possible to create an Ingress resource using deprecated versions of the Ingress API, such as: - - - `extensions/v1beta1` - - `networking.k8s.io/v1beta1` - -You would get a message about deprecation, but the Ingress resource would get created. - -From K8s version 1.22 onwards, you can **only** access the Ingress API via the stable, `networking.k8s.io/v1` API. The reason is explained in the [official blog on deprecated ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/). - -### Reason #2 - -If you are already using the Ingress-NGINX controller and then upgrade to K8s version v1.22 , there are several scenarios where your existing Ingress objects will not work how you expect. Read this FAQ to check which scenario matches your use case. - -## What is ingressClassName field ? - -`ingressClassName` is a field in the specs of an Ingress object. - -```shell -kubectl explain ingress.spec.ingressClassName -``` -```console -KIND: Ingress -VERSION: networking.k8s.io/v1 - -FIELD: ingressClassName - -DESCRIPTION: - IngressClassName is the name of the IngressClass cluster resource. The - associated IngressClass defines which controller will implement the - resource. This replaces the deprecated `kubernetes.io/ingress.class` - annotation. For backwards compatibility, when that annotation is set, it - must be given precedence over this field. The controller may emit a warning - if the field and annotation have different values. Implementations of this - API should ignore Ingresses without a class specified. An IngressClass - resource may be marked as default, which can be used to set a default value - for this field. For more information, refer to the IngressClass - documentation. -``` - -The `.spec.ingressClassName` behavior has precedence over the deprecated `kubernetes.io/ingress.class` annotation. - - -## I have only one ingress controller in my cluster. What should I do? - -If a single instance of the Ingress-NGINX controller is the sole Ingress controller running in your cluster, you should add the annotation "ingressclass.kubernetes.io/is-default-class" in your IngressClass, so any new Ingress objects will have this one as default IngressClass. - -When using Helm, you can enable this annotation by setting `.controller.ingressClassResource.default: true` in your Helm chart installation's values file. - -If you have any old Ingress objects remaining without an IngressClass set, you can do one or more of the following to make the Ingress-NGINX controller aware of the old objects: - -- You can manually set the [`.spec.ingressClassName`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec) field in the manifest of your own Ingress resources. -- You can re-create them after setting the `ingressclass.kubernetes.io/is-default-class` annotation to `true` on the IngressClass -- Alternatively you can make the Ingress-NGINX controller watch Ingress objects without the ingressClassName field set by starting your Ingress-NGINX with the flag [--watch-ingress-without-class=true](#what-is-the-flag-watch-ingress-without-class) . When using Helm, you can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true` - -You can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true`. - -We recommend that you create the IngressClass as shown below: -``` ---- -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - app.kubernetes.io/component: controller - name: nginx - annotations: - ingressclass.kubernetes.io/is-default-class: "true" -spec: - controller: k8s.io/ingress-nginx -``` - -And add the value `spec.ingressClassName=nginx` in your Ingress objects. - - -## I have multiple ingress objects in my cluster. What should I do ? -- If you have lot of ingress objects without ingressClass configuration, you can run the ingress-controller with the flag `--watch-ingress-without-class=true`. - - -### What is the flag '--watch-ingress-without-class' ? -- Its a flag that is passed,as an argument, to the `nginx-ingress-controller` executable. In the configuration, it looks like this: -``` -... -... -args: - - /nginx-ingress-controller - - --watch-ingress-without-class=true - - --publish-service=$(POD_NAMESPACE)/ingress-nginx-dev-v1-test-controller - - --election-id=ingress-controller-leader - - --controller-class=k8s.io/ingress-nginx - - --configmap=$(POD_NAMESPACE)/ingress-nginx-dev-v1-test-controller - - --validating-webhook=:8443 - - --validating-webhook-certificate=/usr/local/certificates/cert - - --validating-webhook-key=/usr/local/certificates/key -... -... -``` - -## I have more than one controller in my cluster and already use the annotation ? - -No problem. This should still keep working, but we highly recommend you to test! - -Even though `kubernetes.io/ingress.class` is deprecated, the Ingress-NGINX controller still understands that annotation. -If you want to follow good practice, you should consider migrating to use IngressClass and `.spec.ingressClassName`. - -## I have more than one controller running in my cluster, and I want to use the new API ? - -In this scenario, you need to create multiple IngressClasses (see example one). But be aware that IngressClass works in a very specific way: you will need to change the `.spec.controller` value in your IngressClass and configure the controller to expect the exact same value. - -Let's see some example, supposing that you have three IngressClasses: - -- IngressClass `ingress-nginx-one`, with `.spec.controller` equal to `example.com/ingress-nginx1` -- IngressClass `ingress-nginx-two`, with `.spec.controller` equal to `example.com/ingress-nginx2` -- IngressClass `ingress-nginx-three`, with `.spec.controller` equal to `example.com/ingress-nginx1` - -(for private use, you can also use a controller name that doesn't contain a `/`; for example: `ingress-nginx1`) - -When deploying your ingress controllers, you will have to change the `--controller-class` field as follows: - -- Ingress-Nginx A, configured to use controller class name `example.com/ingress-nginx1` -- Ingress-Nginx B, configured to use controller class name `example.com/ingress-nginx2` - -Then, when you create an Ingress object with its `ingressClassName` set to `ingress-nginx-two`, only controllers looking for the `example.com/ingress-nginx2` controller class pay attention to the new object. Given that Ingress-Nginx B is set up that way, it will serve that object, whereas Ingress-Nginx A ignores the new Ingress. - -Bear in mind that, if you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true`, then it will serve: - -1. Ingresses without any `ingressClassName` set -2. Ingresses where the deprecated annotation (`kubernetes.io/ingress.class`) matches the value set in the command line argument `--ingress-class` -3. Ingresses that refer to any IngressClass that has the same `spec.controller` as configured in `--controller-class` - -If you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true` and you run Ingress-Nginx A with the command line argument `--watch-ingress-without-class=false` then this is a supported configuration. If you have two Ingress-NGINX controllers for the same cluster, both running with `--watch-ingress-without-class=true` then there is likely to be a conflict. - -## I am seeing this error message in the logs of the Ingress-NGINX controller: "ingress class annotation is not equal to the expected by Ingress Controller". Why ? - -- It is highly likely that you will also see the name of the ingress resource in the same error message. This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in a Ingress resource manifest. It is recommended to use the `.spec.ingressClassName` field of the Ingress resource, to specify the name of the IngressClass of the Ingress you are defining. - -## How to easily install multiple instances of the ingress-NGINX controller in the same cluster ? -- Create a new namespace - ``` - kubectl create namespace ingress-nginx-2 - ``` -- Use Helm to install the additional instance of the ingress controller -- Ensure you have Helm working (refer to the [Helm documentation](https://helm.sh/docs/)) -- We have to assume that you have the helm repo for the ingress-NGINX controller already added to your Helm config. But, if you have not added the helm repo then you can do this to add the repo to your helm config; - ``` - helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx - ``` -- Make sure you have updated the helm repo data; - ``` - helm repo update - ``` -- Now, install an additional instance of the ingress-NGINX controller like this: - ``` - helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ - --namespace ingress-nginx-2 \ - --set controller.ingressClassResource.name=nginx-two \ - --set controller.ingressClass=nginx-two \ - --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ - --set controller.ingressClassResource.enabled=true \ - --set controller.ingressClassByName=true - ``` -- If you need to install yet another instance, then repeat the procedure to create a new namespace, change the values such as names & namespaces (for example from "-2" to "-3"), or anything else that meets your needs. -- If you need to install all instances in the same namespace, then you need to specify a different **election id**, like this: - ``` - helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ - --namespace kube-system \ - --set controller.electionID=nginx-two-leader \ - --set controller.ingressClassResource.name=nginx-two \ - --set controller.ingressClass=nginx-two \ - --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ - --set controller.ingressClassResource.enabled=true \ - --set controller.ingressClassByName=true - ``` - - Note, controller.ingressClassResource.name and controller.ingressClass have to be set with the value of the new class as the first is to create the IngressClass object and the other is to modify the deployment of the actuall ingress controller pod. +If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), +and you plan to upgrade to Kubernetes v1.22, please read [the migration guide here](./user-guide/k8s-122-migration.md). diff --git a/docs/user-guide/k8s-122-migration.md b/docs/user-guide/k8s-122-migration.md new file mode 100644 index 000000000..34893f931 --- /dev/null +++ b/docs/user-guide/k8s-122-migration.md @@ -0,0 +1,245 @@ +# FAQ - Migration to Kubernetes 1.22 and apiVersion `networking.k8s.io/v1` + +If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), +and you plan to upgrade to Kubernetes v1.22, this page is relevant to you. + +- Please read this [official blog on deprecated Ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) +- Please read this [official documentation on the IngressClass object](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) + +## What is an IngressClass and why is it important for users of ingress-nginx controller now? + +IngressClass is a Kubernetes resource. See the description below. +It's important because until now, a default install of the ingress-nginx controller did not require a IngressClass object. +From version 1.0.0 of the ingress-nginx controller, an IngressClass object is required. + +On clusters with more than one instance of the ingress-nginx controller, all instances of the controllers must be aware of which Ingress objects they serve. +The `ingressClassName` field of an Ingress is the way to let the controller know about that. + +```console +kubectl explain ingressclass +``` + +``` +KIND: IngressClass +VERSION: networking.k8s.io/v1 +DESCRIPTION: + IngressClass represents the class of the Ingress, referenced by the Ingress + Spec. The `ingressclass.kubernetes.io/is-default-class` annotation can be + used to indicate that an IngressClass should be considered default. When a + single IngressClass resource has this annotation set to true, new Ingress + resources without a class specified will be assigned this default class. +FIELDS: + apiVersion + APIVersion defines the versioned schema of this representation of an + object. Servers should convert recognized schemas to the latest internal + value, and may reject unrecognized values. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + kind + Kind is a string value representing the REST resource this object + represents. Servers may infer this from the endpoint the client submits + requests to. Cannot be updated. In CamelCase. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + metadata + Standard object's metadata. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + spec + Spec is the desired state of the IngressClass. More info: + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status` +``` + +## What has caused this change in behavior? + +There are 2 primary reasons. + +### Reason 1 + +Until K8s version 1.21, it was possible to create an Ingress resource using deprecated versions of the Ingress API, such as: + +- `extensions/v1beta1` +- `networking.k8s.io/v1beta1` + You would get a message about deprecation, but the Ingress resource would get created. + +From K8s version 1.22 onwards, you can **only** access the Ingress API via the stable, `networking.k8s.io/v1` API. +The reason is explained in the [official blog on deprecated ingress API versions](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/). + +### Reason #2 + +If you are already using the ingress-nginx controller and then upgrade to Kubernetes 1.22, +there are several scenarios where your existing Ingress objects will not work how you expect. + +Read this FAQ to check which scenario matches your use case. + +## What is the `ingressClassName` field? + +`ingressClassName` is a field in the spec of an Ingress object. + +```shell +kubectl explain ingress.spec.ingressClassName +``` + +```console +KIND: Ingress +VERSION: networking.k8s.io/v1 +FIELD: ingressClassName +DESCRIPTION: + IngressClassName is the name of the IngressClass cluster resource. The + associated IngressClass defines which controller will implement the + resource. This replaces the deprecated `kubernetes.io/ingress.class` + annotation. For backwards compatibility, when that annotation is set, it + must be given precedence over this field. The controller may emit a warning + if the field and annotation have different values. Implementations of this + API should ignore Ingresses without a class specified. An IngressClass + resource may be marked as default, which can be used to set a default value + for this field. For more information, refer to the IngressClass + documentation. +``` + +The `.spec.ingressClassName` behavior has precedence over the deprecated `kubernetes.io/ingress.class` annotation. + +## I have only one ingress controller in my cluster. What should I do? + +If a single instance of the ingress-nginx controller is the sole Ingress controller running in your cluster, +you should add the annotation "ingressclass.kubernetes.io/is-default-class" in your IngressClass, +so any new Ingress objects will have this one as default IngressClass. + +When using Helm, you can enable this annotation by setting `.controller.ingressClassResource.default: true` in your Helm chart installation's values file. + +If you have any old Ingress objects remaining without an IngressClass set, you can do one or more of the following to make the ingress-nginx controller aware of the old objects: + +- You can manually set the [`.spec.ingressClassName`](https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec) field in the manifest of your own Ingress resources. +- You can re-create them after setting the `ingressclass.kubernetes.io/is-default-class` annotation to `true` on the IngressClass +- Alternatively you can make the ingress-nginx controller watch Ingress objects without the ingressClassName field set by starting your ingress-nginx with the flag [--watch-ingress-without-class=true](#what-is-the-flag-watch-ingress-without-class). + When using Helm, you can configure your Helm chart installation's values file with `.controller.watchIngressWithoutClass: true`. + +We recommend that you create the IngressClass as shown below: + +``` +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + app.kubernetes.io/component: controller + name: nginx + annotations: + ingressclass.kubernetes.io/is-default-class: "true" +spec: + controller: k8s.io/ingress-nginx +``` + +and add the value `spec.ingressClassName=nginx` in your Ingress objects. + +## I have many ingress objects in my cluster. What should I do? + +If you have lot of ingress objects without ingressClass configuration, +you can run the ingress controller with the flag `--watch-ingress-without-class=true`. + +### What is the flag `--watch-ingress-without-class`? + +It's a flag that is passed, as an argument, to the `nginx-ingress-controller` executable. +In the configuration, it looks like this: + +```yaml +# ... +args: + - /nginx-ingress-controller + - --watch-ingress-without-class=true + - --controller-class=k8s.io/ingress-nginx + # ... +# ... +``` + +## I have more than one controller in my cluster, and I'm already using the annotation + +No problem. This should still keep working, but we highly recommend you to test! +Even though `kubernetes.io/ingress.class` is deprecated, the ingress-nginx controller still understands that annotation. +If you want to follow good practice, you should consider migrating to use IngressClass and `.spec.ingressClassName`. + +## I have more than one controller running in my cluster, and I want to use the new API + +In this scenario, you need to create multiple IngressClasses (see the example above). + +Be aware that IngressClass works in a very specific way: you will need to change the `.spec.controller` value in your IngressClass and configure the controller to expect the exact same value. + +Let's see an example, supposing that you have three IngressClasses: + +- IngressClass `ingress-nginx-one`, with `.spec.controller` equal to `example.com/ingress-nginx1` +- IngressClass `ingress-nginx-two`, with `.spec.controller` equal to `example.com/ingress-nginx2` +- IngressClass `ingress-nginx-three`, with `.spec.controller` equal to `example.com/ingress-nginx1` + +For private use, you can also use a controller name that doesn't contain a `/`, e.g. `ingress-nginx1`. + +When deploying your ingress controllers, you will have to change the `--controller-class` field as follows: + +- Ingress-Nginx A, configured to use controller class name `example.com/ingress-nginx1` +- Ingress-Nginx B, configured to use controller class name `example.com/ingress-nginx2` + +When you create an Ingress object with its `ingressClassName` set to `ingress-nginx-two`, +only controllers looking for the `example.com/ingress-nginx2` controller class pay attention to the new object. + +Given that Ingress-Nginx B is set up that way, it will serve that object, whereas Ingress-Nginx A ignores the new Ingress. + +Bear in mind that if you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true`, it will serve: + +1. Ingresses without any `ingressClassName` set +2. Ingresses where the deprecated annotation (`kubernetes.io/ingress.class`) matches the value set in the command line argument `--ingress-class` +3. Ingresses that refer to any IngressClass that has the same `spec.controller` as configured in `--controller-class` +4. If you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true` and you run Ingress-Nginx A with the command line argument `--watch-ingress-without-class=false` then this is a supported configuration. + If you have two ingress-nginx controllers for the same cluster, both running with `--watch-ingress-without-class=true` then there is likely to be a conflict. + +## Why am I am seeing "ingress class annotation is not equal to the expected by Ingress Controller" in my controller logs? + +It is highly likely that you will also see the name of the ingress resource in the same error message. +This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in a Ingress resource manifest. +It is recommended to use the `.spec.ingressClassName` field of the Ingress resource, to specify the name of the IngressClass of the Ingress you are defining. + +## How can I easily install multiple instances of the ingress-nginx controller in the same cluster? + +You can install them in different namespaces. + +- Create a new namespace + ``` + kubectl create namespace ingress-nginx-2 + ``` +- Use Helm to install the additional instance of the ingress controller +- Ensure you have Helm working (refer to the [Helm documentation](https://helm.sh/docs/)) +- We have to assume that you have the helm repo for the ingress-nginx controller already added to your Helm config. + But, if you have not added the helm repo then you can do this to add the repo to your helm config; + ``` + helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx + ``` +- Make sure you have updated the helm repo data; + ``` + helm repo update + ``` +- Now, install an additional instance of the ingress-nginx controller like this: + ``` + helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ + --namespace ingress-nginx-2 \ + --set controller.ingressClassResource.name=nginx-two \ + --set controller.ingressClass=nginx-two \ + --set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ + --set controller.ingressClassResource.enabled=true \ + --set controller.ingressClassByName=true + ``` + +If you need to install yet another instance, then repeat the procedure to create a new namespace, +change the values such as names & namespaces (for example from "-2" to "-3"), or anything else that meets your needs. + +Note that `controller.ingressClassResource.name` and `controller.ingressClass` have to be set correctly. +The first is to create the IngressClass object and the other is to modify the deployment of the actual ingress controller pod. + +### I can't use multiple namespaces, what should I do? + +If you need to install all instances in the same namespace, then you need to specify a different **election id**, like this: + +``` +helm install ingress-nginx-2 ingress-nginx/ingress-nginx \ +--namespace kube-system \ +--set controller.electionID=nginx-two-leader \ +--set controller.ingressClassResource.name=nginx-two \ +--set controller.ingressClass=nginx-two \ +--set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \ +--set controller.ingressClassResource.enabled=true \ +--set controller.ingressClassByName=true +``` From 909a8185920c45f99292cce705dba07c770e6f74 Mon Sep 17 00:00:00 2001 From: Ismayil Mirzali Date: Fri, 27 Jan 2023 17:12:27 +0200 Subject: [PATCH 024/822] tcpproxy: increase buffer size to 16K (#9548) --- pkg/tcpproxy/tcp.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/tcpproxy/tcp.go b/pkg/tcpproxy/tcp.go index 4c34e1f7b..86850ad54 100644 --- a/pkg/tcpproxy/tcp.go +++ b/pkg/tcpproxy/tcp.go @@ -59,11 +59,12 @@ func (p *TCPProxy) Get(host string) *TCPServer { // and open a connection to the passthrough server. func (p *TCPProxy) Handle(conn net.Conn) { defer conn.Close() - data := make([]byte, 4096) + // See: https://www.ibm.com/docs/en/ztpf/1.1.0.15?topic=sessions-ssl-record-format + data := make([]byte, 16384) length, err := conn.Read(data) if err != nil { - klog.V(4).ErrorS(err, "Error reading the first 4k of the connection") + klog.V(4).ErrorS(err, "Error reading data from the connection") return } From 0c3625cdb919c9348033369dd890569aea66ed4a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 30 Jan 2023 12:44:50 -0800 Subject: [PATCH 025/822] Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 22 ++++++++++---------- go.sum | 65 +++++++++++++++++++++++++++++++++++++--------------------- 2 files changed, 53 insertions(+), 34 deletions(-) diff --git a/go.mod b/go.mod index 6f90615ff..03b3ebdb7 100644 --- a/go.mod +++ b/go.mod @@ -30,17 +30,17 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.0 - k8s.io/apiextensions-apiserver v0.26.0 - k8s.io/apimachinery v0.26.0 - k8s.io/apiserver v0.26.0 + k8s.io/api v0.26.1 + k8s.io/apiextensions-apiserver v0.26.1 + k8s.io/apimachinery v0.26.1 + k8s.io/apiserver v0.26.1 k8s.io/cli-runtime v0.26.0 - k8s.io/client-go v0.26.0 - k8s.io/code-generator v0.26.0 - k8s.io/component-base v0.26.0 + k8s.io/client-go v0.26.1 + k8s.io/code-generator v0.26.1 + k8s.io/component-base v0.26.1 k8s.io/klog/v2 v2.80.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 - sigs.k8s.io/controller-runtime v0.13.1 + sigs.k8s.io/controller-runtime v0.14.2 sigs.k8s.io/mdtoc v1.1.0 ) @@ -77,7 +77,6 @@ require ( github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect - github.com/magefile/mage v1.14.0 // indirect github.com/mailru/easyjson v0.7.6 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect @@ -88,6 +87,7 @@ require ( github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833 // indirect + github.com/onsi/ginkgo v1.16.5 // indirect github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/errors v0.9.1 // indirect @@ -104,7 +104,7 @@ require ( golang.org/x/sys v0.4.0 // indirect golang.org/x/term v0.4.0 // indirect golang.org/x/text v0.6.0 // indirect - golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect + golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 // indirect @@ -115,7 +115,7 @@ require ( gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect - k8s.io/utils v0.0.0-20221107191617-1a15be271d1d // indirect + k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect sigs.k8s.io/kustomize/api v0.12.1 // indirect sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect diff --git a/go.sum b/go.sum index 8a32d3e00..7588a51fb 100644 --- a/go.sum +++ b/go.sum @@ -87,6 +87,8 @@ github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQL github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b h1:074/xhloHUBOpTZwlIzQ28rbPY8pNJvzY7Gcx5KnNOk= @@ -116,6 +118,7 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro= github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= @@ -195,6 +198,7 @@ github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWet github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= @@ -231,8 +235,6 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= -github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= -github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= @@ -276,10 +278,17 @@ github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833/go.mod h1:0CznHmX github.com/ncabatoff/process-exporter v0.7.10 h1:+Ere7+3se6QqP54gg7aBRagWcL8bq3u5zNi/GRSWeKQ= github.com/ncabatoff/process-exporter v0.7.10/go.mod h1:DHZRZjqxw9LCOpLlX0DjBuyn6d5plh41Jv6Tmttj7Ek= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= +github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= +github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= +github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= +github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= github.com/onsi/ginkgo/v2 v2.6.1 h1:1xQPCjcqYw/J5LchOcp4/2q/jzJFjiAOc25chhnDw+Q= github.com/onsi/ginkgo/v2 v2.6.1/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo= +github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= +github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.24.1 h1:KORJXNNTzJXzu4ScJWssJfJMnJ+2QJqhoQSRwNlze9E= github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= @@ -385,7 +394,7 @@ go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee33 go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o= go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= -go.uber.org/zap v1.21.0 h1:WefMeulhovoZ2sYXz7st6K0sLj7bBhpiFaud4r4zST8= +go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60= golang.org/dl v0.0.0-20190829154251-82a15e2f2ead/go.mod h1:IUMfjQLJQd4UTqG1Z90tenwKoCX93Gn3MAQJMOSBsDQ= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= @@ -430,6 +439,7 @@ golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -452,6 +462,7 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/ golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= @@ -482,6 +493,7 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -493,10 +505,13 @@ golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -517,6 +532,7 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= @@ -542,8 +558,8 @@ golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.0.0-20220609170525-579cf78fd858 h1:Dpdu/EMxGMFgq0CeYMh4fazTD2vtlZRYE7wyynxJb9U= -golang.org/x/time v0.0.0-20220609170525-579cf78fd858/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= +golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= @@ -586,6 +602,7 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= @@ -689,6 +706,7 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/go-playground/assert.v1 v1.2.1 h1:xoYuJVE7KT85PYWrN730RguIQO0ePzVRfFMXadIrXTM= gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE= gopkg.in/go-playground/pool.v3 v3.1.1 h1:4Qcj91IsYTpIeRhe/eo6Fz+w6uKWPEghx8vHFTYMfhw= @@ -698,6 +716,7 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= gopkg.in/mcuadros/go-syslog.v2 v2.3.0 h1:kcsiS+WsTKyIEPABJBJtoG0KkOS6yzvJ+/eZlhD79kk= gopkg.in/mcuadros/go-syslog.v2 v2.3.0/go.mod h1:l5LPIyOOyIdQquNg+oU6Z3524YwrcqEm0aKH+5zpt2U= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= @@ -718,22 +737,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.0 h1:IpPlZnxBpV1xl7TGk/X6lFtpgjgntCg8PJ+qrPHAC7I= -k8s.io/api v0.26.0/go.mod h1:k6HDTaIFC8yn1i6pSClSqIwLABIcLV9l5Q4EcngKnQg= -k8s.io/apiextensions-apiserver v0.26.0 h1:Gy93Xo1eg2ZIkNX/8vy5xviVSxwQulsnUdQ00nEdpDo= -k8s.io/apiextensions-apiserver v0.26.0/go.mod h1:7ez0LTiyW5nq3vADtK6C3kMESxadD51Bh6uz3JOlqWQ= -k8s.io/apimachinery v0.26.0 h1:1feANjElT7MvPqp0JT6F3Ss6TWDwmcjLypwoPpEf7zg= -k8s.io/apimachinery v0.26.0/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= -k8s.io/apiserver v0.26.0 h1:q+LqIK5EZwdznGZb8bq0+a+vCqdeEEe4Ux3zsOjbc4o= -k8s.io/apiserver v0.26.0/go.mod h1:aWhlLD+mU+xRo+zhkvP/gFNbShI4wBDHS33o0+JGI84= +k8s.io/api v0.26.1 h1:f+SWYiPd/GsiWwVRz+NbFyCgvv75Pk9NK6dlkZgpCRQ= +k8s.io/api v0.26.1/go.mod h1:xd/GBNgR0f707+ATNyPmQ1oyKSgndzXij81FzWGsejg= +k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI= +k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM= +k8s.io/apimachinery v0.26.1 h1:8EZ/eGJL+hY/MYCNwhmDzVqq2lPl3N3Bo8rvweJwXUQ= +k8s.io/apimachinery v0.26.1/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= +k8s.io/apiserver v0.26.1 h1:6vmnAqCDO194SVCPU3MU8NcDgSqsUA62tBUSWrFXhsc= +k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg= k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= -k8s.io/client-go v0.26.0 h1:lT1D3OfO+wIi9UFolCrifbjUUgu7CpLca0AD8ghRLI8= -k8s.io/client-go v0.26.0/go.mod h1:I2Sh57A79EQsDmn7F7ASpmru1cceh3ocVT9KlX2jEZg= -k8s.io/code-generator v0.26.0 h1:ZDY+7Gic9p/lACgD1G72gQg2CvNGeAYZTPIncv+iALM= -k8s.io/code-generator v0.26.0/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= -k8s.io/component-base v0.26.0 h1:0IkChOCohtDHttmKuz+EP3j3+qKmV55rM9gIFTXA7Vs= -k8s.io/component-base v0.26.0/go.mod h1:lqHwlfV1/haa14F/Z5Zizk5QmzaVf23nQzCwVOQpfC8= +k8s.io/client-go v0.26.1 h1:87CXzYJnAMGaa/IDDfRdhTzxk/wzGZ+/HUQpqgVSZXU= +k8s.io/client-go v0.26.1/go.mod h1:IWNSglg+rQ3OcvDkhY6+QLeasV4OYHDjdqeWkDQZwGE= +k8s.io/code-generator v0.26.1 h1:dusFDsnNSKlMFYhzIM0jAO1OlnTN5WYwQQ+Ai12IIlo= +k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= +k8s.io/component-base v0.26.1 h1:4ahudpeQXHZL5kko+iDHqLj/FSGAEUnSVO0EBbgDd+4= +k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/kAWU= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= @@ -741,15 +760,15 @@ k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d h1:0Smp/HP1OH4Rvhe+4B8nWGERtlqAGSftbSbbmm45oFs= -k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= +k8s.io/utils v0.0.0-20221128185143-99ec85e7a448/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 h1:SAElp8THCfmBdM+4lmWX5gebiSSkEr7PAYDVF91qpfg= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R5A2EgsVzG8RTt4RfPoQuRAcDmg= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/controller-runtime v0.13.1 h1:tUsRCSJVM1QQOOeViGeX3GMT3dQF1eePPw6sEE3xSlg= -sigs.k8s.io/controller-runtime v0.13.1/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI= +sigs.k8s.io/controller-runtime v0.14.2 h1:P6IwDhbsRWsBClt/8/h8Zy36bCuGuW5Op7MHpFrN/60= +sigs.k8s.io/controller-runtime v0.14.2/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= From 3999fb8923e3a7bf2ab89eccf4210e4df0f8af52 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 31 Jan 2023 17:31:05 -0800 Subject: [PATCH 026/822] Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 03b3ebdb7..5224aefbe 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( k8s.io/client-go v0.26.1 k8s.io/code-generator v0.26.1 k8s.io/component-base v0.26.1 - k8s.io/klog/v2 v2.80.1 + k8s.io/klog/v2 v2.90.0 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.2 sigs.k8s.io/mdtoc v1.1.0 diff --git a/go.sum b/go.sum index 7588a51fb..0a7ed9440 100644 --- a/go.sum +++ b/go.sum @@ -756,8 +756,8 @@ k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/k k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4= -k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/klog/v2 v2.90.0 h1:VkTxIV/FjRXn1fgNNcKGM8cfmL1Z33ZjXRTVxKCoF5M= +k8s.io/klog/v2 v2.90.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= From 95e525ccc20cc86d97e8771c90b1b75cad543c10 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 31 Jan 2023 17:33:06 -0800 Subject: [PATCH 027/822] Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5224aefbe..10b9e2fda 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.5.0 - google.golang.org/grpc v1.52.0 + google.golang.org/grpc v1.52.3 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 0a7ed9440..6e370c655 100644 --- a/go.sum +++ b/go.sum @@ -679,8 +679,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk= -google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= +google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ= +google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From fb2223b12c70cdf746349393a7f44b753576b49c Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 31 Jan 2023 21:16:48 -0500 Subject: [PATCH 028/822] build release 1.6.1 image Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index b7c0a9b1d..023604509 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.6.0 +v1.6.1 From 41c2f2454c0b1b4c7aad49f05f8bcc6af4e6ed35 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 1 Feb 2023 16:51:36 -0500 Subject: [PATCH 029/822] add lint on chart before release (#9570) Signed-off-by: James Strong --- .github/workflows/helm.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 5d96507a1..2bd271bb2 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -25,6 +25,18 @@ jobs: - name: Checkout uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + - name: Run Artifact Hub lint + run: | + wget https://github.com/artifacthub/hub/releases/download/v1.5.0/ah_1.5.0_linux_amd64.tar.gz + echo 'ad0e44c6ea058ab6b85dbf582e88bad9fdbc64ded0d1dd4edbac65133e5c87da *ah_1.5.0_linux_amd64.tar.gz' | shasum -c + tar -xzvf ah_1.5.0_linux_amd64.tar.gz ah + ./ah lint -p charts/ingress-nginx || exit 1 + rm -f ./ah ./ah_1.5.0_linux_amd64.tar.gz + + - name: Lint + run: | + ./build/run-in-docker.sh ./hack/verify-chart-lint.sh + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter with: From 7782c70030bc5cbe9f981fc4126c31dd715f9427 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 2 Feb 2023 14:48:36 -0500 Subject: [PATCH 030/822] build 1.6.2 to fix (#9569) --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index 023604509..98610aa42 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.6.1 +v1.6.2 \ No newline at end of file From dea3a9a3f788f92f10d668c9ecd33e76b1347a87 Mon Sep 17 00:00:00 2001 From: Jongwoo Han Date: Mon, 6 Feb 2023 16:37:00 +0900 Subject: [PATCH 031/822] Replace deprecated command with environment file (#9581) Signed-off-by: jongwooo --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 67fad3187..b19031ff6 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -42,7 +42,7 @@ jobs: echo "${SHORT_TAGS[0]},${SHORT_TAGS[1]},${SHORT_TAGS[2]}" TAGS_JSON="[\"${SHORT_TAGS[0]}\",\"${SHORT_TAGS[1]}\",\"${SHORT_TAGS[2]}\"]" echo "${TAGS_JSON}" - echo "::set-output name=TAGS::${TAGS_JSON}" + echo "TAGS=${TAGS_JSON}" >> $GITHUB_OUTPUT scan: runs-on: ubuntu-latest From 6f713b76a15f4ed6488b9969cedaa176f3cbeb9d Mon Sep 17 00:00:00 2001 From: Kir Shatrov Date: Wed, 8 Feb 2023 20:25:02 +0300 Subject: [PATCH 032/822] Allow to pass a target test (#9542) --- test/test-lua.sh | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/test/test-lua.sh b/test/test-lua.sh index 3b00cf35a..9c8149eac 100755 --- a/test/test-lua.sh +++ b/test/test-lua.sh @@ -25,14 +25,23 @@ set -o pipefail BUSTED_ARGS="-v --pattern=_test" -resty \ - -I ./rootfs/etc/nginx/lua \ - --shdict "configuration_data 5M" \ - --shdict "certificate_data 16M" \ - --shdict "certificate_servers 1M" \ - --shdict "ocsp_response_cache 1M" \ - --shdict "balancer_ewma 1M" \ - --shdict "balancer_ewma_last_touched_at 1M" \ - --shdict "balancer_ewma_locks 512k" \ - --shdict "global_throttle_cache 5M" \ - ./rootfs/etc/nginx/lua/test/run.lua ${BUSTED_ARGS} ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test +SHDICT_ARGS=( + "-I" "./rootfs/etc/nginx/lua" + "--shdict" "configuration_data 5M" + "--shdict" "certificate_data 16M" + "--shdict" "certificate_servers 1M" + "--shdict" "ocsp_response_cache 1M" + "--shdict" "balancer_ewma 1M" + "--shdict" "quota_tracker 1M" + "--shdict" "high_throughput_tracker 1M" + "--shdict" "balancer_ewma_last_touched_at 1M" + "--shdict" "balancer_ewma_locks 512k" + "--shdict" "global_throttle_cache 5M" + "./rootfs/etc/nginx/lua/test/run.lua" +) + +if [ $# -eq 0 ]; then + resty "${SHDICT_ARGS[@]}" ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test +else + resty "${SHDICT_ARGS[@]}" $@ +fi From 59d247dd7433fd2cd99d381c1bcfce9f7dde7ac0 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 10 Feb 2023 15:13:30 +0100 Subject: [PATCH 033/822] update history and allow to pass a target test (#9605) * Replace deprecated command with environment file (#9581) Signed-off-by: jongwooo * Allow to pass a target test (#9542) * start 1.6.0 release Signed-off-by: James Strong * testing auto change Signed-off-by: James Strong * Add mage files for changelog Signed-off-by: James Strong * change format Signed-off-by: James Strong * fixed boiler plate lint Signed-off-by: James Strong * Align default value for keepalive_request with NGINX default (#9518) * Align default value for keepalive_request with NGINX default --------- Signed-off-by: jongwooo Signed-off-by: James Strong Co-authored-by: Jongwoo Han Co-authored-by: Kir Shatrov Co-authored-by: Christian Schaefer --- TAG | 3 +- .../nginx-configuration/configmap.md | 403 +++++++++--------- go.mod | 1 + go.sum | 2 + 4 files changed, 196 insertions(+), 213 deletions(-) diff --git a/TAG b/TAG index 98610aa42..103ae529e 100644 --- a/TAG +++ b/TAG @@ -1 +1,2 @@ -v1.6.2 \ No newline at end of file +v1.6.2 + diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index 3832bba16..fc5bd07c2 100755 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -25,199 +25,197 @@ data: The following table shows a configuration option's name, type, and the default value: -| name | type | default | -|:--------------------------------------------------------------------------------|:-------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [add-headers](#add-headers) | string | "" | -| [allow-backend-server-header](#allow-backend-server-header) | bool | "false" | -| [allow-snippet-annotations](#allow-snippet-annotations) | bool | true | -| [annotation-value-word-blocklist](#annotation-value-word-blocklist) | string array | "" | -| [hide-headers](#hide-headers) | string array | empty | -| [access-log-params](#access-log-params) | string | "" | -| [access-log-path](#access-log-path) | string | "/var/log/nginx/access.log" | -| [http-access-log-path](#http-access-log-path) | string | "" | -| [stream-access-log-path](#stream-access-log-path) | string | "" | -| [enable-access-log-for-default-backend](#enable-access-log-for-default-backend) | bool | "false" | -| [error-log-path](#error-log-path) | string | "/var/log/nginx/error.log" | -| [enable-modsecurity](#enable-modsecurity) | bool | "false" | -| [modsecurity-snippet](#modsecurity-snippet) | string | "" | -| [enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs) | bool | "false" | -| [client-header-buffer-size](#client-header-buffer-size) | string | "1k" | -| [client-header-timeout](#client-header-timeout) | int | 60 | -| [client-body-buffer-size](#client-body-buffer-size) | string | "8k" | -| [client-body-timeout](#client-body-timeout) | int | 60 | -| [disable-access-log](#disable-access-log) | bool | false | -| [disable-ipv6](#disable-ipv6) | bool | false | -| [disable-ipv6-dns](#disable-ipv6-dns) | bool | false | -| [enable-underscores-in-headers](#enable-underscores-in-headers) | bool | false | -| [enable-ocsp](#enable-ocsp) | bool | false | -| [ignore-invalid-headers](#ignore-invalid-headers) | bool | true | -| [retry-non-idempotent](#retry-non-idempotent) | bool | "false" | -| [error-log-level](#error-log-level) | string | "notice" | -| [http2-max-field-size](#http2-max-field-size) | string | "4k" | -| [http2-max-header-size](#http2-max-header-size) | string | "16k" | -| [http2-max-requests](#http2-max-requests) | int | 1000 | -| [http2-max-concurrent-streams](#http2-max-concurrent-streams) | int | 128 | -| [hsts](#hsts) | bool | "true" | -| [hsts-include-subdomains](#hsts-include-subdomains) | bool | "true" | -| [hsts-max-age](#hsts-max-age) | string | "15724800" | -| [hsts-preload](#hsts-preload) | bool | "false" | -| [keep-alive](#keep-alive) | int | 75 | -| [keep-alive-requests](#keep-alive-requests) | int | 1000 | -| [large-client-header-buffers](#large-client-header-buffers) | string | "4 8k" | -| [log-format-escape-none](#log-format-escape-none) | bool | "false" | -| [log-format-escape-json](#log-format-escape-json) | bool | "false" | -| [log-format-upstream](#log-format-upstream) | string | `$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id` | -| [log-format-stream](#log-format-stream) | string | `[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time` | -| [enable-multi-accept](#enable-multi-accept) | bool | "true" | -| [max-worker-connections](#max-worker-connections) | int | 16384 | -| [max-worker-open-files](#max-worker-open-files) | int | 0 | -| [map-hash-bucket-size](#max-hash-bucket-size) | int | 64 | -| [nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist) | []string | "127.0.0.1" | -| [nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist) | []string | "::1" | -| [proxy-real-ip-cidr](#proxy-real-ip-cidr) | []string | "0.0.0.0/0" | -| [proxy-set-headers](#proxy-set-headers) | string | "" | -| [server-name-hash-max-size](#server-name-hash-max-size) | int | 1024 | -| [server-name-hash-bucket-size](#server-name-hash-bucket-size) | int | `` | -| [proxy-headers-hash-max-size](#proxy-headers-hash-max-size) | int | 512 | -| [proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size) | int | 64 | -| [plugins](#plugins) | []string | | -| [reuse-port](#reuse-port) | bool | "true" | -| [server-tokens](#server-tokens) | bool | "false" | -| [ssl-ciphers](#ssl-ciphers) | string | "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" | -| [ssl-ecdh-curve](#ssl-ecdh-curve) | string | "auto" | -| [ssl-dh-param](#ssl-dh-param) | string | "" | -| [ssl-protocols](#ssl-protocols) | string | "TLSv1.2 TLSv1.3" | -| [ssl-session-cache](#ssl-session-cache) | bool | "true" | -| [ssl-session-cache-size](#ssl-session-cache-size) | string | "10m" | -| [ssl-session-tickets](#ssl-session-tickets) | bool | "false" | -| [ssl-session-ticket-key](#ssl-session-ticket-key) | string | `` | -| [ssl-session-timeout](#ssl-session-timeout) | string | "10m" | -| [ssl-buffer-size](#ssl-buffer-size) | string | "4k" | -| [use-proxy-protocol](#use-proxy-protocol) | bool | "false" | -| [proxy-protocol-header-timeout](#proxy-protocol-header-timeout) | string | "5s" | -| [use-gzip](#use-gzip) | bool | "false" | -| [use-geoip](#use-geoip) | bool | "true" | -| [use-geoip2](#use-geoip2) | bool | "false" | -| [enable-brotli](#enable-brotli) | bool | "false" | -| [brotli-level](#brotli-level) | int | 4 | -| [brotli-min-length](#brotli-min-length) | int | 20 | -| [brotli-types](#brotli-types) | string | "application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" | -| [use-http2](#use-http2) | bool | "true" | -| [gzip-disable](#gzip-disable) | string | "" | -| [gzip-level](#gzip-level) | int | 1 | -| [gzip-min-length](#gzip-min-length) | int | 256 | -| [gzip-types](#gzip-types) | string | "application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" | -| [worker-processes](#worker-processes) | string | `` | -| [worker-cpu-affinity](#worker-cpu-affinity) | string | "" | -| [worker-shutdown-timeout](#worker-shutdown-timeout) | string | "240s" | -| [load-balance](#load-balance) | string | "round_robin" | -| [variables-hash-bucket-size](#variables-hash-bucket-size) | int | 128 | -| [variables-hash-max-size](#variables-hash-max-size) | int | 2048 | -| [upstream-keepalive-connections](#upstream-keepalive-connections) | int | 320 | -| [upstream-keepalive-time](#upstream-keepalive-time) | string | "1h" | -| [upstream-keepalive-timeout](#upstream-keepalive-timeout) | int | 60 | -| [upstream-keepalive-requests](#upstream-keepalive-requests) | int | 10000 | -| [limit-conn-zone-variable](#limit-conn-zone-variable) | string | "$binary_remote_addr" | -| [proxy-stream-timeout](#proxy-stream-timeout) | string | "600s" | -| [proxy-stream-next-upstream](#proxy-stream-next-upstream) | bool | "true" | -| [proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout) | string | "600s" | -| [proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries) | int | 3 | -| [proxy-stream-responses](#proxy-stream-responses) | int | 1 | -| [bind-address](#bind-address) | []string | "" | -| [use-forwarded-headers](#use-forwarded-headers) | bool | "false" | -| [enable-real-ip](#enable-real-ip) | bool | "false" | -| [forwarded-for-header](#forwarded-for-header) | string | "X-Forwarded-For" | -| [compute-full-forwarded-for](#compute-full-forwarded-for) | bool | "false" | -| [proxy-add-original-uri-header](#proxy-add-original-uri-header) | bool | "false" | -| [generate-request-id](#generate-request-id) | bool | "true" | -| [enable-opentracing](#enable-opentracing) | bool | "false" | -| [opentracing-operation-name](#opentracing-operation-name) | string | "" | -| [opentracing-location-operation-name](#opentracing-location-operation-name) | string | "" | -| [zipkin-collector-host](#zipkin-collector-host) | string | "" | -| [zipkin-collector-port](#zipkin-collector-port) | int | 9411 | -| [zipkin-service-name](#zipkin-service-name) | string | "nginx" | -| [zipkin-sample-rate](#zipkin-sample-rate) | float | 1.0 | -| [jaeger-collector-host](#jaeger-collector-host) | string | "" | -| [jaeger-collector-port](#jaeger-collector-port) | int | 6831 | -| [jaeger-endpoint](#jaeger-endpoint) | string | "" | -| [jaeger-service-name](#jaeger-service-name) | string | "nginx" | -| [jaeger-propagation-format](#jaeger-propagation-format) | string | "jaeger" | -| [jaeger-sampler-type](#jaeger-sampler-type) | string | "const" | -| [jaeger-sampler-param](#jaeger-sampler-param) | string | "1" | -| [jaeger-sampler-host](#jaeger-sampler-host) | string | "http://127.0.0.1" | -| [jaeger-sampler-port](#jaeger-sampler-port) | int | 5778 | -| [jaeger-trace-context-header-name](#jaeger-trace-context-header-name) | string | uber-trace-id | -| [jaeger-debug-header](#jaeger-debug-header) | string | uber-debug-id | -| [jaeger-baggage-header](#jaeger-baggage-header) | string | jaeger-baggage | -| [jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix) | string | uberctx- | -| [datadog-collector-host](#datadog-collector-host) | string | "" | -| [datadog-collector-port](#datadog-collector-port) | int | 8126 | -| [datadog-service-name](#datadog-service-name) | string | "nginx" | -| [datadog-environment](#datadog-environment) | string | "prod" | -| [datadog-operation-name-override](#datadog-operation-name-override) | string | "nginx.handle" | -| [datadog-priority-sampling](#datadog-priority-sampling) | bool | "true" | -| [datadog-sample-rate](#datadog-sample-rate) | float | 1.0 | -| [main-snippet](#main-snippet) | string | "" | -| [http-snippet](#http-snippet) | string | "" | -| [server-snippet](#server-snippet) | string | "" | -| [stream-snippet](#stream-snippet) | string | "" | -| [location-snippet](#location-snippet) | string | "" | -| [custom-http-errors](#custom-http-errors) | []int | []int{} | -| [proxy-body-size](#proxy-body-size) | string | "1m" | -| [proxy-connect-timeout](#proxy-connect-timeout) | int | 5 | -| [proxy-read-timeout](#proxy-read-timeout) | int | 60 | -| [proxy-send-timeout](#proxy-send-timeout) | int | 60 | -| [proxy-buffers-number](#proxy-buffers-number) | int | 4 | -| [proxy-buffer-size](#proxy-buffer-size) | string | "4k" | -| [proxy-cookie-path](#proxy-cookie-path) | string | "off" | -| [proxy-cookie-domain](#proxy-cookie-domain) | string | "off" | -| [proxy-next-upstream](#proxy-next-upstream) | string | "error timeout" | -| [proxy-next-upstream-timeout](#proxy-next-upstream-timeout) | int | 0 | -| [proxy-next-upstream-tries](#proxy-next-upstream-tries) | int | 3 | -| [proxy-redirect-from](#proxy-redirect-from) | string | "off" | -| [proxy-request-buffering](#proxy-request-buffering) | string | "on" | -| [ssl-redirect](#ssl-redirect) | bool | "true" | -| [force-ssl-redirect](#force-ssl-redirect) | bool | "false" | -| [denylist-source-range](#denylist-source-range) | []string | []string{} | -| [whitelist-source-range](#whitelist-source-range) | []string | []string{} | -| [skip-access-log-urls](#skip-access-log-urls) | []string | []string{} | -| [limit-rate](#limit-rate) | int | 0 | -| [limit-rate-after](#limit-rate-after) | int | 0 | -| [lua-shared-dicts](#lua-shared-dicts) | string | "" | -| [http-redirect-code](#http-redirect-code) | int | 308 | -| [proxy-buffering](#proxy-buffering) | string | "off" | -| [limit-req-status-code](#limit-req-status-code) | int | 503 | -| [limit-conn-status-code](#limit-conn-status-code) | int | 503 | -| [enable-syslog](#enable-syslog) | bool | false | -| [syslog-host](#syslog-host) | string | "" | -| [syslog-port](#syslog-port) | int | 514 | -| [no-tls-redirect-locations](#no-tls-redirect-locations) | string | "/.well-known/acme-challenge" | -| [global-auth-url](#global-auth-url) | string | "" | -| [global-auth-method](#global-auth-method) | string | "" | -| [global-auth-signin](#global-auth-signin) | string | "" | -| [global-auth-signin-redirect-param](#global-auth-signin-redirect-param) | string | "rd" | -| [global-auth-response-headers](#global-auth-response-headers) | string | "" | -| [global-auth-request-redirect](#global-auth-request-redirect) | string | "" | -| [global-auth-snippet](#global-auth-snippet) | string | "" | -| [global-auth-cache-key](#global-auth-cache-key) | string | "" | -| [global-auth-cache-duration](#global-auth-cache-duration) | string | "200 202 401 5m" | -| [no-auth-locations](#no-auth-locations) | string | "/.well-known/acme-challenge" | -| [block-cidrs](#block-cidrs) | []string | "" | -| [block-user-agents](#block-user-agents) | []string | "" | -| [block-referers](#block-referers) | []string | "" | -| [proxy-ssl-location-only](#proxy-ssl-location-only) | bool | "false" | -| [default-type](#default-type) | string | "text/html" | -| [global-rate-limit-memcached-host](#global-rate-limit) | string | "" | -| [global-rate-limit-memcached-port](#global-rate-limit) | int | 11211 | -| [global-rate-limit-memcached-connect-timeout](#global-rate-limit) | int | 50 | -| [global-rate-limit-memcached-max-idle-timeout](#global-rate-limit) | int | 10000 | -| [global-rate-limit-memcached-pool-size](#global-rate-limit) | int | 50 | -| [global-rate-limit-status-code](#global-rate-limit) | int | 429 | -| [service-upstream](#service-upstream) | bool | "false" | -| [ssl-reject-handshake](#ssl-reject-handshake) | bool | "false" | -| [debug-connections](#debug-connections) | []string | "127.0.0.1,1.1.1.1/24" | -| [enable-pathtype-validation](#enable-pathtype-validation) | bool | "false" | -| [path-additional-allowed-chars](#path-additional-allowed-chars) | string | "^%$[](){}*+?" | +|name|type|default| +|:---|:---|:------| +|[add-headers](#add-headers)|string|""| +|[allow-backend-server-header](#allow-backend-server-header)|bool|"false"| +|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true| +|[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""| +|[hide-headers](#hide-headers)|string array|empty| +|[access-log-params](#access-log-params)|string|""| +|[access-log-path](#access-log-path)|string|"/var/log/nginx/access.log"| +|[http-access-log-path](#http-access-log-path)|string|""| +|[stream-access-log-path](#stream-access-log-path)|string|""| +|[enable-access-log-for-default-backend](#enable-access-log-for-default-backend)|bool|"false"| +|[error-log-path](#error-log-path)|string|"/var/log/nginx/error.log"| +|[enable-modsecurity](#enable-modsecurity)|bool|"false"| +|[modsecurity-snippet](#modsecurity-snippet)|string|""| +|[enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs)|bool|"false"| +|[client-header-buffer-size](#client-header-buffer-size)|string|"1k"| +|[client-header-timeout](#client-header-timeout)|int|60| +|[client-body-buffer-size](#client-body-buffer-size)|string|"8k"| +|[client-body-timeout](#client-body-timeout)|int|60| +|[disable-access-log](#disable-access-log)|bool|false| +|[disable-ipv6](#disable-ipv6)|bool|false| +|[disable-ipv6-dns](#disable-ipv6-dns)|bool|false| +|[enable-underscores-in-headers](#enable-underscores-in-headers)|bool|false| +|[enable-ocsp](#enable-ocsp)|bool|false| +|[ignore-invalid-headers](#ignore-invalid-headers)|bool|true| +|[retry-non-idempotent](#retry-non-idempotent)|bool|"false"| +|[error-log-level](#error-log-level)|string|"notice"| +|[http2-max-field-size](#http2-max-field-size)|string|"4k"| +|[http2-max-header-size](#http2-max-header-size)|string|"16k"| +|[http2-max-requests](#http2-max-requests)|int|1000| +|[http2-max-concurrent-streams](#http2-max-concurrent-streams)|int|128| +|[hsts](#hsts)|bool|"true"| +|[hsts-include-subdomains](#hsts-include-subdomains)|bool|"true"| +|[hsts-max-age](#hsts-max-age)|string|"15724800"| +|[hsts-preload](#hsts-preload)|bool|"false"| +|[keep-alive](#keep-alive)|int|75| +|[keep-alive-requests](#keep-alive-requests)|int|1000| +|[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"| +|[log-format-escape-none](#log-format-escape-none)|bool|"false"| +|[log-format-escape-json](#log-format-escape-json)|bool|"false"| +|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`| +|[log-format-stream](#log-format-stream)|string|`[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time`| +|[enable-multi-accept](#enable-multi-accept)|bool|"true"| +|[max-worker-connections](#max-worker-connections)|int|16384| +|[max-worker-open-files](#max-worker-open-files)|int|0| +|[map-hash-bucket-size](#max-hash-bucket-size)|int|64| +|[nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist)|[]string|"127.0.0.1"| +|[nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist)|[]string|"::1"| +|[proxy-real-ip-cidr](#proxy-real-ip-cidr)|[]string|"0.0.0.0/0"| +|[proxy-set-headers](#proxy-set-headers)|string|""| +|[server-name-hash-max-size](#server-name-hash-max-size)|int|1024| +|[server-name-hash-bucket-size](#server-name-hash-bucket-size)|int|`` +|[proxy-headers-hash-max-size](#proxy-headers-hash-max-size)|int|512| +|[proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size)|int|64| +|[plugins](#plugins)|[]string| | +|[reuse-port](#reuse-port)|bool|"true"| +|[server-tokens](#server-tokens)|bool|"false"| +|[ssl-ciphers](#ssl-ciphers)|string|"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"| +|[ssl-ecdh-curve](#ssl-ecdh-curve)|string|"auto"| +|[ssl-dh-param](#ssl-dh-param)|string|""| +|[ssl-protocols](#ssl-protocols)|string|"TLSv1.2 TLSv1.3"| +|[ssl-session-cache](#ssl-session-cache)|bool|"true"| +|[ssl-session-cache-size](#ssl-session-cache-size)|string|"10m"| +|[ssl-session-tickets](#ssl-session-tickets)|bool|"false"| +|[ssl-session-ticket-key](#ssl-session-ticket-key)|string|`` +|[ssl-session-timeout](#ssl-session-timeout)|string|"10m"| +|[ssl-buffer-size](#ssl-buffer-size)|string|"4k"| +|[use-proxy-protocol](#use-proxy-protocol)|bool|"false"| +|[proxy-protocol-header-timeout](#proxy-protocol-header-timeout)|string|"5s"| +|[use-gzip](#use-gzip)|bool|"false"| +|[use-geoip](#use-geoip)|bool|"true"| +|[use-geoip2](#use-geoip2)|bool|"false"| +|[enable-brotli](#enable-brotli)|bool|"false"| +|[brotli-level](#brotli-level)|int|4| +|[brotli-min-length](#brotli-min-length)|int|20| +|[brotli-types](#brotli-types)|string|"application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| +|[use-http2](#use-http2)|bool|"true"| +|[gzip-disable](#gzip-disable)|string|""| +|[gzip-level](#gzip-level)|int|1| +|[gzip-min-length](#gzip-min-length)|int|256| +|[gzip-types](#gzip-types)|string|"application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| +|[worker-processes](#worker-processes)|string|``| +|[worker-cpu-affinity](#worker-cpu-affinity)|string|""| +|[worker-shutdown-timeout](#worker-shutdown-timeout)|string|"240s"| +|[load-balance](#load-balance)|string|"round_robin"| +|[variables-hash-bucket-size](#variables-hash-bucket-size)|int|128| +|[variables-hash-max-size](#variables-hash-max-size)|int|2048| +|[upstream-keepalive-connections](#upstream-keepalive-connections)|int|320| +|[upstream-keepalive-time](#upstream-keepalive-time)|string|"1h"| +|[upstream-keepalive-timeout](#upstream-keepalive-timeout)|int|60| +|[upstream-keepalive-requests](#upstream-keepalive-requests)|int|10000| +|[limit-conn-zone-variable](#limit-conn-zone-variable)|string|"$binary_remote_addr"| +|[proxy-stream-timeout](#proxy-stream-timeout)|string|"600s"| +|[proxy-stream-next-upstream](#proxy-stream-next-upstream)|bool|"true"| +|[proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout)|string|"600s"| +|[proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries)|int|3| +|[proxy-stream-responses](#proxy-stream-responses)|int|1| +|[bind-address](#bind-address)|[]string|""| +|[use-forwarded-headers](#use-forwarded-headers)|bool|"false"| +|[enable-real-ip](#enable-real-ip)|bool|"false"| +|[forwarded-for-header](#forwarded-for-header)|string|"X-Forwarded-For"| +|[compute-full-forwarded-for](#compute-full-forwarded-for)|bool|"false"| +|[proxy-add-original-uri-header](#proxy-add-original-uri-header)|bool|"false"| +|[generate-request-id](#generate-request-id)|bool|"true"| +|[enable-opentracing](#enable-opentracing)|bool|"false"| +|[opentracing-operation-name](#opentracing-operation-name)|string|""| +|[opentracing-location-operation-name](#opentracing-location-operation-name)|string|""| +|[zipkin-collector-host](#zipkin-collector-host)|string|""| +|[zipkin-collector-port](#zipkin-collector-port)|int|9411| +|[zipkin-service-name](#zipkin-service-name)|string|"nginx"| +|[zipkin-sample-rate](#zipkin-sample-rate)|float|1.0| +|[jaeger-collector-host](#jaeger-collector-host)|string|""| +|[jaeger-collector-port](#jaeger-collector-port)|int|6831| +|[jaeger-endpoint](#jaeger-endpoint)|string|""| +|[jaeger-service-name](#jaeger-service-name)|string|"nginx"| +|[jaeger-propagation-format](#jaeger-propagation-format)|string|"jaeger"| +|[jaeger-sampler-type](#jaeger-sampler-type)|string|"const"| +|[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"| +|[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"| +|[jaeger-sampler-port](#jaeger-sampler-port)|int|5778| +|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id| +|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id| +|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage| +|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-| +|[datadog-collector-host](#datadog-collector-host)|string|""| +|[datadog-collector-port](#datadog-collector-port)|int|8126| +|[datadog-service-name](#datadog-service-name)|string|"nginx"| +|[datadog-environment](#datadog-environment)|string|"prod"| +|[datadog-operation-name-override](#datadog-operation-name-override)|string|"nginx.handle"| +|[datadog-priority-sampling](#datadog-priority-sampling)|bool|"true"| +|[datadog-sample-rate](#datadog-sample-rate)|float|1.0| +|[main-snippet](#main-snippet)|string|""| +|[http-snippet](#http-snippet)|string|""| +|[server-snippet](#server-snippet)|string|""| +|[stream-snippet](#stream-snippet)|string|""| +|[location-snippet](#location-snippet)|string|""| +|[custom-http-errors](#custom-http-errors)|[]int|[]int{}| +|[proxy-body-size](#proxy-body-size)|string|"1m"| +|[proxy-connect-timeout](#proxy-connect-timeout)|int|5| +|[proxy-read-timeout](#proxy-read-timeout)|int|60| +|[proxy-send-timeout](#proxy-send-timeout)|int|60| +|[proxy-buffers-number](#proxy-buffers-number)|int|4| +|[proxy-buffer-size](#proxy-buffer-size)|string|"4k"| +|[proxy-cookie-path](#proxy-cookie-path)|string|"off"| +|[proxy-cookie-domain](#proxy-cookie-domain)|string|"off"| +|[proxy-next-upstream](#proxy-next-upstream)|string|"error timeout"| +|[proxy-next-upstream-timeout](#proxy-next-upstream-timeout)|int|0| +|[proxy-next-upstream-tries](#proxy-next-upstream-tries)|int|3| +|[proxy-redirect-from](#proxy-redirect-from)|string|"off"| +|[proxy-request-buffering](#proxy-request-buffering)|string|"on"| +|[ssl-redirect](#ssl-redirect)|bool|"true"| +|[force-ssl-redirect](#force-ssl-redirect)|bool|"false"| +|[denylist-source-range](#denylist-source-range)|[]string|[]string{}| +|[whitelist-source-range](#whitelist-source-range)|[]string|[]string{}| +|[skip-access-log-urls](#skip-access-log-urls)|[]string|[]string{}| +|[limit-rate](#limit-rate)|int|0| +|[limit-rate-after](#limit-rate-after)|int|0| +|[lua-shared-dicts](#lua-shared-dicts)|string|""| +|[http-redirect-code](#http-redirect-code)|int|308| +|[proxy-buffering](#proxy-buffering)|string|"off"| +|[limit-req-status-code](#limit-req-status-code)|int|503| +|[limit-conn-status-code](#limit-conn-status-code)|int|503| +|[enable-syslog](#enable-syslog)|bool|false| +|[syslog-host](#syslog-host)|string|""| +|[syslog-port](#syslog-port)|int|514| +|[no-tls-redirect-locations](#no-tls-redirect-locations)|string|"/.well-known/acme-challenge"| +|[global-auth-url](#global-auth-url)|string|""| +|[global-auth-method](#global-auth-method)|string|""| +|[global-auth-signin](#global-auth-signin)|string|""| +|[global-auth-signin-redirect-param](#global-auth-signin-redirect-param)|string|"rd"| +|[global-auth-response-headers](#global-auth-response-headers)|string|""| +|[global-auth-request-redirect](#global-auth-request-redirect)|string|""| +|[global-auth-snippet](#global-auth-snippet)|string|""| +|[global-auth-cache-key](#global-auth-cache-key)|string|""| +|[global-auth-cache-duration](#global-auth-cache-duration)|string|"200 202 401 5m"| +|[no-auth-locations](#no-auth-locations)|string|"/.well-known/acme-challenge"| +|[block-cidrs](#block-cidrs)|[]string|""| +|[block-user-agents](#block-user-agents)|[]string|""| +|[block-referers](#block-referers)|[]string|""| +|[proxy-ssl-location-only](#proxy-ssl-location-only)|bool|"false"| +|[default-type](#default-type)|string|"text/html"| +|[global-rate-limit-memcached-host](#global-rate-limit)|string|""| +|[global-rate-limit-memcached-port](#global-rate-limit)|int|11211| +|[global-rate-limit-memcached-connect-timeout](#global-rate-limit)|int|50| +|[global-rate-limit-memcached-max-idle-timeout](#global-rate-limit)|int|10000| +|[global-rate-limit-memcached-pool-size](#global-rate-limit)|int|50| +|[global-rate-limit-status-code](#global-rate-limit)|int|429| +|[service-upstream](#service-upstream)|bool|"false"| +|[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"| +|[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"| ## add-headers @@ -1328,22 +1326,3 @@ _**default:**_ "" _References:_ [http://nginx.org/en/docs/ngx_core_module.html#debug_connection](http://nginx.org/en/docs/ngx_core_module.html#debug_connection) - -## enable-pathtype-validation -Ingress Controller validates the pathType, and only allows special characters on "path" if pathType is -ImplementationSpecific. - -The only characters allowed on ingresses with pathType not ImplementationSpecific -will be 0-9, a-z, A-Z, "-", ".", "_", "~", "/". - -If the validation is disabled, the [#path-additional-allowed-chars](#path-additional-allowed-chars) will -be allowed on any pathType. - -This behavior is disabled by default, so special characters are accepted regardless of pathType -_**default:**_ "false" - -## path-additional-allowed-chars -When [enable-pathtype-validation](enable-pathtype-validation) is set to true [#path-additional-allowed-chars](#path-additional-allowed-chars) defines the additional set of special characters that -will be allowed. - -_**default:**_ "^%$[](){}*+?|" diff --git a/go.mod b/go.mod index 10b9e2fda..1aad274fb 100644 --- a/go.mod +++ b/go.mod @@ -77,6 +77,7 @@ require ( github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect + github.com/magefile/mage v1.14.0 // indirect github.com/mailru/easyjson v0.7.6 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect diff --git a/go.sum b/go.sum index 6e370c655..1d99238cb 100644 --- a/go.sum +++ b/go.sum @@ -235,6 +235,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= +github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= +github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= From 01c9a2bf253ce962d969b624763e8a8b000dfa76 Mon Sep 17 00:00:00 2001 From: James Strong Date: Mon, 13 Feb 2023 07:57:29 +0100 Subject: [PATCH 034/822] Revert Implement pathType validation (#9511) (#9607) Signed-off-by: James Strong --- charts/ingress-nginx/README.md | 1 - .../templates/controller-configmap.yaml | 1 - charts/ingress-nginx/values.yaml | 5 - internal/ingress/controller/config/config.go | 14 -- internal/ingress/controller/controller.go | 4 - .../ingress/controller/controller_test.go | 91 --------- internal/ingress/controller/store/store.go | 9 +- internal/k8s/main.go | 3 + magefiles/helm.go | 3 + pkg/util/ingress/ingress.go | 83 ++------ pkg/util/ingress/ingress_test.go | 192 +++++------------- test/e2e/admission/admission.go | 38 +--- test/e2e/annotations/affinity.go | 6 - test/e2e/annotations/auth.go | 45 ---- test/e2e/annotations/rewrite.go | 8 - test/e2e/security/invalid_paths.go | 134 ++++++++++++ 16 files changed, 211 insertions(+), 426 deletions(-) create mode 100644 test/e2e/security/invalid_paths.go diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 7f3ea1866..65236e08c 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -253,7 +253,6 @@ Kubernetes: `>=1.20.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | commonLabels | object | `{}` | | -| controller.EnablePathTypeValidation | bool | `false` | This configuration defines if Ingress Controller should validate pathType. If false, special characters will be allowed on paths of any pathType. If true, special characters are only allowed on paths with pathType = ImplementationSpecific | | controller.addHeaders | object | `{}` | Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers | | controller.admissionWebhooks.annotations | object | `{}` | | | controller.admissionWebhooks.certManager.admissionCert.duration | string | `""` | | diff --git a/charts/ingress-nginx/templates/controller-configmap.yaml b/charts/ingress-nginx/templates/controller-configmap.yaml index a1fbdf549..f28b26e1e 100644 --- a/charts/ingress-nginx/templates/controller-configmap.yaml +++ b/charts/ingress-nginx/templates/controller-configmap.yaml @@ -14,7 +14,6 @@ metadata: namespace: {{ .Release.Namespace }} data: allow-snippet-annotations: "{{ .Values.controller.allowSnippetAnnotations }}" - enable-pathtype-validation: "{{ .Values.controller.EnablePathTypeValidation }}" {{- if .Values.controller.addHeaders }} add-headers: {{ .Release.Namespace }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 4c587ee88..215ce509d 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -87,11 +87,6 @@ controller: # Global snippets in ConfigMap are still respected allowSnippetAnnotations: true - # -- This configuration defines if Ingress Controller should validate pathType. - # If false, special characters will be allowed on paths of any pathType. - # If true, special characters are only allowed on paths with pathType = ImplementationSpecific - EnablePathTypeValidation: false - # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 # is merged diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index b02e5998e..5786b6776 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -782,18 +782,6 @@ type Configuration struct { // http://nginx.org/en/docs/ngx_core_module.html#debug_connection // Default: "" DebugConnections []string `json:"debug-connections"` - - // EnablePathTypeValidation allows the admin to enable the pathType validation. - // If EnablePathTypeValidation is enabled, the Controller will only allow alphanumeric - // characters on path (0-9, a-z, A-Z, "-", ".", "_", "~", "/") - // to control what characters are allowed set them with PathAdditionalAllowedChars - EnablePathTypeValidation bool `json:"enable-pathtype-validation"` - - // PathAdditionalAllowedChars allows the admin to specify what are the additional - // characters allowed in case of pathType=ImplementationSpecific. - // Case enable-pathtype-validation=true, this characters will be only allowed on ImplementationSpecific. - // Defaults to: "^%$[](){}*+?" - PathAdditionalAllowedChars string `json:"path-additional-allowed-chars"` } // NewDefault returns the default nginx configuration @@ -829,8 +817,6 @@ func NewDefault() Configuration { ClientHeaderTimeout: 60, ClientBodyBufferSize: "8k", ClientBodyTimeout: 60, - EnablePathTypeValidation: false, - PathAdditionalAllowedChars: "^%$[](){}*+?|", EnableUnderscoresInHeaders: false, ErrorLogLevel: errorLevel, UseForwardedHeaders: false, diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 9812bd97e..dab507cdf 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -325,10 +325,6 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { k8s.SetDefaultNGINXPathType(ing) - if err := utilingress.ValidateIngressPath(ing, cfg.EnablePathTypeValidation, cfg.PathAdditionalAllowedChars); err != nil { - return fmt.Errorf("ingress contains invalid characters: %s", err) - } - allIngresses := n.store.ListIngresses() filter := func(toCheck *ingress.Ingress) bool { diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index dab1e6e37..8cca10385 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -201,97 +201,6 @@ func TestCheckIngress(t *testing.T) { }, }, } - - t.Run("when validating pathType", func(t *testing.T) { - t.Run("When ingress contains invalid path and pathType validation is enabled", func(t *testing.T) { - nginx.store = fakeIngressStore{ - ingresses: []*ingress.Ingress{}, - configuration: ngx_config.Configuration{ - EnablePathTypeValidation: true, - }, - } - nginx.command = testNginxTestCommand{ - t: t, - err: nil, - expected: "", - } - nginx.cfg.IngressClassConfiguration = &ingressclass.IngressClassConfiguration{ - WatchWithoutClass: true, - } - ingPath := &networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-ingress1", - Namespace: "user-namespace1", - Annotations: map[string]string{ - "kubernetes.io/ingress.class": "nginx", - }, - }, - Spec: networking.IngressSpec{ - Rules: []networking.IngressRule{ - { - Host: "example.com", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/xpto/(a+)", - PathType: &pathTypePrefix, - }, - }, - }, - }, - }, - }, - }, - } - - if nginx.CheckIngress(ingPath) == nil { - t.Errorf("invalid path on pathTypePrefix and validation enabled should return an error") - } - }) - t.Run("When ingress contains invalid path and pathType validation is disabled", func(t *testing.T) { - nginx.store = fakeIngressStore{ - ingresses: []*ingress.Ingress{}, - configuration: ngx_config.Configuration{ - EnablePathTypeValidation: false, - PathAdditionalAllowedChars: "^%$[](){}*+?|", - }, - } - nginx.command = testNginxTestCommand{ - t: t, - err: nil, - expected: "_,example.com", - } - - ingPath := &networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test-ingress2", - Namespace: "user-namespace2", - }, - Spec: networking.IngressSpec{ - Rules: []networking.IngressRule{ - { - Host: "example.com", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/example(/|$)(.*)", - PathType: &pathTypePrefix, - }, - }, - }, - }, - }, - }, - }, - } - - if nginx.CheckIngress(ingPath) != nil { - t.Errorf("invalid path on pathTypePrefix and validation disabled should not return an error: %s", nginx.CheckIngress(ingPath)) - } - }) - }) t.Run("when the class is the nginx one", func(t *testing.T) { ing.ObjectMeta.Annotations["kubernetes.io/ingress.class"] = "nginx" nginx.command = testNginxTestCommand{ diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index e0f6cfb54..13af28137 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -846,11 +846,6 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) { copyIng := &networkingv1.Ingress{} ing.ObjectMeta.DeepCopyInto(©Ing.ObjectMeta) - if err := ingressutils.ValidateIngressPath(ing, s.backendConfig.EnablePathTypeValidation, s.backendConfig.PathAdditionalAllowedChars); err != nil { - klog.Errorf("ingress %s contains invalid path and will be skipped: %s", key, err) - return - } - if s.backendConfig.AnnotationValueWordBlocklist != "" { if err := checkBadAnnotationValue(copyIng.Annotations, s.backendConfig.AnnotationValueWordBlocklist); err != nil { klog.Warningf("skipping ingress %s: %s", key, err) @@ -870,6 +865,10 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) { if path.Path == "" { copyIng.Spec.Rules[ri].HTTP.Paths[pi].Path = "/" } + if !ingressutils.IsSafePath(copyIng, path.Path) { + klog.Warningf("ingress %s contains invalid path %s", key, path.Path) + return + } } } diff --git a/internal/k8s/main.go b/internal/k8s/main.go index 6973b6cb7..e0d2a1660 100644 --- a/internal/k8s/main.go +++ b/internal/k8s/main.go @@ -180,6 +180,9 @@ func SetDefaultNGINXPathType(ing *networkingv1.Ingress) { p.PathType = &defaultPathType } + if *p.PathType == networkingv1.PathTypeImplementationSpecific { + p.PathType = &defaultPathType + } } } } diff --git a/magefiles/helm.go b/magefiles/helm.go index a57c46813..e69c4e029 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -153,6 +153,9 @@ func updateChartValue(key, value string) { Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) } +func (Helm) Helmdocs() error { + return runHelmDocs() +} func runHelmDocs() error { err := installHelmDocs() if err != nil { diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index 91243e2cc..5fb3ee7b9 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -23,6 +23,7 @@ import ( networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/util/sets" + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/k8s" "k8s.io/ingress-nginx/internal/net/ssl" "k8s.io/ingress-nginx/pkg/apis/ingress" @@ -30,15 +31,15 @@ import ( ) const ( - alphaNumericChars = `A-Za-z0-9\-\.\_\~\/` // This is the default allowed set on paths + alphaNumericChars = `\-\.\_\~a-zA-Z0-9/` + regexEnabledChars = `\^\$\[\]\(\)\{\}\*\+` ) var ( - // pathAlphaNumeric is a regex validation that allows only (0-9, a-z, A-Z, "-", ".", "_", "~", "/") - pathAlphaNumericRegex = regexp.MustCompile("^[" + alphaNumericChars + "]*$").MatchString - - // default path type is Prefix to not break existing definitions - defaultPathType = networkingv1.PathTypePrefix + // pathAlphaNumeric is a regex validation of something like "^/[a-zA-Z]+$" on path + pathAlphaNumeric = regexp.MustCompile("^/[" + alphaNumericChars + "]*$").MatchString + // pathRegexEnabled is a regex validation of paths that may contain regex. + pathRegexEnabled = regexp.MustCompile("^/[" + alphaNumericChars + regexEnabledChars + "]*$").MatchString ) func GetRemovedHosts(rucfg, newcfg *ingress.Configuration) []string { @@ -246,68 +247,12 @@ func BuildRedirects(servers []*ingress.Server) []*redirect { return redirectServers } -func ValidateIngressPath(copyIng *networkingv1.Ingress, enablePathTypeValidation bool, pathAdditionalAllowedChars string) error { - - if copyIng == nil { - return nil +// IsSafePath verifies if the path used in ingress object contains only valid characters. +// It will behave differently if regex is enabled or not +func IsSafePath(copyIng *networkingv1.Ingress, path string) bool { + isRegex, _ := parser.GetBoolAnnotation("use-regex", copyIng) + if isRegex { + return pathRegexEnabled(path) } - - escapedPathAdditionalAllowedChars := regexp.QuoteMeta(pathAdditionalAllowedChars) - regexPath, err := regexp.Compile("^[" + alphaNumericChars + escapedPathAdditionalAllowedChars + "]*$") - if err != nil { - return fmt.Errorf("ingress has misconfigured validation regex on configmap: %s - %w", pathAdditionalAllowedChars, err) - } - - for _, rule := range copyIng.Spec.Rules { - - if rule.HTTP == nil { - continue - } - - if err := checkPath(rule.HTTP.Paths, enablePathTypeValidation, regexPath); err != nil { - return fmt.Errorf("error validating ingressPath: %w", err) - } - } - return nil -} - -func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bool, regexSpecificChars *regexp.Regexp) error { - - for _, path := range paths { - if path.PathType == nil { - path.PathType = &defaultPathType - } - - klog.V(9).InfoS("PathType Validation", "enablePathTypeValidation", enablePathTypeValidation, "regexSpecificChars", regexSpecificChars.String(), "Path", path.Path) - - switch pathType := *path.PathType; pathType { - case networkingv1.PathTypeImplementationSpecific: - if enablePathTypeValidation { - //only match on regex chars per Ingress spec when path is implementation specific - if !regexSpecificChars.MatchString(path.Path) { - return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) - } - } - - case networkingv1.PathTypeExact, networkingv1.PathTypePrefix: - //enforce path type validation - if enablePathTypeValidation { - //only allow alphanumeric chars, no regex chars - if !pathAlphaNumericRegex(path.Path) { - return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) - } - continue - } else { - //path validation is disabled, so we check what regex chars are allowed by user - if !regexSpecificChars.MatchString(path.Path) { - return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType) - } - continue - } - - default: - return fmt.Errorf("unknown path type %v on path %v", *path.PathType, path.Path) - } - } - return nil + return pathAlphaNumeric(path) } diff --git a/pkg/util/ingress/ingress_test.go b/pkg/util/ingress/ingress_test.go index 12c2ff1da..d829a57f1 100644 --- a/pkg/util/ingress/ingress_test.go +++ b/pkg/util/ingress/ingress_test.go @@ -17,10 +17,13 @@ limitations under the License. package ingress import ( + "fmt" "testing" - networkingv1 "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + networkingv1 "k8s.io/api/networking/v1" + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/pkg/apis/ingress" ) @@ -133,172 +136,81 @@ func TestIsDynamicConfigurationEnough(t *testing.T) { } } -func generateDumbIngressforPathTest(pathType *networkingv1.PathType, path string) *networkingv1.Ingress { +func generateDumbIngressforPathTest(regexEnabled bool) *networkingv1.Ingress { + var annotations = make(map[string]string) + regexAnnotation := fmt.Sprintf("%s/use-regex", parser.AnnotationsPrefix) + if regexEnabled { + annotations[regexAnnotation] = "true" + } return &networkingv1.Ingress{ ObjectMeta: metav1.ObjectMeta{ - Name: "dumb", - Namespace: "default", - }, - Spec: networkingv1.IngressSpec{ - Rules: []networkingv1.IngressRule{ - { - Host: "test.com", - IngressRuleValue: networkingv1.IngressRuleValue{ - HTTP: &networkingv1.HTTPIngressRuleValue{ - Paths: []networkingv1.HTTPIngressPath{ - { - PathType: pathType, - Path: path, - }, - }, - }, - }, - }, - }, + Name: "dumb", + Namespace: "default", + Annotations: annotations, }, } } -func generateComplexIngress(ing *networkingv1.Ingress) *networkingv1.Ingress { - - oldRules := ing.Spec.DeepCopy().Rules - ing.Spec.Rules = []networkingv1.IngressRule{ - { - Host: "test1.com", - IngressRuleValue: networkingv1.IngressRuleValue{ - HTTP: &networkingv1.HTTPIngressRuleValue{ - Paths: []networkingv1.HTTPIngressPath{ - { - PathType: &pathTypeExact, - Path: "/xpto", - }, - }, - }, - }, - }, - { - Host: "test2.com", - IngressRuleValue: networkingv1.IngressRuleValue{ - HTTP: &networkingv1.HTTPIngressRuleValue{ - Paths: []networkingv1.HTTPIngressPath{ - { - PathType: &pathTypeExact, - Path: "/someotherpath", - }, - { - PathType: &pathTypePrefix, - Path: "/someprefix/~xpto/lala123", - }, - }, - }, - }, - }, - } - // we want to invert the order to test better :) - ing.Spec.Rules = append(ing.Spec.Rules, oldRules...) - - return ing -} - -var ( - pathTypeExact = networkingv1.PathTypeExact - pathTypePrefix = networkingv1.PathTypePrefix - pathTypeImplSpecific = networkingv1.PathTypeImplementationSpecific -) - -const ( - defaultAdditionalChars = "^%$[](){}*+?" -) - -func TestValidateIngressPath(t *testing.T) { +func TestIsSafePath(t *testing.T) { tests := []struct { - name string - copyIng *networkingv1.Ingress - EnablePathTypeValidation bool - additionalChars string - wantErr bool + name string + copyIng *networkingv1.Ingress + path string + want bool }{ { - name: "should return nil when ingress = nil", - wantErr: false, - copyIng: nil, + name: "should accept valid path with regex disabled", + want: true, + copyIng: generateDumbIngressforPathTest(false), + path: "/xpto/~user/t-e_st.exe", }, { - name: "should accept valid path on pathType Exact", - wantErr: false, - copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/xpto/~user9/t-e_st.exe"), + name: "should accept valid path / with regex disabled", + want: true, + copyIng: generateDumbIngressforPathTest(false), + path: "/", }, { - name: "should accept valid path on pathType Prefix", - wantErr: false, - copyIng: generateDumbIngressforPathTest(&pathTypePrefix, "/xpto/~user9/t-e_st.exe"), + name: "should reject invalid path with invalid chars", + want: false, + copyIng: generateDumbIngressforPathTest(false), + path: "/foo/bar/;xpto", }, { - name: "should accept valid simple path on pathType Impl Specific", - wantErr: false, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/xpto/~user9/t-e_st.exe"), + name: "should reject regex path when regex is disabled", + want: false, + copyIng: generateDumbIngressforPathTest(false), + path: "/foo/bar/(.+)", }, { - name: "should accept valid path on pathType nil", - wantErr: false, - copyIng: generateDumbIngressforPathTest(nil, "/xpto/~user/t-e_st.exe"), + name: "should accept valid path / with regex enabled", + want: true, + copyIng: generateDumbIngressforPathTest(true), + path: "/", }, { - name: "should accept empty path", - wantErr: false, - copyIng: generateDumbIngressforPathTest(&pathTypePrefix, ""), + name: "should accept regex path when regex is enabled", + want: true, + copyIng: generateDumbIngressforPathTest(true), + path: "/foo/bar/(.+)", }, { - name: "should deny path with bad characters and pathType not implementationSpecific", - wantErr: true, - additionalChars: "()", - copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"), + name: "should reject regex path when regex is enabled but the path is invalid", + want: false, + copyIng: generateDumbIngressforPathTest(true), + path: "/foo/bar/;xpto", }, { - name: "should accept path with regex characters and pathType implementationSpecific", - wantErr: false, - additionalChars: defaultAdditionalChars, - EnablePathTypeValidation: false, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), - }, - { - name: "should accept path with regex characters and pathType exact, but pathType validation disabled", - wantErr: false, - additionalChars: defaultAdditionalChars, - EnablePathTypeValidation: false, - copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"), - }, - { - name: "should reject path when the allowed additional set does not match", - wantErr: true, - additionalChars: "().?", - EnablePathTypeValidation: true, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"), - }, - { - name: "should accept path when the allowed additional set does match", - wantErr: false, - additionalChars: "().?", - EnablePathTypeValidation: false, - copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)"), - }, - { - name: "should block if at least one path is bad", - wantErr: true, - EnablePathTypeValidation: false, - copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.?)")), - }, - { - name: "should block if at least one path is bad", - wantErr: true, - EnablePathTypeValidation: true, - copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")), + name: "should reject regex path when regex is enabled but the path is invalid", + want: false, + copyIng: generateDumbIngressforPathTest(true), + path: ";xpto", }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - if err := ValidateIngressPath(tt.copyIng, tt.EnablePathTypeValidation, tt.additionalChars); (err != nil) != tt.wantErr { - t.Errorf("ValidateIngressPath() error = %v, wantErr %v", err, tt.wantErr) + if got := IsSafePath(tt.copyIng, tt.path); got != tt.want { + t.Errorf("IsSafePath() = %v, want %v", got, tt.want) } }) } diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index e0f55df4e..bde98fddf 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -30,14 +30,6 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" - - networkingv1 "k8s.io/api/networking/v1" -) - -var ( - pathExact = networkingv1.PathTypeExact - pathPrefix = networkingv1.PathTypePrefix - pathImplSpecific = networkingv1.PathTypeImplementationSpecific ) var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { @@ -160,35 +152,7 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid annotation value should return an error") }) - ginkgo.It("ADMISSION should not validate characters on ingress when validation of pathType is disabled", func() { - host := "admission-test" - - f.UpdateNginxConfigMapData("enable-pathtype-validation", "false") - - firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil) - firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix - _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex chars on path and pathType validation disabled should be accepted") - }) - - ginkgo.It("ADMISSION should reject ingress with bad characters and pathType != ImplementationSpecific", func() { - host := "admission-test" - - f.UpdateNginxConfigMapData("enable-pathtype-validation", "true") - - firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil) - firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix - _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) - assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid path value should return an error") - - secondIngress := framework.NewSingleIngress("second-ingress", "/abc123*", host, f.Namespace, framework.EchoService, 80, nil) - secondIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImplSpecific - _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), secondIngress, metav1.CreateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex on path and pathType ImplementationSpecific should not return an error") - - }) - - ginkgo.It("ADMISSION should return an error if there is a forbidden value in some annotation", func() { + ginkgo.It("should return an error if there is a forbidden value in some annotation", func() { host := "admission-test" annotations := map[string]string{ diff --git a/test/e2e/annotations/affinity.go b/test/e2e/annotations/affinity.go index 31e8905d1..3e1e9e969 100644 --- a/test/e2e/annotations/affinity.go +++ b/test/e2e/annotations/affinity.go @@ -35,8 +35,6 @@ import ( var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { f := framework.NewDefaultFramework("affinity") - pathImpl := networking.PathTypeImplementationSpecific - ginkgo.BeforeEach(func() { f.NewEchoDeployment(framework.WithDeploymentReplicas(2)) }) @@ -278,8 +276,6 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { annotations["nginx.ingress.kubernetes.io/session-cookie-path"] = "/foo/bar" ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) - ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl - f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -303,8 +299,6 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { annotations["nginx.ingress.kubernetes.io/use-regex"] = "true" ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) - ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl - f.EnsureIngress(ing) f.WaitForNginxServer(host, diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index e26fcbd46..1f0f4c3b2 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -720,51 +720,6 @@ http { }) }) - ginkgo.Context("when external authentication is configured along with CORS enabled", func() { - host := "auth" - var annotations map[string]string - var ing *networking.Ingress - - ginkgo.BeforeEach(func() { - f.NewHttpbinDeployment() - - var httpbinIP string - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - httpbinIP = e.Subsets[0].Addresses[0].IP - - annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), - "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", - "nginx.ingress.kubernetes.io/enable-cors": "true", - } - - ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, func(server string) bool { - return strings.Contains(server, "server_name auth") - }) - }) - - ginkgo.It("should redirect to signin url when not signed in along With CORS headers in response", func() { - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - WithQuery("a", "b"). - WithQuery("c", "d"). - Expect(). - Status(http.StatusFound). - Header("Access-Control-Allow-Origin").Equal(fmt.Sprintf("*")) - - }) - }) - ginkgo.Context("when external authentication with caching is configured", func() { thisHost := "auth" thatHost := "different" diff --git a/test/e2e/annotations/rewrite.go b/test/e2e/annotations/rewrite.go index 0c426a8df..79738b984 100644 --- a/test/e2e/annotations/rewrite.go +++ b/test/e2e/annotations/rewrite.go @@ -24,15 +24,12 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" - networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/test/e2e/framework" ) var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-log", func() { f := framework.NewDefaultFramework("rewrite") - pathImpl := networking.PathTypeImplementationSpecific - ginkgo.BeforeEach(func() { f.NewEchoDeployment() }) @@ -129,7 +126,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo "nginx.ingress.kubernetes.io/rewrite-target": "/new/backend", } ing = framework.NewSingleIngress("regex", "/foo.+", host, f.Namespace, framework.EchoService, 80, annotations) - ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -172,8 +168,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo "nginx.ingress.kubernetes.io/rewrite-target": "/new/backend", } ing = framework.NewSingleIngress("regex", "/foo/bar/[a-z]{3}", host, f.Namespace, framework.EchoService, 80, annotations) - ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl - f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -202,8 +196,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo "nginx.ingress.kubernetes.io/rewrite-target": "/new/backend/$1", } ing := framework.NewSingleIngress("regex", "/foo/bar/(.+)", host, f.Namespace, framework.EchoService, 80, annotations) - ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl - f.EnsureIngress(ing) f.WaitForNginxServer(host, diff --git a/test/e2e/security/invalid_paths.go b/test/e2e/security/invalid_paths.go new file mode 100644 index 000000000..d75aefc2c --- /dev/null +++ b/test/e2e/security/invalid_paths.go @@ -0,0 +1,134 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package security + +import ( + "fmt" + "net/http" + "strings" + + "github.com/onsi/ginkgo/v2" + + "k8s.io/ingress-nginx/test/e2e/framework" +) + +const ( + validPath = "/xpto/~user/t-e_st.exe" + invalidPath = "/foo/bar/;xpto" + regexPath = "/foo/bar/(.+)" + host = "securitytest.com" +) + +var ( + annotationRegex = map[string]string{ + "nginx.ingress.kubernetes.io/use-regex": "true", + } +) + +var _ = framework.IngressNginxDescribe("[Security] validate path fields", func() { + f := framework.NewDefaultFramework("validate-path") + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + }) + + ginkgo.It("should accept an ingress with valid path", func() { + + ing := framework.NewSingleIngress(host, validPath, host, f.Namespace, framework.EchoService, 80, nil) + + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) + }) + + f.HTTPTestClient(). + GET(validPath). + WithHeader("Host", host). + Expect(). + Status(http.StatusOK) + }) + + ginkgo.It("should drop an ingress with invalid path", func() { + + ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, nil) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) + }) + + f.HTTPTestClient(). + GET(invalidPath). + WithHeader("Host", host). + Expect(). + Status(http.StatusNotFound) + }) + + ginkgo.It("should drop an ingress with regex path and regex disabled", func() { + + ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, nil) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) + }) + + f.HTTPTestClient(). + GET("/foo/bar/lalala"). + WithHeader("Host", host). + Expect(). + Status(http.StatusNotFound) + }) + + ginkgo.It("should accept an ingress with regex path and regex enabled", func() { + + ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, annotationRegex) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) + }) + + f.HTTPTestClient(). + GET("/foo/bar/lalala"). + WithHeader("Host", host). + Expect(). + Status(http.StatusOK) + }) + + ginkgo.It("should reject an ingress with invalid path and regex enabled", func() { + + ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, annotationRegex) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) + }) + + f.HTTPTestClient(). + GET(invalidPath). + WithHeader("Host", host). + Expect(). + Status(http.StatusNotFound) + }) +}) From b3fc7c7a066c95cd0b6497082c68d4b0167b0929 Mon Sep 17 00:00:00 2001 From: James Strong Date: Mon, 13 Feb 2023 08:22:52 -0500 Subject: [PATCH 035/822] trigger the build 1.6.3 --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index 103ae529e..e37df95ee 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.6.2 +v1.6.3 From 80fd69e641d5b730048fff61f3d58682e2494fd1 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 14 Feb 2023 04:23:31 +0100 Subject: [PATCH 036/822] Release docs for Controller v1.6.3 and Helm v4.5.0 (#9614) Signed-off-by: James Strong --- README.md | 1 + ...{Changelog-1.5.2.md => Changelog-1.6.3.md} | 101 +- charts/ingress-nginx/Chart.yaml | 48 +- charts/ingress-nginx/README.md | 8 +- ...{Changelog-1.5.2.md => Changelog-4.5.0.md} | 7 +- charts/ingress-nginx/values.yaml | 1624 ++++++++--------- deploy/static/provider/aws/deploy.yaml | 57 +- .../aws/nlb-with-tls-termination/deploy.yaml | 57 +- deploy/static/provider/baremetal/deploy.yaml | 57 +- deploy/static/provider/cloud/deploy.yaml | 57 +- deploy/static/provider/do/deploy.yaml | 57 +- deploy/static/provider/exoscale/deploy.yaml | 57 +- deploy/static/provider/kind/deploy.yaml | 57 +- deploy/static/provider/scw/deploy.yaml | 57 +- docs/deploy/index.md | 20 +- docs/e2e-tests.md | 991 ++++++++-- 16 files changed, 1822 insertions(+), 1434 deletions(-) rename changelog/{Changelog-1.5.2.md => Changelog-1.6.3.md} (52%) rename charts/ingress-nginx/changelog/{Changelog-1.5.2.md => Changelog-4.5.0.md} (75%) diff --git a/README.md b/README.md index f8c020b68..6d3fb7873 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | |-----------------------|------------------------------|----------------|---------------| +| v1.6.3 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | | v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | diff --git a/changelog/Changelog-1.5.2.md b/changelog/Changelog-1.6.3.md similarity index 52% rename from changelog/Changelog-1.5.2.md rename to changelog/Changelog-1.6.3.md index ed8532374..39fa5bb24 100644 --- a/changelog/Changelog-1.5.2.md +++ b/changelog/Changelog-1.6.3.md @@ -1,14 +1,59 @@ # Changelog -### 1.5.2 +### 1.6.3 Images: -<<<<<<< HEAD - * registry.k8s.io/ingress-nginx/controller:controller-v1.5.2@sha256:3870522ed937c9efb94bfa31a7eb16009831567a0d4cbe01846fc5486d622655 - * registry.k8s.io/ingress-nginx/controller-chroot:controller-v1.5.2@sha256:84613555694f2c59a8b2551126d226c9aa648544ebf0cde1e0df942f7dbce42b + * registry.k8s.io/controller:controller-v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + * registry.k8s.io/controller-chroot:controller-v1.6.3@sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4 ### All Changes: +* Revert Implement pathType validation (#9511) (#9607) +* update history and allow to pass a target test (#9605) +* Allow to pass a target test (#9542) +* Replace deprecated command with environment file (#9581) +* build 1.6.2 to fix (#9569) +* add lint on chart before release (#9570) +* tcpproxy: increase buffer size to 16K (#9548) +* Move and spell-check Kubernetes 1.22 migration FAQ (#9544) +* Add CORS template check inside location for externalAuth.SignURL (#8814) +* fix(grafana-dashboard): remove hardcoded namespace references (#9523) +* Replace deprecated command with environment file (#9581) +* add path validation to implementation specific as well (#9573) +* add lint on chart before release (#9570) +* Switch logic on path type validation and setting it to false (#9543) +* tcpproxy: increase buffer size to 16K (#9548) +* Move and spell-check Kubernetes 1.22 migration FAQ (#9544) +* Add CORS template check inside location for externalAuth.SignURL (#8814) +* fix(grafana-dashboard): remove hardcoded namespace references (#9523) +* Align default value for keepalive_request with NGINX default (#9518) +* Implement pathType validation (#9511) +* feat(configmap): expose gzip-disable (#9505) +* Values: Add missing `controller.metrics.service.labels`. (#9501) +* Add docs about orphan_ingress metric (#9514) +* Add new prometheus metric for orphaned ingress (#8230) +* Sanitise request metrics in monitoring docs (#9384) +* Change default value of enable-brotli (#9500) +* feat: support topology aware hints (#9165) +* Remove 1.5.2 from readme (#9498) +* Remove nonexistent load flag from docker build commands (#9122) +* added option to disable sync event creation (#8528) +* Add buildResolvers to the stream module (#9184) +* fix: disable auth access logs (#9049) +* Adding ipdenylist annotation (#8795) +* Add update updateStrategy and minReadySeconds for defaultBackend (#8506) +* Fix indentation on serviceAccount annotation (#9129) +* Update monitoring.md (#9269) +* add github actions stale bot (#9439) +* Admission Webhooks/Job: Add `NetworkPolicy`. (#9218) +* update OpenTelemetry image (#9491) +* bump OpenTelemetry (#9489) +* Optional podman support (#9294) +* fix change images (#9463) +* move tests to gh actions (#9461) +* Automated Release Controller 1.5.2 (#9455) +* Add sslpassthrough tests (#9457) +* updated the link in RELEASE.md file (#9456) * restart 1.5.2 release process (#9450) * Update command line arguments documentation (#9224) * start release 1.5.2 (#9445) @@ -20,24 +65,6 @@ Images: * update the nginx run container for alpine:3.17.0 (#9430) * cleanup: remove ioutil for new go version (#9427) * start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417) -======= - * registry.k8s.io/controller:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7g098v62f60a87868d12452529bad0d178fb36143346 - * registry.k8s.io/controller-chroot:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529b350d178fb36147345 - -### All Changes: - -<<<<<<< HEAD ->>>>>>> f4164ae0b (THE CHANGELOG WORKS) -======= -* upgrade nginx base image (#9436) -* test the new e2e test images (#9444) -* avoid builds and tests for non-code changes (#9392) -* CI updates (#9440) -* HPA: Add `controller.autoscaling.annotations` to `values.yaml`. (#9253) -* update the nginx run container for alpine:3.17.0 (#9430) -* cleanup: remove ioutil for new go version (#9427) -* start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417) ->>>>>>> 9ecab7d85 (e2e doc updates work now) * ci: remove setup-helm step (#9404) * ci: remove setup-kind step (#9401) * Add reporter for all tests (#9395) @@ -73,10 +100,17 @@ Images: * add containerSecurityContext to extraModules init containers (kubernetes#9016) (#9242) ### Dependencies updates: -<<<<<<< HEAD -<<<<<<< HEAD -======= ->>>>>>> 9ecab7d85 (e2e doc updates work now) +* Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555) +* Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553) +* Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552) +* Bump google.golang.org/grpc from 1.51.0 to 1.52.0 (#9512) +* Bump `client-go` to remove dependence on go-autorest dependency (#9488) +* Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555) +* Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553) +* Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552) +* Bump google.golang.org/grpc from 1.51.0 to 1.52.0 (#9512) +* Bump `client-go` to remove dependence on go-autorest dependency (#9488) +* Bump golang.org/x/crypto from 0.4.0 to 0.5.0 (#9494) * Bump golang.org/x/crypto from 0.3.0 to 0.4.0 (#9397) * Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9432) * Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9421) @@ -85,11 +119,6 @@ Images: * Bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (#9426) * Bump actions/dependency-review-action from 3.0.1 to 3.0.2 (#9424) * Bump ossf/scorecard-action from 2.0.6 to 2.1.0 (#9422) -<<<<<<< HEAD -======= ->>>>>>> f4164ae0b (THE CHANGELOG WORKS) -======= ->>>>>>> 9ecab7d85 (e2e doc updates work now) * Bump github.com/prometheus/common from 0.37.0 to 0.39.0 (#9416) * Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9408) * Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9398) @@ -104,12 +133,4 @@ Images: * Bump actions/dependency-review-action from 2.5.1 to 3.0.0 (#9301) * Bump k8s.io/component-base from 0.25.3 to 0.25.4 (#9300) -<<<<<<< HEAD -<<<<<<< HEAD -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2 -======= -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.2...controller-controller-v1.5.1 ->>>>>>> f4164ae0b (THE CHANGELOG WORKS) -======= -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2 ->>>>>>> 9ecab7d85 (e2e doc updates work now) +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.6.3 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 2a15960f7..c11859326 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,31 +1,27 @@ +annotations: + artifacthub.io/changes: | + - "add lint on chart before release (#9570)" + - "ci: remove setup-helm step (#9404)" + - "feat(helm): Optionally use cert-manager instead admission patch (#9279)" + - "run helm release on main only and when the chart/value changes only (#9290)" + - "Update Ingress-Nginx version controller-v1.6.3" + artifacthub.io/prerelease: "false" apiVersion: v2 -name: ingress-nginx -# When the version is modified, make sure the artifacthub.io/changes list is updated -# Also update CHANGELOG.md -version: 4.4.2 -appVersion: 1.5.1 +appVersion: 1.6.3 +description: Ingress controller for Kubernetes using NGINX as a reverse proxy and + load balancer +engine: gotpl home: https://github.com/kubernetes/ingress-nginx -description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png keywords: - - ingress - - nginx -sources: - - https://github.com/kubernetes/ingress-nginx +- ingress +- nginx +kubeVersion: '>=1.20.0-0' maintainers: - - name: rikatz - - name: strongjz - - name: tao12345666333 -engine: gotpl -kubeVersion: ">=1.20.0-0" -annotations: - # Use this annotation to indicate that this chart version is a pre-release. - # https://artifacthub.io/docs/topics/annotations/helm/ - artifacthub.io/prerelease: "false" - # List of changes for the release in artifacthub.io - # https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx?modal=changelog - artifacthub.io/changes: | - - Adding support for disabling liveness and readiness probes to the Helm chart - - add:(admission-webhooks) ability to set securityContext - - Updated Helm chart to use the fullname for the electionID if not specified - - Rename controller-wehbooks-networkpolicy.yaml +- name: rikatz +- name: strongjz +- name: tao12345666333 +name: ingress-nginx +sources: +- https://github.com/kubernetes/ingress-nginx +version: 4.5.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 65236e08c..cb454b535 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.4.2](https://img.shields.io/badge/Version-4.4.2-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square) +![Version: 4.5.0](https://img.shields.io/badge/Version-4.5.0-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -333,13 +333,13 @@ Kubernetes: `>=1.20.0-0` | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629"` | | -| controller.image.digestChroot | string | `"sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345"` | | +| controller.image.digest | string | `"sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2"` | | +| controller.image.digestChroot | string | `"sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.5.1"` | | +| controller.image.tag | string | `"v1.6.3"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-1.5.2.md b/charts/ingress-nginx/changelog/Changelog-4.5.0.md similarity index 75% rename from charts/ingress-nginx/changelog/Changelog-1.5.2.md rename to charts/ingress-nginx/changelog/Changelog-4.5.0.md index 5e0563858..ba4b52cbc 100644 --- a/charts/ingress-nginx/changelog/Changelog-1.5.2.md +++ b/charts/ingress-nginx/changelog/Changelog-4.5.0.md @@ -2,11 +2,12 @@ This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). -### 4.4.1 +### 4.5.0 +* add lint on chart before release (#9570) * ci: remove setup-helm step (#9404) * feat(helm): Optionally use cert-manager instead admission patch (#9279) * run helm release on main only and when the chart/value changes only (#9290) -* Update Ingress-Nginx version controller-v1.5.2 +* Update Ingress-Nginx version controller-v1.6.3 -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.1...helm-chart-4.4.1 +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.0 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 215ce509d..34e1cf6ef 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -14,226 +14,193 @@ commonLabels: {} # myLabel: aakkmd controller: - name: controller - image: - ## Keep false as default for now! - chroot: false - registry: registry.k8s.io - image: ingress-nginx/controller - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "v1.5.1" - digest: sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 - digestChroot: sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345 - pullPolicy: IfNotPresent - # www-data -> uid 101 - runAsUser: 101 - allowPrivilegeEscalation: true + name: controller + image: + ## Keep false as default for now! + chroot: false + registry: registry.k8s.io + image: ingress-nginx/controller + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "v1.6.3" + digest: sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + digestChroot: sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4 + pullPolicy: IfNotPresent + # www-data -> uid 101 + runAsUser: 101 + allowPrivilegeEscalation: true + # -- Use an existing PSP instead of creating one + existingPsp: "" + # -- Configures the controller container name + containerName: controller + # -- Configures the ports that the nginx-controller listens on + containerPort: + http: 80 + https: 443 + # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ + config: {} + # -- Annotations to be added to the controller config configuration configmap. + configAnnotations: {} + # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers + proxySetHeaders: {} + # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers + addHeaders: {} + # -- Optionally customize the pod dnsConfig. + dnsConfig: {} + # -- Optionally customize the pod hostname. + hostname: {} + # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. + # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller + # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. + dnsPolicy: ClusterFirst + # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network + # Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + reportNodeInternalIp: false + # -- Process Ingress objects without ingressClass annotation/ingressClassName field + # Overrides value for --watch-ingress-without-class flag of the controller binary + # Defaults to false + watchIngressWithoutClass: false + # -- Process IngressClass per name (additionally as per spec.controller). + ingressClassByName: false + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" + # Defaults to false + enableTopologyAwareRouting: false + # -- This configuration defines if Ingress Controller should allow users to set + # their own *-snippet annotations, otherwise this is forbidden / dropped + # when users add those annotations. + # Global snippets in ConfigMap are still respected + allowSnippetAnnotations: true + # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), + # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 + # is merged + hostNetwork: false + ## Use host ports 80 and 443 + ## Disabled by default + hostPort: + # -- Enable 'hostPort' or not + enabled: false + ports: + # -- 'hostPort' http port + http: 80 + # -- 'hostPort' https port + https: 443 + # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' + electionID: "" + ## This section refers to the creation of the IngressClass resource + ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 + ingressClassResource: + # -- Name of the ingressClass + name: nginx + # -- Is this ingressClass enabled or not + enabled: true + # -- Is this the default ingressClass for the cluster + default: false + # -- Controller-value of the controller that is processing this ingressClass + controllerValue: "k8s.io/ingress-nginx" + # -- Parameters is a link to a custom resource containing additional + # configuration for the controller. This is optional if the controller + # does not require extra parameters. + parameters: {} + # -- For backwards compatibility with ingress.class annotation, use ingressClass. + # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation + ingressClass: nginx + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value - # -- Use an existing PSP instead of creating one - existingPsp: "" + # -- Security Context policies for controller pods + podSecurityContext: {} + # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls + sysctls: {} + # sysctls: + # "net.core.somaxconn": "8192" - # -- Configures the controller container name - containerName: controller - - # -- Configures the ports that the nginx-controller listens on - containerPort: - http: 80 - https: 443 - - # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ - config: {} - - # -- Annotations to be added to the controller config configuration configmap. - configAnnotations: {} - - # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers - proxySetHeaders: {} - - # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers - addHeaders: {} - - # -- Optionally customize the pod dnsConfig. - dnsConfig: {} - - # -- Optionally customize the pod hostname. - hostname: {} - - # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. - # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller - # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. - dnsPolicy: ClusterFirst - - # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network - # Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply - reportNodeInternalIp: false - - # -- Process Ingress objects without ingressClass annotation/ingressClassName field - # Overrides value for --watch-ingress-without-class flag of the controller binary - # Defaults to false - watchIngressWithoutClass: false - - # -- Process IngressClass per name (additionally as per spec.controller). - ingressClassByName: false - - # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" - # Defaults to false - enableTopologyAwareRouting: false - - # -- This configuration defines if Ingress Controller should allow users to set - # their own *-snippet annotations, otherwise this is forbidden / dropped - # when users add those annotations. - # Global snippets in ConfigMap are still respected - allowSnippetAnnotations: true - - # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), - # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 - # is merged - hostNetwork: false - - ## Use host ports 80 and 443 - ## Disabled by default - hostPort: - # -- Enable 'hostPort' or not - enabled: false - ports: - # -- 'hostPort' http port - http: 80 - # -- 'hostPort' https port - https: 443 - - # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' - electionID: "" - - ## This section refers to the creation of the IngressClass resource - ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 - ingressClassResource: - # -- Name of the ingressClass - name: nginx - # -- Is this ingressClass enabled or not - enabled: true - # -- Is this the default ingressClass for the cluster - default: false - # -- Controller-value of the controller that is processing this ingressClass - controllerValue: "k8s.io/ingress-nginx" - - # -- Parameters is a link to a custom resource containing additional - # configuration for the controller. This is optional if the controller - # does not require extra parameters. - parameters: {} - - # -- For backwards compatibility with ingress.class annotation, use ingressClass. - # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation - ingressClass: nginx - - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value - - # -- Security Context policies for controller pods - podSecurityContext: {} - - # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls - sysctls: {} - # sysctls: - # "net.core.somaxconn": "8192" - - # -- Allows customization of the source of the IP address or FQDN to report - # in the ingress status field. By default, it reads the information provided - # by the service. If disable, the status field reports the IP address of the - # node or nodes where an ingress controller pod is running. - publishService: - # -- Enable 'publishService' or not - enabled: true - # -- Allows overriding of the publish service to bind to - # Must be / - pathOverride: "" - - # Limit the scope of the controller to a specific namespace - scope: - # -- Enable 'scope' or not - enabled: false - # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) - namespace: "" - # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels - # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. - namespaceSelector: "" - - # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - - tcp: - # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) + # -- Allows customization of the source of the IP address or FQDN to report + # in the ingress status field. By default, it reads the information provided + # by the service. If disable, the status field reports the IP address of the + # node or nodes where an ingress controller pod is running. + publishService: + # -- Enable 'publishService' or not + enabled: true + # -- Allows overriding of the publish service to bind to + # Must be / + pathOverride: "" + # Limit the scope of the controller to a specific namespace + scope: + # -- Enable 'scope' or not + enabled: false + # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) + namespace: "" + # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels + # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. + namespaceSelector: "" + # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) configMapNamespace: "" - # -- Annotations to be added to the tcp config configmap + tcp: + # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the tcp config configmap + annotations: {} + udp: + # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the udp config configmap + annotations: {} + # -- Maxmind license key to download GeoLite2 Databases. + ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases + maxmindLicenseKey: "" + # -- Additional command line arguments to pass to nginx-ingress-controller + # E.g. to specify the default SSL certificate you can use + extraArgs: {} + ## extraArgs: + ## default-ssl-certificate: "/" + + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + + # -- Use a `DaemonSet` or `Deployment` + kind: Deployment + # -- Annotations to be added to the controller Deployment or DaemonSet + ## annotations: {} + # keel.sh/pollSchedule: "@every 60m" - udp: - # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - # -- Annotations to be added to the udp config configmap - annotations: {} + # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels + ## + labels: {} + # keel.sh/policy: patch + # keel.sh/trigger: poll - # -- Maxmind license key to download GeoLite2 Databases. - ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases - maxmindLicenseKey: "" + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate - # -- Additional command line arguments to pass to nginx-ingress-controller - # E.g. to specify the default SSL certificate you can use - extraArgs: {} - ## extraArgs: - ## default-ssl-certificate: "/" + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - # -- Additional environment variables to set - extraEnvs: [] - # extraEnvs: - # - name: FOO - # valueFrom: - # secretKeyRef: - # key: FOO - # name: secret-resource - - # -- Use a `DaemonSet` or `Deployment` - kind: Deployment - - # -- Annotations to be added to the controller Deployment or DaemonSet - ## - annotations: {} - # keel.sh/pollSchedule: "@every 60m" - - # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels - ## - labels: {} - # keel.sh/policy: patch - # keel.sh/trigger: poll - - - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - - - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - # -- Affinity and anti-affinity rules for server scheduling to nodes - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## - affinity: {} + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} # # An example of preferred pod anti-affinity, weight is in the range 1-100 # podAntiAffinity: # preferredDuringSchedulingIgnoredDuringExecution: @@ -274,10 +241,10 @@ controller: # - controller # topologyKey: "kubernetes.io/hostname" - # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## - topologySpreadConstraints: [] + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + topologySpreadConstraints: [] # - maxSkew: 1 # topologyKey: topology.kubernetes.io/zone # whenUnsatisfiable: DoNotSchedule @@ -285,682 +252,616 @@ controller: # matchLabels: # app.kubernetes.io/instance: ingress-nginx-internal - # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready - ## wait up to five minutes for the drain of connections - ## - terminationGracePeriodSeconds: 300 - - # -- Node labels for controller pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: - kubernetes.io/os: linux - - ## Liveness and readiness probe values - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## - ## startupProbe: - ## httpGet: - ## # should match container.healthCheckPath - ## path: "/healthz" - ## port: 10254 - ## scheme: HTTP - ## initialDelaySeconds: 5 - ## periodSeconds: 5 - ## timeoutSeconds: 2 - ## successThreshold: 1 - ## failureThreshold: 5 - livenessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - readinessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 3 - - - # -- Path of the health check endpoint. All requests received on the port defined by - # the healthz-port parameter are forwarded internally to this path. - healthCheckPath: "/healthz" - - # -- Address to bind the health check endpoint. - # It is better to set this option to the internal node address - # if the ingress nginx controller is running in the `hostNetwork: true` mode. - healthCheckHost: "" - - # -- Annotations to be added to controller pods - ## - podAnnotations: {} - - replicaCount: 1 - - # -- Define either 'minAvailable' or 'maxUnavailable', never both. - minAvailable: 1 - # -- Define either 'minAvailable' or 'maxUnavailable', never both. - # maxUnavailable: 1 - - ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes - ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 - ## Ideally, there should be no limits. - ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ - resources: - ## limits: - ## cpu: 100m - ## memory: 90Mi - requests: - cpu: 100m - memory: 90Mi - - # Mutually exclusive with keda autoscaling - autoscaling: - apiVersion: autoscaling/v2 - enabled: false - annotations: {} - minReplicas: 1 - maxReplicas: 11 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - - autoscalingTemplate: [] - # Custom or additional autoscaling metrics - # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics - # - type: Pods - # pods: - # metric: - # name: nginx_ingress_controller_nginx_process_requests_total - # target: - # type: AverageValue - # averageValue: 10000m - - # Mutually exclusive with hpa autoscaling - keda: - apiVersion: "keda.sh/v1alpha1" - ## apiVersion changes with keda 1.x vs 2.x - ## 2.x = keda.sh/v1alpha1 - ## 1.x = keda.k8s.io/v1alpha1 - enabled: false - minReplicas: 1 - maxReplicas: 11 - pollingInterval: 30 - cooldownPeriod: 300 - restoreToOriginalReplicaCount: false - scaledObject: - annotations: {} - # Custom annotations for ScaledObject resource - # annotations: - # key: value - triggers: [] - # - type: prometheus - # metadata: - # serverAddress: http://:9090 - # metricName: http_requests_total - # threshold: '100' - # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) - - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - - # -- Enable mimalloc as a drop-in replacement for malloc. - ## ref: https://github.com/microsoft/mimalloc - ## - enableMimalloc: true - - ## Override NGINX template - customTemplate: - configMapName: "" - configMapKey: "" - - service: - enabled: true - - # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were - # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http - # It allows choosing the protocol for each backend specified in the Kubernetes service. - # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 - # Will be ignored for Kubernetes versions older than 1.20 + # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready + ## wait up to five minutes for the drain of connections ## - appProtocol: true - - annotations: {} - labels: {} - # clusterIP: "" - - # -- List of IP addresses at which the controller services are available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + terminationGracePeriodSeconds: 300 + # -- Node labels for controller pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ ## - externalIPs: [] - - # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer - loadBalancerIP: "" - loadBalancerSourceRanges: [] - - enableHttp: true - enableHttps: true - - ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. - ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer - # externalTrafficPolicy: "" - - ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". - ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - # sessionAffinity: "" - - ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, - ## the service controller allocates a port from your cluster’s NodePort range. - ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - # healthCheckNodePort: 0 - - # -- Represents the dual-stack-ness requested or required by this Service. Possible values are - # SingleStack, PreferDualStack or RequireDualStack. - # The ipFamilies and clusterIPs fields depend on the value of this field. - ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ - ipFamilyPolicy: "SingleStack" - - # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically - # based on cluster configuration and the ipFamilyPolicy field. - ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ - ipFamilies: - - IPv4 - - ports: - http: 80 - https: 443 - - targetPorts: - http: http - https: https - - type: LoadBalancer - - ## type: NodePort - ## nodePorts: - ## http: 32080 - ## https: 32443 - ## tcp: - ## 8080: 32808 - nodePorts: - http: "" - https: "" - tcp: {} - udp: {} - - external: - enabled: true - - internal: - # -- Enables an additional internal load balancer (besides the external one). - enabled: false - # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. - annotations: {} - - # loadBalancerIP: "" - - # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. - loadBalancerSourceRanges: [] - - ## Set external traffic policy to: "Local" to preserve source IP on - ## providers supporting it - ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer - # externalTrafficPolicy: "" - - # shareProcessNamespace enables process namespace sharing within the pod. - # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. - shareProcessNamespace: false - - # -- Additional containers to be added to the controller pod. - # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. - extraContainers: [] - # - name: my-sidecar - # image: nginx:latest - # - name: lemonldap-ng-controller - # image: lemonldapng/lemonldap-ng-controller:0.2.0 - # args: - # - /lemonldap-ng-controller - # - --alsologtostderr - # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration - # env: - # - name: POD_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.name - # - name: POD_NAMESPACE - # valueFrom: - # fieldRef: - # fieldPath: metadata.namespace - # volumeMounts: - # - name: copy-portal-skins - # mountPath: /srv/var/lib/lemonldap-ng/portal/skins - - # -- Additional volumeMounts to the controller main container. - extraVolumeMounts: [] - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - # -- Additional volumes to the controller pod. - extraVolumes: [] - # - name: copy-portal-skins - # emptyDir: {} - - # -- Containers, which are run before the app containers are started. - extraInitContainers: [] - # - name: init-myservice - # image: busybox - # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] - - # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module - extraModules: [] - # containerSecurityContext: - # allowPrivilegeEscalation: false - # - # The image must contain a `/usr/local/bin/init_module.sh` executable, which - # will be executed as initContainers, to move its config files within the - # mounted volume. - - opentelemetry: - enabled: false - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9 - containerSecurityContext: - allowPrivilegeEscalation: false - - admissionWebhooks: - annotations: {} - # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". - - ## Additional annotations to the admission webhooks. - ## These annotations will be added to the ValidatingWebhookConfiguration and - ## the Jobs Spec of the admission webhooks. - enabled: true - # -- Additional environment variables to set - extraEnvs: [] - # extraEnvs: - # - name: FOO - # valueFrom: - # secretKeyRef: - # key: FOO - # name: secret-resource - # -- Admission Webhook failure policy to use - failurePolicy: Fail - # timeoutSeconds: 10 - port: 8443 - certificate: "/usr/local/certificates/cert" - key: "/usr/local/certificates/key" - namespaceSelector: {} - objectSelector: {} - # -- Labels to be added to admission webhooks - labels: {} - - # -- Use an existing PSP instead of creating one - existingPsp: "" - networkPolicyEnabled: false - - service: - annotations: {} - # clusterIP: "" - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 443 - type: ClusterIP - - createSecretJob: - securityContext: - allowPrivilegeEscalation: false - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - - patchWebhookJob: - securityContext: - allowPrivilegeEscalation: false - resources: {} - - patch: - enabled: true - image: - registry: registry.k8s.io - image: ingress-nginx/kube-webhook-certgen - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: v20220916-gd32f8c343 - digest: sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f - pullPolicy: IfNotPresent - # -- Provide a priority class name to the webhook patching job - ## - priorityClassName: "" - podAnnotations: {} - nodeSelector: + nodeSelector: kubernetes.io/os: linux - tolerations: [] - # -- Labels to be added to patch job resources - labels: {} - securityContext: - runAsNonRoot: true - runAsUser: 2000 - fsGroup: 2000 + ## Liveness and readiness probe values + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## + ## startupProbe: + ## httpGet: + ## # should match container.healthCheckPath + ## path: "/healthz" + ## port: 10254 + ## scheme: HTTP + ## initialDelaySeconds: 5 + ## periodSeconds: 5 + ## timeoutSeconds: 2 + ## successThreshold: 1 + ## failureThreshold: 5 + livenessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + # -- Path of the health check endpoint. All requests received on the port defined by + # the healthz-port parameter are forwarded internally to this path. + healthCheckPath: "/healthz" + # -- Address to bind the health check endpoint. + # It is better to set this option to the internal node address + # if the ingress nginx controller is running in the `hostNetwork: true` mode. + healthCheckHost: "" + # -- Annotations to be added to controller pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Define either 'minAvailable' or 'maxUnavailable', never both. + # maxUnavailable: 1 - # Use certmanager to generate webhook certs - certManager: - enabled: false - # self-signed root certificate - rootCert: - duration: "" # default to be 5y - admissionCert: - duration: "" # default to be 1y - # issuerRef: - # name: "issuer" - # kind: "ClusterIssuer" + ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes + ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 + ## Ideally, there should be no limits. + ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ + resources: + ## limits: + ## cpu: 100m + ## memory: 90Mi + requests: + cpu: 100m + memory: 90Mi + # Mutually exclusive with keda autoscaling + autoscaling: + apiVersion: autoscaling/v2 + enabled: false + annotations: {} + minReplicas: 1 + maxReplicas: 11 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + autoscalingTemplate: [] + # Custom or additional autoscaling metrics + # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics + # - type: Pods + # pods: + # metric: + # name: nginx_ingress_controller_nginx_process_requests_total + # target: + # type: AverageValue + # averageValue: 10000m - metrics: - port: 10254 - portName: metrics - # if this port is changed, change healthz-port: in extraArgs: accordingly - enabled: false + # Mutually exclusive with hpa autoscaling + keda: + apiVersion: "keda.sh/v1alpha1" + ## apiVersion changes with keda 1.x vs 2.x + ## 2.x = keda.sh/v1alpha1 + ## 1.x = keda.k8s.io/v1alpha1 + enabled: false + minReplicas: 1 + maxReplicas: 11 + pollingInterval: 30 + cooldownPeriod: 300 + restoreToOriginalReplicaCount: false + scaledObject: + annotations: {} + # Custom annotations for ScaledObject resource + # annotations: + # key: value + triggers: [] + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + + # -- Enable mimalloc as a drop-in replacement for malloc. + ## ref: https://github.com/microsoft/mimalloc + ## + enableMimalloc: true + ## Override NGINX template + customTemplate: + configMapName: "" + configMapKey: "" service: - annotations: {} - # prometheus.io/scrape: "true" - # prometheus.io/port: "10254" - # -- Labels to be added to the metrics service resource - labels: {} + enabled: true + # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were + # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http + # It allows choosing the protocol for each backend specified in the Kubernetes service. + # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 + # Will be ignored for Kubernetes versions older than 1.20 + ## + appProtocol: true + annotations: {} + labels: {} + # clusterIP: "" - # clusterIP: "" + # -- List of IP addresses at which the controller services are available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + loadBalancerSourceRanges: [] + enableHttp: true + enableHttps: true + ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" - # -- List of IP addresses at which the stats-exporter service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] + ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + # sessionAffinity: "" - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 10254 - type: ClusterIP - # externalTrafficPolicy: "" - # nodePort: "" + ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, + ## the service controller allocates a port from your cluster’s NodePort range. + ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 - serviceMonitor: - enabled: false - additionalLabels: {} - ## The label to use to retrieve the job name from. - ## jobLabel: "app.kubernetes.io/name" - namespace: "" - namespaceSelector: {} - ## Default: scrape .Release.Namespace only - ## To scrape all, use the following: - ## namespaceSelector: - ## any: true - scrapeInterval: 30s - # honorLabels: true - targetLabels: [] - relabelings: [] - metricRelabelings: [] + # -- Represents the dual-stack-ness requested or required by this Service. Possible values are + # SingleStack, PreferDualStack or RequireDualStack. + # The ipFamilies and clusterIPs fields depend on the value of this field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilyPolicy: "SingleStack" + # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically + # based on cluster configuration and the ipFamilyPolicy field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilies: + - IPv4 + ports: + http: 80 + https: 443 + targetPorts: + http: http + https: https + type: LoadBalancer + ## type: NodePort + ## nodePorts: + ## http: 32080 + ## https: 32443 + ## tcp: + ## 8080: 32808 + nodePorts: + http: "" + https: "" + tcp: {} + udp: {} + external: + enabled: true + internal: + # -- Enables an additional internal load balancer (besides the external one). + enabled: false + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. + annotations: {} + # loadBalancerIP: "" - prometheusRule: - enabled: false - additionalLabels: {} - # namespace: "" - rules: [] - # # These are just examples rules, please adapt them to your needs - # - alert: NGINXConfigFailed - # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: bad ingress config - nginx config test failed - # summary: uninstall the latest ingress changes to allow config reloads to resume - # - alert: NGINXCertificateExpiry - # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: ssl certificate(s) will expire in less then a week - # summary: renew expiring certificates to avoid downtime - # - alert: NGINXTooMany500s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 5XXs - # summary: More than 5% of all requests returned 5XX, this requires your attention - # - alert: NGINXTooMany400s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 4XXs - # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. + loadBalancerSourceRanges: [] + ## Set external traffic policy to: "Local" to preserve source IP on + ## providers supporting it + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + # shareProcessNamespace enables process namespace sharing within the pod. + # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. + shareProcessNamespace: false + # -- Additional containers to be added to the controller pod. + # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. + extraContainers: [] + # - name: my-sidecar + # image: nginx:latest + # - name: lemonldap-ng-controller + # image: lemonldapng/lemonldap-ng-controller:0.2.0 + # args: + # - /lemonldap-ng-controller + # - --alsologtostderr + # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration + # env: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + # - name: POD_NAMESPACE + # valueFrom: + # fieldRef: + # fieldPath: metadata.namespace + # volumeMounts: + # - name: copy-portal-skins + # mountPath: /srv/var/lib/lemonldap-ng/portal/skins - # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: - # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds - # to 300, allowing the draining of connections up to five minutes. - # If the active connections end before that, the pod will terminate gracefully at that time. - # To effectively take advantage of this feature, the Configmap feature - # worker-shutdown-timeout new value is 240s instead of 10s. - ## - lifecycle: - preStop: - exec: - command: - - /wait-shutdown + # -- Additional volumeMounts to the controller main container. + extraVolumeMounts: [] + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins - priorityClassName: "" + # -- Additional volumes to the controller pod. + extraVolumes: [] + # - name: copy-portal-skins + # emptyDir: {} + # -- Containers, which are run before the app containers are started. + extraInitContainers: [] + # - name: init-myservice + # image: busybox + # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] + + # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module + extraModules: [] + # containerSecurityContext: + # allowPrivilegeEscalation: false + # + # The image must contain a `/usr/local/bin/init_module.sh` executable, which + # will be executed as initContainers, to move its config files within the + # mounted volume. + + opentelemetry: + enabled: false + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9 + containerSecurityContext: + allowPrivilegeEscalation: false + admissionWebhooks: + annotations: {} + # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". + + ## Additional annotations to the admission webhooks. + ## These annotations will be added to the ValidatingWebhookConfiguration and + ## the Jobs Spec of the admission webhooks. + enabled: true + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + # -- Admission Webhook failure policy to use + failurePolicy: Fail + # timeoutSeconds: 10 + port: 8443 + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + namespaceSelector: {} + objectSelector: {} + # -- Labels to be added to admission webhooks + labels: {} + # -- Use an existing PSP instead of creating one + existingPsp: "" + networkPolicyEnabled: false + service: + annotations: {} + # clusterIP: "" + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 443 + type: ClusterIP + createSecretJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + patchWebhookJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + patch: + enabled: true + image: + registry: registry.k8s.io + image: ingress-nginx/kube-webhook-certgen + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: v20220916-gd32f8c343 + digest: sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + pullPolicy: IfNotPresent + # -- Provide a priority class name to the webhook patching job + ## + priorityClassName: "" + podAnnotations: {} + nodeSelector: + kubernetes.io/os: linux + tolerations: [] + # -- Labels to be added to patch job resources + labels: {} + securityContext: + runAsNonRoot: true + runAsUser: 2000 + fsGroup: 2000 + # Use certmanager to generate webhook certs + certManager: + enabled: false + # self-signed root certificate + rootCert: + # default to be 5y + duration: "" + admissionCert: + # default to be 1y + duration: "" + # issuerRef: + # name: "issuer" + # kind: "ClusterIssuer" + metrics: + port: 10254 + portName: metrics + # if this port is changed, change healthz-port: in extraArgs: accordingly + enabled: false + service: + annotations: {} + # prometheus.io/scrape: "true" + # prometheus.io/port: "10254" + # -- Labels to be added to the metrics service resource + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the stats-exporter service is available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 10254 + type: ClusterIP + # externalTrafficPolicy: "" + # nodePort: "" + serviceMonitor: + enabled: false + additionalLabels: {} + ## The label to use to retrieve the job name from. + ## jobLabel: "app.kubernetes.io/name" + namespace: "" + namespaceSelector: {} + ## Default: scrape .Release.Namespace only + ## To scrape all, use the following: + ## namespaceSelector: + ## any: true + scrapeInterval: 30s + # honorLabels: true + targetLabels: [] + relabelings: [] + metricRelabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + # namespace: "" + rules: [] + # # These are just examples rules, please adapt them to your needs + # - alert: NGINXConfigFailed + # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: bad ingress config - nginx config test failed + # summary: uninstall the latest ingress changes to allow config reloads to resume + # - alert: NGINXCertificateExpiry + # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: ssl certificate(s) will expire in less then a week + # summary: renew expiring certificates to avoid downtime + # - alert: NGINXTooMany500s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 5XXs + # summary: More than 5% of all requests returned 5XX, this requires your attention + # - alert: NGINXTooMany400s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 4XXs + # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: + # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds + # to 300, allowing the draining of connections up to five minutes. + # If the active connections end before that, the pod will terminate gracefully at that time. + # To effectively take advantage of this feature, the Configmap feature + # worker-shutdown-timeout new value is 240s instead of 10s. + ## + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + priorityClassName: "" # -- Rollback limit ## revisionHistoryLimit: 10 - ## Default 404 backend ## defaultBackend: - ## - enabled: false - - name: defaultbackend - image: - registry: registry.k8s.io - image: defaultbackend-amd64 - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "1.5" - pullPolicy: IfNotPresent - # nobody user -> uid 65534 - runAsUser: 65534 - runAsNonRoot: true - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - - # -- Use an existing PSP instead of creating one - existingPsp: "" - - extraArgs: {} - - serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - # -- Additional environment variables to set for defaultBackend pods - extraEnvs: [] - - port: 8080 - - ## Readiness and liveness probes for default backend - ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ - ## - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 30 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 5 - readinessProbe: - failureThreshold: 6 - initialDelaySeconds: 0 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 5 - - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - affinity: {} - - # -- Security Context policies for controller pods - # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for - # notes on enabling and using sysctls - ## - podSecurityContext: {} - - # -- Security Context policies for controller main container. - # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for - # notes on enabling and using sysctls - ## - containerSecurityContext: {} - - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value - - # -- Node labels for default backend pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: - kubernetes.io/os: linux - - # -- Annotations to be added to default backend pods - ## - podAnnotations: {} - - replicaCount: 1 - - minAvailable: 1 - - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - - extraVolumeMounts: [] - ## Additional volumeMounts to the default backend container. - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - extraVolumes: [] - ## Additional volumes to the default backend pod. - # - name: copy-portal-skins - # emptyDir: {} - - autoscaling: - annotations: {} - enabled: false - minReplicas: 1 - maxReplicas: 2 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - - service: - annotations: {} - - # clusterIP: "" - - # -- List of IP addresses at which the default backend service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips ## - externalIPs: [] + enabled: false + name: defaultbackend + image: + registry: registry.k8s.io + image: defaultbackend-amd64 + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "1.5" + pullPolicy: IfNotPresent + # nobody user -> uid 65534 + runAsUser: 65534 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + # -- Use an existing PSP instead of creating one + existingPsp: "" + extraArgs: {} + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Additional environment variables to set for defaultBackend pods + extraEnvs: [] + port: 8080 + ## Readiness and liveness probes for default backend + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ + ## + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 80 - type: ClusterIP + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - priorityClassName: "" - # -- Labels to be added to the default backend resources - labels: {} + affinity: {} + # -- Security Context policies for controller pods + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + podSecurityContext: {} + # -- Security Context policies for controller main container. + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + containerSecurityContext: {} + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value + # -- Node labels for default backend pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: + kubernetes.io/os: linux + # -- Annotations to be added to default backend pods + ## + podAnnotations: {} + replicaCount: 1 + minAvailable: 1 + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + + extraVolumeMounts: [] + ## Additional volumeMounts to the default backend container. + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + extraVolumes: [] + ## Additional volumes to the default backend pod. + # - name: copy-portal-skins + # emptyDir: {} + + autoscaling: + annotations: {} + enabled: false + minReplicas: 1 + maxReplicas: 2 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + service: + annotations: {} + # clusterIP: "" + + # -- List of IP addresses at which the default backend service is available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 80 + type: ClusterIP + priorityClassName: "" + # -- Labels to be added to the default backend resources + labels: {} ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 rbac: - create: true - scope: false - + create: true + scope: false ## If true, create & use Pod Security Policy resources ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ podSecurityPolicy: - enabled: false - + enabled: false serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - # -- Annotations for the controller service account - annotations: {} - + create: true + name: "" + automountServiceAccountToken: true + # -- Annotations for the controller service account + annotations: {} # -- Optional array of imagePullSecrets containing private registry credentials ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ imagePullSecrets: [] @@ -981,7 +882,6 @@ udp: {} # -- Prefix for TCP and UDP ports names in ingress controller service ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration portNamePrefix: "" - # -- (string) A base64-encoded Diffie-Hellman parameter. # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index fbdf9486a..c79412536 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -343,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -359,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -392,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -415,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -455,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -527,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -538,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -574,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -585,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -623,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -636,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 73ec24286..fae1c5d61 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -350,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -368,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -401,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -424,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -464,7 +449,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -539,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -550,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -586,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -597,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -635,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -648,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 9e6e905bb..245978140 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -343,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -355,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -387,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -410,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -449,7 +434,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -521,7 +506,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -532,7 +517,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -568,7 +553,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -579,7 +564,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -617,7 +602,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -630,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index dd986a55d..9bc28ec80 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -343,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -355,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -388,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -411,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -451,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -570,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -619,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -632,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 64e0366b4..b17da8a07 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -344,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -358,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -391,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -414,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -454,7 +439,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -526,7 +511,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -537,7 +522,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -573,7 +558,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -584,7 +569,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -622,7 +607,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -635,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index d6a40aed9..d93497323 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -343,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -364,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -397,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -420,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -460,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -532,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -543,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -579,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -590,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -628,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -641,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index 62ead9e34..8c9e96891 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -343,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -355,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -387,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -410,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -455,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -537,7 +522,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -548,7 +533,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -584,7 +569,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -595,7 +580,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -633,7 +618,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -646,7 +631,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index d52f01489..edd00a98d 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -90,21 +90,6 @@ rules: - get - list - watch -- apiGroups: - - "" - resourceNames: - - ingress-nginx-leader - resources: - - configmaps - verbs: - - get - - update -- apiGroups: - - "" - resources: - - configmaps - verbs: - - create - apiGroups: - coordination.k8s.io resourceNames: @@ -144,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -163,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx rules: - apiGroups: @@ -245,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission rules: - apiGroups: @@ -264,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -284,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -303,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -322,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -344,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -358,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -391,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -414,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -454,7 +439,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629 + image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -526,7 +511,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -537,7 +522,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-create spec: containers: @@ -573,7 +558,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -584,7 +569,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission-patch spec: containers: @@ -622,7 +607,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -635,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.5.1 + app.kubernetes.io/version: 1.6.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/deploy/index.md b/docs/deploy/index.md index 29495b5c0..57df7a215 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml ``` A @@ -357,7 +357,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index d5aa6cc16..5c67b47aa 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -7,11 +7,660 @@ Do not try to edit it manually. +### [[Serial] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L35) + +- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L48) +- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L75) +- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L92) +- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L113) +- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L130) +- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L141) +- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L155) +- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L169) +- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L185) +- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L201) +- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L212) + +### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L31) + +- [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L34) +- [Check persistent affinity mode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L67) + +### [server-alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L29) + +- [should return status code 200 for host 'foo' and 404 for 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L36) +- [should return status code 200 for host 'foo' and 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L62) +- [should return status code 200 for hosts defined in two ingresses, different path with one alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L87) + +### [app-root](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L28) + +- [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) + +### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L29) + +- [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L36) +- [should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L84) +- [should 302 redirect to error page instead of 400 when auth-tls-error-page is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L114) +- [should pass URL-encoded certificate to upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L161) +- [should validate auth-tls-verify-client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L206) +- [should return 403 using auth-tls-match-cn with no matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L266) +- [should return 200 using auth-tls-match-cn with matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L295) +- [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L324) + +### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L27) + +- [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L34) +- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L49) +- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) +- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) +- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) +- [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) + +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) + +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L836) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L864) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L888) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L916) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L973) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) + +### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) + +- [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L35) +- [should set client_body_buffer_size to 1K](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L57) +- [should set client_body_buffer_size to 1k](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L79) +- [should set client_body_buffer_size to 1m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L101) +- [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L123) +- [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L145) + +### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L29) + +- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L36) + +### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L28) + +- [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L35) +- [should set cors methods to only allow POST, GET](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L62) +- [should set cors max-age](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L78) +- [should disable cors allow credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L94) +- [should allow origin for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L110) +- [should allow headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L137) +- [should expose headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L153) +- [should allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L169) +- [should not allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L196) +- [should allow correct origins - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L216) +- [should not break functionality](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L267) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L291) +- [should not break functionality with extra domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L314) +- [should not match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L338) +- [should allow - single origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L358) +- [should not allow - single origin with port and origin without port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L386) +- [should not allow - single origin without port and origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L405) +- [should allow - matching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L425) +- [should not allow - unmatching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L468) +- [should allow - matching origin+port with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L488) +- [should not allow - portless origin with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L515) +- [should allow correct origins - missing subdomain + origin with wildcard origin and correct origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L535) +- [should allow - missing origins (should allow all origins)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L571) + +### [custom-http-errors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L34) + +- [configures Nginx correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L41) + +### [default-backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L29) + +- [should use a custom default backend as upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L37) + +### [disable-access-log disable-http-access-log disable-stream-access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L28) + +- [disable-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L35) +- [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) +- [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) + +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L31) + +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L38) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L55) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L72) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L105) + +### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) + +- [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) + +### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L31) + +- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L38) +- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L64) + +### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L30) + +- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L38) + +### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L40) + +- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L43) +- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L68) +- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L126) +- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L199) + +### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L27) + +- [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) + +### [influxdb-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/influxdb.go#L39) + +- [should send the request metric to the influxdb server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/influxdb.go#L48) + +### [whitelist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L27) + +- [should set valid ip whitelist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L34) + +### [Annotation - limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L31) + +- [should limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L38) + +### [limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L29) + +- [Check limit-rate annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L37) + +### [enable-access-log enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L27) + +- [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L34) +- [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L49) + +### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) + +- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) +- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) +- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) + +### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) + +- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) +- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) +- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) +- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) +- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) +- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) +- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) +- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) +- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) +- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) +- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) +- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) + +### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) + +- [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) + +### [proxy-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L28) + +- [should set proxy_redirect to off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L36) +- [should set proxy_redirect to default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L52) +- [should set proxy_redirect to hello.com goodbye.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L68) +- [should set proxy client-max-body-size to 8m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L85) +- [should not set proxy client-max-body-size to incorrect value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L100) +- [should set valid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L115) +- [should not set invalid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L136) +- [should turn on proxy-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L157) +- [should turn off proxy-request-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L179) +- [should build proxy next upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L194) +- [should setup proxy cookies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L215) +- [should change the default proxy HTTP version](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L233) + +### [proxy-ssl-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L30) + +- [should set valid proxy-ssl-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L37) +- [should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L64) +- [should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L94) +- [should set valid proxy-ssl-secret, proxy-ssl-protocols](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L122) +- [proxy-ssl-location-only flag should change the nginx config server part](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L150) + +### [permanent-redirect permanent-redirect-code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L30) + +- [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L33) +- [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L61) + +### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L35) + +- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L42) +- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L84) + +### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L28) + +- [add valid directives to server via server snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L35) +- [drops server snippet if disabled by the administrator](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L61) + +### [service-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L32) + +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L41) +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L70) +- [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L99) + +### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L58) + +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L28) + +- [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L35) + +### [stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L34) + +- [should add value of stream-snippet to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L41) +- [should add stream-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L85) + +### [upstream-hash-by-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L76) + +- [should connect to the same pod](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L83) +- [should connect to the same subset of pods](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L92) + +### [upstream-vhost](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L27) + +- [set host to upstreamvhost.bar.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L34) + +### [x-forwarded-prefix](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L28) + +- [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) +- [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) + +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) + +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) + +### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) + +- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) +- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) +- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) +- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) +- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) +- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) +- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) +- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) +- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) +- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) +- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) +- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) +- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) +- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) +- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) + +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) + +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) +- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) +- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) +- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) +- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L485) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L494) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L505) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L529) +- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L552) +- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L570) +- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L590) +- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L609) +- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L623) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L678) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L687) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L698) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L772) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L820) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L849) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) + +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) + +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) + +### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) + +- [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) +- [should get information for a specific backend server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L56) +- [should produce valid JSON for /dbg general](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L85) + +### [[Default Backend] custom service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L33) + +- [uses custom default backend that returns 200 as status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L36) + +### [[Default Backend]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L30) + +- [should return 404 sending requests when only a default backend is running](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L33) +- [enables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L88) +- [disables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L105) + +### [[Default Backend] SSL](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L26) + +- [should return a self generated SSL certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L29) + +### [[Default Backend] change default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L30) + +- [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) + +### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) + +- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) + +### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L36) + +- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L50) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L190) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L206) +- [ [MemoryLeak]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L207) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/chain.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/chain.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/cookie.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/cookie.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/match.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/match.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/string.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/string.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) + +- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) + +### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L30) + +- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L40) +- [should shutdown after waiting 60 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L61) +- [should shutdown after waiting 150 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L106) + +### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L25) + +- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L33) + +### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L27) + +- [should drop whole ingress if one path matches invalid regex](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L34) + +### [single ingress - multiple hosts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L30) + +- [should set the correct $service_name NGINX variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L38) + +### [[Ingress] [PathType] exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L30) + +- [should choose exact location for /exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L37) + +### [[Ingress] [PathType] mix Exact and Prefix paths](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L30) + +- [should choose the correct location](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L39) + +### [[Ingress] [PathType] prefix checks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L28) + +- [should return 404 when prefix /aaa does not match request /aaaccc](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L35) + +### [[Ingress] definition without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L31) + +- [should set ingress details variables for ingresses without a host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L34) +- [should set ingress details variables for ingresses with host without IngressRuleValue, only Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L55) + +### [[Memory Leak] Dynamic Certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L35) + +- [should not leak memory from ingress SSL certificates or configuration updates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L42) + +### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L28) + +- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L35) + +### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L31) + +- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L42) + +### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L31) + +- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L39) + +### [[Lua] dynamic certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L37) + +- [picks up the certificate when we add TLS spec to existing ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L45) +- [picks up the previously missing secret for a given ingress without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L70) +- [supports requests with domain with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L145) +- [picks up the updated certificate without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L149) +- [falls back to using default certificate when secret gets deleted without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L185) +- [picks up a non-certificate only change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L218) +- [removes HTTPS configuration when we delete TLS spec](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L233) + +### [[Lua] dynamic configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L42) + +- [configures balancer Lua middleware correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L50) +- [handles endpoints only changes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L62) +- [handles endpoints only changes (down scaling of replicas)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L87) +- [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L125) +- [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L171) + +### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) + +- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) +- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) +- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) + +### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) + +- [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) + +### [[Security] validate path fields](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L42) + +- [should accept an ingress with valid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L49) +- [should drop an ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L67) +- [should drop an ingress with regex path and regex disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L84) +- [should accept an ingress with regex path and regex enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L101) +- [should reject an ingress with invalid path and regex enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L118) + +### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L33) + +- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) +- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L54) + +### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L59) + +- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L62) +- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L95) +- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L129) +- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L153) +- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L184) +- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L217) +- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L248) +- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L311) + +### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) + +- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) + +### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) + +- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L32) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L42) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L54) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L67) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L80) + +### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L29) + +- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L36) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L67) +- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L102) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L133) + +### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) + +- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L39) + +### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) + +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) + +### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) + +- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) +- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L65) + +### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L33) + +- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L64) +- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L80) + +### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L33) + +- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L50) +- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L69) +- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) +- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) + +### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) + +- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L52) + +### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) + +- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) +- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) + +### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L30) + +- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L40) +- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L92) + ### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L37) - [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L46) - [should only allow requests from specific countries](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L70) +### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L28) + +- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L38) +- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) +- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) + ### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L34) - [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L85) @@ -27,59 +676,39 @@ Do not try to edit it manually. - [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L337) - [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L348) -### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L40) +### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L43) +- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) +- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L38) -### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) +### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L30) -- [should disable the log-format-escape-json by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L40) -- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L47) -- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L55) -- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L66) -- [log-format-escape-json disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L89) +- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) -### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L29) +### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) -- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L38) -- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L50) +- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L40) +- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L48) +- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L60) +- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L68) +- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L80) +- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L88) +- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L100) -### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L28) +### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L39) -- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L36) -- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L52) - -### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L28) - -- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) - -### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L36) - -- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L46) -- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L79) -- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L112) -- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L155) - -### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L28) - -- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L35) - -### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L28) - -- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L35) -- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L92) - -### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L33) - -- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L50) -- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L69) -- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) -- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) - -### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) - -- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) -- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) +- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L68) +- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L104) +- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L132) +- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L164) +- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L192) +- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L257) +- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L323) +- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L413) +- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L482) +- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L539) +- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L631) +- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L652) ### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L28) @@ -87,7 +716,41 @@ Do not try to edit it manually. - [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L48) - [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L59) - [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L68) -- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L77) +- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L77) +- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L86) + +### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) + +- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) + +### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L32) + +- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L48) +- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L70) +- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L100) + +### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) + +- [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L40) +- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L47) +- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L55) +- [should enable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L63) +- [should disable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L71) +- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L82) +- [log-format default escape](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L105) +- [log-format-escape-none enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L128) + +### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L26) + +- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L29) + +### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L27) + +- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) + +### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) + +- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) ### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) @@ -99,9 +762,19 @@ Do not try to edit it manually. - [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L70) -### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L34) +### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) -- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L51) +- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) +- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) +- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) + +### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L28) + +- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) + +### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) + +- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) ### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L48) @@ -119,41 +792,48 @@ Do not try to edit it manually. - [should enable opentracing using jaeger with an HTTP endpoint](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L228) - [should enable opentracing using datadog](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L241) -### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) +### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L28) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) +- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L35) -### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) +### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L41) -- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L44) -### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L26) +### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L37) -- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L31) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L41) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L53) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L66) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L79) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L40) -### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) +### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L28) -- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) -- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L38) +- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L36) +- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L52) -### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L39) +### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) -- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L68) -- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L104) -- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L132) -- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L164) -- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L192) -- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L257) -- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L323) -- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L413) -- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L482) -- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L539) -- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L631) -- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L652) +- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) +- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L57) + +### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) + +- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) + +### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L36) + +- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L46) +- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L79) +- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L112) +- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L155) + +### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L28) + +- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L36) +- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L52) + +### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L28) + +- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L36) +- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L52) ### [reuse-port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L27) @@ -161,133 +841,53 @@ Do not try to edit it manually. - [reuse port should be disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L44) - [reuse port should be enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L52) -### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L28) +### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L28) -- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L36) -- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L52) +- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L35) +- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L92) -### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L33) +### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L29) -- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L64) -- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L80) +- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L38) +- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L50) -### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L28) -- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L39) +- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) -### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L36) +### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L39) - -### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) - -- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) -- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L57) - -### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L28) - -- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L38) -- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) -- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) - -### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L30) - -- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) - -### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L28) - -- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) - -### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L27) - -- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) - -### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L26) - -- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L29) - -### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L29) - -- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L36) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L67) -- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L102) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L133) +- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) ### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L31) - [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L65) -- [enforcing TLS v1.0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L87) -- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L133) -- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L149) -- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L168) -- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L188) -- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L209) -- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L227) +- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L111) +- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L127) +- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L146) +- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L166) +- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L187) +- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L205) -### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) +### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) -- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) +- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) +- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) -### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) +### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) -- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) +- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) +- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L53) +- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L80) -### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L34) +### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) -- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L41) - -### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L28) - -- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L36) -- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L52) - -### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) - -- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) - -### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) - -- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L40) -- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L48) -- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L60) -- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L68) -- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L80) -- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L88) -- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L100) - -### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) - -- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) -- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) -- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) - -### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L32) - -- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L48) -- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L70) -- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L100) - -### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L30) - -- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L40) -- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L92) - -### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) - -- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) -- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L65) - -### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L31) - -- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L39) - -### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L31) - -- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L42) - -### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L28) - -- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L35) +- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) +- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) +- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) +- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) +- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) +- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) ### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) @@ -298,22 +898,11 @@ Do not try to edit it manually. - [should not appear references to secret updates not used in ingress rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L40) - [should return the fake SSL certificate if the secret is invalid](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L82) -### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L58) +### [[Status] status update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L38) -- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L61) -- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L94) -- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L128) -- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L152) -- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L183) -- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L216) -- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L247) -- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L310) +- [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L43) -### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) +### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L37) -- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) - -### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L33) - -- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) -- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L54) +- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L40) +- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L98) \ No newline at end of file From bbc8bd4bcebd43faeb2ad009babe307590e06dcf Mon Sep 17 00:00:00 2001 From: lou-lan Date: Tue, 14 Feb 2023 17:37:30 +0800 Subject: [PATCH 037/822] Fix incorrect annotation name in upstream hashing configuration (#9617) --- docs/user-guide/nginx-configuration/annotations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index 8cc6f4c16..9c79d9d9c 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -239,7 +239,7 @@ To enable consistent hashing for a backend: `nginx.ingress.kubernetes.io/upstream-hash-by`: the nginx variable, text value or any combination thereof to use for consistent hashing. For example: `nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri"` or `nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri$host"` or `nginx.ingress.kubernetes.io/upstream-hash-by: "${request_uri}-text-value"` to consistently hash upstream requests by the current request URI. -"subset" hashing can be enabled setting `nginx.ingress.kubernetes.io/upstream-hash-by-subset`: "true". This maps requests to subset of nodes instead of a single one. `upstream-hash-by-subset-size` determines the size of each subset (default 3). +"subset" hashing can be enabled setting `nginx.ingress.kubernetes.io/upstream-hash-by-subset`: "true". This maps requests to subset of nodes instead of a single one. `nginx.ingress.kubernetes.io/upstream-hash-by-subset-size` determines the size of each subset (default 3). Please check the [chashsubset](../../examples/chashsubset/deployment.yaml) example. From 5e85747db71578d3ac828923b72d38f7d7f7027b Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 14 Feb 2023 21:33:52 +0100 Subject: [PATCH 038/822] remove tests and regex path checks (#9626) Signed-off-by: James Strong --- go.mod | 1 - go.sum | 2 - internal/ingress/controller/store/store.go | 5 - pkg/util/ingress/ingress.go | 25 ---- pkg/util/ingress/ingress_test.go | 85 ------------- test/e2e/security/invalid_paths.go | 134 --------------------- 6 files changed, 252 deletions(-) delete mode 100644 test/e2e/security/invalid_paths.go diff --git a/go.mod b/go.mod index 1aad274fb..10b9e2fda 100644 --- a/go.mod +++ b/go.mod @@ -77,7 +77,6 @@ require ( github.com/inconshreveable/mousetrap v1.0.1 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect - github.com/magefile/mage v1.14.0 // indirect github.com/mailru/easyjson v0.7.6 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect diff --git a/go.sum b/go.sum index 1d99238cb..6e370c655 100644 --- a/go.sum +++ b/go.sum @@ -235,8 +235,6 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= -github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= -github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index 13af28137..b5731c4bf 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -59,7 +59,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/k8s" "k8s.io/ingress-nginx/pkg/apis/ingress" - ingressutils "k8s.io/ingress-nginx/pkg/util/ingress" ) // IngressFilterFunc decides if an Ingress should be omitted or not @@ -865,10 +864,6 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) { if path.Path == "" { copyIng.Spec.Rules[ri].HTTP.Paths[pi].Path = "/" } - if !ingressutils.IsSafePath(copyIng, path.Path) { - klog.Warningf("ingress %s contains invalid path %s", key, path.Path) - return - } } } diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index 5fb3ee7b9..7df2cc114 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -18,30 +18,15 @@ package ingress import ( "fmt" - "regexp" "strings" - networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/util/sets" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/k8s" "k8s.io/ingress-nginx/internal/net/ssl" "k8s.io/ingress-nginx/pkg/apis/ingress" "k8s.io/klog/v2" ) -const ( - alphaNumericChars = `\-\.\_\~a-zA-Z0-9/` - regexEnabledChars = `\^\$\[\]\(\)\{\}\*\+` -) - -var ( - // pathAlphaNumeric is a regex validation of something like "^/[a-zA-Z]+$" on path - pathAlphaNumeric = regexp.MustCompile("^/[" + alphaNumericChars + "]*$").MatchString - // pathRegexEnabled is a regex validation of paths that may contain regex. - pathRegexEnabled = regexp.MustCompile("^/[" + alphaNumericChars + regexEnabledChars + "]*$").MatchString -) - func GetRemovedHosts(rucfg, newcfg *ingress.Configuration) []string { oldSet := sets.NewString() newSet := sets.NewString() @@ -246,13 +231,3 @@ func BuildRedirects(servers []*ingress.Server) []*redirect { return redirectServers } - -// IsSafePath verifies if the path used in ingress object contains only valid characters. -// It will behave differently if regex is enabled or not -func IsSafePath(copyIng *networkingv1.Ingress, path string) bool { - isRegex, _ := parser.GetBoolAnnotation("use-regex", copyIng) - if isRegex { - return pathRegexEnabled(path) - } - return pathAlphaNumeric(path) -} diff --git a/pkg/util/ingress/ingress_test.go b/pkg/util/ingress/ingress_test.go index d829a57f1..24597fb6e 100644 --- a/pkg/util/ingress/ingress_test.go +++ b/pkg/util/ingress/ingress_test.go @@ -17,13 +17,8 @@ limitations under the License. package ingress import ( - "fmt" "testing" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - - networkingv1 "k8s.io/api/networking/v1" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/pkg/apis/ingress" ) @@ -135,83 +130,3 @@ func TestIsDynamicConfigurationEnough(t *testing.T) { t.Errorf("Expected new config to not change") } } - -func generateDumbIngressforPathTest(regexEnabled bool) *networkingv1.Ingress { - var annotations = make(map[string]string) - regexAnnotation := fmt.Sprintf("%s/use-regex", parser.AnnotationsPrefix) - if regexEnabled { - annotations[regexAnnotation] = "true" - } - return &networkingv1.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "dumb", - Namespace: "default", - Annotations: annotations, - }, - } -} - -func TestIsSafePath(t *testing.T) { - tests := []struct { - name string - copyIng *networkingv1.Ingress - path string - want bool - }{ - { - name: "should accept valid path with regex disabled", - want: true, - copyIng: generateDumbIngressforPathTest(false), - path: "/xpto/~user/t-e_st.exe", - }, - { - name: "should accept valid path / with regex disabled", - want: true, - copyIng: generateDumbIngressforPathTest(false), - path: "/", - }, - { - name: "should reject invalid path with invalid chars", - want: false, - copyIng: generateDumbIngressforPathTest(false), - path: "/foo/bar/;xpto", - }, - { - name: "should reject regex path when regex is disabled", - want: false, - copyIng: generateDumbIngressforPathTest(false), - path: "/foo/bar/(.+)", - }, - { - name: "should accept valid path / with regex enabled", - want: true, - copyIng: generateDumbIngressforPathTest(true), - path: "/", - }, - { - name: "should accept regex path when regex is enabled", - want: true, - copyIng: generateDumbIngressforPathTest(true), - path: "/foo/bar/(.+)", - }, - { - name: "should reject regex path when regex is enabled but the path is invalid", - want: false, - copyIng: generateDumbIngressforPathTest(true), - path: "/foo/bar/;xpto", - }, - { - name: "should reject regex path when regex is enabled but the path is invalid", - want: false, - copyIng: generateDumbIngressforPathTest(true), - path: ";xpto", - }, - } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if got := IsSafePath(tt.copyIng, tt.path); got != tt.want { - t.Errorf("IsSafePath() = %v, want %v", got, tt.want) - } - }) - } -} diff --git a/test/e2e/security/invalid_paths.go b/test/e2e/security/invalid_paths.go deleted file mode 100644 index d75aefc2c..000000000 --- a/test/e2e/security/invalid_paths.go +++ /dev/null @@ -1,134 +0,0 @@ -/* -Copyright 2022 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package security - -import ( - "fmt" - "net/http" - "strings" - - "github.com/onsi/ginkgo/v2" - - "k8s.io/ingress-nginx/test/e2e/framework" -) - -const ( - validPath = "/xpto/~user/t-e_st.exe" - invalidPath = "/foo/bar/;xpto" - regexPath = "/foo/bar/(.+)" - host = "securitytest.com" -) - -var ( - annotationRegex = map[string]string{ - "nginx.ingress.kubernetes.io/use-regex": "true", - } -) - -var _ = framework.IngressNginxDescribe("[Security] validate path fields", func() { - f := framework.NewDefaultFramework("validate-path") - - ginkgo.BeforeEach(func() { - f.NewEchoDeployment() - }) - - ginkgo.It("should accept an ingress with valid path", func() { - - ing := framework.NewSingleIngress(host, validPath, host, f.Namespace, framework.EchoService, 80, nil) - - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) - }) - - f.HTTPTestClient(). - GET(validPath). - WithHeader("Host", host). - Expect(). - Status(http.StatusOK) - }) - - ginkgo.It("should drop an ingress with invalid path", func() { - - ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, nil) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) - }) - - f.HTTPTestClient(). - GET(invalidPath). - WithHeader("Host", host). - Expect(). - Status(http.StatusNotFound) - }) - - ginkgo.It("should drop an ingress with regex path and regex disabled", func() { - - ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, nil) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) - }) - - f.HTTPTestClient(). - GET("/foo/bar/lalala"). - WithHeader("Host", host). - Expect(). - Status(http.StatusNotFound) - }) - - ginkgo.It("should accept an ingress with regex path and regex enabled", func() { - - ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, annotationRegex) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) - }) - - f.HTTPTestClient(). - GET("/foo/bar/lalala"). - WithHeader("Host", host). - Expect(). - Status(http.StatusOK) - }) - - ginkgo.It("should reject an ingress with invalid path and regex enabled", func() { - - ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, annotationRegex) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) - }) - - f.HTTPTestClient(). - GET(invalidPath). - WithHeader("Host", host). - Expect(). - Status(http.StatusNotFound) - }) -}) From 8afba516e7b14019327dd62da89fcc0c6d094659 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 14 Feb 2023 15:55:09 -0500 Subject: [PATCH 039/822] start 1.6.4 build Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index e37df95ee..9dc820555 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.6.3 +v1.6.4 From 8045cd29fbaaf720dea7586e5b559005250f03c9 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 14 Feb 2023 19:12:18 -0500 Subject: [PATCH 040/822] Release Notes Controller 1.6.4 Helm 4.5.1 Signed-off-by: James Strong --- README.md | 2 +- ...{Changelog-1.6.3.md => Changelog-1.6.4.md} | 14 +- charts/ingress-nginx/Chart.yaml | 6 +- charts/ingress-nginx/README.md | 8 +- ...{Changelog-4.5.0.md => Changelog-4.5.1.md} | 6 +- charts/ingress-nginx/values.yaml | 6 +- deploy/static/provider/aws/deploy.yaml | 42 ++--- .../aws/nlb-with-tls-termination/deploy.yaml | 42 ++--- deploy/static/provider/baremetal/deploy.yaml | 42 ++--- deploy/static/provider/cloud/deploy.yaml | 42 ++--- deploy/static/provider/do/deploy.yaml | 42 ++--- deploy/static/provider/exoscale/deploy.yaml | 42 ++--- deploy/static/provider/kind/deploy.yaml | 42 ++--- deploy/static/provider/scw/deploy.yaml | 42 ++--- docs/e2e-tests.md | 148 +++++++++--------- 15 files changed, 259 insertions(+), 267 deletions(-) rename changelog/{Changelog-1.6.3.md => Changelog-1.6.4.md} (93%) rename charts/ingress-nginx/changelog/{Changelog-4.5.0.md => Changelog-4.5.1.md} (82%) diff --git a/README.md b/README.md index 6d3fb7873..855c47418 100644 --- a/README.md +++ b/README.md @@ -38,7 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | |-----------------------|------------------------------|----------------|---------------| -| v1.6.3 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | +| v1.6.4 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | | v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | diff --git a/changelog/Changelog-1.6.3.md b/changelog/Changelog-1.6.4.md similarity index 93% rename from changelog/Changelog-1.6.3.md rename to changelog/Changelog-1.6.4.md index 39fa5bb24..5f940d1c4 100644 --- a/changelog/Changelog-1.6.3.md +++ b/changelog/Changelog-1.6.4.md @@ -1,13 +1,16 @@ # Changelog -### 1.6.3 +### 1.6.4 Images: - * registry.k8s.io/controller:controller-v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 - * registry.k8s.io/controller-chroot:controller-v1.6.3@sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4 + * registry.k8s.io/controller:controller-v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + * registry.k8s.io/controller-chroot:controller-v1.6.4@sha256:0de01e2c316c3ca7847ca13b32d077af7910d07f21a4a82f81061839764f8f81 ### All Changes: +* remove tests and regex path checks (#9626) +* Fix incorrect annotation name in upstream hashing configuration (#9617) +* Release docs for Controller v1.6.3 and Helm v4.5.0 (#9614) * Revert Implement pathType validation (#9511) (#9607) * update history and allow to pass a target test (#9605) * Allow to pass a target test (#9542) @@ -19,7 +22,6 @@ Images: * Add CORS template check inside location for externalAuth.SignURL (#8814) * fix(grafana-dashboard): remove hardcoded namespace references (#9523) * Replace deprecated command with environment file (#9581) -* add path validation to implementation specific as well (#9573) * add lint on chart before release (#9570) * Switch logic on path type validation and setting it to false (#9543) * tcpproxy: increase buffer size to 16K (#9548) @@ -27,7 +29,6 @@ Images: * Add CORS template check inside location for externalAuth.SignURL (#8814) * fix(grafana-dashboard): remove hardcoded namespace references (#9523) * Align default value for keepalive_request with NGINX default (#9518) -* Implement pathType validation (#9511) * feat(configmap): expose gzip-disable (#9505) * Values: Add missing `controller.metrics.service.labels`. (#9501) * Add docs about orphan_ingress metric (#9514) @@ -89,7 +90,6 @@ Images: * remove the configmap related permissions (#9310) * remove hardcoded datasource from grafana dashboard (#9284) * update gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b to 3.0.0 (#9277) -* Validate ingress path fields (#9309) * added SAN to cert create command (#9295) * Missing controller.ingressClass (#9304) * OpenTelemetry static linking (#9286) @@ -133,4 +133,4 @@ Images: * Bump actions/dependency-review-action from 2.5.1 to 3.0.0 (#9301) * Bump k8s.io/component-base from 0.25.3 to 0.25.4 (#9300) -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.6.3 +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.6.4 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index c11859326..89e679d49 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -4,10 +4,10 @@ annotations: - "ci: remove setup-helm step (#9404)" - "feat(helm): Optionally use cert-manager instead admission patch (#9279)" - "run helm release on main only and when the chart/value changes only (#9290)" - - "Update Ingress-Nginx version controller-v1.6.3" + - "Update Ingress-Nginx version controller-v1.6.4" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.6.3 +appVersion: 1.6.4 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -24,4 +24,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.5.0 +version: 4.5.1 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index cb454b535..6c5437a26 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.5.0](https://img.shields.io/badge/Version-4.5.0-informational?style=flat-square) ![AppVersion: 1.6.3](https://img.shields.io/badge/AppVersion-1.6.3-informational?style=flat-square) +![Version: 4.5.1](https://img.shields.io/badge/Version-4.5.1-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -333,13 +333,13 @@ Kubernetes: `>=1.20.0-0` | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2"` | | -| controller.image.digestChroot | string | `"sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4"` | | +| controller.image.digest | string | `"sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f"` | | +| controller.image.digestChroot | string | `"sha256:0de01e2c316c3ca7847ca13b32d077af7910d07f21a4a82f81061839764f8f81"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.6.3"` | | +| controller.image.tag | string | `"v1.6.4"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.5.0.md b/charts/ingress-nginx/changelog/Changelog-4.5.1.md similarity index 82% rename from charts/ingress-nginx/changelog/Changelog-4.5.0.md rename to charts/ingress-nginx/changelog/Changelog-4.5.1.md index ba4b52cbc..ebe78f49c 100644 --- a/charts/ingress-nginx/changelog/Changelog-4.5.0.md +++ b/charts/ingress-nginx/changelog/Changelog-4.5.1.md @@ -2,12 +2,12 @@ This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). -### 4.5.0 +### 4.5.1 * add lint on chart before release (#9570) * ci: remove setup-helm step (#9404) * feat(helm): Optionally use cert-manager instead admission patch (#9279) * run helm release on main only and when the chart/value changes only (#9290) -* Update Ingress-Nginx version controller-v1.6.3 +* Update Ingress-Nginx version controller-v1.6.4 -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.0 +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.1 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 34e1cf6ef..202cd4a23 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -23,9 +23,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.6.3" - digest: sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 - digestChroot: sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4 + tag: "v1.6.4" + digest: sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + digestChroot: sha256:0de01e2c316c3ca7847ca13b32d077af7910d07f21a4a82f81061839764f8f81 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index c79412536..487340a73 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -608,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index fae1c5d61..4763623c8 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -449,7 +449,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 245978140..a642d67da 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -434,7 +434,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -506,7 +506,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -517,7 +517,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -553,7 +553,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -564,7 +564,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -602,7 +602,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -615,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 9bc28ec80..8b09efac1 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -436,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -508,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -519,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -555,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -566,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -604,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -617,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index b17da8a07..7461d9794 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -439,7 +439,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -511,7 +511,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -522,7 +522,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -558,7 +558,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -569,7 +569,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -607,7 +607,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index d93497323..be0e2f587 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index 8c9e96891..abb310999 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -522,7 +522,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -533,7 +533,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -569,7 +569,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -580,7 +580,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -618,7 +618,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -631,7 +631,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index edd00a98d..fdc3c6cde 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -439,7 +439,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2 + image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -511,7 +511,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -522,7 +522,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-create spec: containers: @@ -558,7 +558,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -569,7 +569,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission-patch spec: containers: @@ -607,7 +607,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: nginx spec: controller: k8s.io/ingress-nginx @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.3 + app.kubernetes.io/version: 1.6.4 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 5c67b47aa..9f66e3991 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -21,6 +21,21 @@ Do not try to edit it manually. - [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L201) - [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L212) +### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) + +- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) +- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) +- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) +- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) +- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) +- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) +- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) +- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) +- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) +- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) +- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) +- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) + ### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L31) - [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L34) @@ -194,21 +209,6 @@ Do not try to edit it manually. - [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) - [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) -### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) - -- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) -- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) -- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) -- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) -- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) -- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) -- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) -- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) -- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) -- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) -- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) -- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) - ### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) - [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) @@ -285,11 +285,6 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) - -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) - ### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) - [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) @@ -308,6 +303,14 @@ Do not try to edit it manually. - [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) - [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) + +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) + ### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) - [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) @@ -344,13 +347,10 @@ Do not try to edit it manually. - [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) - [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) -### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) -- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) -- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) -- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) -- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) -- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) @@ -376,26 +376,22 @@ Do not try to edit it manually. - [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) -### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) - -- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) - -### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L36) - -- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L50) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) @@ -409,10 +405,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) @@ -465,10 +457,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) @@ -477,14 +465,14 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) @@ -558,24 +546,10 @@ Do not try to edit it manually. - [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L125) - [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L171) -### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) - -- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) -- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) -- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) - ### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) - [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) -### [[Security] validate path fields](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L42) - -- [should accept an ingress with valid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L49) -- [should drop an ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L67) -- [should drop an ingress with regex path and regex disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L84) -- [should accept an ingress with regex path and regex enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L101) -- [should reject an ingress with invalid path and regex enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/invalid_paths.go#L118) - ### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L33) - [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) @@ -596,6 +570,14 @@ Do not try to edit it manually. - [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) +### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) + +- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) + +### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) + +- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) + ### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) - [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L32) @@ -748,10 +730,6 @@ Do not try to edit it manually. - [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) -### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) - -- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) - ### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) - [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L31) @@ -772,10 +750,6 @@ Do not try to edit it manually. - [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) -### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) - -- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) - ### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L48) - [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L58) @@ -869,11 +843,6 @@ Do not try to edit it manually. - [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L187) - [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L205) -### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) - -- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) -- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) - ### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) - [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) @@ -889,6 +858,11 @@ Do not try to edit it manually. - [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) - [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) +### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) + +- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) +- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) + ### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) - [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) @@ -905,4 +879,22 @@ Do not try to edit it manually. ### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L37) - [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L40) -- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L98) \ No newline at end of file +- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L98) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) + +- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) + +### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L36) + +- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L50) + +### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) + +- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) +- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) +- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) \ No newline at end of file From 864316955fce19b7c5397680d91da313b097fc9b Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 14 Feb 2023 20:22:36 -0500 Subject: [PATCH 041/822] Release new Helm Chart Signed-off-by: James Strong --- charts/ingress-nginx/Chart.yaml | 2 +- charts/ingress-nginx/README.md | 2 +- .../changelog/{Changelog-4.5.1.md => Changelog-4.5.2.md} | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) rename charts/ingress-nginx/changelog/{Changelog-4.5.1.md => Changelog-4.5.2.md} (91%) diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 89e679d49..21779e195 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -24,4 +24,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.5.1 +version: 4.5.2 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 6c5437a26..49bb38273 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.5.1](https://img.shields.io/badge/Version-4.5.1-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square) +![Version: 4.5.2](https://img.shields.io/badge/Version-4.5.2-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. diff --git a/charts/ingress-nginx/changelog/Changelog-4.5.1.md b/charts/ingress-nginx/changelog/Changelog-4.5.2.md similarity index 91% rename from charts/ingress-nginx/changelog/Changelog-4.5.1.md rename to charts/ingress-nginx/changelog/Changelog-4.5.2.md index ebe78f49c..b6d8a3b0c 100644 --- a/charts/ingress-nginx/changelog/Changelog-4.5.1.md +++ b/charts/ingress-nginx/changelog/Changelog-4.5.2.md @@ -2,7 +2,7 @@ This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). -### 4.5.1 +### 4.5.2 * add lint on chart before release (#9570) * ci: remove setup-helm step (#9404) @@ -10,4 +10,4 @@ This file documents all notable changes to [ingress-nginx](https://github.com/ku * run helm release on main only and when the chart/value changes only (#9290) * Update Ingress-Nginx version controller-v1.6.4 -**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.1 +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.2 From de793dfeea03bd2db064b1f4c9b63e768a961172 Mon Sep 17 00:00:00 2001 From: Igor Milavec Date: Wed, 15 Feb 2023 14:50:24 +0100 Subject: [PATCH 042/822] Fix rewrite example (#9633) --- docs/examples/rewrite/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/examples/rewrite/README.md b/docs/examples/rewrite/README.md index c529c34ef..5b42e1fc7 100644 --- a/docs/examples/rewrite/README.md +++ b/docs/examples/rewrite/README.md @@ -38,6 +38,7 @@ apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: + nginx.ingress.kubernetes.io/use-regex: "true" nginx.ingress.kubernetes.io/rewrite-target: /$2 name: rewrite namespace: default From 9a79b059ca99380ff463f7ff589e8b4f01b19d75 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Feb 2023 05:52:25 -0800 Subject: [PATCH 043/822] Bump golang.org/x/crypto from 0.5.0 to 0.6.0 (#9609) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.5.0 to 0.6.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](https://github.com/golang/crypto/compare/v0.5.0...v0.6.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 10b9e2fda..0aa7e6880 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.1 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.5.0 + golang.org/x/crypto v0.6.0 google.golang.org/grpc v1.52.3 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -99,11 +99,11 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.7.0 // indirect - golang.org/x/net v0.5.0 // indirect + golang.org/x/net v0.6.0 // indirect golang.org/x/oauth2 v0.3.0 // indirect - golang.org/x/sys v0.4.0 // indirect - golang.org/x/term v0.4.0 // indirect - golang.org/x/text v0.6.0 // indirect + golang.org/x/sys v0.5.0 // indirect + golang.org/x/term v0.5.0 // indirect + golang.org/x/text v0.7.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index 6e370c655..47777a30d 100644 --- a/go.sum +++ b/go.sum @@ -403,8 +403,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE= -golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU= +golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= +golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -471,8 +471,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.5.0 h1:GyT4nK/YDHSqa1c4753ouYCDajOYKTja9Xb/OHtgvSw= -golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= +golang.org/x/net v0.6.0 h1:L4ZwwTvKW9gr0ZMS1yrHD9GZhIuVjOBBnaKH+SPQK0Q= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -542,19 +542,19 @@ golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.4.0 h1:Zr2JFtRQNX3BCZ8YtxRE9hNJYC8J6I1MVbMg6owUp18= -golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.4.0 h1:O7UWfv5+A2qiuulQk30kVinPoMtoIPeVaKLEgLpVkvg= -golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ= +golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.6.0 h1:3XmdazWV+ubf7QgHSTWeykHOci5oeekaGJBLkrkaw4k= -golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From 15ecd2531fdcb722c8c477f0b51b86ab9213723f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Feb 2023 05:54:24 -0800 Subject: [PATCH 044/822] Bump github.com/prometheus/client_golang (#9630) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.11.0 to 1.11.1. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.11.0...v1.11.1) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- images/custom-error-pages/rootfs/go.mod | 2 +- images/custom-error-pages/rootfs/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/images/custom-error-pages/rootfs/go.mod b/images/custom-error-pages/rootfs/go.mod index b39db8b20..515b72c09 100644 --- a/images/custom-error-pages/rootfs/go.mod +++ b/images/custom-error-pages/rootfs/go.mod @@ -2,7 +2,7 @@ module k8s.io/ingress-nginx/custom-error-pages go 1.19 -require github.com/prometheus/client_golang v1.11.0 +require github.com/prometheus/client_golang v1.11.1 require ( github.com/beorn7/perks v1.0.1 // indirect diff --git a/images/custom-error-pages/rootfs/go.sum b/images/custom-error-pages/rootfs/go.sum index 87cd96b26..d071619b7 100644 --- a/images/custom-error-pages/rootfs/go.sum +++ b/images/custom-error-pages/rootfs/go.sum @@ -66,8 +66,8 @@ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZN github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= -github.com/prometheus/client_golang v1.11.0 h1:HNkLOAEQMIDv/K+04rukrLx6ch7msSRwf3/SASFAGtQ= -github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= +github.com/prometheus/client_golang v1.11.1 h1:+4eQaD7vAZ6DsfsxB15hbE0odUjGI5ARs9yskGu1v4s= +github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M= From 00086ab429d99e3888bc2adf70178d2da66d2f57 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Feb 2023 07:06:25 -0800 Subject: [PATCH 045/822] Bump google.golang.org/grpc from 1.52.3 to 1.53.0 (#9610) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.52.3 to 1.53.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.52.3...v1.53.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 0aa7e6880..d942c1637 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.6.0 - google.golang.org/grpc v1.52.3 + google.golang.org/grpc v1.53.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 @@ -48,7 +48,7 @@ require ( github.com/BurntSushi/toml v1.0.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect - github.com/cespare/xxhash/v2 v2.1.2 // indirect + github.com/cespare/xxhash/v2 v2.2.0 // indirect github.com/coreos/go-systemd/v22 v22.3.2 // indirect github.com/cyphar/filepath-securejoin v0.2.3 // indirect github.com/davecgh/go-spew v1.1.1 // indirect @@ -100,14 +100,14 @@ require ( go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.7.0 // indirect golang.org/x/net v0.6.0 // indirect - golang.org/x/oauth2 v0.3.0 // indirect + golang.org/x/oauth2 v0.4.0 // indirect golang.org/x/sys v0.5.0 // indirect golang.org/x/term v0.5.0 // indirect golang.org/x/text v0.7.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 // indirect + google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect google.golang.org/protobuf v1.28.1 // indirect gopkg.in/go-playground/assert.v1 v1.2.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 47777a30d..b1f6269a6 100644 --- a/go.sum +++ b/go.sum @@ -50,8 +50,8 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cespare/xxhash/v2 v2.1.2 h1:YRXhKfTDauu4ajMg1TPgFO5jnlC2HCbmLXMcTG5cbYE= -github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= +github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= @@ -479,8 +479,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.3.0 h1:6l90koy8/LaBLmLu8jpHeHexzMwEita0zFfYlggy2F8= -golang.org/x/oauth2 v0.3.0/go.mod h1:rQrIauxkUhJ6CuwEXwymO2/eh4xz2ZWF1nBkcxS+tGk= +golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M= +golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -665,8 +665,8 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6 h1:a2S6M0+660BgMNl++4JPlcAO/CjkqYItDEZwkoDQK7c= -google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg= +google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f h1:BWUVssLB0HVOSY78gIdvk1dTVYtT1y8SBWtPYuTJ/6w= +google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -679,8 +679,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ= -google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY= +google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc= +google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From fbdbc24a423a1afa195d5770529fbd873ef68e66 Mon Sep 17 00:00:00 2001 From: Fish-pro Date: Thu, 16 Feb 2023 21:59:39 +0800 Subject: [PATCH 046/822] Optimize the judgment mode to remove redundant transformations (#9588) Signed-off-by: Fish-pro --- internal/ingress/inspector/inspector.go | 6 +++--- internal/nginx/maxmind.go | 2 +- pkg/apis/ingress/types_equals.go | 6 +----- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/internal/ingress/inspector/inspector.go b/internal/ingress/inspector/inspector.go index 98f257997..e7b6c2f10 100644 --- a/internal/ingress/inspector/inspector.go +++ b/internal/ingress/inspector/inspector.go @@ -26,11 +26,11 @@ import ( // if an object contains invalid configurations that may represent a security risk, // and returning an error in this case func DeepInspect(obj interface{}) error { - switch obj.(type) { + switch obj := obj.(type) { case *networking.Ingress: - return InspectIngress(obj.(*networking.Ingress)) + return InspectIngress(obj) case *corev1.Service: - return InspectService(obj.(*corev1.Service)) + return InspectService(obj) default: klog.Warningf("received invalid object to inspect: %T", obj) return nil diff --git a/internal/nginx/maxmind.go b/internal/nginx/maxmind.go index df9fd2231..5aee414cd 100644 --- a/internal/nginx/maxmind.go +++ b/internal/nginx/maxmind.go @@ -165,7 +165,7 @@ func downloadDatabase(dbName string) error { mmdbFile := dbName + dbExtension tarReader := tar.NewReader(archive) - for true { + for { header, err := tarReader.Next() if err == io.EOF { break diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index 0941e0956..2485f8a7b 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -76,11 +76,7 @@ func (c1 *Configuration) Equal(c2 *Configuration) bool { } } - if c1.BackendConfigChecksum != c2.BackendConfigChecksum { - return false - } - - return true + return c1.BackendConfigChecksum == c2.BackendConfigChecksum } // Equal tests for equality between two Backend types From 1cdd61fb9496b39dc7892ca3f3670784cb58ec58 Mon Sep 17 00:00:00 2001 From: Fish-pro Date: Thu, 16 Feb 2023 22:05:40 +0800 Subject: [PATCH 047/822] Adjust the import package order and use http library variables (#9587) Signed-off-by: Fish-pro --- internal/ingress/controller/checker_test.go | 2 +- internal/ingress/controller/nginx_test.go | 4 ++-- internal/ingress/status/status.go | 2 +- test/e2e/framework/healthz.go | 2 +- test/e2e/framework/metrics.go | 2 +- test/e2e/status/update.go | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/internal/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go index 5d9fb1baf..a0d2baafa 100644 --- a/internal/ingress/controller/checker_test.go +++ b/internal/ingress/controller/checker_test.go @@ -122,7 +122,7 @@ func TestNginxCheck(t *testing.T) { } func callHealthz(expErr bool, healthzPath string, mux *http.ServeMux) error { - req, err := http.NewRequest("GET", healthzPath, nil) + req, err := http.NewRequest(http.MethodGet, healthzPath, nil) if err != nil { return fmt.Errorf("healthz error: %v", err) } diff --git a/internal/ingress/controller/nginx_test.go b/internal/ingress/controller/nginx_test.go index 4d3155194..56eb0f324 100644 --- a/internal/ingress/controller/nginx_test.go +++ b/internal/ingress/controller/nginx_test.go @@ -62,7 +62,7 @@ func TestConfigureDynamically(t *testing.T) { Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) - if r.Method != "POST" { + if r.Method != http.MethodPost { t.Errorf("expected a 'POST' request, got '%s'", r.Method) } @@ -222,7 +222,7 @@ func TestConfigureCertificates(t *testing.T) { Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) - if r.Method != "POST" { + if r.Method != http.MethodPost { t.Errorf("expected a 'POST' request, got '%s'", r.Method) } diff --git a/internal/ingress/status/status.go b/internal/ingress/status/status.go index eac1f6cb0..a7506705c 100644 --- a/internal/ingress/status/status.go +++ b/internal/ingress/status/status.go @@ -19,7 +19,6 @@ package status import ( "context" "fmt" - v1 "k8s.io/api/networking/v1" "net" "regexp" "sort" @@ -30,6 +29,7 @@ import ( pool "gopkg.in/go-playground/pool.v3" apiv1 "k8s.io/api/core/v1" + v1 "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/labels" "k8s.io/apimachinery/pkg/util/wait" diff --git a/test/e2e/framework/healthz.go b/test/e2e/framework/healthz.go index bef093355..b52c3ffde 100644 --- a/test/e2e/framework/healthz.go +++ b/test/e2e/framework/healthz.go @@ -26,7 +26,7 @@ func (f *Framework) VerifyHealthz(ip string, statusCode int) error { url := fmt.Sprintf("http://%v:10254/healthz", ip) client := &http.Client{} - req, err := http.NewRequest("GET", url, nil) + req, err := http.NewRequest(http.MethodGet, url, nil) if err != nil { return fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } diff --git a/test/e2e/framework/metrics.go b/test/e2e/framework/metrics.go index 349eb4dc3..830237540 100644 --- a/test/e2e/framework/metrics.go +++ b/test/e2e/framework/metrics.go @@ -29,7 +29,7 @@ func (f *Framework) GetMetric(metricName, ip string) (*dto.MetricFamily, error) url := fmt.Sprintf("http://%v:10254/metrics", ip) client := &http.Client{} - req, err := http.NewRequest("GET", url, nil) + req, err := http.NewRequest(http.MethodGet, url, nil) if err != nil { return nil, fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } diff --git a/test/e2e/status/update.go b/test/e2e/status/update.go index 8bedc4d4e..5c6ea4977 100644 --- a/test/e2e/status/update.go +++ b/test/e2e/status/update.go @@ -19,7 +19,6 @@ package settings import ( "context" "fmt" - v1 "k8s.io/api/networking/v1" "log" "net" "strings" @@ -29,6 +28,7 @@ import ( "github.com/stretchr/testify/assert" appsv1 "k8s.io/api/apps/v1" + v1 "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/wait" From ac8dd3dd53344b948b291530a71bcbffef9ca5d4 Mon Sep 17 00:00:00 2001 From: Fish-pro Date: Thu, 16 Feb 2023 22:05:48 +0800 Subject: [PATCH 048/822] sets.String is deprecated: use generic Set instead. new ways: s1 := Set[string]{} s2 := New[string]() (#9589) Signed-off-by: Fish-pro --- internal/ingress/controller/controller.go | 4 ++-- internal/ingress/controller/store/objectref.go | 8 ++++---- internal/ingress/controller/template/template.go | 10 +++++----- internal/ingress/metric/collectors/socket.go | 4 ++-- internal/ingress/metric/collectors/socket_test.go | 2 +- internal/ingress/metric/dummy.go | 2 +- internal/ingress/metric/main.go | 4 ++-- pkg/util/ingress/ingress.go | 2 +- 8 files changed, 18 insertions(+), 18 deletions(-) diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index dab507cdf..a77d2ff37 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -541,11 +541,11 @@ func (n *NGINXController) getDefaultUpstream() *ingress.Backend { } // getConfiguration returns the configuration matching the standard kubernetes ingress -func (n *NGINXController) getConfiguration(ingresses []*ingress.Ingress) (sets.String, []*ingress.Server, *ingress.Configuration) { +func (n *NGINXController) getConfiguration(ingresses []*ingress.Ingress) (sets.Set[string], []*ingress.Server, *ingress.Configuration) { upstreams, servers := n.getBackendServers(ingresses) var passUpstreams []*ingress.SSLPassthroughBackend - hosts := sets.NewString() + hosts := sets.New[string]() for _, server := range servers { // If a location is defined by a prefix string that ends with the slash character, and requests are processed by one of diff --git a/internal/ingress/controller/store/objectref.go b/internal/ingress/controller/store/objectref.go index 9ef13bf07..89ea47251 100644 --- a/internal/ingress/controller/store/objectref.go +++ b/internal/ingress/controller/store/objectref.go @@ -37,13 +37,13 @@ type ObjectRefMap interface { type objectRefMap struct { sync.Mutex - v map[string]sets.String + v map[string]sets.Set[string] } // NewObjectRefMap returns a new ObjectRefMap. func NewObjectRefMap() ObjectRefMap { return &objectRefMap{ - v: make(map[string]sets.String), + v: make(map[string]sets.Set[string]), } } @@ -54,7 +54,7 @@ func (o *objectRefMap) Insert(consumer string, ref ...string) { for _, r := range ref { if _, ok := o.v[r]; !ok { - o.v[r] = sets.NewString(consumer) + o.v[r] = sets.New[string](consumer) continue } o.v[r].Insert(consumer) @@ -112,7 +112,7 @@ func (o *objectRefMap) Reference(ref string) []string { if !ok { return make([]string, 0) } - return consumers.List() + return consumers.UnsortedList() } // ReferencedBy returns all objects referenced by the given object. diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 315262150..ea9807bd0 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -792,7 +792,7 @@ rewrite "(?i)%s" %s break; func filterRateLimits(input interface{}) []ratelimit.Config { ratelimits := []ratelimit.Config{} - found := sets.String{} + found := sets.Set[string]{} servers, ok := input.([]*ingress.Server) if !ok { @@ -815,12 +815,12 @@ func filterRateLimits(input interface{}) []ratelimit.Config { // for connection limit by IP address, one for limiting requests per minute, and // one for limiting requests per second. func buildRateLimitZones(input interface{}) []string { - zones := sets.String{} + zones := sets.Set[string]{} servers, ok := input.([]*ingress.Server) if !ok { klog.Errorf("expected a '[]*ingress.Server' type but %T was returned", input) - return zones.List() + return zones.UnsortedList() } for _, server := range servers { @@ -859,7 +859,7 @@ func buildRateLimitZones(input interface{}) []string { } } - return zones.List() + return zones.UnsortedList() } // buildRateLimit produces an array of limit_req to be used inside the Path of @@ -1654,7 +1654,7 @@ func buildModSecurityForLocation(cfg config.Configuration, location *ingress.Loc func buildMirrorLocations(locs []*ingress.Location) string { var buffer bytes.Buffer - mapped := sets.String{} + mapped := sets.Set[string]{} for _, loc := range locs { if loc.Mirror.Source == "" || loc.Mirror.Target == "" { diff --git a/internal/ingress/metric/collectors/socket.go b/internal/ingress/metric/collectors/socket.go index 9c0376cd3..23048d5d6 100644 --- a/internal/ingress/metric/collectors/socket.go +++ b/internal/ingress/metric/collectors/socket.go @@ -80,7 +80,7 @@ type SocketCollector struct { metricMapping map[string]interface{} - hosts sets.String + hosts sets.Set[string] metricsPerHost bool reportStatusClasses bool @@ -505,7 +505,7 @@ func (sc SocketCollector) Collect(ch chan<- prometheus.Metric) { // SetHosts sets the hostnames that are being served by the ingress controller // This set of hostnames is used to filter the metrics to be exposed -func (sc *SocketCollector) SetHosts(hosts sets.String) { +func (sc *SocketCollector) SetHosts(hosts sets.Set[string]) { sc.hosts = hosts } diff --git a/internal/ingress/metric/collectors/socket_test.go b/internal/ingress/metric/collectors/socket_test.go index f175828cc..4bebc7600 100644 --- a/internal/ingress/metric/collectors/socket_test.go +++ b/internal/ingress/metric/collectors/socket_test.go @@ -485,7 +485,7 @@ func TestCollector(t *testing.T) { t.Errorf("registering collector failed: %s", err) } - sc.SetHosts(sets.NewString("testshop.com")) + sc.SetHosts(sets.New[string]("testshop.com")) for _, d := range c.data { sc.handleMessage([]byte(d)) diff --git a/internal/ingress/metric/dummy.go b/internal/ingress/metric/dummy.go index e34b5ecbd..d8ae0155a 100644 --- a/internal/ingress/metric/dummy.go +++ b/internal/ingress/metric/dummy.go @@ -69,7 +69,7 @@ func (dc DummyCollector) SetSSLInfo([]*ingress.Server) {} func (dc DummyCollector) SetSSLExpireTime([]*ingress.Server) {} // SetHosts ... -func (dc DummyCollector) SetHosts(hosts sets.String) {} +func (dc DummyCollector) SetHosts(hosts sets.Set[string]) {} // OnStartedLeading indicates the pod is not the current leader func (dc DummyCollector) OnStartedLeading(electionID string) {} diff --git a/internal/ingress/metric/main.go b/internal/ingress/metric/main.go index 892c8e8db..cac86e889 100644 --- a/internal/ingress/metric/main.go +++ b/internal/ingress/metric/main.go @@ -52,7 +52,7 @@ type Collector interface { SetSSLInfo(servers []*ingress.Server) // SetHosts sets the hostnames that are being served by the ingress controller - SetHosts(sets.String) + SetHosts(set sets.Set[string]) Start(string) Stop(string) @@ -191,7 +191,7 @@ func (c *collector) DecOrphanIngress(namespace string, name string, orphanityTyp c.ingressController.DecOrphanIngress(namespace, name, orphanityType) } -func (c *collector) SetHosts(hosts sets.String) { +func (c *collector) SetHosts(hosts sets.Set[string]) { c.socket.SetHosts(hosts) } diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index 7df2cc114..39ca3f883 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -177,7 +177,7 @@ type redirect struct { // BuildRedirects build the redirects of servers based on configurations and certificates func BuildRedirects(servers []*ingress.Server) []*redirect { - names := sets.String{} + names := sets.Set[string]{} redirectServers := make([]*redirect, 0) for _, srv := range servers { From 57398dee16808fb5f7acc378bc7f84a9761348a9 Mon Sep 17 00:00:00 2001 From: Fish-pro Date: Thu, 16 Feb 2023 22:07:39 +0800 Subject: [PATCH 049/822] Optimize the document for readability (#9551) Signed-off-by: Fish-pro --- docs/how-it-works.md | 2 +- docs/user-guide/k8s-122-migration.md | 6 +++--- docs/user-guide/miscellaneous.md | 2 +- docs/user-guide/monitoring.md | 6 +++--- docs/user-guide/multiple-ingress.md | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/how-it-works.md b/docs/how-it-works.md index 4ad824dc8..894a504dc 100644 --- a/docs/how-it-works.md +++ b/docs/how-it-works.md @@ -10,7 +10,7 @@ The goal of this Ingress controller is the assembly of a configuration file (ngi Usually, a Kubernetes Controller utilizes the [synchronization loop pattern][1] to check if the desired state in the controller is updated or a change is required. To this purpose, we need to build a model using different objects from the cluster, in particular (in no special order) Ingresses, Services, Endpoints, Secrets, and Configmaps to generate a point in time configuration file that reflects the state of the cluster. -To get this object from the cluster, we use [Kubernetes Informers][2], in particular, `FilteredSharedInformer`. This informers allows reacting to changes in using [callbacks][3] to individual changes when a new object is added, modified or removed. Unfortunately, there is no way to know if a particular change is going to affect the final configuration file. Therefore on every change, we have to rebuild a new model from scratch based on the state of cluster and compare it to the current model. If the new model equals to the current one, then we avoid generating a new NGINX configuration and triggering a reload. Otherwise, we check if the difference is only about Endpoints. If so we then send the new list of Endpoints to a Lua handler running inside Nginx using HTTP POST request and again avoid generating a new NGINX configuration and triggering a reload. If the difference between running and new model is about more than just Endpoints we create a new NGINX configuration based on the new model, replace the current model and trigger a reload. +To get this object from the cluster, we use [Kubernetes Informers][2], in particular, `FilteredSharedInformer`. These informers allow reacting to change in using [callbacks][3] to individual changes when a new object is added, modified or removed. Unfortunately, there is no way to know if a particular change is going to affect the final configuration file. Therefore on every change, we have to rebuild a new model from scratch based on the state of cluster and compare it to the current model. If the new model equals to the current one, then we avoid generating a new NGINX configuration and triggering a reload. Otherwise, we check if the difference is only about Endpoints. If so we then send the new list of Endpoints to a Lua handler running inside Nginx using HTTP POST request and again avoid generating a new NGINX configuration and triggering a reload. If the difference between running and new model is about more than just Endpoints we create a new NGINX configuration based on the new model, replace the current model and trigger a reload. One of the uses of the model is to avoid unnecessary reloads when there's no change in the state and to detect conflicts in definitions. diff --git a/docs/user-guide/k8s-122-migration.md b/docs/user-guide/k8s-122-migration.md index 34893f931..9a1ca081d 100644 --- a/docs/user-guide/k8s-122-migration.md +++ b/docs/user-guide/k8s-122-migration.md @@ -131,7 +131,7 @@ and add the value `spec.ingressClassName=nginx` in your Ingress objects. ## I have many ingress objects in my cluster. What should I do? -If you have lot of ingress objects without ingressClass configuration, +If you have a lot of ingress objects without ingressClass configuration, you can run the ingress controller with the flag `--watch-ingress-without-class=true`. ### What is the flag `--watch-ingress-without-class`? @@ -187,10 +187,10 @@ Bear in mind that if you start Ingress-Nginx B with the command line argument `- 4. If you start Ingress-Nginx B with the command line argument `--watch-ingress-without-class=true` and you run Ingress-Nginx A with the command line argument `--watch-ingress-without-class=false` then this is a supported configuration. If you have two ingress-nginx controllers for the same cluster, both running with `--watch-ingress-without-class=true` then there is likely to be a conflict. -## Why am I am seeing "ingress class annotation is not equal to the expected by Ingress Controller" in my controller logs? +## Why am I seeing "ingress class annotation is not equal to the expected by Ingress Controller" in my controller logs? It is highly likely that you will also see the name of the ingress resource in the same error message. -This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in a Ingress resource manifest. +This error message has been observed on use the deprecated annotation (`kubernetes.io/ingress.class`) in an Ingress resource manifest. It is recommended to use the `.spec.ingressClassName` field of the Ingress resource, to specify the name of the IngressClass of the Ingress you are defining. ## How can I easily install multiple instances of the ingress-nginx controller in the same cluster? diff --git a/docs/user-guide/miscellaneous.md b/docs/user-guide/miscellaneous.md index 196ea17fc..d9b32d36f 100644 --- a/docs/user-guide/miscellaneous.md +++ b/docs/user-guide/miscellaneous.md @@ -27,7 +27,7 @@ Support for websockets is provided by NGINX out of the box. No special configura The only requirement to avoid the close of connections is the increase of the values of `proxy-read-timeout` and `proxy-send-timeout`. -The default value of this settings is `60 seconds`. +The default value of these settings is `60 seconds`. A more adequate value to support websockets is a value higher than one hour (`3600`). diff --git a/docs/user-guide/monitoring.md b/docs/user-guide/monitoring.md index 807d91afc..281207866 100644 --- a/docs/user-guide/monitoring.md +++ b/docs/user-guide/monitoring.md @@ -170,7 +170,7 @@ According to the above example, this URL will be http://10.192.0.3:31086 - By default request metrics are labeled with the hostname. When you have a wildcard domain ingress, then there will be no metrics for that ingress (to prevent the metrics from exploding in cardinality). To get metrics in this case you need to run the ingress controller with `--metrics-per-host=false` (you will lose labeling by hostname, but still have labeling by ingress). ### Grafana dashboard using ingress resource - - If you want to expose the dashboard for grafana using a ingress resource, then you can : + - If you want to expose the dashboard for grafana using an ingress resource, then you can : - change the service type of the prometheus-server service and the grafana service to "ClusterIP" like this : ``` kubectl -n ingress-nginx edit svc grafana @@ -178,8 +178,8 @@ According to the above example, this URL will be http://10.192.0.3:31086 - This will open the currently deployed service grafana in the default editor configured in your shell (vi/nvim/nano/other) - scroll down to line 34 that looks like "type: NodePort" - change it to look like "type: ClusterIP". Save and exit. - - create a ingress resource with backend as "grafana" and port as "3000" - - Similarly, you can edit the service "prometheus-server" and add a ingress resource. + - create an ingress resource with backend as "grafana" and port as "3000" + - Similarly, you can edit the service "prometheus-server" and add an ingress resource. ## Prometheus and Grafana installation using Service Monitors This document assumes you're using helm and using the kube-prometheus-stack package to install Prometheus and Grafana. diff --git a/docs/user-guide/multiple-ingress.md b/docs/user-guide/multiple-ingress.md index 179041727..6a9457a9c 100644 --- a/docs/user-guide/multiple-ingress.md +++ b/docs/user-guide/multiple-ingress.md @@ -2,7 +2,7 @@ By default, deploying multiple Ingress controllers (e.g., `ingress-nginx` & `gce`) will result in all controllers simultaneously racing to update Ingress status fields in confusing ways. -To fix this problem, use [IngressClasses](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class). The `kubernetes.io/ingress.class` annotation is not being preferred or suggested to use as it can be deprecated in future. Better to use the field `ingress.spec.ingressClassName`. +To fix this problem, use [IngressClasses](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class). The `kubernetes.io/ingress.class` annotation is not being preferred or suggested to use as it can be deprecated in the future. Better to use the field `ingress.spec.ingressClassName`. But, when user has deployed with `scope.enabled`, then the ingress class resource field is not used. From 080c905fabd95fdccbd8deb8efcc108ebd632182 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=A8=E5=88=9A=20=20=28=E6=88=90=E9=83=BD=29?= Date: Thu, 16 Feb 2023 22:11:39 +0800 Subject: [PATCH 050/822] code clean for fsnotify (#9571) Signed-off-by: yanggang --- pkg/util/file/file_watcher.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/util/file/file_watcher.go b/pkg/util/file/file_watcher.go index eeb7b5721..daf955e52 100644 --- a/pkg/util/file/file_watcher.go +++ b/pkg/util/file/file_watcher.go @@ -72,8 +72,8 @@ func (f *OSFileWatcher) watch() error { for { select { case event := <-watcher.Events: - if event.Op&fsnotify.Create == fsnotify.Create || - event.Op&fsnotify.Write == fsnotify.Write { + if event.Has(fsnotify.Create) || + event.Has(fsnotify.Write) { if finfo, err := os.Lstat(event.Name); err != nil { log.Printf("can not lstat file: %v\n", err) } else if finfo.Mode()&os.ModeSymlink != 0 { From d6bba853511d01d336fbe3c13b34ae23dc187b62 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Herv=C3=A9?= Date: Thu, 16 Feb 2023 15:15:39 +0100 Subject: [PATCH 051/822] Rework Ginkgo usage (#9522) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Rework Ginkgo usage Currently Ginkgo is launched multiple times with different options to accomodate various use-cases. In particular, some specs needs to be run sequentially because non-namespaced objects are created that conflicts with concurent Helm deployments. However Ginkgo is able to handle such cases natively, in particular specs that needs to be run sequentially are supported (Serial spec). This commit marks the specs that needs to be run sequentially as Serial specs and runs the whole test suite from a single Ginkgo invocation. As a result, a single JUnit report is now generated. Signed-off-by: Hervé Werner * Fix controller error in test Error getting ConfigMap "$NAMESPACE/tcp-services": no object matching key "$NAMESPACE/tcp-services" in local store Signed-off-by: Hervé Werner * Replace "go get" invocations by "go install" Executing "go get" changes the go.mod & go.sum files which is not the case of "go install". Signed-off-by: Hervé Werner * Always clean out the Helm deployment Signed-off-by: Hervé Werner * Add E2E test to verify that changes to one or more configmap trigger an update Signed-off-by: Hervé Werner --------- Signed-off-by: Hervé Werner --- Makefile | 2 +- internal/ingress/controller/store/store.go | 1 - internal/k8s/main.go | 2 +- test/e2e-image/e2e.sh | 77 ++++------- .../namespace-overlays/topology/values.yaml | 19 +-- test/e2e/admission/admission.go | 17 +-- test/e2e/annotations/fastcgi.go | 5 +- test/e2e/endpointslices/topology.go | 19 +-- test/e2e/framework/exec.go | 10 ++ test/e2e/framework/framework.go | 18 ++- test/e2e/framework/influxdb.go | 6 +- test/e2e/framework/k8s.go | 41 ++++-- test/e2e/leaks/lua_ssl.go | 2 +- test/e2e/run-chart-test.sh | 2 +- test/e2e/run-e2e-suite.sh | 46 +------ test/e2e/run-kind-e2e.sh | 2 +- test/e2e/settings/configmap_change.go | 4 + test/e2e/settings/namespace_selector.go | 11 +- test/e2e/settings/ocsp/ocsp.go | 4 +- test/e2e/tcpudp/tcp.go | 129 ++++++++++-------- 20 files changed, 165 insertions(+), 252 deletions(-) diff --git a/Makefile b/Makefile index 25855a224..6037ac39d 100644 --- a/Makefile +++ b/Makefile @@ -31,7 +31,7 @@ TAG ?= $(shell cat TAG) # e2e settings # Allow limiting the scope of the e2e tests. By default run everything -FOCUS ?= .* +FOCUS ?= # number of parallel test E2E_NODES ?= 7 # run e2e test suite with tests that check for memory leaks? (default is false) diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index b5731c4bf..7157332c3 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -701,7 +701,6 @@ func New( }, } - // TODO: add e2e test to verify that changes to one or more configmap trigger an update changeTriggerUpdate := func(name string) bool { return name == configmap || name == tcp || name == udp } diff --git a/internal/k8s/main.go b/internal/k8s/main.go index e0d2a1660..d61013a9f 100644 --- a/internal/k8s/main.go +++ b/internal/k8s/main.go @@ -78,7 +78,7 @@ func GetNodeIPOrName(kubeClient clientset.Interface, name string, useInternalIP var ( // IngressPodDetails hold information about the ingress-nginx pod IngressPodDetails *PodInfo - // IngressNodeDetails old information about the node running ingress-nginx pod + // IngressNodeDetails hold information about the node running ingress-nginx pod IngressNodeDetails *NodeInfo ) diff --git a/test/e2e-image/e2e.sh b/test/e2e-image/e2e.sh index ed13926fb..f8ecd5337 100755 --- a/test/e2e-image/e2e.sh +++ b/test/e2e-image/e2e.sh @@ -14,70 +14,39 @@ # See the License for the specific language governing permissions and # limitations under the License. -set -e +set -eu NC='\e[0m' BGREEN='\e[32m' -#SLOW_E2E_THRESHOLD=${SLOW_E2E_THRESHOLD:-"5s"} -FOCUS=${FOCUS:-.*} E2E_NODES=${E2E_NODES:-5} E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS:-""} +reportFile="report-e2e-test-suite.xml" ginkgo_args=( - "-randomize-all" - "-flake-attempts=2" - "-fail-fast" - "--show-node-events" + "--fail-fast" + "--flake-attempts=2" + "--junit-report=${reportFile}" + "--nodes=${E2E_NODES}" "--poll-progress-after=180s" -# "-slow-spec-threshold=${SLOW_E2E_THRESHOLD}" - "-succinct" - "-timeout=75m" + "--randomize-all" + "--show-node-events" + "--succinct" + "--timeout=75m" ) -# Variable for the prefix of report filenames -reportFileNamePrefix="report-e2e-test-suite" - -echo -e "${BGREEN}Running e2e test suite (FOCUS=${FOCUS})...${NC}" -ginkgo "${ginkgo_args[@]}" \ - -focus="${FOCUS}" \ - -skip="\[Serial\]|\[MemoryLeak\]|\[TopologyHints\]" \ - -nodes="${E2E_NODES}" \ - --junit-report=$reportFileNamePrefix.xml \ - /e2e.test -# Create configMap out of a compressed report file for extraction later - -# Must be isolated, there is a collision if multiple helms tries to install same clusterRole at same time -echo -e "${BGREEN}Running e2e test for topology aware hints...${NC}" -ginkgo "${ginkgo_args[@]}" \ - -focus="\[TopologyHints\]" \ - -skip="\[Serial\]|\[MemoryLeak\]]" \ - -nodes="${E2E_NODES}" \ - --junit-report=$reportFileNamePrefix-topology.xml \ - /e2e.test -# Create configMap out of a compressed report file for extraction later - -echo -e "${BGREEN}Running e2e test suite with tests that require serial execution...${NC}" -ginkgo "${ginkgo_args[@]}" \ - -focus="\[Serial\]" \ - -skip="\[MemoryLeak\]" \ - --junit-report=$reportFileNamePrefix-serial.xml \ - /e2e.test -# Create configMap out of a compressed report file for extraction later - -if [[ ${E2E_CHECK_LEAKS} != "" ]]; then - echo -e "${BGREEN}Running e2e test suite with tests that check for memory leaks...${NC}" - ginkgo "${ginkgo_args[@]}" \ - -focus="\[MemoryLeak\]" \ - -skip="\[Serial\]" \ - --junit-report=$reportFileNamePrefix-memleak.xml \ - /e2e.test -# Create configMap out of a compressed report file for extraction later +if [ -n "${FOCUS}" ]; then + ginkgo_args+=("--focus=${FOCUS}") fi -for rFile in `ls $reportFileNamePrefix*` -do - gzip -k $rFile - kubectl create cm $rFile.gz --from-file $rFile.gz - kubectl label cm $rFile.gz junitreport=true -done +if [ -z "${E2E_CHECK_LEAKS}" ]; then + ginkgo_args+=("--skip=\[Memory Leak\]") +fi + +echo -e "${BGREEN}Running e2e test suite...${NC}" +(set -x; ginkgo "${ginkgo_args[@]}" /e2e.test) + +# Create configMap out of a compressed report file for extraction later +gzip -k ${reportFile} +kubectl create cm ${reportFile}.gz --from-file ${reportFile}.gz +kubectl label cm ${reportFile}.gz junitreport=true diff --git a/test/e2e-image/namespace-overlays/topology/values.yaml b/test/e2e-image/namespace-overlays/topology/values.yaml index 28b1cad19..5e27f7902 100644 --- a/test/e2e-image/namespace-overlays/topology/values.yaml +++ b/test/e2e-image/namespace-overlays/topology/values.yaml @@ -8,6 +8,7 @@ controller: digest: digestChroot: scope: + # Necessary to allow the ingress controller to get the topology information from the nodes enabled: false config: worker-processes: "1" @@ -19,12 +20,7 @@ controller: periodSeconds: 1 service: type: NodePort - electionID: ingress-controller-leader - ingressClassResource: - # We will create and remove each IC/ClusterRole/ClusterRoleBinding per test so there's no conflict - enabled: false extraArgs: - tcp-services-configmap: $NAMESPACE/tcp-services # e2e tests do not require information about ingress status update-status: "false" terminationGracePeriodSeconds: 1 @@ -33,19 +29,6 @@ controller: enableTopologyAwareRouting: true - # ulimit -c unlimited - # mkdir -p /tmp/coredump - # chmod a+rwx /tmp/coredump - # echo "/tmp/coredump/core.%e.%p.%h.%t" > /proc/sys/kernel/core_pattern - extraVolumeMounts: - - name: coredump - mountPath: /tmp/coredump - - extraVolumes: - - name: coredump - hostPath: - path: /tmp/coredump - rbac: create: true scope: false diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index bde98fddf..4a4e31980 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -32,7 +32,7 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { +var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", func() { f := framework.NewDefaultFramework("admission") ginkgo.BeforeEach(func() { @@ -40,11 +40,6 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { f.NewSlowEchoDeployment() }) - ginkgo.AfterEach(func() { - err := uninstallChart(f) - assert.Nil(ginkgo.GinkgoT(), err, "uninstalling helm chart") - }) - ginkgo.It("reject ingress with global-rate-limit annotations when memcached is not configured", func() { host := "admission-test" @@ -216,16 +211,6 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() { }) }) -func uninstallChart(f *framework.Framework) error { - cmd := exec.Command("helm", "uninstall", "--namespace", f.Namespace, "nginx-ingress") - _, err := cmd.CombinedOutput() - if err != nil { - return fmt.Errorf("unexpected error uninstalling ingress-nginx release: %v", err) - } - - return nil -} - const ( validV1Ingress = ` apiVersion: networking.k8s.io/v1 diff --git a/test/e2e/annotations/fastcgi.go b/test/e2e/annotations/fastcgi.go index 0dc6ae4a4..572eca548 100644 --- a/test/e2e/annotations/fastcgi.go +++ b/test/e2e/annotations/fastcgi.go @@ -21,7 +21,6 @@ import ( "strings" "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -81,9 +80,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { }, } - cm, err := f.EnsureConfigMap(configuration) - assert.Nil(ginkgo.GinkgoT(), err, "creating configmap") - assert.NotNil(ginkgo.GinkgoT(), cm, "expected a configmap but none returned") + f.EnsureConfigMap(configuration) host := "fastcgi-params-configmap" diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index ce913e966..7cc67cedb 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -21,7 +21,6 @@ import ( "encoding/json" "fmt" "net/http" - "os/exec" "strings" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -33,7 +32,7 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var _ = framework.IngressNginxDescribe("[TopologyHints] topology aware routing", func() { +var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware routing", func() { f := framework.NewDefaultFramework("topology") host := "topology-svc.foo.com" @@ -41,12 +40,6 @@ var _ = framework.IngressNginxDescribe("[TopologyHints] topology aware routing", f.NewEchoDeployment(framework.WithDeploymentReplicas(2), framework.WithSvcTopologyAnnotations()) }) - ginkgo.AfterEach(func() { - // we need to uninstall chart because of clusterRole which is not destroyed with namespace - err := uninstallChart(f) - assert.Nil(ginkgo.GinkgoT(), err, "uninstalling helm chart") - }) - ginkgo.It("should return 200 when service has topology hints", func() { annotations := make(map[string]string) @@ -100,13 +93,3 @@ var _ = framework.IngressNginxDescribe("[TopologyHints] topology aware routing", } }) }) - -func uninstallChart(f *framework.Framework) error { - cmd := exec.Command("helm", "uninstall", "--namespace", f.Namespace, "nginx-ingress") - _, err := cmd.CombinedOutput() - if err != nil { - return fmt.Errorf("unexpected error uninstalling ingress-nginx release: %v", err) - } - - return nil -} diff --git a/test/e2e/framework/exec.go b/test/e2e/framework/exec.go index 8c8c7ddb0..0284e768c 100644 --- a/test/e2e/framework/exec.go +++ b/test/e2e/framework/exec.go @@ -152,6 +152,16 @@ func (f *Framework) KubectlProxy(port int) (int, *exec.Cmd, error) { return -1, cmd, fmt.Errorf("failed to parse port from proxy stdout: %s", output) } +func (f *Framework) UninstallChart() error { + cmd := exec.Command("helm", "uninstall", "--namespace", f.Namespace, "nginx-ingress") + _, err := cmd.CombinedOutput() + if err != nil { + return fmt.Errorf("unexpected error uninstalling ingress-nginx release: %v", err) + } + + return nil +} + func startCmdAndStreamOutput(cmd *exec.Cmd) (stdout, stderr io.ReadCloser, err error) { stdout, err = cmd.StdoutPipe() if err != nil { diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index 662cd0879..cac6dfd20 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -150,7 +150,11 @@ func (f *Framework) AfterEach() { defer func(kubeClient kubernetes.Interface, ingressclass string) { defer ginkgo.GinkgoRecover() - err := deleteIngressClass(kubeClient, ingressclass) + + err := f.UninstallChart() + assert.Nil(ginkgo.GinkgoT(), err, "uninstalling helm chart") + + err = deleteIngressClass(kubeClient, ingressclass) assert.Nil(ginkgo.GinkgoT(), err, "deleting IngressClass") }(f.KubeClientSet, f.IngressClass) @@ -192,6 +196,11 @@ func IngressNginxDescribe(text string, body func()) bool { return ginkgo.Describe(text, body) } +// IngressNginxDescribeSerial wrapper function for ginkgo describe. Adds namespacing. +func IngressNginxDescribeSerial(text string, body func()) bool { + return ginkgo.Describe(text, ginkgo.Serial, body) +} + // DescribeAnnotation wrapper function for ginkgo describe. Adds namespacing. func DescribeAnnotation(text string, body func()) bool { return ginkgo.Describe("[Annotations] "+text, body) @@ -202,11 +211,6 @@ func DescribeSetting(text string, body func()) bool { return ginkgo.Describe("[Setting] "+text, body) } -// MemoryLeakIt is wrapper function for ginkgo It. Adds "[MemoryLeak]" tag and makes static analysis easier. -func MemoryLeakIt(text string, body interface{}) bool { - return ginkgo.It(text+" [MemoryLeak]", body) -} - // GetNginxIP returns the number of TCP port where NGINX is running func (f *Framework) GetNginxIP() string { s, err := f.KubeClientSet. @@ -387,7 +391,7 @@ func (f *Framework) UpdateNginxConfigMapData(key string, value string) { } // WaitForReload calls the passed function and -// asser it has caused at least 1 reload. +// asserts it has caused at least 1 reload. func (f *Framework) WaitForReload(fn func()) { initialReloadCount := getReloadCount(f.pod, f.Namespace, f.KubeClientSet) diff --git a/test/e2e/framework/influxdb.go b/test/e2e/framework/influxdb.go index c3c0e3421..43a5702e6 100644 --- a/test/e2e/framework/influxdb.go +++ b/test/e2e/framework/influxdb.go @@ -68,9 +68,7 @@ func (f *Framework) NewInfluxDBDeployment() { }, } - cm, err := f.EnsureConfigMap(configuration) - assert.Nil(ginkgo.GinkgoT(), err, "creating an Influxdb deployment") - assert.NotNil(ginkgo.GinkgoT(), cm, "expected a configmap but none returned") + f.EnsureConfigMap(configuration) deployment := &appsv1.Deployment{ ObjectMeta: metav1.ObjectMeta{ @@ -136,7 +134,7 @@ func (f *Framework) NewInfluxDBDeployment() { d := f.EnsureDeployment(deployment) - err = waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), }) assert.Nil(ginkgo.GinkgoT(), err, "waiting for influxdb pod to become ready") diff --git a/test/e2e/framework/k8s.go b/test/e2e/framework/k8s.go index ef9c522d6..fc3e59b08 100644 --- a/test/e2e/framework/k8s.go +++ b/test/e2e/framework/k8s.go @@ -25,9 +25,7 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" appsv1 "k8s.io/api/apps/v1" - api "k8s.io/api/core/v1" core "k8s.io/api/core/v1" - v1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" k8sErrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -36,8 +34,8 @@ import ( "k8s.io/client-go/kubernetes" ) -// EnsureSecret creates a Secret object or returns it if it already exists. -func (f *Framework) EnsureSecret(secret *api.Secret) *api.Secret { +// EnsureSecret creates a Secret object or returns it. +func (f *Framework) EnsureSecret(secret *core.Secret) *core.Secret { err := createSecretWithRetries(f.KubeClientSet, secret.Namespace, secret) assert.Nil(ginkgo.GinkgoT(), err, "creating secret") @@ -48,17 +46,30 @@ func (f *Framework) EnsureSecret(secret *api.Secret) *api.Secret { return s } -// EnsureConfigMap creates a ConfigMap object or returns it if it already exists. -func (f *Framework) EnsureConfigMap(configMap *api.ConfigMap) (*api.ConfigMap, error) { - cm, err := f.KubeClientSet.CoreV1().ConfigMaps(configMap.Namespace).Create(context.TODO(), configMap, metav1.CreateOptions{}) - if err != nil { - if k8sErrors.IsAlreadyExists(err) { - return f.KubeClientSet.CoreV1().ConfigMaps(configMap.Namespace).Update(context.TODO(), configMap, metav1.UpdateOptions{}) - } - return nil, err +// GetConfigMap gets a ConfigMap object from the given namespace, name and returns it, throws error if it does not exist. +func (f *Framework) GetConfigMap(namespace string, name string) *core.ConfigMap { + cm, err := f.KubeClientSet.CoreV1().ConfigMaps(namespace).Get(context.TODO(), name, metav1.GetOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "getting configmap") + assert.NotNil(ginkgo.GinkgoT(), cm, "expected a configmap but none returned") + return cm +} + +// EnsureConfigMap creates or updates an existing ConfigMap object or returns it. +func (f *Framework) EnsureConfigMap(configMap *core.ConfigMap) *core.ConfigMap { + cm := configMap.DeepCopy() + // Clean out ResourceVersion field if present + if cm.ObjectMeta.ResourceVersion != "" { + cm.ObjectMeta.ResourceVersion = "" } - return cm, nil + res, err := f.KubeClientSet.CoreV1().ConfigMaps(configMap.Namespace).Create(context.TODO(), cm, metav1.CreateOptions{}) + if k8sErrors.IsAlreadyExists(err) { + res, err = f.KubeClientSet.CoreV1().ConfigMaps(configMap.Namespace).Update(context.TODO(), cm, metav1.UpdateOptions{}) + } + assert.Nil(ginkgo.GinkgoT(), err, "updating configmap") + assert.NotNil(ginkgo.GinkgoT(), res, "updating configmap") + + return res } // GetIngress gets an Ingress object from the given namespace, name and returns it, throws error if it does not exists. @@ -293,7 +304,7 @@ func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj * return retryWithExponentialBackOff(createFunc) } -func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *v1.Secret) error { +func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *core.Secret) error { if obj == nil { return fmt.Errorf("Object provided to create is empty") } @@ -313,7 +324,7 @@ func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *v1.S return retryWithExponentialBackOff(createFunc) } -func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *v1.Service) error { +func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *core.Service) error { if obj == nil { return fmt.Errorf("Object provided to create is empty") } diff --git a/test/e2e/leaks/lua_ssl.go b/test/e2e/leaks/lua_ssl.go index 8ebd05ccb..e63a1e353 100644 --- a/test/e2e/leaks/lua_ssl.go +++ b/test/e2e/leaks/lua_ssl.go @@ -39,7 +39,7 @@ var _ = framework.IngressNginxDescribe("[Memory Leak] Dynamic Certificates", fun f.NewEchoDeployment() }) - framework.MemoryLeakIt("should not leak memory from ingress SSL certificates or configuration updates", func() { + ginkgo.It("should not leak memory from ingress SSL certificates or configuration updates", func() { hostCount := 1000 iterations := 10 diff --git a/test/e2e/run-chart-test.sh b/test/e2e/run-chart-test.sh index e501ca6fe..d01ab4486 100755 --- a/test/e2e/run-chart-test.sh +++ b/test/e2e/run-chart-test.sh @@ -78,7 +78,7 @@ fi if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go get github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 fi echo "[dev-env] building image" make -C ${DIR}/../../ clean-image build image diff --git a/test/e2e/run-e2e-suite.sh b/test/e2e/run-e2e-suite.sh index 7920c0523..b1de8bf9a 100755 --- a/test/e2e/run-e2e-suite.sh +++ b/test/e2e/run-e2e-suite.sh @@ -49,15 +49,9 @@ if [ "$missing" = true ]; then exit 1 fi -E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS:-} -FOCUS=${FOCUS:-.*} - BASEDIR=$(dirname "$0") NGINX_BASE_IMAGE=$(cat $BASEDIR/../../NGINX_BASE) -export E2E_CHECK_LEAKS -export FOCUS - echo -e "${BGREEN}Granting permissions to ingress-nginx e2e service account...${NC}" kubectl create serviceaccount ingress-nginx-e2e || true kubectl create clusterrolebinding permissive-binding \ @@ -66,7 +60,6 @@ kubectl create clusterrolebinding permissive-binding \ --user=kubelet \ --serviceaccount=default:ingress-nginx-e2e || true - VER=$(kubectl version --client=false -o json |jq '.serverVersion.minor |tonumber') if [ $VER -lt 24 ]; then echo -e "${BGREEN}Waiting service account...${NC}"; \ @@ -76,7 +69,6 @@ if [ $VER -lt 24 ]; then done fi - echo -e "Starting the e2e test pod" kubectl run --rm \ @@ -90,38 +82,10 @@ kubectl run --rm \ e2e --image=nginx-ingress-controller:e2e # Get the junit-reports stored in the configMaps created during e2etests -echo "Getting the report files out now.." +echo "Getting the report file out now.." reportsDir="test/junitreports" -reportFileName="report-e2e-test-suite" -[ ! -e ${reportsDir} ] && mkdir $reportsDir +reportFile="report-e2e-test-suite.xml.gz" +mkdir -p $reportsDir cd $reportsDir - -# TODO: Seeking Rikatz help here to extract in a loop. Tried things like below without success -#for cmName in `k get cm -l junitreport=true -o json | jq '.items[].binaryData | keys[]' | tr '\"' ' '` -#do -# -# -# kubectl get cm -l junitreport=true -o json | jq -r '[.items[].binaryData | to_entries[] | {"key": .key, "value": .value }] | from_entries' -# - -# Below lines successfully extract the report but they are one line per report. -# We only have 3 ginkgo reports so its ok for now -# But still, ideally this should be a loop as talked about in comments a few lines above -kubectl get cm $reportFileName.xml.gz -o "jsonpath={.binaryData['report-e2e-test-suite\.xml\.gz']}" > $reportFileName.xml.gz.base64 -kubectl get cm $reportFileName-serial.xml.gz -o "jsonpath={.binaryData['report-e2e-test-suite-serial\.xml\.gz']}" > $reportFileName-serial.xml.gz.base64 - -cat $reportFileName.xml.gz.base64 | base64 -d > $reportFileName.xml.gz -cat $reportFileName-serial.xml.gz.base64 | base64 -d > $reportFileName-serial.xml.gz - -gzip -d $reportFileName.xml.gz -gzip -d $reportFileName-serial.xml.gz - -rm *.base64 -cd ../.. - -# TODO Temporary: if condition to check if the memleak cm exists and only then try the extract for the memleak report -# -#kubectl get cm $reportFileName-serial -o "jsonpath={.data['report-e2e-test-suite-memleak\.xml\.gz']}" > $reportFileName-memleak.base64 -#cat $reportFileName-memleak.base64 | base64 -d > $reportFileName-memleak.xml.gz -#gzip -d $reportFileName-memleak.xml.gz -echo "done getting the reports files out.." +kubectl get cm $reportFile -o "jsonpath={.binaryData['${reportFile//\./\\.}']}" | base64 -d | gunzip > ${reportFile%\.gz} +echo "done getting the report file out.." diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index bb61706b4..df927bd1c 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -95,7 +95,7 @@ fi if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go get github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 fi echo "[dev-env] .. done building controller images" diff --git a/test/e2e/settings/configmap_change.go b/test/e2e/settings/configmap_change.go index be3ab0b11..3e37b62cd 100644 --- a/test/e2e/settings/configmap_change.go +++ b/test/e2e/settings/configmap_change.go @@ -73,5 +73,9 @@ var _ = framework.DescribeSetting("Configmap change", func() { return strings.ContainsAny(cfg, "error_log /var/log/nginx/error.log debug;") }) assert.NotEqual(ginkgo.GinkgoT(), checksum, newChecksum) + + logs, err := f.NginxLogs() + assert.Nil(ginkgo.GinkgoT(), err, "obtaining nginx logs") + assert.Contains(ginkgo.GinkgoT(), logs, "Backend successfully reloaded") }) }) diff --git a/test/e2e/settings/namespace_selector.go b/test/e2e/settings/namespace_selector.go index a23514dca..3bf856566 100644 --- a/test/e2e/settings/namespace_selector.go +++ b/test/e2e/settings/namespace_selector.go @@ -27,7 +27,7 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var _ = framework.IngressNginxDescribe("[Flag] watch namespace selector", func() { +var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", func() { f := framework.NewDefaultFramework("namespace-selector") notMatchedHost, matchedHost := "bar", "foo" var notMatchedNs string @@ -45,7 +45,7 @@ var _ = framework.IngressNginxDescribe("[Flag] watch namespace selector", func() cleanupNamespace := func(ns string) { err := framework.DeleteKubeNamespace(f.KubeClientSet, ns) - assert.Nil(ginkgo.GinkgoT(), err, "deleting temporarily crated namespace") + assert.Nil(ginkgo.GinkgoT(), err, "deleting temporarily created namespace") } ginkgo.BeforeEach(func() { @@ -56,13 +56,6 @@ var _ = framework.IngressNginxDescribe("[Flag] watch namespace selector", func() ginkgo.AfterEach(func() { cleanupNamespace(notMatchedNs) cleanupNamespace(matchedNs) - - // cleanup clusterrole/clusterrolebinding created by installing chart with controller.scope.enabled=false - err := f.KubeClientSet.RbacV1().ClusterRoles().Delete(context.TODO(), "nginx-ingress", metav1.DeleteOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "deleting clusterrole nginx-ingress") - - err = f.KubeClientSet.RbacV1().ClusterRoleBindings().Delete(context.TODO(), "nginx-ingress", metav1.DeleteOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "deleting clusterrolebinging nginx-ingress") }) ginkgo.Context("With specific watch-namespace-selector flags", func() { diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index ea137aeb1..adf4351e7 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -85,7 +85,7 @@ var _ = framework.DescribeSetting("OCSP", func() { cfsslDB, err := os.ReadFile("empty.db") assert.Nil(ginkgo.GinkgoT(), err) - cmap, err := f.EnsureConfigMap(&corev1.ConfigMap{ + f.EnsureConfigMap(&corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "ocspserve", Namespace: f.Namespace, @@ -95,8 +95,6 @@ var _ = framework.DescribeSetting("OCSP", func() { "db-config.json": []byte(`{"driver":"sqlite3","data_source":"/data/empty.db"}`), }, }) - assert.Nil(ginkgo.GinkgoT(), err) - assert.NotNil(ginkgo.GinkgoT(), cmap) d, s := ocspserveDeployment(f.Namespace) f.EnsureDeployment(d) diff --git a/test/e2e/tcpudp/tcp.go b/test/e2e/tcpudp/tcp.go index b62134a03..16a633b63 100644 --- a/test/e2e/tcpudp/tcp.go +++ b/test/e2e/tcpudp/tcp.go @@ -21,6 +21,7 @@ import ( "fmt" "net" "net/http" + "regexp" "strings" "time" @@ -36,58 +37,39 @@ import ( var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { f := framework.NewDefaultFramework("tcp") + var ip string + + ginkgo.BeforeEach(func() { + ip = f.GetNginxIP() + }) ginkgo.It("should expose a TCP service", func() { f.NewEchoDeployment() - config, err := f.KubeClientSet. - CoreV1(). - ConfigMaps(f.Namespace). - Get(context.TODO(), "tcp-services", metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining tcp-services configmap") - assert.NotNil(ginkgo.GinkgoT(), config, "expected a configmap but none returned") - - if config.Data == nil { - config.Data = map[string]string{} + cm := f.GetConfigMap(f.Namespace, "tcp-services") + cm.Data = map[string]string{ + "8080": fmt.Sprintf("%v/%v:80", f.Namespace, framework.EchoService), } + f.EnsureConfigMap(cm) - config.Data["8080"] = fmt.Sprintf("%v/%v:80", f.Namespace, framework.EchoService) - - _, err = f.KubeClientSet. - CoreV1(). - ConfigMaps(f.Namespace). - Update(context.TODO(), config, metav1.UpdateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating configmap") - - svc, err := f.KubeClientSet. - CoreV1(). - Services(f.Namespace). - Get(context.TODO(), "nginx-ingress-controller", metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining ingress-nginx service") - assert.NotNil(ginkgo.GinkgoT(), svc, "expected a service but none returned") - + svc := f.GetService(f.Namespace, "nginx-ingress-controller") svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{ Name: framework.EchoService, Port: 8080, TargetPort: intstr.FromInt(8080), }) - _, err = f.KubeClientSet. + _, err := f.KubeClientSet. CoreV1(). Services(f.Namespace). Update(context.TODO(), svc, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating service") - // wait for update and nginx reload and new endpoint is available - framework.Sleep() - f.WaitForNginxConfiguration( func(cfg string) bool { return strings.Contains(cfg, fmt.Sprintf(`ngx.var.proxy_upstream_name="tcp-%v-%v-80"`, f.Namespace, framework.EchoService)) }) - ip := f.GetNginxIP() - f.HTTPTestClient(). GET("/"). WithURL(fmt.Sprintf("http://%v:8080", ip)). @@ -122,44 +104,25 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { } f.EnsureService(externalService) - // Expose the `external name` port on the `ingress-nginx` service - svc, err := f.KubeClientSet. - CoreV1(). - Services(f.Namespace). - Get(context.TODO(), "nginx-ingress-controller", metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining ingress-nginx service") - assert.NotNil(ginkgo.GinkgoT(), svc, "expected a service but none returned") - + // Expose the `external name` port on the `ingress-nginx-controller` service + svc := f.GetService(f.Namespace, "nginx-ingress-controller") svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{ Name: "dns-svc", Port: 5353, TargetPort: intstr.FromInt(5353), }) - _, err = f.KubeClientSet. + _, err := f.KubeClientSet. CoreV1(). Services(f.Namespace). Update(context.TODO(), svc, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating service") // Update the TCP configmap to link port 5353 to the DNS external name service - config, err := f.KubeClientSet. - CoreV1(). - ConfigMaps(f.Namespace). - Get(context.TODO(), "tcp-services", metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining tcp-services configmap") - assert.NotNil(ginkgo.GinkgoT(), config, "expected a configmap but none returned") - - if config.Data == nil { - config.Data = map[string]string{} + config := f.GetConfigMap(f.Namespace, "tcp-services") + config.Data = map[string]string{ + "5353": fmt.Sprintf("%v/dns-external-name-svc:5353", f.Namespace), } - - config.Data["5353"] = fmt.Sprintf("%v/dns-external-name-svc:5353", f.Namespace) - - _, err = f.KubeClientSet. - CoreV1(). - ConfigMaps(f.Namespace). - Update(context.TODO(), config, metav1.UpdateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating configmap") + f.EnsureConfigMap(config) // Validate that the generated nginx config contains the expected `proxy_upstream_name` value f.WaitForNginxConfiguration( @@ -168,7 +131,6 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { }) // Execute the test. Use the `external name` service to resolve a domain name. - ip := f.GetNginxIP() resolver := net.Resolver{ PreferGo: true, Dial: func(ctx context.Context, network, address string) (net.Conn, error) { @@ -203,4 +165,57 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error from DNS resolver") assert.Contains(ginkgo.GinkgoT(), ips, "8.8.4.4") }) + + ginkgo.It("should reload after an update in the configuration", func() { + + ginkgo.By("setting up a first deployment") + f.NewEchoDeployment(framework.WithDeploymentName("first-service")) + + cm := f.GetConfigMap(f.Namespace, "tcp-services") + cm.Data = map[string]string{ + "8080": fmt.Sprintf("%v/first-service:80", f.Namespace), + } + f.EnsureConfigMap(cm) + + checksumRegex := regexp.MustCompile(`Configuration checksum:\s+(\d+)`) + checksum := "" + + f.WaitForNginxConfiguration( + func(cfg string) bool { + // before returning, extract the current checksum + match := checksumRegex.FindStringSubmatch(cfg) + if len(match) > 0 { + checksum = match[1] + } + + return strings.Contains(cfg, fmt.Sprintf(`ngx.var.proxy_upstream_name="tcp-%v-first-service-80"`, + f.Namespace)) + }) + assert.NotEmpty(ginkgo.GinkgoT(), checksum) + + ginkgo.By("updating the tcp service to a second deployment") + f.NewEchoDeployment(framework.WithDeploymentName("second-service")) + + cm = f.GetConfigMap(f.Namespace, "tcp-services") + cm.Data["8080"] = fmt.Sprintf("%v/second-service:80", f.Namespace) + f.EnsureConfigMap(cm) + + newChecksum := "" + f.WaitForNginxConfiguration( + func(cfg string) bool { + match := checksumRegex.FindStringSubmatch(cfg) + if len(match) > 0 { + newChecksum = match[1] + } + + return strings.Contains(cfg, fmt.Sprintf(`ngx.var.proxy_upstream_name="tcp-%v-second-service-80"`, + f.Namespace)) + }) + assert.NotEqual(ginkgo.GinkgoT(), checksum, newChecksum) + + logs, err := f.NginxLogs() + assert.Nil(ginkgo.GinkgoT(), err, "obtaining nginx logs") + assert.Contains(ginkgo.GinkgoT(), logs, "Backend successfully reloaded") + }) + }) From 4aef45c17734d7dcba32a2032f97ac604c59d7bd Mon Sep 17 00:00:00 2001 From: Toon Schoenmakers Date: Fri, 17 Feb 2023 22:48:10 +0100 Subject: [PATCH 052/822] controller: Don't panic when ready condition in a endpointslice is missing (#9550) --- internal/ingress/controller/endpointslices.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/ingress/controller/endpointslices.go b/internal/ingress/controller/endpointslices.go index 34d5266dd..56e7a2dcb 100644 --- a/internal/ingress/controller/endpointslices.go +++ b/internal/ingress/controller/endpointslices.go @@ -128,7 +128,7 @@ func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto c } for _, ep := range eps.Endpoints { - if !(*ep.Conditions.Ready) { + if (ep.Conditions.Ready != nil) && !(*ep.Conditions.Ready) { continue } epHasZone := false From 9126401eebf81e75bed25b5c7a1d0bbf94e2ecb6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 17 Feb 2023 16:00:03 -0800 Subject: [PATCH 053/822] Bump golang.org/x/net in /images/kube-webhook-certgen/rootfs (#9645) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.1.0 to 0.7.0. - [Release notes](https://github.com/golang/net/releases) - [Commits](https://github.com/golang/net/compare/v0.1.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- images/kube-webhook-certgen/rootfs/go.mod | 8 ++++---- images/kube-webhook-certgen/rootfs/go.sum | 20 ++++++++------------ 2 files changed, 12 insertions(+), 16 deletions(-) diff --git a/images/kube-webhook-certgen/rootfs/go.mod b/images/kube-webhook-certgen/rootfs/go.mod index b98adf58b..a6e2b7ed2 100644 --- a/images/kube-webhook-certgen/rootfs/go.mod +++ b/images/kube-webhook-certgen/rootfs/go.mod @@ -29,11 +29,11 @@ require ( github.com/pkg/errors v0.9.1 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/tidwall/gjson v1.14.0 // indirect - golang.org/x/net v0.1.0 // indirect + golang.org/x/net v0.7.0 // indirect golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d // indirect - golang.org/x/sys v0.1.0 // indirect - golang.org/x/term v0.1.0 // indirect - golang.org/x/text v0.4.0 // indirect + golang.org/x/sys v0.5.0 // indirect + golang.org/x/term v0.5.0 // indirect + golang.org/x/text v0.7.0 // indirect golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect google.golang.org/appengine v1.6.5 // indirect google.golang.org/protobuf v1.26.0 // indirect diff --git a/images/kube-webhook-certgen/rootfs/go.sum b/images/kube-webhook-certgen/rootfs/go.sum index 0270e3297..7817b7f29 100644 --- a/images/kube-webhook-certgen/rootfs/go.sum +++ b/images/kube-webhook-certgen/rootfs/go.sum @@ -89,7 +89,6 @@ github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25Kn github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= -github.com/emicklei/go-restful v2.16.0+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= @@ -484,8 +483,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.1.0 h1:hZ/3BUoy5aId7sCpA/Tc5lt8DkFgdVS2onTpJsZ/fl0= -golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= +golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= +golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -545,16 +544,14 @@ golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw= -golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -562,8 +559,8 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.4.0 h1:BrVqGRd7+k1DiOgtnFvAkoQEWQvBc25ouMJM6429SFg= -golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -708,7 +705,6 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo= gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA= gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= From d21ae2dbf6810158e912dcba0ef5f5775f823978 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Sat, 18 Feb 2023 17:11:37 +0530 Subject: [PATCH 054/822] changed v1.6.3 to v1.6.4 on deploy docs (#9647) --- docs/deploy/index.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/deploy/index.md b/docs/deploy/index.md index 57df7a215..49340e2f5 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml ``` A @@ -357,7 +357,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), @@ -429,4 +429,4 @@ of the NGINX Ingress Controller (e.g. version 0.49). The Helm chart of the NGINX Ingress Controller switched to version 1 in version 4 of the chart. In other words, if you're running Kubernetes 1.19 or earlier, you should use version 3.X of the chart (this can be done by adding -`--version='<4'` to the `helm install` command). +`--version='<4'` to the `helm install` command ). From c5d73d58c69f71a8d1aecad6b5c15b5ede4a23e8 Mon Sep 17 00:00:00 2001 From: Mitsuo Heijo <25817501+johejo@users.noreply.github.com> Date: Thu, 23 Feb 2023 00:27:57 +0900 Subject: [PATCH 055/822] migrate mitchellh/hashstructure to v2 (#9651) --- go.mod | 2 +- go.sum | 4 ++-- internal/ingress/controller/controller.go | 4 ++-- internal/ingress/controller/template/configmap.go | 4 ++-- internal/ingress/controller/template/configmap_test.go | 8 ++++---- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/go.mod b/go.mod index d942c1637..2b51cda17 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/json-iterator/go v1.1.12 github.com/kylelemons/godebug v1.1.0 github.com/mitchellh/go-ps v1.0.0 - github.com/mitchellh/hashstructure v1.1.0 + github.com/mitchellh/hashstructure/v2 v2.0.2 github.com/mitchellh/mapstructure v1.5.0 github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 diff --git a/go.sum b/go.sum index b1f6269a6..fe147d4a5 100644 --- a/go.sum +++ b/go.sum @@ -248,8 +248,8 @@ github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zk github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= -github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0= -github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA= +github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4= +github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= github.com/mmarkdown/mmark v2.0.40+incompatible h1:vMeUeDzBK3H+/mU0oMVfMuhSXJlIA+DE/DMPQNAj5C4= diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index a77d2ff37..1914765d8 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -23,7 +23,7 @@ import ( "strings" "time" - "github.com/mitchellh/hashstructure" + "github.com/mitchellh/hashstructure/v2" apiv1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" apiequality "k8s.io/apimachinery/pkg/api/equality" @@ -187,7 +187,7 @@ func (n *NGINXController) syncIngress(interface{}) error { if !utilingress.IsDynamicConfigurationEnough(pcfg, n.runningConfig) { klog.InfoS("Configuration changes detected, backend reload required") - hash, _ := hashstructure.Hash(pcfg, &hashstructure.HashOptions{ + hash, _ := hashstructure.Hash(pcfg, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) diff --git a/internal/ingress/controller/template/configmap.go b/internal/ingress/controller/template/configmap.go index 61e8e4998..c73f3b6c0 100644 --- a/internal/ingress/controller/template/configmap.go +++ b/internal/ingress/controller/template/configmap.go @@ -26,7 +26,7 @@ import ( "k8s.io/klog/v2" - "github.com/mitchellh/hashstructure" + "github.com/mitchellh/hashstructure/v2" "github.com/mitchellh/mapstructure" "k8s.io/apimachinery/pkg/util/sets" @@ -431,7 +431,7 @@ func ReadConfig(src map[string]string) config.Configuration { klog.Warningf("unexpected error merging defaults: %v", err) } - hash, err := hashstructure.Hash(to, &hashstructure.HashOptions{ + hash, err := hashstructure.Hash(to, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) if err != nil { diff --git a/internal/ingress/controller/template/configmap_test.go b/internal/ingress/controller/template/configmap_test.go index ebe55d192..dad841694 100644 --- a/internal/ingress/controller/template/configmap_test.go +++ b/internal/ingress/controller/template/configmap_test.go @@ -23,7 +23,7 @@ import ( "time" "github.com/kylelemons/godebug/pretty" - "github.com/mitchellh/hashstructure" + "github.com/mitchellh/hashstructure/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/authreq" "k8s.io/ingress-nginx/internal/ingress/controller/config" @@ -104,7 +104,7 @@ func TestMergeConfigMapToStruct(t *testing.T) { def.DefaultType = "text/plain" def.DebugConnections = []string{"127.0.0.1", "1.1.1.1/24", "::1"} - hash, err := hashstructure.Hash(def, &hashstructure.HashOptions{ + hash, err := hashstructure.Hash(def, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) if err != nil { @@ -134,7 +134,7 @@ func TestMergeConfigMapToStruct(t *testing.T) { def.LuaSharedDicts = defaultLuaSharedDicts def.DisableIpv6DNS = true - hash, err = hashstructure.Hash(def, &hashstructure.HashOptions{ + hash, err = hashstructure.Hash(def, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) if err != nil { @@ -155,7 +155,7 @@ func TestMergeConfigMapToStruct(t *testing.T) { def.WhitelistSourceRange = []string{"1.1.1.1/32"} def.DisableIpv6DNS = true - hash, err = hashstructure.Hash(def, &hashstructure.HashOptions{ + hash, err = hashstructure.Hash(def, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) if err != nil { From 6865ee0fba2d0f4256463d3fce747d89d4c69698 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Feb 2023 07:37:57 -0800 Subject: [PATCH 056/822] Bump golang.org/x/net from 0.6.0 to 0.7.0 (#9646) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/golang/net/releases) - [Commits](https://github.com/golang/net/compare/v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2b51cda17..2b485801f 100644 --- a/go.mod +++ b/go.mod @@ -99,7 +99,7 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.7.0 // indirect - golang.org/x/net v0.6.0 // indirect + golang.org/x/net v0.7.0 // indirect golang.org/x/oauth2 v0.4.0 // indirect golang.org/x/sys v0.5.0 // indirect golang.org/x/term v0.5.0 // indirect diff --git a/go.sum b/go.sum index fe147d4a5..741fa7b5b 100644 --- a/go.sum +++ b/go.sum @@ -471,8 +471,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.6.0 h1:L4ZwwTvKW9gr0ZMS1yrHD9GZhIuVjOBBnaKH+SPQK0Q= -golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= +golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= From 33b3dc32153699517908404099cff779dac0b296 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Feb 2023 07:39:57 -0800 Subject: [PATCH 057/822] Bump github.com/prometheus/common from 0.39.0 to 0.40.0 (#9653) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.39.0 to 0.40.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](https://github.com/prometheus/common/compare/v0.39.0...v0.40.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2b485801f..8c4a7123c 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 - github.com/prometheus/common v0.39.0 + github.com/prometheus/common v0.40.0 github.com/spf13/cobra v1.6.1 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.1 diff --git a/go.sum b/go.sum index 741fa7b5b..31c11e5a4 100644 --- a/go.sum +++ b/go.sum @@ -320,8 +320,8 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= -github.com/prometheus/common v0.39.0 h1:oOyhkDq05hPZKItWVBkJ6g6AtGxi+fy7F4JvUV8uhsI= -github.com/prometheus/common v0.39.0/go.mod h1:6XBZ7lYdLCbkAVhwRsWTZn+IN5AB9F/NXd5w0BbEX0Y= +github.com/prometheus/common v0.40.0 h1:Afz7EVRqGg2Mqqf4JuF9vdvp1pi220m55Pi9T2JnO4Q= +github.com/prometheus/common v0.40.0/go.mod h1:L65ZJPSmfn/UBWLQIHV7dBrKFidB/wPlF1y5TlSt9OE= github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= From dc61f6cd8bdc9dfa87ee8924d16838549242cf2b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Feb 2023 04:26:19 -0800 Subject: [PATCH 058/822] Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#9675) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.1 to 1.8.2. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.8.1...v1.8.2) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8c4a7123c..00765b534 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/prometheus/common v0.40.0 github.com/spf13/cobra v1.6.1 github.com/spf13/pflag v1.0.5 - github.com/stretchr/testify v1.8.1 + github.com/stretchr/testify v1.8.2 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.6.0 diff --git a/go.sum b/go.sum index 31c11e5a4..6274257aa 100644 --- a/go.sum +++ b/go.sum @@ -364,8 +364,8 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= -github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= -github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= +github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= From 640bdac76d8c5b0505b10255a3195709b971154f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 5 Mar 2023 10:56:57 -0800 Subject: [PATCH 059/822] Bump golang.org/x/sys in /images/custom-error-pages/rootfs (#9671) Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.0.0-20210603081109-ebe580a85c40 to 0.1.0. - [Release notes](https://github.com/golang/sys/releases) - [Commits](https://github.com/golang/sys/commits/v0.1.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- images/custom-error-pages/rootfs/go.mod | 2 +- images/custom-error-pages/rootfs/go.sum | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/images/custom-error-pages/rootfs/go.mod b/images/custom-error-pages/rootfs/go.mod index 515b72c09..2e762d091 100644 --- a/images/custom-error-pages/rootfs/go.mod +++ b/images/custom-error-pages/rootfs/go.mod @@ -12,6 +12,6 @@ require ( github.com/prometheus/client_model v0.2.0 // indirect github.com/prometheus/common v0.26.0 // indirect github.com/prometheus/procfs v0.6.0 // indirect - golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40 // indirect + golang.org/x/sys v0.1.0 // indirect google.golang.org/protobuf v1.28.0 // indirect ) diff --git a/images/custom-error-pages/rootfs/go.sum b/images/custom-error-pages/rootfs/go.sum index d071619b7..a5f86cade 100644 --- a/images/custom-error-pages/rootfs/go.sum +++ b/images/custom-error-pages/rootfs/go.sum @@ -113,8 +113,9 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40 h1:JWgyZ1qgdTaF3N3oxC+MdTV7qvEEgHo3otj+HB5CM7Q= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U= +golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= From 82e836fbe89815ba57dcc1c8f9e370773d6bf291 Mon Sep 17 00:00:00 2001 From: cui fliter Date: Mon, 6 Mar 2023 03:00:57 +0800 Subject: [PATCH 060/822] fix some comments (#9688) Signed-off-by: cui fliter --- docs/developer-guide/code-overview.md | 2 +- images/kube-webhook-certgen/rootfs/pkg/k8s/k8s.go | 2 +- internal/ingress/controller/endpointslices.go | 2 +- internal/ingress/controller/template/template.go | 2 +- magefiles/helm.go | 7 ++++--- pkg/util/ingress/ingress.go | 2 +- test/e2e/settings/ssl_passthrough.go | 2 +- 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/developer-guide/code-overview.md b/docs/developer-guide/code-overview.md index c55fb69f9..a26083c6a 100644 --- a/docs/developer-guide/code-overview.md +++ b/docs/developer-guide/code-overview.md @@ -104,7 +104,7 @@ Describe here `kubectl plugin`, `dbg`, `waitshutdown` and cover the hack scripts ### kubectl plugin -It containes kubectl plugin for inspecting your ingress-nginx deployments. +It contains kubectl plugin for inspecting your ingress-nginx deployments. This part of code can be found in [cmd/plugin](https://github.com/kubernetes/ingress-nginx/tree/main/cmd/plugin) directory Detail functions flow and available flow can be found in [kubectl-plugin](https://github.com/kubernetes/ingress-nginx/blob/main/docs/kubectl-plugin.md) diff --git a/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s.go b/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s.go index 0034235fb..6018b4253 100644 --- a/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s.go +++ b/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s.go @@ -105,7 +105,7 @@ func (k8s *k8s) patchAPIService(ctx context.Context, objectName string, ca []byt return nil } -// PatchWebhookConfigurations will patch validatingWebhook and mutatingWebhook clientConfig configurations with +// patchWebhookConfigurations will patch validatingWebhook and mutatingWebhook clientConfig configurations with // the provided ca data. If failurePolicy is provided, patch all webhooks with this value func (k8s *k8s) patchWebhookConfigurations( ctx context.Context, diff --git a/internal/ingress/controller/endpointslices.go b/internal/ingress/controller/endpointslices.go index 56e7a2dcb..ca6e595c8 100644 --- a/internal/ingress/controller/endpointslices.go +++ b/internal/ingress/controller/endpointslices.go @@ -34,7 +34,7 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) -// getEndpoints returns a list of Endpoint structs for a given service/target port combination. +// getEndpointsFromSlices returns a list of Endpoint structs for a given service/target port combination. func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto corev1.Protocol, zoneForHints string, getServiceEndpointsSlices func(string) ([]*discoveryv1.EndpointSlice, error)) []ingress.Endpoint { diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index ea9807bd0..f3283a782 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -1732,7 +1732,7 @@ func buildServerName(hostname string) string { return `~^(?[\w-]+)\.` + strings.Join(parts, "\\.") + `$` } -// parseComplexNGINXVar parses things like "$my${complex}ngx\$var" into +// parseComplexNginxVarIntoLuaTable parses things like "$my${complex}ngx\$var" into // [["$var", "complex", "my", "ngx"]]. In other words, 2nd and 3rd elements // in the result are actual NGINX variable names, whereas first and 4th elements // are string literals. diff --git a/magefiles/helm.go b/magefiles/helm.go index e69c4e029..93c440584 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -20,14 +20,15 @@ package main import ( "fmt" + "os" + "strings" + semver "github.com/blang/semver/v4" "github.com/helm/helm/pkg/chartutil" "github.com/magefile/mage/mg" "github.com/magefile/mage/sh" yamlpath "github.com/vmware-labs/yaml-jsonpath/pkg/yamlpath" "gopkg.in/yaml.v3" - "os" - "strings" ) const HelmChartPath = "charts/ingress-nginx/Chart.yaml" @@ -114,7 +115,7 @@ func UpdateChartChangelog() { } -// UpdateAppVersion Updates the Helm App Version of Ingress Nginx Controller +// UpdateChartValue Updates the Helm ChartValue func (Helm) UpdateChartValue(key, value string) { updateChartValue(key, value) } diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index 39ca3f883..e69ca7b29 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -46,7 +46,7 @@ func GetRemovedHosts(rucfg, newcfg *ingress.Configuration) []string { return oldSet.Difference(newSet).List() } -// GetRemovedCertificateSerialNumber extracts the difference of certificates between two configurations +// GetRemovedCertificateSerialNumbers extracts the difference of certificates between two configurations func GetRemovedCertificateSerialNumbers(rucfg, newcfg *ingress.Configuration) []string { oldCertificates := sets.NewString() newCertificates := sets.NewString() diff --git a/test/e2e/settings/ssl_passthrough.go b/test/e2e/settings/ssl_passthrough.go index 77a3c990e..a906a2d11 100644 --- a/test/e2e/settings/ssl_passthrough.go +++ b/test/e2e/settings/ssl_passthrough.go @@ -81,7 +81,7 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { host := "testpassthrough.com" echoName := "echopass" - /* Even with enable-ssl-passthrough enabled, only annotated ingresses may receive the trafic */ + /* Even with enable-ssl-passthrough enabled, only annotated ingresses may receive the traffic */ annotations := map[string]string{ "nginx.ingress.kubernetes.io/ssl-passthrough": "true", } From c84003e3b1e34d8a3c8cce6a026c267e37a0fbea Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 5 Mar 2023 12:10:58 -0800 Subject: [PATCH 061/822] Bump golang.org/x/net in /magefiles (#9692) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20220722155237-a158d28d115b to 0.7.0. - [Release notes](https://github.com/golang/net/releases) - [Commits](https://github.com/golang/net/commits/v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- magefiles/go.mod | 2 +- magefiles/go.sum | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/magefiles/go.mod b/magefiles/go.mod index 31c11a061..613e5fb1f 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -23,7 +23,7 @@ require ( github.com/google/go-querystring v1.1.0 // indirect github.com/stretchr/testify v1.8.1 // indirect golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect - golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect + golang.org/x/net v0.7.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.28.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/magefiles/go.sum b/magefiles/go.sum index 38a4235f6..f6b4786a5 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -64,17 +64,17 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 h1:HWj/xjIHfjYU5nVXpTM0s3 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b h1:PxfKdU9lEEDYjdIzOtC4qFWgkU2rGHdKlKowJSMN9h0= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= +golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be h1:vEDujvNQGv4jgYKudGeI/+DAX4Jffq6hpD55MmoEvKs= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k= +golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= -golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk= +golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= From 0bb07bffd02e104b68d3ab7e5603924e8d117bde Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 6 Mar 2023 23:22:18 -0800 Subject: [PATCH 062/822] Bump sigs.k8s.io/controller-runtime from 0.14.2 to 0.14.5 (#9697) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.14.2 to 0.14.5. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.14.2...v0.14.5) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 00765b534..0ffda4dcf 100644 --- a/go.mod +++ b/go.mod @@ -40,7 +40,7 @@ require ( k8s.io/component-base v0.26.1 k8s.io/klog/v2 v2.90.0 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 - sigs.k8s.io/controller-runtime v0.14.2 + sigs.k8s.io/controller-runtime v0.14.5 sigs.k8s.io/mdtoc v1.1.0 ) diff --git a/go.sum b/go.sum index 6274257aa..a9f0db95e 100644 --- a/go.sum +++ b/go.sum @@ -767,8 +767,8 @@ pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/controller-runtime v0.14.2 h1:P6IwDhbsRWsBClt/8/h8Zy36bCuGuW5Op7MHpFrN/60= -sigs.k8s.io/controller-runtime v0.14.2/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= +sigs.k8s.io/controller-runtime v0.14.5 h1:6xaWFqzT5KuAQ9ufgUaj1G/+C4Y1GRkhrxl+BJ9i+5s= +sigs.k8s.io/controller-runtime v0.14.5/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= From ec2fe2b6d1e99202d15b6c0577bcfd69cf461c3a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Mar 2023 11:54:41 -0800 Subject: [PATCH 063/822] Bump github.com/prometheus/common from 0.40.0 to 0.41.0 (#9698) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.40.0 to 0.41.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](https://github.com/prometheus/common/compare/v0.40.0...v0.41.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 0ffda4dcf..e85419dcc 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 - github.com/prometheus/common v0.40.0 + github.com/prometheus/common v0.41.0 github.com/spf13/cobra v1.6.1 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 @@ -100,7 +100,7 @@ require ( go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.7.0 // indirect golang.org/x/net v0.7.0 // indirect - golang.org/x/oauth2 v0.4.0 // indirect + golang.org/x/oauth2 v0.5.0 // indirect golang.org/x/sys v0.5.0 // indirect golang.org/x/term v0.5.0 // indirect golang.org/x/text v0.7.0 // indirect diff --git a/go.sum b/go.sum index a9f0db95e..0729873ef 100644 --- a/go.sum +++ b/go.sum @@ -320,8 +320,8 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= -github.com/prometheus/common v0.40.0 h1:Afz7EVRqGg2Mqqf4JuF9vdvp1pi220m55Pi9T2JnO4Q= -github.com/prometheus/common v0.40.0/go.mod h1:L65ZJPSmfn/UBWLQIHV7dBrKFidB/wPlF1y5TlSt9OE= +github.com/prometheus/common v0.41.0 h1:npo01n6vUlRViIj5fgwiK8vlNIh8bnoxqh3gypKsyAw= +github.com/prometheus/common v0.41.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc= github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= @@ -479,8 +479,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M= -golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec= +golang.org/x/oauth2 v0.5.0 h1:HuArIo48skDwlrvM3sEdHXElYslAMsf3KwRkkW4MC4s= +golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= From 4f74e03aad663c7d72edaa36d8e874f1ebe1aa2d Mon Sep 17 00:00:00 2001 From: Alan Clucas Date: Thu, 9 Mar 2023 15:26:04 +0000 Subject: [PATCH 064/822] Indent values.yaml using 2 instead of 4 spaces (#9656) * Generate values.yaml with indentation of 2 Signed-off-by: Alan Clucas * Fix review comments --------- Signed-off-by: Alan Clucas --- magefiles/helm.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/magefiles/helm.go b/magefiles/helm.go index 93c440584..d56cbed78 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -19,6 +19,7 @@ limitations under the License. package main import ( + "bytes" "fmt" "os" "strings" @@ -146,9 +147,12 @@ func updateChartValue(key, value string) { } //// write to file - newValueFile, err := yaml.Marshal(&n) + var b bytes.Buffer + yamlEncoder := yaml.NewEncoder(&b) + yamlEncoder.SetIndent(2) + err = yamlEncoder.Encode(&n) CheckIfError(err, "HELM Could not Marshal new Values file") - err = os.WriteFile(HelmChartValues, newValueFile, 0644) + err = os.WriteFile(HelmChartValues, b.Bytes(), 0644) CheckIfError(err, "HELM Could not write new Values file to %s", HelmChartValues) Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) From 1b11527f59388e53b84105589508862fa3229417 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 10 Mar 2023 08:54:40 -0800 Subject: [PATCH 065/822] Bump k8s.io/component-base from 0.26.1 to 0.26.2 (#9696) Bumps [k8s.io/component-base](https://github.com/kubernetes/component-base) from 0.26.1 to 0.26.2. - [Release notes](https://github.com/kubernetes/component-base/releases) - [Commits](https://github.com/kubernetes/component-base/compare/v0.26.1...v0.26.2) --- updated-dependencies: - dependency-name: k8s.io/component-base dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index e85419dcc..39e76c331 100644 --- a/go.mod +++ b/go.mod @@ -30,14 +30,14 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.1 + k8s.io/api v0.26.2 k8s.io/apiextensions-apiserver v0.26.1 - k8s.io/apimachinery v0.26.1 + k8s.io/apimachinery v0.26.2 k8s.io/apiserver v0.26.1 k8s.io/cli-runtime v0.26.0 - k8s.io/client-go v0.26.1 + k8s.io/client-go v0.26.2 k8s.io/code-generator v0.26.1 - k8s.io/component-base v0.26.1 + k8s.io/component-base v0.26.2 k8s.io/klog/v2 v2.90.0 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.5 diff --git a/go.sum b/go.sum index 0729873ef..d299919fb 100644 --- a/go.sum +++ b/go.sum @@ -737,22 +737,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.1 h1:f+SWYiPd/GsiWwVRz+NbFyCgvv75Pk9NK6dlkZgpCRQ= -k8s.io/api v0.26.1/go.mod h1:xd/GBNgR0f707+ATNyPmQ1oyKSgndzXij81FzWGsejg= +k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ= +k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU= k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI= k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM= -k8s.io/apimachinery v0.26.1 h1:8EZ/eGJL+hY/MYCNwhmDzVqq2lPl3N3Bo8rvweJwXUQ= -k8s.io/apimachinery v0.26.1/go.mod h1:tnPmbONNJ7ByJNz9+n9kMjNP8ON+1qoAIIC70lztu74= +k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ= +k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= k8s.io/apiserver v0.26.1 h1:6vmnAqCDO194SVCPU3MU8NcDgSqsUA62tBUSWrFXhsc= k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg= k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= -k8s.io/client-go v0.26.1 h1:87CXzYJnAMGaa/IDDfRdhTzxk/wzGZ+/HUQpqgVSZXU= -k8s.io/client-go v0.26.1/go.mod h1:IWNSglg+rQ3OcvDkhY6+QLeasV4OYHDjdqeWkDQZwGE= +k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI= +k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU= k8s.io/code-generator v0.26.1 h1:dusFDsnNSKlMFYhzIM0jAO1OlnTN5WYwQQ+Ai12IIlo= k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= -k8s.io/component-base v0.26.1 h1:4ahudpeQXHZL5kko+iDHqLj/FSGAEUnSVO0EBbgDd+4= -k8s.io/component-base v0.26.1/go.mod h1:VHrLR0b58oC035w6YQiBSbtsf0ThuSwXP+p5dD/kAWU= +k8s.io/component-base v0.26.2 h1:IfWgCGUDzrD6wLLgXEstJKYZKAFS2kO+rBRi0p3LqcI= +k8s.io/component-base v0.26.2/go.mod h1:DxbuIe9M3IZPRxPIzhch2m1eT7uFrSBJUBuVCQEBivs= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= From 67ca41d797bd4471ddb8ac95c7df51c945893e43 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 11 Mar 2023 11:34:41 -0800 Subject: [PATCH 066/822] Bump golang.org/x/crypto in /magefiles (#9691) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.0.0-20210817164053-32db794688a5 to 0.1.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](https://github.com/golang/crypto/commits/v0.1.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- magefiles/go.mod | 2 +- magefiles/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/magefiles/go.mod b/magefiles/go.mod index 613e5fb1f..9ad1e11c9 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -22,7 +22,7 @@ require ( github.com/golang/protobuf v1.5.2 // indirect github.com/google/go-querystring v1.1.0 // indirect github.com/stretchr/testify v1.8.1 // indirect - golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect + golang.org/x/crypto v0.1.0 // indirect golang.org/x/net v0.7.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.28.0 // indirect diff --git a/magefiles/go.sum b/magefiles/go.sum index f6b4786a5..9c0c8ee7f 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -60,8 +60,8 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 h1:HWj/xjIHfjYU5nVXpTM0s39J9CbLn7Cc5a7IC5rwsMQ= -golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU= +golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= From 5dabf2155868f3415520abe74423f2479cef4599 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 11 Mar 2023 11:36:42 -0800 Subject: [PATCH 067/822] Bump k8s.io/klog/v2 from 2.90.0 to 2.90.1 (#9694) Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.90.0 to 2.90.1. - [Release notes](https://github.com/kubernetes/klog/releases) - [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes/klog/compare/v2.90.0...v2.90.1) --- updated-dependencies: - dependency-name: k8s.io/klog/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 39e76c331..bf0f83625 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( k8s.io/client-go v0.26.2 k8s.io/code-generator v0.26.1 k8s.io/component-base v0.26.2 - k8s.io/klog/v2 v2.90.0 + k8s.io/klog/v2 v2.90.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.5 sigs.k8s.io/mdtoc v1.1.0 diff --git a/go.sum b/go.sum index d299919fb..a46367fb7 100644 --- a/go.sum +++ b/go.sum @@ -756,8 +756,8 @@ k8s.io/component-base v0.26.2/go.mod h1:DxbuIe9M3IZPRxPIzhch2m1eT7uFrSBJUBuVCQEB k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.90.0 h1:VkTxIV/FjRXn1fgNNcKGM8cfmL1Z33ZjXRTVxKCoF5M= -k8s.io/klog/v2 v2.90.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw= +k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= From ddcfaecb3c4f6820f570f1ac926f16a3a433f586 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 11 Mar 2023 11:38:39 -0800 Subject: [PATCH 068/822] Bump github.com/onsi/ginkgo/v2 from 2.6.1 to 2.9.0 (#9695) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.6.1 to 2.9.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.6.1...v2.9.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 +++++--- go.sum | 18 +++++++++++------- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index bf0f83625..011d69e63 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/mitchellh/mapstructure v1.5.0 github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 - github.com/onsi/ginkgo/v2 v2.6.1 + github.com/onsi/ginkgo/v2 v2.9.0 github.com/opencontainers/runc v1.1.4 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 @@ -62,6 +62,7 @@ require ( github.com/go-openapi/jsonpointer v0.19.5 // indirect github.com/go-openapi/jsonreference v0.20.0 // indirect github.com/go-openapi/swag v0.19.14 // indirect + github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect github.com/godbus/dbus/v5 v5.0.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect @@ -71,6 +72,7 @@ require ( github.com/google/gnostic v0.5.7-v3refs // indirect github.com/google/go-cmp v0.5.9 // indirect github.com/google/gofuzz v1.1.0 // indirect + github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.3.0 // indirect github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect @@ -98,14 +100,14 @@ require ( github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect - golang.org/x/mod v0.7.0 // indirect + golang.org/x/mod v0.8.0 // indirect golang.org/x/net v0.7.0 // indirect golang.org/x/oauth2 v0.5.0 // indirect golang.org/x/sys v0.5.0 // indirect golang.org/x/term v0.5.0 // indirect golang.org/x/text v0.7.0 // indirect golang.org/x/time v0.3.0 // indirect - golang.org/x/tools v0.4.0 // indirect + golang.org/x/tools v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect google.golang.org/protobuf v1.28.1 // indirect diff --git a/go.sum b/go.sum index a46367fb7..1c709138d 100644 --- a/go.sum +++ b/go.sum @@ -118,6 +118,7 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro= @@ -187,6 +188,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE= +github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= @@ -200,6 +203,7 @@ github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc= @@ -285,11 +289,11 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= -github.com/onsi/ginkgo/v2 v2.6.1 h1:1xQPCjcqYw/J5LchOcp4/2q/jzJFjiAOc25chhnDw+Q= -github.com/onsi/ginkgo/v2 v2.6.1/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo= +github.com/onsi/ginkgo/v2 v2.9.0 h1:Tugw2BKlNHTMfG+CheOITkYvk4LAh6MFOvikhGVnhE8= +github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxmrTcxyk= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= -github.com/onsi/gomega v1.24.1 h1:KORJXNNTzJXzu4ScJWssJfJMnJ+2QJqhoQSRwNlze9E= +github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754= github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= @@ -435,8 +439,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA= -golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -604,8 +608,8 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.4.0 h1:7mTAgkunk3fr4GAloyyCasadO6h9zSsQZbwvcaIciV4= -golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= +golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 66a760794f91809bcd897cbdb45435653d73fd92 Mon Sep 17 00:00:00 2001 From: James Strong Date: Sat, 11 Mar 2023 23:38:39 -0500 Subject: [PATCH 069/822] update to golang 1.20 (#9690) update alpine and golang remove nano update go modules remove need for openssl external cli fix stale Signed-off-by: James Strong --- .github/workflows/ci.yaml | 12 +++++------ .github/workflows/plugin.yaml | 2 +- .github/workflows/stale.yaml | 4 ++-- go.mod | 4 ++-- go.sum | 4 ++-- images/cfssl/rootfs/Dockerfile | 2 +- images/custom-error-pages/rootfs/Dockerfile | 2 +- images/custom-error-pages/rootfs/go.mod | 2 +- .../rootfs/Dockerfile | 2 +- images/ext-auth-example-authsvc/rootfs/go.mod | 2 +- images/ext-auth-example-authsvc/rootfs/go.sum | 21 +++++++++++++++++-- images/fastcgi-helloserver/rootfs/Dockerfile | 2 +- .../go-grpc-greeter-server/rootfs/Dockerfile | 2 +- images/httpbin/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/go.mod | 2 +- images/nginx/rootfs/Dockerfile | 5 ++--- images/opentelemetry/rootfs/Dockerfile | 4 ++-- images/test-runner/Makefile | 2 +- magefiles/go.mod | 2 +- rootfs/Dockerfile-chroot | 4 ++-- test/e2e-image/Dockerfile | 2 +- test/e2e/annotations/auth.go | 8 ++++--- test/e2e/settings/no_auth_locations.go | 5 +++-- 24 files changed, 59 insertions(+), 40 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 61f5970db..b9a400747 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -88,7 +88,7 @@ jobs: id: go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: Run Lint @@ -107,7 +107,7 @@ jobs: id: go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: Run go-fmt @@ -126,7 +126,7 @@ jobs: id: go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: Run test @@ -147,7 +147,7 @@ jobs: id: go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: Set up QEMU @@ -213,7 +213,7 @@ jobs: - name: Setup Go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: cache @@ -485,7 +485,7 @@ jobs: if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: '1.19' + go-version: '1.20' check-latest: true - name: kube-webhook-certgen image build diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 779cd1da8..cb0f73489 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -24,7 +24,7 @@ jobs: - name: Set up Go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 with: - go-version: 1.19 + go-version: 1.20 check-latest: true - name: Run GoReleaser diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 736585e05..8a172d370 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -15,8 +15,8 @@ jobs: steps: - uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0 with: - stale-issue-message: 'This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack.' - stale-pr-message: 'This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack.' + stale-issue-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack." + stale-pr-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack." stale-issue-label: lifecycle/frozen stale-pr-label: lifecycle/frozen days-before-issue-stale: 30 diff --git a/go.mod b/go.mod index 011d69e63..a653632f5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx -go 1.19 +go 1.20 require ( github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a @@ -93,7 +93,7 @@ require ( github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/prometheus/procfs v0.8.0 // indirect + github.com/prometheus/procfs v0.9.0 // indirect github.com/sergi/go-diff v1.1.0 // indirect github.com/sirupsen/logrus v1.8.1 // indirect github.com/xlab/treeprint v1.1.0 // indirect diff --git a/go.sum b/go.sum index 1c709138d..ff41229cf 100644 --- a/go.sum +++ b/go.sum @@ -332,8 +332,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= -github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo= -github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4= +github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= +github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8= diff --git a/images/cfssl/rootfs/Dockerfile b/images/cfssl/rootfs/Dockerfile index f9370c210..7841e189c 100644 --- a/images/cfssl/rootfs/Dockerfile +++ b/images/cfssl/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.0 +FROM alpine:3.17.2 RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories RUN apk add --no-cache \ diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index ef825dec1..942228eac 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.19.4-alpine3.17 as builder +FROM golang:1.20.1-alpine3.17 as builder RUN apk add git WORKDIR /go/src/k8s.io/ingress-nginx/images/custom-error-pages diff --git a/images/custom-error-pages/rootfs/go.mod b/images/custom-error-pages/rootfs/go.mod index 2e762d091..89e47a4b5 100644 --- a/images/custom-error-pages/rootfs/go.mod +++ b/images/custom-error-pages/rootfs/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx/custom-error-pages -go 1.19 +go 1.20 require github.com/prometheus/client_golang v1.11.1 diff --git a/images/ext-auth-example-authsvc/rootfs/Dockerfile b/images/ext-auth-example-authsvc/rootfs/Dockerfile index d54df8ab9..c604651d4 100644 --- a/images/ext-auth-example-authsvc/rootfs/Dockerfile +++ b/images/ext-auth-example-authsvc/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.19.4-alpine3.17 as builder +FROM golang:1.20.1-alpine3.17 as builder RUN mkdir /authsvc WORKDIR /authsvc COPY . ./ diff --git a/images/ext-auth-example-authsvc/rootfs/go.mod b/images/ext-auth-example-authsvc/rootfs/go.mod index 0be630b8b..cc5124072 100644 --- a/images/ext-auth-example-authsvc/rootfs/go.mod +++ b/images/ext-auth-example-authsvc/rootfs/go.mod @@ -1,6 +1,6 @@ module example.com/authsvc -go 1.19 +go 1.20 require k8s.io/apimachinery v0.23.1 diff --git a/images/ext-auth-example-authsvc/rootfs/go.sum b/images/ext-auth-example-authsvc/rootfs/go.sum index 2ca056fae..6e3fab295 100644 --- a/images/ext-auth-example-authsvc/rootfs/go.sum +++ b/images/ext-auth-example-authsvc/rootfs/go.sum @@ -105,7 +105,19 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= +golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= +golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -129,7 +141,12 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile index 0213baf87..7d9220ddf 100755 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.19.4-alpine3.17 as builder +FROM golang:1.20.1-alpine3.17 as builder WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi diff --git a/images/go-grpc-greeter-server/rootfs/Dockerfile b/images/go-grpc-greeter-server/rootfs/Dockerfile index 547842512..67aed038e 100644 --- a/images/go-grpc-greeter-server/rootfs/Dockerfile +++ b/images/go-grpc-greeter-server/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.19.4-alpine3.17 as build +FROM golang:1.20.1-alpine3.17 as build WORKDIR /go/src/greeter-server diff --git a/images/httpbin/rootfs/Dockerfile b/images/httpbin/rootfs/Dockerfile index 1a9b55ba5..0e490be74 100644 --- a/images/httpbin/rootfs/Dockerfile +++ b/images/httpbin/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.0 +FROM alpine:3.17.2 ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 diff --git a/images/kube-webhook-certgen/rootfs/Dockerfile b/images/kube-webhook-certgen/rootfs/Dockerfile index 32847fd39..40a2c31ac 100644 --- a/images/kube-webhook-certgen/rootfs/Dockerfile +++ b/images/kube-webhook-certgen/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM --platform=$BUILDPLATFORM golang:1.19.4 as builder +FROM --platform=$BUILDPLATFORM golang:1.20.1 as builder ARG BUILDPLATFORM ARG TARGETARCH diff --git a/images/kube-webhook-certgen/rootfs/go.mod b/images/kube-webhook-certgen/rootfs/go.mod index a6e2b7ed2..49f95828f 100644 --- a/images/kube-webhook-certgen/rootfs/go.mod +++ b/images/kube-webhook-certgen/rootfs/go.mod @@ -1,6 +1,6 @@ module github.com/jet/kube-webhook-certgen -go 1.19 +go 1.20 require ( github.com/onrik/logrus v0.9.0 diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index a9b01ff82..3279af5d5 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -11,7 +11,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.0 as builder +FROM alpine:3.17.2 as builder COPY . / @@ -21,7 +21,7 @@ RUN apk update \ && /build.sh # Use a multi-stage build -FROM alpine:3.17.0 +FROM alpine:3.17.2 ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin @@ -49,7 +49,6 @@ RUN apk update \ libmaxminddb \ yaml-cpp \ dumb-init \ - nano \ tzdata \ && ln -s /usr/local/nginx/sbin/nginx /sbin/nginx \ && adduser -S -D -H -u 101 -h /usr/local/nginx \ diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index aa4e219af..33f5bcb36 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -13,7 +13,7 @@ # limitations under the License. -FROM alpine:3.17.0 as base +FROM alpine:3.17.2 as base RUN mkdir -p /opt/third_party/install COPY . /opt/third_party/ @@ -39,7 +39,7 @@ COPY --from=grpc /opt/third_party/install/ /usr COPY --from=otel-cpp /opt/third_party/install/ /usr RUN bash /opt/third_party/build.sh -n -FROM alpine:3.17.0 as final +FROM alpine:3.17.2 as final COPY --from=base /opt/third_party/init_module.sh /usr/local/bin/init_module.sh COPY --from=nginx /etc/nginx/modules /etc/nginx/modules COPY --from=nginx /opt/third_party/install/lib /etc/nginx/modules diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 4d71b8ad5..a8c3a4560 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -39,7 +39,7 @@ build: ensure-buildx --progress=$(PROGRESS) \ --pull \ --build-arg BASE_IMAGE=$(NGINX_BASE_IMAGE) \ - --build-arg GOLANG_VERSION=1.19.4 \ + --build-arg GOLANG_VERSION=1.20.1 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.24.2 \ --build-arg RESTY_CLI_VERSION=0.27 \ diff --git a/magefiles/go.mod b/magefiles/go.mod index 9ad1e11c9..40b909600 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -1,6 +1,6 @@ module github.com/kubernetes/ingress-nginx/magefiles -go 1.19 +go 1.20 require ( github.com/blang/semver/v4 v4.0.0 diff --git a/rootfs/Dockerfile-chroot b/rootfs/Dockerfile-chroot index bdb9be60b..7ab8584a7 100644 --- a/rootfs/Dockerfile-chroot +++ b/rootfs/Dockerfile-chroot @@ -23,7 +23,7 @@ RUN apk update \ && apk upgrade \ && /chroot.sh -FROM alpine:3.17.0 +FROM alpine:3.17.2 ARG TARGETARCH ARG VERSION @@ -49,8 +49,8 @@ RUN apk update \ && apk upgrade \ && apk add -U --no-cache \ bash \ - curl \ openssl \ + curl \ ca-certificates \ dumb-init \ tzdata \ diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index ab4ba5026..09ce36cc5 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -1,7 +1,7 @@ ARG E2E_BASE_IMAGE FROM ${E2E_BASE_IMAGE} AS BASE -FROM alpine:3.16.2 +FROM alpine:3.17.2 RUN apk add -U --no-cache \ ca-certificates \ diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 1f0f4c3b2..e3d0bcb2e 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -19,9 +19,9 @@ package annotations import ( "context" "fmt" + "golang.org/x/crypto/bcrypt" "net/http" "net/url" - "os/exec" "regexp" "strings" "time" @@ -899,7 +899,8 @@ http { // Auth error func buildSecret(username, password, name, namespace string) *corev1.Secret { - out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + out, err := bcrypt.GenerateFromPassword([]byte(password), 14) encpass := fmt.Sprintf("%v:%s\n", username, out) assert.Nil(ginkgo.GinkgoT(), err) @@ -917,7 +918,8 @@ func buildSecret(username, password, name, namespace string) *corev1.Secret { } func buildMapSecret(username, password, name, namespace string) *corev1.Secret { - out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err) return &corev1.Secret{ diff --git a/test/e2e/settings/no_auth_locations.go b/test/e2e/settings/no_auth_locations.go index 70ec3be8f..2fc4b6455 100644 --- a/test/e2e/settings/no_auth_locations.go +++ b/test/e2e/settings/no_auth_locations.go @@ -18,8 +18,8 @@ package settings import ( "fmt" + "golang.org/x/crypto/bcrypt" "net/http" - "os/exec" "strings" "github.com/onsi/ginkgo/v2" @@ -147,7 +147,8 @@ func buildBasicAuthIngressWithSecondPath(host, namespace, secretName, pathName s } func buildSecret(username, password, name, namespace string) *corev1.Secret { - out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() + out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err, "creating password") encpass := fmt.Sprintf("%v:%s\n", username, out) From f93d11b4cf549c4c443c0d81cf15fbecfd0b3388 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 12 Mar 2023 05:18:40 -0700 Subject: [PATCH 070/822] Bump helm/chart-releaser-action from 1.4.1 to 1.5.0 (#9720) Bumps [helm/chart-releaser-action](https://github.com/helm/chart-releaser-action) from 1.4.1 to 1.5.0. - [Release notes](https://github.com/helm/chart-releaser-action/releases) - [Commits](https://github.com/helm/chart-releaser-action/compare/98bccfd32b0f76149d188912ac8e45ddd3f8695f...be16258da8010256c6e82849661221415f031968) --- updated-dependencies: - dependency-name: helm/chart-releaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/helm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 2bd271bb2..b1db0c1d8 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -73,7 +73,7 @@ jobs: git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com" - name: Helm Chart Releaser - uses: helm/chart-releaser-action@98bccfd32b0f76149d188912ac8e45ddd3f8695f # v1.4.1 + uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0 env: CR_SKIP_EXISTING: "false" CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" From b87645fe5318dc6fe9b00b3d9c6c25b5098d9e0e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 12 Mar 2023 05:20:40 -0700 Subject: [PATCH 071/822] Bump docker/setup-buildx-action from 2.2.1 to 2.5.0 (#9719) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.2.1 to 2.5.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8c0edbc76e98fa90f69d9a2c020dcb50019dc325...4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b9a400747..db9f69c41 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -155,7 +155,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1 + uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0 with: version: latest From e2d076c4fc52f6c9cdcf9af93d9ae41821303faa Mon Sep 17 00:00:00 2001 From: Do Hoang Khiem Date: Tue, 14 Mar 2023 18:32:18 +0700 Subject: [PATCH 072/822] HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731) --- charts/ingress-nginx/README.md | 1 + charts/ingress-nginx/templates/default-backend-hpa.yaml | 2 +- charts/ingress-nginx/values.yaml | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 49bb38273..5e7fa85a1 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -456,6 +456,7 @@ Kubernetes: `>=1.20.0-0` | controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false | | defaultBackend.affinity | object | `{}` | | | defaultBackend.autoscaling.annotations | object | `{}` | | +| defaultBackend.autoscaling.apiVersion | string | `"autoscaling/v2"` | | | defaultBackend.autoscaling.enabled | bool | `false` | | | defaultBackend.autoscaling.maxReplicas | int | `2` | | | defaultBackend.autoscaling.minReplicas | int | `1` | | diff --git a/charts/ingress-nginx/templates/default-backend-hpa.yaml b/charts/ingress-nginx/templates/default-backend-hpa.yaml index 594d26525..f9ae0b276 100644 --- a/charts/ingress-nginx/templates/default-backend-hpa.yaml +++ b/charts/ingress-nginx/templates/default-backend-hpa.yaml @@ -1,5 +1,5 @@ {{- if and .Values.defaultBackend.enabled .Values.defaultBackend.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 +apiVersion: {{ .Values.defaultBackend.autoscaling.apiVersion }} kind: HorizontalPodAutoscaler metadata: labels: diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 202cd4a23..031078499 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -827,6 +827,7 @@ defaultBackend: # emptyDir: {} autoscaling: + apiVersion: autoscaling/v2 annotations: {} enabled: false minReplicas: 1 From 520384b1103d8382c857c0f86551dab2343eda2c Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Tue, 14 Mar 2023 17:06:17 +0530 Subject: [PATCH 073/822] bumped ginkgo to v2.9.0 (#9722) --- build/run-in-docker.sh | 2 +- images/test-runner/rootfs/Dockerfile | 2 +- test/e2e/run-chart-test.sh | 2 +- test/e2e/run-kind-e2e.sh | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 44ca2d5f7..d375c4336 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -87,7 +87,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then echo "..reached DIND check TRUE block, inside run-in-docker.sh" echo "FLAGS=$FLAGS" #go env - go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 + go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 find / -type f -name ginkgo 2>/dev/null which ginkgo /bin/bash -c "${FLAGS}" diff --git a/images/test-runner/rootfs/Dockerfile b/images/test-runner/rootfs/Dockerfile index 1e8bc3643..7872b7a2b 100644 --- a/images/test-runner/rootfs/Dockerfile +++ b/images/test-runner/rootfs/Dockerfile @@ -55,7 +55,7 @@ ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH" -RUN go install github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 && go install golang.org/x/lint/golint@latest +RUN go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 && go install golang.org/x/lint/golint@latest ARG RESTY_CLI_VERSION ARG RESTY_CLI_SHA diff --git a/test/e2e/run-chart-test.sh b/test/e2e/run-chart-test.sh index d01ab4486..813e296cf 100755 --- a/test/e2e/run-chart-test.sh +++ b/test/e2e/run-chart-test.sh @@ -78,7 +78,7 @@ fi if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 fi echo "[dev-env] building image" make -C ${DIR}/../../ clean-image build image diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index df927bd1c..d3ea18b6d 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -95,7 +95,7 @@ fi if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.6.1 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 fi echo "[dev-env] .. done building controller images" @@ -112,4 +112,4 @@ echo "[dev-env] copying docker images to cluster..." kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes="${KIND_WORKERS}" nginx-ingress-controller:e2e kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes="${KIND_WORKERS}" "${REGISTRY}"/controller:"${TAG}" echo "[dev-env] running e2e tests..." -make -C "${DIR}"/../../ e2e-test \ No newline at end of file +make -C "${DIR}"/../../ e2e-test From 47eb3a17fd95e9205dbe0c6bdb474ac4603f498d Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Tue, 14 Mar 2023 14:44:17 +0100 Subject: [PATCH 074/822] Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732) --- charts/ingress-nginx/templates/controller-daemonset.yaml | 2 +- charts/ingress-nginx/templates/controller-deployment.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index e6721566b..efa273dac 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -33,7 +33,7 @@ spec: {{- end }} {{- end }} labels: - {{- include "ingress-nginx.selectorLabels" . | nindent 8 }} + {{- include "ingress-nginx.labels" . | nindent 8 }} app.kubernetes.io/component: controller {{- with .Values.controller.labels }} {{- toYaml . | nindent 8 }} diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 9f1cf70db..36d7670e3 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -37,7 +37,7 @@ spec: {{- end }} {{- end }} labels: - {{- include "ingress-nginx.selectorLabels" . | nindent 8 }} + {{- include "ingress-nginx.labels" . | nindent 8 }} app.kubernetes.io/component: controller {{- with .Values.controller.labels }} {{- toYaml . | nindent 8 }} From 2d15a9946b0017d0888b59066862c48f09ad6fa3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:22:17 -0700 Subject: [PATCH 075/822] Bump actions/upload-artifact from 3.1.1 to 3.1.2 (#9717) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3.1.1 to 3.1.2. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/83fd05a356d7e2593de66fc9913b3002723633cb...0b7f8abb1508181956e8e162db84b466c27e18ce) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 6 +++--- .github/workflows/scorecards.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index db9f69c41..56d87c000 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -188,7 +188,7 @@ jobs: | pigz > docker.tar.gz - name: cache - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: docker.tar.gz path: docker.tar.gz @@ -320,7 +320,7 @@ jobs: make kind-e2e-test - name: Uplaod e2e junit-reports - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 if: success() || failure() with: name: e2e-test-reports-${{ matrix.k8s }} @@ -375,7 +375,7 @@ jobs: make kind-e2e-test - name: Uplaod e2e junit-reports - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 if: success() || failure() with: name: e2e-test-reports-chroot-${{ matrix.k8s }} diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 6af70e691..8a3af47de 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -51,7 +51,7 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # v3.1.1 + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 with: name: SARIF file path: results.sarif From 7a95a43df63627d7fe1a4db6eceb1c83bf556d8f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:24:23 -0700 Subject: [PATCH 076/822] Bump goreleaser/goreleaser-action from 4.1.0 to 4.2.0 (#9718) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/8f67e590f2d095516493f017008adc464e63adb1...f82d6c1c344bcacabba2c841718984797f664a6b) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index cb0f73489..760420765 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -28,7 +28,7 @@ jobs: check-latest: true - name: Run GoReleaser - uses: goreleaser/goreleaser-action@8f67e590f2d095516493f017008adc464e63adb1 # v4.1.0 + uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0 with: version: latest args: release --rm-dist From 778577253e612181114e694028105e046d16c90e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:26:18 -0700 Subject: [PATCH 077/822] Bump actions/download-artifact from 3.0.1 to 3.0.2 (#9721) Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/9782bd6a9848b53b110e712e20e42d89988822b7...9bc31d5ccc31df68ecc42ccf4149144866c47d8a) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 56d87c000..00049bddf 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -217,7 +217,7 @@ jobs: check-latest: true - name: cache - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 with: name: docker.tar.gz @@ -291,7 +291,7 @@ jobs: uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 - name: cache - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 with: name: docker.tar.gz @@ -345,7 +345,7 @@ jobs: uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 - name: cache - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1 + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 with: name: docker.tar.gz From 4d443962d698ce022e71db4373ce48ef6b5964c2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:28:16 -0700 Subject: [PATCH 078/822] Bump golang.org/x/crypto from 0.6.0 to 0.7.0 (#9723) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](https://github.com/golang/crypto/compare/v0.6.0...v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index a653632f5..9144ff337 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.2 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.6.0 + golang.org/x/crypto v0.7.0 google.golang.org/grpc v1.53.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -101,11 +101,11 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.8.0 // indirect - golang.org/x/net v0.7.0 // indirect + golang.org/x/net v0.8.0 // indirect golang.org/x/oauth2 v0.5.0 // indirect - golang.org/x/sys v0.5.0 // indirect - golang.org/x/term v0.5.0 // indirect - golang.org/x/text v0.7.0 // indirect + golang.org/x/sys v0.6.0 // indirect + golang.org/x/term v0.6.0 // indirect + golang.org/x/text v0.8.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index ff41229cf..813771bbc 100644 --- a/go.sum +++ b/go.sum @@ -407,8 +407,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= -golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= +golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A= +golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -475,8 +475,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -546,19 +546,19 @@ golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From ce18c5e552158ff512afd8034de361fc42a2b381 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:30:17 -0700 Subject: [PATCH 079/822] Bump github.com/prometheus/common from 0.41.0 to 0.42.0 (#9724) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.41.0 to 0.42.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](https://github.com/prometheus/common/compare/v0.41.0...v0.42.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9144ff337..4c4bc903a 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 - github.com/prometheus/common v0.41.0 + github.com/prometheus/common v0.42.0 github.com/spf13/cobra v1.6.1 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 diff --git a/go.sum b/go.sum index 813771bbc..c3a2152b7 100644 --- a/go.sum +++ b/go.sum @@ -324,8 +324,8 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= -github.com/prometheus/common v0.41.0 h1:npo01n6vUlRViIj5fgwiK8vlNIh8bnoxqh3gypKsyAw= -github.com/prometheus/common v0.41.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc= +github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM= +github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc= github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= From dba7ae04f5074ef49d1a61811660ad00680f0e6c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Mar 2023 07:32:16 -0700 Subject: [PATCH 080/822] Bump actions/dependency-review-action from 3.0.2 to 3.0.3 (#9727) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.0.2 to 3.0.3. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/0ff3da6f81b812d4ec3cf37a04e2308c7a723730...c090f4e553673e6e505ea70d6a95362ee12adb94) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/depreview.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 758e4b95f..0ecdcd55c 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -11,4 +11,4 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 - name: 'Dependency Review' - uses: actions/dependency-review-action@0ff3da6f81b812d4ec3cf37a04e2308c7a723730 # v3.0.2 + uses: actions/dependency-review-action@c090f4e553673e6e505ea70d6a95362ee12adb94 # v3.0.3 From 3cd4ff93fe6cef93665604fd490f100fe65a3f53 Mon Sep 17 00:00:00 2001 From: longwuyuan Date: Wed, 15 Mar 2023 23:44:25 +0530 Subject: [PATCH 081/822] changed test-runner-image tag and sha --- build/run-in-docker.sh | 2 +- test/e2e-image/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index d375c4336..3a6aeb43d 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20221221-controller-v1.5.1-62-g6ffaef32a@sha256:8f025472964cd15ae2d379503aba150565a8d78eb36b41ddfc5f1e3b1ca81a8e} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index f89bf6bf2..001146f65 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE="registry.k8s.io/ingress-nginx/e2e-test-runner:v20221221-controller-v1.5.1-62-g6ffaef32a@sha256:8f025472964cd15ae2d379503aba150565a8d78eb36b41ddfc5f1e3b1ca81a8e" +E2E_BASE_IMAGE="registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035" image: echo "..entered Makefile in /test/e2e-image" From 2324ad0d0556d07aa39c4b8872e1b8419f338e33 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Thu, 16 Mar 2023 13:57:18 +0530 Subject: [PATCH 082/822] updated NGINX_BASE image with latest tag (#9747) --- NGINX_BASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NGINX_BASE b/NGINX_BASE index 72093c593..bf23fa5a7 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:21aa7f55a3325c1c26de0dfb62ede4c0a809a994@sha256:da6b877ed96dada46ed6e379051c2dd461dd5d329af7a7531820ad3e16197e20 \ No newline at end of file +registry.k8s.io/ingress-nginx/nginx:66a760794f91809bcd897cbdb45435653d73fd92@sha256:86c1581e69dc92d107f8edd36724890ea682a3afda8c1fb1ba41aabc7bc0128d \ No newline at end of file From 58e5a2c01f72bd1e4d9e924d5059b29350577d76 Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Fri, 17 Mar 2023 02:39:16 +0100 Subject: [PATCH 083/822] Chart: Drop `controller.headers`, rework DH param secret. (#9659) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/templates/NOTES.txt | 7 ------- .../controller-configmap-proxyheaders.yaml | 9 ++------- .../templates/controller-configmap.yaml | 7 +++---- .../templates/controller-secret.yaml | 15 +++++++++++++++ .../ingress-nginx/templates/dh-param-secret.yaml | 10 ---------- charts/ingress-nginx/values.yaml | 2 +- 7 files changed, 22 insertions(+), 30 deletions(-) create mode 100644 charts/ingress-nginx/templates/controller-secret.yaml delete mode 100644 charts/ingress-nginx/templates/dh-param-secret.yaml diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 5e7fa85a1..a72805054 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -509,7 +509,7 @@ Kubernetes: `>=1.20.0-0` | defaultBackend.serviceAccount.name | string | `""` | | | defaultBackend.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # | | defaultBackend.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # | -| dhParam | string | `nil` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param | +| dhParam | string | `""` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param | | imagePullSecrets | list | `[]` | Optional array of imagePullSecrets containing private registry credentials # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ | | podSecurityPolicy.enabled | bool | `false` | | | portNamePrefix | string | `""` | Prefix for TCP and UDP ports names in ingress controller service # Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration | diff --git a/charts/ingress-nginx/templates/NOTES.txt b/charts/ingress-nginx/templates/NOTES.txt index 8985c56c0..9fe35c785 100644 --- a/charts/ingress-nginx/templates/NOTES.txt +++ b/charts/ingress-nginx/templates/NOTES.txt @@ -71,10 +71,3 @@ If TLS is enabled for the Ingress, a Secret containing the certificate and key m tls.crt: tls.key: type: kubernetes.io/tls - -{{- if .Values.controller.headers }} -################################################################################# -###### WARNING: `controller.headers` has been deprecated! ##### -###### It has been renamed to `controller.proxySetHeaders`. ##### -################################################################################# -{{- end }} diff --git a/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml b/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml index f8d15faf9..38feb721f 100644 --- a/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml +++ b/charts/ingress-nginx/templates/controller-configmap-proxyheaders.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.controller.proxySetHeaders .Values.controller.headers -}} +{{- if .Values.controller.proxySetHeaders -}} apiVersion: v1 kind: ConfigMap metadata: @@ -10,10 +10,5 @@ metadata: {{- end }} name: {{ include "ingress-nginx.fullname" . }}-custom-proxy-headers namespace: {{ .Release.Namespace }} -data: -{{- if .Values.controller.proxySetHeaders }} -{{ toYaml .Values.controller.proxySetHeaders | indent 2 }} -{{ else if and .Values.controller.headers (not .Values.controller.proxySetHeaders) }} -{{ toYaml .Values.controller.headers | indent 2 }} -{{- end }} +data: {{ toYaml .Values.controller.proxySetHeaders | nindent 2 }} {{- end }} diff --git a/charts/ingress-nginx/templates/controller-configmap.yaml b/charts/ingress-nginx/templates/controller-configmap.yaml index f28b26e1e..9ec2b8369 100644 --- a/charts/ingress-nginx/templates/controller-configmap.yaml +++ b/charts/ingress-nginx/templates/controller-configmap.yaml @@ -17,13 +17,12 @@ data: {{- if .Values.controller.addHeaders }} add-headers: {{ .Release.Namespace }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers {{- end }} -{{- if or .Values.controller.proxySetHeaders .Values.controller.headers }} +{{- if .Values.controller.proxySetHeaders }} proxy-set-headers: {{ .Release.Namespace }}/{{ include "ingress-nginx.fullname" . }}-custom-proxy-headers {{- end }} {{- if .Values.dhParam }} - ssl-dh-param: {{ printf "%s/%s" .Release.Namespace (include "ingress-nginx.controller.fullname" .) }} + ssl-dh-param: {{ .Release.Namespace }}/{{ include "ingress-nginx.controller.fullname" . }} {{- end }} {{- range $key, $value := .Values.controller.config }} - {{- $key | nindent 2 }}: {{ $value | quote }} + {{- $key | nindent 2 }}: {{ $value | quote }} {{- end }} - diff --git a/charts/ingress-nginx/templates/controller-secret.yaml b/charts/ingress-nginx/templates/controller-secret.yaml new file mode 100644 index 000000000..f3744232f --- /dev/null +++ b/charts/ingress-nginx/templates/controller-secret.yaml @@ -0,0 +1,15 @@ +{{- if .Values.dhParam -}} +apiVersion: v1 +kind: Secret +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + dhparam.pem: {{ .Values.dhParam }} +{{- end }} diff --git a/charts/ingress-nginx/templates/dh-param-secret.yaml b/charts/ingress-nginx/templates/dh-param-secret.yaml deleted file mode 100644 index 12e7a4f63..000000000 --- a/charts/ingress-nginx/templates/dh-param-secret.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{{- with .Values.dhParam -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "ingress-nginx.controller.fullname" $ }} - labels: - {{- include "ingress-nginx.labels" $ | nindent 4 }} -data: - dhparam.pem: {{ . }} -{{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 031078499..1fab6f52a 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -886,4 +886,4 @@ portNamePrefix: "" # -- (string) A base64-encoded Diffie-Hellman parameter. # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param -dhParam: +dhParam: "" From fec1dbe3a122089a92c1f794fa2ca6b389640d49 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Sun, 19 Mar 2023 03:43:16 +0530 Subject: [PATCH 084/822] changes Makefile of echo folder to trigger code-build (#9754) --- images/echo/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/echo/Makefile b/images/echo/Makefile index 500704e81..0ab1c945f 100644 --- a/images/echo/Makefile +++ b/images/echo/Makefile @@ -4,7 +4,7 @@ # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, From 1e629fae1d12a6bf3151f709ecdb96b5b1165ebb Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Sun, 19 Mar 2023 03:45:16 +0530 Subject: [PATCH 085/822] added upgrade ginkgo documentation for contributors (#9753) --- ginkgo_upgrade.md | 131 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 131 insertions(+) create mode 100644 ginkgo_upgrade.md diff --git a/ginkgo_upgrade.md b/ginkgo_upgrade.md new file mode 100644 index 000000000..1ed996cd1 --- /dev/null +++ b/ginkgo_upgrade.md @@ -0,0 +1,131 @@ +# GINKGO UPGRADE + +#### Bumping ginkgo in the project requires four PRs. + +## 1. Dependabot PR + +- Dependabot automatically updates `ginkgo version` but only in [go.mod ](go.mod) and [go.sum ](go.sum) files. +- This is an automatically generated PR by Dependabot but it needs approval from maintainers to get merged. + +## 2. Edit-hardcoded-version PR + +### a. Make changes to appropriate files in required directories + +- Make changes in files where gingko version is hardcoded. These files are : + - [run-in-docker.sh ](build/run-in-docker.sh) + - [Dockerfile ](images/test-runner/rootfs/Dockerfile) + - [run.sh ](test/e2e/run.sh) + - [run-chart-test.sh ](test/e2e/run-chart-test.sh) + +### b. Create PR + +- Open pull request(s) accordingly, to fire cloudbuild for building the component's image (if applicable). + +### c. Merge + +- Merging will fire cloudbuild, which will result in images being promoted to the [staging container registry](https://console.cloud.google.com/gcr/images/k8s-staging-ingress-nginx). + +### d. Make sure cloudbuild is a success + +- Wait for [cloud build](https://console.cloud.google.com/cloud-build/builds?project=k8s-staging-ingress-nginx). If you don't have access to cloudbuild, you can also have a look at [this](https://prow.k8s.io/?repo=kubernetes%2Fingress-nginx&job=post-*), to see the progress of the build. + +- Proceed only after cloud-build is successful in building a new Ingress-Nginx-Controller image. + + +## 3. PROMOTE the new-testrunner-image PR: + +Promoting the images basically means that images, that were pushed to staging container registry in the steps above, now are also pushed to the public container registry. Thus are publicly available. Follow these steps to promote images: +- When you make changes to the `Dockerfile` or other core content under [images directory ](images), it generates a new image in google cloudbuild. This is because kubernetes projects need to use the infra provided for the kubernetes projects. The new image is always only pushed to the staging repository of K8S. From the staging repo, the new image needs to be promoted to the production repo. And once promoted, its possible to use the sha of the new image in the code. + +### a. Get the sha + +- Get the sha of the new image(s) of the controller, from the cloudbuild, from steps above + + - The sha is available in output from [cloud build](https://console.cloud.google.com/cloud-build/builds?project=k8s-staging-ingress-nginx) + + - The sha is also visible [here](https://console.cloud.google.com/gcr/images/k8s-staging-ingress-nginx/global/e2e-test-runner) + + - The sha is also visible [here]((https://prow.k8s.io/?repo=kubernetes%2Fingress-nginx&job=post-*)), after cloud build is finished. Click on the respective job, go to `Artifacts` section in the UI, then again `artifacts` in the directory browser. In the `build.log` at the very bottom you see something like this: + + ``` + ... + pushing manifest for gcr.io/k8s-staging-ingress-nginx/controller:v1.0.2@sha256:e15fac6e8474d77e1f017edc33d804ce72a184e3c0a30963b2a0d7f0b89f6b16 + ... + ``` + +### b. Add the new image to [k8s.io](http://github.com/kubernetes/k8s.io) + +- The sha(s) from the step before (and the tag(s) for the new image(s) have to be added, as a new line, in a file, of the [k8s.io](http://github.com/kubernetes/k8s.io) project of Kubernetes organization. + +- Fork that other project (if you don't have a fork already). + +- Other project to fork [Github repo kubernetes/k8s.io](http://github.com/kubernetes/k8s.io) + +- Fetch --all and rebase to upstream if already forked. + +- Create a branch in your fork, named as the issue number for this release + +- In the related branch, of your fork, edit the file k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml. + +- For making it easier, you can edit your branch directly in the browser. But be careful about making any mistake. + +- Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml) Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/4499) to see how it was done before + +- Save and commit + +### c. Create PR + +- Open pull request to promote the new e2e-test-runner image. + +### d. Merge + +- Merge success is required. + +- Proceed only after cloud-build is successful in building a new e2e-test-runner image. + + +## 4. Change testrunner-image-sha PR + +### a. Get the sha + +- Make sure to get the tag and sha of the promoted image from the step before, either from cloudbuild or from [here](https://console.cloud.google.com/gcr/images/k8s-artifacts-prod/us/ingress-nginx/e2e-test-runner). + +### a. Make sure your git workspace is ready + +- Get your git workspace ready + + - If not using a pre-existing fork, then Fork the repo kubernetes/ingress-nginx + + - Clone (to laptop or wherever) + + - Add upstream + + - Set upstream url to no_push + + - Checkout & switch to branch, named as per related new-release-issue-number + + - If already forked, and upstream already added, then `git fetch --all` and `git rebase upstream/main` (not origin) + + - Checkout a branch in your fork's clone + + - Perform any other diligence as needed + +- Prefer to edit only and only in your branch, in your Fork + +### b. Change testrunner-image-sha + +- You need update the testrunner-image-sha in the following files : + + - [run-in-docker.sh](https://github.com/kubernetes/ingress-nginx/blob/main/build/run-in-docker.sh#L41) + - [Makefile](https://github.com/kubernetes/ingress-nginx/blob/main/test/e2e-image/Makefile#L3) + +### c. Create PR + +- Look at this PR for how it was done before [example PR](https://github.com/kubernetes/ingress-nginx/pull/9444) +- Create a PR + +### d. Merge + +- Finally merge the PR. + +## END ## \ No newline at end of file From 6eb52c39c8d964e3e23d537a23c1aadb1befb3fd Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Sun, 19 Mar 2023 03:47:15 +0530 Subject: [PATCH 086/822] updated nginx-error digest and tags (#9755) --- .../custom-errors/custom-default-backend.helm.values.yaml | 2 +- .../customization/custom-errors/custom-default-backend.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml b/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml index 670208559..807da71a4 100644 --- a/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml +++ b/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml @@ -6,7 +6,7 @@ defaultBackend: image: registry: registry.k8s.io image: ingress-nginx/nginx-errors - tag: "v20220916-gd32f8c343@sha256:09c421ac743bace19ab77979b82186941c5125c95e62cdb40bdf41293b5c275c" + tag: "v20230312-helm-chart-4.5.2-28-g66a760794@sha256:332be6ff8c4e93e8845963932f98839dfd52ae49829c29e06475368a3e4fbd9e" extraVolumes: - name: custom-error-pages configMap: diff --git a/docs/examples/customization/custom-errors/custom-default-backend.yaml b/docs/examples/customization/custom-errors/custom-default-backend.yaml index 072beab3b..5fc5c55e4 100644 --- a/docs/examples/customization/custom-errors/custom-default-backend.yaml +++ b/docs/examples/customization/custom-errors/custom-default-backend.yaml @@ -36,7 +36,7 @@ spec: spec: containers: - name: nginx-error-server - image: registry.k8s.io/ingress-nginx/nginx-errors:v20220916-gd32f8c343@sha256:09c421ac743bace19ab77979b82186941c5125c95e62cdb40bdf41293b5c275c + image: registry.k8s.io/ingress-nginx/nginx-errors:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:332be6ff8c4e93e8845963932f98839dfd52ae49829c29e06475368a3e4fbd9e ports: - containerPort: 8080 # Setting the environment variable DEBUG we can see the headers sent From 45dae623c74515382d3566a3643c105d0f6d2b2e Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Sun, 19 Mar 2023 21:29:16 +0530 Subject: [PATCH 087/822] updated kube-webhook-certgen digest and tags (#9756) --- charts/ingress-nginx/README.md | 4 ++-- charts/ingress-nginx/values.yaml | 4 ++-- deploy/static/provider/aws/deploy.yaml | 4 ++-- .../static/provider/aws/nlb-with-tls-termination/deploy.yaml | 4 ++-- deploy/static/provider/baremetal/deploy.yaml | 4 ++-- deploy/static/provider/cloud/deploy.yaml | 4 ++-- deploy/static/provider/do/deploy.yaml | 4 ++-- deploy/static/provider/exoscale/deploy.yaml | 4 ++-- deploy/static/provider/kind/deploy.yaml | 4 ++-- deploy/static/provider/scw/deploy.yaml | 4 ++-- 10 files changed, 20 insertions(+), 20 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index a72805054..6725bb2bb 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -271,11 +271,11 @@ Kubernetes: `>=1.20.0-0` | controller.admissionWebhooks.networkPolicyEnabled | bool | `false` | | | controller.admissionWebhooks.objectSelector | object | `{}` | | | controller.admissionWebhooks.patch.enabled | bool | `true` | | -| controller.admissionWebhooks.patch.image.digest | string | `"sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f"` | | +| controller.admissionWebhooks.patch.image.digest | string | `"sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f"` | | | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | | | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | | | controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | | -| controller.admissionWebhooks.patch.image.tag | string | `"v20220916-gd32f8c343"` | | +| controller.admissionWebhooks.patch.image.tag | string | `"v20230312-helm-chart-4.5.2-28-g66a760794"` | | | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources | | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | | | controller.admissionWebhooks.patch.podAnnotations | object | `{}` | | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 1fab6f52a..f6064911a 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -598,8 +598,8 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: v20220916-gd32f8c343 - digest: sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + tag: v20230312-helm-chart-4.5.2-28-g66a760794 + digest: sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f pullPolicy: IfNotPresent # -- Provide a priority class name to the webhook patching job ## diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 487340a73..bf4ffce19 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -537,7 +537,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -586,7 +586,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 4763623c8..0b58831a3 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -549,7 +549,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -598,7 +598,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index a642d67da..d141e8ca6 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -531,7 +531,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -580,7 +580,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 8b09efac1..97c22739b 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -533,7 +533,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -582,7 +582,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 7461d9794..5b7c86670 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -536,7 +536,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -585,7 +585,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index be0e2f587..c8236ef20 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -542,7 +542,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -591,7 +591,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index abb310999..a8fd055c9 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -547,7 +547,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -596,7 +596,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index fdc3c6cde..1f04b9b9e 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -536,7 +536,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: create securityContext: @@ -585,7 +585,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f imagePullPolicy: IfNotPresent name: patch securityContext: From 1f4fb4133240794cdd2fcc2c1b5171ff5b8b9d01 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Sun, 19 Mar 2023 21:33:16 +0530 Subject: [PATCH 088/822] updated digest and sha for e2e-test-cfssl (#9757) --- test/e2e/settings/ocsp/ocsp.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index adf4351e7..483013f59 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -290,7 +290,7 @@ func ocspserveDeployment(namespace string) (*appsv1.Deployment, *corev1.Service) Containers: []corev1.Container{ { Name: name, - Image: "registry.k8s.io/ingress-nginx/e2e-test-cfssl@sha256:c1b273763048944dd7d22d37adfc65be4fa6a5f6068204292573c6cdc5ea3457", + Image: "registry.k8s.io/ingress-nginx/e2e-test-cfssl@sha256:d02c1e18f573449966999fc850f1fed3d37621bf77797562cbe77ebdb06a66ea", Command: []string{ "/bin/bash", "-c", From 18c3a91a0462b8182a2ff61461f002f32749aaef Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Mon, 20 Mar 2023 01:13:16 +0530 Subject: [PATCH 089/822] updated digest and sha for opentelemetry (#9758) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 6725bb2bb..6da71a144 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -395,7 +395,7 @@ Kubernetes: `>=1.20.0-0` | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # | | controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | controller.opentelemetry.enabled | bool | `false` | | -| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9"` | | +| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f"` | | | controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # | | controller.podLabels | object | `{}` | Labels to add to the pod container metadata | | controller.podSecurityContext | object | `{}` | Security Context policies for controller pods | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index f6064911a..f043c17cb 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -536,7 +536,7 @@ controller: opentelemetry: enabled: false - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9 + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f containerSecurityContext: allowPrivilegeEscalation: false admissionWebhooks: From f75b12e690151d6a2e1f692ff22fc01152cbd162 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Mon, 20 Mar 2023 01:17:16 +0530 Subject: [PATCH 090/822] updated digest and sha for e2e-test-fastcgi-helloserver (#9759) --- test/e2e/framework/fastcgi_helloserver.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/framework/fastcgi_helloserver.go b/test/e2e/framework/fastcgi_helloserver.go index c3e89c7f5..719048c06 100644 --- a/test/e2e/framework/fastcgi_helloserver.go +++ b/test/e2e/framework/fastcgi_helloserver.go @@ -58,7 +58,7 @@ func (f *Framework) NewNewFastCGIHelloServerDeploymentWithReplicas(replicas int3 Containers: []corev1.Container{ { Name: "fastcgi-helloserver", - Image: "registry.k8s.io/ingress-nginx/e2e-test-fastcgi-helloserver@sha256:723b8187e1768d199b93fd939c37c1ce9427dcbca72ec6415f4d890bca637fcc", + Image: "registry.k8s.io/ingress-nginx/e2e-test-fastcgi-helloserver@sha256:0e08c836cc58f1ea862578de99b13bc4264fe071e816f96dc1d79857bfba7473", Env: []corev1.EnvVar{}, Ports: []corev1.ContainerPort{ { From 2d3554794314139e87ac47c3f75e5f6f5d48a467 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Mon, 20 Mar 2023 01:17:24 +0530 Subject: [PATCH 091/822] updated digest and sha for e2e-test-echo (#9760) --- .../customization/external-auth-headers/echo-service.yaml | 2 +- test/e2e/framework/deployment.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/examples/customization/external-auth-headers/echo-service.yaml b/docs/examples/customization/external-auth-headers/echo-service.yaml index 0fe37be56..57df4d628 100644 --- a/docs/examples/customization/external-auth-headers/echo-service.yaml +++ b/docs/examples/customization/external-auth-headers/echo-service.yaml @@ -18,7 +18,7 @@ spec: terminationGracePeriodSeconds: 60 containers: - name: echo-service - image: registry.k8s.io/ingress-nginx/e2e-test-echo:v20220819-ga98c63787@sha256:778ac6d1188c8de8ecabeddd3c37b72c8adc8c712bad2bd7a81fb23a3514934c + image: registry.k8s.io/ingress-nginx/e2e-test-echo:v20230318-helm-chart-4.5.2-44-gfec1dbe3a@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a ports: - containerPort: 8080 resources: diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 8115fd12e..4627a8892 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -93,7 +93,7 @@ func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { o(options) } - deployment := newDeployment(options.name, options.namespace, "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:778ac6d1188c8de8ecabeddd3c37b72c8adc8c712bad2bd7a81fb23a3514934c", 80, int32(options.replicas), + deployment := newDeployment(options.name, options.namespace, "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a", 80, int32(options.replicas), nil, nil, nil, []corev1.VolumeMount{}, []corev1.Volume{}, From 9a1cfc7181d0afc1e405962c5308abaa0501b751 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Mar 2023 11:01:37 +0000 Subject: [PATCH 092/822] Bump securego/gosec from 2.14.0 to 2.15.0 Bumps [securego/gosec](https://github.com/securego/gosec) from 2.14.0 to 2.15.0. - [Release notes](https://github.com/securego/gosec/releases) - [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml) - [Commits](https://github.com/securego/gosec/compare/1af1d5bb49259b62e45c505db397dd2ada5d74f8...a459eb0ba387d9bd083d5c2e2354dbeef2465038) --- updated-dependencies: - dependency-name: securego/gosec dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 00049bddf..3d7c21c3d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -68,7 +68,7 @@ jobs: uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 - name: Run Gosec Security Scanner - uses: securego/gosec@1af1d5bb49259b62e45c505db397dd2ada5d74f8 # v2.14.0 + uses: securego/gosec@a459eb0ba387d9bd083d5c2e2354dbeef2465038 # v2.15.0 with: # G601 for zz_generated.deepcopy.go # G306 TODO: Expect WriteFile permissions to be 0600 or less From 12da492f0112a5833f6437e00a485c23562856b2 Mon Sep 17 00:00:00 2001 From: Ole-Martin Bratteng <1681525+omBratteng@users.noreply.github.com> Date: Mon, 20 Mar 2023 13:05:18 +0100 Subject: [PATCH 093/822] docs(helm): fix value key in readme for enabling certManager (#9640) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/README.md.gotmpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 6da71a144..9659df139 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -228,7 +228,7 @@ A validating and configuration requires the endpoint to which the request is sen #### Alternatives It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. -You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enable` value to true. +You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. Please ensure that cert-manager is correctly installed and configured. diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index 78e4f38d4..99a2a62cb 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -227,7 +227,7 @@ A validating and configuration requires the endpoint to which the request is sen #### Alternatives It should be possible to use [cert-manager/cert-manager](https://github.com/cert-manager/cert-manager) if a more complete solution is required. -You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enable` value to true. +You can enable automatic self-signed TLS certificate provisioning via cert-manager by setting the `controller.admissionWebhooks.certManager.enabled` value to true. Please ensure that cert-manager is correctly installed and configured. From 1936973ea9d95b62fe8077e1cb36b2471d2c16b8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Mar 2023 09:33:19 -0700 Subject: [PATCH 094/822] Bump actions/add-to-project from 0.4.0 to 0.4.1 (#9765) Bumps [actions/add-to-project](https://github.com/actions/add-to-project) from 0.4.0 to 0.4.1. - [Release notes](https://github.com/actions/add-to-project/releases) - [Commits](https://github.com/actions/add-to-project/compare/960fbad431afda394cfcf8743445e741acd19e85...4756e6330fe1e0a736690d3cfd9f11c9399c2ed4) --- updated-dependencies: - dependency-name: actions/add-to-project dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/project.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index d75435712..35d6d3e5c 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -13,7 +13,7 @@ jobs: repository-projects: write issues: write steps: - - uses: actions/add-to-project@960fbad431afda394cfcf8743445e741acd19e85 # v0.4.0 + - uses: actions/add-to-project@4756e6330fe1e0a736690d3cfd9f11c9399c2ed4 # v0.4.1 with: project-url: https://github.com/orgs/kubernetes/projects/104 github-token: ${{ secrets.PROJECT_WRITER }} From 5c0b70764395832d243cd6647aa384c891c453da Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Mar 2023 06:33:08 -0700 Subject: [PATCH 095/822] Bump actions/dependency-review-action from 3.0.3 to 3.0.4 (#9766) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.0.3 to 3.0.4. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/c090f4e553673e6e505ea70d6a95362ee12adb94...f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/depreview.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 0ecdcd55c..571610dc6 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -11,4 +11,4 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 - name: 'Dependency Review' - uses: actions/dependency-review-action@c090f4e553673e6e505ea70d6a95362ee12adb94 # v3.0.3 + uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e # v3.0.4 From 9b3599206c0b5789523678a7f09d8c12d9f41cb7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Mar 2023 06:35:10 -0700 Subject: [PATCH 096/822] Bump k8s.io/component-base from 0.26.2 to 0.26.3 (#9764) Bumps [k8s.io/component-base](https://github.com/kubernetes/component-base) from 0.26.2 to 0.26.3. - [Release notes](https://github.com/kubernetes/component-base/releases) - [Commits](https://github.com/kubernetes/component-base/compare/v0.26.2...v0.26.3) --- updated-dependencies: - dependency-name: k8s.io/component-base dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 4c4bc903a..f351bae17 100644 --- a/go.mod +++ b/go.mod @@ -30,14 +30,14 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.2 + k8s.io/api v0.26.3 k8s.io/apiextensions-apiserver v0.26.1 - k8s.io/apimachinery v0.26.2 + k8s.io/apimachinery v0.26.3 k8s.io/apiserver v0.26.1 k8s.io/cli-runtime v0.26.0 - k8s.io/client-go v0.26.2 + k8s.io/client-go v0.26.3 k8s.io/code-generator v0.26.1 - k8s.io/component-base v0.26.2 + k8s.io/component-base v0.26.3 k8s.io/klog/v2 v2.90.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.5 diff --git a/go.sum b/go.sum index c3a2152b7..00918fc47 100644 --- a/go.sum +++ b/go.sum @@ -741,22 +741,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.2 h1:dM3cinp3PGB6asOySalOZxEG4CZ0IAdJsrYZXE/ovGQ= -k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU= +k8s.io/api v0.26.3 h1:emf74GIQMTik01Aum9dPP0gAypL8JTLl/lHa4V9RFSU= +k8s.io/api v0.26.3/go.mod h1:PXsqwPMXBSBcL1lJ9CYDKy7kIReUydukS5JiRlxC3qE= k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI= k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM= -k8s.io/apimachinery v0.26.2 h1:da1u3D5wfR5u2RpLhE/ZtZS2P7QvDgLZTi9wrNZl/tQ= -k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= +k8s.io/apimachinery v0.26.3 h1:dQx6PNETJ7nODU3XPtrwkfuubs6w7sX0M8n61zHIV/k= +k8s.io/apimachinery v0.26.3/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= k8s.io/apiserver v0.26.1 h1:6vmnAqCDO194SVCPU3MU8NcDgSqsUA62tBUSWrFXhsc= k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg= k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= -k8s.io/client-go v0.26.2 h1:s1WkVujHX3kTp4Zn4yGNFK+dlDXy1bAAkIl+cFAiuYI= -k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU= +k8s.io/client-go v0.26.3 h1:k1UY+KXfkxV2ScEL3gilKcF7761xkYsSD6BC9szIu8s= +k8s.io/client-go v0.26.3/go.mod h1:ZPNu9lm8/dbRIPAgteN30RSXea6vrCpFvq+MateTUuQ= k8s.io/code-generator v0.26.1 h1:dusFDsnNSKlMFYhzIM0jAO1OlnTN5WYwQQ+Ai12IIlo= k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= -k8s.io/component-base v0.26.2 h1:IfWgCGUDzrD6wLLgXEstJKYZKAFS2kO+rBRi0p3LqcI= -k8s.io/component-base v0.26.2/go.mod h1:DxbuIe9M3IZPRxPIzhch2m1eT7uFrSBJUBuVCQEBivs= +k8s.io/component-base v0.26.3 h1:oC0WMK/ggcbGDTkdcqefI4wIZRYdK3JySx9/HADpV0g= +k8s.io/component-base v0.26.3/go.mod h1:5kj1kZYwSC6ZstHJN7oHBqcJC6yyn41eR+Sqa/mQc8E= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= From 00bfb2e84a3cbbce501d5e23cf112772cae6eb0e Mon Sep 17 00:00:00 2001 From: Adam Jacques Date: Tue, 21 Mar 2023 06:37:08 -0700 Subject: [PATCH 097/822] Fix several Helm YAML issues with extraModules and extraInitContainers (#9709) * Fix indention issue for DaemonSets when using extraModules and extraInitContainers * Improve documentation * Unify and fix templating * Enable support for the opentelemetry from values.yaml --- .../templates/controller-daemonset.yaml | 19 ++++++++----------- .../templates/controller-deployment.yaml | 2 +- charts/ingress-nginx/values.yaml | 2 ++ 3 files changed, 11 insertions(+), 12 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index efa273dac..bce21a7d6 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -178,17 +178,14 @@ spec: {{- end }} {{- if .Values.controller.extraModules }} {{- range .Values.controller.extraModules }} - - name: {{ .Name }} - image: {{ .Image }} - command: ['sh', '-c', '/usr/local/bin/init_module.sh'] - {{- if (or $.Values.controller.containerSecurityContext .containerSecurityContext) }} - securityContext: {{ .containerSecurityContext | default $.Values.controller.containerSecurityContext | toYaml | nindent 14 }} - {{- end }} - volumeMounts: - - name: modules - mountPath: /modules_mount + {{ $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} +{{ include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | indent 8 }} {{- end }} {{- end }} + {{- if .Values.controller.opentelemetry.enabled}} + {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}} + {{- end}} {{- end }} {{- if .Values.controller.hostNetwork }} hostNetwork: {{ .Values.controller.hostNetwork }} @@ -207,9 +204,9 @@ spec: {{- end }} serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }} volumes: - {{- if .Values.controller.extraModules }} + {{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}} - name: modules emptyDir: {} {{- end }} diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 36d7670e3..323d87623 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -185,7 +185,7 @@ spec: {{- if .Values.controller.extraModules }} {{- range .Values.controller.extraModules }} {{ $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext | nindent 8) }} +{{ include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | indent 8 }} {{- end }} {{- end }} {{- if .Values.controller.opentelemetry.enabled}} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index f043c17cb..1a538f810 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -527,6 +527,8 @@ controller: # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module extraModules: [] + # - name: mytestmodule + # image: registry.k8s.io/ingress-nginx/mytestmodule # containerSecurityContext: # allowPrivilegeEscalation: false # From 9e097fb79d1e8f0eb792107167f6a707ee9f0b3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Mar 2023 06:39:07 -0700 Subject: [PATCH 098/822] Bump aquasecurity/trivy-action from 0.8.0 to 0.9.2 (#9767) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.8.0 to 0.9.2. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/9ab158e8597f3b310480b9a69402b419bc03dbd5...1f0aa582c8c8f5f7639610d6d38baddfea4fdcee) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index b19031ff6..88ba16fa2 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -60,7 +60,7 @@ jobs: - name: Scan image with AquaSec/Trivy id: scan - uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5 # v0.8.0 + uses: aquasecurity/trivy-action@1f0aa582c8c8f5f7639610d6d38baddfea4fdcee # v0.9.2 with: image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }} format: 'sarif' From e3c9382fc927cfbdfaa7a006b5ef2b0c332242d1 Mon Sep 17 00:00:00 2001 From: Taehyun Kim Date: Tue, 21 Mar 2023 22:41:08 +0900 Subject: [PATCH 099/822] fix: controller psp's volume config (#9740) * fix: controller psp's volume config * revert chart version --- charts/ingress-nginx/templates/controller-psp.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-psp.yaml b/charts/ingress-nginx/templates/controller-psp.yaml index 2e0499ce9..3c499b9d4 100644 --- a/charts/ingress-nginx/templates/controller-psp.yaml +++ b/charts/ingress-nginx/templates/controller-psp.yaml @@ -28,9 +28,9 @@ spec: volumes: - 'configMap' - 'emptyDir' - #- 'projected' + - 'projected' - 'secret' - #- 'downwardAPI' + - 'downwardAPI' {{- if .Values.controller.hostNetwork }} hostNetwork: {{ .Values.controller.hostNetwork }} {{- end }} From 43168a7fe119b8e6a8b99944fa29e94b46a1e216 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Mar 2023 13:42:46 +0000 Subject: [PATCH 100/822] Bump actions/checkout from 3.2.0 to 3.4.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 3.2.0 to 3.4.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/755da8c3cf115ac066823e79a1e1788f8940201b...24cb9080177205b6e8c946b17badbe402adc938f) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yaml | 22 +++++++++++----------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3d7c21c3d..3ce77b419 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -39,7 +39,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -65,7 +65,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Run Gosec Security Scanner uses: securego/gosec@a459eb0ba387d9bd083d5c2e2354dbeef2465038 # v2.15.0 @@ -82,7 +82,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Set up Go id: go @@ -101,7 +101,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Set up Go id: go @@ -120,7 +120,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Set up Go id: go @@ -141,7 +141,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Set up Go id: go @@ -208,7 +208,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Setup Go uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 @@ -288,7 +288,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -342,7 +342,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -391,7 +391,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -464,7 +464,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 571610dc6..46a587ded 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: 'Dependency Review' uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e # v3.0.4 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 241921ecf..3ab49ef10 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index b1db0c1d8..4e7fde34f 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 89dfdfad6..dd31420bf 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 760420765..87ba6aca9 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 8a3af47de..529cc7c28 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 88ba16fa2..9649140ec 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0 + uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - shell: bash id: test From e4a66fd2f625de3bcc7aaa793b31f529a0662009 Mon Sep 17 00:00:00 2001 From: Sergei Kaznakhovskii Date: Tue, 21 Mar 2023 07:47:09 -0600 Subject: [PATCH 101/822] Fix canary-weight-total annotation ignored in rule backends (#9729) * Missed canary weight total - added canary weight total for spec rules * - added e2e test --- internal/ingress/controller/controller.go | 30 +++++++++++------------ test/e2e/annotations/canary.go | 27 ++++++++++++++++++++ 2 files changed, 42 insertions(+), 15 deletions(-) diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 1914765d8..20f8c8687 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -33,6 +33,7 @@ import ( "k8s.io/apimachinery/pkg/util/wait" clientset "k8s.io/client-go/kubernetes" "k8s.io/ingress-nginx/internal/ingress/annotations" + "k8s.io/ingress-nginx/internal/ingress/annotations/canary" "k8s.io/ingress-nginx/internal/ingress/annotations/log" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/annotations/proxy" @@ -968,14 +969,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[defBackend].NoServer = true - upstreams[defBackend].TrafficShapingPolicy = ingress.TrafficShapingPolicy{ - Weight: anns.Canary.Weight, - WeightTotal: anns.Canary.WeightTotal, - Header: anns.Canary.Header, - HeaderValue: anns.Canary.HeaderValue, - HeaderPattern: anns.Canary.HeaderPattern, - Cookie: anns.Canary.Cookie, - } + upstreams[defBackend].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) } if len(upstreams[defBackend].Endpoints) == 0 { @@ -1040,13 +1034,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[name].NoServer = true - upstreams[name].TrafficShapingPolicy = ingress.TrafficShapingPolicy{ - Weight: anns.Canary.Weight, - Header: anns.Canary.Header, - HeaderValue: anns.Canary.HeaderValue, - HeaderPattern: anns.Canary.HeaderPattern, - Cookie: anns.Canary.Cookie, - } + upstreams[name].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) } if len(upstreams[name].Endpoints) == 0 { @@ -1819,3 +1807,15 @@ func (n *NGINXController) getStreamSnippets(ingresses []*ingress.Ingress) []stri } return snippets } + +// newTrafficShapingPolicy creates new ingress.TrafficShapingPolicy instance using canary configuration +func newTrafficShapingPolicy(cfg canary.Config) ingress.TrafficShapingPolicy { + return ingress.TrafficShapingPolicy{ + Weight: cfg.Weight, + WeightTotal: cfg.WeightTotal, + Header: cfg.Header, + HeaderValue: cfg.HeaderValue, + HeaderPattern: cfg.HeaderPattern, + Cookie: cfg.Cookie, + } +} diff --git a/test/e2e/annotations/canary.go b/test/e2e/annotations/canary.go index 893a4dc8b..6dd81fdd8 100644 --- a/test/e2e/annotations/canary.go +++ b/test/e2e/annotations/canary.go @@ -830,6 +830,33 @@ var _ = framework.DescribeAnnotation("canary-*", func() { TestMainlineCanaryDistribution(f, host) }) + + ginkgo.It("should route requests split between mainline and canary if canary weight is 100 and weight total is 200", func() { + host := "foo" + annotations := map[string]string{} + + ing := framework.NewSingleIngress(host, "/", host, + f.Namespace, framework.EchoService, 80, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "server_name foo") + }) + + canaryIngName := fmt.Sprintf("%v-canary", host) + canaryAnnotations := map[string]string{ + "nginx.ingress.kubernetes.io/canary": "true", + "nginx.ingress.kubernetes.io/canary-weight": "100", + "nginx.ingress.kubernetes.io/canary-weight-total": "200", + } + + canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, + f.Namespace, canaryService, 80, canaryAnnotations) + f.EnsureIngress(canaryIng) + + TestMainlineCanaryDistribution(f, host) + }) }) ginkgo.Context("Single canary Ingress", func() { From c075793ae5ee52e28cf8420c33cf3b73022161e1 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 21 Mar 2023 16:34:12 -0400 Subject: [PATCH 102/822] drop k8s 1.23 support (#9772) Signed-off-by: James Strong --- .github/workflows/ci.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3ce77b419..c2c108638 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -204,7 +204,7 @@ jobs: strategy: matrix: - k8s: [v1.23.13, v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.7, v1.25.3, v1.26.0] steps: - name: Checkout @@ -284,7 +284,7 @@ jobs: strategy: matrix: - k8s: [v1.23.13, v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.7, v1.25.3, v1.26.0] steps: - name: Checkout @@ -337,7 +337,7 @@ jobs: strategy: matrix: - k8s: [v1.23.13, v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.7, v1.25.3, v1.26.0] steps: @@ -460,7 +460,7 @@ jobs: strategy: matrix: - k8s: [v1.23.13, v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.7, v1.25.3, v1.26.0] steps: - name: Checkout From c8cb9167d3bfe6a2ed50796e179b3aec648a7e16 Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Wed, 22 Mar 2023 19:58:22 +0100 Subject: [PATCH 103/822] feat: OpenTelemetry module integration (#9062) * OpenTelemetry module integration * e2e test * e2e test fix * default OpentelemetryConfig * e2e values * mount otel module for otel test only * propagate IS_CHROOT * propagate IS_CHROOT e2e test * code doc * comments * golint * opentelemetry doc * zipkin * zipkin * typo * update e2e test OpenTelemetry value * use opentelemetry value * revert merge conflict * fix * format * review comments * clean --- docs/images/otel-grafana-demo.png | Bin 0 -> 123976 bytes docs/images/otel-jaeger-demo.png | Bin 0 -> 120283 bytes docs/images/otel-zipkin-demo.png | Bin 0 -> 133964 bytes docs/kubectl-plugin.md | 1 + .../nginx-configuration/annotations.md | 20 ++ .../nginx-configuration/configmap.md | 53 ++++ .../third-party-addons/opentelemetry.md | 260 ++++++++++++++++++ internal/ingress/annotations/annotations.go | 3 + .../ingress/annotations/opentelemetry/main.go | 101 +++++++ .../annotations/opentelemetry/main_test.go | 170 ++++++++++++ internal/ingress/controller/config/config.go | 55 ++++ internal/ingress/controller/controller.go | 1 + internal/ingress/controller/nginx.go | 43 +++ .../ingress/controller/template/template.go | 96 +++++++ .../controller/template/template_test.go | 153 +++++++++++ mkdocs.yml | 1 + pkg/apis/ingress/types.go | 4 + pkg/apis/ingress/types_equals.go | 4 + rootfs/etc/nginx/template/nginx.tmpl | 26 ++ test/e2e/framework/exec.go | 7 +- test/e2e/run-e2e-suite.sh | 1 + test/e2e/settings/opentelemetry.go | 119 ++++++++ test/e2e/wait-for-nginx.sh | 15 +- 23 files changed, 1131 insertions(+), 2 deletions(-) create mode 100644 docs/images/otel-grafana-demo.png create mode 100644 docs/images/otel-jaeger-demo.png create mode 100644 docs/images/otel-zipkin-demo.png mode change 100755 => 100644 docs/user-guide/nginx-configuration/configmap.md create mode 100644 docs/user-guide/third-party-addons/opentelemetry.md create mode 100644 internal/ingress/annotations/opentelemetry/main.go create mode 100644 internal/ingress/annotations/opentelemetry/main_test.go mode change 100755 => 100644 rootfs/etc/nginx/template/nginx.tmpl create mode 100644 test/e2e/settings/opentelemetry.go diff --git a/docs/images/otel-grafana-demo.png b/docs/images/otel-grafana-demo.png new file mode 100644 index 0000000000000000000000000000000000000000..61b50c8612dc1aaa80de0bc416dc683f39bd201a GIT binary patch literal 123976 zcmd43cQo7o`#-FUQlqWX(xQ{1cI??IYLD1z)r?pzp>~JSR?*sf6GX&{5qqmWB4*5@ zgxE8}Fa3PJpYNxApL3u4KKCE@xvz5^uROh8*Xud1`M9q5tfiquL&Z!*Mn*=X{NlL| z85vbN8QJ;F%jBeyGSP@o(yw!FI!e#Tiu&%XkUm_rd#e7FjI1Q$%8BJA(q~H77e;Pm zWGo@Sf6hfLZrPBLo#iM$f2#Y|Yz=$GLU-i-*%n)*+``4c^ov(6wvnCBxuvjK@>n?f zOXerxfe-1=3>LW16l3S%ij@`&H$sm^QCIY}xLUs$IzIWJV5Ix)x*^pk#cyP)AFf}$ z4vf5eMi3KnvlH}EyM8rt16tQp?TPQ1I*@+t@1_xjq5Rx&ku;}22|WN>y7uP)={oP) z`MiG&eWE(2`;VdLL1bM27|MJ`#_*3J?R)QjZ{8pDF7K+`@16OBGCeu zMXhsx4_#&We>ANeWn5sZRW9`(55IF&PpqQ5|BA#=!@r}@IMhU}9&+<_+y!Q&m&o_9QmR=Iid2NN>&M6nDS$+xR?X%k0ZUtAy~Yy9z8r>>3F@l+z5UI)&V z&wR=Fua$*Gu}BD80%ZeUWO=M|^pM`Jg`6-jY%YUpbmt)p$*%oY%>sep(l^Nvp6V7@$l=SVswJ* z?&O=8xEP~|8ROx4IOvpguCv)cb>Al@=jK9Fa^uGgaRTiL&IYf;W8+|jyXIU+xvdGd zI|d03Iur$h?w`D#h)UP%YP)hIIT0>)JRPn3vKYhx#rm zF~x5)M29GTS@Q)+cGKUNfn}h=P6f6eusnehE^hA8jE@vk96Z958L76c+{HCm&lac+ z7w1tsWyW=xKjj!&QM|b#P@{HugNzKo>k;P1nB7ab$))H#N~ZeUge`B z{upwtBysgZm7E-#z6XEIrZJ!AiLXQ4kJR&I@7lZaDTH6Y$@G{lA3vCy%1e`me>Sx% zco=95B13|PZ!HhvJ=p$ub{5Te&v#X7g0wAiRzER8_0s$BowpMp0f+1N99ILi9^?Vu zF|ReGePR6LA+eb8@sJmDK$Es_q@~C$%wj%>k8UF0W^KdXP4A&|i8z zi}viH)IIE$V5HUryv`*6e=B`h7`-G!#e*B#vF05K6fQlbypo}~`X%izBVj*qUYk-< zckb)h4=N7ZIVsW!12meBzhO=4vF8iULL@b20cwYUzce%bJr$UUrk8=Rkre1^9$Sz> z)O|?X#?!y11Tb`VoR8lNh|0a}MKW>k8vL#8)UYDjSZ|$deXY6--M?9$+ph3;5K!O{ znsaY+3DLrWelH+4N&osyp>B!8K|A+K7 zg+Dt4=Hj!4!{dZjgMlfXR-ID0XR@@h8B`cyJdc5wvRu#UfKHuVw6ZXWw7QEwXN?)D!IY zk?ktNk1dq{x-WMtqRvW zI#Wn0qsyh^1C23A{mbva3&t4+-VI90+N2}#2s298uqFaCoNsV`WBvyh+V|87BbFpT z^sc=F9l>?9uJQ06)47)4HvH*w2I*B*&u|Jcqmj?j?!EhxxU)C9Nw9NhM^iEn^{SC< z<$q{4TH!M3oB$q31f4J_<=d?i2wKDr31JQWLMt9IlkmD9yt4Ph_M!LWjM_+`xNUX` zlN9jEFz}~PR@-e`aI3s(kD*N@;NFe`jl|?vF7xj8h@rLGw=@A#s#YjrH;xVSoUbKJ z#>?R(BlaJ1eNzm)suA9NBbh=Ia9`@tV7Bu;v=IH2Z(FLg7fChKx9n$Ret4Y}xTftG znh2;TCF(5b`tRm(j?hjboF_FqrnnKBpDs;{#kl(m(B6;9@|1~th#;nT*| z3T+yODBVjN4H*V0za!#5D7{4dsAd+?^KQlXt&8k%o$q%{FLS}yn7+%k$F}yT=u-zL z#n4fW(N7@m9>c1KIkJSzV0Zp38yxi@G;OEZ8|!RNzHzLN`uy^(HPCY%uR_hG_EGOuFsbku>Emx~uj8bWT{0 zX$P98sp?s1G47OD?ODi9y^aWn7g8#@A%C??0{ZiRXb919Z+^|L>u zh#ya~**OfdYmV;EO=LT~Ja#qp@Q=K1BH{*R;nCYNs5Y*%E?TOM$?9@Tp=5ULejZlE z)n+WR0p2NpZIpYuX{?6`D?A_~>?au3dkiyV;$w4Hz`c1PE>k^} zn2^-*sOR*A_L>KhrGTHQYL$1|N5OgRVRwqUYs#bg8`f2*kl;x!o@8kgZt3@ikJQo0 zPzvrrrjpq8*Wht|$p?zH?b68SEq%!DBjcli$GuatQkD-v&z3@&-76&ZAy*Lp-II6Z z{WFGf4YN{jGq25YQvMEW(bsv>F?7aq@Y}|6(oOUIX$72>@tgU*5~nBP%K0I|(#bhT z2he=YNDg0z&@h8nZvw)OOk-^$aF*=B+ce3U;{BR~#q~d$HuK>ip`+_Q_5kaJ z4xHnKbW(G}iJuKNCeuc{8 z(~jy$GzUkX=4~Md%G!z^wc=KGD5wkFl)E^}++~s-;h9vL19?;6o%BZT#Q>0Nxs!q9=;Fp>RN=`IJLD2Zv5%4v$pS0)1(02B<~)l~wP zKiaRlXZ`Ym57&>g_cqlNhq;`87&g*^-Yw*6lWVbryg|NcQd9S{&&-vPF<=v;S6Z0} z{V+E?ub#l{*X@+(dd7lrO;S`d%QSt@Z!c+jV&(D)VAj$>qqi(~OHi{r^~G@UV3zyx zp*FLCcP69L6_3f8oZfAz3OD^B_f{f!K45I^HX%Y|514Vr0>z?-CU-U0;jRtp$s?Zl*3D)fPcru6{{3v`}BLAa*#4)M(0!iiXjmiA?f^{&tf0XyQkG9h?4s}Xd*H_4K>n{aK4sH_3V)oU z>;1g}no8MpAAb4`{|%23;=LX6x<(Gj>D8=X?L1_Y{&Ga}N= zW+}Z{Ckj1F)vJRg!ddh1sj)BOWW*=SYCYmTD{P<81zY%GkHPVr;1%0-K?USmHXFG< zkGfyv$4PWd_RfV#b!N196_!ed0Fz>){O_V0IiY7S=;sSpW+{C{HU!ivu}`fK9~wqPN|T>pXtl ztfhNRcDBchoGMg+1taS^k04GTp22;;Tzh4)nl#Q4t*vh3N}jP1zgKbS+3n+Cn8C8e zz)oZCBV$mPuy9@|$JH81C4@Kg%e~3HAJZ0c0K6k)w;}rw(S-$fIY581CCtCO@u;J^ z?E@05I~$$Id6cQGq0C$u?xa3A;anr4bg1>;rI9gzcI#6eVp4}c+o_O%5}5GMe~WeY zmPeC0gLx!5R?xJ}+%U5Z0UsE8)MPnUZJX-4)hlJ%c5|hX97z2gYO`arRauy$Ha zL&gNIKIj})-d~rI#fBSS;=@n+Bj>P;BusBXZc zRM3|Sx8ZXB=54;ZO7r3xU$8X2L{cWwbeiyFCORkFbSSw)#;+#+=*r%aq|wAGyB0%| zHBXIc)m;S^6N#wo$o_JH3G|ac7Q_K3PShUi5vx&_Z5_7$E1_7QU4#q#*|`7u={(qz zlqAI1Gt+08)$zKL*L?lenu5RLC|fgi>zW+R0#5j8*>Y_jrRY9zx%F)uIWVWApHjjz z^rmn2l-zk_3d($eT`R===Zb&BT_qQV;cZw}LgL8Qi;2UCl=m2It4R-SmmGV!HyE(_bp z5UWy;1Kf5G)@^^!R*d)?A{akNZsN^aT5AMV7GW<;_VbFiU*$T7zM7x7+o%N*!Pdhb zn%_20%g?6^8%=ot6t=c6VBFyEXAupW_~kxm-n;1>o*>JN`1Miq19sDM4f0XKA)0sJ zy}`VA%f<VcgN;dwS*Gh?_s~gm&R=yN%4wS%?R1`U$4>OCy%09T z@@bCnYgV4sRPYEq`eP-e%W%4Y!*bBDMR$}(wLq{IWx97*)zdnnDT>>?o0T~ypU(!o z5X>{daMGk@t&r1%UuSSRm^XKmJfJW>D>sLoScnp1Xk8R1)$74qtG!MAs{_D~ie~dG z{<4~EXOH@$vq}_?DAWh9-!{pvywBs-$#2m8Ovd4}%(&ARm7$}`eE>Wumg|6x{Uz#6 zPzCFo(0YxJBT%@kSQ28&^NSkOe<%Bnlt7z6`uW(3gUwficX|O?XD@tE!e7g4?(F4H z>Sei4t{)^F!RPSis}<#J+||{R0oF^9l_lZ*O*T)^u5es|RSe<+S-Rz?8!~&~ulGn< zFl)Wg{72KlxV4cYr`(tHs-oaH&I#<~L48pOr%w)O0>)kL{#ml8zD>;x4ijqg#%S!Hti$ zY+GS3x@C46l!PD~me*_l<(EvN_3g19^Z<1=ZI^&E!lk4=GkEOnKi9id{+9U5ZiRUY zR@e6l?7(iEC^E`4qdE9ZKs4Vjn;*2pwz^uf1esp8@^cu@Y4DfGMHt5`lj8R0b92Ly zkrri9r*EvTkPxrE$1==osb;TD-N#>$+}P6#?G1VNmJK~QZe&Kh+oxqW#xy+C+c_NZ#eRxJ-k17 zCuL$kEN6`&l*AH4l6NO|=t^|nc`&~~mn#@fh|C*fF-BWn(HpV_~<<*SKsK_v} zekMu0i$*y;mTM!*5%?Q`{|}8E*%Btbw?-V{XHPV1whQOdxRIM-$m8uif^SlGJr(<% zCn<=*OY3Ujd~=tf$T;&sN%1rkg6IgJ_S&N}jxW<(#NQ!%7o}FV)C*CBedG2C8$*2rTLdExIx!!G{KI))yHh^o{Fktx5w((y{9D_+vU0x`##SSdFavOH&`YGg~i>1 zsH9x3PI4)yL{0oyRxV;4`s)a|sqL&MD6pzm?7~ zQ8heF1%HDqdG>gp!LJr8shKKchyr5rZXY+9hPdP5K|E;G@GIyZBXj=)El|KOpW+n7&dZBjbp1HuZUYR9m#_ z-sfejvezemAhj&)@u{?=tWq8_2W;59>agu)n*2syflRmuBkpOxMsH*sXOJhj)6Ggs ze_l5+^7y@qRy^yaFaAo(7(c3yKQ@ywUBJg@dcoZETs!Hb%cmC_@po|2LxAIqCr-jq z@{Zj@=n_!k(J`|V-(xEO`kcaSts0RhgKIU4prMmHBRt$FMHi=iazoV^LPRyhSJULX z%-ekt>`BtNam77NidqI$yW2~vA1?s``}@>9G*=prd8U6-l5G&xy6-qkqGS^&A;T+2+-Pn{&YDp?|^HWL!wxu=JY;dA%|2 za~6=V19WHO7kKqU#Dvb1iRCL$ktzcUPJd&%a*GuWSxECcue_Di&Bud66=pbP!$wgO3XN{T^+T8yO_j|{6XK<;q40+V3 zZTEz|zRuh1^+$h+HM`>#;R|S?lIq=FnRUL`sYSENJCW|F6fJRhb>9kRH09QSg7Rne z6dkpsqT{EAoq%e26VWl|Nk!8>j`vh#dp~HCohPCfr~@^#Jj-ienp8NxA^%sLdg+gY zmm3N9E%02j;qn<~^>bpDheR`g&+K5k%U%IPcopUV!u*bu-ws^waR1Y`hvRDwa^KwA z^P*$Mr+XTH6(=z^Ho^fawQ+xG1hdsuf^L-RkG6WDpUiWuyH}o>Tl3DJyxZ=E4hP_$C#5n_$n6}fZXE{U5}qU zIe3q<@41Hg4VTY&LVs6(KXnf*6;||FX%F68{u9=m&9;NyO?*q$_mPA7T56>Ie9ud; zfIx{vmI61>V%yd%Q9lLRU~*>wHg_z&f;B-aa1tbI_#$?#5l}*no19#nB{( zR85OiXCoCkg>kwT%SBjO%CES2N`C~9b_di?67Wnm_Fu72#LEv$l*+J_E*o;em7TE_}$2c$7yypF1jI;bD3GrqYqJNe1*L}am z?~do+rjIoAe_t*ic)=nRLAo@anj8FW;+V_XV=g^T z)*|^Fxd%%KIwQJiiKvDf`Rcl|f7ec)Ub)DTY!Nhkxia+S)Z;FQ-@v;B?o*NuW*B&26LH#jR^cAkB z-?0;MLShAU=A?&{C)E5nv?xl+Ys{=ik`fKiV1~E1`!{6X{@q1Dqk8wfL%duNeW`0# zaDa%9|FSS<*5%q0{@*ORr1lc!x}mnk2^7$xpFInlNs-+>zwGJ^ez%5L0!{xfj46$? z#r^H9IW@sy=_q-{^L)tD*T$F2SW_qnY)Q9mA!c(ub~jI+k-|l?)z19aRcdt)wCJ`* zC6gsWf&7c#5~zg`y_~3>wjDQg9mqVW#@2odZpPDmAEmN`Gb zT4@SwQ=?LzS>x_Vi>&!wSBI@Y&5wMQRHwYe3%{$}e%ojvwYrx45U~+jUEQSjXvHp55$Bo{#}&2TTR*`HOuQaFj-hC zhag^1N-3eXr3W7jSW`M^N?3B8Zj0`b?X$?8*zqBSy6+}F=|YQfw{!894y;RqUynGB zml0YUB~+&%5g(M-bjppl8AqeCS$n>-!g#meg_Qpi^JB^Dme(0h-+>OZdWB3{z1EZn z%F9i%S(XvrUcYPKd7gS0=|YYaRA}X$l|k=`)DHi0qhXDMqrzwOEKg3lR^BvxmPQbx z3A39X4I5wSNtJ~E63wsx$HO^W?i0={8&((RG<`1I7O7ba7~(xXTK0UKM!GSNFO^EE z)%%5EN}G8^$vE9UaC+1$+28xha(;6&5z}4B1i$7ohF-d;^)c%oGv|`@UDZ?;u1kUm9*;WqgkYyt9ZyT+`?*(6f$Br1$S28Q|&> z*~}Kd8Mm%fW8HO%(Z>FGUm5_=qSClrx*T>$YLaN&vKWy}K30mCgS7I9olTq_F7L&q zu>HK)0`(XtHib)n)cbjs>g#tGb`zvw_Gw04;lM*g3SF^q`+>t=lim!qk;eO5$_avP0Ql4^UHv|LntHpn35r; zqwpLqtJ52Mpp|e2L`u=MVg0HH?eFqc0VOWAl5gz8Y{OGCqh1aEPh2^hy-d#Y@^tL^ zSQTaN1n?tv*f=>eK~#sIRFj;2UWVgwzGs+Iawv)MJl!JKWXV{NF~71r$Rr5^-3uK*Hy_o_A3_zdJG=Us@-YHTiNc?z?aeV6iG`%O2`(K>>EsBg>&gbpf<>m6kr%(4OPG>4qejTj^&dtuJ z{?Bm%bUF&pL@90gPwsu~${m-YyO%){}n(7fm$xGs@b` zUkB`bTF5(CUtxapG}5@z5!!cQSlFi6>wM#n9FS1k#4>0mL*)#6oyYgp2i~#^fW5|1 zaG`B&`SboTO<)=;X0P$K401dT%cWcg2S0D0a_mh=%*8Kp-eGHTVS#l=PX4fSI*@t5 z&MEyv>Kx#F7}8mAZ9A1z^P^30KB|%R{o)Pr3)tg7=$r5D)(qRs5Aq?Iu-`ObC@gS} zIv^UYVSEu27oC9F3|Jq(ABUkj7GwaGj6~J_hDqs%EA# ziesi$I1@}WVLm#Vo$X_sHNwA;pY_vx!;=_fmP9X+c%O8RU8v74g}jn8g$EhE-W-!W znKEtQo`yZ$LXzNP8u(tTK+ogdwHsd@34EVN-gy1@}OpAuc30l`|_aGwWzNBq5-!9%~8R` zspi-2C!{+3w3v(M@gADN)!tyoxsvGCV+hHdWOTlHw9*n%;Q5OGlTK_>4&{NJLmX2? z*E{OohRO!xByGu7lVZ!yjHjdB#uby3Z2=!7=uk!nUs((Ka$zD*!!VOiohi;{U3whm^H_+~>&K1Ww<#08=a(7lEi>t9iDIYW ze~@R;)-41$Ry>%H`jCE&IZ4q#RC(yv6{2im=kTgQ-5d}d7oJ5(xQZwTuTKHleI5Ro zG_BPk$$DRWAa=OG{NC%<|Byyk6TB{P)Mg6$VJFbd3^<&tNka;VwVD`vz21DTpg?U$ z7({drt5q-gK5)S-eztAZDPFs0V|_ERMCHcvW1+P&A9Ep*f#b(y>5RwWBa19*UY_C8 zT|zeKEE41|`XhR$d<)@d{clwwqj@izK1b`U+d@D83Gh6=wejDiwISd7xv2?W8Hlkd zfb@8q(%A0&HqGCE))j`;sE=QtEP?V0EhduI+U@fg^L4ywsIA{w;K4{|H@dX9iBZQ& z68g)Sg!?{6^uJ5Z6<*bGGLJo8YV~oW!wwft}yePUfEb*u5f+(Z&wq8S>9(7cxt5s@0S)bD^X7o z*VEU@J5lE@=NAHUAJhz=_XQ>Ho3E^{yKrsIa`o0eYVk&NqGtBK*it*#wW}a;Z~|oc ziZFF26GNp>t+#nn(cI`RFrtk9d^f!GK7%i*z2K&`!%FUEQ3r8I*he{W1vTQ>p`Ndj zCZ;dDI;0`vLty1WcX12>+>k<1ABEt$Jo zn+ERk2`fEBl6oUTs)NInq3y_6~TEYs&pF6uduhIbz80Ib&@n@&RQ zehE+1>pPp|1eMtt)ao-2k}~~7U!oxmK{*@z6{2Z$T)Naytw_=HQwvgE;Z>pJ12*fg zD_nD}uP7wIAf~-TC>2b}c^{uJjbUV5Zk}nVZ7R4N$r>~Q4|z01EKo0K&!HQ&S?1s@ z$+2U*(=*)eX^vqtGuB=qcpW_5npj~La8g(#1Zalq+xDXGY@8xsDzT=IFw)?DTfc89 z`37;zBk4sJpLfmP6L*6d#rH0GzNz|V^;#)5cxtEAdj_DrGP-w#b#&5f@Kc2MFB=?c z);ZRf=eDd$8I1bq5hro{rf_TdiIHtxM=xCuWE6@*Dc`Em*ef$}&Z|mOue07#vid72u@acR0$_b(7F-bwDShmPw_$-o~IN7+*#&{PTSO&B2P?-k+*#8BZ(wb(elNz2^&fKni+5 zzdMW+HOX2(IgM*zDKrMk#S!-NjUo&k9D~i*HALTMQX>+N2=7xC zLM~{&tRMVRRA>+(raBzwsGYuy*C&$NR9I~vs#Q`ZZaxUG7&?`aG%3rXPSYPKZ(x^7 z$pKZ;>2J`cUVYCaV)j{@oSW!rSyBYYcka&}=0`6C*XhZ-h zZ@Sg>OA;iF{G5~XmJ9uaZCpQi-OoGhr6zirV9(JUgrqM$O15%Wj8|tqtHy znKUk2;39=nG3e`PKRH=oc;SLD=ljikmixztdI9_bW?3PqIbaf>SDthIG|$3~sKmAL z4uxZ1zZ;}hsr?&ar{fkhZoyyXhJ!mt9g5qfP|tTZNO6{Rzn4o{-y()Z2k`UM0I=+T zFtJ|KDub}&^0W9wchRvAx&0v{@zC5TQE=em7l$9eW3--ro%X7(A_0uF&6Im@nk2A= ztJ)(lZw}c@tE>K2Lb6J_8E;bpk3{=epaf6BpKZU=1}AV06Wdo3ty~aIcxj$pX4BBU z;_~{}xl3oGH)wE4cbI3($GS(C+c~vs%|DPD%=C^vjH|uSZdx1eQ zPip21ee_HBycW#S-I|(c8$IW#x27JWp~h08%|4g*qZ;b9qO3|1$kqL{hZPU#q>GY- zfm=9O`J=0^oS@UAM>Ud&=R-6Y0dN;d+q%!2?d4*Awj}f2%(4NaR9ANIi)y{`N`wD%&A!Bp@qKxyygy7q8TzFT!KH2Nt z3&06aA0;y)w)M0a5#iIZR4fV;DA!VUp34Nsna90vf6RP=Bb7a@LCw+$8K%3z{ZWBcyV1I$zjnbOfnl^Du3rd zIeGIEH(+mnWx`$&wopS<;Hky1(U$djIx3K}rTLw`(!M?P zc?XhKG#@F-z~hvv;Gv4fiUvd%tC_}?t~)cD@ZPGH9kXeiQi8AmMxyf0wF)3)QegM! z8H;_w)src%qJV2AVsN**or@(cZ)91Do^q~_D(zT$4oqxM_nWegiM%&&V)Q&Yc6JV|40OOYttc zjbSJoFGh8|x^(GOqwUeIP8v+d9n_C^NRU)&@Om^V1q_O3Tz%aJK^3@^N>qX}Zh?^= zwZh6}u}RBy^O3^VyZoj@)o^2xN{(n)t!spgzuosznF+hFk&oRQ15u)ny4OlR(ZYSE zjVhlW^bCB{uziK}a9FA9w@+Y-;vL2c1?PkH*xbdG`lYHGu?HLvB;R?%k>@ha`WR6T zCpWMI;&08O4R3~~U?y;;%?0yjB{cUh+Xq{s`nh zZ7J^(vo7gAzyxa2ImW}jmgMJNdJ3+3otN9!zvUh@u9m{rU{u#@s8t&*3%K`F^>}{j zQKH}Iz^o58x?oV#8U({CfU?tHz!Nq>%Biu^eo2Z`_A>pWu#IXJz@>Xl^6*MFs= z$HC?Am+-SlbkS-^mY4T)S2|lS}ED zLvpowcwY&Vn)5TxZ7{;8{KT=*ug44xnO_Sna3v+nv?GDn*sW(jjTZlCxp0q6vYb$9 zS9|Z>{W=t8_}DQimHEaglfMiue&-_I!^yjaUaWX}dF0WAe=#Y^-$ykR#*w0c%+!Zr zdTjmvT$2YzVJ*;#(Eja<6s0+0e-NPbSR#OSzi((#d zI83u^dSWmT*T((==NPg3IA)<04b4MzgQIAWnbk8qH^z>p#`6^e4-;l~BA1m}wAY7@ zORs5l9OYJy^sh8blk|^PJn2DENJ|;qzJRqB1tjC{V2w_Rd`jF5s8vGeACd=$r`@T>6 zcqR%m8cvSU<}t%bh(y=kH4Kv7*GkyKb!^{tl?sH~Ih_RbP4w*(JwVRIlN)1h!+?8r z^ZUPK@RZmU$}~oo?l(A=Y2t1mgl?OyR-N8`ypwa)O7Vdp%!1XmuT(QQ>CB$X&`%q-x`T$FJ8>sLc){#(E5Cp>Lm z-}=VkUOpw6A+8sslv90lp9|gY$%WIH?siUdgbZeljCLSWga*m>S>F*czWMnAN_1kx4UQiL*hxKhDPTPT8)@!k^%6# z^2nn>XMx?ge~()88oT|#;SZG0z>%{Y?vt0g+Sdv9RalymZy5Sa=_cwN{G)iHkWC~$ zX*(T%B~Y_}G(JCdv3O?ZlW?_y$=)sZ5W#k6L74OmrEQ1?f*BH$dy3bV-k%gusi}>V zC@-jT{@&`&oJqmzrL{7elLyYcEd!}QAk9eMcPj8bJLVwLNqn%6Y&J zTJ7&c2m*|)UY7{_r$xG~5siCi&EuNS2c53*X_V}hHbT?)FO1Akrp1Dl_NlR=pi+Nf zo6^)DpNolH)EKXywaV4oJN2$A74fN{LzemK?0^s*S5DFVl(GL~QaQYiQ_#pRUR2 z85f(3c&~WN-X-;c*2|Of+PBZ@V_%8h6gdl8*8J4#4N8}oV{oY3(&wZD#X;Xa@ef#k1#l6$l1)L$bmA1<~d$O)TAh4Gm7lHBeOZC`S1B zD$jZ~T)>$RqQCik^T9H|YCj2nIjQ+M*U=@(>%i6?G)8c>elw*JN(|5g)W7@(r zc!^a9c&XWuWL@NoD1X9xJpxYV^D=Lreq)nF18)2h))j>Y!_$xm1CmWC+d$2f!MX5B zR0m+(%fwUtpF18~wEcdE9P}_+97e7KtaHA*lmxq}7_&z-%4j~ofYuh1^Xa4}?`;Dm$ZzZy?FwIj2PC*SAB=BJMjc)Hq)z2c+yJ-q|`X z+0NOr9E~`hONL_h3l0z7L;CnSDKTDFQRoNHZgxZ9o~-6PfS(x4RR_NQCiUZCtEiOO zXqMO-m#!UePt9ujyoTLi+|QZ4iumqfcZgjLC$?px$~72Ifb1c@M?&xi*hVy-?xxpi zUrAfu8K3j({+tJrNVFL(K{`NMnXUn)>>jS^2x!zM)o01r1!|j*wrzGo(E#@ zTSbV9tFc#btYWytU(PL&>Q?|w#;GqpHjMP@@r@CX1(w13ev3T?SlkT8x$@U)?5|*2 zRS~1T@11EvbJotpa$Z!W=O}TLo#>PRU7VO|OJsa4=^dBEf|18jU~YBCTL zfS9g>TBu#JTW{jQXq2#1#@WfOyfkyXxQqntFm}|VwC~Bvz_Hiy$aB$)J~P>NAC`ah zD-}c>d@E=Jzv3+q?>==(nO(sjq>3U0x?}5xjSk{948T)Jo~fJ3cahQ_CT2;wPuJHO zqzWN!Z0NvEa1x|<&C2QH0Go&b#0eHQVH)?Jo+Ghq%+_Qhw0bfJ&)&XxY>zAG<>I%I zd_0DK1q65>Y|MkyIW+@(1a&HFe)oYcA@X<2G7YjJJ5U4amO}(O65*WrJwEV$Zn0KW2S$9j9B{R?IJQppj7y%TCRP(@ zo3kOR+rsN$*M+fjG0tY{=00PCNc)Fi8r4+tw7cm^`WmDJzBiZ#)a!vB;OX;Y02 z(`(}8CQ=4$zVk*6JHQktRxUHyx<>k6;}wbs%uExh^FC$Dyk*GFp)WZhwKzQG`wx9~ zoqz#T6RWy)L@fI>$5HlB8rs>_>RJvMI_Bb{S4%FY;jama4_|PF^(DQ`G&cra1Cm?J9P)dRAtu;km!> zYO%w`Q?#2%zb?`}Jj2#oAcbbAcf_Ff>T|zbbeN`655NwuTE@>W0s$SjpW(k{f??F< z`uC@Y9lU;+t$#s7P*$N!g$GjOf=%u$_*F6QbSR|xB@aBaNUPQtHNADQH%aw5nizbZW~TG~>b0sZqrITzg1jq6lMegW zHS1vVnlyrKR0lX@LRa4I%hHOY^O{=4>Njbs8l%B&KCH{21#@ofxTOkGx~5>qJxt$! zNn9W9_Nbie$h63<>bM~{5Vuoi(I{K4cTg~v(Iu-}5?1-EuKyWADPvMh;XE&K|7wvET6#!_LP(Cl|!6_eTj zg*`JX(3I{_YErtg8|>!WnulvMkXX)v;~46ut~%C3PI_loXDgM;cyg zsXJGXY5$9HwO#f7uHj@l>3do;;}Q)+-xR)6$>hIkF`t>C|H?UpSu{%ZV;(OO??yh_ z^wa*(hhxi-94*FJnV1Xe16kwK&%Ix|u!D5O^r%E2+F+s-aalH+G~?bIbHZ(40}-}6^)W%18jV&&*(w>v4p@E` zJwx}NymIcW=-fD}o^!?JQl%;*g2k?lJdB0VHFbbw#m<3c`m1iaKF{@S;I z&CY!>uTqx}&PBEKvpbX|I8$`hVkhIA%(Dz&h1@q*`m3AxP1nXT#HMKOu{aYagQMGJ zZ$3=kdnJ0Zb!>#NP{mwIibK~fYFcSU%tkya7gY*{!T79Qw9RIj=@FQ?q?HTDoZ`jr z!2{QE6T-(*-&7o+*`aDBBFD7)o^GshP9}POe!S_rL1_lkI~0V1Dl@-0+#S5wOW?D; zvc5}hIgckZ>AyM)4)WY=^5mX%zAja zr6)t;rbV(bc`Oovl9{t6)&tB_!vCkL0aju*>m*Y5o)A#c| z!4@PrdAumR;2=(Ln0U^vA%J6mYgy8icfuD9UyB|an#96wEz==c9QHvqIs=KrISp*S z@*DL8}k0ZXqpbHwRA9jcbiGd9Z2kp&x=bJ{4A4{Q)l6bAQ z+GSy0rr;itIY>8EtK?}gf6LIC19soRUn z4@~HyTF=`#8TOvQZLN#7!I7^+mxf(=BzW|LpJ?WdW6k6atNV(nlut|O#u(;venj_J|3|<`XIwytS zI-*;Bzq3=lKG_-VtIV`q6y3 z!NJy%vabVkzX)B@IlFTzI9tyC1b+jWo##YNUZM5jdp)G#>mc|UznRe=z#hVn;epd{ zeqOj#_0IlQ*+_HGc(%xj-bhDsk#pf?U*@%<wsUu1RY4Yq1yTP?{C|( z!&(;7Qu9uwhHSi0-mK-A+mwGhX!+)d-&|Kv-{__2a6e4obZM8`-7X>CyHdW(P(1I{Tg)7 z`zOXe4s5N?w_qDH&nnwS-bdKCxzqM&Zx4uL6l z6W$Xgj8@IFg6&9G@apym9Wt|ud5bMQb&q9Memo9FYc<)$^kw-Q86v%M zo||Zl{{b5=?zRb=Q_VPc8=|pj>=ibNirLhu9R+Vv=OQ2$c@A*!h74qONQ`> zmAV^%jRC>ai}2~;iey;$hj6bf0}DB`n|YWjsX0J8#Ume(o-v{!^H6a_EC)~-kco2v zX5I32*^Hig%8=95+m!25g*<=4o%?e9Z-*9Ve*9q01Q5zByhlcfqDGkl$Oh=d^hrDD z%7S<3^X3`tkmg>%yDJjfa#fAM>z^W(S31RyV8Ezs-fnuVGalF0i(83^FhqSKs}cFTKoZsk~G4Mo4yWkLQaSJ|)0+`tz+g^5ez+Ap;1x)?va=h9X}P zO-z4ur%>zEL&xqiww_q0!(9z(j2%J8Fg{G5&?F*E_^k3Zc_%x#74lHPfBQ!zJ=)78 zhgF*mlXHp#2?}}v+URPYuN6$3up7>ybF&6cDsPDH!qEP%Z5r<4iCRO|oTu%Zu78>$ zFVHcM$}j4$@Zu#qA~EZz|hQq|CInW-Fm7mn}E>VacTv zQvz6jPm{IIX2PgJ;guBU*c4aa-LLxOkAgRuL?8=I>DkAF>zk#+; z6Q@CGjrLo=y}gRpjGPNMKN}Ke8RRU=mu`XrOk}@@`Rb5u@{Y(K*31%HzDFxB6=_=T zcM2|rcU|tsi6@%l;TCVZpy58Hdgw~zVK}6x#HD{CIo8yQhU{2$XzO>#>_*S|JAVDk zHve#3+3jiDQxy}y#RFr2Y`6M-jYc%gR!er6`WWOXR|_^FDbhUoCiR13&ZF0_UzcU9 zrZ^N)L^xOZd}YjGa6$xqv<8kdHOb51V~TQe6!akZ=4@n~+sLVz_2LCBdz zozFrs%N~J>fwU00)mWQMq1^XGx`40Dde^l1J=V|1HU3Bfn~3SB=RY2SLAAdHJb`95 z{+)%>sJ%0CS1|?vaMA7nrb^@2H_8zpVxnqoa4|f%)+$FlrfXy{Xo~_Oar|*KClUYQ zoRxvkDHJ^l1e=Dn-yZ`0h`JZt^YJwE4C(WjZUuo_(^($xs+by-sb8r{vp=@<(o@aK zfnKc<3%QIHCRTsO;)vDKNl|&-ipTbSAZh+Ne=7O9B815Py6*h(jb|1eFG3EDntlr}d>u^|Ik7IqQ;+ zcAcwbgsG9$0({}69W9Rcs2jgZ0i`sJa=a&DF_4w}t}%E;{3DN0e!+ZUsM_vL2$tCr zp*EzqdJ+8XL-AIJIy+iLi%AS#xQ$SZ5`1zTt8Rx3O(_$?Ta4~#m7Qw4y4rw*$N5PX!7)3Q=N2n@FvLIMDfY;5Z39Hf z=RPeyXv)i-AtL-D$J0EcEA?Z!Uerjk3W4aJXffzUPd%qLiz8A6>+!K5pwO}MXh<7^ zy8o+`_6l*!PynEe0<2^6Ek5Hj+&!MAr^iS7{}NuFaSsZ9V33m1)NXUjm(U2HhnZLH zbSzhInzy%biarz8+O^e?5m*Z3)-uvnNdBX z(^)G?WiZb9uS@UMR-0T*M)gom*G(;z_51Y)##%ZB2HRzj%;=dV{hqX}(f&;G&DIZ$ zIg4tis@*M=BWvWM<(`Vi@446fTQ{>+CRxkN_N%|93~V43lUEPl?c#&-998@Le8A`YikJUvWP2sZn;r^P7JR_ZR|76Op(@58Wt@7&zW8A0-5eEr|i9zEze zs>d~Q0sOgZ$wWHSlGjQ^_3SiJPVru%aO;vcA)TuZ{*xVIqkCGq#KtfVD znqPf_1nBhva#-+g!soMwg4Fr^-zUWwkq*&_@}#DqKGx7FjkwVTCFB zx;m^-J4RFl*5qX6_VhD?OI_X;qrf%jEtCxYZJ}nO<>+Wk`NJ^IK>--dDXP5YG+J-+ zw5~eln#}K@)-3VFjmx9mz3XBcSM3UDIi+De1W&LFCe|S0!b2)s(m-t0%7cE4c1{(8PM5WO^B_*DWqe&aLK<#CL0!TMq4>}&y@{{P zt*Vi3w@j#@B_TKDYizjl2Cj*jjl`YT`AI;f_M-`TyGMPu7!IrT3P#$Qy-xZ4OJ4dH zk<2hg><2LWrQqM^0I;n@s^8rTV5c|W70M(q@-VIaQpa&S?!4T{@WNyM_~>-H$D4jm z*Ij{)7&!tWx3Ax*9%mOCZ%g~aNU)xjk)|VugbiF(;O{2!H?XYR$iH`4x#7u>_^P8A z#}*k+C2QFkhFIwu za!TIa$a{c=ym3SVs^QUBr7~9{`dbB;*9q#4lRr8kfdHSaNC~|j-mB7V_HXt%Ds0^veP|dI(_l$g!7I-B)GKp6#HnTBJtn{ zvM0_yRQ&ew82naKi?O3c4|22i@;4||?{QsCWg!W!|F32B#~Dm` zKOoJk=vSN}|9Crmr|`(H6AEAs?dkT$leHk%xn!$0%GUf8zPS7-_%nLoseqJ*ZOFi< zglcC+PM=kL14rFFUEL;4xwr16nW9TpLA-eRj5s2;0lZ9Z{+4hUpexoN*Zv{jfrTP}lqZ&Jo~$<#ZY!5r zXt%!G#7D+(RA?@RJ7DvjeLEKT#;f!Q^L5i^Z+i%FSI$(*zQH{_*Q~h59sIfZTf}8k%8_niLPcfAq$rUd#?dZ! zQ&tXbe(g79Y!E>&$i$WV{{1eMxFaK%7x#TUqc*ye!fj&dG5uJ zN2e)1A_z*3$}-gE(~ifYA9H`~j?3L@1ub(9V*dwlD8mN2032y5?epu~OuOS37o(CD z9DqRNDmxq%S!kHir}z&Cj6_lNA-7{snU>Q-7mhAxdiGDMDv#_viFad^BOw*42IU;t z4^_sS+!12Ekkn}Tie>PRoZ!pj1$IFmX-~>WXCj{`(`X-if(>Fh<1)mCUFwmZ`T78E zL6iUR1uu7CXZ zLC4T;#9T*jIhz#VW>^Y1+~GSBx#e1fvu}LkY9C~YYx#uDoY7Tp(@HIOUGADDp*HGp z8V9BK>4P`Z53Q_ubttb~acc}|p}$%1Wzcx(@&r-5Zl8#Ux(_vhc}4Ad2n%j! z@VFi!f^bXIi?1aNoCI|Xx3coJE7uS}>oVYY<;RMN%k=HS5Zjl* z>*3Gul|&vwUBP{?0K%f4$EE;Bi!0?Eyh{4DNv9R}^F%c-pFBlW>=_v*1nxP1a5{R) zu2xdK7R(j%)o^R4+vZSWmWP$N1Yz$vZ3VNl0uCv96C%exw}&(v3d#H4JSm$c7zzdK zn%*N*%&U%IObz8YjKix>;QFd+CgK~qIV20R0E!EBtv|wQV|?A|KB6~ru*e6*j6^-; zi-Rak1=UX( z>01xnq9lCiPn^{FbBh;sr~q+T?L)`4MS)8LLmkvrcDAB*&G&*KHMWLufOYGRuIDEp2UCEKBu;6zr=6dVQ~UI+2j0Lg_kgT*BAux z^%Fj#vE+|FW-1B505Y-!O{`)bd%Q!p4G;zp>{qLjqoxx5uW*E&MvK(l)dvzn?sZ4J ztGKf6Jc6wmXO5LhY)yh3ywyfZDKpPYD&124 z@>;D0AcOEiQ`K(HJgzkc-+CHv9y(z5fnt zEiT-qE|X+gfTV=gNjf!^=s!fsQGt2mX+di6u9O>>@-djvipHn$hxfT&Zims0eVu~B zg5vA;VU&%nXq1sMfsv4Np?7lauCwEa1N@*{Df&f7VI+3IYGIc@7oDO1%BBtP8VABR zeF3MJcB-`{uORxkeSnZiC)c)6*Ci*g4ypq^lDKN-5UTp}z4Mej95ekPOT;H8J#hYj zK%=8Ug~akP{UxU!rJhX@uQ?Z+y5SV^6 z%KBHAUN|8?1joOeT$JP)RG9M_N7X5QjD0uWL&j0MW;;)pif@uLM25QS7Tb1Ywa$8J z&QP4AS(u_T@B>@6;9}b{6q201_O>z>1+Fc2#P^FPpwur+t~@TUBsjFzh;i-rQu@9+ z&ujaiEe@fY|1A6Y_VC`i!L!N1kje93vzUXa7Wzarhj++A<=(-{U0|Cf)M~`#sZ-9y zU_xWRlZbcd(?2%XiXI$&o_s9reEp|3;@YEMJA2xW3g?fhc}RTrGgH3lyF1f;CC1Ew zIHTxGoT=8=rI)N`c;b14L~r~zw0y&r@iHLbxX9vB4~xXf9_dPh2Osmw59uO|Y@H<= zq;BiQL*=M^PH-x?GsfRxxZBVCoPApJ;gtgl60Jt@qlF9^&Vz)7-H>X@?4^({+Hndh z{f11w3vaH4S1>x94~KoEvQz#Ql;Mv*UIk=HTI#x@B<^Y4tiBnsB9eTY30|d zjBrdpq~hy-)>hkH(`+Opr;#vrJS#EuZ|sqziXJ>`l0Ov1FEUOtu+g$(Ypzw+nZqiI=|_k_9Q0<^gGB@ccv?(K|U-w104Tg2lN< z8c4nBJXhv9Goj({d`EqN6R`s{9W0qU@5WjKBjM6_nI9}Qm z9dcGzE{^eI}k(RG41h z*9(^uQ$;mB013v!9=%@B*Xb5W9(`Yk5PbPq+eO7z*UYbU-wd57`X^Xp3tEYDge*>DQG{MVn4{kgj72Qc%Qv5 zSIO{p1$Skw?&xno+0id~QjCa5jEdGUj!s&ccKlqeHZ zjxK-xv1gR6Lw+@!VCntQqGDAop!M2<5}&hP&GGF^$9C<*fu#+}7n;~5-+ji2=V&f! zS|J(G1g^=un)&JUTQV)|lPeT%?cs9T~-G4$XJLzX)##7FU zo59vTF&$U4Kjz+)xP@)-gWqX#*U`0xdvDDz96pUtAAX*=;O+jGPg=32@?)@rE`PS> zL`L~TL8Bv<-;qpn)#M$i>>CD-6)AnCWBK;i@VeR#ls%l27fS{ZEhS#kEe~ZKC<+%n ze@k4?-OX75&zsgL)Z&H3h>D{Jj}{%o_V)LT2K8+0`7=QbElHt@Y5oNguPIx-N<6-- zr=icUp#$^DtChv@DB9hml)m24rYLv*zU0tUGyn%I?S23E3h61N<$}3T_Wk^`8ew}z z+;)iQ$qxbFd^mGG*>De_>u`=khq>HCb{_^~PFR7lVSr4R!qgh`Mv+)ionq|#P8+yy zbcZFoHL?9wxG9cF7b|?@D5S&85mF-J4dy{9EYzJ&W;8Gc9*F4EV% zV*s^l(Wu2d`B3CY=6wG36peXMUSw{{to;QrQb_eIKuED?`!?`0`+QG(EX@mNOWpg} zWEJh}Mx|`Yx{R)U5j2afUH6|7QHiVNOC1k>3wGBZXpmXCUc2*--=K0bv;b| zO1Zs#L2B1_jdc6g`6F6b?Cb}N7NO>TTqyw@>-+r%{Ys_cR7;D+O>)zi8n2Rgro>~M z;s%=jMo_r9*Ds7%8f8Dmn683WhT6{zzEu9@e6e2##F17LCI!4&&3>9F`SH3leC3&4 z6}>COfkxFT1%JW@0b~yD31MS5WUKMZBf1RN%qEw&_o@neRc%J;X3bV5RPnMya(FAV zfg}^`cWy?(ZSiS(ur)@HFIv6hjnpG#Nj0|jtCElgxk*Fk;OXQFgV}aMsnK`Q3nd1f zgZ9P+sRae~F8mK|T z&_|C+N9pl!XUJ-y!ru}OqFeVI$Wceoq{nAnGnx{UzB`Xi`TmKQX3;C#xQSq7P^PPv zZN^v8rkk`tFpN{FDkrbPiCKIE8|n$7&rHkfJB0X8ElDz|FqjAS1Fg%B zo|SOHb8wPSisVG@qM-$btsiVR(?4#iEj(B0*DVYulc2jx!mF54`%EGv_A{-&1t6+T zs0^gCdUY4TK`jSyYh#?2FPB4|AgiKF@kB~~zuy)0Wqg*RZ-2s*tm=w`sUbnrLHw*~ zHKL*qqIn`a{(>R=oxGQ>=s$7krIR<}OYX)=2?)gRyo>SvR>KEe+G(Hh6ySq{ciAJO zt>5ZnrqQ4AA7X>HSS!Nr-^bLQg7mg(R~&MH>-@6m>&uF8-`5K|oECTe3^!k-OuD+( z9n@aXUn$-&hSW9L#$aQI1sIF$9Ald%TuB5HOx9iH@d64o06>|8`!Cj|xH8g=y?{vv?e38%FFa(`! z+7rPlB)58B)6v4WoH;qpUKKQre9jpQSyqJ>iC`8QJFXMzBTTjsSf_W$_L>QiVz7VQ zRn-<|uDivV;p0Wh;WKyoB4+RO)ib8QO~>2ie1Gs|^NUeUa@CaBH^a$m~9`#N@e_;@cQXm^% z76raWF8vI%zQBM?OmzrX%tg)jMVz~zQF`_vVKH6a<+|fQSX6;=lv+SVt8VqygwR)Z ziqPQEaDV@-7~wsYcL3_t^S?FrOIOw9?3S=Klq1>9>Qr7{)pL7Is?>wa5lX6KQ12|% zkW)sR)_EnanH2u~K59Lr|5_jE#Dska@W;6QCMW<;YfPPh>wXXF(^|7GD#D%(Ip^0i z`m0w>>wzJaGr=*WT(4!+@IKZhX0&gDMqfNPem+Qhjt-*7%)5W$%OD^D9zhe-fuULG z*a37%KEBa#c{BY~rHbed;xFrxcz+zV^ETvOX5mthE@`Y0(?}6+7--Ede67J)8@*|H zsj@4f1se0K8-i?f`2`3mZIlE|T zY6a+A?YG^Y?Du8$=S38NW`_PinM@4IIVe>^reSDVN7tbuIw^Z}tg-TOBd05afJx{US!(?CJ1HS98-5TWudUsafsE z?$_F76x#1g`JLE^fPoW2k-_cvM`ahg+FUpYt- z(st&{892+5=2_lU2UQ4@oiQ=*jVSC$T)Uh~@BVJuaf!MIX3`i^?&y*ixAF0)&HS}j z&e_ON-pYly3iV`N-(Wun;Y0=U^>fP+Av^tOR>r11=+g8=q?WUag~R>?((mb`%%X%X zC8Tv6y^_vN^r}1`8a5!y-WDruM!8Pg^G6MAjcGe}cL(40m|Y5-94-T4`-s{77=NTf z#LQ$iBSO3s3?mAe)b6yQlhr1?UfX22I4E%H-(UOmo?dFiT$P|Ebom0yq6D zoHeGZCXhpvU)6@`ziHewVT#>ru|w{P7m2V*l^vaaJ1_t_+%OY*tcGiGbj3doot>H> zQEZyEf`nLxV_zzELTwu?+8sM_S#7y`ux}Rj41sKkaj3f#mOgA;#lp=8)KJ13ey0gMJ}URgqZ%06o{KWbhLi;btCJq z6SqrpDz@VY%0u0)7heg9SAPHW7_$17zcLc;Q32|}_vA6)8$58mXgqy)ZQ=pNpRcUu zM=|tqW9qNXh~h_7q~KK}uUpXr$B$A|e1~$R`eHv@5gFIx$vwBoveSptZ7q6Z&IC}X}~fLK`E1Jf|tfKRAO zb6Zxy_(|HGke^rQ(2By@L5Y8=J|g85Xez^K9@J44+-d1_oj&O8qYyfN%IT$q z1A}dmlkb)!(hoMO6Y*8)gt`#|dY%iUrRynfG~wS!oNF~mLmCWpjy3Fqm?b=!mhT#= zHbQM)dGr$!w=fZeU3ig2I!_bE#24d7RAwL6ms165Mg03K#=PB7zr5BBPS)9(QpP^x zD_xP7658f%%E>97%}nQwb0drZA)lrG3Wdj)bh|kd0l^4}27C33?D$vw1+28}qbzVa zrb5ox6;g^tlQE zXw{x5L(Te(=L$GNccTU6Ur<7@+?HxHaDhZci$P-F(@|;@i3e=~l z)fw;6d*!AcSRa+4U;JqCO4!FDB1J#wr6ikrMqoMn0m|`p2$uau5+<#4-J!yc$9ZQj zJmx=qtJP?m8P&>>9NJ45zgd3@&Z;PG@B9+j_}qrZNY~0w72le~IB&`aTTk6`0L{O= z0T$ttE5w7Q@W;V>8#nT7h04`;F5xInYrWn-5rB5Y(5Ufe6If>(M`b5*Qh}zF7+K-iu-J}Bb70Gc%fNG z`jc8=HD5Uj%$t|T3bWe6EeA{Vnr4-!%hQ&;(pk6a)K`^k(=?7*@f~**$GdmU(^tbo z>{?$c#A>wWm*OM3Kf3A>GTvzd%4Q>-Q80MXYApk|werB!ui`0?al_LylnrwCw01k% z5LmPT+j9(8C)pfQv(d}cVx$^U790p~+!918ejMJ{6pQk$dy01IkgK?E6ju~K{JF~J znnzedi16v?Z0WjF?5BMr9Za$}18AT&TOkLiU3z@D_nJ$4#)9|oqDh5{TcOrxZ6nhh zjJZa!ho{$8X?iymls7(y0xyj4!PptfywLB*DMb5_K`r|f5Ba(281Lb5O4GyavXZ;v zQbT7VIAWZ87Lyw`h@ta`{UAe6op*tY-*oWUidzl{ixcz7c_&e5;FpF-KzkWI- zr#8iZk}@*ML|Ol=zPou*5Vt7X%X$gy5&VT3n&rb>Sb61IbyvU&qr;s>OAF2JhRz`{ z>;alYy%)pCE-S{Vc1){Y0j^AGsY^_9Q#KoYCFUP@Y5w+9t-6z|oxeh} zUM-wHA$Bf?KQ%PuV_vf2T%G8}ZpFKMEsT9dmnd9VBDxqCWftQqD^%ub_;n!p60S|H zkWZx8VE)ALHB&U5UtsOGzCdgy#p)A|v~ZP+ z!8UH{?!NPCtd6{e>JGm>B2s}%xJ6M@QR%15l@p}ow{Q1kqqAWgA+T2zqq4g0tE(gH ziAP>{56X?(87&RC$>J)7OH zM&ZzUO0Y4EpG*qS@K=0xa7X%B17v!K7W?{^j|ZiJ_z*=<<(&<2_U#$2O>@VN(cQry zz`^H7>HwWTYr}{?Uu@2f=Ec?gRY5FA_%aYP#GlpeW1YoneU5eYYG7g{;GDAJHP0KN zvZo!ho9+D%M#k8U(d)9q<$W46oGLYXvew_}+e&t1W@z1elqF;jCoA(?><4p(#kG<5 z7d>6(ydYW~K0K3{5vm$rKO4gZC!;L_`mzL&rzjIZmhFq6PaZ7PO2Zjc>CI{m!jl&Td+|& zvfY3-c&>P2Egt3_{W6P^@-Kfe`dO&g9|s0TzipkC9doLq3Qz8SnV1t-`t#YG*Oy?$ zminBXs#}w^(0}oWE}EgGO$}DNf_rY%{$o^@8mc^$71~$Sz78c=+ALTQ+(JOq?vdg3 zdbygWXSNrP5s)jb+OHY?29FQYbt@bLpgi?cyjL8c0ep2e79QfY~nX&149@$s)PcX>;%#x#fN|M(F@Slo7LvNCFdtaCYXXJum z2cpW_LBAIF+89a`LL)1->TB(O4}uRS^AYx)ZQWi5zr9)1?$b3^>pMHU<-}%u=4=JD zjRC<-zL{5VZ?RfYMw->@RX#~j@_DXz(uR8Z)&Hn=`Ck;sFK}P7v&qgb(es_f!M~3H zw!iNaxT2`Hza2UE{Q=}y`{4Wc+^@m!%8lYYi zOXsbK@mcPFJkw%7jaQGbTTaR7KyLn&OXoG&3Bs1{^wlj>23j8{ld&a- z_eRawB>(bW3Q8lo8U8cU|NBu4_>aQx|I8kD>jf1=o>J{PC7zm_(ABj(!S{}M?q99w zwgX@ebJDMP#HBqmlvAJ5GEA4ND?MAEJny|UH-cVyyjaXPYt7BO)Q|6l6?;w*e}GP58@Yef@2nZRE7AT`OgJ0`~!XO4sn}!I$k`KPfNI;7vFr; zPGmcT6v%hzH(;?($Ht_NvuF(ch}S!P)ep zf1QGTp?#w*%%ECIuAM%U(C#DiU&maJ%g2%o|D62x|ItA$*X4h5MF{@EC$9gu>qgse zfL_=HZ(fgFbvG=@NiRd056rD*_odE{{X7ro^PmsMlARGUjI+e?%(&{(7mKf z{Qki^M&y6?Cx0^W-@(588~(Q%oBtpB+W%iY)(zAJ`T1oe1g*BEKj2Z6cYZC4Fg;%B z0Lpqq{lAZo+rytAw`Nsrjt~6@<6l*mt`@(|z=1RJk;>&%g3kW#Fzrs3XzcpZ%4R>I z(WBmem-%So`+EKK^4+fU!rbZO@TP(rGSgZ?x7L>-eOXOjPxP~@ zm4M&Tp{her`1nk?FF+GC(Cd^J-MsZY--3hES zwqHi`aW9L-+XF>jD+LO@LdgM%gd_sffvmp%d=58Gkm?_$X1Y7YIC5+ zOC9WNRcT@LGNO1DQ-N)Qc+2MS)cSYcA`_?5D;>DiMHW40LZ_0O0<839LOqcpeSP0I z0wt7saV+6+05?%rUgf>?YrgI;3ZY}w+HYxlYx7L#>`-9xIbwmOJ+?rDM;4M$3Y8@| zI>QQ`HE(btK9(~)YOOL`Tf+Rovn%tfo5@e`>%<;N#G^>I7%8cZSPw(mD@6don@Gnm z4Ud6gZ4ZD`1+AxMBPmax@XHYpH^<@k@6-% zQYtp$4I<>FcX0zYJq5htcqFehk~O_JomNJ3I!f=<_W*}VtZHj;xW4f#Vl7#cr{oQeS6l-^%RFDOn?k<4&LF`27&~fi>3GW6)r}So23d3T1 zM_E>M45~l0I^MhMcrGKcn0z1O2PS=Yn%TB z7SGEuSA=l>PU_ZO+s!g!Bd6|um^j|M2XhD%zSD2R z;{tz$&)0E%=SO!Nw3JRMHvr_Q<+s*70O;jS`KU~5z9}+rq)1+^bonixl%jf#Teb2k zhf2{fPMp%Xex^Sz_p*kmpx#<$UD|r?Q(z!jwTanjTsAw8A8$1onA&`6fBXJ3KMkEc zP`rt?0^;*u@AxwGoi!?JuGqchcsTW-f^Y93V8FwBYpQ~%p>ikW;gAqMd<=`RX$9~F zoMrb1JhLWxykhbUDR{~~$isV)Y3>rUQkEl&@_S2kuWc}~1ashA-_w2c1_7XP6MbDY z7+y_2S9ctY;Vz5Bv0>^Yie^9})wZc;V1?SPI z*N>;1M>k+Qn}H`KxVJ0y+0(3_3aTy&0VWuhNIc8B8t@_~!|s69q+81f!0^4@tK8e# zH6BY#!bwpED#iq_T?vP>R{aLCn_UU@YLxN$vgt+Zz9_lr2u?H}#k(C{9LUH&!0dkT z><()Kk-8+sBba?>@V$02FP_Q0a} zvxz0PY7w%)0!i z?Lgo!@*-7$&LbeQ_LQigg1PN*NdH;8P_3X}NXxB6I%x5P{t;9SZ6W-h6Z7Y<4d6bj zjE?qpkB@<`M&PR&CWVC%_QlU$zS=v=J0{H=Afm_y>R!U#Vn*~L6KZ*-dAmvF@r zb6kpJkA8zuKcwPo6MTnuTdgLsRQh0YDjQ2|S+beeB6(C|bcS!EP65isz50SX#wBpG zR@obIZ5X4CWeVAt?vh!|ZKn_j?`ae={k)qtl5r zo`t`bSIo++aWb{1J&`>#=?62kIglfMYPQO0yqAQqUB@*13=4+J7VfSE!?*gI-d>4T zrdyk{nR?#yn$vr75KZ(QuH7qht9rdGI>OXme!wg?R@t~zV**8zH5u5~+*AUi11PT`)*o<4Op}drk9* zdquZh#DmH@1YNm3LU~LpIX$OzmD~y5*2{Zdzd+yvCYcliG7X$06{x5r$ZX zt(wA2%E?T;!+u(BJ{5{&ceZ< z*Xdz2?Y@C~iBchh9;Oanm1(v?rD7YK3c+=}+n40*9CxhY;sM(LZ9P_vUhET-oqNU0 zuh|i0zf^BkJiza9qB#I|C}OoAZx`-5`D=u;s3#>Rl94>UqDT( zCs&TNFYi#r0ab;gW=KH+vWpdG`mc2@?HwNq2qr?&dYa4Snv}kyx$ADQXO>q4k}_D! z*hjO!zI&&&bS9z3K??hy;D1@ z6L!#K<+$eZbMhGlKGr&5+ZFA2OBNESmwSJw(H=<3a&8?7*P^}afw-8m6W9IiGINlq z3~ni^QG3Gotv_e}1Ob4uNVM)<@+fm9xe}W@wd%w+5noD>w3Yv1TM68{Ke?x*FTIgh z)%q(V9l<a}KRxKo9+QNryr-I1UOgpYl zpMjwb^;1xj&uK{+OB39=;JmY&lq<^sdY~#Pb-)IReT0$A9m0m z=U>a!?Rqm7u0g>gb+$XTi(8b5_948nC&<9tF zyES%4tg(KQ6C0cmyT!83__CaeoiJfV4|}(5|6sy^4G!h22tv@W0|V>ikha=fDAq8s z$yi9T!Oqplxza=bxRQs@#sdx;=Y9de-x-P~^^K+3Oe@kC6`|-jS+CLdZ2UcaxTD}C zv~`%)Xtz{QNiaZ6o!So6VPxhtq3hVhp46g)6*OyzLQDjv%B1Qa+wBn8Ap(BxF-2+-|y$L{dJrU(vY397C9(dG4$)(rw; z`ptDBr9(>Qpp&p}gK?ZY*AScS-pUnBq|B6J@d#d0Lyh_s-3~h|5NX7_3vusIR6I0ds zl1xR=&)b)(S5Xe&? zR+(kv5%uz6BPWd2%*^2CRt|E?&H@8N{ibG+bCyn9{%KSj%9*A!NIkX7BT?>vxjFWZ zCvY~z^PwDWRd^&*%Z#P#$6<7UJiKCxBS?z$)MdAhWeH~F-0U}Pf2;a0Xp~ik%VE63 zh(CJSWuU@(?U-k=X#})Jj*vAO9losxd3luwnwc)UJiLjwn))N+g>}|~1hg!!G*g1* zgSPkGc7|b<4*NvCt7I;}had=L1HG1GfM9DrNcY!;d^#}uKSn>-Lc-e#C(zeTJ<@dC z*845(tj1Hr=l2u0yHfoc9S=gZ+#>hW!E1N2*T`Hu=z@OgQ%q)c-AwvfD1#HO>h3jS zEE>J{95Ff_WAZe2|wHMbXbY+au0cTYrMA8CCBCR`Pw|wPQ3cQPscX7-ckH>DJ zecOYez6H#hvXGHy*?yFE^=3Am*S}tS!S<7IVn3ni%ZsNF3uCo;t?ON>HBYBSP*3^3 z(Pa;X%2J(is%O-dx~%bte)?t8B=yz}u-kqHLKV{Nld1JlMZZ~L`Cw6NuB;^D7H_Ju z>6v%SJ(@W6u&VuBaq5fk9d=@vYOVYyhy^=*O>%%*J~w`vGy4ugUkoms-Z?73tPA#T zUin+*;BY}SAcrnGe;~ovDKBNfNg@zaYpH&R6qbsFfo<#?1068==!*~LGi3aDkk41mok$ z9%ge1=&nA8N}rpenvX+c6vqMEmNfA(l4oHgZO{d%bR;ZFD1Y~hETB2>3vpItI&3-X z_S)=+fN?b~{lUWji>Pn$XZnx7@9vY5PoYAnltQSG>s%6wm@wBy$Yth|%iJ%Oq~wxv zzuzyLO)fLHk;)~^-R3^IGn<%gnAvaN-|zALeIDDN@P55s=XuU~o`ZoAgIBI$FZvRz ztG*U6a(?xr8#n7rYQNKN*f$qZBsA@mSY0MLq(%v3BweCJbDxu5Yeo%y_;X>z+BMU! zH7G`7#uB3Y>?C`-QZ7f`I!@L9l`6VR^14h1-vwfuUSwE+?qilko<^CqG=Mf$Z^6Rz z18-1HqQ~ryhn^rkcFsElC9)@M?a{`Y0$*vJngGpx$dqnc`u&8eck;N_y?U*@&A*fs zla4&LnSFYwGotuhdzCM?jeWmlzw>)IuIX(TV|`!Vwg1ilwXe@R_m;kygtK&LSn2(^z0T4bQV*tq zF(lHM?`SSctX=$zV#GSXQO0MaPljO6Wi^YUh3f*t)>TcN=Xgd7bBTY0;&bkHSYb~0 z2(4r)Jv{V`@h=aa3ub<}f;@8}=M6B1zBzdK{%}PDuk!q3z)1VgOgduc#phwa6{tmh z^*MTwnN{IE50AvNPE%r2_HYdu!~JNfh>aUY8LHNNHQ7_L;+}Q$g*v0p?8_t)$)`iA zBjWDQ%Gm|(|BD3DH+7b@onj zjTTPipt^7L5bS~Ro3Xs+U1P99&+IUd?apMCMLBSRgcetT{m})J*6iDwn?KSM!;S4P zZ-&g(1BD|F3Lnr9*T^M3EsGM)lgN55v_+7IDyw0*4C+D(VJ%g}&=yt>D+PqP`BfMa zI3FbYwb9hdI$vJn!{68X3-;e?lJ*#(z($?(DoPOd?AnjNuC}>g*~{+4tUsDR3GzV4w> zAWiIiKE16CWrQa_RoRc!+)b4=_+(-3UwGfIX7umC(t7CV)H0xW(=JOA>NmOqadL)V z024PWPDix;tE*sH-ryFqWsP94tMa{Tr(#N1Yk;skd75tI;5J2IbXrb5KM{DjVs$l1 zNYSD40AB^FM&P^q1NIa_PzGhD)Ag&yxYYzE_&{7TGXSJ#nNKO0=|#_?RT2eH2ixZK zRPJdGm&S+s=L6%D9WsM{@1R&i7M%X+M#A;5=SMR`sVfRN5YpeNHJ80fFkki@n^v)O z^C1|c1~Z9BkfpB^RPA3xMOyL18}4@ZiV*#*=J^k$Yq8L-K-OWbV%x~%>=|X#lJVbZ zQaEGFC|kr%zXV3Bm~S3`!>bJ^pay#&X70LiIbPx1w-;S^L7RZ93{(As(UUzn?!~l^ zU3G1FOUlE3ijfxeNw?l1sx7GvU}{#dF0Aart-jHX3cgD9Nry!>5QUGKoTw7kE8VN5w5MuR z4B+aivvh;--R&&j^V<8O;rI34;eOW6M?;D3Hjf-`I4(ccZE1F^p*5UgNsAtcY)>CZ zUv2`f*JLY;Otu)8uypgf`UpsdMrGA34K%ZDO=WI4541hv<7ABWE(3%nWBtSxL&CoN zz@=UiqC@p{bvOkA{Z2x;FY^X|W~%4Kg!c?MrKDblCPxa74vxZ$L@!26`_(EwyJY86 zU3&Rv(E$RD!Bc4;?1!V9_6sFD0~1WO#_UACIewb%2Qqvey+!+jt9n@x?Xi~??NrQ4 zZ>vq+#xyPSkj-^;qHMU*m6TPD_-+A*ZxCodd@yM`5I@p$(lm(p>Q zO2UMr77;C5BG~HM&1&M^HTQ5h;;eO<2%zW8E%(*!w_c*dPvmnF{#x4pyrvl1FuSUX zzn%$tK1Ok9>yVtcsy+9hZfBa_`aG%uoM&V7SB(3WsI5w8^-_ef|0oX7kFYqgk43{R$wUJ8NpnoI!%P3()jn=0Q zANyI3lq#oXMbAw+id>?|u1)wWqrX`Y!%WA%gQ~G^X~vbyS9!csB9p`8PQuFj$!e#< zH|P&e5Y|#;3Jh9aH2H>sa}+2<76 zBQNOQSaG9wm?f)U|GrnmItV$~HCfn9!(|~pN+$W9fU!H|x(m9C@8GhPfP7%IF715& z_(!V$MD|C6kG{9RD>iS5w2M2YJP6K3rGK6E{`w_hG^6R@%N1vdN4Ljm0{E7#p6my} zG$1DwSd$v!zxu+GN5A^?lNlqU(BT%t;NDb7#@6qtCDxk-*{f29epTsZ*?mE}Cz_FN zTHmhgl|p)Mra@iSztbA8c(a3Us#^bER(a7UoRK}}%yVDYhKh&U?3c2vu`{AXL;oPl z*U$27#+N1hPY!3GTSYcRR-HN1G14|(`ur0x3FFE_%n;f5&`F2HP03EApkqY{k-K@| z+ZvLxM-0;u3z?43;I2I`Wkdr_ZD@$G793{S<0CfDHVp6P_CD%pzCM4J3qjpz&3!-# zw5=DnSs>fxW&a`VZ4Xce6Av5ALqkT-t~W17sgYal9$2pD&p^lSst!=lk9z+E-0ALC z-q*BrS!>PmC2Ms`c(PU&ycGB7;_REOWejj4FRgA!l-%!Q^u9@otT<3+$H&9#14KVm z3~QKyO7&ufrB`kdkrxNNj;a(*r`nf=i%nol_a7qHGb2;DL(REdg@fPd!9aGC1#m3u z{R-WwRH7_^{XU$OR{rX>D;4W}!=Er$tmnic&x)@1g2n{;F2YwYV?0wuy*HfG^u~hY zq&>~|-cZ~c2G8F+z9MkT2w~8>k=dZLAV35|HU{qxPiL!86>h2&N+$*kIK96vrgkmj zTuEQcb84xxRK%li8SxVfGd;)T%@U>*(8Le^xEv)jYtbG)>sncm@pDe#T2}HM(k-q> z?*4Dn+N%944u@g6npFb1g-V@9U#lBEJ*DIVdNC~m=SOoG^$PGF3JqWUNxu15^;iqo zFp^}p>(1+QhFxe+#8@pX{NP^=V`y#jesLPT6TbY1NP4q(21b;R911^EBj8#YnD+f{ z2l$&618|tW96H{Tu$Q>H=PEi}C@2~0-@Afz?s9gUMDwl@I*9?pq!fhEZ7kq%(%(==S4X(5yLW2-(*T)Rj=olkhh*SBWFKJ2-$ePB*e=L!u*w+eKy zQIKe-D4B1L#RP0ttmxVe+N(lJM^0z-+#6my^K}MTX!qlSf-_#7mnrjb%UT{b(ZMI6 zHrF^;a&;jzj-*E#Uk^9FOn6s20?6)*YI-j@7JI3Qv1P9=@oOS8dm}biabXwJ>sLYF z*~)&O&g_6`@c8pkZi+|tX8P%B23JyTX0p`rp)z_xP)@7ve9DWqBjb5+Ba|7K3rF-vx>D%uUJ>)0f z8)Xz^?ar^8Q{R{hcurN~q6KDfR}-_#KS^}j@~W!xrbw|_81!`5KXnJ5$o>4sFqi3k z`|>Yk#-=SXF=`1r8DL(Z4KF{0720{wn+DnI8Jm1Q>k)>y$NcaVmvM!7>-(*%vig3q zAL=_XqPKk_7~4xB%p6Ma@p%dNWo68Vh6RWW!OoI7(&^oslZ$d|K2@{e$E$FAom-)N zay8^`YMH1H{F-E@hPcuB<)l%Yk{^nQN@8o@0nes4J^~RtaYWbtt`Q56b)VK832%0l)!mFXsZ=*AL?qNPDbG;h({-C+ z&oskXC$cINeh+R4i;nQ+;nr+6mvQXTTCDro2nLx3ug#lM65?Vu3-li@aK~G8PG`~3 zq+7pf%FRAhQ<<%R!`H7mjGpH=Z{`w2zT0e}?4ElvLZxq+6*XO8hEMKq2H~35yuz77 zd26nkei0D|-N*Om3!iLXCN6S&37ZtDPQSGgcO2Q!h-y=k{8IhS0(0_FXRqh!GV_&! zQ)-&$K<@-z!Y-T*Jf#48fG@9e%X;7~X&#LT!D=r#X)LE4=Qi1{d+w~C#TAvro9aDc zgSg@l#twy|kv|$?#|mpeU@QBo1EVJz?G^_xKYH8-2MpB zay`W|JFl(nZ%xD@ZNU9Y*SovAX)pb`2#T9wz$G!}d(lvrCxnBlmb#|{>;b1HMS{%g zRMFj=iH6_sB{SW<$i&e2u*0EDR*LuKwG#QiqYDa2wfvV6mB~8)7Y=+31YawA9ya zQP55pVFG6VsD;l9)kIQhi_SN zPBK34eBw>qy+Y-~!}Jk&kJ=SQc5daFnM9C1N_$$_R6gbMcp?0{lL*p(R|Gk01wX}v zULU@7yM(d!pd6b1<}w6-@(isc@6d|MM}DSnNTX9D>$&>>6|eCh@@MMyTDZ<~I50h- z?fOQXK~q(G8FpunQ&-7qMjBHWI)Aq4 zsbfT-Eu&R&qz4sFQgsb2snxNQRk8h#I_P(dia6(sU-K{-%3SJU=4&>W8g{NNy$z5wEwGbY*}Xn8EC3PJ%~708O{@B%BZK!=Vw2pa zt8k<@Hr?8{4YSi0kF4J!AXifi#{2mgu|0*iG)&Aj5Yq z8n4Pwjd#&qpN}3G?`T@TJtPP~;K8WT$nzJ_Ru=rGJ?i*Yj+Z{gywCUaZ3v!SzbtQ*vFz=Gv$d4Y?IHF# zh8vA^6(|$hqxekWiWo6y#Q> zl5oQtnn!!+RG=|FF~`|JzG9H84zvU(Ape4DtV&I zy3%>Tg}hz{>5saZg%19-HBqNe%gtREEl)y}Y<&Bh%j_k07Yj;HFt{{m{m0u?o*4q2ERN-~ODSP?d)}P>wh^V3qDJsGB z%iwA)OI#LmWAPtXYQU|0=g0!TDbG9R(Pd(klAvIb?p4Qi<$fy81X|vgdf~?sf=hO%=z>0hSt5&9epYsJ=AB zTc_G!)*dn3!ag(4QKTs0nM=G&C-Z;+J6^G7si4%PGP{ zeR0&kCF~b$0ZOlu;%zHvY#K&=l(8yc;ll1K@I%QY_9*wJJW}+EHm5BCKU=yV-XT@x zwQk*9E^bSRBp0AEJ96}-`pD+~zs8Tsl8xZ9G9WA#kn>hyIdgNhRgj*~wd5Uc)Hbo4 z%2rxgOY5yi%!n$C^oUf^GfU};*p>+ptnivF=+Y#%^j?xzmzg25=Xtb|;a7`0*6{d_ zj!CERI8B%FNTCZN@W~njM168E=wq(^*N~N;Tmx~_%>A2vS4TzDdV}Gb+G#t#QWG+7S zvF+tnPXol?-|5HFRpaBnvSi-7#aD|X)TCnfGceCXH{RV)xL3hk5~F_U1uau<;SiEj z6)XW}JP;Y)n#=78pQXd?Y)xPA=IODPPwJ_vbb9H|n^bed0XKYeXp?4+;Cq5A)?YTj z(}qYX_5LaNw&zUyE0!q2Zk>@?imE4tY`<*v80z9&9oFnXY~#EF*JZ|o`?@GR0m`iu z+Sgo3ns})88K7V-N$(ZXfFR8aGP=C?OrirqhRqP}aBxQ0JD(*5|I9#6OdKr$*Ijxf z#Cvj%YRpLxg-PF@fI-<0F zq$lTw>-v9VnlAh3r{i83|y<4Sj2|rBJ`iQyu!kbu0Qc;IC*p8iEDg-mx5TB zCmuCP5%`!;Ep|cCq5|H=wSweVba{>m9zj`z%9Q9w;eo6vI^uc(EyqTpman7N+otVye= zPu;?>FqHHmFybleeHrcLCYKjQkwDv1N7#~o8#mWF1Az5Bz_k({FNc(bvoZ%gn@CS; znSH~UTfng|nvqqgS0`n%(3cMBCytrXH_=gLaRaSQsQl{hzpjAUxU@uj(%jaS@v?bv zM?X*(Z28JnYx)M5Iu-+C9L$bcFow-h7YGN=V_>wSq&mpYn^oT$?u0+h6%$}yIV?|P zrMA*mzlLm=C9c{M*-_hMWkIv=4WH0=e~W(q?NiBq>QcU4t$q3fs1hu1YuKS>^g*e- zZ|qTE@;zWAmvh_FzqPp?U&~v~)t;{eLrOBi?FHurd$0?Uv;(C}=inBNyzKqD!y3n& zfDOcGu0Z1YnLL|(x#{qj){vF!;p=!Ny6zY9)NsS|nO7rP1v;?F{U5CT>9UJ!{h{7t zm%QwXV~BSG&RjJb+<_xZ)bT`)1LQcdqUnGT4vZXJPZfuV(JE zw#GTKo5dI^3~AT+yq9Q)q(zs&H61nYZhtbF?0dfS3kJ9*#^3g5%OFqPwlU4F01;9d ziMl_~$>CnEg#WG#t|O_q<~-0~DzXlf6~``>KC#~rQQuE)WvFc)KPrAnz0|vD?A?Uj z_LqolD@`17;m$Be5f2Bp5lz-EDlc_<7zBdfOhtH^`mygl2v^ZSRE15$rbi*q5s7s^B=5FTLO?*w=ToH|&)iI;lmeTwX+yFgK^9Lctx9t&H2;rHn2)68 zsCf<6QP!1!xyD7=HdwS~b60uXB6IuPS#R5V9X56>J^7?dOk)L9Tj z>Mjc5X~GxEg7>lg10X)KO?+q$LNVGFO|%(1(&2)`J6nQFq#N9T;AS;Tqrr-acnC?XtxPQEN9lfF zrePbknld-E?+Ik`tFNcC(+`;m*1jDx=uKPrtu|)eiq=C$CTTy6K8Ze;bF@E|rhb#V zZn1h`^-Q29rBY;Y^3+~WC=J3|?bi)?g%ON(hE|zn5YWrfkRc`S(IDn`Xn&+}+w-Lj zvHQ5a{a#*s*cl%>pm?tRqlv!YZ^S?TDhPiQLeVS`U=Xf^37IXanuNC8iT9>bBANV?I{jD zO?B)^T`uHaaCk$P%xeV+B=Jbo^3PnmIk#bZZUb_Jj$7P3aLrI&dS@hblVBgxW-=#M z-2H4KvwluCd_}2ur!Pv$t%X(g6;-Rl!)0LpjUplw>54Ttr^0*q`rQ>HAmGhhl{VBw zw?rQN%KN>h>a})3HxT$wBV>IO&Fr6TNC|DWt$|1p8a%yj;c z9@+j(44_I3Ydsjg5uaHiY`hr#i4QhOed`Bg)x^*$ZIOEk8`3cBOr*x?4?V-v(#w*! za#GgfY_o%w8U~NR3^GA&_vfVOxQ?ED0()+ z+mCUE=O{<4%qZ;pD4!DA0c!FHX)?~gb}`TAzfW!Z-`DOR`dc6KE%cR%iNK|8ssdBx zMz&KnS91cvdC2v)0^Bu|j4J2eR1tP9#7$?zhQygmtxBnaLB(I@!y}LJXRCs1yB=9_ znHqMuEMYw>SEeXaUf3onadqjJ&>`Ls#ZdM>W9Kj8_^A5i>~f<-k6q!z=7+~h_6Iw65kUNR&8o@~v!tKc^Nrbp2HF}3 zks~Cp%38O|{@INMt>EX~g5qq)vk`mSN28^`BkASuGcPm`yc*5o|84c~+tjgj#A5wB zGbv@&P88@H2p3A|WC+d6&zQoxk%AHWb)Dl_yD3`|-B-VE zzHACxX5iOq7qKC~Kbl4vlw&tNwEbiVA}$1-F`bTU-igYag{?!&JdkF8-s9jkQMK3k z=9zetiRZ=YKxh1HUJKZ+?a_#>PH>~2oqmfWGOgsgfYNYA#F)87&ik}qnV{sAKT7ny zMTq65*vtgH=}VY&j&-Xq8t*M_S}~zszbAg||IXEEK(h7J#_!RV;%@TE+!HtRI**up zZ@-1d=hpiXfe~oH@w$6$<;>|bPY1{Og36XF`M(sd$q(~8xNOHTpj2ir+GEcbqkbrY zB+8GEuAP9@mxnEc2u#?Eeg6D%@uAMj)7wOUp{ePR0*AdR8}zb{0HvbF)^W@1Z}(G< z%xk$;_U-&@>fwKe*c;c5jLF$mJn8Rhk+~`6#zLv0Ls&POb-@BVyVLJp#Ry_n`9<-d zqLGh&w*dq%3ppiLLoc}!k%TC0(_*+uR4FHCJI1Jpj+Zhp8=GFGJC*#Ud%TBQ7-N6H zzI+t0t(2Ka*kG;qpgi4V#oa4yUpS`m$0u-P5l`>(zn4Ea;Ggf~23E=u%fnyNcCcLg z6^)}`eFE3G>}|^zQE)TDS{lcZAW*i}=nkARU$R(mdj2D z#n*~S20~_cDNe{RDiP$x5VL$_5{RpaQdpxVu6@kYARUA;WQ}UN7^B5>ZN0PcO*WnWX~Sh43!82Ym!{=ID96#O3f0$&0ik=6mVtGlM7b=X(kM= zUevOAzV;w8sBT#OCNAlB?56ublP(PH^>Gs=g;{3(6aY+)9Q%=?Uem0-k*b64Pdjhi z_~NF-gyd`z3$DJn0e~6%Y2YW}KRF2kyWdsno!*gNt9bMWgvbPyGu7E^I_p(`nDu-U zsb-Ynz?R*Fo!c07!sAbjaV&PkSO2A^qD)z5LrRJiNMjVO5sIj{lC}#m=hb|LXnjRp z+W*0uXECdRnFP!G##9Cv=!bY&QhV3Bq;Cg|mUp5>W-gOdosX*Vt28 zckSVm(|VB5M{h6Sv_|`dK<3PJE8&xYD{Fj}gOnSCYB}Tp)isk}|ME|(O$nJ>wi=!k zYjA()FAKPO%~0^xmCq?fwrwQU$lS5OxSA4u+${DHY@6rvCI7lWH zKk|zFjN=R;MNb34yf|JI%IN}$vu2hq1wlU8KO*em6%%bx>r z=ZO3Nf#~zEg*cdJ5K+)CW7?i$ADLBQ#>G3C6#lF_maG&ZZ)%;UD)tc9>km-&1Yr@e z()u-eyw*4|oVzb*`jSvZ`9eqXDK2Qk45|4Wit8Lk7w;(ZXENiD3ih? zG$Ig|S;Z-{YL~yUJDObfW1I3qsB7F%0Y}-ax4OhR9&bEkiL2p%7e8}8?vdmA39bH{ z^Ax9itkx!W4&Sn~m3$G37|V`i=eaW$DjJ7H+rUc!+iQ>eM$_ZYuDH&hFxuvqp1+$g z64XpIv2Vsv)LI7{6r77)l{NWfP2gn;vM)-99XT(x6HcRf;I5-N<6zCY=|vr&HO38m zw@2oghE<7UGeO!mc9a%>6w>snHReRbj)HT8aexjOZObaMH5dg4XH~b>G7r1|st9_$ zL5@vgI1Ijr`IC|v=w(GO7vkj3bvaYLw=>@5vZU(QW)fE=Z3V@%Sv)sGN7XJ-&iS4p zX;!T(CDJ<~{at-?8cd#3`rB@e9XA*k3WlBp)J+%IjAc`f#5RmlsOsYSUtPu*Lc8&c zFEMk2$5UnrogN=8d^qA`Zpw`hIXyw!a-@!wyKqf3)*A0TdqfAMb=XP zVa%t66^Ll17Cj;iAgac+)dFNRCc0i%BuzAJ4EM$jc$5V9T*77k`-$EY?ELR~=qnE~ zhgjhS)yVq_l4@n%6Qgqt4}KzDW>i6Y$rC&|N2zb|`zV_?T*kM6S|5BwTwU)YV}v%Y zF3E$x*a|^57CzQ)Yysl)(%0)ZN#@u|3IMmxJE}~bUMRj6ar%kxML{)lzx+HX?Wq4r z8O$i@MO((fzhw?M9fxjlg|ARF3Y7@Y?fiN%h`mbNXAzBym$2WZFQB|#(3^H2mWtSARa79A? z_?OPx6YlrxbU`UIL$*AjjB)CFDNo;~E250|dDri|Lg~AY6MN~!@RsR_eAmj6#h20a z=CtGdc`BU||BMtw#hm(JzO%d3Sznvyq7vu1vNn_<4ts0LCH7~1;#+~HM;DP!Y!X*0 zK;Sd>VZgQaGO9Y>bkefIZfaU&@scvd2Jp(W9`LdUk7UShM0_XO<@4HaoQthaS4^9| zXYYd&P`0bx!>U|dS0nCMb~fjhqxqq~6E_K8a_D~r9e=NrXQmWfQYpIzs3{$-+EbGQ zjVJGLVEvTz#-SO>!+OALC^G=3wDU_YZ}5kL`?>k4{JWsCGYeJOylT22JKZw zde(N2yktMBDCs3FsQN^SIRC(2zgpw@(nTQ?HmcryoYi?CNcA4;OQPpP76qDU^OW-D z1hClpjA+uy_>jO*M%CHJZKfFdc*0QAJT)zVAUefl0+Z%ArpN9S@A~BO{5tP$pk;ox zeVt=bHWqN=7j$}+@3igZ`LMpJxF$nHPw&Q8DFq`wW<|nqlEyO#eV}r}He^4lXm*Bj z@vr_0ZD`4WFKEPks zkqa_hsPE5u#JD=@A+w&8s!;KY#u5BShLs2~E2(Yi zZdWn%B)Mw6^Xkd>nR$1em*@u4JPEyKqv7M2jC)2p3*YS;XKO!*DCzz_p8fEs&w@gy zT~$I9SMxBVzXveW+nrgs8aFD$>6gD@>hj(+wby64y@-zMnu${7>}sB;&;MSXjU zELnY=m+SE@WG4SgpM^!6_Sijx?S_G4$>})`T=n&C?AD`iuK<52cF$o89%2~K>njmD zMC-xYM;9`fJmE`UC>W#3Kon@ed|N@)1n%3cMer7KT--9N+3>3_d0v8gtqa^geVrVV z)N#JbiWJh4_LtvCxxn`w7j9`1+O--ZwDy$UReVhyyoOSWJ%^_UpYMX)?V>=Mj4^fP z=$}tFYc?hbfWZ)s74@g>UnZm3t04eHGgHYb(-W<#1EqBvvOo89npvb7TkLx z^feb1gy|kk1qa)JM*UP0b{czd{u=ubfJrg#WGE=IL5KT;iAPAPMEu8kQFy>*5))P3 zO0T{8iP@ssVn6j@)7;tV(>|tsTkM z=2D!(Lv4)^2k%8dz2`%nk2xydV?4ac6$p3eVscdZxuwP%k%!g*A5T5T@!eEavXA$} zsjr=3tiu=}qPhS3UdY^DjKY*mX+E~qe2GUp*6``)BIqBNSEQo-AHeBj7dfz#FL5US z9(X`w%G};`GExSRYU3H+F0kVo#_*2Y3^;QLnYFB3N8JVt^jOXo+)A4`e(Nfu{brN* zdlCN8Z^ppc{kbDY)g_x~WdrWd^a8&pT7PocJA4q$+0-tcq7v!zY5wfvKn~0*bft&% z69OaHpGzm6Xj9+o(;B-HE{$d)m=SC0%Y8>mXV(b;RC8p_sLsEz1WM@g>7^#o0Hqa@ zQeLxtIBAi#foI!Qa7Iq8--b;TC~)eytZ4nrvxRh&LIOlrTIHI}n?rh#4zquS7VXVy z>XgN?F!o5lrzx;2Liw{;Ot0hm70U-KC4HzkXkv+@bJ@ z%_l7XCyA1AC!o2M!%js5n5~7r6M9|shk(d=_-mBsU;)-J5^i6)nz9_%{EU})Z)6w! zz)6GzHyFL}Z`E%4E6koS`fx&j$1(2(_3X@Uj+)|#jM4vSfH#f8Bb^rZU3a=a=~$C< zbk-UhYorb|JQhVraVGJHI8|tR_=GegS;t=vO*bK zke6bf@Ev`}Scy2pfY9I~gT3DEcy@CKkb|@3@%fF9gM*vZvw3f2CJMH6OCy(q%B&l6 zVz;+P<(to#%-8iQ-t0fPmg6o7Nty&zlrLo?0 zOn-kl6mC}_HnUg$U@|K8BybfN=+E^FRMli3sFC8$`#*-0Qv0xyW|voHmb0ooyXP2n zzaA&Hx)$qWp*)PbTpAk2eO75X(6BfDky%^I6c+zV+&iM9JBwTZsIo^fBVBnL`Z(r^ zCf8J!aAw_Bh3@{dO^E~VP>ZVPUmbWk5C9gq%AkK zI?gYStz$3x2{NFt(U5A9EnCw$B5PJm&QI#~Mhnp^)(y}gmX(*JRFdDe0xa!4XVxy3$a94LCWXZ?R{ zMPrjo?$+NIHL8*#2;>R)4}c2!YJWVA7*?^Bg+n^$uAH1~ zYBuG;(;j~NQP_1G>X=!GTdGfivYMyN3ACvz23dYdHF~=h=mQ<(q{RaG8>bOCY#Qkj z_BA*z!+APM(jdWKPOT2oWnV>zlB0!aufIF%VE5wG$$@*R&aSaC0#kL34Fr1D3lB}d zXEG%=S(Y!_7FPl)Gvb`EUfyr8198?d`cjIavGhhj}V`2TIxxrO)qs-*B>9WrBZQfaYy~fdUueG;6t*IV;1ks|nxv~Is-6Yrd z?vG85A-;jCpa!#0sO>1E)TgKm^3=EZE%H&nc?qtUiYAgzkPZRiy_b*s7P~E1daS5; z=2BCd&0ETTNZDH*=m>a*MOwJmu~;%v*0l!FF_mpL#yjJHJ&xY|8HOwnM}yF;&XFw=$|W@6auz$OxW!k&z_ur z!+lw_=vjqRN^VlYPIXbrWdV0UkT<|2AC@IGIw>tm$Y#7|KfbAZ5^D9LVV+atSvjV# zV-^48iTUE+Bi1{xvEdAQ z=7`)N3?oQ{;z<1be;~QJdHu1PZhI1;@A*DwhJIacsJAC+Aj#F>5Vc|>1T;l;^ZLzZ z_vzEzW{-CMiEiL}Ji5G=!6im;@easO>))VVK^UU2k3Q1<=IF8NEGjWH`#7s-R6xnD zbn!0cc%OgW6Sc#=xg(0Z#)ATcz{s@sBBKduMDsU*Aa%2A%9i<*VDsW`9 z6uYO(Evjh^5#Px9<9domS6X%YvG+_Wv4$!D*xFd9dr zfbR1`tMv&Y@I%HX?Nf%(3{EpE8@(+xSPWhcE8iPmb@l z2Y^JXPche(i=$%A+~a({@5e|<{Lbi#6O^|p($l-WYK0KWOpqGie};qKL2XpG{k(8L zdA0AQ`6Mv+mE&G|`==Jugh$TGmXBa1UJEig?r^xd?da`}_xr+Yfp3%S%cOta(ZAd# zf9-mA_gLRt(lIPsyTT@9WlVd>z$m_Y`|~oZW83PE(2LB5K8V2sjzj;Xbe$*Lhw7L% z%)nIKgw~e^3n;rdFyS(1@b7wuPY>#Ua#N#Zjadc&T8cV zj~cy%yTgW1si?*X&0v$>P<~P4zUrTfQV5EP`N8ApQ>Sjfe1|xIMw;qDio-WD+I3En zG)=6lsCBiCrp&~5(mpTKj~#m`kfA(j6c!&b5R1S@pbcBS%rL#0z&^5f7qqajD!!8;IC#Mza!KCI4v$7&j=%%`@vGCfk%edqcu%v^(=aPI>{Nc2* zsZ%c{XiYfe?(6`{9?AQmD`AR$1ZYM(ddM(t4XMRi(cVy)3wvb*Z5#&I6X_S{<{;#Ew z;KrRQ)weTz^BilRUrg=+M*7FW;^|mp#chxO_r^g0`Qb4Slhgk#&{`N*pav0OuWU@? z{PJuF?ZJ})-+w0D8;L#_W6Jk)$#u~oDM0XAeNka3Qxs(e{{Hx8Rz}OSgb#5*j^p`k zCS>}bxpC zxbkehnZA2(U0LC?oc43k(I=$8&${FwajNFkX2Mhqybr#GyVNym(+0d5%0O(neSWAD zM-=!s-+_J)KQRgK-1imm>?foGVD5|tuP*-vm$u9(CxJ^BU*e`F@Wt!f;i`+1$vOJ| zFYGhcCu5}5!y4Wq%iKCwQ$te7uhn)Hr)C(9aas3>JQ9m_u_O17uocDA`EPI~> zznoMtB<>V)LOWe?N}z?=7V?)lKoXbBQw$;X*$uRx$Zx`p443Y&i%41Rg#zf~ytDyc zX|8{sj~BtqKPlW2x6zL9gxj%hv3xzN1K*r`zrd9*G--%-m_SIm#f^6FUe;BcJ_ek^ zO`2dU*Q+eB7s*qOcuu}(`ReUx!9B30iHm-W5bp+lIg+J4aOjDZ0^Gzh zh4>$A9g9DAM&Tl;GVrkec{BNCH+ZEW$0iH&g!bpRK^%`+xwMZG)I)|?iD7TYaU$nx zx^w~qWkT`N-iFxg^G*VPS`(1*@Y!Z-Z*_LuVI%Cd`rp4^NKC7yUA6f2IECMb5w)F` zRHfEETL5(cIm=}hgp*k<=N0z`_*(JkX~hrAM2K`K|LmBYxGPinUL_Nn(Av+9V+D0c6}NWNZmWwUL{)FNHXpUU7H{$ zTk+`Kb4QVyt^vTEGn&sP)CKVIcBfyZSzPcYfRr}K$UJ$-^*sDdAv@|U^7esuuyYcD zrpD9*G+))@rmb(((C#AYdGwXt-5%M7HV3W3 zleT_u_`t3Ue{PO`&{j%437-`ORAENtdNiS)i8zCx1)~q|+?4nl`9IWs;u#@-JZ7U! z9iR1xkH9r6L6(38a0lv{_Odf{#^7(*ChtSa9hn* z@#B8$)rF_F5Vny9siK-^VK(S1=Iqdoft`|_t%aOS>BA+l&?N^QJ)4h1-ySaJK06kO z%b(_oVsIsZtgXHoiQZDvQwsSMNWJ3oEba2IfT^IRV#owN-dqKedx6glGeg4Z;yqxT!XWvn? zQi`@oBX%HANzDhc#cikEzjQ!(*-kcS!uP{{a`HEBHa3vLBB8v03id1UfPm~T&;9RI zMMX|V2kzP0e!wEww=O6kpo?nya*G6x`^zgmL9WvnY&JCABnm01feVaikI^9g3IFn= z)T9IIe+nwQoN-BxEwCSO8a;`(YCy&IU1 zeh*rZ^a`*C%75lEAI>PMs|}oC_%w6Y>Q1*o6DB3uc?j0T7b*A3eoxQ4?3ExEw&9@86W$du?71l2?F(*eYj^25aVUuN> zgE(8s$e1>)Ns zm2@4mS!BmQ;H@7G&~y{JB`{vR(Dg+IL46UvG6BK12Vj_2Z@2~BBesErUUQJ>dXmNK zD{*1e74_Ldgw*JC`*bzygeL+TooYV`iC5kFx1Qc5U!J!5W0fu65kQ=t7@E`Gid0vy z3&g~Z$ltW?3MGmIdk5~#7($&><(Gi&gj27EClt0)FthDgWwK+U^Vj97WGq8RJMQHB zZiDbHM%gt*YL}y;aitUTwG>suQRh-t((Q>d=l@1awOjT2^{~;wJ z(DW$ReblCVFQy$qx$8uAcOq_M;eJ?f1Tw$QEEPlwJ?ObAeWY-svLV}?;jmr~fTqTq zJNr7iNGo%tzR~gVI~(RKIwg6XiHZGZcW+YDQCX23lIOK-=F1at4MN5QAsNGz0;Efd zz|fN(oW}4kfO=`}XJm4@O(MqXaw#$gtzY%wqRed$Cld&_15_Ey%ICUlrKtjkG7AqO z5L-6Xy;lX{Ngkof;hlxvAVZN3PX8 zWmHrWn;rQkAPp%f)L5E9O-}H?h?i-4>OSs=&Z54+#CN2HY;k~BG&p;dTQB?6_l9d) z&WqZRuBEu7qL1%_^xb3f`WogbMMQK&b}vE3cRtNb8m1>qUSXfr$QpXnNgYQCEr}JM zv{TtkwTRXj7LV4T33Faw)oneYQ+?k0#%A*Ds65o4zc)ol=4Y?8*GBIldqKhQdk8NX znGhShY4p782{gwMk#~oPfZ+9S%)LXbD`6UnazX3v4udJ-FIz<>HMQ!dPF%t$DwQJO zg865vA66pN`g%IU)eHt@e0A6A+C~1hat~S8ht_rpArlaxnaRAj8!5)s?i5;VPXv^9 z8D;Y_ZLz!EG0P$QI!ljc5PG#UV1sVSM?*8dWbDN*U}ZnWLM8gHB#fo*9+MK~L{SED zqB(^)5U95AS!9B!L&CSq8`0;*F(;1Om*@%#wXI)8LN04WOMs$(PbwY_WybrbO4~s`8>uRUJ7s=GKh;d)NcFh14 z+dL!bDUo?a^*+qv5m%X7AWa4K(K`=%kk)vWCbO`AaZ| z&f>Lr#L5Twl!=ps4pea(MT^P8a+HvZHz^*8aT%u<3P6Nk!XXz>CyD!!0m_}3)hI6N z{%UFmx+yZT^ebH5TfnqPq>((lGrdog#eERK}Sk`(HF2 zC~ADz8D-4Y7DBiO4@#uicU8vfLM*Md`>rZ=b*Vb*hOl$cAjxT=H(gxZCPLZzoQ?IP zHBIspn#C17r&+HN5KwyEHO;kpYgp1HRA2lStG^imUv+f+($@MZzaD}+GXrO^^o^8% ze8X;njUA1yoG|sh^EHbK*3O;*f@yEruGXj|JY5m>^|8+g*P>VNL5kG4YKP}2I&<^g z*3booKSsFbSSYS(^|?kI?|3}2^D26roSaE(>St5aVG1dRXcWI?1xQuni*Nka>H(i< z%(LnqR<6{3YCbDXh`v{3dT7oL5mAnRWE)+^XPOOpOI9;$w$Jps++rn%qpno7TYGCD z{ZbdVl(ydjZmck0#-;U=l3@rR;T;eRLIYE<2e(@u^m2g!-Ba+PLMZ zz|_M;ttwdVkUy}@F8-7z7p6>CSU&y}^VvRJ*VJeIk#x0y$ZNs&lU)T^3@I`XA7~I` zqMQEVY_KcI7fxQ{F$)&>oVcIU9Fihb7wSw`}I-)m3)Mi&dAo~C5Nd($fzT;O1)-?CG)sa zFF@~;f^KVD>Da--Q$mB5(@h1OT+=48TiU@>G*TbfEyGg^Z7f~^5+T2!Ls)MTN(i?=gY1gRWDf@S&$28_ zyA*}w1A3V!wMDC}J`R-X$=|jeE1Kuspf^>COz@e=?xOb7#dV>1Gn@4+lK5;=)cO<$ z)O18(z5RN9{B3S1z5}AMkH46c<-4#aZpJZzl)JU74vuijJ&;D3oxC$|a{}LRj!| z%hhXwTKSH{+GJajOy}QA6JR@g^jLHsxuqk)`m^wk<5S6(=@y&*{j}6V4?4$_1@sXI zMoV^V>OW)QUN&pjV`$oqG_`Z)(QE+KbF6?MF#%p|oC+?vZR|+)5gdmrlHce%$j}){ z3Mm;)7*O9;dw<(ql>ZHesa1?M7Hsv+LRmrMwPkX}b{?!PKH&?I)(kuIN{^P;N8jo@ zck&DL^uDOqx}!I})sTrQ-By#?cIGnA-H@8SG&GOFFw*Un;yfolex9zXcauh0Mjvc1 zKU@p2l|H6Z8}xRt9+5FkB()uaEOEf=o2pJ<^$v|ckEsL(`sC};O^f(qH5b_e0AfsM2c8u}-sdkv|yCMt<@+2at0bZ*oc+A#}$Kzhxg8w?=)}-IvhIW~ctf zzu#r!nkj+~3vt88z+$MZXHz$pK6a_RSsM*mgUsX!g_B~7&Z1)I3VXT5S}nVC zYE}IUPX`Cp#dA{k_xlKKe4XU1NpF1Yg-0e!M*DUH$$; z>n5a?fbT((F)pnwrO(4}lc6E`XTS-Tz>+7tgqe)H^W@?_HD z-QRPXqWL%!wC0WDr7W}A3)aG|bl$|P4Q-4X8?eGk^9PD5PpVabbBiM=UclHWi&M5% zevim?fPSiYM-D1IFi;9}JH8evs;-sut==3WOq&s@=W@8Kx7_^_Po&tZ=~be3Fg>wh zY!xRH6D>H2SLTW#(~eh*ksei8Hxk{@G_B9vR{abO%zo3C7K&lq%2v+*ndx!3{!Qr6 zKA7SXu)YK-p$X_ZA&YC_791yYEcLr>ELxsw3i%r|Ixh|DF4I6l_cXF^Q@6&He6%(4 zJG5o?AWQop@b=?`(!jwnU-YsGlsB_Lt8DwLs0@?!3EBQrq?}j4600Pvi%H7HpdaVH zM01d!=I3SV;*l+9Nwnd#f1EogtlQJEz_euSo$U-8CS{-L znZz;dlNEy?>chsnFmfc30CQ6!_kk_K>F$WVp`lX4o@tG2K zi<|(@^yFL**p=Vg$i0b7e`M)yJ+^B=wIIO;+{q`6OomPmz6Y`UnAouUJhG1GX6JGm z$$>wI#v%$&so5M40=r(7bC&*xt#m!Bi~7U4zPN4uMXKg5x$OyK~q% z*!17@C5Fi8?R}oSF#!S&V*cyypx#O1(S6k3BqO2XcL>zkTO5X#Rp<=TKW@5Sc#0T1 zI1#f@%7(%>1u{9cY)6MuvL-Z6MtQwT=D6xtL9bTv9)~9gg#zkVtR}+R=@|a@C8gv1 zH>vXLVOy&cHBL>oN|ZFvyw{nhNKZ|)%yE7;ezTUwBlbpG1=Q}V0Iz^gxq5L!t=3Xd z5QpbHzmeaFK+UdXPtaB-nR~3mh3J9ua%f0U2p`#qVV=-g|3uR2W0>c$xdXdHDq=pj zS4%lmyzn&UDgL3kG+jla^f=@Ps&6^t?AR~xawt)PXOvNIwESH?7Xg=OMAulunyo&l z5@!8TCypZTfo;KZ?<<;;Zo23j&Iw(IQ$TB&vH2L92;A~|A}LNo=Tp< z?AH1qp=rE>y{cL=X$;S+{biHFjdRmd2?Y+ePepY#pS3_duyi$E>q49es z4FRD{9h#FASAGb{BOc0EC-z04?PZ3XrG_Ev^A6N5>yY8oA`>sJM7M?FY5BS=%imzW$(&i{vm#@$(u5%lB_@p`f4Wg>BJ%y~P6<3QY=)T{Kg=414o7VC) zJCp5|<}aBdDjo-5&}$PPArqQ@Z`88YASwgnn%s{oPMpf~6&dRGbBukC0oVDbD#zX= z-8^33icZJNA2eLZUxX2X;k{*Dc`1p{=)O2F&pD=&0&}-WNGo7KWWhvvttm{uq9|iU zyrBtHP?_LGOoS!%r_SivWV%Le-u(l`T1|DD*~>n0RAh{A=kVHv$LLq*zw8ZXS~9G7 z#)m6R24J&Mh*->{+Xv6W{-9~%BmT9kAf%{sRpupz@Y!LOTF~uyl%vRxg1b_=`=251 zMI$uDluNnbGX;l2uA%pDer-OB4ptJg-aAAaEP@!VzwIkD3@O?XMn+QU2~`U;+#`i^^466 zU1L!k4iI^@C#IXW1XVyTD%fSgM?_z{KFnamUDy98c7>Jt_F+L`_qVTw!D{NmeV1dB z$}M*AWRXwwt=USA1XdXA3Ux;M!n_v5_XDBNvU8nXfW&4;zdux9Kc;7eyC8t+BFjr`ZLmW_-O$)9vxcLpO-NmYT#}){V|JPN#R;f7Dp@PpxJ4C z|5;dwmU@HelU3fVZLYGb9ju*1U}?99Hd{VY287ttxPW(WLG5E$l?q@Ww{%}Yy%Y*yx8d_n-S*C?iR2(cED z=gS<%J*~Y(lgI))7{?D$(8%2<@Bu|`5 zNi{b(V6ji8e->QJFDx8cPazKra<$d0`8FRV!16%xteIB6FQtG=&xz0;I#46fiV8fK zi=>Xb3w?bq7xv|8&g3VSYtk$m0oHs1Y@?hr75R{Nm7t!~VJFoa;mn}vRkJV}nqtR= zN4Gvx7qanLSQ%!ePGXmBdS_VZVC1(hPKoLp&jDhoq5mR4YdM7XvBarN=ulSvaCFpD zLkRbPcOnQ0B0HJX^bpoGjarC_mXHZndq7An_#%^4d9)|^l`}1LEOsPO%bX&NhFUcG zDT~@J8VHyu zyd@_;oL6NQ#z2=n@H;rLEysGVoG6COG#W^#!d_gZ)|cNLBl^W<;R@P{X^2lE^98&I$gJ052fP#Zn;2G`d$^-bnB$KZ*8IcRgG zEmOt(4EyvCZs-}h_cH)mMmD0C`y+szn2095<8Hm=C6GAs z;eK-JqR4rAARml$xLm`Vq+0%UvZ$_;oSNxyOk{jcOP*XSYnb{;3oQxunqB05*WGAJ z;whNgHkEnx**hZ(*J1CJJTT5;tAp!fjo`PD+qNpXOU%l$nrdMxXn5t$g)LB&2K%gc%(GT zH9J(W%R~EV7UHdp3bJ5g?aP6U&a1Nlh3R;>oO&~cWh%u3I{1cz&#u9{^twOAdMUe~fUfRY)23SL}zqV!p`BXvt_p*<90?1Sw4BB#K< zU>4ZhrD^usdssvWZ0V?3M+IbL#N0{DQ)BBZv(%7&KU#-P$5h3Y8f<9Rt@w+6l4X~W zQ0wdr{t|IZ%iAbe!tk)60$CHo5)}C8vA7nGEQyuJpkMX;HJ=Oclu#|x5wN>0-QI4k zIrJ#(OUTepxEHz$tg>wjb>TovUdluFf_5Tw+Ny4aF^K60r^8Ru($q5Nn^Bilv-{ed z(fMntx|#*|WWv3!H3Z%Y$E-v2=aJ3DUm$`K271*cQT^UG&OiTeg< z!s@3X?>YGGL)%`u=Xq^EM!O)`#wPNH>TkGm@-{t!hH1JYecYMV+KxVx?oa$y@m!h>xs z1I-B-f%z;0k(!Tl#y!)AWK`r?qx$=PhW&dzU!zmQ;rTf&R3udQfpA#SX3R1{5LmkU z)abIc#>iSdjnH=j;{LsS8W*Ads~XKeDv;o>8nYuaT}{_ho?1lE_ih{Hk;w^T2T|ko1*cE^Kw#8EUX1S5X6e^RKMpz6o4S z3Xkwnz@whfu_@o&+XBDTfGlGi+Vm#yKc~e%${+U)_^ELJuOa)p^p_YL0pBl*@WiiX z{P%BN%KM|{@Beph{;Cqj4ge;Hzly&`*uQUxM9JvSNfRFVZ*HgOm!HYDN$cMgj_gZ) z$=2AzXu*Bw+KW6TtFw6>Kjo?KLcU0GP3nNh=>hEr0qtxkk`h|`#-VTo*ryQGwfepS zE=LeEygcBQTsN|TZqQ)m0@TI)&ST5Lwg4h3y%eYQAgq&;W z8?(Z}q)qXJDKJ6)3*KARD+OEV%31qgQ0Cxda*=|xLBHhnd(_zQ#6ACYOOL;RA3^bd z0AT;B%HO50)U@5p_0Klu%oZA$fDZbE{*?}RE{V@}yoCOrz<~IVHDCGXHJ|<0ec%3P zF!;Z#9er?ZUX;JX;2)j;QTfOJzrpgqd@rD#fBh1w!+*B*cLezFos9oWU!wOH zA{GBLB9+@t@B)a`=Wyx$*_YsmSVo^J@#_S0Ti>epLwT2;E)^PQV?!?xZLTn=;Y=Jb z2<`X#gGl}YUu8qtb~Umcr%6 zV6o}x4B~BDWO#2Y@RV@nU4O587hrfLgjVFmn9mkS>AT;LI51rof# zW&g^z5yB>zf}3pce88I6gGgI`uAC{~IY+z6^{O7_^VnuiJeh&0c?F zCjTp#D5atEXNSrHe`$!{?ShH{Wlr<|7^DAl?Oa%Nh&T9?-KVj1OH80H*vfa`&n?!m zw$2|x0FVI?J4ZsAp94u8mY|*^QecG}jhr!^QE~KI(z%UPacAx_T{%1aKUf^7j7Er>IXk&jVn%6;3Xx$K@AKv?A+>~1Jjih zc=^=jR?2+TIPPV2!Yg&%#D!pR%{u9v0@Y^%Gx4($p>k@Kq;{xdra_i1-%wA~t z*k&m(w#Hp??6iwE7Bl5g`EL+G;NK)_a77irc>#0(Smww8s0FrCeIo8XdYy=0l>g#B zD-H09Kz+l%G*Mbfdei*raP?2t+t}ImivcA${Pyh6mHb;b{wlw!8bwydOHIWu#&l5} z%l=>uD>Q!&AU&Alk2?gp)c>yU6xPBW`nLI8z7l|j|J@7^m|kI_TOnVbn~Qd}zX=Pu^^ zu!GI6JRJz)etRxjx7;f70&vHSy_FPVIZN9wAgCRH*?v9Llmh~_e(`-~{uf)nZqpQS zOKaKY^GgE^$I&MmfY_GY2m+x40m)y^DRpe|KrYX&hQT+^^Xwo zUpM>vFWU?LCms~eb#-@NRn>ssM#iP^q+-Igz0v8I3iwL12jnZj{Zvo!ZEG6N(0O+sN-1tiN z-i}$8tO<9q17B4a?sHCtF3`I zCQONw?LZEBnm^mJz3>j))~3ngXGs(}6P1z$D*c_Bs&*-7yB}D~GbYZ4MS6HZ=@Py; z;sn0O(vc4^atoAJ5~>C8;&WxNVM4J+Db_?U zT(Fnwe%1#X;{hxfeh^JdLEx`px!4h@jct5?IR3t47aPH{LZnowUCl#4)}_>(<$P zB2zp!jA@gP*@kX7-4bp?6*%~qHi+}LY%UB!=QK3r0&;w}EKf%2iEi9V2=s79972r! zj_p=fEKMrfy_SD-mlXR!y8H$C4^lw@u#>*RekX8iXgF&mrd|M9pbAi~-3neODK>6+ zC5B<8RJf#&aXPoeiI`o1Ei5g*^YtA5y9Wkj$rZ>)qtY+9LcytUlf9v4N|!m}(X#8*Qj~;k_w{o#N23n&9a3BT&9A z``x~7cfaOf2)fC$a(&+e<+Win+P*1CZ;}g$ME_nI^#-mY7KSCq9E$t3(*%$?d)X#q z_5H-iXwPzTiGxu4{@{urYj@oAuDSTx9x=5k$w;xMoQcodWbs8_1rsnvt+&D*oalav zHuYLH-yo6tT{`u=lTSZ-3!*hFOh4{Pin7-T z?AtdZucM#1k!f2*!C(lL<4Fgj$|Ei=6ty1~wRAFjj?W*7fL&3#e2Ku(osk;={pn{Z zw+R|2B2H-m9oOudRls>D$us<^%FO6POU2K~DrFTE=Ih>Olb?wFKr`Z`3`m~>MvH-S z6B~RVkKOW0`MzJ`=M640x&n$4JUi9Lk9m(iBS}4vck0O!!C_Bl$xhm~lku#Z-((Mi ziu=|fYL#anSY7)g;xG(8>%3d`_=Yj(|O+fAm!K@ zLRH`Uc(T{+Fy*U^zm|@DzepsA{nHz{n$PoATu}tu4#H&f1x$6#a5w>*zPc! z1|S^7EuJyBu0jz)1MGTsT;Op*J$6`*T*xR)u?ZlB2nHVz$nVv$_jJO%N{?Xd$Ngp> zW)C_(I}mkQ9IR*g+@*%7p!ZmRkBB=!MM(^tF6lSmE6eU^SR^4nNl)NEY=*=1Lh|#= zf|4HBZi0N5IA%+N`iw2Oa<+O1H24OP^`7{%02S|k@0=%NSipoEezp^&gF7Wx@!R=u zUUAu}J|0u|Wb3;4DRQ9(zqh&d`filTS6U~k1blq^A@saPX#qV5Z0c{BEw89x;!-Vb z&d}|h{VLegD}=+FVyR=p*qJozOw?r~#Rr2xV2}@6$4jYh{Y&_`4O-aN*!k({bFPFf zavu=yD7Q1PP&L^83j*is2WayfJMYE2eAqe}Og#*;q#s%7Jw4<%Q}31alKqzQE(L&^ zYHr2-Fd%`4AHYzQJ%}U(;>Xf5oeOLha~nLGZ_cJ9vJgw`?B}&=%6ZtVq@bRm*eNX zZP%4-J0pv(E~2dCtGkY*MeRe|V>S%Q@;3!g&a>QggeQr1q+VO`TcA$}T?Gl87Jh_& zokKB-+)rw9*=ORSK7qGml1V!6SuPXFQbY!TdMd0Nn<5{wo!nrC-)8)e(>q&Y+; z*rE;*l4GY=ZQjBiaB%yRGljnQXNLHyvmIug9n<8|vm+V&<`tX9f&E@%hlka4ndIwH zsRjiT3mRTe`K=|@b0Kyd2Pdh<17Cb+;>rsu-xqg|yu(%|P6A< JJM)-1$N#-{jZ z&TgwH?L;6BseI4xQz!`ba4hB9ihJz*v8o*}`*A=Taa(_If2E?c65^N$>15 z8|Us?uT|S+>3Udh?C=}EHVFGE?x0e#E~l`;)(|QfP2;tN>l1_vX+j(qY`m6)yIqQn zMvvX!H8>*O{a6Pp%xQYqW#5XHXxC%!lBiS8hPGjEt-!#QEZz;w;kUcYca1cv*TY zkQ%N-ZUW)OXZu^IWgGyOGum#R=7y$|^I6KsFOIq z!Z}LeU|hh1A?{cQOJ<#)rp}CQ02J=Mh{SG{pBvP7c112*umNPqP~54bB^SOtyJK!7 zDcBelGiU18lmYmb!T zPEA~TLD0Ciq?NKIH+Z_yP++s%t6m1nhtVrb6PtCKcp0C&xP2Mafn;NSpZCXzv?nSH zs{o>5&J`uUnSD>6Qti5f0PW=!s3BVd|B6MW&A|QYm6XE%^F>SjXnRR0+E)Fr&rN@K zix*uGo6xlnU%8qBeSA6tt?_mKUV0`)bwLfG$0sKa3`pAz>V7|R+&ZCeRkpHPlqDN> zG7;`rwyzKI9aA`I69U^UQb{D7ruiM#AM-W?q1V7w{UVc531NtVZ$93Qs4DJ_-EAO> zS5X``kps>M&etyDRE1M(Rb(Gs1zCy1lESG~@&9Iba!bbA#s&^}RL+4PUdoI4lDccH z6uj?oJNz@U166Eg6zJmk`;v{xpro;9(;4T8ptlc$1u4c8NLe*{WHtvcCTle)geaieeM4BLW7HfD!F)ilIXHx| z%NjwhQ85+_p4~kY-Rm-#d_(M6v9nxkrCn!K1@Y05#G$F(g09tqD>V`O5neV?;sZg) zu>%eVC~l+d%`7XC03(i-MTR?&&sjGUN_Rwi!yaqR+{gx1o-ao->UiJ}s8HUAfF`*X zuN{Rzym)v|z%6a)lz0iD`YcEc>KGzv$RvkMCqO zfT!I}V2qZl!o8oZ_@4>zp~5M4ir zATvn5Vl<64Pj=s?D>m>uO0D7NQ@i`19;4;>T_!v}TYiwZkl>ZSf=37PusmYxuqw=eE@$b^VD0 zHq6uqi~Hlhh&A*=cn0zds-w@9j}uacHsnITC(<9ugsW7AmnDtg;S) zN~9|#3g$JOrQvn9t1dH~FG$)CWw(hSybfzET?bN+aeMnhtMeh;IjZ6e?IJ{K%PT9_@Yq=`<-S|eGBra4diZ5wzGwTkgc1Tu-=DOeR8{$f9E4tA`gO4s+G4Y7nTlmZl33tB0D`zi-V8J%Ao!E==`WybkXpFT?3qvJN! z@7ZEob;_OT7Aa>!c(YgUr})0!?~eiwf>U&ok|qV`9X>9_|w&fT^g?c^ITr|ZRE0NEw>}I@D0pun)$G3@lO;*L?tvs?JP)YyatGFq7Iji zH-?p;`LW#DAdfR?Lx!6;4M@CUm&h%X?89&t9r!%K?`+*`X~p|&bLU;WpaS-E$6l$l zELJe4_%y!(GjQL_1+8sr)LYkTIO`%Sn~UO;d;YvhyK<=n>tJ--lX*$Xt}_8`FYu7% z5q4(9ZLAg5#KhVXYVWt$ov_$Yg<;W(BZJn>JYuRw-;o{dJvmcpnAZAWejdQTHY{Wn z%11bqxo5si^Q_|Q&938*sO`bGy^7oRec3+y3JtOW24(P7T>mOY1Vd9J2*b4Q8D&ER z2?J39(LSxsUh4)|_KQZwTKQ3`b|7@}u zG65qpa1UO+t|$`1%)WzuS)@2T;!j9dZeH)cB_A5%qHT>dAx^l$lk1k+ZurSNEXI^}jg3J!X3h-XiHdx9A3x`9KkIKyIJ^6NND zb~pwIp)y*Is?$`#Pu&)AQyl2I)NKyzoL#@WKF>%_6|!#cihH`eQtVK%&3Qe?%BR?7 z5)TS4>qrkVY;+t5qMzN`igie)ht%h(c*W zJ!WC^3c=jL6PqU-h7d^!ugoIE63h!Yo*dR_cnt|l_`)8Sr`#B^-Z($(8&-LG!TXc2 z!67l`k_?5$SewFCm-n_$ik|CimAGJcG?i%4n}?ID+#5N17&rSRb^KUmD&>$iQ!c7{ zU}D|c`~BWiBdIF{K4q`Vj5sPHi;8x1H{7CP>sG$t6;${5q3uGZrZrpr^at5x&kXho zE3GSh>vih)9*7@6$yOBYaxK5`Nf2nAd%Zj#pC`Zb_S$rPp5)WxJPEMp7hiwk0IFxl z{sw7Q-r1uP*lQ@~VfaZuZVOp&a{ArA22FFaQL#0o`1<56$_>AJStx+i>M;!VYKfsP zM^a*!SbXmaKmhT(QY)nFxa3i^D@y&Q`se}8rXR`U`212M$ueD<^Z5 zoX*-tkOGUO(^<{wpULw^9G_3rlI%R{I^13ms%QHB>Tg^JGf@6ZWM5}AUtX2IOV$!V z|1)n6IwzugwyM^0`C-~;f70x{OV>E_G;bQo{~k^7z*WxblFy2tyE|-Rlcn}S^vCTW zo8tJMtsdo6)RGW(KkwH1n3~tq-5gFQXqH~uPXel;iK#v9xCX}5$de)#=XtZKx}STx z{o#A#uWeAo>yJqeHrY&LYqV5}tsjs)9UBKSAlrg<+CH)>3&~F4%#gYLa#3&lem6^c z85j}Wlv#gOvFKU#W&4ev2WqdHj}_mdJ}5m8%*sM-M7g=Lv=l|Jok&ez0S*;u5|bUx zA7*2ianpX^y4BQbBya(;R(xtPvNMtG)HQZEG;EO=g^3Vnmr4bz(pTghkK=v@Ystbs z$we7+D}YvfEa5Fjz8uV_`;izw3C)=!-qQT0GYJVd(O zzZ#=AC2!f7z>T5BW9>K0xae!sm!(XZ##`?jHmAXJ3SV|I4y-sWd7^7IRoCb%zaKSFG zGVzC0^^#xLG{7bF8s?4~-rrfrZ2Z2e)uZ2}ywF!T*J16n)S&3zoWPhalkCO&S7$ekNoZ7#&YpVIx2x!tES7^4zewI&Td2Ghkti#Eb*UVDe{hz= z=allEcNe-gH;AQQ2`<^~^E=6S^Hb)AwlT|$*ZFS!HoPYb)x5qI^DD_~QMp}t&rw<0 z3E;*n1ZM2}vtNN2UvbZi>p1oqhj?Di$E}ZIx7WkZDNzVTivpf2D8ruu)k}|#e>9wh z`L)zYjBPSX%_PPj)ErGPQ8`DTS`e)pHV2c(?`)j#*bt%9HUfewW5N|!$Z^Z71M=DG zz=fh0Peqs?9TJ+nLT*n?_BqleLzx{eTW9j^V>lDvHl6@4*p zxTFdB!7?(QKK=Ol1(Gbp)Zyrq&C}vzV<+(&Utc8!JCUY^OqT1_O}DQ&4sPkc2!U7N zPAQ_fcK!wAO&`A1&&` zk}emAu$bd+Mze+MzP6E8V=aZ|lXv1NGYZD#Y9{e1_n_{2QK$y><*cI z?z#7W6EdbvJXKCNRalH_k}?a1(w4$qW=FX7M#j?UuVjCK?k!ylKC%CP>)bh8R`m2c zC+uyo09O!yXECqrFd!|U!N-5QGxF>g_j?I-khi9_RxVkXQwtjnptXn zJ%5XZC~5p=o-4$?Vbzird2dVq_7u;?kvCrLxWz8DPwiNOYTmBiTeMW2MZzYm7P&yX zVCX&;5i7!6Ab+ElVJzX3H28Q)7RP-9{35U6g|8@A;mdfn>Cgwr(0dYYgiIf)tzHZ4 zgE*y=Q?be|9fY+)@x<+hD=TTgTVCTa=u7(6d_wz`(WB&Q^=livr21X@Q82nd7%O}$ZPsf*M$V=4*X zi%*@(c5^$8^%H9MY|1oLmq->D?vCPO%8a-Dj5t;G6AtLPGE?n1wY-ksg&B)Y)pKqi zS*3^10yZjRBc~qUC}#H_=2kQp+58X8*?pOo%LiKGoi}ueAwAAzHTfP4Evf@CRJiuGmz5+rz95LRq`@WgVzV0kN-2OcNTSU?ovG zs}H-bU^QaTd-Q>1apvo7-f@6*oX)(Ur`&=DZiJrWAXA*P9Tgo1Z%Dd2tT~uR_qWth zU&*Kyf@F=Ou&h(TKfUr%cZZZ}kP5dbT8gQ-9XJokBqkneSX5oxf5HALWYQf$GN>^7 zH8@fIHmt>9*i~?3zLx52bSOi99{hT9axObwNb>3-2+bZ?%#h=UbFH(5oy*&Y_>?tr zp^eHum6v(befvas-@QMIMPC8747$Yqbp1&9l$cb(pH(q~72pR4b{byFD7tay9yTX8X|$W>;Z0 zn%O?avwKWgqMiv8)crk}4Mn9Y698it6k;Ib>Bjm|NGd!`>b<1zO!_#P^T-Fzq$itC z&oC;1AAP6iJ$a_lTvmxySZYSVxpM2-ex@`Tu-Z%rp_L3VX#v@22}2SFza#LaKvfOG z)b(=Sgy)S1iOx_+K&z|t$g9_)R^Rh8612n>I;ejl znz$lXFQx5ux-xo5FKPZWc=o1(Q0$qp-^*LxS#V8(^9Sa>m1knpw_GaCqV`!pXshl1IRTx;4)0+p0*k&o}CFp7ilrKG^ z8fo_GT@nt~7d4(KHK0&9O>V4l72IT15p+GM-Jt=twq9c7YuQJ!x%NYKWeevF_c9)u zrLXO4sJgJN*gibo_PmGO3d|ajwmkb7Mq)NeaXL z2m9?JMZ=6HV4Y=$&!q_PN;JE;Wmi;h$g6Oda2w}68$V^XG5gnhmyHbjFHO5b6lTNS zwN^iJm0@W3p8TGEjP4noNK)Ttj#wWY7U%fNLgs42>}06_)@>$N8xnWEP03$=?J zTv`P;TkXFyr;gA5lnGB{rZGitM^;0-uPhjUB~KSA9Il-@Y{m->(UN61Gj{UH#Q(&O z+`9Kn3!oy2KY3T1Quf+bewJ~Kc9UE!YS~ddo=20qhcop~GDL-iXuQ%X)?=e)l8~gF**+)4&vF53Whxs-}0;M&XescO>=Y!a~ zA8uU9q@z|8rr^AWf_h(d`wA(lSm5p`5-{fgLo3|? z2hrz0rnj&17Oc?k#*p@>P0Oo#!yW1h9Et3%lR+QDH~oTMTWc}%yo|a72e_l|7g6Qq zZC5+aPPMw4@)BHqu%s25)g9r{ZPqg!+}lf%{C&?Ua-8%7^P?8ak=O$*{Tieb5jEO4 zwkwX<-1mXrT186NNE8Nmg6AHZZ*J>r7F)~oCC^w9?Y*O#YPI@3UYmd=ytm^IO;Lp z9f*xSX@U8Wx$$4Uhd{FmwL{MU6I3)Z*MGEcBjr>Pk`Obxcx4M0Z_e6zA2%#YO06Is zsG+Az!qL(}kxP~%>qnGD63Qy!i^~N7^oz0f2~k!-_xARejKs`)9da&=f;7%&C4-Kh zLJLzfZzC5e>50DAxNU-H>S1P0b!*3+#}erRfQN2 zkfd@{y!W9!{xN=~`+TXMxV{oxm2B{Z@c>!1{@s9 z;(sFCCxp^S`?7u(ZcCVfHIJ^AYgQY*^_HQtZK>z#PY!u)euw{6>R;R|aQFug_K|JL z_~e*aiKvV5XJ$SZWEWtdg?#jO8JWWLJwg+l61Kh?c(n1vT{UDADbZuKdkf?3?MIqv zMgiYstzs3^qx~D~Nx2688(bL`37o>PYUoQ0~R^!F=kMPlKol$Nn;V&X7+3PD2@3h$L2b|W%p zDXsI2-fC0aNh!cjQ)!Oy@p=bf60~I$dofQ_Pts}AcL$#tD(bUAQMVcCcTp+18+_o~ zW-0lpiP+zlEz*ta_xLmu46lpUhiS|bv7<8HW`vl1B$b+E*rVCV;Vm~9zaIaeY7vMMD)8|C@ynNCz0w>Z@g2%c^#nl8nSL^2}*ol{wa>UbU1D z18EZt@6H4Tuy?t}f=#SJ=odRP?7cgAWMsxt-{FlO(h6}R=24F`lApUCMppMz?N28U z+!l}#aUp-@aCHqFnUxIiW5)o|Va=Pjx|Y}K`vc)8FMp$Z{fRMB z!NXKgin7KpXd6Fbc83#@O6moVW=*Psr5t;ambE4uK&8Xt@ zKt>blO6Z5J*+4dJ)&HzRtetl(r7F?ZMy{W!yP&(PT1hW3f7@EY(Xk4(o*%no7cPQ=9WkeDGh{-H&pM3C9=`wQCQ zy%kySjxvPYT{SlM_wtd~V))#DbVQub0CDKGfRx^aX6gs6XeG1y<>IpqLu62(zhT4c zCJE|Kmcx7E$+|k*v`vk|P9~tiU25&mmse}SeEVG96M=TxPtD$m>TmFIBu) ziYt(`VGwmI+S2)m`vBkVxV;}9(*{~lj>(KzG-iMCaaNO*=fvqZ3sPbk6+23O<^Q{k zH_&pg9HPqYpeIc39D6vSaq;eB2^t^Uh}h#||Jv1NAoS20j$L<$POxDWxj&_+brr*Y zG|mT;qJQ?Z>Djfo;n3oJxV@&wyN9hlbMykS&khP4G8wZxWX7FVod=UC>-@0(KrUle zjfgCfA#L{xJZ^E%plaLIt(qrX+MF(H=xr2xUi5|Gk-S+03+qsQ_yw}}mLJ_)i7boV zp*IrZ_);*K1{C;AdqvT0NfLh}fjxy7F5YU~8Q`1ZD#yQ~xGHK_r}>p?sxvKd>wbPV zRAUQDJTrgnKelhM-n}Sf6(W6;?7c&wwv3(CT^@^2cM`XhP#GBja*@;q0nl)%({mjx6)tt=X4a z=vQwh|FXwzQ%rs^d|+Wp&#ko-HMeKU7WH9>3O zac8ylHdz_;qyw-}o7LJ2@>Zvu&5a0)a6@;%6P{KXx)$VpA4OzEnm+0;dDQT z-W-AGPc^Tht~DB(vqgMI+^~bHJlgs+?Q2(YlVOYHeWVNzVP}qa>F9zu@rufK&quRN z+VweK(kpcIPJt|@Q0;HS6Hk090qfnRR8%MDcRYSDwomsQcT>drXs?uiex;vvI(T-% za}LvzUr9{CSZPWQ31|A{>&fB7MwKrWx^xoDh$-^Q)d*|6TXcn=UQu;}42G_R-{hKF zf`Ik;{hVmLY#8Mhd*#j=_yUu}ICqN1LpHJJYq5+#G0&Dgw&STbDD5s=?Rtel zjnV05M#Cme_yF>F_t-Rl5ifaD;uCA&cdr{Zh33D%?R z^}(GC9}vDYtX_drqCCjbrf&P?n=x+w?(%;cEH&$|db{qbihfs+&`^DDZqCxN00eIa zn9jzaN5l3}FngQEB(@)NMymCYy*&U<9hhHMYm1C(Zra`O^awKRrlP^-{ z#NS$z(NR{xMn-&CTn49127ZW$0j28OX-6vQ^FmQBg@u;p&CraP9-u;U9ND7hqxSoX zMD6I{k>bAFYGFo*VF#y$=?=Tj!Q`dKTt^B6J@e~IzAYfmK`w6y`IxxzIyC{Ae$$=B zvy^;blR^~T7A^Je_<`2Jo#$RY!k;vR;RkkOr{#JiJJRZc(_}!Xu+|h3Wn}+B)5N=2 z)-^YrEt@$b#A%%QAzCKj_&MP zNm`9d_LqAi+C`6J;vPA;b9uk&OArVj$VJ&GC7wUZ<0C#3{I+~;{B7%TJfR>m?VBli z@Qxfk-m1lM#!hV^6-NZ``_khN|AJD;0(sl6!KTr`m(-x9*pxhf`ICbV_a7pmj}q9; z1j);14ckCM%AgDhtyeO0>Gyfa7N%}&aqXa=!d(6&iNZ%|rkJXe^Z>rUlg+EN<8om{ z0*Jeq&x7-4Umf{eNdAY``}@}dh%&D-hvqjOYXx3Jiq(Jv?Itt~lfBMZWgUNRdk&fu zFazc(PQLC^Tz!~$YZ0urrhJ0}g!h$PLuM}7^z*M5vOW35EX=)GQQOft8($X;0@ebpR?eFOZDK`^VQ-9_(g8AgG@Jt5UdG_xzAg?L9 zpt%Zr|E>s4yR1H+fv*bIIeciQ&OlykY<~4HSqDkd-hB2v47bZgX^bDcH+f{k!22zz zS>3z!b_q}@F@3M&rQ!wQaSrvc$cL}zJN@GO9wFDKosN?^3{TmKUs_gH5f@MH^>2u~ zI8r|pktFm6bBFcW>sK%tT~77!UcI`X&O&U+otk#<7^TeCDA`pJ^q4?&l#(1&@3`Y6 z-&;V4&x}p`N3l3(mJOw0n}=CX;*T_O`$ClLrNU1dmvjs%ro>f#vUW-$mNd>lx&V52 z=85mX;vX9{nOFauy1SbTq(vWYK`ixogI-@GyWe^TURFd5m9$P%HP~7f|4^&)aNzKo zN~Nwd-;nX~zLuNDjna3p3A4CLl^*}rOY?Ps?L%f5-+3l0BgK@57vLaxLEW+p{B~35 z;EQTffAh$v={BAcF~K`YU55*QFqEN+{BwBw*k)vQgkNy6p%2*ZQbsgB1v z?T{u4pf#vKCn?-;8Z~KgfD$(=oVmG2X9lTe4zeI4n|Y!d#Wt!K2>C3*>A-a}QP8wg zoX{^F6*s%Y`$y?&T`s;o0%$MBHx;Ln!HUT~O>(Y+XWrgEo0VnL=A1w}kxmoMl7BfxZFyF*h%p zCMo+)1o+ssCp${Rvd;MsS+ z+dCU-{Gi$cznHhjtW-dJ<#u=j$9I5UeGP5`cj(_)ZoeX?))|CX-SMQ_QCYM` z%^$S|jkYdjK(uJNej9aJjr4W_b-Qf%a)h{5e^4)m`)_h=t;d0ktSZzQUS1lQ^@r3c zI3PU+a2|~1BpPT6HqrUR57rt1Gg=utnb=&6l}@x@vNTj%{V8o74@2Z80~9_dJVIy~ zPA0urCYe4M(`sj2m0a|vx-VbO6&M~1`R!s9YXhC^YM0<7AIUWpgQANKsiWOhgHOmx zt*Eg@mU2=U*VB@1pF{fT*a^A90IPz!(TwXM918ETUO3C4c|Dg6vaLu;@NJADf`T&k z#4L|Z=?P}WPEYvw)roa8=}AoyAx;btM0_Fe#dTQYb?BPAOa0HaV~ggYlt%AhL%vCd zw0kXly7E(n-g?fZRPaJ0@y%aytd$V$*d)sGhf|0|ry6a$RkOF4$QR5WP+^G|Kb%z- z)pJf<{gz4F)~*RpIeFK<;E1d*OCuqhozCi+vAO>47!T$%qoaXK049nc;S*~D4F=SR zC%h#&;{qusi;^JgCjqHqefgl*jYk(kt*iA{mz;H;$0|AU$n34Q^K)T4>fS=I z*W}S6TCI(TYIR-UF`y=;^sMvYiQV4Hrl5(AUE9PleEXn^ivjwzj(ag13nov*?#mz&J26n=chaHfEz%HQ}mtGNFvO z26SpzMA1dRJOe+kxQbzz-WL8|ma}3St42LfCk#QoAnq@>=T0n?3>y@OSnfa! zvjSEw0o3Bbh>FU#se$#eDNWkS-~Ngx%6ibSnIdL&Dmo4*;{OF|xYEeL!MwfJtNmln zOK5&qe5o^mZki_8k=jZ40peg)uF@1T3QGklLdTtvq4P&-$&JvR^IT;(!cVUXCuh5y zc^xXVvvl_{q;iB59S4V7yDD?|$*+9iGJ;;LF%17ZO{S|thxIK;rl*JB6Ilz zQlruirlfJ2C$Z_Y+eSRoGe;pjPNvC7ZZ%tio=~9G(ldtITXl~@sdIu1M0At4RcBm2 zZb`GVpBC4tvdvmfbYdXxRo({{mfhkInve?66_v^=Zl~h6c0^-wsM38pE~qXi=~uhs z{=m=3MmgNdhxpPYiz@!W`E1^tjwuEELOY9A3Gb=XwnfXpr@PyPdt(+yAN)&Mr~54j z)0zSY)DBZrEREhhH!=jp5BLY$y&rGRutVZtIKAK|E+HC9tX~*|aM@k60BNl-jjVt_ zgm|Ls+VOnwvSAFOoTTcO9enN=?>M>i2wypyAs(<*vwzH71r2rZI&xoDeSK|ndI;9f z9TfiJqi;5)1x|w%`AtSedR;~njXA*2juKt!geJKkcNJ~qz1HleY?Z|W~BP0 zkYNy_))DMeAygBBmU8zj0CW5TN~Hr|o1X@gQ36w0PdS>FmiRY7t;N|yqc>+PliPC? zy)dsT#?TOZ@3?F2L66CktBysyXI<-ELaK9KS7LUfJ7&+AADiO?wNq;6&OX|8l%$Ry zxIx@s+k()L#2tTet1DzJN+QXo!#t6#BCJN-9@fR@(7yj=>5mRcDhi78>8Dq;yNcy4 zH`X`*0*S8mf4ojm@vTK3q^2-Ee_ftZ*qC)iX~NlLT`lLX9I+sfx!339(~inYJ+Hl& zScfY>ZBIUi43GTqWdlmErgNmx24xbJCIaRs6F0A}bC{E{GovMF2cIWkVs%b^>Rn`M zBW7VDo0OlOC%b-4=iuCT8><{fp9W8N+@F2`6Oyk^Q#~MTMKjALB^^v|Cq*DsJQ9_Id`IEoZ^_+v)%t(r*wMa-aeg96W2nyO9v^Gxar(@3iznPJTssjN8+<<}aPP~w&yM!#g)>U}<@Io* zS#|a~FdN<*zExhWp1?JGF@qf1WwrExK<(quV@S|_2R)9lgFR;6F1k8HSAtS7B^+Mb zG-T7K7~kcpj%JFx_d-1?DgO4(lr6wxj6S7byY-xkXHxDICW(-Q&BRV7W<6a$vM?|0 zL8dTbNci>UlYSwq{key|;Z?_$>-S7B0@0A(1nv4P4veo6M)vCK{8!A}ngu05!fs8G zBUwoMeE89#Rw1?|$p?IB%MRr7_GQ?!t#Xo3HDY&|2_%YCO`hLoRQza96&G7MDqC5; zy;78p3w7gVim$sSp7_{u@cqn(fK4?F$&-e7K-|1AW!vk_Jdr5lKD6* zD;?$>s13~C9x_-2R#m_cL1>S`LHJJ=Y45S;28$cOGn@QwLRRNOC|pB-J;ZW+nYlps zO2>Oc6m}{Glf*vtwCnz@I?r_QODtL%<~51RNVnlno)lgmcruzH9L$Jmn-o=81qruNWTI89o^TE_lz1bT1ykv>&y2Y$46~y|iR`ZVUnRi+D$FKl< zle-lTU3a@WE{aOd5s@9rGFule!K18)o{<_l3o@KKcS7-9 zqlK!j4Yl-;nzNOFQmf{Zf(;q(;M<{*6JEEL)YF^|S4ZNzcU7P~v#$n!fp7)yZH$i& zt|+-WUWzLEuw$B%h-vv<7G?1)#04p`9Q#vo+YXKY^-l9iUwYLvAzL3?bu)-}X8F

W1tRUt>+i$rx4ugd3{blqTZ_;&ayzz7XSZ)0_Yi8c4V%5olubQZEyRb53 zgL%_v8f5E8UTm@Qy25LZwhq)lr+At}&ZTQOC^_X};ADsZ{Iiutlyj_>;O)S}k1I7r zdLqGauap{a@|Sx;Af-|Z(q@)6WJRfYFUO5v{T+3$KK9<@yq7cSP>(i8X=7}hy3gCq zx=wpOa2;{ju*U;Ql{ReXe2jai;ugrD)LbZaytC43%E6|&)+zS7$g!EEUetCNxXuhE z|MY@z2$q$Ib0$&eA9d zp-Hks6SOIA+^*iS=x{Kp!k56*Y~5kB{(hsIh0uw+V(q;idBlno!qp`ApYxXfwfQ6< z^YHk(XmQJ2EFVN8o0VIo9T>ZpzY=A`IDNM#aSoN&t>R(jDo>C(sjydlEJ}*fV4A@fV?TBH*SC!+5UuZ!u2Pp3HJGLprFbSGeA4Uy=1zLg{_Bn$HdIvo< z{rxh<4_lKbD$p^@;KV?u8h%G|iHaaVfXt?rrvp?2>(kaa5A9d`p^o-|N7)fGFO$jk ztfCrcmPT>fBQKRtjN~o95UPOtk-saMeR z%Fm_SkQ9=noH(p9pIHZzjt)Fte6`@UT2krac(xDHVedbiWSXz<*0y>>j$F@TLasAc zcY^W4q?FkHNVnJlDHZ$~C0SY$peSuQ6QqJ8k{GFWJ2i6jLB=d#pTgzXhsr7>K}dnT zQn|Q!)R5n{LE5g%(u#6bzw_WCp&9#=bZL*6judh{7>voV@)=EFk?)bZI{kODB3c+E zeM}@x!Z?VXnw?eaNre8A#lV8d(HnDulP6Zn!{Y#^)od{*?-XUEI z2;$#I*Q*Sm0{(zX#!7YR)8EM3TO10jw_O5d7_9kj-11DV;EtlIp3sJ)in zByBy~e9ab$v0pzLNT?kh;NtBdou_WK9>4gcito%5nzvCO@HyhzKSt0V$W=KEAxMEZ z(>f(($m$NCWl9+Cr)jBx3pP0xZ)oupi^ z@5jtyU(6(DrrrasBhF<*HAVEahK2(=kNEQN+pj;k$$h;Wdw3h9Ch&)guM(-`&_wzd z!K(XA(?|dv+VYIEHlc(AXeGL>oA(aBx4HUs@+i7-M2kYjnN>jEj8VYBVrI>tS>b|- zPt0a(I8NR1UhtJgEjlihxjL$XJ;exA?pLi{0BGyH8Av*~nPVC^Aqugw?6lzs$njvo z@t2w-HSBf=fIHP`0)>ivvzk1*_NY;3V$$&I$meClolp_8#i=dPOWl%x< ziu?IC)9ZuA=Vq~$CMzM**nZv6dhFq@&uKy9#j?U#Tl|un0?jJp)c?!{Z6W2h`|t|Xl;NcO5%?NK}&30m?F$a>mhkUYxBE1bNW zbW&8^ZzJ$fS4^$-qN~^D>5soQr)nB#UDZb=&&7krOkTC6WE?>++CRwY4eyWEv^V~iSLbZ4icKHe&Oet35ddg zJma<2mW}HX%Hi|C6L)E>C{Ms_K!CF(vkXAxU$hUqk$W*sPx4CI1+tb1V=NgD%9@M} zPDg6>BH|G*XvxS*7t*PKfYXZuo+|$m%XtFyy2O2%3sBne`}gzpKu4v;{r@iE z`TqT1|6Kq?R`&Yenwl`C8TL0)?3KON5g>DFK>Dfgh5GiqWANN0d-#s|zdrUP-zMmoeFP*RddeeKxn-~5lkNk68{`8+BCBXkKKL6jQC|+Rue{jA3`1t$x zFaP%;gn#|@fBDV-@uok&{tv%a|NjD$pVFO;XSm1I%4a0%{uX|bJ>@ZOso7+aaQ_LY zTgvwQXau%(=!1hK85un*0DZ}XU>@YA`ME(is774c6sUXCt7J<4f4xk_u1+Z=GR33)>btZFz=2^bw2#w zRdfT`vO86)z;UKB9=kx+chUk7sqg=9?-6h${^N50$Ab3b1ZZ3-MG@3A@P zp0g2IHXW${Y{Wm7BK?K&4E>HauZQ5H?F5m@cw2Y zQ@J}pJ;pgHUv2E_8Z;*D{}ky-l)Iu$_Kl9)xFl}8)I{rG^+r=T8C9$MYJ#C?xr)A0 zuNoJ<+D^KtWgm7_asC=>+)S&-w0t#{8ODomosInlx8ZYBl4H>!!{NuoO2d#nfHC;j zx<3Xd(V$3-C=xr0#7oWhW*}&7D*s{`wYF^caG7eFCcHz1tJRfFt|(aANImnJoeU)N zYW~z5LV0OFfCDi3I#z}+i86z!*FhOW z9F-yUm1-5QVk)OC5$T;n2UmDp=AOX|ephO?y1yhJ$k3~^?0=BLZ<5fZ5Yw05`M{D8 zljV*-up%HLcH8qqfqp*J`C#*>PnXl63*gCm8?$uO^0v#`WUvWitNU6a0RvTdE+5r5 zV)Eu-rya9xLl!@6G{e~}Rw3ZFzrV)hcCdoLtH!e&p1?YLr4z=cifx9{E!GfzF;UV1 zFRVw-bw{$KY&s>0c>ih#LF&0=Y4+a~B^n)~rpme{@2LOf@`3xduvQC3Tl?W^vyaT| z6t0Zl{Az^azg=rx=tu(R2Y~E8((>x6&fz=7t#Fa^R@2Fp)+b?~5kek4dhnLtl}Gw> zh)OLZ&Mzc=WR;Hk^iD0)VF#{tm=QU!V3S=J zF1ax;X`I7~%ZWFgS0KnRAIED~=znJ!luNPM%}ld44xA;B7@cGw<1Mkh>FYSJ`JwDv zulIgQVA_m_T^u;OOi!E7+77w!;4w+zfWe;Y22WgKW>Cv4;4dpPs9_T)!wf5f;}i?% zMoYHm`8n?Ft-73?6);lSU*{HI)wv->F2KzCPp8^_dU}` zHakuSo(Rvherb!DJHeo>Q^kdg0_{wTv4`-^@Co_qoO+wl{xo45$g`0g8JCN>r@w+m z*S(m~1`=TYP1iu<7T52p$MDs`{_L^vFfr-Pr`gqGZ#VdwS5i2mU4ZV9ZKpEtt6%Mt z0PZb5ydbDU@-`E#<(ytIuR)z+?bnxuTH)UAKFuRVOZfr}y0}b%(cZ$Slp%+)HkRtf z8%Y1B{%0))oeHrm_2Cz(YHP!XgMv>zGaE-GV^$e;(liST-hRL6{)DsV6T*d)K5){= zbLZvBKYWAh7~H;u87yN@@^X4}0TEtqa6#u%3A<@v_hklD<^26C6f+O31`}&@)Oa{K zUzz%O6`VC~`+ya{vK-Ix2|OcZ((=&0qgLAb_929m_Rbw$O)6%|hom68md9qb@F3(Z zS4U(+1UWoV(){ZedO|$$3;X-ipUXrJAbmd=tnO5*OcxD=jUt_7awp^fz?biyqnl8H>)2FyOS+0?=uU#&Md2+#gR;-OlfD+t|hTZ`@@|!&# zYYl|`+zV5D7*l0W{r1|xQ8^M5#Ud|kS#;jXcz$D>6ZY<->nPxs2 zmBjrY!i=sSJV5N6^>MNqgm69evr|-=%e_C=;kwwqS=9Wo`RQ{HF7=|haR*oc-gwyc z8c*f&9MKlexhWkewP^traMdZ-j+b(F;g;}NdlF1)4G1lb#1B>vS`N+|solq(wPM}T zm6WRQHCY`{Rgj5^pO*WOOF2)}wjAzjmV4P>fzz9fCOAzuWo!=P*NjSa%8L>yZU|RL z#KxxN+!09H*dQL!zG(A7^AswFrjgB>Ij~!SRWFVxurl6v zI5*_Y5OYe#1Yb}2c!ff7I9>E16qoL3P(Sb`t$w?fS;TX)-A|bNZAaDH?;owx4g;?m zV5`iPvyMhgpew`83WI=N{7&uJa;8t=gj&slUe`fBz^*ZBd%sFG zFs8R}-+qUT)%_gkcS3^1ll;0a`vqS&v+Yz~>CTg1X|h%uLW^WdZlry;4%}!%;_`?i z#{(JSv9#RA`akaSxp$=S8yz`L4j+x%7oDD+QZhd5@gFr8=(PP<*%lLQ*#2UU6`Mz| zu!)Ukoab2`OcEY+Jy_wUIrAzee9#?LYw>;a<1W9@U{GPh0~Z8O(ki@gu+9#9N5W_B zSR&WfwnV$+^~hrf=6Ti0&ae`7aZ1DibWJUfE^{K-_8qqOxi0#fvGfe&A~nJvjj zn28Zx7qShV;0t!C55KyrjLe5G=gxOg4^$#+JA5#pQnSt~&)r|@&Mtl#ULd=NNxTv~ z7acq{Pp7DMFbPyUQ;HrAB$t_zJcGNn;nZ9XTV}kY-j4IS?yDn7j)C?qZO&PS@P2<7 zf|+l%sVKS-h)sCCWG%}C23TRnp! zPMv|tWxgr8!O5ezp=Lzbze2lGQ)whqg10vYER(Y#p~uVRv-L~Y*~QH$68p8`U`0OA zKTXzcC{G_7G=lq`8zjwbIUM3_LkWkDMK(+C?ph-ieuQ4ul5SQ*OAYz@W8YJujy`BS~p#uGzV-t&M@Z3CT#I;)d+Z!SX!t ztRB>7=b@9~EL##!qBtR=N_>`up=ln*4rk$gbIBoiD=?TEovHg>Qa~Zy0uh)#V!o?v zh;EXHLMwJA1{!lV-3r##W~n=V2Ws(tY=V|IT1*oJ)$O-XJa^;%s@gLd%Z-^b)bh@rPOwJw$ zSI$*n7BO{Fv7+nv?$()bYSyG9q+r2%R7;DmaPa2hTyJ*mpQ#T2S}hV*!|6MbLeV@n zBgRGGBh~iJ)8(-0_x_`^vnweaQL1qwuQ^nbpDb^QIBOd^IgV$za5)$Tjx^5?d=C*U zk|FWo)#{hj4doilyG}VLyw1=3Xx@((oy~3@!ZIcK7Ty+%Gm1NjscnGa_8Gl9WRS4$ z3}TLN0iS+P%4^G0iyIKe$dd9&oK6=_ayEgc$`(?QPSKM}>ATd4S6S~0m~MID8+zD7%kOSMgx3Lc6y|V+v>>?{nQapp(f7?E- z0Ha3WC&;S_d|)xu=`Ytq=~-wxS;kd4(I-Xb%~+)5*f-zMgVhxnxJ?C6xgJ7m#Zxy z%NLhoOUK|vKSdMEx@I>$sAVRmAJ=Ecio7WAO?EcQx=Z=RK5mq;GPxYHZp_-oBxxpE zrUxN_XLdZ=BUcAi06~WMcQ55vKQ_jQmXuXHz2nOmDPDh8^l(TrTzVXuVsNyL6dSXG zz0D#y*H%$8_#$xIPHA2+QL>74<564zo3TlAw#bXX=EmTS^S9Z}EK`WR27dYdcipP@ zkbomcaqnz-4d+-ddBOY*(bb-%PlQdfWOnTJjl$8`>_cgmEsxI9_R2GQF3~objV6Sh z1n+Aw#Xtti(P38ary<8~?+erjbNlWkJquIm&4yFZ$@??`>8e9%Pty3nMCGod9rLKk z5NJ0_W{^d*CKr%dH1Q@9cAZUzYKw@HGHvsAZ*ed%G-H|kU-k|Bw4@RbAj1JUmgx=ljxNv}@qG z{qOhNN6b>H!E^0?CQ0nlc7+<1rklf+&0->phJ^@=y8)z-&EtX#6F5e(^z&za2fl&T zqn#)4PuikGQ$@He&QE2FtTe`%*h&;};aKL}Q)gzJ$G38~rR%VqQ;i`_`IB-AWbK#; z5w;njy=0J`X|7TU@|}}3)%w~Sp&N6^72qRncTdovsp0@v;bOV1uxz#6n=_Cy21{;f zc}i0;K9I|xoFy4pX>~Yj=jTiAP`K}UdyQ*0^Q(`{qvc~^p?9}(nMrg5qbhvim zriTBGcUx`^=F6OEhuzx3F}e%d4A+rwv%+jib8RLd2J!FDNO__=tar{I-sOL&ILv@h zv(n-laut;t5k=$oIw@Vz`;1aW07A_iyPnX*eQnay7;&Tw(2 zebohxTOI~S<6Se)oU^J04A#{sF?dGVaXjjEO&H#LH&VH7NQMtT`H5jLMId9PJ%9a9 zC9({=(3+jOJYHsC5_wm^IyPQ0mb#Manag)->r9FHAz?zu9Ie~dxE;+W6gFOp@*cYF zmsee&!j?E)BDcwaq08`)s6UW_uXJf_;JUnWl?_6+^4q~+sT>s9P#tV&|P`|j$@xmG@{h$;@D|B3)hIn zT7AD(#pq*&p?zRl*T0ugI3S;JdaUbL<04b4TUj>GrX3g!)9wB3=EaZ}5k@8YqF6oq z88_f_g^1#10!6B#Y|4~xbgH!bFF(P#Fz?#!32XGPQ94)=<{2T<$;3MSbTK=}PPh!= zXh+ywk8*~NpUD>?S~;|Slh?Wak}GU`u47u;5|OJ>s#&<57a>w`x?`*mr*izp=C9*w zpdxYhDdMO+0Uqhe@OBJkH__KI;E1zFsP?JO3qJsKTSbVr3tP1cgn_vAoPGSSqC#N? z%2#wvF>I9D-AspbnJ{r6F-e$D`t>BW8CMefU4uGN$SMINt``zU9ei$;W(S(%7CWl3 z`)Fj>_yZ7+)S_aJ6b&x#AbjN*sERA0lh(@r-o}%}n-+LHO2=!m%tP73hhG(^NkG}r zQF>k8nzhR%6mxW@@{Ej>#gv(58FFU&|B?(pYp^UO&*TZr;X}3tb(bO5Fp`Z9=@zem zc}#YRx^4+kr-EKb*^<>hHc-2kU7 z`r(&+ZEZgi5|cmNk8Z8hjb1T-Hw(hv{WKWUmt~zM8c?}xrxz007Q>^f$RPRnO?%5q z?TA9J22)B`xR$f7Ns38xY*-eK>9{wC*F@adR*!`AD*j;PG%{cM28hID9Ukla21kU0 zhs%%6T9w~b9wTZB*4qnTtiMDh!Pj=YBme;7^_}_#go&n&s*$HooqasNY#ouRr=i26 zC-QwB!lltq9Tg-rJ**V#G<)os1LVlwdNolvCe90EZGDYk0DlgBe z^64bZiIGMT6matSg~9Z;A$*~@8MhH&+~(UKw2CNXYw=iz=-GL(2pG1$M#UCm?=q?3 z)`uYq?vrf3W(|06%D;NLyEDqNvKzK)#5SwG>$-ezW)F|$WUN|js!8A&-iyv?@|B)@ z;Io?`j10;UcsfDXHnz+a@cW&?9`QNNQ(OVI#FO=RU>8IecIbWPAPbC9^gCD)8%_i( z*Yx~$+Erf_u-=GeIxR{cF-osv@h)YR|-BBL+sjkSsGs_Leo`G414{=DifnG9 z_tDkj*7YRH3f!`R`Qc>oRmBWlpH#1)!wo?^f52}#@uYd6pxZyEz&bSp6=%4PZDPR* zn#1oFC9L8+@i~M2Kio|Xr2La&f2>>R@4-8d)*I)Y8Rv3kWlY zL&V#{Y~cn9>kmfG@mx6@IhL&O@Ler(u~5$b9s*c+A?xE zL$Rc9?1(EUHJ0fJ1)g}4K3uA@|7tk7{R-8pb!`*gnolmtz2j{=ufA(PHg&ecFXUeQ z_~iUrns~5WUHDbO#su^G&*kOS?r~P~o55BnRwT+tPBrUZkfXqMt5PnezULAStX|su zI?XfgQO_m_7qk%LcTLtr9gyjE_K+pq79t7o_ZbUuS7ExwA7bv%ga-sbSipLeqet^d(|}U4e!UJ z;1xESsiAa^^6g3JsP@EoICyLc)g^=M1m3$_e)@|zsFX36BSA2tK@K}thPYb|rv6oW zRgZOhRx6T@&%RTLyB_qc2z~x*VNnJ&qBpmJ7Og2+-=|m|OgDd7iLJ=)qGFZc32)a< z#d)fHI7<+=nHm}N2O+W9%~o!p8I+N-C(D4*VD7Txbki(LdJx>h6xdx+jop<+3yl$; z&E4LQZBv6m_&QcO?|*Db+@e(pSsDE8<^;7&GI)14`5}Nh$DmLj(NU|Tfnvaq`h@B> z_!o)w2Ia$FCtQ6jYFj$|rrH3Tvbhy-j5&6V{62X2y3Ue(4DoF@p1nVVRwG)By6VCM zog!7cFoFa4TW^ zY+V^d(Mh9Oas9hh9)gbRREu8}iYH&#dPGpInLu$JoUis9Ek;Q}mC(*YKp!tgC8(P5 zX8!oDr_;lmr0(nWZU~(}LAe z#JoIR%F?S3?2lQ{?Y?r#v;xjZr*4YXVL!EUK?2PWkl&Ja+3+FZE5cZ2&f6f+jzXhxB+GaSoTk$nhwA_S>=^uMz zX;07pzN{zcFd{(82gdtp>t@c@lR*A@qgMMQCdn1sI>Qi!o#{ENQ|Z-yh(eu>1{gPb z_+%lXw@|k-y(oCP$?2dvPav%dzIb|ufHx>vl)i>#ZpwJ9ec|1s|BNU{rGBf1$LXY~ zGpltLN7C^sMl&E(NdSig=|~}8I`aE=*+n#$4(1vkAh{?k;dfB5(wA)_>Fp>0)NGs0 zvNCl;qno;-S1YaH;Zrb+@Cu{O?}y78|W3uBsfk@ zzst#S+WJb4kk)z{8LX-RKbop5-&pz^mycFLrBsQVH2saha)Og0ax?^!0=@i!qV$t$ z)VB`Z3%VT2wBoae1$o;Ry|EdQ4GjK#rWGaRKX&IjdV^jLWMYf+5bdBcU;8-ylu19x zM-L`SeE1#icVQ;vCb54on%p_Fly~|sOMfMdAMVxs@{C09@GV#wB{aM?mPO@en(45W zPuNdfOJ9z_1dBh;q%9SgY5$KsOzXy-c4BYR%jyWgp3Trb_X^YSni!VNury<=9r+aJ zzB<5R0`*L8^Rk~Fm9({8&$|XzQB;%z_ca!OP@WZI`0?8nxh*lTtg8BDb8B9*Jwp`3 zK&!@^^$LxwR3#hF;wRC>9*e8(l?VR*eK1{TRV4El!>)0weIt3r>S&G`OLNiY&i}#O zc>p!Jwr^gKilQP%5s`?13W!wc9TXI$_ZFH+2LUMo352L9D2ntJnh1oJfYJ#iDo5!Z zLJgpl2mwM%D531b+5h>z^Zm>2&hG5aX2y|mB1zu7@AE$Qb^osGu4iE4;Lg>OD`fU0 z;&f&^Q@w!p;xhX2HlhzND4>b%*n~FFmB&zd6CLGJIsKF$4YPr^<-G+AL`mZuW~QH5 z>q~YjZ;I{~9dYBeV)7u4yw6~ixC#r8;tlJ(QK@!FtYZZ>CdZIlk|nP!%nL5J46#!=7#mW>hWU>-wUfRAO30leTRj zssl5MKI{2Pk}(X9N+g4c5}(|N*_yaK-ITRJHvzLk?p?YP&&Edes8Ff`mIuyH_>=}$ z(uaEt)eaiGta&utYnb!cu8*Qino6`>P4#>)X~oW3F`9-XTMTj%!93xp;b#;5F0vN3 zC5M|e38jIZp?k#2j`Y=`Y(%czF5D^ElRnh=Zgv+o>ONzlhbvy&Vh66b$qPnTEY(_r z>WncB=jN13#(znVpPf4ql_+XScoCtYwO&Kw=@FqdA zI6*VCHxNTMgTEOrYx_G(F*#c zr6YT>?ree71Uqr$5{E0HTm$v>?%drY2@p*G)3>JQ(xrFZC9G;esVZuU$yZ!4M@lGS z3yq6;rc}1{!y1RJf{xFWH#y|5VRtnC+SooCYE?%~o}d zKKN=W4{1)`Tc496ip>)Zy;NL=+W4H>0fcAD_)sViV?lyl{# z0JRr&C?o88g=--4E@r}|@N{^B&=ssDQAEyHzEF`&H!d+XK}q5UcCa1uO~WP{6#`Q) zUmRU)=t!0Fj?6|@d5uEdMh4y>dOnX|Mlrwz7kQ|D3k zh8sb-ZNyJRYqRrpRL90lFrwsd%gk7ssgSkHhP5R-@Qg}6ftS71OJKODa*>`@z+YJI zx^Wy%jqmZo+o9m1tQVXFVqCdb;oaQ13<6S5J|s-0f$*h+53t4r>5n@cl_&h7ko7i9 zu2C~FzKJWSUugeh(jFMoZYtJCIMiJicq+CY$?azy1)mZg2G_yBFC3L-137^RTCYWy z7AX9ABHhJUdi_?Y3$>%xa(&hDZH1hytqrPj7@drHUbQ5i~Zp(`$xc~PpiBN`SUmC6NXG8+G$M+6c@X3wIiuOcKKwRB2J|2 znK$&NQO1(C3Z6x2;2RL_Tec)ML3;()O}`#JEp2XnwdiemMEyIN=6O@BVN0D8aXXTB z@tGWap_-#~99)-1))}`BHj^VNd;OAyjK^vTF#`j57;%?I&vdFulf>+|dEryna+g$a zTylec=ZPrldn9RdPw>5rZb_aJ4wA3k` z#wPlQjZ`Xz-hjK%*6>xH69{YKP2rqz@+#ZiGX(dnrKUNL;T`r;BuSbs`nQwK6BKox ziCk!%(tTW|I1pByDxb7;tuFYAHkaUq<3O8%e_Um!eji1v5-ZTGDwLYq zT1I2H$K<@s#N_21g+EWZk+hxqjq!AhYY_6+Y9~tSUPH3@z)@)WZE2?JN23kaHv5!I zv);Mo?0XsY+sPX}4`L*4Wm5vCn+-rE@Jw;NIUC(uSeus#?>+iR>V2Wzq(vEtr|1v) zy*@@Kn}o2~^1?z*TP{#^>=vgO8VAkG~f`2J*Z6(>ZB!Wc@A*q+4NVrxdhqP+hHj`(D$Pf4~ z@9iFsHFl;Yh1oho$$EoDYeU_|BH1EERZl%*sSnamrIT-Oh%)hYp(F-Lw8y=vCr+{n zI22MiKW&5;T~V5qlEN*a%}Kn(?~H6B$zXwM9}Kd3<2ZzcOmFaefQJ6{m~{HEZ?^ZNNOTBk9b|Db>^v;~+p2#4{rtJ_-_pg2>!!ti zjD3+KL7)A+B#lD!@$aRB-4=s-xzg1ksifnvS221&z+3E~iJCdZ-7e zp}~2dOxqt97vNy^IN z=Qx!(+;Mx{Pv_Ot0gOk$6u8Qdm`N-g$$X-n0g>!BCil6e)Whk;n3SHew}<;h(&by- zOU@+iY^}A$=Bl*C=_$FZ9GP?jIPX#2qM<|)Rwo+Lxo=h8~eif0R4V*SSfENVjbv&=7s{Z>r)NP7LD28Ve0>R+AEVVZ(YEQ{TrDtG`=1Z) z?5j^vw-M_rvMExeOMN`$rcI9qX(EAB_>#6?RTI%6QR@k+FIBbsstgQjXNddtqO}2( zPfd5!4eHFrYHBUnYVah4VXluOi*n@a*D+B|2!WLq=LIw1?VpkbyVYPZ7z$%v1MM^) zEL05i(OMd-nQ0#`E0um&A1q~$4*YA7`@uVE-uz$3Bpb*@-r1HjUzC}Xi>13Vge|3O zo~(TM<2z>}ugbmUU(0 zv3YXA`6}3`G=OWkx_7`7anG+2Y+}S;p^{|gL$}ob`1j!P?;L3peo>t7q^yy@-=bd0 z{*#gRblTx&0GRUkfB)?0#6to)%K#hy`{REftme`B68&L+XjkLBz&SUZw|AblOnri& z^;f@a8s|-G@EY9u|6dcg2h)uI_Bc2YM~uPxw)VGwJovHN;_QC~+A`VIJ*1#jQOXcvoLX!DiU<~z=#`hOq7QLB$C*>X2;pY)>O`>C z$UW9Meu#T&3V!C$p?|YweL|C&1^%=b{6G9OSDr>((j6{!bO79EDQpeC74oIZ5G;Lk z_Q~xBnSXDf9eSE`;{DGsqdb3)8%F524jm{H&6h7V>fx|O=cnXQ#JRt{YY>Ke75w5( zK=?Rx0TvLDx5I3gh0mTPFZ^fEZT*kT|NroievT|UV7Eb>_ZQh ziHG0IW@~Xn1%N?XwC=Z}m?vlZB9)&E`5kt!xeO;>iCn@6<_erodNf=%to9d$`&325 zx{inL&lzu`QWCe!jvrDx%x&x7S&WuOd^Hw&@Co ztO_0lt{#p0NRMm2blw5SCXxoE8q?*(V06&WY1h6Ee$Vx-rM>%>wOzG=nfopqhi`rF zud`rr9sVhO!?N=2!mF_xq%PZZaz7P)Tc2sfP5&{OcG(92%?0<1Bf`QoL3zfr*Umm% z=U8M__oU~vD5&HMpt+@1I6n&jXkH~1f5C|WY0htP%m!%4JQMA^x(9s?m20uQS{Dke z3O@LK%D}I^OLVez8QU~<=M?-C)~%D)$7Q$=iWb;*~pF z9GMn+-_pgb52bWP2QVaa{qff+cx#(qUlwm%XrUXj>-kdY=%G74v+a&J=dM3ei&b2n ztK5?DW!WL({A13RG+e!XJ8CT3D}7T zVay@3u5&}5>d&8K6g$ktBz<>rT-diEMKF#JX{V=T05I#B{c#8{7$csb7JjA$ZwnD= zGsBc;>P)BkkJgUd2RKYihElDo;pXNF%fVKmd4HTsP)tmWR>X2ZYabxk+H~rE!;KAU z^*so2M1OU*LvXaxD@la7RAD>!o+5FeQu;QXF~pen@K6rq-jvlD<1)+**APpIx&2?) z3~T*`8PA*)CuJzB8aTFLt+?z9kojw@49c5N$%u@~dYB2gmBj5L8(x`-@}j5{U{ z)`$cwjW~8Rnu)v9WN79Za!E3vX`r~hd24IXx9k3!*$$m2nk2QxAfy+Oj|PiE*(cv4yZAgg&;HTVcP#tVv zW8@|}Wyt&zy%E{WV-t>iNcw7P;Qm7P5`4xMAiQm($xWZ9_>Db?!1EzT^_ zsJT8rf`1CN2Cn#F9@*|;gU@o_aK0S+TWsFLpup;T*Q#7?;>*IXI&N)Dw2nnKwY$f* za0=*97H@cv6Jk`~QC|3njiaKZPB{|BB7OSB_|fg-R$P!>YQB0 z5P|m$znqGnLMt>`Yo=(4e5Z3wRu719;{wCsqe#iqIg&@sK_|ZkYa#JkDcF3RgUSUW z_H2J-?$89$BhkJYR>an2L4_Oq7hvLULV z3E8+VNTQcl%-&N|$e(`SXHoBj#q0^H0uq(?8+PhWQ4ptc@E>E`lO?5&npzvh>FwS{Q^MP> zpI(SUg^En~9cfZ}@V$lZB@q@=VvS%c&Z#|~wTO@$DChk%Ctk!vGvd6617YAxXp7hL z>hX2-5n^7eUUrZqQ+PkZa@U~=Z$qDj*?0gF4OP>H)mIfx zB?5?W72!pJ3(<9idmrDBx>~oiEO^W^f(>&XU3Sd~+p3OP4@B42oVxVaX`h3C9~@Zl z{N!g|VOD*{_YAKN6<&J^1;{PSgC4g$BXkJwnO5D zHYe7ybe%w_Qslg?Y{u-cR7`5!ztrPJkK%Jm@a;~R(EvQ%FJS(=5gZGP1@SkA;Bz^qd< zRf$GbcL8(RA-(DD@j|IG)HiT#y2YNLq1}FEYl+U)PLqYN=g0Hgj2$iXt99EXPlE3^ z@tPDQqyJy2At^R)H`)^10-6P>=Dg0q&$Q%RKEAfr<8X zugWrpDZd&RvcRh5gT?;Rl`%n!5C%R?qzx3QEu>(yh&TUJ?%X7nHZBue5$$}NKH zQ|uyP!8?wZ`*h*$iz<&lAJw2<>@CcOKI`Y&&R86&jCoF|c(9RCFAk^@zRxH_Zh)fz z1wX!w)Y%fCA|y^al?R+>_wRpsPS_TDSbWKHPZu)@zt*#sZ0bGmaZj1d0o(TbzAZHS z`j9|z_yUzH9tjf?l$-u=XJ7udI^w3**Q6bxH*EVt?s^vza8hqHGbRlU<#;p`w+o^3 zSArtPSA9wfW1CR3S*%7gDij@wKC5!S`ZRtUOE=bzYsUnWk{$_~HTzfnoPcq{P34n1 zuK0xDg)Z;Edz-QqC&i^Topj__jz2Xvc0bY3P^9a^7M1cg5Tmj_Ml8M*^w*VfYrEBq z`~Iw+#iRXWlTP;zQ6VQB8l)bhb&lrUg*Jgcp)nJ?ZraYvy3O9leLFj7ozxjR*VmcM zwj@BU^pUg>vQX7Set7To$1bnFX#QrRnr;rB%4XoHfQ^L%6I?t9;l(a zlIKol7P5t(5xW9Kq)R_jJ}@4PQxSxn3c|X=#JwYFcTch#)8g2}p&8y-QEO4iAN^n~ZUju(uU2?->3Gni zeZ`Fh3B!h9ISt@jXh2CfLi0*cf&JmdMof4&su5H8d;_+vIN>)FeSMoi$4xCKc1cScP%jYR%g!9O>uFg(8bs1Z+tLZ!D*>E}HOKXU%h7w1lI=pvxzjE!4NZavhCGW1hkYWZ< zgl6SF>&YAZ0Cx~SY*Mc-m-++LJr{bXmORl=_pisWgfWAW@`lC*F3|6g7`V^Oq3Dv{ zv=;-1xogQ(d0^=~Dul;gWaEu0$Uu=M>CB?`Q?n>3?1dtePZj63hRZx}NTp_kuA_3v zS}N`fXUn%C;ZoiqR8;Bh*o{O?>Dr($d+Ck6S}u=&+NgkByuXj+wYYjH zMGN{{etc|==2A^<>Q1Rc4CCmrLWh=fPFCsPBQ;Zh-}n3KOtXDmKKIahK%Qx4=l6#D zA(ph-tx=7lZ?3*;kPH3X?@b@9nGKhY)FF*nn&km+5v=5!ct?GyJQLPEhg|Eh>WT1# zXZ25J%aA(LC9aGBgI;AgPoZUArE7?7lL~A;UOV|_51IaUYf{b3cYb66&!C>}XCt*- zFktK4nQ;xjo8hOFe{5o(8@M)g@TT?yzXNjm4`|(!0!BKnFEDv$>pZZF8CYm-q$dhP zlSA}C^CH2kA>H}6=SzMyeoFJ(#-QAZhf2AlLXfP&5H}oKr|r!wBRw3m%Y#0P8y_G4 z_=+xqt8{A#nC3s&-dG}D=Zd2Duh-Jo%QVnmvji+FF%@q+bnw@iQXAxd!UpNpmfLNj z#ohT~&!ryE7Xtxf=AZ+=>(ha%u*v%o*{QV%tH=5q zPg!2N-^Ce_s{i4-QsPKujZvX#fde}0w(2KN$oc-K8K!!Kn-~S_Jm`R7E&W4w2R%nU z^rJj8pdfy$$7zoYyiY$fNK%>$QtT&%us}@q-cG#{No6=*>*wYrFm6*$$kWxETVI+R zH)*vXh28pv>*N05$zomANqzsU?TiOyRla`RiqF;$dO$oBniUBE|Aya!3h0ms3?6tC zgx%T7@bsd$6&--^a8-?iynqF?%4h1);fcX}AUs)?#yQm+T__K4$7_Zb2G@u??W!-1 zPsvB2)sNKS(jW|j9+SEoCZsL>lFQ?sJOvNZNw7;U-)7fHovDi-+OT%y&dZ~<&xts! zlp=g96WRVLYt&Zl=aL_i++7@5?lr2es(KQ&(YF}gfvcRSug}3UhuP}DEu%zk!gbTS zvGdSx1_lwtSZ+4a*9)VxJf6rb1rB0^t+uhUUWf)9y`1%V(J(KE_DAcg*VQ_0U%d8y zmwq5^D`}>Y=kAyq558t0Bf;oXOOrf&IoTe%rJ9q^{|D0^m0njmEQNK|hh zFViuxy*Yu*jBC(Q<*jYF8N}{N|3g18sC=r1SsgFZ$kkvSfw~^oYJ-VUTpnv%RUx^< zpe4)+&xr1U2&KPn-v<#9hvrQlqLw;i@1jG*ZoL1!uz@!9$-ce1a~AJ)2LfHW0GQIC zsDcG_XC{8qmmL7`uBtMv?1YtjScp{4qU0`g*Ff-?{2cBgXkd!3f3rguA#Ir;OZ|Kk3DP8r zGV@+9^_P|2u~QeK1xy4|LXfTxv;l@?S$^_Eo|OAutpDZO`}JXwI%fO+gD}}j+{H9R>HdYYAZdw*Z;E;jW$GcDj1c_g~GMYkc?p@N5Jcuk-A_fDA>Wz07QEL8wNca);)GP{<)#pzWht=XXOrke5%6XC#qDGcT^ zj}mYfI^8!6bXOM6&Ttb>z#52VD7mXv42NoJHqtYbo(a2YO#IN(BDrP7PW4*I72W+< zMvD0WQ)qjmH!iYd7PBA)Z+pc?i9s0iZ-vmSd$G zDK^&qwm43EW;xXy`N&va&E&nV>pJ(vOO}`sovuAmDm4O~{!9G^iTis+b^G`ppMVX3 zA0?l2rmADlKpe4Jw&kvFxmOIZLMa!3^65BhlxI-oc{wQmKF~I?9;8=yT_(+oa<_|s zl3CW--+*Wc^}_FLr>-vyG%dvKQz`}*vj+XQh_2BljRBA$%c_uU#*a6MQPPjbgnH=A z$&2g|RJDrhW1}MLd3UzG@;hg0kGWRZ9tn_dVECz6^xp01@`j43d5MLi>I+DB|750r z_69}fN?QbL>u8C8_bs~&&?DS@J>@fWMvnfW$u@mNN{8D>tq!;md+YLgi}w(dpKnXp zjs)Y3vcsr4FhG7td1UVx-&@v^R>RN1V3_0?;W2+fGzCIrsJSLn`m?%#gL zK^^a|SPI95q&1~^CM5_CR(rncCL#BIUkbVumGmvwnKpE!DHB&$yZ8tp0Ml#~lhVc)vs1n-Y>8qJjdTGZ3pA8oxKg0P?k z8`g)yJl#I@)$<$RMK5?|8b&03QVw6(H&N!GmF~C?6|I&eska##38~Z?H{_K_w%a2_ zw(p1I1wr0@6#DxOYUSx^`j|K*Y3TuS@BCd+*F>dY>y7! zT#@a2QBf?zB<;V@Z8IL?8;^nR)wa|9D-}m5cJu*_nerpwpplP%o$3l=s-2%|;M_`37%+{@t(O;g zGL6f*e)govtWBqHd~fZ-^Hi=`V$8*iW@tm+OfUFAigo!pG{cDG{a@@K`)?9s?8lD; z#wcXB?-dR3g|6~3%%pW>Q^w1>NMf_`GJ2dh468p5hgnv62E5!zTc>nb?p2PvC&6}H z8D*N}MWN;S?9NT^(w%CEb3scgkGmh)dU%2!glVyK0)NGCW!J4IfN@xy^i+}aFfslY z&fApTKVW|S##&k!zm#@C@ptjS-mSskOa8lQMHSdu`|X?blD8O7NqA`HHM27eZ0S}f zuU67>Oq>Nx3Lg}{bDJdij?zC|v0}2FS4Ov$KA96OcKZZ{8F#V5J6wa^LmhM$NvF<8 zC+NYff6?bEmAquCxXzzg!z9p@F!m$%CeEe2q1L@=wa(>F0 z{c|hjJ7%e$xpoUrKeAL`O^ZyBl2C68!lT3sTCCs3drj=?Rw|Tk5GFo}2fQqU(C-fK z?S_lX^ip#;PTKO;w%_agow3M{0UDwCs^wE=;-b3@)HnUt!gp8kfNZJh;OFNBEP6Ok z{_`GE#trTvh_%H!o-4+-Xx)?rFg8`TS=MK|S)?;9Cg_zO6LO2!HOTA|3#9k)>`;_) zOk%(|Zv~m?hRPmn8gN6YD81cZmtf!id9wtp{lw|6yk?@(Qj#~}v4@+DTBYU@8vrJP zi>!fL!Z|oWgw?j>4;%~-n3}1dik;1FV}VRw@Hv0Lzzk#M80P4YLx45h;khSdGRSRm z%7;R<&h_trv=k=E1J~n2RTz|g75IOW(XB+TD5a6X7sXWB=Cik0)*!F?xzibbdo!AK zAM0cRzz`!bzog3$-PcRbkXb3a&%R4NNq0ux)`Y25)cEECdq~~<4zSLM46pvmzFm)- zt>`?Nt+X_kxFDsc+@qo~X_}X3B0;AvUh7g(Xr{`OwrfzmrP|MWVb}!Ofu3tk+JkXR zws6H8*mEd|$5mxeZ^cGGHqcF9JsZ2KI=FVZsw(;o;mMm2=zQ6HzKlhwlNia9soo7{ zvvINvvbp2hB8rB%1J|i5WI`h<3djlfW3Ik*Y(#gg_Q>9IfgPBEJFC_@wsIZYM%%q- zM7!R96ov0N0;_rYaE*HsM?_@8-7jW0_jXf(C;BH(qiF|8Zx zNlTpHmde;_b(TEMv?4}8QmCeFDqd#wg=VC}h?bGRr4Z{?iAoi^HN4tn2P zZ}`qPi^y4Vu`SGQ@n-ff_L@NlPI?<7E3hf+g^KRNZO!as5B?b&<{*7kzvS>gTt@ec z?zr8GT6Ucmv2Iuh&?jkHH3YX%l_8uuucggOo(avI7A*k$y%wNov|(~gC+as>AG6bc zG@WCy2e)OjtgNi!!23n9yq7zcYAqWc=C-HeKaJ%Pt7?OiqZjS<6kSoI z!H5r#v|i2ZMq7AK2+R;v-7(C-R3^MIzm*IG^B~M;EVTZBi>HDHhBauyqd}_0H^n?w z#R^R~?y-#oL2qp0L^{LLLGad@?;NoUa-~`|rH(m^)>!TLt6#>Ia?N`_&;;XrOoO%O zyyre3P52YSSSz+3E13$!2OQmvfYQsuq?ozn+%Bu!kinOD-iV%faj{ReDwDywUO0R$ zE5SO!KTauN3A1CrYXs3~;h8Eq{z8v-7)Ihl9i4lp?+ai96nX^t0Oen&Z+w zx)~DJ#hf6IB?@S9US3tClYr(w@VnDpBSeaDf{pQ_Wc6(mfU9o zxqU;($)|I8LtJ~;>Aj>KdahmZ?3OzLBXW79s?7EZ-}}6BXlAjmmz`Nx(|4WJc3Ia? z>m*yu;*S%lu6=6&89T^U;!~`XewfbAd4lQQyu8st3Qw`jNHBt=d%0bC7}$b>epT3p z=s`Zx-L|#2CL6uQ7sss}sU)X6l4BTA{)HfE<^8)-a$`m9_3*AAtzUgXW%3ZnX2GRC@#q?{?< zF>o63W)y{j1#B*#O}V*ps!X>6oOc&Qx4sEYRs7y8er!IiBGc`cwA4#g4il-VpFeeE zc%88b-KsLv+tlm#F+ci%_K`Zd4pRH=zV<)s)hvQ+_O4Z#PEcoejy1tP*Fztd zhrfh|*Dd*iE>@f`sZ$G(jX96ARB7Es_egfb6eP++-t(&i01I+wFAhX})`3XHixA*f zU!1h^xYE1+BWpFdD3&i6?$>diUCK3K(>88+Tk-LTatWAvVY>4}xDs;1-CtJV4x50@ zfS-wZt&^dyo!BJtZR3*lQms`Z@zR{#aV>XwWZbg7LsEOz1xT2+!-jazh_pV<>3P# zt-Oq$;L=l}<~)M#Cmm$@X>SF807V?gb^@H2dFF7L0!lMrWM|{TL3hB1)G1sw48GzX zx7<0qMI3Ba>C}0C?tpRcT9C=sB(y<6?zrN=A};~ot`xfsh|F*u{!lZw(GLPI#OGD6 zbtrHBVZRHiFXycU&m$hvHmPibH`BxR&v3}{YlZBY@P#OUJ9^*Og6;$~`~|Udp)abY zySz|=dU}u{MW@AUkfZ(GMbc{}w}*%!rWO6aFTXs+rrj-45;dQOdk0HN{{kb)LT;TF zHvHps?YSBZtT4fHU^_CEM?{%A=?K@NIIgNss2xdcHS1dh_MZ`YbC3Oa>RdqHl~%1J zk<`V!0ezznB!YiHh4}4(SFfmql{#e|lUJf?_y?*JKwev`Q6aU?oyd^)y071PlQe@o zCumdKcd}Ssg<$81+QLKEs|TjcHe5+^CPkH=L**6?8PrI|i|)VI7#GA6LQ;ZlyLY8Z zU`s~#qH-D{4{b)*7mjW8>Ic3r&S37+G~RS!rw*taF-iU|_RfEidgiywcyh=r0-Sv4j*kjz`JKxJXF`#ZZ)r`LZ93+1qjqJx6+BFn8$-5?FU}RGp(ho-W@p8tH3Q>7z zh-GE_dQfj6&=6qWFDYq$C}!YH1nhKof92xnkwOrn`x#?Uk5cR|$~*X;hC!T@4qmz{ zWV?Kd>bCMT*N1;Ldd>^vnx01d2<)S1gzKe?Ybev#S&VenH8Ic%b&&SsS_mOv42Y*k z%K}OY-a+`Wt2nzU^|GattS4gt9;{RO4i++6k)KJ&E%yO&@F3vhd4715 z3qSS6ZbW>#To9qoMzF=SG*PE9aA}=V>9G{w#JMQQgr#DBcBRGqX-F$FEBaYcGX<>8dgvRe8yM?aw4nKXPMb;T9dC)83CitoiS>#*v2jO@gObH%zE<=xMFx2W^WiPC@&xBJPn zHgaq3$!NeGR0xUga-w^bo~9URh}KON0Z?~4*<|zU-O@%*+ti=P#epBIU+9$9&(}F6 zh$U$4#4x5y)z5uKT4EaS{rvpXof9SH@eu7TFQN+qE2LW#tNR9jxjSpqd)q^G)do{_ zjqxcZ3`nXOIpE(U}!da)Sm5?`!M6b7D36-XoWISWL_;jRq=ix$l`HQ~IBW6EyZ#}b| zt{g@2Fh+*GI3Hh{tChN!toDw(u-E&8KShd+vFQ75SPwNB+$(CFClok_Ln$keU~L`X zgX8;X4sr<(;J<~45f7Rm@>fGeNFyIhbrH}^B|*2dJr1Z>*v1OOl?hLi=lc=nUIYYy z^KzJkqK?;5XJ8`I(VZiw&{Hl~>QhPj-!;BMUj_4^sx6Bk{GMlvAau(sw!e2k^SlLC?S`V2|zPZw1c_#m{;#F8fe zZeqs-qM_!MbkV&|e&#aiS2q1}rdFTzw_3-|OJ1!2yyO;+?P$C!S1xE;hm@yw6=n_& z|HJFYUB9BB_*5`KSTAGpEErT182Vg$moSgfNzF2bXKZF0A9w<8FFO@SGENWBQ zuh?t3ac^VW< zhb<32zuc^9Vi2tvd9R-LEaw+h8?)5@>fH!?73-!w{9 zAh>1gq)LlfGqJcmHc7%qOCc%_vTHv1B+QwCbw9x{_pA0T!_@18+zG`pU4h*<`(-9N zWL*+dv^IZ~$E;XjaSv ztfsEx*)~LZCri|FK}E4`pvMb~swGpbjr~_QDfj-5-@6=9VuLfjB6$q;lKQaa2XA+r z`!4}s34YifT_>8GqdnK_H14OEp4nonEoP!$ui=r|zw!>+mv3E!9wr=IeH5!Ew<&ao z_`-fYU%29Lfo7#UuDMwXOdnl+H^63D;#tc!VcW&e9Z@p?&4k*?9%LKEs$9A9sTXDX zRtPwGEA&|7H3=b@FEUvEksNO|u(vg`YVfI8n4nZ^X>No=rHWFibujuF_e>D!^D+CR z6NqK$<@;9gVXjmqG4)pAb!!z?fp`g4AsMe>w|C6BeT19VH6Z(RNS~w=WszP5@UCWF zG7JKJ8=?7#un!!(Wg>n`zr4*SAWb!#fY<$Od}|yz`F^M7p<^s{^34(#t6;p0od#3- zyrd+i$RwJ2vEN>&%5l1r-&Z@2rvjGu!w!3=NN3P%r0yF=B_YvqwL%wBA71QCjA}~| zbVqFmG=vwsE1g*nuIiFk4}q?hS$HCU`49TO%IHe_fec8OuZ+8?;9${>5+zbRJzN$` zY&hZRy&HpDzX-Y6@fDRwJ92gZa=!0yJOd53=Z6G58!p684h0?69!zIIvF%mMYP>QX zEO}?7-gF~F_8q;ni9?=8MQBH?rIf6k-!#HVuEWnzJU}E3o_$-~m zSt(%2y;sOX#_+fEE9NQ#r2#sVQ;lx^C+T z>{2Wy=`9~pxyhMeiRPfJ5& z?ey}ornuoXlZ0Zu4ez%B%7zX5)6T>0QD#{hmIYRyA;FWP7Py{kFKnt4%iYYad|EVy z8(b1(J?TCtW8?#*b(McO&#fysCc7JBTbsV>u6qT zzrcfz#u#DofML^>U5(GR%{sNYo_+I%?;k@U%m3IJf+VmD!kP6mO7tU>v+)vn*}2nY z&K$>vc4EvcPc`2v58MGBO%R=eZUtbw^%r(*V!nwYe#Z^9j+hoRnp@S(Syu+>%?W{P zY|Uy>if#f?@NCNd7(Oi7Eg$q9#jj{1TypWYNK3vb=8HV!K?Ri8Ai7DadM;8~#ht(* z!G#O%ER2>{8FAPn?;{!&4L@`g?o)Qf{!AR+EbKFe(0T>ZLNkMI^93hXx_yHDgg=}# zTAh#?j}->o+Br!7dsLVd(0TdmxfTRt{HahqdzBq?hBNSy7te_#y(ELAz}W>kA0#E* zVI?-RV_7hlyubY88X5@*2(!A9U+~4P&uRy|*fOtbuWQzOV)iPr;dCnAF45Lwto&|6 z8m)q{d~U~$Rf`Gdy6HPJk9P>G=t`H1D@Ud7DYnXnDU{9=O(+6vmpHJri2wW81l zlvrDZu9P{ZX&f-Zt>x@xIztwudupL(MsSfhQQW&c?R3vX;V<%?R3%^-NSWOjvd1bg z1-reM0>+Xcm#fxZnrd~B$-#{^YIBNUULaOFv}E*7XwP-sv}H&bY{EJIT?tuxkO=Ip zn*B?Ed@hZX-dC9-56{YxK22HCfMDT@4#*`BaxFDwH&k_ocD^YVw9ZH=YY zI*lDjtv^RyW>pX)3oUQd}^&=$D0PPzqs{BBOr2v+-9}Z_QgNW|F<*@Yu0)ix;mv$b7rg zyK~|n_SD|+y`^G2{>bNq1LscuAkF<0E29*#y84!T|7M=m+&T26ijAjpPUmH|gZ1`i zE(0q{NWke&^ysq(iT19&)@nw;gzBRD_Sv@G7b_!g6SWW5Z1zhSJAV5dsa_OBtIn%E zF9;C;I;}uz)sBZs=sNn!00`r>FO)}0cs*kbc6RvhhPK=H9L*;SYdxOsl-#?!LimaB z37W1Yshl^vbQE%H(fIrP%EhHv>j>!@%ca`v#CTCu(+VeBS8LYgqUqYLQ;vwY8|PhV z4=Zwf2Wh<@gY%~Y#^U+ex-t{9YfW1)qHL}HQQE9s}q z43C{4E1JePlrTq!ZDA;C6U+%47e+&c0|mxKHejB7QV}oja|Ut#feKesp1mS0zm8Lb z5G~9!P54EIOBFn||I#ZC?bZ0L#4d~mc1zZBDNnJ12@yOe&-j;XK3RX6a)RSvSjXeW1Hb2iS9rQP#z@}ZMexg)FEoj2LqG@WfSoe$XeA}O;w*VF z>u;}o$W`sYpF5@x_SP|!5OaR8(#4))>l{_{&h1Q75?-;aV)^6TZ-=5Un6!=YIY#uyTduMuU@S_9)%s>vRg$Ks=hR9`%Y4H)5_1rL@PC+< zbmCv9Lfztv0a8C$Q%jBcZFRxGn1{^uVq<~#PW@@(1kr`GXu-JgKCRac;SEU*c?!0T zC49u<0~>#pbpG|bYH#jWVuIt39GcWTN@9%hXF7hLc+w;H!QMGDF#b=TDLwH(%b@&Y zJ&b0Lfr1q^u6x|w(pd~!@h2NCCt zEy`PWkT*aGKTSeoraeXNz%{9N=9j3b;zoJkZl9jA=b~1C2FOZYFw5;^Z>ExBdUwE* zD@-(uV<}i&1bGTRg@-yn#eV@K~iQcPhw*G2uW}x}Bsu!CHr`}{&Y)gy9)J0;%$2`(1ZzzvazKHKrr#NU zsa{JmD*Dq@m%=@2V0n0ZHDOHh;X-VJzquITLB)PmNdMsh7#Ea{*GM>709ppMt-~%& zPBY9_l@#`i4(ynuLw)W8&divL1cL>PZT+1|j>z;UEm%hD9#2$E~Lo_B=}wO(wtZP++5 zxH-uT$PW1|H`sS!tE!@^zNCvf6M)`l{5E=J7~GY9c;|x{G{Z6bI_xp*l=b2Hb^5*2 zu4?-hOx<}+@?@J9Ggx5mzpC*mH| z)%tEIwLv(hu#uY%4nxb~+~CQll3q6F(6Ve) zbaabt21al$C5yfZESk~RmsGw&zb&m?H|g?LJBAnmpDAvrV~xg4x+;hNg5Xc@&lg5y z4OHkf?09OlU3XitpEW^A;U$%@x(@c?kD?h-WD*u+e)j@)%2>H$m&;x{fQQ0sN=iz_ zhAOpzm*aI7gxH^rTe!RX0la1T^=T8_h}q8Z#Wb)z9Dd*#n7j zc{sIrU^uc5&`#-Xyr-ZYiew9_Hu8!t-)f3*U?LarlqVoOMVpQAydC}-{mp6yIck+J zhHwRfWS{oe^71Pw8<%Aa_4|f_-oeBQm>cQL1||06`_#aoU~}P@k9+UXttT)fRK{T- z={rxCuAbuf3?47_)itFb4-rCYZ{xB%s`v!u)^q?uq5Zi2b>o2-*&)>x`;)&u08D>J zst5_%xwRrWJjF=!<+J;SX3;=mvaP&egoy=aPV({Q_z|6ruguiDLMvqoi_W}Way?ke zPx1hHcnw@ov_xL!$6tSrY)IMoVCDH0DdIsxLnDd$ z5eh@RpMZ-_eSu4ieW^84^(O~Uqh~&O9r7@QQSZwY2&GV~9!pXvbS(OPljD$iNJQLju|dU`|7^YA&Evfdxpl<0IKVSpK;gyL7?%Ik9T zTnpfx1mA(5qFMeR{FVu^(Ut+W4|1x8fx}D2!z?o~B55!}M|CvKOVkVGxgBWjRW)aE zlgOpoE~CXIC&#jt=-&2c@SJ|RXmHy2n=7_zP!C2+#k(mpsLI;EKG&$gGc(0rqrTl; zTgxY61T>^f`L{A4Yg=7%XC4rQh#}^b>L(+o&2l@_!=<*>y{)pIZ$FLXo$HQoY6;w~ zLffY;uYMAL8U2Oem<$1XlmuK4OD?-w*JeFai=)tq++-0fTVO4jsQcZ5;cXVdUpoWfS%*@1u3SxbK?hR0+&p!7q zC@PW#bmci>!%ww8vWo)Kdcqbr*7u_~jIDV}pA?*?b~)KCPCnKEVgfcQ%2A}e%=Yii zJJaf$K;(Hb`s_DYNm34i_RkFze!Kx_>QfH>_UrHlFX^`CI7ehhkgkyd>=C%0fcb`D z<&TVvjAEP(pKI@MW=quRD{7z=Fo9<#D{Gm>_3MZ@gcNo(=-g}?x18w7L1L5nZ%K7VK#9q>&Ez+*5q}ThMBc_|< zYBkPto;>ggVbZ4_VQ$hTiOW#^3qH={A%{8ZTY*MyC@k9QbAxH4s_Q`Vnov}V-Nl#G zs?#K-7**0+=}P?tx`d@W%_35`X1jONzWlS;?cm3sf4@@&>n|~;Qz?`1!yLPY z+Bs~e-@t24A(h<)FgSTpJf-NTd6tiM0S4RHTgU6ux__Lx@C}RABddOCEf9-dg#BE%Bj#QA%>duUX6r@VCx8yNYFw9G$|ly!cI58;b{$+xOY7vgQE8ou%BOrq z#2Tf?n|UWg9ZkZ$G~ihOTh4lu(??kr9h4G(*-Dl+exTNvT?(6Rw5T1tw-r$&8{HC2 zV(iPy_U)fS+dHOt71p1uB*e#23>{^`FsAtxrpz|~?G&=zlRc!tXEysx3=sEay%ylp z`8t?kbGDN{FS#&UjA5F4!|)^)!+3R;MZZqoAPO8{*NP0MLNj+RGOT-^Dy(?q)m?^-;3=B! za#SAatEwho#yxH_qAq-XgWGB`Rm1I=lJqv--Kp-mjXajV7$`Cs;{?q zR2lAbxm2MRdYtvm7orAx)q*R;Eo~ghMIqp-3(BIgzv>nHUMS;i0?3tVX8p>kvNPRT zs;^y|UmlaxhFIISN=?TNq||b}*~jQsM_+5J(ulF`_A=Bd)?W*?F?^xYbGbJm*X+7O z@Am3YV=RiS51!SqwUZw(Yl|y#OS#x0JHpqpdy&Q!hA*_HsYJTA*uMPeFs9^YuF8&O zjnuNLieY=>u9#ZNr$j%kSTAze69akEZ6BFLHSX->QJQZdd0S zz)?yXqfPS2WVG^yF8&-0eJH%Q={_9tbfIx7UA7nc8H%AlO;3jFw1=PCrBdq({ELsuGFa#(#a(tFG`ov#1j#g zPdO+bRhBoa6z14d~>a%n=*x)KpZx zRZRXfk?f0ujXm|KmKGzu{raMX2T@(`c)pu4N-z2wBV*ojtTj~?yk4>9h`7kaX;{IS zAE#%O6*J<-<)*r*lAyZ3JvGM8qFD&rxvG#oxq9~f^;t&KDOT&(M@j1Vk<6GFAxmB( zdZgp!n$-dNZszDWk8?ZG(U#t+-QEtG>HNJpm}w~nbdElWO}S&+ZU_hznw}PszLoef z5tq!ACR1C))_t*fo{`9;qQ1I{v$y91LcBuMpgP!0m0OguM_P@MMlxe`MBqLr&sh=w z__3APbO%8Zoo{zYIi9Phv)I7IA8aBK`qIe3Okd>(V7=8VaEI7YJ<*7&4)UkJdFnG+ zCglc~(#Wwx!?}tGem};gIwdZY=g9h`^a3X4HFnT)xSL-!#I;mxuiMbnvgKtPk*EJ9 z(Ds>#(SVoVLAx0J)SO9I3Zkuh+_FG>ho|?X z@Uf0Lh_c1FRqEwCZ!GRZpj+Je;{nSQe4?Oq4l;JlwCm6UyHp0NXZ=w(o)Nw$gZ;4u z{LAUQEHb6ZNlU)T(6De?UqS%S7FUh0r9?d=IGHY@_xB01vHGO1ajUSUi818~rQ0)W>hHmAj8rjQYss*l!{}JE8z~w8^y@c3 zX#A@&;y=$B_ah2)BY%3fx<k>}L9-FCccy z)NU8MAhsdxT>)PR7|0HTUwi^|8AkYa-=V%$%Hl2@z+jWybc)0n+axCM^0Yc45m7-^ zwBZc5ETR50I5?;a2g&D4ep-dwlty~5Z;$bRvjRm*=;Agi$;hzHB<~*+Z_d~6k;Xfr znkeZxwCtjMV{SLpG{ zS1Iw2AUPi+kpw1$tMx&9M>Df+>>mBj*ZTuuj;sei3$mcVl6i~sEIby%bSCiR`zvB} zT#D&aWjtLfH`l#9k!}?9wMbWm(Ywg|eUMhObs-upKD$Kd1QtTrpK$FDl5;@4eEhPb zB>22gyI%N|XjtSmF_Dhz2Q7dijn$N9APZEdQ93(jEsgb8l1TiM%g|l|lmu{UZrR5BjOh%kW-Mv&deF1~jxU^jOsN^%1 zTtz6qZ~x;j{4t>Ul@`o(fAEsjSv^t<^VO6mTP3gz?{%@Yp-TDvDXW_*$?D6(KJDhb zcLqO;Hf*6RcoKRnz^j6dS@BiIxG0NZbJ7qaM z_ceCeae=;AlKeEF2uJnN3#>Xgj;r&5OBai%jy_7M)d`Kbs33olH|K5o-XO zlr%#uNC38*H!LcYC07$DT@CmbFp1Oxuww6&I*g36R{Lh4CL_Go$MZ5?VQ;2aNQe^T zc6nI*tt!Cq#!lE}bWPG=bL%YigJ(=^Nj6VrYZ=65IT!wiD=*&;by^wzVU~N#AMY)= zkoVbyVgAV9^}g2o7uNNjL)uMte^Gef-Xo`5Hs@C<0E>?vEsPIOEBC&wyXIUUTFwbb7DCl1Qi`E6i{u-V}7^p{}`9=aC+L9?H9dQWC%P!APn#e1wI-w-{cRc5YzeSK~D8h_?jskq#uhSw!%yBlg_=5pY2&3Z`~<}6o{ zsZ=P@od#6Dpb|aM9=|}`W!n^_zUetsRgGAmJ$4sBmY|(Gx7CgYQ~BwGdoVG^4z69Q zAdh`0N$@LwE12mu+JAaU0;^S|in)OE*(-w(#*rFa!wEz;?OF-uB6ZF~&Dhgz_tD^C-T_hwzY`aO(sJ(n$z}!YY^ytp)Y2cqT2c}rC}Pe9U8cg*Z%I~6 zjS-ytX%TTy#fnkNtlz9#`N{<6+r$bBKZvF6D&y>6POsrP_Y^ZQQr4&xMm&d;G270Covam5(V4wP+>&e4SP{meou>?sV8^*q>j(6frfcZ! zd^oePh>GFWAo#M_-ytNoIifJXxIF#2>1-b@wf;A=Pa4a|V;l=wF-e?+;Vb5esfijJ zJsDN$%XmrwlRq#`*<~Iz$@W`tq&HlFKanaH_775oxOZuPgTvEX5FY8R0 z2+~piu2xuKJ?F@S5RvE%$e9OozA(jI8SsljNK3|eYNT=5# z3JP9&@lE@id>Tv>km~lk2tu10wZo7(-<=cdj-;g1`B;&1NIaO(L+LZ??P^={2D5~K zXVtEgBACH}%>Gc|h99-5we|g!k8Ztt-{%Ta49@T0or-Gg7U*S1qUe4R>lm^QWx+KW z!qYu&gG9^;!%4rmq7unbb2kR7mMe>-RN!?Z%omE;U2fjDy?xEfstnr6g4&D3C)fol zRS*y=S-ImS8REaKONr0eWleNj{UhT;(GlzW)x`v3>}OL;u-(MO2OwQtnU~epv!87+yG!~Lj$5Msl#e$p!IUcd zOLsWSW@9rcwKadrj3qFg^U}DoLaesk*6s+B^eC#cJ(t^+PQD+1`^7XL#buSmx)!_v zvvo??okG#$g+}M3G0umu80KJc1M`1VzecmrtXc51G@Ogc_Ria~cwf);E< z2BMVs{MAK~ce%=#5Hlb?AUi#$$G(?;Tyv6leU^vOuEQHbJD5u6mCTDD9#lCp@NP|V z0MU7n{PkN_H~QiCn)xf;w!V|N_8(9F5bvn;#WrSEOP1O8hG#N7Gl}BV@Fj+lu54=m zYyJlw8JW?P!;o^+nqP*f@}87b%ozAc0Caxvw|A&Df_Il&;A zU>f*xev*vz9$LYUnY+13FLk_ZyBr|y_6$5K|IHmpf}chT^cQxsi%5dfD{XQ>!g%Z_ za}jzBTUpKnJ_%CJ(Ln~St4^gF-?gvU+{U_Utlt}eCFP(Kf1}Icv=&u^;@ncHNelmo z$MLmUq$^+LPiq#qadR+dwSW@3nz5WH9g7_tH&8j-cXf;(?t`pS3iq30Og{a>Uq!zl zuuy+*-&SO%39gxMiF^%pV74#Epd;>HbCoO93$*;?GE3Q=1yVWGS#c@x43{kjAoP>- zNs^O8mbbg`0ZfB|oe8ry?0L~=t+i#4ditX*H5PVJgvnN=fc6}K)r9J<&0IR{5U#$R z!yGW(JvrT+?`V_}hP99L%^QHS`>B$5wkwwJPoI~AG7qh(B@q4CjWR913h%3w7U-Sa z_WA(}P%l}C?@E_-sFL0e_Z9w*dW(5Br(>rxqVY0*yIrinDY0tS7rY>Nt>Cee^l>9| z4tX+ zx>GCOl9Kp@TBmGrcCI0rHZqL;?Wa;C(&0r>9drokT6xVlW3vd+Ly6n2`tid&%yL$F zS5mu3PRd0=RmLR<7-ORI$f0Fh#jI0hY7<_nBl6X$H|^Yb-RW#z(TXWqcU}GKcXDQF9K*?;o$|1%sz}Ba;Dj`yp(w4OoMQY zgk%;w0w{=yroyCJ0n)04*n5K=!Hdc;oB6O zpy}J$U{wme28mQpDrKz(+b@A=ekoPD2`UP&*je=A4S=Lh7W~Sqk?84su;6b_mlM^M zwTDrCUmPcPCG#!{7fA*N~xC4cEB-nX^Et`oeaccq<#C4Idu;v!DZ&U(ba{*cKD=u ziILSMcwsfpclZ_FyD#zR?x?)fy1hBHm;5#?NX9=%cC>~&7yRq)1COeYfPuj_An*zm zn_R?D*k4`L8FlY)e@WqBcSZx?oY+;mPVrc6@N(Iub1A+XVDZB=#do{6A*GfkJ>G3@2*~*mz0?N zGhwzK&oksL;`?DZ=EKOqNE+uJ1!crJm)X)2A3w39F=TZf`QecNp65y8j>o)}7oR=- zus6hNeBwi-)j;`n5^e_cANfuE3}F6wHnzy^B@dmm={_6bPi?8$^Y^;h z^AcEM`4mRHr(E&!$&=fziBs3U-oa79>JVW@@R2c01g8TT#9*+b0tkZTK+P@=_;N%v zfPvicn~oj{`_CYElW+u2!WX^YRBYChu}g3<4$ZW7r*QAqQG))u-sFOz52l0U124{( zhCHQXXi$aP4kP1P-+$>Dpxh!$mb;j%U_Z~7i1$APHEE={W?E@d(g&Y$8uY{N^{EjF zHIcNOiB5!v{`MBrK0lxPxz$B_c=&TLXBs2^t?S$;y%MHt#x%Z!CnSE6V`XM#6~0-X zQc8i>TaSq@`JQ5v@NJ@8!{k`ftTG#HU>6x!t|h!P4Q?y|&atyj#!*r{@FVy*M`5&o z846AWnR!_KRD{{!R`qa9bbSN5S)xB<8pOt4{ZPM+WAs_ct=smfk)CV!>Bybh#lal4 z1G=&4?#G0|`X(lw_Kw-gLZQV4TX_>41kQfSa&0ZA^fW}l%BjMnL|vNzsMu5>&W?}c z6e;*Zi;IgXF9C(^Av5m783Pkedi0fgD>;O#+jdP`C7@)W|60Qo%?> z31QX*vz74A_y)IXa1?KVY;o~O##qklXrd%~e29SeddYQU0JXXI)bn3k9~b$$AwUJN zdyR|71 z!rmhIrd;=Q#@?v%_UpCrv~pX0wsrdr(0o>dmU4*s3dK9V#3A%VA^^_gyd1>s)N-q-P5SY7_%zN98CwrkTt{ zpDrYM;=X8=uiH^7vzbz80eYFCmQ{!SjU+<-&5L32me<^LS)AIvYa{1)J=x>`llq4C zs{LbLIzGm%0SutA$#QoW?=G=N@c^@+xSO+sLL&;*`UU8H&UNUi>*2K;#Cox)>JnJs zzsvSsSnRYHpVq|KY_K}BOmilulTbiN3aJ$1u{-WE|)6YKBQk)+0iI%OaoH(B{I*ie_^B$1gI!TNr2(gI3|;GL1F;U< z>%ls>@U|t)PXUU-lB`&~!-2BG%ik8NoUW6ub=WhSpK|BlgQtyQ=X(;HrJ7h*0m2?8 zx@KR#_G{Iq*^3fHfAJbI+Y^M>oKy1e{gEd-E9pMhXSWPfyRM*y7^j8$>NdSci@C@;OF*uD010g#cnewt{wWs&^}9cwLoH&Dpaz z*NZh3snej%W}3Tpmk)v_KOz*ZsPWT;hLRIPTzArL>%3O=NKRKYNlrB*o4T{Aole(= zHsqoO?OtW8kP}H_pE2=^r)5(2G*rbksUR5+TTj4|H*{kJ-4*!E6=#_LHW2Qo*d@Y%tXSSRm0#jHfkgtvQ6dOVkYb_q@c1o3F==tW}NuSWYMwZ7eW?MGfxs}CqxrL(rGq(n!BbMar z`do!Q^=53;vdtlb*fMO$5jnrx#h}GJnl;K@u#GXyo|#AM>+p?wN@mcbO<<_wFb~1o z8<0c@BDbj=4-F2ceOh@P10zZ9+EGza&9AUT^k6yfI@+JT^sUMj3!K9Hn<3PDT5 zsyc9YS3=UVk#r*2V7Mj{_Q5P+-Tf9*fCb3q69G#yOX!nniI36oJybr@2hhtb{uMd1 z3~mouv0|iJnYlk9(I-93GdRpo7^q0n{aQ8vQkN7$Q3yTU>Gx$7V88x1~&T^qs2>;z8SiNvS{;3)v<`50GZXnzLk$DlrjQcpoI=e@kGd91BsofJjVUP(>5q%*m*?GP=~u_wxyf)LGp?koNgRg^hx3(U4-^WglLzMVtH6U*&_})d| z@BSO4oR`PAwWD=xN5)pS2Kx=Kfb<(%jPn6W~p3fH~5qdCPN3(o=6 z4aOMCS@fFU3?x@gTIQ+GUIHb2I!5rf1N4<)pq?OiX{%STNMXadA87yCTQs0mXjg2` zl=!`Kk82OH}bGix5qFkBc5g`jcdxVD5RxDoy=yjIcbSjKJ+hRG*!~^ zqlqlLr5d%A+lHT1$}q z#6BY{;_czWGtA_;Cc_qMe%Ook8Bp7>0Ws1@iciKdXY%a`8t0MiHBBCsj?LJ$or@1qnUh#E3kEm?EG7~cH6YK>2H(L*BCCjHtrPjr{{^K z+E1tAI=bKJr&wC&e^M0_nBiubzR*Fu!lU$pAKF>aPpJR1<{uj$&uBLCR;J$ao2S4U zxskk1&!dh3mEw_Dz^d#=)qBbeC)NJv&oIY!e`3UNh1tFtiaHG%)id;mvbk3EhbLK` z@z#h=4gC7`D1RuaFxsJl!-jxqDAE;TIVbNYX}YSQ1CcRaCGiow!I^Tyr{}lStp$>E zmp0l)96Uh@Die=3HdlO{`mHq;8PHGUaS!KQiyc&P2&d$41SEI{CxNuv!(y7Fo4cr6 z5|$<>uy$?QpBxA0bM4DAFgd^W-y`&iv6y5NfcgmK2oSRr^?^C}oDo4HoO8R~JmNnH zOe!R5izM&G<;YBQN+6Nd0lu0ow)t7#J7#U|?!Sp`&XeJtiTmYzw)Vb_vRbcWqpYU1 z!6+pu-@;tO^ueFXX;0*=WI`3g?b7O4id}}B=)|z4rp7S=`v!cN28OG~h}$c+6nKt-sOk>O+Dyrt=yptbu| z{YFn(h)D78 zG-U3*$9fL&U{h%c{!XvnQ8Qi{7q_*L$ToJX{sS@?n1C)bU5(Its;fn^(VcvW8GT|@ z_9N!@Q33xHoA7&sW0{1;LLCX{t_PAUZ2JZ6lt7e^L~??USG06<6N|%X$^q^I-6uiQ zC_<>g%St|a4YVm()ia-u&!+VH+p-&3nBx2U+-N*L>-YOrptYbO8o zS#6D3jOmT5YJj-?1U|o@+kv+YdNeKqy$)Sv6N*5hdx9{)NT1sgzdqau-^ssaoaI5v zFTnQg-1~OyM#f{{E}AzNlOIO<5LDjuh)b$oqP!N*b8s*xG=o(JO^91O`p1+N+=mzW z!DDl7i}QswOpu&5+GDu&+VTEx$d~JIwdVH5(fhtW?P2NFwY3NV_0g(JY|npWpV8Pb zr@*!Qnd1B85GtQrA_^e~4}jL?+A-#4Et7Jb^TBOUjU&+wjow0(Rj2j_VO1(n!U|h#G4Nv!rxr+J*93FkN+u_diHLv*14y{(&C$q7?&^-1{v|lX)+_bU;2TOqk1FwrqqVk0&!h3o1JVY59$$?coZQX8KdBs(VL z;KU3dsG^hEs0?{;$4-zc6mKx@@3(K&Q@I`TO|@^x0UjJs6b*AATbj}}Eml`^IzgPu ztX^5gan*e6C!T=Ff{&|vDkRZ8kl(9Msv#!jksg&1fh)`PH3VPg_UW#zL9nZ;U}s9M zdGAGYk2b$Xcm3awe`3QMJix+5)A}^kb<%JX#I*aX-3DfCAXR zTFH-o)eCI-A}Shm2(DN zeLX?V9H&Skg{HB}h(%W3c#MfwG=|4+!w%c4a_V+qZ z)ylw^#l!0c5gRnV3)#^JTE}gEKORRh{a)|vp;!1@|2*#;+wpdw|Hk-6Se=mSVv^x zEd=JVt+`_$_Xgxz6q(UFpsT~$@QZ$DqAG-=Y=dPfnMH{V&i&4TFQvB#ZpN9Dw&&)t zZs>8J`sz3t_4+s){f)7-M%YnT>&;wzlCyBKZvuUkR9&(s1%zzVCZ#^k_=L+HJ@1(fK_w z09}R3s;9D>7PyV@(XrF$s#oc;@VOpvQBfmt*&awC>7C0PkjJVm{tUob?|6>?n<|nK zkPY0yZKZ>o^Sv6=J=Z4Z>l%(Q+xJO~sVd6^zekQFbGlpj=Q58O3 zD#pj4QRzN`0t|Nl(TLDdN*>k-4WWx(#-=e2WkA|U0b8av9XQD+|BqJ!U(AfPUijg} z5x-P#%VsK505af?^DV&7{y;_jZz%r5pUq7V9j(!pd23Z;%HZ(Bhl%s{f}nr)w2Wzl z&Qq8kFPf`wkFKNjMSsH}5Lh&MWC38cDTIny{CO5|wYE&RdH@mb>>kCh82HwUH&=)Z z;NOhuXVZwubtixo3JlHv^{M|jO!?>KKU~#+G-jhm|5mp8S405lcE=;e|GLtD95xlm zn=bqBZ8|dhs@&sZ<^1;zd-$|CIRK^l|MhADAFKXv=Xb>X zX9sw=mVa;S@$5-HD3$30O;>8?Gl;=K=QbAbG*j9S0E79zo9Z~1&7uV}kwRDal4o|B zx8h;uZ>)cGtp9%Pdi>|Ae{|3PenQ+&zx;oHqA>dZc61zB9HsWzC{@cMe#~e!+`$-e1N6H literal 0 HcmV?d00001 diff --git a/docs/images/otel-jaeger-demo.png b/docs/images/otel-jaeger-demo.png new file mode 100644 index 0000000000000000000000000000000000000000..006b23c34de68375ed40377e14707493112ef2f4 GIT binary patch literal 120283 zcmeFY_dDBd{|Bs7b!n*;>*_#JtM<%QilX-3RkcFw*rbDM)u@@;MeRKjJ83COY+^;E z_KcVbVm#^n{a)Yue(pcu`RVx_ha>r%M6D>ZO><*`$ z8u*N0+$}7d5EbUdmP;0=@W(>vu&J~$P=({_`_$Qi;VNwh;|C(eepl0PXKR z=lGuO%bRnwA&SAzcNN>MP|Llt`1!zrWh-ye#-we;>y)f4_h$E*mPP`A`t|+<(4^`uyUf^8^32M01|` zjnjXxo%{4%{J+*-zgGRt_Frp%f4}$tf4%;Vn1XSk%=3y}CiJB`b_?1a9b9xa5U9_$lYwv#{B` zaTF?|dsqp*YcrB2afiUdE%{M@Sq)>{tRWBCoY3Kv_cJhhcWXV4MQ@Xiprt)LR*r>( zN8IzBHpiD*&BwTJ*a?j`LcRcOvDyS|y=i2u7>EsY(r2n};yPMBzt}KwWF1fZ5n=6K z!i?CZv8uLtSi2C|SCPV4QF z{l#9JtM$AW`ViyuzGOGoV~Jy-{OC`{G|@Xfbok(ZjL*|6uZ?P*MN`8G@Ib=^hMDxj zZe4}4nR-8?X%+E05Rq>ECX*l^By&kY@~Ic6oM712e440zP6~iHz`xvQnE@^Eo+ioany*Bq@%gRXEHJAsauv?>aK~ns)ZTPz7w1M-Y>eO&Ff}(5n&E}DBy!ujsYkr`ygz-2w-Svj6g0LniH?! z7!}UkD?KJ^tG1ORj-}-Xeo>B6=l?lIBNtePVlc_HG=?TQ%f0g4I9%VBlR-FrN)P{E#U=A@n4b80<93bMp0V$(!BbjM-h z!Ti%{kLXXs`W}w9a_Y?{w%-9-kqM@~=DE=yJOo(P!op9NS!GmzC= zb%&P#{F_-63D3W!A?{<(;JD0pxBy~mBx0o&Dl|TQX?@x#B6etk=d5%{j3?v!$uCe$ z6QqTM1zWA<2Z*cXJ^wwz%tVm>f6eY%VYMoZUo)f@1;7?wSM3UVgXr7KT;G{H6lY@d zzqCP`2vmY(9aqn=4gONnci3*F{pVa*qy-c%7%NAs5vPhzF0tGUI{){ZueUH2m}mMZ z&Vokn&@%H-D?vVw(cXG#fv&Wj!ad1>20Ho3;$7~7^>z`ZF-u)~gOG2LRkhs##M!=P zm){Mrq=QA;G|8WmsYzw2BP;?u<7rQsI{dg^3yxjO_g8L43SZw-gM9M4BA+)bQ*CK^ zO?fpws=1;hGE+N*_>WC|?}+&mlp6vrN*ZJr+K!pQrahN}(a8Zn)3#uBi)qI{L9i;H z==aE-*cmpwmVVBd_Dl&zIW+6ow)LzCovxczepbI$B}x5%QOW7KeMEC`#A@u9XQeSc z5B${=n5nn8g4kZQf6n2xK-|ARuVM7V(BSQp@{b|wb&`wW7*gb;@*tN4hI0O9(fvTL zCf+l|Bc>}Vqo+BmswGBz$R_3V;+^X>e|H5YlN|zM z?wvjMgUp`uFeHWXRD8*yBgg55kdG-H{9y-Iw7*naeZ;3!pLaGXVTe*V<7}dwYNR1v z=8+sM$+i5mt<0W{wtMpyke^41pL!+Zu2!{ZcuwI;`u0Kl)aQ$&WmO)FOPL}3y-CKvot!=Ch z8x*ZQ{2YdoCBy4=9?tSFFQ+0tdh+#rH33Ih_MHc2^B*=ZCo^hVNe%>ta!NgeaslR1 zqB^gjI4BH*=*8FIKsgdoc%>A(=FjQ*;IX5rz~-|CUJ*asX7JpJ-%MhLM`9hQdi|jN zlub=h-cn0?)3jf9y}x5?LU*~QE^yl@X2mJyTrVNM-kvru&OixHCbk~N)mxW^rGbg_ zkD)+aPDE?}Fey zlD02n%W7ZbqBG!Azf@=et>s@2`oT&rtQZ-d?A%%13;l&BiYsPG0Mn5y)?9XZR-%U&NQ@}*d^--9 zuVgp&O*_Rz5vcodCOmRD#dT*PW-Qz~AiHqyn{7#M&|Uk?A^KJ(^5BC$+xTzbo9B}E zUM)Mkz|`jhHM37Ajc~Zoa9&h>^$Xcw)9K&B$&Svwzh$&3z3u1x#9xR{n#D#h?#=Ky zI_tmP4K^AJ153g3m%G+CvGRcI_JHi*Pe3zn2F2&lV1>@Kng;`8;%B~^n1IiveLh{T z$Pq6BYfPrhbAl^t-)A%2<6kazdTmV)=xMh;c`cmn{kU2Rz8b9O#c7?FSMlS)?i_={ zg{WQY6zEv1iz|H8D^T+3jrGa~J=Zo7Q1Pw@ZSkVeJBitj@x9rpO8D8f*}BJ8VTLsk zG)k0%HCTTL1~rmWfqR~xPgk$wf`c1*b|7wUQ1{*(5~ZjIP$92=i2cJB+xf< zip-TGHqaak+{nH=+Zvd*rDqFA?b>Nm>h3(ri;hWCkkBD3omDW9Ep*-8<951kin#fn z;pD1q=_=XnD{p$Oo$v*px%Wd`VlcXuSV}`M&_1}f!{yz4<}rBrhW~_()70C=PQ+vL z)v@f|)X?g{4rT4Im*HZz(F5Y4a8j}y(NCHGQ_R3v=!eeU08=_k5{o;9gVM=inhcpX zePYj&oobI~qZjO7Avb4#S+hG$BYKo{UYAZmS*klvrJW$j5n|BgxKChJ@U*q(Bq(pm5}fY-?hdyL9R2W5$+7AbO`!lQsM|po zj*#y{QC(j|I+w*z{-68~cT{C^LS3UF`0`99;B;SD1e!dBuu2g%*)P4{tvO9CPPDzi znO(&lXtlqVp7F%U3#n$6+GP)R%^7ivtirWa^{;=-M8Uvi|B=v&o>SHuIp=T zt?W$NIdR&YF6uL}#5EO%UMM9nktmbI|I6UXOmCdN`wAHEa<7&*JCzACgn4ycr;Gkm zASJY3kNNWCYka8W68FqSMS4NI&RaMoJNU5R%5ON^H0v-HdnGQ5Wj=kVvDL8TKqZGv~RbqEtH|Ygjd-k2XiBrGj z4X7*bm&khB-Z#nqb+Hc6ipNQkfsY;~<)dZ*Bv*~JQBZURd28{mqFut#^^B5mhOvl( zJ*GroVr?e^E0tUd_J|#P4HOz(Vvy$VL=cN_1F9#|xl<43!U>Ag?(f5;gBr^33;}hyt0OB1I;sLiOJU7cjF(B6qRE+<*5|2?0l^2jCVvE( zSov4RT03GySS$TZ%x3!n-yxTuIOTLda+DJ2p_DGU8T=~8!0P<2P4U<2PXjuv=m=So zb=A=Nq3g9ErJ-@w3oIwwulZK9r6}o z(icL36B&a`x-1sp=7s|^NyJpX-)5DGA|#UOG0Ab-<7`HoYr@h#C2+evnvoP*a=_PO zPM(}>A8(bM<1Xd_qPQ0}rVV5YHilI))6ED8tf8=jWA4^7H<$J3F!9dcHX`XvCo!?EKyTi&!9i|;HMVsZpN;J353<3TBl0h$+} zl5(9R!4jo6(+f#(-k5 zepa#3ht1GD25C9dx3$*{m%D7oEXiHJ>^%yEM{y@kGLZq%4#GobOVjVK)JTK8@saRf z+wkcbpz$sRU+!`e*HXOM*82@?DfVLt!&(a9rfyIc;gtjFLYJ_U)b-#*(WyQZk4R{p2)F#L?%U5MN7 ze_dme>{A=!o0|JmngUZSGGTUCB2Mtg$3S3`w`qib)~ppR5b~;#t)-Eh&UWr(g}57Y zw#R0S64<~@aJ1m%Q<4BC5o#!jh#57jq> z0f7Cm>%#{Xu)38-u8y!u1!U|HZ6@|<@jEy{qU%wlzuWjyB@PU{(INb)0)I#=={gk_ zllr@%-`m_z$-FRMhslG`MtMG7W+q`_Y`9X&N0QBAVD4r|q6Y*MPoCp7~U zVyqQp?4qmPB|6Q(MDW8qmH>pz1cyUSiA$Ij@13f_8F5 zoy|=XXu!{6@{F(Go~q& zz$}`SHhzYcr%_t6$VRtIIBte8*Ptr-xHs~P^wtZ`^VNBDT#pF>HSRt+{*`-|mv8fY zwOHI*`z3mT9{4+4I2bLt_nQIW{Zfebe$3+c?nXvUb4isvE6Uw6*phH&ML_*IM(J7g zbkU9&sCDh>EtiP$N0XG8W%r!Uo4bGck1O0@TLDafzP-`a8J`G#d57y2&gi>B@_~YO z)~3aqitw*dIV(S$bmP2yUNnFCs@enGl*$^v8;=1;G1!tH)1*<$@UUgQbG`H4%N3P$ z3XB1MBB34aQNcai5>s}7<_AOc=YGHHlNjsrDdRV6s16BPja5^j$#}5b7xJa8wq^snUF8m-%+&%2O^RaUBj~J=*2K(qu)cfP*2`sT zcaoGUYSY@)ba6R~ZGNGke56-npwTEKdMJGH)2HxX3j2l!Li2m5k!VQm{6y!3`zGZH zh;7z$J{|%P-||{k5g(5in-O-{t>^Kg}`1|@T)#W%7Lw2mey4}s~xVo z7$Rj%;0_#5dpy0LfKVK7Kim(o5Lpmd>;smNwfZ%Bw{+U~77l1Jd^Ia9B7BF|C;OGc zOq=bOSIg;n1uA|a-!_XvyeP~|A-coIPF=1`PW^HGE@c+HjT&iVcHv7{-YD!Q3%S+( z+kuy%M8`C5L+p>f(8kFD=iZmFFyxsKI6z^nJ*Y4@WjUAf{gh6j8H<;MmD5T(^oVvy zd(|39mo@@{#m+qIFY(ZvX>IX45R~yb#a>ow*)1_9a+G@Q&Nym=Y+6oDms`KPxS>WV z)p#nh_PT@$K<-+%+9}}Bo5nq`PYz0b*_+dP4-NU69HWehH z;DTpYdJ3j*h5(4JQ}St;!h@ayRl&Gqj$0BJ*z19FtU>WpaZp>L{ADF?LrJFtT>r`1 z;yI$h?j1l>pdPU|)F=~oQG937Ewd1K6LOO$;O657`sV?Ljf29*yR_8Aqr%iRHHH{wJ}%2vD!Jyj{K9M7cw6Agn`MT;X(gny8+UNfjM7qwoCe{n zZaU3d?Ur6;AqWP8<`)zwpJKT7_sFVmMHZ6M$tnQuY_!eHRpNYF&}0OGj-rZETU_n z;|p=xt~{tm@_|J!rL3x2%lyubBW7-fI#x8kH%BF-#5nl+mF8=;!L`xs-YDw|)J^}> zc;yT+5B!eZ47G4W;~rb$A_oLH1e5QuKJrwi(}j!`F^zru5z2j3W%KayP4Oj^x&CpZ z4ajOC(&uJ0ciX z%Dq>4U{)`i2`_ioD^XJdLfJB2ZKQWE4Exd~nQqVa@gKCPQ!|CBYB`_gy1_c2;a7)q zn>Y`*kx2~e4bCBaTGfLPL2154NsckvGf#yT{s{bTS;3v)!I3+;DHl!)%-aQpIh=xR zc`h@2>r{+v4v(s-TmMYa&8{Q~L5J}~uhU1^0#sT4CCps!JKTUA_g>wSdI$I3Mvl1% zGdJsF%;t-%3S^|D1MF}Kz~gAi$g@_E6WUt(BDr~yvCn@kT{I?RNp)iK&X9KEnUbm( z6+9Sg4uT}x=e8MtQ&SS}m;G#~uvEF57%l4{Tca}oB!;}0L0o4tjj7Zqn`<@)r^jd> zG#xl}ZB|KDdX=?dwL@Pj3YFTeiTf0ih~6y$S75*A983u8iwu5Jb=+Q-lkNQlW$ijS zFAaTvUb-nCEb8NF3I9MEaEKiVD!JOY&achSyWv(6YN#7iHxU2YFb5t`~Sfs80eI49l;f|kF zd!P;V?UGbqxHcj=yt`U%3glbM zfoWZ7VtWfH9vBgEts9vDJU%EaXLB~oMeCwkN9Bwak@s(d=oAb_yS(AHn@!6wMNW!F2gW{VMas)?cXkc||; z0zr??Y&I;P!AB3bSJRec)Osz74l9zOC;!4xx7QV`qex!O+(2*;ot;zSb}Mp#XCe!3 zxyojO?TE0>La$XRofi6h$0&T#>b7$-{L{7?#D~s+J%mK;T9ZmDf&A04*9okP7;^P3 z%E<=#Lc>HVt#j|Ya>s_lwbDwHlcRkwru~ZiAJpr6gx%!~PC@zfb1T`<)5$RsZEc(9 zY1oUA0&ON{X2;;xPqMzQVScsry+~2Y&kgq4xL)KA%MoYMw7^S6eP$}JX?Xl%UkLfx z=*?7lSYE#g)*UsB3(X!$sOu3cEOrM3+e*U>^@AC5`|oED|Ls~565-;^?SVHHSCxkb z@PwEe&=jT2oo)d1sO45=c`fIiejHqHpdrHsd!4ZX2o5=n0+99SX6uw=<|AFpMuM#> z=%pGTJXBnzc8IN4tuqIgE=KmeE@;jgUJ+K}xa~e{3*}m#PQ}hl{SG;DHH~kVaIGI8?rti z-sF>WPOQm@u%T>WnPc%QelNJzAbDsuitLSLW*E^@u@1|q3G~;%BFsAc_jo5B=09k9 zFWj{{;4T;+q<7yWFWc+pR|jOh)kpVEyM1|`(eTL2{79{`Dd~@xLHyAUC%r!U;W9Yo zCWqe)7fUIMi*0SO_z;{UH~zN^9oB`GNy=|KP0YkIsE1K*-r=Ce?-gH%^hbRs`wWS_ z9Iv#&+Wa*$sGzSIw}_8T=R8;7=(>_%3qvSYxxkx{}dEuQ>0x%NpV?WCtL!9VDpKxnUyaND;i$?-At?t!n ze(On_q*A{(u;rS^U8_2j=J>R&04OyM98PcSI<}VPca+11{rIb2NRjj+A96#le-8sv zPH2Qdj_|6oM-)F^1%;Mroy30;^jn#1A^mt=aWX#aaFNBb`B8s{Y~FlV9Cm6c&ZcjR zDFffvhmVVe3r&gQ){HGBSC&0+ zA=gwQey%XX@)qfAiGGF-!!h`}J>e^#sg%#n!f@%Bja9;vHDxN7wGdLJw9Xi6tvpk( z{rY1+hD0T&YJtN`k|Ll4!zo!c`|QB)rGw7{VDg#tOCA!)`#eTBwI_Gt4SzfQevJ*i zqW^WxqEM{9sZwHNlL2C%F-Hrm=q7@F8EeR4Y$P=u1b2x6mwCCqyHcbyOu*9R@NI)O z=Tt!L1sknd(spRh3?ZX5ILM$BL7u1g$e1WE*Wu~BkCE=L|82L7_cKK6R7atfpJ)eo zHyt4aR)+|qJ*C?*J`;nZhgn=R`-$&znc(9tu2HTHl_|MFH-~?z^MN+gJyuVksKro- z6YvTORXC?v)Uffe#S(f0J|$)2R!9)=+?az0fsQRpT@t^gRtk+PdAvQo-6}!Gf7ya%MFlB+uQHSL@adtP(rM_%-2lI#asCLWnuoFV_A*)&nPp8BKX-_^ z^5^k=^=o#3iTq4@yq&Z`{i=Q8u`_g^FlQA3H@iz1ZS=nnCo+`2Y437r^U+;RscM_i zoNSt2?V_QAc!o~g^~H{o8%Pr@FC@<|NZ)#fZ>h#`>wc422Yf$={&}nX;Vp$YJuMh_ z+d@_?AXa#9$4YHgUP?}6!1^-(Or&u_OnT_d+?ZCXyfpKsz5i+f=|&j>HbJaU<0aQ4cu^C&dZ*|J(!;FxsJ!k@sGB6AsWdNcwzl(vjbYo{dI|EXx}^6rkq$|b9LBkH zcFXG`ukt~)_8noW0-H?+7c-S}M<-n@?+G0(S(Y-f9{KHveYGe}m6M4GH-xY2X<%Jc zF2!26j6WlIc*$!0EYXM}o>lRRn3eb8vmP4W68ArImvuO5pDN0ad!ueR&rB#waoBYy z)Tec92VIAW?5Hh+YKpmC4880~_ce|twlBQDF)WnXgOKW0sKd%89bt8%cJ6-msF;_F zqnHsRd>KB6;Mp3+No{cG z@#fF^*oPxQp?G>#)CfyZpm6%5d^gApK4y*CI_jk1ma0F;E4UCbKOo?YuWo%EV$$qe z*%gMukd%{gL|RXMal!CZ(CF5P$p5H|!dN&s+?q-15z8Zmy4VU=%+$Zh6ZYGB>=Ei(VoL2B~Y0xIVCvJ1}x;~`T9H~4Sn6%FC&KXfW zkf?j$d({cGQ~feq`>BsClLvaLJakjXXCv3E$p1ofMxJ?p;Xqup-ibjB9WEn5MyMUc zl&1mJ&f4Ix@MhR8I+dD+_2f{?oci`M1a1kg;V!UgVSq|9oT0{zwGG3+X}7+`&%M_* zZBzGf@ufZ6bjBcuyQ1P*1}Atn-;whhqhqVH>I907TSu{7opvmavZC)|bg(gaDQQH- z;>MaNv0vdc#Eeo_U>yv9gpop}SUhbq%AEF@IP`&y6+a?q*%aoB^RCWLM&!uh_w;-X zZD~_tMkn$|_e(BNV~`*<1bynPN{~6hz)4n8tE)9Ya3*&4s;a;#SJ$GXF}E8jBcT8Ih_R5yZM15$ zQ##-6CbtQMk6Jc6D0Tzp!t&Z?e`2JdP0Tjg>Nu?aHM=H-gW42Vy?nA2577JVg4!N!RoU-Qp#@@MKxIEilxK7-j z>HYAk@1uJuvy%0aY^Kt9=0U-JSqi;!yVd#oe7>EZJf9HKW;o5d6$uP@f&CT%i_lTa z7~1Efk6?!0Sjb2nihXyu%l_$I&Sq-O;5JjImadplqu{WsuERv9eu_x+&yoACI{(EC zvN>#fze{^)nupsNI~KP;)?fo##h2AuKYJDr$!IQ#ExOopW9RZ`@d}_{M^n~ogD#}1CU{XFLXs#$PgV8_ zGK1Q(-#~`i+-E|?=ynuu~~9SMk7a- z?7PZRxEBhXYgP38oSpE{d`8Y$GH2&CqykL4!rOYu{2)2sN;=qBV=|zFQ^VpFyl-vU zIwUKGisDrKL2*#W?-ma+ZGS9+h9y!A;ZTp^TPKWqdR^!8NJNCler{k;s4?ENGC$OE}(Gp%^n${hp< zc&2~$TML2BpWA#Or0HwADr%lBT1~c}*(cK|~H$HEYc!)bI7D8%o#( zKs&nX^awjvN%t&@@-V&i#1Cun8=^FvX*!?${q)j7Q;KDEctTFx*+S1j(7E#>h zLMlW*r0J?K{RTPsP8BuH|L^tH;QrS2ugZ(=7DdbBW{fwP6(udxbbVu*m;dkx)_5~66ue%}4N-K_#rC%}v?=1T6U^+mS z1_&Z~hxRg!X1>;!X*HPv2bbNqT}U1AhlP5B|!(S3wal zX2~?vNRze8q5QTTQ;tbZH=0|;Ug-JA0UI#*C=e8A-Y5||X{7C`sDf=AV z?_p%y#bF+=8QC~>JlRa8ii+dCkl8^T4WfWzur%!Jt2SnE`Qsmo7i+45s!h<|4|nIT zV8=@;?!jYq^FgQf{_8Vrovgi0-I-e^)oUEUXL*0($0efRHkv9fpq7;6b3CTJq{7}u zFj2pCwMD~B%K2z(Wx&s(0Tsi&Q-r)rRa2vXPk@i6=;N(GB2ATj?rKX9{ zOCi}JBE`BF)@9L82(dVcK~TB@v-_Y_DcIjEeO%^dLlZwT518`9;wowiWPxxzD9>nQ zM`pgsnLw+Y0w|ng{V@?2`lwQsmg6D(B|VLl%BBDNvLHU zOX3p)5J=y{ykNALnV>qp{HxG~g_R;q-8EAJz+{A8S=j%hT(Vq)pK_Nq7c19->a;Al zkyqF6IzGJEi?Qoca31e5#BOMG7|yrPK{HfF~iO;Z4TI( zZ|U!2(<|yzLcWUhy{HvaJMdn#402j}8pAnbyPbIt(_mum`aY~QFQ3(5fy=+*fZaH6 zfvnGE58KKTX^hU%MD`L^5lDpP-P`d|>$1-iorF#1pr|nzH!|OR{xW|>a{BVKta8~x<(s={5I-~88}h*XPcLX(CXp;5Bp}&k`F(i}C9Gqs=lvMof5@Od&dpNtA zOk}%(KkV_-gdFSjvV#0tL(j>~c8jCq2Ze^Ef~RysX=mYcGUBa^r~%aCy4ywxlE8w5wV&_`m~pp*_i#+y0J_*$vM;hv>E zdM)oh72oz(@g<(bx$bO4q@nIjE)()BZwrkMfu=%pt@CBIUT=RK_LukYZ%c1BQqiG2 zt3+;wWOw>&o6f0My6kM(M169}*?LTyt~hBM1>UzKoK#}!eBC(g;0o7%R)5lcs~jE3 zQmWL>w^p9~@n~m17pQ01B;4)th-2nwe$-*Xi5k)P^4&Gh-FG+9#bQf1t1kgM8X@(f zy)LW)T4nf>Tanhdc91!VOBk`%XxY8%Ymd6!8Dy7GAY@jgn$3wYb-LmDEk#GA=Mh29 zsN@Hzv0G!(rlD8e&(IQevHK)%M|hy%3f#>}Qiz*~uChROON?ph0KZ;$t?1N2W9SG+ zO`cA?C6>O`Oml+Fl#`0{q5t+sBlnA0Z@h086y5Bnt&-*|JYv=C##B_|;Zw<0BsFax z*?jP*imt0~q$r$wJ6uhUYp_4a6q?yO1e_JHEyGq=D>1id9TL?|(89+E(&>#QDcAeU z^UI}hh%SH0PCjASv2a725q`13!I7B|Poj7_lK z>RQX5oZ zxK|TV`K6r8*Y+*JU7QHKZ%h+YK+ggE`B#Vkj_uV}uTN6_*gV~OS5#bt@d(*Xe`)4{ zeQTA~u2b*eLgnte^4n2<-G+Q_Q#Mh^=a}PD|CLROy7Opltt9k^H&|&dPN-n_Gzs6e z=3tZxbF$B`V2ggSF(%mI`#r20vcI&4mdIs@>g-VU=YM4$MVy53 zCENXn34s2X!0r_m>OCL~`< z2G#h8ite@+O4jD;dZojy(i20km@M$F*7|2EC0+L0+WkTP{1Afd0$DDhQ2kwNwvAJW z&PLGJHh06Wxf#%!vZ6R{TVdT`dckYWez6-sAMl*<3Bhu6BvEH^FdtmYJz_habniD^fZ!v8%*?RFgc5ow zN(whfuW|m<%mpI85z?^dLDDIR-BpYc-54R z24-C6qYM54?}NiTM_Ty3cpuE7J8l&D1|zIP6Km~lh{qHaIy(0Uuh#{l!+6|vNG{XE zHQIcoi%%9}*4Fn@3?)R5~N)f3#@| zEZ3UujgvFlB~|!DM9#aZYI;E(@m3A5`CqT#eN^ zRZH)(Ur@2!77S5G_0UwY0~!XO){3mYlvGaD!i zdijmFY=UV2r8|a^0td~a>M&^+Hvnwd8_NR6{Ngs_CC4wzc*Nd0dB}mMN9z;M5*+ls z-raG6gAJV4F~&;ASAH8MEb00ew}gymM)_Q&%{Jb2DNQ9BRp{ay_Z&oA(>&58oYR7u+YtK)~UV4PqGFq1Bd>c>V4o+q2z6SlmTrebEU)%OGjA2+O zljyzKk?+F-!t%T3UTo|xh5sr>9hLe}+MfCmVmp=MMn>2v3YFy~rM+y|XhmB{#g)=8 zr%}6IC47+P6y`^}??w;hpm7*%rt2F;Ff>i6AEoG@+In`;&EN2hjQd@ki(n%_4S zd8@dZ-8U#MB5OKPoY~Ffq-M`|Q($LOIXBW}PNjdK7JO8jHji%HSFvaEhhe06+{S4w5%L%7j|407 zfLa{qnI7fB3R(`nqUo>SbX_$JWdi!;FpOyG4+#gO7-GO0$C-cBoEl8cu}|{{87^t%cyWv-jTurLzVVeFHq6Y z8=C&uWc_g2v^m^0(&a_{Re(o>(H^eFDlJJ8l3le4o<=|T+7)X6A-igvQa{?&E0aV%u!A#%?=QBmPu`w zlU1qB)XgW8>6p7Tk;%zHfl?%Y;sN(^RO^&;nM$_Bvg(TL_yjS)idq-)g<^q9zXA^p zN|2}Dwv<#nO1_HL>rN0Weg84Nzu6W!ElSPj)m+wEFq+T1KP$#<(8$6$*tUsKo@U ze8ewKy6@{`-Q?{Zw$I~r>92W8(5ye-Kgl))w<}&!5Z8=rZ84#31)5!=F*ZrQqJY}& zWDhz$T!wq)rF)+DJQv~1X7cUrPzfD*ZDx|n%Lp&0r04f}D3zUyYgxClt2glW*TmWc z?Zk8S({}8t?hS``_Z#zzn<^GAGiK1gh1FA~ta{ni*Wi;lbk?pYv`Kp?JWF_10Oe(< zEi0%YPD{oVUDD|BrJ%nvYM%KbHaU;0m>VxXJBo%HZD;8uW;azmV=Xz!gAP5bcNkS3 z4g1LmSOpAzY0~4jamsS#uUHl>1qYdqa0vR(jHqO0o~P##L)zM7OH}LT9c-8mgmWI3 z;#T$hf*^YFC2Om6;u3TInN-ERki=o0a(kBZSQ#az~sKQ4qN5IWK-~hQMo3ByJkSKMqgZgrc|tygQbjBJK!sf0`@Cr zTR)-A@-7YuGt=q<*ypWwdJ|@)X;Qn1Amy`WNrL$DCH#m~iRyDGj0}E{j2S?U@5WvC zM&gPN?TLERjA$I~zLKJwn?uNFxCP_;xZyfU3hup<52<2oA-*D;|M~qhh3ACO-sa0= z6Zy_t16HS8T#D`UJ5Dv^u3LRxWo6X4koz7!3hm)Mb?Iur)f%_76C5Qjt>xb2{Dd<; zjjeOSxg~?yM_dAkT%m97(fu|@gs>9B@6bu(w74m%Ia;w~x7?)ArF$%W<4vo1Nt26x%5Z zIk#1n6Y{;xsLY43-Zm%p;tRboy<(V?KT~jwSbtQPBrd9+d{ zggsCS`YJEm^Y4EQns1cei-4i_2B!Dk+XPSq9ZHhtHq(n>XXB?KTFkBGuxvmsJAjp} zVNt~5ScZABE=J>7U9$JaNqi%N+t<(S!kfF#x977V#Z$@oeU-q926o~g&b|<|^p@KD zyg=|$KepkfR}(qE?E-4nZt?chV%Ai;fyRtslc=-ZyfsEU?S`R%?@zUT&!_^%dJ>wM`zlaW*#^-4l}7sn0ww{^k5Z(Y6rdK1z#E0QnK}?%iGt z5ww%NDTScp#N3-YP{IS1$xF7E@pjiX)!DG0W}s=`4qZvjofxR#*wJj~So$bT&6M9sPFIz`Io6?1jf7uG4~RJ@Um%B~LO*w{KOClnk42*JQImz&82>|JEfiVvl=W03BvogR)~ zcRwOQXU%s3`x_f?mAHpQbO@9f|3m$RP-{8t`Dihsr9UNaSC zY-LG*p`S*N+NA74=Ch^7tc5-Bq)h5K#wJ2msEK}Pfk}9G#!4jBsiVkF+w$Kq#LNi2 zw1^Ce!g*;g4ER6LoE|SN+;7%^AZby4`T0EdgF zas%2d+@%bE;tUwB2e5UYdZ< z54wtTwgb(l>Kz)FuuB8i`)p?wpl&azvPqtiPl{jGMPh<=#%oL?i+$qlXJgUvhf0al zreUEwp+clv*Aodz!>YP`N;?Decj!19yjeg~q~Y2$6dL`@=b1bNiS9dhN}UNAug<-| z{`X-qr{XgopysIje9#@ng~!N&^n^OuvjnT-;=y+L{qa}!e23^u^P`2vFH97EMlj@( z=uaw@IPm4qARWD})Y-7_$i6S6qh`&AH5pX$Y@uG^?C(zcKk)P1;%3;z-z|j9-5EKs z51m{(v2vH&W~9cYBjR4n_Ro>cP8)-un)c;-M0$Uv9p14b?eMdl3^cI`7l95w*SHGM>st#gW$|K~9~@LXi4UaabP< zpFqFvo3V@}g22NpPAaX5E2BTJ&SR5B6>TlrpHk8|Z1?0Xcci*F2CnZ`*~sNs+p=Vx z@RV5ALEE+#sl9dc-}wIt_g^`vL(nFTjg4~9(-z3J*8;A1zw#L;t4PwwcX`WV(Y1|- zX62hLrWeuyeFRtd;^z|+-J4->6Ku@7>*eWE8zCGp4^(GR8GO`TrcrZpBI5SOm8QYW zchT!0bJ^v4T-x=1_wzcctZoxv? z7DPb6vPFu3fb?bqwkSm)p@xV^3tb>cR}oMYu+UrRB_RX|2{lAz15!f^p(7v!5<&~1 zg>o03ea`ot^WEn@&;5Px`XPBHm}Jd0=a^%>;~npSC5hS#t^RmC!t0=K>$uQS{zF~p ztg9QpY^cR)fXc|9qP@7{(2&$pk%EFiiLSVqfKY4p@wt%-WJxW-O}? z6(QyO;1VNlqrJ90A{DJlU(jd9zPO$5&#asZokbMCBXGvhjs2om&Sc?F#KJta!=J3n zIN1E=biaN4#{Fby2}kBJb@qf$7^1XkY1fpvw~Z3hP$>R-o3v#|-FF*9nid+)k8AHeES^{> z-?M7!hh=L`PxMBz-YU{t0ZPl2=E<9n0QL%y7)1mbyn%);sQ&1=F-p&(M|@0K&Jj}; zWtp*8jM!dQJHP92Z@tx3ADak`9s${c!PnmINR})SRSfS;3(r2ZIN=v7ns-dL!68l0 zC#pqKC!DMyaX0^FOeI4M~7AmIMoq0p$zU?LfjRO#5fmzKxHh zTBAD7n$`R2$eZEyN!Qf%?h8$I*PLSPA1iuo-tDydSj5c-ksduS6r<3r1r5&fw@okl z;4jb~Bo!5(SHn+ zmpP2Uz8l#?Mo;N z#hyC*fbs+@YD4jvt!_$fS;8nbOJmsMqIicLKl|NkrLcDld8G;6lA5$|xuHmYRmQtnXOPFuZ4z85ywr~Ec(;%v@% z{=#Xz(4p@+zO4YuAPm63zc!tN8yZ#VNu?@#dep5~rC>S+(gT(8z(%Cm|KPz2gEn_?1t}E{G^rNB!*K3h5D0Cbez%$5M z`6B=(_YALS_Zm?u>$HA+^Kd)J6gj&=wC*!Ow|?{9_S!1bH-5u===n9YpirUQv4K3h zg^wA65E0^t-NLVjK&OE4*;sCUp`3rnd8`)4P7*y%Mtu%jZ3zMB;8;i!r^1i)PoJjcM%^5xORJ}jlZ#FDl5DM9 zjB0Ijm{gMaJjtA#()7E*>?#dap)nvdyU}ijvDF;$b4h3keKfmW9O$+uGhZrUC7+ex zhYE6xn0kl_y~2HcF(|2!y-05R@~P5H*?A3R-_O#gJ65g3ioGWiq6ZFRfm7s#9~QBR zBJQv>0<=Z?Ger%pOk)jQD4f{Jr%^rie#v5R@38G}-OWAGN8}T9TGdbauv@KdXhuOXl+{mwuti55O3szsYk$`|*pte(FrOaK|6KB8r^6(7auu@b ztFC{=crOHP5~EeLun>0Qth6M+|4um^?|nM6pHnpC$=DQh_Iuc0jk(bPJA0@l&b2$F z(RaD~B0ce~`2cSOr>24MrCzK>E#Z&-Q`b=gUYVoE+~8t0*tkTqvKiY)}aoobQSO00s;bR0lg3l z%&NlS;wWBGnWF_cPg~pD`!*)RFrr~QJ$M`T*LvcX3Ug(aY2)@a?e0h;0^#0QdVFs) zKw>1`S?P8z-z2rn=fd%ZRY4s+ow}Mz6QC&Fkd<1qRk!?b>tV`8pA>q3Mbg_sNon z??7>n$&&Q5``4lVKZ<&W(|-gTlX~K`ck{@iVQvN>lUC*#ro(U?2nOS zZYC_8d*w&j2R#O=%Wsfk=4sltMQ2>wH1dNGgVE~w>Id@{FL(d}X*>T8woXckp|O1V z$O*s({5D_~@~Diy zzCL$KXPR;qgl*~wPTX^v6ZI9B?ySuh_jxaGKg^^BQ8Nal^OK-MHPvNUm(A|%KpJKm zU0g9z?wYjCy(0>c#TO=UeK5<|l7S-Y7Su8qwQ;R$z?*jdu|eVm|2{51Vpz63+Qlf& z^W@k7Ec=hsndb^WG)4|x{YX%k*4VXH(`n$%e1hqFRT|f>@#0k{MAl`*N7HO1wZlJ~ zdMC~GGL9`2CEx!%97aZNF+^`0mka9MFbQn7b3HC@*~73-1joemC4c<|(JV7m+#@&e zD*whv`6UeBXM6sJ`$fl*=9p3ir_l^5cR~}H8`JAQvH!>*fp?wVj@a@vQYhRXOa1lG zesQv?M=D>!PmiYRjMep%G#r!Q9reAmB;l^G>S#enwCF#0wD)rKE=n^=_eXrcYYCpZC&`+=5%EE|%C4 z02Nu4ib~tHI6H$EeddfVFoYIChD@F<{H}R@6Rs1*X&rVgp5T(GOW01h@hCcRbVeel z-du{)sMlmHs|QnCd^1SKC}pCAtnMi@V6Kl#2#m$s_lLhC_kP@6c_!{}EQG>BAyxPi-sN>I~=fk;IsgTTy4fh`Y{VJUi z;t&cl?^r+Dot5BGUHVCFY!n2sK5M$PIVvGMx}9=L*}Vs!N5F?Mx!upB;mXbPiPp8q zgqEmGlV)?o{OP0?T@Lxp{bq4VaoO{JKPG?I(SN=4rxlDu zPn<_;sI#2RLFyF{1lk7u*AIv;B6X=QLv3vM{%+u1sT<#dpKlEf!2G`Q4`+U~>rl;| zuved7pP0xmjd{CeGgKE}J$oYLL;YAPZ}W8NTX2wlW>XWsB6CD%FUV(CCZLv(rOg3r z`xpxIle`1HQZg_si>7eJ82dgj9~)=F$BajV6w~$h^${VfHTZ>1{h*koVn#VdmmaxD z@HMSle%Uq*y4AG9wrc%#kE&z_mw`?;e`X@y?qwGkXzbHbs$K%hllMZFd-Q-!<&*uj zi~m8mZZur7qtf{8sd}!LPf7-$S5-vTZp@N*$NImthZo$Od5>~mk{0JumwJ%P_LVvX z2bSTX=g680^hpWXtDfGghbtThw^rL_t3X&K zOy@|aJ}LI%T-#T!&D2}&SV4a{9DeJFCp0BaLDW;r=+8g@%r6RdlgV}bHpC^HWHw)O zsj(~JcHamqX{FKk&S41!m+}HFID&&$#OBB26Y6P+22a`k>?SVtw1(bvz0sYJxsbpG z)u2ID4S4dNe0}iOE)cZf6f`ZbxV@tc8xpt_ncIf4i^w3I@23gGx%4aeR6ZLskFay< z`#{)+jXmxRn7wDP`}q!Nse@sq;*gh_jg>sT*c?3W-BwHf0vwmy zqbiz{v))j&brFB_yS@{yJYbtE-l9*$2-(N%ZM&zq*UPZLf2k}2M^04;eR=^bN43suuJ2;U_bR!X4hW>ST;^1(X?yY*U02T#hy zq?KE7wwt(8->nR7IBZvQ{gCiMlxu({1+{-6BwSgrkqbVixgW%^qMw~eRzJiK8XOWc zfpF*mvJ9_|T~>tM`Y5j%`^hJv#vxlb<~#;uIbcu#l!wcUgU@f=bx26d$nQ8EaU#?M zjszQs=0`bQwXQn%I1)%%UYj{MiX=|}b$ACairP99f>SRVnP#Z@je-v;E!lI}LK<@% z=g3@|(5J0e@Gc71tt?Y+*Tb7;Ay_}tk`f!$42DvoTHc)N{PSi-S;^C3lNw{aq z28s7&8fnJhf|hY|wu3^wjm=z288+yPfhQ$dz(;ZB!;9#*(c&e~>7I`HgNuh1w>^DW ztM*m&RN4Sz*`U`%dhA^3h-kn=X418uk2*}&)Y=P}6T3FEcm0a2^U8o*E^)-=yQwUl zq0=1Vwh?6QQy4SAz{9=`4YNr8YnHV`a4*NCvqpipTsH(59LmnG8>c5i{cgYcf4z*f0qoa!k_ zF&nUkOrTbid_=#4SAqXq-#A~NqFGS~-!-hHX0(2%|M!u&OBGcz11C;2 zh#$qWCDj9p#WWRK3mrZ$=rQH)e_|e<1{r-mh*r(7dEOz##RPq&c4JjP2YvsbCsP5e z`@4*#fCqOnkeb5aukTLQmN)(_&;^jAM`W;y0SiZ){FjP;DkP=)`KO)Z4p}_bBqVh^ ztK#_9I%Mpbz1~Q1a_4;E{L0< zYuEY?8xe|Xz<>6x$ZvcQTG$Y}p8sv)xUA`oZg`>4jct%}7=oQ6rZs2;u}-wk+s-*T z?4K3s`^K2t=TcGRCBdjRyqJ20jw>bQOSdsA@Y%aR^L&oKNCb z7yU~2+*GPP%E2Qd*$QDZuRY5n6G@sR3L0mwsO52s>3|&!WoKY(1ji;!x zZDXxX?#}JuFXs5Z&)Qs-`!~OL!-ajhP9g?N$xFd@!B)lO=W^Ta1c;x3H2p<$I?}Eq z>f&_sAp7ZriL?b(FiA#w8e5bkrltD8yLqGJJ6~hWM&SNU*9K2YX}HYfuq~Zn6I)x`)8C@4d#dF zj~@){Vsq&3ZJLtRVSChK;Pff`MjF5u1nMF+I`p0H?u?F$ik{chX#ZBLb23}nZt!+pjdfOKkpVS{g8w-mxDY<9P z5QUU9@irNEavd^med0nMREfD)CdO@_w9r3y&h;zeTpb_?dw?wcI+3XvVs*e^HpKWQ(z4wR%YYD+pwA}w))z|r|-JlOFwnM(cYE@>R+C{!#hJUxSv%?2KEmQ1*eY6m&KFvz|9a`6^^oXPCX&6^|qO8M1IrfW8 z2hY@eAg*=b)tDdy2P)YXeO}|(PcGj^x#C5RB zBphK0b6rne#z)#Di8@L9!q_IA+Z(nHqA@`HyWP5r74D}UGlH#LlvoSPq>MIDEUJW< zp7C<~75T0l+8F9m2XV}DHj;mBv@ifU@rNPry9MNOJ#dx}nxSuqP!_)=v62=uW7qk# z_POIa$jLGeN6Yp$BOEp5^_ou=zX-E_46=fIE=7Myt?Y3AD|TSCrK20yl&uZyB50#p zwWBn%(zP`tb^AjPmvE7U&)8aF)P~)9k3ADF6h|+7Bg<>%+hgfqx=eT)viEXh_8^F^ zYh+i?+S-q^e3h5v6I2*-gz`qe1|b9!5$8hVoaG9>DZ78AYkFmvAf+o1;xbCY$%fd0 z4~LCg@Kn^o*5Z3;wD~4^AU|`@XH6%$N7+a)#FU3`Qg$s+5&9YQ49*W%5?1s56F?57 zliqHPmN5%@0YeS^t6=9;_kMO)k)F$YgU(y7^_$7p{tBuJ0lOp36PN=l5-M#5_kq|K zF)nBSQHhpt1_&*muln1zz{85ACxSgss6$hstoc!anc)4HJ?!rLQA8)}o%}~-m-bR$ zVReUy3|WF%(q5pglaX-W3p5l~rFs9rZ1X!F>gU3x+MJk6xn*wD@x8>dQx#!(OGW#r zYvett(@bpgEk~?q$DxwK3s`}p#Hna0w+)3QPp#4lIqC<2r%HE59P?ocbJpoQNXqPP zXA5W+aC&gPOd!BFa&R)cs63a78olc5S}9cY=Cl}1Cl088F1n4WsHz~Tn+<6K?ARg4 z%VrrlqkvxLzNP(@BN(M7^|@-o*@Z=#`&m|HX=EG z2CwSAR(wIiYsmFVqfuc}+WGHxM;M)SYg7uL9x73(6Escc9kAyrgD$&ZcoN|pV9)%}xLB}xNVY209EPdOekBl{so7Gk zXC4z;33#tB{>b{3fJ}e20_j!{bb?a&l+f zcKkCCwZ8WxQ)$C3j(>h=WtG~%UQ~BQ z7JdAckomIH@p*snB2Z{+UGx^#?dS# zq|ogi8vF6($SlM0`_PkdqCB_~-omArHp$rW!qRUT7tic_4GIMm`qIn_cnaJo{KxL& zyqe9Vm8A6R)IOjgcwMOowsGx7zua_){jcip!fc_qy-ohvJ3L-4qaSo}g= zZrh-%B88Ck!Gry^_FX_DjTznyZyONDrY5mB?F=2H`i@(R22<~CEcMlnD!b!$W4G^J zZC_0*TrL%S=4l?WXpOWy(eP2zBSY2{dM!CWpKayxeUMYb{CVl^UnQ4E(bmc%NBA?V zvZ)W_v~B-bdoWmYE*ns0rd}|3wkS=&{;+3E;IQ9UXY{A>)MgiFk_GNsqvg@>`N^Ca z+hN*;uVkHK&M13Ck6WfVv$k3SCoIM};Zt*3hqB~Pm?BbmrjJd_t2J+bBFe#kdEWK{ zpqM|uNFBL*MXZ+SHq59I%(_bav6my23dQhr(u%G29%i(c8c!!XD;7B-cD5{PnO{f% z<8R~jZX%33$1f!9DCFUL(`qwvsarv^5Ju`5pyGb${nCL>Mr&&ifFuEUgQE4EqIl6} zW!9EIGZff`H_Ns*ca9Gw+zZ9Q6nO198aj90UT(Qi9iYwJ14V45bZjMxf|W6yE=+h9 zOg+DY@y1HS6PbBV(IR{asN=XS+V_b>$Wryh^bey2WPa(ZPz`F{2;(mrUX7;~!aDh; zI_^PUtDYO5`6Wi6TYpH1-+86r0ewJ2c;`E)b0`@NKD-FRB!(K~aF#qju8}74?E5dk zbQc(;(ORz}t{s>@apa9`C!f@^e<`Jhnh;)CDSP{C_14zX^rgzv{lT$U$M&|O>?`cK8)5Hm=f1Jn`l1<}Wk9V@p2K5|h5u5kD-F@^K4T2+>O zD(`mz_Yx25cYIv~=!hI&uZS-^n1R{p4(d0|OPiErGSZb&>VCo_?S&_{*C+HlrCzBJ z2#jF^v%xo(pnS>gMO#CL8EOt}H*UcjWsn2+bgTWkG3yEKEv0$BoPWHV#$6Y0cV9_} z-9yolTI{+Q_^9IyL1oDyCKfj~r2TR=EMOF5KP%Jo@rtdD2px&EzSB6^Y#}NG9Etw> zTVpocxJvDUuMjJPBRcn1+ zdG?qt{X?Bqie|vWqt&0Wt&q8`?(93m)!w-0F8}6 z9Q&yp0ZiH<889xbMM9=)H~)TG?EsUbig9Dgi{jUY05QrI~w0W2%PD}oN|kFKAa)os};Ia z&A_H1uz6lpQa|UpC5>dS1$D6RV()xk2e=0Ah{lelWXf#imcPP+jR~3F_SHtW6G@(} zmrsH)v1!bne>?%==|EkOuU8B~tyJJ?Y@KJc?H*JieY>LIL2?l%$A-x$H~P#&dR|3X z*~G*>ud>o|#dS$+^{MVCFuhgo(+$7j$L`9D{DLBOGeHWzYt?A)4<|r>`K^Q3%iUBx zy$>5ZS6?czyBWC>Dg~~t_9cHdXyL|8$8$FT zse?cLpbF<<*ae9&wLK~6an)PwqN_Lj#`QzWF*$b<_}_*P}cZrMDx!BLQ#ZdGCS34`Y~XQH>+Xz_Gf48ivop8`gTio{JUW>1-`WL^aljg}%RGoU%lKGlpwd+oarI%=EVL9!cY82ApT- z$;%y{n02~N4f817<&SVU_L5VOQifHXfFwQi8LrRh#$xO5xGK7iiW_89S-p`EkgQU9 z3Xg=lTOd_Q?|SWJG2~n9H^JZa0=D=P!^6>$C=CW=;{%{x>V)nuEhIEEOE;2eC;U^W z3PG%)mJ#<(*Fe02h}}^SG(3cH`4#ECtOP&!TI<^#y|`= z^j-Akv!oVDQi_n%P}tGy?%567J+$+WPT|j*O3J&6m*q zUra~$#zIqaUf|V#V$ECZoGR9;>79STh1s?i%MluslaWi8`jK^-&r0GFVJijUY6(t= z{u&L3uqp@&DpGi_T_Y+6GcR|S&{6np@3xPltl3n9+l;o3?W_zs*e?;BO3uC$3SZ26@aVLgEnb?B-!98@QT*0w$L<)OdJTE@Bq6&3L51}j6>cllK# zyK@xvR~4c!kB>9|auDb;{*%=a%doXi-5C=L{jcz809=Y0M#&C@>t*@MTB zmD5k=Q(TA&>zaKs?_}Lh=;%PKy(I&9?ahad#;SwJoq&bG@=FPsV_Sg7XA>jI?dwE)_Ie8MIvVmLt>CwN^)L4=+^x5{;%=x;XC$^u ziF301_7Mqvv1;aPr6TByrh7RfFK-Twlc2v+1W3_NF*rl=l*cx1grO>m1aG z=;P_l>IH}uV|6%AlNmX%sIYf-*zit)=F^8}E8IlCcbUYh4D{2dj=hf!LKd`w!jeO_ zzMl@9M2xtHOi1p@3MynJ$Zg2{VLv3Gp%eB-Ieczt80Q$98QeX&tEF_$^N-|PTgJG$ zjR4JF#-(eGHnEbO0hfO%23VGbP?$a3JxUlJUQhL z%&d5$yI~<&?BE*AqHn8)N=Q?3}Qdyh0P4%?xMdAAuWW zT*>sCb{wll2rY)+pen+CZYa2ZOM^cn1nN8wpH{0xaEx2Nc+pNn_tP^&@fYUSH;C`4 zfsMpZHSzQTv^AjB*>cg{KqKpXF6baR_AKb*UzKS6oq=a& zIF9J~UfqbRYWw%*$v1YUq@>`DvC19#pB+`=%M^b7An;B3 z&QAU@@3e^sA8Hq$nbt;C`gx!IW?KQmwKjY0>pr_?no40wzLYc40*}CO*0rF%YcYW= zDVOKo6LlJ6{unS%W?p{ntz4*ZZmGGIavje6ehjb?XYbd6*nlQyZ>}2NVvl3Bv+;fAlh9d*zw3YoP+y} zh=>Pjo&H9^R|%!2clYk^aNW=Hjcxg83wN#3dLVk0VQ-9r6cO@a;hwjd)dR3p$gx1?pH5^3s2dJW9MPa+HDT&fp87VNV^J-dru=q%I)KXW* zmaV#SSdOC9K4>$&eJ?*OBsq)QdVQ`a&M4L2H}2yArl*aMXK7_O%w?v{C_deNOk$!& zVS6v_5BFuJ(?8o+#ADmjkc}~Nu%0YDlG8FOyeor}e+y`(Gl`>}8PR2F2wy>tnQ_wx zjocxGTbC6paSyo3MK1_&rh}g#(#74n@B2LbKq^=$aV=-;A&g=+D&*2 zW~(PvnaJQcR4x9u=rlavo+G_83wv4Ns5?gv>f_p)?}*<|1?m^#3R3s?71nrbaX}kz z6&7}wzqoG`_r<646dCte+pv)tFF;_*wAL$}ex1)HQlFYj1q8Rn=Las-Bs9D7_Q%)k_P5oJ zL3hZ|g|NdQ^Q>T^6w9b>6cp&uC#GHcCi)3D&~}BiA=6vN^g!?DIS;Cet5|&ba;xj& z4+TA(&#vH=5dW^)FQ0t2L)!(>{@m(NM=htamonuA2E@#sjaGW)Mck`OR!zvZQFI|d zH3>AB;pI149LXZ5jRJlKbYkU>CBmie%g5dWXZoL)nXscGPy^s5qQ`06gmWvjm5!k= zBv@_t*z#_rX)t!@grzl~+!z@vH9Qb7q>Osi4GT~>lL)zFw#FZUhKvL9L)*1q#}*e$ zLwVH?-*h;&w$^84gda{YX^9n1NJz-9th`b6%N+8;KIQ)GP1W}xqIeiO8SRb;EqADTM#lod6kpe+t9xa z(YD-Be${W9mNw!8OZ)67G@6uKoH*?>kNfUo zp0`n5R`&oc*j0IKa8XT1XbGp&hccs9T$ukB7XLmz8#}Q3;ENsFZ`xoihOIjUCB}H~ z2lkdJ>0@p=>6OEh%q(^30h$ zAf|heWHV)fyjA3E zXWB^VNtLd=Qc9|DOFR@)1E)V@y)I_hkcU3{FZ-bPXzZ8JXJog~v_QD8GFR(B*g$a3 z;jJT|P|7_9n)c-Gu}{Ou`%C@h(31IXC0dBJHK?^#|$pgNrZ1lm^%`oAdu< znjJ0*UVVEzQPJ2ull>wfYJf&gI!i-c9^ft&{A>Qj)kvvDn5PtxI{)Y^DwVZv-d5@1 z%_pM%z+R*tLaFBdEg^%r{dU(gi*`JIsVZu_BEbm6t$z7^Mvt-!kP#=l6YpElKc>$(l6xw*KjezQqCMc(gUA}MABj?Vsq5LdGQMkA_kLMnhQ zBCMI2d%7_1wNQ}MI*jfqlILz!ocB(HeU~Lh8&?Oj7^aC!32T#7eRX@p@z~dj9Cr*B zPB#s1gzfj@FAoF}bMigdkf5MVH9tZkL&dSK#$q6-Cy^I7`JOd}EKL5Tsx9r(nx3$z ze}IA?kr|jonz^=Acq2bAH1{1K+$4{=FpkdpPD5H&HKgL^vj#lW3FiWa^zYy6Q5MjP z+4@lEv*n6!e+k-Mtwm0h#HiU=L$$P|{_&ij>&O1j#ryQ>Q#T5WMg};OXW1_rR?NeC zmTr>y#3wu@HKucb_I4ibo6AuB!Fp>KJs%);FYrQ} zxr{nGUOkY$L6lWpDDiPoO9wI!28ynzZ_5j74;`q~7;eQomrKAaUty|dv3pxr6Y$N< zR-32|bAsbBK9r_P#^tz^bf1>WpvEYx8ku`RJWlGs8&Frf#Hr4yAC*h`qlDmeiw}nW z)b!YVx9%v>;G8^7fi|uA-{DHT9}5+(#!51XLY1qH+{28qPyh5c{=V}=x4sMT=le`t zap~O7P^0}WqjUsvw&eTwM@LjMZKo&-+gbq`N_m-;9^w%`s>6gy?Y3{Y0=|;hiD=M| zYiG4HdMr^c~Av@9=5lULmnuBDVzOj z-=0U)tT+n;J#EqMf-nrF>r#fu6M{CC6gWF)h~D226W$!E{eu3aR^}2ju%w1mFvQWq zOGr*O)>VV)s>lpF#kuc`e8bd|>gv1$#JQXh=3`I3_psDzN(7Ib0f7g7+ zn`FP*NUSWzX z{!P1CT`{X#Ds50Jj`6hhWd0cqe@&f@{fyd~eYDOU@(qtp^;+n}o--(5Z^j(t=@D#8 z<*F2-#;d)?q7a7!u|IIBFpSs7N~hrbcqkZS@`=PV8NeAJ#Ujzrr6#q z(~S`Xyr{?8-O9kx1gLJ+{yM`ph;Xv;mB$y(B_|XrO8r848*5HlbSIb9+Dm`GK=u$p ziIf|he~DLBE4$nX>_Ls@2g+*B! zAkuqUr@?)C+2$0V?RppW)%!a9)6@)oEQWNgnLeVheWVMZl(ElCDw=!t>JU8QK<%|% zF0?EfHyIyf)TBp|T0kH+=25~jplpLee;O);Cm~hVGe?Fn#W!-v%#b8#2I0=FLs8w` zL71#I);$KBWH_Di9~ zTAOOlGsY{RGFy)PdI`bTM_@uQCDW?Gqg3OHPZ!9sv>YYYaqVFEwxOy&8k>F*RMm2|W;T z3c2ns-1yBY9`AxXgTsV}SbR?k5QB*Z6mnT2|j!>1NZT=r* zazXJOm8~BSg}wAOg!=T(BP!nv2YQ2ZXdevBl5@3+b7OD0{k_~kChu8sl>q@wXMR$t z51FYRRFaTiUY+UDTT?g2{nqQB`dL9nQZKCIp2dqr!TciVWvR$WJZ41wMidsQ)9BfO(CvLHjjbd*VLx|h4Q!laXI^PPmyHQi{ zRWN8v0K=oWn6Z=>y8Q)~Y8Zxbi>mkOEYrR68-=N8G6x7Sd94;Mq0jzpP?3^<{P7n& z0{~d+e!51#WiqLZLIu)(56sdG1@450tS>~!Xq?+zWs4I@Z7%`wUa_#!t8KJX)1Awo zq7NngS4-dgDk|1NzpFwFsr+zbyd3FikVw>U_#>pmz$N0|*!R~Kti|5E>o)1Nw(aoq zSTR~L6H`)(5uw}nva_?1P(&Cv&^NIN33Mv9uk$!y zbqL;^dA#>0xjtFjiZFFN3I@;j0@(4w+Mzb)wgLG71GvO`(hv+z4Bc7LJ19%w7PPQK znB@FZ=`rUkuqck)qMW#7ak9J|Hf0>GvJ`b#?Gf&+T5Z3se_qY$wkCc;N`8q)?0~w>PeCOVRu7zN*uY&5@D|QOn-z_o7TXB7Fh^@TPi+ z!4h2R{N6ixcgW6-vWp^1dr$3>{tg%p@u2}s9Zz3aaQm4PYaoTY8~tJ6u3SYGy5}m}aQNy=8ftf`4wWB*eBVbOFdg}&3K^pa0=uMv zB_%GCw7h>ha@#LMHEUM($Y3F|MiQ%@E-kc>Sz%o0X^5}AG$x*R_022c|;O#MT}*L&~Fg2rn7 z+}*>xM|takvqMgc_2%>uK5Kx2RQ&q&QR@-toPX9T zvWRup<>a%{-;Qdq<4iZftTPJV!8m+DaKdhEWW&r>)67y6H=+#e@h;k;=}0Dv z@KI~W#^uP?_q2X>{Eug4rtj+vU0Ds9%{3;K#iPHH^kO#Zv%hO{Dmr5(CTz}C!H?Uc z@KzH7nB;bJYj4|lfg)nT^b6K@#CnBTvrN43_Zs|tu;Z|zrRCOsGLXJ_jw}KY4)BSa z4t9IzSkY3YWd%F*ZyzqJ0VzktBYKWa103APZ{H8qAszyL5T&|qE>FPx+8TOyT;qb(A>>bo0?Uq72YjhDWFd~YGaMtvx*7NGc0D6^Ggmzo8-HGIa(D4R#e{Auh0 z7O9!^$DK5=0P|_YiU1`zhZ`#Tz7hNPQC&3E(PmPs*m9D2gR0(f_igM_hd%S~Mihq1C9S`wt+F9R#ymJgRH&Mm27{;S!u^<1Ai z+#Xat0ZLUV3Jqd0#(OXR#)uTCA4|78Vjs?Ta>NMIVbZ0&tLHi(EM6qPK=#?Kw?>qV z6)*SFcUe)#zK9wyKQu}S|q~o_|pX3*uF37cmQ9(-<7|zM#7b`0$SYy`3mUh)9Vq%ki>ez5DjmqG@$RhUx>^d4AbULb}#GI5c_d6W?o>sL7NTLt* z=Kv9={tc?cG@W~R7ppi=qmB(%)?Ekm+r?mXnS}*hB8+b_r?kfNG-XJrdN;<%$E@F?Bs=i5 zF2=~2T^ql!+;szC56z71{os#T1{1*;g)SrH!ft7ZgN7@X2R6N&`R`Bf=A+vGO)M^6 z=QFXZcg!)tE-7DouHq3S@Qv?YaAuckgkwI!En)~FgcLH_O`sK?Q zs(dMF|FK3Ao&E|B-mtbeBSFT8noBb4n^le7jvqH!&QGch2)l*!htzw-_=>9F??EsQ z>amumS^e%+{KiX+AD1li?Ep)FRPy9L+8I7I*5c=@dqP`6Xco zP0TxLr%!{17>EVY1%-YC|a95ONl5JB|HOSQ6V;)qA@a^*1S6<2iTDSbu z1Ng`HExJ*(Y;(+bvPNS@f^8gavi@Xlj^uRyYyGX`NLy2u;0@EXbu?(=N-li>K>0(V z73=3!koJXLXCgn!9y9TZu|kG{6cpdW3L?pG4b=F(7oSA}CHvyj-;QNmJ9;E(YIh5G z@0;Tf8AEt$&e-#PtqRoRl3JWcC}wDmleJ3n`UbQ>=2X{esJ^K_O&L$}ZQguvu7)ivPJ)P z*_9s>7m4ZbU*5b41RnqG4-a1cKR2KMH+$K5CPOo50RD?{ z%?d;}%P!^BUu3C1heb1*qbs5qL*6hbZAg;8j#Et1+ z7^4JeltLW+!FT{2Jm34ChBU=|u&Q)HIhu1=SJnE<+ovfN+9G3#F+CCUWahTZl9;=e zV0I=X&9W*1oEaNd2fCM51=F)iH6eCZc<`FOEfRyBBHt2L+tK|nnPgp+gq<$lb|Y`V zDY+Uc^&&gdGv<{q4bfph2nZBEz5R6kyWS}LiaTECC z=-fz(Z6RIFzgt?k)YQUTHdO7tIzF@j&9j@cE#3cR$Iv$xeo|zI- ztxuPBWq^mnD0Hk*%*Nc3gA6pY+{V)eP5KCTM!6Fl5gX-10;CG>X|eOvNhPDffUXVk zycSfvJsup64-iFJFV^dPa9C_)ss$}PH`&h9{GEXF`6L`nsoR z$V4*`PrPaWu~({U$rAk0Htjmp8hwwnJ&*BR|2TrqbJxT@L|oa8YZL;$Np}&3*;Fdg;*?WHWb7RSGpCYCM*Umlr_M-2ppp}11o`7jGGyy zn4P)@BHfV=`w!m)jU*jGZS&bRKOM3{TlbrH9@-PYw(OE$hM5-?ClVRO>*m9r>vhrR z=&H*jt6tgrV>3yJN?8|dXmxF&$0`*z-QsS=oYzW0EVHnuc`)hkWwHiW_8 zE&;wB)3*F1NtL|VuYx$^v^htl`Hpt}=ZxdFVgG_PH={o@BfR#K;i344bzvP?kL7Ed zZA!FW0-9EL%siOrkPmpZ8ZAdo@MrXA8d1c72EmrihnnWY5iXNy_bbV7b)-tB55?4P zz;V@IYrjmyE>Wn*q;RXB%!FlSo}1}{G?&vi7_eQUixh4mRYq<(9e3ycc(4v4#1*I& z3w^uiyZ;En?`Xiz$)hUuzY%z(vCn{=dOY_1f>gkpS>m?kq?32g)PT0jk1YC+J+y;M zOC6Kd7HAZw)L&zGSR}}zN?9h*OiMNdZ5tGj0{>CyKPJA%+P&)99=yBTnfLO7clitI z=nb^ucCckdp|VIp+TuQTk^Y0~pOJ=iIK7V;P^&L#`OG90TWxIzqxYH{gG$0a>BiI; zG1`~UGDA0Q?mH6EB+Zf$n#~BHj|nTWAHC-9_(+2lUX!~2p+@Fu%UomBJFNwaVdZC5 z^VXl%I^&2y`(X%t1{clf9yF-Vz80sb6rM66?&4Hyn2Gi9;xjXi8EK{sd+lGTmihDh zP*1)h`N#HRw7XSbZFYr3Xc{!&FllB-bEL{-!wBkbaHgg4S*}J^OoCa!Z<(aLD=xd{ zE^3yW>^mEhGaH*z$2F4N>#WuI|5#oS&nq1seTEty;H~fXDQBbj0AS*Ic_vEoQsK5}MLO z2t7o)WdP|Sz4w+vXi4Z%5s+R&5=ekZFCic;bojXITkrec{7im5S?la)pS{mH+ozly z+Gede4g%}Zp)iXTW;%J$Qa$p1m)cbE^Ii2|DA?!h8T&+l1`nzbXjZ#M!| zk3S}4U&?#7g6xN(Nn`z?+zKd+O1iyM=~7P4@cVei4*ik%Y6uucLenk#LGpFG7JHnC zfNo5WdZ-TJNGw+~w^S=Ce3*o;61&OWOC@O0Gj-XJwv`KL$>-SIWIg?3bKC@r(?Yxn zynL;~CG;3~q5;9Og75OG?u5o@oNg8%@XH0a!=xZ@ZC+lPEVuf$+4EC{r=fDs$fDPYro{N#JsSrXaA7U->yxg* zdvotWwnEeo2l>cNKlzHUpZXa;g*wI$E;4d7A!-51tfM(m9}oD+w)FAaszUDOl%J{_ z{kMe#YAyw-Necwe8B}C7na^wHS3&JVkvTJV2Nbn=r{jv=ssv*`O`w@NeBk86)2AnU zX*t8!gVD_VE@>lM+py)*rU&aK0~w9pv$A}HN);$>%2Jk|)k@2kv`DByBdf}GGSOP1^zrWn2;y@lO%6VeyTj!dzEP{c-P=vRL*AN==yt8jor-i z)ZfeDut(v4fm*9p6g|tx6ggbzLN$mK=i^fKD(gJPevn~6zE_&t3_^1Q(oDK9_`fIT z|DQtpPupheSU)E_sTQb@Pe0ht#P+(2fA6RF>nDp#ZEnSsL5XC+g=uwBrAIpO36izC zXPX^#>+oT1tAp2C;Z$fd(lE^axJ8%7q6(OiGJx+E2`7!r?NtrsHmzQ}Fzc5Znm6W| zdkLur;onwS9Z)9ha{!fnr^kOuD5t;P--#g=$VY(iEur9QTM^1 zJNgw~IL5@kQFg9$WozF0?8j9~PvVylyQnglsYg-Cf2I?S>~5>7&^T^E-`M z8>{(pUw8aBU7pCjiE4?RENsa=c@sr$(|9^-XN3kx$+iV_?a)gG(YVS4hbRrSg`MK! zsrUhH$Z|IAnKfZ-T5HLJ5D@ak1#6fvcwDy7_FH7f-SfD6p}~9|)^KWcN=mo4gqr1A zPVV-Jv*tHb3CnE*uhtFn*S*7B50fc9%Oq8LdAX}q@6N>C1GB-~Wc$?w%((sAa0=yY zUGRVy_hG$5d~l-NvMZf(jj8m@tSkK=qb|a+O|Od@+V%FqX7RtXdXp=6e*3L$S>)ZV zwB|iL+5?5Atw!yhz35XH^|rEa1% z%#VhIHO}IeR}&Au6@FjcuNT-Zp8fdIz4GN@HVl%;AHx`Wj^&NLoTphOFv2VT^t3`N za{$70-@yPqY_9J#VC#xjRP#@cJr>@i8t1g$YyiLnPc?&g&!+=JPft%pKYaL<{#Q{! z(I+;s4DQayeGlu(dY2r@X*BozaaU4WzES=G?#N?jvRvbkOa&2)Ld`?dXujFQ zWKNw-U6M|pT;Mc$Zv5xp=gvJn%Js8d{J{8dWiCG`Gcj1PX#mzT06Vc+Y#C(aY^h-U zK6+-}n0X5kE_I%7oS1m0KmXm+wd`gp2Pn6U#t*MQ$A9X=Basw4YY%Skk`%1(Xu_H$ z(*O24{@6VRcV4J{1=F!jiV^3{4Qs!ZGSqqN(jQSGqCO2f>+(@4*1wki#V=9Ac5CNu zRTN&XlT+^jNyYCdLoBwM*Q)?rg5>rNAZq5O_<#5wzalz(;GN{(`?mvp@YZz#h&Ufi z2yiuR8s{7f`#gSZp}MIVHJK=@S!0N#8&O!3LMyUi)nYOlWRYyb$bfBg zYG}a=&en@yH*d2MGcD(&T6kC`Mh53j8?dFe2IG&Vg6VJg&?vJ4Xu%(oekBv5xnme; zerTZ-4r*2=eeJM1u=6eVf!Nz81wlL28e<0S-Ny$jM3?q?e)7gjUTs8HA_A{5cCO

+ + Video Thumbnail + +

+ +

Demo: OpenTelemetry in Ingress NGINX.

+ ## Usage To enable the instrumentation we must enable OpenTelemetry in the configuration ConfigMap: @@ -258,3 +270,45 @@ To install the example and collectors run: ``` In the Zipkin interface we can see the details: ![zipkin screenshot](../../images/otel-zipkin-demo.png "zipkin screenshot") + +## Migration from OpenTracing, Jaeger, Zipkin and Datadog + +If you are migrating from OpenTracing, Jaeger, Zipkin, or Datadog to OpenTelemetry, +you may need to update various annotations and configurations. Here are the mappings +for common annotations and configurations: + +### Annotations + +| Legacy | OpenTelemetry | +|--------------------------------------------------|--------------------------------------------------| +| `nginx.ingress.kubernetes.io/enable-opentracing` | `nginx.ingress.kubernetes.io/enable-opentelemetry` | +| `opentracing-trust-incoming-span` | `opentracing-trust-incoming-span` | + +### Configs + +| Legacy | OpenTelemetry | +|---------------------------------------|----------------------------------------------| +| `opentracing-operation-name` | `opentelemetry-operation-name` | +| `opentracing-location-operation-name` | `opentelemetry-operation-name` | +| `opentracing-trust-incoming-span` | `opentelemetry-trust-incoming-span` | +| `zipkin-collector-port` | `otlp-collector-port` | +| `zipkin-service-name` | `otel-service-name` | +| `zipkin-sample-rate` | `otel-sampler-ratio` | +| `jaeger-collector-port` | `otlp-collector-port` | +| `jaeger-endpoint` | `otlp-collector-port`, `otlp-collector-host` | +| `jaeger-service-name` | `otel-service-name` | +| `jaeger-propagation-format` | `N/A` | +| `jaeger-sampler-type` | `otel-sampler` | +| `jaeger-sampler-param` | `otel-sampler` | +| `jaeger-sampler-host` | `N/A` | +| `jaeger-sampler-port` | `N/A` | +| `jaeger-trace-context-header-name` | `N/A` | +| `jaeger-debug-header` | `N/A` | +| `jaeger-baggage-header` | `N/A` | +| `jaeger-tracer-baggage-header-prefix` | `N/A` | +| `datadog-collector-port` | `otlp-collector-port` | +| `datadog-service-name` | `otel-service-name` | +| `datadog-environment` | `N/A` | +| `datadog-operation-name-override` | `N/A` | +| `datadog-priority-sampling` | `otel-sampler` | +| `datadog-sample-rate` | `otel-sampler-ratio` | From bcfed2e912e1eb81013fc886062607ef900d22ed Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 May 2023 21:27:44 -0700 Subject: [PATCH 206/822] Bump github.com/imdario/mergo from 0.3.15 to 0.3.16 (#10008) Bumps [github.com/imdario/mergo](https://github.com/imdario/mergo) from 0.3.15 to 0.3.16. - [Release notes](https://github.com/imdario/mergo/releases) - [Commits](https://github.com/imdario/mergo/compare/v0.3.15...v0.3.16) --- updated-dependencies: - dependency-name: github.com/imdario/mergo dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 721a3c16b..99849f00b 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a github.com/eapache/channels v1.1.0 github.com/fsnotify/fsnotify v1.6.0 - github.com/imdario/mergo v0.3.15 + github.com/imdario/mergo v0.3.16 github.com/json-iterator/go v1.1.12 github.com/kylelemons/godebug v1.1.0 github.com/mitchellh/go-ps v1.0.0 diff --git a/go.sum b/go.sum index 003ad5fb8..dda3e809f 100644 --- a/go.sum +++ b/go.sum @@ -200,8 +200,8 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM= -github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= +github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= +github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= From 3476232f5c38383dd157ddaff3b4c7cebd57284e Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 30 May 2023 14:39:50 -0400 Subject: [PATCH 207/822] release controller 1.8.0 and chart 4.7.0 (#10017) Signed-off-by: James Strong --- README.md | 75 ++-- changelog/Changelog-1.8.0.md | 67 +++ charts/ingress-nginx/Chart.yaml | 10 +- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.7.0.md | 14 + charts/ingress-nginx/values.yaml | 6 +- deploy/static/provider/aws/deploy.yaml | 48 +- .../aws/nlb-with-tls-termination/deploy.yaml | 48 +- deploy/static/provider/baremetal/deploy.yaml | 48 +- deploy/static/provider/cloud/deploy.yaml | 48 +- deploy/static/provider/do/deploy.yaml | 48 +- deploy/static/provider/exoscale/deploy.yaml | 48 +- deploy/static/provider/kind/deploy.yaml | 48 +- deploy/static/provider/scw/deploy.yaml | 48 +- docs/deploy/index.md | 20 +- docs/e2e-tests.md | 409 +++++++++--------- magefiles/release.go | 8 +- 17 files changed, 546 insertions(+), 455 deletions(-) create mode 100644 changelog/Changelog-1.8.0.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.7.0.md diff --git a/README.md b/README.md index 86f95cb9b..dc7ff3c38 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ ## Overview -ingress-nginx is an Ingress controller for Kubernetes using [NGINX](https://www.nginx.org/) as a reverse proxy and load +ingress-nginx is an Ingress controller for Kubernetes using [NGINX](https://www.nginx.org/) as a reverse proxy and load balancer. [Learn more about Ingress on the main Kubernetes documentation site](https://kubernetes.io/docs/concepts/services-networking/ingress/). @@ -20,67 +20,72 @@ See the [Getting Started](https://kubernetes.github.io/ingress-nginx/deploy/) do ## Troubleshooting -If you encounter issues, review the [troubleshooting docs](docs/troubleshooting.md), -[file an issue](https://github.com/kubernetes/ingress-nginx/issues), or talk to us on the +If you encounter issues, review the [troubleshooting docs](docs/troubleshooting.md), +[file an issue](https://github.com/kubernetes/ingress-nginx/issues), or talk to us on the [#ingress-nginx channel](https://kubernetes.slack.com/messages/ingress-nginx) on the Kubernetes Slack server. ## Changelog See [the list of releases](https://github.com/kubernetes/ingress-nginx/releases) to find out about feature changes. For detailed changes for each release; please check the [Changelog.md](Changelog.md) file. -For detailed changes on the `ingress-nginx` helm chart, please check the following +For detailed changes on the `ingress-nginx` helm chart, please check the following [CHANGELOG.md](charts/ingress-nginx/CHANGELOG.md) file. -### Supported Versions table +### Supported Versions table Supported versions for the ingress-nginx project mean that we have completed E2E tests, and they are passing for the versions listed. Ingress-Nginx versions may work on older versions but the project does not make that guarantee. -| | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | -|:-----:|------------------------|------------------------------|----------------|---------------|--------------------| -| 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | -| 🔄 | **v1.7.0** | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | -| 🔄 | **v1.6.4** | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | 4.5.* | -| 🔄| **v1.5.1** | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | 4.4.* | -| | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | 4.3.0 | -| | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | 4.2.5 | -| | v1.3.0 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.0 | 1.19.10† | 4.2.3 | -| | v1.2.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.6 | 1.19.10† | 4.1.4 | -| | v1.1.3 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.4 | 1.19.10† | 4.0.19 | -| | v1.1.2 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.18 | -| | v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.17 | -| | v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.13 | -| | v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.9 | -| | v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.6 | -| | v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.5 | -| | v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.3 | -| | v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.2 | -| | v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 | 4.0.1 | +| | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | +|:--:|-----------------------|------------------------------|----------------|---------------|--------------------| +| 🔄 | **v1.8.0** | 1.27,1.26, 1.25, 1.24 | 3.18.0 | 1.21.6 | 4.7.* | +| 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | +| 🔄 | **v1.7.0** | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | +| 🔄 | **v1.6.4** | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | 4.5.* | +| | v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | 4.4.* | +| | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | 4.3.0 | +| | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | 4.2.5 | +| | v1.3.0 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.0 | 1.19.10† | 4.2.3 | +| | v1.2.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.6 | 1.19.10† | 4.1.4 | +| | v1.1.3 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.4 | 1.19.10† | 4.0.19 | +| | v1.1.2 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.18 | +| | v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.17 | +| | v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.13 | +| | v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.9 | +| | v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.6 | +| | v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.5 | +| | v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.3 | +| | v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.2 | +| | v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 | 4.0.1 | -† _This build is +† _This build is [patched against CVE-2021-23017](https://github.com/openresty/openresty/commit/4b5ec7edd78616f544abc194308e0cf4b788725b#diff-42ef841dc27fe0b5aa2d06bd31308bb63a59cdcddcbcddd917248349d22020a3)._ -See [this article](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) if you want upgrade to the stable -Ingress API. +See [this article](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) if you want upgrade to the stable +Ingress API. ## Get Involved Thanks for taking the time to join our community and start contributing! -- This project adheres to the [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md). +- This project adheres to the [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md). By participating in this project, you agree to abide by its terms. - **Contributing**: Contributions of all kind are welcome! - - - Read [`CONTRIBUTING.md`](CONTRIBUTING.md) for information about setting up your environment, the workflow that we + + - Read [`CONTRIBUTING.md`](CONTRIBUTING.md) for information about setting up your environment, the workflow that we expect, and instructions on the developer certificate of origin that we require. - Join our Kubernetes Slack channel for developer discussion : [#ingress-nginx-dev](https://kubernetes.slack.com/archives/C021E147ZA4). - - Submit GitHub issues for any feature enhancements, bugs or documentation problems. Please make sure to read the [Issue Reporting Checklist](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md#issue-reporting-guidelines) before opening an issue. Issues not conforming to the guidelines **may be closed immediately**. - - **Support**: Join the [#ingress-nginx-users](https://kubernetes.slack.com/messages/CANQGM8BA/) channel inside the [Kubernetes Slack](http://slack.kubernetes.io/) to ask questions or get support from the maintainers and other users. + - Submit GitHub issues for any feature enhancements, bugs or documentation problems. + - Please make sure to read the [Issue Reporting Checklist](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md#issue-reporting-guidelines) before opening an issue. Issues not conforming to the guidelines **may be closed immediately**. + - Join our [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernetes.io/g/ingress-nginx-dev/c/ebbBMo-zX-w) + +- **Support**: + - Join the [#ingress-nginx-users](https://kubernetes.slack.com/messages/CANQGM8BA/) channel inside the [Kubernetes Slack](http://slack.kubernetes.io/) to ask questions or get support from the maintainers and other users. - The [GitHub issues](https://github.com/kubernetes/ingress-nginx/issues) in the repository are **exclusively** for bug reports and feature requests. - - **Discuss**: Tweet using the `#IngressNginx` hashtag. + - **Discuss**: Tweet using the `#IngressNginx` hashtag or sharing with us [@IngressNginx](https://twitter.com/IngressNGINX). ## License -[Apache License 2.0](https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE) +[Apache License 2.0](https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE) \ No newline at end of file diff --git a/changelog/Changelog-1.8.0.md b/changelog/Changelog-1.8.0.md new file mode 100644 index 000000000..a109c68ba --- /dev/null +++ b/changelog/Changelog-1.8.0.md @@ -0,0 +1,67 @@ +# Changelog + +### 1.8.0 +Images: + +* registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 +* registry.k8s.io/ingress-nginx/controller-chroot:v1.8.0@sha256:a45e41cd2b7670adf829759878f512d4208d0aec1869dae593a0fecd09a5e49e + +### Important Changes: + +* Validate path types (#9967) +* images: upgrade to Alpine 3.18 (#9997) +* Update documentation to reflect project name; Ingress-Nginx Controller + +For improving security on our 1.8.0 release includes a +[new, **optional** validation ](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) +that limits the characters accepted on ".spec paths.path" when pathType=Exact or pathType=Prefix, +to alphanumeric characters only. More information can be found on our +[Google doc](https://docs.google.com/document/d/1HPvaEwHRuMSkXYkVIJ-w7IpijKdHfNynm_4N2Akt0CQ/edit?usp=sharing) +, our new [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernetes.io/g/ingress-nginx-dev/c/ebbBMo-zX-w) +or in our [docs](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) + +### Community Updates + +We are now posting updates and release to our twitter handle, [@IngressNginx](https://twitter.com/IngressNGINX) and +on our new [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernetes.io/g/ingress-nginx-dev/c/ebbBMo-zX-w) + +### All Changes: + +* Add legacy to OpenTelemetry migration doc (#10011) +* changed tagsha to recent builds (#10001) +* change to alpine318 baseimage (#10000) +* images: upgrade to Alpine 3.18 (#9997) +* openssl CVE fix (#9996) +* PodDisruptionBudget spec logic update (#9904) +* Admission warning (#9975) +* Add OPA examples on pathType restrictions (#9992) +* updated testrunner image tag+sha (#9987) +* bumped ginkgo to v2.9.5 (#9985) +* helm: Fix opentelemetry module installation for daemonset (#9792) +* OpenTelemetry default config (#9978) +* Correct annotations in monitoring docs (#9976) +* fix: avoid builds and tests for changes to markdown (#9962) +* Validate path types (#9967) +* HPA: Use capabilites & align manifests. (#9521) +* Use dl.k8s.io instead of hardcoded GCS URIs (#9946) +* add option for annotations in PodDisruptionBudget (#9843) +* chore: update httpbin to httpbun (#9919) +* image_update (#9942) +* Add geoname id value into $geoip2_*_geoname_id variables (#9527) +* Update annotations.md (#9933) +* Update charts/* to keep project name display aligned (#9931) +* Keep project name display aligned (#9920) + +### Dependencies updates: +* Bump github.com/imdario/mergo from 0.3.15 to 0.3.16 (#10008) +* Bump github.com/prometheus/common from 0.43.0 to 0.44.0 (#10007) +* Bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 (#9913) +* Bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 (#9980) +* Bump golang.org/x/crypto from 0.8.0 to 0.9.0 (#9982) +* Bump actions/setup-go from 4.0.0 to 4.0.1 (#9984) +* Bump securego/gosec from 2.15.0 to 2.16.0 (#9983) +* Bump github.com/prometheus/common from 0.42.0 to 0.43.0 (#9981) +* Bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 (#9937) +* Bump google.golang.org/grpc from 1.54.0 to 1.55.0 (#9936) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.7.1...controller-controller-v1.8.0 \ No newline at end of file diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 81ebfc875..9786f705c 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,11 +1,11 @@ annotations: artifacthub.io/changes: | - - "[helm] Support custom port configuration for internal service (#9846)" - - "Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803)" - - "Update Ingress-Nginx version controller-v1.7.1" + - "helm: Fix opentelemetry module installation for daemonset (#9792)" + - "Update charts/* to keep project name display aligned (#9931)" + - "Update Ingress-Nginx version controller-v1.8.0" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.7.1 +appVersion: 1.8.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -22,4 +22,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.6.1 +version: 4.7.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 391eb4159..4a00815fd 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.6.1](https://img.shields.io/badge/Version-4.6.1-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) +![Version: 4.7.0](https://img.shields.io/badge/Version-4.7.0-informational?style=flat-square) ![AppVersion: 1.8.0](https://img.shields.io/badge/AppVersion-1.8.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -309,13 +309,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407"` | | -| controller.image.digestChroot | string | `"sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988"` | | +| controller.image.digest | string | `"sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3"` | | +| controller.image.digestChroot | string | `"sha256:a45e41cd2b7670adf829759878f512d4208d0aec1869dae593a0fecd09a5e49e"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.7.1"` | | +| controller.image.tag | string | `"v1.8.0"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.7.0.md b/charts/ingress-nginx/changelog/Changelog-4.7.0.md new file mode 100644 index 000000000..7399da777 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.7.0.md @@ -0,0 +1,14 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.0 + +* helm: Fix opentelemetry module installation for daemonset (#9792) +* Update charts/* to keep project name display aligned (#9931) +* HPA: Use capabilites & align manifests. (#9521) +* PodDisruptionBudget spec logic update (#9904) +* add option for annotations in PodDisruptionBudget (#9843) +* Update Ingress-Nginx version controller-v1.8.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.1...helm-chart-4.7.0 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 962567e07..7ca41e79e 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -23,9 +23,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.7.1" - digest: sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 - digestChroot: sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988 + tag: "v1.8.0" + digest: sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + digestChroot: sha256:a45e41cd2b7670adf829759878f512d4208d0aec1869dae593a0fecd09a5e49e pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 41006c016..48f7f11b1 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -539,7 +539,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -588,7 +588,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 4e4f9ca9b..b4e2cd5f6 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -427,7 +427,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -451,7 +451,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -526,7 +526,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -537,7 +537,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -551,7 +551,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -573,7 +573,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -584,7 +584,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -600,7 +600,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -635,7 +635,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 3f015f001..74292b82b 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -413,7 +413,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -436,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -508,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -519,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -533,7 +533,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -555,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -566,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -582,7 +582,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -604,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -617,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index a914aca5e..6dac63865 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -414,7 +414,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -438,7 +438,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -510,7 +510,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -521,7 +521,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -535,7 +535,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -557,7 +557,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -568,7 +568,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -584,7 +584,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -606,7 +606,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 676ae1229..0e3f4b46f 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -538,7 +538,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -587,7 +587,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index e9d3522f0..a1bd4ed00 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -519,7 +519,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -530,7 +530,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -544,7 +544,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -566,7 +566,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -577,7 +577,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -593,7 +593,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -615,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -628,7 +628,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index 6a327b97f..41d17d8d1 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -549,7 +549,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -598,7 +598,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 389e2a920..e303a52f5 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -538,7 +538,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -587,7 +587,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/deploy/index.md b/docs/deploy/index.md index e33ee5dbe..655c6fae9 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the Ingress-Nginx Control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml ``` A @@ -357,7 +357,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 9b3c5f2ff..025ff686d 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -7,19 +7,38 @@ Do not try to edit it manually. -### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L35) +### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L37) -- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L43) -- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L70) -- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L87) -- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L108) -- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L125) -- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L136) -- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L150) -- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L164) -- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L180) -- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L196) -- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L207) +- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L45) +- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L72) +- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L89) +- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L110) +- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L127) +- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L138) +- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L152) +- [should return an error if there is an invalid path and wrong pathType is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L166) +- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L201) +- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L217) +- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L233) +- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L244) + +### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) + +- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) +- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) +- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) +- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) +- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) +- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) +- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) +- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) +- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) +- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) +- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) +- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) +- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) +- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) +- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) ### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L31) @@ -36,6 +55,42 @@ Do not try to edit it manually. - [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L40) + +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L47) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L66) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L90) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L117) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L145) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L173) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L200) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L228) +- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L267) +- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L285) +- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L302) +- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L323) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L412) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L423) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L434) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L486) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L495) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L506) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L530) +- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L553) +- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L571) +- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L591) +- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L610) +- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L624) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L679) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L688) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L699) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L773) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L793) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L821) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L850) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L880) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L888) + ### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L29) - [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L36) @@ -56,6 +111,34 @@ Do not try to edit it manually. - [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) - [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) + +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) + ### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) - [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L35) @@ -109,6 +192,13 @@ Do not try to edit it manually. - [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) - [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) + +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) + ### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) - [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) @@ -133,6 +223,11 @@ Do not try to edit it manually. - [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) + +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) + ### [whitelist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L27) - [should set valid ip whitelist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L34) @@ -203,6 +298,14 @@ Do not try to edit it manually. - [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L33) - [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L61) +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) + +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) + ### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L35) - [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L42) @@ -247,108 +350,6 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) - -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) - -### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) - -- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) -- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) -- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) -- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) -- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) -- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) -- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) -- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) -- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) -- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) -- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) -- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) -- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) -- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) -- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) - -### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) - -- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) -- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) -- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) -- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) -- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) - -### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) - -- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) -- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) -- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) -- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) - -### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) - -- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) -- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) -- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) -- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) -- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) -- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) -- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) -- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) -- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) -- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) -- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) -- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) -- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L485) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L494) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L505) -- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L529) -- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L552) -- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L570) -- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L590) -- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L609) -- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L623) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L678) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L687) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L698) -- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L772) -- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) -- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L820) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L849) -- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) -- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) - -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) - -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) -- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) - ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) - [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) @@ -373,6 +374,10 @@ Do not try to edit it manually. - [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) @@ -385,10 +390,30 @@ Do not try to edit it manually. - [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L43) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) @@ -413,6 +438,10 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) @@ -425,14 +454,18 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) @@ -445,34 +478,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) -### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) @@ -546,6 +551,11 @@ Do not try to edit it manually. - [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L125) - [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L171) +### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) + +- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) +- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) + ### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) - [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) @@ -561,15 +571,15 @@ Do not try to edit it manually. - [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) - [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L54) -### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L59) +### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L37) -- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L62) -- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L95) -- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L129) -- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L153) -- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L184) -- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L217) -- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L248) +- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L40) +- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L72) +- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L110) +- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L138) +- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L169) +- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L206) +- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L241) - [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L311) ### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) @@ -595,6 +605,10 @@ Do not try to edit it manually. - [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L39) +### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) + +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) + ### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) - [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) @@ -616,6 +630,12 @@ Do not try to edit it manually. - [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L52) +### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) + +- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) +- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L53) +- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L80) + ### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) - [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) @@ -661,6 +681,15 @@ Do not try to edit it manually. - [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) +### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) + +- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) +- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) +- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) +- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) +- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) +- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) + ### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) - [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L40) @@ -734,6 +763,16 @@ Do not try to edit it manually. - [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L39) - [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L49) +### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) + +- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) + +### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) + +- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) +- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) +- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) + ### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L28) - [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) @@ -742,6 +781,14 @@ Do not try to edit it manually. - [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) +### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L37) + +- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L47) +- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L60) +- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L74) +- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L89) +- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L104) + ### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L48) - [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L58) @@ -821,6 +868,11 @@ Do not try to edit it manually. - [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) +### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) + +- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) +- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) + ### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) - [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) @@ -835,48 +887,6 @@ Do not try to edit it manually. - [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L187) - [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L205) -### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) - -- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) -- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L53) -- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L80) - -### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) - -- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) -- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) -- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) -- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) -- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) -- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) - -### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) - -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) - -### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) - -- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) - -### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) - -- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) -- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) - -### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) - -- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) -- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) -- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) - -### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L37) - -- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L47) -- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L60) -- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L74) -- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L89) -- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L104) - ### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) - [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) @@ -894,13 +904,4 @@ Do not try to edit it manually. - [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) - [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) - -- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) -- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) \ No newline at end of file +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file diff --git a/magefiles/release.go b/magefiles/release.go index c02b88cfd..6e5efb490 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -136,12 +136,16 @@ func (Release) NewRelease(version string) { //controller tag updateChartValue("controller.image.tag", fmt.Sprintf("v%s", releaseNotes.Version)) + Debug("releaseNotes.ControllerImages[0].Name %s", releaseNotes.ControllerImages[0].Name) + Debug("releaseNotes.ControllerImages[1].Name %s", releaseNotes.ControllerImages[1].Name) //controller digest - if releaseNotes.ControllerImages[0].Name == "controller" { + if releaseNotes.ControllerImages[0].Name == "ingress-nginx/controller" { + Debug("Updating Chart Value %s with %s", "controller.image.digest", releaseNotes.ControllerImages[0].Digest) updateChartValue("controller.image.digest", releaseNotes.ControllerImages[0].Digest) } //controller chroot digest - if releaseNotes.ControllerImages[1].Name == "controller-chroot" { + if releaseNotes.ControllerImages[1].Name == "ingress-nginx/controller-chroot" { + Debug("Updating Chart Value %s with %s", "controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) updateChartValue("controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) } From 057c1b26fb1e9f7bcd073ab8c5e6f3eb346a9885 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Wed, 31 May 2023 02:03:46 +0530 Subject: [PATCH 208/822] added helmshowvalues example (#10019) --- docs/deploy/index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/deploy/index.md b/docs/deploy/index.md index 655c6fae9..dcdfeb7c0 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -59,6 +59,12 @@ It will install the controller in the `ingress-nginx` namespace, creating that n - if the ingress controller is not installed, it will install it, - if the ingress controller is already installed, it will upgrade it. +**If you want a full list of values that you can set, while installing with Helm,** then run: + +```console +helm show values ingress-nginx --repo https://kubernetes.github.io/ingress-nginx +``` + **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console From fddf4e034c0d766a4815247b414cbd71a1869456 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Wed, 31 May 2023 23:17:50 -0500 Subject: [PATCH 209/822] fix formatting --- pkg/util/runtime/cpu_notlinux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 0441af957..2a1b48252 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -26,4 +26,4 @@ import ( // NumCPU ... func NumCPU() int { return runtime.NumCPU() -} \ No newline at end of file +} From 19de8af3508c50c19eccc647eb9f259ac9008a74 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Thu, 1 Jun 2023 13:11:46 +0530 Subject: [PATCH 210/822] added note on dns for localtesting (#10021) --- docs/deploy/index.md | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/docs/deploy/index.md b/docs/deploy/index.md index dcdfeb7c0..76a28b6ad 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -76,10 +76,9 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont resources as if you had used Helm to install the controller. !!! attention - If you are running an old version of Kubernetes (1.18 or earlier), please read - [this paragraph](#running-on-Kubernetes-versions-older-than-1.19) for specific instructions. - Because of api deprecations, the default manifest may not work on your cluster. - Specific manifests for supported Kubernetes versions are available within a sub-folder of each provider. + If you are running an old version of Kubernetes (1.18 or earlier), please read [this paragraph](#running-on-Kubernetes-versions-older-than-1.19) for specific instructions. + Because of api deprecations, the default manifest may not work on your cluster. + Specific manifests for supported Kubernetes versions are available within a sub-folder of each provider. ### Pre-flight check @@ -99,6 +98,7 @@ kubectl wait --namespace ingress-nginx \ --timeout=120s ``` + ### Local testing Let's create a simple web server and the associated service: @@ -121,7 +121,19 @@ Now, forward a local port to the ingress controller: kubectl port-forward --namespace=ingress-nginx service/ingress-nginx-controller 8080:80 ``` -At this point, if you access http://demo.localdev.me:8080/, you should see an HTML page telling you "It works!". +!!! info + A note on DNS & network-connection. + This documentation assumes that a user has awareness of the DNS and the network routing aspects involved in using ingress. + The port-forwarding mentioned above, is the easiest way to demo the working of ingress. The "kubectl port-forward..." command above has forwarded the port number 8080, on the localhost's tcp/ip stack, where the command was typed, to the port number 80, of the service created by the installation of ingress-nginx controller. So now, the traffic sent to port number 8080 on localhost will reach the port number 80, of the ingress-controller's service. + Port-forwarding is not for a production environment use-case. But here we use port-forwarding, to simulate a HTTP request, originating from outside the cluster, to reach the service of the ingress-nginx controller, that is exposed to receive traffic from outside the cluster. + [This issue](https://github.com/kubernetes/ingress-nginx/issues/10014#issuecomment-1567791549described) shows a typical DNS problem and its solution. + +At this point, you can access your deployment using curl ; +```console +curl --resolve demo.localdev.me:8080:127.0.0.1 http://demo.localdev.me:8080 +``` + +You should see a HTML response containing text like **"It works!"**. ### Online testing From d02ba28b9609c106ea4de8e0f3dbf5abc3d06fdc Mon Sep 17 00:00:00 2001 From: Eng Zer Jun Date: Thu, 1 Jun 2023 22:29:47 +0800 Subject: [PATCH 211/822] perf: avoid unnecessary byte/string conversion (#10012) We can use alternative functions to avoid unnecessary byte/string conversion calls and reduce allocations. Signed-off-by: Eng Zer Jun --- internal/ingress/annotations/auth/main.go | 2 +- internal/ingress/annotations/authreq/main.go | 6 +++--- internal/net/ssl/ssl.go | 6 +++--- test/e2e/settings/ocsp/ocsp.go | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/internal/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go index 58486c6e8..62d70873e 100644 --- a/internal/ingress/annotations/auth/main.go +++ b/internal/ingress/annotations/auth/main.go @@ -197,7 +197,7 @@ func dumpSecretAuthMap(filename string, secret *api.Secret) error { for user, pass := range secret.Data { builder.WriteString(user) builder.WriteString(":") - builder.WriteString(string(pass)) + builder.Write(pass) builder.WriteString("\n") } diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go index 6a8a4611a..2ab389146 100644 --- a/internal/ingress/annotations/authreq/main.go +++ b/internal/ingress/annotations/authreq/main.go @@ -143,7 +143,7 @@ func ValidMethod(method string) bool { // ValidHeader checks is the provided string satisfies the header's name regex func ValidHeader(header string) bool { - return headerRegexp.Match([]byte(header)) + return headerRegexp.MatchString(header) } // ValidCacheDuration checks if the provided string is a valid cache duration @@ -159,13 +159,13 @@ func ValidCacheDuration(duration string) bool { if len(element) == 0 { continue } - if statusCodeRegex.Match([]byte(element)) { + if statusCodeRegex.MatchString(element) { if seenDuration { return false // code after duration } continue } - if durationRegex.Match([]byte(element)) { + if durationRegex.MatchString(element) { seenDuration = true } } diff --git a/internal/net/ssl/ssl.go b/internal/net/ssl/ssl.go index 05ec10bc5..fdee2f46e 100644 --- a/internal/net/ssl/ssl.go +++ b/internal/net/ssl/ssl.go @@ -81,7 +81,7 @@ func CreateSSLCert(cert, key []byte, uid string) (*ingress.SSLCert, error) { } } - pemCertBuffer.Write([]byte("\n")) + pemCertBuffer.WriteString("\n") pemCertBuffer.Write(key) pemBlock, _ := pem.Decode(pemCertBuffer.Bytes()) @@ -195,12 +195,12 @@ func StoreSSLCertOnDisk(name string, sslCert *ingress.SSLCert) (string, error) { func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLCert) error { var buffer bytes.Buffer - _, err := buffer.Write([]byte(sslCert.PemCertKey)) + _, err := buffer.WriteString(sslCert.PemCertKey) if err != nil { return fmt.Errorf("could not append newline to cert file %v: %v", sslCert.CAFileName, err) } - _, err = buffer.Write([]byte("\n")) + _, err = buffer.WriteString("\n") if err != nil { return fmt.Errorf("could not append newline to cert file %v: %v", sslCert.CAFileName, err) } diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index ea444444b..0173f41ac 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -68,7 +68,7 @@ var _ = framework.DescribeSetting("OCSP", func() { var pemCertBuffer bytes.Buffer pemCertBuffer.Write(leafCert) - pemCertBuffer.Write([]byte("\n")) + pemCertBuffer.WriteString("\n") pemCertBuffer.Write(intermediateCa) f.EnsureSecret(&corev1.Secret{ From 9e125c597e17781b7df12b03987f98360ad6e20c Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 1 Jun 2023 13:33:20 -0400 Subject: [PATCH 212/822] adding a tag here so we force nginx builds to cloudbuild Signed-off-by: James Strong --- images/nginx/TAG | 1 + 1 file changed, 1 insertion(+) create mode 100644 images/nginx/TAG diff --git a/images/nginx/TAG b/images/nginx/TAG new file mode 100644 index 000000000..77d6f4ca2 --- /dev/null +++ b/images/nginx/TAG @@ -0,0 +1 @@ +0.0.0 From 8a61027f1a65bfd588ac85c960ab00db164d7a59 Mon Sep 17 00:00:00 2001 From: Stilian Stoilov Date: Fri, 2 Jun 2023 04:07:46 +0300 Subject: [PATCH 213/822] Upgrade to Golang 1.20.4 (#10016) * Upgrade to Golang 1.20.4 and alpine 3.18.0 * Handle Review comments --- images/custom-error-pages/rootfs/Dockerfile | 2 +- images/ext-auth-example-authsvc/rootfs/Dockerfile | 2 +- images/fastcgi-helloserver/rootfs/Dockerfile | 2 +- images/go-grpc-greeter-server/rootfs/Dockerfile | 2 +- images/test-runner/Makefile | 4 ++-- images/test-runner/rootfs/Dockerfile | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index b34bb6977..30ac54693 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.1-alpine3.17 as builder +FROM golang:1.20.4-alpine3.18 as builder RUN apk update \ && apk upgrade && apk add git diff --git a/images/ext-auth-example-authsvc/rootfs/Dockerfile b/images/ext-auth-example-authsvc/rootfs/Dockerfile index c604651d4..96dcd9a39 100644 --- a/images/ext-auth-example-authsvc/rootfs/Dockerfile +++ b/images/ext-auth-example-authsvc/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.1-alpine3.17 as builder +FROM golang:1.20.4-alpine3.18 as builder RUN mkdir /authsvc WORKDIR /authsvc COPY . ./ diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile index 7d9220ddf..a11834373 100755 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.1-alpine3.17 as builder +FROM golang:1.20.4-alpine3.18 as builder WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi diff --git a/images/go-grpc-greeter-server/rootfs/Dockerfile b/images/go-grpc-greeter-server/rootfs/Dockerfile index 67aed038e..d457b43e5 100644 --- a/images/go-grpc-greeter-server/rootfs/Dockerfile +++ b/images/go-grpc-greeter-server/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.1-alpine3.17 as build +FROM golang:1.20.4-alpine3.18 as build WORKDIR /go/src/greeter-server diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index a004ad932..1d1f4f638 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -43,7 +43,7 @@ image: --pull \ --push \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.1 \ + --build-arg GOLANG_VERSION=1.20.4 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -64,7 +64,7 @@ build: ensure-buildx --progress=${PROGRESS} \ --pull \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.1 \ + --build-arg GOLANG_VERSION=1.20.4 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ diff --git a/images/test-runner/rootfs/Dockerfile b/images/test-runner/rootfs/Dockerfile index 8574f8752..40017f775 100644 --- a/images/test-runner/rootfs/Dockerfile +++ b/images/test-runner/rootfs/Dockerfile @@ -15,7 +15,7 @@ ARG BASE_IMAGE ARG GOLANG_VERSION ARG ETCD_VERSION -FROM golang:${GOLANG_VERSION}-alpine3.17 as GO +FROM golang:${GOLANG_VERSION}-alpine3.18 as GO FROM registry.k8s.io/etcd:${ETCD_VERSION} as etcd FROM ${BASE_IMAGE} From e97e9285428bf78b3ddc334c1f670636fd7c2427 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Fri, 2 Jun 2023 15:36:53 +0800 Subject: [PATCH 214/822] chore(dep): upgrade github.com/emicklei/go-restful/v3 to 3.10 (#10028) Signed-off-by: Jintao Zhang --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 99849f00b..6d8bcce61 100644 --- a/go.mod +++ b/go.mod @@ -53,7 +53,7 @@ require ( github.com/cyphar/filepath-securejoin v0.2.3 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/eapache/queue v1.1.0 // indirect - github.com/emicklei/go-restful/v3 v3.9.0 // indirect + github.com/emicklei/go-restful/v3 v3.10.2 // indirect github.com/evanphx/json-patch v4.12.0+incompatible // indirect github.com/evanphx/json-patch/v5 v5.6.0 // indirect github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b // indirect diff --git a/go.sum b/go.sum index dda3e809f..d04cc680a 100644 --- a/go.sum +++ b/go.sum @@ -71,8 +71,8 @@ github.com/eapache/channels v1.1.0 h1:F1taHcn7/F0i8DYqKXJnyhJcVpp2kgFcNePxXtnyu4 github.com/eapache/channels v1.1.0/go.mod h1:jMm2qB5Ubtg9zLd+inMZd2/NUvXgzmWXsDaLyQIGfH0= github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc= github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I= -github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE= -github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/emicklei/go-restful/v3 v3.10.2 h1:hIovbnmBTLjHXkqEBUz3HGpXZdM7ZrE9fJIZIqlJLqE= +github.com/emicklei/go-restful/v3 v3.10.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= From 179aa898f4b7b5e43175aad7220f1aa76c69c4fb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 2 Jun 2023 08:04:55 -0700 Subject: [PATCH 215/822] Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (#10005) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.2 to 1.8.3. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.8.2...v1.8.3) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 6d8bcce61..e1f8cd8c6 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 - github.com/stretchr/testify v1.8.2 + github.com/stretchr/testify v1.8.3 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.9.0 diff --git a/go.sum b/go.sum index d04cc680a..a867674d6 100644 --- a/go.sum +++ b/go.sum @@ -347,9 +347,7 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c= -github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.1.3/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= @@ -357,10 +355,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= -github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= -github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY= +github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk= github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= From 1503695b3041505c93335c1ddf5801bd6734e970 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Sun, 4 Jun 2023 01:50:41 +0800 Subject: [PATCH 216/822] Fix typo in controller_test (#10034) Signed-off-by: z1cheng --- internal/ingress/controller/controller_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index 06e1e8db0..41ce9de87 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -387,7 +387,7 @@ func TestCheckWarning(t *testing.T) { t.Errorf("no error should be returned, but %s was returned", err) } if len(warnings) != 1 { - t.Errorf("expected 1 warning to occur but %d occured", len(warnings)) + t.Errorf("expected 1 warning to occur but %d occurred", len(warnings)) } else { t.Logf("got warning %s correctly", warnings[0]) } @@ -424,7 +424,7 @@ func TestCheckWarning(t *testing.T) { t.Errorf("no error should be returned, but %s was returned", err) } if len(warnings) != 1 { - t.Errorf("expected 1 warning to occur but %d occured", len(warnings)) + t.Errorf("expected 1 warning to occur but %d occurred", len(warnings)) } else { t.Logf("got warnings %v correctly", warnings) } @@ -441,7 +441,7 @@ func TestCheckWarning(t *testing.T) { t.Errorf("no error should be returned, but %s was returned", err) } if len(warnings) != 4 { - t.Errorf("expected 4 warning to occur but %d occured", len(warnings)) + t.Errorf("expected 4 warning to occur but %d occurred", len(warnings)) } else { t.Logf("got warnings %v correctly", warnings) } From 7d27f39953fb131b75088a9f34c4c069492ae2e0 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Mon, 5 Jun 2023 20:37:27 +0530 Subject: [PATCH 217/822] ensured hpa mem spec before cpu spec (#10043) --- .../ingress-nginx/templates/controller-hpa.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-hpa.yaml b/charts/ingress-nginx/templates/controller-hpa.yaml index 96a91f533..f212bc4f5 100644 --- a/charts/ingress-nginx/templates/controller-hpa.yaml +++ b/charts/ingress-nginx/templates/controller-hpa.yaml @@ -21,14 +21,6 @@ spec: minReplicas: {{ .Values.controller.autoscaling.minReplicas }} maxReplicas: {{ .Values.controller.autoscaling.maxReplicas }} metrics: - {{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} {{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }} - type: Resource resource: @@ -37,6 +29,14 @@ spec: type: Utilization averageUtilization: {{ . }} {{- end }} + {{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} {{- with .Values.controller.autoscalingTemplate }} {{- toYaml . | nindent 2 }} {{- end }} From ba1a4fac998f14d1718d507492ceb3917c8abb99 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Jun 2023 14:13:08 -0700 Subject: [PATCH 218/822] Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#10041) Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.8.3 to 1.8.4. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.8.3...v1.8.4) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e1f8cd8c6..1bdcdbc61 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 - github.com/stretchr/testify v1.8.3 + github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.9.0 diff --git a/go.sum b/go.sum index a867674d6..9e65d666f 100644 --- a/go.sum +++ b/go.sum @@ -355,8 +355,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.8.3 h1:RP3t2pwF7cMEbC1dqtB6poj3niw/9gnV4Cjg5oW5gtY= -github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= +github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= +github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk= github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= From 712e10d4176da06e28a11eb6f9e2d7a263b887cb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Jun 2023 14:15:06 -0700 Subject: [PATCH 219/822] Bump actions/dependency-review-action from 3.0.4 to 3.0.6 (#10042) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.0.4 to 3.0.6. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e...1360a344ccb0ab6e9475edef90ad2f46bf8003b1) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/depreview.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index de9243f16..4f04bdaed 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -11,4 +11,4 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: 'Dependency Review' - uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e # v3.0.4 + uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6 From c3ea3b861e04db08a9edb67d25fc96502b32a657 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Wed, 7 Jun 2023 22:58:13 +0800 Subject: [PATCH 220/822] docs: Updated the content of deploy/rbac.md (#10054) Due to Kubernetes having deprecated the use of configmap as a mechanism for elections, we have migrated to a mechanism based on leases resources. However, the documentation has not been updated, resulting in inconsistencies. Signed-off-by: Jintao Zhang --- docs/deploy/rbac.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/deploy/rbac.md b/docs/deploy/rbac.md index 8c36d19a7..70af8ba92 100644 --- a/docs/deploy/rbac.md +++ b/docs/deploy/rbac.md @@ -29,39 +29,38 @@ namespace specific permissions defined by the `Role` named `ingress-nginx`. These permissions are granted in order for the ingress-nginx-controller to be able to function as an ingress across the cluster. These permissions are -granted to the ClusterRole named `ingress-nginx` +granted to the `ClusterRole` named `ingress-nginx` * `configmaps`, `endpoints`, `nodes`, `pods`, `secrets`: list, watch * `nodes`: get -* `services`, `ingresses`: get, list, watch +* `services`, `ingresses`, `ingressclasses`, `endpointslices`: get, list, watch * `events`: create, patch * `ingresses/status`: update +* `leases`: list, watch ### Namespace Permissions These permissions are granted specific to the ingress-nginx namespace. These -permissions are granted to the Role named `ingress-nginx` +permissions are granted to the `Role` named `ingress-nginx` * `configmaps`, `pods`, `secrets`: get * `endpoints`: get Furthermore to support leader-election, the ingress-nginx-controller needs to -have access to a `configmap` using the resourceName `ingress-controller-leader-nginx` +have access to a `leases` using the resourceName `ingress-nginx-leader` > Note that resourceNames can NOT be used to limit requests using the “create” > verb because authorizers only have access to information that can be obtained > from the request URL, method, and headers (resource names in a “create” request > are part of the request body). -* `configmaps`: get, update (for resourceName `ingress-controller-leader-nginx`) -* `configmaps`: create +* `leases`: get, update (for resourceName `ingress-controller-leader`) +* `leases`: create -This resourceName is the concatenation of the `election-id` and the -`ingress-class` as defined by the ingress-controller, which defaults to: +This resourceName is the `election-id` defined by the ingress-controller, which defaults to: * `election-id`: `ingress-controller-leader` -* `ingress-class`: `nginx` -* `resourceName` : `-` +* `resourceName` : `` Please adapt accordingly if you overwrite either parameter when launching the ingress-nginx-controller. From 4c00085c173566519f0509cd8c1b0a4aa0f81aa0 Mon Sep 17 00:00:00 2001 From: Mitchell Mohorovich Date: Thu, 8 Jun 2023 11:52:14 -0400 Subject: [PATCH 221/822] fix broken kubernetes.io/user-guide/ docs links (#10055) --- charts/ingress-nginx/README.md | 10 +++++----- charts/ingress-nginx/values.yaml | 10 +++++----- docs/index.md | 2 +- docs/troubleshooting.md | 4 ++-- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 4a00815fd..c6859d1ad 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -352,7 +352,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.metrics.prometheusRule.enabled | bool | `false` | | | controller.metrics.prometheusRule.rules | list | `[]` | | | controller.metrics.service.annotations | object | `{}` | | -| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # | +| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | | controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource | | controller.metrics.service.loadBalancerSourceRanges | list | `[]` | | | controller.metrics.service.servicePort | int | `10254` | | @@ -368,7 +368,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | | controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | | controller.name | string | `"controller"` | | -| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # | +| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | | controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | controller.opentelemetry.enabled | bool | `false` | | | controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0"` | | @@ -401,7 +401,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.service.enableHttps | bool | `true` | | | controller.service.enabled | bool | `true` | | | controller.service.external.enabled | bool | `true` | | -| controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # | +| controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | | controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. | | controller.service.internal.enabled | bool | `false` | Enables an additional internal load balancer (besides the external one). | | controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. | @@ -463,7 +463,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | defaultBackend.minAvailable | int | `1` | | | defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | | defaultBackend.name | string | `"defaultbackend"` | | -| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # | +| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | | defaultBackend.podAnnotations | object | `{}` | Annotations to be added to default backend pods # | | defaultBackend.podLabels | object | `{}` | Labels to add to the pod container metadata | | defaultBackend.podSecurityContext | object | `{}` | Security Context policies for controller pods See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls # | @@ -477,7 +477,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | defaultBackend.replicaCount | int | `1` | | | defaultBackend.resources | object | `{}` | | | defaultBackend.service.annotations | object | `{}` | | -| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # | +| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | | defaultBackend.service.loadBalancerSourceRanges | list | `[]` | | | defaultBackend.service.servicePort | int | `80` | | | defaultBackend.service.type | string | `"ClusterIP"` | | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 7ca41e79e..708469fab 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -257,7 +257,7 @@ controller: ## terminationGracePeriodSeconds: 300 # -- Node labels for controller pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ ## nodeSelector: kubernetes.io/os: linux @@ -417,7 +417,7 @@ controller: # clusterIP: "" # -- List of IP addresses at which the controller services are available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips ## externalIPs: [] # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer @@ -652,7 +652,7 @@ controller: # clusterIP: "" # -- List of IP addresses at which the stats-exporter service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips ## externalIPs: [] # loadBalancerIP: "" @@ -810,7 +810,7 @@ defaultBackend: # key: value # -- Node labels for default backend pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ ## nodeSelector: kubernetes.io/os: linux @@ -849,7 +849,7 @@ defaultBackend: # clusterIP: "" # -- List of IP addresses at which the default backend service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips ## externalIPs: [] # loadBalancerIP: "" diff --git a/docs/index.md b/docs/index.md index 0a0f488cf..bd6a825e1 100644 --- a/docs/index.md +++ b/docs/index.md @@ -4,7 +4,7 @@ This is the documentation for the Ingress NGINX Controller. It is built around the [Kubernetes Ingress resource](https://kubernetes.io/docs/concepts/services-networking/ingress/), using a [ConfigMap](https://kubernetes.io/docs/concepts/configuration/configmap/) to store the controller configuration. -You can learn more about using [Ingress](http://kubernetes.io/docs/user-guide/ingress/) in the official [Kubernetes documentation](https://docs.k8s.io). +You can learn more about using [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) in the official [Kubernetes documentation](https://docs.k8s.io). # Getting Started diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 4b9820200..e1fd6956e 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -137,7 +137,7 @@ The Ingress controller needs information from apiserver. Therefore, authenticati * _Kubeconfig file:_ In some Kubernetes environments service accounts are not available. In this case a manual configuration is required. The Ingress controller binary can be started with the `--kubeconfig` flag. The value of the flag is a path to a file specifying how to connect to the API server. Using the `--kubeconfig` does not requires the flag `--apiserver-host`. The format of the file is identical to `~/.kube/config` which is used by kubectl to connect to the API server. See 'kubeconfig' section for details. -* _Using the flag `--apiserver-host`:_ Using this flag `--apiserver-host=http://localhost:8080` it is possible to specify an unsecured API server or reach a remote kubernetes cluster using [kubectl proxy](https://kubernetes.io/docs/user-guide/kubectl/kubectl_proxy/). +* _Using the flag `--apiserver-host`:_ Using this flag `--apiserver-host=http://localhost:8080` it is possible to specify an unsecured API server or reach a remote kubernetes cluster using [kubectl proxy](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#proxy). Please do not use this approach in production. In the diagram below you can see the full authentication flow with all options, starting with the browser @@ -230,7 +230,7 @@ If it is not working, there are two possible reasons: More information: -- [User Guide: Service Accounts](http://kubernetes.io/docs/user-guide/service-accounts/) +- [User Guide: Service Accounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) - [Cluster Administrator Guide: Managing Service Accounts](http://kubernetes.io/docs/admin/service-accounts-admin/) ## Kube-Config From 5bfc56618ed512d5a2c95bdbd5481b82c6853661 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Thu, 8 Jun 2023 23:54:13 +0800 Subject: [PATCH 222/822] Update Internal Load Balancer docs (#10062) * Update internal load balancer doc Signed-off-by: z1cheng * Fix incorrect description Signed-off-by: z1cheng * GenerateREADME.md using helm-docs Signed-off-by: z1cheng * Regenerate the docs Signed-off-by: z1cheng --------- Signed-off-by: z1cheng --- charts/ingress-nginx/README.md | 8 ++++++-- charts/ingress-nginx/README.md.gotmpl | 8 ++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index c6859d1ad..363970f60 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -143,8 +143,10 @@ controller: internal: enabled: true annotations: - # Create internal ELB - service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # Create internal NLB + service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" + # Create internal ELB(Deprecated) + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # Any other annotation can be declared here. ``` @@ -187,6 +189,8 @@ controller: # Any other annotation can be declared here. ``` +The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). + An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index 4a35a40b3..9b6f8c9c9 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -140,8 +140,10 @@ controller: internal: enabled: true annotations: - # Create internal ELB - service.beta.kubernetes.io/aws-load-balancer-internal: "true" + # Create internal NLB + service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" + # Create internal ELB(Deprecated) + # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # Any other annotation can be declared here. ``` @@ -184,6 +186,8 @@ controller: # Any other annotation can be declared here. ``` +The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer). + An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object. Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`. From adbad99a71234f1f570133c36c1961c7dd383e94 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Fri, 9 Jun 2023 13:58:15 +0200 Subject: [PATCH 223/822] docs: canary weighted deployments example (#10067) Signed-off-by: Spazzy --- docs/examples/canary/README.md | 231 +++++++++++++++++++++++++++++++++ docs/examples/index.md | 1 + 2 files changed, 232 insertions(+) create mode 100644 docs/examples/canary/README.md diff --git a/docs/examples/canary/README.md b/docs/examples/canary/README.md new file mode 100644 index 000000000..4124faf6f --- /dev/null +++ b/docs/examples/canary/README.md @@ -0,0 +1,231 @@ +# Canary + +Ingress Nginx Has the ability to handle canary routing by setting specific +annotations, the following is an example of how to configure a canary +deployment with weighted canary routing. + +## Create your main deployment and service + +This is the main deployment of your application with the service that will be +used to route to it + +```bash +echo " +--- +# Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: production + labels: + app: production +spec: + replicas: 1 + selector: + matchLabels: + app: production + template: + metadata: + labels: + app: production + spec: + containers: + - name: production + image: registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:6fc5aa2994c86575975bb20a5203651207029a0d28e3f491d8a127d08baadab4 + ports: + - containerPort: 80 + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP +--- +# Service +apiVersion: v1 +kind: Service +metadata: + name: production + labels: + app: production +spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + selector: + app: production +" | kubectl apply -f - +``` + +## Create the canary deployment and service + +This is the canary deployment that will take a weighted amount of requests +instead of the main deployment + +```bash +echo " +--- +# Deployment +apiVersion: apps/v1 +kind: Deployment +metadata: + name: canary + labels: + app: canary +spec: + replicas: 1 + selector: + matchLabels: + app: canary + template: + metadata: + labels: + app: canary + spec: + containers: + - name: canary + image: registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:6fc5aa2994c86575975bb20a5203651207029a0d28e3f491d8a127d08baadab4 + ports: + - containerPort: 80 + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP +--- +# Service +apiVersion: v1 +kind: Service +metadata: + name: canary + labels: + app: canary +spec: + ports: + - port: 80 + targetPort: 80 + protocol: TCP + name: http + selector: + app: canary +" | kubectl apply -f - +``` + +## Create Ingress Pointing To Your Main Deployment + +Next you will need to expose your main deployment with an ingress resource, +note there are no canary specific annotations on this ingress + +```bash +echo " +--- +# Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: production + annotations: +spec: + ingressClassName: nginx + rules: + - host: echo.prod.mydomain.com + http: + paths: + - pathType: Prefix + path: / + backend: + service: + name: production + port: + number: 80 +" | kubectl apply -f - +``` + +## Create Ingress Pointing To Your Canary Deployment + +You will then create an Ingress that has the canary specific configuration, +please pay special notice of the following: + +- The host name is identical to the main ingress host name +- The `nginx.ingress.kubernetes.io/canary: "true"` annotation is required and + defines this as a canary annotation (if you do not have this the Ingresses + will clash) +- The `nginx.ingress.kubernetes.io/canary-weight: "50"` annotation dictates the + weight of the routing, in this case there is a "50%" chance a request will + hit the canary deployment over the main deployment +```bash +echo " +--- +# Ingress +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: canary + annotations: + nginx.ingress.kubernetes.io/canary: \"true\" + nginx.ingress.kubernetes.io/canary-weight: \"50\" +spec: + ingressClassName: nginx + rules: + - host: echo.prod.mydomain.com + http: + paths: + - pathType: Prefix + path: / + backend: + service: + name: canary + port: + number: 80 +" | kubectl apply -f - +``` + +## Testing your setup + +You can use the following command to test your setup (replacing +INGRESS_CONTROLLER_IP with your ingresse controllers IP Address) + +```bash +for i in $(seq 1 10); do curl -s --resolve echo.prod.mydomain.com:80:$INGRESS_CONTROLLER_IP echo.prod.mydomain.com | grep "Hostname"; done +``` + +You will get the following output showing that your canary setup is working as +expected: + +```bash +Hostname: production-5c5f65d859-phqzc +Hostname: canary-6697778457-zkfjf +Hostname: canary-6697778457-zkfjf +Hostname: production-5c5f65d859-phqzc +Hostname: canary-6697778457-zkfjf +Hostname: production-5c5f65d859-phqzc +Hostname: production-5c5f65d859-phqzc +Hostname: production-5c5f65d859-phqzc +Hostname: canary-6697778457-zkfjf +Hostname: production-5c5f65d859-phqzc +``` diff --git a/docs/examples/index.md b/docs/examples/index.md index 8a5fd5f51..3af4266ff 100644 --- a/docs/examples/index.md +++ b/docs/examples/index.md @@ -23,6 +23,7 @@ Customization | [External authentication with response header propagation](custo Customization | [Sysctl tuning](customization/sysctl/README.md) | TODO | TODO Features | [Rewrite](rewrite/README.md) | TODO | TODO Features | [Session stickiness](affinity/cookie/README.md) | route requests consistently to the same endpoint | Advanced +Features | [Canary Deployments](canary/README.md) | weigthed canary routing to a seperate deployment | Intermediate Scaling | [Static IP](static-ip/README.md) | a single ingress gets a single static IP | Intermediate TLS | [Multi TLS certificate termination](multi-tls/README.md) | TODO | TODO TLS | [TLS termination](tls-termination/README.md) | TODO | TODO From 388987c4e7500478ce76ff0c845d43256b603a00 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Sun, 11 Jun 2023 20:39:47 +0200 Subject: [PATCH 224/822] docs: add lua testing documentation (#10060) Signed-off-by: Spazzy --- docs/lua_tests.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 docs/lua_tests.md diff --git a/docs/lua_tests.md b/docs/lua_tests.md new file mode 100644 index 000000000..4d3d1fe70 --- /dev/null +++ b/docs/lua_tests.md @@ -0,0 +1,19 @@ +# Lua Tests + +## Running the Lua Tests + +To run the Lua tests you can run the following from the root directory: + +```bash +make lua-test +``` + +This command makes use of docker hence does not need any dependency +installations besides docker + +## Where are the Lua Tests? + +Lua Tests can be found in the [rootfs/etc/nginx/lua/test](../rootfs/etc/nginx/lua/test) directory + + +[1]: https://openresty.org/en/installation.html From dd4a703637f723c34081cd67d51dc5451a3a7771 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Sun, 11 Jun 2023 20:41:46 +0200 Subject: [PATCH 225/822] fix: add canary to sidebar in examples (#10068) Signed-off-by: Spazzy --- mkdocs.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/mkdocs.yml b/mkdocs.yml index 992c04d45..3243f8247 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -127,6 +127,7 @@ nav: - TLS termination: "examples/tls-termination/README.md" - Pod Security Policy (PSP): "examples/psp/README.md" - Open Policy Agent rules: "examples/openpolicyagent/README.md" + - Canary Deployments: "examples/canary/README.md" - Developer Guide: - Getting Started: "developer-guide/getting-started.md" - Code Overview: "developer-guide/code-overview.md" From 05e5956545afa74ce332791075db14ac7ffa54ff Mon Sep 17 00:00:00 2001 From: David Goffredo Date: Sun, 11 Jun 2023 14:45:47 -0400 Subject: [PATCH 226/822] tracing: upgrade to dd-opentracing-cpp v1.3.7 (#10031) --- images/nginx/rootfs/build.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index 44c7b20f8..e2a5fd8c6 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -53,8 +53,8 @@ export JAEGER_VERSION=0.7.0 # Check for recent changes: https://github.com/msgpack/msgpack-c/compare/cpp-3.3.0...master export MSGPACK_VERSION=3.3.0 -# Check for recent changes: https://github.com/DataDog/dd-opentracing-cpp/compare/v1.3.2...master -export DATADOG_CPP_VERSION=1.3.2 +# Check for recent changes: https://github.com/DataDog/dd-opentracing-cpp/compare/v1.3.7...master +export DATADOG_CPP_VERSION=1.3.7 # Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.3...master export MODSECURITY_VERSION=1.0.3 @@ -265,7 +265,7 @@ get_src d3f2c870f8f88477b01726b32accab30f6e5d57ae59c5ec87374ff73d0794316 \ "https://github.com/openresty/luajit2/archive/v$LUAJIT_VERSION.tar.gz" fi -get_src 586f92166018cc27080d34e17c59d68219b85af745edf3cc9fe41403fc9b4ac6 \ +get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \ "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz" get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ From 114ae77fb7ca30cb97326f41a18a1cb75ecc5665 Mon Sep 17 00:00:00 2001 From: guangwu Date: Mon, 12 Jun 2023 02:49:47 +0800 Subject: [PATCH 227/822] chore: pkg imported more than once (#10048) --- .../ingress/controller/controller_test.go | 31 +++++++++---------- internal/ingress/controller/store/store.go | 3 +- internal/net/ssl/ssl_test.go | 5 ++- test/e2e/annotations/grpc.go | 7 ++--- test/e2e/framework/framework.go | 14 ++++----- 5 files changed, 27 insertions(+), 33 deletions(-) diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index 41ce9de87..355f5da95 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -33,7 +33,7 @@ import ( "github.com/eapache/channels" corev1 "k8s.io/api/core/v1" - v1 "k8s.io/api/core/v1" + discoveryv1 "k8s.io/api/discovery/v1" networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -48,7 +48,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl" "k8s.io/ingress-nginx/internal/ingress/annotations/sessionaffinity" - "k8s.io/ingress-nginx/internal/ingress/controller/config" ngx_config "k8s.io/ingress-nginx/internal/ingress/controller/config" "k8s.io/ingress-nginx/internal/ingress/controller/ingressclass" "k8s.io/ingress-nginx/internal/ingress/controller/store" @@ -146,7 +145,7 @@ func (ntc testNginxTestCommand) Test(cfg string) ([]byte, error) { type fakeTemplate struct{} -func (fakeTemplate) Write(conf config.TemplateConfig) ([]byte, error) { +func (fakeTemplate) Write(conf ngx_config.TemplateConfig) ([]byte, error) { r := []byte{} for _, s := range conf.Servers { if len(r) > 0 { @@ -1529,7 +1528,7 @@ func TestGetBackendServers(t *testing.T) { testCases := []struct { Ingresses []*ingress.Ingress Validate func(ingresses []*ingress.Ingress, upstreams []*ingress.Backend, servers []*ingress.Server) - SetConfigMap func(namespace string) *v1.ConfigMap + SetConfigMap func(namespace string) *corev1.ConfigMap }{ { Ingresses: []*ingress.Ingress{ @@ -2299,8 +2298,8 @@ func TestGetBackendServers(t *testing.T) { t.Errorf("location cafilename should be '%s', got '%s'", ingresses[1].ParsedAnnotations.ProxySSL.CAFileName, s.Locations[0].ProxySSL.CAFileName) } }, - SetConfigMap: func(ns string) *v1.ConfigMap { - return &v1.ConfigMap{ + SetConfigMap: func(ns string) *corev1.ConfigMap { + return &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "config", SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), @@ -2360,8 +2359,8 @@ func TestGetBackendServers(t *testing.T) { t.Errorf("backend should be upstream-default-backend, got '%s'", s.Locations[0].Backend) } }, - SetConfigMap: func(ns string) *v1.ConfigMap { - return &v1.ConfigMap{ + SetConfigMap: func(ns string) *corev1.ConfigMap { + return &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "config", SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), @@ -2438,8 +2437,8 @@ func TestGetBackendServers(t *testing.T) { } }, - SetConfigMap: func(ns string) *v1.ConfigMap { - return &v1.ConfigMap{ + SetConfigMap: func(ns string) *corev1.ConfigMap { + return &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "config", SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), @@ -2459,8 +2458,8 @@ func TestGetBackendServers(t *testing.T) { } } -func testConfigMap(ns string) *v1.ConfigMap { - return &v1.ConfigMap{ +func testConfigMap(ns string) *corev1.ConfigMap { + return &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "config", SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), @@ -2469,11 +2468,11 @@ func testConfigMap(ns string) *v1.ConfigMap { } func newNGINXController(t *testing.T) *NGINXController { - ns := v1.NamespaceDefault + ns := corev1.NamespaceDefault clientSet := fake.NewSimpleClientset() - configMap := &v1.ConfigMap{ + configMap := &corev1.ConfigMap{ ObjectMeta: metav1.ObjectMeta{ Name: "config", SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), @@ -2540,8 +2539,8 @@ func fakeX509Cert(dnsNames []string) *x509.Certificate { } } -func newDynamicNginxController(t *testing.T, setConfigMap func(string) *v1.ConfigMap) *NGINXController { - ns := v1.NamespaceDefault +func newDynamicNginxController(t *testing.T, setConfigMap func(string) *corev1.ConfigMap) *NGINXController { + ns := corev1.NamespaceDefault clientSet := fake.NewSimpleClientset() configMap := setConfigMap(ns) diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index 7157332c3..78fab62dc 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -36,7 +36,6 @@ import ( "k8s.io/apimachinery/pkg/labels" k8sruntime "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/util/runtime" - utilruntime "k8s.io/apimachinery/pkg/util/runtime" "k8s.io/client-go/informers" clientset "k8s.io/client-go/kubernetes" "k8s.io/client-go/kubernetes/scheme" @@ -1138,7 +1137,7 @@ func (s *k8sStore) Run(stopCh chan struct{}) { var runtimeScheme = k8sruntime.NewScheme() func init() { - utilruntime.Must(networkingv1.AddToScheme(runtimeScheme)) + runtime.Must(networkingv1.AddToScheme(runtimeScheme)) } func toIngress(obj interface{}) (*networkingv1.Ingress, bool) { diff --git a/internal/net/ssl/ssl_test.go b/internal/net/ssl/ssl_test.go index e251d01d1..9d1aedf16 100644 --- a/internal/net/ssl/ssl_test.go +++ b/internal/net/ssl/ssl_test.go @@ -20,7 +20,6 @@ import ( "bytes" "crypto" "crypto/rand" - cryptorand "crypto/rand" "crypto/rsa" "crypto/tls" "crypto/x509" @@ -336,7 +335,7 @@ const ( // newPrivateKey creates an RSA private key func newPrivateKey() (*rsa.PrivateKey, error) { - return rsa.GenerateKey(cryptorand.Reader, rsaKeySize) + return rsa.GenerateKey(rand.Reader, rsaKeySize) } // newSignedCert creates a signed certificate using the given CA certificate and key @@ -365,7 +364,7 @@ func newSignedCert(cfg certutil.Config, key crypto.Signer, caCert *x509.Certific KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature, ExtKeyUsage: cfg.Usages, } - certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &certTmpl, caCert, key.Public(), caKey) + certDERBytes, err := x509.CreateCertificate(rand.Reader, &certTmpl, caCert, key.Public(), caKey) if err != nil { return nil, err } diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 046191b21..2bdac553b 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -29,7 +29,6 @@ import ( "google.golang.org/grpc" "google.golang.org/grpc/credentials" "google.golang.org/grpc/metadata" - core "k8s.io/api/core/v1" corev1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/intstr" @@ -70,7 +69,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { host := "echo" - svc := &core.Service{ + svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: "grpcbin-test", Namespace: f.Namespace, @@ -129,7 +128,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { host := "echo" - svc := &core.Service{ + svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: "grpcbin-test", Namespace: f.Namespace, @@ -201,7 +200,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { host := "echo" - svc := &core.Service{ + svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: "grpcbin-test", Namespace: f.Namespace, diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index cac6dfd20..7ed3da3e0 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -27,7 +27,6 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" appsv1 "k8s.io/api/apps/v1" - corev1 "k8s.io/api/core/v1" v1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" apiextcs "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset" @@ -38,7 +37,6 @@ import ( "k8s.io/client-go/kubernetes" "k8s.io/client-go/kubernetes/scheme" "k8s.io/client-go/rest" - restclient "k8s.io/client-go/rest" "k8s.io/klog/v2" ) @@ -62,13 +60,13 @@ type Framework struct { // A Kubernetes and Service Catalog client KubeClientSet kubernetes.Interface - KubeConfig *restclient.Config + KubeConfig *rest.Config APIExtensionsClientSet apiextcs.Interface Namespace string IngressClass string - pod *corev1.Pod + pod *v1.Pod } // NewDefaultFramework makes a new framework and sets up a BeforeEach/AfterEach for @@ -233,7 +231,7 @@ func (f *Framework) GetURL(scheme RequestScheme) string { } // GetIngressNGINXPod returns the ingress controller running pod -func (f *Framework) GetIngressNGINXPod() *corev1.Pod { +func (f *Framework) GetIngressNGINXPod() *v1.Pod { return f.pod } @@ -413,13 +411,13 @@ func (f *Framework) WaitForReload(fn func()) { assert.Nil(ginkgo.GinkgoT(), err, "while waiting for ingress controller reload") } -func getReloadCount(pod *corev1.Pod, namespace string, client kubernetes.Interface) int { +func getReloadCount(pod *v1.Pod, namespace string, client kubernetes.Interface) int { events, err := client.CoreV1().Events(namespace).Search(scheme.Scheme, pod) assert.Nil(ginkgo.GinkgoT(), err, "obtaining NGINX Pod") reloadCount := 0 for _, e := range events.Items { - if e.Reason == "RELOAD" && e.Type == corev1.EventTypeNormal { + if e.Reason == "RELOAD" && e.Type == v1.EventTypeNormal { reloadCount++ } } @@ -793,7 +791,7 @@ func Sleep(duration ...time.Duration) { time.Sleep(sleepFor) } -func loadConfig() (*restclient.Config, error) { +func loadConfig() (*rest.Config, error) { config, err := rest.InClusterConfig() if err != nil { return nil, err From 7043f6ae296ef85bbb4066d5e33e72b5e15dc970 Mon Sep 17 00:00:00 2001 From: guangwu Date: Mon, 12 Jun 2023 02:49:54 +0800 Subject: [PATCH 228/822] unnecessary use of fmt.Sprint (S1039) (#10049) --- internal/ingress/controller/checker_test.go | 2 +- test/e2e/annotations/connection.go | 3 +- test/e2e/framework/framework.go | 4 +- test/e2e/settings/enable_real_ip.go | 30 +++++++------- test/e2e/settings/forwarded_headers.go | 39 +++++++++---------- test/e2e/settings/keep-alive.go | 5 +-- test/e2e/settings/listen_nondefault_ports.go | 4 +- .../e2e/settings/no_tls_redirect_locations.go | 5 +-- test/e2e/settings/proxy_host.go | 2 +- test/e2e/settings/proxy_protocol.go | 20 +++++----- test/e2e/settings/tls.go | 6 +-- 11 files changed, 58 insertions(+), 62 deletions(-) diff --git a/internal/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go index a0d2baafa..bea1c9cd0 100644 --- a/internal/ingress/controller/checker_test.go +++ b/internal/ingress/controller/checker_test.go @@ -109,7 +109,7 @@ func TestNginxCheck(t *testing.T) { }) // pollute pid file - pidFile.Write([]byte(fmt.Sprint("999999"))) + pidFile.Write([]byte("999999")) pidFile.Close() t.Run("bad pid", func(t *testing.T) { diff --git a/test/e2e/annotations/connection.go b/test/e2e/annotations/connection.go index 9cfcbacd0..428d85876 100644 --- a/test/e2e/annotations/connection.go +++ b/test/e2e/annotations/connection.go @@ -17,7 +17,6 @@ limitations under the License. package annotations import ( - "fmt" "net/http" "strings" @@ -52,6 +51,6 @@ var _ = framework.DescribeAnnotation("connection-proxy-header", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK). - Body().Contains(fmt.Sprintf("connection=keep-alive")) + Body().Contains("connection=keep-alive") }) }) diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index 7ed3da3e0..a3d5ea760 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -160,7 +160,7 @@ func (f *Framework) AfterEach() { return } - cmd := fmt.Sprintf("cat /etc/nginx/nginx.conf") + cmd := "cat /etc/nginx/nginx.conf" o, err := f.ExecCommand(f.pod, cmd) if err != nil { Logf("Unexpected error obtaining nginx.conf file: %v", err) @@ -277,7 +277,7 @@ func (f *Framework) matchNginxConditions(name string, matcher func(cfg string) b return func() (bool, error) { var cmd string if name == "" { - cmd = fmt.Sprintf("cat /etc/nginx/nginx.conf") + cmd = "cat /etc/nginx/nginx.conf" } else { cmd = fmt.Sprintf("cat /etc/nginx/nginx.conf | awk '/## start server %v/,/## end server %v/'", name, name) } diff --git a/test/e2e/settings/enable_real_ip.go b/test/e2e/settings/enable_real_ip.go index 9be2e52d9..778011b9f 100644 --- a/test/e2e/settings/enable_real_ip.go +++ b/test/e2e/settings/enable_real_ip.go @@ -64,15 +64,15 @@ var _ = framework.DescribeSetting("enable-real-ip", func() { Body(). Raw() - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) + assert.NotContains(ginkgo.GinkgoT(), body, "host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-proto=myproto") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%s", host)) assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=%s", host)) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=http")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=80")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4")) + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=80") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=1.2.3.4") }) ginkgo.It("should not trust X-Forwarded-For header when setting is false", func() { @@ -101,13 +101,13 @@ var _ = framework.DescribeSetting("enable-real-ip", func() { Raw() assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%s", host)) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=80")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=http")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-original-forwarded-for=1.2.3.4")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4")) + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=80") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") + assert.Contains(ginkgo.GinkgoT(), body, "x-original-forwarded-for=1.2.3.4") + assert.NotContains(ginkgo.GinkgoT(), body, "host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-proto=myproto") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-for=1.2.3.4") }) }) diff --git a/test/e2e/settings/forwarded_headers.go b/test/e2e/settings/forwarded_headers.go index b929e683b..d4ffee545 100644 --- a/test/e2e/settings/forwarded_headers.go +++ b/test/e2e/settings/forwarded_headers.go @@ -17,7 +17,6 @@ limitations under the License. package settings import ( - "fmt" "net/http" "strings" @@ -65,12 +64,12 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { Body(). Raw() - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=myproto")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4")) + assert.Contains(ginkgo.GinkgoT(), body, "host=myhost") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-host=myhost") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=myproto") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-scheme=myproto") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=1.2.3.4") ginkgo.By("ensuring that first entry in X-Forwarded-Host is used as the best host") body = f.HTTPTestClient(). @@ -85,8 +84,8 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { Body(). Raw() - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost.com")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost.com")) + assert.Contains(ginkgo.GinkgoT(), body, "host=myhost.com") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-host=myhost.com") }) ginkgo.It("should not trust X-Forwarded headers when setting is false", func() { @@ -115,16 +114,16 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { Body(). Raw() - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=forwarded-headers")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=80")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=http")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=http")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-original-forwarded-for=1.2.3.4")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=myproto")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) - assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4")) + assert.Contains(ginkgo.GinkgoT(), body, "host=forwarded-headers") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=80") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-scheme=http") + assert.Contains(ginkgo.GinkgoT(), body, "x-original-forwarded-for=1.2.3.4") + assert.NotContains(ginkgo.GinkgoT(), body, "host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-host=myhost") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-proto=myproto") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-scheme=myproto") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") + assert.NotContains(ginkgo.GinkgoT(), body, "x-forwarded-for=1.2.3.4") }) }) diff --git a/test/e2e/settings/keep-alive.go b/test/e2e/settings/keep-alive.go index 510a90125..d139f61c0 100644 --- a/test/e2e/settings/keep-alive.go +++ b/test/e2e/settings/keep-alive.go @@ -17,7 +17,6 @@ limitations under the License. package settings import ( - "fmt" "regexp" "strings" @@ -41,7 +40,7 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("keep-alive", "140") f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf(`keepalive_timeout 140s;`)) + return strings.Contains(server, `keepalive_timeout 140s;`) }) }) @@ -49,7 +48,7 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("keep-alive-requests", "200") f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf(`keepalive_requests 200;`)) + return strings.Contains(server, `keepalive_requests 200;`) }) }) diff --git a/test/e2e/settings/listen_nondefault_ports.go b/test/e2e/settings/listen_nondefault_ports.go index 8b5d22f6e..e682cef06 100644 --- a/test/e2e/settings/listen_nondefault_ports.go +++ b/test/e2e/settings/listen_nondefault_ports.go @@ -92,7 +92,7 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun Expect(). Status(http.StatusOK). Body(). - Contains(fmt.Sprintf("x-forwarded-port=443")) + Contains("x-forwarded-port=443") }) ginkgo.Context("when external authentication is configured", func() { @@ -141,7 +141,7 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun Expect(). Status(http.StatusOK). Body(). - Contains(fmt.Sprintf("x-forwarded-port=443")) + Contains("x-forwarded-port=443") }) }) }) diff --git a/test/e2e/settings/no_tls_redirect_locations.go b/test/e2e/settings/no_tls_redirect_locations.go index 2fca545ff..332d764d6 100644 --- a/test/e2e/settings/no_tls_redirect_locations.go +++ b/test/e2e/settings/no_tls_redirect_locations.go @@ -17,7 +17,6 @@ limitations under the License. package settings import ( - "fmt" "strings" "github.com/onsi/ginkgo/v2" @@ -34,7 +33,7 @@ var _ = framework.DescribeSetting("Add no tls redirect locations", func() { f.EnsureIngress(ing) f.WaitForNginxConfiguration(func(server string) bool { - return !strings.Contains(server, fmt.Sprintf("force_no_ssl_redirect = true,")) + return !strings.Contains(server, "force_no_ssl_redirect = true,") }) wlKey := "no-tls-redirect-locations" @@ -43,7 +42,7 @@ var _ = framework.DescribeSetting("Add no tls redirect locations", func() { f.UpdateNginxConfigMapData(wlKey, wlValue) f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf("force_no_ssl_redirect = true,")) + return strings.Contains(server, "force_no_ssl_redirect = true,") }) }) diff --git a/test/e2e/settings/proxy_host.go b/test/e2e/settings/proxy_host.go index 8f564414a..efc254e45 100644 --- a/test/e2e/settings/proxy_host.go +++ b/test/e2e/settings/proxy_host.go @@ -66,7 +66,7 @@ var _ = framework.IngressNginxDescribe("Dynamic $proxy_host", func() { f.WaitForNginxConfiguration( func(server string) bool { return strings.Contains(server, fmt.Sprintf("server_name %v", test)) && - strings.Contains(server, fmt.Sprintf("set $proxy_host $proxy_upstream_name")) + strings.Contains(server, "set $proxy_host $proxy_upstream_name") }) f.HTTPTestClient(). diff --git a/test/e2e/settings/proxy_protocol.go b/test/e2e/settings/proxy_protocol.go index 8b0e56fe4..f48ee5c8c 100644 --- a/test/e2e/settings/proxy_protocol.go +++ b/test/e2e/settings/proxy_protocol.go @@ -71,9 +71,9 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { body := string(data) assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=http")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=192.168.0.1")) + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) ginkgo.It("should respect proto passed by the PROXY Protocol server port", func() { @@ -104,9 +104,9 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { body := string(data) assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=443")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=https")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=192.168.0.1")) + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=443") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) ginkgo.It("should enable PROXY Protocol for HTTPS", func() { @@ -146,10 +146,10 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { body := string(data) assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=https")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-scheme=https")) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=192.168.0.1")) + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") + assert.Contains(ginkgo.GinkgoT(), body, "x-scheme=https") + assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) ginkgo.It("should enable PROXY Protocol for TCP", func() { diff --git a/test/e2e/settings/tls.go b/test/e2e/settings/tls.go index a249f8bad..a820e41dd 100644 --- a/test/e2e/settings/tls.go +++ b/test/e2e/settings/tls.go @@ -112,7 +112,7 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f f.UpdateNginxConfigMapData(hstsMaxAge, "86400") f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf(`hsts_max_age = 86400,`)) + return strings.Contains(server, `hsts_max_age = 86400,`) }) f.HTTPTestClientWithTLSConfig(tlsConfig). @@ -131,7 +131,7 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f }) f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf(`hsts_include_subdomains = false,`)) + return strings.Contains(server, `hsts_include_subdomains = false,`) }) f.HTTPTestClientWithTLSConfig(tlsConfig). @@ -151,7 +151,7 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f }) f.WaitForNginxConfiguration(func(server string) bool { - return strings.Contains(server, fmt.Sprintf(`hsts_preload = true,`)) + return strings.Contains(server, `hsts_preload = true,`) }) f.HTTPTestClientWithTLSConfig(tlsConfig). From 051aa6d40d88aaf390ba280fa86fd90fc3c25986 Mon Sep 17 00:00:00 2001 From: Micah Huber Date: Sun, 11 Jun 2023 13:51:46 -0500 Subject: [PATCH 229/822] add support for keda fallback settings (#9993) --- charts/ingress-nginx/templates/controller-keda.yaml | 5 +++++ charts/ingress-nginx/values.yaml | 3 +++ 2 files changed, 8 insertions(+) diff --git a/charts/ingress-nginx/templates/controller-keda.yaml b/charts/ingress-nginx/templates/controller-keda.yaml index 875157ea4..c0d95a98e 100644 --- a/charts/ingress-nginx/templates/controller-keda.yaml +++ b/charts/ingress-nginx/templates/controller-keda.yaml @@ -25,6 +25,11 @@ spec: cooldownPeriod: {{ .Values.controller.keda.cooldownPeriod }} minReplicaCount: {{ .Values.controller.keda.minReplicas }} maxReplicaCount: {{ .Values.controller.keda.maxReplicas }} +{{- with .Values.controller.keda.fallback }} + fallback: + failureThreshold: {{ .failureThreshold | default 3 }} + replicas: {{ .replicas | default $.Values.controller.keda.maxReplicas }} +{{- end }} triggers: {{- with .Values.controller.keda.triggers }} {{ toYaml . | indent 2 }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 708469fab..8080a1fc3 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -368,6 +368,9 @@ controller: maxReplicas: 11 pollingInterval: 30 cooldownPeriod: 300 + # fallback: + # failureThreshold: 3 + # replicas: 11 restoreToOriginalReplicaCount: false scaledObject: annotations: {} From 4d3e64258c6fa581b1bf92b6a541e718977040fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Neto?= <53952575+josenetoo@users.noreply.github.com> Date: Sun, 11 Jun 2023 15:55:47 -0300 Subject: [PATCH 230/822] Adding feature to upgrade Oracle Cloud Infrastructure's Flexible Load Balancer and adjusting Health Check that were critical in the previous configuration (#9961) * Create deploy.yaml * Create kustomization.yaml --- deploy/static/provider/oci/deploy.yaml | 648 ++++++++++++++++++ deploy/static/provider/oci/kustomization.yaml | 11 + 2 files changed, 659 insertions(+) create mode 100644 deploy/static/provider/oci/deploy.yaml create mode 100644 deploy/static/provider/oci/kustomization.yaml diff --git a/deploy/static/provider/oci/deploy.yaml b/deploy/static/provider/oci/deploy.yaml new file mode 100644 index 000000000..77de50247 --- /dev/null +++ b/deploy/static/provider/oci/deploy.yaml @@ -0,0 +1,648 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + name: ingress-nginx +--- +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx + namespace: ingress-nginx +rules: +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get +- apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update +- apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch +- apiGroups: + - coordination.k8s.io + resourceNames: + - ingress-nginx-leader + resources: + - leases + verbs: + - get + - update +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission + namespace: ingress-nginx +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx +rules: +- apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets + - namespaces + verbs: + - list + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - list + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get +- apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update +- apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission +rules: +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-nginx +subjects: +- kind: ServiceAccount + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-nginx-admission +subjects: +- kind: ServiceAccount + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-nginx +subjects: +- kind: ServiceAccount + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-nginx-admission +subjects: +- kind: ServiceAccount + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: v1 +data: + allow-snippet-annotations: "true" +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-controller + namespace: ingress-nginx +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-controller + namespace: ingress-nginx + annotations: + service.beta.kubernetes.io/oci-load-balancer-shape: "flexible" + service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10" + service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100" +spec: + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - appProtocol: http + name: http + port: 80 + protocol: TCP + targetPort: http + - appProtocol: https + name: https + port: 443 + protocol: TCP + targetPort: https + selector: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-controller-admission + namespace: ingress-nginx +spec: + ports: + - appProtocol: https + name: https-webhook + port: 443 + targetPort: webhook + selector: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-controller + namespace: ingress-nginx +spec: + minReadySeconds: 0 + revisionHistoryLimit: 10 + selector: + matchLabels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + template: + metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + spec: + containers: + - args: + - /nginx-ingress-controller + - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller + - --election-id=ingress-nginx-leader + - --controller-class=k8s.io/ingress-nginx + - --ingress-class=nginx + - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller + - --validating-webhook=:8443 + - --validating-webhook-certificate=/usr/local/certificates/cert + - --validating-webhook-key=/usr/local/certificates/key + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: LD_PRELOAD + value: /usr/local/lib/libmimalloc.so + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + imagePullPolicy: IfNotPresent + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: controller + ports: + - containerPort: 80 + name: http + protocol: TCP + - containerPort: 443 + name: https + protocol: TCP + - containerPort: 8443 + name: webhook + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + requests: + cpu: 100m + memory: 90Mi + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - NET_BIND_SERVICE + drop: + - ALL + runAsUser: 101 + volumeMounts: + - mountPath: /usr/local/certificates/ + name: webhook-cert + readOnly: true + dnsPolicy: ClusterFirst + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: ingress-nginx + terminationGracePeriodSeconds: 300 + volumes: + - name: webhook-cert + secret: + secretName: ingress-nginx-admission +--- +apiVersion: batch/v1 +kind: Job +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission-create + namespace: ingress-nginx +spec: + template: + metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission-create + spec: + containers: + - args: + - create + - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc + - --namespace=$(POD_NAMESPACE) + - --secret-name=ingress-nginx-admission + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + imagePullPolicy: IfNotPresent + name: create + securityContext: + allowPrivilegeEscalation: false + nodeSelector: + kubernetes.io/os: linux + restartPolicy: OnFailure + securityContext: + fsGroup: 2000 + runAsNonRoot: true + runAsUser: 2000 + serviceAccountName: ingress-nginx-admission +--- +apiVersion: batch/v1 +kind: Job +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission-patch + namespace: ingress-nginx +spec: + template: + metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission-patch + spec: + containers: + - args: + - patch + - --webhook-name=ingress-nginx-admission + - --namespace=$(POD_NAMESPACE) + - --patch-mutating=false + - --secret-name=ingress-nginx-admission + - --patch-failure-policy=Fail + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + imagePullPolicy: IfNotPresent + name: patch + securityContext: + allowPrivilegeEscalation: false + nodeSelector: + kubernetes.io/os: linux + restartPolicy: OnFailure + securityContext: + fsGroup: 2000 + runAsNonRoot: true + runAsUser: 2000 + serviceAccountName: ingress-nginx-admission +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: nginx +spec: + controller: k8s.io/ingress-nginx +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.1 + name: ingress-nginx-admission +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: ingress-nginx-controller-admission + namespace: ingress-nginx + path: /networking/v1/ingresses + failurePolicy: Fail + matchPolicy: Equivalent + name: validate.nginx.ingress.kubernetes.io + rules: + - apiGroups: + - networking.k8s.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - ingresses + sideEffects: None diff --git a/deploy/static/provider/oci/kustomization.yaml b/deploy/static/provider/oci/kustomization.yaml new file mode 100644 index 000000000..d477ec405 --- /dev/null +++ b/deploy/static/provider/oci/kustomization.yaml @@ -0,0 +1,11 @@ +# NOTE: kustomize is not supported. This file exists only to be able to reference it from bases. +# https://kubectl.docs.kubernetes.io/references/kustomize/bases/ +# +# ``` +# namespace: ingress-nginx +# bases: +# - github.com/kubernetes/ingress-nginx/tree/main/deploy/static/provider/cloud +# ``` + +resources: + - deploy.yaml From db49b9da6f61bd477bcaa519bb537f6bfaa71252 Mon Sep 17 00:00:00 2001 From: Gerald Pape Date: Sun, 11 Jun 2023 20:59:47 +0200 Subject: [PATCH 231/822] Fix mirror-target values without path separator and port (#9889) * Remove variables with $ before feeding into url.Parse Signed-off-by: Gerald Pape * Do not render invalid request mirroring config Signed-off-by: Gerald Pape * Remove additional note from docs again Signed-off-by: Gerald Pape * Include quotes in e2e test for mirror proxy_pass --------- Signed-off-by: Gerald Pape --- internal/ingress/annotations/mirror/main.go | 7 ++++--- .../ingress/annotations/mirror/main_test.go | 18 ++++++++++++++++++ .../ingress/controller/template/template.go | 6 +++--- test/e2e/annotations/mirror.go | 2 +- 4 files changed, 26 insertions(+), 7 deletions(-) diff --git a/internal/ingress/annotations/mirror/main.go b/internal/ingress/annotations/mirror/main.go index cd54a9826..9cb1b0ede 100644 --- a/internal/ingress/annotations/mirror/main.go +++ b/internal/ingress/annotations/mirror/main.go @@ -93,12 +93,13 @@ func (a mirror) Parse(ing *networking.Ingress) (interface{}, error) { config.Host, err = parser.GetStringAnnotation("mirror-host", ing) if err != nil { if config.Target != "" { - url, err := parser.StringToURL(config.Target) + target := strings.Split(config.Target, "$") + + url, err := parser.StringToURL(target[0]) if err != nil { config.Host = "" } else { - hostname := strings.Split(url.Hostname(), "$") - config.Host = hostname[0] + config.Host = url.Hostname() } } } diff --git a/internal/ingress/annotations/mirror/main_test.go b/internal/ingress/annotations/mirror/main_test.go index f744ab552..add90d768 100644 --- a/internal/ingress/annotations/mirror/main_test.go +++ b/internal/ingress/annotations/mirror/main_test.go @@ -48,6 +48,24 @@ func TestParse(t *testing.T) { Target: "https://test.env.com/$request_uri", Host: "test.env.com", }}, + {map[string]string{backendURL: "https://test.env.com$request_uri"}, &Config{ + Source: ngxURI, + RequestBody: "on", + Target: "https://test.env.com$request_uri", + Host: "test.env.com", + }}, + {map[string]string{backendURL: "https://test.env.com:8080$request_uri"}, &Config{ + Source: ngxURI, + RequestBody: "on", + Target: "https://test.env.com:8080$request_uri", + Host: "test.env.com", + }}, + {map[string]string{backendURL: "https://test.env.com:8080/$request_uri"}, &Config{ + Source: ngxURI, + RequestBody: "on", + Target: "https://test.env.com:8080/$request_uri", + Host: "test.env.com", + }}, {map[string]string{requestBody: "off"}, &Config{ Source: "", RequestBody: "off", diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 6aadab48e..2d941f95d 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -1727,7 +1727,7 @@ func buildMirrorLocations(locs []*ingress.Location) string { mapped := sets.Set[string]{} for _, loc := range locs { - if loc.Mirror.Source == "" || loc.Mirror.Target == "" { + if loc.Mirror.Source == "" || loc.Mirror.Target == "" || loc.Mirror.Host == "" { continue } @@ -1738,8 +1738,8 @@ func buildMirrorLocations(locs []*ingress.Location) string { mapped.Insert(loc.Mirror.Source) buffer.WriteString(fmt.Sprintf(`location = %v { internal; -proxy_set_header Host %v; -proxy_pass %v; +proxy_set_header Host "%v"; +proxy_pass "%v"; } `, loc.Mirror.Source, loc.Mirror.Host, loc.Mirror.Target)) diff --git a/test/e2e/annotations/mirror.go b/test/e2e/annotations/mirror.go index ad178a947..787cbfa3b 100644 --- a/test/e2e/annotations/mirror.go +++ b/test/e2e/annotations/mirror.go @@ -60,7 +60,7 @@ var _ = framework.DescribeAnnotation("mirror-*", func() { func(server string) bool { return strings.Contains(server, fmt.Sprintf("mirror /_mirror-%v;", ing.UID)) && strings.Contains(server, "mirror_request_body on;") && - strings.Contains(server, "proxy_pass https://test.env.com/$request_uri;") + strings.Contains(server, `proxy_pass "https://test.env.com/$request_uri";`) }) }) From 90ed0ccdbe4edd55ad4ab16ffec40be64f3308d9 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 11 Jun 2023 17:33:47 -0300 Subject: [PATCH 232/822] Remove fastcgi feature (#9864) --- .github/workflows/ci.yaml | 6 - MANUAL_RELEASE.md | 2 - docs/e2e-tests.md | 131 +++++++- docs/kubectl-plugin.md | 1 - docs/user-guide/fcgi-services.md | 118 +------- .../nginx-configuration/annotations.md | 2 +- images/fastcgi-helloserver/Makefile | 59 ---- images/fastcgi-helloserver/cloudbuild.yaml | 22 -- images/fastcgi-helloserver/rootfs/Dockerfile | 32 -- images/fastcgi-helloserver/rootfs/main.go | 30 -- internal/ingress/annotations/annotations.go | 62 ++-- .../annotations/backendprotocol/main.go | 2 +- internal/ingress/annotations/fastcgi/main.go | 106 ------- .../ingress/annotations/fastcgi/main_test.go | 285 ------------------ internal/ingress/annotations/parser/main.go | 1 - internal/ingress/controller/controller.go | 3 +- .../ingress/controller/template/template.go | 3 - .../controller/template/template_test.go | 2 - pkg/apis/ingress/types.go | 4 - pkg/apis/ingress/types_equals.go | 4 - rootfs/etc/nginx/template/nginx.tmpl | 11 - test/e2e/annotations/backendprotocol.go | 15 - test/e2e/annotations/fastcgi.go | 125 -------- test/e2e/framework/fastcgi_helloserver.go | 104 ------- 24 files changed, 156 insertions(+), 974 deletions(-) delete mode 100644 images/fastcgi-helloserver/Makefile delete mode 100644 images/fastcgi-helloserver/cloudbuild.yaml delete mode 100755 images/fastcgi-helloserver/rootfs/Dockerfile delete mode 100644 images/fastcgi-helloserver/rootfs/main.go delete mode 100644 internal/ingress/annotations/fastcgi/main.go delete mode 100644 internal/ingress/annotations/fastcgi/main_test.go delete mode 100644 test/e2e/annotations/fastcgi.go delete mode 100644 test/e2e/framework/fastcgi_helloserver.go diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 4d443f8d5..3406b250f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -391,8 +391,6 @@ jobs: - 'images/custom-error-pages/**' cfssl: - 'images/cfssl/**' - fastcgi-helloserver: - - 'images/fastcgi-helloserver/**' echo: - 'images/echo/**' go-grpc-greeter-server: @@ -412,10 +410,6 @@ jobs: if: ${{ steps.filter-images.outputs.cfssl == 'true' }} run: | cd images/cfssl && make build - - name: fastcgi-helloserver - if: ${{ steps.filter-images.outputs.fastcgi-helloserver == 'true' }} - run: | - cd images/fastcgi-helloserver && make build - name: echo image build if: ${{ steps.filter-images.outputs.echo == 'true' }} run: | diff --git a/MANUAL_RELEASE.md b/MANUAL_RELEASE.md index d7144b85d..4b4df0ec6 100644 --- a/MANUAL_RELEASE.md +++ b/MANUAL_RELEASE.md @@ -56,8 +56,6 @@ - [cfssl](https://github.com/kubernetes/ingress-nginx/tree/main/images/cfssl) - - [fastcgi-helloserver](https://github.com/kubernetes/ingress-nginx/tree/main/images/fastcgi-helloserver) - - [httpbin](https://github.com/kubernetes/ingress-nginx/tree/main/images/httpbin) - [kube-webhook-certgen](https://github.com/kubernetes/ingress-nginx/tree/main/images/kube-webhook-certgen) diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 025ff686d..64d35c79a 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -108,7 +108,6 @@ Do not try to edit it manually. - [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L49) - [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) - [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) -- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) - [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) ### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) @@ -192,13 +191,6 @@ Do not try to edit it manually. - [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) - [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) -### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) - -- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) -- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) -- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) -- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) - ### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) - [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) @@ -350,6 +342,101 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) + +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) + +### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) + +- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) +- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) +- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) +- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) +- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) +- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) +- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) +- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) +- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) +- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) +- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) +- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) +- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) +- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) +- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) + +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) + +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) + +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) + +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) +- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) +- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) +- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) +- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L485) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L494) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L505) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L529) +- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L552) +- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L570) +- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L590) +- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L609) +- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L623) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L678) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L687) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L698) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L772) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L820) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L849) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) + +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) + +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) + ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) - [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) @@ -398,10 +485,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - ### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) @@ -478,6 +561,30 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) diff --git a/docs/kubectl-plugin.md b/docs/kubectl-plugin.md index 9e5a5dcc6..9dc808642 100644 --- a/docs/kubectl-plugin.md +++ b/docs/kubectl-plugin.md @@ -200,7 +200,6 @@ kubectl ingress-nginx conf -n ingress-nginx --host testaddr.local ```console $ kubectl ingress-nginx exec -i -n ingress-nginx -- ls /etc/nginx -fastcgi_params geoip lua mime.types diff --git a/docs/user-guide/fcgi-services.md b/docs/user-guide/fcgi-services.md index db4d9428b..d4f1d1f1e 100644 --- a/docs/user-guide/fcgi-services.md +++ b/docs/user-guide/fcgi-services.md @@ -2,118 +2,10 @@ # Exposing FastCGI Servers -> **FastCGI** is a [binary protocol](https://en.wikipedia.org/wiki/Binary_protocol "Binary protocol") for interfacing interactive programs with a [web server](https://en.wikipedia.org/wiki/Web_server "Web server"). [...] (It's) aim is to reduce the overhead related to interfacing between web server and CGI programs, allowing a server to handle more web page requests per unit of time. -> -> — Wikipedia +**This feature has been removed from Ingress NGINX** -The _ingress-nginx_ ingress controller can be used to directly expose [FastCGI](https://en.wikipedia.org/wiki/FastCGI) servers. Enabling FastCGI in your Ingress only requires setting the _backend-protocol_ annotation to `FCGI`, and with a couple more annotations you can customize the way _ingress-nginx_ handles the communication with your FastCGI _server_. +People willing to use fastcgi servers, should create an NGINX + FastCGI service and expose +this service via Ingress NGINX. - -## Example Objects to Expose a FastCGI Pod - -The _Pod_ example object below exposes port `9000`, which is the conventional FastCGI port. - -```yaml -apiVersion: v1 -kind: Pod -metadata: - name: example-app -labels: - app: example-app -spec: - containers: - - name: example-app - image: example-app:1.0 - ports: - - containerPort: 9000 - name: fastcgi -``` - -The _Service_ object example below matches port `9000` from the _Pod_ object above. - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: example-service -spec: - selector: - app: example-app - ports: - - port: 9000 - targetPort: 9000 - name: fastcgi -``` - -And the _Ingress_ and _ConfigMap_ objects below demonstrates the supported _FastCGI_ specific annotations (NGINX actually has 50 FastCGI directives, all of which have not been exposed in the ingress yet), and matches the service `example-service`, and the port named `fastcgi` from above. The _ConfigMap_ **must** be created first for the _Ingress Controller_ to be able to find it when the _Ingress_ object is created, otherwise you will need to restart the _Ingress Controller_ pods. - -```yaml -# The ConfigMap MUST be created first for the ingress controller to be able to -# find it when the Ingress object is created. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: example-cm -data: - SCRIPT_FILENAME: "/example/index.php" - ---- - -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - annotations: - nginx.ingress.kubernetes.io/backend-protocol: "FCGI" - nginx.ingress.kubernetes.io/fastcgi-index: "index.php" - nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-cm" - name: example-app -spec: - ingressClassName: nginx - rules: - - host: app.example.com - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: example-service - port: - name: fastcgi -``` - -## FastCGI Ingress Annotations - -To enable FastCGI, the `nginx.ingress.kubernetes.io/backend-protocol` annotation needs to be set to `FCGI`, which overrides the default `HTTP` value. - -> `nginx.ingress.kubernetes.io/backend-protocol: "FCGI"` - -**This enables the _FastCGI_ mode for all paths defined in the _Ingress_ object** - -### The `nginx.ingress.kubernetes.io/fastcgi-index` Annotation - -To specify an index file, the `fastcgi-index` annotation value can optionally be set. In the example below, the value is set to `index.php`. This annotation corresponds to [the _NGINX_ `fastcgi_index` directive](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_index). - -> `nginx.ingress.kubernetes.io/fastcgi-index: "index.php"` - -### The `nginx.ingress.kubernetes.io/fastcgi-params-configmap` Annotation - -To specify [_NGINX_ `fastcgi_param` directives](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_param), the `fastcgi-params-configmap` annotation is used, which in turn must lead to a _ConfigMap_ object containing the _NGINX_ `fastcgi_param` directives as key/values. - -> `nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-configmap"` - -And the _ConfigMap_ object to specify the `SCRIPT_FILENAME` and `HTTP_PROXY` _NGINX's_ `fastcgi_param` directives will look like the following: - -```yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: example-configmap -data: - SCRIPT_FILENAME: "/example/index.php" - HTTP_PROXY: "" -``` -Using the _namespace/_ prefix is also supported, for example: - -> `nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-namespace/example-configmap"` +We recommend using images like `cgr.dev/chainguard/nginx:latest` and expose your fast_cgi application +as another container on this Pod. diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index b515a9f3b..fc43a47b2 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -894,7 +894,7 @@ Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf ### Backend Protocol Using `backend-protocol` annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces `secure-backends` in older versions) -Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP and FCGI +Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP By default NGINX uses `HTTP`. diff --git a/images/fastcgi-helloserver/Makefile b/images/fastcgi-helloserver/Makefile deleted file mode 100644 index 4d277a19d..000000000 --- a/images/fastcgi-helloserver/Makefile +++ /dev/null @@ -1,59 +0,0 @@ -# Copyright 2020 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Docker image for e2e testing. - -# set default shell -SHELL=/bin/bash -o pipefail -o errexit - -DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) -INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh - -SHORT_SHA ?=$(shell git rev-parse --short HEAD) -TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) - -REGISTRY ?= local - -IMAGE = $(REGISTRY)/e2e-test-fastcgi-helloserver - -# required to enable buildx -export DOCKER_CLI_EXPERIMENTAL=enabled - -# build with buildx -PLATFORMS?=linux/amd64,linux/arm,linux/arm64 -OUTPUT= -PROGRESS=plain - -build: ensure-buildx - docker buildx build \ - --platform=${PLATFORMS} $(OUTPUT) \ - --progress=$(PROGRESS) \ - --pull \ - -t $(IMAGE):$(TAG) rootfs - -# push the cross built image -push: OUTPUT=--push -push: build - -# enable buildx -ensure-buildx: -# this is required for cloudbuild -ifeq ("$(wildcard $(INIT_BUILDX))","") - @curl -sSL https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/hack/init-buildx.sh | bash -else - @exec $(INIT_BUILDX) -endif - @echo "done" - -.PHONY: build push ensure-buildx diff --git a/images/fastcgi-helloserver/cloudbuild.yaml b/images/fastcgi-helloserver/cloudbuild.yaml deleted file mode 100644 index a4c9d5eff..000000000 --- a/images/fastcgi-helloserver/cloudbuild.yaml +++ /dev/null @@ -1,22 +0,0 @@ -timeout: 1800s -options: - substitution_option: ALLOW_LOOSE -steps: - - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 - entrypoint: bash - env: - - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - - REGISTRY=gcr.io/k8s-staging-ingress-nginx - # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx - # set the home to /root explicitly to if using docker buildx - - HOME=/root - args: - - -c - - | - gcloud auth configure-docker \ - && cd images/fastcgi-helloserver && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile deleted file mode 100755 index a11834373..000000000 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ /dev/null @@ -1,32 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -FROM golang:1.20.4-alpine3.18 as builder - -WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi - -COPY . . - -RUN CGO_ENABLED=0 go build -a -installsuffix cgo \ - -ldflags "-s -w" \ - -o fastcgi-helloserver main.go - -# Use distroless as minimal base image to package the binary -# Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot - -COPY --from=builder /go/src/k8s.io/ingress-nginx/images/fastcgi/fastcgi-helloserver / -USER nonroot:nonroot - -CMD ["/fastcgi-helloserver"] diff --git a/images/fastcgi-helloserver/rootfs/main.go b/images/fastcgi-helloserver/rootfs/main.go deleted file mode 100644 index 91db60c26..000000000 --- a/images/fastcgi-helloserver/rootfs/main.go +++ /dev/null @@ -1,30 +0,0 @@ -package main - -import ( - "fmt" - "net" - "net/http" - "net/http/fcgi" -) - -func hello(w http.ResponseWriter, r *http.Request) { - keys, ok := r.URL.Query()["name"] - - if !ok || len(keys[0]) < 1 { - fmt.Fprintf(w, "Hello world!") - return - } - - key := keys[0] - fmt.Fprintf(w, "Hello "+string(key)+"!") -} - -func main() { - http.HandleFunc("/hello", hello) - - l, err := net.Listen("tcp", "0.0.0.0:9000") - if err != nil { - panic(err) - } - fcgi.Serve(l, nil) -} diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 5bb2bf5e6..ad7dad37d 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -41,7 +41,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/cors" "k8s.io/ingress-nginx/internal/ingress/annotations/customhttperrors" "k8s.io/ingress-nginx/internal/ingress/annotations/defaultbackend" - "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/http2pushpreload" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" @@ -86,37 +85,35 @@ type Ingress struct { CorsConfig cors.Config CustomHTTPErrors []int DefaultBackend *apiv1.Service - //TODO: Change this back into an error when https://github.com/imdario/mergo/issues/100 is resolved - FastCGI fastcgi.Config - Denied *string - ExternalAuth authreq.Config - EnableGlobalAuth bool - HTTP2PushPreload bool - Opentracing opentracing.Config - Opentelemetry opentelemetry.Config - Proxy proxy.Config - ProxySSL proxyssl.Config - RateLimit ratelimit.Config - GlobalRateLimit globalratelimit.Config - Redirect redirect.Config - Rewrite rewrite.Config - Satisfy string - ServerSnippet string - ServiceUpstream bool - SessionAffinity sessionaffinity.Config - SSLPassthrough bool - UsePortInRedirects bool - UpstreamHashBy upstreamhashby.Config - LoadBalancing string - UpstreamVhost string - Whitelist ipwhitelist.SourceRange - Denylist ipdenylist.SourceRange - XForwardedPrefix string - SSLCipher sslcipher.Config - Logs log.Config - ModSecurity modsecurity.Config - Mirror mirror.Config - StreamSnippet string + Denied *string + ExternalAuth authreq.Config + EnableGlobalAuth bool + HTTP2PushPreload bool + Opentracing opentracing.Config + Opentelemetry opentelemetry.Config + Proxy proxy.Config + ProxySSL proxyssl.Config + RateLimit ratelimit.Config + GlobalRateLimit globalratelimit.Config + Redirect redirect.Config + Rewrite rewrite.Config + Satisfy string + ServerSnippet string + ServiceUpstream bool + SessionAffinity sessionaffinity.Config + SSLPassthrough bool + UsePortInRedirects bool + UpstreamHashBy upstreamhashby.Config + LoadBalancing string + UpstreamVhost string + Whitelist ipwhitelist.SourceRange + Denylist ipdenylist.SourceRange + XForwardedPrefix string + SSLCipher sslcipher.Config + Logs log.Config + ModSecurity modsecurity.Config + Mirror mirror.Config + StreamSnippet string } // Extractor defines the annotation parsers to be used in the extraction of annotations @@ -138,7 +135,6 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "CorsConfig": cors.NewParser(cfg), "CustomHTTPErrors": customhttperrors.NewParser(cfg), "DefaultBackend": defaultbackend.NewParser(cfg), - "FastCGI": fastcgi.NewParser(cfg), "ExternalAuth": authreq.NewParser(cfg), "EnableGlobalAuth": authreqglobal.NewParser(cfg), "HTTP2PushPreload": http2pushpreload.NewParser(cfg), diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index d8ea72386..0140c30a3 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -31,7 +31,7 @@ import ( const HTTP = "HTTP" var ( - validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|AJP|GRPC|GRPCS|FCGI)$`) + validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|AJP|GRPC|GRPCS)$`) ) type backendProtocol struct { diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go deleted file mode 100644 index 84bac4109..000000000 --- a/internal/ingress/annotations/fastcgi/main.go +++ /dev/null @@ -1,106 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package fastcgi - -import ( - "fmt" - "reflect" - - networking "k8s.io/api/networking/v1" - "k8s.io/client-go/tools/cache" - - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -type fastcgi struct { - r resolver.Resolver -} - -// Config describes the per location fastcgi config -type Config struct { - Index string `json:"index"` - Params map[string]string `json:"params"` -} - -// Equal tests for equality between two Configuration types -func (l1 *Config) Equal(l2 *Config) bool { - if l1 == l2 { - return true - } - - if l1 == nil || l2 == nil { - return false - } - - if l1.Index != l2.Index { - return false - } - - return reflect.DeepEqual(l1.Params, l2.Params) -} - -// NewParser creates a new fastcgiConfig protocol annotation parser -func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return fastcgi{r} -} - -// ParseAnnotations parses the annotations contained in the ingress -// rule used to indicate the fastcgiConfig. -func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { - - fcgiConfig := Config{} - - if ing.GetAnnotations() == nil { - return fcgiConfig, nil - } - - index, err := parser.GetStringAnnotation("fastcgi-index", ing) - if err != nil { - index = "" - } - fcgiConfig.Index = index - - cm, err := parser.GetStringAnnotation("fastcgi-params-configmap", ing) - if err != nil { - return fcgiConfig, nil - } - - cmns, cmn, err := cache.SplitMetaNamespaceKey(cm) - if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ - Reason: fmt.Errorf("error reading configmap name from annotation: %w", err), - } - } - - if cmns != "" && cmns != ing.Namespace { - return fcgiConfig, fmt.Errorf("different namespace is not supported on fast_cgi param configmap") - } - - cm = fmt.Sprintf("%v/%v", ing.Namespace, cmn) - cmap, err := a.r.GetConfigMap(cm) - if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ - Reason: fmt.Errorf("unexpected error reading configmap %s: %w", cm, err), - } - } - - fcgiConfig.Params = cmap.Data - - return fcgiConfig, nil -} diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go deleted file mode 100644 index 35c5bbc12..000000000 --- a/internal/ingress/annotations/fastcgi/main_test.go +++ /dev/null @@ -1,285 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package fastcgi - -import ( - "fmt" - "testing" - - api "k8s.io/api/core/v1" - networking "k8s.io/api/networking/v1" - meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/client-go/tools/cache" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -func buildIngress() *networking.Ingress { - return &networking.Ingress{ - ObjectMeta: meta_v1.ObjectMeta{ - Name: "foo", - Namespace: api.NamespaceDefault, - }, - Spec: networking.IngressSpec{ - DefaultBackend: &networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "default-backend", - Port: networking.ServiceBackendPort{ - Number: 80, - }, - }, - }, - }, - } -} - -type mockConfigMap struct { - resolver.Mock -} - -func (m mockConfigMap) GetConfigMap(name string) (*api.ConfigMap, error) { - if name != "default/demo-configmap" && name != "otherns/demo-configmap" { - return nil, fmt.Errorf("there is no configmap with name %v", name) - } - - cmns, cmn, err := cache.SplitMetaNamespaceKey(name) - if err != nil { - return nil, fmt.Errorf("invalid configmap name") - } - - return &api.ConfigMap{ - ObjectMeta: meta_v1.ObjectMeta{ - Namespace: cmns, - Name: cmn, - }, - Data: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, - }, nil -} - -func TestParseEmptyFastCGIAnnotations(t *testing.T) { - ing := buildIngress() - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err != nil { - t.Errorf("unexpected error parsing ingress without fastcgi") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if config.Index != "" { - t.Errorf("Index should be an empty string") - } - - if len(config.Params) != 0 { - t.Errorf("Params should be an empty slice") - } -} - -func TestParseFastCGIIndexAnnotation(t *testing.T) { - ing := buildIngress() - - const expectedAnnotation = "index.php" - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-index")] = expectedAnnotation - ing.SetAnnotations(data) - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err != nil { - t.Errorf("unexpected error parsing ingress without fastcgi") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if config.Index != "index.php" { - t.Errorf("expected %s but %v returned", expectedAnnotation, config.Index) - } -} - -func TestParseEmptyFastCGIParamsConfigMapAnnotation(t *testing.T) { - ing := buildIngress() - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "" - ing.SetAnnotations(data) - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err != nil { - t.Errorf("unexpected error parsing ingress without fastcgi") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if len(config.Params) != 0 { - t.Errorf("Params should be an empty slice") - } -} - -func TestParseFastCGIInvalidParamsConfigMapAnnotation(t *testing.T) { - ing := buildIngress() - - invalidConfigMapList := []string{"unknown/configMap", "unknown/config/map"} - for _, configmap := range invalidConfigMapList { - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = configmap - ing.SetAnnotations(data) - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err == nil { - t.Errorf("Reading an unexisting configmap should return an error") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if len(config.Params) != 0 { - t.Errorf("Params should be an empty slice") - } - } -} - -func TestParseFastCGIParamsConfigMapAnnotationWithoutNS(t *testing.T) { - ing := buildIngress() - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "demo-configmap" - ing.SetAnnotations(data) - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err != nil { - t.Errorf("unexpected error parsing ingress without fastcgi") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if len(config.Params) != 2 { - t.Errorf("Params should have a length of 2") - } - - if config.Params["REDIRECT_STATUS"] != "200" || config.Params["SERVER_NAME"] != "$server_name" { - t.Errorf("Params value is not the one expected") - } -} - -func TestParseFastCGIParamsConfigMapAnnotationWithNS(t *testing.T) { - ing := buildIngress() - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "default/demo-configmap" - ing.SetAnnotations(data) - - i, err := NewParser(&mockConfigMap{}).Parse(ing) - if err != nil { - t.Errorf("unexpected error parsing ingress without fastcgi") - } - - config, ok := i.(Config) - if !ok { - t.Errorf("Parse do not return a Config object") - } - - if len(config.Params) != 2 { - t.Errorf("Params should have a length of 2") - } - - if config.Params["REDIRECT_STATUS"] != "200" || config.Params["SERVER_NAME"] != "$server_name" { - t.Errorf("Params value is not the one expected") - } -} - -func TestParseFastCGIParamsConfigMapAnnotationWithDifferentNS(t *testing.T) { - ing := buildIngress() - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "otherns/demo-configmap" - ing.SetAnnotations(data) - - _, err := NewParser(&mockConfigMap{}).Parse(ing) - if err == nil { - t.Errorf("Different namespace configmap should return an error") - } - -} - -func TestConfigEquality(t *testing.T) { - - var nilConfig *Config - - config := Config{ - Index: "index.php", - Params: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, - } - - configCopy := Config{ - Index: "index.php", - Params: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, - } - - config2 := Config{ - Index: "index.php", - Params: map[string]string{"REDIRECT_STATUS": "200"}, - } - - config3 := Config{ - Index: "index.py", - Params: map[string]string{"SERVER_NAME": "$server_name", "REDIRECT_STATUS": "200"}, - } - - config4 := Config{ - Index: "index.php", - Params: map[string]string{"SERVER_NAME": "$server_name", "REDIRECT_STATUS": "200"}, - } - - if !config.Equal(&config) { - t.Errorf("config should be equal to itself") - } - - if nilConfig.Equal(&config) { - t.Errorf("Foo") - } - - if !config.Equal(&configCopy) { - t.Errorf("config should be equal to configCopy") - } - - if config.Equal(&config2) { - t.Errorf("config2 should not be equal to config") - } - - if config.Equal(&config3) { - t.Errorf("config3 should not be equal to config") - } - - if !config.Equal(&config4) { - t.Errorf("config4 should be equal to config") - } -} diff --git a/internal/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go index 107a278b0..8a0ea4b87 100644 --- a/internal/ingress/annotations/parser/main.go +++ b/internal/ingress/annotations/parser/main.go @@ -160,7 +160,6 @@ func normalizeString(input string) string { var configmapAnnotations = sets.NewString( "auth-proxy-set-header", - "fastcgi-params-configmap", ) // AnnotationsReferencesConfigmap checks if at least one annotation in the Ingress rule diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 20de63fd1..e93d3b5de 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -608,7 +608,7 @@ func (n *NGINXController) getConfiguration(ingresses []*ingress.Ingress) (sets.S for _, server := range servers { // If a location is defined by a prefix string that ends with the slash character, and requests are processed by one of - // proxy_pass, fastcgi_pass, uwsgi_pass, scgi_pass, memcached_pass, or grpc_pass, then the special processing is performed. + // proxy_pass, uwsgi_pass, scgi_pass, memcached_pass, or grpc_pass, then the special processing is performed. // In response to a request with URI equal to // this string, but without the trailing slash, a permanent redirect with the // code 301 will be returned to the requested URI with the slash appended. If this is not desired, an exact match of the // URIand location could be defined like this: @@ -1519,7 +1519,6 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) loc.Logs = anns.Logs loc.DefaultBackend = anns.DefaultBackend loc.BackendProtocol = anns.BackendProtocol - loc.FastCGI = anns.FastCGI loc.CustomHTTPErrors = anns.CustomHTTPErrors loc.ModSecurity = anns.ModSecurity loc.Satisfy = anns.Satisfy diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 2d941f95d..15ae438ab 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -739,9 +739,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { case "AJP": proto = "" proxyPass = "ajp_pass" - case "FCGI": - proto = "" - proxyPass = "fastcgi_pass" } upstreamName := "upstream_balancer" diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index 1980d7e52..1b88c3fe7 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -1138,7 +1138,6 @@ func TestOpentracingPropagateContext(t *testing.T) { {BackendProtocol: "GRPC"}: "opentracing_grpc_propagate_context;", {BackendProtocol: "GRPCS"}: "opentracing_grpc_propagate_context;", {BackendProtocol: "AJP"}: "opentracing_propagate_context;", - {BackendProtocol: "FCGI"}: "opentracing_propagate_context;", nil: "", } @@ -1158,7 +1157,6 @@ func TestOpentelemetryPropagateContext(t *testing.T) { {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", {BackendProtocol: "AJP"}: "opentelemetry_propagate;", - {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", nil: "", } diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index e50666c18..68cacc25b 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -27,7 +27,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/authtls" "k8s.io/ingress-nginx/internal/ingress/annotations/connection" "k8s.io/ingress-nginx/internal/ingress/annotations/cors" - "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" @@ -340,9 +339,6 @@ type Location struct { // BackendProtocol indicates which protocol should be used to communicate with the service // By default this is HTTP BackendProtocol string `json:"backend-protocol"` - // FastCGI allows the ingress to act as a FastCGI client for a given location. - // +optional - FastCGI fastcgi.Config `json:"fastcgi,omitempty"` // CustomHTTPErrors specifies the error codes that should be intercepted. // +optional CustomHTTPErrors []int `json:"custom-http-errors"` diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index 84b1a186a..fee8c31d5 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -435,10 +435,6 @@ func (l1 *Location) Equal(l2 *Location) bool { return false } - if !(&l1.FastCGI).Equal(&l2.FastCGI) { - return false - } - match := compareInts(l1.CustomHTTPErrors, l2.CustomHTTPErrors) if !match { return false diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 9b3a47de3..638333407 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -305,7 +305,6 @@ http { keepalive_requests {{ $cfg.KeepAliveRequests }}; client_body_temp_path /tmp/nginx/client-body; - fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; @@ -1489,16 +1488,6 @@ stream { {{ range $errCode := $location.CustomHTTPErrors }} error_page {{ $errCode }} = @custom_{{ $location.DefaultBackendUpstreamName }}_{{ $errCode }};{{ end }} - {{ if (eq $location.BackendProtocol "FCGI") }} - include /etc/nginx/fastcgi_params; - {{ end }} - {{- if $location.FastCGI.Index -}} - fastcgi_index {{ $location.FastCGI.Index | quote }}; - {{- end -}} - {{ range $k, $v := $location.FastCGI.Params }} - fastcgi_param {{ $k }} {{ $v | quote }}; - {{ end }} - {{ if not (empty $location.Redirect.URL) }} return {{ $location.Redirect.Code }} {{ $location.Redirect.URL }}; {{ end }} diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index bccb03afb..8256befd2 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -91,21 +91,6 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) }) - ginkgo.It("should set backend protocol to '' and use fastcgi_pass", func() { - host := "backendprotocol.foo.com" - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", - } - - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "fastcgi_pass upstream_balancer;") - }) - }) - ginkgo.It("should set backend protocol to '' and use ajp_pass", func() { host := "backendprotocol.foo.com" annotations := map[string]string{ diff --git a/test/e2e/annotations/fastcgi.go b/test/e2e/annotations/fastcgi.go deleted file mode 100644 index 572eca548..000000000 --- a/test/e2e/annotations/fastcgi.go +++ /dev/null @@ -1,125 +0,0 @@ -/* -Copyright 2019 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package annotations - -import ( - "net/http" - "strings" - - "github.com/onsi/ginkgo/v2" - corev1 "k8s.io/api/core/v1" - - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/ingress-nginx/test/e2e/framework" -) - -var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { - f := framework.NewDefaultFramework("fastcgi") - - ginkgo.BeforeEach(func() { - f.NewFastCGIHelloServerDeployment() - }) - - ginkgo.It("should use fastcgi_pass in the configuration file", func() { - host := "fastcgi" - - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", - } - - ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "include /etc/nginx/fastcgi_params;") && - strings.Contains(server, "fastcgi_pass") - }) - }) - - ginkgo.It("should add fastcgi_index in the configuration file", func() { - host := "fastcgi-index" - - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", - "nginx.ingress.kubernetes.io/fastcgi-index": "index.php", - } - - ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "fastcgi_index \"index.php\";") - }) - }) - - ginkgo.It("should add fastcgi_param in the configuration file", func() { - configuration := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: "fastcgi-configmap", - Namespace: f.Namespace, - }, - Data: map[string]string{ - "SCRIPT_FILENAME": "/home/www/scripts/php$fastcgi_script_name", - "REDIRECT_STATUS": "200", - }, - } - - f.EnsureConfigMap(configuration) - - host := "fastcgi-params-configmap" - - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", - "nginx.ingress.kubernetes.io/fastcgi-params-configmap": "fastcgi-configmap", - } - - ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "fastcgi_param SCRIPT_FILENAME \"/home/www/scripts/php$fastcgi_script_name\";") && - strings.Contains(server, "fastcgi_param REDIRECT_STATUS \"200\";") - }) - }) - - ginkgo.It("should return OK for service with backend protocol FastCGI", func() { - host := "fastcgi-helloserver" - path := "/hello" - - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", - } - - ing := framework.NewSingleIngress(host, path, host, f.Namespace, "fastcgi-helloserver", 9000, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "fastcgi_pass") - }) - - f.HTTPTestClient(). - GET(path). - WithHeader("Host", host). - Expect(). - Status(http.StatusOK). - Body().Contains("Hello world!") - }) -}) diff --git a/test/e2e/framework/fastcgi_helloserver.go b/test/e2e/framework/fastcgi_helloserver.go deleted file mode 100644 index 719048c06..000000000 --- a/test/e2e/framework/fastcgi_helloserver.go +++ /dev/null @@ -1,104 +0,0 @@ -/* -Copyright 2017 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package framework - -import ( - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - appsv1 "k8s.io/api/apps/v1" - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/fields" - "k8s.io/apimachinery/pkg/util/intstr" -) - -// NewFastCGIHelloServerDeployment creates a new single replica -// deployment of the fortune teller image in a particular namespace -func (f *Framework) NewFastCGIHelloServerDeployment() { - f.NewNewFastCGIHelloServerDeploymentWithReplicas(1) -} - -// NewNewFastCGIHelloServerDeploymentWithReplicas creates a new deployment of the -// fortune teller image in a particular namespace. Number of replicas is configurable -func (f *Framework) NewNewFastCGIHelloServerDeploymentWithReplicas(replicas int32) { - deployment := &appsv1.Deployment{ - ObjectMeta: metav1.ObjectMeta{ - Name: "fastcgi-helloserver", - Namespace: f.Namespace, - }, - Spec: appsv1.DeploymentSpec{ - Replicas: NewInt32(replicas), - Selector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "fastcgi-helloserver", - }, - }, - Template: corev1.PodTemplateSpec{ - ObjectMeta: metav1.ObjectMeta{ - Labels: map[string]string{ - "app": "fastcgi-helloserver", - }, - }, - Spec: corev1.PodSpec{ - TerminationGracePeriodSeconds: NewInt64(0), - Containers: []corev1.Container{ - { - Name: "fastcgi-helloserver", - Image: "registry.k8s.io/ingress-nginx/e2e-test-fastcgi-helloserver@sha256:0e08c836cc58f1ea862578de99b13bc4264fe071e816f96dc1d79857bfba7473", - Env: []corev1.EnvVar{}, - Ports: []corev1.ContainerPort{ - { - Name: "fastcgi", - ContainerPort: 9000, - }, - }, - }, - }, - }, - }, - }, - } - - d := f.EnsureDeployment(deployment) - - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ - LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), - }) - assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") - - service := &corev1.Service{ - ObjectMeta: metav1.ObjectMeta{ - Name: "fastcgi-helloserver", - Namespace: f.Namespace, - }, - Spec: corev1.ServiceSpec{ - Ports: []corev1.ServicePort{ - { - Name: "fastcgi", - Port: 9000, - TargetPort: intstr.FromInt(9000), - Protocol: "TCP", - }, - }, - Selector: map[string]string{ - "app": "fastcgi-helloserver", - }, - }, - } - - f.EnsureService(service) -} From 60bf6ba6429feb4a5d8b485d1bcee87187fbc368 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Mon, 12 Jun 2023 12:25:49 +0200 Subject: [PATCH 233/822] chore: move httpbun to be part of framework (#9955) Signed-off-by: Spazzy --- test/e2e/HTTPBUN_IMAGE | 1 + test/e2e/annotations/auth.go | 53 +----- test/e2e/annotations/grpc.go | 17 +- test/e2e/annotations/satisfy.go | 17 +- test/e2e/framework/deployment.go | 111 +++++++++---- test/e2e/framework/framework.go | 29 +++- test/e2e/run-e2e-suite.sh | 2 + .../servicebackend/service_externalname.go | 153 +++++++++++------- test/e2e/settings/brotli.go | 9 +- .../settings/disable_service_external_name.go | 16 +- test/e2e/settings/global_external_auth.go | 10 +- test/e2e/settings/listen_nondefault_ports.go | 19 +-- test/e2e/settings/ssl_passthrough.go | 32 +++- 13 files changed, 265 insertions(+), 204 deletions(-) create mode 100644 test/e2e/HTTPBUN_IMAGE diff --git a/test/e2e/HTTPBUN_IMAGE b/test/e2e/HTTPBUN_IMAGE new file mode 100644 index 000000000..2d95865c7 --- /dev/null +++ b/test/e2e/HTTPBUN_IMAGE @@ -0,0 +1 @@ +registry.k8s.io/ingress-nginx/e2e-test-httpbun:v20230505-v0.0.1 diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 4ca034825..8011186a1 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -23,7 +23,6 @@ import ( "net/url" "regexp" "strings" - "time" "golang.org/x/crypto/bcrypt" @@ -38,7 +37,7 @@ import ( ) var _ = framework.DescribeAnnotation("auth-*", func() { - f := framework.NewDefaultFramework("auth") + f := framework.NewDefaultFramework("auth", framework.WithHTTPBunEnabled()) ginkgo.BeforeEach(func() { f.NewEchoDeployment() @@ -390,10 +389,10 @@ http { assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbunIP := e.Subsets[0].Addresses[0].IP + nginxIP := e.Subsets[0].Addresses[0].IP annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/cookies/set/alma/armud", nginxIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } @@ -457,21 +456,8 @@ http { var ing *networking.Ingress ginkgo.BeforeEach(func() { - f.NewHttpbunDeployment() - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - - httpbunIP := e.Subsets[0].Addresses[0].IP - annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } @@ -650,20 +636,8 @@ http { var ing *networking.Ingress ginkgo.BeforeEach(func() { - f.NewHttpbunDeployment() - - var httpbunIP string - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - httpbunIP = e.Subsets[0].Addresses[0].IP - annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", "nginx.ingress.kubernetes.io/auth-signin-redirect-param": "orig", } @@ -729,23 +703,8 @@ http { barPath := "/bar" ginkgo.BeforeEach(func() { - f.NewHttpbunDeployment() - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - framework.Sleep(1 * time.Second) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - - httpbunIP := e.Subsets[0].Addresses[0].IP - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", "nginx.ingress.kubernetes.io/auth-cache-key": "fixed", "nginx.ingress.kubernetes.io/auth-cache-duration": "200 201 401 30m", diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 2bdac553b..c8e530ead 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -37,7 +37,7 @@ import ( ) var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { - f := framework.NewDefaultFramework("grpc") + f := framework.NewDefaultFramework("grpc", framework.WithHTTPBunEnabled()) ginkgo.It("should use grpc_pass in the configuration file", func() { f.NewGRPCFortuneTellerDeployment() @@ -124,8 +124,6 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("authorization metadata should be overwritten by external auth response headers", func() { f.NewGRPCBinDeployment() - f.NewHttpbunDeployment() - host := "echo" svc := &corev1.Service{ @@ -148,19 +146,8 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { } f.EnsureService(svc) - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - - httpbunIP := e.Subsets[0].Addresses[0].IP - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/response-headers?authorization=foo", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/response-headers?authorization=foo", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-response-headers": "Authorization", "nginx.ingress.kubernetes.io/backend-protocol": "GRPC", } diff --git a/test/e2e/annotations/satisfy.go b/test/e2e/annotations/satisfy.go index 758ad21a4..6ba6db33e 100644 --- a/test/e2e/annotations/satisfy.go +++ b/test/e2e/annotations/satisfy.go @@ -17,7 +17,6 @@ limitations under the License. package annotations import ( - "context" "fmt" "net/http" "net/url" @@ -27,13 +26,12 @@ import ( "github.com/stretchr/testify/assert" networking "k8s.io/api/networking/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" ) var _ = framework.DescribeAnnotation("satisfy", func() { - f := framework.NewDefaultFramework("satisfy") + f := framework.NewDefaultFramework("satisfy", framework.WithHTTPBunEnabled()) ginkgo.BeforeEach(func() { f.NewEchoDeployment() @@ -84,17 +82,6 @@ var _ = framework.DescribeAnnotation("satisfy", func() { ginkgo.It("should allow multiple auth with satisfy any", func() { host := "auth" - // setup external auth - f.NewHttpbunDeployment() - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - httpbunIP := e.Subsets[0].Addresses[0].IP - // create basic auth secret at ingress s := f.EnsureSecret(buildSecret("uname", "pwd", "basic-secret", f.Namespace)) @@ -105,7 +92,7 @@ var _ = framework.DescribeAnnotation("satisfy", func() { "nginx.ingress.kubernetes.io/auth-realm": "test basic auth", // annotations for external auth - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", // set satisfy any diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 565b8f4ac..d4e20fbf5 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -43,12 +43,28 @@ const HTTPBunService = "httpbun" // NipService name of external service using nip.io const NIPService = "external-nip" +// HTTPBunImage is the default image that is used to deploy HTTPBun with the framwork +var HTTPBunImage = os.Getenv("HTTPBUN_IMAGE") + +// EchoImage is the default image to be used by the echo service +const EchoImage = "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a" + +// TODO: change all Deployment functions to use these options +// in order to reduce complexity and have a unified API accross the +// framework type deploymentOptions struct { - namespace string name string - replicas int - svcAnnotations map[string]string + namespace string image string + port int32 + replicas int + command []string + args []string + env []corev1.EnvVar + volumeMounts []corev1.VolumeMount + volumes []corev1.Volume + svcAnnotations map[string]string + setProbe bool } // WithDeploymentNamespace allows configuring the deployment's namespace @@ -100,22 +116,25 @@ func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { namespace: f.Namespace, name: EchoService, replicas: 1, - image: "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:6fc5aa2994c86575975bb20a5203651207029a0d28e3f491d8a127d08baadab4", + image: EchoImage, } for _, o := range opts { o(options) } - deployment := newDeployment(options.name, options.namespace, options.image, 80, int32(options.replicas), + f.EnsureDeployment(newDeployment( + options.name, + options.namespace, + options.image, + 80, + int32(options.replicas), nil, nil, nil, []corev1.VolumeMount{}, []corev1.Volume{}, true, - ) + )) - f.EnsureDeployment(deployment) - - service := &corev1.Service{ + f.EnsureService(&corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: options.name, Namespace: options.namespace, @@ -134,11 +153,15 @@ func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { "app": options.name, }, }, - } + }) - f.EnsureService(service) - - err := WaitForEndpoints(f.KubeClientSet, DefaultTimeout, options.name, options.namespace, options.replicas) + err := WaitForEndpoints( + f.KubeClientSet, + DefaultTimeout, + options.name, + options.namespace, + options.replicas, + ) assert.Nil(ginkgo.GinkgoT(), err, "waiting for endpoints to become ready") } @@ -147,6 +170,12 @@ func BuildNIPHost(ip string) string { return fmt.Sprintf("%s.nip.io", ip) } +// GetNipHost used to generate a nip host for external DNS resolving +// for the instance deployed by the framework +func (f *Framework) GetNIPHost() string { + return BuildNIPHost(f.HTTPBunIP) +} + // BuildNIPExternalNameService used to generate a service pointing to nip.io to // help resolve to an IP address func BuildNIPExternalNameService(f *Framework, ip, portName string) *corev1.Service { @@ -177,22 +206,27 @@ func (f *Framework) NewHttpbunDeployment(opts ...func(*deploymentOptions)) strin namespace: f.Namespace, name: HTTPBunService, replicas: 1, - image: "registry.k8s.io/ingress-nginx/e2e-test-httpbun:v20230505-v0.0.1", + image: HTTPBunImage, } for _, o := range opts { o(options) } - deployment := newDeployment(options.name, options.namespace, options.image, 80, int32(options.replicas), + // Create the HTTPBun Deployment + f.EnsureDeployment(newDeployment( + options.name, + options.namespace, + options.image, + 80, + int32(options.replicas), nil, nil, nil, []corev1.VolumeMount{}, []corev1.Volume{}, true, - ) + )) - f.EnsureDeployment(deployment) - - service := &corev1.Service{ + // Create a service pointing to deployment + f.EnsureService(&corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: options.name, Namespace: options.namespace, @@ -211,14 +245,26 @@ func (f *Framework) NewHttpbunDeployment(opts ...func(*deploymentOptions)) strin "app": options.name, }, }, - } + }) - s := f.EnsureService(service) - - err := WaitForEndpoints(f.KubeClientSet, DefaultTimeout, options.name, options.namespace, options.replicas) + // Wait for deployment to become available + err := WaitForEndpoints( + f.KubeClientSet, + DefaultTimeout, + options.name, + options.namespace, + options.replicas, + ) assert.Nil(ginkgo.GinkgoT(), err, "waiting for endpoints to become ready") - return s.Spec.ClusterIPs[0] + // Get cluster ip for HTTPBun to be used in tests + e, err := f.KubeClientSet. + CoreV1(). + Endpoints(f.Namespace). + Get(context.TODO(), HTTPBunService, metav1.GetOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "failed to get httpbun endpoint") + + return e.Subsets[0].Addresses[0].IP } // NewSlowEchoDeployment creates a new deployment of the slow echo server image in a particular namespace. @@ -276,13 +322,16 @@ func (f *Framework) NGINXDeployment(name string, cfg string, waitendpoint bool) "nginx.conf": cfg, } - _, err := f.KubeClientSet.CoreV1().ConfigMaps(f.Namespace).Create(context.TODO(), &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: f.Namespace, - }, - Data: cfgMap, - }, metav1.CreateOptions{}) + _, err := f.KubeClientSet. + CoreV1(). + ConfigMaps(f.Namespace). + Create(context.TODO(), &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: f.Namespace, + }, + Data: cfgMap, + }, metav1.CreateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "creating configmap") deployment := newDeployment(name, f.Namespace, f.GetNginxBaseImage(), 80, 1, diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index a3d5ea760..69f6dae78 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -67,16 +67,32 @@ type Framework struct { IngressClass string pod *v1.Pod + // We use httpbun as a service that we route to in our tests through + // the ingress controller. We add it as part of the framework as it + // is used extensively + HTTPBunIP string + HTTPBunEnabled bool +} + +// WithHTTPBunEnabled deploys an instance of HTTPBun for the specific test +func WithHTTPBunEnabled() func(*Framework) { + return func(f *Framework) { + f.HTTPBunEnabled = true + } } // NewDefaultFramework makes a new framework and sets up a BeforeEach/AfterEach for // you (you can write additional before/after each functions). -func NewDefaultFramework(baseName string) *Framework { +func NewDefaultFramework(baseName string, opts ...func(*Framework)) *Framework { defer ginkgo.GinkgoRecover() f := &Framework{ BaseName: baseName, } + // set framework options + for _, o := range opts { + o(f) + } ginkgo.BeforeEach(f.BeforeEach) ginkgo.AfterEach(f.AfterEach) @@ -86,12 +102,16 @@ func NewDefaultFramework(baseName string) *Framework { // NewSimpleFramework makes a new framework that allows the usage of a namespace // for arbitraty tests. -func NewSimpleFramework(baseName string) *Framework { +func NewSimpleFramework(baseName string, opts ...func(*Framework)) *Framework { defer ginkgo.GinkgoRecover() f := &Framework{ BaseName: baseName, } + // set framework options + for _, o := range opts { + o(f) + } ginkgo.BeforeEach(f.CreateEnvironment) ginkgo.AfterEach(f.DestroyEnvironment) @@ -140,6 +160,11 @@ func (f *Framework) BeforeEach() { assert.Nil(ginkgo.GinkgoT(), err, "updating ingress controller pod information") f.WaitForNginxListening(80) + + // If HTTPBun is enabled deploy an instance to the namespace + if f.HTTPBunEnabled { + f.HTTPBunIP = f.NewHttpbunDeployment() + } } // AfterEach deletes the namespace, after reading its events. diff --git a/test/e2e/run-e2e-suite.sh b/test/e2e/run-e2e-suite.sh index a3bf589cd..b56312afd 100755 --- a/test/e2e/run-e2e-suite.sh +++ b/test/e2e/run-e2e-suite.sh @@ -51,6 +51,7 @@ fi BASEDIR=$(dirname "$0") NGINX_BASE_IMAGE=$(cat $BASEDIR/../../NGINX_BASE) +HTTPBUN_IMAGE=$(cat $BASEDIR/HTTPBUN_IMAGE) echo -e "${BGREEN}Granting permissions to ingress-nginx e2e service account...${NC}" kubectl create serviceaccount ingress-nginx-e2e || true @@ -79,6 +80,7 @@ kubectl run --rm \ --env="IS_CHROOT=${IS_CHROOT:-false}"\ --env="E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS}" \ --env="NGINX_BASE_IMAGE=${NGINX_BASE_IMAGE}" \ + --env="HTTPBUN_IMAGE=${HTTPBUN_IMAGE}" \ --overrides='{ "apiVersion": "v1", "spec":{"serviceAccountName": "ingress-nginx-e2e"}}' \ e2e --image=nginx-ingress-controller:e2e diff --git a/test/e2e/servicebackend/service_externalname.go b/test/e2e/servicebackend/service_externalname.go index 2fd6cd080..89ae77b10 100644 --- a/test/e2e/servicebackend/service_externalname.go +++ b/test/e2e/servicebackend/service_externalname.go @@ -35,7 +35,7 @@ import ( ) var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { - f := framework.NewDefaultFramework("type-externalname") + f := framework.NewDefaultFramework("type-externalname", framework.WithHTTPBunEnabled()) ginkgo.It("works with external name set to incomplete fqdn", func() { f.NewEchoDeployment() @@ -43,7 +43,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBunService, + Name: framework.NIPService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ @@ -51,10 +51,15 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Type: corev1.ServiceTypeExternalName, }, } - f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.NIPService, + 80, + nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -70,10 +75,6 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName without a port defined", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" svc := &corev1.Service{ @@ -82,17 +83,23 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: framework.BuildNIPHost(ip), + ExternalName: f.GetNIPHost(), Type: corev1.ServiceTypeExternalName, }, } - f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), + "nginx.ingress.kubernetes.io/upstream-vhost": f.GetNIPHost(), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) + + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -108,19 +115,21 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName with a port defined", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" - svc := framework.BuildNIPExternalNameService(f, ip, host) + svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), + "nginx.ingress.kubernetes.io/upstream-vhost": f.GetNIPHost(), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -140,7 +149,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBunService, + Name: framework.NIPService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ @@ -148,10 +157,15 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Type: corev1.ServiceTypeExternalName, }, } - f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.NIPService, + 80, + nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -167,19 +181,22 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using a port name", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" - svc := framework.BuildNIPExternalNameService(f, ip, host) + svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), + "nginx.ingress.kubernetes.io/upstream-vhost": f.GetNIPHost(), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations) + namedBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ Name: framework.NIPService, @@ -188,6 +205,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }, }, } + ing.Spec.Rules[0].HTTP.Paths[0].Backend = namedBackend f.EnsureIngress(ing) @@ -204,10 +222,6 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using FQDN with trailing dot", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" svc := &corev1.Service{ @@ -216,14 +230,19 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: framework.BuildNIPHost(ip), + ExternalName: f.GetNIPHost(), Type: corev1.ServiceTypeExternalName, }, } - f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -239,20 +258,23 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should update the external name after a service update", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" - svc := framework.BuildNIPExternalNameService(f, ip, host) + svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), + "nginx.ingress.kubernetes.io/upstream-vhost": f.GetNIPHost(), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations) + namedBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ Name: framework.NIPService, @@ -279,14 +301,20 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains(ginkgo.GinkgoT(), body, `"X-Forwarded-Host": "echo"`) - svc, err := f.KubeClientSet.CoreV1().Services(f.Namespace).Get(context.TODO(), framework.NIPService, metav1.GetOptions{}) + svc, err := f.KubeClientSet. + CoreV1(). + Services(f.Namespace). + Get(context.TODO(), framework.NIPService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining external service") - ip = f.NewHttpbunDeployment(framework.WithDeploymentName("eu-server")) - + //Deploy a new instance to switch routing to + ip := f.NewHttpbunDeployment(framework.WithDeploymentName("eu-server")) svc.Spec.ExternalName = framework.BuildNIPHost(ip) - _, err = f.KubeClientSet.CoreV1().Services(f.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{}) + _, err = f.KubeClientSet. + CoreV1(). + Services(f.Namespace). + Update(context.Background(), svc, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating external service") framework.Sleep() @@ -302,21 +330,31 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains(ginkgo.GinkgoT(), body, `"X-Forwarded-Host": "echo"`) ginkgo.By("checking the service is updated to use new host") - curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) + curlCmd := fmt.Sprintf( + "curl --fail --silent http://localhost:%v/configuration/backends", + nginx.StatusPort, + ) + output, err := f.ExecIngressPod(curlCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf("{\"address\":\"%s\"", framework.BuildNIPHost(ip))) + assert.Contains( + ginkgo.GinkgoT(), + output, + fmt.Sprintf("{\"address\":\"%s\"", framework.BuildNIPHost(ip)), + ) }) ginkgo.It("should sync ingress on external name service addition/deletion", func() { - // This is a workaround so we only depend on a self hosted instance of - // httpbun - ip := f.NewHttpbunDeployment() - host := "echo" // Create the Ingress first - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.NIPService, 80, nil) + ing := framework.NewSingleIngress(host, + "/", + host, + f.Namespace, + framework.NIPService, + 80, + nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -332,7 +370,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Status(http.StatusServiceUnavailable) // Now create the service - svc := framework.BuildNIPExternalNameService(f, ip, host) + svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) framework.Sleep() @@ -345,7 +383,10 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Status(http.StatusOK) // And back to 503 after deleting the service - err := f.KubeClientSet.CoreV1().Services(f.Namespace).Delete(context.TODO(), framework.NIPService, metav1.DeleteOptions{}) + err := f.KubeClientSet. + CoreV1(). + Services(f.Namespace). + Delete(context.TODO(), framework.NIPService, metav1.DeleteOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error deleting external service") framework.Sleep() diff --git a/test/e2e/settings/brotli.go b/test/e2e/settings/brotli.go index a13678f66..aacaddec5 100644 --- a/test/e2e/settings/brotli.go +++ b/test/e2e/settings/brotli.go @@ -28,14 +28,13 @@ import ( ) var _ = framework.IngressNginxDescribe("brotli", func() { - f := framework.NewDefaultFramework("brotli") + f := framework.NewDefaultFramework( + "brotli", + framework.WithHTTPBunEnabled(), + ) host := "brotli" - ginkgo.BeforeEach(func() { - f.NewHttpbunDeployment() - }) - ginkgo.It("should only compress responses that meet the `brotli-min-length` condition", func() { brotliMinLength := 24 contentEncoding := "application/octet-stream" diff --git a/test/e2e/settings/disable_service_external_name.go b/test/e2e/settings/disable_service_external_name.go index 7f03e5355..4ecf69e81 100644 --- a/test/e2e/settings/disable_service_external_name.go +++ b/test/e2e/settings/disable_service_external_name.go @@ -33,7 +33,10 @@ import ( ) var _ = framework.IngressNginxDescribe("[Flag] disable-service-external-name", func() { - f := framework.NewDefaultFramework("disabled-service-external-name") + f := framework.NewDefaultFramework( + "disabled-service-external-name", + framework.WithHTTPBunEnabled(), + ) ginkgo.BeforeEach(func() { f.NewEchoDeployment(framework.WithDeploymentReplicas(2)) @@ -54,21 +57,18 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-service-external-name", f externalhost := "echo-external-svc.com" - ip := f.NewHttpbunDeployment() - svc := framework.BuildNIPExternalNameService(f, ip, "echo") - f.EnsureService(svc) + f.EnsureService(framework.BuildNIPExternalNameService(f, f.HTTPBunIP, "echo")) - svcexternal := &corev1.Service{ + f.EnsureService(&corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: "external", Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: framework.BuildNIPHost(ip), + ExternalName: f.GetNIPHost(), Type: corev1.ServiceTypeExternalName, }, - } - f.EnsureService(svcexternal) + }) ingexternal := framework.NewSingleIngress(externalhost, "/", externalhost, f.Namespace, "external", 80, nil) f.EnsureIngress(ingexternal) diff --git a/test/e2e/settings/global_external_auth.go b/test/e2e/settings/global_external_auth.go index c5964299f..cc98099ae 100644 --- a/test/e2e/settings/global_external_auth.go +++ b/test/e2e/settings/global_external_auth.go @@ -32,7 +32,10 @@ import ( ) var _ = framework.DescribeSetting("[Security] global-auth-url", func() { - f := framework.NewDefaultFramework("global-external-auth") + f := framework.NewDefaultFramework( + "global-external-auth", + framework.WithHTTPBunEnabled(), + ) host := "global-external-auth" @@ -50,7 +53,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { ginkgo.BeforeEach(func() { f.NewEchoDeployment() - f.NewHttpbunDeployment() }) ginkgo.Context("when global external authentication is configured", func() { @@ -307,9 +309,9 @@ http { assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbunIP := e.Subsets[0].Addresses[0].IP + nginxIP := e.Subsets[0].Addresses[0].IP - f.UpdateNginxConfigMapData(globalExternalAuthURLSetting, fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbunIP)) + f.UpdateNginxConfigMapData(globalExternalAuthURLSetting, fmt.Sprintf("http://%s/cookies/set/alma/armud", nginxIP)) ing1 = framework.NewSingleIngress(host, "/", host, f.Namespace, "http-cookie-with-error", 80, nil) f.EnsureIngress(ing1) diff --git a/test/e2e/settings/listen_nondefault_ports.go b/test/e2e/settings/listen_nondefault_ports.go index e682cef06..7e3b11b21 100644 --- a/test/e2e/settings/listen_nondefault_ports.go +++ b/test/e2e/settings/listen_nondefault_ports.go @@ -17,14 +17,12 @@ limitations under the License. package settings import ( - "context" "fmt" "net/http" "strings" "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -33,7 +31,7 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun host := "forwarded-headers" - f := framework.NewDefaultFramework("forwarded-port-headers") + f := framework.NewDefaultFramework("forwarded-port-headers", framework.WithHTTPBunEnabled()) ginkgo.BeforeEach(func() { f.NewEchoDeployment() @@ -98,21 +96,8 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun ginkgo.Context("when external authentication is configured", func() { ginkgo.It("should set the X-Forwarded-Port header to 443", func() { - f.NewHttpbunDeployment() - - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) - assert.Nil(ginkgo.GinkgoT(), err) - - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err) - - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") - assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - - httpbunIP := e.Subsets[0].Addresses[0].IP - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } diff --git a/test/e2e/settings/ssl_passthrough.go b/test/e2e/settings/ssl_passthrough.go index a906a2d11..f0859f878 100644 --- a/test/e2e/settings/ssl_passthrough.go +++ b/test/e2e/settings/ssl_passthrough.go @@ -34,7 +34,7 @@ import ( ) var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { - f := framework.NewDefaultFramework("ssl-passthrough") + f := framework.NewDefaultFramework("ssl-passthrough", framework.WithHTTPBunEnabled()) ginkgo.BeforeEach(func() { err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { @@ -86,7 +86,14 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { "nginx.ingress.kubernetes.io/ssl-passthrough": "true", } - ingressDef := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, echoName, 80, annotations) + ingressDef := framework.NewSingleIngressWithTLS(host, + "/", + host, + []string{host}, + f.Namespace, + echoName, + 80, + annotations) tlsConfig, err := framework.CreateIngressTLSSecret(f.KubeClientSet, ingressDef.Spec.TLS[0].Hosts, ingressDef.Spec.TLS[0].SecretName, @@ -119,7 +126,17 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { Value: "/certs/tls.key", }, } - f.NewDeploymentWithOpts("echopass", "ghcr.io/sharat87/httpbun:latest", 80, 1, nil, nil, envs, volumeMount, volume, false) + + f.NewDeploymentWithOpts("echopass", + framework.HTTPBunImage, + 80, + 1, + nil, + nil, + envs, + volumeMount, + volume, + false) f.EnsureIngress(ingressDef) @@ -133,7 +150,14 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { /* This one should not receive traffic as it does not contain passthrough annotation */ hostBad := "noannotationnopassthrough.com" - ingBad := f.EnsureIngress(framework.NewSingleIngressWithTLS(hostBad, "/", hostBad, []string{hostBad}, f.Namespace, echoName, 80, nil)) + ingBad := f.EnsureIngress(framework.NewSingleIngressWithTLS(hostBad, + "/", + hostBad, + []string{hostBad}, + f.Namespace, + echoName, + 80, + nil)) tlsConfigBad, err := framework.CreateIngressTLSSecret(f.KubeClientSet, ingBad.Spec.TLS[0].Hosts, ingBad.Spec.TLS[0].SecretName, From 436df32c2c50dee5b984e06b86b2660f32a5a384 Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Mon, 12 Jun 2023 12:47:48 +0200 Subject: [PATCH 234/822] add distroless otel init (#10035) add distroless otel init --- charts/ingress-nginx/templates/_helpers.tpl | 6 +- .../templates/controller-deployment.yaml | 2 +- images/opentelemetry/rootfs/Dockerfile | 18 ++- images/opentelemetry/rootfs/build.sh | 3 + images/opentelemetry/rootfs/go.mod | 3 + images/opentelemetry/rootfs/init_module.go | 104 ++++++++++++++++++ images/opentelemetry/rootfs/init_module.sh | 22 ---- 7 files changed, 131 insertions(+), 27 deletions(-) create mode 100644 images/opentelemetry/rootfs/go.mod create mode 100644 images/opentelemetry/rootfs/init_module.go delete mode 100755 images/opentelemetry/rootfs/init_module.sh diff --git a/charts/ingress-nginx/templates/_helpers.tpl b/charts/ingress-nginx/templates/_helpers.tpl index 7db5b2ca8..548e8cf12 100644 --- a/charts/ingress-nginx/templates/_helpers.tpl +++ b/charts/ingress-nginx/templates/_helpers.tpl @@ -201,8 +201,12 @@ Extra modules. - name: {{ .name }} image: {{ .image }} + {{- if .distroless | default false }} + command: ['/init_module'] + {{- else }} command: ['sh', '-c', '/usr/local/bin/init_module.sh'] - {{- if (.containerSecurityContext) }} + {{- end }} + {{- if .containerSecurityContext }} securityContext: {{ .containerSecurityContext | toYaml | nindent 4 }} {{- end }} volumeMounts: diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 323d87623..7fe8804ea 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -190,7 +190,7 @@ spec: {{- end }} {{- if .Values.controller.opentelemetry.enabled}} {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}} + {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" false) | nindent 8}} {{- end}} {{- end }} {{- if .Values.controller.hostNetwork }} diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index 69d82cda2..d15c28bbf 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -21,9 +21,11 @@ COPY . /opt/third_party/ # install build tools RUN apk update \ && apk upgrade \ - && apk add -U bash cmake \ + && apk add -U bash cmake ninja \ && bash /opt/third_party/build.sh -p +ENV NINJA_STATUS "[%p/%f/%t]" + # install gRPC FROM base as grpc RUN bash /opt/third_party/build.sh -g v1.49.2 @@ -39,7 +41,17 @@ COPY --from=grpc /opt/third_party/install/ /usr COPY --from=otel-cpp /opt/third_party/install/ /usr RUN bash /opt/third_party/build.sh -n -FROM alpine:3.18.0 as final -COPY --from=base /opt/third_party/init_module.sh /usr/local/bin/init_module.sh +FROM cgr.dev/chainguard/go:latest as build-init + +WORKDIR /go/src/app +COPY . . + +RUN go mod download +RUN CGO_ENABLED=0 go build -o /go/bin/init_module + +FROM cgr.dev/chainguard/static as final +COPY --from=build-init /go/bin/init_module / COPY --from=nginx /etc/nginx/modules /etc/nginx/modules COPY --from=nginx /opt/third_party/install/lib /etc/nginx/modules + +CMD ["/init_module"] diff --git a/images/opentelemetry/rootfs/build.sh b/images/opentelemetry/rootfs/build.sh index 6ad4601c6..30faad304 100755 --- a/images/opentelemetry/rootfs/build.sh +++ b/images/opentelemetry/rootfs/build.sh @@ -70,6 +70,7 @@ install_grpc() mkdir -p $BUILD_PATH/grpc cd ${BUILD_PATH}/grpc cmake -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ + -G Ninja \ -DGRPC_GIT_TAG=${GRPC_GIT_TAG} /opt/third_party \ -DgRPC_BUILD_GRPC_NODE_PLUGIN=OFF \ -DgRPC_BUILD_GRPC_OBJECTIVE_C_PLUGIN=OFF \ @@ -92,6 +93,7 @@ install_otel() cd .build cmake -DCMAKE_BUILD_TYPE=Release \ + -G Ninja \ -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \ -DWITH_ZIPKIN=OFF \ -DWITH_JAEGER=OFF \ @@ -143,6 +145,7 @@ install_nginx() mkdir -p build cd build cmake -DCMAKE_BUILD_TYPE=Release \ + -G Ninja \ -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ -DBUILD_SHARED_LIBS=ON \ -DNGINX_VERSION=${NGINX_VERSION} \ diff --git a/images/opentelemetry/rootfs/go.mod b/images/opentelemetry/rootfs/go.mod new file mode 100644 index 000000000..f636c81b7 --- /dev/null +++ b/images/opentelemetry/rootfs/go.mod @@ -0,0 +1,3 @@ +module init-otel + +go 1.20 diff --git a/images/opentelemetry/rootfs/init_module.go b/images/opentelemetry/rootfs/init_module.go new file mode 100644 index 000000000..bebec728f --- /dev/null +++ b/images/opentelemetry/rootfs/init_module.go @@ -0,0 +1,104 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package main + +import ( + "fmt" + "io" + "os" + "path/filepath" +) + +func main() { + // Enable error handling for all operations + err := run() + if err != nil { + fmt.Fprintf(os.Stderr, "Error: %v\n", err) + os.Exit(1) + } +} + +func run() error { + // Create the target directory if it doesn't exist + targetDir := "/modules_mount/etc/nginx/modules/otel" + err := os.MkdirAll(targetDir, os.ModePerm) + if err != nil { + return fmt.Errorf("failed to create target directory: %w", err) + } + + // Copy files from source directory to target directory + sourceDir := "/etc/nginx/modules/" + err = filepath.Walk(sourceDir, func(path string, info os.FileInfo, err error) error { + if err != nil { + return err + } + + // Skip directories + if info.IsDir() { + return nil + } + + // Calculate the destination path + relPath, err := filepath.Rel(sourceDir, path) + if err != nil { + return err + } + destPath := filepath.Join(targetDir, relPath) + + // Create the destination directory if it doesn't exist + destDir := filepath.Dir(destPath) + err = os.MkdirAll(destDir, os.ModePerm) + if err != nil { + return err + } + + // Copy the file + err = copyFile(path, destPath) + if err != nil { + return err + } + + return nil + }) + + if err != nil { + return fmt.Errorf("failed to copy files: %w", err) + } + + return nil +} + +func copyFile(sourcePath, destPath string) error { + sourceFile, err := os.Open(sourcePath) + if err != nil { + return err + } + defer sourceFile.Close() + + destFile, err := os.Create(destPath) + if err != nil { + return err + } + defer destFile.Close() + + _, err = io.Copy(destFile, sourceFile) + if err != nil { + return err + } + + return nil +} diff --git a/images/opentelemetry/rootfs/init_module.sh b/images/opentelemetry/rootfs/init_module.sh deleted file mode 100755 index 5a675aa2b..000000000 --- a/images/opentelemetry/rootfs/init_module.sh +++ /dev/null @@ -1,22 +0,0 @@ -#!/bin/sh - -# Copyright 2021 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -set -o errexit -set -o nounset -set -o pipefail - -mkdir -p /modules_mount/etc/nginx/modules/otel -cp -R /etc/nginx/modules/* /modules_mount/etc/nginx/modules/otel From dd6d8e0d9f3def3bf9a85a1bac972418e67e5212 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Jun 2023 05:03:48 -0700 Subject: [PATCH 235/822] Bump docker/setup-buildx-action from 2.5.0 to 2.6.0 (#10077) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.5.0 to 2.6.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c...6a58db7e0d21ca03e6c44877909e80e45217eed2) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3406b250f..756d65c3e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0 + uses: docker/setup-buildx-action@6a58db7e0d21ca03e6c44877909e80e45217eed2 # v2.6.0 with: version: latest From 18e6bfdebfcc2ba1bf2f369e7fd10af72bd2f428 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Jun 2023 05:05:47 -0700 Subject: [PATCH 236/822] Bump aquasecurity/trivy-action from 0.10.0 to 0.11.2 (#10078) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.10.0 to 0.11.2. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/e5f43133f6e8736992c9f3c1b3296e24b37e17f2...41f05d9ecffa2ed3f1580af306000f734b733e54) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 069c9f974..9814c2c95 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -60,7 +60,7 @@ jobs: - name: Scan image with AquaSec/Trivy id: scan - uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # v0.10.0 + uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54 # v0.11.2 with: image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }} format: 'sarif' From 5544c1f1f639e4f13905b927854d4e48e83d5658 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Jun 2023 05:33:49 -0700 Subject: [PATCH 237/822] Bump docker/setup-qemu-action from 2.1.0 to 2.2.0 (#10075) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.1.0 to 2.2.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/e81a89b1732b9c48d79cd809d8d81d79c4647a18...2b82ce82d56a2a04d2637cd93a637ae1b359c0a7) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 756d65c3e..9e3e97edf 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -154,7 +154,7 @@ jobs: check-latest: true - name: Set up QEMU - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0 + uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0 - name: Set up Docker Buildx id: buildx From 4eeee031c76ac3403f845c8bf85e95caef87fee0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Jun 2023 05:35:49 -0700 Subject: [PATCH 238/822] Bump actions/checkout from 3.5.2 to 3.5.3 (#10076) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.2 to 3.5.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8e5e7e5ab8b370d6c329ec480221332ada57f0ab...c85c95e3d7251135ab7dc9ce3241c5835cc595a9) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 22 +++++++++++----------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9e3e97edf..abb2af532 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -68,7 +68,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Run Gosec Security Scanner uses: securego/gosec@c5ea1b7bdd9efc3792e513258853552b0ae31e06 # v2.16.0 @@ -85,7 +85,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Set up Go id: go @@ -104,7 +104,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Set up Go id: go @@ -123,7 +123,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Set up Go id: go @@ -144,7 +144,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Set up Go id: go @@ -211,7 +211,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Setup Go uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 @@ -286,7 +286,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -336,7 +336,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -380,7 +380,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -447,7 +447,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 4f04bdaed..625c2f461 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: 'Dependency Review' uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 1a2ceaa83..f7aee6610 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 2a82fa124..6303b6a27 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 9e87bf1b2..36f1f1ede 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index c5c6fc2b1..6088f77f8 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 72acf608a..72a112ac4 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 9814c2c95..af7d8bda1 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - shell: bash id: test From f1e3f2fa3c38a8a5473bd253175c3f6525bc3f53 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Tue, 13 Jun 2023 10:45:58 +0800 Subject: [PATCH 239/822] docs: add netlify configuration (#10073) Signed-off-by: Jintao Zhang --- Makefile | 5 +++++ netlify.toml | 10 ++++++++++ 2 files changed, 15 insertions(+) create mode 100644 netlify.toml diff --git a/Makefile b/Makefile index fc40a39bb..7b413141a 100644 --- a/Makefile +++ b/Makefile @@ -262,3 +262,8 @@ release: ensure-buildx clean --build-arg COMMIT_SHA="$(COMMIT_SHA)" \ --build-arg BUILD_ID="$(BUILD_ID)" \ -t $(REGISTRY)/controller-chroot:$(TAG) rootfs -f rootfs/Dockerfile-chroot + +.PHONY: build-docs +build-docs: + pip install -U mkdocs-material==6.2.4 mkdocs-awesome-pages-plugin mkdocs-minify-plugin mkdocs-redirects + mkdocs build --config-file mkdocs.yml diff --git a/netlify.toml b/netlify.toml new file mode 100644 index 000000000..add8d4fc3 --- /dev/null +++ b/netlify.toml @@ -0,0 +1,10 @@ +# netlify configuration +[build] +publish = "site" +command = "make build-docs" +# available here https://github.com/netlify/build-image/blob/focal/included_software.md#languages +environment = { PYTHON_VERSION = "3.8" } + +[context.deploy-preview] + publish = "site/" + command = "make build-docs" From cccba35005962f9eee96d2b592cc5b7b1485d965 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Wed, 14 Jun 2023 03:55:59 +0800 Subject: [PATCH 240/822] Revert "Remove fastcgi feature" (#10081) * Revert "Remove fastcgi feature (#9864)" This reverts commit 90ed0ccdbe4edd55ad4ab16ffec40be64f3308d9. * revert fastcgi* annotations warning Signed-off-by: Jintao Zhang --------- Signed-off-by: Jintao Zhang --- .github/workflows/ci.yaml | 6 + MANUAL_RELEASE.md | 2 + docs/e2e-tests.md | 131 +------- docs/kubectl-plugin.md | 1 + docs/user-guide/fcgi-services.md | 118 +++++++- .../nginx-configuration/annotations.md | 2 +- images/fastcgi-helloserver/Makefile | 59 ++++ images/fastcgi-helloserver/cloudbuild.yaml | 22 ++ images/fastcgi-helloserver/rootfs/Dockerfile | 32 ++ images/fastcgi-helloserver/rootfs/main.go | 30 ++ internal/ingress/annotations/annotations.go | 62 ++-- .../annotations/backendprotocol/main.go | 2 +- internal/ingress/annotations/fastcgi/main.go | 106 +++++++ .../ingress/annotations/fastcgi/main_test.go | 285 ++++++++++++++++++ internal/ingress/annotations/parser/main.go | 1 + internal/ingress/controller/controller.go | 5 +- .../ingress/controller/controller_test.go | 2 +- .../ingress/controller/template/template.go | 3 + .../controller/template/template_test.go | 2 + pkg/apis/ingress/types.go | 4 + pkg/apis/ingress/types_equals.go | 4 + rootfs/etc/nginx/template/nginx.tmpl | 11 + test/e2e/annotations/backendprotocol.go | 15 + test/e2e/annotations/fastcgi.go | 125 ++++++++ test/e2e/framework/fastcgi_helloserver.go | 104 +++++++ 25 files changed, 975 insertions(+), 159 deletions(-) create mode 100644 images/fastcgi-helloserver/Makefile create mode 100644 images/fastcgi-helloserver/cloudbuild.yaml create mode 100755 images/fastcgi-helloserver/rootfs/Dockerfile create mode 100644 images/fastcgi-helloserver/rootfs/main.go create mode 100644 internal/ingress/annotations/fastcgi/main.go create mode 100644 internal/ingress/annotations/fastcgi/main_test.go create mode 100644 test/e2e/annotations/fastcgi.go create mode 100644 test/e2e/framework/fastcgi_helloserver.go diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index abb2af532..9764a5e74 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -391,6 +391,8 @@ jobs: - 'images/custom-error-pages/**' cfssl: - 'images/cfssl/**' + fastcgi-helloserver: + - 'images/fastcgi-helloserver/**' echo: - 'images/echo/**' go-grpc-greeter-server: @@ -410,6 +412,10 @@ jobs: if: ${{ steps.filter-images.outputs.cfssl == 'true' }} run: | cd images/cfssl && make build + - name: fastcgi-helloserver + if: ${{ steps.filter-images.outputs.fastcgi-helloserver == 'true' }} + run: | + cd images/fastcgi-helloserver && make build - name: echo image build if: ${{ steps.filter-images.outputs.echo == 'true' }} run: | diff --git a/MANUAL_RELEASE.md b/MANUAL_RELEASE.md index 4b4df0ec6..d7144b85d 100644 --- a/MANUAL_RELEASE.md +++ b/MANUAL_RELEASE.md @@ -56,6 +56,8 @@ - [cfssl](https://github.com/kubernetes/ingress-nginx/tree/main/images/cfssl) + - [fastcgi-helloserver](https://github.com/kubernetes/ingress-nginx/tree/main/images/fastcgi-helloserver) + - [httpbin](https://github.com/kubernetes/ingress-nginx/tree/main/images/httpbin) - [kube-webhook-certgen](https://github.com/kubernetes/ingress-nginx/tree/main/images/kube-webhook-certgen) diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 64d35c79a..025ff686d 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -108,6 +108,7 @@ Do not try to edit it manually. - [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L49) - [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) - [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) +- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) - [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) ### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) @@ -191,6 +192,13 @@ Do not try to edit it manually. - [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) - [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) + +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) + ### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) - [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) @@ -342,101 +350,6 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) - -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) - -### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) - -- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) -- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) -- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) -- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) -- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) -- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) -- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) -- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) -- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) -- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) -- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) -- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) -- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) -- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) -- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) - -### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) - -- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) -- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) -- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) -- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) -- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) - -### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) - -- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) -- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) -- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) -- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) -- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) -- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) -- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) -- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) -- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) -- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) -- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) -- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) -- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L485) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L494) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L505) -- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L529) -- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L552) -- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L570) -- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L590) -- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L609) -- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L623) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L678) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L687) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L698) -- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L772) -- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) -- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L820) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L849) -- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) -- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) - -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) - -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) -- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) - ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) - [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) @@ -485,6 +398,10 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + ### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) @@ -561,30 +478,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) -### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) diff --git a/docs/kubectl-plugin.md b/docs/kubectl-plugin.md index 9dc808642..9e5a5dcc6 100644 --- a/docs/kubectl-plugin.md +++ b/docs/kubectl-plugin.md @@ -200,6 +200,7 @@ kubectl ingress-nginx conf -n ingress-nginx --host testaddr.local ```console $ kubectl ingress-nginx exec -i -n ingress-nginx -- ls /etc/nginx +fastcgi_params geoip lua mime.types diff --git a/docs/user-guide/fcgi-services.md b/docs/user-guide/fcgi-services.md index d4f1d1f1e..db4d9428b 100644 --- a/docs/user-guide/fcgi-services.md +++ b/docs/user-guide/fcgi-services.md @@ -2,10 +2,118 @@ # Exposing FastCGI Servers -**This feature has been removed from Ingress NGINX** +> **FastCGI** is a [binary protocol](https://en.wikipedia.org/wiki/Binary_protocol "Binary protocol") for interfacing interactive programs with a [web server](https://en.wikipedia.org/wiki/Web_server "Web server"). [...] (It's) aim is to reduce the overhead related to interfacing between web server and CGI programs, allowing a server to handle more web page requests per unit of time. +> +> — Wikipedia -People willing to use fastcgi servers, should create an NGINX + FastCGI service and expose -this service via Ingress NGINX. +The _ingress-nginx_ ingress controller can be used to directly expose [FastCGI](https://en.wikipedia.org/wiki/FastCGI) servers. Enabling FastCGI in your Ingress only requires setting the _backend-protocol_ annotation to `FCGI`, and with a couple more annotations you can customize the way _ingress-nginx_ handles the communication with your FastCGI _server_. -We recommend using images like `cgr.dev/chainguard/nginx:latest` and expose your fast_cgi application -as another container on this Pod. + +## Example Objects to Expose a FastCGI Pod + +The _Pod_ example object below exposes port `9000`, which is the conventional FastCGI port. + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: example-app +labels: + app: example-app +spec: + containers: + - name: example-app + image: example-app:1.0 + ports: + - containerPort: 9000 + name: fastcgi +``` + +The _Service_ object example below matches port `9000` from the _Pod_ object above. + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: example-service +spec: + selector: + app: example-app + ports: + - port: 9000 + targetPort: 9000 + name: fastcgi +``` + +And the _Ingress_ and _ConfigMap_ objects below demonstrates the supported _FastCGI_ specific annotations (NGINX actually has 50 FastCGI directives, all of which have not been exposed in the ingress yet), and matches the service `example-service`, and the port named `fastcgi` from above. The _ConfigMap_ **must** be created first for the _Ingress Controller_ to be able to find it when the _Ingress_ object is created, otherwise you will need to restart the _Ingress Controller_ pods. + +```yaml +# The ConfigMap MUST be created first for the ingress controller to be able to +# find it when the Ingress object is created. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: example-cm +data: + SCRIPT_FILENAME: "/example/index.php" + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + nginx.ingress.kubernetes.io/backend-protocol: "FCGI" + nginx.ingress.kubernetes.io/fastcgi-index: "index.php" + nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-cm" + name: example-app +spec: + ingressClassName: nginx + rules: + - host: app.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: example-service + port: + name: fastcgi +``` + +## FastCGI Ingress Annotations + +To enable FastCGI, the `nginx.ingress.kubernetes.io/backend-protocol` annotation needs to be set to `FCGI`, which overrides the default `HTTP` value. + +> `nginx.ingress.kubernetes.io/backend-protocol: "FCGI"` + +**This enables the _FastCGI_ mode for all paths defined in the _Ingress_ object** + +### The `nginx.ingress.kubernetes.io/fastcgi-index` Annotation + +To specify an index file, the `fastcgi-index` annotation value can optionally be set. In the example below, the value is set to `index.php`. This annotation corresponds to [the _NGINX_ `fastcgi_index` directive](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_index). + +> `nginx.ingress.kubernetes.io/fastcgi-index: "index.php"` + +### The `nginx.ingress.kubernetes.io/fastcgi-params-configmap` Annotation + +To specify [_NGINX_ `fastcgi_param` directives](https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html#fastcgi_param), the `fastcgi-params-configmap` annotation is used, which in turn must lead to a _ConfigMap_ object containing the _NGINX_ `fastcgi_param` directives as key/values. + +> `nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-configmap"` + +And the _ConfigMap_ object to specify the `SCRIPT_FILENAME` and `HTTP_PROXY` _NGINX's_ `fastcgi_param` directives will look like the following: + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: example-configmap +data: + SCRIPT_FILENAME: "/example/index.php" + HTTP_PROXY: "" +``` +Using the _namespace/_ prefix is also supported, for example: + +> `nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-namespace/example-configmap"` diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index fc43a47b2..b515a9f3b 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -894,7 +894,7 @@ Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf ### Backend Protocol Using `backend-protocol` annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces `secure-backends` in older versions) -Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP +Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP and FCGI By default NGINX uses `HTTP`. diff --git a/images/fastcgi-helloserver/Makefile b/images/fastcgi-helloserver/Makefile new file mode 100644 index 000000000..4d277a19d --- /dev/null +++ b/images/fastcgi-helloserver/Makefile @@ -0,0 +1,59 @@ +# Copyright 2020 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Docker image for e2e testing. + +# set default shell +SHELL=/bin/bash -o pipefail -o errexit + +DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) +INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh + +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + +REGISTRY ?= local + +IMAGE = $(REGISTRY)/e2e-test-fastcgi-helloserver + +# required to enable buildx +export DOCKER_CLI_EXPERIMENTAL=enabled + +# build with buildx +PLATFORMS?=linux/amd64,linux/arm,linux/arm64 +OUTPUT= +PROGRESS=plain + +build: ensure-buildx + docker buildx build \ + --platform=${PLATFORMS} $(OUTPUT) \ + --progress=$(PROGRESS) \ + --pull \ + -t $(IMAGE):$(TAG) rootfs + +# push the cross built image +push: OUTPUT=--push +push: build + +# enable buildx +ensure-buildx: +# this is required for cloudbuild +ifeq ("$(wildcard $(INIT_BUILDX))","") + @curl -sSL https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/hack/init-buildx.sh | bash +else + @exec $(INIT_BUILDX) +endif + @echo "done" + +.PHONY: build push ensure-buildx diff --git a/images/fastcgi-helloserver/cloudbuild.yaml b/images/fastcgi-helloserver/cloudbuild.yaml new file mode 100644 index 000000000..a4c9d5eff --- /dev/null +++ b/images/fastcgi-helloserver/cloudbuild.yaml @@ -0,0 +1,22 @@ +timeout: 1800s +options: + substitution_option: ALLOW_LOOSE +steps: + - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 + entrypoint: bash + env: + - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA + - BASE_REF=$_PULL_BASE_REF + - REGISTRY=gcr.io/k8s-staging-ingress-nginx + # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx + # set the home to /root explicitly to if using docker buildx + - HOME=/root + args: + - -c + - | + gcloud auth configure-docker \ + && cd images/fastcgi-helloserver && make push +substitutions: + _GIT_TAG: "12345" + _PULL_BASE_REF: "master" diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile new file mode 100755 index 000000000..a11834373 --- /dev/null +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -0,0 +1,32 @@ +# Copyright 2017 The Kubernetes Authors. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FROM golang:1.20.4-alpine3.18 as builder + +WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi + +COPY . . + +RUN CGO_ENABLED=0 go build -a -installsuffix cgo \ + -ldflags "-s -w" \ + -o fastcgi-helloserver main.go + +# Use distroless as minimal base image to package the binary +# Refer to https://github.com/GoogleContainerTools/distroless for more details +FROM gcr.io/distroless/static:nonroot + +COPY --from=builder /go/src/k8s.io/ingress-nginx/images/fastcgi/fastcgi-helloserver / +USER nonroot:nonroot + +CMD ["/fastcgi-helloserver"] diff --git a/images/fastcgi-helloserver/rootfs/main.go b/images/fastcgi-helloserver/rootfs/main.go new file mode 100644 index 000000000..91db60c26 --- /dev/null +++ b/images/fastcgi-helloserver/rootfs/main.go @@ -0,0 +1,30 @@ +package main + +import ( + "fmt" + "net" + "net/http" + "net/http/fcgi" +) + +func hello(w http.ResponseWriter, r *http.Request) { + keys, ok := r.URL.Query()["name"] + + if !ok || len(keys[0]) < 1 { + fmt.Fprintf(w, "Hello world!") + return + } + + key := keys[0] + fmt.Fprintf(w, "Hello "+string(key)+"!") +} + +func main() { + http.HandleFunc("/hello", hello) + + l, err := net.Listen("tcp", "0.0.0.0:9000") + if err != nil { + panic(err) + } + fcgi.Serve(l, nil) +} diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index ad7dad37d..5bb2bf5e6 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -41,6 +41,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/cors" "k8s.io/ingress-nginx/internal/ingress/annotations/customhttperrors" "k8s.io/ingress-nginx/internal/ingress/annotations/defaultbackend" + "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/http2pushpreload" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" @@ -85,35 +86,37 @@ type Ingress struct { CorsConfig cors.Config CustomHTTPErrors []int DefaultBackend *apiv1.Service - Denied *string - ExternalAuth authreq.Config - EnableGlobalAuth bool - HTTP2PushPreload bool - Opentracing opentracing.Config - Opentelemetry opentelemetry.Config - Proxy proxy.Config - ProxySSL proxyssl.Config - RateLimit ratelimit.Config - GlobalRateLimit globalratelimit.Config - Redirect redirect.Config - Rewrite rewrite.Config - Satisfy string - ServerSnippet string - ServiceUpstream bool - SessionAffinity sessionaffinity.Config - SSLPassthrough bool - UsePortInRedirects bool - UpstreamHashBy upstreamhashby.Config - LoadBalancing string - UpstreamVhost string - Whitelist ipwhitelist.SourceRange - Denylist ipdenylist.SourceRange - XForwardedPrefix string - SSLCipher sslcipher.Config - Logs log.Config - ModSecurity modsecurity.Config - Mirror mirror.Config - StreamSnippet string + //TODO: Change this back into an error when https://github.com/imdario/mergo/issues/100 is resolved + FastCGI fastcgi.Config + Denied *string + ExternalAuth authreq.Config + EnableGlobalAuth bool + HTTP2PushPreload bool + Opentracing opentracing.Config + Opentelemetry opentelemetry.Config + Proxy proxy.Config + ProxySSL proxyssl.Config + RateLimit ratelimit.Config + GlobalRateLimit globalratelimit.Config + Redirect redirect.Config + Rewrite rewrite.Config + Satisfy string + ServerSnippet string + ServiceUpstream bool + SessionAffinity sessionaffinity.Config + SSLPassthrough bool + UsePortInRedirects bool + UpstreamHashBy upstreamhashby.Config + LoadBalancing string + UpstreamVhost string + Whitelist ipwhitelist.SourceRange + Denylist ipdenylist.SourceRange + XForwardedPrefix string + SSLCipher sslcipher.Config + Logs log.Config + ModSecurity modsecurity.Config + Mirror mirror.Config + StreamSnippet string } // Extractor defines the annotation parsers to be used in the extraction of annotations @@ -135,6 +138,7 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "CorsConfig": cors.NewParser(cfg), "CustomHTTPErrors": customhttperrors.NewParser(cfg), "DefaultBackend": defaultbackend.NewParser(cfg), + "FastCGI": fastcgi.NewParser(cfg), "ExternalAuth": authreq.NewParser(cfg), "EnableGlobalAuth": authreqglobal.NewParser(cfg), "HTTP2PushPreload": http2pushpreload.NewParser(cfg), diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index 0140c30a3..d8ea72386 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -31,7 +31,7 @@ import ( const HTTP = "HTTP" var ( - validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|AJP|GRPC|GRPCS)$`) + validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|AJP|GRPC|GRPCS|FCGI)$`) ) type backendProtocol struct { diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go new file mode 100644 index 000000000..84bac4109 --- /dev/null +++ b/internal/ingress/annotations/fastcgi/main.go @@ -0,0 +1,106 @@ +/* +Copyright 2018 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package fastcgi + +import ( + "fmt" + "reflect" + + networking "k8s.io/api/networking/v1" + "k8s.io/client-go/tools/cache" + + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" + "k8s.io/ingress-nginx/internal/ingress/resolver" +) + +type fastcgi struct { + r resolver.Resolver +} + +// Config describes the per location fastcgi config +type Config struct { + Index string `json:"index"` + Params map[string]string `json:"params"` +} + +// Equal tests for equality between two Configuration types +func (l1 *Config) Equal(l2 *Config) bool { + if l1 == l2 { + return true + } + + if l1 == nil || l2 == nil { + return false + } + + if l1.Index != l2.Index { + return false + } + + return reflect.DeepEqual(l1.Params, l2.Params) +} + +// NewParser creates a new fastcgiConfig protocol annotation parser +func NewParser(r resolver.Resolver) parser.IngressAnnotation { + return fastcgi{r} +} + +// ParseAnnotations parses the annotations contained in the ingress +// rule used to indicate the fastcgiConfig. +func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { + + fcgiConfig := Config{} + + if ing.GetAnnotations() == nil { + return fcgiConfig, nil + } + + index, err := parser.GetStringAnnotation("fastcgi-index", ing) + if err != nil { + index = "" + } + fcgiConfig.Index = index + + cm, err := parser.GetStringAnnotation("fastcgi-params-configmap", ing) + if err != nil { + return fcgiConfig, nil + } + + cmns, cmn, err := cache.SplitMetaNamespaceKey(cm) + if err != nil { + return fcgiConfig, ing_errors.LocationDenied{ + Reason: fmt.Errorf("error reading configmap name from annotation: %w", err), + } + } + + if cmns != "" && cmns != ing.Namespace { + return fcgiConfig, fmt.Errorf("different namespace is not supported on fast_cgi param configmap") + } + + cm = fmt.Sprintf("%v/%v", ing.Namespace, cmn) + cmap, err := a.r.GetConfigMap(cm) + if err != nil { + return fcgiConfig, ing_errors.LocationDenied{ + Reason: fmt.Errorf("unexpected error reading configmap %s: %w", cm, err), + } + } + + fcgiConfig.Params = cmap.Data + + return fcgiConfig, nil +} diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go new file mode 100644 index 000000000..35c5bbc12 --- /dev/null +++ b/internal/ingress/annotations/fastcgi/main_test.go @@ -0,0 +1,285 @@ +/* +Copyright 2018 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package fastcgi + +import ( + "fmt" + "testing" + + api "k8s.io/api/core/v1" + networking "k8s.io/api/networking/v1" + meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/tools/cache" + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/resolver" +) + +func buildIngress() *networking.Ingress { + return &networking.Ingress{ + ObjectMeta: meta_v1.ObjectMeta{ + Name: "foo", + Namespace: api.NamespaceDefault, + }, + Spec: networking.IngressSpec{ + DefaultBackend: &networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: "default-backend", + Port: networking.ServiceBackendPort{ + Number: 80, + }, + }, + }, + }, + } +} + +type mockConfigMap struct { + resolver.Mock +} + +func (m mockConfigMap) GetConfigMap(name string) (*api.ConfigMap, error) { + if name != "default/demo-configmap" && name != "otherns/demo-configmap" { + return nil, fmt.Errorf("there is no configmap with name %v", name) + } + + cmns, cmn, err := cache.SplitMetaNamespaceKey(name) + if err != nil { + return nil, fmt.Errorf("invalid configmap name") + } + + return &api.ConfigMap{ + ObjectMeta: meta_v1.ObjectMeta{ + Namespace: cmns, + Name: cmn, + }, + Data: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, + }, nil +} + +func TestParseEmptyFastCGIAnnotations(t *testing.T) { + ing := buildIngress() + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing ingress without fastcgi") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if config.Index != "" { + t.Errorf("Index should be an empty string") + } + + if len(config.Params) != 0 { + t.Errorf("Params should be an empty slice") + } +} + +func TestParseFastCGIIndexAnnotation(t *testing.T) { + ing := buildIngress() + + const expectedAnnotation = "index.php" + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-index")] = expectedAnnotation + ing.SetAnnotations(data) + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing ingress without fastcgi") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if config.Index != "index.php" { + t.Errorf("expected %s but %v returned", expectedAnnotation, config.Index) + } +} + +func TestParseEmptyFastCGIParamsConfigMapAnnotation(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "" + ing.SetAnnotations(data) + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing ingress without fastcgi") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if len(config.Params) != 0 { + t.Errorf("Params should be an empty slice") + } +} + +func TestParseFastCGIInvalidParamsConfigMapAnnotation(t *testing.T) { + ing := buildIngress() + + invalidConfigMapList := []string{"unknown/configMap", "unknown/config/map"} + for _, configmap := range invalidConfigMapList { + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = configmap + ing.SetAnnotations(data) + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err == nil { + t.Errorf("Reading an unexisting configmap should return an error") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if len(config.Params) != 0 { + t.Errorf("Params should be an empty slice") + } + } +} + +func TestParseFastCGIParamsConfigMapAnnotationWithoutNS(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "demo-configmap" + ing.SetAnnotations(data) + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing ingress without fastcgi") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if len(config.Params) != 2 { + t.Errorf("Params should have a length of 2") + } + + if config.Params["REDIRECT_STATUS"] != "200" || config.Params["SERVER_NAME"] != "$server_name" { + t.Errorf("Params value is not the one expected") + } +} + +func TestParseFastCGIParamsConfigMapAnnotationWithNS(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "default/demo-configmap" + ing.SetAnnotations(data) + + i, err := NewParser(&mockConfigMap{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing ingress without fastcgi") + } + + config, ok := i.(Config) + if !ok { + t.Errorf("Parse do not return a Config object") + } + + if len(config.Params) != 2 { + t.Errorf("Params should have a length of 2") + } + + if config.Params["REDIRECT_STATUS"] != "200" || config.Params["SERVER_NAME"] != "$server_name" { + t.Errorf("Params value is not the one expected") + } +} + +func TestParseFastCGIParamsConfigMapAnnotationWithDifferentNS(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "otherns/demo-configmap" + ing.SetAnnotations(data) + + _, err := NewParser(&mockConfigMap{}).Parse(ing) + if err == nil { + t.Errorf("Different namespace configmap should return an error") + } + +} + +func TestConfigEquality(t *testing.T) { + + var nilConfig *Config + + config := Config{ + Index: "index.php", + Params: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, + } + + configCopy := Config{ + Index: "index.php", + Params: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, + } + + config2 := Config{ + Index: "index.php", + Params: map[string]string{"REDIRECT_STATUS": "200"}, + } + + config3 := Config{ + Index: "index.py", + Params: map[string]string{"SERVER_NAME": "$server_name", "REDIRECT_STATUS": "200"}, + } + + config4 := Config{ + Index: "index.php", + Params: map[string]string{"SERVER_NAME": "$server_name", "REDIRECT_STATUS": "200"}, + } + + if !config.Equal(&config) { + t.Errorf("config should be equal to itself") + } + + if nilConfig.Equal(&config) { + t.Errorf("Foo") + } + + if !config.Equal(&configCopy) { + t.Errorf("config should be equal to configCopy") + } + + if config.Equal(&config2) { + t.Errorf("config2 should not be equal to config") + } + + if config.Equal(&config3) { + t.Errorf("config3 should not be equal to config") + } + + if !config.Equal(&config4) { + t.Errorf("config4 should be equal to config") + } +} diff --git a/internal/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go index 8a0ea4b87..107a278b0 100644 --- a/internal/ingress/annotations/parser/main.go +++ b/internal/ingress/annotations/parser/main.go @@ -160,6 +160,7 @@ func normalizeString(input string) string { var configmapAnnotations = sets.NewString( "auth-proxy-set-header", + "fastcgi-params-configmap", ) // AnnotationsReferencesConfigmap checks if at least one annotation in the Ingress rule diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index e93d3b5de..4a4417130 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -271,8 +271,6 @@ func (n *NGINXController) CheckWarning(ing *networking.Ingress) ([]string, error "influxdb-host", "influxdb-server-name", "secure-verify-ca-secret", - "fastcgi-params-configmap", - "fastcgi-index", ) // Skip checks if the ingress is marked as deleted @@ -608,7 +606,7 @@ func (n *NGINXController) getConfiguration(ingresses []*ingress.Ingress) (sets.S for _, server := range servers { // If a location is defined by a prefix string that ends with the slash character, and requests are processed by one of - // proxy_pass, uwsgi_pass, scgi_pass, memcached_pass, or grpc_pass, then the special processing is performed. + // proxy_pass, fastcgi_pass, uwsgi_pass, scgi_pass, memcached_pass, or grpc_pass, then the special processing is performed. // In response to a request with URI equal to // this string, but without the trailing slash, a permanent redirect with the // code 301 will be returned to the requested URI with the slash appended. If this is not desired, an exact match of the // URIand location could be defined like this: @@ -1519,6 +1517,7 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) loc.Logs = anns.Logs loc.DefaultBackend = anns.DefaultBackend loc.BackendProtocol = anns.BackendProtocol + loc.FastCGI = anns.FastCGI loc.CustomHTTPErrors = anns.CustomHTTPErrors loc.ModSecurity = anns.ModSecurity loc.Satisfy = anns.Satisfy diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index 355f5da95..c631461c0 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -431,7 +431,7 @@ func TestCheckWarning(t *testing.T) { t.Run("adding invalid annotations increases the warning count", func(t *testing.T) { ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "true" - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("fastcgi-index")] = "blabla" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("influxdb-host")] = "blabla" defer func() { ing.ObjectMeta.Annotations = map[string]string{} }() diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 15ae438ab..2d941f95d 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -739,6 +739,9 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { case "AJP": proto = "" proxyPass = "ajp_pass" + case "FCGI": + proto = "" + proxyPass = "fastcgi_pass" } upstreamName := "upstream_balancer" diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index 1b88c3fe7..1980d7e52 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -1138,6 +1138,7 @@ func TestOpentracingPropagateContext(t *testing.T) { {BackendProtocol: "GRPC"}: "opentracing_grpc_propagate_context;", {BackendProtocol: "GRPCS"}: "opentracing_grpc_propagate_context;", {BackendProtocol: "AJP"}: "opentracing_propagate_context;", + {BackendProtocol: "FCGI"}: "opentracing_propagate_context;", nil: "", } @@ -1157,6 +1158,7 @@ func TestOpentelemetryPropagateContext(t *testing.T) { {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", {BackendProtocol: "AJP"}: "opentelemetry_propagate;", + {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", nil: "", } diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index 68cacc25b..e50666c18 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -27,6 +27,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/authtls" "k8s.io/ingress-nginx/internal/ingress/annotations/connection" "k8s.io/ingress-nginx/internal/ingress/annotations/cors" + "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" @@ -339,6 +340,9 @@ type Location struct { // BackendProtocol indicates which protocol should be used to communicate with the service // By default this is HTTP BackendProtocol string `json:"backend-protocol"` + // FastCGI allows the ingress to act as a FastCGI client for a given location. + // +optional + FastCGI fastcgi.Config `json:"fastcgi,omitempty"` // CustomHTTPErrors specifies the error codes that should be intercepted. // +optional CustomHTTPErrors []int `json:"custom-http-errors"` diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index fee8c31d5..84b1a186a 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -435,6 +435,10 @@ func (l1 *Location) Equal(l2 *Location) bool { return false } + if !(&l1.FastCGI).Equal(&l2.FastCGI) { + return false + } + match := compareInts(l1.CustomHTTPErrors, l2.CustomHTTPErrors) if !match { return false diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 638333407..9b3a47de3 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -305,6 +305,7 @@ http { keepalive_requests {{ $cfg.KeepAliveRequests }}; client_body_temp_path /tmp/nginx/client-body; + fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; ajp_temp_path /tmp/nginx/ajp-temp; @@ -1488,6 +1489,16 @@ stream { {{ range $errCode := $location.CustomHTTPErrors }} error_page {{ $errCode }} = @custom_{{ $location.DefaultBackendUpstreamName }}_{{ $errCode }};{{ end }} + {{ if (eq $location.BackendProtocol "FCGI") }} + include /etc/nginx/fastcgi_params; + {{ end }} + {{- if $location.FastCGI.Index -}} + fastcgi_index {{ $location.FastCGI.Index | quote }}; + {{- end -}} + {{ range $k, $v := $location.FastCGI.Params }} + fastcgi_param {{ $k }} {{ $v | quote }}; + {{ end }} + {{ if not (empty $location.Redirect.URL) }} return {{ $location.Redirect.Code }} {{ $location.Redirect.URL }}; {{ end }} diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index 8256befd2..bccb03afb 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -91,6 +91,21 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) }) + ginkgo.It("should set backend protocol to '' and use fastcgi_pass", func() { + host := "backendprotocol.foo.com" + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", + } + + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "fastcgi_pass upstream_balancer;") + }) + }) + ginkgo.It("should set backend protocol to '' and use ajp_pass", func() { host := "backendprotocol.foo.com" annotations := map[string]string{ diff --git a/test/e2e/annotations/fastcgi.go b/test/e2e/annotations/fastcgi.go new file mode 100644 index 000000000..572eca548 --- /dev/null +++ b/test/e2e/annotations/fastcgi.go @@ -0,0 +1,125 @@ +/* +Copyright 2019 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package annotations + +import ( + "net/http" + "strings" + + "github.com/onsi/ginkgo/v2" + corev1 "k8s.io/api/core/v1" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/ingress-nginx/test/e2e/framework" +) + +var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { + f := framework.NewDefaultFramework("fastcgi") + + ginkgo.BeforeEach(func() { + f.NewFastCGIHelloServerDeployment() + }) + + ginkgo.It("should use fastcgi_pass in the configuration file", func() { + host := "fastcgi" + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", + } + + ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "include /etc/nginx/fastcgi_params;") && + strings.Contains(server, "fastcgi_pass") + }) + }) + + ginkgo.It("should add fastcgi_index in the configuration file", func() { + host := "fastcgi-index" + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", + "nginx.ingress.kubernetes.io/fastcgi-index": "index.php", + } + + ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "fastcgi_index \"index.php\";") + }) + }) + + ginkgo.It("should add fastcgi_param in the configuration file", func() { + configuration := &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{ + Name: "fastcgi-configmap", + Namespace: f.Namespace, + }, + Data: map[string]string{ + "SCRIPT_FILENAME": "/home/www/scripts/php$fastcgi_script_name", + "REDIRECT_STATUS": "200", + }, + } + + f.EnsureConfigMap(configuration) + + host := "fastcgi-params-configmap" + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", + "nginx.ingress.kubernetes.io/fastcgi-params-configmap": "fastcgi-configmap", + } + + ing := framework.NewSingleIngress(host, "/hello", host, f.Namespace, "fastcgi-helloserver", 9000, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "fastcgi_param SCRIPT_FILENAME \"/home/www/scripts/php$fastcgi_script_name\";") && + strings.Contains(server, "fastcgi_param REDIRECT_STATUS \"200\";") + }) + }) + + ginkgo.It("should return OK for service with backend protocol FastCGI", func() { + host := "fastcgi-helloserver" + path := "/hello" + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", + } + + ing := framework.NewSingleIngress(host, path, host, f.Namespace, "fastcgi-helloserver", 9000, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "fastcgi_pass") + }) + + f.HTTPTestClient(). + GET(path). + WithHeader("Host", host). + Expect(). + Status(http.StatusOK). + Body().Contains("Hello world!") + }) +}) diff --git a/test/e2e/framework/fastcgi_helloserver.go b/test/e2e/framework/fastcgi_helloserver.go new file mode 100644 index 000000000..719048c06 --- /dev/null +++ b/test/e2e/framework/fastcgi_helloserver.go @@ -0,0 +1,104 @@ +/* +Copyright 2017 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package framework + +import ( + "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/fields" + "k8s.io/apimachinery/pkg/util/intstr" +) + +// NewFastCGIHelloServerDeployment creates a new single replica +// deployment of the fortune teller image in a particular namespace +func (f *Framework) NewFastCGIHelloServerDeployment() { + f.NewNewFastCGIHelloServerDeploymentWithReplicas(1) +} + +// NewNewFastCGIHelloServerDeploymentWithReplicas creates a new deployment of the +// fortune teller image in a particular namespace. Number of replicas is configurable +func (f *Framework) NewNewFastCGIHelloServerDeploymentWithReplicas(replicas int32) { + deployment := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "fastcgi-helloserver", + Namespace: f.Namespace, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: NewInt32(replicas), + Selector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "app": "fastcgi-helloserver", + }, + }, + Template: corev1.PodTemplateSpec{ + ObjectMeta: metav1.ObjectMeta{ + Labels: map[string]string{ + "app": "fastcgi-helloserver", + }, + }, + Spec: corev1.PodSpec{ + TerminationGracePeriodSeconds: NewInt64(0), + Containers: []corev1.Container{ + { + Name: "fastcgi-helloserver", + Image: "registry.k8s.io/ingress-nginx/e2e-test-fastcgi-helloserver@sha256:0e08c836cc58f1ea862578de99b13bc4264fe071e816f96dc1d79857bfba7473", + Env: []corev1.EnvVar{}, + Ports: []corev1.ContainerPort{ + { + Name: "fastcgi", + ContainerPort: 9000, + }, + }, + }, + }, + }, + }, + }, + } + + d := f.EnsureDeployment(deployment) + + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ + LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), + }) + assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") + + service := &corev1.Service{ + ObjectMeta: metav1.ObjectMeta{ + Name: "fastcgi-helloserver", + Namespace: f.Namespace, + }, + Spec: corev1.ServiceSpec{ + Ports: []corev1.ServicePort{ + { + Name: "fastcgi", + Port: 9000, + TargetPort: intstr.FromInt(9000), + Protocol: "TCP", + }, + }, + Selector: map[string]string{ + "app": "fastcgi-helloserver", + }, + }, + } + + f.EnsureService(service) +} From 686aeac5961f37eaf1ddfa2fa320df4ccf0cf005 Mon Sep 17 00:00:00 2001 From: Hansuk Hong Date: Thu, 15 Jun 2023 16:32:18 +0900 Subject: [PATCH 241/822] docs: change Dockefile url ref main (#10087) --- docs/examples/grpc/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/examples/grpc/README.md b/docs/examples/grpc/README.md index cf4597fcd..508b23fb8 100644 --- a/docs/examples/grpc/README.md +++ b/docs/examples/grpc/README.md @@ -20,7 +20,7 @@ This example demonstrates how to route traffic to a gRPC service through the Ing - As an example gRPC application, we can use this app . -- To create a container image for this app, you can use [this Dockerfile](https://github.com/kubernetes/ingress-nginx/blob/5a52d99ae85cfe5ef9535291b8326b0006e75066/images/go-grpc-greeter-server/rootfs/Dockerfile). +- To create a container image for this app, you can use [this Dockerfile](https://github.com/kubernetes/ingress-nginx/blob/main/images/go-grpc-greeter-server/rootfs/Dockerfile). - If you use the Dockerfile mentioned above, to create a image, then you can use the following example Kubernetes manifest to create a deployment resource that uses that image. If necessary edit this manifest to suit your needs. From 30de5999c15fb0dc1581950685f1e027957515d5 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Sun, 18 Jun 2023 21:16:21 +0200 Subject: [PATCH 242/822] fix: obsolete warnings (#10029) Signed-off-by: Spazzy --- .../nginx-configuration/configmap.md | 410 +++++++++--------- internal/ingress/controller/config/config.go | 9 +- rootfs/etc/nginx/template/nginx.tmpl | 6 + 3 files changed, 217 insertions(+), 208 deletions(-) diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index 782b9bc92..c55b7502a 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -25,211 +25,211 @@ data: The following table shows a configuration option's name, type, and the default value: -|name|type|default| -|:---|:---|:------| -|[add-headers](#add-headers)|string|""| -|[allow-backend-server-header](#allow-backend-server-header)|bool|"false"| -|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true| -|[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""| -|[hide-headers](#hide-headers)|string array|empty| -|[access-log-params](#access-log-params)|string|""| -|[access-log-path](#access-log-path)|string|"/var/log/nginx/access.log"| -|[http-access-log-path](#http-access-log-path)|string|""| -|[stream-access-log-path](#stream-access-log-path)|string|""| -|[enable-access-log-for-default-backend](#enable-access-log-for-default-backend)|bool|"false"| -|[error-log-path](#error-log-path)|string|"/var/log/nginx/error.log"| -|[enable-modsecurity](#enable-modsecurity)|bool|"false"| -|[modsecurity-snippet](#modsecurity-snippet)|string|""| -|[enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs)|bool|"false"| -|[client-header-buffer-size](#client-header-buffer-size)|string|"1k"| -|[client-header-timeout](#client-header-timeout)|int|60| -|[client-body-buffer-size](#client-body-buffer-size)|string|"8k"| -|[client-body-timeout](#client-body-timeout)|int|60| -|[disable-access-log](#disable-access-log)|bool|false| -|[disable-ipv6](#disable-ipv6)|bool|false| -|[disable-ipv6-dns](#disable-ipv6-dns)|bool|false| -|[enable-underscores-in-headers](#enable-underscores-in-headers)|bool|false| -|[enable-ocsp](#enable-ocsp)|bool|false| -|[ignore-invalid-headers](#ignore-invalid-headers)|bool|true| -|[retry-non-idempotent](#retry-non-idempotent)|bool|"false"| -|[error-log-level](#error-log-level)|string|"notice"| -|[http2-max-field-size](#http2-max-field-size)|string|"4k"| -|[http2-max-header-size](#http2-max-header-size)|string|"16k"| -|[http2-max-requests](#http2-max-requests)|int|1000| -|[http2-max-concurrent-streams](#http2-max-concurrent-streams)|int|128| -|[hsts](#hsts)|bool|"true"| -|[hsts-include-subdomains](#hsts-include-subdomains)|bool|"true"| -|[hsts-max-age](#hsts-max-age)|string|"15724800"| -|[hsts-preload](#hsts-preload)|bool|"false"| -|[keep-alive](#keep-alive)|int|75| -|[keep-alive-requests](#keep-alive-requests)|int|1000| -|[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"| -|[log-format-escape-none](#log-format-escape-none)|bool|"false"| -|[log-format-escape-json](#log-format-escape-json)|bool|"false"| -|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`| -|[log-format-stream](#log-format-stream)|string|`[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time`| -|[enable-multi-accept](#enable-multi-accept)|bool|"true"| -|[max-worker-connections](#max-worker-connections)|int|16384| -|[max-worker-open-files](#max-worker-open-files)|int|0| -|[map-hash-bucket-size](#max-hash-bucket-size)|int|64| -|[nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist)|[]string|"127.0.0.1"| -|[nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist)|[]string|"::1"| -|[proxy-real-ip-cidr](#proxy-real-ip-cidr)|[]string|"0.0.0.0/0"| -|[proxy-set-headers](#proxy-set-headers)|string|""| -|[server-name-hash-max-size](#server-name-hash-max-size)|int|1024| -|[server-name-hash-bucket-size](#server-name-hash-bucket-size)|int|`` -|[proxy-headers-hash-max-size](#proxy-headers-hash-max-size)|int|512| -|[proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size)|int|64| -|[plugins](#plugins)|[]string| | -|[reuse-port](#reuse-port)|bool|"true"| -|[server-tokens](#server-tokens)|bool|"false"| -|[ssl-ciphers](#ssl-ciphers)|string|"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"| -|[ssl-ecdh-curve](#ssl-ecdh-curve)|string|"auto"| -|[ssl-dh-param](#ssl-dh-param)|string|""| -|[ssl-protocols](#ssl-protocols)|string|"TLSv1.2 TLSv1.3"| -|[ssl-session-cache](#ssl-session-cache)|bool|"true"| -|[ssl-session-cache-size](#ssl-session-cache-size)|string|"10m"| -|[ssl-session-tickets](#ssl-session-tickets)|bool|"false"| -|[ssl-session-ticket-key](#ssl-session-ticket-key)|string|`` -|[ssl-session-timeout](#ssl-session-timeout)|string|"10m"| -|[ssl-buffer-size](#ssl-buffer-size)|string|"4k"| -|[use-proxy-protocol](#use-proxy-protocol)|bool|"false"| -|[proxy-protocol-header-timeout](#proxy-protocol-header-timeout)|string|"5s"| -|[use-gzip](#use-gzip)|bool|"false"| -|[use-geoip](#use-geoip)|bool|"true"| -|[use-geoip2](#use-geoip2)|bool|"false"| -|[enable-brotli](#enable-brotli)|bool|"false"| -|[brotli-level](#brotli-level)|int|4| -|[brotli-min-length](#brotli-min-length)|int|20| -|[brotli-types](#brotli-types)|string|"application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| -|[use-http2](#use-http2)|bool|"true"| -|[gzip-disable](#gzip-disable)|string|""| -|[gzip-level](#gzip-level)|int|1| -|[gzip-min-length](#gzip-min-length)|int|256| -|[gzip-types](#gzip-types)|string|"application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"| -|[worker-processes](#worker-processes)|string|``| -|[worker-cpu-affinity](#worker-cpu-affinity)|string|""| -|[worker-shutdown-timeout](#worker-shutdown-timeout)|string|"240s"| -|[load-balance](#load-balance)|string|"round_robin"| -|[variables-hash-bucket-size](#variables-hash-bucket-size)|int|128| -|[variables-hash-max-size](#variables-hash-max-size)|int|2048| -|[upstream-keepalive-connections](#upstream-keepalive-connections)|int|320| -|[upstream-keepalive-time](#upstream-keepalive-time)|string|"1h"| -|[upstream-keepalive-timeout](#upstream-keepalive-timeout)|int|60| -|[upstream-keepalive-requests](#upstream-keepalive-requests)|int|10000| -|[limit-conn-zone-variable](#limit-conn-zone-variable)|string|"$binary_remote_addr"| -|[proxy-stream-timeout](#proxy-stream-timeout)|string|"600s"| -|[proxy-stream-next-upstream](#proxy-stream-next-upstream)|bool|"true"| -|[proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout)|string|"600s"| -|[proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries)|int|3| -|[proxy-stream-responses](#proxy-stream-responses)|int|1| -|[bind-address](#bind-address)|[]string|""| -|[use-forwarded-headers](#use-forwarded-headers)|bool|"false"| -|[enable-real-ip](#enable-real-ip)|bool|"false"| -|[forwarded-for-header](#forwarded-for-header)|string|"X-Forwarded-For"| -|[compute-full-forwarded-for](#compute-full-forwarded-for)|bool|"false"| -|[proxy-add-original-uri-header](#proxy-add-original-uri-header)|bool|"false"| -|[generate-request-id](#generate-request-id)|bool|"true"| -|[enable-opentracing](#enable-opentracing)|bool|"false"| -|[opentracing-operation-name](#opentracing-operation-name)|string|""| -|[opentracing-location-operation-name](#opentracing-location-operation-name)|string|""| -|[zipkin-collector-host](#zipkin-collector-host)|string|""| -|[zipkin-collector-port](#zipkin-collector-port)|int|9411| -|[zipkin-service-name](#zipkin-service-name)|string|"nginx"| -|[zipkin-sample-rate](#zipkin-sample-rate)|float|1.0| -|[jaeger-collector-host](#jaeger-collector-host)|string|""| -|[jaeger-collector-port](#jaeger-collector-port)|int|6831| -|[jaeger-endpoint](#jaeger-endpoint)|string|""| -|[jaeger-service-name](#jaeger-service-name)|string|"nginx"| -|[jaeger-propagation-format](#jaeger-propagation-format)|string|"jaeger"| -|[jaeger-sampler-type](#jaeger-sampler-type)|string|"const"| -|[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"| -|[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"| -|[jaeger-sampler-port](#jaeger-sampler-port)|int|5778| -|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id| -|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id| -|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage| -|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-| -|[datadog-collector-host](#datadog-collector-host)|string|""| -|[datadog-collector-port](#datadog-collector-port)|int|8126| -|[datadog-service-name](#datadog-service-name)|string|"nginx"| -|[datadog-environment](#datadog-environment)|string|"prod"| -|[datadog-operation-name-override](#datadog-operation-name-override)|string|"nginx.handle"| -|[datadog-priority-sampling](#datadog-priority-sampling)|bool|"true"| -|[datadog-sample-rate](#datadog-sample-rate)|float|1.0| -|[enable-opentelemetry](#enable-opentelemetry)|bool|"false"| -|[opentelemetry-trust-incoming-span](#opentelemetry-trust-incoming-span)|bool|"true"| -|[opentelemetry-operation-name](#opentelemetry-operation-name)|string|""| -|[opentelemetry-config](#/etc/nginx/opentelemetry.toml)|string|"/etc/nginx/opentelemetry.toml"| -|[otlp-collector-host](#otlp-collector-host)|string|""| -|[otlp-collector-port](#otlp-collector-port)|int|4317| -|[otel-max-queuesize](#otel-max-queuesize)|int|| -|[otel-schedule-delay-millis](#otel-schedule-delay-millis)|int|| -|[otel-max-export-batch-size](#otel-max-export-batch-size)|int|| -|[otel-service-name](#otel-service-name)|string|"nginx"| -|[otel-sampler](#otel-sampler)|string|"AlwaysOff"| -|[otel-sampler-parent-based](#otel-sampler-parent-based)|bool|"false"| -|[otel-sampler-ratio](#otel-sampler-ratio)|float|0.01| -|[main-snippet](#main-snippet)|string|""| -|[http-snippet](#http-snippet)|string|""| -|[server-snippet](#server-snippet)|string|""| -|[stream-snippet](#stream-snippet)|string|""| -|[location-snippet](#location-snippet)|string|""| -|[custom-http-errors](#custom-http-errors)|[]int|[]int{}| -|[proxy-body-size](#proxy-body-size)|string|"1m"| -|[proxy-connect-timeout](#proxy-connect-timeout)|int|5| -|[proxy-read-timeout](#proxy-read-timeout)|int|60| -|[proxy-send-timeout](#proxy-send-timeout)|int|60| -|[proxy-buffers-number](#proxy-buffers-number)|int|4| -|[proxy-buffer-size](#proxy-buffer-size)|string|"4k"| -|[proxy-cookie-path](#proxy-cookie-path)|string|"off"| -|[proxy-cookie-domain](#proxy-cookie-domain)|string|"off"| -|[proxy-next-upstream](#proxy-next-upstream)|string|"error timeout"| -|[proxy-next-upstream-timeout](#proxy-next-upstream-timeout)|int|0| -|[proxy-next-upstream-tries](#proxy-next-upstream-tries)|int|3| -|[proxy-redirect-from](#proxy-redirect-from)|string|"off"| -|[proxy-request-buffering](#proxy-request-buffering)|string|"on"| -|[ssl-redirect](#ssl-redirect)|bool|"true"| -|[force-ssl-redirect](#force-ssl-redirect)|bool|"false"| -|[denylist-source-range](#denylist-source-range)|[]string|[]string{}| -|[whitelist-source-range](#whitelist-source-range)|[]string|[]string{}| -|[skip-access-log-urls](#skip-access-log-urls)|[]string|[]string{}| -|[limit-rate](#limit-rate)|int|0| -|[limit-rate-after](#limit-rate-after)|int|0| -|[lua-shared-dicts](#lua-shared-dicts)|string|""| -|[http-redirect-code](#http-redirect-code)|int|308| -|[proxy-buffering](#proxy-buffering)|string|"off"| -|[limit-req-status-code](#limit-req-status-code)|int|503| -|[limit-conn-status-code](#limit-conn-status-code)|int|503| -|[enable-syslog](#enable-syslog)|bool|false| -|[syslog-host](#syslog-host)|string|""| -|[syslog-port](#syslog-port)|int|514| -|[no-tls-redirect-locations](#no-tls-redirect-locations)|string|"/.well-known/acme-challenge"| -|[global-auth-url](#global-auth-url)|string|""| -|[global-auth-method](#global-auth-method)|string|""| -|[global-auth-signin](#global-auth-signin)|string|""| -|[global-auth-signin-redirect-param](#global-auth-signin-redirect-param)|string|"rd"| -|[global-auth-response-headers](#global-auth-response-headers)|string|""| -|[global-auth-request-redirect](#global-auth-request-redirect)|string|""| -|[global-auth-snippet](#global-auth-snippet)|string|""| -|[global-auth-cache-key](#global-auth-cache-key)|string|""| -|[global-auth-cache-duration](#global-auth-cache-duration)|string|"200 202 401 5m"| -|[no-auth-locations](#no-auth-locations)|string|"/.well-known/acme-challenge"| -|[block-cidrs](#block-cidrs)|[]string|""| -|[block-user-agents](#block-user-agents)|[]string|""| -|[block-referers](#block-referers)|[]string|""| -|[proxy-ssl-location-only](#proxy-ssl-location-only)|bool|"false"| -|[default-type](#default-type)|string|"text/html"| -|[global-rate-limit-memcached-host](#global-rate-limit)|string|""| -|[global-rate-limit-memcached-port](#global-rate-limit)|int|11211| -|[global-rate-limit-memcached-connect-timeout](#global-rate-limit)|int|50| -|[global-rate-limit-memcached-max-idle-timeout](#global-rate-limit)|int|10000| -|[global-rate-limit-memcached-pool-size](#global-rate-limit)|int|50| -|[global-rate-limit-status-code](#global-rate-limit)|int|429| -|[service-upstream](#service-upstream)|bool|"false"| -|[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"| -|[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"| -|[strict-validate-path-type](#strict-validate-path-type)|bool|"false" (v1.7.x)| +|name|type|default|notes| +|:---|:---|:------|:----| +|[add-headers](#add-headers)|string|""|| +|[allow-backend-server-header](#allow-backend-server-header)|bool|"false"|| +|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true|| +|[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""|| +|[hide-headers](#hide-headers)|string array|empty|| +|[access-log-params](#access-log-params)|string|""|| +|[access-log-path](#access-log-path)|string|"/var/log/nginx/access.log"|| +|[http-access-log-path](#http-access-log-path)|string|""|| +|[stream-access-log-path](#stream-access-log-path)|string|""|| +|[enable-access-log-for-default-backend](#enable-access-log-for-default-backend)|bool|"false"|| +|[error-log-path](#error-log-path)|string|"/var/log/nginx/error.log"|| +|[enable-modsecurity](#enable-modsecurity)|bool|"false"|| +|[modsecurity-snippet](#modsecurity-snippet)|string|""|| +|[enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs)|bool|"false"|| +|[client-header-buffer-size](#client-header-buffer-size)|string|"1k"|| +|[client-header-timeout](#client-header-timeout)|int|60|| +|[client-body-buffer-size](#client-body-buffer-size)|string|"8k"|| +|[client-body-timeout](#client-body-timeout)|int|60|| +|[disable-access-log](#disable-access-log)|bool|false|| +|[disable-ipv6](#disable-ipv6)|bool|false|| +|[disable-ipv6-dns](#disable-ipv6-dns)|bool|false|| +|[enable-underscores-in-headers](#enable-underscores-in-headers)|bool|false|| +|[enable-ocsp](#enable-ocsp)|bool|false|| +|[ignore-invalid-headers](#ignore-invalid-headers)|bool|true|| +|[retry-non-idempotent](#retry-non-idempotent)|bool|"false"|| +|[error-log-level](#error-log-level)|string|"notice"|| +|[http2-max-field-size](#http2-max-field-size)|string|""|DEPRECATED in favour of [large_client_header_buffers](#large-client-header-buffers)| +|[http2-max-header-size](#http2-max-header-size)|string|""|DEPRECATED in favour of [large_client_header_buffers](#large-client-header-buffers)| +|[http2-max-requests](#http2-max-requests)|int|0|DEPRECATED in favour of [keepalive_requests](#keepalive-requests)| +|[http2-max-concurrent-streams](#http2-max-concurrent-streams)|int|128|| +|[hsts](#hsts)|bool|"true"|| +|[hsts-include-subdomains](#hsts-include-subdomains)|bool|"true"|| +|[hsts-max-age](#hsts-max-age)|string|"15724800"|| +|[hsts-preload](#hsts-preload)|bool|"false"|| +|[keep-alive](#keep-alive)|int|75|| +|[keep-alive-requests](#keep-alive-requests)|int|1000|| +|[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"|| +|[log-format-escape-none](#log-format-escape-none)|bool|"false"|| +|[log-format-escape-json](#log-format-escape-json)|bool|"false"|| +|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`|| +|[log-format-stream](#log-format-stream)|string|`[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time`|| +|[enable-multi-accept](#enable-multi-accept)|bool|"true"|| +|[max-worker-connections](#max-worker-connections)|int|16384|| +|[max-worker-open-files](#max-worker-open-files)|int|0|| +|[map-hash-bucket-size](#max-hash-bucket-size)|int|64|| +|[nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist)|[]string|"127.0.0.1"|| +|[nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist)|[]string|"::1"|| +|[proxy-real-ip-cidr](#proxy-real-ip-cidr)|[]string|"0.0.0.0/0"|| +|[proxy-set-headers](#proxy-set-headers)|string|""|| +|[server-name-hash-max-size](#server-name-hash-max-size)|int|1024|| +|[server-name-hash-bucket-size](#server-name-hash-bucket-size)|int|``| +|[proxy-headers-hash-max-size](#proxy-headers-hash-max-size)|int|512|| +|[proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size)|int|64|| +|[plugins](#plugins)|[]string| || +|[reuse-port](#reuse-port)|bool|"true"|| +|[server-tokens](#server-tokens)|bool|"false"|| +|[ssl-ciphers](#ssl-ciphers)|string|"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"|| +|[ssl-ecdh-curve](#ssl-ecdh-curve)|string|"auto"|| +|[ssl-dh-param](#ssl-dh-param)|string|""|| +|[ssl-protocols](#ssl-protocols)|string|"TLSv1.2 TLSv1.3"|| +|[ssl-session-cache](#ssl-session-cache)|bool|"true"|| +|[ssl-session-cache-size](#ssl-session-cache-size)|string|"10m"|| +|[ssl-session-tickets](#ssl-session-tickets)|bool|"false"|| +|[ssl-session-ticket-key](#ssl-session-ticket-key)|string|``| +|[ssl-session-timeout](#ssl-session-timeout)|string|"10m"|| +|[ssl-buffer-size](#ssl-buffer-size)|string|"4k"|| +|[use-proxy-protocol](#use-proxy-protocol)|bool|"false"|| +|[proxy-protocol-header-timeout](#proxy-protocol-header-timeout)|string|"5s"|| +|[use-gzip](#use-gzip)|bool|"false"|| +|[use-geoip](#use-geoip)|bool|"true"|| +|[use-geoip2](#use-geoip2)|bool|"false"|| +|[enable-brotli](#enable-brotli)|bool|"false"|| +|[brotli-level](#brotli-level)|int|4|| +|[brotli-min-length](#brotli-min-length)|int|20|| +|[brotli-types](#brotli-types)|string|"application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"|| +|[use-http2](#use-http2)|bool|"true"|| +|[gzip-disable](#gzip-disable)|string|""|| +|[gzip-level](#gzip-level)|int|1|| +|[gzip-min-length](#gzip-min-length)|int|256|| +|[gzip-types](#gzip-types)|string|"application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"|| +|[worker-processes](#worker-processes)|string|``|| +|[worker-cpu-affinity](#worker-cpu-affinity)|string|""|| +|[worker-shutdown-timeout](#worker-shutdown-timeout)|string|"240s"|| +|[load-balance](#load-balance)|string|"round_robin"|| +|[variables-hash-bucket-size](#variables-hash-bucket-size)|int|128|| +|[variables-hash-max-size](#variables-hash-max-size)|int|2048|| +|[upstream-keepalive-connections](#upstream-keepalive-connections)|int|320|| +|[upstream-keepalive-time](#upstream-keepalive-time)|string|"1h"|| +|[upstream-keepalive-timeout](#upstream-keepalive-timeout)|int|60|| +|[upstream-keepalive-requests](#upstream-keepalive-requests)|int|10000|| +|[limit-conn-zone-variable](#limit-conn-zone-variable)|string|"$binary_remote_addr"|| +|[proxy-stream-timeout](#proxy-stream-timeout)|string|"600s"|| +|[proxy-stream-next-upstream](#proxy-stream-next-upstream)|bool|"true"|| +|[proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout)|string|"600s"|| +|[proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries)|int|3|| +|[proxy-stream-responses](#proxy-stream-responses)|int|1|| +|[bind-address](#bind-address)|[]string|""|| +|[use-forwarded-headers](#use-forwarded-headers)|bool|"false"|| +|[enable-real-ip](#enable-real-ip)|bool|"false"|| +|[forwarded-for-header](#forwarded-for-header)|string|"X-Forwarded-For"|| +|[compute-full-forwarded-for](#compute-full-forwarded-for)|bool|"false"|| +|[proxy-add-original-uri-header](#proxy-add-original-uri-header)|bool|"false"|| +|[generate-request-id](#generate-request-id)|bool|"true"|| +|[enable-opentracing](#enable-opentracing)|bool|"false"|| +|[opentracing-operation-name](#opentracing-operation-name)|string|""|| +|[opentracing-location-operation-name](#opentracing-location-operation-name)|string|""|| +|[zipkin-collector-host](#zipkin-collector-host)|string|""|| +|[zipkin-collector-port](#zipkin-collector-port)|int|9411|| +|[zipkin-service-name](#zipkin-service-name)|string|"nginx"|| +|[zipkin-sample-rate](#zipkin-sample-rate)|float|1.0|| +|[jaeger-collector-host](#jaeger-collector-host)|string|""|| +|[jaeger-collector-port](#jaeger-collector-port)|int|6831|| +|[jaeger-endpoint](#jaeger-endpoint)|string|""|| +|[jaeger-service-name](#jaeger-service-name)|string|"nginx"|| +|[jaeger-propagation-format](#jaeger-propagation-format)|string|"jaeger"|| +|[jaeger-sampler-type](#jaeger-sampler-type)|string|"const"|| +|[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"|| +|[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"|| +|[jaeger-sampler-port](#jaeger-sampler-port)|int|5778|| +|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id|| +|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id|| +|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage|| +|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-|| +|[datadog-collector-host](#datadog-collector-host)|string|""|| +|[datadog-collector-port](#datadog-collector-port)|int|8126|| +|[datadog-service-name](#datadog-service-name)|string|"nginx"|| +|[datadog-environment](#datadog-environment)|string|"prod"|| +|[datadog-operation-name-override](#datadog-operation-name-override)|string|"nginx.handle"|| +|[datadog-priority-sampling](#datadog-priority-sampling)|bool|"true"|| +|[datadog-sample-rate](#datadog-sample-rate)|float|1.0|| +|[enable-opentelemetry](#enable-opentelemetry)|bool|"false"|| +|[opentelemetry-trust-incoming-span](#opentelemetry-trust-incoming-span)|bool|"true"|| +|[opentelemetry-operation-name](#opentelemetry-operation-name)|string|""|| +|[opentelemetry-config](#/etc/nginx/opentelemetry.toml)|string|"/etc/nginx/opentelemetry.toml"|| +|[otlp-collector-host](#otlp-collector-host)|string|""|| +|[otlp-collector-port](#otlp-collector-port)|int|4317|| +|[otel-max-queuesize](#otel-max-queuesize)|int||| +|[otel-schedule-delay-millis](#otel-schedule-delay-millis)|int||| +|[otel-max-export-batch-size](#otel-max-export-batch-size)|int||| +|[otel-service-name](#otel-service-name)|string|"nginx"|| +|[otel-sampler](#otel-sampler)|string|"AlwaysOff"|| +|[otel-sampler-parent-based](#otel-sampler-parent-based)|bool|"false"|| +|[otel-sampler-ratio](#otel-sampler-ratio)|float|0.01|| +|[main-snippet](#main-snippet)|string|""|| +|[http-snippet](#http-snippet)|string|""|| +|[server-snippet](#server-snippet)|string|""|| +|[stream-snippet](#stream-snippet)|string|""|| +|[location-snippet](#location-snippet)|string|""|| +|[custom-http-errors](#custom-http-errors)|[]int|[]int{}|| +|[proxy-body-size](#proxy-body-size)|string|"1m"|| +|[proxy-connect-timeout](#proxy-connect-timeout)|int|5|| +|[proxy-read-timeout](#proxy-read-timeout)|int|60|| +|[proxy-send-timeout](#proxy-send-timeout)|int|60|| +|[proxy-buffers-number](#proxy-buffers-number)|int|4|| +|[proxy-buffer-size](#proxy-buffer-size)|string|"4k"|| +|[proxy-cookie-path](#proxy-cookie-path)|string|"off"|| +|[proxy-cookie-domain](#proxy-cookie-domain)|string|"off"|| +|[proxy-next-upstream](#proxy-next-upstream)|string|"error timeout"|| +|[proxy-next-upstream-timeout](#proxy-next-upstream-timeout)|int|0|| +|[proxy-next-upstream-tries](#proxy-next-upstream-tries)|int|3|| +|[proxy-redirect-from](#proxy-redirect-from)|string|"off"|| +|[proxy-request-buffering](#proxy-request-buffering)|string|"on"|| +|[ssl-redirect](#ssl-redirect)|bool|"true"|| +|[force-ssl-redirect](#force-ssl-redirect)|bool|"false"|| +|[denylist-source-range](#denylist-source-range)|[]string|[]string{}|| +|[whitelist-source-range](#whitelist-source-range)|[]string|[]string{}|| +|[skip-access-log-urls](#skip-access-log-urls)|[]string|[]string{}|| +|[limit-rate](#limit-rate)|int|0|| +|[limit-rate-after](#limit-rate-after)|int|0|| +|[lua-shared-dicts](#lua-shared-dicts)|string|""|| +|[http-redirect-code](#http-redirect-code)|int|308|| +|[proxy-buffering](#proxy-buffering)|string|"off"|| +|[limit-req-status-code](#limit-req-status-code)|int|503|| +|[limit-conn-status-code](#limit-conn-status-code)|int|503|| +|[enable-syslog](#enable-syslog)|bool|false|| +|[syslog-host](#syslog-host)|string|""|| +|[syslog-port](#syslog-port)|int|514|| +|[no-tls-redirect-locations](#no-tls-redirect-locations)|string|"/.well-known/acme-challenge"|| +|[global-auth-url](#global-auth-url)|string|""|| +|[global-auth-method](#global-auth-method)|string|""|| +|[global-auth-signin](#global-auth-signin)|string|""|| +|[global-auth-signin-redirect-param](#global-auth-signin-redirect-param)|string|"rd"|| +|[global-auth-response-headers](#global-auth-response-headers)|string|""|| +|[global-auth-request-redirect](#global-auth-request-redirect)|string|""|| +|[global-auth-snippet](#global-auth-snippet)|string|""|| +|[global-auth-cache-key](#global-auth-cache-key)|string|""|| +|[global-auth-cache-duration](#global-auth-cache-duration)|string|"200 202 401 5m"|| +|[no-auth-locations](#no-auth-locations)|string|"/.well-known/acme-challenge"|| +|[block-cidrs](#block-cidrs)|[]string|""|| +|[block-user-agents](#block-user-agents)|[]string|""|| +|[block-referers](#block-referers)|[]string|""|| +|[proxy-ssl-location-only](#proxy-ssl-location-only)|bool|"false"|| +|[default-type](#default-type)|string|"text/html"|| +|[global-rate-limit-memcached-host](#global-rate-limit)|string|""|| +|[global-rate-limit-memcached-port](#global-rate-limit)|int|11211|| +|[global-rate-limit-memcached-connect-timeout](#global-rate-limit)|int|50|| +|[global-rate-limit-memcached-max-idle-timeout](#global-rate-limit)|int|10000|| +|[global-rate-limit-memcached-pool-size](#global-rate-limit)|int|50|| +|[global-rate-limit-status-code](#global-rate-limit)|int|429|| +|[service-upstream](#service-upstream)|bool|"false"|| +|[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"|| +|[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"|| +|[strict-validate-path-type](#strict-validate-path-type)|bool|"false" (v1.7.x)|| ## add-headers diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index ad4bebde0..ec44b08ed 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -215,16 +215,19 @@ type Configuration struct { // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size // HTTP2MaxFieldSize Limits the maximum size of an HPACK-compressed request header field + // NOTE: Deprecated HTTP2MaxFieldSize string `json:"http2-max-field-size,omitempty"` // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size // HTTP2MaxHeaderSize Limits the maximum size of the entire request header list after HPACK decompression + // NOTE: Deprecated HTTP2MaxHeaderSize string `json:"http2-max-header-size,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_requests // HTTP2MaxRequests Sets the maximum number of requests (including push requests) that can be served // through one HTTP/2 connection, after which the next client request will lead to connection closing // and the need of establishing a new connection. + // NOTE: Deprecated HTTP2MaxRequests int `json:"http2-max-requests,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_concurrent_streams @@ -882,9 +885,9 @@ func NewDefault() Configuration { ComputeFullForwardedFor: false, ProxyAddOriginalURIHeader: false, GenerateRequestID: true, - HTTP2MaxFieldSize: "4k", - HTTP2MaxHeaderSize: "16k", - HTTP2MaxRequests: 1000, + HTTP2MaxFieldSize: "", + HTTP2MaxHeaderSize: "", + HTTP2MaxRequests: 0, HTTP2MaxConcurrentStreams: 128, HTTPRedirectCode: 308, HSTS: true, diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 9b3a47de3..a1e02aae3 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -315,9 +315,15 @@ http { client_body_buffer_size {{ $cfg.ClientBodyBufferSize }}; client_body_timeout {{ $cfg.ClientBodyTimeout }}s; + {{ if and (ne $cfg.HTTP2MaxHeaderSize "") (ne $cfg.HTTP2MaxFieldSize "") }} http2_max_field_size {{ $cfg.HTTP2MaxFieldSize }}; http2_max_header_size {{ $cfg.HTTP2MaxHeaderSize }}; + {{ end }} + + {{ if (gt $cfg.HTTP2MaxRequests 0) }} http2_max_requests {{ $cfg.HTTP2MaxRequests }}; + {{ end }} + http2_max_concurrent_streams {{ $cfg.HTTP2MaxConcurrentStreams }}; types_hash_max_size 2048; From 910ca9ec0bd55aa651a593425929ebcfba0bf464 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Jun 2023 05:04:22 -0700 Subject: [PATCH 243/822] Bump docker/setup-buildx-action from 2.6.0 to 2.7.0 (#10102) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.6.0 to 2.7.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/6a58db7e0d21ca03e6c44877909e80e45217eed2...ecf95283f03858871ff00b787d79c419715afc34) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9764a5e74..f27ac4f9b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@6a58db7e0d21ca03e6c44877909e80e45217eed2 # v2.6.0 + uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34 # v2.7.0 with: version: latest From 7028bce2f2b9f384bebb1c1f0b044d21ed1a202a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Jun 2023 05:06:22 -0700 Subject: [PATCH 244/822] Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 (#10101) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 4.2.0 to 4.3.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/f82d6c1c344bcacabba2c841718984797f664a6b...336e29918d653399e599bfca99fadc1d7ffbc9f7) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 6088f77f8..d8769f439 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -28,7 +28,7 @@ jobs: check-latest: true - name: Run GoReleaser - uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0 + uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0 with: version: latest args: release --rm-dist From b47409afe7d75d435d919a84d0ad6011670264d1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 19 Jun 2023 05:08:22 -0700 Subject: [PATCH 245/822] Bump google.golang.org/grpc from 1.55.0 to 1.56.0 (#10103) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.55.0 to 1.56.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.55.0...v1.56.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 1bdcdbc61..d558077f5 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.9.0 - google.golang.org/grpc v1.55.0 + google.golang.org/grpc v1.56.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 @@ -109,7 +109,7 @@ require ( golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect + google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect google.golang.org/protobuf v1.30.0 // indirect gopkg.in/go-playground/assert.v1 v1.2.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index 9e65d666f..47454259b 100644 --- a/go.sum +++ b/go.sum @@ -647,8 +647,8 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 h1:DdoeryqhaXp1LtT/emMP1BRJPHHKFi5akj/nbx/zNTA= -google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s= +google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A= +google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -661,8 +661,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag= -google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8= +google.golang.org/grpc v1.56.0 h1:+y7Bs8rtMd07LeXmL3NxcTLn7mUkbKZqEpPhMNkwJEE= +google.golang.org/grpc v1.56.0/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 22e855d413ce1f30478811cbd0283199454e2b8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jun 2023 02:32:23 -0700 Subject: [PATCH 246/822] Bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#10105) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.9.0 to 0.10.0. - [Commits](https://github.com/golang/crypto/compare/v0.9.0...v0.10.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index d558077f5..a28d70f0b 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.9.0 + golang.org/x/crypto v0.10.0 google.golang.org/grpc v1.56.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -103,9 +103,9 @@ require ( golang.org/x/mod v0.10.0 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/sys v0.8.0 // indirect - golang.org/x/term v0.8.0 // indirect - golang.org/x/text v0.9.0 // indirect + golang.org/x/sys v0.9.0 // indirect + golang.org/x/term v0.9.0 // indirect + golang.org/x/text v0.10.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index 47454259b..3bc76ed7f 100644 --- a/go.sum +++ b/go.sum @@ -390,8 +390,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g= -golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= +golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM= +golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -524,19 +524,19 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= -golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s= +golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols= -golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= +golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28= +golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= -golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58= +golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From a53cfba348e0424326f33a89bc2a0f05bb24dd52 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jun 2023 02:34:22 -0700 Subject: [PATCH 247/822] Bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0 (#10106) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.15.1 to 1.16.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.15.1...v1.16.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index a28d70f0b..cbcc28cc8 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/onsi/ginkgo/v2 v2.9.5 github.com/opencontainers/runc v1.1.7 github.com/pmezard/go-difflib v1.0.0 - github.com/prometheus/client_golang v1.15.1 + github.com/prometheus/client_golang v1.16.0 github.com/prometheus/client_model v0.4.0 github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 @@ -93,7 +93,7 @@ require ( github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/prometheus/procfs v0.9.0 // indirect + github.com/prometheus/procfs v0.10.1 // indirect github.com/sergi/go-diff v1.1.0 // indirect github.com/sirupsen/logrus v1.8.1 // indirect github.com/xlab/treeprint v1.1.0 // indirect diff --git a/go.sum b/go.sum index 3bc76ed7f..5924b2d1c 100644 --- a/go.sum +++ b/go.sum @@ -306,8 +306,8 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= -github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI= -github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= +github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8= +github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= @@ -326,8 +326,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= -github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= -github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= +github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg= +github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= From 1eeabe97b5cf8ad04d25f6b435579dce388da4bd Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Tue, 20 Jun 2023 11:42:22 +0200 Subject: [PATCH 248/822] chore: remove echo friom canary tests (#10089) Signed-off-by: Spazzy --- test/e2e/annotations/canary.go | 700 +++++++++++++++++++++---------- test/e2e/framework/deployment.go | 9 +- 2 files changed, 493 insertions(+), 216 deletions(-) diff --git a/test/e2e/annotations/canary.go b/test/e2e/annotations/canary.go index 6dd81fdd8..15cbeffa7 100644 --- a/test/e2e/annotations/canary.go +++ b/test/e2e/annotations/canary.go @@ -30,18 +30,15 @@ import ( ) const ( - canaryService = "echo-canary" + canaryService = "httpbun-canary" ) var _ = framework.DescribeAnnotation("canary-*", func() { - f := framework.NewDefaultFramework("canary") + f := framework.NewDefaultFramework("canary", framework.WithHTTPBunEnabled()) ginkgo.BeforeEach(func() { - // Deployment for main backend - f.NewEchoDeployment() - // Deployment for canary backend - f.NewEchoDeployment(framework.WithDeploymentName(canaryService)) + f.NewHttpbunDeployment(framework.WithDeploymentName(canaryService)) }) ginkgo.Context("when canary is created", func() { @@ -49,9 +46,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -65,16 +67,23 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) }) ginkgo.It("should return 404 status for requests to the canary if no matching ingress is found", func() { @@ -87,13 +96,17 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). @@ -108,7 +121,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + ing := framework.NewSingleIngress(host, "/info", host, f.Namespace, framework.HTTPBunService, 80, annotations) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -123,7 +136,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, f.Namespace, canaryService, + canaryIng := framework.NewSingleIngress(canaryIngName, "/info", host, f.Namespace, canaryService, 80, canaryAnnotations) f.EnsureIngress(canaryIng) @@ -162,9 +175,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -178,29 +196,37 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests destined for the mainline ingress to the maineline upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests destined for the canary ingress to the canary upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) }) ginkgo.It("should route requests to the correct upstream if mainline ingress is created after the canary ingress", func() { @@ -213,15 +239,25 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -230,30 +266,38 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.By("routing requests destined for the mainline ingress to the mainelin upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests destined for the canary ingress to the canary upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) }) ginkgo.It("should route requests to the correct upstream if the mainline ingress is modified", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -267,18 +311,27 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) modAnnotations := map[string]string{ "foo": "bar", } - modIng := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, modAnnotations) - - f.UpdateIngress(modIng) + f.UpdateIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + modAnnotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -287,30 +340,38 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.By("routing requests destined fro the mainline ingress to the mainline upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests destined for the canary ingress to the canary upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) }) ginkgo.It("should route requests to the correct upstream if the canary ingress is modified", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -324,9 +385,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -338,10 +404,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-by-header": "CanaryByHeader2", } - modIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, newAnnotations) - - f.UpdateIngress(modIng) + f.UpdateIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + newAnnotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -350,21 +420,24 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.By("routing requests destined for the mainline ingress to the mainline upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader2", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests destined for the canary ingress to the canary upstream") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader2", "always"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) }) }) @@ -372,9 +445,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.It("should route requests to the correct upstream", func() { host := "foo" - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, nil) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + nil)) f.WaitForNginxServer(host, func(server string) bool { @@ -388,37 +466,46 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the canary upstream when header is set to 'always'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) ginkgo.By("routing requests to the mainline upstream when header is set to 'never'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "never"). Expect(). Status(http.StatusOK). Body(). - Contains(framework.EchoService).NotContains(canaryService) + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests to the mainline upstream when header is set to anything else") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "badheadervalue"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) }) }) @@ -427,9 +514,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -444,45 +536,57 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the canary upstream when header is set to 'DoCanary'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "DoCanary"). Expect(). Status(http.StatusOK). - Body().Contains(canaryService) + Body(). + Contains(canaryService) ginkgo.By("routing requests to the mainline upstream when header is set to 'always'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "always"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests to the mainline upstream when header is set to 'never'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) ginkgo.By("routing requests to the mainline upstream when header is set to anything else") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "otherheadervalue"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body(). + Contains(framework.HTTPBunService). + NotContains(canaryService) }) }) @@ -491,8 +595,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -507,13 +617,18 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, f.Namespace, canaryService, - 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the canary upstream when header pattern is matched") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "DoCanary"). Expect(). @@ -522,19 +637,25 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.By("routing requests to the mainline upstream when header failed to match header value") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "Docanary"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should route requests to the correct upstream", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -550,25 +671,36 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, f.Namespace, canaryService, - 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "DoCananry"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should routes to mainline upstream when the given Regex causes error", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -584,19 +716,24 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, f.Namespace, canaryService, - 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the mainline upstream when the given Regex causes error") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "DoCanary"). WithCookie("CanaryByCookie", "always"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) }) @@ -605,9 +742,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -623,13 +765,18 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the canary upstream when header value does not match and cookie is set to 'always'") f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("CanaryByHeader", "otherheadervalue"). WithCookie("CanaryByCookie", "always"). @@ -644,9 +791,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -660,14 +812,19 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryIngName := fmt.Sprintf("%v-canary", host) - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) ginkgo.By("routing requests to the canary upstream when cookie is set to 'always'") for i := 0; i < 50; i++ { f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithCookie("Canary-By-Cookie", "always"). Expect(). @@ -678,12 +835,12 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.By("routing requests to the mainline upstream when cookie is set to 'never'") for i := 0; i < 50; i++ { f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithCookie("Canary-By-Cookie", "never"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body().Contains(framework.HTTPBunService).NotContains(canaryService) } ginkgo.By("routing requests to the mainline upstream when cookie is set to anything else") @@ -691,12 +848,12 @@ var _ = framework.DescribeAnnotation("canary-*", func() { // This test relies on canary cookie not parsing into the valid // affinity data and canary weight not being specified at all. f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithCookie("Canary-By-Cookie", "badcookievalue"). Expect(). Status(http.StatusOK). - Body().Contains(framework.EchoService).NotContains(canaryService) + Body().Contains(framework.HTTPBunService).NotContains(canaryService) } }) }) @@ -706,9 +863,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -721,9 +883,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight": "0", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -731,12 +898,12 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). Expect(). Status(http.StatusOK). Body(). - Contains(framework.EchoService). + Contains(framework.HTTPBunService). NotContains(canaryService) }) @@ -744,9 +911,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -759,12 +931,17 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight": "100", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). Expect(). Status(http.StatusOK). @@ -776,9 +953,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -792,12 +974,17 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight-total": "1000", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). Expect(). Status(http.StatusOK). @@ -809,9 +996,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -824,9 +1016,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight": "50", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) TestMainlineCanaryDistribution(f, host) }) @@ -835,9 +1032,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { host := "foo" annotations := map[string]string{} - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -851,9 +1053,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight-total": "200", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) TestMainlineCanaryDistribution(f, host) }) @@ -868,17 +1075,23 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-by-header": "CanaryByHeader", } - ing := framework.NewSingleCatchAllIngress(canaryIngName, - f.Namespace, canaryService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleCatchAllIngress( + canaryIngName, + f.Namespace, + canaryService, + 80, + annotations)) - ing = framework.NewSingleCatchAllIngress(host, f.Namespace, - framework.EchoService, 80, nil) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleCatchAllIngress( + host, + f.Namespace, + framework.HTTPBunService, + 80, + nil)) f.WaitForNginxServer("_", func(server string) bool { - upstreamName := fmt.Sprintf(`set $proxy_upstream_name "%s-%s-%s";`, f.Namespace, framework.EchoService, "80") + upstreamName := fmt.Sprintf(`set $proxy_upstream_name "%s-%s-%s";`, f.Namespace, framework.HTTPBunService, "80") canaryUpstreamName := fmt.Sprintf(`set $proxy_upstream_name "%s-%s-%s";`, f.Namespace, canaryService, "80") return strings.Contains(server, fmt.Sprintf(`set $ingress_name "%v";`, host)) && @@ -896,14 +1109,24 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-by-header": "CanaryByHeader", } - ing := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + annotations)) otherHost := "bar" - ing = framework.NewSingleIngress(otherHost, "/", otherHost, - f.Namespace, framework.EchoService, 80, nil) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + otherHost, + "/info", + otherHost, + f.Namespace, + framework.HTTPBunService, + 80, + nil)) f.WaitForNginxConfiguration(func(cfg string) bool { return strings.Contains(cfg, "server_name "+otherHost) && @@ -921,13 +1144,22 @@ var _ = framework.DescribeAnnotation("canary-*", func() { } paths := []string{"/foo", "/bar"} - ing := framework.NewSingleIngressWithMultiplePaths(canaryIngName, paths, host, - f.Namespace, "httpy-svc-canary", 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngressWithMultiplePaths( + canaryIngName, + paths, + host, + f.Namespace, + "httpy-svc-canary", + 80, + annotations)) - ing = framework.NewSingleIngress(host, "/", host, f.Namespace, - framework.EchoService, 80, nil) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, f.Namespace, + framework.HTTPBunService, + 80, + nil)) f.WaitForNginxServer(host, func(server string) bool { @@ -946,9 +1178,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/session-cookie-name": affinityCookieName, } - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -964,14 +1201,19 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/canary-weight": "1", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) // This request will produce affinity cookie coming from the canary // backend. forcedRequestToCanary := f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("ForceCanary", "yes"). Expect(). @@ -988,7 +1230,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { // routed to a specific backend. for i := 0; i < 50; i++ { f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithCookie(affinityCookieName, affinityCookie.Raw().Value). Expect(). @@ -1003,9 +1245,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/session-cookie-name": affinityCookieName, } - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -1022,14 +1269,19 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/affinity-canary-behavior": "sticky", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) // This request will produce affinity cookie coming from the canary // backend. forcedRequestToCanary := f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("ForceCanary", "yes"). Expect(). @@ -1046,7 +1298,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { // routed to a specific backend. for i := 0; i < 50; i++ { f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithCookie(affinityCookieName, affinityCookie.Raw().Value). Expect(). @@ -1061,9 +1313,14 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/session-cookie-name": affinityCookieName, } - ing := framework.NewSingleIngress(host, "/", host, - f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/info", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -1080,14 +1337,19 @@ var _ = framework.DescribeAnnotation("canary-*", func() { "nginx.ingress.kubernetes.io/affinity-canary-behavior": "legacy", } - canaryIng := framework.NewSingleIngress(canaryIngName, "/", host, - f.Namespace, canaryService, 80, canaryAnnotations) - f.EnsureIngress(canaryIng) + f.EnsureIngress(framework.NewSingleIngress( + canaryIngName, + "/info", + host, + f.Namespace, + canaryService, + 80, + canaryAnnotations)) // This request will produce affinity cookie coming from the canary // backend. forcedRequestToCanary := f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). WithHeader("ForceCanary", "yes"). Expect(). @@ -1113,7 +1375,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { // This method assumes canary weight being configured at 50%. func TestMainlineCanaryDistribution(f *framework.Framework, host string) { - re := regexp.MustCompile(fmt.Sprintf(`%s.*`, framework.EchoService)) + re := regexp.MustCompile(fmt.Sprintf(`%s.*`, framework.HTTPBunService)) replicaRequestCount := map[string]int{} // The implementation of choice by weight doesn't guarantee exact @@ -1124,7 +1386,7 @@ func TestMainlineCanaryDistribution(f *framework.Framework, host string) { for i := 0; i < requestsToGet; i++ { body := f.HTTPTestClient(). - GET("/"). + GET("/info"). WithHeader("Host", host). Expect(). Status(http.StatusOK).Body().Raw() @@ -1143,6 +1405,14 @@ func TestMainlineCanaryDistribution(f *framework.Framework, host string) { assert.Equal(ginkgo.GinkgoT(), 2, len(keys)) - assert.GreaterOrEqual(ginkgo.GinkgoT(), int(replicaRequestCount[keys[0].String()]), requestsNumberToTest) - assert.GreaterOrEqual(ginkgo.GinkgoT(), int(replicaRequestCount[keys[1].String()]), requestsNumberToTest) + assert.GreaterOrEqual( + ginkgo.GinkgoT(), + int(replicaRequestCount[keys[0].String()]), + requestsNumberToTest, + ) + assert.GreaterOrEqual( + ginkgo.GinkgoT(), + int(replicaRequestCount[keys[1].String()]), + requestsNumberToTest, + ) } diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index d4e20fbf5..04faefc7f 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -219,7 +219,14 @@ func (f *Framework) NewHttpbunDeployment(opts ...func(*deploymentOptions)) strin options.image, 80, int32(options.replicas), - nil, nil, nil, + nil, nil, + //Required to get hostname information + []corev1.EnvVar{ + { + Name: "HTTPBUN_INFO_ENABLED", + Value: "1", + }, + }, []corev1.VolumeMount{}, []corev1.Volume{}, true, From 0b4c98b7c31f95e00dc93b7a346bfe3a6526af51 Mon Sep 17 00:00:00 2001 From: LucasBoisserie Date: Thu, 22 Jun 2023 16:59:40 +0200 Subject: [PATCH 249/822] feat(helm): Add loadBalancerClass (#9562) --- charts/ingress-nginx/README.md | 1 + charts/ingress-nginx/templates/controller-service.yaml | 3 +++ charts/ingress-nginx/values.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 363970f60..a425ca33e 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -414,6 +414,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ | | controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack-ness requested or required by this Service. Possible values are SingleStack, PreferDualStack or RequireDualStack. The ipFamilies and clusterIPs fields depend on the value of this field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ | | controller.service.labels | object | `{}` | | +| controller.service.loadBalancerClass | string | `""` | Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class | | controller.service.loadBalancerIP | string | `""` | Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer | | controller.service.loadBalancerSourceRanges | list | `[]` | | | controller.service.nodePorts.http | string | `""` | | diff --git a/charts/ingress-nginx/templates/controller-service.yaml b/charts/ingress-nginx/templates/controller-service.yaml index 2b28196de..36feb06c5 100644 --- a/charts/ingress-nginx/templates/controller-service.yaml +++ b/charts/ingress-nginx/templates/controller-service.yaml @@ -28,6 +28,9 @@ spec: {{- if .Values.controller.service.loadBalancerSourceRanges }} loadBalancerSourceRanges: {{ toYaml .Values.controller.service.loadBalancerSourceRanges | nindent 4 }} {{- end }} +{{- if .Values.controller.service.loadBalancerClass }} + loadBalancerClass: {{ toYaml .Values.controller.service.loadBalancerClass }} +{{- end }} {{- if .Values.controller.service.externalTrafficPolicy }} externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }} {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 8080a1fc3..cc8bddf28 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -426,6 +426,8 @@ controller: # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer loadBalancerIP: "" loadBalancerSourceRanges: [] + # -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + loadBalancerClass: "" enableHttp: true enableHttps: true ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. From 8cdbcfa61cefe2bd49ca45bf71b05a57b0a1d30d Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 22 Jun 2023 13:25:41 -0400 Subject: [PATCH 250/822] golang 1.20.5 bump (#10120) Signed-off-by: James Strong --- images/test-runner/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 1d1f4f638..acf3dd660 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -43,7 +43,7 @@ image: --pull \ --push \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.4 \ + --build-arg GOLANG_VERSION=1.20.5 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -64,7 +64,7 @@ build: ensure-buildx --progress=${PROGRESS} \ --pull \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.4 \ + --build-arg GOLANG_VERSION=1.20.5 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ From 08158df8c0b9d869247aceed8fdfffe5ac55e929 Mon Sep 17 00:00:00 2001 From: Isaac Wilson <10012479+jukie@users.noreply.github.com> Date: Thu, 22 Jun 2023 11:35:40 -0600 Subject: [PATCH 251/822] Update typo in docs for lb scheme (#10117) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/README.md.gotmpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index a425ca33e..808601439 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -144,7 +144,7 @@ controller: enabled: true annotations: # Create internal NLB - service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" + service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" # Create internal ELB(Deprecated) # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # Any other annotation can be declared here. diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index 9b6f8c9c9..17b029bbf 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -141,7 +141,7 @@ controller: enabled: true annotations: # Create internal NLB - service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing" + service.beta.kubernetes.io/aws-load-balancer-scheme: "internal" # Create internal ELB(Deprecated) # service.beta.kubernetes.io/aws-load-balancer-internal: "true" # Any other annotation can be declared here. From f8bf5a3086fc52114040a60335e2f483e819a14c Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Fri, 23 Jun 2023 12:01:24 +0200 Subject: [PATCH 252/822] chore: remove echo from snippet tests (#10110) Signed-off-by: Spazzy --- test/e2e/annotations/snippet.go | 46 +++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 16 deletions(-) diff --git a/test/e2e/annotations/snippet.go b/test/e2e/annotations/snippet.go index 367708302..2bbd3e33a 100644 --- a/test/e2e/annotations/snippet.go +++ b/test/e2e/annotations/snippet.go @@ -26,21 +26,25 @@ import ( ) var _ = framework.DescribeAnnotation("configuration-snippet", func() { - f := framework.NewDefaultFramework("configurationsnippet") + f := framework.NewDefaultFramework( + "configurationsnippet", + framework.WithHTTPBunEnabled(), + ) - ginkgo.BeforeEach(func() { - f.NewEchoDeployment() - }) - - ginkgo.It(`set snippet "more_set_headers "Foo1: Bar1";" in all locations"`, func() { + ginkgo.It("set snippet more_set_headers in all locations", func() { host := "configurationsnippet.foo.com" annotations := map[string]string{ - "nginx.ingress.kubernetes.io/configuration-snippet": ` - more_set_headers "Foo1: Bar1";`, + "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Foo1: Bar1";`, } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) + f.EnsureIngress(framework.NewSingleIngress( + host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations)) f.WaitForNginxServer(host, func(server string) bool { @@ -51,23 +55,32 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() { GET("/"). WithHeader("Host", host). Expect(). - Status(http.StatusOK).Headers(). + Status(http.StatusOK). + Headers(). ValueEqual("Foo1", []string{"Bar1"}) }) - ginkgo.It(`drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin"`, func() { + ginkgo.It("drops snippet more_set_header in all locations if disabled by admin", func() { host := "noconfigurationsnippet.foo.com" annotations := map[string]string{ - "nginx.ingress.kubernetes.io/configuration-snippet": ` - more_set_headers "Foo1: Bar1";`, + "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Foo1: Bar1";`, } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + ing := framework.NewSingleIngress( + host, + "/", + host, + f.Namespace, + framework.HTTPBunService, + 80, + annotations) + f.UpdateNginxConfigMapData("allow-snippet-annotations", "false") defer func() { // Return to the original value f.UpdateNginxConfigMapData("allow-snippet-annotations", "true") }() + // Sleep a while just to guarantee that the configmap is applied framework.Sleep() f.EnsureIngress(ing) @@ -81,7 +94,8 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() { GET("/"). WithHeader("Host", host). Expect(). - Status(http.StatusOK).Headers(). + Status(http.StatusOK). + Headers(). NotContainsKey("Foo1") }) }) From 44b006719150ac45f05e9fbb7f269110c3f3ec61 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 23 Jun 2023 09:31:00 -0400 Subject: [PATCH 253/822] add gcloud ignore Signed-off-by: James Strong --- .gcloudignore | 0 images/test-runner/cloudbuild.yaml | 6 ------ 2 files changed, 6 deletions(-) create mode 100644 .gcloudignore diff --git a/.gcloudignore b/.gcloudignore new file mode 100644 index 000000000..e69de29bb diff --git a/images/test-runner/cloudbuild.yaml b/images/test-runner/cloudbuild.yaml index 761ea7f28..b17de9b31 100644 --- a/images/test-runner/cloudbuild.yaml +++ b/images/test-runner/cloudbuild.yaml @@ -6,8 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -17,7 +15,3 @@ steps: - | gcloud auth configure-docker \ && cd images/test-runner && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" - _PULL_BASE_SHA: '12345' \ No newline at end of file From cd610168be182844c8a9d73cd5540de2dc62b5d0 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 23 Jun 2023 14:17:24 -0400 Subject: [PATCH 254/822] update test runner (#10125) Signed-off-by: James Strong --- build/run-in-docker.sh | 2 +- test/e2e-image/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index d2d6fcdd9..86e0e443f 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230527@sha256:a98ce8ab90f16bdd8539b168a4d000f366afa4eec23a220b3ce39698c5769bfd} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230623-d50c7193b@sha256:e5c68dc56934c273850bfb75c0348a2819756669baf59fcdce9e16771537b247} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index f74ea8c74..f68d6ea6e 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230527@sha256:a98ce8ab90f16bdd8539b168a4d000f366afa4eec23a220b3ce39698c5769bfd" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230623-d50c7193b@sha256:e5c68dc56934c273850bfb75c0348a2819756669baf59fcdce9e16771537b247" image: echo "..entered Makefile in /test/e2e-image" From 58650d6aaab8452d9ceaa010db251c068a1d91f3 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 23 Jun 2023 15:29:48 -0400 Subject: [PATCH 255/822] rebuild nginx base container image Signed-off-by: James Strong --- TAG | 2 +- images/nginx/TAG | 2 +- images/nginx/cloudbuild.yaml | 6 ------ 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/TAG b/TAG index ba103d909..c9a0c1a83 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.8.0 +v1.8.1 diff --git a/images/nginx/TAG b/images/nginx/TAG index 77d6f4ca2..8acdd82b7 100644 --- a/images/nginx/TAG +++ b/images/nginx/TAG @@ -1 +1 @@ -0.0.0 +0.0.1 diff --git a/images/nginx/cloudbuild.yaml b/images/nginx/cloudbuild.yaml index c581700dd..71051f26d 100644 --- a/images/nginx/cloudbuild.yaml +++ b/images/nginx/cloudbuild.yaml @@ -8,8 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx - HOME=/root args: @@ -17,7 +15,3 @@ steps: - | gcloud auth configure-docker \ && cd images/nginx && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" - _PULL_BASE_SHA: '12345' From 643c475db08e216eebd8c17dfc069b1a257d2df1 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Mon, 26 Jun 2023 07:03:11 +0530 Subject: [PATCH 256/822] bump pinned golang to 1.20.5 (#10127) --- images/custom-error-pages/rootfs/Dockerfile | 2 +- images/ext-auth-example-authsvc/rootfs/Dockerfile | 2 +- images/fastcgi-helloserver/rootfs/Dockerfile | 2 +- images/go-grpc-greeter-server/rootfs/Dockerfile | 2 +- images/httpbun/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/Dockerfile | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index 30ac54693..04bcb8e08 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.4-alpine3.18 as builder +FROM golang:1.20.5-alpine3.18 as builder RUN apk update \ && apk upgrade && apk add git diff --git a/images/ext-auth-example-authsvc/rootfs/Dockerfile b/images/ext-auth-example-authsvc/rootfs/Dockerfile index 96dcd9a39..02d92d773 100644 --- a/images/ext-auth-example-authsvc/rootfs/Dockerfile +++ b/images/ext-auth-example-authsvc/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.4-alpine3.18 as builder +FROM golang:1.20.5-alpine3.18 as builder RUN mkdir /authsvc WORKDIR /authsvc COPY . ./ diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile index a11834373..096d31abb 100755 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.4-alpine3.18 as builder +FROM golang:1.20.5-alpine3.18 as builder WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi diff --git a/images/go-grpc-greeter-server/rootfs/Dockerfile b/images/go-grpc-greeter-server/rootfs/Dockerfile index d457b43e5..46f916fb4 100644 --- a/images/go-grpc-greeter-server/rootfs/Dockerfile +++ b/images/go-grpc-greeter-server/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.4-alpine3.18 as build +FROM golang:1.20.5-alpine3.18 as build WORKDIR /go/src/greeter-server diff --git a/images/httpbun/rootfs/Dockerfile b/images/httpbun/rootfs/Dockerfile index a1775d303..e88716bb8 100644 --- a/images/httpbun/rootfs/Dockerfile +++ b/images/httpbun/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20 AS builder +FROM golang:1.20.5 AS builder ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 diff --git a/images/kube-webhook-certgen/rootfs/Dockerfile b/images/kube-webhook-certgen/rootfs/Dockerfile index 40a2c31ac..13226dbe2 100644 --- a/images/kube-webhook-certgen/rootfs/Dockerfile +++ b/images/kube-webhook-certgen/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM --platform=$BUILDPLATFORM golang:1.20.1 as builder +FROM --platform=$BUILDPLATFORM golang:1.20.5 as builder ARG BUILDPLATFORM ARG TARGETARCH From a21b5218a53476015c996e2588ac5837b20d37b0 Mon Sep 17 00:00:00 2001 From: Junrui Chen Date: Tue, 27 Jun 2023 16:30:30 +1000 Subject: [PATCH 257/822] Set grpc :authority header from request header (#8912) This is to fix that the `:authority` header is set to `upstream_balancer` --- rootfs/etc/nginx/template/nginx.tmpl | 2 -- test/e2e/annotations/grpc.go | 1 + 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index a1e02aae3..ccc86702d 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -1388,13 +1388,11 @@ stream { {{ end }} {{/* By default use vhost as Host to upstream, but allow overrides */}} - {{ if not (eq $proxySetHeader "grpc_set_header") }} {{ if not (empty $location.UpstreamVhost) }} {{ $proxySetHeader }} Host {{ $location.UpstreamVhost | quote }}; {{ else }} {{ $proxySetHeader }} Host $best_http_host; {{ end }} - {{ end }} # Pass the extracted client certificate to the backend {{ if not (empty $server.CertificateAuth.CAFileName) }} diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index c8e530ead..243307df4 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -120,6 +120,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { metadata := res.GetMetadata() assert.Equal(ginkgo.GinkgoT(), metadata["content-type"].Values[0], "application/grpc") + assert.Equal(ginkgo.GinkgoT(), metadata[":authority"].Values[0], host) }) ginkgo.It("authorization metadata should be overwritten by external auth response headers", func() { From 0986c33378e8567059ce00d7dc8e7f36c56731e4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 27 Jun 2023 05:28:30 -0700 Subject: [PATCH 258/822] Bump google.golang.org/grpc from 1.56.0 to 1.56.1 (#10134) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.0 to 1.56.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.56.0...v1.56.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index cbcc28cc8..4b75cbd12 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.10.0 - google.golang.org/grpc v1.56.0 + google.golang.org/grpc v1.56.1 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 5924b2d1c..db879481c 100644 --- a/go.sum +++ b/go.sum @@ -661,8 +661,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.56.0 h1:+y7Bs8rtMd07LeXmL3NxcTLn7mUkbKZqEpPhMNkwJEE= -google.golang.org/grpc v1.56.0/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= +google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ= +google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From ef6163a0883e2be47d89a18b571aa128e24a19c1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 27 Jun 2023 05:30:31 -0700 Subject: [PATCH 259/822] Bump ossf/scorecard-action from 2.1.3 to 2.2.0 (#10133) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.3 to 2.2.0. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/80e868c13c90f172d68d1f4501dee99e2479f7af...08b4669551908b1024bb425080c797723083c031) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 72a112ac4..2e276a3f6 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3 + uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 with: results_file: results.sarif results_format: sarif From 002d7e90d76e2588a7b3babc671837e5803656d9 Mon Sep 17 00:00:00 2001 From: Fabio Formosa Date: Tue, 27 Jun 2023 14:34:32 +0200 Subject: [PATCH 260/822] Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406) * Update README.md #9403 Add documentation for controller.service.internal.loadBalancerIP in Helm chart * Update README.md removed a duplicated row in the helm chart values * #9403 added a doc to the internal loadBalancerIP removed a comment from an already supported helm value and added a doc line * #9403 Reverted a manual added line Removed a manual added line in favour of helm doc * #9403 re-generated the README with the last doc line added to the value.yaml * #9403 removed trailing spaces * removed trail spaces --- charts/ingress-nginx/README.md | 1 + charts/ingress-nginx/values.yaml | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 808601439..8b5d92d37 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -408,6 +408,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | | controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. | | controller.service.internal.enabled | bool | `false` | Enables an additional internal load balancer (besides the external one). | +| controller.service.internal.loadBalancerIP | string | `""` | Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. | | controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. | | controller.service.internal.ports | object | `{}` | Custom port mapping for internal service | | controller.service.internal.targetPorts | object | `{}` | Custom target port mapping for internal service | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index cc8bddf28..b313643f3 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -478,7 +478,9 @@ controller: enabled: false # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. annotations: {} - # loadBalancerIP: "" + + # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. + loadBalancerIP: "" # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. loadBalancerSourceRanges: [] From 8b24fc98d28dec4e1cdc247fac240cd237c0c8c9 Mon Sep 17 00:00:00 2001 From: kylekluever <39891060+kylekluever@users.noreply.github.com> Date: Tue, 27 Jun 2023 07:42:32 -0500 Subject: [PATCH 261/822] Fix loadBalancerClass value (#10139) --- charts/ingress-nginx/templates/controller-service.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/ingress-nginx/templates/controller-service.yaml b/charts/ingress-nginx/templates/controller-service.yaml index 36feb06c5..b2735d2e8 100644 --- a/charts/ingress-nginx/templates/controller-service.yaml +++ b/charts/ingress-nginx/templates/controller-service.yaml @@ -29,7 +29,7 @@ spec: loadBalancerSourceRanges: {{ toYaml .Values.controller.service.loadBalancerSourceRanges | nindent 4 }} {{- end }} {{- if .Values.controller.service.loadBalancerClass }} - loadBalancerClass: {{ toYaml .Values.controller.service.loadBalancerClass }} + loadBalancerClass: {{ .Values.controller.service.loadBalancerClass }} {{- end }} {{- if .Values.controller.service.externalTrafficPolicy }} externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }} From 1ddecfc09945e265b88e510f8c0787519ab7b476 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Tue, 27 Jun 2023 23:36:33 +0530 Subject: [PATCH 262/822] changed to updated baseimage and reverted tag (#10143) --- NGINX_BASE | 2 +- TAG | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/NGINX_BASE b/NGINX_BASE index 02a35039a..14a7ee54b 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:v20230527@sha256:cf77c71aa6e4284925ca2233ddf871b5823eaa3ee000347ae25096b07fb52c57 +registry.k8s.io/ingress-nginx/nginx:v20230623-427f3d2fb@sha256:7b479f66872c0b1cb0f1315e305b8a3e9c6da846c7dd3855db99bc8cfd6791e1 diff --git a/TAG b/TAG index c9a0c1a83..804a616da 100644 --- a/TAG +++ b/TAG @@ -1,2 +1 @@ -v1.8.1 - +v1.8.0 From a2f3036e20bcd500daee9d9eeebf807257c75c7b Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Wed, 28 Jun 2023 02:50:32 +0800 Subject: [PATCH 263/822] netlify: Only trigger preview when there are changes in docs. (#10144) Signed-off-by: Jintao Zhang --- netlify.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/netlify.toml b/netlify.toml index add8d4fc3..dc4b0d1ca 100644 --- a/netlify.toml +++ b/netlify.toml @@ -2,6 +2,7 @@ [build] publish = "site" command = "make build-docs" +ignore = "git diff --quiet $CACHED_COMMIT_REF $COMMIT_REF ./docs" # available here https://github.com/netlify/build-image/blob/focal/included_software.md#languages environment = { PYTHON_VERSION = "3.8" } From b38a2c761283e16bff3f17f56ce135986b9716ab Mon Sep 17 00:00:00 2001 From: z1cheng Date: Fri, 30 Jun 2023 12:37:20 +0000 Subject: [PATCH 264/822] Fix OCI manifest templates and regenerate the deploy files Signed-off-by: z1cheng --- deploy/static/provider/oci/deploy.yaml | 57 ++++++++++--------- deploy/static/provider/oci/kustomization.yaml | 2 +- .../provider/oci/kustomization.yaml | 4 ++ .../provider/oci/values.yaml | 8 +++ 4 files changed, 42 insertions(+), 29 deletions(-) create mode 100644 hack/manifest-templates/provider/oci/kustomization.yaml create mode 100644 hack/manifest-templates/provider/oci/values.yaml diff --git a/deploy/static/provider/oci/deploy.yaml b/deploy/static/provider/oci/deploy.yaml index 77de50247..2518201bd 100644 --- a/deploy/static/provider/oci/deploy.yaml +++ b/deploy/static/provider/oci/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,26 +328,27 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx --- apiVersion: v1 kind: Service metadata: + annotations: + service.beta.kubernetes.io/oci-load-balancer-shape: flexible + service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100" + service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10" labels: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx - annotations: - service.beta.kubernetes.io/oci-load-balancer-shape: "flexible" - service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10" - service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100" spec: + externalTrafficPolicy: Local ipFamilies: - IPv4 ipFamilyPolicy: SingleStack @@ -376,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 spec: containers: - args: @@ -441,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-create spec: containers: @@ -538,7 +539,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: create securityContext: @@ -560,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission-patch spec: containers: @@ -587,7 +588,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b imagePullPolicy: IfNotPresent name: patch securityContext: @@ -609,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.8.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oci/kustomization.yaml b/deploy/static/provider/oci/kustomization.yaml index d477ec405..632c0f80f 100644 --- a/deploy/static/provider/oci/kustomization.yaml +++ b/deploy/static/provider/oci/kustomization.yaml @@ -4,7 +4,7 @@ # ``` # namespace: ingress-nginx # bases: -# - github.com/kubernetes/ingress-nginx/tree/main/deploy/static/provider/cloud +# - github.com/kubernetes/ingress-nginx/tree/main/deploy/static/provider/oci # ``` resources: diff --git a/hack/manifest-templates/provider/oci/kustomization.yaml b/hack/manifest-templates/provider/oci/kustomization.yaml new file mode 100644 index 000000000..cd6ef95be --- /dev/null +++ b/hack/manifest-templates/provider/oci/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../common diff --git a/hack/manifest-templates/provider/oci/values.yaml b/hack/manifest-templates/provider/oci/values.yaml new file mode 100644 index 000000000..b4480531f --- /dev/null +++ b/hack/manifest-templates/provider/oci/values.yaml @@ -0,0 +1,8 @@ +controller: + service: + type: LoadBalancer + externalTrafficPolicy: Local + annotations: + service.beta.kubernetes.io/oci-load-balancer-shape: "flexible" + service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10" + service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100" From 155fc8daa468fd127b16118832279e0f6f42aa1b Mon Sep 17 00:00:00 2001 From: z1cheng Date: Fri, 30 Jun 2023 12:49:51 +0000 Subject: [PATCH 265/822] Rename OCI to oracle Signed-off-by: z1cheng --- deploy/static/provider/{oci => oracle}/deploy.yaml | 0 deploy/static/provider/{oci => oracle}/kustomization.yaml | 2 +- .../provider/{oci => oracle}/kustomization.yaml | 0 hack/manifest-templates/provider/{oci => oracle}/values.yaml | 0 4 files changed, 1 insertion(+), 1 deletion(-) rename deploy/static/provider/{oci => oracle}/deploy.yaml (100%) rename deploy/static/provider/{oci => oracle}/kustomization.yaml (94%) rename hack/manifest-templates/provider/{oci => oracle}/kustomization.yaml (100%) rename hack/manifest-templates/provider/{oci => oracle}/values.yaml (100%) diff --git a/deploy/static/provider/oci/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml similarity index 100% rename from deploy/static/provider/oci/deploy.yaml rename to deploy/static/provider/oracle/deploy.yaml diff --git a/deploy/static/provider/oci/kustomization.yaml b/deploy/static/provider/oracle/kustomization.yaml similarity index 94% rename from deploy/static/provider/oci/kustomization.yaml rename to deploy/static/provider/oracle/kustomization.yaml index 632c0f80f..5c1dcff96 100644 --- a/deploy/static/provider/oci/kustomization.yaml +++ b/deploy/static/provider/oracle/kustomization.yaml @@ -4,7 +4,7 @@ # ``` # namespace: ingress-nginx # bases: -# - github.com/kubernetes/ingress-nginx/tree/main/deploy/static/provider/oci +# - github.com/kubernetes/ingress-nginx/tree/main/deploy/static/provider/oracle # ``` resources: diff --git a/hack/manifest-templates/provider/oci/kustomization.yaml b/hack/manifest-templates/provider/oracle/kustomization.yaml similarity index 100% rename from hack/manifest-templates/provider/oci/kustomization.yaml rename to hack/manifest-templates/provider/oracle/kustomization.yaml diff --git a/hack/manifest-templates/provider/oci/values.yaml b/hack/manifest-templates/provider/oracle/values.yaml similarity index 100% rename from hack/manifest-templates/provider/oci/values.yaml rename to hack/manifest-templates/provider/oracle/values.yaml From 652a80042222f881ce56b3b689498e2b6fe4de72 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 30 Jun 2023 17:37:24 -0400 Subject: [PATCH 266/822] release notes 1.8.1 (#10161) Signed-off-by: James Strong --- README.md | 7 +- changelog/Changelog-1.8.1.md | 67 ++++ charts/ingress-nginx/Chart.yaml | 11 +- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.7.1.md | 12 + charts/ingress-nginx/values.yaml | 8 +- deploy/static/provider/aws/deploy.yaml | 44 +-- .../aws/nlb-with-tls-termination/deploy.yaml | 44 +-- deploy/static/provider/baremetal/deploy.yaml | 44 +-- deploy/static/provider/cloud/deploy.yaml | 44 +-- deploy/static/provider/do/deploy.yaml | 44 +-- deploy/static/provider/exoscale/deploy.yaml | 44 +-- deploy/static/provider/kind/deploy.yaml | 44 +-- deploy/static/provider/oracle/deploy.yaml | 44 +-- deploy/static/provider/scw/deploy.yaml | 44 +-- docs/deploy/index.md | 20 +- docs/e2e-tests.md | 356 +++++++++--------- 17 files changed, 482 insertions(+), 403 deletions(-) create mode 100644 changelog/Changelog-1.8.1.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.7.1.md diff --git a/README.md b/README.md index dc7ff3c38..812ddacb6 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p | | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | |:--:|-----------------------|------------------------------|----------------|---------------|--------------------| +| 🔄 | **v1.8.1** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.0** | 1.27,1.26, 1.25, 1.24 | 3.18.0 | 1.21.6 | 4.7.* | | 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | | 🔄 | **v1.7.0** | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | @@ -77,15 +78,15 @@ Thanks for taking the time to join our community and start contributing! - Read [`CONTRIBUTING.md`](CONTRIBUTING.md) for information about setting up your environment, the workflow that we expect, and instructions on the developer certificate of origin that we require. - Join our Kubernetes Slack channel for developer discussion : [#ingress-nginx-dev](https://kubernetes.slack.com/archives/C021E147ZA4). - - Submit GitHub issues for any feature enhancements, bugs or documentation problems. + - Submit GitHub issues for any feature enhancements, bugs or documentation problems. - Please make sure to read the [Issue Reporting Checklist](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md#issue-reporting-guidelines) before opening an issue. Issues not conforming to the guidelines **may be closed immediately**. - Join our [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernetes.io/g/ingress-nginx-dev/c/ebbBMo-zX-w) -- **Support**: +- **Support**: - Join the [#ingress-nginx-users](https://kubernetes.slack.com/messages/CANQGM8BA/) channel inside the [Kubernetes Slack](http://slack.kubernetes.io/) to ask questions or get support from the maintainers and other users. - The [GitHub issues](https://github.com/kubernetes/ingress-nginx/issues) in the repository are **exclusively** for bug reports and feature requests. - **Discuss**: Tweet using the `#IngressNginx` hashtag or sharing with us [@IngressNginx](https://twitter.com/IngressNGINX). ## License -[Apache License 2.0](https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE) \ No newline at end of file +[Apache License 2.0](https://github.com/kubernetes/ingress-nginx/blob/main/LICENSE) diff --git a/changelog/Changelog-1.8.1.md b/changelog/Changelog-1.8.1.md new file mode 100644 index 000000000..c84a7ce18 --- /dev/null +++ b/changelog/Changelog-1.8.1.md @@ -0,0 +1,67 @@ +# Changelog + +### 1.8.1 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + * registry.k8s.io/ingress-nginx/controller-chroot:v1.8.1@sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627 + +### All Changes: + +* netlify: Only trigger preview when there are changes in docs. (#10144) +* changed to updated baseimage and reverted tag (#10143) +* Fix loadBalancerClass value (#10139) +* Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406) +* Set grpc :authority header from request header (#8912) +* bump pinned golang to 1.20.5 (#10127) +* update test runner (#10125) +* chore: remove echo from snippet tests (#10110) +* Update typo in docs for lb scheme (#10117) +* golang 1.20.5 bump (#10120) +* feat(helm): Add loadBalancerClass (#9562) +* chore: remove echo friom canary tests (#10089) +* fix: obsolete warnings (#10029) +* docs: change Dockefile url ref main (#10087) +* Revert "Remove fastcgi feature" (#10081) +* docs: add netlify configuration (#10073) +* add distroless otel init (#10035) +* chore: move httpbun to be part of framework (#9955) +* Remove fastcgi feature (#9864) +* Fix mirror-target values without path separator and port (#9889) +* Adding feature to upgrade Oracle Cloud Infrastructure's Flexible Load Balancer and adjusting Health Check that were critical in the previous configuration (#9961) +* add support for keda fallback settings (#9993) +* unnecessary use of fmt.Sprint (S1039) (#10049) +* chore: pkg imported more than once (#10048) +* tracing: upgrade to dd-opentracing-cpp v1.3.7 (#10031) +* fix: add canary to sidebar in examples (#10068) +* docs: add lua testing documentation (#10060) +* docs: canary weighted deployments example (#10067) +* Update Internal Load Balancer docs (#10062) +* fix broken kubernetes.io/user-guide/ docs links (#10055) +* docs: Updated the content of deploy/rbac.md (#10054) +* ensured hpa mem spec before cpu spec (#10043) +* Fix typo in controller_test (#10034) +* chore(dep): upgrade github.com/emicklei/go-restful/v3 to 3.10 (#10028) +* Upgrade to Golang 1.20.4 (#10016) +* perf: avoid unnecessary byte/string conversion (#10012) +* added note on dns for localtesting (#10021) +* added helmshowvalues example (#10019) +* release controller 1.8.0 and chart 4.7.0 (#10017) + +### Dependencies updates: +* Bump ossf/scorecard-action from 2.1.3 to 2.2.0 (#10133) +* Bump google.golang.org/grpc from 1.56.0 to 1.56.1 (#10134) +* Bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0 (#10106) +* Bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#10105) +* Bump google.golang.org/grpc from 1.55.0 to 1.56.0 (#10103) +* Bump goreleaser/goreleaser-action from 4.2.0 to 4.3.0 (#10101) +* Bump docker/setup-buildx-action from 2.6.0 to 2.7.0 (#10102) +* Bump actions/checkout from 3.5.2 to 3.5.3 (#10076) +* Bump docker/setup-qemu-action from 2.1.0 to 2.2.0 (#10075) +* Bump aquasecurity/trivy-action from 0.10.0 to 0.11.2 (#10078) +* Bump docker/setup-buildx-action from 2.5.0 to 2.6.0 (#10077) +* Bump actions/dependency-review-action from 3.0.4 to 3.0.6 (#10042) +* Bump github.com/stretchr/testify from 1.8.3 to 1.8.4 (#10041) +* Bump github.com/stretchr/testify from 1.8.2 to 1.8.3 (#10005) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.8.0...controller-controller-v1.8.1 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 9786f705c..de5fe4df0 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,11 +1,12 @@ annotations: artifacthub.io/changes: | - - "helm: Fix opentelemetry module installation for daemonset (#9792)" - - "Update charts/* to keep project name display aligned (#9931)" - - "Update Ingress-Nginx version controller-v1.8.0" + - "Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406)" + - "feat(helm): Add loadBalancerClass (#9562)" + - "added helmshowvalues example (#10019)" + - "Update Ingress-Nginx version controller-v1.8.1" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.8.0 +appVersion: 1.8.1 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -22,4 +23,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.7.0 +version: 4.7.1 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 8b5d92d37..955091873 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.7.0](https://img.shields.io/badge/Version-4.7.0-informational?style=flat-square) ![AppVersion: 1.8.0](https://img.shields.io/badge/AppVersion-1.8.0-informational?style=flat-square) +![Version: 4.7.1](https://img.shields.io/badge/Version-4.7.1-informational?style=flat-square) ![AppVersion: 1.8.1](https://img.shields.io/badge/AppVersion-1.8.1-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -313,13 +313,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3"` | | -| controller.image.digestChroot | string | `"sha256:a45e41cd2b7670adf829759878f512d4208d0aec1869dae593a0fecd09a5e49e"` | | +| controller.image.digest | string | `"sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd"` | | +| controller.image.digestChroot | string | `"sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.8.0"` | | +| controller.image.tag | string | `"v1.8.1"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.7.1.md b/charts/ingress-nginx/changelog/Changelog-4.7.1.md new file mode 100644 index 000000000..4d69a7117 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.7.1.md @@ -0,0 +1,12 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.1 + +* Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406) +* feat(helm): Add loadBalancerClass (#9562) +* added helmshowvalues example (#10019) +* Update Ingress-Nginx version controller-v1.8.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.0...helm-chart-4.7.1 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index b313643f3..d091391a8 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -23,9 +23,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.8.0" - digest: sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 - digestChroot: sha256:a45e41cd2b7670adf829759878f512d4208d0aec1869dae593a0fecd09a5e49e + tag: "v1.8.1" + digest: sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + digestChroot: sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 @@ -478,10 +478,8 @@ controller: enabled: false # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. annotations: {} - # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. loadBalancerIP: "" - # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. loadBalancerSourceRanges: [] ## Set external traffic policy to: "Local" to preserve source IP on diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 48f7f11b1..f22f3a9c1 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index b4e2cd5f6..e9ae85143 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -427,7 +427,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -451,7 +451,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -526,7 +526,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -537,7 +537,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -573,7 +573,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -584,7 +584,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -635,7 +635,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 74292b82b..b66da7d45 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -413,7 +413,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -436,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -508,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -519,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -555,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -566,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -604,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -617,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 6dac63865..659da1d1b 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -414,7 +414,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -438,7 +438,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -510,7 +510,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -521,7 +521,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -557,7 +557,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -568,7 +568,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -606,7 +606,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 0e3f4b46f..434f21ead 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index a1bd4ed00..c9dff62cb 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -519,7 +519,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -530,7 +530,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -566,7 +566,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -577,7 +577,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -615,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -628,7 +628,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index 41d17d8d1..f9965d0fe 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index 2518201bd..72556bb42 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index e303a52f5..8b4750992 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3 + image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-create spec: containers: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission-patch spec: containers: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.0 + app.kubernetes.io/version: 1.8.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/deploy/index.md b/docs/deploy/index.md index 76a28b6ad..d719d4a57 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -68,7 +68,7 @@ helm show values ingress-nginx --repo https://kubernetes.github.io/ingress-nginx **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -243,7 +243,7 @@ In AWS, we use a Network load balancer (NLB) to expose the Ingress-Nginx Control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -251,10 +251,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -300,7 +300,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -317,7 +317,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -325,7 +325,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -333,7 +333,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -348,7 +348,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml ``` A @@ -375,7 +375,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.0/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 025ff686d..ced8eaeaf 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -55,42 +55,6 @@ Do not try to edit it manually. - [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) -### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L40) - -- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L47) -- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L66) -- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L90) -- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L117) -- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L145) -- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L173) -- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L200) -- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L228) -- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L267) -- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L285) -- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L302) -- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L323) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L412) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L423) -- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L434) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L486) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L495) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L506) -- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L530) -- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L553) -- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L571) -- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L591) -- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L610) -- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L624) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L679) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L688) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L699) -- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L773) -- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L793) -- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L821) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L850) -- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L880) -- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L888) - ### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L29) - [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L36) @@ -111,34 +75,6 @@ Do not try to edit it manually. - [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) - [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) - -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) -- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) - ### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) - [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L35) @@ -148,10 +84,6 @@ Do not try to edit it manually. - [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L123) - [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L145) -### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L29) - -- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L36) - ### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L28) - [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L35) @@ -212,13 +144,6 @@ Do not try to edit it manually. - [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L38) -### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L40) - -- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L43) -- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L68) -- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L126) -- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L199) - ### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L27) - [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) @@ -245,12 +170,6 @@ Do not try to edit it manually. - [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L34) - [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L49) -### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) - -- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) -- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) -- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) - ### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) - [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) @@ -306,11 +225,6 @@ Do not try to edit it manually. - [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) - [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) -### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L35) - -- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L42) -- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L84) - ### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L28) - [add valid directives to server via server snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L35) @@ -322,11 +236,6 @@ Do not try to edit it manually. - [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L70) - [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L99) -### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L58) - ### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L28) - [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L35) @@ -350,6 +259,97 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) + +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) +- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) +- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) +- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) +- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L472) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L481) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L492) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L516) +- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L539) +- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L557) +- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L577) +- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L596) +- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L610) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L653) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L662) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L673) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L732) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L752) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L780) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L809) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L839) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L847) + +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) + +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L45) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L89) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L120) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L174) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L232) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L289) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L363) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L445) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L513) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L594) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L647) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L692) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L741) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L790) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L862) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L910) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L952) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L995) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1070) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1104) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1138) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1175) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1242) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1310) + +### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L28) + +- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L35) + +### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) + +- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) +- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) +- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) + +### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L33) + +- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L40) +- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L82) + +### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) + +- [set snippet more_set_headers in all locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L34) +- [drops snippet more_set_header in all locations if disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L63) + +### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L39) + +- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L42) +- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L67) +- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L126) +- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L186) + ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) - [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) @@ -390,10 +390,6 @@ Do not try to edit it manually. - [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L43) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) @@ -402,10 +398,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) -### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) @@ -478,6 +470,14 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L217) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) + ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) @@ -571,21 +571,21 @@ Do not try to edit it manually. - [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) - [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L54) -### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L37) - -- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L40) -- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L72) -- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L110) -- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L138) -- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L169) -- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L206) -- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L241) -- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L311) - ### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) - [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) +### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L37) + +- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L40) +- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L77) +- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L117) +- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L147) +- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L183) +- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L224) +- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L260) +- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L347) + ### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) - [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L32) @@ -601,10 +601,6 @@ Do not try to edit it manually. - [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L102) - [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L133) -### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) - -- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L39) - ### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) - [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) @@ -626,26 +622,12 @@ Do not try to edit it manually. - [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) - [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) -### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) - -- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L52) - ### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) - [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) - [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L53) - [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L80) -### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) - -- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) -- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) - -### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L30) - -- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L40) -- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L92) - ### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L37) - [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L46) @@ -657,21 +639,6 @@ Do not try to edit it manually. - [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) - [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) -### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L34) - -- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L85) -- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L102) -- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L126) -- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L155) -- [should proxy_method method when global-auth-method is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L197) -- [should add custom error page when global-auth-signin url is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L210) -- [should add auth headers when global-auth-response-headers is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L223) -- [should set request-redirect when global-auth-request-redirect is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L237) -- [should set snippet when global external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L250) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L326) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L337) -- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L348) - ### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) - [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) @@ -715,25 +682,10 @@ Do not try to edit it manually. - [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L631) - [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L652) -### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L28) - -- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L40) -- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L48) -- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L59) -- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L68) -- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L77) -- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L86) - ### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) - [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) -### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L32) - -- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L48) -- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L70) -- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L100) - ### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) - [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L40) @@ -773,10 +725,6 @@ Do not try to edit it manually. - [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) - [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) -### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L28) - -- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) - ### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) - [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) @@ -822,22 +770,10 @@ Do not try to edit it manually. - [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L36) - [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L52) -### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) - -- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) -- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L57) - ### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) - [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) -### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L36) - -- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L46) -- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L79) -- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L112) -- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L155) - ### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L28) - [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L36) @@ -868,15 +804,79 @@ Do not try to edit it manually. - [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) +### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) + +- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) + +### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) + +- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L38) + +### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) + +- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L55) + +### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) + +- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) +- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) + +### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L29) + +- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L39) +- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L91) + +### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L34) + +- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L87) +- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L104) +- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L128) +- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L157) +- [should proxy_method method when global-auth-method is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L199) +- [should add custom error page when global-auth-signin url is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L212) +- [should add auth headers when global-auth-response-headers is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L225) +- [should set request-redirect when global-auth-request-redirect is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L239) +- [should set snippet when global external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L252) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L328) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L339) +- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L350) + +### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L27) + +- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L39) +- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L47) +- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L58) +- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L67) +- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L76) +- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L85) + +### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L30) + +- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L46) +- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L68) +- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L98) + +### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L27) + +- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L30) + +### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) + +- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) +- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L57) + +### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L36) + +- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L46) +- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L79) +- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L112) +- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L155) + ### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) - [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) - [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) -### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) - -- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) - ### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L31) - [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L65) From ebb631449474d12192304feacd180f1430035188 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 2 Jul 2023 06:26:49 -0300 Subject: [PATCH 267/822] Deprecate and remove AJP support (#10158) --- docs/e2e-tests.md | 1 - .../user-guide/nginx-configuration/annotations.md | 4 ++-- images/nginx/rootfs/build.sh | 9 --------- .../ingress/annotations/backendprotocol/main.go | 2 +- internal/ingress/controller/template/template.go | 3 --- .../ingress/controller/template/template_test.go | 2 -- rootfs/etc/nginx/template/nginx.tmpl | 1 - test/e2e/annotations/backendprotocol.go | 15 --------------- 8 files changed, 3 insertions(+), 34 deletions(-) diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index ced8eaeaf..c45b1e72c 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -73,7 +73,6 @@ Do not try to edit it manually. - [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) - [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) - [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) -- [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) ### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index b515a9f3b..0916b4df5 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -38,7 +38,7 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz |[nginx.ingress.kubernetes.io/auth-proxy-set-headers](#external-authentication)|string| |[nginx.ingress.kubernetes.io/auth-snippet](#external-authentication)|string| |[nginx.ingress.kubernetes.io/enable-global-auth](#external-authentication)|"true" or "false"| -|[nginx.ingress.kubernetes.io/backend-protocol](#backend-protocol)|string|HTTP,HTTPS,GRPC,GRPCS,AJP| +|[nginx.ingress.kubernetes.io/backend-protocol](#backend-protocol)|string|HTTP,HTTPS,GRPC,GRPCS| |[nginx.ingress.kubernetes.io/canary](#canary)|"true" or "false"| |[nginx.ingress.kubernetes.io/canary-by-header](#canary)|string| |[nginx.ingress.kubernetes.io/canary-by-header-value](#canary)|string| @@ -894,7 +894,7 @@ Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf ### Backend Protocol Using `backend-protocol` annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces `secure-backends` in older versions) -Valid Values: HTTP, HTTPS, GRPC, GRPCS, AJP and FCGI +Valid Values: HTTP, HTTPS, GRPC, GRPCS and FCGI By default NGINX uses `HTTP`. diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index e2a5fd8c6..5e215bf72 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -80,11 +80,6 @@ export LUA_CJSON_VERSION=2.1.0.10 # Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.3...master export GEOIP2_VERSION=a26c6beed77e81553686852dceb6c7fdacc5970d -# Check for recent changes: https://github.com/msva/nginx_ajp_module/compare/fcbb2ccca4901d317ecd7a9dabb3fec9378ff40f...master -# This is a fork from https://github.com/yaoweibin/nginx_ajp_module -# Since it has not been updated and is not compatible with NGINX 1.21 -export NGINX_AJP_VERSION=fcbb2ccca4901d317ecd7a9dabb3fec9378ff40f - # Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20220411...v2.1-agentzh export LUAJIT_VERSION=2.1-20220411 @@ -271,9 +266,6 @@ get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \ get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" -get_src 778fcca851bd69dabfb382dc827d2ee07662f7eca36b5e66e67d5512bad75ef8 \ - "https://github.com/msva/nginx_ajp_module/archive/$NGINX_AJP_VERSION.tar.gz" - get_src 5d16e623d17d4f42cc64ea9cfb69ca960d313e12f5d828f785dd227cc483fcbd \ "https://github.com/openresty/lua-resty-upload/archive/v$LUA_RESTY_UPLOAD_VERSION.tar.gz" @@ -633,7 +625,6 @@ WITH_MODULES=" \ --add-module=$BUILD_PATH/lua-nginx-module-$LUA_NGX_VERSION \ --add-module=$BUILD_PATH/stream-lua-nginx-module-$LUA_STREAM_NGX_VERSION \ --add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \ - --add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \ --add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \ --add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \ --add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \ diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index d8ea72386..c749072e3 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -31,7 +31,7 @@ import ( const HTTP = "HTTP" var ( - validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|AJP|GRPC|GRPCS|FCGI)$`) + validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|GRPC|GRPCS|FCGI)$`) ) type backendProtocol struct { diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 2d941f95d..791ab7962 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -736,9 +736,6 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { case "GRPCS": proto = "grpcs://" proxyPass = "grpc_pass" - case "AJP": - proto = "" - proxyPass = "ajp_pass" case "FCGI": proto = "" proxyPass = "fastcgi_pass" diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index 1980d7e52..f5d68178b 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -1137,7 +1137,6 @@ func TestOpentracingPropagateContext(t *testing.T) { {BackendProtocol: "AUTO_HTTP"}: "opentracing_propagate_context;", {BackendProtocol: "GRPC"}: "opentracing_grpc_propagate_context;", {BackendProtocol: "GRPCS"}: "opentracing_grpc_propagate_context;", - {BackendProtocol: "AJP"}: "opentracing_propagate_context;", {BackendProtocol: "FCGI"}: "opentracing_propagate_context;", nil: "", } @@ -1157,7 +1156,6 @@ func TestOpentelemetryPropagateContext(t *testing.T) { {BackendProtocol: "AUTO_HTTP"}: "opentelemetry_propagate;", {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", - {BackendProtocol: "AJP"}: "opentelemetry_propagate;", {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", nil: "", } diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index ccc86702d..6ace87448 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -307,7 +307,6 @@ http { client_body_temp_path /tmp/nginx/client-body; fastcgi_temp_path /tmp/nginx/fastcgi-temp; proxy_temp_path /tmp/nginx/proxy-temp; - ajp_temp_path /tmp/nginx/ajp-temp; client_header_buffer_size {{ $cfg.ClientHeaderBufferSize }}; client_header_timeout {{ $cfg.ClientHeaderTimeout }}s; diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index bccb03afb..566a6921e 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -105,19 +105,4 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { return strings.Contains(server, "fastcgi_pass upstream_balancer;") }) }) - - ginkgo.It("should set backend protocol to '' and use ajp_pass", func() { - host := "backendprotocol.foo.com" - annotations := map[string]string{ - "nginx.ingress.kubernetes.io/backend-protocol": "AJP", - } - - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "ajp_pass upstream_balancer;") - }) - }) }) From f50431a9f9b98a7af14604dee6d7d4130d953c5a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 3 Jul 2023 04:40:53 -0700 Subject: [PATCH 268/822] Bump docker/setup-buildx-action from 2.7.0 to 2.8.0 (#10165) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.7.0 to 2.8.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/ecf95283f03858871ff00b787d79c419715afc34...16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f27ac4f9b..150ec29ae 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@ecf95283f03858871ff00b787d79c419715afc34 # v2.7.0 + uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0 with: version: latest From d44a8e0045728729d6d604ea81f9ef582889d271 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Mon, 3 Jul 2023 20:50:52 +0800 Subject: [PATCH 269/822] Fix golang-ci linter errors (#10128) * Fix golang-ci linter errors Signed-off-by: z1cheng * Fix gofmt errors Signed-off-by: z1cheng * Add nolint comment to defaults.Backend in Configuration Signed-off-by: z1cheng * Add #nosec comment to rand.New func Signed-off-by: z1cheng * Fix errcheck warnings Signed-off-by: z1cheng * Fix gofmt check Signed-off-by: z1cheng * Fix unit tests and comments Signed-off-by: z1cheng --------- Signed-off-by: z1cheng --- cmd/dataplane/main.go | 9 +--- cmd/nginx/main.go | 3 -- cmd/plugin/commands/certs/certs.go | 6 ++- cmd/plugin/kubectl/kubectl.go | 4 +- images/fastcgi-helloserver/rootfs/main.go | 4 +- .../rootfs/pkg/k8s/k8s_test.go | 2 +- internal/admission/controller/main_test.go | 14 ++++--- internal/admission/controller/server.go | 4 +- internal/ingress/controller/checker_test.go | 24 ++++++++--- internal/ingress/controller/config/config.go | 2 +- .../ingress/controller/controller_test.go | 13 ++++-- internal/ingress/controller/nginx.go | 42 +------------------ .../controller/store/endpointslice_test.go | 20 ++++++--- internal/ingress/controller/store/store.go | 31 ++++++++++---- .../ingress/controller/store/store_test.go | 36 +++++++++++----- .../ingress/controller/template/template.go | 15 +++---- .../controller/template/template_test.go | 4 +- .../ingress/metric/collectors/process_test.go | 4 +- .../ingress/metric/collectors/socket_test.go | 4 +- internal/ingress/status/status.go | 5 ++- internal/ingress/status/status_test.go | 4 +- internal/net/dns/dns_test.go | 5 ++- internal/net/ssl/ssl.go | 2 +- internal/net/ssl/ssl_test.go | 8 +++- pkg/flags/flags.go | 10 ++--- pkg/tcpproxy/tcp.go | 4 +- pkg/util/file/file_test.go | 8 +++- pkg/util/file/file_watcher_test.go | 4 +- pkg/util/process/sigterm_test.go | 11 +++-- test/e2e/annotations/affinitymode.go | 2 +- test/e2e/endpointslices/topology.go | 4 +- test/e2e/framework/deployment.go | 7 ---- test/e2e/framework/httpexpect/chain.go | 16 ------- test/e2e/security/request_smuggling.go | 4 +- test/e2e/settings/proxy_protocol.go | 25 +++++++---- test/e2e/ssl/secret_update.go | 4 +- test/e2e/status/update.go | 4 +- 37 files changed, 206 insertions(+), 162 deletions(-) diff --git a/cmd/dataplane/main.go b/cmd/dataplane/main.go index 6fd559e4d..a1c4cbcc6 100644 --- a/cmd/dataplane/main.go +++ b/cmd/dataplane/main.go @@ -18,13 +18,10 @@ package main import ( "fmt" - "math/rand" // #nosec - "net/http" - "os" - "time" - "github.com/prometheus/client_golang/prometheus" "github.com/prometheus/client_golang/prometheus/collectors" + "net/http" + "os" "k8s.io/klog/v2" @@ -41,8 +38,6 @@ import ( func main() { klog.InitFlags(nil) - rand.Seed(time.Now().UnixNano()) - fmt.Println(version.String()) var err error showVersion, conf, err := ingressflags.ParseFlags() diff --git a/cmd/nginx/main.go b/cmd/nginx/main.go index 48dd933dc..508e940e1 100644 --- a/cmd/nginx/main.go +++ b/cmd/nginx/main.go @@ -19,7 +19,6 @@ package main import ( "context" "fmt" - "math/rand" // #nosec "net/http" "os" "path/filepath" @@ -54,8 +53,6 @@ import ( func main() { klog.InitFlags(nil) - rand.Seed(time.Now().UnixNano()) - fmt.Println(version.String()) showVersion, conf, err := ingressflags.ParseFlags() diff --git a/cmd/plugin/commands/certs/certs.go b/cmd/plugin/commands/certs/certs.go index 88b721ee3..1f08b5216 100644 --- a/cmd/plugin/commands/certs/certs.go +++ b/cmd/plugin/commands/certs/certs.go @@ -18,6 +18,7 @@ package certs import ( "fmt" + "os" "github.com/spf13/cobra" @@ -46,7 +47,10 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { } cmd.Flags().String("host", "", "Get the cert for this hostname") - cobra.MarkFlagRequired(cmd.Flags(), "host") + if err := cobra.MarkFlagRequired(cmd.Flags(), "host"); err != nil { + util.PrintError(err) + os.Exit(1) + } pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) diff --git a/cmd/plugin/kubectl/kubectl.go b/cmd/plugin/kubectl/kubectl.go index 3f31a2104..1171e9218 100644 --- a/cmd/plugin/kubectl/kubectl.go +++ b/cmd/plugin/kubectl/kubectl.go @@ -77,7 +77,9 @@ func execToWriter(args []string, writer io.Writer) error { return err } - go io.Copy(writer, op) + go func() { + io.Copy(writer, op) //nolint:errcheck + }() err = cmd.Run() if err != nil { return err diff --git a/images/fastcgi-helloserver/rootfs/main.go b/images/fastcgi-helloserver/rootfs/main.go index 91db60c26..a42c9a487 100644 --- a/images/fastcgi-helloserver/rootfs/main.go +++ b/images/fastcgi-helloserver/rootfs/main.go @@ -26,5 +26,7 @@ func main() { if err != nil { panic(err) } - fcgi.Serve(l, nil) + if err := fcgi.Serve(l, nil); err != nil { + panic(err) + } } diff --git a/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s_test.go b/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s_test.go index deaeb3540..f11bef981 100644 --- a/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s_test.go +++ b/images/kube-webhook-certgen/rootfs/pkg/k8s/k8s_test.go @@ -3,8 +3,8 @@ package k8s import ( "bytes" "context" + "crypto/rand" "errors" - "math/rand" "testing" "time" diff --git a/internal/admission/controller/main_test.go b/internal/admission/controller/main_test.go index 0a547d4be..8c42f87ef 100644 --- a/internal/admission/controller/main_test.go +++ b/internal/admission/controller/main_test.go @@ -67,7 +67,7 @@ func TestHandleAdmission(t *testing.T) { Checker: failTestChecker{t: t}, } - result, err := adm.HandleAdmission(&admissionv1.AdmissionReview{ + _, err := adm.HandleAdmission(&admissionv1.AdmissionReview{ Request: &admissionv1.AdmissionRequest{ Kind: v1.GroupVersionKind{Group: "", Version: "v1", Kind: "Pod"}, }, @@ -76,12 +76,12 @@ func TestHandleAdmission(t *testing.T) { t.Fatalf("with a non ingress resource, the check should not pass") } - result, err = adm.HandleAdmission(nil) + _, err = adm.HandleAdmission(nil) if err == nil { t.Fatalf("with a nil AdmissionReview request, the check should not pass") } - result, err = adm.HandleAdmission(&admissionv1.AdmissionReview{ + result, err := adm.HandleAdmission(&admissionv1.AdmissionReview{ Request: &admissionv1.AdmissionRequest{ Kind: v1.GroupVersionKind{Group: networking.GroupName, Version: "v1", Kind: "Ingress"}, Object: runtime.RawExtension{ @@ -114,7 +114,9 @@ func TestHandleAdmission(t *testing.T) { err: fmt.Errorf("this is a test error"), } - adm.HandleAdmission(review) + if _, err := adm.HandleAdmission(review); err != nil { + t.Errorf("unexpected error: %v", err) + } if review.Response.Allowed { t.Fatalf("when the checker returns an error, the request should not be allowed") } @@ -124,7 +126,9 @@ func TestHandleAdmission(t *testing.T) { err: nil, } - adm.HandleAdmission(review) + if _, err := adm.HandleAdmission(review); err != nil { + t.Errorf("unexpected error: %v", err) + } if !review.Response.Allowed { t.Fatalf("when the checker returns no error, the request should be allowed") } diff --git a/internal/admission/controller/server.go b/internal/admission/controller/server.go index 29449de50..3fa70971f 100644 --- a/internal/admission/controller/server.go +++ b/internal/admission/controller/server.go @@ -31,7 +31,9 @@ var ( ) func init() { - admissionv1.AddToScheme(scheme) + if err := admissionv1.AddToScheme(scheme); err != nil { + klog.ErrorS(err, "Failed to add scheme") + } } // AdmissionController checks if an object diff --git a/internal/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go index bea1c9cd0..2d63efc09 100644 --- a/internal/ingress/controller/checker_test.go +++ b/internal/ingress/controller/checker_test.go @@ -76,7 +76,10 @@ func TestNginxCheck(t *testing.T) { }) // create pid file - os.MkdirAll("/tmp/nginx", file.ReadWriteByUser) + if err := os.MkdirAll("/tmp/nginx", file.ReadWriteByUser); err != nil { + t.Errorf("unexpected error creating pid file: %v", err) + } + pidFile, err := os.Create(nginx.PID) if err != nil { t.Fatalf("unexpected error: %v", err) @@ -90,14 +93,23 @@ func TestNginxCheck(t *testing.T) { // start dummy process to use the PID cmd := exec.Command("sleep", "3600") - cmd.Start() + if err := cmd.Start(); err != nil { + t.Errorf("unexpected error: %v", err) + } pid := cmd.Process.Pid - defer cmd.Process.Kill() + defer func() { + if err := cmd.Process.Kill(); err != nil { + t.Errorf("unexpected error killing the process: %v", err) + } + }() go func() { - cmd.Wait() + cmd.Wait() //nolint:errcheck }() - pidFile.Write([]byte(fmt.Sprintf("%v", pid))) + if _, err := pidFile.Write([]byte(fmt.Sprintf("%v", pid))); err != nil { + t.Errorf("unexpected error writing the pid file: %v", err) + } + pidFile.Close() healthz.InstallPathHandler(mux, tt.healthzPath, n) @@ -109,7 +121,7 @@ func TestNginxCheck(t *testing.T) { }) // pollute pid file - pidFile.Write([]byte("999999")) + pidFile.Write([]byte("999999")) //nolint:errcheck pidFile.Close() t.Run("bad pid", func(t *testing.T) { diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index ec44b08ed..000bfc730 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -91,7 +91,7 @@ const ( // Configuration represents the content of nginx.conf file type Configuration struct { - defaults.Backend `json:",squash"` + defaults.Backend `json:",squash"` //nolint:staticcheck // AllowSnippetAnnotations enable users to add their own snippets via ingress annotation. // If disabled, only snippets added via ConfigMap are added to ingress. diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index c631461c0..44184f6b9 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -158,7 +158,7 @@ func (fakeTemplate) Write(conf ngx_config.TemplateConfig) ([]byte, error) { func TestCheckIngress(t *testing.T) { defer func() { - filepath.Walk(os.TempDir(), func(path string, info os.FileInfo, err error) error { + err := filepath.Walk(os.TempDir(), func(path string, info os.FileInfo, err error) error { if info.IsDir() && os.TempDir() != path { return filepath.SkipDir } @@ -167,6 +167,9 @@ func TestCheckIngress(t *testing.T) { } return nil }) + if err != nil { + t.Errorf("unexpected error: %v", err) + } }() err := file.CreateRequiredDirectories() @@ -176,9 +179,13 @@ func TestCheckIngress(t *testing.T) { // Ensure no panic with wrong arguments var nginx *NGINXController - nginx.CheckIngress(nil) + if err := nginx.CheckIngress(nil); err != nil { + t.Errorf("unexpected error: %v", err) + } nginx = newNGINXController(t) - nginx.CheckIngress(nil) + if err := nginx.CheckIngress(nil); err != nil { + t.Errorf("unexpected error: %v", err) + } nginx.metricCollector = metric.DummyCollector{} nginx.t = fakeTemplate{} diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index 80693db5c..4a5a07625 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -248,8 +248,7 @@ type NGINXController struct { store store.Storer - metricCollector metric.Collector - admissionCollector metric.Collector + metricCollector metric.Collector validationWebhookServer *http.Server @@ -799,45 +798,6 @@ func (n *NGINXController) setupSSLProxy() { }() } -// Helper function to clear Certificates from the ingress configuration since they should be ignored when -// checking if the new configuration changes can be applied dynamically if dynamic certificates is on -func clearCertificates(config *ingress.Configuration) { - var clearedServers []*ingress.Server - for _, server := range config.Servers { - copyOfServer := *server - copyOfServer.SSLCert = nil - clearedServers = append(clearedServers, ©OfServer) - } - config.Servers = clearedServers -} - -// Helper function to clear endpoints from the ingress configuration since they should be ignored when -// checking if the new configuration changes can be applied dynamically. -func clearL4serviceEndpoints(config *ingress.Configuration) { - var clearedTCPL4Services []ingress.L4Service - var clearedUDPL4Services []ingress.L4Service - for _, service := range config.TCPEndpoints { - copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, - Endpoints: []ingress.Endpoint{}, - Service: nil, - } - clearedTCPL4Services = append(clearedTCPL4Services, copyofService) - } - for _, service := range config.UDPEndpoints { - copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, - Endpoints: []ingress.Endpoint{}, - Service: nil, - } - clearedUDPL4Services = append(clearedUDPL4Services, copyofService) - } - config.TCPEndpoints = clearedTCPL4Services - config.UDPEndpoints = clearedUDPL4Services -} - // configureDynamically encodes new Backends in JSON format and POSTs the // payload to an internal HTTP endpoint handled by Lua. func (n *NGINXController) configureDynamically(pcfg *ingress.Configuration) error { diff --git a/internal/ingress/controller/store/endpointslice_test.go b/internal/ingress/controller/store/endpointslice_test.go index e12a98c2f..1342575ae 100644 --- a/internal/ingress/controller/store/endpointslice_test.go +++ b/internal/ingress/controller/store/endpointslice_test.go @@ -59,7 +59,9 @@ func TestEndpointSliceLister(t *testing.T) { }, }, } - el.Add(endpointSlice) + if err := el.Add(endpointSlice); err != nil { + t.Errorf("unexpected error %v", err) + } endpointSlice = &discoveryv1.EndpointSlice{ ObjectMeta: metav1.ObjectMeta{ Namespace: "namespace", @@ -69,7 +71,9 @@ func TestEndpointSliceLister(t *testing.T) { }, }, } - el.Add(endpointSlice) + if err := el.Add(endpointSlice); err != nil { + t.Errorf("unexpected error %v", err) + } endpointSlice = &discoveryv1.EndpointSlice{ ObjectMeta: metav1.ObjectMeta{ Namespace: "namespace", @@ -79,7 +83,9 @@ func TestEndpointSliceLister(t *testing.T) { }, }, } - el.Add(endpointSlice) + if err := el.Add(endpointSlice); err != nil { + t.Errorf("unexpected error %v", err) + } eps, err := el.MatchByKey(key) if err != nil { @@ -108,7 +114,9 @@ func TestEndpointSliceLister(t *testing.T) { }, }, } - el.Add(endpointSlice) + if err := el.Add(endpointSlice); err != nil { + t.Errorf("unexpected error %v", err) + } endpointSlice2 := &discoveryv1.EndpointSlice{ ObjectMeta: metav1.ObjectMeta{ Namespace: ns2, @@ -118,7 +126,9 @@ func TestEndpointSliceLister(t *testing.T) { }, }, } - el.Add(endpointSlice2) + if err := el.Add(endpointSlice2); err != nil { + t.Errorf("unexpected error %v", err) + } eps, err := el.MatchByKey(key) if err != nil { t.Errorf("unexpeted error %v", err) diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index 78fab62dc..9b3700739 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -404,7 +404,10 @@ func New( return } - store.listers.IngressWithAnnotation.Delete(ing) + if err := store.listers.IngressWithAnnotation.Delete(ing); err != nil { + klog.ErrorS(err, "Error while deleting ingress from store", "ingress", klog.KObj(ing)) + return + } key := k8s.MetaNamespaceKey(ing) store.secretIngressMap.Delete(key) @@ -793,14 +796,26 @@ func New( }, } - store.informers.Ingress.AddEventHandler(ingEventHandler) - if !icConfig.IgnoreIngressClass { - store.informers.IngressClass.AddEventHandler(ingressClassEventHandler) + if _, err := store.informers.Ingress.AddEventHandler(ingEventHandler); err != nil { + klog.Errorf("Error adding ingress event handler: %v", err) + } + if !icConfig.IgnoreIngressClass { + if _, err := store.informers.IngressClass.AddEventHandler(ingressClassEventHandler); err != nil { + klog.Errorf("Error adding ingress class event handler: %v", err) + } + } + if _, err := store.informers.EndpointSlice.AddEventHandler(epsEventHandler); err != nil { + klog.Errorf("Error adding endpoint slice event handler: %v", err) + } + if _, err := store.informers.Secret.AddEventHandler(secrEventHandler); err != nil { + klog.Errorf("Error adding secret event handler: %v", err) + } + if _, err := store.informers.ConfigMap.AddEventHandler(cmEventHandler); err != nil { + klog.Errorf("Error adding configmap event handler: %v", err) + } + if _, err := store.informers.Service.AddEventHandler(serviceHandler); err != nil { + klog.Errorf("Error adding service event handler: %v", err) } - store.informers.EndpointSlice.AddEventHandler(epsEventHandler) - store.informers.Secret.AddEventHandler(secrEventHandler) - store.informers.ConfigMap.AddEventHandler(cmEventHandler) - store.informers.Service.AddEventHandler(serviceHandler) // do not wait for informers to read the configmap configuration ns, name, _ := k8s.ParseNameNS(configmap) diff --git a/internal/ingress/controller/store/store_test.go b/internal/ingress/controller/store/store_test.go index 9fe6e37bb..b91cadc6c 100644 --- a/internal/ingress/controller/store/store_test.go +++ b/internal/ingress/controller/store/store_test.go @@ -92,7 +92,7 @@ func TestStore(t *testing.T) { emptySelector, _ := labels.Parse("") - defer te.Stop() + defer te.Stop() //nolint:errcheck clientSet, err := kubernetes.NewForConfig(cfg) if err != nil { @@ -1377,14 +1377,18 @@ func TestUpdateSecretIngressMap(t *testing.T) { Namespace: "testns", }, } - s.listers.Ingress.Add(ingTpl) + if err := s.listers.Ingress.Add(ingTpl); err != nil { + t.Errorf("error adding the Ingress template: %v", err) + } t.Run("with TLS secret", func(t *testing.T) { ing := ingTpl.DeepCopy() ing.Spec = networking.IngressSpec{ TLS: []networking.IngressTLS{{SecretName: "tls"}}, } - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); !(l == 1 && s.secretIngressMap.Has("testns/tls")) { @@ -1397,7 +1401,9 @@ func TestUpdateSecretIngressMap(t *testing.T) { ing.ObjectMeta.SetAnnotations(map[string]string{ parser.GetAnnotationWithPrefix("auth-secret"): "auth", }) - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); !(l == 1 && s.secretIngressMap.Has("testns/auth")) { @@ -1410,7 +1416,9 @@ func TestUpdateSecretIngressMap(t *testing.T) { ing.ObjectMeta.SetAnnotations(map[string]string{ parser.GetAnnotationWithPrefix("auth-secret"): "otherns/auth", }) - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); !(l == 1 && s.secretIngressMap.Has("otherns/auth")) { @@ -1423,7 +1431,9 @@ func TestUpdateSecretIngressMap(t *testing.T) { ing.ObjectMeta.SetAnnotations(map[string]string{ parser.GetAnnotationWithPrefix("auth-secret"): "ns/name/garbage", }) - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); l != 0 { @@ -1457,7 +1467,9 @@ func TestListIngresses(t *testing.T) { }, }, } - s.listers.IngressWithAnnotation.Add(ingressToIgnore) + if err := s.listers.IngressWithAnnotation.Add(ingressToIgnore); err != nil { + t.Errorf("error adding the Ingress: %v", err) + } ingressWithoutPath := &ingress.Ingress{ Ingress: networking.Ingress{ @@ -1492,8 +1504,9 @@ func TestListIngresses(t *testing.T) { }, }, } - s.listers.IngressWithAnnotation.Add(ingressWithoutPath) - + if err := s.listers.IngressWithAnnotation.Add(ingressWithoutPath); err != nil { + t.Errorf("error adding the Ingress: %v", err) + } ingressWithNginxClassAnnotation := &ingress.Ingress{ Ingress: networking.Ingress{ ObjectMeta: metav1.ObjectMeta{ @@ -1531,8 +1544,9 @@ func TestListIngresses(t *testing.T) { }, }, } - s.listers.IngressWithAnnotation.Add(ingressWithNginxClassAnnotation) - + if err := s.listers.IngressWithAnnotation.Add(ingressWithNginxClassAnnotation); err != nil { + t.Errorf("error adding the Ingress: %v", err) + } ingresses := s.ListIngresses() if s := len(ingresses); s != 3 { diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 791ab7962..147455771 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -18,13 +18,14 @@ package template import ( "bytes" + "crypto/rand" "crypto/sha1" // #nosec "encoding/base64" "encoding/hex" "encoding/json" "fmt" "io" - "math/rand" // #nosec + "math/big" "net" "net/url" "os" @@ -34,7 +35,6 @@ import ( "strconv" "strings" text_template "text/template" - "time" networkingv1 "k8s.io/api/networking/v1" "k8s.io/apimachinery/pkg/util/sets" @@ -1184,14 +1184,15 @@ func buildAuthSignURLLocation(location, authSignURL string) string { var letters = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ") -func init() { - rand.Seed(time.Now().UnixNano()) -} - func randomString() string { b := make([]rune, 32) for i := range b { - b[i] = letters[rand.Intn(len(letters))] // #nosec + idx, err := rand.Int(rand.Reader, big.NewInt(int64(len(letters)))) + if err != nil { + klog.Errorf("unexpected error generating random index: %v", err) + return "" + } + b[i] = letters[idx.Int64()] } return string(b) diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index f5d68178b..a2c3b8299 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -767,7 +767,9 @@ func BenchmarkTemplateWithData(b *testing.B) { } for i := 0; i < b.N; i++ { - ngxTpl.Write(dat) + if _, err := ngxTpl.Write(dat); err != nil { + b.Errorf("unexpected error writing template: %v", err) + } } } diff --git a/internal/ingress/metric/collectors/process_test.go b/internal/ingress/metric/collectors/process_test.go index 45170572b..b21d95496 100644 --- a/internal/ingress/metric/collectors/process_test.go +++ b/internal/ingress/metric/collectors/process_test.go @@ -48,7 +48,7 @@ func TestProcessCollector(t *testing.T) { done := make(chan struct{}) go func() { - cmd.Wait() + cmd.Wait() //nolint:errcheck status := cmd.ProcessState.Sys().(syscall.WaitStatus) if status.Signaled() { t.Logf("Signal: %v", status.Signal()) @@ -69,7 +69,7 @@ func TestProcessCollector(t *testing.T) { defer func() { cm.Stop() - cmd.Process.Kill() + cmd.Process.Kill() //nolint:errcheck <-done close(done) }() diff --git a/internal/ingress/metric/collectors/socket_test.go b/internal/ingress/metric/collectors/socket_test.go index fe442aba0..6000f2685 100644 --- a/internal/ingress/metric/collectors/socket_test.go +++ b/internal/ingress/metric/collectors/socket_test.go @@ -58,7 +58,9 @@ func TestNewUDPLogListener(t *testing.T) { }() conn, _ := net.Dial("unix", tmpFile) - conn.Write([]byte("message")) + if _, err := conn.Write([]byte("message")); err != nil { + t.Errorf("unexpected error writing to unix socket: %v", err) + } conn.Close() time.Sleep(1 * time.Millisecond) diff --git a/internal/ingress/status/status.go b/internal/ingress/status/status.go index a7506705c..62b88da16 100644 --- a/internal/ingress/status/status.go +++ b/internal/ingress/status/status.go @@ -95,10 +95,13 @@ func (s statusSync) Run(stopCh chan struct{}) { // when this instance is the leader we need to enqueue // an item to trigger the update of the Ingress status. - wait.PollUntil(time.Duration(UpdateInterval)*time.Second, func() (bool, error) { + err := wait.PollUntil(time.Duration(UpdateInterval)*time.Second, func() (bool, error) { s.syncQueue.EnqueueTask(task.GetDummyObject("sync status")) return false, nil }, stopCh) + if err != nil { + klog.ErrorS(err, "error running poll") + } } // Shutdown stops the sync. In case the instance is the leader it will remove the current IP diff --git a/internal/ingress/status/status_test.go b/internal/ingress/status/status_test.go index 3dd56f37d..ce6b6a0bf 100644 --- a/internal/ingress/status/status_test.go +++ b/internal/ingress/status/status_test.go @@ -325,7 +325,9 @@ func TestStatusActions(t *testing.T) { // wait for the election time.Sleep(100 * time.Millisecond) // execute sync - fk.sync("just-test") + if err := fk.sync("just-test"); err != nil { + t.Errorf("unexpected error: %v", err) + } // PublishService is empty, so the running address is: ["11.0.0.2"] // after updated, the ingress's ip should only be "11.0.0.2" newIPs := []networking.IngressLoadBalancerIngress{{ diff --git a/internal/net/dns/dns_test.go b/internal/net/dns/dns_test.go index 708e3c6df..7e030e17a 100644 --- a/internal/net/dns/dns_test.go +++ b/internal/net/dns/dns_test.go @@ -40,13 +40,16 @@ func TestGetDNSServers(t *testing.T) { defer f.Close() defer os.Remove(f.Name()) - os.WriteFile(f.Name(), []byte(` + err = os.WriteFile(f.Name(), []byte(` # comment ; comment nameserver 2001:4860:4860::8844 nameserver 2001:4860:4860::8888 nameserver 8.8.8.8 `), file.ReadWriteByUser) + if err != nil { + t.Errorf("unexpected error: %v", err) + } defResolvConf = f.Name() s, err = GetSystemNameServers() diff --git a/internal/net/ssl/ssl.go b/internal/net/ssl/ssl.go index fdee2f46e..c74537fe9 100644 --- a/internal/net/ssl/ssl.go +++ b/internal/net/ssl/ssl.go @@ -228,7 +228,7 @@ func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { return fmt.Errorf("CRL file %v contains invalid data, and must be created only with PEM formatted certificates", name) } - _, err := x509.ParseCRL(pemCRLBlock.Bytes) + _, err := x509.ParseRevocationList(pemCRLBlock.Bytes) if err != nil { return fmt.Errorf(err.Error()) } diff --git a/internal/net/ssl/ssl_test.go b/internal/net/ssl/ssl_test.go index 9d1aedf16..a86ecb87a 100644 --- a/internal/net/ssl/ssl_test.go +++ b/internal/net/ssl/ssl_test.go @@ -397,7 +397,9 @@ func newFakeCertificate(t *testing.T) ([]byte, string, string) { t.Errorf("failed to write test key: %v", err) } - certFile.Write(cert) + if _, err := certFile.Write(cert); err != nil { + t.Errorf("failed to write cert: %v", err) + } defer certFile.Close() keyFile, err := os.CreateTemp("", "key-") @@ -405,7 +407,9 @@ func newFakeCertificate(t *testing.T) ([]byte, string, string) { t.Errorf("failed to write test key: %v", err) } - keyFile.Write(key) + if _, err := keyFile.Write(key); err != nil { + t.Errorf("failed to write key: %v", err) + } defer keyFile.Close() return cert, certFile.Name(), keyFile.Name() diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 370510380..489e24886 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -228,14 +228,10 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g flags.IntVar(&nginx.MaxmindRetriesCount, "maxmind-retries-count", 1, "Number of attempts to download the GeoIP DB.") flags.DurationVar(&nginx.MaxmindRetriesTimeout, "maxmind-retries-timeout", time.Second*0, "Maxmind downloading delay between 1st and 2nd attempt, 0s - do not retry to download if something went wrong.") - flag.Set("logtostderr", "true") - flags.AddGoFlagSet(flag.CommandLine) - flags.Parse(os.Args) - - // Workaround for this issue: - // https://github.com/kubernetes/kubernetes/issues/17162 - flag.CommandLine.Parse([]string{}) + if err := flags.Parse(os.Args); err != nil { + return false, nil, err + } pflag.VisitAll(func(flag *pflag.Flag) { klog.V(2).InfoS("FLAG", flag.Name, flag.Value) diff --git a/pkg/tcpproxy/tcp.go b/pkg/tcpproxy/tcp.go index 86850ad54..25cc39ee4 100644 --- a/pkg/tcpproxy/tcp.go +++ b/pkg/tcpproxy/tcp.go @@ -119,7 +119,9 @@ func (p *TCPProxy) Handle(conn net.Conn) { func pipe(client, server net.Conn) { doCopy := func(s, c net.Conn, cancel chan<- bool) { - io.Copy(s, c) + if _, err := io.Copy(s, c); err != nil { + klog.Errorf("Error copying data: %v", err) + } cancel <- true } diff --git a/pkg/util/file/file_test.go b/pkg/util/file/file_test.go index 93ec39cf9..9a43946b3 100644 --- a/pkg/util/file/file_test.go +++ b/pkg/util/file/file_test.go @@ -35,8 +35,12 @@ func TestSHA1(t *testing.T) { if err != nil { t.Fatal(err) } - f.Write(test.content) - f.Sync() + if _, err := f.Write(test.content); err != nil { + t.Error(err) + } + if err := f.Sync(); err != nil { + t.Error(err) + } sha := SHA1(f.Name()) f.Close() diff --git a/pkg/util/file/file_watcher_test.go b/pkg/util/file/file_watcher_test.go index 316cb6f1e..dd2755812 100644 --- a/pkg/util/file/file_watcher_test.go +++ b/pkg/util/file/file_watcher_test.go @@ -59,7 +59,9 @@ func TestFileWatcher(t *testing.T) { t.Fatalf("expected no events before writing a file") case <-timeoutChan: } - os.WriteFile(f.Name(), []byte{}, ReadWriteByUser) + if err := os.WriteFile(f.Name(), []byte{}, ReadWriteByUser); err != nil { + t.Errorf("unexpected error: %v", err) + } select { case <-events: case <-timeoutChan: diff --git a/pkg/util/process/sigterm_test.go b/pkg/util/process/sigterm_test.go index 2c2a6ee91..b7413bed4 100644 --- a/pkg/util/process/sigterm_test.go +++ b/pkg/util/process/sigterm_test.go @@ -42,9 +42,9 @@ func (f *FakeProcess) exiterFunc(code int) { f.exitCode = code } -func sendDelayedSignal(delay time.Duration) { +func sendDelayedSignal(delay time.Duration) error { time.Sleep(delay * time.Second) - syscall.Kill(syscall.Getpid(), syscall.SIGTERM) + return syscall.Kill(syscall.Getpid(), syscall.SIGTERM) } func TestHandleSigterm(t *testing.T) { @@ -66,7 +66,12 @@ func TestHandleSigterm(t *testing.T) { for _, tt := range tests { process := &FakeProcess{shouldError: tt.shouldError} t.Run(tt.name, func(t *testing.T) { - go sendDelayedSignal(2) // Send a signal after 2 seconds + go func() { + err := sendDelayedSignal(2) // Send a signal after 2 seconds + if err != nil { + t.Errorf("error sending delayed signal: %v", err) + } + }() HandleSigterm(process, tt.delay, process.exiterFunc) }) if tt.shouldError && process.exitCode != 1 { diff --git a/test/e2e/annotations/affinitymode.go b/test/e2e/annotations/affinitymode.go index cce2b004d..ad210cfa5 100644 --- a/test/e2e/annotations/affinitymode.go +++ b/test/e2e/annotations/affinitymode.go @@ -125,7 +125,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { framework.Sleep() // validate, there is no backend to serve the request - response = request.WithCookies(cookies).Expect().Status(http.StatusServiceUnavailable) + request.WithCookies(cookies).Expect().Status(http.StatusServiceUnavailable) // create brand new backends replicas = 2 diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index 7cc67cedb..8dd0becfb 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -76,7 +76,9 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou status, err := f.ExecIngressPod(curlCmd) assert.Nil(ginkgo.GinkgoT(), err) var backends []map[string]interface{} - json.Unmarshal([]byte(status), &backends) + if err := json.Unmarshal([]byte(status), &backends); err != nil { + assert.Nil(ginkgo.GinkgoT(), err) + } gotBackends := 0 for _, bck := range backends { if strings.Contains(bck["name"].(string), "topology") { diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 04faefc7f..bcb1d3960 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -56,15 +56,8 @@ type deploymentOptions struct { name string namespace string image string - port int32 replicas int - command []string - args []string - env []corev1.EnvVar - volumeMounts []corev1.VolumeMount - volumes []corev1.Volume svcAnnotations map[string]string - setProbe bool } // WithDeploymentNamespace allows configuring the deployment's namespace diff --git a/test/e2e/framework/httpexpect/chain.go b/test/e2e/framework/httpexpect/chain.go index 79956fb33..33c4d15b7 100644 --- a/test/e2e/framework/httpexpect/chain.go +++ b/test/e2e/framework/httpexpect/chain.go @@ -36,19 +36,3 @@ func (c *chain) fail(message string, args ...interface{}) { c.failbit = true c.reporter.Errorf(message, args...) } - -func (c *chain) reset() { - c.failbit = false -} - -func (c *chain) assertFailed(r Reporter) { - if !c.failbit { - r.Errorf("expected chain is failed, but it's ok") - } -} - -func (c *chain) assertOK(r Reporter) { - if c.failbit { - r.Errorf("expected chain is ok, but it's failed") - } -} diff --git a/test/e2e/security/request_smuggling.go b/test/e2e/security/request_smuggling.go index 786a7a397..58b17c4d8 100644 --- a/test/e2e/security/request_smuggling.go +++ b/test/e2e/security/request_smuggling.go @@ -79,7 +79,9 @@ func smugglingRequest(host, addr string, port int) (string, error) { defer conn.Close() - conn.SetDeadline(time.Now().Add(time.Second * 10)) + if err := conn.SetDeadline(time.Now().Add(time.Second * 10)); err != nil { + return "", err + } _, err = fmt.Fprintf(conn, "GET /echo HTTP/1.1\r\nHost: %v\r\nContent-Length: 56\r\n\r\nGET /_hidden/index.html HTTP/1.1\r\nHost: notlocalhost\r\n\r\n", host) if err != nil { diff --git a/test/e2e/settings/proxy_protocol.go b/test/e2e/settings/proxy_protocol.go index f48ee5c8c..1567b2267 100644 --- a/test/e2e/settings/proxy_protocol.go +++ b/test/e2e/settings/proxy_protocol.go @@ -63,8 +63,12 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 1234\r\n" - conn.Write([]byte(header)) - conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) + if _, err := conn.Write([]byte(header)); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + } + if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") + } data, err := io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") @@ -96,8 +100,12 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n" - conn.Write([]byte(header)) - conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) + if _, err := conn.Write([]byte(header)); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + } + if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") + } data, err := io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") @@ -205,9 +213,12 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 8080\r\n" - conn.Write([]byte(header)) - conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) - + if _, err := conn.Write([]byte(header)); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + } + if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") + } _, err = io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") diff --git a/test/e2e/ssl/secret_update.go b/test/e2e/ssl/secret_update.go index 77e64c6b2..242b370ee 100644 --- a/test/e2e/ssl/secret_update.go +++ b/test/e2e/ssl/secret_update.go @@ -73,7 +73,9 @@ var _ = framework.IngressNginxDescribe("[SSL] secret update", func() { dummySecret.Data["some-key"] = []byte("some value") - f.KubeClientSet.CoreV1().Secrets(f.Namespace).Update(context.TODO(), dummySecret, metav1.UpdateOptions{}) + if _, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace).Update(context.TODO(), dummySecret, metav1.UpdateOptions{}); err != nil { + assert.Nil(ginkgo.GinkgoT(), err, "updating secret") + } assert.NotContains(ginkgo.GinkgoT(), log, fmt.Sprintf("starting syncing of secret %v/dummy", f.Namespace)) assert.NotContains(ginkgo.GinkgoT(), log, fmt.Sprintf("error obtaining PEM from secret %v/dummy", f.Namespace)) diff --git a/test/e2e/status/update.go b/test/e2e/status/update.go index 5c6ea4977..046752d2b 100644 --- a/test/e2e/status/update.go +++ b/test/e2e/status/update.go @@ -71,7 +71,7 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { f.NewEchoDeployment() - ing := f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) + f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) f.WaitForNginxConfiguration( func(cfg string) bool { @@ -84,7 +84,7 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { err = cmd.Process.Kill() assert.Nil(ginkgo.GinkgoT(), err, "unexpected error terminating kubectl proxy") - ing, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Get(context.TODO(), host, metav1.GetOptions{}) + ing, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Get(context.TODO(), host, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error getting %s/%v Ingress", f.Namespace, host) ing.Status.LoadBalancer.Ingress = []v1.IngressLoadBalancerIngress{} From ff0cb504d672c2c576d99adcf7ae9abc98857f6d Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Thu, 6 Jul 2023 19:31:03 +0800 Subject: [PATCH 270/822] Cleanup errcheck code (#10166) Signed-off-by: z1cheng --- test/e2e/endpointslices/topology.go | 5 ++--- test/e2e/settings/proxy_protocol.go | 34 ++++++++++++++--------------- test/e2e/ssl/secret_update.go | 5 ++--- 3 files changed, 20 insertions(+), 24 deletions(-) diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index 8dd0becfb..ff66f2ad1 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -76,9 +76,8 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou status, err := f.ExecIngressPod(curlCmd) assert.Nil(ginkgo.GinkgoT(), err) var backends []map[string]interface{} - if err := json.Unmarshal([]byte(status), &backends); err != nil { - assert.Nil(ginkgo.GinkgoT(), err) - } + err = json.Unmarshal([]byte(status), &backends) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error unmarshalling backends") gotBackends := 0 for _, bck := range backends { if strings.Contains(bck["name"].(string), "topology") { diff --git a/test/e2e/settings/proxy_protocol.go b/test/e2e/settings/proxy_protocol.go index 1567b2267..9939cad9e 100644 --- a/test/e2e/settings/proxy_protocol.go +++ b/test/e2e/settings/proxy_protocol.go @@ -63,12 +63,11 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 1234\r\n" - if _, err := conn.Write([]byte(header)); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") - } - if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") - } + _, err = conn.Write([]byte(header)) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + + _, err = conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") data, err := io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") @@ -100,12 +99,11 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 443\r\n" - if _, err := conn.Write([]byte(header)); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") - } - if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") - } + _, err = conn.Write([]byte(header)) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + + _, err = conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") data, err := io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") @@ -213,12 +211,12 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { defer conn.Close() header := "PROXY TCP4 192.168.0.1 192.168.0.11 56324 8080\r\n" - if _, err := conn.Write([]byte(header)); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") - } - if _, err := conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") - } + _, err = conn.Write([]byte(header)) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing header") + + _, err = conn.Write([]byte("GET / HTTP/1.1\r\nHost: proxy-protocol\r\n\r\n")) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error writing request") + _, err = io.ReadAll(conn) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") diff --git a/test/e2e/ssl/secret_update.go b/test/e2e/ssl/secret_update.go index 242b370ee..fe7bfca0c 100644 --- a/test/e2e/ssl/secret_update.go +++ b/test/e2e/ssl/secret_update.go @@ -73,9 +73,8 @@ var _ = framework.IngressNginxDescribe("[SSL] secret update", func() { dummySecret.Data["some-key"] = []byte("some value") - if _, err := f.KubeClientSet.CoreV1().Secrets(f.Namespace).Update(context.TODO(), dummySecret, metav1.UpdateOptions{}); err != nil { - assert.Nil(ginkgo.GinkgoT(), err, "updating secret") - } + _, err = f.KubeClientSet.CoreV1().Secrets(f.Namespace).Update(context.TODO(), dummySecret, metav1.UpdateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "updating secret") assert.NotContains(ginkgo.GinkgoT(), log, fmt.Sprintf("starting syncing of secret %v/dummy", f.Namespace)) assert.NotContains(ginkgo.GinkgoT(), log, fmt.Sprintf("error obtaining PEM from secret %v/dummy", f.Namespace)) From c8f7cb052af9f6ddbcb3e92c677d88af13204889 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A1z=C3=A1r=20Gy=C3=B6rgy?= <55853197+lgyurci@users.noreply.github.com> Date: Fri, 7 Jul 2023 01:39:04 +0200 Subject: [PATCH 271/822] Exposed continent data as variable in the case of Maxmind city files (#10157) --- rootfs/etc/nginx/template/nginx.tmpl | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 6ace87448..189c13d6c 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -224,6 +224,8 @@ http { $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code; $geoip2_subregion_name source=$remote_addr subdivisions 1 names en; $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id; + $geoip2_city_continent_code source=$remote_addr continent code; + $geoip2_city_continent_name source=$remote_addr continent names en; } {{ end }} @@ -245,6 +247,8 @@ http { $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code; $geoip2_subregion_name source=$remote_addr subdivisions 1 names en; $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id; + $geoip2_city_continent_code source=$remote_addr continent code; + $geoip2_city_continent_name source=$remote_addr continent names en; } {{ end }} From 125b3be6f9960f86174fbcb842912e87d5f530bd Mon Sep 17 00:00:00 2001 From: Alex Matchneer Date: Thu, 6 Jul 2023 19:47:04 -0400 Subject: [PATCH 272/822] Clarify TCP/UDP service docs (#10146) In the current state, the docs on TCP/UDP aren't really clear on exactly whether/how TCP/UDP traffic is supported. This is an attempt to clarify the limitations inherent to k8s Ingress resources vs what can be accomplished with this controller. --- docs/user-guide/exposing-tcp-udp-services.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/exposing-tcp-udp-services.md b/docs/user-guide/exposing-tcp-udp-services.md index 63293f0e5..089511ff9 100644 --- a/docs/user-guide/exposing-tcp-udp-services.md +++ b/docs/user-guide/exposing-tcp-udp-services.md @@ -1,6 +1,8 @@ # Exposing TCP and UDP services -Ingress does not support TCP or UDP services. For this reason this Ingress controller uses the flags `--tcp-services-configmap` and `--udp-services-configmap` to point to an existing config map where the key is the external port to use and the value indicates the service to expose using the format: +While the Kubernetes Ingress resource only officially supports routing external HTTP(s) traffic to services, ingress-nginx can be configured to receive external TCP/UDP traffic from non-HTTP protocols and route them to internal services using TCP/UDP port mappings that are specified within a ConfigMap. + +To support this, the `--tcp-services-configmap` and `--udp-services-configmap` flags can be used to point to an existing config map where the key is the external port to use and the value indicates the service to expose using the format: `::[PROXY]:[PROXY]` It is also possible to use a number or the name of the port. The two last fields are optional. From 6d55e1f3c42925db5e99f61457695778a681c8be Mon Sep 17 00:00:00 2001 From: David Goffredo Date: Thu, 6 Jul 2023 19:51:04 -0400 Subject: [PATCH 273/822] revise Datadog trace sampling configuration (#10151) * datadog: sample_rate omitted by default * config: use *float32 with nil instead of float32 with sentinel value * change some names * gofmt -s -w internal/ingress/controller/nginx.go --- internal/ingress/controller/config/config.go | 14 +--- internal/ingress/controller/nginx.go | 80 ++++++++++++-------- 2 files changed, 52 insertions(+), 42 deletions(-) diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 000bfc730..345ce89b4 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -706,16 +706,9 @@ type Configuration struct { // Default: nginx.handle DatadogOperationNameOverride string `json:"datadog-operation-name-override"` - // DatadogPrioritySampling specifies to use client-side sampling - // If true disables client-side sampling (thus ignoring sample_rate) and enables distributed - // priority sampling, where traces are sampled based on a combination of user-assigned - // Default: true - DatadogPrioritySampling bool `json:"datadog-priority-sampling"` - // DatadogSampleRate specifies sample rate for any traces created. - // This is effective only when datadog-priority-sampling is false - // Default: 1.0 - DatadogSampleRate float32 `json:"datadog-sample-rate"` + // Default: use a dynamic rate instead + DatadogSampleRate *float32 `json:"datadog-sample-rate",omitempty` // MainSnippet adds custom configuration to the main section of the nginx configuration MainSnippet string `json:"main-snippet"` @@ -1001,8 +994,7 @@ func NewDefault() Configuration { DatadogEnvironment: "prod", DatadogCollectorPort: 8126, DatadogOperationNameOverride: "nginx.handle", - DatadogSampleRate: 1.0, - DatadogPrioritySampling: true, + DatadogSampleRate: nil, LimitReqStatusCode: 503, LimitConnStatusCode: 503, SyslogPort: 514, diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index 4a5a07625..6c25aa34f 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -1011,16 +1011,6 @@ const jaegerTmpl = `{ } }` -const datadogTmpl = `{ - "service": "{{ .DatadogServiceName }}", - "agent_host": "{{ .DatadogCollectorHost }}", - "agent_port": {{ .DatadogCollectorPort }}, - "environment": "{{ .DatadogEnvironment }}", - "operation_name_override": "{{ .DatadogOperationNameOverride }}", - "sample_rate": {{ .DatadogSampleRate }}, - "dd.priority.sampling": {{ .DatadogPrioritySampling }} -}` - const otelTmpl = ` exporter = "otlp" processor = "batch" @@ -1044,37 +1034,65 @@ ratio = {{ .OtelSamplerRatio }} parent_based = {{ .OtelSamplerParentBased }} ` -func createOpentracingCfg(cfg ngx_config.Configuration) error { - var tmpl *template.Template - var err error +func datadogOpentracingCfg(cfg ngx_config.Configuration) (string, error) { + m := map[string]interface{}{ + "service": cfg.DatadogServiceName, + "agent_host": cfg.DatadogCollectorHost, + "agent_port": cfg.DatadogCollectorPort, + "environment": cfg.DatadogEnvironment, + "operation_name_override": cfg.DatadogOperationNameOverride, + } - if cfg.ZipkinCollectorHost != "" { - tmpl, err = template.New("zipkin").Parse(zipkinTmpl) - if err != nil { - return err - } - } else if cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "" { - tmpl, err = template.New("jaeger").Parse(jaegerTmpl) - if err != nil { - return err - } - } else if cfg.DatadogCollectorHost != "" { - tmpl, err = template.New("datadog").Parse(datadogTmpl) - if err != nil { - return err - } - } else { - tmpl, _ = template.New("empty").Parse("{}") + // Omit "sample_rate" if the configuration's sample rate is unset (nil). + // Omitting "sample_rate" from the plugin JSON indicates to the tracer that + // it should use dynamic rates instead of a configured rate. + if cfg.DatadogSampleRate != nil { + m["sample_rate"] = *cfg.DatadogSampleRate + } + + buf, err := json.Marshal(m) + if err != nil { + return "", err + } + + return string(buf), nil +} + +func opentracingCfgFromTemplate(cfg ngx_config.Configuration, tmplName string, tmplText string) (string, error) { + tmpl, err := template.New(tmplName).Parse(tmplText) + if err != nil { + return "", err } tmplBuf := bytes.NewBuffer(make([]byte, 0)) err = tmpl.Execute(tmplBuf, cfg) + if err != nil { + return "", err + } + + return tmplBuf.String(), nil +} + +func createOpentracingCfg(cfg ngx_config.Configuration) error { + var configData string + var err error + + if cfg.ZipkinCollectorHost != "" { + configData, err = opentracingCfgFromTemplate(cfg, "zipkin", zipkinTmpl) + } else if cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "" { + configData, err = opentracingCfgFromTemplate(cfg, "jaeger", jaegerTmpl) + } else if cfg.DatadogCollectorHost != "" { + configData, err = datadogOpentracingCfg(cfg) + } else { + configData = "{}" + } + if err != nil { return err } // Expand possible environment variables before writing the configuration to file. - expanded := os.ExpandEnv(tmplBuf.String()) + expanded := os.ExpandEnv(configData) return os.WriteFile("/etc/nginx/opentracing.json", []byte(expanded), file.ReadWriteByUser) } From b9122e0248a5de64bfb3fd7c321be7e2c5238040 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jul 2023 05:55:07 -0700 Subject: [PATCH 274/822] Bump docker/setup-buildx-action from 2.8.0 to 2.9.0 (#10191) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.8.0 to 2.9.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a...2a1a44ac4aa01993040736bd95bb470da1a38365) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 150ec29ae..e2ddec049 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@16c0bc4a6e6ada2cfd8afd41d22d95379cf7c32a # v2.8.0 + uses: docker/setup-buildx-action@2a1a44ac4aa01993040736bd95bb470da1a38365 # v2.9.0 with: version: latest From 5b35651a1a40f5506d06540c1fcd103dc41a16d5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jul 2023 05:57:06 -0700 Subject: [PATCH 275/822] Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#10192) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.10.0 to 0.11.0. - [Commits](https://github.com/golang/crypto/compare/v0.10.0...v0.11.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 4b75cbd12..2b808ef2b 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.10.0 + golang.org/x/crypto v0.11.0 google.golang.org/grpc v1.56.1 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -103,9 +103,9 @@ require ( golang.org/x/mod v0.10.0 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/sys v0.9.0 // indirect - golang.org/x/term v0.9.0 // indirect - golang.org/x/text v0.10.0 // indirect + golang.org/x/sys v0.10.0 // indirect + golang.org/x/term v0.10.0 // indirect + golang.org/x/text v0.11.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index db879481c..9fee095bc 100644 --- a/go.sum +++ b/go.sum @@ -390,8 +390,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM= -golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= +golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= +golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -524,19 +524,19 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s= -golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= +golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28= -golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo= +golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= +golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58= -golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= +golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From a9f9793a1fbe269660c70ef9ea33c03f541cc689 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Jul 2023 13:18:32 -0400 Subject: [PATCH 276/822] update default value for period when not set --- pkg/util/runtime/cpu_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index c72f47f01..dc24a1ad7 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -93,7 +93,7 @@ func readCgroup2FileToInt64Tuple(cgroupFile string) (int64, int64) { } if len(values) == 1 { - return cpuQuota, 1 + return cpuQuota, 100000 } cpuPeriod, err := strconv.ParseInt(values[1], 10, 64) From 0cd1f16c476ca72c324b8ded07c861ebe0dce4e0 Mon Sep 17 00:00:00 2001 From: lijie Date: Mon, 17 Jul 2023 04:45:06 +0800 Subject: [PATCH 277/822] Scanning port 10247 lead to tcp connection 502 error (#9815) * fix tcp 502 error * fix tcp 502 error for parse tcp backend data * fix tcp 502 error for parse tcp backend data --- rootfs/etc/nginx/lua/tcp_udp_configuration.lua | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/rootfs/etc/nginx/lua/tcp_udp_configuration.lua b/rootfs/etc/nginx/lua/tcp_udp_configuration.lua index 85864b45b..f191454fa 100644 --- a/rootfs/etc/nginx/lua/tcp_udp_configuration.lua +++ b/rootfs/etc/nginx/lua/tcp_udp_configuration.lua @@ -1,5 +1,6 @@ local ngx = ngx local tostring = tostring +local cjson = require("cjson.safe") -- this is the Lua representation of TCP/UDP Configuration local tcp_udp_configuration_data = ngx.shared.tcp_udp_configuration_data @@ -37,6 +38,14 @@ function _M.call() return end + local _, backends_err = cjson.decode(backends) + + if backends_err then + ngx.log(ngx.ERR, "could not parse backends data: ", backends_err) + return + end + + local success, err_conf = tcp_udp_configuration_data:set("backends", backends) if not success then ngx.log(ngx.ERR, "dynamic-configuration: error updating configuration: " .. tostring(err_conf)) From 3814e1f01fbfebe4c8c9f88e57cd424a56578537 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Jul 2023 18:58:58 -0400 Subject: [PATCH 278/822] write e2e tests for cgroups --- pkg/util/runtime/cpu_linux.go | 4 +- test/e2e/cgroups/cgroups_linux.go | 78 +- test/e2e/e2e.go | 41 +- test/junitreports/report-e2e-test-suite.xml | 1294 +------------------ 4 files changed, 92 insertions(+), 1325 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index e5e8db40a..e2eff9fec 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -38,7 +38,7 @@ import ( func NumCPU() int { cpus := runtime.NumCPU() - cgroupVersion := getCgroupVersion() + cgroupVersion := GetCgroupVersion() cpuQuota := int64(-1) cpuPeriod := int64(-1) @@ -64,7 +64,7 @@ func IsCgroupAvaliable() bool { return true } -func getCgroupVersion() int64 { +func GetCgroupVersion() int64 { // /sys/fs/cgroup/cgroup.controllers will not exist with cgroupsv1 if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); err == nil { return 2 diff --git a/test/e2e/cgroups/cgroups_linux.go b/test/e2e/cgroups/cgroups_linux.go index 18b3f837b..b27346dc3 100644 --- a/test/e2e/cgroups/cgroups_linux.go +++ b/test/e2e/cgroups/cgroups_linux.go @@ -28,7 +28,10 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" + "path/filepath" "k8s.io/ingress-nginx/pkg/util/runtime" + + libcontainercgroups "github.com/opencontainers/runc/libcontainer/cgroups" ) var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { @@ -40,26 +43,75 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { }) ginkgo.It("detects if cgroups is avaliable", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.IsCgroupAvaliable(), 1) + assert.True(ginkgo.GinkgoT(), runtime.IsCgroupAvaliable()) }) ginkgo.It("detects cgroups version v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.readCgroupFileToInt64(), 1) - }) - - ginkgo.It("detects number of CPUs properly in cgroups v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) - }) - - ginkgo.It("detects cgroups version v2", func() { - // create cgroups2 files - if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { + cgroupPath, err := libcontainercgroups.FindCgroupMountpoint("", "cpu") + if err != nil { log.Fatal(err) } + quotaFile, err := os.Create(filepath.Join(cgroupPath,"cpu.cfs_quota_us")) + + if err != nil { + log.Fatal(err) + } + + periodFile, err := os.Create(filepath.Join(cgroupPath,"cpu.cfs_period_us")) + + if err != nil { + log.Fatal(err) + } + + quotaFile.WriteString("4"); + quotaFile.Sync(); + + periodFile.WriteString("2"); + periodFile.Sync(); + + assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(1)) + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), 2) + + os.Remove(filepath.Join(cgroupPath,"cpu.cfs_quota_us")) + os.Remove(filepath.Join(cgroupPath,"cpu.cfs_period_us")) }) - ginkgo.It("detects number of CPUs properly in cgroups v2", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) + ginkgo.It("detect cgroups version v2", func() { + if err := os.MkdirAll("/sys/fs/cgroup/", os.ModePerm); err != nil { + log.Fatal(err) + } + + os.Create("/sys/fs/cgroup/cgroup.controllers") + file, err := os.Create("/sys/fs/cgroup/cpu.max") + + if err != nil { + log.Fatal(err) + } + + file.WriteString("4 2"); + file.Sync(); + + assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(2)) + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), 2) + + os.Remove("/sys/fs/cgroup/cpu.max") + os.Remove("/sys/fs/cgroup/cgroup.controllers") }) + + // ginkgo.It("detects number of CPUs properly in cgroups v1", func() { + // assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) + // }) + + // ginkgo.It("detects cgroups version v2", func() { + // // create cgroups2 files + // if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { + // log.Fatal(err) + // } + + // }) + + // ginkgo.It("detects number of CPUs properly in cgroups v2", func() { + // assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) + // }) }) diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index a671e8793..57b047230 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -29,27 +29,26 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" // tests to run - // _ "k8s.io/ingress-nginx/test/e2e/admission" - // _ "k8s.io/ingress-nginx/test/e2e/annotations" - // _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" - _ "k8s.io/ingress-nginx/test/e2e/cgroups" - // _ "k8s.io/ingress-nginx/test/e2e/dbg" - // _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" - // _ "k8s.io/ingress-nginx/test/e2e/endpointslices" - // _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" - // _ "k8s.io/ingress-nginx/test/e2e/ingress" - // _ "k8s.io/ingress-nginx/test/e2e/leaks" - // _ "k8s.io/ingress-nginx/test/e2e/loadbalance" - // _ "k8s.io/ingress-nginx/test/e2e/lua" - // _ "k8s.io/ingress-nginx/test/e2e/nginx" - // _ "k8s.io/ingress-nginx/test/e2e/security" - // _ "k8s.io/ingress-nginx/test/e2e/servicebackend" - // _ "k8s.io/ingress-nginx/test/e2e/settings" - // _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" - // _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" - // _ "k8s.io/ingress-nginx/test/e2e/ssl" - // _ "k8s.io/ingress-nginx/test/e2e/status" - // _ "k8s.io/ingress-nginx/test/e2e/tcpudp" + _ "k8s.io/ingress-nginx/test/e2e/admission" + _ "k8s.io/ingress-nginx/test/e2e/annotations" + _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/dbg" + _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" + _ "k8s.io/ingress-nginx/test/e2e/endpointslices" + _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" + _ "k8s.io/ingress-nginx/test/e2e/ingress" + _ "k8s.io/ingress-nginx/test/e2e/leaks" + _ "k8s.io/ingress-nginx/test/e2e/loadbalance" + _ "k8s.io/ingress-nginx/test/e2e/lua" + _ "k8s.io/ingress-nginx/test/e2e/nginx" + _ "k8s.io/ingress-nginx/test/e2e/security" + _ "k8s.io/ingress-nginx/test/e2e/servicebackend" + _ "k8s.io/ingress-nginx/test/e2e/settings" + _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" + _ "k8s.io/ingress-nginx/test/e2e/ssl" + _ "k8s.io/ingress-nginx/test/e2e/status" + _ "k8s.io/ingress-nginx/test/e2e/tcpudp" ) // RunE2ETests checks configuration parameters (specified through flags) and then runs diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml index fc919bad2..e48076b5a 100644 --- a/test/junitreports/report-e2e-test-suite.xml +++ b/test/junitreports/report-e2e-test-suite.xml @@ -1,12 +1,12 @@ - - + + - + @@ -20,1292 +20,8 @@ - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:40.576 (2m21.32s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:40.576 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:44.629 (4.053s) > Enter [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:44.629 < Exit [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:54.768 (10.139s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.768 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.976 (208ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:54.976 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:01.906 (6.93s) > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:01.906 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:12.967 (11.06s) > Enter [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:07:12.967 < Exit [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:09:21.17 (2m8.203s) > Enter [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.17 < Exit [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.399 (229ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:21.4 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:28.324 (6.924s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:28.324 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:39.376 (11.052s) > Enter [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:39.376 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:54 @ 04/04/23 18:09:56.563 STEP: ensuring that first entry in X-Forwarded-Host is used as the best host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:75 @ 04/04/23 18:09:56.572 < Exit [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:56.578 (17.202s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.578 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.789 (211ms) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:56.79 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.662 (6.873s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:03.662 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:07.688 (4.026s) > Enter [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:07.688 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:65 @ 04/04/23 18:10:07.688 STEP: sending request to www should redirect to domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:91 @ 04/04/23 18:10:22.913 STEP: sending request to domain should not redirect to www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:103 @ 04/04/23 18:10:22.941 < Exit [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:22.969 (15.281s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:22.969 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:23.209 (240ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:23.21 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.083 (7.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:31.083 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:35.101 (4.018s) > Enter [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:35.101 < Exit [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:45.308 (10.206s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.308 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.524 (217ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:45.525 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:52.399 (6.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:52.399 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:56.446 (4.048s) > Enter [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:10:56.446 < Exit [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:11:06.571 (10.124s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.571 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.765 (195ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.765 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.684 (6.918s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:13.684 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:17.714 (4.03s) > Enter [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:17.714 < Exit [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:27.946 (10.232s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:27.946 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:28.167 (220ms) - - - > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:28.167 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:36.071 (7.904s) > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:36.071 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:38.106 (2.035s) > Enter [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:11:38.106 < Exit [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:12:00.307 (22.201s) > Enter [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.307 < Exit [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.53 (223ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:00.531 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:07.492 (6.961s) > Enter [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:07.492 < Exit [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:24.818 (17.326s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:24.818 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:25.032 (214ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:25.033 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:32.425 (7.392s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:32.425 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:36.448 (4.023s) > Enter [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:36.448 < Exit [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:46.572 (10.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.572 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.787 (215ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:46.788 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:54.215 (7.427s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:54.215 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:02.279 (8.064s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:02.279 STEP: routing requests to the canary upstream when header pattern is matched - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:514 @ 04/04/23 18:13:19.503 STEP: routing requests to the mainline upstream when header failed to match header value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:523 @ 04/04/23 18:13:19.508 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:19.51 (17.231s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.51 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.813 (303ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:19.813 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:26.704 (6.89s) > Enter [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:26.704 < Exit [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:29.872 (3.169s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:29.872 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:30.073 (201ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:30.073 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.948 (7.874s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:37.948 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:41.967 (4.019s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:13:41.967 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:14:07.32 (25.353s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.32 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.487 (167ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:07.487 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.369 (6.882s) > Enter [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.369 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:107 @ 04/04/23 18:14:14.37 < Exit [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.37 (1ms) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.37 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.561 (191ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.561 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:21.468 (6.907s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:21.468 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:29.526 (8.058s) > Enter [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:14:29.526 STEP: routing requests to the canary upstream when cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:667 @ 04/04/23 18:14:46.664 STEP: routing requests to the mainline upstream when cookie is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:678 @ 04/04/23 18:14:54.864 STEP: routing requests to the mainline upstream when cookie is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:689 @ 04/04/23 18:15:04.858 < Exit [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:15:14.862 (45.336s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:14.862 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:15.079 (218ms) - - - > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:15.08 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.972 (7.892s) > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:22.972 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:26.998 (4.026s) > Enter [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:26.998 < Exit [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:37.18 (10.182s) > Enter [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.18 < Exit [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.392 (212ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:37.392 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:44.321 (6.929s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:44.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:50.372 (6.051s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:15:50.372 < Exit [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:16:15.956 (25.584s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:15.956 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:16.151 (195ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:16.152 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:25.575 (9.424s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:25.576 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:29.621 (4.045s) > Enter [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:29.621 STEP: setting enable-rewrite-log annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:38 @ 04/04/23 18:16:29.621 < Exit [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:42.864 (13.243s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:42.864 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:43.089 (224ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:43.089 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.483 (7.394s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:50.483 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:54.502 (4.019s) > Enter [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:16:54.502 < Exit [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:17:09.564 (15.063s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.564 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.781 (217ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:09.782 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:16.68 (6.899s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:16.68 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:20.71 (4.03s) > Enter [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:20.71 < Exit [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:50.976 (30.266s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:50.976 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:51.176 (200ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 (0s) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:51.177 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.072 (7.895s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:59.072 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:18:13.271 (14.199s) > Enter [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:13.271 < Exit [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:23.585 (10.314s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.585 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.805 (219ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:23.805 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:30.696 (6.891s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:30.696 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:34.717 (4.021s) > Enter [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:34.717 < Exit [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:57.987 (23.27s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:57.987 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:58.194 (208ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:58.195 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:08.072 (9.877s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:08.072 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:12.096 (4.024s) > Enter [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:12.096 < Exit [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:29.486 (17.39s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:29.486 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:30 (514ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 (0s) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:30.007 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:37.929 (7.922s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:37.929 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:41.957 (4.027s) > Enter [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:41.957 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:39 @ 04/04/23 18:19:41.957 STEP: sending request to www.fromtowwwredirect.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:55 @ 04/04/23 18:19:52.111 < Exit [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:52.114 (10.157s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.114 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.309 (195ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:52.309 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.222 (6.912s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:19:59.222 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:20:03.271 (4.049s) > Enter [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:03.271 < Exit [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:10.739 (7.468s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:10.739 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:11.546 (807ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:11.548 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.355 (8.808s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:20.355 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:28.54 (8.185s) > Enter [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:20:28.54 < Exit [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:21:23.965 (55.425s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:23.965 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:24.188 (223ms) - - - > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:24.188 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:32.093 (7.904s) > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:32.093 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:36.116 (4.023s) > Enter [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:21:36.116 STEP: turning on proxy_intercept_errors directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:59 @ 04/04/23 18:21:46.348 STEP: configuring error_page directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:62 @ 04/04/23 18:21:46.348 STEP: creating error locations - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:67 @ 04/04/23 18:21:46.348 STEP: updating configuration when only custom-http-error value changes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:72 @ 04/04/23 18:21:46.349 STEP: ignoring duplicate values (503 in this case) per server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:90 @ 04/04/23 18:21:50.55 STEP: using the custom default-backend from annotation for upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:102 @ 04/04/23 18:22:00.715 < Exit [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:22:08.9 (32.784s) > Enter [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:08.9 < Exit [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.112 (212ms) - - - > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.112 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.003 (7.891s) > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:17.003 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:21.032 (4.029s) > Enter [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:21.032 < Exit [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:31.159 (10.126s) > Enter [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.159 < Exit [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.365 (206ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:31.366 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:38.253 (6.887s) > Enter [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:38.253 < Exit [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:48.533 (10.28s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.533 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.75 (218ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:48.751 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:55.631 (6.88s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:55.631 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:59.653 (4.022s) > Enter [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:22:59.653 < Exit [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:23:08.743 (9.09s) > Enter [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:08.743 < Exit [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:18.9 (10.157s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:18.9 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.087 (187ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.087 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.019 (7.931s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.019 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.042 (4.023s) > Enter [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:31.042 < Exit [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:41.252 (10.21s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.252 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.433 (181ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:41.433 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:48.317 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:48.317 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:52.34 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:23:52.34 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:24:11.665 (19.325s) > Enter [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:11.665 < Exit [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:16.916 (5.251s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.295 (379ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.296 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:24.725 (7.429s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:24.725 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:28.761 (4.036s) > Enter [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:28.761 < Exit [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:45.952 (17.19s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:45.952 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:46.145 (194ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:46.146 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:54.048 (7.903s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:54.048 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:58.076 (4.028s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:24:58.076 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:03.11 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:13.321 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:23.483 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:33.694 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:25:48.897 (50.821s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.897 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.908 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:48.908 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:49.135 (227ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:49.135 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:56.988 (7.853s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:25:56.988 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:26:08.04 (11.052s) > Enter [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:08.04 < Exit [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:18.223 (10.184s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.223 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.414 (191ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:18.415 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.316 (6.901s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:25.316 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:29.352 (4.036s) > Enter [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:29.352 < Exit [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:46.584 (17.231s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.584 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.805 (221ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.805 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.714 (6.909s) > Enter [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:26:53.714 < Exit [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:27:03.859 (10.145s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.859 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:04.058 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:04.058 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:22.496 (2m18.438s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:22.496 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:26.527 (4.032s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:26.527 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:40.697 (14.169s) > Enter [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:29:40.697 < Exit [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:30:03.916 (23.219s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:03.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:04.131 (215ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:04.131 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:12.003 (7.871s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:12.003 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:16.028 (4.025s) > Enter [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:16.028 < Exit [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:26.487 (10.459s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.487 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.704 (217ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:26.704 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:33.592 (6.888s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:33.592 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:44.636 (11.044s) > Enter [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:44.636 < Exit [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:54.792 (10.156s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.792 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.971 (179ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:54.971 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:56.98 (2.008s) > Enter [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:30:56.98 < Exit [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:31:57.006 (1m0.027s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.006 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.009 (3ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:57.009 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:03.889 (6.88s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:03.889 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:07.917 (4.028s) > Enter [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:07.917 < Exit [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:23.139 (15.222s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.139 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.334 (195ms) - - - > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:23.334 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:30.222 (6.888s) > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:30.222 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:34.249 (4.027s) > Enter [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:34.249 < Exit [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:41.274 (7.025s) > Enter [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.274 < Exit [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.496 (222ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:41.497 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:48.376 (6.879s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:48.376 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:52.403 (4.027s) > Enter [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:32:52.403 < Exit [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:33:00.451 (8.048s) > Enter [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:00.451 < Exit [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:24.697 (24.246s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.697 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.873 (176ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.873 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:32.238 (7.364s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:32.238 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:42.291 (10.053s) > Enter [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:42.291 < Exit [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:59.526 (17.235s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.526 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.709 (183ms) - - - > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:59.71 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.602 (6.893s) > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:06.602 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:10.627 (4.025s) > Enter [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:10.627 < Exit [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:27.807 (17.179s) > Enter [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:27.807 < Exit [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:28.007 (200ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:28.007 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:35.896 (7.889s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:35.896 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:39.916 (4.02s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:34:39.916 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:34:57.039 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:35:05.187 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:35:05.197 (25.281s) > Enter [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:05.197 STEP: serving the default certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:204 @ 04/04/23 18:35:10.227 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:214 @ 04/04/23 18:35:10.293 < Exit [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:10.293 (5.095s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.293 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.501 (209ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:10.502 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:17.387 (6.885s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:17.387 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:21.413 (4.026s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:21.413 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:42.607 (21.195s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.607 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.616 (9ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.832 (216ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.832 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:49.737 (6.905s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:49.737 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:54.76 (5.023s) > Enter [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:35:54.76 < Exit [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:36:04.978 (10.218s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:04.978 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:05.161 (183ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.162 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:13.068 (7.906s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:13.068 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:17.096 (4.027s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:17.096 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:36:34.288 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:36:42.473 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:42.5 (25.405s) > Enter [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:42.5 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:163 @ 04/04/23 18:36:47.607 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:169 @ 04/04/23 18:36:50.731 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:180 @ 04/04/23 18:36:53.763 < Exit [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:53.763 (11.263s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.763 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.98 (217ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:53.981 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:00.852 (6.872s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:00.852 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:13.899 (13.046s) > Enter [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:13.899 < Exit [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:27.067 (13.169s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.067 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.254 (186ms) - - - > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:27.254 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:35.134 (7.88s) > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:35.134 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:39.153 (4.019s) > Enter [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:37:39.153 < Exit [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:38:10.344 (31.191s) > Enter [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.344 < Exit [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.535 (191ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:10.535 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:17.414 (6.879s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:17.414 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:21.437 (4.023s) > Enter [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:21.437 < Exit [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:38.614 (17.177s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.614 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.835 (221ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:38.836 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:45.698 (6.862s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:45.698 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:49.734 (4.036s) > Enter [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:49.734 < Exit [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:59.959 (10.225s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:59.959 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:00.179 (220ms) - - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.179 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:08.619 (8.44s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:08.619 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:12.644 (4.025s) > Enter [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.644 [SKIPPED] GeoIP test are temporarily disabled In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:71 @ 04/04/23 18:39:12.645 < Exit [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.645 (1ms) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.645 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.862 (217ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:12.863 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:19.76 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:19.76 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:23.829 (4.069s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:23.829 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:33.03 (9.2s) > Enter [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:33.03 < Exit [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:43.259 (10.229s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.259 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.444 (186ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:43.445 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:50.328 (6.883s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:50.328 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:58.361 (8.034s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:40:08.534 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:40:18.725 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:40:28.928 (30.567s) > Enter [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:28.928 STEP: Adding a global-auth-response-headers to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:228 @ 04/04/23 18:40:28.928 < Exit [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:39.119 (10.19s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.119 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.335 (216ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.335 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:46.231 (6.896s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:46.231 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:48.266 (2.035s) > Enter [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:40:48.266 < Exit [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:41:05.463 (17.198s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.463 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.678 (215ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:24.95 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:57.132 (32.182s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:41:57.132 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:05.196 (8.064s) > Enter [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:05.196 < Exit [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:08.558 (3.362s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.558 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.881 (323ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:08.881 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:27.269 (18.388s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:27.269 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:35.33 (8.061s) > Enter [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.33 < Exit [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.482 (152ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.482 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.681 (199ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:35.681 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:54.33 (18.649s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:54.33 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 21:18:55.121 (10.056s) > Enter [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:55.121 < Exit [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:58.366 (3.245s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.367 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.612 (246ms) - - - > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:18:58.613 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:05.487 (6.875s) > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:05.487 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:09.523 (4.036s) > Enter [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:09.523 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:53 @ 04/04/23 21:19:19.701 < Exit [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:19.839 (10.316s) > Enter [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:19.839 < Exit [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:20.061 (222ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:20.061 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:17:57.17 (30.737s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:17:57.17 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:18:05.234 (8.065s) > Enter [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:05.234 < Exit [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:08.53 (3.296s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.53 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.765 (235ms) - - - > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:08.766 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:22.642 (13.877s) > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:22.642 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:48.76 (26.118s) > Enter [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:48.76 < Exit [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:55.044 (6.284s) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.044 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.29 (246ms) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.29 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.293 (3ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:55.294 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:12.977 (17.683s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:12.977 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:21.048 (8.072s) > Enter [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.048 < Exit [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.18 (132ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.18 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.377 (197ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:21.377 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:52.511 (31.134s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:52.511 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:00.575 (8.064s) > Enter [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:00.575 STEP: rejects ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:52 @ 04/04/23 22:20:00.575 STEP: accepts ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:57 @ 04/04/23 22:20:00.587 < Exit [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:10.885 (10.31s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:10.885 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:11.143 (257ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:11.143 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:29.584 (18.441s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:29.584 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:37.66 (8.076s) > Enter [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:37.66 < Exit [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:44.7 (7.04s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.7 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.899 (199ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:44.899 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:03.976 (19.078s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:03.976 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:12.046 (8.07s) > Enter [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:12.046 < Exit [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:19.079 (7.033s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.079 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.337 (258ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:19.337 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:37.731 (18.394s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:37.731 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:45.791 (8.06s) > Enter [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.791 < Exit [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.852 (61ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:45.852 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:46.057 (205ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:46.057 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:04.907 (18.85s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:04.907 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:12.968 (8.061s) > Enter [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:12.968 < Exit [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:18.358 (5.39s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.358 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.592 (234ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:18.592 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:47.015 (28.422s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:47.015 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:55.073 (8.059s) > Enter [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:55.073 < Exit [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:58.439 (3.366s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.439 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.64 (201ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.251 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.76 (7.509s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:26.76 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:38.808 (12.048s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:04:38.808 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:04:55.931 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:05:04.12 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:05:04.15 (25.342s) > Enter [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.15 < Exit [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.174 (24ms) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.174 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.407 (234ms) - - - > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.408 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.385 (6.978s) > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:11.385 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:15.42 (4.034s) > Enter [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:15.42 < Exit [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:22.428 (7.008s) > Enter [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.428 < Exit [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.626 (198ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:22.626 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:29.568 (6.942s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:29.568 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:33.606 (4.037s) > Enter [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:33.606 < Exit [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:43.732 (10.127s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.732 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.917 (184ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:43.917 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:51.802 (7.885s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:51.802 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:55.831 (4.029s) > Enter [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:05:55.831 < Exit [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:06:05.978 (10.147s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:05.978 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:06.188 (210ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:06.189 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:14.133 (7.945s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:14.133 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:18.165 (4.031s) > Enter [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:18.165 < Exit [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:35.378 (17.213s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.378 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.637 (259ms) - - - > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:35.637 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:42.521 (6.884s) > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:42.521 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:46.54 (4.019s) > Enter [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:06:46.54 < Exit [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:07:17.039 (30.499s) > Enter [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.039 < Exit [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.22 (180ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:17.22 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:24.225 (7.005s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:24.225 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:26.256 (2.031s) > Enter [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:26.256 < Exit [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:36.45 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.45 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.633 (183ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:36.633 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:43.537 (6.903s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:43.537 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:51.596 (8.059s) > Enter [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:07:51.596 < Exit [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:08:08.813 (17.217s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:08.813 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:09.063 (249ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:09.063 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:16.959 (7.896s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:16.959 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:25.017 (8.058s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:08:35.191 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:08:45.372 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:55.507 (30.491s) > Enter [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:08:55.507 STEP: Adding a global-auth-cache-key to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:163 @ 04/04/23 18:08:55.507 < Exit [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:09:12.69 (17.183s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.69 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.914 (224ms) - - - > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:12.915 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:19.799 (6.884s) > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:19.799 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:23.825 (4.026s) > Enter [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:23.825 < Exit [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:41.065 (17.24s) > Enter [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.065 < Exit [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.299 (233ms) - - - > Enter [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:41.299 < Exit [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:49.196 (7.896s) > Enter [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:09:49.196 < Exit [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:10:01.416 (12.22s) > Enter [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.416 < Exit [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.602 (187ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:01.603 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:08.48 (6.877s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:08.48 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:12.502 (4.022s) > Enter [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:12.502 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:69 @ 04/04/23 18:10:12.502 STEP: making a request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:78 @ 04/04/23 18:10:22.752 STEP: creating an ingress definition with the rewrite-target annotation set on the "/" location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:88 @ 04/04/23 18:10:22.759 STEP: making a second request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:102 @ 04/04/23 18:10:32.852 < Exit [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:32.86 (20.358s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:32.86 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:33.04 (180ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:33.04 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:40.925 (7.885s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:40.925 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:44.945 (4.02s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:44.945 Apr 4 18:10:54.109: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:56.109 (11.164s) > Enter [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:10:56.109 < Exit [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:11:06.315 (10.206s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.315 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.527 (212ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.528 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.431 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:13.431 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:21.479 (8.048s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:21.479 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:49.732 (28.253s) > Enter [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:49.732 < Exit [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:56.743 (7.011s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.743 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.926 (183ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.926 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:03.815 (6.889s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:03.815 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:11.862 (8.047s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:11.862 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:40.103 (28.241s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.103 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.112 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.112 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.334 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:40.335 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.184 (6.849s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.184 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.214 (4.031s) > Enter [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:51.214 < Exit [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:58.232 (7.018s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.232 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.436 (203ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.436 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:05.332 (6.896s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:05.332 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:09.361 (4.029s) > Enter [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:09.361 < Exit [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:21.468 (12.107s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.468 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.639 (171ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.639 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.514 (7.875s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:29.514 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:33.537 (4.023s) > Enter [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:33.537 < Exit [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:47.331 (13.794s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.331 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.532 (202ms) - - - > Enter [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:47.533 < Exit [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:54.43 (6.897s) > Enter [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:13:54.43 < Exit [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:14:10.603 (16.173s) > Enter [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.603 < Exit [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.797 (195ms) - - - > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.798 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.742 (6.944s) > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:17.742 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:21.766 (4.024s) > Enter [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:21.766 < Exit [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:31.914 (10.148s) > Enter [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:31.914 < Exit [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.125 (211ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.125 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.045 (7.92s) > Enter [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:40.045 < Exit [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:50.345 (10.299s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.345 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.661 (317ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.662 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.86 (7.198s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:57.86 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:15:01.901 (4.041s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:01.901 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:16.075 (14.174s) > Enter [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:16.075 < Exit [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:39.289 (23.214s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.289 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.523 (234ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:39.523 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:46.413 (6.89s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:46.413 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:05.358 (18.945s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:05.358 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:08.518 (3.16s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.518 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.699 (180ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:08.699 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:15.641 (6.942s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:15.641 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:26.725 (11.084s) > Enter [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:16:26.725 < Exit [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:17:59.041 (1m32.316s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.041 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.27 (229ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.27 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.156 (7.885s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:07.156 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:19.212 (12.057s) > Enter [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:19.212 < Exit [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:39.618 (20.406s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.618 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.83 (212ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.831 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.716 (6.885s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:46.716 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:50.744 (4.028s) > Enter [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:18:50.744 < Exit [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:19:00.902 (10.159s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:00.902 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:01.091 (189ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:01.092 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:09.007 (7.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:09.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:17.081 (8.074s) > Enter [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:17.081 < Exit [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:24.105 (7.024s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.388 (283ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:24.389 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.748 (2m19.359s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:43.748 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:57.954 (14.206s) > Enter [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:21:57.954 < Exit [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:22:20.304 (22.351s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.304 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.502 (198ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:20.503 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:27.369 (6.866s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:27.369 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:31.399 (4.03s) > Enter [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:31.399 < Exit [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:41.545 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.545 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.748 (203ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.748 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:58.304 (2m16.556s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:24:58.304 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:25:07.351 (9.047s) > Enter [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:07.351 < Exit [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:17.463 (10.112s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.463 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.721 (257ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:17.721 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36 (2m18.279s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:40.022 (4.023s) > Enter [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:40.022 < Exit [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:50.223 (10.201s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.224 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.413 (190ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.414 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.312 (13.898s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:04.312 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:11.43 (7.118s) > Enter [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:11.43 Apr 4 18:28:24.664: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not forwarded-headers < Exit [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:29.799 (18.368s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:29.799 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:30.029 (230ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:30.03 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:36.888 (6.859s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:36.888 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:40.919 (4.03s) > Enter [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:40.919 < Exit [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:51.095 (10.176s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.095 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.273 (178ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:51.273 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:59.672 (8.399s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:28:59.672 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:07.713 (8.041s) > Enter [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:07.713 STEP: routing requests destined for the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:351 @ 04/04/23 18:29:32.166 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:360 @ 04/04/23 18:29:32.169 < Exit [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:32.172 (24.459s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.172 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.356 (184ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:32.356 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:39.249 (6.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:39.249 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:43.271 (4.022s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:43.271 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:57.423 (14.152s) > Enter [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:29:57.423 < Exit [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:30:20.684 (23.26s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.684 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.873 (189ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:20.873 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:27.823 (6.95s) > Enter [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:27.823 < Exit [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:49.071 (21.248s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.071 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.267 (196ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:49.267 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:56.179 (6.912s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:30:56.179 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:31:00.207 (4.028s) > Enter [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:00.207 < Exit [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:10.334 (10.127s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.334 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.562 (228ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:10.562 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:17.468 (6.905s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:17.468 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:21.488 (4.02s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:21.488 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:35.745 (14.257s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:35.745 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:46.949 (11.204s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:46.949 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:47.158 (209ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:47.158 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.054 (7.895s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:55.054 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:59.086 (4.032s) > Enter [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:31:59.086 < Exit [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:32:06.117 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.117 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.335 (217ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:06.335 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:13.216 (6.881s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:13.216 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:30.126 (16.91s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:30.126 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:34.111 (3.985s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.111 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.285 (174ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:34.285 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.164 (7.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:42.164 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:46.19 (4.026s) > Enter [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:46.19 < Exit [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:53.221 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.221 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.428 (207ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:53.428 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.295 (6.867s) > Enter [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:00.295 < Exit [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:17.519 (17.224s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.519 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.698 (178ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:17.698 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.578 (6.881s) > Enter [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:24.578 < Exit [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:34.73 (10.152s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.73 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.905 (175ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:34.906 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:44.808 (9.902s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:44.808 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:55.842 (11.034s) > Enter [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:33:55.842 < Exit [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:34:05.994 (10.152s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:05.994 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.258 (264ms) - - - - - - > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.259 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:14.168 (7.909s) > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:14.168 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:25.207 (11.04s) > Enter [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:25.207 < Exit [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:36.4 (11.193s) > Enter [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.4 < Exit [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.599 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:36.6 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:44.48 (7.88s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.48 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:48.503 (4.024s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:34:48.503 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:35:02.728 (14.224s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.728 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.742 (15ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.742 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.951 (209ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:02.951 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:09.829 (6.877s) > Enter [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:09.829 < Exit [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:30.35 (20.521s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.35 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.552 (202ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:30.552 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:37.481 (6.929s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:37.481 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:48.587 (11.106s) > Enter [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:35:48.587 < Exit [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:36:17.402 (28.814s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.402 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.602 (201ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.603 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:24.47 (6.867s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:24.47 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:35.523 (11.052s) > Enter [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:35.523 < Exit [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:45.69 (10.167s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.69 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.908 (218ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.908 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.807 (6.899s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:52.807 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:56.83 (4.024s) > Enter [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:36:56.83 < Exit [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:37:10.803 (13.972s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.803 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.971 (169ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.972 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.855 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:17.855 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:21.879 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:21.879 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:43.087 (21.209s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.087 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.095 (8ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.095 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.321 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:43.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:50.242 (6.92s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:50.242 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:58.297 (8.055s) > Enter [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:37:58.297 < Exit [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:38:15.503 (17.206s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.503 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.723 (220ms) - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.724 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:22.643 (6.92s) > Enter [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:22.643 STEP: basic HTTP GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.644 STEP: basic HTTP GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.657 STEP: basic HTTPS GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.667 STEP: basic HTTPS GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.695 STEP: basic HTTP POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.708 STEP: basic HTTP POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.712 STEP: basic HTTPS POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.052 STEP: basic HTTPS POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.468 STEP: basic HTTP GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.852 STEP: basic HTTP GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.25 STEP: basic HTTPS GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.647 STEP: basic HTTPS GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.07 STEP: basic HTTP POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.469 STEP: basic HTTP POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.847 STEP: basic HTTPS POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.252 STEP: basic HTTPS POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.65 < Exit [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:32.067 (9.424s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.067 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.276 (208ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:32.276 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:40.184 (7.908s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:40.184 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:48.25 (8.066s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:38:58.421 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:39:08.584 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:18.813 (30.563s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:18.813 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 04/04/23 18:39:18.813 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 04/04/23 18:39:29.026 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 04/04/23 18:39:29.042 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:29.049 (10.236s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.049 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.257 (208ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.257 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:37.143 (7.885s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:37.143 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:39.168 (2.025s) > Enter [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:39.168 < Exit [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:56.292 (17.124s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.292 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.478 (186ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:56.478 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.36 (6.881s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:03.36 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:14.407 (11.047s) > Enter [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:14.407 < Exit [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:24.598 (10.191s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.598 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.819 (221ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:24.819 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.201 (14.382s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:39.201 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:46.467 (7.266s) > Enter [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:46.467 < Exit [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:56.662 (10.195s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.662 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.852 (191ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.258 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.76 (8.502s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:27.76 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:39.782 (12.022s) > Enter [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:39.782 < Exit [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:49.993 (10.211s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.993 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:50.223 (229ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:50.223 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:58.145 (7.922s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:04:58.145 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:05:02.17 (4.025s) > Enter [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:02.17 < Exit [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:19.394 (17.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.394 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.624 (230ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:19.625 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:26.544 (6.92s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:26.544 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:30.589 (4.045s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:30.589 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:58.841 (28.251s) > Enter [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:05:58.841 < Exit [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:06:22.065 (23.224s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.065 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.266 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:22.267 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:29.196 (6.929s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:29.196 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:40.24 (11.044s) > Enter [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:40.24 < Exit [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:50.425 (10.185s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.425 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.601 (177ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.602 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.545 (6.943s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:06:57.545 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:07:01.588 (4.043s) > Enter [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:01.588 < Exit [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:11.685 (10.097s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.685 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.883 (198ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.883 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:18.774 (6.89s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:18.774 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:22.815 (4.041s) > Enter [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:22.815 < Exit [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:29.864 (7.049s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:29.864 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:30.072 (208ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:30.072 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:48.992 (2m18.92s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:48.992 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:53.047 (4.055s) > Enter [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:09:53.047 < Exit [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:10:03.229 (10.182s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.229 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.446 (217ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.446 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:10.362 (6.916s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:10.362 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:14.4 (4.038s) > Enter [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:14.4 < Exit [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:24.616 (10.216s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.82 (204ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:24.821 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.7 (6.879s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:31.7 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:42.759 (11.059s) > Enter [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:10:42.759 < Exit [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:12:14.993 (1m32.235s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:14.993 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:15.384 (390ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:15.384 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:22.265 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:22.265 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:24.285 (2.02s) > Enter [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:24.285 < Exit [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:34.441 (10.156s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.441 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.624 (183ms) - - - > Enter [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:34.624 < Exit [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:41.556 (6.931s) > Enter [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:12:41.556 < Exit [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:13:01.842 (20.286s) > Enter [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.842 < Exit [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:02.025 (183ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.025 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:09.923 (7.898s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:09.923 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:13.962 (4.038s) > Enter [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:13.962 < Exit [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:20.977 (7.016s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:20.977 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.159 (181ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.159 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.044 (7.885s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:29.044 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:40.088 (11.044s) > Enter [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:40.088 < Exit [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:50.23 (10.141s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.23 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.426 (197ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:50.427 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.36 (6.933s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:57.36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:01.385 (4.026s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:01.385 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:06.428 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:16.618 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:26.768 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:36.897 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:52.087 (50.702s) > Enter [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:14:52.087 STEP: logging into server thisHost /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:821 @ 04/04/23 18:14:52.087 STEP: receiving an internal server error without cache on thisHost location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:833 @ 04/04/23 18:14:59.113 < Exit [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:15:59.128 (1m7.041s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.128 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.362 (234ms) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.363 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.334 (6.971s) > Enter [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:06.334 < Exit [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:20.803 (14.469s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.803 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:21.76 (957ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:21.77 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.035 (9.266s) > Enter [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:31.035 STEP: setting permanent-redirect annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:34 @ 04/04/23 18:16:31.036 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:52 @ 04/04/23 18:16:41.175 < Exit [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:41.182 (10.147s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.182 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.409 (227ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.409 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:57.856 (2m16.447s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:57.856 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:19:09.919 (12.063s) > Enter [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:09.919 < Exit [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:20.272 (10.353s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.272 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.675 (403ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:20.677 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.892 (8.215s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:28.892 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:32.924 (4.032s) > Enter [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:32.924 < Exit [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:43.863 (10.939s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:43.863 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:44.064 (200ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:44.064 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.434 (9.37s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:53.434 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:55.451 (2.017s) > Enter [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:19:55.451 < Exit [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:20:12.863 (17.412s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.863 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.699 (836ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 (0s) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.7 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:22.723 (9.023s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:22.723 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:26.762 (4.038s) > Enter [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:26.762 < Exit [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:36.907 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:36.907 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:37.137 (230ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:37.137 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:45.044 (7.907s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:45.044 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:49.07 (4.026s) > Enter [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:20:49.07 < Exit [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:21:06.287 (17.217s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.287 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.513 (226ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:06.513 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:13.397 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:13.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:15.42 (2.023s) > Enter [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:15.42 < Exit [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:26.454 (11.034s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.454 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.651 (198ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.652 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:33.515 (6.863s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:33.515 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:43.707 (10.192s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.707 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.924 (216ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.924 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:50.816 (6.892s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:50.816 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:54.851 (4.035s) > Enter [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:21:54.851 < Exit [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:22:01.873 (7.022s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:01.873 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:02.061 (188ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:02.061 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.943 (7.882s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:09.943 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:20.994 (11.051s) > Enter [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:20.994 < Exit [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:34.191 (13.197s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.191 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.407 (216ms) - - - > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:34.407 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.334 (6.927s) > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:41.334 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:45.355 (4.021s) > Enter [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:22:45.355 STEP: Checking exact request to / - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:63 @ 04/04/23 18:23:02.535 STEP: Checking prefix request to /bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:76 @ 04/04/23 18:23:02.543 STEP: Checking exact request to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:109 @ 04/04/23 18:23:19.72 STEP: Checking prefix request to /foo/bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:122 @ 04/04/23 18:23:19.723 STEP: Checking prefix request to /foobar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:134 @ 04/04/23 18:23:19.724 < Exit [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:23:19.726 (34.371s) > Enter [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.726 < Exit [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.917 (190ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.917 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.858 (7.94s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.858 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.884 (4.027s) > Enter [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:31.884 < Exit [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:42.035 (10.15s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.035 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.253 (218ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:42.254 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.152 (7.898s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:50.152 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:59.193 (9.041s) > Enter [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:23:59.193 < Exit [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:24:16.594 (17.4s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.594 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.994 (401ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:16.995 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.428 (8.433s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:25.428 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:33.475 (8.047s) > Enter [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:24:33.475 < Exit [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:25:28.827 (55.352s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:28.827 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:29.073 (245ms) - - - > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:29.073 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:35.955 (6.882s) > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:35.955 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:39.976 (4.021s) > Enter [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:39.976 < Exit [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:50.116 (10.14s) > Enter [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.116 < Exit [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.35 (233ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:50.35 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:57.262 (6.911s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:25:57.262 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:26:08.325 (11.063s) > Enter [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:08.325 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:54 @ 04/04/23 18:26:25.541 < Exit [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:25.551 (17.226s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.551 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.758 (207ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.758 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:32.641 (6.883s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:32.641 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:36.668 (4.026s) > Enter [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:36.668 < Exit [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:46.879 (10.212s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.879 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.059 (180ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.06 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.958 (6.898s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:53.958 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:57.986 (4.028s) > Enter [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:26:57.986 < Exit [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:27:27.257 (29.271s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.257 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.443 (186ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:27.443 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:34.37 (6.927s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:34.37 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:38.399 (4.029s) > Enter [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:27:38.399 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:115 @ 04/04/23 18:27:55.604 STEP: sending request from an implicitly denied IP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:123 @ 04/04/23 18:27:55.61 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:131 @ 04/04/23 18:27:55.616 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:139 @ 04/04/23 18:27:55.623 < Exit [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:28:02.653 (24.254s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.653 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.902 (249ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:02.903 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:09.803 (6.9s) > Enter [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:09.803 < Exit [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:20.04 (10.238s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.041 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.276 (236ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:20.277 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:28.169 (7.892s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:28.169 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:30.185 (2.016s) > Enter [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:30.185 < Exit [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:40.334 (10.15s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.334 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.52 (185ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:40.52 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:47.397 (6.877s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:47.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:51.425 (4.028s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:28:51.425 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:05.527 (14.103s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.527 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.539 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.539 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.766 (227ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:05.767 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:12.664 (6.897s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:12.664 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:16.693 (4.029s) > Enter [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:16.693 < Exit [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:33.899 (17.207s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:33.899 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:34.123 (224ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:34.124 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:42.012 (7.888s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:42.012 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:46.039 (4.027s) > Enter [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:46.039 < Exit [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:56.186 (10.147s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.186 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.375 (189ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.375 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:03.267 (6.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:03.267 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:07.298 (4.031s) > Enter [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:07.298 < Exit [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:17.47 (10.172s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.47 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.686 (215ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.686 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.008 (2m17.322s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:35.008 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:39.033 (4.025s) > Enter [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:39.033 < Exit [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:52.207 (13.174s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.207 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.41 (203ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:52.41 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:59.312 (6.902s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:32:59.312 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:33:03.343 (4.031s) > Enter [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:03.343 < Exit [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:13.571 (10.227s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.571 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.79 (220ms) - - - > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:13.791 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:20.666 (6.876s) > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:20.666 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:24.686 (4.02s) > Enter [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:33:24.686 STEP: running cfssl gencert -initca ca_csr.json | cfssljson -bare ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:31.697 STEP: running cfssl gencert -ca ca.pem -ca-key ca-key.pem -config=cfssl_config.json -profile=intermediate intermediate_ca_csr.json | cfssljson -bare intermediate_ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.042 STEP: running cfssl gencert -ca intermediate_ca.pem -ca-key intermediate_ca-key.pem -config=cfssl_config.json -profile=ocsp ocsp_csr.json | cfssljson -bare ocsp - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.211 STEP: running cfssl serve -db-config=db-config.json -ca-key=intermediate_ca-key.pem -ca=intermediate_ca.pem -config=cfssl_config.json -responder=ocsp.pem -responder-key=ocsp-key.pem - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:228 @ 04/04/23 18:33:32.385 STEP: running cfssl gencert -remote=localhost -profile=server leaf_csr.json | cfssljson -bare leaf - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:238 @ 04/04/23 18:33:37.385 STEP: running cfssl ocsprefresh -ca intermediate_ca.pem -responder=ocsp.pem -responder-key=ocsp-key.pem -db-config=db-config.json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:252 @ 04/04/23 18:33:37.548 < Exit [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:34:06.016 (41.33s) > Enter [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.016 < Exit [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.329 (312ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.329 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:13.238 (6.909s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:13.238 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:17.265 (4.027s) > Enter [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:17.265 < Exit [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:33.244 (15.979s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.244 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.413 (169ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:33.413 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:40.3 (6.887s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:40.3 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.318 (4.018s) > Enter [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:44.318 < Exit [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:54.489 (10.171s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.489 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.674 (185ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:54.674 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:01.542 (6.868s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:01.542 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:15.829 (14.287s) > Enter [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:15.829 < Exit [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:42.1 (26.271s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.1 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.298 (198ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.298 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:50.176 (7.878s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:50.176 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:54.197 (4.021s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:35:54.197 Apr 4 18:36:03.338: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:36:05.327 (11.13s) > Enter [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:05.327 < Exit [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:15.512 (10.185s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.512 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.744 (233ms) - - - > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:15.745 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:23.617 (7.872s) > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:23.617 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:27.64 (4.023s) > Enter [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:27.64 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:48 @ 04/04/23 18:36:37.807 < Exit [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:37.815 (10.175s) > Enter [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:37.815 < Exit [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:38.05 (235ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:38.05 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.936 (7.886s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:45.936 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:47.961 (2.026s) > Enter [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:47.961 < Exit [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:58.079 (10.118s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.079 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.306 (226ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:58.306 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:16.416 (2m18.11s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:16.416 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:20.463 (4.047s) > Enter [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:20.463 < Exit [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:49.668 (29.205s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.668 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.888 (220ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:49.888 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:57.8 (7.912s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:57.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:40:01.823 (4.023s) > Enter [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:01.823 Apr 4 18:40:10.971: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:12.979 (11.155s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:12.979 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:13.188 (209ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:13.188 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:21.087 (7.899s) > Enter [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:21.087 < Exit [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:31.585 (10.498s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.585 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.773 (188ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.773 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:38.672 (6.898s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:38.672 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:42.706 (4.034s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:42.706 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:56.901 (14.195s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.901 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.912 (10ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.912 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.097 (186ms) - - - I0404 18:04:54.427675 25 request.go:690] Waited for 1.19834838s due to client-side throttling, not priority and fairness, request: GET:https://10.96.0.1:443/api/v1/namespaces/e2e-tests-limit-connections-1680631459257336272-jn44f/services/nginx-ingress-controller - > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.817 (7.56s) > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:26.817 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:38.845 (12.028s) > Enter [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:04:38.845 < Exit [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:05:03.259 (24.414s) > Enter [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.259 < Exit [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.482 (224ms) - - - > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:03.483 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:10.366 (6.883s) > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:10.366 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:14.405 (4.039s) > Enter [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:14.405 < Exit [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:41.807 (27.402s) > Enter [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:41.807 < Exit [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:42.078 (271ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:42.079 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:50.08 (8.002s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:50.08 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:54.108 (4.028s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:05:54.108 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:06:21.53 (27.422s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.53 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.804 (274ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.804 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.705 (6.901s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:28.705 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:32.732 (4.027s) > Enter [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:32.732 < Exit [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:39.756 (7.024s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.756 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.957 (201ms) - - - > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:39.958 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:47.864 (7.907s) > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:47.864 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:51.912 (4.047s) > Enter [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:06:51.912 < Exit [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:07:02.086 (10.175s) > Enter [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.086 < Exit [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.297 (211ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:02.297 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:10.188 (7.891s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:10.188 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:14.226 (4.037s) > Enter [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:14.226 < Exit [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:25.018 (10.792s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.018 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.219 (201ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:25.22 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:33.104 (7.884s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:33.104 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:35.129 (2.025s) > Enter [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:35.129 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:61 @ 04/04/23 18:07:52.29 STEP: sending request from an explicitly denied IP address - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:69 @ 04/04/23 18:07:52.298 STEP: sending request from an implicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:77 @ 04/04/23 18:07:52.304 < Exit [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:59.326 (24.197s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.326 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.52 (194ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.52 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:06.412 (6.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:06.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:14.461 (8.049s) > Enter [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:14.461 < Exit [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:31.701 (17.24s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.701 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.909 (208ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:31.909 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:39.801 (7.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:39.801 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:43.836 (4.035s) > Enter [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:43.836 < Exit [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:54.106 (10.269s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.106 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.318 (212ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:54.318 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:01.207 (6.889s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:01.207 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:09.264 (8.058s) > Enter [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:09.264 STEP: routing requests to the mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:591 @ 04/04/23 18:09:26.43 < Exit [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:26.434 (17.169s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.434 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.658 (224ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:26.658 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:33.593 (6.935s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:33.593 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:37.637 (4.044s) > Enter [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:09:37.637 < Exit [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:10:02.989 (25.352s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:02.989 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.188 (199ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.189 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.089 (7.901s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:11.09 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:19.123 (8.033s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:10:29.295 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:10:39.491 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:49.631 (30.509s) > Enter [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:49.631 STEP: Adding a global-auth-method to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:202 @ 04/04/23 18:10:49.631 < Exit [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:59.844 (10.213s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:59.844 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:00.053 (208ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:00.053 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:17.888 (2m17.835s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:17.888 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:21.926 (4.038s) > Enter [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:21.926 < Exit [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:39.103 (17.177s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.103 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.316 (214ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:39.317 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:46.2 (6.883s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:46.2 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:51.228 (5.028s) > Enter [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:13:51.228 < Exit [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:14:01.351 (10.123s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.351 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.572 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:01.573 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:08.451 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:08.451 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:12.484 (4.033s) > Enter [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:12.484 < Exit [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:22.62 (10.136s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.62 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.8 (179ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:22.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:29.697 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:29.697 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:33.724 (4.026s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:33.724 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:43.071 (9.347s) > Enter [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:43.071 < Exit [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:50.277 (7.207s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.277 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.564 (287ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.566 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.791 (7.225s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:57.791 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:15:01.819 (4.028s) > Enter [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:01.819 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:94 @ 04/04/23 18:15:18.959 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:101 @ 04/04/23 18:15:21.991 < Exit [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:22.003 (20.184s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.003 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.173 (170ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.173 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:30.052 (7.879s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:30.052 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:32.076 (2.024s) > Enter [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:32.076 < Exit [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:42.292 (10.217s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.292 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.533 (240ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:42.533 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:49.463 (6.93s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:49.463 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:08.363 (18.9s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:08.363 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:11.514 (3.151s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.514 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.73 (216ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:11.73 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:18.612 (6.881s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:18.612 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:28.726 (10.115s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:16:38.887 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:16:49.114 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:59.322 (30.595s) > Enter [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:87 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:94 @ 04/04/23 18:16:59.333 < Exit [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.342 (20ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.342 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.57 (229ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:59.571 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:06.433 (6.862s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:06.433 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:18.505 (12.072s) > Enter [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:18.505 < Exit [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:28.675 (10.171s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.675 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.85 (174ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:28.85 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:37.72 (8.87s) > Enter [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:37.72 < Exit [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:40.919 (3.199s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:40.919 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:41.126 (207ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:41.126 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:49.014 (7.887s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:49.014 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:53.032 (4.018s) > Enter [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:17:53.032 Apr 4 18:18:09.269: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:18:11.272 (18.241s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.272 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.48 (208ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:11.48 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:18.335 (6.854s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:18.335 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:22.355 (4.02s) > Enter [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:22.355 < Exit [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:32.501 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.501 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.736 (236ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:32.737 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.632 (6.895s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:39.632 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:50.669 (11.037s) > Enter [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:18:50.669 < Exit [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:20:22.888 (1m32.219s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:22.888 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:23.276 (388ms) - - - > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:23.277 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:31.164 (7.887s) > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:31.164 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:33.226 (2.062s) > Enter [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:33.226 < Exit [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:43.402 (10.176s) > Enter [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.402 < Exit [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.603 (201ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:43.603 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:50.486 (6.883s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:50.486 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:54.514 (4.028s) > Enter [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:20:54.514 < Exit [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:21:04.738 (10.224s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.738 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.947 (209ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.947 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:11.835 (6.888s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:11.835 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:15.853 (4.017s) > Enter [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:15.853 < Exit [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:26.03 (10.178s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.03 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.226 (196ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.227 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.123 (7.896s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:34.123 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:38.158 (4.035s) > Enter [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:38.158 < Exit [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:48.595 (10.437s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.595 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.793 (198ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:48.794 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:50.797 (2.003s) > Enter [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:50.797 < Exit [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:59.838 (9.042s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.839 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.841 (3ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:59.842 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.232 (7.39s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:07.232 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:11.252 (4.02s) > Enter [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:11.252 < Exit [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:21.435 (10.182s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.435 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.724 (289ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.725 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:29.212 (7.488s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:29.212 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:33.245 (4.033s) > Enter [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:33.245 < Exit [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:40.278 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.278 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.502 (224ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:40.502 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:47.367 (6.865s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:47.368 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:51.389 (4.021s) > Enter [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:22:51.389 < Exit [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:23:06.598 (15.209s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.598 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.803 (205ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:06.804 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:13.683 (6.879s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:13.683 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:17.702 (4.019s) > Enter [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:17.702 < Exit [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:50.157 (32.455s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.157 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.365 (209ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.366 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:57.248 (6.882s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:23:57.248 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:24:06.308 (9.06s) > Enter [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:06.308 < Exit [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:16.602 (10.294s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.602 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.016 (414ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.016 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.558 (8.541s) > Enter [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:25.558 < Exit [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:42.749 (17.191s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.749 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.994 (245ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.994 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.859 (6.865s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:49.859 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:55.885 (6.025s) > Enter [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:24:55.885 < Exit [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:25:13.047 (17.162s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.047 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.223 (176ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 (0s) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:13.223 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:21.122 (7.899s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:21.122 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:27.151 (6.029s) > Enter [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:27.151 < Exit [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:34.17 (7.019s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.17 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.371 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:34.371 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:41.275 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:41.275 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:49.318 (8.044s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:25:59.469 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:26:09.647 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:26:19.839 (30.521s) > Enter [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:19.839 STEP: Adding a global-auth-snippet to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:254 @ 04/04/23 18:26:19.839 < Exit [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:29.995 (10.156s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.995 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:30.195 (200ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:30.195 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:37.066 (6.871s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:37.066 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:41.082 (4.015s) > Enter [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:41.082 < Exit [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:51.227 (10.145s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.227 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.453 (226ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:51.453 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:58.324 (6.87s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:26:58.324 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:02.348 (4.024s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:02.348 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:07.377 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:17.563 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:27.77 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:37.89 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:53.085 (50.737s) > Enter [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:27:53.085 STEP: receiving an internal server error without cache on location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:811 @ 04/04/23 18:28:00.105 < Exit [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:29:00.109 (1m7.024s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.109 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.314 (205ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:00.314 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:08.193 (7.878s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:08.193 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:10.222 (2.029s) > Enter [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:10.222 < Exit [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:20.442 (10.22s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.442 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.65 (208ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:20.651 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:27.592 (6.941s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:27.592 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:35.635 (8.044s) > Enter [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:35.635 < Exit [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:52.866 (17.23s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:52.866 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:53.101 (235ms) - - - > Enter [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:53.101 < Exit [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:00.998 (7.896s) > Enter [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:00.998 < Exit [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:11.215 (10.217s) > Enter [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.215 < Exit [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.436 (221ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:11.436 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:18.304 (6.868s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:18.304 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:22.331 (4.027s) > Enter [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:22.331 < Exit [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:39.546 (17.216s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.546 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.763 (217ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 (0s) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.763 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.146 (7.383s) > Enter [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:30:47.146 < Exit [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:32:47.648 (2m0.502s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.648 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.827 (179ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:47.827 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:04.512 (2m16.685s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:04.512 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:08.555 (4.042s) > Enter [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:08.555 < Exit [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:25.764 (17.209s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.764 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.96 (196ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.96 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:33.883 (7.923s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:33.883 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:37.911 (4.028s) > Enter [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:37.911 < Exit [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:57.93 (20.019s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:57.93 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:58.103 (173ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 (0s) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:58.104 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.96 (7.857s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:05.96 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:14.017 (8.056s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:36:24.203 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:36:34.361 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:44.521 (30.504s) > Enter [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:44.521 STEP: Adding a global-auth-signin to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:215 @ 04/04/23 18:36:44.521 < Exit [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:54.694 (10.173s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.694 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.922 (228ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.922 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:02.365 (7.443s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:02.365 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:08.389 (6.023s) > Enter [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:08.389 < Exit [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:25.61 (17.222s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.611 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.869 (258ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.869 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:32.759 (6.89s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:32.759 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:36.785 (4.026s) > Enter [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:36.785 < Exit [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:56.815 (20.03s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:56.815 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.041 (227ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 (0s) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.042 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.9 (7.858s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:04.9 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:15.932 (11.032s) > Enter [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:15.932 < Exit [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:26.137 (10.204s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.137 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.471 (334ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:26.471 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:33.322 (6.851s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:33.322 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:37.351 (4.029s) > Enter [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:38:37.351 < Exit [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:39:02.787 (25.436s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:02.787 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:03.018 (231ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:03.025 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:11.02 (7.995s) > Enter [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:11.02 < Exit [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:21.316 (10.296s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.316 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.504 (188ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.504 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.492 (7.988s) > Enter [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:29.492 < Exit [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:46.643 (17.151s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.643 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.835 (192ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:46.835 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:53.72 (6.885s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:39:53.72 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:01.768 (8.048s) > Enter [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:01.768 < Exit [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:57.335 (55.567s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.335 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.533 (198ms) - - - > Enter [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.249 < Exit [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.794 (7.545s) > Enter [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:04:26.794 Apr 4 18:04:26.794: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=0' Apr 4 18:04:49.019: INFO: waiting for leader election and initial status update Apr 4 18:05:29.033: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=42431' < Exit [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:05:39.069 (1m12.275s) > Enter [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.069 < Exit [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.293 (225ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.294 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.218 (6.925s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:46.218 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:50.239 (4.02s) > Enter [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:05:50.239 < Exit [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:06:00.422 (10.184s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.422 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.649 (227ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:00.649 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:07.542 (6.893s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:07.542 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:11.569 (4.027s) > Enter [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:11.569 < Exit [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:21.772 (10.203s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.772 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.963 (191ms) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.964 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.888 (6.924s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:28.888 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:39.938 (11.05s) > Enter [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:39.938 < Exit [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:50.151 (10.213s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.151 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.374 (223ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.375 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.307 (6.932s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:06:57.307 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:05.355 (8.048s) > Enter [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:05.355 STEP: routing requests destined for the mainline ingress to the maineline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:185 @ 04/04/23 18:07:22.519 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:195 @ 04/04/23 18:07:22.526 < Exit [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:22.534 (17.179s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.534 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.759 (225ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:22.759 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:29.671 (6.912s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:29.671 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:40.702 (11.031s) > Enter [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:40.702 < Exit [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:50.922 (10.22s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:50.922 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:51.164 (242ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:51.164 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.041 (7.877s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:07:59.041 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:08:03.067 (4.025s) > Enter [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:03.067 < Exit [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:20.253 (17.187s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.253 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.455 (201ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:20.455 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:27.83 (7.375s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:27.83 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:38.87 (11.04s) > Enter [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:38.87 < Exit [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:52.098 (13.228s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.098 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.323 (225ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:52.323 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:59.233 (6.909s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:59.233 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:09:03.258 (4.025s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:03.258 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:17.471 (14.213s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.471 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.477 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.477 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.663 (186ms) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:17.664 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:24.618 (6.955s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:24.618 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:37.752 (13.134s) > Enter [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:37.752 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:90 @ 04/04/23 18:09:44.916 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:96 @ 04/04/23 18:09:48.094 < Exit [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:50.119 (12.367s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.119 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.349 (230ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:50.349 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:57.22 (6.871s) > Enter [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:09:57.22 < Exit [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:10:11.466 (14.247s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.466 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.655 (189ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.655 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:18.528 (6.872s) > Enter [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:18.528 < Exit [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:28.683 (10.155s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.683 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.876 (193ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:28.876 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:35.756 (6.88s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:35.756 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:39.781 (4.025s) > Enter [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:39.781 < Exit [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:56.965 (17.184s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:56.965 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:57.186 (221ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 (0s) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:57.186 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:05.078 (7.892s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:05.078 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:09.104 (4.027s) > Enter [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:09.104 < Exit [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:22.32 (13.216s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.32 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.585 (265ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:22.585 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:29.564 (6.979s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:29.564 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:33.585 (4.021s) > Enter [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:33.585 < Exit [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:43.812 (10.227s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:43.812 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:44.056 (244ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:44.057 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:52.078 (8.021s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:52.078 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:54.141 (2.063s) > Enter [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:11:54.141 < Exit [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:12:23.359 (29.218s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.359 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.53 (171ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:23.53 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:30.423 (6.893s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:30.423 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:34.455 (4.032s) > Enter [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:34.455 < Exit [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:44.621 (10.166s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.621 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.832 (211ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:44.833 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:52.267 (7.434s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.267 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.272 (5ms) > Enter [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:52.272 < Exit [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:55.617 (3.345s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.617 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.87 (253ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:55.871 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.782 (6.911s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:02.782 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:06.807 (4.025s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:06.807 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:13:23.944 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:13:32.097 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:32.106 (25.299s) > Enter [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:32.106 < Exit [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:37.112 (5.005s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.112 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.281 (169ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.281 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:45.19 (7.908s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:45.19 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:49.209 (4.019s) > Enter [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:13:49.209 < Exit [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:14:06.443 (17.233s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.443 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.621 (178ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 (0s) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:06.621 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:13.543 (6.921s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:13.543 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:17.569 (4.026s) > Enter [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:17.569 < Exit [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:33.037 (15.469s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.037 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.234 (196ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:33.234 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:35.237 (2.003s) > Enter [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:14:35.237 < Exit [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:15:35.27 (1m0.034s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.27 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.272 (2ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:35.273 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:43.177 (7.905s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:43.177 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:45.196 (2.019s) > Enter [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:15:45.196 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:161 @ 04/04/23 18:15:45.196 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:165 @ 04/04/23 18:15:52.212 STEP: check that '/foo/bar/bar' does not match the longest exact path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:179 @ 04/04/23 18:16:02.371 < Exit [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:16:02.374 (17.178s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.374 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.58 (206ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:02.581 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:12.465 (9.885s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:12.465 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:16.495 (4.03s) > Enter [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:16.495 < Exit [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:33.975 (17.48s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:33.975 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:34.598 (623ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 (0s) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:34.603 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.474 (6.871s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:41.474 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:43.493 (2.019s) > Enter [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:16:43.493 < Exit [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:17:00.623 (17.13s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.623 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.822 (199ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:00.823 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:07.712 (6.89s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:07.712 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:18.751 (11.038s) > Enter [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:18.751 < Exit [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:28.957 (10.206s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.957 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:29.194 (237ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:29.195 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:39.14 (9.946s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:39.14 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:50.186 (11.045s) > Enter [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:17:50.186 < Exit [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:18:00.312 (10.127s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.312 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.496 (184ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:00.496 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.399 (6.903s) > Enter [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:07.399 < Exit [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:24.593 (17.194s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.593 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.792 (199ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:24.793 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:31.73 (6.937s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:31.73 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:35.753 (4.023s) > Enter [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:35.753 < Exit [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:45.94 (10.187s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:45.94 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:46.161 (221ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.161 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.022 (7.861s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:54.022 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:58.047 (4.025s) > Enter [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:18:58.047 < Exit [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:19:05.106 (7.059s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.106 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.287 (181ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:05.287 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:13.171 (7.884s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:13.171 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:17.198 (4.027s) > Enter [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:17.198 < Exit [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:34.328 (17.129s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.328 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.564 (236ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.564 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:42.455 (7.891s) > Enter [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:42.455 < Exit [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:52.995 (10.54s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.995 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:53.197 (202ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.198 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.144 (6.946s) > Enter [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:90 @ 04/04/23 18:20:00.144 < Exit [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.144 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.767 (622ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.767 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:09.884 (9.117s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:09.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:13.952 (4.068s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:13.952 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:28.231 (14.28s) > Enter [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:28.231 < Exit [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:32.452 (4.22s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.452 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.657 (205ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:32.657 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:39.572 (6.914s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:39.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:43.594 (4.022s) > Enter [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:20:43.594 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:114 @ 04/04/23 18:20:43.594 STEP: creating an ingress definition with the use-regex amd rewrite-target annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:123 @ 04/04/23 18:20:53.786 STEP: ensuring '/foo' matches '~* ^/foo' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:137 @ 04/04/23 18:21:03.945 STEP: ensuring '/foo/bar' matches '~* ^/foo.+' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:147 @ 04/04/23 18:21:03.953 < Exit [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:21:03.959 (20.365s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:03.959 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.173 (214ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.173 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:12.085 (7.912s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:12.085 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:16.104 (4.019s) > Enter [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:16.104 < Exit [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:27.134 (11.029s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.134 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.321 (187ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:27.321 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.238 (6.917s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:34.238 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:38.265 (4.026s) > Enter [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:38.265 < Exit [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:48.462 (10.197s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.462 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.677 (215ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:48.677 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:55.595 (6.918s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:55.595 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:59.616 (4.02s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:21:59.616 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:22:09.78 (10.165s) > Enter [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.78 < Exit [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.787 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.787 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:10.018 (231ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:10.018 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.91 (7.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:17.91 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:21.937 (4.027s) > Enter [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:21.937 < Exit [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:32.141 (10.205s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.141 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.312 (170ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.312 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:39.246 (6.934s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:39.246 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:43.274 (4.028s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:43.274 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:50.32 (7.047s) > Enter [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:22:50.32 < Exit [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:23:00.536 (10.216s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.536 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.771 (235ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:00.772 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:07.648 (6.876s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:07.648 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:18.858 (11.21s) > Enter [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:18.858 < Exit [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:30.073 (11.215s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.073 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.267 (194ms) - - - > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:30.267 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:37.168 (6.901s) > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:37.168 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:41.193 (4.024s) > Enter [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:41.193 < Exit [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:51.36 (10.167s) > Enter [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.36 < Exit [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.551 (192ms) - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:51.552 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:58.412 (6.86s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:23:58.412 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:24:02.44 (4.027s) > Enter [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:02.44 Apr 4 18:24:11.771: INFO: Connecting to github.com (140.82.113.4:443) Connecting to github.com (140.82.113.4:443) Connecting to raw.githubusercontent.com (185.199.108.133:443) saving to '/etc/nginx/geoip/GeoLite2-Country.mmdb' GeoLite2-Country.mmd 100%!|(MISSING)********************************| 17952 0:00:00 ETA '/etc/nginx/geoip/GeoLite2-Country.mmdb' saved < Exit [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:22.088 (19.648s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.088 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.674 (586ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.675 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.572 (7.897s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:30.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:34.603 (4.031s) > Enter [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:34.603 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:193 @ 04/04/23 18:24:34.603 STEP: check that '/foo/bar/bar' redirects to custom rewrite - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:206 @ 04/04/23 18:24:44.755 < Exit [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:44.757 (10.154s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.757 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.959 (202ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:44.96 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:53.864 (8.905s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:24:53.864 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:25:04.899 (11.035s) > Enter [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:04.899 < Exit [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:15.061 (10.162s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.061 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.316 (255ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:15.316 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:39.846 (24.53s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:39.846 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:47.041 (7.195s) > Enter [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:47.041 < Exit [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:59.374 (12.333s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.374 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.585 (211ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:59.585 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:06.445 (6.86s) > Enter [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:06.445 < Exit [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:20.681 (14.236s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.681 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.877 (196ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:20.877 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:27.751 (6.874s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:27.751 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:31.787 (4.036s) > Enter [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:31.787 < Exit [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:38.82 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:38.82 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:39.022 (203ms) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:39.023 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.929 (7.906s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:46.929 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:50.949 (4.02s) > Enter [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:26:50.949 < Exit [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:27:08.052 (17.103s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.052 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.24 (188ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:08.24 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:16.131 (7.891s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:16.131 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:27.187 (11.056s) > Enter [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:27.187 < Exit [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:37.411 (10.224s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.411 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.656 (245ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:37.657 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:44.535 (6.879s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:44.535 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:48.555 (4.02s) > Enter [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:48.555 < Exit [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:58.71 (10.155s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.71 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.954 (244ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:58.955 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:06.864 (7.909s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:06.864 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:10.897 (4.033s) > Enter [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:10.897 < Exit [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:17.933 (7.036s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:17.933 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:18.142 (209ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:18.142 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:26.105 (7.963s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:26.105 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:28.133 (2.028s) > Enter [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:28:28.133 < Exit [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:29:01.214 (33.081s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.214 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.431 (217ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:01.431 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:19.232 (2m17.801s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:19.232 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:23.279 (4.047s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:23.279 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:33.459 (10.18s) > Enter [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:33.459 < Exit [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:36.583 (3.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.583 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.807 (224ms) - - - > Enter [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:36.808 < Exit [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:43.735 (6.927s) > Enter [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX IP address - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:30 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX catch all server - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:45 @ 04/04/23 18:31:48.771 < Exit [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:48.798 (5.063s) > Enter [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:48.798 < Exit [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:49.002 (204ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:49.002 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.884 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:55.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:59.898 (4.014s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:31:59.898 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:04.919 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:15.067 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:25.279 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:35.453 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:32:50.643 (50.746s) > Enter [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:50.643 < Exit [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:57.666 (7.022s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.666 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.876 (210ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:57.876 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:04.793 (6.917s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:04.793 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:08.814 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:08.814 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:19.338 (10.524s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.338 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.552 (213ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:19.552 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:26.442 (6.89s) > Enter [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:26.442 < Exit [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:29.606 (3.164s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.606 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.78 (174ms) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.78 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.668 (6.887s) > Enter [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:36.668 < Exit [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:54.927 (18.259s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:54.927 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:55.127 (200ms) - - - > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:55.128 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:03.016 (7.888s) > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:03.016 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:07.036 (4.021s) > Enter [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:07.036 < Exit [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:24.255 (17.219s) > Enter [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.255 < Exit [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.485 (230ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:24.485 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:31.385 (6.9s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:31.385 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:35.427 (4.042s) > Enter [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:35.427 < Exit [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:45.603 (10.176s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.603 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.78 (178ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.781 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:52.66 (6.879s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:52.66 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:56.689 (4.029s) > Enter [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:34:56.689 < Exit [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:35:13.844 (17.155s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:13.844 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:14.078 (234ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 (0s) - - - > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:14.078 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:22.011 (7.933s) > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:22.011 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:38.056 (16.045s) > Enter [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:38.056 < Exit [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:59.417 (21.362s) > Enter [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.417 < Exit [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.632 (215ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:59.632 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:06.509 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:06.509 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:10.532 (4.023s) > Enter [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:10.532 < Exit [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:30.574 (20.042s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.574 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.81 (237ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 (0s) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:30.811 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:37.689 (6.878s) > Enter [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:37.689 < Exit [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:51.912 (14.223s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:51.912 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:52.088 (176ms) - - - > Enter [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.088 < Exit [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:59.999 (7.911s) > Enter [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:36:59.999 < Exit [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:37:10.187 (10.188s) > Enter [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.187 < Exit [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.413 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.413 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.279 (6.866s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:17.279 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:21.337 (4.058s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:21.337 STEP: routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:557 @ 04/04/23 18:37:38.545 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:38.552 (17.215s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.552 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.772 (219ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:38.772 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:45.664 (6.892s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:45.664 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:49.681 (4.017s) > Enter [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:37:49.681 < Exit [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:38:15.087 (25.406s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.087 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.266 (179ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.266 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:23.144 (7.877s) > Enter [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:23.144 < Exit [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:39.406 (16.262s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.406 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.613 (207ms) - - - > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:39.613 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:46.507 (6.894s) > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:46.507 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:50.531 (4.023s) > Enter [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:38:50.531 STEP: regenerating the correct configuration after update - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:65 @ 04/04/23 18:39:12.735 < Exit [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:39:23.972 (33.441s) > Enter [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:23.972 < Exit [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:24.525 (553ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:24.526 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:32.928 (8.402s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:32.928 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:36.954 (4.026s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:39:36.954 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:40:09.289 (32.335s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.289 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.487 (198ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:09.487 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:16.38 (6.893s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:16.38 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:20.419 (4.039s) > Enter [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:20.419 < Exit [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:30.626 (10.207s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.626 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.822 (196ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:30.822 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:37.735 (6.913s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:37.735 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:41.759 (4.024s) > Enter [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:41.759 < Exit [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:58.984 (17.225s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:58.984 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:59.238 (254ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.257 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.759 (7.502s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:26.759 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:38.804 (12.045s) > Enter [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:38.804 < Exit [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:49.017 (10.213s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.017 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.223 (207ms) - - - > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:49.225 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:57.104 (7.879s) > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:04:57.104 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:05:01.132 (4.029s) > Enter [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:01.132 STEP: setting an ingress with a nil backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:39 @ 04/04/23 18:05:01.132 < Exit [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:18.375 (17.242s) > Enter [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.375 < Exit [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.574 (200ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:18.575 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:25.47 (6.895s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:25.47 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:29.501 (4.031s) > Enter [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:29.501 < Exit [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:39.685 (10.184s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.685 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.886 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.886 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.798 (6.912s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:46.798 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:57.853 (11.055s) > Enter [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:05:57.853 < Exit [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:06:08.065 (10.213s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.065 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.304 (239ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:08.304 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:15.196 (6.891s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:15.196 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:19.22 (4.024s) > Enter [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:19.22 < Exit [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:36.431 (17.211s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.431 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.678 (246ms) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:36.678 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:43.562 (6.884s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:43.562 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:47.588 (4.026s) > Enter [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:06:47.588 < Exit [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:07:04.782 (17.194s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.782 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.961 (179ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:04.961 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:12.853 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:12.853 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:20.912 (8.059s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:20.912 STEP: routing requests to the canary upstream when header is set to 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:451 @ 04/04/23 18:07:38.088 STEP: routing requests to the mainline upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:460 @ 04/04/23 18:07:38.092 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:469 @ 04/04/23 18:07:38.097 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:478 @ 04/04/23 18:07:38.101 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:38.105 (17.192s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.312 (208ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.313 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.57 (7.258s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:45.57 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:49.597 (4.027s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:07:49.597 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:08:17.835 (28.238s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:17.835 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:29.028 (11.193s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.028 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.254 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:29.254 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:37.146 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:37.146 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:45.193 (8.047s) > Enter [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:08:45.193 STEP: routing requests destined for the mainline ingress to the mainelin upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:231 @ 04/04/23 18:09:02.324 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:240 @ 04/04/23 18:09:02.332 < Exit [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:09:02.337 (17.144s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.337 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.545 (208ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:02.545 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:09.432 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:09.432 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:13.454 (4.022s) > Enter [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:13.454 < Exit [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:23.682 (10.227s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.682 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.867 (185ms) - - - > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:23.867 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:41.632 (2m17.765s) > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:41.632 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:45.686 (4.054s) > Enter [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:11:45.686 STEP: generating correct defaults - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:43 @ 04/04/23 18:11:52.711 STEP: applying customizations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:61 @ 04/04/23 18:11:55.865 < Exit [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:12:06.074 (20.388s) > Enter [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.074 < Exit [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.248 (175ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:06.248 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:13.645 (7.397s) > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:13.645 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:24.689 (11.044s) > Enter [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:24.689 Apr 4 18:12:39.085: INFO: Request distribution: map[echo-7b6bf466cc-4gqhv:16 echo-7b6bf466cc-kbjqx:9 echo-7b6bf466cc-scqj9:5] < Exit [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:39.085 (14.396s) > Enter [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.085 < Exit [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.295 (210ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:39.295 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.18 (7.884s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.18 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.204 (4.024s) > Enter [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:12:51.204 < Exit [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:13:01.392 (10.189s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.392 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.572 (180ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:01.573 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:08.45 (6.878s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:08.45 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:16.493 (8.042s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:16.493 < Exit [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:42.089 (25.596s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.089 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.311 (222ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:42.312 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.227 (6.915s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:49.227 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:14:00.268 (11.041s) > Enter [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:00.268 < Exit [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:10.406 (10.138s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.406 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.583 (177ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.584 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.985 (7.402s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:17.985 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:22.015 (4.03s) > Enter [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:22.015 < Exit [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:32.238 (10.222s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.238 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.409 (172ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.41 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.329 (7.92s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:40.329 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:51.355 (11.026s) > Enter [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:14:51.356 < Exit [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:15:01.513 (10.157s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.513 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.717 (204ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.717 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:08.628 (6.911s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:08.628 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:12.654 (4.026s) > Enter [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:12.654 < Exit [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:22.863 (10.21s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.863 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:23.117 (253ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:23.117 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:31.017 (7.9s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:31.017 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:35.052 (4.035s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:35.052 STEP: routing requests to the canary upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:395 @ 04/04/23 18:15:52.235 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:404 @ 04/04/23 18:15:52.237 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:414 @ 04/04/23 18:15:52.239 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:52.24 (17.188s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.24 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.427 (187ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:52.428 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.303 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:59.303 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:16:03.326 (4.022s) > Enter [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:03.326 < Exit [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:20.959 (17.634s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.959 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:22.171 (1.211s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 (0s) - - - > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:22.172 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.372 (9.2s) > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:31.372 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:35.41 (4.038s) > Enter [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:35.41 < Exit [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:49.822 (14.412s) > Enter [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:49.822 < Exit [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:50.037 (215ms) - - - > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.037 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:57.908 (7.87s) > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:16:57.908 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:17:01.931 (4.024s) > Enter [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:01.931 < Exit [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:24.158 (22.227s) > Enter [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.158 < Exit [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.349 (191ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:24.35 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:31.239 (6.889s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:31.239 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:39.264 (8.025s) > Enter [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:17:39.264 < Exit [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:18:09.666 (30.402s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.666 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.903 (237ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:09.904 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:16.786 (6.882s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:16.786 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:20.804 (4.018s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:20.804 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:35.029 (14.226s) > Enter [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:35.029 < Exit [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:41.107 (6.078s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.107 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.32 (212ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:41.32 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:49.195 (7.875s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:49.195 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:53.217 (4.022s) > Enter [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:18:53.217 < Exit [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:19:04.077 (10.86s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.077 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.257 (181ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:04.258 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:12.153 (7.895s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:12.153 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:16.174 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:16.174 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:27.319 (11.146s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.32 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.668 (348ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:27.668 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.827 (7.159s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:34.827 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:38.85 (4.023s) > Enter [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:38.85 < Exit [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:49.066 (10.216s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.066 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.312 (246ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:49.312 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:57.192 (7.879s) > Enter [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:19:57.192 < Exit [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:20:12.695 (15.504s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.695 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.536 (840ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.536 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.628 (7.092s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:20.628 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:28.704 (8.077s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:20:38.882 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:20:49.057 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:59.272 (30.567s) > Enter [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:20:59.272 STEP: Adding a global-auth-request-redirect to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:242 @ 04/04/23 18:20:59.272 < Exit [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:21:09.45 (10.178s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.45 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.625 (175ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:09.625 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:16.495 (6.87s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:16.495 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:20.516 (4.021s) > Enter [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:20.516 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:113 @ 04/04/23 18:21:37.731 STEP: checking if the Service Cluster IP and Port are not used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:120 @ 04/04/23 18:21:37.737 < Exit [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:37.9 (17.384s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:37.9 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:38.126 (226ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:38.126 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:46.024 (7.897s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:46.024 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:50.044 (4.02s) > Enter [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:21:50.044 < Exit [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:22:00.233 (10.189s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.233 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.414 (181ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:00.414 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.306 (6.892s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:07.306 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:18.341 (11.035s) > Enter [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:18.341 < Exit [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:21.446 (3.105s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.446 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.733 (287ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.733 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:39.876 (2m18.143s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:39.876 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:47.956 (8.08s) > Enter [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:24:47.956 STEP: routing requests destined fro the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:288 @ 04/04/23 18:25:09.571 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:297 @ 04/04/23 18:25:09.578 < Exit [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:25:09.586 (21.629s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.586 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.787 (201ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:09.787 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:16.668 (6.881s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:16.668 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:24.696 (8.028s) > Enter [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:24.696 < Exit [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:55.101 (30.405s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.101 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.343 (242ms) - - - > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:55.344 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:02.277 (6.934s) > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:02.277 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:06.299 (4.021s) > Enter [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:06.299 < Exit [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:19.516 (13.217s) > Enter [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.516 < Exit [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.717 (201ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:19.718 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:26.668 (6.951s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:26.668 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:30.695 (4.027s) > Enter [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:26:30.695 < Exit [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:27:02.982 (32.287s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:02.982 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.156 (175ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:03.157 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:11.021 (7.864s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:11.021 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:15.049 (4.028s) > Enter [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:15.049 < Exit [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:25.315 (10.266s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.315 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.546 (231ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:25.547 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:32.464 (6.917s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:32.464 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:36.484 (4.02s) > Enter [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:36.484 < Exit [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:43.52 (7.037s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.52 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.695 (175ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:43.696 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.592 (6.896s) > Enter [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:27:50.592 < Exit [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:28:00.821 (10.229s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:00.821 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:01.043 (221ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:01.043 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:08.918 (7.875s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:08.918 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:12.942 (4.024s) > Enter [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:12.942 < Exit [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:31.293 (18.352s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.293 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.512 (218ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:31.512 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:38.394 (6.882s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:38.394 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:46.454 (8.06s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:28:56.618 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:29:06.764 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:29:16.991 (30.537s) > Enter [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:16.991 STEP: Adding an ingress rule for /bar with annotation enable-global-auth = false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:128 @ 04/04/23 18:29:16.991 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:140 @ 04/04/23 18:29:21.174 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:147 @ 04/04/23 18:29:21.184 < Exit [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:21.191 (4.2s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.191 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.411 (220ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:21.411 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:28.853 (7.441s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:28.853 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:43.082 (14.23s) > Enter [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:43.082 < Exit [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:49.435 (6.352s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.435 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.619 (185ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:49.62 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.496 (6.875s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:29:56.496 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:30:00.515 (4.019s) > Enter [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:00.515 < Exit [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:17.68 (17.166s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.68 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.86 (179ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.86 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:24.767 (6.907s) > Enter [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:24.767 < Exit [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:38.985 (14.218s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:38.985 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.203 (218ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.204 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.098 (7.895s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:47.098 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:51.122 (4.023s) > Enter [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:30:51.122 < Exit [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:31:01.391 (10.269s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.391 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.582 (191ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:01.582 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:08.498 (6.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:08.498 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:16.564 (8.066s) > Enter [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:16.564 < Exit [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:33.8 (17.236s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:33.8 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:34.042 (242ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:34.042 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:40.946 (6.904s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:40.946 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:44.981 (4.035s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:44.981 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:53 @ 04/04/23 18:31:55.094 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:60 @ 04/04/23 18:31:55.098 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:55.252 (10.271s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.252 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.492 (240ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.493 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:02.366 (6.874s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:02.366 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:06.394 (4.028s) > Enter [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:06.394 < Exit [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:35.569 (29.175s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.569 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.753 (184ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.753 < Exit [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.66 (6.907s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.66 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:53 @ 04/04/23 18:32:42.661 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.661 (1ms) > Enter [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.661 < Exit [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.858 (197ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.858 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:49.722 (6.864s) > Enter [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:49.722 STEP: setting permanent-redirect-code annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:62 @ 04/04/23 18:32:49.722 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:82 @ 04/04/23 18:32:59.899 < Exit [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:59.901 (10.18s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:59.901 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:00.105 (203ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.105 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:07.991 (7.886s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:07.991 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:19.06 (11.069s) > Enter [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:19.06 < Exit [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:29.206 (10.146s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.206 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.433 (227ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.433 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.312 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:36.312 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:42.335 (6.023s) > Enter [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:42.335 < Exit [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:49.381 (7.046s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.381 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.571 (190ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:49.571 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:56.527 (6.956s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:33:56.527 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:00.557 (4.03s) > Enter [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:00.557 < Exit [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:22.694 (22.137s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.694 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.91 (216ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:22.91 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:29.807 (6.897s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.807 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.814 (6ms) > Enter [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:29.814 < Exit [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:36.97 (7.156s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.97 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:37.169 (200ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:37.17 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.073 (7.903s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:45.073 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:49.091 (4.018s) > Enter [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:34:49.091 < Exit [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:35:18.316 (29.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.316 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.518 (202ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:18.518 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.408 (6.889s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:25.408 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:36.46 (11.052s) > Enter [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:36.46 < Exit [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:39.652 (3.192s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.652 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.91 (258ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:39.91 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:46.843 (6.933s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:46.843 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:50.861 (4.018s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:50.861 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:58.882 (8.021s) > Enter [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:35:58.882 < Exit [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:36:09.027 (10.145s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.027 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.241 (213ms) - - - > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:09.241 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.143 (7.901s) > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:17.143 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:21.166 (4.023s) > Enter [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:21.166 < Exit [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:31.412 (10.246s) > Enter [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:31.412 < Exit [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:32.055 (644ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:32.057 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:39.923 (7.865s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:39.923 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:43.949 (4.026s) > Enter [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:43.949 < Exit [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:54.141 (10.192s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.141 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.342 (200ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.342 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:01.212 (6.87s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:01.212 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:07.231 (6.019s) > Enter [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:07.231 < Exit [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:17.855 (10.625s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:17.855 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:18.076 (221ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:18.076 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.984 (7.907s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:25.984 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:30.003 (4.019s) > Enter [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:30.003 < Exit [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:40.203 (10.201s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.203 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.453 (250ms) - - - > Enter [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:40.453 < Exit [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:47.317 (6.864s) > Enter [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:47.317 < Exit [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:57.514 (10.197s) > Enter [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.514 < Exit [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.725 (211ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.725 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.608 (6.883s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:04.608 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:08.636 (4.028s) > Enter [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:08.636 < Exit [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:20.58 (11.945s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.58 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.761 (181ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:20.762 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:27.757 (6.995s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:27.757 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:31.784 (4.027s) > Enter [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:31.784 < Exit [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:41.901 (10.118s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:41.901 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:42.108 (207ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:42.108 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:50.04 (7.932s) > Enter [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:50.04 < Exit [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:53.238 (3.198s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.238 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.443 (205ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:53.443 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.319 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:00.319 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:04.344 (4.026s) > Enter [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:04.344 < Exit [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:21.438 (17.094s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.438 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.668 (229ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 (0s) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.67 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.901 (8.232s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:29.901 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:40.966 (11.065s) > Enter [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:40.966 < Exit [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:55.23 (14.264s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.23 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.411 (181ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:55.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.291 (7.88s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:03.291 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:11.34 (8.049s) > Enter [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:11.34 < Exit [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:31.758 (20.417s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.758 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.95 (192ms) - - - > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.951 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.859 (7.909s) > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:39.859 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:47.913 (8.054s) > Enter [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:40:47.913 < Exit [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:41:01.214 (13.301s) > Enter [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.214 < Exit [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.409 (195ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.796 (8.54s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:27.796 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:39.83 (12.034s) > Enter [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:39.83 < Exit [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:46.871 (7.041s) > Enter [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:04:46.871 < Exit [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:05:04.134 (17.262s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.134 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.398 (264ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.398 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.399 (7.001s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:11.399 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:15.426 (4.027s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:15.426 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:82 @ 04/04/23 18:05:32.603 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:89 @ 04/04/23 18:05:32.612 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:32.783 (17.357s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.783 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.966 (182ms) - - - > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:32.966 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:40.858 (7.892s) > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:40.858 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:52.924 (12.066s) > Enter [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:05:52.924 < Exit [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:06:13.273 (20.349s) > Enter [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.273 < Exit [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.49 (217ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:13.49 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:20.419 (6.929s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:20.419 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:24.447 (4.029s) > Enter [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:24.447 < Exit [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:41.792 (17.345s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.792 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.98 (187ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:41.98 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:49.854 (7.874s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:06:49.854 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:07:00.907 (11.052s) > Enter [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:00.907 < Exit [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:11.072 (10.166s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.073 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.276 (203ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.277 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:19.172 (7.895s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:19.172 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:28.212 (9.04s) > Enter [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:28.212 < Exit [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:38.38 (10.168s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.38 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.612 (232ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.613 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.664 (7.051s) > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:45.664 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:49.689 (4.025s) > Enter [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:07:49.689 < Exit [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:08:07.048 (17.358s) > Enter [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.048 < Exit [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.227 (180ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:07.228 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:25.86 (2m18.633s) > Enter [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:25.86 < Exit [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:44.166 (18.305s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.166 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.384 (218ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:44.385 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:51.27 (6.885s) > Enter [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:10:51.27 STEP: checking the service is updated to use eu.httpbin.org - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:304 @ 04/04/23 18:11:06.958 < Exit [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:11:07.097 (15.827s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.097 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.302 (205ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:07.302 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:15.212 (7.91s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:15.212 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:19.237 (4.025s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:19.237 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:30.15 (10.913s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.15 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.361 (211ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:30.361 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:37.259 (6.898s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:37.259 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:39.287 (2.028s) > Enter [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:39.287 < Exit [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:49.482 (10.195s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.482 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.703 (222ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:49.704 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.672 (6.968s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:11:56.672 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:12:07.713 (11.041s) > Enter [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:07.713 < Exit [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:17.909 (10.196s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:17.909 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:18.149 (239ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:18.149 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:26.102 (7.953s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:26.102 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:34.143 (8.041s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:34.143 STEP: routing requests to the canary upstream when header value does not match and cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:630 @ 04/04/23 18:12:51.301 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:51.309 (17.166s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.309 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.494 (185ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:51.494 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.391 (6.897s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:12:58.391 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:13:02.411 (4.02s) > Enter [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:02.411 < Exit [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:31.674 (29.262s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.674 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.873 (199ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:31.874 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:38.753 (6.879s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:38.753 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:48.95 (10.197s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:48.95 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:49.177 (226ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.177 < Exit [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.081 (7.904s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.081 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:56 @ 04/04/23 18:13:57.084 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.084 (2ms) > Enter [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.084 < Exit [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.316 (232ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.316 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:04.203 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:04.203 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:08.231 (4.028s) > Enter [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:08.231 < Exit [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:30.484 (22.253s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.484 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.708 (223ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:30.708 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:37.628 (6.92s) > Enter [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:14:37.628 < Exit [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:15:00.832 (23.203s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:00.832 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.031 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.031 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:07.953 (6.922s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:07.953 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:11.978 (4.025s) > Enter [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:11.978 < Exit [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:26.888 (14.91s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:26.888 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:27.083 (195ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:27.083 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:34.978 (7.895s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:34.978 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:39.01 (4.032s) > Enter [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:39.01 < Exit [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:59.042 (20.032s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.042 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.301 (259ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 (0s) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.302 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.324 (7.022s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:06.324 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:10.352 (4.028s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:10.352 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:16:28.235 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:16:36.64 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:36.649 (26.297s) > Enter [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:36.649 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:229 @ 04/04/23 18:16:41.653 < Exit [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:41.686 (5.038s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.686 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.905 (219ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.905 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:48.792 (6.887s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:48.792 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:59.851 (11.059s) > Enter [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:16:59.851 < Exit [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:17:17.088 (17.237s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.088 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.268 (179ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:17.268 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:25.143 (7.875s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:25.143 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:39.338 (14.195s) > Enter [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:39.338 < Exit [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:45.709 (6.371s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.709 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.895 (186ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:45.896 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:52.77 (6.874s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:17:52.77 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:18:00.824 (8.054s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:00.824 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:29.039 (28.216s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.039 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.048 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.048 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.27 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:29.27 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:36.638 (7.367s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:36.638 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:40.656 (4.018s) > Enter [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:40.656 < Exit [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:47.695 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.695 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.919 (224ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:47.919 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.793 (6.873s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:54.793 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:58.818 (4.026s) > Enter [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:18:58.818 < Exit [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:19:28.082 (29.263s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.082 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.561 (479ms) - - - > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.561 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:36.485 (7.924s) > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:36.485 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:40.514 (4.029s) > Enter [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:40.514 < Exit [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:50.715 (10.201s) > Enter [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.715 < Exit [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.928 (213ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:50.928 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.376 (8.447s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:19:59.376 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:03.412 (4.036s) > Enter [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:03.412 < Exit [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:13.859 (10.448s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.859 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:15.468 (1.608s) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:15.468 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.896 (2m17.428s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.896 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.905 (9ms) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:32.905 STEP: setting up a first deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:171 @ 04/04/23 18:22:32.905 STEP: updating the tcp service to a second deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:196 @ 04/04/23 18:22:40.099 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:50.31 (17.405s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.31 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.534 (224ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:50.534 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:57.402 (6.868s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:57.402 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:23:01.417 (4.015s) > Enter [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:01.417 < Exit [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:08.429 (7.012s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.429 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.611 (182ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:08.611 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:15.499 (6.888s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:15.499 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:19.526 (4.026s) > Enter [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:19.526 < Exit [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:29.716 (10.19s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.716 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.948 (233ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:29.949 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:36.837 (6.888s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:36.837 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:40.864 (4.027s) > Enter [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:40.864 < Exit [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:51.976 (11.112s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.976 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:52.182 (206ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:52.183 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:00.596 (8.414s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:00.596 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:04.625 (4.028s) > Enter [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:04.625 < Exit [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:21.864 (17.239s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:21.864 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.288 (424ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.289 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.179 (7.89s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:30.179 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:32.201 (2.022s) > Enter [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:32.201 < Exit [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:42.391 (10.19s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.391 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.559 (169ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.559 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.462 (6.902s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:49.462 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:55.483 (6.021s) > Enter [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:24:55.483 < Exit [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:25:05.677 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.677 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.892 (215ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:05.892 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:12.767 (6.875s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:12.767 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:22.853 (10.086s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:22.853 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:23.038 (186ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:23.039 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:30.928 (7.889s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:30.928 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:34.955 (4.027s) > Enter [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:34.955 < Exit [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:45.122 (10.167s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.122 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.378 (256ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:45.378 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:52.259 (6.88s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:52.259 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:56.284 (4.026s) > Enter [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:25:56.284 < Exit [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:26:05.326 (9.041s) > Enter [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:05.326 < Exit [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:29.579 (24.254s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.579 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.795 (215ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:29.795 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:36.671 (6.876s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:36.671 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:40.694 (4.023s) > Enter [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:40.694 < Exit [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:47.715 (7.021s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.715 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.897 (182ms) - - - > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.898 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:54.79 (6.892s) > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:54.79 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:58.813 (4.023s) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:26:58.813 STEP: adding a whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:42 @ 04/04/23 18:27:05.828 STEP: changing error-log-level - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:61 @ 04/04/23 18:27:16.071 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:27:29.359 (30.546s) > Enter [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.359 < Exit [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.558 (198ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:29.558 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36.431 (6.873s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:36.431 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:47.466 (11.035s) > Enter [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:47.466 < Exit [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:57.638 (10.172s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.638 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.835 (197ms) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:57.835 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.708 (6.873s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:04.708 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:20.208 (15.5s) > Enter [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:20.208 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:68 @ 04/04/23 18:28:27.228 STEP: making sure new ingress is responding - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:74 @ 04/04/23 18:28:30.423 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:76 @ 04/04/23 18:28:30.423 < Exit [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:32.435 (12.227s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.435 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.615 (181ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:32.616 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:39.497 (6.882s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:39.497 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:49.668 (10.171s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.669 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.884 (215ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:49.884 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:56.783 (6.899s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:28:56.783 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:00.81 (4.027s) > Enter [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:00.81 < Exit [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:10.998 (10.189s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:10.998 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:11.21 (212ms) - - - > Enter [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:11.211 < Exit [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:19.1 (7.89s) > Enter [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:29:19.1 < Exit [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:30:30.168 (1m11.068s) > Enter [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.168 < Exit [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.345 (177ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:30.345 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:37.278 (6.932s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:37.278 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:41.303 (4.025s) > Enter [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:41.303 < Exit [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:51.481 (10.178s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.481 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.683 (202ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:51.684 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:58.618 (6.934s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:30:58.618 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:31:09.663 (11.045s) > Enter [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:31:09.663 Automatically polling progress: [Setting] use-proxy-protocol should enable PROXY Protocol for TCP (Spec Runtime: 3m17.98s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 In [It] (Node Runtime: 3m0.001s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 Spec Goroutine goroutine 2932 [IO wait, 3 minutes] internal/poll.runtime_pollWait(0x7f9e883a91b8, 0x72) /usr/local/go/src/runtime/netpoll.go:306 internal/poll.(*pollDesc).wait(0xc0000de300?, 0xc00098a926?, 0x0) /usr/local/go/src/internal/poll/fd_poll_runtime.go:84 internal/poll.(*pollDesc).waitRead(...) /usr/local/go/src/internal/poll/fd_poll_runtime.go:89 internal/poll.(*FD).Read(0xc0000de300, {0xc00098a926, 0x15a, 0x15a}) /usr/local/go/src/internal/poll/fd_unix.go:167 net.(*netFD).Read(0xc0000de300, {0xc00098a926?, 0x453656?, 0x380?}) /usr/local/go/src/net/fd_posix.go:55 net.(*conn).Read(0xc000516660, {0xc00098a926?, 0x19913c0?, 0xc00098a700?}) /usr/local/go/src/net/net.go:183 io.ReadAll({0x1f62de0, 0xc000516660}) /usr/local/go/src/io/io.go:701 > k8s.io/ingress-nginx/test/e2e/settings.glob..func38.5() /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:211 github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0xa0558e, 0xc000300a80}) /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3() /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:850 < Exit [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:41:24.726 (10m15.064s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.726 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.943 (217ms) + + > Enter [BeforeEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 17:53:35.472 < Exit [BeforeEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 17:53:42.61 (7.137s) > Enter [BeforeEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/cgroups/cgroups_linux.go:37 @ 07/16/23 17:53:42.61 < Exit [BeforeEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/cgroups/cgroups_linux.go:37 @ 07/16/23 17:53:54.745 (12.135s) > Enter [It] detects if cgroups is avaliable - /go/src/k8s.io/ingress-nginx/test/e2e/cgroups/cgroups_linux.go:42 @ 07/16/23 17:53:54.745 < Exit [It] detects if cgroups is avaliable - /go/src/k8s.io/ingress-nginx/test/e2e/cgroups/cgroups_linux.go:42 @ 07/16/23 17:53:54.745 (0s) > Enter [AfterEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 17:53:54.745 < Exit [AfterEach] [CGroups] cgroups - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 17:53:55.145 (400ms) \ No newline at end of file From 0f4d054c0766cacc3e4fde487f8ac0439f1cd0ac Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Jul 2023 23:47:43 -0400 Subject: [PATCH 279/822] gofmt --- pkg/util/runtime/cpu_notlinux.go | 2 +- test/e2e/cgroups/cgroups_linux.go | 30 +++++++++++++++--------------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 0441af957..2a1b48252 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -26,4 +26,4 @@ import ( // NumCPU ... func NumCPU() int { return runtime.NumCPU() -} \ No newline at end of file +} diff --git a/test/e2e/cgroups/cgroups_linux.go b/test/e2e/cgroups/cgroups_linux.go index 76a18407d..00d077b2b 100644 --- a/test/e2e/cgroups/cgroups_linux.go +++ b/test/e2e/cgroups/cgroups_linux.go @@ -28,8 +28,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" - "path/filepath" "k8s.io/ingress-nginx/pkg/util/runtime" + "path/filepath" libcontainercgroups "github.com/opencontainers/runc/libcontainer/cgroups" ) @@ -48,29 +48,29 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { log.Fatal(err) } - quotaFile, err := os.Create(filepath.Join(cgroupPath,"cpu.cfs_quota_us")) + quotaFile, err := os.Create(filepath.Join(cgroupPath, "cpu.cfs_quota_us")) if err != nil { log.Fatal(err) } - periodFile, err := os.Create(filepath.Join(cgroupPath,"cpu.cfs_period_us")) + periodFile, err := os.Create(filepath.Join(cgroupPath, "cpu.cfs_period_us")) if err != nil { log.Fatal(err) } - quotaFile.WriteString("4"); - quotaFile.Sync(); + quotaFile.WriteString("4") + quotaFile.Sync() - periodFile.WriteString("2"); - periodFile.Sync(); - - assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(1)) + periodFile.WriteString("2") + periodFile.Sync() + + assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(1)) assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), 2) - os.Remove(filepath.Join(cgroupPath,"cpu.cfs_quota_us")) - os.Remove(filepath.Join(cgroupPath,"cpu.cfs_period_us")) + os.Remove(filepath.Join(cgroupPath, "cpu.cfs_quota_us")) + os.Remove(filepath.Join(cgroupPath, "cpu.cfs_period_us")) }) ginkgo.It("detect cgroups version v2", func() { @@ -85,10 +85,10 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { log.Fatal(err) } - file.WriteString("4 2"); - file.Sync(); - - assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(2)) + file.WriteString("4 2") + file.Sync() + + assert.Equal(ginkgo.GinkgoT(), runtime.GetCgroupVersion(), int64(2)) assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), 2) os.Remove("/sys/fs/cgroup/cpu.max") From b270b4a8bf108dd210b209b1babb61a6bf5b840d Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Jul 2023 23:53:42 -0400 Subject: [PATCH 280/822] remove build flags and rename cgroups_linux.go --- .../cgroups/{cgroups_linux.go => cgroups.go} | 3 - test/e2e/e2e.go | 1 + test/junitreports/report-e2e-test-suite.xml | 1311 +++++++++++++++++ 3 files changed, 1312 insertions(+), 3 deletions(-) rename test/e2e/cgroups/{cgroups_linux.go => cgroups.go} (98%) create mode 100644 test/junitreports/report-e2e-test-suite.xml diff --git a/test/e2e/cgroups/cgroups_linux.go b/test/e2e/cgroups/cgroups.go similarity index 98% rename from test/e2e/cgroups/cgroups_linux.go rename to test/e2e/cgroups/cgroups.go index 00d077b2b..6ad8558df 100644 --- a/test/e2e/cgroups/cgroups_linux.go +++ b/test/e2e/cgroups/cgroups.go @@ -1,6 +1,3 @@ -//go:build linux -// +build linux - /* Copyright 2020 The Kubernetes Authors. diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 57b047230..6a9cb21f8 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -49,6 +49,7 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/ssl" _ "k8s.io/ingress-nginx/test/e2e/status" _ "k8s.io/ingress-nginx/test/e2e/tcpudp" + _ "k8s.io/ingress-nginx/test/e2e/cgroups" ) // RunE2ETests checks configuration parameters (specified through flags) and then runs diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml new file mode 100644 index 000000000..43f6f3233 --- /dev/null +++ b/test/junitreports/report-e2e-test-suite.xml @@ -0,0 +1,1311 @@ + + + + + + + + + + + + + + + + + + + + + + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.215 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:47.677 (13.462s) > Enter [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 07/16/23 23:07:47.677 < Exit [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 07/16/23 23:08:11.636 (23.993s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:11.636 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:12.72 (1.084s) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:12.728 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:26.952 (14.224s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:08:26.952 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:08:40.053 (13.136s) > Enter [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 07/16/23 23:08:40.053 < Exit [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 07/16/23 23:08:50.288 (10.235s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:50.289 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:50.915 (626ms) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:50.916 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:00.386 (9.47s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:00.386 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:11.506 (11.154s) > Enter [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 07/16/23 23:09:11.506 < Exit [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 07/16/23 23:09:21.824 (10.319s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:21.824 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:22.594 (769ms) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:22.602 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:31.342 (8.739s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:31.342 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:42.441 (11.134s) > Enter [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 07/16/23 23:09:42.441 < Exit [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 07/16/23 23:09:45.658 (3.217s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:45.658 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:46.07 (411ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:46.071 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:55.04 (8.969s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:55.04 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:59.124 (4.084s) > Enter [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 07/16/23 23:09:59.124 < Exit [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 07/16/23 23:10:13.448 (14.358s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:13.448 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:13.998 (550ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:13.999 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:22.738 (8.738s) > Enter [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 07/16/23 23:10:22.738 < Exit [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 07/16/23 23:10:33.094 (10.391s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:33.094 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:33.676 (582ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:33.688 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:42.391 (8.703s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:42.391 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:53.541 (11.15s) > Enter [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 07/16/23 23:10:53.541 < Exit [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 07/16/23 23:12:26.01 (1m32.617s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:26.01 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:26.827 (817ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.829 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:35.094 (8.299s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:35.094 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:39.241 (4.147s) > Enter [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 07/16/23 23:12:39.241 < Exit [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 07/16/23 23:13:08.762 (29.555s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.762 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:09.288 (526ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:09.289 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:17.226 (7.936s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:13:17.226 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:13:21.294 (4.068s) > Enter [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 07/16/23 23:13:21.294 < Exit [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 07/16/23 23:13:31.492 (10.198s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:31.492 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:32.119 (661ms) + + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.123 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:40.759 (8.636s) > Enter [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 07/16/23 23:13:40.759 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:90 @ 07/16/23 23:13:40.759 < Exit [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 07/16/23 23:13:40.759 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:40.76 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:41.293 (534ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:41.296 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:50.342 (9.046s) > Enter [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 07/16/23 23:13:50.342 < Exit [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 07/16/23 23:14:00.578 (10.237s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:00.578 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:01.204 (626ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:01.205 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:09.622 (8.451s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:14:09.622 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:14:13.746 (4.123s) > Enter [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 07/16/23 23:14:13.746 < Exit [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 07/16/23 23:14:24.227 (10.481s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:24.227 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:24.72 (493ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:24.722 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:35.239 (10.552s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:14:35.239 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:14:43.596 (8.357s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:14:43.596 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:15:05.851 (22.289s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 07/16/23 23:15:05.851 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 07/16/23 23:15:05.862 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:05.862 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:06.276 (414ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:06.278 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:14.855 (8.577s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:15:14.855 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:15:25.98 (11.125s) > Enter [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 07/16/23 23:15:25.98 < Exit [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 07/16/23 23:15:36.182 (10.236s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36.182 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36.652 (469ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:36.653 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:45.163 (8.51s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:45.163 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:51.277 (6.114s) > Enter [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 07/16/23 23:15:51.277 < Exit [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 07/16/23 23:16:01.482 (10.205s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:01.482 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:02.018 (570ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:02.019 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.556 (7.537s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:09.556 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:13.642 (4.085s) > Enter [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 07/16/23 23:16:13.642 < Exit [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 07/16/23 23:16:39.138 (25.531s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.138 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.697 (559ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:39.736 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:47.471 (7.735s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:47.471 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:51.578 (4.107s) > Enter [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 07/16/23 23:16:51.578 < Exit [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 07/16/23 23:17:17.178 (25.634s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:17.178 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:17.695 (517ms) + + + > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:17.697 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:26.222 (8.525s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:26.222 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:30.293 (4.071s) > Enter [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 07/16/23 23:17:30.293 Jul 16 23:17:39.506: INFO: Connecting to github.com (140.82.113.3:443) Connecting to github.com (140.82.113.3:443) Connecting to raw.githubusercontent.com (185.199.111.133:443) saving to '/etc/nginx/geoip/GeoLite2-Country.mmdb' GeoLite2-Country.mmd 100%!|(MISSING)********************************| 17952 0:00:00 ETA '/etc/nginx/geoip/GeoLite2-Country.mmdb' saved < Exit [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 07/16/23 23:17:49.758 (19.499s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:49.758 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:50.446 (688ms) + + + > Enter [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:50.448 < Exit [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:59.09 (8.642s) > Enter [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 07/16/23 23:17:59.09 Jul 16 23:17:59.090: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=0' Jul 16 23:18:19.484: INFO: waiting for leader election and initial status update Jul 16 23:18:59.486: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=36979' < Exit [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 07/16/23 23:19:09.559 (1m10.572s) > Enter [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:09.559 < Exit [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:10.072 (512ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:10.074 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:18.758 (8.683s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:18.758 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:22.852 (4.094s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:22.852 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:37.243 (14.425s) > Enter [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 07/16/23 23:19:37.243 < Exit [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 07/16/23 23:19:41.445 (4.202s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:41.446 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:42.051 (605ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:42.053 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:50.431 (8.379s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:50.432 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:54.495 (4.064s) > Enter [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 07/16/23 23:19:54.495 < Exit [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 07/16/23 23:20:06.914 (12.453s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:06.914 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:07.67 (756ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:07.684 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:16.699 (9.015s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:20:16.699 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:20:20.747 (4.048s) > Enter [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 07/16/23 23:20:20.747 < Exit [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 07/16/23 23:20:31.134 (10.387s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:31.134 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:31.656 (556ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:31.657 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:40.453 (8.796s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:20:40.453 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:20:44.53 (4.077s) > Enter [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 07/16/23 23:20:44.53 < Exit [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 07/16/23 23:21:13.79 (29.294s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.79 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:14.395 (605ms) + + + > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:14.4 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:23.168 (8.768s) > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 07/16/23 23:21:23.168 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 07/16/23 23:21:27.261 (4.093s) > Enter [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 07/16/23 23:21:27.261 < Exit [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 07/16/23 23:21:37.483 (10.256s) > Enter [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:37.483 < Exit [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:38.068 (585ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:38.069 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:45.534 (7.465s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:45.534 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:49.607 (4.073s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:21:49.607 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:22:03.839 (14.266s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 07/16/23 23:22:03.84 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 07/16/23 23:22:03.852 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:03.852 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.325 (473ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:04.328 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:12.822 (8.494s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:12.822 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:16.892 (4.07s) > Enter [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 07/16/23 23:22:16.892 < Exit [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 07/16/23 23:22:27.117 (10.225s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.117 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.555 (438ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:27.556 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:36.204 (8.682s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:36.204 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:40.282 (4.078s) > Enter [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 07/16/23 23:22:40.283 < Exit [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 07/16/23 23:22:52.486 (12.203s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:52.486 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:52.861 (375ms) + + + > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:52.864 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:00.437 (7.573s) > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 07/16/23 23:23:00.437 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 07/16/23 23:23:04.507 (4.105s) > Enter [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 07/16/23 23:23:04.507 STEP: generating correct defaults - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:43 @ 07/16/23 23:23:11.537 STEP: applying customizations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:61 @ 07/16/23 23:23:14.706 < Exit [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 07/16/23 23:23:25.01 (20.503s) > Enter [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.01 < Exit [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.724 (714ms) + + + > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:25.726 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:34.135 (8.443s) > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 07/16/23 23:23:34.135 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 07/16/23 23:23:38.193 (4.058s) > Enter [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 07/16/23 23:23:38.193 < Exit [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 07/16/23 23:23:52.705 (14.512s) > Enter [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:52.707 < Exit [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:53.193 (486ms) + + + > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:53.194 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:02.76 (9.601s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:24:02.76 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:24:13.875 (11.115s) > Enter [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 07/16/23 23:24:13.875 < Exit [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 07/16/23 23:24:24.131 (10.255s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:24.131 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:24.572 (441ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:24.573 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:33.002 (8.463s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:24:33.003 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:24:37.063 (4.061s) > Enter [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 07/16/23 23:24:37.063 < Exit [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 07/16/23 23:24:47.308 (10.245s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:47.308 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:47.843 (535ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:47.845 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:56.211 (8.367s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:24:56.212 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:25:04.311 (8.134s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:25:04.312 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:25:04.312 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:25:14.551 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:25:24.781 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:25:34.923 (30.646s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 07/16/23 23:25:34.923 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 07/16/23 23:25:34.924 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 07/16/23 23:25:45.117 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 07/16/23 23:25:45.136 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 07/16/23 23:25:45.155 (10.231s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.155 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.792 (637ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:45.799 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:53.394 (7.595s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:25:53.394 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:25:57.447 (4.052s) > Enter [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 07/16/23 23:25:57.447 STEP: setting enable-rewrite-log annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:38 @ 07/16/23 23:25:57.447 < Exit [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 07/16/23 23:26:10.67 (13.258s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.67 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:11.462 (792ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:11.466 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:19.994 (8.529s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:26:19.994 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:26:24.057 (4.063s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 07/16/23 23:26:24.057 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:53 @ 07/16/23 23:26:34.26 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:60 @ 07/16/23 23:26:34.268 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 07/16/23 23:26:34.424 (10.402s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:34.424 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:34.943 (519ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:34.948 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:43.595 (8.647s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:43.595 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:47.667 (4.072s) > Enter [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 07/16/23 23:26:47.667 < Exit [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 07/16/23 23:26:54.707 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:54.707 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:55.197 (490ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:55.199 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:02.431 (7.267s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:02.431 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:06.577 (4.146s) > Enter [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 07/16/23 23:27:06.577 < Exit [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 07/16/23 23:27:16.86 (10.283s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.86 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:17.6 (740ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:17.603 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:29.242 (11.639s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:27:29.242 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:27:33.297 (4.089s) > Enter [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 07/16/23 23:27:33.297 < Exit [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 07/16/23 23:27:50.62 (17.323s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:50.62 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:51.396 (777ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:51.398 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:59.848 (8.45s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:27:59.848 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:28:07.927 (8.114s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:28:07.927 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:28:07.927 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:28:18.108 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:28:28.311 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:28:38.594 (30.701s) > Enter [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 07/16/23 23:28:38.594 STEP: Adding a global-auth-method to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:202 @ 07/16/23 23:28:38.594 < Exit [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 07/16/23 23:28:48.849 (10.255s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:48.849 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:49.496 (647ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.498 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:58.133 (8.635s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:28:58.133 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:29:00.195 (2.062s) > Enter [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 07/16/23 23:29:00.195 < Exit [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 07/16/23 23:29:09.273 (9.111s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.273 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.693 (420ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:09.696 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:18.525 (8.83s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:29:18.525 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:29:22.595 (4.069s) > Enter [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 07/16/23 23:29:22.595 < Exit [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 07/16/23 23:29:35.79 (13.229s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:35.79 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:36.912 (1.123s) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:36.914 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:45.266 (8.352s) > Enter [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 07/16/23 23:29:45.266 STEP: checking the service is updated to use eu.httpbin.org - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:304 @ 07/16/23 23:30:01.037 < Exit [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 07/16/23 23:30:01.219 (15.992s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:01.219 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:01.675 (455ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:01.676 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:09.223 (7.547s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:30:09.223 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:30:17.344 (8.121s) > Enter [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 07/16/23 23:30:17.344 STEP: routing requests destined for the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:351 @ 07/16/23 23:30:44.8 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:360 @ 07/16/23 23:30:44.834 < Exit [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 07/16/23 23:30:44.863 (27.584s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:44.863 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:51.061 (6.197s) + + + > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:51.215 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:08.914 (17.737s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:31:08.914 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:31:24.729 (15.815s) > Enter [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 07/16/23 23:31:24.729 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:90 @ 07/16/23 23:31:33.588 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:96 @ 07/16/23 23:31:36.75 < Exit [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 07/16/23 23:31:38.764 (14.071s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:38.764 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:39.22 (456ms) + + + > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:39.221 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:47.492 (8.271s) > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 07/16/23 23:31:47.492 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 07/16/23 23:31:51.545 (4.053s) > Enter [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 07/16/23 23:31:51.545 < Exit [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 07/16/23 23:32:22.076 (30.566s) > Enter [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:22.076 < Exit [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:22.569 (493ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:22.57 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:30.865 (8.329s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:32:30.865 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:32:34.935 (4.071s) > Enter [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 07/16/23 23:32:34.936 < Exit [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 07/16/23 23:32:42.001 (7.066s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.001 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.52 (519ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:42.522 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:49.858 (7.336s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:32:49.859 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:00.922 (11.098s) > Enter [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 07/16/23 23:33:00.922 < Exit [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 07/16/23 23:33:11.133 (10.211s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.133 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.499 (366ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.501 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:19.977 (8.476s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:33:19.977 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:33:24.088 (4.111s) > Enter [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 07/16/23 23:33:24.088 < Exit [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 07/16/23 23:33:34.766 (10.712s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:34.766 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:35.346 (580ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:35.349 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:43.804 (8.455s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:43.804 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:54.894 (11.09s) > Enter [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 07/16/23 23:33:54.894 < Exit [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 07/16/23 23:34:05.028 (10.168s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:05.028 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:05.552 (523ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:05.554 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:14.153 (8.6s) > Enter [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 07/16/23 23:34:14.153 < Exit [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 07/16/23 23:34:24.357 (10.204s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:24.358 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:24.84 (482ms) + + + > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:24.841 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:33.146 (8.339s) > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 07/16/23 23:34:33.146 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 07/16/23 23:34:47.325 (14.18s) > Enter [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 07/16/23 23:34:47.325 < Exit [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 07/16/23 23:35:00.678 (13.387s) > Enter [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:00.678 < Exit [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:01.088 (411ms) + + + > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:01.09 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:09.717 (8.628s) > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 07/16/23 23:35:09.717 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 07/16/23 23:35:13.774 (4.056s) > Enter [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 07/16/23 23:35:13.774 < Exit [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 07/16/23 23:35:24.001 (10.227s) > Enter [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:24.001 < Exit [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:24.542 (541ms) + + + > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:24.545 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:32.804 (8.293s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:35:32.804 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:35:45.013 (12.209s) > Enter [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 07/16/23 23:35:45.013 < Exit [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 07/16/23 23:35:56.305 (11.292s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:56.305 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:57.119 (814ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:57.124 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:06.657 (9.567s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:06.657 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:10.742 (4.085s) > Enter [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 07/16/23 23:36:10.742 < Exit [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 07/16/23 23:36:20.937 (10.195s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.937 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.453 (516ms) + + + > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:21.455 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:31.124 (9.704s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:36:31.124 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:36:35.265 (4.141s) > Enter [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 07/16/23 23:36:35.265 < Exit [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 07/16/23 23:36:48.617 (13.352s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:48.617 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:49.062 (444ms) + + + > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:49.063 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:57.626 (8.563s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:36:57.626 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:37:05.661 (8.069s) > Enter [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 07/16/23 23:37:05.661 < Exit [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 07/16/23 23:37:36.037 (30.41s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:36.037 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:36.473 (436ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:36.475 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:45.324 (8.85s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:37:45.324 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:37:57.596 (12.271s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:37:57.596 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:38:25.91 (28.348s) > Enter [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 07/16/23 23:38:25.91 < Exit [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 07/16/23 23:38:32.91 (7.035s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:32.91 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:33.401 (490ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:33.402 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:42.01 (8.609s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:42.01 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:55.207 (13.196s) > Enter [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 07/16/23 23:38:55.207 < Exit [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 07/16/23 23:38:58.375 (3.169s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:58.375 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:58.773 (398ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:58.777 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:07.045 (8.302s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:39:07.045 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:39:11.141 (4.096s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:39:11.141 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:39:25.521 (14.38s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 07/16/23 23:39:25.521 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 07/16/23 23:39:36.735 (11.248s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.735 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:37.352 (617ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:37.354 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:47.228 (9.874s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:39:47.228 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:39:55.38 (8.152s) > Enter [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 07/16/23 23:39:55.38 < Exit [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 07/16/23 23:40:02.395 (7.05s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.395 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.942 (547ms) + + + > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:02.952 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:14.181 (11.229s) > Enter [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 07/16/23 23:40:14.181 < Exit [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 07/16/23 23:40:17.314 (3.133s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:17.314 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:17.708 (394ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:17.709 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:26.08 (8.371s) > Enter [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 07/16/23 23:40:26.08 < Exit [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 07/16/23 23:40:46.867 (20.821s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:46.867 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:47.244 (376ms) + + + I0716 23:41:15.732712 21 request.go:690] Waited for 1.1995168s due to client-side throttling, not priority and fairness, request: GET:https://10.96.0.1:443/api/v1/namespaces/e2e-tests-limit-connections-1689550847245898400-wb8ks/services/nginx-ingress-controller + > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:47.245 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.079 (8.834s) > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 07/16/23 23:40:56.079 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 07/16/23 23:41:00.171 (4.127s) > Enter [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 07/16/23 23:41:00.171 < Exit [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 07/16/23 23:41:24.568 (24.396s) > Enter [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:24.568 < Exit [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:25.344 (776ms) + + + > Enter [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:25.36 < Exit [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:32.695 (7.368s) > Enter [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 07/16/23 23:41:32.695 < Exit [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 07/16/23 23:42:45.785 (1m13.158s) > Enter [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:45.785 < Exit [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:46.185 (401ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:42:46.188 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:12.099 (25.945s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:12.099 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:20.23 (8.131s) > Enter [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 07/16/23 23:43:20.23 < Exit [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 07/16/23 23:43:27.268 (7.037s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:43:27.268 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:43:27.784 (516ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:27.785 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:58.24 (30.49s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:58.24 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:06.339 (8.133s) > Enter [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 07/16/23 23:44:06.339 STEP: rejects ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:52 @ 07/16/23 23:44:06.339 STEP: accepts ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:57 @ 07/16/23 23:44:06.349 < Exit [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 07/16/23 23:44:16.599 (10.26s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:16.599 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:17.054 (455ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:17.055 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:36.36 (19.339s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:36.36 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:44.488 (8.128s) > Enter [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 07/16/23 23:44:44.488 < Exit [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 07/16/23 23:44:44.642 (153ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:44.642 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:45.068 (426ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:45.07 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:03.441 (18.405s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:03.441 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:11.572 (8.131s) > Enter [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 07/16/23 23:45:11.572 < Exit [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 07/16/23 23:45:14.768 (3.197s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:14.768 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:15.19 (422ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:15.191 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:33.55 (18.393s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:33.55 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:41.706 (8.156s) > Enter [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 07/16/23 23:45:41.706 < Exit [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 07/16/23 23:45:41.879 (173ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:41.879 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:42.315 (436ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:42.316 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:05.628 (23.347s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:05.629 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:13.77 (8.142s) > Enter [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 07/16/23 23:46:13.77 < Exit [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 07/16/23 23:46:19.093 (5.323s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:19.093 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:19.553 (460ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:19.554 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:38.748 (19.229s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:38.748 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:46.903 (8.154s) > Enter [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 07/16/23 23:46:46.903 < Exit [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 07/16/23 23:46:53.94 (7.037s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:53.94 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:54.36 (420ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:54.361 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:47:21.846 (27.52s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:47:21.846 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:47:29.967 (8.139s) > Enter [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 07/16/23 23:47:29.967 < Exit [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 07/16/23 23:47:33.332 (3.365s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:47:33.332 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:47:33.801 (469ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:47:33.802 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:03.021 (29.226s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:48:03.021 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:48:11.191 (8.17s) > Enter [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 07/16/23 23:48:11.191 < Exit [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 07/16/23 23:48:14.438 (3.246s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:14.438 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:15.015 (577ms) + + + > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:15.017 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:22.38 (7.363s) > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 07/16/23 23:48:22.38 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 07/16/23 23:48:26.446 (4.066s) > Enter [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 07/16/23 23:48:26.446 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:53 @ 07/16/23 23:48:36.588 < Exit [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 07/16/23 23:48:36.76 (10.343s) > Enter [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:36.76 < Exit [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:37.218 (459ms) + + + > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:37.219 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:01.506 (24.32s) > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 07/16/23 23:49:01.506 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 07/16/23 23:49:27.706 (26.2s) > Enter [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 07/16/23 23:49:27.706 < Exit [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 07/16/23 23:49:34.037 (6.365s) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:49:34.037 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:49:34.43 (393ms) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 07/16/23 23:49:34.43 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 07/16/23 23:49:34.447 (17ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:34.449 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:53.407 (18.958s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:49:53.407 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:01.525 (8.152s) > Enter [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 07/16/23 23:50:01.525 < Exit [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 07/16/23 23:50:06.787 (5.263s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:06.787 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:07.247 (459ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:50:07.248 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:50:26.543 (19.295s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:26.543 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:34.647 (8.138s) > Enter [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 07/16/23 23:50:34.647 < Exit [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 07/16/23 23:50:34.688 (42ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:34.688 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:35.093 (404ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.275 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.02 (13.746s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:07:48.02 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:08:02.283 (14.262s) > Enter [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 07/16/23 23:08:02.283 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:193 @ 07/16/23 23:08:02.283 STEP: check that '/foo/bar/bar' redirects to custom rewrite - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:206 @ 07/16/23 23:08:12.679 < Exit [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 07/16/23 23:08:12.703 (10.454s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:12.703 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:13.572 (869ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:13.576 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:28.615 (15.039s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:28.615 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:36.764 (8.184s) > Enter [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 07/16/23 23:08:36.765 STEP: routing requests destined for the mainline ingress to the mainelin upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:231 @ 07/16/23 23:08:54.047 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:240 @ 07/16/23 23:08:54.056 < Exit [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 07/16/23 23:08:54.065 (17.301s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:54.065 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:54.538 (473ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:54.54 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:05.022 (10.516s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:05.022 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:09.106 (4.084s) > Enter [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 07/16/23 23:09:09.106 < Exit [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 07/16/23 23:09:25.238 (16.132s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:25.238 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:25.913 (675ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:25.915 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:34.419 (8.538s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:34.419 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:42.592 (8.174s) > Enter [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 07/16/23 23:09:42.592 < Exit [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 07/16/23 23:10:38.197 (55.673s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:38.197 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:38.587 (391ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:38.589 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:47.213 (8.624s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:10:47.213 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:10:51.275 (4.063s) > Enter [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 07/16/23 23:10:51.276 < Exit [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 07/16/23 23:10:58.316 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:58.316 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:58.828 (512ms) + + + > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:58.83 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:06.101 (7.326s) > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 07/16/23 23:11:06.101 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 07/16/23 23:11:55.28 (49.235s) > Enter [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 07/16/23 23:11:55.28 < Exit [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 07/16/23 23:12:16.87 (21.626s) > Enter [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.87 < Exit [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:17.419 (549ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:17.421 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.489 (9.069s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:12:26.49 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:12:30.699 (4.21s) > Enter [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 07/16/23 23:12:30.699 < Exit [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 07/16/23 23:12:41.026 (10.361s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.03 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.518 (487ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:41.519 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:50.636 (9.117s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:12:50.636 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:12:54.712 (4.076s) > Enter [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 07/16/23 23:12:54.712 < Exit [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 07/16/23 23:13:01.787 (7.076s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:01.787 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:02.426 (673ms) + + + > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:02.429 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:11.216 (8.787s) > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 07/16/23 23:13:11.217 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 07/16/23 23:13:15.424 (4.207s) > Enter [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 07/16/23 23:13:15.424 STEP: Checking exact request to / - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:63 @ 07/16/23 23:13:32.733 STEP: Checking prefix request to /bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:76 @ 07/16/23 23:13:32.756 STEP: Checking exact request to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:109 @ 07/16/23 23:13:50.333 STEP: Checking prefix request to /foo/bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:122 @ 07/16/23 23:13:50.341 STEP: Checking prefix request to /foobar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:134 @ 07/16/23 23:13:50.351 < Exit [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 07/16/23 23:13:50.359 (34.97s) > Enter [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:50.36 < Exit [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:50.91 (550ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:50.913 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:58.322 (7.409s) > Enter [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 07/16/23 23:13:58.322 < Exit [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 07/16/23 23:14:15.594 (17.306s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.594 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:16.06 (466ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:16.061 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:24.013 (7.951s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:14:24.013 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:14:28.134 (4.121s) > Enter [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 07/16/23 23:14:28.134 < Exit [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 07/16/23 23:14:47.036 (18.936s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:47.036 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:53.943 (6.907s) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:53.945 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:04.186 (10.275s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:15:04.186 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:15:08.271 (4.085s) > Enter [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 07/16/23 23:15:08.271 < Exit [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 07/16/23 23:15:18.477 (10.206s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:18.477 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:18.878 (401ms) + + + > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:18.88 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:27.307 (8.428s) > Enter [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 07/16/23 23:15:27.307 STEP: setting permanent-redirect-code annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:62 @ 07/16/23 23:15:27.307 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:82 @ 07/16/23 23:15:37.505 < Exit [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 07/16/23 23:15:37.513 (10.24s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:37.513 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:38.004 (491ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:38.014 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:47.066 (9.052s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:47.066 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:57.188 (10.122s) > Enter [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 07/16/23 23:15:57.188 STEP: routing requests to the mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:591 @ 07/16/23 23:16:14.422 < Exit [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 07/16/23 23:16:14.445 (17.291s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:14.445 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:15.095 (650ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:15.112 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:23.549 (8.437s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:23.549 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:27.629 (4.08s) > Enter [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 07/16/23 23:16:27.629 < Exit [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 07/16/23 23:16:37.862 (10.268s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.862 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:38.445 (583ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:38.446 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:49.042 (10.596s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:16:49.042 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:17:00.129 (11.087s) > Enter [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 07/16/23 23:17:00.129 < Exit [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 07/16/23 23:17:10.352 (10.257s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.352 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.734 (382ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:10.736 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:19.354 (8.618s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:17:19.354 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:17:23.429 (4.075s) > Enter [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 07/16/23 23:17:23.429 < Exit [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 07/16/23 23:17:33.591 (10.197s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:33.591 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:34.089 (497ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:34.09 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:42.368 (8.278s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:42.368 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:50.549 (8.181s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:17:50.549 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:17:50.549 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:18:01.043 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:18:11.254 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:18:21.423 (30.908s) > Enter [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 07/16/23 23:18:21.423 STEP: Adding a global-auth-response-headers to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:228 @ 07/16/23 23:18:21.423 < Exit [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 07/16/23 23:18:31.597 (10.208s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:31.597 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:32.129 (532ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:32.13 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:40.387 (8.257s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:40.387 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:44.465 (4.078s) > Enter [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 07/16/23 23:18:44.465 < Exit [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 07/16/23 23:18:54.781 (10.316s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:54.781 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:55.208 (427ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:55.21 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:03.622 (8.446s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:19:03.622 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:19:07.698 (4.076s) > Enter [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 07/16/23 23:19:07.698 < Exit [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 07/16/23 23:19:17.914 (10.216s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:17.914 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:18.304 (391ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:18.307 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:26.675 (8.368s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:26.675 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:30.739 (4.064s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:30.739 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:45.008 (14.304s) > Enter [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 07/16/23 23:19:45.008 < Exit [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 07/16/23 23:20:08.248 (23.274s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:08.248 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:08.787 (539ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:08.788 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:17.73 (8.942s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:20:17.73 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:20:21.833 (4.103s) > Enter [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 07/16/23 23:20:21.833 < Exit [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 07/16/23 23:20:32.024 (10.226s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:32.024 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:32.522 (498ms) + + + > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:32.53 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:40.871 (8.341s) > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 07/16/23 23:20:40.871 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 07/16/23 23:20:46.94 (6.069s) > Enter [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 07/16/23 23:20:46.94 < Exit [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 07/16/23 23:21:04.258 (17.351s) > Enter [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:04.258 < Exit [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:04.797 (540ms) + + + > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:04.802 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:13.19 (8.387s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:21:13.19 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:21:19.32 (6.13s) > Enter [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 07/16/23 23:21:19.32 < Exit [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 07/16/23 23:21:49.708 (30.422s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:49.708 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:50.139 (431ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:50.145 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:58.496 (8.351s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:21:58.496 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:22:09.574 (11.112s) > Enter [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 07/16/23 23:22:09.574 < Exit [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 07/16/23 23:22:19.755 (10.181s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:19.755 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:20.256 (501ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:20.257 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:28.894 (8.637s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:22:28.894 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:22:43.112 (14.252s) > Enter [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 07/16/23 23:22:43.112 < Exit [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 07/16/23 23:23:05.645 (22.568s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:05.645 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:06.129 (484ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:06.131 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:20.599 (14.468s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:23:20.6 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:23:27.994 (7.394s) > Enter [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 07/16/23 23:23:27.994 < Exit [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 07/16/23 23:23:40.522 (12.562s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:40.522 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:40.988 (466ms) + + + > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:40.989 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:49.554 (8.565s) > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 07/16/23 23:23:49.554 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 07/16/23 23:23:53.661 (4.107s) > Enter [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 07/16/23 23:23:53.661 < Exit [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 07/16/23 23:24:03.928 (10.302s) > Enter [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:03.928 < Exit [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:04.364 (435ms) + + + > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:04.366 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:12.746 (8.379s) > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 07/16/23 23:24:12.746 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 07/16/23 23:24:16.814 (4.069s) > Enter [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 07/16/23 23:24:16.814 < Exit [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 07/16/23 23:24:39.062 (22.282s) > Enter [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.062 < Exit [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.426 (364ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:39.427 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:48.131 (8.704s) > Enter [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 07/16/23 23:24:48.132 < Exit [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 07/16/23 23:25:02.405 (14.308s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:02.405 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:02.769 (364ms) + + + > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:02.775 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:11.181 (8.406s) > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 07/16/23 23:25:11.181 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 07/16/23 23:25:24.327 (13.145s) > Enter [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 07/16/23 23:25:24.327 < Exit [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 07/16/23 23:25:44.763 (20.471s) > Enter [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:44.763 < Exit [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.279 (515ms) + + + > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:45.282 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:53.726 (8.444s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:25:53.726 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:25:57.802 (4.077s) > Enter [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 07/16/23 23:25:57.803 < Exit [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 07/16/23 23:26:27.099 (29.331s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.099 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.643 (544ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.646 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:36.154 (8.542s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:26:36.154 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:26:40.235 (4.081s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:26:40.235 Jul 16 23:26:49.946: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:26:51.943 (11.709s) > Enter [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 07/16/23 23:26:51.944 < Exit [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 07/16/23 23:27:02.135 (10.226s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:02.135 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:02.635 (500ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:02.637 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:10.976 (8.339s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:10.976 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:15.04 (4.064s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:27:15.04 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:27:29.343 (14.303s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 07/16/23 23:27:29.343 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 07/16/23 23:27:29.355 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:29.355 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:29.875 (520ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:29.877 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:37.741 (7.898s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:37.741 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:45.891 (8.149s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 07/16/23 23:27:45.891 STEP: routing requests to the canary upstream when header value does not match and cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:630 @ 07/16/23 23:28:03.119 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 07/16/23 23:28:03.125 (17.268s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:03.125 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:03.604 (479ms) + + + > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:03.605 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:11.902 (8.297s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:28:11.902 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:28:23.063 (11.161s) > Enter [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 07/16/23 23:28:23.063 < Exit [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 07/16/23 23:28:40.338 (17.309s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:40.338 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:40.752 (414ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:40.754 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.068 (8.315s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:28:49.068 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:28:53.189 (4.121s) > Enter [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 07/16/23 23:28:53.189 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:94 @ 07/16/23 23:29:10.345 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:101 @ 07/16/23 23:29:13.397 < Exit [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 07/16/23 23:29:13.425 (20.27s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:13.425 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:13.959 (534ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:13.961 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:22.387 (8.427s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:29:22.387 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:29:26.497 (4.11s) > Enter [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 07/16/23 23:29:26.497 < Exit [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 07/16/23 23:29:34.509 (8.047s) > Enter [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 07/16/23 23:29:34.509 < Exit [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 07/16/23 23:29:51.844 (17.335s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:51.844 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:52.449 (605ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:52.451 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:02.775 (10.363s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:30:02.775 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:30:08.866 (6.091s) > Enter [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 07/16/23 23:30:08.866 < Exit [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 07/16/23 23:30:15.919 (7.053s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:15.919 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:16.435 (515ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:16.437 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:40.742 (24.37s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:30:40.742 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:30:57.46 (16.718s) > Enter [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 07/16/23 23:30:57.46 < Exit [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 07/16/23 23:31:14.185 (16.763s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:14.185 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:14.687 (502ms) + + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:14.689 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:23.074 (8.386s) > Enter [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 07/16/23 23:31:23.074 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:107 @ 07/16/23 23:31:23.075 < Exit [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 07/16/23 23:31:23.075 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:23.075 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:23.495 (420ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:23.497 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:32.125 (8.663s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:31:32.125 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:31:46.863 (14.738s) > Enter [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 07/16/23 23:31:46.863 < Exit [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 07/16/23 23:32:13.132 (26.303s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:13.132 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:13.542 (410ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:13.543 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:21.845 (8.301s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:32:21.845 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:32:32.94 (11.13s) > Enter [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 07/16/23 23:32:32.94 < Exit [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 07/16/23 23:32:43.229 (10.289s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.229 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.683 (454ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:43.686 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:52.383 (8.697s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:32:52.383 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:32:56.466 (4.083s) > Enter [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 07/16/23 23:32:56.466 < Exit [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 07/16/23 23:33:11.547 (15.115s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.547 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.984 (436ms) + + + > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.986 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:20.45 (8.464s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:33:20.45 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:33:32.659 (12.244s) > Enter [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 07/16/23 23:33:32.659 Jul 16 23:34:02.788: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not noannotationnopassthrough.com < Exit [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 07/16/23 23:34:08.035 (35.41s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:08.036 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:08.724 (688ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:08.73 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:16.88 (8.151s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:34:16.881 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:34:20.959 (4.078s) > Enter [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 07/16/23 23:34:20.959 < Exit [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 07/16/23 23:34:31.272 (10.348s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:31.272 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:31.691 (419ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:31.694 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:41.1 (9.407s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:34:41.1 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:35:00.246 (19.146s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 07/16/23 23:35:00.246 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 07/16/23 23:35:03.378 (3.166s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.378 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.897 (519ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:03.899 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:12.446 (8.548s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:35:12.446 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:35:16.511 (4.065s) > Enter [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 07/16/23 23:35:16.511 < Exit [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 07/16/23 23:35:49.692 (33.215s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:49.692 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:50.092 (400ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:35:50.093 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:35:52.103 (2.01s) > Enter [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 07/16/23 23:35:52.103 < Exit [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 07/16/23 23:36:52.175 (1m0.14s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:36:52.175 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:36:52.185 (10ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:52.186 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:02.922 (10.77s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:37:02.922 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:37:07.012 (4.09s) > Enter [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 07/16/23 23:37:07.012 < Exit [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 07/16/23 23:37:24.253 (17.242s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:24.253 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:24.676 (423ms) + + + > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:24.678 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:32.973 (8.329s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:37:32.973 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:37:37.052 (4.079s) > Enter [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 07/16/23 23:37:37.052 < Exit [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 07/16/23 23:37:47.815 (10.762s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:47.815 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:48.335 (520ms) + + + > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:48.336 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:58.16 (9.824s) > Enter [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 07/16/23 23:37:58.16 < Exit [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 07/16/23 23:38:08.445 (10.319s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:08.445 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:08.913 (468ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:08.914 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:16.27 (7.355s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:38:16.27 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:38:27.37 (11.1s) > Enter [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 07/16/23 23:38:27.37 < Exit [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 07/16/23 23:38:37.659 (10.323s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:37.659 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.366 (708ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:38.369 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:50.759 (12.39s) > Enter [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 07/16/23 23:38:50.759 < Exit [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 07/16/23 23:39:09.202 (18.477s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:09.202 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:09.666 (464ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:09.667 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:20.364 (10.697s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:39:20.364 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:39:26.451 (6.087s) > Enter [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 07/16/23 23:39:26.451 < Exit [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 07/16/23 23:39:36.677 (10.26s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.677 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:37.244 (568ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:37.246 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:46.548 (9.301s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:39:46.548 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:39:48.593 (2.045s) > Enter [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 07/16/23 23:39:48.593 < Exit [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 07/16/23 23:39:58.782 (10.188s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.782 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:59.281 (499ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:59.283 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:09.944 (10.696s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:40:09.944 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:40:14.019 (4.074s) > Enter [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 07/16/23 23:40:14.019 < Exit [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 07/16/23 23:40:36.276 (22.292s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:36.276 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:37.147 (871ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:37.158 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:45.052 (7.894s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 07/16/23 23:40:45.052 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 07/16/23 23:40:55.399 (10.347s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:55.399 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:56.086 (686ms) + + + > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.088 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:04.49 (8.436s) > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 07/16/23 23:41:04.49 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 07/16/23 23:41:08.564 (4.074s) > Enter [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 07/16/23 23:41:08.564 < Exit [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 07/16/23 23:41:18.798 (10.233s) > Enter [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:18.798 < Exit [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:19.252 (455ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:19.254 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:27.682 (8.428s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 07/16/23 23:41:27.682 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 07/16/23 23:41:37.904 (10.256s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:37.904 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:38.533 (629ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.181 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.294 (14.113s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:07:48.294 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:08:06.535 (18.275s) > Enter [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 07/16/23 23:08:06.535 < Exit [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 07/16/23 23:08:19.035 (12.5s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:19.036 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:22.623 (3.587s) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:22.634 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:33.298 (10.698s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:33.298 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:41.456 (8.158s) > Enter [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 07/16/23 23:08:41.456 < Exit [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 07/16/23 23:08:58.789 (17.333s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:58.789 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:59.423 (634ms) + + + > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:59.425 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:07.036 (7.646s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:09:07.036 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:09:11.131 (4.095s) > Enter [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 07/16/23 23:09:11.131 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:115 @ 07/16/23 23:09:28.355 STEP: sending request from an implicitly denied IP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:123 @ 07/16/23 23:09:28.363 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:131 @ 07/16/23 23:09:28.369 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:139 @ 07/16/23 23:09:28.381 < Exit [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 07/16/23 23:09:35.394 (24.298s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:35.394 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:35.813 (419ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:35.815 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:43.362 (7.548s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:43.362 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:51.533 (8.17s) > Enter [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 07/16/23 23:09:51.533 < Exit [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 07/16/23 23:10:08.703 (17.205s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.703 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:09.316 (613ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:09.318 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:18.473 (9.154s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:18.473 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:29.549 (11.076s) > Enter [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 07/16/23 23:10:29.549 < Exit [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 07/16/23 23:12:01.67 (1m32.267s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:01.67 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:02.208 (575ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:02.214 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:10.539 (8.324s) > Enter [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 07/16/23 23:12:10.539 < Exit [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 07/16/23 23:12:13.724 (3.185s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:13.724 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:14.29 (566ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:14.293 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:23.098 (8.805s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:23.098 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:27.239 (4.141s) > Enter [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 07/16/23 23:12:27.239 < Exit [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 07/16/23 23:12:34.414 (7.21s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:34.414 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:35.005 (591ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:35.039 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:42.388 (7.349s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:12:42.388 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:12:46.475 (4.088s) > Enter [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 07/16/23 23:12:46.475 Jul 16 23:12:56.021: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 07/16/23 23:12:58.041 (11.565s) > Enter [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 07/16/23 23:12:58.041 < Exit [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 07/16/23 23:13:08.414 (10.408s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.414 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.876 (461ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:08.877 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:18.056 (9.178s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:13:18.056 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:13:22.157 (4.101s) > Enter [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 07/16/23 23:13:22.157 < Exit [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 07/16/23 23:13:29.225 (7.069s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:29.225 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:29.887 (662ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:29.89 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:39.107 (9.251s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:13:39.107 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:13:43.181 (4.074s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 07/16/23 23:13:43.181 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 07/16/23 23:14:10.942 (27.795s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:10.942 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:11.517 (575ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:11.518 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:22.99 (11.472s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:14:22.99 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:14:27.23 (4.24s) > Enter [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 07/16/23 23:14:27.23 < Exit [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 07/16/23 23:14:49.899 (22.703s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:49.899 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.182 (7.283s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:14:57.182 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:14:57.182 (0s) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:57.184 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:08.252 (11.102s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:15:08.252 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:15:12.39 (4.138s) > Enter [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 07/16/23 23:15:12.39 < Exit [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 07/16/23 23:15:22.633 (10.243s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.633 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.102 (469ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:23.104 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.984 (8.914s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:31.984 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:36.044 (4.06s) > Enter [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 07/16/23 23:15:36.044 < Exit [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 07/16/23 23:15:43.084 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:43.084 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:43.533 (449ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:43.534 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:53.243 (9.708s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:53.243 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:16:01.378 (8.135s) > Enter [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 07/16/23 23:16:01.378 < Exit [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 07/16/23 23:16:18.568 (17.224s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:18.568 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:19.084 (516ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:19.086 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:27.839 (8.752s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:27.839 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:31.857 (4.053s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:16:31.857 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:16:53.175 (21.318s) > Enter [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 07/16/23 23:16:53.175 < Exit [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 07/16/23 23:16:58.37 (5.195s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:58.37 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:58.799 (429ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:58.8 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:07.105 (8.339s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:07.105 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:15.232 (8.127s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:17:15.232 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:17:43.549 (28.352s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 07/16/23 23:17:43.549 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 07/16/23 23:17:43.559 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:43.559 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:44.126 (567ms) + + + + > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:44.132 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:52.272 (8.14s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:52.272 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:56.337 (4.065s) > Enter [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 07/16/23 23:17:56.338 [SKIPPED] GeoIP test are temporarily disabled In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:71 @ 07/16/23 23:17:56.338 < Exit [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 07/16/23 23:17:56.338 (0s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:56.338 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:56.866 (528ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:56.867 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:05.372 (8.539s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:05.372 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:09.472 (4.1s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:09.472 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:23.753 (14.281s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 07/16/23 23:18:23.753 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 07/16/23 23:18:35.016 (11.297s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:35.016 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:35.607 (591ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:35.609 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:43.138 (7.529s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:18:43.138 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:18:54.215 (11.077s) > Enter [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 07/16/23 23:18:54.216 < Exit [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 07/16/23 23:20:26.407 (1m32.295s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.407 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.885 (478ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:26.887 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:37.187 (10.334s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:20:37.187 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:20:45.389 (8.202s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 07/16/23 23:20:45.389 STEP: routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:557 @ 07/16/23 23:21:02.659 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 07/16/23 23:21:02.665 (17.31s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:02.665 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:03.083 (418ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:03.085 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:11.612 (8.528s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:11.613 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:15.676 (4.064s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:21:15.676 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:21:30.005 (14.329s) > Enter [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 07/16/23 23:21:30.005 < Exit [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 07/16/23 23:21:53.323 (23.352s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:53.323 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:53.812 (489ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:53.814 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:03.724 (9.944s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:22:03.724 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:22:07.799 (4.075s) > Enter [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 07/16/23 23:22:07.799 < Exit [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 07/16/23 23:22:17.991 (10.193s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:17.992 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:18.348 (357ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:18.35 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:25.849 (7.5s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:25.849 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:29.974 (4.125s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:22:29.975 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:22:35.051 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:22:45.228 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:22:55.444 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:23:05.609 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:23:20.804 (50.898s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 07/16/23 23:23:20.804 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 07/16/23 23:23:20.815 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:20.815 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.307 (492ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:21.309 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:29.836 (8.527s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:23:29.836 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:23:33.883 (4.082s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:23:33.883 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:23:40.947 (7.064s) > Enter [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 07/16/23 23:23:40.947 < Exit [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 07/16/23 23:23:51.186 (10.238s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.186 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.782 (596ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:51.784 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:01.236 (9.487s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:24:01.236 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:24:07.344 (6.108s) > Enter [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 07/16/23 23:24:07.344 < Exit [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 07/16/23 23:24:16.393 (9.049s) > Enter [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 07/16/23 23:24:16.393 < Exit [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 07/16/23 23:24:40.653 (24.294s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:40.653 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:41.482 (829ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:41.484 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:50.125 (8.641s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:50.125 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:54.192 (4.067s) > Enter [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 07/16/23 23:24:54.192 < Exit [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 07/16/23 23:25:04.321 (10.163s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:04.321 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:04.923 (601ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:04.925 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:13.199 (8.274s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:25:13.199 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:25:17.26 (4.061s) > Enter [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 07/16/23 23:25:17.26 < Exit [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 07/16/23 23:25:24.298 (7.039s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:24.298 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:24.749 (451ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:24.752 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:33.474 (8.756s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:25:33.474 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:25:37.542 (4.067s) > Enter [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 07/16/23 23:25:37.542 < Exit [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 07/16/23 23:26:06.773 (29.265s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:06.773 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.274 (502ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:07.276 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:15.787 (8.511s) > Enter [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 07/16/23 23:26:15.787 < Exit [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 07/16/23 23:26:18.987 (3.2s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:18.987 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:19.381 (394ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:19.383 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.733 (8.35s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:27.733 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:31.801 (4.102s) > Enter [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 07/16/23 23:26:31.801 < Exit [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 07/16/23 23:26:38.85 (7.05s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:38.85 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:39.478 (628ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:39.479 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:48.115 (8.636s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:26:48.115 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:26:59.194 (11.079s) > Enter [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 07/16/23 23:26:59.195 < Exit [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 07/16/23 23:27:12.403 (13.243s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:12.403 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:13.018 (615ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:13.019 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:21.582 (8.563s) > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 07/16/23 23:27:21.582 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 07/16/23 23:27:34.703 (13.156s) > Enter [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 07/16/23 23:27:34.703 < Exit [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 07/16/23 23:29:42.768 (2m8.202s) > Enter [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:42.769 < Exit [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:43.223 (454ms) + + + > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:43.227 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:53.678 (10.45s) > Enter [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 07/16/23 23:29:53.678 < Exit [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 07/16/23 23:31:59.236 (2m5.735s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:59.236 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:59.608 (372ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:59.609 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:07.878 (8.303s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:32:07.878 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:32:16 (8.122s) > Enter [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 07/16/23 23:32:16 STEP: routing requests destined for the mainline ingress to the maineline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:185 @ 07/16/23 23:32:33.194 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:195 @ 07/16/23 23:32:33.2 < Exit [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 07/16/23 23:32:33.205 (17.24s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:33.206 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:33.607 (402ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:33.609 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:42.047 (8.438s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:32:42.047 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:32:44.131 (2.084s) > Enter [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 07/16/23 23:32:44.131 < Exit [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 07/16/23 23:33:01.382 (17.284s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.382 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.909 (527ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:01.911 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:09.441 (7.531s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:33:09.441 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:33:13.505 (4.063s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:33:13.505 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:33:30.702 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:33:38.854 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:33:38.882 (25.412s) > Enter [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 07/16/23 23:33:38.883 < Exit [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 07/16/23 23:33:38.915 (33ms) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:38.915 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:39.351 (436ms) + + + > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:39.353 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:47.674 (8.321s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:33:47.674 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:33:51.753 (4.079s) > Enter [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 07/16/23 23:33:51.753 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:39 @ 07/16/23 23:33:51.753 STEP: sending request to www.fromtowwwredirect.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:55 @ 07/16/23 23:34:01.902 < Exit [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 07/16/23 23:34:01.908 (10.19s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:01.908 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:02.385 (477ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:02.387 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:10.798 (8.412s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:10.798 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:14.981 (4.183s) > Enter [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 07/16/23 23:34:14.981 < Exit [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 07/16/23 23:34:25.139 (10.158s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:25.139 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:25.527 (388ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:25.529 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:34.003 (8.508s) > Enter [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 07/16/23 23:34:34.003 < Exit [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 07/16/23 23:34:37.287 (3.284s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:37.287 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:37.727 (440ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:37.729 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:46.195 (8.467s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:34:46.195 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:34:50.299 (4.103s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 07/16/23 23:34:50.299 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:82 @ 07/16/23 23:35:07.674 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:89 @ 07/16/23 23:35:07.684 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 07/16/23 23:35:07.935 (17.671s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:07.935 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:08.597 (662ms) + + + > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:08.599 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:16.925 (8.326s) > Enter [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 07/16/23 23:35:16.925 < Exit [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 07/16/23 23:35:27.115 (10.19s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:27.115 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:27.606 (491ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:27.607 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:36.182 (8.609s) > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 07/16/23 23:35:36.182 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 07/16/23 23:35:40.286 (4.104s) > Enter [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 07/16/23 23:35:40.286 < Exit [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 07/16/23 23:35:57.881 (17.595s) > Enter [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:57.882 < Exit [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:58.487 (606ms) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:58.488 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:08.838 (10.384s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:36:08.838 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:36:08.844 (7ms) > Enter [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 07/16/23 23:36:08.844 < Exit [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 07/16/23 23:36:20.132 (11.288s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.132 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.736 (604ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:20.747 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:35.265 (14.553s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:36:35.265 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:36:40.48 (5.214s) > Enter [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 07/16/23 23:36:40.48 < Exit [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 07/16/23 23:36:50.676 (10.196s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:50.676 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:51.171 (494ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:51.175 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:05.11 (13.969s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:37:05.11 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:37:07.17 (2.06s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 07/16/23 23:37:07.17 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 07/16/23 23:37:39.655 (32.519s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:39.655 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:40.653 (998ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:40.661 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:51.734 (11.073s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:37:51.734 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:38:03.848 (12.148s) > Enter [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 07/16/23 23:38:03.849 < Exit [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 07/16/23 23:38:24.234 (20.386s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:24.234 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:24.679 (445ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:24.68 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:32.938 (8.292s) > Enter [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 07/16/23 23:38:32.938 < Exit [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 07/16/23 23:38:43.94 (11.002s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:43.94 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:44.431 (490ms) + + + > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:44.432 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:52.684 (8.252s) > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 07/16/23 23:38:52.684 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 07/16/23 23:38:56.739 (4.055s) > Enter [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 07/16/23 23:38:56.739 STEP: setting an ingress with a nil backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:39 @ 07/16/23 23:38:56.739 < Exit [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 07/16/23 23:39:14.138 (17.433s) > Enter [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:14.138 < Exit [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:14.962 (824ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:14.965 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:24.07 (9.105s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:24.07 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:28.143 (4.073s) > Enter [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 07/16/23 23:39:28.143 < Exit [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 07/16/23 23:39:38.36 (10.251s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:38.36 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:39.039 (679ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:39.042 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:48.893 (9.851s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:39:48.893 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:40:03.237 (14.378s) > Enter [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 07/16/23 23:40:03.237 < Exit [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 07/16/23 23:40:09.71 (6.473s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:09.71 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:10.252 (542ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:10.253 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:19.088 (8.835s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:40:19.088 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:40:23.173 (4.085s) > Enter [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 07/16/23 23:40:23.173 < Exit [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 07/16/23 23:40:38.779 (15.64s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:38.779 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:39.307 (527ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:39.308 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:47.706 (8.397s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:40:47.706 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:40:55.919 (8.214s) > Enter [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 07/16/23 23:40:55.919 STEP: routing requests to the canary upstream when cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:667 @ 07/16/23 23:41:13.225 STEP: routing requests to the mainline upstream when cookie is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:678 @ 07/16/23 23:41:21.42 STEP: routing requests to the mainline upstream when cookie is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:689 @ 07/16/23 23:41:31.387 < Exit [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 07/16/23 23:41:41.387 (45.536s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:41.387 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:41.882 (496ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.174 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:47.886 (13.712s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:07:47.886 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:08:05.964 (18.112s) > Enter [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 07/16/23 23:08:05.964 < Exit [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 07/16/23 23:08:16.513 (10.55s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:16.513 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:18.635 (2.121s) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:18.644 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:33.277 (14.667s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:08:33.277 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:08:37.346 (4.069s) > Enter [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 07/16/23 23:08:37.346 < Exit [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 07/16/23 23:08:47.641 (10.296s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:47.641 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:48.061 (420ms) + + + + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:48.065 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:56.738 (8.673s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:56.738 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:09:02.831 (6.128s) > Enter [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 07/16/23 23:09:02.831 < Exit [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 07/16/23 23:09:13.19 (10.358s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:13.19 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:13.879 (690ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:13.881 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:23.851 (9.97s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:09:23.851 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:09:27.921 (4.07s) > Enter [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 07/16/23 23:09:27.921 < Exit [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 07/16/23 23:09:38.098 (10.211s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:38.098 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:38.641 (542ms) + + + > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:38.642 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:47.013 (8.37s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:09:47.013 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:09:51.1 (4.087s) > Enter [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 07/16/23 23:09:51.1 < Exit [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 07/16/23 23:10:08.284 (17.218s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.284 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.876 (592ms) + + + > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:08.879 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:17.058 (8.179s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:10:17.058 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:10:21.245 (4.187s) > Enter [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 07/16/23 23:10:21.245 < Exit [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 07/16/23 23:10:36.438 (15.228s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:36.438 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:37.064 (626ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:37.067 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:45.508 (8.441s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:45.508 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:49.586 (4.077s) > Enter [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 07/16/23 23:10:49.586 < Exit [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 07/16/23 23:10:59.919 (10.333s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:59.919 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:00.531 (612ms) + + + > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:00.533 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:09.091 (8.614s) > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 07/16/23 23:11:09.091 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 07/16/23 23:11:13.182 (4.091s) > Enter [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 07/16/23 23:11:13.182 < Exit [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 07/16/23 23:11:26.418 (13.236s) > Enter [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:26.418 < Exit [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:26.883 (466ms) + + + > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:26.886 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:35.167 (8.337s) > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 07/16/23 23:11:35.167 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 07/16/23 23:11:39.249 (4.082s) > Enter [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 07/16/23 23:11:39.249 STEP: turning on proxy_intercept_errors directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:59 @ 07/16/23 23:11:49.509 STEP: configuring error_page directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:62 @ 07/16/23 23:11:49.509 STEP: creating error locations - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:67 @ 07/16/23 23:11:49.509 STEP: updating configuration when only custom-http-error value changes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:72 @ 07/16/23 23:11:49.509 STEP: ignoring duplicate values (503 in this case) per server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:90 @ 07/16/23 23:11:55.803 STEP: using the custom default-backend from annotation for upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:102 @ 07/16/23 23:12:06.081 < Exit [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 07/16/23 23:12:16.315 (37.103s) > Enter [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.315 < Exit [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:17.092 (777ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:17.094 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.253 (9.159s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:12:26.253 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:12:30.38 (4.127s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:12:30.38 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:12:40.55 (10.205s) > Enter [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 07/16/23 23:12:40.55 < Exit [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 07/16/23 23:12:40.557 (7ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:40.557 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.043 (485ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:41.045 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:49.182 (8.137s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:49.182 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:53.256 (4.074s) > Enter [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 07/16/23 23:12:53.256 < Exit [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 07/16/23 23:13:22.75 (29.529s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:22.751 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:23.247 (496ms) + + + > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:23.249 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.429 (9.214s) > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 07/16/23 23:13:32.429 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 07/16/23 23:13:36.507 (4.079s) > Enter [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 07/16/23 23:13:36.507 STEP: running cfssl gencert -initca ca_csr.json | cfssljson -bare ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:43.545 STEP: running cfssl gencert -ca ca.pem -ca-key ca-key.pem -config=cfssl_config.json -profile=intermediate intermediate_ca_csr.json | cfssljson -bare intermediate_ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:43.952 STEP: running cfssl gencert -ca intermediate_ca.pem -ca-key intermediate_ca-key.pem -config=cfssl_config.json -profile=ocsp ocsp_csr.json | cfssljson -bare ocsp - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:44.496 STEP: running cfssl serve -db-config=db-config.json -ca-key=intermediate_ca-key.pem -ca=intermediate_ca.pem -config=cfssl_config.json -responder=ocsp.pem -responder-key=ocsp-key.pem - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:228 @ 07/16/23 23:13:44.802 STEP: running cfssl gencert -remote=localhost -profile=server leaf_csr.json | cfssljson -bare leaf - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:238 @ 07/16/23 23:13:49.804 STEP: running cfssl ocsprefresh -ca intermediate_ca.pem -responder=ocsp.pem -responder-key=ocsp-key.pem -db-config=db-config.json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:252 @ 07/16/23 23:13:50.312 < Exit [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 07/16/23 23:14:19.018 (42.545s) > Enter [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:19.019 < Exit [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:19.766 (748ms) + + + > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:19.784 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:28.844 (9.06s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:14:28.844 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:14:32.923 (4.113s) > Enter [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 07/16/23 23:14:32.923 < Exit [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 07/16/23 23:14:58.308 (25.386s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.309 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.898 (590ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:58.904 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:07.074 (8.204s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:15:07.074 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:15:11.143 (4.069s) > Enter [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 07/16/23 23:15:11.143 < Exit [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 07/16/23 23:15:31.188 (20.046s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:31.189 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:31.695 (506ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:15:31.695 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:15:31.695 (0s) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.698 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:40.015 (8.352s) > Enter [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 07/16/23 23:15:40.015 < Exit [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 07/16/23 23:15:56.386 (16.37s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:56.386 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:56.782 (396ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:56.784 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:04.113 (7.363s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:16:04.113 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:16:08.211 (4.099s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:16:08.211 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:16:25.445 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:16:33.599 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:16:33.62 (25.443s) > Enter [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 07/16/23 23:16:33.62 STEP: serving the default certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:204 @ 07/16/23 23:16:38.67 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:214 @ 07/16/23 23:16:38.72 < Exit [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 07/16/23 23:16:38.72 (5.1s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:38.72 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.166 (446ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:16:39.168 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:16:41.179 (2.011s) > Enter [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 07/16/23 23:16:41.179 < Exit [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 07/16/23 23:17:41.25 (1m0.14s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:17:41.25 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:17:41.266 (16ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:41.269 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:49.268 (7.999s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:17:49.268 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:17:53.439 (4.171s) > Enter [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 07/16/23 23:17:53.439 < Exit [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 07/16/23 23:18:03.611 (10.206s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:03.611 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:04.065 (454ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:04.067 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:11.387 (7.321s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:11.387 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:15.513 (4.126s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:15.513 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:29.758 (14.244s) > Enter [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 07/16/23 23:18:29.758 < Exit [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 07/16/23 23:18:52.938 (23.215s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:52.938 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:53.44 (502ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:53.442 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:01.722 (8.314s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:19:01.722 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:19:05.782 (4.06s) > Enter [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 07/16/23 23:19:05.782 < Exit [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 07/16/23 23:19:12.827 (7.045s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:12.827 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:13.418 (591ms) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:13.419 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:21.929 (8.511s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:19:21.93 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:19:26.01 (4.081s) > Enter [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 07/16/23 23:19:26.011 < Exit [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 07/16/23 23:19:43.294 (17.318s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:43.294 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:43.763 (468ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:43.765 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:53.125 (9.36s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:19:53.125 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:19:57.249 (4.124s) > Enter [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 07/16/23 23:19:57.249 < Exit [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 07/16/23 23:20:14.861 (17.646s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:14.861 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:15.741 (880ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:20:15.741 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:20:15.741 (0s) + + + > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:15.743 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:24.398 (8.655s) > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 07/16/23 23:20:24.398 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 07/16/23 23:20:28.465 (4.067s) > Enter [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 07/16/23 23:20:28.465 < Exit [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 07/16/23 23:20:45.696 (17.265s) > Enter [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:45.696 < Exit [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:46.089 (393ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:46.09 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:54.488 (8.398s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:20:54.488 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:21:05.565 (11.111s) > Enter [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 07/16/23 23:21:05.565 < Exit [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 07/16/23 23:21:15.847 (10.282s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:15.847 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:16.528 (681ms) + + + > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:16.53 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:26.755 (10.225s) > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 07/16/23 23:21:26.755 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 07/16/23 23:21:30.816 (4.061s) > Enter [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 07/16/23 23:21:30.816 < Exit [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 07/16/23 23:21:41.003 (10.222s) > Enter [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:41.003 < Exit [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:41.534 (531ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:41.538 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:50.229 (8.691s) > Enter [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 07/16/23 23:21:50.229 < Exit [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 07/16/23 23:22:00.623 (10.393s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:00.623 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:00.983 (361ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:00.985 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:09.37 (8.419s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:22:09.37 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:22:20.486 (11.116s) > Enter [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 07/16/23 23:22:20.486 < Exit [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 07/16/23 23:22:30.763 (10.277s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:30.763 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:31.515 (787ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:31.521 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:40.235 (8.714s) > Enter [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 07/16/23 23:22:40.235 < Exit [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 07/16/23 23:22:54.509 (14.274s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:54.509 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:55.102 (593ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:55.104 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:03.655 (8.585s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:23:03.655 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:23:14.739 (11.084s) > Enter [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 07/16/23 23:23:14.739 < Exit [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 07/16/23 23:23:25.032 (10.292s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.032 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.8 (768ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:23:25.803 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:23:27.816 (2.013s) > Enter [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 07/16/23 23:23:27.816 < Exit [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 07/16/23 23:23:36.925 (9.144s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:23:36.925 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:23:36.938 (13ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:36.94 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:45.412 (8.472s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:23:45.412 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:23:49.52 (4.108s) > Enter [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 07/16/23 23:23:49.52 < Exit [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 07/16/23 23:23:59.723 (10.203s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:59.723 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:00.261 (538ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:00.263 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:07.782 (7.554s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:07.782 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:11.858 (4.076s) > Enter [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 07/16/23 23:24:11.858 < Exit [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 07/16/23 23:24:22.095 (10.237s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:22.095 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:22.827 (732ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:22.835 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:31.215 (8.414s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:24:31.215 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:24:33.268 (2.053s) > Enter [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 07/16/23 23:24:33.268 < Exit [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 07/16/23 23:24:50.51 (17.242s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:50.51 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:51.166 (657ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:24:51.166 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:24:51.166 (0s) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:51.169 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:00.029 (8.86s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:25:00.029 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:25:08.096 (8.101s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 07/16/23 23:25:08.096 STEP: routing requests to the canary upstream when header pattern is matched - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:514 @ 07/16/23 23:25:25.318 STEP: routing requests to the mainline upstream when header failed to match header value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:523 @ 07/16/23 23:25:25.328 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 07/16/23 23:25:25.338 (17.243s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:25.339 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:25.856 (517ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:25.858 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:34.445 (8.622s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:25:34.445 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:25:45.53 (11.085s) > Enter [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 07/16/23 23:25:45.53 < Exit [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 07/16/23 23:25:55.715 (10.185s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:55.715 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:56.172 (456ms) + + + > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:56.173 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:04.819 (8.68s) > Enter [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 07/16/23 23:26:04.819 STEP: setting permanent-redirect annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:34 @ 07/16/23 23:26:04.819 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:52 @ 07/16/23 23:26:15.073 < Exit [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 07/16/23 23:26:15.081 (10.263s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:15.081 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:15.564 (482ms) + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:15.565 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:23.961 (8.396s) > Enter [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 07/16/23 23:26:23.961 STEP: basic HTTP GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.963 STEP: basic HTTP GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.977 STEP: basic HTTPS GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.992 STEP: basic HTTPS GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.017 STEP: basic HTTP POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.044 STEP: basic HTTP POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.06 STEP: basic HTTPS POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.371 STEP: basic HTTPS POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.776 STEP: basic HTTP GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.197 STEP: basic HTTP GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.574 STEP: basic HTTPS GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.98 STEP: basic HTTPS GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:31.34 STEP: basic HTTP POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:31.743 STEP: basic HTTP POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.136 STEP: basic HTTPS POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.539 STEP: basic HTTPS POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.97 < Exit [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 07/16/23 23:26:33.344 (9.418s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:33.344 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:33.883 (539ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:33.885 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:41.697 (7.812s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:26:41.697 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:26:45.787 (4.089s) > Enter [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 07/16/23 23:26:45.787 < Exit [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 07/16/23 23:27:16.141 (30.389s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.141 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.729 (588ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:27:16.729 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:27:16.729 (0s) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:16.734 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:27.28 (10.546s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:27.28 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:35.372 (8.127s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 07/16/23 23:27:35.373 STEP: routing requests to the canary upstream when header is set to 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:451 @ 07/16/23 23:27:52.596 STEP: routing requests to the mainline upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:460 @ 07/16/23 23:27:52.607 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:469 @ 07/16/23 23:27:52.618 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:478 @ 07/16/23 23:27:52.624 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 07/16/23 23:27:52.632 (17.259s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:52.632 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:53.184 (552ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:53.185 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:01.521 (8.37s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:01.521 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:05.603 (4.082s) > Enter [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 07/16/23 23:28:05.603 < Exit [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 07/16/23 23:28:22.87 (17.267s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:22.87 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:23.292 (422ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:28:23.292 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:28:23.292 (0s) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:23.293 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:31.555 (8.296s) > Enter [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 07/16/23 23:28:31.555 < Exit [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 07/16/23 23:28:48.825 (17.268s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:48.825 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:49.416 (591ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.42 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:57.983 (8.563s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:57.983 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:29:02.021 (4.072s) > Enter [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 07/16/23 23:29:02.021 < Exit [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 07/16/23 23:29:19.271 (17.25s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:19.271 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:19.996 (725ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:29:19.996 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:29:19.996 (0s) + + + > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:19.999 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:27.495 (7.496s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:29:27.495 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:29:31.525 (4.064s) > Enter [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 07/16/23 23:29:31.525 < Exit [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 07/16/23 23:29:48.787 (17.262s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:48.787 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:49.468 (682ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:49.475 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:58.075 (8.6s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:29:58.075 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:30:09.134 (11.098s) > Enter [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 07/16/23 23:30:09.134 < Exit [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 07/16/23 23:30:19.281 (10.147s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:19.281 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:19.775 (494ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:19.783 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:29.478 (9.696s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:30:29.478 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:30:33.47 (4.057s) > Enter [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 07/16/23 23:30:33.471 < Exit [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 07/16/23 23:30:54.972 (21.502s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:54.973 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:00.749 (5.815s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:31:00.749 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:31:00.749 (0s) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:00.828 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:08.468 (7.64s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:31:08.468 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:31:16.616 (8.148s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 07/16/23 23:31:16.616 < Exit [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 07/16/23 23:31:42.294 (25.713s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:42.294 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:42.864 (569ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:42.867 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:51.421 (8.554s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:51.421 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:55.49 (4.069s) > Enter [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 07/16/23 23:31:55.49 < Exit [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 07/16/23 23:32:06.723 (11.267s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:06.723 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:07.164 (442ms) + + + > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:07.168 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:14.509 (7.341s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:14.509 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:25.596 (11.087s) > Enter [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 07/16/23 23:32:25.596 < Exit [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 07/16/23 23:32:42.761 (17.199s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.761 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.179 (418ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:43.184 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:51.238 (8.053s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 07/16/23 23:32:51.238 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 07/16/23 23:33:01.441 (10.238s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.442 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:02.003 (562ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:02.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.575 (9.568s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:33:11.575 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:33:19.722 (8.147s) > Enter [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 07/16/23 23:33:19.722 < Exit [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 07/16/23 23:34:15.058 (55.405s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:15.058 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:15.476 (418ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:15.477 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:23.831 (8.354s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:23.831 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:27.893 (4.061s) > Enter [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 07/16/23 23:34:27.893 < Exit [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 07/16/23 23:34:38.318 (10.46s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:38.318 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:38.801 (483ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:38.803 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:48.547 (9.744s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:34:48.547 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:34:52.605 (4.058s) > Enter [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 07/16/23 23:34:52.605 < Exit [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 07/16/23 23:35:02.751 (10.18s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:02.751 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.297 (546ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:03.312 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:11.68 (8.368s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:35:11.68 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:35:22.776 (11.096s) > Enter [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 07/16/23 23:35:22.776 < Exit [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 07/16/23 23:35:32.97 (10.229s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:32.97 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:33.388 (418ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:33.39 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:41.909 (8.519s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:35:41.909 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:35:43.975 (2.066s) > Enter [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 07/16/23 23:35:43.975 < Exit [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 07/16/23 23:35:54.184 (10.209s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.184 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.637 (453ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:54.638 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:04.492 (9.888s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:04.492 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:10.59 (6.098s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 07/16/23 23:36:10.59 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 07/16/23 23:36:21.417 (10.826s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.417 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.909 (492ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:21.91 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:31.441 (9.565s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:36:31.441 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:36:39.575 (8.135s) > Enter [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 07/16/23 23:36:39.575 < Exit [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 07/16/23 23:36:56.821 (17.246s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:56.821 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:57.222 (400ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:57.223 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:07.971 (10.783s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:37:07.971 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:37:19.071 (11.099s) > Enter [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 07/16/23 23:37:19.071 < Exit [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 07/16/23 23:37:29.282 (10.212s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:29.283 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:29.692 (409ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:29.693 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:38.006 (8.347s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:37:38.006 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:37:58.271 (20.264s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 07/16/23 23:37:58.271 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 07/16/23 23:38:02.529 (4.293s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.529 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.964 (434ms) + + + > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:02.971 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:11.459 (8.488s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:38:11.459 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:38:22.582 (11.122s) > Enter [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 07/16/23 23:38:22.582 < Exit [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 07/16/23 23:38:32.759 (10.211s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:32.759 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:33.178 (419ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:33.18 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:41.812 (8.632s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:38:41.812 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:38:49.899 (8.087s) > Enter [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 07/16/23 23:38:49.899 < Exit [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 07/16/23 23:39:07.104 (17.239s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.104 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.608 (504ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:07.617 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:15.244 (7.627s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:39:15.244 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:39:21.419 (6.176s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:39:21.42 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:39:38.597 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:39:46.821 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:39:46.84 (25.455s) > Enter [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 07/16/23 23:39:46.841 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:163 @ 07/16/23 23:39:52.033 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:169 @ 07/16/23 23:39:55.176 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:180 @ 07/16/23 23:39:58.206 < Exit [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 07/16/23 23:39:58.206 (11.366s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.206 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.754 (548ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:58.76 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:07.505 (8.774s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:40:07.505 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:40:13.578 (6.073s) > Enter [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 07/16/23 23:40:13.578 < Exit [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 07/16/23 23:40:30.774 (17.231s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:30.774 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:31.257 (483ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:40:31.257 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:40:31.258 (0s) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:31.26 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:39.618 (8.359s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:40:39.619 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:40:45.749 (6.13s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:40:45.749 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:40:50.946 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:41:01.126 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:41:11.35 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:41:21.559 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:41:36.857 (51.177s) > Enter [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 07/16/23 23:41:36.857 < Exit [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 07/16/23 23:41:43.93 (7.073s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:43.93 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:44.372 (442ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.287 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:49.044 (14.757s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:07:49.044 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:05.568 (16.559s) > Enter [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 07/16/23 23:08:05.569 < Exit [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 07/16/23 23:08:27.887 (22.318s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:27.887 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:28.576 (689ms) + + + > Enter [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:28.582 < Exit [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:36.857 (8.309s) > Enter [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 07/16/23 23:08:36.857 < Exit [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 07/16/23 23:08:57.345 (20.488s) > Enter [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:57.345 < Exit [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:57.948 (603ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:57.95 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:06.944 (9.028s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:09:06.944 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:09:25.075 (18.131s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:09:25.075 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:09:25.075 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:09:35.276 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:09:45.533 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:09:55.741 (30.7s) > Enter [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 07/16/23 23:09:55.741 STEP: Adding a global-auth-request-redirect to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:242 @ 07/16/23 23:09:55.741 < Exit [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 07/16/23 23:10:05.886 (10.18s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:05.886 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:06.357 (471ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:06.359 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:15.633 (9.274s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:10:15.633 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:10:26.724 (11.091s) > Enter [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 07/16/23 23:10:26.724 < Exit [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 07/16/23 23:10:40.107 (13.418s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:40.107 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:40.707 (600ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:40.727 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:49.212 (8.485s) > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 07/16/23 23:10:49.212 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 07/16/23 23:11:00.338 (11.126s) > Enter [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 07/16/23 23:11:00.338 Jul 16 23:11:14.762: INFO: Request distribution: map[echo-7b6bf466cc-k5lq4:6 echo-7b6bf466cc-xhgrs:9 echo-7b6bf466cc-zm2tc:15] < Exit [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 07/16/23 23:11:14.762 (14.48s) > Enter [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:14.762 < Exit [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:15.337 (574ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:15.344 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:23.899 (8.554s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:11:23.899 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:11:28.014 (4.115s) > Enter [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 07/16/23 23:11:28.014 < Exit [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 07/16/23 23:11:45.272 (17.315s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:45.272 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:46.053 (781ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:46.055 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:54.592 (8.537s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:11:54.592 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:12:02.74 (8.185s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:12:02.741 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:12:02.741 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:12:12.97 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:12:23.365 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:12:33.703 (30.997s) > Enter [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 07/16/23 23:12:33.703 STEP: Adding a global-auth-signin to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:215 @ 07/16/23 23:12:33.703 < Exit [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 07/16/23 23:12:43.93 (10.227s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:43.93 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:44.68 (750ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:44.681 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:53.488 (8.807s) > Enter [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 07/16/23 23:12:53.488 < Exit [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 07/16/23 23:13:16.154 (22.701s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:16.154 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:16.68 (526ms) + + + > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:16.682 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:24.418 (7.736s) > Enter [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 07/16/23 23:13:24.418 < Exit [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 07/16/23 23:13:43.022 (18.638s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:43.022 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:43.557 (535ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:43.569 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:52.109 (8.54s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:13:52.109 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:14:00.22 (8.111s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:14:00.22 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:14:00.221 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:14:10.357 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:14:20.687 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:14:31.22 (31.034s) > Enter [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 07/16/23 23:14:31.221 STEP: Adding a global-auth-cache-key to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:163 @ 07/16/23 23:14:31.221 < Exit [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 07/16/23 23:14:56.908 (25.722s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:56.908 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.868 (959ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:57.873 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:07.775 (9.936s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:15:07.775 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:15:11.846 (4.07s) > Enter [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 07/16/23 23:15:11.846 < Exit [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 07/16/23 23:15:22.158 (10.312s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.158 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.583 (425ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:22.584 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.03 (8.446s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:15:31.03 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:15:35.048 (4.052s) > Enter [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 07/16/23 23:15:35.048 < Exit [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 07/16/23 23:15:45.303 (10.255s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:45.303 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:45.943 (640ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:45.959 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:54.309 (8.35s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:15:54.309 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:15:58.369 (4.06s) > Enter [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 07/16/23 23:15:58.369 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:113 @ 07/16/23 23:16:15.745 STEP: checking if the Service Cluster IP and Port are not used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:120 @ 07/16/23 23:16:15.754 < Exit [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 07/16/23 23:16:15.932 (17.597s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:15.932 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:16.329 (396ms) + + + > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:16.33 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:24.942 (8.612s) > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 07/16/23 23:16:24.942 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 07/16/23 23:16:29.022 (4.08s) > Enter [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 07/16/23 23:16:29.022 < Exit [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 07/16/23 23:16:39.31 (10.323s) > Enter [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.31 < Exit [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.98 (670ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:39.982 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:49.837 (9.855s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:16:49.837 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:17:00.937 (11.1s) > Enter [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 07/16/23 23:17:00.938 < Exit [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 07/16/23 23:17:11.121 (10.218s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:11.121 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:11.607 (486ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:11.608 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:20.212 (8.604s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:17:20.212 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:17:28.342 (8.13s) > Enter [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 07/16/23 23:17:28.342 < Exit [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 07/16/23 23:18:23.842 (55.569s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:23.843 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:24.502 (659ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:24.505 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:31.714 (7.243s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:31.714 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:35.862 (4.148s) > Enter [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 07/16/23 23:18:35.862 < Exit [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 07/16/23 23:18:46.046 (10.184s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:46.046 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:46.546 (500ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:46.548 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:53.971 (7.423s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:53.971 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:58.059 (4.088s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:58.059 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:12.335 (14.31s) > Enter [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 07/16/23 23:19:12.335 < Exit [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 07/16/23 23:19:35.576 (23.275s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:35.576 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:36.255 (679ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:36.256 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:43.637 (7.381s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:19:43.637 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:19:57.933 (14.296s) > Enter [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 07/16/23 23:19:57.933 < Exit [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 07/16/23 23:20:04.479 (6.58s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:04.479 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:05.013 (534ms) + + + + > Enter [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:05.015 < Exit [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:14.859 (9.844s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 07/16/23 23:20:14.859 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:53 @ 07/16/23 23:20:14.864 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 07/16/23 23:20:14.864 (5ms) > Enter [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:14.864 < Exit [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:15.695 (831ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:15.697 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:23.308 (7.611s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:20:23.308 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:20:27.397 (4.089s) > Enter [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 07/16/23 23:20:27.397 < Exit [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 07/16/23 23:20:37.584 (10.221s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:37.584 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:38.237 (653ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:38.239 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:46.709 (8.47s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:46.709 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:50.775 (4.066s) > Enter [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 07/16/23 23:20:50.775 < Exit [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 07/16/23 23:21:01.786 (11.046s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:01.786 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:02.175 (389ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:02.177 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:10.721 (8.544s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:21:10.721 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:21:14.801 (4.08s) > Enter [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 07/16/23 23:21:14.801 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:161 @ 07/16/23 23:21:14.801 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:165 @ 07/16/23 23:21:21.843 STEP: check that '/foo/bar/bar' does not match the longest exact path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:179 @ 07/16/23 23:21:32.042 < Exit [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 07/16/23 23:21:32.048 (17.282s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:32.048 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:32.461 (413ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:32.463 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:39.797 (7.334s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:21:39.797 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:21:43.865 (4.068s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:21:43.865 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:21:51.955 (8.09s) > Enter [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 07/16/23 23:21:51.955 < Exit [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 07/16/23 23:22:02.145 (10.223s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:02.145 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:02.564 (419ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:02.566 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:11.193 (8.627s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:22:11.193 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:22:22.303 (11.11s) > Enter [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 07/16/23 23:22:22.303 < Exit [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 07/16/23 23:22:32.765 (10.496s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:32.765 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:33.67 (906ms) + + + > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:33.674 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:42.623 (8.949s) > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 07/16/23 23:22:42.623 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 07/16/23 23:22:46.677 (4.054s) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 07/16/23 23:22:46.677 STEP: adding a whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:42 @ 07/16/23 23:22:53.713 STEP: changing error-log-level - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:61 @ 07/16/23 23:23:03.876 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 07/16/23 23:23:17.205 (30.562s) > Enter [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:17.205 < Exit [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:17.616 (412ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:17.617 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:25.915 (8.298s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:23:25.916 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:23:40.996 (15.114s) > Enter [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 07/16/23 23:23:40.996 < Exit [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 07/16/23 23:23:51.243 (10.247s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.243 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.888 (645ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:51.89 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:02.36 (10.505s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:02.36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:06.483 (4.123s) > Enter [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 07/16/23 23:24:06.483 < Exit [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 07/16/23 23:24:16.671 (10.187s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:16.671 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:17.137 (467ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:17.14 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:25.522 (8.382s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:24:25.522 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:24:29.596 (4.073s) > Enter [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 07/16/23 23:24:29.596 < Exit [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 07/16/23 23:24:39.753 (10.192s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.753 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:40.161 (408ms) + + + > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:40.163 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:48.151 (7.988s) > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 07/16/23 23:24:48.151 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 07/16/23 23:24:59.271 (11.12s) > Enter [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 07/16/23 23:24:59.271 < Exit [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 07/16/23 23:25:10.518 (11.281s) > Enter [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:10.518 < Exit [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:10.966 (448ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:10.967 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:18.468 (7.501s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:25:18.468 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:25:22.573 (4.105s) > Enter [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 07/16/23 23:25:22.573 < Exit [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 07/16/23 23:25:39.828 (17.29s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:39.828 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:40.22 (391ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:40.221 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:47.582 (7.361s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:25:47.582 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:25:51.699 (4.117s) > Enter [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 07/16/23 23:25:51.699 < Exit [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 07/16/23 23:26:10.03 (18.365s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.03 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.792 (762ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:10.796 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:18.517 (7.721s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:26:18.517 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:26:29.612 (11.095s) > Enter [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 07/16/23 23:26:29.612 < Exit [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 07/16/23 23:26:39.848 (10.27s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:39.848 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:40.318 (470ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:40.322 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:49.062 (8.74s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:26:49.062 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:26:57.227 (8.165s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 07/16/23 23:26:57.227 STEP: routing requests to the canary upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:395 @ 07/16/23 23:27:14.5 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:404 @ 07/16/23 23:27:14.506 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:414 @ 07/16/23 23:27:14.512 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 07/16/23 23:27:14.518 (17.326s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:14.518 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:14.982 (464ms) + + + > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:14.983 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:23.621 (8.637s) > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 07/16/23 23:27:23.621 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 07/16/23 23:27:27.678 (4.058s) > Enter [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 07/16/23 23:27:27.678 < Exit [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 07/16/23 23:27:44.864 (17.219s) > Enter [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:44.864 < Exit [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.355 (491ms) + + + > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:45.356 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.361 (9.004s) > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 07/16/23 23:27:54.361 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 07/16/23 23:27:58.446 (4.085s) > Enter [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 07/16/23 23:27:58.446 < Exit [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 07/16/23 23:28:08.662 (10.25s) > Enter [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:08.662 < Exit [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:09.492 (830ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:09.495 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:18.198 (8.703s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:28:18.198 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:28:20.266 (2.068s) > Enter [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 07/16/23 23:28:20.266 < Exit [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 07/16/23 23:28:30.476 (10.21s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:30.476 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:31.049 (608ms) + + + > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:31.05 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:39.51 (8.46s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:28:39.51 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:28:43.584 (4.073s) > Enter [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 07/16/23 23:28:43.584 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:61 @ 07/16/23 23:29:00.77 STEP: sending request from an explicitly denied IP address - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:69 @ 07/16/23 23:29:00.776 STEP: sending request from an implicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:77 @ 07/16/23 23:29:00.783 < Exit [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 07/16/23 23:29:07.785 (24.235s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:07.785 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:08.219 (434ms) + + + > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:08.222 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:16.588 (8.366s) > Enter [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 07/16/23 23:29:16.588 < Exit [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 07/16/23 23:29:26.783 (10.195s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:26.783 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:27.308 (525ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:27.309 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:35.546 (8.271s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:29:35.546 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:29:39.603 (4.057s) > Enter [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 07/16/23 23:29:39.603 < Exit [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 07/16/23 23:29:56.89 (17.287s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:56.89 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:57.255 (365ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:29:57.255 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:29:57.255 (0s) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:57.258 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:07.638 (10.419s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:30:07.638 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:30:15.827 (8.189s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:30:15.827 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:30:15.827 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:30:26.122 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:30:36.224 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:30:48.339 (32.577s) > Enter [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 07/16/23 23:30:48.339 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:87 @ 07/16/23 23:30:48.339 STEP: Sending a request to protected service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:94 @ 07/16/23 23:30:48.391 < Exit [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 07/16/23 23:30:48.504 (165ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:48.504 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:55.877 (7.373s) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:55.918 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:09.07 (13.19s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:31:09.07 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:31:11.17 (2.1s) > Enter [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 07/16/23 23:31:11.17 < Exit [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 07/16/23 23:31:31.176 (20.041s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:31.176 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:31.616 (439ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:31:31.616 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:31:31.616 (0s) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:31.67 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:40.298 (8.628s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:40.298 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:44.4 (4.102s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:31:44.402 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:31:49.602 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:31:59.831 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:32:09.984 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:32:20.215 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:32:35.406 (51.073s) > Enter [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 07/16/23 23:32:35.406 STEP: receiving an internal server error without cache on location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:811 @ 07/16/23 23:32:42.457 < Exit [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 07/16/23 23:33:42.399 (1m7.062s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:42.4 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:42.892 (492ms) + + + + > Enter [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:42.896 < Exit [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:51.181 (8.285s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 07/16/23 23:33:51.181 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:56 @ 07/16/23 23:33:51.184 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 07/16/23 23:33:51.184 (3ms) > Enter [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:51.184 < Exit [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:51.664 (480ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:51.666 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:00.007 (8.341s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:34:00.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:34:08.102 (8.129s) > Enter [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 07/16/23 23:34:08.102 STEP: routing requests destined fro the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:288 @ 07/16/23 23:34:29.661 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:297 @ 07/16/23 23:34:29.668 < Exit [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 07/16/23 23:34:29.676 (21.575s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:29.676 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:30.248 (571ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:30.253 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:39.68 (9.461s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:34:39.68 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:34:45.772 (6.092s) > Enter [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 07/16/23 23:34:45.772 < Exit [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 07/16/23 23:34:54.823 (9.051s) > Enter [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 07/16/23 23:34:54.823 < Exit [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 07/16/23 23:35:19.068 (24.279s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:19.068 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:19.459 (391ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:19.461 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:27.831 (8.37s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:35:27.831 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:35:31.866 (4.07s) > Enter [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 07/16/23 23:35:31.866 < Exit [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 07/16/23 23:35:38.908 (7.042s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:38.908 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:39.497 (588ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:39.502 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:48.362 (8.86s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:35:48.362 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:36:02.591 (14.263s) > Enter [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 07/16/23 23:36:02.591 < Exit [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 07/16/23 23:36:15.012 (12.421s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:15.012 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:15.419 (407ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:15.421 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:22.799 (7.379s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:36:22.799 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:36:26.895 (4.096s) > Enter [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 07/16/23 23:36:26.895 < Exit [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 07/16/23 23:36:44.072 (17.211s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:44.072 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:44.573 (501ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:36:44.573 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:36:44.573 (0s) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:44.575 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:52.863 (8.288s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:36:52.863 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:37:03.994 (11.165s) > Enter [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 07/16/23 23:37:03.994 < Exit [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 07/16/23 23:37:17.209 (13.215s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:17.209 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:17.698 (489ms) + + + > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:17.7 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:25.25 (7.55s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:37:25.25 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:37:29.308 (4.058s) > Enter [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 07/16/23 23:37:29.308 < Exit [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 07/16/23 23:37:39.541 (10.267s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:39.541 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:40.249 (708ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:40.25 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:50.903 (10.653s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:37:50.903 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:37:56.972 (6.069s) > Enter [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 07/16/23 23:37:56.972 < Exit [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 07/16/23 23:38:04.012 (7.074s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:04.012 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:04.575 (562ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:04.576 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:13.092 (8.516s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:38:13.092 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:38:21.224 (8.132s) > Enter [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 07/16/23 23:38:21.224 < Exit [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 07/16/23 23:38:38.446 (17.256s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.446 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.972 (525ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:38.973 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:47.576 (8.603s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:47.576 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:39:00.694 (13.151s) > Enter [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 07/16/23 23:39:00.694 < Exit [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 07/16/23 23:39:10.972 (10.278s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:10.972 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:11.554 (582ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:11.557 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:21.757 (10.2s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:21.757 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:25.828 (4.071s) > Enter [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 07/16/23 23:39:25.828 < Exit [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 07/16/23 23:39:35.962 (10.168s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:35.962 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.474 (511ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:36.475 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:45.251 (8.776s) > Enter [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 07/16/23 23:39:45.251 < Exit [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 07/16/23 23:39:55.449 (10.198s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:55.449 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:55.846 (396ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:55.848 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:04.392 (8.579s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:04.392 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:12.535 (8.142s) > Enter [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 07/16/23 23:40:12.535 < Exit [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 07/16/23 23:40:22.872 (10.337s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:22.872 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:23.35 (478ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:23.353 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:31.723 (8.405s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:40:31.724 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:40:35.786 (4.063s) > Enter [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 07/16/23 23:40:35.786 < Exit [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 07/16/23 23:40:53.138 (17.352s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:53.138 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:54.07 (932ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:54.097 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:02.625 (8.562s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:41:02.625 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:41:06.715 (4.09s) > Enter [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 07/16/23 23:41:06.715 < Exit [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 07/16/23 23:41:20.837 (14.122s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:20.837 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:21.278 (441ms) + + + > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:21.3 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:29.247 (7.948s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:41:29.248 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:41:31.27 (2.057s) > Enter [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 07/16/23 23:41:31.27 < Exit [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 07/16/23 23:41:48.597 (17.327s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:48.597 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:48.993 (395ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.242 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:51.069 (16.827s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:07:51.069 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:08:07.17 (16.135s) > Enter [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 07/16/23 23:08:07.17 < Exit [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 07/16/23 23:08:18.073 (10.903s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:18.073 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:21.927 (3.855s) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:21.964 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:34.164 (12.234s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:08:34.164 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:08:38.275 (4.111s) > Enter [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 07/16/23 23:08:38.275 < Exit [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 07/16/23 23:08:55.61 (17.335s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:55.61 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:56.065 (455ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:56.067 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:04.727 (8.695s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 07/16/23 23:09:04.727 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 07/16/23 23:09:15.337 (10.61s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:15.337 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:16.059 (722ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:16.064 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:26.631 (10.567s) > Enter [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 07/16/23 23:09:26.631 < Exit [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 07/16/23 23:09:43.812 (17.216s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:43.816 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:44.481 (664ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:44.483 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:52.854 (8.371s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:09:52.854 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:09:56.947 (4.093s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:09:56.947 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:10:14.472 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:10:22.717 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:10:22.74 (25.827s) > Enter [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 07/16/23 23:10:22.74 < Exit [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 07/16/23 23:10:27.764 (5.024s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:27.764 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:28.249 (485ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:28.252 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:36.867 (8.65s) > Enter [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 07/16/23 23:10:36.867 < Exit [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 07/16/23 23:10:54.131 (17.264s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:54.131 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:54.62 (489ms) + + + > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:54.623 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:02.922 (8.355s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:11:02.922 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:11:07.043 (4.12s) > Enter [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 07/16/23 23:11:07.043 < Exit [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 07/16/23 23:11:36.273 (29.286s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:36.273 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:36.734 (462ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:36.736 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:45.28 (8.543s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:11:45.28 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:11:49.471 (4.191s) > Enter [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 07/16/23 23:11:49.471 < Exit [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 07/16/23 23:11:59.696 (10.224s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:59.696 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:00.22 (525ms) + + + > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:00.222 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:07.673 (7.488s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:12:07.673 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:12:11.802 (4.129s) > Enter [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 07/16/23 23:12:11.802 < Exit [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 07/16/23 23:12:29.118 (17.317s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:29.119 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:29.598 (479ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:29.6 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:38.338 (8.773s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:38.338 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:42.421 (4.083s) > Enter [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 07/16/23 23:12:42.421 < Exit [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 07/16/23 23:12:53.144 (10.723s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:53.144 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:53.923 (779ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:53.953 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:02.253 (8.335s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:13:02.254 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:13:06.383 (4.13s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:13:06.383 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:13:20.773 (14.39s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 07/16/23 23:13:20.773 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 07/16/23 23:13:20.8 (27ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:20.8 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:21.451 (651ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:21.454 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.274 (10.854s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:13:32.274 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:13:51.868 (19.594s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 07/16/23 23:13:51.868 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 07/16/23 23:13:55.053 (3.185s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:55.053 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:55.451 (398ms) + + + > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:55.453 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:03.927 (8.508s) > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 07/16/23 23:14:03.927 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 07/16/23 23:14:08.019 (4.092s) > Enter [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 07/16/23 23:14:08.019 < Exit [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 07/16/23 23:14:15.059 (7.04s) > Enter [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.059 < Exit [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.545 (486ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:15.546 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:25.303 (9.757s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:14:25.303 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:14:31.39 (6.086s) > Enter [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 07/16/23 23:14:31.39 < Exit [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 07/16/23 23:14:38.906 (7.55s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:38.906 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:50.983 (12.078s) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:51.107 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:05.828 (14.755s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:15:05.828 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:15:05.835 (7ms) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 07/16/23 23:15:05.835 STEP: setting up a first deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:171 @ 07/16/23 23:15:05.835 STEP: updating the tcp service to a second deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:196 @ 07/16/23 23:15:13.198 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 07/16/23 23:15:23.493 (17.658s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.493 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.916 (423ms) + + + > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:23.918 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:32.462 (8.579s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:15:32.462 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:15:36.539 (4.076s) > Enter [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 07/16/23 23:15:36.539 < Exit [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 07/16/23 23:16:08.955 (32.451s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:08.955 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:09.389 (434ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.392 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:17.757 (8.366s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:16:17.757 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:16:21.842 (4.084s) > Enter [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 07/16/23 23:16:21.842 < Exit [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 07/16/23 23:16:28.878 (7.036s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:28.878 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:29.277 (399ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:29.279 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:36.677 (7.433s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:16:36.678 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:16:40.761 (4.083s) > Enter [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 07/16/23 23:16:40.761 < Exit [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 07/16/23 23:16:50.994 (10.233s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:50.994 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:51.379 (385ms) + + + > Enter [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:51.381 < Exit [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:59.709 (8.329s) > Enter [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 07/16/23 23:16:59.71 < Exit [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 07/16/23 23:17:09.861 (10.185s) > Enter [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:09.861 < Exit [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.282 (421ms) + + + > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:10.283 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:18.723 (8.44s) > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 07/16/23 23:17:18.724 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 07/16/23 23:17:22.807 (4.083s) > Enter [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 07/16/23 23:17:22.807 < Exit [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 07/16/23 23:17:50.668 (27.896s) > Enter [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:50.668 < Exit [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:51.179 (511ms) + + + > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:51.181 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:59.818 (8.637s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:17:59.819 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:18:03.954 (4.169s) > Enter [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 07/16/23 23:18:03.954 < Exit [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 07/16/23 23:18:36.609 (32.69s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:36.609 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:37.003 (394ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:37.005 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:45.497 (8.492s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:18:45.497 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:18:56.635 (11.138s) > Enter [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 07/16/23 23:18:56.635 < Exit [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 07/16/23 23:19:06.818 (10.218s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:06.819 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:07.2 (381ms) + + + > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:07.202 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:15.79 (8.588s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:19:15.79 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:19:19.867 (4.077s) > Enter [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 07/16/23 23:19:19.867 < Exit [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 07/16/23 23:19:30.126 (10.259s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:30.126 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:30.554 (428ms) + + + > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:30.555 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:38.942 (8.421s) > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 07/16/23 23:19:38.942 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 07/16/23 23:19:43.029 (4.087s) > Enter [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 07/16/23 23:19:43.029 < Exit [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 07/16/23 23:19:53.271 (10.241s) > Enter [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:53.271 < Exit [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:53.823 (553ms) + + + > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:53.836 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:02.051 (8.25s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:20:02.051 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:20:06.14 (4.089s) > Enter [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 07/16/23 23:20:06.14 < Exit [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 07/16/23 23:20:23.477 (17.337s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:23.477 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:23.967 (489ms) + + + > Enter [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:23.968 < Exit [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:32.478 (8.544s) > Enter [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 07/16/23 23:20:32.478 < Exit [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 07/16/23 23:20:48.821 (16.343s) > Enter [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:48.821 < Exit [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:49.341 (520ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:49.348 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:57.865 (8.517s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:57.865 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:21:01.925 (4.094s) > Enter [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 07/16/23 23:21:01.925 < Exit [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 07/16/23 23:21:13.025 (11.101s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.025 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.59 (565ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:13.591 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:23.49 (9.898s) > Enter [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 07/16/23 23:21:23.49 < Exit [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 07/16/23 23:21:33.747 (10.292s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:33.747 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:34.172 (424ms) + + + > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:34.173 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:43.009 (8.836s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:21:43.009 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:21:47.1 (4.091s) > Enter [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 07/16/23 23:21:47.1 < Exit [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 07/16/23 23:22:04.345 (17.279s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.345 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.959 (614ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:04.961 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:13.436 (8.476s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:22:13.436 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:22:17.548 (4.111s) > Enter [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 07/16/23 23:22:17.548 < Exit [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 07/16/23 23:22:27.746 (10.199s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.746 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:28.164 (417ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:28.165 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:36.999 (8.868s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:36.999 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:41.09 (4.09s) > Enter [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 07/16/23 23:22:41.09 < Exit [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 07/16/23 23:22:51.266 (10.177s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:51.266 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:51.761 (495ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:51.771 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:00.105 (8.333s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:00.105 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:04.146 (4.075s) > Enter [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 07/16/23 23:23:04.146 < Exit [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 07/16/23 23:23:21.518 (17.372s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.518 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.932 (414ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:21.932 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:21.932 (0s) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:21.935 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:31.384 (9.483s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:31.384 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:35.475 (4.091s) > Enter [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 07/16/23 23:23:35.475 < Exit [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 07/16/23 23:23:55.524 (20.049s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:55.524 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:56.075 (551ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:56.075 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:56.075 (0s) + + + > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:56.077 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:04.518 (8.476s) > Enter [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 07/16/23 23:24:04.518 < Exit [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 07/16/23 23:24:18.775 (14.257s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:18.775 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:19.228 (452ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:19.229 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:27.5 (8.272s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:27.501 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:31.562 (4.096s) > Enter [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 07/16/23 23:24:31.562 < Exit [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 07/16/23 23:24:42.129 (10.566s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:42.129 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:42.874 (745ms) + + + > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:42.875 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:51.845 (8.97s) > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 07/16/23 23:24:51.845 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 07/16/23 23:24:55.921 (4.076s) > Enter [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 07/16/23 23:24:55.921 < Exit [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 07/16/23 23:25:18.165 (22.279s) > Enter [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:18.165 < Exit [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:18.624 (459ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:18.626 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:26.989 (8.37s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:25:26.996 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:25:31.086 (4.091s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:25:31.087 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:25:52.393 (21.341s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 07/16/23 23:25:52.393 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 07/16/23 23:25:52.403 (10ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:52.403 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:52.851 (448ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:52.853 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:01.147 (8.328s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:26:01.147 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:26:05.234 (4.087s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:26:05.234 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:26:22.995 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:26:31.133 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:26:31.179 (25.98s) > Enter [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 07/16/23 23:26:31.179 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:229 @ 07/16/23 23:26:36.206 < Exit [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 07/16/23 23:26:36.237 (5.058s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:36.237 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:37.018 (782ms) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:37.021 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:45.616 (8.596s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:26:45.616 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:26:49.683 (4.066s) > Enter [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 07/16/23 23:26:49.683 < Exit [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 07/16/23 23:27:06.949 (17.301s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:06.949 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:07.445 (496ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:07.447 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:15.777 (8.33s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:27:15.778 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:27:30.909 (15.132s) > Enter [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 07/16/23 23:27:30.909 < Exit [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 07/16/23 23:27:45.291 (14.415s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.291 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.766 (475ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:45.767 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.396 (8.629s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:54.396 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:58.524 (4.127s) > Enter [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 07/16/23 23:27:58.524 < Exit [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 07/16/23 23:28:08.725 (10.235s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:08.725 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:09.625 (900ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:09.63 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:17.428 (7.798s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:28:17.428 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:28:21.486 (4.058s) > Enter [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 07/16/23 23:28:21.486 < Exit [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 07/16/23 23:28:31.88 (10.429s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:31.88 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:32.319 (438ms) + + + > Enter [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:32.324 < Exit [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:41.907 (9.584s) > Enter [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 07/16/23 23:28:41.907 STEP: checking SSL Certificate using the NGINX IP address - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:30 @ 07/16/23 23:28:41.908 STEP: checking SSL Certificate using the NGINX catch all server - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:45 @ 07/16/23 23:28:46.925 < Exit [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 07/16/23 23:28:46.943 (5.036s) > Enter [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:46.943 < Exit [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:47.34 (397ms) + + + > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:47.341 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:55.857 (8.516s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:28:55.857 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:28:59.917 (4.06s) > Enter [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 07/16/23 23:28:59.917 < Exit [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 07/16/23 23:29:17.172 (17.289s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:17.172 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:17.73 (558ms) + + + > Enter [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:17.734 < Exit [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:26.783 (9.049s) > Enter [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 07/16/23 23:29:26.783 < Exit [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 07/16/23 23:29:37.377 (10.63s) > Enter [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:37.377 < Exit [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:37.857 (480ms) + + + > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:37.859 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:45.315 (7.456s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:29:45.315 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:29:49.393 (4.078s) > Enter [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 07/16/23 23:29:49.393 < Exit [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 07/16/23 23:29:59.716 (10.323s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:59.716 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:00.218 (501ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:00.22 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:08.82 (8.64s) > Enter [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 07/16/23 23:30:08.82 < Exit [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 07/16/23 23:30:23.242 (14.421s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:23.242 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:23.721 (479ms) + + + > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:23.724 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:32.155 (8.497s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:30:32.155 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:30:36.238 (4.083s) > Enter [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 07/16/23 23:30:36.238 < Exit [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 07/16/23 23:31:06.15 (29.95s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:06.15 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:06.581 (431ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:06.583 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:15.201 (8.619s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:31:15.201 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:31:19.262 (4.061s) > Enter [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 07/16/23 23:31:19.262 < Exit [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 07/16/23 23:31:29.469 (10.206s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:29.469 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:29.882 (413ms) + + + > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:29.885 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:40.12 (10.27s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:31:40.12 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:31:44.185 (4.066s) > Enter [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 07/16/23 23:31:44.185 < Exit [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 07/16/23 23:31:54.361 (10.176s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:54.361 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:54.803 (442ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:54.805 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:03.07 (8.3s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:32:03.07 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:32:07.143 (4.072s) > Enter [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 07/16/23 23:32:07.143 < Exit [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 07/16/23 23:32:27.197 (20.054s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:27.197 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:27.565 (368ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:32:27.565 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:32:27.565 (0s) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:27.566 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:35.926 (8.394s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:32:35.926 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:32:40.026 (4.1s) > Enter [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 07/16/23 23:32:40.026 < Exit [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 07/16/23 23:32:50.274 (10.248s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:50.274 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:50.832 (558ms) + + + > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:50.833 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:59.336 (8.503s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:59.336 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:33:10.405 (11.103s) > Enter [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 07/16/23 23:33:10.405 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:54 @ 07/16/23 23:33:27.663 STEP: ensuring that first entry in X-Forwarded-Host is used as the best host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:75 @ 07/16/23 23:33:27.674 < Exit [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 07/16/23 23:33:27.683 (17.278s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:27.683 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:28.126 (443ms) + + + > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:28.128 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:35.418 (7.324s) > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 07/16/23 23:33:35.418 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 07/16/23 23:33:39.517 (4.099s) > Enter [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 07/16/23 23:33:39.517 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:48 @ 07/16/23 23:33:49.731 < Exit [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 07/16/23 23:33:49.739 (10.222s) > Enter [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:49.739 < Exit [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:50.184 (444ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:50.185 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:58.583 (8.398s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:33:58.583 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:34:02.597 (4.049s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 07/16/23 23:34:02.598 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 07/16/23 23:34:13.497 (10.899s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:13.497 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:13.905 (409ms) + + + > Enter [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:13.907 < Exit [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:22.216 (8.309s) > Enter [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 07/16/23 23:34:22.216 < Exit [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 07/16/23 23:34:32.368 (10.187s) > Enter [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:32.368 < Exit [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:32.925 (557ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:32.927 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:41.551 (8.624s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:34:41.551 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:34:47.637 (6.086s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:34:47.637 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:34:57.01 (9.372s) > Enter [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 07/16/23 23:34:57.01 < Exit [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 07/16/23 23:35:04.275 (7.3s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:04.275 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:04.736 (461ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:04.742 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:14.56 (9.817s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:35:14.56 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:35:18.617 (4.057s) > Enter [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 07/16/23 23:35:18.617 < Exit [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 07/16/23 23:35:28.832 (10.214s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:28.832 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:29.223 (392ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:29.225 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:38.691 (9.501s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:35:38.692 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:35:42.8 (4.108s) > Enter [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 07/16/23 23:35:42.8 < Exit [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 07/16/23 23:35:53.62 (10.82s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:53.62 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.081 (461ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:54.084 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:03.891 (9.841s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:03.891 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:09.979 (6.088s) > Enter [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 07/16/23 23:36:09.979 < Exit [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 07/16/23 23:36:25.241 (15.261s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:25.241 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:25.701 (460ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:25.703 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:33.605 (7.936s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:36:33.605 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:36:37.682 (4.077s) > Enter [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 07/16/23 23:36:37.682 < Exit [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 07/16/23 23:36:47.901 (10.219s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:47.901 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:48.375 (474ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:48.376 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:56.928 (8.552s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:56.928 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:37:03.013 (6.119s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 07/16/23 23:37:03.013 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 07/16/23 23:37:14.194 (11.181s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:14.194 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:14.663 (469ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:14.665 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:22.951 (8.286s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:37:22.951 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:37:27.087 (4.136s) > Enter [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 07/16/23 23:37:27.087 < Exit [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 07/16/23 23:37:37.286 (10.233s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:37.286 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:37.719 (433ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:37.721 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:47.137 (9.416s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:37:47.137 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:37:51.362 (4.225s) > Enter [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 07/16/23 23:37:51.362 < Exit [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 07/16/23 23:38:01.535 (10.206s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:01.535 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.216 (682ms) + + + > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:02.219 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:09.728 (7.509s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:38:09.729 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:38:13.797 (4.069s) > Enter [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 07/16/23 23:38:13.797 < Exit [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 07/16/23 23:38:31.175 (17.412s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:31.175 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:31.552 (376ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:31.553 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:40.919 (9.366s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:38:40.919 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:38:46.993 (6.074s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:38:46.993 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:39:03.307 (16.348s) > Enter [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 07/16/23 23:39:03.307 < Exit [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 07/16/23 23:39:07.472 (4.165s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.472 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:08.148 (676ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:08.153 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:16.57 (8.417s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:39:16.57 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:39:22.657 (6.087s) > Enter [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 07/16/23 23:39:22.657 < Exit [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 07/16/23 23:39:32.838 (10.215s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:32.838 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:33.231 (394ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:33.235 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:40.596 (7.361s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:39:40.596 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:39:44.718 (4.122s) > Enter [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 07/16/23 23:39:44.718 Jul 16 23:40:00.953: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 07/16/23 23:40:02.967 (18.283s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.967 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:03.473 (506ms) + + + > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:03.475 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:14.008 (10.533s) > Enter [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 07/16/23 23:40:14.008 < Exit [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 07/16/23 23:40:28.273 (14.265s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:28.274 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:29.069 (795ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:29.07 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:36.48 (7.444s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:36.48 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:40.607 (4.127s) > Enter [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 07/16/23 23:40:40.607 < Exit [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 07/16/23 23:40:47.651 (7.043s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:47.651 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:48.174 (524ms) + + + > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:48.176 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.86 (8.684s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:40:56.86 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:41:00.951 (4.125s) > Enter [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 07/16/23 23:41:00.951 < Exit [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 07/16/23 23:41:11.126 (10.175s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.126 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.617 (491ms) + + + > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:11.624 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:20.141 (8.516s) > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 07/16/23 23:41:20.141 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 07/16/23 23:41:22.214 (2.074s) > Enter [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 07/16/23 23:41:22.214 < Exit [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 07/16/23 23:41:32.382 (10.202s) > Enter [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:32.382 < Exit [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:32.85 (468ms) + + + > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:32.854 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:40.227 (7.374s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:41:40.227 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:41:44.297 (4.07s) > Enter [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 07/16/23 23:41:44.297 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:65 @ 07/16/23 23:41:44.297 STEP: sending request to www should redirect to domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:91 @ 07/16/23 23:41:59.768 STEP: sending request to domain should not redirect to www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:103 @ 07/16/23 23:41:59.784 < Exit [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 07/16/23 23:41:59.805 (15.508s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:59.805 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:00.18 (409ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.241 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.51 (14.268s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:07:48.51 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:08:06.784 (18.308s) > Enter [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 07/16/23 23:08:06.784 < Exit [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 07/16/23 23:08:13.874 (7.09s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:13.874 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:15.012 (1.138s) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:15.026 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:31.711 (16.684s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:31.711 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:35.749 (4.073s) > Enter [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 07/16/23 23:08:35.749 < Exit [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 07/16/23 23:08:45.914 (10.164s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:45.914 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:46.502 (588ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:46.507 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:58.795 (12.288s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:08:58.795 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:09:02.852 (4.092s) > Enter [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 07/16/23 23:09:02.852 < Exit [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 07/16/23 23:09:20.835 (17.983s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:20.835 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:21.688 (853ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:09:21.688 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:09:21.688 (0s) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:21.694 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:29.368 (7.675s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:09:29.369 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:09:33.396 (4.061s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:09:33.396 Jul 16 23:09:42.839: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:09:44.841 (11.445s) > Enter [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 07/16/23 23:09:44.841 < Exit [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 07/16/23 23:09:55.117 (10.276s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:55.117 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:55.595 (478ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:55.621 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:03.902 (8.315s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:03.902 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:07.984 (4.082s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:10:07.984 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:10:23.092 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:10:33.264 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:10:43.654 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:10:53.881 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:11:09.227 (1m1.333s) > Enter [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 07/16/23 23:11:09.227 STEP: logging into server thisHost /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:821 @ 07/16/23 23:11:09.227 STEP: receiving an internal server error without cache on thisHost location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:833 @ 07/16/23 23:11:16.27 < Exit [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 07/16/23 23:12:16.192 (1m7.058s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.192 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.811 (619ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:16.817 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:25.674 (8.857s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:25.674 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:36.81 (11.17s) > Enter [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 07/16/23 23:12:36.81 < Exit [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 07/16/23 23:12:47.088 (10.278s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:47.088 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:47.718 (631ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:47.72 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:56.863 (9.143s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:56.863 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:13:07.932 (11.103s) > Enter [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 07/16/23 23:13:07.932 < Exit [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 07/16/23 23:13:18.203 (10.272s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:18.203 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:18.842 (639ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:18.844 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:28.621 (9.777s) > Enter [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 07/16/23 23:13:28.621 < Exit [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 07/16/23 23:13:39.052 (10.465s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:39.052 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:39.573 (521ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:39.576 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:47.884 (8.308s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:13:47.884 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:13:51.979 (4.095s) > Enter [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 07/16/23 23:13:51.979 < Exit [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 07/16/23 23:14:17.414 (25.47s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:17.414 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:18.388 (973ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:18.39 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:27.699 (9.309s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:14:27.699 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:14:34.284 (6.619s) > Enter [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 07/16/23 23:14:34.284 < Exit [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 07/16/23 23:14:57.094 (22.81s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.094 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.009 (914ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:58.012 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:08.991 (11.014s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:15:08.991 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:15:15.072 (6.08s) > Enter [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 07/16/23 23:15:15.072 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:69 @ 07/16/23 23:15:15.072 STEP: making a request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:78 @ 07/16/23 23:15:25.351 STEP: creating an ingress definition with the rewrite-target annotation set on the "/" location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:88 @ 07/16/23 23:15:25.361 STEP: making a second request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:102 @ 07/16/23 23:15:35.543 < Exit [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 07/16/23 23:15:35.551 (20.514s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:35.551 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36 (449ms) + + + > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:36.002 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:44.55 (8.548s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:15:44.55 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:15:50.604 (6.055s) > Enter [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 07/16/23 23:15:50.604 < Exit [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 07/16/23 23:16:00.832 (10.227s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:00.832 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:01.23 (398ms) + + + > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:01.232 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.619 (8.421s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:16:09.619 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:16:13.742 (4.123s) > Enter [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 07/16/23 23:16:13.742 < Exit [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 07/16/23 23:16:37.172 (23.465s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.172 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.786 (614ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:37.787 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:46.283 (8.495s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:16:46.283 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:16:54.442 (8.159s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:16:54.442 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:16:54.442 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:17:04.664 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:17:15.032 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:17:25.212 (30.804s) > Enter [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 07/16/23 23:17:25.212 STEP: Adding a global-auth-snippet to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:254 @ 07/16/23 23:17:25.212 < Exit [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 07/16/23 23:17:35.375 (10.198s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:35.375 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:35.767 (391ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:35.769 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:44.223 (8.454s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:17:44.223 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:17:48.3 (4.077s) > Enter [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 07/16/23 23:17:48.3 < Exit [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 07/16/23 23:17:55.341 (7.041s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:55.341 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:55.791 (449ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:55.792 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:04.137 (8.379s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:18:04.137 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:18:08.248 (4.112s) > Enter [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 07/16/23 23:18:08.249 < Exit [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 07/16/23 23:18:18.49 (10.241s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:18.49 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:18.911 (422ms) + + + > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:18.912 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:27.287 (8.374s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:18:27.287 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:18:31.349 (4.062s) > Enter [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 07/16/23 23:18:31.349 < Exit [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 07/16/23 23:18:47.764 (16.45s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:47.764 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:48.191 (427ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:48.193 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:56.623 (8.43s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:18:56.623 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:19:00.738 (4.115s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 07/16/23 23:19:00.738 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 07/16/23 23:19:26.161 (25.457s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:26.161 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:26.559 (398ms) + + + > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:26.564 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:35.081 (8.55s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:19:35.081 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:19:39.133 (4.052s) > Enter [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 07/16/23 23:19:39.133 < Exit [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 07/16/23 23:19:49.376 (10.244s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:49.376 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:49.802 (425ms) + + + > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:49.804 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:58.14 (8.336s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:19:58.14 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:20:13.506 (15.401s) > Enter [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 07/16/23 23:20:13.506 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:68 @ 07/16/23 23:20:20.544 STEP: making sure new ingress is responding - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:74 @ 07/16/23 23:20:23.704 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:76 @ 07/16/23 23:20:23.704 < Exit [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 07/16/23 23:20:25.721 (12.215s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:25.721 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.267 (546ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:26.269 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:34.686 (8.452s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:20:34.686 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:20:38.757 (4.07s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:20:38.757 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:20:48.932 (10.175s) > Enter [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 07/16/23 23:20:48.932 < Exit [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 07/16/23 23:20:52.115 (3.183s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:52.115 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:52.579 (463ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:52.58 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:00.264 (7.684s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:00.264 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:04.298 (4.069s) > Enter [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 07/16/23 23:21:04.298 < Exit [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 07/16/23 23:21:15.98 (11.682s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:15.98 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:16.663 (683ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:16.666 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:26.922 (10.256s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:26.922 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:30.978 (4.056s) > Enter [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 07/16/23 23:21:30.978 < Exit [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 07/16/23 23:21:42.285 (11.341s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:42.285 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:42.816 (531ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:42.818 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:51.43 (8.612s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:21:51.43 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:21:55.497 (4.067s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:21:55.497 Jul 16 23:22:04.729: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:22:06.734 (11.271s) > Enter [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 07/16/23 23:22:06.734 < Exit [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 07/16/23 23:22:16.936 (10.203s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:16.937 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:17.423 (487ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:17.424 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:25.824 (8.4s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:22:25.824 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:22:33.95 (8.16s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:22:33.95 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:23:02.307 (28.392s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 07/16/23 23:23:02.308 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 07/16/23 23:23:02.317 (10ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:02.317 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:02.727 (409ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:02.729 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:11.096 (8.368s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:23:11.097 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:23:17.255 (6.159s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 07/16/23 23:23:17.255 < Exit [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 07/16/23 23:23:42.874 (25.653s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:42.874 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:43.4 (525ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:43.401 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:52.034 (8.633s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:23:52.034 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:24:00.279 (8.245s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:24:00.279 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:24:00.279 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:24:10.446 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:24:20.663 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:24:30.894 (30.65s) > Enter [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 07/16/23 23:24:30.894 STEP: Adding an ingress rule for /bar with annotation enable-global-auth = false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:128 @ 07/16/23 23:24:30.894 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:140 @ 07/16/23 23:24:35.071 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:147 @ 07/16/23 23:24:35.079 < Exit [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 07/16/23 23:24:35.086 (4.226s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:35.086 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:35.565 (479ms) + + + > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:35.566 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:44.981 (9.415s) > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 07/16/23 23:24:44.981 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 07/16/23 23:24:49.116 (4.135s) > Enter [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 07/16/23 23:24:49.116 STEP: regenerating the correct configuration after update - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:65 @ 07/16/23 23:25:11.373 < Exit [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 07/16/23 23:25:22.684 (33.602s) > Enter [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:22.684 < Exit [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:23.246 (562ms) + + + > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:23.247 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:31.61 (8.398s) > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 07/16/23 23:25:31.61 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 07/16/23 23:25:35.714 (4.104s) > Enter [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 07/16/23 23:25:35.715 < Exit [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 07/16/23 23:26:07.011 (31.33s) > Enter [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.011 < Exit [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.5 (489ms) + + + > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:07.503 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:16.195 (8.692s) > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 07/16/23 23:26:16.195 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 07/16/23 23:26:20.306 (4.111s) > Enter [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 07/16/23 23:26:20.306 < Exit [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 07/16/23 23:26:27.349 (7.044s) > Enter [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.349 < Exit [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.949 (600ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.952 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:36.662 (8.744s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:26:36.662 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:26:40.824 (4.163s) > Enter [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 07/16/23 23:26:40.824 < Exit [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 07/16/23 23:27:03.024 (22.234s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:03.024 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:03.527 (504ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:03.528 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:11.896 (8.368s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:11.896 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:15.977 (4.081s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:27:15.977 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:27:30.444 (14.468s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 07/16/23 23:27:30.445 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 07/16/23 23:27:30.455 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:30.455 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:31.001 (545ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:31.003 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:39.402 (8.434s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:27:39.403 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:27:43.461 (4.058s) > Enter [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 07/16/23 23:27:43.461 < Exit [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 07/16/23 23:27:53.686 (10.226s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:53.687 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:54.173 (486ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.174 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:02.854 (8.714s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:28:02.854 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:28:06.916 (4.062s) > Enter [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 07/16/23 23:28:06.916 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:114 @ 07/16/23 23:28:06.917 STEP: creating an ingress definition with the use-regex amd rewrite-target annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:123 @ 07/16/23 23:28:17.092 STEP: ensuring '/foo' matches '~* ^/foo' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:137 @ 07/16/23 23:28:27.312 STEP: ensuring '/foo/bar' matches '~* ^/foo.+' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:147 @ 07/16/23 23:28:27.32 < Exit [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 07/16/23 23:28:27.329 (20.413s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:27.329 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:27.758 (429ms) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:27.76 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:35.027 (7.302s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:28:35.027 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:28:35.031 (4ms) > Enter [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 07/16/23 23:28:35.031 < Exit [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 07/16/23 23:28:38.754 (3.722s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:38.754 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:39.199 (446ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:39.205 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:47.511 (8.307s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:28:47.511 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:28:51.575 (4.064s) > Enter [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 07/16/23 23:28:51.575 < Exit [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 07/16/23 23:29:08.745 (17.204s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:08.745 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.129 (383ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:09.13 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:17.772 (8.641s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:29:17.772 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:29:28.874 (11.102s) > Enter [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 07/16/23 23:29:28.874 Automatically polling progress: [Setting] use-proxy-protocol should enable PROXY Protocol for TCP (Spec Runtime: 3m19.498s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 In [It] (Node Runtime: 2m59.754s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 Spec Goroutine goroutine 2683 [IO wait, 2 minutes] internal/poll.runtime_pollWait(0x7f5468c3dd40, 0x72) /usr/local/go/src/runtime/netpoll.go:306 internal/poll.(*pollDesc).wait(0xc000c86a00?, 0xc000daf725?, 0x0) /usr/local/go/src/internal/poll/fd_poll_runtime.go:84 internal/poll.(*pollDesc).waitRead(...) /usr/local/go/src/internal/poll/fd_poll_runtime.go:89 internal/poll.(*FD).Read(0xc000c86a00, {0xc000daf725, 0x15b, 0x15b}) /usr/local/go/src/internal/poll/fd_unix.go:167 net.(*netFD).Read(0xc000c86a00, {0xc000daf725?, 0x453656?, 0x380?}) /usr/local/go/src/net/fd_posix.go:55 net.(*conn).Read(0xc000126120, {0xc000daf725?, 0x19913c0?, 0xc000daf500?}) /usr/local/go/src/net/net.go:183 io.ReadAll({0x1f62e00, 0xc000126120}) /usr/local/go/src/io/io.go:701 > k8s.io/ingress-nginx/test/e2e/settings.glob..func38.5() /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:211 github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0xa0558e, 0xc000cfc300}) /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3() /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:850 < Exit [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 07/16/23 23:39:43.452 (10m15.338s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:43.452 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:44.02 (568ms) + + + > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:44.023 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:52.324 (8.301s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:39:52.324 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:40:01.39 (9.101s) > Enter [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 07/16/23 23:40:01.39 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:54 @ 07/16/23 23:40:18.685 < Exit [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 07/16/23 23:40:18.693 (17.302s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:18.693 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:19.14 (448ms) + + + > Enter [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:19.154 < Exit [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:27.75 (8.595s) > Enter [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 07/16/23 23:40:27.75 < Exit [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 07/16/23 23:40:39.948 (12.232s) > Enter [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:39.948 < Exit [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:40.361 (413ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:40.362 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:49.01 (8.647s) > Enter [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 07/16/23 23:40:49.01 < Exit [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 07/16/23 23:41:11.382 (22.406s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.382 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:12.084 (702ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:12.087 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:19.624 (7.537s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:41:19.624 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:41:23.694 (4.07s) > Enter [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 07/16/23 23:41:23.694 < Exit [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 07/16/23 23:41:33.973 (10.314s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:33.974 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:34.437 (464ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:34.439 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:42.983 (8.544s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:41:42.983 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:41:47.055 (4.073s) > Enter [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 07/16/23 23:41:47.055 < Exit [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 07/16/23 23:42:04.248 (17.227s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:04.248 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:04.658 (410ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:42:04.658 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:42:04.658 (0s) + + + \ No newline at end of file From 30dc62987192e6a6ca797c403148549b86bd30f7 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Jul 2023 23:54:30 -0400 Subject: [PATCH 281/822] remove junit --- test/junitreports/report-e2e-test-suite.xml | 1311 ------------------- 1 file changed, 1311 deletions(-) delete mode 100644 test/junitreports/report-e2e-test-suite.xml diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml deleted file mode 100644 index 43f6f3233..000000000 --- a/test/junitreports/report-e2e-test-suite.xml +++ /dev/null @@ -1,1311 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.215 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:47.677 (13.462s) > Enter [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 07/16/23 23:07:47.677 < Exit [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 07/16/23 23:08:11.636 (23.993s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:11.636 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:12.72 (1.084s) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:12.728 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:26.952 (14.224s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:08:26.952 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:08:40.053 (13.136s) > Enter [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 07/16/23 23:08:40.053 < Exit [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 07/16/23 23:08:50.288 (10.235s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:50.289 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:50.915 (626ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:50.916 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:00.386 (9.47s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:00.386 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:11.506 (11.154s) > Enter [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 07/16/23 23:09:11.506 < Exit [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 07/16/23 23:09:21.824 (10.319s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:21.824 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:22.594 (769ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:22.602 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:31.342 (8.739s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:31.342 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 07/16/23 23:09:42.441 (11.134s) > Enter [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 07/16/23 23:09:42.441 < Exit [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 07/16/23 23:09:45.658 (3.217s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:45.658 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:46.07 (411ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:46.071 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:55.04 (8.969s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:55.04 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:59.124 (4.084s) > Enter [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 07/16/23 23:09:59.124 < Exit [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 07/16/23 23:10:13.448 (14.358s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:13.448 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:13.998 (550ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:13.999 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:22.738 (8.738s) > Enter [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 07/16/23 23:10:22.738 < Exit [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 07/16/23 23:10:33.094 (10.391s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:33.094 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:33.676 (582ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:33.688 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:42.391 (8.703s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:42.391 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:53.541 (11.15s) > Enter [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 07/16/23 23:10:53.541 < Exit [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 07/16/23 23:12:26.01 (1m32.617s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:26.01 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:26.827 (817ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.829 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:35.094 (8.299s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:35.094 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:39.241 (4.147s) > Enter [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 07/16/23 23:12:39.241 < Exit [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 07/16/23 23:13:08.762 (29.555s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.762 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:09.288 (526ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:09.289 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:17.226 (7.936s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:13:17.226 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:13:21.294 (4.068s) > Enter [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 07/16/23 23:13:21.294 < Exit [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 07/16/23 23:13:31.492 (10.198s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:31.492 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:32.119 (661ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.123 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:40.759 (8.636s) > Enter [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 07/16/23 23:13:40.759 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:90 @ 07/16/23 23:13:40.759 < Exit [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 07/16/23 23:13:40.759 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:40.76 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:41.293 (534ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:41.296 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:50.342 (9.046s) > Enter [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 07/16/23 23:13:50.342 < Exit [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 07/16/23 23:14:00.578 (10.237s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:00.578 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:01.204 (626ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:01.205 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:09.622 (8.451s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:14:09.622 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:14:13.746 (4.123s) > Enter [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 07/16/23 23:14:13.746 < Exit [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 07/16/23 23:14:24.227 (10.481s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:24.227 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:24.72 (493ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:24.722 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:35.239 (10.552s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:14:35.239 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:14:43.596 (8.357s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:14:43.596 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:15:05.851 (22.289s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 07/16/23 23:15:05.851 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 07/16/23 23:15:05.862 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:05.862 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:06.276 (414ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:06.278 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:14.855 (8.577s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:15:14.855 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:15:25.98 (11.125s) > Enter [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 07/16/23 23:15:25.98 < Exit [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 07/16/23 23:15:36.182 (10.236s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36.182 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36.652 (469ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:36.653 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:45.163 (8.51s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:45.163 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:51.277 (6.114s) > Enter [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 07/16/23 23:15:51.277 < Exit [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 07/16/23 23:16:01.482 (10.205s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:01.482 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:02.018 (570ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:02.019 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.556 (7.537s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:09.556 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:13.642 (4.085s) > Enter [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 07/16/23 23:16:13.642 < Exit [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 07/16/23 23:16:39.138 (25.531s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.138 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.697 (559ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:39.736 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:47.471 (7.735s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:47.471 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:16:51.578 (4.107s) > Enter [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 07/16/23 23:16:51.578 < Exit [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 07/16/23 23:17:17.178 (25.634s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:17.178 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:17.695 (517ms) - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:17.697 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:26.222 (8.525s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:26.222 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:30.293 (4.071s) > Enter [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 07/16/23 23:17:30.293 Jul 16 23:17:39.506: INFO: Connecting to github.com (140.82.113.3:443) Connecting to github.com (140.82.113.3:443) Connecting to raw.githubusercontent.com (185.199.111.133:443) saving to '/etc/nginx/geoip/GeoLite2-Country.mmdb' GeoLite2-Country.mmd 100%!|(MISSING)********************************| 17952 0:00:00 ETA '/etc/nginx/geoip/GeoLite2-Country.mmdb' saved < Exit [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 07/16/23 23:17:49.758 (19.499s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:49.758 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:50.446 (688ms) - - - > Enter [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:50.448 < Exit [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:59.09 (8.642s) > Enter [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 07/16/23 23:17:59.09 Jul 16 23:17:59.090: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=0' Jul 16 23:18:19.484: INFO: waiting for leader election and initial status update Jul 16 23:18:59.486: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=36979' < Exit [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 07/16/23 23:19:09.559 (1m10.572s) > Enter [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:09.559 < Exit [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:10.072 (512ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:10.074 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:18.758 (8.683s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:18.758 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:22.852 (4.094s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:22.852 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:37.243 (14.425s) > Enter [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 07/16/23 23:19:37.243 < Exit [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 07/16/23 23:19:41.445 (4.202s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:41.446 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:42.051 (605ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:42.053 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:50.431 (8.379s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:50.432 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:54.495 (4.064s) > Enter [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 07/16/23 23:19:54.495 < Exit [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 07/16/23 23:20:06.914 (12.453s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:06.914 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:07.67 (756ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:07.684 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:16.699 (9.015s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:20:16.699 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:20:20.747 (4.048s) > Enter [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 07/16/23 23:20:20.747 < Exit [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 07/16/23 23:20:31.134 (10.387s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:31.134 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:31.656 (556ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:31.657 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:40.453 (8.796s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:20:40.453 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:20:44.53 (4.077s) > Enter [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 07/16/23 23:20:44.53 < Exit [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 07/16/23 23:21:13.79 (29.294s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.79 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:14.395 (605ms) - - - > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:14.4 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:23.168 (8.768s) > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 07/16/23 23:21:23.168 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 07/16/23 23:21:27.261 (4.093s) > Enter [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 07/16/23 23:21:27.261 < Exit [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 07/16/23 23:21:37.483 (10.256s) > Enter [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:37.483 < Exit [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:38.068 (585ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:38.069 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:45.534 (7.465s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:45.534 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:49.607 (4.073s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:21:49.607 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:22:03.839 (14.266s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 07/16/23 23:22:03.84 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 07/16/23 23:22:03.852 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:03.852 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.325 (473ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:04.328 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:12.822 (8.494s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:12.822 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:16.892 (4.07s) > Enter [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 07/16/23 23:22:16.892 < Exit [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 07/16/23 23:22:27.117 (10.225s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.117 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.555 (438ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:27.556 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:36.204 (8.682s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:36.204 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:40.282 (4.078s) > Enter [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 07/16/23 23:22:40.283 < Exit [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 07/16/23 23:22:52.486 (12.203s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:52.486 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:52.861 (375ms) - - - > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:52.864 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:00.437 (7.573s) > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 07/16/23 23:23:00.437 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 07/16/23 23:23:04.507 (4.105s) > Enter [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 07/16/23 23:23:04.507 STEP: generating correct defaults - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:43 @ 07/16/23 23:23:11.537 STEP: applying customizations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:61 @ 07/16/23 23:23:14.706 < Exit [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 07/16/23 23:23:25.01 (20.503s) > Enter [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.01 < Exit [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.724 (714ms) - - - > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:25.726 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:34.135 (8.443s) > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 07/16/23 23:23:34.135 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 07/16/23 23:23:38.193 (4.058s) > Enter [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 07/16/23 23:23:38.193 < Exit [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 07/16/23 23:23:52.705 (14.512s) > Enter [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:52.707 < Exit [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:53.193 (486ms) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:53.194 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:02.76 (9.601s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:24:02.76 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:24:13.875 (11.115s) > Enter [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 07/16/23 23:24:13.875 < Exit [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 07/16/23 23:24:24.131 (10.255s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:24.131 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:24.572 (441ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:24.573 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:33.002 (8.463s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:24:33.003 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:24:37.063 (4.061s) > Enter [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 07/16/23 23:24:37.063 < Exit [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 07/16/23 23:24:47.308 (10.245s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:47.308 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:47.843 (535ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:47.845 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:56.211 (8.367s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:24:56.212 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:25:04.311 (8.134s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:25:04.312 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:25:04.312 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:25:14.551 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:25:24.781 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:25:34.923 (30.646s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 07/16/23 23:25:34.923 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 07/16/23 23:25:34.924 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 07/16/23 23:25:45.117 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 07/16/23 23:25:45.136 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 07/16/23 23:25:45.155 (10.231s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.155 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.792 (637ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:45.799 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:53.394 (7.595s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:25:53.394 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:25:57.447 (4.052s) > Enter [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 07/16/23 23:25:57.447 STEP: setting enable-rewrite-log annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:38 @ 07/16/23 23:25:57.447 < Exit [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 07/16/23 23:26:10.67 (13.258s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.67 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:11.462 (792ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:11.466 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:19.994 (8.529s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:26:19.994 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:26:24.057 (4.063s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 07/16/23 23:26:24.057 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:53 @ 07/16/23 23:26:34.26 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:60 @ 07/16/23 23:26:34.268 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 07/16/23 23:26:34.424 (10.402s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:34.424 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:34.943 (519ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:34.948 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:43.595 (8.647s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:43.595 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:47.667 (4.072s) > Enter [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 07/16/23 23:26:47.667 < Exit [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 07/16/23 23:26:54.707 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:54.707 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:55.197 (490ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:55.199 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:02.431 (7.267s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:02.431 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:06.577 (4.146s) > Enter [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 07/16/23 23:27:06.577 < Exit [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 07/16/23 23:27:16.86 (10.283s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.86 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:17.6 (740ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:17.603 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:29.242 (11.639s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:27:29.242 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:27:33.297 (4.089s) > Enter [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 07/16/23 23:27:33.297 < Exit [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 07/16/23 23:27:50.62 (17.323s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:50.62 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:51.396 (777ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:51.398 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:59.848 (8.45s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:27:59.848 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:28:07.927 (8.114s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:28:07.927 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:28:07.927 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:28:18.108 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:28:28.311 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:28:38.594 (30.701s) > Enter [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 07/16/23 23:28:38.594 STEP: Adding a global-auth-method to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:202 @ 07/16/23 23:28:38.594 < Exit [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 07/16/23 23:28:48.849 (10.255s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:48.849 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:49.496 (647ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.498 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:58.133 (8.635s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:28:58.133 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:29:00.195 (2.062s) > Enter [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 07/16/23 23:29:00.195 < Exit [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 07/16/23 23:29:09.273 (9.111s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.273 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.693 (420ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:09.696 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:18.525 (8.83s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:29:18.525 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:29:22.595 (4.069s) > Enter [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 07/16/23 23:29:22.595 < Exit [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 07/16/23 23:29:35.79 (13.229s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:35.79 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:36.912 (1.123s) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:36.914 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:45.266 (8.352s) > Enter [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 07/16/23 23:29:45.266 STEP: checking the service is updated to use eu.httpbin.org - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:304 @ 07/16/23 23:30:01.037 < Exit [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 07/16/23 23:30:01.219 (15.992s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:01.219 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:01.675 (455ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:01.676 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:09.223 (7.547s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:30:09.223 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:30:17.344 (8.121s) > Enter [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 07/16/23 23:30:17.344 STEP: routing requests destined for the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:351 @ 07/16/23 23:30:44.8 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:360 @ 07/16/23 23:30:44.834 < Exit [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 07/16/23 23:30:44.863 (27.584s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:44.863 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:51.061 (6.197s) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:51.215 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:08.914 (17.737s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:31:08.914 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:31:24.729 (15.815s) > Enter [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 07/16/23 23:31:24.729 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:90 @ 07/16/23 23:31:33.588 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:96 @ 07/16/23 23:31:36.75 < Exit [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 07/16/23 23:31:38.764 (14.071s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:38.764 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:39.22 (456ms) - - - > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:39.221 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:47.492 (8.271s) > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 07/16/23 23:31:47.492 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 07/16/23 23:31:51.545 (4.053s) > Enter [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 07/16/23 23:31:51.545 < Exit [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 07/16/23 23:32:22.076 (30.566s) > Enter [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:22.076 < Exit [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:22.569 (493ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:22.57 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:30.865 (8.329s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:32:30.865 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:32:34.935 (4.071s) > Enter [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 07/16/23 23:32:34.936 < Exit [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 07/16/23 23:32:42.001 (7.066s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.001 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.52 (519ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:42.522 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:49.858 (7.336s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:32:49.859 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:00.922 (11.098s) > Enter [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 07/16/23 23:33:00.922 < Exit [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 07/16/23 23:33:11.133 (10.211s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.133 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.499 (366ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.501 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:19.977 (8.476s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:33:19.977 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:33:24.088 (4.111s) > Enter [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 07/16/23 23:33:24.088 < Exit [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 07/16/23 23:33:34.766 (10.712s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:34.766 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:35.346 (580ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:35.349 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:43.804 (8.455s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:43.804 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:33:54.894 (11.09s) > Enter [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 07/16/23 23:33:54.894 < Exit [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 07/16/23 23:34:05.028 (10.168s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:05.028 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:05.552 (523ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:05.554 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:14.153 (8.6s) > Enter [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 07/16/23 23:34:14.153 < Exit [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 07/16/23 23:34:24.357 (10.204s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:24.358 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:24.84 (482ms) - - - > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:24.841 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:33.146 (8.339s) > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 07/16/23 23:34:33.146 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 07/16/23 23:34:47.325 (14.18s) > Enter [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 07/16/23 23:34:47.325 < Exit [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 07/16/23 23:35:00.678 (13.387s) > Enter [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:00.678 < Exit [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:01.088 (411ms) - - - > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:01.09 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:09.717 (8.628s) > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 07/16/23 23:35:09.717 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 07/16/23 23:35:13.774 (4.056s) > Enter [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 07/16/23 23:35:13.774 < Exit [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 07/16/23 23:35:24.001 (10.227s) > Enter [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:24.001 < Exit [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:24.542 (541ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:24.545 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:32.804 (8.293s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:35:32.804 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:35:45.013 (12.209s) > Enter [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 07/16/23 23:35:45.013 < Exit [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 07/16/23 23:35:56.305 (11.292s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:56.305 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:57.119 (814ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:57.124 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:06.657 (9.567s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:06.657 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:10.742 (4.085s) > Enter [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 07/16/23 23:36:10.742 < Exit [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 07/16/23 23:36:20.937 (10.195s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.937 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.453 (516ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:21.455 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:31.124 (9.704s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:36:31.124 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:36:35.265 (4.141s) > Enter [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 07/16/23 23:36:35.265 < Exit [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 07/16/23 23:36:48.617 (13.352s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:48.617 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:49.062 (444ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:49.063 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:57.626 (8.563s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:36:57.626 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:37:05.661 (8.069s) > Enter [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 07/16/23 23:37:05.661 < Exit [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 07/16/23 23:37:36.037 (30.41s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:36.037 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:36.473 (436ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:36.475 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:45.324 (8.85s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:37:45.324 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:37:57.596 (12.271s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:37:57.596 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:38:25.91 (28.348s) > Enter [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 07/16/23 23:38:25.91 < Exit [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 07/16/23 23:38:32.91 (7.035s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:32.91 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:33.401 (490ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:33.402 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:42.01 (8.609s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:42.01 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:55.207 (13.196s) > Enter [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 07/16/23 23:38:55.207 < Exit [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 07/16/23 23:38:58.375 (3.169s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:58.375 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:58.773 (398ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:58.777 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:07.045 (8.302s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:39:07.045 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:39:11.141 (4.096s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:39:11.141 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:39:25.521 (14.38s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 07/16/23 23:39:25.521 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 07/16/23 23:39:36.735 (11.248s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.735 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:37.352 (617ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:37.354 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:47.228 (9.874s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:39:47.228 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:39:55.38 (8.152s) > Enter [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 07/16/23 23:39:55.38 < Exit [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 07/16/23 23:40:02.395 (7.05s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.395 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.942 (547ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:02.952 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:14.181 (11.229s) > Enter [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 07/16/23 23:40:14.181 < Exit [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 07/16/23 23:40:17.314 (3.133s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:17.314 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:17.708 (394ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:17.709 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:26.08 (8.371s) > Enter [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 07/16/23 23:40:26.08 < Exit [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 07/16/23 23:40:46.867 (20.821s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:46.867 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:47.244 (376ms) - - - I0716 23:41:15.732712 21 request.go:690] Waited for 1.1995168s due to client-side throttling, not priority and fairness, request: GET:https://10.96.0.1:443/api/v1/namespaces/e2e-tests-limit-connections-1689550847245898400-wb8ks/services/nginx-ingress-controller - > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:47.245 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.079 (8.834s) > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 07/16/23 23:40:56.079 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 07/16/23 23:41:00.171 (4.127s) > Enter [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 07/16/23 23:41:00.171 < Exit [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 07/16/23 23:41:24.568 (24.396s) > Enter [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:24.568 < Exit [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:25.344 (776ms) - - - > Enter [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:25.36 < Exit [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:32.695 (7.368s) > Enter [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 07/16/23 23:41:32.695 < Exit [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 07/16/23 23:42:45.785 (1m13.158s) > Enter [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:45.785 < Exit [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:46.185 (401ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:42:46.188 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:12.099 (25.945s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:12.099 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:20.23 (8.131s) > Enter [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 07/16/23 23:43:20.23 < Exit [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 07/16/23 23:43:27.268 (7.037s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:43:27.268 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:43:27.784 (516ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:27.785 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:43:58.24 (30.49s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:43:58.24 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:06.339 (8.133s) > Enter [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 07/16/23 23:44:06.339 STEP: rejects ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:52 @ 07/16/23 23:44:06.339 STEP: accepts ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:57 @ 07/16/23 23:44:06.349 < Exit [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 07/16/23 23:44:16.599 (10.26s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:16.599 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:17.054 (455ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:17.055 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:36.36 (19.339s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:36.36 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:44:44.488 (8.128s) > Enter [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 07/16/23 23:44:44.488 < Exit [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 07/16/23 23:44:44.642 (153ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:44.642 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:44:45.068 (426ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:44:45.07 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:03.441 (18.405s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:03.441 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:11.572 (8.131s) > Enter [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 07/16/23 23:45:11.572 < Exit [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 07/16/23 23:45:14.768 (3.197s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:14.768 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:15.19 (422ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:15.191 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:33.55 (18.393s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:33.55 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:45:41.706 (8.156s) > Enter [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 07/16/23 23:45:41.706 < Exit [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 07/16/23 23:45:41.879 (173ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:41.879 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:45:42.315 (436ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:45:42.316 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:05.628 (23.347s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:05.629 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:13.77 (8.142s) > Enter [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 07/16/23 23:46:13.77 < Exit [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 07/16/23 23:46:19.093 (5.323s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:19.093 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:19.553 (460ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:19.554 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:38.748 (19.229s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:38.748 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:46:46.903 (8.154s) > Enter [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 07/16/23 23:46:46.903 < Exit [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 07/16/23 23:46:53.94 (7.037s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:53.94 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:46:54.36 (420ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:46:54.361 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:47:21.846 (27.52s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:47:21.846 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:47:29.967 (8.139s) > Enter [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 07/16/23 23:47:29.967 < Exit [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 07/16/23 23:47:33.332 (3.365s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:47:33.332 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:47:33.801 (469ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:47:33.802 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:03.021 (29.226s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:48:03.021 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:48:11.191 (8.17s) > Enter [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 07/16/23 23:48:11.191 < Exit [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 07/16/23 23:48:14.438 (3.246s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:14.438 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:15.015 (577ms) - - - > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:15.017 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:22.38 (7.363s) > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 07/16/23 23:48:22.38 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 07/16/23 23:48:26.446 (4.066s) > Enter [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 07/16/23 23:48:26.446 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:53 @ 07/16/23 23:48:36.588 < Exit [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 07/16/23 23:48:36.76 (10.343s) > Enter [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:36.76 < Exit [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:48:37.218 (459ms) - - - > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:48:37.219 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:01.506 (24.32s) > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 07/16/23 23:49:01.506 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 07/16/23 23:49:27.706 (26.2s) > Enter [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 07/16/23 23:49:27.706 < Exit [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 07/16/23 23:49:34.037 (6.365s) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:49:34.037 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:49:34.43 (393ms) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 07/16/23 23:49:34.43 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 07/16/23 23:49:34.447 (17ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:34.449 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:49:53.407 (18.958s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:49:53.407 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:01.525 (8.152s) > Enter [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 07/16/23 23:50:01.525 < Exit [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 07/16/23 23:50:06.787 (5.263s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:06.787 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:07.247 (459ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:50:07.248 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:50:26.543 (19.295s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:26.543 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 07/16/23 23:50:34.647 (8.138s) > Enter [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 07/16/23 23:50:34.647 < Exit [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 07/16/23 23:50:34.688 (42ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:34.688 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:50:35.093 (404ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.275 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.02 (13.746s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:07:48.02 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:08:02.283 (14.262s) > Enter [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 07/16/23 23:08:02.283 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:193 @ 07/16/23 23:08:02.283 STEP: check that '/foo/bar/bar' redirects to custom rewrite - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:206 @ 07/16/23 23:08:12.679 < Exit [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 07/16/23 23:08:12.703 (10.454s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:12.703 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:13.572 (869ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:13.576 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:28.615 (15.039s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:28.615 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:36.764 (8.184s) > Enter [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 07/16/23 23:08:36.765 STEP: routing requests destined for the mainline ingress to the mainelin upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:231 @ 07/16/23 23:08:54.047 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:240 @ 07/16/23 23:08:54.056 < Exit [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 07/16/23 23:08:54.065 (17.301s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:54.065 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:54.538 (473ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:54.54 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:05.022 (10.516s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:05.022 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:09:09.106 (4.084s) > Enter [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 07/16/23 23:09:09.106 < Exit [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 07/16/23 23:09:25.238 (16.132s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:25.238 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:25.913 (675ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:25.915 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:34.419 (8.538s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:34.419 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:42.592 (8.174s) > Enter [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 07/16/23 23:09:42.592 < Exit [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 07/16/23 23:10:38.197 (55.673s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:38.197 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:38.587 (391ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:38.589 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:47.213 (8.624s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:10:47.213 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:10:51.275 (4.063s) > Enter [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 07/16/23 23:10:51.276 < Exit [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 07/16/23 23:10:58.316 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:58.316 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:58.828 (512ms) - - - > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:58.83 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:06.101 (7.326s) > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 07/16/23 23:11:06.101 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 07/16/23 23:11:55.28 (49.235s) > Enter [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 07/16/23 23:11:55.28 < Exit [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 07/16/23 23:12:16.87 (21.626s) > Enter [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.87 < Exit [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:17.419 (549ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:17.421 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.489 (9.069s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:12:26.49 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:12:30.699 (4.21s) > Enter [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 07/16/23 23:12:30.699 < Exit [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 07/16/23 23:12:41.026 (10.361s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.03 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.518 (487ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:41.519 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:50.636 (9.117s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:12:50.636 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:12:54.712 (4.076s) > Enter [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 07/16/23 23:12:54.712 < Exit [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 07/16/23 23:13:01.787 (7.076s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:01.787 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:02.426 (673ms) - - - > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:02.429 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:11.216 (8.787s) > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 07/16/23 23:13:11.217 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 07/16/23 23:13:15.424 (4.207s) > Enter [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 07/16/23 23:13:15.424 STEP: Checking exact request to / - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:63 @ 07/16/23 23:13:32.733 STEP: Checking prefix request to /bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:76 @ 07/16/23 23:13:32.756 STEP: Checking exact request to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:109 @ 07/16/23 23:13:50.333 STEP: Checking prefix request to /foo/bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:122 @ 07/16/23 23:13:50.341 STEP: Checking prefix request to /foobar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:134 @ 07/16/23 23:13:50.351 < Exit [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 07/16/23 23:13:50.359 (34.97s) > Enter [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:50.36 < Exit [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:50.91 (550ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:50.913 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:58.322 (7.409s) > Enter [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 07/16/23 23:13:58.322 < Exit [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 07/16/23 23:14:15.594 (17.306s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.594 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:16.06 (466ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:16.061 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:24.013 (7.951s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:14:24.013 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:14:28.134 (4.121s) > Enter [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 07/16/23 23:14:28.134 < Exit [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 07/16/23 23:14:47.036 (18.936s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:47.036 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:53.943 (6.907s) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:53.945 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:04.186 (10.275s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:15:04.186 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:15:08.271 (4.085s) > Enter [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 07/16/23 23:15:08.271 < Exit [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 07/16/23 23:15:18.477 (10.206s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:18.477 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:18.878 (401ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:18.88 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:27.307 (8.428s) > Enter [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 07/16/23 23:15:27.307 STEP: setting permanent-redirect-code annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:62 @ 07/16/23 23:15:27.307 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:82 @ 07/16/23 23:15:37.505 < Exit [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 07/16/23 23:15:37.513 (10.24s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:37.513 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:38.004 (491ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:38.014 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:47.066 (9.052s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:47.066 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:57.188 (10.122s) > Enter [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 07/16/23 23:15:57.188 STEP: routing requests to the mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:591 @ 07/16/23 23:16:14.422 < Exit [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 07/16/23 23:16:14.445 (17.291s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:14.445 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:15.095 (650ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:15.112 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:23.549 (8.437s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:23.549 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:27.629 (4.08s) > Enter [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 07/16/23 23:16:27.629 < Exit [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 07/16/23 23:16:37.862 (10.268s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.862 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:38.445 (583ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:38.446 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:49.042 (10.596s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:16:49.042 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:17:00.129 (11.087s) > Enter [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 07/16/23 23:17:00.129 < Exit [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 07/16/23 23:17:10.352 (10.257s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.352 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.734 (382ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:10.736 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:19.354 (8.618s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:17:19.354 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:17:23.429 (4.075s) > Enter [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 07/16/23 23:17:23.429 < Exit [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 07/16/23 23:17:33.591 (10.197s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:33.591 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:34.089 (497ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:34.09 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:42.368 (8.278s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:42.368 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:50.549 (8.181s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:17:50.549 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:17:50.549 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:18:01.043 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:18:11.254 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:18:21.423 (30.908s) > Enter [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 07/16/23 23:18:21.423 STEP: Adding a global-auth-response-headers to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:228 @ 07/16/23 23:18:21.423 < Exit [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 07/16/23 23:18:31.597 (10.208s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:31.597 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:32.129 (532ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:32.13 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:40.387 (8.257s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:40.387 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:44.465 (4.078s) > Enter [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 07/16/23 23:18:44.465 < Exit [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 07/16/23 23:18:54.781 (10.316s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:54.781 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:55.208 (427ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:55.21 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:03.622 (8.446s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:19:03.622 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:19:07.698 (4.076s) > Enter [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 07/16/23 23:19:07.698 < Exit [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 07/16/23 23:19:17.914 (10.216s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:17.914 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:18.304 (391ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:18.307 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:26.675 (8.368s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:26.675 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:19:30.739 (4.064s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:30.739 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:45.008 (14.304s) > Enter [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 07/16/23 23:19:45.008 < Exit [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 07/16/23 23:20:08.248 (23.274s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:08.248 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:08.787 (539ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:08.788 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:17.73 (8.942s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:20:17.73 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:20:21.833 (4.103s) > Enter [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 07/16/23 23:20:21.833 < Exit [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 07/16/23 23:20:32.024 (10.226s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:32.024 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:32.522 (498ms) - - - > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:32.53 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:40.871 (8.341s) > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 07/16/23 23:20:40.871 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 07/16/23 23:20:46.94 (6.069s) > Enter [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 07/16/23 23:20:46.94 < Exit [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 07/16/23 23:21:04.258 (17.351s) > Enter [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:04.258 < Exit [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:04.797 (540ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:04.802 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:13.19 (8.387s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:21:13.19 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 07/16/23 23:21:19.32 (6.13s) > Enter [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 07/16/23 23:21:19.32 < Exit [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 07/16/23 23:21:49.708 (30.422s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:49.708 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:50.139 (431ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:50.145 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:58.496 (8.351s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:21:58.496 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:22:09.574 (11.112s) > Enter [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 07/16/23 23:22:09.574 < Exit [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 07/16/23 23:22:19.755 (10.181s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:19.755 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:20.256 (501ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:20.257 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:28.894 (8.637s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:22:28.894 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:22:43.112 (14.252s) > Enter [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 07/16/23 23:22:43.112 < Exit [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 07/16/23 23:23:05.645 (22.568s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:05.645 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:06.129 (484ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:06.131 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:20.599 (14.468s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:23:20.6 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:23:27.994 (7.394s) > Enter [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 07/16/23 23:23:27.994 < Exit [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 07/16/23 23:23:40.522 (12.562s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:40.522 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:40.988 (466ms) - - - > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:40.989 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:49.554 (8.565s) > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 07/16/23 23:23:49.554 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 07/16/23 23:23:53.661 (4.107s) > Enter [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 07/16/23 23:23:53.661 < Exit [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 07/16/23 23:24:03.928 (10.302s) > Enter [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:03.928 < Exit [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:04.364 (435ms) - - - > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:04.366 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:12.746 (8.379s) > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 07/16/23 23:24:12.746 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 07/16/23 23:24:16.814 (4.069s) > Enter [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 07/16/23 23:24:16.814 < Exit [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 07/16/23 23:24:39.062 (22.282s) > Enter [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.062 < Exit [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.426 (364ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:39.427 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:48.131 (8.704s) > Enter [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 07/16/23 23:24:48.132 < Exit [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 07/16/23 23:25:02.405 (14.308s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:02.405 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:02.769 (364ms) - - - > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:02.775 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:11.181 (8.406s) > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 07/16/23 23:25:11.181 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 07/16/23 23:25:24.327 (13.145s) > Enter [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 07/16/23 23:25:24.327 < Exit [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 07/16/23 23:25:44.763 (20.471s) > Enter [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:44.763 < Exit [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:45.279 (515ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:45.282 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:53.726 (8.444s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:25:53.726 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:25:57.802 (4.077s) > Enter [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 07/16/23 23:25:57.803 < Exit [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 07/16/23 23:26:27.099 (29.331s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.099 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.643 (544ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.646 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:36.154 (8.542s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:26:36.154 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:26:40.235 (4.081s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:26:40.235 Jul 16 23:26:49.946: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:26:51.943 (11.709s) > Enter [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 07/16/23 23:26:51.944 < Exit [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 07/16/23 23:27:02.135 (10.226s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:02.135 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:02.635 (500ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:02.637 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:10.976 (8.339s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:10.976 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:15.04 (4.064s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:27:15.04 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 07/16/23 23:27:29.343 (14.303s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 07/16/23 23:27:29.343 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 07/16/23 23:27:29.355 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:29.355 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:29.875 (520ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:29.877 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:37.741 (7.898s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:37.741 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:45.891 (8.149s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 07/16/23 23:27:45.891 STEP: routing requests to the canary upstream when header value does not match and cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:630 @ 07/16/23 23:28:03.119 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 07/16/23 23:28:03.125 (17.268s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:03.125 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:03.604 (479ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:03.605 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:11.902 (8.297s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:28:11.902 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:28:23.063 (11.161s) > Enter [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 07/16/23 23:28:23.063 < Exit [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 07/16/23 23:28:40.338 (17.309s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:40.338 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:40.752 (414ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:40.754 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.068 (8.315s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:28:49.068 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:28:53.189 (4.121s) > Enter [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 07/16/23 23:28:53.189 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:94 @ 07/16/23 23:29:10.345 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:101 @ 07/16/23 23:29:13.397 < Exit [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 07/16/23 23:29:13.425 (20.27s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:13.425 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:13.959 (534ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:13.961 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:22.387 (8.427s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:29:22.387 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:29:26.497 (4.11s) > Enter [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 07/16/23 23:29:26.497 < Exit [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 07/16/23 23:29:34.509 (8.047s) > Enter [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 07/16/23 23:29:34.509 < Exit [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 07/16/23 23:29:51.844 (17.335s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:51.844 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:52.449 (605ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:52.451 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:02.775 (10.363s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:30:02.775 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:30:08.866 (6.091s) > Enter [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 07/16/23 23:30:08.866 < Exit [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 07/16/23 23:30:15.919 (7.053s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:15.919 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:16.435 (515ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:16.437 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:40.742 (24.37s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:30:40.742 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:30:57.46 (16.718s) > Enter [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 07/16/23 23:30:57.46 < Exit [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 07/16/23 23:31:14.185 (16.763s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:14.185 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:14.687 (502ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:14.689 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:23.074 (8.386s) > Enter [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 07/16/23 23:31:23.074 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:107 @ 07/16/23 23:31:23.075 < Exit [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 07/16/23 23:31:23.075 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:23.075 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:23.495 (420ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:23.497 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:32.125 (8.663s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:31:32.125 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:31:46.863 (14.738s) > Enter [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 07/16/23 23:31:46.863 < Exit [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 07/16/23 23:32:13.132 (26.303s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:13.132 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:13.542 (410ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:13.543 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:21.845 (8.301s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:32:21.845 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:32:32.94 (11.13s) > Enter [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 07/16/23 23:32:32.94 < Exit [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 07/16/23 23:32:43.229 (10.289s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.229 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.683 (454ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:43.686 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:52.383 (8.697s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:32:52.383 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:32:56.466 (4.083s) > Enter [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 07/16/23 23:32:56.466 < Exit [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 07/16/23 23:33:11.547 (15.115s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.547 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:11.984 (436ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.986 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:20.45 (8.464s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:33:20.45 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 07/16/23 23:33:32.659 (12.244s) > Enter [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 07/16/23 23:33:32.659 Jul 16 23:34:02.788: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not noannotationnopassthrough.com < Exit [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 07/16/23 23:34:08.035 (35.41s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:08.036 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:08.724 (688ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:08.73 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:16.88 (8.151s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:34:16.881 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:34:20.959 (4.078s) > Enter [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 07/16/23 23:34:20.959 < Exit [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 07/16/23 23:34:31.272 (10.348s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:31.272 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:31.691 (419ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:31.694 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:41.1 (9.407s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:34:41.1 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:35:00.246 (19.146s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 07/16/23 23:35:00.246 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 07/16/23 23:35:03.378 (3.166s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.378 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.897 (519ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:03.899 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:12.446 (8.548s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:35:12.446 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:35:16.511 (4.065s) > Enter [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 07/16/23 23:35:16.511 < Exit [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 07/16/23 23:35:49.692 (33.215s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:49.692 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:50.092 (400ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:35:50.093 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:35:52.103 (2.01s) > Enter [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 07/16/23 23:35:52.103 < Exit [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 07/16/23 23:36:52.175 (1m0.14s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:36:52.175 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:36:52.185 (10ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:52.186 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:02.922 (10.77s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:37:02.922 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:37:07.012 (4.09s) > Enter [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 07/16/23 23:37:07.012 < Exit [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 07/16/23 23:37:24.253 (17.242s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:24.253 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:24.676 (423ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:24.678 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:32.973 (8.329s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:37:32.973 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:37:37.052 (4.079s) > Enter [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 07/16/23 23:37:37.052 < Exit [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 07/16/23 23:37:47.815 (10.762s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:47.815 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:48.335 (520ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:48.336 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:58.16 (9.824s) > Enter [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 07/16/23 23:37:58.16 < Exit [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 07/16/23 23:38:08.445 (10.319s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:08.445 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:08.913 (468ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:08.914 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:16.27 (7.355s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:38:16.27 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:38:27.37 (11.1s) > Enter [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 07/16/23 23:38:27.37 < Exit [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 07/16/23 23:38:37.659 (10.323s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:37.659 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.366 (708ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:38.369 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:50.759 (12.39s) > Enter [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 07/16/23 23:38:50.759 < Exit [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 07/16/23 23:39:09.202 (18.477s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:09.202 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:09.666 (464ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:09.667 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:20.364 (10.697s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:39:20.364 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:39:26.451 (6.087s) > Enter [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 07/16/23 23:39:26.451 < Exit [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 07/16/23 23:39:36.677 (10.26s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.677 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:37.244 (568ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:37.246 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:46.548 (9.301s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:39:46.548 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:39:48.593 (2.045s) > Enter [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 07/16/23 23:39:48.593 < Exit [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 07/16/23 23:39:58.782 (10.188s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.782 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:59.281 (499ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:59.283 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:09.944 (10.696s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:40:09.944 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:40:14.019 (4.074s) > Enter [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 07/16/23 23:40:14.019 < Exit [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 07/16/23 23:40:36.276 (22.292s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:36.276 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:37.147 (871ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:37.158 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:45.052 (7.894s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 07/16/23 23:40:45.052 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 07/16/23 23:40:55.399 (10.347s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:55.399 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:56.086 (686ms) - - - > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.088 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:04.49 (8.436s) > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 07/16/23 23:41:04.49 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 07/16/23 23:41:08.564 (4.074s) > Enter [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 07/16/23 23:41:08.564 < Exit [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 07/16/23 23:41:18.798 (10.233s) > Enter [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:18.798 < Exit [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:19.252 (455ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:19.254 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:27.682 (8.428s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 07/16/23 23:41:27.682 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 07/16/23 23:41:37.904 (10.256s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:37.904 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:38.533 (629ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.181 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.294 (14.113s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:07:48.294 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:08:06.535 (18.275s) > Enter [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 07/16/23 23:08:06.535 < Exit [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 07/16/23 23:08:19.035 (12.5s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:19.036 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:22.623 (3.587s) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:22.634 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:33.298 (10.698s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:33.298 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:41.456 (8.158s) > Enter [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 07/16/23 23:08:41.456 < Exit [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 07/16/23 23:08:58.789 (17.333s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:58.789 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:59.423 (634ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:59.425 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:07.036 (7.646s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:09:07.036 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:09:11.131 (4.095s) > Enter [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 07/16/23 23:09:11.131 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:115 @ 07/16/23 23:09:28.355 STEP: sending request from an implicitly denied IP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:123 @ 07/16/23 23:09:28.363 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:131 @ 07/16/23 23:09:28.369 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:139 @ 07/16/23 23:09:28.381 < Exit [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 07/16/23 23:09:35.394 (24.298s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:35.394 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:35.813 (419ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:35.815 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:43.362 (7.548s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:43.362 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:09:51.533 (8.17s) > Enter [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 07/16/23 23:09:51.533 < Exit [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 07/16/23 23:10:08.703 (17.205s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.703 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:09.316 (613ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:09.318 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:18.473 (9.154s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:18.473 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:10:29.549 (11.076s) > Enter [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 07/16/23 23:10:29.549 < Exit [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 07/16/23 23:12:01.67 (1m32.267s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:01.67 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:02.208 (575ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:02.214 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:10.539 (8.324s) > Enter [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 07/16/23 23:12:10.539 < Exit [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 07/16/23 23:12:13.724 (3.185s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:13.724 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:14.29 (566ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:14.293 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:23.098 (8.805s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:23.098 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:27.239 (4.141s) > Enter [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 07/16/23 23:12:27.239 < Exit [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 07/16/23 23:12:34.414 (7.21s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:34.414 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:35.005 (591ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:35.039 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:42.388 (7.349s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:12:42.388 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:12:46.475 (4.088s) > Enter [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 07/16/23 23:12:46.475 Jul 16 23:12:56.021: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 07/16/23 23:12:58.041 (11.565s) > Enter [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 07/16/23 23:12:58.041 < Exit [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 07/16/23 23:13:08.414 (10.408s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.414 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:08.876 (461ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:08.877 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:18.056 (9.178s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:13:18.056 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:13:22.157 (4.101s) > Enter [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 07/16/23 23:13:22.157 < Exit [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 07/16/23 23:13:29.225 (7.069s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:29.225 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:29.887 (662ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:29.89 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:39.107 (9.251s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:13:39.107 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:13:43.181 (4.074s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 07/16/23 23:13:43.181 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 07/16/23 23:14:10.942 (27.795s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:10.942 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:11.517 (575ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:11.518 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:22.99 (11.472s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:14:22.99 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:14:27.23 (4.24s) > Enter [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 07/16/23 23:14:27.23 < Exit [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 07/16/23 23:14:49.899 (22.703s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:49.899 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.182 (7.283s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:14:57.182 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:14:57.182 (0s) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:57.184 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:08.252 (11.102s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:15:08.252 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:15:12.39 (4.138s) > Enter [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 07/16/23 23:15:12.39 < Exit [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 07/16/23 23:15:22.633 (10.243s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.633 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.102 (469ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:23.104 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.984 (8.914s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:31.984 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:15:36.044 (4.06s) > Enter [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 07/16/23 23:15:36.044 < Exit [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 07/16/23 23:15:43.084 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:43.084 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:43.533 (449ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:43.534 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:53.243 (9.708s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:15:53.243 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:16:01.378 (8.135s) > Enter [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 07/16/23 23:16:01.378 < Exit [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 07/16/23 23:16:18.568 (17.224s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:18.568 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:19.084 (516ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:19.086 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:27.839 (8.752s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:27.839 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:16:31.857 (4.053s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:16:31.857 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:16:53.175 (21.318s) > Enter [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 07/16/23 23:16:53.175 < Exit [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 07/16/23 23:16:58.37 (5.195s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:58.37 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:58.799 (429ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:58.8 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:07.105 (8.339s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:07.105 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:17:15.232 (8.127s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:17:15.232 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:17:43.549 (28.352s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 07/16/23 23:17:43.549 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 07/16/23 23:17:43.559 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:43.559 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:44.126 (567ms) - - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:44.132 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:52.272 (8.14s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:52.272 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 07/16/23 23:17:56.337 (4.065s) > Enter [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 07/16/23 23:17:56.338 [SKIPPED] GeoIP test are temporarily disabled In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:71 @ 07/16/23 23:17:56.338 < Exit [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 07/16/23 23:17:56.338 (0s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:56.338 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:56.866 (528ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:56.867 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:05.372 (8.539s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:05.372 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:09.472 (4.1s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:09.472 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:23.753 (14.281s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 07/16/23 23:18:23.753 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 07/16/23 23:18:35.016 (11.297s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:35.016 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:35.607 (591ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:35.609 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:43.138 (7.529s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:18:43.138 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:18:54.215 (11.077s) > Enter [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 07/16/23 23:18:54.216 < Exit [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 07/16/23 23:20:26.407 (1m32.295s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.407 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.885 (478ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:26.887 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:37.187 (10.334s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:20:37.187 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:20:45.389 (8.202s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 07/16/23 23:20:45.389 STEP: routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:557 @ 07/16/23 23:21:02.659 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 07/16/23 23:21:02.665 (17.31s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:02.665 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:03.083 (418ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:03.085 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:11.612 (8.528s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:11.613 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:15.676 (4.064s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:21:15.676 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:21:30.005 (14.329s) > Enter [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 07/16/23 23:21:30.005 < Exit [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 07/16/23 23:21:53.323 (23.352s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:53.323 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:53.812 (489ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:53.814 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:03.724 (9.944s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:22:03.724 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:22:07.799 (4.075s) > Enter [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 07/16/23 23:22:07.799 < Exit [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 07/16/23 23:22:17.991 (10.193s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:17.992 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:18.348 (357ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:18.35 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:25.849 (7.5s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:25.849 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:29.974 (4.125s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:22:29.975 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:22:35.051 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:22:45.228 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:22:55.444 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:23:05.609 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:23:20.804 (50.898s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 07/16/23 23:23:20.804 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 07/16/23 23:23:20.815 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:20.815 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.307 (492ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:21.309 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:29.836 (8.527s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:23:29.836 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:23:33.883 (4.082s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:23:33.883 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:23:40.947 (7.064s) > Enter [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 07/16/23 23:23:40.947 < Exit [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 07/16/23 23:23:51.186 (10.238s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.186 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.782 (596ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:51.784 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:01.236 (9.487s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:24:01.236 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:24:07.344 (6.108s) > Enter [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 07/16/23 23:24:07.344 < Exit [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 07/16/23 23:24:16.393 (9.049s) > Enter [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 07/16/23 23:24:16.393 < Exit [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 07/16/23 23:24:40.653 (24.294s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:40.653 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:41.482 (829ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:41.484 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:50.125 (8.641s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:50.125 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:54.192 (4.067s) > Enter [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 07/16/23 23:24:54.192 < Exit [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 07/16/23 23:25:04.321 (10.163s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:04.321 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:04.923 (601ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:04.925 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:13.199 (8.274s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:25:13.199 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:25:17.26 (4.061s) > Enter [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 07/16/23 23:25:17.26 < Exit [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 07/16/23 23:25:24.298 (7.039s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:24.298 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:24.749 (451ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:24.752 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:33.474 (8.756s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:25:33.474 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:25:37.542 (4.067s) > Enter [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 07/16/23 23:25:37.542 < Exit [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 07/16/23 23:26:06.773 (29.265s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:06.773 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.274 (502ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:07.276 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:15.787 (8.511s) > Enter [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 07/16/23 23:26:15.787 < Exit [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 07/16/23 23:26:18.987 (3.2s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:18.987 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:19.381 (394ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:19.383 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.733 (8.35s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:27.733 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:26:31.801 (4.102s) > Enter [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 07/16/23 23:26:31.801 < Exit [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 07/16/23 23:26:38.85 (7.05s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:38.85 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:39.478 (628ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:39.479 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:48.115 (8.636s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:26:48.115 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:26:59.194 (11.079s) > Enter [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 07/16/23 23:26:59.195 < Exit [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 07/16/23 23:27:12.403 (13.243s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:12.403 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:13.018 (615ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:13.019 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:21.582 (8.563s) > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 07/16/23 23:27:21.582 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 07/16/23 23:27:34.703 (13.156s) > Enter [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 07/16/23 23:27:34.703 < Exit [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 07/16/23 23:29:42.768 (2m8.202s) > Enter [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:42.769 < Exit [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:43.223 (454ms) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:43.227 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:53.678 (10.45s) > Enter [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 07/16/23 23:29:53.678 < Exit [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 07/16/23 23:31:59.236 (2m5.735s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:59.236 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:59.608 (372ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:59.609 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:07.878 (8.303s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:32:07.878 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:32:16 (8.122s) > Enter [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 07/16/23 23:32:16 STEP: routing requests destined for the mainline ingress to the maineline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:185 @ 07/16/23 23:32:33.194 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:195 @ 07/16/23 23:32:33.2 < Exit [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 07/16/23 23:32:33.205 (17.24s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:33.206 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:33.607 (402ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:33.609 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:42.047 (8.438s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:32:42.047 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 07/16/23 23:32:44.131 (2.084s) > Enter [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 07/16/23 23:32:44.131 < Exit [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 07/16/23 23:33:01.382 (17.284s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.382 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.909 (527ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:01.911 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:09.441 (7.531s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:33:09.441 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:33:13.505 (4.063s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:33:13.505 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:33:30.702 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:33:38.854 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:33:38.882 (25.412s) > Enter [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 07/16/23 23:33:38.883 < Exit [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 07/16/23 23:33:38.915 (33ms) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:38.915 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:39.351 (436ms) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:39.353 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:47.674 (8.321s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:33:47.674 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:33:51.753 (4.079s) > Enter [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 07/16/23 23:33:51.753 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:39 @ 07/16/23 23:33:51.753 STEP: sending request to www.fromtowwwredirect.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:55 @ 07/16/23 23:34:01.902 < Exit [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 07/16/23 23:34:01.908 (10.19s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:01.908 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:02.385 (477ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:02.387 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:10.798 (8.412s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:10.798 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:14.981 (4.183s) > Enter [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 07/16/23 23:34:14.981 < Exit [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 07/16/23 23:34:25.139 (10.158s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:25.139 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:25.527 (388ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:25.529 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:34.003 (8.508s) > Enter [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 07/16/23 23:34:34.003 < Exit [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 07/16/23 23:34:37.287 (3.284s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:37.287 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:37.727 (440ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:37.729 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:46.195 (8.467s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:34:46.195 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:34:50.299 (4.103s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 07/16/23 23:34:50.299 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:82 @ 07/16/23 23:35:07.674 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:89 @ 07/16/23 23:35:07.684 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 07/16/23 23:35:07.935 (17.671s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:07.935 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:08.597 (662ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:08.599 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:16.925 (8.326s) > Enter [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 07/16/23 23:35:16.925 < Exit [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 07/16/23 23:35:27.115 (10.19s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:27.115 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:27.606 (491ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:27.607 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:36.182 (8.609s) > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 07/16/23 23:35:36.182 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 07/16/23 23:35:40.286 (4.104s) > Enter [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 07/16/23 23:35:40.286 < Exit [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 07/16/23 23:35:57.881 (17.595s) > Enter [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:57.882 < Exit [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:58.487 (606ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:58.488 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:08.838 (10.384s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:36:08.838 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:36:08.844 (7ms) > Enter [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 07/16/23 23:36:08.844 < Exit [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 07/16/23 23:36:20.132 (11.288s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.132 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:20.736 (604ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:20.747 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:35.265 (14.553s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:36:35.265 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 07/16/23 23:36:40.48 (5.214s) > Enter [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 07/16/23 23:36:40.48 < Exit [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 07/16/23 23:36:50.676 (10.196s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:50.676 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:51.171 (494ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:51.175 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:05.11 (13.969s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:37:05.11 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:37:07.17 (2.06s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 07/16/23 23:37:07.17 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 07/16/23 23:37:39.655 (32.519s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:39.655 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:40.653 (998ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:40.661 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:51.734 (11.073s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:37:51.734 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:38:03.848 (12.148s) > Enter [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 07/16/23 23:38:03.849 < Exit [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 07/16/23 23:38:24.234 (20.386s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:24.234 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:24.679 (445ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:24.68 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:32.938 (8.292s) > Enter [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 07/16/23 23:38:32.938 < Exit [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 07/16/23 23:38:43.94 (11.002s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:43.94 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:44.431 (490ms) - - - > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:44.432 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:52.684 (8.252s) > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 07/16/23 23:38:52.684 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 07/16/23 23:38:56.739 (4.055s) > Enter [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 07/16/23 23:38:56.739 STEP: setting an ingress with a nil backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:39 @ 07/16/23 23:38:56.739 < Exit [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 07/16/23 23:39:14.138 (17.433s) > Enter [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:14.138 < Exit [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:14.962 (824ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:14.965 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:24.07 (9.105s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:24.07 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:28.143 (4.073s) > Enter [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 07/16/23 23:39:28.143 < Exit [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 07/16/23 23:39:38.36 (10.251s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:38.36 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:39.039 (679ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:39.042 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:48.893 (9.851s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:39:48.893 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:40:03.237 (14.378s) > Enter [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 07/16/23 23:40:03.237 < Exit [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 07/16/23 23:40:09.71 (6.473s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:09.71 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:10.252 (542ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:10.253 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:19.088 (8.835s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:40:19.088 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:40:23.173 (4.085s) > Enter [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 07/16/23 23:40:23.173 < Exit [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 07/16/23 23:40:38.779 (15.64s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:38.779 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:39.307 (527ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:39.308 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:47.706 (8.397s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:40:47.706 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:40:55.919 (8.214s) > Enter [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 07/16/23 23:40:55.919 STEP: routing requests to the canary upstream when cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:667 @ 07/16/23 23:41:13.225 STEP: routing requests to the mainline upstream when cookie is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:678 @ 07/16/23 23:41:21.42 STEP: routing requests to the mainline upstream when cookie is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:689 @ 07/16/23 23:41:31.387 < Exit [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 07/16/23 23:41:41.387 (45.536s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:41.387 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:41.882 (496ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.174 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:47.886 (13.712s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:07:47.886 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:08:05.964 (18.112s) > Enter [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 07/16/23 23:08:05.964 < Exit [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 07/16/23 23:08:16.513 (10.55s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:16.513 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:18.635 (2.121s) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:18.644 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:33.277 (14.667s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:08:33.277 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:08:37.346 (4.069s) > Enter [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 07/16/23 23:08:37.346 < Exit [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 07/16/23 23:08:47.641 (10.296s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:47.641 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:48.061 (420ms) - - - - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:48.065 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:56.738 (8.673s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:56.738 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:09:02.831 (6.128s) > Enter [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 07/16/23 23:09:02.831 < Exit [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 07/16/23 23:09:13.19 (10.358s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:13.19 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:13.879 (690ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:13.881 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:23.851 (9.97s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:09:23.851 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:09:27.921 (4.07s) > Enter [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 07/16/23 23:09:27.921 < Exit [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 07/16/23 23:09:38.098 (10.211s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:38.098 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:38.641 (542ms) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:38.642 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:47.013 (8.37s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:09:47.013 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:09:51.1 (4.087s) > Enter [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 07/16/23 23:09:51.1 < Exit [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 07/16/23 23:10:08.284 (17.218s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.284 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:08.876 (592ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:08.879 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:17.058 (8.179s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:10:17.058 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:10:21.245 (4.187s) > Enter [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 07/16/23 23:10:21.245 < Exit [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 07/16/23 23:10:36.438 (15.228s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:36.438 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:37.064 (626ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:37.067 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:45.508 (8.441s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:45.508 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:49.586 (4.077s) > Enter [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 07/16/23 23:10:49.586 < Exit [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 07/16/23 23:10:59.919 (10.333s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:59.919 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:00.531 (612ms) - - - > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:00.533 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:09.091 (8.614s) > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 07/16/23 23:11:09.091 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 07/16/23 23:11:13.182 (4.091s) > Enter [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 07/16/23 23:11:13.182 < Exit [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 07/16/23 23:11:26.418 (13.236s) > Enter [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:26.418 < Exit [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:26.883 (466ms) - - - > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:26.886 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:35.167 (8.337s) > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 07/16/23 23:11:35.167 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 07/16/23 23:11:39.249 (4.082s) > Enter [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 07/16/23 23:11:39.249 STEP: turning on proxy_intercept_errors directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:59 @ 07/16/23 23:11:49.509 STEP: configuring error_page directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:62 @ 07/16/23 23:11:49.509 STEP: creating error locations - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:67 @ 07/16/23 23:11:49.509 STEP: updating configuration when only custom-http-error value changes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:72 @ 07/16/23 23:11:49.509 STEP: ignoring duplicate values (503 in this case) per server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:90 @ 07/16/23 23:11:55.803 STEP: using the custom default-backend from annotation for upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:102 @ 07/16/23 23:12:06.081 < Exit [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 07/16/23 23:12:16.315 (37.103s) > Enter [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.315 < Exit [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:17.092 (777ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:17.094 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:26.253 (9.159s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:12:26.253 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:12:30.38 (4.127s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:12:30.38 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:12:40.55 (10.205s) > Enter [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 07/16/23 23:12:40.55 < Exit [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 07/16/23 23:12:40.557 (7ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:40.557 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:41.043 (485ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:41.045 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:49.182 (8.137s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:49.182 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:12:53.256 (4.074s) > Enter [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 07/16/23 23:12:53.256 < Exit [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 07/16/23 23:13:22.75 (29.529s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:22.751 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:23.247 (496ms) - - - > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:23.249 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.429 (9.214s) > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 07/16/23 23:13:32.429 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 07/16/23 23:13:36.507 (4.079s) > Enter [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 07/16/23 23:13:36.507 STEP: running cfssl gencert -initca ca_csr.json | cfssljson -bare ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:43.545 STEP: running cfssl gencert -ca ca.pem -ca-key ca-key.pem -config=cfssl_config.json -profile=intermediate intermediate_ca_csr.json | cfssljson -bare intermediate_ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:43.952 STEP: running cfssl gencert -ca intermediate_ca.pem -ca-key intermediate_ca-key.pem -config=cfssl_config.json -profile=ocsp ocsp_csr.json | cfssljson -bare ocsp - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 07/16/23 23:13:44.496 STEP: running cfssl serve -db-config=db-config.json -ca-key=intermediate_ca-key.pem -ca=intermediate_ca.pem -config=cfssl_config.json -responder=ocsp.pem -responder-key=ocsp-key.pem - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:228 @ 07/16/23 23:13:44.802 STEP: running cfssl gencert -remote=localhost -profile=server leaf_csr.json | cfssljson -bare leaf - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:238 @ 07/16/23 23:13:49.804 STEP: running cfssl ocsprefresh -ca intermediate_ca.pem -responder=ocsp.pem -responder-key=ocsp-key.pem -db-config=db-config.json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:252 @ 07/16/23 23:13:50.312 < Exit [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 07/16/23 23:14:19.018 (42.545s) > Enter [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:19.019 < Exit [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:19.766 (748ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:19.784 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:28.844 (9.06s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:14:28.844 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:14:32.923 (4.113s) > Enter [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 07/16/23 23:14:32.923 < Exit [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 07/16/23 23:14:58.308 (25.386s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.309 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.898 (590ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:58.904 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:07.074 (8.204s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:15:07.074 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:15:11.143 (4.069s) > Enter [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 07/16/23 23:15:11.143 < Exit [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 07/16/23 23:15:31.188 (20.046s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:31.189 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:31.695 (506ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:15:31.695 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:15:31.695 (0s) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.698 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:40.015 (8.352s) > Enter [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 07/16/23 23:15:40.015 < Exit [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 07/16/23 23:15:56.386 (16.37s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:56.386 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:56.782 (396ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:56.784 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:04.113 (7.363s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:16:04.113 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:16:08.211 (4.099s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:16:08.211 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:16:25.445 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:16:33.599 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:16:33.62 (25.443s) > Enter [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 07/16/23 23:16:33.62 STEP: serving the default certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:204 @ 07/16/23 23:16:38.67 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:214 @ 07/16/23 23:16:38.72 < Exit [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 07/16/23 23:16:38.72 (5.1s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:38.72 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.166 (446ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:16:39.168 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:16:41.179 (2.011s) > Enter [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 07/16/23 23:16:41.179 < Exit [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 07/16/23 23:17:41.25 (1m0.14s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:17:41.25 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:17:41.266 (16ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:41.269 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:49.268 (7.999s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:17:49.268 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:17:53.439 (4.171s) > Enter [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 07/16/23 23:17:53.439 < Exit [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 07/16/23 23:18:03.611 (10.206s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:03.611 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:04.065 (454ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:04.067 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:11.387 (7.321s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:11.387 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:15.513 (4.126s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:15.513 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:29.758 (14.244s) > Enter [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 07/16/23 23:18:29.758 < Exit [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 07/16/23 23:18:52.938 (23.215s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:52.938 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:53.44 (502ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:53.442 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:01.722 (8.314s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:19:01.722 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:19:05.782 (4.06s) > Enter [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 07/16/23 23:19:05.782 < Exit [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 07/16/23 23:19:12.827 (7.045s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:12.827 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:13.418 (591ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:13.419 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:21.929 (8.511s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:19:21.93 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:19:26.01 (4.081s) > Enter [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 07/16/23 23:19:26.011 < Exit [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 07/16/23 23:19:43.294 (17.318s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:43.294 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:43.763 (468ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:43.765 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:53.125 (9.36s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:19:53.125 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:19:57.249 (4.124s) > Enter [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 07/16/23 23:19:57.249 < Exit [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 07/16/23 23:20:14.861 (17.646s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:14.861 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:15.741 (880ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:20:15.741 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:20:15.741 (0s) - - - > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:15.743 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:24.398 (8.655s) > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 07/16/23 23:20:24.398 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 07/16/23 23:20:28.465 (4.067s) > Enter [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 07/16/23 23:20:28.465 < Exit [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 07/16/23 23:20:45.696 (17.265s) > Enter [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:45.696 < Exit [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:46.089 (393ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:46.09 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:54.488 (8.398s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:20:54.488 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:21:05.565 (11.111s) > Enter [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 07/16/23 23:21:05.565 < Exit [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 07/16/23 23:21:15.847 (10.282s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:15.847 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:16.528 (681ms) - - - > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:16.53 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:26.755 (10.225s) > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 07/16/23 23:21:26.755 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 07/16/23 23:21:30.816 (4.061s) > Enter [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 07/16/23 23:21:30.816 < Exit [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 07/16/23 23:21:41.003 (10.222s) > Enter [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:41.003 < Exit [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:41.534 (531ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:41.538 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:50.229 (8.691s) > Enter [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 07/16/23 23:21:50.229 < Exit [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 07/16/23 23:22:00.623 (10.393s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:00.623 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:00.983 (361ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:00.985 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:09.37 (8.419s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:22:09.37 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:22:20.486 (11.116s) > Enter [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 07/16/23 23:22:20.486 < Exit [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 07/16/23 23:22:30.763 (10.277s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:30.763 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:31.515 (787ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:31.521 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:40.235 (8.714s) > Enter [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 07/16/23 23:22:40.235 < Exit [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 07/16/23 23:22:54.509 (14.274s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:54.509 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:55.102 (593ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:55.104 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:03.655 (8.585s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:23:03.655 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:23:14.739 (11.084s) > Enter [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 07/16/23 23:23:14.739 < Exit [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 07/16/23 23:23:25.032 (10.292s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.032 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:25.8 (768ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:23:25.803 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 07/16/23 23:23:27.816 (2.013s) > Enter [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 07/16/23 23:23:27.816 < Exit [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 07/16/23 23:23:36.925 (9.144s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:23:36.925 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 07/16/23 23:23:36.938 (13ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:36.94 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:45.412 (8.472s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:23:45.412 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:23:49.52 (4.108s) > Enter [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 07/16/23 23:23:49.52 < Exit [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 07/16/23 23:23:59.723 (10.203s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:59.723 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:00.261 (538ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:00.263 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:07.782 (7.554s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:07.782 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:11.858 (4.076s) > Enter [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 07/16/23 23:24:11.858 < Exit [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 07/16/23 23:24:22.095 (10.237s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:22.095 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:22.827 (732ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:22.835 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:31.215 (8.414s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:24:31.215 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:24:33.268 (2.053s) > Enter [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 07/16/23 23:24:33.268 < Exit [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 07/16/23 23:24:50.51 (17.242s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:50.51 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:51.166 (657ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:24:51.166 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:24:51.166 (0s) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:51.169 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:00.029 (8.86s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:25:00.029 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:25:08.096 (8.101s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 07/16/23 23:25:08.096 STEP: routing requests to the canary upstream when header pattern is matched - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:514 @ 07/16/23 23:25:25.318 STEP: routing requests to the mainline upstream when header failed to match header value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:523 @ 07/16/23 23:25:25.328 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 07/16/23 23:25:25.338 (17.243s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:25.339 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:25.856 (517ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:25.858 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:34.445 (8.622s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:25:34.445 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:25:45.53 (11.085s) > Enter [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 07/16/23 23:25:45.53 < Exit [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 07/16/23 23:25:55.715 (10.185s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:55.715 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:56.172 (456ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:56.173 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:04.819 (8.68s) > Enter [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 07/16/23 23:26:04.819 STEP: setting permanent-redirect annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:34 @ 07/16/23 23:26:04.819 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:52 @ 07/16/23 23:26:15.073 < Exit [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 07/16/23 23:26:15.081 (10.263s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:15.081 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:15.564 (482ms) - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:15.565 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:23.961 (8.396s) > Enter [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 07/16/23 23:26:23.961 STEP: basic HTTP GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.963 STEP: basic HTTP GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.977 STEP: basic HTTPS GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:28.992 STEP: basic HTTPS GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.017 STEP: basic HTTP POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.044 STEP: basic HTTP POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.06 STEP: basic HTTPS POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.371 STEP: basic HTTPS POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:29.776 STEP: basic HTTP GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.197 STEP: basic HTTP GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.574 STEP: basic HTTPS GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:30.98 STEP: basic HTTPS GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:31.34 STEP: basic HTTP POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:31.743 STEP: basic HTTP POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.136 STEP: basic HTTPS POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.539 STEP: basic HTTPS POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 07/16/23 23:26:32.97 < Exit [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 07/16/23 23:26:33.344 (9.418s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:33.344 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:33.883 (539ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:33.885 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:41.697 (7.812s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:26:41.697 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:26:45.787 (4.089s) > Enter [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 07/16/23 23:26:45.787 < Exit [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 07/16/23 23:27:16.141 (30.389s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.141 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:16.729 (588ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:27:16.729 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:27:16.729 (0s) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:16.734 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:27.28 (10.546s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:27.28 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:27:35.372 (8.127s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 07/16/23 23:27:35.373 STEP: routing requests to the canary upstream when header is set to 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:451 @ 07/16/23 23:27:52.596 STEP: routing requests to the mainline upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:460 @ 07/16/23 23:27:52.607 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:469 @ 07/16/23 23:27:52.618 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:478 @ 07/16/23 23:27:52.624 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 07/16/23 23:27:52.632 (17.259s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:52.632 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:53.184 (552ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:53.185 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:01.521 (8.37s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:01.521 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:05.603 (4.082s) > Enter [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 07/16/23 23:28:05.603 < Exit [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 07/16/23 23:28:22.87 (17.267s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:22.87 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:23.292 (422ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:28:23.292 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:28:23.292 (0s) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:23.293 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:31.555 (8.296s) > Enter [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 07/16/23 23:28:31.555 < Exit [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 07/16/23 23:28:48.825 (17.268s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:48.825 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:49.416 (591ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:49.42 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:57.983 (8.563s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:28:57.983 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:29:02.021 (4.072s) > Enter [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 07/16/23 23:29:02.021 < Exit [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 07/16/23 23:29:19.271 (17.25s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:19.271 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:19.996 (725ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:29:19.996 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:29:19.996 (0s) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:19.999 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:27.495 (7.496s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:29:27.495 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 07/16/23 23:29:31.525 (4.064s) > Enter [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 07/16/23 23:29:31.525 < Exit [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 07/16/23 23:29:48.787 (17.262s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:48.787 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:49.468 (682ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:49.475 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:58.075 (8.6s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:29:58.075 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:30:09.134 (11.098s) > Enter [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 07/16/23 23:30:09.134 < Exit [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 07/16/23 23:30:19.281 (10.147s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:19.281 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:19.775 (494ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:19.783 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:29.478 (9.696s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:30:29.478 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:30:33.47 (4.057s) > Enter [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 07/16/23 23:30:33.471 < Exit [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 07/16/23 23:30:54.972 (21.502s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:54.973 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:00.749 (5.815s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:31:00.749 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:31:00.749 (0s) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:00.828 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:08.468 (7.64s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:31:08.468 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:31:16.616 (8.148s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 07/16/23 23:31:16.616 < Exit [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 07/16/23 23:31:42.294 (25.713s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:42.294 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:42.864 (569ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:42.867 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:51.421 (8.554s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:51.421 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:55.49 (4.069s) > Enter [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 07/16/23 23:31:55.49 < Exit [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 07/16/23 23:32:06.723 (11.267s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:06.723 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:07.164 (442ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:07.168 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:14.509 (7.341s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:14.509 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:25.596 (11.087s) > Enter [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 07/16/23 23:32:25.596 < Exit [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 07/16/23 23:32:42.761 (17.199s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:42.761 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:43.179 (418ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:43.184 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:51.238 (8.053s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 07/16/23 23:32:51.238 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 07/16/23 23:33:01.441 (10.238s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:01.442 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:02.003 (562ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:02.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:11.575 (9.568s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:33:11.575 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:33:19.722 (8.147s) > Enter [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 07/16/23 23:33:19.722 < Exit [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 07/16/23 23:34:15.058 (55.405s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:15.058 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:15.476 (418ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:15.477 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:23.831 (8.354s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:23.831 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:34:27.893 (4.061s) > Enter [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 07/16/23 23:34:27.893 < Exit [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 07/16/23 23:34:38.318 (10.46s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:38.318 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:38.801 (483ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:38.803 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:48.547 (9.744s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:34:48.547 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:34:52.605 (4.058s) > Enter [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 07/16/23 23:34:52.605 < Exit [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 07/16/23 23:35:02.751 (10.18s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:02.751 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:03.297 (546ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:03.312 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:11.68 (8.368s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:35:11.68 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:35:22.776 (11.096s) > Enter [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 07/16/23 23:35:22.776 < Exit [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 07/16/23 23:35:32.97 (10.229s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:32.97 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:33.388 (418ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:33.39 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:41.909 (8.519s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:35:41.909 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:35:43.975 (2.066s) > Enter [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 07/16/23 23:35:43.975 < Exit [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 07/16/23 23:35:54.184 (10.209s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.184 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.637 (453ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:54.638 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:04.492 (9.888s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:04.492 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:10.59 (6.098s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 07/16/23 23:36:10.59 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 07/16/23 23:36:21.417 (10.826s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.417 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:21.909 (492ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:21.91 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:31.441 (9.565s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:36:31.441 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:36:39.575 (8.135s) > Enter [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 07/16/23 23:36:39.575 < Exit [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 07/16/23 23:36:56.821 (17.246s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:56.821 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:57.222 (400ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:57.223 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:07.971 (10.783s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:37:07.971 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:37:19.071 (11.099s) > Enter [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 07/16/23 23:37:19.071 < Exit [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 07/16/23 23:37:29.282 (10.212s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:29.283 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:29.692 (409ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:29.693 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:38.006 (8.347s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:37:38.006 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:37:58.271 (20.264s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 07/16/23 23:37:58.271 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 07/16/23 23:38:02.529 (4.293s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.529 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.964 (434ms) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:02.971 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:11.459 (8.488s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:38:11.459 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 07/16/23 23:38:22.582 (11.122s) > Enter [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 07/16/23 23:38:22.582 < Exit [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 07/16/23 23:38:32.759 (10.211s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:32.759 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:33.178 (419ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:33.18 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:41.812 (8.632s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:38:41.812 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:38:49.899 (8.087s) > Enter [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 07/16/23 23:38:49.899 < Exit [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 07/16/23 23:39:07.104 (17.239s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.104 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.608 (504ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:07.617 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:15.244 (7.627s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:39:15.244 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:39:21.419 (6.176s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:39:21.42 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:39:38.597 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:39:46.821 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:39:46.84 (25.455s) > Enter [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 07/16/23 23:39:46.841 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:163 @ 07/16/23 23:39:52.033 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:169 @ 07/16/23 23:39:55.176 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:180 @ 07/16/23 23:39:58.206 < Exit [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 07/16/23 23:39:58.206 (11.366s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.206 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:58.754 (548ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:58.76 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:07.505 (8.774s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:40:07.505 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:40:13.578 (6.073s) > Enter [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 07/16/23 23:40:13.578 < Exit [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 07/16/23 23:40:30.774 (17.231s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:30.774 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:31.257 (483ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:40:31.257 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:40:31.258 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:31.26 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:39.618 (8.359s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:40:39.619 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:40:45.749 (6.13s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:40:45.749 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:40:50.946 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:41:01.126 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:41:11.35 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:41:21.559 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:41:36.857 (51.177s) > Enter [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 07/16/23 23:41:36.857 < Exit [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 07/16/23 23:41:43.93 (7.073s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:43.93 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:44.372 (442ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.287 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:49.044 (14.757s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:07:49.044 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:08:05.568 (16.559s) > Enter [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 07/16/23 23:08:05.569 < Exit [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 07/16/23 23:08:27.887 (22.318s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:27.887 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:28.576 (689ms) - - - > Enter [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:28.582 < Exit [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:36.857 (8.309s) > Enter [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 07/16/23 23:08:36.857 < Exit [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 07/16/23 23:08:57.345 (20.488s) > Enter [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:57.345 < Exit [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:57.948 (603ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:57.95 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:06.944 (9.028s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:09:06.944 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:09:25.075 (18.131s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:09:25.075 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:09:25.075 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:09:35.276 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:09:45.533 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:09:55.741 (30.7s) > Enter [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 07/16/23 23:09:55.741 STEP: Adding a global-auth-request-redirect to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:242 @ 07/16/23 23:09:55.741 < Exit [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 07/16/23 23:10:05.886 (10.18s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:05.886 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:06.357 (471ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:06.359 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:15.633 (9.274s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:10:15.633 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:10:26.724 (11.091s) > Enter [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 07/16/23 23:10:26.724 < Exit [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 07/16/23 23:10:40.107 (13.418s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:40.107 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:40.707 (600ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:40.727 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:49.212 (8.485s) > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 07/16/23 23:10:49.212 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 07/16/23 23:11:00.338 (11.126s) > Enter [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 07/16/23 23:11:00.338 Jul 16 23:11:14.762: INFO: Request distribution: map[echo-7b6bf466cc-k5lq4:6 echo-7b6bf466cc-xhgrs:9 echo-7b6bf466cc-zm2tc:15] < Exit [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 07/16/23 23:11:14.762 (14.48s) > Enter [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:14.762 < Exit [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:15.337 (574ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:15.344 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:23.899 (8.554s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:11:23.899 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:11:28.014 (4.115s) > Enter [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 07/16/23 23:11:28.014 < Exit [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 07/16/23 23:11:45.272 (17.315s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:45.272 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:46.053 (781ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:46.055 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:54.592 (8.537s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:11:54.592 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:12:02.74 (8.185s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:12:02.741 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:12:02.741 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:12:12.97 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:12:23.365 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:12:33.703 (30.997s) > Enter [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 07/16/23 23:12:33.703 STEP: Adding a global-auth-signin to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:215 @ 07/16/23 23:12:33.703 < Exit [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 07/16/23 23:12:43.93 (10.227s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:43.93 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:44.68 (750ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:44.681 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:53.488 (8.807s) > Enter [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 07/16/23 23:12:53.488 < Exit [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 07/16/23 23:13:16.154 (22.701s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:16.154 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:16.68 (526ms) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:16.682 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:24.418 (7.736s) > Enter [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 07/16/23 23:13:24.418 < Exit [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 07/16/23 23:13:43.022 (18.638s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:43.022 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:43.557 (535ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:43.569 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:52.109 (8.54s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:13:52.109 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:14:00.22 (8.111s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:14:00.22 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:14:00.221 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:14:10.357 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:14:20.687 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:14:31.22 (31.034s) > Enter [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 07/16/23 23:14:31.221 STEP: Adding a global-auth-cache-key to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:163 @ 07/16/23 23:14:31.221 < Exit [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 07/16/23 23:14:56.908 (25.722s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:56.908 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.868 (959ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:57.873 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:07.775 (9.936s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:15:07.775 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 07/16/23 23:15:11.846 (4.07s) > Enter [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 07/16/23 23:15:11.846 < Exit [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 07/16/23 23:15:22.158 (10.312s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.158 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:22.583 (425ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:22.584 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:31.03 (8.446s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:15:31.03 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:15:35.048 (4.052s) > Enter [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 07/16/23 23:15:35.048 < Exit [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 07/16/23 23:15:45.303 (10.255s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:45.303 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:45.943 (640ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:45.959 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:54.309 (8.35s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:15:54.309 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 07/16/23 23:15:58.369 (4.06s) > Enter [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 07/16/23 23:15:58.369 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:113 @ 07/16/23 23:16:15.745 STEP: checking if the Service Cluster IP and Port are not used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:120 @ 07/16/23 23:16:15.754 < Exit [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 07/16/23 23:16:15.932 (17.597s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:15.932 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:16.329 (396ms) - - - > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:16.33 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:24.942 (8.612s) > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 07/16/23 23:16:24.942 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 07/16/23 23:16:29.022 (4.08s) > Enter [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 07/16/23 23:16:29.022 < Exit [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 07/16/23 23:16:39.31 (10.323s) > Enter [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.31 < Exit [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:39.98 (670ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:39.982 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:49.837 (9.855s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:16:49.837 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:17:00.937 (11.1s) > Enter [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 07/16/23 23:17:00.938 < Exit [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 07/16/23 23:17:11.121 (10.218s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:11.121 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:11.607 (486ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:11.608 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:20.212 (8.604s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:17:20.212 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:17:28.342 (8.13s) > Enter [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 07/16/23 23:17:28.342 < Exit [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 07/16/23 23:18:23.842 (55.569s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:23.843 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:24.502 (659ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:24.505 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:31.714 (7.243s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:31.714 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:18:35.862 (4.148s) > Enter [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 07/16/23 23:18:35.862 < Exit [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 07/16/23 23:18:46.046 (10.184s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:46.046 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:46.546 (500ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:46.548 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:53.971 (7.423s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:53.971 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:18:58.059 (4.088s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:18:58.059 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:19:12.335 (14.31s) > Enter [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 07/16/23 23:19:12.335 < Exit [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 07/16/23 23:19:35.576 (23.275s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:35.576 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:36.255 (679ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:36.256 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:43.637 (7.381s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:19:43.637 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:19:57.933 (14.296s) > Enter [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 07/16/23 23:19:57.933 < Exit [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 07/16/23 23:20:04.479 (6.58s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:04.479 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:05.013 (534ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:05.015 < Exit [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:14.859 (9.844s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 07/16/23 23:20:14.859 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:53 @ 07/16/23 23:20:14.864 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 07/16/23 23:20:14.864 (5ms) > Enter [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:14.864 < Exit [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:15.695 (831ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:15.697 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:23.308 (7.611s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:20:23.308 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:20:27.397 (4.089s) > Enter [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 07/16/23 23:20:27.397 < Exit [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 07/16/23 23:20:37.584 (10.221s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:37.584 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:38.237 (653ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:38.239 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:46.709 (8.47s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:46.709 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:50.775 (4.066s) > Enter [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 07/16/23 23:20:50.775 < Exit [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 07/16/23 23:21:01.786 (11.046s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:01.786 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:02.175 (389ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:02.177 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:10.721 (8.544s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:21:10.721 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:21:14.801 (4.08s) > Enter [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 07/16/23 23:21:14.801 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:161 @ 07/16/23 23:21:14.801 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:165 @ 07/16/23 23:21:21.843 STEP: check that '/foo/bar/bar' does not match the longest exact path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:179 @ 07/16/23 23:21:32.042 < Exit [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 07/16/23 23:21:32.048 (17.282s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:32.048 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:32.461 (413ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:32.463 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:39.797 (7.334s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:21:39.797 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:21:43.865 (4.068s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:21:43.865 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 07/16/23 23:21:51.955 (8.09s) > Enter [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 07/16/23 23:21:51.955 < Exit [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 07/16/23 23:22:02.145 (10.223s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:02.145 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:02.564 (419ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:02.566 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:11.193 (8.627s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:22:11.193 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 07/16/23 23:22:22.303 (11.11s) > Enter [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 07/16/23 23:22:22.303 < Exit [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 07/16/23 23:22:32.765 (10.496s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:32.765 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:33.67 (906ms) - - - > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:33.674 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:42.623 (8.949s) > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 07/16/23 23:22:42.623 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 07/16/23 23:22:46.677 (4.054s) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 07/16/23 23:22:46.677 STEP: adding a whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:42 @ 07/16/23 23:22:53.713 STEP: changing error-log-level - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:61 @ 07/16/23 23:23:03.876 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 07/16/23 23:23:17.205 (30.562s) > Enter [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:17.205 < Exit [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:17.616 (412ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:17.617 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:25.915 (8.298s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:23:25.916 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:23:40.996 (15.114s) > Enter [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 07/16/23 23:23:40.996 < Exit [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 07/16/23 23:23:51.243 (10.247s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.243 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:51.888 (645ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:51.89 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:02.36 (10.505s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:02.36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:24:06.483 (4.123s) > Enter [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 07/16/23 23:24:06.483 < Exit [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 07/16/23 23:24:16.671 (10.187s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:16.671 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:17.137 (467ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:17.14 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:25.522 (8.382s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:24:25.522 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:24:29.596 (4.073s) > Enter [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 07/16/23 23:24:29.596 < Exit [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 07/16/23 23:24:39.753 (10.192s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:39.753 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:40.161 (408ms) - - - > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:40.163 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:48.151 (7.988s) > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 07/16/23 23:24:48.151 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 07/16/23 23:24:59.271 (11.12s) > Enter [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 07/16/23 23:24:59.271 < Exit [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 07/16/23 23:25:10.518 (11.281s) > Enter [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:10.518 < Exit [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:10.966 (448ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:10.967 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:18.468 (7.501s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:25:18.468 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:25:22.573 (4.105s) > Enter [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 07/16/23 23:25:22.573 < Exit [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 07/16/23 23:25:39.828 (17.29s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:39.828 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:40.22 (391ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:40.221 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:47.582 (7.361s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:25:47.582 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:25:51.699 (4.117s) > Enter [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 07/16/23 23:25:51.699 < Exit [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 07/16/23 23:26:10.03 (18.365s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.03 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:10.792 (762ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:10.796 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:18.517 (7.721s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:26:18.517 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 07/16/23 23:26:29.612 (11.095s) > Enter [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 07/16/23 23:26:29.612 < Exit [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 07/16/23 23:26:39.848 (10.27s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:39.848 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:40.318 (470ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:40.322 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:49.062 (8.74s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:26:49.062 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:26:57.227 (8.165s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 07/16/23 23:26:57.227 STEP: routing requests to the canary upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:395 @ 07/16/23 23:27:14.5 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:404 @ 07/16/23 23:27:14.506 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:414 @ 07/16/23 23:27:14.512 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 07/16/23 23:27:14.518 (17.326s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:14.518 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:14.982 (464ms) - - - > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:14.983 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:23.621 (8.637s) > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 07/16/23 23:27:23.621 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 07/16/23 23:27:27.678 (4.058s) > Enter [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 07/16/23 23:27:27.678 < Exit [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 07/16/23 23:27:44.864 (17.219s) > Enter [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:44.864 < Exit [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.355 (491ms) - - - > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:45.356 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.361 (9.004s) > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 07/16/23 23:27:54.361 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 07/16/23 23:27:58.446 (4.085s) > Enter [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 07/16/23 23:27:58.446 < Exit [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 07/16/23 23:28:08.662 (10.25s) > Enter [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:08.662 < Exit [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:09.492 (830ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:09.495 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:18.198 (8.703s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:28:18.198 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 07/16/23 23:28:20.266 (2.068s) > Enter [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 07/16/23 23:28:20.266 < Exit [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 07/16/23 23:28:30.476 (10.21s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:30.476 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:31.049 (608ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:31.05 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:39.51 (8.46s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:28:39.51 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 07/16/23 23:28:43.584 (4.073s) > Enter [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 07/16/23 23:28:43.584 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:61 @ 07/16/23 23:29:00.77 STEP: sending request from an explicitly denied IP address - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:69 @ 07/16/23 23:29:00.776 STEP: sending request from an implicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:77 @ 07/16/23 23:29:00.783 < Exit [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 07/16/23 23:29:07.785 (24.235s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:07.785 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:08.219 (434ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:08.222 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:16.588 (8.366s) > Enter [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 07/16/23 23:29:16.588 < Exit [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 07/16/23 23:29:26.783 (10.195s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:26.783 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:27.308 (525ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:27.309 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:35.546 (8.271s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:29:35.546 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:29:39.603 (4.057s) > Enter [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 07/16/23 23:29:39.603 < Exit [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 07/16/23 23:29:56.89 (17.287s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:56.89 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:57.255 (365ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:29:57.255 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:29:57.255 (0s) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:57.258 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:07.638 (10.419s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:30:07.638 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:30:15.827 (8.189s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:30:15.827 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:30:15.827 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:30:26.122 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:30:36.224 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:30:48.339 (32.577s) > Enter [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 07/16/23 23:30:48.339 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:87 @ 07/16/23 23:30:48.339 STEP: Sending a request to protected service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:94 @ 07/16/23 23:30:48.391 < Exit [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 07/16/23 23:30:48.504 (165ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:48.504 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:55.877 (7.373s) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:55.918 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:09.07 (13.19s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:31:09.07 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:31:11.17 (2.1s) > Enter [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 07/16/23 23:31:11.17 < Exit [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 07/16/23 23:31:31.176 (20.041s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:31.176 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:31.616 (439ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:31:31.616 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:31:31.616 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:31.67 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:40.298 (8.628s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:40.298 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:31:44.4 (4.102s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:31:44.402 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:31:49.602 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:31:59.831 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:32:09.984 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:32:20.215 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:32:35.406 (51.073s) > Enter [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 07/16/23 23:32:35.406 STEP: receiving an internal server error without cache on location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:811 @ 07/16/23 23:32:42.457 < Exit [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 07/16/23 23:33:42.399 (1m7.062s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:42.4 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:42.892 (492ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:42.896 < Exit [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:51.181 (8.285s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 07/16/23 23:33:51.181 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:56 @ 07/16/23 23:33:51.184 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 07/16/23 23:33:51.184 (3ms) > Enter [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:51.184 < Exit [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:51.664 (480ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:51.666 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:00.007 (8.341s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:34:00.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:34:08.102 (8.129s) > Enter [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 07/16/23 23:34:08.102 STEP: routing requests destined fro the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:288 @ 07/16/23 23:34:29.661 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:297 @ 07/16/23 23:34:29.668 < Exit [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 07/16/23 23:34:29.676 (21.575s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:29.676 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:30.248 (571ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:30.253 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:39.68 (9.461s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:34:39.68 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:34:45.772 (6.092s) > Enter [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 07/16/23 23:34:45.772 < Exit [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 07/16/23 23:34:54.823 (9.051s) > Enter [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 07/16/23 23:34:54.823 < Exit [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 07/16/23 23:35:19.068 (24.279s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:19.068 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:19.459 (391ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:19.461 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:27.831 (8.37s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:35:27.831 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:35:31.866 (4.07s) > Enter [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 07/16/23 23:35:31.866 < Exit [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 07/16/23 23:35:38.908 (7.042s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:38.908 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:39.497 (588ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:39.502 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:48.362 (8.86s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:35:48.362 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 07/16/23 23:36:02.591 (14.263s) > Enter [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 07/16/23 23:36:02.591 < Exit [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 07/16/23 23:36:15.012 (12.421s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:15.012 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:15.419 (407ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:15.421 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:22.799 (7.379s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:36:22.799 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:36:26.895 (4.096s) > Enter [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 07/16/23 23:36:26.895 < Exit [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 07/16/23 23:36:44.072 (17.211s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:44.072 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:44.573 (501ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:36:44.573 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:36:44.573 (0s) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:44.575 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:52.863 (8.288s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:36:52.863 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:37:03.994 (11.165s) > Enter [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 07/16/23 23:37:03.994 < Exit [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 07/16/23 23:37:17.209 (13.215s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:17.209 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:17.698 (489ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:17.7 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:25.25 (7.55s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:37:25.25 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:37:29.308 (4.058s) > Enter [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 07/16/23 23:37:29.308 < Exit [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 07/16/23 23:37:39.541 (10.267s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:39.541 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:40.249 (708ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:40.25 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:50.903 (10.653s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:37:50.903 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:37:56.972 (6.069s) > Enter [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 07/16/23 23:37:56.972 < Exit [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 07/16/23 23:38:04.012 (7.074s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:04.012 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:04.575 (562ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:04.576 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:13.092 (8.516s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:38:13.092 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:38:21.224 (8.132s) > Enter [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 07/16/23 23:38:21.224 < Exit [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 07/16/23 23:38:38.446 (17.256s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.446 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:38.972 (525ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:38.973 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:47.576 (8.603s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:38:47.576 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:39:00.694 (13.151s) > Enter [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 07/16/23 23:39:00.694 < Exit [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 07/16/23 23:39:10.972 (10.278s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:10.972 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:11.554 (582ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:11.557 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:21.757 (10.2s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:21.757 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:39:25.828 (4.071s) > Enter [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 07/16/23 23:39:25.828 < Exit [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 07/16/23 23:39:35.962 (10.168s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:35.962 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:36.474 (511ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:36.475 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:45.251 (8.776s) > Enter [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 07/16/23 23:39:45.251 < Exit [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 07/16/23 23:39:55.449 (10.198s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:55.449 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:55.846 (396ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:55.848 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:04.392 (8.579s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:04.392 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:12.535 (8.142s) > Enter [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 07/16/23 23:40:12.535 < Exit [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 07/16/23 23:40:22.872 (10.337s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:22.872 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:23.35 (478ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:23.353 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:31.723 (8.405s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:40:31.724 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:40:35.786 (4.063s) > Enter [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 07/16/23 23:40:35.786 < Exit [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 07/16/23 23:40:53.138 (17.352s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:53.138 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:54.07 (932ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:54.097 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:02.625 (8.562s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:41:02.625 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:41:06.715 (4.09s) > Enter [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 07/16/23 23:41:06.715 < Exit [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 07/16/23 23:41:20.837 (14.122s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:20.837 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:21.278 (441ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:21.3 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:29.247 (7.948s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:41:29.248 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:41:31.27 (2.057s) > Enter [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 07/16/23 23:41:31.27 < Exit [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 07/16/23 23:41:48.597 (17.327s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:48.597 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:48.993 (395ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.242 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:51.069 (16.827s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:07:51.069 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:08:07.17 (16.135s) > Enter [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 07/16/23 23:08:07.17 < Exit [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 07/16/23 23:08:18.073 (10.903s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:18.073 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:21.927 (3.855s) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:21.964 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:34.164 (12.234s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:08:34.164 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:08:38.275 (4.111s) > Enter [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 07/16/23 23:08:38.275 < Exit [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 07/16/23 23:08:55.61 (17.335s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:55.61 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:56.065 (455ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:56.067 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:04.727 (8.695s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 07/16/23 23:09:04.727 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 07/16/23 23:09:15.337 (10.61s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:15.337 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:16.059 (722ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:16.064 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:26.631 (10.567s) > Enter [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 07/16/23 23:09:26.631 < Exit [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 07/16/23 23:09:43.812 (17.216s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:43.816 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:44.481 (664ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:44.483 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:52.854 (8.371s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:09:52.854 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:09:56.947 (4.093s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:09:56.947 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:10:14.472 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:10:22.717 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:10:22.74 (25.827s) > Enter [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 07/16/23 23:10:22.74 < Exit [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 07/16/23 23:10:27.764 (5.024s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:27.764 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:28.249 (485ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:28.252 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:36.867 (8.65s) > Enter [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 07/16/23 23:10:36.867 < Exit [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 07/16/23 23:10:54.131 (17.264s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:54.131 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:10:54.62 (489ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:54.623 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:02.922 (8.355s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:11:02.922 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:11:07.043 (4.12s) > Enter [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 07/16/23 23:11:07.043 < Exit [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 07/16/23 23:11:36.273 (29.286s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:36.273 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:36.734 (462ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:36.736 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:11:45.28 (8.543s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:11:45.28 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:11:49.471 (4.191s) > Enter [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 07/16/23 23:11:49.471 < Exit [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 07/16/23 23:11:59.696 (10.224s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:11:59.696 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:00.22 (525ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:00.222 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:07.673 (7.488s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:12:07.673 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:12:11.802 (4.129s) > Enter [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 07/16/23 23:12:11.802 < Exit [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 07/16/23 23:12:29.118 (17.317s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:29.119 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:29.598 (479ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:29.6 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:38.338 (8.773s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:38.338 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 07/16/23 23:12:42.421 (4.083s) > Enter [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 07/16/23 23:12:42.421 < Exit [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 07/16/23 23:12:53.144 (10.723s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:53.144 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:53.923 (779ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:53.953 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:02.253 (8.335s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:13:02.254 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:13:06.383 (4.13s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:13:06.383 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:13:20.773 (14.39s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 07/16/23 23:13:20.773 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 07/16/23 23:13:20.8 (27ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:20.8 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:21.451 (651ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:21.454 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:32.274 (10.854s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:13:32.274 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 07/16/23 23:13:51.868 (19.594s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 07/16/23 23:13:51.868 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 07/16/23 23:13:55.053 (3.185s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:55.053 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:55.451 (398ms) - - - > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:55.453 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:03.927 (8.508s) > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 07/16/23 23:14:03.927 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 07/16/23 23:14:08.019 (4.092s) > Enter [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 07/16/23 23:14:08.019 < Exit [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 07/16/23 23:14:15.059 (7.04s) > Enter [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.059 < Exit [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:15.545 (486ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:15.546 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:25.303 (9.757s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:14:25.303 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:14:31.39 (6.086s) > Enter [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 07/16/23 23:14:31.39 < Exit [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 07/16/23 23:14:38.906 (7.55s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:38.906 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:50.983 (12.078s) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:51.107 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:05.828 (14.755s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:15:05.828 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:15:05.835 (7ms) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 07/16/23 23:15:05.835 STEP: setting up a first deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:171 @ 07/16/23 23:15:05.835 STEP: updating the tcp service to a second deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:196 @ 07/16/23 23:15:13.198 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 07/16/23 23:15:23.493 (17.658s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.493 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:23.916 (423ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:23.918 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:32.462 (8.579s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:15:32.462 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:15:36.539 (4.076s) > Enter [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 07/16/23 23:15:36.539 < Exit [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 07/16/23 23:16:08.955 (32.451s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:08.955 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:09.389 (434ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.392 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:17.757 (8.366s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:16:17.757 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:16:21.842 (4.084s) > Enter [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 07/16/23 23:16:21.842 < Exit [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 07/16/23 23:16:28.878 (7.036s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:28.878 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:29.277 (399ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:29.279 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:36.677 (7.433s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:16:36.678 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:16:40.761 (4.083s) > Enter [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 07/16/23 23:16:40.761 < Exit [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 07/16/23 23:16:50.994 (10.233s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:50.994 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:51.379 (385ms) - - - > Enter [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:51.381 < Exit [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:59.709 (8.329s) > Enter [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 07/16/23 23:16:59.71 < Exit [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 07/16/23 23:17:09.861 (10.185s) > Enter [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:09.861 < Exit [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:10.282 (421ms) - - - > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:10.283 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:18.723 (8.44s) > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 07/16/23 23:17:18.724 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 07/16/23 23:17:22.807 (4.083s) > Enter [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 07/16/23 23:17:22.807 < Exit [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 07/16/23 23:17:50.668 (27.896s) > Enter [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:50.668 < Exit [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:51.179 (511ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:51.181 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:59.818 (8.637s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:17:59.819 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 07/16/23 23:18:03.954 (4.169s) > Enter [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 07/16/23 23:18:03.954 < Exit [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 07/16/23 23:18:36.609 (32.69s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:36.609 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:37.003 (394ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:37.005 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:45.497 (8.492s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:18:45.497 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 07/16/23 23:18:56.635 (11.138s) > Enter [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 07/16/23 23:18:56.635 < Exit [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 07/16/23 23:19:06.818 (10.218s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:06.819 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:07.2 (381ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:07.202 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:15.79 (8.588s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:19:15.79 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 07/16/23 23:19:19.867 (4.077s) > Enter [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 07/16/23 23:19:19.867 < Exit [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 07/16/23 23:19:30.126 (10.259s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:30.126 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:30.554 (428ms) - - - > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:30.555 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:38.942 (8.421s) > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 07/16/23 23:19:38.942 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 07/16/23 23:19:43.029 (4.087s) > Enter [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 07/16/23 23:19:43.029 < Exit [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 07/16/23 23:19:53.271 (10.241s) > Enter [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:53.271 < Exit [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:53.823 (553ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:53.836 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:02.051 (8.25s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:20:02.051 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:20:06.14 (4.089s) > Enter [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 07/16/23 23:20:06.14 < Exit [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 07/16/23 23:20:23.477 (17.337s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:23.477 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:23.967 (489ms) - - - > Enter [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:23.968 < Exit [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:32.478 (8.544s) > Enter [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 07/16/23 23:20:32.478 < Exit [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 07/16/23 23:20:48.821 (16.343s) > Enter [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:48.821 < Exit [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:49.341 (520ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:49.348 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:57.865 (8.517s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:20:57.865 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:21:01.925 (4.094s) > Enter [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 07/16/23 23:21:01.925 < Exit [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 07/16/23 23:21:13.025 (11.101s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.025 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:13.59 (565ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:13.591 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:23.49 (9.898s) > Enter [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 07/16/23 23:21:23.49 < Exit [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 07/16/23 23:21:33.747 (10.292s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:33.747 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:34.172 (424ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:34.173 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:43.009 (8.836s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:21:43.009 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 07/16/23 23:21:47.1 (4.091s) > Enter [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 07/16/23 23:21:47.1 < Exit [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 07/16/23 23:22:04.345 (17.279s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.345 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:04.959 (614ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:04.961 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:13.436 (8.476s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:22:13.436 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:22:17.548 (4.111s) > Enter [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 07/16/23 23:22:17.548 < Exit [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 07/16/23 23:22:27.746 (10.199s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:27.746 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:28.164 (417ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:28.165 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:36.999 (8.868s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:36.999 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:22:41.09 (4.09s) > Enter [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 07/16/23 23:22:41.09 < Exit [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 07/16/23 23:22:51.266 (10.177s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:51.266 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:51.761 (495ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:51.771 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:00.105 (8.333s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:00.105 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:04.146 (4.075s) > Enter [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 07/16/23 23:23:04.146 < Exit [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 07/16/23 23:23:21.518 (17.372s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.518 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:21.932 (414ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:21.932 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:21.932 (0s) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:21.935 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:31.384 (9.483s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:31.384 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:23:35.475 (4.091s) > Enter [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 07/16/23 23:23:35.475 < Exit [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 07/16/23 23:23:55.524 (20.049s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:55.524 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:56.075 (551ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:56.075 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:23:56.075 (0s) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:56.077 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:04.518 (8.476s) > Enter [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 07/16/23 23:24:04.518 < Exit [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 07/16/23 23:24:18.775 (14.257s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:18.775 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:19.228 (452ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:19.229 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:27.5 (8.272s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:27.501 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:24:31.562 (4.096s) > Enter [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 07/16/23 23:24:31.562 < Exit [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 07/16/23 23:24:42.129 (10.566s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:42.129 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:42.874 (745ms) - - - > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:42.875 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:51.845 (8.97s) > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 07/16/23 23:24:51.845 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 07/16/23 23:24:55.921 (4.076s) > Enter [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 07/16/23 23:24:55.921 < Exit [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 07/16/23 23:25:18.165 (22.279s) > Enter [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:18.165 < Exit [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:18.624 (459ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:18.626 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:26.989 (8.37s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:25:26.996 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:25:31.086 (4.091s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:25:31.087 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 07/16/23 23:25:52.393 (21.341s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 07/16/23 23:25:52.393 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 07/16/23 23:25:52.403 (10ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:52.403 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:52.851 (448ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:52.853 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:01.147 (8.328s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:26:01.147 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 07/16/23 23:26:05.234 (4.087s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:26:05.234 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 07/16/23 23:26:22.995 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 07/16/23 23:26:31.133 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 07/16/23 23:26:31.179 (25.98s) > Enter [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 07/16/23 23:26:31.179 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:229 @ 07/16/23 23:26:36.206 < Exit [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 07/16/23 23:26:36.237 (5.058s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:36.237 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:37.018 (782ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:37.021 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:45.616 (8.596s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:26:45.616 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 07/16/23 23:26:49.683 (4.066s) > Enter [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 07/16/23 23:26:49.683 < Exit [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 07/16/23 23:27:06.949 (17.301s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:06.949 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:07.445 (496ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:07.447 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:15.777 (8.33s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:27:15.778 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 07/16/23 23:27:30.909 (15.132s) > Enter [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 07/16/23 23:27:30.909 < Exit [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 07/16/23 23:27:45.291 (14.415s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.291 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:45.766 (475ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:45.767 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.396 (8.629s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:54.396 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:27:58.524 (4.127s) > Enter [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 07/16/23 23:27:58.524 < Exit [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 07/16/23 23:28:08.725 (10.235s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:08.725 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:09.625 (900ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:09.63 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:17.428 (7.798s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:28:17.428 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:28:21.486 (4.058s) > Enter [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 07/16/23 23:28:21.486 < Exit [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 07/16/23 23:28:31.88 (10.429s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:31.88 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:32.319 (438ms) - - - > Enter [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:32.324 < Exit [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:41.907 (9.584s) > Enter [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 07/16/23 23:28:41.907 STEP: checking SSL Certificate using the NGINX IP address - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:30 @ 07/16/23 23:28:41.908 STEP: checking SSL Certificate using the NGINX catch all server - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:45 @ 07/16/23 23:28:46.925 < Exit [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 07/16/23 23:28:46.943 (5.036s) > Enter [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:46.943 < Exit [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:47.34 (397ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:47.341 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:55.857 (8.516s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:28:55.857 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 07/16/23 23:28:59.917 (4.06s) > Enter [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 07/16/23 23:28:59.917 < Exit [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 07/16/23 23:29:17.172 (17.289s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:17.172 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:17.73 (558ms) - - - > Enter [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:17.734 < Exit [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:26.783 (9.049s) > Enter [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 07/16/23 23:29:26.783 < Exit [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 07/16/23 23:29:37.377 (10.63s) > Enter [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:37.377 < Exit [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:37.857 (480ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:37.859 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:45.315 (7.456s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:29:45.315 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 07/16/23 23:29:49.393 (4.078s) > Enter [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 07/16/23 23:29:49.393 < Exit [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 07/16/23 23:29:59.716 (10.323s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:59.716 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:00.218 (501ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:00.22 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:08.82 (8.64s) > Enter [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 07/16/23 23:30:08.82 < Exit [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 07/16/23 23:30:23.242 (14.421s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:23.242 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:30:23.721 (479ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:23.724 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:30:32.155 (8.497s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:30:32.155 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 07/16/23 23:30:36.238 (4.083s) > Enter [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 07/16/23 23:30:36.238 < Exit [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 07/16/23 23:31:06.15 (29.95s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:06.15 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:06.581 (431ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:06.583 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:15.201 (8.619s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:31:15.201 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:31:19.262 (4.061s) > Enter [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 07/16/23 23:31:19.262 < Exit [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 07/16/23 23:31:29.469 (10.206s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:29.469 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:29.882 (413ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:29.885 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:40.12 (10.27s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:31:40.12 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 07/16/23 23:31:44.185 (4.066s) > Enter [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 07/16/23 23:31:44.185 < Exit [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 07/16/23 23:31:54.361 (10.176s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:54.361 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:31:54.803 (442ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:31:54.805 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:03.07 (8.3s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:32:03.07 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:32:07.143 (4.072s) > Enter [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 07/16/23 23:32:07.143 < Exit [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 07/16/23 23:32:27.197 (20.054s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:27.197 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:27.565 (368ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:32:27.565 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:32:27.565 (0s) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:27.566 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:35.926 (8.394s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:32:35.926 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 07/16/23 23:32:40.026 (4.1s) > Enter [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 07/16/23 23:32:40.026 < Exit [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 07/16/23 23:32:50.274 (10.248s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:50.274 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:32:50.832 (558ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:50.833 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:32:59.336 (8.503s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:32:59.336 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 07/16/23 23:33:10.405 (11.103s) > Enter [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 07/16/23 23:33:10.405 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:54 @ 07/16/23 23:33:27.663 STEP: ensuring that first entry in X-Forwarded-Host is used as the best host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:75 @ 07/16/23 23:33:27.674 < Exit [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 07/16/23 23:33:27.683 (17.278s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:27.683 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:28.126 (443ms) - - - > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:28.128 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:35.418 (7.324s) > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 07/16/23 23:33:35.418 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 07/16/23 23:33:39.517 (4.099s) > Enter [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 07/16/23 23:33:39.517 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:48 @ 07/16/23 23:33:49.731 < Exit [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 07/16/23 23:33:49.739 (10.222s) > Enter [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:49.739 < Exit [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:33:50.184 (444ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:50.185 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:33:58.583 (8.398s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:33:58.583 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:34:02.597 (4.049s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 07/16/23 23:34:02.598 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 07/16/23 23:34:13.497 (10.899s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:13.497 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:13.905 (409ms) - - - > Enter [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:13.907 < Exit [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:22.216 (8.309s) > Enter [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 07/16/23 23:34:22.216 < Exit [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 07/16/23 23:34:32.368 (10.187s) > Enter [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:32.368 < Exit [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:34:32.925 (557ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:32.927 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:34:41.551 (8.624s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:34:41.551 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:34:47.637 (6.086s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:34:47.637 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:34:57.01 (9.372s) > Enter [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 07/16/23 23:34:57.01 < Exit [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 07/16/23 23:35:04.275 (7.3s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:04.275 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:04.736 (461ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:04.742 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:14.56 (9.817s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:35:14.56 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:35:18.617 (4.057s) > Enter [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 07/16/23 23:35:18.617 < Exit [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 07/16/23 23:35:28.832 (10.214s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:28.832 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:29.223 (392ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:29.225 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:38.691 (9.501s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:35:38.692 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 07/16/23 23:35:42.8 (4.108s) > Enter [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 07/16/23 23:35:42.8 < Exit [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 07/16/23 23:35:53.62 (10.82s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:53.62 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:35:54.081 (461ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:35:54.084 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:03.891 (9.841s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:03.891 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:36:09.979 (6.088s) > Enter [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 07/16/23 23:36:09.979 < Exit [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 07/16/23 23:36:25.241 (15.261s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:25.241 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:25.701 (460ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:25.703 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:33.605 (7.936s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:36:33.605 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:36:37.682 (4.077s) > Enter [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 07/16/23 23:36:37.682 < Exit [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 07/16/23 23:36:47.901 (10.219s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:47.901 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:36:48.375 (474ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:48.376 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:36:56.928 (8.552s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:36:56.928 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 07/16/23 23:37:03.013 (6.119s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 07/16/23 23:37:03.013 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 07/16/23 23:37:14.194 (11.181s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:14.194 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:14.663 (469ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:14.665 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:22.951 (8.286s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:37:22.951 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 07/16/23 23:37:27.087 (4.136s) > Enter [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 07/16/23 23:37:27.087 < Exit [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 07/16/23 23:37:37.286 (10.233s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:37.286 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:37:37.719 (433ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:37.721 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:37:47.137 (9.416s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:37:47.137 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:37:51.362 (4.225s) > Enter [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 07/16/23 23:37:51.362 < Exit [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 07/16/23 23:38:01.535 (10.206s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:01.535 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:02.216 (682ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:02.219 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:09.728 (7.509s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:38:09.729 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 07/16/23 23:38:13.797 (4.069s) > Enter [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 07/16/23 23:38:13.797 < Exit [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 07/16/23 23:38:31.175 (17.412s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:31.175 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:38:31.552 (376ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:31.553 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:38:40.919 (9.366s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:38:40.919 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:38:46.993 (6.074s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:38:46.993 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:39:03.307 (16.348s) > Enter [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 07/16/23 23:39:03.307 < Exit [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 07/16/23 23:39:07.472 (4.165s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:07.472 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:08.148 (676ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:08.153 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:16.57 (8.417s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:39:16.57 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:39:22.657 (6.087s) > Enter [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 07/16/23 23:39:22.657 < Exit [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 07/16/23 23:39:32.838 (10.215s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:32.838 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:33.231 (394ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:33.235 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:40.596 (7.361s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:39:40.596 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:39:44.718 (4.122s) > Enter [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 07/16/23 23:39:44.718 Jul 16 23:40:00.953: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 07/16/23 23:40:02.967 (18.283s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:02.967 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:03.473 (506ms) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:03.475 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:14.008 (10.533s) > Enter [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 07/16/23 23:40:14.008 < Exit [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 07/16/23 23:40:28.273 (14.265s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:28.274 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:29.069 (795ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:29.07 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:36.48 (7.444s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:36.48 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:40:40.607 (4.127s) > Enter [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 07/16/23 23:40:40.607 < Exit [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 07/16/23 23:40:47.651 (7.043s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:47.651 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:48.174 (524ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:48.176 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:56.86 (8.684s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:40:56.86 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:41:00.951 (4.125s) > Enter [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 07/16/23 23:41:00.951 < Exit [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 07/16/23 23:41:11.126 (10.175s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.126 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.617 (491ms) - - - > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:11.624 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:20.141 (8.516s) > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 07/16/23 23:41:20.141 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 07/16/23 23:41:22.214 (2.074s) > Enter [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 07/16/23 23:41:22.214 < Exit [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 07/16/23 23:41:32.382 (10.202s) > Enter [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:32.382 < Exit [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:32.85 (468ms) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:32.854 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:40.227 (7.374s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:41:40.227 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 07/16/23 23:41:44.297 (4.07s) > Enter [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 07/16/23 23:41:44.297 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:65 @ 07/16/23 23:41:44.297 STEP: sending request to www should redirect to domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:91 @ 07/16/23 23:41:59.768 STEP: sending request to domain should not redirect to www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:103 @ 07/16/23 23:41:59.784 < Exit [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 07/16/23 23:41:59.805 (15.508s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:59.805 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:00.18 (409ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:34.241 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:07:48.51 (14.268s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:07:48.51 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:08:06.784 (18.308s) > Enter [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 07/16/23 23:08:06.784 < Exit [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 07/16/23 23:08:13.874 (7.09s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:13.874 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:15.012 (1.138s) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:15.026 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:31.711 (16.684s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:31.711 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:08:35.749 (4.073s) > Enter [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 07/16/23 23:08:35.749 < Exit [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 07/16/23 23:08:45.914 (10.164s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:45.914 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:08:46.502 (588ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:46.507 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:08:58.795 (12.288s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:08:58.795 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 07/16/23 23:09:02.852 (4.092s) > Enter [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 07/16/23 23:09:02.852 < Exit [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 07/16/23 23:09:20.835 (17.983s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:20.835 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:21.688 (853ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:09:21.688 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 07/16/23 23:09:21.688 (0s) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:21.694 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:29.368 (7.675s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:09:29.369 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:09:33.396 (4.061s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:09:33.396 Jul 16 23:09:42.839: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:09:44.841 (11.445s) > Enter [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 07/16/23 23:09:44.841 < Exit [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 07/16/23 23:09:55.117 (10.276s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:55.117 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:09:55.595 (478ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:09:55.621 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:10:03.902 (8.315s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:03.902 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:10:07.984 (4.082s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:10:07.984 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:10:23.092 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:10:33.264 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 07/16/23 23:10:43.654 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 07/16/23 23:10:53.881 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 07/16/23 23:11:09.227 (1m1.333s) > Enter [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 07/16/23 23:11:09.227 STEP: logging into server thisHost /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:821 @ 07/16/23 23:11:09.227 STEP: receiving an internal server error without cache on thisHost location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:833 @ 07/16/23 23:11:16.27 < Exit [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 07/16/23 23:12:16.192 (1m7.058s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.192 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:16.811 (619ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:16.817 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:25.674 (8.857s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:25.674 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:36.81 (11.17s) > Enter [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 07/16/23 23:12:36.81 < Exit [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 07/16/23 23:12:47.088 (10.278s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:47.088 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:12:47.718 (631ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:47.72 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:12:56.863 (9.143s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:12:56.863 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 07/16/23 23:13:07.932 (11.103s) > Enter [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 07/16/23 23:13:07.932 < Exit [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 07/16/23 23:13:18.203 (10.272s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:18.203 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:18.842 (639ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:18.844 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:28.621 (9.777s) > Enter [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 07/16/23 23:13:28.621 < Exit [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 07/16/23 23:13:39.052 (10.465s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:39.052 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:13:39.573 (521ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:39.576 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:13:47.884 (8.308s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:13:47.884 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 07/16/23 23:13:51.979 (4.095s) > Enter [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 07/16/23 23:13:51.979 < Exit [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 07/16/23 23:14:17.414 (25.47s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:17.414 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:18.388 (973ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:18.39 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:27.699 (9.309s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:14:27.699 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:14:34.284 (6.619s) > Enter [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 07/16/23 23:14:34.284 < Exit [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 07/16/23 23:14:57.094 (22.81s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:57.094 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:14:58.009 (914ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:14:58.012 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:08.991 (11.014s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:15:08.991 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:15:15.072 (6.08s) > Enter [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 07/16/23 23:15:15.072 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:69 @ 07/16/23 23:15:15.072 STEP: making a request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:78 @ 07/16/23 23:15:25.351 STEP: creating an ingress definition with the rewrite-target annotation set on the "/" location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:88 @ 07/16/23 23:15:25.361 STEP: making a second request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:102 @ 07/16/23 23:15:35.543 < Exit [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 07/16/23 23:15:35.551 (20.514s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:35.551 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:15:36 (449ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:36.002 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:15:44.55 (8.548s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:15:44.55 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 07/16/23 23:15:50.604 (6.055s) > Enter [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 07/16/23 23:15:50.604 < Exit [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 07/16/23 23:16:00.832 (10.227s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:00.832 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:01.23 (398ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:01.232 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:09.619 (8.421s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:16:09.619 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 07/16/23 23:16:13.742 (4.123s) > Enter [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 07/16/23 23:16:13.742 < Exit [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 07/16/23 23:16:37.172 (23.465s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.172 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:16:37.786 (614ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:37.787 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:16:46.283 (8.495s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:16:46.283 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:16:54.442 (8.159s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:16:54.442 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:16:54.442 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:17:04.664 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:17:15.032 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:17:25.212 (30.804s) > Enter [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 07/16/23 23:17:25.212 STEP: Adding a global-auth-snippet to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:254 @ 07/16/23 23:17:25.212 < Exit [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 07/16/23 23:17:35.375 (10.198s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:35.375 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:35.767 (391ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:35.769 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:44.223 (8.454s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:17:44.223 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 07/16/23 23:17:48.3 (4.077s) > Enter [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 07/16/23 23:17:48.3 < Exit [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 07/16/23 23:17:55.341 (7.041s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:55.341 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:17:55.791 (449ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:17:55.792 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:04.137 (8.379s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:18:04.137 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 07/16/23 23:18:08.248 (4.112s) > Enter [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 07/16/23 23:18:08.249 < Exit [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 07/16/23 23:18:18.49 (10.241s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:18.49 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:18.911 (422ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:18.912 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:27.287 (8.374s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:18:27.287 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 07/16/23 23:18:31.349 (4.062s) > Enter [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 07/16/23 23:18:31.349 < Exit [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 07/16/23 23:18:47.764 (16.45s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:47.764 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:18:48.191 (427ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:48.193 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:18:56.623 (8.43s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:18:56.623 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 07/16/23 23:19:00.738 (4.115s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 07/16/23 23:19:00.738 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 07/16/23 23:19:26.161 (25.457s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:26.161 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:26.559 (398ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:26.564 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:35.081 (8.55s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:19:35.081 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 07/16/23 23:19:39.133 (4.052s) > Enter [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 07/16/23 23:19:39.133 < Exit [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 07/16/23 23:19:49.376 (10.244s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:49.376 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:19:49.802 (425ms) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:49.804 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:19:58.14 (8.336s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:19:58.14 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 07/16/23 23:20:13.506 (15.401s) > Enter [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 07/16/23 23:20:13.506 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:68 @ 07/16/23 23:20:20.544 STEP: making sure new ingress is responding - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:74 @ 07/16/23 23:20:23.704 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:76 @ 07/16/23 23:20:23.704 < Exit [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 07/16/23 23:20:25.721 (12.215s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:25.721 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:26.267 (546ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:26.269 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:34.686 (8.452s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:20:34.686 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:20:38.757 (4.07s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:20:38.757 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 07/16/23 23:20:48.932 (10.175s) > Enter [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 07/16/23 23:20:48.932 < Exit [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 07/16/23 23:20:52.115 (3.183s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:52.115 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:20:52.579 (463ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:20:52.58 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:00.264 (7.684s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:00.264 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:04.298 (4.069s) > Enter [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 07/16/23 23:21:04.298 < Exit [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 07/16/23 23:21:15.98 (11.682s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:15.98 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:16.663 (683ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:16.666 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:26.922 (10.256s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:26.922 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:21:30.978 (4.056s) > Enter [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 07/16/23 23:21:30.978 < Exit [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 07/16/23 23:21:42.285 (11.341s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:42.285 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:21:42.816 (531ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:42.818 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:21:51.43 (8.612s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:21:51.43 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 07/16/23 23:21:55.497 (4.067s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:21:55.497 Jul 16 23:22:04.729: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 07/16/23 23:22:06.734 (11.271s) > Enter [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 07/16/23 23:22:06.734 < Exit [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 07/16/23 23:22:16.936 (10.203s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:16.937 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:22:17.423 (487ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:17.424 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:22:25.824 (8.4s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:22:25.824 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:22:33.95 (8.16s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:22:33.95 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 07/16/23 23:23:02.307 (28.392s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 07/16/23 23:23:02.308 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 07/16/23 23:23:02.317 (10ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:02.317 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:02.727 (409ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:02.729 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:11.096 (8.368s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:23:11.097 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 07/16/23 23:23:17.255 (6.159s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 07/16/23 23:23:17.255 < Exit [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 07/16/23 23:23:42.874 (25.653s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:42.874 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:23:43.4 (525ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:43.401 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:23:52.034 (8.633s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:23:52.034 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 07/16/23 23:24:00.279 (8.245s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:24:00.279 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 07/16/23 23:24:00.279 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 07/16/23 23:24:10.446 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 07/16/23 23:24:20.663 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 07/16/23 23:24:30.894 (30.65s) > Enter [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 07/16/23 23:24:30.894 STEP: Adding an ingress rule for /bar with annotation enable-global-auth = false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:128 @ 07/16/23 23:24:30.894 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:140 @ 07/16/23 23:24:35.071 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:147 @ 07/16/23 23:24:35.079 < Exit [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 07/16/23 23:24:35.086 (4.226s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:35.086 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:24:35.565 (479ms) - - - > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:35.566 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:24:44.981 (9.415s) > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 07/16/23 23:24:44.981 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 07/16/23 23:24:49.116 (4.135s) > Enter [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 07/16/23 23:24:49.116 STEP: regenerating the correct configuration after update - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:65 @ 07/16/23 23:25:11.373 < Exit [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 07/16/23 23:25:22.684 (33.602s) > Enter [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:22.684 < Exit [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:25:23.246 (562ms) - - - > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:23.247 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:25:31.61 (8.398s) > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 07/16/23 23:25:31.61 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 07/16/23 23:25:35.714 (4.104s) > Enter [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 07/16/23 23:25:35.715 < Exit [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 07/16/23 23:26:07.011 (31.33s) > Enter [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.011 < Exit [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:07.5 (489ms) - - - > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:07.503 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:16.195 (8.692s) > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 07/16/23 23:26:16.195 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 07/16/23 23:26:20.306 (4.111s) > Enter [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 07/16/23 23:26:20.306 < Exit [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 07/16/23 23:26:27.349 (7.044s) > Enter [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.349 < Exit [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:26:27.949 (600ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:27.952 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:26:36.662 (8.744s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:26:36.662 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:26:40.824 (4.163s) > Enter [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 07/16/23 23:26:40.824 < Exit [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 07/16/23 23:27:03.024 (22.234s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:03.024 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:03.527 (504ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:03.528 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:11.896 (8.368s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:11.896 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 07/16/23 23:27:15.977 (4.081s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:27:15.977 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 07/16/23 23:27:30.444 (14.468s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 07/16/23 23:27:30.445 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 07/16/23 23:27:30.455 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:30.455 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:31.001 (545ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:31.003 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:39.402 (8.434s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:27:39.403 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:27:43.461 (4.058s) > Enter [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 07/16/23 23:27:43.461 < Exit [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 07/16/23 23:27:53.686 (10.226s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:53.687 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:27:54.173 (486ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:27:54.174 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:02.854 (8.714s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:28:02.854 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 07/16/23 23:28:06.916 (4.062s) > Enter [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 07/16/23 23:28:06.916 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:114 @ 07/16/23 23:28:06.917 STEP: creating an ingress definition with the use-regex amd rewrite-target annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:123 @ 07/16/23 23:28:17.092 STEP: ensuring '/foo' matches '~* ^/foo' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:137 @ 07/16/23 23:28:27.312 STEP: ensuring '/foo/bar' matches '~* ^/foo.+' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:147 @ 07/16/23 23:28:27.32 < Exit [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 07/16/23 23:28:27.329 (20.413s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:27.329 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:27.758 (429ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:27.76 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:35.027 (7.302s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:28:35.027 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 07/16/23 23:28:35.031 (4ms) > Enter [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 07/16/23 23:28:35.031 < Exit [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 07/16/23 23:28:38.754 (3.722s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:38.754 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:28:39.199 (446ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:39.205 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:28:47.511 (8.307s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:28:47.511 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 07/16/23 23:28:51.575 (4.064s) > Enter [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 07/16/23 23:28:51.575 < Exit [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 07/16/23 23:29:08.745 (17.204s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:08.745 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:29:09.129 (383ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:09.13 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:29:17.772 (8.641s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:29:17.772 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 07/16/23 23:29:28.874 (11.102s) > Enter [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 07/16/23 23:29:28.874 Automatically polling progress: [Setting] use-proxy-protocol should enable PROXY Protocol for TCP (Spec Runtime: 3m19.498s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 In [It] (Node Runtime: 2m59.754s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 Spec Goroutine goroutine 2683 [IO wait, 2 minutes] internal/poll.runtime_pollWait(0x7f5468c3dd40, 0x72) /usr/local/go/src/runtime/netpoll.go:306 internal/poll.(*pollDesc).wait(0xc000c86a00?, 0xc000daf725?, 0x0) /usr/local/go/src/internal/poll/fd_poll_runtime.go:84 internal/poll.(*pollDesc).waitRead(...) /usr/local/go/src/internal/poll/fd_poll_runtime.go:89 internal/poll.(*FD).Read(0xc000c86a00, {0xc000daf725, 0x15b, 0x15b}) /usr/local/go/src/internal/poll/fd_unix.go:167 net.(*netFD).Read(0xc000c86a00, {0xc000daf725?, 0x453656?, 0x380?}) /usr/local/go/src/net/fd_posix.go:55 net.(*conn).Read(0xc000126120, {0xc000daf725?, 0x19913c0?, 0xc000daf500?}) /usr/local/go/src/net/net.go:183 io.ReadAll({0x1f62e00, 0xc000126120}) /usr/local/go/src/io/io.go:701 > k8s.io/ingress-nginx/test/e2e/settings.glob..func38.5() /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:211 github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0xa0558e, 0xc000cfc300}) /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3() /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:850 < Exit [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 07/16/23 23:39:43.452 (10m15.338s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:43.452 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:39:44.02 (568ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:44.023 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:39:52.324 (8.301s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:39:52.324 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 07/16/23 23:40:01.39 (9.101s) > Enter [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 07/16/23 23:40:01.39 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:54 @ 07/16/23 23:40:18.685 < Exit [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 07/16/23 23:40:18.693 (17.302s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:18.693 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:19.14 (448ms) - - - > Enter [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:19.154 < Exit [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:27.75 (8.595s) > Enter [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 07/16/23 23:40:27.75 < Exit [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 07/16/23 23:40:39.948 (12.232s) > Enter [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:39.948 < Exit [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:40:40.361 (413ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:40.362 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:40:49.01 (8.647s) > Enter [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 07/16/23 23:40:49.01 < Exit [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 07/16/23 23:41:11.382 (22.406s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:11.382 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:12.084 (702ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:12.087 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:19.624 (7.537s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:41:19.624 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 07/16/23 23:41:23.694 (4.07s) > Enter [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 07/16/23 23:41:23.694 < Exit [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 07/16/23 23:41:33.973 (10.314s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:33.974 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:41:34.437 (464ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:34.439 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 07/16/23 23:41:42.983 (8.544s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:41:42.983 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 07/16/23 23:41:47.055 (4.073s) > Enter [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 07/16/23 23:41:47.055 < Exit [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 07/16/23 23:42:04.248 (17.227s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:04.248 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 07/16/23 23:42:04.658 (410ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:42:04.658 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 07/16/23 23:42:04.658 (0s) - - - \ No newline at end of file From be6f1d54c75af5c7ce6db646fe99deb0f77b6570 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Mon, 17 Jul 2023 00:04:41 -0400 Subject: [PATCH 282/822] gofmt --- test/e2e/e2e.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index a61c368ee..5d410248a 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -32,6 +32,7 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/admission" _ "k8s.io/ingress-nginx/test/e2e/annotations" _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/cgroups" _ "k8s.io/ingress-nginx/test/e2e/dbg" _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" _ "k8s.io/ingress-nginx/test/e2e/endpointslices" @@ -50,7 +51,6 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/ssl" _ "k8s.io/ingress-nginx/test/e2e/status" _ "k8s.io/ingress-nginx/test/e2e/tcpudp" - _ "k8s.io/ingress-nginx/test/e2e/cgroups" ) // RunE2ETests checks configuration parameters (specified through flags) and then runs From 8f8f471422f0ec4ef8dc09dd22d317b9ee1814de Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Jul 2023 04:47:08 -0700 Subject: [PATCH 283/822] Bump docker/setup-buildx-action from 2.9.0 to 2.9.1 (#10207) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.9.0 to 2.9.1. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/2a1a44ac4aa01993040736bd95bb470da1a38365...4c0219f9ac95b02789c1075625400b2acbff50b1) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e2ddec049..097e77276 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@2a1a44ac4aa01993040736bd95bb470da1a38365 # v2.9.0 + uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1 with: version: latest From 49674631ef52ef3b37f0ec0ec3210f8cfe3aa951 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Jul 2023 05:49:09 -0700 Subject: [PATCH 284/822] Bump google.golang.org/grpc from 1.56.1 to 1.56.2 (#10193) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.1 to 1.56.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.56.1...v1.56.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2b808ef2b..8864e3a83 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.11.0 - google.golang.org/grpc v1.56.1 + google.golang.org/grpc v1.56.2 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 9fee095bc..acd310e3a 100644 --- a/go.sum +++ b/go.sum @@ -661,8 +661,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ= -google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= +google.golang.org/grpc v1.56.2 h1:fVRFRnXvU+x6C4IlHZewvJOVHoOv1TUuQyoRsYnB4bI= +google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 6416ed821d726d78d8988ed1ae189bc243903471 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Thu, 20 Jul 2023 23:36:09 +0800 Subject: [PATCH 285/822] chore: bump OpenResty to v1.21.4.2 (#10219) Signed-off-by: Jintao Zhang --- images/nginx/rootfs/build.sh | 66 ++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index 5e215bf72..a99ebd292 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -20,14 +20,14 @@ set -o pipefail export NGINX_VERSION=1.21.6 -# Check for recent changes: https://github.com/vision5/ngx_devel_kit/compare/v0.3.1...master -export NDK_VERSION=0.3.1 +# Check for recent changes: https://github.com/vision5/ngx_devel_kit/compare/v0.3.2...master +export NDK_VERSION=0.3.2 # Check for recent changes: https://github.com/openresty/set-misc-nginx-module/compare/v0.33...master export SETMISC_VERSION=0.33 -# Check for recent changes: https://github.com/openresty/headers-more-nginx-module/compare/v0.33...master -export MORE_HEADERS_VERSION=0.33 +# Check for recent changes: https://github.com/openresty/headers-more-nginx-module/compare/v0.34...master +export MORE_HEADERS_VERSION=0.34 # Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...atomx:master export NGINX_DIGEST_AUTH=1.0.0 @@ -65,32 +65,32 @@ export MODSECURITY_LIB_VERSION=e9a7ba4a60be48f761e0328c6dfcc668d70e35a0 # Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.2...v3.3/master export OWASP_MODSECURITY_CRS_VERSION=v3.3.4 -# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.21...master -export LUA_NGX_VERSION=0.10.21 +# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.25...master +export LUA_NGX_VERSION=0.10.25 -# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.11...master -export LUA_STREAM_NGX_VERSION=0.0.11 +# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.13...master +export LUA_STREAM_NGX_VERSION=0.0.13 # Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/8aa93ead98ba2060d4efd594ae33a35d153589bf...master export LUA_UPSTREAM_VERSION=8aa93ead98ba2060d4efd594ae33a35d153589bf -# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.10...openresty:master -export LUA_CJSON_VERSION=2.1.0.10 +# Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.11...openresty:master +export LUA_CJSON_VERSION=2.1.0.11 # Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.3...master export GEOIP2_VERSION=a26c6beed77e81553686852dceb6c7fdacc5970d -# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20220411...v2.1-agentzh -export LUAJIT_VERSION=2.1-20220411 +# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20230410...v2.1-agentzh +export LUAJIT_VERSION=2.1-20230410 # Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/v0.04...master export LUA_RESTY_BALANCER=0.04 -# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.11...master -export LUA_RESTY_CACHE=0.11 +# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.13...master +export LUA_RESTY_CACHE=0.13 -# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.23...master -export LUA_RESTY_CORE=0.1.23 +# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.27...master +export LUA_RESTY_CORE=0.1.27 # Check for recent changes: https://github.com/cloudflare/lua-resty-cookie/compare/v0.1.0...master export LUA_RESTY_COOKIE_VERSION=303e32e512defced053a6484bc0745cf9dc0d39e @@ -101,17 +101,17 @@ export LUA_RESTY_DNS=0.22 # Check for recent changes: https://github.com/ledgetech/lua-resty-http/compare/v0.16.1...master export LUA_RESTY_HTTP=0ce55d6d15da140ecc5966fa848204c6fd9074e8 -# Check for recent changes: https://github.com/openresty/lua-resty-lock/compare/v0.08...master -export LUA_RESTY_LOCK=0.08 +# Check for recent changes: https://github.com/openresty/lua-resty-lock/compare/v0.09...master +export LUA_RESTY_LOCK=0.09 -# Check for recent changes: https://github.com/openresty/lua-resty-upload/compare/v0.10...master -export LUA_RESTY_UPLOAD_VERSION=0.10 +# Check for recent changes: https://github.com/openresty/lua-resty-upload/compare/v0.11...master +export LUA_RESTY_UPLOAD_VERSION=0.11 # Check for recent changes: https://github.com/openresty/lua-resty-string/compare/v0.15...master export LUA_RESTY_STRING_VERSION=0.15 -# Check for recent changes: https://github.com/openresty/lua-resty-memcached/compare/v0.16...master -export LUA_RESTY_MEMCACHED_VERSION=0.16 +# Check for recent changes: https://github.com/openresty/lua-resty-memcached/compare/v0.17...master +export LUA_RESTY_MEMCACHED_VERSION=0.17 # Check for recent changes: https://github.com/openresty/lua-resty-redis/compare/v0.30...master export LUA_RESTY_REDIS_VERSION=0.30 @@ -199,13 +199,13 @@ cd "$BUILD_PATH" get_src 66dc7081488811e9f925719e34d1b4504c2801c81dee2920e5452a86b11405ae \ "https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz" -get_src 0e971105e210d272a497567fa2e2c256f4e39b845a5ba80d373e26ba1abfbd85 \ +get_src 09fec34ff3ef1baf23dd0eaf04307fd73db865cdf99294687de45bf80c58f146 \ "https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz" get_src cd5e2cc834bcfa30149e7511f2b5a2183baf0b70dc091af717a89a64e44a2985 \ "https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz" -get_src a3dcbab117a9c103bc1ea5200fc00a7b7d2af97ff7fd525f16f8ac2632e30fbf \ +get_src 2a86088a37932a4a9812d2e552cc3847e11470a753ed78a18510b196344c2734 \ "https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz" get_src f09851e6309560a8ff3e901548405066c83f1f6ff88aa7171e0763bd9514762b \ @@ -241,10 +241,10 @@ get_src 7d5f3439c8df56046d0564b5857fd8a30296ab1bd6df0f048aed7afb56a0a4c2 \ get_src 99c47c75c159795c9faf76bbb9fa58e5a50b75286c86565ffcec8514b1c74bf9 \ "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz" else -get_src 9db756000578efaecb43bea4fc6cf631aaa80988d86ffe5d3afeb9927895ffad \ +get_src bc764db42830aeaf74755754b900253c233ad57498debe7a441cee2c6f4b07c2 \ "https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz" -get_src c7924f28cb014a99636e747ea907724dd55f60e180cb92cde6e8ed48d2278f27 \ +get_src c4df29aeee1ec648a2d2d527c2b27312617a1f1a4033e492e8cf8e6ecbbc269d \ "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz" fi @@ -256,7 +256,7 @@ if [[ ${ARCH} == "s390x" ]]; then get_src 266ed1abb70a9806d97cb958537a44b67db6afb33d3b32292a2d68a2acedea75 \ "https://github.com/openresty/luajit2/archive/$LUAJIT_VERSION.tar.gz" else -get_src d3f2c870f8f88477b01726b32accab30f6e5d57ae59c5ec87374ff73d0794316 \ +get_src 77bbcbb24c3c78f51560017288f3118d995fe71240aa379f5818ff6b166712ff \ "https://github.com/openresty/luajit2/archive/v$LUAJIT_VERSION.tar.gz" fi @@ -266,7 +266,7 @@ get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \ get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" -get_src 5d16e623d17d4f42cc64ea9cfb69ca960d313e12f5d828f785dd227cc483fcbd \ +get_src c7e94aefd32ed04068642fd5da2dcc41aa41a63a8dfac6d73b203bc73f1a3232 \ "https://github.com/openresty/lua-resty-upload/archive/v$LUA_RESTY_UPLOAD_VERSION.tar.gz" get_src bdbf271003d95aa91cab0a92f24dca129e99b33f79c13ebfcdbbcbb558129491 \ @@ -279,20 +279,20 @@ if [[ ${ARCH} == "s390x" ]]; then get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \ "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz" else -get_src efd6b51520429e64b1bcc10f477d370ebed1631c190f7e4dc270d959a743ad7d \ +get_src 5249631c2f493fc41a9e85b1e7214675d2e31d5bb52cac7a1e99d9a5eb873ba9 \ "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz" fi -get_src 0c551d6898f89f876e48730f9b55790d0ba07d5bc0aa6c76153277f63c19489f \ +get_src a77b9de160d81712f2f442e1de8b78a5a7ef0d08f13430ff619f79235db974d4 \ "https://github.com/openresty/lua-cjson/archive/$LUA_CJSON_VERSION.tar.gz" get_src 5ed48c36231e2622b001308622d46a0077525ac2f751e8cc0c9905914254baa4 \ "https://github.com/cloudflare/lua-resty-cookie/archive/$LUA_RESTY_COOKIE_VERSION.tar.gz" -get_src e810ed124fe788b8e4aac2c8960dda1b9a6f8d0ca94ce162f28d3f4d877df8af \ +get_src b38ba9620a08cf3e0b3cc17f85bde285dca6441fe5a6bd982ef732f4b6036e66 \ "https://github.com/openresty/lua-resty-lrucache/archive/v$LUA_RESTY_CACHE.tar.gz" -get_src 2b4683f9abe73e18ca00345c65010c9056777970907a311d6e1699f753141de2 \ +get_src 6aebf4412639a84eedc8b140aa48e065d625453859699a6712a62fa8085f2704 \ "https://github.com/openresty/lua-resty-lock/archive/v$LUA_RESTY_LOCK.tar.gz" get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \ @@ -301,7 +301,7 @@ get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \ get_src 9fcb6db95bc37b6fce77d3b3dc740d593f9d90dce0369b405eb04844d56ac43f \ "https://github.com/ledgetech/lua-resty-http/archive/$LUA_RESTY_HTTP.tar.gz" -get_src 42893da0e3de4ec180c9bf02f82608d78787290a70c5644b538f29d243147396 \ +get_src 0513e2be4e9d6dd59c5575432c8a28e5f7a105b373009fa5058f685f0759f28f \ "https://github.com/openresty/lua-resty-memcached/archive/v$LUA_RESTY_MEMCACHED_VERSION.tar.gz" get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \ From 1dd8d0cfd70b13aeb3220ab2f5157302bebf7418 Mon Sep 17 00:00:00 2001 From: amirschw <24677563+amirschw@users.noreply.github.com> Date: Thu, 20 Jul 2023 20:34:11 +0300 Subject: [PATCH 286/822] Ignore deployment template's replicas if KEDA is enabled (#9534) --- charts/ingress-nginx/templates/controller-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 7fe8804ea..c4a1a37e1 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -19,7 +19,7 @@ spec: matchLabels: {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} app.kubernetes.io/component: controller - {{- if not .Values.controller.autoscaling.enabled }} + {{- if not (or .Values.controller.autoscaling.enabled .Values.controller.keda.enabled) }} replicas: {{ .Values.controller.replicaCount }} {{- end }} revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} From a297cedb7abdff51e1afbb286e4bd008e9715c69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan-Otto=20Kr=C3=B6pke?= Date: Thu, 20 Jul 2023 20:00:10 +0200 Subject: [PATCH 287/822] [helm] pass service annotations through helm tpl engine (#10084) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jan-Otto Kröpke --- charts/ingress-nginx/README.md | 4 ++-- .../ingress-nginx/templates/controller-service-internal.yaml | 2 +- charts/ingress-nginx/templates/controller-service.yaml | 2 +- charts/ingress-nginx/values.yaml | 3 ++- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 955091873..953eff685 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -399,14 +399,14 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.scope.enabled | bool | `false` | Enable 'scope' or not | | controller.scope.namespace | string | `""` | Namespace to limit the controller to; defaults to $(POD_NAMESPACE) | | controller.scope.namespaceSelector | string | `""` | When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. | -| controller.service.annotations | object | `{}` | | +| controller.service.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. | | controller.service.appProtocol | bool | `true` | If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http It allows choosing the protocol for each backend specified in the Kubernetes service. See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 Will be ignored for Kubernetes versions older than 1.20 # | | controller.service.enableHttp | bool | `true` | | | controller.service.enableHttps | bool | `true` | | | controller.service.enabled | bool | `true` | | | controller.service.external.enabled | bool | `true` | | | controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # | -| controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. | +| controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. | | controller.service.internal.enabled | bool | `false` | Enables an additional internal load balancer (besides the external one). | | controller.service.internal.loadBalancerIP | string | `""` | Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. | | controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. | diff --git a/charts/ingress-nginx/templates/controller-service-internal.yaml b/charts/ingress-nginx/templates/controller-service-internal.yaml index 87146b746..3966b3260 100644 --- a/charts/ingress-nginx/templates/controller-service-internal.yaml +++ b/charts/ingress-nginx/templates/controller-service-internal.yaml @@ -4,7 +4,7 @@ kind: Service metadata: annotations: {{- range $key, $value := .Values.controller.service.internal.annotations }} - {{ $key }}: {{ $value | quote }} + {{ $key }}: {{ tpl ($value | toString) $ | quote }} {{- end }} labels: {{- include "ingress-nginx.labels" . | nindent 4 }} diff --git a/charts/ingress-nginx/templates/controller-service.yaml b/charts/ingress-nginx/templates/controller-service.yaml index b2735d2e8..f079fd4d8 100644 --- a/charts/ingress-nginx/templates/controller-service.yaml +++ b/charts/ingress-nginx/templates/controller-service.yaml @@ -4,7 +4,7 @@ kind: Service metadata: annotations: {{- range $key, $value := .Values.controller.service.annotations }} - {{ $key }}: {{ $value | quote }} + {{ $key }}: {{ tpl ($value | toString) $ | quote }} {{- end }} labels: {{- include "ingress-nginx.labels" . | nindent 4 }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index d091391a8..6fd113b67 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -415,6 +415,7 @@ controller: # Will be ignored for Kubernetes versions older than 1.20 ## appProtocol: true + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. annotations: {} labels: {} # clusterIP: "" @@ -476,7 +477,7 @@ controller: internal: # -- Enables an additional internal load balancer (besides the external one). enabled: false - # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. annotations: {} # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. loadBalancerIP: "" From 24fda9da20e3045de54c92ef64016d801c370bc9 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 20 Jul 2023 17:34:12 -0400 Subject: [PATCH 288/822] Golang 1.20.6 for test runner (#10230) * Golang 1.20.6 for test runner * alpine 3.18.2 as well Signed-off-by: James Strong --------- Signed-off-by: James Strong --- images/cfssl/rootfs/Dockerfile | 2 +- images/nginx/rootfs/Dockerfile | 4 ++-- images/opentelemetry/rootfs/Dockerfile | 2 +- images/test-runner/Makefile | 4 ++-- rootfs/Dockerfile-chroot | 2 +- test/e2e-image/Dockerfile | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/images/cfssl/rootfs/Dockerfile b/images/cfssl/rootfs/Dockerfile index e8d6c617a..89a5eef9c 100644 --- a/images/cfssl/rootfs/Dockerfile +++ b/images/cfssl/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.18.0 +FROM alpine:3.18.2 RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index 9b4abf244..7627870ba 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -11,7 +11,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.18.0 as builder +FROM alpine:3.18.2 as builder COPY . / @@ -21,7 +21,7 @@ RUN apk update \ && /build.sh # Use a multi-stage build -FROM alpine:3.18.0 +FROM alpine:3.18.2 ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index d15c28bbf..f3628b1f3 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -13,7 +13,7 @@ # limitations under the License. -FROM alpine:3.18.0 as base +FROM alpine:3.18.2 as base RUN mkdir -p /opt/third_party/install COPY . /opt/third_party/ diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index acf3dd660..3cd378937 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -43,7 +43,7 @@ image: --pull \ --push \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.5 \ + --build-arg GOLANG_VERSION=1.20.6 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -64,7 +64,7 @@ build: ensure-buildx --progress=${PROGRESS} \ --pull \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.5 \ + --build-arg GOLANG_VERSION=1.20.6 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ diff --git a/rootfs/Dockerfile-chroot b/rootfs/Dockerfile-chroot index a4123fe87..48facd44f 100644 --- a/rootfs/Dockerfile-chroot +++ b/rootfs/Dockerfile-chroot @@ -23,7 +23,7 @@ RUN apk update \ && apk upgrade \ && /chroot.sh -FROM alpine:3.18.0 +FROM alpine:3.18.2 ARG TARGETARCH ARG VERSION diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index 97986ec95..2ee5716ed 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -1,7 +1,7 @@ ARG E2E_BASE_IMAGE FROM ${E2E_BASE_IMAGE} AS BASE -FROM alpine:3.18.0 +FROM alpine:3.18.2 RUN apk update \ && apk upgrade && apk add -U --no-cache \ From e8097d8b8ff4aa4573a8d25e4bb98093323e6302 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 20 Jul 2023 21:04:21 -0400 Subject: [PATCH 289/822] fix gcloud builds Signed-off-by: James Strong --- images/cfssl/Makefile | 2 -- images/cfssl/cloudbuild.yaml | 5 ----- images/custom-error-pages/cloudbuild.yaml | 5 ----- images/echo/cloudbuild.yaml | 5 ----- images/ext-auth-example-authsvc/Makefile | 4 +++- images/ext-auth-example-authsvc/cloudbuild.yaml | 5 ----- images/fastcgi-helloserver/cloudbuild.yaml | 6 +----- images/go-grpc-greeter-server/cloudbuild.yaml | 5 ----- images/httpbun/cloudbuild.yaml | 5 ----- images/kube-webhook-certgen/cloudbuild.yaml | 5 ----- images/opentelemetry/cloudbuild.yaml | 5 ----- images/test-runner/Makefile | 2 +- 12 files changed, 5 insertions(+), 49 deletions(-) diff --git a/images/cfssl/Makefile b/images/cfssl/Makefile index 8d8e597a4..31c37fbc5 100644 --- a/images/cfssl/Makefile +++ b/images/cfssl/Makefile @@ -23,8 +23,6 @@ TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) REGISTRY ?= local - - IMAGE = $(REGISTRY)/e2e-test-cfssl # required to enable buildx diff --git a/images/cfssl/cloudbuild.yaml b/images/cfssl/cloudbuild.yaml index 4976a3f67..5fed3b712 100644 --- a/images/cfssl/cloudbuild.yaml +++ b/images/cfssl/cloudbuild.yaml @@ -6,8 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -17,6 +15,3 @@ steps: - | gcloud auth configure-docker \ && cd images/cfssl && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/custom-error-pages/cloudbuild.yaml b/images/custom-error-pages/cloudbuild.yaml index e38d4bcdc..a443d2b11 100644 --- a/images/custom-error-pages/cloudbuild.yaml +++ b/images/custom-error-pages/cloudbuild.yaml @@ -6,8 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -17,6 +15,3 @@ steps: - | gcloud auth configure-docker \ && cd images/custom-error-pages && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/echo/cloudbuild.yaml b/images/echo/cloudbuild.yaml index f07be825a..811d8d3f0 100644 --- a/images/echo/cloudbuild.yaml +++ b/images/echo/cloudbuild.yaml @@ -6,8 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -17,6 +15,3 @@ steps: - | gcloud auth configure-docker \ && cd images/echo && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/ext-auth-example-authsvc/Makefile b/images/ext-auth-example-authsvc/Makefile index 85d2f8e6b..63f261ec3 100644 --- a/images/ext-auth-example-authsvc/Makefile +++ b/images/ext-auth-example-authsvc/Makefile @@ -18,7 +18,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v1.0.0 +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/ext-auth-example-authsvc diff --git a/images/ext-auth-example-authsvc/cloudbuild.yaml b/images/ext-auth-example-authsvc/cloudbuild.yaml index c5bb5db6a..4a436e012 100644 --- a/images/ext-auth-example-authsvc/cloudbuild.yaml +++ b/images/ext-auth-example-authsvc/cloudbuild.yaml @@ -8,8 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -19,6 +17,3 @@ steps: - | gcloud auth configure-docker \ && cd images/ext-auth-example-authsvc && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/fastcgi-helloserver/cloudbuild.yaml b/images/fastcgi-helloserver/cloudbuild.yaml index a4c9d5eff..80623a197 100644 --- a/images/fastcgi-helloserver/cloudbuild.yaml +++ b/images/fastcgi-helloserver/cloudbuild.yaml @@ -6,8 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -17,6 +15,4 @@ steps: - | gcloud auth configure-docker \ && cd images/fastcgi-helloserver && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" + diff --git a/images/go-grpc-greeter-server/cloudbuild.yaml b/images/go-grpc-greeter-server/cloudbuild.yaml index 6f32bcf50..20740eb27 100644 --- a/images/go-grpc-greeter-server/cloudbuild.yaml +++ b/images/go-grpc-greeter-server/cloudbuild.yaml @@ -8,8 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -19,6 +17,3 @@ steps: - | gcloud auth configure-docker \ && cd images/go-grpc-greeter-server && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/httpbun/cloudbuild.yaml b/images/httpbun/cloudbuild.yaml index 9e3af5935..68afbe873 100644 --- a/images/httpbun/cloudbuild.yaml +++ b/images/httpbun/cloudbuild.yaml @@ -8,8 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -19,6 +17,3 @@ steps: - | gcloud auth configure-docker \ && cd images/httpbun && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "master" diff --git a/images/kube-webhook-certgen/cloudbuild.yaml b/images/kube-webhook-certgen/cloudbuild.yaml index bf0bd3ce1..88d7400d0 100644 --- a/images/kube-webhook-certgen/cloudbuild.yaml +++ b/images/kube-webhook-certgen/cloudbuild.yaml @@ -21,8 +21,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -32,6 +30,3 @@ steps: - | gcloud auth configure-docker \ && cd images/kube-webhook-certgen && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "main" diff --git a/images/opentelemetry/cloudbuild.yaml b/images/opentelemetry/cloudbuild.yaml index 9556ccba9..baf29a051 100644 --- a/images/opentelemetry/cloudbuild.yaml +++ b/images/opentelemetry/cloudbuild.yaml @@ -8,8 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - SHORT_SHA=$SHORT_SHA - - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx # set the home to /root explicitly to if using docker buildx @@ -19,6 +17,3 @@ steps: - | gcloud auth configure-docker \ && cd images/opentelemetry && make push -substitutions: - _GIT_TAG: "12345" - _PULL_BASE_REF: "main" diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 3cd378937..97133045e 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -21,7 +21,7 @@ INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh SHORT_SHA ?=$(shell git rev-parse --short HEAD) TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) -REGISTRY ?= local +REGISTRY ?= gcr.io/k8s-staging-ingress-nginx IMAGE = $(REGISTRY)/e2e-test-runner From b0081a574ab46d5477544294836da0746953af17 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 20 Jul 2023 21:05:38 -0400 Subject: [PATCH 290/822] update reg Signed-off-by: James Strong --- images/test-runner/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 97133045e..3cd378937 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -21,7 +21,7 @@ INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh SHORT_SHA ?=$(shell git rev-parse --short HEAD) TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) -REGISTRY ?= gcr.io/k8s-staging-ingress-nginx +REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-runner From c83422fd6592b7b6aea2f58b5688929a5170875a Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Sat, 22 Jul 2023 06:41:22 +0800 Subject: [PATCH 291/822] fix deps sha Signed-off-by: Jintao Zhang --- images/nginx/rootfs/build.sh | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index a99ebd292..db1eebfb8 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -199,13 +199,13 @@ cd "$BUILD_PATH" get_src 66dc7081488811e9f925719e34d1b4504c2801c81dee2920e5452a86b11405ae \ "https://nginx.org/download/nginx-$NGINX_VERSION.tar.gz" -get_src 09fec34ff3ef1baf23dd0eaf04307fd73db865cdf99294687de45bf80c58f146 \ - "https://github.com/simpl/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz" +get_src aa961eafb8317e0eb8da37eb6e2c9ff42267edd18b56947384e719b85188f58b \ + "https://github.com/vision5/ngx_devel_kit/archive/v$NDK_VERSION.tar.gz" get_src cd5e2cc834bcfa30149e7511f2b5a2183baf0b70dc091af717a89a64e44a2985 \ "https://github.com/openresty/set-misc-nginx-module/archive/v$SETMISC_VERSION.tar.gz" -get_src 2a86088a37932a4a9812d2e552cc3847e11470a753ed78a18510b196344c2734 \ +get_src 0c0d2ced2ce895b3f45eb2b230cd90508ab2a773299f153de14a43e44c1209b3 \ "https://github.com/openresty/headers-more-nginx-module/archive/v$MORE_HEADERS_VERSION.tar.gz" get_src f09851e6309560a8ff3e901548405066c83f1f6ff88aa7171e0763bd9514762b \ @@ -244,7 +244,7 @@ else get_src bc764db42830aeaf74755754b900253c233ad57498debe7a441cee2c6f4b07c2 \ "https://github.com/openresty/lua-nginx-module/archive/v$LUA_NGX_VERSION.tar.gz" -get_src c4df29aeee1ec648a2d2d527c2b27312617a1f1a4033e492e8cf8e6ecbbc269d \ +get_src 01b715754a8248cc7228e0c8f97f7488ae429d90208de0481394e35d24cef32f \ "https://github.com/openresty/stream-lua-nginx-module/archive/v$LUA_STREAM_NGX_VERSION.tar.gz" fi @@ -266,7 +266,7 @@ get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \ get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" -get_src c7e94aefd32ed04068642fd5da2dcc41aa41a63a8dfac6d73b203bc73f1a3232 \ +get_src deb4ab1ffb9f3d962c4b4a2c4bdff692b86a209e3835ae71ebdf3b97189e40a9 \ "https://github.com/openresty/lua-resty-upload/archive/v$LUA_RESTY_UPLOAD_VERSION.tar.gz" get_src bdbf271003d95aa91cab0a92f24dca129e99b33f79c13ebfcdbbcbb558129491 \ @@ -279,7 +279,7 @@ if [[ ${ARCH} == "s390x" ]]; then get_src 8f5f76d2689a3f6b0782f0a009c56a65e4c7a4382be86422c9b3549fe95b0dc4 \ "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz" else -get_src 5249631c2f493fc41a9e85b1e7214675d2e31d5bb52cac7a1e99d9a5eb873ba9 \ +get_src 39baab9e2b31cc48cecf896cea40ef6e80559054fd8a6e440cc804a858ea84d4 \ "https://github.com/openresty/lua-resty-core/archive/v$LUA_RESTY_CORE.tar.gz" fi @@ -289,10 +289,10 @@ get_src a77b9de160d81712f2f442e1de8b78a5a7ef0d08f13430ff619f79235db974d4 \ get_src 5ed48c36231e2622b001308622d46a0077525ac2f751e8cc0c9905914254baa4 \ "https://github.com/cloudflare/lua-resty-cookie/archive/$LUA_RESTY_COOKIE_VERSION.tar.gz" -get_src b38ba9620a08cf3e0b3cc17f85bde285dca6441fe5a6bd982ef732f4b6036e66 \ +get_src 573184006b98ccee2594b0d134fa4d05e5d2afd5141cbad315051ccf7e9b6403 \ "https://github.com/openresty/lua-resty-lrucache/archive/v$LUA_RESTY_CACHE.tar.gz" -get_src 6aebf4412639a84eedc8b140aa48e065d625453859699a6712a62fa8085f2704 \ +get_src b4ddcd47db347e9adf5c1e1491a6279a6ae2a3aff3155ef77ea0a65c998a69c1 \ "https://github.com/openresty/lua-resty-lock/archive/v$LUA_RESTY_LOCK.tar.gz" get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \ @@ -301,7 +301,7 @@ get_src 70e9a01eb32ccade0d5116a25bcffde0445b94ad35035ce06b94ccd260ad1bf0 \ get_src 9fcb6db95bc37b6fce77d3b3dc740d593f9d90dce0369b405eb04844d56ac43f \ "https://github.com/ledgetech/lua-resty-http/archive/$LUA_RESTY_HTTP.tar.gz" -get_src 0513e2be4e9d6dd59c5575432c8a28e5f7a105b373009fa5058f685f0759f28f \ +get_src 02733575c4aed15f6cab662378e4b071c0a4a4d07940c4ef19a7319e9be943d4 \ "https://github.com/openresty/lua-resty-memcached/archive/v$LUA_RESTY_MEMCACHED_VERSION.tar.gz" get_src c15aed1a01c88a3a6387d9af67a957dff670357f5fdb4ee182beb44635eef3f1 \ From c5f348ea2eec5f15ab0d5c5e976b29d6787fd3dc Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sat, 22 Jul 2023 00:32:07 -0300 Subject: [PATCH 292/822] Implement annotation validation (#9673) * Add validation to all annotations * Add annotation validation for fcgi * Fix reviews and fcgi e2e * Add flag to disable cross namespace validation * Add risk, flag for validation, tests * Add missing formating * Enable validation by default on tests * Test validation flag * remove ajp from list * Finalize validation changes * Add validations to CI * Update helm docs * Fix code review * Use a better name for annotation risk --- .github/workflows/ci.yaml | 49 +++ charts/ingress-nginx/README.md | 1 + charts/ingress-nginx/templates/_params.tpl | 3 + charts/ingress-nginx/values.yaml | 1 + docs/user-guide/cli-arguments.md | 1 + .../nginx-configuration/configmap.md | 26 ++ internal/ingress/annotations/alias/main.go | 36 +- .../ingress/annotations/alias/main_test.go | 35 +- internal/ingress/annotations/annotations.go | 17 +- .../ingress/annotations/annotations_test.go | 32 +- internal/ingress/annotations/auth/main.go | 86 ++++- .../ingress/annotations/auth/main_test.go | 114 ++++++- internal/ingress/annotations/authreq/main.go | 221 +++++++++++-- .../ingress/annotations/authreq/main_test.go | 6 +- .../ingress/annotations/authreqglobal/main.go | 35 +- internal/ingress/annotations/authtls/main.go | 105 +++++- .../ingress/annotations/authtls/main_test.go | 66 +++- .../annotations/backendprotocol/main.go | 59 +++- .../annotations/backendprotocol/main_test.go | 4 +- internal/ingress/annotations/canary/main.go | 121 ++++++- .../annotations/clientbodybuffersize/main.go | 38 ++- .../clientbodybuffersize/main_test.go | 3 + .../ingress/annotations/connection/main.go | 41 ++- .../annotations/connection/main_test.go | 20 +- internal/ingress/annotations/cors/main.go | 120 ++++++- .../ingress/annotations/cors/main_test.go | 42 +-- .../annotations/customhttperrors/main.go | 43 ++- .../annotations/defaultbackend/main.go | 36 +- .../annotations/defaultbackend/main_test.go | 58 +++- internal/ingress/annotations/fastcgi/main.go | 71 +++- .../ingress/annotations/fastcgi/main_test.go | 124 ++++++- .../annotations/globalratelimit/main.go | 81 ++++- .../annotations/globalratelimit/main_test.go | 22 +- .../annotations/http2pushpreload/main.go | 35 +- .../annotations/http2pushpreload/main_test.go | 20 +- .../{ipwhitelist => ipallowlist}/main.go | 64 +++- .../{ipwhitelist => ipallowlist}/main_test.go | 83 ++++- .../ingress/annotations/ipdenylist/main.go | 47 ++- .../annotations/ipdenylist/main_test.go | 30 +- .../ingress/annotations/loadbalancing/main.go | 44 ++- .../annotations/loadbalancing/main_test.go | 3 +- internal/ingress/annotations/log/main.go | 44 ++- internal/ingress/annotations/log/main_test.go | 22 +- internal/ingress/annotations/mirror/main.go | 74 ++++- .../ingress/annotations/mirror/main_test.go | 11 +- .../ingress/annotations/modsecurity/main.go | 73 ++++- .../ingress/annotations/opentelemetry/main.go | 67 +++- .../annotations/opentelemetry/main_test.go | 30 +- .../ingress/annotations/opentracing/main.go | 45 ++- .../annotations/opentracing/main_test.go | 8 +- internal/ingress/annotations/parser/main.go | 109 ++++-- .../ingress/annotations/parser/main_test.go | 21 +- .../ingress/annotations/parser/validators.go | 239 ++++++++++++++ .../annotations/parser/validators_test.go | 310 ++++++++++++++++++ .../annotations/portinredirect/main.go | 35 +- .../annotations/portinredirect/main_test.go | 28 +- internal/ingress/annotations/proxy/main.go | 188 +++++++++-- .../ingress/annotations/proxy/main_test.go | 68 ++++ internal/ingress/annotations/proxyssl/main.go | 115 ++++++- .../ingress/annotations/proxyssl/main_test.go | 2 +- .../ingress/annotations/ratelimit/main.go | 120 ++++++- .../annotations/ratelimit/main_test.go | 93 +++++- .../ingress/annotations/redirect/redirect.go | 67 +++- .../annotations/redirect/redirect_test.go | 10 +- internal/ingress/annotations/rewrite/main.go | 103 +++++- .../ingress/annotations/rewrite/main_test.go | 24 ++ internal/ingress/annotations/satisfy/main.go | 37 ++- .../ingress/annotations/satisfy/main_test.go | 2 +- .../ingress/annotations/serversnippet/main.go | 35 +- .../annotations/serversnippet/main_test.go | 2 +- .../annotations/serviceupstream/main.go | 35 +- .../annotations/serviceupstream/main_test.go | 6 +- .../annotations/sessionaffinity/main.go | 125 ++++++- internal/ingress/annotations/snippet/main.go | 35 +- .../ingress/annotations/snippet/main_test.go | 2 +- .../ingress/annotations/sslcipher/main.go | 56 +++- .../annotations/sslcipher/main_test.go | 27 +- .../annotations/sslpassthrough/main.go | 34 +- .../annotations/sslpassthrough/main_test.go | 2 +- .../ingress/annotations/streamsnippet/main.go | 35 +- .../annotations/streamsnippet/main_test.go | 2 +- .../annotations/upstreamhashby/main.go | 71 +++- .../annotations/upstreamhashby/main_test.go | 32 +- .../ingress/annotations/upstreamvhost/main.go | 36 +- .../annotations/upstreamvhost/main_test.go | 2 +- .../annotations/xforwardedprefix/main.go | 35 +- .../annotations/xforwardedprefix/main_test.go | 2 +- internal/ingress/controller/config/config.go | 15 +- internal/ingress/controller/controller.go | 15 +- .../ingress/controller/controller_test.go | 13 +- internal/ingress/controller/store/store.go | 35 +- .../ingress/controller/store/store_test.go | 17 +- internal/ingress/defaults/main.go | 12 + internal/ingress/errors/errors.go | 44 +++ internal/ingress/resolver/main.go | 3 + internal/ingress/resolver/mock.go | 15 +- pkg/apis/ingress/types.go | 8 +- pkg/apis/ingress/types_equals.go | 2 +- pkg/flags/flags.go | 4 + rootfs/etc/nginx/template/nginx.tmpl | 10 +- .../validations/values.yaml | 38 +++ test/e2e/annotations/fastcgi.go | 4 +- .../{ipwhitelist.go => ipallowlist.go} | 10 +- test/e2e/e2e.go | 2 + test/e2e/framework/exec.go | 7 +- test/e2e/run-e2e-suite.sh | 1 + test/e2e/run-kind-e2e.sh | 1 + test/e2e/settings/validations/validations.go | 86 +++++ test/e2e/wait-for-nginx.sh | 2 + 109 files changed, 4320 insertions(+), 586 deletions(-) rename internal/ingress/annotations/{ipwhitelist => ipallowlist}/main.go (53%) rename internal/ingress/annotations/{ipwhitelist => ipallowlist}/main_test.go (64%) create mode 100644 internal/ingress/annotations/parser/validators.go create mode 100644 internal/ingress/annotations/parser/validators_test.go create mode 100644 test/e2e-image/namespace-overlays/validations/values.yaml rename test/e2e/annotations/{ipwhitelist.go => ipallowlist.go} (81%) create mode 100644 test/e2e/settings/validations/validations.go diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 097e77276..453775379 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -319,6 +319,55 @@ jobs: name: e2e-test-reports-${{ matrix.k8s }} path: 'test/junitreports/report*.xml' + kubernetes-validations: + name: Kubernetes with Validations + runs-on: ubuntu-latest + needs: + - changes + - build + if: | + (needs.changes.outputs.go == 'true') || ${{ inputs.run_e2e }} + + strategy: + matrix: + k8s: [v1.27.1] + + steps: + - name: Checkout + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + + - name: cache + uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 + with: + name: docker.tar.gz + + - name: Create Kubernetes ${{ matrix.k8s }} cluster + id: kind + run: | + kind create cluster --image=kindest/node:${{ matrix.k8s }} --config test/e2e/kind.yaml + + - name: Load images from cache + run: | + echo "loading docker images..." + pigz -dc docker.tar.gz | docker load + + - name: Run e2e tests + env: + KIND_CLUSTER_NAME: kind + SKIP_CLUSTER_CREATION: true + SKIP_IMAGE_CREATION: true + ENABLE_VALIDATIONS: true + run: | + kind get kubeconfig > $HOME/.kube/kind-config-kind + make kind-e2e-test + + - name: Upload e2e junit-reports + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 + if: success() || failure() + with: + name: e2e-test-reports-${{ matrix.k8s }} + path: 'test/junitreports/report*.xml' + kubernetes-chroot: name: Kubernetes chroot diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 953eff685..17547912d 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -294,6 +294,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.dnsConfig | object | `{}` | Optionally customize the pod dnsConfig. | | controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. | | controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' | +| controller.enableAnnotationValidations | bool | `false` | | | controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # | | controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" Defaults to false | | controller.existingPsp | string | `""` | Use an existing PSP instead of creating one | diff --git a/charts/ingress-nginx/templates/_params.tpl b/charts/ingress-nginx/templates/_params.tpl index a1aef01ae..47d024e85 100644 --- a/charts/ingress-nginx/templates/_params.tpl +++ b/charts/ingress-nginx/templates/_params.tpl @@ -1,5 +1,8 @@ {{- define "ingress-nginx.params" -}} - /nginx-ingress-controller +{{- if .Values.controller.enableAnnotationValidations }} +- --enable-annotation-validation=true +{{- end }} {{- if .Values.defaultBackend.enabled }} - --default-backend-service=$(POD_NAMESPACE)/{{ include "ingress-nginx.defaultBackend.fullname" . }} {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 6fd113b67..1cd74dad0 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -15,6 +15,7 @@ commonLabels: {} controller: name: controller + enableAnnotationValidations: false image: ## Keep false as default for now! chroot: false diff --git a/docs/user-guide/cli-arguments.md b/docs/user-guide/cli-arguments.md index bc0894a52..be6e1dd50 100644 --- a/docs/user-guide/cli-arguments.md +++ b/docs/user-guide/cli-arguments.md @@ -15,6 +15,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment | `--default-backend-service` | Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form "namespace/name". The controller configures NGINX to forward requests to the first port of this Service. | | `--default-server-port` | Port to use for exposing the default server (catch-all). (default 8181) | | `--default-ssl-certificate` | Secret containing a SSL certificate to be used by the default HTTPS server (catch-all). Takes the form "namespace/name". | +| `--enable-annotation-validation` | If true, will enable the annotation validation feature. This value will be defaulted to true on a future release. | | `--disable-catch-all` | Disable support for catch-all Ingresses. (default false) | | `--disable-full-test` | Disable full test of all merged ingresses at the admission stage and tests the template of the ingress being created or updated (full test of all ingresses is enabled by default). | | `--disable-svc-external-name` | Disable support for Services of type ExternalName. (default false) | diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index c55b7502a..0a7e44dce 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -29,7 +29,9 @@ The following table shows a configuration option's name, type, and the default v |:---|:---|:------|:----| |[add-headers](#add-headers)|string|""|| |[allow-backend-server-header](#allow-backend-server-header)|bool|"false"|| +|[allow-cross-namespace-resources](#allow-cross-namespace-resources)|bool|"true"|| |[allow-snippet-annotations](#allow-snippet-annotations)|bool|true|| +|[annotations-risk-level](#annotations-risk-level)|string|Critical|| |[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""|| |[hide-headers](#hide-headers)|string array|empty|| |[access-log-params](#access-log-params)|string|""|| @@ -239,6 +241,20 @@ Sets custom headers from named configmap before sending traffic to the client. S Enables the return of the header Server from the backend instead of the generic nginx string. _**default:**_ is disabled +## allow-cross-namespace-resources + +Enables users to consume cross namespace resource on annotations, when was previously enabled . _**default:**_ true + +**Annotations that may be impacted with this change**: +* `auth-secret` +* `auth-proxy-set-header` +* `auth-tls-secret` +* `fastcgi-params-configmap` +* `proxy-ssl-secret` + + +**This option will be defaulted to false in the next major release** + ## allow-snippet-annotations Enables Ingress to parse and add *-snippet annotations/directives created by the user. _**default:**_ `true` @@ -246,6 +262,16 @@ Enables Ingress to parse and add *-snippet annotations/directives created by the Warning: We recommend enabling this option only if you TRUST users with permission to create Ingress objects, as this may allow a user to add restricted configurations to the final nginx.conf file +**This option will be defaulted to false in the next major release** + +## annotations-risk-level + +Represents the risk accepted on an annotation. If the risk is, for instance `Medium`, annotations with risk High and Critical will not be accepted. + +Accepted values are `Critical`, `High`, `Medium` and `Low`. + +Defaults to `Critical` but will be changed to `High` on the next minor release + ## annotation-value-word-blocklist Contains a comma-separated value of chars/words that are well known of being used to abuse Ingress configuration diff --git a/internal/ingress/annotations/alias/main.go b/internal/ingress/annotations/alias/main.go index bd2067c9f..4a5e6f188 100644 --- a/internal/ingress/annotations/alias/main.go +++ b/internal/ingress/annotations/alias/main.go @@ -27,19 +27,44 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + serverAliasAnnotation = "server-alias" +) + +var aliasAnnotation = parser.Annotation{ + Group: "alias", + Annotations: parser.AnnotationFields{ + serverAliasAnnotation: { + Validator: parser.ValidateArrayOfServerName, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, // High as this allows regex chars + Documentation: `this annotation can be used to define additional server + aliases for this Ingress`, + }, + }, +} + type alias struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new Alias annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return alias{r} + return alias{ + r: r, + annotationConfig: aliasAnnotation, + } +} + +func (a alias) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations } // Parse parses the annotations contained in the ingress rule // used to add an alias to the provided hosts func (a alias) Parse(ing *networking.Ingress) (interface{}, error) { - val, err := parser.GetStringAnnotation("server-alias", ing) + val, err := parser.GetStringAnnotation(serverAliasAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return []string{}, err } @@ -61,3 +86,8 @@ func (a alias) Parse(ing *networking.Ingress) (interface{}, error) { return l, nil } + +func (a alias) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, aliasAnnotation.Annotations) +} diff --git a/internal/ingress/annotations/alias/main_test.go b/internal/ingress/annotations/alias/main_test.go index 8e6fca447..1965f2630 100644 --- a/internal/ingress/annotations/alias/main_test.go +++ b/internal/ingress/annotations/alias/main_test.go @@ -27,7 +27,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -var annotation = parser.GetAnnotationWithPrefix("server-alias") +var annotation = parser.GetAnnotationWithPrefix(serverAliasAnnotation) func TestParse(t *testing.T) { ap := NewParser(&resolver.Mock{}) @@ -36,16 +36,20 @@ func TestParse(t *testing.T) { } testCases := []struct { - annotations map[string]string - expected []string + annotations map[string]string + expected []string + skipValidation bool + wantErr bool }{ - {map[string]string{annotation: "a.com, b.com, , c.com"}, []string{"a.com", "b.com", "c.com"}}, - {map[string]string{annotation: "www.example.com"}, []string{"www.example.com"}}, - {map[string]string{annotation: "*.example.com,www.example.*"}, []string{"*.example.com", "www.example.*"}}, - {map[string]string{annotation: `~^www\d+\.example\.com$`}, []string{`~^www\d+\.example\.com$`}}, - {map[string]string{annotation: ""}, []string{}}, - {map[string]string{}, []string{}}, - {nil, []string{}}, + {map[string]string{annotation: "a.com, b.com, , c.com"}, []string{"a.com", "b.com", "c.com"}, false, false}, + {map[string]string{annotation: "www.example.com"}, []string{"www.example.com"}, false, false}, + {map[string]string{annotation: "*.example.com,www.example.*"}, []string{"*.example.com", "www.example.*"}, false, false}, + {map[string]string{annotation: `~^www\d+\.example\.com$`}, []string{`~^www\d+\.example\.com$`}, false, false}, + {map[string]string{annotation: `www.xpto;lala`}, []string{}, false, true}, + {map[string]string{annotation: `www.xpto;lala`}, []string{"www.xpto;lala"}, true, false}, // When we skip validation no error should happen + {map[string]string{annotation: ""}, []string{}, false, true}, + {map[string]string{}, []string{}, false, true}, + {nil, []string{}, false, true}, } ing := &networking.Ingress{ @@ -58,7 +62,16 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) + if testCase.skipValidation { + parser.EnableAnnotationValidation = false + } + defer func() { + parser.EnableAnnotationValidation = true + }() + result, err := ap.Parse(ing) + if (err != nil) != testCase.wantErr { + t.Errorf("ParseAliasAnnotation() annotation: %s, error = %v, wantErr %v", testCase.annotations, err, testCase.wantErr) + } if !reflect.DeepEqual(result, testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 5bb2bf5e6..5371e6eb7 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -44,8 +44,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/http2pushpreload" + "k8s.io/ingress-nginx/internal/ingress/annotations/ipallowlist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" - "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" "k8s.io/ingress-nginx/internal/ingress/annotations/loadbalancing" "k8s.io/ingress-nginx/internal/ingress/annotations/log" "k8s.io/ingress-nginx/internal/ingress/annotations/mirror" @@ -109,7 +109,6 @@ type Ingress struct { UpstreamHashBy upstreamhashby.Config LoadBalancing string UpstreamVhost string - Whitelist ipwhitelist.SourceRange Denylist ipdenylist.SourceRange XForwardedPrefix string SSLCipher sslcipher.Config @@ -117,6 +116,7 @@ type Ingress struct { ModSecurity modsecurity.Config Mirror mirror.Config StreamSnippet string + Allowlist ipallowlist.SourceRange } // Extractor defines the annotation parsers to be used in the extraction of annotations @@ -159,7 +159,7 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "UpstreamHashBy": upstreamhashby.NewParser(cfg), "LoadBalancing": loadbalancing.NewParser(cfg), "UpstreamVhost": upstreamvhost.NewParser(cfg), - "Whitelist": ipwhitelist.NewParser(cfg), + "Allowlist": ipallowlist.NewParser(cfg), "Denylist": ipdenylist.NewParser(cfg), "XForwardedPrefix": xforwardedprefix.NewParser(cfg), "SSLCipher": sslcipher.NewParser(cfg), @@ -173,16 +173,23 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { } // Extract extracts the annotations from an Ingress -func (e Extractor) Extract(ing *networking.Ingress) *Ingress { +func (e Extractor) Extract(ing *networking.Ingress) (*Ingress, error) { pia := &Ingress{ ObjectMeta: ing.ObjectMeta, } data := make(map[string]interface{}) for name, annotationParser := range e.annotations { + if err := annotationParser.Validate(ing.GetAnnotations()); err != nil { + return nil, errors.NewRiskyAnnotations(name) + } val, err := annotationParser.Parse(ing) klog.V(5).InfoS("Parsing Ingress annotation", "name", name, "ingress", klog.KObj(ing), "value", val) if err != nil { + if errors.IsValidationError(err) { + klog.ErrorS(err, "ingress contains invalid annotation value") + return nil, err + } if errors.IsMissingAnnotations(err) { continue } @@ -220,5 +227,5 @@ func (e Extractor) Extract(ing *networking.Ingress) *Ingress { klog.ErrorS(err, "unexpected error merging extracted annotations") } - return pia + return pia, nil } diff --git a/internal/ingress/annotations/annotations_test.go b/internal/ingress/annotations/annotations_test.go index d792801bc..2b2a64268 100644 --- a/internal/ingress/annotations/annotations_test.go +++ b/internal/ingress/annotations/annotations_test.go @@ -134,8 +134,11 @@ func TestSSLPassthrough(t *testing.T) { for _, foo := range fooAnns { ing.SetAnnotations(foo.annotations) - r := ec.Extract(ing).SSLPassthrough - if r != foo.er { + r, err := ec.Extract(ing) + if err != nil { + t.Errorf("Errors should be null: %v", err) + } + if r.SSLPassthrough != foo.er { t.Errorf("Returned %v but expected %v", r, foo.er) } } @@ -158,8 +161,11 @@ func TestUpstreamHashBy(t *testing.T) { for _, foo := range fooAnns { ing.SetAnnotations(foo.annotations) - r := ec.Extract(ing).UpstreamHashBy.UpstreamHashBy - if r != foo.er { + r, err := ec.Extract(ing) + if err != nil { + t.Errorf("error should be null: %v", err) + } + if r.UpstreamHashBy.UpstreamHashBy != foo.er { t.Errorf("Returned %v but expected %v", r, foo.er) } } @@ -185,7 +191,11 @@ func TestAffinitySession(t *testing.T) { for _, foo := range fooAnns { ing.SetAnnotations(foo.annotations) - r := ec.Extract(ing).SessionAffinity + rann, err := ec.Extract(ing) + if err != nil { + t.Errorf("error should be null: %v", err) + } + r := rann.SessionAffinity t.Logf("Testing pass %v %v", foo.affinitytype, foo.cookiename) if r.Type != foo.affinitytype { @@ -228,7 +238,11 @@ func TestCors(t *testing.T) { for _, foo := range fooAnns { ing.SetAnnotations(foo.annotations) - r := ec.Extract(ing).CorsConfig + rann, err := ec.Extract(ing) + if err != nil { + t.Errorf("error should be null: %v", err) + } + r := rann.CorsConfig t.Logf("Testing pass %v %v %v %v %v", foo.corsenabled, foo.methods, foo.headers, foo.origin, foo.credentials) if r.CorsEnabled != foo.corsenabled { @@ -277,7 +291,11 @@ func TestCustomHTTPErrors(t *testing.T) { for _, foo := range fooAnns { ing.SetAnnotations(foo.annotations) - r := ec.Extract(ing).CustomHTTPErrors + rann, err := ec.Extract(ing) + if err != nil { + t.Errorf("error should be null: %v", err) + } + r := rann.CustomHTTPErrors // Check that expected codes were created for i := range foo.er { diff --git a/internal/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go index 62d70873e..beecebdb1 100644 --- a/internal/ingress/annotations/auth/main.go +++ b/internal/ingress/annotations/auth/main.go @@ -32,13 +32,56 @@ import ( "k8s.io/ingress-nginx/pkg/util/file" ) +const ( + authSecretTypeAnnotation = "auth-secret-type" //#nosec G101 + authRealmAnnotation = "auth-realm" + authTypeAnnotation = "auth-type" + // This should be exported as it is imported by other packages + AuthSecretAnnotation = "auth-secret" //#nosec G101 +) + var ( - authTypeRegex = regexp.MustCompile(`basic|digest`) + authTypeRegex = regexp.MustCompile(`basic|digest`) + authSecretTypeRegex = regexp.MustCompile(`auth-file|auth-map`) + // AuthDirectory default directory used to store files // to authenticate request AuthDirectory = "/etc/ingress-controller/auth" ) +var AuthSecretConfig = parser.AnnotationConfig{ + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars + Documentation: `This annotation defines the name of the Secret that contains the usernames and passwords which are granted access to the paths defined in the Ingress rules. `, +} + +var authSecretAnnotations = parser.Annotation{ + Group: "authentication", + Annotations: parser.AnnotationFields{ + AuthSecretAnnotation: AuthSecretConfig, + authSecretTypeAnnotation: { + Validator: parser.ValidateRegex(*authSecretTypeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation what is the format of auth-secret value. Can be "auth-file" that defines the content of an htpasswd file, or "auth-map" where each key + is a user and each value is the password.`, + }, + authRealmAnnotation: { + Validator: parser.ValidateRegex(*parser.CharsWithSpace, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars + Documentation: `This annotation defines the realm (message) that should be shown to user when authentication is requested.`, + }, + authTypeAnnotation: { + Validator: parser.ValidateRegex(*authTypeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines the basic authentication type. Should be "basic" or "digest"`, + }, + }, +} + const ( fileAuth = "auth-file" mapAuth = "auth-map" @@ -85,13 +128,18 @@ func (bd1 *Config) Equal(bd2 *Config) bool { } type auth struct { - r resolver.Resolver - authDirectory string + r resolver.Resolver + authDirectory string + annotationConfig parser.Annotation } // NewParser creates a new authentication annotation parser func NewParser(authDirectory string, r resolver.Resolver) parser.IngressAnnotation { - return auth{r, authDirectory} + return auth{ + r: r, + authDirectory: authDirectory, + annotationConfig: authSecretAnnotations, + } } // Parse parses the annotations contained in the ingress @@ -99,7 +147,7 @@ func NewParser(authDirectory string, r resolver.Resolver) parser.IngressAnnotati // and generated an htpasswd compatible file to be used as source // during the authentication process func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { - at, err := parser.GetStringAnnotation("auth-type", ing) + at, err := parser.GetStringAnnotation(authTypeAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return nil, err } @@ -109,12 +157,15 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { } var secretType string - secretType, err = parser.GetStringAnnotation("auth-secret-type", ing) + secretType, err = parser.GetStringAnnotation(authSecretTypeAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + return nil, err + } secretType = fileAuth } - s, err := parser.GetStringAnnotation("auth-secret", ing) + s, err := parser.GetStringAnnotation(AuthSecretAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return nil, ing_errors.LocationDenied{ Reason: fmt.Errorf("error reading secret name from annotation: %w", err), @@ -131,6 +182,13 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { if sns == "" { sns = ing.Namespace } + secCfg := a.r.GetSecurityConfiguration() + // We don't accept different namespaces for secrets. + if !secCfg.AllowCrossNamespaceResources && sns != ing.Namespace { + return nil, ing_errors.LocationDenied{ + Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), + } + } name := fmt.Sprintf("%v/%v", sns, sname) secret, err := a.r.GetSecret(name) @@ -140,7 +198,10 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { } } - realm, _ := parser.GetStringAnnotation("auth-realm", ing) + realm, err := parser.GetStringAnnotation(authRealmAnnotation, ing, a.annotationConfig.Annotations) + if ing_errors.IsValidationError(err) { + return nil, err + } passFilename := fmt.Sprintf("%v/%v-%v-%v.passwd", a.authDirectory, ing.GetNamespace(), ing.UID, secret.UID) @@ -210,3 +271,12 @@ func dumpSecretAuthMap(filename string, secret *api.Secret) error { return nil } + +func (a auth) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a auth) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, authSecretAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/auth/main_test.go b/internal/ingress/annotations/auth/main_test.go index d4ec53459..2a9dc7c72 100644 --- a/internal/ingress/annotations/auth/main_test.go +++ b/internal/ingress/annotations/auth/main_test.go @@ -26,6 +26,7 @@ import ( api "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/tools/cache" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" @@ -79,13 +80,18 @@ type mockSecret struct { } func (m mockSecret) GetSecret(name string) (*api.Secret, error) { - if name != "default/demo-secret" { + if name != "default/demo-secret" && name != "otherns/demo-secret" { return nil, fmt.Errorf("there is no secret with name %v", name) } + ns, _, err := cache.SplitMetaNamespaceKey(name) + if err != nil { + return nil, err + } + return &api.Secret{ ObjectMeta: meta_v1.ObjectMeta{ - Namespace: api.NamespaceDefault, + Namespace: ns, Name: "demo-secret", }, Data: map[string][]byte{"auth": []byte("foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0")}, @@ -106,13 +112,91 @@ func TestIngressAuthBadAuthType(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-type")] = "invalid" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "invalid" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.NewLocationDenied("invalid authentication type") + expected := ing_errors.NewValidationError("nginx.ingress.kubernetes.io/auth-type") + _, err := NewParser(dir, &mockSecret{}).Parse(ing) + if err.Error() != expected.Error() { + t.Errorf("expected '%v' but got '%v'", expected, err) + } +} + +func TestIngressInvalidRealm(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "something weird ; location trying to { break }" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + ing.SetAnnotations(data) + + _, dir, _ := dummySecretContent(t) + defer os.RemoveAll(dir) + + expected := ing_errors.NewValidationError("nginx.ingress.kubernetes.io/auth-realm") + _, err := NewParser(dir, &mockSecret{}).Parse(ing) + if err.Error() != expected.Error() { + t.Errorf("expected '%v' but got '%v'", expected, err) + } +} + +func TestIngressInvalidDifferentNamespace(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + ing.SetAnnotations(data) + + _, dir, _ := dummySecretContent(t) + defer os.RemoveAll(dir) + + expected := ing_errors.LocationDenied{ + Reason: errors.New("cross namespace usage of secrets is not allowed"), + } + _, err := NewParser(dir, &mockSecret{}).Parse(ing) + if err.Error() != expected.Error() { + t.Errorf("expected '%v' but got '%v'", expected, err) + } +} + +func TestIngressInvalidDifferentNamespaceAllowed(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + ing.SetAnnotations(data) + + _, dir, _ := dummySecretContent(t) + defer os.RemoveAll(dir) + + r := mockSecret{} + r.AllowCrossNamespace = true + _, err := NewParser(dir, r).Parse(ing) + if err != nil { + t.Errorf("not expecting an error") + } +} + +func TestIngressInvalidSecretName(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret;xpto" + ing.SetAnnotations(data) + + _, dir, _ := dummySecretContent(t) + defer os.RemoveAll(dir) + + expected := ing_errors.LocationDenied{ + Reason: errors.New("error reading secret name from annotation: annotation nginx.ingress.kubernetes.io/auth-secret contains invalid value"), + } _, err := NewParser(dir, &mockSecret{}).Parse(ing) if err.Error() != expected.Error() { t.Errorf("expected '%v' but got '%v'", expected, err) @@ -123,7 +207,7 @@ func TestInvalidIngressAuthNoSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-type")] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -142,9 +226,9 @@ func TestIngressAuth(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-type")] = "basic" - data[parser.GetAnnotationWithPrefix("auth-secret")] = "demo-secret" - data[parser.GetAnnotationWithPrefix("auth-realm")] = "-realm-" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -173,9 +257,9 @@ func TestIngressAuthWithoutSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-type")] = "basic" - data[parser.GetAnnotationWithPrefix("auth-secret")] = "invalid-secret" - data[parser.GetAnnotationWithPrefix("auth-realm")] = "-realm-" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "invalid-secret" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -191,10 +275,10 @@ func TestIngressAuthInvalidSecretKey(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-type")] = "basic" - data[parser.GetAnnotationWithPrefix("auth-secret")] = "demo-secret" - data[parser.GetAnnotationWithPrefix("auth-secret-type")] = "invalid-type" - data[parser.GetAnnotationWithPrefix("auth-realm")] = "-realm-" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(authSecretTypeAnnotation)] = "invalid-type" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go index 2ab389146..2ab98ace0 100644 --- a/internal/ingress/annotations/authreq/main.go +++ b/internal/ingress/annotations/authreq/main.go @@ -24,6 +24,7 @@ import ( "k8s.io/klog/v2" networking "k8s.io/api/networking/v1" + "k8s.io/client-go/tools/cache" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" @@ -31,6 +32,118 @@ import ( "k8s.io/ingress-nginx/pkg/util/sets" ) +const ( + authReqURLAnnotation = "auth-url" + authReqMethodAnnotation = "auth-method" + authReqSigninAnnotation = "auth-signin" + authReqSigninRedirParamAnnotation = "auth-signin-redirect-param" + authReqSnippetAnnotation = "auth-snippet" + authReqCacheKeyAnnotation = "auth-cache-key" + authReqKeepaliveAnnotation = "auth-keepalive" + authReqKeepaliveRequestsAnnotation = "auth-keepalive-requests" + authReqKeepaliveTimeout = "auth-keepalive-timeout" + authReqCacheDuration = "auth-cache-duration" + authReqResponseHeadersAnnotation = "auth-response-headers" + authReqProxySetHeadersAnnotation = "auth-proxy-set-headers" + authReqRequestRedirectAnnotation = "auth-request-redirect" + authReqAlwaysSetCookieAnnotation = "auth-always-set-cookie" + + // This should be exported as it is imported by other packages + AuthSecretAnnotation = "auth-secret" +) + +var authReqAnnotations = parser.Annotation{ + Group: "authentication", + Annotations: parser.AnnotationFields{ + authReqURLAnnotation: { + Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation allows to indicate the URL where the HTTP request should be sent`, + }, + authReqMethodAnnotation: { + Validator: parser.ValidateRegex(*methodsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows to specify the HTTP method to use`, + }, + authReqSigninAnnotation: { + Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation allows to specify the location of the error page`, + }, + authReqSigninRedirParamAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows to specify the URL parameter in the error page which should contain the original URL for a failed signin request`, + }, + authReqSnippetAnnotation: { + Validator: parser.ValidateNull, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskCritical, + Documentation: `This annotation allows to specify a custom snippet to use with external authentication`, + }, + authReqCacheKeyAnnotation: { + Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation enables caching for auth requests.`, + }, + authReqKeepaliveAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation specifies the maximum number of keepalive connections to auth-url. Only takes effect when no variables are used in the host part of the URL`, + }, + authReqKeepaliveRequestsAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines the maximum number of requests that can be served through one keepalive connection`, + }, + authReqKeepaliveTimeout: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation specifies a duration in seconds which an idle keepalive connection to an upstream server will stay open`, + }, + authReqCacheDuration: { + Validator: parser.ValidateRegex(*parser.ExtendedCharsRegex, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows to specify a caching time for auth responses based on their response codes, e.g. 200 202 30m`, + }, + authReqResponseHeadersAnnotation: { + Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation sets the headers to pass to backend once authentication request completes. They should be separated by comma.`, + }, + authReqProxySetHeadersAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation sets the name of a ConfigMap that specifies headers to pass to the authentication service. + Only ConfigMaps on the same namespace are allowed`, + }, + authReqRequestRedirectAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows to specify the X-Auth-Request-Redirect header value`, + }, + authReqAlwaysSetCookieAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables setting a cookie returned by auth request. + By default, the cookie will be set only if an upstream reports with the code 200, 201, 204, 206, 301, 302, 303, 304, 307, or 308`, + }, + }, +} + // Config returns external authentication configuration for an Ingress rule type Config struct { URL string `json:"url"` @@ -121,7 +234,7 @@ func (e1 *Config) Equal(e2 *Config) bool { } var ( - methods = []string{"GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "CONNECT", "OPTIONS", "TRACE"} + methodsRegex = regexp.MustCompile("(GET|HEAD|POST|PUT|PATCH|DELETE|CONNECT|OPTIONS|TRACE)") headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`) statusCodeRegex = regexp.MustCompile(`^[\d]{3}$`) durationRegex = regexp.MustCompile(`^[\d]+(ms|s|m|h|d|w|M|y)$`) // see http://nginx.org/en/docs/syntax.html @@ -129,16 +242,7 @@ var ( // ValidMethod checks is the provided string a valid HTTP method func ValidMethod(method string) bool { - if len(method) == 0 { - return false - } - - for _, m := range methods { - if method == m { - return true - } - } - return false + return methodsRegex.MatchString(method) } // ValidHeader checks is the provided string satisfies the header's name regex @@ -173,19 +277,23 @@ func ValidCacheDuration(duration string) bool { } type authReq struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new authentication request annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return authReq{r} + return authReq{ + r: r, + annotationConfig: authReqAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress // rule used to use an Config URL as source for authentication func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { // Required Parameters - urlString, err := parser.GetStringAnnotation("auth-url", ing) + urlString, err := parser.GetStringAnnotation(authReqURLAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return nil, err } @@ -195,33 +303,44 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { return nil, ing_errors.LocationDenied{Reason: fmt.Errorf("could not parse auth-url annotation: %v", err)} } - authMethod, _ := parser.GetStringAnnotation("auth-method", ing) - if len(authMethod) != 0 && !ValidMethod(authMethod) { - return nil, ing_errors.NewLocationDenied("invalid HTTP method") + authMethod, err := parser.GetStringAnnotation(authReqMethodAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + if ing_errors.IsValidationError(err) { + return nil, ing_errors.NewLocationDenied("invalid HTTP method") + } } // Optional Parameters - signIn, err := parser.GetStringAnnotation("auth-signin", ing) + signIn, err := parser.GetStringAnnotation(authReqSigninAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + klog.Warningf("%s value is invalid: %s", authReqSigninAnnotation, err) + } klog.V(3).InfoS("auth-signin annotation is undefined and will not be set") } - signInRedirectParam, err := parser.GetStringAnnotation("auth-signin-redirect-param", ing) + signInRedirectParam, err := parser.GetStringAnnotation(authReqSigninRedirParamAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + klog.Warningf("%s value is invalid: %s", authReqSigninRedirParamAnnotation, err) + } klog.V(3).Infof("auth-signin-redirect-param annotation is undefined and will not be set") } - authSnippet, err := parser.GetStringAnnotation("auth-snippet", ing) + authSnippet, err := parser.GetStringAnnotation(authReqSnippetAnnotation, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("auth-snippet annotation is undefined and will not be set") } - authCacheKey, err := parser.GetStringAnnotation("auth-cache-key", ing) + authCacheKey, err := parser.GetStringAnnotation(authReqCacheKeyAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + klog.Warningf("%s value is invalid: %s", authReqCacheKeyAnnotation, err) + } klog.V(3).InfoS("auth-cache-key annotation is undefined and will not be set") } - keepaliveConnections, err := parser.GetIntAnnotation("auth-keepalive", ing) + keepaliveConnections, err := parser.GetIntAnnotation(authReqKeepaliveAnnotation, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("auth-keepalive annotation is undefined and will be set to its default value") keepaliveConnections = defaultKeepaliveConnections @@ -238,9 +357,9 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { } } - keepaliveRequests, err := parser.GetIntAnnotation("auth-keepalive-requests", ing) + keepaliveRequests, err := parser.GetIntAnnotation(authReqKeepaliveRequestsAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - klog.V(3).InfoS("auth-keepalive-requests annotation is undefined and will be set to its default value") + klog.V(3).InfoS("auth-keepalive-requests annotation is undefined or invalid and will be set to its default value") keepaliveRequests = defaultKeepaliveRequests } if keepaliveRequests <= 0 { @@ -248,7 +367,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { keepaliveConnections = 0 } - keepaliveTimeout, err := parser.GetIntAnnotation("auth-keepalive-timeout", ing) + keepaliveTimeout, err := parser.GetIntAnnotation(authReqKeepaliveTimeout, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("auth-keepalive-timeout annotation is undefined and will be set to its default value") keepaliveTimeout = defaultKeepaliveTimeout @@ -258,14 +377,20 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { keepaliveConnections = 0 } - durstr, _ := parser.GetStringAnnotation("auth-cache-duration", ing) + durstr, err := parser.GetStringAnnotation(authReqCacheDuration, ing, a.annotationConfig.Annotations) + if err != nil && ing_errors.IsValidationError(err) { + return nil, fmt.Errorf("%s contains invalid value", authReqCacheDuration) + } authCacheDuration, err := ParseStringToCacheDurations(durstr) if err != nil { return nil, err } responseHeaders := []string{} - hstr, _ := parser.GetStringAnnotation("auth-response-headers", ing) + hstr, err := parser.GetStringAnnotation(authReqResponseHeadersAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && ing_errors.IsValidationError(err) { + return nil, ing_errors.NewLocationDenied("validation error") + } if len(hstr) != 0 { harr := strings.Split(hstr, ",") for _, header := range harr { @@ -279,9 +404,28 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { } } - proxySetHeaderMap, err := parser.GetStringAnnotation("auth-proxy-set-headers", ing) + proxySetHeaderMap, err := parser.GetStringAnnotation(authReqProxySetHeadersAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - klog.V(3).InfoS("auth-set-proxy-headers annotation is undefined and will not be set") + klog.V(3).InfoS("auth-set-proxy-headers annotation is undefined and will not be set", "err", err) + } + + cns, _, err := cache.SplitMetaNamespaceKey(proxySetHeaderMap) + if err != nil { + return nil, ing_errors.LocationDenied{ + Reason: fmt.Errorf("error reading configmap name %s from annotation: %w", proxySetHeaderMap, err), + } + } + + if cns == "" { + cns = ing.Namespace + } + + secCfg := a.r.GetSecurityConfiguration() + // We don't accept different namespaces for secrets. + if !secCfg.AllowCrossNamespaceResources && cns != ing.Namespace { + return nil, ing_errors.LocationDenied{ + Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), + } } var proxySetHeaders map[string]string @@ -301,9 +445,15 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { proxySetHeaders = proxySetHeadersMapContents.Data } - requestRedirect, _ := parser.GetStringAnnotation("auth-request-redirect", ing) + requestRedirect, err := parser.GetStringAnnotation(authReqRequestRedirectAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && ing_errors.IsValidationError(err) { + return nil, fmt.Errorf("%s is invalid: %w", authReqRequestRedirectAnnotation, err) + } - alwaysSetCookie, _ := parser.GetBoolAnnotation("auth-always-set-cookie", ing) + alwaysSetCookie, err := parser.GetBoolAnnotation(authReqAlwaysSetCookieAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && ing_errors.IsValidationError(err) { + return nil, fmt.Errorf("%s is invalid: %w", authReqAlwaysSetCookieAnnotation, err) + } return &Config{ URL: urlString, @@ -348,3 +498,12 @@ func ParseStringToCacheDurations(input string) ([]string, error) { } return authCacheDuration, nil } + +func (a authReq) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a authReq) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, authReqAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go index e1325235b..833bebe78 100644 --- a/internal/ingress/annotations/authreq/main_test.go +++ b/internal/ingress/annotations/authreq/main_test.go @@ -192,11 +192,13 @@ func TestHeaderAnnotations(t *testing.T) { i, err := NewParser(&resolver.Mock{}).Parse(ing) if test.expErr { if err == nil { - t.Error("expected error but retuned nil") + t.Errorf("%v expected error but retuned nil", test.title) } continue } - + if err != nil { + t.Errorf("no error was expected but %v happened in %s", err, test.title) + } u, ok := i.(*Config) if !ok { t.Errorf("%v: expected an External type", test.title) diff --git a/internal/ingress/annotations/authreqglobal/main.go b/internal/ingress/annotations/authreqglobal/main.go index 78dd7d6a5..a1641e085 100644 --- a/internal/ingress/annotations/authreqglobal/main.go +++ b/internal/ingress/annotations/authreqglobal/main.go @@ -23,23 +23,52 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + enableGlobalAuthAnnotation = "enable-global-auth" +) + +var globalAuthAnnotations = parser.Annotation{ + Group: "authentication", + Annotations: parser.AnnotationFields{ + enableGlobalAuthAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `Defines if the global external authentication should be enabled.`, + }, + }, +} + type authReqGlobal struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new authentication request annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return authReqGlobal{r} + return authReqGlobal{ + r: r, + annotationConfig: globalAuthAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress // rule used to enable or disable global external authentication func (a authReqGlobal) Parse(ing *networking.Ingress) (interface{}, error) { - enableGlobalAuth, err := parser.GetBoolAnnotation("enable-global-auth", ing) + enableGlobalAuth, err := parser.GetBoolAnnotation(enableGlobalAuthAnnotation, ing, a.annotationConfig.Annotations) if err != nil { enableGlobalAuth = true } return enableGlobalAuth, nil } + +func (a authReqGlobal) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a authReqGlobal) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, globalAuthAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/authtls/main.go b/internal/ingress/annotations/authtls/main.go index 2efd6d176..5d6763e8b 100644 --- a/internal/ingress/annotations/authtls/main.go +++ b/internal/ingress/annotations/authtls/main.go @@ -32,13 +32,64 @@ import ( const ( defaultAuthTLSDepth = 1 defaultAuthVerifyClient = "on" + + annotationAuthTLSSecret = "auth-tls-secret" //#nosec G101 + annotationAuthTLSVerifyClient = "auth-tls-verify-client" + annotationAuthTLSVerifyDepth = "auth-tls-verify-depth" + annotationAuthTLSErrorPage = "auth-tls-error-page" + annotationAuthTLSPassCertToUpstream = "auth-tls-pass-certificate-to-upstream" //#nosec G101 + annotationAuthTLSMatchCN = "auth-tls-match-cn" ) var ( + regexChars = regexp.QuoteMeta(`()|=`) authVerifyClientRegex = regexp.MustCompile(`on|off|optional|optional_no_ca`) - commonNameRegex = regexp.MustCompile(`CN=`) + commonNameRegex = regexp.MustCompile(`^CN=[/\-.\_\~a-zA-Z0-9` + regexChars + `]*$`) + redirectRegex = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-\.]*(:[0-9]+)?/[A-Za-z0-9\-\.]*)?$`) ) +var authTLSAnnotations = parser.Annotation{ + Group: "authentication", + Annotations: parser.AnnotationFields{ + annotationAuthTLSSecret: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars + Documentation: `This annotation defines the secret that contains the certificate chain of allowed certs`, + }, + annotationAuthTLSVerifyClient: { + Validator: parser.ValidateRegex(*authVerifyClientRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars + Documentation: `This annotation enables verification of client certificates. Can be "on", "off", "optional" or "optional_no_ca"`, + }, + annotationAuthTLSVerifyDepth: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines validation depth between the provided client certificate and the Certification Authority chain.`, + }, + annotationAuthTLSErrorPage: { + Validator: parser.ValidateRegex(*redirectRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation defines the URL/Page that user should be redirected in case of a Certificate Authentication Error`, + }, + annotationAuthTLSPassCertToUpstream: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if the received certificates should be passed or not to the upstream server in the header "ssl-client-cert"`, + }, + annotationAuthTLSMatchCN: { + Validator: parser.ValidateRegex(*commonNameRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation adds a sanity check for the CN of the client certificate that is sent over using a string / regex starting with "CN="`, + }, + }, +} + // Config contains the AuthSSLCert used for mutual authentication // and the configured ValidationDepth type Config struct { @@ -80,11 +131,15 @@ func (assl1 *Config) Equal(assl2 *Config) bool { // NewParser creates a new TLS authentication annotation parser func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { - return authTLS{resolver} + return authTLS{ + r: resolver, + annotationConfig: authTLSAnnotations, + } } type authTLS struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Parse parses the annotations contained in the ingress @@ -93,15 +148,23 @@ func (a authTLS) Parse(ing *networking.Ingress) (interface{}, error) { var err error config := &Config{} - tlsauthsecret, err := parser.GetStringAnnotation("auth-tls-secret", ing) + tlsauthsecret, err := parser.GetStringAnnotation(annotationAuthTLSSecret, ing, a.annotationConfig.Annotations) if err != nil { return &Config{}, err } - _, _, err = k8s.ParseNameNS(tlsauthsecret) + ns, _, err := k8s.ParseNameNS(tlsauthsecret) if err != nil { return &Config{}, ing_errors.NewLocationDenied(err.Error()) } + if ns == "" { + ns = ing.Namespace + } + secCfg := a.r.GetSecurityConfiguration() + // We don't accept different namespaces for secrets. + if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace { + return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported") + } authCert, err := a.r.GetAuthCertificate(tlsauthsecret) if err != nil { @@ -110,30 +173,50 @@ func (a authTLS) Parse(ing *networking.Ingress) (interface{}, error) { } config.AuthSSLCert = *authCert - config.VerifyClient, err = parser.GetStringAnnotation("auth-tls-verify-client", ing) + config.VerifyClient, err = parser.GetStringAnnotation(annotationAuthTLSVerifyClient, ing, a.annotationConfig.Annotations) + // We can set a default value here in case of validation error if err != nil || !authVerifyClientRegex.MatchString(config.VerifyClient) { config.VerifyClient = defaultAuthVerifyClient } - config.ValidationDepth, err = parser.GetIntAnnotation("auth-tls-verify-depth", ing) + config.ValidationDepth, err = parser.GetIntAnnotation(annotationAuthTLSVerifyDepth, ing, a.annotationConfig.Annotations) + // We can set a default value here in case of validation error if err != nil || config.ValidationDepth == 0 { config.ValidationDepth = defaultAuthTLSDepth } - config.ErrorPage, err = parser.GetStringAnnotation("auth-tls-error-page", ing) + config.ErrorPage, err = parser.GetStringAnnotation(annotationAuthTLSErrorPage, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + return &Config{}, err + } config.ErrorPage = "" } - config.PassCertToUpstream, err = parser.GetBoolAnnotation("auth-tls-pass-certificate-to-upstream", ing) + config.PassCertToUpstream, err = parser.GetBoolAnnotation(annotationAuthTLSPassCertToUpstream, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + return &Config{}, err + } config.PassCertToUpstream = false } - config.MatchCN, err = parser.GetStringAnnotation("auth-tls-match-cn", ing) - if err != nil || !commonNameRegex.MatchString(config.MatchCN) { + config.MatchCN, err = parser.GetStringAnnotation(annotationAuthTLSMatchCN, ing, a.annotationConfig.Annotations) + if err != nil { + if ing_errors.IsValidationError(err) { + return &Config{}, err + } config.MatchCN = "" } return config, nil } + +func (a authTLS) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a authTLS) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, authTLSAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/authtls/main_test.go b/internal/ingress/annotations/authtls/main_test.go index 569f3865b..a1f3f0f92 100644 --- a/internal/ingress/annotations/authtls/main_test.go +++ b/internal/ingress/annotations/authtls/main_test.go @@ -93,7 +93,7 @@ func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("auth-tls-secret")] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "default/demo-secret" ing.SetAnnotations(data) @@ -132,11 +132,11 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected empty string, but got %v", u.MatchCN) } - data[parser.GetAnnotationWithPrefix("auth-tls-verify-client")] = "off" - data[parser.GetAnnotationWithPrefix("auth-tls-verify-depth")] = "2" - data[parser.GetAnnotationWithPrefix("auth-tls-error-page")] = "ok.com/error" - data[parser.GetAnnotationWithPrefix("auth-tls-pass-certificate-to-upstream")] = "true" - data[parser.GetAnnotationWithPrefix("auth-tls-match-cn")] = "CN=hello-app" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = "off" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyDepth)] = "2" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSErrorPage)] = "ok.com/error" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSPassCertToUpstream)] = "true" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSMatchCN)] = "CN=(hello-app|ok|goodbye)" ing.SetAnnotations(data) @@ -165,8 +165,8 @@ func TestAnnotations(t *testing.T) { if u.PassCertToUpstream != true { t.Errorf("expected %v but got %v", true, u.PassCertToUpstream) } - if u.MatchCN != "CN=hello-app" { - t.Errorf("expected %v but got %v", "CN=hello-app", u.MatchCN) + if u.MatchCN != "CN=(hello-app|ok|goodbye)" { + t.Errorf("expected %v but got %v", "CN=(hello-app|ok|goodbye)", u.MatchCN) } } @@ -182,15 +182,24 @@ func TestInvalidAnnotations(t *testing.T) { } // Invalid NameSpace - data[parser.GetAnnotationWithPrefix("auth-tls-secret")] = "demo-secret" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "demo-secret" ing.SetAnnotations(data) _, err = NewParser(fakeSecret).Parse(ing) if err == nil { t.Errorf("Expected error with ingress but got nil") } + // Invalid Cross NameSpace + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "nondefault/demo-secret" + ing.SetAnnotations(data) + _, err = NewParser(fakeSecret).Parse(ing) + expErr := errors.NewLocationDenied("cross namespace secrets are not supported") + if err.Error() != expErr.Error() { + t.Errorf("received error is different from cross namespace error: %s Expected %s", err, expErr) + } + // Invalid Auth Certificate - data[parser.GetAnnotationWithPrefix("auth-tls-secret")] = "default/invalid-demo-secret" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "default/invalid-demo-secret" ing.SetAnnotations(data) _, err = NewParser(fakeSecret).Parse(ing) if err == nil { @@ -198,11 +207,38 @@ func TestInvalidAnnotations(t *testing.T) { } // Invalid optional Annotations - data[parser.GetAnnotationWithPrefix("auth-tls-secret")] = "default/demo-secret" - data[parser.GetAnnotationWithPrefix("auth-tls-verify-client")] = "w00t" - data[parser.GetAnnotationWithPrefix("auth-tls-verify-depth")] = "abcd" - data[parser.GetAnnotationWithPrefix("auth-tls-pass-certificate-to-upstream")] = "nahh" - data[parser.GetAnnotationWithPrefix("auth-tls-match-cn")] = "" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "default/demo-secret" + + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = "w00t" + ing.SetAnnotations(data) + _, err = NewParser(fakeSecret).Parse(ing) + if err != nil { + t.Errorf("Error should be nil and verify client should be defaulted") + } + + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyDepth)] = "abcd" + ing.SetAnnotations(data) + _, err = NewParser(fakeSecret).Parse(ing) + if err != nil { + t.Errorf("Error should be nil and verify depth should be defaulted") + } + + data[parser.GetAnnotationWithPrefix(annotationAuthTLSPassCertToUpstream)] = "nahh" + ing.SetAnnotations(data) + _, err = NewParser(fakeSecret).Parse(ing) + if err == nil { + t.Errorf("Expected error with ingress but got nil") + } + delete(data, parser.GetAnnotationWithPrefix(annotationAuthTLSPassCertToUpstream)) + + data[parser.GetAnnotationWithPrefix(annotationAuthTLSMatchCN)] = "" + ing.SetAnnotations(data) + _, err = NewParser(fakeSecret).Parse(ing) + if err == nil { + t.Errorf("Expected error with ingress CN but got nil") + } + delete(data, parser.GetAnnotationWithPrefix(annotationAuthTLSMatchCN)) + ing.SetAnnotations(data) i, err := NewParser(fakeSecret).Parse(ing) diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index c749072e3..2704ce9f6 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -17,49 +17,72 @@ limitations under the License. package backendprotocol import ( - "regexp" - "strings" - networking "k8s.io/api/networking/v1" "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) -// HTTP protocol -const HTTP = "HTTP" - var ( - validProtocols = regexp.MustCompile(`^(AUTO_HTTP|HTTP|HTTPS|GRPC|GRPCS|FCGI)$`) + validProtocols = []string{"auto_http", "http", "https", "grpc", "grpcs", "fcgi"} ) +const ( + http = "HTTP" + backendProtocolAnnotation = "backend-protocol" +) + +var backendProtocolConfig = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + backendProtocolAnnotation: { + Validator: parser.ValidateOptions(validProtocols, false, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `this annotation can be used to define which protocol should + be used to communicate with backends`, + }, + }, +} + type backendProtocol struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new backend protocol annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return backendProtocol{r} + return backendProtocol{ + r: r, + annotationConfig: backendProtocolConfig, + } +} + +func (a backendProtocol) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations } // ParseAnnotations parses the annotations contained in the ingress // rule used to indicate the backend protocol. func (a backendProtocol) Parse(ing *networking.Ingress) (interface{}, error) { if ing.GetAnnotations() == nil { - return HTTP, nil + return http, nil } - proto, err := parser.GetStringAnnotation("backend-protocol", ing) + proto, err := parser.GetStringAnnotation(backendProtocolAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - return HTTP, nil - } - - proto = strings.TrimSpace(strings.ToUpper(proto)) - if !validProtocols.MatchString(proto) { - klog.Warningf("Protocol %v is not a valid value for the backend-protocol annotation. Using HTTP as protocol", proto) - return HTTP, nil + if errors.IsValidationError(err) { + klog.Warningf("validation error %s. Using HTTP as protocol", err) + } + return http, nil } return proto, nil } + +func (a backendProtocol) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, backendProtocolConfig.Annotations) +} diff --git a/internal/ingress/annotations/backendprotocol/main_test.go b/internal/ingress/annotations/backendprotocol/main_test.go index e8c018998..490be447b 100644 --- a/internal/ingress/annotations/backendprotocol/main_test.go +++ b/internal/ingress/annotations/backendprotocol/main_test.go @@ -77,7 +77,7 @@ func TestParseInvalidAnnotations(t *testing.T) { } // Test invalid annotation set - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "INVALID" + data[parser.GetAnnotationWithPrefix(backendProtocolAnnotation)] = "INVALID" ing.SetAnnotations(data) i, err = NewParser(&resolver.Mock{}).Parse(ing) @@ -97,7 +97,7 @@ func TestParseAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTPS" + data[parser.GetAnnotationWithPrefix(backendProtocolAnnotation)] = " HTTPS " ing.SetAnnotations(data) i, err := NewParser(&resolver.Mock{}).Parse(ing) diff --git a/internal/ingress/annotations/canary/main.go b/internal/ingress/annotations/canary/main.go index d9e53b3b8..119f09181 100644 --- a/internal/ingress/annotations/canary/main.go +++ b/internal/ingress/annotations/canary/main.go @@ -18,14 +18,82 @@ package canary import ( networking "k8s.io/api/networking/v1" + "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + canaryAnnotation = "canary" + canaryWeightAnnotation = "canary-weight" + canaryWeightTotalAnnotation = "canary-weight-total" + canaryByHeaderAnnotation = "canary-by-header" + canaryByHeaderValueAnnotation = "canary-by-header-value" + canaryByHeaderPatternAnnotation = "canary-by-header-pattern" + canaryByCookieAnnotation = "canary-by-cookie" +) + +var CanaryAnnotations = parser.Annotation{ + Group: "canary", + Annotations: parser.AnnotationFields{ + canaryAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables the Ingress spec to act as an alternative service for requests to route to depending on the rules applied`, + }, + canaryWeightAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines the integer based (0 - ) percent of random requests that should be routed to the service specified in the canary Ingress`, + }, + canaryWeightTotalAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation The total weight of traffic. If unspecified, it defaults to 100`, + }, + canaryByHeaderAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the header that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. + When the request header is set to 'always', it will be routed to the canary. When the header is set to 'never', it will never be routed to the canary. + For any other value, the header will be ignored and the request compared against the other canary rules by precedence`, + }, + canaryByHeaderValueAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the header value to match for notifying the Ingress to route the request to the service specified in the Canary Ingress. + When the request header is set to this value, it will be routed to the canary. For any other header value, the header will be ignored and the request compared against the other canary rules by precedence. + This annotation has to be used together with 'canary-by-header'. The annotation is an extension of the 'canary-by-header' to allow customizing the header value instead of using hardcoded values. + It doesn't have any effect if the 'canary-by-header' annotation is not defined`, + }, + canaryByHeaderPatternAnnotation: { + Validator: parser.ValidateRegex(*parser.IsValidRegex, false), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation works the same way as canary-by-header-value except it does PCRE Regex matching. + Note that when 'canary-by-header-value' is set this annotation will be ignored. + When the given Regex causes error during request processing, the request will be considered as not matching.`, + }, + canaryByCookieAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the cookie that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. + When the cookie is set to 'always', it will be routed to the canary. When the cookie is set to 'never', it will never be routed to the canary`, + }, + }, +} + type canary struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config returns the configuration rules for setting up the Canary @@ -41,7 +109,10 @@ type Config struct { // NewParser parses the ingress for canary related annotations func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return canary{r} + return canary{ + r: r, + annotationConfig: CanaryAnnotations, + } } // Parse parses the annotations contained in the ingress @@ -50,45 +121,75 @@ func (c canary) Parse(ing *networking.Ingress) (interface{}, error) { config := &Config{} var err error - config.Enabled, err = parser.GetBoolAnnotation("canary", ing) + config.Enabled, err = parser.GetBoolAnnotation(canaryAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to 'false'", canaryAnnotation) + } config.Enabled = false } - config.Weight, err = parser.GetIntAnnotation("canary-weight", ing) + config.Weight, err = parser.GetIntAnnotation(canaryWeightAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to '0'", canaryWeightAnnotation) + } config.Weight = 0 } - config.WeightTotal, err = parser.GetIntAnnotation("canary-weight-total", ing) + config.WeightTotal, err = parser.GetIntAnnotation(canaryWeightTotalAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to '100'", canaryWeightTotalAnnotation) + } config.WeightTotal = 100 } - config.Header, err = parser.GetStringAnnotation("canary-by-header", ing) + config.Header, err = parser.GetStringAnnotation(canaryByHeaderAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to ''", canaryByHeaderAnnotation) + } config.Header = "" } - config.HeaderValue, err = parser.GetStringAnnotation("canary-by-header-value", ing) + config.HeaderValue, err = parser.GetStringAnnotation(canaryByHeaderValueAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to ''", canaryByHeaderValueAnnotation) + } config.HeaderValue = "" } - config.HeaderPattern, err = parser.GetStringAnnotation("canary-by-header-pattern", ing) + config.HeaderPattern, err = parser.GetStringAnnotation(canaryByHeaderPatternAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to ''", canaryByHeaderPatternAnnotation) + } config.HeaderPattern = "" } - config.Cookie, err = parser.GetStringAnnotation("canary-by-cookie", ing) + config.Cookie, err = parser.GetStringAnnotation(canaryByCookieAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%s is invalid, defaulting to ''", canaryByCookieAnnotation) + } config.Cookie = "" } if !config.Enabled && (config.Weight > 0 || len(config.Header) > 0 || len(config.HeaderValue) > 0 || len(config.Cookie) > 0 || len(config.HeaderPattern) > 0) { - return nil, errors.NewInvalidAnnotationConfiguration("canary", "configured but not enabled") + return nil, errors.NewInvalidAnnotationConfiguration(canaryAnnotation, "configured but not enabled") } return config, nil } + +func (c canary) GetDocumentation() parser.AnnotationFields { + return c.annotationConfig.Annotations +} + +func (a canary) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, CanaryAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/clientbodybuffersize/main.go b/internal/ingress/annotations/clientbodybuffersize/main.go index 9020ee594..aa1485df2 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main.go +++ b/internal/ingress/annotations/clientbodybuffersize/main.go @@ -23,17 +23,49 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + clientBodyBufferSizeAnnotation = "client-body-buffer-size" +) + +var clientBodyBufferSizeConfig = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + clientBodyBufferSizeAnnotation: { + Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Sets buffer size for reading client request body per location. + In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. + By default, buffer size is equal to two memory pages. This is 8K on x86, other 32-bit platforms, and x86-64. + It is usually 16K on other 64-bit platforms. This annotation is applied to each location provided in the ingress rule.`, + }, + }, +} + type clientBodyBufferSize struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new clientBodyBufferSize annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return clientBodyBufferSize{r} + return clientBodyBufferSize{ + r: r, + annotationConfig: clientBodyBufferSizeConfig, + } +} + +func (cbbs clientBodyBufferSize) GetDocumentation() parser.AnnotationFields { + return cbbs.annotationConfig.Annotations } // Parse parses the annotations contained in the ingress rule // used to add an client-body-buffer-size to the provided locations func (cbbs clientBodyBufferSize) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("client-body-buffer-size", ing) + return parser.GetStringAnnotation(clientBodyBufferSizeAnnotation, ing, cbbs.annotationConfig.Annotations) +} + +func (a clientBodyBufferSize) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, clientBodyBufferSizeConfig.Annotations) } diff --git a/internal/ingress/annotations/clientbodybuffersize/main_test.go b/internal/ingress/annotations/clientbodybuffersize/main_test.go index 9932f8314..0f2c8474a 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main_test.go +++ b/internal/ingress/annotations/clientbodybuffersize/main_test.go @@ -39,6 +39,9 @@ func TestParse(t *testing.T) { }{ {map[string]string{annotation: "8k"}, "8k"}, {map[string]string{annotation: "16k"}, "16k"}, + {map[string]string{annotation: "10000"}, "10000"}, + {map[string]string{annotation: "16R"}, ""}, + {map[string]string{annotation: "16kkk"}, ""}, {map[string]string{annotation: ""}, ""}, {map[string]string{}, ""}, {nil, ""}, diff --git a/internal/ingress/annotations/connection/main.go b/internal/ingress/annotations/connection/main.go index e9b0c1865..9e96b6ab1 100644 --- a/internal/ingress/annotations/connection/main.go +++ b/internal/ingress/annotations/connection/main.go @@ -17,12 +17,34 @@ limitations under the License. package connection import ( + "regexp" + networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + connectionProxyHeaderAnnotation = "connection-proxy-header" +) + +var ( + validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`) +) + +var connectionHeadersAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + connectionProxyHeaderAnnotation: { + Validator: parser.ValidateRegex(*validConnectionHeaderValue, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows setting a specific value for "proxy_set_header Connection" directive. Right now it is restricted to "close" or "keep-alive"`, + }, + }, +} + // Config returns the connection header configuration for an Ingress rule type Config struct { Header string `json:"header"` @@ -30,18 +52,22 @@ type Config struct { } type connection struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new port in redirect annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return connection{r} + return connection{ + r: r, + annotationConfig: connectionHeadersAnnotations, + } } // Parse parses the annotations contained in the ingress // rule used to indicate if the connection header should be overridden. func (a connection) Parse(ing *networking.Ingress) (interface{}, error) { - cp, err := parser.GetStringAnnotation("connection-proxy-header", ing) + cp, err := parser.GetStringAnnotation(connectionProxyHeaderAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return &Config{ Enabled: false, @@ -70,3 +96,12 @@ func (r1 *Config) Equal(r2 *Config) bool { return true } + +func (a connection) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a connection) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, connectionHeadersAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/connection/main_test.go b/internal/ingress/annotations/connection/main_test.go index 011a2948c..a95288385 100644 --- a/internal/ingress/annotations/connection/main_test.go +++ b/internal/ingress/annotations/connection/main_test.go @@ -37,10 +37,12 @@ func TestParse(t *testing.T) { testCases := []struct { annotations map[string]string expected *Config + expectErr bool }{ - {map[string]string{annotation: "keep-alive"}, &Config{Enabled: true, Header: "keep-alive"}}, - {map[string]string{}, &Config{Enabled: false}}, - {nil, &Config{Enabled: false}}, + {map[string]string{annotation: "keep-alive"}, &Config{Enabled: true, Header: "keep-alive"}, false}, + {map[string]string{annotation: "not-allowed-value"}, &Config{Enabled: false}, true}, + {map[string]string{}, &Config{Enabled: false}, true}, + {nil, &Config{Enabled: false}, true}, } ing := &networking.Ingress{ @@ -53,11 +55,17 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - i, _ := ap.Parse(ing) - p, _ := i.(*Config) - + i, err := ap.Parse(ing) + if (err != nil) != testCase.expectErr { + t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations) + } + p, ok := i.(*Config) + if !ok { + t.Fatalf("expected a Config type") + } if !p.Equal(testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, p, testCase.annotations) } + } } diff --git a/internal/ingress/annotations/cors/main.go b/internal/ingress/annotations/cors/main.go index 3888f2909..cc30b8405 100644 --- a/internal/ingress/annotations/cors/main.go +++ b/internal/ingress/annotations/cors/main.go @@ -24,6 +24,7 @@ import ( "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) @@ -38,20 +39,87 @@ var ( // Regex are defined here to prevent information leak, if user tries to set anything not valid // that could cause the Response to contain some internal value/variable (like returning $pid, $upstream_addr, etc) // Origin must contain a http/s Origin (including or not the port) or the value '*' + // This Regex is composed of the following: + // * Sets a group that can be (https?://)?*?.something.com:port? + // * Allows this to be repeated as much as possible, and separated by comma + // Otherwise it should be '*' + corsOriginRegexValidator = regexp.MustCompile(`^((((https?://)?(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?,?)+)|\*)?$`) + // corsOriginRegex defines the regex for validation inside Parse corsOriginRegex = regexp.MustCompile(`^(https?://(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?|\*)?$`) // Method must contain valid methods list (PUT, GET, POST, BLA) // May contain or not spaces between each verb corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`) - // Headers must contain valid values only (X-HEADER12, X-ABC) - // May contain or not spaces between each Header - corsHeadersRegex = regexp.MustCompile(`^([A-Za-z0-9\-\_]+,?\s?)+$`) // Expose Headers must contain valid values only (*, X-HEADER12, X-ABC) // May contain or not spaces between each Header corsExposeHeadersRegex = regexp.MustCompile(`^(([A-Za-z0-9\-\_]+|\*),?\s?)+$`) ) +const ( + corsEnableAnnotation = "enable-cors" + corsAllowOriginAnnotation = "cors-allow-origin" + corsAllowHeadersAnnotation = "cors-allow-headers" + corsAllowMethodsAnnotation = "cors-allow-methods" + corsAllowCredentialsAnnotation = "cors-allow-credentials" //#nosec G101 + corsExposeHeadersAnnotation = "cors-expose-headers" + corsMaxAgeAnnotation = "cors-max-age" +) + +var corsAnnotation = parser.Annotation{ + Group: "cors", + Annotations: parser.AnnotationFields{ + corsEnableAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables Cross-Origin Resource Sharing (CORS) in an Ingress rule`, + }, + corsAllowOriginAnnotation: { + Validator: parser.ValidateRegex(*corsOriginRegexValidator, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation controls what's the accepted Origin for CORS. + This is a multi-valued field, separated by ','. It must follow this format: http(s)://origin-site.com or http(s)://origin-site.com:port + It also supports single level wildcard subdomains and follows this format: http(s)://*.foo.bar, http(s)://*.bar.foo:8080 or http(s)://*.abc.bar.foo:9000`, + }, + corsAllowHeadersAnnotation: { + Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation controls which headers are accepted. + This is a multi-valued field, separated by ',' and accepts letters, numbers, _ and -`, + }, + corsAllowMethodsAnnotation: { + Validator: parser.ValidateRegex(*corsMethodsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation controls which methods are accepted. + This is a multi-valued field, separated by ',' and accepts only letters (upper and lower case)`, + }, + corsAllowCredentialsAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation controls if credentials can be passed during CORS operations.`, + }, + corsExposeHeadersAnnotation: { + Validator: parser.ValidateRegex(*corsExposeHeadersRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation controls which headers are exposed to response. + This is a multi-valued field, separated by ',' and accepts letters, numbers, _, - and *.`, + }, + corsMaxAgeAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation controls how long, in seconds, preflight requests can be cached.`, + }, + }, +} + type cors struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the Cors configuration to be used in the Ingress @@ -67,7 +135,10 @@ type Config struct { // NewParser creates a new CORS annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return cors{r} + return cors{ + r: r, + annotationConfig: corsAnnotation, + } } // Equal tests for equality between two External types @@ -116,13 +187,16 @@ func (c cors) Parse(ing *networking.Ingress) (interface{}, error) { var err error config := &Config{} - config.CorsEnabled, err = parser.GetBoolAnnotation("enable-cors", ing) + config.CorsEnabled, err = parser.GetBoolAnnotation(corsEnableAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("enable-cors is invalid, defaulting to 'false'") + } config.CorsEnabled = false } config.CorsAllowOrigin = []string{} - unparsedOrigins, err := parser.GetStringAnnotation("cors-allow-origin", ing) + unparsedOrigins, err := parser.GetStringAnnotation(corsAllowOriginAnnotation, ing, c.annotationConfig.Annotations) if err == nil { origins := strings.Split(unparsedOrigins, ",") for _, origin := range origins { @@ -140,33 +214,53 @@ func (c cors) Parse(ing *networking.Ingress) (interface{}, error) { klog.Infof("Current config.corsAllowOrigin %v", config.CorsAllowOrigin) } } else { + if errors.IsValidationError(err) { + klog.Warningf("cors-allow-origin is invalid, defaulting to '*'") + } config.CorsAllowOrigin = []string{"*"} } - config.CorsAllowHeaders, err = parser.GetStringAnnotation("cors-allow-headers", ing) - if err != nil || !corsHeadersRegex.MatchString(config.CorsAllowHeaders) { + config.CorsAllowHeaders, err = parser.GetStringAnnotation(corsAllowHeadersAnnotation, ing, c.annotationConfig.Annotations) + if err != nil || !parser.HeadersVariable.MatchString(config.CorsAllowHeaders) { config.CorsAllowHeaders = defaultCorsHeaders } - config.CorsAllowMethods, err = parser.GetStringAnnotation("cors-allow-methods", ing) + config.CorsAllowMethods, err = parser.GetStringAnnotation(corsAllowMethodsAnnotation, ing, c.annotationConfig.Annotations) if err != nil || !corsMethodsRegex.MatchString(config.CorsAllowMethods) { config.CorsAllowMethods = defaultCorsMethods } - config.CorsAllowCredentials, err = parser.GetBoolAnnotation("cors-allow-credentials", ing) + config.CorsAllowCredentials, err = parser.GetBoolAnnotation(corsAllowCredentialsAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + if errors.IsValidationError(err) { + klog.Warningf("cors-allow-credentials is invalid, defaulting to 'true'") + } + } config.CorsAllowCredentials = true } - config.CorsExposeHeaders, err = parser.GetStringAnnotation("cors-expose-headers", ing) + config.CorsExposeHeaders, err = parser.GetStringAnnotation(corsExposeHeadersAnnotation, ing, c.annotationConfig.Annotations) if err != nil || !corsExposeHeadersRegex.MatchString(config.CorsExposeHeaders) { config.CorsExposeHeaders = "" } - config.CorsMaxAge, err = parser.GetIntAnnotation("cors-max-age", ing) + config.CorsMaxAge, err = parser.GetIntAnnotation(corsMaxAgeAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("cors-max-age is invalid, defaulting to %d", defaultCorsMaxAge) + } config.CorsMaxAge = defaultCorsMaxAge } return config, nil } + +func (c cors) GetDocumentation() parser.AnnotationFields { + return c.annotationConfig.Annotations +} + +func (a cors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, corsAnnotation.Annotations) +} diff --git a/internal/ingress/annotations/cors/main_test.go b/internal/ingress/annotations/cors/main_test.go index 086a59d89..d371d183b 100644 --- a/internal/ingress/annotations/cors/main_test.go +++ b/internal/ingress/annotations/cors/main_test.go @@ -75,13 +75,13 @@ func TestIngressCorsConfigValid(t *testing.T) { data := map[string]string{} // Valid - data[parser.GetAnnotationWithPrefix("enable-cors")] = "true" - data[parser.GetAnnotationWithPrefix("cors-allow-headers")] = "DNT,X-CustomHeader, Keep-Alive,User-Agent" - data[parser.GetAnnotationWithPrefix("cors-allow-credentials")] = "false" - data[parser.GetAnnotationWithPrefix("cors-allow-methods")] = "GET, PATCH" - data[parser.GetAnnotationWithPrefix("cors-allow-origin")] = "https://origin123.test.com:4443" - data[parser.GetAnnotationWithPrefix("cors-expose-headers")] = "*, X-CustomResponseHeader" - data[parser.GetAnnotationWithPrefix("cors-max-age")] = "600" + data[parser.GetAnnotationWithPrefix(corsEnableAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)] = "DNT,X-CustomHeader, Keep-Alive,User-Agent" + data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)] = "false" + data[parser.GetAnnotationWithPrefix(corsAllowMethodsAnnotation)] = "GET, PATCH" + data[parser.GetAnnotationWithPrefix(corsAllowOriginAnnotation)] = "https://origin123.test.com:4443" + data[parser.GetAnnotationWithPrefix(corsExposeHeadersAnnotation)] = "*, X-CustomResponseHeader" + data[parser.GetAnnotationWithPrefix(corsMaxAgeAnnotation)] = "600" ing.SetAnnotations(data) corst, err := NewParser(&resolver.Mock{}).Parse(ing) @@ -95,31 +95,31 @@ func TestIngressCorsConfigValid(t *testing.T) { } if !nginxCors.CorsEnabled { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("enable-cors")], nginxCors.CorsEnabled) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsEnableAnnotation)], nginxCors.CorsEnabled) } if nginxCors.CorsAllowCredentials { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-allow-credentials")], nginxCors.CorsAllowCredentials) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)], nginxCors.CorsAllowCredentials) } if nginxCors.CorsAllowHeaders != "DNT,X-CustomHeader, Keep-Alive,User-Agent" { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-allow-headers")], nginxCors.CorsAllowHeaders) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)], nginxCors.CorsAllowHeaders) } if nginxCors.CorsAllowMethods != "GET, PATCH" { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-allow-methods")], nginxCors.CorsAllowMethods) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowMethodsAnnotation)], nginxCors.CorsAllowMethods) } if nginxCors.CorsAllowOrigin[0] != "https://origin123.test.com:4443" { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-allow-origin")], nginxCors.CorsAllowOrigin) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsAllowOriginAnnotation)], nginxCors.CorsAllowOrigin) } if nginxCors.CorsExposeHeaders != "*, X-CustomResponseHeader" { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-expose-headers")], nginxCors.CorsExposeHeaders) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsExposeHeadersAnnotation)], nginxCors.CorsExposeHeaders) } if nginxCors.CorsMaxAge != 600 { - t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix("cors-max-age")], nginxCors.CorsMaxAge) + t.Errorf("expected %v but returned %v", data[parser.GetAnnotationWithPrefix(corsMaxAgeAnnotation)], nginxCors.CorsMaxAge) } } @@ -129,13 +129,13 @@ func TestIngressCorsConfigInvalid(t *testing.T) { data := map[string]string{} // Valid - data[parser.GetAnnotationWithPrefix("enable-cors")] = "yes" - data[parser.GetAnnotationWithPrefix("cors-allow-headers")] = "@alright, #ingress" - data[parser.GetAnnotationWithPrefix("cors-allow-credentials")] = "no" - data[parser.GetAnnotationWithPrefix("cors-allow-methods")] = "GET, PATCH, $nginx" - data[parser.GetAnnotationWithPrefix("cors-allow-origin")] = "origin123.test.com:4443" - data[parser.GetAnnotationWithPrefix("cors-expose-headers")] = "@alright, #ingress" - data[parser.GetAnnotationWithPrefix("cors-max-age")] = "abcd" + data[parser.GetAnnotationWithPrefix(corsEnableAnnotation)] = "yes" + data[parser.GetAnnotationWithPrefix(corsAllowHeadersAnnotation)] = "@alright, #ingress" + data[parser.GetAnnotationWithPrefix(corsAllowCredentialsAnnotation)] = "no" + data[parser.GetAnnotationWithPrefix(corsAllowMethodsAnnotation)] = "GET, PATCH, $nginx" + data[parser.GetAnnotationWithPrefix(corsAllowOriginAnnotation)] = "origin123.test.com:4443" + data[parser.GetAnnotationWithPrefix(corsExposeHeadersAnnotation)] = "@alright, #ingress" + data[parser.GetAnnotationWithPrefix(corsMaxAgeAnnotation)] = "abcd" ing.SetAnnotations(data) corst, err := NewParser(&resolver.Mock{}).Parse(ing) diff --git a/internal/ingress/annotations/customhttperrors/main.go b/internal/ingress/annotations/customhttperrors/main.go index a05fb16c8..c3c9b5be3 100644 --- a/internal/ingress/annotations/customhttperrors/main.go +++ b/internal/ingress/annotations/customhttperrors/main.go @@ -17,6 +17,7 @@ limitations under the License. package customhttperrors import ( + "regexp" "strconv" "strings" @@ -26,19 +27,46 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + customHTTPErrorsAnnotation = "custom-http-errors" +) + +var ( + // We accept anything between 400 and 599, on a comma separated. + arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5][0-9][0-9],?)*$`) +) + +var customHTTPErrorsAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + customHTTPErrorsAnnotation: { + Validator: parser.ValidateRegex(*arrayOfHTTPErrors, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `If a default backend annotation is specified on the ingress, the errors code specified on this annotation + will be routed to that annotation's default backend service. Otherwise they will be routed to the global default backend. + A comma-separated list of error codes is accepted (anything between 400 and 599, like 403, 503)`, + }, + }, +} + type customhttperrors struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new custom http errors annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return customhttperrors{r} + return customhttperrors{ + r: r, + annotationConfig: customHTTPErrorsAnnotations, + } } // Parse parses the annotations contained in the ingress to use // custom http errors func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) { - c, err := parser.GetStringAnnotation("custom-http-errors", ing) + c, err := parser.GetStringAnnotation(customHTTPErrorsAnnotation, ing, e.annotationConfig.Annotations) if err != nil { return nil, err } @@ -55,3 +83,12 @@ func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) { return codes, nil } + +func (e customhttperrors) GetDocumentation() parser.AnnotationFields { + return e.annotationConfig.Annotations +} + +func (a customhttperrors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, customHTTPErrorsAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/defaultbackend/main.go b/internal/ingress/annotations/defaultbackend/main.go index b1685015e..f3ca004dd 100644 --- a/internal/ingress/annotations/defaultbackend/main.go +++ b/internal/ingress/annotations/defaultbackend/main.go @@ -25,19 +25,40 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + defaultBackendAnnotation = "default-backend" +) + +var defaultBackendAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + defaultBackendAnnotation: { + Validator: parser.ValidateServiceName, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This service will be used to handle the response when the configured service in the Ingress rule does not have any active endpoints. + It will also be used to handle the error responses if both this annotation and the custom-http-errors annotation are set.`, + }, + }, +} + type backend struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new default backend annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return backend{r} + return backend{ + r: r, + annotationConfig: defaultBackendAnnotations, + } } // Parse parses the annotations contained in the ingress to use // a custom default backend func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { - s, err := parser.GetStringAnnotation("default-backend", ing) + s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, db.annotationConfig.Annotations) if err != nil { return nil, err } @@ -50,3 +71,12 @@ func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { return svc, nil } + +func (db backend) GetDocumentation() parser.AnnotationFields { + return db.annotationConfig.Annotations +} + +func (a backend) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, defaultBackendAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/defaultbackend/main_test.go b/internal/ingress/annotations/defaultbackend/main_test.go index ec23d32c2..214d07803 100644 --- a/internal/ingress/annotations/defaultbackend/main_test.go +++ b/internal/ingress/annotations/defaultbackend/main_test.go @@ -91,21 +91,51 @@ func (m mockService) GetService(name string) (*api.Service, error) { func TestAnnotations(t *testing.T) { ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("default-backend")] = "demo-service" - ing.SetAnnotations(data) - - fakeService := &mockService{} - i, err := NewParser(fakeService).Parse(ing) - if err != nil { - t.Errorf("unexpected error %v", err) + tests := map[string]struct { + expectErr bool + serviceName string + }{ + "valid name": { + serviceName: "demo-service", + expectErr: false, + }, + "not in backend": { + serviceName: "demo1-service", + expectErr: true, + }, + "invalid dns name": { + serviceName: "demo-service.something.tld", + expectErr: true, + }, + "invalid name": { + serviceName: "something/xpto", + expectErr: true, + }, + "invalid characters": { + serviceName: "something;xpto", + expectErr: true, + }, } - svc, ok := i.(*api.Service) - if !ok { - t.Errorf("expected *api.Service but got %v", svc) - } - if svc.Name != "demo-service" { - t.Errorf("expected %v but got %v", "demo-service", svc.Name) + for _, test := range tests { + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(defaultBackendAnnotation)] = test.serviceName + ing.SetAnnotations(data) + + fakeService := &mockService{} + i, err := NewParser(fakeService).Parse(ing) + if (err != nil) != test.expectErr { + t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i) + } + + if !test.expectErr { + svc, ok := i.(*api.Service) + if !ok { + t.Errorf("expected *api.Service but got %v", svc) + } + if svc.Name != test.serviceName { + t.Errorf("expected %v but got %v", test.serviceName, svc.Name) + } + } } } diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go index 84bac4109..96dbc7159 100644 --- a/internal/ingress/annotations/fastcgi/main.go +++ b/internal/ingress/annotations/fastcgi/main.go @@ -19,17 +19,49 @@ package fastcgi import ( "fmt" "reflect" + "regexp" networking "k8s.io/api/networking/v1" "k8s.io/client-go/tools/cache" + "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + fastCGIIndexAnnotation = "fastcgi-index" + fastCGIParamsAnnotation = "fastcgi-params-configmap" +) + +var ( + // fast-cgi valid parameters is just a single file name (like index.php) + regexValidIndexAnnotationAndKey = regexp.MustCompile(`^[A-Za-z0-9\.\-\_]+$`) +) + +var fastCGIAnnotations = parser.Annotation{ + Group: "fastcgi", + Annotations: parser.AnnotationFields{ + fastCGIIndexAnnotation: { + Validator: parser.ValidateRegex(*regexValidIndexAnnotationAndKey, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation can be used to specify an index file`, + }, + fastCGIParamsAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation can be used to specify a ConfigMap containing the fastcgi parameters as a key/value. + Only ConfigMaps on the same namespace of ingress can be used. They key and value from ConfigMap are validated for unauthorized characters.`, + }, + }, +} + type fastcgi struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config describes the per location fastcgi config @@ -57,7 +89,10 @@ func (l1 *Config) Equal(l2 *Config) bool { // NewParser creates a new fastcgiConfig protocol annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return fastcgi{r} + return fastcgi{ + r: r, + annotationConfig: fastCGIAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -70,14 +105,21 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { return fcgiConfig, nil } - index, err := parser.GetStringAnnotation("fastcgi-index", ing) + index, err := parser.GetStringAnnotation(fastCGIIndexAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + return fcgiConfig, err + } index = "" } + fcgiConfig.Index = index - cm, err := parser.GetStringAnnotation("fastcgi-params-configmap", ing) + cm, err := parser.GetStringAnnotation(fastCGIParamsAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if ing_errors.IsValidationError(err) { + return fcgiConfig, err + } return fcgiConfig, nil } @@ -87,8 +129,10 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { Reason: fmt.Errorf("error reading configmap name from annotation: %w", err), } } + secCfg := a.r.GetSecurityConfiguration() - if cmns != "" && cmns != ing.Namespace { + // We don't accept different namespaces for secrets. + if cmns != "" && !secCfg.AllowCrossNamespaceResources && cmns != ing.Namespace { return fcgiConfig, fmt.Errorf("different namespace is not supported on fast_cgi param configmap") } @@ -100,7 +144,24 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { } } + for k, v := range cmap.Data { + if !regexValidIndexAnnotationAndKey.MatchString(k) || !parser.NGINXVariable.MatchString(v) { + klog.ErrorS(fmt.Errorf("fcgi contains invalid key or value"), "fcgi annotation error", "configmap", cmap.Name, "namespace", cmap.Namespace, "key", k, "value", v) + return fcgiConfig, ing_errors.NewValidationError(fastCGIParamsAnnotation) + } + } + + fcgiConfig.Index = index fcgiConfig.Params = cmap.Data return fcgiConfig, nil } + +func (a fastcgi) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a fastcgi) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, fastCGIAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go index 35c5bbc12..3296ded65 100644 --- a/internal/ingress/annotations/fastcgi/main_test.go +++ b/internal/ingress/annotations/fastcgi/main_test.go @@ -18,6 +18,7 @@ package fastcgi import ( "fmt" + "reflect" "testing" api "k8s.io/api/core/v1" @@ -49,10 +50,16 @@ func buildIngress() *networking.Ingress { type mockConfigMap struct { resolver.Mock + extraConfigMap map[string]map[string]string } func (m mockConfigMap) GetConfigMap(name string) (*api.ConfigMap, error) { - if name != "default/demo-configmap" && name != "otherns/demo-configmap" { + if m.extraConfigMap == nil { + m.extraConfigMap = make(map[string]map[string]string) + } + cmdata, ok := m.extraConfigMap[name] + + if name != "default/demo-configmap" && name != "otherns/demo-configmap" && !ok { return nil, fmt.Errorf("there is no configmap with name %v", name) } @@ -61,12 +68,17 @@ func (m mockConfigMap) GetConfigMap(name string) (*api.ConfigMap, error) { return nil, fmt.Errorf("invalid configmap name") } + data := map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"} + if ok { + data = cmdata + } + return &api.ConfigMap{ ObjectMeta: meta_v1.ObjectMeta{ Namespace: cmns, Name: cmn, }, - Data: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, + Data: data, }, nil } @@ -283,3 +295,111 @@ func TestConfigEquality(t *testing.T) { t.Errorf("config4 should be equal to config") } } + +func Test_fastcgi_Parse(t *testing.T) { + + tests := []struct { + name string + index string + configmapname string + configmap map[string]string + want interface{} + wantErr bool + }{ + { + name: "valid configuration", + index: "indexxpto-92123.php", + configmapname: "default/fcgiconfig", + configmap: map[string]string{ + "REQUEST_METHOD": "$request_method", + "SCRIPT_FILENAME": "$document_root$fastcgi_script_name", + }, + want: Config{ + Index: "indexxpto-92123.php", + Params: map[string]string{ + "REQUEST_METHOD": "$request_method", + "SCRIPT_FILENAME": "$document_root$fastcgi_script_name", + }, + }, + }, + { + name: "invalid index name", + index: "indexxpto-92123$xx.php", + configmapname: "default/fcgiconfig", + configmap: map[string]string{ + "REQUEST_METHOD": "$request_method", + "SCRIPT_FILENAME": "$document_root$fastcgi_script_name", + }, + want: Config{}, + wantErr: true, + }, + { + name: "invalid configmap namespace", + index: "indexxpto-92123.php", + configmapname: "otherns/fcgiconfig", + configmap: map[string]string{ + "REQUEST_METHOD": "$request_method", + "SCRIPT_FILENAME": "$document_root$fastcgi_script_name", + }, + want: Config{Index: "indexxpto-92123.php"}, + wantErr: true, + }, + { + name: "invalid configmap namespace name", + index: "indexxpto-92123.php", + configmapname: "otherns/fcgicon;{fig", + configmap: map[string]string{ + "REQUEST_METHOD": "$request_method", + "SCRIPT_FILENAME": "$document_root$fastcgi_script_name", + }, + want: Config{Index: "indexxpto-92123.php"}, + wantErr: true, + }, + { + name: "invalid configmap values key", + index: "indexxpto-92123.php", + configmapname: "default/fcgiconfig", + configmap: map[string]string{ + "REQUEST_METHOD$XPTO": "$request_method", + }, + want: Config{Index: "indexxpto-92123.php"}, + wantErr: true, + }, + { + name: "invalid configmap values val", + index: "indexxpto-92123.php", + configmapname: "default/fcgiconfig", + configmap: map[string]string{ + "REQUEST_METHOD_XPTO": "$request_method{test};a", + }, + want: Config{Index: "indexxpto-92123.php"}, + wantErr: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-index")] = tt.index + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = tt.configmapname + ing.SetAnnotations(data) + + m := &mockConfigMap{ + extraConfigMap: map[string]map[string]string{ + tt.configmapname: tt.configmap, + }, + } + + got, err := NewParser(m).Parse(ing) + if (err != nil) != tt.wantErr { + t.Errorf("fastcgi.Parse() error = %v, wantErr %v", err, tt.wantErr) + return + } + if !reflect.DeepEqual(got, tt.want) { + t.Errorf("fastcgi.Parse() = %v, want %v", got, tt.want) + } + }) + } +} diff --git a/internal/ingress/annotations/globalratelimit/main.go b/internal/ingress/annotations/globalratelimit/main.go index ea9fc4678..41f58fd57 100644 --- a/internal/ingress/annotations/globalratelimit/main.go +++ b/internal/ingress/annotations/globalratelimit/main.go @@ -22,8 +22,10 @@ import ( "time" networking "k8s.io/api/networking/v1" + "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/net" @@ -32,6 +34,46 @@ import ( const defaultKey = "$remote_addr" +const ( + globalRateLimitAnnotation = "global-rate-limit" + globalRateLimitWindowAnnotation = "global-rate-limit-window" + globalRateLimitKeyAnnotation = "global-rate-limit-key" + globalRateLimitIgnoredCidrsAnnotation = "global-rate-limit-ignored-cidrs" +) + +var globalRateLimitAnnotationConfig = parser.Annotation{ + Group: "ratelimit", + Annotations: parser.AnnotationFields{ + globalRateLimitAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation configures maximum allowed number of requests per window`, + }, + globalRateLimitWindowAnnotation: { + Validator: parser.ValidateDuration, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `Configures a time window (i.e 1m) that the limit is applied`, + }, + globalRateLimitKeyAnnotation: { + Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation Configures a key for counting the samples. Defaults to $remote_addr. + You can also combine multiple NGINX variables here, like ${remote_addr}-${http_x_api_client} which would mean the limit will be applied to + requests coming from the same API client (indicated by X-API-Client HTTP request header) with the same source IP address`, + }, + globalRateLimitIgnoredCidrsAnnotation: { + Validator: parser.ValidateCIDRs, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines a comma separated list of IPs and CIDRs to match client IP against. + When there's a match request is not considered for rate limiting.`, + }, + }, +} + // Config encapsulates all global rate limit attributes type Config struct { Namespace string `json:"namespace"` @@ -63,12 +105,16 @@ func (l *Config) Equal(r *Config) bool { } type globalratelimit struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new globalratelimit annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return globalratelimit{r} + return globalratelimit{ + r: r, + annotationConfig: globalRateLimitAnnotationConfig, + } } // Parse extracts globalratelimit annotations from the given ingress @@ -76,8 +122,16 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { config := &Config{} - limit, _ := parser.GetIntAnnotation("global-rate-limit", ing) - rawWindowSize, _ := parser.GetStringAnnotation("global-rate-limit-window", ing) + limit, err := parser.GetIntAnnotation(globalRateLimitAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsInvalidContent(err) { + return nil, err + } + rawWindowSize, err := parser.GetStringAnnotation(globalRateLimitWindowAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsValidationError(err) { + return config, ing_errors.LocationDenied{ + Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err), + } + } if limit == 0 || len(rawWindowSize) == 0 { return config, nil @@ -90,12 +144,18 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { } } - key, _ := parser.GetStringAnnotation("global-rate-limit-key", ing) + key, err := parser.GetStringAnnotation(globalRateLimitKeyAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + klog.Warningf("invalid %s, defaulting to %s", globalRateLimitKeyAnnotation, defaultKey) + } if len(key) == 0 { key = defaultKey } - rawIgnoredCIDRs, _ := parser.GetStringAnnotation("global-rate-limit-ignored-cidrs", ing) + rawIgnoredCIDRs, err := parser.GetStringAnnotation(globalRateLimitIgnoredCidrsAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsInvalidContent(err) { + return nil, err + } ignoredCIDRs, err := net.ParseCIDRs(rawIgnoredCIDRs) if err != nil { return nil, err @@ -109,3 +169,12 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { return config, nil } + +func (a globalratelimit) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a globalratelimit) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, globalRateLimitAnnotationConfig.Annotations) +} diff --git a/internal/ingress/annotations/globalratelimit/main_test.go b/internal/ingress/annotations/globalratelimit/main_test.go index 815d6cfff..5d7922666 100644 --- a/internal/ingress/annotations/globalratelimit/main_test.go +++ b/internal/ingress/annotations/globalratelimit/main_test.go @@ -149,6 +149,22 @@ func TestGlobalRateLimiting(t *testing.T) { }, nil, }, + { + "global-rate-limit-complex-key", + map[string]string{ + annRateLimit: "100", + annRateLimitWindow: "2m", + annRateLimitKey: "${http_x_api_user}${otherinfo}", + }, + &Config{ + Namespace: expectedUID, + Limit: 100, + WindowSize: 120, + Key: "${http_x_api_user}${otherinfo}", + IgnoredCIDRs: make([]string, 0), + }, + nil, + }, { "incorrect duration for window", map[string]string{ @@ -157,8 +173,8 @@ func TestGlobalRateLimiting(t *testing.T) { annRateLimitKey: "$http_x_api_user", }, &Config{}, - ing_errors.LocationDenied{ - Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: time: unknown unit \"mb\" in duration \"2mb\""), + ing_errors.ValidationError{ + Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: annotation nginx.ingress.kubernetes.io/global-rate-limit-window contains invalid value"), }, }, } @@ -168,7 +184,7 @@ func TestGlobalRateLimiting(t *testing.T) { i, actualErr := NewParser(mockBackend{}).Parse(ing) if (testCase.expectedErr == nil || actualErr == nil) && testCase.expectedErr != actualErr { - t.Errorf("expected error 'nil' but got '%v'", actualErr) + t.Errorf("%s expected error '%v' but got '%v'", testCase.title, testCase.expectedErr, actualErr) } else if testCase.expectedErr != nil && actualErr != nil && testCase.expectedErr.Error() != actualErr.Error() { t.Errorf("expected error '%v' but got '%v'", testCase.expectedErr, actualErr) diff --git a/internal/ingress/annotations/http2pushpreload/main.go b/internal/ingress/annotations/http2pushpreload/main.go index 27d3368f4..af9f90aa9 100644 --- a/internal/ingress/annotations/http2pushpreload/main.go +++ b/internal/ingress/annotations/http2pushpreload/main.go @@ -23,17 +23,46 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + http2PushPreloadAnnotation = "http2-push-preload" +) + +var http2PushPreloadAnnotations = parser.Annotation{ + Group: "http2", + Annotations: parser.AnnotationFields{ + http2PushPreloadAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `Enables automatic conversion of preload links specified in the “Link” response header fields into push requests`, + }, + }, +} + type http2PushPreload struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new http2PushPreload annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return http2PushPreload{r} + return http2PushPreload{ + r: r, + annotationConfig: http2PushPreloadAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to add http2 push preload to the server func (h2pp http2PushPreload) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetBoolAnnotation("http2-push-preload", ing) + return parser.GetBoolAnnotation(http2PushPreloadAnnotation, ing, h2pp.annotationConfig.Annotations) +} + +func (h2pp http2PushPreload) GetDocumentation() parser.AnnotationFields { + return h2pp.annotationConfig.Annotations +} + +func (a http2PushPreload) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, http2PushPreloadAnnotations.Annotations) } diff --git a/internal/ingress/annotations/http2pushpreload/main_test.go b/internal/ingress/annotations/http2pushpreload/main_test.go index bb98af93f..eb6e9111d 100644 --- a/internal/ingress/annotations/http2pushpreload/main_test.go +++ b/internal/ingress/annotations/http2pushpreload/main_test.go @@ -23,11 +23,12 @@ import ( networking "k8s.io/api/networking/v1" meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("http2-push-preload") + annotation := parser.GetAnnotationWithPrefix(http2PushPreloadAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { t.Fatalf("expected a parser.IngressAnnotation but returned nil") @@ -36,12 +37,14 @@ func TestParse(t *testing.T) { testCases := []struct { annotations map[string]string expected bool + expectErr bool }{ - {map[string]string{annotation: "true"}, true}, - {map[string]string{annotation: "1"}, true}, - {map[string]string{annotation: ""}, false}, - {map[string]string{}, false}, - {nil, false}, + {map[string]string{annotation: "true"}, true, false}, + {map[string]string{annotation: "1"}, true, false}, + {map[string]string{annotation: "xpto"}, false, true}, + {map[string]string{annotation: ""}, false, false}, + {map[string]string{}, false, false}, + {nil, false, false}, } ing := &networking.Ingress{ @@ -54,7 +57,10 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) + result, err := ap.Parse(ing) + if ((err != nil) != testCase.expectErr) && !errors.IsInvalidContent(err) && !errors.IsMissingAnnotations(err) { + t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations) + } if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } diff --git a/internal/ingress/annotations/ipwhitelist/main.go b/internal/ingress/annotations/ipallowlist/main.go similarity index 53% rename from internal/ingress/annotations/ipwhitelist/main.go rename to internal/ingress/annotations/ipallowlist/main.go index 63c049fef..d9d454c97 100644 --- a/internal/ingress/annotations/ipwhitelist/main.go +++ b/internal/ingress/annotations/ipallowlist/main.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package ipwhitelist +package ipallowlist import ( "fmt" @@ -30,6 +30,24 @@ import ( "k8s.io/ingress-nginx/pkg/util/sets" ) +const ( + ipWhitelistAnnotation = "whitelist-source-range" + ipAllowlistAnnotation = "allowlist-source-range" +) + +var allowlistAnnotations = parser.Annotation{ + Group: "acl", + Annotations: parser.AnnotationFields{ + ipAllowlistAnnotation: { + Validator: parser.ValidateCIDRs, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Failure on parsing this may cause undesired access + Documentation: `This annotation allows setting a list of IPs and networks allowed to access this Location`, + AnnotationAliases: []string{ipWhitelistAnnotation}, + }, + }, +} + // SourceRange returns the CIDR type SourceRange struct { CIDR []string `json:"cidr,omitempty"` @@ -47,36 +65,47 @@ func (sr1 *SourceRange) Equal(sr2 *SourceRange) bool { return sets.StringElementsMatch(sr1.CIDR, sr2.CIDR) } -type ipwhitelist struct { - r resolver.Resolver +type ipallowlist struct { + r resolver.Resolver + annotationConfig parser.Annotation } -// NewParser creates a new whitelist annotation parser +// NewParser creates a new ipallowlist annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return ipwhitelist{r} + return ipallowlist{ + r: r, + annotationConfig: allowlistAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress // rule used to limit access to certain client addresses or networks. // Multiple ranges can specified using commas as separator // e.g. `18.0.0.0/8,56.0.0.0/8` -func (a ipwhitelist) Parse(ing *networking.Ingress) (interface{}, error) { +func (a ipallowlist) Parse(ing *networking.Ingress) (interface{}, error) { defBackend := a.r.GetDefaultBackend() - defaultWhitelistSourceRange := make([]string, len(defBackend.WhitelistSourceRange)) - copy(defaultWhitelistSourceRange, defBackend.WhitelistSourceRange) - sort.Strings(defaultWhitelistSourceRange) + defaultAllowlistSourceRange := make([]string, len(defBackend.WhitelistSourceRange)) + copy(defaultAllowlistSourceRange, defBackend.WhitelistSourceRange) + sort.Strings(defaultAllowlistSourceRange) - val, err := parser.GetStringAnnotation("whitelist-source-range", ing) + val, err := parser.GetStringAnnotation(ipAllowlistAnnotation, ing, a.annotationConfig.Annotations) // A missing annotation is not a problem, just use the default - if err == ing_errors.ErrMissingAnnotations { - return &SourceRange{CIDR: defaultWhitelistSourceRange}, nil + if err != nil { + if err == ing_errors.ErrMissingAnnotations { + return &SourceRange{CIDR: defaultAllowlistSourceRange}, nil + } + + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ + Reason: err, + } + } values := strings.Split(val, ",") ipnets, ips, err := net.ParseIPNets(values...) if err != nil && len(ips) == 0 { - return &SourceRange{CIDR: defaultWhitelistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ Reason: fmt.Errorf("the annotation does not contain a valid IP address or network: %w", err), } } @@ -93,3 +122,12 @@ func (a ipwhitelist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{cidrs}, nil } + +func (a ipallowlist) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a ipallowlist) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, allowlistAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/ipwhitelist/main_test.go b/internal/ingress/annotations/ipallowlist/main_test.go similarity index 64% rename from internal/ingress/annotations/ipwhitelist/main_test.go rename to internal/ingress/annotations/ipallowlist/main_test.go index 5042bb200..b16b25a5b 100644 --- a/internal/ingress/annotations/ipwhitelist/main_test.go +++ b/internal/ingress/annotations/ipallowlist/main_test.go @@ -14,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package ipwhitelist +package ipallowlist import ( "testing" @@ -86,12 +86,12 @@ func TestParseAnnotations(t *testing.T) { "test parse a invalid net": { net: "ww", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ww", + errOut: "annotation nginx.ingress.kubernetes.io/allowlist-source-range contains invalid value", }, "test parse a empty net": { net: "", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ", + errOut: "the annotation nginx.ingress.kubernetes.io/allowlist-source-range does not contain a valid value ()", }, "test parse multiple valid cidr": { net: "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24", @@ -102,16 +102,16 @@ func TestParseAnnotations(t *testing.T) { for testName, test := range tests { data := map[string]string{} - data[parser.GetAnnotationWithPrefix("whitelist-source-range")] = test.net + data[parser.GetAnnotationWithPrefix(ipAllowlistAnnotation)] = test.net ing.SetAnnotations(data) p := NewParser(&resolver.Mock{}) i, err := p.Parse(ing) - if err != nil && !test.expectErr { - t.Errorf("%v:unexpected error: %v", testName, err) + if (err != nil) != test.expectErr { + t.Errorf("%s expected error: %t got error: %t err value: %s. %+v", testName, test.expectErr, err != nil, err, i) } - if test.expectErr { + if test.expectErr && err != nil { if err.Error() != test.errOut { - t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error()) + t.Errorf("expected error %s but got %s", test.errOut, err) } } if !test.expectErr { @@ -137,7 +137,7 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { } } -// Test that when we have a whitelist set on the Backend that is used when we +// Test that when we have a allowlist set on the Backend that is used when we // don't have the annotation func TestParseAnnotationsWithDefaultConfig(t *testing.T) { ing := buildIngress() @@ -158,12 +158,12 @@ func TestParseAnnotationsWithDefaultConfig(t *testing.T) { "test parse a invalid net": { net: "ww", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ww", + errOut: "annotation nginx.ingress.kubernetes.io/allowlist-source-range contains invalid value", }, "test parse a empty net": { net: "", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ", + errOut: "the annotation nginx.ingress.kubernetes.io/allowlist-source-range does not contain a valid value ()", }, "test parse multiple valid cidr": { net: "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24", @@ -174,16 +174,67 @@ func TestParseAnnotationsWithDefaultConfig(t *testing.T) { for testName, test := range tests { data := map[string]string{} - data[parser.GetAnnotationWithPrefix("whitelist-source-range")] = test.net + data[parser.GetAnnotationWithPrefix(ipAllowlistAnnotation)] = test.net ing.SetAnnotations(data) p := NewParser(mockBackend) i, err := p.Parse(ing) - if err != nil && !test.expectErr { - t.Errorf("%v:unexpected error: %v", testName, err) + if (err != nil) != test.expectErr { + t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i) } - if test.expectErr { + if test.expectErr && err != nil { if err.Error() != test.errOut { - t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error()) + t.Errorf("expected error %s but got %s", test.errOut, err) + } + } + if !test.expectErr { + sr, ok := i.(*SourceRange) + if !ok { + t.Errorf("%v:expected a SourceRange type", testName) + } + if !strsEquals(sr.CIDR, test.expectCidr) { + t.Errorf("%v:expected %v CIDR but %v returned", testName, test.expectCidr, sr.CIDR) + } + } + } +} + +// Test that when we have a whitelist set on the Backend that is used when we +// don't have the annotation +func TestLegacyAnnotation(t *testing.T) { + ing := buildIngress() + + mockBackend := mockBackend{} + + tests := map[string]struct { + net string + expectCidr []string + expectErr bool + errOut string + }{ + "test parse a valid net": { + net: "10.0.0.0/24", + expectCidr: []string{"10.0.0.0/24"}, + expectErr: false, + }, + "test parse multiple valid cidr": { + net: "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24", + expectCidr: []string{"1.1.1.1/32", "2.2.2.2/32", "3.3.3.0/24"}, + expectErr: false, + }, + } + + for testName, test := range tests { + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(ipWhitelistAnnotation)] = test.net + ing.SetAnnotations(data) + p := NewParser(mockBackend) + i, err := p.Parse(ing) + if (err != nil) != test.expectErr { + t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i) + } + if test.expectErr && err != nil { + if err.Error() != test.errOut { + t.Errorf("expected error %s but got %s", test.errOut, err) } } if !test.expectErr { diff --git a/internal/ingress/annotations/ipdenylist/main.go b/internal/ingress/annotations/ipdenylist/main.go index f6a0e10f1..f17ce079a 100644 --- a/internal/ingress/annotations/ipdenylist/main.go +++ b/internal/ingress/annotations/ipdenylist/main.go @@ -30,6 +30,22 @@ import ( "k8s.io/ingress-nginx/pkg/util/sets" ) +const ( + ipDenylistAnnotation = "denylist-source-range" +) + +var denylistAnnotations = parser.Annotation{ + Group: "acl", + Annotations: parser.AnnotationFields{ + ipDenylistAnnotation: { + Validator: parser.ValidateCIDRs, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Failure on parsing this may cause undesired access + Documentation: `This annotation allows setting a list of IPs and networks that should be blocked to access this Location`, + }, + }, +} + // SourceRange returns the CIDR type SourceRange struct { CIDR []string `json:"cidr,omitempty"` @@ -48,12 +64,16 @@ func (sr1 *SourceRange) Equal(sr2 *SourceRange) bool { } type ipdenylist struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new denylist annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return ipdenylist{r} + return ipdenylist{ + r: r, + annotationConfig: denylistAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -67,10 +87,16 @@ func (a ipdenylist) Parse(ing *networking.Ingress) (interface{}, error) { copy(defaultDenylistSourceRange, defBackend.DenylistSourceRange) sort.Strings(defaultDenylistSourceRange) - val, err := parser.GetStringAnnotation("denylist-source-range", ing) - // A missing annotation is not a problem, just use the default - if err == ing_errors.ErrMissingAnnotations { - return &SourceRange{CIDR: defaultDenylistSourceRange}, nil + val, err := parser.GetStringAnnotation(ipDenylistAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + if err == ing_errors.ErrMissingAnnotations { + return &SourceRange{CIDR: defaultDenylistSourceRange}, nil + } + + return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDenied{ + Reason: err, + } + } values := strings.Split(val, ",") @@ -93,3 +119,12 @@ func (a ipdenylist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{cidrs}, nil } + +func (a ipdenylist) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a ipdenylist) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, denylistAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/ipdenylist/main_test.go b/internal/ingress/annotations/ipdenylist/main_test.go index eb69aa520..ebd81179a 100644 --- a/internal/ingress/annotations/ipdenylist/main_test.go +++ b/internal/ingress/annotations/ipdenylist/main_test.go @@ -86,17 +86,17 @@ func TestParseAnnotations(t *testing.T) { "test parse a invalid net": { net: "ww", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ww", + errOut: "annotation nginx.ingress.kubernetes.io/denylist-source-range contains invalid value", }, "test parse a empty net": { net: "", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ", + errOut: "the annotation nginx.ingress.kubernetes.io/denylist-source-range does not contain a valid value ()", }, "test parse a malicious escaped string": { net: `10.0.0.0/8"rm /tmp",11.0.0.0/8`, expectErr: true, - errOut: `the annotation does not contain a valid IP address or network: invalid CIDR address: 10.0.0.0/8"rm /tmp"`, + errOut: `annotation nginx.ingress.kubernetes.io/denylist-source-range contains invalid value`, }, "test parse multiple valid cidr": { net: "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24", @@ -107,16 +107,16 @@ func TestParseAnnotations(t *testing.T) { for testName, test := range tests { data := map[string]string{} - data[parser.GetAnnotationWithPrefix("denylist-source-range")] = test.net + data[parser.GetAnnotationWithPrefix(ipDenylistAnnotation)] = test.net ing.SetAnnotations(data) p := NewParser(&resolver.Mock{}) i, err := p.Parse(ing) - if err != nil && !test.expectErr { - t.Errorf("%v:unexpected error: %v", testName, err) + if (err != nil) != test.expectErr { + t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i) } - if test.expectErr { + if test.expectErr && err != nil { if err.Error() != test.errOut { - t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error()) + t.Errorf("expected error %s but got %s", test.errOut, err) } } if !test.expectErr { @@ -163,12 +163,12 @@ func TestParseAnnotationsWithDefaultConfig(t *testing.T) { "test parse a invalid net": { net: "ww", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ww", + errOut: "annotation nginx.ingress.kubernetes.io/denylist-source-range contains invalid value", }, "test parse a empty net": { net: "", expectErr: true, - errOut: "the annotation does not contain a valid IP address or network: invalid CIDR address: ", + errOut: "the annotation nginx.ingress.kubernetes.io/denylist-source-range does not contain a valid value ()", }, "test parse multiple valid cidr": { net: "2.2.2.2/32,1.1.1.1/32,3.3.3.0/24", @@ -179,16 +179,16 @@ func TestParseAnnotationsWithDefaultConfig(t *testing.T) { for testName, test := range tests { data := map[string]string{} - data[parser.GetAnnotationWithPrefix("denylist-source-range")] = test.net + data[parser.GetAnnotationWithPrefix(ipDenylistAnnotation)] = test.net ing.SetAnnotations(data) p := NewParser(mockBackend) i, err := p.Parse(ing) - if err != nil && !test.expectErr { - t.Errorf("%v:unexpected error: %v", testName, err) + if (err != nil) != test.expectErr { + t.Errorf("expected error: %t got error: %t err value: %s. %+v", test.expectErr, err != nil, err, i) } - if test.expectErr { + if test.expectErr && err != nil { if err.Error() != test.errOut { - t.Errorf("%v:expected error: %v but %v return", testName, test.errOut, err.Error()) + t.Errorf("expected error %s but got %s", test.errOut, err) } } if !test.expectErr { diff --git a/internal/ingress/annotations/loadbalancing/main.go b/internal/ingress/annotations/loadbalancing/main.go index a8b4335e6..ee89d2c1b 100644 --- a/internal/ingress/annotations/loadbalancing/main.go +++ b/internal/ingress/annotations/loadbalancing/main.go @@ -23,18 +23,52 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -type loadbalancing struct { - r resolver.Resolver +// LB Alghorithms are defined in https://github.com/kubernetes/ingress-nginx/blob/d3e75b056f77be54e01bdb18675f1bb46caece31/rootfs/etc/nginx/lua/balancer.lua#L28 + +const ( + loadBalanceAlghoritmAnnotation = "load-balance" +) + +var loadBalanceAlghoritms = []string{"round_robin", "chash", "chashsubset", "sticky_balanced", "sticky_persistent", "ewma"} + +var loadBalanceAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + loadBalanceAlghoritmAnnotation: { + Validator: parser.ValidateOptions(loadBalanceAlghoritms, true, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows setting the load balancing alghorithm that should be used. If none is specified, defaults to + the default configured by Ingress admin, otherwise to round_robin`, + }, + }, } -// NewParser creates a new CORS annotation parser +type loadbalancing struct { + r resolver.Resolver + annotationConfig parser.Annotation +} + +// NewParser creates a new Load Balancer annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return loadbalancing{r} + return loadbalancing{ + r: r, + annotationConfig: loadBalanceAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to indicate if the location/s contains a fragment of // configuration to be included inside the paths of the rules func (a loadbalancing) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("load-balance", ing) + return parser.GetStringAnnotation(loadBalanceAlghoritmAnnotation, ing, a.annotationConfig.Annotations) +} + +func (a loadbalancing) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a loadbalancing) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, loadBalanceAnnotations.Annotations) } diff --git a/internal/ingress/annotations/loadbalancing/main_test.go b/internal/ingress/annotations/loadbalancing/main_test.go index e2be5c0ae..b0442c37f 100644 --- a/internal/ingress/annotations/loadbalancing/main_test.go +++ b/internal/ingress/annotations/loadbalancing/main_test.go @@ -38,7 +38,8 @@ func TestParse(t *testing.T) { annotations map[string]string expected string }{ - {map[string]string{annotation: "ip_hash"}, "ip_hash"}, + {map[string]string{annotation: "ewma"}, "ewma"}, + {map[string]string{annotation: "ip_hash"}, ""}, // This is invalid and should not return anything {map[string]string{}, ""}, {nil, ""}, } diff --git a/internal/ingress/annotations/log/main.go b/internal/ingress/annotations/log/main.go index 4bc76dcf7..ec08292a9 100644 --- a/internal/ingress/annotations/log/main.go +++ b/internal/ingress/annotations/log/main.go @@ -23,8 +23,32 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + enableAccessLogAnnotation = "enable-access-log" + enableRewriteLogAnnotation = "enable-rewrite-log" +) + +var logAnnotations = parser.Annotation{ + Group: "log", + Annotations: parser.AnnotationFields{ + enableAccessLogAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This configuration setting allows you to control if this location should generate an access_log`, + }, + enableRewriteLogAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This configuration setting allows you to control if this location should generate logs from the rewrite feature usage`, + }, + }, +} + type log struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the configuration to be used in the Ingress @@ -48,7 +72,10 @@ func (bd1 *Config) Equal(bd2 *Config) bool { // NewParser creates a new log annotations parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return log{r} + return log{ + r: r, + annotationConfig: logAnnotations, + } } // Parse parses the annotations contained in the ingress @@ -57,15 +84,24 @@ func (l log) Parse(ing *networking.Ingress) (interface{}, error) { var err error config := &Config{} - config.Access, err = parser.GetBoolAnnotation("enable-access-log", ing) + config.Access, err = parser.GetBoolAnnotation(enableAccessLogAnnotation, ing, l.annotationConfig.Annotations) if err != nil { config.Access = true } - config.Rewrite, err = parser.GetBoolAnnotation("enable-rewrite-log", ing) + config.Rewrite, err = parser.GetBoolAnnotation(enableRewriteLogAnnotation, ing, l.annotationConfig.Annotations) if err != nil { config.Rewrite = false } return config, nil } + +func (l log) GetDocumentation() parser.AnnotationFields { + return l.annotationConfig.Annotations +} + +func (a log) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, logAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/log/main_test.go b/internal/ingress/annotations/log/main_test.go index c4632b010..df97c2e5b 100644 --- a/internal/ingress/annotations/log/main_test.go +++ b/internal/ingress/annotations/log/main_test.go @@ -73,7 +73,7 @@ func TestIngressAccessLogConfig(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-access-log")] = "false" + data[parser.GetAnnotationWithPrefix(enableAccessLogAnnotation)] = "false" ing.SetAnnotations(data) log, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -91,7 +91,7 @@ func TestIngressRewriteLogConfig(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-rewrite-log")] = "true" + data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "true" ing.SetAnnotations(data) log, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -104,3 +104,21 @@ func TestIngressRewriteLogConfig(t *testing.T) { t.Errorf("expected rewrite log to be enabled but it is disabled") } } + +func TestInvalidBoolConfig(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "blo" + ing.SetAnnotations(data) + + log, _ := NewParser(&resolver.Mock{}).Parse(ing) + nginxLogs, ok := log.(*Config) + if !ok { + t.Errorf("expected a Config type") + } + + if !nginxLogs.Access { + t.Errorf("expected access log to be enabled due to invalid config, but it is disabled") + } +} diff --git a/internal/ingress/annotations/mirror/main.go b/internal/ingress/annotations/mirror/main.go index 9cb1b0ede..2d417dece 100644 --- a/internal/ingress/annotations/mirror/main.go +++ b/internal/ingress/annotations/mirror/main.go @@ -18,13 +18,50 @@ package mirror import ( "fmt" + "regexp" "strings" networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" + "k8s.io/klog/v2" ) +const ( + mirrorRequestBodyAnnotation = "mirror-request-body" + mirrorTargetAnnotation = "mirror-target" + mirrorHostAnnotation = "mirror-host" +) + +var ( + OnOffRegex = regexp.MustCompile(`^(on|off)$`) +) + +var mirrorAnnotation = parser.Annotation{ + Group: "mirror", + Annotations: parser.AnnotationFields{ + mirrorRequestBodyAnnotation: { + Validator: parser.ValidateRegex(*OnOffRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if the request-body should be sent to the mirror backend. Can be 'on' or 'off'`, + }, + mirrorTargetAnnotation: { + Validator: parser.ValidateServerName, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation enables a request to be mirrored to a mirror backend.`, + }, + mirrorHostAnnotation: { + Validator: parser.ValidateServerName, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation defines if a specific Host header should be set for mirrored request.`, + }, + }, +} + // Config returns the mirror to use in a given location type Config struct { Source string `json:"source"` @@ -63,12 +100,16 @@ func (m1 *Config) Equal(m2 *Config) bool { } type mirror struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new mirror configuration annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return mirror{r} + return mirror{ + r: r, + annotationConfig: mirrorAnnotation, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -79,19 +120,29 @@ func (a mirror) Parse(ing *networking.Ingress) (interface{}, error) { } var err error - config.RequestBody, err = parser.GetStringAnnotation("mirror-request-body", ing) + config.RequestBody, err = parser.GetStringAnnotation(mirrorRequestBodyAnnotation, ing, a.annotationConfig.Annotations) if err != nil || config.RequestBody != "off" { + if errors.IsValidationError(err) { + klog.Warningf("annotation %s contains invalid value", mirrorRequestBodyAnnotation) + } config.RequestBody = "on" } - config.Target, err = parser.GetStringAnnotation("mirror-target", ing) + config.Target, err = parser.GetStringAnnotation(mirrorTargetAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - config.Target = "" - config.Source = "" + if errors.IsValidationError(err) { + klog.Warningf("annotation %s contains invalid value, defaulting", mirrorTargetAnnotation) + } else { + config.Target = "" + config.Source = "" + } } - config.Host, err = parser.GetStringAnnotation("mirror-host", ing) + config.Host, err = parser.GetStringAnnotation(mirrorHostAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("annotation %s contains invalid value, defaulting", mirrorHostAnnotation) + } if config.Target != "" { target := strings.Split(config.Target, "$") @@ -106,3 +157,12 @@ func (a mirror) Parse(ing *networking.Ingress) (interface{}, error) { return config, nil } + +func (a mirror) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a mirror) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, mirrorAnnotation.Annotations) +} diff --git a/internal/ingress/annotations/mirror/main_test.go b/internal/ingress/annotations/mirror/main_test.go index add90d768..1f6b44d61 100644 --- a/internal/ingress/annotations/mirror/main_test.go +++ b/internal/ingress/annotations/mirror/main_test.go @@ -94,13 +94,13 @@ func TestParse(t *testing.T) { Source: ngxURI, RequestBody: "on", Target: "http://some.test.env.com", - Host: "someInvalidParm.%^&*()_=!@#'\"", + Host: "some.test.env.com", }}, {map[string]string{backendURL: "http://some.test.env.com", host: "_sbrubles-i\"@xpto:12345"}, &Config{ Source: ngxURI, RequestBody: "on", Target: "http://some.test.env.com", - Host: "_sbrubles-i\"@xpto:12345", + Host: "some.test.env.com", }}, } @@ -115,9 +115,12 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) + result, err := ap.Parse(ing) + if err != nil { + t.Errorf(err.Error()) + } if !reflect.DeepEqual(result, testCase.expected) { - t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) + t.Errorf("expected %+v but returned %+v, annotations: %s", testCase.expected, result, testCase.annotations) } } } diff --git a/internal/ingress/annotations/modsecurity/main.go b/internal/ingress/annotations/modsecurity/main.go index c53739441..5a9aaa729 100644 --- a/internal/ingress/annotations/modsecurity/main.go +++ b/internal/ingress/annotations/modsecurity/main.go @@ -19,9 +19,48 @@ package modsecurity import ( networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" + "k8s.io/klog/v2" ) +const ( + modsecEnableAnnotation = "enable-modsecurity" + modsecEnableOwaspCoreAnnotation = "enable-owasp-core-rules" + modesecTransactionIdAnnotation = "modsecurity-transaction-id" + modsecSnippetAnnotation = "modsecurity-snippet" +) + +var modsecurityAnnotation = parser.Annotation{ + Group: "modsecurity", + Annotations: parser.AnnotationFields{ + modsecEnableAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables ModSecurity`, + }, + modsecEnableOwaspCoreAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables the OWASP Core Rule Set`, + }, + modesecTransactionIdAnnotation: { + Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation enables passing an NGINX variable to ModSecurity.`, + }, + modsecSnippetAnnotation: { + Validator: parser.ValidateNull, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskCritical, + Documentation: `This annotation enables adding a specific snippet configuration for ModSecurity`, + }, + }, +} + // Config contains ModSecurity Configuration items type Config struct { Enable bool `json:"enable-modsecurity"` @@ -60,11 +99,15 @@ func (modsec1 *Config) Equal(modsec2 *Config) bool { // NewParser creates a new ModSecurity annotation parser func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { - return modSecurity{resolver} + return modSecurity{ + r: resolver, + annotationConfig: modsecurityAnnotation, + } } type modSecurity struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Parse parses the annotations contained in the ingress @@ -74,26 +117,44 @@ func (a modSecurity) Parse(ing *networking.Ingress) (interface{}, error) { config := &Config{} config.EnableSet = true - config.Enable, err = parser.GetBoolAnnotation("enable-modsecurity", ing) + config.Enable, err = parser.GetBoolAnnotation(modsecEnableAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsInvalidContent(err) { + klog.Warningf("annotation %s contains invalid directive, defaulting to false", modsecEnableAnnotation) + } config.Enable = false config.EnableSet = false } - config.OWASPRules, err = parser.GetBoolAnnotation("enable-owasp-core-rules", ing) + config.OWASPRules, err = parser.GetBoolAnnotation(modsecEnableOwaspCoreAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsInvalidContent(err) { + klog.Warningf("annotation %s contains invalid directive, defaulting to false", modsecEnableOwaspCoreAnnotation) + } config.OWASPRules = false } - config.TransactionID, err = parser.GetStringAnnotation("modsecurity-transaction-id", ing) + config.TransactionID, err = parser.GetStringAnnotation(modesecTransactionIdAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsInvalidContent(err) { + klog.Warningf("annotation %s contains invalid directive, defaulting", modesecTransactionIdAnnotation) + } config.TransactionID = "" } - config.Snippet, err = parser.GetStringAnnotation("modsecurity-snippet", ing) + config.Snippet, err = parser.GetStringAnnotation("modsecurity-snippet", ing, a.annotationConfig.Annotations) if err != nil { config.Snippet = "" } return config, nil } + +func (a modSecurity) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a modSecurity) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, modsecurityAnnotation.Annotations) +} diff --git a/internal/ingress/annotations/opentelemetry/main.go b/internal/ingress/annotations/opentelemetry/main.go index 7dd292322..a029087da 100644 --- a/internal/ingress/annotations/opentelemetry/main.go +++ b/internal/ingress/annotations/opentelemetry/main.go @@ -17,14 +17,51 @@ limitations under the License. package opentelemetry import ( + "regexp" + networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + enableOpenTelemetryAnnotation = "enable-opentelemetry" + otelTrustSpanAnnotation = "opentelemetry-trust-incoming-span" + otelOperationNameAnnotation = "opentelemetry-operation-name" +) + +var regexOperationName = regexp.MustCompile(`^[A-Za-z0-9_\-]*$`) + +var otelAnnotations = parser.Annotation{ + Group: "opentelemetry", + Annotations: parser.AnnotationFields{ + enableOpenTelemetryAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if Open Telemetry collector should be enable for this location. OpenTelemetry should + already be configured by Ingress administrator`, + }, + otelTrustSpanAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables or disables using spans from incoming requests as parent for created ones`, + }, + otelOperationNameAnnotation: { + Validator: parser.ValidateRegex(*regexOperationName, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines what operation name should be added to the span`, + }, + }, +} + type opentelemetry struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the configuration to be used in the Ingress @@ -64,13 +101,16 @@ func (bd1 *Config) Equal(bd2 *Config) bool { // NewParser creates a new serviceUpstream annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return opentelemetry{r} + return opentelemetry{ + r: r, + annotationConfig: otelAnnotations, + } } // Parse parses the annotations to look for opentelemetry configurations func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) { cfg := Config{} - enabled, err := parser.GetBoolAnnotation("enable-opentelemetry", ing) + enabled, err := parser.GetBoolAnnotation(enableOpenTelemetryAnnotation, ing, c.annotationConfig.Annotations) if err != nil { return &cfg, nil } @@ -80,10 +120,13 @@ func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) { return &cfg, nil } - trustEnabled, err := parser.GetBoolAnnotation("opentelemetry-trust-incoming-span", ing) + trustEnabled, err := parser.GetBoolAnnotation(otelTrustSpanAnnotation, ing, c.annotationConfig.Annotations) if err != nil { - operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing) + operationName, err := parser.GetStringAnnotation(otelOperationNameAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + return nil, err + } return &cfg, nil } cfg.OperationName = operationName @@ -92,10 +135,22 @@ func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) { cfg.TrustSet = true cfg.TrustEnabled = trustEnabled - operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing) + operationName, err := parser.GetStringAnnotation(otelOperationNameAnnotation, ing, c.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + return nil, err + } return &cfg, nil } cfg.OperationName = operationName return &cfg, nil } + +func (c opentelemetry) GetDocumentation() parser.AnnotationFields { + return c.annotationConfig.Annotations +} + +func (a opentelemetry) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, otelAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/opentelemetry/main_test.go b/internal/ingress/annotations/opentelemetry/main_test.go index 619108fa6..c78ebc8b3 100644 --- a/internal/ingress/annotations/opentelemetry/main_test.go +++ b/internal/ingress/annotations/opentelemetry/main_test.go @@ -73,7 +73,7 @@ func TestIngressAnnotationOpentelemetrySetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -100,7 +100,7 @@ func TestIngressAnnotationOpentelemetrySetFalse(t *testing.T) { // Test with explicitly set to false data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "false" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "false" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -123,12 +123,15 @@ func TestIngressAnnotationOpentelemetryTrustSetTrue(t *testing.T) { data := map[string]string{} opName := "foo-op" - data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "true" - data[parser.GetAnnotationWithPrefix("opentelemetry-trust-incoming-span")] = "true" - data[parser.GetAnnotationWithPrefix("opentelemetry-operation-name")] = opName + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(otelTrustSpanAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Fatal(err) + } openTelemetry, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -155,6 +158,21 @@ func TestIngressAnnotationOpentelemetryTrustSetTrue(t *testing.T) { } } +func TestIngressAnnotationOpentelemetryWithBadOpName(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + opName := "fooxpto_123$la;" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName + ing.SetAnnotations(data) + + _, err := NewParser(&resolver.Mock{}).Parse(ing) + if err == nil { + t.Fatalf("This operation should return an error but no error was returned") + } +} + func TestIngressAnnotationOpentelemetryUnset(t *testing.T) { ing := buildIngress() diff --git a/internal/ingress/annotations/opentracing/main.go b/internal/ingress/annotations/opentracing/main.go index 17ba7eb9f..7c8671f9d 100644 --- a/internal/ingress/annotations/opentracing/main.go +++ b/internal/ingress/annotations/opentracing/main.go @@ -23,8 +23,33 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + enableOpentracingAnnotation = "enable-opentracing" + opentracingTrustSpanAnnotation = "opentracing-trust-incoming-span" +) + +var opentracingAnnotations = parser.Annotation{ + Group: "opentracing", + Annotations: parser.AnnotationFields{ + enableOpentracingAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if Opentracing collector should be enable for this location. Opentracing should + already be configured by Ingress administrator`, + }, + opentracingTrustSpanAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables or disables using spans from incoming requests as parent for created ones`, + }, + }, +} + type opentracing struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the configuration to be used in the Ingress @@ -58,19 +83,31 @@ func (bd1 *Config) Equal(bd2 *Config) bool { // NewParser creates a new serviceUpstream annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return opentracing{r} + return opentracing{ + r: r, + annotationConfig: opentracingAnnotations, + } } func (s opentracing) Parse(ing *networking.Ingress) (interface{}, error) { - enabled, err := parser.GetBoolAnnotation("enable-opentracing", ing) + enabled, err := parser.GetBoolAnnotation(enableOpentracingAnnotation, ing, s.annotationConfig.Annotations) if err != nil { return &Config{}, nil } - trustSpan, err := parser.GetBoolAnnotation("opentracing-trust-incoming-span", ing) + trustSpan, err := parser.GetBoolAnnotation(opentracingTrustSpanAnnotation, ing, s.annotationConfig.Annotations) if err != nil { return &Config{Set: true, Enabled: enabled}, nil } return &Config{Set: true, Enabled: enabled, TrustSet: true, TrustEnabled: trustSpan}, nil } + +func (s opentracing) GetDocumentation() parser.AnnotationFields { + return s.annotationConfig.Annotations +} + +func (a opentracing) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, opentracingAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/opentracing/main_test.go b/internal/ingress/annotations/opentracing/main_test.go index 7bd9d31ff..b7b62ac9d 100644 --- a/internal/ingress/annotations/opentracing/main_test.go +++ b/internal/ingress/annotations/opentracing/main_test.go @@ -73,7 +73,7 @@ func TestIngressAnnotationOpentracingSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-opentracing")] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -92,7 +92,7 @@ func TestIngressAnnotationOpentracingSetFalse(t *testing.T) { // Test with explicitly set to false data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-opentracing")] = "false" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "false" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -110,8 +110,8 @@ func TestIngressAnnotationOpentracingTrustSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-opentracing")] = "true" - data[parser.GetAnnotationWithPrefix("opentracing-trust-incoming-span")] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(opentracingTrustSpanAnnotation)] = "true" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) diff --git a/internal/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go index 107a278b0..951970e27 100644 --- a/internal/ingress/annotations/parser/main.go +++ b/internal/ingress/annotations/parser/main.go @@ -29,20 +29,79 @@ import ( ) // DefaultAnnotationsPrefix defines the common prefix used in the nginx ingress controller -const DefaultAnnotationsPrefix = "nginx.ingress.kubernetes.io" +const ( + DefaultAnnotationsPrefix = "nginx.ingress.kubernetes.io" + DefaultEnableAnnotationValidation = true +) var ( // AnnotationsPrefix is the mutable attribute that the controller explicitly refers to AnnotationsPrefix = DefaultAnnotationsPrefix + // Enable is the mutable attribute for enabling or disabling the validation functions + EnableAnnotationValidation = DefaultEnableAnnotationValidation ) +// AnnotationGroup defines the group that this annotation may belong +// eg.: Security, Snippets, Rewrite, etc +type AnnotationGroup string + +// AnnotationScope defines which scope this annotation applies. May be to the whole +// ingress, per location, etc +type AnnotationScope string + +var ( + AnnotationScopeLocation AnnotationScope = "location" + AnnotationScopeIngress AnnotationScope = "ingress" +) + +// AnnotationRisk is a subset of risk that an annotation may represent. +// Based on the Risk, the admin will be able to allow or disallow users to set it +// on their ingress objects +type AnnotationRisk int + +type AnnotationFields map[string]AnnotationConfig + +// AnnotationConfig defines the configuration that a single annotation field +// has, with the Validator and the documentation of this field. +type AnnotationConfig struct { + // Validator defines a function to validate the annotation value + Validator AnnotationValidator + // Documentation defines a user facing documentation for this annotation. This + // field will be used to auto generate documentations + Documentation string + // Risk defines a risk of this annotation being exposed to the user. Annotations + // with bool fields, or to set timeout are usually low risk. Annotations that allows + // string input without a limited set of options may represent a high risk + Risk AnnotationRisk + + // Scope defines which scope this annotation applies, may be to location, to an Ingress object, etc + Scope AnnotationScope + + // AnnotationAliases defines other names this annotation may have. + AnnotationAliases []string +} + +// Annotation defines an annotation feature an Ingress may have. +// It should contain the internal resolver, and all the annotations +// with configs and Validators that should be used for each Annotation +type Annotation struct { + // Annotations contains all the annotations that belong to this feature + Annotations AnnotationFields + // Group defines which annotation group this feature belongs to + Group AnnotationGroup +} + // IngressAnnotation has a method to parse annotations located in Ingress type IngressAnnotation interface { Parse(ing *networking.Ingress) (interface{}, error) + GetDocumentation() AnnotationFields + Validate(anns map[string]string) error } type ingAnnotations map[string]string +// TODO: We already parse all of this on checkAnnotation and can just do a parse over the +// value func (a ingAnnotations) parseBool(name string) (bool, error) { val, ok := a[name] if ok { @@ -92,21 +151,9 @@ func (a ingAnnotations) parseFloat32(name string) (float32, error) { return 0, errors.ErrMissingAnnotations } -func checkAnnotation(name string, ing *networking.Ingress) error { - if ing == nil || len(ing.GetAnnotations()) == 0 { - return errors.ErrMissingAnnotations - } - if name == "" { - return errors.ErrInvalidAnnotationName - } - - return nil -} - // GetBoolAnnotation extracts a boolean from an Ingress annotation -func GetBoolAnnotation(name string, ing *networking.Ingress) (bool, error) { - v := GetAnnotationWithPrefix(name) - err := checkAnnotation(v, ing) +func GetBoolAnnotation(name string, ing *networking.Ingress, fields AnnotationFields) (bool, error) { + v, err := checkAnnotation(name, ing, fields) if err != nil { return false, err } @@ -114,9 +161,8 @@ func GetBoolAnnotation(name string, ing *networking.Ingress) (bool, error) { } // GetStringAnnotation extracts a string from an Ingress annotation -func GetStringAnnotation(name string, ing *networking.Ingress) (string, error) { - v := GetAnnotationWithPrefix(name) - err := checkAnnotation(v, ing) +func GetStringAnnotation(name string, ing *networking.Ingress, fields AnnotationFields) (string, error) { + v, err := checkAnnotation(name, ing, fields) if err != nil { return "", err } @@ -125,9 +171,8 @@ func GetStringAnnotation(name string, ing *networking.Ingress) (string, error) { } // GetIntAnnotation extracts an int from an Ingress annotation -func GetIntAnnotation(name string, ing *networking.Ingress) (int, error) { - v := GetAnnotationWithPrefix(name) - err := checkAnnotation(v, ing) +func GetIntAnnotation(name string, ing *networking.Ingress, fields AnnotationFields) (int, error) { + v, err := checkAnnotation(name, ing, fields) if err != nil { return 0, err } @@ -135,9 +180,8 @@ func GetIntAnnotation(name string, ing *networking.Ingress) (int, error) { } // GetFloatAnnotation extracts a float32 from an Ingress annotation -func GetFloatAnnotation(name string, ing *networking.Ingress) (float32, error) { - v := GetAnnotationWithPrefix(name) - err := checkAnnotation(v, ing) +func GetFloatAnnotation(name string, ing *networking.Ingress, fields AnnotationFields) (float32, error) { + v, err := checkAnnotation(name, ing, fields) if err != nil { return 0, err } @@ -149,6 +193,23 @@ func GetAnnotationWithPrefix(suffix string) string { return fmt.Sprintf("%v/%v", AnnotationsPrefix, suffix) } +func TrimAnnotationPrefix(annotation string) string { + return strings.TrimPrefix(annotation, AnnotationsPrefix+"/") +} + +func StringRiskToRisk(risk string) AnnotationRisk { + switch strings.ToLower(risk) { + case "critical": + return AnnotationRiskCritical + case "high": + return AnnotationRiskHigh + case "medium": + return AnnotationRiskMedium + default: + return AnnotationRiskLow + } +} + func normalizeString(input string) string { trimmedContent := []string{} for _, line := range strings.Split(input, "\n") { diff --git a/internal/ingress/annotations/parser/main_test.go b/internal/ingress/annotations/parser/main_test.go index 318e024d3..beca49370 100644 --- a/internal/ingress/annotations/parser/main_test.go +++ b/internal/ingress/annotations/parser/main_test.go @@ -38,7 +38,7 @@ func buildIngress() *networking.Ingress { func TestGetBoolAnnotation(t *testing.T) { ing := buildIngress() - _, err := GetBoolAnnotation("", nil) + _, err := GetBoolAnnotation("", nil, nil) if err == nil { t.Errorf("expected error but retuned nil") } @@ -59,8 +59,8 @@ func TestGetBoolAnnotation(t *testing.T) { for _, test := range tests { data[GetAnnotationWithPrefix(test.field)] = test.value - - u, err := GetBoolAnnotation(test.field, ing) + ing.SetAnnotations(data) + u, err := GetBoolAnnotation(test.field, ing, nil) if test.expErr { if err == nil { t.Errorf("%v: expected error but retuned nil", test.name) @@ -68,7 +68,7 @@ func TestGetBoolAnnotation(t *testing.T) { continue } if u != test.exp { - t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.name, test.exp, u) + t.Errorf("%v: expected \"%v\" but \"%v\" was returned, %+v", test.name, test.exp, u, ing) } delete(data, test.field) @@ -78,7 +78,7 @@ func TestGetBoolAnnotation(t *testing.T) { func TestGetStringAnnotation(t *testing.T) { ing := buildIngress() - _, err := GetStringAnnotation("", nil) + _, err := GetStringAnnotation("", nil, nil) if err == nil { t.Errorf("expected error but none returned") } @@ -109,7 +109,7 @@ rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/serv for _, test := range tests { data[GetAnnotationWithPrefix(test.field)] = test.value - s, err := GetStringAnnotation(test.field, ing) + s, err := GetStringAnnotation(test.field, ing, nil) if test.expErr { if err == nil { t.Errorf("%v: expected error but none returned", test.name) @@ -133,7 +133,7 @@ rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/serv func TestGetFloatAnnotation(t *testing.T) { ing := buildIngress() - _, err := GetFloatAnnotation("", nil) + _, err := GetFloatAnnotation("", nil, nil) if err == nil { t.Errorf("expected error but retuned nil") } @@ -156,7 +156,7 @@ func TestGetFloatAnnotation(t *testing.T) { for _, test := range tests { data[GetAnnotationWithPrefix(test.field)] = test.value - s, err := GetFloatAnnotation(test.field, ing) + s, err := GetFloatAnnotation(test.field, ing, nil) if test.expErr { if err == nil { t.Errorf("%v: expected error but retuned nil", test.name) @@ -174,7 +174,7 @@ func TestGetFloatAnnotation(t *testing.T) { func TestGetIntAnnotation(t *testing.T) { ing := buildIngress() - _, err := GetIntAnnotation("", nil) + _, err := GetIntAnnotation("", nil, nil) if err == nil { t.Errorf("expected error but retuned nil") } @@ -196,7 +196,7 @@ func TestGetIntAnnotation(t *testing.T) { for _, test := range tests { data[GetAnnotationWithPrefix(test.field)] = test.value - s, err := GetIntAnnotation(test.field, ing) + s, err := GetIntAnnotation(test.field, ing, nil) if test.expErr { if err == nil { t.Errorf("%v: expected error but retuned nil", test.name) @@ -224,6 +224,7 @@ func TestStringToURL(t *testing.T) { }{ {"empty", "", "url scheme is empty", nil, true}, {"no scheme", "bar", "url scheme is empty", nil, true}, + {"invalid parse", "://lala.com", "://lala.com is not a valid URL: parse \"://lala.com\": missing protocol scheme", nil, true}, {"invalid host", "http://", "url host is empty", nil, true}, {"invalid host (multiple dots)", "http://foo..bar.com", "invalid url host", nil, true}, {"valid URL", validURL, "", validParsedURL, false}, diff --git a/internal/ingress/annotations/parser/validators.go b/internal/ingress/annotations/parser/validators.go new file mode 100644 index 000000000..e14b486eb --- /dev/null +++ b/internal/ingress/annotations/parser/validators.go @@ -0,0 +1,239 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package parser + +import ( + "errors" + "fmt" + "regexp" + "strconv" + "strings" + "time" + + networking "k8s.io/api/networking/v1" + machineryvalidation "k8s.io/apimachinery/pkg/api/validation" + ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" + "k8s.io/ingress-nginx/internal/net" + "k8s.io/klog/v2" +) + +type AnnotationValidator func(string) error + +const ( + AnnotationRiskLow AnnotationRisk = iota + AnnotationRiskMedium + AnnotationRiskHigh + AnnotationRiskCritical +) + +var ( + alphaNumericChars = `\-\.\_\~a-zA-Z0-9\/:` + extendedAlphaNumeric = alphaNumericChars + ", " + regexEnabledChars = regexp.QuoteMeta(`^$[](){}*+?|&=\`) + urlEnabledChars = regexp.QuoteMeta(`:?&=`) +) + +// IsValidRegex checks if the tested string can be used as a regex, but without any weird character. +// It includes regex characters for paths that may contain regexes +var IsValidRegex = regexp.MustCompile("^[/" + alphaNumericChars + regexEnabledChars + "]*$") + +// SizeRegex validates sizes understood by NGINX, like 1000, 100k, 1000M +var SizeRegex = regexp.MustCompile("^(?i)[0-9]+[bkmg]?$") + +// URLRegex is used to validate a URL but with only a specific set of characters: +// It is alphanumericChar + ":", "?", "&" +// A valid URL would be proto://something.com:port/something?arg=param +var ( + // URLIsValidRegex is used on full URLs, containing query strings (:, ? and &) + URLIsValidRegex = regexp.MustCompile("^[" + alphaNumericChars + urlEnabledChars + "]*$") + // BasicChars is alphanumeric and ".", "-", "_", "~" and ":", usually used on simple host:port/path composition. + // This combination can also be used on fields that may contain characters like / (as ns/name) + BasicCharsRegex = regexp.MustCompile("^[/" + alphaNumericChars + "]*$") + // ExtendedChars is alphanumeric and ".", "-", "_", "~" and ":" plus "," and spaces, usually used on simple host:port/path composition + ExtendedCharsRegex = regexp.MustCompile("^[/" + extendedAlphaNumeric + "]*$") + // CharsWithSpace is like basic chars, but includes the space character + CharsWithSpace = regexp.MustCompile("^[/" + alphaNumericChars + " ]*$") + // NGINXVariable allows entries with alphanumeric characters, -, _ and the special "$" + NGINXVariable = regexp.MustCompile(`^[A-Za-z0-9\-\_\$\{\}]*$`) + // RegexPathWithCapture allows entries that SHOULD start with "/" and may contain alphanumeric + capture + // character for regex based paths, like /something/$1/anything/$2 + RegexPathWithCapture = regexp.MustCompile(`^/[` + alphaNumericChars + `\/\$]*$`) + // HeadersVariable defines a regex that allows headers separated by comma + HeadersVariable = regexp.MustCompile(`^[A-Za-z0-9-_, ]*$`) + // URLWithNginxVariableRegex defines a url that can contain nginx variables. + // It is a risky operation + URLWithNginxVariableRegex = regexp.MustCompile("^[" + alphaNumericChars + urlEnabledChars + "$]*$") +) + +// ValidateArrayOfServerName validates if all fields on a Server name annotation are +// regexes. They can be *.something*, ~^www\d+\.example\.com$ but not fancy character +func ValidateArrayOfServerName(value string) error { + for _, fqdn := range strings.Split(value, ",") { + if err := ValidateServerName(fqdn); err != nil { + return err + } + } + return nil +} + +// ValidateServerName validates if the passed value is an acceptable server name. The server name +// can contain regex characters, as those are accepted values on nginx configuration +func ValidateServerName(value string) error { + value = strings.TrimSpace(value) + if !IsValidRegex.MatchString(value) { + return fmt.Errorf("value %s is invalid server name", value) + } + return nil +} + +// ValidateRegex receives a regex as an argument and uses it to validate +// the value of the field. +// Annotation can define if the spaces should be trimmed before validating the value +func ValidateRegex(regex regexp.Regexp, removeSpace bool) AnnotationValidator { + return func(s string) error { + if removeSpace { + s = strings.ReplaceAll(s, " ", "") + } + if !regex.MatchString(s) { + return fmt.Errorf("value %s is invalid", s) + } + return nil + } +} + +// ValidateOptions receives an array of valid options that can be the value of annotation. +// If no valid option is found, it will return an error +func ValidateOptions(options []string, caseSensitive bool, trimSpace bool) AnnotationValidator { + return func(s string) error { + if trimSpace { + s = strings.TrimSpace(s) + } + if !caseSensitive { + s = strings.ToLower(s) + } + for _, option := range options { + if s == option { + return nil + } + } + return fmt.Errorf("value does not match any valid option") + } +} + +// ValidateBool validates if the specified value is a bool +func ValidateBool(value string) error { + _, err := strconv.ParseBool(value) + return err +} + +// ValidateInt validates if the specified value is an integer +func ValidateInt(value string) error { + _, err := strconv.Atoi(value) + return err +} + +// ValidateCIDRs validates if the specified value is an array of IPs and CIDRs +func ValidateCIDRs(value string) error { + _, err := net.ParseCIDRs(value) + return err +} + +// ValidateDuration validates if the specified value is a valid time +func ValidateDuration(value string) error { + _, err := time.ParseDuration(value) + return err +} + +// ValidateNull always return null values and should not be widely used. +// It is used on the "snippet" annotations, as it is up to the admin to allow its +// usage, knowing it can be critical! +func ValidateNull(value string) error { + return nil +} + +// ValidateServiceName validates if a provided service name is a valid string +func ValidateServiceName(value string) error { + errs := machineryvalidation.NameIsDNS1035Label(value, false) + if len(errs) != 0 { + return fmt.Errorf("annotation does not contain a valid service name: %+v", errs) + } + return nil +} + +// checkAnnotations will check each annotation for: +// 1 - Does it contain the internal validation and docs config? +// 2 - Does the ingress contains annotations? (validate null pointers) +// 3 - Does it contains a validator? Should it contain a validator (not containing is a bug!) +// 4 - Does the annotation contain aliases? So we should use if the alias is defined an the annotation not. +// 4 - Runs the validator on the value +// It will return the full annotation name if all is fine +func checkAnnotation(name string, ing *networking.Ingress, fields AnnotationFields) (string, error) { + var validateFunc AnnotationValidator + if fields != nil { + config, ok := fields[name] + if !ok { + return "", fmt.Errorf("annotation does not contain a valid internal configuration, this is an Ingress Controller issue! Please raise an issue on github.com/kubernetes/ingress-nginx") + } + validateFunc = config.Validator + } + + if ing == nil || len(ing.GetAnnotations()) == 0 { + return "", ing_errors.ErrMissingAnnotations + } + + annotationFullName := GetAnnotationWithPrefix(name) + if annotationFullName == "" { + return "", ing_errors.ErrInvalidAnnotationName + } + + annotationValue := ing.GetAnnotations()[annotationFullName] + if fields != nil { + if validateFunc == nil { + return "", fmt.Errorf("annotation does not contain a validator. This is an ingress-controller bug. Please open an issue") + } + if annotationValue == "" { + for _, annotationAlias := range fields[name].AnnotationAliases { + tempAnnotationFullName := GetAnnotationWithPrefix(annotationAlias) + if aliasVal := ing.GetAnnotations()[tempAnnotationFullName]; aliasVal != "" { + annotationValue = aliasVal + annotationFullName = tempAnnotationFullName + break + } + } + } + // We don't run validation against empty values + if EnableAnnotationValidation && annotationValue != "" { + if err := validateFunc(annotationValue); err != nil { + klog.Warningf("validation error on ingress %s/%s: annotation %s contains invalid value %s", ing.GetNamespace(), ing.GetName(), name, annotationValue) + return "", ing_errors.NewValidationError(annotationFullName) + } + } + } + + return annotationFullName, nil +} + +func CheckAnnotationRisk(annotations map[string]string, maxrisk AnnotationRisk, config AnnotationFields) error { + var err error + for annotation := range annotations { + annPure := TrimAnnotationPrefix(annotation) + if cfg, ok := config[annPure]; ok && cfg.Risk > maxrisk { + err = errors.Join(err, fmt.Errorf("annotation %s is too risky for environment", annotation)) + } + } + return err +} diff --git a/internal/ingress/annotations/parser/validators_test.go b/internal/ingress/annotations/parser/validators_test.go new file mode 100644 index 000000000..2aa6cec37 --- /dev/null +++ b/internal/ingress/annotations/parser/validators_test.go @@ -0,0 +1,310 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package parser + +import ( + "fmt" + "testing" + + networking "k8s.io/api/networking/v1" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func TestValidateArrayOfServerName(t *testing.T) { + tests := []struct { + name string + value string + wantErr bool + }{ + { + name: "should accept common name", + value: "something.com,anything.com", + wantErr: false, + }, + { + name: "should accept wildcard name", + value: "*.something.com,otherthing.com", + wantErr: false, + }, + { + name: "should allow names with spaces between array and some regexes", + value: `~^www\d+\.example\.com$,something.com`, + wantErr: false, + }, + { + name: "should allow names with regexes", + value: `http://some.test.env.com:2121/$someparam=1&$someotherparam=2`, + wantErr: false, + }, + { + name: "should allow names with wildcard in middle common name", + value: "*.so*mething.com,bla.com", + wantErr: false, + }, + { + name: "should deny names with weird characters", + value: "something.com,lolo;xpto.com,nothing.com", + wantErr: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if err := ValidateArrayOfServerName(tt.value); (err != nil) != tt.wantErr { + t.Errorf("ValidateArrayOfServerName() error = %v, wantErr %v", err, tt.wantErr) + } + }) + } +} + +func Test_checkAnnotation(t *testing.T) { + type args struct { + name string + ing *networking.Ingress + fields AnnotationFields + } + tests := []struct { + name string + args args + want string + wantErr bool + }{ + { + name: "null ingress should error", + want: "", + args: args{ + name: "some-random-annotation", + }, + wantErr: true, + }, + { + name: "not having a validator for a specific annotation is a bug", + want: "", + args: args{ + name: "some-new-invalid-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{ + Annotations: map[string]string{ + GetAnnotationWithPrefix("some-new-invalid-annotation"): "xpto", + }, + }, + }, + fields: AnnotationFields{ + "otherannotation": AnnotationConfig{ + Validator: func(value string) error { return nil }, + }, + }, + }, + wantErr: true, + }, + { + name: "annotationconfig found and no validation func defined on annotation is a bug", + want: "", + args: args{ + name: "some-new-invalid-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{ + Annotations: map[string]string{ + GetAnnotationWithPrefix("some-new-invalid-annotation"): "xpto", + }, + }, + }, + fields: AnnotationFields{ + "some-new-invalid-annotation": AnnotationConfig{}, + }, + }, + wantErr: true, + }, + { + name: "no annotation can turn into a null pointer and should fail", + want: "", + args: args{ + name: "some-new-invalid-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{}, + }, + fields: AnnotationFields{ + "some-new-invalid-annotation": AnnotationConfig{}, + }, + }, + wantErr: true, + }, + { + name: "no AnnotationField config should bypass validations", + want: GetAnnotationWithPrefix("some-valid-annotation"), + args: args{ + name: "some-valid-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{ + Annotations: map[string]string{ + GetAnnotationWithPrefix("some-valid-annotation"): "xpto", + }, + }, + }, + }, + wantErr: false, + }, + { + name: "annotation with invalid value should fail", + want: "", + args: args{ + name: "some-new-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{ + Annotations: map[string]string{ + GetAnnotationWithPrefix("some-new-annotation"): "xpto1", + }, + }, + }, + fields: AnnotationFields{ + "some-new-annotation": AnnotationConfig{ + Validator: func(value string) error { + if value != "xpto" { + return fmt.Errorf("this is an error") + } + return nil + }, + }, + }, + }, + wantErr: true, + }, + { + name: "annotation with valid value should pass", + want: GetAnnotationWithPrefix("some-other-annotation"), + args: args{ + name: "some-other-annotation", + ing: &networking.Ingress{ + ObjectMeta: v1.ObjectMeta{ + Annotations: map[string]string{ + GetAnnotationWithPrefix("some-other-annotation"): "xpto", + }, + }, + }, + fields: AnnotationFields{ + "some-other-annotation": AnnotationConfig{ + Validator: func(value string) error { + if value != "xpto" { + return fmt.Errorf("this is an error") + } + return nil + }, + }, + }, + }, + wantErr: false, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := checkAnnotation(tt.args.name, tt.args.ing, tt.args.fields) + if (err != nil) != tt.wantErr { + t.Errorf("checkAnnotation() error = %v, wantErr %v", err, tt.wantErr) + return + } + if got != tt.want { + t.Errorf("checkAnnotation() = %v, want %v", got, tt.want) + } + }) + } +} + +func TestCheckAnnotationRisk(t *testing.T) { + + tests := []struct { + name string + annotations map[string]string + maxrisk AnnotationRisk + config AnnotationFields + wantErr bool + }{ + { + name: "high risk should not be accepted with maximum medium", + maxrisk: AnnotationRiskMedium, + annotations: map[string]string{ + "nginx.ingress.kubernetes.io/bla": "blo", + "nginx.ingress.kubernetes.io/bli": "bl3", + }, + config: AnnotationFields{ + "bla": { + Risk: AnnotationRiskHigh, + }, + "bli": { + Risk: AnnotationRiskMedium, + }, + }, + wantErr: true, + }, + { + name: "high risk should be accepted with maximum critical", + maxrisk: AnnotationRiskCritical, + annotations: map[string]string{ + "nginx.ingress.kubernetes.io/bla": "blo", + "nginx.ingress.kubernetes.io/bli": "bl3", + }, + config: AnnotationFields{ + "bla": { + Risk: AnnotationRiskHigh, + }, + "bli": { + Risk: AnnotationRiskMedium, + }, + }, + wantErr: false, + }, + { + name: "low risk should be accepted with maximum low", + maxrisk: AnnotationRiskLow, + annotations: map[string]string{ + "nginx.ingress.kubernetes.io/bla": "blo", + "nginx.ingress.kubernetes.io/bli": "bl3", + }, + config: AnnotationFields{ + "bla": { + Risk: AnnotationRiskLow, + }, + "bli": { + Risk: AnnotationRiskLow, + }, + }, + wantErr: false, + }, + { + name: "critical risk should be accepted with maximum critical", + maxrisk: AnnotationRiskCritical, + annotations: map[string]string{ + "nginx.ingress.kubernetes.io/bla": "blo", + "nginx.ingress.kubernetes.io/bli": "bl3", + }, + config: AnnotationFields{ + "bla": { + Risk: AnnotationRiskCritical, + }, + "bli": { + Risk: AnnotationRiskCritical, + }, + }, + wantErr: false, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if err := CheckAnnotationRisk(tt.annotations, tt.maxrisk, tt.config); (err != nil) != tt.wantErr { + t.Errorf("CheckAnnotationRisk() error = %v, wantErr %v", err, tt.wantErr) + } + }) + } +} diff --git a/internal/ingress/annotations/portinredirect/main.go b/internal/ingress/annotations/portinredirect/main.go index 25d665558..7392ea3a6 100644 --- a/internal/ingress/annotations/portinredirect/main.go +++ b/internal/ingress/annotations/portinredirect/main.go @@ -23,22 +23,51 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + portsInRedirectAnnotation = "use-port-in-redirects" +) + +var portsInRedirectAnnotations = parser.Annotation{ + Group: "redirect", + Annotations: parser.AnnotationFields{ + portsInRedirectAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Enables or disables specifying the port in absolute redirects issued by nginx.`, + }, + }, +} + type portInRedirect struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new port in redirect annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return portInRedirect{r} + return portInRedirect{ + r: r, + annotationConfig: portsInRedirectAnnotations, + } } // Parse parses the annotations contained in the ingress // rule used to indicate if the redirects must func (a portInRedirect) Parse(ing *networking.Ingress) (interface{}, error) { - up, err := parser.GetBoolAnnotation("use-port-in-redirects", ing) + up, err := parser.GetBoolAnnotation(portsInRedirectAnnotation, ing, a.annotationConfig.Annotations) if err != nil { return a.r.GetDefaultBackend().UsePortInRedirects, nil } return up, nil } + +func (a portInRedirect) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a portInRedirect) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, portsInRedirectAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/portinredirect/main_test.go b/internal/ingress/annotations/portinredirect/main_test.go index 71afd4cdf..f5806e01a 100644 --- a/internal/ingress/annotations/portinredirect/main_test.go +++ b/internal/ingress/annotations/portinredirect/main_test.go @@ -17,7 +17,6 @@ limitations under the License. package portinredirect import ( - "fmt" "testing" api "k8s.io/api/core/v1" @@ -84,23 +83,24 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { func TestPortInRedirect(t *testing.T) { tests := []struct { title string - usePort *bool + usePort string def bool exp bool }{ - {"false - default false", newFalse(), false, false}, - {"false - default true", newFalse(), true, false}, - {"no annotation - default false", nil, false, false}, - {"no annotation - default true", nil, true, true}, - {"true - default true", newTrue(), true, true}, + {"false - default false", "false", false, false}, + {"false - default true", "false", true, false}, + {"no annotation - default false", "", false, false}, + {"no annotation - default false", "not-a-bool", false, false}, + {"no annotation - default true", "", true, true}, + {"true - default true", "true", true, true}, } for _, test := range tests { ing := buildIngress() data := map[string]string{} - if test.usePort != nil { - data[parser.GetAnnotationWithPrefix("use-port-in-redirects")] = fmt.Sprintf("%v", *test.usePort) + if test.usePort != "" { + data[parser.GetAnnotationWithPrefix(portsInRedirectAnnotation)] = test.usePort } ing.SetAnnotations(data) @@ -118,13 +118,3 @@ func TestPortInRedirect(t *testing.T) { } } } - -func newTrue() *bool { - b := true - return &b -} - -func newFalse() *bool { - b := false - return &b -} diff --git a/internal/ingress/annotations/proxy/main.go b/internal/ingress/annotations/proxy/main.go index 3a89b8855..a2d10ca90 100644 --- a/internal/ingress/annotations/proxy/main.go +++ b/internal/ingress/annotations/proxy/main.go @@ -17,12 +17,150 @@ limitations under the License. package proxy import ( + "regexp" + networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + proxyConnectTimeoutAnnotation = "proxy-connect-timeout" + proxySendTimeoutAnnotation = "proxy-send-timeout" + proxyReadTimeoutAnnotation = "proxy-read-timeout" + proxyBuffersNumberAnnotation = "proxy-buffers-number" + proxyBufferSizeAnnotation = "proxy-buffer-size" + proxyCookiePathAnnotation = "proxy-cookie-path" + proxyCookieDomainAnnotation = "proxy-cookie-domain" + proxyBodySizeAnnotation = "proxy-body-size" + proxyNextUpstreamAnnotation = "proxy-next-upstream" + proxyNextUpstreamTimeoutAnnotation = "proxy-next-upstream-timeout" + proxyNextUpstreamTriesAnnotation = "proxy-next-upstream-tries" + proxyRequestBufferingAnnotation = "proxy-request-buffering" + proxyRedirectFromAnnotation = "proxy-redirect-from" + proxyRedirectToAnnotation = "proxy-redirect-to" + proxyBufferingAnnotation = "proxy-buffering" + proxyHTTPVersionAnnotation = "proxy-http-version" + proxyMaxTempFileSizeAnnotation = "proxy-max-temp-file-size" +) + +var ( + validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) +) + +var proxyAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + proxyConnectTimeoutAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows setting the timeout in seconds of the connect operation to the backend.`, + }, + proxySendTimeoutAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows setting the timeout in seconds of the send operation to the backend.`, + }, + proxyReadTimeoutAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation allows setting the timeout in seconds of the read operation to the backend.`, + }, + proxyBuffersNumberAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation sets the number of the buffers in proxy_buffers used for reading the first part of the response received from the proxied server. + By default proxy buffers number is set as 4`, + }, + proxyBufferSizeAnnotation: { + Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation sets the size of the buffer proxy_buffer_size used for reading the first part of the response received from the proxied server. + By default proxy buffer size is set as "4k".`, + }, + proxyCookiePathAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation sets a text that should be changed in the path attribute of the "Set-Cookie" header fields of a proxied server response.`, + }, + proxyCookieDomainAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation ets a text that should be changed in the domain attribute of the "Set-Cookie" header fields of a proxied server response.`, + }, + proxyBodySizeAnnotation: { + Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows setting the maximum allowed size of a client request body.`, + }, + proxyNextUpstreamAnnotation: { + Validator: parser.ValidateRegex(*validUpstreamAnnotation, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines when the next upstream should be used. + This annotation reflect the directive https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream + and only the allowed values on upstream are allowed here.`, + }, + proxyNextUpstreamTimeoutAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation limits the time during which a request can be passed to the next server`, + }, + proxyNextUpstreamTriesAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation limits the number of possible tries for passing a request to the next server`, + }, + proxyRequestBufferingAnnotation: { + Validator: parser.ValidateOptions([]string{"on", "off"}, true, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables or disables buffering of a client request body.`, + }, + proxyRedirectFromAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, + }, + proxyRedirectToAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, + }, + proxyBufferingAnnotation: { + Validator: parser.ValidateOptions([]string{"on", "off"}, true, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables or disables buffering of responses from the proxied server. It can be "on" or "off"`, + }, + proxyHTTPVersionAnnotation: { + Validator: parser.ValidateOptions([]string{"1.0", "1.1"}, true, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotations sets the HTTP protocol version for proxying. Can be "1.0" or "1.1".`, + }, + proxyMaxTempFileSizeAnnotation: { + Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines the maximum size of a temporary file when buffering responses.`, + }, + }, +} + // Config returns the proxy timeout to use in the upstream server/s type Config struct { BodySize string `json:"bodySize"` @@ -109,12 +247,15 @@ func (l1 *Config) Equal(l2 *Config) bool { } type proxy struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new reverse proxy configuration annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return proxy{r} + return proxy{r: r, + annotationConfig: proxyAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -125,90 +266,99 @@ func (a proxy) Parse(ing *networking.Ingress) (interface{}, error) { var err error - config.ConnectTimeout, err = parser.GetIntAnnotation("proxy-connect-timeout", ing) + config.ConnectTimeout, err = parser.GetIntAnnotation(proxyConnectTimeoutAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ConnectTimeout = defBackend.ProxyConnectTimeout } - config.SendTimeout, err = parser.GetIntAnnotation("proxy-send-timeout", ing) + config.SendTimeout, err = parser.GetIntAnnotation(proxySendTimeoutAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.SendTimeout = defBackend.ProxySendTimeout } - config.ReadTimeout, err = parser.GetIntAnnotation("proxy-read-timeout", ing) + config.ReadTimeout, err = parser.GetIntAnnotation(proxyReadTimeoutAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ReadTimeout = defBackend.ProxyReadTimeout } - config.BuffersNumber, err = parser.GetIntAnnotation("proxy-buffers-number", ing) + config.BuffersNumber, err = parser.GetIntAnnotation(proxyBuffersNumberAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.BuffersNumber = defBackend.ProxyBuffersNumber } - config.BufferSize, err = parser.GetStringAnnotation("proxy-buffer-size", ing) + config.BufferSize, err = parser.GetStringAnnotation(proxyBufferSizeAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.BufferSize = defBackend.ProxyBufferSize } - config.CookiePath, err = parser.GetStringAnnotation("proxy-cookie-path", ing) + config.CookiePath, err = parser.GetStringAnnotation(proxyCookiePathAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.CookiePath = defBackend.ProxyCookiePath } - config.CookieDomain, err = parser.GetStringAnnotation("proxy-cookie-domain", ing) + config.CookieDomain, err = parser.GetStringAnnotation(proxyCookieDomainAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.CookieDomain = defBackend.ProxyCookieDomain } - config.BodySize, err = parser.GetStringAnnotation("proxy-body-size", ing) + config.BodySize, err = parser.GetStringAnnotation(proxyBodySizeAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.BodySize = defBackend.ProxyBodySize } - config.NextUpstream, err = parser.GetStringAnnotation("proxy-next-upstream", ing) + config.NextUpstream, err = parser.GetStringAnnotation(proxyNextUpstreamAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.NextUpstream = defBackend.ProxyNextUpstream } - config.NextUpstreamTimeout, err = parser.GetIntAnnotation("proxy-next-upstream-timeout", ing) + config.NextUpstreamTimeout, err = parser.GetIntAnnotation(proxyNextUpstreamTimeoutAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.NextUpstreamTimeout = defBackend.ProxyNextUpstreamTimeout } - config.NextUpstreamTries, err = parser.GetIntAnnotation("proxy-next-upstream-tries", ing) + config.NextUpstreamTries, err = parser.GetIntAnnotation(proxyNextUpstreamTriesAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.NextUpstreamTries = defBackend.ProxyNextUpstreamTries } - config.RequestBuffering, err = parser.GetStringAnnotation("proxy-request-buffering", ing) + config.RequestBuffering, err = parser.GetStringAnnotation(proxyRequestBufferingAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.RequestBuffering = defBackend.ProxyRequestBuffering } - config.ProxyRedirectFrom, err = parser.GetStringAnnotation("proxy-redirect-from", ing) + config.ProxyRedirectFrom, err = parser.GetStringAnnotation(proxyRedirectFromAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ProxyRedirectFrom = defBackend.ProxyRedirectFrom } - config.ProxyRedirectTo, err = parser.GetStringAnnotation("proxy-redirect-to", ing) + config.ProxyRedirectTo, err = parser.GetStringAnnotation(proxyRedirectToAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ProxyRedirectTo = defBackend.ProxyRedirectTo } - config.ProxyBuffering, err = parser.GetStringAnnotation("proxy-buffering", ing) + config.ProxyBuffering, err = parser.GetStringAnnotation(proxyBufferingAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ProxyBuffering = defBackend.ProxyBuffering } - config.ProxyHTTPVersion, err = parser.GetStringAnnotation("proxy-http-version", ing) + config.ProxyHTTPVersion, err = parser.GetStringAnnotation(proxyHTTPVersionAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ProxyHTTPVersion = defBackend.ProxyHTTPVersion } - config.ProxyMaxTempFileSize, err = parser.GetStringAnnotation("proxy-max-temp-file-size", ing) + config.ProxyMaxTempFileSize, err = parser.GetStringAnnotation(proxyMaxTempFileSizeAnnotation, ing, a.annotationConfig.Annotations) if err != nil { config.ProxyMaxTempFileSize = defBackend.ProxyMaxTempFileSize } return config, nil } + +func (a proxy) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a proxy) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, proxyAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/proxy/main_test.go b/internal/ingress/annotations/proxy/main_test.go index e377ccb19..fa185551b 100644 --- a/internal/ingress/annotations/proxy/main_test.go +++ b/internal/ingress/annotations/proxy/main_test.go @@ -161,6 +161,74 @@ func TestProxy(t *testing.T) { } } +func TestProxyComplex(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("proxy-connect-timeout")] = "1" + data[parser.GetAnnotationWithPrefix("proxy-send-timeout")] = "2" + data[parser.GetAnnotationWithPrefix("proxy-read-timeout")] = "3" + data[parser.GetAnnotationWithPrefix("proxy-buffers-number")] = "8" + data[parser.GetAnnotationWithPrefix("proxy-buffer-size")] = "1k" + data[parser.GetAnnotationWithPrefix("proxy-body-size")] = "2k" + data[parser.GetAnnotationWithPrefix("proxy-next-upstream")] = "error http_502" + data[parser.GetAnnotationWithPrefix("proxy-next-upstream-timeout")] = "5" + data[parser.GetAnnotationWithPrefix("proxy-next-upstream-tries")] = "3" + data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-buffering")] = "on" + data[parser.GetAnnotationWithPrefix("proxy-http-version")] = "1.0" + data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = "128k" + ing.SetAnnotations(data) + + i, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Fatalf("unexpected error parsing a valid") + } + p, ok := i.(*Config) + if !ok { + t.Fatalf("expected a Config type") + } + if p.ConnectTimeout != 1 { + t.Errorf("expected 1 as connect-timeout but returned %v", p.ConnectTimeout) + } + if p.SendTimeout != 2 { + t.Errorf("expected 2 as send-timeout but returned %v", p.SendTimeout) + } + if p.ReadTimeout != 3 { + t.Errorf("expected 3 as read-timeout but returned %v", p.ReadTimeout) + } + if p.BuffersNumber != 8 { + t.Errorf("expected 8 as proxy-buffers-number but returned %v", p.BuffersNumber) + } + if p.BufferSize != "1k" { + t.Errorf("expected 1k as buffer-size but returned %v", p.BufferSize) + } + if p.BodySize != "2k" { + t.Errorf("expected 2k as body-size but returned %v", p.BodySize) + } + if p.NextUpstream != "error http_502" { + t.Errorf("expected off as next-upstream but returned %v", p.NextUpstream) + } + if p.NextUpstreamTimeout != 5 { + t.Errorf("expected 5 as next-upstream-timeout but returned %v", p.NextUpstreamTimeout) + } + if p.NextUpstreamTries != 3 { + t.Errorf("expected 3 as next-upstream-tries but returned %v", p.NextUpstreamTries) + } + if p.RequestBuffering != "off" { + t.Errorf("expected off as request-buffering but returned %v", p.RequestBuffering) + } + if p.ProxyBuffering != "on" { + t.Errorf("expected on as proxy-buffering but returned %v", p.ProxyBuffering) + } + if p.ProxyHTTPVersion != "1.0" { + t.Errorf("expected 1.0 as proxy-http-version but returned %v", p.ProxyHTTPVersion) + } + if p.ProxyMaxTempFileSize != "128k" { + t.Errorf("expected 128k as proxy-max-temp-file-size but returned %v", p.ProxyMaxTempFileSize) + } +} + func TestProxyWithNoAnnotation(t *testing.T) { ing := buildIngress() diff --git a/internal/ingress/annotations/proxyssl/main.go b/internal/ingress/annotations/proxyssl/main.go index 22f49b3eb..40ee18aa0 100644 --- a/internal/ingress/annotations/proxyssl/main.go +++ b/internal/ingress/annotations/proxyssl/main.go @@ -24,9 +24,11 @@ import ( networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/k8s" + "k8s.io/klog/v2" ) const ( @@ -39,9 +41,73 @@ const ( var ( proxySSLOnOffRegex = regexp.MustCompile(`^(on|off)$`) - proxySSLProtocolRegex = regexp.MustCompile(`^(SSLv2|SSLv3|TLSv1|TLSv1\.1|TLSv1\.2|TLSv1\.3)$`) + proxySSLProtocolRegex = regexp.MustCompile(`^(SSLv2|SSLv3|TLSv1|TLSv1\.1|TLSv1\.2|TLSv1\.3| )*$`) + proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+\:\_\-\!]*$`) ) +const ( + proxySSLSecretAnnotation = "proxy-ssl-secret" + proxySSLCiphersAnnotation = "proxy-ssl-ciphers" + proxySSLProtocolsAnnotation = "proxy-ssl-protocols" + proxySSLNameAnnotation = "proxy-ssl-name" + proxySSLVerifyAnnotation = "proxy-ssl-verify" + proxySSLVerifyDepthAnnotation = "proxy-ssl-verify-depth" + proxySSLServerNameAnnotation = "proxy-ssl-server-name" +) + +var proxySSLAnnotation = parser.Annotation{ + Group: "proxy", + Annotations: parser.AnnotationFields{ + proxySSLSecretAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation specifies a Secret with the certificate tls.crt, key tls.key in PEM format used for authentication to a proxied HTTPS server. + It should also contain trusted CA certificates ca.crt in PEM format used to verify the certificate of the proxied HTTPS server. + This annotation expects the Secret name in the form "namespace/secretName" + Just secrets on the same namespace of the ingress can be used.`, + }, + proxySSLCiphersAnnotation: { + Validator: parser.ValidateRegex(*proxySSLCiphersRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation Specifies the enabled ciphers for requests to a proxied HTTPS server. + The ciphers are specified in the format understood by the OpenSSL library.`, + }, + proxySSLProtocolsAnnotation: { + Validator: parser.ValidateRegex(*proxySSLProtocolRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables the specified protocols for requests to a proxied HTTPS server.`, + }, + proxySSLNameAnnotation: { + Validator: parser.ValidateServerName, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskHigh, + Documentation: `This annotation allows to set proxy_ssl_name. This allows overriding the server name used to verify the certificate of the proxied HTTPS server. + This value is also passed through SNI when a connection is established to the proxied HTTPS server.`, + }, + proxySSLVerifyAnnotation: { + Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables or disables verification of the proxied HTTPS server certificate. (default: off)`, + }, + proxySSLVerifyDepthAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation Sets the verification depth in the proxied HTTPS server certificates chain. (default: 1).`, + }, + proxySSLServerNameAnnotation: { + Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server.`, + }, + }, +} + // Config contains the AuthSSLCert used for mutual authentication // and the configured VerifyDepth type Config struct { @@ -85,11 +151,14 @@ func (pssl1 *Config) Equal(pssl2 *Config) bool { // NewParser creates a new TLS authentication annotation parser func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { - return proxySSL{resolver} + return proxySSL{ + r: resolver, + annotationConfig: proxySSLAnnotation} } type proxySSL struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } func sortProtocols(protocols string) string { @@ -120,16 +189,22 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { var err error config := &Config{} - proxysslsecret, err := parser.GetStringAnnotation("proxy-ssl-secret", ing) + proxysslsecret, err := parser.GetStringAnnotation(proxySSLSecretAnnotation, ing, p.annotationConfig.Annotations) if err != nil { return &Config{}, err } - _, _, err = k8s.ParseNameNS(proxysslsecret) + ns, _, err := k8s.ParseNameNS(proxysslsecret) if err != nil { return &Config{}, ing_errors.NewLocationDenied(err.Error()) } + secCfg := p.r.GetSecurityConfiguration() + // We don't accept different namespaces for secrets. + if !secCfg.AllowCrossNamespaceResources && ns != ing.Namespace { + return &Config{}, ing_errors.NewLocationDenied("cross namespace secrets are not supported") + } + proxyCert, err := p.r.GetAuthCertificate(proxysslsecret) if err != nil { e := fmt.Errorf("error obtaining certificate: %w", err) @@ -137,37 +212,55 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { } config.AuthSSLCert = *proxyCert - config.Ciphers, err = parser.GetStringAnnotation("proxy-ssl-ciphers", ing) + config.Ciphers, err = parser.GetStringAnnotation(proxySSLCiphersAnnotation, ing, p.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("invalid value passed to proxy-ssl-ciphers, defaulting to %s", defaultProxySSLCiphers) + } config.Ciphers = defaultProxySSLCiphers } - config.Protocols, err = parser.GetStringAnnotation("proxy-ssl-protocols", ing) + config.Protocols, err = parser.GetStringAnnotation(proxySSLProtocolsAnnotation, ing, p.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("invalid value passed to proxy-ssl-protocols, defaulting to %s", defaultProxySSLProtocols) + } config.Protocols = defaultProxySSLProtocols } else { config.Protocols = sortProtocols(config.Protocols) } - config.ProxySSLName, err = parser.GetStringAnnotation("proxy-ssl-name", ing) + config.ProxySSLName, err = parser.GetStringAnnotation(proxySSLNameAnnotation, ing, p.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("invalid value passed to proxy-ssl-name, defaulting to empty") + } config.ProxySSLName = "" } - config.Verify, err = parser.GetStringAnnotation("proxy-ssl-verify", ing) + config.Verify, err = parser.GetStringAnnotation(proxySSLVerifyAnnotation, ing, p.annotationConfig.Annotations) if err != nil || !proxySSLOnOffRegex.MatchString(config.Verify) { config.Verify = defaultProxySSLVerify } - config.VerifyDepth, err = parser.GetIntAnnotation("proxy-ssl-verify-depth", ing) + config.VerifyDepth, err = parser.GetIntAnnotation(proxySSLVerifyDepthAnnotation, ing, p.annotationConfig.Annotations) if err != nil || config.VerifyDepth == 0 { config.VerifyDepth = defaultProxySSLVerifyDepth } - config.ProxySSLServerName, err = parser.GetStringAnnotation("proxy-ssl-server-name", ing) + config.ProxySSLServerName, err = parser.GetStringAnnotation(proxySSLServerNameAnnotation, ing, p.annotationConfig.Annotations) if err != nil || !proxySSLOnOffRegex.MatchString(config.ProxySSLServerName) { config.ProxySSLServerName = defaultProxySSLServerName } return config, nil } + +func (p proxySSL) GetDocumentation() parser.AnnotationFields { + return p.annotationConfig.Annotations +} + +func (a proxySSL) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, proxySSLAnnotation.Annotations) +} diff --git a/internal/ingress/annotations/proxyssl/main_test.go b/internal/ingress/annotations/proxyssl/main_test.go index 29949796c..edd65343e 100644 --- a/internal/ingress/annotations/proxyssl/main_test.go +++ b/internal/ingress/annotations/proxyssl/main_test.go @@ -93,7 +93,7 @@ func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("proxy-ssl-secret")] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = "default/demo-secret" data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = "HIGH:-SHA" data[parser.GetAnnotationWithPrefix("proxy-ssl-name")] = "$host" data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv1.3 SSLv2 TLSv1 TLSv1.2" diff --git a/internal/ingress/annotations/ratelimit/main.go b/internal/ingress/annotations/ratelimit/main.go index 84a5f10f0..39161a2c0 100644 --- a/internal/ingress/annotations/ratelimit/main.go +++ b/internal/ingress/annotations/ratelimit/main.go @@ -24,6 +24,7 @@ import ( networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/net" "k8s.io/ingress-nginx/pkg/util/sets" @@ -58,7 +59,7 @@ type Config struct { ID string `json:"id"` - Whitelist []string `json:"whitelist"` + Allowlist []string `json:"allowlist"` } // Equal tests for equality between two RateLimit types @@ -90,11 +91,11 @@ func (rt1 *Config) Equal(rt2 *Config) bool { if rt1.Name != rt2.Name { return false } - if len(rt1.Whitelist) != len(rt2.Whitelist) { + if len(rt1.Allowlist) != len(rt2.Allowlist) { return false } - return sets.StringElementsMatch(rt1.Whitelist, rt2.Whitelist) + return sets.StringElementsMatch(rt1.Allowlist, rt2.Allowlist) } // Zone returns information about the NGINX rate limit (limit_req_zone) @@ -131,43 +132,121 @@ func (z1 *Zone) Equal(z2 *Zone) bool { return true } +const ( + limitRateAnnotation = "limit-rate" + limitRateAfterAnnotation = "limit-rate-after" + limitRateRPMAnnotation = "limit-rpm" + limitRateRPSAnnotation = "limit-rps" + limitRateConnectionsAnnotation = "limit-connections" + limitRateBurstMultiplierAnnotation = "limit-burst-multiplier" + limitWhitelistAnnotation = "limit-whitelist" // This annotation is an alias for limit-allowlist + limitAllowlistAnnotation = "limit-allowlist" +) + +var rateLimitAnnotations = parser.Annotation{ + Group: "rate-limit", + Annotations: parser.AnnotationFields{ + limitRateAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Limits the rate of response transmission to a client. The rate is specified in bytes per second. + The zero value disables rate limiting. The limit is set per a request, and so if a client simultaneously opens two connections, the overall rate will be twice as much as the specified limit. + References: https://nginx.org/en/docs/http/ngx_http_core_module.html#limit_rate`, + }, + limitRateAfterAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Sets the initial amount after which the further transmission of a response to a client will be rate limited.`, + }, + limitRateRPMAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Requests per minute that will be allowed.`, + }, + limitRateRPSAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Requests per second that will be allowed.`, + }, + limitRateConnectionsAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Number of connections that will be allowed`, + }, + limitRateBurstMultiplierAnnotation: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `Burst multiplier for a limit-rate enabled location.`, + }, + limitAllowlistAnnotation: { + Validator: parser.ValidateCIDRs, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `List of CIDR/IP addresses that will not be rate-limited.`, + AnnotationAliases: []string{limitWhitelistAnnotation}, + }, + }, +} + type ratelimit struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new ratelimit annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return ratelimit{r} + return ratelimit{ + r: r, + annotationConfig: rateLimitAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress // rule used to rewrite the defined paths func (a ratelimit) Parse(ing *networking.Ingress) (interface{}, error) { defBackend := a.r.GetDefaultBackend() - lr, err := parser.GetIntAnnotation("limit-rate", ing) + lr, err := parser.GetIntAnnotation(limitRateAnnotation, ing, a.annotationConfig.Annotations) if err != nil { lr = defBackend.LimitRate } - lra, err := parser.GetIntAnnotation("limit-rate-after", ing) + lra, err := parser.GetIntAnnotation(limitRateAfterAnnotation, ing, a.annotationConfig.Annotations) if err != nil { lra = defBackend.LimitRateAfter } - rpm, _ := parser.GetIntAnnotation("limit-rpm", ing) - rps, _ := parser.GetIntAnnotation("limit-rps", ing) - conn, _ := parser.GetIntAnnotation("limit-connections", ing) - burstMultiplier, err := parser.GetIntAnnotation("limit-burst-multiplier", ing) + rpm, err := parser.GetIntAnnotation(limitRateRPMAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsValidationError(err) { + return nil, err + } + rps, err := parser.GetIntAnnotation(limitRateRPSAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsValidationError(err) { + return nil, err + } + conn, err := parser.GetIntAnnotation(limitRateConnectionsAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsValidationError(err) { + return nil, err + } + burstMultiplier, err := parser.GetIntAnnotation(limitRateBurstMultiplierAnnotation, ing, a.annotationConfig.Annotations) if err != nil { burstMultiplier = defBurst } - val, _ := parser.GetStringAnnotation("limit-whitelist", ing) - - cidrs, err := net.ParseCIDRs(val) - if err != nil { + val, err := parser.GetStringAnnotation(limitAllowlistAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && errors.IsValidationError(err) { return nil, err } + cidrs, errCidr := net.ParseCIDRs(val) + if errCidr != nil { + return nil, errCidr + } + if rpm == 0 && rps == 0 && conn == 0 { return &Config{ Connections: Zone{}, @@ -203,7 +282,7 @@ func (a ratelimit) Parse(ing *networking.Ingress) (interface{}, error) { LimitRateAfter: lra, Name: zoneName, ID: encode(zoneName), - Whitelist: cidrs, + Allowlist: cidrs, }, nil } @@ -211,3 +290,12 @@ func encode(s string) string { str := base64.URLEncoding.EncodeToString([]byte(s)) return strings.Replace(str, "=", "", -1) } + +func (a ratelimit) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a ratelimit) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, rateLimitAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/ratelimit/main_test.go b/internal/ingress/annotations/ratelimit/main_test.go index 9f101cc3b..d3a2cc0e9 100644 --- a/internal/ingress/annotations/ratelimit/main_test.go +++ b/internal/ingress/annotations/ratelimit/main_test.go @@ -25,6 +25,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/defaults" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) @@ -85,8 +86,8 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { func TestWithoutAnnotations(t *testing.T) { ing := buildIngress() _, err := NewParser(mockBackend{}).Parse(ing) - if err != nil { - t.Error("unexpected error with ingress without annotations") + if err != nil && !errors.IsMissingAnnotations(err) { + t.Errorf("unexpected error with ingress without annotations: %s", err) } } @@ -94,22 +95,22 @@ func TestRateLimiting(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("limit-connections")] = "0" - data[parser.GetAnnotationWithPrefix("limit-rps")] = "0" - data[parser.GetAnnotationWithPrefix("limit-rpm")] = "0" + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "0" + data[parser.GetAnnotationWithPrefix(limitRateRPSAnnotation)] = "0" + data[parser.GetAnnotationWithPrefix(limitRateRPMAnnotation)] = "0" ing.SetAnnotations(data) _, err := NewParser(mockBackend{}).Parse(ing) if err != nil { - t.Errorf("unexpected error with invalid limits (0)") + t.Errorf("unexpected error with invalid limits (0): %s", err) } data = map[string]string{} - data[parser.GetAnnotationWithPrefix("limit-connections")] = "5" - data[parser.GetAnnotationWithPrefix("limit-rps")] = "100" - data[parser.GetAnnotationWithPrefix("limit-rpm")] = "10" - data[parser.GetAnnotationWithPrefix("limit-rate-after")] = "100" - data[parser.GetAnnotationWithPrefix("limit-rate")] = "10" + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "5" + data[parser.GetAnnotationWithPrefix(limitRateRPSAnnotation)] = "100" + data[parser.GetAnnotationWithPrefix(limitRateRPMAnnotation)] = "10" + data[parser.GetAnnotationWithPrefix(limitRateAfterAnnotation)] = "100" + data[parser.GetAnnotationWithPrefix(limitRateAnnotation)] = "10" ing.SetAnnotations(data) @@ -147,12 +148,12 @@ func TestRateLimiting(t *testing.T) { } data = map[string]string{} - data[parser.GetAnnotationWithPrefix("limit-connections")] = "5" - data[parser.GetAnnotationWithPrefix("limit-rps")] = "100" - data[parser.GetAnnotationWithPrefix("limit-rpm")] = "10" - data[parser.GetAnnotationWithPrefix("limit-rate-after")] = "100" - data[parser.GetAnnotationWithPrefix("limit-rate")] = "10" - data[parser.GetAnnotationWithPrefix("limit-burst-multiplier")] = "3" + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "5" + data[parser.GetAnnotationWithPrefix(limitRateRPSAnnotation)] = "100" + data[parser.GetAnnotationWithPrefix(limitRateRPMAnnotation)] = "10" + data[parser.GetAnnotationWithPrefix(limitRateAfterAnnotation)] = "100" + data[parser.GetAnnotationWithPrefix(limitRateAnnotation)] = "10" + data[parser.GetAnnotationWithPrefix(limitRateBurstMultiplierAnnotation)] = "3" ing.SetAnnotations(data) @@ -189,3 +190,61 @@ func TestRateLimiting(t *testing.T) { t.Errorf("expected 10 in limit by limitrate but %v was returned", rateLimit.LimitRate) } } + +func TestAnnotationCIDR(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "5" + data[parser.GetAnnotationWithPrefix(limitAllowlistAnnotation)] = "192.168.0.5, 192.168.50.32/24" + ing.SetAnnotations(data) + + i, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + + rateLimit, ok := i.(*Config) + if !ok { + t.Errorf("expected a RateLimit type") + } + if len(rateLimit.Allowlist) != 2 { + t.Errorf("expected 2 cidrs in limit by ip but %v was returned", len(rateLimit.Allowlist)) + } + + data = map[string]string{} + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "5" + data[parser.GetAnnotationWithPrefix(limitWhitelistAnnotation)] = "192.168.0.5, 192.168.50.32/24, 10.10.10.1" + ing.SetAnnotations(data) + + i, err = NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + rateLimit, ok = i.(*Config) + if !ok { + t.Errorf("expected a RateLimit type") + } + if len(rateLimit.Allowlist) != 3 { + t.Errorf("expected 3 cidrs in limit by ip but %v was returned", len(rateLimit.Allowlist)) + } + + // Parent annotation surpasses any alias + data = map[string]string{} + data[parser.GetAnnotationWithPrefix(limitRateConnectionsAnnotation)] = "5" + data[parser.GetAnnotationWithPrefix(limitWhitelistAnnotation)] = "192.168.0.5, 192.168.50.32/24, 10.10.10.1" + data[parser.GetAnnotationWithPrefix(limitAllowlistAnnotation)] = "192.168.0.9" + ing.SetAnnotations(data) + + i, err = NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + rateLimit, ok = i.(*Config) + if !ok { + t.Errorf("expected a RateLimit type") + } + if len(rateLimit.Allowlist) != 1 { + t.Errorf("expected 1 cidrs in limit by ip but %v was returned", len(rateLimit.Allowlist)) + } +} diff --git a/internal/ingress/annotations/redirect/redirect.go b/internal/ingress/annotations/redirect/redirect.go index 11b08a4a2..89513c83c 100644 --- a/internal/ingress/annotations/redirect/redirect.go +++ b/internal/ingress/annotations/redirect/redirect.go @@ -37,13 +37,56 @@ type Config struct { FromToWWW bool `json:"fromToWWW"` } +const ( + fromToWWWRedirAnnotation = "from-to-www-redirect" + temporalRedirectAnnotation = "temporal-redirect" + permanentRedirectAnnotation = "permanent-redirect" + permanentRedirectAnnotationCode = "permanent-redirect-code" +) + +var redirectAnnotations = parser.Annotation{ + Group: "redirect", + Annotations: parser.AnnotationFields{ + fromToWWWRedirAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `In some scenarios is required to redirect from www.domain.com to domain.com or vice versa. To enable this feature use this annotation.`, + }, + temporalRedirectAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated + Documentation: `This annotation allows you to return a temporal redirect (Return Code 302) instead of sending data to the upstream. + For example setting this annotation to https://www.google.com would redirect everything to Google with a Return Code of 302 (Moved Temporarily).`, + }, + permanentRedirectAnnotation: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated + Documentation: `This annotation allows to return a permanent redirect (Return Code 301) instead of sending data to the upstream. + For example setting this annotation https://www.google.com would redirect everything to Google with a code 301`, + }, + permanentRedirectAnnotationCode: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options + Documentation: `This annotation allows you to modify the status code used for permanent redirects.`, + }, + }, +} + type redirect struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new redirect annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return redirect{r} + return redirect{ + r: r, + annotationConfig: redirectAnnotations, + } } // Parse parses the annotations contained in the ingress @@ -51,9 +94,12 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // If the Ingress contains both annotations the execution order is // temporal and then permanent func (r redirect) Parse(ing *networking.Ingress) (interface{}, error) { - r3w, _ := parser.GetBoolAnnotation("from-to-www-redirect", ing) + r3w, err := parser.GetBoolAnnotation(fromToWWWRedirAnnotation, ing, r.annotationConfig.Annotations) + if err != nil && !errors.IsMissingAnnotations(err) { + return nil, err + } - tr, err := parser.GetStringAnnotation("temporal-redirect", ing) + tr, err := parser.GetStringAnnotation(temporalRedirectAnnotation, ing, r.annotationConfig.Annotations) if err != nil && !errors.IsMissingAnnotations(err) { return nil, err } @@ -70,12 +116,12 @@ func (r redirect) Parse(ing *networking.Ingress) (interface{}, error) { }, nil } - pr, err := parser.GetStringAnnotation("permanent-redirect", ing) + pr, err := parser.GetStringAnnotation(permanentRedirectAnnotation, ing, r.annotationConfig.Annotations) if err != nil && !errors.IsMissingAnnotations(err) { return nil, err } - prc, err := parser.GetIntAnnotation("permanent-redirect-code", ing) + prc, err := parser.GetIntAnnotation(permanentRedirectAnnotationCode, ing, r.annotationConfig.Annotations) if err != nil && !errors.IsMissingAnnotations(err) { return nil, err } @@ -127,3 +173,12 @@ func isValidURL(s string) error { return nil } + +func (a redirect) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a redirect) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, redirectAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/redirect/redirect_test.go b/internal/ingress/annotations/redirect/redirect_test.go index b5a87a5d3..5a61f364d 100644 --- a/internal/ingress/annotations/redirect/redirect_test.go +++ b/internal/ingress/annotations/redirect/redirect_test.go @@ -43,7 +43,7 @@ func TestPermanentRedirectWithDefaultCode(t *testing.T) { ing := new(networking.Ingress) data := make(map[string]string, 1) - data[parser.GetAnnotationWithPrefix("permanent-redirect")] = defRedirectURL + data[parser.GetAnnotationWithPrefix(permanentRedirectAnnotation)] = defRedirectURL ing.SetAnnotations(data) i, err := rp.Parse(ing) @@ -81,8 +81,8 @@ func TestPermanentRedirectWithCustomCode(t *testing.T) { ing := new(networking.Ingress) data := make(map[string]string, 2) - data[parser.GetAnnotationWithPrefix("permanent-redirect")] = defRedirectURL - data[parser.GetAnnotationWithPrefix("permanent-redirect-code")] = strconv.Itoa(tc.input) + data[parser.GetAnnotationWithPrefix(permanentRedirectAnnotation)] = defRedirectURL + data[parser.GetAnnotationWithPrefix(permanentRedirectAnnotationCode)] = strconv.Itoa(tc.input) ing.SetAnnotations(data) i, err := rp.Parse(ing) @@ -112,8 +112,8 @@ func TestTemporalRedirect(t *testing.T) { ing := new(networking.Ingress) data := make(map[string]string, 1) - data[parser.GetAnnotationWithPrefix("from-to-www-redirect")] = "true" - data[parser.GetAnnotationWithPrefix("temporal-redirect")] = defRedirectURL + data[parser.GetAnnotationWithPrefix(fromToWWWRedirAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(temporalRedirectAnnotation)] = defRedirectURL ing.SetAnnotations(data) i, err := rp.Parse(ing) diff --git a/internal/ingress/annotations/rewrite/main.go b/internal/ingress/annotations/rewrite/main.go index f92d508dc..84dc93bf0 100644 --- a/internal/ingress/annotations/rewrite/main.go +++ b/internal/ingress/annotations/rewrite/main.go @@ -27,6 +27,59 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + rewriteTargetAnnotation = "rewrite-target" + sslRedirectAnnotation = "ssl-redirect" + preserveTrailingSlashAnnotation = "preserve-trailing-slash" + forceSSLRedirectAnnotation = "force-ssl-redirect" + useRegexAnnotation = "use-regex" + appRootAnnotation = "app-root" +) + +var rewriteAnnotations = parser.Annotation{ + Group: "rewrite", + Annotations: parser.AnnotationFields{ + rewriteTargetAnnotation: { + Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows to specify the target URI where the traffic must be redirected. It can contain regular characters and captured + groups specified as '$1', '$2', etc.`, + }, + sslRedirectAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if the location section is only accessible via SSL`, + }, + preserveTrailingSlashAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines if the trailing slash should be preserved in the URI with 'ssl-redirect'`, + }, + forceSSLRedirectAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation forces the redirection to HTTPS even if the Ingress is not TLS Enabled`, + }, + useRegexAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines if the paths defined on an Ingress use regular expressions. To use regex on path + the pathType should also be defined as 'ImplementationSpecific'.`, + }, + appRootAnnotation: { + Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the Application Root that the Controller must redirect if it's in / context`, + }, + }, +} + // Config describes the per location redirect config type Config struct { // Target URI where the traffic must be redirected @@ -71,12 +124,16 @@ func (r1 *Config) Equal(r2 *Config) bool { } type rewrite struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new rewrite annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return rewrite{r} + return rewrite{ + r: r, + annotationConfig: rewriteAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -85,24 +142,45 @@ func (a rewrite) Parse(ing *networking.Ingress) (interface{}, error) { var err error config := &Config{} - config.Target, _ = parser.GetStringAnnotation("rewrite-target", ing) - config.SSLRedirect, err = parser.GetBoolAnnotation("ssl-redirect", ing) + config.Target, err = parser.GetStringAnnotation(rewriteTargetAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%sis invalid, defaulting to empty", rewriteTargetAnnotation) + } + config.Target = "" + } + config.SSLRedirect, err = parser.GetBoolAnnotation(sslRedirectAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%sis invalid, defaulting to '%s'", sslRedirectAnnotation, a.r.GetDefaultBackend().SSLRedirect) + } config.SSLRedirect = a.r.GetDefaultBackend().SSLRedirect } - config.PreserveTrailingSlash, err = parser.GetBoolAnnotation("preserve-trailing-slash", ing) + config.PreserveTrailingSlash, err = parser.GetBoolAnnotation(preserveTrailingSlashAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%sis invalid, defaulting to '%s'", preserveTrailingSlashAnnotation, a.r.GetDefaultBackend().PreserveTrailingSlash) + } config.PreserveTrailingSlash = a.r.GetDefaultBackend().PreserveTrailingSlash } - config.ForceSSLRedirect, err = parser.GetBoolAnnotation("force-ssl-redirect", ing) + config.ForceSSLRedirect, err = parser.GetBoolAnnotation(forceSSLRedirectAnnotation, ing, a.annotationConfig.Annotations) if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%sis invalid, defaulting to '%s'", forceSSLRedirectAnnotation, a.r.GetDefaultBackend().ForceSSLRedirect) + } config.ForceSSLRedirect = a.r.GetDefaultBackend().ForceSSLRedirect } - config.UseRegex, _ = parser.GetBoolAnnotation("use-regex", ing) + config.UseRegex, err = parser.GetBoolAnnotation(useRegexAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + if errors.IsValidationError(err) { + klog.Warningf("%sis invalid, defaulting to 'false'", useRegexAnnotation) + } + config.UseRegex = false + } - config.AppRoot, err = parser.GetStringAnnotation("app-root", ing) + config.AppRoot, err = parser.GetStringAnnotation(appRootAnnotation, ing, a.annotationConfig.Annotations) if err != nil { if !errors.IsMissingAnnotations(err) && !errors.IsInvalidContent(err) { klog.Warningf("Annotation app-root contains an invalid value: %v", err) @@ -126,3 +204,12 @@ func (a rewrite) Parse(ing *networking.Ingress) (interface{}, error) { return config, nil } + +func (a rewrite) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a rewrite) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, rewriteAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/rewrite/main_test.go b/internal/ingress/annotations/rewrite/main_test.go index c2cb42c78..6b97d2e01 100644 --- a/internal/ingress/annotations/rewrite/main_test.go +++ b/internal/ingress/annotations/rewrite/main_test.go @@ -129,6 +129,30 @@ func TestSSLRedirect(t *testing.T) { t.Errorf("Expected true but returned false") } + data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/$1/abc/$2" + ing.SetAnnotations(data) + + i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + redirect, ok = i.(*Config) + if !ok { + t.Errorf("expected a Redirect type") + } + if redirect.Target != "/xpto/$1/abc/$2" { + t.Errorf("Expected /xpto/$1/abc/$2 but returned %s", redirect.Target) + } + + data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/xas{445}" + ing.SetAnnotations(data) + + i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + redirect, ok = i.(*Config) + if !ok { + t.Errorf("expected a Redirect type") + } + if redirect.Target != "" { + t.Errorf("Expected empty rewrite target but returned %s", redirect.Target) + } + data[parser.GetAnnotationWithPrefix("ssl-redirect")] = "false" ing.SetAnnotations(data) diff --git a/internal/ingress/annotations/satisfy/main.go b/internal/ingress/annotations/satisfy/main.go index 0d4fd4ff6..45187fe5c 100644 --- a/internal/ingress/annotations/satisfy/main.go +++ b/internal/ingress/annotations/satisfy/main.go @@ -23,18 +23,40 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + satisfyAnnotation = "satisfy" +) + +var satisfyAnnotations = parser.Annotation{ + Group: "authentication", + Annotations: parser.AnnotationFields{ + satisfyAnnotation: { + Validator: parser.ValidateOptions([]string{"any", "all"}, true, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `By default, a request would need to satisfy all authentication requirements in order to be allowed. + By using this annotation, requests that satisfy either any or all authentication requirements are allowed, based on the configuration value. + Valid options are "all" and "any"`, + }, + }, +} + type satisfy struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new SATISFY annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return satisfy{r} + return satisfy{ + r: r, + annotationConfig: satisfyAnnotations, + } } // Parse parses annotation contained in the ingress func (s satisfy) Parse(ing *networking.Ingress) (interface{}, error) { - satisfy, err := parser.GetStringAnnotation("satisfy", ing) + satisfy, err := parser.GetStringAnnotation(satisfyAnnotation, ing, s.annotationConfig.Annotations) if err != nil || (satisfy != "any" && satisfy != "all") { satisfy = "" @@ -42,3 +64,12 @@ func (s satisfy) Parse(ing *networking.Ingress) (interface{}, error) { return satisfy, nil } + +func (s satisfy) GetDocumentation() parser.AnnotationFields { + return s.annotationConfig.Annotations +} + +func (a satisfy) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, satisfyAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/satisfy/main_test.go b/internal/ingress/annotations/satisfy/main_test.go index b45205d9f..c8d5782f9 100644 --- a/internal/ingress/annotations/satisfy/main_test.go +++ b/internal/ingress/annotations/satisfy/main_test.go @@ -83,7 +83,7 @@ func TestSatisfyParser(t *testing.T) { annotations := map[string]string{} for input, expected := range data { - annotations[parser.GetAnnotationWithPrefix("satisfy")] = input + annotations[parser.GetAnnotationWithPrefix(satisfyAnnotation)] = input ing.SetAnnotations(annotations) satisfyt, err := NewParser(&resolver.Mock{}).Parse(ing) diff --git a/internal/ingress/annotations/serversnippet/main.go b/internal/ingress/annotations/serversnippet/main.go index 70f0af8e5..aa15608d0 100644 --- a/internal/ingress/annotations/serversnippet/main.go +++ b/internal/ingress/annotations/serversnippet/main.go @@ -23,18 +23,47 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + serverSnippetAnnotation = "server-snippet" +) + +var serverSnippetAnnotations = parser.Annotation{ + Group: "snippets", + Annotations: parser.AnnotationFields{ + serverSnippetAnnotation: { + Validator: parser.ValidateNull, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskCritical, // Critical, this annotation is not validated at all and allows arbitrary configutations + Documentation: `This annotation allows setting a custom NGINX configuration on a server block. This annotation does not contain any validation and it's usage is not recommended!`, + }, + }, +} + type serverSnippet struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new server snippet annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return serverSnippet{r} + return serverSnippet{ + r: r, + annotationConfig: serverSnippetAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to indicate if the location/s contains a fragment of // configuration to be included inside the paths of the rules func (a serverSnippet) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("server-snippet", ing) + return parser.GetStringAnnotation(serverSnippetAnnotation, ing, a.annotationConfig.Annotations) +} + +func (a serverSnippet) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a serverSnippet) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, serverSnippetAnnotations.Annotations) } diff --git a/internal/ingress/annotations/serversnippet/main_test.go b/internal/ingress/annotations/serversnippet/main_test.go index c9e0979ad..601e11a42 100644 --- a/internal/ingress/annotations/serversnippet/main_test.go +++ b/internal/ingress/annotations/serversnippet/main_test.go @@ -27,7 +27,7 @@ import ( ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("server-snippet") + annotation := parser.GetAnnotationWithPrefix(serverSnippetAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { diff --git a/internal/ingress/annotations/serviceupstream/main.go b/internal/ingress/annotations/serviceupstream/main.go index 4a4879682..e662f73c3 100644 --- a/internal/ingress/annotations/serviceupstream/main.go +++ b/internal/ingress/annotations/serviceupstream/main.go @@ -24,19 +24,39 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + serviceUpstreamAnnotation = "service-upstream" +) + +var serviceUpstreamAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + serviceUpstreamAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, // Critical, this annotation is not validated at all and allows arbitrary configutations + Documentation: `This annotation makes NGINX use Service's Cluster IP and Port instead of Endpoints as the backend endpoints`, + }, + }, +} + type serviceUpstream struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new serviceUpstream annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return serviceUpstream{r} + return serviceUpstream{ + r: r, + annotationConfig: serviceUpstreamAnnotations, + } } func (s serviceUpstream) Parse(ing *networking.Ingress) (interface{}, error) { defBackend := s.r.GetDefaultBackend() - val, err := parser.GetBoolAnnotation("service-upstream", ing) + val, err := parser.GetBoolAnnotation(serviceUpstreamAnnotation, ing, s.annotationConfig.Annotations) // A missing annotation is not a problem, just use the default if err == errors.ErrMissingAnnotations { return defBackend.ServiceUpstream, nil @@ -44,3 +64,12 @@ func (s serviceUpstream) Parse(ing *networking.Ingress) (interface{}, error) { return val, nil } + +func (s serviceUpstream) GetDocumentation() parser.AnnotationFields { + return s.annotationConfig.Annotations +} + +func (a serviceUpstream) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, serviceUpstreamAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/serviceupstream/main_test.go b/internal/ingress/annotations/serviceupstream/main_test.go index b773e9723..2751208ec 100644 --- a/internal/ingress/annotations/serviceupstream/main_test.go +++ b/internal/ingress/annotations/serviceupstream/main_test.go @@ -74,7 +74,7 @@ func TestIngressAnnotationServiceUpstreamEnabled(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("service-upstream")] = "true" + data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "true" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -93,7 +93,7 @@ func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) { // Test with explicitly set to false data := map[string]string{} - data[parser.GetAnnotationWithPrefix("service-upstream")] = "false" + data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) val, _ := NewParser(&resolver.Mock{}).Parse(ing) @@ -155,7 +155,7 @@ func TestParseAnnotationsOverridesDefaultConfig(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix("service-upstream")] = "false" + data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) val, _ := NewParser(mockBackend{}).Parse(ing) diff --git a/internal/ingress/annotations/sessionaffinity/main.go b/internal/ingress/annotations/sessionaffinity/main.go index 98a0d64f8..0a4a59dbc 100644 --- a/internal/ingress/annotations/sessionaffinity/main.go +++ b/internal/ingress/annotations/sessionaffinity/main.go @@ -65,6 +65,90 @@ const ( annotationAffinityCookieChangeOnFailure = "session-cookie-change-on-failure" ) +var sessionAffinityAnnotations = parser.Annotation{ + Group: "affinity", + Annotations: parser.AnnotationFields{ + annotationAffinityType: { + Validator: parser.ValidateOptions([]string{"cookie"}, true, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation enables and sets the affinity type in all Upstreams of an Ingress. This way, a request will always be directed to the same upstream server. The only affinity type available for NGINX is cookie`, + }, + annotationAffinityMode: { + Validator: parser.ValidateOptions([]string{"balanced", "persistent"}, true, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the stickiness of a session. + Setting this to balanced (default) will redistribute some sessions if a deployment gets scaled up, therefore rebalancing the load on the servers. + Setting this to persistent will not rebalance sessions to new servers, therefore providing maximum stickiness.`, + }, + annotationAffinityCanaryBehavior: { + Validator: parser.ValidateOptions([]string{"sticky", "legacy"}, true, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation defines the behavior of canaries when session affinity is enabled. + Setting this to sticky (default) will ensure that users that were served by canaries, will continue to be served by canaries. + Setting this to legacy will restore original canary behavior, when session affinity was ignored.`, + }, + annotationAffinityCookieName: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation allows to specify the name of the cookie that will be used to route the requests`, + }, + annotationAffinityCookieSecure: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation set the cookie as secure regardless the protocol of the incoming request`, + }, + annotationAffinityCookieExpires: { + Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation is a legacy version of "session-cookie-max-age" for compatibility with older browsers, generates an "Expires" cookie directive by adding the seconds to the current date`, + }, + annotationAffinityCookieMaxAge: { + Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, false), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation sets the time until the cookie expires`, + }, + annotationAffinityCookiePath: { + Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the Path that will be set on the cookie (required if your Ingress paths use regular expressions)`, + }, + annotationAffinityCookieDomain: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskMedium, + Documentation: `This annotation defines the Domain attribute of the sticky cookie.`, + }, + annotationAffinityCookieSameSite: { + Validator: parser.ValidateOptions([]string{"None", "Lax", "Strict"}, false, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation is used to apply a SameSite attribute to the sticky cookie. + Browser accepted values are None, Lax, and Strict`, + }, + annotationAffinityCookieConditionalSameSiteNone: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation is used to omit SameSite=None from browsers with SameSite attribute incompatibilities`, + }, + annotationAffinityCookieChangeOnFailure: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation, when set to false will send request to upstream pointed by sticky cookie even if previous attempt failed. + When set to true and previous attempt failed, sticky cookie will be changed to point to another upstream.`, + }, + }, +} + var ( affinityCookieExpiresRegex = regexp.MustCompile(`(^0|-?[1-9]\d*$)`) ) @@ -109,50 +193,50 @@ func (a affinity) cookieAffinityParse(ing *networking.Ingress) *Cookie { cookie := &Cookie{} - cookie.Name, err = parser.GetStringAnnotation(annotationAffinityCookieName, ing) + cookie.Name, err = parser.GetStringAnnotation(annotationAffinityCookieName, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieName, "default", defaultAffinityCookieName) cookie.Name = defaultAffinityCookieName } - cookie.Expires, err = parser.GetStringAnnotation(annotationAffinityCookieExpires, ing) + cookie.Expires, err = parser.GetStringAnnotation(annotationAffinityCookieExpires, ing, a.annotationConfig.Annotations) if err != nil || !affinityCookieExpiresRegex.MatchString(cookie.Expires) { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieExpires) cookie.Expires = "" } - cookie.MaxAge, err = parser.GetStringAnnotation(annotationAffinityCookieMaxAge, ing) + cookie.MaxAge, err = parser.GetStringAnnotation(annotationAffinityCookieMaxAge, ing, a.annotationConfig.Annotations) if err != nil || !affinityCookieExpiresRegex.MatchString(cookie.MaxAge) { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieMaxAge) cookie.MaxAge = "" } - cookie.Path, err = parser.GetStringAnnotation(annotationAffinityCookiePath, ing) + cookie.Path, err = parser.GetStringAnnotation(annotationAffinityCookiePath, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookiePath) } - cookie.Domain, err = parser.GetStringAnnotation(annotationAffinityCookieDomain, ing) + cookie.Domain, err = parser.GetStringAnnotation(annotationAffinityCookieDomain, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieDomain) } - cookie.SameSite, err = parser.GetStringAnnotation(annotationAffinityCookieSameSite, ing) + cookie.SameSite, err = parser.GetStringAnnotation(annotationAffinityCookieSameSite, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieSameSite) } - cookie.Secure, err = parser.GetBoolAnnotation(annotationAffinityCookieSecure, ing) + cookie.Secure, err = parser.GetBoolAnnotation(annotationAffinityCookieSecure, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieSecure) } - cookie.ConditionalSameSiteNone, err = parser.GetBoolAnnotation(annotationAffinityCookieConditionalSameSiteNone, ing) + cookie.ConditionalSameSiteNone, err = parser.GetBoolAnnotation(annotationAffinityCookieConditionalSameSiteNone, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieConditionalSameSiteNone) } - cookie.ChangeOnFailure, err = parser.GetBoolAnnotation(annotationAffinityCookieChangeOnFailure, ing) + cookie.ChangeOnFailure, err = parser.GetBoolAnnotation(annotationAffinityCookieChangeOnFailure, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("Invalid or no annotation value found. Ignoring", "ingress", klog.KObj(ing), "annotation", annotationAffinityCookieChangeOnFailure) } @@ -162,11 +246,15 @@ func (a affinity) cookieAffinityParse(ing *networking.Ingress) *Cookie { // NewParser creates a new Affinity annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return affinity{r} + return affinity{ + r: r, + annotationConfig: sessionAffinityAnnotations, + } } type affinity struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // ParseAnnotations parses the annotations contained in the ingress @@ -174,18 +262,18 @@ type affinity struct { func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { cookie := &Cookie{} // Check the type of affinity that will be used - at, err := parser.GetStringAnnotation(annotationAffinityType, ing) + at, err := parser.GetStringAnnotation(annotationAffinityType, ing, a.annotationConfig.Annotations) if err != nil { at = "" } // Check the affinity mode that will be used - am, err := parser.GetStringAnnotation(annotationAffinityMode, ing) + am, err := parser.GetStringAnnotation(annotationAffinityMode, ing, a.annotationConfig.Annotations) if err != nil { am = "" } - cb, err := parser.GetStringAnnotation(annotationAffinityCanaryBehavior, ing) + cb, err := parser.GetStringAnnotation(annotationAffinityCanaryBehavior, ing, a.annotationConfig.Annotations) if err != nil { cb = "" } @@ -205,3 +293,12 @@ func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { Cookie: *cookie, }, nil } + +func (a affinity) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a affinity) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, sessionAffinityAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/snippet/main.go b/internal/ingress/annotations/snippet/main.go index 93ec70cf9..2406093c5 100644 --- a/internal/ingress/annotations/snippet/main.go +++ b/internal/ingress/annotations/snippet/main.go @@ -23,18 +23,47 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + configurationSnippetAnnotation = "configuration-snippet" +) + +var configurationSnippetAnnotations = parser.Annotation{ + Group: "snippets", + Annotations: parser.AnnotationFields{ + configurationSnippetAnnotation: { + Validator: parser.ValidateNull, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskCritical, // Critical, this annotation is not validated at all and allows arbitrary configutations + Documentation: `This annotation allows setting a custom NGINX configuration on a location block. This annotation does not contain any validation and it's usage is not recommended!`, + }, + }, +} + type snippet struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new CORS annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return snippet{r} + return snippet{ + r: r, + annotationConfig: configurationSnippetAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to indicate if the location/s contains a fragment of // configuration to be included inside the paths of the rules func (a snippet) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("configuration-snippet", ing) + return parser.GetStringAnnotation(configurationSnippetAnnotation, ing, a.annotationConfig.Annotations) +} + +func (a snippet) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a snippet) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, configurationSnippetAnnotations.Annotations) } diff --git a/internal/ingress/annotations/snippet/main_test.go b/internal/ingress/annotations/snippet/main_test.go index 0defc3c1f..921afeea8 100644 --- a/internal/ingress/annotations/snippet/main_test.go +++ b/internal/ingress/annotations/snippet/main_test.go @@ -27,7 +27,7 @@ import ( ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("configuration-snippet") + annotation := parser.GetAnnotationWithPrefix(configurationSnippetAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { diff --git a/internal/ingress/annotations/sslcipher/main.go b/internal/ingress/annotations/sslcipher/main.go index e4e5baad2..c30f12424 100644 --- a/internal/ingress/annotations/sslcipher/main.go +++ b/internal/ingress/annotations/sslcipher/main.go @@ -17,14 +17,47 @@ limitations under the License. package sslcipher import ( + "regexp" + networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + sslPreferServerCipherAnnotation = "ssl-prefer-server-ciphers" + sslCipherAnnotation = "ssl-ciphers" +) + +var ( + // Should cover something like "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" + regexValidSSLCipher = regexp.MustCompile(`^[A-Za-z0-9!:+\-]*$`) +) + +var sslCipherAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + sslPreferServerCipherAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `The following annotation will set the ssl_prefer_server_ciphers directive at the server level. + This configuration specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols.`, + }, + sslCipherAnnotation: { + Validator: parser.ValidateRegex(*regexValidSSLCipher, true), + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, + Documentation: `Using this annotation will set the ssl_ciphers directive at the server level. This configuration is active for all the paths in the host.`, + }, + }, +} + type sslCipher struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the ssl-ciphers & ssl-prefer-server-ciphers configuration @@ -35,7 +68,10 @@ type Config struct { // NewParser creates a new sslCipher annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return sslCipher{r} + return sslCipher{ + r: r, + annotationConfig: sslCipherAnnotations, + } } // Parse parses the annotations contained in the ingress rule @@ -45,7 +81,7 @@ func (sc sslCipher) Parse(ing *networking.Ingress) (interface{}, error) { var err error var sslPreferServerCiphers bool - sslPreferServerCiphers, err = parser.GetBoolAnnotation("ssl-prefer-server-ciphers", ing) + sslPreferServerCiphers, err = parser.GetBoolAnnotation(sslPreferServerCipherAnnotation, ing, sc.annotationConfig.Annotations) if err != nil { config.SSLPreferServerCiphers = "" } else { @@ -56,7 +92,19 @@ func (sc sslCipher) Parse(ing *networking.Ingress) (interface{}, error) { } } - config.SSLCiphers, _ = parser.GetStringAnnotation("ssl-ciphers", ing) + config.SSLCiphers, err = parser.GetStringAnnotation(sslCipherAnnotation, ing, sc.annotationConfig.Annotations) + if err != nil && !errors.IsInvalidContent(err) && !errors.IsMissingAnnotations(err) { + return config, err + } return config, nil } + +func (sc sslCipher) GetDocumentation() parser.AnnotationFields { + return sc.annotationConfig.Annotations +} + +func (a sslCipher) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, sslCipherAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/sslcipher/main_test.go b/internal/ingress/annotations/sslcipher/main_test.go index 6eb9ec0c2..ac6808e06 100644 --- a/internal/ingress/annotations/sslcipher/main_test.go +++ b/internal/ingress/annotations/sslcipher/main_test.go @@ -33,22 +33,24 @@ func TestParse(t *testing.T) { t.Fatalf("expected a parser.IngressAnnotation but returned nil") } - annotationSSLCiphers := parser.GetAnnotationWithPrefix("ssl-ciphers") - annotationSSLPreferServerCiphers := parser.GetAnnotationWithPrefix("ssl-prefer-server-ciphers") + annotationSSLCiphers := parser.GetAnnotationWithPrefix(sslCipherAnnotation) + annotationSSLPreferServerCiphers := parser.GetAnnotationWithPrefix(sslPreferServerCipherAnnotation) testCases := []struct { annotations map[string]string expected Config + expectErr bool }{ - {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", ""}}, + {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", ""}, false}, {map[string]string{annotationSSLCiphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"}, - Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}}, - {map[string]string{annotationSSLCiphers: ""}, Config{"", ""}}, - {map[string]string{annotationSSLPreferServerCiphers: "true"}, Config{"", "on"}}, - {map[string]string{annotationSSLPreferServerCiphers: "false"}, Config{"", "off"}}, - {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", annotationSSLPreferServerCiphers: "true"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", "on"}}, - {map[string]string{}, Config{"", ""}}, - {nil, Config{"", ""}}, + Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}, false}, + {map[string]string{annotationSSLCiphers: ""}, Config{"", ""}, false}, + {map[string]string{annotationSSLPreferServerCiphers: "true"}, Config{"", "on"}, false}, + {map[string]string{annotationSSLPreferServerCiphers: "false"}, Config{"", "off"}, false}, + {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", annotationSSLPreferServerCiphers: "true"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", "on"}, false}, + {map[string]string{annotationSSLCiphers: "ALL:SOMETHING:;locationXPTO"}, Config{"", ""}, true}, + {map[string]string{}, Config{"", ""}, false}, + {nil, Config{"", ""}, false}, } ing := &networking.Ingress{ @@ -61,7 +63,10 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) + result, err := ap.Parse(ing) + if (err != nil) != testCase.expectErr { + t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations) + } if !reflect.DeepEqual(result, &testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } diff --git a/internal/ingress/annotations/sslpassthrough/main.go b/internal/ingress/annotations/sslpassthrough/main.go index d1def7172..1557d4243 100644 --- a/internal/ingress/annotations/sslpassthrough/main.go +++ b/internal/ingress/annotations/sslpassthrough/main.go @@ -24,13 +24,32 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + sslPassthroughAnnotation = "ssl-passthrough" +) + +var sslPassthroughAnnotations = parser.Annotation{ + Group: "", // TBD + Annotations: parser.AnnotationFields{ + sslPassthroughAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set + Documentation: `This annotation instructs the controller to send TLS connections directly to the backend instead of letting NGINX decrypt the communication.`, + }, + }, +} + type sslpt struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new SSL passthrough annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return sslpt{r} + return sslpt{r: r, + annotationConfig: sslPassthroughAnnotations, + } } // ParseAnnotations parses the annotations contained in the ingress @@ -40,5 +59,14 @@ func (a sslpt) Parse(ing *networking.Ingress) (interface{}, error) { return false, ing_errors.ErrMissingAnnotations } - return parser.GetBoolAnnotation("ssl-passthrough", ing) + return parser.GetBoolAnnotation(sslPassthroughAnnotation, ing, a.annotationConfig.Annotations) +} + +func (a sslpt) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a sslpt) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, sslPassthroughAnnotations.Annotations) } diff --git a/internal/ingress/annotations/sslpassthrough/main_test.go b/internal/ingress/annotations/sslpassthrough/main_test.go index 5cf2f979a..b712fda19 100644 --- a/internal/ingress/annotations/sslpassthrough/main_test.go +++ b/internal/ingress/annotations/sslpassthrough/main_test.go @@ -54,7 +54,7 @@ func TestParseAnnotations(t *testing.T) { } data := map[string]string{} - data[parser.GetAnnotationWithPrefix("ssl-passthrough")] = "true" + data[parser.GetAnnotationWithPrefix(sslPassthroughAnnotation)] = "true" ing.SetAnnotations(data) // test ingress using the annotation without a TLS section _, err = NewParser(&resolver.Mock{}).Parse(ing) diff --git a/internal/ingress/annotations/streamsnippet/main.go b/internal/ingress/annotations/streamsnippet/main.go index fb22f754c..71ff3b140 100644 --- a/internal/ingress/annotations/streamsnippet/main.go +++ b/internal/ingress/annotations/streamsnippet/main.go @@ -23,18 +23,47 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + streamSnippetAnnotation = "stream-snippet" +) + +var streamSnippetAnnotations = parser.Annotation{ + Group: "snippets", + Annotations: parser.AnnotationFields{ + streamSnippetAnnotation: { + Validator: parser.ValidateNull, + Scope: parser.AnnotationScopeIngress, + Risk: parser.AnnotationRiskCritical, // Critical, this annotation is not validated at all and allows arbitrary configutations + Documentation: `This annotation allows setting a custom NGINX configuration on a stream block. This annotation does not contain any validation and it's usage is not recommended!`, + }, + }, +} + type streamSnippet struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new server snippet annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return streamSnippet{r} + return streamSnippet{ + r: r, + annotationConfig: streamSnippetAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to indicate if the location/s contains a fragment of // configuration to be included inside the paths of the rules func (a streamSnippet) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("stream-snippet", ing) + return parser.GetStringAnnotation("stream-snippet", ing, a.annotationConfig.Annotations) +} + +func (a streamSnippet) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a streamSnippet) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, streamSnippetAnnotations.Annotations) } diff --git a/internal/ingress/annotations/streamsnippet/main_test.go b/internal/ingress/annotations/streamsnippet/main_test.go index 0b8e3e3aa..997b7be70 100644 --- a/internal/ingress/annotations/streamsnippet/main_test.go +++ b/internal/ingress/annotations/streamsnippet/main_test.go @@ -27,7 +27,7 @@ import ( ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("stream-snippet") + annotation := parser.GetAnnotationWithPrefix(streamSnippetAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { diff --git a/internal/ingress/annotations/upstreamhashby/main.go b/internal/ingress/annotations/upstreamhashby/main.go index e6bbca6c3..bc07f70fb 100644 --- a/internal/ingress/annotations/upstreamhashby/main.go +++ b/internal/ingress/annotations/upstreamhashby/main.go @@ -17,14 +17,54 @@ limitations under the License. package upstreamhashby import ( + "regexp" + networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + upstreamHashByAnnotation = "upstream-hash-by" + upstreamHashBySubsetAnnotation = "upstream-hash-by-subset" + upstreamHashBySubsetSize = "upstream-hash-by-subset-size" +) + +var ( + specialChars = regexp.QuoteMeta("_${}") + hashByRegex = regexp.MustCompilePOSIX(`^[A-Za-z0-9\-` + specialChars + `]*$`) +) + +var upstreamHashByAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + upstreamHashByAnnotation: { + Validator: parser.ValidateRegex(*hashByRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskHigh, // High, this annotation allows accessing NGINX variables + Documentation: `This annotation defines the nginx variable, text value or any combination thereof to use for consistent hashing. + For example: nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri" or nginx.ingress.kubernetes.io/upstream-hash-by: "$request_uri$host" or nginx.ingress.kubernetes.io/upstream-hash-by: "${request_uri}-text-value" to consistently hash upstream requests by the current request URI.`, + }, + upstreamHashBySubsetAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation maps requests to subset of nodes instead of a single one.`, + }, + upstreamHashBySubsetSize: { + Validator: parser.ValidateInt, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation determines the size of each subset (default 3)`, + }, + }, +} + type upstreamhashby struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // Config contains the Consistent hash configuration to be used in the Ingress @@ -36,14 +76,26 @@ type Config struct { // NewParser creates a new UpstreamHashBy annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return upstreamhashby{r} + return upstreamhashby{ + r: r, + annotationConfig: upstreamHashByAnnotations, + } } // Parse parses the annotations contained in the ingress rule func (a upstreamhashby) Parse(ing *networking.Ingress) (interface{}, error) { - upstreamHashBy, _ := parser.GetStringAnnotation("upstream-hash-by", ing) - upstreamHashBySubset, _ := parser.GetBoolAnnotation("upstream-hash-by-subset", ing) - upstreamHashbySubsetSize, _ := parser.GetIntAnnotation("upstream-hash-by-subset-size", ing) + upstreamHashBy, err := parser.GetStringAnnotation(upstreamHashByAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && !errors.IsMissingAnnotations(err) { + return nil, err + } + upstreamHashBySubset, err := parser.GetBoolAnnotation(upstreamHashBySubsetAnnotation, ing, a.annotationConfig.Annotations) + if err != nil && !errors.IsMissingAnnotations(err) { + return nil, err + } + upstreamHashbySubsetSize, err := parser.GetIntAnnotation(upstreamHashBySubsetSize, ing, a.annotationConfig.Annotations) + if err != nil && !errors.IsMissingAnnotations(err) { + return nil, err + } if upstreamHashbySubsetSize == 0 { upstreamHashbySubsetSize = 3 @@ -51,3 +103,12 @@ func (a upstreamhashby) Parse(ing *networking.Ingress) (interface{}, error) { return &Config{upstreamHashBy, upstreamHashBySubset, upstreamHashbySubsetSize}, nil } + +func (a upstreamhashby) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a upstreamhashby) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, upstreamHashByAnnotations.Annotations) +} diff --git a/internal/ingress/annotations/upstreamhashby/main_test.go b/internal/ingress/annotations/upstreamhashby/main_test.go index d2c2644ca..bdbd9c350 100644 --- a/internal/ingress/annotations/upstreamhashby/main_test.go +++ b/internal/ingress/annotations/upstreamhashby/main_test.go @@ -27,7 +27,7 @@ import ( ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("upstream-hash-by") + annotation := parser.GetAnnotationWithPrefix(upstreamHashByAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { @@ -37,12 +37,15 @@ func TestParse(t *testing.T) { testCases := []struct { annotations map[string]string expected string + expectErr bool }{ - {map[string]string{annotation: "$request_uri"}, "$request_uri"}, - {map[string]string{annotation: "$request_uri$scheme"}, "$request_uri$scheme"}, - {map[string]string{annotation: "false"}, "false"}, - {map[string]string{}, ""}, - {nil, ""}, + {map[string]string{annotation: "$request_URI"}, "$request_URI", false}, + {map[string]string{annotation: "$request_uri$scheme"}, "$request_uri$scheme", false}, + {map[string]string{annotation: "xpto;[]"}, "", true}, + {map[string]string{annotation: "lalal${scheme_test}"}, "lalal${scheme_test}", false}, + {map[string]string{annotation: "false"}, "false", false}, + {map[string]string{}, "", false}, + {nil, "", false}, } ing := &networking.Ingress{ @@ -55,14 +58,19 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) - uc, ok := result.(*Config) - if !ok { - t.Fatalf("expected a Config type") + result, err := ap.Parse(ing) + if (err != nil) != testCase.expectErr { + t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations) } + if !testCase.expectErr { + uc, ok := result.(*Config) + if !ok { + t.Fatalf("expected a Config type") + } - if uc.UpstreamHashBy != testCase.expected { - t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) + if uc.UpstreamHashBy != testCase.expected { + t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) + } } } } diff --git a/internal/ingress/annotations/upstreamvhost/main.go b/internal/ingress/annotations/upstreamvhost/main.go index 2eed5607e..052ca2344 100644 --- a/internal/ingress/annotations/upstreamvhost/main.go +++ b/internal/ingress/annotations/upstreamvhost/main.go @@ -23,18 +23,48 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + upstreamVhostAnnotation = "upstream-vhost" +) + +var upstreamVhostAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + upstreamVhostAnnotation: { + Validator: parser.ValidateServerName, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set + Documentation: `This configuration setting allows you to control the value for host in the following statement: proxy_set_header Host $host, which forms part of the location block. + This is useful if you need to call the upstream server by something other than $host`, + }, + }, +} + type upstreamVhost struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new upstream VHost annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return upstreamVhost{r} + return upstreamVhost{ + r: r, + annotationConfig: upstreamVhostAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to indicate if the location/s contains a fragment of // configuration to be included inside the paths of the rules func (a upstreamVhost) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("upstream-vhost", ing) + return parser.GetStringAnnotation(upstreamVhostAnnotation, ing, a.annotationConfig.Annotations) +} + +func (a upstreamVhost) GetDocumentation() parser.AnnotationFields { + return a.annotationConfig.Annotations +} + +func (a upstreamVhost) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, upstreamVhostAnnotations.Annotations) } diff --git a/internal/ingress/annotations/upstreamvhost/main_test.go b/internal/ingress/annotations/upstreamvhost/main_test.go index 130d745ee..87324b181 100644 --- a/internal/ingress/annotations/upstreamvhost/main_test.go +++ b/internal/ingress/annotations/upstreamvhost/main_test.go @@ -36,7 +36,7 @@ func TestParse(t *testing.T) { } data := map[string]string{} - data[parser.GetAnnotationWithPrefix("upstream-vhost")] = "ok.com" + data[parser.GetAnnotationWithPrefix(upstreamVhostAnnotation)] = "ok.com" ing.SetAnnotations(data) diff --git a/internal/ingress/annotations/xforwardedprefix/main.go b/internal/ingress/annotations/xforwardedprefix/main.go index 60eed8773..fc4d5798d 100644 --- a/internal/ingress/annotations/xforwardedprefix/main.go +++ b/internal/ingress/annotations/xforwardedprefix/main.go @@ -23,17 +23,46 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + xForwardedForPrefixAnnotation = "x-forwarded-prefix" +) + +var xForwardedForAnnotations = parser.Annotation{ + Group: "backend", + Annotations: parser.AnnotationFields{ + xForwardedForPrefixAnnotation: { + Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set + Documentation: `This annotation can be used to add the non-standard X-Forwarded-Prefix header to the upstream request with a string value`, + }, + }, +} + type xforwardedprefix struct { - r resolver.Resolver + r resolver.Resolver + annotationConfig parser.Annotation } // NewParser creates a new xforwardedprefix annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return xforwardedprefix{r} + return xforwardedprefix{ + r: r, + annotationConfig: xForwardedForAnnotations, + } } // Parse parses the annotations contained in the ingress rule // used to add an x-forwarded-prefix header to the request func (cbbs xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation("x-forwarded-prefix", ing) + return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, cbbs.annotationConfig.Annotations) +} + +func (cbbs xforwardedprefix) GetDocumentation() parser.AnnotationFields { + return cbbs.annotationConfig.Annotations +} + +func (a xforwardedprefix) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) + return parser.CheckAnnotationRisk(anns, maxrisk, xForwardedForAnnotations.Annotations) } diff --git a/internal/ingress/annotations/xforwardedprefix/main_test.go b/internal/ingress/annotations/xforwardedprefix/main_test.go index a78c63d04..d873a4412 100644 --- a/internal/ingress/annotations/xforwardedprefix/main_test.go +++ b/internal/ingress/annotations/xforwardedprefix/main_test.go @@ -27,7 +27,7 @@ import ( ) func TestParse(t *testing.T) { - annotation := parser.GetAnnotationWithPrefix("x-forwarded-prefix") + annotation := parser.GetAnnotationWithPrefix(xForwardedForPrefixAnnotation) ap := NewParser(&resolver.Mock{}) if ap == nil { t.Fatalf("expected a parser.IngressAnnotation but returned nil") diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 345ce89b4..6e78964ed 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -97,6 +97,17 @@ type Configuration struct { // If disabled, only snippets added via ConfigMap are added to ingress. AllowSnippetAnnotations bool `json:"allow-snippet-annotations"` + // AllowCrossNamespaceResources enables users to consume cross namespace resource on annotations + // Case disabled, attempts to use secrets or configmaps from a namespace different from Ingress will + // be denied + // This value will default to `false` on future releases + AllowCrossNamespaceResources bool `json:"allow-cross-namespace-resources"` + + // AnnotationsRiskLevel represents the risk accepted on an annotation. If the risk is, for instance `Medium`, annotations + // with risk High and Critical will not be accepted. + // Default Risk is Critical by default, but this may be changed in future releases + AnnotationsRiskLevel string `json:"annotations-risk-level"` + // AnnotationValueWordBlocklist defines words that should not be part of an user annotation value // (can be used to run arbitrary code or configs, for example) and that should be dropped. // This list should be separated by "," character @@ -708,7 +719,7 @@ type Configuration struct { // DatadogSampleRate specifies sample rate for any traces created. // Default: use a dynamic rate instead - DatadogSampleRate *float32 `json:"datadog-sample-rate",omitempty` + DatadogSampleRate *float32 `json:"datadog-sample-rate,omitempty"` // MainSnippet adds custom configuration to the main section of the nginx configuration MainSnippet string `json:"main-snippet"` @@ -853,8 +864,10 @@ func NewDefault() Configuration { cfg := Configuration{ AllowSnippetAnnotations: true, + AllowCrossNamespaceResources: true, AllowBackendServerHeader: false, AnnotationValueWordBlocklist: "", + AnnotationsRiskLevel: "Critical", AccessLogPath: "/var/log/nginx/access.log", AccessLogParams: "", EnableAccessLogForDefaultBackend: false, diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 4a4417130..7dc1a5292 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -389,14 +389,19 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { toCheck.ObjectMeta.Name == ing.ObjectMeta.Name } ings := store.FilterIngresses(allIngresses, filter) + parsed, err := annotations.NewAnnotationExtractor(n.store).Extract(ing) + if err != nil { + n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name) + return err + } ings = append(ings, &ingress.Ingress{ Ingress: *ing, - ParsedAnnotations: annotations.NewAnnotationExtractor(n.store).Extract(ing), + ParsedAnnotations: parsed, }) startTest := time.Now().UnixNano() / 1000000 _, servers, pcfg := n.getConfiguration(ings) - err := checkOverlap(ing, allIngresses, servers) + err = checkOverlap(ing, allIngresses, servers) if err != nil { n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name) return err @@ -1509,7 +1514,7 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) loc.Rewrite = anns.Rewrite loc.UpstreamVhost = anns.UpstreamVhost loc.Denylist = anns.Denylist - loc.Whitelist = anns.Whitelist + loc.Allowlist = anns.Allowlist loc.Denied = anns.Denied loc.XForwardedPrefix = anns.XForwardedPrefix loc.UsePortInRedirects = anns.UsePortInRedirects @@ -1808,9 +1813,9 @@ func checkOverlap(ing *networking.Ingress, ingresses []*ingress.Ingress, servers } // path overlap. Check if one of the ingresses has a canary annotation - isCanaryEnabled, annotationErr := parser.GetBoolAnnotation("canary", ing) + isCanaryEnabled, annotationErr := parser.GetBoolAnnotation("canary", ing, canary.CanaryAnnotations.Annotations) for _, existing := range existingIngresses { - isExistingCanaryEnabled, existingAnnotationErr := parser.GetBoolAnnotation("canary", existing) + isExistingCanaryEnabled, existingAnnotationErr := parser.GetBoolAnnotation("canary", existing, canary.CanaryAnnotations.Annotations) if isCanaryEnabled && isExistingCanaryEnabled { return fmt.Errorf(`host "%s" and path "%s" is already defined in ingress %s/%s`, rule.Host, path.Path, existing.Namespace, existing.Name) diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index 44184f6b9..c353d1b5e 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -44,7 +44,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations" "k8s.io/ingress-nginx/internal/ingress/annotations/canary" - "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" + "k8s.io/ingress-nginx/internal/ingress/annotations/ipallowlist" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl" "k8s.io/ingress-nginx/internal/ingress/annotations/sessionaffinity" @@ -73,6 +73,13 @@ func (fis fakeIngressStore) GetBackendConfiguration() ngx_config.Configuration { return fis.configuration } +func (fis fakeIngressStore) GetSecurityConfiguration() defaults.SecurityConfiguration { + return defaults.SecurityConfiguration{ + AnnotationsRiskLevel: fis.configuration.AnnotationsRiskLevel, + AllowCrossNamespaceResources: fis.configuration.AllowCrossNamespaceResources, + } +} + func (fakeIngressStore) GetConfigMap(key string) (*corev1.ConfigMap, error) { return nil, fmt.Errorf("test error") } @@ -2418,7 +2425,7 @@ func TestGetBackendServers(t *testing.T) { }, }, ParsedAnnotations: &annotations.Ingress{ - Whitelist: ipwhitelist.SourceRange{CIDR: []string{"10.0.0.0/24"}}, + Allowlist: ipallowlist.SourceRange{CIDR: []string{"10.0.0.0/24"}}, ServerSnippet: "bla", ConfigurationSnippet: "blo", }, @@ -2439,7 +2446,7 @@ func TestGetBackendServers(t *testing.T) { t.Errorf("config snippet should be empty, got '%s'", s.Locations[0].ConfigurationSnippet) } - if len(s.Locations[0].Whitelist.CIDR) != 1 || s.Locations[0].Whitelist.CIDR[0] != "10.0.0.0/24" { + if len(s.Locations[0].Allowlist.CIDR) != 1 || s.Locations[0].Allowlist.CIDR[0] != "10.0.0.0/24" { t.Errorf("allow list was incorrectly dropped, len should be 1 and contain 10.0.0.0/24") } diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index 9b3700739..c11e35d76 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -69,6 +69,9 @@ type Storer interface { // GetBackendConfiguration returns the nginx configuration stored in a configmap GetBackendConfiguration() ngx_config.Configuration + // GetSecurityConfiguration returns the configuration options from Ingress + GetSecurityConfiguration() defaults.SecurityConfiguration + // GetConfigMap returns the ConfigMap matching key. GetConfigMap(key string) (*corev1.ConfigMap, error) @@ -882,9 +885,14 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) { k8s.SetDefaultNGINXPathType(copyIng) - err := s.listers.IngressWithAnnotation.Update(&ingress.Ingress{ + parsed, err := s.annotations.Extract(ing) + if err != nil { + klog.Error(err) + return + } + err = s.listers.IngressWithAnnotation.Update(&ingress.Ingress{ Ingress: *copyIng, - ParsedAnnotations: s.annotations.Extract(ing), + ParsedAnnotations: parsed, }) if err != nil { klog.Error(err) @@ -920,8 +928,10 @@ func (s *k8sStore) updateSecretIngressMap(ing *networkingv1.Ingress) { "proxy-ssl-secret", "secure-verify-ca-secret", } + + secConfig := s.GetSecurityConfiguration().AllowCrossNamespaceResources for _, ann := range secretAnnotations { - secrKey, err := objectRefAnnotationNsKey(ann, ing) + secrKey, err := objectRefAnnotationNsKey(ann, ing, secConfig) if err != nil && !errors.IsMissingAnnotations(err) { klog.Errorf("error reading secret reference in annotation %q: %s", ann, err) continue @@ -937,8 +947,9 @@ func (s *k8sStore) updateSecretIngressMap(ing *networkingv1.Ingress) { // objectRefAnnotationNsKey returns an object reference formatted as a // 'namespace/name' key from the given annotation name. -func objectRefAnnotationNsKey(ann string, ing *networkingv1.Ingress) (string, error) { - annValue, err := parser.GetStringAnnotation(ann, ing) +func objectRefAnnotationNsKey(ann string, ing *networkingv1.Ingress, allowCrossNamespace bool) (string, error) { + // We pass nil fields, as this is an internal process and we don't need to validate it. + annValue, err := parser.GetStringAnnotation(ann, ing, nil) if err != nil { return "", err } @@ -951,6 +962,9 @@ func objectRefAnnotationNsKey(ann string, ing *networkingv1.Ingress) (string, er if secrNs == "" { return fmt.Sprintf("%v/%v", ing.Namespace, secrName), nil } + if !allowCrossNamespace && secrNs != ing.Namespace { + return "", fmt.Errorf("cross namespace secret is not supported") + } return annValue, nil } @@ -1125,6 +1139,17 @@ func (s *k8sStore) GetBackendConfiguration() ngx_config.Configuration { return s.backendConfig } +func (s *k8sStore) GetSecurityConfiguration() defaults.SecurityConfiguration { + s.backendConfigMu.RLock() + defer s.backendConfigMu.RUnlock() + + secConfig := defaults.SecurityConfiguration{ + AllowCrossNamespaceResources: s.backendConfig.AllowCrossNamespaceResources, + AnnotationsRiskLevel: s.backendConfig.AnnotationsRiskLevel, + } + return secConfig +} + func (s *k8sStore) setConfig(cmap *corev1.ConfigMap) { s.backendConfigMu.Lock() defer s.backendConfigMu.Unlock() diff --git a/internal/ingress/controller/store/store_test.go b/internal/ingress/controller/store/store_test.go index b91cadc6c..774a45676 100644 --- a/internal/ingress/controller/store/store_test.go +++ b/internal/ingress/controller/store/store_test.go @@ -1414,18 +1414,31 @@ func TestUpdateSecretIngressMap(t *testing.T) { t.Run("with annotation in namespace/name format", func(t *testing.T) { ing := ingTpl.DeepCopy() ing.ObjectMeta.SetAnnotations(map[string]string{ - parser.GetAnnotationWithPrefix("auth-secret"): "otherns/auth", + parser.GetAnnotationWithPrefix("auth-secret"): "testns/auth", }) if err := s.listers.Ingress.Update(ing); err != nil { t.Errorf("error updating the Ingress: %v", err) } s.updateSecretIngressMap(ing) - if l := s.secretIngressMap.Len(); !(l == 1 && s.secretIngressMap.Has("otherns/auth")) { + if l := s.secretIngressMap.Len(); !(l == 1 && s.secretIngressMap.Has("testns/auth")) { t.Errorf("Expected \"otherns/auth\" to be the only referenced Secret (got %d)", l) } }) + t.Run("with annotation in namespace/name format should not be supported", func(t *testing.T) { + ing := ingTpl.DeepCopy() + ing.ObjectMeta.SetAnnotations(map[string]string{ + parser.GetAnnotationWithPrefix("auth-secret"): "anotherns/auth", + }) + s.listers.Ingress.Update(ing) + s.updateSecretIngressMap(ing) + + if l := s.secretIngressMap.Len(); l != 0 { + t.Errorf("Expected \"otherns/auth\" to be denied as it contains a different namespace (got %d)", l) + } + }) + t.Run("with annotation in invalid format", func(t *testing.T) { ing := ingTpl.DeepCopy() ing.ObjectMeta.SetAnnotations(map[string]string{ diff --git a/internal/ingress/defaults/main.go b/internal/ingress/defaults/main.go index 0aab2ff47..8cd0e8ba5 100644 --- a/internal/ingress/defaults/main.go +++ b/internal/ingress/defaults/main.go @@ -170,3 +170,15 @@ type Backend struct { // It disables that behavior and instead uses a single upstream in NGINX, the service's Cluster IP and port. ServiceUpstream bool `json:"service-upstream"` } + +type SecurityConfiguration struct { + // AllowCrossNamespaceResources enables users to consume cross namespace resource on annotations + // Case disabled, attempts to use secrets or configmaps from a namespace different from Ingress will + // be denied + // This valid will default to `false` on future releases + AllowCrossNamespaceResources bool `json:"allow-cross-namespace-resources"` + + // AnnotationsRiskLevel represents the risk accepted on an annotation. If the risk is, for instance `Medium`, annotations + // with risk High and Critical will not be accepted + AnnotationsRiskLevel string `json:"annotations-risk-level"` +} diff --git a/internal/ingress/errors/errors.go b/internal/ingress/errors/errors.go index 93c9ee5e0..e6f7fb52c 100644 --- a/internal/ingress/errors/errors.go +++ b/internal/ingress/errors/errors.go @@ -110,3 +110,47 @@ func New(m string) error { func Errorf(format string, args ...interface{}) error { return fmt.Errorf(format, args...) } + +type ValidationError struct { + Reason error +} + +type RiskyAnnotationError struct { + Reason error +} + +func (e ValidationError) Error() string { + return e.Reason.Error() +} + +// NewValidationError returns a new LocationDenied error +func NewValidationError(annotation string) error { + return ValidationError{ + Reason: fmt.Errorf("annotation %s contains invalid value", annotation), + } +} + +// IsValidationError checks if the err is an error which +// indicates that some annotation value is invalid +func IsValidationError(e error) bool { + _, ok := e.(ValidationError) + return ok +} + +// NewValidationError returns a new LocationDenied error +func NewRiskyAnnotations(name string) error { + return RiskyAnnotationError{ + Reason: fmt.Errorf("annotation group %s contains risky annotation based on ingress configuration", name), + } +} + +// IsRiskyAnnotationError checks if the err is an error which +// indicates that some annotation value is invalid +func IsRiskyAnnotationError(e error) bool { + _, ok := e.(ValidationError) + return ok +} + +func (e RiskyAnnotationError) Error() string { + return e.Reason.Error() +} diff --git a/internal/ingress/resolver/main.go b/internal/ingress/resolver/main.go index e05a2aaae..7d17f4e16 100644 --- a/internal/ingress/resolver/main.go +++ b/internal/ingress/resolver/main.go @@ -26,6 +26,9 @@ type Resolver interface { // GetDefaultBackend returns the backend that must be used as default GetDefaultBackend() defaults.Backend + // GetSecurityConfiguration returns the configuration options from Ingress + GetSecurityConfiguration() defaults.SecurityConfiguration + // GetConfigMap searches for configmap containing the namespace and name usting the character / GetConfigMap(string) (*apiv1.ConfigMap, error) diff --git a/internal/ingress/resolver/mock.go b/internal/ingress/resolver/mock.go index 62c5c6db9..679c3b13c 100644 --- a/internal/ingress/resolver/mock.go +++ b/internal/ingress/resolver/mock.go @@ -26,7 +26,9 @@ import ( // Mock implements the Resolver interface type Mock struct { - ConfigMaps map[string]*apiv1.ConfigMap + ConfigMaps map[string]*apiv1.ConfigMap + AnnotationsRiskLevel string + AllowCrossNamespace bool } // GetDefaultBackend returns the backend that must be used as default @@ -34,6 +36,17 @@ func (m Mock) GetDefaultBackend() defaults.Backend { return defaults.Backend{} } +func (m Mock) GetSecurityConfiguration() defaults.SecurityConfiguration { + defRisk := m.AnnotationsRiskLevel + if defRisk == "" { + defRisk = "Critical" + } + return defaults.SecurityConfiguration{ + AnnotationsRiskLevel: defRisk, + AllowCrossNamespaceResources: m.AllowCrossNamespace, + } +} + // GetSecret searches for secrets contenating the namespace and name using a the character / func (m Mock) GetSecret(string) (*apiv1.Secret, error) { return nil, nil diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index e50666c18..284e9b427 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -29,8 +29,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/cors" "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" + "k8s.io/ingress-nginx/internal/ingress/annotations/ipallowlist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" - "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" "k8s.io/ingress-nginx/internal/ingress/annotations/log" "k8s.io/ingress-nginx/internal/ingress/annotations/mirror" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" @@ -224,7 +224,7 @@ type Server struct { // is required. // The chain in the execution order of annotations should be: // - Denylist -// - Whitelist +// - Allowlist // - RateLimit // - BasicDigestAuth // - ExternalAuth @@ -298,10 +298,10 @@ type Location struct { // addresses or networks are allowed. // +optional Denylist ipdenylist.SourceRange `json:"denylist,omitempty"` - // Whitelist indicates only connections from certain client + // Allowlist indicates only connections from certain client // addresses or networks are allowed. // +optional - Whitelist ipwhitelist.SourceRange `json:"whitelist,omitempty"` + Allowlist ipallowlist.SourceRange `json:"allowlist,omitempty"` // Proxy contains information about timeouts and buffer sizes // to be used in connections against endpoints // +optional diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index 84b1a186a..c87f5ba3e 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -400,7 +400,7 @@ func (l1 *Location) Equal(l2 *Location) bool { if !(&l1.Denylist).Equal(&l2.Denylist) { return false } - if !(&l1.Whitelist).Equal(&l2.Whitelist) { + if !(&l1.Allowlist).Equal(&l2.Allowlist) { return false } if !(&l1.Proxy).Equal(&l2.Proxy) { diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 489e24886..2c926a35f 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -152,6 +152,9 @@ Requires the update-status parameter.`) annotationsPrefix = flags.String("annotations-prefix", parser.DefaultAnnotationsPrefix, `Prefix of the Ingress annotations specific to the NGINX controller.`) + enableAnnotationValidation = flags.Bool("enable-annotation-validation", false, + `If true, will enable the annotation validation feature. This value will be defaulted to true on a future release`) + enableSSLChainCompletion = flags.Bool("enable-ssl-chain-completion", false, `Autocomplete SSL certificate chains with missing intermediate CA certificates. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 @@ -249,6 +252,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g } parser.AnnotationsPrefix = *annotationsPrefix + parser.EnableAnnotationValidation = *enableAnnotationValidation // check port collisions if !ing_net.IsPortAvailable(*httpPort) { diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 189c13d6c..02b5309cd 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -548,14 +548,14 @@ http { {{ range $rl := (filterRateLimits $servers ) }} # Ratelimit {{ $rl.Name }} - geo $remote_addr $whitelist_{{ $rl.ID }} { + geo $remote_addr $allowlist_{{ $rl.ID }} { default 0; - {{ range $ip := $rl.Whitelist }} + {{ range $ip := $rl.Allowlist }} {{ $ip }} 1;{{ end }} } # Ratelimit {{ $rl.Name }} - map $whitelist_{{ $rl.ID }} $limit_{{ $rl.ID }} { + map $allowlist_{{ $rl.ID }} $limit_{{ $rl.ID }} { 0 {{ $cfg.LimitConnZoneVariable }}; 1 ""; } @@ -1312,8 +1312,8 @@ stream { {{ range $ip := $location.Denylist.CIDR }} deny {{ $ip }};{{ end }} {{ end }} - {{ if gt (len $location.Whitelist.CIDR) 0 }} - {{ range $ip := $location.Whitelist.CIDR }} + {{ if gt (len $location.Allowlist.CIDR) 0 }} + {{ range $ip := $location.Allowlist.CIDR }} allow {{ $ip }};{{ end }} deny all; {{ end }} diff --git a/test/e2e-image/namespace-overlays/validations/values.yaml b/test/e2e-image/namespace-overlays/validations/values.yaml new file mode 100644 index 000000000..d423217db --- /dev/null +++ b/test/e2e-image/namespace-overlays/validations/values.yaml @@ -0,0 +1,38 @@ +# TODO: remove the need to use fullnameOverride +fullnameOverride: nginx-ingress +controller: + image: + repository: ingress-controller/controller + chroot: true + tag: 1.0.0-dev + digest: + digestChroot: + containerPort: + http: "1080" + https: "1443" + + extraArgs: + http-port: "1080" + https-port: "1443" + # e2e tests do not require information about ingress status + update-status: "false" + + scope: + enabled: true + + config: + worker-processes: "1" + service: + type: NodePort + + admissionWebhooks: + enabled: true + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + +defaultBackend: + enabled: false + +rbac: + create: true + scope: true diff --git a/test/e2e/annotations/fastcgi.go b/test/e2e/annotations/fastcgi.go index 572eca548..7ed35cb76 100644 --- a/test/e2e/annotations/fastcgi.go +++ b/test/e2e/annotations/fastcgi.go @@ -75,7 +75,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { Namespace: f.Namespace, }, Data: map[string]string{ - "SCRIPT_FILENAME": "/home/www/scripts/php$fastcgi_script_name", + "SCRIPT_FILENAME": "$fastcgi_script_name", "REDIRECT_STATUS": "200", }, } @@ -94,7 +94,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { f.WaitForNginxServer(host, func(server string) bool { - return strings.Contains(server, "fastcgi_param SCRIPT_FILENAME \"/home/www/scripts/php$fastcgi_script_name\";") && + return strings.Contains(server, "fastcgi_param SCRIPT_FILENAME \"$fastcgi_script_name\";") && strings.Contains(server, "fastcgi_param REDIRECT_STATUS \"200\";") }) }) diff --git a/test/e2e/annotations/ipwhitelist.go b/test/e2e/annotations/ipallowlist.go similarity index 81% rename from test/e2e/annotations/ipwhitelist.go rename to test/e2e/annotations/ipallowlist.go index 71f026c7f..79c77b4d0 100644 --- a/test/e2e/annotations/ipwhitelist.go +++ b/test/e2e/annotations/ipallowlist.go @@ -24,19 +24,19 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var _ = framework.DescribeAnnotation("whitelist-source-range", func() { - f := framework.NewDefaultFramework("ipwhitelist") +var _ = framework.DescribeAnnotation("allowlist-source-range", func() { + f := framework.NewDefaultFramework("ipallowlist") ginkgo.BeforeEach(func() { f.NewEchoDeployment() }) - ginkgo.It("should set valid ip whitelist range", func() { - host := "ipwhitelist.foo.com" + ginkgo.It("should set valid ip allowlist range", func() { + host := "ipallowlist.foo.com" nameSpace := f.Namespace annotations := map[string]string{ - "nginx.ingress.kubernetes.io/whitelist-source-range": "18.0.0.0/8, 56.0.0.0/8", + "nginx.ingress.kubernetes.io/allowlist-source-range": "18.0.0.0/8, 56.0.0.0/8", } ing := framework.NewSingleIngress(host, "/", host, nameSpace, framework.EchoService, 80, annotations) diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 614dd166a..28adf297d 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -47,6 +47,8 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/settings" _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" + _ "k8s.io/ingress-nginx/test/e2e/settings/validations" + _ "k8s.io/ingress-nginx/test/e2e/ssl" _ "k8s.io/ingress-nginx/test/e2e/status" _ "k8s.io/ingress-nginx/test/e2e/tcpudp" diff --git a/test/e2e/framework/exec.go b/test/e2e/framework/exec.go index d91d36551..07bf09be8 100644 --- a/test/e2e/framework/exec.go +++ b/test/e2e/framework/exec.go @@ -116,7 +116,12 @@ func (f *Framework) newIngressController(namespace string, namespaceOverlay stri if !ok { isChroot = "false" } - cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay, isChroot) + + enableAnnotationValidations, ok := os.LookupEnv("ENABLE_VALIDATIONS") + if !ok { + enableAnnotationValidations = "false" + } + cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay, isChroot, enableAnnotationValidations) out, err := cmd.CombinedOutput() if err != nil { return fmt.Errorf("unexpected error waiting for ingress controller deployment: %v.\nLogs:\n%v", err, string(out)) diff --git a/test/e2e/run-e2e-suite.sh b/test/e2e/run-e2e-suite.sh index b56312afd..015895e56 100755 --- a/test/e2e/run-e2e-suite.sh +++ b/test/e2e/run-e2e-suite.sh @@ -78,6 +78,7 @@ kubectl run --rm \ --env="E2E_NODES=${E2E_NODES}" \ --env="FOCUS=${FOCUS}" \ --env="IS_CHROOT=${IS_CHROOT:-false}"\ + --env="ENABLE_VALIDATIONS=${ENABLE_VALIDATIONS:-false}"\ --env="E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS}" \ --env="NGINX_BASE_IMAGE=${NGINX_BASE_IMAGE}" \ --env="HTTPBUN_IMAGE=${HTTPBUN_IMAGE}" \ diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index e6e4e086b..4dc1bddd0 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -39,6 +39,7 @@ fi KIND_LOG_LEVEL="1" IS_CHROOT="${IS_CHROOT:-false}" +ENABLE_VALIDATIONS="${ENABLE_VALIDATIONS:-false}" export KIND_CLUSTER_NAME=${KIND_CLUSTER_NAME:-ingress-nginx-dev} DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" # Use 1.0.0-dev to make sure we use the latest configuration in the helm template diff --git a/test/e2e/settings/validations/validations.go b/test/e2e/settings/validations/validations.go new file mode 100644 index 000000000..6f1715ada --- /dev/null +++ b/test/e2e/settings/validations/validations.go @@ -0,0 +1,86 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package annotations + +import ( + "context" + + "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "k8s.io/ingress-nginx/test/e2e/framework" +) + +var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { + f := framework.NewDefaultFramework("validations") + + ginkgo.It("should allow ingress based on their risk on webhooks", func() { + host := "annotation-validations" + + // Low and Medium Risk annotations should be allowed, the rest should be denied + f.UpdateNginxConfigMapData("annotations-risk-level", "Medium") + // Sleep a while just to guarantee that the configmap is applied + framework.Sleep() + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/default-backend": "default/bla", // low risk + "nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk + } + + ginkgo.By("allow ingress with low/medium risk annotations") + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "creating ingress with allowed annotations should not trigger an error") + + ginkgo.By("block ingress with risky annotations") + annotations["nginx.ingress.kubernetes.io/modsecurity-transaction-id"] = "bla123" // High should be blocked + annotations["nginx.ingress.kubernetes.io/modsecurity-snippet"] = "some random stuff;" // High should be blocked + ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) + assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") + + }) + + ginkgo.It("should allow ingress based on their risk on webhooks", func() { + host := "annotation-validations" + + // Low and Medium Risk annotations should be allowed, the rest should be denied + f.UpdateNginxConfigMapData("annotations-risk-level", "Medium") + // Sleep a while just to guarantee that the configmap is applied + framework.Sleep() + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/default-backend": "default/bla", // low risk + "nginx.ingress.kubernetes.io/denylist-source-range": "1.1.1.1/32", // medium risk + } + + ginkgo.By("allow ingress with low/medium risk annotations") + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "creating ingress with allowed annotations should not trigger an error") + + ginkgo.By("block ingress with risky annotations") + annotations["nginx.ingress.kubernetes.io/modsecurity-transaction-id"] = "bla123" // High should be blocked + annotations["nginx.ingress.kubernetes.io/modsecurity-snippet"] = "some random stuff;" // High should be blocked + ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) + assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") + + }) +}) diff --git a/test/e2e/wait-for-nginx.sh b/test/e2e/wait-for-nginx.sh index 153d348c2..0726bde10 100755 --- a/test/e2e/wait-for-nginx.sh +++ b/test/e2e/wait-for-nginx.sh @@ -24,6 +24,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" export NAMESPACE=$1 export NAMESPACE_OVERLAY=$2 export IS_CHROOT=$3 +export ENABLE_VALIDATIONS=$4 echo "deploying NGINX Ingress controller in namespace $NAMESPACE" @@ -68,6 +69,7 @@ else # TODO: remove the need to use fullnameOverride fullnameOverride: nginx-ingress controller: + enableAnnotationValidations: ${ENABLE_VALIDATIONS} image: repository: ingress-controller/controller chroot: ${IS_CHROOT} From ee9c6246f25799677a67a93c4913a70cf756c174 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Mon, 24 Jul 2023 23:26:13 +0800 Subject: [PATCH 293/822] Add rolling update strategy to each static deployment file (#10129) * Add rollingUpdate strategy to each static deployment file Signed-off-by: z1cheng * Update the templates and regenerate Signed-off-by: z1cheng * Upgrade k8s version and add rolling update for exoscale Signed-off-by: z1cheng * Add rolling update strategy to Oracle template Signed-off-by: z1cheng * Revert the k8s version in generate-deploy-scripts.sh Signed-off-by: z1cheng --------- Signed-off-by: z1cheng --- deploy/static/provider/aws/deploy.yaml | 4 ++++ .../static/provider/aws/nlb-with-tls-termination/deploy.yaml | 4 ++++ deploy/static/provider/baremetal/deploy.yaml | 4 ++++ deploy/static/provider/cloud/deploy.yaml | 4 ++++ deploy/static/provider/do/deploy.yaml | 4 ++++ deploy/static/provider/exoscale/deploy.yaml | 4 ++++ deploy/static/provider/oracle/deploy.yaml | 4 ++++ deploy/static/provider/scw/deploy.yaml | 4 ++++ .../provider/aws/nlb-with-tls-termination/values.yaml | 4 ++++ hack/manifest-templates/provider/aws/values.yaml | 4 ++++ hack/manifest-templates/provider/baremetal/values.yaml | 4 ++++ hack/manifest-templates/provider/cloud/values.yaml | 4 ++++ hack/manifest-templates/provider/do/values.yaml | 4 ++++ hack/manifest-templates/provider/exoscale/values.yaml | 4 ++++ hack/manifest-templates/provider/oracle/values.yaml | 4 ++++ hack/manifest-templates/provider/scw/values.yaml | 4 ++++ 16 files changed, 64 insertions(+) diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index f22f3a9c1..2c785fab2 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -411,6 +411,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index e9ae85143..7eb2a4c12 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -420,6 +420,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index b66da7d45..ba5b71838 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -406,6 +406,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 659da1d1b..0bb95331f 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -407,6 +407,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 434f21ead..9ef7f86ee 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -410,6 +410,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index c9dff62cb..d09c9bbb4 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -510,6 +510,10 @@ spec: - name: webhook-cert secret: secretName: ingress-nginx-admission + updateStrategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate --- apiVersion: batch/v1 kind: Job diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index 72556bb42..4c93acfb2 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -411,6 +411,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 8b4750992..a57ef5ded 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -410,6 +410,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: diff --git a/hack/manifest-templates/provider/aws/nlb-with-tls-termination/values.yaml b/hack/manifest-templates/provider/aws/nlb-with-tls-termination/values.yaml index 5b36b3dd2..46f8417c7 100644 --- a/hack/manifest-templates/provider/aws/nlb-with-tls-termination/values.yaml +++ b/hack/manifest-templates/provider/aws/nlb-with-tls-termination/values.yaml @@ -1,5 +1,9 @@ # AWS NLB with TLS termination controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/aws/values.yaml b/hack/manifest-templates/provider/aws/values.yaml index 743721fc4..37eac03c2 100644 --- a/hack/manifest-templates/provider/aws/values.yaml +++ b/hack/manifest-templates/provider/aws/values.yaml @@ -1,5 +1,9 @@ # AWS - NLB controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/baremetal/values.yaml b/hack/manifest-templates/provider/baremetal/values.yaml index 3c5a0840b..205a7430c 100644 --- a/hack/manifest-templates/provider/baremetal/values.yaml +++ b/hack/manifest-templates/provider/baremetal/values.yaml @@ -1,5 +1,9 @@ # Baremetal controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: NodePort diff --git a/hack/manifest-templates/provider/cloud/values.yaml b/hack/manifest-templates/provider/cloud/values.yaml index 7d8266c0f..edc5662dd 100644 --- a/hack/manifest-templates/provider/cloud/values.yaml +++ b/hack/manifest-templates/provider/cloud/values.yaml @@ -1,4 +1,8 @@ controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/do/values.yaml b/hack/manifest-templates/provider/do/values.yaml index 2b0578414..aeee47ad6 100644 --- a/hack/manifest-templates/provider/do/values.yaml +++ b/hack/manifest-templates/provider/do/values.yaml @@ -1,5 +1,9 @@ # Digital Ocean controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/exoscale/values.yaml b/hack/manifest-templates/provider/exoscale/values.yaml index 17458cac9..867ecc57e 100644 --- a/hack/manifest-templates/provider/exoscale/values.yaml +++ b/hack/manifest-templates/provider/exoscale/values.yaml @@ -1,6 +1,10 @@ # Exoscale controller: kind: DaemonSet + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/oracle/values.yaml b/hack/manifest-templates/provider/oracle/values.yaml index b4480531f..600dbfe5c 100644 --- a/hack/manifest-templates/provider/oracle/values.yaml +++ b/hack/manifest-templates/provider/oracle/values.yaml @@ -1,4 +1,8 @@ controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local diff --git a/hack/manifest-templates/provider/scw/values.yaml b/hack/manifest-templates/provider/scw/values.yaml index cee5e2b1e..56d351dcd 100644 --- a/hack/manifest-templates/provider/scw/values.yaml +++ b/hack/manifest-templates/provider/scw/values.yaml @@ -1,5 +1,9 @@ # Scaleway controller: + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 service: type: LoadBalancer externalTrafficPolicy: Local From 0ec08bd1d06a2fbb797e6ee9116102599ad9f0e1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Jul 2023 10:22:13 -0700 Subject: [PATCH 294/822] Bump github.com/opencontainers/runc from 1.1.7 to 1.1.8 (#10244) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.7 to 1.1.8. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.8/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.7...v1.1.8) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8864e3a83..13d0fcf04 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 github.com/onsi/ginkgo/v2 v2.9.5 - github.com/opencontainers/runc v1.1.7 + github.com/opencontainers/runc v1.1.8 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.16.0 github.com/prometheus/client_model v0.4.0 diff --git a/go.sum b/go.sum index acd310e3a..6e1495776 100644 --- a/go.sum +++ b/go.sum @@ -289,8 +289,8 @@ github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3Ro github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= -github.com/opencontainers/runc v1.1.7 h1:y2EZDS8sNng4Ksf0GUYNhKbTShZJPJg1FiXJNH/uoCk= -github.com/opencontainers/runc v1.1.7/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= +github.com/opencontainers/runc v1.1.8 h1:zICRlc+C1XzivLc3nzE+cbJV4LIi8tib6YG0MqC6OqA= +github.com/opencontainers/runc v1.1.8/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= From afd1311f8529c21fdf6621bf683bec814e698f1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan-Otto=20Kr=C3=B6pke?= Date: Fri, 28 Jul 2023 13:41:56 +0200 Subject: [PATCH 295/822] [helm] configure allow to configure hostAliases (#10180) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jan-Otto Kröpke --- charts/ingress-nginx/README.md | 1 + charts/ingress-nginx/templates/controller-deployment.yaml | 3 +++ charts/ingress-nginx/values.yaml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 17547912d..6288da3e3 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -307,6 +307,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. | | controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. | | controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. | +| controller.hostAliases | object | `{}` | Optionally customize the pod hostAliases. | | controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged | | controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not | | controller.hostPort.ports.http | int | `80` | 'hostPort' http port | diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index c4a1a37e1..537c3feef 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -49,6 +49,9 @@ spec: {{- if .Values.controller.dnsConfig }} dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} {{- end }} + {{- if .Values.controller.hostAliases }} + hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} + {{- end }} {{- if .Values.controller.hostname }} hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 1cd74dad0..8205b3506 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -49,6 +49,8 @@ controller: addHeaders: {} # -- Optionally customize the pod dnsConfig. dnsConfig: {} + # -- Optionally customize the pod hostAliases. + hostAliases: {} # -- Optionally customize the pod hostname. hostname: {} # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. From 3baa591bb5720c8009b1f575e83b913533d7bc98 Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Wed, 2 Aug 2023 12:34:49 +0200 Subject: [PATCH 296/822] promote distroless otel init image (#10257) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/templates/controller-deployment.yaml | 2 +- charts/ingress-nginx/values.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 6288da3e3..c9ce4e3bc 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -377,7 +377,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | | controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | controller.opentelemetry.enabled | bool | `false` | | -| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0"` | | +| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472"` | | | controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # | | controller.podLabels | object | `{}` | Labels to add to the pod container metadata | | controller.podSecurityContext | object | `{}` | Security Context policies for controller pods | diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 537c3feef..69cb734a0 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -193,7 +193,7 @@ spec: {{- end }} {{- if .Values.controller.opentelemetry.enabled}} {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" false) | nindent 8}} + {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" true) | nindent 8}} {{- end}} {{- end }} {{- if .Values.controller.hostNetwork }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 8205b3506..3b156a6bf 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -556,7 +556,7 @@ controller: opentelemetry: enabled: false - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0 + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472 containerSecurityContext: allowPrivilegeEscalation: false admissionWebhooks: From d712dd9d92f1f46eab5f55d4643f3a45a7a97f90 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 2 Aug 2023 10:12:42 -0400 Subject: [PATCH 297/822] test kind updates (#10272) Signed-off-by: James Strong --- .github/workflows/ci.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 453775379..5c08ba0da 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -207,7 +207,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] + k8s: [v1.24.15, v1.25.11, v1.26.6, v1.27.3] steps: - name: Checkout @@ -282,7 +282,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] + k8s: [v1.24.15, v1.25.11, v1.26.6, v1.27.3] steps: - name: Checkout @@ -330,7 +330,7 @@ jobs: strategy: matrix: - k8s: [v1.27.1] + k8s: [v1.24.15, v1.25.11, v1.26.6, v1.27.3] steps: - name: Checkout @@ -380,7 +380,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] + k8s: [v1.24.15, v1.25.11, v1.26.6, v1.27.3] steps: @@ -498,7 +498,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] + k8s: [v1.24.15, v1.25.11, v1.26.6, v1.27.3] steps: - name: Checkout From e8b8778f74b4b01c56398147844370e78f2047c3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Aug 2023 05:52:31 -0700 Subject: [PATCH 298/822] Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#10280) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0. - [Commits](https://github.com/golang/crypto/compare/v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 13d0fcf04..1579513bc 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.11.0 + golang.org/x/crypto v0.12.0 google.golang.org/grpc v1.56.2 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -103,9 +103,9 @@ require ( golang.org/x/mod v0.10.0 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/sys v0.10.0 // indirect - golang.org/x/term v0.10.0 // indirect - golang.org/x/text v0.11.0 // indirect + golang.org/x/sys v0.11.0 // indirect + golang.org/x/term v0.11.0 // indirect + golang.org/x/text v0.12.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index 6e1495776..a6ae8cdcf 100644 --- a/go.sum +++ b/go.sum @@ -390,8 +390,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= -golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= +golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk= +golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -524,19 +524,19 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= -golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM= +golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= -golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= +golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0= +golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= -golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc= +golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From 5d8185c9d725359de3fd6f2f77bfdd3e8bc44c8d Mon Sep 17 00:00:00 2001 From: Gabor Lekeny Date: Mon, 7 Aug 2023 15:16:32 +0200 Subject: [PATCH 299/822] Handle request_id variable correctly in auth requests (#9219) * Handle $request_id variable correctly in auth requests * Make share_all_vars configurable * Fix test name --- .../nginx-configuration/annotations.md | 4 ++ internal/ingress/annotations/authreq/main.go | 48 +++++++++++++------ .../ingress/annotations/authreq/main_test.go | 29 ++++++----- rootfs/etc/nginx/template/nginx.tmpl | 2 +- test/e2e/annotations/auth.go | 39 +++++++++++++++ 5 files changed, 96 insertions(+), 26 deletions(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index 0916b4df5..877654d12 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -33,6 +33,7 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz |[nginx.ingress.kubernetes.io/auth-cache-key](#external-authentication)|string| |[nginx.ingress.kubernetes.io/auth-cache-duration](#external-authentication)|string| |[nginx.ingress.kubernetes.io/auth-keepalive](#external-authentication)|number| +|[nginx.ingress.kubernetes.io/auth-keepalive-share-vars](#external-authentication)|"true" or "false"| |[nginx.ingress.kubernetes.io/auth-keepalive-requests](#external-authentication)|number| |[nginx.ingress.kubernetes.io/auth-keepalive-timeout](#external-authentication)|number| |[nginx.ingress.kubernetes.io/auth-proxy-set-headers](#external-authentication)|string| @@ -467,6 +468,9 @@ Additionally it is possible to set: > Note: does not work with HTTP/2 listener because of a limitation in Lua [subrequests](https://github.com/openresty/lua-nginx-module#spdy-mode-not-fully-supported). > [UseHTTP2](./configmap.md#use-http2) configuration should be disabled! +* `nginx.ingress.kubernetes.io/auth-keepalive-share-vars`: + Whether to share Nginx variables among the current request and the auth request. Example use case is to track requests: when set to "true" X-Request-ID HTTP header will be the same for the backend and the auth request. + Defaults to "false". * `nginx.ingress.kubernetes.io/auth-keepalive-requests`: `` to specify the maximum number of requests that can be served through one keepalive connection. Defaults to `1000` and only applied if `auth-keepalive` is set to higher than `0`. diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go index 2ab98ace0..b8ba4f125 100644 --- a/internal/ingress/annotations/authreq/main.go +++ b/internal/ingress/annotations/authreq/main.go @@ -33,20 +33,21 @@ import ( ) const ( - authReqURLAnnotation = "auth-url" - authReqMethodAnnotation = "auth-method" - authReqSigninAnnotation = "auth-signin" - authReqSigninRedirParamAnnotation = "auth-signin-redirect-param" - authReqSnippetAnnotation = "auth-snippet" - authReqCacheKeyAnnotation = "auth-cache-key" - authReqKeepaliveAnnotation = "auth-keepalive" - authReqKeepaliveRequestsAnnotation = "auth-keepalive-requests" - authReqKeepaliveTimeout = "auth-keepalive-timeout" - authReqCacheDuration = "auth-cache-duration" - authReqResponseHeadersAnnotation = "auth-response-headers" - authReqProxySetHeadersAnnotation = "auth-proxy-set-headers" - authReqRequestRedirectAnnotation = "auth-request-redirect" - authReqAlwaysSetCookieAnnotation = "auth-always-set-cookie" + authReqURLAnnotation = "auth-url" + authReqMethodAnnotation = "auth-method" + authReqSigninAnnotation = "auth-signin" + authReqSigninRedirParamAnnotation = "auth-signin-redirect-param" + authReqSnippetAnnotation = "auth-snippet" + authReqCacheKeyAnnotation = "auth-cache-key" + authReqKeepaliveAnnotation = "auth-keepalive" + authReqKeepaliveShareVarsAnnotation = "auth-keepalive-share-vars" + authReqKeepaliveRequestsAnnotation = "auth-keepalive-requests" + authReqKeepaliveTimeout = "auth-keepalive-timeout" + authReqCacheDuration = "auth-cache-duration" + authReqResponseHeadersAnnotation = "auth-response-headers" + authReqProxySetHeadersAnnotation = "auth-proxy-set-headers" + authReqRequestRedirectAnnotation = "auth-request-redirect" + authReqAlwaysSetCookieAnnotation = "auth-always-set-cookie" // This should be exported as it is imported by other packages AuthSecretAnnotation = "auth-secret" @@ -97,6 +98,12 @@ var authReqAnnotations = parser.Annotation{ Risk: parser.AnnotationRiskLow, Documentation: `This annotation specifies the maximum number of keepalive connections to auth-url. Only takes effect when no variables are used in the host part of the URL`, }, + authReqKeepaliveShareVarsAnnotation: { + Validator: parser.ValidateBool, + Scope: parser.AnnotationScopeLocation, + Risk: parser.AnnotationRiskLow, + Documentation: `This annotation specifies whether to share Nginx variables among the current request and the auth request`, + }, authReqKeepaliveRequestsAnnotation: { Validator: parser.ValidateInt, Scope: parser.AnnotationScopeLocation, @@ -158,6 +165,7 @@ type Config struct { AuthCacheKey string `json:"authCacheKey"` AuthCacheDuration []string `json:"authCacheDuration"` KeepaliveConnections int `json:"keepaliveConnections"` + KeepaliveShareVars bool `json:"keepaliveShareVars"` KeepaliveRequests int `json:"keepaliveRequests"` KeepaliveTimeout int `json:"keepaliveTimeout"` ProxySetHeaders map[string]string `json:"proxySetHeaders,omitempty"` @@ -170,6 +178,7 @@ const DefaultCacheDuration = "200 202 401 5m" // fallback values when no keepalive parameters are set const ( defaultKeepaliveConnections = 0 + defaultKeepaliveShareVars = false defaultKeepaliveRequests = 1000 defaultKeepaliveTimeout = 60 ) @@ -218,6 +227,10 @@ func (e1 *Config) Equal(e2 *Config) bool { return false } + if e1.KeepaliveShareVars != e2.KeepaliveShareVars { + return false + } + if e1.KeepaliveRequests != e2.KeepaliveRequests { return false } @@ -357,6 +370,12 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { } } + keepaliveShareVars, err := parser.GetBoolAnnotation(authReqKeepaliveShareVarsAnnotation, ing, a.annotationConfig.Annotations) + if err != nil { + klog.V(3).InfoS("auth-keepalive-share-vars annotation is undefined and will be set to its default value") + keepaliveShareVars = defaultKeepaliveShareVars + } + keepaliveRequests, err := parser.GetIntAnnotation(authReqKeepaliveRequestsAnnotation, ing, a.annotationConfig.Annotations) if err != nil { klog.V(3).InfoS("auth-keepalive-requests annotation is undefined or invalid and will be set to its default value") @@ -467,6 +486,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { AuthCacheKey: authCacheKey, AuthCacheDuration: authCacheDuration, KeepaliveConnections: keepaliveConnections, + KeepaliveShareVars: keepaliveShareVars, KeepaliveRequests: keepaliveRequests, KeepaliveTimeout: keepaliveTimeout, ProxySetHeaders: proxySetHeaders, diff --git a/internal/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go index 833bebe78..dc5188c8a 100644 --- a/internal/ingress/annotations/authreq/main_test.go +++ b/internal/ingress/annotations/authreq/main_test.go @@ -268,28 +268,31 @@ func TestKeepaliveAnnotations(t *testing.T) { title string url string keepaliveConnections string + keepaliveShareVars string keepaliveRequests string keepaliveTimeout string expectedConnections int + expectedShareVars bool expectedRequests int expectedTimeout int }{ - {"all set", "http://goog.url", "5", "500", "50", 5, 500, 50}, - {"no annotation", "http://goog.url", "", "", "", defaultKeepaliveConnections, defaultKeepaliveRequests, defaultKeepaliveTimeout}, - {"default for connections", "http://goog.url", "x", "500", "50", defaultKeepaliveConnections, 500, 50}, - {"default for requests", "http://goog.url", "5", "x", "50", 5, defaultKeepaliveRequests, 50}, - {"default for invalid timeout", "http://goog.url", "5", "500", "x", 5, 500, defaultKeepaliveTimeout}, - {"variable in host", "http://$host:5000/a/b", "5", "", "", 0, defaultKeepaliveRequests, defaultKeepaliveTimeout}, - {"variable in path", "http://goog.url:5000/$path", "5", "", "", 5, defaultKeepaliveRequests, defaultKeepaliveTimeout}, - {"negative connections", "http://goog.url", "-2", "", "", 0, defaultKeepaliveRequests, defaultKeepaliveTimeout}, - {"negative requests", "http://goog.url", "5", "-1", "", 0, -1, defaultKeepaliveTimeout}, - {"negative timeout", "http://goog.url", "5", "", "-1", 0, defaultKeepaliveRequests, -1}, - {"negative request and timeout", "http://goog.url", "5", "-2", "-3", 0, -2, -3}, + {"all set", "http://goog.url", "5", "false", "500", "50", 5, false, 500, 50}, + {"no annotation", "http://goog.url", "", "", "", "", defaultKeepaliveConnections, defaultKeepaliveShareVars, defaultKeepaliveRequests, defaultKeepaliveTimeout}, + {"default for connections", "http://goog.url", "x", "true", "500", "50", defaultKeepaliveConnections, true, 500, 50}, + {"default for requests", "http://goog.url", "5", "x", "dummy", "50", 5, defaultKeepaliveShareVars, defaultKeepaliveRequests, 50}, + {"default for invalid timeout", "http://goog.url", "5", "t", "500", "x", 5, true, 500, defaultKeepaliveTimeout}, + {"variable in host", "http://$host:5000/a/b", "5", "1", "", "", 0, true, defaultKeepaliveRequests, defaultKeepaliveTimeout}, + {"variable in path", "http://goog.url:5000/$path", "5", "t", "", "", 5, true, defaultKeepaliveRequests, defaultKeepaliveTimeout}, + {"negative connections", "http://goog.url", "-2", "f", "", "", 0, false, defaultKeepaliveRequests, defaultKeepaliveTimeout}, + {"negative requests", "http://goog.url", "5", "True", "-1", "", 0, true, -1, defaultKeepaliveTimeout}, + {"negative timeout", "http://goog.url", "5", "0", "", "-1", 0, false, defaultKeepaliveRequests, -1}, + {"negative request and timeout", "http://goog.url", "5", "False", "-2", "-3", 0, false, -2, -3}, } for _, test := range tests { data[parser.GetAnnotationWithPrefix("auth-url")] = test.url data[parser.GetAnnotationWithPrefix("auth-keepalive")] = test.keepaliveConnections + data[parser.GetAnnotationWithPrefix("auth-keepalive-share-vars")] = test.keepaliveShareVars data[parser.GetAnnotationWithPrefix("auth-keepalive-timeout")] = test.keepaliveTimeout data[parser.GetAnnotationWithPrefix("auth-keepalive-requests")] = test.keepaliveRequests @@ -313,6 +316,10 @@ func TestKeepaliveAnnotations(t *testing.T) { t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.expectedConnections, u.KeepaliveConnections) } + if u.KeepaliveShareVars != test.expectedShareVars { + t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.expectedShareVars, u.KeepaliveShareVars) + } + if u.KeepaliveRequests != test.expectedRequests { t.Errorf("%v: expected \"%v\" but \"%v\" was returned", test.title, test.expectedRequests, u.KeepaliveRequests) } diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 02b5309cd..0f44efc3d 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -1334,7 +1334,7 @@ stream { # `auth_request` module does not support HTTP keepalives in upstream block: # https://trac.nginx.org/nginx/ticket/1579 access_by_lua_block { - local res = ngx.location.capture('{{ $authPath }}', { method = ngx.HTTP_GET, body = '' }) + local res = ngx.location.capture('{{ $authPath }}', { method = ngx.HTTP_GET, body = '', share_all_vars = {{ $externalAuth.KeepaliveShareVars }} }) if res.status == ngx.HTTP_OK then ngx.var.auth_cookie = res.header['Set-Cookie'] {{- range $line := buildAuthUpstreamLuaHeaders $externalAuth.ResponseHeaders }} diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 8011186a1..56246828a 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -628,6 +628,45 @@ http { strings.Contains(server, `keepalive_timeout 789s;`) }) }) + + ginkgo.It(`should disable set_all_vars when auth-keepalive-share-vars is not set`, func() { + f.UpdateNginxConfigMapData("use-http2", "false") + defer func() { + f.UpdateNginxConfigMapData("use-http2", "true") + }() + // Sleep a while just to guarantee that the configmap is applied + framework.Sleep() + + annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "10" + f.UpdateIngress(ing) + + f.WaitForNginxServer("", + func(server string) bool { + return strings.Contains(server, `upstream auth-external-auth`) && + strings.Contains(server, `keepalive 10;`) && + strings.Contains(server, `share_all_vars = false`) + }) + }) + + ginkgo.It(`should enable set_all_vars when auth-keepalive-share-vars is true`, func() { + f.UpdateNginxConfigMapData("use-http2", "false") + defer func() { + f.UpdateNginxConfigMapData("use-http2", "true") + }() + // Sleep a while just to guarantee that the configmap is applied + framework.Sleep() + + annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "10" + annotations["nginx.ingress.kubernetes.io/auth-keepalive-share-vars"] = "true" + f.UpdateIngress(ing) + + f.WaitForNginxServer("", + func(server string) bool { + return strings.Contains(server, `upstream auth-external-auth`) && + strings.Contains(server, `keepalive 10;`) && + strings.Contains(server, `share_all_vars = true`) + }) + }) }) ginkgo.Context("when external authentication is configured with a custom redirect param", func() { From 42610df2a31a3be9bad9c73b76ed76764edc95fd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Aug 2023 07:05:28 -0700 Subject: [PATCH 300/822] Bump google.golang.org/grpc from 1.56.2 to 1.57.0 (#10258) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.2 to 1.57.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.56.2...v1.57.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 1579513bc..0ba9fa71b 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.12.0 - google.golang.org/grpc v1.56.2 + google.golang.org/grpc v1.57.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 @@ -109,7 +109,7 @@ require ( golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 // indirect google.golang.org/protobuf v1.30.0 // indirect gopkg.in/go-playground/assert.v1 v1.2.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index a6ae8cdcf..5ecec5625 100644 --- a/go.sum +++ b/go.sum @@ -647,8 +647,8 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A= -google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19 h1:0nDDozoAU19Qb2HwhXadU8OcsiO/09cnTqhUtq2MEOM= +google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -661,8 +661,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.56.2 h1:fVRFRnXvU+x6C4IlHZewvJOVHoOv1TUuQyoRsYnB4bI= -google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= +google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw= +google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 411edd717ba96cfc8f7584596bcb6b2b68e24310 Mon Sep 17 00:00:00 2001 From: Altif Date: Fri, 11 Aug 2023 19:37:27 +0530 Subject: [PATCH 301/822] Updated index.md - Fix typos (#10256) --- docs/examples/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/examples/index.md b/docs/examples/index.md index 3af4266ff..59745e014 100644 --- a/docs/examples/index.md +++ b/docs/examples/index.md @@ -23,7 +23,7 @@ Customization | [External authentication with response header propagation](custo Customization | [Sysctl tuning](customization/sysctl/README.md) | TODO | TODO Features | [Rewrite](rewrite/README.md) | TODO | TODO Features | [Session stickiness](affinity/cookie/README.md) | route requests consistently to the same endpoint | Advanced -Features | [Canary Deployments](canary/README.md) | weigthed canary routing to a seperate deployment | Intermediate +Features | [Canary Deployments](canary/README.md) | weighted canary routing to a seperate deployment | Intermediate Scaling | [Static IP](static-ip/README.md) | a single ingress gets a single static IP | Intermediate TLS | [Multi TLS certificate termination](multi-tls/README.md) | TODO | TODO TLS | [TLS termination](tls-termination/README.md) | TODO | TODO From e17927ba52e852c3a604f257838ad1c00a2a8e86 Mon Sep 17 00:00:00 2001 From: Kazuki Suda <230185+superbrothers@users.noreply.github.com> Date: Fri, 11 Aug 2023 23:09:27 +0900 Subject: [PATCH 302/822] helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) Signed-off-by: Kazuki Suda --- charts/ingress-nginx/templates/controller-servicemonitor.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/ingress-nginx/templates/controller-servicemonitor.yaml b/charts/ingress-nginx/templates/controller-servicemonitor.yaml index 8ab16f0b2..482fe7f3c 100644 --- a/charts/ingress-nginx/templates/controller-servicemonitor.yaml +++ b/charts/ingress-nginx/templates/controller-servicemonitor.yaml @@ -5,6 +5,8 @@ metadata: name: {{ include "ingress-nginx.controller.fullname" . }} {{- if .Values.controller.metrics.serviceMonitor.namespace }} namespace: {{ .Values.controller.metrics.serviceMonitor.namespace | quote }} +{{- else }} + namespace: {{ .Release.Namespace }} {{- end }} labels: {{- include "ingress-nginx.labels" . | nindent 4 }} From 868df87bb31478fe239e3cd426eb6c1d4bb3ae04 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Fri, 11 Aug 2023 22:11:27 +0800 Subject: [PATCH 303/822] ci(helm): fix Helm Chart release action 422 error (#10237) Signed-off-by: Jintao Zhang --- .github/workflows/helm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 6303b6a27..e6bd4f101 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -75,7 +75,7 @@ jobs: - name: Helm Chart Releaser uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0 env: - CR_SKIP_EXISTING: "false" + CR_SKIP_EXISTING: true CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" CR_RELEASE_NAME_TEMPLATE: "helm-chart-{{ .Version }}" with: From d9baff90d7d9fa451331882acb6af3a6c0cde14a Mon Sep 17 00:00:00 2001 From: Jack <56563911+jdockerty@users.noreply.github.com> Date: Fri, 11 Aug 2023 15:13:27 +0100 Subject: [PATCH 304/822] docs: swap explanation to match example (#10220) --- docs/user-guide/exposing-tcp-udp-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/exposing-tcp-udp-services.md b/docs/user-guide/exposing-tcp-udp-services.md index 089511ff9..dbc143ff1 100644 --- a/docs/user-guide/exposing-tcp-udp-services.md +++ b/docs/user-guide/exposing-tcp-udp-services.md @@ -3,7 +3,7 @@ While the Kubernetes Ingress resource only officially supports routing external HTTP(s) traffic to services, ingress-nginx can be configured to receive external TCP/UDP traffic from non-HTTP protocols and route them to internal services using TCP/UDP port mappings that are specified within a ConfigMap. To support this, the `--tcp-services-configmap` and `--udp-services-configmap` flags can be used to point to an existing config map where the key is the external port to use and the value indicates the service to expose using the format: -`::[PROXY]:[PROXY]` +`::[PROXY]:[PROXY]` It is also possible to use a number or the name of the port. The two last fields are optional. Adding `PROXY` in either or both of the two last fields we can use [Proxy Protocol](https://www.nginx.com/resources/admin-guide/proxy-protocol) decoding (listen) and/or encoding (proxy_pass) in a TCP service. From dd6145b2d38491be60b2fadad69524163429cdf0 Mon Sep 17 00:00:00 2001 From: logica <84759675+logica0419@users.noreply.github.com> Date: Fri, 11 Aug 2023 23:17:27 +0900 Subject: [PATCH 305/822] Bump k8s.io/component-base from 0.26.4 to 0.27.4 (Replace Topology Aware Hints with Topology Aware Routing) (#10282) * Bump k8s.io/component-base from 0.26.4 to 0.27.4 Bumps [k8s.io/component-base](https://github.com/kubernetes/component-base) from 0.26.4 to 0.27.4. - [Commits](https://github.com/kubernetes/component-base/compare/v0.26.4...v0.27.4) --- updated-dependencies: - dependency-name: k8s.io/component-base dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] * changed annotation to TopologyMode * fixed documents * fixed test * using api constraint for test deployment options --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/values.yaml | 2 +- docs/user-guide/cli-arguments.md | 2 +- go.mod | 24 ++++----- go.sum | 61 +++++++++++------------ internal/ingress/controller/controller.go | 2 +- pkg/flags/flags.go | 2 +- test/e2e/framework/deployment.go | 6 +-- 8 files changed, 50 insertions(+), 51 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index c9ce4e3bc..4deed599b 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -296,7 +296,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' | | controller.enableAnnotationValidations | bool | `false` | | | controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # | -| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" Defaults to false | +| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false | | controller.existingPsp | string | `""` | Use an existing PSP instead of creating one | | controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use | | controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 3b156a6bf..4e8ddb4fc 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -66,7 +66,7 @@ controller: watchIngressWithoutClass: false # -- Process IngressClass per name (additionally as per spec.controller). ingressClassByName: false - # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" # Defaults to false enableTopologyAwareRouting: false # -- This configuration defines if Ingress Controller should allow users to set diff --git a/docs/user-guide/cli-arguments.md b/docs/user-guide/cli-arguments.md index be6e1dd50..07a17a271 100644 --- a/docs/user-guide/cli-arguments.md +++ b/docs/user-guide/cli-arguments.md @@ -25,7 +25,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment | `--enable-metrics` | Enables the collection of NGINX metrics. (default true) | | `--enable-ssl-chain-completion` | Autocomplete SSL certificate chains with missing intermediate CA certificates. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 extension for this to succeed. (default false)| | `--enable-ssl-passthrough` | Enable SSL Passthrough. (default false) | -| `--enable-topology-aware-routing` | Enable topology aware hints feature, needs service object annotation service.kubernetes.io/topology-aware-hints sets to auto. (default false) | +| `--enable-topology-aware-routing` | Enable topology aware routing feature, needs service object annotation service.kubernetes.io/topology-mode sets to auto. (default false) | | `--exclude-socket-metrics` | Set of socket request metrics to exclude which won't be exported nor being calculated. The possible socket request metrics to exclude are documented in the monitoring guide e.g. 'nginx_ingress_controller_request_duration_seconds,nginx_ingress_controller_response_size'| | `--health-check-path` | URL path of the health check endpoint. Configured inside the NGINX status server. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. (default "/healthz") | | `--health-check-timeout` | Time limit, in seconds, for a probe to health-check-path to succeed. (default 10) | diff --git a/go.mod b/go.mod index 0ba9fa71b..3ed0e77e0 100644 --- a/go.mod +++ b/go.mod @@ -30,14 +30,14 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.4 + k8s.io/api v0.27.4 k8s.io/apiextensions-apiserver v0.26.4 - k8s.io/apimachinery v0.26.4 + k8s.io/apimachinery v0.27.4 k8s.io/apiserver v0.26.4 k8s.io/cli-runtime v0.26.4 - k8s.io/client-go v0.26.4 + k8s.io/client-go v0.27.4 k8s.io/code-generator v0.26.4 - k8s.io/component-base v0.26.4 + k8s.io/component-base v0.27.4 k8s.io/klog/v2 v2.100.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.6 @@ -59,9 +59,9 @@ require ( github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b // indirect github.com/go-errors/errors v1.0.1 // indirect github.com/go-logr/logr v1.2.4 // indirect - github.com/go-openapi/jsonpointer v0.19.5 // indirect - github.com/go-openapi/jsonreference v0.20.0 // indirect - github.com/go-openapi/swag v0.19.14 // indirect + github.com/go-openapi/jsonpointer v0.19.6 // indirect + github.com/go-openapi/jsonreference v0.20.1 // indirect + github.com/go-openapi/swag v0.22.3 // indirect github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect github.com/godbus/dbus/v5 v5.0.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -72,14 +72,14 @@ require ( github.com/google/gnostic v0.5.7-v3refs // indirect github.com/google/go-cmp v0.5.9 // indirect github.com/google/gofuzz v1.1.0 // indirect - github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect + github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.3.0 // indirect github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect - github.com/mailru/easyjson v0.7.6 // indirect + github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect github.com/mmarkdown/mmark v2.0.40+incompatible // indirect @@ -116,9 +116,9 @@ require ( gopkg.in/yaml.v2 v2.4.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/gengo v0.0.0-20220902162205-c0856e24416d // indirect - k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 // indirect - k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 // indirect - sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect + k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect + k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect + sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect sigs.k8s.io/kustomize/api v0.12.1 // indirect sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect diff --git a/go.sum b/go.sum index 5ecec5625..eb703a707 100644 --- a/go.sum +++ b/go.sum @@ -103,14 +103,12 @@ github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbV github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A= -github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY= -github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= -github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA= -github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo= -github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= -github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= -github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= +github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= +github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= +github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8= +github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= +github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= @@ -184,8 +182,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE= -github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= @@ -235,10 +233,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= -github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= -github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA= -github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= +github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ= @@ -276,7 +272,6 @@ github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833 h1:t4WWQ9I797y7QU github.com/ncabatoff/go-seq v0.0.0-20180805175032-b08ef85ed833/go.mod h1:0CznHmXSjMEqs5Tezj/w2emQoM41wzYM9KpDKUHPYag= github.com/ncabatoff/process-exporter v0.7.10 h1:+Ere7+3se6QqP54gg7aBRagWcL8bq3u5zNi/GRSWeKQ= github.com/ncabatoff/process-exporter v0.7.10/go.mod h1:DHZRZjqxw9LCOpLlX0DjBuyn6d5plh41Jv6Tmttj7Ek= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= @@ -331,7 +326,7 @@ github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPH github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= -github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= +github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= @@ -347,7 +342,9 @@ github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.1.3/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= @@ -355,6 +352,9 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= @@ -683,7 +683,6 @@ gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLks gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= @@ -717,31 +716,31 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.4 h1:qSG2PmtcD23BkYiWfoYAcak870eF/hE7NNYBYavTT94= -k8s.io/api v0.26.4/go.mod h1:WwKEXU3R1rgCZ77AYa7DFksd9/BAIKyOmRlbVxgvjCk= +k8s.io/api v0.27.4 h1:0pCo/AN9hONazBKlNUdhQymmnfLRbSZjd5H5H3f0bSs= +k8s.io/api v0.27.4/go.mod h1:O3smaaX15NfxjzILfiln1D8Z3+gEYpjEpiNA/1EVK1Y= k8s.io/apiextensions-apiserver v0.26.4 h1:9D2RTxYGxrG5uYg6D7QZRcykXvavBvcA59j5kTaedQI= k8s.io/apiextensions-apiserver v0.26.4/go.mod h1:cd4uGFGIgzEqUghWpRsr9KE8j2KNTjY8Ji8pnMMazyw= -k8s.io/apimachinery v0.26.4 h1:rZccKdBLg9vP6J09JD+z8Yr99Ce8gk3Lbi9TCx05Jzs= -k8s.io/apimachinery v0.26.4/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= +k8s.io/apimachinery v0.27.4 h1:CdxflD4AF61yewuid0fLl6bM4a3q04jWel0IlP+aYjs= +k8s.io/apimachinery v0.27.4/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= k8s.io/apiserver v0.26.4 h1:3Oq4mnJv0mzVX7BR/Nod+8KjlELf/3Ljvu9ZWDyLUoA= k8s.io/apiserver v0.26.4/go.mod h1:yAY3O1vBM4/0OIGAGeWcdfzQvgdwJ188VirLcuSAVnw= k8s.io/cli-runtime v0.26.4 h1:MgSU871KDzBDX7V9GtuqS6Ai9lhQCHgRzkurnXOWtZ0= k8s.io/cli-runtime v0.26.4/go.mod h1:MjJ2DXMChw2zcG0/agzm17xwKpfVxOfuoCdfY9iOCOE= -k8s.io/client-go v0.26.4 h1:/7P/IbGBuT73A+G97trf44NTPSNqvuBREpOfdLbHvD4= -k8s.io/client-go v0.26.4/go.mod h1:6qOItWm3EwxJdl/8p5t7FWtWUOwyMdA8N9ekbW4idpI= +k8s.io/client-go v0.27.4 h1:vj2YTtSJ6J4KxaC88P4pMPEQECWMY8gqPqsTgUKzvjk= +k8s.io/client-go v0.27.4/go.mod h1:ragcly7lUlN0SRPk5/ZkGnDjPknzb37TICq07WhI6Xc= k8s.io/code-generator v0.26.4 h1:zgDD0qX13p/jtrAoYRRiYeQ5ibnriwmo2cMkMZAtJxc= k8s.io/code-generator v0.26.4/go.mod h1:ryaiIKwfxEJEaywEzx3dhWOydpVctKYbqLajJf0O8dI= -k8s.io/component-base v0.26.4 h1:Bg2xzyXNKL3eAuiTEu3XE198d6z22ENgFgGQv2GGOUk= -k8s.io/component-base v0.26.4/go.mod h1:lTuWL1Xz/a4e80gmIC3YZG2JCO4xNwtKWHJWeJmsq20= +k8s.io/component-base v0.27.4 h1:Wqc0jMKEDGjKXdae8hBXeskRP//vu1m6ypC+gwErj4c= +k8s.io/component-base v0.27.4/go.mod h1:hoiEETnLc0ioLv6WPeDt8vD34DDeB35MfQnxCARq3kY= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= -k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= -k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= -k8s.io/utils v0.0.0-20221128185143-99ec85e7a448/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg= +k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY= +k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 h1:SAElp8THCfmBdM+4lmWX5gebiSSkEr7PAYDVF91qpfg= pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R5A2EgsVzG8RTt4RfPoQuRAcDmg= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= @@ -749,8 +748,8 @@ rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= sigs.k8s.io/controller-runtime v0.14.6 h1:oxstGVvXGNnMvY7TAESYk+lzr6S3V5VFxQ6d92KcwQA= sigs.k8s.io/controller-runtime v0.14.6/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= -sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s= sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk= diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 7dc1a5292..f405bdcbb 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -142,7 +142,7 @@ type Configuration struct { func getIngressPodZone(svc *apiv1.Service) string { svcKey := k8s.MetaNamespaceKey(svc) - if svcZoneAnnotation, ok := svc.ObjectMeta.GetAnnotations()[apiv1.AnnotationTopologyAwareHints]; ok { + if svcZoneAnnotation, ok := svc.ObjectMeta.GetAnnotations()[apiv1.AnnotationTopologyMode]; ok { if strings.ToLower(svcZoneAnnotation) == "auto" { if foundZone, ok := k8s.IngressNodeDetails.GetLabels()[apiv1.LabelTopologyZone]; ok { klog.V(3).Infof("Svc has topology aware annotation enabled, try to use zone %q where controller pod is running for Service %q ", foundZone, svcKey) diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 2c926a35f..55d24f690 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -221,7 +221,7 @@ Takes the form ":port". If not provided, no admission controller is starte disableSyncEvents = flags.Bool("disable-sync-events", false, "Disables the creation of 'Sync' event resources") - enableTopologyAwareRouting = flags.Bool("enable-topology-aware-routing", false, "Enable topology aware hints feature, needs service object annotation service.kubernetes.io/topology-aware-hints sets to auto.") + enableTopologyAwareRouting = flags.Bool("enable-topology-aware-routing", false, "Enable topology aware routing feature, needs service object annotation service.kubernetes.io/topology-mode sets to auto.") ) flags.StringVar(&nginx.MaxmindMirror, "maxmind-mirror", "", `Maxmind mirror url (example: http://geoip.local/databases.`) diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index bcb1d3960..93e1811ec 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -67,11 +67,11 @@ func WithDeploymentNamespace(n string) func(*deploymentOptions) { } } -// WithSvcTopologyAnnotations create svc with topology aware hints sets to auto +// WithSvcTopologyAnnotations create svc with topology mode sets to auto func WithSvcTopologyAnnotations() func(*deploymentOptions) { return func(o *deploymentOptions) { o.svcAnnotations = map[string]string{ - "service.kubernetes.io/topology-aware-hints": "auto", + corev1.AnnotationTopologyMode: "auto", } } } @@ -213,7 +213,7 @@ func (f *Framework) NewHttpbunDeployment(opts ...func(*deploymentOptions)) strin 80, int32(options.replicas), nil, nil, - //Required to get hostname information + // Required to get hostname information []corev1.EnvVar{ { Name: "HTTPBUN_INFO_ENABLED", From 53c2f2742fa49648ade7ed3d150e01d19be91fa5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 11 Aug 2023 13:11:22 -0700 Subject: [PATCH 306/822] Bump github.com/opencontainers/runc from 1.1.8 to 1.1.9 (#10298) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.8 to 1.1.9. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.9/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.8...v1.1.9) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 3ed0e77e0..e78ca245e 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 github.com/onsi/ginkgo/v2 v2.9.5 - github.com/opencontainers/runc v1.1.8 + github.com/opencontainers/runc v1.1.9 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.16.0 github.com/prometheus/client_model v0.4.0 diff --git a/go.sum b/go.sum index eb703a707..bbfacc71e 100644 --- a/go.sum +++ b/go.sum @@ -284,8 +284,8 @@ github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3Ro github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= -github.com/opencontainers/runc v1.1.8 h1:zICRlc+C1XzivLc3nzE+cbJV4LIi8tib6YG0MqC6OqA= -github.com/opencontainers/runc v1.1.8/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= +github.com/opencontainers/runc v1.1.9 h1:XR0VIHTGce5eWPkaPesqTBrhW2yAcaraWfsEalNwQLM= +github.com/opencontainers/runc v1.1.9/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= From a92e7b4857b3cd7fb152f1ade5f6c3db462311b2 Mon Sep 17 00:00:00 2001 From: Son Bui Date: Sat, 12 Aug 2023 11:21:19 +0800 Subject: [PATCH 307/822] Remove curl dependencies in e2e tests #9716 (#10296) * fix: Replace curl list backend with dbg command #9716 Signed-off-by: Son Bui * fix: Remove curl dependencies in e2e tests #9716 Signed-off-by: Son Bui --------- Signed-off-by: Son Bui --- test/e2e/annotations/serviceupstream.go | 20 +++++++++---------- test/e2e/endpointslices/topology.go | 5 ++--- .../servicebackend/service_externalname.go | 11 +++------- test/e2e/settings/tls.go | 20 ++++++++++--------- 4 files changed, 25 insertions(+), 31 deletions(-) diff --git a/test/e2e/annotations/serviceupstream.go b/test/e2e/annotations/serviceupstream.go index 94ad6d346..0606a2d61 100644 --- a/test/e2e/annotations/serviceupstream.go +++ b/test/e2e/annotations/serviceupstream.go @@ -25,8 +25,6 @@ import ( "github.com/stretchr/testify/assert" "k8s.io/ingress-nginx/test/e2e/framework" - - "k8s.io/ingress-nginx/internal/nginx" ) var _ = framework.DescribeAnnotation("service-upstream", func() { @@ -59,10 +57,10 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) - output, err := f.ExecIngressPod(curlCmd) + dbgCmd := "/dbg backends all" + output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`{"address":"%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) }) }) @@ -88,10 +86,10 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) - output, err := f.ExecIngressPod(curlCmd) + dbgCmd := "/dbg backends all" + output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`{"address":"%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) }) }) @@ -119,10 +117,10 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are not used") s := f.GetService(f.Namespace, framework.EchoService) - curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) - output, err := f.ExecIngressPod(curlCmd) + dbgCmd := "/dbg backends all" + output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`{"address":"%s"`, s.Spec.ClusterIP)) + assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) }) }) }) diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index ff66f2ad1..2197bcb53 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -28,7 +28,6 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" - "k8s.io/ingress-nginx/internal/nginx" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -72,8 +71,8 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou } } - curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) - status, err := f.ExecIngressPod(curlCmd) + dbgCmd := "/dbg backends all" + status, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) var backends []map[string]interface{} err = json.Unmarshal([]byte(status), &backends) diff --git a/test/e2e/servicebackend/service_externalname.go b/test/e2e/servicebackend/service_externalname.go index 89ae77b10..429690ff1 100644 --- a/test/e2e/servicebackend/service_externalname.go +++ b/test/e2e/servicebackend/service_externalname.go @@ -30,7 +30,6 @@ import ( networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/ingress-nginx/internal/nginx" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -330,17 +329,13 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains(ginkgo.GinkgoT(), body, `"X-Forwarded-Host": "echo"`) ginkgo.By("checking the service is updated to use new host") - curlCmd := fmt.Sprintf( - "curl --fail --silent http://localhost:%v/configuration/backends", - nginx.StatusPort, - ) - - output, err := f.ExecIngressPod(curlCmd) + dbgCmd := "/dbg backends all" + output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) assert.Contains( ginkgo.GinkgoT(), output, - fmt.Sprintf("{\"address\":\"%s\"", framework.BuildNIPHost(ip)), + fmt.Sprintf(`"address": "%s"`, framework.BuildNIPHost(ip)), ) }) diff --git a/test/e2e/settings/tls.go b/test/e2e/settings/tls.go index a820e41dd..2cead4a94 100644 --- a/test/e2e/settings/tls.go +++ b/test/e2e/settings/tls.go @@ -170,15 +170,17 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f hstsIncludeSubdomains: "false", }) - // we can not use gorequest here because it flattens the duplicate headers - // and specifically in case of Strict-Transport-Security it ignore extra headers - // intead of concatenating, rightfully. And I don't know of any API it provides for getting raw headers. - curlCmd := fmt.Sprintf("curl -I -k --fail --silent --resolve settings-tls:443:127.0.0.1 https://settings-tls%v", "?hsts=true") - output, err := f.ExecIngressPod(curlCmd) - assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, "strict-transport-security: max-age=86400; preload") - // this is what the upstream sets - assert.NotContains(ginkgo.GinkgoT(), output, "strict-transport-security: max-age=3600; preload") + expectResponse := f.HTTPTestClientWithTLSConfig(tlsConfig). + GET("/"). + WithURL(f.GetURL(framework.HTTPS)). + WithHeader("Host", host). + WithQuery("hsts", "true"). + Expect() + + expectResponse.Header("Strict-Transport-Security").Equal("max-age=86400; preload") + header := expectResponse.Raw().Header + got := header["Strict-Transport-Security"] + assert.Equal(ginkgo.GinkgoT(), 1, len(got)) }) }) From 6b05e9b06e3a61062a33c6c8338f2e253c881aec Mon Sep 17 00:00:00 2001 From: Lucas Fernando Cardoso Nunes Date: Sun, 13 Aug 2023 12:27:20 -0300 Subject: [PATCH 308/822] fix: add /etc/mime.types #10309 (#10310) Signed-off-by: Lucas Fernando Cardoso Nunes --- images/custom-error-pages/rootfs/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index 04bcb8e08..4560e9ed5 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -32,6 +32,7 @@ FROM gcr.io/distroless/static:nonroot COPY --from=builder /go/src/k8s.io/ingress-nginx/images/custom-error-pages/nginx-errors / COPY --from=builder /go/src/k8s.io/ingress-nginx/images/custom-error-pages/www /www +COPY --from=builder /go/src/k8s.io/ingress-nginx/images/custom-error-pages/etc /etc USER nonroot:nonroot CMD ["/nginx-errors"] From 8a578c9f4a268cba2d75fc40d4e5f4bb3e17a714 Mon Sep 17 00:00:00 2001 From: Mark Ley Date: Mon, 14 Aug 2023 10:35:21 -0700 Subject: [PATCH 309/822] Disable Modsecurity from internal processing which affects large ingresses (#10316) * Disable Modsecurity from interanl processing * Fix modsecurity check logic --- rootfs/etc/nginx/template/nginx.tmpl | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 0f44efc3d..0a031442c 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -709,6 +709,11 @@ http { # default server, used for NGINX healthcheck and access to nginx stats server { + # Ensure that modsecurity will not run on an internal location as this is not accessible from outside + {{ if $all.Cfg.EnableModsecurity }} + modsecurity off; + {{ end }} + listen 127.0.0.1:{{ .StatusPort }}; set $proxy_upstream_name "internal"; From 1a8ba5e2f26c16064888be869ce978bbaaffda32 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Aug 2023 02:44:27 -0700 Subject: [PATCH 310/822] Bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (#10314) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 4.3.0 to 4.4.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/336e29918d653399e599bfca99fadc1d7ffbc9f7...3fa32b8bb5620a2c1afe798654bbad59f9da4906) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index d8769f439..a7ce737ac 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -28,7 +28,7 @@ jobs: check-latest: true - name: Run GoReleaser - uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0 + uses: goreleaser/goreleaser-action@3fa32b8bb5620a2c1afe798654bbad59f9da4906 # v4.4.0 with: version: latest args: release --rm-dist From cee39f68ef1053057f14c88443605a80a180c769 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Aug 2023 06:21:23 -0700 Subject: [PATCH 311/822] Bump securego/gosec from 2.16.0 to 2.17.0 (#10332) Bumps [securego/gosec](https://github.com/securego/gosec) from 2.16.0 to 2.17.0. - [Release notes](https://github.com/securego/gosec/releases) - [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml) - [Commits](https://github.com/securego/gosec/compare/c5ea1b7bdd9efc3792e513258853552b0ae31e06...a89e9d5a7acb4457f3891ac18532b142b1bf9221) --- updated-dependencies: - dependency-name: securego/gosec dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 5c08ba0da..54ad661cc 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -71,7 +71,7 @@ jobs: uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Run Gosec Security Scanner - uses: securego/gosec@c5ea1b7bdd9efc3792e513258853552b0ae31e06 # v2.16.0 + uses: securego/gosec@a89e9d5a7acb4457f3891ac18532b142b1bf9221 # v2.17.0 with: # G601 for zz_generated.deepcopy.go # G306 TODO: Expect WriteFile permissions to be 0600 or less From ac3ff59ea42a8c7defd84f5b5bf0e2c6e71ac133 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 23 Aug 2023 15:26:00 -0700 Subject: [PATCH 312/822] Bump actions/setup-go from 4.0.1 to 4.1.0 (#10313) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.0.1 to 4.1.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/fac708d6674e30b6ba41289acaab6d4b75aa0753...93397bea11091df50f3d7e59dc26a7711a8bcfbe) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 12 ++++++------ .github/workflows/plugin.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 54ad661cc..09de92680 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -89,7 +89,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true @@ -108,7 +108,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true @@ -127,7 +127,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true @@ -148,7 +148,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true @@ -214,7 +214,7 @@ jobs: uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Setup Go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true @@ -521,7 +521,7 @@ jobs: - name: Set up Go id: go if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: '1.20' check-latest: true diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index a7ce737ac..40fed1d9b 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -22,7 +22,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version: 1.20 check-latest: true From 40e0849b16f1e9c07d8f5a1554ef2a7f79c9224a Mon Sep 17 00:00:00 2001 From: Ciprian Hacman Date: Fri, 25 Aug 2023 07:33:19 +0300 Subject: [PATCH 313/822] Use gzip instead of pigz in CI (#10348) Signed-off-by: Ciprian Hacman --- .github/workflows/ci.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 09de92680..796e81844 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -167,8 +167,6 @@ jobs: - name: Prepare Host run: | - sudo apt-get -qq update || true - sudo apt-get install -y pigz curl -LO https://dl.k8s.io/release/v1.25.5/bin/linux/amd64/kubectl chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin/kubectl @@ -188,7 +186,7 @@ jobs: nginx-ingress-controller:e2e \ ingress-controller/controller:1.0.0-dev \ ingress-controller/controller-chroot:1.0.0-dev \ - | pigz > docker.tar.gz + | gzip > docker.tar.gz - name: cache uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 @@ -260,7 +258,7 @@ jobs: - name: Load images from cache run: | echo "loading docker images..." - pigz -dc docker.tar.gz | docker load + gzip -dc docker.tar.gz | docker load - name: Test env: @@ -301,7 +299,7 @@ jobs: - name: Load images from cache run: | echo "loading docker images..." - pigz -dc docker.tar.gz | docker load + gzip -dc docker.tar.gz | docker load - name: Run e2e tests env: @@ -349,7 +347,7 @@ jobs: - name: Load images from cache run: | echo "loading docker images..." - pigz -dc docker.tar.gz | docker load + gzip -dc docker.tar.gz | docker load - name: Run e2e tests env: @@ -400,7 +398,7 @@ jobs: - name: Load images from cache run: | echo "loading docker images..." - pigz -dc docker.tar.gz | docker load + gzip -dc docker.tar.gz | docker load - name: Run e2e tests env: From 8d0b00dd263b32f179460ab881095c3e95efbcbc Mon Sep 17 00:00:00 2001 From: Son Bui Date: Fri, 25 Aug 2023 21:00:53 +0800 Subject: [PATCH 314/822] fix: update action file to auto release plugin #10197 (#10321) Signed-off-by: Son Bui --- .github/workflows/plugin.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 40fed1d9b..1eeb1d102 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -4,10 +4,8 @@ on: push: branches: - "main" - paths: - - "cmd/plugin/**" tags: - - "v*" + - 'v*.*.*\+plugin' permissions: contents: write # for goreleaser/goreleaser-action @@ -24,14 +22,14 @@ jobs: - name: Set up Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: 1.20 + go-version: '1.20' check-latest: true - name: Run GoReleaser uses: goreleaser/goreleaser-action@3fa32b8bb5620a2c1afe798654bbad59f9da4906 # v4.4.0 with: version: latest - args: release --rm-dist + args: release --clean env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 9487907fa1ba3451d2f4440b550f9cfffe11fd65 Mon Sep 17 00:00:00 2001 From: Marcelo Cyreno <812725+marcelocyreno@users.noreply.github.com> Date: Sat, 26 Aug 2023 00:25:21 -0300 Subject: [PATCH 315/822] =?UTF-8?q?Fix=20=E2=80=9Cdev-env=E2=80=9D=20Makef?= =?UTF-8?q?ile=20target=20to=20work=20with=20kubectl=201.28+=20(#10350)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- build/dev-env.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/dev-env.sh b/build/dev-env.sh index 3d21b7e15..d79238b7d 100755 --- a/build/dev-env.sh +++ b/build/dev-env.sh @@ -52,7 +52,7 @@ if [[ ${HELM_VERSION} -lt 3.10.0 ]]; then exit 1 fi -KUBE_CLIENT_VERSION=$(kubectl version --client --short 2>/dev/null | grep Client | awk '{print $3}' | cut -d. -f2) || true +KUBE_CLIENT_VERSION=$(kubectl version --client -oyaml 2>/dev/null | grep "minor:" | awk '{print $2}' | tr -d '"') || true if [[ ${KUBE_CLIENT_VERSION} -lt 24 ]]; then echo "Please update kubectl to 1.24.2 or higher" exit 1 From 300a60f7244cb056701177989a1a09135626f930 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 26 Aug 2023 16:59:22 -0700 Subject: [PATCH 316/822] Bump actions/dependency-review-action from 3.0.6 to 3.0.8 (#10333) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.0.6 to 3.0.8. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/1360a344ccb0ab6e9475edef90ad2f46bf8003b1...f6fff72a3217f580d5afd49a46826795305b63c7) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/depreview.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 625c2f461..45d796088 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -11,4 +11,4 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: 'Dependency Review' - uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6 + uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 # v3.0.8 From 1ce25127bd39179bfaba6f0b7ef5b40ec2dc4bbb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 28 Aug 2023 04:55:43 -0700 Subject: [PATCH 317/822] Bump actions/checkout from 3.5.3 to 3.6.0 (#10354) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.3 to 3.6.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/c85c95e3d7251135ab7dc9ce3241c5835cc595a9...f43a0e5ff2bd294095638e18286ca9a3d1956744) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 24 +++++++++++----------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 8 files changed, 22 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 796e81844..596ef0427 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -68,7 +68,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Run Gosec Security Scanner uses: securego/gosec@a89e9d5a7acb4457f3891ac18532b142b1bf9221 # v2.17.0 @@ -85,7 +85,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go id: go @@ -104,7 +104,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go id: go @@ -123,7 +123,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go id: go @@ -144,7 +144,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Set up Go id: go @@ -209,7 +209,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Setup Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 @@ -284,7 +284,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -332,7 +332,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -383,7 +383,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -427,7 +427,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -500,7 +500,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 45d796088..f93869c79 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: 'Dependency Review' uses: actions/dependency-review-action@f6fff72a3217f580d5afd49a46826795305b63c7 # v3.0.8 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index f7aee6610..d4b81e62a 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index e6bd4f101..5b0f98f1b 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 36f1f1ede..154ab6e47 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 1eeb1d102..16974e906 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 2e276a3f6..d06fa1528 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index af7d8bda1..1acc6c163 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - shell: bash id: test From 93f9ac2521519404a442fa2660b79c1ba672adea Mon Sep 17 00:00:00 2001 From: Marcelo Cyreno <812725+marcelocyreno@users.noreply.github.com> Date: Mon, 28 Aug 2023 11:37:44 -0300 Subject: [PATCH 318/822] Making auth access logs optional (#10335) --- internal/ingress/controller/config/config.go | 5 +++++ rootfs/etc/nginx/template/nginx.tmpl | 2 ++ 2 files changed, 7 insertions(+) diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 6e78964ed..60cef489a 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -131,6 +131,10 @@ type Configuration struct { // By default this is disabled EnableAccessLogForDefaultBackend bool `json:"enable-access-log-for-default-backend"` + // EnableAuthAccessLog enable auth access log + // By default this is disabled + EnableAuthAccessLog bool `json:"enable-auth-access-log"` + // AccessLogPath sets the path of the access logs for both http and stream contexts if enabled // http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log // http://nginx.org/en/docs/stream/ngx_stream_log_module.html#access_log @@ -871,6 +875,7 @@ func NewDefault() Configuration { AccessLogPath: "/var/log/nginx/access.log", AccessLogParams: "", EnableAccessLogForDefaultBackend: false, + EnableAuthAccessLog: false, WorkerCPUAffinity: "", ErrorLogPath: "/var/log/nginx/error.log", BlockCIDRs: defBlockEntity, diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 0a031442c..3d7235bcc 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -1102,7 +1102,9 @@ stream { opentelemetry_propagate; {{ end }} + {{ if not $all.Cfg.EnableAuthAccessLog }} access_log off; + {{ end }} # Ensure that modsecurity will not run on an internal location as this is not accessible from outside {{ if $all.Cfg.EnableModsecurity }} From 616d7e97d006cb0d054706dd0db5639497abee54 Mon Sep 17 00:00:00 2001 From: Rudolf Byker Date: Tue, 29 Aug 2023 09:17:22 +0200 Subject: [PATCH 319/822] Add firewall configuration to quick start documentation (#10357) --- docs/deploy/index.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/deploy/index.md b/docs/deploy/index.md index d719d4a57..df11d710c 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -80,6 +80,12 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont Because of api deprecations, the default manifest may not work on your cluster. Specific manifests for supported Kubernetes versions are available within a sub-folder of each provider. +### Firewall configuration + +To check which ports are used by your installation of ingress-nginx, look at the output of `kubectl -n ingress-nginx get pod -o yaml`. In general, you need: +- Port 8443 open between all hosts on which the kubernetes nodes are running. This is used for the ingress-nginx [admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/). +- Port 80 (for HTTP) and/or 443 (for HTTPS) open to the public on the kubernetes nodes to which the DNS of your apps are pointing. + ### Pre-flight check A few pods should start in the `ingress-nginx` namespace: From 46d87d3462014d7e188bff0082f0c4de044d9bc0 Mon Sep 17 00:00:00 2001 From: Son Bui Date: Thu, 31 Aug 2023 10:06:47 +0800 Subject: [PATCH 320/822] chore(build): Fix Run make dev-env syntax error (#10294) * fix: Run make dev-env syntax error #10293 Signed-off-by: Son Bui * fix: Run make dev-env value too great for base #10294 --------- Signed-off-by: Son Bui --- build/dev-env.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/build/dev-env.sh b/build/dev-env.sh index d79238b7d..93ed3de40 100755 --- a/build/dev-env.sh +++ b/build/dev-env.sh @@ -45,9 +45,11 @@ if ! command -v helm &> /dev/null; then exit 1 fi +function ver { printf "%d%03d%03d" $(echo "$1" | tr '.' ' '); } + HELM_VERSION=$(helm version 2>&1 | cut -f1 -d"," | grep -oE '[0-9]+\.[0-9]+\.[0-9]+') || true echo $HELM_VERSION -if [[ ${HELM_VERSION} -lt 3.10.0 ]]; then +if [[ $(ver $HELM_VERSION) -lt $(ver "3.10.0") ]]; then echo "Please upgrade helm to v3.10.0 or higher" exit 1 fi From b3060bfbd09825993081f60b56df8201f1246702 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Thu, 31 Aug 2023 15:36:48 +0800 Subject: [PATCH 321/822] Fix golangci-lint errors (#10196) * Fix golangci-lint errors Signed-off-by: z1cheng * Fix dupl errors Signed-off-by: z1cheng * Fix comments Signed-off-by: z1cheng * Fix errcheck lint errors Signed-off-by: z1cheng * Fix assert in e2e test Signed-off-by: z1cheng * Not interrupt the waitForPodsReady Signed-off-by: z1cheng * Replace string with constant Signed-off-by: z1cheng * Fix comments Signed-off-by: z1cheng * Revert write file permision Signed-off-by: z1cheng --------- Signed-off-by: z1cheng --- cmd/dataplane/main.go | 5 +- cmd/dbg/main.go | 40 ++- cmd/nginx/logger.go | 1 - cmd/nginx/main.go | 5 +- cmd/nginx/main_test.go | 10 +- cmd/plugin/commands/backends/backends.go | 9 +- cmd/plugin/commands/certs/certs.go | 2 +- cmd/plugin/commands/conf/conf.go | 2 +- cmd/plugin/commands/exec/exec.go | 2 +- cmd/plugin/commands/general/general.go | 2 +- cmd/plugin/commands/ingresses/ingresses.go | 15 +- .../commands/ingresses/ingresses_test.go | 1 - cmd/plugin/commands/lint/main.go | 10 +- cmd/plugin/commands/logs/logs.go | 2 +- cmd/plugin/commands/ssh/ssh.go | 2 +- cmd/plugin/kubectl/kubectl.go | 18 +- cmd/plugin/lints/deployment.go | 20 +- cmd/plugin/lints/ingress.go | 21 +- cmd/plugin/main.go | 2 +- cmd/plugin/request/request.go | 49 ++- cmd/plugin/util/util.go | 22 +- docs/e2e-tests.md | 2 +- images/fastcgi-helloserver/rootfs/main.go | 4 +- images/go-grpc-greeter-server/rootfs/main.go | 4 +- internal/admission/controller/main.go | 13 +- internal/admission/controller/main_test.go | 4 +- internal/admission/controller/server.go | 4 +- internal/ingress/annotations/alias/main.go | 2 +- .../ingress/annotations/alias/main_test.go | 4 +- internal/ingress/annotations/annotations.go | 61 ++-- .../ingress/annotations/annotations_test.go | 8 +- internal/ingress/annotations/auth/main.go | 24 +- .../ingress/annotations/auth/main_test.go | 62 ++-- internal/ingress/annotations/authreq/main.go | 36 +- .../ingress/annotations/authreq/main_test.go | 5 +- .../ingress/annotations/authreqglobal/main.go | 1 - .../annotations/authreqglobal/main_test.go | 5 +- internal/ingress/annotations/authtls/main.go | 19 +- .../ingress/annotations/authtls/main_test.go | 33 +- .../annotations/backendprotocol/main.go | 4 +- .../annotations/backendprotocol/main_test.go | 7 +- internal/ingress/annotations/canary/main.go | 12 +- .../ingress/annotations/canary/main_test.go | 11 +- .../annotations/clientbodybuffersize/main.go | 6 +- .../clientbodybuffersize/main_test.go | 1 + .../ingress/annotations/connection/main.go | 6 +- .../annotations/connection/main_test.go | 1 - internal/ingress/annotations/cors/main.go | 16 +- .../annotations/customhttperrors/main.go | 14 +- .../annotations/defaultbackend/main.go | 14 +- internal/ingress/annotations/fastcgi/main.go | 15 +- .../ingress/annotations/fastcgi/main_test.go | 5 - .../annotations/globalratelimit/main.go | 19 +- .../annotations/globalratelimit/main_test.go | 21 +- .../annotations/http2pushpreload/main.go | 4 +- .../ingress/annotations/ipallowlist/main.go | 5 +- .../ingress/annotations/ipdenylist/main.go | 5 +- .../annotations/loadbalancing/main_test.go | 1 + internal/ingress/annotations/log/main.go | 4 +- internal/ingress/annotations/log/main_test.go | 15 +- internal/ingress/annotations/mirror/main.go | 6 +- .../ingress/annotations/modsecurity/main.go | 14 +- .../annotations/modsecurity/main_test.go | 10 +- .../ingress/annotations/opentelemetry/main.go | 7 +- .../annotations/opentelemetry/main_test.go | 25 +- .../ingress/annotations/opentracing/main.go | 14 +- .../annotations/opentracing/main_test.go | 29 +- internal/ingress/annotations/parser/main.go | 13 +- .../ingress/annotations/parser/main_test.go | 12 +- .../ingress/annotations/parser/validators.go | 8 +- .../annotations/parser/validators_test.go | 1 - internal/ingress/annotations/proxy/main.go | 23 +- .../ingress/annotations/proxy/main_test.go | 32 +- internal/ingress/annotations/proxyssl/main.go | 32 +- .../ingress/annotations/proxyssl/main_test.go | 62 ++-- .../ingress/annotations/ratelimit/main.go | 2 +- .../ingress/annotations/redirect/redirect.go | 12 +- .../annotations/redirect/redirect_test.go | 1 - internal/ingress/annotations/rewrite/main.go | 4 +- .../ingress/annotations/rewrite/main_test.go | 36 +- internal/ingress/annotations/satisfy/main.go | 4 +- .../annotations/serversnippet/main_test.go | 1 + .../annotations/serviceupstream/main.go | 4 +- .../annotations/serviceupstream/main_test.go | 25 +- .../annotations/sessionaffinity/main.go | 31 +- .../annotations/sessionaffinity/main_test.go | 6 +- .../ingress/annotations/snippet/main_test.go | 1 + .../ingress/annotations/sslcipher/main.go | 12 +- .../annotations/sslcipher/main_test.go | 7 +- .../annotations/sslpassthrough/main.go | 3 +- .../annotations/streamsnippet/main_test.go | 4 +- .../annotations/upstreamhashby/main.go | 2 +- .../annotations/xforwardedprefix/main.go | 14 +- .../annotations/xforwardedprefix/main_test.go | 1 + internal/ingress/controller/certificate.go | 2 +- internal/ingress/controller/checker.go | 2 +- internal/ingress/controller/checker_test.go | 13 +- internal/ingress/controller/config/config.go | 84 +++-- internal/ingress/controller/controller.go | 76 ++--- .../ingress/controller/controller_test.go | 69 ++-- internal/ingress/controller/endpointslices.go | 6 +- .../ingress/controller/endpointslices_test.go | 1 + .../controller/ingressclass/ingressclass.go | 6 +- internal/ingress/controller/nginx.go | 65 ++-- internal/ingress/controller/nginx_test.go | 23 +- internal/ingress/controller/process/nginx.go | 5 +- internal/ingress/controller/status.go | 10 +- .../ingress/controller/store/backend_ssl.go | 9 +- .../ingress/controller/store/endpointslice.go | 2 +- .../controller/store/endpointslice_test.go | 1 - internal/ingress/controller/store/store.go | 113 +++++-- .../ingress/controller/store/store_test.go | 178 ++++++---- .../ingress/controller/template/configmap.go | 38 ++- .../ingress/controller/template/template.go | 309 +++++++++--------- .../controller/template/template_test.go | 94 +++--- internal/ingress/controller/util.go | 2 + internal/ingress/defaults/main.go | 2 +- internal/ingress/errors/errors.go | 32 +- internal/ingress/inspector/ingress_test.go | 1 - internal/ingress/inspector/inspector.go | 4 +- internal/ingress/inspector/rules.go | 6 +- internal/ingress/inspector/rules_test.go | 1 - internal/ingress/inspector/service.go | 2 +- .../ingress/metric/collectors/admission.go | 6 +- .../ingress/metric/collectors/controller.go | 66 ++-- .../metric/collectors/controller_test.go | 20 +- .../ingress/metric/collectors/nginx_status.go | 1 - .../metric/collectors/nginx_status_test.go | 2 +- internal/ingress/metric/collectors/process.go | 23 +- .../ingress/metric/collectors/process_test.go | 9 +- internal/ingress/metric/collectors/socket.go | 73 ++--- .../ingress/metric/collectors/socket_test.go | 7 +- .../ingress/metric/collectors/testutils.go | 6 +- internal/ingress/metric/dummy.go | 40 +-- internal/ingress/metric/main.go | 14 +- internal/ingress/status/status.go | 34 +- internal/ingress/status/status_test.go | 287 ++++++++-------- internal/k8s/main.go | 7 +- internal/k8s/main_test.go | 20 +- internal/net/dns/dns.go | 2 +- internal/net/ipnet_test.go | 8 +- internal/net/net.go | 16 +- internal/net/net_test.go | 2 +- internal/net/ssl/ssl.go | 53 +-- internal/net/ssl/ssl_test.go | 37 +-- internal/nginx/main.go | 17 +- internal/nginx/maxmind.go | 10 +- internal/task/queue.go | 11 +- pkg/apis/ingress/sslcert.go | 6 +- pkg/apis/ingress/types.go | 7 +- pkg/apis/ingress/types_equals.go | 62 ++-- pkg/apis/ingress/types_equals_test.go | 25 +- pkg/flags/flags.go | 10 +- pkg/flags/flags_test.go | 7 +- pkg/metrics/handler.go | 3 +- pkg/tcpproxy/tcp.go | 12 +- pkg/util/file/file_watcher.go | 6 +- pkg/util/file/filesystem.go | 2 +- pkg/util/file/structure.go | 10 +- pkg/util/ingress/ingress.go | 28 +- pkg/util/process/controller.go | 4 +- pkg/util/process/sigterm.go | 2 +- pkg/util/process/sigterm_test.go | 4 +- pkg/util/runtime/cpu_notlinux.go | 2 +- pkg/util/sets/match_test.go | 27 +- rootfs/etc/nginx/template/nginx.tmpl | 6 +- test/e2e/admission/admission.go | 17 +- test/e2e/annotations/affinity.go | 86 ++--- test/e2e/annotations/affinitymode.go | 8 +- test/e2e/annotations/alias.go | 12 +- test/e2e/annotations/auth.go | 84 ++--- test/e2e/annotations/authtls.go | 22 +- test/e2e/annotations/backendprotocol.go | 12 +- test/e2e/annotations/canary.go | 53 ++- test/e2e/annotations/clientbodybuffersize.go | 14 +- test/e2e/annotations/cors.go | 57 ++-- test/e2e/annotations/customhttperrors.go | 2 +- test/e2e/annotations/default_backend.go | 6 +- test/e2e/annotations/fromtowwwredirect.go | 4 +- test/e2e/annotations/globalratelimit.go | 2 +- test/e2e/annotations/grpc.go | 34 +- .../annotations/modsecurity/modsecurity.go | 65 ++-- test/e2e/annotations/proxy.go | 9 +- test/e2e/annotations/proxyssl.go | 15 +- test/e2e/annotations/rewrite.go | 16 +- test/e2e/annotations/serversnippet.go | 1 - test/e2e/annotations/serviceupstream.go | 11 +- test/e2e/annotations/upstreamhashby.go | 7 +- test/e2e/dbg/main.go | 4 +- test/e2e/e2e.go | 1 - test/e2e/e2e_test.go | 1 + test/e2e/endpointslices/longname.go | 1 - test/e2e/endpointslices/topology.go | 3 +- test/e2e/framework/deployment.go | 15 +- test/e2e/framework/exec.go | 12 +- test/e2e/framework/fastcgi_helloserver.go | 3 +- test/e2e/framework/framework.go | 41 +-- test/e2e/framework/grpc_fortune_teller.go | 3 +- test/e2e/framework/healthz.go | 2 +- test/e2e/framework/httpexpect/match.go | 2 +- test/e2e/framework/httpexpect/object.go | 17 +- test/e2e/framework/httpexpect/request.go | 3 +- test/e2e/framework/k8s.go | 55 ++-- test/e2e/framework/metrics.go | 3 +- test/e2e/framework/ssl.go | 10 +- test/e2e/framework/test_context.go | 3 +- test/e2e/framework/util.go | 40 ++- test/e2e/gracefulshutdown/grace_period.go | 2 - test/e2e/ingress/pathtype_exact.go | 3 +- test/e2e/ingress/pathtype_mixed.go | 3 +- test/e2e/leaks/lua_ssl.go | 4 +- test/e2e/loadbalance/configmap.go | 4 +- test/e2e/loadbalance/ewma.go | 9 +- test/e2e/loadbalance/round_robin.go | 6 +- test/e2e/lua/dynamic_certificates.go | 2 - test/e2e/lua/dynamic_configuration.go | 19 +- test/e2e/nginx/nginx.go | 5 - test/e2e/security/request_smuggling.go | 8 +- test/e2e/servicebackend/service_backend.go | 91 +++--- .../servicebackend/service_externalname.go | 22 +- .../e2e/servicebackend/service_nil_backend.go | 1 - test/e2e/settings/access_log.go | 4 - test/e2e/settings/badannotationvalues.go | 2 - test/e2e/settings/default_ssl_certificate.go | 6 +- test/e2e/settings/disable_catch_all.go | 8 +- .../settings/disable_service_external_name.go | 1 - test/e2e/settings/disable_sync_events.go | 3 +- test/e2e/settings/forwarded_headers.go | 6 +- test/e2e/settings/geoip2.go | 9 +- test/e2e/settings/global_external_auth.go | 22 +- test/e2e/settings/global_options.go | 1 - test/e2e/settings/hash-size.go | 9 - test/e2e/settings/ingress_class.go | 24 +- test/e2e/settings/keep-alive.go | 14 +- test/e2e/settings/listen_nondefault_ports.go | 5 - test/e2e/settings/log-format.go | 2 - test/e2e/settings/namespace_selector.go | 16 +- test/e2e/settings/no_auth_locations.go | 8 +- .../e2e/settings/no_tls_redirect_locations.go | 1 - test/e2e/settings/ocsp/ocsp.go | 5 +- test/e2e/settings/opentelemetry.go | 15 +- test/e2e/settings/opentracing.go | 60 ++-- .../settings/pod_security_policy_volumes.go | 1 - test/e2e/settings/proxy_connect_timeout.go | 2 +- test/e2e/settings/proxy_protocol.go | 19 +- test/e2e/settings/proxy_read_timeout.go | 2 +- test/e2e/settings/proxy_send_timeout.go | 2 +- test/e2e/settings/ssl_passthrough.go | 11 +- test/e2e/settings/tls.go | 5 +- test/e2e/settings/validations/validations.go | 6 +- test/e2e/ssl/secret_update.go | 2 +- test/e2e/status/update.go | 4 +- test/e2e/tcpudp/tcp.go | 12 +- 253 files changed, 2434 insertions(+), 2113 deletions(-) diff --git a/cmd/dataplane/main.go b/cmd/dataplane/main.go index a1c4cbcc6..65f898df6 100644 --- a/cmd/dataplane/main.go +++ b/cmd/dataplane/main.go @@ -18,11 +18,12 @@ package main import ( "fmt" - "github.com/prometheus/client_golang/prometheus" - "github.com/prometheus/client_golang/prometheus/collectors" "net/http" "os" + "github.com/prometheus/client_golang/prometheus" + "github.com/prometheus/client_golang/prometheus/collectors" + "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/controller" diff --git a/cmd/dbg/main.go b/cmd/dbg/main.go index 41a3c2772..b63bcf5fe 100644 --- a/cmd/dbg/main.go +++ b/cmd/dbg/main.go @@ -114,7 +114,6 @@ func main() { fmt.Println(err) os.Exit(1) } - } func backendsAll() { @@ -155,10 +154,16 @@ func backendsList() { fmt.Println(unmarshalErr) return } - backends := f.([]interface{}) + backends, ok := f.([]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", f) + } for _, backendi := range backends { - backend := backendi.(map[string]interface{}) + backend, ok := backendi.(map[string]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", backendi) + } fmt.Println(backend["name"].(string)) } } @@ -180,12 +185,22 @@ func backendsGet(name string) { fmt.Println(unmarshalErr) return } - backends := f.([]interface{}) + backends, ok := f.([]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", f) + } for _, backendi := range backends { - backend := backendi.(map[string]interface{}) + backend, ok := backendi.(map[string]interface{}) + if !ok { + fmt.Printf("unexpected type: %T", backendi) + } if backend["name"].(string) == name { - printed, _ := json.MarshalIndent(backend, "", " ") + printed, err := json.MarshalIndent(backend, "", " ") + if err != nil { + fmt.Println(err) + return + } fmt.Println(string(printed)) return } @@ -213,18 +228,7 @@ func certGet(host string) { } func general() { - //TODO: refactor to obtain ingress-nginx pod count from the api server - /* - statusCode, body, requestErr := nginx.NewGetStatusRequest(generalPath) - if requestErr != nil { - fmt.Println(requestErr) - return - } - if statusCode != 200 { - fmt.Printf("Nginx returned code %v\n", statusCode) - return - } - */ + // TODO: refactor to obtain ingress-nginx pod count from the api server var prettyBuffer bytes.Buffer indentErr := json.Indent(&prettyBuffer, []byte("{}"), "", " ") diff --git a/cmd/nginx/logger.go b/cmd/nginx/logger.go index 13ec095fa..323085c83 100644 --- a/cmd/nginx/logger.go +++ b/cmd/nginx/logger.go @@ -47,5 +47,4 @@ func logger(address string) { server.Wait() klog.Infof("Stopping logger") - } diff --git a/cmd/nginx/main.go b/cmd/nginx/main.go index 508e940e1..1d30091ef 100644 --- a/cmd/nginx/main.go +++ b/cmd/nginx/main.go @@ -153,7 +153,6 @@ func main() { if errExists == nil { conf.IsChroot = true go logger(conf.InternalLoggerAddress) - } go metrics.StartHTTPServer(conf.HealthCheckHost, conf.ListenPorts.Health, mux) @@ -282,10 +281,10 @@ func checkService(key string, kubeClient *kubernetes.Clientset) error { } if errors.IsNotFound(err) { - return fmt.Errorf("No service with name %v found in namespace %v: %v", name, ns, err) + return fmt.Errorf("no service with name %v found in namespace %v: %v", name, ns, err) } - return fmt.Errorf("Unexpected error searching service with name %v in namespace %v: %v", name, ns, err) + return fmt.Errorf("unexpected error searching service with name %v in namespace %v: %v", name, ns, err) } return nil diff --git a/cmd/nginx/main_test.go b/cmd/nginx/main_test.go index f57c02c5e..13f1e9eec 100644 --- a/cmd/nginx/main_test.go +++ b/cmd/nginx/main_test.go @@ -47,7 +47,7 @@ func TestCreateApiserverClient(t *testing.T) { func init() { // the default value of nginx.TemplatePath assumes the template exists in // the root filesystem and not in the rootfs directory - path, err := filepath.Abs(filepath.Join("../../rootfs/", nginx.TemplatePath)) + path, err := filepath.Abs(filepath.Join("..", "..", "rootfs", nginx.TemplatePath)) if err == nil { nginx.TemplatePath = path } @@ -87,14 +87,14 @@ func TestHandleSigterm(t *testing.T) { ingressflags.ResetForTesting(func() { t.Fatal("bad parse") }) - os.Setenv("POD_NAME", podName) - os.Setenv("POD_NAMESPACE", namespace) + t.Setenv("POD_NAME", podName) + t.Setenv("POD_NAMESPACE", namespace) oldArgs := os.Args defer func() { - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", "") os.Args = oldArgs }() diff --git a/cmd/plugin/commands/backends/backends.go b/cmd/plugin/commands/backends/backends.go index afc98e4d6..ff44fd9c2 100644 --- a/cmd/plugin/commands/backends/backends.go +++ b/cmd/plugin/commands/backends/backends.go @@ -63,13 +63,14 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func backends(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, backend string, onlyList bool) error { +func backends(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container, backend string, onlyList bool) error { var command []string - if onlyList { + switch { + case onlyList: command = []string{"/dbg", "backends", "list"} - } else if backend != "" { + case backend != "": command = []string{"/dbg", "backends", "get", backend} - } else { + default: command = []string{"/dbg", "backends", "all"} } diff --git a/cmd/plugin/commands/certs/certs.go b/cmd/plugin/commands/certs/certs.go index 1f08b5216..ee27cf1b1 100644 --- a/cmd/plugin/commands/certs/certs.go +++ b/cmd/plugin/commands/certs/certs.go @@ -59,7 +59,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func certs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, host string) error { +func certs(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container, host string) error { command := []string{"/dbg", "certs", "get", host} pod, err := request.ChoosePod(flags, podName, deployment, selector) diff --git a/cmd/plugin/commands/conf/conf.go b/cmd/plugin/commands/conf/conf.go index a7f03a062..090fb40bb 100644 --- a/cmd/plugin/commands/conf/conf.go +++ b/cmd/plugin/commands/conf/conf.go @@ -55,7 +55,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func conf(flags *genericclioptions.ConfigFlags, host string, podName string, deployment string, selector string, container string) error { +func conf(flags *genericclioptions.ConfigFlags, host, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/exec/exec.go b/cmd/plugin/commands/exec/exec.go index f06aaeb23..8e853c534 100644 --- a/cmd/plugin/commands/exec/exec.go +++ b/cmd/plugin/commands/exec/exec.go @@ -55,7 +55,7 @@ type execFlags struct { Stdin bool } -func exec(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, cmd []string, opts execFlags) error { +func exec(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string, cmd []string, opts execFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/general/general.go b/cmd/plugin/commands/general/general.go index fa6c1301f..cea403562 100644 --- a/cmd/plugin/commands/general/general.go +++ b/cmd/plugin/commands/general/general.go @@ -47,7 +47,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func general(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { +func general(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/ingresses/ingresses.go b/cmd/plugin/commands/ingresses/ingresses.go index dff967103..8a25418db 100644 --- a/cmd/plugin/commands/ingresses/ingresses.go +++ b/cmd/plugin/commands/ingresses/ingresses.go @@ -74,9 +74,9 @@ func ingresses(flags *genericclioptions.ConfigFlags, host string, allNamespaces if host != "" { rowsWithHost := make([]ingressRow, 0) - for _, row := range rows { - if row.Host == host { - rowsWithHost = append(rowsWithHost, row) + for i := range rows { + if rows[i].Host == host { + rowsWithHost = append(rowsWithHost, rows[i]) } } rows = rowsWithHost @@ -91,7 +91,8 @@ func ingresses(flags *genericclioptions.ConfigFlags, host string, allNamespaces fmt.Fprintln(printer, "INGRESS NAME\tHOST+PATH\tADDRESSES\tTLS\tSERVICE\tSERVICE PORT\tENDPOINTS") } - for _, row := range rows { + for i := range rows { + row := &rows[i] var tlsMsg string if row.TLS { tlsMsg = "YES" @@ -134,8 +135,8 @@ type ingressRow struct { func getIngressRows(ingresses *[]networking.Ingress) []ingressRow { rows := make([]ingressRow, 0) - for _, ing := range *ingresses { - + for i := range *ingresses { + ing := &(*ingresses)[i] address := "" for _, lbIng := range ing.Status.LoadBalancer.Ingress { if len(lbIng.IP) > 0 { @@ -182,7 +183,7 @@ func getIngressRows(ingresses *[]networking.Ingress) []ingressRow { for _, rule := range ing.Spec.Rules { _, hasTLS := tlsHosts[rule.Host] - //Handle ingress with no paths + // Handle ingress with no paths if rule.HTTP == nil { row := ingressRow{ Namespace: ing.Namespace, diff --git a/cmd/plugin/commands/ingresses/ingresses_test.go b/cmd/plugin/commands/ingresses/ingresses_test.go index 6a8d8837f..7a90efe46 100644 --- a/cmd/plugin/commands/ingresses/ingresses_test.go +++ b/cmd/plugin/commands/ingresses/ingresses_test.go @@ -24,7 +24,6 @@ import ( ) func TestGetIngressInformation(t *testing.T) { - testcases := map[string]struct { ServiceBackend *networking.IngressServiceBackend wantName string diff --git a/cmd/plugin/commands/lint/main.go b/cmd/plugin/commands/lint/main.go index 2daf8eb87..847fe86c9 100644 --- a/cmd/plugin/commands/lint/main.go +++ b/cmd/plugin/commands/lint/main.go @@ -111,11 +111,13 @@ type lintOptions struct { } func (opts *lintOptions) Validate() error { + //nolint:dogsled // Ignore 3 blank identifiers _, _, _, err := util.ParseVersionString(opts.versionFrom) if err != nil { return err } + //nolint:dogsled // Ignore 3 blank identifiers _, _, _, err = util.ParseVersionString(opts.versionTo) if err != nil { return err @@ -131,9 +133,9 @@ type lint interface { Version() string } -func checkObjectArray(lints []lint, objects []kmeta.Object, opts lintOptions) { +func checkObjectArray(allLints []lint, objects []kmeta.Object, opts lintOptions) { usedLints := make([]lint, 0) - for _, lint := range lints { + for _, lint := range allLints { lintVersion := lint.Version() if lint.Version() == "" { lintVersion = "0.0.0" @@ -189,7 +191,7 @@ func ingresses(opts lintOptions) error { return err } - var iLints []lints.IngressLint = lints.GetIngressLints() + iLints := lints.GetIngressLints() genericLints := make([]lint, len(iLints)) for i := range iLints { genericLints[i] = iLints[i] @@ -216,7 +218,7 @@ func deployments(opts lintOptions) error { return err } - var iLints []lints.DeploymentLint = lints.GetDeploymentLints() + iLints := lints.GetDeploymentLints() genericLints := make([]lint, len(iLints)) for i := range iLints { genericLints[i] = iLints[i] diff --git a/cmd/plugin/commands/logs/logs.go b/cmd/plugin/commands/logs/logs.go index 56f4fc640..22068d469 100644 --- a/cmd/plugin/commands/logs/logs.go +++ b/cmd/plugin/commands/logs/logs.go @@ -95,7 +95,7 @@ func (o *logsFlags) toStrings() []string { return r } -func logs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, opts logsFlags) error { +func logs(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string, opts logsFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/commands/ssh/ssh.go b/cmd/plugin/commands/ssh/ssh.go index fe1b3e9fe..a4762d781 100644 --- a/cmd/plugin/commands/ssh/ssh.go +++ b/cmd/plugin/commands/ssh/ssh.go @@ -45,7 +45,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func ssh(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { +func ssh(flags *genericclioptions.ConfigFlags, podName, deployment, selector, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err diff --git a/cmd/plugin/kubectl/kubectl.go b/cmd/plugin/kubectl/kubectl.go index 1171e9218..cb33243fc 100644 --- a/cmd/plugin/kubectl/kubectl.go +++ b/cmd/plugin/kubectl/kubectl.go @@ -38,11 +38,11 @@ func PodExecString(flags *genericclioptions.ConfigFlags, pod *apiv1.Pod, contain // ExecToString runs a kubectl subcommand and returns stdout as a string func ExecToString(flags *genericclioptions.ConfigFlags, args []string) (string, error) { - kArgs := getKubectlConfigFlags(flags) - kArgs = append(kArgs, args...) + kubectlArgs := getKubectlConfigFlags(flags) + kubectlArgs = append(kubectlArgs, args...) buf := bytes.NewBuffer(make([]byte, 0)) - err := execToWriter(append([]string{"kubectl"}, kArgs...), buf) + err := execToWriter(append([]string{"kubectl"}, kubectlArgs...), buf) if err != nil { return "", err } @@ -51,9 +51,9 @@ func ExecToString(flags *genericclioptions.ConfigFlags, args []string) (string, // Exec replaces the current process with a kubectl invocation func Exec(flags *genericclioptions.ConfigFlags, args []string) error { - kArgs := getKubectlConfigFlags(flags) - kArgs = append(kArgs, args...) - return execCommand(append([]string{"kubectl"}, kArgs...)) + kubectlArgs := getKubectlConfigFlags(flags) + kubectlArgs = append(kubectlArgs, args...) + return execCommand(append([]string{"kubectl"}, kubectlArgs...)) } // Replaces the currently running process with the given command @@ -70,6 +70,7 @@ func execCommand(args []string) error { // Runs a command and returns stdout func execToWriter(args []string, writer io.Writer) error { + //nolint:gosec // Ignore G204 error cmd := exec.Command(args[0], args[1:]...) op, err := cmd.StdoutPipe() @@ -78,7 +79,7 @@ func execToWriter(args []string, writer io.Writer) error { } go func() { - io.Copy(writer, op) //nolint:errcheck + io.Copy(writer, op) //nolint:errcheck // Ignore the error }() err = cmd.Run() if err != nil { @@ -106,7 +107,6 @@ func getKubectlConfigFlags(flags *genericclioptions.ConfigFlags) []string { appendStringFlag(o, flags.Password, "password") appendStringFlag(o, flags.ClusterName, "cluster") appendStringFlag(o, flags.AuthInfoName, "user") - //appendStringFlag(o, flags.Namespace, "namespace") appendStringFlag(o, flags.Context, "context") appendStringFlag(o, flags.APIServer, "server") appendBoolFlag(o, flags.Insecure, "insecure-skip-tls-verify") @@ -128,7 +128,7 @@ func appendBoolFlag(out *[]string, in *bool, flag string) { } } -func appendStringArrayFlag(out *[]string, in *[]string, flag string) { +func appendStringArrayFlag(out, in *[]string, flag string) { if in != nil && len(*in) > 0 { *out = append(*out, fmt.Sprintf("--%v=%v'", flag, strings.Join(*in, ","))) } diff --git a/cmd/plugin/lints/deployment.go b/cmd/plugin/lints/deployment.go index a1c473f1e..ce1712284 100644 --- a/cmd/plugin/lints/deployment.go +++ b/cmd/plugin/lints/deployment.go @@ -35,7 +35,10 @@ type DeploymentLint struct { // Check returns true if the lint detects an issue func (lint DeploymentLint) Check(obj kmeta.Object) bool { - cmp := obj.(*v1.Deployment) + cmp, ok := obj.(*v1.Deployment) + if !ok { + util.PrintError(fmt.Errorf("unexpected type: %T", obj)) + } return lint.f(*cmp) } @@ -72,11 +75,11 @@ func removedFlag(flag string, issueNumber int, version string) DeploymentLint { issue: issueNumber, version: version, f: func(dep v1.Deployment) bool { - if !isIngressNginxDeployment(dep) { + if !isIngressNginxDeployment(&dep) { return false } - args := getNginxArgs(dep) + args := getNginxArgs(&dep) for _, arg := range args { if strings.HasPrefix(arg, fmt.Sprintf("--%v", flag)) { return true @@ -88,8 +91,9 @@ func removedFlag(flag string, issueNumber int, version string) DeploymentLint { } } -func getNginxArgs(dep v1.Deployment) []string { - for _, container := range dep.Spec.Template.Spec.Containers { +func getNginxArgs(dep *v1.Deployment) []string { + for i := range dep.Spec.Template.Spec.Containers { + container := &dep.Spec.Template.Spec.Containers[i] if len(container.Args) > 0 && container.Args[0] == "/nginx-ingress-controller" { return container.Args } @@ -97,10 +101,10 @@ func getNginxArgs(dep v1.Deployment) []string { return make([]string, 0) } -func isIngressNginxDeployment(dep v1.Deployment) bool { +func isIngressNginxDeployment(dep *v1.Deployment) bool { containers := dep.Spec.Template.Spec.Containers - for _, container := range containers { - if len(container.Args) > 0 && container.Args[0] == "/nginx-ingress-controller" { + for i := range containers { + if len(containers[i].Args) > 0 && containers[i].Args[0] == "/nginx-ingress-controller" { return true } } diff --git a/cmd/plugin/lints/ingress.go b/cmd/plugin/lints/ingress.go index ea08bfd8b..d5ad42e2c 100644 --- a/cmd/plugin/lints/ingress.go +++ b/cmd/plugin/lints/ingress.go @@ -30,13 +30,16 @@ type IngressLint struct { message string issue int version string - f func(ing networking.Ingress) bool + f func(ing *networking.Ingress) bool } // Check returns true if the lint detects an issue func (lint IngressLint) Check(obj kmeta.Object) bool { - ing := obj.(*networking.Ingress) - return lint.f(*ing) + ing, ok := obj.(*networking.Ingress) + if !ok { + util.PrintError(fmt.Errorf("unexpected type: %T", obj)) + } + return lint.f(ing) } // Message is a description of the lint @@ -94,7 +97,7 @@ func GetIngressLints() []IngressLint { } } -func xForwardedPrefixIsBool(ing networking.Ingress) bool { +func xForwardedPrefixIsBool(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/x-forwarded-prefix") && (val == "true" || val == "false") { return true @@ -103,7 +106,7 @@ func xForwardedPrefixIsBool(ing networking.Ingress) bool { return false } -func annotationPrefixIsNginxCom(ing networking.Ingress) bool { +func annotationPrefixIsNginxCom(ing *networking.Ingress) bool { for name := range ing.Annotations { if strings.HasPrefix(name, "nginx.com/") { return true @@ -112,7 +115,7 @@ func annotationPrefixIsNginxCom(ing networking.Ingress) bool { return false } -func annotationPrefixIsNginxOrg(ing networking.Ingress) bool { +func annotationPrefixIsNginxOrg(ing *networking.Ingress) bool { for name := range ing.Annotations { if strings.HasPrefix(name, "nginx.org/") { return true @@ -121,7 +124,7 @@ func annotationPrefixIsNginxOrg(ing networking.Ingress) bool { return false } -func rewriteTargetWithoutCaptureGroup(ing networking.Ingress) bool { +func rewriteTargetWithoutCaptureGroup(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/rewrite-target") && !strings.Contains(val, "$1") { return true @@ -135,7 +138,7 @@ func removedAnnotation(annotationName string, issueNumber int, version string) I message: fmt.Sprintf("Contains the removed %v annotation.", annotationName), issue: issueNumber, version: version, - f: func(ing networking.Ingress) bool { + f: func(ing *networking.Ingress) bool { for annotation := range ing.Annotations { if strings.HasSuffix(annotation, "/"+annotationName) { return true @@ -146,7 +149,7 @@ func removedAnnotation(annotationName string, issueNumber int, version string) I } } -func satisfyDirective(ing networking.Ingress) bool { +func satisfyDirective(ing *networking.Ingress) bool { for name, val := range ing.Annotations { if strings.HasSuffix(name, "/configuration-snippet") { return strings.Contains(val, "satisfy") diff --git a/cmd/plugin/main.go b/cmd/plugin/main.go index f3a809715..e9a8ea59a 100644 --- a/cmd/plugin/main.go +++ b/cmd/plugin/main.go @@ -24,7 +24,7 @@ import ( "k8s.io/cli-runtime/pkg/genericclioptions" - //Just importing this is supposed to allow cloud authentication + // Just importing this is supposed to allow cloud authentication // eg GCP, AWS, Azure ... _ "k8s.io/client-go/plugin/pkg/client/auth" diff --git a/cmd/plugin/request/request.go b/cmd/plugin/request/request.go index fd47564a9..55df85d5e 100644 --- a/cmd/plugin/request/request.go +++ b/cmd/plugin/request/request.go @@ -35,7 +35,7 @@ import ( ) // ChoosePod finds a pod either by deployment or by name -func ChoosePod(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string) (apiv1.Pod, error) { +func ChoosePod(flags *genericclioptions.ConfigFlags, podName, deployment, selector string) (apiv1.Pod, error) { if podName != "" { return GetNamedPod(flags, podName) } @@ -54,9 +54,9 @@ func GetNamedPod(flags *genericclioptions.ConfigFlags, name string) (apiv1.Pod, return apiv1.Pod{}, err } - for _, pod := range allPods { - if pod.Name == name { - return pod, nil + for i := range allPods { + if allPods[i].Name == name { + return allPods[i], nil } } @@ -132,7 +132,7 @@ func GetIngressDefinitions(flags *genericclioptions.ConfigFlags, namespace strin } // GetNumEndpoints counts the number of endpointslices adresses for the service with the given name -func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace string, serviceName string) (*int, error) { +func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace, serviceName string) (*int, error) { epss, err := GetEndpointSlicesByName(flags, namespace, serviceName) if err != nil { return nil, err @@ -143,25 +143,26 @@ func GetNumEndpoints(flags *genericclioptions.ConfigFlags, namespace string, ser } ret := 0 - for _, eps := range epss { - for _, ep := range eps.Endpoints { - ret += len(ep.Addresses) + for i := range epss { + eps := &epss[i] + for j := range eps.Endpoints { + ret += len(eps.Endpoints[j].Addresses) } } return &ret, nil } // GetEndpointSlicesByName returns the endpointSlices for the service with the given name -func GetEndpointSlicesByName(flags *genericclioptions.ConfigFlags, namespace string, name string) ([]discoveryv1.EndpointSlice, error) { +func GetEndpointSlicesByName(flags *genericclioptions.ConfigFlags, namespace, name string) ([]discoveryv1.EndpointSlice, error) { allEndpointsSlices, err := getEndpointSlices(flags, namespace) if err != nil { return nil, err } var eps []discoveryv1.EndpointSlice - for _, slice := range allEndpointsSlices { - if svcName, ok := slice.ObjectMeta.GetLabels()[discoveryv1.LabelServiceName]; ok { + for i := range allEndpointsSlices { + if svcName, ok := allEndpointsSlices[i].ObjectMeta.GetLabels()[discoveryv1.LabelServiceName]; ok { if svcName == name { - eps = append(eps, slice) + eps = append(eps, allEndpointsSlices[i]) } } } @@ -182,7 +183,7 @@ func getEndpointSlices(flags *genericclioptions.ConfigFlags, namespace string) ( tryAllNamespacesEndpointSlicesCache(flags) } - cachedEndpointSlices = tryFilteringEndpointSlicesFromAllNamespacesCache(flags, namespace) + cachedEndpointSlices = tryFilteringEndpointSlicesFromAllNamespacesCache(namespace) if cachedEndpointSlices != nil { return *cachedEndpointSlices, nil @@ -217,13 +218,13 @@ func tryAllNamespacesEndpointSlicesCache(flags *genericclioptions.ConfigFlags) { } } -func tryFilteringEndpointSlicesFromAllNamespacesCache(flags *genericclioptions.ConfigFlags, namespace string) *[]discoveryv1.EndpointSlice { +func tryFilteringEndpointSlicesFromAllNamespacesCache(namespace string) *[]discoveryv1.EndpointSlice { allEndpointSlices := endpointSlicesCache[""] if allEndpointSlices != nil { endpointSlices := make([]discoveryv1.EndpointSlice, 0) - for _, slice := range *allEndpointSlices { - if slice.Namespace == namespace { - endpointSlices = append(endpointSlices, slice) + for i := range *allEndpointSlices { + if (*allEndpointSlices)[i].Namespace == namespace { + endpointSlices = append(endpointSlices, (*allEndpointSlices)[i]) } } endpointSlicesCache[namespace] = &endpointSlices @@ -242,9 +243,9 @@ func GetServiceByName(flags *genericclioptions.ConfigFlags, name string, service services = &servicesArray } - for _, svc := range *services { - if svc.Name == name { - return svc, nil + for i := range *services { + if (*services)[i].Name == name { + return (*services)[i], nil } } @@ -288,7 +289,6 @@ func getLabeledPods(flags *genericclioptions.ConfigFlags, label string) ([]apiv1 pods, err := api.Pods(namespace).List(context.TODO(), metav1.ListOptions{ LabelSelector: label, }) - if err != nil { return make([]apiv1.Pod, 0), err } @@ -303,9 +303,9 @@ func getDeploymentPods(flags *genericclioptions.ConfigFlags, deployment string) } ingressPods := make([]apiv1.Pod, 0) - for _, pod := range pods { - if util.PodInDeployment(pod, deployment) { - ingressPods = append(ingressPods, pod) + for i := range pods { + if util.PodInDeployment(&pods[i], deployment) { + ingressPods = append(ingressPods, pods[i]) } } @@ -331,5 +331,4 @@ func getServices(flags *genericclioptions.ConfigFlags) ([]apiv1.Service, error) } return services.Items, nil - } diff --git a/cmd/plugin/util/util.go b/cmd/plugin/util/util.go index e1910140d..aa753689a 100644 --- a/cmd/plugin/util/util.go +++ b/cmd/plugin/util/util.go @@ -47,17 +47,25 @@ func PrintError(e error) { } // ParseVersionString returns the major, minor, and patch numbers of a version string -func ParseVersionString(v string) (int, int, int, error) { +func ParseVersionString(v string) (major, minor, patch int, err error) { parts := versionRegex.FindStringSubmatch(v) if len(parts) != 4 { return 0, 0, 0, fmt.Errorf("could not parse %v as a version string (like 0.20.3)", v) } - major, _ := strconv.Atoi(parts[1]) - minor, _ := strconv.Atoi(parts[2]) - patch, _ := strconv.Atoi(parts[3]) - + major, err = strconv.Atoi(parts[1]) + if err != nil { + return 0, 0, 0, err + } + minor, err = strconv.Atoi(parts[2]) + if err != nil { + return 0, 0, 0, err + } + patch, err = strconv.Atoi(parts[3]) + if err != nil { + return 0, 0, 0, err + } return major, minor, patch, nil } @@ -90,7 +98,7 @@ func isVersionLessThan(a, b string) bool { // PodInDeployment returns whether a pod is part of a deployment with the given name // a pod is considered to be in {deployment} if it is owned by a replicaset with a name of format {deployment}-otherchars -func PodInDeployment(pod apiv1.Pod, deployment string) bool { +func PodInDeployment(pod *apiv1.Pod, deployment string) bool { for _, owner := range pod.OwnerReferences { if owner.Controller == nil || !*owner.Controller || owner.Kind != "ReplicaSet" { continue @@ -138,7 +146,7 @@ func AddContainerFlag(cmd *cobra.Command) *string { // GetNamespace takes a set of kubectl flag values and returns the namespace we should be operating in func GetNamespace(flags *genericclioptions.ConfigFlags) string { namespace, _, err := flags.ToRawKubeConfigLoader().Namespace() - if err != nil || len(namespace) == 0 { + if err != nil || namespace == "" { namespace = apiv1.NamespaceDefault } return namespace diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index c45b1e72c..398304c57 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -716,7 +716,7 @@ Do not try to edit it manually. ### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) -- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) +- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) ### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) diff --git a/images/fastcgi-helloserver/rootfs/main.go b/images/fastcgi-helloserver/rootfs/main.go index a42c9a487..710f90f2c 100644 --- a/images/fastcgi-helloserver/rootfs/main.go +++ b/images/fastcgi-helloserver/rootfs/main.go @@ -16,13 +16,13 @@ func hello(w http.ResponseWriter, r *http.Request) { } key := keys[0] - fmt.Fprintf(w, "Hello "+string(key)+"!") + fmt.Fprintf(w, "Hello "+key+"!") } func main() { http.HandleFunc("/hello", hello) - l, err := net.Listen("tcp", "0.0.0.0:9000") + l, err := net.Listen("tcp", "0.0.0.0:9000") //nolint:gosec // Ignore the gosec error since it's a hello server if err != nil { panic(err) } diff --git a/images/go-grpc-greeter-server/rootfs/main.go b/images/go-grpc-greeter-server/rootfs/main.go index 569273dfd..d7fc36208 100644 --- a/images/go-grpc-greeter-server/rootfs/main.go +++ b/images/go-grpc-greeter-server/rootfs/main.go @@ -41,7 +41,7 @@ type hwServer struct { } // SayHello implements helloworld.GreeterServer -func (s *hwServer) SayHello(ctx context.Context, in *hwpb.HelloRequest) (*hwpb.HelloReply, error) { +func (s *hwServer) SayHello(_ context.Context, in *hwpb.HelloRequest) (*hwpb.HelloReply, error) { return &hwpb.HelloReply{Message: "Hello " + in.Name}, nil } @@ -49,7 +49,7 @@ type ecServer struct { ecpb.UnimplementedEchoServer } -func (s *ecServer) UnaryEcho(ctx context.Context, req *ecpb.EchoRequest) (*ecpb.EchoResponse, error) { +func (s *ecServer) UnaryEcho(_ context.Context, req *ecpb.EchoRequest) (*ecpb.EchoResponse, error) { return &ecpb.EchoResponse{Message: req.Message}, nil } diff --git a/internal/admission/controller/main.go b/internal/admission/controller/main.go index f59bf2091..888818c89 100644 --- a/internal/admission/controller/main.go +++ b/internal/admission/controller/main.go @@ -42,19 +42,16 @@ type IngressAdmission struct { Checker Checker } -var ( - ingressResource = metav1.GroupVersionKind{ - Group: networking.GroupName, - Version: "v1", - Kind: "Ingress", - } -) +var ingressResource = metav1.GroupVersionKind{ + Group: networking.GroupName, + Version: "v1", + Kind: "Ingress", +} // HandleAdmission populates the admission Response // with Allowed=false if the Object is an ingress that would prevent nginx to reload the configuration // with Allowed=true otherwise func (ia *IngressAdmission) HandleAdmission(obj runtime.Object) (runtime.Object, error) { - review, isV1 := obj.(*admissionv1.AdmissionReview) if !isV1 { return nil, fmt.Errorf("request is not of type AdmissionReview v1 or v1beta1") diff --git a/internal/admission/controller/main_test.go b/internal/admission/controller/main_test.go index 8c42f87ef..1d223cc9e 100644 --- a/internal/admission/controller/main_test.go +++ b/internal/admission/controller/main_test.go @@ -33,12 +33,12 @@ type failTestChecker struct { t *testing.T } -func (ftc failTestChecker) CheckIngress(ing *networking.Ingress) error { +func (ftc failTestChecker) CheckIngress(_ *networking.Ingress) error { ftc.t.Error("checker should not be called") return nil } -func (ftc failTestChecker) CheckWarning(ing *networking.Ingress) ([]string, error) { +func (ftc failTestChecker) CheckWarning(_ *networking.Ingress) ([]string, error) { ftc.t.Error("checker should not be called") return nil, nil } diff --git a/internal/admission/controller/server.go b/internal/admission/controller/server.go index 3fa70971f..7fc61bcbb 100644 --- a/internal/admission/controller/server.go +++ b/internal/admission/controller/server.go @@ -26,9 +26,7 @@ import ( "k8s.io/klog/v2" ) -var ( - scheme = runtime.NewScheme() -) +var scheme = runtime.NewScheme() func init() { if err := admissionv1.AddToScheme(scheme); err != nil { diff --git a/internal/ingress/annotations/alias/main.go b/internal/ingress/annotations/alias/main.go index 4a5e6f188..7a33e648e 100644 --- a/internal/ingress/annotations/alias/main.go +++ b/internal/ingress/annotations/alias/main.go @@ -72,7 +72,7 @@ func (a alias) Parse(ing *networking.Ingress) (interface{}, error) { aliases := sets.NewString() for _, alias := range strings.Split(val, ",") { alias = strings.TrimSpace(alias) - if len(alias) == 0 { + if alias == "" { continue } diff --git a/internal/ingress/annotations/alias/main_test.go b/internal/ingress/annotations/alias/main_test.go index 1965f2630..f1d68c1f7 100644 --- a/internal/ingress/annotations/alias/main_test.go +++ b/internal/ingress/annotations/alias/main_test.go @@ -65,9 +65,9 @@ func TestParse(t *testing.T) { if testCase.skipValidation { parser.EnableAnnotationValidation = false } - defer func() { + t.Cleanup(func() { parser.EnableAnnotationValidation = true - }() + }) result, err := ap.Parse(ing) if (err != nil) != testCase.wantErr { t.Errorf("ParseAliasAnnotation() annotation: %s, error = %v, wantErr %v", testCase.annotations, err, testCase.wantErr) diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 5371e6eb7..38843c2db 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -86,37 +86,36 @@ type Ingress struct { CorsConfig cors.Config CustomHTTPErrors []int DefaultBackend *apiv1.Service - //TODO: Change this back into an error when https://github.com/imdario/mergo/issues/100 is resolved - FastCGI fastcgi.Config - Denied *string - ExternalAuth authreq.Config - EnableGlobalAuth bool - HTTP2PushPreload bool - Opentracing opentracing.Config - Opentelemetry opentelemetry.Config - Proxy proxy.Config - ProxySSL proxyssl.Config - RateLimit ratelimit.Config - GlobalRateLimit globalratelimit.Config - Redirect redirect.Config - Rewrite rewrite.Config - Satisfy string - ServerSnippet string - ServiceUpstream bool - SessionAffinity sessionaffinity.Config - SSLPassthrough bool - UsePortInRedirects bool - UpstreamHashBy upstreamhashby.Config - LoadBalancing string - UpstreamVhost string - Denylist ipdenylist.SourceRange - XForwardedPrefix string - SSLCipher sslcipher.Config - Logs log.Config - ModSecurity modsecurity.Config - Mirror mirror.Config - StreamSnippet string - Allowlist ipallowlist.SourceRange + FastCGI fastcgi.Config + Denied *string + ExternalAuth authreq.Config + EnableGlobalAuth bool + HTTP2PushPreload bool + Opentracing opentracing.Config + Opentelemetry opentelemetry.Config + Proxy proxy.Config + ProxySSL proxyssl.Config + RateLimit ratelimit.Config + GlobalRateLimit globalratelimit.Config + Redirect redirect.Config + Rewrite rewrite.Config + Satisfy string + ServerSnippet string + ServiceUpstream bool + SessionAffinity sessionaffinity.Config + SSLPassthrough bool + UsePortInRedirects bool + UpstreamHashBy upstreamhashby.Config + LoadBalancing string + UpstreamVhost string + Denylist ipdenylist.SourceRange + XForwardedPrefix string + SSLCipher sslcipher.Config + Logs log.Config + ModSecurity modsecurity.Config + Mirror mirror.Config + StreamSnippet string + Allowlist ipallowlist.SourceRange } // Extractor defines the annotation parsers to be used in the extraction of annotations diff --git a/internal/ingress/annotations/annotations_test.go b/internal/ingress/annotations/annotations_test.go index 2b2a64268..5f8128e0d 100644 --- a/internal/ingress/annotations/annotations_test.go +++ b/internal/ingress/annotations/annotations_test.go @@ -64,7 +64,11 @@ func (m mockCfg) GetService(name string) (*apiv1.Service, error) { } func (m mockCfg) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if secret, _ := m.GetSecret(name); secret != nil { + secret, err := m.GetSecret(name) + if err != nil { + return nil, err + } + if secret != nil { return &resolver.AuthSSLCert{ Secret: name, CAFileName: "/opt/ca.pem", @@ -270,9 +274,9 @@ func TestCors(t *testing.T) { if r.CorsAllowCredentials != foo.credentials { t.Errorf("Returned %v but expected %v for Cors Credentials", r.CorsAllowCredentials, foo.credentials) } - } } + func TestCustomHTTPErrors(t *testing.T) { ec := NewAnnotationExtractor(mockCfg{}) ing := buildIngress() diff --git a/internal/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go index beecebdb1..7c7fde7b8 100644 --- a/internal/ingress/annotations/auth/main.go +++ b/internal/ingress/annotations/auth/main.go @@ -50,7 +50,7 @@ var ( ) var AuthSecretConfig = parser.AnnotationConfig{ - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the name of the Secret that contains the usernames and passwords which are granted access to the paths defined in the Ingress rules. `, @@ -61,20 +61,20 @@ var authSecretAnnotations = parser.Annotation{ Annotations: parser.AnnotationFields{ AuthSecretAnnotation: AuthSecretConfig, authSecretTypeAnnotation: { - Validator: parser.ValidateRegex(*authSecretTypeRegex, true), + Validator: parser.ValidateRegex(authSecretTypeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation what is the format of auth-secret value. Can be "auth-file" that defines the content of an htpasswd file, or "auth-map" where each key is a user and each value is the password.`, }, authRealmAnnotation: { - Validator: parser.ValidateRegex(*parser.CharsWithSpace, false), + Validator: parser.ValidateRegex(parser.CharsWithSpace, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the realm (message) that should be shown to user when authentication is requested.`, }, authTypeAnnotation: { - Validator: parser.ValidateRegex(*authTypeRegex, true), + Validator: parser.ValidateRegex(authTypeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines the basic authentication type. Should be "basic" or "digest"`, @@ -167,14 +167,14 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { s, err := parser.GetStringAnnotation(AuthSecretAnnotation, ing, a.annotationConfig.Annotations) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading secret name from annotation: %w", err), } } sns, sname, err := cache.SplitMetaNamespaceKey(s) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading secret name from annotation: %w", err), } } @@ -185,7 +185,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { secCfg := a.r.GetSecurityConfiguration() // We don't accept different namespaces for secrets. if !secCfg.AllowCrossNamespaceResources && sns != ing.Namespace { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), } } @@ -193,7 +193,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { name := fmt.Sprintf("%v/%v", sns, sname) secret, err := a.r.GetSecret(name) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error reading secret %s: %w", name, err), } } @@ -217,7 +217,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { return nil, err } default: - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("invalid auth-secret-type in annotation, must be 'auth-file' or 'auth-map': %w", err), } } @@ -238,14 +238,14 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) { func dumpSecretAuthFile(filename string, secret *api.Secret) error { val, ok := secret.Data["auth"] if !ok { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the secret %s does not contain a key with value auth", secret.Name), } } err := os.WriteFile(filename, val, file.ReadWriteByUser) if err != nil { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error creating password file: %w", err), } } @@ -264,7 +264,7 @@ func dumpSecretAuthMap(filename string, secret *api.Secret) error { err := os.WriteFile(filename, []byte(builder.String()), file.ReadWriteByUser) if err != nil { - return ing_errors.LocationDenied{ + return ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error creating password file: %w", err), } } diff --git a/internal/ingress/annotations/auth/main_test.go b/internal/ingress/annotations/auth/main_test.go index 2a9dc7c72..868f31a05 100644 --- a/internal/ingress/annotations/auth/main_test.go +++ b/internal/ingress/annotations/auth/main_test.go @@ -32,6 +32,15 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +//nolint:gosec // Ignore hardcoded credentials error in testing +const ( + authType = "basic" + authRealm = "-realm-" + defaultDemoSecret = "default/demo-secret" + othernsDemoSecret = "otherns/demo-secret" + demoSecret = "demo-secret" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -80,7 +89,7 @@ type mockSecret struct { } func (m mockSecret) GetSecret(name string) (*api.Secret, error) { - if name != "default/demo-secret" && name != "otherns/demo-secret" { + if name != defaultDemoSecret && name != othernsDemoSecret { return nil, fmt.Errorf("there is no secret with name %v", name) } @@ -92,7 +101,7 @@ func (m mockSecret) GetSecret(name string) (*api.Secret, error) { return &api.Secret{ ObjectMeta: meta_v1.ObjectMeta{ Namespace: ns, - Name: "demo-secret", + Name: demoSecret, }, Data: map[string][]byte{"auth": []byte("foo:$apr1$OFG3Xybp$ckL0FHDAkoXYIlH9.cysT0")}, }, nil @@ -129,9 +138,9 @@ func TestIngressInvalidRealm(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "something weird ; location trying to { break }" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -148,14 +157,14 @@ func TestIngressInvalidDifferentNamespace(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = othernsDemoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("cross namespace usage of secrets is not allowed"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -168,8 +177,8 @@ func TestIngressInvalidDifferentNamespaceAllowed(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "otherns/demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = othernsDemoSecret ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -187,14 +196,14 @@ func TestIngressInvalidSecretName(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret;xpto" ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("error reading secret name from annotation: annotation nginx.ingress.kubernetes.io/auth-secret contains invalid value"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -207,13 +216,13 @@ func TestInvalidIngressAuthNoSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) defer os.RemoveAll(dir) - expected := ing_errors.LocationDenied{ + expected := ing_errors.LocationDeniedError{ Reason: errors.New("error reading secret name from annotation: ingress rule without annotations"), } _, err := NewParser(dir, &mockSecret{}).Parse(ing) @@ -226,9 +235,9 @@ func TestIngressAuth(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -242,10 +251,10 @@ func TestIngressAuth(t *testing.T) { if !ok { t.Errorf("expected a BasicDigest type") } - if auth.Type != "basic" { + if auth.Type != authType { t.Errorf("Expected basic as auth type but returned %s", auth.Type) } - if auth.Realm != "-realm-" { + if auth.Realm != authRealm { t.Errorf("Expected -realm- as realm but returned %s", auth.Realm) } if !auth.Secured { @@ -257,9 +266,9 @@ func TestIngressAuthWithoutSecret(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "invalid-secret" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -275,10 +284,10 @@ func TestIngressAuthInvalidSecretKey(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = "basic" - data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = "demo-secret" + data[parser.GetAnnotationWithPrefix(authTypeAnnotation)] = authType + data[parser.GetAnnotationWithPrefix(AuthSecretAnnotation)] = demoSecret data[parser.GetAnnotationWithPrefix(authSecretTypeAnnotation)] = "invalid-type" - data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = "-realm-" + data[parser.GetAnnotationWithPrefix(authRealmAnnotation)] = authRealm ing.SetAnnotations(data) _, dir, _ := dummySecretContent(t) @@ -290,7 +299,7 @@ func TestIngressAuthInvalidSecretKey(t *testing.T) { } } -func dummySecretContent(t *testing.T) (string, string, *api.Secret) { +func dummySecretContent(t *testing.T) (fileName, dir string, s *api.Secret) { dir, err := os.MkdirTemp("", fmt.Sprintf("%v", time.Now().Unix())) if err != nil { t.Error(err) @@ -301,7 +310,10 @@ func dummySecretContent(t *testing.T) (string, string, *api.Secret) { t.Error(err) } defer tmpfile.Close() - s, _ := mockSecret{}.GetSecret("default/demo-secret") + s, err = mockSecret{}.GetSecret(defaultDemoSecret) + if err != nil { + t.Errorf("unexpected error: %v", err) + } return tmpfile.Name(), dir, s } diff --git a/internal/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go index b8ba4f125..c66b0ed47 100644 --- a/internal/ingress/annotations/authreq/main.go +++ b/internal/ingress/annotations/authreq/main.go @@ -57,25 +57,25 @@ var authReqAnnotations = parser.Annotation{ Group: "authentication", Annotations: parser.AnnotationFields{ authReqURLAnnotation: { - Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Validator: parser.ValidateRegex(parser.URLWithNginxVariableRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation allows to indicate the URL where the HTTP request should be sent`, }, authReqMethodAnnotation: { - Validator: parser.ValidateRegex(*methodsRegex, true), + Validator: parser.ValidateRegex(methodsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation allows to specify the HTTP method to use`, }, authReqSigninAnnotation: { - Validator: parser.ValidateRegex(*parser.URLWithNginxVariableRegex, true), + Validator: parser.ValidateRegex(parser.URLWithNginxVariableRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation allows to specify the location of the error page`, }, authReqSigninRedirParamAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the URL parameter in the error page which should contain the original URL for a failed signin request`, @@ -87,7 +87,7 @@ var authReqAnnotations = parser.Annotation{ Documentation: `This annotation allows to specify a custom snippet to use with external authentication`, }, authReqCacheKeyAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation enables caching for auth requests.`, @@ -117,26 +117,26 @@ var authReqAnnotations = parser.Annotation{ Documentation: `This annotation specifies a duration in seconds which an idle keepalive connection to an upstream server will stay open`, }, authReqCacheDuration: { - Validator: parser.ValidateRegex(*parser.ExtendedCharsRegex, false), + Validator: parser.ValidateRegex(parser.ExtendedCharsRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify a caching time for auth responses based on their response codes, e.g. 200 202 30m`, }, authReqResponseHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Validator: parser.ValidateRegex(parser.HeadersVariable, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the headers to pass to backend once authentication request completes. They should be separated by comma.`, }, authReqProxySetHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the name of a ConfigMap that specifies headers to pass to the authentication service. Only ConfigMaps on the same namespace are allowed`, }, authReqRequestRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the X-Auth-Request-Redirect header value`, @@ -249,8 +249,8 @@ func (e1 *Config) Equal(e2 *Config) bool { var ( methodsRegex = regexp.MustCompile("(GET|HEAD|POST|PUT|PATCH|DELETE|CONNECT|OPTIONS|TRACE)") headerRegexp = regexp.MustCompile(`^[a-zA-Z\d\-_]+$`) - statusCodeRegex = regexp.MustCompile(`^[\d]{3}$`) - durationRegex = regexp.MustCompile(`^[\d]+(ms|s|m|h|d|w|M|y)$`) // see http://nginx.org/en/docs/syntax.html + statusCodeRegex = regexp.MustCompile(`^\d{3}$`) + durationRegex = regexp.MustCompile(`^\d+(ms|s|m|h|d|w|M|y)$`) // see http://nginx.org/en/docs/syntax.html ) // ValidMethod checks is the provided string a valid HTTP method @@ -273,7 +273,7 @@ func ValidCacheDuration(duration string) bool { seenDuration := false for _, element := range elements { - if len(element) == 0 { + if element == "" { continue } if statusCodeRegex.MatchString(element) { @@ -304,6 +304,8 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to use an Config URL as source for authentication +// +//nolint:gocyclo // Ignore function complexity error func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { // Required Parameters urlString, err := parser.GetStringAnnotation(authReqURLAnnotation, ing, a.annotationConfig.Annotations) @@ -313,7 +315,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { authURL, err := parser.StringToURL(urlString) if err != nil { - return nil, ing_errors.LocationDenied{Reason: fmt.Errorf("could not parse auth-url annotation: %v", err)} + return nil, ing_errors.LocationDeniedError{Reason: fmt.Errorf("could not parse auth-url annotation: %v", err)} } authMethod, err := parser.GetStringAnnotation(authReqMethodAnnotation, ing, a.annotationConfig.Annotations) @@ -410,7 +412,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { if err != nil && ing_errors.IsValidationError(err) { return nil, ing_errors.NewLocationDenied("validation error") } - if len(hstr) != 0 { + if hstr != "" { harr := strings.Split(hstr, ",") for _, header := range harr { header = strings.TrimSpace(header) @@ -430,7 +432,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { cns, _, err := cache.SplitMetaNamespaceKey(proxySetHeaderMap) if err != nil { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading configmap name %s from annotation: %w", proxySetHeaderMap, err), } } @@ -442,7 +444,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { secCfg := a.r.GetSecurityConfiguration() // We don't accept different namespaces for secrets. if !secCfg.AllowCrossNamespaceResources && cns != ing.Namespace { - return nil, ing_errors.LocationDenied{ + return nil, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("cross namespace usage of secrets is not allowed"), } } @@ -499,7 +501,7 @@ func (a authReq) Parse(ing *networking.Ingress) (interface{}, error) { // It will always return at least one duration (the default duration) func ParseStringToCacheDurations(input string) ([]string, error) { authCacheDuration := []string{} - if len(input) != 0 { + if input != "" { arr := strings.Split(input, ",") for _, duration := range arr { duration = strings.TrimSpace(duration) diff --git a/internal/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go index dc5188c8a..3e6df3d3b 100644 --- a/internal/ingress/annotations/authreq/main_test.go +++ b/internal/ingress/annotations/authreq/main_test.go @@ -17,7 +17,6 @@ limitations under the License. package authreq import ( - "fmt" "reflect" "testing" @@ -113,7 +112,7 @@ func TestAnnotations(t *testing.T) { data[parser.GetAnnotationWithPrefix("auth-url")] = test.url data[parser.GetAnnotationWithPrefix("auth-signin")] = test.signinURL data[parser.GetAnnotationWithPrefix("auth-signin-redirect-param")] = test.signinURLRedirectParam - data[parser.GetAnnotationWithPrefix("auth-method")] = fmt.Sprintf("%v", test.method) + data[parser.GetAnnotationWithPrefix("auth-method")] = test.method data[parser.GetAnnotationWithPrefix("auth-request-redirect")] = test.requestRedirect data[parser.GetAnnotationWithPrefix("auth-snippet")] = test.authSnippet data[parser.GetAnnotationWithPrefix("auth-cache-key")] = test.authCacheKey @@ -331,7 +330,6 @@ func TestKeepaliveAnnotations(t *testing.T) { } func TestParseStringToCacheDurations(t *testing.T) { - tests := []struct { title string duration string @@ -346,7 +344,6 @@ func TestParseStringToCacheDurations(t *testing.T) { } for _, test := range tests { - dur, err := ParseStringToCacheDurations(test.duration) if test.expErr { if err == nil { diff --git a/internal/ingress/annotations/authreqglobal/main.go b/internal/ingress/annotations/authreqglobal/main.go index a1641e085..e8a259047 100644 --- a/internal/ingress/annotations/authreqglobal/main.go +++ b/internal/ingress/annotations/authreqglobal/main.go @@ -55,7 +55,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to enable or disable global external authentication func (a authReqGlobal) Parse(ing *networking.Ingress) (interface{}, error) { - enableGlobalAuth, err := parser.GetBoolAnnotation(enableGlobalAuthAnnotation, ing, a.annotationConfig.Annotations) if err != nil { enableGlobalAuth = true diff --git a/internal/ingress/annotations/authreqglobal/main_test.go b/internal/ingress/annotations/authreqglobal/main_test.go index 0313edcf5..734f97c0f 100644 --- a/internal/ingress/annotations/authreqglobal/main_test.go +++ b/internal/ingress/annotations/authreqglobal/main_test.go @@ -77,7 +77,10 @@ func TestAnnotation(t *testing.T) { data[parser.GetAnnotationWithPrefix("enable-global-auth")] = "false" ing.SetAnnotations(data) - i, _ := NewParser(&resolver.Mock{}).Parse(ing) + i, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } u, ok := i.(bool) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/authtls/main.go b/internal/ingress/annotations/authtls/main.go index 5d6763e8b..adedb084a 100644 --- a/internal/ingress/annotations/authtls/main.go +++ b/internal/ingress/annotations/authtls/main.go @@ -18,11 +18,10 @@ package authtls import ( "fmt" + "regexp" networking "k8s.io/api/networking/v1" - "regexp" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" @@ -45,20 +44,20 @@ var ( regexChars = regexp.QuoteMeta(`()|=`) authVerifyClientRegex = regexp.MustCompile(`on|off|optional|optional_no_ca`) commonNameRegex = regexp.MustCompile(`^CN=[/\-.\_\~a-zA-Z0-9` + regexChars + `]*$`) - redirectRegex = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-\.]*(:[0-9]+)?/[A-Za-z0-9\-\.]*)?$`) + redirectRegex = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-.]*(:\d+)?/[A-Za-z0-9\-.]*)?$`) ) var authTLSAnnotations = parser.Annotation{ Group: "authentication", Annotations: parser.AnnotationFields{ annotationAuthTLSSecret: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation defines the secret that contains the certificate chain of allowed certs`, }, annotationAuthTLSVerifyClient: { - Validator: parser.ValidateRegex(*authVerifyClientRegex, true), + Validator: parser.ValidateRegex(authVerifyClientRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium as it allows a subset of chars Documentation: `This annotation enables verification of client certificates. Can be "on", "off", "optional" or "optional_no_ca"`, @@ -70,7 +69,7 @@ var authTLSAnnotations = parser.Annotation{ Documentation: `This annotation defines validation depth between the provided client certificate and the Certification Authority chain.`, }, annotationAuthTLSErrorPage: { - Validator: parser.ValidateRegex(*redirectRegex, true), + Validator: parser.ValidateRegex(redirectRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation defines the URL/Page that user should be redirected in case of a Certificate Authentication Error`, @@ -82,7 +81,7 @@ var authTLSAnnotations = parser.Annotation{ Documentation: `This annotation defines if the received certificates should be passed or not to the upstream server in the header "ssl-client-cert"`, }, annotationAuthTLSMatchCN: { - Validator: parser.ValidateRegex(*commonNameRegex, true), + Validator: parser.ValidateRegex(commonNameRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation adds a sanity check for the CN of the client certificate that is sent over using a string / regex starting with "CN="`, @@ -130,9 +129,9 @@ func (assl1 *Config) Equal(assl2 *Config) bool { } // NewParser creates a new TLS authentication annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return authTLS{ - r: resolver, + r: r, annotationConfig: authTLSAnnotations, } } @@ -169,7 +168,7 @@ func (a authTLS) Parse(ing *networking.Ingress) (interface{}, error) { authCert, err := a.r.GetAuthCertificate(tlsauthsecret) if err != nil { e := fmt.Errorf("error obtaining certificate: %w", err) - return &Config{}, ing_errors.LocationDenied{Reason: e} + return &Config{}, ing_errors.LocationDeniedError{Reason: e} } config.AuthSSLCert = *authCert diff --git a/internal/ingress/annotations/authtls/main_test.go b/internal/ingress/annotations/authtls/main_test.go index a1f3f0f92..0dd442e4f 100644 --- a/internal/ingress/annotations/authtls/main_test.go +++ b/internal/ingress/annotations/authtls/main_test.go @@ -27,6 +27,11 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + defaultDemoSecret = "default/demo-secret" + off = "off" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -77,23 +82,22 @@ type mockSecret struct { // GetAuthCertificate from mockSecret mocks the GetAuthCertificate for authTLS func (m mockSecret) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if name != "default/demo-secret" { + if name != defaultDemoSecret { return nil, errors.Errorf("there is no secret with name %v", name) } return &resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", }, nil - } func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSSecret)] = defaultDemoSecret ing.SetAnnotations(data) @@ -108,7 +112,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected *Config but got %v", u) } - secret, err := fakeSecret.GetAuthCertificate("default/demo-secret") + secret, err := fakeSecret.GetAuthCertificate(defaultDemoSecret) if err != nil { t.Errorf("unexpected error getting secret %v", err) } @@ -132,7 +136,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected empty string, but got %v", u.MatchCN) } - data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = "off" + data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyClient)] = off data[parser.GetAnnotationWithPrefix(annotationAuthTLSVerifyDepth)] = "2" data[parser.GetAnnotationWithPrefix(annotationAuthTLSErrorPage)] = "ok.com/error" data[parser.GetAnnotationWithPrefix(annotationAuthTLSPassCertToUpstream)] = "true" @@ -153,8 +157,8 @@ func TestAnnotations(t *testing.T) { if u.AuthSSLCert.Secret != secret.Secret { t.Errorf("expected %v but got %v", secret.Secret, u.AuthSSLCert.Secret) } - if u.VerifyClient != "off" { - t.Errorf("expected %v but got %v", "off", u.VerifyClient) + if u.VerifyClient != off { + t.Errorf("expected %v but got %v", off, u.VerifyClient) } if u.ValidationDepth != 2 { t.Errorf("expected %v but got %v", 2, u.ValidationDepth) @@ -262,28 +266,21 @@ func TestInvalidAnnotations(t *testing.T) { if u.MatchCN != "" { t.Errorf("expected empty string but got %v", u.MatchCN) } - } func TestEquals(t *testing.T) { cfg1 := &Config{} cfg2 := &Config{} - // Same config - result := cfg1.Equal(cfg1) - if result != true { - t.Errorf("Expected true") - } - // compare nil - result = cfg1.Equal(nil) + result := cfg1.Equal(nil) if result != false { t.Errorf("Expected false") } // Different Certs sslCert1 := resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", } @@ -302,7 +299,7 @@ func TestEquals(t *testing.T) { // Different Verify Client cfg1.VerifyClient = "on" - cfg2.VerifyClient = "off" + cfg2.VerifyClient = off result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") diff --git a/internal/ingress/annotations/backendprotocol/main.go b/internal/ingress/annotations/backendprotocol/main.go index 2704ce9f6..62674c4e5 100644 --- a/internal/ingress/annotations/backendprotocol/main.go +++ b/internal/ingress/annotations/backendprotocol/main.go @@ -25,9 +25,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -var ( - validProtocols = []string{"auto_http", "http", "https", "grpc", "grpcs", "fcgi"} -) +var validProtocols = []string{"auto_http", "http", "https", "grpc", "grpcs", "fcgi"} const ( http = "HTTP" diff --git a/internal/ingress/annotations/backendprotocol/main_test.go b/internal/ingress/annotations/backendprotocol/main_test.go index 490be447b..cb1ec779f 100644 --- a/internal/ingress/annotations/backendprotocol/main_test.go +++ b/internal/ingress/annotations/backendprotocol/main_test.go @@ -44,6 +44,7 @@ func buildIngress() *networking.Ingress { }, } } + func TestParseInvalidAnnotations(t *testing.T) { ing := buildIngress() @@ -56,7 +57,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } @@ -72,7 +73,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } @@ -88,7 +89,7 @@ func TestParseInvalidAnnotations(t *testing.T) { if !ok { t.Errorf("expected a string type") } - if val != "HTTP" { + if val != http { t.Errorf("expected HTTPS but %v returned", val) } } diff --git a/internal/ingress/annotations/canary/main.go b/internal/ingress/annotations/canary/main.go index 119f09181..be5761675 100644 --- a/internal/ingress/annotations/canary/main.go +++ b/internal/ingress/annotations/canary/main.go @@ -57,7 +57,7 @@ var CanaryAnnotations = parser.Annotation{ Documentation: `This annotation The total weight of traffic. If unspecified, it defaults to 100`, }, canaryByHeaderAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the header that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -65,7 +65,7 @@ var CanaryAnnotations = parser.Annotation{ For any other value, the header will be ignored and the request compared against the other canary rules by precedence`, }, canaryByHeaderValueAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the header value to match for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -74,7 +74,7 @@ var CanaryAnnotations = parser.Annotation{ It doesn't have any effect if the 'canary-by-header' annotation is not defined`, }, canaryByHeaderPatternAnnotation: { - Validator: parser.ValidateRegex(*parser.IsValidRegex, false), + Validator: parser.ValidateRegex(parser.IsValidRegex, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation works the same way as canary-by-header-value except it does PCRE Regex matching. @@ -82,7 +82,7 @@ var CanaryAnnotations = parser.Annotation{ When the given Regex causes error during request processing, the request will be considered as not matching.`, }, canaryByCookieAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the cookie that should be used for notifying the Ingress to route the request to the service specified in the Canary Ingress. @@ -189,7 +189,7 @@ func (c canary) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a canary) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c canary) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, CanaryAnnotations.Annotations) } diff --git a/internal/ingress/annotations/canary/main_test.go b/internal/ingress/annotations/canary/main_test.go index ddfc0a9c4..1787ddb85 100644 --- a/internal/ingress/annotations/canary/main_test.go +++ b/internal/ingress/annotations/canary/main_test.go @@ -17,6 +17,7 @@ limitations under the License. package canary import ( + "strconv" "testing" api "k8s.io/api/core/v1" @@ -24,8 +25,6 @@ import ( metaV1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "strconv" - "k8s.io/ingress-nginx/internal/ingress/resolver" ) @@ -93,7 +92,6 @@ func TestCanaryInvalid(t *testing.T) { if val.Weight != 0 { t.Errorf("Expected %v but got %v", 0, val.Weight) } - } func TestAnnotations(t *testing.T) { @@ -133,10 +131,9 @@ func TestAnnotations(t *testing.T) { } continue - } else { - if err != nil { - t.Errorf("%v: expected nil but returned error %v", test.title, err) - } + } + if err != nil { + t.Errorf("%v: expected nil but returned error %v", test.title, err) } canaryConfig, ok := i.(*Config) diff --git a/internal/ingress/annotations/clientbodybuffersize/main.go b/internal/ingress/annotations/clientbodybuffersize/main.go index aa1485df2..c0fa79713 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main.go +++ b/internal/ingress/annotations/clientbodybuffersize/main.go @@ -31,7 +31,7 @@ var clientBodyBufferSizeConfig = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ clientBodyBufferSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, // Low, as it allows just a set of options Documentation: `Sets buffer size for reading client request body per location. @@ -65,7 +65,7 @@ func (cbbs clientBodyBufferSize) Parse(ing *networking.Ingress) (interface{}, er return parser.GetStringAnnotation(clientBodyBufferSizeAnnotation, ing, cbbs.annotationConfig.Annotations) } -func (a clientBodyBufferSize) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (cbbs clientBodyBufferSize) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(cbbs.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, clientBodyBufferSizeConfig.Annotations) } diff --git a/internal/ingress/annotations/clientbodybuffersize/main_test.go b/internal/ingress/annotations/clientbodybuffersize/main_test.go index 0f2c8474a..62257aeb9 100644 --- a/internal/ingress/annotations/clientbodybuffersize/main_test.go +++ b/internal/ingress/annotations/clientbodybuffersize/main_test.go @@ -57,6 +57,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/connection/main.go b/internal/ingress/annotations/connection/main.go index 9e96b6ab1..b0242ac23 100644 --- a/internal/ingress/annotations/connection/main.go +++ b/internal/ingress/annotations/connection/main.go @@ -29,15 +29,13 @@ const ( connectionProxyHeaderAnnotation = "connection-proxy-header" ) -var ( - validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`) -) +var validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`) var connectionHeadersAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ connectionProxyHeaderAnnotation: { - Validator: parser.ValidateRegex(*validConnectionHeaderValue, true), + Validator: parser.ValidateRegex(validConnectionHeaderValue, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation allows setting a specific value for "proxy_set_header Connection" directive. Right now it is restricted to "close" or "keep-alive"`, diff --git a/internal/ingress/annotations/connection/main_test.go b/internal/ingress/annotations/connection/main_test.go index a95288385..1b9361f31 100644 --- a/internal/ingress/annotations/connection/main_test.go +++ b/internal/ingress/annotations/connection/main_test.go @@ -66,6 +66,5 @@ func TestParse(t *testing.T) { if !p.Equal(testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, p, testCase.annotations) } - } } diff --git a/internal/ingress/annotations/cors/main.go b/internal/ingress/annotations/cors/main.go index cc30b8405..39e02f21b 100644 --- a/internal/ingress/annotations/cors/main.go +++ b/internal/ingress/annotations/cors/main.go @@ -43,9 +43,9 @@ var ( // * Sets a group that can be (https?://)?*?.something.com:port? // * Allows this to be repeated as much as possible, and separated by comma // Otherwise it should be '*' - corsOriginRegexValidator = regexp.MustCompile(`^((((https?://)?(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?,?)+)|\*)?$`) + corsOriginRegexValidator = regexp.MustCompile(`^((((https?://)?(\*\.)?[A-Za-z0-9\-.]*(:\d+)?,?)+)|\*)?$`) // corsOriginRegex defines the regex for validation inside Parse - corsOriginRegex = regexp.MustCompile(`^(https?://(\*\.)?[A-Za-z0-9\-\.]*(:[0-9]+)?|\*)?$`) + corsOriginRegex = regexp.MustCompile(`^(https?://(\*\.)?[A-Za-z0-9\-.]*(:\d+)?|\*)?$`) // Method must contain valid methods list (PUT, GET, POST, BLA) // May contain or not spaces between each verb corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`) @@ -74,7 +74,7 @@ var corsAnnotation = parser.Annotation{ Documentation: `This annotation enables Cross-Origin Resource Sharing (CORS) in an Ingress rule`, }, corsAllowOriginAnnotation: { - Validator: parser.ValidateRegex(*corsOriginRegexValidator, true), + Validator: parser.ValidateRegex(corsOriginRegexValidator, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls what's the accepted Origin for CORS. @@ -82,14 +82,14 @@ var corsAnnotation = parser.Annotation{ It also supports single level wildcard subdomains and follows this format: http(s)://*.foo.bar, http(s)://*.bar.foo:8080 or http(s)://*.abc.bar.foo:9000`, }, corsAllowHeadersAnnotation: { - Validator: parser.ValidateRegex(*parser.HeadersVariable, true), + Validator: parser.ValidateRegex(parser.HeadersVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which headers are accepted. This is a multi-valued field, separated by ',' and accepts letters, numbers, _ and -`, }, corsAllowMethodsAnnotation: { - Validator: parser.ValidateRegex(*corsMethodsRegex, true), + Validator: parser.ValidateRegex(corsMethodsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which methods are accepted. @@ -102,7 +102,7 @@ var corsAnnotation = parser.Annotation{ Documentation: `This annotation controls if credentials can be passed during CORS operations.`, }, corsExposeHeadersAnnotation: { - Validator: parser.ValidateRegex(*corsExposeHeadersRegex, true), + Validator: parser.ValidateRegex(corsExposeHeadersRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation controls which headers are exposed to response. @@ -260,7 +260,7 @@ func (c cors) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a cors) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c cors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, corsAnnotation.Annotations) } diff --git a/internal/ingress/annotations/customhttperrors/main.go b/internal/ingress/annotations/customhttperrors/main.go index c3c9b5be3..f3c72a22f 100644 --- a/internal/ingress/annotations/customhttperrors/main.go +++ b/internal/ingress/annotations/customhttperrors/main.go @@ -31,16 +31,14 @@ const ( customHTTPErrorsAnnotation = "custom-http-errors" ) -var ( - // We accept anything between 400 and 599, on a comma separated. - arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5][0-9][0-9],?)*$`) -) +// We accept anything between 400 and 599, on a comma separated. +var arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5]\d{2},?)*$`) var customHTTPErrorsAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ customHTTPErrorsAnnotation: { - Validator: parser.ValidateRegex(*arrayOfHTTPErrors, true), + Validator: parser.ValidateRegex(arrayOfHTTPErrors, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `If a default backend annotation is specified on the ingress, the errors code specified on this annotation @@ -72,7 +70,7 @@ func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) { } cSplit := strings.Split(c, ",") - var codes []int + codes := make([]int, 0, len(cSplit)) for _, i := range cSplit { num, err := strconv.Atoi(i) if err != nil { @@ -88,7 +86,7 @@ func (e customhttperrors) GetDocumentation() parser.AnnotationFields { return e.annotationConfig.Annotations } -func (a customhttperrors) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (e customhttperrors) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(e.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, customHTTPErrorsAnnotations.Annotations) } diff --git a/internal/ingress/annotations/defaultbackend/main.go b/internal/ingress/annotations/defaultbackend/main.go index f3ca004dd..9ae44f052 100644 --- a/internal/ingress/annotations/defaultbackend/main.go +++ b/internal/ingress/annotations/defaultbackend/main.go @@ -57,14 +57,14 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // Parse parses the annotations contained in the ingress to use // a custom default backend -func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { - s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, db.annotationConfig.Annotations) +func (b backend) Parse(ing *networking.Ingress) (interface{}, error) { + s, err := parser.GetStringAnnotation(defaultBackendAnnotation, ing, b.annotationConfig.Annotations) if err != nil { return nil, err } name := fmt.Sprintf("%v/%v", ing.Namespace, s) - svc, err := db.r.GetService(name) + svc, err := b.r.GetService(name) if err != nil { return nil, fmt.Errorf("unexpected error reading service %s: %w", name, err) } @@ -72,11 +72,11 @@ func (db backend) Parse(ing *networking.Ingress) (interface{}, error) { return svc, nil } -func (db backend) GetDocumentation() parser.AnnotationFields { - return db.annotationConfig.Annotations +func (b backend) GetDocumentation() parser.AnnotationFields { + return b.annotationConfig.Annotations } -func (a backend) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (b backend) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(b.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, defaultBackendAnnotations.Annotations) } diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go index 96dbc7159..882de5b1c 100644 --- a/internal/ingress/annotations/fastcgi/main.go +++ b/internal/ingress/annotations/fastcgi/main.go @@ -35,22 +35,20 @@ const ( fastCGIParamsAnnotation = "fastcgi-params-configmap" ) -var ( - // fast-cgi valid parameters is just a single file name (like index.php) - regexValidIndexAnnotationAndKey = regexp.MustCompile(`^[A-Za-z0-9\.\-\_]+$`) -) +// fast-cgi valid parameters is just a single file name (like index.php) +var regexValidIndexAnnotationAndKey = regexp.MustCompile(`^[A-Za-z0-9.\-\_]+$`) var fastCGIAnnotations = parser.Annotation{ Group: "fastcgi", Annotations: parser.AnnotationFields{ fastCGIIndexAnnotation: { - Validator: parser.ValidateRegex(*regexValidIndexAnnotationAndKey, true), + Validator: parser.ValidateRegex(regexValidIndexAnnotationAndKey, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation can be used to specify an index file`, }, fastCGIParamsAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation can be used to specify a ConfigMap containing the fastcgi parameters as a key/value. @@ -98,7 +96,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // ParseAnnotations parses the annotations contained in the ingress // rule used to indicate the fastcgiConfig. func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { - fcgiConfig := Config{} if ing.GetAnnotations() == nil { @@ -125,7 +122,7 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { cmns, cmn, err := cache.SplitMetaNamespaceKey(cm) if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ + return fcgiConfig, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("error reading configmap name from annotation: %w", err), } } @@ -139,7 +136,7 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { cm = fmt.Sprintf("%v/%v", ing.Namespace, cmn) cmap, err := a.r.GetConfigMap(cm) if err != nil { - return fcgiConfig, ing_errors.LocationDenied{ + return fcgiConfig, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("unexpected error reading configmap %s: %w", cm, err), } } diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go index 3296ded65..bc5e2755f 100644 --- a/internal/ingress/annotations/fastcgi/main_test.go +++ b/internal/ingress/annotations/fastcgi/main_test.go @@ -155,7 +155,6 @@ func TestParseFastCGIInvalidParamsConfigMapAnnotation(t *testing.T) { invalidConfigMapList := []string{"unknown/configMap", "unknown/config/map"} for _, configmap := range invalidConfigMapList { - data := map[string]string{} data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = configmap ing.SetAnnotations(data) @@ -239,11 +238,9 @@ func TestParseFastCGIParamsConfigMapAnnotationWithDifferentNS(t *testing.T) { if err == nil { t.Errorf("Different namespace configmap should return an error") } - } func TestConfigEquality(t *testing.T) { - var nilConfig *Config config := Config{ @@ -297,7 +294,6 @@ func TestConfigEquality(t *testing.T) { } func Test_fastcgi_Parse(t *testing.T) { - tests := []struct { name string index string @@ -378,7 +374,6 @@ func Test_fastcgi_Parse(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - ing := buildIngress() data := map[string]string{} diff --git a/internal/ingress/annotations/globalratelimit/main.go b/internal/ingress/annotations/globalratelimit/main.go index 41f58fd57..0aec29f66 100644 --- a/internal/ingress/annotations/globalratelimit/main.go +++ b/internal/ingress/annotations/globalratelimit/main.go @@ -25,7 +25,6 @@ import ( "k8s.io/klog/v2" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/net" @@ -57,7 +56,7 @@ var globalRateLimitAnnotationConfig = parser.Annotation{ Documentation: `Configures a time window (i.e 1m) that the limit is applied`, }, globalRateLimitKeyAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation Configures a key for counting the samples. Defaults to $remote_addr. @@ -123,23 +122,23 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { config := &Config{} limit, err := parser.GetIntAnnotation(globalRateLimitAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsInvalidContent(err) { + if err != nil && ing_errors.IsInvalidContent(err) { return nil, err } rawWindowSize, err := parser.GetStringAnnotation(globalRateLimitWindowAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsValidationError(err) { - return config, ing_errors.LocationDenied{ + if err != nil && ing_errors.IsValidationError(err) { + return config, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err), } } - if limit == 0 || len(rawWindowSize) == 0 { + if limit == 0 || rawWindowSize == "" { return config, nil } windowSize, err := time.ParseDuration(rawWindowSize) if err != nil { - return config, ing_errors.LocationDenied{ + return config, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("failed to parse 'global-rate-limit-window' value: %w", err), } } @@ -148,12 +147,12 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { if err != nil { klog.Warningf("invalid %s, defaulting to %s", globalRateLimitKeyAnnotation, defaultKey) } - if len(key) == 0 { + if key == "" { key = defaultKey } rawIgnoredCIDRs, err := parser.GetStringAnnotation(globalRateLimitIgnoredCidrsAnnotation, ing, a.annotationConfig.Annotations) - if err != nil && errors.IsInvalidContent(err) { + if err != nil && ing_errors.IsInvalidContent(err) { return nil, err } ignoredCIDRs, err := net.ParseCIDRs(rawIgnoredCIDRs) @@ -161,7 +160,7 @@ func (a globalratelimit) Parse(ing *networking.Ingress) (interface{}, error) { return nil, err } - config.Namespace = strings.Replace(string(ing.UID), "-", "", -1) + config.Namespace = strings.ReplaceAll(string(ing.UID), "-", "") config.Limit = limit config.WindowSize = int(windowSize.Seconds()) config.Key = key diff --git a/internal/ingress/annotations/globalratelimit/main_test.go b/internal/ingress/annotations/globalratelimit/main_test.go index 5d7922666..b1a7ab71b 100644 --- a/internal/ingress/annotations/globalratelimit/main_test.go +++ b/internal/ingress/annotations/globalratelimit/main_test.go @@ -30,8 +30,10 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) -const UID = "31285d47-b150-4dcf-bd6f-12c46d769f6e" -const expectedUID = "31285d47b1504dcfbd6f12c46d769f6e" +const ( + UID = "31285d47-b150-4dcf-bd6f-12c46d769f6e" + expectedUID = "31285d47b1504dcfbd6f12c46d769f6e" +) func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ @@ -190,10 +192,19 @@ func TestGlobalRateLimiting(t *testing.T) { t.Errorf("expected error '%v' but got '%v'", testCase.expectedErr, actualErr) } - actualConfig := i.(*Config) + actualConfig, ok := i.(*Config) + if !ok { + t.Errorf("expected Config type but got %T", i) + } if !testCase.expectedConfig.Equal(actualConfig) { - expectedJSON, _ := json.Marshal(testCase.expectedConfig) - actualJSON, _ := json.Marshal(actualConfig) + expectedJSON, err := json.Marshal(testCase.expectedConfig) + if err != nil { + t.Errorf("failed to marshal expected config: %v", err) + } + actualJSON, err := json.Marshal(actualConfig) + if err != nil { + t.Errorf("failed to marshal actual config: %v", err) + } t.Errorf("%v: expected config '%s' but got '%s'", testCase.title, expectedJSON, actualJSON) } } diff --git a/internal/ingress/annotations/http2pushpreload/main.go b/internal/ingress/annotations/http2pushpreload/main.go index af9f90aa9..123940d9d 100644 --- a/internal/ingress/annotations/http2pushpreload/main.go +++ b/internal/ingress/annotations/http2pushpreload/main.go @@ -62,7 +62,7 @@ func (h2pp http2PushPreload) GetDocumentation() parser.AnnotationFields { return h2pp.annotationConfig.Annotations } -func (a http2PushPreload) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (h2pp http2PushPreload) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(h2pp.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, http2PushPreloadAnnotations.Annotations) } diff --git a/internal/ingress/annotations/ipallowlist/main.go b/internal/ingress/annotations/ipallowlist/main.go index d9d454c97..23a3bd9e7 100644 --- a/internal/ingress/annotations/ipallowlist/main.go +++ b/internal/ingress/annotations/ipallowlist/main.go @@ -96,16 +96,15 @@ func (a ipallowlist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{CIDR: defaultAllowlistSourceRange}, nil } - return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDeniedError{ Reason: err, } - } values := strings.Split(val, ",") ipnets, ips, err := net.ParseIPNets(values...) if err != nil && len(ips) == 0 { - return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultAllowlistSourceRange}, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the annotation does not contain a valid IP address or network: %w", err), } } diff --git a/internal/ingress/annotations/ipdenylist/main.go b/internal/ingress/annotations/ipdenylist/main.go index f17ce079a..e8f02fe50 100644 --- a/internal/ingress/annotations/ipdenylist/main.go +++ b/internal/ingress/annotations/ipdenylist/main.go @@ -93,16 +93,15 @@ func (a ipdenylist) Parse(ing *networking.Ingress) (interface{}, error) { return &SourceRange{CIDR: defaultDenylistSourceRange}, nil } - return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDeniedError{ Reason: err, } - } values := strings.Split(val, ",") ipnets, ips, err := net.ParseIPNets(values...) if err != nil && len(ips) == 0 { - return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDenied{ + return &SourceRange{CIDR: defaultDenylistSourceRange}, ing_errors.LocationDeniedError{ Reason: fmt.Errorf("the annotation does not contain a valid IP address or network: %w", err), } } diff --git a/internal/ingress/annotations/loadbalancing/main_test.go b/internal/ingress/annotations/loadbalancing/main_test.go index b0442c37f..a5205e523 100644 --- a/internal/ingress/annotations/loadbalancing/main_test.go +++ b/internal/ingress/annotations/loadbalancing/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/log/main.go b/internal/ingress/annotations/log/main.go index ec08292a9..82d50bac3 100644 --- a/internal/ingress/annotations/log/main.go +++ b/internal/ingress/annotations/log/main.go @@ -101,7 +101,7 @@ func (l log) GetDocumentation() parser.AnnotationFields { return l.annotationConfig.Annotations } -func (a log) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (l log) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(l.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, logAnnotations.Annotations) } diff --git a/internal/ingress/annotations/log/main_test.go b/internal/ingress/annotations/log/main_test.go index df97c2e5b..950612b5b 100644 --- a/internal/ingress/annotations/log/main_test.go +++ b/internal/ingress/annotations/log/main_test.go @@ -76,7 +76,10 @@ func TestIngressAccessLogConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableAccessLogAnnotation)] = "false" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") @@ -94,7 +97,10 @@ func TestIngressRewriteLogConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "true" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing annotations %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") @@ -112,7 +118,10 @@ func TestInvalidBoolConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableRewriteLogAnnotation)] = "blo" ing.SetAnnotations(data) - log, _ := NewParser(&resolver.Mock{}).Parse(ing) + log, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } nginxLogs, ok := log.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/mirror/main.go b/internal/ingress/annotations/mirror/main.go index 2d417dece..d51bdd27c 100644 --- a/internal/ingress/annotations/mirror/main.go +++ b/internal/ingress/annotations/mirror/main.go @@ -34,15 +34,13 @@ const ( mirrorHostAnnotation = "mirror-host" ) -var ( - OnOffRegex = regexp.MustCompile(`^(on|off)$`) -) +var OnOffRegex = regexp.MustCompile(`^(on|off)$`) var mirrorAnnotation = parser.Annotation{ Group: "mirror", Annotations: parser.AnnotationFields{ mirrorRequestBodyAnnotation: { - Validator: parser.ValidateRegex(*OnOffRegex, true), + Validator: parser.ValidateRegex(OnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines if the request-body should be sent to the mirror backend. Can be 'on' or 'off'`, diff --git a/internal/ingress/annotations/modsecurity/main.go b/internal/ingress/annotations/modsecurity/main.go index 5a9aaa729..80ae78937 100644 --- a/internal/ingress/annotations/modsecurity/main.go +++ b/internal/ingress/annotations/modsecurity/main.go @@ -27,7 +27,7 @@ import ( const ( modsecEnableAnnotation = "enable-modsecurity" modsecEnableOwaspCoreAnnotation = "enable-owasp-core-rules" - modesecTransactionIdAnnotation = "modsecurity-transaction-id" + modesecTransactionIDAnnotation = "modsecurity-transaction-id" modsecSnippetAnnotation = "modsecurity-snippet" ) @@ -46,8 +46,8 @@ var modsecurityAnnotation = parser.Annotation{ Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables the OWASP Core Rule Set`, }, - modesecTransactionIdAnnotation: { - Validator: parser.ValidateRegex(*parser.NGINXVariable, true), + modesecTransactionIDAnnotation: { + Validator: parser.ValidateRegex(parser.NGINXVariable, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskHigh, Documentation: `This annotation enables passing an NGINX variable to ModSecurity.`, @@ -98,9 +98,9 @@ func (modsec1 *Config) Equal(modsec2 *Config) bool { } // NewParser creates a new ModSecurity annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return modSecurity{ - r: resolver, + r: r, annotationConfig: modsecurityAnnotation, } } @@ -134,10 +134,10 @@ func (a modSecurity) Parse(ing *networking.Ingress) (interface{}, error) { config.OWASPRules = false } - config.TransactionID, err = parser.GetStringAnnotation(modesecTransactionIdAnnotation, ing, a.annotationConfig.Annotations) + config.TransactionID, err = parser.GetStringAnnotation(modesecTransactionIDAnnotation, ing, a.annotationConfig.Annotations) if err != nil { if errors.IsInvalidContent(err) { - klog.Warningf("annotation %s contains invalid directive, defaulting", modesecTransactionIdAnnotation) + klog.Warningf("annotation %s contains invalid directive, defaulting", modesecTransactionIDAnnotation) } config.TransactionID = "" } diff --git a/internal/ingress/annotations/modsecurity/main_test.go b/internal/ingress/annotations/modsecurity/main_test.go index 2ddbdf7e3..0c9b3a9c7 100644 --- a/internal/ingress/annotations/modsecurity/main_test.go +++ b/internal/ingress/annotations/modsecurity/main_test.go @@ -69,8 +69,14 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) - result, _ := ap.Parse(ing) - config := result.(*Config) + result, err := ap.Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + config, ok := result.(*Config) + if !ok { + t.Errorf("unexpected type: %T", result) + } if !config.Equal(&testCase.expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } diff --git a/internal/ingress/annotations/opentelemetry/main.go b/internal/ingress/annotations/opentelemetry/main.go index a029087da..ca9108548 100644 --- a/internal/ingress/annotations/opentelemetry/main.go +++ b/internal/ingress/annotations/opentelemetry/main.go @@ -51,7 +51,7 @@ var otelAnnotations = parser.Annotation{ Documentation: `This annotation enables or disables using spans from incoming requests as parent for created ones`, }, otelOperationNameAnnotation: { - Validator: parser.ValidateRegex(*regexOperationName, true), + Validator: parser.ValidateRegex(regexOperationName, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines what operation name should be added to the span`, @@ -75,7 +75,6 @@ type Config struct { // Equal tests for equality between two Config types func (bd1 *Config) Equal(bd2 *Config) bool { - if bd1.Set != bd2.Set { return false } @@ -150,7 +149,7 @@ func (c opentelemetry) GetDocumentation() parser.AnnotationFields { return c.annotationConfig.Annotations } -func (a opentelemetry) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (c opentelemetry) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(c.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, otelAnnotations.Annotations) } diff --git a/internal/ingress/annotations/opentelemetry/main_test.go b/internal/ingress/annotations/opentelemetry/main_test.go index c78ebc8b3..e5c1de0b3 100644 --- a/internal/ingress/annotations/opentelemetry/main_test.go +++ b/internal/ingress/annotations/opentelemetry/main_test.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const enableAnnotation = "true" + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -73,10 +75,13 @@ func TestIngressAnnotationOpentelemetrySetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } openTelemetry, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -103,7 +108,10 @@ func TestIngressAnnotationOpentelemetrySetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } openTelemetry, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -123,8 +131,8 @@ func TestIngressAnnotationOpentelemetryTrustSetTrue(t *testing.T) { data := map[string]string{} opName := "foo-op" - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" - data[parser.GetAnnotationWithPrefix(otelTrustSpanAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation + data[parser.GetAnnotationWithPrefix(otelTrustSpanAnnotation)] = enableAnnotation data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName ing.SetAnnotations(data) @@ -163,7 +171,7 @@ func TestIngressAnnotationOpentelemetryWithBadOpName(t *testing.T) { data := map[string]string{} opName := "fooxpto_123$la;" - data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpenTelemetryAnnotation)] = enableAnnotation data[parser.GetAnnotationWithPrefix(otelOperationNameAnnotation)] = opName ing.SetAnnotations(data) @@ -180,7 +188,10 @@ func TestIngressAnnotationOpentelemetryUnset(t *testing.T) { data := map[string]string{} ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } _, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/opentracing/main.go b/internal/ingress/annotations/opentracing/main.go index 7c8671f9d..9d7995a8a 100644 --- a/internal/ingress/annotations/opentracing/main.go +++ b/internal/ingress/annotations/opentracing/main.go @@ -89,13 +89,13 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { } } -func (s opentracing) Parse(ing *networking.Ingress) (interface{}, error) { - enabled, err := parser.GetBoolAnnotation(enableOpentracingAnnotation, ing, s.annotationConfig.Annotations) +func (o opentracing) Parse(ing *networking.Ingress) (interface{}, error) { + enabled, err := parser.GetBoolAnnotation(enableOpentracingAnnotation, ing, o.annotationConfig.Annotations) if err != nil { return &Config{}, nil } - trustSpan, err := parser.GetBoolAnnotation(opentracingTrustSpanAnnotation, ing, s.annotationConfig.Annotations) + trustSpan, err := parser.GetBoolAnnotation(opentracingTrustSpanAnnotation, ing, o.annotationConfig.Annotations) if err != nil { return &Config{Set: true, Enabled: enabled}, nil } @@ -103,11 +103,11 @@ func (s opentracing) Parse(ing *networking.Ingress) (interface{}, error) { return &Config{Set: true, Enabled: enabled, TrustSet: true, TrustEnabled: trustSpan}, nil } -func (s opentracing) GetDocumentation() parser.AnnotationFields { - return s.annotationConfig.Annotations +func (o opentracing) GetDocumentation() parser.AnnotationFields { + return o.annotationConfig.Annotations } -func (a opentracing) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (o opentracing) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(o.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, opentracingAnnotations.Annotations) } diff --git a/internal/ingress/annotations/opentracing/main_test.go b/internal/ingress/annotations/opentracing/main_test.go index b7b62ac9d..f59e60438 100644 --- a/internal/ingress/annotations/opentracing/main_test.go +++ b/internal/ingress/annotations/opentracing/main_test.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const enableAnnotation = "true" + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -73,10 +75,13 @@ func TestIngressAnnotationOpentracingSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -95,7 +100,10 @@ func TestIngressAnnotationOpentracingSetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -110,11 +118,14 @@ func TestIngressAnnotationOpentracingTrustSetTrue(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = "true" - data[parser.GetAnnotationWithPrefix(opentracingTrustSpanAnnotation)] = "true" + data[parser.GetAnnotationWithPrefix(enableOpentracingAnnotation)] = enableAnnotation + data[parser.GetAnnotationWithPrefix(opentracingTrustSpanAnnotation)] = enableAnnotation ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error %v", err) + } openTracing, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") @@ -136,7 +147,11 @@ func TestIngressAnnotationOpentracingUnset(t *testing.T) { data := map[string]string{} ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } + _, ok := val.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go index 951970e27..554ad9dde 100644 --- a/internal/ingress/annotations/parser/main.go +++ b/internal/ingress/annotations/parser/main.go @@ -118,7 +118,7 @@ func (a ingAnnotations) parseString(name string) (string, error) { val, ok := a[name] if ok { s := normalizeString(val) - if len(s) == 0 { + if s == "" { return "", errors.NewInvalidAnnotationContent(name, val) } @@ -248,13 +248,14 @@ func StringToURL(input string) (*url.URL, error) { return nil, fmt.Errorf("%v is not a valid URL: %v", input, err) } - if parsedURL.Scheme == "" { + switch { + case parsedURL.Scheme == "": return nil, fmt.Errorf("url scheme is empty") - } else if parsedURL.Host == "" { + case parsedURL.Host == "": return nil, fmt.Errorf("url host is empty") - } else if strings.Contains(parsedURL.Host, "..") { + case strings.Contains(parsedURL.Host, ".."): return nil, fmt.Errorf("invalid url host") + default: + return parsedURL, nil } - - return parsedURL, nil } diff --git a/internal/ingress/annotations/parser/main_test.go b/internal/ingress/annotations/parser/main_test.go index beca49370..0f7ecb459 100644 --- a/internal/ingress/annotations/parser/main_test.go +++ b/internal/ingress/annotations/parser/main_test.go @@ -93,14 +93,16 @@ func TestGetStringAnnotation(t *testing.T) { {"valid - A", "string", "A ", "A", false}, {"valid - B", "string", " B", "B", false}, {"empty", "string", " ", "", true}, - {"valid multiline", "string", ` + { + "valid multiline", "string", ` rewrite (?i)/arcgis/rest/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/rest/services/Utilities/Geometry/GeometryServer$1 break; rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/services/Utilities/Geometry/GeometryServer$1 break; `, ` rewrite (?i)/arcgis/rest/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/rest/services/Utilities/Geometry/GeometryServer$1 break; rewrite (?i)/arcgis/services/Utilities/Geometry/GeometryServer(.*)$ /arcgis/services/Utilities/Geometry/GeometryServer$1 break; `, - false}, + false, + }, } data := map[string]string{} @@ -213,8 +215,10 @@ func TestGetIntAnnotation(t *testing.T) { func TestStringToURL(t *testing.T) { validURL := "http://bar.foo.com/external-auth" - validParsedURL, _ := url.Parse(validURL) - + validParsedURL, err := url.Parse(validURL) + if err != nil { + t.Errorf("unexpected error: %v", err) + } tests := []struct { title string url string diff --git a/internal/ingress/annotations/parser/validators.go b/internal/ingress/annotations/parser/validators.go index e14b486eb..ab9b4799f 100644 --- a/internal/ingress/annotations/parser/validators.go +++ b/internal/ingress/annotations/parser/validators.go @@ -52,7 +52,7 @@ var ( var IsValidRegex = regexp.MustCompile("^[/" + alphaNumericChars + regexEnabledChars + "]*$") // SizeRegex validates sizes understood by NGINX, like 1000, 100k, 1000M -var SizeRegex = regexp.MustCompile("^(?i)[0-9]+[bkmg]?$") +var SizeRegex = regexp.MustCompile(`^(?i)\d+[bkmg]?$`) // URLRegex is used to validate a URL but with only a specific set of characters: // It is alphanumericChar + ":", "?", "&" @@ -103,7 +103,7 @@ func ValidateServerName(value string) error { // ValidateRegex receives a regex as an argument and uses it to validate // the value of the field. // Annotation can define if the spaces should be trimmed before validating the value -func ValidateRegex(regex regexp.Regexp, removeSpace bool) AnnotationValidator { +func ValidateRegex(regex *regexp.Regexp, removeSpace bool) AnnotationValidator { return func(s string) error { if removeSpace { s = strings.ReplaceAll(s, " ", "") @@ -117,7 +117,7 @@ func ValidateRegex(regex regexp.Regexp, removeSpace bool) AnnotationValidator { // ValidateOptions receives an array of valid options that can be the value of annotation. // If no valid option is found, it will return an error -func ValidateOptions(options []string, caseSensitive bool, trimSpace bool) AnnotationValidator { +func ValidateOptions(options []string, caseSensitive, trimSpace bool) AnnotationValidator { return func(s string) error { if trimSpace { s = strings.TrimSpace(s) @@ -161,7 +161,7 @@ func ValidateDuration(value string) error { // ValidateNull always return null values and should not be widely used. // It is used on the "snippet" annotations, as it is up to the admin to allow its // usage, knowing it can be critical! -func ValidateNull(value string) error { +func ValidateNull(_ string) error { return nil } diff --git a/internal/ingress/annotations/parser/validators_test.go b/internal/ingress/annotations/parser/validators_test.go index 2aa6cec37..e7aeb15ca 100644 --- a/internal/ingress/annotations/parser/validators_test.go +++ b/internal/ingress/annotations/parser/validators_test.go @@ -223,7 +223,6 @@ func Test_checkAnnotation(t *testing.T) { } func TestCheckAnnotationRisk(t *testing.T) { - tests := []struct { name string annotations map[string]string diff --git a/internal/ingress/annotations/proxy/main.go b/internal/ingress/annotations/proxy/main.go index a2d10ca90..7fb1c814e 100644 --- a/internal/ingress/annotations/proxy/main.go +++ b/internal/ingress/annotations/proxy/main.go @@ -45,9 +45,7 @@ const ( proxyMaxTempFileSizeAnnotation = "proxy-max-temp-file-size" ) -var ( - validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) -) +var validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) var proxyAnnotations = parser.Annotation{ Group: "backend", @@ -78,32 +76,32 @@ var proxyAnnotations = parser.Annotation{ By default proxy buffers number is set as 4`, }, proxyBufferSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation sets the size of the buffer proxy_buffer_size used for reading the first part of the response received from the proxied server. By default proxy buffer size is set as "4k".`, }, proxyCookiePathAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets a text that should be changed in the path attribute of the "Set-Cookie" header fields of a proxied server response.`, }, proxyCookieDomainAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation ets a text that should be changed in the domain attribute of the "Set-Cookie" header fields of a proxied server response.`, }, proxyBodySizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows setting the maximum allowed size of a client request body.`, }, proxyNextUpstreamAnnotation: { - Validator: parser.ValidateRegex(*validUpstreamAnnotation, false), + Validator: parser.ValidateRegex(validUpstreamAnnotation, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines when the next upstream should be used. @@ -129,13 +127,13 @@ var proxyAnnotations = parser.Annotation{ Documentation: `This annotation enables or disables buffering of a client request body.`, }, proxyRedirectFromAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, }, proxyRedirectToAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `The annotations proxy-redirect-from and proxy-redirect-to will set the first and second parameters of NGINX's proxy_redirect directive respectively`, @@ -153,7 +151,7 @@ var proxyAnnotations = parser.Annotation{ Documentation: `This annotations sets the HTTP protocol version for proxying. Can be "1.0" or "1.1".`, }, proxyMaxTempFileSizeAnnotation: { - Validator: parser.ValidateRegex(*parser.SizeRegex, true), + Validator: parser.ValidateRegex(parser.SizeRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, Documentation: `This annotation defines the maximum size of a temporary file when buffering responses.`, @@ -253,7 +251,8 @@ type proxy struct { // NewParser creates a new reverse proxy configuration annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return proxy{r: r, + return proxy{ + r: r, annotationConfig: proxyAnnotations, } } diff --git a/internal/ingress/annotations/proxy/main_test.go b/internal/ingress/annotations/proxy/main_test.go index fa185551b..9446ae970 100644 --- a/internal/ingress/annotations/proxy/main_test.go +++ b/internal/ingress/annotations/proxy/main_test.go @@ -28,6 +28,12 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + off = "off" + proxyHTTPVersion = "1.0" + proxyMaxTempFileSize = "128k" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -87,7 +93,7 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { ProxyNextUpstreamTimeout: 0, ProxyNextUpstreamTries: 3, ProxyRequestBuffering: "on", - ProxyBuffering: "off", + ProxyBuffering: off, ProxyHTTPVersion: "1.1", ProxyMaxTempFileSize: "1024m", } @@ -103,13 +109,13 @@ func TestProxy(t *testing.T) { data[parser.GetAnnotationWithPrefix("proxy-buffers-number")] = "8" data[parser.GetAnnotationWithPrefix("proxy-buffer-size")] = "1k" data[parser.GetAnnotationWithPrefix("proxy-body-size")] = "2k" - data[parser.GetAnnotationWithPrefix("proxy-next-upstream")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-next-upstream")] = off data[parser.GetAnnotationWithPrefix("proxy-next-upstream-timeout")] = "5" data[parser.GetAnnotationWithPrefix("proxy-next-upstream-tries")] = "3" - data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = off data[parser.GetAnnotationWithPrefix("proxy-buffering")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-http-version")] = "1.0" - data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = "128k" + data[parser.GetAnnotationWithPrefix("proxy-http-version")] = proxyHTTPVersion + data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = proxyMaxTempFileSize ing.SetAnnotations(data) i, err := NewParser(mockBackend{}).Parse(ing) @@ -138,7 +144,7 @@ func TestProxy(t *testing.T) { if p.BodySize != "2k" { t.Errorf("expected 2k as body-size but returned %v", p.BodySize) } - if p.NextUpstream != "off" { + if p.NextUpstream != off { t.Errorf("expected off as next-upstream but returned %v", p.NextUpstream) } if p.NextUpstreamTimeout != 5 { @@ -147,16 +153,16 @@ func TestProxy(t *testing.T) { if p.NextUpstreamTries != 3 { t.Errorf("expected 3 as next-upstream-tries but returned %v", p.NextUpstreamTries) } - if p.RequestBuffering != "off" { + if p.RequestBuffering != off { t.Errorf("expected off as request-buffering but returned %v", p.RequestBuffering) } if p.ProxyBuffering != "on" { t.Errorf("expected on as proxy-buffering but returned %v", p.ProxyBuffering) } - if p.ProxyHTTPVersion != "1.0" { + if p.ProxyHTTPVersion != proxyHTTPVersion { t.Errorf("expected 1.0 as proxy-http-version but returned %v", p.ProxyHTTPVersion) } - if p.ProxyMaxTempFileSize != "128k" { + if p.ProxyMaxTempFileSize != proxyMaxTempFileSize { t.Errorf("expected 128k as proxy-max-temp-file-size but returned %v", p.ProxyMaxTempFileSize) } } @@ -176,8 +182,8 @@ func TestProxyComplex(t *testing.T) { data[parser.GetAnnotationWithPrefix("proxy-next-upstream-tries")] = "3" data[parser.GetAnnotationWithPrefix("proxy-request-buffering")] = "off" data[parser.GetAnnotationWithPrefix("proxy-buffering")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-http-version")] = "1.0" - data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = "128k" + data[parser.GetAnnotationWithPrefix("proxy-http-version")] = proxyHTTPVersion + data[parser.GetAnnotationWithPrefix("proxy-max-temp-file-size")] = proxyMaxTempFileSize ing.SetAnnotations(data) i, err := NewParser(mockBackend{}).Parse(ing) @@ -221,10 +227,10 @@ func TestProxyComplex(t *testing.T) { if p.ProxyBuffering != "on" { t.Errorf("expected on as proxy-buffering but returned %v", p.ProxyBuffering) } - if p.ProxyHTTPVersion != "1.0" { + if p.ProxyHTTPVersion != proxyHTTPVersion { t.Errorf("expected 1.0 as proxy-http-version but returned %v", p.ProxyHTTPVersion) } - if p.ProxyMaxTempFileSize != "128k" { + if p.ProxyMaxTempFileSize != proxyMaxTempFileSize { t.Errorf("expected 128k as proxy-max-temp-file-size but returned %v", p.ProxyMaxTempFileSize) } } diff --git a/internal/ingress/annotations/proxyssl/main.go b/internal/ingress/annotations/proxyssl/main.go index 40ee18aa0..0e854cd21 100644 --- a/internal/ingress/annotations/proxyssl/main.go +++ b/internal/ingress/annotations/proxyssl/main.go @@ -24,7 +24,6 @@ import ( networking "k8s.io/api/networking/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/errors" ing_errors "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" "k8s.io/ingress-nginx/internal/k8s" @@ -42,7 +41,7 @@ const ( var ( proxySSLOnOffRegex = regexp.MustCompile(`^(on|off)$`) proxySSLProtocolRegex = regexp.MustCompile(`^(SSLv2|SSLv3|TLSv1|TLSv1\.1|TLSv1\.2|TLSv1\.3| )*$`) - proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+\:\_\-\!]*$`) + proxySSLCiphersRegex = regexp.MustCompile(`^[A-Za-z0-9\+:\_\-!]*$`) ) const ( @@ -59,7 +58,7 @@ var proxySSLAnnotation = parser.Annotation{ Group: "proxy", Annotations: parser.AnnotationFields{ proxySSLSecretAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation specifies a Secret with the certificate tls.crt, key tls.key in PEM format used for authentication to a proxied HTTPS server. @@ -68,14 +67,14 @@ var proxySSLAnnotation = parser.Annotation{ Just secrets on the same namespace of the ingress can be used.`, }, proxySSLCiphersAnnotation: { - Validator: parser.ValidateRegex(*proxySSLCiphersRegex, true), + Validator: parser.ValidateRegex(proxySSLCiphersRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation Specifies the enabled ciphers for requests to a proxied HTTPS server. The ciphers are specified in the format understood by the OpenSSL library.`, }, proxySSLProtocolsAnnotation: { - Validator: parser.ValidateRegex(*proxySSLProtocolRegex, true), + Validator: parser.ValidateRegex(proxySSLProtocolRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables the specified protocols for requests to a proxied HTTPS server.`, @@ -88,7 +87,7 @@ var proxySSLAnnotation = parser.Annotation{ This value is also passed through SNI when a connection is established to the proxied HTTPS server.`, }, proxySSLVerifyAnnotation: { - Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Validator: parser.ValidateRegex(proxySSLOnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables or disables verification of the proxied HTTPS server certificate. (default: off)`, @@ -100,7 +99,7 @@ var proxySSLAnnotation = parser.Annotation{ Documentation: `This annotation Sets the verification depth in the proxied HTTPS server certificates chain. (default: 1).`, }, proxySSLServerNameAnnotation: { - Validator: parser.ValidateRegex(*proxySSLOnOffRegex, true), + Validator: parser.ValidateRegex(proxySSLOnOffRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server.`, @@ -150,10 +149,11 @@ func (pssl1 *Config) Equal(pssl2 *Config) bool { } // NewParser creates a new TLS authentication annotation parser -func NewParser(resolver resolver.Resolver) parser.IngressAnnotation { +func NewParser(r resolver.Resolver) parser.IngressAnnotation { return proxySSL{ - r: resolver, - annotationConfig: proxySSLAnnotation} + r: r, + annotationConfig: proxySSLAnnotation, + } } type proxySSL struct { @@ -208,13 +208,13 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { proxyCert, err := p.r.GetAuthCertificate(proxysslsecret) if err != nil { e := fmt.Errorf("error obtaining certificate: %w", err) - return &Config{}, ing_errors.LocationDenied{Reason: e} + return &Config{}, ing_errors.LocationDeniedError{Reason: e} } config.AuthSSLCert = *proxyCert config.Ciphers, err = parser.GetStringAnnotation(proxySSLCiphersAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-ciphers, defaulting to %s", defaultProxySSLCiphers) } config.Ciphers = defaultProxySSLCiphers @@ -222,7 +222,7 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { config.Protocols, err = parser.GetStringAnnotation(proxySSLProtocolsAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-protocols, defaulting to %s", defaultProxySSLProtocols) } config.Protocols = defaultProxySSLProtocols @@ -232,7 +232,7 @@ func (p proxySSL) Parse(ing *networking.Ingress) (interface{}, error) { config.ProxySSLName, err = parser.GetStringAnnotation(proxySSLNameAnnotation, ing, p.annotationConfig.Annotations) if err != nil { - if errors.IsValidationError(err) { + if ing_errors.IsValidationError(err) { klog.Warningf("invalid value passed to proxy-ssl-name, defaulting to empty") } config.ProxySSLName = "" @@ -260,7 +260,7 @@ func (p proxySSL) GetDocumentation() parser.AnnotationFields { return p.annotationConfig.Annotations } -func (a proxySSL) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (p proxySSL) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(p.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, proxySSLAnnotation.Annotations) } diff --git a/internal/ingress/annotations/proxyssl/main_test.go b/internal/ingress/annotations/proxyssl/main_test.go index edd65343e..a20c6813d 100644 --- a/internal/ingress/annotations/proxyssl/main_test.go +++ b/internal/ingress/annotations/proxyssl/main_test.go @@ -27,6 +27,14 @@ import ( "k8s.io/ingress-nginx/internal/ingress/resolver" ) +const ( + defaultDemoSecret = "default/demo-secret" + proxySslCiphers = "HIGH:-SHA" + off = "off" + sslServerName = "w00t" + defaultProtocol = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" +) + func buildIngress() *networking.Ingress { defaultBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ @@ -77,28 +85,27 @@ type mockSecret struct { // GetAuthCertificate from mockSecret mocks the GetAuthCertificate for backend certificate authentication func (m mockSecret) GetAuthCertificate(name string) (*resolver.AuthSSLCert, error) { - if name != "default/demo-secret" { + if name != defaultDemoSecret { return nil, errors.Errorf("there is no secret with name %v", name) } return &resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", }, nil - } func TestAnnotations(t *testing.T) { ing := buildIngress() data := map[string]string{} - data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = "default/demo-secret" - data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = "HIGH:-SHA" + data[parser.GetAnnotationWithPrefix(proxySSLSecretAnnotation)] = defaultDemoSecret + data[parser.GetAnnotationWithPrefix("proxy-ssl-ciphers")] = proxySslCiphers data[parser.GetAnnotationWithPrefix("proxy-ssl-name")] = "$host" data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv1.3 SSLv2 TLSv1 TLSv1.2" data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "on" - data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = "off" + data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = off data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "on" data[parser.GetAnnotationWithPrefix("proxy-ssl-verify-depth")] = "3" @@ -115,7 +122,7 @@ func TestAnnotations(t *testing.T) { t.Errorf("expected *Config but got %v", u) } - secret, err := fakeSecret.GetAuthCertificate("default/demo-secret") + secret, err := fakeSecret.GetAuthCertificate(defaultDemoSecret) if err != nil { t.Errorf("unexpected error getting secret %v", err) } @@ -123,11 +130,11 @@ func TestAnnotations(t *testing.T) { if u.AuthSSLCert.Secret != secret.Secret { t.Errorf("expected %v but got %v", secret.Secret, u.AuthSSLCert.Secret) } - if u.Ciphers != "HIGH:-SHA" { - t.Errorf("expected %v but got %v", "HIGH:-SHA", u.Ciphers) + if u.Ciphers != proxySslCiphers { + t.Errorf("expected %v but got %v", proxySslCiphers, u.Ciphers) } - if u.Protocols != "SSLv2 TLSv1 TLSv1.2 TLSv1.3" { - t.Errorf("expected %v but got %v", "SSLv2 TLSv1 TLSv1.2 TLSv1.3", u.Protocols) + if u.Protocols != defaultProtocol { + t.Errorf("expected %v but got %v", defaultProtocol, u.Protocols) } if u.Verify != "on" { t.Errorf("expected %v but got %v", "on", u.Verify) @@ -141,7 +148,6 @@ func TestAnnotations(t *testing.T) { if u.ProxySSLServerName != "on" { t.Errorf("expected %v but got %v", "on", u.ProxySSLServerName) } - } func TestInvalidAnnotations(t *testing.T) { @@ -172,11 +178,11 @@ func TestInvalidAnnotations(t *testing.T) { } // Invalid optional Annotations - data[parser.GetAnnotationWithPrefix("proxy-ssl-secret")] = "default/demo-secret" + data[parser.GetAnnotationWithPrefix("proxy-ssl-secret")] = defaultDemoSecret data[parser.GetAnnotationWithPrefix("proxy-ssl-protocols")] = "TLSv111 SSLv1" - data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = "w00t" - data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = "w00t" - data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = "w00t" + data[parser.GetAnnotationWithPrefix("proxy-ssl-server-name")] = sslServerName + data[parser.GetAnnotationWithPrefix("proxy-ssl-session-reuse")] = sslServerName + data[parser.GetAnnotationWithPrefix("proxy-ssl-verify")] = sslServerName data[parser.GetAnnotationWithPrefix("proxy-ssl-verify-depth")] = "abcd" ing.SetAnnotations(data) @@ -207,21 +213,15 @@ func TestEquals(t *testing.T) { cfg1 := &Config{} cfg2 := &Config{} - // Same config - result := cfg1.Equal(cfg1) - if result != true { - t.Errorf("Expected true") - } - // compare nil - result = cfg1.Equal(nil) + result := cfg1.Equal(nil) if result != false { t.Errorf("Expected false") } // Different Certs sslCert1 := resolver.AuthSSLCert{ - Secret: "default/demo-secret", + Secret: defaultDemoSecret, CAFileName: "/ssl/ca.crt", CASHA: "abc", } @@ -240,7 +240,7 @@ func TestEquals(t *testing.T) { // Different Ciphers cfg1.Ciphers = "DEFAULT" - cfg2.Ciphers = "HIGH:-SHA" + cfg2.Ciphers = proxySslCiphers result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") @@ -248,22 +248,22 @@ func TestEquals(t *testing.T) { cfg2.Ciphers = "DEFAULT" // Different Protocols - cfg1.Protocols = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" + cfg1.Protocols = defaultProtocol cfg2.Protocols = "SSLv3 TLSv1 TLSv1.2 TLSv1.3" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.Protocols = "SSLv2 TLSv1 TLSv1.2 TLSv1.3" + cfg2.Protocols = defaultProtocol // Different Verify - cfg1.Verify = "off" + cfg1.Verify = off cfg2.Verify = "on" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.Verify = "off" + cfg2.Verify = off // Different VerifyDepth cfg1.VerifyDepth = 1 @@ -275,13 +275,13 @@ func TestEquals(t *testing.T) { cfg2.VerifyDepth = 1 // Different ProxySSLServerName - cfg1.ProxySSLServerName = "off" + cfg1.ProxySSLServerName = off cfg2.ProxySSLServerName = "on" result = cfg1.Equal(cfg2) if result != false { t.Errorf("Expected false") } - cfg2.ProxySSLServerName = "off" + cfg2.ProxySSLServerName = off // Equal Configs result = cfg1.Equal(cfg2) diff --git a/internal/ingress/annotations/ratelimit/main.go b/internal/ingress/annotations/ratelimit/main.go index 39161a2c0..e79c698bf 100644 --- a/internal/ingress/annotations/ratelimit/main.go +++ b/internal/ingress/annotations/ratelimit/main.go @@ -288,7 +288,7 @@ func (a ratelimit) Parse(ing *networking.Ingress) (interface{}, error) { func encode(s string) string { str := base64.URLEncoding.EncodeToString([]byte(s)) - return strings.Replace(str, "=", "", -1) + return strings.ReplaceAll(str, "=", "") } func (a ratelimit) GetDocumentation() parser.AnnotationFields { diff --git a/internal/ingress/annotations/redirect/redirect.go b/internal/ingress/annotations/redirect/redirect.go index 89513c83c..b58e35171 100644 --- a/internal/ingress/annotations/redirect/redirect.go +++ b/internal/ingress/annotations/redirect/redirect.go @@ -54,14 +54,14 @@ var redirectAnnotations = parser.Annotation{ Documentation: `In some scenarios is required to redirect from www.domain.com to domain.com or vice versa. To enable this feature use this annotation.`, }, temporalRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated Documentation: `This annotation allows you to return a temporal redirect (Return Code 302) instead of sending data to the upstream. For example setting this annotation to https://www.google.com would redirect everything to Google with a Return Code of 302 (Moved Temporarily).`, }, permanentRedirectAnnotation: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, false), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, // Medium, as it allows arbitrary URLs that needs to be validated Documentation: `This annotation allows to return a permanent redirect (Return Code 301) instead of sending data to the upstream. @@ -174,11 +174,11 @@ func isValidURL(s string) error { return nil } -func (a redirect) GetDocumentation() parser.AnnotationFields { - return a.annotationConfig.Annotations +func (r redirect) GetDocumentation() parser.AnnotationFields { + return r.annotationConfig.Annotations } -func (a redirect) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (r redirect) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(r.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, redirectAnnotations.Annotations) } diff --git a/internal/ingress/annotations/redirect/redirect_test.go b/internal/ingress/annotations/redirect/redirect_test.go index 5a61f364d..bd2f98211 100644 --- a/internal/ingress/annotations/redirect/redirect_test.go +++ b/internal/ingress/annotations/redirect/redirect_test.go @@ -136,7 +136,6 @@ func TestTemporalRedirect(t *testing.T) { } func TestIsValidURL(t *testing.T) { - invalid := "ok.com" urlParse, err := url.Parse(invalid) if err != nil { diff --git a/internal/ingress/annotations/rewrite/main.go b/internal/ingress/annotations/rewrite/main.go index 84dc93bf0..cd9ed3993 100644 --- a/internal/ingress/annotations/rewrite/main.go +++ b/internal/ingress/annotations/rewrite/main.go @@ -40,7 +40,7 @@ var rewriteAnnotations = parser.Annotation{ Group: "rewrite", Annotations: parser.AnnotationFields{ rewriteTargetAnnotation: { - Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Validator: parser.ValidateRegex(parser.RegexPathWithCapture, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the target URI where the traffic must be redirected. It can contain regular characters and captured @@ -72,7 +72,7 @@ var rewriteAnnotations = parser.Annotation{ the pathType should also be defined as 'ImplementationSpecific'.`, }, appRootAnnotation: { - Validator: parser.ValidateRegex(*parser.RegexPathWithCapture, false), + Validator: parser.ValidateRegex(parser.RegexPathWithCapture, false), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Application Root that the Controller must redirect if it's in / context`, diff --git a/internal/ingress/annotations/rewrite/main_test.go b/internal/ingress/annotations/rewrite/main_test.go index 6b97d2e01..b68b901b4 100644 --- a/internal/ingress/annotations/rewrite/main_test.go +++ b/internal/ingress/annotations/rewrite/main_test.go @@ -120,7 +120,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = defRoute ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -132,7 +135,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/$1/abc/$2" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + i, err = NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -144,7 +150,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = "/xpto/xas{445}" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: true}).Parse(ing) + i, err = NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -156,7 +165,10 @@ func TestSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("ssl-redirect")] = "false" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: false}).Parse(ing) + i, err = NewParser(mockBackend{redirect: false}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -173,7 +185,10 @@ func TestForceSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("rewrite-target")] = defRoute ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -185,7 +200,10 @@ func TestForceSSLRedirect(t *testing.T) { data[parser.GetAnnotationWithPrefix("force-ssl-redirect")] = "true" ing.SetAnnotations(data) - i, _ = NewParser(mockBackend{redirect: false}).Parse(ing) + i, err = NewParser(mockBackend{redirect: false}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok = i.(*Config) if !ok { t.Errorf("expected a Redirect type") @@ -194,6 +212,7 @@ func TestForceSSLRedirect(t *testing.T) { t.Errorf("Expected true but returned false") } } + func TestAppRoot(t *testing.T) { ap := NewParser(mockBackend{redirect: true}) @@ -241,7 +260,10 @@ func TestUseRegex(t *testing.T) { data[parser.GetAnnotationWithPrefix("use-regex")] = "true" ing.SetAnnotations(data) - i, _ := NewParser(mockBackend{redirect: true}).Parse(ing) + i, err := NewParser(mockBackend{redirect: true}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } redirect, ok := i.(*Config) if !ok { t.Errorf("expected a App Context") diff --git a/internal/ingress/annotations/satisfy/main.go b/internal/ingress/annotations/satisfy/main.go index 45187fe5c..13a4532c1 100644 --- a/internal/ingress/annotations/satisfy/main.go +++ b/internal/ingress/annotations/satisfy/main.go @@ -69,7 +69,7 @@ func (s satisfy) GetDocumentation() parser.AnnotationFields { return s.annotationConfig.Annotations } -func (a satisfy) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (s satisfy) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(s.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, satisfyAnnotations.Annotations) } diff --git a/internal/ingress/annotations/serversnippet/main_test.go b/internal/ingress/annotations/serversnippet/main_test.go index 601e11a42..72e757dc1 100644 --- a/internal/ingress/annotations/serversnippet/main_test.go +++ b/internal/ingress/annotations/serversnippet/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/serviceupstream/main.go b/internal/ingress/annotations/serviceupstream/main.go index e662f73c3..d1851bc7b 100644 --- a/internal/ingress/annotations/serviceupstream/main.go +++ b/internal/ingress/annotations/serviceupstream/main.go @@ -69,7 +69,7 @@ func (s serviceUpstream) GetDocumentation() parser.AnnotationFields { return s.annotationConfig.Annotations } -func (a serviceUpstream) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (s serviceUpstream) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(s.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, serviceUpstreamAnnotations.Annotations) } diff --git a/internal/ingress/annotations/serviceupstream/main_test.go b/internal/ingress/annotations/serviceupstream/main_test.go index 2751208ec..e6216ee5a 100644 --- a/internal/ingress/annotations/serviceupstream/main_test.go +++ b/internal/ingress/annotations/serviceupstream/main_test.go @@ -77,7 +77,10 @@ func TestIngressAnnotationServiceUpstreamEnabled(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "true" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { t.Errorf("expected a bool type") @@ -96,7 +99,10 @@ func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(&resolver.Mock{}).Parse(ing) + val, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { t.Errorf("expected a bool type") @@ -110,7 +116,10 @@ func TestIngressAnnotationServiceUpstreamSetFalse(t *testing.T) { data = map[string]string{} ing.SetAnnotations(data) - val, _ = NewParser(&resolver.Mock{}).Parse(ing) + val, err = NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok = val.(bool) if !ok { t.Errorf("expected a bool type") @@ -137,7 +146,10 @@ func (m mockBackend) GetDefaultBackend() defaults.Backend { func TestParseAnnotationsWithDefaultConfig(t *testing.T) { ing := buildIngress() - val, _ := NewParser(mockBackend{}).Parse(ing) + val, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { @@ -158,7 +170,10 @@ func TestParseAnnotationsOverridesDefaultConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(serviceUpstreamAnnotation)] = "false" ing.SetAnnotations(data) - val, _ := NewParser(mockBackend{}).Parse(ing) + val, err := NewParser(mockBackend{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error: %v", err) + } enabled, ok := val.(bool) if !ok { diff --git a/internal/ingress/annotations/sessionaffinity/main.go b/internal/ingress/annotations/sessionaffinity/main.go index 0a4a59dbc..cc2095de4 100644 --- a/internal/ingress/annotations/sessionaffinity/main.go +++ b/internal/ingress/annotations/sessionaffinity/main.go @@ -63,13 +63,15 @@ const ( // This is used to control the cookie change after request failure annotationAffinityCookieChangeOnFailure = "session-cookie-change-on-failure" + + cookieAffinity = "cookie" ) var sessionAffinityAnnotations = parser.Annotation{ Group: "affinity", Annotations: parser.AnnotationFields{ annotationAffinityType: { - Validator: parser.ValidateOptions([]string{"cookie"}, true, true), + Validator: parser.ValidateOptions([]string{cookieAffinity}, true, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `This annotation enables and sets the affinity type in all Upstreams of an Ingress. This way, a request will always be directed to the same upstream server. The only affinity type available for NGINX is cookie`, @@ -91,7 +93,7 @@ var sessionAffinityAnnotations = parser.Annotation{ Setting this to legacy will restore original canary behavior, when session affinity was ignored.`, }, annotationAffinityCookieName: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation allows to specify the name of the cookie that will be used to route the requests`, @@ -103,25 +105,25 @@ var sessionAffinityAnnotations = parser.Annotation{ Documentation: `This annotation set the cookie as secure regardless the protocol of the incoming request`, }, annotationAffinityCookieExpires: { - Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, true), + Validator: parser.ValidateRegex(affinityCookieExpiresRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation is a legacy version of "session-cookie-max-age" for compatibility with older browsers, generates an "Expires" cookie directive by adding the seconds to the current date`, }, annotationAffinityCookieMaxAge: { - Validator: parser.ValidateRegex(*affinityCookieExpiresRegex, false), + Validator: parser.ValidateRegex(affinityCookieExpiresRegex, false), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation sets the time until the cookie expires`, }, annotationAffinityCookiePath: { - Validator: parser.ValidateRegex(*parser.URLIsValidRegex, true), + Validator: parser.ValidateRegex(parser.URLIsValidRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Path that will be set on the cookie (required if your Ingress paths use regular expressions)`, }, annotationAffinityCookieDomain: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskMedium, Documentation: `This annotation defines the Domain attribute of the sticky cookie.`, @@ -149,9 +151,7 @@ var sessionAffinityAnnotations = parser.Annotation{ }, } -var ( - affinityCookieExpiresRegex = regexp.MustCompile(`(^0|-?[1-9]\d*$)`) -) +var affinityCookieExpiresRegex = regexp.MustCompile(`(^0|-?[1-9]\d*$)`) // Config describes the per ingress session affinity config type Config struct { @@ -186,6 +186,11 @@ type Cookie struct { ConditionalSameSiteNone bool `json:"conditional-samesite-none"` } +type affinity struct { + r resolver.Resolver + annotationConfig parser.Annotation +} + // cookieAffinityParse gets the annotation values related to Cookie Affinity // It also sets default values when no value or incorrect value is found func (a affinity) cookieAffinityParse(ing *networking.Ingress) *Cookie { @@ -252,11 +257,6 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { } } -type affinity struct { - r resolver.Resolver - annotationConfig parser.Annotation -} - // ParseAnnotations parses the annotations contained in the ingress // rule used to configure the affinity directives func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { @@ -279,11 +279,10 @@ func (a affinity) Parse(ing *networking.Ingress) (interface{}, error) { } switch at { - case "cookie": + case cookieAffinity: cookie = a.cookieAffinityParse(ing) default: klog.V(3).InfoS("No default affinity found", "ingress", ing.Name) - } return &Config{ diff --git a/internal/ingress/annotations/sessionaffinity/main_test.go b/internal/ingress/annotations/sessionaffinity/main_test.go index cffe57fec..cecf8cf8f 100644 --- a/internal/ingress/annotations/sessionaffinity/main_test.go +++ b/internal/ingress/annotations/sessionaffinity/main_test.go @@ -83,7 +83,11 @@ func TestIngressAffinityCookieConfig(t *testing.T) { data[parser.GetAnnotationWithPrefix(annotationAffinityCookieSecure)] = "true" ing.SetAnnotations(data) - affin, _ := NewParser(&resolver.Mock{}).Parse(ing) + affin, err := NewParser(&resolver.Mock{}).Parse(ing) + if err != nil { + t.Errorf("unexpected error parsing annotations: %v", err) + } + nginxAffinity, ok := affin.(*Config) if !ok { t.Errorf("expected a Config type") diff --git a/internal/ingress/annotations/snippet/main_test.go b/internal/ingress/annotations/snippet/main_test.go index 921afeea8..b29b2950d 100644 --- a/internal/ingress/annotations/snippet/main_test.go +++ b/internal/ingress/annotations/snippet/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/sslcipher/main.go b/internal/ingress/annotations/sslcipher/main.go index c30f12424..685ef90bf 100644 --- a/internal/ingress/annotations/sslcipher/main.go +++ b/internal/ingress/annotations/sslcipher/main.go @@ -31,10 +31,8 @@ const ( sslCipherAnnotation = "ssl-ciphers" ) -var ( - // Should cover something like "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" - regexValidSSLCipher = regexp.MustCompile(`^[A-Za-z0-9!:+\-]*$`) -) +// Should cover something like "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP" +var regexValidSSLCipher = regexp.MustCompile(`^[A-Za-z0-9!:+\-]*$`) var sslCipherAnnotations = parser.Annotation{ Group: "backend", @@ -47,7 +45,7 @@ var sslCipherAnnotations = parser.Annotation{ This configuration specifies that server ciphers should be preferred over client ciphers when using the SSLv3 and TLS protocols.`, }, sslCipherAnnotation: { - Validator: parser.ValidateRegex(*regexValidSSLCipher, true), + Validator: parser.ValidateRegex(regexValidSSLCipher, true), Scope: parser.AnnotationScopeIngress, Risk: parser.AnnotationRiskLow, Documentation: `Using this annotation will set the ssl_ciphers directive at the server level. This configuration is active for all the paths in the host.`, @@ -104,7 +102,7 @@ func (sc sslCipher) GetDocumentation() parser.AnnotationFields { return sc.annotationConfig.Annotations } -func (a sslCipher) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (sc sslCipher) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(sc.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, sslCipherAnnotations.Annotations) } diff --git a/internal/ingress/annotations/sslcipher/main_test.go b/internal/ingress/annotations/sslcipher/main_test.go index ac6808e06..167466fef 100644 --- a/internal/ingress/annotations/sslcipher/main_test.go +++ b/internal/ingress/annotations/sslcipher/main_test.go @@ -42,8 +42,11 @@ func TestParse(t *testing.T) { expectErr bool }{ {map[string]string{annotationSSLCiphers: "ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"}, Config{"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP", ""}, false}, - {map[string]string{annotationSSLCiphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"}, - Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}, false}, + { + map[string]string{annotationSSLCiphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"}, + Config{"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256", ""}, + false, + }, {map[string]string{annotationSSLCiphers: ""}, Config{"", ""}, false}, {map[string]string{annotationSSLPreferServerCiphers: "true"}, Config{"", "on"}, false}, {map[string]string{annotationSSLPreferServerCiphers: "false"}, Config{"", "off"}, false}, diff --git a/internal/ingress/annotations/sslpassthrough/main.go b/internal/ingress/annotations/sslpassthrough/main.go index 1557d4243..c06db8715 100644 --- a/internal/ingress/annotations/sslpassthrough/main.go +++ b/internal/ingress/annotations/sslpassthrough/main.go @@ -47,7 +47,8 @@ type sslpt struct { // NewParser creates a new SSL passthrough annotation parser func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return sslpt{r: r, + return sslpt{ + r: r, annotationConfig: sslPassthroughAnnotations, } } diff --git a/internal/ingress/annotations/streamsnippet/main_test.go b/internal/ingress/annotations/streamsnippet/main_test.go index 997b7be70..e8a1ff8d0 100644 --- a/internal/ingress/annotations/streamsnippet/main_test.go +++ b/internal/ingress/annotations/streamsnippet/main_test.go @@ -38,7 +38,8 @@ func TestParse(t *testing.T) { annotations map[string]string expected string }{ - {map[string]string{annotation: "server { listen: 8000; proxy_pass 127.0.0.1:80}"}, + { + map[string]string{annotation: "server { listen: 8000; proxy_pass 127.0.0.1:80}"}, "server { listen: 8000; proxy_pass 127.0.0.1:80}", }, {map[string]string{annotation: "false"}, "false"}, @@ -56,6 +57,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/annotations/upstreamhashby/main.go b/internal/ingress/annotations/upstreamhashby/main.go index bc07f70fb..25cc88b8e 100644 --- a/internal/ingress/annotations/upstreamhashby/main.go +++ b/internal/ingress/annotations/upstreamhashby/main.go @@ -41,7 +41,7 @@ var upstreamHashByAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ upstreamHashByAnnotation: { - Validator: parser.ValidateRegex(*hashByRegex, true), + Validator: parser.ValidateRegex(hashByRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskHigh, // High, this annotation allows accessing NGINX variables Documentation: `This annotation defines the nginx variable, text value or any combination thereof to use for consistent hashing. diff --git a/internal/ingress/annotations/xforwardedprefix/main.go b/internal/ingress/annotations/xforwardedprefix/main.go index fc4d5798d..530afbb01 100644 --- a/internal/ingress/annotations/xforwardedprefix/main.go +++ b/internal/ingress/annotations/xforwardedprefix/main.go @@ -31,7 +31,7 @@ var xForwardedForAnnotations = parser.Annotation{ Group: "backend", Annotations: parser.AnnotationFields{ xForwardedForPrefixAnnotation: { - Validator: parser.ValidateRegex(*parser.BasicCharsRegex, true), + Validator: parser.ValidateRegex(parser.BasicCharsRegex, true), Scope: parser.AnnotationScopeLocation, Risk: parser.AnnotationRiskLow, // Low, as it allows regexes but on a very limited set Documentation: `This annotation can be used to add the non-standard X-Forwarded-Prefix header to the upstream request with a string value`, @@ -54,15 +54,15 @@ func NewParser(r resolver.Resolver) parser.IngressAnnotation { // Parse parses the annotations contained in the ingress rule // used to add an x-forwarded-prefix header to the request -func (cbbs xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) { - return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, cbbs.annotationConfig.Annotations) +func (x xforwardedprefix) Parse(ing *networking.Ingress) (interface{}, error) { + return parser.GetStringAnnotation(xForwardedForPrefixAnnotation, ing, x.annotationConfig.Annotations) } -func (cbbs xforwardedprefix) GetDocumentation() parser.AnnotationFields { - return cbbs.annotationConfig.Annotations +func (x xforwardedprefix) GetDocumentation() parser.AnnotationFields { + return x.annotationConfig.Annotations } -func (a xforwardedprefix) Validate(anns map[string]string) error { - maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel) +func (x xforwardedprefix) Validate(anns map[string]string) error { + maxrisk := parser.StringRiskToRisk(x.r.GetSecurityConfiguration().AnnotationsRiskLevel) return parser.CheckAnnotationRisk(anns, maxrisk, xForwardedForAnnotations.Annotations) } diff --git a/internal/ingress/annotations/xforwardedprefix/main_test.go b/internal/ingress/annotations/xforwardedprefix/main_test.go index d873a4412..f28b6b10e 100644 --- a/internal/ingress/annotations/xforwardedprefix/main_test.go +++ b/internal/ingress/annotations/xforwardedprefix/main_test.go @@ -54,6 +54,7 @@ func TestParse(t *testing.T) { for _, testCase := range testCases { ing.SetAnnotations(testCase.annotations) + //nolint:errcheck // Ignore the error since invalid cases will be checked with expected results result, _ := ap.Parse(ing) if result != testCase.expected { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) diff --git a/internal/ingress/controller/certificate.go b/internal/ingress/controller/certificate.go index e8707c716..76aafec3c 100644 --- a/internal/ingress/controller/certificate.go +++ b/internal/ingress/controller/certificate.go @@ -100,7 +100,7 @@ func matchHostnames(pattern, host string) bool { host = strings.TrimSuffix(host, ".") pattern = strings.TrimSuffix(pattern, ".") - if len(pattern) == 0 || len(host) == 0 { + if pattern == "" || host == "" { return false } diff --git a/internal/ingress/controller/checker.go b/internal/ingress/controller/checker.go index 3229778bb..d1bf19ddf 100644 --- a/internal/ingress/controller/checker.go +++ b/internal/ingress/controller/checker.go @@ -29,7 +29,7 @@ import ( ) // Name returns the healthcheck name -func (n NGINXController) Name() string { +func (n *NGINXController) Name() string { return "nginx-ingress-controller" } diff --git a/internal/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go index 2d63efc09..5fb6b09fd 100644 --- a/internal/ingress/controller/checker_test.go +++ b/internal/ingress/controller/checker_test.go @@ -32,7 +32,7 @@ import ( ) func TestNginxCheck(t *testing.T) { - var tests = []struct { + tests := []struct { healthzPath string }{ {"/healthz"}, @@ -42,7 +42,6 @@ func TestNginxCheck(t *testing.T) { for _, tt := range tests { testName := fmt.Sprintf("health path: %s", tt.healthzPath) t.Run(testName, func(t *testing.T) { - mux := http.NewServeMux() listener, err := tryListen("tcp", fmt.Sprintf(":%v", nginx.StatusPort)) @@ -50,7 +49,7 @@ func TestNginxCheck(t *testing.T) { t.Fatalf("creating tcp listener: %s", err) } defer listener.Close() - + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing server := &httptest.Server{ Listener: listener, Config: &http.Server{ @@ -103,10 +102,10 @@ func TestNginxCheck(t *testing.T) { } }() go func() { - cmd.Wait() //nolint:errcheck + cmd.Wait() //nolint:errcheck // Ignore the error }() - if _, err := pidFile.Write([]byte(fmt.Sprintf("%v", pid))); err != nil { + if _, err := fmt.Fprintf(pidFile, "%v", pid); err != nil { t.Errorf("unexpected error writing the pid file: %v", err) } @@ -121,7 +120,7 @@ func TestNginxCheck(t *testing.T) { }) // pollute pid file - pidFile.Write([]byte("999999")) //nolint:errcheck + pidFile.WriteString("999999") //nolint:errcheck // Ignore the error pidFile.Close() t.Run("bad pid", func(t *testing.T) { @@ -134,7 +133,7 @@ func TestNginxCheck(t *testing.T) { } func callHealthz(expErr bool, healthzPath string, mux *http.ServeMux) error { - req, err := http.NewRequest(http.MethodGet, healthzPath, nil) + req, err := http.NewRequest(http.MethodGet, healthzPath, http.NoBody) if err != nil { return fmt.Errorf("healthz error: %v", err) } diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 60cef489a..0dafa78a2 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -29,10 +29,8 @@ import ( "k8s.io/ingress-nginx/pkg/util/runtime" ) -var ( - // EnableSSLChainCompletion Autocomplete SSL certificate chains with missing intermediate CA certificates. - EnableSSLChainCompletion = false -) +// EnableSSLChainCompletion Autocomplete SSL certificate chains with missing intermediate CA certificates. +var EnableSSLChainCompletion = false const ( // http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size @@ -91,7 +89,7 @@ const ( // Configuration represents the content of nginx.conf file type Configuration struct { - defaults.Backend `json:",squash"` //nolint:staticcheck + defaults.Backend `json:",squash"` //nolint:staticcheck // Ignore unknown JSON option "squash" error // AllowSnippetAnnotations enable users to add their own snippets via ingress annotation. // If disabled, only snippets added via ConfigMap are added to ingress. @@ -141,9 +139,9 @@ type Configuration struct { // By default access logs go to /var/log/nginx/access.log AccessLogPath string `json:"access-log-path,omitempty"` - // HttpAccessLogPath sets the path of the access logs for http context globally if enabled + // HTTPAccessLogPath sets the path of the access logs for http context globally if enabled // http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log - HttpAccessLogPath string `json:"http-access-log-path,omitempty"` + HTTPAccessLogPath string `json:"http-access-log-path,omitempty"` // StreamAccessLogPath sets the path of the access logs for stream context globally if enabled // http://nginx.org/en/docs/stream/ngx_stream_log_module.html#access_log @@ -230,19 +228,19 @@ type Configuration struct { // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_field_size // HTTP2MaxFieldSize Limits the maximum size of an HPACK-compressed request header field - // NOTE: Deprecated + // Deprecated: HTTP2MaxFieldSize is deprecated. HTTP2MaxFieldSize string `json:"http2-max-field-size,omitempty"` // https://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_header_size // HTTP2MaxHeaderSize Limits the maximum size of the entire request header list after HPACK decompression - // NOTE: Deprecated + // Deprecated: HTTP2MaxHeaderSize is deprecated. HTTP2MaxHeaderSize string `json:"http2-max-header-size,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_requests // HTTP2MaxRequests Sets the maximum number of requests (including push requests) that can be served // through one HTTP/2 connection, after which the next client request will lead to connection closing // and the need of establishing a new connection. - // NOTE: Deprecated + // Deprecated: HTTP2MaxRequests is deprecated. HTTP2MaxRequests int `json:"http2-max-requests,omitempty"` // http://nginx.org/en/docs/http/ngx_http_v2_module.html#http2_max_concurrent_streams @@ -552,7 +550,7 @@ type Configuration struct { UseForwardedHeaders bool `json:"use-forwarded-headers"` // Sets whether to enable the real ip module - EnableRealIp bool `json:"enable-real-ip"` + EnableRealIP bool `json:"enable-real-ip"` // Sets the header field for identifying the originating IP address of a client // Default is X-Forwarded-For @@ -621,7 +619,7 @@ type Configuration struct { // Default: 0.01 OtelSamplerRatio float32 `json:"otel-sampler-ratio"` - //OtelSamplerParentBased specifies the parent based sampler to be use for any traces created + // OtelSamplerParentBased specifies the parent based sampler to be use for any traces created // Default: true OtelSamplerParentBased bool `json:"otel-sampler-parent-based"` @@ -891,7 +889,7 @@ func NewDefault() Configuration { EnableUnderscoresInHeaders: false, ErrorLogLevel: errorLevel, UseForwardedHeaders: false, - EnableRealIp: false, + EnableRealIP: false, ForwardedForHeader: "X-Forwarded-For", ComputeFullForwardedFor: false, ProxyAddOriginalURIHeader: false, @@ -1039,41 +1037,41 @@ func NewDefault() Configuration { // TemplateConfig contains the nginx configuration to render the file nginx.conf type TemplateConfig struct { - ProxySetHeaders map[string]string - AddHeaders map[string]string - BacklogSize int - Backends []*ingress.Backend - PassthroughBackends []*ingress.SSLPassthroughBackend - Servers []*ingress.Server - TCPBackends []ingress.L4Service - UDPBackends []ingress.L4Service - HealthzURI string - Cfg Configuration - IsIPV6Enabled bool - IsSSLPassthroughEnabled bool - NginxStatusIpv4Whitelist []string - NginxStatusIpv6Whitelist []string - RedirectServers interface{} - ListenPorts *ListenPorts - PublishService *apiv1.Service - EnableMetrics bool - MaxmindEditionFiles *[]string - MonitorMaxBatchSize int - PID string - StatusPath string - StatusPort int - StreamPort int - StreamSnippets []string + ProxySetHeaders map[string]string `json:"ProxySetHeaders"` + AddHeaders map[string]string `json:"AddHeaders"` + BacklogSize int `json:"BacklogSize"` + Backends []*ingress.Backend `json:"Backends"` + PassthroughBackends []*ingress.SSLPassthroughBackend `json:"PassthroughBackends"` + Servers []*ingress.Server `json:"Servers"` + TCPBackends []ingress.L4Service `json:"TCPBackends"` + UDPBackends []ingress.L4Service `json:"UDPBackends"` + HealthzURI string `json:"HealthzURI"` + Cfg Configuration `json:"Cfg"` + IsIPV6Enabled bool `json:"IsIPV6Enabled"` + IsSSLPassthroughEnabled bool `json:"IsSSLPassthroughEnabled"` + NginxStatusIpv4Whitelist []string `json:"NginxStatusIpv4Whitelist"` + NginxStatusIpv6Whitelist []string `json:"NginxStatusIpv6Whitelist"` + RedirectServers interface{} `json:"RedirectServers"` + ListenPorts *ListenPorts `json:"ListenPorts"` + PublishService *apiv1.Service `json:"PublishService"` + EnableMetrics bool `json:"EnableMetrics"` + MaxmindEditionFiles *[]string `json:"MaxmindEditionFiles"` + MonitorMaxBatchSize int `json:"MonitorMaxBatchSize"` + PID string `json:"PID"` + StatusPath string `json:"StatusPath"` + StatusPort int `json:"StatusPort"` + StreamPort int `json:"StreamPort"` + StreamSnippets []string `json:"StreamSnippets"` } // ListenPorts describe the ports required to run the // NGINX Ingress controller type ListenPorts struct { - HTTP int - HTTPS int - Health int - Default int - SSLProxy int + HTTP int `json:"HTTP"` + HTTPS int `json:"HTTPS"` + Health int `json:"Health"` + Default int `json:"Default"` + SSLProxy int `json:"SSLProxy"` } // GlobalExternalAuth describe external authentication configuration for the diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index f405bdcbb..f2ad4639b 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -114,7 +114,7 @@ type Configuration struct { DisableCatchAll bool - IngressClassConfiguration *ingressclass.IngressClassConfiguration + IngressClassConfiguration *ingressclass.Configuration ValidationWebhook string ValidationWebhookCertPath string @@ -143,7 +143,7 @@ type Configuration struct { func getIngressPodZone(svc *apiv1.Service) string { svcKey := k8s.MetaNamespaceKey(svc) if svcZoneAnnotation, ok := svc.ObjectMeta.GetAnnotations()[apiv1.AnnotationTopologyMode]; ok { - if strings.ToLower(svcZoneAnnotation) == "auto" { + if strings.EqualFold(svcZoneAnnotation, "auto") { if foundZone, ok := k8s.IngressNodeDetails.GetLabels()[apiv1.LabelTopologyZone]; ok { klog.V(3).Infof("Svc has topology aware annotation enabled, try to use zone %q where controller pod is running for Service %q ", foundZone, svcKey) return foundZone @@ -154,7 +154,7 @@ func getIngressPodZone(svc *apiv1.Service) string { } // GetPublishService returns the Service used to set the load-balancer status of Ingresses. -func (n NGINXController) GetPublishService() *apiv1.Service { +func (n *NGINXController) GetPublishService() *apiv1.Service { s, err := n.store.GetService(n.cfg.PublishService) if err != nil { return nil @@ -189,13 +189,16 @@ func (n *NGINXController) syncIngress(interface{}) error { if !utilingress.IsDynamicConfigurationEnough(pcfg, n.runningConfig) { klog.InfoS("Configuration changes detected, backend reload required") - hash, _ := hashstructure.Hash(pcfg, hashstructure.FormatV1, &hashstructure.HashOptions{ + hash, err := hashstructure.Hash(pcfg, hashstructure.FormatV1, &hashstructure.HashOptions{ TagName: "json", }) + if err != nil { + klog.Errorf("unexpected error hashing configuration: %v", err) + } pcfg.ConfigurationChecksum = fmt.Sprintf("%v", hash) - err := n.OnUpdate(*pcfg) + err = n.OnUpdate(*pcfg) if err != nil { n.metricCollector.IncReloadErrorCount() n.metricCollector.ConfigSuccess(hash, false) @@ -263,7 +266,7 @@ func (n *NGINXController) syncIngress(interface{}) error { func (n *NGINXController) CheckWarning(ing *networking.Ingress) ([]string, error) { warnings := make([]string, 0) - var deprecatedAnnotations = sets.NewString() + deprecatedAnnotations := sets.NewString() deprecatedAnnotations.Insert( "enable-influxdb", "influxdb-measurement", @@ -335,7 +338,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { } if n.cfg.DisableCatchAll && ing.Spec.DefaultBackend != nil { - return fmt.Errorf("This deployment is trying to create a catch-all ingress while DisableCatchAll flag is set to true. Remove '.spec.defaultBackend' or set DisableCatchAll flag to false.") + return fmt.Errorf("this deployment is trying to create a catch-all ingress while DisableCatchAll flag is set to true. Remove '.spec.defaultBackend' or set DisableCatchAll flag to false") } startRender := time.Now().UnixNano() / 1000000 cfg := n.store.GetBackendConfiguration() @@ -355,10 +358,9 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { } for key, value := range ing.ObjectMeta.GetAnnotations() { - if parser.AnnotationsPrefix != parser.DefaultAnnotationsPrefix { if strings.HasPrefix(key, fmt.Sprintf("%s/", parser.DefaultAnnotationsPrefix)) { - return fmt.Errorf("This deployment has a custom annotation prefix defined. Use '%s' instead of '%s'", parser.AnnotationsPrefix, parser.DefaultAnnotationsPrefix) + return fmt.Errorf("this deployment has a custom annotation prefix defined. Use '%s' instead of '%s'", parser.AnnotationsPrefix, parser.DefaultAnnotationsPrefix) } } @@ -374,10 +376,9 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { return fmt.Errorf("%s annotation cannot be used. Snippet directives are disabled by the Ingress administrator", key) } - if len(cfg.GlobalRateLimitMemcachedHost) == 0 && strings.HasPrefix(key, fmt.Sprintf("%s/%s", parser.AnnotationsPrefix, "global-rate-limit")) { + if cfg.GlobalRateLimitMemcachedHost == "" && strings.HasPrefix(key, fmt.Sprintf("%s/%s", parser.AnnotationsPrefix, "global-rate-limit")) { return fmt.Errorf("'global-rate-limit*' annotations require 'global-rate-limit-memcached-host' settings configured in the global configmap") } - } k8s.SetDefaultNGINXPathType(ing) @@ -401,7 +402,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { startTest := time.Now().UnixNano() / 1000000 _, servers, pcfg := n.getConfiguration(ings) - err = checkOverlap(ing, allIngresses, servers) + err = checkOverlap(ing, servers) if err != nil { n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name) return err @@ -452,7 +453,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr return []ingress.L4Service{} } - var svcs []ingress.L4Service + svcs := make([]ingress.L4Service, 0, len(configmap.Data)) var svcProxyProtocol ingress.ProxyProtocol rp := []int{ @@ -489,10 +490,10 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr svcProxyProtocol.Encode = false // Proxy Protocol is only compatible with TCP Services if len(nsSvcPort) >= 3 && proto == apiv1.ProtocolTCP { - if len(nsSvcPort) >= 3 && strings.ToUpper(nsSvcPort[2]) == "PROXY" { + if len(nsSvcPort) >= 3 && strings.EqualFold(nsSvcPort[2], "PROXY") { svcProxyProtocol.Decode = true } - if len(nsSvcPort) == 4 && strings.ToUpper(nsSvcPort[3]) == "PROXY" { + if len(nsSvcPort) == 4 && strings.EqualFold(nsSvcPort[3], "PROXY") { svcProxyProtocol.Encode = true } } @@ -532,6 +533,7 @@ func (n *NGINXController) getStreamServices(configmapName string, proto apiv1.Pr klog.V(3).Infof("Searching Endpoints with %v port number %d for Service %q", proto, targetPort, nsName) for i := range svc.Spec.Ports { sp := svc.Spec.Ports[i] + //nolint:gosec // Ignore G109 error if sp.Port == int32(targetPort) { if sp.Protocol == proto { endps = getEndpointsFromSlices(svc, &sp, proto, zone, n.store.GetServiceEndpointsSlices) @@ -574,7 +576,7 @@ func (n *NGINXController) getDefaultUpstream() *ingress.Backend { } svcKey := n.cfg.DefaultService - if len(svcKey) == 0 { + if svcKey == "" { upstream.Endpoints = append(upstream.Endpoints, n.DefaultEndpoint()) return upstream } @@ -690,13 +692,14 @@ func dropSnippetDirectives(anns *annotations.Ingress, ingKey string) { klog.V(3).Infof("Ingress %q tried to use stream-snippet and the annotation is disabled by the admin. Removing the annotation", ingKey) anns.StreamSnippet = "" } - } } // getBackendServers returns a list of Upstream and Server to be used by the // backend. An upstream can be used in multiple servers if the namespace, // service name and port are the same. +// +//nolint:gocyclo // Ignore function complexity error func (n *NGINXController) getBackendServers(ingresses []*ingress.Ingress) ([]*ingress.Backend, []*ingress.Server) { du := n.getDefaultUpstream() upstreams := n.createUpstreams(ingresses, du) @@ -1030,7 +1033,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[defBackend].NoServer = true - upstreams[defBackend].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) + upstreams[defBackend].TrafficShapingPolicy = newTrafficShapingPolicy(&anns.Canary) } if len(upstreams[defBackend].Endpoints) == 0 { @@ -1095,7 +1098,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // configure traffic shaping for canary if anns.Canary.Enabled { upstreams[name].NoServer = true - upstreams[name].TrafficShapingPolicy = newTrafficShapingPolicy(anns.Canary) + upstreams[name].TrafficShapingPolicy = newTrafficShapingPolicy(&anns.Canary) } if len(upstreams[name].Endpoints) == 0 { @@ -1206,7 +1209,6 @@ func (n *NGINXController) serviceEndpoints(svcKey, backendPort string) ([]ingres if strconv.Itoa(int(servicePort.Port)) == backendPort || servicePort.TargetPort.String() == backendPort || servicePort.Name == backendPort { - endps := getEndpointsFromSlices(svc, &servicePort, apiv1.ProtocolTCP, zone, n.store.GetServiceEndpointsSlices) if len(endps) == 0 { klog.Warningf("Service %q does not have any active Endpoint.", svcKey) @@ -1239,8 +1241,8 @@ func (n *NGINXController) getDefaultSSLCertificate() *ingress.SSLCert { // one root location, which uses a default backend if left unspecified. func (n *NGINXController) createServers(data []*ingress.Ingress, upstreams map[string]*ingress.Backend, - du *ingress.Backend) map[string]*ingress.Server { - + du *ingress.Backend, +) map[string]*ingress.Server { servers := make(map[string]*ingress.Server, len(data)) allAliases := make(map[string][]string, len(data)) @@ -1282,7 +1284,8 @@ func (n *NGINXController) createServers(data []*ingress.Ingress, Rewrite: false, }, }, - }} + }, + } // initialize all other servers for _, ing := range data { @@ -1532,7 +1535,7 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) } // OK to merge canary ingresses iff there exists one or more ingresses to potentially merge into -func nonCanaryIngressExists(ingresses []*ingress.Ingress, canaryIngresses []*ingress.Ingress) bool { +func nonCanaryIngressExists(ingresses, canaryIngresses []*ingress.Ingress) bool { return len(ingresses)-len(canaryIngresses) > 0 } @@ -1540,12 +1543,12 @@ func nonCanaryIngressExists(ingresses []*ingress.Ingress, canaryIngresses []*ing // 1) names of backends do not match and canary doesn't merge into itself // 2) primary name is not the default upstream // 3) the primary has a server -func canMergeBackend(primary *ingress.Backend, alternative *ingress.Backend) bool { +func canMergeBackend(primary, alternative *ingress.Backend) bool { return alternative != nil && primary.Name != alternative.Name && primary.Name != defUpstreamName && !primary.NoServer } // Performs the merge action and checks to ensure that one two alternative backends do not merge into each other -func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altUps *ingress.Backend) bool { +func mergeAlternativeBackend(ing *ingress.Ingress, priUps, altUps *ingress.Backend) bool { if priUps.NoServer { klog.Warningf("unable to merge alternative backend %v into primary backend %v because %v is a primary backend", altUps.Name, priUps.Name, priUps.Name) @@ -1563,8 +1566,7 @@ func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altU priUps.SessionAffinity.DeepCopyInto(&altUps.SessionAffinity) } - priUps.AlternativeBackends = - append(priUps.AlternativeBackends, altUps.Name) + priUps.AlternativeBackends = append(priUps.AlternativeBackends, altUps.Name) return true } @@ -1574,8 +1576,8 @@ func mergeAlternativeBackend(ing *ingress.Ingress, priUps *ingress.Backend, altU // to a backend's alternative list. // If no match is found, then the serverless backend is deleted. func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingress.Backend, - servers map[string]*ingress.Server) { - + servers map[string]*ingress.Server, +) { // merge catch-all alternative backends if ing.Spec.DefaultBackend != nil { upsName := upstreamName(ing.Namespace, ing.Spec.DefaultBackend.Service) @@ -1585,7 +1587,6 @@ func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingres if altUps == nil { klog.Warningf("alternative backend %s has already been removed", upsName) } else { - merged := false altEqualsPri := false @@ -1676,8 +1677,8 @@ func mergeAlternativeBackends(ing *ingress.Ingress, upstreams map[string]*ingres // extractTLSSecretName returns the name of the Secret containing a SSL // certificate for the given host name, or an empty string. func extractTLSSecretName(host string, ing *ingress.Ingress, - getLocalSSLCert func(string) (*ingress.SSLCert, error)) string { - + getLocalSSLCert func(string) (*ingress.SSLCert, error), +) string { if ing == nil { return "" } @@ -1694,7 +1695,6 @@ func extractTLSSecretName(host string, ing *ingress.Ingress, // no TLS host matching host name, try each TLS host for matching SAN or CN for _, tls := range ing.Spec.TLS { - if tls.SecretName == "" { // There's no secretName specified, so it will never be available continue @@ -1753,6 +1753,7 @@ func externalNamePorts(name string, svc *apiv1.Service) *apiv1.ServicePort { } for _, svcPort := range svc.Spec.Ports { + //nolint:gosec // Ignore G109 error if svcPort.Port != int32(port) { continue } @@ -1771,13 +1772,14 @@ func externalNamePorts(name string, svc *apiv1.Service) *apiv1.ServicePort { // ExternalName without port return &apiv1.ServicePort{ - Protocol: "TCP", + Protocol: "TCP", + //nolint:gosec // Ignore G109 error Port: int32(port), TargetPort: intstr.FromInt(port), } } -func checkOverlap(ing *networking.Ingress, ingresses []*ingress.Ingress, servers []*ingress.Server) error { +func checkOverlap(ing *networking.Ingress, servers []*ingress.Server) error { for _, rule := range ing.Spec.Rules { if rule.HTTP == nil { continue @@ -1870,7 +1872,7 @@ func (n *NGINXController) getStreamSnippets(ingresses []*ingress.Ingress) []stri } // newTrafficShapingPolicy creates new ingress.TrafficShapingPolicy instance using canary configuration -func newTrafficShapingPolicy(cfg canary.Config) ingress.TrafficShapingPolicy { +func newTrafficShapingPolicy(cfg *canary.Config) ingress.TrafficShapingPolicy { return ingress.TrafficShapingPolicy{ Weight: cfg.Weight, WeightTotal: cfg.WeightTotal, diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index c353d1b5e..c07fcfadf 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -60,51 +60,56 @@ import ( "k8s.io/ingress-nginx/pkg/util/file" ) +const ( + exampleBackend = "example-http-svc-1-80" + TRUE = "true" +) + type fakeIngressStore struct { ingresses []*ingress.Ingress configuration ngx_config.Configuration } -func (fakeIngressStore) GetIngressClass(ing *networking.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) { +func (fakeIngressStore) GetIngressClass(_ *networking.Ingress, _ *ingressclass.Configuration) (string, error) { return "nginx", nil } -func (fis fakeIngressStore) GetBackendConfiguration() ngx_config.Configuration { +func (fis *fakeIngressStore) GetBackendConfiguration() ngx_config.Configuration { return fis.configuration } -func (fis fakeIngressStore) GetSecurityConfiguration() defaults.SecurityConfiguration { +func (fis *fakeIngressStore) GetSecurityConfiguration() defaults.SecurityConfiguration { return defaults.SecurityConfiguration{ AnnotationsRiskLevel: fis.configuration.AnnotationsRiskLevel, AllowCrossNamespaceResources: fis.configuration.AllowCrossNamespaceResources, } } -func (fakeIngressStore) GetConfigMap(key string) (*corev1.ConfigMap, error) { +func (fakeIngressStore) GetConfigMap(_ string) (*corev1.ConfigMap, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetSecret(key string) (*corev1.Secret, error) { +func (fakeIngressStore) GetSecret(_ string) (*corev1.Secret, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetService(key string) (*corev1.Service, error) { +func (fakeIngressStore) GetService(_ string) (*corev1.Service, error) { return nil, fmt.Errorf("test error") } -func (fakeIngressStore) GetServiceEndpointsSlices(key string) ([]*discoveryv1.EndpointSlice, error) { +func (fakeIngressStore) GetServiceEndpointsSlices(_ string) ([]*discoveryv1.EndpointSlice, error) { return nil, fmt.Errorf("test error") } -func (fis fakeIngressStore) ListIngresses() []*ingress.Ingress { +func (fis *fakeIngressStore) ListIngresses() []*ingress.Ingress { return fis.ingresses } -func (fis fakeIngressStore) FilterIngresses(ingresses []*ingress.Ingress, filterFunc store.IngressFilterFunc) []*ingress.Ingress { +func (fis *fakeIngressStore) FilterIngresses(ingresses []*ingress.Ingress, _ store.IngressFilterFunc) []*ingress.Ingress { return ingresses } -func (fakeIngressStore) GetLocalSSLCert(name string) (*ingress.SSLCert, error) { +func (fakeIngressStore) GetLocalSSLCert(_ string) (*ingress.SSLCert, error) { return nil, fmt.Errorf("test error") } @@ -120,7 +125,7 @@ func (fakeIngressStore) GetDefaultBackend() defaults.Backend { return defaults.Backend{} } -func (fakeIngressStore) Run(stopCh chan struct{}) {} +func (fakeIngressStore) Run(_ chan struct{}) {} type testNginxTestCommand struct { t *testing.T @@ -129,7 +134,7 @@ type testNginxTestCommand struct { err error } -func (ntc testNginxTestCommand) ExecCommand(args ...string) *exec.Cmd { +func (ntc testNginxTestCommand) ExecCommand(_ ...string) *exec.Cmd { return nil } @@ -152,7 +157,7 @@ func (ntc testNginxTestCommand) Test(cfg string) ([]byte, error) { type fakeTemplate struct{} -func (fakeTemplate) Write(conf ngx_config.TemplateConfig) ([]byte, error) { +func (fakeTemplate) Write(conf *ngx_config.TemplateConfig) ([]byte, error) { r := []byte{} for _, s := range conf.Servers { if len(r) > 0 { @@ -196,7 +201,7 @@ func TestCheckIngress(t *testing.T) { nginx.metricCollector = metric.DummyCollector{} nginx.t = fakeTemplate{} - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, } @@ -226,7 +231,7 @@ func TestCheckIngress(t *testing.T) { } t.Run("When the hostname is updated", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{ { Ingress: *ing, @@ -273,7 +278,7 @@ func TestCheckIngress(t *testing.T) { }) t.Run("When snippets are disabled and user tries to use snippet annotation", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ AllowSnippetAnnotations: false, @@ -290,7 +295,7 @@ func TestCheckIngress(t *testing.T) { }) t.Run("When invalid directives are used in annotation values", func(t *testing.T) { - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, configuration: ngx_config.Configuration{ AnnotationValueWordBlocklist: "invalid_directive, another_directive", @@ -366,12 +371,11 @@ func TestCheckIngress(t *testing.T) { } func TestCheckWarning(t *testing.T) { - // Ensure no panic with wrong arguments - var nginx = &NGINXController{} + nginx := &NGINXController{} nginx.t = fakeTemplate{} - nginx.store = fakeIngressStore{ + nginx.store = &fakeIngressStore{ ingresses: []*ingress.Ingress{}, } @@ -390,7 +394,7 @@ func TestCheckWarning(t *testing.T) { }, } t.Run("when a deprecated annotation is used a warning should be returned", func(t *testing.T) { - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = TRUE defer func() { ing.ObjectMeta.Annotations = map[string]string{} }() @@ -407,7 +411,6 @@ func TestCheckWarning(t *testing.T) { }) t.Run("When an invalid pathType is used, a warning should be returned", func(t *testing.T) { - rules := ing.Spec.DeepCopy().Rules ing.Spec.Rules = []networking.IngressRule{ { @@ -443,8 +446,8 @@ func TestCheckWarning(t *testing.T) { } t.Run("adding invalid annotations increases the warning count", func(t *testing.T) { - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" - ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = TRUE + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = TRUE ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("influxdb-host")] = "blabla" defer func() { ing.ObjectMeta.Annotations = map[string]string{} @@ -472,6 +475,7 @@ func TestCheckWarning(t *testing.T) { }) } +//nolint:dupl // Ignore dupl errors for similar test case func TestMergeAlternativeBackends(t *testing.T) { testCases := map[string]struct { ingress *ingress.Ingress @@ -1537,8 +1541,8 @@ func TestExtractTLSSecretName(t *testing.T) { } } +//nolint:gocyclo // Ignore function complexity error func TestGetBackendServers(t *testing.T) { - testCases := []struct { Ingresses []*ingress.Ingress Validate func(ingresses []*ingress.Ingress, upstreams []*ingress.Backend, servers []*ingress.Server) @@ -2078,7 +2082,7 @@ func TestGetBackendServers(t *testing.T) { t.Errorf("server hostname should be 'example.com', got '%s'", s.Hostname) } - if s.Locations[0].Backend != "example-http-svc-1-80" || s.Locations[1].Backend != "example-http-svc-1-80" || s.Locations[2].Backend != "example-http-svc-1-80" { + if s.Locations[0].Backend != exampleBackend || s.Locations[1].Backend != exampleBackend || s.Locations[2].Backend != exampleBackend { t.Errorf("all location backend should be 'example-http-svc-1-80'") } @@ -2087,7 +2091,7 @@ func TestGetBackendServers(t *testing.T) { return } - if upstreams[0].Name != "example-http-svc-1-80" { + if upstreams[0].Name != exampleBackend { t.Errorf("example-http-svc-1-80 should be first upstream, got %s", upstreams[0].Name) return } @@ -2101,6 +2105,7 @@ func TestGetBackendServers(t *testing.T) { SetConfigMap: testConfigMap, }, { + //nolint:dupl // Ignore dupl errors for similar test case Ingresses: []*ingress.Ingress{ { Ingress: networking.Ingress{ @@ -2208,6 +2213,7 @@ func TestGetBackendServers(t *testing.T) { SetConfigMap: testConfigMap, }, { + //nolint:dupl // Ignore dupl errors for similar test case Ingresses: []*ingress.Ingress{ { Ingress: networking.Ingress{ @@ -2319,7 +2325,7 @@ func TestGetBackendServers(t *testing.T) { SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), }, Data: map[string]string{ - "proxy-ssl-location-only": "true", + "proxy-ssl-location-only": TRUE, }, } }, @@ -2380,7 +2386,7 @@ func TestGetBackendServers(t *testing.T) { SelfLink: fmt.Sprintf("/api/v1/namespaces/%s/configmaps/config", ns), }, Data: map[string]string{ - "proxy-ssl-location-only": "true", + "proxy-ssl-location-only": TRUE, }, } }, @@ -2449,7 +2455,6 @@ func TestGetBackendServers(t *testing.T) { if len(s.Locations[0].Allowlist.CIDR) != 1 || s.Locations[0].Allowlist.CIDR[0] != "10.0.0.0/24" { t.Errorf("allow list was incorrectly dropped, len should be 1 and contain 10.0.0.0/24") } - }, SetConfigMap: func(ns string) *corev1.ConfigMap { return &corev1.ConfigMap{ @@ -2520,7 +2525,7 @@ func newNGINXController(t *testing.T) *NGINXController { channels.NewRingChannel(10), false, true, - &ingressclass.IngressClassConfiguration{ + &ingressclass.Configuration{ Controller: "k8s.io/ingress-nginx", AnnotationValue: "nginx", }, @@ -2586,7 +2591,7 @@ func newDynamicNginxController(t *testing.T, setConfigMap func(string) *corev1.C channels.NewRingChannel(10), false, true, - &ingressclass.IngressClassConfiguration{ + &ingressclass.Configuration{ Controller: "k8s.io/ingress-nginx", AnnotationValue: "nginx", }, diff --git a/internal/ingress/controller/endpointslices.go b/internal/ingress/controller/endpointslices.go index ca6e595c8..4f98e3ce7 100644 --- a/internal/ingress/controller/endpointslices.go +++ b/internal/ingress/controller/endpointslices.go @@ -36,8 +36,8 @@ import ( // getEndpointsFromSlices returns a list of Endpoint structs for a given service/target port combination. func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto corev1.Protocol, zoneForHints string, - getServiceEndpointsSlices func(string) ([]*discoveryv1.EndpointSlice, error)) []ingress.Endpoint { - + getServiceEndpointsSlices func(string) ([]*discoveryv1.EndpointSlice, error), +) []ingress.Endpoint { upsServers := []ingress.Endpoint{} if s == nil || port == nil { @@ -94,7 +94,7 @@ func getEndpointsFromSlices(s *corev1.Service, port *corev1.ServicePort, proto c if !reflect.DeepEqual(*epPort.Protocol, proto) { continue } - var targetPort int32 = 0 + var targetPort int32 if port.Name == "" { // port.Name is optional if there is only one port targetPort = *epPort.Port diff --git a/internal/ingress/controller/endpointslices_test.go b/internal/ingress/controller/endpointslices_test.go index b61e9a4f3..69ef3ef1b 100644 --- a/internal/ingress/controller/endpointslices_test.go +++ b/internal/ingress/controller/endpointslices_test.go @@ -27,6 +27,7 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) +//nolint:dupl // Ignore dupl errors for similar test case func TestGetEndpointsFromSlices(t *testing.T) { tests := []struct { name string diff --git a/internal/ingress/controller/ingressclass/ingressclass.go b/internal/ingress/controller/ingressclass/ingressclass.go index 95bd98d0f..90c6a4d67 100644 --- a/internal/ingress/controller/ingressclass/ingressclass.go +++ b/internal/ingress/controller/ingressclass/ingressclass.go @@ -29,9 +29,9 @@ const ( DefaultAnnotationValue = "nginx" ) -// IngressClassConfiguration defines the various aspects of IngressClass parsing +// Configuration defines the various aspects of IngressClass parsing // and how the controller should behave in each case -type IngressClassConfiguration struct { +type Configuration struct { // Controller defines the controller value this daemon watch to. // Defaults to "k8s.io/ingress-nginx" defined in flags Controller string @@ -45,7 +45,7 @@ type IngressClassConfiguration struct { // IgnoreIngressClass defines if Controller should ignore the IngressClass Object if no permissions are // granted on IngressClass IgnoreIngressClass bool - //IngressClassByName defines if the Controller should watch for Ingress Classes by + // IngressClassByName defines if the Controller should watch for Ingress Classes by // .metadata.name together with .spec.Controller IngressClassByName bool } diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index 6c25aa34f..30f785586 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -113,7 +113,7 @@ func NewNGINXController(config *Configuration, mc metric.Collector) *NGINXContro if n.cfg.ValidationWebhook != "" { n.validationWebhookServer = &http.Server{ Addr: config.ValidationWebhook, - //G112 (CWE-400): Potential Slowloris Attack + // G112 (CWE-400): Potential Slowloris Attack ReadHeaderTimeout: 10 * time.Second, Handler: adm_controller.NewAdmissionControllerServer(&adm_controller.IngressAdmission{Checker: n}), TLSConfig: ssl.NewTLSListener(n.cfg.ValidationWebhookCertPath, n.cfg.ValidationWebhookKeyPath).TLSConfig(), @@ -429,7 +429,7 @@ func (n *NGINXController) start(cmd *exec.Cmd) { } // DefaultEndpoint returns the default endpoint to be use as default server that returns 404. -func (n NGINXController) DefaultEndpoint() ingress.Endpoint { +func (n *NGINXController) DefaultEndpoint() ingress.Endpoint { return ingress.Endpoint{ Address: "127.0.0.1", Port: fmt.Sprintf("%v", n.cfg.ListenPorts.Default), @@ -438,8 +438,9 @@ func (n NGINXController) DefaultEndpoint() ingress.Endpoint { } // generateTemplate returns the nginx configuration file content -func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressCfg ingress.Configuration) ([]byte, error) { - +// +//nolint:gocritic // the cfg shouldn't be changed, and shouldn't be mutated by other processes while being rendered. +func (n *NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressCfg ingress.Configuration) ([]byte, error) { if n.cfg.EnableSSLPassthrough { servers := []*tcpproxy.TCPServer{} for _, pb := range ingressCfg.PassthroughBackends { @@ -458,6 +459,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC } } else { for _, sp := range svc.Spec.Ports { + //nolint:gosec // Ignore G109 error if sp.Port == int32(port) { port = int(sp.Port) break @@ -563,7 +565,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC if err != nil { klog.Warningf("Error reading Secret %q from local store: %v", secretName, err) } else { - nsSecName := strings.Replace(secretName, "/", "-", -1) + nsSecName := strings.ReplaceAll(secretName, "/", "-") dh, ok := secret.Data["dhparam.pem"] if ok { pemFileName, err := ssl.AddOrUpdateDHParam(nsSecName, dh) @@ -589,7 +591,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC } } - tc := ngx_config.TemplateConfig{ + tc := &ngx_config.TemplateConfig{ ProxySetHeaders: setHeaders, AddHeaders: addHeaders, BacklogSize: sysctlSomaxconn(), @@ -623,7 +625,7 @@ func (n NGINXController) generateTemplate(cfg ngx_config.Configuration, ingressC // testTemplate checks if the NGINX configuration inside the byte array is valid // running the command "nginx -t" using a temporal file. -func (n NGINXController) testTemplate(cfg []byte) error { +func (n *NGINXController) testTemplate(cfg []byte) error { if len(cfg) == 0 { return fmt.Errorf("invalid NGINX configuration (empty)") } @@ -658,6 +660,8 @@ Error: %v // changes were detected. The received backend Configuration is merged with the // configuration ConfigMap before generating the final configuration file. // Returns nil in case the backend was successfully reloaded. +// +//nolint:gocritic // the cfg shouldn't be changed, and shouldn't be mutated by other processes while being rendered. func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { cfg := n.store.GetBackendConfiguration() cfg.Resolver = n.resolver @@ -667,12 +671,12 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { return err } - err = createOpentracingCfg(cfg) + err = createOpentracingCfg(&cfg) if err != nil { return err } - err = createOpentelemetryCfg(cfg) + err = createOpentelemetryCfg(&cfg) if err != nil { return err } @@ -683,7 +687,10 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { } if klog.V(2).Enabled() { - src, _ := os.ReadFile(cfgPath) + src, err := os.ReadFile(cfgPath) + if err != nil { + return err + } if !bytes.Equal(src, content) { tmpfile, err := os.CreateTemp("", "new-nginx-cfg") if err != nil { @@ -694,11 +701,14 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { if err != nil { return err } - + //nolint:gosec //Ignore G204 error diffOutput, err := exec.Command("diff", "-I", "'# Configuration.*'", "-u", cfgPath, tmpfile.Name()).CombinedOutput() if err != nil { if exitError, ok := err.(*exec.ExitError); ok { - ws := exitError.Sys().(syscall.WaitStatus) + ws, ok := exitError.Sys().(syscall.WaitStatus) + if !ok { + klog.Errorf("unexpected type: %T", exitError.Sys()) + } if ws.ExitStatus() == 2 { klog.Warningf("Failed to executing diff command: %v", err) } @@ -828,9 +838,10 @@ func (n *NGINXController) configureDynamically(pcfg *ingress.Configuration) erro return nil } -func updateStreamConfiguration(TCPEndpoints []ingress.L4Service, UDPEndpoints []ingress.L4Service) error { +func updateStreamConfiguration(tcpEndpoints, udpEndpoints []ingress.L4Service) error { streams := make([]ingress.Backend, 0) - for _, ep := range TCPEndpoints { + for i := range tcpEndpoints { + ep := &tcpEndpoints[i] var service *apiv1.Service if ep.Service != nil { service = &apiv1.Service{Spec: ep.Service.Spec} @@ -844,7 +855,8 @@ func updateStreamConfiguration(TCPEndpoints []ingress.L4Service, UDPEndpoints [] Service: service, }) } - for _, ep := range UDPEndpoints { + for i := range udpEndpoints { + ep := &udpEndpoints[i] var service *apiv1.Service if ep.Service != nil { service = &apiv1.Service{Spec: ep.Service.Spec} @@ -1034,7 +1046,7 @@ ratio = {{ .OtelSamplerRatio }} parent_based = {{ .OtelSamplerParentBased }} ` -func datadogOpentracingCfg(cfg ngx_config.Configuration) (string, error) { +func datadogOpentracingCfg(cfg *ngx_config.Configuration) (string, error) { m := map[string]interface{}{ "service": cfg.DatadogServiceName, "agent_host": cfg.DatadogCollectorHost, @@ -1058,7 +1070,7 @@ func datadogOpentracingCfg(cfg ngx_config.Configuration) (string, error) { return string(buf), nil } -func opentracingCfgFromTemplate(cfg ngx_config.Configuration, tmplName string, tmplText string) (string, error) { +func opentracingCfgFromTemplate(cfg *ngx_config.Configuration, tmplName, tmplText string) (string, error) { tmpl, err := template.New(tmplName).Parse(tmplText) if err != nil { return "", err @@ -1073,17 +1085,18 @@ func opentracingCfgFromTemplate(cfg ngx_config.Configuration, tmplName string, t return tmplBuf.String(), nil } -func createOpentracingCfg(cfg ngx_config.Configuration) error { +func createOpentracingCfg(cfg *ngx_config.Configuration) error { var configData string var err error - if cfg.ZipkinCollectorHost != "" { + switch { + case cfg.ZipkinCollectorHost != "": configData, err = opentracingCfgFromTemplate(cfg, "zipkin", zipkinTmpl) - } else if cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "" { + case cfg.JaegerCollectorHost != "" || cfg.JaegerEndpoint != "": configData, err = opentracingCfgFromTemplate(cfg, "jaeger", jaegerTmpl) - } else if cfg.DatadogCollectorHost != "" { + case cfg.DatadogCollectorHost != "": configData, err = datadogOpentracingCfg(cfg) - } else { + default: configData = "{}" } @@ -1097,8 +1110,7 @@ func createOpentracingCfg(cfg ngx_config.Configuration) error { return os.WriteFile("/etc/nginx/opentracing.json", []byte(expanded), file.ReadWriteByUser) } -func createOpentelemetryCfg(cfg ngx_config.Configuration) error { - +func createOpentelemetryCfg(cfg *ngx_config.Configuration) error { tmpl, err := template.New("otel").Parse(otelTmpl) if err != nil { return err @@ -1123,7 +1135,10 @@ func cleanTempNginxCfg() error { return filepath.SkipDir } - dur, _ := time.ParseDuration("-5m") + dur, err := time.ParseDuration("-5m") + if err != nil { + return err + } fiveMinutesAgo := time.Now().Add(dur) if strings.HasPrefix(info.Name(), tempNginxPattern) && info.ModTime().Before(fiveMinutesAgo) { files = append(files, path) diff --git a/internal/ingress/controller/nginx_test.go b/internal/ingress/controller/nginx_test.go index 56eb0f324..c68b0b188 100644 --- a/internal/ingress/controller/nginx_test.go +++ b/internal/ingress/controller/nginx_test.go @@ -58,6 +58,7 @@ func TestConfigureDynamically(t *testing.T) { server := &httptest.Server{ Listener: listener, + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing Config: &http.Server{ Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) @@ -76,23 +77,17 @@ func TestConfigureDynamically(t *testing.T) { switch r.URL.Path { case "/configuration/backends": - { - if strings.Contains(body, "target") { - t.Errorf("unexpected target reference in JSON content: %v", body) - } + if strings.Contains(body, "target") { + t.Errorf("unexpected target reference in JSON content: %v", body) + } - if !strings.Contains(body, "service") { - t.Errorf("service reference should be present in JSON content: %v", body) - } + if !strings.Contains(body, "service") { + t.Errorf("service reference should be present in JSON content: %v", body) } case "/configuration/general": - { - } case "/configuration/servers": - { - if !strings.Contains(body, `{"certificates":{},"servers":{"myapp.fake":"-1"}}`) { - t.Errorf("should be present in JSON content: %v", body) - } + if !strings.Contains(body, `{"certificates":{},"servers":{"myapp.fake":"-1"}}`) { + t.Errorf("should be present in JSON content: %v", body) } default: t.Errorf("unknown request to %s", r.URL.Path) @@ -218,6 +213,7 @@ func TestConfigureCertificates(t *testing.T) { server := &httptest.Server{ Listener: listener, + //nolint:gosec // Ignore not configured ReadHeaderTimeout in testing Config: &http.Server{ Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) @@ -414,6 +410,7 @@ func TestCleanTempNginxCfg(t *testing.T) { } } +//nolint:unparam // Ingnore `network` always receives `"tcp"` error func tryListen(network, address string) (l net.Listener, err error) { condFunc := func() (bool, error) { l, err = net.Listen(network, address) diff --git a/internal/ingress/controller/process/nginx.go b/internal/ingress/controller/process/nginx.go index 70227ac2e..fdf501616 100644 --- a/internal/ingress/controller/process/nginx.go +++ b/internal/ingress/controller/process/nginx.go @@ -30,7 +30,10 @@ func IsRespawnIfRequired(err error) bool { return false } - waitStatus := exitError.Sys().(syscall.WaitStatus) + waitStatus, ok := exitError.Sys().(syscall.WaitStatus) + if !ok { + return false + } klog.Warningf(` ------------------------------------------------------------------------------- NGINX master process died (%v): %v diff --git a/internal/ingress/controller/status.go b/internal/ingress/controller/status.go index 3b0a41ab8..e061b2cb7 100644 --- a/internal/ingress/controller/status.go +++ b/internal/ingress/controller/status.go @@ -50,7 +50,7 @@ func setupLeaderElection(config *leaderElectionConfig) { var cancelContext context.CancelFunc - var newLeaderCtx = func(ctx context.Context) context.CancelFunc { + newLeaderCtx := func(ctx context.Context) context.CancelFunc { // allow to cancel the context in case we stop being the leader leaderCtx, cancel := context.WithCancel(ctx) go elector.Run(leaderCtx) @@ -86,8 +86,10 @@ func setupLeaderElection(config *leaderElectionConfig) { } broadcaster := record.NewBroadcaster() - hostname, _ := os.Hostname() - + hostname, err := os.Hostname() + if err != nil { + klog.Errorf("unexpected error getting hostname: %v", err) + } recorder := broadcaster.NewRecorder(scheme.Scheme, apiv1.EventSource{ Component: "ingress-leader-elector", Host: hostname, @@ -107,7 +109,7 @@ func setupLeaderElection(config *leaderElectionConfig) { ttl := 30 * time.Second - elector, err := leaderelection.NewLeaderElector(leaderelection.LeaderElectionConfig{ + elector, err = leaderelection.NewLeaderElector(leaderelection.LeaderElectionConfig{ Lock: lock, LeaseDuration: ttl, RenewDeadline: ttl / 2, diff --git a/internal/ingress/controller/store/backend_ssl.go b/internal/ingress/controller/store/backend_ssl.go index 6f0fcf189..81b508cd2 100644 --- a/internal/ingress/controller/store/backend_ssl.go +++ b/internal/ingress/controller/store/backend_ssl.go @@ -88,10 +88,11 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error auth := secret.Data["auth"] // namespace/secretName -> namespace-secretName - nsSecName := strings.Replace(secretName, "/", "-", -1) + nsSecName := strings.ReplaceAll(secretName, "/", "-") var sslCert *ingress.SSLCert - if okcert && okkey { + switch { + case okcert && okkey: if cert == nil { return nil, fmt.Errorf("key 'tls.crt' missing from Secret %q", secretName) } @@ -144,7 +145,7 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error } klog.V(3).InfoS(msg) - } else if len(ca) > 0 { + case len(ca) > 0: sslCert, err = ssl.CreateCACert(ca) if err != nil { return nil, fmt.Errorf("unexpected error creating SSL Cert: %v", err) @@ -166,7 +167,7 @@ func (s *k8sStore) getPemCertificate(secretName string) (*ingress.SSLCert, error // makes this secret in 'syncSecret' to be used for Certificate Authentication // this does not enable Certificate Authentication klog.V(3).InfoS("Configuring Secret for TLS authentication", "secret", secretName) - } else { + default: if auth != nil { return nil, ErrSecretForAuth } diff --git a/internal/ingress/controller/store/endpointslice.go b/internal/ingress/controller/store/endpointslice.go index 78d088695..61bc63ae7 100644 --- a/internal/ingress/controller/store/endpointslice.go +++ b/internal/ingress/controller/store/endpointslice.go @@ -38,7 +38,7 @@ func (s *EndpointSliceLister) MatchByKey(key string) ([]*discoveryv1.EndpointSli keyNsLen = 0 } else { // count '/' char - keyNsLen += 1 + keyNsLen++ } // filter endpointSlices owned by svc for _, listKey := range s.ListKeys() { diff --git a/internal/ingress/controller/store/endpointslice_test.go b/internal/ingress/controller/store/endpointslice_test.go index 1342575ae..5d423a3a6 100644 --- a/internal/ingress/controller/store/endpointslice_test.go +++ b/internal/ingress/controller/store/endpointslice_test.go @@ -87,7 +87,6 @@ func TestEndpointSliceLister(t *testing.T) { t.Errorf("unexpected error %v", err) } eps, err := el.MatchByKey(key) - if err != nil { t.Errorf("unexpeted error %v", err) } diff --git a/internal/ingress/controller/store/store.go b/internal/ingress/controller/store/store.go index c11e35d76..918dfd41a 100644 --- a/internal/ingress/controller/store/store.go +++ b/internal/ingress/controller/store/store.go @@ -105,7 +105,7 @@ type Storer interface { Run(stopCh chan struct{}) // GetIngressClass validates given ingress against ingress class configuration and returns the ingress class. - GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) + GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.Configuration) (string, error) } // EventType type of event associated with an informer @@ -242,7 +242,9 @@ type k8sStore struct { defaultSSLCertificate string } -// New creates a new object store to be used in the ingress controller +// New creates a new object store to be used in the ingress controller. +// +//nolint:gocyclo // Ignore function complexity error. func New( namespace string, namespaceSelector labels.Selector, @@ -252,9 +254,9 @@ func New( updateCh *channels.RingChannel, disableCatchAll bool, deepInspector bool, - icConfig *ingressclass.IngressClassConfiguration, - disableSyncEvents bool) Storer { - + icConfig *ingressclass.Configuration, + disableSyncEvents bool, +) Storer { store := &k8sStore{ informers: &Informer{}, listers: &Lister{}, @@ -474,7 +476,8 @@ func New( _, errOld = store.GetIngressClass(oldIng, icConfig) classCur, errCur = store.GetIngressClass(curIng, icConfig) } - if errOld != nil && errCur == nil { + switch { + case errOld != nil && errCur == nil: if hasCatchAllIngressRule(curIng.Spec) && disableCatchAll { klog.InfoS("ignoring update for catch-all ingress because of --disable-catch-all", "ingress", klog.KObj(curIng)) return @@ -482,11 +485,11 @@ func New( klog.InfoS("creating ingress", "ingress", klog.KObj(curIng), "ingressclass", classCur) recorder.Eventf(curIng, corev1.EventTypeNormal, "Sync", "Scheduled for sync") - } else if errOld == nil && errCur != nil { + case errOld == nil && errCur != nil: klog.InfoS("removing ingress because of unknown ingressclass", "ingress", klog.KObj(curIng)) ingDeleteHandler(old) return - } else if errCur == nil && !reflect.DeepEqual(old, cur) { + case errCur == nil && !reflect.DeepEqual(old, cur): if hasCatchAllIngressRule(curIng.Spec) && disableCatchAll { klog.InfoS("ignoring update for catch-all ingress and delete old one because of --disable-catch-all", "ingress", klog.KObj(curIng)) ingDeleteHandler(old) @@ -494,7 +497,7 @@ func New( } recorder.Eventf(curIng, corev1.EventTypeNormal, "Sync", "Scheduled for sync") - } else { + default: klog.V(3).InfoS("No changes on ingress. Skipping update", "ingress", klog.KObj(curIng)) return } @@ -519,7 +522,10 @@ func New( ingressClassEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - ingressclass := obj.(*networkingv1.IngressClass) + ingressclass, ok := obj.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } foundClassByName := false if icConfig.IngressClassByName && ingressclass.Name == icConfig.AnnotationValue { klog.InfoS("adding ingressclass as ingress-class-by-name is configured", "ingressclass", klog.KObj(ingressclass)) @@ -541,7 +547,10 @@ func New( } }, DeleteFunc: func(obj interface{}) { - ingressclass := obj.(*networkingv1.IngressClass) + ingressclass, ok := obj.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if ingressclass.Spec.Controller != icConfig.Controller { klog.InfoS("ignoring ingressclass as the spec.controller is not the same of this ingress", "ingressclass", klog.KObj(ingressclass)) return @@ -557,8 +566,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oic := old.(*networkingv1.IngressClass) - cic := cur.(*networkingv1.IngressClass) + oic, ok := old.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + cic, ok := cur.(*networkingv1.IngressClass) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if cic.Spec.Controller != icConfig.Controller { klog.InfoS("ignoring ingressclass as the spec.controller is not the same of this ingress", "ingressclass", klog.KObj(cic)) return @@ -581,7 +596,10 @@ func New( secrEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - sec := obj.(*corev1.Secret) + sec, ok := obj.(*corev1.Secret) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } key := k8s.MetaNamespaceKey(sec) if store.defaultSSLCertificate == key { @@ -608,7 +626,10 @@ func New( }, UpdateFunc: func(old, cur interface{}) { if !reflect.DeepEqual(old, cur) { - sec := cur.(*corev1.Secret) + sec, ok := cur.(*corev1.Secret) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } key := k8s.MetaNamespaceKey(sec) if !watchedNamespace(sec.Namespace) { @@ -695,8 +716,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oeps := old.(*discoveryv1.EndpointSlice) - ceps := cur.(*discoveryv1.EndpointSlice) + oeps, ok := old.(*discoveryv1.EndpointSlice) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + ceps, ok := cur.(*discoveryv1.EndpointSlice) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if !reflect.DeepEqual(ceps.Endpoints, oeps.Endpoints) { updateCh.In() <- Event{ Type: UpdateEvent, @@ -750,7 +777,10 @@ func New( cmEventHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - cfgMap := obj.(*corev1.ConfigMap) + cfgMap, ok := obj.(*corev1.ConfigMap) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } key := k8s.MetaNamespaceKey(cfgMap) handleCfgMapEvent(key, cfgMap, "CREATE") }, @@ -759,7 +789,10 @@ func New( return } - cfgMap := cur.(*corev1.ConfigMap) + cfgMap, ok := cur.(*corev1.ConfigMap) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } key := k8s.MetaNamespaceKey(cfgMap) handleCfgMapEvent(key, cfgMap, "UPDATE") }, @@ -767,7 +800,10 @@ func New( serviceHandler := cache.ResourceEventHandlerFuncs{ AddFunc: func(obj interface{}) { - svc := obj.(*corev1.Service) + svc, ok := obj.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if svc.Spec.Type == corev1.ServiceTypeExternalName { updateCh.In() <- Event{ Type: CreateEvent, @@ -776,7 +812,10 @@ func New( } }, DeleteFunc: func(obj interface{}) { - svc := obj.(*corev1.Service) + svc, ok := obj.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", obj) + } if svc.Spec.Type == corev1.ServiceTypeExternalName { updateCh.In() <- Event{ Type: DeleteEvent, @@ -785,8 +824,14 @@ func New( } }, UpdateFunc: func(old, cur interface{}) { - oldSvc := old.(*corev1.Service) - curSvc := cur.(*corev1.Service) + oldSvc, ok := old.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", old) + } + curSvc, ok := cur.(*corev1.Service) + if !ok { + klog.Errorf("unexpected type: %T", cur) + } if reflect.DeepEqual(oldSvc, curSvc) { return @@ -821,7 +866,10 @@ func New( } // do not wait for informers to read the configmap configuration - ns, name, _ := k8s.ParseNameNS(configmap) + ns, name, err := k8s.ParseNameNS(configmap) + if err != nil { + klog.Errorf("unexpected error parsing name and ns: %v", err) + } cm, err := client.CoreV1().ConfigMaps(ns).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { klog.Warningf("Unexpected error reading configuration configmap: %v", err) @@ -837,10 +885,10 @@ func hasCatchAllIngressRule(spec networkingv1.IngressSpec) bool { return spec.DefaultBackend != nil } -func checkBadAnnotationValue(annotations map[string]string, badwords string) error { +func checkBadAnnotationValue(annotationMap map[string]string, badwords string) error { arraybadWords := strings.Split(strings.TrimSpace(badwords), ",") - for annotation, value := range annotations { + for annotation, value := range annotationMap { if strings.HasPrefix(annotation, fmt.Sprintf("%s/", parser.AnnotationsPrefix)) { for _, forbiddenvalue := range arraybadWords { if strings.Contains(value, forbiddenvalue) { @@ -999,7 +1047,7 @@ func (s *k8sStore) GetService(key string) (*corev1.Service, error) { return s.listers.Service.ByKey(key) } -func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.IngressClassConfiguration) (string, error) { +func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressclass.Configuration) (string, error) { // First we try ingressClassName if !icConfig.IgnoreIngressClass && ing.Spec.IngressClassName != nil { iclass, err := s.listers.IngressClass.ByKey(*ing.Spec.IngressClassName) @@ -1010,11 +1058,11 @@ func (s *k8sStore) GetIngressClass(ing *networkingv1.Ingress, icConfig *ingressc } // Then we try annotation - if ingressclass, ok := ing.GetAnnotations()[ingressclass.IngressKey]; ok { - if ingressclass != icConfig.AnnotationValue { + if class, ok := ing.GetAnnotations()[ingressclass.IngressKey]; ok { + if class != icConfig.AnnotationValue { return "", fmt.Errorf("ingress class annotation is not equal to the expected by Ingress Controller") } - return ingressclass, nil + return class, nil } // Then we accept if the WithoutClass is enabled @@ -1055,7 +1103,10 @@ func (s *k8sStore) ListIngresses() []*ingress.Ingress { // filter ingress rules ingresses := make([]*ingress.Ingress, 0) for _, item := range s.listers.IngressWithAnnotation.List() { - ing := item.(*ingress.Ingress) + ing, ok := item.(*ingress.Ingress) + if !ok { + klog.Errorf("unexpected type: %T", item) + } ingresses = append(ingresses, ing) } diff --git a/internal/ingress/controller/store/store_test.go b/internal/ingress/controller/store/store_test.go index 774a45676..317c0f36c 100644 --- a/internal/ingress/controller/store/store_test.go +++ b/internal/ingress/controller/store/store_test.go @@ -44,29 +44,27 @@ import ( var pathPrefix networking.PathType = networking.PathTypePrefix -var DefaultClassConfig = &ingressclass.IngressClassConfiguration{ +var DefaultClassConfig = &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ingressclass.DefaultAnnotationValue, WatchWithoutClass: false, } -var ( - commonIngressSpec = networking.IngressSpec{ - Rules: []networking.IngressRule{ - { - Host: "dummy", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/", - PathType: &pathPrefix, - Backend: networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "http-svc", - Port: networking.ServiceBackendPort{ - Number: 80, - }, +var commonIngressSpec = networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + Host: "dummy", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/", + PathType: &pathPrefix, + Backend: networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: "http-svc", + Port: networking.ServiceBackendPort{ + Number: 80, }, }, }, @@ -75,12 +73,15 @@ var ( }, }, }, - } -) + }, +} +const updateDummyHost = "update-dummy" + +//nolint:gocyclo // Ignore function complexity error func TestStore(t *testing.T) { - //TODO: move env definition to docker image? - os.Setenv("KUBEBUILDER_ASSETS", "/usr/local/bin") + // TODO: move env definition to docker image? + t.Setenv("KUBEBUILDER_ASSETS", "/usr/local/bin") pathPrefix = networking.PathTypePrefix @@ -90,9 +91,12 @@ func TestStore(t *testing.T) { t.Fatalf("error: %v", err) } - emptySelector, _ := labels.Parse("") + emptySelector, err := labels.Parse("") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } - defer te.Stop() //nolint:errcheck + defer te.Stop() //nolint:errcheck // Ignore the error clientSet, err := kubernetes.NewForConfig(cfg) if err != nil { @@ -176,7 +180,11 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } + if e.Obj == nil { continue } @@ -230,7 +238,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) ni := ing.DeepCopy() - ni.Spec.Rules[0].Host = "update-dummy" + ni.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ni, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -281,7 +289,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -343,7 +354,7 @@ func TestStore(t *testing.T) { defer deleteIngress(invalidIngress, clientSet, t) ni := ing.DeepCopy() - ni.Spec.Rules[0].Host = "update-dummy" + ni.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ni, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -392,7 +403,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -411,7 +425,7 @@ func TestStore(t *testing.T) { } }(updateCh) - ingressClassconfig := &ingressclass.IngressClassConfiguration{ + ingressClassconfig := &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ingressclass.DefaultAnnotationValue, WatchWithoutClass: true, @@ -463,7 +477,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) validIngressUpdated := validIngress1.DeepCopy() - validIngressUpdated.Spec.Rules[0].Host = "update-dummy" + validIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(validIngressUpdated, clientSet, t) if err != nil { t.Errorf("error updating ingress: %v", err) @@ -523,7 +537,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -542,7 +559,7 @@ func TestStore(t *testing.T) { } }(updateCh) - ingressClassconfig := &ingressclass.IngressClassConfiguration{ + ingressClassconfig := &ingressclass.Configuration{ Controller: ingressclass.DefaultControllerName, AnnotationValue: ic, IngressClassByName: true, @@ -581,7 +598,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) ingressUpdated := ing.DeepCopy() - ingressUpdated.Spec.Rules[0].Host = "update-dummy" + ingressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(ingressUpdated, clientSet, t) if err != nil { t.Errorf("error updating ingress: %v", err) @@ -630,7 +647,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -684,7 +704,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) invalidIngressUpdated := invalidIngress.DeepCopy() - invalidIngressUpdated.Spec.Rules[0].Host = "update-dummy" + invalidIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(invalidIngressUpdated, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -725,7 +745,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -778,7 +801,7 @@ func TestStore(t *testing.T) { time.Sleep(1 * time.Second) invalidIngressUpdated := invalidIngress.DeepCopy() - invalidIngressUpdated.Spec.Rules[0].Host = "update-dummy" + invalidIngressUpdated.Spec.Rules[0].Host = updateDummyHost _ = ensureIngress(invalidIngressUpdated, clientSet, t) if err != nil { t.Errorf("error creating ingress: %v", err) @@ -816,7 +839,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -908,7 +934,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1008,7 +1037,6 @@ func TestStore(t *testing.T) { if atomic.LoadUint64(&del) != 1 { t.Errorf("expected 1 events of type Delete but %v occurred", del) } - }) t.Run("should create an ingress with a secret which does not exist", func(t *testing.T) { @@ -1032,7 +1060,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1159,7 +1190,10 @@ func TestStore(t *testing.T) { return } - e := evt.(Event) + e, ok := evt.(Event) + if !ok { + return + } if e.Obj == nil { continue } @@ -1174,7 +1208,10 @@ func TestStore(t *testing.T) { } }(updateCh) - namesapceSelector, _ := labels.Parse("foo=bar") + namesapceSelector, err := labels.Parse("foo=bar") + if err != nil { + t.Errorf("unexpected error: %v", err) + } storer := New( ns, namesapceSelector, @@ -1236,7 +1273,6 @@ func TestStore(t *testing.T) { if atomic.LoadUint64(&del) != 0 { t.Errorf("expected 0 events of type Delete but %v occurred", del) } - }) // test add ingress with secret it doesn't exists and then add secret // check secret is generated on fs @@ -1274,16 +1310,16 @@ func deleteNamespace(ns string, clientSet kubernetes.Interface, t *testing.T) { func createIngressClass(clientSet kubernetes.Interface, t *testing.T, controller string) string { t.Helper() - ingressclass := &networking.IngressClass{ + class := &networking.IngressClass{ ObjectMeta: metav1.ObjectMeta{ Name: fmt.Sprintf("ingress-nginx-%v", time.Now().Unix()), - //Namespace: "xpto" // TODO: We don't support namespaced ingress-class yet + // Namespace: "xpto" // TODO: We don't support namespaced ingress-class yet }, Spec: networking.IngressClassSpec{ Controller: controller, }, } - ic, err := clientSet.NetworkingV1().IngressClasses().Create(context.TODO(), ingressclass, metav1.CreateOptions{}) + ic, err := clientSet.NetworkingV1().IngressClasses().Create(context.TODO(), class, metav1.CreateOptions{}) if err != nil { t.Errorf("error creating ingress class: %v", err) } @@ -1299,7 +1335,7 @@ func deleteIngressClass(ic string, clientSet kubernetes.Interface, t *testing.T) } } -func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) string { +func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) { t.Helper() configMap := &v1.ConfigMap{ @@ -1308,51 +1344,47 @@ func createConfigMap(clientSet kubernetes.Interface, ns string, t *testing.T) st }, } - cm, err := clientSet.CoreV1().ConfigMaps(ns).Create(context.TODO(), configMap, metav1.CreateOptions{}) + _, err := clientSet.CoreV1().ConfigMaps(ns).Create(context.TODO(), configMap, metav1.CreateOptions{}) if err != nil { t.Errorf("error creating the configuration map: %v", err) } - - return cm.Name } -func ensureIngress(ingress *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) *networking.Ingress { +func ensureIngress(ing *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) *networking.Ingress { t.Helper() - ing, err := clientSet.NetworkingV1().Ingresses(ingress.Namespace).Update(context.TODO(), ingress, metav1.UpdateOptions{}) - + newIngress, err := clientSet.NetworkingV1().Ingresses(ing.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) if err != nil { if k8sErrors.IsNotFound(err) { - t.Logf("Ingress %v not found, creating", ingress) + t.Logf("Ingress %v not found, creating", ing) - ing, err = clientSet.NetworkingV1().Ingresses(ingress.Namespace).Create(context.TODO(), ingress, metav1.CreateOptions{}) + newIngress, err = clientSet.NetworkingV1().Ingresses(ing.Namespace).Create(context.TODO(), ing, metav1.CreateOptions{}) if err != nil { - t.Fatalf("error creating ingress %+v: %v", ingress, err) + t.Fatalf("error creating ingress %+v: %v", ing, err) } - t.Logf("Ingress %+v created", ingress) - return ing + t.Logf("Ingress %+v created", ing) + return newIngress } - t.Fatalf("error updating ingress %+v: %v", ingress, err) + t.Fatalf("error updating ingress %+v: %v", ing, err) } - return ing + return newIngress } -func deleteIngress(ingress *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) { +func deleteIngress(ing *networking.Ingress, clientSet kubernetes.Interface, t *testing.T) { t.Helper() - err := clientSet.NetworkingV1().Ingresses(ingress.Namespace).Delete(context.TODO(), ingress.Name, metav1.DeleteOptions{}) - + err := clientSet.NetworkingV1().Ingresses(ing.Namespace).Delete(context.TODO(), ing.Name, metav1.DeleteOptions{}) if err != nil { - t.Errorf("failed to delete ingress %+v: %v", ingress, err) + t.Errorf("failed to delete ingress %+v: %v", ing, err) } - t.Logf("Ingress %+v deleted", ingress) + t.Logf("Ingress %+v deleted", ing) } // newStore creates a new mock object store for tests which do not require the // use of Informers. -func newStore(t *testing.T) *k8sStore { +func newStore() *k8sStore { return &k8sStore{ listers: &Lister{ // add more listers if needed @@ -1369,7 +1401,7 @@ func newStore(t *testing.T) *k8sStore { } func TestUpdateSecretIngressMap(t *testing.T) { - s := newStore(t) + s := newStore() ingTpl := &networking.Ingress{ ObjectMeta: metav1.ObjectMeta{ @@ -1431,7 +1463,9 @@ func TestUpdateSecretIngressMap(t *testing.T) { ing.ObjectMeta.SetAnnotations(map[string]string{ parser.GetAnnotationWithPrefix("auth-secret"): "anotherns/auth", }) - s.listers.Ingress.Update(ing) + if err := s.listers.Ingress.Update(ing); err != nil { + t.Errorf("error updating the Ingress: %v", err) + } s.updateSecretIngressMap(ing) if l := s.secretIngressMap.Len(); l != 0 { @@ -1456,7 +1490,7 @@ func TestUpdateSecretIngressMap(t *testing.T) { } func TestListIngresses(t *testing.T) { - s := newStore(t) + s := newStore() invalidIngressClass := "something" validIngressClass := ingressclass.DefaultControllerName @@ -1586,7 +1620,7 @@ func TestWriteSSLSessionTicketKey(t *testing.T) { } for _, test := range tests { - s := newStore(t) + s := newStore() cmap := &v1.ConfigMap{ Data: map[string]string{ diff --git a/internal/ingress/controller/template/configmap.go b/internal/ingress/controller/template/configmap.go index c73f3b6c0..9dc019bcc 100644 --- a/internal/ingress/controller/template/configmap.go +++ b/internal/ingress/controller/template/configmap.go @@ -91,6 +91,8 @@ const ( ) // ReadConfig obtains the configuration defined by the user merged with the defaults. +// +//nolint:gocyclo // Ignore function complexity error func ReadConfig(src map[string]string) config.Configuration { conf := map[string]string{} // we need to copy the configmap data because the content is altered @@ -116,12 +118,12 @@ func ReadConfig(src map[string]string) config.Configuration { luaSharedDicts := make(map[string]int) debugConnectionsList := make([]string, 0) - //parse lua shared dict values + // parse lua shared dict values if val, ok := conf[luaSharedDictsKey]; ok { delete(conf, luaSharedDictsKey) lsd := splitAndTrimSpace(val, ",") for _, v := range lsd { - v = strings.Replace(v, " ", "", -1) + v = strings.ReplaceAll(v, " ", "") results := strings.SplitN(v, ":", 2) dictName := results[0] size := dictStrToKb(results[1]) @@ -196,7 +198,7 @@ func ReadConfig(src map[string]string) config.Configuration { if ing_net.IsIPV6(ns) { bindAddressIpv6List = append(bindAddressIpv6List, fmt.Sprintf("[%v]", ns)) } else { - bindAddressIpv4List = append(bindAddressIpv4List, fmt.Sprintf("%v", ns)) + bindAddressIpv4List = append(bindAddressIpv4List, ns.String()) } } else { klog.Warningf("%v is not a valid textual representation of an IP address", i) @@ -250,7 +252,7 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthMethod]; ok { delete(conf, globalAuthMethod) - if len(val) != 0 && !authreq.ValidMethod(val) { + if val != "" && !authreq.ValidMethod(val) { klog.Warningf("Global auth location denied - %v.", "invalid HTTP method") } else { to.GlobalExternalAuth.Method = val @@ -261,7 +263,10 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthSignin]; ok { delete(conf, globalAuthSignin) - signinURL, _ := parser.StringToURL(val) + signinURL, err := parser.StringToURL(val) + if err != nil { + klog.Errorf("string to URL conversion failed: %v", err) + } if signinURL == nil { klog.Warningf("Global auth location denied - %v.", "global-auth-signin setting is undefined and will not be set") } else { @@ -274,7 +279,10 @@ func ReadConfig(src map[string]string) config.Configuration { delete(conf, globalAuthSigninRedirectParam) redirectParam := strings.TrimSpace(val) - dummySigninURL, _ := parser.StringToURL(fmt.Sprintf("%s?%s=dummy", to.GlobalExternalAuth.SigninURL, redirectParam)) + dummySigninURL, err := parser.StringToURL(fmt.Sprintf("%s?%s=dummy", to.GlobalExternalAuth.SigninURL, redirectParam)) + if err != nil { + klog.Errorf("string to URL conversion failed: %v", err) + } if dummySigninURL == nil { klog.Warningf("Global auth redirect parameter denied - %v.", "global-auth-signin-redirect-param setting is invalid and will not be set") } else { @@ -286,7 +294,7 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[globalAuthResponseHeaders]; ok { delete(conf, globalAuthResponseHeaders) - if len(val) != 0 { + if val != "" { harr := splitAndTrimSpace(val, ",") for _, header := range harr { if !authreq.ValidHeader(header) { @@ -385,8 +393,8 @@ func ReadConfig(src map[string]string) config.Configuration { if val, ok := conf[debugConnections]; ok { delete(conf, debugConnections) for _, i := range splitAndTrimSpace(val, ",") { - validIp := net.ParseIP(i) - if validIp != nil { + validIP := net.ParseIP(i) + if validIP != nil { debugConnectionsList = append(debugConnectionsList, i) } else { _, _, err := net.ParseCIDR(i) @@ -415,14 +423,14 @@ func ReadConfig(src map[string]string) config.Configuration { to.DisableIpv6DNS = !ing_net.IsIPv6Enabled() to.LuaSharedDicts = luaSharedDicts - config := &mapstructure.DecoderConfig{ + decoderConfig := &mapstructure.DecoderConfig{ Metadata: nil, WeaklyTypedInput: true, Result: &to, TagName: "json", } - decoder, err := mapstructure.NewDecoder(config) + decoder, err := mapstructure.NewDecoder(decoderConfig) if err != nil { klog.Warningf("unexpected error merging defaults: %v", err) } @@ -456,6 +464,7 @@ func filterErrors(codes []int) []int { return fa } +//nolint:unparam // Ignore `sep` always receives `,` error func splitAndTrimSpace(s, sep string) []string { f := func(c rune) bool { return strings.EqualFold(string(c), sep) @@ -474,8 +483,11 @@ func dictStrToKb(sizeStr string) int { if sizeMatch == nil { return -1 } - size, _ := strconv.Atoi(sizeMatch[1]) // validated already with regex - if sizeMatch[2] == "" || strings.ToLower(sizeMatch[2]) == "m" { + size, err := strconv.Atoi(sizeMatch[1]) // validated already with regex + if err != nil { + klog.Errorf("unexpected error converting size string %s to int: %v", sizeStr, err) + } + if sizeMatch[2] == "" || strings.EqualFold(sizeMatch[2], "m") { size *= 1024 } return size diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 147455771..4e51ac665 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -52,6 +52,12 @@ const ( nonIdempotent = "non_idempotent" defBufferSize = 65535 writeIndentOnEmptyLines = true // backward-compatibility + httpProtocol = "HTTP" + autoHTTPProtocol = "AUTO_HTTP" + httpsProtocol = "HTTPS" + grpcProtocol = "GRPC" + grpcsProtocol = "GRPCS" + fcgiProtocol = "FCGI" ) const ( @@ -64,13 +70,13 @@ type Writer interface { // Write renders the template. // NOTE: Implementors must ensure that the content of the returned slice is not modified by the implementation // after the return of this function. - Write(conf config.TemplateConfig) ([]byte, error) + Write(conf *config.TemplateConfig) ([]byte, error) } -// Template ... +// Template ingress template type Template struct { tmpl *text_template.Template - //fw watch.FileWatcher + bp *BufferPool } @@ -97,7 +103,7 @@ func NewTemplate(file string) (*Template, error) { // 2. Collapses multiple empty lines to single one // 3. Re-indent // (ATW: always returns nil) -func cleanConf(in *bytes.Buffer, out *bytes.Buffer) error { +func cleanConf(in, out *bytes.Buffer) error { depth := 0 lineStarted := false emptyLineWritten := false @@ -176,7 +182,7 @@ func cleanConf(in *bytes.Buffer, out *bytes.Buffer) error { // Write populates a buffer using a template with NGINX configuration // and the servers and upstreams created by Ingress rules -func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { +func (t *Template) Write(conf *config.TemplateConfig) ([]byte, error) { tmplBuf := t.bp.Get() defer t.bp.Put(tmplBuf) @@ -184,14 +190,14 @@ func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { defer t.bp.Put(outCmdBuf) if klog.V(3).Enabled() { - b, err := json.Marshal(conf) + b, err := json.Marshal(*conf) if err != nil { klog.Errorf("unexpected error: %v", err) } klog.InfoS("NGINX", "configuration", string(b)) } - err := t.tmpl.Execute(tmplBuf, conf) + err := t.tmpl.Execute(tmplBuf, *conf) if err != nil { return nil, err } @@ -211,78 +217,76 @@ func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) { return res, nil } -var ( - funcMap = text_template.FuncMap{ - "empty": func(input interface{}) bool { - check, ok := input.(string) - if ok { - return len(check) == 0 - } - return true - }, - "escapeLiteralDollar": escapeLiteralDollar, - "buildLuaSharedDictionaries": buildLuaSharedDictionaries, - "luaConfigurationRequestBodySize": luaConfigurationRequestBodySize, - "buildLocation": buildLocation, - "buildAuthLocation": buildAuthLocation, - "shouldApplyGlobalAuth": shouldApplyGlobalAuth, - "buildAuthResponseHeaders": buildAuthResponseHeaders, - "buildAuthUpstreamLuaHeaders": buildAuthUpstreamLuaHeaders, - "buildAuthProxySetHeaders": buildAuthProxySetHeaders, - "buildAuthUpstreamName": buildAuthUpstreamName, - "shouldApplyAuthUpstream": shouldApplyAuthUpstream, - "extractHostPort": extractHostPort, - "changeHostPort": changeHostPort, - "buildProxyPass": buildProxyPass, - "filterRateLimits": filterRateLimits, - "buildRateLimitZones": buildRateLimitZones, - "buildRateLimit": buildRateLimit, - "configForLua": configForLua, - "locationConfigForLua": locationConfigForLua, - "buildResolvers": buildResolvers, - "buildUpstreamName": buildUpstreamName, - "isLocationInLocationList": isLocationInLocationList, - "isLocationAllowed": isLocationAllowed, - "buildDenyVariable": buildDenyVariable, - "getenv": os.Getenv, - "contains": strings.Contains, - "split": strings.Split, - "hasPrefix": strings.HasPrefix, - "hasSuffix": strings.HasSuffix, - "trimSpace": strings.TrimSpace, - "toUpper": strings.ToUpper, - "toLower": strings.ToLower, - "formatIP": formatIP, - "quote": quote, - "buildNextUpstream": buildNextUpstream, - "getIngressInformation": getIngressInformation, - "serverConfig": func(all config.TemplateConfig, server *ingress.Server) interface{} { - return struct{ First, Second interface{} }{all, server} - }, - "isValidByteSize": isValidByteSize, - "buildForwardedFor": buildForwardedFor, - "buildAuthSignURL": buildAuthSignURL, - "buildAuthSignURLLocation": buildAuthSignURLLocation, - "buildOpentracing": buildOpentracing, - "buildOpentelemetry": buildOpentelemetry, - "proxySetHeader": proxySetHeader, - "enforceRegexModifier": enforceRegexModifier, - "buildCustomErrorDeps": buildCustomErrorDeps, - "buildCustomErrorLocationsPerServer": buildCustomErrorLocationsPerServer, - "shouldLoadModSecurityModule": shouldLoadModSecurityModule, - "buildHTTPListener": buildHTTPListener, - "buildHTTPSListener": buildHTTPSListener, - "buildOpentracingForLocation": buildOpentracingForLocation, - "buildOpentelemetryForLocation": buildOpentelemetryForLocation, - "shouldLoadOpentracingModule": shouldLoadOpentracingModule, - "shouldLoadOpentelemetryModule": shouldLoadOpentelemetryModule, - "buildModSecurityForLocation": buildModSecurityForLocation, - "buildMirrorLocations": buildMirrorLocations, - "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, - "buildServerName": buildServerName, - "buildCorsOriginRegex": buildCorsOriginRegex, - } -) +var funcMap = text_template.FuncMap{ + "empty": func(input interface{}) bool { + check, ok := input.(string) + if ok { + return check == "" + } + return true + }, + "escapeLiteralDollar": escapeLiteralDollar, + "buildLuaSharedDictionaries": buildLuaSharedDictionaries, + "luaConfigurationRequestBodySize": luaConfigurationRequestBodySize, + "buildLocation": buildLocation, + "buildAuthLocation": buildAuthLocation, + "shouldApplyGlobalAuth": shouldApplyGlobalAuth, + "buildAuthResponseHeaders": buildAuthResponseHeaders, + "buildAuthUpstreamLuaHeaders": buildAuthUpstreamLuaHeaders, + "buildAuthProxySetHeaders": buildAuthProxySetHeaders, + "buildAuthUpstreamName": buildAuthUpstreamName, + "shouldApplyAuthUpstream": shouldApplyAuthUpstream, + "extractHostPort": extractHostPort, + "changeHostPort": changeHostPort, + "buildProxyPass": buildProxyPass, + "filterRateLimits": filterRateLimits, + "buildRateLimitZones": buildRateLimitZones, + "buildRateLimit": buildRateLimit, + "configForLua": configForLua, + "locationConfigForLua": locationConfigForLua, + "buildResolvers": buildResolvers, + "buildUpstreamName": buildUpstreamName, + "isLocationInLocationList": isLocationInLocationList, + "isLocationAllowed": isLocationAllowed, + "buildDenyVariable": buildDenyVariable, + "getenv": os.Getenv, + "contains": strings.Contains, + "split": strings.Split, + "hasPrefix": strings.HasPrefix, + "hasSuffix": strings.HasSuffix, + "trimSpace": strings.TrimSpace, + "toUpper": strings.ToUpper, + "toLower": strings.ToLower, + "formatIP": formatIP, + "quote": quote, + "buildNextUpstream": buildNextUpstream, + "getIngressInformation": getIngressInformation, + "serverConfig": func(all config.TemplateConfig, server *ingress.Server) interface{} { + return struct{ First, Second interface{} }{all, server} + }, + "isValidByteSize": isValidByteSize, + "buildForwardedFor": buildForwardedFor, + "buildAuthSignURL": buildAuthSignURL, + "buildAuthSignURLLocation": buildAuthSignURLLocation, + "buildOpentracing": buildOpentracing, + "buildOpentelemetry": buildOpentelemetry, + "proxySetHeader": proxySetHeader, + "enforceRegexModifier": enforceRegexModifier, + "buildCustomErrorDeps": buildCustomErrorDeps, + "buildCustomErrorLocationsPerServer": buildCustomErrorLocationsPerServer, + "shouldLoadModSecurityModule": shouldLoadModSecurityModule, + "buildHTTPListener": buildHTTPListener, + "buildHTTPSListener": buildHTTPSListener, + "buildOpentracingForLocation": buildOpentracingForLocation, + "buildOpentelemetryForLocation": buildOpentelemetryForLocation, + "shouldLoadOpentracingModule": shouldLoadOpentracingModule, + "shouldLoadOpentelemetryModule": shouldLoadOpentelemetryModule, + "buildModSecurityForLocation": buildModSecurityForLocation, + "buildMirrorLocations": buildMirrorLocations, + "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, + "buildServerName": buildServerName, + "buildCorsOriginRegex": buildCorsOriginRegex, +} // escapeLiteralDollar will replace the $ character with ${literal_dollar} // which is made to work via the following configuration in the http section of @@ -296,7 +300,7 @@ func escapeLiteralDollar(input interface{}) string { if !ok { return "" } - return strings.Replace(inputStr, `$`, `${literal_dollar}`, -1) + return strings.ReplaceAll(inputStr, `$`, `${literal_dollar}`) } // formatIP will wrap IPv6 addresses in [] and return IPv4 addresses @@ -328,9 +332,7 @@ func quote(input interface{}) string { return fmt.Sprintf("%q", inputStr) } -func buildLuaSharedDictionaries(c interface{}, s interface{}) string { - var out []string - +func buildLuaSharedDictionaries(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -343,6 +345,7 @@ func buildLuaSharedDictionaries(c interface{}, s interface{}) string { return "" } + out := make([]string, 0, len(cfg.LuaSharedDicts)) for name, size := range cfg.LuaSharedDicts { sizeStr := dictKbToStr(size) out = append(out, fmt.Sprintf("lua_shared_dict %s %s", name, sizeStr)) @@ -364,7 +367,7 @@ func luaConfigurationRequestBodySize(c interface{}) string { if size < cfg.LuaSharedDicts["certificate_data"] { size = cfg.LuaSharedDicts["certificate_data"] } - size = size + 1024 + size += 1024 return dictKbToStr(size) } @@ -418,7 +421,7 @@ func configForLua(input interface{}) string { } // locationConfigForLua formats some location specific configuration into Lua table represented as string -func locationConfigForLua(l interface{}, a interface{}) string { +func locationConfigForLua(l, a interface{}) string { location, ok := l.(*ingress.Location) if !ok { klog.Errorf("expected an '*ingress.Location' type but %T was given", l) @@ -459,7 +462,7 @@ func locationConfigForLua(l interface{}, a interface{}) string { } // buildResolvers returns the resolvers reading the /etc/resolv.conf file -func buildResolvers(res interface{}, disableIpv6 interface{}) string { +func buildResolvers(res, disableIpv6 interface{}) string { // NGINX need IPV6 addresses to be surrounded by brackets nss, ok := res.([]net.IP) if !ok { @@ -484,7 +487,7 @@ func buildResolvers(res interface{}, disableIpv6 interface{}) string { } r = append(r, fmt.Sprintf("[%v]", ns)) } else { - r = append(r, fmt.Sprintf("%v", ns)) + r = append(r, ns.String()) } } r = append(r, "valid=30s") @@ -554,7 +557,7 @@ func buildAuthLocation(input interface{}, globalExternalAuthURL string) string { str := base64.URLEncoding.EncodeToString([]byte(location.Path)) // removes "=" after encoding - str = strings.Replace(str, "=", "", -1) + str = strings.ReplaceAll(str, "=", "") pathType := "default" if location.PathType != nil { @@ -644,7 +647,7 @@ func buildAuthUpstreamName(input interface{}, host string) string { // shouldApplyAuthUpstream returns true only in case when ExternalAuth.URL and // ExternalAuth.KeepaliveConnections are all set -func shouldApplyAuthUpstream(l interface{}, c interface{}) bool { +func shouldApplyAuthUpstream(l, c interface{}) bool { location, ok := l.(*ingress.Location) if !ok { klog.Errorf("expected an '*ingress.Location' type but %T was returned", l) @@ -672,14 +675,14 @@ func shouldApplyAuthUpstream(l interface{}, c interface{}) bool { } // extractHostPort will extract the host:port part from the URL specified by url -func extractHostPort(url string) string { - if url == "" { +func extractHostPort(newURL string) string { + if newURL == "" { return "" } - authURL, err := parser.StringToURL(url) + authURL, err := parser.StringToURL(newURL) if err != nil { - klog.Errorf("expected a valid URL but %s was returned", url) + klog.Errorf("expected a valid URL but %s was returned", newURL) return "" } @@ -687,14 +690,14 @@ func extractHostPort(url string) string { } // changeHostPort will change the host:port part of the url to value -func changeHostPort(url string, value string) string { - if url == "" { +func changeHostPort(newURL, value string) string { + if newURL == "" { return "" } - authURL, err := parser.StringToURL(url) + authURL, err := parser.StringToURL(newURL) if err != nil { - klog.Errorf("expected a valid URL but %s was returned", url) + klog.Errorf("expected a valid URL but %s was returned", newURL) return "" } @@ -707,7 +710,7 @@ func changeHostPort(url string, value string) string { // (specified through the nginx.ingress.kubernetes.io/rewrite-target annotation) // If the annotation nginx.ingress.kubernetes.io/add-base-url:"true" is specified it will // add a base tag in the head of the response from the service -func buildProxyPass(host string, b interface{}, loc interface{}) string { +func buildProxyPass(_ string, b, loc interface{}) string { backends, ok := b.([]*ingress.Backend) if !ok { klog.Errorf("expected an '[]*ingress.Backend' type but %T was returned", b) @@ -726,17 +729,17 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { proxyPass := "proxy_pass" switch location.BackendProtocol { - case "AUTO_HTTP": + case autoHTTPProtocol: proto = "$scheme://" - case "HTTPS": + case httpsProtocol: proto = "https://" - case "GRPC": + case grpcProtocol: proto = "grpc://" proxyPass = "grpc_pass" - case "GRPCS": + case grpcsProtocol: proto = "grpcs://" proxyPass = "grpc_pass" - case "FCGI": + case fcgiProtocol: proto = "" proxyPass = "fastcgi_pass" } @@ -748,7 +751,7 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { if backend.SSLPassthrough { proto = "https://" - if location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcsProtocol { proto = "grpcs://" } } @@ -775,7 +778,7 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string { var xForwardedPrefix string if len(location.XForwardedPrefix) > 0 { - xForwardedPrefix = fmt.Sprintf("%s X-Forwarded-Prefix \"%s\";\n", proxySetHeader(location), location.XForwardedPrefix) + xForwardedPrefix = fmt.Sprintf("%s X-Forwarded-Prefix %q;\n", proxySetHeader(location), location.XForwardedPrefix) } return fmt.Sprintf(` @@ -935,9 +938,7 @@ func isLocationAllowed(input interface{}) bool { return loc.Denied == nil } -var ( - denyPathSlugMap = map[string]string{} -) +var denyPathSlugMap = map[string]string{} // buildDenyVariable returns a nginx variable for a location in a // server to be used in the whitelist check @@ -977,7 +978,11 @@ func buildNextUpstream(i, r interface{}) string { return "" } - retryNonIdempotent := r.(bool) + retryNonIdempotent, ok := r.(bool) + if !ok { + klog.Errorf("expected a 'bool' type but %T was returned", i) + return "" + } parts := strings.Split(nextUpstream, " ") @@ -1002,8 +1007,10 @@ func buildNextUpstream(i, r interface{}) string { // refer to http://nginx.org/en/docs/syntax.html // Nginx differentiates between size and offset // offset directives support gigabytes in addition -var nginxSizeRegex = regexp.MustCompile("^[0-9]+[kKmM]{0,1}$") -var nginxOffsetRegex = regexp.MustCompile("^[0-9]+[kKmMgG]{0,1}$") +var ( + nginxSizeRegex = regexp.MustCompile(`^\d+[kKmM]?$`) + nginxOffsetRegex = regexp.MustCompile(`^\d+[kKmMgG]?$`) +) // isValidByteSize validates size units valid in nginx // http://nginx.org/en/docs/syntax.html @@ -1153,13 +1160,17 @@ func buildForwardedFor(input interface{}) string { return "" } - ffh := strings.Replace(s, "-", "_", -1) + ffh := strings.ReplaceAll(s, "-", "_") ffh = strings.ToLower(ffh) return fmt.Sprintf("$http_%v", ffh) } func buildAuthSignURL(authSignURL, authRedirectParam string) string { - u, _ := url.Parse(authSignURL) + u, err := url.Parse(authSignURL) + if err != nil { + klog.Errorf("error parsing authSignURL: %v", err) + return "" + } q := u.Query() if authRedirectParam == "" { authRedirectParam = defaultGlobalAuthRedirectParam @@ -1198,7 +1209,7 @@ func randomString() string { return string(b) } -func buildOpentracing(c interface{}, s interface{}) string { +func buildOpentracing(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1217,6 +1228,7 @@ func buildOpentracing(c interface{}, s interface{}) string { buf := bytes.NewBufferString("") + //nolint:gocritic // rewriting if-else to switch statement is not more readable if cfg.DatadogCollectorHost != "" { buf.WriteString("opentracing_load_tracer /usr/local/lib/libdd_opentracing.so /etc/nginx/opentracing.json;") } else if cfg.ZipkinCollectorHost != "" { @@ -1228,16 +1240,16 @@ func buildOpentracing(c interface{}, s interface{}) string { buf.WriteString("\r\n") if cfg.OpentracingOperationName != "" { - buf.WriteString(fmt.Sprintf("opentracing_operation_name \"%s\";\n", cfg.OpentracingOperationName)) + fmt.Fprintf(buf, "opentracing_operation_name \"%s\";\n", cfg.OpentracingOperationName) } if cfg.OpentracingLocationOperationName != "" { - buf.WriteString(fmt.Sprintf("opentracing_location_operation_name \"%s\";\n", cfg.OpentracingLocationOperationName)) + fmt.Fprintf(buf, "opentracing_location_operation_name \"%s\";\n", cfg.OpentracingLocationOperationName) } return buf.String() } -func buildOpentelemetry(c interface{}, s interface{}) string { +func buildOpentelemetry(c, s interface{}) string { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1259,7 +1271,7 @@ func buildOpentelemetry(c interface{}, s interface{}) string { buf.WriteString("\r\n") if cfg.OpentelemetryOperationName != "" { - buf.WriteString(fmt.Sprintf("opentelemetry_operation_name \"%s\";\n", cfg.OpentelemetryOperationName)) + fmt.Fprintf(buf, "opentelemetry_operation_name \"%s\";\n", cfg.OpentelemetryOperationName) } return buf.String() } @@ -1271,7 +1283,7 @@ func proxySetHeader(loc interface{}) string { return "proxy_set_header" } - if location.BackendProtocol == "GRPC" || location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcProtocol || location.BackendProtocol == grpcsProtocol { return "grpc_set_header" } @@ -1280,7 +1292,7 @@ func proxySetHeader(loc interface{}) string { // buildCustomErrorDeps is a utility function returning a struct wrapper with // the data required to build the 'CUSTOM_ERRORS' template -func buildCustomErrorDeps(upstreamName string, errorCodes []int, enableMetrics bool, modsecurityEnabled bool) interface{} { +func buildCustomErrorDeps(upstreamName string, errorCodes []int, enableMetrics, modsecurityEnabled bool) interface{} { return struct { UpstreamName string ErrorCodes []int @@ -1355,7 +1367,7 @@ func opentracingPropagateContext(location *ingress.Location) string { return "" } - if location.BackendProtocol == "GRPC" || location.BackendProtocol == "GRPCS" { + if location.BackendProtocol == grpcProtocol || location.BackendProtocol == grpcsProtocol { return "opentracing_grpc_propagate_context;" } @@ -1372,7 +1384,7 @@ func opentelemetryPropagateContext(location *ingress.Location) string { // shouldLoadModSecurityModule determines whether or not the ModSecurity module needs to be loaded. // First, it checks if `enable-modsecurity` is set in the ConfigMap. If it is not, it iterates over all locations to // check if ModSecurity is enabled by the annotation `nginx.ingress.kubernetes.io/enable-modsecurity`. -func shouldLoadModSecurityModule(c interface{}, s interface{}) bool { +func shouldLoadModSecurityModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1403,7 +1415,7 @@ func shouldLoadModSecurityModule(c interface{}, s interface{}) bool { return false } -func buildHTTPListener(t interface{}, s interface{}) string { +func buildHTTPListener(t, s interface{}) string { var out []string tc, ok := t.(config.TemplateConfig) @@ -1423,9 +1435,9 @@ func buildHTTPListener(t interface{}, s interface{}) string { addrV4 = tc.Cfg.BindAddressIpv4 } - co := commonListenOptions(tc, hostname) + co := commonListenOptions(&tc, hostname) - out = append(out, httpListener(addrV4, co, tc)...) + out = append(out, httpListener(addrV4, co, &tc)...) if !tc.IsIPV6Enabled { return strings.Join(out, "\n") @@ -1436,12 +1448,12 @@ func buildHTTPListener(t interface{}, s interface{}) string { addrV6 = tc.Cfg.BindAddressIpv6 } - out = append(out, httpListener(addrV6, co, tc)...) + out = append(out, httpListener(addrV6, co, &tc)...) return strings.Join(out, "\n") } -func buildHTTPSListener(t interface{}, s interface{}) string { +func buildHTTPSListener(t, s interface{}) string { var out []string tc, ok := t.(config.TemplateConfig) @@ -1456,14 +1468,14 @@ func buildHTTPSListener(t interface{}, s interface{}) string { return "" } - co := commonListenOptions(tc, hostname) + co := commonListenOptions(&tc, hostname) addrV4 := []string{""} if len(tc.Cfg.BindAddressIpv4) > 0 { addrV4 = tc.Cfg.BindAddressIpv4 } - out = append(out, httpsListener(addrV4, co, tc)...) + out = append(out, httpsListener(addrV4, co, &tc)...) if !tc.IsIPV6Enabled { return strings.Join(out, "\n") @@ -1474,12 +1486,12 @@ func buildHTTPSListener(t interface{}, s interface{}) string { addrV6 = tc.Cfg.BindAddressIpv6 } - out = append(out, httpsListener(addrV6, co, tc)...) + out = append(out, httpsListener(addrV6, co, &tc)...) return strings.Join(out, "\n") } -func commonListenOptions(template config.TemplateConfig, hostname string) string { +func commonListenOptions(template *config.TemplateConfig, hostname string) string { var out []string if template.Cfg.UseProxyProtocol { @@ -1503,7 +1515,7 @@ func commonListenOptions(template config.TemplateConfig, hostname string) string return strings.Join(out, " ") } -func httpListener(addresses []string, co string, tc config.TemplateConfig) []string { +func httpListener(addresses []string, co string, tc *config.TemplateConfig) []string { out := make([]string, 0) for _, address := range addresses { lo := []string{"listen"} @@ -1514,15 +1526,14 @@ func httpListener(addresses []string, co string, tc config.TemplateConfig) []str lo = append(lo, fmt.Sprintf("%v:%v", address, tc.ListenPorts.HTTP)) } - lo = append(lo, co) - lo = append(lo, ";") + lo = append(lo, co, ";") out = append(out, strings.Join(lo, " ")) } return out } -func httpsListener(addresses []string, co string, tc config.TemplateConfig) []string { +func httpsListener(addresses []string, co string, tc *config.TemplateConfig) []string { out := make([]string, 0) for _, address := range addresses { lo := []string{"listen"} @@ -1545,8 +1556,7 @@ func httpsListener(addresses []string, co string, tc config.TemplateConfig) []st } } - lo = append(lo, co) - lo = append(lo, "ssl") + lo = append(lo, co, "ssl") if tc.Cfg.UseHTTP2 { lo = append(lo, "http2") @@ -1559,7 +1569,7 @@ func httpsListener(addresses []string, co string, tc config.TemplateConfig) []st return out } -func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string { +func buildOpentracingForLocation(isOTEnabled, isOTTrustSet bool, location *ingress.Location) string { isOTEnabledInLoc := location.Opentracing.Enabled isOTSetInLoc := location.Opentracing.Set @@ -1578,13 +1588,13 @@ func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location * if (!isOTTrustSet && !location.Opentracing.TrustSet) || (location.Opentracing.TrustSet && !location.Opentracing.TrustEnabled) { - opc = opc + "\nopentracing_trust_incoming_span off;" + opc += "\nopentracing_trust_incoming_span off;" } return opc } -func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string { +func buildOpentelemetryForLocation(isOTEnabled, isOTTrustSet bool, location *ingress.Location) string { isOTEnabledInLoc := location.Opentelemetry.Enabled isOTSetInLoc := location.Opentelemetry.Set @@ -1602,14 +1612,14 @@ func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location } if location.Opentelemetry.OperationName != "" { - opc = opc + "\nopentelemetry_operation_name " + location.Opentelemetry.OperationName + ";" + opc += "\nopentelemetry_operation_name " + location.Opentelemetry.OperationName + ";" } if (!isOTTrustSet && !location.Opentelemetry.TrustSet) || (location.Opentelemetry.TrustSet && !location.Opentelemetry.TrustEnabled) { - opc = opc + "\nopentelemetry_trust_incoming_spans off;" + opc += "\nopentelemetry_trust_incoming_spans off;" } else { - opc = opc + "\nopentelemetry_trust_incoming_spans on;" + opc += "\nopentelemetry_trust_incoming_spans on;" } return opc } @@ -1617,7 +1627,7 @@ func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location // shouldLoadOpentracingModule determines whether or not the Opentracing module needs to be loaded. // First, it checks if `enable-opentracing` is set in the ConfigMap. If it is not, it iterates over all locations to // check if Opentracing is enabled by the annotation `nginx.ingress.kubernetes.io/enable-opentracing`. -func shouldLoadOpentracingModule(c interface{}, s interface{}) bool { +func shouldLoadOpentracingModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1647,7 +1657,7 @@ func shouldLoadOpentracingModule(c interface{}, s interface{}) bool { // shouldLoadOpentelemetryModule determines whether or not the Opentelemetry module needs to be loaded. // It checks if `enable-opentelemetry` is set in the ConfigMap. -func shouldLoadOpentelemetryModule(c interface{}, s interface{}) bool { +func shouldLoadOpentelemetryModule(c, s interface{}) bool { cfg, ok := c.(config.Configuration) if !ok { klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) @@ -1674,6 +1684,7 @@ func shouldLoadOpentelemetryModule(c interface{}, s interface{}) bool { return false } +//nolint:gocritic // Ignore passing cfg by pointer error func buildModSecurityForLocation(cfg config.Configuration, location *ingress.Location) string { isMSEnabledInLoc := location.ModSecurity.Enable isMSEnableSetInLoc := location.ModSecurity.EnableSet @@ -1807,7 +1818,7 @@ func convertGoSliceIntoLuaTable(goSliceInterface interface{}, emptyStringAsNil b switch kind { case reflect.String: - if emptyStringAsNil && len(goSlice.Interface().(string)) == 0 { + if emptyStringAsNil && goSlice.Interface().(string) == "" { return "nil", nil } return fmt.Sprintf(`"%v"`, goSlice.Interface()), nil @@ -1840,17 +1851,17 @@ func buildCorsOriginRegex(corsOrigins []string) string { return "set $http_origin *;\nset $cors 'true';" } - var originsRegex string = "if ($http_origin ~* (" + originsRegex := "if ($http_origin ~* (" for i, origin := range corsOrigins { originTrimmed := strings.TrimSpace(origin) if len(originTrimmed) > 0 { builtOrigin := buildOriginRegex(originTrimmed) originsRegex += builtOrigin if i != len(corsOrigins)-1 { - originsRegex = originsRegex + "|" + originsRegex += "|" } } } - originsRegex = originsRegex + ")$ ) { set $cors 'true'; }" + originsRegex += ")$ ) { set $cors 'true'; }" return originsRegex } diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index a2c3b8299..110967711 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -48,9 +48,9 @@ import ( func init() { // the default value of nginx.TemplatePath assumes the template exists in // the root filesystem and not in the rootfs directory - path, err := filepath.Abs(filepath.Join("../../../../rootfs/", nginx.TemplatePath)) + absPath, err := filepath.Abs(filepath.Join("..", "..", "..", "..", "rootfs", nginx.TemplatePath)) if err == nil { - nginx.TemplatePath = path + nginx.TemplatePath = absPath } } @@ -63,7 +63,7 @@ var ( Target string Location string ProxyPass string - AutoHttpProxyPass string + AutoHTTPProxyPass string Sticky bool XForwardedPrefix string SecureBackend bool @@ -200,6 +200,12 @@ proxy_pass $scheme://upstream_balancer;`, } ) +const ( + defaultBackend = "upstream-name" + defaultHost = "example.com" + fooAuthHost = "foo.com/auth" +) + func getTestDataDir() (string, error) { pwd, err := os.Getwd() if err != nil { @@ -326,9 +332,6 @@ func TestBuildLocation(t *testing.T) { } func TestBuildProxyPass(t *testing.T) { - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -339,7 +342,7 @@ func TestBuildProxyPass(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } backend := &ingress.Backend{ @@ -367,9 +370,6 @@ func TestBuildProxyPass(t *testing.T) { } func TestBuildProxyPassAutoHttp(t *testing.T) { - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -379,9 +379,9 @@ func TestBuildProxyPassAutoHttp(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } else { - loc.BackendProtocol = "AUTO_HTTP" + loc.BackendProtocol = autoHTTPProtocol } backend := &ingress.Backend{ @@ -402,7 +402,7 @@ func TestBuildProxyPassAutoHttp(t *testing.T) { backends := []*ingress.Backend{backend} pp := buildProxyPass(defaultHost, backends, loc) - if !strings.EqualFold(tc.AutoHttpProxyPass, pp) { + if !strings.EqualFold(tc.AutoHTTPProxyPass, pp) { t.Errorf("%s: expected \n'%v'\nbut returned \n'%v'", k, tc.ProxyPass, pp) } } @@ -417,7 +417,7 @@ func TestBuildAuthLocation(t *testing.T) { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - authURL := "foo.com/auth" + authURL := fooAuthHost globalAuthURL := "foo.com/global-auth" loc := &ingress.Location{ @@ -428,7 +428,7 @@ func TestBuildAuthLocation(t *testing.T) { EnableGlobalAuth: true, } - encodedAuthURL := strings.Replace(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "", -1) + encodedAuthURL := strings.ReplaceAll(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "") externalAuthPath := fmt.Sprintf("/_external-auth-%v-default", encodedAuthURL) testCases := []struct { @@ -460,8 +460,7 @@ func TestBuildAuthLocation(t *testing.T) { } func TestShouldApplyGlobalAuth(t *testing.T) { - - authURL := "foo.com/auth" + authURL := fooAuthHost globalAuthURL := "foo.com/global-auth" loc := &ingress.Location{ @@ -579,12 +578,12 @@ func TestBuildAuthUpstreamName(t *testing.T) { loc := &ingress.Location{ ExternalAuth: authreq.Config{ - URL: "foo.com/auth", + URL: fooAuthHost, }, Path: "/cat", } - encodedAuthURL := strings.Replace(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "", -1) + encodedAuthURL := strings.ReplaceAll(base64.URLEncoding.EncodeToString([]byte(loc.Path)), "=", "") externalAuthPath := fmt.Sprintf("external-auth-%v-default", encodedAuthURL) testCases := []struct { @@ -606,7 +605,7 @@ func TestBuildAuthUpstreamName(t *testing.T) { } func TestShouldApplyAuthUpstream(t *testing.T) { - authURL := "foo.com/auth" + authURL := fooAuthHost loc := &ingress.Location{ ExternalAuth: authreq.Config{ @@ -702,7 +701,10 @@ func TestChangeHostPort(t *testing.T) { } func TestTemplateWithData(t *testing.T) { - pwd, _ := os.Getwd() + pwd, err := os.Getwd() + if err != nil { + t.Errorf("unexpected error: %v", err) + } f, err := os.Open(path.Join(pwd, "../../../../test/data/config.json")) if err != nil { t.Errorf("unexpected error reading json file: %v", err) @@ -727,7 +729,7 @@ func TestTemplateWithData(t *testing.T) { dat.Cfg.DefaultSSLCertificate = &ingress.SSLCert{} - rt, err := ngxTpl.Write(dat) + rt, err := ngxTpl.Write(&dat) if err != nil { t.Errorf("invalid NGINX template: %v", err) } @@ -746,7 +748,10 @@ func TestTemplateWithData(t *testing.T) { } func BenchmarkTemplateWithData(b *testing.B) { - pwd, _ := os.Getwd() + pwd, err := os.Getwd() + if err != nil { + b.Errorf("unexpected error: %v", err) + } f, err := os.Open(path.Join(pwd, "../../../../test/data/config.json")) if err != nil { b.Errorf("unexpected error reading json file: %v", err) @@ -767,7 +772,7 @@ func BenchmarkTemplateWithData(b *testing.B) { } for i := 0; i < b.N; i++ { - if _, err := ngxTpl.Write(dat); err != nil { + if _, err := ngxTpl.Write(&dat); err != nil { b.Errorf("unexpected error writing template: %v", err) } } @@ -1066,9 +1071,6 @@ func TestBuildUpstreamName(t *testing.T) { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - defaultBackend := "upstream-name" - defaultHost := "example.com" - for k, tc := range tmplFuncTestcases { loc := &ingress.Location{ Path: tc.Path, @@ -1079,7 +1081,7 @@ func TestBuildUpstreamName(t *testing.T) { } if tc.SecureBackend { - loc.BackendProtocol = "HTTPS" + loc.BackendProtocol = httpsProtocol } backend := &ingress.Backend{ @@ -1134,13 +1136,13 @@ func TestEscapeLiteralDollar(t *testing.T) { func TestOpentracingPropagateContext(t *testing.T) { tests := map[*ingress.Location]string{ - {BackendProtocol: "HTTP"}: "opentracing_propagate_context;", - {BackendProtocol: "HTTPS"}: "opentracing_propagate_context;", - {BackendProtocol: "AUTO_HTTP"}: "opentracing_propagate_context;", - {BackendProtocol: "GRPC"}: "opentracing_grpc_propagate_context;", - {BackendProtocol: "GRPCS"}: "opentracing_grpc_propagate_context;", - {BackendProtocol: "FCGI"}: "opentracing_propagate_context;", - nil: "", + {BackendProtocol: httpProtocol}: "opentracing_propagate_context;", + {BackendProtocol: httpsProtocol}: "opentracing_propagate_context;", + {BackendProtocol: autoHTTPProtocol}: "opentracing_propagate_context;", + {BackendProtocol: grpcProtocol}: "opentracing_grpc_propagate_context;", + {BackendProtocol: grpcsProtocol}: "opentracing_grpc_propagate_context;", + {BackendProtocol: fcgiProtocol}: "opentracing_propagate_context;", + nil: "", } for loc, expectedDirective := range tests { @@ -1153,13 +1155,13 @@ func TestOpentracingPropagateContext(t *testing.T) { func TestOpentelemetryPropagateContext(t *testing.T) { tests := map[*ingress.Location]string{ - {BackendProtocol: "HTTP"}: "opentelemetry_propagate;", - {BackendProtocol: "HTTPS"}: "opentelemetry_propagate;", - {BackendProtocol: "AUTO_HTTP"}: "opentelemetry_propagate;", - {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", - {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", - {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", - nil: "", + {BackendProtocol: httpProtocol}: "opentelemetry_propagate;", + {BackendProtocol: httpsProtocol}: "opentelemetry_propagate;", + {BackendProtocol: autoHTTPProtocol}: "opentelemetry_propagate;", + {BackendProtocol: grpcProtocol}: "opentelemetry_propagate;", + {BackendProtocol: grpcsProtocol}: "opentelemetry_propagate;", + {BackendProtocol: fcgiProtocol}: "opentelemetry_propagate;", + nil: "", } for loc, expectedDirective := range tests { @@ -1171,7 +1173,6 @@ func TestOpentelemetryPropagateContext(t *testing.T) { } func TestGetIngressInformation(t *testing.T) { - testcases := map[string]struct { Ingress interface{} Host string @@ -1625,7 +1626,7 @@ func TestProxySetHeader(t *testing.T) { { name: "gRPC backend", loc: &ingress.Location{ - BackendProtocol: "GRPC", + BackendProtocol: grpcProtocol, }, expected: "grpc_set_header", }, @@ -1716,7 +1717,6 @@ func TestBuildOpenTracing(t *testing.T) { if expected != actual { t.Errorf("Expected '%v' but returned '%v'", expected, actual) } - } func TestBuildOpenTelemetry(t *testing.T) { @@ -1777,6 +1777,7 @@ func TestEnforceRegexModifier(t *testing.T) { } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadModSecurityModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -1877,6 +1878,7 @@ opentracing_trust_incoming_span off;` } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadOpentracingModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -1978,6 +1980,7 @@ opentelemetry_trust_incoming_spans off;` } } +//nolint:dupl // Ignore dupl errors for similar test case func TestShouldLoadOpentelemetryModule(t *testing.T) { // ### Invalid argument type tests ### // The first tests should return false. @@ -2104,7 +2107,6 @@ func TestModSecurityForLocation(t *testing.T) { } func TestBuildServerName(t *testing.T) { - testCases := []struct { title string hostname string diff --git a/internal/ingress/controller/util.go b/internal/ingress/controller/util.go index 6562dd17c..8851f323f 100644 --- a/internal/ingress/controller/util.go +++ b/internal/ingress/controller/util.go @@ -135,11 +135,13 @@ func (nc NginxCommand) ExecCommand(args ...string) *exec.Cmd { cmdArgs = append(cmdArgs, "-c", cfgPath) cmdArgs = append(cmdArgs, args...) + //nolint:gosec // Ignore G204 error return exec.Command(nc.Binary, cmdArgs...) } // Test checks if config file is a syntax valid nginx configuration func (nc NginxCommand) Test(cfg string) ([]byte, error) { + //nolint:gosec // Ignore G204 error return exec.Command(nc.Binary, "-c", cfg, "-t").CombinedOutput() } diff --git a/internal/ingress/defaults/main.go b/internal/ingress/defaults/main.go index 8cd0e8ba5..0526d443e 100644 --- a/internal/ingress/defaults/main.go +++ b/internal/ingress/defaults/main.go @@ -100,7 +100,7 @@ type Backend struct { // Name server/s used to resolve names of upstream servers into IP addresses. // The file /etc/resolv.conf is used as DNS resolution configuration. - Resolver []net.IP + Resolver []net.IP `json:"Resolver"` // SkipAccessLogURLs sets a list of URLs that should not appear in the NGINX access log // This is useful with urls like `/health` or `health-check` that make "complex" reading the logs diff --git a/internal/ingress/errors/errors.go b/internal/ingress/errors/errors.go index e6f7fb52c..d70218334 100644 --- a/internal/ingress/errors/errors.go +++ b/internal/ingress/errors/errors.go @@ -33,57 +33,57 @@ var ( // NewInvalidAnnotationConfiguration returns a new InvalidConfiguration error for use when // annotations are not correctly configured -func NewInvalidAnnotationConfiguration(name string, reason string) error { - return InvalidConfiguration{ +func NewInvalidAnnotationConfiguration(name, reason string) error { + return InvalidConfigurationError{ Name: fmt.Sprintf("the annotation %v does not contain a valid configuration: %v", name, reason), } } // NewInvalidAnnotationContent returns a new InvalidContent error func NewInvalidAnnotationContent(name string, val interface{}) error { - return InvalidContent{ + return InvalidContentError{ Name: fmt.Sprintf("the annotation %v does not contain a valid value (%v)", name, val), } } // NewLocationDenied returns a new LocationDenied error func NewLocationDenied(reason string) error { - return LocationDenied{ - Reason: fmt.Errorf("Location denied, reason: %v", reason), + return LocationDeniedError{ + Reason: fmt.Errorf("location denied, reason: %v", reason), } } -// InvalidConfiguration Error -type InvalidConfiguration struct { +// InvalidConfigurationError +type InvalidConfigurationError struct { Name string } -func (e InvalidConfiguration) Error() string { +func (e InvalidConfigurationError) Error() string { return e.Name } -// InvalidContent error -type InvalidContent struct { +// InvalidContentError +type InvalidContentError struct { Name string } -func (e InvalidContent) Error() string { +func (e InvalidContentError) Error() string { return e.Name } -// LocationDenied error -type LocationDenied struct { +// LocationDeniedError +type LocationDeniedError struct { Reason error } -func (e LocationDenied) Error() string { +func (e LocationDeniedError) Error() string { return e.Reason.Error() } // IsLocationDenied checks if the err is an error which // indicates a location should return HTTP code 503 func IsLocationDenied(e error) bool { - _, ok := e.(LocationDenied) + _, ok := e.(LocationDeniedError) return ok } @@ -96,7 +96,7 @@ func IsMissingAnnotations(e error) bool { // IsInvalidContent checks if the err is an error which // indicates an annotations value is not valid func IsInvalidContent(e error) bool { - _, ok := e.(InvalidContent) + _, ok := e.(InvalidContentError) return ok } diff --git a/internal/ingress/inspector/ingress_test.go b/internal/ingress/inspector/ingress_test.go index bfd9f6b93..52ad8d431 100644 --- a/internal/ingress/inspector/ingress_test.go +++ b/internal/ingress/inspector/ingress_test.go @@ -24,7 +24,6 @@ import ( ) func makeSimpleIngress(hostname string, paths ...string) *networking.Ingress { - newIngress := networking.Ingress{ ObjectMeta: v1.ObjectMeta{ Name: "test1", diff --git a/internal/ingress/inspector/inspector.go b/internal/ingress/inspector/inspector.go index 23b57e538..b41e18d9e 100644 --- a/internal/ingress/inspector/inspector.go +++ b/internal/ingress/inspector/inspector.go @@ -40,9 +40,7 @@ func DeepInspect(obj interface{}) error { } } -var ( - implSpecific = networking.PathTypeImplementationSpecific -) +var implSpecific = networking.PathTypeImplementationSpecific func ValidatePathType(ing *networking.Ingress) error { if ing == nil { diff --git a/internal/ingress/inspector/rules.go b/internal/ingress/inspector/rules.go index c9714e680..8388efdd5 100644 --- a/internal/ingress/inspector/rules.go +++ b/internal/ingress/inspector/rules.go @@ -34,7 +34,7 @@ var ( // the group [[:alnum:]\_\-\/]* says that any amount of characters (A-Za-z0-9), _, - and / // are accepted until the end of the line // Nothing else is accepted. - validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-\/]*$`) + validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-/]*$`) invalidRegex = []regexp.Regexp{} ) @@ -52,8 +52,8 @@ func init() { // CheckRegex receives a value/configuration and validates if it matches with one of the // forbidden regexes. func CheckRegex(value string) error { - for _, regex := range invalidRegex { - if regex.MatchString(value) { + for i := range invalidRegex { + if invalidRegex[i].MatchString(value) { return fmt.Errorf("invalid value found: %s", value) } } diff --git a/internal/ingress/inspector/rules_test.go b/internal/ingress/inspector/rules_test.go index 6ed6dbe87..3945a3bd4 100644 --- a/internal/ingress/inspector/rules_test.go +++ b/internal/ingress/inspector/rules_test.go @@ -19,7 +19,6 @@ package inspector import "testing" func TestCheckRegex(t *testing.T) { - tests := []struct { name string value string diff --git a/internal/ingress/inspector/service.go b/internal/ingress/inspector/service.go index 27ed27a8c..8be08490b 100644 --- a/internal/ingress/inspector/service.go +++ b/internal/ingress/inspector/service.go @@ -21,6 +21,6 @@ import ( ) // InspectService will be used to inspect service objects for possible invalid configurations -func InspectService(svc *corev1.Service) error { +func InspectService(_ *corev1.Service) error { return nil } diff --git a/internal/ingress/metric/collectors/admission.go b/internal/ingress/metric/collectors/admission.go index cf42fbaa1..7b84325c0 100644 --- a/internal/ingress/metric/collectors/admission.go +++ b/internal/ingress/metric/collectors/admission.go @@ -104,7 +104,7 @@ func NewAdmissionCollector(pod, namespace, class string) *AdmissionCollector { } // Describe implements prometheus.Collector -func (am AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { +func (am *AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { am.testedIngressLength.Describe(ch) am.testedIngressTime.Describe(ch) am.renderingIngressLength.Describe(ch) @@ -114,7 +114,7 @@ func (am AdmissionCollector) Describe(ch chan<- *prometheus.Desc) { } // Collect implements the prometheus.Collector interface. -func (am AdmissionCollector) Collect(ch chan<- prometheus.Metric) { +func (am *AdmissionCollector) Collect(ch chan<- prometheus.Metric) { am.testedIngressLength.Collect(ch) am.testedIngressTime.Collect(ch) am.renderingIngressLength.Collect(ch) @@ -139,7 +139,7 @@ func ByteFormat(bytes int64) string { } // SetAdmissionMetrics sets the values for AdmissionMetrics that can be called externally -func (am *AdmissionCollector) SetAdmissionMetrics(testedIngressLength float64, testedIngressTime float64, renderingIngressLength float64, renderingIngressTime float64, testedConfigurationSize float64, admissionTime float64) { +func (am *AdmissionCollector) SetAdmissionMetrics(testedIngressLength, testedIngressTime, renderingIngressLength, renderingIngressTime, testedConfigurationSize, admissionTime float64) { am.testedIngressLength.Set(testedIngressLength) am.testedIngressTime.Set(testedIngressTime) am.renderingIngressLength.Set(renderingIngressLength) diff --git a/internal/ingress/metric/collectors/controller.go b/internal/ingress/metric/collectors/controller.go index 3a65a1a99..e1d6789bb 100644 --- a/internal/ingress/metric/collectors/controller.go +++ b/internal/ingress/metric/collectors/controller.go @@ -226,7 +226,7 @@ func (cm *Controller) IncCheckErrorCount(namespace, name string) { } // IncOrphanIngress sets the the orphaned ingress gauge to one -func (cm *Controller) IncOrphanIngress(namespace string, name string, orphanityType string) { +func (cm *Controller) IncOrphanIngress(namespace, name, orphanityType string) { labels := prometheus.Labels{ "namespace": namespace, "ingress": name, @@ -236,7 +236,7 @@ func (cm *Controller) IncOrphanIngress(namespace string, name string, orphanityT } // DecOrphanIngress sets the the orphaned ingress gauge to zero (all services has their endpoints) -func (cm *Controller) DecOrphanIngress(namespace string, name string, orphanityType string) { +func (cm *Controller) DecOrphanIngress(namespace, name, orphanityType string) { labels := prometheus.Labels{ "namespace": namespace, "ingress": name, @@ -261,7 +261,7 @@ func (cm *Controller) ConfigSuccess(hash uint64, success bool) { } // Describe implements prometheus.Collector -func (cm Controller) Describe(ch chan<- *prometheus.Desc) { +func (cm *Controller) Describe(ch chan<- *prometheus.Desc) { cm.configHash.Describe(ch) cm.configSuccess.Describe(ch) cm.configSuccessTime.Describe(ch) @@ -277,7 +277,7 @@ func (cm Controller) Describe(ch chan<- *prometheus.Desc) { } // Collect implements the prometheus.Collector interface. -func (cm Controller) Collect(ch chan<- prometheus.Metric) { +func (cm *Controller) Collect(ch chan<- prometheus.Metric) { cm.configHash.Collect(ch) cm.configSuccess.Collect(ch) cm.configSuccessTime.Collect(ch) @@ -295,41 +295,45 @@ func (cm Controller) Collect(ch chan<- prometheus.Metric) { // SetSSLExpireTime sets the expiration time of SSL Certificates func (cm *Controller) SetSSLExpireTime(servers []*ingress.Server) { for _, s := range servers { - if s.Hostname != "" && s.SSLCert != nil && s.SSLCert.ExpireTime.Unix() > 0 { - labels := make(prometheus.Labels, len(cm.labels)+1) - for k, v := range cm.labels { - labels[k] = v - } - labels["host"] = s.Hostname - labels["secret_name"] = s.SSLCert.Name - - cm.sslExpireTime.With(labels).Set(float64(s.SSLCert.ExpireTime.Unix())) + if !(s.Hostname != "" && s.SSLCert != nil && s.SSLCert.ExpireTime.Unix() > 0) { + continue } + + labels := make(prometheus.Labels, len(cm.labels)+1) + for k, v := range cm.labels { + labels[k] = v + } + labels["host"] = s.Hostname + labels["secret_name"] = s.SSLCert.Name + + cm.sslExpireTime.With(labels).Set(float64(s.SSLCert.ExpireTime.Unix())) } } // SetSSLInfo creates a metric with all certificates informations func (cm *Controller) SetSSLInfo(servers []*ingress.Server) { for _, s := range servers { - if s.SSLCert != nil && s.SSLCert.Certificate != nil && s.SSLCert.Certificate.SerialNumber != nil { - labels := make(prometheus.Labels, len(cm.labels)+1) - for k, v := range cm.labels { - labels[k] = v - } - labels["identifier"] = s.SSLCert.Identifier() - labels["host"] = s.Hostname - labels["secret_name"] = s.SSLCert.Name - labels["namespace"] = s.SSLCert.Namespace - labels["issuer_common_name"] = s.SSLCert.Certificate.Issuer.CommonName - labels["issuer_organization"] = "" - if len(s.SSLCert.Certificate.Issuer.Organization) > 0 { - labels["issuer_organization"] = s.SSLCert.Certificate.Issuer.Organization[0] - } - labels["serial_number"] = s.SSLCert.Certificate.SerialNumber.String() - labels["public_key_algorithm"] = s.SSLCert.Certificate.PublicKeyAlgorithm.String() - - cm.sslInfo.With(labels).Set(1) + if s.SSLCert == nil || s.SSLCert.Certificate == nil || s.SSLCert.Certificate.SerialNumber == nil { + continue } + + labels := make(prometheus.Labels, len(cm.labels)+1) + for k, v := range cm.labels { + labels[k] = v + } + labels["identifier"] = s.SSLCert.Identifier() + labels["host"] = s.Hostname + labels["secret_name"] = s.SSLCert.Name + labels["namespace"] = s.SSLCert.Namespace + labels["issuer_common_name"] = s.SSLCert.Certificate.Issuer.CommonName + labels["issuer_organization"] = "" + if len(s.SSLCert.Certificate.Issuer.Organization) > 0 { + labels["issuer_organization"] = s.SSLCert.Certificate.Issuer.Organization[0] + } + labels["serial_number"] = s.SSLCert.Certificate.SerialNumber.String() + labels["public_key_algorithm"] = s.SSLCert.Certificate.PublicKeyAlgorithm.String() + + cm.sslInfo.With(labels).Set(1) } } diff --git a/internal/ingress/metric/collectors/controller_test.go b/internal/ingress/metric/collectors/controller_test.go index ef80bc96a..15735df42 100644 --- a/internal/ingress/metric/collectors/controller_test.go +++ b/internal/ingress/metric/collectors/controller_test.go @@ -76,9 +76,12 @@ func TestControllerCounters(t *testing.T) { { name: "should set SSL certificates metrics", test: func(cm *Controller) { - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") + if err != nil { + t.Errorf("unexpected error: %v", err) + } servers := []*ingress.Server{ { @@ -106,7 +109,6 @@ func TestControllerCounters(t *testing.T) { { name: "should set SSL certificates infos metrics", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -143,7 +145,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore certificates without serial number", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -168,7 +169,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore certificates with nil x509 pointer", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -193,7 +193,6 @@ func TestControllerCounters(t *testing.T) { { name: "should ignore servers without certificates", test: func(cm *Controller) { - servers := []*ingress.Server{ { Hostname: "demo", @@ -232,9 +231,12 @@ func TestRemoveMetrics(t *testing.T) { t.Errorf("registering collector failed: %s", err) } - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") + if err != nil { + t.Errorf("Unexpected error: %v", err) + } servers := []*ingress.Server{ { @@ -279,10 +281,12 @@ func TestRemoveAllSSLMetrics(t *testing.T) { t.Errorf("registering collector failed: %s", err) } - t1, _ := time.Parse( + t1, err := time.Parse( time.RFC3339, "2012-11-01T22:08:41+00:00") - + if err != nil { + t.Errorf("unexpected error: %v", err) + } servers := []*ingress.Server{ { Hostname: "demo", diff --git a/internal/ingress/metric/collectors/nginx_status.go b/internal/ingress/metric/collectors/nginx_status.go index 5aaa787de..f3afdc334 100644 --- a/internal/ingress/metric/collectors/nginx_status.go +++ b/internal/ingress/metric/collectors/nginx_status.go @@ -75,7 +75,6 @@ type NGINXStatusCollector interface { // NewNGINXStatus returns a new prometheus collector the default nginx status module func NewNGINXStatus(podName, namespace, ingressClass string) (NGINXStatusCollector, error) { - p := nginxStatusCollector{ scrapeChan: make(chan scrapeRequest), } diff --git a/internal/ingress/metric/collectors/nginx_status_test.go b/internal/ingress/metric/collectors/nginx_status_test.go index 4dc67c425..ec535745d 100644 --- a/internal/ingress/metric/collectors/nginx_status_test.go +++ b/internal/ingress/metric/collectors/nginx_status_test.go @@ -106,7 +106,7 @@ func TestStatusCollector(t *testing.T) { server := &httptest.Server{ Listener: listener, - Config: &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + Config: &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { //nolint:gosec // Ignore the gosec error in testing w.WriteHeader(http.StatusOK) if r.URL.Path == "/nginx_status" { diff --git a/internal/ingress/metric/collectors/process.go b/internal/ingress/metric/collectors/process.go index 23f533876..3803a47ae 100644 --- a/internal/ingress/metric/collectors/process.go +++ b/internal/ingress/metric/collectors/process.go @@ -53,6 +53,8 @@ type BinaryNameMatcher struct { // MatchAndName returns false if the match failed, otherwise // true and the resulting name. +// +//nolint:gocritic // nacl param cannot be a pointer since it's to implement common.MatchNamer interface func (em BinaryNameMatcher) MatchAndName(nacl common.ProcAttributes) (bool, string) { if len(nacl.Cmdline) == 0 { return false, "" @@ -94,8 +96,10 @@ type NGINXProcessCollector interface { Stop() } -var name = "nginx" -var binary = "/usr/bin/nginx" +var ( + name = "nginx" + binary = "/usr/bin/nginx" +) // NewNGINXProcess returns a new prometheus collector for the nginx process func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector, error) { @@ -106,7 +110,7 @@ func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector nm := newBinaryNameMatcher(name, binary) - p := namedProcess{ + p := &namedProcess{ scrapeChan: make(chan scrapeRequest), Grouper: proc.NewGrouper(nm, true, false, false, false), fs: fs, @@ -164,7 +168,7 @@ func NewNGINXProcess(pod, namespace, ingressClass string) (NGINXProcessCollector } // Describe implements prometheus.Collector. -func (p namedProcess) Describe(ch chan<- *prometheus.Desc) { +func (p *namedProcess) Describe(ch chan<- *prometheus.Desc) { ch <- p.data.cpuSecs ch <- p.data.numProcs ch <- p.data.readBytes @@ -175,13 +179,13 @@ func (p namedProcess) Describe(ch chan<- *prometheus.Desc) { } // Collect implements prometheus.Collector. -func (p namedProcess) Collect(ch chan<- prometheus.Metric) { +func (p *namedProcess) Collect(ch chan<- prometheus.Metric) { req := scrapeRequest{results: ch, done: make(chan struct{})} p.scrapeChan <- req <-req.done } -func (p namedProcess) Start() { +func (p *namedProcess) Start() { for req := range p.scrapeChan { ch := req.results p.scrape(ch) @@ -189,18 +193,19 @@ func (p namedProcess) Start() { } } -func (p namedProcess) Stop() { +func (p *namedProcess) Stop() { close(p.scrapeChan) } -func (p namedProcess) scrape(ch chan<- prometheus.Metric) { +func (p *namedProcess) scrape(ch chan<- prometheus.Metric) { _, groups, err := p.Update(p.fs.AllProcs()) if err != nil { klog.Warningf("unexpected error obtaining nginx process info: %v", err) return } - for _, gcounts := range groups { + for i := range groups { + gcounts := groups[i] ch <- prometheus.MustNewConstMetric(p.data.numProcs, prometheus.GaugeValue, float64(gcounts.Procs)) ch <- prometheus.MustNewConstMetric(p.data.memResidentbytes, diff --git a/internal/ingress/metric/collectors/process_test.go b/internal/ingress/metric/collectors/process_test.go index b21d95496..588cbafef 100644 --- a/internal/ingress/metric/collectors/process_test.go +++ b/internal/ingress/metric/collectors/process_test.go @@ -48,8 +48,11 @@ func TestProcessCollector(t *testing.T) { done := make(chan struct{}) go func() { - cmd.Wait() //nolint:errcheck - status := cmd.ProcessState.Sys().(syscall.WaitStatus) + cmd.Wait() //nolint:errcheck // Ignore the error + status, ok := cmd.ProcessState.Sys().(syscall.WaitStatus) + if !ok { + t.Errorf("unexpected type: %T", cmd.ProcessState.Sys()) + } if status.Signaled() { t.Logf("Signal: %v", status.Signal()) } else { @@ -69,7 +72,7 @@ func TestProcessCollector(t *testing.T) { defer func() { cm.Stop() - cmd.Process.Kill() //nolint:errcheck + cmd.Process.Kill() //nolint:errcheck // Ignore the error <-done close(done) }() diff --git a/internal/ingress/metric/collectors/socket.go b/internal/ingress/metric/collectors/socket.go index 508cc6bc8..a70024c57 100644 --- a/internal/ingress/metric/collectors/socket.go +++ b/internal/ingress/metric/collectors/socket.go @@ -44,14 +44,11 @@ type socketData struct { Latency float64 `json:"upstreamLatency"` HeaderTime float64 `json:"upstreamHeaderTime"` ResponseTime float64 `json:"upstreamResponseTime"` - //ResponseLength float64 `json:"upstreamResponseLength"` - //Status string `json:"upstreamStatus"` - - Namespace string `json:"namespace"` - Ingress string `json:"ingress"` - Service string `json:"service"` - Canary string `json:"canary"` - Path string `json:"path"` + Namespace string `json:"namespace"` + Ingress string `json:"ingress"` + Service string `json:"service"` + Canary string `json:"canary"` + Path string `json:"path"` } // HistogramBuckets allow customizing prometheus histogram buckets values @@ -89,19 +86,17 @@ type SocketCollector struct { reportStatusClasses bool } -var ( - requestTags = []string{ - "status", +var requestTags = []string{ + "status", - "method", - "path", + "method", + "path", - "namespace", - "ingress", - "service", - "canary", - } -) + "namespace", + "ingress", + "service", + "canary", +} // DefObjectives was removed in https://github.com/prometheus/client_golang/pull/262 // updating the library to latest version changed the output of the metrics @@ -112,6 +107,7 @@ var defObjectives = map[float64]float64{0.5: 0.05, 0.9: 0.01, 0.99: 0.001} func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStatusClasses bool, buckets HistogramBuckets, excludeMetrics []string) (*SocketCollector, error) { socket := "/tmp/nginx/prometheus-nginx.socket" // unix sockets must be unlink()ed before being used + //nolint:errcheck // Ignore unlink error _ = syscall.Unlink(socket) listener, err := net.Listen("unix", socket) @@ -119,7 +115,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat return nil, err } - err = os.Chmod(socket, 0777) // #nosec + err = os.Chmod(socket, 0o777) // #nosec if err != nil { return nil, err } @@ -152,7 +148,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat reportStatusClasses: reportStatusClasses, connectTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "connect_duration_seconds", Help: "The time spent on establishing a connection with the upstream server", Namespace: PrometheusNamespace, @@ -165,7 +161,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), headerTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "header_duration_seconds", Help: "The time spent on receiving first header from the upstream server", Namespace: PrometheusNamespace, @@ -177,7 +173,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat mm, ), responseTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "response_duration_seconds", Help: "The time spent on receiving the response from the upstream server", Namespace: PrometheusNamespace, @@ -190,7 +186,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requestTime: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "request_duration_seconds", Help: "The request processing time in milliseconds", Namespace: PrometheusNamespace, @@ -203,7 +199,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), responseLength: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "response_size", Help: "The response length (including request line, header, and request body)", Namespace: PrometheusNamespace, @@ -216,7 +212,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requestLength: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "request_size", Help: "The request length (including request line, header, and request body)", Namespace: PrometheusNamespace, @@ -229,7 +225,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), requests: counterMetric( - prometheus.CounterOpts{ + &prometheus.CounterOpts{ Name: "requests", Help: "The total number of client requests", Namespace: PrometheusNamespace, @@ -241,7 +237,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), bytesSent: histogramMetric( - prometheus.HistogramOpts{ + &prometheus.HistogramOpts{ Name: "bytes_sent", Help: "DEPRECATED The number of bytes sent to a client", Namespace: PrometheusNamespace, @@ -254,7 +250,7 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ), upstreamLatency: summaryMetric( - prometheus.SummaryOpts{ + &prometheus.SummaryOpts{ Name: "ingress_upstream_latency_seconds", Help: "DEPRECATED Upstream service latency per Ingress", Namespace: PrometheusNamespace, @@ -279,36 +275,36 @@ func containsMetric(excludeMetrics map[string]struct{}, name string) bool { return false } -func summaryMetric(opts prometheus.SummaryOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.SummaryVec { +func summaryMetric(opts *prometheus.SummaryOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.SummaryVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewSummaryVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m return m } -func counterMetric(opts prometheus.CounterOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.CounterVec { +func counterMetric(opts *prometheus.CounterOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.CounterVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewCounterVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m return m } -func histogramMetric(opts prometheus.HistogramOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.HistogramVec { +func histogramMetric(opts *prometheus.HistogramOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.HistogramVec { if containsMetric(excludeMetrics, opts.Name) { return nil } m := prometheus.NewHistogramVec( - opts, + *opts, requestTags, ) metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m @@ -326,7 +322,8 @@ func (sc *SocketCollector) handleMessage(msg []byte) { return } - for _, stats := range statsBatch { + for i := range statsBatch { + stats := &statsBatch[i] if sc.metricsPerHost && !sc.hosts.Has(stats.Host) { klog.V(3).InfoS("Skipping metric for host not being served", "host", stats.Host) continue @@ -543,14 +540,14 @@ func (sc *SocketCollector) RemoveMetrics(ingresses []string, registry prometheus } // Describe implements prometheus.Collector -func (sc SocketCollector) Describe(ch chan<- *prometheus.Desc) { +func (sc *SocketCollector) Describe(ch chan<- *prometheus.Desc) { for _, metric := range sc.metricMapping { metric.Describe(ch) } } // Collect implements the prometheus.Collector interface. -func (sc SocketCollector) Collect(ch chan<- prometheus.Metric) { +func (sc *SocketCollector) Collect(ch chan<- prometheus.Metric) { for _, metric := range sc.metricMapping { metric.Collect(ch) } diff --git a/internal/ingress/metric/collectors/socket_test.go b/internal/ingress/metric/collectors/socket_test.go index 6000f2685..71e9097c9 100644 --- a/internal/ingress/metric/collectors/socket_test.go +++ b/internal/ingress/metric/collectors/socket_test.go @@ -30,6 +30,7 @@ import ( func TestNewUDPLogListener(t *testing.T) { var count uint64 + //nolint:unparam // Unused `message` param is required by the handleMessages function fn := func(message []byte) { atomic.AddUint64(&count, 1) } @@ -57,7 +58,10 @@ func TestNewUDPLogListener(t *testing.T) { } }() - conn, _ := net.Dial("unix", tmpFile) + conn, err := net.Dial("unix", tmpFile) + if err != nil { + t.Errorf("unexpected error connecting to unix socket: %v", err) + } if _, err := conn.Write([]byte("message")); err != nil { t.Errorf("unexpected error writing to unix socket: %v", err) } @@ -70,7 +74,6 @@ func TestNewUDPLogListener(t *testing.T) { } func TestCollector(t *testing.T) { - buckets := struct { TimeBuckets []float64 LengthBuckets []float64 diff --git a/internal/ingress/metric/collectors/testutils.go b/internal/ingress/metric/collectors/testutils.go index 8c5c27b62..669e89e17 100644 --- a/internal/ingress/metric/collectors/testutils.go +++ b/internal/ingress/metric/collectors/testutils.go @@ -31,7 +31,7 @@ import ( // GatherAndCompare retrieves all metrics exposed by a collector and compares it // to an expected output in the Prometheus text exposition format. // metricNames allows only comparing the given metrics. All are compared if it's nil. -func GatherAndCompare(c prometheus.Collector, expected string, metricNames []string, reg prometheus.Gatherer) error { +func GatherAndCompare(_ prometheus.Collector, expected string, metricNames []string, reg prometheus.Gatherer) error { expected = removeUnusedWhitespace(expected) metrics, err := reg.Gather() @@ -77,9 +77,7 @@ metric output does not match expectation; want: got: -'%s' - -`, buf2.String(), buf1.String()) +'%s'`, buf2.String(), buf1.String()) } return nil } diff --git a/internal/ingress/metric/dummy.go b/internal/ingress/metric/dummy.go index d8ae0155a..a619ccbd8 100644 --- a/internal/ingress/metric/dummy.go +++ b/internal/ingress/metric/dummy.go @@ -29,50 +29,50 @@ func NewDummyCollector() Collector { // DummyCollector dummy implementation for mocks in tests type DummyCollector struct{} -// ConfigSuccess ... +// ConfigSuccess dummy implementation func (dc DummyCollector) ConfigSuccess(uint64, bool) {} -// SetAdmissionMetrics ... +// SetAdmissionMetrics dummy implementation func (dc DummyCollector) SetAdmissionMetrics(float64, float64, float64, float64, float64, float64) {} -// IncReloadCount ... +// IncReloadCount dummy implementation func (dc DummyCollector) IncReloadCount() {} -// IncReloadErrorCount ... +// IncReloadErrorCount dummy implementation func (dc DummyCollector) IncReloadErrorCount() {} -// IncOrphanIngress ... +// IncOrphanIngress dummy implementation func (dc DummyCollector) IncOrphanIngress(string, string, string) {} -// DecOrphanIngress ... +// DecOrphanIngress dummy implementation func (dc DummyCollector) DecOrphanIngress(string, string, string) {} -// IncCheckCount ... +// IncCheckCount dummy implementation func (dc DummyCollector) IncCheckCount(string, string) {} -// IncCheckErrorCount ... +// IncCheckErrorCount dummy implementation func (dc DummyCollector) IncCheckErrorCount(string, string) {} -// RemoveMetrics ... -func (dc DummyCollector) RemoveMetrics(ingresses, endpoints, certificates []string) {} +// RemoveMetrics dummy implementation +func (dc DummyCollector) RemoveMetrics(_, _, _ []string) {} -// Start ... -func (dc DummyCollector) Start(admissionStatus string) {} +// Start dummy implementation +func (dc DummyCollector) Start(_ string) {} -// Stop ... -func (dc DummyCollector) Stop(admissionStatus string) {} +// Stop dummy implementation +func (dc DummyCollector) Stop(_ string) {} -// SetSSLInfo ... +// SetSSLInfo dummy implementation func (dc DummyCollector) SetSSLInfo([]*ingress.Server) {} -// SetSSLExpireTime ... +// SetSSLExpireTime dummy implementation func (dc DummyCollector) SetSSLExpireTime([]*ingress.Server) {} -// SetHosts ... -func (dc DummyCollector) SetHosts(hosts sets.Set[string]) {} +// SetHosts dummy implementation +func (dc DummyCollector) SetHosts(_ sets.Set[string]) {} // OnStartedLeading indicates the pod is not the current leader -func (dc DummyCollector) OnStartedLeading(electionID string) {} +func (dc DummyCollector) OnStartedLeading(_ string) {} // OnStoppedLeading indicates the pod is not the current leader -func (dc DummyCollector) OnStoppedLeading(electionID string) {} +func (dc DummyCollector) OnStoppedLeading(_ string) {} diff --git a/internal/ingress/metric/main.go b/internal/ingress/metric/main.go index b2f721f62..aa35a5c51 100644 --- a/internal/ingress/metric/main.go +++ b/internal/ingress/metric/main.go @@ -115,11 +115,11 @@ func (c *collector) ConfigSuccess(hash uint64, success bool) { c.ingressController.ConfigSuccess(hash, success) } -func (c *collector) IncCheckCount(namespace string, name string) { +func (c *collector) IncCheckCount(namespace, name string) { c.ingressController.IncCheckCount(namespace, name) } -func (c *collector) IncCheckErrorCount(namespace string, name string) { +func (c *collector) IncCheckErrorCount(namespace, name string) { c.ingressController.IncCheckErrorCount(namespace, name) } @@ -183,11 +183,11 @@ func (c *collector) SetSSLInfo(servers []*ingress.Server) { c.ingressController.SetSSLInfo(servers) } -func (c *collector) IncOrphanIngress(namespace string, name string, orphanityType string) { +func (c *collector) IncOrphanIngress(namespace, name, orphanityType string) { c.ingressController.IncOrphanIngress(namespace, name, orphanityType) } -func (c *collector) DecOrphanIngress(namespace string, name string, orphanityType string) { +func (c *collector) DecOrphanIngress(namespace, name, orphanityType string) { c.ingressController.DecOrphanIngress(namespace, name, orphanityType) } @@ -195,7 +195,7 @@ func (c *collector) SetHosts(hosts sets.Set[string]) { c.socket.SetHosts(hosts) } -func (c *collector) SetAdmissionMetrics(testedIngressLength float64, testedIngressTime float64, renderingIngressLength float64, renderingIngressTime float64, testedConfigurationSize float64, admissionTime float64) { +func (c *collector) SetAdmissionMetrics(testedIngressLength, testedIngressTime, renderingIngressLength, renderingIngressTime, testedConfigurationSize, admissionTime float64) { c.admissionController.SetAdmissionMetrics( testedIngressLength, testedIngressTime, @@ -219,9 +219,7 @@ func (c *collector) OnStoppedLeading(electionID string) { c.ingressController.RemoveAllSSLMetrics(c.registry) } -var ( - currentLeader uint32 -) +var currentLeader uint32 func setLeader(leader bool) { var i uint32 diff --git a/internal/ingress/status/status.go b/internal/ingress/status/status.go index 62b88da16..81fb9044a 100644 --- a/internal/ingress/status/status.go +++ b/internal/ingress/status/status.go @@ -44,7 +44,7 @@ import ( // which the status should check if an update is required. var UpdateInterval = 60 -// Syncer ... +// Syncer is an interface that implements syncer type Syncer interface { Run(chan struct{}) @@ -56,7 +56,7 @@ type ingressLister interface { ListIngresses() []*ingress.Ingress } -// Config ... +// Config is a structure that implements Client interfaces type Config struct { Client clientset.Interface @@ -87,7 +87,7 @@ type statusSync struct { } // Start starts the loop to keep the status in sync -func (s statusSync) Run(stopCh chan struct{}) { +func (s *statusSync) Run(stopCh chan struct{}) { go s.syncQueue.Run(time.Second, stopCh) // trigger initial sync @@ -95,6 +95,7 @@ func (s statusSync) Run(stopCh chan struct{}) { // when this instance is the leader we need to enqueue // an item to trigger the update of the Ingress status. + //nolint:staticcheck // TODO: will replace it since wait.PollUntil is deprecated err := wait.PollUntil(time.Duration(UpdateInterval)*time.Second, func() (bool, error) { s.syncQueue.EnqueueTask(task.GetDummyObject("sync status")) return false, nil @@ -106,7 +107,7 @@ func (s statusSync) Run(stopCh chan struct{}) { // Shutdown stops the sync. In case the instance is the leader it will remove the current IP // if there is no other instances running. -func (s statusSync) Shutdown() { +func (s *statusSync) Shutdown() { go s.syncQueue.Shutdown() if !s.UpdateStatusOnShutdown { @@ -135,7 +136,7 @@ func (s statusSync) Shutdown() { s.updateStatus([]v1.IngressLoadBalancerIngress{}) } -func (s *statusSync) sync(key interface{}) error { +func (s *statusSync) sync(_ interface{}) error { if s.syncQueue.IsShuttingDown() { klog.V(2).InfoS("skipping Ingress status update (shutting down in progress)") return nil @@ -150,13 +151,13 @@ func (s *statusSync) sync(key interface{}) error { return nil } -func (s statusSync) keyfunc(input interface{}) (interface{}, error) { +func (s *statusSync) keyfunc(input interface{}) (interface{}, error) { return input, nil } // NewStatusSyncer returns a new Syncer instance func NewStatusSyncer(config Config) Syncer { - st := statusSync{ + st := &statusSync{ Config: config, } st.syncQueue = task.NewCustomTaskQueue(st.sync, st.keyfunc) @@ -229,7 +230,6 @@ func (s *statusSync) runningAddresses() ([]v1.IngressLoadBalancerIngress, error) } func (s *statusSync) isRunningMultiplePods() bool { - // As a standard, app.kubernetes.io are "reserved well-known" labels. // In our case, we add those labels as identifiers of the Ingress // deployment in this namespace, so we can select it as a set of Ingress instances. @@ -288,7 +288,8 @@ func (s *statusSync) updateStatus(newIngressPoint []v1.IngressLoadBalancerIngres } func runUpdate(ing *ingress.Ingress, status []v1.IngressLoadBalancerIngress, - client clientset.Interface) pool.WorkFunc { + client clientset.Interface, +) pool.WorkFunc { return func(wu pool.WorkUnit) (interface{}, error) { if wu.IsCancelled() { return nil, nil @@ -341,7 +342,10 @@ func ingressSliceEqual(lhs, rhs []v1.IngressLoadBalancerIngress) bool { } func statusAddressFromService(service string, kubeClient clientset.Interface) ([]v1.IngressLoadBalancerIngress, error) { - ns, name, _ := k8s.ParseNameNS(service) + ns, name, err := k8s.ParseNameNS(service) + if err != nil { + return nil, err + } svc, err := kubeClient.CoreV1().Services(ns).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return nil, err @@ -362,15 +366,15 @@ func statusAddressFromService(service string, kubeClient clientset.Interface) ([ IP: svc.Spec.ClusterIP, }}, nil } - addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Spec.ExternalIPs)) - for i, ip := range svc.Spec.ExternalIPs { - addrs[i] = v1.IngressLoadBalancerIngress{IP: ip} + addrs := make([]v1.IngressLoadBalancerIngress, 0, len(svc.Spec.ExternalIPs)) + for _, ip := range svc.Spec.ExternalIPs { + addrs = append(addrs, v1.IngressLoadBalancerIngress{IP: ip}) } return addrs, nil case apiv1.ServiceTypeLoadBalancer: - addrs := make([]v1.IngressLoadBalancerIngress, len(svc.Status.LoadBalancer.Ingress)) + addrs := make([]v1.IngressLoadBalancerIngress, 0, len(svc.Status.LoadBalancer.Ingress)) for i, ingress := range svc.Status.LoadBalancer.Ingress { - addrs[i] = v1.IngressLoadBalancerIngress{} + addrs = append(addrs, v1.IngressLoadBalancerIngress{}) if ingress.Hostname != "" { addrs[i].Hostname = ingress.Hostname } diff --git a/internal/ingress/status/status_test.go b/internal/ingress/status/status_test.go index ce6b6a0bf..01419708b 100644 --- a/internal/ingress/status/status_test.go +++ b/internal/ingress/status/status_test.go @@ -18,7 +18,6 @@ package status import ( "context" - "os" "reflect" "testing" "time" @@ -34,6 +33,8 @@ import ( "k8s.io/ingress-nginx/pkg/apis/ingress" ) +const localhost = "127.0.0.1" + func buildLoadBalancerIngressByIP() []networking.IngressLoadBalancerIngress { return []networking.IngressLoadBalancerIngress{ { @@ -126,17 +127,6 @@ func buildSimpleClientSet() *testclient.Clientset { // This is commented out as the ServiceStatus.LoadBalancer field expects a LoadBalancerStatus object // which is incompatible with the current Ingress struct which expects a IngressLoadBalancerStatus object // TODO: update this service when the ServiceStatus struct gets updated - //{ - // ObjectMeta: metav1.ObjectMeta{ - // Name: "foo", - // Namespace: apiv1.NamespaceDefault, - // }, - // Status: apiv1.ServiceStatus{ - // LoadBalancer: apiv1.LoadBalancerStatus{ - // Ingress: buildLoadBalancerIngressByIP(), - // }, - // }, - //}, { ObjectMeta: metav1.ObjectMeta{ Name: "foo_non_exist", @@ -185,7 +175,8 @@ func buildSimpleClientSet() *testclient.Clientset { Name: "ingress-controller-leader", Namespace: apiv1.NamespaceDefault, }, - }}}, + }, + }}, &networking.IngressList{Items: buildExtensionsIngresses()}, ) } @@ -245,30 +236,33 @@ func buildExtensionsIngresses() []networking.Ingress { } } -type testIngressLister struct { -} +type testIngressLister struct{} func (til *testIngressLister) ListIngresses() []*ingress.Ingress { var ingresses []*ingress.Ingress - ingresses = append(ingresses, &ingress.Ingress{ - Ingress: networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "foo_ingress_non_01", - Namespace: apiv1.NamespaceDefault, - }}}) - - ingresses = append(ingresses, &ingress.Ingress{ - Ingress: networking.Ingress{ - ObjectMeta: metav1.ObjectMeta{ - Name: "foo_ingress_1", - Namespace: apiv1.NamespaceDefault, - }, - Status: networking.IngressStatus{ - LoadBalancer: networking.IngressLoadBalancerStatus{ - Ingress: buildLoadBalancerIngressByIP(), + ingresses = append(ingresses, + &ingress.Ingress{ + Ingress: networking.Ingress{ + ObjectMeta: metav1.ObjectMeta{ + Name: "foo_ingress_non_01", + Namespace: apiv1.NamespaceDefault, }, }, - }}) + }, + &ingress.Ingress{ + Ingress: networking.Ingress{ + ObjectMeta: metav1.ObjectMeta{ + Name: "foo_ingress_1", + Namespace: apiv1.NamespaceDefault, + }, + Status: networking.IngressStatus{ + LoadBalancer: networking.IngressLoadBalancerStatus{ + Ingress: buildLoadBalancerIngressByIP(), + }, + }, + }, + }, + ) return ingresses } @@ -290,8 +284,8 @@ func buildStatusSync() statusSync { func TestStatusActions(t *testing.T) { // make sure election can be created - os.Setenv("POD_NAME", "foo1") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "foo1") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) c := Config{ Client: buildSimpleClientSet(), PublishService: "", @@ -315,7 +309,10 @@ func TestStatusActions(t *testing.T) { t.Fatalf("expected a valid Sync") } - fk := fkSync.(statusSync) + fk, ok := fkSync.(*statusSync) + if !ok { + t.Errorf("unexpected type: %T", fkSync) + } // start it and wait for the election and syn actions stopCh := make(chan struct{}) @@ -366,7 +363,7 @@ func TestStatusActions(t *testing.T) { } } -func TestCallback(t *testing.T) { +func TestCallback(_ *testing.T) { buildStatusSync() } @@ -375,7 +372,6 @@ func TestKeyfunc(t *testing.T) { i := "foo_base_pod" r, err := fk.keyfunc(i) - if err != nil { t.Fatalf("unexpected error") } @@ -392,34 +388,36 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }{ "service type ClusterIP": { testclient.NewSimpleClientset( - &apiv1.PodList{Items: []apiv1.Pod{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.PodSpec{ - NodeName: "foo_node", - }, - Status: apiv1.PodStatus{ - Phase: apiv1.PodRunning, + &apiv1.PodList{ + Items: []apiv1.Pod{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.PodSpec{ + NodeName: "foo_node", + }, + Status: apiv1.PodStatus{ + Phase: apiv1.PodRunning, + }, }, }, }, - }, - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeClusterIP, - ClusterIP: "1.1.1.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeClusterIP, + ClusterIP: "1.1.1.1", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, @@ -428,19 +426,20 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type NodePort": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeNodePort, - ClusterIP: "1.1.1.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeNodePort, + ClusterIP: "1.1.1.1", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "1.1.1.1"}, @@ -449,19 +448,20 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type ExternalName": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeExternalName, - ExternalName: "foo.bar", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeExternalName, + ExternalName: "foo.bar", + }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {Hostname: "foo.bar"}, @@ -470,35 +470,36 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type LoadBalancer": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeLoadBalancer, - }, - Status: apiv1.ServiceStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ - { - IP: "10.0.0.1", - }, - { - IP: "", - Hostname: "foo", - }, - { - IP: "10.0.0.2", - Hostname: "10-0-0-2.cloudprovider.example.net", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeLoadBalancer, + }, + Status: apiv1.ServiceStatus{ + LoadBalancer: apiv1.LoadBalancerStatus{ + Ingress: []apiv1.LoadBalancerIngress{ + { + IP: "10.0.0.1", + }, + { + IP: "", + Hostname: "foo", + }, + { + IP: "10.0.0.2", + Hostname: "10-0-0-2.cloudprovider.example.net", + }, }, }, }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, @@ -512,28 +513,29 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "service type LoadBalancer with same externalIP and ingress IP": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, - }, - Spec: apiv1.ServiceSpec{ - Type: apiv1.ServiceTypeLoadBalancer, - ExternalIPs: []string{"10.0.0.1"}, - }, - Status: apiv1.ServiceStatus{ - LoadBalancer: apiv1.LoadBalancerStatus{ - Ingress: []apiv1.LoadBalancerIngress{ - { - IP: "10.0.0.1", + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, + Spec: apiv1.ServiceSpec{ + Type: apiv1.ServiceTypeLoadBalancer, + ExternalIPs: []string{"10.0.0.1"}, + }, + Status: apiv1.ServiceStatus{ + LoadBalancer: apiv1.LoadBalancerStatus{ + Ingress: []apiv1.LoadBalancerIngress{ + { + IP: "10.0.0.1", + }, }, }, }, }, }, }, - }, ), []networking.IngressLoadBalancerIngress{ {IP: "10.0.0.1"}, @@ -542,15 +544,16 @@ func TestRunningAddressesWithPublishService(t *testing.T) { }, "invalid service type": { testclient.NewSimpleClientset( - &apiv1.ServiceList{Items: []apiv1.Service{ - { - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: apiv1.NamespaceDefault, + &apiv1.ServiceList{ + Items: []apiv1.Service{ + { + ObjectMeta: metav1.ObjectMeta{ + Name: "foo", + Namespace: apiv1.NamespaceDefault, + }, }, }, }, - }, ), nil, true, @@ -559,7 +562,6 @@ func TestRunningAddressesWithPublishService(t *testing.T) { for title, tc := range testCases { t.Run(title, func(t *testing.T) { - fk := buildStatusSync() fk.Config.Client = tc.fakeClient @@ -587,7 +589,11 @@ func TestRunningAddressesWithPods(t *testing.T) { fk := buildStatusSync() fk.PublishService = "" - r, _ := fk.runningAddresses() + r, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } + if r == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -603,9 +609,12 @@ func TestRunningAddressesWithPods(t *testing.T) { func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { fk := buildStatusSync() - fk.PublishStatusAddress = "127.0.0.1" + fk.PublishStatusAddress = localhost - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -614,8 +623,8 @@ func TestRunningAddressesWithPublishStatusAddress(t *testing.T) { t.Errorf("returned %v but expected %v", rl, 1) } rv := ra[0] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } } @@ -623,7 +632,10 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { fk := buildStatusSync() fk.PublishStatusAddress = "127.0.0.1,1.1.1.1" - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngress") } @@ -633,8 +645,8 @@ func TestRunningAddressesWithPublishStatusAddresses(t *testing.T) { } rv := ra[0] rv2 := ra[1] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } if rv2.IP != "1.1.1.1" { t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) @@ -645,7 +657,10 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { fk := buildStatusSync() fk.PublishStatusAddress = "127.0.0.1, 1.1.1.1" - ra, _ := fk.runningAddresses() + ra, err := fk.runningAddresses() + if err != nil { + t.Errorf("unexpected error: %v", err) + } if ra == nil { t.Fatalf("returned nil but expected valid []networking.IngressLoadBalancerIngresst") } @@ -655,8 +670,8 @@ func TestRunningAddressesWithPublishStatusAddressesAndSpaces(t *testing.T) { } rv := ra[0] rv2 := ra[1] - if rv.IP != "127.0.0.1" { - t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: "127.0.0.1"}) + if rv.IP != localhost { + t.Errorf("returned %v but expected %v", rv, networking.IngressLoadBalancerIngress{IP: localhost}) } if rv2.IP != "1.1.1.1" { t.Errorf("returned %v but expected %v", rv2, networking.IngressLoadBalancerIngress{IP: "1.1.1.1"}) diff --git a/internal/k8s/main.go b/internal/k8s/main.go index d61013a9f..5e93e560d 100644 --- a/internal/k8s/main.go +++ b/internal/k8s/main.go @@ -33,7 +33,7 @@ import ( ) // ParseNameNS parses a string searching a namespace and name -func ParseNameNS(input string) (string, string, error) { +func ParseNameNS(input string) (ns, name string, err error) { nsName := strings.Split(input, "/") if len(nsName) != 2 { return "", "", fmt.Errorf("invalid format (namespace/name) found in '%v'", input) @@ -148,7 +148,10 @@ const IngressNGINXController = "k8s.io/ingress-nginx" // NetworkingIngressAvailable checks if the package "k8s.io/api/networking/v1" // is available or not and if Ingress V1 is supported (k8s >= v1.19.0) func NetworkingIngressAvailable(client clientset.Interface) bool { - version119, _ := version.ParseGeneric("v1.19.0") + version119, err := version.ParseGeneric("v1.19.0") + if err != nil { + return false + } serverVersion, err := client.Discovery().ServerVersion() if err != nil { diff --git a/internal/k8s/main_test.go b/internal/k8s/main_test.go index f3f8b652e..1721c1fb2 100644 --- a/internal/k8s/main_test.go +++ b/internal/k8s/main_test.go @@ -17,7 +17,6 @@ limitations under the License. package k8s import ( - "os" "testing" apiv1 "k8s.io/api/core/v1" @@ -203,7 +202,8 @@ func TestGetNodeIP(t *testing.T) { }, }, }}}), - "demo", "10.0.0.2", true}, + "demo", "10.0.0.2", true, + }, } for _, fk := range fKNodes { @@ -216,32 +216,32 @@ func TestGetNodeIP(t *testing.T) { func TestGetIngressPod(t *testing.T) { // POD_NAME & POD_NAMESPACE not exist - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", "") err := GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD_NAME not exist - os.Setenv("POD_NAME", "") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD_NAMESPACE not exist - os.Setenv("POD_NAME", "testpod") - os.Setenv("POD_NAMESPACE", "") + t.Setenv("POD_NAME", "testpod") + t.Setenv("POD_NAMESPACE", "") err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") } // POD not exist - os.Setenv("POD_NAME", "testpod") - os.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) + t.Setenv("POD_NAME", "testpod") + t.Setenv("POD_NAMESPACE", apiv1.NamespaceDefault) err = GetIngressPod(testclient.NewSimpleClientset()) if err == nil { t.Errorf("expected an error but returned nil") diff --git a/internal/net/dns/dns.go b/internal/net/dns/dns.go index 7dfbbd177..6b250e8cb 100644 --- a/internal/net/dns/dns.go +++ b/internal/net/dns/dns.go @@ -38,7 +38,7 @@ func GetSystemNameServers() ([]net.IP, error) { lines := strings.Split(string(file), "\n") for l := range lines { trimmed := strings.TrimSpace(lines[l]) - if len(trimmed) == 0 || trimmed[0] == '#' || trimmed[0] == ';' { + if trimmed == "" || trimmed[0] == '#' || trimmed[0] == ';' { continue } fields := strings.Fields(trimmed) diff --git a/internal/net/ipnet_test.go b/internal/net/ipnet_test.go index 95e6b9c32..8e460aae9 100644 --- a/internal/net/ipnet_test.go +++ b/internal/net/ipnet_test.go @@ -36,13 +36,17 @@ func TestNewIPSet(t *testing.T) { } func TestParseCIDRs(t *testing.T) { - cidr, _ := ParseCIDRs("invalid.com") + cidr, err := ParseCIDRs("invalid.com") + if err == nil { + t.Errorf("expected error but got nil") + } + if cidr != nil { t.Errorf("expected %v but got %v", nil, cidr) } expected := []string{"192.0.0.1", "192.0.1.0/24"} - cidr, err := ParseCIDRs("192.0.0.1, 192.0.1.0/24") + cidr, err = ParseCIDRs("192.0.0.1, 192.0.1.0/24") if err != nil { t.Errorf("unexpected error %v", err) } diff --git a/internal/net/net.go b/internal/net/net.go index 712262f3a..b0952d9cc 100644 --- a/internal/net/net.go +++ b/internal/net/net.go @@ -30,11 +30,12 @@ func IsIPV6(ip _net.IP) bool { // IsPortAvailable checks if a TCP port is available or not func IsPortAvailable(p int) bool { ln, err := _net.Listen("tcp", fmt.Sprintf(":%v", p)) - if err != nil { - return false - } - defer ln.Close() - return true + defer func() { + if ln != nil { + ln.Close() + } + }() + return err == nil } // IsIPv6Enabled checks if IPV6 is enabled or not and we have @@ -51,7 +52,10 @@ func IsIPv6Enabled() bool { } for _, addr := range addrs { - ip, _, _ := _net.ParseCIDR(addr.String()) + ip, _, err := _net.ParseCIDR(addr.String()) + if err != nil { + return false + } if IsIPV6(ip) { return true } diff --git a/internal/net/net_test.go b/internal/net/net_test.go index f2f37a838..f7a4f52e1 100644 --- a/internal/net/net_test.go +++ b/internal/net/net_test.go @@ -47,7 +47,7 @@ func TestIsPortAvailable(t *testing.T) { t.Fatal("expected port 0 to be available (random port) but returned false") } - ln, err := net.Listen("tcp", ":0") + ln, err := net.Listen("tcp", ":0") //nolint:gosec // Ignore the gosec error in testing if err != nil { t.Fatalf("unexpected error: %v", err) } diff --git a/internal/net/ssl/ssl.go b/internal/net/ssl/ssl.go index c74537fe9..516b1ec9c 100644 --- a/internal/net/ssl/ssl.go +++ b/internal/net/ssl/ssl.go @@ -52,17 +52,15 @@ import ( // certificate generated by the ingress controller var FakeSSLCertificateUID = "00000000-0000-0000-0000-000000000000" -var ( - oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} -) +var oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} const ( fakeCertificateName = "default-fake-certificate" ) // getPemFileName returns absolute file path and file name of pem cert related to given fullSecretName -func getPemFileName(fullSecretName string) (string, string) { - pemName := fmt.Sprintf("%v.pem", fullSecretName) +func getPemFileName(fullSecretName string) (filePath, pemName string) { + pemName = fmt.Sprintf("%v.pem", fullSecretName) return fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, pemName), pemName } @@ -192,7 +190,7 @@ func StoreSSLCertOnDisk(name string, sslCert *ingress.SSLCert) (string, error) { // ConfigureCACertWithCertAndKey appends ca into existing PEM file consisting of cert and key // and sets relevant fields in sslCert object -func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLCert) error { +func ConfigureCACertWithCertAndKey(_ string, ca []byte, sslCert *ingress.SSLCert) error { var buffer bytes.Buffer _, err := buffer.WriteString(sslCert.PemCertKey) @@ -210,12 +208,12 @@ func ConfigureCACertWithCertAndKey(name string, ca []byte, sslCert *ingress.SSLC return fmt.Errorf("could not write ca data to cert file %v: %v", sslCert.CAFileName, err) } - return os.WriteFile(sslCert.CAFileName, buffer.Bytes(), 0644) + //nolint:gosec // Not change permission to avoid possible issues + return os.WriteFile(sslCert.CAFileName, buffer.Bytes(), 0o644) } // ConfigureCRL creates a CRL file and append it into the SSLCert func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { - crlName := fmt.Sprintf("crl-%v.pem", name) crlFileName := fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, crlName) @@ -230,10 +228,11 @@ func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { _, err := x509.ParseRevocationList(pemCRLBlock.Bytes) if err != nil { - return fmt.Errorf(err.Error()) + return err } - err = os.WriteFile(crlFileName, crl, 0644) + //nolint:gosec // Not change permission to avoid possible issues + err = os.WriteFile(crlFileName, crl, 0o644) if err != nil { return fmt.Errorf("could not write CRL file %v: %v", crlFileName, err) } @@ -242,7 +241,6 @@ func ConfigureCRL(name string, crl []byte, sslCert *ingress.SSLCert) error { sslCert.CRLSHA = file.SHA1(crlFileName) return nil - } // ConfigureCACert is similar to ConfigureCACertWithCertAndKey but it creates a separate file @@ -251,7 +249,8 @@ func ConfigureCACert(name string, ca []byte, sslCert *ingress.SSLCert) error { caName := fmt.Sprintf("ca-%v.pem", name) fileName := fmt.Sprintf("%v/%v", file.DefaultSSLDirectory, caName) - err := os.WriteFile(fileName, ca, 0644) + //nolint:gosec // Not change permission to avoid possible issues + err := os.WriteFile(fileName, ca, 0o644) if err != nil { return fmt.Errorf("could not write CA file %v: %v", fileName, err) } @@ -293,14 +292,14 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre var seq asn1.RawValue var rest []byte if rest, err = asn1.Unmarshal(value, &seq); err != nil { - return + return dnsNames, emailAddresses, ipAddresses, err } else if len(rest) != 0 { err = errors.New("x509: trailing data after X.509 extension") - return + return dnsNames, emailAddresses, ipAddresses, err } if !seq.IsCompound || seq.Tag != 16 || seq.Class != 0 { err = asn1.StructuralError{Msg: "bad SAN sequence"} - return + return dnsNames, emailAddresses, ipAddresses, err } rest = seq.Bytes @@ -308,7 +307,7 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre var v asn1.RawValue rest, err = asn1.Unmarshal(rest, &v) if err != nil { - return + return dnsNames, emailAddresses, ipAddresses, err } switch v.Tag { case 1: @@ -321,12 +320,12 @@ func parseSANExtension(value []byte) (dnsNames, emailAddresses []string, ipAddre ipAddresses = append(ipAddresses, v.Bytes) default: err = errors.New("x509: certificate contained IP address of length " + strconv.Itoa(len(v.Bytes))) - return + return dnsNames, emailAddresses, ipAddresses, err } } } - return + return dnsNames, emailAddresses, ipAddresses, err } // AddOrUpdateDHParam creates a dh parameters file with the specified name @@ -396,7 +395,7 @@ func GetFakeSSLCert() *ingress.SSLCert { return sslCert } -func getFakeHostSSLCert(host string) ([]byte, []byte) { +func getFakeHostSSLCert(host string) (cert, key []byte) { var priv interface{} var err error @@ -412,7 +411,6 @@ func getFakeHostSSLCert(host string) ([]byte, []byte) { serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) - if err != nil { klog.Fatalf("failed to generate fake serial number: %v", err) } @@ -436,9 +434,9 @@ func getFakeHostSSLCert(host string) ([]byte, []byte) { klog.Fatalf("Failed to create fake certificate: %v", err) } - cert := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) + cert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) - key := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv.(*rsa.PrivateKey))}) + key = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv.(*rsa.PrivateKey))}) return cert, key } @@ -508,9 +506,14 @@ func NewTLSListener(certificate, key string) *TLSListener { l.load() - _, _ = file.NewFileWatcher(certificate, l.load) - _, _ = file.NewFileWatcher(key, l.load) - + _, err := file.NewFileWatcher(certificate, l.load) + if err != nil { + klog.Errorf("unexpected error: %v", err) + } + _, err = file.NewFileWatcher(key, l.load) + if err != nil { + klog.Errorf("unexpected error: %v", err) + } return &l } diff --git a/internal/net/ssl/ssl_test.go b/internal/net/ssl/ssl_test.go index a86ecb87a..9f8c5eeae 100644 --- a/internal/net/ssl/ssl_test.go +++ b/internal/net/ssl/ssl_test.go @@ -42,7 +42,7 @@ import ( ) // generateRSACerts generates a self signed certificate using a self generated ca -func generateRSACerts(host string) (*keyPair, *keyPair, error) { +func generateRSACerts(host string) (newCert, newCa *keyPair, err error) { ca, err := newCA("self-sign-ca") if err != nil { return nil, nil, err @@ -57,7 +57,7 @@ func generateRSACerts(host string) (*keyPair, *keyPair, error) { CommonName: host, Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}, } - cert, err := newSignedCert(config, key, ca.Cert, ca.Key) + cert, err := newSignedCert(&config, key, ca.Cert, ca.Key) if err != nil { return nil, nil, fmt.Errorf("unable to sign the server certificate: %v", err) } @@ -139,11 +139,11 @@ func TestCACert(t *testing.T) { func TestGetFakeSSLCert(t *testing.T) { sslCert := GetFakeSSLCert() - if len(sslCert.PemCertKey) == 0 { + if sslCert.PemCertKey == "" { t.Fatalf("expected PemCertKey to not be empty") } - if len(sslCert.PemFileName) == 0 { + if sslCert.PemFileName == "" { t.Fatalf("expected PemFileName to not be empty") } @@ -195,7 +195,7 @@ func TestConfigureCRL(t *testing.T) { // Demo CRL from https://csrc.nist.gov/projects/pki-testing/sample-certificates-and-crls // Converted to PEM to be tested // SHA: ef21f9c97ec2ef84ba3b2ab007c858a6f760d813 - var crl = []byte(`-----BEGIN X509 CRL----- + crl := []byte(`-----BEGIN X509 CRL----- MIIBYDCBygIBATANBgkqhkiG9w0BAQUFADBDMRMwEQYKCZImiZPyLGQBGRYDY29t MRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTETMBEGA1UEAxMKRXhhbXBsZSBDQRcN MDUwMjA1MTIwMDAwWhcNMDUwMjA2MTIwMDAwWjAiMCACARIXDTA0MTExOTE1NTcw @@ -237,6 +237,7 @@ fUNCdMGmr8FVF6IzTNYGmCuk/C4= t.Fatalf("the expected CRL SHA wasn't found") } } + func TestCreateSSLCert(t *testing.T) { cert, _, err := generateRSACerts("echoheaders") if err != nil { @@ -339,12 +340,12 @@ func newPrivateKey() (*rsa.PrivateKey, error) { } // newSignedCert creates a signed certificate using the given CA certificate and key -func newSignedCert(cfg certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, error) { +func newSignedCert(cfg *certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, error) { serial, err := rand.Int(rand.Reader, new(big.Int).SetInt64(math.MaxInt64)) if err != nil { return nil, err } - if len(cfg.CommonName) == 0 { + if cfg.CommonName == "" { return nil, errors.New("must specify a CommonName") } if len(cfg.Usages) == 0 { @@ -389,7 +390,7 @@ func encodeCertPEM(cert *x509.Certificate) []byte { return pem.EncodeToMemory(&block) } -func newFakeCertificate(t *testing.T) ([]byte, string, string) { +func newFakeCertificate(t *testing.T) (sslCert []byte, certFileName, keyFileName string) { cert, key := getFakeHostSSLCert("localhost") certFile, err := os.CreateTemp("", "crt-") @@ -423,10 +424,9 @@ func dialTestServer(port string, rootCertificates ...[]byte) error { return fmt.Errorf("failed to add root certificate") } } - resp, err := tls.Dial("tcp", "localhost:"+port, &tls.Config{ + resp, err := tls.Dial("tcp", "localhost:"+port, &tls.Config{ //nolint:gosec // Ignore the gosec error in testing RootCAs: roots, }) - if err != nil { return err } @@ -473,15 +473,14 @@ func TestTLSKeyReloader(t *testing.T) { } }) - //TODO: fix - /* - // simulate watch.NewFileWatcher to call the load function - watcher.load() - t.Run("when the certificate is reloaded", func(t *testing.T) { - if err := dialTestServer(port, cert); err != nil { - t.Errorf("TLS dial should succeed, got error: %v", err) - } - }) + /*TODO: fix + // simulate watch.NewFileWatcher to call the load function + watcher.load() + t.Run("when the certificate is reloaded", func(t *testing.T) { + if err := dialTestServer(port, cert); err != nil { + t.Errorf("TLS dial should succeed, got error: %v", err) + } + }) */ }) } diff --git a/internal/nginx/main.go b/internal/nginx/main.go index ae319fe1f..fc586e9e8 100644 --- a/internal/nginx/main.go +++ b/internal/nginx/main.go @@ -62,7 +62,7 @@ var StatusPath = "/nginx_status" var StreamPort = 10247 // NewGetStatusRequest creates a new GET request to the internal NGINX status server -func NewGetStatusRequest(path string) (int, []byte, error) { +func NewGetStatusRequest(path string) (statusCode int, data []byte, err error) { url := fmt.Sprintf("http://127.0.0.1:%v%v", StatusPort, path) client := http.Client{} @@ -72,7 +72,7 @@ func NewGetStatusRequest(path string) (int, []byte, error) { } defer res.Body.Close() - data, err := io.ReadAll(res.Body) + data, err = io.ReadAll(res.Body) if err != nil { return 0, nil, err } @@ -81,7 +81,7 @@ func NewGetStatusRequest(path string) (int, []byte, error) { } // NewPostStatusRequest creates a new POST request to the internal NGINX status server -func NewPostStatusRequest(path, contentType string, data interface{}) (int, []byte, error) { +func NewPostStatusRequest(path, contentType string, data interface{}) (statusCode int, body []byte, err error) { url := fmt.Sprintf("http://127.0.0.1:%v%v", StatusPort, path) buf, err := json.Marshal(data) @@ -96,7 +96,7 @@ func NewPostStatusRequest(path, contentType string, data interface{}) (int, []by } defer res.Body.Close() - body, err := io.ReadAll(res.Body) + body, err = io.ReadAll(res.Body) if err != nil { return 0, nil, err } @@ -105,7 +105,7 @@ func NewPostStatusRequest(path, contentType string, data interface{}) (int, []by } // GetServerBlock takes an nginx.conf file and a host and tries to find the server block for that host -func GetServerBlock(conf string, host string) (string, error) { +func GetServerBlock(conf, host string) (string, error) { startMsg := fmt.Sprintf("## start server %v\n", host) endMsg := fmt.Sprintf("## end server %v", host) @@ -113,7 +113,7 @@ func GetServerBlock(conf string, host string) (string, error) { if blockStart < 0 { return "", fmt.Errorf("host %v was not found in the controller's nginx.conf", host) } - blockStart = blockStart + len(startMsg) + blockStart += len(startMsg) blockEnd := strings.Index(conf, endMsg) if blockEnd < 0 { @@ -163,7 +163,10 @@ func Version() string { // IsRunning returns true if a process with the name 'nginx' is found func IsRunning() bool { - processes, _ := ps.Processes() + processes, err := ps.Processes() + if err != nil { + klog.ErrorS(err, "unexpected error obtaining process list") + } for _, p := range processes { if p.Executable() == "nginx" { return true diff --git a/internal/nginx/maxmind.go b/internal/nginx/maxmind.go index 5aee414cd..bd6bc1048 100644 --- a/internal/nginx/maxmind.go +++ b/internal/nginx/maxmind.go @@ -101,7 +101,7 @@ func DownloadGeoLite2DB(attempts int, period time.Duration) error { var lastErr error retries := 0 - _ = wait.ExponentialBackoff(defaultRetry, func() (bool, error) { + lastErr = wait.ExponentialBackoff(defaultRetry, func() (bool, error) { var dlError error for _, dbName := range strings.Split(MaxmindEditionIDs, ",") { dlError = downloadDatabase(dbName) @@ -139,8 +139,8 @@ func createURL(mirror, licenseKey, dbName string) string { } func downloadDatabase(dbName string) error { - url := createURL(MaxmindMirror, MaxmindLicenseKey, dbName) - req, err := http.NewRequest(http.MethodGet, url, nil) + newURL := createURL(MaxmindMirror, MaxmindLicenseKey, dbName) + req, err := http.NewRequest(http.MethodGet, newURL, http.NoBody) if err != nil { return err } @@ -175,8 +175,7 @@ func downloadDatabase(dbName string) error { return err } - switch header.Typeflag { - case tar.TypeReg: + if header.Typeflag == tar.TypeReg { if !strings.HasSuffix(header.Name, mmdbFile) { continue } @@ -186,6 +185,7 @@ func downloadDatabase(dbName string) error { return err } + //nolint:gocritic // TODO: will fix it on a followup PR defer outFile.Close() if _, err := io.CopyN(outFile, tarReader, header.Size); err != nil { diff --git a/internal/task/queue.go b/internal/task/queue.go index ff6b20f62..f92f2a501 100644 --- a/internal/task/queue.go +++ b/internal/task/queue.go @@ -28,9 +28,7 @@ import ( "k8s.io/client-go/util/workqueue" ) -var ( - keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc -) +var keyFunc = cache.DeletionHandlingMetaNamespaceKeyFunc // Queue manages a time work queue through an independent worker that invokes the // given sync function for every work item inserted. @@ -117,7 +115,10 @@ func (t *Queue) worker() { } ts := time.Now().UnixNano() - item := key.(Element) + item, ok := key.(Element) + if !ok { + klog.ErrorS(nil, "invalid item type", "key", key) + } if item.Timestamp != 0 && t.lastSync > item.Timestamp { klog.V(3).InfoS("skipping sync", "key", item.Key, "last", t.lastSync, "now", item.Timestamp) t.queue.Forget(key) @@ -168,7 +169,7 @@ func NewTaskQueue(syncFn func(interface{}) error) *Queue { return NewCustomTaskQueue(syncFn, nil) } -// NewCustomTaskQueue ... +// NewCustomTaskQueue creates a new custom task queue with the given sync function. func NewCustomTaskQueue(syncFn func(interface{}) error, fn func(interface{}) (interface{}, error)) *Queue { q := &Queue{ queue: workqueue.NewRateLimitingQueue(workqueue.DefaultControllerRateLimiter()), diff --git a/pkg/apis/ingress/sslcert.go b/pkg/apis/ingress/sslcert.go index 7dee3880d..b340b2d9a 100644 --- a/pkg/apis/ingress/sslcert.go +++ b/pkg/apis/ingress/sslcert.go @@ -66,12 +66,12 @@ type SSLCert struct { } // GetObjectKind implements the ObjectKind interface as a noop -func (s SSLCert) GetObjectKind() schema.ObjectKind { +func (s *SSLCert) GetObjectKind() schema.ObjectKind { return schema.EmptyObjectKind } // Identifier returns a the couple issuer / serial number if they both exist, an empty string otherwise -func (s SSLCert) Identifier() string { +func (s *SSLCert) Identifier() string { if s.Certificate != nil { if s.Certificate.SerialNumber != nil { return fmt.Sprintf("%s-%s", s.Certificate.Issuer.SerialNumber, s.Certificate.SerialNumber.String()) @@ -81,7 +81,7 @@ func (s SSLCert) Identifier() string { } // HashInclude defines if a field should be used or not to calculate the hash -func (s SSLCert) HashInclude(field string, v interface{}) (bool, error) { +func (s *SSLCert) HashInclude(field string, _ interface{}) (bool, error) { switch field { case "PemSHA", "CASHA", "ExpireTime": return true, nil diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index 284e9b427..0742e9f3b 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -73,7 +73,7 @@ type Configuration struct { DefaultSSLCertificate *SSLCert `json:"-"` - StreamSnippets []string + StreamSnippets []string `json:"StreamSnippets"` } // Backend describes one or more remote server/s (endpoints) associated with a service @@ -129,7 +129,7 @@ type TrafficShapingPolicy struct { } // HashInclude defines if a field should be used or not to calculate the hash -func (s Backend) HashInclude(field string, v interface{}) (bool, error) { +func (b *Backend) HashInclude(field string, _ interface{}) (bool, error) { switch field { case "Endpoints": return false, nil @@ -410,5 +410,4 @@ type Ingress struct { } // GeneralConfig holds the definition of lua general configuration data -type GeneralConfig struct { -} +type GeneralConfig struct{} diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index c87f5ba3e..45f0eedba 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -80,58 +80,58 @@ func (c1 *Configuration) Equal(c2 *Configuration) bool { } // Equal tests for equality between two Backend types -func (b1 *Backend) Equal(b2 *Backend) bool { - if b1 == b2 { +func (b *Backend) Equal(newB *Backend) bool { + if b == newB { return true } - if b1 == nil || b2 == nil { + if b == nil || newB == nil { return false } - if b1.Name != b2.Name { + if b.Name != newB.Name { return false } - if b1.NoServer != b2.NoServer { + if b.NoServer != newB.NoServer { return false } - if b1.Service != b2.Service { - if b1.Service == nil || b2.Service == nil { + if b.Service != newB.Service { + if b.Service == nil || newB.Service == nil { return false } - if b1.Service.GetNamespace() != b2.Service.GetNamespace() { + if b.Service.GetNamespace() != newB.Service.GetNamespace() { return false } - if b1.Service.GetName() != b2.Service.GetName() { + if b.Service.GetName() != newB.Service.GetName() { return false } } - if b1.Port != b2.Port { + if b.Port != newB.Port { return false } - if b1.SSLPassthrough != b2.SSLPassthrough { + if b.SSLPassthrough != newB.SSLPassthrough { return false } - if !(&b1.SessionAffinity).Equal(&b2.SessionAffinity) { + if !(&b.SessionAffinity).Equal(&newB.SessionAffinity) { return false } - if b1.UpstreamHashBy != b2.UpstreamHashBy { + if b.UpstreamHashBy != newB.UpstreamHashBy { return false } - if b1.LoadBalancing != b2.LoadBalancing { + if b.LoadBalancing != newB.LoadBalancing { return false } - match := compareEndpoints(b1.Endpoints, b2.Endpoints) + match := compareEndpoints(b.Endpoints, newB.Endpoints) if !match { return false } - if !b1.TrafficShapingPolicy.Equal(b2.TrafficShapingPolicy) { + if !b.TrafficShapingPolicy.Equal(&newB.TrafficShapingPolicy) { return false } - return sets.StringElementsMatch(b1.AlternativeBackends, b2.AlternativeBackends) + return sets.StringElementsMatch(b.AlternativeBackends, newB.AlternativeBackends) } // Equal tests for equality between two SessionAffinityConfig types @@ -243,7 +243,7 @@ func (e1 *Endpoint) Equal(e2 *Endpoint) bool { } // Equal checks for equality between two TrafficShapingPolicies -func (tsp1 TrafficShapingPolicy) Equal(tsp2 TrafficShapingPolicy) bool { +func (tsp1 *TrafficShapingPolicy) Equal(tsp2 *TrafficShapingPolicy) bool { if tsp1.Weight != tsp2.Weight { return false } @@ -335,6 +335,8 @@ func (s1 *Server) Equal(s2 *Server) bool { } // Equal tests for equality between two Location types +// +//nolint:gocyclo // Ignore function complexity error func (l1 *Location) Equal(l2 *Location) bool { if l1 == l2 { return true @@ -550,39 +552,39 @@ func (l4b1 *L4Backend) Equal(l4b2 *L4Backend) bool { } // Equal tests for equality between two SSLCert types -func (s1 *SSLCert) Equal(s2 *SSLCert) bool { - if s1 == s2 { +func (s *SSLCert) Equal(newS *SSLCert) bool { + if s == newS { return true } - if s1 == nil || s2 == nil { + if s == nil || newS == nil { return false } - if s1.CASHA != s2.CASHA { + if s.CASHA != newS.CASHA { return false } - if s1.CRLSHA != s2.CRLSHA { + if s.CRLSHA != newS.CRLSHA { return false } - if s1.PemSHA != s2.PemSHA { + if s.PemSHA != newS.PemSHA { return false } - if s1.CAFileName != s2.CAFileName { + if s.CAFileName != newS.CAFileName { return false } - if s1.CRLFileName != s2.CRLFileName { + if s.CRLFileName != newS.CRLFileName { return false } - if !s1.ExpireTime.Equal(s2.ExpireTime) { + if !s.ExpireTime.Equal(newS.ExpireTime) { return false } - if s1.PemCertKey != s2.PemCertKey { + if s.PemCertKey != newS.PemCertKey { return false } - if s1.UID != s2.UID { + if s.UID != newS.UID { return false } - return sets.StringElementsMatch(s1.CN, s2.CN) + return sets.StringElementsMatch(s.CN, newS.CN) } var compareEndpointsFunc = func(e1, e2 interface{}) bool { diff --git a/pkg/apis/ingress/types_equals_test.go b/pkg/apis/ingress/types_equals_test.go index 78d29d46c..53643f912 100644 --- a/pkg/apis/ingress/types_equals_test.go +++ b/pkg/apis/ingress/types_equals_test.go @@ -25,19 +25,29 @@ import ( ) func TestEqualConfiguration(t *testing.T) { - ap, _ := filepath.Abs("../../../test/manifests/configuration-a.json") + ap, err := filepath.Abs("../../../test/manifests/configuration-a.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } a, err := readJSON(ap) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) } - bp, _ := filepath.Abs("../../../test/manifests/configuration-b.json") + bp, err := filepath.Abs("../../../test/manifests/configuration-b.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } + b, err := readJSON(bp) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) } - cp, _ := filepath.Abs("../../../test/manifests/configuration-c.json") + cp, err := filepath.Abs("../../../test/manifests/configuration-c.json") + if err != nil { + t.Errorf("unexpected error: %v", err) + } c, err := readJSON(cp) if err != nil { t.Errorf("unexpected error reading JSON file: %v", err) @@ -84,15 +94,18 @@ func TestL4ServiceElementsMatch(t *testing.T) { {[]L4Service{{Port: 80}}, []L4Service{{Port: 80}}, true}, { []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}}}, + }, []L4Service{{Port: 80}}, false, }, { []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}, {Address: "1.1.1.2"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.1"}, {Address: "1.1.1.2"}}}, + }, []L4Service{ - {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.2"}, {Address: "1.1.1.1"}}}}, + {Port: 80, Endpoints: []Endpoint{{Address: "1.1.1.2"}, {Address: "1.1.1.1"}}}, + }, true, }, { diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 55d24f690..d3bc4ee86 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -298,12 +298,12 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g nginx.HealthCheckTimeout = time.Duration(*defHealthCheckTimeout) * time.Second } - if len(*watchNamespace) != 0 && len(*watchNamespaceSelector) != 0 { + if *watchNamespace != "" && *watchNamespaceSelector != "" { return false, nil, fmt.Errorf("flags --watch-namespace and --watch-namespace-selector are mutually exclusive") } var namespaceSelector labels.Selector - if len(*watchNamespaceSelector) != 0 { + if *watchNamespaceSelector != "" { var err error namespaceSelector, err = labels.Parse(*watchNamespaceSelector) if err != nil { @@ -311,7 +311,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g } } - var histogramBuckets = &collectors.HistogramBuckets{ + histogramBuckets := &collectors.HistogramBuckets{ TimeBuckets: *timeBuckets, LengthBuckets: *lengthBuckets, SizeBuckets: *sizeBuckets, @@ -360,7 +360,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g HTTPS: *httpsPort, SSLProxy: *sslProxyPort, }, - IngressClassConfiguration: &ingressclass.IngressClassConfiguration{ + IngressClassConfiguration: &ingressclass.Configuration{ Controller: *ingressClassController, AnnotationValue: *ingressClassAnnotation, WatchWithoutClass: *watchWithoutClass, @@ -380,7 +380,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g var err error if nginx.MaxmindEditionIDs != "" { - if err = nginx.ValidateGeoLite2DBEditions(); err != nil { + if err := nginx.ValidateGeoLite2DBEditions(); err != nil { return false, nil, err } if nginx.MaxmindLicenseKey != "" || nginx.MaxmindMirror != "" { diff --git a/pkg/flags/flags_test.go b/pkg/flags/flags_test.go index 2a33d73dd..bffe2b16d 100644 --- a/pkg/flags/flags_test.go +++ b/pkg/flags/flags_test.go @@ -33,7 +33,8 @@ func TestDefaults(t *testing.T) { oldArgs := os.Args defer func() { os.Args = oldArgs }() - os.Args = []string{"cmd", + os.Args = []string{ + "cmd", "--default-backend-service", "namespace/test", "--http-port", "0", "--https-port", "0", @@ -53,8 +54,8 @@ func TestDefaults(t *testing.T) { } } -func TestSetupSSLProxy(t *testing.T) { - // TODO +func TestSetupSSLProxy(_ *testing.T) { + // TODO TestSetupSSLProxy } func TestFlagConflict(t *testing.T) { diff --git a/pkg/metrics/handler.go b/pkg/metrics/handler.go index c37c1760c..73c7d328f 100644 --- a/pkg/metrics/handler.go +++ b/pkg/metrics/handler.go @@ -29,7 +29,6 @@ import ( ) func RegisterHealthz(healthPath string, mux *http.ServeMux, checks ...healthz.HealthChecker) { - healthCheck := []healthz.HealthChecker{healthz.PingHealthz} if len(checks) > 0 { healthCheck = append(healthCheck, checks...) @@ -67,7 +66,7 @@ func RegisterProfiler(host string, port int) { server := &http.Server{ Addr: fmt.Sprintf("%s:%d", host, port), - //G112 (CWE-400): Potential Slowloris Attack + // G112 (CWE-400): Potential Slowloris Attack ReadHeaderTimeout: 10 * time.Second, Handler: mux, } diff --git a/pkg/tcpproxy/tcp.go b/pkg/tcpproxy/tcp.go index 25cc39ee4..eda4a2746 100644 --- a/pkg/tcpproxy/tcp.go +++ b/pkg/tcpproxy/tcp.go @@ -69,7 +69,7 @@ func (p *TCPProxy) Handle(conn net.Conn) { } proxy := p.Default - hostname, err := parser.GetHostname(data[:]) + hostname, err := parser.GetHostname(data) if err == nil { klog.V(4).InfoS("TLS Client Hello", "host", hostname) proxy = p.Get(hostname) @@ -91,8 +91,14 @@ func (p *TCPProxy) Handle(conn net.Conn) { if proxy.ProxyProtocol { // write out the Proxy Protocol header - localAddr := conn.LocalAddr().(*net.TCPAddr) - remoteAddr := conn.RemoteAddr().(*net.TCPAddr) + localAddr, ok := conn.LocalAddr().(*net.TCPAddr) + if !ok { + klog.Errorf("unexpected type: %T", conn.LocalAddr()) + } + remoteAddr, ok := conn.RemoteAddr().(*net.TCPAddr) + if !ok { + klog.Errorf("unexpected type: %T", conn.RemoteAddr()) + } protocol := "UNKNOWN" if remoteAddr.IP.To4() != nil { protocol = "TCP4" diff --git a/pkg/util/file/file_watcher.go b/pkg/util/file/file_watcher.go index daf955e52..3899e41f8 100644 --- a/pkg/util/file/file_watcher.go +++ b/pkg/util/file/file_watcher.go @@ -26,8 +26,8 @@ import ( "github.com/fsnotify/fsnotify" ) -// FileWatcher is an interface we use to watch changes in files -type FileWatcher interface { +// Watcher is an interface we use to watch changes in files +type Watcher interface { Close() error } @@ -40,7 +40,7 @@ type OSFileWatcher struct { } // NewFileWatcher creates a new FileWatcher -func NewFileWatcher(file string, onEvent func()) (FileWatcher, error) { +func NewFileWatcher(file string, onEvent func()) (Watcher, error) { fw := OSFileWatcher{ file: file, onEvent: onEvent, diff --git a/pkg/util/file/filesystem.go b/pkg/util/file/filesystem.go index 7c0db9f12..ccb93ed06 100644 --- a/pkg/util/file/filesystem.go +++ b/pkg/util/file/filesystem.go @@ -17,4 +17,4 @@ limitations under the License. package file // ReadWriteByUser defines linux permission to read and write files for the owner user -const ReadWriteByUser = 0700 +const ReadWriteByUser = 0o700 diff --git a/pkg/util/file/structure.go b/pkg/util/file/structure.go index d109e8c03..7d4f26da9 100644 --- a/pkg/util/file/structure.go +++ b/pkg/util/file/structure.go @@ -33,12 +33,10 @@ const ( DefaultSSLDirectory = "/etc/ingress-controller/ssl" ) -var ( - directories = []string{ - DefaultSSLDirectory, - AuthDirectory, - } -) +var directories = []string{ + DefaultSSLDirectory, + AuthDirectory, +} // CreateRequiredDirectories verifies if the required directories to // start the ingress controller exist and creates the missing ones. diff --git a/pkg/util/ingress/ingress.go b/pkg/util/ingress/ingress.go index e69ca7b29..881d5a001 100644 --- a/pkg/util/ingress/ingress.go +++ b/pkg/util/ingress/ingress.go @@ -114,7 +114,7 @@ func GetRemovedIngresses(rucfg, newcfg *ingress.Configuration) []string { // IsDynamicConfigurationEnough returns whether a Configuration can be // dynamically applied, without reloading the backend. -func IsDynamicConfigurationEnough(newcfg *ingress.Configuration, oldcfg *ingress.Configuration) bool { +func IsDynamicConfigurationEnough(newcfg, oldcfg *ingress.Configuration) bool { copyOfRunningConfig := *oldcfg copyOfPcfg := *newcfg @@ -133,21 +133,21 @@ func IsDynamicConfigurationEnough(newcfg *ingress.Configuration, oldcfg *ingress // clearL4serviceEndpoints is a helper function to clear endpoints from the ingress configuration since they should be ignored when // checking if the new configuration changes can be applied dynamically. func clearL4serviceEndpoints(config *ingress.Configuration) { - var clearedTCPL4Services []ingress.L4Service - var clearedUDPL4Services []ingress.L4Service - for _, service := range config.TCPEndpoints { + clearedTCPL4Services := make([]ingress.L4Service, 0, len(config.TCPEndpoints)) + clearedUDPL4Services := make([]ingress.L4Service, 0, len(config.UDPEndpoints)) + for i := range config.TCPEndpoints { copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, + Port: config.TCPEndpoints[i].Port, + Backend: config.TCPEndpoints[i].Backend, Endpoints: []ingress.Endpoint{}, Service: nil, } clearedTCPL4Services = append(clearedTCPL4Services, copyofService) } - for _, service := range config.UDPEndpoints { + for i := range config.UDPEndpoints { copyofService := ingress.L4Service{ - Port: service.Port, - Backend: service.Backend, + Port: config.UDPEndpoints[i].Port, + Backend: config.UDPEndpoints[i].Backend, Endpoints: []ingress.Endpoint{}, Service: nil, } @@ -160,7 +160,7 @@ func clearL4serviceEndpoints(config *ingress.Configuration) { // clearCertificates is a helper function to clear Certificates from the ingress configuration since they should be ignored when // checking if the new configuration changes can be applied dynamically if dynamic certificates is on func clearCertificates(config *ingress.Configuration) { - var clearedServers []*ingress.Server + clearedServers := make([]*ingress.Server, 0, len(config.Servers)) for _, server := range config.Servers { copyOfServer := *server copyOfServer.SSLCert = nil @@ -169,16 +169,16 @@ func clearCertificates(config *ingress.Configuration) { config.Servers = clearedServers } -type redirect struct { +type Redirect struct { From string To string SSLCert *ingress.SSLCert } // BuildRedirects build the redirects of servers based on configurations and certificates -func BuildRedirects(servers []*ingress.Server) []*redirect { +func BuildRedirects(servers []*ingress.Server) []*Redirect { names := sets.Set[string]{} - redirectServers := make([]*redirect, 0) + redirectServers := make([]*Redirect, 0) for _, srv := range servers { if !srv.RedirectFromToWWW { @@ -212,7 +212,7 @@ func BuildRedirects(servers []*ingress.Server) []*redirect { continue } - r := &redirect{ + r := &Redirect{ From: from, To: to, } diff --git a/pkg/util/process/controller.go b/pkg/util/process/controller.go index ae9bc9356..a73e81934 100644 --- a/pkg/util/process/controller.go +++ b/pkg/util/process/controller.go @@ -16,9 +16,9 @@ limitations under the License. package process -// ProcessController defines a common interface for a process to be controlled, +// Controller defines a common interface for a process to be controlled, // like the configurer, the webhook or the proper ingress controller -type ProcessController interface { +type Controller interface { Start() Stop() error } diff --git a/pkg/util/process/sigterm.go b/pkg/util/process/sigterm.go index 77c0ad58c..1c0d729c1 100644 --- a/pkg/util/process/sigterm.go +++ b/pkg/util/process/sigterm.go @@ -29,7 +29,7 @@ type exiter func(code int) // HandleSigterm receives a ProcessController interface and deals with // the graceful shutdown -func HandleSigterm(ngx ProcessController, delay int, exit exiter) { +func HandleSigterm(ngx Controller, delay int, exit exiter) { signalChan := make(chan os.Signal, 1) signal.Notify(signalChan, syscall.SIGTERM) <-signalChan diff --git a/pkg/util/process/sigterm_test.go b/pkg/util/process/sigterm_test.go index b7413bed4..08c8275c3 100644 --- a/pkg/util/process/sigterm_test.go +++ b/pkg/util/process/sigterm_test.go @@ -43,7 +43,7 @@ func (f *FakeProcess) exiterFunc(code int) { } func sendDelayedSignal(delay time.Duration) error { - time.Sleep(delay * time.Second) + time.Sleep(delay) return syscall.Kill(syscall.Getpid(), syscall.SIGTERM) } @@ -67,7 +67,7 @@ func TestHandleSigterm(t *testing.T) { process := &FakeProcess{shouldError: tt.shouldError} t.Run(tt.name, func(t *testing.T) { go func() { - err := sendDelayedSignal(2) // Send a signal after 2 seconds + err := sendDelayedSignal(2 * time.Second) // Send a signal after 2 seconds if err != nil { t.Errorf("error sending delayed signal: %v", err) } diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 2a1b48252..97c72cd5a 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -23,7 +23,7 @@ import ( "runtime" ) -// NumCPU ... +// NumCPU returns the number of logical CPUs usable by the current process. func NumCPU() int { return runtime.NumCPU() } diff --git a/pkg/util/sets/match_test.go b/pkg/util/sets/match_test.go index e2366d2c7..a65c5a05f 100644 --- a/pkg/util/sets/match_test.go +++ b/pkg/util/sets/match_test.go @@ -20,23 +20,20 @@ import ( "testing" ) -var ( - testCasesElementMatch = []struct { - listA []string - listB []string - expected bool - }{ - {nil, nil, true}, - {[]string{"1"}, nil, false}, - {[]string{"1"}, []string{"1"}, true}, - {[]string{"1", "2", "1"}, []string{"1", "1", "2"}, true}, - {[]string{"1", "3", "1"}, []string{"1", "1", "2"}, false}, - {[]string{"1", "1"}, []string{"1", "2"}, false}, - } -) +var testCasesElementMatch = []struct { + listA []string + listB []string + expected bool +}{ + {nil, nil, true}, + {[]string{"1"}, nil, false}, + {[]string{"1"}, []string{"1"}, true}, + {[]string{"1", "2", "1"}, []string{"1", "1", "2"}, true}, + {[]string{"1", "3", "1"}, []string{"1", "1", "2"}, false}, + {[]string{"1", "1"}, []string{"1", "2"}, false}, +} func TestElementsMatch(t *testing.T) { - for _, testCase := range testCasesElementMatch { result := StringElementsMatch(testCase.listA, testCase.listB) if result != testCase.expected { diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 3d7235bcc..ccd7b4411 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -140,7 +140,7 @@ http { {{/* Enable the real_ip module only if we use either X-Forwarded headers or Proxy Protocol. */}} {{/* we use the value of the real IP for the geo_ip module */}} - {{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIp }} + {{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIP }} {{ if $cfg.UseProxyProtocol }} real_ip_header proxy_protocol; {{ else }} @@ -406,7 +406,7 @@ http { {{ if $cfg.EnableSyslog }} access_log syslog:server={{ $cfg.SyslogHost }}:{{ $cfg.SyslogPort }} upstreaminfo if=$loggable; {{ else }} - access_log {{ or $cfg.HttpAccessLogPath $cfg.AccessLogPath }} upstreaminfo {{ $cfg.AccessLogParams }} if=$loggable; + access_log {{ or $cfg.HTTPAccessLogPath $cfg.AccessLogPath }} upstreaminfo {{ $cfg.AccessLogParams }} if=$loggable; {{ end }} {{ end }} @@ -822,7 +822,7 @@ stream { error_log {{ $cfg.ErrorLogPath }} {{ $cfg.ErrorLogLevel }}; - {{ if $cfg.EnableRealIp }} + {{ if $cfg.EnableRealIP }} {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }} set_real_ip_from {{ $trusted_ip }}; {{ end }} diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index 0ee8248b0..726e16f0b 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -34,6 +34,8 @@ import ( networking "k8s.io/api/networking/v1" ) +const admissionTestHost = "admission-test" + var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", func() { f := framework.NewDefaultFramework("admission") @@ -43,7 +45,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("reject ingress with global-rate-limit annotations when memcached is not configured", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/global-rate-limit": "100", @@ -70,7 +72,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should not allow overlaps of host and paths without canary annotations", func() { - host := "admission-test" + host := admissionTestHost firstIngress := framework.NewSingleIngress("first-ingress", "/", host, f.Namespace, framework.EchoService, 80, nil) _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) @@ -87,7 +89,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should allow overlaps of host and paths with canary annotation", func() { - host := "admission-test" + host := admissionTestHost firstIngress := framework.NewSingleIngress("first-ingress", "/", host, f.Namespace, framework.EchoService, 80, nil) _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{}) @@ -125,7 +127,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is an error validating the ingress definition", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": "something invalid", @@ -136,7 +138,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is an invalid value in some annotation", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/connection-proxy-header": "a;}", @@ -150,7 +152,7 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is a forbidden value in some annotation", func() { - host := "admission-test" + host := admissionTestHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/connection-proxy-header": "set_by_lua", @@ -195,7 +197,6 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", validPath := framework.NewSingleIngress("second-ingress", "/bloblo", host, f.Namespace, framework.EchoService, 80, nil) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), validPath, metav1.CreateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with valid path should not return an error") - }) ginkgo.It("should not return an error if the Ingress V1 definition is valid with Ingress Class", func() { @@ -346,7 +347,7 @@ func createIngress(namespace, ingressDefinition string) (string, error) { execOut bytes.Buffer execErr bytes.Buffer ) - + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v --warnings-as-errors=false apply --namespace %s -f -", framework.KubectlPath, namespace)) cmd.Stdin = strings.NewReader(ingressDefinition) cmd.Stdout = &execOut diff --git a/test/e2e/annotations/affinity.go b/test/e2e/annotations/affinity.go index 3e1e9e969..b64581ef6 100644 --- a/test/e2e/annotations/affinity.go +++ b/test/e2e/annotations/affinity.go @@ -32,6 +32,14 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + affinityAnnotation = "cookie" + cookieName = "SERVERID" + enableAnnotation = "true" + disableAnnotation = "false" + defaultHost = "foo.com" +) + var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { f := framework.NewDefaultFramework("affinity") @@ -42,8 +50,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set sticky cookie SERVERID", func() { host := "sticky.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -64,8 +72,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should change cookie name on ingress definition change", func() { host := "change.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -80,7 +88,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK). - Header("Set-Cookie").Contains("SERVERID") + Header("Set-Cookie").Contains(cookieName) ing.ObjectMeta.Annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "OTHERCOOKIENAME" @@ -99,8 +107,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set the path to /something on the generated cookie", func() { host := "path.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress(host, "/something", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -122,8 +130,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { pathtype := networking.PathTypePrefix host := "morethanonerule.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName f.EnsureIngress(&networking.Ingress{ ObjectMeta: metav1.ObjectMeta{ @@ -194,7 +202,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set cookie with expires", func() { host := "cookieexpires.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "ExpiresCookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "259200" @@ -211,7 +219,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { assert.Nil(ginkgo.GinkgoT(), err, "loading GMT location") assert.NotNil(ginkgo.GinkgoT(), local, "expected a location but none returned") - duration, _ := time.ParseDuration("48h") + duration, err := time.ParseDuration("48h") + assert.Nil(ginkgo.GinkgoT(), err, "parsing duration") expected := time.Now().In(local).Add(duration).Format("Mon, 02-Jan-06 15:04") f.HTTPTestClient(). @@ -225,7 +234,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set cookie with domain", func() { host := "cookiedomain.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "DomainCookie" annotations["nginx.ingress.kubernetes.io/session-cookie-domain"] = "foo.bar" @@ -248,7 +257,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should not set cookie without domain annotation", func() { host := "cookienodomain.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "NoDomainCookie" ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) @@ -270,9 +279,9 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should work with use-regex annotation and session-cookie-path", func() { host := "useregex.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/use-regex"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/use-regex"] = enableAnnotation annotations["nginx.ingress.kubernetes.io/session-cookie-path"] = "/foo/bar" ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) @@ -294,9 +303,9 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should warn user when use-regex is true and session-cookie-path is not set", func() { host := "useregexwarn.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/use-regex"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/use-regex"] = enableAnnotation ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -321,7 +330,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { host := "separate.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation ing1 := framework.NewSingleIngress("ingress1", "/foo/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing1) @@ -351,8 +360,8 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { ginkgo.It("should set sticky cookie without host", func() { annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName ing := framework.NewSingleIngress("default-no-host", "/", "", f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -370,12 +379,12 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should work with server-alias annotation", func() { - host := "foo.com" + host := defaultHost alias1 := "a1.foo.com" alias2 := "a2.foo.com" annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName annotations["nginx.ingress.kubernetes.io/server-alias"] = fmt.Sprintf("%s,%s", alias1, alias2) ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) @@ -383,7 +392,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { f.WaitForNginxServer(host, func(server string) bool { - //server alias sort by sort.Strings(), see: internal/ingress/annotations/alias/main.go:60 + // server alias sort by sort.Strings(), see: internal/ingress/annotations/alias/main.go:60 return strings.Contains(server, fmt.Sprintf("server_name %s %s %s ;", host, alias1, alias2)) }) @@ -410,11 +419,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should set secure in cookie with provided true annotation on http", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "true" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = enableAnnotation ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -433,11 +442,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should not set secure in cookie with provided false annotation on http", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "false" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = disableAnnotation ing := framework.NewSingleIngress(host, "/bar", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -456,11 +465,11 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { }) ginkgo.It("should set secure in cookie with provided false annotation on https", func() { - host := "foo.com" + host := defaultHost annotations := make(map[string]string) - annotations["nginx.ingress.kubernetes.io/affinity"] = "cookie" - annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "SERVERID" - annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = "false" + annotations["nginx.ingress.kubernetes.io/affinity"] = affinityAnnotation + annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = cookieName + annotations["nginx.ingress.kubernetes.io/session-cookie-secure"] = disableAnnotation f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, annotations)) @@ -470,6 +479,7 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() { strings.Contains(server, "listen 443") }) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). WithURL(f.GetURL(framework.HTTPS)). diff --git a/test/e2e/annotations/affinitymode.go b/test/e2e/annotations/affinitymode.go index ad210cfa5..e6253b6ff 100644 --- a/test/e2e/annotations/affinitymode.go +++ b/test/e2e/annotations/affinitymode.go @@ -28,6 +28,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const sslRedirectValue = "false" + var _ = framework.DescribeAnnotation("affinitymode", func() { f := framework.NewDefaultFramework("affinity") @@ -45,7 +47,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "hello-cookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "172800" - annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false" + annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = sslRedirectValue annotations["nginx.ingress.kubernetes.io/affinity-mode"] = "balanced" annotations["nginx.ingress.kubernetes.io/session-cookie-hash"] = "sha1" @@ -78,7 +80,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { annotations["nginx.ingress.kubernetes.io/session-cookie-name"] = "hello-cookie" annotations["nginx.ingress.kubernetes.io/session-cookie-expires"] = "172800" annotations["nginx.ingress.kubernetes.io/session-cookie-max-age"] = "172800" - annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false" + annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = sslRedirectValue annotations["nginx.ingress.kubernetes.io/affinity-mode"] = "persistent" annotations["nginx.ingress.kubernetes.io/session-cookie-hash"] = "sha1" @@ -106,7 +108,7 @@ var _ = framework.DescribeAnnotation("affinitymode", func() { // Send new requests and add new backends. Check which backend responded to the sent request cookies := getCookiesFromHeader(response.Header("Set-Cookie").Raw()) for sendRequestNumber := 0; sendRequestNumber < 10; sendRequestNumber++ { - replicas = replicas + 1 + replicas++ err := framework.UpdateDeployment(f.KubeClientSet, f.Namespace, deploymentName, replicas, nil) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() diff --git a/test/e2e/annotations/alias.go b/test/e2e/annotations/alias.go index de829507d..ca4fe9c31 100644 --- a/test/e2e/annotations/alias.go +++ b/test/e2e/annotations/alias.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const fooHost = "foo" + var _ = framework.DescribeAnnotation("server-alias", func() { f := framework.NewDefaultFramework("alias") @@ -34,7 +36,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for host 'foo' and 404 for 'bar'", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -60,7 +62,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for host 'foo' and 'bar'", func() { - host := "foo" + host := fooHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-alias": "bar", } @@ -73,7 +75,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { return strings.Contains(server, fmt.Sprintf("server_name %v", host)) }) - hosts := []string{"foo", "bar"} + hosts := []string{fooHost, "bar"} for _, host := range hosts { f.HTTPTestClient(). GET("/"). @@ -85,7 +87,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { }) ginkgo.It("should return status code 200 for hosts defined in two ingresses, different path with one alias", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress("app-a", "/app-a", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -101,7 +103,7 @@ var _ = framework.DescribeAnnotation("server-alias", func() { return strings.Contains(server, fmt.Sprintf("server_name %v bar", host)) }) - hosts := []string{"foo", "bar"} + hosts := []string{fooHost, "bar"} for _, host := range hosts { f.HTTPTestClient(). GET("/app-a"). diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index 56246828a..be915a722 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -36,6 +36,12 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + differentHost = "different" + authHost = "auth" + authURL = "http://foo.bar.baz:5000/path" +) + var _ = framework.DescribeAnnotation("auth-*", func() { f := framework.NewDefaultFramework("auth", framework.WithHTTPBunEnabled()) @@ -44,7 +50,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 200 when no authentication is configured", func() { - host := "auth" + host := authHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -63,7 +69,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 503 when authentication is configured with an invalid secret", func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", "nginx.ingress.kubernetes.io/auth-secret": "something", @@ -87,9 +93,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 when authentication is configured but Authorization header is not configured", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -114,9 +120,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -142,9 +148,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -170,9 +176,9 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It("should return status code 200 when authentication is configured and Authorization header is sent", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -191,15 +197,15 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusOK) }) ginkgo.It("should return status code 200 when authentication is configured with a map and Authorization header is sent", func() { - host := "auth" + host := authHost - s := f.EnsureSecret(buildMapSecret("foo", "bar", "test", f.Namespace)) + s := f.EnsureSecret(buildMapSecret(fooHost, "bar", "test", f.Namespace)) annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-type": "basic", @@ -219,13 +225,13 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusOK) }) ginkgo.It("should return status code 401 when authentication is configured with invalid content and Authorization header is sent", func() { - host := "auth" + host := authHost s := f.EnsureSecret( &corev1.Secret{ @@ -258,13 +264,13 @@ var _ = framework.DescribeAnnotation("auth-*", func() { f.HTTPTestClient(). GET("/"). WithHeader("Host", host). - WithBasicAuth("foo", "bar"). + WithBasicAuth(fooHost, "bar"). Expect(). Status(http.StatusUnauthorized) }) ginkgo.It(`should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", @@ -282,7 +288,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-snippet": ` @@ -299,7 +305,7 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", @@ -320,11 +326,11 @@ var _ = framework.DescribeAnnotation("auth-*", func() { }) ginkgo.It(`should set cache_key when external auth cache is configured`, func() { - host := "auth" + host := authHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": "http://foo.bar/basic-auth/user/password", - "nginx.ingress.kubernetes.io/auth-cache-key": "foo", + "nginx.ingress.kubernetes.io/auth-cache-key": fooHost, "nginx.ingress.kubernetes.io/auth-cache-duration": "200 202 401 30m", } @@ -337,7 +343,6 @@ var _ = framework.DescribeAnnotation("auth-*", func() { func(server string) bool { return cacheRegex.MatchString(server) && strings.Contains(server, `proxy_cache_valid 200 202 401 30m;`) - }) }) @@ -405,7 +410,6 @@ http { f.WaitForNginxServer(host, func(server string) bool { return strings.Contains(server, "server_name "+host) }) - }) ginkgo.It("user retains cookie by default", func() { @@ -431,7 +435,7 @@ http { }) ginkgo.It("user with annotated ingress retains cookie if upstream returns error status code", func() { - annotations["nginx.ingress.kubernetes.io/auth-always-set-cookie"] = "true" + annotations["nginx.ingress.kubernetes.io/auth-always-set-cookie"] = enableAnnotation f.UpdateIngress(ing1) f.UpdateIngress(ing2) @@ -451,7 +455,7 @@ http { }) ginkgo.Context("when external authentication is configured", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -495,7 +499,7 @@ http { annotations["nginx.ingress.kubernetes.io/auth-realm"] = "test auth" f.UpdateIngress(ing) - anotherHost := "different" + anotherHost := differentHost anotherAnnotations := map[string]string{} anotherIng := framework.NewSingleIngress(anotherHost, "/", anotherHost, f.Namespace, framework.EchoService, 80, anotherAnnotations) @@ -544,12 +548,12 @@ http { // Sleep a while just to guarantee that the configmap is applied framework.Sleep() - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL f.UpdateIngress(ing) f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) @@ -582,19 +586,19 @@ http { // Sleep a while just to guarantee that the configmap is applied framework.Sleep() - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "-1" f.UpdateIngress(ing) f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) ginkgo.It(`should not create additional upstream block when auth-keepalive is set with HTTP/2`, func() { - annotations["nginx.ingress.kubernetes.io/auth-url"] = "http://foo.bar.baz:5000/path" + annotations["nginx.ingress.kubernetes.io/auth-url"] = authURL annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "123" annotations["nginx.ingress.kubernetes.io/auth-keepalive-requests"] = "456" annotations["nginx.ingress.kubernetes.io/auth-keepalive-timeout"] = "789" @@ -602,7 +606,7 @@ http { f.WaitForNginxServer("", func(server string) bool { - return strings.Contains(server, "http://foo.bar.baz:5000/path") && + return strings.Contains(server, authURL) && !strings.Contains(server, `upstream auth-external-auth`) }) }) @@ -657,7 +661,7 @@ http { framework.Sleep() annotations["nginx.ingress.kubernetes.io/auth-keepalive"] = "10" - annotations["nginx.ingress.kubernetes.io/auth-keepalive-share-vars"] = "true" + annotations["nginx.ingress.kubernetes.io/auth-keepalive-share-vars"] = enableAnnotation f.UpdateIngress(ing) f.WaitForNginxServer("", @@ -670,7 +674,7 @@ http { }) ginkgo.Context("when external authentication is configured with a custom redirect param", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -715,7 +719,7 @@ http { annotations["nginx.ingress.kubernetes.io/auth-realm"] = "test auth" f.UpdateIngress(ing) - anotherHost := "different" + anotherHost := differentHost anotherAnnotations := map[string]string{} anotherIng := framework.NewSingleIngress(anotherHost, "/", anotherHost, f.Namespace, framework.EchoService, 80, anotherAnnotations) @@ -735,8 +739,8 @@ http { }) ginkgo.Context("when external authentication with caching is configured", func() { - thisHost := "auth" - thatHost := "different" + thisHost := authHost + thatHost := differentHost fooPath := "/foo" barPath := "/bar" @@ -858,7 +862,7 @@ http { }) ginkgo.Context("with invalid auth-url should deny whole location", func() { - host := "auth" + host := authHost var annotations map[string]string var ing *networking.Ingress @@ -898,7 +902,6 @@ http { // Auth error func buildSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) encpass := fmt.Sprintf("%v:%s\n", username, out) assert.Nil(ginkgo.GinkgoT(), err) @@ -917,7 +920,6 @@ func buildSecret(username, password, name, namespace string) *corev1.Secret { } func buildMapSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err) @@ -928,7 +930,7 @@ func buildMapSecret(username, password, name, namespace string) *corev1.Secret { DeletionGracePeriodSeconds: framework.NewInt64(1), }, Data: map[string][]byte{ - username: []byte(out), + username: out, }, Type: corev1.SecretTypeOpaque, } diff --git a/test/e2e/annotations/authtls.go b/test/e2e/annotations/authtls.go index e96835aa0..c7a05c053 100644 --- a/test/e2e/annotations/authtls.go +++ b/test/e2e/annotations/authtls.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const authTLSFooHost = "authtls.foo.com" + var _ = framework.DescribeAnnotation("auth-tls-*", func() { f := framework.NewDefaultFramework("authtls") @@ -34,7 +36,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -82,7 +84,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace _, err := framework.CreateIngressMASecret( @@ -112,7 +114,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should 302 redirect to error page instead of 400 when auth-tls-error-page is set", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace errorPath := "/error" @@ -159,7 +161,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should pass URL-encoded certificate to upstream", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -204,7 +206,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should validate auth-tls-verify-client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -260,11 +262,10 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK) - }) ginkgo.It("should return 403 using auth-tls-match-cn with no matching CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -293,7 +294,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should return 200 using auth-tls-match-cn with matching CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -322,7 +323,7 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) ginkgo.It("should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client", func() { - host := "authtls.foo.com" + host := authTLSFooHost nameSpace := f.Namespace clientConfig, err := framework.CreateIngressMASecret( @@ -351,7 +352,8 @@ var _ = framework.DescribeAnnotation("auth-tls-*", func() { }) }) -func assertSslClientCertificateConfig(f *framework.Framework, host string, verifyClient string, verifyDepth string) { +//nolint:unparam // Ignore the invariant param: host +func assertSslClientCertificateConfig(f *framework.Framework, host, verifyClient, verifyDepth string) { sslClientCertDirective := fmt.Sprintf("ssl_client_certificate /etc/ingress-controller/ssl/%s-%s.pem;", f.Namespace, host) sslVerify := fmt.Sprintf("ssl_verify_client %s;", verifyClient) sslVerifyDepth := fmt.Sprintf("ssl_verify_depth %s;", verifyDepth) diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index 566a6921e..d0a08c767 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -24,6 +24,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const backendProtocolHost = "backendprotocol.foo.com" + var _ = framework.DescribeAnnotation("backend-protocol", func() { f := framework.NewDefaultFramework("backendprotocol") @@ -32,7 +34,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to https:// and use proxy_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS", } @@ -47,7 +49,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to $scheme:// and use proxy_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "AUTO_HTTP", } @@ -62,7 +64,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to grpc:// and use grpc_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "GRPC", } @@ -77,7 +79,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to grpcs:// and use grpc_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "GRPCS", } @@ -92,7 +94,7 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) ginkgo.It("should set backend protocol to '' and use fastcgi_pass", func() { - host := "backendprotocol.foo.com" + host := backendProtocolHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", } diff --git a/test/e2e/annotations/canary.go b/test/e2e/annotations/canary.go index 15cbeffa7..ea733dbf4 100644 --- a/test/e2e/annotations/canary.go +++ b/test/e2e/annotations/canary.go @@ -43,7 +43,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canary is created", func() { ginkgo.It("should response with a 200 status from the mainline upstream when requests are made to the mainline ingress", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -87,7 +87,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should return 404 status for requests to the canary if no matching ingress is found", func() { - host := "foo" + host := fooHost canaryAnnotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -118,7 +118,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { TODO: This test needs improvements made to the e2e framework so that deployment updates work in order to successfully run It("should return the correct status codes when endpoints are unavailable", func() { - host := "foo" + host := fooHost annotations := map[string]string{} ing := framework.NewSingleIngress(host, "/info", host, f.Namespace, framework.HTTPBunService, 80, annotations) @@ -172,7 +172,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { */ ginkgo.It("should route requests to the correct upstream if mainline ingress is created before the canary ingress", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -230,7 +230,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if mainline ingress is created after the canary ingress", func() { - host := "foo" + host := fooHost canaryAnnotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -287,7 +287,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if the mainline ingress is modified", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -321,7 +321,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { canaryAnnotations)) modAnnotations := map[string]string{ - "foo": "bar", + fooHost: "bar", } f.UpdateIngress(framework.NewSingleIngress( @@ -361,7 +361,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests to the correct upstream if the canary ingress is modified", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -443,7 +443,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with no value", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost f.EnsureIngress(framework.NewSingleIngress( host, @@ -511,7 +511,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -592,7 +592,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value and pattern", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -645,7 +645,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -690,7 +690,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { Body().Contains(framework.HTTPBunService).NotContains(canaryService) }) ginkgo.It("should routes to mainline upstream when the given Regex causes error", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -739,7 +739,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by header with value and cookie", func() { ginkgo.It("should route requests to the correct upstream", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -788,7 +788,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by cookie", func() { ginkgo.It("respects always and never values", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -860,7 +860,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("when canaried by weight", func() { ginkgo.It("should route requests only to mainline if canary weight is 0", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -908,7 +908,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests only to canary if canary weight is 100", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -950,7 +950,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests only to canary if canary weight is equal to canary weight total", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -993,7 +993,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests split between mainline and canary if canary weight is 50", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -1029,7 +1029,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should route requests split between mainline and canary if canary weight is 100 and weight total is 200", func() { - host := "foo" + host := fooHost annotations := map[string]string{} f.EnsureIngress(framework.NewSingleIngress( @@ -1068,7 +1068,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { ginkgo.Context("Single canary Ingress", func() { ginkgo.It("should not use canary as a catch-all server", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1102,7 +1102,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("should not use canary with domain as a server", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1136,7 +1136,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.It("does not crash when canary ingress has multiple paths to the same non-matching backend", func() { - host := "foo" + host := fooHost canaryIngName := fmt.Sprintf("%v-canary", host) annotations := map[string]string{ "nginx.ingress.kubernetes.io/canary": "true", @@ -1168,7 +1168,7 @@ var _ = framework.DescribeAnnotation("canary-*", func() { }) ginkgo.Context("canary affinity behavior", func() { - host := "foo" + host := fooHost affinityCookieName := "aff" canaryIngName := fmt.Sprintf("%v-canary", host) @@ -1370,7 +1370,6 @@ var _ = framework.DescribeAnnotation("canary-*", func() { TestMainlineCanaryDistribution(f, host) }) }) - }) // This method assumes canary weight being configured at 50%. @@ -1407,12 +1406,12 @@ func TestMainlineCanaryDistribution(f *framework.Framework, host string) { assert.GreaterOrEqual( ginkgo.GinkgoT(), - int(replicaRequestCount[keys[0].String()]), + replicaRequestCount[keys[0].String()], requestsNumberToTest, ) assert.GreaterOrEqual( ginkgo.GinkgoT(), - int(replicaRequestCount[keys[1].String()]), + replicaRequestCount[keys[1].String()], requestsNumberToTest, ) } diff --git a/test/e2e/annotations/clientbodybuffersize.go b/test/e2e/annotations/clientbodybuffersize.go index 4ea1943bd..15a3530f3 100644 --- a/test/e2e/annotations/clientbodybuffersize.go +++ b/test/e2e/annotations/clientbodybuffersize.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const clientBodyBufferSizeHost = "client-body-buffer-size.com" + var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { f := framework.NewDefaultFramework("clientbodybuffersize") @@ -33,7 +35,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1000", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1000" annotations := make(map[string]string) @@ -55,7 +57,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1K", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1K" annotations := make(map[string]string) @@ -77,7 +79,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1k", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1k" annotations := make(map[string]string) @@ -99,7 +101,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1m", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1m" annotations := make(map[string]string) @@ -121,7 +123,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should set client_body_buffer_size to 1M", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1M" annotations := make(map[string]string) @@ -143,7 +145,7 @@ var _ = framework.DescribeAnnotation("client-body-buffer-size", func() { }) ginkgo.It("should not set client_body_buffer_size to invalid 1b", func() { - host := "client-body-buffer-size.com" + host := clientBodyBufferSizeHost clientBodyBufferSize := "1b" annotations := make(map[string]string) diff --git a/test/e2e/annotations/cors.go b/test/e2e/annotations/cors.go index f53bd8e9e..dd28f5dd4 100644 --- a/test/e2e/annotations/cors.go +++ b/test/e2e/annotations/cors.go @@ -25,6 +25,11 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + originHost = "http://origin.com:8080" + corsHost = "cors.foo.com" +) + var _ = framework.DescribeAnnotation("cors-*", func() { f := framework.NewDefaultFramework("cors") @@ -33,7 +38,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should enable cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", } @@ -60,7 +65,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should set cors methods to only allow POST, GET", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-methods": "POST, GET", @@ -76,7 +81,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should set cors max-age", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-max-age": "200", @@ -92,7 +97,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should disable cors allow credentials", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-credentials": "false", @@ -108,7 +113,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow origin for cors", func() { - host := "cors.foo.com" + host := corsHost origin := "https://origin.cors.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -135,7 +140,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow headers for cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-headers": "DNT, User-Agent", @@ -151,7 +156,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should expose headers for cors", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-expose-headers": "X-CustomResponseHeader, X-CustomSecondHeader", @@ -167,7 +172,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost origin := "https://origin.cors.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -194,7 +199,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost origin := "http://no.origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -214,7 +219,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow correct origins - single origin for multiple cors values", func() { - host := "cors.foo.com" + host := corsHost badOrigin := "origin.cors.com:8080" origin1 := "https://origin2.cors.com" origin2 := "https://origin.com" @@ -265,7 +270,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "*", @@ -289,7 +294,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality - without `*`", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", } @@ -312,7 +317,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not break functionality with extra domain", func() { - host := "cors.foo.com" + host := corsHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "*, foo.bar.com", @@ -336,7 +341,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not match", func() { - host := "cors.foo.com" + host := corsHost origin := "https://fooxbar.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -356,8 +361,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - single origin with required port", func() { - host := "cors.foo.com" - origin := "http://origin.com:8080" + host := corsHost + origin := originHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "http://origin.cors.com:8080, http://origin.com:8080", @@ -384,8 +389,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin with port and origin without port", func() { - host := "cors.foo.com" - origin := "http://origin.com:8080" + host := corsHost + origin := originHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", "nginx.ingress.kubernetes.io/cors-allow-origin": "https://origin2.cors.com, http://origin.com", @@ -403,7 +408,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - single origin without port and origin with required port", func() { - host := "cors.foo.com" + host := corsHost origin := "http://origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -423,7 +428,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - matching origin with wildcard origin (2 subdomains)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://foo.origin.cors.com" origin2 := "http://bar-foo.origin.cors.com" annotations := map[string]string{ @@ -466,7 +471,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - unmatching origin with wildcard origin (2 subdomains)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://bar.foo.origin.cors.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -486,7 +491,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - matching origin+port with wildcard origin", func() { - host := "cors.foo.com" + host := corsHost origin := "http://abc.origin.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -513,7 +518,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should not allow - portless origin with wildcard origin", func() { - host := "cors.foo.com" + host := corsHost origin := "http://abc.origin.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -533,8 +538,8 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow correct origins - missing subdomain + origin with wildcard origin and correct origin", func() { - host := "cors.foo.com" - badOrigin := "http://origin.com:8080" + host := corsHost + badOrigin := originHost origin := "http://bar.origin.com:8080" annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-cors": "true", @@ -569,7 +574,7 @@ var _ = framework.DescribeAnnotation("cors-*", func() { }) ginkgo.It("should allow - missing origins (should allow all origins)", func() { - host := "cors.foo.com" + host := corsHost origin := "http://origin.com" origin2 := "http://book.origin.com" origin3 := "test.origin.com" diff --git a/test/e2e/annotations/customhttperrors.go b/test/e2e/annotations/customhttperrors.go index 3862f817b..37a3e9695 100644 --- a/test/e2e/annotations/customhttperrors.go +++ b/test/e2e/annotations/customhttperrors.go @@ -27,7 +27,7 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -func errorBlockName(upstreamName string, errorCode string) string { +func errorBlockName(upstreamName, errorCode string) string { return fmt.Sprintf("@custom_%s_%s", upstreamName, errorCode) } diff --git a/test/e2e/annotations/default_backend.go b/test/e2e/annotations/default_backend.go index 53c98a307..72ca303b5 100644 --- a/test/e2e/annotations/default_backend.go +++ b/test/e2e/annotations/default_backend.go @@ -48,18 +48,18 @@ var _ = framework.DescribeAnnotation("default-backend", func() { return strings.Contains(server, fmt.Sprintf("server_name %v", host)) }) - requestId := "something-unique" + requestID := "something-unique" f.HTTPTestClient(). GET("/alma/armud"). WithHeader("Host", host). - WithHeader("x-request-id", requestId). + WithHeader("x-request-id", requestID). Expect(). Status(http.StatusOK). Body().Contains("x-code=503"). Contains(fmt.Sprintf("x-ingress-name=%s", host)). Contains("x-service-name=invalid"). - Contains(fmt.Sprintf("x-request-id=%s", requestId)) + Contains(fmt.Sprintf("x-request-id=%s", requestID)) }) }) }) diff --git a/test/e2e/annotations/fromtowwwredirect.go b/test/e2e/annotations/fromtowwwredirect.go index 9201bedb7..4ee3d313c 100644 --- a/test/e2e/annotations/fromtowwwredirect.go +++ b/test/e2e/annotations/fromtowwwredirect.go @@ -90,7 +90,7 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() { ginkgo.By("sending request to www should redirect to domain") f.HTTPTestClientWithTLSConfig(&tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing ServerName: toHost, }). GET("/"). @@ -102,7 +102,7 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() { ginkgo.By("sending request to domain should not redirect to www") f.HTTPTestClientWithTLSConfig(&tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing ServerName: fromHost, }). GET("/"). diff --git a/test/e2e/annotations/globalratelimit.go b/test/e2e/annotations/globalratelimit.go index 2efcc3558..96be467fe 100644 --- a/test/e2e/annotations/globalratelimit.go +++ b/test/e2e/annotations/globalratelimit.go @@ -47,7 +47,7 @@ var _ = framework.DescribeAnnotation("annotation-global-rate-limit", func() { ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) ing = f.EnsureIngress(ing) - namespace := strings.Replace(string(ing.UID), "-", "", -1) + namespace := strings.ReplaceAll(string(ing.UID), "-", "") serverConfig := "" f.WaitForNginxServer(host, func(server string) bool { diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 243307df4..4c121df49 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -17,12 +17,11 @@ limitations under the License. package annotations import ( + "context" "crypto/tls" "fmt" "strings" - "context" - pb "github.com/moul/pb/grpcbin/go-grpc" "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -36,6 +35,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const echoHost = "echo" + var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { f := framework.NewDefaultFramework("grpc", framework.WithHTTPBunEnabled()) @@ -67,7 +68,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("should return OK for service with backend protocol GRPC", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -102,14 +103,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpc://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore certificate validation in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err, "error creating a connection") defer conn.Close() client := pb.NewGRPCBinClient(conn) @@ -125,7 +127,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("authorization metadata should be overwritten by external auth response headers", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -162,14 +164,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpc://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore certificate validation in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err) defer conn.Close() client := pb.NewGRPCBinClient(conn) @@ -180,13 +183,13 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { assert.Nil(ginkgo.GinkgoT(), err) metadata := res.GetMetadata() - assert.Equal(ginkgo.GinkgoT(), "foo", metadata["authorization"].Values[0]) + assert.Equal(ginkgo.GinkgoT(), fooHost, metadata["authorization"].Values[0]) }) ginkgo.It("should return OK for service with backend protocol GRPCS", func() { f.NewGRPCBinDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -226,14 +229,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { return strings.Contains(server, "grpc_pass grpcs://upstream_balancer;") }) - conn, _ := grpc.Dial(f.GetNginxIP()+":443", + conn, err := grpc.Dial(f.GetNginxIP()+":443", grpc.WithTransportCredentials( credentials.NewTLS(&tls.Config{ - ServerName: "echo", - InsecureSkipVerify: true, + ServerName: echoHost, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }), ), ) + assert.Nil(ginkgo.GinkgoT(), err) defer conn.Close() client := pb.NewGRPCBinClient(conn) diff --git a/test/e2e/annotations/modsecurity/modsecurity.go b/test/e2e/annotations/modsecurity/modsecurity.go index 62c9bc843..71e8963e3 100644 --- a/test/e2e/annotations/modsecurity/modsecurity.go +++ b/test/e2e/annotations/modsecurity/modsecurity.go @@ -25,6 +25,17 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + modSecurityFooHost = "modsecurity.foo.com" + defaultSnippet = `SecRuleEngine On + SecRequestBodyAccess On + SecAuditEngine RelevantOnly + SecAuditLogParts ABIJDEFHZ + SecAuditLog /dev/stdout + SecAuditLogType Serial + SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` +) + var _ = framework.DescribeAnnotation("modsecurity owasp", func() { f := framework.NewDefaultFramework("modsecuritylocation") @@ -33,7 +44,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -51,7 +62,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with transaction ID and OWASP rules", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -72,7 +83,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should disable modsecurity", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -89,7 +100,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -109,10 +120,11 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { ginkgo.It("should enable modsecurity without using 'modsecurity on;'", func() { f.SetNginxConfigMapData(map[string]string{ - "enable-modsecurity": "true"}, + "enable-modsecurity": "true", + }, ) - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -131,10 +143,11 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { ginkgo.It("should disable modsecurity using 'modsecurity off;'", func() { f.SetNginxConfigMapData(map[string]string{ - "enable-modsecurity": "true"}, + "enable-modsecurity": "true", + }, ) - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace annotations := map[string]string{ @@ -151,16 +164,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet and block requests", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/enable-modsecurity": "true", @@ -187,16 +194,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity globally and with modsecurity-snippet block requests", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/modsecurity-snippet": snippet, @@ -223,16 +224,10 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity when enable-owasp-modsecurity-crs is set to true", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace - snippet := `SecRuleEngine On - SecRequestBodyAccess On - SecAuditEngine RelevantOnly - SecAuditLogParts ABIJDEFHZ - SecAuditLog /dev/stdout - SecAuditLogType Serial - SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"` + snippet := defaultSnippet annotations := map[string]string{ "nginx.ingress.kubernetes.io/modsecurity-snippet": snippet, @@ -262,7 +257,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity through the config map", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRequestBodyAccess On @@ -303,7 +298,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity through the config map but ignore snippet as disabled by admin", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRequestBodyAccess On @@ -345,7 +340,7 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should disable default modsecurity conf setting when modsecurity-snippet is specified", func() { - host := "modsecurity.foo.com" + host := modSecurityFooHost nameSpace := f.Namespace snippet := `SecRuleEngine On diff --git a/test/e2e/annotations/proxy.go b/test/e2e/annotations/proxy.go index c0c89eb43..235b828e7 100644 --- a/test/e2e/annotations/proxy.go +++ b/test/e2e/annotations/proxy.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxyRedirectToHost = "goodbye.com" + var _ = framework.DescribeAnnotation("proxy-*", func() { f := framework.NewDefaultFramework("proxy") host := "proxy.foo.com" @@ -38,7 +40,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom - annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = "goodbye.com" + annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = proxyRedirectToHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -54,7 +56,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom - annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = "goodbye.com" + annotations["nginx.ingress.kubernetes.io/proxy-redirect-to"] = proxyRedirectToHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -67,7 +69,7 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { ginkgo.It("should set proxy_redirect to hello.com goodbye.com", func() { proxyRedirectFrom := "hello.com" - proxyRedirectTo := "goodbye.com" + proxyRedirectTo := proxyRedirectToHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-redirect-from"] = proxyRedirectFrom @@ -244,5 +246,4 @@ var _ = framework.DescribeAnnotation("proxy-*", func() { return strings.Contains(server, fmt.Sprintf("proxy_http_version %s;", proxyHTTPVersion)) }) }) - }) diff --git a/test/e2e/annotations/proxyssl.go b/test/e2e/annotations/proxyssl.go index 7f14c3393..989d681c1 100644 --- a/test/e2e/annotations/proxyssl.go +++ b/test/e2e/annotations/proxyssl.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxySSLHost = "proxyssl.foo.com" + var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { f := framework.NewDefaultFramework("proxyssl") @@ -35,7 +37,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { }) ginkgo.It("should set valid proxy-ssl-secret", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host @@ -62,7 +64,7 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { }) ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-verify"] = "on" @@ -90,9 +92,9 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { Expect(). Status(http.StatusOK) }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-ciphers"] = "HIGH:!AES" @@ -118,9 +120,9 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { Expect(). Status(http.StatusOK) }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should set valid proxy-ssl-secret, proxy-ssl-protocols", func() { - host := "proxyssl.foo.com" + host := proxySSLHost annotations := make(map[string]string) annotations["nginx.ingress.kubernetes.io/proxy-ssl-secret"] = f.Namespace + "/" + host annotations["nginx.ingress.kubernetes.io/proxy-ssl-protocols"] = "TLSv1.2 TLSv1.3" @@ -195,7 +197,6 @@ var _ = framework.DescribeAnnotation("proxy-ssl-*", func() { strings.Contains(server, "proxy_ssl_certificate_key")) }) }) - }) func assertProxySSL(f *framework.Framework, host, sslName, ciphers, protocols, verify string, depth int, proxySSLServerName string) { diff --git a/test/e2e/annotations/rewrite.go b/test/e2e/annotations/rewrite.go index 79738b984..173df29f0 100644 --- a/test/e2e/annotations/rewrite.go +++ b/test/e2e/annotations/rewrite.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const rewriteHost = "rewrite.bar.com" + var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-log", func() { f := framework.NewDefaultFramework("rewrite") @@ -37,7 +39,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo ginkgo.It("should write rewrite logs", func() { ginkgo.By("setting enable-rewrite-log annotation") - host := "rewrite.bar.com" + host := rewriteHost annotations := map[string]string{ "nginx.ingress.kubernetes.io/rewrite-target": "/", "nginx.ingress.kubernetes.io/enable-rewrite-log": "true", @@ -64,7 +66,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should use correct longest path match", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") ing := framework.NewSingleIngress("kube-lego", "/.well-known/acme/challenge", host, f.Namespace, framework.EchoService, 80, nil) @@ -109,10 +111,10 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should use ~* location modifier if regex annotation is present", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") - ing := framework.NewSingleIngress("foo", "/foo", host, f.Namespace, framework.EchoService, 80, nil) + ing := framework.NewSingleIngress(fooHost, "/foo", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -156,10 +158,10 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should fail to use longest match for documented warning", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By("creating a regular ingress definition") - ing := framework.NewSingleIngress("foo", "/foo/bar/bar", host, f.Namespace, framework.EchoService, 80, nil) + ing := framework.NewSingleIngress(fooHost, "/foo/bar/bar", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) ginkgo.By(`creating an ingress definition with the use-regex annotation`) @@ -188,7 +190,7 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo }) ginkgo.It("should allow for custom rewrite parameters", func() { - host := "rewrite.bar.com" + host := rewriteHost ginkgo.By(`creating an ingress definition with the use-regex annotation`) annotations := map[string]string{ diff --git a/test/e2e/annotations/serversnippet.go b/test/e2e/annotations/serversnippet.go index df1383bdb..e74fa37f5 100644 --- a/test/e2e/annotations/serversnippet.go +++ b/test/e2e/annotations/serversnippet.go @@ -89,6 +89,5 @@ var _ = framework.DescribeAnnotation("server-snippet", func() { Status(http.StatusOK).Headers(). NotContainsKey("Foo"). NotContainsKey("Xpto") - }) }) diff --git a/test/e2e/annotations/serviceupstream.go b/test/e2e/annotations/serviceupstream.go index 0606a2d61..1d80f304a 100644 --- a/test/e2e/annotations/serviceupstream.go +++ b/test/e2e/annotations/serviceupstream.go @@ -27,6 +27,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const dbgCmd = "/dbg backends all" + var _ = framework.DescribeAnnotation("service-upstream", func() { f := framework.NewDefaultFramework("serviceupstream") host := "serviceupstream" @@ -57,10 +59,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) @@ -86,10 +87,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) @@ -117,10 +117,9 @@ var _ = framework.DescribeAnnotation("service-upstream", func() { ginkgo.By("checking if the Service Cluster IP and Port are not used") s := f.GetService(f.Namespace, framework.EchoService) - dbgCmd := "/dbg backends all" output, err := f.ExecIngressPod(dbgCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": "%s"`, s.Spec.ClusterIP)) + assert.NotContains(ginkgo.GinkgoT(), output, fmt.Sprintf(`"address": %q`, s.Spec.ClusterIP)) }) }) }) diff --git a/test/e2e/annotations/upstreamhashby.go b/test/e2e/annotations/upstreamhashby.go index 023a094aa..1b8106662 100644 --- a/test/e2e/annotations/upstreamhashby.go +++ b/test/e2e/annotations/upstreamhashby.go @@ -39,12 +39,13 @@ func startIngress(f *framework.Framework, annotations map[string]string) map[str return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) }) + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(framework.Poll, framework.DefaultTimeout, func() (bool, error) { - resp := f.HTTPTestClient(). GET("/"). WithHeader("Host", host). Expect().Raw() + defer resp.Body.Close() if resp.StatusCode == http.StatusOK { return true, nil @@ -55,7 +56,9 @@ func startIngress(f *framework.Framework, annotations map[string]string) map[str assert.Nil(ginkgo.GinkgoT(), err) - re, _ := regexp.Compile(fmt.Sprintf(`Hostname: %v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`Hostname: %v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + podMap := map[string]bool{} for i := 0; i < 100; i++ { diff --git a/test/e2e/dbg/main.go b/test/e2e/dbg/main.go index 2df57469d..6c0a22f69 100644 --- a/test/e2e/dbg/main.go +++ b/test/e2e/dbg/main.go @@ -49,7 +49,7 @@ var _ = framework.IngressNginxDescribe("Debug CLI", func() { assert.Nil(ginkgo.GinkgoT(), err) // Should be 2: the default and the echo deployment - numUpstreams := len(strings.Split(strings.Trim(string(output), "\n"), "\n")) + numUpstreams := len(strings.Split(strings.Trim(output, "\n"), "\n")) assert.Equal(ginkgo.GinkgoT(), numUpstreams, 2) }) @@ -67,7 +67,7 @@ var _ = framework.IngressNginxDescribe("Debug CLI", func() { output, err := f.ExecIngressPod(cmd) assert.Nil(ginkgo.GinkgoT(), err) - backends := strings.Split(string(output), "\n") + backends := strings.Split(output, "\n") assert.Greater(ginkgo.GinkgoT(), len(backends), 0) getCmd := "/dbg backends get " + backends[0] diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 28adf297d..25d714f88 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -48,7 +48,6 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" _ "k8s.io/ingress-nginx/test/e2e/settings/validations" - _ "k8s.io/ingress-nginx/test/e2e/ssl" _ "k8s.io/ingress-nginx/test/e2e/status" _ "k8s.io/ingress-nginx/test/e2e/tcpudp" diff --git a/test/e2e/e2e_test.go b/test/e2e/e2e_test.go index 4a7a48d92..2e556cf6d 100644 --- a/test/e2e/e2e_test.go +++ b/test/e2e/e2e_test.go @@ -26,6 +26,7 @@ func init() { testing.Init() framework.RegisterParseFlags() } + func TestE2E(t *testing.T) { RunE2ETests(t) } diff --git a/test/e2e/endpointslices/longname.go b/test/e2e/endpointslices/longname.go index 0adb66767..b2242daac 100644 --- a/test/e2e/endpointslices/longname.go +++ b/test/e2e/endpointslices/longname.go @@ -36,7 +36,6 @@ var _ = framework.IngressNginxDescribe("[Endpointslices] long service name", fun }) ginkgo.It("should return 200 when service name has max allowed number of characters 63", func() { - annotations := make(map[string]string) ing := framework.NewSingleIngress(host, "/", host, f.Namespace, name, 80, annotations) f.EnsureIngress(ing) diff --git a/test/e2e/endpointslices/topology.go b/test/e2e/endpointslices/topology.go index 2197bcb53..38c5f8b76 100644 --- a/test/e2e/endpointslices/topology.go +++ b/test/e2e/endpointslices/topology.go @@ -40,7 +40,6 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou }) ginkgo.It("should return 200 when service has topology hints", func() { - annotations := make(map[string]string) ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -85,7 +84,7 @@ var _ = framework.IngressNginxDescribeSerial("[TopologyHints] topology aware rou } if gotHints { - //we have 2 replics, if there is just one backend it means that we are routing according slices hints to same zone as controller is + // we have 2 replics, if there is just one backend it means that we are routing according slices hints to same zone as controller is assert.Equal(ginkgo.GinkgoT(), 1, gotBackends) } else { // two replicas should have two endpoints without topology hints diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 93e1811ec..7ac150dcf 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -50,7 +50,7 @@ var HTTPBunImage = os.Getenv("HTTPBUN_IMAGE") const EchoImage = "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a" // TODO: change all Deployment functions to use these options -// in order to reduce complexity and have a unified API accross the +// in order to reduce complexity and have a unified API across the // framework type deploymentOptions struct { name string @@ -317,7 +317,7 @@ func (f *Framework) GetNginxBaseImage() string { // NGINXDeployment creates a new simple NGINX Deployment using NGINX base image // and passing the desired configuration -func (f *Framework) NGINXDeployment(name string, cfg string, waitendpoint bool) { +func (f *Framework) NGINXDeployment(name, cfg string, waitendpoint bool) { cfgMap := map[string]string{ "nginx.conf": cfg, } @@ -389,7 +389,7 @@ func (f *Framework) NGINXDeployment(name string, cfg string, waitendpoint bool) } // NGINXWithConfigDeployment creates an NGINX deployment using a configmap containing the nginx.conf configuration -func (f *Framework) NGINXWithConfigDeployment(name string, cfg string) { +func (f *Framework) NGINXWithConfigDeployment(name, cfg string) { f.NGINXDeployment(name, cfg, true) } @@ -487,7 +487,8 @@ func (f *Framework) NewGRPCBinDeployment() { } func newDeployment(name, namespace, image string, port int32, replicas int32, command []string, args []string, env []corev1.EnvVar, - volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) *appsv1.Deployment { + volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool, +) *appsv1.Deployment { probe := &corev1.Probe{ InitialDelaySeconds: 2, PeriodSeconds: 1, @@ -559,12 +560,12 @@ func newDeployment(name, namespace, image string, port int32, replicas int32, co return d } -func (f *Framework) NewDeployment(name, image string, port int32, replicas int32) { +func (f *Framework) NewDeployment(name, image string, port, replicas int32) { f.NewDeploymentWithOpts(name, image, port, replicas, nil, nil, nil, nil, nil, true) } // NewDeployment creates a new deployment in a particular namespace. -func (f *Framework) NewDeploymentWithOpts(name, image string, port int32, replicas int32, command []string, args []string, env []corev1.EnvVar, volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) { +func (f *Framework) NewDeploymentWithOpts(name, image string, port, replicas int32, command, args []string, env []corev1.EnvVar, volumeMounts []corev1.VolumeMount, volumes []corev1.Volume, setProbe bool) { deployment := newDeployment(name, f.Namespace, image, port, replicas, command, args, env, volumeMounts, volumes, setProbe) f.EnsureDeployment(deployment) @@ -606,7 +607,7 @@ func (f *Framework) DeleteDeployment(name string) error { }) assert.Nil(ginkgo.GinkgoT(), err, "deleting deployment") - return waitForPodsDeleted(f.KubeClientSet, 2*time.Minute, f.Namespace, metav1.ListOptions{ + return waitForPodsDeleted(f.KubeClientSet, 2*time.Minute, f.Namespace, &metav1.ListOptions{ LabelSelector: labelSelectorToString(d.Spec.Selector.MatchLabels), }) } diff --git a/test/e2e/framework/exec.go b/test/e2e/framework/exec.go index 07bf09be8..9e4b55122 100644 --- a/test/e2e/framework/exec.go +++ b/test/e2e/framework/exec.go @@ -66,6 +66,7 @@ func (f *Framework) ExecCommand(pod *corev1.Pod, command string) (string, error) execErr bytes.Buffer ) + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v exec --namespace %s %s --container controller -- %s", KubectlPath, pod.Namespace, pod.Name, command)) cmd.Stdout = &execOut cmd.Stderr = &execErr @@ -73,7 +74,6 @@ func (f *Framework) ExecCommand(pod *corev1.Pod, command string) (string, error) err := cmd.Run() if err != nil { return "", fmt.Errorf("could not execute '%s %s': %v", cmd.Path, cmd.Args, err) - } if execErr.Len() > 0 { @@ -91,6 +91,7 @@ func (f *Framework) NamespaceContent() (string, error) { execErr bytes.Buffer ) + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v get pods,services,endpoints,deployments --namespace %s", KubectlPath, f.Namespace)) cmd.Stdout = &execOut cmd.Stderr = &execErr @@ -98,7 +99,6 @@ func (f *Framework) NamespaceContent() (string, error) { err := cmd.Run() if err != nil { return "", fmt.Errorf("could not execute '%s %s': %v", cmd.Path, cmd.Args, err) - } eout := strings.TrimSpace(execErr.String()) @@ -110,7 +110,7 @@ func (f *Framework) NamespaceContent() (string, error) { } // newIngressController deploys a new NGINX Ingress controller in a namespace -func (f *Framework) newIngressController(namespace string, namespaceOverlay string) error { +func (f *Framework) newIngressController(namespace, namespaceOverlay string) error { // Creates an nginx deployment isChroot, ok := os.LookupEnv("IS_CHROOT") if !ok { @@ -130,12 +130,11 @@ func (f *Framework) newIngressController(namespace string, namespaceOverlay stri return nil } -var ( - proxyRegexp = regexp.MustCompile("Starting to serve on .*:([0-9]+)") -) +var proxyRegexp = regexp.MustCompile(`Starting to serve on .*:(\d+)`) // KubectlProxy creates a proxy to kubernetes apiserver func (f *Framework) KubectlProxy(port int) (int, *exec.Cmd, error) { + //nolint:gosec // Ignore G204 error cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%s proxy --accept-hosts=.* --address=0.0.0.0 --port=%d", KubectlPath, port)) stdout, stderr, err := startCmdAndStreamOutput(cmd) if err != nil { @@ -163,6 +162,7 @@ func (f *Framework) KubectlProxy(port int) (int, *exec.Cmd, error) { } func (f *Framework) UninstallChart() error { + //nolint:gosec //Ignore G204 error cmd := exec.Command("helm", "uninstall", "--namespace", f.Namespace, "nginx-ingress") _, err := cmd.CombinedOutput() if err != nil { diff --git a/test/e2e/framework/fastcgi_helloserver.go b/test/e2e/framework/fastcgi_helloserver.go index 719048c06..73f9ef340 100644 --- a/test/e2e/framework/fastcgi_helloserver.go +++ b/test/e2e/framework/fastcgi_helloserver.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package framework import ( @@ -75,7 +76,7 @@ func (f *Framework) NewNewFastCGIHelloServerDeploymentWithReplicas(replicas int3 d := f.EnsureDeployment(deployment) - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), }) assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") diff --git a/test/e2e/framework/framework.go b/test/e2e/framework/framework.go index 69f6dae78..b62ad691c 100644 --- a/test/e2e/framework/framework.go +++ b/test/e2e/framework/framework.go @@ -49,10 +49,8 @@ const ( HTTPS RequestScheme = "https" ) -var ( - // KubectlPath defines the full path of the kubectl binary - KubectlPath = "/usr/local/bin/kubectl" -) +// KubectlPath defines the full path of the kubectl binary +var KubectlPath = "/usr/local/bin/kubectl" // Framework supports common operations used by e2e tests; it will keep a client & a namespace for you. type Framework struct { @@ -131,7 +129,6 @@ func (f *Framework) CreateEnvironment() { f.KubeClientSet, err = kubernetes.NewForConfig(f.KubeConfig) assert.Nil(ginkgo.GinkgoT(), err, "creating a kubernetes client") - } f.Namespace, err = CreateKubeNamespace(f.BaseName, f.KubeClientSet) @@ -250,9 +247,9 @@ func (f *Framework) GetNginxPodIP() string { } // GetURL returns the URL should be used to make a request to NGINX -func (f *Framework) GetURL(scheme RequestScheme) string { +func (f *Framework) GetURL(requestScheme RequestScheme) string { ip := f.GetNginxIP() - return fmt.Sprintf("%v://%v", scheme, ip) + return fmt.Sprintf("%v://%v", requestScheme, ip) } // GetIngressNGINXPod returns the ingress controller running pod @@ -270,6 +267,7 @@ func (f *Framework) updateIngressNGINXPod() error { // WaitForNginxServer waits until the nginx configuration contains a particular server section. // `cfg` passed to matcher is normalized by replacing all tabs and spaces with single space. func (f *Framework) WaitForNginxServer(name string, matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxConditions(name, matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") Sleep(1 * time.Second) @@ -278,13 +276,15 @@ func (f *Framework) WaitForNginxServer(name string, matcher func(cfg string) boo // WaitForNginxConfiguration waits until the nginx configuration contains a particular configuration // `cfg` passed to matcher is normalized by replacing all tabs and spaces with single space. func (f *Framework) WaitForNginxConfiguration(matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxConditions("", matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") Sleep(1 * time.Second) } // WaitForNginxCustomConfiguration waits until the nginx configuration given part (from, to) contains a particular configuration -func (f *Framework) WaitForNginxCustomConfiguration(from string, to string, matcher func(cfg string) bool) { +func (f *Framework) WaitForNginxCustomConfiguration(from, to string, matcher func(cfg string) bool) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, f.matchNginxCustomConditions(from, to, matcher)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for nginx server condition/s") } @@ -325,7 +325,7 @@ func (f *Framework) matchNginxConditions(name string, matcher func(cfg string) b } } -func (f *Framework) matchNginxCustomConditions(from string, to string, matcher func(cfg string) bool) wait.ConditionFunc { +func (f *Framework) matchNginxCustomConditions(from, to string, matcher func(cfg string) bool) wait.ConditionFunc { return func() (bool, error) { cmd := fmt.Sprintf("cat /etc/nginx/nginx.conf| awk '/%v/,/%v/'", from, to) @@ -395,7 +395,7 @@ func (f *Framework) CreateConfigMap(name string, data map[string]string) { } // UpdateNginxConfigMapData updates single field in ingress-nginx's nginx-ingress-controller map data -func (f *Framework) UpdateNginxConfigMapData(key string, value string) { +func (f *Framework) UpdateNginxConfigMapData(key, value string) { config, err := f.getConfigMap("nginx-ingress-controller") assert.Nil(ginkgo.GinkgoT(), err) assert.NotNil(ginkgo.GinkgoT(), config, "expected a configmap but none returned") @@ -421,6 +421,7 @@ func (f *Framework) WaitForReload(fn func()) { fn() count := 0 + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(1*time.Second, DefaultTimeout, func() (bool, error) { reloads := getReloadCount(f.pod, f.Namespace, f.KubeClientSet) // most of the cases reload the ingress controller @@ -441,8 +442,8 @@ func getReloadCount(pod *v1.Pod, namespace string, client kubernetes.Interface) assert.Nil(ginkgo.GinkgoT(), err, "obtaining NGINX Pod") reloadCount := 0 - for _, e := range events.Items { - if e.Reason == "RELOAD" && e.Type == v1.EventTypeNormal { + for i := range events.Items { + if events.Items[i].Reason == "RELOAD" && events.Items[i].Type == v1.EventTypeNormal { reloadCount++ } } @@ -457,7 +458,7 @@ func (f *Framework) DeleteNGINXPod(grace int64) { err := f.KubeClientSet.CoreV1().Pods(ns).Delete(context.TODO(), f.pod.GetName(), *metav1.NewDeleteOptions(grace)) assert.Nil(ginkgo.GinkgoT(), err, "deleting ingress nginx pod") - + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(Poll, DefaultTimeout, func() (bool, error) { err := f.updateIngressNGINXPod() if err != nil || f.pod == nil { @@ -487,7 +488,7 @@ func (f *Framework) HTTPTestClientWithTLSConfig(config *tls.Config) *httpexpect. func (f *Framework) newHTTPTestClient(config *tls.Config, setIngressURL bool) *httpexpect.HTTPRequest { if config == nil { config = &tls.Config{ - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing } } var baseURL string @@ -507,12 +508,13 @@ func (f *Framework) newHTTPTestClient(config *tls.Config, setIngressURL bool) *h // WaitForNginxListening waits until NGINX starts accepting connections on a port func (f *Framework) WaitForNginxListening(port int) { - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, &metav1.ListOptions{ LabelSelector: "app.kubernetes.io/name=ingress-nginx", }) assert.Nil(ginkgo.GinkgoT(), err, "waiting for ingress pods to be ready") podIP := f.GetNginxIP() + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(500*time.Millisecond, DefaultTimeout, func() (bool, error) { hostPort := net.JoinHostPort(podIP, fmt.Sprintf("%v", port)) conn, err := net.Dial("tcp", hostPort) @@ -529,7 +531,7 @@ func (f *Framework) WaitForNginxListening(port int) { // WaitForPod waits for a specific Pod to be ready, using a label selector func (f *Framework) WaitForPod(selector string, timeout time.Duration, shouldFail bool) { - err := waitForPodsReady(f.KubeClientSet, timeout, 1, f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, timeout, 1, f.Namespace, &metav1.ListOptions{ LabelSelector: selector, }) @@ -541,7 +543,7 @@ func (f *Framework) WaitForPod(selector string, timeout time.Duration, shouldFai } // UpdateDeployment runs the given updateFunc on the deployment and waits for it to be updated -func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name string, replicas int, updateFunc func(d *appsv1.Deployment) error) error { +func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace, name string, replicas int, updateFunc func(d *appsv1.Deployment) error) error { deployment, err := kubeClientSet.AppsV1().Deployments(namespace).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return err @@ -571,7 +573,7 @@ func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name } } - err = waitForPodsReady(kubeClientSet, DefaultTimeout, replicas, namespace, metav1.ListOptions{ + err = waitForPodsReady(kubeClientSet, DefaultTimeout, replicas, namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(deployment.Spec.Template.ObjectMeta.Labels)).String(), }) if err != nil { @@ -582,6 +584,7 @@ func UpdateDeployment(kubeClientSet kubernetes.Interface, namespace string, name } func waitForDeploymentRollout(kubeClientSet kubernetes.Interface, resource *appsv1.Deployment) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, 5*time.Minute, func() (bool, error) { d, err := kubeClientSet.AppsV1().Deployments(resource.Namespace).Get(context.TODO(), resource.Name, metav1.GetOptions{}) if apierrors.IsNotFound(err) { @@ -605,7 +608,7 @@ func waitForDeploymentRollout(kubeClientSet kubernetes.Interface, resource *apps } // UpdateIngress runs the given updateFunc on the ingress -func UpdateIngress(kubeClientSet kubernetes.Interface, namespace string, name string, updateFunc func(d *networking.Ingress) error) error { +func UpdateIngress(kubeClientSet kubernetes.Interface, namespace, name string, updateFunc func(d *networking.Ingress) error) error { ingress, err := kubeClientSet.NetworkingV1().Ingresses(namespace).Get(context.TODO(), name, metav1.GetOptions{}) if err != nil { return err diff --git a/test/e2e/framework/grpc_fortune_teller.go b/test/e2e/framework/grpc_fortune_teller.go index 02ff3aae2..a7be46327 100644 --- a/test/e2e/framework/grpc_fortune_teller.go +++ b/test/e2e/framework/grpc_fortune_teller.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package framework import ( @@ -75,7 +76,7 @@ func (f *Framework) NewNewGRPCFortuneTellerDeploymentWithReplicas(replicas int32 d := f.EnsureDeployment(deployment) - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, metav1.ListOptions{ + err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, int(replicas), f.Namespace, &metav1.ListOptions{ LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), }) assert.Nil(ginkgo.GinkgoT(), err, "failed to wait for to become ready") diff --git a/test/e2e/framework/healthz.go b/test/e2e/framework/healthz.go index b52c3ffde..3ee297b27 100644 --- a/test/e2e/framework/healthz.go +++ b/test/e2e/framework/healthz.go @@ -26,7 +26,7 @@ func (f *Framework) VerifyHealthz(ip string, statusCode int) error { url := fmt.Sprintf("http://%v:10254/healthz", ip) client := &http.Client{} - req, err := http.NewRequest(http.MethodGet, url, nil) + req, err := http.NewRequest(http.MethodGet, url, http.NoBody) if err != nil { return fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } diff --git a/test/e2e/framework/httpexpect/match.go b/test/e2e/framework/httpexpect/match.go index b031510c4..aad10b02e 100644 --- a/test/e2e/framework/httpexpect/match.go +++ b/test/e2e/framework/httpexpect/match.go @@ -23,7 +23,7 @@ type Match struct { names map[string]int } -func makeMatch(chain chain, submatches []string, names []string) *Match { +func makeMatch(chain chain, submatches, names []string) *Match { if submatches == nil { submatches = []string{} } diff --git a/test/e2e/framework/httpexpect/object.go b/test/e2e/framework/httpexpect/object.go index f7c27faaf..49dcf5659 100644 --- a/test/e2e/framework/httpexpect/object.go +++ b/test/e2e/framework/httpexpect/object.go @@ -23,6 +23,8 @@ import ( "github.com/yudai/gojsondiff/formatter" ) +const unavailableMsg = " (unavailable)" + // Object provides methods to inspect attached map[string]interface{} object // (Go representation of JSON object). type Object struct { @@ -81,20 +83,21 @@ func diffValues(expected, actual interface{}) string { var diff gojsondiff.Diff - if ve, ok := expected.(map[string]interface{}); ok { + switch ve := expected.(type) { + case map[string]interface{}: if va, ok := actual.(map[string]interface{}); ok { diff = differ.CompareObjects(ve, va) } else { - return " (unavailable)" + return unavailableMsg } - } else if ve, ok := expected.([]interface{}); ok { + case []interface{}: if va, ok := actual.([]interface{}); ok { diff = differ.CompareArrays(ve, va) } else { - return " (unavailable)" + return unavailableMsg } - } else { - return " (unavailable)" + default: + return unavailableMsg } config := formatter.AsciiFormatterConfig{ @@ -104,7 +107,7 @@ func diffValues(expected, actual interface{}) string { str, err := f.Format(diff) if err != nil { - return " (unavailable)" + return unavailableMsg } return "--- expected\n+++ actual\n" + str diff --git a/test/e2e/framework/httpexpect/request.go b/test/e2e/framework/httpexpect/request.go index d8edb42ce..0ae85dd79 100644 --- a/test/e2e/framework/httpexpect/request.go +++ b/test/e2e/framework/httpexpect/request.go @@ -65,7 +65,7 @@ func (h *HTTPRequest) DoRequest(method, rpath string) *HTTPRequest { var request *http.Request uri.Path = path.Join(uri.Path, rpath) - if request, err = http.NewRequest(method, uri.String(), nil); err != nil { + if request, err = http.NewRequest(method, uri.String(), http.NoBody); err != nil { h.chain.fail(err.Error()) } @@ -110,6 +110,7 @@ func (h *HTTPRequest) Expect() *HTTPResponse { if err != nil { h.chain.fail(err.Error()) } + defer response.Body.Close() h.HTTPResponse.Response = response // set the HTTP response diff --git a/test/e2e/framework/k8s.go b/test/e2e/framework/k8s.go index fc3e59b08..7c067421d 100644 --- a/test/e2e/framework/k8s.go +++ b/test/e2e/framework/k8s.go @@ -47,7 +47,7 @@ func (f *Framework) EnsureSecret(secret *core.Secret) *core.Secret { } // GetConfigMap gets a ConfigMap object from the given namespace, name and returns it, throws error if it does not exist. -func (f *Framework) GetConfigMap(namespace string, name string) *core.ConfigMap { +func (f *Framework) GetConfigMap(namespace, name string) *core.ConfigMap { cm, err := f.KubeClientSet.CoreV1().ConfigMaps(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting configmap") assert.NotNil(ginkgo.GinkgoT(), cm, "expected a configmap but none returned") @@ -73,7 +73,7 @@ func (f *Framework) EnsureConfigMap(configMap *core.ConfigMap) *core.ConfigMap { } // GetIngress gets an Ingress object from the given namespace, name and returns it, throws error if it does not exists. -func (f *Framework) GetIngress(namespace string, name string) *networking.Ingress { +func (f *Framework) GetIngress(namespace, name string) *networking.Ingress { ing, err := f.KubeClientSet.NetworkingV1().Ingresses(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting ingress") assert.NotNil(ginkgo.GinkgoT(), ing, "expected an ingress but none returned") @@ -114,7 +114,7 @@ func (f *Framework) UpdateIngress(ingress *networking.Ingress) *networking.Ingre } // GetService gets a Service object from the given namespace, name and returns it, throws error if it does not exist. -func (f *Framework) GetService(namespace string, name string) *core.Service { +func (f *Framework) GetService(namespace, name string) *core.Service { s, err := f.KubeClientSet.CoreV1().Services(namespace).Get(context.TODO(), name, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "getting service") assert.NotNil(ginkgo.GinkgoT(), s, "expected a service but none returned") @@ -143,16 +143,21 @@ func (f *Framework) EnsureDeployment(deployment *appsv1.Deployment) *appsv1.Depl } // waitForPodsReady waits for a given amount of time until a group of Pods is running in the given namespace. -func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, expectedReplicas int, namespace string, opts metav1.ListOptions) error { +func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, expectedReplicas int, namespace string, opts *metav1.ListOptions) error { + //nolint:staticcheck // TODO: will replace it since wait.PollImmediate is deprecated return wait.PollImmediate(1*time.Second, timeout, func() (bool, error) { - pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), opts) + pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), *opts) if err != nil { return false, nil } r := 0 - for _, p := range pl.Items { - if isRunning, _ := podRunningReady(&p); isRunning { + for i := range pl.Items { + isRunning, err := podRunningReady(&pl.Items[i]) + if err != nil { + Logf("error checking if pod is running : %v", err) + } + if isRunning { r++ } } @@ -166,9 +171,10 @@ func waitForPodsReady(kubeClientSet kubernetes.Interface, timeout time.Duration, } // waitForPodsDeleted waits for a given amount of time until a group of Pods are deleted in the given namespace. -func waitForPodsDeleted(kubeClientSet kubernetes.Interface, timeout time.Duration, namespace string, opts metav1.ListOptions) error { +func waitForPodsDeleted(kubeClientSet kubernetes.Interface, timeout time.Duration, namespace string, opts *metav1.ListOptions) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, timeout, func() (bool, error) { - pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), opts) + pl, err := kubeClientSet.CoreV1().Pods(namespace).List(context.TODO(), *opts) if err != nil { return false, nil } @@ -186,7 +192,7 @@ func WaitForEndpoints(kubeClientSet kubernetes.Interface, timeout time.Duration, if expectedEndpoints == 0 { return nil } - + //nolint:staticcheck // TODO: will replace it since wait.PollImmediate is deprecated return wait.PollImmediate(Poll, timeout, func() (bool, error) { endpoint, err := kubeClientSet.CoreV1().Endpoints(ns).Get(context.TODO(), name, metav1.GetOptions{}) if k8sErrors.IsNotFound(err) { @@ -248,6 +254,7 @@ func isPodReady(p *core.Pod) bool { // getIngressNGINXPod returns the ingress controller running pod func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Pod, error) { var pod *core.Pod + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(1*time.Second, DefaultTimeout, func() (bool, error) { l, err := kubeClientSet.CoreV1().Pods(ns).List(context.TODO(), metav1.ListOptions{ LabelSelector: "app.kubernetes.io/name=ingress-nginx", @@ -256,15 +263,16 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po return false, nil } - for _, p := range l.Items { + for i := range l.Items { + p := &l.Items[i] if strings.HasPrefix(p.GetName(), "nginx-ingress-controller") { - isRunning, err := podRunningReady(&p) + isRunning, err := podRunningReady(p) if err != nil { continue } if isRunning { - pod = &p + pod = p return true, nil } } @@ -273,6 +281,7 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po return false, nil }) if err != nil { + //nolint:staticcheck // TODO: will replace it since wait.ErrWaitTimeout is deprecated if err == wait.ErrWaitTimeout { return nil, fmt.Errorf("timeout waiting at least one ingress-nginx pod running in namespace %v", ns) } @@ -285,7 +294,7 @@ func getIngressNGINXPod(ns string, kubeClientSet kubernetes.Interface) (*core.Po func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj *appsv1.Deployment) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.AppsV1().Deployments(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -298,7 +307,7 @@ func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj * if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -306,7 +315,7 @@ func createDeploymentWithRetries(c kubernetes.Interface, namespace string, obj * func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *core.Secret) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.CoreV1().Secrets(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -319,14 +328,14 @@ func createSecretWithRetries(c kubernetes.Interface, namespace string, obj *core if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) } func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *core.Service) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.CoreV1().Services(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -339,7 +348,7 @@ func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *cor if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -347,7 +356,7 @@ func createServiceWithRetries(c kubernetes.Interface, namespace string, obj *cor func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *networking.Ingress) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } createFunc := func() (bool, error) { _, err := c.NetworkingV1().Ingresses(namespace).Create(context.TODO(), obj, metav1.CreateOptions{}) @@ -360,7 +369,7 @@ func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *net if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to create object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to create object with non-retriable error: %v", err) } return retryWithExponentialBackOff(createFunc) @@ -368,7 +377,7 @@ func createIngressWithRetries(c kubernetes.Interface, namespace string, obj *net func updateIngressWithRetries(c kubernetes.Interface, namespace string, obj *networking.Ingress) error { if obj == nil { - return fmt.Errorf("Object provided to create is empty") + return fmt.Errorf("object provided to create is empty") } updateFunc := func() (bool, error) { _, err := c.NetworkingV1().Ingresses(namespace).Update(context.TODO(), obj, metav1.UpdateOptions{}) @@ -378,7 +387,7 @@ func updateIngressWithRetries(c kubernetes.Interface, namespace string, obj *net if isRetryableAPIError(err) { return false, nil } - return false, fmt.Errorf("Failed to update object with non-retriable error: %v", err) + return false, fmt.Errorf("failed to update object with non-retriable error: %v", err) } return retryWithExponentialBackOff(updateFunc) diff --git a/test/e2e/framework/metrics.go b/test/e2e/framework/metrics.go index 830237540..774f1bd7e 100644 --- a/test/e2e/framework/metrics.go +++ b/test/e2e/framework/metrics.go @@ -29,7 +29,7 @@ func (f *Framework) GetMetric(metricName, ip string) (*dto.MetricFamily, error) url := fmt.Sprintf("http://%v:10254/metrics", ip) client := &http.Client{} - req, err := http.NewRequest(http.MethodGet, url, nil) + req, err := http.NewRequest(http.MethodGet, url, http.NoBody) if err != nil { return nil, fmt.Errorf("creating GET request for URL %q failed: %v", url, err) } @@ -44,7 +44,6 @@ func (f *Framework) GetMetric(metricName, ip string) (*dto.MetricFamily, error) var parser expfmt.TextParser metrics, err := parser.TextToMetricFamilies(resp.Body) - if err != nil { return nil, fmt.Errorf("reading text format failed: %v", err) } diff --git a/test/e2e/framework/ssl.go b/test/e2e/framework/ssl.go index 52ceffc57..d6252fe47 100644 --- a/test/e2e/framework/ssl.go +++ b/test/e2e/framework/ssl.go @@ -93,8 +93,8 @@ func CreateIngressTLSSecret(client kubernetes.Interface, hosts []string, secretN // CreateIngressMASecret creates or updates a Secret containing a Mutual Auth // certificate-chain for the given Ingress and returns a TLS configuration suitable // for HTTP clients to use against that particular Ingress. -func CreateIngressMASecret(client kubernetes.Interface, host string, secretName, namespace string) (*tls.Config, error) { - if len(host) == 0 { +func CreateIngressMASecret(client kubernetes.Interface, host, secretName, namespace string) (*tls.Config, error) { + if host == "" { return nil, fmt.Errorf("requires a non-empty host") } @@ -138,12 +138,13 @@ func CreateIngressMASecret(client kubernetes.Interface, host string, secretName, return &tls.Config{ ServerName: host, Certificates: []tls.Certificate{clientPair}, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }, nil } // WaitForTLS waits until the TLS handshake with a given server completes successfully. func WaitForTLS(url string, tlsConfig *tls.Config) { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err := wait.Poll(Poll, DefaultTimeout, matchTLSServerName(url, tlsConfig)) assert.Nil(ginkgo.GinkgoT(), err, "waiting for TLS configuration in URL %s", url) } @@ -160,7 +161,6 @@ func generateRSACert(host string, isCA bool, keyOut, certOut io.Writer) error { serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumber, err := rand.Int(rand.Reader, serialNumberLimit) - if err != nil { return fmt.Errorf("failed to generate serial number: %s", err) } @@ -329,7 +329,7 @@ func tlsConfig(serverName string, pemCA []byte) (*tls.Config, error) { if !rootCAPool.AppendCertsFromPEM(pemCA) { return nil, fmt.Errorf("error creating CA certificate pool (%s)", serverName) } - return &tls.Config{ + return &tls.Config{ //nolint:gosec // Ignore the gosec error in testing ServerName: serverName, RootCAs: rootCAPool, }, nil diff --git a/test/e2e/framework/test_context.go b/test/e2e/framework/test_context.go index be4cd6e5e..961357885 100644 --- a/test/e2e/framework/test_context.go +++ b/test/e2e/framework/test_context.go @@ -23,7 +23,7 @@ import ( // TestContextType describes the client context to use in communications with the Kubernetes API. type TestContextType struct { KubeHost string - //KubeConfig string + // KubeConfig string KubeContext string } @@ -33,7 +33,6 @@ var TestContext TestContextType // registerCommonFlags registers flags common to all e2e test suites. func registerCommonFlags() { flag.StringVar(&TestContext.KubeHost, "kubernetes-host", "http://127.0.0.1:8080", "The kubernetes host, or apiserver, to connect to") - //flag.StringVar(&TestContext.KubeConfig, "kubernetes-config", os.Getenv(clientcmd.RecommendedConfigPathEnvVar), "Path to config containing embedded authinfo for kubernetes. Default value is from environment variable "+clientcmd.RecommendedConfigPathEnvVar) flag.StringVar(&TestContext.KubeContext, "kubernetes-context", "", "config context to use for kubernetes. If unset, will use value from 'current-context'") } diff --git a/test/e2e/framework/util.go b/test/e2e/framework/util.go index 90f15eb1b..abdb168e1 100644 --- a/test/e2e/framework/util.go +++ b/test/e2e/framework/util.go @@ -49,24 +49,24 @@ func nowStamp() string { return time.Now().Format(time.StampMilli) } -func log(level string, format string, args ...interface{}) { +func logf(level, format string, args ...interface{}) { fmt.Fprintf(ginkgo.GinkgoWriter, nowStamp()+": "+level+": "+format+"\n", args...) } // Logf logs to the INFO logs. func Logf(format string, args ...interface{}) { - log("INFO", format, args...) + logf("INFO", format, args...) } // Failf logs to the INFO logs and fails the test. func Failf(format string, args ...interface{}) { msg := fmt.Sprintf(format, args...) - log("INFO", msg) + logf("INFO", msg) ginkgo.Fail(nowStamp()+": "+msg, 1) } // RestclientConfig deserializes the contents of a kubeconfig file into a Config object. -func RestclientConfig(config, context string) (*api.Config, error) { +func RestclientConfig(config, newContext string) (*api.Config, error) { Logf(">>> config: %s\n", config) if config == "" { return nil, fmt.Errorf("config file must be specified to load client config") @@ -75,9 +75,9 @@ func RestclientConfig(config, context string) (*api.Config, error) { if err != nil { return nil, fmt.Errorf("error loading config: %v", err.Error()) } - if context != "" { - Logf(">>> context: %s\n", context) - c.CurrentContext = context + if newContext != "" { + Logf(">>> context: %s\n", newContext) + c.CurrentContext = newContext } return c, nil } @@ -98,6 +98,7 @@ func createNamespace(baseName string, labels map[string]string, c kubernetes.Int var got *corev1.Namespace var err error + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(Poll, DefaultTimeout, func() (bool, error) { got, err = c.CoreV1().Namespaces().Create(context.TODO(), ns, metav1.CreateOptions{}) if err != nil { @@ -114,13 +115,11 @@ func createNamespace(baseName string, labels map[string]string, c kubernetes.Int // CreateKubeNamespace creates a new namespace in the cluster func CreateKubeNamespace(baseName string, c kubernetes.Interface) (string, error) { - return createNamespace(baseName, nil, c) } // CreateKubeNamespaceWithLabel creates a new namespace with given labels in the cluster func CreateKubeNamespaceWithLabel(baseName string, labels map[string]string, c kubernetes.Interface) (string, error) { - return createNamespace(baseName, labels, c) } @@ -150,7 +149,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass %s: %v", icname, err) } _, err = c.RbacV1().ClusterRoles().Create(context.TODO(), &rbacv1.ClusterRole{ @@ -162,7 +161,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }}, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass ClusterRole %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass ClusterRole %s: %v", icname, err) } _, err = c.RbacV1().ClusterRoleBindings().Create(context.TODO(), &rbacv1.ClusterRoleBinding{ @@ -184,7 +183,7 @@ func CreateIngressClass(namespace string, c kubernetes.Interface) (string, error }, }, metav1.CreateOptions{}) if err != nil { - return "", fmt.Errorf("Unexpected error creating IngressClass ClusterRoleBinding %s: %v", icname, err) + return "", fmt.Errorf("unexpected error creating IngressClass ClusterRoleBinding %s: %v", icname, err) } return ic.Name, nil } @@ -200,16 +199,16 @@ func deleteIngressClass(c kubernetes.Interface, ingressclass string) error { } err = c.NetworkingV1().IngressClasses().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass %s: %v", ingressclass, err) } err = c.RbacV1().ClusterRoleBindings().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass ClusterRoleBinding %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass ClusterRoleBinding %s: %v", ingressclass, err) } err = c.RbacV1().ClusterRoles().Delete(context.TODO(), ingressclass, deleteOptions) if err != nil { - return fmt.Errorf("Unexpected error deleting IngressClass ClusterRole %s: %v", ingressclass, err) + return fmt.Errorf("unexpected error deleting IngressClass ClusterRole %s: %v", ingressclass, err) } return nil @@ -223,6 +222,7 @@ func GetIngressClassName(namespace string) *string { // WaitForKubeNamespaceNotExist waits until a namespaces is not present in the cluster func WaitForKubeNamespaceNotExist(c kubernetes.Interface, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, namespaceNotExist(c, namespace)) } @@ -241,6 +241,7 @@ func namespaceNotExist(c kubernetes.Interface, namespace string) wait.ConditionF // WaitForNoPodsInNamespace waits until there are no pods running in a namespace func WaitForNoPodsInNamespace(c kubernetes.Interface, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, noPodsInNamespace(c, namespace)) } @@ -267,15 +268,17 @@ func WaitForPodRunningInNamespace(c kubernetes.Interface, pod *corev1.Pod) error if pod.Status.Phase == corev1.PodRunning { return nil } - return waitTimeoutForPodRunningInNamespace(c, pod.Name, pod.Namespace, DefaultTimeout) + return waitTimeoutForPodRunningInNamespace(c, pod.Name, pod.Namespace) } -func waitTimeoutForPodRunningInNamespace(c kubernetes.Interface, podName, namespace string, timeout time.Duration) error { +func waitTimeoutForPodRunningInNamespace(c kubernetes.Interface, podName, namespace string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, podRunning(c, podName, namespace)) } // WaitForSecretInNamespace waits a default amount of time for the specified secret is present in a particular namespace func WaitForSecretInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, secretInNamespace(c, namespace, name)) } @@ -298,6 +301,7 @@ func secretInNamespace(c kubernetes.Interface, namespace, name string) wait.Cond // WaitForFileInFS waits a default amount of time for the specified file is present in the filesystem func WaitForFileInFS(file string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, fileInFS(file)) } @@ -322,6 +326,7 @@ func fileInFS(file string) wait.ConditionFunc { // WaitForNoIngressInNamespace waits until there is no ingress object in a particular namespace func WaitForNoIngressInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, noIngressInNamespace(c, namespace, name)) } @@ -344,6 +349,7 @@ func noIngressInNamespace(c kubernetes.Interface, namespace, name string) wait.C // WaitForIngressInNamespace waits until a particular ingress object exists namespace func WaitForIngressInNamespace(c kubernetes.Interface, namespace, name string) error { + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated return wait.Poll(Poll, DefaultTimeout, ingressInNamespace(c, namespace, name)) } diff --git a/test/e2e/gracefulshutdown/grace_period.go b/test/e2e/gracefulshutdown/grace_period.go index 12e2f3d67..123892f3a 100644 --- a/test/e2e/gracefulshutdown/grace_period.go +++ b/test/e2e/gracefulshutdown/grace_period.go @@ -33,7 +33,6 @@ var _ = framework.IngressNginxDescribe("[Shutdown] Grace period shutdown", func( f := framework.NewDefaultFramework("shutdown-grace-period") ginkgo.It("/healthz should return status code 500 during shutdown grace period", func() { - f.NewSlowEchoDeployment() err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { @@ -83,6 +82,5 @@ var _ = framework.IngressNginxDescribe("[Shutdown] Grace period shutdown", func( for _, err := range <-result { assert.Nil(ginkgo.GinkgoT(), err) } - }) }) diff --git a/test/e2e/ingress/pathtype_exact.go b/test/e2e/ingress/pathtype_exact.go index ae2902e9f..ccc76b5bc 100644 --- a/test/e2e/ingress/pathtype_exact.go +++ b/test/e2e/ingress/pathtype_exact.go @@ -35,14 +35,13 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] exact", func() { }) ginkgo.It("should choose exact location for /exact", func() { - host := "exact.path" annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_input_headers "pathType: exact";`, } - var exactPathType = networking.PathTypeExact + exactPathType := networking.PathTypeExact ing := framework.NewSingleIngress("exact", "/exact", host, f.Namespace, framework.EchoService, 80, annotations) ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &exactPathType f.EnsureIngress(ing) diff --git a/test/e2e/ingress/pathtype_mixed.go b/test/e2e/ingress/pathtype_mixed.go index dd183bbb4..c55a2c32a 100644 --- a/test/e2e/ingress/pathtype_mixed.go +++ b/test/e2e/ingress/pathtype_mixed.go @@ -34,10 +34,9 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] mix Exact and Prefi f.NewEchoDeployment() }) - var exactPathType = networking.PathTypeExact + exactPathType := networking.PathTypeExact ginkgo.It("should choose the correct location", func() { - host := "mixed.path" annotations := map[string]string{ diff --git a/test/e2e/leaks/lua_ssl.go b/test/e2e/leaks/lua_ssl.go index e63a1e353..88285ba4b 100644 --- a/test/e2e/leaks/lua_ssl.go +++ b/test/e2e/leaks/lua_ssl.go @@ -87,14 +87,14 @@ func provisionIngress(hostname string, f *framework.Framework) { func checkIngress(hostname string, f *framework.Framework) { resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ ServerName: hostname, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }). GET("/"). WithURL(f.GetURL(framework.HTTPS)). WithHeader("Host", hostname). Expect(). Raw() - + defer resp.Body.Close() assert.Equal(ginkgo.GinkgoT(), resp.StatusCode, http.StatusOK) // check the returned secret is not the fake one diff --git a/test/e2e/loadbalance/configmap.go b/test/e2e/loadbalance/configmap.go index 8cd47286b..737cd06dd 100644 --- a/test/e2e/loadbalance/configmap.go +++ b/test/e2e/loadbalance/configmap.go @@ -25,6 +25,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const loadBalanceHost = "load-balance.com" + var _ = framework.DescribeSetting("[Load Balancer] load-balance", func() { f := framework.NewDefaultFramework("lb-configmap") @@ -33,7 +35,7 @@ var _ = framework.DescribeSetting("[Load Balancer] load-balance", func() { }) ginkgo.It("should apply the configmap load-balance setting", func() { - host := "load-balance.com" + host := loadBalanceHost f.UpdateNginxConfigMapData("load-balance", "ewma") diff --git a/test/e2e/loadbalance/ewma.go b/test/e2e/loadbalance/ewma.go index e2750a09a..f457e6357 100644 --- a/test/e2e/loadbalance/ewma.go +++ b/test/e2e/loadbalance/ewma.go @@ -35,12 +35,13 @@ var _ = framework.DescribeSetting("[Load Balancer] EWMA", func() { f.NewEchoDeployment(framework.WithDeploymentReplicas(3)) f.SetNginxConfigMapData(map[string]string{ "worker-processes": "2", - "load-balance": "ewma"}, + "load-balance": "ewma", + }, ) }) ginkgo.It("does not fail requests", func() { - host := "load-balance.com" + host := loadBalanceHost f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) f.WaitForNginxServer(host, @@ -52,7 +53,9 @@ var _ = framework.DescribeSetting("[Load Balancer] EWMA", func() { assert.Nil(ginkgo.GinkgoT(), err) assert.Equal(ginkgo.GinkgoT(), algorithm, "ewma") - re, _ := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + replicaRequestCount := map[string]int{} for i := 0; i < 30; i++ { diff --git a/test/e2e/loadbalance/round_robin.go b/test/e2e/loadbalance/round_robin.go index 2d0582e9a..5f6667143 100644 --- a/test/e2e/loadbalance/round_robin.go +++ b/test/e2e/loadbalance/round_robin.go @@ -37,7 +37,7 @@ var _ = framework.DescribeSetting("[Load Balancer] round-robin", func() { }) ginkgo.It("should evenly distribute requests with round-robin (default algorithm)", func() { - host := "load-balance.com" + host := loadBalanceHost f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) f.WaitForNginxServer(host, @@ -45,7 +45,9 @@ var _ = framework.DescribeSetting("[Load Balancer] round-robin", func() { return strings.Contains(server, "server_name load-balance.com") }) - re, _ := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + re, err := regexp.Compile(fmt.Sprintf(`%v.*`, framework.EchoService)) + assert.Nil(ginkgo.GinkgoT(), err, "error compiling regex") + replicaRequestCount := map[string]int{} for i := 0; i < 600; i++ { diff --git a/test/e2e/lua/dynamic_certificates.go b/test/e2e/lua/dynamic_certificates.go index 0160cc9e7..8c9df5e71 100644 --- a/test/e2e/lua/dynamic_certificates.go +++ b/test/e2e/lua/dynamic_certificates.go @@ -245,7 +245,6 @@ var _ = framework.IngressNginxDescribe("[Lua] dynamic certificates", func() { WithHeader("Host", host). Expect(). Status(http.StatusOK) - }) }) }) @@ -254,7 +253,6 @@ func extractReloadCount(mf *dto.MetricFamily) (float64, error) { vec, err := expfmt.ExtractSamples(&expfmt.DecodeOptions{ Timestamp: model.Now(), }, mf) - if err != nil { return 0, err } diff --git a/test/e2e/lua/dynamic_configuration.go b/test/e2e/lua/dynamic_configuration.go index 8e9804545..8ec1ef839 100644 --- a/test/e2e/lua/dynamic_configuration.go +++ b/test/e2e/lua/dynamic_configuration.go @@ -26,7 +26,6 @@ import ( "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" - networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" @@ -199,20 +198,18 @@ var _ = framework.IngressNginxDescribe("[Lua] dynamic configuration", func() { }) }) -func ensureIngress(f *framework.Framework, host string, deploymentName string) *networking.Ingress { - ing := createIngress(f, host, deploymentName) +func ensureIngress(f *framework.Framework, host, deploymentName string) { + createIngress(f, host, deploymentName) f.HTTPTestClient(). GET("/"). WithHeader("Host", host). Expect(). Status(http.StatusOK) - - return ing } -func createIngress(f *framework.Framework, host string, deploymentName string) *networking.Ingress { - ing := f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, deploymentName, 80, +func createIngress(f *framework.Framework, host, deploymentName string) { + f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, deploymentName, 80, map[string]string{ "nginx.ingress.kubernetes.io/load-balance": "ewma", }, @@ -223,21 +220,19 @@ func createIngress(f *framework.Framework, host string, deploymentName string) * return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) && strings.Contains(server, "proxy_pass http://upstream_balancer;") }) - - return ing } -func ensureHTTPSRequest(f *framework.Framework, url string, host string, expectedDNSName string) { +func ensureHTTPSRequest(f *framework.Framework, url, host, expectedDNSName string) { resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ ServerName: host, - InsecureSkipVerify: true, + InsecureSkipVerify: true, //nolint:gosec // Ignore the gosec error in testing }). GET("/"). WithURL(url). WithHeader("Host", host). Expect(). Raw() - + defer resp.Body.Close() assert.Equal(ginkgo.GinkgoT(), resp.StatusCode, http.StatusOK) assert.Equal(ginkgo.GinkgoT(), len(resp.TLS.PeerCertificates), 1) assert.Equal(ginkgo.GinkgoT(), resp.TLS.PeerCertificates[0].DNSNames[0], expectedDNSName) diff --git a/test/e2e/nginx/nginx.go b/test/e2e/nginx/nginx.go index cd14a931c..7e572a976 100644 --- a/test/e2e/nginx/nginx.go +++ b/test/e2e/nginx/nginx.go @@ -100,7 +100,6 @@ var _ = framework.DescribeSetting("nginx-configuration", func() { f := framework.NewSimpleFramework("nginxconfiguration") ginkgo.It("start nginx with default configuration", func() { - f.NGINXWithConfigDeployment("default-nginx", cfgOK) f.WaitForPod("app=default-nginx", 60*time.Second, false) framework.Sleep(5 * time.Second) @@ -113,20 +112,16 @@ var _ = framework.DescribeSetting("nginx-configuration", func() { }) ginkgo.It("fails when using alias directive", func() { - f.NGINXDeployment("alias-nginx", cfgAlias, false) // This should fail with a crashloopback because our NGINX does not have // alias directive! f.WaitForPod("app=alias-nginx", 60*time.Second, true) - }) ginkgo.It("fails when using root directive", func() { - f.NGINXDeployment("root-nginx", cfgRoot, false) // This should fail with a crashloopback because our NGINX does not have // root directive! f.WaitForPod("app=root-nginx", 60*time.Second, true) - }) }) diff --git a/test/e2e/security/request_smuggling.go b/test/e2e/security/request_smuggling.go index 58b17c4d8..5ede02d4b 100644 --- a/test/e2e/security/request_smuggling.go +++ b/test/e2e/security/request_smuggling.go @@ -50,9 +50,9 @@ server { f.UpdateNginxConfigMapData("http-snippet", snippet) - //TODO: currently using a self hosted HTTPBun instance results in a 499, we - //should move away from using httpbun.com once we have the httpbun - //deployment as part of the framework + // TODO: currently using a self hosted HTTPBun instance results in a 499, we + // should move away from using httpbun.com once we have the httpbun + // deployment as part of the framework ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, map[string]string{ "nginx.ingress.kubernetes.io/auth-signin": "https://httpbun.com/bearer/d4bcba7a-0def-4a31-91a7-47e420adf44b", "nginx.ingress.kubernetes.io/auth-url": "https://httpbun.com/basic-auth/user/passwd", @@ -91,7 +91,7 @@ func smugglingRequest(host, addr string, port int) (string, error) { // wait for /_hidden/index.html response framework.Sleep() - var buf = make([]byte, 1024) + buf := make([]byte, 1024) r := bufio.NewReader(conn) _, err = r.Read(buf) if err != nil { diff --git a/test/e2e/servicebackend/service_backend.go b/test/e2e/servicebackend/service_backend.go index 44f3d36a5..6ab2f8ad1 100644 --- a/test/e2e/servicebackend/service_backend.go +++ b/test/e2e/servicebackend/service_backend.go @@ -29,48 +29,50 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) -var pathtype = networking.PathTypePrefix -var _ = framework.IngressNginxDescribe("[Service] backend status code 503", func() { - f := framework.NewDefaultFramework("service-backend") +var ( + pathtype = networking.PathTypePrefix + _ = framework.IngressNginxDescribe("[Service] backend status code 503", func() { + f := framework.NewDefaultFramework("service-backend") - ginkgo.It("should return 503 when backend service does not exist", func() { - host := "nonexistent.svc.com" + ginkgo.It("should return 503 when backend service does not exist", func() { + host := "nonexistent.svc.com" - bi := buildIngressWithNonexistentService(host, f.Namespace, "/") - f.EnsureIngress(bi) + bi := buildIngressWithNonexistentService(host, f.Namespace, "/") + f.EnsureIngress(bi) - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "proxy_pass http://upstream_balancer;") - }) + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "proxy_pass http://upstream_balancer;") + }) - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - Expect(). - Status(http.StatusServiceUnavailable) + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusServiceUnavailable) + }) + + ginkgo.It("should return 503 when all backend service endpoints are unavailable", func() { + host := "unavailable.svc.com" + + bi, bs := buildIngressWithUnavailableServiceEndpoints(host, f.Namespace, "/") + + f.EnsureService(bs) + f.EnsureIngress(bi) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "proxy_pass http://upstream_balancer;") + }) + + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusServiceUnavailable) + }) }) - - ginkgo.It("should return 503 when all backend service endpoints are unavailable", func() { - host := "unavailable.svc.com" - - bi, bs := buildIngressWithUnavailableServiceEndpoints(host, f.Namespace, "/") - - f.EnsureService(bs) - f.EnsureIngress(bi) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, "proxy_pass http://upstream_balancer;") - }) - - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - Expect(). - Status(http.StatusServiceUnavailable) - }) -}) +) func buildIngressWithNonexistentService(host, namespace, path string) *networking.Ingress { backendService := "nonexistent-svc" @@ -146,14 +148,15 @@ func buildIngressWithUnavailableServiceEndpoints(host, namespace, path string) ( Name: backendService, Namespace: namespace, }, - Spec: corev1.ServiceSpec{Ports: []corev1.ServicePort{ - { - Name: "tcp", - Port: 80, - TargetPort: intstr.FromInt(80), - Protocol: "TCP", + Spec: corev1.ServiceSpec{ + Ports: []corev1.ServicePort{ + { + Name: "tcp", + Port: 80, + TargetPort: intstr.FromInt(80), + Protocol: "TCP", + }, }, - }, Selector: map[string]string{ "app": backendService, }, diff --git a/test/e2e/servicebackend/service_externalname.go b/test/e2e/servicebackend/service_externalname.go index 429690ff1..fccd1cd19 100644 --- a/test/e2e/servicebackend/service_externalname.go +++ b/test/e2e/servicebackend/service_externalname.go @@ -33,12 +33,14 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const echoHost = "echo" + var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f := framework.NewDefaultFramework("type-externalname", framework.WithHTTPBunEnabled()) ginkgo.It("works with external name set to incomplete fqdn", func() { f.NewEchoDeployment() - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -74,7 +76,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName without a port defined", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -114,7 +116,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName with a port defined", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -144,7 +146,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return status 502 for service type=ExternalName with an invalid host", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -180,7 +182,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using a port name", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -221,7 +223,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using FQDN with trailing dot", func() { - host := "echo" + host := echoHost svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ @@ -257,7 +259,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should update the external name after a service update", func() { - host := "echo" + host := echoHost svc := framework.BuildNIPExternalNameService(f, f.HTTPBunIP, host) f.EnsureService(svc) @@ -306,7 +308,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Get(context.TODO(), framework.NIPService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining external service") - //Deploy a new instance to switch routing to + // Deploy a new instance to switch routing to ip := f.NewHttpbunDeployment(framework.WithDeploymentName("eu-server")) svc.Spec.ExternalName = framework.BuildNIPHost(ip) @@ -335,12 +337,12 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains( ginkgo.GinkgoT(), output, - fmt.Sprintf(`"address": "%s"`, framework.BuildNIPHost(ip)), + fmt.Sprintf(`"address": %q`, framework.BuildNIPHost(ip)), ) }) ginkgo.It("should sync ingress on external name service addition/deletion", func() { - host := "echo" + host := echoHost // Create the Ingress first ing := framework.NewSingleIngress(host, diff --git a/test/e2e/servicebackend/service_nil_backend.go b/test/e2e/servicebackend/service_nil_backend.go index c44601c88..9b5b4c7e6 100644 --- a/test/e2e/servicebackend/service_nil_backend.go +++ b/test/e2e/servicebackend/service_nil_backend.go @@ -64,7 +64,6 @@ var _ = framework.IngressNginxDescribe("[Service] Nil Service Backend", func() { WithHeader("Host", invalidHost). Expect(). Status(http.StatusNotFound) - }) }) diff --git a/test/e2e/settings/access_log.go b/test/e2e/settings/access_log.go index 7c7e2b9e3..65b9dfda4 100644 --- a/test/e2e/settings/access_log.go +++ b/test/e2e/settings/access_log.go @@ -28,7 +28,6 @@ var _ = framework.DescribeSetting("access-log", func() { f := framework.NewDefaultFramework("access-log") ginkgo.Context("access-log-path", func() { - ginkgo.It("use the default configuration", func() { f.WaitForNginxConfiguration( func(cfg string) bool { @@ -50,7 +49,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("http-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.UpdateNginxConfigMapData("http-access-log-path", "/tmp/nginx/http-access.log") f.WaitForNginxConfiguration( @@ -63,7 +61,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("stream-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.UpdateNginxConfigMapData("stream-access-log-path", "/tmp/nginx/stream-access.log") f.WaitForNginxConfiguration( @@ -76,7 +73,6 @@ var _ = framework.DescribeSetting("access-log", func() { }) ginkgo.Context("http-access-log-path & stream-access-log-path", func() { - ginkgo.It("use the specified configuration", func() { f.SetNginxConfigMapData(map[string]string{ "http-access-log-path": "/tmp/nginx/http-access.log", diff --git a/test/e2e/settings/badannotationvalues.go b/test/e2e/settings/badannotationvalues.go index b4b6def4a..68a122e76 100644 --- a/test/e2e/settings/badannotationvalues.go +++ b/test/e2e/settings/badannotationvalues.go @@ -100,7 +100,6 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place", func() { - hostValid := "custom-allowed-value-test" annotationsValid := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": ` @@ -159,6 +158,5 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { WithHeader("Host", host). Expect(). Status(http.StatusNotFound) - }) }) diff --git a/test/e2e/settings/default_ssl_certificate.go b/test/e2e/settings/default_ssl_certificate.go index ea97d4895..c48a1e87f 100644 --- a/test/e2e/settings/default_ssl_certificate.go +++ b/test/e2e/settings/default_ssl_certificate.go @@ -30,10 +30,12 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const fooHost = "foo" + var _ = framework.IngressNginxDescribe("[SSL] [Flag] default-ssl-certificate", func() { f := framework.NewDefaultFramework("default-ssl-certificate") var tlsConfig *tls.Config - secretName := "my-custom-cert" + secretName := "my-custom-cert" //nolint:gosec // Ignore the gosec error in testing service := framework.EchoService port := 80 @@ -78,7 +80,7 @@ var _ = framework.IngressNginxDescribe("[SSL] [Flag] default-ssl-certificate", f }) ginkgo.It("uses default ssl certificate for host based ingress when configured certificate does not match host", func() { - host := "foo" + host := fooHost ing := f.EnsureIngress(framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, service, port, nil)) _, err := framework.CreateIngressTLSSecret(f.KubeClientSet, diff --git a/test/e2e/settings/disable_catch_all.go b/test/e2e/settings/disable_catch_all.go index 0d1a14493..4e7a16f4d 100644 --- a/test/e2e/settings/disable_catch_all.go +++ b/test/e2e/settings/disable_catch_all.go @@ -48,7 +48,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should ignore catch all Ingress with backend", func() { - host := "foo" + host := fooHost ing := framework.NewSingleCatchAllIngress("catch-all", f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -67,7 +67,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should ignore catch all Ingress with backend and rules", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngressWithBackendAndRules(host, "/", host, f.Namespace, framework.EchoService, 80, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -79,7 +79,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should delete Ingress updated to catch-all", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -121,7 +121,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-catch-all", func() { }) ginkgo.It("should allow Ingress with rules", func() { - host := "foo" + host := fooHost ing := framework.NewSingleIngress("not-catch-all", "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) diff --git a/test/e2e/settings/disable_service_external_name.go b/test/e2e/settings/disable_service_external_name.go index 4ecf69e81..602828089 100644 --- a/test/e2e/settings/disable_service_external_name.go +++ b/test/e2e/settings/disable_service_external_name.go @@ -95,6 +95,5 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-service-external-name", f WithHeader("Host", externalhost). Expect(). StatusRange(httpexpect.Status5xx) - }) }) diff --git a/test/e2e/settings/disable_sync_events.go b/test/e2e/settings/disable_sync_events.go index 7d1298087..033fd9194 100644 --- a/test/e2e/settings/disable_sync_events.go +++ b/test/e2e/settings/disable_sync_events.go @@ -50,6 +50,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.NotEmpty(ginkgo.GinkgoT(), events.Items, "got events") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should create sync events", func() { host := "disable-sync-events-false" f.NewEchoDeployment(framework.WithDeploymentReplicas(1)) @@ -77,6 +78,7 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.NotEmpty(ginkgo.GinkgoT(), events.Items, "got events") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should not create sync events", func() { host := "disable-sync-events-true" f.NewEchoDeployment(framework.WithDeploymentReplicas(1)) @@ -103,5 +105,4 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-sync-events", func() { assert.Empty(ginkgo.GinkgoT(), events.Items, "got events") }) - }) diff --git a/test/e2e/settings/forwarded_headers.go b/test/e2e/settings/forwarded_headers.go index d4ffee545..44460aca6 100644 --- a/test/e2e/settings/forwarded_headers.go +++ b/test/e2e/settings/forwarded_headers.go @@ -26,6 +26,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const forwardedHeadersHost = "forwarded-headers" + var _ = framework.DescribeSetting("use-forwarded-headers", func() { f := framework.NewDefaultFramework("forwarded-headers") @@ -37,7 +39,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { }) ginkgo.It("should trust X-Forwarded headers when setting is true", func() { - host := "forwarded-headers" + host := forwardedHeadersHost f.UpdateNginxConfigMapData(setting, "true") @@ -89,7 +91,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() { }) ginkgo.It("should not trust X-Forwarded headers when setting is false", func() { - host := "forwarded-headers" + host := forwardedHeadersHost f.UpdateNginxConfigMapData(setting, "false") diff --git a/test/e2e/settings/geoip2.go b/test/e2e/settings/geoip2.go index 9b2ca8624..6dd48b2ad 100644 --- a/test/e2e/settings/geoip2.go +++ b/test/e2e/settings/geoip2.go @@ -19,11 +19,10 @@ package settings import ( "context" "fmt" + "net/http" "path/filepath" "strings" - "net/http" - "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -72,8 +71,7 @@ var _ = framework.DescribeSetting("Geoip2", func() { f.UpdateNginxConfigMapData("use-geoip2", "true") - httpSnippetAllowingOnlyAustralia := - `map $geoip2_city_country_code $blocked_country { + httpSnippetAllowingOnlyAustralia := `map $geoip2_city_country_code $blocked_country { default 1; AU 0; }` @@ -85,8 +83,7 @@ var _ = framework.DescribeSetting("Geoip2", func() { return strings.Contains(cfg, "map $geoip2_city_country_code $blocked_country") }) - configSnippet := - `if ($blocked_country) { + configSnippet := `if ($blocked_country) { return 403; }` diff --git a/test/e2e/settings/global_external_auth.go b/test/e2e/settings/global_external_auth.go index cc98099ae..741e6f955 100644 --- a/test/e2e/settings/global_external_auth.go +++ b/test/e2e/settings/global_external_auth.go @@ -31,6 +31,11 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const ( + disable = "false" + noAuthLocaltionSetting = "no-auth-locations" +) + var _ = framework.DescribeSetting("[Security] global-auth-url", func() { f := framework.NewDefaultFramework( "global-external-auth", @@ -46,7 +51,7 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { fooPath := "/foo" barPath := "/bar" - noAuthSetting := "no-auth-locations" + noAuthSetting := noAuthLocaltionSetting noAuthLocations := barPath enableGlobalExternalAuthAnnotation := "nginx.ingress.kubernetes.io/enable-global-auth" @@ -56,7 +61,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.Context("when global external authentication is configured", func() { - ginkgo.BeforeEach(func() { globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/401", framework.HTTPBunService, f.Namespace) @@ -85,7 +89,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 401 when request any protected service", func() { - ginkgo.By("Sending a request to protected service /foo") f.HTTPTestClient(). GET(fooPath). @@ -102,7 +105,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service", func() { - ginkgo.By("Adding a no-auth-locations for /bar to configMap") f.UpdateNginxConfigMapData(noAuthSetting, noAuthLocations) f.WaitForNginxServer(host, @@ -126,10 +128,9 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service", func() { - ginkgo.By("Adding an ingress rule for /bar with annotation enable-global-auth = false") err := framework.UpdateIngress(f.KubeClientSet, f.Namespace, "bar-ingress", func(ingress *networking.Ingress) error { - ingress.ObjectMeta.Annotations[enableGlobalExternalAuthAnnotation] = "false" + ingress.ObjectMeta.Annotations[enableGlobalExternalAuthAnnotation] = disable return nil }) assert.Nil(ginkgo.GinkgoT(), err) @@ -155,9 +156,8 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It("should still return status code 200 after auth backend is deleted using cache", func() { - globalExternalAuthCacheKeySetting := "global-auth-cache-key" - globalExternalAuthCacheKey := "foo" + globalExternalAuthCacheKey := fooHost globalExternalAuthCacheDurationSetting := "global-auth-cache-duration" globalExternalAuthCacheDuration := "200 201 401 30m" globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/200", framework.HTTPBunService, f.Namespace) @@ -197,7 +197,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should proxy_method method when global-auth-method is configured`, func() { - globalExternalAuthMethodSetting := "global-auth-method" globalExternalAuthMethod := "GET" @@ -210,7 +209,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should add custom error page when global-auth-signin url is configured`, func() { - globalExternalAuthSigninSetting := "global-auth-signin" globalExternalAuthSignin := "http://foo.com/global-error-page" @@ -223,7 +221,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should add auth headers when global-auth-response-headers is configured`, func() { - globalExternalAuthResponseHeadersSetting := "global-auth-response-headers" globalExternalAuthResponseHeaders := "Foo, Bar" @@ -237,7 +234,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { }) ginkgo.It(`should set request-redirect when global-auth-request-redirect is configured`, func() { - globalExternalAuthRequestRedirectSetting := "global-auth-request-redirect" globalExternalAuthRequestRedirect := "Foo-Redirect" @@ -260,7 +256,6 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { return strings.Contains(server, globalExternalAuthSnippet) }) }) - }) ginkgo.Context("cookie set by external authentication server", func() { @@ -322,7 +317,6 @@ http { f.WaitForNginxServer(host, func(server string) bool { return strings.Contains(server, "server_name "+host) }) - }) ginkgo.It("user retains cookie by default", func() { diff --git a/test/e2e/settings/global_options.go b/test/e2e/settings/global_options.go index 117860d59..1f84ef5d7 100644 --- a/test/e2e/settings/global_options.go +++ b/test/e2e/settings/global_options.go @@ -31,7 +31,6 @@ var _ = framework.IngressNginxDescribe("global-options", func() { ginkgo.It("should have worker_rlimit_nofile option", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, fmt.Sprintf("worker_rlimit_nofile %d;", rlimitMaxNumFiles()-1024)) - }) }) diff --git a/test/e2e/settings/hash-size.go b/test/e2e/settings/hash-size.go index 6e3e0480c..5aa5f7c95 100644 --- a/test/e2e/settings/hash-size.go +++ b/test/e2e/settings/hash-size.go @@ -36,7 +36,6 @@ var _ = framework.DescribeSetting("hash size", func() { }) ginkgo.Context("Check server names hash size", func() { - ginkgo.It("should set server_names_hash_bucket_size", func() { f.UpdateNginxConfigMapData("server-name-hash-bucket-size", "512") @@ -52,11 +51,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "server_names_hash_max_size 4096;") }) }) - }) ginkgo.Context("Check proxy header hash size", func() { - ginkgo.It("should set proxy-headers-hash-bucket-size", func() { f.UpdateNginxConfigMapData("proxy-headers-hash-bucket-size", "512") @@ -72,11 +69,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "proxy_headers_hash_max_size 4096;") }) }) - }) ginkgo.Context("Check the variable hash size", func() { - ginkgo.It("should set variables-hash-bucket-size", func() { f.UpdateNginxConfigMapData("variables-hash-bucket-size", "512") @@ -92,11 +87,9 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "variables_hash_max_size 512;") }) }) - }) ginkgo.Context("Check the map hash size", func() { - ginkgo.It("should set vmap-hash-bucket-size", func() { f.UpdateNginxConfigMapData("map-hash-bucket-size", "512") @@ -104,7 +97,5 @@ var _ = framework.DescribeSetting("hash size", func() { return strings.Contains(server, "map_hash_bucket_size 512;") }) }) - }) - }) diff --git a/test/e2e/settings/ingress_class.go b/test/e2e/settings/ingress_class.go index 232045f3a..80c09f80c 100644 --- a/test/e2e/settings/ingress_class.go +++ b/test/e2e/settings/ingress_class.go @@ -36,6 +36,8 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const barHost = "bar" + var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { f := framework.NewDefaultFramework("ingress-class") @@ -66,7 +68,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { ginkgo.Context("With default ingress class config", func() { ginkgo.It("should ignore Ingress with a different class annotation", func() { - invalidHost := "foo" + invalidHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -75,7 +77,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - validHost := "bar" + validHost := barHost annotationClass := map[string]string{ ingressclass.IngressKey: ingressclass.DefaultAnnotationValue, } @@ -385,7 +387,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusOK) }) - }) ginkgo.Context("With specific ingress-class flags", func() { @@ -411,13 +412,13 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should ignore Ingress with no class and accept the correctly configured Ingresses", func() { - invalidHost := "bar" + invalidHost := barHost ing := framework.NewSingleIngress(invalidHost, "/", invalidHost, f.Namespace, framework.EchoService, 80, nil) ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - validHost := "foo" + validHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -455,7 +456,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("With watch-ingress-without-class flag", func() { @@ -480,13 +480,13 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should watch Ingress with no class and ignore ingress with a different class", func() { - validHost := "bar" + validHost := barHost ing := framework.NewSingleIngress(validHost, "/", validHost, f.Namespace, framework.EchoService, 80, nil) ing.Spec.IngressClassName = nil f.EnsureIngress(ing) - invalidHost := "foo" + invalidHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass123", } @@ -511,7 +511,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("With ingress-class-by-name flag", func() { @@ -579,11 +578,9 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) ginkgo.Context("Without IngressClass Cluster scoped Permission", func() { - ginkgo.BeforeEach(func() { icname := fmt.Sprintf("ic-%s", f.Namespace) @@ -629,8 +626,7 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should watch Ingress with correct annotation", func() { - - validHost := "foo" + validHost := fooHost annotations := map[string]string{ ingressclass.IngressKey: "testclass", } @@ -650,7 +646,6 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { }) ginkgo.It("should ignore Ingress with only IngressClassName", func() { - invalidHost := "noclassforyou" ing := framework.NewSingleIngress(invalidHost, "/", invalidHost, f.Namespace, framework.EchoService, 80, nil) @@ -666,6 +661,5 @@ var _ = framework.IngressNginxDescribe("[Flag] ingress-class", func() { Expect(). Status(http.StatusNotFound) }) - }) }) diff --git a/test/e2e/settings/keep-alive.go b/test/e2e/settings/keep-alive.go index d139f61c0..167f5ac18 100644 --- a/test/e2e/settings/keep-alive.go +++ b/test/e2e/settings/keep-alive.go @@ -21,6 +21,7 @@ import ( "strings" "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" "k8s.io/ingress-nginx/test/e2e/framework" ) @@ -50,7 +51,6 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, `keepalive_requests 200;`) }) - }) }) @@ -59,7 +59,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-connections", "128") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive 128;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive 128;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -68,7 +69,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-timeout", "120") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_timeout\s*120s;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_timeout\s*120s;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -77,7 +79,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-time", "75s") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_time\s*75s;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_time\s*75s;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) @@ -86,7 +89,8 @@ var _ = framework.DescribeSetting("keep-alive keep-alive-requests", func() { f.UpdateNginxConfigMapData("upstream-keepalive-requests", "200") f.WaitForNginxConfiguration(func(server string) bool { - match, _ := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_requests\s*200;`, server) + match, err := regexp.MatchString(`upstream\supstream_balancer\s\{[\s\S]*keepalive_requests\s*200;`, server) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error matching the upstream keepalive time") return match }) }) diff --git a/test/e2e/settings/listen_nondefault_ports.go b/test/e2e/settings/listen_nondefault_ports.go index 7e3b11b21..9d3952227 100644 --- a/test/e2e/settings/listen_nondefault_ports.go +++ b/test/e2e/settings/listen_nondefault_ports.go @@ -28,7 +28,6 @@ import ( ) var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", func() { - host := "forwarded-headers" f := framework.NewDefaultFramework("forwarded-port-headers", framework.WithHTTPBunEnabled()) @@ -44,7 +43,6 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun ginkgo.Context("with a plain HTTP ingress", func() { ginkgo.It("should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port", func() { - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -64,9 +62,7 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun }) ginkgo.Context("with a TLS enabled ingress", func() { - ginkgo.It("should set X-Forwarded-Port header to 443", func() { - ing := framework.NewSingleIngressWithTLS(host, "/", host, []string{host}, f.Namespace, framework.EchoService, 80, nil) f.EnsureIngress(ing) @@ -94,7 +90,6 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun }) ginkgo.Context("when external authentication is configured", func() { - ginkgo.It("should set the X-Forwarded-Port header to 443", func() { annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", f.HTTPBunIP), diff --git a/test/e2e/settings/log-format.go b/test/e2e/settings/log-format.go index 24877818d..18835cb66 100644 --- a/test/e2e/settings/log-format.go +++ b/test/e2e/settings/log-format.go @@ -36,7 +36,6 @@ var _ = framework.DescribeSetting("log-format-*", func() { }) ginkgo.Context("Check log-format-escape-json and log-format-escape-none", func() { - ginkgo.It("should not configure log-format escape by default", func() { f.WaitForNginxConfiguration( func(cfg string) bool { @@ -78,7 +77,6 @@ var _ = framework.DescribeSetting("log-format-*", func() { }) ginkgo.Context("Check log-format-upstream with log-format-escape-json and log-format-escape-none", func() { - ginkgo.It("log-format-escape-json enabled", func() { f.SetNginxConfigMapData(map[string]string{ "log-format-escape-json": "true", diff --git a/test/e2e/settings/namespace_selector.go b/test/e2e/settings/namespace_selector.go index 3bf856566..1da62ee86 100644 --- a/test/e2e/settings/namespace_selector.go +++ b/test/e2e/settings/namespace_selector.go @@ -29,12 +29,12 @@ import ( var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", func() { f := framework.NewDefaultFramework("namespace-selector") - notMatchedHost, matchedHost := "bar", "foo" + notMatchedHost, matchedHost := barHost, fooHost var notMatchedNs string var matchedNs string // create a test namespace, under which create an ingress and backend deployment - prepareTestIngress := func(baseName string, host string, labels map[string]string) string { + prepareTestIngress := func(host string, labels map[string]string) string { ns, err := framework.CreateKubeNamespaceWithLabel(f.BaseName, labels, f.KubeClientSet) assert.Nil(ginkgo.GinkgoT(), err, "creating test namespace") f.NewEchoDeployment(framework.WithDeploymentNamespace(ns)) @@ -49,8 +49,8 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", } ginkgo.BeforeEach(func() { - notMatchedNs = prepareTestIngress(notMatchedHost, notMatchedHost, nil) // create namespace without label "foo=bar" - matchedNs = prepareTestIngress(matchedHost, matchedHost, map[string]string{"foo": "bar"}) + notMatchedNs = prepareTestIngress(notMatchedHost, nil) // create namespace without label "foo=bar" + matchedNs = prepareTestIngress(matchedHost, map[string]string{fooHost: barHost}) }) ginkgo.AfterEach(func() { @@ -59,9 +59,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", }) ginkgo.Context("With specific watch-namespace-selector flags", func() { - - ginkgo.It("should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar", func() { - + ginkgo.It("should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar", func() { f.WaitForNginxConfiguration(func(cfg string) bool { return !strings.Contains(cfg, "server_name bar") && strings.Contains(cfg, "server_name foo") @@ -86,7 +84,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", if ns.Labels == nil { ns.Labels = make(map[string]string) } - ns.Labels["foo"] = "bar" + ns.Labels[fooHost] = barHost _, err = f.KubeClientSet.CoreV1().Namespaces().Update(context.TODO(), ns, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "labeling not matched namespace") @@ -97,7 +95,7 @@ var _ = framework.IngressNginxDescribeSerial("[Flag] watch namespace selector", if ing.Labels == nil { ing.Labels = make(map[string]string) } - ing.Labels["foo"] = "bar" + ing.Labels[fooHost] = barHost _, err = f.KubeClientSet.NetworkingV1().Ingresses(notMatchedNs).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.Nil(ginkgo.GinkgoT(), err, "updating ingress") diff --git a/test/e2e/settings/no_auth_locations.go b/test/e2e/settings/no_auth_locations.go index 2fc4b6455..103c057d7 100644 --- a/test/e2e/settings/no_auth_locations.go +++ b/test/e2e/settings/no_auth_locations.go @@ -18,12 +18,12 @@ package settings import ( "fmt" - "golang.org/x/crypto/bcrypt" "net/http" "strings" "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" + "golang.org/x/crypto/bcrypt" corev1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -34,7 +34,7 @@ var _ = framework.DescribeSetting("[Security] no-auth-locations", func() { f := framework.NewDefaultFramework("no-auth-locations") setting := "no-auth-locations" - username := "foo" + username := fooHost password := "bar" secretName := "test-secret" host := "no-auth-locations" @@ -100,7 +100,8 @@ func buildBasicAuthIngressWithSecondPath(host, namespace, secretName, pathName s ObjectMeta: metav1.ObjectMeta{ Name: host, Namespace: namespace, - Annotations: map[string]string{"nginx.ingress.kubernetes.io/auth-type": "basic", + Annotations: map[string]string{ + "nginx.ingress.kubernetes.io/auth-type": "basic", "nginx.ingress.kubernetes.io/auth-secret": secretName, "nginx.ingress.kubernetes.io/auth-realm": "test auth", }, @@ -147,7 +148,6 @@ func buildBasicAuthIngressWithSecondPath(host, namespace, secretName, pathName s } func buildSecret(username, password, name, namespace string) *corev1.Secret { - //out, err := exec.Command("openssl", "passwd", "-crypt", password).CombinedOutput() out, err := bcrypt.GenerateFromPassword([]byte(password), 14) assert.Nil(ginkgo.GinkgoT(), err, "creating password") diff --git a/test/e2e/settings/no_tls_redirect_locations.go b/test/e2e/settings/no_tls_redirect_locations.go index 332d764d6..8339eb23e 100644 --- a/test/e2e/settings/no_tls_redirect_locations.go +++ b/test/e2e/settings/no_tls_redirect_locations.go @@ -44,6 +44,5 @@ var _ = framework.DescribeSetting("Add no tls redirect locations", func() { f.WaitForNginxConfiguration(func(server string) bool { return strings.Contains(server, "force_no_ssl_redirect = true,") }) - }) }) diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index 0173f41ac..0ec15db58 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -112,7 +112,7 @@ var _ = framework.DescribeSetting("OCSP", func() { return strings.Contains(server, fmt.Sprintf(`server_name %v`, host)) }) - tlsConfig := &tls.Config{ServerName: host, InsecureSkipVerify: true} + tlsConfig := &tls.Config{ServerName: host, InsecureSkipVerify: true} //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(tlsConfig). GET("/"). WithURL(f.GetURL(framework.HTTPS)). @@ -195,7 +195,8 @@ const configTemplate = ` func prepareCertificates(namespace string) error { config := fmt.Sprintf(configTemplate, namespace) - err := os.WriteFile("cfssl_config.json", []byte(config), 0644) + //nolint:gosec // Not change permission to avoid possible issues + err := os.WriteFile("cfssl_config.json", []byte(config), 0o644) if err != nil { return fmt.Errorf("creating cfssl_config.json file: %v", err) } diff --git a/test/e2e/settings/opentelemetry.go b/test/e2e/settings/opentelemetry.go index 92d202cb3..15b5d165e 100644 --- a/test/e2e/settings/opentelemetry.go +++ b/test/e2e/settings/opentelemetry.go @@ -32,6 +32,8 @@ const ( opentelemetryLocationOperationName = "opentelemetry-location-operation-name" opentelemetryConfig = "opentelemetry-config" opentelemetryConfigPath = "/etc/nginx/opentelemetry.toml" + + enable = "true" ) var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { @@ -46,7 +48,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should not exists opentelemetry directive", func() { config := map[string]string{} - config[enableOpentelemetry] = "false" + config[enableOpentelemetry] = disable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) @@ -59,7 +61,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should exists opentelemetry directive when is enabled", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath f.SetNginxConfigMapData(config) @@ -73,9 +75,9 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should include opentelemetry_trust_incoming_spans on directive when enabled", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath - config[opentelemetryTrustIncomingSpan] = "true" + config[opentelemetryTrustIncomingSpan] = enable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) @@ -88,7 +90,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should not exists opentelemetry_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath config[opentelemetryOperationName] = "" f.SetNginxConfigMapData(config) @@ -103,7 +105,7 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { ginkgo.It("should exists opentelemetry_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentelemetry] = "true" + config[enableOpentelemetry] = enable config[opentelemetryConfig] = opentelemetryConfigPath config[opentelemetryOperationName] = "HTTP $request_method $uri" f.SetNginxConfigMapData(config) @@ -115,5 +117,4 @@ var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { return strings.Contains(cfg, `opentelemetry_operation_name "HTTP $request_method $uri"`) }) }) - }) diff --git a/test/e2e/settings/opentracing.go b/test/e2e/settings/opentracing.go index aee01ea60..76d96498d 100644 --- a/test/e2e/settings/opentracing.go +++ b/test/e2e/settings/opentracing.go @@ -41,8 +41,12 @@ const ( datadogCollectorHost = "datadog-collector-host" - opentracingOperationName = "opentracing-operation-name" + opentracingOperationName = "opentracing-operation-name" + opentracingOperationValue = "HTTP $request_method $uri" + opentracingLocationOperationName = "opentracing-location-operation-name" + + localhost = "127.0.0.1" ) var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { @@ -57,7 +61,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing directive", func() { config := map[string]string{} - config[enableOpentracing] = "false" + config[enableOpentracing] = disable f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -70,8 +74,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing directive when is enabled", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -84,9 +88,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should include opentracing_trust_incoming_span off directive when disabled", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[opentracingTrustIncomingSpan] = "false" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[opentracingTrustIncomingSpan] = disable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -99,8 +103,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost config[opentracingOperationName] = "" f.SetNginxConfigMapData(config) @@ -114,9 +118,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" - config[opentracingOperationName] = "HTTP $request_method $uri" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost + config[opentracingOperationName] = opentracingOperationValue f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -129,8 +133,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should not exists opentracing_location_operation_name directive when is empty", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost config[opentracingLocationOperationName] = "" f.SetNginxConfigMapData(config) @@ -144,9 +148,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should exists opentracing_location_operation_name directive when is configured", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" - config[opentracingLocationOperationName] = "HTTP $request_method $uri" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost + config[opentracingLocationOperationName] = opentracingOperationValue f.SetNginxConfigMapData(config) f.EnsureIngress(framework.NewSingleIngress(enableOpentracing, "/", enableOpentracing, f.Namespace, "http-svc", 80, nil)) @@ -159,8 +163,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using zipkin", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[zipkinCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[zipkinCollectorHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -171,8 +175,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using jaeger", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -183,9 +187,9 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using jaeger with sampler host", func() { config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" - config[jaegerSamplerHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost + config[jaegerSamplerHost] = localhost f.SetNginxConfigMapData(config) framework.Sleep(10 * time.Second) @@ -197,8 +201,8 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should propagate the w3c header when configured with jaeger", func() { host := "jaeger-w3c" config := map[string]string{} - config[enableOpentracing] = "true" - config[jaegerCollectorHost] = "127.0.0.1" + config[enableOpentracing] = enable + config[jaegerCollectorHost] = localhost config[jaegerPropagationFormat] = "w3c" f.SetNginxConfigMapData(config) @@ -227,7 +231,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { /* ginkgo.It("should enable opentracing using jaeger with an HTTP endpoint", func() { config := map[string]string{} - config[enableOpentracing] = "true" + config[enableOpentracing] = TRUE config[jaegerEndpoint] = "http://127.0.0.1/api/traces" f.SetNginxConfigMapData(config) @@ -240,7 +244,7 @@ var _ = framework.IngressNginxDescribe("Configure OpenTracing", func() { ginkgo.It("should enable opentracing using datadog", func() { config := map[string]string{} - config[enableOpentracing] = "true" + config[enableOpentracing] = enable config[datadogCollectorHost] = "http://127.0.0.1" f.SetNginxConfigMapData(config) diff --git a/test/e2e/settings/pod_security_policy_volumes.go b/test/e2e/settings/pod_security_policy_volumes.go index dd4df3bd9..f8fc58300 100644 --- a/test/e2e/settings/pod_security_policy_volumes.go +++ b/test/e2e/settings/pod_security_policy_volumes.go @@ -38,7 +38,6 @@ var _ = framework.IngressNginxDescribe("[Security] Pod Security Policies with vo f := framework.NewDefaultFramework("pod-security-policies-volumes") ginkgo.It("should be running with a Pod Security Policy", func() { - k8sversion, err := f.KubeClientSet.Discovery().ServerVersion() if err != nil { assert.Nil(ginkgo.GinkgoT(), err, "getting version") diff --git a/test/e2e/settings/proxy_connect_timeout.go b/test/e2e/settings/proxy_connect_timeout.go index 1290775a5..185ac1dd1 100644 --- a/test/e2e/settings/proxy_connect_timeout.go +++ b/test/e2e/settings/proxy_connect_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-connect-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_connect_timeout %ss;", proxyConnectTimeout)) }) }) - }) diff --git a/test/e2e/settings/proxy_protocol.go b/test/e2e/settings/proxy_protocol.go index 9939cad9e..cfce68bf8 100644 --- a/test/e2e/settings/proxy_protocol.go +++ b/test/e2e/settings/proxy_protocol.go @@ -33,8 +33,10 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" ) +const proxyProtocol = "proxy-protocol" + var _ = framework.DescribeSetting("use-proxy-protocol", func() { - f := framework.NewDefaultFramework("proxy-protocol") + f := framework.NewDefaultFramework(proxyProtocol) setting := "use-proxy-protocol" @@ -42,9 +44,9 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { f.NewEchoDeployment() f.UpdateNginxConfigMapData(setting, "false") }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should respect port passed by the PROXY Protocol", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -73,14 +75,15 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=http") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should respect proto passed by the PROXY Protocol server port", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -109,14 +112,14 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=443") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-for=192.168.0.1") }) ginkgo.It("should enable PROXY Protocol for HTTPS", func() { - host := "proxy-protocol" + host := proxyProtocol f.UpdateNginxConfigMapData(setting, "true") @@ -151,7 +154,7 @@ var _ = framework.DescribeSetting("use-proxy-protocol", func() { assert.Nil(ginkgo.GinkgoT(), err, "unexpected error reading connection data") body := string(data) - assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", "proxy-protocol")) + assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=%v", proxyProtocol)) assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-port=1234") assert.Contains(ginkgo.GinkgoT(), body, "x-forwarded-proto=https") assert.Contains(ginkgo.GinkgoT(), body, "x-scheme=https") diff --git a/test/e2e/settings/proxy_read_timeout.go b/test/e2e/settings/proxy_read_timeout.go index c84956cc9..484b44f24 100644 --- a/test/e2e/settings/proxy_read_timeout.go +++ b/test/e2e/settings/proxy_read_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-read-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_read_timeout %ss;", proxyReadtimeout)) }) }) - }) diff --git a/test/e2e/settings/proxy_send_timeout.go b/test/e2e/settings/proxy_send_timeout.go index 886642bc0..bdcd46f0f 100644 --- a/test/e2e/settings/proxy_send_timeout.go +++ b/test/e2e/settings/proxy_send_timeout.go @@ -14,6 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ +//nolint:dupl // Ignore dupl errors for similar test case package settings import ( @@ -64,5 +65,4 @@ var _ = framework.DescribeSetting("proxy-send-timeout", func() { return !strings.Contains(server, fmt.Sprintf("proxy_send_timeout %ss;", proxySendTimeout)) }) }) - }) diff --git a/test/e2e/settings/ssl_passthrough.go b/test/e2e/settings/ssl_passthrough.go index f0859f878..b10511bde 100644 --- a/test/e2e/settings/ssl_passthrough.go +++ b/test/e2e/settings/ssl_passthrough.go @@ -19,7 +19,7 @@ package settings import ( "context" "crypto/tls" - "fmt" + "net" "net/http" "strings" @@ -54,7 +54,6 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { ginkgo.Describe("With enable-ssl-passthrough enabled", func() { ginkgo.It("should enable ssl-passthrough-proxy-port on a different port", func() { - err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { args := deployment.Spec.Template.Spec.Containers[0].Args args = append(args, "--ssl-passthrough-proxy-port=1442") @@ -77,7 +76,6 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { }) ginkgo.It("should pass unknown traffic to default backend and handle known traffic", func() { - host := "testpassthrough.com" echoName := "echopass" @@ -170,20 +168,21 @@ var _ = framework.IngressNginxDescribe("[Flag] enable-ssl-passthrough", func() { return strings.Contains(server, "listen 442") }) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). - WithURL(fmt.Sprintf("https://%s:443", host)). + WithURL("https://"+net.JoinHostPort(host, "443")). ForceResolve(f.GetNginxIP(), 443). Expect(). Status(http.StatusOK) + //nolint:gosec // Ignore the gosec error in testing f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: hostBad, InsecureSkipVerify: true}). GET("/"). - WithURL(fmt.Sprintf("https://%s:443", hostBad)). + WithURL("https://"+net.JoinHostPort(hostBad, "443")). ForceResolve(f.GetNginxIP(), 443). Expect(). Status(http.StatusNotFound) - }) }) }) diff --git a/test/e2e/settings/tls.go b/test/e2e/settings/tls.go index 2cead4a94..51f760df8 100644 --- a/test/e2e/settings/tls.go +++ b/test/e2e/settings/tls.go @@ -87,9 +87,7 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f }) ginkgo.Context("should configure HSTS policy header", func() { - var ( - tlsConfig *tls.Config - ) + var tlsConfig *tls.Config const ( hstsMaxAge = "hsts-max-age" @@ -182,7 +180,6 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f got := header["Strict-Transport-Security"] assert.Equal(ginkgo.GinkgoT(), 1, len(got)) }) - }) ginkgo.Context("ports or X-Forwarded-Host check during HTTP tp HTTPS redirection", func() { diff --git a/test/e2e/settings/validations/validations.go b/test/e2e/settings/validations/validations.go index 6f1715ada..19488d247 100644 --- a/test/e2e/settings/validations/validations.go +++ b/test/e2e/settings/validations/validations.go @@ -29,7 +29,7 @@ import ( var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { f := framework.NewDefaultFramework("validations") - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { host := "annotation-validations" @@ -54,9 +54,8 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") - }) - + //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { host := "annotation-validations" @@ -81,6 +80,5 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{}) assert.NotNil(ginkgo.GinkgoT(), err, "creating ingress with risky annotations should trigger an error") - }) }) diff --git a/test/e2e/ssl/secret_update.go b/test/e2e/ssl/secret_update.go index fe7bfca0c..8e81f09f9 100644 --- a/test/e2e/ssl/secret_update.go +++ b/test/e2e/ssl/secret_update.go @@ -98,7 +98,7 @@ var _ = framework.IngressNginxDescribe("[SSL] secret update", func() { return strings.Contains(server, "server_name invalid-ssl") && strings.Contains(server, "listen 443") }) - + //nolint:gosec // Ignore certificate validation in testing resp := f.HTTPTestClientWithTLSConfig(&tls.Config{ServerName: host, InsecureSkipVerify: true}). GET("/"). WithURL(f.GetURL(framework.HTTPS)). diff --git a/test/e2e/status/update.go b/test/e2e/status/update.go index 046752d2b..c3c48f8d2 100644 --- a/test/e2e/status/update.go +++ b/test/e2e/status/update.go @@ -108,6 +108,7 @@ var _ = framework.IngressNginxDescribe("[Status] status update", func() { } }() + //nolint:staticcheck // TODO: will replace it since wait.Poll is deprecated err = wait.Poll(5*time.Second, 4*time.Minute, func() (done bool, err error) { ing, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Get(context.TODO(), host, metav1.GetOptions{}) if err != nil { @@ -134,7 +135,8 @@ func getHostIP() net.IP { } defer conn.Close() - localAddr := conn.LocalAddr().(*net.UDPAddr) + localAddr, ok := conn.LocalAddr().(*net.UDPAddr) + assert.True(ginkgo.GinkgoT(), ok, "unexpected type: %T", conn.LocalAddr()) return localAddr.IP } diff --git a/test/e2e/tcpudp/tcp.go b/test/e2e/tcpudp/tcp.go index 16a633b63..f06d6c9a3 100644 --- a/test/e2e/tcpudp/tcp.go +++ b/test/e2e/tcpudp/tcp.go @@ -148,18 +148,18 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { } var ips []string - var retryErr error + var errRetry error err = wait.ExponentialBackoff(retry, func() (bool, error) { - ips, retryErr = resolver.LookupHost(context.Background(), "google-public-dns-b.google.com") - if retryErr == nil { + ips, errRetry = resolver.LookupHost(context.Background(), "google-public-dns-b.google.com") + if errRetry == nil { return true, nil } return false, nil }) - + //nolint:staticcheck // TODO: will replace it since wait.ErrWaitTimeout is deprecated if err == wait.ErrWaitTimeout { - err = retryErr + err = errRetry } assert.Nil(ginkgo.GinkgoT(), err, "unexpected error from DNS resolver") @@ -167,7 +167,6 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { }) ginkgo.It("should reload after an update in the configuration", func() { - ginkgo.By("setting up a first deployment") f.NewEchoDeployment(framework.WithDeploymentName("first-service")) @@ -217,5 +216,4 @@ var _ = framework.IngressNginxDescribe("[TCP] tcp-services", func() { assert.Nil(ginkgo.GinkgoT(), err, "obtaining nginx logs") assert.Contains(ginkgo.GinkgoT(), logs, "Backend successfully reloaded") }) - }) From a687343fedbb26c3e2cef0608a975d6bfe31a0f7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 31 Aug 2023 00:52:48 -0700 Subject: [PATCH 322/822] Bump docker/setup-buildx-action from 2.9.1 to 2.10.0 (#10353) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.9.1 to 2.10.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/4c0219f9ac95b02789c1075625400b2acbff50b1...885d1462b80bc1c1c7f0b00334ad271f09369c55) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 596ef0427..a5dd136ae 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -158,7 +158,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1 + uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 with: version: latest From c3a28ab45da2360ac5b590b640f6b5e6a20055b0 Mon Sep 17 00:00:00 2001 From: Son Bui Date: Mon, 4 Sep 2023 05:09:47 +0800 Subject: [PATCH 323/822] fix: path with sepecial characters warning #10281 #10308 (#10330) --- docs/examples/rewrite/README.md | 5 ++++- docs/user-guide/ingress-path-matching.md | 9 ++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/docs/examples/rewrite/README.md b/docs/examples/rewrite/README.md index 5b42e1fc7..aadcc1e4b 100644 --- a/docs/examples/rewrite/README.md +++ b/docs/examples/rewrite/README.md @@ -30,6 +30,9 @@ Rewriting can be controlled using the following annotations: !!! note [Captured groups](https://www.regular-expressions.info/refcapture.html) are saved in numbered placeholders, chronologically, in the form `$1`, `$2` ... `$n`. These placeholders can be used as parameters in the `rewrite-target` annotation. +!!! note + Please see the [FAQ](../faq.md#validation-of-path) for Validation Of __`path`__ + Create an Ingress rule with a rewrite annotation: ```console @@ -49,7 +52,7 @@ spec: http: paths: - path: /something(/|$)(.*) - pathType: Prefix + pathType: ImplementationSpecific backend: service: name: http-svc diff --git a/docs/user-guide/ingress-path-matching.md b/docs/user-guide/ingress-path-matching.md index 321ddfa8e..dd618e08b 100644 --- a/docs/user-guide/ingress-path-matching.md +++ b/docs/user-guide/ingress-path-matching.md @@ -5,6 +5,9 @@ !!! important Regular expressions and wild cards are not supported in the `spec.rules.host` field. Full hostnames must be used. +!!! note + Please see the [FAQ](../faq.md#validation-of-path) for Validation Of __`path`__ + The ingress controller supports **case insensitive** regular expressions in the `spec.rules.http.paths.path` field. This can be enabled by setting the `nginx.ingress.kubernetes.io/use-regex` annotation to `true` (the default is false). @@ -28,7 +31,7 @@ spec: http: paths: - path: /foo/.* - pathType: Prefix + pathType: ImplementationSpecific backend: service: name: test @@ -95,7 +98,7 @@ spec: http: paths: - path: /foo/bar/(.+) - pathType: Prefix + pathType: ImplementationSpecific backend: service: name: service3 @@ -160,7 +163,7 @@ spec: port: number: 80 - path: /foo/bar/[A-Z0-9]{3} - pathType: Prefix + pathType: ImplementationSpecific backend: service: name: test From 02236ca96595c1303c5f7dca06ae95c16cf41ffa Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Sun, 3 Sep 2023 23:13:47 +0200 Subject: [PATCH 324/822] Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57.0 (#10352) * Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57 * upgrade module --- images/opentelemetry/rootfs/CMakeLists.txt | 17 ++++-- images/opentelemetry/rootfs/Dockerfile | 14 +++-- images/opentelemetry/rootfs/build.sh | 66 +++++++++++++++------- 3 files changed, 67 insertions(+), 30 deletions(-) diff --git a/images/opentelemetry/rootfs/CMakeLists.txt b/images/opentelemetry/rootfs/CMakeLists.txt index ef90b5805..2a816ebf7 100644 --- a/images/opentelemetry/rootfs/CMakeLists.txt +++ b/images/opentelemetry/rootfs/CMakeLists.txt @@ -25,6 +25,7 @@ set(CMAKE_CXX_STANDARD 17) set(CMAKE_CXX_EXTENSIONS OFF) set(CMAKE_CXX_STANDARD_REQUIRED ON) set(CMAKE_CXX_FLAGS "-O2") +set(CMAKE_VERBOSE_MAKEFILE ON CACHE BOOL "ON" FORCE) set(CMAKE_BUILD_TYPE Release @@ -82,12 +83,18 @@ ExternalProject_Add( -DgRPC_BUILD_TESTS=OFF -DBUILD_SHARED_LIBS=OFF -DgRPC_INSTALL=ON + -DgRPC_BUILD_GRPC_NODE_PLUGIN=OFF + -DgRPC_BUILD_GRPC_OBJECTIVE_C_PLUGIN=OFF + -DgRPC_BUILD_GRPC_PHP_PLUGIN=OFF + -DgRPC_BUILD_GRPC_PYTHON_PLUGIN=OFF + -DgRPC_BUILD_GRPC_RUBY_PLUGIN=OFF CMAKE_CACHE_ARGS -DCMAKE_CXX_FLAGS:STRING=${CMAKE_CXX_FLAGS} - TEST_AFTER_INSTALL 0 - DOWNLOAD_NO_PROGRESS 1 - LOG_CONFIGURE 1 - LOG_BUILD 0 - LOG_INSTALL 1) + TEST_AFTER_INSTALL FALSE + USES_TERMINAL_BUILD TRUE + DOWNLOAD_NO_PROGRESS TRUE + LOG_CONFIGURE TRUE + LOG_BUILD TRUE + LOG_INSTALL TRUE) install( DIRECTORY ${STAGED_INSTALL_PREFIX}/ diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index f3628b1f3..819c0d42c 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -21,19 +21,24 @@ COPY . /opt/third_party/ # install build tools RUN apk update \ && apk upgrade \ - && apk add -U bash cmake ninja \ + && apk add -U bash \ && bash /opt/third_party/build.sh -p -ENV NINJA_STATUS "[%p/%f/%t]" +ENV NINJA_STATUS "[%p/%f/%t] " # install gRPC FROM base as grpc -RUN bash /opt/third_party/build.sh -g v1.49.2 +RUN bash /opt/third_party/build.sh -g v1.57.0 + +# install abseil-cpp +FROM base as absl-cpp +RUN bash /opt/third_party/build.sh -a 20230802.0 # install OpenTelemetry-cpp FROM base as otel-cpp COPY --from=grpc /opt/third_party/install/ /usr -RUN bash /opt/third_party/build.sh -o v1.8.1 +COPY --from=absl-cpp /opt/third_party/install/ /usr +RUN bash /opt/third_party/build.sh -o v1.11.0 # install otel_ngx_module.so FROM base as nginx @@ -52,6 +57,5 @@ RUN CGO_ENABLED=0 go build -o /go/bin/init_module FROM cgr.dev/chainguard/static as final COPY --from=build-init /go/bin/init_module / COPY --from=nginx /etc/nginx/modules /etc/nginx/modules -COPY --from=nginx /opt/third_party/install/lib /etc/nginx/modules CMD ["/init_module"] diff --git a/images/opentelemetry/rootfs/build.sh b/images/opentelemetry/rootfs/build.sh index 30faad304..ebf95e219 100755 --- a/images/opentelemetry/rootfs/build.sh +++ b/images/opentelemetry/rootfs/build.sh @@ -21,6 +21,7 @@ set -o pipefail export GRPC_GIT_TAG=${GRPC_GIT_TAG:="v1.43.2"} # Check for recent changes: https://github.com/open-telemetry/opentelemetry-cpp/compare/v1.2.0...main export OPENTELEMETRY_CPP_VERSION=${OPENTELEMETRY_CPP_VERSION:="1.2.0"} +export ABSL_CPP_VERSION=${ABSL_CPP_VERSION:="20230802.0"} export INSTAL_DIR=/opt/third_party/install # improve compilation times CORES=$(($(grep -c ^processor /proc/cpuinfo) - 1)) @@ -54,6 +55,8 @@ prepare() { apk add \ linux-headers \ + cmake \ + ninja \ openssl \ curl-dev \ openssl-dev \ @@ -71,14 +74,32 @@ install_grpc() cd ${BUILD_PATH}/grpc cmake -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ -G Ninja \ - -DGRPC_GIT_TAG=${GRPC_GIT_TAG} /opt/third_party \ - -DgRPC_BUILD_GRPC_NODE_PLUGIN=OFF \ - -DgRPC_BUILD_GRPC_OBJECTIVE_C_PLUGIN=OFF \ - -DgRPC_BUILD_GRPC_PHP_PLUGIN=OFF \ - -DgRPC_BUILD_GRPC_PHP_PLUGIN=OFF \ - -DgRPC_BUILD_GRPC_PYTHON_PLUGIN=OFF \ - -DgRPC_BUILD_GRPC_RUBY_PLUGIN=OFF - cmake --build . -j ${CORES} --target all install + -DGRPC_GIT_TAG=${GRPC_GIT_TAG} /opt/third_party + + cmake --build . -j ${CORES} --target all install --verbose +} + +install_absl() +{ + cd ${BUILD_PATH} + export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+LD_LIBRARY_PATH:}${INSTAL_DIR}/lib:/usr/local" + export PATH="${PATH}:${INSTAL_DIR}/bin" + git clone --recurse-submodules -j ${CORES} --depth=1 -b \ + ${ABSL_CPP_VERSION} https://github.com/abseil/abseil-cpp.git abseil-cpp-${ABSL_CPP_VERSION} + cd "abseil-cpp-${ABSL_CPP_VERSION}" + mkdir -p .build + cd .build + + cmake -DCMAKE_BUILD_TYPE=Release \ + -G Ninja \ + -DCMAKE_CXX_STANDARD=17 \ + -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \ + -DBUILD_TESTING=OFF \ + -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ + -DABSL_PROPAGATE_CXX_STD=ON \ + -DBUILD_SHARED_LIBS=OFF \ + .. + cmake --build . -j ${CORES} --target install } install_otel() @@ -94,17 +115,19 @@ install_otel() cmake -DCMAKE_BUILD_TYPE=Release \ -G Ninja \ + -DCMAKE_CXX_STANDARD=17 \ -DCMAKE_POSITION_INDEPENDENT_CODE=TRUE \ -DWITH_ZIPKIN=OFF \ - -DWITH_JAEGER=OFF \ -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ -DBUILD_TESTING=OFF \ + -DWITH_BENCHMARK=OFF \ + -DWITH_FUNC_TESTS=OFF \ -DBUILD_SHARED_LIBS=OFF \ - -DWITH_OTLP=ON \ -DWITH_OTLP_GRPC=ON \ -DWITH_OTLP_HTTP=OFF \ - -DWITH_ABSEIL=OFF \ + -DWITH_ABSEIL=ON \ -DWITH_EXAMPLES=OFF \ + -DWITH_NO_DEPRECATED_CODE=ON \ .. cmake --build . -j ${CORES} --target install } @@ -128,7 +151,7 @@ install_nginx() export NGINX_VERSION=1.21.6 # Check for recent changes: https://github.com/open-telemetry/opentelemetry-cpp-contrib/compare/2656a4...main - export OPENTELEMETRY_CONTRIB_COMMIT=1ec94c82095bab61f06c7393b6f3272469d285af + export OPENTELEMETRY_CONTRIB_COMMIT=aaa51e2297bcb34297f3c7aa44fa790497d2f7f3 mkdir -p /etc/nginx cd "$BUILD_PATH" @@ -145,20 +168,19 @@ install_nginx() mkdir -p build cd build cmake -DCMAKE_BUILD_TYPE=Release \ - -G Ninja \ - -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ - -DBUILD_SHARED_LIBS=ON \ - -DNGINX_VERSION=${NGINX_VERSION} \ - .. + -G Ninja \ + -DCMAKE_CXX_STANDARD=17 \ + -DCMAKE_INSTALL_PREFIX=${INSTAL_DIR} \ + -DBUILD_SHARED_LIBS=ON \ + -DNGINX_VERSION=${NGINX_VERSION} \ + .. cmake --build . -j ${CORES} --target install mkdir -p /etc/nginx/modules cp ${INSTAL_DIR}/otel_ngx_module.so /etc/nginx/modules/otel_ngx_module.so - - mkdir -p ${INSTAL_DIR}/lib } -while getopts ":hpng:o:" option; do +while getopts ":pha:g:o:n" option; do case $option in h) # display Help Help @@ -177,6 +199,10 @@ while getopts ":hpng:o:" option; do n) # install nginx install_nginx exit;; + a) # install abseil + ABSL_CPP_VERSION=${OPTARG} + install_absl + exit;; \?) Help exit;; From d45a0c3287247120865306657c6a195a52e95a85 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 4 Sep 2023 05:37:48 -0700 Subject: [PATCH 325/822] Bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 (#10365) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.11.2 to 0.12.0. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/41f05d9ecffa2ed3f1580af306000f734b733e54...fbd16365eb88e12433951383f5e99bd901fc618f) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 1acc6c163..253d36690 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -60,7 +60,7 @@ jobs: - name: Scan image with AquaSec/Trivy id: scan - uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54 # v0.11.2 + uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 with: image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }} format: 'sarif' From c9ca1683645f099dc968e96abb8972d5e0208348 Mon Sep 17 00:00:00 2001 From: Matt Clegg Date: Tue, 5 Sep 2023 12:42:51 +0545 Subject: [PATCH 326/822] BUGFIX incorrect indentation (#10254) Error: Failed to render chart: exit status 1: Error: YAML parse error on ingress-nginx/templates/controller-serviceaccount.yaml: error converting YAML to JSON: yaml: line 14: mapping values are not allowed in this context Use --debug flag to render out invalid YAML Error: plugin "diff" exited with error --- charts/ingress-nginx/templates/controller-serviceaccount.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-serviceaccount.yaml b/charts/ingress-nginx/templates/controller-serviceaccount.yaml index e6e776d09..e9e9f32ef 100644 --- a/charts/ingress-nginx/templates/controller-serviceaccount.yaml +++ b/charts/ingress-nginx/templates/controller-serviceaccount.yaml @@ -11,8 +11,7 @@ metadata: name: {{ template "ingress-nginx.serviceAccountName" . }} namespace: {{ .Release.Namespace }} {{- if .Values.serviceAccount.annotations }} - annotations: - {{- toYaml .Values.serviceAccount.annotations | nindent 4 }} + annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} {{- end }} From 8a6af6068d3f4b850cdcca15f96ce56f49315f91 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Thu, 7 Sep 2023 01:06:53 +0800 Subject: [PATCH 327/822] Add golangci github action and replace the deprecated golint (#10187) * Add golangci github action and replace the deprecated golint Signed-off-by: z1cheng * Install if golangci-lint not exists Signed-off-by: z1cheng * Use -z operator Signed-off-by: z1cheng * Fix json tag for DatadogSampleRate field in config.go Signed-off-by: z1cheng * Add golangci linters Signed-off-by: z1cheng * Revert DatadogSampleRate fix Signed-off-by: z1cheng * Fix comments Signed-off-by: z1cheng * Add a new line Signed-off-by: z1cheng * fixup! Add a new line Signed-off-by: z1cheng * Add trigger condition Signed-off-by: z1cheng * Add golint-check entry in makefile Signed-off-by: Chen Chen * Run golint-check in a container Signed-off-by: Chen Chen --------- Signed-off-by: z1cheng Signed-off-by: Chen Chen --- .github/workflows/ci.yaml | 19 --- .github/workflows/golangci-lint.yml | 34 ++++ .golangci.yml | 241 ++++++++++++++++++++++++++++ Makefile | 6 + hack/verify-golint.sh | 22 +-- 5 files changed, 289 insertions(+), 33 deletions(-) create mode 100644 .github/workflows/golangci-lint.yml create mode 100644 .golangci.yml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index a5dd136ae..e96993366 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -78,25 +78,6 @@ jobs: # G307 TODO: Deferring unsafe method "Close" args: -exclude=G109,G601,G104,G204,G304,G306,G307 -tests=false -exclude-dir=test -exclude-dir=images/ -exclude-dir=docs/ ./... - lint: - runs-on: ubuntu-latest - needs: changes - if: | - (needs.changes.outputs.go == 'true') - steps: - - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - - name: Set up Go - id: go - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 - with: - go-version: '1.20' - check-latest: true - - - name: Run Lint - run: ./hack/verify-golint.sh - gofmt: runs-on: ubuntu-latest needs: changes diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml new file mode 100644 index 000000000..d601d69dd --- /dev/null +++ b/.github/workflows/golangci-lint.yml @@ -0,0 +1,34 @@ +name: golangci-lint + +on: + pull_request: + push: + branches: + - main + paths-ignore: + - 'docs/**' + - 'deploy/**' + - '**.md' + +permissions: + contents: read + +jobs: + golangci: + name: lint + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + + - name: Set up Go + id: go + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + with: + go-version: '1.20' + check-latest: true + + - name: golangci-lint + uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0 + with: + version: v1.53 diff --git a/.golangci.yml b/.golangci.yml new file mode 100644 index 000000000..5da8f0399 --- /dev/null +++ b/.golangci.yml @@ -0,0 +1,241 @@ +run: + timeout: 10m + allow-parallel-runners: true + + # Maximum issues count per one linter. Set to 0 to disable. Default is 50. + max-issues-per-linter: 0 + + # Maximum count of issues with the same text. Set to 0 to disable. Default is 3. + max-same-issues: 0 +linters: + disable-all: true + enable: + - asasalint + - asciicheck + - bidichk + - bodyclose + - contextcheck + - decorder + - dogsled + - dupl + - durationcheck + - errcheck + - errchkjson + - errname + - execinquery + - ginkgolinter + - gocheckcompilerdirectives + - goconst + - gocritic + - gocyclo + - godox + - gofmt + - gofumpt + - goheader + - goimports + - gomoddirectives + - gomodguard + - goprintffuncname + - gosec + - gosimple + - govet + - grouper + - importas + - ineffassign + - loggercheck + - makezero + - misspell + - musttag + - nakedret + - nolintlint + - nosprintfhostport + - prealloc + - predeclared + - promlinter + - reassign + - revive + - rowserrcheck + - sqlclosecheck + - staticcheck + - stylecheck + - tenv + - testableexamples + - typecheck + - unconvert + - unparam + - unused + - usestdlibvars + - whitespace + # - containedctx + # - cyclop + # - dupword + # - errorlint + # - exhaustive + # - exhaustruct + # - exportloopref + # - forbidigo + # - forcetypeassert + # - funlen + # - gci + # - gochecknoglobals + # - gochecknoinits + # - gocognit + # - godot + # - goerr113 + # - gomnd + # - interfacebloat + # - ireturn + # - lll + # - maintidx + # - nestif + # - nilerr + # - nilnil + # - nlreturn + # - noctx + # - nonamedreturns + # - paralleltest + # - tagliatelle + # - testpackage + # - thelper + # - tparallel + # - varnamelen + # - wastedassign + # - wrapcheck + # - wsl +linters-settings: + gocyclo: + min-complexity: 40 + godox: + keywords: + - BUG + - FIXME + - HACK + errcheck: + check-type-assertions: true + check-blank: true + gocritic: + enabled-checks: + # Diagnostic + - appendAssign + - argOrder + - badCall + - badCond + - badLock + - badRegexp + - badSorting + - builtinShadowDecl + - caseOrder + - codegenComment + - commentedOutCode + - deferInLoop + - deprecatedComment + - dupArg + - dupBranchBody + - dupCase + - dupSubExpr + - dynamicFmtString + - emptyDecl + - evalOrder + - exitAfterDefer + - externalErrorReassign + - filepathJoin + - flagDeref + - flagName + - mapKey + - nilValReturn + - offBy1 + - regexpPattern + - returnAfterHttpError + - sloppyReassign + - sloppyTypeAssert + - sortSlice + - sprintfQuotedString + - sqlQuery + - syncMapLoadAndDelete + - truncateCmp + - unnecessaryDefer + - weakCond + + # Performance + - appendCombine + - equalFold + - hugeParam + - indexAlloc + - preferDecodeRune + - preferFprint + - preferStringWriter + - preferWriteByte + - rangeExprCopy + - rangeValCopy + - sliceClear + - stringXbytes + + # Style + - assignOp + - boolExprSimplify + - captLocal + - commentFormatting + - commentedOutImport + - defaultCaseOrder + - deferUnlambda + - docStub + - dupImport + - elseif + - emptyFallthrough + - emptyStringTest + - exposedSyncMutex + - hexLiteral + - httpNoBody + - ifElseChain + - methodExprCall + - newDeref + - octalLiteral + - preferFilepathJoin + - redundantSprint + - regexpMust + - regexpSimplify + - ruleguard + - singleCaseSwitch + - sloppyLen + - stringConcatSimplify + - stringsCompare + - switchTrue + - timeCmpSimplify + - timeExprSimplify + - todoCommentWithoutDetail + - tooManyResultsChecker + - typeAssertChain + - typeDefFirst + - typeSwitchVar + - underef + - unlabelStmt + - unlambda + - unslice + - valSwap + - whyNoLint + - wrapperFunc + - yodaStyleExpr + + # Opinionated + - builtinShadow + - importShadow + - initClause + - nestingReduce + - paramTypeCombine + - ptrToRefParam + - typeUnparen + - unnamedResult + - unnecessaryBlock + nolintlint: + # Enable to ensure that nolint directives are all used. Default is true. + allow-unused: false + # Disable to ensure that nolint directives don't have a leading space. Default is true. + # TODO(lint): Enforce machine-readable `nolint` directives + allow-leading-space: true + # Exclude following linters from requiring an explanation. Default is []. + allow-no-explanation: [] + # Enable to require an explanation of nonzero length after each nolint directive. Default is false. + # TODO(lint): Enforce explanations for `nolint` directives + require-explanation: false + # Enable to require nolint directives to mention the specific linter being suppressed. Default is false. + require-specific: true diff --git a/Makefile b/Makefile index 7b413141a..792cd56a7 100644 --- a/Makefile +++ b/Makefile @@ -128,6 +128,12 @@ static-check: ## Run verification script for boilerplate, codegen, gofmt, golint MAC_OS=$(MAC_OS) \ hack/verify-all.sh +.PHONY: golint-check +golint-check: + @build/run-in-docker.sh \ + MAC_OS=$(MAC_OS) \ + hack/verify-golint.sh + ############################### # Tests for ingress-nginx ############################### diff --git a/hack/verify-golint.sh b/hack/verify-golint.sh index 7c9284880..17bcedd9f 100755 --- a/hack/verify-golint.sh +++ b/hack/verify-golint.sh @@ -22,19 +22,13 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE}")/.. cd "${KUBE_ROOT}" -GOLINT=${GOLINT:-"golint"} -PACKAGES=($(go list ./internal/... | grep -v /vendor/)) -bad_files=() -for package in "${PACKAGES[@]}"; do - out=$("${GOLINT}" -min_confidence=0.9 "${package}" | grep -v -E '(should not use dot imports|internal/file/bindata.go)' || :) - if [[ -n "${out}" ]]; then - bad_files+=("${out}") - fi -done -if [[ "${#bad_files[@]}" -ne 0 ]]; then - echo "!!! '$GOLINT' problems: " - echo "${bad_files[@]}" - exit 1 +LINT=${LINT:-golangci-lint} + +if [[ -z "$(command -v ${LINT})" ]]; then + echo "${LINT} is missing. Installing it now." + # See: https://golangci-lint.run/usage/install/#local-installation + curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.53.3 + LINT=$(go env GOPATH)/bin/golangci-lint fi -# ex: ts=2 sw=2 et filetype=sh +${LINT} run From 5bb82dcb7e0cdf51a78ed4ca2f20a32eb75ae456 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 7 Sep 2023 16:55:06 -0300 Subject: [PATCH 328/822] Bump Go version to 1.21.1 on testrunner (#10378) --- images/test-runner/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 3cd378937..dc83dd4a2 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -43,7 +43,7 @@ image: --pull \ --push \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.6 \ + --build-arg GOLANG_VERSION=1.21.1 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -64,7 +64,7 @@ build: ensure-buildx --progress=${PROGRESS} \ --pull \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.20.6 \ + --build-arg GOLANG_VERSION=1.21.1 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ From 8b85bada8232b1a49eda429862a7801a5fec8d41 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 7 Sep 2023 17:40:58 -0300 Subject: [PATCH 329/822] Bump Go version to 1.21.1 (#10377) * Bump Go version to 1.21.1 * Bump testrunner image --- .github/workflows/ci.yaml | 28 ++++--------------- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/plugin.yaml | 2 +- build/run-in-docker.sh | 2 +- go.mod | 2 +- go.sum | 8 ++++++ images/custom-error-pages/rootfs/Dockerfile | 2 +- images/custom-error-pages/rootfs/go.mod | 2 +- .../rootfs/Dockerfile | 2 +- images/ext-auth-example-authsvc/rootfs/go.mod | 2 +- images/fastcgi-helloserver/rootfs/Dockerfile | 2 +- .../go-grpc-greeter-server/rootfs/Dockerfile | 2 +- images/httpbun/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/go.mod | 2 +- images/opentelemetry/rootfs/go.mod | 6 ++-- magefiles/go.mod | 2 +- magefiles/go.sum | 7 +++++ test/e2e-image/Makefile | 2 +- 19 files changed, 39 insertions(+), 40 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e96993366..3465a5264 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -62,23 +62,7 @@ jobs: - 'charts/ingress-nginx/**/*' - 'NGINX_BASE' - - security: - runs-on: ubuntu-latest - steps: - - - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - - name: Run Gosec Security Scanner - uses: securego/gosec@a89e9d5a7acb4457f3891ac18532b142b1bf9221 # v2.17.0 - with: - # G601 for zz_generated.deepcopy.go - # G306 TODO: Expect WriteFile permissions to be 0600 or less - # G307 TODO: Deferring unsafe method "Close" - args: -exclude=G109,G601,G104,G204,G304,G306,G307 -tests=false -exclude-dir=test -exclude-dir=images/ -exclude-dir=docs/ ./... - - gofmt: + gofmt: runs-on: ubuntu-latest needs: changes if: | @@ -91,7 +75,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: Run go-fmt @@ -110,7 +94,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: Run test @@ -131,7 +115,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: Set up QEMU @@ -195,7 +179,7 @@ jobs: - name: Setup Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: cache @@ -502,7 +486,7 @@ jobs: if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: kube-webhook-certgen image build diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index d601d69dd..09301af58 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -25,7 +25,7 @@ jobs: id: go uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: golangci-lint diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 16974e906..ba8fb2111 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -22,7 +22,7 @@ jobs: - name: Set up Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.20' + go-version: '1.21.1' check-latest: true - name: Run GoReleaser diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 86e0e443f..7e7974f0f 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230623-d50c7193b@sha256:e5c68dc56934c273850bfb75c0348a2819756669baf59fcdce9e16771537b247} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230907-5bb82dcb7@sha256:421cda0f65a949b8b67b5e62a45071702d19ed458a3e2ba753171b0e66943210} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/go.mod b/go.mod index e78ca245e..de0287d40 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx -go 1.20 +go 1.21.1 require ( github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a diff --git a/go.sum b/go.sum index bbfacc71e..27b7bd039 100644 --- a/go.sum +++ b/go.sum @@ -103,6 +103,7 @@ github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbV github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A= +github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8= @@ -225,6 +226,7 @@ github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfn github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -284,6 +286,7 @@ github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3Ro github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= +github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg= github.com/opencontainers/runc v1.1.9 h1:XR0VIHTGce5eWPkaPesqTBrhW2yAcaraWfsEalNwQLM= github.com/opencontainers/runc v1.1.9/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= @@ -327,6 +330,7 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= +github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= @@ -380,8 +384,11 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 h1:+FNtrFTmVw0YZGpBGX56XDee331t6JAXeK2bcyhLOOc= go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5/go.mod h1:nmDLcffg48OtT/PSW0Hg7FvpRQsQh5OSqIylirxKC7o= go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= +go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= +go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60= +go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg= golang.org/dl v0.0.0-20190829154251-82a15e2f2ead/go.mod h1:IUMfjQLJQd4UTqG1Z90tenwKoCX93Gn3MAQJMOSBsDQ= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= @@ -593,6 +600,7 @@ golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gomodules.xyz/jsonpatch/v2 v2.2.0 h1:4pT439QV83L+G9FkcCriY6EkpcK6r6bK+A5FBUMI7qY= +gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY= google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index 4560e9ed5..8ae42317d 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.5-alpine3.18 as builder +FROM golang:1.21.1-alpine3.18 as builder RUN apk update \ && apk upgrade && apk add git diff --git a/images/custom-error-pages/rootfs/go.mod b/images/custom-error-pages/rootfs/go.mod index 89e47a4b5..1fc8f9939 100644 --- a/images/custom-error-pages/rootfs/go.mod +++ b/images/custom-error-pages/rootfs/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx/custom-error-pages -go 1.20 +go 1.21.1 require github.com/prometheus/client_golang v1.11.1 diff --git a/images/ext-auth-example-authsvc/rootfs/Dockerfile b/images/ext-auth-example-authsvc/rootfs/Dockerfile index 02d92d773..f0b51374b 100644 --- a/images/ext-auth-example-authsvc/rootfs/Dockerfile +++ b/images/ext-auth-example-authsvc/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.5-alpine3.18 as builder +FROM golang:1.21.1-alpine3.18 as builder RUN mkdir /authsvc WORKDIR /authsvc COPY . ./ diff --git a/images/ext-auth-example-authsvc/rootfs/go.mod b/images/ext-auth-example-authsvc/rootfs/go.mod index cc5124072..df99c08b0 100644 --- a/images/ext-auth-example-authsvc/rootfs/go.mod +++ b/images/ext-auth-example-authsvc/rootfs/go.mod @@ -1,6 +1,6 @@ module example.com/authsvc -go 1.20 +go 1.21.1 require k8s.io/apimachinery v0.23.1 diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile index 096d31abb..d4ed8305f 100755 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.5-alpine3.18 as builder +FROM golang:1.21.1-alpine3.18 as builder WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi diff --git a/images/go-grpc-greeter-server/rootfs/Dockerfile b/images/go-grpc-greeter-server/rootfs/Dockerfile index 46f916fb4..6460ce154 100644 --- a/images/go-grpc-greeter-server/rootfs/Dockerfile +++ b/images/go-grpc-greeter-server/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.20.5-alpine3.18 as build +FROM golang:1.21.1-alpine3.18 as build WORKDIR /go/src/greeter-server diff --git a/images/httpbun/rootfs/Dockerfile b/images/httpbun/rootfs/Dockerfile index e88716bb8..dd2d04502 100644 --- a/images/httpbun/rootfs/Dockerfile +++ b/images/httpbun/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.20.5 AS builder +FROM golang:1.21.1 AS builder ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 diff --git a/images/kube-webhook-certgen/rootfs/Dockerfile b/images/kube-webhook-certgen/rootfs/Dockerfile index 13226dbe2..4a7e32ced 100644 --- a/images/kube-webhook-certgen/rootfs/Dockerfile +++ b/images/kube-webhook-certgen/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM --platform=$BUILDPLATFORM golang:1.20.5 as builder +FROM --platform=$BUILDPLATFORM golang:1.21.1 as builder ARG BUILDPLATFORM ARG TARGETARCH diff --git a/images/kube-webhook-certgen/rootfs/go.mod b/images/kube-webhook-certgen/rootfs/go.mod index 49f95828f..b2870f840 100644 --- a/images/kube-webhook-certgen/rootfs/go.mod +++ b/images/kube-webhook-certgen/rootfs/go.mod @@ -1,6 +1,6 @@ module github.com/jet/kube-webhook-certgen -go 1.20 +go 1.21.1 require ( github.com/onrik/logrus v0.9.0 diff --git a/images/opentelemetry/rootfs/go.mod b/images/opentelemetry/rootfs/go.mod index f636c81b7..2ca85f584 100644 --- a/images/opentelemetry/rootfs/go.mod +++ b/images/opentelemetry/rootfs/go.mod @@ -1,3 +1,3 @@ -module init-otel - -go 1.20 +module init-otel + +go 1.21.1 diff --git a/magefiles/go.mod b/magefiles/go.mod index 40b909600..3282bc68b 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -1,6 +1,6 @@ module github.com/kubernetes/ingress-nginx/magefiles -go 1.20 +go 1.21.1 require ( github.com/blang/semver/v4 v4.0.0 diff --git a/magefiles/go.sum b/magefiles/go.sum index 9c0c8ee7f..733486e9e 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -24,6 +24,7 @@ github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= +github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/go-github/v48 v48.2.0 h1:68puzySE6WqUY9KWmpOsDEQfDZsso98rT6pZcz9HqcE= github.com/google/go-github/v48 v48.2.0/go.mod h1:dDlehKBDo850ZPvCTK0sEqTCVWcrGl2LcDiajkYi89Y= github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= @@ -36,14 +37,17 @@ github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORN github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= +github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94= github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q= +github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= @@ -72,9 +76,11 @@ golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJ golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= @@ -86,6 +92,7 @@ google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= +gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index f68d6ea6e..bd3453253 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230623-d50c7193b@sha256:e5c68dc56934c273850bfb75c0348a2819756669baf59fcdce9e16771537b247" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230907-5bb82dcb7@sha256:421cda0f65a949b8b67b5e62a45071702d19ed458a3e2ba753171b0e66943210" image: echo "..entered Makefile in /test/e2e-image" From 373b1d1741f19ccce7522d526ec7df7d10d1502b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 7 Sep 2023 17:42:52 -0300 Subject: [PATCH 330/822] Bump github.com/cyphar/filepath-securejoin in /magefiles (#10374) Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.2.3 to 0.2.4. - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.2.3...v0.2.4) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- magefiles/go.mod | 2 +- magefiles/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/magefiles/go.mod b/magefiles/go.mod index 3282bc68b..051e88de7 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -15,7 +15,7 @@ require ( require ( github.com/BurntSushi/toml v1.2.1 // indirect github.com/Masterminds/semver v1.5.0 // indirect - github.com/cyphar/filepath-securejoin v0.2.3 // indirect + github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/gobwas/glob v0.2.3 // indirect diff --git a/magefiles/go.sum b/magefiles/go.sum index 733486e9e..380e194e7 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -4,8 +4,8 @@ github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3Q github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y= github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= -github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI= -github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= +github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg= +github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From 0729935fbc113b197acff03d922f12f3db6e8ae0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 7 Sep 2023 14:08:58 -0700 Subject: [PATCH 331/822] Bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 (#10373) Bumps [github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin) from 0.2.3 to 0.2.4. - [Release notes](https://github.com/cyphar/filepath-securejoin/releases) - [Commits](https://github.com/cyphar/filepath-securejoin/compare/v0.2.3...v0.2.4) --- updated-dependencies: - dependency-name: github.com/cyphar/filepath-securejoin dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index de0287d40..bd52b5cb2 100644 --- a/go.mod +++ b/go.mod @@ -50,7 +50,7 @@ require ( github.com/blang/semver/v4 v4.0.0 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect github.com/coreos/go-systemd/v22 v22.3.2 // indirect - github.com/cyphar/filepath-securejoin v0.2.3 // indirect + github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/eapache/queue v1.1.0 // indirect github.com/emicklei/go-restful/v3 v3.10.2 // indirect diff --git a/go.sum b/go.sum index 27b7bd039..36ec1043d 100644 --- a/go.sum +++ b/go.sum @@ -61,8 +61,8 @@ github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzA github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= -github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI= -github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= +github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg= +github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From e5f524268ecc9f0180049aed25d936b6c89706a0 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Fri, 8 Sep 2023 08:04:15 -0300 Subject: [PATCH 332/822] Fix http default backend test (#10382) --- .github/workflows/ci.yaml | 2 +- test/e2e/defaultbackend/default_backend.go | 16 ++++++++-------- test/e2e/settings/ocsp/ocsp.go | 1 + 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3465a5264..6413174a0 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -62,7 +62,7 @@ jobs: - 'charts/ingress-nginx/**/*' - 'NGINX_BASE' - gofmt: + gofmt: runs-on: ubuntu-latest needs: changes if: | diff --git a/test/e2e/defaultbackend/default_backend.go b/test/e2e/defaultbackend/default_backend.go index e589024b4..936878000 100644 --- a/test/e2e/defaultbackend/default_backend.go +++ b/test/e2e/defaultbackend/default_backend.go @@ -49,15 +49,15 @@ var _ = framework.IngressNginxDescribe("[Default Backend]", func() { {"basic HTTPS POST request without host to path / should return 404", "", framework.HTTPS, "POST", "/", http.StatusNotFound}, {"basic HTTPS POST request without host to path /demo should return 404", "", framework.HTTPS, "POST", "/demo", http.StatusNotFound}, - {"basic HTTP GET request to host foo.bar.com and path / should return 404", " foo.bar.com", framework.HTTP, "GET", "/", http.StatusNotFound}, - {"basic HTTP GET request to host foo.bar.com and path /demo should return 404", " foo.bar.com", framework.HTTP, "GET", "/demo", http.StatusNotFound}, - {"basic HTTPS GET request to host foo.bar.com and path / should return 404", " foo.bar.com", framework.HTTPS, "GET", "/", http.StatusNotFound}, - {"basic HTTPS GET request to host foo.bar.com and path /demo should return 404", " foo.bar.com", framework.HTTPS, "GET", "/demo", http.StatusNotFound}, + {"basic HTTP GET request to host foo.bar.com and path / should return 404", "foo.bar.com", framework.HTTP, "GET", "/", http.StatusNotFound}, + {"basic HTTP GET request to host foo.bar.com and path /demo should return 404", "foo.bar.com", framework.HTTP, "GET", "/demo", http.StatusNotFound}, + {"basic HTTPS GET request to host foo.bar.com and path / should return 404", "foo.bar.com", framework.HTTPS, "GET", "/", http.StatusNotFound}, + {"basic HTTPS GET request to host foo.bar.com and path /demo should return 404", "foo.bar.com", framework.HTTPS, "GET", "/demo", http.StatusNotFound}, - {"basic HTTP POST request to host foo.bar.com and path / should return 404", " foo.bar.com", framework.HTTP, "POST", "/", http.StatusNotFound}, - {"basic HTTP POST request to host foo.bar.com and path /demo should return 404", " foo.bar.com", framework.HTTP, "POST", "/demo", http.StatusNotFound}, - {"basic HTTPS POST request to host foo.bar.com and path / should return 404", " foo.bar.com", framework.HTTPS, "POST", "/", http.StatusNotFound}, - {"basic HTTPS POST request to host foo.bar.com and path /demo should return 404", " foo.bar.com", framework.HTTPS, "POST", "/demo", http.StatusNotFound}, + {"basic HTTP POST request to host foo.bar.com and path / should return 404", "foo.bar.com", framework.HTTP, "POST", "/", http.StatusNotFound}, + {"basic HTTP POST request to host foo.bar.com and path /demo should return 404", "foo.bar.com", framework.HTTP, "POST", "/demo", http.StatusNotFound}, + {"basic HTTPS POST request to host foo.bar.com and path / should return 404", "foo.bar.com", framework.HTTPS, "POST", "/", http.StatusNotFound}, + {"basic HTTPS POST request to host foo.bar.com and path /demo should return 404", "foo.bar.com", framework.HTTPS, "POST", "/demo", http.StatusNotFound}, } framework.Sleep() diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index 0ec15db58..4d419c5d0 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -47,6 +47,7 @@ var _ = framework.DescribeSetting("OCSP", func() { }) ginkgo.It("should enable OCSP and contain stapling information in the connection", func() { + ginkgo.Skip("Skipped due to a bug with cfssl and Alpine") host := "www.example.com" f.UpdateNginxConfigMapData("enable-ocsp", "true") From 4664b741ff789817ed32923cf0391cb0a4bc77df Mon Sep 17 00:00:00 2001 From: Son Bui Date: Sat, 9 Sep 2023 01:34:15 +0800 Subject: [PATCH 333/822] fix: remove curl on base container #9716 (#10306) * fix: remove curl on base container #9716 * fix: remove curl on chroot container #9716 Signed-off-by: Son Bui * fix: remove curl on test runner image #9716 Signed-off-by: Son Bui * fix: remove curl on e2e runner container #9716 Signed-off-by: Son Bui --------- Signed-off-by: Son Bui --- images/nginx/rootfs/Dockerfile | 1 - images/test-runner/rootfs/Dockerfile | 1 - rootfs/Dockerfile-chroot | 1 - test/e2e-image/Dockerfile | 1 - 4 files changed, 4 deletions(-) diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index 7627870ba..d5cd8c143 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -40,7 +40,6 @@ RUN apk update \ pcre \ zlib \ geoip \ - curl \ ca-certificates \ patch \ yajl \ diff --git a/images/test-runner/rootfs/Dockerfile b/images/test-runner/rootfs/Dockerfile index 40017f775..161b6caf4 100644 --- a/images/test-runner/rootfs/Dockerfile +++ b/images/test-runner/rootfs/Dockerfile @@ -65,7 +65,6 @@ RUN apk update && apk upgrade && apk add --no-cache \ unzip \ openssl \ cfssl@testing \ - curl \ tzdata \ libc6-compat diff --git a/rootfs/Dockerfile-chroot b/rootfs/Dockerfile-chroot index 48facd44f..945304ad2 100644 --- a/rootfs/Dockerfile-chroot +++ b/rootfs/Dockerfile-chroot @@ -50,7 +50,6 @@ RUN apk update \ && apk add -U --no-cache \ bash \ openssl \ - curl \ ca-certificates \ dumb-init \ tzdata \ diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index 2ee5716ed..28609d23d 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -7,7 +7,6 @@ RUN apk update \ && apk upgrade && apk add -U --no-cache \ ca-certificates \ bash \ - curl \ tzdata \ libc6-compat \ openssl From da9c5730f669d4bcad5c7146a644796cb7c24ee5 Mon Sep 17 00:00:00 2001 From: James Strong Date: Sat, 9 Sep 2023 11:44:09 -0400 Subject: [PATCH 334/822] release notes 1.8.2 (#10389) * release notes 1.8.2 Signed-off-by: James Strong * fix yaml error Signed-off-by: James Strong * supdate docs * Rolling back to v1.21.1 --------- Signed-off-by: James Strong Co-authored-by: Ricardo Katz --- README.md | 1 + TAG | 2 +- changelog/Changelog-1.8.2.md | 19 + charts/ingress-nginx/Chart.yaml | 9 +- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.7.2.md | 9 + charts/ingress-nginx/values.yaml | 6 +- deploy/static/provider/aws/deploy.yaml | 44 +- .../aws/nlb-with-tls-termination/deploy.yaml | 44 +- deploy/static/provider/baremetal/deploy.yaml | 44 +- deploy/static/provider/cloud/deploy.yaml | 44 +- deploy/static/provider/do/deploy.yaml | 44 +- deploy/static/provider/exoscale/deploy.yaml | 44 +- deploy/static/provider/kind/deploy.yaml | 44 +- deploy/static/provider/oracle/deploy.yaml | 44 +- deploy/static/provider/scw/deploy.yaml | 44 +- docs/deploy/index.md | 20 +- docs/e2e-tests.md | 924 ++++++------------ 18 files changed, 560 insertions(+), 834 deletions(-) create mode 100644 changelog/Changelog-1.8.2.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.7.2.md diff --git a/README.md b/README.md index 812ddacb6..b6e2dafe7 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p | | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | |:--:|-----------------------|------------------------------|----------------|---------------|--------------------| +| 🔄 | **v1.8.2** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.1** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.0** | 1.27,1.26, 1.25, 1.24 | 3.18.0 | 1.21.6 | 4.7.* | | 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | diff --git a/TAG b/TAG index 804a616da..57f52717b 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.8.0 +v1.8.2 diff --git a/changelog/Changelog-1.8.2.md b/changelog/Changelog-1.8.2.md new file mode 100644 index 000000000..12a273af2 --- /dev/null +++ b/changelog/Changelog-1.8.2.md @@ -0,0 +1,19 @@ +# Changelog + +### 1.8.2 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.8.2@sha256:1317a563219f755a6094d990057c78e5c4dcea5e31f4ce1db8641e732a7d6133 + +### All Changes: + +* Release v1.8.2 and Update Go to v1.21.1 (#10379) +* Making auth access logs optional (#10380) +* [release-1.8] Disable Modsecurity from internal processing which affects large ingresses (#10375) +* promote distroless otel init image (#10270) +* [release-1.8] Update images tags after adding git data in gcloud (#10233) +* [release-1.8] Golang 1.20.6 for test runner (#10231) + +### Dependencies updates: +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.8.1...controller-controller-v1.8.2 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index de5fe4df0..4e1fc67a5 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,12 +1,9 @@ annotations: artifacthub.io/changes: | - - "Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406)" - - "feat(helm): Add loadBalancerClass (#9562)" - - "added helmshowvalues example (#10019)" - - "Update Ingress-Nginx version controller-v1.8.1" + - "Update Ingress-Nginx version controller-v1.8.2" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.8.1 +appVersion: 1.8.2 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -23,4 +20,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.7.1 +version: 4.7.2 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 4deed599b..77f711042 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.7.1](https://img.shields.io/badge/Version-4.7.1-informational?style=flat-square) ![AppVersion: 1.8.1](https://img.shields.io/badge/AppVersion-1.8.1-informational?style=flat-square) +![Version: 4.7.2](https://img.shields.io/badge/Version-4.7.2-informational?style=flat-square) ![AppVersion: 1.8.2](https://img.shields.io/badge/AppVersion-1.8.2-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -315,13 +315,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd"` | | -| controller.image.digestChroot | string | `"sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627"` | | +| controller.image.digest | string | `"sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2"` | | +| controller.image.digestChroot | string | `"sha256:1317a563219f755a6094d990057c78e5c4dcea5e31f4ce1db8641e732a7d6133"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.8.1"` | | +| controller.image.tag | string | `"v1.8.2"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.7.2.md b/charts/ingress-nginx/changelog/Changelog-4.7.2.md new file mode 100644 index 000000000..57b17b982 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.7.2.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.7.2 + +* Update Ingress-Nginx version controller-v1.8.2 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.1...helm-chart-4.7.2 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 4e8ddb4fc..7ba4fa896 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -24,9 +24,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.8.1" - digest: sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd - digestChroot: sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627 + tag: "v1.8.2" + digest: sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + digestChroot: sha256:1317a563219f755a6094d990057c78e5c4dcea5e31f4ce1db8641e732a7d6133 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 2c785fab2..6ac6b2847 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 7eb2a4c12..eebac4dbc 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -431,7 +431,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -455,7 +455,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -530,7 +530,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -541,7 +541,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -577,7 +577,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -588,7 +588,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index ba5b71838..d503b5db2 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -608,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 0bb95331f..ce08314fc 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 9ef7f86ee..db6609024 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index d09c9bbb4..2eaabad4f 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +523,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +534,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -570,7 +570,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +581,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -632,7 +632,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index f9965d0fe..aefad5a33 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index 4c93acfb2..c52d3a24e 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index a57ef5ded..8f64241ec 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.8.2 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/deploy/index.md b/docs/deploy/index.md index df11d710c..ae28c2502 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -68,7 +68,7 @@ helm show values ingress-nginx --repo https://kubernetes.github.io/ingress-nginx **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -249,7 +249,7 @@ In AWS, we use a Network load balancer (NLB) to expose the Ingress-Nginx Control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -257,10 +257,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -306,7 +306,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -323,7 +323,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -331,7 +331,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -339,7 +339,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -354,7 +354,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/cloud/deploy.yaml ``` A @@ -381,7 +381,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 398304c57..9a1661de0 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -7,407 +7,263 @@ Do not try to edit it manually. -### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L) -- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L45) -- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L72) -- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L89) -- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L110) -- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L127) -- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L138) -- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L152) -- [should return an error if there is an invalid path and wrong pathType is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L166) -- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L201) -- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L217) -- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L233) -- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L244) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L) -### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L) -- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) -- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L64) -- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L99) -- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L121) -- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L194) -- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L225) -- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L248) -- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L270) -- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L294) -- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L320) -- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L352) -- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L372) -- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L412) -- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L435) -- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L458) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L) -### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L31) - -- [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L34) -- [Check persistent affinity mode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L67) - -### [server-alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L29) - -- [should return status code 200 for host 'foo' and 404 for 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L36) -- [should return status code 200 for host 'foo' and 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L62) -- [should return status code 200 for hosts defined in two ingresses, different path with one alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L87) - -### [app-root](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L28) - -- [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) - -### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L29) - -- [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L36) -- [should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L84) -- [should 302 redirect to error page instead of 400 when auth-tls-error-page is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L114) -- [should pass URL-encoded certificate to upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L161) -- [should validate auth-tls-verify-client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L206) -- [should return 403 using auth-tls-match-cn with no matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L266) -- [should return 200 using auth-tls-match-cn with matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L295) -- [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L324) - -### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L) - [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L34) - [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L49) - [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) - [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) - [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) +======= +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L) -### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L) -- [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L35) -- [should set client_body_buffer_size to 1K](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L57) -- [should set client_body_buffer_size to 1k](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L79) -- [should set client_body_buffer_size to 1m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L101) -- [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L123) -- [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L145) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L) -### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L) -- [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L35) -- [should set cors methods to only allow POST, GET](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L62) -- [should set cors max-age](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L78) -- [should disable cors allow credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L94) -- [should allow origin for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L110) -- [should allow headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L137) -- [should expose headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L153) -- [should allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L169) -- [should not allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L196) -- [should allow correct origins - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L216) -- [should not break functionality](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L267) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L291) -- [should not break functionality with extra domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L314) -- [should not match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L338) -- [should allow - single origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L358) -- [should not allow - single origin with port and origin without port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L386) -- [should not allow - single origin without port and origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L405) -- [should allow - matching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L425) -- [should not allow - unmatching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L468) -- [should allow - matching origin+port with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L488) -- [should not allow - portless origin with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L515) -- [should allow correct origins - missing subdomain + origin with wildcard origin and correct origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L535) -- [should allow - missing origins (should allow all origins)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L571) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L) -### [custom-http-errors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L34) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L) -- [configures Nginx correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L41) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L) -### [default-backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L) -- [should use a custom default backend as upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L37) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L) -### [disable-access-log disable-http-access-log disable-stream-access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L) -- [disable-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L35) -- [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) -- [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L) -### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L) -- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) -- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) -- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) -- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L) -### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L) -- [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L) -### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L) -- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L38) -- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L64) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L) -### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L) -- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L) -### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L) -- [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L) -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L) -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L) -### [whitelist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L) -- [should set valid ip whitelist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L34) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L) -### [Annotation - limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L) -- [should limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L) -### [limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L) -- [Check limit-rate annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L37) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L) -### [enable-access-log enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L) -- [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L34) -- [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L49) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L) -### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L) -- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) -- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) -- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) -- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) -- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) -- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) -- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) -- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) -- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) -- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) -- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) -- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L) -### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L) -- [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L) -### [proxy-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L) -- [should set proxy_redirect to off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L36) -- [should set proxy_redirect to default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L52) -- [should set proxy_redirect to hello.com goodbye.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L68) -- [should set proxy client-max-body-size to 8m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L85) -- [should not set proxy client-max-body-size to incorrect value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L100) -- [should set valid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L115) -- [should not set invalid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L136) -- [should turn on proxy-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L157) -- [should turn off proxy-request-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L179) -- [should build proxy next upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L194) -- [should setup proxy cookies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L215) -- [should change the default proxy HTTP version](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L233) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L) -### [proxy-ssl-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L) -- [should set valid proxy-ssl-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L37) -- [should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L64) -- [should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L94) -- [should set valid proxy-ssl-secret, proxy-ssl-protocols](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L122) -- [proxy-ssl-location-only flag should change the nginx config server part](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L150) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L) -### [permanent-redirect permanent-redirect-code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L) -- [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L33) -- [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L61) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L) -### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L) -- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L37) -- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L66) -- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L111) -- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) -- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L) -### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L) -- [add valid directives to server via server snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L35) -- [drops server snippet if disabled by the administrator](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L61) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L) -### [service-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L32) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L) -- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L41) -- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L70) -- [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L99) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L) -### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L) -- [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L) -### [stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L34) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L) -- [should add value of stream-snippet to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L41) -- [should add stream-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L85) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L) -### [upstream-hash-by-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L76) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L) -- [should connect to the same pod](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L83) -- [should connect to the same subset of pods](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L92) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L) -### [upstream-vhost](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L) -- [set host to upstreamvhost.bar.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L34) - -### [x-forwarded-prefix](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L28) - -- [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) -- [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) - -### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) - -- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) -- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L65) -- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L89) -- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L116) -- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L144) -- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L172) -- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L199) -- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L227) -- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L266) -- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L284) -- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L301) -- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L322) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L411) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L422) -- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L433) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L472) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L481) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L492) -- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L516) -- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L539) -- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L557) -- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L577) -- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L596) -- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L610) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L653) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L662) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L673) -- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L732) -- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L752) -- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L780) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L809) -- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L839) -- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L847) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L) -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L) -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L45) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L89) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L120) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L174) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L232) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L289) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L363) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L445) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L513) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L594) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L647) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L692) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L741) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L790) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L862) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L910) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L952) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L995) -- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1070) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1104) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1138) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1175) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1242) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1310) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L) -### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L) -- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L) -### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L) -- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) -- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) -- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L) -### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L) -- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L40) -- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L82) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L) -### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L) -- [set snippet more_set_headers in all locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L34) -- [drops snippet more_set_header in all locations if disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L63) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L) -### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L39) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L) -- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L42) -- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L67) -- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L126) -- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L186) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L) -### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L) -- [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) -- [should get information for a specific backend server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L56) -- [should produce valid JSON for /dbg general](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L85) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L) -### [[Default Backend] custom service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L) -- [uses custom default backend that returns 200 as status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L36) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L) -### [[Default Backend]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L) -- [should return 404 sending requests when only a default backend is running](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L33) -- [enables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L88) -- [disables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L105) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L) -### [[Default Backend] SSL](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L26) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L) -- [should return a self generated SSL certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L29) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L) -### [[Default Backend] change default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L) -- [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L) -### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L) -- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L) -### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L35) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L) -- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L43) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/chain.go#L) @@ -421,21 +277,9 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/match.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/string.go#L) @@ -445,462 +289,318 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) -### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L217) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) -### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) -- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) -### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) -- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L40) -- [should shutdown after waiting 60 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L61) -- [should shutdown after waiting 150 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L106) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) -### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L25) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) -- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L33) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) -### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) -- [should drop whole ingress if one path matches invalid regex](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L34) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) -### [single ingress - multiple hosts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) -- [should set the correct $service_name NGINX variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) -### [[Ingress] [PathType] exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L) -- [should choose exact location for /exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L37) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L) -### [[Ingress] [PathType] mix Exact and Prefix paths](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L) -- [should choose the correct location](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L39) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L) -### [[Ingress] [PathType] prefix checks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L) -- [should return 404 when prefix /aaa does not match request /aaaccc](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L) -### [[Ingress] definition without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L) -- [should set ingress details variables for ingresses without a host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L34) -- [should set ingress details variables for ingresses with host without IngressRuleValue, only Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L55) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L) -### [[Memory Leak] Dynamic Certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L35) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L) -- [should not leak memory from ingress SSL certificates or configuration updates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L42) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L) -### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L) -- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L) -### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L) -- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L42) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L) -### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L) -- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L39) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L) -### [[Lua] dynamic certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L) -- [picks up the certificate when we add TLS spec to existing ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L45) -- [picks up the previously missing secret for a given ingress without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L70) -- [supports requests with domain with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L145) -- [picks up the updated certificate without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L149) -- [falls back to using default certificate when secret gets deleted without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L185) -- [picks up a non-certificate only change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L218) -- [removes HTTPS configuration when we delete TLS spec](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L233) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L) -### [[Lua] dynamic configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L42) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L) -- [configures balancer Lua middleware correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L50) -- [handles endpoints only changes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L62) -- [handles endpoints only changes (down scaling of replicas)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L87) -- [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L125) -- [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L171) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L) -### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L) -- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) -- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L) -### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L) -- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) -- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) -- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L) -### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L) -- [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L) -### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L) -- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L36) -- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L54) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L) -### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L) -- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L) -### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L) -- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L40) -- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L77) -- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L117) -- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L147) -- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L183) -- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L224) -- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L260) -- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L347) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L) -### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L) -- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L32) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L42) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L54) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L67) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L80) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L) -### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L) -- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L36) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L67) -- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L102) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L133) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L) -### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L) -### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L) -- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) -- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L65) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L) -### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L) -- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L64) -- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L80) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L) -### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L) -- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L50) -- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L69) -- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) -- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L) -### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L) -- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) -- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L53) -- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L80) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L) -### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L) -- [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L46) -- [should only allow requests from specific countries](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L70) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L) -### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L) -- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L38) -- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) -- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L) -### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L) -- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) -- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L) -### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L) -- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L) -### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L) -- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) -- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) -- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) -- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) -- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) -- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L) -### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L) -- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L40) -- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L48) -- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L60) -- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L68) -- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L80) -- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L88) -- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L100) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L) -### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L39) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L) -- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L68) -- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L104) -- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L132) -- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L164) -- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L192) -- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L257) -- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L323) -- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L413) -- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L482) -- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L539) -- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L631) -- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L652) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L) -### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L) -- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L) -### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L) -- [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L40) -- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L47) -- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L55) -- [should enable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L63) -- [should disable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L71) -- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L82) -- [log-format default escape](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L105) -- [log-format-escape-none enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L128) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L) -### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L26) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L) -- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L29) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L) -### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L) -- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L) -### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L) -- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L) -### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L) -- [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L31) -- [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L39) -- [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L49) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L) -### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L) +<<<<<<< Updated upstream - [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) +======= +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L) +>>>>>>> Stashed changes -### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L) -- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) -- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) -- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L) -### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L) -- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L) -### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L) -- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L47) -- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L60) -- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L74) -- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L89) -- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L104) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L) -### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L48) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L) -- [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L58) -- [should exists opentracing directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L71) -- [should include opentracing_trust_incoming_span off directive when disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L85) -- [should not exists opentracing_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L100) -- [should exists opentracing_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L115) -- [should not exists opentracing_location_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L130) -- [should exists opentracing_location_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L145) -- [should enable opentracing using zipkin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L160) -- [should enable opentracing using jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L172) -- [should enable opentracing using jaeger with sampler host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L184) -- [should propagate the w3c header when configured with jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L197) -- [should enable opentracing using jaeger with an HTTP endpoint](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L228) -- [should enable opentracing using datadog](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L241) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L) -### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L) -- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L35) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L) -### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L41) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L) -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L44) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L) -### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L37) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L) -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L40) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L) -### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L) -- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L36) -- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L52) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L) -### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L) -- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L) -### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L) -- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L36) -- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L52) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L) -### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L) -- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L36) -- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L52) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L) -### [reuse-port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L) -- [reuse port should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L38) -- [reuse port should be disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L44) -- [reuse port should be enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L52) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L) -### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L) -- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L35) -- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L92) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L) -### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L) -- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L38) -- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L50) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L) -### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L) -- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L) -### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L) -- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L) -### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L) -- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L38) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L) -### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L) -- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L55) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L) -### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L) -- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) -- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L) -### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L) -- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L39) -- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L91) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L) -### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L34) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L) -- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L87) -- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L104) -- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L128) -- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L157) -- [should proxy_method method when global-auth-method is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L199) -- [should add custom error page when global-auth-signin url is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L212) -- [should add auth headers when global-auth-response-headers is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L225) -- [should set request-redirect when global-auth-request-redirect is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L239) -- [should set snippet when global external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L252) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L328) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L339) -- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L350) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L) -### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L) -- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L39) -- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L47) -- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L58) -- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L67) -- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L76) -- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L85) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L) -### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L30) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L) -- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L46) -- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L68) -- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L98) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L) -### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L27) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L) -- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L30) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L) -### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) -- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) -- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L57) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) -### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L36) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L) -- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L46) -- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L79) -- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L112) -- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L155) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L) -### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L) -- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) -- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L) -### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L31) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L) -- [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L65) -- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L111) -- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L127) -- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L146) -- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L166) -- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L187) -- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L205) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L) -### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L) -- [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) - -### [[SSL] secret update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L33) - -- [should not appear references to secret updates not used in ingress rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L40) -- [should return the fake SSL certificate if the secret is invalid](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L82) - -### [[Status] status update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L38) - -- [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L43) - -### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L38) - -- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) -- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L) From 4869c8b462e1c02597ce978051a694992c8417ae Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Sun, 10 Sep 2023 14:38:10 +0200 Subject: [PATCH 335/822] Deployment/DaemonSet: Template `topologySpreadConstraints`. (#10259) --- .../templates/controller-daemonset.yaml | 2 +- .../templates/controller-deployment.yaml | 2 +- charts/ingress-nginx/values.yaml | 20 ++++++++++++++----- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index 82abe7564..54bb2b6a5 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -202,7 +202,7 @@ spec: affinity: {{ toYaml .Values.controller.affinity | nindent 8 }} {{- end }} {{- if .Values.controller.topologySpreadConstraints }} - topologySpreadConstraints: {{ toYaml .Values.controller.topologySpreadConstraints | nindent 8 }} + topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} {{- end }} serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index 69cb734a0..bc33fecf1 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -209,7 +209,7 @@ spec: affinity: {{ toYaml .Values.controller.affinity | nindent 8 }} {{- end }} {{- if .Values.controller.topologySpreadConstraints }} - topologySpreadConstraints: {{ toYaml .Values.controller.topologySpreadConstraints | nindent 8 }} + topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }} {{- end }} serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }} terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 7ba4fa896..6762c0d85 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -248,12 +248,22 @@ controller: ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ ## topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - # labelSelector: + # - labelSelector: # matchLabels: - # app.kubernetes.io/instance: ingress-nginx-internal + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: controller + # topologyKey: topology.kubernetes.io/zone + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}' + # app.kubernetes.io/component: controller + # topologyKey: kubernetes.io/hostname + # maxSkew: 1 + # whenUnsatisfiable: ScheduleAnyway # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready ## wait up to five minutes for the drain of connections From fb7f92a7d5e0cac0ce8a9bab8247ccc0805a0239 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Sun, 10 Sep 2023 20:46:09 +0800 Subject: [PATCH 336/822] Remove gofmt (#10385) Signed-off-by: z1cheng --- .github/workflows/ci.yaml | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 6413174a0..2b416311b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -62,25 +62,6 @@ jobs: - 'charts/ingress-nginx/**/*' - 'NGINX_BASE' - gofmt: - runs-on: ubuntu-latest - needs: changes - if: | - (needs.changes.outputs.go == 'true') - steps: - - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - - - name: Set up Go - id: go - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 - with: - go-version: '1.21.1' - check-latest: true - - - name: Run go-fmt - run: ./hack/verify-gofmt.sh - test-go: runs-on: ubuntu-latest needs: changes From 93e006c2cedd3c7836c6edd0a46d71f63fa9d0f5 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Sun, 10 Sep 2023 21:48:10 +0800 Subject: [PATCH 337/822] Fix deferInLoop error (#10387) Signed-off-by: z1cheng --- internal/nginx/maxmind.go | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/internal/nginx/maxmind.go b/internal/nginx/maxmind.go index bd6bc1048..4719a22c1 100644 --- a/internal/nginx/maxmind.go +++ b/internal/nginx/maxmind.go @@ -179,20 +179,19 @@ func downloadDatabase(dbName string) error { if !strings.HasSuffix(header.Name, mmdbFile) { continue } + return func() error { + outFile, err := os.Create(path.Join(geoIPPath, mmdbFile)) + if err != nil { + return err + } - outFile, err := os.Create(path.Join(geoIPPath, mmdbFile)) - if err != nil { - return err - } + defer outFile.Close() - //nolint:gocritic // TODO: will fix it on a followup PR - defer outFile.Close() - - if _, err := io.CopyN(outFile, tarReader, header.Size); err != nil { - return err - } - - return nil + if _, err := io.CopyN(outFile, tarReader, header.Size); err != nil { + return err + } + return nil + }() } } From 2d03da63344b63544f8f8f108c54b326fecb7c36 Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Sun, 10 Sep 2023 16:20:09 +0200 Subject: [PATCH 338/822] Deployment/DaemonSet: Fix templating & value. (#10240) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/templates/_helpers.tpl | 2 -- .../ingress-nginx/templates/controller-daemonset.yaml | 11 +++++++---- .../templates/controller-deployment.yaml | 9 ++++----- charts/ingress-nginx/values.yaml | 10 +++++++++- 5 files changed, 21 insertions(+), 13 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 77f711042..fe8892412 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -307,7 +307,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. | | controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. | | controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. | -| controller.hostAliases | object | `{}` | Optionally customize the pod hostAliases. | +| controller.hostAliases | list | `[]` | Optionally customize the pod hostAliases. | | controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged | | controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not | | controller.hostPort.ports.http | int | `80` | 'hostPort' http port | diff --git a/charts/ingress-nginx/templates/_helpers.tpl b/charts/ingress-nginx/templates/_helpers.tpl index 548e8cf12..7206fe5ba 100644 --- a/charts/ingress-nginx/templates/_helpers.tpl +++ b/charts/ingress-nginx/templates/_helpers.tpl @@ -198,7 +198,6 @@ IngressClass parameters. Extra modules. */}} {{- define "extraModules" -}} - - name: {{ .name }} image: {{ .image }} {{- if .distroless | default false }} @@ -212,5 +211,4 @@ Extra modules. volumeMounts: - name: {{ toYaml "modules"}} mountPath: {{ toYaml "/modules_mount"}} - {{- end -}} diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index 54bb2b6a5..5d94eb2f5 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -45,6 +45,9 @@ spec: {{- if .Values.controller.dnsConfig }} dnsConfig: {{ toYaml .Values.controller.dnsConfig | nindent 8 }} {{- end }} + {{- if .Values.controller.hostAliases }} + hostAliases: {{ tpl (toYaml .Values.controller.hostAliases) $ | nindent 8 }} + {{- end }} {{- if .Values.controller.hostname }} hostname: {{ toYaml .Values.controller.hostname | nindent 8 }} {{- end }} @@ -180,13 +183,13 @@ spec: {{- end }} {{- if .Values.controller.extraModules }} {{- range .Values.controller.extraModules }} - {{ $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} -{{ include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | indent 8 }} + {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | nindent 8 }} {{- end }} {{- end }} {{- if .Values.controller.opentelemetry.enabled}} - {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} - {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}} + {{- $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" true) | nindent 8}} {{- end}} {{- end }} {{- if .Values.controller.hostNetwork }} diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index bc33fecf1..e23414ec9 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -24,8 +24,7 @@ spec: {{- end }} revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} {{- if .Values.controller.updateStrategy }} - strategy: - {{ toYaml .Values.controller.updateStrategy | nindent 4 }} + strategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }} {{- end }} minReadySeconds: {{ .Values.controller.minReadySeconds }} template: @@ -187,12 +186,12 @@ spec: {{- end }} {{- if .Values.controller.extraModules }} {{- range .Values.controller.extraModules }} - {{ $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} -{{ include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | indent 8 }} + {{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | nindent 8 }} {{- end }} {{- end }} {{- if .Values.controller.opentelemetry.enabled}} - {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} + {{- $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }} {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" true) | nindent 8}} {{- end}} {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 6762c0d85..4816758fa 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -50,7 +50,15 @@ controller: # -- Optionally customize the pod dnsConfig. dnsConfig: {} # -- Optionally customize the pod hostAliases. - hostAliases: {} + hostAliases: [] + # - ip: 127.0.0.1 + # hostnames: + # - foo.local + # - bar.local + # - ip: 10.1.2.3 + # hostnames: + # - foo.remote + # - bar.remote # -- Optionally customize the pod hostname. hostname: {} # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. From cf889c6c47fda30a59e1d08665bbb3d3931a5b4e Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Mon, 11 Sep 2023 00:02:10 -0300 Subject: [PATCH 339/822] Disable user snippets per default (#10393) * Disable user snippets per default * Enable snippet on tests --- .gitignore | 1 + charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/values.yaml | 2 +- cmd/plugin/util/util.go | 4 +- .../nginx-configuration/configmap.md | 4 +- internal/ingress/annotations/fastcgi/main.go | 2 +- .../annotations/modsecurity/main_test.go | 4 +- internal/ingress/annotations/proxy/main.go | 2 +- .../annotations/sslcipher/main_test.go | 4 +- internal/ingress/controller/config/config.go | 2 +- internal/ingress/controller/controller.go | 8 +- internal/ingress/metric/collectors/main.go | 2 +- internal/net/ssl/ssl.go | 2 +- magefiles/helm.go | 328 ++++++++---------- magefiles/mage.go | 3 +- magefiles/release.go | 122 +++---- magefiles/tags.go | 11 +- test/e2e/admission/admission.go | 26 ++ test/e2e/annotations/auth.go | 17 + test/e2e/annotations/fastcgi.go | 2 +- test/e2e/annotations/fromtowwwredirect.go | 9 + test/e2e/annotations/grpc.go | 9 + .../annotations/modsecurity/modsecurity.go | 58 +++- test/e2e/annotations/serversnippet.go | 18 + test/e2e/annotations/snippet.go | 14 +- test/e2e/annotations/streamsnippet.go | 9 + test/e2e/framework/deployment.go | 2 +- test/e2e/ingress/multiple_rules.go | 9 + test/e2e/ingress/pathtype_exact.go | 9 + test/e2e/ingress/pathtype_mixed.go | 9 + test/e2e/settings/badannotationvalues.go | 33 ++ test/e2e/settings/geoip2.go | 10 +- test/e2e/settings/proxy_host.go | 17 + test/e2e/settings/server_snippet.go | 11 + test/e2e/settings/validations/validations.go | 17 + 35 files changed, 494 insertions(+), 288 deletions(-) diff --git a/.gitignore b/.gitignore index 2c0accad7..60bf6a304 100644 --- a/.gitignore +++ b/.gitignore @@ -60,3 +60,4 @@ cmd/plugin/release/ingress-nginx.yaml cmd/plugin/release/*.tar.gz cmd/plugin/release/LICENSE tmp/ +test/junitreports/ diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index fe8892412..5487ca218 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -274,7 +274,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.admissionWebhooks.service.servicePort | int | `443` | | | controller.admissionWebhooks.service.type | string | `"ClusterIP"` | | | controller.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity # | -| controller.allowSnippetAnnotations | bool | `true` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected | +| controller.allowSnippetAnnotations | bool | `false` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected | | controller.annotations | object | `{}` | Annotations to be added to the controller Deployment or DaemonSet # | | controller.autoscaling.annotations | object | `{}` | | | controller.autoscaling.behavior | object | `{}` | | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 4816758fa..fffbe90b2 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -81,7 +81,7 @@ controller: # their own *-snippet annotations, otherwise this is forbidden / dropped # when users add those annotations. # Global snippets in ConfigMap are still respected - allowSnippetAnnotations: true + allowSnippetAnnotations: false # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 # is merged diff --git a/cmd/plugin/util/util.go b/cmd/plugin/util/util.go index aa753689a..7457b8c53 100644 --- a/cmd/plugin/util/util.go +++ b/cmd/plugin/util/util.go @@ -29,8 +29,8 @@ import ( // The default deployment and service names for ingress-nginx const ( - DefaultIngressDeploymentName = "ingress-nginx-controller" - DefaultIngressServiceName = "ingress-nginx-controller" + DefaultIngressDeploymentName = "ingress-nginx-controller" //#nosec G101 + DefaultIngressServiceName = "ingress-nginx-controller" //#nosec G101 DefaultIngressContainerName = "controller" ) diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index 0a7e44dce..d771d16b2 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -30,7 +30,7 @@ The following table shows a configuration option's name, type, and the default v |[add-headers](#add-headers)|string|""|| |[allow-backend-server-header](#allow-backend-server-header)|bool|"false"|| |[allow-cross-namespace-resources](#allow-cross-namespace-resources)|bool|"true"|| -|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true|| +|[allow-snippet-annotations](#allow-snippet-annotations)|bool|false|| |[annotations-risk-level](#annotations-risk-level)|string|Critical|| |[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""|| |[hide-headers](#hide-headers)|string array|empty|| @@ -257,7 +257,7 @@ Enables users to consume cross namespace resource on annotations, when was previ ## allow-snippet-annotations -Enables Ingress to parse and add *-snippet annotations/directives created by the user. _**default:**_ `true` +Enables Ingress to parse and add *-snippet annotations/directives created by the user. _**default:**_ `false` Warning: We recommend enabling this option only if you TRUST users with permission to create Ingress objects, as this may allow a user to add restricted configurations to the final nginx.conf file diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go index 882de5b1c..52384a969 100644 --- a/internal/ingress/annotations/fastcgi/main.go +++ b/internal/ingress/annotations/fastcgi/main.go @@ -32,7 +32,7 @@ import ( const ( fastCGIIndexAnnotation = "fastcgi-index" - fastCGIParamsAnnotation = "fastcgi-params-configmap" + fastCGIParamsAnnotation = "fastcgi-params-configmap" //#nosec G101 ) // fast-cgi valid parameters is just a single file name (like index.php) diff --git a/internal/ingress/annotations/modsecurity/main_test.go b/internal/ingress/annotations/modsecurity/main_test.go index 0c9b3a9c7..5cb05f201 100644 --- a/internal/ingress/annotations/modsecurity/main_test.go +++ b/internal/ingress/annotations/modsecurity/main_test.go @@ -67,7 +67,7 @@ func TestParse(t *testing.T) { Spec: networking.IngressSpec{}, } - for _, testCase := range testCases { + for i, testCase := range testCases { ing.SetAnnotations(testCase.annotations) result, err := ap.Parse(ing) if err != nil { @@ -77,7 +77,7 @@ func TestParse(t *testing.T) { if !ok { t.Errorf("unexpected type: %T", result) } - if !config.Equal(&testCase.expected) { + if !config.Equal(&testCases[i].expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } } diff --git a/internal/ingress/annotations/proxy/main.go b/internal/ingress/annotations/proxy/main.go index 7fb1c814e..9d2646261 100644 --- a/internal/ingress/annotations/proxy/main.go +++ b/internal/ingress/annotations/proxy/main.go @@ -42,7 +42,7 @@ const ( proxyRedirectToAnnotation = "proxy-redirect-to" proxyBufferingAnnotation = "proxy-buffering" proxyHTTPVersionAnnotation = "proxy-http-version" - proxyMaxTempFileSizeAnnotation = "proxy-max-temp-file-size" + proxyMaxTempFileSizeAnnotation = "proxy-max-temp-file-size" //#nosec G101 ) var validUpstreamAnnotation = regexp.MustCompile(`^((error|timeout|invalid_header|http_500|http_502|http_503|http_504|http_403|http_404|http_429|non_idempotent|off)\s?)+$`) diff --git a/internal/ingress/annotations/sslcipher/main_test.go b/internal/ingress/annotations/sslcipher/main_test.go index 167466fef..20cb4d7af 100644 --- a/internal/ingress/annotations/sslcipher/main_test.go +++ b/internal/ingress/annotations/sslcipher/main_test.go @@ -64,13 +64,13 @@ func TestParse(t *testing.T) { Spec: networking.IngressSpec{}, } - for _, testCase := range testCases { + for i, testCase := range testCases { ing.SetAnnotations(testCase.annotations) result, err := ap.Parse(ing) if (err != nil) != testCase.expectErr { t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations) } - if !reflect.DeepEqual(result, &testCase.expected) { + if !reflect.DeepEqual(result, &testCases[i].expected) { t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations) } } diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 0dafa78a2..09983308e 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -865,7 +865,7 @@ func NewDefault() Configuration { defGlobalExternalAuth := GlobalExternalAuth{"", "", "", "", "", append(defResponseHeaders, ""), "", "", "", []string{}, map[string]string{}, false} cfg := Configuration{ - AllowSnippetAnnotations: true, + AllowSnippetAnnotations: false, AllowCrossNamespaceResources: true, AllowBackendServerHeader: false, AnnotationValueWordBlocklist: "", diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index f2ad4639b..bbcde1d4f 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -1057,7 +1057,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B continue } - for _, path := range rule.HTTP.Paths { + for i, path := range rule.HTTP.Paths { if path.Backend.Service == nil { // skip non-service backends klog.V(3).Infof("Ingress %q and path %q does not contain a service backend, using default backend", ingKey, path.Path) @@ -1087,7 +1087,7 @@ func (n *NGINXController) createUpstreams(data []*ingress.Ingress, du *ingress.B // add the service ClusterIP as a single Endpoint instead of individual Endpoints if anns.ServiceUpstream { - endpoint, err := n.getServiceClusterEndpoint(svcKey, &path.Backend) + endpoint, err := n.getServiceClusterEndpoint(svcKey, &rule.HTTP.Paths[i].Backend) if err != nil { klog.Errorf("Failed to determine a suitable ClusterIP Endpoint for Service %q: %v", svcKey, err) } else { @@ -1844,7 +1844,7 @@ func ingressForHostPath(hostname, path string, servers []*ingress.Server) []*net continue } - for _, location := range server.Locations { + for i, location := range server.Locations { if location.Path != path { continue } @@ -1853,7 +1853,7 @@ func ingressForHostPath(hostname, path string, servers []*ingress.Server) []*net continue } - ingresses = append(ingresses, &location.Ingress.Ingress) + ingresses = append(ingresses, &server.Locations[i].Ingress.Ingress) } } diff --git a/internal/ingress/metric/collectors/main.go b/internal/ingress/metric/collectors/main.go index 2c57ad774..b2479929b 100644 --- a/internal/ingress/metric/collectors/main.go +++ b/internal/ingress/metric/collectors/main.go @@ -17,4 +17,4 @@ limitations under the License. package collectors // PrometheusNamespace default metric namespace -var PrometheusNamespace = "nginx_ingress_controller" +var PrometheusNamespace = "nginx_ingress_controller" //#nosec G101 diff --git a/internal/net/ssl/ssl.go b/internal/net/ssl/ssl.go index 516b1ec9c..26fd706e1 100644 --- a/internal/net/ssl/ssl.go +++ b/internal/net/ssl/ssl.go @@ -55,7 +55,7 @@ var FakeSSLCertificateUID = "00000000-0000-0000-0000-000000000000" var oidExtensionSubjectAltName = asn1.ObjectIdentifier{2, 5, 29, 17} const ( - fakeCertificateName = "default-fake-certificate" + fakeCertificateName = "default-fake-certificate" //#nosec G101 ) // getPemFileName returns absolute file path and file name of pem cert related to given fullSecretName diff --git a/magefiles/helm.go b/magefiles/helm.go index 585a93413..c11fc9ec2 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -32,8 +32,10 @@ import ( "gopkg.in/yaml.v3" ) -const HelmChartPath = "charts/ingress-nginx/Chart.yaml" -const HelmChartValues = "charts/ingress-nginx/values.yaml" +const ( + HelmChartPath = "charts/ingress-nginx/Chart.yaml" + HelmChartValues = "charts/ingress-nginx/values.yaml" +) type Helm mg.Namespace @@ -43,7 +45,6 @@ func (Helm) UpdateAppVersion() { } func updateAppVersion() { - } // UpdateVersion Update Helm Version of the Chart @@ -69,11 +70,11 @@ func updateVersion(version string) { chart, err := chartutil.LoadChartfile(HelmChartPath) CheckIfError(err, "HELM Could not Load Chart") - //Get the current tag - //appVersionV, err := getIngressNGINXVersion() - //CheckIfError(err, "HELM Issue Retrieving the Current Ingress Nginx Version") + // Get the current tag + // appVersionV, err := getIngressNGINXVersion() + // CheckIfError(err, "HELM Issue Retrieving the Current Ingress Nginx Version") - //remove the v from TAG + // remove the v from TAG appVersion := version Info("HELM Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) @@ -82,7 +83,7 @@ func updateVersion(version string) { return } - //Update the helm chart + // Update the helm chart chart.AppVersion = appVersion cTag, err := semver.Make(chart.Version) CheckIfError(err, "HELM Creating Chart Version: %v", err) @@ -113,7 +114,6 @@ func updateChartReleaseNotes(releasesNotes []string) { } func UpdateChartChangelog() { - } // UpdateChartValue Updates the Helm ChartValue @@ -124,16 +124,16 @@ func (Helm) UpdateChartValue(key, value string) { func updateChartValue(key, value string) { Info("HELM Updating Chart %s %s:%s", HelmChartValues, key, value) - //read current values.yaml + // read current values.yaml data, err := os.ReadFile(HelmChartValues) CheckIfError(err, "HELM Could not Load Helm Chart Values files %s", HelmChartValues) - //var valuesStruct IngressChartValue + // var valuesStruct IngressChartValue var n yaml.Node CheckIfError(yaml.Unmarshal(data, &n), "HELM Could not Unmarshal %s", HelmChartValues) - //update value - //keyParse := parsePath(key) + // update value + // keyParse := parsePath(key) p, err := yamlpath.NewPath(key) CheckIfError(err, "HELM cannot create path") @@ -152,7 +152,7 @@ func updateChartValue(key, value string) { yamlEncoder.SetIndent(2) err = yamlEncoder.Encode(&n) CheckIfError(err, "HELM Could not Marshal new Values file") - err = os.WriteFile(HelmChartValues, b.Bytes(), 0644) + err = os.WriteFile(HelmChartValues, b.Bytes(), 0o644) CheckIfError(err, "HELM Could not write new Values file to %s", HelmChartValues) Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) @@ -161,6 +161,7 @@ func updateChartValue(key, value string) { func (Helm) Helmdocs() error { return runHelmDocs() } + func runHelmDocs() error { err := installHelmDocs() if err != nil { @@ -175,7 +176,7 @@ func runHelmDocs() error { func installHelmDocs() error { Info("HELM Install HelmDocs") - var g0 = sh.RunCmd("go") + g0 := sh.RunCmd("go") err := g0("install", "github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0") if err != nil { @@ -186,13 +187,11 @@ func installHelmDocs() error { func parsePath(key string) []string { return strings.Split(key, ".") } func updateHelmDocs() { - } type IngressChartValue struct { - CommonLabels struct { - } `yaml:"commonLabels"` - Controller struct { + CommonLabels struct{} `yaml:"commonLabels"` + Controller struct { Name string `yaml:"name"` Image struct { Chroot bool `yaml:"chroot"` @@ -211,24 +210,18 @@ type IngressChartValue struct { HTTP int `yaml:"http"` HTTPS int `yaml:"https"` } `yaml:"containerPort"` - Config struct { - } `yaml:"config"` - ConfigAnnotations struct { - } `yaml:"configAnnotations"` - ProxySetHeaders struct { - } `yaml:"proxySetHeaders"` - AddHeaders struct { - } `yaml:"addHeaders"` - DNSConfig struct { - } `yaml:"dnsConfig"` - Hostname struct { - } `yaml:"hostname"` - DNSPolicy string `yaml:"dnsPolicy"` - ReportNodeInternalIP bool `yaml:"reportNodeInternalIp"` - WatchIngressWithoutClass bool `yaml:"watchIngressWithoutClass"` - IngressClassByName bool `yaml:"ingressClassByName"` - AllowSnippetAnnotations bool `yaml:"allowSnippetAnnotations"` - HostNetwork bool `yaml:"hostNetwork"` + Config struct{} `yaml:"config"` + ConfigAnnotations struct{} `yaml:"configAnnotations"` + ProxySetHeaders struct{} `yaml:"proxySetHeaders"` + AddHeaders struct{} `yaml:"addHeaders"` + DNSConfig struct{} `yaml:"dnsConfig"` + Hostname struct{} `yaml:"hostname"` + DNSPolicy string `yaml:"dnsPolicy"` + ReportNodeInternalIP bool `yaml:"reportNodeInternalIp"` + WatchIngressWithoutClass bool `yaml:"watchIngressWithoutClass"` + IngressClassByName bool `yaml:"ingressClassByName"` + AllowSnippetAnnotations bool `yaml:"allowSnippetAnnotations"` + HostNetwork bool `yaml:"hostNetwork"` HostPort struct { Enabled bool `yaml:"enabled"` Ports struct { @@ -238,21 +231,17 @@ type IngressChartValue struct { } `yaml:"hostPort"` ElectionID string `yaml:"electionID"` IngressClassResource struct { - Name string `yaml:"name"` - Enabled bool `yaml:"enabled"` - Default bool `yaml:"default"` - ControllerValue string `yaml:"controllerValue"` - Parameters struct { - } `yaml:"parameters"` + Name string `yaml:"name"` + Enabled bool `yaml:"enabled"` + Default bool `yaml:"default"` + ControllerValue string `yaml:"controllerValue"` + Parameters struct{} `yaml:"parameters"` } `yaml:"ingressClassResource"` - IngressClass string `yaml:"ingressClass"` - PodLabels struct { - } `yaml:"podLabels"` - PodSecurityContext struct { - } `yaml:"podSecurityContext"` - Sysctls struct { - } `yaml:"sysctls"` - PublishService struct { + IngressClass string `yaml:"ingressClass"` + PodLabels struct{} `yaml:"podLabels"` + PodSecurityContext struct{} `yaml:"podSecurityContext"` + Sysctls struct{} `yaml:"sysctls"` + PublishService struct { Enabled bool `yaml:"enabled"` PathOverride string `yaml:"pathOverride"` } `yaml:"publishService"` @@ -263,30 +252,23 @@ type IngressChartValue struct { } `yaml:"scope"` ConfigMapNamespace string `yaml:"configMapNamespace"` TCP struct { - ConfigMapNamespace string `yaml:"configMapNamespace"` - Annotations struct { - } `yaml:"annotations"` + ConfigMapNamespace string `yaml:"configMapNamespace"` + Annotations struct{} `yaml:"annotations"` } `yaml:"tcp"` UDP struct { - ConfigMapNamespace string `yaml:"configMapNamespace"` - Annotations struct { - } `yaml:"annotations"` + ConfigMapNamespace string `yaml:"configMapNamespace"` + Annotations struct{} `yaml:"annotations"` } `yaml:"udp"` - MaxmindLicenseKey string `yaml:"maxmindLicenseKey"` - ExtraArgs struct { - } `yaml:"extraArgs"` - ExtraEnvs []interface{} `yaml:"extraEnvs"` - Kind string `yaml:"kind"` - Annotations struct { - } `yaml:"annotations"` - Labels struct { - } `yaml:"labels"` - UpdateStrategy struct { - } `yaml:"updateStrategy"` - MinReadySeconds int `yaml:"minReadySeconds"` - Tolerations []interface{} `yaml:"tolerations"` - Affinity struct { - } `yaml:"affinity"` + MaxmindLicenseKey string `yaml:"maxmindLicenseKey"` + ExtraArgs struct{} `yaml:"extraArgs"` + ExtraEnvs []interface{} `yaml:"extraEnvs"` + Kind string `yaml:"kind"` + Annotations struct{} `yaml:"annotations"` + Labels struct{} `yaml:"labels"` + UpdateStrategy struct{} `yaml:"updateStrategy"` + MinReadySeconds int `yaml:"minReadySeconds"` + Tolerations []interface{} `yaml:"tolerations"` + Affinity struct{} `yaml:"affinity"` TopologySpreadConstraints []interface{} `yaml:"topologySpreadConstraints"` TerminationGracePeriodSeconds int `yaml:"terminationGracePeriodSeconds"` NodeSelector struct { @@ -316,29 +298,26 @@ type IngressChartValue struct { SuccessThreshold int `yaml:"successThreshold"` FailureThreshold int `yaml:"failureThreshold"` } `yaml:"readinessProbe"` - HealthCheckPath string `yaml:"healthCheckPath"` - HealthCheckHost string `yaml:"healthCheckHost"` - PodAnnotations struct { - } `yaml:"podAnnotations"` - ReplicaCount int `yaml:"replicaCount"` - MinAvailable int `yaml:"minAvailable"` - Resources struct { + HealthCheckPath string `yaml:"healthCheckPath"` + HealthCheckHost string `yaml:"healthCheckHost"` + PodAnnotations struct{} `yaml:"podAnnotations"` + ReplicaCount int `yaml:"replicaCount"` + MinAvailable int `yaml:"minAvailable"` + Resources struct { Requests struct { CPU string `yaml:"cpu"` Memory string `yaml:"memory"` } `yaml:"requests"` } `yaml:"resources"` Autoscaling struct { - APIVersion string `yaml:"apiVersion"` - Enabled bool `yaml:"enabled"` - Annotations struct { - } `yaml:"annotations"` - MinReplicas int `yaml:"minReplicas"` - MaxReplicas int `yaml:"maxReplicas"` - TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` - TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` - Behavior struct { - } `yaml:"behavior"` + APIVersion string `yaml:"apiVersion"` + Enabled bool `yaml:"enabled"` + Annotations struct{} `yaml:"annotations"` + MinReplicas int `yaml:"minReplicas"` + MaxReplicas int `yaml:"maxReplicas"` + TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` + TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` + Behavior struct{} `yaml:"behavior"` } `yaml:"autoscaling"` AutoscalingTemplate []interface{} `yaml:"autoscalingTemplate"` Keda struct { @@ -350,12 +329,10 @@ type IngressChartValue struct { CooldownPeriod int `yaml:"cooldownPeriod"` RestoreToOriginalReplicaCount bool `yaml:"restoreToOriginalReplicaCount"` ScaledObject struct { - Annotations struct { - } `yaml:"annotations"` + Annotations struct{} `yaml:"annotations"` } `yaml:"scaledObject"` Triggers []interface{} `yaml:"triggers"` - Behavior struct { - } `yaml:"behavior"` + Behavior struct{} `yaml:"behavior"` } `yaml:"keda"` EnableMimalloc bool `yaml:"enableMimalloc"` CustomTemplate struct { @@ -363,12 +340,10 @@ type IngressChartValue struct { ConfigMapKey string `yaml:"configMapKey"` } `yaml:"customTemplate"` Service struct { - Enabled bool `yaml:"enabled"` - AppProtocol bool `yaml:"appProtocol"` - Annotations struct { - } `yaml:"annotations"` - Labels struct { - } `yaml:"labels"` + Enabled bool `yaml:"enabled"` + AppProtocol bool `yaml:"appProtocol"` + Annotations struct{} `yaml:"annotations"` + Labels struct{} `yaml:"labels"` ExternalIPs []interface{} `yaml:"externalIPs"` LoadBalancerIP string `yaml:"loadBalancerIP"` LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` @@ -386,20 +361,17 @@ type IngressChartValue struct { } `yaml:"targetPorts"` Type string `yaml:"type"` NodePorts struct { - HTTP string `yaml:"http"` - HTTPS string `yaml:"https"` - TCP struct { - } `yaml:"tcp"` - UDP struct { - } `yaml:"udp"` + HTTP string `yaml:"http"` + HTTPS string `yaml:"https"` + TCP struct{} `yaml:"tcp"` + UDP struct{} `yaml:"udp"` } `yaml:"nodePorts"` External struct { Enabled bool `yaml:"enabled"` } `yaml:"external"` Internal struct { - Enabled bool `yaml:"enabled"` - Annotations struct { - } `yaml:"annotations"` + Enabled bool `yaml:"enabled"` + Annotations struct{} `yaml:"annotations"` LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` } `yaml:"internal"` } `yaml:"service"` @@ -417,25 +389,20 @@ type IngressChartValue struct { } `yaml:"containerSecurityContext"` } `yaml:"opentelemetry"` AdmissionWebhooks struct { - Annotations struct { - } `yaml:"annotations"` - Enabled bool `yaml:"enabled"` - ExtraEnvs []interface{} `yaml:"extraEnvs"` - FailurePolicy string `yaml:"failurePolicy"` - Port int `yaml:"port"` - Certificate string `yaml:"certificate"` - Key string `yaml:"key"` - NamespaceSelector struct { - } `yaml:"namespaceSelector"` - ObjectSelector struct { - } `yaml:"objectSelector"` - Labels struct { - } `yaml:"labels"` - ExistingPsp string `yaml:"existingPsp"` - NetworkPolicyEnabled bool `yaml:"networkPolicyEnabled"` + Annotations struct{} `yaml:"annotations"` + Enabled bool `yaml:"enabled"` + ExtraEnvs []interface{} `yaml:"extraEnvs"` + FailurePolicy string `yaml:"failurePolicy"` + Port int `yaml:"port"` + Certificate string `yaml:"certificate"` + Key string `yaml:"key"` + NamespaceSelector struct{} `yaml:"namespaceSelector"` + ObjectSelector struct{} `yaml:"objectSelector"` + Labels struct{} `yaml:"labels"` + ExistingPsp string `yaml:"existingPsp"` + NetworkPolicyEnabled bool `yaml:"networkPolicyEnabled"` Service struct { - Annotations struct { - } `yaml:"annotations"` + Annotations struct{} `yaml:"annotations"` ExternalIPs []interface{} `yaml:"externalIPs"` LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` ServicePort int `yaml:"servicePort"` @@ -445,15 +412,13 @@ type IngressChartValue struct { SecurityContext struct { AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` } `yaml:"securityContext"` - Resources struct { - } `yaml:"resources"` + Resources struct{} `yaml:"resources"` } `yaml:"createSecretJob"` PatchWebhookJob struct { SecurityContext struct { AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` } `yaml:"securityContext"` - Resources struct { - } `yaml:"resources"` + Resources struct{} `yaml:"resources"` } `yaml:"patchWebhookJob"` Patch struct { Enabled bool `yaml:"enabled"` @@ -464,15 +429,13 @@ type IngressChartValue struct { Digest string `yaml:"digest"` PullPolicy string `yaml:"pullPolicy"` } `yaml:"image"` - PriorityClassName string `yaml:"priorityClassName"` - PodAnnotations struct { - } `yaml:"podAnnotations"` - NodeSelector struct { + PriorityClassName string `yaml:"priorityClassName"` + PodAnnotations struct{} `yaml:"podAnnotations"` + NodeSelector struct { KubernetesIoOs string `yaml:"kubernetes.io/os"` } `yaml:"nodeSelector"` - Tolerations []interface{} `yaml:"tolerations"` - Labels struct { - } `yaml:"labels"` + Tolerations []interface{} `yaml:"tolerations"` + Labels struct{} `yaml:"labels"` SecurityContext struct { RunAsNonRoot bool `yaml:"runAsNonRoot"` RunAsUser int `yaml:"runAsUser"` @@ -494,30 +457,26 @@ type IngressChartValue struct { PortName string `yaml:"portName"` Enabled bool `yaml:"enabled"` Service struct { - Annotations struct { - } `yaml:"annotations"` + Annotations struct{} `yaml:"annotations"` ExternalIPs []interface{} `yaml:"externalIPs"` LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` ServicePort int `yaml:"servicePort"` Type string `yaml:"type"` } `yaml:"service"` ServiceMonitor struct { - Enabled bool `yaml:"enabled"` - AdditionalLabels struct { - } `yaml:"additionalLabels"` - Namespace string `yaml:"namespace"` - NamespaceSelector struct { - } `yaml:"namespaceSelector"` + Enabled bool `yaml:"enabled"` + AdditionalLabels struct{} `yaml:"additionalLabels"` + Namespace string `yaml:"namespace"` + NamespaceSelector struct{} `yaml:"namespaceSelector"` ScrapeInterval string `yaml:"scrapeInterval"` TargetLabels []interface{} `yaml:"targetLabels"` Relabelings []interface{} `yaml:"relabelings"` MetricRelabelings []interface{} `yaml:"metricRelabelings"` } `yaml:"serviceMonitor"` PrometheusRule struct { - Enabled bool `yaml:"enabled"` - AdditionalLabels struct { - } `yaml:"additionalLabels"` - Rules []interface{} `yaml:"rules"` + Enabled bool `yaml:"enabled"` + AdditionalLabels struct{} `yaml:"additionalLabels"` + Rules []interface{} `yaml:"rules"` } `yaml:"prometheusRule"` } `yaml:"metrics"` Lifecycle struct { @@ -543,9 +502,8 @@ type IngressChartValue struct { ReadOnlyRootFilesystem bool `yaml:"readOnlyRootFilesystem"` AllowPrivilegeEscalation bool `yaml:"allowPrivilegeEscalation"` } `yaml:"image"` - ExistingPsp string `yaml:"existingPsp"` - ExtraArgs struct { - } `yaml:"extraArgs"` + ExistingPsp string `yaml:"existingPsp"` + ExtraArgs struct{} `yaml:"extraArgs"` ServiceAccount struct { Create bool `yaml:"create"` Name string `yaml:"name"` @@ -567,46 +525,37 @@ type IngressChartValue struct { SuccessThreshold int `yaml:"successThreshold"` TimeoutSeconds int `yaml:"timeoutSeconds"` } `yaml:"readinessProbe"` - Tolerations []interface{} `yaml:"tolerations"` - Affinity struct { - } `yaml:"affinity"` - PodSecurityContext struct { - } `yaml:"podSecurityContext"` - ContainerSecurityContext struct { - } `yaml:"containerSecurityContext"` - PodLabels struct { - } `yaml:"podLabels"` - NodeSelector struct { + Tolerations []interface{} `yaml:"tolerations"` + Affinity struct{} `yaml:"affinity"` + PodSecurityContext struct{} `yaml:"podSecurityContext"` + ContainerSecurityContext struct{} `yaml:"containerSecurityContext"` + PodLabels struct{} `yaml:"podLabels"` + NodeSelector struct { KubernetesIoOs string `yaml:"kubernetes.io/os"` } `yaml:"nodeSelector"` - PodAnnotations struct { - } `yaml:"podAnnotations"` - ReplicaCount int `yaml:"replicaCount"` - MinAvailable int `yaml:"minAvailable"` - Resources struct { - } `yaml:"resources"` + PodAnnotations struct{} `yaml:"podAnnotations"` + ReplicaCount int `yaml:"replicaCount"` + MinAvailable int `yaml:"minAvailable"` + Resources struct{} `yaml:"resources"` ExtraVolumeMounts []interface{} `yaml:"extraVolumeMounts"` ExtraVolumes []interface{} `yaml:"extraVolumes"` Autoscaling struct { - Annotations struct { - } `yaml:"annotations"` - Enabled bool `yaml:"enabled"` - MinReplicas int `yaml:"minReplicas"` - MaxReplicas int `yaml:"maxReplicas"` - TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` - TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` + Annotations struct{} `yaml:"annotations"` + Enabled bool `yaml:"enabled"` + MinReplicas int `yaml:"minReplicas"` + MaxReplicas int `yaml:"maxReplicas"` + TargetCPUUtilizationPercentage int `yaml:"targetCPUUtilizationPercentage"` + TargetMemoryUtilizationPercentage int `yaml:"targetMemoryUtilizationPercentage"` } `yaml:"autoscaling"` Service struct { - Annotations struct { - } `yaml:"annotations"` + Annotations struct{} `yaml:"annotations"` ExternalIPs []interface{} `yaml:"externalIPs"` LoadBalancerSourceRanges []interface{} `yaml:"loadBalancerSourceRanges"` ServicePort int `yaml:"servicePort"` Type string `yaml:"type"` } `yaml:"service"` - PriorityClassName string `yaml:"priorityClassName"` - Labels struct { - } `yaml:"labels"` + PriorityClassName string `yaml:"priorityClassName"` + Labels struct{} `yaml:"labels"` } `yaml:"defaultBackend"` Rbac struct { Create bool `yaml:"create"` @@ -616,17 +565,14 @@ type IngressChartValue struct { Enabled bool `yaml:"enabled"` } `yaml:"podSecurityPolicy"` ServiceAccount struct { - Create bool `yaml:"create"` - Name string `yaml:"name"` - AutomountServiceAccountToken bool `yaml:"automountServiceAccountToken"` - Annotations struct { - } `yaml:"annotations"` + Create bool `yaml:"create"` + Name string `yaml:"name"` + AutomountServiceAccountToken bool `yaml:"automountServiceAccountToken"` + Annotations struct{} `yaml:"annotations"` } `yaml:"serviceAccount"` ImagePullSecrets []interface{} `yaml:"imagePullSecrets"` - TCP struct { - } `yaml:"tcp"` - UDP struct { - } `yaml:"udp"` - PortNamePrefix string `yaml:"portNamePrefix"` - DhParam interface{} `yaml:"dhParam"` + TCP struct{} `yaml:"tcp"` + UDP struct{} `yaml:"udp"` + PortNamePrefix string `yaml:"portNamePrefix"` + DhParam interface{} `yaml:"dhParam"` } diff --git a/magefiles/mage.go b/magefiles/mage.go index 605d687a9..ef54ee0f7 100644 --- a/magefiles/mage.go +++ b/magefiles/mage.go @@ -20,8 +20,9 @@ limitations under the License. package main import ( - "github.com/magefile/mage/mage" "os" + + "github.com/magefile/mage/mage" ) func main() { diff --git a/magefiles/release.go b/magefiles/release.go index 6e5efb490..e6dc6401d 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -22,39 +22,45 @@ import ( "context" "errors" "fmt" + "io" + "net" + "net/http" + "os" + "regexp" + "strings" + "text/template" + "time" + "github.com/google/go-github/v48/github" "github.com/magefile/mage/mg" "github.com/magefile/mage/sh" "golang.org/x/oauth2" "gopkg.in/yaml.v3" - "io" - "net" - "net/http" - "os" - "text/template" - - "regexp" - "strings" - "time" ) type Release mg.Namespace -var INGRESS_ORG = "kubernetes" // the owner so we can test from forks -var INGRESS_REPO = "ingress-nginx" // the repo to pull from -var RELEASE_BRANCH = "main" //we only release from main -var GITHUB_TOKEN string // the Google/gogithub lib needs an PAT to access the GitHub API -var K8S_IO_ORG = "kubernetes" //the owner or organization for the k8s.io repo -var K8S_IO_REPO = "k8s.io" //the repo that holds the images yaml for production promotion -var INGRESS_REGISTRY = "registry.k8s.io" //Container registry for storage Ingress-nginx images -var KUSTOMIZE_INSTALL_VERSION = "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4" //static deploys needs kustomize to generate the template +var ( + INGRESS_ORG = "kubernetes" // the owner so we can test from forks + INGRESS_REPO = "ingress-nginx" // the repo to pull from + RELEASE_BRANCH = "main" // we only release from main + GITHUB_TOKEN string // the Google/gogithub lib needs an PAT to access the GitHub API + K8S_IO_ORG = "kubernetes" // the owner or organization for the k8s.io repo + K8S_IO_REPO = "k8s.io" // the repo that holds the images yaml for production promotion + INGRESS_REGISTRY = "registry.k8s.io" // Container registry for storage Ingress-nginx images + KUSTOMIZE_INSTALL_VERSION = "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4" // static deploys needs kustomize to generate the template +) // ingress-nginx releases start with a TAG then a cloudbuild, then a promotion through a PR, this the location of that PR -var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml" -var ctx = context.Background() // Context used for GitHub Client +var ( + IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml" + ctx = context.Background() // Context used for GitHub Client +) -const INDEX_DOCS = "docs/deploy/index.md" //index.md has a version of the controller and needs to updated -const CHANGELOG = "Changelog.md" //Name of the changelog +const ( + INDEX_DOCS = "docs/deploy/index.md" // index.md has a version of the controller and needs to updated + CHANGELOG = "Changelog.md" // Name of the changelog +) // ControllerImage - struct with info about controllers type ControllerImage struct { @@ -101,81 +107,80 @@ func init() { // PromoteImage Creates PR into the k8s.io repo for promotion of ingress from staging to production func (Release) PromoteImage(version, sha string) { - } // Release Create a new release of ingress nginx controller func (Release) NewRelease(version string) { - //newRelease := Release{} + // newRelease := Release{} - //update ingress-nginx version - //This is the step that kicks all the release process - //it is already done, so it kicks off the gcloud build of the controller images - //mg.Deps(mg.F(Tag.BumpNginx, version)) + // update ingress-nginx version + // This is the step that kicks all the release process + // it is already done, so it kicks off the gcloud build of the controller images + // mg.Deps(mg.F(Tag.BumpNginx, version)) tag, err := getIngressNGINXVersion() CheckIfError(err, "RELEASE Retrieving the current Ingress Nginx Version") Info("RELEASE Checking Current Version %s to New Version %s", tag, version) - //if the version were upgrading does not match the TAG file, lets update the TAG file + // if the version were upgrading does not match the TAG file, lets update the TAG file if tag[1:] != version { Warning("RELEASE Ingress Nginx TAG %s and new version %s do not match", tag, version) mg.Deps(mg.F(Tag.BumpNginx, fmt.Sprintf("v%s", version))) } - //update git controller tag controller-v$version + // update git controller tag controller-v$version mg.Deps(mg.F(Tag.NewControllerTag, version)) - //make release notes + // make release notes releaseNotes, err := makeReleaseNotes(version) CheckIfError(err, "RELEASE Creating Release Notes for version %s", version) Info("RELEASE Release Notes %s completed", releaseNotes.Version) - //update chart values.yaml new controller tag and image digest + // update chart values.yaml new controller tag and image digest releaseNotes.PreviousHelmChartVersion = currentChartVersion() - //controller tag + // controller tag updateChartValue("controller.image.tag", fmt.Sprintf("v%s", releaseNotes.Version)) Debug("releaseNotes.ControllerImages[0].Name %s", releaseNotes.ControllerImages[0].Name) Debug("releaseNotes.ControllerImages[1].Name %s", releaseNotes.ControllerImages[1].Name) - //controller digest + // controller digest if releaseNotes.ControllerImages[0].Name == "ingress-nginx/controller" { Debug("Updating Chart Value %s with %s", "controller.image.digest", releaseNotes.ControllerImages[0].Digest) updateChartValue("controller.image.digest", releaseNotes.ControllerImages[0].Digest) } - //controller chroot digest + // controller chroot digest if releaseNotes.ControllerImages[1].Name == "ingress-nginx/controller-chroot" { Debug("Updating Chart Value %s with %s", "controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) updateChartValue("controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) } - //update helm chart app version + // update helm chart app version mg.Deps(mg.F(Helm.UpdateVersion, version)) releaseNotes.NewHelmChartVersion = currentChartVersion() - //update helm chart release notes + // update helm chart release notes updateChartReleaseNotes(releaseNotes.HelmUpdates) - //Run helm docs update + // Run helm docs update CheckIfError(runHelmDocs(), "Error Updating Helm Docs ") releaseNotes.helmTemplate() - //update static manifest + // update static manifest CheckIfError(updateStaticManifest(), "Error Updating Static manifests") ////update e2e docs updateE2EDocs() - //update documentation with ingress-nginx version + // update documentation with ingress-nginx version CheckIfError(updateIndexMD(releaseNotes.PreviousControllerVersion, releaseNotes.NewControllerVersion), "Error Updating %s", INDEX_DOCS) - //keeping these manual for now - //git commit TODO - //make Pull Request TODO - //make release TODO - //mg.Deps(mg.F(Release.CreateRelease, version)) + // keeping these manual for now + // git commit TODO + // make Pull Request TODO + // make release TODO + // mg.Deps(mg.F(Release.CreateRelease, version)) } // the index.md doc needs the controller version updated @@ -204,7 +209,7 @@ func updateE2EDocs() { // The static deploy scripts use kustomize to generate them, this function ensures kustomize is installed func installKustomize() error { Info("Install Kustomize") - var g0 = sh.RunCmd("go") + g0 := sh.RunCmd("go") // somewhere in your main code err := g0("install", KUSTOMIZE_INSTALL_VERSION) if err != nil { @@ -215,7 +220,7 @@ func installKustomize() error { func updateStaticManifest() error { CheckIfError(installKustomize(), "error installing kustomize") - //hack/generate-deploy-scripts.sh + // hack/generate-deploy-scripts.sh err := sh.RunV("./hack/generate-deploy-scripts.sh") if err != nil { return err @@ -270,28 +275,28 @@ func (Release) ReleaseNotes(newVersion string) error { } func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { - var newReleaseNotes = ReleaseNote{} + newReleaseNotes := ReleaseNote{} newReleaseNotes.Version = newVersion allControllerTags := getAllControllerTags() - //new version + // new version newReleaseNotes.NewControllerVersion = allControllerTags[0] newControllerVersion := fmt.Sprintf("controller-v%s", newVersion) - //the newControllerVersion should match the latest tag + // the newControllerVersion should match the latest tag if newControllerVersion != allControllerTags[0] { return nil, errors.New(fmt.Sprintf("Generating release new version %s didnt match the current latest tag %s", newControllerVersion, allControllerTags[0])) } - //previous version + // previous version newReleaseNotes.PreviousControllerVersion = allControllerTags[1] Info("New Version: %s Old Version: %s", newReleaseNotes.NewControllerVersion, newReleaseNotes.PreviousControllerVersion) commits := commitsBetweenTags() - //dependency_updates - //all_updates + // dependency_updates + // all_updates var allUpdates []string var depUpdates []string var helmUpdates []string @@ -299,9 +304,9 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { depBot := regexp.MustCompile("^(\\w){1,10} Bump ") helmRegex := regexp.MustCompile("helm|chart") for i, s := range commits { - //matches on PR + // matches on PR if prRegex.Match([]byte(s)) { - //matches a dependant bot update + // matches a dependant bot update if depBot.Match([]byte(s)) { // Debug("#%v DEPENDABOT %v", i, s) u := strings.SplitN(s, " ", 2) @@ -311,13 +316,12 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { u := strings.SplitN(s, " ", 2) allUpdates = append(allUpdates, u[1]) - //helm chart updates + // helm chart updates if helmRegex.Match([]byte(s)) { u := strings.SplitN(s, " ", 2) helmUpdates = append(helmUpdates, u[1]) } } - } } helmUpdates = append(helmUpdates, fmt.Sprintf("Update Ingress-Nginx version %s", newReleaseNotes.NewControllerVersion)) @@ -326,7 +330,7 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { newReleaseNotes.DepUpdates = depUpdates newReleaseNotes.HelmUpdates = helmUpdates - //controller_image_digests + // controller_image_digests imagesYaml, err := downloadFile(IMAGES_YAML) if err != nil { ErrorF("Could not download file %s : %s", IMAGES_YAML, err) @@ -342,7 +346,7 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { return nil, err } - //controller + // controller controllerDigest := findImageDigest(data, "controller", newVersion) if len(controllerDigest) == 0 { ErrorF("Controller Digest could not be found") @@ -379,7 +383,7 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { newReleaseNotes.printRelease() } - //write it all out to the changelog file + // write it all out to the changelog file newReleaseNotes.template() return &newReleaseNotes, nil diff --git a/magefiles/tags.go b/magefiles/tags.go index 02bbbcb37..ca02c2cc3 100644 --- a/magefiles/tags.go +++ b/magefiles/tags.go @@ -20,11 +20,12 @@ package main import ( "fmt" + "os" + "strings" + semver "github.com/blang/semver/v4" "github.com/magefile/mage/mg" "github.com/magefile/mage/sh" - "os" - "strings" ) type Tag mg.Namespace @@ -42,7 +43,7 @@ func getIngressNGINXVersion() (string, error) { dat, err := os.ReadFile("TAG") CheckIfError(err, "Could not read TAG file") datString := string(dat) - //remove newline + // remove newline datString = strings.Replace(datString, "\n", "", -1) return datString, nil } @@ -88,14 +89,14 @@ func (Tag) BumpNginx(newTag string) { } func bump(currentTag, newTag string) { - //check if semver is valid + // check if semver is valid if !checkSemVer(currentTag, newTag) { ErrorF("ERROR: Semver is not valid %v", newTag) os.Exit(1) } Info("Updating Tag %v to %v", currentTag, newTag) - err := os.WriteFile("TAG", []byte(newTag), 0666) + err := os.WriteFile("TAG", []byte(newTag), 0o666) CheckIfError(err, "Error Writing New Tag File") } diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index 726e16f0b..c41105e2d 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -127,6 +127,15 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if there is an error validating the ingress definition", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := admissionTestHost annotations := map[string]string{ @@ -232,6 +241,15 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should return an error if the Ingress V1 definition contains invalid annotations", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + out, err := createIngress(f.Namespace, invalidV1Ingress) assert.Empty(ginkgo.GinkgoT(), out) assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress using kubectl") @@ -243,6 +261,14 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", }) ginkgo.It("should not return an error for an invalid Ingress when it has unknown class", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() out, err := createIngress(f.Namespace, invalidV1IngressWithOtherClass) assert.Equal(ginkgo.GinkgoT(), "ingress.networking.k8s.io/extensions-invalid-other created\n", out) assert.Nil(ginkgo.GinkgoT(), err, "creating an invalid ingress with unknown class using kubectl") diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index be915a722..415ffd951 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -277,6 +277,14 @@ var _ = framework.DescribeAnnotation("auth-*", func() { "nginx.ingress.kubernetes.io/auth-snippet": ` proxy_set_header My-Custom-Header 42;`, } + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) @@ -290,6 +298,15 @@ var _ = framework.DescribeAnnotation("auth-*", func() { ginkgo.It(`should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured`, func() { host := authHost + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + annotations := map[string]string{ "nginx.ingress.kubernetes.io/auth-snippet": ` proxy_set_header My-Custom-Header 42;`, diff --git a/test/e2e/annotations/fastcgi.go b/test/e2e/annotations/fastcgi.go index 7ed35cb76..bcf1c3487 100644 --- a/test/e2e/annotations/fastcgi.go +++ b/test/e2e/annotations/fastcgi.go @@ -82,7 +82,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - FastCGI", func() { f.EnsureConfigMap(configuration) - host := "fastcgi-params-configmap" + host := "fastcgi-params-configmap" //#nosec G101 annotations := map[string]string{ "nginx.ingress.kubernetes.io/backend-protocol": "FCGI", diff --git a/test/e2e/annotations/fromtowwwredirect.go b/test/e2e/annotations/fromtowwwredirect.go index 4ee3d313c..b69cce93e 100644 --- a/test/e2e/annotations/fromtowwwredirect.go +++ b/test/e2e/annotations/fromtowwwredirect.go @@ -62,6 +62,15 @@ var _ = framework.DescribeAnnotation("from-to-www-redirect", func() { }) ginkgo.It("should redirect from www HTTPS to HTTPS", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + ginkgo.By("setting up server for redirect from www") fromHost := fmt.Sprintf("%s.nip.io", f.GetNginxIP()) diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 4c121df49..b256b8ae4 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -189,6 +189,15 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("should return OK for service with backend protocol GRPCS", func() { f.NewGRPCBinDeployment() + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := echoHost svc := &corev1.Service{ diff --git a/test/e2e/annotations/modsecurity/modsecurity.go b/test/e2e/annotations/modsecurity/modsecurity.go index 71e8963e3..a3e7d80ba 100644 --- a/test/e2e/annotations/modsecurity/modsecurity.go +++ b/test/e2e/annotations/modsecurity/modsecurity.go @@ -100,6 +100,15 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := modSecurityFooHost nameSpace := f.Namespace @@ -164,6 +173,15 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity with snippet and block requests", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := modSecurityFooHost nameSpace := f.Namespace @@ -194,6 +212,15 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity globally and with modsecurity-snippet block requests", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := modSecurityFooHost nameSpace := f.Namespace @@ -224,6 +251,17 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should enable modsecurity when enable-owasp-modsecurity-crs is set to true", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + "enable-modsecurity": "true", + "enable-owasp-modsecurity-crs": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := modSecurityFooHost nameSpace := f.Namespace @@ -238,11 +276,6 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { ing := framework.NewSingleIngress(host, "/", host, nameSpace, framework.EchoService, 80, annotations) f.EnsureIngress(ing) - f.SetNginxConfigMapData(map[string]string{ - "enable-modsecurity": "true", - "enable-owasp-modsecurity-crs": "true", - }) - f.WaitForNginxServer(host, func(server string) bool { return strings.Contains(server, "SecRuleEngine On") @@ -277,12 +310,17 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { f.EnsureIngress(ing) expectedComment := "SecRuleEngine On" - f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", "enable-modsecurity": "true", "enable-owasp-modsecurity-crs": "true", "modsecurity-snippet": expectedComment, }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() f.WaitForNginxServer(host, func(server string) bool { @@ -340,6 +378,14 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() { }) ginkgo.It("should disable default modsecurity conf setting when modsecurity-snippet is specified", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() host := modSecurityFooHost nameSpace := f.Namespace diff --git a/test/e2e/annotations/serversnippet.go b/test/e2e/annotations/serversnippet.go index e74fa37f5..1195b728a 100644 --- a/test/e2e/annotations/serversnippet.go +++ b/test/e2e/annotations/serversnippet.go @@ -33,6 +33,15 @@ var _ = framework.DescribeAnnotation("server-snippet", func() { }) ginkgo.It(`add valid directives to server via server snippet`, func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "serversnippet.foo.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-snippet": ` @@ -59,6 +68,15 @@ var _ = framework.DescribeAnnotation("server-snippet", func() { }) ginkgo.It(`drops server snippet if disabled by the administrator`, func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "noserversnippet.foo.com" annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-snippet": ` diff --git a/test/e2e/annotations/snippet.go b/test/e2e/annotations/snippet.go index 2bbd3e33a..0c6148a4f 100644 --- a/test/e2e/annotations/snippet.go +++ b/test/e2e/annotations/snippet.go @@ -33,6 +33,16 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() { ginkgo.It("set snippet more_set_headers in all locations", func() { host := "configurationsnippet.foo.com" + + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Foo1: Bar1";`, } @@ -76,10 +86,6 @@ var _ = framework.DescribeAnnotation("configuration-snippet", func() { annotations) f.UpdateNginxConfigMapData("allow-snippet-annotations", "false") - defer func() { - // Return to the original value - f.UpdateNginxConfigMapData("allow-snippet-annotations", "true") - }() // Sleep a while just to guarantee that the configmap is applied framework.Sleep() diff --git a/test/e2e/annotations/streamsnippet.go b/test/e2e/annotations/streamsnippet.go index b5df50975..432537b4a 100644 --- a/test/e2e/annotations/streamsnippet.go +++ b/test/e2e/annotations/streamsnippet.go @@ -39,6 +39,15 @@ var _ = framework.DescribeSetting("stream-snippet", func() { }) ginkgo.It("should add value of stream-snippet to nginx config", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "foo.com" snippet := `server {listen 8000; proxy_pass 127.0.0.1:80;}` diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 7ac150dcf..08a5353b2 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -47,7 +47,7 @@ const NIPService = "external-nip" var HTTPBunImage = os.Getenv("HTTPBUN_IMAGE") // EchoImage is the default image to be used by the echo service -const EchoImage = "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a" +const EchoImage = "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a" //#nosec G101 // TODO: change all Deployment functions to use these options // in order to reduce complexity and have a unified API across the diff --git a/test/e2e/ingress/multiple_rules.go b/test/e2e/ingress/multiple_rules.go index c08f36374..f44b2f8dd 100644 --- a/test/e2e/ingress/multiple_rules.go +++ b/test/e2e/ingress/multiple_rules.go @@ -36,6 +36,15 @@ var _ = framework.IngressNginxDescribe("single ingress - multiple hosts", func() }) ginkgo.It("should set the correct $service_name NGINX variable", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_input_headers "service-name: $service_name";`, } diff --git a/test/e2e/ingress/pathtype_exact.go b/test/e2e/ingress/pathtype_exact.go index ccc76b5bc..d0564cbf6 100644 --- a/test/e2e/ingress/pathtype_exact.go +++ b/test/e2e/ingress/pathtype_exact.go @@ -35,6 +35,15 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] exact", func() { }) ginkgo.It("should choose exact location for /exact", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "exact.path" annotations := map[string]string{ diff --git a/test/e2e/ingress/pathtype_mixed.go b/test/e2e/ingress/pathtype_mixed.go index c55a2c32a..e7bf2532e 100644 --- a/test/e2e/ingress/pathtype_mixed.go +++ b/test/e2e/ingress/pathtype_mixed.go @@ -37,6 +37,15 @@ var _ = framework.IngressNginxDescribe("[Ingress] [PathType] mix Exact and Prefi exactPathType := networking.PathTypeExact ginkgo.It("should choose the correct location", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "mixed.path" annotations := map[string]string{ diff --git a/test/e2e/settings/badannotationvalues.go b/test/e2e/settings/badannotationvalues.go index 68a122e76..f61b5bada 100644 --- a/test/e2e/settings/badannotationvalues.go +++ b/test/e2e/settings/badannotationvalues.go @@ -34,6 +34,14 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() host := "invalid-value-test" annotations := map[string]string{ @@ -65,6 +73,15 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "forbidden-value-test" annotations := map[string]string{ @@ -100,6 +117,14 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() hostValid := "custom-allowed-value-test" annotationsValid := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": ` @@ -130,6 +155,14 @@ var _ = framework.DescribeAnnotation("Bad annotation values", func() { }) ginkgo.It("[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() host := "custom-forbidden-value-test" annotations := map[string]string{ diff --git a/test/e2e/settings/geoip2.go b/test/e2e/settings/geoip2.go index 6dd48b2ad..e37286d5c 100644 --- a/test/e2e/settings/geoip2.go +++ b/test/e2e/settings/geoip2.go @@ -69,7 +69,15 @@ var _ = framework.DescribeSetting("Geoip2", func() { ginkgo.It("should only allow requests from specific countries", func() { ginkgo.Skip("GeoIP test are temporarily disabled") - f.UpdateNginxConfigMapData("use-geoip2", "true") + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + "use-geoip2": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() httpSnippetAllowingOnlyAustralia := `map $geoip2_city_country_code $blocked_country { default 1; diff --git a/test/e2e/settings/proxy_host.go b/test/e2e/settings/proxy_host.go index efc254e45..35aafc53d 100644 --- a/test/e2e/settings/proxy_host.go +++ b/test/e2e/settings/proxy_host.go @@ -34,6 +34,14 @@ var _ = framework.IngressNginxDescribe("Dynamic $proxy_host", func() { }) ginkgo.It("should exist a proxy_host", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() upstreamName := fmt.Sprintf("%v-%v-80", f.Namespace, framework.EchoService) annotations := map[string]string{ "nginx.ingress.kubernetes.io/configuration-snippet": `more_set_headers "Custom-Header: $proxy_host"`, @@ -55,6 +63,15 @@ var _ = framework.IngressNginxDescribe("Dynamic $proxy_host", func() { }) ginkgo.It("should exist a proxy_host using the upstream-vhost annotation value", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + upstreamName := fmt.Sprintf("%v-%v-80", f.Namespace, framework.EchoService) upstreamVHost := "different.host" annotations := map[string]string{ diff --git a/test/e2e/settings/server_snippet.go b/test/e2e/settings/server_snippet.go index 1577c927c..8ddf10fd9 100644 --- a/test/e2e/settings/server_snippet.go +++ b/test/e2e/settings/server_snippet.go @@ -37,10 +37,16 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() { hostAnnots := "serverannotssnippet1.foo.com" f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", "server-snippet": ` more_set_headers "Globalfoo: Foooo";`, }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-snippet": ` more_set_headers "Foo: Bar"; @@ -99,6 +105,11 @@ var _ = framework.DescribeSetting("configmap server-snippet", func() { more_set_headers "Globalfoo: Foooo";`, }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() annotations := map[string]string{ "nginx.ingress.kubernetes.io/server-snippet": ` more_set_headers "Foo: Bar"; diff --git a/test/e2e/settings/validations/validations.go b/test/e2e/settings/validations/validations.go index 19488d247..ac95a453a 100644 --- a/test/e2e/settings/validations/validations.go +++ b/test/e2e/settings/validations/validations.go @@ -31,6 +31,15 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { f := framework.NewDefaultFramework("validations") //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() + host := "annotation-validations" // Low and Medium Risk annotations should be allowed, the rest should be denied @@ -57,6 +66,14 @@ var _ = framework.IngressNginxDescribeSerial("annotation validations", func() { }) //nolint:dupl // Ignore dupl errors for similar test case ginkgo.It("should allow ingress based on their risk on webhooks", func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "true", + }) + defer func() { + f.SetNginxConfigMapData(map[string]string{ + "allow-snippet-annotations": "false", + }) + }() host := "annotation-validations" // Low and Medium Risk annotations should be allowed, the rest should be denied From 3d69d9a88b7ba70671b4fb9d15bb148f7e053fd2 Mon Sep 17 00:00:00 2001 From: Chen Chen Date: Mon, 11 Sep 2023 16:24:11 +0800 Subject: [PATCH 340/822] Fix e2e test suite doc (#10396) * Fix e2e test suite doc Signed-off-by: z1cheng * Fix doc script and regenerate Signed-off-by: z1cheng * Add skip files to the script and regenerate Signed-off-by: z1cheng --------- Signed-off-by: z1cheng --- docs/e2e-tests.md | 991 ++++++++++++++++++++------------- hack/generate-e2e-suite-doc.sh | 14 + 2 files changed, 615 insertions(+), 390 deletions(-) diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 9a1661de0..9a3e727fd 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -7,600 +7,811 @@ Do not try to edit it manually. -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L) +### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L39) + +- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L47) +- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L74) +- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L91) +- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L112) +- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L129) +- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L149) +- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L163) +- [should return an error if there is an invalid path and wrong pathType is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L177) +- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L211) +- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L227) +- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L243) +- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L263) + +### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L43) + +- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L50) +- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L72) +- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L107) +- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L129) +- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L202) +- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L234) +- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L257) +- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L279) +- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L303) +- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L329) +- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L361) +- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L381) +- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L421) +- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L444) +- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L467) + +### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L33) + +- [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L36) +- [Check persistent affinity mode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L69) + +### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L29) + +- [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L36) +- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L51) +- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L66) +- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L81) +- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L96) + +### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L30) + +- [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L37) +- [should set client_body_buffer_size to 1K](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L59) +- [should set client_body_buffer_size to 1k](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L81) +- [should set client_body_buffer_size to 1m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L103) +- [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L125) +- [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L147) + +### [default-backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L29) + +- [should use a custom default backend as upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L37) + +### [proxy-ssl-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L32) + +- [should set valid proxy-ssl-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L39) +- [should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L66) +- [should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L96) +- [should set valid proxy-ssl-secret, proxy-ssl-protocols](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L124) +- [proxy-ssl-location-only flag should change the nginx config server part](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L152) + +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L45) + +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L52) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L71) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L95) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L122) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L150) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L178) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L205) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L233) +- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L272) +- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L298) +- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L324) +- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L345) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L432) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L443) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L454) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L493) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L502) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L513) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L537) +- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L560) +- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L578) +- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L598) +- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L617) +- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L631) +- [should disable set_all_vars when auth-keepalive-share-vars is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L653) +- [should enable set_all_vars when auth-keepalive-share-vars is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L672) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L713) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L722) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L733) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L812) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L840) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L869) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L899) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L907) + +### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L39) + +- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L46) +- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L64) +- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L85) +- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L102) +- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L130) +- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) +- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L175) +- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L214) +- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L253) +- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L292) +- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L338) +- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L380) + +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) + +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) + +### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L31) + +- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L38) +- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L64) + +### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L40) + +- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L43) +- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L68) +- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L128) +- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L189) + +### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) + +- [set snippet more_set_headers in all locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L34) +- [drops snippet more_set_header in all locations if disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L73) + +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L28) + +- [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L35) + +### [upstream-vhost](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L27) + +- [set host to upstreamvhost.bar.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L34) + +### [x-forwarded-prefix](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L28) + +- [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) +- [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) + +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L32) + +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L39) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L68) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L113) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L160) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L192) + +### [service-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L32) + +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L41) +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L69) +- [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L97) + +### [server-alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L31) + +- [should return status code 200 for host 'foo' and 404 for 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L38) +- [should return status code 200 for host 'foo' and 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L64) +- [should return status code 200 for hosts defined in two ingresses, different path with one alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L89) + +### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L31) + +- [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L38) +- [should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L86) +- [should 302 redirect to error page instead of 400 when auth-tls-error-page is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L116) +- [should pass URL-encoded certificate to upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L163) +- [should validate auth-tls-verify-client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L208) +- [should return 403 using auth-tls-match-cn with no matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L267) +- [should return 200 using auth-tls-match-cn with matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L296) +- [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L325) + +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L) +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L45) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L89) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L120) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L174) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L232) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L289) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L363) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L445) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L513) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L594) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L647) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L692) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L741) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L790) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L862) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L910) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L952) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L995) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1070) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1104) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1138) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1175) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1242) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1310) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L) +### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L) +- [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L40) +- [should set cors methods to only allow POST, GET](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L67) +- [should set cors max-age](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L83) +- [should disable cors allow credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L99) +- [should allow origin for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L115) +- [should allow headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L142) +- [should expose headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L158) +- [should allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L174) +- [should not allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L201) +- [should allow correct origins - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L221) +- [should not break functionality](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L272) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L296) +- [should not break functionality with extra domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L319) +- [should not match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L343) +- [should allow - single origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L363) +- [should not allow - single origin with port and origin without port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L391) +- [should not allow - single origin without port and origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L410) +- [should allow - matching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L430) +- [should not allow - unmatching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L473) +- [should allow - matching origin+port with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L493) +- [should not allow - portless origin with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L520) +- [should allow correct origins - missing subdomain + origin with wildcard origin and correct origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L540) +- [should allow - missing origins (should allow all origins)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L576) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L) +### [custom-http-errors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L34) -- [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L34) -- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L49) -- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L64) -- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L79) -- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) -======= -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L) +- [configures Nginx correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L41) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L) +### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L) +- [add valid directives to server via server snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L35) +- [drops server snippet if disabled by the administrator](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L70) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L) +### [stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L34) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L) +- [should add value of stream-snippet to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L41) +- [should add stream-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L94) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L) +### [app-root](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L) +- [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L) +### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L) +- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L35) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L) +### [disable-access-log disable-http-access-log disable-stream-access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L) +- [disable-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L35) +- [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) +- [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L) +### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L) +- [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L) +### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L) +- [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L) +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L) +### [Annotation - limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L) +- [should limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L) +### [limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L) +- [Check limit-rate annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L37) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L) +### [enable-access-log enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L) +- [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L34) +- [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L49) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L) +### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L) +- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) +- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) +- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L) +### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L) +- [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L) +### [permanent-redirect permanent-redirect-code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L) +- [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L33) +- [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L61) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L) +### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L) +- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L40) +- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L82) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L) +### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L) +- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L) +### [proxy-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L) +- [should set proxy_redirect to off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L38) +- [should set proxy_redirect to default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L54) +- [should set proxy_redirect to hello.com goodbye.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L70) +- [should set proxy client-max-body-size to 8m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L87) +- [should not set proxy client-max-body-size to incorrect value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L102) +- [should set valid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L117) +- [should not set invalid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L138) +- [should turn on proxy-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L159) +- [should turn off proxy-request-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L181) +- [should build proxy next upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L196) +- [should setup proxy cookies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L217) +- [should change the default proxy HTTP version](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L235) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L) +### [upstream-hash-by-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L79) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L) +- [should connect to the same pod](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L86) +- [should connect to the same subset of pods](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L95) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L) +### [allowlist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipallowlist.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L) +- [should set valid ip allowlist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipallowlist.go#L34) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L) +### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L) +- [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) +- [should get information for a specific backend server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L56) +- [should produce valid JSON for /dbg general](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L85) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L) +### [[Default Backend] custom service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L) +- [uses custom default backend that returns 200 as status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L36) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L) +### [[Default Backend] SSL](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L26) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L) +- [should return a self generated SSL certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L29) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L) +### [[Default Backend] change default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L) +- [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L) +### [[Default Backend]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L) +- [should return 404 sending requests when only a default backend is running](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L33) +- [enables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L88) +- [disables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L105) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L) +### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L) +- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L) +### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L34) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L) +- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L42) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L) +### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L) +- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L40) +- [should shutdown after waiting 60 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L61) +- [should shutdown after waiting 150 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L106) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L) +### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L25) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L) +- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L33) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L) +### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L) +- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L) +### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L) +- [should drop whole ingress if one path matches invalid regex](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L34) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L) +### [[Ingress] [PathType] prefix checks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L) +- [should return 404 when prefix /aaa does not match request /aaaccc](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L35) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L) +### [[Ingress] definition without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L) +- [should set ingress details variables for ingresses without a host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L34) +- [should set ingress details variables for ingresses with host without IngressRuleValue, only Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L55) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L) +### [single ingress - multiple hosts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L) +- [should set the correct $service_name NGINX variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L) +### [[Ingress] [PathType] exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L) +- [should choose exact location for /exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L37) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L) +### [[Ingress] [PathType] mix Exact and Prefix paths](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L) +- [should choose the correct location](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L39) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L) +### [[Memory Leak] Dynamic Certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L) +- [should not leak memory from ingress SSL certificates or configuration updates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L42) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L) +### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L) +- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L37) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L) +### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L) +- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L43) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L) +### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L) +- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L39) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L) +### [[Lua] dynamic certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L37) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L) +- [picks up the certificate when we add TLS spec to existing ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L45) +- [picks up the previously missing secret for a given ingress without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L70) +- [supports requests with domain with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L145) +- [picks up the updated certificate without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L149) +- [falls back to using default certificate when secret gets deleted without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L185) +- [picks up a non-certificate only change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L218) +- [removes HTTPS configuration when we delete TLS spec](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L233) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L) +### [[Lua] dynamic configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L41) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L) +- [configures balancer Lua middleware correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L49) +- [handles endpoints only changes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L61) +- [handles endpoints only changes (down scaling of replicas)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L86) +- [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L124) +- [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L170) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L) +### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L) +- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) +- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L) +### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L) +- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) +- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L114) +- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L121) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L) +### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L) +- [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L) +### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L34) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L) +- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L37) +- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L55) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L) +### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L38) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L) +- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L41) +- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L78) +- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L118) +- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L148) +- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L184) +- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L225) +- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L261) +- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L344) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L) +### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L) +- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L) +### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L) +- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L) +### [reuse-port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L) +- [reuse port should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L38) +- [reuse port should be disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L44) +- [reuse port should be enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L52) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L) +### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L) +- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L38) +- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L50) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L) +### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L) +- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L40) +- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L48) +- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L58) +- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L68) +- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L78) +- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L88) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L) +### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L) +- [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L39) +- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L46) +- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L54) +- [should enable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L62) +- [should disable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L70) +- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L80) +- [log-format default escape](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L103) +- [log-format-escape-none enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L126) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L) +### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L) +- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) +- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) +- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L) +### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L39) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L) +- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L49) +- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L62) +- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L76) +- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L91) +- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L106) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L) +### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L52) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L) +- [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L62) +- [should exists opentracing directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L75) +- [should include opentracing_trust_incoming_span off directive when disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L89) +- [should not exists opentracing_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L104) +- [should exists opentracing_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L119) +- [should not exists opentracing_location_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L134) +- [should exists opentracing_location_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L149) +- [should enable opentracing using zipkin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L164) +- [should enable opentracing using jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L176) +- [should enable opentracing using jaeger with sampler host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L188) +- [should propagate the w3c header when configured with jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L201) +- [should enable opentracing using jaeger with an HTTP endpoint](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L232) +- [should enable opentracing using datadog](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L245) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) +### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L37) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L40) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) +### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/object.go#L) +- [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L65) +- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L109) +- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L125) +- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L144) +- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L164) +- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L186) +- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L204) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) +### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/response.go#L) +- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) +### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) +- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L37) +- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L53) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) +### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/reporter.go#L) +- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) +- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L78) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/chain.go#L) +### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L26) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/chain.go#L) +- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L29) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/cookie.go#L) +### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/cookie.go#L) +- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/match.go#L) +### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L41) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/match.go#L) +- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L70) +- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L106) +- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L134) +- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L166) +- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L194) +- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L259) +- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L325) +- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L414) +- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L482) +- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L538) +- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L628) +- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L648) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) +### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/array.go#L) +- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/string.go#L) +### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/string.go#L) +- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L35) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/value.go#L) +- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) +### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) +- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) +### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) +- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L62) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L30) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) +### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L38) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) +- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L48) +- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L85) +- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L121) +- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L164) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L37) +- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L53) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) +### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) +- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L37) +- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L53) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) +### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) +- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L36) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L75) +- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L119) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L157) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) +### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L36) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) +- [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L45) +- [should only allow requests from specific countries](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L69) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) +### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/ssl.go#L) +- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) +- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L65) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) +### [annotation validations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) +- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L33) +- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L68) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) +### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L31) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) +- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L41) +- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L93) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) +### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) +- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) +- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L37) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L) +### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L) +- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L39) +- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L47) +- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L57) +- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L65) +- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L75) +- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L83) +- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L93) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L) +### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L) +- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L45) +- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L65) +- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L93) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L) +### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L) +- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L) +### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L) +### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L) +- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) +- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L65) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L) +### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L) +- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) +- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L) +### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L) +- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L38) +- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) +- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L) +### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L) +- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) +- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) +- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) +- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) +- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) +- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L) +### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L) +- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L) +### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L) +- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L) +### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L) +- [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L31) +- [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L39) +- [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L49) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L) +### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L41) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L44) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L) +### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L28) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L) +- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L35) +- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L98) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L) +### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L) +- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L31) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L41) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L52) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L64) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L76) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L) +### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L) +- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L66) +- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L82) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L) +### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L) +- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L50) +- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L69) +- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) +- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L) +### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L) +- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L55) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L) +### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L) +- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) +- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L54) +- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L82) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L) +### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L39) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L) +- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L91) +- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L107) +- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L130) +- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L158) +- [should proxy_method method when global-auth-method is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L199) +- [should add custom error page when global-auth-signin url is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L211) +- [should add auth headers when global-auth-response-headers is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L223) +- [should set request-redirect when global-auth-request-redirect is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L236) +- [should set snippet when global external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L248) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L322) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L333) +- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L344) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L) +### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L) +- [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L) +### [[SSL] secret update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L33) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L) +- [should not appear references to secret updates not used in ingress rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L40) +- [should return the fake SSL certificate if the secret is invalid](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L83) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L) +### [[Status] status update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L38) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L) +- [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L43) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L) +### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L38) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L) - -<<<<<<< Updated upstream -- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) -======= -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L) ->>>>>>> Stashed changes - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L) +- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) +- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) diff --git a/hack/generate-e2e-suite-doc.sh b/hack/generate-e2e-suite-doc.sh index a4ccc8fc2..a63354c25 100755 --- a/hack/generate-e2e-suite-doc.sh +++ b/hack/generate-e2e-suite-doc.sh @@ -21,6 +21,12 @@ fi URL="https://github.com/kubernetes/ingress-nginx/tree/main/" DIR=$(cd $(dirname "${BASH_SOURCE}")/.. && pwd -P) +declare -A skip_files=( + ["$DIR/test/e2e/framework/framework.go"]=1 + ["$DIR/test/e2e/e2e.go"]=1 + ["$DIR/test/e2e/e2e_test.go"]=1 +) + echo " - -# e2e test suite for [Ingress NGINX Controller]($URL) - -" - -for FILE in $(find $DIR/test/e2e -name "*.go");do - # skip files - if [ ${skip_files[$FILE]} ]; then - continue - fi - - # describe definition - DESCRIBE=$(cat $FILE | grep -n -oP 'Describe.*') - if [ -z "$DESCRIBE" ]; then - continue - fi - # line number - DESCRIBE_LINE=$(echo $DESCRIBE | cut -f1 -d ':') - # clean describe, extracting the string - DESCRIBE=$(echo $DESCRIBE | sed -En 's/.*("|`)(.*)("|`).*/\2/p') - - FILE_URL=$(echo $FILE | sed "s|${DIR}/|${URL}|g") - echo " -### [$DESCRIBE]($FILE_URL#L$DESCRIBE_LINE) -" - - # extract Tests - ITS=$(cat $FILE | grep -n -oP 'It\(.*') - while IFS= read -r line; do - IT_LINE=$(echo $line | cut -f1 -d ':') - IT=$(echo $line | sed -En 's/.*("|`)(.*)("|`).*/\2/p') - echo "- [$IT]($FILE_URL#L$IT_LINE)" - done <<< "$ITS" -done diff --git a/magefiles/docker.go b/magefiles/docker.go deleted file mode 100644 index d7c7f588e..000000000 --- a/magefiles/docker.go +++ /dev/null @@ -1,19 +0,0 @@ -//go:build mage - -/* -Copyright 2023 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main diff --git a/magefiles/yaml.go b/magefiles/exec.go similarity index 84% rename from magefiles/yaml.go rename to magefiles/exec.go index d7c7f588e..0acd557c6 100644 --- a/magefiles/yaml.go +++ b/magefiles/exec.go @@ -1,4 +1,4 @@ -//go:build mage +//go:build ignore /* Copyright 2023 The Kubernetes Authors. @@ -17,3 +17,11 @@ limitations under the License. */ package main + +import ( + "os" + + "github.com/magefile/mage/mage" +) + +func main() { os.Exit(mage.Main()) } diff --git a/magefiles/go.go b/magefiles/go.go deleted file mode 100644 index 2385b089e..000000000 --- a/magefiles/go.go +++ /dev/null @@ -1,31 +0,0 @@ -//go:build mage - -/* -Copyright 2023 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package main - -//import ( -// "github.com/magefile/mage/mg" -// "github.com/mysteriumnetwork/go-ci/commands" -//) -// -//type Go mg.Namespace -// -//// Checks for issues with go imports -//func (Go) CheckGoImports() error { -// return commands.GoImports("./...") -//} diff --git a/magefiles/go.mod b/magefiles/go.mod index 051e88de7..ac05f6b89 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -1,4 +1,4 @@ -module github.com/kubernetes/ingress-nginx/magefiles +module k8s.io/ingress-nginx/magefiles go 1.21.1 @@ -6,27 +6,27 @@ require ( github.com/blang/semver/v4 v4.0.0 github.com/google/go-github/v48 v48.2.0 github.com/helm/helm v2.17.0+incompatible - github.com/magefile/mage v1.14.0 + github.com/magefile/mage v1.15.0 github.com/vmware-labs/yaml-jsonpath v0.3.2 - golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be + golang.org/x/oauth2 v0.12.0 gopkg.in/yaml.v3 v3.0.1 ) require ( - github.com/BurntSushi/toml v1.2.1 // indirect + github.com/BurntSushi/toml v1.3.2 // indirect github.com/Masterminds/semver v1.5.0 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/gobwas/glob v0.2.3 // indirect - github.com/golang/protobuf v1.5.2 // indirect + github.com/golang/protobuf v1.5.3 // indirect github.com/google/go-querystring v1.1.0 // indirect - github.com/stretchr/testify v1.8.1 // indirect - golang.org/x/crypto v0.1.0 // indirect - golang.org/x/net v0.7.0 // indirect + github.com/rogpeppe/go-internal v1.11.0 // indirect + golang.org/x/crypto v0.13.0 // indirect + golang.org/x/net v0.15.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/protobuf v1.28.0 // indirect + google.golang.org/protobuf v1.31.0 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - k8s.io/apimachinery v0.25.4 // indirect + k8s.io/apimachinery v0.27.4 // indirect k8s.io/helm v2.17.0+incompatible // indirect ) diff --git a/magefiles/go.sum b/magefiles/go.sum index 380e194e7..8cd8c9420 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -1,5 +1,5 @@ -github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak= -github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= +github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8= +github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww= github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y= github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= @@ -19,8 +19,8 @@ github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJA github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= -github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= @@ -34,65 +34,61 @@ github.com/helm/helm v2.17.0+incompatible/go.mod h1:ahXhuvluW4YnSL6W6hDVetZsVK8P github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= +github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= -github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= -github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo= -github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= +github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg= +github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94= github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= -github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q= -github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo= +github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E= +github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= +github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= -github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU= -golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= +golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= +golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be h1:vEDujvNQGv4jgYKudGeI/+DAX4Jffq6hpD55MmoEvKs= -golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= +golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8= +golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= +golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4= +golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= +golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= -golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= +golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw= -google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= +google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= @@ -106,7 +102,7 @@ gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/apimachinery v0.25.4 h1:CtXsuaitMESSu339tfhVXhQrPET+EiWnIY1rcurKnAc= -k8s.io/apimachinery v0.25.4/go.mod h1:jaF9C/iPNM1FuLl7Zuy5b9v+n35HGSh6AQ4HYRkCqwo= +k8s.io/apimachinery v0.27.4 h1:CdxflD4AF61yewuid0fLl6bM4a3q04jWel0IlP+aYjs= +k8s.io/apimachinery v0.27.4/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= k8s.io/helm v2.17.0+incompatible h1:Bpn6o1wKLYqKM3+Osh8e+1/K2g/GsQJ4F4yNF2+deao= k8s.io/helm v2.17.0+incompatible/go.mod h1:LZzlS4LQBHfciFOurYBFkCMTaZ0D1l+p0teMg7TSULI= diff --git a/magefiles/mage.go b/magefiles/mage.go index ef54ee0f7..1dfaa4dbd 100644 --- a/magefiles/mage.go +++ b/magefiles/mage.go @@ -1,8 +1,7 @@ -//go:build ignore -// +build ignore +//go:build mage /* -Copyright 2021 The Kubernetes Authors. +Copyright 2023 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. @@ -20,11 +19,6 @@ limitations under the License. package main import ( - "os" - - "github.com/magefile/mage/mage" + //mage:import + _ "k8s.io/ingress-nginx/magefiles/steps" ) - -func main() { - os.Exit(mage.Main()) -} diff --git a/magefiles/steps/helm.go b/magefiles/steps/helm.go new file mode 100644 index 000000000..b4cdc6d81 --- /dev/null +++ b/magefiles/steps/helm.go @@ -0,0 +1,187 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package steps + +import ( + "bytes" + "fmt" + "os" + + semver "github.com/blang/semver/v4" + "github.com/helm/helm/pkg/chartutil" + "github.com/magefile/mage/mg" + "github.com/magefile/mage/sh" + yamlpath "github.com/vmware-labs/yaml-jsonpath/pkg/yamlpath" + "gopkg.in/yaml.v3" + + utils "k8s.io/ingress-nginx/magefiles/utils" +) + +const ( + HelmChartPath = "charts/ingress-nginx/Chart.yaml" + HelmChartValues = "charts/ingress-nginx/values.yaml" +) + +type Helm mg.Namespace + +// UpdateVersion Update Helm Version of the Chart +func (Helm) UpdateVersion(version string) { + updateVersion(version) +} + +func currentChartVersion() string { + chart, err := chartutil.LoadChartfile(HelmChartPath) + utils.CheckIfError(err, "HELM Could not Load Chart") + return chart.Version +} + +func updateVersion(version string) { + utils.Info("HELM Reading File %v", HelmChartPath) + + chart, err := chartutil.LoadChartfile(HelmChartPath) + utils.CheckIfError(err, "HELM Could not Load Chart") + + // Get the current tag + // appVersionV, err := getIngressNGINXVersion() + // utils.CheckIfError(err, "HELM Issue Retrieving the Current Ingress Nginx Version") + + // remove the v from TAG + appVersion := version + + utils.Info("HELM Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) + if appVersion == chart.AppVersion { + utils.Warning("HELM Ingress NGINX Version didnt change Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) + return + } + + controllerSemVer, err := semver.Parse(version) + utils.CheckIfError(err, "error parsing semver of new app") + isPreRelease := len(controllerSemVer.Pre) > 0 + oldControllerSemVer, err := semver.Parse(chart.AppVersion) + utils.CheckIfError(err, "error parsing semver of old chart") + isBreakingChange := controllerSemVer.Major > oldControllerSemVer.Major || controllerSemVer.Minor > oldControllerSemVer.Minor + + // Update the helm chart + chart.AppVersion = appVersion + cTag, err := semver.Make(chart.Version) + utils.CheckIfError(err, "HELM Creating Chart Version: %v", err) + + incrFunc := cTag.IncrementPatch + if isBreakingChange { + cTag.Patch = 0 + incrFunc = cTag.IncrementMinor + + } + + if isPreRelease { + chart.Annotations["artifacthub.io/prerelease"] = "true" + cTag.Pre = controllerSemVer.Pre + } + + if err = incrFunc(); err != nil { + utils.ErrorF("HELM Incrementing Chart Version: %v", err) + os.Exit(1) + } + chart.Version = cTag.String() + utils.Debug("HELM Updated Chart Version: %v", chart.Version) + + err = chartutil.SaveChartfile(HelmChartPath, chart) + utils.CheckIfError(err, "HELM Saving new Chart") +} + +func updateChartReleaseNotes(releasesNotes []string) { + utils.Info("HELM Updating the Chart Release notes") + chart, err := chartutil.LoadChartfile(HelmChartPath) + utils.CheckIfError(err, "HELM Could not Load Chart to update release notes %s", HelmChartPath) + var releaseNoteString string + for i := range releasesNotes { + releaseNoteString = fmt.Sprintf("%s - \"%s\"\n", releaseNoteString, releasesNotes[i]) + } + utils.Info("HELM Release note string %s", releaseNoteString) + chart.Annotations["artifacthub.io/changes"] = releaseNoteString + err = chartutil.SaveChartfile(HelmChartPath, chart) + utils.CheckIfError(err, "HELM Saving updated release notes for Chart") +} + +// UpdateChartValue Updates the Helm ChartValue +func (Helm) UpdateChartValue(key, value string) { + updateChartValue(key, value) +} + +func updateChartValue(key, value string) { + utils.Info("HELM Updating Chart %s %s:%s", HelmChartValues, key, value) + + // read current values.yaml + data, err := os.ReadFile(HelmChartValues) + utils.CheckIfError(err, "HELM Could not Load Helm Chart Values files %s", HelmChartValues) + + // var valuesStruct IngressChartValue + var n yaml.Node + utils.CheckIfError(yaml.Unmarshal(data, &n), "HELM Could not Unmarshal %s", HelmChartValues) + + // update value + // keyParse := parsePath(key) + p, err := yamlpath.NewPath(key) + utils.CheckIfError(err, "HELM cannot create path") + + q, err := p.Find(&n) + utils.CheckIfError(err, "HELM unexpected error finding path") + + for _, i := range q { + utils.Info("HELM Found %s at %s", i.Value, key) + i.Value = value + utils.Info("HELM Updated %s at %s", i.Value, key) + } + + //// write to file + var b bytes.Buffer + yamlEncoder := yaml.NewEncoder(&b) + yamlEncoder.SetIndent(2) + err = yamlEncoder.Encode(&n) + utils.CheckIfError(err, "HELM Could not Marshal new Values file") + err = os.WriteFile(HelmChartValues, b.Bytes(), 0o644) + utils.CheckIfError(err, "HELM Could not write new Values file to %s", HelmChartValues) + + utils.Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) +} + +func (Helm) Helmdocs() error { + return runHelmDocs() +} + +func runHelmDocs() error { + err := installHelmDocs() + if err != nil { + return err + } + err = sh.RunV("helm-docs", "--chart-search-root=${PWD}/charts") + if err != nil { + return err + } + return nil +} + +func installHelmDocs() error { + utils.Info("HELM Install HelmDocs") + g0 := sh.RunCmd("go") + + err := g0("install", "github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0") + if err != nil { + return err + } + return nil +} diff --git a/magefiles/release.go b/magefiles/steps/release.go similarity index 50% rename from magefiles/release.go rename to magefiles/steps/release.go index e6dc6401d..1ed09850f 100644 --- a/magefiles/release.go +++ b/magefiles/steps/release.go @@ -1,5 +1,3 @@ -//go:build mage - /* Copyright 2023 The Kubernetes Authors. @@ -16,26 +14,23 @@ See the License for the specific language governing permissions and limitations under the License. */ -package main +package steps import ( "context" "errors" "fmt" - "io" - "net" - "net/http" "os" "regexp" "strings" - "text/template" - "time" "github.com/google/go-github/v48/github" "github.com/magefile/mage/mg" "github.com/magefile/mage/sh" "golang.org/x/oauth2" "gopkg.in/yaml.v3" + + utils "k8s.io/ingress-nginx/magefiles/utils" ) type Release mg.Namespace @@ -62,55 +57,28 @@ const ( CHANGELOG = "Changelog.md" // Name of the changelog ) -// ControllerImage - struct with info about controllers -type ControllerImage struct { - Tag string - Digest string - Registry string - Name string -} - -// IngressRelease All the information about an ingress-nginx release that gets updated -type IngressRelease struct { - ControllerVersion string - ControllerImage ControllerImage - ReleaseNote ReleaseNote - Release *github.RepositoryRelease -} - -// ReleaseNote - All the pieces of information/documents that get updated during a release -type ReleaseNote struct { - Version string - NewControllerVersion string - PreviousControllerVersion string - ControllerImages []ControllerImage - DepUpdates []string - Updates []string - HelmUpdates []string - NewHelmChartVersion string - PreviousHelmChartVersion string -} - -// IMAGES_YAML returns this data structure -type ImageYamls []ImageElement - -// ImageElement - a specific image and it's data structure the dmap is a list of shas and container versions -type ImageElement struct { - Name string `json:"name"` - Dmap map[string][]string `json:"dmap"` -} - // init will set the GitHub token from the committers/releasers env var func init() { GITHUB_TOKEN = os.Getenv("GITHUB_TOKEN") } -// PromoteImage Creates PR into the k8s.io repo for promotion of ingress from staging to production -func (Release) PromoteImage(version, sha string) { -} - // Release Create a new release of ingress nginx controller func (Release) NewRelease(version string) { + newRelease(version, "") +} + +func (Release) NewReleaseFromOld(version, oldversion string) { + newRelease(version, oldversion) +} + +func (Release) E2EDocs() { + e2edocs, err := utils.GenerateE2EDocs() + utils.CheckIfError(err, "error on template") + err = os.WriteFile("docs/e2e-tests.md", []byte(e2edocs), 644) + utils.CheckIfError(err, "Could not write new e2e test file ") +} + +func newRelease(version, oldversion string) { // newRelease := Release{} // update ingress-nginx version @@ -119,12 +87,12 @@ func (Release) NewRelease(version string) { // mg.Deps(mg.F(Tag.BumpNginx, version)) tag, err := getIngressNGINXVersion() - CheckIfError(err, "RELEASE Retrieving the current Ingress Nginx Version") + utils.CheckIfError(err, "RELEASE Retrieving the current Ingress Nginx Version") - Info("RELEASE Checking Current Version %s to New Version %s", tag, version) + utils.Info("RELEASE Checking Current Version %s to New Version %s", tag, version) // if the version were upgrading does not match the TAG file, lets update the TAG file if tag[1:] != version { - Warning("RELEASE Ingress Nginx TAG %s and new version %s do not match", tag, version) + utils.Warning("RELEASE Ingress Nginx TAG %s and new version %s do not match", tag, version) mg.Deps(mg.F(Tag.BumpNginx, fmt.Sprintf("v%s", version))) } @@ -132,25 +100,25 @@ func (Release) NewRelease(version string) { mg.Deps(mg.F(Tag.NewControllerTag, version)) // make release notes - releaseNotes, err := makeReleaseNotes(version) - CheckIfError(err, "RELEASE Creating Release Notes for version %s", version) - Info("RELEASE Release Notes %s completed", releaseNotes.Version) + releaseNotes, err := makeReleaseNotes(version, oldversion) + utils.CheckIfError(err, "RELEASE Creating Release Notes for version %s", version) + utils.Info("RELEASE Release Notes %s completed", releaseNotes.Version) // update chart values.yaml new controller tag and image digest releaseNotes.PreviousHelmChartVersion = currentChartVersion() // controller tag updateChartValue("controller.image.tag", fmt.Sprintf("v%s", releaseNotes.Version)) - Debug("releaseNotes.ControllerImages[0].Name %s", releaseNotes.ControllerImages[0].Name) - Debug("releaseNotes.ControllerImages[1].Name %s", releaseNotes.ControllerImages[1].Name) + utils.Debug("releaseNotes.ControllerImages[0].Name %s", releaseNotes.ControllerImages[0].Name) + utils.Debug("releaseNotes.ControllerImages[1].Name %s", releaseNotes.ControllerImages[1].Name) // controller digest if releaseNotes.ControllerImages[0].Name == "ingress-nginx/controller" { - Debug("Updating Chart Value %s with %s", "controller.image.digest", releaseNotes.ControllerImages[0].Digest) + utils.Debug("Updating Chart Value %s with %s", "controller.image.digest", releaseNotes.ControllerImages[0].Digest) updateChartValue("controller.image.digest", releaseNotes.ControllerImages[0].Digest) } // controller chroot digest if releaseNotes.ControllerImages[1].Name == "ingress-nginx/controller-chroot" { - Debug("Updating Chart Value %s with %s", "controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) + utils.Debug("Updating Chart Value %s with %s", "controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) updateChartValue("controller.image.digestChroot", releaseNotes.ControllerImages[1].Digest) } @@ -163,18 +131,18 @@ func (Release) NewRelease(version string) { updateChartReleaseNotes(releaseNotes.HelmUpdates) // Run helm docs update - CheckIfError(runHelmDocs(), "Error Updating Helm Docs ") + utils.CheckIfError(runHelmDocs(), "Error Updating Helm Docs ") - releaseNotes.helmTemplate() + releaseNotes.HelmTemplate() // update static manifest - CheckIfError(updateStaticManifest(), "Error Updating Static manifests") + utils.CheckIfError(updateStaticManifest(), "Error Updating Static manifests") ////update e2e docs - updateE2EDocs() + mg.Deps(mg.F(Release.E2EDocs)) // update documentation with ingress-nginx version - CheckIfError(updateIndexMD(releaseNotes.PreviousControllerVersion, releaseNotes.NewControllerVersion), "Error Updating %s", INDEX_DOCS) + utils.CheckIfError(updateIndexMD(releaseNotes.PreviousControllerVersion, releaseNotes.NewControllerVersion), "Error Updating %s", INDEX_DOCS) // keeping these manual for now // git commit TODO @@ -185,30 +153,22 @@ func (Release) NewRelease(version string) { // the index.md doc needs the controller version updated func updateIndexMD(old, new string) error { - Info("Updating Deploy docs with new version") + utils.Info("Updating Deploy docs with new version") data, err := os.ReadFile(INDEX_DOCS) - CheckIfError(err, "Could not read INDEX_DOCS file %s", INDEX_DOCS) + utils.CheckIfError(err, "Could not read INDEX_DOCS file %s", INDEX_DOCS) datString := string(data) datString = strings.Replace(datString, old, new, -1) err = os.WriteFile(INDEX_DOCS, []byte(datString), 644) if err != nil { - ErrorF("Could not write new %s %s", INDEX_DOCS, err) + utils.ErrorF("Could not write new %s %s", INDEX_DOCS, err) return err } return nil } -// runs the hack/generate-deploy-scripts.sh -func updateE2EDocs() { - updates, err := sh.Output("./hack/generate-e2e-suite-doc.sh") - CheckIfError(err, "Could not run update hack script") - err = os.WriteFile("docs/e2e-tests.md", []byte(updates), 644) - CheckIfError(err, "Could not write new e2e test file ") -} - // The static deploy scripts use kustomize to generate them, this function ensures kustomize is installed func installKustomize() error { - Info("Install Kustomize") + utils.Info("Install Kustomize") g0 := sh.RunCmd("go") // somewhere in your main code err := g0("install", KUSTOMIZE_INSTALL_VERSION) @@ -219,7 +179,7 @@ func installKustomize() error { } func updateStaticManifest() error { - CheckIfError(installKustomize(), "error installing kustomize") + utils.CheckIfError(installKustomize(), "error installing kustomize") // hack/generate-deploy-scripts.sh err := sh.RunV("./hack/generate-deploy-scripts.sh") if err != nil { @@ -231,10 +191,10 @@ func updateStaticManifest() error { //// CreateRelease Creates a new GitHub Release //func (Release) CreateRelease(name string) { // releaser, err := gh_release.NewReleaser(INGRESS_ORG, INGRESS_REPO, GITHUB_TOKEN) -// CheckIfError(err, "GitHub Release Client error") +// utils.CheckIfError(err, "GitHub Release Client error") // newRelease, err := releaser.Create(fmt.Sprintf("controller-%s", name)) -// CheckIfError(err, "Create release error") -// Info("New Release: Tag %v, ID: %v", newRelease.TagName, newRelease.ID) +// utils.CheckIfError(err, "Create release error") +// utils.Info("New Release: Tag %v, ID: %v", newRelease.TagName, newRelease.ID) //} // Returns a GitHub client ready for use @@ -248,34 +208,44 @@ func githubClient() *github.Client { // LatestCommitLogs Retrieves the commit log between the latest two controller versions. func (Release) LatestCommitLogs() { - commitLog := commitsBetweenTags() + commitLog := commitsBetweenTags("", "") for i, s := range commitLog { - Info("#%v Version %v", i, s) + utils.Info("#%v Version %v", i, s) } } -func commitsBetweenTags() []string { +func commitsBetweenTags(newversion, oldversion string) []string { + + var newTag, oldTag string tags := getAllControllerTags() - Info("Getting Commits between %v and %v", tags[0], tags[1]) - commitLog, err := git("log", "--full-history", "--pretty", "--oneline", fmt.Sprintf("%v..%v", tags[1], tags[0])) + newTag, oldTag = tags[0], tags[1] + if newversion != "" { + newTag = newversion + } + if oldversion != "" { + oldTag = oldversion + } + + utils.Info("Getting Commits between %v and %v", newTag, oldTag) + commitLog, err := git("log", "--full-history", "--pretty", "--oneline", fmt.Sprintf("%v..%v", oldTag, newTag)) if commitLog == "" { - Warning("All Controller Tags is empty") + utils.Warning("All Controller Tags is empty") } - CheckIfError(err, "Retrieving Commit log") + utils.CheckIfError(err, "Retrieving Commit log") return strings.Split(commitLog, "\n") } // Generate Release Notes func (Release) ReleaseNotes(newVersion string) error { - notes, err := makeReleaseNotes(newVersion) - CheckIfError(err, "Creating Release Notes for version %s", newVersion) - Info("Release Notes %s completed", notes.Version) + notes, err := makeReleaseNotes(newVersion, "") + utils.CheckIfError(err, "Creating Release Notes for version %s", newVersion) + utils.Info("Release Notes %s completed", notes.Version) return nil } -func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { - newReleaseNotes := ReleaseNote{} +func makeReleaseNotes(newVersion, oldVersion string) (*utils.ReleaseNote, error) { + newReleaseNotes := utils.ReleaseNote{} newReleaseNotes.Version = newVersion allControllerTags := getAllControllerTags() @@ -290,10 +260,13 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { } // previous version newReleaseNotes.PreviousControllerVersion = allControllerTags[1] + if oldVersion != "" { + newReleaseNotes.PreviousControllerVersion = oldVersion + } - Info("New Version: %s Old Version: %s", newReleaseNotes.NewControllerVersion, newReleaseNotes.PreviousControllerVersion) + utils.Info("New Version: %s Old Version: %s", newReleaseNotes.NewControllerVersion, newReleaseNotes.PreviousControllerVersion) - commits := commitsBetweenTags() + commits := commitsBetweenTags(newReleaseNotes.NewControllerVersion, newReleaseNotes.PreviousControllerVersion) // dependency_updates // all_updates @@ -308,11 +281,11 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { if prRegex.Match([]byte(s)) { // matches a dependant bot update if depBot.Match([]byte(s)) { // - Debug("#%v DEPENDABOT %v", i, s) + utils.Debug("#%v DEPENDABOT %v", i, s) u := strings.SplitN(s, " ", 2) depUpdates = append(depUpdates, u[1]) } else { // add it to the all updates slice - Debug("#%v ALL UPDATES %v", i, s) + utils.Debug("#%v ALL UPDATES %v", i, s) u := strings.SplitN(s, " ", 2) allUpdates = append(allUpdates, u[1]) @@ -331,44 +304,44 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { newReleaseNotes.HelmUpdates = helmUpdates // controller_image_digests - imagesYaml, err := downloadFile(IMAGES_YAML) + imagesYaml, err := utils.DownloadFile(IMAGES_YAML) if err != nil { - ErrorF("Could not download file %s : %s", IMAGES_YAML, err) + utils.ErrorF("Could not download file %s : %s", IMAGES_YAML, err) return nil, err } - Debug("%s", imagesYaml) + utils.Debug("%s", imagesYaml) - data := ImageYamls{} + data := utils.ImageYamls{} err = yaml.Unmarshal([]byte(imagesYaml), &data) if err != nil { - ErrorF("Could not unmarshal images yaml %s", err) + utils.ErrorF("Could not unmarshal images yaml %s", err) return nil, err } // controller - controllerDigest := findImageDigest(data, "controller", newVersion) + controllerDigest := utils.FindImageDigest(data, "controller", newVersion) if len(controllerDigest) == 0 { - ErrorF("Controller Digest could not be found") + utils.ErrorF("Controller Digest could not be found") return nil, errors.New("Controller digest could not be found") } - controllerChrootDigest := findImageDigest(data, "controller-chroot", newVersion) + controllerChrootDigest := utils.FindImageDigest(data, "controller-chroot", newVersion) if len(controllerChrootDigest) == 0 { - ErrorF("Controller Chroot Digest could not be found") + utils.ErrorF("Controller Chroot Digest could not be found") return nil, errors.New("Controller Chroot digest could not be found") } - Debug("Latest Controller Digest %v", controllerDigest) - Debug("Latest Controller Chroot Digest %v", controllerChrootDigest) - c1 := ControllerImage{ + utils.Debug("Latest Controller Digest %v", controllerDigest) + utils.Debug("Latest Controller Chroot Digest %v", controllerChrootDigest) + c1 := utils.ControllerImage{ Digest: controllerDigest, Registry: INGRESS_REGISTRY, Name: "ingress-nginx/controller", Tag: fmt.Sprintf("v%s", newReleaseNotes.Version), } - c2 := ControllerImage{ + c2 := utils.ControllerImage{ Digest: controllerChrootDigest, Registry: INGRESS_REGISTRY, Name: "ingress-nginx/controller-chroot", @@ -377,141 +350,37 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c1) newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c2) - Debug("New Release Controller Images %s %s", newReleaseNotes.ControllerImages[0].Digest, newReleaseNotes.ControllerImages[1].Digest) + utils.Debug("New Release Controller Images %s %s", newReleaseNotes.ControllerImages[0].Digest, newReleaseNotes.ControllerImages[1].Digest) - if DEBUG { - newReleaseNotes.printRelease() + if utils.DEBUG { + newReleaseNotes.PrintRelease() } // write it all out to the changelog file - newReleaseNotes.template() + newReleaseNotes.Template() return &newReleaseNotes, nil } -func (i ControllerImage) print() string { - return fmt.Sprintf("%s/%s:%s@%s", i.Registry, i.Name, i.Tag, i.Digest) -} - -func (r ReleaseNote) template() { - // Files are provided as a slice of strings. - changelogTemplate, err := os.ReadFile("Changelog.md.gotmpl") - if err != nil { - ErrorF("Could not read changelog template file %s", err) - } - Debug("ChangeLog Templates %s", string(changelogTemplate)) - t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) - // create a new file - file, err := os.Create(fmt.Sprintf("changelog/Changelog-%s.md", r.Version)) - if err != nil { - ErrorF("Could not create changelog file %s", err) - } - defer file.Close() - - err = t.Execute(file, r) - if err != nil { - ErrorF("executing template:", err) - } -} - -func (r ReleaseNote) helmTemplate() { - // Files are provided as a slice of strings. - changelogTemplate, err := os.ReadFile("charts/ingress-nginx/changelog.md.gotmpl") - if err != nil { - ErrorF("Could not read changelog template file %s", err) - } - Debug("ChangeLog Templates %s", string(changelogTemplate)) - t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) - // create a new file - file, err := os.Create(fmt.Sprintf("charts/ingress-nginx/changelog/Changelog-%s.md", r.NewHelmChartVersion)) - if err != nil { - ErrorF("Could not create changelog file %s", err) - } - defer file.Close() - - err = t.Execute(file, r) - if err != nil { - ErrorF("executing template:", err) - } -} - -func (r ReleaseNote) printRelease() { - Info("Release Version: %v", r.NewControllerVersion) - Info("Previous Version: %v", r.PreviousControllerVersion) - Info("Controller Image: %v", r.ControllerImages[0].print()) - Info("Controller Chroot Image: %v", r.ControllerImages[1].print()) - for i := range r.Updates { - Info("Update #%v - %v", i, r.Updates[i]) - } - for j := range r.DepUpdates { - Info("Dependabot Update #%v - %v", j, r.DepUpdates[j]) - } -} - -func findImageDigest(yaml ImageYamls, image, version string) string { - version = fmt.Sprintf("v%s", version) - Info("Searching Digest for %s:%s", image, version) - for i := range yaml { - if yaml[i].Name == image { - for k, v := range yaml[i].Dmap { - if v[0] == version { - return k - } - } - return "" - } - } - return "" -} - -func downloadFile(url string) (string, error) { - client := &http.Client{ - Transport: &http.Transport{ - DialContext: (&net.Dialer{ - Timeout: 5 * time.Second, - KeepAlive: 5 * time.Second, - }).DialContext, - TLSHandshakeTimeout: 5 * time.Second, - ResponseHeaderTimeout: 5 * time.Second, - ExpectContinueTimeout: 1 * time.Second, - MaxIdleConnsPerHost: -1, - }, - } - resp, err := client.Get(url) - if err != nil { - return "", nil - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - return "", errors.New(fmt.Sprintf("Could not retrieve file, response from server %s for file %s", resp.StatusCode, url)) - } - bodyBytes, err := io.ReadAll(resp.Body) - if err != nil { - return "", nil - } - return string(bodyBytes), nil -} - // Latest returns latest Github Release func (Release) Latest() error { r, _, err := latestRelease() if err != nil { - ErrorF("Latest Release error %s", err) + utils.ErrorF("Latest Release error %s", err) return err } - Info("Latest Release %v", r.String()) + utils.Info("Latest Release %v", r.String()) return nil } func (Release) ReleaseByTag(tag string) error { r, _, err := releaseByTag(tag) if err != nil { - ErrorF("Release retrieve tag error %s", tag, err) + utils.ErrorF("Release retrieve tag %s error %s", tag, err) return err } - Info("Latest Release %v", r.String()) + utils.Info("Latest Release %v", r.String()) return nil } @@ -525,31 +394,3 @@ func latestRelease() (*github.RepositoryRelease, *github.Response, error) { ghClient := githubClient() return ghClient.Repositories.GetLatestRelease(ctx, INGRESS_ORG, INGRESS_REPO) } - -// Copy Test function to copy a release -func (Release) Copy() error { - ghClient := githubClient() - kRelease, _, err := ghClient.Repositories.GetLatestRelease(ctx, "kubernetes", "ingress-nginx") - if err != nil { - ErrorF("Get Release from kubernetes %s", err) - return err - } - - sRelease := &github.RepositoryRelease{ - TagName: kRelease.TagName, - Name: kRelease.Name, - Body: kRelease.Body, - Draft: kRelease.Draft, - Prerelease: kRelease.GenerateReleaseNotes, - DiscussionCategoryName: kRelease.DiscussionCategoryName, - GenerateReleaseNotes: kRelease.GenerateReleaseNotes, - } - - sRelease, _, err = ghClient.Repositories.CreateRelease(ctx, "strongjz", "ingress-nginx", sRelease) - if err != nil { - ErrorF("Creating Strongjz release %s", err) - return err - } - Info("Copied over Kubernetes Release %v to Strongjz %v", &kRelease.Name, &sRelease.Name) - return nil -} diff --git a/magefiles/tags.go b/magefiles/steps/tags.go similarity index 67% rename from magefiles/tags.go rename to magefiles/steps/tags.go index ca02c2cc3..e3c811f8c 100644 --- a/magefiles/tags.go +++ b/magefiles/steps/tags.go @@ -1,5 +1,3 @@ -//go:build mage - /* Copyright 2023 The Kubernetes Authors. @@ -16,7 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package main +package steps import ( "fmt" @@ -26,6 +24,8 @@ import ( semver "github.com/blang/semver/v4" "github.com/magefile/mage/mg" "github.com/magefile/mage/sh" + + utils "k8s.io/ingress-nginx/magefiles/utils" ) type Tag mg.Namespace @@ -35,13 +35,13 @@ var git = sh.OutCmd("git") // Nginx returns the ingress-nginx current version func (Tag) Nginx() { tag, err := getIngressNGINXVersion() - CheckIfError(err, "") + utils.CheckIfError(err, "") fmt.Printf("%v", tag) } func getIngressNGINXVersion() (string, error) { dat, err := os.ReadFile("TAG") - CheckIfError(err, "Could not read TAG file") + utils.CheckIfError(err, "Could not read TAG file") datString := string(dat) // remove newline datString = strings.Replace(datString, "\n", "", -1) @@ -49,21 +49,21 @@ func getIngressNGINXVersion() (string, error) { } func checkSemVer(currentVersion, newVersion string) bool { - Info("Checking Sem Ver between current %s and new %s", currentVersion, newVersion) + utils.Info("Checking Sem Ver between current %s and new %s", currentVersion, newVersion) cVersion, err := semver.Make(currentVersion[1:]) if err != nil { - ErrorF("TAG Error Current Tag %v Making Semver : %v", currentVersion[1:], err) + utils.ErrorF("TAG Error Current Tag %v Making Semver : %v", currentVersion[1:], err) return false } nVersion, err := semver.Make(newVersion) if err != nil { - ErrorF("TAG %v Error Making Semver %v \n", newVersion, err) + utils.ErrorF("TAG %v Error Making Semver %v \n", newVersion, err) return false } err = nVersion.Validate() if err != nil { - ErrorF("TAG %v not a valid Semver %v \n", newVersion, err) + utils.ErrorF("TAG %v not a valid Semver %v \n", newVersion, err) return false } @@ -71,10 +71,10 @@ func checkSemVer(currentVersion, newVersion string) bool { //0 if newVersion == currentVersion //-1 if newVersion < currentVersion //+1 if newVersion > currentVersion. - Info("TAG Comparing Old %s to New %s", cVersion.String(), nVersion.String()) + utils.Info("TAG Comparing Old %s to New %s", cVersion.String(), nVersion.String()) comp := nVersion.Compare(cVersion) if comp <= 0 { - Warning("SemVer:%v is not an update\n", newVersion) + utils.Warning("SemVer:%v is not an update\n", newVersion) return false } return true @@ -82,29 +82,29 @@ func checkSemVer(currentVersion, newVersion string) bool { // BumpNginx will update the nginx TAG func (Tag) BumpNginx(newTag string) { - Info("TAG BumpNginx version %v", newTag) + utils.Info("TAG BumpNginx version %v", newTag) currentTag, err := getIngressNGINXVersion() - CheckIfError(err, "Getting Ingress-nginx Version") + utils.CheckIfError(err, "Getting Ingress-nginx Version") bump(currentTag, newTag) } func bump(currentTag, newTag string) { // check if semver is valid if !checkSemVer(currentTag, newTag) { - ErrorF("ERROR: Semver is not valid %v", newTag) + utils.ErrorF("ERROR: Semver is not valid %v", newTag) os.Exit(1) } - Info("Updating Tag %v to %v", currentTag, newTag) + utils.Info("Updating Tag %v to %v", currentTag, newTag) err := os.WriteFile("TAG", []byte(newTag), 0o666) - CheckIfError(err, "Error Writing New Tag File") + utils.CheckIfError(err, "Error Writing New Tag File") } // Git Returns the latest git tag func (Tag) Git() { tag, err := getGitTag() - CheckIfError(err, "Retrieving Git Tag") - Info("Git tag: %v", tag) + utils.CheckIfError(err, "Retrieving Git Tag") + utils.Info("Git tag: %v", tag) } func getGitTag() (string, error) { @@ -113,10 +113,10 @@ func getGitTag() (string, error) { // ControllerTag Creates a new Git Tag for the ingress controller func (Tag) NewControllerTag(version string) { - Info("Create Ingress Nginx Controller Tag v%s", version) + utils.Info("Create Ingress Nginx Controller Tag v%s", version) tag, err := controllerTag(version) - CheckIfError(err, "Creating git tag") - Debug("Git Tag: %s", tag) + utils.CheckIfError(err, "Creating git tag") + utils.Debug("Git Tag: %s", tag) } func controllerTag(version string) (string, error) { @@ -126,22 +126,22 @@ func controllerTag(version string) (string, error) { func (Tag) AllControllerTags() { tags := getAllControllerTags() for i, s := range tags { - Info("#%v Version %v", i, s) + utils.Info("#%v Version %v", i, s) } } func getAllControllerTags() []string { allControllerTags, err := git("tag", "-l", "--sort=-v:refname", "controller-v*") - CheckIfError(err, "Retrieving git tags") + utils.CheckIfError(err, "Retrieving git tags") if !sh.CmdRan(err) { - Warning("Issue Running Command") + utils.Warning("Issue Running Command") } if allControllerTags == "" { - Warning("All Controller Tags is empty") + utils.Warning("All Controller Tags is empty") } - Debug("Controller Tags: %v", allControllerTags) + utils.Debug("Controller Tags: %v", allControllerTags) temp := strings.Split(allControllerTags, "\n") - Debug("There are %v controller tags", len(temp)) + utils.Debug("There are %v controller tags", len(temp)) return temp } diff --git a/magefiles/common.go b/magefiles/utils/common.go similarity index 73% rename from magefiles/common.go rename to magefiles/utils/common.go index c5c33f989..19cad7bba 100644 --- a/magefiles/common.go +++ b/magefiles/utils/common.go @@ -1,5 +1,3 @@ -//go:build mage - /* Copyright 2023 The Kubernetes Authors. @@ -16,10 +14,14 @@ See the License for the specific language governing permissions and limitations under the License. */ -package main +package utils import ( + "errors" "fmt" + "io" + "net" + "net/http" "os" "strings" "time" @@ -80,3 +82,32 @@ func Debug(format string, args ...interface{}) { func ErrorF(format string, args ...interface{}) { fmt.Printf("\x1b[31;1m%s ERROR: %s\x1b[0m\n", timeStamp(), fmt.Sprintf(format, args...)) } + +func DownloadFile(url string) (string, error) { + client := &http.Client{ + Transport: &http.Transport{ + DialContext: (&net.Dialer{ + Timeout: 5 * time.Second, + KeepAlive: 5 * time.Second, + }).DialContext, + TLSHandshakeTimeout: 5 * time.Second, + ResponseHeaderTimeout: 5 * time.Second, + ExpectContinueTimeout: 1 * time.Second, + MaxIdleConnsPerHost: -1, + }, + } + resp, err := client.Get(url) + if err != nil { + return "", nil + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return "", errors.New(fmt.Sprintf("could not retrieve file, response from server %d for file %s", resp.StatusCode, url)) + } + bodyBytes, err := io.ReadAll(resp.Body) + if err != nil { + return "", nil + } + return string(bodyBytes), nil +} diff --git a/magefiles/utils/controller.go b/magefiles/utils/controller.go new file mode 100644 index 000000000..c8e250a36 --- /dev/null +++ b/magefiles/utils/controller.go @@ -0,0 +1,68 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package utils + +import ( + "fmt" + + "github.com/google/go-github/v48/github" +) + +// ControllerImage - struct with info about controllers +type ControllerImage struct { + Tag string + Digest string + Registry string + Name string +} + +// IngressRelease All the information about an ingress-nginx release that gets updated +type IngressRelease struct { + ControllerVersion string + ControllerImage ControllerImage + ReleaseNote ReleaseNote + Release *github.RepositoryRelease +} + +// IMAGES_YAML returns this data structure +type ImageYamls []ImageElement + +// ImageElement - a specific image and it's data structure the dmap is a list of shas and container versions +type ImageElement struct { + Name string `json:"name"` + Dmap map[string][]string `json:"dmap"` +} + +func (i ControllerImage) print() string { + return fmt.Sprintf("%s/%s:%s@%s", i.Registry, i.Name, i.Tag, i.Digest) +} + +func FindImageDigest(yaml ImageYamls, image, version string) string { + version = fmt.Sprintf("v%s", version) + Info("Searching Digest for %s:%s", image, version) + for i := range yaml { + if yaml[i].Name == image { + for k, v := range yaml[i].Dmap { + if v[0] == version { + return k + } + } + return "" + } + } + return "" +} diff --git a/magefiles/utils/e2edocs.go b/magefiles/utils/e2edocs.go new file mode 100644 index 000000000..2edc2ca40 --- /dev/null +++ b/magefiles/utils/e2edocs.go @@ -0,0 +1,140 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package utils + +import ( + "bufio" + "bytes" + "embed" + "fmt" + "io/fs" + "os" + "path/filepath" + "regexp" + "strings" + "text/template" + + "slices" +) + +//go:embed templates/e2edocs.tpl +var tplContent embed.FS + +var ( + skipFiles = []string{ + "test/e2e/framework/framework.go", + "test/e2e/e2e.go", + "test/e2e/e2e_test.go", + } +) + +const ( + testDir = "test/e2e" + describe = "Describe" + URL = "https://github.com/kubernetes/ingress-nginx/tree/main/" +) + +var ( + betweenquotes = regexp.MustCompile(`("|\')(?P.*)("|\')`) +) + +type E2ETemplate struct { + URL string + Tests []string +} + +func getDescription(linetext, path, url string, lineN int, isDescription bool) string { + var descriptionLine string + prefix := "-" + if isDescription { + prefix = "###" + } + + matches := betweenquotes.FindStringSubmatch(linetext) + contentIndex := betweenquotes.SubexpIndex("TestDescription") + if len(matches) < 2 || contentIndex == -1 { + return "" + } + + fileName := fmt.Sprintf("%s/%s", url, path) + descriptionLine = fmt.Sprintf("%s [%s](%s#L%d)", prefix, matches[contentIndex], fileName, lineN) + + return descriptionLine +} + +func containsGinkgoTest(line string) bool { + if !strings.Contains(line, describe) && !strings.Contains(line, "It") { + return false + } + return strings.Contains(line, "func() {") +} + +func (t *E2ETemplate) walkE2eDir(path string, d fs.DirEntry, errAggregated error) error { + if errAggregated != nil { + return errAggregated + } + // Remove ignored files or non .go files + if d.IsDir() || slices.Contains(skipFiles, path) || !strings.HasSuffix(path, ".go") { + return nil + } + + content, err := os.ReadFile(path) + if err != nil { + return err + } + + fileScanner := bufio.NewScanner(bytes.NewReader(content)) + + fileScanner.Split(bufio.ScanLines) + + tests := make([]string, 0) + var lineN = 0 + for fileScanner.Scan() { + lineN = lineN + 1 + if !containsGinkgoTest(fileScanner.Text()) { + continue + } + + line := getDescription(fileScanner.Text(), path, t.URL, lineN, strings.Contains(fileScanner.Text(), describe)) + if line != "" { + tests = append(tests, line) + } + } + t.Tests = append(t.Tests, tests...) + return nil +} + +func GenerateE2EDocs() (string, error) { + e2etpl := &E2ETemplate{URL: URL} + err := filepath.WalkDir(testDir, e2etpl.walkE2eDir) + if err != nil { + return "", err + } + + tmpl, err := template.New("e2edocs.tpl").ParseFS(tplContent, "templates/e2edocs.tpl") + if err != nil { + return "", fmt.Errorf("error parsing the template file: %s", err) + } + + tplBuff := new(bytes.Buffer) + err = tmpl.Execute(tplBuff, e2etpl) + if err != nil { + return "", err + } + return tplBuff.String(), nil + +} diff --git a/magefiles/helm.go b/magefiles/utils/helm.go similarity index 79% rename from magefiles/helm.go rename to magefiles/utils/helm.go index c11fc9ec2..dea68caab 100644 --- a/magefiles/helm.go +++ b/magefiles/utils/helm.go @@ -1,5 +1,3 @@ -//go:build mage - /* Copyright 2023 The Kubernetes Authors. @@ -16,178 +14,7 @@ See the License for the specific language governing permissions and limitations under the License. */ -package main - -import ( - "bytes" - "fmt" - "os" - "strings" - - semver "github.com/blang/semver/v4" - "github.com/helm/helm/pkg/chartutil" - "github.com/magefile/mage/mg" - "github.com/magefile/mage/sh" - yamlpath "github.com/vmware-labs/yaml-jsonpath/pkg/yamlpath" - "gopkg.in/yaml.v3" -) - -const ( - HelmChartPath = "charts/ingress-nginx/Chart.yaml" - HelmChartValues = "charts/ingress-nginx/values.yaml" -) - -type Helm mg.Namespace - -// UpdateAppVersion Updates the Helm App Version of Ingress Nginx Controller -func (Helm) UpdateAppVersion() { - updateAppVersion() -} - -func updateAppVersion() { -} - -// UpdateVersion Update Helm Version of the Chart -func (Helm) UpdateVersion(version string) { - updateVersion(version) -} - -func currentChartVersion() string { - chart, err := chartutil.LoadChartfile(HelmChartPath) - CheckIfError(err, "HELM Could not Load Chart") - return chart.Version -} - -func currentChartAppVersion() string { - chart, err := chartutil.LoadChartfile(HelmChartPath) - CheckIfError(err, "HELM Could not Load Chart") - return chart.AppVersion -} - -func updateVersion(version string) { - Info("HELM Reading File %v", HelmChartPath) - - chart, err := chartutil.LoadChartfile(HelmChartPath) - CheckIfError(err, "HELM Could not Load Chart") - - // Get the current tag - // appVersionV, err := getIngressNGINXVersion() - // CheckIfError(err, "HELM Issue Retrieving the Current Ingress Nginx Version") - - // remove the v from TAG - appVersion := version - - Info("HELM Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) - if appVersion == chart.AppVersion { - Warning("HELM Ingress NGINX Version didnt change Ingress-Nginx App Version: %s Chart AppVersion: %s", appVersion, chart.AppVersion) - return - } - - // Update the helm chart - chart.AppVersion = appVersion - cTag, err := semver.Make(chart.Version) - CheckIfError(err, "HELM Creating Chart Version: %v", err) - - if err = cTag.IncrementPatch(); err != nil { - ErrorF("HELM Incrementing Chart Version: %v", err) - os.Exit(1) - } - chart.Version = cTag.String() - Debug("HELM Updated Chart Version: %v", chart.Version) - - err = chartutil.SaveChartfile(HelmChartPath, chart) - CheckIfError(err, "HELM Saving new Chart") -} - -func updateChartReleaseNotes(releasesNotes []string) { - Info("HELM Updating the Chart Release notes") - chart, err := chartutil.LoadChartfile(HelmChartPath) - CheckIfError(err, "HELM Could not Load Chart to update release notes %s", HelmChartPath) - var releaseNoteString string - for i := range releasesNotes { - releaseNoteString = fmt.Sprintf("%s - \"%s\"\n", releaseNoteString, releasesNotes[i]) - } - Info("HELM Release note string %s", releaseNoteString) - chart.Annotations["artifacthub.io/changes"] = releaseNoteString - err = chartutil.SaveChartfile(HelmChartPath, chart) - CheckIfError(err, "HELM Saving updated release notes for Chart") -} - -func UpdateChartChangelog() { -} - -// UpdateChartValue Updates the Helm ChartValue -func (Helm) UpdateChartValue(key, value string) { - updateChartValue(key, value) -} - -func updateChartValue(key, value string) { - Info("HELM Updating Chart %s %s:%s", HelmChartValues, key, value) - - // read current values.yaml - data, err := os.ReadFile(HelmChartValues) - CheckIfError(err, "HELM Could not Load Helm Chart Values files %s", HelmChartValues) - - // var valuesStruct IngressChartValue - var n yaml.Node - CheckIfError(yaml.Unmarshal(data, &n), "HELM Could not Unmarshal %s", HelmChartValues) - - // update value - // keyParse := parsePath(key) - p, err := yamlpath.NewPath(key) - CheckIfError(err, "HELM cannot create path") - - q, err := p.Find(&n) - CheckIfError(err, "HELM unexpected error finding path") - - for _, i := range q { - Info("HELM Found %s at %s", i.Value, key) - i.Value = value - Info("HELM Updated %s at %s", i.Value, key) - } - - //// write to file - var b bytes.Buffer - yamlEncoder := yaml.NewEncoder(&b) - yamlEncoder.SetIndent(2) - err = yamlEncoder.Encode(&n) - CheckIfError(err, "HELM Could not Marshal new Values file") - err = os.WriteFile(HelmChartValues, b.Bytes(), 0o644) - CheckIfError(err, "HELM Could not write new Values file to %s", HelmChartValues) - - Info("HELM Ingress Nginx Helm Chart update %s %s", key, value) -} - -func (Helm) Helmdocs() error { - return runHelmDocs() -} - -func runHelmDocs() error { - err := installHelmDocs() - if err != nil { - return err - } - err = sh.RunV("helm-docs", "--chart-search-root=${PWD}/charts") - if err != nil { - return err - } - return nil -} - -func installHelmDocs() error { - Info("HELM Install HelmDocs") - g0 := sh.RunCmd("go") - - err := g0("install", "github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0") - if err != nil { - return err - } - return nil -} -func parsePath(key string) []string { return strings.Split(key, ".") } - -func updateHelmDocs() { -} +package utils type IngressChartValue struct { CommonLabels struct{} `yaml:"commonLabels"` diff --git a/magefiles/utils/releasenote.go b/magefiles/utils/releasenote.go new file mode 100644 index 000000000..fa883104f --- /dev/null +++ b/magefiles/utils/releasenote.go @@ -0,0 +1,91 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package utils + +import ( + "fmt" + "os" + "text/template" +) + +// ReleaseNote - All the pieces of information/documents that get updated during a release +type ReleaseNote struct { + Version string + NewControllerVersion string + PreviousControllerVersion string + ControllerImages []ControllerImage + DepUpdates []string + Updates []string + HelmUpdates []string + NewHelmChartVersion string + PreviousHelmChartVersion string +} + +func (r ReleaseNote) Template() { + // Files are provided as a slice of strings. + changelogTemplate, err := os.ReadFile("Changelog.md.gotmpl") + if err != nil { + ErrorF("Could not read changelog template file %s", err) + } + Debug("ChangeLog Templates %s", string(changelogTemplate)) + t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) + // create a new file + file, err := os.Create(fmt.Sprintf("changelog/Changelog-%s.md", r.Version)) + if err != nil { + ErrorF("Could not create changelog file %s", err) + } + defer file.Close() + + err = t.Execute(file, r) + if err != nil { + ErrorF("executing template: %s", err) + } +} + +func (r ReleaseNote) HelmTemplate() { + // Files are provided as a slice of strings. + changelogTemplate, err := os.ReadFile("charts/ingress-nginx/changelog.md.gotmpl") + if err != nil { + ErrorF("Could not read changelog template file %s", err) + } + Debug("ChangeLog Templates %s", string(changelogTemplate)) + t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) + // create a new file + file, err := os.Create(fmt.Sprintf("charts/ingress-nginx/changelog/Changelog-%s.md", r.NewHelmChartVersion)) + if err != nil { + ErrorF("Could not create changelog file %s", err) + } + defer file.Close() + + err = t.Execute(file, r) + if err != nil { + ErrorF("executing template: %s", err) + } +} + +func (r ReleaseNote) PrintRelease() { + Info("Release Version: %v", r.NewControllerVersion) + Info("Previous Version: %v", r.PreviousControllerVersion) + Info("Controller Image: %v", r.ControllerImages[0].print()) + Info("Controller Chroot Image: %v", r.ControllerImages[1].print()) + for i := range r.Updates { + Info("Update #%v - %v", i, r.Updates[i]) + } + for j := range r.DepUpdates { + Info("Dependabot Update #%v - %v", j, r.DepUpdates[j]) + } +} diff --git a/magefiles/utils/templates/e2edocs.tpl b/magefiles/utils/templates/e2edocs.tpl new file mode 100644 index 000000000..8757c10bd --- /dev/null +++ b/magefiles/utils/templates/e2edocs.tpl @@ -0,0 +1,10 @@ + + +# e2e test suite for [Ingress NGINX Controller]({{.URL}}) + +{{ range $test := .Tests }} +{{ $test }} +{{- end }} \ No newline at end of file From d1dc763c7ec1d4be1096520a6db048e734d32f60 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Sep 2023 04:24:30 -0700 Subject: [PATCH 355/822] Bump google.golang.org/grpc from 1.58.0 to 1.58.1 (#10419) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.0 to 1.58.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.58.0...v1.58.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9423c5bf0..63228c8ae 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.13.0 - google.golang.org/grpc v1.58.0 + google.golang.org/grpc v1.58.1 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 61c31f0d8..c5be5c64d 100644 --- a/go.sum +++ b/go.sum @@ -669,8 +669,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.58.0 h1:32JY8YpPMSR45K+c3o6b8VL73V+rR8k+DeMIr4vRH8o= -google.golang.org/grpc v1.58.0/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= +google.golang.org/grpc v1.58.1 h1:OL+Vz23DTtrrldqHK49FUOPHyY75rvFqJfXC84NYW58= +google.golang.org/grpc v1.58.1/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From cb7090060921603568badac269bef8dc1c412609 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Mon, 18 Sep 2023 08:52:31 -0300 Subject: [PATCH 356/822] Release v1.9.0-beta.0 (#10422) --- changelog/Changelog-1.9.0-beta.0.md | 93 ++ charts/ingress-nginx/Chart.yaml | 14 +- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.8.0-beta.0.md | 13 + charts/ingress-nginx/values.yaml | 6 +- deploy/static/provider/aws/deploy.yaml | 46 +- .../aws/nlb-with-tls-termination/deploy.yaml | 46 +- deploy/static/provider/baremetal/deploy.yaml | 46 +- deploy/static/provider/cloud/deploy.yaml | 46 +- deploy/static/provider/do/deploy.yaml | 46 +- deploy/static/provider/exoscale/deploy.yaml | 46 +- deploy/static/provider/kind/deploy.yaml | 46 +- deploy/static/provider/oracle/deploy.yaml | 46 +- deploy/static/provider/scw/deploy.yaml | 46 +- docs/e2e-tests.md | 1358 +++++++---------- 15 files changed, 878 insertions(+), 1028 deletions(-) create mode 100644 changelog/Changelog-1.9.0-beta.0.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.8.0-beta.0.md diff --git a/changelog/Changelog-1.9.0-beta.0.md b/changelog/Changelog-1.9.0-beta.0.md new file mode 100644 index 000000000..d1ffe148f --- /dev/null +++ b/changelog/Changelog-1.9.0-beta.0.md @@ -0,0 +1,93 @@ +# Changelog + +### 1.9.0-beta.0 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.9.0-beta.0@sha256:60b4c95349ce2a81a3b2a76423ee483b847b89d3fa8cb148468434f606f3fa0c + +### All Changes: + +* Rework mage (#10418) +* Start release of v1.9.0 beta0 (#10407) +* Update k8s versions on CI (#10406) +* Add a flag to enable or disable aio_write (#10394) +* Update external-articles.md - advanced setup with GKE/Cloud Armor/IAP (#10372) +* Fix e2e test suite doc (#10396) +* Disable user snippets per default (#10393) +* Deployment/DaemonSet: Fix templating & value. (#10240) +* Fix deferInLoop error (#10387) +* Remove gofmt (#10385) +* Deployment/DaemonSet: Template `topologySpreadConstraints`. (#10259) +* release notes 1.8.2 (#10389) +* fix: remove curl on base container #9716 (#10306) +* Fix http default backend test (#10382) +* Add golangci github action and replace the deprecated golint (#10187) +* BUGFIX incorrect indentation (#10254) +* Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57.0 (#10352) +* fix: path with sepecial characters warning #10281 #10308 (#10330) +* Fix golangci-lint errors (#10196) +* chore(build): Fix Run make dev-env syntax error (#10294) +* Add firewall configuration to quick start documentation (#10357) +* Making auth access logs optional (#10335) +* Fix “dev-env” Makefile target to work with kubectl 1.28+ (#10350) +* fix: update action file to auto release plugin #10197 (#10321) +* Use gzip instead of pigz in CI (#10348) +* Disable Modsecurity from internal processing which affects large ingresses (#10316) +* fix: add /etc/mime.types #10309 (#10310) +* Remove curl dependencies in e2e tests #9716 (#10296) +* docs: swap explanation to match example (#10220) +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* Updated index.md - Fix typos (#10256) +* Handle request_id variable correctly in auth requests (#9219) +* test kind updates (#10272) +* promote distroless otel init image (#10257) +* [helm] configure allow to configure hostAliases (#10180) +* Add rolling update strategy to each static deployment file (#10129) +* Implement annotation validation (#9673) +* Golang 1.20.6 for test runner (#10230) +* [helm] pass service annotations through helm tpl engine (#10084) +* Ignore deployment template's replicas if KEDA is enabled (#9534) +* chore: bump OpenResty to v1.21.4.2 (#10219) +* Scanning port 10247 lead to tcp connection 502 error (#9815) +* revise Datadog trace sampling configuration (#10151) +* Clarify TCP/UDP service docs (#10146) +* Exposed continent data as variable in the case of Maxmind city files (#10157) +* Cleanup errcheck code (#10166) +* Fix golang-ci linter errors (#10128) +* Deprecate and remove AJP support (#10158) +* release notes 1.8.1 (#10161) + +### Dependencies updates: +* Bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.12.0 (#10355) +* Bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#10399) +* Bump actions/setup-go from 4.0.1 to 4.1.0 (#10403) +* Bump goreleaser/goreleaser-action from 4.4.0 to 4.6.0 (#10402) +* Bump actions/upload-artifact from 3.1.2 to 3.1.3 (#10404) +* Bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (#10400) +* Bump google.golang.org/grpc from 1.57.0 to 1.58.0 (#10398) +* Bump actions/dependency-review-action from 3.0.8 to 3.1.0 (#10401) +* Bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 (#10373) +* Bump github.com/cyphar/filepath-securejoin in /magefiles (#10374) +* Bump Go version to 1.21.1 (#10377) +* Bump Go version to 1.21.1 on testrunner (#10378) +* Bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 (#10365) +* Bump docker/setup-buildx-action from 2.9.1 to 2.10.0 (#10353) +* Bump actions/checkout from 3.5.3 to 3.6.0 (#10354) +* Bump actions/dependency-review-action from 3.0.6 to 3.0.8 (#10333) +* Bump actions/setup-go from 4.0.1 to 4.1.0 (#10313) +* Bump securego/gosec from 2.16.0 to 2.17.0 (#10332) +* Bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (#10314) +* Bump github.com/opencontainers/runc from 1.1.8 to 1.1.9 (#10298) +* Bump k8s.io/component-base from 0.26.4 to 0.27.4 (Replace Topology Aware Hints with Topology Aware Routing) (#10282) +* Bump google.golang.org/grpc from 1.56.2 to 1.57.0 (#10258) +* Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#10280) +* Bump github.com/opencontainers/runc from 1.1.7 to 1.1.8 (#10244) +* Bump google.golang.org/grpc from 1.56.1 to 1.56.2 (#10193) +* Bump docker/setup-buildx-action from 2.9.0 to 2.9.1 (#10207) +* Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#10192) +* Bump docker/setup-buildx-action from 2.8.0 to 2.9.0 (#10191) +* Bump docker/setup-buildx-action from 2.7.0 to 2.8.0 (#10165) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-release-1.8...controller-controller-v1.9.0-beta.0 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 4e1fc67a5..b692069a1 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,9 +1,13 @@ annotations: - artifacthub.io/changes: | - - "Update Ingress-Nginx version controller-v1.8.2" - artifacthub.io/prerelease: "false" + artifacthub.io/changes: |2 + - "ci(helm): fix Helm Chart release action 422 error (#10237)" + - "helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249)" + - "[helm] configure allow to configure hostAliases (#10180)" + - "[helm] pass service annotations through helm tpl engine (#10084)" + - "Update Ingress-Nginx version controller-v1.9.0-beta.0" + artifacthub.io/prerelease: "true" apiVersion: v2 -appVersion: 1.8.2 +appVersion: 1.9.0-beta.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -20,4 +24,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.7.2 +version: 4.8.0-beta.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index ab16eb9ca..aa489a65b 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.7.2](https://img.shields.io/badge/Version-4.7.2-informational?style=flat-square) ![AppVersion: 1.8.2](https://img.shields.io/badge/AppVersion-1.8.2-informational?style=flat-square) +![Version: 4.8.0-beta.0](https://img.shields.io/badge/Version-4.8.0--beta.0-informational?style=flat-square) ![AppVersion: 1.9.0-beta.0](https://img.shields.io/badge/AppVersion-1.9.0--beta.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -315,13 +315,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2"` | | -| controller.image.digestChroot | string | `"sha256:1317a563219f755a6094d990057c78e5c4dcea5e31f4ce1db8641e732a7d6133"` | | +| controller.image.digest | string | `"sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9"` | | +| controller.image.digestChroot | string | `"sha256:60b4c95349ce2a81a3b2a76423ee483b847b89d3fa8cb148468434f606f3fa0c"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.8.2"` | | +| controller.image.tag | string | `"v1.9.0-beta.0"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.8.0-beta.0.md b/charts/ingress-nginx/changelog/Changelog-4.8.0-beta.0.md new file mode 100644 index 000000000..9072a75b4 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.8.0-beta.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.0-beta.0 + +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* [helm] configure allow to configure hostAliases (#10180) +* [helm] pass service annotations through helm tpl engine (#10084) +* Update Ingress-Nginx version controller-v1.9.0-beta.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0-beta.0 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 6a1031223..0b6091bb7 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -24,9 +24,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.8.2" - digest: sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 - digestChroot: sha256:1317a563219f755a6094d990057c78e5c4dcea5e31f4ce1db8641e732a7d6133 + tag: "v1.9.0-beta.0" + digest: sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + digestChroot: sha256:60b4c95349ce2a81a3b2a76423ee483b847b89d3fa8cb148468434f606f3fa0c pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 6ac6b2847..a5247d8be 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index eebac4dbc..a5e35c02a 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" http-snippet: | server { listen 2443; @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -431,7 +431,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -455,7 +455,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -530,7 +530,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -541,7 +541,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -577,7 +577,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -588,7 +588,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index d503b5db2..4a0914121 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -608,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index ce08314fc..13ec5db40 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index db6609024..8ed58f056 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" use-proxy-protocol: "true" kind: ConfigMap metadata: @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index 2eaabad4f..8fbade4e2 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +523,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +534,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -570,7 +570,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +581,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -632,7 +632,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index aefad5a33..3d12be236 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index c52d3a24e..fc1ceb566 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" kind: ConfigMap metadata: labels: @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 8f64241ec..0d4f4baf0 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -320,7 +320,7 @@ subjects: --- apiVersion: v1 data: - allow-snippet-annotations: "true" + allow-snippet-annotations: "false" use-proxy-protocol: "true" kind: ConfigMap metadata: @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.2@sha256:74834d3d25b336b62cabeb8bf7f1d788706e2cf1cfd64022de4137ade8881ff2 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.2 + app.kubernetes.io/version: 1.9.0-beta.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 9a3e727fd..bd3936801 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -6,812 +6,552 @@ Do not try to edit it manually. # e2e test suite for [Ingress NGINX Controller](https://github.com/kubernetes/ingress-nginx/tree/main/) - -### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L39) - -- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L47) -- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L74) -- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L91) -- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L112) -- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L129) -- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L149) -- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L163) -- [should return an error if there is an invalid path and wrong pathType is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L177) -- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L211) -- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L227) -- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L243) -- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L263) - -### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L43) - -- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L50) -- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L72) -- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L107) -- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L129) -- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L202) -- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L234) -- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L257) -- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L279) -- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L303) -- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L329) -- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L361) -- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L381) -- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L421) -- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L444) -- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L467) - -### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L33) - -- [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L36) -- [Check persistent affinity mode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L69) - -### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L29) - -- [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L36) -- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L51) -- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L66) -- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L81) -- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L96) - -### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L30) - -- [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L37) -- [should set client_body_buffer_size to 1K](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L59) -- [should set client_body_buffer_size to 1k](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L81) -- [should set client_body_buffer_size to 1m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L103) -- [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L125) -- [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L147) - -### [default-backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L29) - -- [should use a custom default backend as upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/default_backend.go#L37) - -### [proxy-ssl-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L32) - -- [should set valid proxy-ssl-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L39) -- [should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L66) -- [should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L96) -- [should set valid proxy-ssl-secret, proxy-ssl-protocols](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L124) -- [proxy-ssl-location-only flag should change the nginx config server part](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxyssl.go#L152) - -### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L45) - -- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L52) -- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L71) -- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L95) -- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L122) -- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L150) -- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L178) -- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L205) -- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L233) -- [ when external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L272) -- [ when external auth is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L298) -- [ when auth-headers are set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L324) -- [should set cache_key when external auth cache is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L345) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L432) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L443) -- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L454) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L493) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L502) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L513) -- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L537) -- [should not create additional upstream block when auth-keepalive is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L560) -- [should not create additional upstream block when host part of auth-url contains a variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L578) -- [should not create additional upstream block when auth-keepalive is negative](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L598) -- [should not create additional upstream block when auth-keepalive is set with HTTP/2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L617) -- [should create additional upstream block when auth-keepalive is set with HTTP/1.x](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L631) -- [should disable set_all_vars when auth-keepalive-share-vars is not set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L653) -- [should enable set_all_vars when auth-keepalive-share-vars is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L672) -- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L713) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L722) -- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L733) -- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L792) -- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L812) -- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L840) -- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L869) -- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L899) -- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L907) - -### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L39) - -- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L46) -- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L64) -- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L85) -- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L102) -- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L130) -- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) -- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L175) -- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L214) -- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L253) -- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L292) -- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L338) -- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L380) - -### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) - -- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) -- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) -- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) -- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) - -### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L31) - -- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L38) -- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fromtowwwredirect.go#L64) - -### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L40) - -- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L43) -- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L68) -- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L128) -- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/grpc.go#L189) - -### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L28) - -- [set snippet more_set_headers in all locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L34) -- [drops snippet more_set_header in all locations if disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/snippet.go#L73) - -### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L28) - -- [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/sslciphers.go#L35) - -### [upstream-vhost](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L27) - -- [set host to upstreamvhost.bar.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamvhost.go#L34) - -### [x-forwarded-prefix](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L28) - -- [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) -- [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) - -### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L32) - -- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L39) -- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L68) -- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L113) -- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L160) -- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L192) - -### [service-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L32) - -- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L41) -- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L69) -- [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serviceupstream.go#L97) - -### [server-alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L31) - -- [should return status code 200 for host 'foo' and 404 for 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L38) -- [should return status code 200 for host 'foo' and 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L64) -- [should return status code 200 for hosts defined in two ingresses, different path with one alias](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/alias.go#L89) - -### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L31) - -- [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L38) -- [should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L86) -- [should 302 redirect to error page instead of 400 when auth-tls-error-page is set](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L116) -- [should pass URL-encoded certificate to upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L163) -- [should validate auth-tls-verify-client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L208) -- [should return 403 using auth-tls-match-cn with no matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L267) -- [should return 200 using auth-tls-match-cn with matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L296) -- [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/authtls.go#L325) - -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) - -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L45) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L89) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L120) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L174) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L232) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L289) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L363) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L445) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L513) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L594) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L647) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L692) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L741) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L790) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L862) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L910) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L952) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L995) -- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1070) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1104) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1138) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1175) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1242) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1310) - -### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L33) - -- [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L40) -- [should set cors methods to only allow POST, GET](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L67) -- [should set cors max-age](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L83) -- [should disable cors allow credentials](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L99) -- [should allow origin for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L115) -- [should allow headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L142) -- [should expose headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L158) -- [should allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L174) -- [should not allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L201) -- [should allow correct origins - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L221) -- [should not break functionality](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L272) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L296) -- [should not break functionality with extra domain](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L319) -- [should not match](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L343) -- [should allow - single origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L363) -- [should not allow - single origin with port and origin without port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L391) -- [should not allow - single origin without port and origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L410) -- [should allow - matching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L430) -- [should not allow - unmatching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L473) -- [should allow - matching origin+port with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L493) -- [should not allow - portless origin with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L520) -- [should allow correct origins - missing subdomain + origin with wildcard origin and correct origin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L540) -- [should allow - missing origins (should allow all origins)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/cors.go#L576) - -### [custom-http-errors](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L34) - -- [configures Nginx correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/customhttperrors.go#L41) - -### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L28) - -- [add valid directives to server via server snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L35) -- [drops server snippet if disabled by the administrator](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/serversnippet.go#L70) - -### [stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L34) - -- [should add value of stream-snippet to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L41) -- [should add stream-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/streamsnippet.go#L94) - -### [app-root](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L28) - -- [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/approot.go#L35) - -### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L28) - -- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/connection.go#L35) - -### [disable-access-log disable-http-access-log disable-stream-access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L28) - -- [disable-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L35) -- [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) -- [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) - -### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) - -- [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) - -### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L27) - -- [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) - -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) - -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) - -### [Annotation - limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L31) - -- [should limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitconnections.go#L38) - -### [limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L29) - -- [Check limit-rate annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/limitrate.go#L37) - -### [enable-access-log enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L27) - -- [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L34) -- [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/log.go#L49) - -### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L28) - -- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L36) -- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) -- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) - -### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) - -- [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) - -### [permanent-redirect permanent-redirect-code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L30) - -- [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L33) -- [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/redirect.go#L61) - -### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L33) - -- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L40) -- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/satisfy.go#L82) - -### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L30) - -- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/globalratelimit.go#L38) - -### [proxy-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L30) - -- [should set proxy_redirect to off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L38) -- [should set proxy_redirect to default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L54) -- [should set proxy_redirect to hello.com goodbye.com](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L70) -- [should set proxy client-max-body-size to 8m](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L87) -- [should not set proxy client-max-body-size to incorrect value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L102) -- [should set valid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L117) -- [should not set invalid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L138) -- [should turn on proxy-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L159) -- [should turn off proxy-request-buffering](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L181) -- [should build proxy next upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L196) -- [should setup proxy cookies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L217) -- [should change the default proxy HTTP version](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/proxy.go#L235) - -### [upstream-hash-by-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L79) - -- [should connect to the same pod](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L86) -- [should connect to the same subset of pods](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/upstreamhashby.go#L95) - -### [allowlist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipallowlist.go#L27) - -- [should set valid ip allowlist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipallowlist.go#L34) - -### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) - -- [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L37) -- [should get information for a specific backend server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L56) -- [should produce valid JSON for /dbg general](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L85) - -### [[Default Backend] custom service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L33) - -- [uses custom default backend that returns 200 as status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/custom_default_backend.go#L36) - -### [[Default Backend] SSL](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L26) - -- [should return a self generated SSL certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/ssl.go#L29) - -### [[Default Backend] change default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L30) - -- [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) - -### [[Default Backend]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L30) - -- [should return 404 sending requests when only a default backend is running](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L33) -- [enables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L88) -- [disables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/default_backend.go#L105) - -### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) - -- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) - -### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L34) - -- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L42) - -### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L30) - -- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L40) -- [should shutdown after waiting 60 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L61) -- [should shutdown after waiting 150 seconds for pending connections to be closed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/shutdown.go#L106) - -### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L25) - -- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/slow_requests.go#L33) - -### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) - -- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L35) - -### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L27) - -- [should drop whole ingress if one path matches invalid regex](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/deep_inspection.go#L34) - -### [[Ingress] [PathType] prefix checks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L28) - -- [should return 404 when prefix /aaa does not match request /aaaccc](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_prefix.go#L35) - -### [[Ingress] definition without host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L31) - -- [should set ingress details variables for ingresses without a host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L34) -- [should set ingress details variables for ingresses with host without IngressRuleValue, only Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/without_host.go#L55) - -### [single ingress - multiple hosts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L30) - -- [should set the correct $service_name NGINX variable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/multiple_rules.go#L38) - -### [[Ingress] [PathType] exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L30) - -- [should choose exact location for /exact](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_exact.go#L37) - -### [[Ingress] [PathType] mix Exact and Prefix paths](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L30) - -- [should choose the correct location](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ingress/pathtype_mixed.go#L39) - -### [[Memory Leak] Dynamic Certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L35) - -- [should not leak memory from ingress SSL certificates or configuration updates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/leaks/lua_ssl.go#L42) - -### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L30) - -- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/configmap.go#L37) - -### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L31) - -- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/ewma.go#L43) - -### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L31) - -- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/loadbalance/round_robin.go#L39) - -### [[Lua] dynamic certificates](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L37) - -- [picks up the certificate when we add TLS spec to existing ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L45) -- [picks up the previously missing secret for a given ingress without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L70) -- [supports requests with domain with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L145) -- [picks up the updated certificate without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L149) -- [falls back to using default certificate when secret gets deleted without reloading](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L185) -- [picks up a non-certificate only change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L218) -- [removes HTTPS configuration when we delete TLS spec](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_certificates.go#L233) - -### [[Lua] dynamic configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L41) - -- [configures balancer Lua middleware correctly](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L49) -- [handles endpoints only changes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L61) -- [handles endpoints only changes (down scaling of replicas)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L86) -- [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L124) -- [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L170) - -### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) - -- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) -- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) - -### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) - -- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) -- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L114) -- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L121) - -### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) - -- [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) - -### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L34) - -- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L37) -- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_backend.go#L55) - -### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L38) - -- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L41) -- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L78) -- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L118) -- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L148) -- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L184) -- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L225) -- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L261) -- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_externalname.go#L344) - -### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L31) - -- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) - -### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L28) - -- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_next_upstream.go#L36) - -### [reuse-port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L27) - -- [reuse port should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L38) -- [reuse port should be disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L44) -- [reuse port should be enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/reuse-port.go#L52) - -### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L29) - -- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L38) -- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_tokens.go#L50) - -### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L28) - -- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L40) -- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L48) -- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L58) -- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L68) -- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L78) -- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/keep-alive.go#L88) - -### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L28) - -- [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L39) -- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L46) -- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L54) -- [should enable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L62) -- [should disable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L70) -- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L80) -- [log-format default escape](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L103) -- [log-format-escape-none enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/log-format.go#L126) - -### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) - -- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) -- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) -- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) - -### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L39) - -- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L49) -- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L62) -- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L76) -- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L91) -- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L106) - -### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L52) - -- [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L62) -- [should exists opentracing directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L75) -- [should include opentracing_trust_incoming_span off directive when disabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L89) -- [should not exists opentracing_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L104) -- [should exists opentracing_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L119) -- [should not exists opentracing_location_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L134) -- [should exists opentracing_location_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L149) -- [should enable opentracing using zipkin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L164) -- [should enable opentracing using jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L176) -- [should enable opentracing using jaeger with sampler host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L188) -- [should propagate the w3c header when configured with jaeger](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L201) -- [should enable opentracing using jaeger with an HTTP endpoint](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L232) -- [should enable opentracing using datadog](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L245) - -### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L37) - -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy_volumes.go#L40) - -### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L31) - -- [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L65) -- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L109) -- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L125) -- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L144) -- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L164) -- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L186) -- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/tls.go#L204) - -### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L30) - -- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/globalratelimit.go#L38) - -### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L29) - -- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L37) -- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_connect_timeout.go#L53) - -### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) - -- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) -- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L78) - -### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L26) - -- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/lua_shared_dicts.go#L29) - -### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) - -- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) - -### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L41) - -- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L70) -- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L106) -- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L134) -- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L166) -- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L194) -- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L259) -- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L325) -- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L414) -- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L482) -- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L538) -- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L628) -- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ingress_class.go#L648) - -### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) - -- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) - -### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L28) - -- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/plugins.go#L35) - -### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L28) - -- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_ciphers.go#L31) - -### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L35) - -- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/stream_snippet.go#L42) - -### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) - -- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L62) - -### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L27) - -- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L30) - -### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L38) - -- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L48) -- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L85) -- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L121) -- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_protocol.go#L164) - -### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L29) - -- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L37) -- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_read_timeout.go#L53) - -### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L29) - -- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L37) -- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_send_timeout.go#L53) - -### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L29) - -- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L36) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L75) -- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L119) -- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/badannotationvalues.go#L157) - -### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L36) - -- [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L45) -- [should only allow requests from specific countries](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/geoip2.go#L69) - -### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L28) - -- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L36) -- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/proxy_host.go#L65) - -### [annotation validations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L30) - -- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L33) -- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/validations/validations.go#L68) - -### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L31) - -- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L41) -- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/forwarded_headers.go#L93) - -### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L28) - -- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L31) -- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_options.go#L37) - -### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L27) - -- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L39) -- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L47) -- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L57) -- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L65) -- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L75) -- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L83) -- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/hash-size.go#L93) - -### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L30) - -- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L45) -- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L65) -- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/listen_nondefault_ports.go#L93) - -### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L30) - -- [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L38) - -### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) - -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) - -### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) - -- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) -- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L65) - -### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L30) - -- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L40) -- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/enable_real_ip.go#L78) - -### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L28) - -- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L38) -- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L55) -- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_access_block.go#L88) - -### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L29) - -- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L32) -- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L39) -- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L56) -- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L67) -- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) -- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) - -### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L28) - -- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/limit_rate.go#L36) - -### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L27) - -- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) - -### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) - -- [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L31) -- [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L39) -- [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L49) - -### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L41) - -- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/pod_security_policy.go#L44) - -### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L28) - -- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L35) -- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/server_snippet.go#L98) - -### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) - -- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L31) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L41) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L52) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L64) -- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L76) - -### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L35) - -- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L66) -- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/default_ssl_certificate.go#L82) - -### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L33) - -- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L50) -- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L69) -- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L81) -- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_catch_all.go#L123) - -### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L35) - -- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_service_external_name.go#L55) - -### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L32) - -- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L35) -- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L54) -- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/disable_sync_events.go#L82) - -### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L39) - -- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L91) -- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L107) -- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L130) -- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L158) -- [should proxy_method method when global-auth-method is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L199) -- [should add custom error page when global-auth-signin url is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L211) -- [should add auth headers when global-auth-response-headers is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L223) -- [should set request-redirect when global-auth-request-redirect is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L236) -- [should set snippet when global external auth is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L248) -- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L322) -- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L333) -- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/global_external_auth.go#L344) - -### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) - -- [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) - -### [[SSL] secret update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L33) - -- [should not appear references to secret updates not used in ingress rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L40) -- [should return the fake SSL certificate if the secret is invalid](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/secret_update.go#L83) - -### [[Status] status update](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L38) - -- [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L43) - -### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L38) - -- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) -- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) +### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L39) +- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L47) +- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L74) +- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L91) +- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L112) +- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L129) +- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L149) +- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L163) +- [should return an error if there is an invalid path and wrong pathType is set](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L177) +- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L211) +- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L227) +- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L243) +- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/admission/admission.go#L263) +### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L43) +- [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L50) +- [should change cookie name on ingress definition change](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L72) +- [should set the path to /something on the generated cookie](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L107) +- [does not set the path to / on the generated cookie if there's more than one rule referring to the same backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L129) +- [should set cookie with expires](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L202) +- [should set cookie with domain](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L234) +- [should not set cookie without domain annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L257) +- [should work with use-regex annotation and session-cookie-path](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L279) +- [should warn user when use-regex is true and session-cookie-path is not set](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L303) +- [should not set affinity across all server locations when using separate ingresses](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L329) +- [should set sticky cookie without host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L361) +- [should work with server-alias annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L381) +- [should set secure in cookie with provided true annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L421) +- [should not set secure in cookie with provided false annotation on http](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L444) +- [should set secure in cookie with provided false annotation on https](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinity.go#L467) +### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinitymode.go#L33) +- [Balanced affinity mode should balance](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinitymode.go#L36) +- [Check persistent affinity mode](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/affinitymode.go#L69) +### [server-alias](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/alias.go#L31) +- [should return status code 200 for host 'foo' and 404 for 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/alias.go#L38) +- [should return status code 200 for host 'foo' and 'bar'](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/alias.go#L64) +- [should return status code 200 for hosts defined in two ingresses, different path with one alias](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/alias.go#L89) +### [app-root](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/approot.go#L28) +- [should redirect to /foo](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/approot.go#L35) +### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L45) +- [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L52) +- [should return status code 503 when authentication is configured with an invalid secret](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L71) +- [should return status code 401 when authentication is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L95) +- [should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L122) +- [should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L150) +- [should return status code 200 when authentication is configured and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L178) +- [should return status code 200 when authentication is configured with a map and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L205) +- [should return status code 401 when authentication is configured with invalid content and Authorization header is sent](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L233) +- [proxy_set_header My-Custom-Header 42;](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L272) +- [proxy_set_header My-Custom-Header 42;](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L298) +- [proxy_set_header 'My-Custom-Header' '42';](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L324) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L432) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L443) +- [user with annotated ingress retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L454) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L493) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L502) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L513) +- [should overwrite Foo header with auth response](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L537) +- [should return status code 200 when signed in](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L713) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L722) +- [keeps processing new ingresses even if one of the existing ingresses is misconfigured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L733) +- [should return status code 200 when signed in after auth backend is deleted ](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L792) +- [should deny login for different location on same server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L812) +- [should deny login for different servers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L840) +- [should redirect to signin url when not signed in](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L869) +- [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L899) +- [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/auth.go#L907) +### [auth-tls-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L31) +- [should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L38) +- [should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L86) +- [should 302 redirect to error page instead of 400 when auth-tls-error-page is set](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L116) +- [should pass URL-encoded certificate to upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L163) +- [should validate auth-tls-verify-client](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L208) +- [should return 403 using auth-tls-match-cn with no matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L267) +- [should return 200 using auth-tls-match-cn with matching CN from client](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L296) +- [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L325) +### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L29) +- [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L36) +- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L51) +- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L66) +- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L81) +- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L96) +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L36) +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L45) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L89) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L120) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L174) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L232) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L289) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L363) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L445) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L513) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L594) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L647) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L692) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L741) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L790) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L862) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L910) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L952) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L995) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1031) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1070) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1104) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1138) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1175) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1242) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L1310) +### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L30) +- [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L37) +- [should set client_body_buffer_size to 1K](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L59) +- [should set client_body_buffer_size to 1k](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L81) +- [should set client_body_buffer_size to 1m](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L103) +- [should set client_body_buffer_size to 1M](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L125) +- [should not set client_body_buffer_size to invalid 1b](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/clientbodybuffersize.go#L147) +### [connection-proxy-header](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/connection.go#L28) +- [set connection header to keep-alive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/connection.go#L35) +### [cors-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L33) +- [should enable cors](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L40) +- [should set cors methods to only allow POST, GET](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L67) +- [should set cors max-age](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L83) +- [should disable cors allow credentials](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L99) +- [should allow origin for cors](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L115) +- [should allow headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L142) +- [should expose headers for cors](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L158) +- [should allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L174) +- [should not allow - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L201) +- [should allow correct origins - single origin for multiple cors values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L221) +- [should not break functionality](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L272) +- [should not break functionality - without `*`](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L296) +- [should not break functionality with extra domain](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L319) +- [should not match](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L343) +- [should allow - single origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L363) +- [should not allow - single origin with port and origin without port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L391) +- [should not allow - single origin without port and origin with required port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L410) +- [should allow - matching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L430) +- [should not allow - unmatching origin with wildcard origin (2 subdomains)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L473) +- [should allow - matching origin+port with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L493) +- [should not allow - portless origin with wildcard origin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L520) +- [should allow correct origins - missing subdomain + origin with wildcard origin and correct origin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L540) +- [should allow - missing origins (should allow all origins)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/cors.go#L576) +### [custom-http-errors](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/customhttperrors.go#L34) +- [configures Nginx correctly](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/customhttperrors.go#L41) +### [default-backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/default_backend.go#L29) +- [should use a custom default backend as upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/default_backend.go#L37) +### [disable-access-log disable-http-access-log disable-stream-access-log](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/disableaccesslog.go#L28) +- [disable-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/disableaccesslog.go#L35) +- [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/disableaccesslog.go#L53) +- [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/disableaccesslog.go#L71) +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fastcgi.go#L30) +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fastcgi.go#L37) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fastcgi.go#L54) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fastcgi.go#L71) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fastcgi.go#L102) +### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/forcesslredirect.go#L27) +- [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/forcesslredirect.go#L34) +### [from-to-www-redirect](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L31) +- [should redirect from www HTTP to HTTP](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L38) +- [should redirect from www HTTPS to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/fromtowwwredirect.go#L64) +### [annotation-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/globalratelimit.go#L30) +- [generates correct configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/globalratelimit.go#L38) +### [backend-protocol - GRPC](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L40) +- [should use grpc_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L43) +- [should return OK for service with backend protocol GRPC](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L68) +- [authorization metadata should be overwritten by external auth response headers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L128) +- [should return OK for service with backend protocol GRPCS](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/grpc.go#L189) +### [http2-push-preload](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/http2pushpreload.go#L27) +- [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/http2pushpreload.go#L34) +### [allowlist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/ipallowlist.go#L27) +- [should set valid ip allowlist range](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/ipallowlist.go#L34) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/ipdenylist.go#L28) +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/ipdenylist.go#L86) +### [Annotation - limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/limitconnections.go#L31) +- [should limit-connections](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/limitconnections.go#L38) +### [limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/limitrate.go#L29) +- [Check limit-rate annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/limitrate.go#L37) +### [enable-access-log enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/log.go#L27) +- [set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/log.go#L34) +- [set rewrite_log on](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/log.go#L49) +### [mirror-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/mirror.go#L28) +- [should set mirror-target to http://localhost/mirror](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/mirror.go#L36) +- [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/mirror.go#L51) +- [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/mirror.go#L67) +### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L39) +- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L46) +- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L64) +- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L85) +- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L102) +- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L130) +- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L153) +- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L175) +- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L214) +- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L253) +- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L292) +- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L338) +- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/modsecurity/modsecurity.go#L380) +### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/preservetrailingslash.go#L27) +- [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/preservetrailingslash.go#L34) +### [proxy-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L30) +- [should set proxy_redirect to off](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L38) +- [should set proxy_redirect to default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L54) +- [should set proxy_redirect to hello.com goodbye.com](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L70) +- [should set proxy client-max-body-size to 8m](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L87) +- [should not set proxy client-max-body-size to incorrect value](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L102) +- [should set valid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L117) +- [should not set invalid proxy timeouts](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L138) +- [should turn on proxy-buffering](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L159) +- [should turn off proxy-request-buffering](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L181) +- [should build proxy next upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L196) +- [should setup proxy cookies](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L217) +- [should change the default proxy HTTP version](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxy.go#L235) +### [proxy-ssl-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L32) +- [should set valid proxy-ssl-secret](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L39) +- [should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L66) +- [should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L96) +- [should set valid proxy-ssl-secret, proxy-ssl-protocols](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L124) +- [proxy-ssl-location-only flag should change the nginx config server part](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/proxyssl.go#L152) +### [permanent-redirect permanent-redirect-code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/redirect.go#L30) +- [should respond with a standard redirect code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/redirect.go#L33) +- [should respond with a custom redirect code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/redirect.go#L61) +### [rewrite-target use-regex enable-rewrite-log](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L32) +- [should write rewrite logs](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L39) +- [should use correct longest path match](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L68) +- [should use ~* location modifier if regex annotation is present](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L113) +- [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L160) +- [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/rewrite.go#L192) +### [satisfy](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/satisfy.go#L33) +- [should configure satisfy directive correctly](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/satisfy.go#L40) +- [should allow multiple auth with satisfy any](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/satisfy.go#L82) +### [server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/serversnippet.go#L28) +### [service-upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/serviceupstream.go#L32) +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/serviceupstream.go#L41) +- [should use the Service Cluster IP and Port ](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/serviceupstream.go#L69) +- [should not use the Service Cluster IP and Port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/serviceupstream.go#L97) +### [configuration-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/snippet.go#L28) +- [set snippet more_set_headers in all locations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/snippet.go#L34) +- [drops snippet more_set_header in all locations if disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/snippet.go#L73) +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/sslciphers.go#L28) +- [should change ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/sslciphers.go#L35) +### [stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/streamsnippet.go#L34) +- [should add value of stream-snippet to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/streamsnippet.go#L41) +- [should add stream-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/streamsnippet.go#L94) +### [upstream-hash-by-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/upstreamhashby.go#L79) +- [should connect to the same pod](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/upstreamhashby.go#L86) +- [should connect to the same subset of pods](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/upstreamhashby.go#L95) +### [upstream-vhost](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/upstreamvhost.go#L27) +- [set host to upstreamvhost.bar.com](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/upstreamvhost.go#L34) +### [x-forwarded-prefix](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/xforwardedprefix.go#L28) +- [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/xforwardedprefix.go#L35) +- [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/xforwardedprefix.go#L57) +### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/dbg/main.go#L29) +- [should list the backend servers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/dbg/main.go#L37) +- [should get information for a specific backend server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/dbg/main.go#L56) +- [should produce valid JSON for /dbg general](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/dbg/main.go#L85) +### [[Default Backend] custom service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/custom_default_backend.go#L33) +- [uses custom default backend that returns 200 as status code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/custom_default_backend.go#L36) +### [[Default Backend]](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/default_backend.go#L30) +- [should return 404 sending requests when only a default backend is running](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/default_backend.go#L33) +- [enables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/default_backend.go#L88) +- [disables access logging for default backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/default_backend.go#L105) +### [[Default Backend] SSL](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/ssl.go#L26) +- [should return a self generated SSL certificate](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/ssl.go#L29) +### [[Default Backend] change default settings](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/with_hosts.go#L30) +- [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/defaultbackend/with_hosts.go#L38) +### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/endpointslices/longname.go#L29) +- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/endpointslices/longname.go#L38) +### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/endpointslices/topology.go#L34) +- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/endpointslices/topology.go#L42) +### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/grace_period.go#L32) +- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/grace_period.go#L35) +### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/shutdown.go#L30) +- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/shutdown.go#L40) +### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/slow_requests.go#L25) +- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/slow_requests.go#L33) +### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/deep_inspection.go#L27) +- [should drop whole ingress if one path matches invalid regex](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/deep_inspection.go#L34) +### [single ingress - multiple hosts](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/multiple_rules.go#L30) +- [should set the correct $service_name NGINX variable](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/multiple_rules.go#L38) +### [[Ingress] [PathType] exact](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_exact.go#L30) +- [should choose exact location for /exact](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_exact.go#L37) +### [[Ingress] [PathType] mix Exact and Prefix paths](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_mixed.go#L30) +- [should choose the correct location](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_mixed.go#L39) +### [[Ingress] [PathType] prefix checks](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_prefix.go#L28) +- [should return 404 when prefix /aaa does not match request /aaaccc](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/pathtype_prefix.go#L35) +### [[Ingress] definition without host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/without_host.go#L31) +- [should set ingress details variables for ingresses without a host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/without_host.go#L34) +- [should set ingress details variables for ingresses with host without IngressRuleValue, only Backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/without_host.go#L55) +### [[Memory Leak] Dynamic Certificates](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/leaks/lua_ssl.go#L35) +- [should not leak memory from ingress SSL certificates or configuration updates](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/leaks/lua_ssl.go#L42) +### [[Load Balancer] load-balance](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/configmap.go#L30) +- [should apply the configmap load-balance setting](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/configmap.go#L37) +### [[Load Balancer] EWMA](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/ewma.go#L31) +- [does not fail requests](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/ewma.go#L43) +### [[Load Balancer] round-robin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/round_robin.go#L31) +- [should evenly distribute requests with round-robin (default algorithm)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/loadbalance/round_robin.go#L39) +### [[Lua] dynamic certificates](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L37) +- [picks up the certificate when we add TLS spec to existing ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L45) +- [picks up the previously missing secret for a given ingress without reloading](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L70) +- [supports requests with domain with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L145) +- [picks up the updated certificate without reloading](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L149) +- [falls back to using default certificate when secret gets deleted without reloading](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L185) +- [picks up a non-certificate only change](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L218) +- [removes HTTPS configuration when we delete TLS spec](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_certificates.go#L233) +### [[Lua] dynamic configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L41) +- [configures balancer Lua middleware correctly](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L49) +- [handles endpoints only changes](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L61) +- [handles endpoints only changes (down scaling of replicas)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L86) +- [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L124) +- [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/lua/dynamic_configuration.go#L170) +### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/metrics/metrics.go#L36) +- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/metrics/metrics.go#L50) +- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/metrics/metrics.go#L72) +### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/nginx/nginx.go#L99) +- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/nginx/nginx.go#L102) +- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/nginx/nginx.go#L114) +- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/nginx/nginx.go#L121) +### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/security/request_smuggling.go#L32) +- [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/security/request_smuggling.go#L39) +### [[Service] backend status code 503](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_backend.go#L34) +- [should return 503 when backend service does not exist](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_backend.go#L37) +- [should return 503 when all backend service endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_backend.go#L55) +### [[Service] Type ExternalName](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L38) +- [works with external name set to incomplete fqdn](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L41) +- [should return 200 for service type=ExternalName without a port defined](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L78) +- [should return 200 for service type=ExternalName with a port defined](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L118) +- [should return status 502 for service type=ExternalName with an invalid host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L148) +- [should return 200 for service type=ExternalName using a port name](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L184) +- [should return 200 for service type=ExternalName using FQDN with trailing dot](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L225) +- [should update the external name after a service update](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L261) +- [should sync ingress on external name service addition/deletion](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_externalname.go#L344) +### [[Service] Nil Service Backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_nil_backend.go#L31) +- [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/servicebackend/service_nil_backend.go#L38) +### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L27) +- [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L31) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L41) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L52) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L64) +- [use the specified configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/access_log.go#L76) +### [aio-write](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/aio_write.go#L27) +- [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/aio_write.go#L30) +- [should be enabled when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/aio_write.go#L37) +- [should be disabled when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/aio_write.go#L46) +### [Bad annotation values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/badannotationvalues.go#L29) +- [[BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/badannotationvalues.go#L36) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/badannotationvalues.go#L75) +- [[BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/badannotationvalues.go#L119) +- [[BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/badannotationvalues.go#L157) +### [brotli](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/brotli.go#L30) +- [should only compress responses that meet the `brotli-min-length` condition](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/brotli.go#L38) +### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/configmap_change.go#L29) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/configmap_change.go#L36) +### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/custom_header.go#L30) +- [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/custom_header.go#L40) +- [Add multiple custom headers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/custom_header.go#L65) +### [[SSL] [Flag] default-ssl-certificate](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/default_ssl_certificate.go#L35) +- [uses default ssl certificate for catch-all ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/default_ssl_certificate.go#L66) +- [uses default ssl certificate for host based ingress when configured certificate does not match host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/default_ssl_certificate.go#L82) +### [[Flag] disable-catch-all](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_catch_all.go#L33) +- [should ignore catch all Ingress with backend](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_catch_all.go#L50) +- [should ignore catch all Ingress with backend and rules](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_catch_all.go#L69) +- [should delete Ingress updated to catch-all](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_catch_all.go#L81) +- [should allow Ingress with rules](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_catch_all.go#L123) +### [[Flag] disable-service-external-name](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_service_external_name.go#L35) +- [should ignore services of external-name type](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_service_external_name.go#L55) +### [[Flag] disable-sync-events](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_sync_events.go#L32) +- [should create sync events (default)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_sync_events.go#L35) +- [should create sync events](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_sync_events.go#L54) +- [should not create sync events](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/disable_sync_events.go#L82) +### [enable-real-ip](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/enable_real_ip.go#L30) +- [trusts X-Forwarded-For header only when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/enable_real_ip.go#L40) +- [should not trust X-Forwarded-For header when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/enable_real_ip.go#L78) +### [use-forwarded-headers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/forwarded_headers.go#L31) +- [should trust X-Forwarded headers when setting is true](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/forwarded_headers.go#L41) +- [should not trust X-Forwarded headers when setting is false](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/forwarded_headers.go#L93) +### [Geoip2](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/geoip2.go#L36) +- [should include geoip2 line in config when enabled and db file exists](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/geoip2.go#L45) +- [should only allow requests from specific countries](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/geoip2.go#L69) +### [[Security] block-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_access_block.go#L28) +- [should block CIDRs defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_access_block.go#L38) +- [should block User-Agents defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_access_block.go#L55) +- [should block Referers defined in the ConfigMap](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_access_block.go#L88) +### [[Security] global-auth-url](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L39) +- [should return status code 401 when request any protected service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L91) +- [should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L107) +- [should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L130) +- [should still return status code 200 after auth backend is deleted using cache](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L158) +- [user retains cookie by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L322) +- [user does not retain cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L333) +- [user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_external_auth.go#L344) +### [global-options](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L28) +- [should have worker_rlimit_nofile option](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L31) +- [should have worker_rlimit_nofile option and be independent on amount of worker processes](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/global_options.go#L37) +### [settings-global-rate-limit](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/globalratelimit.go#L30) +- [generates correct NGINX configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/globalratelimit.go#L38) +### [gzip](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L29) +- [should be disabled by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L32) +- [should be enabled with default settings](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L39) +- [should set gzip_comp_level to 4](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L56) +- [should set gzip_disable to msie6](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L67) +- [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L78) +- [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/gzip.go#L89) +### [hash size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L27) +- [should set server_names_hash_bucket_size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L39) +- [should set server_names_hash_max_size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L47) +- [should set proxy-headers-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L57) +- [should set proxy-headers-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L65) +- [should set variables-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L75) +- [should set variables-hash-max-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L83) +- [should set vmap-hash-bucket-size](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/hash-size.go#L93) +### [[Flag] ingress-class](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L41) +- [should ignore Ingress with a different class annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L70) +- [should ignore Ingress with different controller class](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L106) +- [should accept both Ingresses with default IngressClassName and IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L134) +- [should ignore Ingress without IngressClass configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L166) +- [should delete Ingress when class is removed](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L194) +- [should serve Ingress when class is added](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L259) +- [should serve Ingress when class is updated between annotation and ingressClassName](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L325) +- [should ignore Ingress with no class and accept the correctly configured Ingresses](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L414) +- [should watch Ingress with no class and ignore ingress with a different class](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L482) +- [should watch Ingress that uses the class name even if spec is different](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L538) +- [should watch Ingress with correct annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L628) +- [should ignore Ingress with only IngressClassName](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ingress_class.go#L648) +### [keep-alive keep-alive-requests](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L28) +- [should set keepalive_timeout](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L40) +- [should set keepalive_requests](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L48) +- [should set keepalive connection to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L58) +- [should set keep alive connection timeout to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L68) +- [should set keepalive time to upstream server](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L78) +- [should set the request count to upstream server through one keep alive connection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/keep-alive.go#L88) +### [Configmap - limit-rate](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/limit_rate.go#L28) +- [Check limit-rate config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/limit_rate.go#L36) +### [[Flag] custom HTTP and HTTPS ports](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/listen_nondefault_ports.go#L30) +- [should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/listen_nondefault_ports.go#L45) +- [should set X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/listen_nondefault_ports.go#L65) +- [should set the X-Forwarded-Port header to 443](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/listen_nondefault_ports.go#L93) +### [log-format-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L28) +- [should not configure log-format escape by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L39) +- [should enable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L46) +- [should disable the log-format-escape-json](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L54) +- [should enable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L62) +- [should disable the log-format-escape-none](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L70) +- [log-format-escape-json enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L80) +- [log-format default escape](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L103) +- [log-format-escape-none enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/log-format.go#L126) +### [[Lua] lua-shared-dicts](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/lua_shared_dicts.go#L26) +- [configures lua shared dicts](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/lua_shared_dicts.go#L29) +### [main-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/main_snippet.go#L27) +- [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/main_snippet.go#L31) +### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) +- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) +### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/multi_accept.go#L27) +- [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/multi_accept.go#L31) +- [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/multi_accept.go#L39) +- [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/multi_accept.go#L49) +### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/namespace_selector.go#L30) +- [should ignore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/namespace_selector.go#L62) +### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_auth_locations.go#L33) +- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_auth_locations.go#L54) +- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_auth_locations.go#L68) +- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_auth_locations.go#L82) +### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_tls_redirect_locations.go#L27) +- [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/no_tls_redirect_locations.go#L30) +### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ocsp/ocsp.go#L42) +- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ocsp/ocsp.go#L49) +### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L39) +- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L49) +- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L62) +- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L76) +- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L91) +- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentelemetry.go#L106) +### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L52) +- [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L62) +- [should exists opentracing directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L75) +- [should include opentracing_trust_incoming_span off directive when disabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L89) +- [should not exists opentracing_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L104) +- [should exists opentracing_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L119) +- [should not exists opentracing_location_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L134) +- [should exists opentracing_location_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L149) +- [should enable opentracing using zipkin](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L164) +- [should enable opentracing using jaeger](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L176) +- [should enable opentracing using jaeger with sampler host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L188) +- [should propagate the w3c header when configured with jaeger](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L201) +- [should enable opentracing using jaeger with an HTTP endpoint](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L232) +- [should enable opentracing using datadog](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/opentracing.go#L245) +### [plugins](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/plugins.go#L28) +- [should exist a x-hello-world header](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/plugins.go#L35) +### [[Security] Pod Security Policies](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/pod_security_policy.go#L41) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/pod_security_policy.go#L44) +### [[Security] Pod Security Policies with volumes](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/pod_security_policy_volumes.go#L37) +- [should be running with a Pod Security Policy](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/pod_security_policy_volumes.go#L40) +### [proxy-connect-timeout](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L29) +- [should set valid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L37) +- [should not set invalid proxy timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_connect_timeout.go#L53) +### [Dynamic $proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_host.go#L28) +- [should exist a proxy_host](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_host.go#L36) +- [should exist a proxy_host using the upstream-vhost annotation value](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_host.go#L65) +### [proxy-next-upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_next_upstream.go#L28) +- [should build proxy next upstream using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_next_upstream.go#L36) +### [use-proxy-protocol](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_protocol.go#L38) +- [should respect port passed by the PROXY Protocol](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_protocol.go#L48) +- [should respect proto passed by the PROXY Protocol server port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_protocol.go#L85) +- [should enable PROXY Protocol for HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_protocol.go#L121) +- [should enable PROXY Protocol for TCP](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_protocol.go#L164) +### [proxy-read-timeout](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_read_timeout.go#L29) +- [should set valid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_read_timeout.go#L37) +- [should not set invalid proxy read timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_read_timeout.go#L53) +### [proxy-send-timeout](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_send_timeout.go#L29) +- [should set valid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_send_timeout.go#L37) +- [should not set invalid proxy send timeouts using configmap values](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/proxy_send_timeout.go#L53) +### [reuse-port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/reuse-port.go#L27) +- [reuse port should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/reuse-port.go#L38) +- [reuse port should be disabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/reuse-port.go#L44) +- [reuse port should be enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/reuse-port.go#L52) +### [configmap server-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_snippet.go#L28) +- [should add value of server-snippet setting to all ingress config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_snippet.go#L35) +- [should add global server-snippet and drop annotations per admin config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_snippet.go#L98) +### [server-tokens](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_tokens.go#L29) +- [should not exists Server header in the response](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_tokens.go#L38) +- [should exists Server header in the response when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/server_tokens.go#L50) +### [ssl-ciphers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_ciphers.go#L28) +- [Add ssl ciphers](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_ciphers.go#L31) +### [[Flag] enable-ssl-passthrough](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_passthrough.go#L36) +### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_passthrough.go#L55) +- [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_passthrough.go#L56) +- [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/ssl_passthrough.go#L78) +### [configmap stream-snippet](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/stream_snippet.go#L35) +- [should add value of stream-snippet via config map to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/stream_snippet.go#L42) +### [[SSL] TLS protocols, ciphers and headers)](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L31) +- [setting cipher suite](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L65) +- [setting max-age parameter](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L109) +- [setting includeSubDomains parameter](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L125) +- [setting preload parameter](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L144) +- [overriding what's set from the upstream](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L164) +- [should not use ports during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L186) +- [should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/tls.go#L204) +### [annotation validations](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/validations/validations.go#L30) +- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/validations/validations.go#L33) +- [should allow ingress based on their risk on webhooks](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/settings/validations/validations.go#L68) +### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ssl/http_redirect.go#L29) +- [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ssl/http_redirect.go#L36) +### [[SSL] secret update](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ssl/secret_update.go#L33) +- [should not appear references to secret updates not used in ingress rules](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ssl/secret_update.go#L40) +- [should return the fake SSL certificate if the secret is invalid](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ssl/secret_update.go#L83) +### [[Status] status update](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/status/update.go#L38) +- [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/status/update.go#L43) +### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L38) +- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L46) +- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L80) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file From 36d5bbb92797a59ed33db0c0a99b5894829e7d1f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Sep 2023 04:56:32 -0700 Subject: [PATCH 357/822] Bump docker/setup-qemu-action from 2.2.0 to 3.0.0 (#10426) Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.2.0 to 3.0.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/2b82ce82d56a2a04d2637cd93a637ae1b359c0a7...68827325e0b33c7199eb31dd4e31fbe9023e06e3) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index bfba95cf4..e94d8eb53 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -100,7 +100,7 @@ jobs: check-latest: true - name: Set up QEMU - uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0 + uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 - name: Set up Docker Buildx id: buildx From e80521ee88ed263c4d7153d48dfb85dd84bcbd9d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Sep 2023 05:06:31 -0700 Subject: [PATCH 358/822] Bump goreleaser/goreleaser-action from 4.6.0 to 5.0.0 (#10423) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 4.6.0 to 5.0.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/5fdedb94abba051217030cc86d4523cf3f02243d...7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 33f5a4dc3..5fbbfe0b1 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -26,7 +26,7 @@ jobs: check-latest: true - name: Run GoReleaser - uses: goreleaser/goreleaser-action@5fdedb94abba051217030cc86d4523cf3f02243d # v4.6.0 + uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0 with: version: latest args: release --clean From 68afabbb601b2fda400523e8f083c5bd0a48619a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Sep 2023 05:26:32 -0700 Subject: [PATCH 359/822] Bump docker/setup-buildx-action from 2.10.0 to 3.0.0 (#10424) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2.10.0 to 3.0.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/885d1462b80bc1c1c7f0b00334ad271f09369c55...f95db51fddba0c2d1ec667646a06c2ce06100226) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e94d8eb53..225e96330 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -104,7 +104,7 @@ jobs: - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0 + uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 with: version: latest From 64e55d461fe1839931dd86008e86d06b8661b499 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Sep 2023 06:40:33 -0700 Subject: [PATCH 360/822] Bump actions/checkout from 3.5.3 to 4.0.0 (#10425) * Bump actions/checkout from 3.5.3 to 4.0.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.3 to 4.0.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3.5.3...3df4ab11eba7bda6032a0b82a6bb43b11571feac) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] * fix vesion comments Signed-off-by: cpanato --------- Signed-off-by: dependabot[bot] Signed-off-by: cpanato Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: cpanato --- .github/workflows/ci.yaml | 18 +++++++++--------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 9 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 225e96330..efed2ba46 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -69,7 +69,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Set up Go id: go @@ -90,7 +90,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Set up Go id: go @@ -155,7 +155,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Setup Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 @@ -230,7 +230,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -278,7 +278,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -329,7 +329,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -373,7 +373,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -446,7 +446,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 58c36a2f2..57874e9da 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: 'Dependency Review' uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index d4b81e62a..4f1279731 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 557c00210..c32f8e729 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Set up Go id: go diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 5b0f98f1b..e855566de 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 154ab6e47..2e031361b 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 5fbbfe0b1..f0c29f02f 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 1cd9d0d39..268914f2c 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 253d36690..1b8ea4160 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 - shell: bash id: test From fcda809ab034fffd14d8ff9b39441b2d12da420e Mon Sep 17 00:00:00 2001 From: Thomas Burguiere Date: Mon, 18 Sep 2023 17:28:32 +0200 Subject: [PATCH 361/822] fix path to faq.md in examples/rewrite/README.md (#10383) --- docs/examples/rewrite/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/examples/rewrite/README.md b/docs/examples/rewrite/README.md index aadcc1e4b..16889e0bc 100644 --- a/docs/examples/rewrite/README.md +++ b/docs/examples/rewrite/README.md @@ -31,7 +31,7 @@ Rewriting can be controlled using the following annotations: [Captured groups](https://www.regular-expressions.info/refcapture.html) are saved in numbered placeholders, chronologically, in the form `$1`, `$2` ... `$n`. These placeholders can be used as parameters in the `rewrite-target` annotation. !!! note - Please see the [FAQ](../faq.md#validation-of-path) for Validation Of __`path`__ + Please see the [FAQ](../../faq.md#validation-of-path) for Validation Of __`path`__ Create an Ingress rule with a rewrite annotation: From 82e24cb3991707838e0f864289f9dd3ff95ef618 Mon Sep 17 00:00:00 2001 From: arukiidou Date: Fri, 22 Sep 2023 20:08:50 +0900 Subject: [PATCH 362/822] Helm - Fix Chart.yaml - add license annotations, add type keyword, remove gotpl (#10287) * Helm - add license annotations, add type keyword, remove gotpl Signed-off-by: junya koyama * Helm - run helm-docs Signed-off-by: junya koyama --------- Signed-off-by: junya koyama --- charts/ingress-nginx/Chart.yaml | 3 ++- charts/ingress-nginx/README.md | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index b692069a1..155acb4f9 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -5,12 +5,12 @@ annotations: - "[helm] configure allow to configure hostAliases (#10180)" - "[helm] pass service annotations through helm tpl engine (#10084)" - "Update Ingress-Nginx version controller-v1.9.0-beta.0" + artifacthub.io/license: Apache-2.0 artifacthub.io/prerelease: "true" apiVersion: v2 appVersion: 1.9.0-beta.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -engine: gotpl home: https://github.com/kubernetes/ingress-nginx icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png keywords: @@ -24,4 +24,5 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx +type: application version: 4.8.0-beta.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index aa489a65b..988a4c7d7 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.8.0-beta.0](https://img.shields.io/badge/Version-4.8.0--beta.0-informational?style=flat-square) ![AppVersion: 1.9.0-beta.0](https://img.shields.io/badge/AppVersion-1.9.0--beta.0-informational?style=flat-square) +![Version: 4.8.0-beta.0](https://img.shields.io/badge/Version-4.8.0--beta.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.0-beta.0](https://img.shields.io/badge/AppVersion-1.9.0--beta.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. From 8ab35777f639d132921a5fba4a23fcc609692f4a Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sat, 23 Sep 2023 13:45:00 -0300 Subject: [PATCH 363/822] Fix release notes on helm (#10434) --- magefiles/steps/helm.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/magefiles/steps/helm.go b/magefiles/steps/helm.go index b4cdc6d81..b53283f78 100644 --- a/magefiles/steps/helm.go +++ b/magefiles/steps/helm.go @@ -20,6 +20,7 @@ import ( "bytes" "fmt" "os" + "strings" semver "github.com/blang/semver/v4" "github.com/helm/helm/pkg/chartutil" @@ -107,10 +108,10 @@ func updateChartReleaseNotes(releasesNotes []string) { utils.Info("HELM Updating the Chart Release notes") chart, err := chartutil.LoadChartfile(HelmChartPath) utils.CheckIfError(err, "HELM Could not Load Chart to update release notes %s", HelmChartPath) - var releaseNoteString string for i := range releasesNotes { - releaseNoteString = fmt.Sprintf("%s - \"%s\"\n", releaseNoteString, releasesNotes[i]) + releasesNotes[i] = fmt.Sprintf("- %q", releasesNotes[i]) } + releaseNoteString := strings.Join(releasesNotes, "\n") utils.Info("HELM Release note string %s", releaseNoteString) chart.Annotations["artifacthub.io/changes"] = releaseNoteString err = chartutil.SaveChartfile(HelmChartPath, chart) From 6107346590f1f7e64749e0977deb4f639e145a17 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sat, 23 Sep 2023 17:46:56 -0300 Subject: [PATCH 364/822] Release v1.9.0 (#10433) --- changelog/Changelog-1.9.0.md | 93 +++++++++++++++++++ charts/ingress-nginx/Chart.yaml | 12 +-- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.8.0.md | 13 +++ charts/ingress-nginx/values.yaml | 6 +- deploy/static/provider/aws/deploy.yaml | 44 ++++----- .../aws/nlb-with-tls-termination/deploy.yaml | 44 ++++----- deploy/static/provider/baremetal/deploy.yaml | 44 ++++----- deploy/static/provider/cloud/deploy.yaml | 44 ++++----- deploy/static/provider/do/deploy.yaml | 44 ++++----- deploy/static/provider/exoscale/deploy.yaml | 44 ++++----- deploy/static/provider/kind/deploy.yaml | 44 ++++----- deploy/static/provider/oracle/deploy.yaml | 44 ++++----- deploy/static/provider/scw/deploy.yaml | 44 ++++----- 14 files changed, 316 insertions(+), 212 deletions(-) create mode 100644 changelog/Changelog-1.9.0.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.8.0.md diff --git a/changelog/Changelog-1.9.0.md b/changelog/Changelog-1.9.0.md new file mode 100644 index 000000000..cd5396f05 --- /dev/null +++ b/changelog/Changelog-1.9.0.md @@ -0,0 +1,93 @@ +# Changelog + +### 1.9.0 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.9.0@sha256:d9fa7a136de2104fb2ecfcf1666978bfab927f4a125b75c0fb471e6104366ab5 + +### All Changes: + +* Rework mage (#10418) +* Start release of v1.9.0 beta0 (#10407) +* Update k8s versions on CI (#10406) +* Add a flag to enable or disable aio_write (#10394) +* Update external-articles.md - advanced setup with GKE/Cloud Armor/IAP (#10372) +* Fix e2e test suite doc (#10396) +* Disable user snippets per default (#10393) +* Deployment/DaemonSet: Fix templating & value. (#10240) +* Fix deferInLoop error (#10387) +* Remove gofmt (#10385) +* Deployment/DaemonSet: Template `topologySpreadConstraints`. (#10259) +* release notes 1.8.2 (#10389) +* fix: remove curl on base container #9716 (#10306) +* Fix http default backend test (#10382) +* Add golangci github action and replace the deprecated golint (#10187) +* BUGFIX incorrect indentation (#10254) +* Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57.0 (#10352) +* fix: path with sepecial characters warning #10281 #10308 (#10330) +* Fix golangci-lint errors (#10196) +* chore(build): Fix Run make dev-env syntax error (#10294) +* Add firewall configuration to quick start documentation (#10357) +* Making auth access logs optional (#10335) +* Fix “dev-env” Makefile target to work with kubectl 1.28+ (#10350) +* fix: update action file to auto release plugin #10197 (#10321) +* Use gzip instead of pigz in CI (#10348) +* Disable Modsecurity from internal processing which affects large ingresses (#10316) +* fix: add /etc/mime.types #10309 (#10310) +* Remove curl dependencies in e2e tests #9716 (#10296) +* docs: swap explanation to match example (#10220) +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* Updated index.md - Fix typos (#10256) +* Handle request_id variable correctly in auth requests (#9219) +* test kind updates (#10272) +* promote distroless otel init image (#10257) +* [helm] configure allow to configure hostAliases (#10180) +* Add rolling update strategy to each static deployment file (#10129) +* Implement annotation validation (#9673) +* Golang 1.20.6 for test runner (#10230) +* [helm] pass service annotations through helm tpl engine (#10084) +* Ignore deployment template's replicas if KEDA is enabled (#9534) +* chore: bump OpenResty to v1.21.4.2 (#10219) +* Scanning port 10247 lead to tcp connection 502 error (#9815) +* revise Datadog trace sampling configuration (#10151) +* Clarify TCP/UDP service docs (#10146) +* Exposed continent data as variable in the case of Maxmind city files (#10157) +* Cleanup errcheck code (#10166) +* Fix golang-ci linter errors (#10128) +* Deprecate and remove AJP support (#10158) +* release notes 1.8.1 (#10161) + +### Dependencies updates: +* Bump github.com/onsi/ginkgo/v2 from 2.9.5 to 2.12.0 (#10355) +* Bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#10399) +* Bump actions/setup-go from 4.0.1 to 4.1.0 (#10403) +* Bump goreleaser/goreleaser-action from 4.4.0 to 4.6.0 (#10402) +* Bump actions/upload-artifact from 3.1.2 to 3.1.3 (#10404) +* Bump golangci/golangci-lint-action from 3.6.0 to 3.7.0 (#10400) +* Bump google.golang.org/grpc from 1.57.0 to 1.58.0 (#10398) +* Bump actions/dependency-review-action from 3.0.8 to 3.1.0 (#10401) +* Bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4 (#10373) +* Bump github.com/cyphar/filepath-securejoin in /magefiles (#10374) +* Bump Go version to 1.21.1 (#10377) +* Bump Go version to 1.21.1 on testrunner (#10378) +* Bump aquasecurity/trivy-action from 0.11.2 to 0.12.0 (#10365) +* Bump docker/setup-buildx-action from 2.9.1 to 2.10.0 (#10353) +* Bump actions/checkout from 3.5.3 to 3.6.0 (#10354) +* Bump actions/dependency-review-action from 3.0.6 to 3.0.8 (#10333) +* Bump actions/setup-go from 4.0.1 to 4.1.0 (#10313) +* Bump securego/gosec from 2.16.0 to 2.17.0 (#10332) +* Bump goreleaser/goreleaser-action from 4.3.0 to 4.4.0 (#10314) +* Bump github.com/opencontainers/runc from 1.1.8 to 1.1.9 (#10298) +* Bump k8s.io/component-base from 0.26.4 to 0.27.4 (Replace Topology Aware Hints with Topology Aware Routing) (#10282) +* Bump google.golang.org/grpc from 1.56.2 to 1.57.0 (#10258) +* Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#10280) +* Bump github.com/opencontainers/runc from 1.1.7 to 1.1.8 (#10244) +* Bump google.golang.org/grpc from 1.56.1 to 1.56.2 (#10193) +* Bump docker/setup-buildx-action from 2.9.0 to 2.9.1 (#10207) +* Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#10192) +* Bump docker/setup-buildx-action from 2.8.0 to 2.9.0 (#10191) +* Bump docker/setup-buildx-action from 2.7.0 to 2.8.0 (#10165) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-release-1.8...controller-controller-v1.9.0 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 155acb4f9..058e4c862 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,14 +1,13 @@ annotations: - artifacthub.io/changes: |2 + artifacthub.io/changes: | - "ci(helm): fix Helm Chart release action 422 error (#10237)" - "helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249)" - "[helm] configure allow to configure hostAliases (#10180)" - "[helm] pass service annotations through helm tpl engine (#10084)" - - "Update Ingress-Nginx version controller-v1.9.0-beta.0" - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" + - "Update Ingress-Nginx version controller-v1.9.0" + artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.9.0-beta.0 +appVersion: 1.9.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer home: https://github.com/kubernetes/ingress-nginx @@ -24,5 +23,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -type: application -version: 4.8.0-beta.0 +version: 4.8.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 988a4c7d7..35e74268d 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.8.0-beta.0](https://img.shields.io/badge/Version-4.8.0--beta.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.0-beta.0](https://img.shields.io/badge/AppVersion-1.9.0--beta.0-informational?style=flat-square) +![Version: 4.8.0](https://img.shields.io/badge/Version-4.8.0-informational?style=flat-square) ![AppVersion: 1.9.0](https://img.shields.io/badge/AppVersion-1.9.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -315,13 +315,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9"` | | -| controller.image.digestChroot | string | `"sha256:60b4c95349ce2a81a3b2a76423ee483b847b89d3fa8cb148468434f606f3fa0c"` | | +| controller.image.digest | string | `"sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60"` | | +| controller.image.digestChroot | string | `"sha256:d9fa7a136de2104fb2ecfcf1666978bfab927f4a125b75c0fb471e6104366ab5"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.9.0-beta.0"` | | +| controller.image.tag | string | `"v1.9.0"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.8.0.md b/charts/ingress-nginx/changelog/Changelog-4.8.0.md new file mode 100644 index 000000000..af8f1241f --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.8.0.md @@ -0,0 +1,13 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.0 + +* ci(helm): fix Helm Chart release action 422 error (#10237) +* helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249) +* [helm] configure allow to configure hostAliases (#10180) +* [helm] pass service annotations through helm tpl engine (#10084) +* Update Ingress-Nginx version controller-v1.9.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.2...helm-chart-4.8.0 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 0b6091bb7..d476f8088 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -24,9 +24,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.9.0-beta.0" - digest: sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 - digestChroot: sha256:60b4c95349ce2a81a3b2a76423ee483b847b89d3fa8cb148468434f606f3fa0c + tag: "v1.9.0" + digest: sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + digestChroot: sha256:d9fa7a136de2104fb2ecfcf1666978bfab927f4a125b75c0fb471e6104366ab5 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index a5247d8be..854d50e37 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index a5e35c02a..28dbe82a5 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -431,7 +431,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -455,7 +455,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -530,7 +530,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -541,7 +541,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -577,7 +577,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -588,7 +588,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 4a0914121..a757ff71e 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -608,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 13ec5db40..9c55fb0de 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 8ed58f056..c44569512 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index 8fbade4e2..5ddda1a2f 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +523,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +534,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -570,7 +570,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +581,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -632,7 +632,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index 3d12be236..e26cdc070 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index fc1ceb566..8733ee83b 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 0d4f4baf0..fceda01a7 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0-beta.0@sha256:531377e4cc9dc62af40d742402222603259673f5a755a64d74122f256dfad8f9 + image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0-beta.0 + app.kubernetes.io/version: 1.9.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: From c3194dd3880c03db6477e8b146d9ce1b80bb523f Mon Sep 17 00:00:00 2001 From: Rashad Mammadli Date: Sun, 24 Sep 2023 16:54:56 +0200 Subject: [PATCH 365/822] upgrade owasp modsecurity core rule set to v3.3.5 (#10323) --- images/nginx/rootfs/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index db1eebfb8..e35fde7f4 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -63,7 +63,7 @@ export MODSECURITY_VERSION=1.0.3 export MODSECURITY_LIB_VERSION=e9a7ba4a60be48f761e0328c6dfcc668d70e35a0 # Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.2...v3.3/master -export OWASP_MODSECURITY_CRS_VERSION=v3.3.4 +export OWASP_MODSECURITY_CRS_VERSION=v3.3.5 # Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.25...master export LUA_NGX_VERSION=0.10.25 From 0b0ce031ac11b2738f85f42d38fdd1fe10fde120 Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Sun, 24 Sep 2023 17:02:57 +0200 Subject: [PATCH 366/822] Chart: Rework network policies. (#10238) --- charts/ingress-nginx/README.md | 3 +- .../job-patch/networkpolicy.yaml | 10 ++--- .../templates/controller-networkpolicy.yaml | 45 +++++++++++++++++++ .../controller-webhooks-networkpolicy.yaml | 19 -------- .../default-backend-networkpolicy.yaml | 25 +++++++++++ charts/ingress-nginx/values.yaml | 11 ++++- 6 files changed, 87 insertions(+), 26 deletions(-) create mode 100644 charts/ingress-nginx/templates/controller-networkpolicy.yaml delete mode 100644 charts/ingress-nginx/templates/controller-webhooks-networkpolicy.yaml create mode 100644 charts/ingress-nginx/templates/default-backend-networkpolicy.yaml diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 35e74268d..40ee83137 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -249,7 +249,6 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.admissionWebhooks.key | string | `"/usr/local/certificates/key"` | | | controller.admissionWebhooks.labels | object | `{}` | Labels to be added to admission webhooks | | controller.admissionWebhooks.namespaceSelector | object | `{}` | | -| controller.admissionWebhooks.networkPolicyEnabled | bool | `false` | | | controller.admissionWebhooks.objectSelector | object | `{}` | | | controller.admissionWebhooks.patch.enabled | bool | `true` | | | controller.admissionWebhooks.patch.image.digest | string | `"sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"` | | @@ -374,6 +373,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | | controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | | controller.name | string | `"controller"` | | +| controller.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | | controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | controller.opentelemetry.enabled | bool | `false` | | @@ -472,6 +472,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | defaultBackend.minAvailable | int | `1` | | | defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | | defaultBackend.name | string | `"defaultbackend"` | | +| defaultBackend.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not | | defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # | | defaultBackend.podAnnotations | object | `{}` | Annotations to be added to default backend pods # | | defaultBackend.podLabels | object | `{}` | Labels to add to the pod container metadata | diff --git a/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml b/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml index 08b32257c..d59da7c9c 100644 --- a/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml +++ b/charts/ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.networkPolicyEnabled }} +{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}} apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -16,11 +16,11 @@ metadata: spec: podSelector: matchLabels: - {{- include "ingress-nginx.labels" . | nindent 6 }} + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} app.kubernetes.io/component: admission-webhook policyTypes: - - Ingress - - Egress + - Ingress + - Egress egress: - - {} + - {} {{- end }} diff --git a/charts/ingress-nginx/templates/controller-networkpolicy.yaml b/charts/ingress-nginx/templates/controller-networkpolicy.yaml new file mode 100644 index 000000000..15d6012f7 --- /dev/null +++ b/charts/ingress-nginx/templates/controller-networkpolicy.yaml @@ -0,0 +1,45 @@ +{{- if .Values.controller.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: controller + {{- with .Values.controller.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.controller.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: controller + policyTypes: + - Ingress + - Egress + ingress: + - ports: + {{- range $key, $value := .Values.controller.containerPort }} + - protocol: TCP + port: {{ $value }} + {{- end }} + {{- if .Values.controller.metrics.enabled }} + - protocol: TCP + port: {{ .Values.controller.metrics.port }} + {{- end }} + {{- if .Values.controller.admissionWebhooks.enabled }} + - protocol: TCP + port: {{ .Values.controller.admissionWebhooks.port }} + {{- end }} + {{- range $key, $value := .Values.tcp }} + - protocol: TCP + port: {{ $key }} + {{- end }} + {{- range $key, $value := .Values.udp }} + - protocol: UDP + port: {{ $key }} + {{- end }} + egress: + - {} +{{- end }} diff --git a/charts/ingress-nginx/templates/controller-webhooks-networkpolicy.yaml b/charts/ingress-nginx/templates/controller-webhooks-networkpolicy.yaml deleted file mode 100644 index f74c2fbf3..000000000 --- a/charts/ingress-nginx/templates/controller-webhooks-networkpolicy.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.controller.admissionWebhooks.enabled }} -{{- if .Values.controller.admissionWebhooks.networkPolicyEnabled }} - -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: {{ include "ingress-nginx.fullname" . }}-webhooks-allow - namespace: {{ .Release.Namespace }} -spec: - ingress: - - {} - podSelector: - matchLabels: - app.kubernetes.io/name: {{ include "ingress-nginx.name" . }} - policyTypes: - - Ingress - -{{- end }} -{{- end }} diff --git a/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml b/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml new file mode 100644 index 000000000..f3a012657 --- /dev/null +++ b/charts/ingress-nginx/templates/default-backend-networkpolicy.yaml @@ -0,0 +1,25 @@ +{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.networkPolicy.enabled }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + {{- include "ingress-nginx.labels" . | nindent 4 }} + app.kubernetes.io/component: default-backend + {{- with .Values.defaultBackend.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + podSelector: + matchLabels: + {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} + app.kubernetes.io/component: default-backend + policyTypes: + - Ingress + - Egress + ingress: + - ports: + - protocol: TCP + port: {{ .Values.defaultBackend.port }} +{{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index d476f8088..2541f268d 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -96,6 +96,10 @@ controller: http: 80 # -- 'hostPort' https port https: 443 + # NetworkPolicy for controller component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' electionID: "" ## This section refers to the creation of the IngressClass resource @@ -606,7 +610,6 @@ controller: labels: {} # -- Use an existing PSP instead of creating one existingPsp: "" - networkPolicyEnabled: false service: annotations: {} # clusterIP: "" @@ -872,6 +875,12 @@ defaultBackend: maxReplicas: 2 targetCPUUtilizationPercentage: 50 targetMemoryUtilizationPercentage: 50 + + # NetworkPolicy for default backend component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + service: annotations: {} # clusterIP: "" From fe4c15d7ba73986c8662920c0e9c0cec00872776 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 Sep 2023 05:00:58 -0700 Subject: [PATCH 367/822] Bump actions/checkout from 4.0.0 to 4.1.0 (#10441) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/3df4ab11eba7bda6032a0b82a6bb43b11571feac...8ade135a41bc03ea155e62e844d188df1ea18608) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 18 +++++++++--------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 9 files changed, 20 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index efed2ba46..b53ec3c46 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -42,7 +42,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -69,7 +69,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Set up Go id: go @@ -90,7 +90,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Set up Go id: go @@ -155,7 +155,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Setup Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 @@ -230,7 +230,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -278,7 +278,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -329,7 +329,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -373,7 +373,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -446,7 +446,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 57874e9da..c6e1d2f93 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: 'Dependency Review' uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 4f1279731..15ac29758 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index c32f8e729..a58850dd2 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Set up Go id: go diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index e855566de..837b95b71 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 2e031361b..de33d5b64 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index f0c29f02f..a1a185608 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 268914f2c..d066f5363 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 1b8ea4160..5f988be83 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - shell: bash id: test From f7b096488c4b94dfc20a5622acff44b1d183a190 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 Sep 2023 05:02:58 -0700 Subject: [PATCH 368/822] Bump google.golang.org/grpc from 1.58.1 to 1.58.2 (#10442) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.1 to 1.58.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.58.1...v1.58.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 63228c8ae..7643d4ef0 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.13.0 - google.golang.org/grpc v1.58.1 + google.golang.org/grpc v1.58.2 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index c5be5c64d..e5207da08 100644 --- a/go.sum +++ b/go.sum @@ -669,8 +669,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.58.1 h1:OL+Vz23DTtrrldqHK49FUOPHyY75rvFqJfXC84NYW58= -google.golang.org/grpc v1.58.1/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= +google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I= +google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 4bac1200bfe4c95f654ffb86bea18ce9fc1c8630 Mon Sep 17 00:00:00 2001 From: James Strong Date: Mon, 25 Sep 2023 15:48:12 -0400 Subject: [PATCH 369/822] Update README.md for release 1.9.0 (#10447) --- README.md | 38 ++++++++++++-------------------------- 1 file changed, 12 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index b6e2dafe7..34b898a54 100644 --- a/README.md +++ b/README.md @@ -26,43 +26,29 @@ If you encounter issues, review the [troubleshooting docs](docs/troubleshooting. ## Changelog -See [the list of releases](https://github.com/kubernetes/ingress-nginx/releases) to find out about feature changes. -For detailed changes for each release; please check the [Changelog.md](Changelog.md) file. -For detailed changes on the `ingress-nginx` helm chart, please check the following -[CHANGELOG.md](charts/ingress-nginx/CHANGELOG.md) file. +See [the list of releases](https://github.com/kubernetes/ingress-nginx/releases) for all changes. +For detailed changes for each release, please check the [changelog-$version.md](./changelog) file for the release version. +For detailed changes on the `ingress-nginx` helm chart, please check the changelog folder for a specific version +[CHANGELOG-$current-version.md](./charts/ingress-nginx/changelog) file. ### Supported Versions table Supported versions for the ingress-nginx project mean that we have completed E2E tests, and they are passing for -the versions listed. Ingress-Nginx versions may work on older versions but the project does not make that guarantee. +the versions listed. Ingress-Nginx versions **may** work on older versions, but the project does not make that guarantee. -| | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | -|:--:|-----------------------|------------------------------|----------------|---------------|--------------------| -| 🔄 | **v1.8.2** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | +| Supported | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | +|:--:|-----------------------|------------------------------|----------------|---------------|------------------------------| +| 🔄 | **v1.9.0** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | +| 🔄 | **v1.8.2** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.1** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.0** | 1.27,1.26, 1.25, 1.24 | 3.18.0 | 1.21.6 | 4.7.* | | 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | | 🔄 | **v1.7.0** | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | -| 🔄 | **v1.6.4** | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | 4.5.* | +| | **v1.6.4** | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | 4.5.* | | | v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | 4.4.* | | | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | 4.3.0 | | | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | 4.2.5 | | | v1.3.0 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.0 | 1.19.10† | 4.2.3 | -| | v1.2.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.6 | 1.19.10† | 4.1.4 | -| | v1.1.3 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.4 | 1.19.10† | 4.0.19 | -| | v1.1.2 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.18 | -| | v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.17 | -| | v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.13 | -| | v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.9 | -| | v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.6 | -| | v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.5 | -| | v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.3 | -| | v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.2 | -| | v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 | 4.0.1 | - - -† _This build is -[patched against CVE-2021-23017](https://github.com/openresty/openresty/commit/4b5ec7edd78616f544abc194308e0cf4b788725b#diff-42ef841dc27fe0b5aa2d06bd31308bb63a59cdcddcbcddd917248349d22020a3)._ See [this article](https://kubernetes.io/blog/2021/07/26/update-with-ingress-nginx/) if you want upgrade to the stable Ingress API. @@ -74,12 +60,12 @@ Thanks for taking the time to join our community and start contributing! - This project adheres to the [Kubernetes Community Code of Conduct](https://git.k8s.io/community/code-of-conduct.md). By participating in this project, you agree to abide by its terms. -- **Contributing**: Contributions of all kind are welcome! +- **Contributing**: Contributions of all kinds are welcome! - Read [`CONTRIBUTING.md`](CONTRIBUTING.md) for information about setting up your environment, the workflow that we expect, and instructions on the developer certificate of origin that we require. - Join our Kubernetes Slack channel for developer discussion : [#ingress-nginx-dev](https://kubernetes.slack.com/archives/C021E147ZA4). - - Submit GitHub issues for any feature enhancements, bugs or documentation problems. + - Submit GitHub issues for any feature enhancements, bugs, or documentation problems. - Please make sure to read the [Issue Reporting Checklist](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md#issue-reporting-guidelines) before opening an issue. Issues not conforming to the guidelines **may be closed immediately**. - Join our [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernetes.io/g/ingress-nginx-dev/c/ebbBMo-zX-w) From e2ee3346db6ce667c4b9e79c6944ba405c741db1 Mon Sep 17 00:00:00 2001 From: Stefan Lobbenmeier Date: Thu, 28 Sep 2023 17:38:34 +0200 Subject: [PATCH 370/822] Link configuration snippet to allow-snippet-annotations (#10456) --- docs/user-guide/nginx-configuration/annotations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index 877654d12..cd48c1f69 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -316,7 +316,7 @@ nginx.ingress.kubernetes.io/configuration-snippet: | more_set_headers "Request-Id: $req_id"; ``` -Be aware this can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. The recommended mitigation for this threat is to disable this feature, so it may not work for you. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. +Since version 1.9.0 this annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md/#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. ### Custom HTTP Errors From ae86c07298e9f910a904f671a97b54635c24cfb8 Mon Sep 17 00:00:00 2001 From: Stefan Lobbenmeier Date: Thu, 28 Sep 2023 18:02:34 +0200 Subject: [PATCH 371/822] Fix link from #10456 (#10458) --- docs/user-guide/nginx-configuration/annotations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index cd48c1f69..c2da56291 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -316,7 +316,7 @@ nginx.ingress.kubernetes.io/configuration-snippet: | more_set_headers "Request-Id: $req_id"; ``` -Since version 1.9.0 this annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md/#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. +Since version 1.9.0 this annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. ### Custom HTTP Errors From 1fbfcbd9078475f53f51c036d514dbe53d1efc35 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 28 Sep 2023 22:20:42 -0300 Subject: [PATCH 372/822] Accept backend protocol on any case (#10460) --- go.work.sum | 24 +++++++++++++++++++ .../ingress/controller/template/template.go | 2 +- test/e2e/annotations/backendprotocol.go | 15 ++++++++++++ 3 files changed, 40 insertions(+), 1 deletion(-) diff --git a/go.work.sum b/go.work.sum index 7eb8379b8..93c6eaa89 100644 --- a/go.work.sum +++ b/go.work.sum @@ -121,6 +121,7 @@ cloud.google.com/go/vpcaccess v1.7.1/go.mod h1:FogoD46/ZU+JUBX9D606X21EnxiszYi2t cloud.google.com/go/webrisk v1.9.1/go.mod h1:4GCmXKcOa2BZcZPn6DCEvE7HypmEJcJkr4mtM+sqYPc= cloud.google.com/go/websecurityscanner v1.6.1/go.mod h1:Njgaw3rttgRHXzwCB8kgCYqv5/rGpFCsBOvPbYgszpg= cloud.google.com/go/workflows v1.11.1/go.mod h1:Z+t10G1wF7h8LgdY/EmRcQY8ptBD/nvofaL6FqlET6g= +github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ= github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c= github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= @@ -129,6 +130,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw= +github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E= +github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA= github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= @@ -136,7 +139,11 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= +github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc= github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= +github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= +github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= @@ -144,6 +151,8 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go. github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g= github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE= github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= +github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= @@ -163,9 +172,13 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+ github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k= github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI= github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= +github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c= +github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y= +github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ= github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= @@ -173,12 +186,21 @@ github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47 github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM= github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= +github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI= github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= +github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= +github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= +github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= +github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= +github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= +github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE= +github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU= github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= @@ -242,6 +264,8 @@ google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBt google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k= +gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE= diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 4e51ac665..6702e08db 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -728,7 +728,7 @@ func buildProxyPass(_ string, b, loc interface{}) string { proxyPass := "proxy_pass" - switch location.BackendProtocol { + switch strings.ToUpper(location.BackendProtocol) { case autoHTTPProtocol: proto = "$scheme://" case httpsProtocol: diff --git a/test/e2e/annotations/backendprotocol.go b/test/e2e/annotations/backendprotocol.go index d0a08c767..0a181d3c7 100644 --- a/test/e2e/annotations/backendprotocol.go +++ b/test/e2e/annotations/backendprotocol.go @@ -48,6 +48,21 @@ var _ = framework.DescribeAnnotation("backend-protocol", func() { }) }) + ginkgo.It("should set backend protocol to https:// and use proxy_pass with lowercase annotation", func() { + host := backendProtocolHost + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/backend-protocol": "https", + } + + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations) + f.EnsureIngress(ing) + + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, "proxy_pass https://upstream_balancer;") + }) + }) + ginkgo.It("should set backend protocol to $scheme:// and use proxy_pass", func() { host := backendProtocolHost annotations := map[string]string{ From 362ec37778146520374e82c594d3aeae82c7f617 Mon Sep 17 00:00:00 2001 From: Nicolas Woerner <69248573+niwoerner@users.noreply.github.com> Date: Sun, 1 Oct 2023 20:18:44 +0200 Subject: [PATCH 373/822] images: upgrade to Alpine 3.18.4 (#10466) --- images/cfssl/rootfs/Dockerfile | 2 +- images/nginx/rootfs/Dockerfile | 4 ++-- images/opentelemetry/rootfs/Dockerfile | 2 +- rootfs/Dockerfile-chroot | 2 +- test/e2e-image/Dockerfile | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/images/cfssl/rootfs/Dockerfile b/images/cfssl/rootfs/Dockerfile index 89a5eef9c..4ad69d362 100644 --- a/images/cfssl/rootfs/Dockerfile +++ b/images/cfssl/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.18.2 +FROM alpine:3.18.4 RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index d5cd8c143..aba0ab70b 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -11,7 +11,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.18.2 as builder +FROM alpine:3.18.4 as builder COPY . / @@ -21,7 +21,7 @@ RUN apk update \ && /build.sh # Use a multi-stage build -FROM alpine:3.18.2 +FROM alpine:3.18.4 ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index 819c0d42c..b46b116e0 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -13,7 +13,7 @@ # limitations under the License. -FROM alpine:3.18.2 as base +FROM alpine:3.18.4 as base RUN mkdir -p /opt/third_party/install COPY . /opt/third_party/ diff --git a/rootfs/Dockerfile-chroot b/rootfs/Dockerfile-chroot index 945304ad2..09e0ba7ce 100644 --- a/rootfs/Dockerfile-chroot +++ b/rootfs/Dockerfile-chroot @@ -23,7 +23,7 @@ RUN apk update \ && apk upgrade \ && /chroot.sh -FROM alpine:3.18.2 +FROM alpine:3.18.4 ARG TARGETARCH ARG VERSION diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index 28609d23d..cd0bcb715 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -1,7 +1,7 @@ ARG E2E_BASE_IMAGE FROM ${E2E_BASE_IMAGE} AS BASE -FROM alpine:3.18.2 +FROM alpine:3.18.4 RUN apk update \ && apk upgrade && apk add -U --no-cache \ From 3a28016a6461d029253d9c6bb1c013f2d59efd5d Mon Sep 17 00:00:00 2001 From: James Strong Date: Sun, 1 Oct 2023 14:51:48 -0400 Subject: [PATCH 374/822] fix brotli build issues Signed-off-by: James Strong --- images/nginx/rootfs/build.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index e35fde7f4..dc1d12547 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -466,8 +466,10 @@ make install # Get Brotli source and deps cd "$BUILD_PATH" -git clone --depth=1 https://github.com/google/ngx_brotli.git +git clone --depth=100 https://github.com/google/ngx_brotli.git cd ngx_brotli +# https://github.com/google/ngx_brotli/issues/156 +git reset --hard 63ca02abdcf79c9e788d2eedcc388d2335902e52 git submodule init git submodule update From 24b139424dd632b02a40e64872ee3410f76297bf Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 1 Oct 2023 17:58:44 -0300 Subject: [PATCH 375/822] Release v1.9.1 --- changelog/Changelog-1.9.1.md | 19 ++++++ charts/ingress-nginx/Chart.yaml | 10 +-- charts/ingress-nginx/README.md | 8 +-- .../changelog/Changelog-4.8.1.md | 9 +++ charts/ingress-nginx/values.yaml | 8 +-- deploy/static/provider/aws/deploy.yaml | 67 +++++++++++++------ .../aws/nlb-with-tls-termination/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/baremetal/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/cloud/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/do/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/exoscale/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/kind/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/oracle/deploy.yaml | 67 +++++++++++++------ deploy/static/provider/scw/deploy.yaml | 67 +++++++++++++------ docs/e2e-tests.md | 11 +-- 15 files changed, 449 insertions(+), 219 deletions(-) create mode 100644 changelog/Changelog-1.9.1.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.8.1.md diff --git a/changelog/Changelog-1.9.1.md b/changelog/Changelog-1.9.1.md new file mode 100644 index 000000000..07790098f --- /dev/null +++ b/changelog/Changelog-1.9.1.md @@ -0,0 +1,19 @@ +# Changelog + +### 1.9.1 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.9.1@sha256:2ac744ef08850ee86ad7162451a6879f47c1a41c6a757f6b6f913c52103b8836 + +### All Changes: + +* upgrade owasp modsecurity core rule set to v3.3.5 (#10437) +* Start v1.9.1 release (#10463) +* Accept backend protocol on any case (#10461) +* Chart: Rework network policies. (#10438) + +### Dependencies updates: +* Bump google.golang.org/grpc from 1.58.0 to 1.58.1 (#10436) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.9.0...controller-controller-v1.9.1 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 058e4c862..d49b3f7cc 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,13 +1,9 @@ annotations: artifacthub.io/changes: | - - "ci(helm): fix Helm Chart release action 422 error (#10237)" - - "helm: Use .Release.Namespace as default for ServiceMonitor namespace (#10249)" - - "[helm] configure allow to configure hostAliases (#10180)" - - "[helm] pass service annotations through helm tpl engine (#10084)" - - "Update Ingress-Nginx version controller-v1.9.0" + - "Update Ingress-Nginx version controller-v1.9.1" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.9.0 +appVersion: 1.9.1 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer home: https://github.com/kubernetes/ingress-nginx @@ -23,4 +19,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.8.0 +version: 4.8.1 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 40ee83137..9016e9290 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.8.0](https://img.shields.io/badge/Version-4.8.0-informational?style=flat-square) ![AppVersion: 1.9.0](https://img.shields.io/badge/AppVersion-1.9.0-informational?style=flat-square) +![Version: 4.8.1](https://img.shields.io/badge/Version-4.8.1-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -314,13 +314,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60"` | | -| controller.image.digestChroot | string | `"sha256:d9fa7a136de2104fb2ecfcf1666978bfab927f4a125b75c0fb471e6104366ab5"` | | +| controller.image.digest | string | `"sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25"` | | +| controller.image.digestChroot | string | `"sha256:2ac744ef08850ee86ad7162451a6879f47c1a41c6a757f6b6f913c52103b8836"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.9.0"` | | +| controller.image.tag | string | `"v1.9.1"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.8.1.md b/charts/ingress-nginx/changelog/Changelog-4.8.1.md new file mode 100644 index 000000000..53a4493de --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.8.1.md @@ -0,0 +1,9 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.1 + +* Update Ingress-Nginx version controller-v1.9.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.0...helm-chart-4.8.1 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 2541f268d..196e14017 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -24,9 +24,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.9.0" - digest: sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 - digestChroot: sha256:d9fa7a136de2104fb2ecfcf1666978bfab927f4a125b75c0fb471e6104366ab5 + tag: "v1.9.1" + digest: sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + digestChroot: sha256:2ac744ef08850ee86ad7162451a6879f47c1a41c6a757f6b6f913c52103b8836 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 @@ -875,12 +875,10 @@ defaultBackend: maxReplicas: 2 targetCPUUtilizationPercentage: 50 targetMemoryUtilizationPercentage: 50 - # NetworkPolicy for default backend component. networkPolicy: # -- Enable 'networkPolicy' or not enabled: false - service: annotations: {} # clusterIP: "" diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 854d50e37..6bfeeefcb 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -614,11 +614,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -627,7 +650,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 28dbe82a5..a132f38e1 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -431,7 +431,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -455,7 +455,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -530,7 +530,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -541,7 +541,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -577,7 +577,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -588,7 +588,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -626,11 +626,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -639,7 +662,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index a757ff71e..b35870f51 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -608,11 +608,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -621,7 +644,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 9c55fb0de..f1a023d23 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -610,11 +610,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -623,7 +646,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index c44569512..21d9e7d79 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -613,11 +613,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -626,7 +649,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index 5ddda1a2f..720d6a855 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +523,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +534,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -570,7 +570,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +581,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -619,11 +619,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -632,7 +655,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index e26cdc070..f162a4ce0 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -620,11 +620,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -633,7 +656,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index 8733ee83b..8aa6a4c55 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -614,11 +614,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -627,7 +650,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index fceda01a7..2ffcd28f8 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.0@sha256:c15d1a617858d90fb8f8a2dd60b0676f2bb85c54e3ed11511794b86ec30c8c60 + image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission-patch spec: containers: @@ -613,11 +613,34 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: nginx spec: controller: k8s.io/ingress-nginx --- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.9.1 + name: ingress-nginx-admission + namespace: ingress-nginx +spec: + egress: + - {} + podSelector: + matchLabels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + policyTypes: + - Ingress + - Egress +--- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: @@ -626,7 +649,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.0 + app.kubernetes.io/version: 1.9.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index bd3936801..0a6ca0a7d 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -83,10 +83,11 @@ Do not try to edit it manually. - [should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/authtls.go#L325) ### [backend-protocol](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L29) - [should set backend protocol to https:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L36) -- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L51) -- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L66) -- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L81) -- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L96) +- [should set backend protocol to https:// and use proxy_pass with lowercase annotation](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L51) +- [should set backend protocol to $scheme:// and use proxy_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L66) +- [should set backend protocol to grpc:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L81) +- [should set backend protocol to grpcs:// and use grpc_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L96) +- [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/backendprotocol.go#L111) ### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L36) - [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L45) - [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/annotations/canary.go#L89) @@ -554,4 +555,4 @@ Do not try to edit it manually. ### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L38) - [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L46) - [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L169) From fb64ba6384472ec574e07cacd018bce27d3eab34 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 2 Oct 2023 04:22:47 -0700 Subject: [PATCH 376/822] Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 (#10472) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.16.0 to 1.17.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.16.0...v1.17.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 7643d4ef0..e04f22320 100644 --- a/go.mod +++ b/go.mod @@ -17,8 +17,8 @@ require ( github.com/onsi/ginkgo/v2 v2.12.0 github.com/opencontainers/runc v1.1.9 github.com/pmezard/go-difflib v1.0.0 - github.com/prometheus/client_golang v1.16.0 - github.com/prometheus/client_model v0.4.0 + github.com/prometheus/client_golang v1.17.0 + github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 @@ -93,7 +93,7 @@ require ( github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect github.com/peterbourgon/diskv v2.0.1+incompatible // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/prometheus/procfs v0.10.1 // indirect + github.com/prometheus/procfs v0.11.1 // indirect github.com/sergi/go-diff v1.1.0 // indirect github.com/sirupsen/logrus v1.8.1 // indirect github.com/xlab/treeprint v1.1.0 // indirect diff --git a/go.sum b/go.sum index e5207da08..5943586e0 100644 --- a/go.sum +++ b/go.sum @@ -304,14 +304,14 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= -github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8= -github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc= +github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q= +github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY= -github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= +github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM= +github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= @@ -324,8 +324,8 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= -github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg= -github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM= +github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI= +github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= From a4de4debecfd6fc96c564b286a6dee04f5398e3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?ChangZhuo=20Chen=20=28=E9=99=B3=E6=98=8C=E5=80=AC=29?= Date: Tue, 3 Oct 2023 21:56:07 +0800 Subject: [PATCH 377/822] docs(tls): add warning for not supporting TLSv1, TLSv1.1 (#10473) --- docs/user-guide/tls.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/user-guide/tls.md b/docs/user-guide/tls.md index 11338981b..f6fee6895 100644 --- a/docs/user-guide/tls.md +++ b/docs/user-guide/tls.md @@ -127,6 +127,9 @@ ingress-nginx defaults to using TLS 1.2 and 1.3 only, with a [secure set of TLS ### Legacy TLS +!!! warning + TLSv1, TLSv1.1 are not supported in ingress-nginx v1.6.0 and above. + The default configuration, though secure, does not support some older browsers and operating systems. For instance, TLS 1.1+ is only enabled by default from Android 5.0 on. At the time of writing, From 5b5dc6027a76dc2f1cd9b962b38eb5d1227d0a36 Mon Sep 17 00:00:00 2001 From: James Strong Date: Tue, 3 Oct 2023 16:18:40 -0400 Subject: [PATCH 378/822] update readme and TAG Signed-off-by: James Strong --- README.md | 1 + TAG | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 34b898a54..9892b08a8 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions **may** work on older versions, but | Supported | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | |:--:|-----------------------|------------------------------|----------------|---------------|------------------------------| +| 🔄 | **v1.9.1** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | | 🔄 | **v1.9.0** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | | 🔄 | **v1.8.2** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.1** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | diff --git a/TAG b/TAG index 57f52717b..ba1e8bf0b 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.8.2 +v1.9.1 From 8bd33d29e742c2b26070a8362eb11dee5ad0a0d2 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Wed, 4 Oct 2023 16:48:34 -0300 Subject: [PATCH 379/822] Remove curl from nginx base image (#10477) --- images/nginx/rootfs/Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index aba0ab70b..9c5304790 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -65,7 +65,10 @@ RUN apk update \ for dir in "${writeDirs[@]}"; do \ mkdir -p ${dir}; \ chown -R www-data.www-data ${dir}; \ - done' + done' \ + # Why we do this? Because apk package of the library requests curl and we dont want curl + && mv /usr/lib/libmaxminddb.so.* /usr/local/lib/ \ + && apk del --purge libmaxminddb curl EXPOSE 80 443 From 223c70bd090d7fa29ca6e004deaf05d206c386a0 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 5 Oct 2023 01:42:21 -0400 Subject: [PATCH 380/822] update error and otel to have all the arch we support (#10476) Signed-off-by: James Strong --- images/custom-error-pages/Makefile | 2 +- images/opentelemetry/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/images/custom-error-pages/Makefile b/images/custom-error-pages/Makefile index 810736cca..98f7104a7 100644 --- a/images/custom-error-pages/Makefile +++ b/images/custom-error-pages/Makefile @@ -31,7 +31,7 @@ IMAGE = $(REGISTRY)/nginx-errors export DOCKER_CLI_EXPERIMENTAL=enabled # build with buildx -PLATFORMS?=linux/amd64 +PLATFORMS?=linux/amd64,linux/arm,linux/arm64,linux/s390x OUTPUT= PROGRESS=plain diff --git a/images/opentelemetry/Makefile b/images/opentelemetry/Makefile index 07a66beed..03d92a298 100644 --- a/images/opentelemetry/Makefile +++ b/images/opentelemetry/Makefile @@ -32,7 +32,7 @@ IMAGE = $(REGISTRY)/opentelemetry export DOCKER_CLI_EXPERIMENTAL=enabled # build with buildx -PLATFORMS?=linux/amd64,linux/arm64 +PLATFORMS?=linux/amd64,linux/arm,linux/arm64,linux/s390x OUTPUT= PROGRESS=plain build: ensure-buildx From 3e26fc3740a6a36fdfb6cfbd4feacde6a527b60d Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Fri, 6 Oct 2023 23:04:58 -0300 Subject: [PATCH 381/822] Revert "Remove curl from nginx base image (#10477)" (#10479) This reverts commit 8bd33d29e742c2b26070a8362eb11dee5ad0a0d2. --- images/nginx/rootfs/Dockerfile | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index 9c5304790..aba0ab70b 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -65,10 +65,7 @@ RUN apk update \ for dir in "${writeDirs[@]}"; do \ mkdir -p ${dir}; \ chown -R www-data.www-data ${dir}; \ - done' \ - # Why we do this? Because apk package of the library requests curl and we dont want curl - && mv /usr/lib/libmaxminddb.so.* /usr/local/lib/ \ - && apk del --purge libmaxminddb curl + done' EXPOSE 80 443 From c43c3dd65655eb104d446eb7cec69a7dc553c489 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Oct 2023 13:45:37 +0200 Subject: [PATCH 382/822] Bump golang.org/x/crypto from 0.13.0 to 0.14.0 (#10485) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.13.0 to 0.14.0. - [Commits](https://github.com/golang/crypto/compare/v0.13.0...v0.14.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index e04f22320..a4581a08c 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.13.0 + golang.org/x/crypto v0.14.0 google.golang.org/grpc v1.58.2 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -103,8 +103,8 @@ require ( golang.org/x/mod v0.12.0 // indirect golang.org/x/net v0.14.0 // indirect golang.org/x/oauth2 v0.10.0 // indirect - golang.org/x/sys v0.12.0 // indirect - golang.org/x/term v0.12.0 // indirect + golang.org/x/sys v0.13.0 // indirect + golang.org/x/term v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.12.0 // indirect diff --git a/go.sum b/go.sum index 5943586e0..7307335eb 100644 --- a/go.sum +++ b/go.sum @@ -397,8 +397,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= -golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= +golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -531,11 +531,11 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= -golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= +golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= +golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= From 921ca509d24c99b967f5121134dd7d93e0d5c208 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Oct 2023 18:22:02 +0200 Subject: [PATCH 383/822] Bump ossf/scorecard-action from 2.2.0 to 2.3.0 (#10487) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.2.0 to 2.3.0. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/08b4669551908b1024bb425080c797723083c031...483ef80eb98fb506c348f7d62e28055e49fe2398) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index d066f5363..1c8f8d00b 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 + uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0 with: results_file: results.sarif results_format: sarif From 371a3859f878806c9d45264fbfdf4ff8e7566ae6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Oct 2023 23:04:47 +0200 Subject: [PATCH 384/822] Bump github.com/prometheus/client_model (#10486) Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.4.1-0.20230718164431-9a2bf3000d16 to 0.5.0. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](https://github.com/prometheus/client_model/commits/v0.5.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index a4581a08c..eef1ab989 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/opencontainers/runc v1.1.9 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.17.0 - github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 + github.com/prometheus/client_model v0.5.0 github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 diff --git a/go.sum b/go.sum index 7307335eb..8f7bbb6a6 100644 --- a/go.sum +++ b/go.sum @@ -310,8 +310,8 @@ github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1: github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 h1:v7DLqVdK4VrYkVD5diGdl4sxJurKJEMnODWRJlxV9oM= -github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= +github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw= +github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI= github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= From a0eac185af2b543e948482f4df0ea748c1ea5e01 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Oct 2023 01:14:23 +0200 Subject: [PATCH 385/822] Bump google.golang.org/grpc from 1.58.2 to 1.58.3 (#10496) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.58.2 to 1.58.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.58.2...v1.58.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index eef1ab989..dcbe4017f 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.14.0 - google.golang.org/grpc v1.58.2 + google.golang.org/grpc v1.58.3 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index 8f7bbb6a6..516a1822b 100644 --- a/go.sum +++ b/go.sum @@ -669,8 +669,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I= -google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= +google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ= +google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 86f1cedcadd8bb86585f4ef8ee89e6645cbb325e Mon Sep 17 00:00:00 2001 From: "Mark D. Gray" Date: Tue, 10 Oct 2023 19:36:13 -0500 Subject: [PATCH 386/822] add upstream patch for CVE-2023-44487 (#10494) * add upstream patch * add source * remove auto-added depend --- .../rootfs/patches/nginx-1.21.4-http2.patch | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 images/nginx/rootfs/patches/nginx-1.21.4-http2.patch diff --git a/images/nginx/rootfs/patches/nginx-1.21.4-http2.patch b/images/nginx/rootfs/patches/nginx-1.21.4-http2.patch new file mode 100644 index 000000000..3b9d57736 --- /dev/null +++ b/images/nginx/rootfs/patches/nginx-1.21.4-http2.patch @@ -0,0 +1,57 @@ +#commit 6ceef192e7af1c507826ac38a2d43f08bf265fb9 +#repository: https://github.com/nginx/nginx +#Author: Maxim Dounin +#Date: Tue Oct 10 15:13:39 2023 +0300 +diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c +index 7c05ff1e7..410a8be24 100644 +--- a/src/http/v2/ngx_http_v2.c ++++ b/src/http/v2/ngx_http_v2.c +@@ -347,6 +347,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev) + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler"); + + h2c->blocked = 1; ++ h2c->new_streams = 0; + + if (c->close) { + c->close = 0; +@@ -1284,6 +1285,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, + goto rst_stream; + } + ++ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) { ++ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, ++ "client sent too many streams at once"); ++ ++ status = NGX_HTTP_V2_REFUSED_STREAM; ++ goto rst_stream; ++ } ++ + if (!h2c->settings_ack + && !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG) + && h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW) +@@ -1349,6 +1358,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, + + rst_stream: + ++ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) { ++ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, ++ "client sent too many refused streams"); ++ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR); ++ } ++ + if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) { + return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); + } +diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h +index cb9014ccf..6751b3026 100644 +--- a/src/http/v2/ngx_http_v2.h ++++ b/src/http/v2/ngx_http_v2.h +@@ -131,6 +131,8 @@ struct ngx_http_v2_connection_s { + ngx_uint_t processing; + ngx_uint_t frames; + ngx_uint_t idle; ++ ngx_uint_t new_streams; ++ ngx_uint_t refused_streams; + ngx_uint_t priority_limit; + + size_t send_window; \ No newline at end of file From cbed4c683196d216def64ef035dc0273fa61e69f Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Wed, 11 Oct 2023 03:53:55 -0300 Subject: [PATCH 387/822] Remove legacy GeoIP from controller (#10495) --- .../nginx-configuration/configmap.md | 3 +++ go.work.sum | 18 ++++++++++++++++++ internal/ingress/controller/config/config.go | 5 ----- rootfs/etc/nginx/template/nginx.tmpl | 10 ---------- 4 files changed, 21 insertions(+), 15 deletions(-) diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index 1bb205ad3..f7ee3c120 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -720,6 +720,9 @@ Enables or disables compression of HTTP responses using the ["gzip" module](http ## use-geoip +!!! attention + GeoIP is deprecated and removed on v1.10. Users willing to use GeoIP should use GeoIP2 + Enables or disables ["geoip" module](https://nginx.org/en/docs/http/ngx_http_geoip_module.html) that creates variables with values depending on the client IP address, using the precompiled MaxMind databases. _**default:**_ true diff --git a/go.work.sum b/go.work.sum index 93c6eaa89..f27920f61 100644 --- a/go.work.sum +++ b/go.work.sum @@ -127,8 +127,10 @@ github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMo github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= +github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= +github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw= github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw= github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E= github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA= @@ -160,6 +162,7 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ= github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= +github.com/google/cel-go v0.12.6/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= @@ -175,7 +178,10 @@ github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/ad github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w= +github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho= github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= +github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c= github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y= github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ= @@ -193,6 +199,7 @@ github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= +github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4= github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= @@ -202,8 +209,18 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c= +go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ= +go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.10.0/go.mod h1:78XhIg8Ht9vR4tbLNUhXsiOnE2HOuSeKAiAcoVQEpOY= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.10.0/go.mod h1:Krqnjl22jUJ0HgMzw5eveuCvFDXY4nSYb4F8t5gdrag= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0/go.mod h1:OfUCyyIiDvNXHWpcWgbF+MWvqPZiNa3YDEnivcnYsV0= +go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A= +go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE= +go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM= go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= +go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= @@ -230,6 +247,7 @@ golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 56fd2699f..71c022e3e 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -432,10 +432,6 @@ type Configuration struct { // http://nginx.org/en/docs/http/ngx_http_gzip_module.html UseGzip bool `json:"use-gzip,omitempty"` - // Enables or disables the use of the nginx geoip module that creates variables with values depending on the client IP - // http://nginx.org/en/docs/http/ngx_http_geoip_module.html - UseGeoIP bool `json:"use-geoip,omitempty"` - // UseGeoIP2 enables the geoip2 module for NGINX // By default this is disabled UseGeoIP2 bool `json:"use-geoip2,omitempty"` @@ -944,7 +940,6 @@ func NewDefault() Configuration { EnableBrotli: false, EnableAioWrite: true, UseGzip: false, - UseGeoIP: true, UseGeoIP2: false, WorkerProcesses: strconv.Itoa(runtime.NumCPU()), WorkerShutdownTimeout: "240s", diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index e3145e6a5..a6ebe5d2a 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -170,16 +170,6 @@ http { {{ end }} - {{ if $cfg.UseGeoIP }} - {{/* databases used to determine the country depending on the client IP address */}} - {{/* http://nginx.org/en/docs/http/ngx_http_geoip_module.html */}} - {{/* this is require to calculate traffic for individual country using GeoIP in the status page */}} - geoip_country /etc/nginx/geoip/GeoIP.dat; - geoip_city /etc/nginx/geoip/GeoLiteCity.dat; - geoip_org /etc/nginx/geoip/GeoIPASNum.dat; - geoip_proxy_recursive on; - {{ end }} - {{ if $cfg.UseGeoIP2 }} # https://github.com/leev/ngx_http_geoip2_module#example-usage From 3732fc6ab672ab2cbb9b3e3d5b405869430c27cd Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Wed, 11 Oct 2023 18:46:47 +0530 Subject: [PATCH 388/822] added warning for configuration-snippets usage (#10492) --- .../user-guide/nginx-configuration/annotations.md | 15 ++++++++++++++- docs/user-guide/nginx-configuration/configmap.md | 2 +- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index c2da56291..7cd34d344 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -316,7 +316,8 @@ nginx.ingress.kubernetes.io/configuration-snippet: | more_set_headers "Request-Id: $req_id"; ``` -Since version 1.9.0 this annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. +!!! attention +Since version 1.9.0, `"configuration-snippet"` annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. ### Custom HTTP Errors @@ -428,6 +429,9 @@ metadata: } ``` +!!! attention +Since version 1.9.0, `"server-snippet"` annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. + !!! attention This annotation can be used only once per host. @@ -505,6 +509,9 @@ nginx.ingress.kubernetes.io/auth-snippet: | ``` > Note: `nginx.ingress.kubernetes.io/auth-snippet` is an optional annotation. However, it may only be used in conjunction with `nginx.ingress.kubernetes.io/auth-url` and will be ignored if `nginx.ingress.kubernetes.io/auth-url` is not set +!!! attention +Since version 1.9.0, `"auth-snippet"` annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. + !!! example Please check the [external-auth](../../examples/auth/external-auth/README.md) example. @@ -895,6 +902,9 @@ nginx.ingress.kubernetes.io/modsecurity-snippet: | Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf ``` +!!! attention +Since version 1.9.0, `"modsecurity-snippet"` annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. + ### Backend Protocol Using `backend-protocol` annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces `secure-backends` in older versions) @@ -984,3 +994,6 @@ metadata: proxy_pass 127.0.0.1:80; } ``` + +!!! attention +Since version 1.9.0, `"stream-snippet"` annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information. \ No newline at end of file diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index f7ee3c120..16a3ef28b 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -263,7 +263,7 @@ Enables Ingress to parse and add *-snippet annotations/directives created by the Warning: We recommend enabling this option only if you TRUST users with permission to create Ingress objects, as this may allow a user to add restricted configurations to the final nginx.conf file -**This option will be defaulted to false in the next major release** +**This option is defaulted to false since v1.9.0** ## annotations-risk-level From 8b53cabe03fdccdca06fa0080430bd68b7b9b00f Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Wed, 11 Oct 2023 11:16:11 -0300 Subject: [PATCH 389/822] Bump curl and Go version (#10503) * Bump curl and Go version * Add NGINX BAse image scanning * Try again --- .github/workflows/ci.yaml | 46 +++++- .github/workflows/golangci-lint.yml | 2 +- .github/workflows/plugin.yaml | 2 +- build/run-in-docker.sh | 2 +- go.mod | 49 +++--- go.sum | 96 ++++++------ go.work | 3 +- go.work.sum | 103 +++++++------ images/custom-error-pages/rootfs/Dockerfile | 2 +- images/custom-error-pages/rootfs/go.mod | 2 +- .../rootfs/Dockerfile | 2 +- images/ext-auth-example-authsvc/rootfs/go.mod | 2 +- images/fastcgi-helloserver/rootfs/Dockerfile | 2 +- .../go-grpc-greeter-server/rootfs/Dockerfile | 2 +- images/httpbun/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/rootfs/go.mod | 73 +++++---- images/kube-webhook-certgen/rootfs/go.sum | 144 +++++++++++++----- images/nginx/TAG | 2 +- images/opentelemetry/rootfs/go.mod | 2 +- images/test-runner/Makefile | 8 +- internal/ingress/annotations/annotations.go | 3 +- magefiles/go.mod | 14 +- magefiles/go.sum | 31 ++-- test/e2e/run-chart-test.sh | 2 +- test/e2e/run-kind-e2e.sh | 2 +- 26 files changed, 360 insertions(+), 240 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b53ec3c46..21e425cdd 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -75,7 +75,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: Run test @@ -96,7 +96,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: Set up QEMU @@ -160,7 +160,7 @@ jobs: - name: Setup Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: cache @@ -363,6 +363,42 @@ jobs: name: e2e-test-reports-chroot-${{ matrix.k8s }} path: 'test/junitreports/report*.xml' + test-nginx-image-build: + permissions: + contents: read # for dorny/paths-filter to fetch a list of changed files + pull-requests: read # for dorny/paths-filter to read pull requests + runs-on: ubuntu-latest + env: + PLATFORMS: linux/amd64,linux/arm64 + steps: + - name: Checkout + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + + - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 + id: filter-images + with: + token: ${{ secrets.GITHUB_TOKEN }} + filters: | + nginx-base: + - 'images/nginx/**' + - name: nginx-base-image + if: ${{ steps.filter-images.outputs.nginx-base == 'true' }} + run: | + cd images/nginx/rootfs && docker build -t docker.io/nginx-test-workflow/nginx:${{ github.sha }} . + - name: Run Trivy on NGINX Image + if: ${{ steps.filter-images.outputs.nginx-base == 'true' }} + uses: aquasecurity/trivy-action@master + with: + image-ref: 'docker.io/nginx-test-workflow/nginx:${{ github.sha }}' + format: 'sarif' + ignore-unfixed: true + output: 'trivy-results.sarif' + - name: Upload Trivy scan results to GitHub Security tab + if: ${{ steps.filter-images.outputs.nginx-base == 'true' && always() }} + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results.sarif' + test-image-build: permissions: @@ -396,7 +432,6 @@ jobs: - 'images/kube-webhook-certgen/**' ext-auth-example-authsvc: - 'images/ext-auth-example-authsvc/**' - - name: custom-error-pages image build if: ${{ steps.filter-images.outputs.custom-error-pages == 'true' }} run: | @@ -467,10 +502,11 @@ jobs: if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: kube-webhook-certgen image build if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} run: | cd images/kube-webhook-certgen && make test test-e2e + diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index a58850dd2..d2ecea1db 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -25,7 +25,7 @@ jobs: id: go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: golangci-lint diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index a1a185608..ae616077c 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -22,7 +22,7 @@ jobs: - name: Set up Go uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version: '1.21.1' + go-version: '1.21.3' check-latest: true - name: Run GoReleaser diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 7e7974f0f..2ac7220a8 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -87,7 +87,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then echo "..reached DIND check TRUE block, inside run-in-docker.sh" echo "FLAGS=$FLAGS" #go env - go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 + go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.13.0 find / -type f -name ginkgo 2>/dev/null which ginkgo /bin/bash -c "${FLAGS}" diff --git a/go.mod b/go.mod index dcbe4017f..8ea342f31 100644 --- a/go.mod +++ b/go.mod @@ -1,12 +1,12 @@ module k8s.io/ingress-nginx -go 1.21.1 +go 1.21.3 require ( + dario.cat/mergo v1.0.0 github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a github.com/eapache/channels v1.1.0 github.com/fsnotify/fsnotify v1.6.0 - github.com/imdario/mergo v0.3.16 github.com/json-iterator/go v1.1.12 github.com/kylelemons/godebug v1.1.0 github.com/mitchellh/go-ps v1.0.0 @@ -14,7 +14,7 @@ require ( github.com/mitchellh/mapstructure v1.5.0 github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 - github.com/onsi/ginkgo/v2 v2.12.0 + github.com/onsi/ginkgo/v2 v2.13.0 github.com/opencontainers/runc v1.1.9 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.17.0 @@ -24,20 +24,20 @@ require ( github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.4 github.com/yudai/gojsondiff v1.0.0 - github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a + github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30 golang.org/x/crypto v0.14.0 google.golang.org/grpc v1.58.3 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.27.4 - k8s.io/apiextensions-apiserver v0.26.4 - k8s.io/apimachinery v0.27.4 - k8s.io/apiserver v0.26.4 - k8s.io/cli-runtime v0.26.4 - k8s.io/client-go v0.27.4 - k8s.io/code-generator v0.26.4 - k8s.io/component-base v0.27.4 + k8s.io/api v0.27.6 + k8s.io/apiextensions-apiserver v0.27.6 + k8s.io/apimachinery v0.27.6 + k8s.io/apiserver v0.27.6 + k8s.io/cli-runtime v0.27.6 + k8s.io/client-go v0.27.6 + k8s.io/code-generator v0.27.6 + k8s.io/component-base v0.27.6 k8s.io/klog/v2 v2.100.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.6 @@ -45,19 +45,19 @@ require ( ) require ( - github.com/BurntSushi/toml v1.0.0 // indirect + github.com/BurntSushi/toml v1.3.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect - github.com/coreos/go-systemd/v22 v22.3.2 // indirect + github.com/coreos/go-systemd/v22 v22.4.0 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/davecgh/go-spew v1.1.1 // indirect github.com/eapache/queue v1.1.0 // indirect github.com/emicklei/go-restful/v3 v3.10.2 // indirect github.com/evanphx/json-patch v4.12.0+incompatible // indirect github.com/evanphx/json-patch/v5 v5.6.0 // indirect - github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b // indirect - github.com/go-errors/errors v1.0.1 // indirect + github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa // indirect + github.com/go-errors/errors v1.4.2 // indirect github.com/go-logr/logr v1.2.4 // indirect github.com/go-openapi/jsonpointer v0.19.6 // indirect github.com/go-openapi/jsonreference v0.20.1 // indirect @@ -72,10 +72,11 @@ require ( github.com/google/gnostic v0.5.7-v3refs // indirect github.com/google/go-cmp v0.5.9 // indirect github.com/google/gofuzz v1.1.0 // indirect - github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect + github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.3.0 // indirect github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect + github.com/imdario/mergo v0.3.6 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect @@ -95,19 +96,19 @@ require ( github.com/pkg/errors v0.9.1 // indirect github.com/prometheus/procfs v0.11.1 // indirect github.com/sergi/go-diff v1.1.0 // indirect - github.com/sirupsen/logrus v1.8.1 // indirect + github.com/sirupsen/logrus v1.9.0 // indirect github.com/xlab/treeprint v1.1.0 // indirect github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect - golang.org/x/mod v0.12.0 // indirect - golang.org/x/net v0.14.0 // indirect - golang.org/x/oauth2 v0.10.0 // indirect + golang.org/x/mod v0.13.0 // indirect + golang.org/x/net v0.16.0 // indirect + golang.org/x/oauth2 v0.12.0 // indirect golang.org/x/sys v0.13.0 // indirect golang.org/x/term v0.13.0 // indirect golang.org/x/text v0.13.0 // indirect golang.org/x/time v0.3.0 // indirect - golang.org/x/tools v0.12.0 // indirect + golang.org/x/tools v0.14.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect google.golang.org/protobuf v1.31.0 // indirect @@ -119,8 +120,8 @@ require ( k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect - sigs.k8s.io/kustomize/api v0.12.1 // indirect - sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect + sigs.k8s.io/kustomize/api v0.13.2 // indirect + sigs.k8s.io/kustomize/kyaml v0.14.1 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect sigs.k8s.io/yaml v1.3.0 // indirect ) diff --git a/go.sum b/go.sum index 516a1822b..ea572e4b3 100644 --- a/go.sum +++ b/go.sum @@ -30,10 +30,12 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= +dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= +dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= -github.com/BurntSushi/toml v1.0.0 h1:dtDWrepsVPfW9H/4y7dDgFc2MBUSeJhlaDtK13CxFlU= -github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= +github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8= +github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= @@ -57,8 +59,8 @@ github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5P github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= -github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI= -github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= +github.com/coreos/go-systemd/v22 v22.4.0 h1:y9YHcjnjynCd/DVbg5j9L/33jQM3MxJlbj/zWskzfGU= +github.com/coreos/go-systemd/v22 v22.4.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg= @@ -85,10 +87,11 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= -github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b h1:074/xhloHUBOpTZwlIzQ28rbPY8pNJvzY7Gcx5KnNOk= github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA= -github.com/go-errors/errors v1.0.1 h1:LUHzmkK3GUKUrL/1gfBUxAHzcev3apQlezX/+O7ma6w= -github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q= +github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU= +github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA= +github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= +github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= @@ -183,8 +186,8 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= -github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= -github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ= +github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= @@ -198,9 +201,8 @@ github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4= -github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= +github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28= +github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= @@ -281,8 +283,8 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= -github.com/onsi/ginkgo/v2 v2.12.0 h1:UIVDowFPwpg6yMUpPjGkYvf06K3RAiJXUhCxEwQVHRI= -github.com/onsi/ginkgo/v2 v2.12.0/go.mod h1:ZNEzXISYlqpb8S36iN71ifqLi3vVD1rVJGvWRCJOUpQ= +github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= +github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= @@ -337,8 +339,8 @@ github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNX github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= -github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE= -github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= +github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0= +github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= @@ -374,8 +376,8 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a h1:CbXWHAnmrtTKgX+yMVVANuRJP8ld88ELbAYAYnBdLJ4= -github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a/go.mod h1:/Hzu8ych2oXCs1iNI+MeASyFzWTncQ6nlu/wgqbqC2A= +github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30 h1:rzHvkiukOVYcf840FqAsHqBMhfLofvQIxWtczkGRklU= +github.com/zakjan/cert-chain-resolver v0.0.0-20221221105603-fcedb00c5b30/go.mod h1:/Hzu8ych2oXCs1iNI+MeASyFzWTncQ6nlu/wgqbqC2A= go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= @@ -429,8 +431,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= -golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY= +golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -464,16 +466,16 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14= -golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= +golang.org/x/net v0.16.0 h1:7eBu7KsSvFDtSXUIDbh3aqlK4DPsZ1rByC8PFfBThos= +golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8= -golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= +golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4= +golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -501,7 +503,6 @@ golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -529,6 +530,7 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= @@ -593,8 +595,8 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss= -golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= +golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc= +golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= @@ -724,22 +726,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.27.4 h1:0pCo/AN9hONazBKlNUdhQymmnfLRbSZjd5H5H3f0bSs= -k8s.io/api v0.27.4/go.mod h1:O3smaaX15NfxjzILfiln1D8Z3+gEYpjEpiNA/1EVK1Y= -k8s.io/apiextensions-apiserver v0.26.4 h1:9D2RTxYGxrG5uYg6D7QZRcykXvavBvcA59j5kTaedQI= -k8s.io/apiextensions-apiserver v0.26.4/go.mod h1:cd4uGFGIgzEqUghWpRsr9KE8j2KNTjY8Ji8pnMMazyw= -k8s.io/apimachinery v0.27.4 h1:CdxflD4AF61yewuid0fLl6bM4a3q04jWel0IlP+aYjs= -k8s.io/apimachinery v0.27.4/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= -k8s.io/apiserver v0.26.4 h1:3Oq4mnJv0mzVX7BR/Nod+8KjlELf/3Ljvu9ZWDyLUoA= -k8s.io/apiserver v0.26.4/go.mod h1:yAY3O1vBM4/0OIGAGeWcdfzQvgdwJ188VirLcuSAVnw= -k8s.io/cli-runtime v0.26.4 h1:MgSU871KDzBDX7V9GtuqS6Ai9lhQCHgRzkurnXOWtZ0= -k8s.io/cli-runtime v0.26.4/go.mod h1:MjJ2DXMChw2zcG0/agzm17xwKpfVxOfuoCdfY9iOCOE= -k8s.io/client-go v0.27.4 h1:vj2YTtSJ6J4KxaC88P4pMPEQECWMY8gqPqsTgUKzvjk= -k8s.io/client-go v0.27.4/go.mod h1:ragcly7lUlN0SRPk5/ZkGnDjPknzb37TICq07WhI6Xc= -k8s.io/code-generator v0.26.4 h1:zgDD0qX13p/jtrAoYRRiYeQ5ibnriwmo2cMkMZAtJxc= -k8s.io/code-generator v0.26.4/go.mod h1:ryaiIKwfxEJEaywEzx3dhWOydpVctKYbqLajJf0O8dI= -k8s.io/component-base v0.27.4 h1:Wqc0jMKEDGjKXdae8hBXeskRP//vu1m6ypC+gwErj4c= -k8s.io/component-base v0.27.4/go.mod h1:hoiEETnLc0ioLv6WPeDt8vD34DDeB35MfQnxCARq3kY= +k8s.io/api v0.27.6 h1:PBWu/lywJe2qQcshMjubzcBg7+XDZOo7O8JJAWuYtUo= +k8s.io/api v0.27.6/go.mod h1:AQYj0UsFCp3qJE7bOVnUuy4orCsXVkvHefnbYQiNWgk= +k8s.io/apiextensions-apiserver v0.27.6 h1:mOwSBJtThZhpJr+8gEkc3wFDIjq87E3JspR5mtZxIg8= +k8s.io/apiextensions-apiserver v0.27.6/go.mod h1:AVNlLYRrESG5Poo6ASRUhY2pvoKPcNt8y/IuZ4lx3o8= +k8s.io/apimachinery v0.27.6 h1:mGU8jmBq5o8mWBov+mLjdTBcU+etTE19waies4AQ6NE= +k8s.io/apimachinery v0.27.6/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= +k8s.io/apiserver v0.27.6 h1:r/eHN8r3lG2buggHrVMy++kKhHlHn1HWSX1dqDtes54= +k8s.io/apiserver v0.27.6/go.mod h1:Xeo9OEXn2kDLK5pqspjdXQx7YKgDyKSpwIB4p0BmpAQ= +k8s.io/cli-runtime v0.27.6 h1:ik1+20C0AvxYcqEzwebH2PHOlqBTKUHZnOuPtG2CCl8= +k8s.io/cli-runtime v0.27.6/go.mod h1:+qSBK08EJL1fFvsfVNlETzsgGtxIhascIGZSuaQXQro= +k8s.io/client-go v0.27.6 h1:vzI8804gpUtpMCNaFjIFyJrifH7u//LJCJPy8fQuYQg= +k8s.io/client-go v0.27.6/go.mod h1:PMsXcDKiJTW7PHJ64oEsIUJF319wm+EFlCj76oE5QXM= +k8s.io/code-generator v0.27.6 h1:1zkSDvylcA11s91aYg5U7fZ24EXMZ+KIDOj/Z3Ti4c8= +k8s.io/code-generator v0.27.6/go.mod h1:DPung1sI5vBgn4AGKtlPRQAyagj/ir/4jI55ipZHVww= +k8s.io/component-base v0.27.6 h1:hF5WxX7Tpi9/dXAbLjPVkIA6CA6Pi6r9JOHyo0uCDYI= +k8s.io/component-base v0.27.6/go.mod h1:NvjLtaneUeb0GgMPpCBF+4LNB9GuhDHi16uUTjBhQfU= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= @@ -758,10 +760,10 @@ sigs.k8s.io/controller-runtime v0.14.6 h1:oxstGVvXGNnMvY7TAESYk+lzr6S3V5VFxQ6d92 sigs.k8s.io/controller-runtime v0.14.6/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= -sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= -sigs.k8s.io/kustomize/api v0.12.1/go.mod h1:y3JUhimkZkR6sbLNwfJHxvo1TCLwuwm14sCYnkH6S1s= -sigs.k8s.io/kustomize/kyaml v0.13.9 h1:Qz53EAaFFANyNgyOEJbT/yoIHygK40/ZcvU3rgry2Tk= -sigs.k8s.io/kustomize/kyaml v0.13.9/go.mod h1:QsRbD0/KcU+wdk0/L0fIp2KLnohkVzs6fQ85/nOXac4= +sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA= +sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw= +sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA= +sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4= sigs.k8s.io/mdtoc v1.1.0 h1:q3YtqYzmC2e0hgLXRIOm7/QLuPux1CX3ZHCwlbABxZo= sigs.k8s.io/mdtoc v1.1.0/go.mod h1:QZLVEdHH2iNIR4uHAZyvFRtjloHgVItk8lo/mzCtq3w= sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= diff --git a/go.work b/go.work index 84cc6ca96..249976119 100644 --- a/go.work +++ b/go.work @@ -1,6 +1,7 @@ -go 1.21.1 +go 1.21.3 use ( . + ./images/kube-webhook-certgen/rootfs ./magefiles ) diff --git a/go.work.sum b/go.work.sum index f27920f61..2ce1176bb 100644 --- a/go.work.sum +++ b/go.work.sum @@ -121,20 +121,22 @@ cloud.google.com/go/vpcaccess v1.7.1/go.mod h1:FogoD46/ZU+JUBX9D606X21EnxiszYi2t cloud.google.com/go/webrisk v1.9.1/go.mod h1:4GCmXKcOa2BZcZPn6DCEvE7HypmEJcJkr4mtM+sqYPc= cloud.google.com/go/websecurityscanner v1.6.1/go.mod h1:Njgaw3rttgRHXzwCB8kgCYqv5/rGpFCsBOvPbYgszpg= cloud.google.com/go/workflows v1.11.1/go.mod h1:Z+t10G1wF7h8LgdY/EmRcQY8ptBD/nvofaL6FqlET6g= -github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= -github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ= -github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c= -github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0= -github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE= -github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= +github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY= +github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY= +github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ= github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw= github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw= +github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko= github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E= +github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs= +github.com/chromedp/chromedp v0.9.2/go.mod h1:LkSXJKONWTCHAfQasKFUZI+mxqS4tZqhmtGzzhLsnLs= +github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww= +github.com/chzyer/logex v1.2.1/go.mod h1:JLbx6lG2kDbNRFnfkgvh4eRJRPX1QCoOIWomwysCBrQ= +github.com/chzyer/readline v1.5.1/go.mod h1:Eh+b79XXUwfKfcPLepksvw2tcLE/Ct21YObkaSkeBlk= +github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38GC8= github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA= -github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= @@ -142,72 +144,66 @@ github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWH github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= -github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc= -github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk= +github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8= github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= -github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk= +github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk= github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= -github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= -github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= +github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0= github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g= github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE= github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= -github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= +github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= -github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM= +github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw= +github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY= +github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I= github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ= github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/google/cel-go v0.12.6/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw= +github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8= github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= -github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk= github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A= -github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k= github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI= -github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= -github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y= -github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= -github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w= github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho= -github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= +github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw= +github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE= +github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU= github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= -github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c= +github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs= +github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY= +github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE= github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y= github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ= -github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU= +github.com/onsi/ginkgo/v2 v2.9.1/go.mod h1:FEcmzVcCHl+4o9bQZVab+4dC9+j+91t2FHSzmGAPfuo= github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM= github.com/onsi/ginkgo/v2 v2.11.0/go.mod h1:ZhrRA5XmEE3x3rhlzamx/JJvujdZoJ2uvgI7kR0iZvM= github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= +github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ= github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI= -github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= +github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0= +github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg= -github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= -github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0= -github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4= github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= -github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE= github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU= -github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4= +github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.1/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c= @@ -218,50 +214,64 @@ go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0/go.mod h go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A= go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE= go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM= -go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U= go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6 h1:QE6XYQK6naiK1EPAe1g/ILLxN5RBoH5xkJk3CqlMI/Y= -golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= golang.org/x/net v0.13.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA= +golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI= +golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= +golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc= golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= +golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= +golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= +golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s= golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4= golang.org/x/tools v0.9.3/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= +golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM= +golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8= google.golang.org/api v0.126.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw= -google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64= google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y= google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 h1:Z0hjGZePRE0ZBWotvtrwxFNrNE9CUAGtplaDK5NNI/g= @@ -271,23 +281,18 @@ google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130/go. google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ= google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA= google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o= -google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0= google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= -google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= -google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM= google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ= google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8= google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s= google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= -gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k= -gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= -gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= -k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE= k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ= k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM= k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index 8ae42317d..54b2a5cc7 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.21.1-alpine3.18 as builder +FROM golang:1.21.3-alpine3.18 as builder RUN apk update \ && apk upgrade && apk add git diff --git a/images/custom-error-pages/rootfs/go.mod b/images/custom-error-pages/rootfs/go.mod index 1fc8f9939..50cfc2a19 100644 --- a/images/custom-error-pages/rootfs/go.mod +++ b/images/custom-error-pages/rootfs/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx/custom-error-pages -go 1.21.1 +go 1.21.3 require github.com/prometheus/client_golang v1.11.1 diff --git a/images/ext-auth-example-authsvc/rootfs/Dockerfile b/images/ext-auth-example-authsvc/rootfs/Dockerfile index f0b51374b..96da802ce 100644 --- a/images/ext-auth-example-authsvc/rootfs/Dockerfile +++ b/images/ext-auth-example-authsvc/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.21.1-alpine3.18 as builder +FROM golang:1.21.3-alpine3.18 as builder RUN mkdir /authsvc WORKDIR /authsvc COPY . ./ diff --git a/images/ext-auth-example-authsvc/rootfs/go.mod b/images/ext-auth-example-authsvc/rootfs/go.mod index df99c08b0..e910e360c 100644 --- a/images/ext-auth-example-authsvc/rootfs/go.mod +++ b/images/ext-auth-example-authsvc/rootfs/go.mod @@ -1,6 +1,6 @@ module example.com/authsvc -go 1.21.1 +go 1.21.3 require k8s.io/apimachinery v0.23.1 diff --git a/images/fastcgi-helloserver/rootfs/Dockerfile b/images/fastcgi-helloserver/rootfs/Dockerfile index d4ed8305f..92a5e8196 100755 --- a/images/fastcgi-helloserver/rootfs/Dockerfile +++ b/images/fastcgi-helloserver/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.21.1-alpine3.18 as builder +FROM golang:1.21.3-alpine3.18 as builder WORKDIR /go/src/k8s.io/ingress-nginx/images/fastcgi diff --git a/images/go-grpc-greeter-server/rootfs/Dockerfile b/images/go-grpc-greeter-server/rootfs/Dockerfile index 6460ce154..33cb35923 100644 --- a/images/go-grpc-greeter-server/rootfs/Dockerfile +++ b/images/go-grpc-greeter-server/rootfs/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.21.1-alpine3.18 as build +FROM golang:1.21.3-alpine3.18 as build WORKDIR /go/src/greeter-server diff --git a/images/httpbun/rootfs/Dockerfile b/images/httpbun/rootfs/Dockerfile index dd2d04502..c84f17fd1 100644 --- a/images/httpbun/rootfs/Dockerfile +++ b/images/httpbun/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM golang:1.21.1 AS builder +FROM golang:1.21.3 AS builder ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 diff --git a/images/kube-webhook-certgen/rootfs/Dockerfile b/images/kube-webhook-certgen/rootfs/Dockerfile index 4a7e32ced..846e37aee 100644 --- a/images/kube-webhook-certgen/rootfs/Dockerfile +++ b/images/kube-webhook-certgen/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM --platform=$BUILDPLATFORM golang:1.21.1 as builder +FROM --platform=$BUILDPLATFORM golang:1.21.3 as builder ARG BUILDPLATFORM ARG TARGETARCH diff --git a/images/kube-webhook-certgen/rootfs/go.mod b/images/kube-webhook-certgen/rootfs/go.mod index b2870f840..6c426f274 100644 --- a/images/kube-webhook-certgen/rootfs/go.mod +++ b/images/kube-webhook-certgen/rootfs/go.mod @@ -1,48 +1,63 @@ module github.com/jet/kube-webhook-certgen -go 1.21.1 +go 1.21.3 require ( github.com/onrik/logrus v0.9.0 - github.com/sirupsen/logrus v1.8.1 - github.com/spf13/cobra v1.1.3 - k8s.io/api v0.22.6 - k8s.io/apimachinery v0.22.6 - k8s.io/client-go v0.22.6 + github.com/sirupsen/logrus v1.9.0 + github.com/spf13/cobra v1.7.0 + k8s.io/api v0.27.6 + k8s.io/apimachinery v0.27.6 + k8s.io/client-go v0.27.6 k8s.io/kube-aggregator v0.22.6 ) require ( github.com/davecgh/go-spew v1.1.1 // indirect - github.com/evanphx/json-patch v4.11.0+incompatible // indirect - github.com/go-logr/logr v0.4.0 // indirect + github.com/emicklei/go-restful/v3 v3.10.2 // indirect + github.com/evanphx/json-patch v4.12.0+incompatible // indirect + github.com/go-logr/logr v1.2.4 // indirect + github.com/go-openapi/jsonpointer v0.19.6 // indirect + github.com/go-openapi/jsonreference v0.20.1 // indirect + github.com/go-openapi/swag v0.22.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/protobuf v1.5.2 // indirect - github.com/google/go-cmp v0.5.5 // indirect + github.com/golang/protobuf v1.5.3 // indirect + github.com/google/gnostic v0.5.7-v3refs // indirect + github.com/google/go-cmp v0.5.9 // indirect github.com/google/gofuzz v1.1.0 // indirect - github.com/googleapis/gnostic v0.5.5 // indirect - github.com/imdario/mergo v0.3.5 // indirect - github.com/inconshreveable/mousetrap v1.0.0 // indirect - github.com/json-iterator/go v1.1.11 // indirect + github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect + github.com/google/uuid v1.3.0 // indirect + github.com/imdario/mergo v0.3.6 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/josharian/intern v1.0.0 // indirect + github.com/json-iterator/go v1.1.12 // indirect + github.com/kr/pretty v0.3.1 // indirect + github.com/mailru/easyjson v0.7.7 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect - github.com/modern-go/reflect2 v1.0.1 // indirect + github.com/modern-go/reflect2 v1.0.2 // indirect + github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect + github.com/onsi/ginkgo/v2 v2.13.0 // indirect + github.com/onsi/gomega v1.27.10 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/spf13/pflag v1.0.5 // indirect + github.com/stretchr/testify v1.8.4 // indirect github.com/tidwall/gjson v1.14.0 // indirect - golang.org/x/net v0.7.0 // indirect - golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d // indirect - golang.org/x/sys v0.5.0 // indirect - golang.org/x/term v0.5.0 // indirect - golang.org/x/text v0.7.0 // indirect - golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect - google.golang.org/appengine v1.6.5 // indirect - google.golang.org/protobuf v1.26.0 // indirect + golang.org/x/net v0.16.0 // indirect + golang.org/x/oauth2 v0.12.0 // indirect + golang.org/x/sys v0.13.0 // indirect + golang.org/x/term v0.13.0 // indirect + golang.org/x/text v0.13.0 // indirect + golang.org/x/time v0.3.0 // indirect + golang.org/x/tools v0.14.0 // indirect + google.golang.org/appengine v1.6.7 // indirect + google.golang.org/protobuf v1.31.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - gopkg.in/yaml.v3 v3.0.0 // indirect - k8s.io/klog/v2 v2.9.0 // indirect - k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c // indirect - k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a // indirect - sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect - sigs.k8s.io/yaml v1.2.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect + k8s.io/klog/v2 v2.100.1 // indirect + k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect + k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect + sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect + sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect + sigs.k8s.io/yaml v1.3.0 // indirect ) diff --git a/images/kube-webhook-certgen/rootfs/go.sum b/images/kube-webhook-certgen/rootfs/go.sum index 7817b7f29..29bcb59ac 100644 --- a/images/kube-webhook-certgen/rootfs/go.sum +++ b/images/kube-webhook-certgen/rootfs/go.sum @@ -77,6 +77,7 @@ github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA= github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= +github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -89,20 +90,22 @@ github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25Kn github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc= github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs= +github.com/emicklei/go-restful/v3 v3.10.2 h1:hIovbnmBTLjHXkqEBUz3HGpXZdM7ZrE9fJIZIqlJLqE= +github.com/emicklei/go-restful/v3 v3.10.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= -github.com/evanphx/json-patch v4.11.0+incompatible h1:glyUF9yIYtMHzn8xaKw5rMhdWcwsYV8dZHIq5567/xs= github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= +github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH5pOlLGNtQ5lPWQu84= +github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= -github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= @@ -117,15 +120,25 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas= github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= -github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc= github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= +github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= +github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= +github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= +github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8= github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg= +github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8= +github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= +github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= +github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4= @@ -158,19 +171,23 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA= +github.com/google/gnostic v0.5.7-v3refs h1:FhTMOKj2VhjpouxvWJAV1TL304uMlb9zcDqkl6cEI54= +github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= +github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g= github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= @@ -180,13 +197,16 @@ github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OI github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9RwLgmVFfReJN+KbQ8ExNEUUoQ= +github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik= github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= +github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU= -github.com/googleapis/gnostic v0.5.5 h1:9fHAtK0uDfpveeqqo1hkEZJcFvYXAiCN3UutL8F9xHw= github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA= github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY= github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= @@ -218,18 +238,22 @@ github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2p github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/imdario/mergo v0.3.5 h1:JboBksRwiiAJWvIYJVo46AfV+IAIKZpfrSzVKj42R4Q= github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= -github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM= +github.com/imdario/mergo v0.3.6 h1:xTNEAn+kxVO7dTZGu0CegyqKZmoWFI0rF8UxjlB2d28= +github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA= github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo= github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8= +github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= -github.com/json-iterator/go v1.1.11 h1:uVUAXhF2To8cbw/3xN3pxj6kk7TYKs98NIrTqPlMWAQ= github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= +github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk= github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU= @@ -244,6 +268,9 @@ github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxv github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -252,6 +279,8 @@ github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czP github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc= github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= +github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0= +github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= @@ -271,16 +300,16 @@ github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= -github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI= github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= +github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw= -github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs= github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= -github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78= github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= github.com/onrik/logrus v0.9.0 h1:oT7VstCUxWBoX7fswYK61fi9bzRBSpROq5CR2b7wxQo= @@ -288,16 +317,19 @@ github.com/onrik/logrus v0.9.0/go.mod h1:qfe9NeZVAJfIxviw3cYkZo3kvBtLoPRJriAO8zl github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= -github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA= github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY= +github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4= +github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o= github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= -github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= +github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= +github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M= github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= +github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -329,7 +361,11 @@ github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40T github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg= github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= +github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= +github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA= github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts= github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= @@ -337,8 +373,9 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= -github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE= github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= +github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0= +github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc= github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA= github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM= @@ -347,8 +384,9 @@ github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasO github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ= github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk= github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cobra v1.1.3 h1:xghbfqPkxzxP3C/f3n5DdpAbdKLj4ZE4BWQI362l53M= github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo= +github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= +github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo= github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= @@ -358,13 +396,19 @@ github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5q github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= +github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw= github.com/tidwall/gjson v1.14.0 h1:6aeJ0bzojgWLa82gDQHcx3S0Lr/O51I9bJ5nv6JFx5w= github.com/tidwall/gjson v1.14.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= @@ -483,14 +527,15 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.16.0 h1:7eBu7KsSvFDtSXUIDbh3aqlK4DPsZ1rByC8PFfBThos= +golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4= +golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -545,13 +590,14 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= +golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.5.0 h1:n2a8QNdAb0sZNpU9R1ALUXBbY+w51fCQDN+7EdxNBsY= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= +golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -559,14 +605,15 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= +golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= -golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs= golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= +golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -607,10 +654,11 @@ golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc= +golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= @@ -626,8 +674,9 @@ google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9Ywl google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= -google.golang.org/appengine v1.6.5 h1:tycE03LOZYQNhDpS27tcQdAzLCVMaj7QT2SXxebnpCM= google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= +google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= @@ -675,14 +724,16 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= -google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= +google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU= gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= @@ -691,7 +742,6 @@ gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k= gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo= gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= -gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74= gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= @@ -706,8 +756,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA= -gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk= gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= @@ -716,33 +766,43 @@ honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.22.6 h1:acjE5ABt0KpsBI9QCtLqaQEPSF94jOtE/LoFxSYasSE= k8s.io/api v0.22.6/go.mod h1:q1F7IfaNrbi/83ebLy3YFQYLjPSNyunZ/IXQxMmbwCg= -k8s.io/apimachinery v0.22.6 h1:z7vxNRkFX0NToA+8D17kzLZ/T4t+DqwzUlqqbqRepRs= +k8s.io/api v0.27.6 h1:PBWu/lywJe2qQcshMjubzcBg7+XDZOo7O8JJAWuYtUo= +k8s.io/api v0.27.6/go.mod h1:AQYj0UsFCp3qJE7bOVnUuy4orCsXVkvHefnbYQiNWgk= k8s.io/apimachinery v0.22.6/go.mod h1:ZvVLP5iLhwVFg2Yx9Gh5W0um0DUauExbRhe+2Z8I1EU= +k8s.io/apimachinery v0.27.6 h1:mGU8jmBq5o8mWBov+mLjdTBcU+etTE19waies4AQ6NE= +k8s.io/apimachinery v0.27.6/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= k8s.io/apiserver v0.22.6/go.mod h1:OlL1rGa2kKWGj2JEXnwBcul/BwC9Twe95gm4ohtiIIs= -k8s.io/client-go v0.22.6 h1:ugAXeC312xeGXsn7zTRz+btgtLBnW3qYhtUUpVQL7YE= k8s.io/client-go v0.22.6/go.mod h1:TffU4AV2idZGeP+g3kdFZP+oHVHWPL1JYFySOALriw0= +k8s.io/client-go v0.27.6 h1:vzI8804gpUtpMCNaFjIFyJrifH7u//LJCJPy8fQuYQg= +k8s.io/client-go v0.27.6/go.mod h1:PMsXcDKiJTW7PHJ64oEsIUJF319wm+EFlCj76oE5QXM= k8s.io/code-generator v0.22.6/go.mod h1:iOZwYADSgFPNGWfqHFfg1V0TNJnl1t0WyZluQp4baqU= k8s.io/component-base v0.22.6/go.mod h1:ngHLefY4J5fq2fApNdbWyj4yh0lvw36do4aAjNN8rc8= k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/gengo v0.0.0-20201214224949-b6c5ce23f027/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.9.0 h1:D7HV+n1V57XeZ0m6tdRkfknthUaM06VFbWldOFh8kzM= k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec= +k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= +k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-aggregator v0.22.6 h1:/iaXzOWia2dqOQkIA9eJtkmfTveJMLz3Dci9ZA/WgmU= k8s.io/kube-aggregator v0.22.6/go.mod h1:0RSTzxqiwsj5HUlov195Z72ZKyE4qgedKXCl6sLKAjM= -k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c h1:jvamsI1tn9V0S8jicyX82qaFC0H/NKxv2e5mbqsgR80= k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw= -k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a h1:8dYfu/Fc9Gz2rNJKB9IQRGgQOh2clmRzNIPPY1xLY5g= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg= +k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg= k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA= +k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY= +k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= +sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw= -sigs.k8s.io/structured-merge-diff/v4 v4.2.1 h1:bKCqE9GvQ5tiVHn5rfn1r+yao3aLQEaLzkkmAkf+A6Y= sigs.k8s.io/structured-merge-diff/v4 v4.2.1/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4= -sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q= +sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= +sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E= sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc= +sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= +sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8= diff --git a/images/nginx/TAG b/images/nginx/TAG index 8acdd82b7..4e379d2bf 100644 --- a/images/nginx/TAG +++ b/images/nginx/TAG @@ -1 +1 @@ -0.0.1 +0.0.2 diff --git a/images/opentelemetry/rootfs/go.mod b/images/opentelemetry/rootfs/go.mod index 2ca85f584..0f48b0988 100644 --- a/images/opentelemetry/rootfs/go.mod +++ b/images/opentelemetry/rootfs/go.mod @@ -1,3 +1,3 @@ module init-otel -go 1.21.1 +go 1.21.3 diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index dc83dd4a2..b70c57b7b 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -43,7 +43,7 @@ image: --pull \ --push \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.21.1 \ + --build-arg GOLANG_VERSION=1.21.3 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -54,7 +54,7 @@ image: --build-arg YAML_LINT_VERSION=1.27.1 \ --build-arg YAMALE_VERSION=4.0.4 \ --build-arg HELM_VERSION=3.11.2 \ - --build-arg GINKGO_VERSION=2.9.5 \ + --build-arg GINKGO_VERSION=2.13.0 \ --build-arg GOLINT_VERSION=latest \ -t ${IMAGE}:${TAG} rootfs @@ -64,7 +64,7 @@ build: ensure-buildx --progress=${PROGRESS} \ --pull \ --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ - --build-arg GOLANG_VERSION=1.21.1 \ + --build-arg GOLANG_VERSION=1.21.3 \ --build-arg ETCD_VERSION=3.4.3-0 \ --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ @@ -75,7 +75,7 @@ build: ensure-buildx --build-arg YAML_LINT_VERSION=1.27.1 \ --build-arg YAMALE_VERSION=4.0.4 \ --build-arg HELM_VERSION=3.11.2 \ - --build-arg GINKGO_VERSION=2.9.5 \ + --build-arg GINKGO_VERSION=2.13.0 \ --build-arg GOLINT_VERSION=latest \ -t ${IMAGE}:${TAG} rootfs diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 38843c2db..a513334a2 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -17,7 +17,8 @@ limitations under the License. package annotations import ( - "github.com/imdario/mergo" + "dario.cat/mergo" + "k8s.io/ingress-nginx/internal/ingress/annotations/canary" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" "k8s.io/ingress-nginx/internal/ingress/annotations/opentelemetry" diff --git a/magefiles/go.mod b/magefiles/go.mod index ac05f6b89..f2c56c79c 100644 --- a/magefiles/go.mod +++ b/magefiles/go.mod @@ -1,6 +1,6 @@ module k8s.io/ingress-nginx/magefiles -go 1.21.1 +go 1.21.3 require ( github.com/blang/semver/v4 v4.0.0 @@ -17,16 +17,22 @@ require ( github.com/Masterminds/semver v1.5.0 // indirect github.com/cyphar/filepath-securejoin v0.2.4 // indirect github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect + github.com/fsnotify/fsnotify v1.6.0 // indirect github.com/ghodss/yaml v1.0.0 // indirect github.com/gobwas/glob v0.2.3 // indirect github.com/golang/protobuf v1.5.3 // indirect github.com/google/go-querystring v1.1.0 // indirect + github.com/kr/pretty v0.3.1 // indirect + github.com/onsi/ginkgo v1.16.5 // indirect + github.com/onsi/gomega v1.27.10 // indirect github.com/rogpeppe/go-internal v1.11.0 // indirect - golang.org/x/crypto v0.13.0 // indirect - golang.org/x/net v0.15.0 // indirect + github.com/stretchr/testify v1.8.4 // indirect + golang.org/x/crypto v0.14.0 // indirect + golang.org/x/net v0.16.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.31.0 // indirect + gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect gopkg.in/yaml.v2 v2.4.0 // indirect - k8s.io/apimachinery v0.27.4 // indirect + k8s.io/apimachinery v0.27.6 // indirect k8s.io/helm v2.17.0+incompatible // indirect ) diff --git a/magefiles/go.sum b/magefiles/go.sum index 8cd8c9420..32da55ddc 100644 --- a/magefiles/go.sum +++ b/magefiles/go.sum @@ -12,6 +12,7 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 h1:aRd8M7HJVZOqn/vhOzrGcQH0lNAMkqMn+pXUYkatmcA= github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= @@ -31,22 +32,20 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= github.com/helm/helm v2.17.0+incompatible h1:0iy95yMXrfWpwaoOA9XRP+cTvitTrq+LcJV9DvR5n1Y= github.com/helm/helm v2.17.0+incompatible/go.mod h1:ahXhuvluW4YnSL6W6hDVetZsVK8Pv4BP8OwKli7aMqo= -github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI= github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= -github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= -github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= -github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/magefile/mage v1.15.0 h1:BvGheCMAsG3bWUDbZ8AyXXpCNwU9u5CB6sM+HNb9HYg= github.com/magefile/mage v1.15.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= +github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= -github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94= github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY= -github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E= -github.com/onsi/gomega v1.27.4/go.mod h1:riYq/GJKh8hhoM01HN6Vmuy93AarCXCBGpvFDK3q3fQ= +github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M= @@ -56,24 +55,20 @@ github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNX github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= -github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk= github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= -golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= +golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= -golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8= -golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= +golang.org/x/net v0.16.0 h1:7eBu7KsSvFDtSXUIDbh3aqlK4DPsZ1rByC8PFfBThos= golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4= golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= -golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= @@ -87,9 +82,8 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= @@ -102,7 +96,6 @@ gopkg.in/yaml.v3 v3.0.0-20191026110619-0b21df46bc1d/go.mod h1:K4uyk7z7BCEPqu6E+C gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/apimachinery v0.27.4 h1:CdxflD4AF61yewuid0fLl6bM4a3q04jWel0IlP+aYjs= -k8s.io/apimachinery v0.27.4/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= +k8s.io/apimachinery v0.27.6 h1:mGU8jmBq5o8mWBov+mLjdTBcU+etTE19waies4AQ6NE= k8s.io/helm v2.17.0+incompatible h1:Bpn6o1wKLYqKM3+Osh8e+1/K2g/GsQJ4F4yNF2+deao= k8s.io/helm v2.17.0+incompatible/go.mod h1:LZzlS4LQBHfciFOurYBFkCMTaZ0D1l+p0teMg7TSULI= diff --git a/test/e2e/run-chart-test.sh b/test/e2e/run-chart-test.sh index 6df4fb1e7..425d043e9 100755 --- a/test/e2e/run-chart-test.sh +++ b/test/e2e/run-chart-test.sh @@ -78,7 +78,7 @@ fi if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.13.0 fi echo "[dev-env] building image" make -C ${DIR}/../../ clean-image build image diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index 4dc1bddd0..5c4ba5c1e 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -96,7 +96,7 @@ fi if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.13.0 fi echo "[dev-env] .. done building controller images" From 2d3ee50949ae6f15ed34c365b426b7d452ab6600 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 11 Oct 2023 17:53:19 -0400 Subject: [PATCH 390/822] update nginx base, httpbun, e2e, helm webhook cert gen (#10506) * update nginx base, httpbun, e2e, helm webhook cert gen Signed-off-by: James Strong * fix helm docs Signed-off-by: James Strong --------- Signed-off-by: James Strong --- NGINX_BASE | 2 +- build/run-in-docker.sh | 2 +- charts/ingress-nginx/README.md | 4 ++-- charts/ingress-nginx/values.yaml | 4 ++-- test/e2e-image/Makefile | 2 +- test/e2e/HTTPBUN_IMAGE | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/NGINX_BASE b/NGINX_BASE index 14a7ee54b..d6cecf76b 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:v20230623-427f3d2fb@sha256:7b479f66872c0b1cb0f1315e305b8a3e9c6da846c7dd3855db99bc8cfd6791e1 +registry.k8s.io/ingress-nginx/nginx:v20231011-8b53cabe0@sha256:34881d62f71e8573fb765c40585dba28a1148206fbbe2c3871ad3f4e8c6e360f diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 2ac7220a8..bec825291 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230907-5bb82dcb7@sha256:421cda0f65a949b8b67b5e62a45071702d19ed458a3e2ba753171b0e66943210} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20231011-8b53cabe0@sha256:ed0dad805c635e66469b4ac376010eebdd0b3fe62d753f58db1632d6f12f451d} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 9016e9290..c86db7480 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -251,11 +251,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.admissionWebhooks.namespaceSelector | object | `{}` | | | controller.admissionWebhooks.objectSelector | object | `{}` | | | controller.admissionWebhooks.patch.enabled | bool | `true` | | -| controller.admissionWebhooks.patch.image.digest | string | `"sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"` | | +| controller.admissionWebhooks.patch.image.digest | string | `"sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80"` | | | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | | | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | | | controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | | -| controller.admissionWebhooks.patch.image.tag | string | `"v20230407"` | | +| controller.admissionWebhooks.patch.image.tag | string | `"v20231011-8b53cabe0"` | | | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources | | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | | | controller.admissionWebhooks.patch.podAnnotations | object | `{}` | | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 196e14017..8b8356656 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -640,8 +640,8 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: v20230407 - digest: sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + tag: v20231011-8b53cabe0 + digest: sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 pullPolicy: IfNotPresent # -- Provide a priority class name to the webhook patching job ## diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index bd3453253..ff5aa8fb6 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230907-5bb82dcb7@sha256:421cda0f65a949b8b67b5e62a45071702d19ed458a3e2ba753171b0e66943210" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20231011-8b53cabe0@sha256:ed0dad805c635e66469b4ac376010eebdd0b3fe62d753f58db1632d6f12f451d" image: echo "..entered Makefile in /test/e2e-image" diff --git a/test/e2e/HTTPBUN_IMAGE b/test/e2e/HTTPBUN_IMAGE index 2d95865c7..7e83b49fe 100644 --- a/test/e2e/HTTPBUN_IMAGE +++ b/test/e2e/HTTPBUN_IMAGE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/e2e-test-httpbun:v20230505-v0.0.1 +registry.k8s.io/ingress-nginx/e2e-test-httpbun:v20231011-8b53cabe0 From b473801a4c206cf163be7f7b45003872eaf8a692 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 12 Oct 2023 08:20:45 -0300 Subject: [PATCH 391/822] Bump x/net (#10514) --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 8ea342f31..8444772d1 100644 --- a/go.mod +++ b/go.mod @@ -102,7 +102,7 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.13.0 // indirect - golang.org/x/net v0.16.0 // indirect + golang.org/x/net v0.17.0 // indirect golang.org/x/oauth2 v0.12.0 // indirect golang.org/x/sys v0.13.0 // indirect golang.org/x/term v0.13.0 // indirect diff --git a/go.sum b/go.sum index ea572e4b3..9253735f5 100644 --- a/go.sum +++ b/go.sum @@ -466,8 +466,8 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.16.0 h1:7eBu7KsSvFDtSXUIDbh3aqlK4DPsZ1rByC8PFfBThos= -golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= +golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= +golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= From 6f2ad83b0d914ae9c0a33bebf3630f296ffb228d Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 12 Oct 2023 09:51:50 -0400 Subject: [PATCH 392/822] release 1.9.3 Signed-off-by: James Strong --- README.md | 2 + TAG | 2 +- changelog/Changelog-1.9.3.md | 27 ++++++++++ charts/ingress-nginx/Chart.yaml | 9 ++-- charts/ingress-nginx/README.md | 8 +-- .../changelog/Changelog-4.8.2.md | 10 ++++ charts/ingress-nginx/values.yaml | 6 +-- deploy/static/provider/aws/deploy.yaml | 50 +++++++++---------- .../aws/nlb-with-tls-termination/deploy.yaml | 50 +++++++++---------- deploy/static/provider/baremetal/deploy.yaml | 50 +++++++++---------- deploy/static/provider/cloud/deploy.yaml | 50 +++++++++---------- deploy/static/provider/do/deploy.yaml | 50 +++++++++---------- deploy/static/provider/exoscale/deploy.yaml | 50 +++++++++---------- deploy/static/provider/kind/deploy.yaml | 50 +++++++++---------- deploy/static/provider/oracle/deploy.yaml | 50 +++++++++---------- deploy/static/provider/scw/deploy.yaml | 50 +++++++++---------- docs/e2e-tests.md | 2 +- 17 files changed, 278 insertions(+), 238 deletions(-) create mode 100644 changelog/Changelog-1.9.3.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.8.2.md diff --git a/README.md b/README.md index 9892b08a8..071ee69ff 100644 --- a/README.md +++ b/README.md @@ -38,9 +38,11 @@ the versions listed. Ingress-Nginx versions **may** work on older versions, but | Supported | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | |:--:|-----------------------|------------------------------|----------------|---------------|------------------------------| +| 🔄 | **v1.9.3** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | | 🔄 | **v1.9.1** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | | 🔄 | **v1.9.0** | 1.28, 1.27,1.26, 1.25 | 3.18.2 | 1.21.6 | 4.8.* | | 🔄 | **v1.8.2** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | +| 🔄 | **v1.8.4** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.1** | 1.27,1.26, 1.25, 1.24 | 3.18.2 | 1.21.6 | 4.7.* | | 🔄 | **v1.8.0** | 1.27,1.26, 1.25, 1.24 | 3.18.0 | 1.21.6 | 4.7.* | | 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | diff --git a/TAG b/TAG index ba1e8bf0b..7517f6876 100644 --- a/TAG +++ b/TAG @@ -1 +1 @@ -v1.9.1 +v1.9.3 diff --git a/changelog/Changelog-1.9.3.md b/changelog/Changelog-1.9.3.md new file mode 100644 index 000000000..45dfaa371 --- /dev/null +++ b/changelog/Changelog-1.9.3.md @@ -0,0 +1,27 @@ +# Changelog + +### 1.9.3 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.9.3@sha256:df4931fd6859fbf1a71e785f02a44b2f9a16f010ae852c442e9bb779cbefdc86 + +### All Changes: + +* update nginx base, httpbun, e2e, helm webhook cert gen (#10506) +* added warning for configuration-snippets usage (#10492) +* Remove legacy GeoIP from controller (#10495) +* add upstream patch for CVE-2023-44487 (#10494) +* Revert "Remove curl from nginx base image (#10477)" (#10479) +* update error and otel to have all the arch we support (#10476) +* Remove curl from nginx base image (#10477) + +### Dependencies updates: +* Bump x/net (#10514) +* Bump curl and Go version (#10503) +* Bump google.golang.org/grpc from 1.58.2 to 1.58.3 (#10496) +* Bump github.com/prometheus/client_model (#10486) +* Bump ossf/scorecard-action from 2.2.0 to 2.3.0 (#10487) +* Bump golang.org/x/crypto from 0.13.0 to 0.14.0 (#10485) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.9.1...controller-controller-v1.9.3 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index d49b3f7cc..c23daa33e 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,9 +1,10 @@ annotations: - artifacthub.io/changes: | - - "Update Ingress-Nginx version controller-v1.9.1" + artifacthub.io/changes: |- + - "update nginx base, httpbun, e2e, helm webhook cert gen (#10506)" + - "Update Ingress-Nginx version controller-v1.9.3" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.9.1 +appVersion: 1.9.3 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer home: https://github.com/kubernetes/ingress-nginx @@ -19,4 +20,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.8.1 +version: 4.8.2 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index c86db7480..31890e175 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.8.1](https://img.shields.io/badge/Version-4.8.1-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square) +![Version: 4.8.2](https://img.shields.io/badge/Version-4.8.2-informational?style=flat-square) ![AppVersion: 1.9.3](https://img.shields.io/badge/AppVersion-1.9.3-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -314,13 +314,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25"` | | -| controller.image.digestChroot | string | `"sha256:2ac744ef08850ee86ad7162451a6879f47c1a41c6a757f6b6f913c52103b8836"` | | +| controller.image.digest | string | `"sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98"` | | +| controller.image.digestChroot | string | `"sha256:df4931fd6859fbf1a71e785f02a44b2f9a16f010ae852c442e9bb779cbefdc86"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.9.1"` | | +| controller.image.tag | string | `"v1.9.3"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.8.2.md b/charts/ingress-nginx/changelog/Changelog-4.8.2.md new file mode 100644 index 000000000..3fbb19f53 --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.8.2.md @@ -0,0 +1,10 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.8.2 + +* - "update nginx base, httpbun, e2e, helm webhook cert gen (#10506)" +* - "Update Ingress-Nginx version controller-v1.9.3" + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.8.1...helm-chart-4.8.2 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 8b8356656..890282233 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -24,9 +24,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.9.1" - digest: sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 - digestChroot: sha256:2ac744ef08850ee86ad7162451a6879f47c1a41c6a757f6b6f913c52103b8836 + tag: "v1.9.3" + digest: sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 + digestChroot: sha256:df4931fd6859fbf1a71e785f02a44b2f9a16f010ae852c442e9bb779cbefdc86 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index 6bfeeefcb..bb210d43d 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -543,7 +543,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -592,7 +592,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -650,7 +650,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index a132f38e1..71d7fba18 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -431,7 +431,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -455,7 +455,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -530,7 +530,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -541,7 +541,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -555,7 +555,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -577,7 +577,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -588,7 +588,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -604,7 +604,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -639,7 +639,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -662,7 +662,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index b35870f51..c801a86d4 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -440,7 +440,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +512,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +523,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -537,7 +537,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -559,7 +559,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +570,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -586,7 +586,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -608,7 +608,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +621,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -644,7 +644,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index f1a023d23..af94f2db1 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -539,7 +539,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -588,7 +588,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -646,7 +646,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 21d9e7d79..500d33c8d 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -542,7 +542,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -591,7 +591,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -649,7 +649,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index 720d6a855..27e1029a1 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -523,7 +523,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -534,7 +534,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -548,7 +548,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -570,7 +570,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -581,7 +581,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -597,7 +597,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -632,7 +632,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -655,7 +655,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index f162a4ce0..52c312d40 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -549,7 +549,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -598,7 +598,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -656,7 +656,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/oracle/deploy.yaml b/deploy/static/provider/oracle/deploy.yaml index 8aa6a4c55..fe31765bc 100644 --- a/deploy/static/provider/oracle/deploy.yaml +++ b/deploy/static/provider/oracle/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,7 +422,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -446,7 +446,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -518,7 +518,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -529,7 +529,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -543,7 +543,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -565,7 +565,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -576,7 +576,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -592,7 +592,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -614,7 +614,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -627,7 +627,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -650,7 +650,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 2ffcd28f8..5f962a478 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -421,7 +421,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 spec: containers: - args: @@ -445,7 +445,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.9.1@sha256:605a737877de78969493a4b1213b21de4ee425d2926906857b98050f57a95b25 + image: registry.k8s.io/ingress-nginx/controller:v1.9.3@sha256:8fd21d59428507671ce0fb47f818b1d859c92d2ad07bb7c947268d433030ba98 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +517,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +528,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-create spec: containers: @@ -542,7 +542,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: create securityContext: @@ -564,7 +564,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +575,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission-patch spec: containers: @@ -591,7 +591,7 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 imagePullPolicy: IfNotPresent name: patch securityContext: @@ -613,7 +613,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +626,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission namespace: ingress-nginx spec: @@ -649,7 +649,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.9.1 + app.kubernetes.io/version: 1.9.3 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 0a6ca0a7d..8418d7b31 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -555,4 +555,4 @@ Do not try to edit it manually. ### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L38) - [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L46) - [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L169) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file From 2f7486b70931648dccd0e6a5cbd97ae12fe86726 Mon Sep 17 00:00:00 2001 From: Tyler Brewer Date: Thu, 12 Oct 2023 12:02:46 -0400 Subject: [PATCH 393/822] explicitly state TLS termination location (#10516) --- docs/examples/grpc/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/examples/grpc/README.md b/docs/examples/grpc/README.md index 508b23fb8..f6bd96e20 100644 --- a/docs/examples/grpc/README.md +++ b/docs/examples/grpc/README.md @@ -9,6 +9,7 @@ This example demonstrates how to route traffic to a gRPC service through the Ing 3. You have the ingress-nginx-controller installed as per docs. 4. You have a backend application running a gRPC server listening for TCP traffic. If you want, you can use as an example. 5. You're also responsible for provisioning an SSL certificate for the ingress. So you need to have a valid SSL certificate, deployed as a Kubernetes secret of type `tls`, in the same namespace as the gRPC application. + - Note: To use gRPC with ingress-nginx, TLS _must_ be terminated by the ingress or gRPC server (using the `backend-protocol: "GRPCS"` annotation described below). ### Step 1: Create a Kubernetes `Deployment` for gRPC app From b9d8bb406ceadcdbb240223842ec61ee42cb3360 Mon Sep 17 00:00:00 2001 From: Matt Clegg Date: Thu, 12 Oct 2023 18:51:40 +0100 Subject: [PATCH 394/822] DOCS Remove support for running Both (#10255) --- charts/ingress-nginx/templates/controller-daemonset.yaml | 2 +- charts/ingress-nginx/templates/controller-deployment.yaml | 2 +- charts/ingress-nginx/templates/controller-hpa.yaml | 2 +- charts/ingress-nginx/templates/controller-keda.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index b55db1761..6a06c3215 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -1,4 +1,4 @@ -{{- if or (eq .Values.controller.kind "DaemonSet") (eq .Values.controller.kind "Both") -}} +{{- if eq .Values.controller.kind "DaemonSet" -}} {{- include "isControllerTagValid" . -}} apiVersion: apps/v1 kind: DaemonSet diff --git a/charts/ingress-nginx/templates/controller-deployment.yaml b/charts/ingress-nginx/templates/controller-deployment.yaml index df597076a..7347ee8b8 100644 --- a/charts/ingress-nginx/templates/controller-deployment.yaml +++ b/charts/ingress-nginx/templates/controller-deployment.yaml @@ -1,4 +1,4 @@ -{{- if or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both") -}} +{{- if eq .Values.controller.kind "Deployment" -}} {{- include "isControllerTagValid" . -}} apiVersion: apps/v1 kind: Deployment diff --git a/charts/ingress-nginx/templates/controller-hpa.yaml b/charts/ingress-nginx/templates/controller-hpa.yaml index f212bc4f5..e531df2e6 100644 --- a/charts/ingress-nginx/templates/controller-hpa.yaml +++ b/charts/ingress-nginx/templates/controller-hpa.yaml @@ -1,4 +1,4 @@ -{{- if and (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}} +{{- if and (eq .Values.controller.kind "Deployment") .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}} apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} kind: HorizontalPodAutoscaler metadata: diff --git a/charts/ingress-nginx/templates/controller-keda.yaml b/charts/ingress-nginx/templates/controller-keda.yaml index c0d95a98e..bbd2237f0 100644 --- a/charts/ingress-nginx/templates/controller-keda.yaml +++ b/charts/ingress-nginx/templates/controller-keda.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.controller.keda.enabled (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) -}} +{{- if and .Values.controller.keda.enabled (eq .Values.controller.kind "Deployment") -}} # https://keda.sh/docs/ apiVersion: {{ .Values.controller.keda.apiVersion }} From 9db8fe51c86631d2a21d9e6cd0c21f8e134741d0 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 12 Oct 2023 16:30:12 -0300 Subject: [PATCH 395/822] Update mkdocs version (#10522) --- .github/actions/mkdocs/Dockerfile | 4 +--- .github/actions/mkdocs/action.sh | 2 +- Makefile | 2 +- docs/requirements.txt | 4 ++++ mkdocs.yml | 1 - 5 files changed, 7 insertions(+), 6 deletions(-) create mode 100644 docs/requirements.txt diff --git a/.github/actions/mkdocs/Dockerfile b/.github/actions/mkdocs/Dockerfile index b5b564d3e..378128978 100644 --- a/.github/actions/mkdocs/Dockerfile +++ b/.github/actions/mkdocs/Dockerfile @@ -1,6 +1,4 @@ -FROM squidfunk/mkdocs-material:6.2.4 - -RUN pip install mkdocs-awesome-pages-plugin +FROM squidfunk/mkdocs-material:9.4.5 COPY action.sh /action.sh diff --git a/.github/actions/mkdocs/action.sh b/.github/actions/mkdocs/action.sh index 07ddbddb9..d9f8ecbfc 100644 --- a/.github/actions/mkdocs/action.sh +++ b/.github/actions/mkdocs/action.sh @@ -16,7 +16,7 @@ set -e -REQUIREMENTS="${GITHUB_WORKSPACE}/requirements.txt" +REQUIREMENTS="${GITHUB_WORKSPACE}/docs/requirements.txt" if [ -f "${REQUIREMENTS}" ]; then pip install -r "${REQUIREMENTS}" diff --git a/Makefile b/Makefile index 792cd56a7..cbda4dafb 100644 --- a/Makefile +++ b/Makefile @@ -271,5 +271,5 @@ release: ensure-buildx clean .PHONY: build-docs build-docs: - pip install -U mkdocs-material==6.2.4 mkdocs-awesome-pages-plugin mkdocs-minify-plugin mkdocs-redirects + pip install -r docs/requirements.txt mkdocs build --config-file mkdocs.yml diff --git a/docs/requirements.txt b/docs/requirements.txt new file mode 100644 index 000000000..5d5943b84 --- /dev/null +++ b/docs/requirements.txt @@ -0,0 +1,4 @@ +mkdocs-material==9.4.5 +mkdocs-awesome-pages-plugin==2.9.2 +mkdocs-minify-plugin==0.7.1 +mkdocs-redirects==1.2.1 \ No newline at end of file diff --git a/mkdocs.yml b/mkdocs.yml index 3243f8247..80f4acdf3 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -65,7 +65,6 @@ plugins: extra_css: [extra.css] -google_analytics: ["UA-118407822-1", "kubernetes.github.io"] nav: - Welcome: From 0055ba3ea6565340d31ba3d5c761db926da3dddb Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Mon, 16 Oct 2023 06:41:51 +0800 Subject: [PATCH 396/822] Remove legacy GeoIP from image (#10500) Signed-off-by: Jintao Zhang Co-authored-by: Ricardo Katz --- images/nginx/rootfs/Dockerfile | 1 - images/nginx/rootfs/build.sh | 8 +++----- images/nginx/rootfs/etc/nginx/geoip/GeoIP.dat | Bin 1242574 -> 0 bytes .../rootfs/etc/nginx/geoip/GeoIPASNum.dat | Bin 4638365 -> 0 bytes .../rootfs/etc/nginx/geoip/GeoLiteCity.dat | Bin 20539238 -> 0 bytes 5 files changed, 3 insertions(+), 6 deletions(-) delete mode 100644 images/nginx/rootfs/etc/nginx/geoip/GeoIP.dat delete mode 100644 images/nginx/rootfs/etc/nginx/geoip/GeoIPASNum.dat delete mode 100644 images/nginx/rootfs/etc/nginx/geoip/GeoLiteCity.dat diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index aba0ab70b..95f7a0288 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -39,7 +39,6 @@ RUN apk update \ openssl \ pcre \ zlib \ - geoip \ ca-certificates \ patch \ yajl \ diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index dc1d12547..06d60ae54 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -77,8 +77,8 @@ export LUA_UPSTREAM_VERSION=8aa93ead98ba2060d4efd594ae33a35d153589bf # Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.11...openresty:master export LUA_CJSON_VERSION=2.1.0.11 -# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.3...master -export GEOIP2_VERSION=a26c6beed77e81553686852dceb6c7fdacc5970d +# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.4...master +export GEOIP2_VERSION=a607a41a8115fecfc05b5c283c81532a3d605425 # Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20230410...v2.1-agentzh export LUAJIT_VERSION=2.1-20230410 @@ -164,7 +164,6 @@ apk add \ linux-headers \ libxslt-dev \ gd-dev \ - geoip-dev \ perl-dev \ libedit-dev \ mercurial \ @@ -263,7 +262,7 @@ fi get_src 8d39c6b23f941a2d11571daaccc04e69539a3fcbcc50a631837560d5861a7b96 \ "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz" -get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ +get_src b6c9c09fd43eb34a71e706ad780b2ead26549a9a9f59280fe558f5b7b980b7c6 \ "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" get_src deb4ab1ffb9f3d962c4b4a2c4bdff692b86a209e3835ae71ebdf3b97189e40a9 \ @@ -583,7 +582,6 @@ WITH_FLAGS="--with-debug \ --with-http_realip_module \ --with-http_auth_request_module \ --with-http_addition_module \ - --with-http_geoip_module \ --with-http_gzip_static_module \ --with-http_sub_module \ --with-http_v2_module \ diff --git a/images/nginx/rootfs/etc/nginx/geoip/GeoIP.dat b/images/nginx/rootfs/etc/nginx/geoip/GeoIP.dat deleted file mode 100644 index be8b031f7d11a1ff394a9840d114f12d5cae2e29..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1242574 zcmZUc1+*Qt_x(TD#;(gN6n87`6f5p-g#rbNyBD|O?(XjH?(XjH?hg0AXHSRU`>y|5 zckQ)va&nTKBxh!lnfD4%gc6kDnk5U@E?KBR06UIjr*VW3!O636%521tzqA3V5;KpWZkn?9lH|W%<h%0F3S zuJ%~(0ejk$dl~mO%1is0>}%Z5xIY|Va-i`b<2d8N#zTyU8V@rbZj?1us^1s={?Yci z9CaKVV-Fu|i9Dl@AMb$>k#eiwKMBtA@TtKk!zpkooM!zqb33QI$Qj10BF+4>T}npI zfpe{?!BX;kxBxDMi!_b})+ul?Tmo|zn5)3@{r;t}ttNAU%V4E`|8lqju7s=L6ZjOa z){=+U;B~kbu7l^`dAJ^KfCu0~xDjrGyA&n*{hN)q8E-L4c&o|${r>H__nO?NiII_hU(J(+3;O+s;9+>i@<)u1!xQkRxpW=_RUx9^lkk+~s#@}=bDfdS zebz|{U&!SzYv6MJ5@ZdQomVV;)hOW`@Fu*k*k#FE#|`Xder8avXee1=78h(4Xcw5gz!U{K1-ce$CiDsnm``Ao&X7Dy4VbXN&;k<` znAmkqYD^o}?@wa2A-W2f+-IQ-su}uCSzxLHQx}+~z_bO16_~lebOoj_Fq8GAGlR*D zwyA=0i_B&tD591K)nMVQM$Mnu3(QfV-0yELhxPk+^!sxcn5V#E1r{$bZ-Kq~{Y49m zD4_PtXPn=-fN^+%1x=K@kjcUY7Rj>ueF<;s_cdehvgIWT4EJ(S+w@zqz*2>D%`R;e zS;l190?U~!pUYP$uwurID;rlau4-J(xVmu-{wu@0y|rBkx@Fk6xg-EZUuJFB_|XZTVRg@ds=d&ajyb< z7ud&q|6Frlll?R|`hA%?pumBa98};ilX1p_jZ!$Iz@g?UqNIL@7dT>&4OU^c)ljojW;JlolU*H1s z3yoPjFE+m<*SS>jKj)X5Tv6akldE$1)h5>zxYp#lTzy@SK~J{N3f!)%K!Jw~ zJl*d0Q%JN|uvLNQ%jKNR?}z)uB!b`}2?_{BszzZLk^KY2zK{a)aY0)H0x ztH9p{{?RDtqOY)~nAY#t`~5lk{c9a$RJLy;y7d>=zzK`yr6Mw=q?{I55*b6IdZetl zh@7C1C@0j4Ojk@jQ#Uq>G)-E@iH&Vzr%2aC%Do~3IUiy&L6He_$xxGtj7ur_n@nn) z%qRLSyaNM~C2MMS^pi_Bp8jCt-%MTVKrY@8*R&uTJTk=b*}942!b zWpkb)^A=gMm=5cF5*Aso$U?<57%t!%6$6J`c@Xuo(a0dOTJu@<(<6I#z%TY)CP^q%5Kt$MOG=YYLSCH z;a4lNdJ)C#HHvIpMAy(Yi>y^-?IPbfo^McOogyQP=rSk!^3}RU)+?sVZB&uEk5P@>x5$3xy43DpL|u@b1C0k6#~BYc9%9sbm(F44hZ~PD9%($vIHPYE z)I!~699u*)_BaoRoF-=qPq6>r&?7)Gy`4DOu0Ey6sYOn+8|8To(CJ0aC~~IDo@FP? zCo-!n**Uk!c|~rhaASq@HO*wR!ZsByEOJp1MYd;(TwF}=BCaWNtt+~u$feG@tjOg> zt|)S4k*kVat+m$gKj^k)BYt?lf0S#{CH^`$;O-*Vt2z(Ujc)&KMQ$o`a}iBEHTV`! zLQRreJ?BLY5`IoY$~&LWx{cNsV9_wOlkuPxtK|Uu6w@73q@Wm@=}pe71pota*5b-nl;)`K5?- zez4AuMSe1onx^Hi)=}|4G%mUp6#3l}MR=K#!!@#h7x|}1Tp}s)uXBqfN+tT{Qq#Uq zp_H~$KUGvV4{}MxL~`YZ=8;jAR&$+ZiCQTQ2z5(Td!v-LIkVX+(Js+(R@c}wW(ry< z6O@>+#E24$l^9xLq7pNe7*=9pt4&^F3X@4nOll&tljRns%q7#8n5x9oPEJ!|x?DbO z3AIP=Qgv#x%Fa+?#ynTTnM=%4Vu2FFOUzngwi0udnA-}o8|N%Bhsl3E5}C)6`AW=h zGH>4BY{XTICcuKuTEr;HLM0Z?d1h)+C$m;9ZoWc^B}yz=VyWEVvL%*w)-pz|5t-6& zIVYF5nk=m7$+0~LgO6->F>|SDQ&ULAh&Yn)n347=AeM;-*Ew}J| ziI>e^$R#h9c*#7QORwbeS4-oA!|Ns9u<*?i@0h%m>%47}wd!51(|-Rw4_P*RA3FE5 z5+CLIAD8&V{L@?_4}YHXFG_r=rQzh)CBDh!^0t0*$oD0FC=rwi%lug4Cq-`s?Giti z_@%_3CH``eUrYRvm;KG;ccYA`VgJqEza5|d$+I$_Yr9{hXe^Y+&qGN{Wye z8;PveDbpXjMDx#}8HW)deSFiu!zsL4cw z+B0!ET>{zanAEwG88r{5EHhP^^~#JYGj*A1$}Cc5(K6GPnXb&7R-3+zCiyI7W|hq{ zGnSdj@|lfl(l8V0WNUw{t^$^b%xYIC zJCl)lOxV%MopNhCJGqNdmUs1th>R_>N0|dG-!sqMugqR$_Re*rwojRTotyP*e{&6l zrmJ#A#+5nP!qdwfQs&Sy$CWw0%wc5?FLP{e`3RFE^WrLdRGFilJjR&W&u%%CdqSC$ z%ben@6U&@rB6+qpb#rp6C8rINpHb#aC(kN#uF2WPb8?-miu0U2-*`bjF)k`|ahXfX zTw11Bp;Y0rGMATmyUaUft|)V5nY+u}Q|2lcyv}&FQLVbB%(XesT6le#8_L{R<|fN; zEpuC$n{%C8$|(4&pnkVoc*h{0-&y7^3l;h@oqH9%%RE))zB2chdBC|3mU+lTPo`3P zxXhzYK4Q#5uH=t7`FNQpOfn}tZT@nZSIRt7=GijOSt9-C%bezVU&tjdmU+oM>)Na3 z@wW|cSooUpb)%-SEWBCfEhoh_L*6a(o@Qg2Z_2!1<^#n>=YCk`qcWf6njf2}*`Jtv zYRqc<-24lpY<}svA(CB0zAf{eyyx8S%luI0_cDJd{#)`(Ug{^4pN)!ID*kJk-<-@A z{+|xNS&e_?rT#X_BG13({W4U>kBd%xWk)f#T%l57#tJi42r7gXrf^nNA+9i?d19

9s>;8x@)r+7&vMw~R;oN+jdm3cU(LD&xbB7R7)Sl$G^j0^3n?XoZO?Ok82j z^7y;HNvt_(u0NT{@?YY2XAbkZE6iy!mr)inSI^_*yvA&z&R<~xCx;ssG|KG?2#Zu$ zw8GLAmZ>npa@kqjWHI+$m$@Z!`I06}C=|7)LF@O5!tN5<`uT6u%#Mo{jE$sFuz8d8x^*zuuoEUL?P^RV-DXsc_gA>nZM(}=%i7%)?y=c>jrSQf zZItyug$FC?wwU~>O(gaGkqVDim^@&LfX6C4UP-qi%K=YRcv9}F@MeXlG*}Aq?!wa* zp3%(I{(pt%DroOrZB~&nZuScmUaas^CEXc&-TE)PZEET(6<)3ITHb86TtYQT9UQf>x3Z2xoux&cFEO85T(13`LhDoy=HIXGv7K7k8rCJYVI zx+V&kIA9VBC$nTy^Ov;c?!gr*+DsWRPr$qZQw2;NFipU;?$PW4)0xZ~Fk8U%0W$>Y zVMU5Ko!V`%S@YHw|hfH{M7QfY$C6)?97X1=oWe5yq* zN{AB{2pAsFk5jV?1}qftQ_RnC8u}IvST11sfJK7wk#Ny~5$3w>SxlbPwLm^JS<<+a zQSzk&mN8$}C~Fd~5U^s9Mw{JbBw*#hN3j8`1gvUzZR`=z@$PB?s|TzRq;KP_XI#^` zR>0Z;>jaDpSl1FMNPkoNLAB^4VwC0U2W$|qVZi8sjdD%ps&=W3^&38#Fq;Hvgc)Pp zG+?uU&CRz6*h(G_*izHLP7~^<;=*lmp_1FVN81~BFz#sF$+&aCE+)GM>=tmkk8v{` z8?Z;fo|;+#4~9GxvUk8f0gHz$5wdTxRHxPXHL zPLtVyLjn#BI40m&S9e&z5dlXA93IecvxP@#KI{D-tr1JaWnBEYfa3#B3OG67gn+tE zeziuND=r=JQxw^B=O56sL|k(5GXl;GxG3P_fU^S54mdC1{D5;btF`~H5E?w zFqy7F0iRhSF1h$60hhYvR|H%pw4;w$pwmEc;WYu*20Ww%8*p8~^;&2F zcLv-LaAUwN0k;O+BnRsKAFTzK5?5LA+XCj&&40jxmWWF(epkTV0rzRP1l*&w(C^=? z$?sfo>4-m|z@p6`O>axYB^Q4r;L(8R0-jg=4|rT^0Z%Lb2Q00Ze>B^zDK35SXEc-h z{bvJ4St2gE_zM9q2D}pRYQReY>-GCDYbHBaTsq>fY2oO)powjXxa8t*1-u;)ha@5I z1iY)Y9Po3%djanUd=c=aJRI<0z$XEp27DB-oi_h9MQuS`cEmr^Wa#%l*O*!&F1h$u z0bd7v7w~<+HyUfje~qI7;O~Gx z0(MvA54hQy;?fuYCqSpb|7xmRA}+ajA*2{m2?;_4NR4!NP-C;I&Uu3Yh1LuLz^J!B4>S}EE6&=K6PE_Z zqIE;o3mF}Y#g#l$e55#!~cmhS!~H7#ug!4Y667p9=?35$hINdg=`;^MU}ykB#Rh3h3p)%OUSMvS@akjF|uedHe?S?r;z>C2=#XPVjtv>S#s{zE6GBc5IVt4ikily?TaVd_J1yjNc{t?UkTXKg3^^<0?2xio zV&rw#9<+|m3pqdJ!jOwX2E2|g2)WMlM>xc5YGSXQOEoAVH-_94a=EO9ToZC_$dw^i zX;FK^Oyc!5`Twq|>r|;~{NEKc%i*e?B1>F`hk5|MUA$L0KE{&SW-Nt*2 z)A^p^zL5K!91-$>NwyFk4tXTx;fO~f9u0X+gB5XL#N%qALQTZf5l@CZ74oY>U&zyn z10nCrf|hy6b0M#4SZ(n6kQYN<3VA`n&HfR-98%S7e@JYJxYnKc>mhH1ysc2Lpb@5T zWxN$K)Vbo)5r0<>*S3GiG?s`5G4< z@TmA7GPNb*l8b*E@?FS}AwPwDuP~_iuZZegap{QvtT3ziuQ+Lmxa8u$hy0;{98r(> zGvqJLpNLAt-y#2m=^Oloh<~-3`U>dG=2GG+D_)G4TigB-Gg=}pxp)wz_e)Vk91%u5 zXSpzmm`CwHVtPx&r6%5pXhuvJF*KqT(T?av3`BGycGW|A#0=IHm%jLrh?#Z%8!@jX z;*yI`6ftqcWD%1`OcF7o-=8#M9p{QmM|_Hi#pTQhJ-tdIE)<_8V%mt+B36%>PA!aB zC}Lq%t=>h<88KJHOcBE(W{sFl4TxB>-=8I7Ia?5y9r4*CR@ALg#G00fOD;aQ`W`WV z!~$w|ls>S}r|O(5E*b0?q0-~ zidbK_{Sj-qthg+QFBh?V#7Yq>N30N~PZ=vl>5Ev(6&H%HqEEaF&Mi#S|mBaV(ZCgN1x_G=d?;zXI1vNnA5 zN{{a9^>(P<6ms(Th!dm`aZ<#O{r;i-{+a#$F*?=l_b<|G{QdrUy8l;8BF>FCFXHrw zGa}B8I49!FD1Djd8sE8{CFl5oS9qiE*{=3`jORyO5OHC|MVgBJ{!D)RxD_( zA$ynXQrU^PIpUUx%OkFcxHjUth$|zminu!Bnuy2x{qJ@?GblG+!=9K#Cv``FZcT& z>3-N>NqnPFCbJRuMLZ~j5kKkW0X;S&C>#jSt{o7h$o~R z6U00j@l?cT5uZmq9q~-W8xe0tJgXQL@lwRg4qVSiyb$rC(D8q8KHr4ptw4-V`CT-#Y`JBT}&L4#7qz~VN5lq7SoRD z#MEONG0m7(%q)(jvk!`&^Eys;V|pj+rJ-gWhKS{;H09>kf)z)5pvZGk459F*C-@6f#xsHjCIGN?#Qo?f8~Ou-Rkgh?z5Hu9z(c#jYI(#ie=Gk(h;I7LJ)eW`UUDF$>1* zIw(f%H7FJ>60>N`h?vD<_8Sz77LU`AvP6uciXxJ@P<-i_WnwOfxiDtgnB`)2j~N@Y ze9Q_l8^vrKv!XVaV%CmXCuU_iA!hZMHDXqc)3~%+oW>|w6BmlF8KW?@R-EpgN+K>4 z9~rZ5%=$4K#H<&iAT}ySVNJQ>Lh%jbG?a~wQ8bf8TqwRt%$S&MW44RgRQ{C5Vz!Fe zJVrrpix|Z{X^IQQw~kR5+$KhmP!e&W`1Ub7#OxfiOU#Zj3X(g;C{8L@TqwS4oW{o8 zViX=F5f_T@5woW%Qk!G;irG8n;Fv>V_KDdy=75+3K1_ZGE`D6h@iC{xoF4P2&VOT0 z(pYF96u4YUcuJhUqpxWtfRQAE#ko5^3dLh@v=xXv{%&XQEm%jKTF}l7y8uOkd;*yI$5vO;gPpNh}GfrQ6R8sg% zoE{K}KWhc?vXd{UB{3hze4?htysYL)Q^r+e%o{Op#=I8uk?#Mc<|5*t&_G!##G2dGAbK{pWU&*Xit~G^U$LSUD z8^u^l#AQMJyO{4~T(Lz9Ek+ka$;E}@zr_5in4{M_joV5X^Lxx6{r(?Xfc^eoF@HMw zyCl8^6-xgf>;G$fLoa_O={@9D+6YS0+sI-)NsO`^KYvLNU4ZRd$LbT}o3XOqDQo!ZZof zx=FJnOqVcylAcz~B#DlplXMBsn50u>xKDYO(vefb%x`C8--Pbbsea znA6qGm9U4an_Heqm^Wd*giVw5Txou7{;RHpC0)DvJ3L{*goP3oR;&8`5tc8KuxLVN z_A^f>Rkv8e;z_!5uG;aN)k`HTov>QM>URDz2`eY8lCW&Ta+WNwHYe$+iYi(mVZ|gp zd=J45)RkI_JQnuuH~pCeKtQX;rN836OKvJkf^fr>sslt)}ZKA_k@HK6Hf9>R&gn4 zbWTpvgYr`nPE9z?p83GzE*FWMnQ&IZlr5%eadyHv2|<&v$+`CP)D5O-q~m^G!uc9v zO{av55@xJ2Q#Eb;#R>N%+@ElX=jx?y_GJl|CtQ(mWx`DfHz!<`aCO3U3D+lFt3RWv%!sjh_g%gDofW`rpBUGMpSvE%A-{ltFm~NgQ|?HvP6|7Wwy%bDoa(8xI5jVfynlBn!j)&F~2b!3(GoV%_u zd%;OMqnupdxIuONd%_!4*|^HyRrXPrtBk3pSNUD7v#C5;Wt%FSIk~xU3*(l?t<>54 z{ZiTAw#p8cZ)cQb`|9|&j(41J!(>n6UdHT=rhU!#H|}Rt zEqdEZctDi{Em7puJ81`3Ii$+9Rj#XYXqCgNoLc3yDu-7&qRR2sJkoe@4$mHREf-FUb04&$93<-5%FDz)_QF&DYl&g`*l_jVG!+sd!uEBda}C<)tbwn?GIUnJUj#c`mo`VwLA}{z7go zd*k#K%ilG=TIDs9*Q>mh>%U?0W?o8de!I#$7H02NO7dQn_jCOZOf<3|SNWvMFIxES z{-+u&8FB7sRX)%4zp&*moy6SYB&`K`+DRr-ol zwbaRfIO}iYpT@t8nlQ@!$Nb+xl7dTBY7|YRQ!**n{_l$b&5fu=Tx0SYQ#d!N(X7#` zQLRz4q+T2UwrwM~lhxREa-tfY8r>SbJa+< zIcaTtSeVSo%>I-$W~?z&jj3ws^PntD?c8aM)7F^IWO}1=XQ+*T>v&j=nQJVffLvpi z8nf0|z&f+ln7zhaHRg75j=a)2|Fhr^cIK%uZ;kmZ)Ce~82|z7TVpwSxW?&{*I1#(9yRu?v0{ytYHU?w zYwNFEW6c_CnXgh~Rg=|>>ig;@YveszyT&>-HmI>-jgh&|x+Z$}bv=_&#`W`Db!~Jl zeKOjl#+Vu#S-$b0T-CCvlM1Keo7LFd$t{dq8nalmjrsO9cBrwfx%9Ww3~{X3vBpj{ zcFW~E*T%ooyGt(F)g*KE?&f22$zC<~Hb1$>J~j5OadeGiYV22I{~8B5>j0x_%vRrl zPU?y zFSalXR+rYe%*o4*R~WN?U1cu)t4*#kURz5q(DLmKHEyhNca3|rxN6*7<4!BwQbS)H z+?tnF7{AT@cH}}+`%vG1(BEGlAeNH}@kLLYOK44TE^uD+7AtxWM@rcQzd9K3X z6E&W!@llPBYdlrs=^7t8_n8{c)_9}Fn>C)R@qCR}Eq}rIlJP~O>}NiCxyCEGM3!GO ze?6B-=dBuVJNcebqxnvacNMQZv1KRwxZr)~exOj0FMNFy@kxzOYkX7V+Zvx);d5g) zUB9UDrAEpU+4(vjeN`$)eV5CBHu>K8gYie>Pm041LBBZpUypvTF|^J^b^fUFr?dVt zMs@zK@lTC^YxHYW>I8N4C))~jO7+y?`V~#aSYLNRfpJ2kbkwAY>r7JT-a7ZynY7Mib#|{aw$9{r zrl_+-oh9o`S!b#`^VXTK&eV0LsWU^J8S6}2XSzDmyLswP)@I#=WcMvI)frY#FC}x< znb|tC8CB^lCbPn!Nx0>TW3wnC0r|4SUZ=jQy(8=*UKfNC zV9vFo4>mut&QWy^F+a4djI>wmAgk#N*Gag@0LwzvEp;=!QBsT5?k^*O=Z?=hiy6<&wMV z+-`n{@lIo^rZ3LS?=faRzhC{T^J$&WEPSxeb9J7t^H80K>pWuNV|5;{^Jrd55%>x7 zr*g@YCfVwH+WeV1&zfkLSQWis{zjcQ>%3U!B`04tzGBqp5>k8B{59k2_3?j2LGrgO z`Jm3*b>1<5*OOc>gD*8{o%KtmQ0E7e zZ;am>W#>DS?~U1G%a7(i8Gklvx&2z_H?>(|Us1h5p^^6JPem0g{AHBn?|S+jqKJO~ z*6CZGt)`-jNM31B%6YjlJ}znENiAv+H<+lw#0`=L)dsy>vu4sV){Tt@%{*75*3NmS zK{w~wm1Us8kOmVp(p&clot54G4Q-4M+G^D#4W@L~q{hjNlQ$TuhY|Dt`ZZN!{Aa?` zHkhu#(G8AiFnuFEp;)ECstsmnFk^$68VqYNSA)45%-mp>2D3HNcXhPKIBO&Q4oDXu zac#!V-e8Ufb2iXtBifuF=3QJhNxAbhSisw`;`26`PqoOb_q4b6M)&Xr3%crsH0b_o zCkr>yo&QA|EZRu--$pc8x{;n|EoNNYxP);@<5EWLaY;wNWt?2L!Ez?c8&@zYcSVzx zj4LrSU=|* zG}tibqfItyuJuBB-{67!pe zH#nognGMcraCSDJ{v)dwcr;taa~qte)_OBsz0>K2axZLfNrOvm^P&b9+vjS(=9^Bt zF0=fK2A4O|!!LbeBfQeXA)TulT;1RrJ4a_6*P6&ta=yaa^$l)laHE!h{`i|)erJQ5 z8{Fc#eQP5IDs*!9K!fiZeBapaxp z;RcVWZ4JJ0b&oZ8yuoW~K!Yb5JlWv+1}`*t%I$on!LxF5-e%o|>yL{rQb-?BpKGM3 zTJ(Fd!OIO^Y4DOY6>TKUO1)}{{2<924c=_4SsL%ha==q_W3UjeztLqzT(oa4SrJu)6qjAJ=BwhKO6kjNblTe^0&gcOZDY^ zom3Y2SF_6>oyj?Bxx!tcNwJx(sZx`2lS(t4`C6XBF`ff&=t#Or+~m3@*EdO;X@smb zsW;O-^J+7FB|}5mXr{|;@+MO>X__n9YSK3E7`wT=*JQwaNG_ScWWpvxO(x3a6PrxZ zWKxsKjE_3TPT5R1i}ahN$y80IZZeH?r*ATY8#!&0>D(P{(aWndHkql(Fqcvw(r~Dc zx_pe(hX5`pomrdA)@1f3bI2!677*$?mnL)D;9Sl0FMq0Ea_>CN^s7nnd0lqCCOi4B zfeml6V3R|d9NJ`|CJQ%Nqsf|07HP6*lckz0-DE_Q#hNV9WXb0Ezbm-7D^gur=3Dx> zO}wB_W11}6WaTESG&#=Kk>#2!Z{-!5tf=1Q9aLWw4OHq@9sV}c56bjg-MOndsVuEx zsfn!BWP>IfHd(vLI<}ToI*ksQp`!~}MjrX!}Z=>w&;hDUTjqKZGKNG!!q2dQL(>EMs^S~wt{Z!+bo)YI;uC|@k@3LB50AdR&S3eS3eCw)FN(?w5YbIx!|P6 zx^bcwjTX%otrqPTLt0GGqSK<=qSs=e#rOVPbc8=Ly~ghb-|uG3957*vp{?}BSRq1J zF|~Xt?E&xWytZc5bmti$zvu^AEo)*`)aHAF*F z;ImttGpG&cTK~KZ-7wv~WG%d~#YHVHZgEMAk6L`(;!;ii7EiT!y2a%!u5hWlTU^=V zsunl3xVgpE7G7^utFAG*w#9Y1MDEh>1}ATHlN6Svd5hLyu5)XP+stpzCE2FOoh|ON zBwGddw7A#F`-~5_xZmUf}n7`WMH4~ZA%6g;4n=RgI@wSEUwRp$mU1K(vq^Z$= zKQHxx$%n?Qv!As1vc*>|KDF>O4U$^+C#cwTsZ}Dx5@2v2%;-txs#vhD2 zeNe%l%tem&dG0SQe$6Fn*dHzaY|*zQ>)>DJe;fbFHUBly&W!#$OQD^bEw(9}h?m;` zH*YI#f;M6M|Mp$gyQEFE&3kR$Z&PbiZ?jvQ-P<(UG}|oIX6ZJqHtjYuw3)F@r%kub z)VAMiGhi}Vn;|9>w3#rkacG-~+DzPL5|!2e0?^T#9k$V}$*w3)Zfur@QdnZ=UX+RSb;t5FV|!$hU#Hks2nS36yp z`ehMpzBcn)zF3&J{CJPx=WD%1^jU$ZGQ3n@qvxJjNw#UcbY^E*KX4y9D zx7nc0a#CnB(rPOhS2fDQifvXhUpbeo(oT2P)-1D{C9Aht!(`1iYv(#^wf}Foa~%sa zSFhV+S+87T)s`4 zZQE?;Q%4{@l^#PV>9k+}-9LbB+7GZSHIHpp*YuyWhzNj9G|# z$oygBBkgpbP}BIaHjlS?!oug@EYxA)4s*EdTpi{%nbVksoq0OU@8rBjS)Q*me(s4c z&|!Fo1)cS~J*oLG`63-g9N)^gj;slDlfaWiNG)*~uL`?AT%d z4hMADsl(0|?ql4g!)_gR@35UQt z!!aEW$~DJzIJm=wz;RMT%H)bOuoy)(x+NkIJd(&o%90)#V9Fg*YP|#&HRE67k1Kr z%5ae$e)Z<3`l9!LG(Y{3#ib?+TzZbaqQjLPuI+GLhpReVZQ~<#+i#*!sk-!-FC3F? z{&&)+Z`r&-BdGnK4mWkUxx+1;bne|MQ~s1jt-7s~eyt{qg$!;r21u4v%)yFFPLVq&wTHNWIo^ z#^W8H=+rrL9X{;vv-LkRe&68-HCUH`4xd``Rc`IG z4xih|7e-n8($+-2_Mm@b&2Nq08I`4d57n-xk{>(#)Jb;~mCW`Pf5|QXYVuo$-%b87 z{%QQns67^y`nN;h$#uKwe`G9lS)|LNU5Z^wT^8)7mdjl#U8e6cLzkdS*rn5@+a+>t zP5BvexK{ws@ znb0`YxUu(&C+RY&O--3 z4Y!4?JqwvHY}B`V(i~yFwo%E&x-8yh2`88AvZB_G{!nU{rMoO+;qu01jmsIe>8*k* zphW)r{KEmi`*%YZ})w%FmLo(`96L{7Hn8*)&_P%P8wevcAa% z-SIO}{?v)jMqM_Rq{|r1D82vRO~b{eUAF6{dyfhQn|0Z|%NE`Alw`|p8lAL+x9X-J z8ExH7AK|xARu@@Qe>KTP6nwVVe*x>VqmAsO8K^z~E<1b3G>c?JhjCizyLH*U%h)b^ zbh)+5ZC&}TBHcz{tIyj>pxn~&=vq5OGh zm&3YT)aBwXhj%%m%Q;=n?Q&$7qq>~g<*Y78yNJqa`~8?M$96f+l9P~}f8%Z1jtpqqYCrAep>sUR%N>WK8E zc}bURw79xl>b_iN?EZhA$yr^~$>XS+OS^1M;?N?E@byS$WZ zzU(IHOW0RUUdvnide&6qn_b>Ac{|U2M~%<zKXm!A%bS+`)aB(R-1x0g;=DG%h5A-QB|kBNFr zY5Bx??qnvD7$?m&ReW+wrf^*{I8~3SEt$qRU5{x^q?uJWeO^{eNk2JxrXIuGyP1u; zO77q(I%|*FERoLaJ?1c<(>RxLZsR=0d5!ZK=QpZ46&!9ZvY^RA#)W$v@4rka`J$GL zFfL|X+_*%KB~7HWRFD1g|E#x6k7aZDawf;?Kj`&XsmBgIcC=*W9_yK`l54KoV>R>D zd#ur8P4jh(YxUA=?%L-6)iTn_b@O^h$!R?{uyAvuTD76c=pGyO*w}oN9-HR5V@xuG zoAt>4GvF3^?v_2a>ale%{p+3E^w`ewZHOvgfbl@1+I(=2LwcO(~?zkLsm=7FBBc9b@6KJ&rRu-gtuj{GW$Uvhd^{r0!uD5YCtdQak2R&x#Ute;IbZrTq&zrwse9`!l@nz#H z##fE68P%iLd%R(utzt>u>hX4-`;N)G#`lcx3r#*Weq>ask9&M#{;BaZjMJe{cMu$B!mI^%xjPXWGwB{$l)9mw+C>n}^Q*!~9R$yhcjt6~xiq_aZF$jR84YUcG^(ios=-ZHk0ojkWYK+in% z9fiye8DIiSvameVd?Mq-#z_X4)MT;&<}gvI$p@Gs=TiC?0>2DpEKidNoo zfR#)}8dZE{lT`*-HJ7Y5!0P5}7}qqemFKQ)vW_tuf^`R2&&g4_&iW=B46vceXyZo4 zjg6{z6O%D&xycQ>{~uuUJa>zM^pC+xO~0)M*m{6%oVBfSH{*5#Y@h4zFu;yE-)VrI z&37>>hVPn_-A%?C_b|%-o&)S2BU+#+xJ z5d&Og$&p6Yb<_Yy4{*!?$L5lgO^*A2biE1qP1PSgyv$Q(-#ec>pF65F7)pZ@p;03m z6pflFDwR}(MpGz-%tNM#C@D%5Q4x~qXRIhg8dP}KS=;Xa{Xg&fKF@j9v-W4+`|Pvt zx#ygFu5gfWuyBZQsE}*^FcC%=E;2&+y6}w>j4Z*MC3wr)j1w7Eg3%&lgl`MS3K@rE zQd^HRO|X)QB9lrmS!7BHrj}ru_|ZtAkVgvcS|rwd~ONeD>?Z| zI!}^bc5QjT1Pe;AP<#1<5-gJTLmPpGeI&kE24*rWDZx?+uk+#45`0Epf*q196K*ZR z=OW8Xu%ZNCi2oq`vIHwdR+V6r$XCME!Zkwnu zysUP*`EcJ{f-P1~$u`Tkmw1n?@IkwsCD>JhIzH6(VRs4kl%Sjs<$c)8ku1UC68t8Y zpGxp^3HFJX)bb8?K9IS;1i$e7zXS(Lz?pWCN0}bpV_05-I3#19n(}k`NC|!~0emRq z!yhI1v&4ILh>nc&R|$@m;BRqC{wcw~CEk~^V$GcgVhJ6qp}Q++tghqHY+&4<(F-arNO zg>t4BXZUa?mtsA+^q9KP(1%7oH1Xja*|W=yeJ5W)N0)PbXzKF@pWF-u3G2DQhYNkU zTrSOgxX6bVKD6XG^Zh?QG?$!L^|{gh5})_Felud1`q0XU);_SCtg4LAL6+T?aGNiiN=apn87^AgSa8t~+KCl-YhwFW~LGl}YxXFi`eQ2jT?n74}y4eCA){g7z!yCL1B%AI&^zh+PpZA6?uR;YG1U&9TPamG} z;YlB!_Mx{APx;VG?i@_In~oEo@!?q?p7WuP51Xa>R`0lDzxdeLbYAb}!~Z_?^P#^F zllUMd*LfcX`0#=cFREJZg@*8oX8|w!@QM$w`Y_Pv{htDZP+r38>LPK8#fGaX!4s{piDJAI2ynN1OGJ^5G7}e4A6$2X>jWnlV`eYv!1f zb1zTS$Sf01QkKa+Oz~l=T;}*N*N176zoYS-E}Ws%GqpEoiO=@oT@iMl;{)FO^?~!} zeI;e0dD=(w&7SgMf#eH?9|&2`ha!uFANjD@%0CwQM7YFAHMZrqqJ*%SSRwG4;)^O8F@uRFC<@_k`$Cd03Py79-=tq4&PW7XbB(;Q8RTilt ztm;QKD?de~y0C^HHAVjWB(1Gx9bsKR>iJRPhtChcBso6FV!yZEHurmTlG`PI zv=DD;C71fq%JSBJw6Xj$KQ0%)!l2x*QrN47%-B}s8sW9V>x9<}ZxG(-M>~=BLVCq` z>CBH?{J1TL+jF?pkB)xq3Sf5txA}3q9|Hpz6!0cYCqMf7@w^|M{kTK!cM6~I<1UfA zZOnT_?)9UKmE7mY{gyxA$AjVz3Aw302(RzG>Bn2* z<^mVdoV~p5$5=n+)3FT3`7z#)N!E9QAN>CXrl93Sr8`X-C;KtQ+DxU5_&ZiIU1WwI zGyRw)KHHBuR{O39!_F0X&yRV2aC*GX-^?#CZ~{OiXt8UN|WQ9u6n z<1fE=i;anRV~92Ly?p=BzO46zJcZ`2@o~AZ$*W9d0w^0m^?-K@S}uU{0aOj3S^yOS zs2K3>u(!}p5i12yIe;nw@8_#@z-(}XlWJ#eyy zGpyvyz{#uG4JBzL9HEKSSiFhQ%&4XToEN}llJLxd=gjA`Bm8k<02c<(O!7+u-U%dg zT@=8@k~9}ma*0R_VM`%D^jihcTAXK|Z7iWNo0qG3MF3ZdP<;d_OK$f=)p9-LpNaq0V z5VE~jUJxIsGtZY~N#mCTc*XKp*%zHLGUMO?rUo!AfFS`4 z4dAr^h6V6;0Am9fuGF-7Gk_5RydJjFS=9GZ90=M_$odBjw_^oh8086aR%m8MI&$g0x1DGQ|SNNWl z&l8z1d_RB%R=zNR55zwdE)srZwTlDz*z!*T-bV?$vs98#t^Bh9mWh8ZTyEtn_$eU% zrIoA{Sta~RxH^C}R{OQcH$tv*Yem*s?RNpJw|s-hM&b9uO~M}n*et>#w}@;NZWC@N zitG^X6w;DQ&7J`EavXyAFo+)m_=%G|h=+psSvE(k<-P#+i~nLJzXotX{GjlVl^@mw z`%O*G`QHQhBY;1xwp9>+1#nc&zqzgk5eniTtNk~CW8%k!CjvkaWrE(wR~MEIdWS%{ zAj${f)9)55NK#QqRiz**i&wFdszFo}KgCMuSVO#~V%8GY7S<8g71k3nbqRBc`>iAp zgt_cSZCJv_K}3RZf`|qY3*xjOP7fk(?YU1A;>jRVLGRe7V_Fi|+GK*risw{Y-d0-> zDF#trjYRl`u}Ki;1aYpFUo6s8c%Jb5 zAT9{vLh)unTqMFSGl+>#(p=3;ge`(-DRSxmZPPl4HbGn##O16xh^vEW8^o2eVT7xK zC)bU(S|Y9q;@Ti?2;#;dt_ylA8|7R*u4izqRJ^&F_^B}0RFO?;S@3=d+2IM1W#!tD(;M+Whx$XnKOR1l-Z#|YmRji7fJF}5UYdu$Z8jhd>q6lB1^1%X%L@^e`Y1ig81C>1{6vE3Pd>6#}Ai9UpBZLh>Yz(472xo-w zeGr?1s24&>2tNd|nJa1#M}ycB#MU5w3F6lvwkgqeq6kk^*xwyo;e+@oh@BGd3SxH< zd&H^T8$5a5NN((ZmTF%q`F_g}1aVN>--0+KVq6Z3^Y~&AZb#JoJ%~R<{jm1r2=ZZHiB{6d5I$y#IgcpX;OoZ}_Lb$k;eTxuUhH!ld zH-vDha1>z^g-OE0u8}UaRJHHqMP9vq+ChL2%$SroGT*?-99| ziOi>fmESMIfqKYF9uA?acsDCC!}y4rO!uhBV<9{q@-C|ImLlW#3}Jw^eP~=&1 zoGEU0=z7y5WbMjm%>#VsFgOiGK5$+hqZDBkc#&coZ9!94y z9uDJ?Fgk~EM;H$%!kuBRIUT!; zKM}^0Vf0YUM}?1t@wiA&b!V)Gg~<3%$>r%VdWkTFk@r^f8Qc9nVf2+`U>MJb(Jzb_ z)il-8tH0t82;&9G8HB2rEPq+#72&HwY6pp!P7Mv?wJ<&kV{sV6!WbULJ7G)@V?-FQ zhcUrgzQHWwtb8PQmiSv?j8gW|VT=jmZ98L4WP`LHC*$$bGW*0ZCWSFs!l@EYQIP-a zr>RNH8DY!}V}Z>(OXR&UW?RX-B6Eau?TF2@+W8{ymkPcxj1O$^4`shd1+d7E!}uhO z4Pk5yV@ViG!}uzU)nR-Z#%E!CQ7XtXh5cN(+~!(gvoq9}VXUsKuyV{*ULk&2w%tS3%`k_dd3Qyz>U6u}-z!VyFw=oP`! z5jc|E5W$TRL?ehr5RV`c!37aq7(p_ER0L;4aApK)Sr#LxAAuV|CW5SLV6K8xIbmLC z4g}(se+EMwXIRLM9{*@TUvSR2--w&y_H`U!8PKS3$KXaN|CD~ zxH^Ki;w+$aFRqo4@vr-TY1>6`TLia9&|azz!kdIQ3+Z)>$gL4{6!|Z5rwHzk-~kCc z3-5^F&Is;`;O+?SiQqnU;ob2p)@|r}&M!+VHrIz#0C8_?ZgAm`|z6M7>4&M=(I-8R4@LJQqP9@xH=-5j?Ll zOohCt#UR{Xh~TvdhRNo|2wsZdW${-y*>qQzHm^o7P{KhG3>M)9H{O6462VY4`PdT8 zhKo;$U}^*-B6wZRH#p(TV2t=k;hVy@grkI`m5aAy-d2;L#zrvC^6?@QgcBo}Br;iO z?x{_S;GGD*kYsuUGeka#V5Z3XLdKjWGF$kraE@?p1n-H^W?lsI#m!ym1y;UL@F zHUAMFiFgkOvX8$<@J9rHMm(Fpr21R@XvCXuoVx$r`{N8e9>IwSsye9V0FHODw}OL; z4$3$v>v+bzgj>!*dB>aTwCBZJF7lNeRF}JlgL)219QdTV!GYgF!0~dma1eA5a&V@DvmAsSL>v?y)OWxe zYL0`n16MriAm$*h2nh!%nS*+N?G$N#SDp6cLq z8|O3;_N9S?GsMlsd0x0aTg~$wT;QOgcq5LagC-8nanRJkdF-ji){K%##1SyJ;S65r zpt*c0Z|2}42N&D%;RsX6?GoqYlO8P{Tq@&M!YhQW9kg+9nfiM<$5Rgyk5$L7ba0hy zu6A&ZNL!(?xz@pTjyHKYued9(SE+2?=%Ag0_6|BY80z3P2RAvmS&okgZ*g$DgHGbN z3OfpKQw>br*})wSx=MJbgS#Abad4jl8r<#R9tZczlEcFB{}1nX@PLB{IRXB^w8pZV zVm_==jikGS9u6LL@R);s4*ENI+(AzVy&XK`;0aDt2fa9e4xXYH{{=?KQLV`jf>M%a z9X#ituY>2UCC8+X7<1h!q9n5kt+rbEhVr}Cbyzbx)2P1hfI(S?1w;YUeFxtVG|Nm%XWohD%cQ8TC zi4LYZnC4)TgURxpVv$|rFuvnpx`P=GW?DHT{AXkMyHb733FBangSiggb1=`r2M#`T zFrQin3mh!`|Bt|aEpo6}CEdwe0NiDIkd<=sB@UK4ST60ST7s5|f5zjKMFu_O5%IZJ z9@^7ug@Z2~eCc@aG3K5!_?3gz4t6-$DVsG8Hi&%f;2Q_uiqn@*m=M=GSSQJM!u3M) zL9o$UelN1g!4D2Li*IqTT?fuq2iw$NhB9M5mIthr>~gSM_GO}8u00O+t1skx9sFqH z|K#9j$?3aKgrUfPaqz2^9}qd{;E>2+2fsNuVztK{{O;fnHUD&Q)WP54f2k6N;`Wau z|7u{_G%1ctctS`aq9@N$%SKTyitL17g&c@&=# zMfE6J$I&K^8d21Y;<^~FkD*o+wWIhXiX~ChiK1>4w?uJk6!jFmVHAy`D2c)sgMG=l75``lPh4Cn&;xQr5xF}4Bdwt=ZUu&6-!ZkKR#;2BB zPEEQLq9{gDU(GXwrwUIKo-S-4Ox!LIZ-qhIX8-?QJg26 zX2SD@7YHvDng|z(Uo15Jx+IDgQM8n#mGDxbv2QKjMtGUY2|4B#H%+ zFA^>kejxl%XySY%zF7FN(8O69#ivnJjiFi$pGC1Oimg#>i{f*||JL?;c@!(6_#%og z<-1zAQn*U^mC)o`BmTAU8==X?(OVnEx+uPjV!h;>gd2n#h2IN}{SV@sgy+RZ7XYpT!`-J<2zX(nI1L6mThlIxWh(_at zj_co}_#=uxrTs_vm++|YZ=s3yulOi%fx=V#MVsK-~#88tT0Ws8$p-v3p7$Py$m6u;wPgo-K2~D(scu*J;n(U5v zLKro2Vcc-_C@G#2riCVEmi3%CaYhVh#*m94A45UfQ-wugeWA&9n)vC$20|0(tQgLY z;rtjbh@qk6=Lj1K8w;BVjs3aeO@-$PP5cYRn+ux>FA`oXG&Yxrw-B}znwYIL$Q){vKTIx_G;l3!YhSW2~D)N;@1eT6`E)_#BgH_^J92FhITQuk6~mCZ^qCehMSb= zS>eqw+!MpSG2Ei&tub_r;Wov&LwLKeld!YU#J^MgF5%rmQ%@J$i$`O)FNXVLctF~2 z!Uu&93A+kSw1>qX5q1~$5b`(0oV}05@OTV8CFv!6LinWcDWQq;w0LjfGeT3L}+}CfZn5n{1!qG8|iQ(-S#>#S{aGY?waDvc8m?S<~I7MhOGV(Mj# ze8<9K*b&3}7&gSPQQFPI?}eL$KL|~oWD^qlgnnT_7!;bwVeyF25k`e3enK%%kE1~x$v9GRq@^tgU1KTC z3Uk7|u&4G~QM|tJRN-kt6aS1j&Wz*yI4+3eEXkV)&lWZmHWD@#ntgGO__@NS!t;ct zM;D4;B5WqSNO-ZZxzJ>9A>LAWsj!vM#JMbv%j0-0fnf<;5yzEr?2cnk99PA0bsR6p z@k$(Rx~_^-vt$)pFE@4k0ZJrY87f1g%dd2Z{9K9uBs6KH#qnPx1 zHjd{cH}&)tf4-E2HUrdrDUKIJD0$Hun6AAV$G|ui#IZ1rL2(R@W3mi}#4$9Ex8fM3 z=4)}h9>*JT46|hq=TTM_BY3#!5vGxnn@ZkPg(f~Tj*eq|91|30OdM~EP(C(}aW)!_ zC(4Tv#_D_DB$=@}C61|aOpD_k8PAn`x^Q+JGi-E01{~(SJ3rk$I>`HjpHLV7YjeOUZ2FVM4Y9XZhjWW7jb;4Xv?JfT(~@r z71qmGu8d=~YFH&?RbPo1?HU<>Eo9%<#<5O(YaHLjv0nU#I5wzLblDWgM!B<+?`==X z&5qa{#}*rkiMGYDUCsZgPTK6SHSCOIS1HTAar_uZ>jc^)@KYQ=b0timZo*p(_r-A} zj^E?hZ$k0#d@Fn0+Af14lKp=sj%n}KNL|9ccfv|W)=m=RM z}d&{p1?T?oSX1wegk#k>;%pbIaA2U zXW1?{ly4)+8%s!S6E*4H)JDD}f%6hLKYA@;`*P!l?mLFz`Y4vmB7^rT%W)V){-OHHi2u@scUVV>(peyHzv?7 zflg|+PoRSgZcX4OYk9L&tmhUHMq~Dl(%vS??cxkYdFKS~NZ?NEdv^kNiBrXmzNU9w zBzz=+`x3Z6fd|xaYP(AQU;+=>VWC$y38{V97SLUi9>PZxcr1a(6X>ZX<3C{ueOZ;s z*eiiP3G|ifX~pTCz%wGxO8A_(v41{+ehCarU{C`66Br@t3EY;#?I~}RMkcV-L`&eU1V$w= zI)Uj4%t&C2xUa8 zGZUC4)$D}#Qw~brO<+y}a}#(kfe)pcCwxDF1tRm=5j|LL-g3E6LOOn6<%=ZwNVwQ) zKThBi%aC-Ha^D-&3iKrxB>Nqm*S z>ID8s;LilsB=B_tKXS26;G2Z^-G5ucdt2{^+nZPEg)+ewbfsNwqER8uJ zL~@cJ64)XYC7ZcM>9Q*MRvvNU+gWD32itC|O`C5;a#tO<1}fy1^E)^;R;-=#G%iGL+2-}6DuwBynL9&62n% ziIz!Rn#9F2yF}PrjvPQ56I-Zel2%EyPNGc`m)VRoVA%hV1zefLRY}~L#9az?brS88 zXrDyeB(6!~+9a+^;s(1@uD7+BL^mp|=|zVmZc5_zBswK=a}u{Cahr^9O`@Z9rzIV^ zkr>|D7IufV`Oo0)B<@S%ei_`OQ1@!bbrEMT9!TQBBpy!Ukt80Hs+&|@h3r0UxRG>M z5JrAfq=#*q%6lg9L=xkZn2^MiNj#OrOG&(}fW4CFr^232qPNI1N%R$YHi_qw=u@g} z6OHMfR{>1dUqL7zki-kNsu$%#vsaRMHHkNp7@5RCSyDJOi9xa)Y$Zdi{cA}KOJca> zBh&@jo56ftO?H;K-b`Y&E#R#rMp<`Sj!EKesm3NTPI5j=V-_X)PE2A_5}zfpOg58~ zn3u%-B&H-WHHm3TF(ZkYBJU(IU4$7Kd6xJb;p`;dwH-HOGB=6$q@pD^vs2zzmXDHH zki^0yK9IqONi4FKraPvOi+KPh@ktU(lK51PjJ(uZnk>fh^CXrl`}QPOaPd##+a%T| z@uj@JN@6uX1(H~$?$gouu2HCOc<}P&Z{jAqDRo^E-zBjri64?!FYSgTHrfa#FY$Y& zFpitWwwG=Eo#{N@7nEdu{yx#=#WxvyJeJ z>^Ytc`>VLIJe0&?E=oEj_$`SeT;5Y~QusZIKa!}DLe&)hR8{3tD4)V#NgP%4?<9_K z!B65JJNN#zxlYKSOzPypi@~l~=T+Qpz){EM%$GQaB|ApR_EydJ45u zsFOmC6lzLnx>HNVGi+V!$RPD3ERn=y^os|C!4yI^DT9P9kERey;k*>iPa!VLd2rQ;a3iVSsHHFhsI6Z|kQ#ebi2EsFhrby!1 zDKwO%k&w|C!Dt(&yyr&PK?)a2POoNCwNj9aQn)yU=He|1%DO_)P zLwGJXsLA7{os}EOv5L4Ug_~2jg~Ot=#EvQNp|4woe8!Rw1JJ!w3Y}9}pTdR|?odes zQg}h3?o8pX6z)#po)qp)p?eBFQs|PxeJOO4!Tl*bAktO%Uy%HNILe>>rto|U{Zi}! zEi%T+-xe9m5!Nr?C#X3sg?CbzXl*8mOcqWNP8BlUbdh(3%rZk{rf`;UwvhXJj>uf$ zd%}4_dNK6^@lS;dQ}}?RC%)L)EE4%h$h;q0`6nVvQdnwL4ER|J%ToB<+N?}rx#cTT z_(J?kD`9P`#J>`nAMCG5;cGR&u}8r(hGS`%?HNg-M!hsj zWJxnR`qJ>LNghzZVEW{Fg$Wy>P;y5YO(P}}Pa~N|DvgAiG-klGeBDwKBhN~bOCv8* zNTa@z7Hw+wi`}I0>1i}bqjef>(l{fHGt;;zjf>@VRvJyxI7j?!VMAdfVPmCc4cyLE z*z?k8DitLRetsGksCi);&17H()}$sjPkY}@Ou?5ZT8lJVrg3R0<5qTXE=%Kb4e|{_ zrno}EuM}RD#?@)GP2-w0u9t*iuTA4R%S}lXnsf%+r_mve7nJU%G;U6#a~gNZ<(4#V zO`~He_uItT1%|pkjZSKk^E2hnH11NfXBu~>agX>TY1}Jvzp#t&K6S?gc_57k(|9QD zy;rkq8r|%8a%3L1BVb0XyL@}3@u=jF$?|cb=?Kl9NaIPFJtgduMlTwq(ObjyY#Ps{ z@r>NfQ2e(S=-W4q=hNtyMt>WV+5xr(WBFnlFQxHv8n2`=H;wmX`Dz-&(ipCc1Jf9k z#^5xDDC5vHUX$E(;XfQfZ5k8On3%>JX^c!`Od4;e@us}kozcqsRvM#hwdO4ij4;-g zG(L@S;-)qed{P>d)0ipwlr*NM@lG1kRVU53O;bHgK|aHVGQP9Yn4QMEGM*zdj*_vY z!92++`7Dk3X}q7tf;1MUv6vG$jStfJFpWiNd}RA;Vj5%+6X%mOmZY)N<~4hP_^CQh zvMi0y(^#IyiZs4VW2NL@l&YC=R!PXnv^RZUt$=IN_*&$fG}fi@T^ir2Nt?AIgY}BM z^=WLh@(m&k^}QuD{z2Rn%;wfK0xp8CH)7kQ+AjQG8avY1nZ~X(cBk({beDYs}pQOC<##5cY)I7??U&IVG;~R1;jpJ!lby3a5i8SD%f{ThS%D5=&qMVEJ z>QO+Ck@H;ZKX-Psl8eeNs>r~|DP&|bCa1Wl?xK#1x-M$CsOh4Xi`wqVvoB-M7ktr$ z8~+BVo{JKN^3#%U{&!EtA?JHw%sE@gMcBom3=U@yapAaV<)XFg?c%75(_EbHBBmge z#9bs@BweIjq+R4)6kND8cD*;{=G>ESo5{+azcPsF5mu^-F6z5D)%D(l!_V1vnhz_> zVs(|1cP<*ZID_tTWM_GA_beAJ)I3|r9yJtcBy22f;^G_^=ZZHKHgj>F$oawxg!H{o z#0=3z;upJUE^>*rp_YAY>Eco=;T~@zzCDBgWpJ5`%UxXI;!2K82B&9mm5ZxgY;dvB zMOzowxESYRyo+mHT<79R7f-pk-o*_r9@UWE=%SsA`&``bqP>d_E^c?xNvfM%+~VR^ z7dNZfxYW0jjxKJ~zGHc&3!OROF79!0uZuff+~wkKd2#4y!;M!>O?M1-k(P2AJmBI% z7u{Su?BXHUGwUiXN67@I4GHlP7v0r;Bkv(&nms1_$EE72!k#E)){AB?Mp@(DE(W-G z!NoH!o|WTsF8aE7-bJ5MRk5~y3f15B&U}KkypAyMi!NSr@tTWaE?#!=ii?3R2Fa1y zS4B*(2fG-e=1`?J?xxE`Zo?Vh#Tzb0l=2$s;!PKCSr>*f(G1dSw2Lt+>}?_CW3BN7 z7ZY84;$n%5Ns2kc#Y`8IT}*K?Rb%pwaGD(-);wL7j7(0Peb5nv76*0}gu_TMO!5q`@#pyiQX>s)*%gY^n! zX4>~IHgRptpkl@whaX%VaB*P;bNzYU8;eh=xZ{P z?{)E`i=SNlTq+TJu}=|Jrw_&@m}f*Uq3$2EhzMQq|4CCsHqi5}TL4wDe0JkZ(w{ zixI+V#`r0afs;X0O_pR_h_s2zF(G7}v}|%2ar!b;QM|tJRN0%# z8)R@s2KQueZw6;(a8?GFWY9teXJ>Fu2Is2p4KrwDy&5Y>6CopWV<>J-GdM4U^E0?W zs*5tXID-r2)y(>`^5){KkdAE9v1JCAW^i)`w@B40gUd6xB7@e7L(4XjUnZo>m0bKY zXs0IKug>5`@wORUlfkv(*9)%`nk=-uK~3g0+1o3A2MKQ~WqGUJWt}DLn89rs+-`k4 zX+X>f-yz|higTCv-9nSGO9uC4Fd>798Qh=20~tJ?K~DvLP(dD+@k1GO6=7lBZ16`E zvwH?TGI&&4*8iBDx8zLmL2Hpn*Kg3GgEmV z$xWU8GU%VdOBuW@;eZTYlqIvgV26U7<(Z)~d|(EHSZxMx$ZK#0uVpYSgCVvHLlwk$ z(Pg;IMo4J#j?CcA3`S=#CWE(>$iyF2%I0l(vF33ZjFpY?rR8{QHYtP28GM?-XBkY% zU}^@lGk90pX>y+>d?$nHwmUO2m?@~zf)n~1U8AuV0F?aW|T2D_DdPX<3_@U!?{;g1>bx2`<@+^6RL41VD;UekMB z9)IulYX%20ILOJPQ2ebNjTw{nzsbH*7L~I&BK~^@e~7RPe~SDiJetAZ8T^yMzx*J} zdL7|r{(|$E42}y=2qA+q!m`40!t%ljLf$<$?p4(MU05}XYFV6;MfEJ+&0y1p_JvR z5}qccFSVyqI(uS6!}rR?-+;Iiyl++aUoNfaeFe0m$G;{i>I>aMXxM+EAm&JIgD4!r934=_^ zVsaK!6o=_%WHD9RX<59J#dNv+SBdG`%q(Wfezxr+4d!O?UKabZ*q_C`EaqqNt$g3l zVnG(GvsjbG!Yn?>;!F8{n8l(jmSyp|%s$HElPs2qFP6c_DuX30mGCp=`cx`YIg@f* zE;%LSEN?{?U&w}z{8F}3zN;kpiVKUz)3|?a2jLspmP^64yzXjvN$O1A=$In#)e)UE8;gU{x*&okUz5cGmF2nIGV-jIW)-O?=1ew zB9=ou=LP>ai*h-X7eA&-jtfr+kwY1&XjxW-_fyC#!#o zZjt0xVMnXwkao(UvzqT0a7PYzieH<@T{+y%Ugy2%Qtrv&-W)#3VTrU|au|`r>p9$) z!~Hotki&yHJdwkb(ms?!cM;C{t~qoQX8{lA@Q65PKASyqcvQ{Da_A}Yc<$t1Owz!- z4)m!UdgU-&+NX2qox@8xyqv=`IXs)g^Evd(d8^8EGU%H_pHdN+f^quiFd&B)a(Iyi z+tUyJ=!{1tZw(upS8{kYhaou(RUDcP%wdos50->~KWBVj%Xxp%$ZeRk3_{KVsAZ@( zau}Jz%p7J(`=)Rr$6sVr4x@7zqkuFXC*j*UjFrT!5|oe6VS=?`*hx7|&S8oq)2w`| z`a(s9CBEc!$%U%$>IH+w-C+E;k_K@NjTs7GLFf#GMmgn$e4nO6vB8M+>_&SGga`;l( z)j6yYSt(p4{7OYK=2$+%qrYo8z$ZU*SewHSIc%2Ax*Rs<@O=*7<*?rFQx>^FU#@L&#ya^6q3C_ik?ezSxH{GP)fs_jo9=MpWs9p$Hh%*g){`BzAT z6AYL~-8|~$J>xQYRLkR(yjOqOJj&%!K934gRnDI*sbU_LWWbCxt0HYxp*aK?r@EST z@~DwVO&Qmcgq^A_LL1XTVo4spJQ_&u&m)jWIuAFGU>+d}oxFFvm~`PhA`+S-I+{l; zkGKpHlADJ^l6j<5FiT>Q%#z6?D}(xZRM)VuhFl(bl~+)NqB!NeO;0>EkJIFGy3iC% z`5Aefna5dqoSjF*Jeo?|D38V>=O{=MR;AR;&dTX^t_^aYh^dN;;RRX}FU+Hv2qhQg zak1siMJ~ysg_X1vxipVfR?<3;HkMx|ayijTuFT^q%dgI(t>xE8N4|C?^@rL+F;hVy@grkJC;b?FhlgHb6jLl=5 zg%gAmg_DGnh4f{Rsg_U6;~nwo!Wlx7C8I%`oyWWC?3}!JkL<%d=8C+hzRzRV ze3+ld`*|$jSn-0thIFCi{69*L7)Os|yD0Cy2JNFf7AwWad3>e_pX9NG#}2${!`ZSl zj~{u#DvudzE>mi%KGz&z9PS00eUZnPd92K1RUZBV0tI}P$Lc%|=kZ$}Yx4M-hg%*y z^7uv(wkpN9d92N2T^`?QXKl%2y>`t;mBg?c)Lh38jyyKy@q?P2(wp<%AAr(;-C<#@ zheN^UHW_TsgS}>LI~A6P2Kg@W-5RSsdF*AsIP>#3AeWytul8~G>Ax&-;>7+ue$mi% z1P1a(FsG1q@j;Cna~;x=#eelZlE?3P{F}!ymCZ{2P#;;_pDN?8JdP^M-+BBaFAgsw zaCdM!&gH#;3I&`{3LXL|fbud0lr5lK!L#hZf85~zRsa>Hs#-ub$tx95xqvDK@2KIi zOiTVf=qUwMFQB9VUja3E`o~}R7QFSLW&u1LI99a^UbNZ;?`f+#1#cv|+|?_1dz>3b zfN>a*Z+T+gU;&{5&M)AC0>TAE3OKER(+hA4h!#*Rpnd@{#b=6a!5j8?0f_>V1*Ft; z3&^O9v{JAh4jNO?lDUXE^(8MX7#j`Osd8u7;Trh{%5skI4B?r=vkEv{zKqtefJOy0 zE_f>m$G-{7tLOEr0v9VT{<3c>Jg?vxunbP%3kzsg!2Jb0P{2h6TwK6q1zcY6uKUrT zxq_2iQb3CWTCzL9r3JJSVRv}MwJxBIMv^g^j{D*YWx1h%8w;9Bjhx74KM`hxdPKgMaN3S06?o&wqz(4l~v3b?s|+qApAyj=e^T(>H9 z$AWi6bK^q9f5K%MoeJn&04MMr3{}8A1>9M{U8V*dI}CDf!Ta;v`wHGhmo5eG?_3#~ z1#ppnkj4e{DWGowUDYG*j;B>vH_oC09?^tk9Qt-wgdW02X)Hqd;|25-f5J+hEZ`~e zUP6ACp&85W%^g?pF0?)?`Ev#Dc-$uy_r>$7d`JQP3g}-Kr<7COf885=|oX9;TK3T}6mE+9mG*ywOaaM>h2)i)7 zfEnzgUEF3BFk3r|yMT+#yV?tL3Yc5Kdzt{OpN{him@gF0>4EH7Y10bdlbrhurOq%fiFN@)ON6TWXRwTMC;8UOld|$w(f>%aK5xydRC}48|TMF1( zK)s@8ysd!k1svxRs$Bo$kz2sQ0(P*H0(KR!yMR3f?4^tTU$Pkwt`jGI3FCV88e;R`M$+Oa;&WPyvSv_^W`U1^iaP5q0O!0-omcKLz~3LyRX;`ajC@BJ6Bm zzV^9*e>j)Q;TV@?jwdexaWT=D%vDMJpF|W$`_HTi{n*L zq3Ded-76NoKg4XT?^7GggTwemE$~^LYDJtjwk;Sg+&lIDZjcPMnAo;S>=lB3ML|vR<{JBEm(_fct{o0R?!=}RlLj1z7&xydON+ordCd>d=Ui^ z4kHUI7QIQr4xU;BqtW=ZqW4tQ=|wasdeiBQBIa|ssN&(-MKmnp(IOrzqLJo9n<6eN zqA}|!;v7}gRQ)|y(Q5L~&H3`@BF-=3f};0Tjv1SAYVm_WcyC2qB>Rhn&4o;QNf9l? zTM91~wi31$a+DbAa`GbX=FsuUe|75WqBkqn^KGtblDC!Qnj)?(;<_TPFXGms_u|SM zBbY%orIl*cNnekF2nT()O(7!w}>Yz zpi2?mi|C;W@8kHZM-K=e6h0(m2fG&0P5fcuBSLzCRav}f?O*0D7U%v7a1Ph<=H#nI3@n12yLgbaoWl$QN(AU@Gb zCKWMRe2SG!6`3YH!lRPAo(GzmES1L&kKX|#W$~_Rm?HzKXg0Tq_llUugQAG{rCnGA zS2=1Ih;TLVxIWfDEMid+A89f9xQI`RSj@Rv{p6DJdlm0cGVp>^L*8khCE@Dj)U(2_VmX3}U z@QoIwc064vVy!yD0cUf)`dhC)O6p@n5gWPM6tSs@<3*g{%3s9hA`TUCxQH!0(u>$# z#GWEL)xfqQc9p?ZRk2;Q{jZ1}MeNkEzpIGOd>5`}Ci_CNw}>C}lQt zFk`~?zli;o|043M@Bmi;t(lxi&3XT~h$BV(S;SvO{9eT0e2TLy{@{Ms3d2R7xsGz& zxcF;&dmjWm+<2D7^^nPwGiMJu^K$C@6v;ISEKIfS?!<5kv*E0_KDuiinB{#S924X2Ap|%$NnU zVB+oCO?$cjTX(Hld+j=P>QvRKQ`Obg{q<+2Rb>kkE0_jzN$2QPvryeaq$+Ay;1z+B zj_Uwz9RV`Fp)Roz>REV~6P%kpO&kV){hC-+7Y!{mvdnNZi^x^IsfA{i z`QOC0h2|DoScplXB@ObwI$Gw+-b#|z!ZyOT!gfO1X)m&+im}ttLMO{yb~_8Z2)ha? z>?YFPLXS|=(?YM1TkK=VqZT^yaS!hrEF>(`@Ug1B2VXj7vV^^?HR5$Ohiyzc?kNO7=%$32ie7@8|ZwrT6INU-X3o|X8Vxg~v zBP>j{aJ+>hE%dW6)WR?eM_K4^;TX$YO$LO17(_c323p4RbPF5*Ie+zx!-<0}3<-P3 zgEnF&{E7>o_!)5eXMO<#- z3JzJg=cN6`8r&t8xq@(i!YRWMVP~(ga4n-EYKHzg3)eGvA}B;~g9RRC|7_tG3pZN0 z$->PRZn5y9g_kTWvv4c>Zs86K%Pp+1aGQmdbh{i*NAbrY=I8``m4!Pk+;8ClwRW|I zyDY2`XAx@NZQ))EYc1TPPvRN1uNbOrGz zDl4#mweTAQEMnsPcME@5*k@sa?qV3OgEU9>GeWrdTlmYu-xmJi(i%a_2>!KjKxUgn zfCwr?O!pf`P*J3E1XUuaB+kHQ7JpSEs2@Rt2&zR;J%Sp_Wyjgbnh`VQYYA%$nXDsH zS6D9sHlD&DL`i72k+K>KX`fk5WwV*Exsa;|HCshYNOy>!V+5@uXcIx(2#&6a_7U^v z64YrIF>9}}ucmg2pmW6RE362*M9?*Y?h*8mgyBtt-DEJ(=Vh*E1id0yQw6_Q00Wo` z+?hloh^lQdTI2dJObBgZQpl`S1ZnY1D9MVjQ@IG-h}lqa2f`KRJ$_0e0xyCWB6u-^ zQUrbk10xs|L0SFf(!@VC<&gDeYa?dt4j1+j_7zfigvgN*^bFo8X5zLC1C51nJGlz4BTan4y zdz>k2vm-bwf;kbK9l_-hTtS0ulIp#TL&;CTMX-Qlts?UyI9FMy%JWT}$B9rC=PUOD z;X>geAzOZ71Q&^4EWAW`sgMO}llG~0Wdw`Wn5z_HOCne*&o9)T_9)$R|CZ`FUqfpydJ@}2)0M?hDPL_2;Pj~EzY%?cw3SS)ECYIt`(#B;(ArH z-Q5|%yDT2T`w@H>!S{^wiufRc-Kw2e@DEjX7b7Zyj~PPT{Bx`&{8Y$^|5*e-Yc2Xh zYX~>76n+`OR}p+IJ1)2VQvOC=Fk2da7=iEqM6icTbkxlKy%GG#IEkV{)XdGFBKReO zU%8&pIOl@w)9h~%{2sv{asus8!oKWNZ10cYPp<#`iTow}JA!{i{ta^vh;Tqzwqn%G z=*nt9r6{<`r+=zMQ8kKcQB;qjSrpBqs1Y>*z+X*~cli~FC~8MhN6GqOZrv#Ag`6*$ zG>Do5qJ~0}Mk0-)Xc9`AM$P)eELv_61!eH0y{ zXju_f6dj}HZiVYZuP8c2(OJFdqK#JfD7r?`EsDxIdg3z6!%RB4M-)A!Q0KsbH9RS* zXl(Kqi6RrK8BG{oFaU<6}E*61Z$~4a`N&%0O#e zBJxobq9{h;MX@Z3TcapN&9(dVD9(t&7cWQAJBq`iI6R7>Q4EWM*YQ446Fh^W=o`fm zte2kvieiA8MBY!5qlEp196sYTl^Pg5cz$?H6oaE+lUni~wl0QfP#8kPqZkpz2~nKL zrq;yBD5gX)HHuMD+)xRlqvq^ljM_F<$Oa!9#W?Ztp=3f7$Ax^N$fPJHhmx&2M&Q-< zcvh-?6y3hF3Qme*I(4Gh2TW5%oD?&nm>I>aC{Bxl(~}LR15aU-xc&?GS2S04YBETe zdu9}~qnH=P{3yQCt``w;QaB3;0EflZ&IcB#KL;xGah*CAnO9g^**-P$csHckv;TrK*A* zzbcBW)y`{#2b!3few}i!r_ZA%dT)&47J2WcC~j70@j6a5exrbqz`K~`QLJFh$IvQ< z+h|7>A%@$dxFd@9qxc|-RT}PfQ9K;Qo#J%Y>L~6KUn9Ibl;0zAuW+sKKH>es2ZRqs z@sJ4Zcoj@6JrczZ4kGveQ9P>gV#gm-V;*OZqIfcjr=oa`6NFEGh0hB&2sa8h37-*e z7H$zfD|}AKk)nmI;x7na6uu;US@??ZRbf!-b@6S&?ZP*NZwlWMzAb!57?j${Wrypn z`o-?>44hMdef*H~UBmQG6d!3p{w<2%qxe|-6Aqk4>a*yUP zCi|oKGiq*Zxzk_~_T?|F2Al;vmf697F{#mPet^f^=2(X3NEKpcd7Q(mKn#`0W2h2C z)fk$@&@_f>F;tIXH2*+}=j}1njG=A}^6V(1t{ryt}Z6u&0oJ$V?qZH5Z&{ z3^7?w#t@Go5i|47j+v3A0+#}|nG#;FpQ>oq@HA_WAsaJW{ljDE!;Yu{IiVXvK4#t{ z<*y(~F$OP&l6YC@3)$uk)zDk~uu#HMePg()CXR^VNE%n|bJQKKifmHVYVwf4jDKVU?g7@*5Lf7lQ;kA_yK-u`y=+BDg z%bEOR8Ai^TiX4*JF`T82P=}3~tAV3e&!KY~nR|Bfc`?ja)#v`_;VL*kh6`e5a$On2 z!Wb4Q>+%>bjNzgfE{mC3E{@@idbm_syz*Yc5$BuXx{qepSRHk)VEcLRQ`=OuIEE!L zv#DFk;fvvF^@tm)xr&@?*k9clP3D^hG29SCZXDckxG{#CVz7%y7I8DDKn!COI5vT0 z>er??o{8gD@#QhB5V=k0#j%o?0P#D7U&gRXgxG-DU>`fvNeVmL|zQ#!4~mlC0~i*)firj;q@4{ z#qhR-+c|16ycxq=Y_smdctPjD1zU*2bch|?Q{3JZJ7QQ2?2O@E215+*$IKf7p9wz@ zGWlT)yF&g^3?GO56FM{GtMz8W=bV_5><;C82ji<4zLwj+iQ#vVZ)5mQS^ z{}96-2D#plA79A`e~jTL<^C-EMfj`mH(?#kkw0W=pKyN+e~SFYH8YO3ar_;_KlC;q zGsV!1v2=ic-2}u@A&!c1G?j$HN+Q+bs2obF#8Fk8pB|z@^*Cz8Q8Ub~A4e_m+QK@a zylx!z;+W9W6nRrGR5ValLt&#h8jCa$@|^^#RS=Rim#{?~Ek!746-Vok^MhmU;%FZ? zuZCvh=nyw+TDLg5i*$^mlL&>KMY;&P3WJw9d&FUfIz2^t#bJp=gi&Ek7#Gr7B7X2y zSn{NVsW{Ri86n%lEJr*iWYQJM$599+#n4VE4nK}^9KGXM5#}Bi#|ZJma{hl@~oWE`X77_H=S!ZE_J z!efQh9~Z}X@d?7Nd>5DZuyIU^V{#l*;g)casX4kKwIWxk4Oi32 zn&zzZI?1mW2LBb5`}~!B6(^2m>dVc_qUJ3k)2rfEk>x_}PWk4*ZQ?8AxIKiiJL zo{;a2V~-@<={9LfVC2yIqK zprUxCP*Pc>im0b`wL?jr1nP>{3nldvXb|#-BCNfM$Vg$+1ezt# zJb@Mo^dZrQ#9JoNDuLDsIL*wwX0O{MaCm5^ZNdy?y9C-N&>?}233N&z$1d;|hAY2F zEP*Z}U4`Ak-0lhV5bqgEdWl#GL`0&YoI@NBc_INjp}iTk0XEYe$e7(K>+$Dm%b`+e2xBh+Q~`bd#}!lQ)!g#!{eT7)_SMFt6v z5e`mZNSHfRWLN^jL&=DQc{7j&M};09oxqrovkl`C7@xosE}nETA%Wu(Sd+lr2~14j zR=rg_H-SkBOio}*!n|ZVGl5eQm`ddNk0d9EpD2EkaGG$s@MPf(A&cL^V;^z8EXpK* zvl2KhVcshyKRtmnnB@A;>Li)XEa}e?jz4hVY!SZeNd0pX=H2yqYQTKS&rO(@lNX4e zm%#Z6T#&%R1QsQ5eF8Vg8y6;UMFLkQa8UvmCvZu^yp;Y?HC!%osjOX=FmFDykE{{g z`6sX>fu#vtl>m2@^|>?QE1>+h?=r~7Oa-n{@oN*fPOVz2SL|r{#sqFkU_}DAC2(^B zx6rW(EGGw+k@GJ#s+#vLZ_3si?6(w+I0;>~XU3buC5Ae-xj^-+kV2gwA z*7Cj9yAs%;7kyddJqg^Kz-L)}p2b?WCxJFuw9VrF1Rh9Wu8nhSJea^k2{g3P$i}(^ z9!}tcgt^msB!Nx36MR2`^$9$hz+(wKp1{@wUSNbI@Fb&x4{8&5Dq&7RpH5%{1BU-7 zxh6Iy%mt1&t(y|&z>W9a&m^#!bDXUh)70u2hIFaV{norO^Okh_6A0_Z{0>8@->-bl|34ETw7n~*u^OWtgggHszeIFaM zTL!;L;9HR|6Zk4&o{KT-Ye^2&!*>aMpTMsP{KiGEj>-BVfjx2&&vN(5Ek7pk6MdDy zFG8MmaDzb{B&^yCsj6nn(U1><)vA37>`&lN8L4EWvW>qI_*=<;5`b+kPyZ@;K*+e| zh*Ypq(KenWXWxlcY-6^%jT$zp+GgCRabsf}SMv~wSkp!w8+9eAWuvx8pjOXDeI*;% z=2)Jt4sz*I7Hn*ro*rqVpN%Fqn%Zb)qq&VPHoDqqVVjTccIIktqos{jwrLC{t!;Av z!qGXi7uworXPft$+S}-8qmylJNITf(X(mUXx8W?pgZIw1dGyR!?PjC9jgpc*RC|`q zv(Zz$myk`eY(&KA+o)|$;A1x8A_<`_ObS!Nw9t%&2#w@yxHgJ5JR5l%-_jHPXf?8)I!8 zYh$!+o`sFk@X<1> zC#d~ADq-JQBXOFI={9EAm}#3Q_$S-oyBTy8yGhUR{P1=j{@eJzB2JZOX4yE+HdCA7 z#4{F-?-@3#Rm5Gq1lX8un;ZPIq&dgN*|sUp+kF1$pLsUs+xXYU0UPJqSYYFI8{2H0 zXXAVu8*R+t$-koOGCIV@LVAPGvTa-_mtJJ!Vm4AdR@3y6UA|OFjw$&Svar;~RW`1) zvDh}JNme~9QP;*-Fptu%wsDP(hcu6_wau$6*V(wVz|@BY8&@S$eWtGY}{kxUK?v{+%0!; z>}+~ZM+aO4*4pM)o#aP4O{E^-C4fV~X9xPR87#6+U3l2WBO;Wn7kO0pnDB89gvgV^ zr-ame+Qx>E^R-gCeG@B{_cjYD*<#~a@#jLx^ES4I`~@2?ioX;}UbgXy_^YAhH4bhC zW1O+Eonv9+eJv?(FvdjQ622{bN4P_{Q^=*}T@jAa2ex?wM%xiWBVX$#&# z+}{x2+xWr89^06rqZsF0Quf;T(Z)|&04r5BG5@oTUuDybKFw~v7x9PI z8CuwH<4>;qnliNckBt1S#h(v4xdJrj3Yj#dP7-yKsE{-(bHyYoCDFbr48F^l#hkS?NTOj9 zjgn@LH&3EP5{;9lM@^Dwnl#Uyn@Q9NiKbAwu@ zs4r8Mb$rq+=FB=NiD^lko5X@7rYCW75@#hbCy5zJ%#`NoNt_}=u8Qu5*?E)i+0vVk)%OXBh*u8{mnAoWiB(D5 zDao27?oML0I4#_DNL<~M#M)4PuShUJ_t8bF@j(e65k3@Zt`m7!SW7RNuTSDpB_9iQ zXy?f!o=W0bNuCyNNMfT%(B)0yn}yFX2ISQ(O0u0C@#n->Nd7_+FDCIt61$UlDT$Yp zcrS_flX!(olhoc3z9xJ#iPw|ZCca(k*c;+}tAUmo18*t$wvZCW1969vJB9CR;8^ts zNqm^ZXAYMI2x;=$+#9r;9(Pld)>Wqd9k#MqZfe5K^CNqjBxeG)$;@s0Sm!tVmP zo@eb5r=6cf_9pS8$bYNB&r1Fx494p>@!ym9Lu8+j7MS~25`QN#D~;3A_$P^fxzeWa zd)4XDO8iBy0A_PHBzW4 zUQ1Y8cq5-ygsWEF6zWOHKg*)2hAA{svYD`P3d1CCq9hfXroiGP%~NP0VapU+hqxtOQCxTol@wWLKg`GzjY1maL9V3&@+Wt3ULX038O+Q zg@_1OVD20Lo12LgY{>(MvysU#nGtbQ$fuAMcZ4}1AKy^9kU}wqvLv36LO+F4$Z0m{ zd+$(kSjsF@RO_3<5h)B$VMGc?rqGXm3v^QGFES*B0Vy1vI=H5>$Uw=D5e`b3hx-%` z4oaz0Lqi^Phus`0$+4k)R0^ZT$AprxDRWig+!>d`_!K5cK2dm_ke372GAV`0DNK=M zs*plll5a?1 zV+v1-KP7xx7_@Vf_%kVN772!fSzDB(&1XYvTT^&}6E=-rX}p-iON{3f{z~EH6kbW; z;}kwg;nlFz&J? zBxieerSPG6u&Pt?5hsFX=%*=sMz5yuLkgcu=c^RHPT>o6VYeh-hIZJ;Z^XX~CEs$4 z^lUmRj`lfM28b?afFO<{UfoA_uGC+jFL7`-*$T7mfX$%SFLBU~Z z43}htFqp`r(-@=V^fbnbOcAn$$EGnZjqzzrkYr*gKTd?BGl|YWq(^kl)HIGyU*g`H#B=*8t12Rfs%`a3x&b#W~mF)xJVLm zHsez9YlN4jad{e7q;X{$OC?!+h~|=zGa#=LzdDpKp07>gIwh}9yqrH114e^&w-y?r?zEg*9p1EzNs` z52SH#8f(+IPs#g*ywRX0rv}^bpd=3ogJF7v(?`i?g^#AON#wCK9v68+_;eairtuU5 zM(bqI{tantRBm933&k@^ZWglAEot-mG0Ah1JfFtaG+qdEUlMtdvsm7EIh3=Vuch%i z7qkp2W=!#IX?&8#r)g|Ybca#u+K1BaF@%?H1De`+7e~9o@c3(K|e@Vi!|D^GE$XVULX&g{Q@zj*L z$Q<-%r3@-(&?JMV@?jNW{S2yRP%VS%8Pv$2u7oUAGlSaVwS+-0D6gYr(B^tP0t(L` z8f4HgEZZo9#)qf{%FQxpob z1NSah?ura<6A6U3XK+Ubt1`GVgZm_3oxxp)D6Glgo(%5I;BE=oW;SN6I7yHs-XBW1 zC3q-WVxfTrYf7_*e#yi##FZ$um#3Y58d-w`8y(gN@>wGI&OW z!%7AIHp_=3&r1HBkd5I+{e=u(%;4<|-jVR73|v_(=wzitxR6 zwuJUSS27rp-QtvgDe_eYUyE=uexr4R7v=9W_<>6rBi&~+)b{2KS z>t<0;q<$8S!rTTT4YTGSZn9uwC7Xn~e1ET57R|HfyrM(IJbDS#-*xa~8w1rl(!9=IKW7EDp<}YZl$I=$=K7EFvmG z|M!%dl|`?td0Qhz1S$!j5+MJ#JZA)ZAd3tQFg)04HNN_knNvPfsm>(ea4UnYwz z)w0N`M}@4ByW)8vH9yt+JjF0s%EHf@$0f&AL|KG<6#tGuWsl0De-?ejX{v7)M~EL8 zO8T)nJ*gj%HIGmSW-%y>qqDe{FG4gll4G*wq0EphhGsFC{?QZadU{?nOlA2uS$s6f zUXRFPWY#=GAC<+JEXJyjqq8QLk8h66Vq6x}vY0MMjnCr5EKZUeCy=oHSxi)`CWURA zoW&IJsiEX}krRY`&48sil>9?}y8YxVW@K?H9mp4Ts$gaor?4a3mgp3Y3VhzpR|rT> z&*BXFJd0&noS8KeHg9njv$Hr$ot=}#{4CDR;%rsK?$1>_&k@ecng_41Ry2>)7i7)b z0+(fRUKZzPae=zLD2of}b3R{F1K#2bdweB^Pwkb@ZTT_-w*kmCuUjm zZ2cx7pAX)rFXP=R`)jheTbj$WSfL2NjXllc_AKsD#Il8}6s~s)=}*pu)mhvn4=^^^ zJBHIeS=^g7Eq{ma|A;)C#Um^BC1!skj5-<4#Vr@2VKwl*RK|Y|WZyrq5)tIg2fdF8b|R zHRCxA0U!6X;0u}^Z)WjU7B7mwB)t8=ftT5LuK&VUg|7);7j6@7&*BXcYO*nJXTf)G zD)%yf7R?v5IKK45jx2V{5AO=!6TUC}KuDbrMRo~45`HZFMEI%jx*GT*i`|T(9Qx+) zWfottn+{%Z@O2j7a27i_(!sY}m-yub2elo1$Mr3XA2`Lho@eogLT*nMdwB`S;wO4F zi(j(%mHw=WZ4JyHSZ%F|-xTnVD<&B&T&(tGu|JCzJgad`(9+3&X7N`Re=DT_$>Lu* zmMF@N66 zMX9ZWma3wagVuCfRWs?9)kPZzQT>qx-zT9D+dD?NgM*Iji(;F7=O}k^On5W!997ZP zK{p589rRE#?I0u4Q`pOa^5i0?QBNQf$Jdepy1#z_Ltv(aNs%c9h4oER4K2>)Z}%a-S6#~4^WVBzf{uS&K&Nb zk7NF{u&-lQEw0-fCaxIN>E~dSgV7F-a?B#upM6p801lRefer>aIL5&U2O}Nxg{Z*} zhBz4Nn3>|pMT=DLFbBgObDiSf#d9qsX~rkHnx|tNGfB@;_s2Ro*1$-x8% z$1!yEcELmklN=oHn2R+pF?2p1HCbUZ#Q_ImDm$WU-wAYu{-BZ{Y-BH{IXFeNPj_&# zV_uD$;b5j?7LDLl6SjxsR0p#hoaUIXkj+u7p6=ibkux1^tc$Z8JlF`cIfD8$BGvfm z$Wc81m+`r31N}eG!F&hjI#@vGJ9yH;c@EBZu*|`&4lZ!8(81*nu5hqO#xD_GD5U2v z(kNW4S~wh+DoJvg$e%pZlDu1h&M|ACI>e==4Dr2Zf>E^JiyV>*Jd7+gzcyN zVO9F5gU1{^BKNLW_nXVUsYMDLI9A6|eu|;aPyKKR96aq{gJb?0i$l+=Ial>(G%ucI z0}%ML4A$k+ZI^Xa4;c_70-^U*5(q7>+*_Z_?>PW_i1yb|(P9lR#~x^SCt zdzkx%$eY5qgl`Mqaj-*Vr|?}NEx#wSuL?eJ@S$V&=eryfbMSKb$ic@BK9Q5D`7`IK zTFXiLnS;+cmk%7^?+cOL4!#umO8B*dZ>Z1r{~i3`U=P=SCBGN46tno-%RsGR)P9uw zCn1wm`^CYpYTIuPs^w5UXZ-fNB!4*A=U~71pIi@fsF1^7N>b-<2mgrw8%hpvW!6br zMH!(^)f_5`R~A+g26sKoYNm2Xi)Vz{ zQ10ZA6L&*NK8J#MV4;*V?j!h|J94lpIdYVV2r_2K95W`M1nDbD3bP=&|X#3Qy#Vb~LEhCeKn?)-^}u>>TEb zoD<6DiOkR8T#*H#{Jb2_7r#KbP`D_E3q`(aWZHj23tW;jZv!sN;no~3&6zoVSq_)y zaD_N~eQgd`=CC+t`n4p7t8%zHhow1lJV>YUO3j{LlQW-~;9uf%pc!@7<#2t@c>9JN zZpz{29ByPl%7M*!`O`fwOWh(r%+pSFIR`XnuB0n+=2nH|Had!7!;#A2j-1&H@W$=+ ziddDyor(myeYKqb46r7LyXnRp?#1_ocxVOuB(8t`Tg z?@02N@NHqByhD7akS(G9dpW!>hj65V?=W++aJROLVXw&lIET-2_&kSCNFwGU`zfbk zO|xQi27QskZq4h!rHls-)7LqC!-?#opNnrfHFB_A6T06k%znsW4}GXB-Ck8u#WioS z{+Pp0ijbdk_?>f#UjfbG*BpLRNW9X}gcC!HL;Q!vdY^EA&U~5SPcHsBY|w`k{?3^X zIQ*ko&shCeY6o(FYt{<>Du`5cQ7M#EcFi)ytg0@mxv1`Plgfj+AS<=F^3> zT-0{WD#}=;yXv{9@0xkt-9-bD<}O;eXy~F5|9Yqj8oOvFc@vg$&HUQJ9h$tvQmBZQ zE?T*0=c2uf*3xX_qOE)IQ-=$+?mfeXH9-d#9bI&G(M5JRciaO9I=SYf?rr$k*EQeN z?dD=(8?&5pOGEqIR}g#1Y)==xL@42xmL8z5P19;dS)aLtG41l71T|GF&)9IMT%^7o%OXN{<(g5i&W}#j)b!ID9&E z;%&u*F!wl-i7qCIFpDuWMO~Zf;&^%N1cthcX;L^*BSi;NZMtjL^Rry=JHRKqnBiik zYpzgiFi!$cadE1GZIX~}y(DS+rtEVpxo#SFL>s7$aQ|?SmxqdjSGYDW*67F=8AT`iyK_r820EUg%jsBrxKmt zzLEJZ9|PuA7b{%c=9(MffE>^p^i`6mYcnjcSm72j#(Vix_(=|JJwq%Wq zyE!N>9$=*|?sc)&#eMwMG>>Sh!?$Ai2hk7JG=bWV-~V*+kc;&$9(A#fOM#0=SiGh= zGob>1{FAz~^gY$b*ms7#zJyHwj8`s0`Y9JryJ%BH+afl&*y!Tfg7N33pm`j6k!M_N zcCm%IE}nDo8kZEwpLg++$X4MCE?yKl_mIDBf0+|p!dHbi>TH=+Y;*CBB->rQ;o?p4 zw}o&0Z%taG{tg#A50Ss`;sX~`^Ef__4_)kHFY;)c$44$c=Gv7vMLv;!ZShZCe8$zu z#TOD*$z!+3w=TXD`O?K#B3}zx{2LM0{=JJI7-&_yNe$gs1@+D)P52M zz5B&ApDN|=SH_I~8`mE$_DM+n{UU!VE9lx^p+1xU$|h^Cl*a+dkw=BRsfY$CuP9DZ zId3FEjaAjhYI#)8qedP#@{F;A@j%TyYALyt|8KN|kyBVl%60Romq-0P8iWR$=Fu>Z zM#^n0Y{If~J}Y7aIK^0;zvg+gkU~pgD`D%fJydR&NBcaE%AM#`KW2o)QLLvcx08pjELv;z}m+DCOac+j%5KQo^(_Bg_gNVNS?a zxq0Np3&Nt1UGPL$QBXTI%aZiY8zJpSgNfU#@5tK}+`$DBN_$>Z8Q&dy_Q9t$t63yIeX~%aIeF8(4c`*9wh4kR z0xA~Jw18#>RMOR%rD}^*E})7?)dH#&P`zLlt6Bv!gK88|vvBb0Lx-?PfOSF(bqlB` zUSHTi$_<5$3TP}Ltu+y$LGtF}oeSt9(xQNt1+*%lwQ8hJhXUFZ(6)eflCaYDY7z;5 zw9rxVPAdLile!j=4kg_R=w3jN0(z1UqGQ?ZWf9{uYi)W{DOHDMR{5B-a_8~P|~M>z6G3Jz}y0kkn%*~kp=WC z;Hc2@@B;c5Fra{=B^jpn4-_9%z%d037H2z$sLLcnC84_lzfm$m5++9$Fsgvj1&ooM zaRrQ5)>tKvmABbnYECHNxX?0_fgdInFj>MW1xyQVPA%Yg@e_n63Qv;3|JpFUfRhWD zQNYXsPATAwu)%% z7I0-KSzJIci?0eL*A;Me$ge5j+K|(Av~azWH?T&LV1GsV%}U-PTvouXBFlwr=ZXSu zQ=39$TGpuG{RP}Da*y!d0@ku#er>OCa2FTscZHIV3ivqW^zCOM|61g8;TOW)1$-IS{*@$b!#5(V@mpnm zr%2;~{=l#)V6Srb34aVVe=6YT0)8pr*8+Yk;13m~h2KMuu{bRUxL>8n{}iG8?*jfQ z;9n&h6^+ji6o4Ws6j4#h+C@|Wq@qfN2R$W5&x~532P=~eD33*+S zdcyieG$@*e@z+pyA;ihZC6RUsYrKW4`EMXFQFymSGQ>@s?vA{za_taGQq#MI2qk4@K-LVqg)2iny|f#YG%b z#NZ+>Q7PISQpC_AhAG*kK86=DLj2+)s_EQvWD%o^7+u7eBFp0F0)l8kO<2%j)cE#ibCPGpm+*CoC zpOx?Fis?n1Ove^+Y7sMvm|29YJDTAwj1G@bxcQt_#A!v$=7`YM%00b^Ggz>NIfyuu zeb*@jaZV9u7tMjm%0~F9i8(2qTf{j<^I3zNq(lArYU;Vd1x1`E!c7#i@2_crOG0#-5oM4LmgT%vIpOaST@VCLWr4 zXeOQJ9$I>6<(aZAgdDZjo^ezgCAs|4$!sbW+I#5WVZP){cJ$DN_C0j+(Ahh9?VvM* zY1_@i*=l5W>G$x=ve45*FAtW7h==1Ok9vrC=;NWUhq#A?heBxI_K@u@NlAslf;7#vUhAG$M<9pGd!FkC(M+>0M!+| zC(Iz>=%41{bPs1Kmj%!8Fk1n0CL5{XWKRQc&yh}WmN-}ZoUqh9`mMU@&bb~IcsS3) z`5u;fxJn8a2ru`rP-KztLVCc%#U3v4aH%}py^VRS!pk4y;YJTP{U7#e`4%ZJ6W%IZE~Mp^9&YzAw~TYjxWmIL z54FmuUB;bKXzZhjkJaLL3D!+jjA5>6=Leh&{Yu1ct0!h;?j z^6;*Q_dKlg@UVxMJiP4T5fAGewWosFZ}6J_h9qx!cw6L6#QzYwRdJT3h3}>CgJ*V7EcGK7e-D3hqIvk4i@!8~_wcLKsLx3LO`OUbo8b=+`#kKI zgqtfWtklluZx8=)tV^g|!oMC4@RCt7uTW;RlcXAy(!sll_EMl5TXrBdea zbSt5I37t#mLbZ|!1O7N?slaK=w)H5%Dj`xr&k}l-%*KzFIb>Ylq9w#ih?mULM{5i` z#u$f#xztIPkSbwt2}4Rqmyju;zgm?o!6~7435O|}WAPFS;;xXcE|%bx;LDkOn#Ly4 z$tCrg5nh&@Eu`>p3QOo$!cip?OMOemIY+1?^afpYWXbrDS-}d-hVcSDpoF7K7^ou5 z8dNg(YYfO^)BsAjLJloqSP5fGIJSi0C5%wk=n_VTUJBxHl;j+gF>)`Bv)*y!l24X! zg80M|juT;bII?~C35b&M8=Evm@~P?|leBhX2`80sM+vJ+m{!8{5-us>(h^QCVMYma zOE{;5nI)W3!s#WPLHD-6sWNh!`a4U=z@{lybY>7{+{~zo*$SkUybCDdY;}k2p$8Zn z9J_fXoL9p6CCo43+!7XqUJCZ@L115?x-KkXVF`=G|0{lxlI+FB%xz=Fj{LF`mXxrx zgv;sqVEr%QO7X=)?g}WsO8iDPzJ#kwxTb__Lu=P7>$=jxw=r)}l9pNUX6f8o!g2|3 zDPfr;G{_sP6`CNNJ}XPOO?uI*hK35^fN35b4HEiWZLMmJ*&V;q?->DfhV&UM%6I5}sFbYY8uCl(|*}HtD68 zmGx=~uY?9y^8bH{2NAfPvBZbklDr}QrjQ#3%K3X+$#+WF!DUJkw&cAM-Y;QK342TU zpo9-g__BnrO4wDxM(?&p!#0PAB0@5ek|dq68q(H)% zzF*DwQ<|)rZTLsZ@Qo&G{8tJGG;6rZRgk=*kZz>G%Gw)L5mpse6IS<8!$(aYwS3f* zga&K-sOy_qNnS@rc!A5-Hj?^28Yruwk4Dm`Fc=`Vs;Q4=KKlC@;G?;Z7CtgQvOZc$ zGa_u|qqUDVKHBJ*`iS|6`$+iUzh$8V`Llf_r9gLaSDf-q%%rHrY`xxP4q>oWP?(uQ2 zkI_EH__)%?Vjp9D94oasKE{ch>|+M~>|=tD<9tl?alDTcd`$8&*~b)iQ*C1x*uwt@ zPxNt;k7+)p|KB>F^7E}eW~nanQ$$XcK7DeUkJEje;p0pnvwfTu%2^k4=__Ku&-O8w zL+@jrk4t4_zK?V1TOW&jEbwujkMn(8z+kIw_VfRLywJx*J}&lg$^X`2=>DgFnJi!K zS!El5k5BYf3$8$c``FPmJGs=3z$9f-6`gqF6qdp$<@wksCLTf?j9*R$M68YHZW7Gew zvssq62!pb0=kq>Z_3@gItv+7x@uH8He7x-A70zxhFHOy@9F=)d_zz$AvCYTZva{XC z8$RCj@m8pRsAj<5@v+1IUl!i=@t%+OeSF|!x9qSbANu&%$0t5^`S{4knl`3LfS>yK z%*W?GzWCqrLv_CN@s*FSeSG8NTOZ&3-{_wFcwDY^Vz{P~ueb!6o1hxO=<8L4TaGHdghyVYEphEfJ`c|ckisF^Zs9ZMd z&wqnhwTxvRscd|8^lyrp@*y{$!FHDo<5hk!aC#YMlrg)Ev&yEC^vs!MbI8Dc zQJF2Fa84O#vkf{o3!F2rjQRf`Q|AFbHSzra7bsN)1V!uxML`sMK~XEhllx7yhr zP`WG8V;V8vZ-Lqll4&ODL4yw&e7K8840+VxV+J2LsJc%WGTq>lUCc1#DT7ZNe8!+S zpEcw;*=Wd{w)*-~7cY0Qs?TaZKPdjyUtP@7=+pdP*;NZcUA*4K8(qxo;>|8T>f&Rg zztzPh+VHQhKzH$uQQkFJXz{;`_q+Ic)~qA+exf#l8pDUiFXAU%eA?wU;{M&mXI*^W z#V=Oz3#;;F7hiSpqqgzuRcJ$mf8WJ7hJV|kd}oN%`=LYmv5TL&ILli6xr6*_l7BP! zyFpd?!;n9__{)&d5;AL+1pd>-zlw0Zy{K1@XU)Q+hsQW8?ddUx$6%i!K685X@)+PT z&~skuZE!A+J|2BNCsW?&=h5He!CAA!ATN#4Er7>79_N^3H7DXAk9j?|^4MCEJ%*?) zkM%s}^O)abEswQ5q{dK>MLibtSio~`k-%Zr;(`Vj@>tkok+u#dTnv)GxX02S$*fsR zcv%4l*7aNzNnr)j$p&@0zRdCH_Sn#)%fs`?JaP}; zBk-trgtFSY=>^?i>l0*J;n5|)LqcNDg;v#|keWx`@Wf!FLr)D+yM;&7qx5KbtY(_r zXHZ2713`IdBae+eHuu=VW4y;E9-De>CQm9zEZ)@mDC<-4tBWUiY-!d_^xO#AW7e$q z4GLEeZsW17$E6;Zd2Hvgy~mLrM|tevv7^U+9{YRjrV1G*(6N% zkc*_M27*MLVv#vT5_GGm?J){ML(cFx)8jmuDJwkA)_Cza*R0;a0!;Fyj5N`x>{i)GWjmYy@aRONDyD?C2%_|W4@kE=YM@_5?gYL9C?Zt=L)<64jF zJZ|u~(L<7_+OWFb;!_g#=tRX$8i{%?Y!-i&NE*`gg-0g9X#~mJbdfa6a6p-SX zVcAS-KcP2kJnr*&(qo3l{U-bgOB4^7Pt;A*bZYoR1|K%~NT>8skHMkaNUZdcWDWMeJ^oQ*S4#K!*W*9A(Wi&cEF0#sMTbmN zW|Kfgf=+w-F3CtpFQ48%bNS5e)5oW;Pd}gjb`4c`D>&7PT&jx7RD$#P4DcD~Gss8E z@1d8!j7>!vdh_}&OH1+v%Ktv|`z-G>+K5l;65z9d&oG|_eU|iD%34{-;9|b(qlJAI z@lmud>br!XV@r?4eU>mDDIkT_&~TrneMa~!>$8j%DMg6w2t}Rr@fqne%INAf^|(xs z?HZvPvn%+l=rhJ=CEs23q^%AiEBmbCyS((Eamrn?LgBQ!&l*0r``qEPrq5bFg-_GG zw6-#K&?hp}F4E>7c|%VDd@3eKy4|N& zEqqQlg=3$p^^u$)t!gHuZt!SROh%a`fOx~ z<_Q}cBA0IJvzgBpJ`>EYwuH@nH-(TWMaz~x6MeSwk%lVW+GiV|qkN9`*;Z`I|32IM zC|gST9eg)-cJ$fF^cihkAWtezcJ^6YZvp%4>a&~A?lQ-B^Tq=W9%V1W?`im62KP3& zkIXb=KZE-lJiuVPiXDa-<=uc#O}n>T&5WN*BlZoZ>UZ z=Xf*x1exPA$>$`WlYJ)p?n*5ybcs=q$QC(ArwXuBEo?+Q)8{k`fYW`>FhoQh3W>9P z&h|OS=Ukujd=!KVFvWo6$Z1$)%CQ$(k4*Ks$me2t&*xH~D}Ao=xyra;(qIzMBJR zuuE0NgCyMMqa;60AOG>WOXI!5pbB^U+@rx8uu#Cg3I?C|6wIdc{XQ@HyyWwMolZ0O zpwB}-5Bogg^NdlX#-oz#Gu=)fGx)fVqESUp+UY#HqWR1){3(Mf+Q&js?s~REdCuqg z4*r71yD`Wc3elHsXuo2muPU+lyl#Cu(PO618-{CYA+c}z?nd=3qr7eK9Su5*TlKGw zOUwx$NJF3R6(>F)`F!m2iSMStU-*2g{HAUHKA)TCB~z!$A?jcC&X+!4sW){C;PZ{o zx2BSOezK(<4gYCU!{BNGY-1t%{a+t?r*bf0?R( zTP$gIrxsKP7)9^MHN<1oRMMkt1{VFb#VK%n`U`HK#!#y#jg%^a*Asa2XXuzc)$_?%LI%FSTbO#fZ+j42QE}JRn`SXh}x33 zB~7+38?ao!$beCS8wKO63*?#QrF`ISB33ZEoGIPpF4fY+Y$Y85D+jD%lJ7Rja-$@# z8n9Zx>H%v6tQoLYz}jYJyE}d~9$kMm#~2&1PQbc>%f>QF@)fJ=>oj1;fSm%m0=$4N z111Le0YTt$^+o}efH0sIP!HT~k;bxM6u3+q8>|}Cs7wMH0nLEY^i=RjLK=_-pI_E^q75d};H5 zEdqBnlp$i4D`eOEdh8ppb-)g$yxhKx*(+CX8?asAt{2-Il+R^_PSr<(I|u9%aCyKL z0lNn57I137X#u;-nF0F*>>IFWz+NVH?*KIPz&Z`3?63iD1(O^Ji_3S2G!{@?dT4EY`}2=$D1@6ds4s&hM#C~l0n^0 zs_0~^GTGoM2B#QQkz}48aE4A5=K*J$s?vEm8}-upoPcu!&XZ%!Z?aK6s8n!)b?7A; zYq|s|n*zEG1V2kDd1)sjJKN4Z?PZ|{XbJ_BV)TG;Ld=1lRfN6kicYdb;|8#M>sN{jxp8F0WeibtI=bTKs4G<51f#ER z1S&4`D;mGk;8lx0D_2;h!gP;SD=t6CaFr@b)#IOxZz=q*zg{(p@m85EgEsfZ;)6!teV7I{y4T^IkLpC-z-ryz%H#NAK z!Of+xA>yB4$k3HsyAvyHrP-iqwY4?3O=b44fn~_{751#KSA`v{Xh(ypwUfDG=L)+R zW%pULcCD~mr*!uUdvx#{_1bU6EwEou;lc|07=7Og`$>Y~a^oQt4lrEKIna=UDjaNx z+ByLat#Fu~9$w+7id&f%{RpERsopmaA6?-Xg^I$g!a2rse1#J#oM!lm2B#QQ^+|@D zRN-VpCU@wk7}EYV@TuxMX74dLy}}tCo--9ohM(P`Tso9#EY;R-{pG$`w?s&KX8r&@SiS7B;}yEJJx;`Ih^G_f~S+{PhQ z(Q#9Sn>(ks7|*R0ZZkxsw;OVY!8;938p=JL(gzH=x59mf+;335qpqB0_=5&lFnwg& zBNbk)@S5rHsKLi7JZ{Jn2B#Yo=aYuaF!+?grz<>T$g>8YGx&Uk7b?71;iU>MS9qo3 zzMV2m_owzbqetx*y%Y6|0o(KQx>fnW;2Q>K8hq2>TL$0OU^L`igYOxXKJOc%9U~uB z_^86i6+Wr3dc+zLpH}$HN(V%IUf~PHf5=`TUsm|4LOmo2`MSb4N-rTxgnV1!y9zx* zdWL+j+*RR^3V&AkvBFOkeyQ+l#r;uQ|9$@10#&a*X;}SM;dl9YByy(oIauEzwC?+> z!rvACt?*yR)&D5P4RhmE3=%S{!u-l(p-W0auGWH*J_->sXUO~^LqmFn^bVOfWN_#P zog!1Cqfba*J5_J?3ti&sA2L_ylFZx&=P@|I;6Q_e47T@-ov-g#hX~FWBK;*+`l#sz zLWYGb6tZy0f}vAVhuAK(=Xz>)kxHZzQV9t|HVEko@k4^p zY2}4%HPSswlUCxFwh}VJJQjt-=9XIMVxVe16pvb0-w6?CBP0!(C?O$PNN)Tag%lls zc84_O5bXjDX@zc6z2-KOpadcb8ycIOym82Q!#4@ptW$T>5OJQZU7+fM(A}d=2;JpL z6}Jr0My&5gIPYz(ZVlNfWap4=J9W1=WV?3Qzz!ih8buMiq_*hjO|A~-ZsxjOL-)BD zN!~qV59>Q=rC*tGN4h}gq=`dO2`T3_BV!dq9|5H zwI+p}6mqipN26f)SSDLwsJl-MInDZO!{Kg}$!Y3S!81e73OOg_+>o8$vD$xj5vCkSjwj3Ar@nG6~nf(N5Y?&SMG;U2dk1awA2) zy-F&DTpMzoyad;nC#8T6wW7f#eg))I^UsosPiYczTgdGpH;3F3a;p^$w2QmMY6$Dk z@-q33kUK-}4*6n)JKb&+cNwQbQ37SMi1&ruuNYH`3wa=9TF6@=Z-+b>@{q=I$TRYG z$Ri<7hRg_g)P}b5*b|nK9<%)LxQw-TJg3{K+$&|IxlGu7C{J16DSDp`c`oGnkQX%M zai4+xXr#*+8sIOQ*y$r(m6xnvUJiN1kXH@9X7F``gY^Dy$jlD@X6W`di1<#(yCEN& zUGIgwAM!!Shc?pXY7M9%*2_}tBSTb0s(upkX~<_r`8;$gNmZ%wg$;x+)g8)RT3yk$ zeQ&7DM%sQGkhHu)auGkJun0i^wCo zBD{z=q8i~x1QC^p(7YkT)z%j3sEBt*&Yu6vUMXCQs7Ev+(#ZKiuD(dG07PtRrMiwN zIoGuD6$*2&7`h{x5v85BA`TzvGP&qqDft^w{Vx9T5t~Hp6S1$PMQj$ad&C~bAa8FT zu|>p$h%M!0*e!Am$&C{uwu;zV{h|)FjpB07wh=p-$F?)Ly}=y}?r3n3S|7*GhVNo< zSA!x-rqYz)p4RkU5qn#aQiKww(rG&n>=&_r#9=Zg;(&+)BMy!@#5fO%P->E|G|D9B zP?IBjrM7hbMxEZF9BDq3yChQ#$3z?(afu>ay&rLW#OV=dM4S+DV#LW2lOrZs-IEM% z+1u4ptjc?*7-dStspcQiHR(M~ZntqEHRP5vBhHGrAmYM^vyJ~eb$7%$3UX8UT)D9` zkyD15qD0-Bi%dy{#Kl%ce$cp9i?Bkqp4C*q2TD(!wa!@Fs7m!|y@H%HtSal6sQaEsNF=C>-|?9&3 zYU#Kua;b8Y1-UokK8?qSMM@rfqe5zj?DuV~ariFhI6#fX<9Ua?4c zN#m}!Q%@IV8KMmNYQ$?1uba-3mGG4sYO5Hl=haLkaH`6N)sC|9aOgF-_?-qr+iXpF|Y z2Ihh>3&kuFJ08u=G__FgFC4ouD|;EyMV^)Y+QMKTv5wk~%tkd;cfv0X-IcAlZHO$Oa zV^)h<-EgG~Y1kI1QF)7Av^Tmcs`}WNbz)wNc|B&`m~kF#Y$9*)L{KQ*|$+>>aaD?Cv;pY%xi#jtn4@BjjyXN%jF@9$j*U4f=H!^;VvdhF zA?8G>-P<`zZMDX@@*&XHmD&*Cc3MoEN(cAWxnjb3yD}dZEFK3|?&T5`&i-6vJhPeA93CRqRUh zv)WatToZF`%yltS74Y-95K>>O==zu&Vs47LS%~%8ji!K_R(Q8>i*7NswQ*O(+hgvC zc|7Kcm^)+cig_^Rp_sd4?$L;gxj&vQ`Cbi7y>v6w1?mH_ySXVN*sIdJ%2HK^SLsuwZ=q<)dWmBmwK^(w1WT@0^k)wk1xd>9ifwA8c8duvr$yGmCT zugcge>r@$6WxcBFUmfdK-Hbxg-q7yNQO*NWV0{y{f!s36ePqM05>%;F3C&Al)^YDh zS1YQb*b`%p;Zp6(x|%Av`SVbuTt3QUR9b^$|^h9X{$Z{q3m8|55xB~IHB`p%f0P%AA|c=+0T&u4IW_d zK!XPvJlNnN2Bm;rDmlE$5mlF(;+!L^993mf!bu578&9tqy=xp}498YE&WOj0r^-o+ zC_P80a-tCrGmB2HGP%mDRbH!dN|h;9?yPcGl~b#nR^^&1*H$^b%HmqIuX0J1GYmh| z;8_M&)V+Mwy^?=Um2(X_&!8yhSGk~rUs&a$4t{NKC-BlLSD1v$s$6c!mRe)f!#I7R z*G{j}@YM8P;bbpF2)|APs>;n(ZmDv;@!V+ehAKK#U1G&{lQlH6H@8-~%^2>eqE>D< z{MRw4l{T}4-(BUNDo<5;y2`y(?yK@xmB*{xU*!Sgf24}4OsgX1hpVishj&#TveRd@ zoNFyg+8qn%v5={%1c%x%5znoukwP4 zRdXxr$!`@MLR8v@FB|hKRW3E+>s8*U@?Dkhm8q({S>=-|pH_LR%G*^wP%mr9Ta|aK zyw{N|Y44l6q>pTo<{uf)#|CAi7<5R7&kX;f%9m9>@06;RO24Y|b(L>SrcS@@)cVMJ zP?R64{8;6mD*smbsmjk)eyj4kvHc={cKF-U+VGDme^vS0Wd3PguMmhv>YVvVh8^f!F28gr{k zjRAJLNsWOu_br9BYOGyjP|aOi=dCfg#t_4Gx@wL2YRq3_XpIGGEN2ym8N5t4>@^mw zu~3bLYb;W8Yc-1-T(st1&sof%h{`8Al~zmC+>1Y=ELCH;30bR?JBCZa;MfR9i-istXR#=S-r*@hOF7KPSwZOSf@r_ zqo}cNjd9joW^lb4LCsB6r1|>ejfZ#+fzFl7|(dO8Yg=sd2vXoNE-xk(19e zioTxxMd!=9@|B7%u5n3?88x1&aj62b#+^0ps&RRZD{912wm6RJi&=OO%iF} zRO4ag5Zxf?mn&BKn6>zX!N)ar`nmOg)tX-8$(q~6E&O_dK~;I#ke3wXR`(SqD z7~VBF-FQYC)I{!mg-}P%M>RgF@o9~Zjk9I+w>zbu)!4`IFKc{NnFpd-YXRbPP z*O{lzLUk6dGoa4EI`gYmok4ZxHMaTc3^rs)oz?reI}~L<1zy8`wWD?ys58tM7Br}t zu!x#rw�`)LFF7l697wF+iV;*gAojNPjS+UNTIxE##tIpa+U)kWAbyiXJI;+{~>UGvIL?d03f9arC z9hF^$w6lr^?AW^d5uuLD^s&`C|AG;I$j;W&W3e1G7krJ zazo_pN}aGyR41-et<&hxYju(iUaz|>DrOx*(hfZ{q@6m7I!!y3hNU4b)4$v5inwu| z@pZPYvrU~%>TGIs)!nQkZOb~F*V)2qiLSOLbnuCWY*lwDU81DJwub9;N2|VFo$WiV z@6cfr=T4ngcCE8pog?cURcH4)dx&1=a4X%j&i-`{uqO7Zvv-|+jILHBVc$CYSqS;7)Vm*Kw%T6Kt3=IOA85>i&;yQk|3P zJXYuNIw#keT<82c7t}eW&J;CQ=e#n zd$8S>*mQbfor~&RU+0F7su$O}q|T*vE~|4*ookJLdB?6R>RegpDr@d)gOa8ubhHIt zXPi^5Xmy-Xy4v1Y=cbMVH`lqP&OLSRt#hjhml}7}xvkFa9Uj$^z&q>QRp)LK^*@)Y z=)OAl*LkSU!*w38QZYYRXIe*ETP4A^y{htvu{~-~^e5^}uk&u5_pHj3b)Kv9yx}wI zJk^o&wDCVv=UFpKt*Gt`bzZD9(|BGohSvUO=r^-7We(|W*`~Sxe;{T}5$8~U>(~OA{#JpBblWeQpxI_&;*KGW_cf z<(oR+8vdPP$!50S+vyK=el+AKgFhRT4!_j-wS$ZQk2-(WnPrr}4F1ilbn zn5B<&lMoVmB=k&}BVnP0g%jpX=#?-}!hnR{34Id!CG<~t&8{G?_MvaWlJ>`8tqRVS zFupHyCvFGnB>U6o^?K}^FeqXEgrN!ZCJas(k}zLFV5=Wm``WX8!Lo_RW6J*t!_-h8 z7F46!Mr*rvrJF8-ug#jZNW!8CBbBrh7E4$>VR*vQ2}?+gguD8&RKf(?8vUb*JxmL6 zx>ZRSk+5vSa*5lozM-bFws`Wjy)*Kp?hUp6pD;RMrG%9eR!CSeVNAlFeYw_lu3n^X zChHU8CiC8Y9M+dr66Y~3j=gTg)f3W$EMX0!ubHq`;vBnnLOmf#7%Lt0{#U}f3F8vh zlLrzi#=L&Q1_@ni+P=*zv7Q{&7eC=-y>f1z(WO63h!Uz+B{nF|P5Zf-o9@wO_M?`# z_t4vu0c|vD$ehjvC{HL7_On{egfd~9gl+A#Wr}T;(4DYh!bS-jCv29mxs{Gj*u)SC zbj=xlqnW&gT%E9G!bGi>Sn0l<8Rq|G-rB0PV|Y7jYbT>@Z*T{LJ0@->pszQ`MLQ?# zVr;t_6lFIvl+;x=w+eg0wFVWMXo`|GoxiQ5VG&PexIQ*%xc?>Ds{NSJ0wbrgDNGQpNx zAG91IO&&4-Je}}N!lMa~B|L61JU!vbgeMdv){6AhlC|c0^23aTr<7rA0bdV3o=td8 z*(u@mgy$1pNO(En6(tIdaT%xuB8@Uz+&I_Zt5&2^t!!v{M93RPc{|}9LuMwt*{S}P zGNCQVXgx&I-c5Kh(uD%xql8ZqK27-8ELv$X7Zsl+e6G~mV9o|# zBz&3hlLliU|7nT|UrgUcN%%Kmmb7Z{UqV}QThw}b@@vGN4cDlSW$X~rt3mGu^EVjUpihIo z#xSTszXtsq%+p{%gSi^WneDHYO4Qs9r=b><1~zCf97$(+Nk#KE7;F-TG-fL>U#CU! zEYM(BgGCxFYQzN%E^KfiwWVjxwv;E$7wgno+}diddCI7z8VqmnVS|qvEZtz422&dh z(IvRy(ur^q^;FpZ9`UTuzG_v8ndsYYZ{w4bqP?5V~uD12J0BIuEB8))-yym1v^!CA&Xxxpz7&MYYkp+@J@qw8@$nAW@GmE!{2Q1R)e>VP4mX*>~*$tyx-shW0N!GNx_dBe4@0Ix`F&@gU=d}(j(<_CI1G$H~7Q&zf|7n5qo|)Zk}BelhrKr}VeR>{Z|GyZBRLt)agf zc7e7p$^X-E>+m}MRl+xXR)?a+%$_N8q|B2tAZ5;!UMc;}3KjKEosfPhebU(y`ljxA zr9>42-FLm_N|`&I9SJgAei)cC$f^%cnb#0K4rqU7bD5sRwo7V039%x%t{tnxQulV) z@RX%f7BqYzg9{r}(ISQ{nzEQ7iyK^`Q@UizQik7aZ>TMkG9qPk#tIqBrYx6ocgj5} zBU47D>?T`MmKQ@xBPC5)A!WssaVhJij7eE3WsQ_IQ&vt{C1ur=)zaD156wU{7128d ztEX-@vWV?5(+p~@l(kd$h<07c*Ph9djJ4BsQa9t054F&$QqA1fm!2t=lrW_$n=cvTN!z5rf2TWjn8g?2)pkd?J%m_Db11<*1aSQ}#*OH|3y|gH!gChf@wnIWV35 zEdKA2ZexRl>ruXhNL3w&$jK>(rEb%mc9gYWlsjA=wvawDka#qTvDVL?3opMgfg((+VLlUTp=cb%zr{||!U~X5VbD5Jh?(Q4O#a4QW!O5ZP zm&;SGNVzKIYGs?4D^oWQm*F!zohAI5)cHiy@@q9bb%zykeaa0fx1`*vPE5Het;|ZBlT2BuDO5fGH$2)+AiB=y?bq@wOzaKro5N(P0F_^@27l_@@dLv%3vuUrF?9mB{>>R z8pYc0@kweM-t3Xb=P6&Le3kOGMaW3)$&_NYGgBQQONFbhwmf~8@_ouLDZi%tkn&^d zc5nV{ChNJFtoTVCZM)Ww8|hNeZ&vh2%AYB}8!l<5+D;@T3S|bx-aje-rVPv&l<{B6 zEM@YHzL{&0j5#vq%;=HPGvk_-o#CP@4tp7c@ZOmll0p;`>VQ3hmgtVx-9GX`fYnz2~Mkc{~<7RVT;oNOD7=Fb>v(vY0$ z8X0S5te3IAS+rKh+8JZ5ElFD^b27)-sajb#bAh1&s3D`++aRMW!_NpZmsP~+8K<14 zw6D}r$q0?2AW_ay#jCYjgIcFNc%V_!u`#x5DVX6z>6_BxWRkhI;+ zmOV1|%v|qFCCS+k!j?Os7 z*bXyzRL0?I#c*kLWac)cDUs?*-PZY7D>@Iqk5>Ovq@ zPsx~)aY4p~8K-8PmT_jrS>}qGf(Nv=p)?@ zQZ=nZ9iiU5UfV%49>|!M@t`q?r#+md=R+2ILeyVkel+8;j3+Z@WIS%}dLm=G`CJ)E zTQub>wI$}KGM+YuXAJ6zn=VEg%PM--tbR@dP@D1k^J2zJ86RYPnDKJPD;YC0-pqJ4 z#2_vHWPF_Q zb;dUtpBU%o8DC_4YA*WBC|3@4D?(ppXdO)2DxXW*R~pNPe4FuI#`hUN$mg95FW>%{ z@l(dna{frS4Ok(n;h;#90>3C1Y0wSj_l!T35_6W!`7`4$W#*i@bNyxeItz z)S>I?JUIh$=Fb_LGcadR&XAn>a^}q$oVzLRrlZ_qqeMyaqIRVaA~lpZ7RVWvvvAHL zxyz8EFPOWISSWXj>E1!N6^oim^7dl68>ccsY>Ve^B~ZvxIm2_-%vmdE>6~S9R>@g4 zXGG4jIm_jYlu@IcG%-8R_ja{(aUW%3m(LlUvqH{_Ib+ml&dRxqXSE`Q<#4qqV~1&@ zyGd9rXZ4<gcLGN2Xr$RQ#-+Gd5>~oUWX8a@NgRFK7MSO+VUx9+$g!H>8PPpV9j= za-EFwa(t5(8r;qzB*>}Qsa&Dds_SVa51S^{oLWvjC&}46XP=x#?!JSuralCeljdYO zxg8=FRwP@5%ah0H{vxN9)19+n&PF-A<<7$!x7l(gf5N zk3MagGtr2<xIW{f4}s=vm%A@!X!^RnoUBWmZ(o5k{+)8(*JQ(R zeT(K2ef&XTVDhEv?z#H}#~wL*8pAvGDX_idUi;?ZzB&8J&$_WH*gxlhobw7dz7EVe zC}*yMxeE@?IV9(?oW~V`Ifvz3m~&Ci;fmp$NjWEJ|7XroIa=^MF6Zc+V+=pm;ICuc zda0H)b%^2koD*`l&9Y5DQPE;gVNTAOoO4FbnK`HAOtHGB8dSxBjoCXhPs=$ypS`nA zE6HaW!+AO98*+BeIfkgAa}~WN`GO8bE7hWFH|E7Tm*m`@b4SjlIhW;Jn{%DC%DE!v zO5>M$V%E`C`>LF)6@(`68VwEmQ_0kv>vL|+xlM7Nb7Srna&NKfqx6v|Gffh1mV8^T zQFR$B$y$SLub6rRTx?Zxm!&h(s5b3V&?GG~TDE9WhZ_nfD5UXj8%&*VIt^IXpJCZuh+guKv^ z`J%?1wfItp^0KLMt{yBJ<&B(~IjA)6_xI;q9Dvaz4uW*cjf;c~23Wy8uwB z4#mI+8augL-MUjN?L8d*6J!1#k3#74oG+A_bN*7!REo>_Ip>$0uXDaJY2W93Yl_KB zZOPx|ZXsQ`(XR0G))UP?e<@{kqQlnk#cO@?C=(ZJq=lqj1N5Py0|K|Lc z)1#ng!K@Cygj388<3BrFh1>nxtDtv5--3RH>z6*oY-Qx7wpN0o_cywNWS)Wn1>*}g zDHvEVs9;RNN(J*43@%utV9|mh1@jdwXjN2w{(_+e3ly{c+1|n`cMU6C7|5Rs8Rx=w z`jN(k3>T$f*@EQ?mMB=VV3~pu#Hr_Wa*sS2t zg2M_nFW91B&w{-QCKPO0uyesKCU9cGwguZ2Y}ILN>w;}MaiyHReZdaq=bZ|6G`jTp z%%17UC&I0JIS0~a8ALw#-n!I z3@R0JzFpBSD7diTqJoPH?k$iHFDbaR;KqWR3N9$1v3iXDtNo#se-2qUXiv1&lEgc@M7U6V9yn9M)!O%djcuS3+hu_=g~^YO9d~> zQTB7mm29g2n(@z6j?#9Hf;SA&3~hd!7QWdz)zs^qf_DpkDEP79y@K}(J}UUQ-~;1P zLmwKVS5u{cn)syP(}FJwzAXO#d*7cGd~R&ICD(h+Uln|j^vn096TutU~(xXYwCViUpZ8ArbIh*uq(!1%ZNVwjR8gH++x2L!g)vxJ1*59Cb zH0jmMR+M>~3}`Z>$$VBcu*tkl1{*%epqoycGJ20m{PQ;%+GJRh1)FYJa)GAvm2MLz z+k9JdUERem)O3?xQPj|)O%`i1s>$+A7H_gdlVzHWXtHFJrJ4+Hva}fV<7^Y&-u$56 zmkFBWFWY1}Yh`59O}6D6(WQfy8U#n1dP2rDS;6oX4Js1cU7oo@evl5UHd(Dn(WKdA z^(JdH37bSs)@-s?ll7XcZxz>WvQ9_l*rxNL?xfajGOp>K3$z`p=5%aeY=Ob9rc>Ut z_qlx48s@%wA)ZRp-DhddN_gC)Va(MgHACtK6N7izO{-paP3<%@m>c}cEG?U~nrz)< zn)k?4%wv&g~3tZ*T{LJ2u@1WEA|n*s1vUYO<^0yBXZQ$sSENgmrJ? z^<+;4YP(0Y{$mVUA=$6V{!Jd=j3+kZfF=hvSztWF#&b}UgPX7+JvQW!CWkh8v*fLk z!>pZT^QHMw0QsL3-;?r3snlLwnT z)a0%vcQ?7O$^A_R_2(Xq%^uvVv8?wNO}NBP>B;i_d7#NO)8u=-_F}C++~g7UolQ;I{ufcV*aqnM@>Fy@@bRLdhoF#b1_~YfXv)QA#H!K`b-Ausi=Lu z_RA(;HTh3TxXIT|zG?DXli!Mf3mC zE%Wx(6}e;)>0tPxhRD53lq^}YNy(-qOO*^SS+!)flBG+QDOt8;xsoqdWN?2D?!}1G z$y7t<>9?@G7+Er^!s~Fp=y;;3v zjgoar)-9noYs$dUtW`4BqIYepHMZm-{p3{9)t_-CUH!>Qaw}S|Wc`v2%>1qrza%K} zN|)>8kQe5qQWBP=rP~P{8NFsOHYm2LAu6pKl62^e(!K1~mZQ=_gW61AG0Q_>%W#&Dv4BNlP{_*{Njbk}XOmlx$bBeaUV8-74#rB@;`w zGC4b&v0ImHQ=)f%w=G%A-u&%7Kl-J6w2J!x^$sOF8ncpsB3TXXQnG8wUL|{%>{haS z$sQ$pmMHL)kQD}N>O}(^YvSKcPbGS?*AN$+`;=~gNb~(l_Afc0yln0ZIW4UMZjvcVWpzC6_8xBxDR*_2S}^ORU|K z^r>p|j|{n71ED96*rnl$k}FGh<S*(iJRtwvZn%P6c0DtgyA*8Fq~ty+*~=+#Psy5VIlpP- zDp}oM@_>zERS`wuBsmY2JY4cz$@3+TsH00BD|uYe)r&bt^G8pf8^secc5R*(!+de27bWFB{uL>khf) zH8nSfd%5X#i^f0o2-p~Ami(bysxK#K{io!ek|(>F(apOW4)RhrH+S=X$pb!77H5Qman>tv>0KOMGY=yaB+i67+lie zQZ0tJSlaMq3`(r3>$r1HmNm+921gnceN>y+gP+X9E4CQZB5jei_(bo;NaxWsTCCi1 zow!PiRa>mqa)Ww}7HhUx-MU8CeNonGxoeqkrE41;YjB+w>$VtY_<9D#tOyre-%d9$ z*ww-_MD405Xt}lYN{2se5t;nhpc<+gQfpD~P!dCW+T7`J-EGZ5-lAyHZ1JrP*dd*- z;3}57TWr|ks&20CW}_Axx45F4E4z872jg3uHik`F?zy3?-n8YeAe*(=+>G6#<*sqc z-V+Sjvc<#}Tea9)f!EC<-E7lh+ZNBXc(%oMEw*oQL5mAp?9gJz7Du-@M$T-pbBhC7 z9N1!)7Q43CtHs_ecC#k-XdzX1H~bSD3yS|e?NoFf`?TD;?tU%yHAEDh>e$~-pHhmD z6IvYF;;{RsATb$8yiRD~lJF~@$%2X}RGDHkI)p3rUitW6X zdnNyTgRYjI|F*ce#qBNbXmLr4OIu8BalLxH#pNxok%#rzSK8XkFIQQ`D-DWrb&Kze zE~w*LJH5`JYTeM{M&&Vm;Y}T_fu^1Rc6zhnVh}}#HmQo|HY+++e|~InSBr;RJksLs z7WcHcuf_e=qB={*z1CkBYq_lDZYSr``(H9ap8zr_%0tSZMi+dv#bYg=Xfa(`w8rBa z$TqiBi(mKQ$rdwOJY`K!=*yn=0?~=~+mWYR?#u0Bd#=UvvZ%%PEnbitTfE)kofa=y zEiue&@p6k-TD+>T?8oa0cwGgoR52!o^K}Vmxp##`f79r1wcLfw3AdMA-fi)L=vMSz zi}%exDm}LcA4%;NU$yvJd85UrR`f-S&rHJSb}AoAn%Zjn^GhS@NvMw3^a;2YpAX?% z6RuN<{h`H=%E{f#(aldSes1xvmHyJ=*A{=8dw*+jkTL&Z(fGSTQTq1b7G1(x{M~ZM zbUXf$d#!8!YcZ<@-R@7RJ-Xe`Qne>@kj)bR)1TkF>DA5L-OSVNdc1eH3&noj^y#Lr zaNBz<6GT)m_wQz|Zhkjha6mT$yBXZgkZuNbGjBJK*-PRos@kE``MR0En+3WV*3D4m z9Bt0mY}44<$b#K`pviwXA_~zVr!CseV%==t%?{lx-pvx-)Vis6vt&0*bu+FT@eJ=~ z>26l;W|eN1>2{-jxo$>wGs5s?4T?>49izHgp_>)ES-zXmRwRpb9A8a;{(p46 z3HVmS`v!iuYSX@=XwklFp|qihDAl{2bKZS_qlgqm`@W)8d!kZNw1^fWWJ^Lqw(M)! zDf-`YpU?62`(OY6b-mYp-Sf;d&&)jY%$#k`dC}8nPPBUa(8q^fK3pM%D}`72%sp*d zK2gbV{`yKtNk1R1r>}gle7Hd!Veba|&|iFj(BV^HpLtiES%Z8S zETPY5u7CnQ_(hn-B!59Auj0zjB3#eag|H719}=pRSzWmP`w;UX&S>H00iJzHNRpHe zld0B7`@omf*xHPQyILYo|M)Q9hXpa;x!%!dY@?o?O!+f~KhueJ^;lr&A zBwk1RaLAjjOx`9TB~5u0@L?1q*@uxn^Cx1I5czASA79%aDR!)keWu@6gpSn0zmA0F^wsShiB z_=oTR@`O{H`rg&>Ete@uzSUn~{H?cRXsSQY_T_C7PTMPV7QtH|JRx7_!+IY!`LJ0b z*RvQlaDo)aBa9sPolPHj)x#)dur+FLZq!sLjV(TG^!n)iaM!&Et9V)!?H2A4?iFsUhG%`)@5A#x9N=2P ziBJyJTADLEBR5`kE$V53!w^$AA|fD?8p9=sOCo_KQ8v0HK97K@fMJlV2!ukstL%8hG-CtV=hG7}AaXXyG^CVQ8X0G8&uu(M-I#-^4#Jb%`zg zXyrF?(%O&C%oT6rM_WJI`O)5wOZ=GB!pxBlesuJslN9E)FhzD(Gsqur%wFb47n!}z zuLFS}J^kqA$9>gsxgXtBs=FUO*eVrahsf~?;3b}W!8po~J0+wkHfD?;cPlwfc#j|76~`n$#`-Z%lJR~_^yAr* zrs@fj@S@u-OPuV-6hEd)?lzBIo9@Rf-87@AS$@n`?m|E2_%YXydpX>63!7BJ*qNtX zmLjL+`~8?N$>I`NAW~Bc`yyB9#}bhT{8+9)VyUH)EOQlPXNCC45?Cd&TDV5|ppd23 z`tgwX!@_l*e7(p9`GIPi{MgKi6GYh{9`)lf&ei}12e8GDt$v&vK*aza_u~maKJeqX zAKSPr`0=VAulcdVkDY!z=g0GmE17-DkEca;QBA?HTQR)Pk7xYYlERD)-pA0=V3EHf7tL3a{-oq}=^ypukRNY|9~Qpl$D1P5 zIpQx074oAISMLBy2Jn|3r=@e&bJ`gt{}$51KO&4?1WfJ4gvEtSQeH~DbO7gwxbwP9 z0A&M3uA@#lPrrP?Ttrj|fX7^tN&!?3pkn}?0;m!|)d1=T&>(b%-ysogG@Iv85LRY7uINRSmfJPp_Sfp_PO+=asn|Zl(ev1HF z2GGirv=wO`KpRiO7PbqZeE^q8!VY!_nEP^Eds!DPbPnLs04@)pn-ne!psPq1A=hO3 z$_>u$l3XL~5kSuXdWrWI(%KaPTp7Ss0kcLi>Duq3+^dCd9QGww^11-758#FX`YB0$ z&Ld*~0B-ao14OtSQ9e+d#(e?!1K7%`9Y7#}U;tACm=-`N04soe0EGZ-DLVm#Md;*+ zNJ>a+(Ews{1$jJxgycz~yPT#y&5TG^%DDh~>qhsG0B#E4_5el%aI>d*O8`T~hY8); zaccm>mAp;p8fVrW0gRMnVgRE8xHEupO0qq71u!~*F-p45ygPt<0vP)r-*RMK`_vyV z%?V!aB+t&|0H$zIG|*I=9>9zMRw;L80JB6M5Y7%@ZUFNFn4_c{*er5y0P_P_5Wszs z-!G(`ty&l;YQSO%7X{2+M`rQ2#B=P@0G26txzKI!iU3x6c6h^lbpUGucrbvq0c=!j zA5!jm;lsjpo<1#X5N7~CBEsO@q*9xOj|v|XZV^(GCmT-$uq}Z11NcCtwg>P+051lx zBY>R&JQ=_)$@dAL3Sf`O)56_C_KR-WEA9@;GXXrS2#{#F3*io6}bJ0eGg^vu7bb}WGRBy81HW)v3|3z{{JMM@}1GD~Jl1yMSPbAm-H80GF#RxXIvL9_{?d=M3a zI5&ujLDZv>ASwk>Sw?CHQN^=XJ&39vuNH)RDn)BGB&-=kEfGGOrjWlnN}eY?KZpxN z>IzrO6&D3jKZvH1P`^PCjXmB_q>=Dqq3gXSLAYh9-%Rr6L9`HQDQqQlm(aFBvg_>l(!6l5`Vx7rKjB zuOO}n;`$(NknqYNt`6dwAg)r9mV1lz37W@MO!igsIxqKH5spYd5qDVoiw_RM7sP-d zZdB4OJ}`(uN-}1+rqQ53h=3&S=m&!cDQO9LUhUcpvjIVjl`tAaEQs5JxIKt?5Q!je z3gYG%dVqp-A#P1Jceh>@986oam zSRBNXAXZ5DfRF~4i!2RdnTR_UTt=9+GKf_YuKrKf8m}b}1@UkYTZ4E!h;>1%=efPq zSa3rSo5ddqV&i|xZt{HM+JDT`-y*_^`9u)gg4nI(_8@kM>~x zY0guvEqj!t&R&syUTgOU@mvsJ1@Uzd&j)cJh!27|9>fblycooxAl{JvOF_KiSvVNP z%N}QJzZ%4AO1>`SG0`2V!$G_$$*~}g1o4*mQQ_M`yd%Q)P}$XgR}xMQcIQ1W_k9s6 zd>F(>L45AXKNk5kh);rMHn~?NC%oLxMA-2!M7|Wd>(4jhKL_y(JwUgs`1cZ?4B`h7 zw(3U_w_&G(_(@6E&%XxoTM+*QaW;tGJ^j-`{1L>TLHy-Oc<^#Pf5wyi?fD!b6bqqL z2&F?P9x7UOONel_EGfe2&t{w>UQSphgtDRkb5Nr~`B0JflDvr&0!P5Y7u>k%h$;&JW>&5N-`&cnEbvs24)d z5PF4hVF(w6&@hBXAw-L#eh3Xhc(0|o_0)q4rfgmuLgNs6gv?GS4o#DgxkJS^G^KJ~ zbG6beWUzS%Eks%hDQOi#>k!(6&{mR5J$XBk_90v%(!rB=455?9JB#rC8|_>s-bL6| zczFojM3~z>1Xr0|=FMB)IJzQ)VIkZS!j&Oh6+-V2`tWWH+aJQ!AzTx}jUfySp)W@v zgaPV~!)Mbi&BNL2l8B3(gm6;`g^;=H_+@j%Tbg^w?840qs>?7`tzs<<2Hw=-O+2=Z zH>TF;UhZun+|J0cP}9PQ5bg+>zMlwTWC)`|SQoNasox&$Q z`7XMsxak+Wznj8x_%wt)^5<%<{~_!PncJ1mgzzkD=Wy_GNeHiqJSTiUgaaZkgz#br zFNrtiJv#jkhVZ4xt0BC`=^w)TA-pb~w}ppE@TSO-5Z)5uLgCuU^5(xJM}_YS zj|r*3>OK(vSa@9cq3|Oib=u3+CyW6}mhy%GA6bU*c?e&yks+K6;Zz7;h43}kNyfPs zRCN9~np`Cm7@UmXhwy_td9|79N3H{!2tS4Ja|k6Yl(g_m2)~AKI)pPJ{1(FRA^Z`- zpPYuJaNtt&poB5ZX~jtUOH+X3PX2cY|8T*#P~1ZOdN|A2Xvr5)&8=g$mh-4MZwgfc zmlSd~tdxb)7Ajh(WZ@hOWh_*%aIS^2mWdgz6})ZE30}@J_p!@cX3=0l&fI#XO)eW# z*+Lb|G=nzTwW=1XS*UKAHH5plh>cV=Ni7StE%diAz%n=Lxn!|a9Si625Mbc~3w14Y zws5J1dKNCU(8@w<3m35?tldIO%iL*XfHknt&_W~2Oe-31Y~fQmssdvnHc6ayml7aTV^acTN$*R&K)gtgSQh~ zr3Uly%6_fnms#jy;VLRy=xX6|3*9aBkbk;a<{X~)Y}rTZ_q5Q&C6dCcO2k3JTzw$P95v~Z1uzLt3$Hll^`Dxbh!tJ<%#%sk>&Pa=DFgJt&jl5;pF z@v*OkffoE00u}~Y7;M4EfoN&g{5l$iq0$`1%`>GCv@ng0X@!twZsl1PYzvNR$yvyY zgoP1d)Iv-oE@aCSB1sD=Pm;Ef5zl&(NtICW_&pYeh~MN%ZWbA8VVH$m#BUYeVPUw1 z+r)3@`fuS#E8~1_zRi_3579Z^pSg=>Tl%Gz2B4_SCv5}pLQ*LUl!qMegLjXV3e$--tDwD63Dqoweug}oMD zXlc&P9<#7Tm2#496?t6vgoSM)+l4!X)Y-}PM0}Sgc}nDI;cnp`t_eERSfl5j&swNa z8b7o)`%XD$>D%Wm9I&v##v?Xfu<)XV8*KEq%|w35!ao+yS~zIoWecxZc-6vp7QVOe znuXUbd~D$p3x_PcVc|Hdv&?hM!<=G#{;OHWN{?v1yd@WL6yCP*j>nIRyem9r;XRS} zg&zp1&%OOz>v-Dvk!7~aawbk{jZZC{u<(_IuPw8~`7_P;FIDg77QV2|zFZDjy<%ol z%Afr3f`xCn8gSEZakCmw$W2W&{)2@dE&OWXHwz~%oU-tfg`c^~wJ^KZxt;h(3uA}N z2)DKW!UaKJOa9%$9~SdETtk2vFbViHV>h}2CGFyUK3s;6QoH#a$ z*{ErwmW|>zO4ulGqk@f+HcHtjZQ~r<*r5ZtT(FyEY?QT8&c@%x%u2}cpsA{wN37^v z8x?I-vQgPKlZ(yZo@5qh*|U{U#YR=zyum>`RIX;5Gn4AV8p5_ZcdBjUd>a?osAHRM zvbE>gINaIrx;EIKEWdrwG72l0-= zPC{4nGVyLgs&%o^)#I15(sIUHcN;xy^mI#kxxKvHD_yzj?PKF=8`s$AYnx-o{F3G^ z8%Euva^|${S{v8d=6Fhn_p`PB+h)twa(*_UEC$%P(Z(Vhi){?FF~~;FM&33V z*cfT!Hij#=fC@=Q*l_nk5UEcbr7Uu;)pyw#%|U0t3s2WFe5{ReHm2K{VPm|F2{tC$ zn8fI9X`IYmI()TZvW+P=rZH~y8rM|YY_#J+)67#{v(V==ZOpPU-^KzPvu(`blEnu- zrOZB0_Js|YYh#{`dl|9CaG#C)ZF4Tcf{f>qI^vTrw9V^6JbS65*|EgN12!JA@vx1h zwmJRa?icqIWtolTningCD}^+*N@TT-HJ;=_k+n9s&4UV|mRM(FJ)^D*{F?r}QlNaJ zjZG9f=;>gyjYn<#Y~vRjk1;m7n3=o9Hs=XEf!u22aT`zA*v2*4#)~$#+t^{_IZiZA z`EuB4n>o1O#*>P}U5qsD{}Dbd+%4QA+$-ECq}nqg&)Vo$#+2d!@%-?BmXYo~F|L}K z%apuiJa~xD~aIRzC zjIOWUs%0FMmDzH_@!6;43mtPii*HRHtZX)k@$8PLLv5;|zGDuf z4IDId(8w_{-^M{(k&A_mg-wJ_h0Po^7il4EDP+M`4qA(USJBvMCw{rGz3>tT9h{;A zdPhk*2|Eif6|&%EB3&GG72#osLjJlr=q?Etgzm-A%fS^6hB_GL;7WSTf$hL?(Az;D z2ZJ08c5tFU;Kgcqw4%x7vP0oS2a_Dkcd)?0 zWCv3m%yuxx!Bhv+9L#hu%fWPYlgs-I`auJFOvAxTZ+5>=8?#o=buiDty$-AHt{;#!C(kIylOC%{xU7 zUeOZqrtnqa8xCG`@VcV?kR%gpnT3?WPbVC9%s*C;A93)Oa^I#AJq3G*fy5c1qxQQF zjwwXnlg=Lw-WU16!Ep|g;^adIA2Bd$n-8^ptlUpr7GY=ql$ZW;aGJ|VZJcq; zH}PtQ@wasTad6fF!seJ#A&hfHiV2GgON3EUgbJm?C@p@Du#B**ms>83^5W(jW%6^y zuxUV*Fe-_VR}L5bS4h<`s)fxER1c$ua`~aN6t`aR8+}~-Wrtp!)e`50alRDVhH-&s zr*7DMDV>`2JjsP37YXZ!(Lki3u#xa$VPjzvVN+o>%tYWKc1;Qy87YCW^=}4V$HG36J1mTpq@WA^2Dk}wg5rC}P$ z9X?^$(szVmj*$pW@y9;WU@VMy*h~%nmbF7tMpDAGFeA(g=^1v7t;#D|5Dp2OGlZMM z=9L`wYgpL)y~q<`YzyO-Fm4TFco?^Zaeo-|!?-6IQ31ey)(>UU7 zFkPm;>4q8d@XRn~sTs4wnCr%{koEHTJ5T&x;eEnu^}WXh;i3;_J}j~@j71`gg-e8+ z_)?O{QsJ^NmV5FQVXPEisI zV{;gfhVdA^%@h7Gwy2wpnwvIZ+C_9 zl=#zO^ZwUv)kUA|(V*;=E7EoFY#95)I26Vk3Lyq0?K~I8^I;qa;{`?at6{trHXnz1 zQDgB^7zY{iwN1>t9L6hZ6{}$Iye@?qHO-f+`QcCoFq?fiZ2naA9hwT`h+>RU@s>2H z@V1&)c7SmLqwZK3?}c$Pf>RN^&-QDMzZt=Cky|4e9>IrUd=$pVl3W!*?+88#<5MM1 z2x~;}Ss0&(@kJP4hEXi)k6>##jB9J0L(6RM4bAc7mEnT}wfNX)Y^D1yP_K2PG0 zARrzThJ=>T7SgMZNH~J!{ESQlQ6(>yKjWTGLL?bMO2lmv%Vw0!(kBt*#S0PK5;;qvV4Ttczg1 z_*&sZ5j^Z^x+gQl4H0u=hqXTv!Nv$SMX))7Me{%Hg!xblmCCH!3Yg^-rN)Ph68-`5d*6T!C;d>6s@5&RIr zkDOC{m{khTUWy1mOrd|ar6$*?pCb5~%T5%RMe$1nzjCRJqD~aQMeuus|HFY|QT!3X zpAr1ytv|d-{40Xf5p%nk%MpKPl=ZjPF68_g6PEW%RS-Ehii)13QWTXvUL}gE;?+D!b&(oT)bu2^M0khiyeQ6(;u0k< zh@x&3^`mH@WW6XZjN+oGxe>%B@yDC1?ysQ~+6x;|tr#wjnhWQ~l2Ee=OL@GRNONHe zVaq65dAY4c+CYPgR+lKcM&XOXAI0TSbc>=NbEVKd zimRizCW;!CDmiuw1K2Z}G6!w+yI`!^aah7uR>5v9D3-G9MHKlc3Q-K9bK(fZaZ?mGM`6d{#4t39VNo29 z;=?FziQ-nZaC;QPqqr@K=~2v(Uf5lY?>E!uuIGKx`Aa}d8%at{4nB7AOg zcNF)CPmW@&$T;D@yB5bsF+q}vLYAE*!VP;AsM);wka9^L_AIOuaV>8UA6Wt$z1&Sv zv(ui%ACqK@0-i~3uGkvI<6f^Rc|r=?R11?kqSzV5lTqx7;?*c#i{dE`cNEV@aUhD_ zQr;WIz9{yHvx5xUXT?k}%{bA#_3=>@ zA9Hnzp+gLxMDZzC#Td%Qa6&pKqc|1CXHk3}#TRZVb}fo8qxdR{uQ`IM^c!~y^IJoD zg7CdG*>#EQaDSvl)__ZjlnoV&s&HnftM&l|0AOA6WwBVkjTO1u@i(p+XGj zDywD;6+N9wB6Mu!7^=ij)st6`p_(`sD^|x}4KGn=p>sr3OmQpGlpIc)cULC_Vba)I`#n79kbnxXU^ieJ=rK!H;G4zjNKn&N#&@YA?VnwSTgZBEEnORhG zCo)Hh&T(I0ad#09l&L|&!7=zmsP7jE2!q0q&=T_ff^ZCx7=DZ4cS)i#+#ADvF~nks z$B^I{#c*2;x5toTEJ^2<7&0+rW4KvK){=`MFV5yMt|%!eIV6UgMBJ!gn}^0Q%qzuS z+{%F~hT)!sQ86NhJ7Sm|!;~0C#xN>|yJNT~W>#j7-JLPqCFRjEj8R$FA+8S@P9$SJ zYvV-5$1p);qHvPXT~4Qp&xm2B$g~)yi@5vtXT>l(_P@C{M_Ft$dpB2nUd(*cjLG|B zm>x7R8*T>Axt_|WexVj`Z#;_@d&62oFs9P7a9+Qvh5VR=?ArS=d=SHNB|nMb(-=PV^goK>V~?}r?x3^m z2?;;*qT)*>zmMUE7`_t!TKJ9dTj6&?mSw2?7{kdJev#yqkc$9a^pi&aXGz?buznSH z-#aj6V<-_v$vFO$oRYs{IPLK>B7Y12iQ%jW;>LT$gvEudi;_}tl#ZiS9IfLxCyp|4 z)QzKF9A)Du7f0ndsz|xKu%fU+9OsI-OHCzlnqso5c=b4H#8J(YyOCTojyjUm64v%| z+28X#e!j>BLN~xJjH6K;7fW(c9Q8fT1|kjPMQ3P@<7g5`O9`6_IrrJ5X5!6x@~Oya z;VNhZ&B`A~+c>U|Fu5ny0olD~ABtjz{L^=xDm(FoqDt?);i;%rwRB-X> z7Dx9uddJa6@*Z(Bk$c6_GhVb3GI@ovX!%Ok&QHK8=??VO?`C9r80llDcMiR z8vBdfC}i#ckwqmiFpfduoY8|t7~VcFHyB5VUQOWQ1gto0$={B{i6bojDBB!IG>$28 zOpPNJM?8+(;$RD@^KWTnTjJLk`}TSHiL1MjUyK~M=1BaYlw1hj$bGC&k=Fl5y$vACd4sP@-bfSs5tHvze_mUle>%X-ErLGNydtd z6S~njF^F{igYXaLaEsp7NtcYV}95dpW8OQuM7D#PY9QVd?UmUaJn8WsX z=UsE-nCID{h5J43PBC|67fQG+jzw`Sju#!u+219SKM==KuM|UfxyRje$W=-{Oqa&7 zCXNS{qyt%eEu)c}|GkMokFASieHM16SmJ+i zTQXr*r&7vtuNF&-v$bUsD4Q@Rq3#uN(of{gl0Vjc$3A9S!>IAMypmhRm61X&h%MxgtKszaS64D{eS}v^?JDu! z!as_e?r;jb=gfT*=%2sX&4hbbNFo8h{3{Jq8 zKtOW8&^;!)Ga{HU=ZCHZOS!C$! zA6+|aJR3vIDmRxvUW66#Ebb=pn-dr+!n%efa7zNWCNNwQdY+DA-)~Ep<&ic=NPfGJ zvx%1J*ii}GnZP{>j7{J!WsOc?jG~bisN=f&ZZAA287H*~35*w^gszyFz$7JE(d0yt z&uM>Z0@D(huB`h!{TT_&6rUxW?aAke%oWZP-YeuJyh2l?kj$V08j}64;x-ngkw9U~2-8C$LsJk0h`$frk=!Sjlz5^_*fA z%<*?a!nlz(>Ag(}Y))W{6exK#fycb~q%svaMnuNa6A5ff;3;Wt7e48g+99&jGfO+W z5=F<6rxV!i@&Cm`0xu@;QUcGggX-h{1fEaeKmyNsHaSxmdu;6so`hj=FoBm7IF!H} z3B012!n$7d>U~X`9O%~-D$H_+{;=e<#&JB7z*`BtoxnQ@e3ii02^>}K@dQ3h;9ak- zV+p(`KfEu=2g1Q}+D8d|%v~G_d@3Ph#$B3DDEYbYGoicke< zuCSi)Lg7Wi`a+g%kVHfAM#76ddH*t|<4uxiDoHb8b72clr=>_MVQXQVB-)C!6ViTr zkxP>3AktCT$;;*4b^7Wu`miSY$aP(WU6Z(+9_B;jB)Ut&+gUx5=qcVSiK|4eNa9M7 zkRB}Zxexb?_D&k)!=S5^xF%_~7qTPw6f?Uru1lg{64g_vk;3&!+>kU6yap!GKM6iC zy^#gAg?K>H?76y7Po4PTbhdC%5`&ZQCE-sZki^;~9!esZM2MPdfR%(Tl1idI|NK3P zxRT){B1uHm-!uI0`0B=5%xiNZiDVM(F2&wjI90rIIWYE*Gv4t`x2kQgd|@Ys4QE zy1jTfiFHYQki_vM)+ez+S-X>XBx%-}9ZBp=Vq+4UlGvQYqe(m=htt|)No-BxamG>^ zY@u%zKMX3fnXm@-oP%viY-cc(Fi-F~tc=emljfm3e@`c|OBInn#h6q_++f&~#9oG_ z%(9kOlXxbHXQjM9iI@h!(h=Z%7?{Sl?KF zFNycL0`La7wjZ#f50m&PiSLv6A&HM^O*89jnf)}0&yx6D{DhF6`9g%IzDnZDq?xni zY5id_1M(ZqBYN*!k?*9;+J8*qWD;kSKnkal_$i6Ml*QsdC-G|%za{aDBy2F}+V4sH zkpw@d|0m-|-)H9F(%~O=Gn<-DCvhf;zv=l}_{VDx-N+%^r$5^&mO}9qN~Fx-vUw#_ z21}=KP70;O*%2z2Nug{Cc_ef z3&k%I))zJqHWW4zUMy@ZY$9}**5)a+Na6Any0IgYcM!G`widP#wiUJ$wijL^q%-NI zj^dq!o!KOA{uEv&Nf%*PA?sysckzM39x3!pp;ro5q%c5|D^s|NqmaVYDf|I5Lwl#p z`A=`&*@Ge1q|lE`eF}Xg=jwMY{mcV_lB=tkKhR;4zZ)d!pE7?R!*<>%`~0{!`5^JZ zLSG906arFqHCangrARF4*eN(EgvHY-WKxKTM};wAJcVTykq{<1?tJ(wIfbk-D}IYG zmqI>;LJFJ(LnRrK!c8gMoH7%TLB%bC{I`1I98Qyz0=NclmF93Evu;b7{mdjZJ|cxX zQW&YMQ7McOxl?$TkUFD9IE(KVxyO@__2d&oW_a?6DNGWdESw^oDx4;qE~G!{@R=#h zN?~>ib5dAEPo^+exvY0l3iDF9SIM1x1uTX8Q#g46=BKbw!UZg%KM?0q$+^Q8E>2;I zvL2u_Q$%Trj9!pfA{+}O3d@fd@Ii}RWk9!%jesjW@np%gZx@Q9KRr?4)C z_2TY>Ef(iLwegf-V+xy6*qp+n9FaQaBz9t54C-zsvOB3q*TfbT+$wCSecIbn*v_C$ znR*c;R7Y#5WXusEPOMCBPqORkxGL2LkE7Mq&Mq0{a(zrW~4Bg11KpMF; z@@W*(xJ9``gskPpnz+g1H>WXFe3+2cQQ=nc;c48K#_eg0NaLGfi?6M;#}L^`Ngy7Xend=K8_k61g9}y zwJb<+nmM{B^k+XgfB~Dc^WJJuaL(A+Tr1KbsB5Zcp;4!(|9nAwP`$? z#{M)Ol0NI*m&U_stmBBYqB^F*o732!T=GXmHm0%3lh9F*rtz4PThiDivQ_xF@QF0G zrLmohe;PZv?5E8&0zHr@X70OgFKOP#bT@TBCH<#`yM=qw*vn9Ywo%;f*;YT~stUQgrAG>)WkD2+GR zwqj;MI4ot>=#CMW5t6skcw2J!{N$Z9j;8T$8pqQ3L2}mhUK*cy{C$xRgvZnP(35{8 z@-b25Q%`<^rW6~WOY(*AOW{|-uZ67T8LSl`^QRB$v?2B2|QDto8N{^{Yw3 zL7}i_2CXt^oiPJcD}&k@)KTtv8Kd7cW7>9p1{X+JH-mZ^T$sT{8C)z02ef_$4Kiq$ zG1h3DrMTXbG|HIkR$eMLmL?}-6W#uz0&|;5*j(5mgO(zzbv@N4gSHur%V4~O?K0?? zL8lDbXK+cz98)@Q>8osvbF$DyooP0MJ{eq{!DShAQK{bYVOQzX?Bx=66Y|Whdj>r+ z=$S#U46exF$_%bjYyUlXaY^K5Dci|TxoaR#HLp?ez8MVeZYB|Pug&1P4EkkoeFisV zFeHPUGU%VdfDD`r!WrC{G3TfO6&#qspo}?2bGq?2IAhijUk3h+S?kD&^k*=Gkn}B~ zE#x}JB`zY)dQ&1%8W)LYkPva3nq*59!|4n%l4mo>Wsn!YUaw)&T0uz?dh+HBhGsA- zgF7=AmccC<+(CzAaBBv`Gq^p25mM%odz%Pb>y9I%&W&5PiZSfE<*p3Y_QDuxju!G& ztWW#kZVpEVV>LAH6&z1=X=*|S6Ej$r!Ez~2%3xXs(=(Wy!4!=kjZak;S1r1Z$r%|e zkz}TDRtB>(n3KWW4DQchzJ&8KxHp6QGNuSag=>*J(Kt00WUw%UMHwunXG)nDBm=0q@&J3RP_%4yBGI&~Kw{VY_yElV<;?D@574G+PpUdER@dKXZ1(6qlgBiT6CcQTV zuVnCQ233Zj>JZcS*E0CEV94uII3#59jSLQF@MZ=_GI)zqxPT4?yq&>289bH4(>WZ? z;9Ytti}hI?%iuju$t@M{s?KueY~4*|dPZ0YL*fyDP;Rgd-8L#D3e9mY*DNJZCiyb&ds8t)V?i_N?BCS;=C-*&!S2eRVA;L zMKzHcp0(<-L;cQt|I4#kTe)>S9agcL|Nof9g;{feVB6|uQBS!n$RvL&OQ3!h4YFvM zMWZa*WYIQ@i>1?C*f?ACz`co*O@+<88e1qyJ1s?8Wzky1wcjp__E}t>MYk+2@$7WY zqC?i)hi9pdQtp&3+PQIQ)?ANVmPMB=x_XxB`G0-IzjfwtbXQgnVb3gjd74zaDvRD( zJe)OA(T6o=F*1u$SzMDv-z-w}1C_J5E{mv2^~>Tf{*6NxK~|l`4O#ThVn7xHvl!&H zitW77>o57>EPUCb&knOjzgIiE9P+p$VhL@}PT0$hNHRelh-DF%JRwYaI<%b0BAdl< zNpiv=!n~(b@GRey#m!j^_2jo^F)WK)lw_;iA6rgO&MJ=EI6e6Zpe#ms`ge%1#yhjP zD~sh>tjJ=tgwwN_k;RxS?#|+#EXHOrSz|OVi}6yJn8gGUclxjvRyRo!mru!Js^`6F zlCvUa&CFs}7WZc{U&7g0%u`fw;O1m8H*21xQ;o{^W{Y-x-{4bwUQR$&{gjeVXR$krJ!(Hci{$!bUlz|O_gUe7A$$EC<6k;# z{0mvUn8i_Ly_ChlERKl3oW(0y9LnMiC11_rH4$27guL!?TBxoi@vtX(Q-rlJe%{LB zZ6)9Fa;g6=4*^-TT)!vbhdc_1e2~R)F9uw%e)OMGpNgN%;#3wVviMBN&xK!S@rA;b zZTnJ^uY_#FH*^SXD#_d*M85ZGq2xzT^QSC+&f;tq$l;ePe$C=EV^1FbEsH;-_PdbX zXTd+kN&fPzosr~kCI1m;1E^3ehvGS$lS7%DNtVc=q=*}Gl$6S$v?Szik+L~dkffZj zywJ^}&bc|Wu((sHQVx}sTP268IaCv`oOb+MeaDEPh zau}S$1v%8sp-T>3bEucYg)-7Hhl_HkpF@irT1wI&hl_J)oI^t;*^)-NqBXfm&dk21 zIW$w-nAKc5|85haguhlfw9BD=4y|)&BL%k?ZN)#+G4zt$|8_}r$o+3s@03Glsa-0( zOcl9ta(NEja_E!8)j4$cnsikTJ#y$Nf>n$@&~Nb9b5i_N4nO7avnT&Wgr(dN`aOp~xF+Xu zZXSOs>z^FXiu{$sX|L27k-vp*3z0|3JWAzFBoq@C7naBut!$;0WNx`U&JiyoEbGZ# zJLQ#R3{=dcQXaMQs3S?`JgR$|RYa=hQBA}xNXs?ys3}P;Pm@{aiPvM0ftCR4Uvz95rsS={TZFDXy)0@VIjKq9V~ zki!2K1dhT`l^x~@Z&A`6o!bhyy?{{#+*!bg0`4eaq;mgVZAe%V@vZ_!tClf^qAN`| z%e6CBrP!mHBI61eU%-R{CKfQMfax0a$;z5iz*Nsm)TckENzSMspW)eYhiO&;vkRD0 zz}y1n6>vYRmcqS^6Rk_Ma39;OP+w3e`k=&;0v3997Ktn_6z!aUKuK4Bc>ya5c(Z^b z1*|M!RRPZ_cXa`43fRgex_}1@SgT%dR@OrWtSex>_`~uiyT74;M+(?jz$VYbuJ@Ql z;`)c}e6)ba3fQ8uZWe`46tJy;y_&Gw3)oS>Qw2O-z|I1mEMS+EIXmbaDwDWw*)91V zp(}A`(7pnmk*Q}3*sokpb1nt$BJg|x2MTzhfESf@sDPIWI9R~zO49zzBCq~GR9yws zRYlv~bVws94blxtNH>BsNQZ>Nz2|o4OG+xzQU)rbU31_&sq$oucv zm-&|eT4(LG=b2}o={R%doFjbS*3pM@=1Pn@EOy5A$sBwtc`o+PxcNT^KT7h&92}g3 zZ|2~r%I(k`d?h)&PdKFfHV3E0&j^1Pp0&Q`M9vHM7Q>%&aDl0sgTM6nqqGZu zi*T3VDi{9YxWwmTbIj8pUjNR)W$}C=Tt;3%SWs9sC&lBrWZWutOM7p`_;qzj|;yrz;1&0T2WLS+}KNK(~>>LPq< zQ%#on(CQi&YDmb3P_$oDvD6aQ7S<8gb)lXJb?S>W5MJv-Ly<<-x3LRN#G4A6S$XdC zeoGgIE4o%Lw05D5e3_n}N>5vtc`Dt`h4v!k*ST=Lq0*(=`S)sI8b<_3xh-k3z^QFTo_{cP?2G-D^HL|SUI2n zk9J{<3zJ=#;=;`?jFs0!mwA>tPJFzOHA|ZlSe2?oKE9mfG7m9Z^Vq)&(_Gl#!rjum z#bpi{yHs4$C7B_dDg9Y4b0*|gwTIhW=IQxt*_`77jWY^fZk4d(f=3ds3qBY8E(GLU z;6hM@vCnlOBpzmga|=j3>O#zgxC;pvvXUfSNV$+^_T^;O*dTdsd`x}t_%RO#Oeu;y zc~#YMlzFnol+0I3XnCOvi(I(fg~cxOM4Qj4m$=O1+NBD`woRMVU*^Jc7gk7khj6v< zPT@-7UBXqu-0_$-;%kNLgzK&EMi(}@@Vd)9gxxG5W7+A#7R$Ga+~dN%F5KtB{Vr^C z;b9kcxbT1r56ai%mmg(yVY`Z&PWC3Inf>SyDdf&VKPt|OW+P{t6qv_-n#(ZH*}o6mO{f z-*n+E^^Uh~A9=@xcg6P!-xIzs{J@0|MLu%jGZALzW06mUpSrML#c+zTsYyvLmq7Rm=flEg zesbZI3qQNC-oXaPys-I;3%|Q?mLnnmKH$P{BBzCCgtS1fb1s}`3wO*?`41QVbm0>> zK6T@Q3m4gI-0-@M*I!D;WHw;3543Y)so zOr((;jooM>{+#YLsKcwd8!g>vC3y=WPa06(+KoxI*eck9M(qFhc)K#t=7#x-m*#^d08L2scK`Ib3*#hct99Zty4*e6;m?6&UL_&2OS`oEzia zn4qf$D@)CfRWM1ulv6Urjj3)k!c24HR;BG0H>SJIhoEP;G1HA%ZUlKwhEFc|IRYLt zH|AP- z0j`305Xg=BZjhX-Y>;XTrLagsIv2~iM7Y$3rSA&287nrs!J|8OxN)Z&E8V!ujk_gZ z<;H3^*1EAy&NV_t!63x-a&8b(Qn@uK9Mc9HCE4^J~fht7} z8&A9Oj2qqf4K98Zj+Yz5_-3~o&$)4o?Mk>?_=0ec@I~QELbmX|ZoF(cLru!h-^XMB zZoG68-f-hhHaz~eiAVbL^B>l)6&d7#y5>MKpLD;&j?7b_ZtQd8J*J0hZhYXzhi<&W zgP?2!JpALv_Z<1zY`6)-2bvP@cjJH?H5}A*%xL_X8)w}3-Hp%P_`;2YZX9ysJEqEw zFWoro#y3>p34At47PuQn+~~@+G{+*YEqP3le_F}UKkCM}95nbH03Ie}jQs2mqjuvb zH%__ngBvH@IO)cZZuH>lj$NBayV+a06U%b(nwiY*jb>lZTn)8_#zl6_s(%Iy= z%;3XcH&*c#68?vshkx8S$KlsO2?yudfI04I7Wk8czZ;j__}7h#tUiwUZv3NwYxT>U zjeLZpA41*3ck#IG<3_$4a8SU(d-?hAusZmw9Tq9iJ@Nn*XE&CZgTfAqI4H{5swav$ z7{z0>doCJh{1>!7KFW)2!UXyl-=gC;CG{jIDT&)etc57kd0XX`I!%^kFG(9%IG z2cG==n0}77T|WbQQ9lOyoP)nCw-pxFAA+uPaJ_?J4u(7E;GiSD91L>MiP?A1-@yRK z{9mIiKmO*J-;Q)~%$r$Vh24a7c6ZDK*F)ITK`)Ws!ahR!_I1!toceSQWOVxf;B@`$ zwIW-TgRh$7CI>?tEaL#h+&Si#Nw4d7TBq4~^7BVH80lcFgK?})2csQ~ad0!Mm=(d> z877h`|lw5e+rm)wK$R#D~V+a zd#C`GJ6Pf14mIZKrOf}lIDo8_?_I)G4puu@Bfi$bI>#8NSsEecp38G$y<5VkwKCi& z+$7xWV2gvT4(^e2yMu=v+$(;ckYVo^*(Q8I_@MA1AdoE%{O{>(bQd+9Gr0Qy{s_{G<8y5 zoVfqwi0a@c2d6kNYOCZA2R}Rb#lf!*esgff!S4=EvmI8!fdTlsiTQN`TjN=_;mYXW z-<;EC_c_NwuRqSq2!|t@`l<;oD3*(gmq*8$=6|G6&|~-|W~3?pb#U21zQcDfO~xnp zGs!66F(pZ}{4)icdLfS~dHOQJMLj4c=dmUz?m-EU(QhD0Ne{|+P}YO1WS4&gvdq;{i7- zYIso7W70-W%#k`C^S&G7tt;gjO;AsSBTRjdF*0cquJxdy$NUDXkq6D>+t_oZLYsKd zR2gUCtmud49#hohEj(!HK`TYq+Joyv+6WnMTMyb<-d-fPio4!}4sv!BcKVMOi>`|Y zgOvTQ9&{7w?m=IVS3eH*>=)sXD zra{sOd%<82Zc@M@9&BJOcret1VIK2(>2ME5$%_qXgi3y-jBrC^G|LAVOlmUrmDZigXtd35WmzH zGd-Bal*<&0m%}@|1Czo0&SCBIZ;u|hL}#kYRaxaHj`Z5Ar-%Rp>qX(>0mdR$-`z9e91K$qV!aAyq zt*X#_Wbj_``_zx_7jBdM0pWu}8h_Y>9UfHip{fs$c<`tPUwUxZgPjV_=$@A5E;%3b z;BgP0P(3~=$y4Gx`%nshvfG0fJa}H5UN;Xlqr@H$Uh-hC2QMl(vst1) zUS^+FvwuzLWNE+3R1Gy9fn(9@oC0LzO}09bw}k8h?8_{TcRYAk*7mWuw6F5M2Oo)i zAmohvp-Ap+h>yiT@!(VIyWfKY;-6W`=N^0^e$Yw|iSSb@Uooj3{NTk2FOGQd4YTaU zb6y%sR7=)nmOPI_?KgEJi2*b>+^c(45ez8=)vng{9bmu%c&jHhmDqj5I!Jo2I(TfWn zTx30}*Zk$d-yDa%DC0G?@DDq({@`=TgMU4^tYR-NuY7TMQNW9Wl2E^h7lkY@>@^9a zu&9+36XE1iLZqbdD(hRyYc^M@&vIx1l=WU2tILU$7gi8*%%slMUX!m%Ud+-o$B~L1 zrz%U5>whn*dvT2nHt^zFFKT#E(~DYOv*@bpMLjQSd(H4z$7^OQZfWve722%t#qeQ9 zhu0bI|9H{Ji?Lpe^P;gAO}yysMISGkdeO{_E=oXiFItFn5VrK9ok%MoQ`p*zHeR%q zvr<#@qBMoP+Iw-G)w!PKrdp%CqZged?<~B*>ag6pdeKeJ?q2i|DIilltxhkmneS+% zuNVEi7$JFo;V@>+ivd=1pcgla4-yU*-Xt6%94a(lQBV|*4p3<~#Yo919OcDm@iD@i zg}L0l&;;YXnBc`kulbb{OPC81j!PuJ55N>Jrb_u1FQ$1hdjNK+O!x?cRWRLay7LUL znOUem(`#DhEcOnsv2Yvpy_n;Lix#}_dExfL@xr54#O>~K%==KY_MX+saK9G;FGB2V zQV6oLVC1~`67J?Qh)BK%h&TnK~0*B)v#^k@g~^G_Up|E5Z_3A(H3C zT#nOQgY&bUfl1+ zHZLBaK`Uev;zegpLe1@7?C|0d^}dId9x6P_s_|l%gw$k#lgiyc zUR)CSksU#V?c|gfKa2ljCBKUNCOj=X(B@S(mB4SeY7 zLoXk$^`W5;t$b!on57L9-sCp&p|KB5d}u29WBU3BH+h=*(A;N!cGE)GQaD4uENSgC zzqfAVGk3vleQ4)1x9Vs0)Sx}n<}HIAoB22S%r9R@ z`7p$1w%~>ehxssEWQ1^}&uquhccAcPw*Ow{CuL)NxLNU*Wm)+!&UfWILaCaV=))u* zcKh%GYgQ@D^I@(JQ+$}}!!#dmQBwUr^IzcUa=|jru zq;Uez*=76!$NUZ$08qY_hGRQOC(uly*u& z4f{1V9-q0d;fjtm@`jY(6u#xd+Zs|R-&n@%`B!g-_k4KYhnjxW^5X*^KJ?+Z58wOn zk3Hn0zwj6DC9?BKZ+=w6@*3oDCS3T@sfUALctc>?iCm93W(7X@8I(gZ-HA#{wE*KsI|nJTf@MkD-1H^JBOl zBm5Ze#{|ho`Z30DR>(~1C`m^9agUrg%SriIKgNkSm3*R=PgTH4O2A~{6u)_v%EV0b z;}$=rOY^8ET-ur8$4p6PSqr!Nahv6{{g@-}vJ$t*Wz~*Xl^78EgnmC^MsV}%GqZ`2a8~#-;A6~{8;42 z?SAvWd$z#Eemt+Kb2|sFahTQu%l%lvHXlUUAnx$vPCuRv;JE-+`f-;Zc?{|5J_I9z8|~AUl8sQvL(Fe$4i#)Wm8d4q5M@pUiae-KVGxG^mE+5`SCxj@5ZrWS<}JiM%iT!20r#CoO;Ezta22Kb6-ZKTdP}7akCPCj4CZh47$| z{pd?S4$Hzhg1k5hhJKiu~rs-|{+bbQ6r|SouYfzl4AL@sG$Q;lD!aU(WfKFw+wPC=f8DU;u>z=1;if#EyJDP_Gyi4VYuq z#R8^x^eTX-MxsQ(EayrJuM*N(N~E-~3=N7D)XJ?w02Kq+7Qh1mTpd8A0LJp~NC8w1 zph^Jg05Sno4WL>8XGWq=4^$7}nt(|_rvPdMP&0sr0W=Djn&p|jS^?A!ppKlB)D_7M zw)Mp82hbp3n%T8N>W~u~2hb*9&hJsVNdQd)Xcj;eVE#-Oal5@Nq><60SvT~oWdYE2NSJ)h{#akFyZP>7#YB*0A>d;CxFobj0s?J z08`|9a{%K-7~NQraRD$0ofG7oD4b+wBA(y8>`a z7!JS@@e4gduaF7w*>VU-614J=l~X4YKs10@0CD*yg$ZGyvL+Y2Qr4MeW8-lGwa+~D z;<>C8Ep+DvFkk$w zfq9p6jc~1So$%KZSRXKF2G}*sok9Q`ZK^f}uvvVIaI2Ny6TrQe-^c8T=hpKN2Jlb- zPX)}vX?wuji|t}B4&Y(&9l}S1^mwQ@TR<24sQkUcEGF&c~#fpka^s22;hA-9^SCG#|Hs?7{CIa$_U`2 z06q?2O9gx)NkV5in4?bv*dM@w06t?Ld9;IXeg*JF04D-C8NfkXcSiy^WcimOhXeRZ z0Crvms{YQNY}ROa0u zvv!7!VI(dDaFOH8c>Er~*#OQ3a9*P^hnGJB=1j}|9Qhk;1|vLM{V%WRdeiajNlAPSDhH$sn!@qEry2 zgXU-DoE@0*tD2cl9Wwjnf+!zE#W1c8qXJ0~$3yr&gsX$76vQhbyc$B~AgTmSX18`m z)gY<`%_*;!L#Q6aH9^z}p=Jm*f~Xn9!$Ir_qE-;KgBTsem>}u|Q8$QIL9`B{9uuHG z-Xw_nK{N>B+TfKEZWKgA@!S-^gf*6v1=v)inXtLAg|MYCr{5-swn5w|Njo7ebPb|? z5Z489y(C?P9fTc)orKiv9K;RcIcquWCQ0`odWiH4qF)gGgXkq^Z($!{Um@)<-~h`9 z2CuB3m<4(b3Sw~1OE^4;AtFPq{xFf8@`xZt$~nsV((=tgj16L85Q~Bsr;@xSi0MI$ zm(B#MIZOC4nB8a3SjRg_6>B;3f6-35L(jt^+ ztt3||bLE^ToG)Bp%bEGQJ&27#Yzks=5KH8{l&k$9?hIm?oXdsOTp>dHD@9fZu_lPS ztnVt3T#Rdj*dXV+Al8fIQcK^v|Kp_1&2nxNZV6&*5cdReublL~Pb6pa{{Qd?#2*ae zA(8Du>NA!{f_OBDKZ5u(h@C;~3gSo*-vsfPblwW$?I0cx;)x)h4C1LEUb11I4&u2W zo)6*~D|uEVm-5}>dxS6iNB&~)%4&RX5HGXu%j>luUJv3`@m#8iZ^-$k)u$wvuXlnt zpf>Ps5c`67Pih|q@lg=(i+^D4Dcr9&tqc@+uEhEUP!mkXi1 z5mptiCS(-VMXs?5wL+*J!srmjgit4hx{`Mcp`J~4%Mj{I*dT;! zLue>YJ55Cz2^)vdL?o9C`ZklZc?d16oSAABLTfqOgmAq|sjZytgbdX_gzGG)sScJi zY$xe=4&jCnx`fa*gkhm8RoN|s0n+R)>=8mwkzT^yLR#x1!dUu-&@Y7k${^*rdKnnP zjZzqtQww3R4aguvLKtf6=zn<}E`<>xjLZe${*TqUIfStx+!4Z^A&gVXXNNE+gz@4N zLYSx^lR}s&GC71PB2z<{#(derpKdMBu$g6In1ET5-zvP#>f{pUk~0>9+sd5~JRx{P z@JSK~AsB*RJlE1_GbAT1ghe94sF1!?i-(YqGbvmWLMnuG2pOw0KZLC1c_MQ|m?x5p zWkCoFZTZmVq7ZJE?_wK@YD+^{CY|N~$?powSB7v`2-`z=ID}O;)Rqudhp3meLv3*_J*!kZy{9m0{2Sxj;%$jzL$LU=o5Zav-!;oXpVR<$pL!)$>? z@t$nHA2R!yAB6B>2p@@mCj40ViSSe5e&GRO?tswe;$H|43J(dt6y|ikQY_DpGBI{& zX%?&BgiOl0vBNbm7sKCDIb=Rua7^+!d@u+65WutOM~!?+=*AnYXM(}yl1-GyC+-GsDHJ3YjE3aQL$?Gr}dFm4HB zdKmpA9~s7|F#3lvK+b_-+!V$T@f*V!6vkj4L@R2tNu*7ZpXmG+i7=93q{2vtu`P@T!pMY?mBMPa2dlX(jJcN26PYhu5XQnV7KL%U^<5&eSXi|h zmRdRaa`6>baz_|)x;f65o7TG9db~cG@W;dyJC3joH zxX1e5D{@~L_ge{HJbcjdU12;VzTHY57TFBu;ZSEB(xe&(797Do*HH_CJ{7v|J81Gx1H^O++^0&fx zTl^j2yH>t0jQ1>O>>q^jVHh8U@v(&8h4G2VLE)!XbHB&|;b+3ngH+r3x!VA&xLVb{14%uLbiW~x){b^Vf-ylXNd^@3FA^2|4LFIVsv<2 zmNQ?-)7zA=%^0r;3dvd6Y8Hv0sCY49aVuw;mlWsu2fjU8I)XA0(@D!m%r;Tk2+Bpw z9uYflw*uH%(RfveAUBUx6uCNrN+Ol5yh_CMV(L_n;F<{9M$Fb3kLA>epiab0jx{5w z6~W5V*v;`jVn$0&h@4gHMo=$;`VlmsFoNb0TpK~d2%1FDG=fGEG>+g*V;nDQ9XK2>3~}+qFuz?NwpV}@M%Ja2s%b^ zRSKn2=oCTc2&P9dBZ?a$=n}!d5nPU-YXsdQcr${xBIq75TVyWgD1sgl^o*bv%PNA| z5zL98PXv7j=f=Lk!(dkM$CrikOzf(n~ z32zZj7tRpQ6wVUfD!ffNv8+yM>Tjn!LcsFp0>+8J7lA(lPXu1pMJ=ABHmF0csGK5 z5xl1u4+`HGejsFwABub={5XP7to&1v{Sh1x`OL~c=O81_1w4Zv66Xii$qz^HRRmv0 zaD=011ee%Nlm<4--y%4wfsQHsRzbdt;8+C5Blupu<`>})!V^Mjo{Zo}%YTaCl=#m= zmMRr^{VHefF6lH!Esa9#-M@>R6`m8GSGWB`_^0rK@L~jiiTo|(GaU{TJViqz!#kS3 zmLK71X|#=^T@(ePC>TZgC@MrvmJ3BuDr)XZ3P({SilR}Is@IyCo=D$fQ526FUP8(x z#p%3CBzF{~bQEReTUN+W22iXvGAl`3NT zICC14W!{l**UGm`6kSES3A+pF%XZ$&@*yIsT%O-MloN(=Lu)MSrp5o zSP{h?Y}I_`E8(5ubn-OOUACvJ5?LL^8Y@{VvQD_3#iBDv8>8q|0QW1>O;K!)Vo*zL ziQ=9p?u}wAYfV3I9m)eFCCoXu`&f4xJ^1`|TNDpO@t{ib;V5=Q@sRj-AtymLl}Dm@ zR1KAUjb7^CDPKBwi99BJT=+y3Pg>unqIlZ!XQFsk{5j$CR?aB)MDb!2piHxnj+15_h!v+%f)c`zIV#KvDgQQ#@1i(ng}EO6gAMyj6em1mCfN_qxda~(-QtE3umJE-TJb2&dTeY@VxL3rdf4*LHfDaxoYAn znon$r|3q;qihrZH%<(*iVlm`Lffx$JP%wrgWz6|@E^d3bHBbL}6^fy73`Jt5s97nT zJGfMy-U7vAC=tU|F_em#sbu{~G%ksfG0fLy6eaaK;&5}6j+sg+6GPdU+3zAJR*0cu z48JFFHi@fasKhkHfdneYP=zfdhP^RVjiFi$$rw^GRFC1B7{vYLysSy*4KZ}F znq5V@#c;5=A~Zh7YPuw0c04h7 zV+h9(QBr-vP|SR*)-N6q24i3mF={588HuXK8DoqoEMSJ0xKct%LWC(v$B>EP=@_1g zAsa(p3@c)|BZj#OyF@roIA6FxxKOw#hTCIidRiOrM%`Ce)I4Isd!WV@*Mwt3y zkeAtJSjBPp;&_$S8bgIRD#r183~#WP#qehgZ^rOe4By3YEQYsZct^2(9>cpL9}D-z z@E$91q)Gq#F?=B5hcPn}GHoBJ(pik0Oh1X?Q~7emvR~9}{!>Jff zC@eKk#_*%%+}QtFHB0%gG5liXxuNE_7*5A9O}AQSVpyOvY-g>`xfsr?_c1J^z7WGj znu?n={H1*53;!0fCH%wwqV7zEe`C0;?ncgoQcx)J0wS#XLU9z1qllcv<0uhFQSo9{ zfyyQ0xGIkFl9UpbiC;PPQ#x+?2n&sBW#cFpH$x5UCD&irM-V&THbRDN-YD>YC^IX_;!ZB&;ptlyLW$!g_JkkE4OS8VM=9 zHjai$Avtr`IF2UrYAU3Ja;A;d+9Hm&akPu0W!%(qtGMZ#trbO^xEUcStlQamwU46{ z6VF*dnv`50M~C>8A-!W9!}UEn$~(t#LmXYC_F+?Wjhk{{g4=RBi=$^8qv9AHN3S?~ zD~cg;^bzSBN5A-$FX;A{WT24A7$Cyi)f?j&B%V9-JXqPhNeN~Gs5w-=!-T`*7$L&f zh(^Y*d})7795=^tOB~bV7#qj9_?6SYOyu}DrYf});+Po6B-T+`^B8WjgdQDfo1(Z_ z(bFU>snKbM3U-cgrf^mqx01AinJl;J+ ztQzg-=Fquu%u|s0aV%0^7R0fTV-!s5y$EBiXGz@7g5m*4g<2BFQUzJ2mbsiY$iqJ> z5GwOkf;*MAm2uo9vMP?XajX+x&BaeqtYOKkgR=nFOTIx(j%RDxU)WPNN%(LaJL1?J z$Cfy@#&M6Ldnk^38N1pQN4ERpR~CT}#<4Aq2NaMNSi)?>d}cax0=6sQWgVb;B#uXw z)Mw(@DZ*?%9>*^6$Kn{;%w)W_oKLV-C@dvUv75*7w2Fw%XQl9*weWl#yOkt*&E#X> zI9`h5L>wpM*c->oaeN!coR)Zn1slg_aeN-fYaIOJ_&9FXif_d6rcAvb$6Lz6KIW?k z-j3rP$={8el^AP~Sz{Dj6}+d>hV{tK_yOyeniWmQ{7BuC#rTQR!yuoE?3bMbHj!T_ zUkv^gJ1^sk<4e`!VIiYtgXA3_D~LK@%jS_dzERqa3MuF6i!pu|$FVq$OXqvx4?@0O z$kCe$KgRJBYrG8pisMuqKP&hjar_d;uWZ0=aW0PE;^wq1+t}|Sr#@@sN`BSEt$O~~?6leKxvi>`cf0V&XaWf@xrubJ*Hi^seD}OdAkU+r% zS|!msi9!h!PGCaI5n!P%&Z3lgm!#sB*$2Bj;p~V8UpsY68^~sIIWr zBv3P9o&r!_BVpbgq;f4;AYuJ7Uv(0wn?OD3*Oynr1R5la{c9!6)e)7a6hxB*nkLXv zYPo5;S>j4JY%b*%39}E(zD)b9*)|EZO`x;%+u3+KCD2}+maj|T`UE=UoGcCf^N8io z;Ji495pPJKixj#Fy9v7s>Dxm|Whd>OK%WF=Com_0z6tb8U~B^866l}6fCPpnFf4(A z3EY@4&63N!K_cWgi43L}%cL-d$jRj&jSm+emB8o(MkLHQM&ZbW87|l!#w2ia!i;I| zf+*a~jL$2Z$;t6Qfk_EWPGCa9^f+Da~v0$ezmdgrcSNw}z=z~Tg!B;X|ANg$R$JOOV4KIJ7SWK;2r1Z?qg=nhH3{Dzsx zLWm>~O_--bOebqCkw7wm1=2|g^Mq-YMkawQb6v_57Zbx)M>02od2H3HzWJ&V3KuHW zBGuIG;uLZK&=M;XxGRBG39L?Fy@YFo>lBs)=~^a9 z>pF(zM6vrS zPpSHzN#NN8o=%uCilY#pRI>d)m%s}uuICfxR1EX7Tdj*j)}91jOyDKu^kw<(Wmjru z)P{F7_(}q=N={xjfHx9&Gl7p1_*l`smB2oQWovm`P3s-uyTaodH{MI&ed(}Oe~`e3 zw!gCjev-ha34E)xv6lC97)jt@0tc+*Gm*~|_@#_#lZUMQn*_d0;BW$8N%FOdhzjgz zM^tFB38u7<%9jm^UcA0b;8+636Zl@~q2x9-^&g~gLPE~MKP7OAV<5LdlK7cXbI47i zND{v$@LK|xI36Z&S}`)Ziwv8sQ74IN zNi%BINM0GKswZ)cBotm6kD8LRmDUnrgJ;xrlX}TFiF!&&{UjPBuk@*Fl@czt8Jub3 zCkLA-oh@aPJ+5ieblYaa=E4?9^Sw<9X_*s2nY7BiB!(n0REg}KM1Q5BM-n}grZ4nTrSu`n zNeNA{7WzuwPsqt-fD$=SxuC+0Nep7$ar0kzlQ8!Z&9LN^4bm}53|Cwuk{Fr9C|ic? z=A*?~apX5AF;>RMNjP4d2OB0REX#bN>qnIZ-&t|Z}EL1Fu zlUO8jyO2fA9Ul5Fk#lJh%S0$yF0vwN9yC*DWfFHK@njNDC9x`r)k$nhVsjE}6vf>t z%(dc-cb&+3;RYeouu(d>aeGS=Ta)0V|40(|Byq3e+D?V!mD%|Lk^6<)SQiD2{6Xvc zkd-`~1YbVln6M*hmR@Y+AD6+Ss_UJ?UBbs$St9HRPbAIx7LuovcqWODlK41@XOnm? ziC2?&O-1*75-%jNM|`(1_t|jHKJ0fdCh?Mldy{xsoRjeHB>qX_y!ao& zKZO?**G1u9LIz>Hm*iVAWg6|j;+KW_LJE;W0r`>_OrenFg;OXZUQ}4j%8RE^!g5BD zTjG{Zp-c)@GpLq9*%Zp9@MsDJ%!aP&tJvDb!7& zUJC7sqVphBO_^s~)l%jWL-iD{Nufpxd;r0#b_zAcYgq|%M|qu;Iom_hwv0I>}dM|U|pigyz4EW9CwE-7>s?R4{!YC1z#?2{=RfXP~!Z_=Di^zE41mVOKCZ#Z0d`b$_L}+Jf3hXTGBe^a^ z$#i+m5Y9|tmPiHrMeEyA=B{ma3UefP2^q?rf|G(rPHzf6k=!ssUq4$57X}3oN+F!W z{1g_X5J@4L!aQpsmO@?%b5n>*k`N|^DIp*DrbRL-WLerO`P@@rTITYA5pkLz@>-a} z-BMnZ!tEl9Q&=KGU(T3IQ&^V5a!KwKuCTs$uvLsRc2-JqR|>0ASS`LLg|%$e_9^qa z6xOG(L0%N*u3SnsT5Fq9*lhV0k*&geSSGS_e@a_(g)p0Y?7EM8AcY50cqoPKDLkCQ zjuf^OG3$ZUL{Q-o6(%3{Ezlj)ST6fhcr1md(s(+J$5VKM<&#EU8c$NlzLPes^yw6y zNnvCfqtbYmm6$^DG)koLdU9O+fbCSNZ(CipCs?8(Y`PKfiPDZ)cH7t z&r|p!g-;~^RJdQ`&jBWb&wnK$;l*ZfP);^Wa&Gb;mhFFV&Ss}n*By{lA|(0 z!t2`j~zozh;jO6md z68K%tKT|j>a!z<&_=n1h$7)Wq`;#c49LxmYvpVz--c;4l9OQ@r_tm;rYLD9XLDhTG+L(7%4RlKwr$gBmqy<- z`lZo6jqB3rDdp=`INj6ekwymvVf*QrMyE77r%hYBA&stSGar$6QIOm+wObmw?*njF zVie32uU@j&+vdHGoDADPjR9#4OJjH%1C^Z{g$&D39N`DaIhYlpD2Av;hKlEki+LQ8 zzOv0lPT}aZS&ENgviY?o-RvCaM3BbVG`I^iPDnCdrY58@F^x$QPEKQ*^_?OzRao4< zEiyfg8Orj^Gy)>CgtrQB6Eah?Mdk=y99~2m>+2Em3VlL<+WhmB0fTaegmi|}h*%y? zBPJeKvRN_-kz^VvD@luFguI`co5nnqUW~^+(^!x;3y(!<+&kJlBI(ux3#q{SR=xt9 zHWScd*Tsmg5Eo|Fl{B@Uiu77F`;jr12>ma6#-z<3%;OCn}oN@=Hn>GrKp9 zmt~Fo6_HodcunMW;Tys?(|9Y5x7h{c{4kAoMcx-O?7lSK6Mt39V@f_q!_(80=SNoO z7oLQ#mzaj!<$sjX%=(GmSH8{GP^HX`V~tya<;Txzz>#>GnT>HltE!-s$j+#q(Tuni)T!zq8Sv+7$G^4K}yKC zWCmAdP%4Ac8I;KdmjW&1G&!)B%b>h$QkWZ=t7^%?#&dNBl`^IkRTfqe9%yAYW~=k# zpBdbk!JrIkWKc7MJ{k1QpjO5V{_QikPNa4Qbuy@%K|MKJ38_$Dq=E3-3>sQ_Baz0! zCK)spX=Z(!i?k576y~PI))};sv#qe*f4r{eliv)wWzd~@q&$O#1<@&kE*W&qm@T`` z%G3=Rb4rR+05_~ydb~Ib^iYZQ%Aj`!J;iHjEyqW1Y^B^D=NHEMWze4)=MbUi2m>9ZEZ#e_Z4b`irVJ)!Fgb%E8FOznHiK0YFf@Z<84S;0L2a0ZbKq8Y?8_%(yyGKgo8$l#$2wr7ycAeF&gER77(855A# zLXk`cS&=;9T;V(+b>?TV!1DWwVv+dm87$6ViTHBiQmeB}WWr#q5V^z3?-W@n{HUl& z!0HU{m2*u7Yem)xH)XJ1WP^~JcZ+Pym=TOlUYjM^lEGH1b591xt?zvj-Y?uHd?14d zMRI>6d^m$08N8dpz6>6b{3$lk3?3Dy{hcDa*tD$Vagir7cv9rP$|fbxWbmwvPEDf}q>Nq9>5a|XYNP|cX) z;Ge;n4BBT6|2>1V8C;!3r7X@V-pd)}XK>!8=Z_5j%-})>7bW>y_?Pvi&40u%3IF|% z9J0?Sii;Ew7R;iMNMT_SA$5w16wBg>nj$47vM4FxRl-uj(pi+rqHGrBvM8U$J$!Ie z!sKGOLRHA3VitMa57d!k$}1~WjVx+rQ6-D2a#j;o&tCa!E!D2cqOIBBD zZA97%+X?wwy6dd(^;vWf?Q#n>#yWf5ZXBpIK@7PBP0HH+Is7(D02a-NfgOG3BM5mN3E@n+!@@e2diHz-0Qku0KFtjOYy zEMi&2vsjSDLir}Ln8yO)=D(aNB`Iw!WU|PzDQ3-&mKfb!$#Z=4_#p~j42;a2wx3YL!{2eRdm_}>+vUo2GhnxRdd?4~+7N3Yv_)!)gi}Uw(bn^OC z&iz^Q&pSG4;d3SCjPQ#r4vJ8ID2p$}4-3Dt@~=7iW${fGMGK;W6QH4%g*O zB7ex@gd``kIF-fE;y((1%9?*MQ-{|tlKhs%uXdozd7b9yp*s3q3e-F+axRPWR`N#{ ze~MoaUKHkv=x;`m#icC%&7#Cyl$?vpS>&_L=V3t}kcR?!n3#u2c_^4?Qqm$1E%Q() z4~6qkM3M@5sF;VM;>Co;g;Xw)hmzt~2}=n}3(E-03d;%03;AtB2IO_MoK5pkDG!zN zP({wVLi$z}sg{T8R&q@qYKYggl3IDFZF!wMyl*Yn%R_xDZy<85u%WO~9vX`@5i+jz z)l9~l<)OKia0+gfht_$xDGx&=Y?Fts*0-%lyF9cPxz5V37wM3Pjv}3eovrT;dFWy} zdsDYObk9Q%NqPx;3a8p!^p>+v9{P&(6ZRJl5DpYFtKS<%EPU4lHZnx+2V7o#FYoPxML-rJmdoUCCLZ_!k{oD3=1Q|s4ymEEb%-f#FJK% z%0pVbwe5FVIrH)`*Xqp6Gk?Ej@P&C;l!tFA&%^EVy*Cf{=1RIQykpz;#P-CV*tTtJ^0sYF zY}-yI_Qd9wWMbR-Pw)HI%=~Nh+Uu!Zr%u(a%f5ZPJ4}sG<T@r((1j(?BusjAU2rH?pRPAcQniy2%U)xLk z`WPII!7=(9Vz4m=n_{q8#qW*57V=i=Hsx=R!4C3H>MrH)j=>(XTuI6S;ZO2D>V6e- zfN(Gdhm>=ea76Y9^$qmnF}O(c1ob5K6jjFjR}4;*&nV|?49=0yQ!h~E2Vo>wUYA(B zOua(A8iQ*Dsl86P5rdnATh!as3%q`~OP0u2gnQKcG5DMCfclX7h$@kfWAKFhR5{OL z@LchW7`!BF=Mjm2&ElIFyp6#-^7|M-7d!qBG5Dz3ejLmHPh3Jg9pV!bP!m!UQ4>@B>7xB6(;>MIZXG;2q|hOy4sCR3t3xUsQtMDrhe|r6 z(IKr4W!OrZq|+gn4!Lzmubd2oj5=gePG&+D9kLR#QL|HXP$f@J9r84Zjv~DZLC8R zLQ`rpsx)b?Lkn_C<+LKS)A07G<`l;IfIt<`64x}@P+EdNj5FLin8K&Zg6Gl)+>M%x=e@VvU#g5d?n3Q)YUqyA!u)n*OJ#!*Xyu> zu#qYw*`&i}#ajrzgxDrKkq$d_*hyzEbr*FvHO$>=j~p2iMQ7s#hIIP1F9gga7OozX9c%Z{^9ZoR#nhqxk=T+NNguiq+O*lh6OFc)G{PITc0{J5K z67{mGy`sZavTQsOEU)V<-q7Ku4!6j+MF~=SM=i@;<=oTZzGAuFd#J-B9a`(rMvuoj zJkcS89vSs`s>3rK66#}ndCn$r^mrj#Ec<<_!z-GvRkk-eyw%|yi|?slb@-raKN3Fa z@L4%u2-+LHZ{+XPA3FRbK=m#$amn$h@s*!Ik3?KkiS$TJGl?E)RBcj1GHP-?QYb&A z9;wKwsXNsEl2(s&bkeIx={J)ene}K&CyO3g_0j+JtD{FYIwkcerAKx>aszZ$IE=t^-`M7ugWi@M_E0} zu~;b+$}7Ku9u@Vdq(>Zi@{=lUg(XIyiXK%}WHmx{J!&YYCZQI!wm$ZqV_g>OQR`D1 zP$k=MdNd?AqBf>BQMCy(pc%P2wFR}Ms%=G(?Z2%a?eyrwVtZd?bUn54&K)oO|!Q^~(mr%_|5I;v#W>tWEt z$f8LPtMbiySQJ;}QrlRx%M$T+v`Y`S9?SJuLEodtY=T#{@)7*hfF40YNY#c35k3CU zW4azQSez+40^vm5=vJiNcGJ3>Lw~Lw^9WKqUylXkh15mV#ndI#rBsPrM$q!CByXXv zqOPW{(PJ%P9d$i*164j>+bEm59RKy$Opp)kq$ruU>amS6!rS%OLEfpHU4-3w?9pQ{ z`AmmE&J{Gm}_yH9!{vkQ|>v4q6DLwuo9Hkzk9@papL3%tXvll1!SbCb~Md}&q zS?W1G&J!+BwMn={zD$)oR|r@2xTc)zgd5bG)LVMoR<(Bo$aj@fup9o?vJ`3)#wz+)BjN{=Vxr^rMr~RE1BKlpAA9}!mI0pRG$NDl|tN0;>z(0}k4M<=> zY6H?3kkEicT!f^CXh33W5<_$cKgou2hhI1uW0D(?f*^~Wl8}m;C@In!kj{Yg24tWk zsia5wIH_^sC}gB5c^=BMDC|NqWH%ryIh$%Cro3_(kdsa>syMj~$V1Lc%}3RCQmOsL zfR1zu8c@i9!Uhy!v5f&m4Jc+nB?BrOAaA0J(=TU02?I(RP|ASP2F#PkN)3=ZGrO8% zcf#mB^Rfms`}tFRZ9L^!tYCmwegfKnKjh2N^0BW0RSc+QKy3r68qi73Bl0_V22^7g z!jeJmz}GOKrXiYB?ox`1U&nyllA&;Pv#D!9J=O}>H=uz5zZuYw8N_LBKqGQvY7^x* zmGLN+kw|0<16nGll>x2ET1;Ezw=kfQwdK zvLeO+ooq{HM(i=dXn@H8qY)-!ba-Y1wi~d+0E+=u18fG^4cKJBW&<2* z%+n2Ua?)G|xM_L}2pABQtwP242z~?PnGH!BVlhn3!h6LL75RsXk+2!Eqz23~V738s z3|M8rYVLh=sVijrG+@2~3s{srXo&#}nP(B5#Z*}lQnggYEHhxaV%ZZ{k_9AY4S54q zTCF9llZ}ud0b*`cwNjK3Zee%Zs9V*RBiW=%UONq_Z$twlcFFV_u*ZPCa#S%Qkr96y zu+M;d2HZDbzX1mfIAg$B0}e9(Q3H+{aEN@^fFrVJ{pS~%haB+fe>31aK^q~A(KQ~=i1MQYB$N!hhFA0hO(g ziYZKxghh-f%35J*BAaUoBT5=kn>&6fBT5@l*@$0_C}TufBPz0CIU~vwDyU`A7DqA& z$g2`-rC5bf-G~}SR5hZS8i^KPleM)}ux5(ZVefURQmn^TGPd97bTy)z5e>;=HX<~p zHZh{9@|zKw8_|N$lG@6M)<(1;cce;&wnns5+@8>ZDt~|_wVlYFjp#y<3mY-z)!m5U zMvO3`hY>wl)ys&%gx*HgRQdCbSZKr|78h`vlwf&D@1l#1SfV1w zWWX{bmK(9ch?Pd{q`!)~ow}O3#u$AzcrA4ubv<*HW{&*yoI`zx{cZ+ZZyLV zWAuwT*EpD6%q){5L)t3`eJ5a!TV-r8YiIndAf}Bs3wB35iWeVnTBI5-&X_ zB};HJ)4xY-DW;+?0ci=TS)0a$0^AGInULOu3?^ixU)+RDCS*1tj|q8A$YMfP6LOl6 z%YQi zQ1U-Zbh-;ltF~oKC~HDF7R#GZ(S%Cm3aYI%uWZ7vS^)2xMfmxt_|<53Frhl3h6yzZ zwM?jOLLC#bb5E&Dvw;b}nNW{hpDGz-85^3=$b>c~v^AkI{U#XRJ zKb~O8ib*C+HX&?6#Dpm{gC>Mbm@2Eu6g?m~S1@Dl=5?Y)nTS#s8B7hTvWn=sdec_vI} z%nYgo%p}ZWr?aVZ)b=UElZNw6SYX0J6Be1U!Gw(_EM^m_T4%x%@>1$D5dfXX#L(d;cpf{nef1bhvbjc zM<%>5;iZhHFCLrlgsW0AJT>7N1D;dG(NeuK;k9xGCdM1`Tk1O#A3C&1ENK8#) zjy^G-)Qn_iBqvKTlNl+@NNGkY<)k+wwHay5NJ}T3^1sQqlKG=68O+G||7$ZdCX0&9 zYKGQIMv|Rf=b*|m<~Adb8Gl)D+Jd}hg)_F1oLW>hz$2B&&}JSfPpnr758qqZ4!%&2QdeKQ)Ek+2JD*GKX$ zsAtAGd7eE?I~ed3q8%~#j4TN-e&Yw zk$wI%!~M+YPhSqC1I!pGt47`ePz45?F+}lD!Z0(2D`$imBgvzv|Lk{T%ouCNI5WnZ zF@edgW=teZQDc}SGeg$yEz6jv%BakkMpIJ75Oh?%taSNskZPn#(PW01Y*9|Te6VpO zb~7Ao=rqG;hM(**!%dLBJZ5+mPsxD*Iij2(A!J5aITG^+c{+8*fBe~I%rRq~8SBlM zYsNe?mZ{qLgauS>8(wI}A{G}@mr$4fCtx{w1$8BL6;;N(ny|)o<+R(2vY&YN+;jE81CGUK8dm&~|n#x1VO%Vu0P=9(4^*qWgnMS(C;Uy-Qpwaw!^dVkG2@dNpLxuAYQ`Hg-kR~ujOPq~ zq4pZ-;-wj{XbQh3NQQT2yf@>6%p@~N)jxZLHZUoEG2<(16It-hjPD#|LasiE`Jr4=7#@~?wV(>y*0i9i1=Tp18r16a*^>@^`A%%QSKfRodz- z&?}Zttp1k-Mip!!*r-;j9Diie>|}=pP77R|WXa>Tz)jynm1U7gA6aVs+_MBi7KANW zVZllZBC#Bw_u(H^I4ohooT@=!ffgs3+58!5<;GokZcQB6j&(p%&TZk7b|}W zVJQc>%!1`CZsl5*R;w&nYr#4TR;&0m1R42y3pQA=+k!n7Y*e+|2%D&zsaq`As%qu) z8p*lcf*s1)N!TS@4z~)a-D|;q3l7l#(}H~jc~nNK zro^AH;H2VH7Wml984J$JzHCJ)E6!PP-hv+%{IuYL1s557*Mduy=oclfT5yeU*@7zs zF_$L9b*`-2)EjJalYEOTTam2XJHj-DwRJ7yxo5$BSrPL5zpTffKOe|}g78QV5d<+G zTkwSZR5{NGn{FD-bbYF}IMhAclkBF*0^|Gfnt$RFhx&TmIOMoi#Is_!{P~L&3o;_LT>M+nO-|GD{V!|uc$J8nnEEy&l3J0> zisV+Lu%a+Cq_iTH6?v`EnMrL$8Y{9}W1kI3YehyYGBGS2HN6!X_>zYQvdClqjLgca zsH3W~DM#M^=U_}uD{>KXTaky*mftRyY|=0vM6t_W z#EPOSzL*uoIr0+L*aM(!|D~-cW5p~hW?NC#8a@5}YDE<*%Bfc6t*D^5BB2tsGF9TM zT2W0JS~1Ov>Q>aSqPrD6SXnR9*RrBEp$=8XFOLz{x1xa+ZLMf$#c%XmSn)j} z8d}lFipEwnv7(k*mZl77MisNU$|Ky;idI&%rqhNhNu&#T$u&}YD>_)wg?>kC^opx9 zwG(w<Inenb1|`>_(6sttVlaY&KT(vZA*YeXQtf#UT3qRQv!d`dg!)bf@8H2P$7X zObwRW3>ZRls1@?wPzE-F#ZlCeRBaeC^3hg|p)-~`jyj$?fhx@>S}}<{Svgazm`d)* zhq7YG4lA5i=*W5%Y2apHq?)K^s)cH$+NgG_912`&o0(ySTjlXs;guratoaCjYQTyh zAw&&RBh){r)2Y(1a}vyCHhDro_Nh7KrB*DnVlH`}>T5n>ffWm_SVUgT{d5Vre&*Qc z%4BAi)7ea2VZ};<_^Yf~t#}P#Ep;7ry%ie>8>yS9a;r@mZXpY7C2X@|yA?aE*lEQs zD~?%loc?Yr4yedIguOCC!anMLs&=_}kSsY55e`$2P>*sql&TXd=8P35$)~7)DgQJ< zKFT?(oO6WpR$Ney?4g&fxMD?D8@kzW)rxDZDr>`aD{jcK(T2D-+@yKeihG1xR@_z@ z?r5MkfcsYbZN+;lK3MU9=3@ptRPm1pvdugpJf%LPKDS1Xy7GEq#Y@Gn2(PVpLwKwF zcZ5z^@KH_37b`w7k4(;Ig7orLIo}B1sXwgvNq{Z72DL|w;@J@2hU_-vupxmB30ake znuwahhQtJElEj9jijxtN+hXrErL-Xxozym@u_3MP-*0)Rqc5XMPsl)(Y#D9HM9!=n zSua^_$i`xb2P#Ese zPcAiWsAWT28`{}W+lD%ftWT{=tw+@oO4|lD{AP=uSR2~V!iJWtZA5KsLlYaClAGDk zoFK!Hw%S4o3$#*xYa7~-wc7T|?_@&YB z!#IYGrT(*wQajOxNjBWFN7uq+8>Yxa+0n|5sj>=e_+Z0F8>ZP1W5XF6&f1`}L2tuM z8)n&Hu))ZLJ{wE~N#eG_tk^=ZQf)TamG2-pZEz8^t6UG+OV#f7`)vr=5TqlSLj<{o z7Y^GHQT`t`OjkUEAa8JH%T8p&AsY_UnQOyp8`hBLQRh<^*szcr$s!vT6PDPpf*@PY zQo=Ioa@pi~PFcy~DitGFP%@siHtb}=b=37XY#?m3VG}`Ov}xaL!xlPQmA{R!-G&{? ziQejzC+K7ol^a3SJvQtmi1R05pAGv72dD>Ctu{YLm@4|dOl|>@k5P}?aDs4>dWtGB ze-Td0L5%N)&e?FD&V3s$sF;g#bmG;>CFNWuT#>T?XXBb0!*#+9ISUYO*>Ky2JLJ36 z|53HYlqI^yqP7|Q&72Qxcxb~T@?#s`5}r_>+VG6E$VST#`d`Xngdj`w zn&unjykisb-xDPM6CsBkIqmpt!xtOA+VD-5k^91T8-CajR#$yLZAe02GJp`rj=0K+ zM~H7n0zyJ+B5Go)w9-C~PijXpJhpr*7VmGV>D@oSFgic3o;o$}M$kwI}rJ2ENG zY)2MyR^?yn)$|x>tM>%qNJ1P(=QY%rlx3OBnU+Kt(QI#Nhs@bET z2voPD20^%{9ks}{sdbcJmr&0h{isF4q-_H`ep7iGicfA#ZKC|9b~IDmoX~ z*s4EO#@yGAewxEQaR7NBb&!e~Y{wAALkYv|7*5c3|50{~w!>+U?yzI*7|SXX`yEG~ zX2*Cno(Y7Bc1$8nrcP0{QwhIQWy~@5*jvOpJM>Itpc<*#9TGFyLbXzDR9QMZ!9kTn zjmr+V9Uc~gR4-K`eFQ%>K$YWX$R0f;$}3EW$Qmb1SN;sbOgm;NXEtFDRgN(8?O0&P zCObCUvCxi1%)FMmn7WL*gu2xJ?=x4+>8zlxq^`1KH9?RM<2V<&kRRaWJ0JN9J49u}pSy>|SmcppJ(#Xm@vH+qK% z+JRL3qjp@QbIgw8cAOxewBwXL_QF77{<7mdec{t~oFSi8&N+fyCtM(0RQ@HxW$G0> zt}0);zOML&9XH9p6pjw^Hu;XI9e3@x$KogIed-H4{w7H913Mm)A5kAG{|Vu#9nX~W zoFLbGFA1-d|C;c|jzc4kUA+mjk^WNbW!i2UVVz>18bv$bYL1|VjR%X{3oXdMhC18*c>o9U}k{j zKVg!=&Y~n2c969(h`Jr{IpBA|Ltg^CoKG!tz=7!w%y1y+K*)jcKY0idE~A!KQq6Q= zmIHGfn5&k3His=$(WQukc`9COve1D=4jgyj1hXxsZlf-7U@1Y`E^}bH11nfu>A)7{ zuX13u;x!Jebwt0+xQ;5Yp0I(s(Sc3M-%OBu-CI@L%vrGAfgKL)bYPbQhtvkPn*lQH zJ%qgu{OQ0x2lhK~z=4AfXlGkZ<%X3ERnx;N^AW;P>M^REQ%=fphL`d09XRE{Uk;ph z;EV&e9JuYkSqIKB@~Q*p374pn{DK1)$#Rg-#VzeJi&tdl)7Y@8u{!0g5ku&la z8sCuLI`B^RrUcQ!XjezF_CK)dBlVL5p9x<$^Iy5md?SCS|HFZwG~q-7XLKKtR~$lI zYCI?6D__=ELOBIEk(f?06}PU zkbbqhBAJ}X;Y3a+GCPsQiL9*6PL;OV*o%O?B)MoVC-ORx&xzblUb>-A>qNd_n1i2!u>qI>#invkKjrvYBaH6gY^<2@V{>_O#PV{x6A%hz^ z(U{PL+RKTiPBbGor?z!Q|K^~D6D?Vk46U4K?Tr30y}a5uv8YRw+p)I26CDU0o#^63 zS8^vOIuo?JvXY^j6Fum3r^>?0v8X3mKmuf)_GVG`%6^1JPAn$$rw(vppc8|f80^Fl zCx$sO+=-!FS<+nF9we>gkt^yEPKNIMM=5XYCvVm%(N?Q}bOtm;+C1_ik-3f=<+9lG-Di_u5gohx$ zS2ghy0?L=i(ZfzeoLH!wKL`t`)18>XAWPIgjx+K0N{i4BB}vVqCR zn*7G1fCOxIVv7@7SvyreXQ#QtiJeXypeZrCoY?Ke9w)Ts;_P+ePbc;QNGOKHO1GRxS{x_6Sv5>m2-z6-&MJ%9BuQsFN35b_i*I?%p>wkCtf-6 z*oh}BK6T=m6VK)7!86W$*}r&{d!d}yPP~yrs0*1~crGBG+cj5=(CspF%iaqnjWfK`mJQw1V`^rba%1lH^OiiLpX)dp1 zEGBowo;Srw=|U=+si|qG;-_^X9XY*nG7zNG%r0cn*oCYvWOJdA3x!?Ct|D`}kVA1! zSL}>Q&fGNfxR95SPsQYSp@8CFTqsDECDNw4hzq4vZBZABk&9DHP)oW{%7x4|FsWMf z2FPTtpfWC$RjtaoP@Y^tIdZvDNpWQtew7Jvp{fhjT&Su1>ICg)oobL}Jlc?ItC%_j z*?;T1(7=U`E_9;vn+t7R(c^7H7aGxN>_Su3s)-BQ2PHBm&1g2KwxG78wsN60L1MJ6 zv@MJ6sO_m8sM1Sk7rMA`+J!SNbakN{{i!Z=ccF(1!&#I(JqZI`=*6-1R(>B>^cdck z#eOdISH4`d43slkN(^#EAB&ae4F*d#`Hg7mP#1;~{f7pyMWSe)&` z9D>~ihYL;@TrRj>h|rW#d0g6;&K;Os>l_DABnKah1D*sVR3?7_Pa1jJ_Vpk!fuJ9y>Ddgb{BTIu!+3c zg)M}wvZ?S6s)TK$BjeoZ!Y&sMx^T#a-87|kpG<`dds+Nb0{BZ}2?|DkJbXV*8TkQM z^j{cc*oR#>;=)P#M^%R7E*z79V$lh_B{wlr;RNFo#l?xV(Q*F8NLi1OaQ;AU7jb8~>s8y-esMV=8s1jdO@+6AxKDFu8aigvq^~fz$ zOnpKFH+~~Dq&A{9rZ%BAr8c8V=H~9$TW2km(~8iV+QyBxgm$X7y&E0K9jTqDvTsVN zu5NU5!_O(|?nVzcuDfx=jh=4wa>L<9t;$ej0Zj4aQNcX?L0X~N2L^sB&+Hr*O)Cum`U*wa1C%G}%jVW$SRgqT0?`}*} zPK+BmvR*j`H;jr+ZkQEY+_B%|u+gzooAD zL{^F$L2`&1rpjowL)LUR7Aa>2VJ3B!8?y;>RP9_h=8@-97f=^cwbPvBTJlc zSVmq>T|r$*T}53@T|+Iz$2ixKrR{om^fyujS&vmHbxQ78SFVu#LK%x`VpY zja`J@RLQW%jlJYQsqzq-mMgHZ+Ve%2>93>p19;cq5o^<0BK~iaV zgif<~MvgXeB5>mzi`x3S=*A@$FH=_}jQzbwX?w+ut2D1stz7DxZrpNXkOzZ3xb4Or zH%fa@Ms^1`?z)l6gVY|}bK|}n@7#FLhJU;9h#)y1xbaZ2_Va*`-FTv$r-Wy2JSV(R z{!79uH(o2}4dE?yR!V$OemoC8D*oigXT@J+izRn2(9hbU>t60Vy z--85ngcA}HQ4@QRMEOYx$vjA|oD?3UR4nh`(~xs{klTZ_%1`G(dU6J8MrtNio7sab zin9{3d61ougPM~%g5%6XEA3c~H)S@+?;HpedoE2bDaiOs+$foWFWdMR8RRs*$TxYbd`a zp_T`=36mPd?qzj7s7I$hwEQdV4RAXpAh586Q~oFKZ!7zI)ysb zgWn0$s4-L>)y(l2$VLxL9+=4vs*KsUJND=@v65fEil}R5ndei;+PjBy%^<%!waVuqZv8I zi?IaBHjZGVj`v~$VIn)7LZ0NsWP)@m@l(maQ>S?mL(q9)An2(@xZtv+(|FUv>|9-Zw)UM%)v2{X$W#Fv*g z^8(A5cDWZTyjaPYRctQFBT<9`w7y^LBb*GVd@d8^d+^&y*ME|nh#ZcIO)YHR^|2K zFOK}17vH@&P4kQwXT3P*#d$9tdhy7M3tn9G;vQ=+d2!i`+g{vZ@roC>)Vy8w;u_8C z)Em^BRBa5}tjb{i=fz#M3bd6a=6yPUd+~rn5=Y|Y_1KFiO!ATX)QeYMye2=RKKJ5< z7ca?L6Y1^^lf3uhgBNeTc&BQky>mjOUkyHa@tL(>xFBCuq@NPmb01px(2^{Db?~7TxwUfI_|R5yJ3@O- zz65tW@8&~y#XSf;WnB=oRx&4jeCX>#KiQTz$gw_*^I-sE2Kq3F z=3pO&`7qpvAuP(Z^iWwf>{M=vkMKorjF0wVqz|JQ;N<^c%29EQFZv5(iIT>i(Hiqu zEnQEL739Mt277(*5hhcoP^bFvJ7F3%#uxn(w~nf(8mLAeOg@;&4yuG%e6W&jRJ-yQ zB!pA3i{Peus8Z|qA;9jo`Vb^UWU2`vAHsys+>)pJFvExCKCJLzrVq1xSi;)bKFsl9 zA$hJ3^9ZuM^9eHB3kY(BtnCPkSX``XHFGJ8%ea=MiM&?Q+2q42!fNUo>RReL>U!!1 z>PD)TP%><0am#EIzA__;A#ROFmro;TRoh_`X5(KyloM6LJdh;glTweK_aCc^^*ua7I*qRwYsN z%Z&2tyK*n==MzR#UGd?n57(GqiqeH_`M>0h!gU{R z_;AyQTRzsIBZD6`$r=5~6qCrI%cO4MB z@_tmHQ_&CY4Rs|yD*L1VOeZ7!Ro(^oQPq!XjFC-6%zy5R)S#Jfcyt-H?rQr{hh|+a zcs)PrvnWH7fCh>i`q9Xb#(p%R)60*hel+u=HH*?kb3a;=TPR0cs8%crw;{Auwe1M) zsU7_2sQgZTbS8IEPFH{QTPoeC-KjnN=*e2~wXdu6_M?v3*Cehl(s zupguR7)^7CKYBZEgiIQX!>FhW@?pZ?{g|pU%kvo1$lBc-y&rWm!r+HdHqO-1f3KEhG5KL- zjIh}ci$D4m_?aoADlZ!&WdKe;Tzu6$VZWRO2nVU!IFI;o z)Q?AgJf?ZfkCT3!^5Zy*(#r{d>{;(GI=85&sb{EX{W#~xc|R`ramA0Teq8k9l1w;v zE6E@r(|egKNOrVqtP=l*AJ=JW0TOeQ2_@z>;SNnt=*)&qs1o0f&@_N%%4r@zivU^%&`LRN z0%)yPu{3E*zY5Rt?E~n*s*W@}ktIeOr$Cngx(3jVwcP_4%77jL^bDX^0KMrC3ZM_6 zpG->teaW&Q(p+>v00Zf0MaeAYVC4)UXx$AX52ua@V5Eu}MHn5x7{XX;ZvI`AS)JrH}0)diprz(7+Qm8gtCdkLEYFsoV%!5V;#U{}5) zfJoBlGP(os1aMLL-T?NpBVPdi00PS26+ke6Pyk_R7{KZP)<{?Y(*u|vz=8l~1TZsz zxhj4ZVRiu8XOYs;9NA%c`kTip?Oyc402T$XJb)DeEDm5v080Z{CM(Dj`!4B1!sr#R zoH0cuiM&<@uuAokQ-z7YHh@h5Yz|;u0P7jBA%Km97d$(J_=(t-0JhTH5x_RW_5dW0 zc6U+ca34F`$*K{Fv6~?I_YfrD&j9uXuwVIy2?qi=NH|2*wx1&b9A)vCT6b>w7kD}6 z%JH9il6s2zR{*C8XQ*eX=cwnY7pT&E<#!oxu9rv^^~cuMD`9RCTjjM`#8XYoZK z_Dc=Y_Ei9{0|3|88`i!JL?0)UXXicy@G*c5L2L}-Qvja>um|A?Mo0Tajz2+E3F2!2 z-vao~h6o}~5I@L2sS+tm7dMD_K@<+6ND%RZNDxGJCP^4Xq9D=-ks*l0bW#OlPqj&c zNJ>XCBnu)rIR!N(Ri;QXrw$?wi)n*M7mWS;_035jFKH;Rj6q~!K&D{ybdZ^>O?Xyv zw*NReg2)*}t{`#;V=wCR1d&%722qe<`GUw#kj!$qUR{0#f}P6W+-QzyAz3JHmPHv^ zOvOv5#e*mjM9CmZaWLhBC{2)ol_iu3Mpu(Wic^k`6e|Q#F^EbmR#v9?5+hnQh-yJ} z4x$S?s!r_~M2#S7l4}LghOKG`Q74GHLDUPPSrE--8G~pLM57=YGxE0}8WJR}EQmHs zP3Sb`deIzBC7?wRtynAE@;?n*b1B4>SKDCpQ^I!C_KfKeM9VJG-~5rG~W5cP`--DP&h@nb;Iil*x z(#jBokr_->Gu5JUS_!rw#-xnCoI$vPm>tBNAl%FlR5?9Cc!Tf-;inT&zP5~_Av)n8 zA~Hy_m|E?07H0%;FCk`@Voeb9$n&YP6blFogIJ`T#X&3~FICR6 zAeJj$5yVQxs|fNb-dch-49U5U#r0~(-xS2=Aif3hJ%}wqYz^Wi1GWXRop6G>BZz%L z>?iN!jO_|yH;a3yd#RHDPlDFnfgldCc#taVA~!dc!z>=59u49cLE0WC$QkWq5U0q0 z1#v5g+d-TT;tZX$)EhyZ3*vkb7lODL#FZef(!WH#OqFlnNKQ?!(Ya3Dmhj(a2yfES zzNKgxn$IALTF5ALTw&GQ-Z`aBdn2A0HGyS?)6Dk>k!(o*fxX?1Tou% z&|a|?){#XqD)4kZkx4hi7~V}`LfT*YYTZkfhWYTibNFeZetA&d)QJjZDcVL}KKL(s7}iTXQL zmTod(N(fU4t2qziPh&BLnpLiXo)Zs%mW^*cD5Ri(?C@5xPV0 z$Ts7HHw0e@{!sLOpuA2`i-J6kDCgW@D0)1Pmk1HnYIz8MD4tH3L7f@GEW&K+9O~Q< z=7ply81t!1s0*kILs&$R+QkIfJC+ibsiIW9`uTH32rHRwRS2s?SVNXAb6p5)$#N@O zitEYR_XswTx2nj^A#5RQJK(ne@Xio+$r6PzJ&fHU?2)w=#@I0ShVZ9sOJQ^mN0aXh z;epDwpKySBFoZ)P91h_~2uDM>5W+?J$EYVmI8Hc0l~aJEIu*iSA)KZo#d9H?3E?b@ zawAK--*sNqY6HF$!nF{thj3Z>S3P$_d~cF z!acH7b?5c%-z;kUP>voUJf>49jKX0&3E^o7&q8=kGcjl5MF?M6l*}(fctw6qeWU!h zgm={U)DP5;A$%f8+s`34I?ih8#OyM2Q?>E zvgIP=rsko_W{^+S<`1KQ;$Oljr~;&+yo!WTEsW}66b+*otBQwFHjHxQ65;5cRgzpP zjM8D0AxK5`OMURA@<@7oI02%{#mwGN|J z7`4M_8b&iZb=ag{IQj#vb*Xa0xqdi$O(+c;u=Y1>HEjOeM=GLv2Bp zwk^YG#V{>Z8x_+wjCSPq)DF~+)K1jS)Gk!X*){y{lW#r37#zlsFnX%mUWDG%K4J6? zqhA>PRjrIiMlyiKfz&~=Uetez4Gm+2iX285&LxsgLbf*{K{?7;eR$ zFuY`67=A(^jIgQ=5<;?nWr!YUA}szT4_wLLK9aA6aXpNgVa#H2b{I>;SVo>holBi3 z+X-O-RZ=Y^ETS%^E}?20?eZ`VhH)s26*N~;S5a4ov4*fVjGY9@wl0kIS7p|XkJ#4vN4E%l{=ll zjWBM?LFtdEc`Jy^eB;)S|oyO5oC`b2aEZrQk#>ID}vn0$wSCX zm1WOQD4^A9Do+7LP>5WZ8ebimi$+k4PH}1pYDuc}Rf4kWbBI-l{}UpH9^Xszp$pEPh==jR<~dmawn=xrkwOe<)y898GmZBA)^k{Q^kzPU=$zcjL8DdiePpG zFC%yr!5n6u7s31p=90BFvLJ$m5v+}1T?C8hOT)zk`N&{N1WU=wB3Pwrmq)N7f|Xo+ z36__ZYIOu_7^8jmD*pNio~TwEBG^dY6v5^QwnVU1j)baqTLcFpI2gfpIy)lR8Nn{{ z|55cFP*W6L(?!l%a!^o^oFpTHB8Y+sL`k9oA_$U9C@Kg_5Cg_%bKcq6oqY_bm;r3!%3EnHg`z83G1e=s zl8+?+v;;d!@No&YDfmeVwu|_CT57%w>@2}92|pL^F2QH2B4$B_N4lEc@0boBdHy5ee&GS(L1oG$zn0)P zN$LmidkOw1L7f2V2JmMI4zY|SfEFfd{w1};>TG|rN~hw8?WO;S94)~y>HI6C4}5R1 zjFMLfprT0G0LqD!w`NVzSj+&b22d@4%92+R{_p;%x`H)@HH7r1RsgjF|MyKN?qlmI z>Lej;vL^j5*C2p~5;h8)SR?$g+(g2r0W=Gsc>paGJU@VwrPeWkP63<}FoTZPS_X`@ zRso!9?VlDv>j2s)c)GRRR>5|{_QDQAzjbJ*a{xUgp$}aG=t>J(Cb~)3J%BSrsL3Qf z1Lze%Z%NJyU|;}!0_Yn+KdW=5NPi(aIXxU8KI$wC5;-@3>#oGv0i2`YwuYvY3>IHn zA438d8o+rhn#wpV0KV5mUQ*7ygmXav!vh$hqKye)YycMqa8bbg-8^T%ivzeMV5Y%K zW$p3+Mg}k{V4f>orb-(v`E}X@5U==8aGW?j8LwI;@mp$Q09OUDD~jDwTphqQ0UQnB zn3N|4-~~_&V6uW!gx3nEvWx*t3t)Nx(EwrrTpz%U02T(YND4EB3xqcWFiV7)&JJLX z<#Pj=XZei*+!Vmg0o)P*=iXa|Bz!1IoUh<*{1H`moFBh%|;JyG>25^4>57<^0@E`VMzd+?Q^l9B%uJpB3wrz0kfL$iU*JgzzHB1KvJ=3c8ma0;(kxg zTF#)~cJ$4)qaYtZ!M3bF&zA=9q>}8n37-n!Y4K+Q_+DhS@Yw*K3*dQi+I%;FH5}#v zycobs0j!t&WgGjd$SXqMjn`C}uM6J@;7yUWLJqWbB5w)b4&WV;0UCgQx!w!leOcQe z+@%t24B!I=>CYyS%>ir?`OwO@2Jn&P9|y24fKLM0&R)bH{7U|*c-=}yvQv_2_Pl*} z0H0Y8KNtBTfG90Y3xN1d0DDCC3cnS8C)_8b4vYCi06!{=pM-wVhzAs8DGmnk zv-mFo{2IV-;(u`3=PF=z{8Wb&JRWkF5ur`i|Gxno4`4?GJ0n04WrBD# zY&vb(Aj$=?JcJb?lnF*b;CL9`2^eGq2_F))Y@L39kFXAr%D z=p@g(3p)qVC5Wy;vlw*~`XwS#az+q6q(;t*!rnpj38KFhQo^gRg8hW7jWb0kA7CYe zf;c;f3xXIf$vHus8^jRt!7PY|E%k>6F)WDlB|lH-=Su}Y_Yo3a9KjuKuWq~*&*Mhh=jjuiSfX`Fm~5EFv9BZxbLxH5=|LCgwbb`Vzuadi;a1u;!& zuL)vu5L1Gfq`IO7HYKlX6+6{dAPv&&^dPQR1I-L#h7|mQ_&MGn2{n74ia9~d4dRv{ zZk2EIg19M&o2780(60yIERomzAZ`odc58NlwdT8I^n+L!#7fB*1#x!}_Xe>vh{ZuH z3F02BPiOq=f5w*uu_B23I7Xzy()kY4rmu5<5D%!N4+img5Kjd0kld!isvsT?;t`HD zRvLHyHW&V{G=toy`KD;o_ml7NQ^H`__T*R)kszY%s7!7@y&exD5k%7JFiA>0Z6z5I z?mBWoxIw(9U_OXK5HHD9PZB>bW>-|ORQROusUV&fVeB(OtQLP(_?(qLAH*8VUl4hb z9Yg#1mxFjEh*u?C8^k)1*MzSJ@rKBoLVq53OWd!Aw{0!G6U2JU-xc}e`0@9pxk0!w zhz~?I3AYBZIfyMPAWeNJp>Oje%Rdfc8wafI?Vkp*gA*X9z7TdwXRp=VC9*q+&w}_| zxqlHf|I^Jz|5CxPtZ!e7d=tbTD`9JXtK{DWu`h`4gZM!~zrueM|6TY~5c@?A2|IJE#3x5RhXAp;i_)GF*!oybQ?;wtd|06sq^b`JTb&dyt(23DnMx<=$ zMBl3rLd6jJhR`pBN+DDZp+g8AL#Pr$)estm&^Ux@Hf?ng8s|2$hIq{oYKhbq))BH? zbwj8pev+`hut5k7Mf{h_xM6FeU>jl65SoS1T>O*}T8gv?;baloD;jKcyq_>IRZY2vsxWn>0*|_2hg^PrD3l|IhUj*Ev zyzZ5RHkXF5Ox&--`$AY5!VXRs65b!est_Iy;Q<976h0*M{dpvWM?-iugx4f|EQGL) zeO%-Tb-5CbJ_Um|HWWH>M-T}i8bU0DcnGi9*n~(%m<%B$pVPJ)nRPYKA-pK^QV1`L z@XHUh|GFNevg%$B;f)YBSqpE9ydT2a5Y~n8mV)brZ(E&rMED}vyH@fZJJkwfc7r4v zg&zq0U;S(jVT*zv+SzQY>g1ykK9+o&aJ%r65d1IieX1bME^C5aA?)UI5JrVCJ`3UV z5Pk{aS1EiE!nYxO7s8hcvQS_72}AfsWRGyKjiteTA$_Bokfd@Lr-)PuqiPt{#F?sk_{4P7kAP812HiE{thmv=5_07#D|e zNf;f&=oH4FFwPF6a~NI1=p9C%FuI1(EsP#v^puhA!ZTQ?R(?_>xP*7#YU+FeZdCDvZmNd`uXlmFfxwFBfvl?WbZ!V1rKvVKo$>wm$J%t|PW|hpJi`WO zg)v)69tdMj7<0q8(YEG15#J7re-rya7`I5c!s^@_#{4jDQ}FgM7FqcMkvoKUGB1&Z z!YlQp@^10PVJr#b9`SpH%!vQVPFxzsGD((Od9t37->2Y8;r-zg|2+F(7!RpVR!RN{ zu5o7i*1rH1V4&w+5 z6~@spj&a(Ipi%_?hH*TMauM@EJbsHC5tI>U(Ep@%*@*eDHiP9QuOPfglFAWOiJ+R* zXL71ljlfSx9V*j@n!?(`TI|&-Z=DG0Mo^DwBRDmJ(;}!Zh2{~oh@e3P4I^k2L1PJ< z3Y$dWzwqoom~IvU-vpk{uSit{f3MAqC_g!3&bm*DprvA4ML-3r@xx-RBWM#bKgewx z`M>|fIbD{Su$@SIVFw`}B6N(HM+u!GCw_U+HG*ytjE>;)2)av$nO+pZ8R9)6=ovvT zD?c}a-VyYPpl`%1bNwSYGlG8N{^!lPcnyePU<89A=En0ZAuH|d2+oOMu&rmm!vEJ6 zLn7uqUgkSAg7a)%!$i&(ULYJEG4Cgj5Wi5!AX8l|ehI6h1ul(Xq=J->61hys2D&1G zG2+`I7|SY+V1|O@h1Uuv2(PpaIx&K)BDgw&Ya*Bw!4$<#7SjF~m9Sp}=a)9djj2|C zT?Es_r>m;37xJEw)jl(V8zPt$!R!d`ieO;`b0U~a&v~j7!90NO%Vu;ymW{d*Pk`|vVJ zXnDEF3gLZ1e`$L_d{qPwM(_|zVNdW#9**FV2p)~#u?XT3BqDfR$|bDN2%d;w%LL;# zHG`6e+4&;~iTlQ*;xX$FmHkpAC3o4$`SQPFS>fpjGL~l}a4gTM`It7(p`nD{f3l## zCnI=@BRYcjB!4=B)gsUQNA1}No{QjlNnVcNl?c{|zaV7pFGlc^a`Zi?*;f_ymhiO* zUKe>oNN3(uU9DA;bwa;rZ%g5w2-e$PNBR2^Y><3Q1REpxAc9R1Y__TVgnmu>NPj+z zV5^dRB>Y(D$9|%O+lAEpl!LJf8dk=x2zIk$L{0DI^;ra;NAQKs<;w`ZiXaw6oC*8vU~dHFqo@$Yw-J07!S714FM{ty_DAqT#QdP+M+G0S`+=V#C;sq}HFh9^ zgNprG_>1t@2!0c}puveR(Ebs@pOPGk;Ft*g{40XP;(rT|SouGkAH@B8fq%u13t`Jx zMx?B;T=c|#zG4)WqNpB44aqApMgyW46vf$5oF#*-lYt`sFgYiR!3z2n z#n^Kd91_J)k@KP$7RC9>Xt*TQxxnV-_h-NV)8Iu?;Mww}Qn*s7s53H(QBhnL#c0WC z;fg3OS1eOepE_fdcC2umaJ+EBfAX3b#Z^jmweT9@B;jPCUnsvUQE{Jtnwir+7MK=`1IeMrPVihMYV zM-+Ti_?XpsJc=ixC{ZvFMcB%NBBAJsv-F6SN3A4bC7CFa;wdXh+s380SqU9sE(+J` zd2!~lhMwyH;iV{E zmhg=zUWtOQ*u8FbUR4Xerm^66jD8JFi@X`d+9=jZ?X4&_M6of7w-tOxxSk_XQ{}q~ zz9)R2sk9HIg%2dzB;-p(n?<$=KNN1|;Ns5#gd`tFu}%CF;dU$ESQk5_zf(@Kp?Q54 z#pj&&;>Oi4qWDq@$71-3B#M7xM$YS-D1K8a@;y=PRbjssvd@1P#Xifw7x^KIA4Pr= z?iU^q9u)p8WZGY%_*D%`XBhlFia(nZg82*ala1;$&I|=Gm{s;`N?3T7#hdWA%>1IG_lrB ziJ_@@vzS?8p5g;&1zQMDj-41CEfs7fJT->XVrVViPRK0Uh@2inTao|WIku0T_+?)w ztNCUOonz<{L)RF(#V{|18)N7m!x=H06T{#bdZ@}067pKh&MJ|Y8xRs1hh5M~} zk%Sk=aEXnj4|l7G5r7!h`)WHimIATpPpG7{*I}wQz#fxiW@{;#XM-KhtrI z_#`Wt9K#gL{jy&d!wr&56HXUiFPtHqDWnhlSTS*yg0qElVwh`VOHaa0G29%(<1suT z;Vm)T$%4mltAg`|w^{w$MHUF}5YnH8F)R{)NO-q!sc^AyNeuUh(35*b{H9qJ!}1tb zNOE5c4~VRc;r^KU_9m76!agWDgM8(KxGIK+W9H+5O&>Tnt4kcVozl7p%nlk7lX(lQBFc z^0d{dJQ~l6zicJXi98>}8Y_7rh8Hb=DTcU;{EC&lD)O4}b>SOA`oA`YbuqkU$KWQB zw}tP-u-?kw6?rd)_eC}cH^%UR?fD$(Yy#ru7`7<(Lm?$xg+GpATMWNR@`-S-aC;1& z#;`+tw{WMBsdmN8c{LB}Ka1h>7`~9htk17SzT_$(LQTJie52qVAwBt4cD@ttvo^mM z`5}fMWB5sYe+&miXoRK?#_)3tzew_{kV0DXi$?x?41ci0XkPtOqq2>y633W(jJMS!sV=M$N6k2D ziPyE7wMFU(S-^TCC&f`ejs|h#7>%3~M?=XQ2^$NW2%8G2(=3kW;w`M?WRWdPjggjd zvp}?xgrqes$MIttKc#WHgd>v}l|>3bcv&D z9LwWa5l1&^UJ}QpadeO4j5vD4(KC+zahw@PuQ+;3p`Wmiuy6cCOVKO8LI2x!1Eh0S z90NrL#c{UCIdPmX!jcXaIafF&j-evw35N-(<6FKUj^UDw5MF3wFN))0%bEMgI7Y=W zK8^_zUKYpYaakDdwt&}2?P}rwG-+o_ z9QVetG>&WIm}+CMi(^_G(-oX4yk0m%xKjsKH;B{1tT<-JF-JjuaC>eX^WwNMZq8#D z2ycqx<~VMNthO!@#DCYZpX1Ojzw|Y9mh9A zae4!zKcyYY&o-Ki<5(i&Ov2zjaqJsr$TGRX0{XS&SIB*FMB<3Xu`-VPrSL!;kBK}e zr1C>?tg`%Jkw@ZqRD|!G`}YNp$MJ+DCBi@)!MHhD4GF_>bH2);f7}|2BOZq7VKl^-koMz}}lKZ*V}j_(xQCp;+p zK8_zm=*f?9{ABt5I1X6O&i1qTFT!7izX^XA{vq`H-(R)J~wT2rbu1pro;BoqCd-Waae}XdvED=+8Ng6KIk^(*&9&&_(j*Lf^d>37nib z@hj9*B&XSy3AD2ORFTsXXf4vl%1;+*n?Sn++KYEcpp%X5DAKDjf;wp_OPEP)j&OPcGZVNWf$I||9yZO8oDXhhB``aIvU(cA8IR9Lc=`W4J2zow z!g&eYm@r>#rkr?70=KHjk0&tSmi@5=ZcE_y1QtlLNO*_vPT^fb`n*s+57gRsw}gv@ zOA@$87D1>y4vtPx?R{89(;#e~^2ki2Z=uZX-V zd`iN9?n@7TWdt|Wf<+mOIURo73-ixv2Rf}0Z9oWK_G?FoD; z@}Y36@FR{gE(F4D90>gVuaLjC+aZPB!kxlhLK7ryj~KG zmFlD<>WeU{K@ts>*=|+OIM5`puPU0LXoGR=t zJWbd-i8dmqC(Q)gHi>pgw3notutO3Z|C4X0Bs$A}7sYlJ`b~VIq4_O133~{83VS8d zTSn+rpCtOqLO)@D;hDk#Lh78A#6a;u!ig13xdzMB*ZgQt66Yq(R&7WULz6f!iD5}x zn8Za%oS!t$k47ZTgYOHH7_Ltu4_DEckVz=NIB6b{U#K5{F-ZCN5x7*wFKvL!k{C@_ z(}<*Tc@kH!hSO-C#+W3=CNVFG8)@8na#a%JlV&(iu#zi9CJI?0S0~L%bWIYISkL_D zcge3$VoDO%icd{qx(JP2m&7#b(lKbI!4 zEQz2LmM5`74+pfjf)k!>?#B)hJ&#scfxD?hC>8TaGPR35mG`6Ox|Oe!5vBLOk$U!DBmseg^;nICGokq zZ-PlGvNXKS>--;@c#?OX5Hh2b0*B#P>=3n8Z&~_H+Cpi80y-`quXU z$MVlf{F20>B>qa`*Cc-9Y;SY%)Bc{sAJ!Cm0zILT!zw2E5k>vY3Q?5*&G}>2LYb5) z>Ay)Fmjnv>K9m(NmqPiJ>0lLX6c3szrcCWoSS5w3DV&+YfE22wP@S47oSs6B6l$i> zDuq*(s#XehQm89lTj+lqzg`M0QaD+XlZ5qCILh}zQ)npCNZ43Nd6N{HTHZ{gc?$KG znk1(vIm_bLNz2s#z3F;d3axFdUo>Ld6xyZGC55hvYM(;K6gsI~9fUN+tFvO$3$a11 z(=CPWDfCXEPYP#Pn>|Emv!_U}|H+r3Zwk5pG;2Ra^%wGv_^cELrf^{j7o{*Lg|j8U zKzL3HLsA%;!r&Cnwf^|d)2s7RIA3bRgcWR~`#uksaD3YROpD-=6M=oAsQ+)hXPN!mJdoNnw(bT%W?^ z6sDwbT?*4uxRxD2A6cFH|Ci-|C7N!XnIS@#W{OZ@b_#P+xH*MeB$+F`F@<>|esfd* zCL6pph50^D;WjJu%XoVV3sSg4LViQzPLU4!ygwBdTHh9@uq1_5ioGX=dsA4E!hH%Z zO<}nR^_N+Fa(0iEl0T5bgDKoE&H>VP|GM{Cb%=+PLQGD{7!pA9Wm*p3$VtG|;OW_lCGyc?9-@)t0mwyzygTs@rzp5a+ zQ}`@}Jt^!>;qw%}Na4#AzOs2S>%JXvS$TZTnWPrJVgKjTb7jZm-=^?g3j0#{o>|w# zjxu<@913MkzCW-6mDexI_#=fsQ|Q;+ zG*e@JhT>2Pf2n;B3;!0f;f|#6kL5>2#?QpRvg3cF32Br`qpbQ;IiYWs=dq1+TvI{9 zifL3zqq2AvVb!$xdwM!hEq&rIGpeUiLs2z_wS-itokktY>x%I3v%W}!^od28{k);o zX(ZBE*d&dnR_=c$t3?`ZB{|v3Pf4Stcq`$l!qbGUh4i5fp8{CUuh6thqkS43(&(7R zrD=>*RHrmLr_n{6)5n7I>u{({=(uk!IPa~mNCyks)QkW8^g&AR1$RfBR+lBcw3L>8H#Wac{ zrD;5w##7>J(s&__r^T83Gij_Ae>RQhROipDM1J3+eZO2jzLdtxX}prgt7&|oRIdr& zwbou2c|-W7aBUjvMBWmdU+QmCaIox)v0mhN*Arv1W7$iEc-ifCiMNn?-rUMu-Fjqk+w3BR}U zAJQlO+h~6p2hw=g#d|IeDt1u@cW3Z3C)hN8m85aTbb#M%+TYXoBaJ`PIF!a;X;f3} z;WYkEqiV)9#1Uy8OXJ@({z>Dgg8q#F%W~Y>sgwaSW+o|w-$qqBBkU@EIp7V3p zTG7h+7G-5|CaID+aYsOX=2+e8)DWpDtd&7+kvhVM6lo;qslbbV zHj$8dHO-(|2F){Qk-^Cs%*bG72B#?Y)C^7&X(?B=#U0 zauvCK2K_TQGlLEpbd;o120cVN3z=`147z5}O~LLNoMGjDZ>K^}E9oWDTi8d~SJ+QT z{Q()AmBEE7;6UM^49=Ffe%C!GgY%@!vJcMSTybVGL}aM7Gfd?C3@#8EE~Eu&j*wZB zi!!)4gG(~F)JkY`q-tZ7m0V_uC`WH2j(+oeA{gE<+@w`mzWH-mW! z-k3SDPrfOGo7s!_6R->_@e@D{+TR1#=TE>?O#0JbZx}96+B<}I3h&Bbp@`pJx1gH#6T3?9hf z!3;tfgfn=EY5Ads3?9#5RR-J*@_Lv}#`k}OkFwWE_(yL%kwGwn1r<=DRLn7;e8-l- zI<7(7{AUo&Af7>jWv^!}$Jn1M;(DHFaevE(sDN!FvAKfTxPHKs{|vGjJd-i|XGbyGJ@kYg+J!y5bwPzL!73K@7Av&uXvEDB47!#f)}ucs7zT3G04d|oZjpA|kQd_IFU zA}o41`b}&;EfC-SwypVGlR8kIlllKI8GM<+SK?m?|1OJ(-A&Zj3X*)20fi*rX7F7G2RV&ruurkA%i{YCnszW5 z{gA!%0)QRSRd2FKW4RrY@~I4%W9naP=?oOt=H@rS7>sUQhS z#q5c4kypv0S{Bt6Rh7!+jAo52YD!W!i_aQjcSqF9qP8Twx1vHF@v*8d`dmMY29mVM zqG1+|vZjq#+l?h`E@Y}ESu_=ICiL^7oSG+RaY_~~vuLHLuEJBZI6aHDS)7(d>nuL* zf;N(~4=@#TZd4bFvtm#kpD2Jzn7V6Vw%X zk4AD{7Q?cbl*QyMScLPlxHyYTvbaDNhG)&*fNCQYyij*3<^CiCIjr{7Mn-3Mjuy{OT;Ov9ZHzVTvqVm&G&^ z@u@<;k4ZW6gUi(5o)wQ{!C zbMBO%^X?@oE;YW$|JbFJKl)6#JB#@@m@4|Bj9HZibMv3Y zmsuRj;;$^eVxwg7Qx^NP_$G@zS^SX2k6D~i(X7sUS-qTv_%KdqP~T;-FKep$dttBR z$H`d(-;D=X%)`KeEDmy>&*Jwi+SD_z%KXgw)M?T$S^TP0OfrO@BW{5|viLKLp4Chb z;e1|CE9PNN(ODeN0uG+9ha*`W&Ei-V|4^c1uEpFYmBYW9$(dW3XfXt2)2~ zpNbgj;5;ete*`*ngTboiubY+81&*2d{YQrvI=D#1nc(1Jkx>pV6S+iAUh3e3vKT2o zlOO+)O?o@d!Q~FFa4<&JC>iUVcnVM6RT+(U@P^98gjYIdDqyXys)4H-+ys{ z^NbyE*{K{n$H{>s-7$02(C%36z;jS^P|8YUhj;J{vlf3!NS`mPYQ`z$L{4a?6popK z*bUY=c!7Px!JF(?^ufVv9DNR6cJPXWk2_&fM|`X#EW)c)gGt4-wX0%nSxl;lwGP&? zj1Jy$%wn;!qdC2QOQWv}cOYf4-oXaeRd2BGy-TylkH6>OeGv{`25E4kgRvb=jj`=E zJ2*3k0Xb~pP;#)_>IH>viFX2AnP*upBvF0%ZH=O$& z9AMMuP&;QDg*9`~!O!Yxzc~0uNq%+kn}gqZ55>dMia4ak{X_UCM?pnXtA9B-?0~V< z`P;z}$$fps9(By>bIifNBF8zI=Zu6GawsES)=J8WlowVIRuoneR?e9PkqN6RSWQ@6 zNMQ|;nmPQgt;NK8sFOpF9D3%=^O3qa)XSOCdQuMcb7&ymNZ3%ws5x_tLSqG+4 zSq{x}XpzIoIkaaMIlRS3z&V^I(o)z;NcpKb%$Q>oT1(P~6)VzK*v`gMfodHk>?)+B zlStyNyx`}rep79^~Iz3~W%%Pe??;QH%%!J%GhkiNq&zT|54#`f=)pqv+)Zy>z zx%1CqNX~pJwiaIj&0$auB)rbf;T+2c=Wwp&RrxQ#Ih>cnupG{3&GWmRIb0xek#M+> z@)05z3is5)#UhsoFBMW}q{t{Cbw=lKx%d^r3BobLu{n$r8J{x?IgcF6F zsISSHH-Ts7a6=B0=$P)fC+9Fl{92Wi!l@$H38&>SU9r~-X9!s#e%e_%Jf6c7In3>h z**VN1$>Eyg$LHm6TMoD9aAOWP<#2NjT#|0dnMo;F!SGvin9tK2zKN=ZhPWVyJ94-` zhX-=FGl#o!Sf0a*92U}fm1S`bi*lw=cQYft7S6uMojlu-w*WcZo5LQS|Ku>Sg3%#g zmcwtI%shEt4l8qJzcg%|+2pVT&<)N-59aVt4iD$>NDkk0GF!)0Bz$zJecGeS>#>~a z2As_}E$ozhFnL8FqFo#eM;T$&QusMfF4$&M|=kRO}u^i$#Je9-KGL^`o zltrkAWX?>CshpYWd8Kp6h-aoRy_Cbts>W9|csVV+n!{^3{L|2!C%>*? z!jbZZbl%Kitq7}qoyc1`ylo}#jHV?#T zWJ?Yovf9~vIc&}0qZ~fYVH^8r1+x&Z9}O-m`EmFphwV9hnlqa~_7+b5By@F04m)$$ zmBa3w*|zcGp5(I}K4-Vd;Y&Hg7bKX`S2W(qkgw@5cgQ@VKYn~~4&UbReGWfxPUwv9 zRFmIyGlOVf4s|=4?0(GQCr)C$O{KB_FjM0G91i5njKS+*4nJGY8vB(Uk27ixf3WAf zxW&bvIUM2?>Y{;*zj8R7!|@!~c>JBi5!Q1KM|0o~tz~y`2HxKtY|4$igYJxDIkS@f z%X#$%Gj__jDC?rSiyE$3eJYhjITtUDG`9@pX`DwuE-H#t5>^&g5mpse6DIj@TxHC? zLroX8T-0{WNMu2n1+%L|o1FYzvrg4>agvJ>ml@8BTY`oz8oB7_qQ8sAE}GC27j0dv z=z_#(44R0hO5V&xb6IF1G&#CB#qyReT3LRoi_&yGGc>MOPOsYGHC`baM@Mr#|01t!0qc87_KAv!}3^u(y!O`-t?F1qRP_ zF~G$@7lT~9I?~*Bou%SD#+8@649<4(&?qxkutev$80_L)7eibOb#aA@F|JuS8kE6# zE{3TT=d;Q9CclddTnuMTx~2#6y41ymE-rF$v1@iRmq^ZCv>(g8G|5O8N86u}TqcFl zE-tqg9_Wp+F2=c->f+J97_W>b(JVjyDI~el#YFL|gjWl%5i$uCCM(qx;kClKWsSp( zy3WNk7t>u_?_!3FIV#Rf<$i-WYk;fCEEls~@Ror=`b;v{#XJ``O0!8>+~k@?hp|i4 zg>H2*-$mF(#KmncZg;WB#oaCzxVXc`oi6Tj@p(<`ZEtp%*LK2^-iFi}kA*I{aB%8a z>|%+F`&~T1e(U01=FWSNikPLbNgtNFSSAmb3s+cg?{l$Ioci?VK^Lp5ny$X8qge_c za?RF#m5YZ(9uZRVsEfxee_Z4VVTmx{B4}enB0Kr;*G0@l(M73?xQm1f$3@OHr!h$v zS$3hart(uRe&_t}BIBCRi}5;lFgPpH8P~<$GAOw4T(f!0s}u5IhtqWG0|^b{-c$y7-Be;NnXcU%B|&HPh)&{2M0i4Zd-)$HfmCHJnoR zY6f7vee2>o7yDd%&(S*G)FH1ix=5(Na_x6n|JhZ#CARYLRmXo!D9&QjUKK4-5Ym9&yc45=(u|#lIYkd6diJINLODdTE)w z$%SUQ`f$2_RylU+f%17&$fIK3R6G5wlt<+}YUWWZk1Bao&7*oAHS(yIHF7jxD@ zYumXdRyDgF?u)pSshvliJnHAsAdmIBJFA<=<+q?--poI|!9OW)4r=HCj|v;+(JF6F zej3TK#(6Z!qir=~s;Qi8mPhlvIh1Z8JVkhN{={<%%3J2mQ5ByHaK&N8o|Z@JJlf>V zf_p|DJ@RIBoUW|f=Fv{1y|9CjE_KYKlXz!g7c1{7(k+kfB76c!<(}dTg}w6VO_E1n zdX>l2Jo@F)Kaa6_jLYN9JO(iLJTA)Pti0Ju4P?>ypHuR4P~J>IXXkN_JRF?IFcErt zuE-GKP~mxbbf{_y!s~oVE)WhEju2Ae;=DOvxjc_Y^yKT3JT7HIPX5AC!pnrCg&(!Y zj`C)$zano2`gASVRw$GCUpoUpWBbi4^1rMoWS;qN1;>#nF2T4>I z6UK!UCi0kA*~D_@;axyFZ|(&$>X}(#A3g{c$qC&&@*)Kr>xmTeC>43q%AXQ>I*(_p z(7^cp;A$d8xM7r~=spY@nC&c$seG@oFBs^Y|=}*Erbo_#lr>?C^QK znaBHiY{+9RN5?pmWSs^Ai@=6>E04GHc!%>w-s~LS&Eq{*=~#1o#NZkYKyD!23fQPg zgU7|}9!$8IlYbsN^4OWjhk0zxO+N)~D7d`wTj~_Y83Mf;+PwbhBn%CFd6wt#1oUgd~&m+gBK}hmT9>0qJ zmdEex=i*0f?4NlYvivWOBg_BJn>$k`=kTYy#;>1ve<3$=j6JJ>feaR~tAIfToL#^zEMUQG%s3UC zQ@~(V+PMV`Er6LG;3&p^2s7o zSS?oKKUlx6fN54TT{&J~zzj)dTDh+|tAN>7GDl=?0rRZn#sY2$%8-5R%KyttL(Wc9C-92f<7DC425hjJbUdpOrac@Gsl zboS82Lq!jjJaq8T(L-eq{W_q2MKjlN(yQX3s)uSGs(Yy6p@oN&J+rpf^w6g)8hfba zp|&J-g!P4Wh4nm~B*MF9DmM^sD5Ql(o_PU=gjW*@n+lr=o6}W2?>NQkw-#yXp_P@K zDsq~TrrL;{E^I4oCu}d|`!>v|lZU+>%poV=ePa8rJYVI$%sklV3 zi+MWanLDGA!coG@grhxNF2dN8wM7}@na%K6&*VZf!NZjvuJbU>!$c2Pd6?{BijrLI zVUirahQ4XM^PGx=izb&pe@k<%hpC=xXG=w%hZ6QE4?z#EhrEZ7hcGM6L)t^cL)1guLqe6- zxVqU=#ys}^=kFow!SRsu@L@gd>S)fgTDCA}vpn6MRL1BR zJa`_S@vz!M(L*K7!%W&`PD;8_pPd3fH#8qb`+@pzf% z$s607qr&PH&08yv_BO5XvnJ1ydFJr^We=~Ym%i%ZH4m>d3lEz;Z1M1>hjru4vDLBe zrYEdr(8F6E-e$-1@V>c=e02U@Oxyx2eCYXdLoW z`TX6(pC0}?e*BP!BkFbJe|b18A^G1TL%0ffILf(NtI{!P_ThnERiKD6MN})IdJ$!d z=+O`5i>OdEQ%bp_IRRjaW(g^&SVX0w`NLw)c$JH0-m6kXRS{qKX9sguQ=@2Vn@34( z(Aq`RDdK}7HWkh3Yu%z5{*!pDsw_?_qJ9w#ifCBGeMPJ+qEQizix^YH*dm$~(X@!Z zMf5A8SrN^P=H~s3B3cx2auKH&(N>aEia4!kIuEP5Wf83;JXOe(G$v^+-bOknl`|4v z?G)@7P}^KoJhHK}DQh#1I8}ro^8Ro>RnN)(KC3iWoEw%!U1scL6jtRBGoH zF-(M#pLkv>K1w*EhzpCjsECV;xTJ_nC0tt`t;>P;?9?AA_egkAepwNti@4lcyP^mR z{n*DZH)LE9Q;N7&3ge5IP{fr*Or(c=F;&8=gr8S866#-5#3btTUauY|v#nKcQ;WE+ zh`WkdSj4mNfGz3Ci(u4ZA}gq zPCL6gVwrT73s(r)h%|VA5f2pcXc3R`vUT{N6dn?;D&pZH9#IXmJDsP}Jzm5U?1x1> zRYVEBEh17xw1}XR&}_JfkT^Fa4DvG5auM+&az(gBBov!2A|sL%rZ_<474@@4I1>7` zO5a!(%JUKyg@qzK5q1*au~H5$S$MjLXNq`}ZWpmyI?omHd=bxz^F*DUe2w_4!WW8o zQQhOEB3|Ke;N&kkb7Z4%B4P`^W+ktSydh-lI+6Em>{~^=UBo*I9_ABUk#~iDXQs{f z72F`)D5Tq)i`Y^``BGFU#fL>~E#jLZ_7w3^5g!+^vxr@qpy=DSqFH)4vwc!DtJ`+r zr$y`#p@gN|UBqXcyNc#X5IZ)X?Jn06^M(5Pm+B|%Dqj`xwdG~F^DpAtBK8+?pos5^ zX0=^i6+g+teX5r4Isc3N$PpofL~f8)>YciS>h<}Ti z+S$A!{znmi7R|Qm5GNl^%YShi=jLDdw~)ajMf_v=QP#i$qjS6nl$uwn{Jzbx!hIc};U ztSMxWw;Q!fQKuAjDUn(uWpPp|8kC}8DQe9}{Zg}Z(gAVT`9I#K>Jd2?AAg0ly?;AREo}4(xnt##Xr?45IY!OyJh9`biHROdX-{%sabt` zm*P+-^eaXGQqv-RO3_zxM)6?^C-5^%F{2bSOEG};R*He87*vXpr5II;vrBQ#|D)0+ zg$4=bzxKM$=lA_T&wbXj&TEfn@7I3q@$BovEk5*R_I&8>LoXkC`^?#6cA7nW=;^~h z$~G5u*){M)?i0n($A{b2n#$rJupe{CM<4q8%ovYjp52wq7AFtUIioSahk?we8a{QH zbvnd{p+4Nn%@~p+Qd$NspHB5* znhy(nctABfUHO^eGfUY_g0(Z#hgtNaG0AKn?)PDi4|9Fy7F-JRcj3;{<9tu}pbrau zX3u@4iX~DR53#7Z`0v9a9~S$})R=0(9k(Su(-!!SkNEH?m6O|H!ev4(4?gC@a`6de z&2V=T*MEF?g0IGADZKCBaA4C_Un_u&Ok@}fwL zEB`*c%E9CwwAzCWKD@?JWdVLD!0S{wAHI*{cpRI2*vwx9Tln+g4c0;s6N7luhpp5r zKYIJ|mJcl|m~-8o{HB3y^I^LWZ~Ne*#`nr6y}13rAA$Adl` z^5L)#pVA0OqsXTz55zqAOg@>bBO;#*nc|l;HR24yu=K#+HzMEqaMY6=6Zwwy;z^E+ z{2=_%ho3}#_FRAQ;a86{m6PJt{kYPPQ$C#5Dv zi~G&XG6+dNY-vBr`cY1gW#obK@_tnC<1#NSJ?H)ZFNVsBr-~n!i!jbB{HE?m_^awi zHBZiRxXRKZh0^J2j#o&6S$^(aeu_^23(W+>aK1v}C#(9r5#}e4bm$Lu)_Uh_n^* zJO*9ci<5K^xk=d3Z_bFaraJp^vmagj=<3Iw`lc)F<~O}b4t!Aehl}U;Sl@H5q^yHn~r#taI_zHh>Q`AWr^va3q5cgHQsMV zQ+N3>(T@p!v-ZfYpHoiuhFou)`KUVooC(eRes}UMsd9@#FR08DB`7h16*8B0iAKU!c z?#By$yy(XUKVI|WB|l#F;}t(%rK|RIh|DT8|5qt<@`qja>r|4$*yzV5+4G5w%z%>> zy4jB{dcil8=X<#i=r_iEE4u&@wlDsejko>q`H^DzQ_cLa{0RGD`w>t>;K(ZIH(fa= z^{kYT)PsY=`2zF_hCv760@O5(>SethJ|UOztemZSTi1=qQ+F+#|GiJA3yl`$HS$u zw6qy^vL36I!_Az?`|+#atf-vu<4^hd&5x6`{C=GF<99#)@S8hJS#Ffj5Ru$k6&FUL zd^P+f{~RElVY}n{j~{0x`Nxwp#S5$^8a)g3E&NC0Pb+GnrUh6iWTAv*6s9mA^^R1q zB9^fLMJU>SNAoP|7=1Rd(9pv77LHqJWTCNzV-~)%(8Mwmis2ki zs5fb9p_zr|7Ft+nX(4JMW}%gZ))tmpSZ1LO)3tDig)x?Cp6x7jx6s2vdkY;b++?An zg{~I5S?FY;vxP1eHe9@TvxR>AmPhAX+VK>MNdB?%B7D{b+%M~Cp_he076x1BZJ`hC zyoK8=G%bl+Ec9gzii(MH3dtDuD#HF22GFS+2FjK3ge0do@*x(6TDaZ9Fbnj_w3uj{ zk{GVX5f)~a0;8gko<~|3rI#8lq=b=-wQ#3}*%t1%FwVkw3-?->Vqt=XyDZ#eVY1Sl z$b`6B*v-U0Nx|>7@JVS?M5VhLA(LhX?z1q}!VIQsVH%U`is=>@s)?6}(>$2O#?lY7 zlv~Qb^5Iu|n~cA62?z<{CMFuW;Gl!gA&ObqkMMSYhEcJw9RKNek;Nthex#g{Lj7vas61 zGZvn;Oi8YkH&zOB%dUZu|9T(RSooUu&B9s>wdBN99#C4;gy${1VBuv8uUOzKFw~36 z*h|7Cs^VAk^<^1X#+=kEVveu7E%`WTlm;QnsN(!EPP}kYawT0r-fY>3M|y&I=@1_V_}DdclC}GGQu9^ zjm}Ka8L;;)d|=^2W{ITVa&)16l8{xOYqr!YtJpDxrLu<)n#y?p2 z(ZU}V{$x%{qf2T0#I~m4)6cYBY}8Z_3nwgd(wjd%{$}B%X)c3m4d|0+LgZ4q_R3-GEtAV6oKW>!?h2a1|(Es^fa$4Z<6R^@Wv6 zqfr2j1GqbYdje<@K+^!m2QYz;T8wHIFkMV@l}w8OS_aT6fYyqCU;u3bNYS1L&_$$e z0PRHD3p)tu;idpOigyxr_TE4igR+GR_eqBLiSUd>rk`?+9Rw$HxY6r}#Ke z!c-14G74~4!1T5gRlJjg92Z?a5|abCH-M=DObcL2z>G2OlPjxip*P6?pfsj4-F7A( z4n=0j15f?U4&eR(HV3dJfH?uo4PZq8PXsV8fcXJD5-^_(>;x7_RXA>>u09aJgLf^J{rKO!B{GdqB<=L;IROf2k^Kg9~L$`#vc{_$pD@TU}FHA z0(d%rXB5Nh%I&kNoeBDecVz&p0$5Fj;mQ91o);m1PGoHW>qORj@~tEBg7}L8ycEF8 z;;#x{5z+&LZwTPEfZ0{#W4lI1!ch%hnFs0l<32BE2X6%MW&j@suseXQ0lXD}6+j?> z(G|=lGIwmZ1+YC}c2VCJ`hG43>CoX0R9Nz z&wx3XvXL7QEUwX@U8OhX_Ak~*X`Bg|q}g` zp8U!nuJSnRx@Hiyf@l&%(;%)1;@Ti?2;#;dY6np#h`K@43mT)rdglvrz4yAHIg>z1 zO1GdEL^Ux}Y)t|lAI?w+E(Labm zK@1LJK+ts1+ZJMA&@^xctUy~)14Dvl=WciqT*{`l3{?hh7Y-Bh1PFbO2x4UL(znT@ zf*9@bJAxSF@v%YN8N|3C#!E7RaR$vegu(eEnH0p`K@1CFcnJ5w;Jx#PfQ5QTT%ACx6!cC6<2$6V)q0yc)y?xxOWQja4SHF^D%rHVNr@ zv&a_KR}mBTO+9WE?od%sxGjk7o_{Xpu(kTxltQQ*f)zv{h+xok6I+{`6+-G*D2Q+n zb`X&uoFIM+;-s2YG>Bb6yiZMI0}LV|A^qn>+#r%7DNmjj$pn%0Bsxd=M8r$-hDT=W)6g3K;{)U;fZ|;Sh=_!lJ@rLdMVY)g?kG z8A7R$xwfK$Coe5hCWNvfloO}$! z=CM@>twU%dZ(Axu*l-oYYOsg4O5LorrJa;L~R;rI|Hc=EeMCJHAB?`AI`GFiy5_l7V< zykxciH&mF;!Y_^GRF4p5gfKINSs~00;gJv?mFN3~3#ANmLYN!EJUVg8$y?SNW4`Kl zfwKC5a{ge*e1yVkrD8m!mwlMA@&2EXSv+4HGMg+*_{tna0ZUbDRGwub?qH)xkFkn* zuC+a=t}7J(3n4tA3~&nbq{vetJT3B!@LAzX;VR*3A^oorc`k&to@AZK`VgM?BnPYF zMI}UCeM#hH;VZ&dg&Wv3wi{*M7{aCyZnRO~#^w;Vgs?q~x5LJ0Kh@C81>OjmrRg_A z*c!rHA#9_E5C()XklsS@g>X$6*M{Mz*$?5*5dI1w5JE7710fugZihk$hhT^Bu)fKP zs5yL)S9@wB2mc|&LWqZu2q6_hIs{jRpOl~7vW@vK!84L%L&$}&Oef_ELU<>H_t|#Cg&=K&y=gLD(AByi5?h$?@+#A9^##ssbX;owfKURLI1AIJ0 z0~NxzAsm(G!yz0AnY9Wo?&KNk#y;_nQ!kWTb!e(X6yVnk*P8bctXrxTm4dXfyX1-n+$7GGkuMgt}$!`?a z7dG%x;g^6^jK&hSR^&~DO~YswHX7bsk1d2Pg{_479pN@%v<;(O812JgVfGE9gQB`Q zj4ol^B;HZjDGU}eBkU}~jCED~J;LZ2MmPECE+0u0!>)0^v3}a{*x9f3O7-K}3nc-oK2xFvPZIqD3!a^P` zeupRF0VI0nZ=59e3CD*qLF6tWLroN!6vo}2}NH1u8~HNb;O~mM>}wc3l|j_4vFn{{`F&;x7tm#$Q$>uLxfaV?!9P@m&;W zK0?N`F^o-;P+{^_MjhJ{#v2OtrZi`(IOT7Ju}u z8Xt1*-&u9UbHbco+hIi5n#!2**hUVD!ia_u3nLyzB8*?c_%#eSjAR(Q!`P!lQ(?Rl z#*Q%3VPwLWKIYBJDJSHM6o}BmlfN6r2YP%@xHF7hVRIUAFaHH5Y=&4Ie$#M$n0NKs z_(x&<5XO&T>qDsFb;|z5`H4=ITeRRJ{2pF3Qj8FwWAXhw*#ZT${tNe}wU;ocw9D9xY zC(nF@jY2jG+n_6TfZ515y&^V>+9*aR8h>F4+Z;ILV@W-h67rFnT-HW88&}!5TEg-+ zD%q$kUO{-7jf(uK81wnR+{Tr1x&#?3Zb*l20vCL0}Xw6e{z()mGXZJUwga4yS8($+>hk@mJZ+}J^!O^GQIJK3hI z<$(l#M9hBeB=1bH(bdL88c2ZQTW_u80ZW44X^ZQN&Ls$OuW zjcK;I{)GiQ-8NGv4tQozm$cf+)wx-=DKy5(Vwq!OE=$SAgZ8C6xK{BZP}_{s=i69d zo7n_^+_hmqPRzNsw$L_*93HZ<>f*)QxhHF5iH&tO*0Tm}JZj@v8!K%rwXw{`(>9*5 z@t7)cxs4Z9gRQwJXM-(>zZD`+*m%;DJY{2l8{^6<9#+^ao6t_Kva#C68XM2q;1>-v zw%ZGvGe|6rBh9eZHoJJNXs$FqZ{r232OA@kv+ zRN$}K=8Q4zGyBkuHa5xsW+7AABJzffH*IVc=b@>$M79Z;I;VaGX<7> zz(&wUh>*YZG3CvsEzM!9GC7LQ@wmg%~6f8)pX`TzPYB{ zZf$68$@|I1&(s7Pzp6C$RW_GtKd(!KPS~g#F*oY`#xB6dDI2G4l#ZAY-S1u*7K-2x z8-MEYFB|{ZI46F_#@`}mg@4a5#(}@{HvW_3f{>Db>C&JW0_A ziisB&(y4?<$p}h$ei*7u1Z5*A=SeC>P+q)(C%G(wisJcnD~n$)yh2z-$h?g&glZ8} zR(-dFzpEm+I)cs-+#ErT2x>;qFoH%A)QaGmh}j=(5HXuv*G5pAq>yPx6ZF<~BF0eE zji8>$bwWz6kKhLJ8-?|S`J21iG&a}qHIAT31UE&{QP~(V%G_ewG=gRkG>@Q#^4Z?Y zZA+0>5wsR*BW&xrwu_j{XZTVbJjsEU#-?>*<|~^c`s0+_E)jH%;DHDpWJO2NJ%ZkR zwTRhX;koo4%0|zKxoCoRuU7<>2b&SsEfIr%*GE%s;;^_P=*LtdxGjSI5zLI3TNau0 zfCz?1Fd~A1%EKVxU@t#IA{Z)uyC)gOno^!eMohH#MogO;6~X8T?ueM)f1HqHjL6ss z?i9%n*v3aNA%eRkx!dzOF@i}R=jh@d@yY*3GDWE{q5C43Dn3m(T{y#Y*8I!9x+OjbL2_4@a;_WjnPk7OQMm>)n?`@Q7ad zQQ^}OERA59_+!E+gv%r5aNy(OD}+4f`J@Po>#2yj7nkH2NuKrODTt5~0On4-M&qcoQTxkZs^7z*x-w3~r;HW1* z7QuHO|6b(89Q+W$kIL9j5u8yu{H#Z2@|OsH6+a>TO?XmxN_bjGpTCRz5y79HQQb$txky>TlJJH=i4+s4ir-Pmj zdO7Ih;1&nd+M>5(c5=CE&o~*1CCP6#SvY;^M;W`#L4OAm9Nfhm7R3OS_7DdHl|yR& zAjh=L!45u|W5`gZ#lf(HVGf3~40W<)q{s-z+(wv}jB+qq!aIaxgkyzw3dae@3mJre zEJB08Rf~yItw~D#ZU^^>OlIxqfC`I_o$q}PraDMCaQTi7raO4U!J7_dIGE{RlY`9; zW+~wFju}zUrktC<4(2$R>tLRP)pDKhV1a{296YMpc|iEEg9k+x3Ry=FIhSr0U8GQp zg-eA08y78g@VEnN?=s1m&&M1r7w7Q+KCW=^go7s?JSE{u2TwbAM*Laor}|LtUa=^+ zpT%NikX3T!awVf(qsX6Qwel#4gLNY0>s96?FQ}Eh=-?#>FMB!P;NTSpuR3O1pD#l5 z$YOkrt}0|oHp(aEJq|un@abv}dmZdkne6w<@TKxN=-?17TNK5k_{70s2fsNu>EKgl!@)N+eGZN| z_}sx44!&f!c$rZcHacdBTFsj-P7TIaj_Ja_Wh`ez5fu+pUfCxm>X{P*vt9GrG=!NI={{%VBZ9sEh+ z;14NM`>y7F&rnZFvO&*-%ai*e_lr|=UT|<)h}U z?`3l?Y(9(Qbeoysq-Jv^RE(lh6jwx1C5p;X^VtGZygX`DlxFs388KSds!>y(>-0GQ z$(2!D6-BKmu8HF6C~8DeQ%TT?wa|xOYnC=wzR=8G8%6CX21YR`iaJqqZGv6dBvCht zdQn^#HBGE%6uqLjK5FDQL~&yj^`mGIMMp^}Y#2oc@kUWJj-p8vP4(DD*i6_`*j(5` zm>*-e5^o*7G~{M%ZKG%>A$j|#xtWAM`Mb&U(&z%- zF&j}#VZBE&HHzs`%#hPGHq0x)@8iDJS90WxiX#W&>?rP!VxhdviDGUP^P^Z0#XMFe z@BbIl8##XuP+|BN0P;-2ADtf3fdXG_cvTJo21@zEcJC8t0XA;F-_Co9BmbcYNDdw-rPc|VE+vR5B4Io7PF;k%>Q8-TO?NTB`bHap`jt7;ggnvhI zHj01PLivZqWzE;4>>TOmyj(A^{JH)k{4Z*Db}lkkGl7^{!RCaq0e3E9rri~ZnaO_9 z7>enUlHxIx@OViP8YSL6RVIdtF;t47Y|LmvIc2!Ku!4}OUnas4c;y%_kKx7`>c?MA|bBr+THUqjw%3Twr1jR@t}#!%bioY&M< zob_V3E{5wR=g^BW+z>NsTpSb;sR<2YraPu~kvEK?Q4Eb^rolFep;^q#!JF!l68^hi z^B7u4*fIt_wi41$Yx!v-9Ij>9_Azvb;iecmO2`3KWqzpA*1RT9wseY_A>ss%0b;m0 zW=4r!gk6Q*g!!>|&lq~eFffKeG4zh1K@;?0gfSd#W`-hEetz}VH->)s7w0rza}Acp zZIbjC4iG*?%OAs#7{{!+8FRVVWYD5JP_rZ|;&lP$edcOcLH5!#$pSvdFzLOcA+HI914081R_J z9y4ObGRzc`%!*;Q`2C(_j>uf$JmLHp7I>}?#PFcU7sl|A#~+Sik@#Za5>Nh!NKI+l zvKao0;bIJr#jrev$75I#!|51)kKqY=<9V1E>=>S;8pO=yfltSNZw&jylQE=XNV8$akd0wa3?E6(Sxio(Acl8h*b&3KG3=CtM(jO4wlxE3 zS|>J{U6eOBrTTshAE>2#DBLaN%!q19<>6?D|1U%%7x|p9+^G3-r3cQt7j!Y#RDL5@j(hVF9*dc7`V{p+ z&E)$Sj`J#7~UcL3YR(IJkTI~juCN;jAK;XG=C0exYohZ3+ICzisZ?d zIL5{?F^);`OLzWs;~#3rF)ohraZF&1aM&*-q3ROZviM_v_x@!jlF4!08^?O;RUA{| zxG!$z{;T4q)l8*gaPFpmB$*b+^f+e3F*A-?aXb;nlX1+B_s>? zj(Kt9_aNp=LZ=0BJmB#MMY#LG{5<6G#Ujh7*dj}m?MK8P6)qJr)N+x><5(fWg!p4r z`4pe>-gl*3pN``h5qfym^Pf+eZ@M~;HG1XeglmQCgvrXLC>HV0U*hKP7-;8d8B8w_ z$IEOf>__5wBaS!4UyWmf$ZNvag&T$Rxham#;#)ik4^M85n}N;VIQGTymiV?fw#V^y z96o9S2ZKy54l9lwal9KxAdX-hZXC%tLUDxUCmx3#Mz&0yn7*zcjSjrQOMtWiups~&Ny}{+waHmfh0_Y z(<>sgu{(}Ea{Wk1d4A@_sP;?pNgN-GP;wxSgW`vT`4e=MA7;r*@|oxJh{)%0eBnvH z6!}W{bsXP_d@DREJSO~3n2-5~IDU*{a2i9>_$iK`<2aST>4a&Izr=BoubjZIYzu1a zC)8Shi{qr%mQUr|avZ;l{Nc&}jN>nlpNZpdkDnF!M|dud^Pc>I$iKq>gxnn{ltAGG ziY8DjVHVT4*i|H9763~QHtSc#6Q*H4oG_YGB7u?#luDp<0wWU`l|Y#U$|g`dfjSA4 zOPHR*tnepLK4Dr%g@ox`E=!=INTmcW7oo7S$esKbc#$f?s={hQ`l+5U7rv1&s;d&X zI$>5VY9!3XbTt#Gl`z)nngp&*7-PkfWamf;dEEr+CD1Zq{@jh(zAj|YB z=pacKmSF-niFXw8r8*_h+2c2hl+=OVZVB}EOdEoWOzdxL2Ixim3@q zOJHsS^AecOB#Ocvj5!I+Q1#99>Sa~}v&HWh^22TBVWURE^AlK*zyk?0%i~y)i!D@O zI!)(NRdF-Rt45=gFykoJDJyhQ0*ez^lE5Pgq!LIc@Mr={6WEx*rUaHH@K^%t5?C(< zTb{skY70}i3Y5SKy$iMOi3FbX_){WJC-98Ov%;00>nf4e!ZpmiHU-Xc{Xc>01{=M7 zK4Ch_7nBOWCFBsD@xLhlFD3A@7tbpquL?H^UlYEbFdybH$mRsLBw!~HVU>->8wrHj zS_|V%y$Bb9x3VGg{AU8&M98-%@OA<|J^B*}iCDsb@FZ^mN?iIAF8Z&b44WfSKRo$tlp(FBf3@?GN6sxO6nh2shQkT91K{g}W{B0neaiwK2R>-uOS zm&JZdm`$#ea^ifAox-+;_&tF?5~!Or2JO!T{$h!__}Imn1pcNmfX{%k7c5xwre_4qxy0!&dD>L(7!rVJ_F~P66QOGq%KJwPAu!|xtin=J~n!y!^ zH?*9^U6k-1Dg0aKYas%$=z#TyvKx^{0w!O0TL?spg`(iz{7R<)Xcd4lb^CQNuNb+0sQ#7qwi| zz&{*=Yg}CGqOOa2E@~@m9oMvO9`s@j4gRGYCzAiyK_r=%SH}#xCl+XyBru zYy8lETkX?vfr!P+$0n{BZZ&h!T%@TY?=L@er4u7(ob2pcxoGX8jcWq7b4{60+uO?j z#8KvIN?JC)+NZoZuqUt*HSSp7caPY(M4Yu{anm)F`EVG;x-opTnu#0`6BMZ_jhrqzFBjaprJVb z1&{4?kc+{t8D|c0F_h_Yz^2>|V;yPNa=42Tl8hAI>td9P(Jt=LBMWwdi!mM_D{`lc zaU$b|%hsCmze{|gaFUS1yItHPK3PaxO5qgM{(YXGsV=5@e7cJn;xmQ$Q1`o-<6?=6 zM_kNxG0(+{e&+Av=ex#=Zd5fbaPfd^n%jde9u^^A=;9%976?0qMdEgQEOyQ8m>wQg z4C`GyuPiNfP4}@(_?U3H@NuRn!cOD~7f(`Axjg9NX&29kuX3^4#k1mcS}8K0U(JiG z_2kca@^zksewdBU+K^?ymt4Hegj{TL@rsLAUA*Svb=N4y24#Sq2+Ppn3gk$06&~#d zf16!wp{ls}$i*8j-gNapSwz>Y7_jOKRG4ou9v9nPyzQF3TE|7yh0lfGg(VNv+mJ{= z7!-0q8y2yJ5g{uvf4n@8F$v=?5-wcvq>GG5%0-%buA|_2%(}?QDIb=?cUe&wOXx-LD&)x zxH!nxku)RiLoPmHVRD?AG*;*^?Nt&LlSYL;Wdm_>#Kq?>zHo8c#qUb!OBY979CPuN zi?3bt5j}%{ei8rGlbjIw zjqQ#Xe(Inmmvk74Cz=0n@uytNCh?a@nWS;zj^`O#6?OqG{!u{{;Y(=@c24hjUUpWR4h7vlR_;jnlxs%nBpleEFml@EF~;0%)d3W z$8tC^80D0u@<~(>p(}rEN0sE6Ck-kmjoGL`%LP{{>Rm zTFA%YtXyTjo%af?9V#3DIHpfK46Te#Npw!4OA=j^xH)MIH9rKHF~a=mTXl9Q#f%Z| zmNYj6vPpJNqDK-vljxO1?wf+XJ3UC_tb*YHe>&O9)N2jzKT5)X+yEL*6Gqh(D6Vqe%=Lf~83;OJYKI z^Qi)-66`~{q5OCfE0QRYLdg`KNaD#PUP%X8 zE@_sy>G~Q|Ok!gao08a^L^O$55?hp(U-*XbP2pA{hbwO-u}yrtCwW`MN894v$7@Lv zNFpc_5{8AgFd}q>`B3pB5=k78#7!cZ#E0T3A=BNFMB3vSk*qK$EJ)%V&-E<30P**P zJ3aZXB;NP<2gysfnC|u@dqh4G?iKD!V!!A5vG;ZdlQ@*bCz5|DJS_aw^ZA*`5#i@a zd?CUt@fG;{N{?R)zoDrVq5NnP$2?BY-zRZAi64^qF^S)jIGMyxN&K9|uQGJ`^}}Dp zS&!@&PN#h)PVI)y1I+?PU`6nLih#+0#IWm9JK zTP}t2DO5<|vXmLeUY9~e5%L-$m4ua3xIBd`#H*xGErsghRfP+x;z|*Qx+;Y^B~4WP zUG2Hn^jvGDaEWO#dSdoYS#c%Ljd1F%jlINdNuhNLZBl5e$7Vvxo2Ssi<1JHYC7%C&xoryVQs|jNFA3WVyQI(|g`31XrqEf0 z@pMXEy2<2bN%(01g2-z1fiQXyGDfIOuee`&XFrR^ba=JBz+eG^39~E{` z3WHOaB+o-6ACY>6 zpw^|Z-fMCB#!GLMznH>HDZDJFy!@5_!(SDrPbSK=Hm0yCg)J$(!Hkv0=9F3R;oO{W z%9%co%)OaHLCX9EIR|N5Q+O+dZ7FO|p(qFWDTGsaTihq~3+ZH~%pfq3LQs;;U5tNQ z+({uS5)l^T%8y7Q1(($)p7);=XTWR!ZX^1?KOJP4G+juhTyDW$Me zMSVDhT_OjC@2BuV3LlE^N#Uauc8hl)@*HP$$PO zz^CHu%0Cl1BIK19U$XjWAJQ0@#@8u)!;xef_0#w^g`+9_k;0!T982LlmHh81d@mi2 z>6|vl564sZf%ZgWi62w=N&IKwFT!7iCxrC&o5)GwsT59o@?Z5QdUd(;o5GnC%B4|0 zjlZRtOzT1lXQ{w!^1^e%^TNgY%e;S6_)m`)g+WENMSEOG0(iL#m%l{3+ zHEm4f4bo_sM&mS^q|qpC&M=%DWO^~?e;QYb(`ZJ|4E`oKp=h2q$1vKZ(ISnOX)_UM zl}4YbXp=_kv{@RZq%+TiGq_yI+o#bXjhpnoUDD{9M#nTd>9Mo$<}~;Pu_+v_y>v^X zdm6pv)FX|aDwbYCUjJ3Cy14|5h4XfG6QoZXx5#H-Atn7t#5o1NEo~;bpJ}#ojEgp9 z!9%%&(&istXj`W6BLUZQgncgXkTHr!higq;Qmw?>;(>JH*Eb#|rNh zjuVa-(&vOU?(+D=G$x7P?MdztnViPGo`eTTrl!q5AUu%9gK11lV|p4h(wHd~Vum@l zs@ejx(xwNToyPrX%t>Qz8uQawkTwUi&lbkKwAo^&&-t9)=XbIq;pc=T zYtvXKzTT5OFY-bfwH1V;%9mMI9OtKvJ%1&QS4GG-$R{h8Bgxmv)e<)eHw(A?pSHO* zjknkabEurdwlubz!0o~Q9n8jezl3S+{;oPDQ}5O;-1VM>@5W`y*aO(Q2x>%m9Z(KNaHJ-?lcZc zVYb%5muVbI;}hw_VO7xQX?&_jwx-Y0IFjd8O>_G~9$1OPxfGz;I&~m4*sR!dmFZ|2 z$I|#NjqlUueoh{diWI@&nP%l}Wg~N5i++CO<}dXmgF+enoW?I{Tu9^JG=8PRw>8Um z|D8N6TkQYexuGUj@>>KQy(3{^6w52~6$ zwG95#t#Nc>iE&Itt-Csd8X0uUpnC>2GpLm@Uzbok8}TCHx}^ksG{6dTx+G!wfoPa8m}2ByTHhETo4f88r2HvkaPhyoE^13|fh_7Pb*~ z(w;TLw#%TsB;?$fBX-o|&3SLa&KYy4l1}_}$)Kx*JZ!_q9vSq^U}y%nXV5Ey-WlAM zLH`W;up%<(n?b*fxjLXoTXXu3`o_T?EBDrn>7+KQW(Q<2FoQuE49^{!5tZl$zW6lqcbK{%l4*%HfZKshr^@{X3a4- zIgHETPHrk_sqJyK3+mEc8BEOJ?hNixW-5-tqzwMhf4rWRPi}KC^~o9B%Nl3Dlfiu% zOwAa*Wt$>S6Q3@eA>@c?rpR~gFgt_$GnkXX+zggxuq=al8O+b%kqjQqnAcp8!2@h! z`sXz&`GZp3g&91g;(b`SNSNQ?UM#+Z@1lQKp~7=eJ*E&!HpF8YEYINO3|`4#Uk_8r zk7vxmrxh7Ik-?K0)5K_pS7z{(I3J%Dc}DoG@PPcR${6dtTDV5|Tn1}JC|{SsdhzEy z$qOPc3SY`xI+u8Qi`hbbHG>TqyhbPL7}vP6X2F*GXd5%wl)>fJ@21heEmcdWdIyrrp!EurAg*3%1 zjUU8+6f!K$>@OMo%BGRQpBbFU;5Rv)R+dhRpAzy|4ukWH-QV@dZA$(q`749JB_TgU zd#le(&SuQn38u(}@pE!LpTUI;{`Gto%i=%ri=KoxF%`<12n!2~2#X5y?^s;CgpgNt z(Pt^~(!w%A3d?3uE^8Ezyu5@JvbfB1t(Zk6k5?ACT*!@ss##RaVo(-?v!;zy&*Hi) zuFoP`8dqjj9vuKh<)2uPY z&9Z1i*DRW6(L$1zS+vTcbru~)U$Wl3K7u~;#=ITn^44BRdA?J)NspiC$V#UyIx{nz zo(sDOy9z1nmPL2*9-gG9NH5`X?dQ^ja$SpG*!5#EW^r2<{rNf^d$h&ucIIm=o~{{? z#aHvqXCMPrKEw5`;*czcW^po$Q(4@e#jq^0S>&=9p2dhPUd-a9EJkKADvNuwn3Bcl ztl8YZBa1Q2vwGyQS+kxtA&a}RxRb6~jF$xZ0D(wX{w8K|kL2W&vbfvhQyUu(le5T^ zcbl2`@8e_EoG6|~^kSQy#f&UwW-&`nbbT<3+2Z#L=LqKt=LzQv7YH8^=5w`B{2?LZ zc{qzj9$%cr67ffbk9zWoaV!&mEQ{sTD^I>EixuKe2%i)_C45@=jPP0EN?|?^tHqi6 z8jaZ;1^oLag7iXiFp3QdbEXn9fwWT z^O=t`t{O}TU9aAgS)@Fk7Rf08REB~q-pS&ZEPl;mM;7m9@j(_JO84H&Vwb!zlRG_a zd|$~iEoOVS7w4B*?8)LIJ?_mKdw3*^eV*(7EIt-L;7JaO91?z##bJ?8g`WxY`pI-Z z&*BS7m{khDQaMomwa7PFd@FL)lON0CJMr&@$Av!#e-tw8Pa;1H`4%ViF24y`rac+nh+ZqH$G4nq`bsQl+M$*4#ekYt!j zgJh(a${jh3%3-vZI(^c0jOWUXo!{nsBjDLzX$Tgb8cMoq@M@vKx1^K;mm!&^Bl$l-w; zUdiFr93ISJVGa-F@NmvtBft-oIFl`{r6G=>IFebEGsA<$IV_=~=FDv9(Hx%4;VJQ@ zIV{WJG4bU&GhL+z{vMZPh42X>C*71kox?gcgl8nA`-`C=iMCMV-5>I3&X+HPG+wFb^&(f@IIaRe>6EWu$f(e4;Ah19QNe! zQ4V|A%nMMz0Q+*-pF@cPlq|rstzC3aZkQ{iVqes1%H z=lV?!Uy6U_Nxt^{FzmNE9M$77s!9&uiyzP72hUIb104D!`I#l0!{0fa&EeM^PRP$0 z;cq$oE^<;x|EEMw=aBz==?_o-XAXaPe9boSukPsiA4&f6BiHNtEEkDof?b%pgj`E?@K z7vKg@!sHqhpkV>}7hpgE8Wo^%0d6Wl#{x9*{In`SQ}JfP=AOJo0a|)IpR3k-Y$I$d zY*&ExA{~SSRXcp6P6g;8NoV2BLdv@opsRSd0(2K)%>OH^o|5z`K<@(le^h-36x77` z^`$DkO0i=_x`=`el%J>wid1Q0!2+TnpmYHRY*+wAK~xl_ND~W!4P|Sx*<_P!0qlwe z6~r!J;k$E}`1wC4=boE4B~#wKnaoTk-D9{c3e_`)9^!{eFNQ1rQ<4<+j-gKsw?_W^ z#xN*`!7=oUB>hDO#Bfz48Tg+VhQx4v48vm>8o6E_!>|~xiQ!sFt`q)Ox0#n4Bpe~U zQFv1fH;d4<{0ZAg-QFS`r6)G$;41PnI)*Xgw+qJ##|g`2LNj-63HkK9Vwf)e?@Z~;819bY9tmf~@Id5qw#Xdey)oPu!~No) z@Y~YLraO30w{wLL2_F`g_u=zdkH#=h67u;X3z*Xw9v5F2!=e}#$MA%1pA>ejVA|tT z;!g{CyM(5%fw`WMmyCG zAH&X=+5gP-Yn!&6jp*RPjMC!>vqD$s33Ea&>9QySb^$TuV<<@YSqw!HI(;lsieXzM z*&f3V@ed-&haw*d_g6F#eiFl{|GA~)bKQO+Tawe`XfJ+7Bxnc`DKH`0a{o>|Fatzf!ZpPju1LC+!PULhN6!F1v3=tnHygF{ipSyLA zF@0Vm;k9vdVh;y(lw8j$lkf&1B{#-#llaZT5yFv?>n(9}${fAj8pmyMj8?IX5tiqX zZjYM*A*VrDT;t*xAIBYW+!;qPj#3;G;+Po6k~p4@V^SQG<5(QWQ*lg*V`?1pnDI`S z7B@#L+#ffu7leEx{ag z9LKY4{&6geV`<#{gYUVx87(taqZKDt#$Sk=-y5xpo3S)C_Qg1stI4bovIVV-ADW(h zNea0-jx}*`fW0=3w?xR-v3-fZ97#6B@rwAXk>s^FUXNoVwMddpacmah`unvU_Oqxp z9ZD13g{uH^dMA!|#*MEtC5mu&dA z(*N(`_@4S7wS^x<_6RwcFTXEyqWdS-NNrTs8XWf${7SPQ$IS_hNZ|K4{)pp@1Ue+J zFK$lou9862glR1M<2VpEn?U{){w4fd_>b^loaeC`4;2!qBtl+MgztCcmBp{CU_KUO z3q34>!xN~MK=lL~CD1s58VS@)pl$;75~!6hFV|dWe2G7%PZ$$jCt-SgYW^^q`h*!L z&~RL8vg{2OW^o~ z=@d?qq?z~$LJCh5p}{;^t_*UD$f?5S37jTU-h7o6rm}g zkV);8F#D9QOd#xr-a_8eq%bdYR-j+P7{>ky3`m&mC08XdFo8h{3{K#h1g=eBNW$cF zXaZM@eA5EMM7SbMIWJ1CljQmYhKu}D2R9^eW5S$xbCV=ILxws`&vYV=4@wP2 zB``XHF)R%lu>^P=`fVzfUM+EZ0%H@no64NPr#$>WVZJmRuN*Do;9rs7nZSeuCMGZ` zfx8lzp1|Y;rX(;eVfrIp+%z>cfgS3eh`cQei8JJ9rmCYXpG8d`V&*otSH|oFcCwTb zW_6p_y(0Gs?-xFhKvGWB)w#;iL&Ap>ctnKqM-!MQK3}*%_?Yl<;X)yOK9Rta;){ff zBl%N_=+BP{Je$C)3A~m7KW$hl1$!ld=cq7TUzR>E6H;$q5P4C!T)0BGGJ#bh^z)L) zYT+8;TH!jXkjTrz4MO_ort#X9!Sh3C3SLiOV*+m|4cr>UN!?9K#+C#&E9GyJ(3tQW zQx)&q3A`gh$-9b>$Irf}AWZ!GB3oIrkt9ydjCeAERKy*w0w-W6kYRIUgh^CNnkD9} zbm=|7O~6YaM@35D+XTK#AfVdIm5m~=w0)4kha!apiXtT;YhjzncHs_T^$Pe%=PbY0S6NJlPX=oob=eK zBK}g#`dhC5h##aTCyh1WRY8QS(v_2_l0+eiViMz9n;%0|P2#X54o{+567MFlC5h@u z)JWo$BwkITX42F(liDPST1lggylRWoNusVuy+~ePq=B$u5=TVxMoBalU)A2k&@_o7 zlQ=4gqm$^JM4u#%N#fWf+9z>_(s^7G$0yM&X|$1c{sak|3r`fDBxJr$7CA+DYSNr> zQO@salC(&orARAb>m=GF(N?_tCQi@obbGpxeOw1Uv~v<&k~mYsvxFUmorDZ^b`s}^ zpBqWe6FFbVaoPn*Tqxc%iLT7M_@%;&gx!Rkrnp$-5+P$|RT8`F_Oc{;h_HX5kR!>< zlcs;UB8gs-Un!&$YqoC^{gRlQ#6uGHPvSO_0ZCjXGBAm2MFu4?IEf+RLxtrYknvod z#4t%roXJBwBFL{x;`$_pCvig(HzsjQ5~Grbej0m|{NF4b5rrKYxiT#CNW3*^CRIpA zCov|8+vW4lBqoTAO=6tLc;OvFepgQaye1|wJ&74fOp=_E$w^F!_|zn(Mf|R$Irh99 zYNmt_Byo4-dXLDgBxWZuCy9G?dtVaw|0k#A36QcPJtz-cO?WtoN0N9di6u!qD&Z5t zc|tyJzQ_XMW5UOiSSa$Zrah_KMZ(3@3YEswNj#Ip8VMQCvmz^mONGw~pBFAm;)SFc zO}(hwUrJ)NI7fPX(Ar48E{XLKe>sT_5oaD>OKL=yG{dvklh{a2 zdlYZ5dESmq48@l$egz=XXN5T=k|4gF#5*EQC0t+M{8IeAB;IEm;eaFwCu!z$ zVo5VziYJjsA}O9u!eV`i)2TsA*y0&smrln2R2`L&Rjb_0BcPM;lE}#@`ALK#b6O%u z;^_v)Qt`?&Uk%JvN@ANH-6)0aN$g1C>mS6pM}r(oe3dkV7QWZ;p}Ug!Hi_?&_@4RI@pOAmH=9LwC$T4q zf08(;NBoe)Z%O=~#NH%+Oq%m6xNh}R5Z|_7sdfr=QmC6U9(c>E92HL% zs-H6Y(?CelP~-?9-^&`O&?JSXDIA%?(J360!ci&n(sV{uvje}0##+awa9j#)QfQkp zUF7j8G)tLolyBLbl|3Pa6H_>edEwVyDKr;3IfYY1C}da2ayu<$dX1JTv`8Il7i`Ov zv`V41eDYXJdgd=zsGQW;7&rf?a0YXf#v5sLNa4&B-bi6n3TLIzF@-fL(`T`GJEbrp zg^?+oox(XOoSVXVDO|;*rf_}=om1$WLO-Ub0X}boE-74)!i6cLFx(<|MG9S2!Yr}> ziCiS?mcqr6{E`$d74IHNE)(gILQj#)BRQ*vuUEZN2Cqz^w+MM35w^bmDKl}z_sS#I zVL-}k#$z^@4Z@%l2B$D2g`p`kW>{1O7YsA=2^`g2&EjfhS}x0KSPIwB!@+~s3Q4XL zxju#AA~!_x8&kL`;y0)8kv^}uC52H`ycBL@JQeY6YqRorWJQclVN445rEouss{(FM zfo=SjHs(QNQy8as#z(Q;A#!I56GSGaFe!z};xi*ZQ&N~JK23O6B%hwbjEMiO!`$vp z;hsn`OJufij_}@;*`dv3JdnbJDJ)6h=@jOs%v$oF5g`KO+8ZL#?IRzv;uuiyM$bR8v zkqykd$g9HFBG=d1BE&f;qUX(gE*oGPC#CUL3U9L&w8Fb7ypzJjN~X2a!t-TeIM)K0 zg%sXTVQUIMq_8)ISPJnJycBXNBvMGGkV+w)GQSa_{q*`9n`Ws5Mw|m%7K1O0%eVxP zg2T3^rkWLTQ}}SIk@zVDDSVp3XN;{nLfVRr_$Y5=^Q#G{UsD*{55MUt%*F31 z{2?PuzAuISO7MXw{ePzLm-ye2gsI}c9yjzgvDIsd3Tb0SE2dE?jml}G=Z6Waq){~u zu3uzVnjcA1&g<~B*=$TwBaNEmX*5#sT4~fyqfXlNQ$N$r^TR`a|CKgsTrX`jq`t6$ zkhcxfW+MR!|9HrK>`Xx8w9&>UX*5ma$TW^hpUo+@mf#%Urgg!I``q?NF>uuU3mBiD9moG#v8c!scp z@J!)ZLdMfEZ9Xd_IVX*C(^$*W;Nb>ooS()h<~oheX>>`WUmE?>xFC%S)98~%-!!_W zksD|J9>{|Ip9=GTJpUn$ZfRVcHl52QX|wosSsIrr`;>G~gS{{buO3Q3&onMi;|iuB zjVl$ZcN$gdfCo!fIn@yQ{JMfUYdu*VH#ab!G7U)Msx$_sF({3RJZ849S!n7?n+}p8jqzhJ&hS@Je0=6@;@_e+8X^Zop&qp zdxW#nm@Pv2oHXtgzb}&9FY-Vd4~oo<h5#=^vyncfbaE*2Od8Lou{4e6 zSok{Uhus#Bhhl^@lFzfIv?qL78ZV^HNbg1Aav^V5h^$OwmB>qxe03UY#3$*1<#lN@ zW?L^Ld6_06;;*FfYQ$d?d0kDL-Zt@;`fTAs3vbf+Q|l~LweWTt??_!!X}p`p7TSl( zrkTH&#`|f+(@3OE9c@h`mNq|2qS5Bd0&9fbL^6$SRnV~}dbBa8qj2peorWcSw%IOd z`O{b_<#*D^vUQ~4rSTI@C7V(jei|jlkVcS3m_|O0LfR}PZ?BAr)lEg*-Pa5`imE#{ zSoX8q*@)8kA&tFhe2~V6YH{Dw7V+b+v`GVN=VMjJCuw{t@>v?+q|IoPPM=HiMH)Lr zz7&2X{8~sqjVfT5?CQ6|?}VMW;s)$i8zJA5J~Yzcxadck)!db+T+@XW)|#zI^1b{2U1x%S&T!_nTt85TNNMrnDSPge_P zF;ny`pB!lMM8UI}01M|@<`axr2M-PcS~bKiH{m?X{B(fD!t`{u&_zMWJ6w#e7XD|U zy^S+$Tx6k}g+?|S+ql@mB^K_qFu}s57P?!w*}@15ms#jx;R*}AEOXQwKXah9>B;OX zZTs|V>|qUXC9~fELoG96>}{csg}xU0F@DbWTNr4ezl8z1yZTFblz^Sa5xbr!DI?Qjb>irf&nGGO!Q%ng39Fp}D0VZ4Pq zSUwhb*xIcY=Jqw?!(}R&+f?$SEsPOi`P^<{tc7uwnPTNFFE$OniEs}Ir)R0X6D>@# z@D>e@WnM5R^U)S&S(w6N{bORbg*i-;wCG+7_gQ$r z!h^DMkV&6l#xx3JK{6BZU& zc#KLeAy>PY9rmj1l%KS)h-I!8_k3k6w(yjNC91U@TH77NPk=3>htF7e*1}Q?&skV* zVFjaNmMy$s;YBr{N<0fre>ORZD}Wk<5qYh&u*$+qmiYjaqy4#D%hn)mwS_g7XxAzr$jcTsuqEnyYFgSw+?HwKby|2ns~I+0ctZ)^Y+)0vK^=1#emi-a#6L}RHpjIw z!S^14cPzXsWnkOi!c1BC&BE^%-nX#T!Y39!wGguqx8PdvEYkrcELaw73rPzpN%((+ zw1rp@p8+jT61?U`}frP8;}K*{ z6~46am4$EEqIDYN*9uF{P%T$rm+J9bHpUg$r+E0P-m5D1L{{`i3qL6AUOkaM8Sp0y zKkN1v7J>+8w3r57B!5`gXQ7IXsNCQ_B&lJerj5gGREs=tX}G#=It#u4GAjD4Wuvx@IyUOssBfcz zeMnB%dbatdn0^|HaHw{K;-QewqMTDA#3nYH+Bnk2Q8t>}IL$`&AvoFwf7;%iB<1bwL+^>F+h&cD-4< z)5Zlh&b4u#jq`1EwoM*+)Z3($=&;&E%P}DbAvId!LK|Ie^s~{Q$z!=yHzSiP*$ddl zs_^Q@ULfL^*tk@@yYMpGG_fASp2Ew86kcJYmpHdr^P=_Zt&H@s(bv|%xVp&>rxaN1 z90<|44YV=H#z-5t*cfbM2-9q1xNW8ghT6E+Hp3FC;?*{W*+w^bU1OWcNsd>qQ+haF zRjkZ~0rq7!chHo@OESmHfy8tQ} zR{?}eh0jszS{dOBHrDmTi#C?qX4ah%uCTF^N^WD5ja8~6=9Ec#$u{fSt8J{Yv6i89 z`-*VAaD$DPMd*!tQL1sem;(T+y@apR2=Hf!;_Tn)fv%gSS62)+KOSZIylLaDsIK3( z@lM1!2Hs-hJsa=a*lNSd7(2#ZCPr1Uk+cz)%CW?T)70BY+jt^_Co`~E_%>Q)&^m*R z4adgsHvX`Ywc*iQ=LE&uK}xpOcknW2cQRwed9-)y9|d zz#w0V@H-cdR~dX)B>$EhL1n{t+t_2{CmTPrg7oeG4>tDN_|Y~i6pVr1IItx7B}&_G za{84`MjaX3JNw6dHulq6W>6!812+D&aaab2XYdz|r)|2x*$nk>@Mf7q>pLf9aB>ExWzZsnQ!+R;gXS62NwF9? z&qm}Um<5uSii(eWpo8i6nfEpsw9Vj#3~tPzT?VITFd&1gGH5TK=V#D4gEKPdpkg^Q zgH9Qooxxcdbc_n<5wKr@m-55;p~2Hi5aID@Xd zRgjA^rnnf87p=-A5?-1?cad9F5gY~a9DY8lX9kyN&?kew8C;P;uMDotpm*lbh=nn5 znz5X!f3aT%{S_61vox6Z9sHImgFzV#SB(tLU`PhnW^i2wLo>KqLe}*#g;3 z?HP>CV2tFHFok7h8~2|_+^I+=WiUBoYI8yc6XiZ3|?jvqiXT+2jN>8yejgV@O9xvA^p4| zvPrmE_-5wNUQ@chEy+8=cZFMo?`80Q23y5r!bApfk!z}&NApTXw;WM$tirht&XMvU z4kk4tCr6kSx(tSL_QFHDEvtHv5*G&vkX30 zkuG+Od8xA;Uu3W|gD+_tGuV^C4;g%&!8h{XP`~NqycYZVT^W3N%+Gm=Rzdh2^u@B3L6F8P<0UY2cutgCpd6ROF|TNMi?0B1uz` zBZXUaSjW*0j)`24b#Pq7j~C$)A52)SwO~=7tdE0Mjxo`#9kg-K)^wtePtw^!|@)U)35%#r+&JHtsJR;NU6|N(MR@B+gy;yk(q29gKA_&cW3V zhB>&#!L<%XI2h^RI+oiYT<@6I84f|4Xb?W!!3_>>ba0buoM~Wn+$_%6$hj?_yCZIK zFiPsgP`5g`%`t1xROZo+v14N#-0u9JIiK;$#UjV77Tw|CP6rblOmr~U!9xxvIhgEV zj)Qw0OrauiqQk)q2UEp)JI%pe5$A+6B{Ln|Bgx&uPD=kQ@!65j^1nImb8x?d2OM+e z8w2tx2YJu|Ntr+FV7`L|4jxh1M;*))DZ4V@V-6mtzDf9RJPQ>kAN}NiJeNN=c*?;N z2Twa@__W%=8VAofc-FyE2hTa+iDXpc=UE+9@Dj_GyBt+M95B4V!eRu#WnlMe8iqJ9yc_>kc+L*x=w52d_GK%`vZ~?0u?M$COUypEBE5 zn@#C#+T2+92F;Fx_Z@7KUNIw^m5euqZwcRa@Qw&w-xb*+qnl>GcR2XK!8Za$~(s`Cor|Q`2;713)$%-0}lSAea@mr)@-i$%R$8~DrNDvgMS=zQ28+aX`&VmIzZO+qgiy=}l`aHhJJc_XIwHp-%L7AIwKa@Oo~PW4BVEShFbCrDRbM`lf- z9hJq=BF6}i6;gg&7RQS>izFvxablUbHvxk>=FcFfWO1spIZ$yn&*HQ!T4c=&MWw37 zTg$BJ!q_{v$)ar*JF@s7i*{L@o<+ATF3zHT7H2TmSzM4c<<=oC}EY9LB zOD}6?`_C1gEj&lauNo=mbzT6c~AjBbxCdS-EX7FT4^D~sV-+#vat!fS=Sg?+N@G&9f^zcL$PiFCKT z#WRt-9DHdO&q?xpB&W|8vUpKBTAsywS-ek$$zo*|tFm}0i`TMvJ&V=U7B25*u_22! zS**=sog@^l=To#_h{ls9krHl~<~ zgY$YPi+3gYv9FO3xBSP$R&hrd6UK!JVKR%92m_`?ETJvT2s!qksmU^5+8UjsMOupj z)02fS4^3zavIy0_$n#l@=xEy76wUjUve+gY#StKLx1E(z$$ZQ6VHO|J7`mwH;$v1N z8)+8%v-mWN&$8G>)0#D#A3o1wXBJN7B_Ga7tg4+OFxB>$s+(>$#|_TT1w7YS9t*qk)T) zq!kTa9O0soi^lRy|3|xM67i-kjubyiSpMw#81Z8xKgWq2@1mK=3BnU2*ONpz)ZuB* z{5FImgj1El=C0Wm%fz&F(aOc?F50_bp|y5R2h_$j%VD(7ZC!AUtR0gf&rR!^9_@8_f)l6>O&b2ld9bJsrjgh<2$;H_&t}LN<3Fo*t*TqX7R(lv$0q41R*2Pj6=ey|a znn!nW@qmj5U0k4|yU;~f7yol{k&7`dZgS1jR8iMYu zg&{_PFLTkuH7ngcUGVLX*X1Ht2zxO-BE5xug!DuI7gRuh7Xw`Lk8du_aWr_9Yt&;O z$N#KTt^%v{28$07r*N2yYg}CG;yTxyF?d=_)9yGHx}HVKweQ+yJ6T`O+`70y&$`jY zO)hR0A0-?SrD3FtTO!VlPq&KS7D+~naHGpu7PyOhT+DJY-o+g*rn{KIvh9OgtKd%8 zjQu944Ef?S(ZwX!bm)^^Gdi6jB$?`Bn)qFjgo`^fUEIyc8W5uCqAGsW#XNc7V1B*` zHGBcfE#i;6SSbF4@X1KN$i-sur(7%%;mDJ@>#EcKpK;By$UQs`TF=e8X728JmVk>F zB-!BN73#B#<*xZ{I0%X&&c$jMYuH-Xnwf{NwOLGG>%y&ub*_=Dcg=w9 zW#OGIHS_P{H5VSYcqu)vyV&UB4P}`VP^VSLCfBTRZFbH7$f!kcx_HaQ+cZ8dVlLt? z-gU9X#rrO{(k4_l1;}Ni_vC*#JD2L_#37D_*u)Ypl5B}C(zGx&%+^h+2V308zGn1p zxn}TbE2pgJ3>8wV_M5Al>0g(Lbdhu6v(&%&KL2b+=X zmA8Rhsdw>0ve9ZUX+Hfcu5}Tr-7EA@{)48Hc~*{~&AAL)(J~ z|E77N{TK2POS!YUA}V;O=$S9YDv@ZP{2WeHN}sEGILgD(o~f_HJRI(!nuqG1G4FMR zRL&Y6YKqqq(y4aYsVeG<)QjZxMH+Z$=-~+QM#3h-#zM}mF@~ldj@0eHGl9o=XeJ3= zkM(ezhvPl7mxg79Lu9W+kGPht?k2 zh|`slfAR9_INdWw=3)=+J<}(4;@>1$8e9eTaHhyv9y*G2@^GQZ*}`)?oa^B{@e9fx zxNFEmXYnq=@+lLHjT?=+O7cJ9MZ#|X@pGMerS2Xs^Dy7T0uMbr^z<;!!+2)L!xbK` z@o=q&UY==;Lp%)iaHWUd9{PC3D$+n*<)N=QZ~J-ZFFrs>3q#>R=0!dSc^E97>|_Qu zOd)$izFJ=GnJ*TH2|1HCpTGW8VNyM==c8%-b$f${8%1ss-Y&e^!w8X)Le}FgBBMOq z8cA;RFj{0e5(~)5A;;cYB!NVWMYVcxQNKq4^xH|Ei8AdzhjiQ-#x5 zXgUU#QQalUbk7(QUbOss*WexxvnZ)x-soq0#s+e3^kFe!qtY6vKla z9u}D^WXun-{55O+h=)fdoF^;~N{JiWn1RP*-l3P@$2~0c@PvmaJuLFD)WdTg7OMfW z4L<+=cWAMfE^58r#(?O}_D_dFCl6g|A}VXFtnL)JsgL)?Sq z!Dc)|^OpD|!#V-UXf@VSRCJhKyzw?kWDr-v^U$ydTJ)}t2}A3f}1ZMHJsjO@_U z>G^=xZn*nmkB1*T{OI8)HM&8qu$Kn8f$8h1ia)dT+T(8z|9EEP`HP2NJ^be3cMpGf z*ze&0>yBBdY~Fy_M)+RCYU0rDPtSbq$XT7g*sS>HIGNUiYVSjG7@7lesE|X&94h6| zAcuxIROT%w(sQVtLzUd2zN~5vhe>|8u$r*Cutv^wc??oBcj({fbrh;z&ZuHt`6+8` z{jywt|D^vTayTuA77Ud`V})%Z&&TJ`lwrk>Qjm7i_M>w+CWm7s=M#?;;dTN>)hve- za^PQtnClZ2gu;_@I5~$?ayV5!DPafKTs*BFwq*{ja_Ex71v#{qykq3EO%83v+vRY2 z4(-Ly5}qOKki(fGOaMptjGPzq+bMVG_r7Q6a83^A=5U_8(UoaFU%Yc9>Ddn#=Fl~V zUO8MT;s0{DG>7gvT%_A>!i#gbBr03B;?wlF%W~)$#nVGYT~5R0Ib0z*6H`tSv3CxA za_B4h0F_U_C~W_z`snQ{2?ypdNMvy2hsAYu4#RR7p2H0}T$97KIb4^+^*Qqi35SRr zB)6)AzbhF1XTzc7#vE?SVPp=skhkJ9lFNgU#EMP`x{Bw9Hhlg``Aa`i1 z#)CP`%^4%pv${cMgv-11`AE*pC_b9QJh^tOZI-Yf%i-}HUdmy04hwU5B8O!;yuipC zm`43%4vTVFtTfMVY2L-2it@4~ho>X{Ob*YAFO4M6i99cy)6zWmMLl#y4$E^UW=3_- z3ardw73-^kiJ99un9emhGX+Wyuja5ehjlruXOK?VKsnP!jm??UnfSuUtTARHcQDfb zYdO5Gn3>a!In#%dY-X9{P{^T}!&^DLor9f2CWm)&csGX><8O&AIlPxcEQfdw@3Wj0 z=hmFr1kN|Ia{LJ;o;;Z|TUJcWe4_R|q;s$oYVRP-Z3Ra@{TzZEvf^$IUJlGGcO~U= z;Eyu-aU4f4-2IZRh){lL8}m7HbP{W%l*6_hKFQ(J9Jb5#Lq=5*JD5)G0{wsuM|)#F zlIzDpriaD&85N8+His{B_&kR%nE2&ii*c zd@tAC!ac$tggkhS5Be#GpJ|JHwDa*x4!_b=`e@?gH!0+wIsBEw@3c8N>{F-%NFO^id0$2V+<_Yla#f-jZ6kl5vQCr zdzz0HKHB(LzTT8WOF6aTt@f+5*6ncZwqihP-RVBs`{?VVpN}(qbnwx|#|1vl^l_Gt zPCm}|(NV?4a^`cH5e7U*lJk6=@8ev>$xSk49q#O#9Ub&DPiel;M^_)0`RL)By#LQf zHy;-($VI*hLhZdov0W-512W^?X|mK3%Qe!|#}z($u{?dV21GyH>vE<1GtS;3Z0{zl zk5MB1eGKq1+{X<*uJSR^$50LeSSx1x*$M~jw zl?!d0kMTY}@bRIKJAB;fW2KK(J|_5>=wq&rhkQ)(G1f z?^5oV?CH{KmflPsce5~k%#zasK4$xv!>F_~hvWHsrKOy*py&Ho5x(i;{?S=R4@T*y z*?-u_BR-z;vBbxtKIZv&LQm&I=gZsUJ{I_REP5`>lUuwNs%Ghjb$St}oqa6wvDi1p znMU>Ky2chg?c*6A&-r-X$Fn|`GP8Wus$iNb1G0!%1pG^5wd0#_oz|=HU-r%3Fvdg4tIEaetV*Ss z^+Nf^s07$AY-Y*$ct;X8WNOikL-3YwMzC+I3@Loq#}+nZ-z5Hh`Q$V^led*|Rx|C9 zjVR$G=_5y@;UncE?Zfrq`LKN0N++w5b&>Jm_{c^vv!Ga>WhFP|pgn2Kd*CDVQB=S@ zYgtYOJ(_9gak$a3l8*G7c_JxnHe0(h}+Ues>t9pG4{iuHa>U~2!;syHsd@qw8GXGt`83MHq&_Z#x4A3et_Mg%6V#92s2Iv>y+yLhV=oaAO0Ou>t3j?EXodYui(21)6A{Q{@ zHH}s2%Jj$^HS?mtbc;+apLFAvZ|o_hwSHI?@#(?2uI+baU} zlIt*Knesk?S;XhdEL{h2@;|_U0M`c?9^k3~0|N{VaCLw|0S2q4s39y9D&deQC8<^z z7MO1LTE)ybuMuH7Kj&LEx$6Cf05`IP1EXWyFnLpek>mkx4lqLgnWJ*P7;sczhGDED zMou9W>^41u{B|kNT>+*C7#m<*fbjwD2rx0gBvwrg6F;vz158i~85?7s9N@<_m=a)W zfF;|eBVw*1VIRx^~zjwG}p z4+fYUARZtQ;GqBy2Ur~^#{kM&|W-gv$;sZPr;8|%V6Z5nl%`DKcQ`Ol$v396S&nvbU0=yVtnM#c9j!sN1 z^>(>5e1-flk|CV@53oAGCQ1UV39vT6s{vl))e7qZyv$VTLF?HzWm{OYRG3#30}Fv~ zyBr(59$=%qv02gbzoF+ce)2a1ycOVG`DZ|OYHy1(J?}76wN37}1b9zD-j~x>MMa}Q z6BG-~h~zJ`V6nfOG&WKo}q|pLT#u04Fe!FXqt%io^?$3*f4_Shh@zFC57E z{{T!FHJPPHc_Bbi-gYpL0k)|%F?l<<=2gL1kL@Zn4$nT2@wto(0gQoLYlNH}{xra6 z0d@uWHo)hKYG;5i1AL(;viunp)Am(>uLFFeoR(h?Ss+XgYv(()*@5#IFHsJw%Prr2Oy@ z)xtx)36n}cEZCY%l7=F+LZfx%jq7d;)D2ND#E~J63QeZ!hd3fcqYw>3G>n3oDrf$h?XHvSAwbetrWIxh}I$6gr?(Q*38us?LyO8@DW7n20eEO zai;vA7ve0DP9e??(NWoCD7NBr7{6jTSC63L(Zn@qYqE2Gl=ur2_QDWdLt}8tW%$1k z7lr7iyq{4A7l$Sn-R1L=5SNBvLx>30p72>84H-{JzVx&^YoN`f;x!|kHEy^Itts!m;F*+)@F^ZW5 zULFOF3o$;##1NB0+!30A#GN4~gvMGj@9Z^L?EJol#XC8~6oq|Q6~}o1I!#qAOq2Ys z5Yt6wgqRuPZt?qs_Xz2KmdI@39O1pf3ptz+p`Qmt9t<&8|5KG0M3lCWd zzE=*^L!XzNt&)ZCf;8$yDrATil9#K7ip`T3r^;VdB(H^dT`iZ5iz#Gm8$-Myr%l8VZ;CSwjaMHs4)peRh<8G~8)6H? zhWITsQ-!_P;k^*=hu9h-7Gh6`A40@KBtm#0av_o-QX#AmHZ2>>=qMeUJqDxnj=*Vo z&c^dAh72`1H0w3bGd-ah=DDFcQHsP55ro(g;)Bqf(ZpT2VTgQ)LWp9BQiyH5?O;Yk zoUtVCs$)JU-%eYhp&#%+YsM{W<7CtXr|@A56$M!;~SXOD-Kq9o&)z4><#fF zZGMPfLbFffCpJ%ZtlYpXKP0*47}FQ++ZuVDRi>za5AjE67BzV73$b7PfbdV@UyLHHEeESTe|XsGCQH#%@~9;eVLkLG!_%^xbCwheGv-uy(EWz`~&mXW+w9<9aO&LL19gY&pLk4&7e$f!JS z&EvK_M(6QZ9*^fSCXd_mn3l&~@-S97Q8+G-@gj`jjy&#+_yiGdBcXg!9+P!DML0F` zGqbO8ou0>ilFSg!%;Rp6d!*sB^O&XE^0(^rKPQiS^JW|8BE7QRpT`68@L(Pf=kW;h zs9XAcD1YeWmPaGWe35y1v-0~}H7w9AjSM|6%;SkXR!Z`u@HuL19*go=oX1m=JR@8p zWRR!xCX(58@T??DBRPf3BEBMz7sOu_E*F+F&KSyv@2$$?CCOI{*9g}Nhw7gf>&5B+ zwHW3eU{< z^9b??^T_A1JC8ki6!IwM@fm~UQOaW*AD71twiga)`{KDb%xiNIDgS%??cij5s|0h4 z#dlOHb+6yc8<&zdRKX83@Da~{9Q#4%qqYd>?is5to>ciIzn zE`R8DSOe^l2|bXN1sq$zaRnS-K(hi)DB#3`83J7= zv(J&_Xzk3Lq^Z%973vh>slw($&g*{C3@wzBmO^R{uQmm=Ens;OD~f1W!081HE#m5; zNqPGM&M2Tm!3=b7;dY$@&MKgJ5vLW=v4Dvy(Yb&w1yehn3OKufbLd(F=N52Y0p~NP zd~>g8e$en_U$Y0`)>gQnfC~%e)B=`y*MhMLJqqY4^1lKu5}~l0$i)R*5=kyCpu6~G zk%S%SEZ~6x9xR}D0euRXz!WOueG9myfKdhXE1-V?0}8lG@*7x& zBFyP9kwL=21q_MgLq)C@nkRDpr+{lC*Xs(nKH|e8KQ|U|Qvo*@Frt8wkt7!9Q&9FfPPgNQcL?t+m=AO4I;nuk1&a|P{Jn)U==NFR zQsHydIuW`qE12JKkSs4?MFDRW@V1;*7VvW9XO+lH!qo+=iR5bwSQqj2B3&zBLjkXd zzbf1;e64`j3)on|8@lD=HWkcxiG(8};+v8)I61F(bek&R-N^rz0^Td&{Q|Z|l4Jof z@pvRjP@`%eih(38xmAE&K&AkPrK*Z!{MiD0w$>VOqp)59xrlSu2Yqr5Fke7{EwPA3 zMHJbP3qTPSirB_VDPV5_KNheiotgGxA;FS+X^_yj7RCOSVSEex=O;zMN|=~S~SaN)x-}I9$q}u;;PGu zt~H9NDPAj*)GnfDKNFC-s9Qum1*~5*R*sSeMKqLzoXKchG+7`&R>CI2rotnOII4)F zi-)xO7zzK?tK)Qgys%jjCx|ef6Gcuc;$)Figr`QXd}50tMoz?8G~Gqh8MQ2$*MU|= zGk|X`Y$I$dY*)nTB6Mvpa)z*j@XVrlS)fzEu~QM37SUY~I=hH-ia1yNJmL95nzGI! zOlKF73xpRI(KV9)PvjzDw<0c%U z`hr6a*4;2xeGzvSF`h`3Uo7BUM7kz^66NYY~sEO9%MWJH`IvLdd~6Xt}B#}^5T<~5wR z+$}ton-3eHNMltpCtsD=1+aXI*ikgI9Dk~neL(Fh;)^0a)a^$?wvLaf>f)b9lFy2V z&fDK9$xlW6T*Q|}d{xBPk)Pcn-w1aV@ogmkPUL$b8{nQu{)5O~;g2jmext!{pSu0E zh~H#^Ibh((=NTRK|GS+2C}N+;ej$S#DBtquFGc*V-2GF;K@sM3<4ZuvWVwQnb5P`! zN~UHxD6L#FXBM%ERW0GL5)Ln+S_v1H(6xl>CDbUPeFamqC9_HRWW`S%<5beACG+mnyoA$AXi+ld z*-F?_$kx$`#$TLHd}U_B+Lds+Vj$;B4Zqms6kLZA&g2(fC7fHrStWEVp;HNG%iFwK z;EFttOJytO=3&09F{kI1aDEA0O1Pk8KC#JFLFba0JY<}cXjH2k6KyJ&$7qyrQ3)59 za7hU<9tc)4^MrhB+o7*fma!tLo4LwMmB{WTTvkGl5}wzW&Q$E4C8OS#mvBW1y-H@S zjj!|E%fzDYQ$pVoMs3Hf+tIIt{v}M^hH2X{poFWKwr#jz8wQpzsDy1LY-h~;1-$U3 z5{8ISGPH!N#fOz}O$pbQa9s)am+(Ld*OxH7go!0gD&d9_ZY<%p5=NJBQwcYha0?$@ z!X{e&5=M&bt72|{6O!B-2`S+PP!6Fry1-YF;EPLS)rPLoTR zQo<~`PAy@Y$V}l~B}^}2hT>r)|E7Uq@1}12-}q;jFsFoj74SaczyA5q2TPb+!qX)@ zQ^G?fJY2%U5}qjGkrE!2=f_Hzr?Q$~!U9S7lyV{&yi6XC&?oD3wGz2TxVD6KZ2Kj= zT*8JDypq|#KY(k3C2TC=4O)YenGfXkS_!Y0d3j=x)}w?(2}!ns65c9d3std%x8>&@ zHd2xC)lKj+4&dZZ30tY>CB#|RbmGjO&^&_C>NZtEnhm)GM=@ARr!D+9wk(}E@hD`D zOjtc7SAt){l^mD}3#I?Z)LB4XRdjv)N2(~GUk2qS z)eTddzjOF%4qtZ`_{I_%!nd7eI%@qehabhkIs86{p9~Y#{lyCZY}6B~zjoBMvHvlL zKke^7vcsJt`n$8F>)NO^x3ib7HM-U4TVuf*-D~uaWzc#48a->wQ=^ytRnELM=Iczm z7OWBF&tLn0-u150r?ZTZU#LdE8cWq!x<>yR3)fhz#^N;=G4cxSMLX)6tDy2rbk<$6 zBhlH*GBpO&7+7QZ8p~SU<*b0Js1f~y%nFt>#Ndh@)wKmsV`WRPVsKT1t93pdRAX>w z`rqMLxNlgE;nvIQ2G=k+!l3$Ev&P8I^jbC6w)CjZoY6JLbf(8zVjY9))>zLH;|%Im zAT_mNjg4xYWH}qx*hGmMTi4jM#%48l`g+S6n|D05tCqH~v}S76)l}T=F6gu}A9V;*lI`>BDLqZiyo#12s;Nye-0! z(kTV;Y8+kTm>S1gf#VFS9nH}lbW=&qYx#R}d+#2WA_@l<3HO{YbL5*i>JX_ucQ5ne*X2 z++5?98u!(>zs9XKX3pZCnw!>dt8sgcJ8Iln+ zEiX`~cW1g!oxYvv1?&GxtlH^cXURHC)mhk{N?;bLv#24nm_fC(c%3Eesf1s|Q9xtq zI?L4=SZA3!1L`bmCHp_)5L0(m*k#9+qModdsC-D&;WhV7_2qb>1;QB3(-Y2Ks# z-#Y8n8DDp9{J1*rKId+k*u2jAB9TSCHn2uEtg}(w8K{j7Zemb>H?6Z-XL@FTwy=Jc zzolhvWpHbQ+jJDGvt36*o933-!QhStcQUBx&;$*3hFj?EYz^*WP>YM*>P)ONsqS`y z^w~JA^mn)P9tQU`_@KUUs^GshwT}&1WZ%~k`x)H7&H=98%{{OCQ#m zqjkLu`;qFp$)qMn)j7J(F?Eiu^Fo~$>uv_=(v#!r9AD>zx(nx?TIVz^XJr5D?tSFR z2B*|H$r2|UJjLM0o7xM@-8j9@rFD04;u&=}L7Z9VEZKjtxXy)jE|UG1VAnan&INTI z=*Nm9+?M?zySl5wj~c~K_q%gP^V*K~#ijz6)Lqm|SBMK1z#MXHduO{vN@NmcFIVt#xj)w5r@}i8pp~)o-hFXPvw1+-{k7 z7(C2Yg?C%}p1O;1N#yis=}|6yzlKof@j6e`nObLBormi@QfIoApHX*5-ygJE9pxYT zpR{uHd(?6sGbl+G8c)`lDLJtgp6cxAnL6t9Y5hIcq57# zp}}PhcL;e_o$u;=FNM;STIba|uhp4d=k+?D)%m>68+G2S^M0KV>bzCw?KU>=16B)5COn#ded$~)B*6it)&!5)aTiA*d zo+MYHPOZ)t%2Au*V4bo~RcDLgG{xLHVVzdpE&RPYz6rddG}1o7s7_pWUWA?|by5?m z!paD}myRK;lh<90OGaR+W1Yy&V;{n9OVgismuV=U4i?yYahMgZUdQ&~P0s*kGXsy)E6xU|)mUOxIHdL-bRkUxWS)7Pd!=*l-qY zIBfMuKR4b6OEg%r!BP!QZg5J2r5h~MU{Hg>4F)t=*05cz!E)Bfzy`}VT;mFNtk7UZ zYg0(BWQkR*%*vJ)>3S;uV`(MySA5a%^&8UQga#)XCPNzxYcRZlY})D#)@U%o(#wx# z%?2Y?U6{!7H(0yDW|r39Q4Pjg`t*AkZHX~z&BB}OG+4L6dJV=k*vKA<+UqyipuvU> z_sX`aYkNy@;8+JYZm>xM?ItL_sg+;W+S%OFTQu0x5?eKR!h-W#+uv;r9&9DIv-I{2 zc4)9;gPj`eDH1gp-(W(6-K2UAc5XOeeJgDi93hP#Jke@pLYu(mM=G~ABcAtyO_aDzh{9HEXRaz++W=5PsQ z1D&aUv%ec@vYETjU%#Uo9Mj;~hWmT8LE)y~afaLRCZ$4BKh>JtpwAFavQDRTbgg5k zJ)B@~+?7)soYvr+2Iq>-T{zu@;f#jUFHIZ^jNr@$XBi!I&g$%jdrMIX$>Dho&Tnvm zh-QIGZKGV+a3Q;k8g3Hrp(TvTP3X=vOF!6PMuX{=7Cu@+KGfjh29Gs( zT#a{glJJNs?4(*ucep2)<~U zvl_f4g|f5|?s%l9uUO8j4PKL|bguH=Xz->iPlKSrTMgcBP_tqx|4xGs#WGQ&8}BxF z&+^}I@Ik|Q3o7tmoIh^3o60^hsQgbGd}f6|Z!o8`wT`jWbtQ;cY?)1it%h5JtCoJA z<>+*u(xIi>4Wb5dgQP*)pt8)&U~W)%5lc3T24%xdI;z+KmC(Syurgm7RL)lozV1v5 z;qMxJFPxjK*5ro4p4}7ZPLx8w0o1DmQcwa&Hv}oJWY3cL7DT}(_T&Hx2Fp<>0>#) zJ8Ow(5+t>`P?LU5mTIzelm7N}vCc9JTVjzWi&{b=s+RRz-2N`nWXaBw9V}R;$?}~! z1JrMm<(iJX9U?l=9;xICmRPaLN=;U_^eUZ?I@%XjgPIJs%*~n%X)?6Q`b{=yGOWq) zCZn5-X|j5gHJYqt#YX&33u`tRX@8|GYVbE>>)Mtxs%c+ov{8(0vaV&S%sQ4(zw23I zoI%M(2R<7%*~D@-GPtopJyQ8ijl4>9l-#_@7EQKP0V}h$!H(gpz&7@GTZ1Cz_DyzZ zvSX8-nv8EUq3J$LE?H(md4QVU}}YFPE>9M>IK7jIc%AQTFKQCdXLfScAtIJl>$f9jc|mCpMYf-+vGe; zztH6TCKoihsmaYvF0@Qh_)1G$)a2qOmstAJCYLq2yy@-%)3p9yTXBUwm1(-F$<x6o8!S_A;i)N=yw3h!->F|W+TRZKyv5RYH@T*l zW}0#-XNn>Gc#|ir&kYET@Bv?^;@_^j_1=8t-?u z{DCDzlaD%cI_&nR_V;sxpBdEX=2$|7<*PKBG@G2<;*=JxCZ4QNi=|rlR_2Q)Up5Jv zg!VUTl2}6c$I^mMjZT|no%y*X3WH^n$`WmZ9oO1_)#U3YU0ZZ(@lBI&oBSvv-{d=^ zzl@BCtoFaRDnE$tCTYs~*>Zl@EMN)c{Hj^N(jDCS!_t2?`K!s_5>(yu*810y{L^G^ zXDuvKy>!@_?k#$>Sg^%HEqdCcUM=QtF^{F^Z82ZVy-BL>I(VwY0xdU*$YS(vIW8!t zj}`7~P=xJgiA7p0+M>Uu7dF_@h(@$ni^W?mmZBV$cllO8-x6B7#WF3%x0ujkK#OHt zjBK%1i{)AjY_VdCm0B!sg;(foQ!R85ZRHlLv{=LPSM7W{yv1rQ2HD@iErxdH53xjt z+c2zijKXAfao?nLL}$r0EukT=-C|UW9a`+zVswi!Ew4V!icb`{oTx}dy`_ib^2{oT*t{svV>-ra$g?vRs1S{&MPp4gNYhqXAo#nCN}k-%7)BRgxU zP1QZh{z@SAJGRB~CL70fmQf=obf!*bae6@3Gi_==X-Qt}Vr?)tx#a(Kr z#hES6YH?|c%UYb>;+z)ewK(4@cF^ryON(L`SmMI}Y4ajWUu^J_&V1Fnyu}qQu5WQe ziz~$lx%w@xZE=;c>}o41VxA-Mw)B6sSVrSU%ek$^?UuO7;LR;=v4p5`t8q;U{ibx| zjuv;?qYhfB_j_90+v0^5FIxV6Egoy}c#Hd6JYaRFwwTf4p%&9R+nnCwK}-MFf9Nn@ z54U*4wD{4^l0vnEEKjs}vc=36PuZgm*?79ee_C!H5pK`4c(${aT6?ZD{d~*aET;l5 zwRqVwU+a|2SuI{sgZ6n86?oO2YFx8hyl!dr@IOe<@mY({TYS>l!l$i&ZJm0Y^FOq$SpiK+4dbAmYT%w_h6W`P zz9j;K5^NQSEZxD2w8ghAzH5=S$XgUGN@-1tuUk~sW``wdxA>y7g)c49VS791{EZQ( zgJQzr`xZa7_}Pm6(Bel+C|@($FD-s;(baRb)$g|!f3^7A3jE&UkItd}*>ZD}82yhu z>f*UsTjl54U#z-Dt=>iFZuYl(XPZ4ddUmE|tmgCR<ikp11u*6hbj<@$66k1d#vKI zsu1uP;<1`_G)O*eABV6!L-*pCf?eusgnPGL{_rr*&-D3@p5gu!LjP&T%mlLKj zaDWR~ojk&QFkQhqz16G2qdZ1?jIqY`QigIAE;xFW3m32Bv98B@9^*ttkF7n{_t?N= zBae+eHuT&Hw0Tc-F9p13!M#n?>4R+UxtHD4&Za6qckX6tS=SB^bvavjZ0Whpj>GKK z;x-=Jdh9Afd2Hvgy~hNPojvE$e`{ge9XxjQ+}yg8O6u^ZrS(^b$9A!iu4v&tu~LTy zCwffs*xh3fbMMuHL}l5@>?!hk9PV+1{C}~mw|hZPLaPS%@z__xR}{Q>DKGfK*?o~$-ZRPRK4LeH1_c+GmSdZg8F7~*@<9Lq~JWlgC z-Qz@$$zr|7$sSWYHXH4(sT?!K4O6dwO1fUyiBpt6!Yu(#wSnt(j5Fl?dz|lafpJQr zc$UQ2@I1$JB^B@#=I0t>=NZ&#;q%9Hp~poYhm570PC*!9Wyvq~xXj}&(bMB{k1IT` z^tj67*FkQQU2dpbj9l$;jmIq>w|ZRbah=EY9yfUZ2CEfR>_5bPy5&aCU4W+T2J!bM zkDCo)(N-5W-sW+;#~mJbiq1p$ZoDgYz$5MrBkf8k)TtKk@wnIHIgjT(?(?|c<4KR1 zrgReW2Rx=4qx%hEnkA-dX!erqgB~+Hx8eSf!G{e#V(?Lej~RU2;1dQfSj3fo%HwH| zXVscS;xWhlXQXix-Ob@LEPChb<(J(lINcoB-@g6vg2#&ugRgu4Z>!(*c*`<7?BqKh?;4L32z}4moYoO!HnIQ6<71CMa{kQu z#N$)RPs9lkpLu-lF;B?6A#*%x9@Bju^r;IOj}?4Y^l5suJpT6h$HVjRJ-+t%#v||u zJu;8nBN8<{5|7k#FZJv{)R~3VhqK&*F1CN{WOw|p@F+dL&=5R+80t7xc`m;#`(~ka zv0KQ0CEL=|U7y%*lJla!_4v-?7YUNb_p0deqsLF`UGt+|AF6~TL3Mu?-E1F0Ilp=Q z?(wI`Uov;|^M?dLA4;3*zL+Kz)=wKWsv?n_tKNMU@mbWTi%(adUOw~tbo1%%)6-`j z-wBwy(6?!N_-?P{S#{lmd3|pF5A*qaGtD`lSDAz_;M3cupHF`uZ8!AsUB!ib`uYyx zemVl`vy-WehOg0yRtx)X__BENibb@=d=~dv#%F-f59e-aD4(@_cbr%; zUcK!uE2okE^O75ss3hSW>$8r}hCUnltn0I$3j3@t1jaansan$FZ+f6prsB>9zH3}t zU>o~v;!KaTl-A%+1+OwpKV29pYcB1`E2jA zgU^mWsxCSFa3L-p;dT>*r{qDeAy4qx*=HA@UHyMaDyb9ccJtj%lQ0x9CmI4W9YSmm zpFMr{^V#2LFQ2`A_7RJXgZj44#v>e|WbQ<(m34)C7Y^__(B~kZgC$X2-HUI!fn@uM z9OAoPM7O8&v`y) z`kdu+w$C{>3b8{UIa;~DGl^=g@0v`X#Q8oK_*~?3vG1<`z0h|zopy-Xq4uhv{1a8w zh%WQF+~*dbTYawZxzgu4pX+_D^10gQ8lP)z;9}f+{oE_Ze7zt2>kX+975PSOq<=G-vZTlox{9IK~Y*W%XGvD{9K;HJ{m1YF*IO#R;u6UFG|p|`;vB_$S3ys(B~tchRnFn$3CC_<>RSGpHR}MZ$)**7tZ}0ZiyWMc*eCPAMq&nb~fFFE*l<^5z zE8r&$#AmU9#RGov`BfG>V4i^Ae16wh0=fkJ;q#}@KR$DP{*v2yq<_(xHpie;GfL;Of2P_cK zJ8-kS=-FXI1Xq8Kzt(dXQ!E&;P(c5Hg#&&c=EmMne?@Mlfm32s+3@trrs-4n8Qz^H(o19lM|0>%Vv92BM=2dI{^A zp==qjRlxQEI|OVUuuZ^4Z?T=mJH)BKdrLHMv#qp4bGHoUj`|xgK43!N&ap@bE?2V)Y1IKaUb4b9UB54=L1sQ)?4`s?ZJR;!8fa3#B zP_2NY1C9we*5pd2TWnPo@kL`fF5s_0?y^C3dSbxjfGHxQBp-JlntYxPL-hS?j-(RW zQv*&5ctr>VoE~sSz?}hi1)LdhR=^bjR|cFNa8AI5B4fb00p|srA8>)huM6okH&y8y z9AdphLXAt`FAlgQ;Ie?r1GmIbFS>XA(!d!*4O2LXu)oNRzsFSpR|nh>aAUwV0oMjx z7jS*x)Liz>*{(TmViHdWj&`+f3b;Ao)_~grH^GUaw@9ugyB%a{>+OMC+T0=9>TBIb zJ*j|tygT5YfX4zJ54bnrK8bO_jDY(C9tfBkFiq;v-^tH&qa2~0>&5W?Oqa!2)9IZU z@le3S!av~Az@Z@)OLA77>^_wuRAnpV@;wpoWWaL)&j-wu7zaEZ@Jv8+4Tkk`KA}e8 zZtx5EkL<$`S4&5R#9w_g;)Q@016~SvSyb)i#=gdbtn`HYfZ!}C%O37CG;#}7__cu9 z0ck)M@VZ1g;PZev0dEGp74Uw*2LW#fyc6(lz3GP5%NAzefM2>4UhHDIoUTrYpgh-rNx18%1~L~Yqyi8P`6@V&%C9;SNi7ScVW zM@Y}m83)~dCT1xiA(xHSM66=-h4cz}AY^LD{2>d3>>RR7Nbit7A!~+=4Cx!PV94?z zD}*c*(l2E3kR?LLp#GuLqeVg%4qclP>D}xE-JuDXZ|Yi@sG>91A!~xXO*GA3kf$a*2;LMIqKAE!Blbwbt+T}3seM%0()K_%W^kPSmN3fVYhlhENH zgP?)PLQ3BBS7n6N<{?{zY#Xv&$d(~ng=`(NjkpXeoaQERkyODPc~%;Zy4XHshmZ-O zlM2yi$B^+Mx{7lrqn`MvVru!gnXZ6-yN2u*a(2i$ArnI;g&Z7mNXYJDR>;2MRLGuI zcdwAWty$HQS=Q7quXrEhg~WCLkOM*v6nRCK5w2wgSmaS_u>xi#drklUp`#xIGY$SBd3N3E9C^<5!%hujl# zuMtEC4s{An2Jk-ntHNsbe(O=?^%dzC_tc;0}e=?;1BxZ)_qeW_5{)uG!U-1rk&PqNnI+(Tp z=Orhf!e7*QDdgpl*&(lo%nEr$%nf!)1bbxp$VU_ZKU6Xd>ite_^YUzoj~h= zKZg7y8yhh);^&ZGWJMzuiTE|-H`(ooo)N#xEQHKe`w@SJ{1x(d$Uid3z1+aHXcc1m zUH*VmMlr5SMAwLJ5#1vvrEU^8r&RpXl%bN+@p&TVjp!56H)6hsUJ>(0ED$-Bk(tu# ztE!?qGo?zsBR5&djhE3|Fk+#Iei8kJWPdkrszFJD*5*#*Y$3L2#9|REMywREc*GJB z10t4I_wu{&@ayeT?Y#q5` zlG2X#uhw_lL_Cd?)$Jp8h}bb=C&`J;DMDC$QAv$d^NYB=bHpwY2Sgkgv1`O`5qk-N zh=~!C)N;h05xYl@YvPo8l-8eNGnb;2GHyQ)WgiVHV!w#}Be(SEFgWU6iz5wCgVjFH zK@kT>91(G3#32!fMjRG#c;pPG@NooD9I~eiObIJBdsM{H5ywOvYtpEt&AV2HGI>UQ8>Cz=^ z7i(O007=MP7IC?RDsnTvJ`uj{%Ul^bS(WFhm61HFYa*_VxH;mMi0dM*kGL`7CQ+}4 zTjJdy`RV2Sd^dkhchr`?NZN0WxGmz2h&v;0mpn{!rbCN3y@W2y@SZ;C*MkpMb*gbs z#Jv$uL_8UBU&Q?p4@Ep2@j%4Xi0Kgznj}cNYao&bsn3fMFGai@F-vMYzzKkw()wMRt2l$)c(L`hh}jW|G$P{lh&LiWRk%Ll z&4{-m-jDbo;_ZlcBHoR7Pu%b2yk7~Pei9zZl0F3}m-s^og9a7xi75Q6GYj%VG+6m^ zlK-2Yck=Uj#GD8(!jGs$)J2nsrZGZj>kAz+)GcG8&PXdbFDA+Y1QB6GB$0^FH1w># zo;k=dQI=5fkv?v`SwtT3W5iDpg-lb#*Wz777156PBH~N+BBy1%qr)#lTrX#x?rh^% zkyGAT3YAMiBEFCKA#w{V8609sTUu5BhhU~v6FUueChg#5F*4-^w zr1;vP6ozU+_V(|He->RUe1E^YCStLe#bXAQbu}9^B4*9lP3WSSc%=B`Nac5N$V=+(F{v08GdgCy zm~k;XIiL}1rvrWu)G20t$uN}p=UzZ%G#(mr zSj?1|lVT2!IU?rRnB!uOj5#Xi=$K<-*NYZwZYnf?PooeS_n64>F(<^F7&BR{AK-LZ z_tIz*pZ|HM8Xfcg$uXzIoE3An?0?K@vivb;#10LW6dFQF^PuG9%-C5WnL#0TPRzM6 z=f#{KyUVWiK@ADs-BXw_iaQk4+S@7MMKKr0OpTcqb4kplF*n8B9CKOBPNBnP_cbfF7ylTnAf8g1FtKS!Mf6N2YS@XNr&>dg1-E1ql znjZ6@YQ?-3Gb84qm=|JRjCnZbk(lRVo{xDnb~DRkHUy!U>Iw);KVk4mgEI|2W$!P%IuieW8R5*H|C9) zH)Gz4dE17pl4?Xj7#S8Vg;ZFz-ivu(2*-RV*%-{S=6-ZEE2`>q$+B{v#C#g_Tf*-N zpT&GGK}t9=VNOgfX61xc66!IHm_K9wifP8QV!nv^GRBMX)q6}Pg^CGdB8ii1<71Az zv&|z-tZPM9+tXZJSESBkikLE{irxEh(jDQfjii2on-GtFiM9xC9^h9oU&s6y^OLkP z=39wn%=a;BQ|0%4*I7$(K}z?7v~0T5W&Qm*<`<19=J(h|fHm-6V^>Ve;qJz08A;LV z4_P65A^Pu_e`LTD7E73`k_mki7EI`p&^4h)LQfGydmM?2YIaXtEk*DIWq8%>JPGq@ zonmpPd6iCFFs+xt`3){$u(v@y>XUHN?yk&23H=iKCoG&ee#wxEXzrJ|%l%~h>s{Ou zUNW|L!V(F~CM=h*WWrJj%Ong)oRDY_LPS_ParY4^Xd??LR8?K*4NO=*VTFVh6Q(`x z=0{C`@)9*ujGN9%YD!To^F~%pSS?|Tge?;W3D1Nv31bt6Bn(X$k+5dMu!P|Wt0%0H zFu%I!;+E~QkRrRRsBDhV7@4qE!l;DN32P^=FU43y>e2REoR}-ESEevrCt=-$4HGs> zSTA8*!ukmtB#uq0BIBkT`6Q_O^>Cj2Kt+KPHc8klVe`bl=Sm$-g~zZzGt;_qi& z6j!6(Dq-t{-4Z4yY?H8U!cGa}6Shm(K4FK19TSI@2(CFxlcVgX-0Z(`tKA6+J16Xt zuxrA_d$?mKUyrbmwcSJ{6_X*Il(2ik5eY{o?2)i%!l4O=CF~`{v;}OUBFnkGv16aa z4S!#Q`x)Hd-~kB-CLEM-u>CzGaV~*M_MPp@%fC82;pJD{2~|Zi&apEaM9)XHzk~saH?8JxFq4U zgwqqwNjNv*jD#~2&Pq5t;pVs8=9lQBx4Ew!PVxvpj&O`SFX8-z3lc6Avve$EgqxRT z!Q|=b_@5N{qQu3k#gt1EE=#yN;hKcY6Rt?OGU2KOMLdMz-ug{p~7yR}=2YI2bPs2909Hz(X8NluuaaBISC3HK!2n{a!=9SL_P+$G)Y zCn*Ru9AvkDfFr#Xvj|_Jee>v;VIKc@lN;)XZ85{XqV8g#IxeE ztY|_b;kkt86W&UATlOU3Md^ORYY8uj;|a48UXdiXnH%+{5^iDDha_LXP!_blnGVh5Ewkzc@ggqa>SGt$O+N%;md@t z5`K`XCVZXnO~SVc-zCl}3iBhoJOAW+8EQof?JJgIjc%^{New3alJKhx*9@mSJqJ6N zM(546E2kY*S-d|I{*(z#Svuvfgui9YQWi-0N5)^)KBZ?0DP2;!rgTf)l2$^f-5Ie` z(`EP6jZQ<8-kmGspE7UCd?~$B$0h}2d?%$KeQWj5HB4x?c-P$c#RTXt4-U$tHN1om? zDFadlr3_A4Hf6b#6;oD98JMzs$_m!3f-~AZ5#LpPKMSm_oU%&Fswu0b?u~wFvGR4q zMSFHiT-nt%J|tym%6ci|Qii1rPZ^uCPRhu!te!fY7ztYedSLsS9w8G`N<* zwGAqBRLW>ek1;5hOqseUSasJGO?sh|mJ${HT|Z@mlnt#}c`2F&^wTUO%r{BdH09)s zQ!+M7**s;fjI}eiNZB&wvy{(Mwo2JL<%*OmQ?^OjHsz?4qf@pMNmKSt*(YU(lpRxc zP1!AFrcgnFTXQiB-a$L&sB5BI0DJP_y zm@-*mAF+P4v)H2N+*h59X`ykFNT(s&Se~`>#;2v6o^nRYnW^hbn5cclXT%68i$WIK zH#sNe+?0z_E>1Zw<@}TjQZ5u3Uv}E0gDCSa?t&N^xRwKoZ(NdcY070Omy6maX&*iB z_Wr~{$*m|O-MK2|>Xau%@RVy(u1&co<=&L*Qm#+ACFRzX8&YmexhdslNsiqa__Q5D zxV?v4Giqj3r?;ito^nUZof_IZPKt!m{I79W%H64R24sH(wLhhwCZ_vR?oW9zWrk!v zWopW_luG=w4%vf%{r;JO*)ZF z!D?BX6?8%OD4t4rI%Rgs>nYC&jg%KtUJ_4Jo=bT?7AQ@=nUTsf#oCZ#hp- z;aNG!dv$XGhxcTB%=i8<<)f63Q$9)YX1cGsNPrc))8`>%jy_FUf2`X9TwI6$Q)($c zOU+a2DGfN}7_T?qQ^sEwKBHU4-!lFwb7l53=kq9F ztHTwVjMP+@%n?wi{$N_uJ)=iP&y0C8M>jF<&j%gvwwvV6LTIN$C3|JepRr)ZLKzEW z^v>v$(KmChqhv#^$<6rS9yhJa{TQu?eMbL`g)EPcJ!6fG z5h7RS_E=Ya*GY19KO-|2Ll9I%LdU@50*%TTov~ZS#EdZ+V>33Fxz1Q8W8I7mGd9Xt zFJoNB`WYK!Zh564h(v-CNJ05pqT9w9n`CS%v!A)YVzJcoRa+Dbic`;YVM{S3W2cPq znakNaW4ny)#laqIld)~)jE`1H(%c;~b`&wk^6_v!HN6o0cJAB>89Qg}lCf*%y3nL4 zMu?}H)^#z05~Av)jNLO1%Q#%a%-A#IfQ$pxOUB+A`-uXA3Rv}W7Ih!PWZ&#xITxyW zPeFsy@1Tr>GY-i(G;y-(5N$x&Nw#XxQt^m*MeG8 z#7TpiZS$sF2-Q{BCuU5}n38dl6;q~cf?@(n=!BJYO?6MrI8B4i*(K-nj58$CIrHY6 znQ>OeD;ck5oSkt_#@!kBWSpCEUdGiK*JPZZaY4qV8JA^Tm~m0Y#Tl2_sAY3RD>+Mw z-3b$s>ze*to^eISl^It_)NKcUv@TuI*?zn4P6tl9b>-TO>oRW1xHaSYj2kj;%(%(g zlnl$CSH+u!(s*~sSqdT_X>DEplW}{-of&rt?f%>$7U zGM>nIGUNV?2Qp@4Jd`mtW18eV<3Vw1l$-8#bWOUi6{x&ExzjTy@~|W)<58(+<|I?| zj^Y(!?zjz{`zoqFE+W{uk(pv;#&a3Zi{ly3WIU^8Gh5FNcP_E)u;fbGp^clXCh|hY ziy1FvylkA(r*JfZD*PyfbyR*<=G09=23d*MGG=i#X zA{xs5_&(!@jGr=o&iGM!H{Fp=o$h8AooUe_)@Ta2aXi1t_-D)&0y%%k_-FhjvoD)4 zn|1bZMpF2Tp>Akq^wffMs!LASobEY2a=PVQH`PT6WV(fkjGK&M&)i9u=qBHFe}#i` zdgYAFSu1D$oCR{0%2_(6cTS(2MRFF+>6^1)PQRS~xm(Z`vSYam?uo@6r)U<|Bb&v} zv$fJQAJge0825Iv$7h@8IiMQ&Z@bi-fDsq-4aZNh0maz!MS6ZenTuVG-sG4h8tYH z^XVG7bL~`2pKMcbN%4O%XziR)Ih*Bdo-;aUOwRf_8{~}5Stn<`oN+np=FVHtIW!ID zB)fD-lc^+Mj1Unv%-JYsm-;OymqP^i~JLjOFr$c zIlJYYm@_$NV$P(TgL4ka**#~EoPBfl%h^-abN0^J$A%;1pMU~`_yc{bA8}wC)`V3YP?~g)C+Ph%(*D%ViBQ_LrJHJ zuIuiu7MJs^z?5*lEa&o^Yo$9mSL9rob5+jOCgE~!6{ykCK2iRf+!>QOeVpb>xvtN- zA?L=Nn?&S^=-b>PptiYnKv%S#r>o=6tvR>lOwV~R=k}aCa_-H!FXzsjyK?T%xhHpF zWSwk0MswCsHwroS3iK&@aDUDNIa70{NfQIttm2t+hNT*sh!rl_y9YBw(wxUd{G5k# z9?5w$=P^@NS-g?9w3iKkc&3vRS&t`kX68JV^R(ftrO>w%9XrH3Et5CzW-~?3b2;^# zM$Yp&FXX(P^G?o-IWOhBmNPr&<(yeLujITca_RFB!>FeH%X(2v%SJf{ujjmx^JdOl zRz{XqCj>;sR~3|)=sx?a_0hXI@9EvHoKJJ!7uw=x&d0J0qusf<4{hL50T~&YN8$PP z8jcj7<$RtqC#Po0CFIqnR*v!?GbNyycOLbck4me(Pv)8V?GbAHMBHRm@8UUzp-qqhG<%-x@q%6j^A{{s(63;Dg5Cvv3i=lA{jUk#ol5pJs>;YnY!)p3 zWp4k1g$oubShR2w^++G|0Rm}I@`y9tGWf!LiGn2ymMa)ouvEd)1Z>-Goc-) zF;!Ot)OXF6EnM7KZqo7vD-^6)uu|c;seaW|%{*tB6bYEBtXi;I!P*6*3I?gcg4GMw zC>T;Ov|w1l@WR#l#NM%$zNq3?c1TQ%pb-UY7K|)dt8j8IL#s-o!G<4-cW zU`)Y!1>*|F8XD^qtZQwmDH(scTPiFyU%z03f(;8c5;gie%@ukQr2X~U;3JHi=?J)K z!Da+w}Ot8Yr5%rX_Yr$>>dlc+hFtK1#;fn2ExMr15F(niW(kS*S*t=j~ z4a!<@=e_67-KTKhZs;hf!YcV?Uk)rdsNk`J#|sWFIHchGf(r@`EjX-TO2J75hZh`C za9qLh1xFSfRd95{F{-7--4JJEH6q!xV+*&AyGc&3Y03!&Cl*XL3QOK3MRHI@Mj`pE zF8?VwrQnQ$GY$V!Rd}#dpVJCX7rX6aNo&k@C&14tIJ@B7!pYt_CZZaPjK5lw+apyy z&sum{hu8})D!94emV%25E-AR8;7XI>OA9V5oJAF?s(!g;s)~qkRl(H-*A-k}aE;|( zYfw0hHrHJPyrJO6f}4z(3Vle0bsAue8jty{q7E zDduFy7ZsKk2my(Npfa@ry074V>v3LlZ>AMYFPKsAkeafqG9R>dR9%ZiEesznc+^<` zh-7bs+hAUb0M0xEpkFUXA9USH#DH*9+b#c+D!#wlbP4H4x#Z$??sCx9ri|1v)aV zeEmdoJ(Xa*SMYwp=LK^LJ}CH51MJ7AR{o=cj|)CA@@gy+5Aj;Hq%xmbFG|ZLt`*b^ zS_Phdi_x&U&BDDjqyk?|a?Y@CnL*(ebn0F9;px}i)3_ih_@UrO^-_>Y*9yKY$P0>s zwuw+FvF}A?J<29)$44?LUs^FPG43nN|EAzuOMETG={Wgdy!hTS6{``gv>eby0Y4S| zT<}-H-vz%E{95pbsMn9*3Vt^vwLX>WKE;5N+;oSP56b9 z2-3B5r&+p{&gGVus~yATAEjr>JSC5pJW(=l$$TYylugpVX`;nJCiMM{^}j)shwa9g}&iISyDmMI-! zmsCZ&XINZYs&rS&id-rtT^>+6r*}VdJ_nX8U$Sz^Dy37I6-xL1+KSe@2C|YhrPdTx zUbSR~Zhk8nT)OU7D;=+u7*aCS>JGEQUz%4e@l)?O_dN;WOoOr4gDEE!v}PRUxO zv%RAAH}?&;{PN#$*$JL_>u`FJKK1Lp1M$^QN~tPb`x`T|3k^7(uHA_f6K#8P{pI&jZ+P& zPs!dT=a*bivQNprCC8VXP_m!8D>=O6h>`a!AR6Vn^xBvOE(79F)-S(2~O> zf%=lg{m%E3%PIyPS#ng#(Iv+SPISVlOhw_2HOV=y{CCMFJmm>2pe1?9&ofZXC~PCEfM$+!>r%a#qQ?rE^a7=sb**TQ+x= z+*LBIWV*;AwJo{7k?+cCGr=pj1FZ&`%~&0y$N3Xe~b|T_}01bWYbpB@c^e zC6AV9>>7xIDvG^#$e|QX-ni<@az0ryvt+4?r7NB)dAj7QlCMji(db0Xk~u=4PL+Q0#BgxzBlGjT{{NI_@xUOi6&y4WJ5m%ZK9I6Br#1)K6bwMf1hgh z%u5PGwOvw{ZZEYGc^`2XR;#-7OCItUGJ{e&9RVHUY>3>3Z=`6F(uy7x-<5n{@~22w z@ zq5_JPN^I1T(i>W)oX<@}#)?T5yH{*hv3bP~6+2qXTU2aau}#I666}wdIS}~z=2iJG5+|eQXy=qCuWa|#9IJn|4 zql3yEQgNuYzerCj#v8?A6A@D zaiRoCM6Q@zF+~DXaY@BV6(?7mRdII3Db~xW6{i_lL?ZQmdc_&`SMs26sN~^Hk;{mG zjzpq6=T}@%ac;$VR$Z1sF`o`$xUk|P;n~Nbt;t=jiM*GJhN6J#R$N}WQ=?Z_T&3~K z$1|uFu9kSn{&zO`@g&Z*9K^8hABiKagxg?-rZ*TBGm0h zMxiaXN|5fVxVz%%if1bBskpadM#V!F_f_0qIWKNn#RFD%s!>>xADQ%A)A`AYnX>#Q#zIfEWX+_)qK4$~S@l&h ztKyZ4=PI7Bc(LLoYvF~;-Dsgk^pk|YY&20AR%ToVLDgTac&*~?igzkzSG->FX2n|~ zi!tsE8-gRg!>Ff?kG}S$RIkEU`-X$2W(j~6kK)2%6J3?q^3#f} zA`$){xNw{#IjGNuPVP*{8sV1Oox^#3pm}Bis^HN+Qs;*;&0jTHVd}- zr(&)qmo`1y(56e9Zf&=??$`)cJ6+rEC2q}nqGb2Bqo?>aPn&t$%-?2#HuG7g@_V&i zzlvH2D>)UKNqbvPpSCkEZ`iR|g~b+X)341UZ5C}iRQtDC*jf2k>9d0XYfNfT5vx=doi9j>vpf-c;>5#Tt{_EhbjA&r2^(sTaj-4 zwi9d(Pz2e)uu`Vb*tpFmZFX+6OPfvGY}RJ$HrurMY$rBvvxV4a;cl7AE!%8mgi<4; z?NIKvZMJK(W1F4YY;VNe!Jzy%5n0sML^IxU#O?`JSG0Yims6!(+w9infHnuVnb>C1 z|1tF)P*4-!*Ow|qKtZIa*cGV)D#e1mR}htAL98H(s1zG27F6uLVxbBODn-HGC}OYJ zv2U^^+0E`In_c%(*Jj-+CR) z3-U`+7*7SVsY=;q0EScVpHRaz%gb5$r|@tJkEC!#3Rk9ZV+uE=a8(MEQn)6CYg3ra z_Cihe)hSF#VX9P0T`{PMt4+^T?{z6$pTdVLz$G)Pf|6+|+`#0hPtL&(XZfb5aB~WG zrZ6*wTT-|+g&ES=ZPEk1aCVyIkqNmyk=&88$pPm3T`An1!hI>+Pc>58Dcq~T*&4p5 z)dX&qdmx1e`HJp%NLe{x)273nZOigN!8Tn7pk58($O*x)`1-U zuugt6g|}D(q_8?=J*Br(c$cb6;T;9e+&4?+60mMRNZA0N5%^HIoL%HgY4&SU_?RZj zZ%9*Em$IIQbwV0i&9GiEVYAMK-Op0^Jca8VT<_qE6ux9(chJMZS1d}@d${I&6 zg}iDZCeW7`Zp|$ySiUHb8|D`cteirWLM4Szp)sCRCf&p-R8y$Yk~Jeib#axDabwQH zK?4Wv9c=5Mp@T*anmcIWps|A{j_o|z!ZF1%vzj`VuDY*gj`?NQP}0)DmJYU}V+XC| zrj5KTABENoNBtbOfb4G3aa#xN9BdjP4*oA7s0J33}&J2^I_;v*KxogGszg}XV}-N9ZCx+$uAI93Df>1^(( zbmhBR+4qTb$&14}#)Oid4thBl>flrdy&dfB;2;L55c)XS$HBf1`tqf}*!o~U$2PIp zw2y=S4)%Ahe=wOf{)^p+J*%;Pu44=t7z`=of)Toy&)>9z|J2=F_aSo1maHxaB z931K3CMG-#9vAs_x zi;r1g$DHzYoX22R4x#svMus^!&A~VampC}x!5I!lQ&CKagAoqSba0k~k&abvW&@6` z8&X}245P%*&USE)qCuCC}&2RA!-)WKs8 zZgFs{gL@p@>)KnZ!OIR_aj?q48xCG|u#`5;&>Sptuw22e5HdrV7xd23N?b`r z?Sp5QTlAPIeD#|w{yp%PgSQ>aGFEpq=>Zxf(#?A;P!2wE@Tr3j9DL|tjf1r^;Expk zYWZS6ts_&n#@4*nIr!MYdS=8L3y@`MD$jtDMSbSrbJq3_zGnR|?~KxyjB`8dck!jH zbtz$dzH#ua91I_6QRQaB4Gw-_1?Zxwiys~Q;A4+Cf&Kj4G2{a1c1Cu{by=Iw&~^9Yl_4lHr%7E~?_sZWcntLF}OFSbEP=qrl=b zKvm@?+WAm4aM94Ug&w#VCA~FrE$x!BId_AZ*cXyKx*i*_zr zx|Zp!T(owvrE76uhn5!Ah9M}Ztz9erTb^z<#!^!sWpKJ+8yDNU=pZ-kxhkzm(T=+9 zqdEE2i{B7bh_{hl4-2I@!f3t|ot6`{Z!RP@A7*(wL`A&M+6Jxj4tg zXcwouIK#zf6LF?%+8*v=go}|bY9q`zM=599>yRimXKdEbVv=1ecMOerM2(&6VvK7e zDM}b6zJjIxJl8gvQ*xn;i(FjqVw#JKU5s@x(Zv-m#xbfrFy6(bE-q1uxUrUTyUfJ| z7ndtL*mY!|^8{`(RGHb_L7n58}R`jO0X4_Y3!G(Fji5D8%HGCJhTe!H+ zwKZibir;gwtPvT>8(iGz;tm&gQl&1YySUZGZH%*Ga*Jy%c-NLVM>B_`wTRGc17^6m zoe@?GPW?0aGhN(84ZFC{#oaVrW~DK&=DK*w#nUdHWvpDxa`6lePwC|=Ueg8u8a9J{UT>ML zgj01_&bQr|ROvhyFSuCfV!n$7a#ODf>4jx;5hW77C^b@(qmw?~5*IJKc*Vu5E|$Ak zLH%snv{cTPN%L&usBnJbL6vfrn*qMYnscCSbE0IWstA%dUA*PuI~U*6#%Mg;4CCTM z)+9Xfz{R_CrqJG}C1^r};mqNQ6E0S}_*~jp!!p95gq*DvUnl&tfyvjq_{7DhdP={a zxti?a|GYHce(yYd;o?gdUn!`sU3}x>Tc(10M>XL_JExX7{Mq2*2N&5S+CS30i(g&* za_%>JPhsQ4F{mY!A*v~Fxzb`i2-Oru*G zk&6mz*EBk$Ek|NDWNB=XMwP{xHLc#o`lLY`n-X0iZ97Sr{Dx^XN?Q&#PFulg!a(|2 zAnY;H0ZFs8^)a@To91b>NSiOZZ<)3ZCu_@AX|ztGO&VLJu}#{#tXrqiRxxRpHqC5E zx*7GNLBH+OHo?VPe)-igjm~LomqsUfp|;rAaoW-1#0N=s@2c$7beg~$l zzM_!v-#?85bbFxGH8_ofbV~=vvqqA8a!#!umd4>}oSeofde;$Y9Gk{*X&jlxQE414 zmwd}HddkL#oC|ixOU`$_$IfsXC#Lc3Jd4jslDD33TZ@N?pO(hy@;fw*Q$>ae2WXjq zUd~8kWE!I+94;K8wDS>55RvgbQ}VOYw#kqZ`aLI&(J~m?$+^m!F==Z@&Xe%`G%iTe zdtn+k%{9%8O=Dadmj{>_;F2`Pr*XcA3p`w!#${<-mBpm2>3IUvlEHTwT%N|nG_FYF zO6nnlV=}lZjY+iIwC#tVtk+FT;|7r_X-pNlT6m3+@wryyI^p#~?xx_eC+q^<$cUve zohFpVvNV>baZ4Jvrm;wgy)BIyX*?wz-k!!CY21^>y=mO3r+3o`dtzo9cj=a9%!-$l zGpjg~`_j0dnbO0yPd|{hM-R#wRmc2#hzeID{%{(P(Dpc%5t2M6^0@E`;gd9e&E_$v zr_-2~#xrR=o5phr@OdE(vc9WfHjRf>X!5SPY0OLbe31n#cOnZDIb-r7O*DvDjG*+guN*bmTm{L~q#5dA-Q^jXE ze*u}cpO7+(*<`$%Mt(j%N#i}5foAyMXC1-@B8?A4$UhQUEnFj9D_kf1IF0opbjh#1 z_^wY`+obV1tu&1<({N>$tTg)Z?7lR=KMDUgja0%N5$+nLo3waFm`x*> zxM4IHrcW)UQAi_5qsWRYgPs|b(kQ2~Lk3+kmgKFZOJAKS*P(M7a zrcq1dKi2%LOEc(@v9^y_gAAHv&{Ve#g^e<3EW&RA=wOQsnq|;VlI9t-$e@jQOCcS! z&R|RNR>HckI`ZjO8El=nY@0aPCXuuk**0U}9dLgy-FM8OlZ2gx+X=T9)*bAa!A=?M zl|i=*cFx#NTAF=}DW-v47&rd^J%imub{Fm;+*8P>T}7VddG9T3E{OAo-7_{M%y9^i zLGKI(XK-)^duPxmgZ(n-pF!V@ebY2U$6fL*{W3PJ*e8R1GuBHaC-M+8ev&pIV;|P> zEdw(cq&V*{JV1D$kZC+9V_&b39FoDI861(pkr_NV+*-`TsC=IPma+LIw!&ObfBO?0 z#X7K;t=NW|Gdwnf<1%J5V>38DgA+11JA-pFIFS*{U|0sHWe^Xsb2Con(-zh;o|3_k z42EWK-BPKXK+mh*D|pg+u`53yH&hnI3DDNf4uHuUTEp+UTQdlbs2n|!TlLLkio+lJd&{w zQTb88gBd);)NyuHA9t{CbLc8On!#g?@DVmY$*kv4|trkKI=8O)Z1kLG1CCxf}V{d|r&UMHNNNET+WD1%orcr}9;C0v~N zeJOFXB!ia|&JgP1EX`nrgv&Bm&NL>0lf0HVrpuM$tAzCXMh0*G&r?d?$>2jt-esa_ zE#mJBKS*3M%#XxZ3)cwgcWvTeeFmRo@M#90WpKwR+xx*KMGgR|XU-UZ&Wd6_zEC#N zAircmmPvmt{6#^+(}P8T>5rO9sDY@LL8OS?^`h zDvRGU_(P9cX7OhRe`SE|W_$QMgLDQNJ^d$xe?=H_Dg#H{71C}g%(Ap{Vn2hTgt-hn z5nq@W7KGd@PWQY@8B`@H3qxTftO#S_@u!;mn)rVzCcNFGTTVtb$f98ujk0K*MYAO4 zO|sZRylEn-N3xF1C2Wzk@hpR4RmP!i>nz%2v8^6$mBrRsw98@}O4tX;f}@q42U*vG zMUPu|Dtc^x{2zzGHD~sM)?48AdSsau_ zpR5gq_Q_)3Ec#}x@7gbG$GCAT5&3>uJCbNn7UM5Pe+DQAw{*wAtSyAGgG4vkc+PJt>QmvlyMlxmlc&#gHt9XE7p+q0D8@{A6*O$f;SIho|Ip-IAP< z1$PJU)c}hpY(AZMWEN*;ah4p6lEzj8XX}=A={bpnZ8yD-k$i&iSoZ%#&R4`P5MG$Y zMG{^tq?fT-j7#_>BIAXZ3NI6GXphT9=zgNe6Q29u9J}RyRx`me46kE;f=zZgwusL3vUt9*R5IHmhc%_+%A4cBDph* znF%j8!QBbJN911NeZu>N4`lJ6$U{Pg|FFm-Sv;CZ9?Rl!@h1|=lOpUZ@|s0`X7OAW z&m>Pze$kHSVwa$fbF!Gr678X}hk04d&tg>;Zz#VO2v-VU$YP<$BH@d|0i0^fVsXNk zWbtysUlDm#xKy|-i{&CKgs%x1!s}VkR7iO7+o(4s|A<17x3YLUarsUb?td|W;*%^s&EhlaEr%y^_&kd*ve+kweRKFS(UPCV zSK?o1@eK=d7T@XiU*Y#z{Fb$jD05_kBtK;FqsULfpM}2&e-+NspK$4Zqi%l}{=rs2 zgz~?#_*?uR;iGb&5_b|eZWif;XR^qO=Msr0!fefFQOF|5qR5&#hh{m8XDN#+<19C2 zVJM8UsEE)_EW%O1e~F}_{BF`Ma%iAi)&_LkNSvf`4o$?HCX#m>qj?T3a%i8!wi33? zVQY~sg{=~ot#fFT@U27`e}>ssyj>34h=dY$$f08nT_x$1L+2cJ7N`5|a@Zl^+vhfC z4dq=V+)=ob@Y%-LC2_f{$Zo>jbJ#;Yhvl$;;`e|Y4ovt#ISdv* zSa^t#<(gsgI$XCW2#?6&NRgw2e0p>a$0Yn%k>heWUgZCWaAFQ8<#4iur{r*Y;(kaD zLlb_g$S~n)Irtyi+s{az4$omk!bj#XD&c&^S>k64>v}jhhcP+an!{~5oG1BI;rTgS zki&)Im*+51hFCrho`6? zZac~0=^SR|@Ny2XxbAIpvrvy-%3)E?_JzKfvxyxNIwoJ7!;&1>W1&l%`N?5v4qxZ+O%BU)Sf0ZN zIeeJIiX2|c;r$%AHSYBsRw}6X6bDKe+NvDh(9<`CZwcQPz9W2BNWXN?i%kaK+n>`u zIjqiMZ4T>lwz|Y9?Rf##C>4z1$2qLe*%0!`j+VerayG9^@~IN_necPr7s4-vUkT}v zF2Bv;yBvOEG0)-q95&?eLk>UY>_vCYwTlU-v-+exHS-IrzO8KPo|6WYQ}P=VtK9ir zn91P}5$4yQIsBFIzonCZs9q83B$b1ca91Rq!y}zc`C0kO2|X6f9P&97a)4)j;~$7XpN#9`Tk}oI{n>rsQ?^6p|1(Nyre$8z|(4!n%Z6(8NOv z4=p`3^=wqaYYUNP9-7M~yYXYVVZcKx5Bqx9&qHeuZ9MGZVNVZRdDz;+b{@9((AGmc z4;?*p^019(+vD4Nb`AqSx91-gw)HHpsp<|Mo@i~`3p+EkzWBY*=FQ}na^~Md7Z1C6 z*xkd9o=wPeq2wD)O7G-ZHtj6jMYyYw*~BFnKH`i);}z)YVJ{E884Y&+J#_cb!$VKc zHg)q`{^slLV+wu%)yuPg$8#!!N#pQ*Zx4MutQu;^QTFxhz`A}4oWbrxZSX+X9_a63 zfQJztMlw+gFwnyw5Bq!il9Z)}hrfCD#R1iIpofDz4EAuahod|k?cos54C!zWERTnZ zA10)5<{W!;gl>=YP`_oq9OL15zS_gF5+295tH`wKjuRO}1;x;qUtIh;*~2N4FsLC4 zYN+s3;V|K8!qbIk2!{(BwXq1WZW-m-k%>$)GvZ7plTCn!vpt;SVYG*HJ)Gy+V#HV$ zC?06<*<=fsMd*G#zxCrHGXHGrVMyNMd69>UJ&g4*j#~1uzi&0$B_5`DnCf9XmjD#h zWge~)VXzZCT%PcWB3F30Qu)ZI+*M1QB>7~|HYD(NSvy?q;TjLu(q=TXcb$jpJuLF@ zqK9c7Zt!rQhx@XRdj8-@{rODs$vxocI>lo%_JUhs+(e0v=X-SRwn>ALf(Gv;fsWS>ESE!uRVO@;ad;idH7xuE|c*W z(iil?*p;?Pm~(VLc(&&Fqlce7{7eI5wd3JW55LO&@50|aY!u<4o%H_Mb6BK0{4WoG zd&qj$;Qr&`Uk_)XL2to;UYg1wKO3CR*lq*a{H<4SyNtMEJc_G>fx>ZsdJK05o@PJDae zj=~*$bP!xYtneJd1)_%_wg7LXb79*0OR za5$g(IMK%uzUl2q5|%6>$b zhU(Qk9D}!~`8b`C$>Z=m&hRnZ#};`s%UgU#__))@OlrW#C?99~ILpT*ACrBY?c*F; z4#V_qVrsOHF+R>?I2`Hw_Eiyu=hK#an<(Q^Exf%@E-w0_dgE994fcUJfx^{_2HXK)WpBA?=8s*js|O!sj$70Z10 z?PRuV6*0zPnvd(`nEZMX7B})6k`P{0$Tu?yQrGR0-%8!Kz-{83ALbipP!)YGQLneg z9W?J%#_#fRw~tSKeCFdGANTrL;^So>_c0DW=K7eYv{2^{_;^sEJ>=s#AJ2sWrjG-KoSv5)n<8d}UZO7e-1y8V3a;|m|YkGzjBS-1H3+s8jXzV`8rk6(TKrf7UC z{NBfRB2-j7#~Pgtv?b2}`}k3W{3jnji~o{HHVnr``QqNZKYje};}74?=&NghGr)iO z)=TFtqxUbJ6-dCoy;PU=k)x#h=Ab-1We5fO^%1j5_fhmw@)1cz z)B}qTO{?r9Ost)s=COXO_;~0vi$KlCf3oT(d2I55yeW-d8strrjfD;KXq3l=iUajf zk2bMs{{K?M7d6jgyF9kfqeUJq^Vl+vR(Widw{Zjm{9`>@=Pl$m3X^4oUbfDoZ659N z*d~vTdP-sYygllW$F?F|N$0z0Boy-MBw^>gb-);z9rEasN7p>|%45eocFJRS#cBY1 z{&}ls_{LqBC@%ieV{;p@@0K@9c<>8*w1-~0XWq&qW7sW^?s@cQk2H@SdPFyU6kyLh zdPzCG^BRpR6&#aNOMUa`r&uvj`{c2&+%sSH%UfMU6J-e+n8%Z+jH2kVW8sy}?N0z5=mPk!Cm5qTV$#|e3yn70j*n%1I8p=JZ=^5q5?HT{PyJO9eLa-K2vy?@Y@y^ z;5~WVOI>N5?mk78iDLJX-RxmHyXL_>9?Iik>Zh+Qi}NYd$Uf3zdE8yVJq0|T#}jIc zpQIapi(0@_c|4uRtUR7!xhtSm0ng^~Tps`Ck;>!wJZ9(dSstI~F(;3?d92N2T^{rD zn6C)%r;Q7!;XD@Rv519nguRp_CgO{EyrkH^%Uo8!h#iu}H0(TH&f^uDG0O|raPwFy zLjGDF%fy!pR|q-u<0D?L>vpAZ6)mcv$=}p1$y-#E_&dV7ulMrSGkiaB^FbaTCj6s3 zR*SFsANL>UZMgR-D;Bm>dD{m_@1Nvt#7Dx5cKAgeU*@qPj~^8HSIqG|zRTn5Jif`> zK$UKYth*Q#BlbP(z=oz7N`B1aCzd{`?q_(E?zAQR^gDeE}%^ToeS8mfUOGHx?ma9serZ$zeB;Yrd%Q0lgItA2B8rGLoFC+FJ?l zQ$Syle!_i(`wI6H_OGLM{S7K${{oIL-~k7EOfDr|ZEMQatXBKRS8#nXctTXgDlXg}ClL{#H zw3g`Xf}Q+!P649}I9Gg(a6$p+6>xq57wC4J@IoQoUsS-w2_IX)F-t5EUYAHXzJN%hrphRHqutl008<}t#i5$-MEz5-Sju&RLj3wWS_c?HZb;K2eOD&XM)9x2$FoIH+( zb4{aL*vUNn3&W!fmPdB?$78Jj3wWY{Ct2+)yXO}0v7EmrAWD(YOvPglva4jk#v5+pS1=PejSHs&)1>3)ez@pJWNU~EqG!D=tK$`$t z1!x*zivX|VH zV7CA}2G}XU&H;7_@bqM}5Eg-VezE@&UdT6XJFs`ZPCIs-!-tV z>|O!71-4I*)0IpzmpmRGY2l=LnudD^*qaIoFfc%$0DS}O7oa~C!Xw|?Sy!!}lCV!; z70$j4hciO@lN5KI#Y600MS}wDAK-uh2L?6(WXRXNg0mV}8D|xGP+)5fESs!t4he8* zfFS{fGGYM^4{!{%8sLZkM+P`5z|l;?a$9BKK^(L+)C0!_I6lD10ZySp zw!#U4tzz&Sme=?pSb&q1(z3Q9^L3rSvS{!+HNda{7X-L4z-a+a4{%<9^8=g_SY^oG zGSk9z4G%Cv$s8#hC1jSJDRP$Z>;UJ8j2507V2lV00&|4dq_y^w4mR!|EyqPPj{uhj zxGbm-fNvj*juK)s!59}{6ER64HH_?Q^4qN8AcHA>Iggu!}o303OWq|i1 zd=TNP0FwgTU&aGvOb#$5z_b!>C|MzzO0y|phZ3$1a7}<~16&s%Q$)6i>jPU+x-q~_ zbRXEF%ndXW)^GX_h?D$dbnN-`05=D?CBUr#ZeyZ~IIn1?K7(EYJS4NfJ-{6zl;0U( zX2S0ZaCgG*5xG}*pYZ+w453nJ?x&R*s_&mTD0oKdq zC&Ic*I{s9*pD`hN7bRax@=buRL@4=Mgzx$`k$ji9{~^GS0e%ngM}VJ_r@xB)Ec_*L z`I~Mx3hNsNh<^t7o7H}RzXIEeP){%4_-}xeT$2B^46F4`Wtzqr07W#Qi3Z38h*cYV z0sH{v#C<+MG2sP~Kv*B%mY5gXr4ULOB`zx>j6hYSmdO7Lut}W9UNJHai)d6t+alT( z(YS~vvi3GbG%cF)n-|eSk}Zm8CPFXujZ7_zXeG&(!vC-B*1DyetrGWJ7dMZ@w<)51 z5!)59y&i2_M90KUhvNU`SEnL6OJ3LB4v8D?LFyvDBh6LT!k6w+#I8yByA`o}5eF49 zxQIQ9R@?V3V(%jMWLk>YOMZI^yA{#Bh#pDEJ&R_LOj=!~Bz$$BBKj7wZxQ>+SwG=E z#sAxhM92M$7$Eun!hyxjInKIhkR%~b0Tnq=SP%K&A`U5HSP`ccaVX)CW_(K=f6 z$m{eXMiw!uh%@A1xRCM@Nm|ZK0vSzT;%66ejz~RLbv!r8!Sjo_pooo0IP9=pSj0tC z6uSyVTwBC-MT{+CToIQ@c%_g}$BSHA#APBA68YstOccLD$VF0iT(3%=PAXz@!lx85 zRs3qt)n~IoT#Qlox&BEJ?m{G(n;qtBY7)#3vH2DPk>4itKisBp(Z@=TD3H ztcYK9`?>I|BEA;+Lii=?gyEJK-xTp}5kD#6-xcwF5kD01V-YXU+gu_x&^S3A%})5j z%@Q70`?CU}ckUSZHQ~RB@a?~g{E^82EaETmzlHxK@_$8AML3DX6-g&GSgr`Kh)yMR zF2SchIX_>rFKhDRg(89?iba$d`6B*fIpWNJ5izTa0mj23q9Q6qRNLG5<;Na|Rn>&7 z4A~*vBrgq1RyXnyO4eg+Amp+dLujN&oJDU^vbQ%aVT%%)m29fHWeHn~G#9og*(@>T ztx9NJ!Zsz_58p^mVKlyC0tj+^(E|B!cHX{x=vk71P_&VpDOjDdx!pXWFUBW3M!;_~&N*J2(Q%e{o zewy&~M1DrezI3DhM@TYKI4XI1rpQ^svxVmfIgx&@2tAG|;XLv46UhZ47nX35$i>3? zTP`VKd3IV4YbB^{$~k1avV^Osb58Y?aO+Y`5@-8D$>fra zTsri_RCfO5_nH!}6=C%FI_4dN;wbDfj&rq8eq+fx-p`jXyJW-Xn@X5o!p$Yz!oW+o ztAx8txQz-a;m#6f(ms3G0gtzr?6a~vfehCXoc%g(hOL(hh={8Zqnm8lw)d^uR#s5f>j4AiV{{be^0l49gI0A zwYV9K+YDB*SgCY#0*9fodU?BqcS@+1P%Gix65cCeT?rpcrSF%pngw}*ZR7c%gbx{2 z?iCT%XZe`AH7ek1iEXW-S!vXyNo^}eTDtX*r$wr%eLojzq0LF8m)6DSUYjbj*(<~2bM9Y zjQz_vpp5ZlTw2C~WgJw-X=R*V#^5pzF5?I)zl=l5IJAtz$~e4i!x^5n&Ruz&k7A|7 zy+_KnXdV|W=CmT^%TBgzrgqc+x`@36wUXP1>Rp^O{KxUr1O%a~Zk)n!~$#ua5;S;mwyrm{{OYD>&lm2G>& zBxTlQ+1vTj8>c8a<;5e!*(YU_QT(|Vc#k;a~aj!%Ql18wWVzlq*m`JTWxb^*}io;w*l@hjQ$+G1m_4yQ|q)a5ACGrdto=Bc6<9YGf!a0e2ZW;3uK3`;k@P#rKCi3Cj z|5?W3GTtiV?J|~>@iOhCjMvI|rHoh0SX#!ivT1eNe9V8@`czB~KkHsD!`OSJ%_qNJ z#>z6@DC13L8IRJPWVlKt(PrC*+P+He!QkexmY4SoQrZa&j~LD)L(* z-&n@)3FlLW@Mjr+C87N-@=qE6ill^2^3)ZfuS^-)GIC{jWfZ9d9{V69$%}lfk3v8cnaZ_gQh)2STFjl#!PZ9iA#wJ$#AsU7{`Y*KH+}O)%8xD5*wXwPV^{s6p zy-A3sA+`+2qFSLu_7`?M{mjEg1wS|3kD2(K_5bR%$EKCd5`D zwhqBb8-9VyIIw18A!-+5o5W>%5r)|@M5hp)Lu|)4a>Bfc)qWjDVEfQ!=@0hJ-ncV? z>Fp9?$Iy0G?-XLs5M4v;9NPF|m(V83cMY*yXg#sr741DjD>x@UWG5>!o_mGXv<(dH zkgjeax`*f?zr9239ipc=gX$%6?I`pS**C;~B7KGZg!>4W4nu#D0YdtvFJ2^rLhK*n zfY2)814A4XTBqnl{TPw@w7KC^E=MQs z>s#-}=(f)9=U-O4;Q~o63~f&xcT9~9F)qY}(3;vy^yo6-_z;&$ja*WBvYqL0iT0tf zq+cFlqP$-rY`4OKniOI(YtayogqXs}hqyJwZ6U4>ag73;9^%>%*M*oC;s#0T0bU<& z{(_s4ypaLw5!1`3Kd#uk4f19QZ;|<(vjb*?xIM(o5O;;RBhl(~R{qi?6GiV+|G?cL z?qx=VxJTZ(HJ$SNLp%`T!4MCH;6`yu>hB`586vX#_o%{QraT?uF*X6A^#`5^@uc+3 z@Hr5m%cm49qs=*=Sxuv`0I< zAkA~7a&d@-Ar{d#xCJP*?%zwH)v;7KIcwS})Jce!sa|&eg|7;i3Mo9RnH8lKj1`Mp zXzdppO4{~H7AS7!39%}~8_b|pmYZ*ecq_!)j5a;ex>!y%pkO55Wie6KvyQ#Kft~UD zL5L3(AUT6w6I$&Qu#AUT%eq~Ct#wM^$062-_$0)qAwCQ7Gs{be&sq70_%_6MA-)Xp zRfw-cd=pwV!Z8|4BG1q=C-jBvVDM_%-Fmrn!!l9|QRbrvCq_C@Jw)#a zdq;>uR6@iwHr9<1c8O36@gKDvVVek>_{IngA~cNf>-YAPi)SZWn3oPfqsWv~(HXyu zBQ%Mux^61mB0{qW&Ba>_TL@bUw-nNGD-rg)+K6l=+&X#MHhJ2f5st89gq<9L z9|n8TXSSd7pveCF$r_AtJ0!xP5e{Qanp#W2j9^T78Vp-2&aE90;YbC0RD`1=Y~2pW zL^v+8eg4M^N%+6}<0Eu#Xj?CMds2jxBRmx0;RvTh7!u*^2Cd%U#Ldqx6nCD}9gqtIqF_;`-N`$GAz5VJ4H;9m56X9C%>k`TJBGYKnSD9m8 zH%7Qg!X}d365-YecSpD|M3@=juE?vP>JDP$j}IM9AE#wwke zcyEOJB0Lb`!3g&&jqKU7`n{UNG)@36wVyBSImrTfB*LQ+-ih!ojV;3CEC@2%oqx3{ zP4*<8i11{Dry@KZVOE625tc-FhE~U!s|d42o}~svC}fEs&WSKTk<5)Sk7a?sX>MbB zUJ&60Jz{-AmkT2-((Q|pjq!QC6q!pBK7Cn_mPL3a3GLMgOaI6Fa`6?()7NOO;`F{U z!YYMX53L=WfXK$nZ^^;ikwu1;>U$9;^H^H_^`2I@p51;HkO&JaSX9C42y0lyRd7

6?`9ILxevg{1xE`)+C!Y{ibsFBeOfg&k=rMZ7GTE0@60War(If zw;FDY@Hu(nP2$=|3)dT;^yCY0RR@mv-jgXdvH4-mMauK`;RaV*& ze0j`AD9Am7rLQ3I%L=dV^;gzW657#=tT@4J&9= z!L}82sGxBLO)6+#v6%2`TEP|-G}A2|Hy3G9LCcCwv((*eSwX9cC7=Cs22Nq?ifN#Y za4X@~!nVS8!fh)5H$P9u9V@1DhS|A-PT~xQjS+W`knB)FmkN4T&`S~6QMgA1J5{iA zW%KrFI@_g!UFo-i-7A(}23XImZ#WTALDvfQ(yM#u)!i!Su4r>#H2vN;cXO`wu3+y9 z4z1v@3i?#gw}Jr`3{;f*Rj_Xb`zerpD%Msq=KXcc5cn>ti0>U#!TuEtuHfJb4yfQj zz2zVw-BaOg27 zzkgvnc9?{wEij^D^Q#P*^IDAas0z+xdMh})f+-bDt>ByrMprPQg3Bv5*}~cHo4J#) zf-#B}djjV%hAes&Tp+^!>V-_>1YD%siz^r_GER7ja6Dh3CFx6bdzp|PCrWjU48Ok~ z%Z)(vyJ^#v6e!Ic?Dlo@MQ&GRjfs3>--=8 z{y7w1SF9J!=7!D0H;fWDe^&4vD~AU5>C^XY2t?Rq{8+(H75q;1(!!bc3Vy3#V+Fsm z6g0u^6Refz7>dg)44?a}pK5DgBL7*zUlsh#0>w(Tp-p8_+Z=TKE2E;$(|v8U)rK{H z1?dW6mdXk;6=W+YR#2jSR^U~Tub@z|xl{J*d{%LNZFI&p9WG-9$`Ni_V{O3Yr*Z{h z1rftnx#q}%`(}AI1rx$~%bf?{iH4|E@E_w7qj8K)tPx@~h|w^%xN#ka9|b?Iql}pl zDyPj*G>OqP#uhP}#W?yq8#J*>A>P))_`5Hex?0BAGR96Zc8?rIcq?^tn+X=Uiu|pzX!A%i**PjE;igt;y zYm5_PoD^fX7`w;l8KYN>J!0$`W3L$97(-^wK&z>`##RPd32;EyJw}h%zN}|2i=9C3 zM`bzf9ow17$20OV_Kwji?L6PePiqw6rnF$Rcmakh0w3=|&} z$@O9O38~=O*$o zvF)8^e9liK7cgB3zewcb*v|T(8?NlISIk=I-X6F##$_?4#<*HK=OW_-=3rA?PK#1q zF)_v!OuqP)F|JDZq!^RMrz8@Nj<2B(TUd^-ebpLeR@B$UxIV_T7&pYYEyj!(H^#Ur z#?3KqiLFD<3TnDu%@WEvF%AZ4?YG8u`~_FgIPknZ#vL&pi}84DC!O9I+pIq0!zO!X zjJsmo9pj!D_r`cI#zV@)`-Bg~xL*oqUbFnM%^I%0_rtM`XCI~hsSy5uxq&?*A#xbF z^+-HHV_s+$%PrPV$C$Sm(CRrixud#;F;Ao|8 zSH;#x;`K(1H^tu)zMaV55qVe0B!3X&!x(;ye2kA`td8NtaAT~Au{OrPF;X!;eGcnl ze9VH(T%e*i$jjN}J-q?N81gr8%pSLxsvJ*AN0(5`-q4L1sZkMW1dpF+z2 zit)GjKZ%52>n!SIR?P-z_q9mJ$i&FS@MOAdGN{RHY@6!YA7HuY^McKvv*9Sj2x1JY z;3iun_@tO z@&+Oeg^h&uCF!PBw9@Ss!e+weRkRRkDcrKUc@4VmrL}|%vyI4B!mWjeHo!Jjw69{9 zDt4`6+r;H|Rdf*Vm`FN_bWTFvUbj0`(M4oO;m%d;B*I|%I$k8ZNzzM5$?jF`QN^CR z?OH{*D!PmBMUt$!_o$+0;=UdfAN5Wodsop%ysxnCV4o`Xtzy3_`q!Na2UKym$iONF zRk45l5o0BCKotjy9F)ihSIyWC79LWy_L{ec>FK#iijJt_NI5u4@}m>K$5e4_!jBU< zUda7FCsuJ%6({Sq9?mJ^Lxim2sFrw+O=7Tz&*{X|t2m>IkyVVU+Q&!3t2VdH%5a3N zh&>S2qG$bqGpjaf$@XQ6W|_{e;+!f*S8;9?W2!i>3jB)m&PHmZeI0gw6&F--WffOd zt-s9Bt;X2!FL z&3+KsEZ$nhZB@*u;`S<@t>U>V?x=#jg?oi0cUCb|{4U|$iTs|b&12I6uluUFU-Ac% zrw@ueRK>%IWCiAOUK>K8Ou8M{7zKE&Q<|qnZ)FVcFaTQCdc$xaC;-@NpuHw}ymR7N* zinUcNt73T-?^f|1v!DT1RI##(RaLx39r6*d?QrWav9P>R#hX>U#TPMyuELbQXgeMo zufaQ28{K#uZC!1Xnd7)vP{jvTobryzKdj=TDpt!43k6@nJ}LuzccMLASH;Iwtgqse zs&zzZ&+N(Y`x@e>GzQtpXH|S&#pMmn*B4cL#Ouo{z7qdh_>J&e;djFCg>=d7e?L_5 zqk`hjPX@xEeyQSDm5#8A->TSH#UC0m9etR^ir4RoFh67Yvx>j;=x|zsG(U6&1*IUW?|$U9XlBO-Rf?A zZJOHlHq_9nhSoK-shIaHl`Q?{cZEI*(L+2W{t6`fO+SkybX1&mDYc|bJ zXAGPJnZXx=(TA zK%i#!z*p~H!ya@wpuw*L8th474Zn41u(3;ny=v%I!}b4R+JER?LysE%so~!mde*GG ze599hGGH5^pK;c_`xNSBAyaIiRg%k_^957q5qHR~JGL0x!M4M*2- zeB$evNrl4OKKP|a%mFt`csB5p@z%#Xkralh+L_ta+UB)p8r!boFtqqoFbemtf%N&xnEkt zbnRItwT{imi{=f7)l-0%Qp;!8TZeTaZ9D0YVajOV9@o4esvl?ry=| z-QC^w;qH)`?^k!S-<~;js;jGRUB9=gt9#wWcFCldTICYM0XVc=){jpY=9N?2RR*D} zqE}CG*VyG`E3dT@9Il(~K!i*1E<)JC=;r^CKtn#Rpk6HP+l}}jtUpvtLl+~Y};+~n} zp0)aOR=#BA^HbalQ{0PF+;zuz>3~C*>TdbU6!+>B_u3Tqx^;fnN-%k2ihHxa{+3nV zHd@}XdY6j#rnvWw)%5?s+CRjrP?_RBvCB`VxX-Ne|1(nge2V+R8oNNgn&Q5m;x=o$ z&D)-V-%N3T+gw_lg_b|8@~4%5 z;iCq-#o6hx%YUc1DN|e9$*@?fTkol-*s{%8^zs z*LK6L0?g&DvO?RfXqA=v+eftB%Ki0KtkNZ_%c9Y3w`$w1*7jPB8t~(lYHoG!jwDt*Yw^rM&-S(XqJ8G)80h4vwZr%PF*K51=`|BvrM*a0o zt+H|3O|;4;R{p;pc4yzh8ux0uEv*9N|5#naO;<&au-s&e< zd7_mkS$VRRr&xKamGnQY?M}D)8CITY9>%&%cMA)xKPZM*N8vika@}!3hl5p~Mj)ge7j^uRlGr*V9e0kQw4dK6_Z(dyDyVes=V&~Xb|Wg#nJ!osvTe`}b{0@y|D)}kG^m{k_HlJ+I6 zLT7}#RL3oC{g>$CK1|7Fy$E{+GYZ$g8JMQ`+ zuFqOVSvlIuRSoiL9j`O1Tgw7`UmSu~~-`9iHd3Z_!~tb}Drj znD%aMmy%_?C*mG?bLBQ+vP4+VvG#gwc~cP%iTL} zkB-~Z>U&$cmz6sXn>x!rcDb*W`&qe%^N#(%j{AkLo^&u(cW}oYg7f#f>fZ10c!fu7 z?y`=%yyJTw(Q!YaQC2_F%A>42+R6t=8Zn0s&w}0Y9Y_6yjyvBfCwAOPRyn!j&a?`5 zPwBW*t$v!7r(1c()Y60EcUH%pZ7t_mNz1t%cV2(}3?2dZ*DtinMICpsRW9jozqG&q z71r`#2lv=v;FTSBmFH*Y>W;gn<0g09wH#xj7Irn78LB&%B?b(i7 zhkqc|ar=*O&sfXjHv4l1|M`x4!O%OGRqzNu%S-+e!{kh+d(E?DDz+f`KCb}ySv>L^ zT4&IB+d3S~Atm#K|+rR6$@2&nrf6I>@x5!98_Gd#3tyq|2KfJbU9r~uzA00l( zbHC*qu_{^_`X`Cv?-B+!(OYj@nT(sB}*I;TyYHgl@k`FHAd8sgM& z3YA$InC@eo73!0 zr;Kt7Oy>j8EKai;8eq~H=KU@Ha}JyCAl{S3^E=J$G>_A~PG1jqUyb#@_j?^!&F8d} z#X*oHG|ca`fYZuOtI$sJ@3gqn5>5*_E$lSZX_(WZPK(*y4SU=HJ#G=F`z$!pf0Nj4 zKia+9>y~s{%4vD06`YoKTE=Nvr{$a=YRT2yN2A>hqaD#1KES2n@We+(pCqj4bY!m^ z!CdSGIS~-S>SDuiq*I^MIH&PWqnt)Njj?XbyQZ~c=sEPc566| zbvk66`+2mxW1RPdYdTGETF+^H8@`s)+D_|u{`kA#v#y8chhNK=CwVC8w4u{RP8&O2 zG{&vRXFOr)5I55(Hxafwfgv#zv7T($Ztk>&(`!zzJ8cQcP8T~};X^G7xsMK$LS%CfO5-ef2$vAZ z`xy7|M4z|7RTy}x6Y=XblLD78e-{4jm(y8J=Q^Ed7IZc|>2Z@rdA6Kmb(lYSh&$iu zLfDA^H$6uv(8#Te=)+;N9(SqJWlncH-Q#q*(-ltFIbH8`rPEbTlbx=mg}t~L9NKlY z6IOE#irwcks7?A@Fv$_D>j}I*s2iPb19_*LoNjhnb%>t}d~N|6p5G9dd6aLww8xv( z9Z0;#-Q{$rby#hPgF4{v%E1_n#pyAp$DQtXdcf&nr$?OD>T!?ux(9IxeLki?Vhu>!1^{ggiM zEnjl_bd*=%R}8V2VUc0=stw0*_`TuuCLT%3q_>>j_8-F3uTJkcz3cS3(-&B!)BETZ z0&@C*cc=QibUt$W&}Kvmhzvgib3VmzhPZ=zeTUDm1#@Ws8}0t*^rh2x{=Y10*&g>v zulowuWcu)p)3@eckmI~P4#q9HV8Te-|2%_z+z%`ETpPv|q}*5hW8W|j8_-+tuKTXK7( z53lBs<^)w~m^4_LOPW`jPhKZ+adQht?JBJ-ts-qGZ6uA9`lL0b3DPKOv@}Lq!-TS`M9^8? z>Z=*HtoU#;IP-HkW67Sgb7O7lang7Q9O6ziLe`SjmevJ->CGOuj==%*0pq>I7as3$ z1uu_s>q{FLH*Oo_HEm;QBGBNZw28E-w3)QIMC`-azB<|w2Pt6`ptg`#+AVGPKwkTz zB5g-!lL#E!Mmo6H%X(XR7tM4#NIObj&f}FIG$xr`c9u}No#cHc)B&8!-K5>6e1kLzHx>?d=b`xWm&p) zvGgr3$c%EANC0Q-<`_c#Wm#&f?gw@j3(lyep(rwaYI!iZ7H^E8gu9I$%J{sk& z2UXN~xZAbsBn{hmyxXGJ-7MW=Y(x;ua=UbgbhmVmbf-jzyU_e`{uT;AA7o8JaxX)A z-TgN3J_)x&XZk#Vp3mUj=EKq>($ms2(xcL2(&N$-_>evylIVHt5I1<7dy=_&y*55& z7^2eLdRBT4O~!R&Afw%3Jr0pQZ(MyrdeJohrLLM;`HGdVTKSrlXyEH$)n6yL;~U>L zbADHP$L2!Gu_=D<89>75hww`JS^7o#So%cz1}R9NN}r*(Xb80Qx^tZS9NU@bS@DI9 z1?R6M+&i?R+vKZXV^Dm%iO)XZ5PIAX(vL_abKi5f*DElN@h7AGrXC+z==m#tRf-yl z8~PpRFa0C^YZLt`{cVPZM*U?(;S&IYAf}iiH5v*UYNM9eX+vswDbRr*%EOOJ*w9c5 zqc8`A(eR|9w4uDAqM^)&5UHCDZx_fK)onFAy>x~I9PcP{#fh$NXh1^;Hgr%!(=;?~ zLn9mNYiPQL1~xQ*Lkl$2)6nz{&Dqf4h6Xh>LqoGRG+RS6Hhh?yx#4}+Obs6(&>YV+ zvZjXDAMTPUp1Y(E;n3AuQ#IMaHH2P4<81xspX^LO0coVjc9mB z#}Edt+|Vip4KkscSw=N9x}mM$MnkJMv|2-JHMDj^t2Z>Jp>Yk3Z)gofV|n9`lib*b zcf!mFs%tiUY$6`vb57u;VB_AJ6Wuxut=rI+TsE{`L+cxpw`gbst3WaiXTye1vG{Fd zm5r^OXyqnWZradhR-w=4AbF{0CTlBZBq?I{#YQH5?H~& zhITOWaeWW5`D17^7A9cqC-?b9!Ojis((qZ$u4wxtum7k7eA}a;JsaAmp?w=Zmf=+( ze6NP~Htj{A2yVZIVDJ9M0bmkz4zRmGLs1WI=#YkI1rpeLmyfD$0mKBgIVR% zhCZ{(=T?5vfA@b4eQ9-aY&!d7088N!0Qd~_}9n3)rS9KI3sk1{ANr>r7b*vG8g~}Z_%(=iP{ct`E z)Cjy=!v=%EdoZjCO1t<@C zKzccIpvA|!SppxMkQAiN9%zn0a|N0^@LqaOy9IUNKRED#gKqN#KHG$x5f%s0sNO(B z0xc3~(LnPDS|HFufff$5AQ;*f7TFrK`y{8=4GlCb@E#ijgw-I!x_&V*3AAjWOKx+kBJJ70uRtq!^!3AQSyLzBC0`>NJ$YTPrBS-c-Ht>sm@L>V9 zQbVIw^=qg#15F6LKkrhvPM~!IZ4hX~zz3l9jORb>=nZ83z(-h|1N3ebXv`?LvEBX0 ztZ!oA;~>sRaU^my|j?6Sn$Gtgdv_O{N% zEcgJ}eeCkUXS_e$KhObzu0&FS4n&%PPKI?TMxa9i9UbTxv^vmXfesIJL?F^#lJNa3 z&u3nY1t3QTI?C{8?TIEF8|b(|#|JvWI0JieDWHUiA^${U0(6}e=qyXxPYrZhpbG+B z80hpsX9PMMHX7z^urSM+^y~-4bhENv9`DW#bY9?BH0PVnVBIhZ0bLa6;y{-Kx)i;2 zemM+R!GR5&%K}|)v%_}yaD@pA_#^{Y2f8NE1A!h4G&#_0U2dWb2`am}ax+M@v z<_&>vgt}o4s|4&#rkR9e_1r075(AU*={wLq_9{-G8N^+upK12sdn zLcJB}?LfZ<`Yq5qf!;;y0(}|iy+H2=`Z&-hAW2%{+y{X^GzI%85Lp}(AsVncmiW@= zJ`MC)pwG>begPlM;@AlR6JqXHAROrXKtGsk`Uaj)bl;k45e~jHZm-(seHUE%5eGHI z{bXK+OA?r$1N~zBx!mUcJ9)Sysxr~#p-3pFqlMzp7M(}dcT%`0y8=ZCE9J~htt&}X=JVl#xAG1M%f zW(_qHzfo@H(0dP3zK1Mfh6=(oqJ$R0#~h*N3^h-vc`2P69BQsmbBEe9@J|*VV~rfJ zE$^wAFH~=+1w$46 z_p7SRzIdqBLyZZwM5rZ0Efs3%P$NRE9BP?R%Z6Gm)bP-6f)QCzLUvh~54D1^8dTxr zilJ7rxqy%BprrFEp+<%p9copW+~fK}vCE3>j50L-8R(Z+3|}o2X*_FWO0Zoc)Ywp) zh1xvSxKQImtsiOw`h=PgYMoH)hJIrT6=gxUmQA`g`rqRdyln&9DGhxfU`=;EnSUtK z?};D~YNOEap&_!3Lm#{N&GucWZA=`v z>;Hy6F2iIrb6dlKOE|d$;vVinp?f>pEEv?zp>_#%V5o!8Jt&&!_BRrCvktqP2I7VG z0Jzon3bl8reXPEpl|b7U^}{C{WUK%cIv~{AX!R)1Ixs&t)NNxu=MM>el)1Ub9Ukfk z_#bK2NJoY`3jT-sAk@*JjtO;ps5?R(8|t`F7lpbw)bXKC2z6$tvtVGTlR}*u>a@^5 zl{h){yB1`~xVuwKd?a%0L!J&-Z5J0-oDurakD$*+F+!am>H;J4T;mVh8sK&wb~@Up z!ROnK+=XT=hzZtR66(@W*MyoJ>atLmhq@}%)uFC1WrnMuLANW-=*XiGC5a750>5iR zT^H(BH~{8@-1XSb5dTo`2IJn1p>7Iwv!Q{4-C~tX?0b*dAm5EftPJ3HhPo@%Q-~XS zL){bVkx-9@x;NB)p&khJppCsh)FS8sAogH9O{)&&xLwE)Qh2BvRPhWY_B8hBZ%*2o*6t@Ibz_i zhI$P@AL{K;uZMmY7m2@Na$y^sx!yD{2M+I;Pk0YmTMGIv3^#v^2S#KchWaQ}7O5HO zV~E1WL;W7=(@>v<`ijn>J`eQ;8WrkG({1#ehe7|rIrqAKhkMo`@oz$X8|o+g8-B^T z??S)(_kHO1y+Nkt9aWUS*ZpYXc#D77Vgy1R`V53$4Rg%@k5GSN6cM{Z`YY7mq5i>5 zp-4TRSFAONSs4D5Q0-71gAZ{059BZ-dew*&L`ov1k-|t(A>%^#_VR7RRU(x6CHq&m{Hk*13@Ao3YF=?4T(6M2EMzJnVBBkxsM zOtHNQGCh&^W>jW~G-IT>Bh3@($zC@TnDqJ#2Q+4mG)v^e)2vofnJv=nR-dE4WlpOM zwsI~jc{(NJ~UoDAK|p8EIIg{f2w3W3vvo zxd{Dj@rao$8u{n|s*6S1`V5crl985*w0xu$A|EA}j{L*%Wg`ESjmU+#!)7->8#jkH0e4I@p6v{s~bBdrG-<9*;;JMs%Iz^)T{s|Pqf z8B1Ir4vhC0;&3*Kv~i>@B5fIIksdcO(x#C%gB8X-*up4&JXV9NoA<+EY49Jzb3gX1 ztb&`R+cuH5jkH^&-6L%mX?qZev~#2#P_14!DH3~e%)4VWbsq`&l7#O9>&#Vx^R9+7 z*uvF4BJCMzpGf;g-f!;(O0nBJ(&={or%Mq&78>`9v_JA4>y7RJlN|>M;Pb(e4xxXf zGa?-t>99!0MmjFi;gODrbabR+B9Ttxfyt|njJ%gVD)MVC1PUl@0cA+=|B+6JbW)^~ zL9fR@U_u8@jP%+li#t8;lt`x{j)`vPULSx?GaTrNyE`+|S&=SfqDW_>oRQ9tbb*-( zDs*n7^CG{?3it5#OnPCYiy|MeE{Sxp@fJ#98b9_%=!U9X9_flmS4X-g(v_xEm>byA z=PInS&y7CPJut>+M3W<3YZd`ToWVdDZisYaq}L<85$UE#H$!!#ha=q*>DEYhMY@~W zBi$b9j!1V#{<$qF1hL@fKKI=?$5u9bLF82TM7lT9eUa{mx*i7)!2$FjicIG6vF?FL z51N6HVbcCcq(`xuNY6%kEYjnVp1}MgpO~=}!jB!m-uOK3DRg^?-$#AgXs5#1=OR51 zs7SAxlu4LhFjagp(n}^a;{MB#KcIr6Ls4-@AdFvq4O)z=Z$^46(zlVmi}ZG+cOrcn z>9a`hf&d=g#PL3gYKyNA?ec?218cv!`N%koSV{0cF@@n-4_JL3>5E8TM*7P7!!b6-b3E5_((`6lu!DMo!C=?8pxq`xEm2zw*_9O)O_?8ct4U`{s-f%P?~ z3x19Co9Pmk^1GSjACdmF3N7co;{J*BZ=@-a+PL>g-s%Ylq(hiCECnD2!b9IitY)fK zsvuSv>&aM8#TtqSh_zs>g{&UON@At4GCIc^6l(@+Z^bHNl~&JVPBQpYI#sMX*0iyv zi@j-s431?$tZ8Vs0Lr?I)R7=EFji0O`M`A3$AX_IIV;K;W6cz6?pX80nmN`iv1X4o z2R(=LwIUw^*w#Rlv&Eiigv&W&AF1bxIfLN_$9j5wz+9%eqSc}A3E7sbv7LB!7tW{!-jJ0^IC1NcX zYj~_BV=WbHnOMsjflGtTI7gTUH_Q`OV{}*nG%g=&g;*nEtsHAbV;3`aGqjar@5ev} zwvcpTO5Ex*3>i2s)~HycW33wdC!4Fs8WU?ZyGw8cdGeDrVvRM1z$I)Mp2H}{j<;@W z#+qR0(V0Dmbz-d>Yui}c#Uw&nKh~x(d&1fv)`qbr!sJ+NpKcUu<5k@kOhvB*|)Jv#%>>Lhgdtu+9lSG z);KBFPW<}kf^`67dw*BEyL+rXVxL#<7EkrVdz!>~b_`;0d#`wEEZdiEu`Z5vNv!>2 z9T4ldSjWdYFxEk_4v%$2tb=1666?@dhnXN?8cWeZEBG0^WU_2LGS*R$4=u5stcX3~ zN5|f$(FcQKpM-eI*b~4c*4eSniFHz}lVhD8>kMY;b=i1#iYe`>u}+Kq{x)t6KHzdE zkMiqcSbApcOE`}qu zSXaclG1g77u8eh6tjV#ijdeAG7~&Tr*cVe=V_?}#!y#W6>v}_sBUQu#IC+Cgs52e#=6fs+>Zi}_Om}= zguns#_OSJQB-W!$G1kN6_n7s6+-`xx6AUzt(f{dK&mgr#hb4M8)^j+DL^CIPKGqAd zevb7^tQTXw6zk(ypTv4O)+@2zi1lWyR}CQWU&D4RY`tz1!3_faTe04b^?s}mV!adl zr+e?l-q~^&!+g&qNXE$aGU@b(aMgBn(eRJDyyE;%tj}V76YJYppU3)w_E=xW{>c<^ znIGEnl_}4*cH9N?{5tkqweamb_#f*B!w?N*QZ$W;ezcaKtORFf|25Wcv7$tAqTgfv z5o=1UcC0^R{bl6*1B-gx-~H}|0E%h>?O&9^4li|Lxx}CKX(Zm7m>qnWkzbH_8ToxS z9t0=en#fy{L}{XF6HS*WOVmu%N|YylTL}!&aB_RNS|q9x)rrc)yJ(b+-vFymlXyp+ zFYi4Sn9zA(qMk&963qZ)%K@fO{00u)2vT%_2{R@>=E7m3-Ykh`O*9Jh63v!q_C$*% zT0GGliRMhSV4{T*4F=&v^Cjv{GL|Y_UJ<*s%Yb9Dc(He=yCK{h;%|zpj=g^2K;Vp0`B;NMf16<8)9|YD(v~Hq} z6HQFCUZV9A@2NISw1JI<4?M=@oF3w!z7f;)`qzqw5>FFtnoM2DpJe>pjLSYZqHN%Ux<#}bk1 z(?Vb&p3*lu+;l5Y>hC4G}oBkA23@i z)#BD+Y2(!rsg|(VXNR&aH=TR-)Wx3);9Cbt_P-_*zP zjR4E$zttyNxrvpVTDh5(n_I~@4d}lmyhZw!-GS9&eclkZM(CiCYMWG-n=7W=KGhDX zc22cR>eu)?8W56sdQM9H(VCr%4}=MV7bNVO`UNHxII~BpJyV^I;-%Uv)!xV=)lsST zNwsgPgHf1N`=#1H)q%z(xN$)0A8Qi#L6U%VQ0k*tS4@YdIxN-U))RIy3wj0GusZk=W&2YbNzlvJnMB_Wld%n+i$ znW@e~pHcW!XQw&`=A^m;GE<$G>cUhPr8*zxq-t7_A}PgP6SEi&h8L$|OaIbTm%ww| zf?yYdxh^xUX1DpuR9B_CI@L9)KRv=Na%{@UCJxf+>r5-IH7kS3Xb8%7W2&1{-J9yZ zR5z!(CDq-j?n!lPs@t$59{8rZ-9!VZJ5s+EBebC;=Z^Eh?=om89^M1J#hFv`yFb-K z2+J^kz=l7V>Rn4n+$2Bn(NvECKhu1f9>@Gs{f3K6^<=82QoWz*gH%tadM4HDsoqHS zY^vu{y^P(ZdOp<)seh`%Zsd!pUNZQkPskU}Ko{;29q8usufl3p0md|977~0j)!V7w zF#)}ms?QQan2h6n7vIJC3R7t`hlTlvsXj{eb*gVteT){R`aIPasXm3twkROTBBsw^ z7f0MpdH!dr`(^4gYQXaQ%CsE?`!>~gseVcIYpU;4{eaIgCjV&2z%Cphk22v8zn={P zd)g4o6kR9wN2)*3kW8&if2I1H(2%K->7P{prs^Q#%-a`ke+s_Q!d%;k0`gyw*6X7T z3(p`^m?_SbWZsFP4^bu-ddy3X)XgZ;%pW|BGasyX0uUcrWrHMl=bEe6>Kbh9b>8#{(V5T0cPoHT}rWvxS5A5)|APkKdl`X_n0E zIX@UOd!{)u&6R2HOmk*_?EucWKJE_Ad`8OhWS-2Ywct;p!dxWzy_tq&S~JsxO!H@2 zAk#9Lmd&(ariC&sl4;RQ3uoS7hh`dlmSyoM9rwX4)mwu9-G9 zDS*ai@PCL~*iKAsZkTV8X-n>A+R84sw{mMMy~0>!n@rpGw`^yX4J=~rkZH&M_DM`_ z^_{Jp*E;YBj8h7`8KWSF`ktBgvdg_QAN!yb+9~$|$GwJ@B4#;#|rsFdmnCYNQ zhi5th#mIC>=8pnm;}Cmjro%EH!P%r`6gdX&>qyg|qk+)ljKw$E>AOtd zXF4y_`I#Qd^f30D>B3AmWV$iaMVT(nbXBISGhLGD(o9!mx-#=?G*b7W_&PJF%MHmc zPl%Wp6t}Li#_KX&pJ}q82LjhxV|Q7B(ZLNCGB;(qIn&*l?#XmZrdu=Jp6QNEBwbK< zTPAD@DKH9UyVD@xU8&z?bslryo9Vtx585SK%H8`jJ%DpC_sB#{%@4hOB-5jr-puq? zrpIvpnV!k?Y^EnNJ(=mLOi#nr9`C5J7Y3qryb6TQv)lh%rsp%ghA1<=km*I6?iG{E zOPO9a8oQi-h?nKBb*~~RGYX_YUdNfYHw+~($5+3d>77iUXZj-3yC_wrk1~C1Hi)p^ z&-8)G_d^(H2lmhbQ2K<4EI@x|vwxaR&5fZB+xZ`E0h_X0knmOJb8Iq6_)N6=1_#Jn zU?wtboPCBLGX01rY-+})e#-PSZn>$bsb4bvn(1#GyMg*G(;rs(-AtZ{M%en(TK=*U zE`i>^nWkiFXX>Cf_Cy%0z}biUrW#G}>yV?GK0`z218eC%q>h_PnyQ+rtubw?)l}Y8 zW|z&Tw--oYc-Jo#)(%}|(`Ny3piDvJgk^PFnP0iKR;!QCx@VlOW?xyBx zYTl-&o&Lnr`I1}F=RjAM3)B;T{*wjMSvWS%nTRF79&oHaZZx9x>`eIhn&O}(* zQcW%0)Cx_l*wivjE!)&`O$~2)Z;bcGWbh$aJ#YOiZ#ctkMuF!_O^vV?>a24qS8i$* zYe7u#c2rZNn>w$l^P5_=snwd=qp3ZcTD_?;O>NfH=1r~9)YzuhYij+b#x*s*sdbuK z*QBs!Q)@MSqBsGDn?J`8(Dt>P{&@--f&=XGii~#y8?s^3dpv9wWHxGQU))+NP;(o7&n&F{EpN|3#6kPLjMGcZay`n?5ms z6+1M2p1@OYX56W%otxUNsolYxBYdVdyPzR9JCU6}*gh;JGO~ZZS5td8bxc#oHnmSv z`!;n*Q-?OSUsL--NK*$keda&o1iv9hfW{df)but8)dx5I0ZWoY5Id}?!<#y)siT`Z zqF*B22ggUEile;Sfe-`==B$X1YwGx>PHXD)rcP+;L|E6HBC)!dXEZl_(^%4b>qw@ zb=Y!)U4rV(R=K^YJDR$ssax$5wY-fMJDG#j?zF~xn!2~CyPCS&F2Njj4dr~r5dW49 zNe*;9(A0xXJ=fIpO+94Y9&hRi%(KTmY=}M5)T8~}c+9lrTg#T8Z0f0|p0*(*md}{f z5F9jOAkP}l$>d*X>cysBZ|aSvUTW%P>;H-o-sL#Q^t)H6u**q9j zbVK}aP5s_f&{EjaA5Hyf-8xqO)zrUM`P(=Nb^lle)t!QtTG(x)Av1WwUCY19+h~b8 z&-;)j8LwwZkBeGLT1xF!-12)e#}08>OU;(@mWr15RIQdzeK9W9r;NoO%a(WVb<6vf zs^!yl4)$xQ%UTTubBop&<+0>{>1V zs?$J3POY60?QOo;Y_{rGDs&4(3HfZ_GAAWAw^1B}Z+}Qf?{|iVnHf?FM zmbQZxHv8r;X}6X? zfI10YjdwePK+Eqtbx&FBV)!5+)Cq^bJ7&d^S{P*!YOj{|hP0O6YH6RA_HAi$OV^?# zE$!dZ8IaJ@0WBTa(xELK*3v;XJ5wJFizfQj6ZJz{BAJJ!hqrV@OGmeK4EmG#=zyS) zH0q8r9b;dGjiX~BpZ)xnj%(@omd|N7!G0m3rHYgPD53p-H|i%_%PB3LYL!c-_5aI& z_pnZHO+A!yR!e8MbWuwew{%WR=eGQY?FB8rggLL}Uv@ZZtUJFuHQOm`x(nf|(GIqk zv~+1pSGO#RwRAal*Xyn{Y_DkfM<<9LW#)-LG+t$dgFCi5z|IF~cF(rG76R z>_FxNEj`%Mvn@RbZY@3B($lDDOOKdE!_UWBdeo4|r2q<@e7vP6T6z)|@%^8cqCMru)vSy)NO#B|_?G^i3ZVVn(myTz+tQSNse#5HBmLPDR-HVLZnxAiKC_Pm zkVdW`*PvW8?u~_L(y~gP`y~%8JU}_N z$5pw{duxEO5y4CMHgK9;)8^taA}$3tLeHLD)7vediS?&O?BUFqYo=Ut<{F%9=3KMn znl;yKxwnY*?AS>+HR7BM7CL+Gm4A-hM;s8FE7#n)dUFlQz3ZOG;Cp}0$)a5I*iW7*Alsw z%+;4`RIa6REuCw4uH|zrllyqe4<;;YXu#y;*^^GN@a6zaE)!QVFbdq;?Dhg>`6+CA4E z);=lMF1dC!AUheVJLmrFF^t;H8ljyu1ETOVd*<3J*FG>d*WS4Y-o1-0pm-el-p^q2 z70vx~@9uCZypVMe{K<8Ft{ZY4lIzf1r{_8&*I~I1&viUKa~;8?Hul(DN98&?_m&H9 zSuGx8tV3aNfXL-I>&7jlaAK~La-Ev%v|K0W{_s2;1M^di5LU$S0cVA9(O7m?&&+jJ zu8T2>TxTQwT<7PyAQ#6e&ovnjYmD|1~1y%vuSHJ^{C!fjq_`~(8WKdv)V1w$@x%ym<)hjKj(3At{`bx*E) zbKRQjwp@4Sx-0j27cS*?EZXwtJDARn*@G?ZcN@Y@7K4WWeGtXT&wh#?uz4Zv!Q4kW zo{c_|>(N}#<$6BXW4RvB^;E8>&F2s}p6KuYBxKsjWM+BBto|JP;>5Ey9eY+U%&~%=K3zzN4Y-E^(AQJ`UDfOrTXWr0&Hq9{4Dpm6KrReFO2{H zgR6Fwm-H2*{@NJwjrB*M$npDJKjiu)*RLixl=;V8KUoJ7zn`rU7tvi2&oiqR+;66h zznl97$X~hs#%~u&3jLGoU+xzE13jPzO6&tqF+sO;b&Mwr!5KCRFR7qVSa_p`OHtwX zc33hqias1>P7Ci&TZQt%dxOk|Gz))jpFW^UV^R130W(WjXYUFPC^Su>-aZfRrpOF2!RR^Lrdo^e1MqG=<=Zo&tGVPLW>t#qR@hc7AiEX z&?1Ev2ECy^P{OpK1`|h$;JT?G2rOD?G5XkE3YSY3TB^`;g@zYey3jI41-!yXG0U>X zC>RJ<%Nq_1S+URx)(t7Zd47<;a-mfU?N@03LL&?H7234WW`#x-8eM3uLTeXVwa{vX z)+jXAhC|otFxFT!rqJESA08r)LoS9nIE*(0Q2PmnGy22V+tw+xZlU!Gt#93U*MJ`c zg2@JjCUSSM+py3^HWv6Gzp>Tlus)l>d^^^%d7&)|?Nn&zLR-=S-6*s}p{-CkLu{ME z@9goE+0l?OkX$BbniQ6x!X; zrjA#n+|w9K#CgKL60?s%*w^|42a*pcbYP(~3Y}T#AT+tqQH72!bV#8?3msADNW%x8 zaF{_x0}nTt{!Ib%{N2-u#}qoY(20dkvTny&c|xJ%*$OayV>(bmTTU)?N}1R=0dj=db-dvg>Ef$TcP_vtkCU+?kIE@Du>}r@LPp<+SKS9A||WE zeD1MHF~EEKW&J>*2Max3=!rrP6?(YPV@4WCK4QZkMQ}sCH^x(SRb}N)=gC4(87P7U ztm8p8i&NC^*+S11dcDvag`O|;LZO$j?m{nOKCJgmyIwLsz@s9jc(s_CDd8))e68>q z2$eSry;bO4Ts_RUSEb%AG|PDRPT_MTn8rRQsSBfU(eD@fpzz_3fk@%wLZ9F>3;j{( z(?Xx2Gljk>^tplhqR{`$ZFU6#Prfu)jJ&=w4+)LmqI3w)z`X}#n<~MCQ)mef3`myUNHGQd(rTR(@Dm6o?1xhVgYQ|DC zl^R@Xu2M6Xnx)iirDiWRYw2H<=&s7w;Qi=%d>%DN=>yZ8hA>Z0cn|$yQ+wkd4jxrsg+8ND7Av|e8tlH z4aCP-ek+&yd}jZ80`*mldxX4ErAEWvQd^Z;6--L4UuuI=tCt#6YC@^CO07|9Y^gQr z*6YTZEWm0!v>V#g@e;WuA#0a@H;fp%ZmD%_cBTM<^$Z^fr1OTQHY&AAsZC9kNOR*- zaGR4S6U(VPV4E3NF^Vm0y3MU*ZvpmhS^DS?sIBQ!YEr44N^MhW+fv&xy!6k8x~#+4 zcYu@jLJDfUBmT!$B@ExW)Gnp=D79y)T}yF9WOthpcI^fP`$Sk5+r3Kdjl$RiI6}Za z1_UvYD+6$B|Cs5-(&tXRgaQ?yfhbQcby}&5 zxLfM)On@O1Ro9x@~yVSv;C}6XO}vMc5~X4KsdkjkGd{2+R1G$unMz~7<2a$ z6s*+crLI6^oPII;Vrv%z2O$293i;2KrLHozbUohWQrDKcuhjjeuEPXM-CF9lQa9lI zOWjoJ=2CcIWQ5gB*XI{*w-{Ss2y3ySocu?NO5IiJZhXafui>BYp%ufeE7^NW-D}98 zTEt((3MLPfda%?prJgPIP^pJYJyGh(QjZuj0sffTlhlzO++d!;_ZBul+t>I00W)F%eE`?UANQXd&x5HZdZ4LP8P z|AwYdOL5K+Y`-Y=zf#|p`mWTMhBJ*{TjeYGK=?3c^^MsJ{P`a1uto7trGCKTtlht| zZK6cC*)#dI)NiHQHt+9dbpMq47xgRkXQ{u8fqz>&o4s%z8(}!WsZ1$-dQU2dZgdO+ zOn|YCNA_QI5T4a5aP~+ zN^4cx9AYc2U1^<48&%radaeruHh(IuXQV+FGj3qFfVQFCC4rw<`M|xYslg^zf=~C^ z*=E)UzHM3QKS-IemA0a8D>b^IwA8mj!A5zPLY>BKO&>@PcBr%?f`l~%T6lb=6ATU+$aXwst8|j_5T?=X)JmsSdZf~$l}@j8My2a3-B9UFl(5p}m9D6C zcBOMFT~z7fO6OKOukxpYap~t{bT-R{CLmlf++#D!YoIxKR!^5yx)j6=fi8702hVn8 zrK@05Jy1UZNm2RnYYo*)zf%73{ z43+?NJ9zT8ueIM{yh54)0m40%?uBWU9yas8uhIi1g8TdDL ztkUC^KB@F6;;!^$rI#wbTNQO7B*B&tS5P_i(K4$Q5pR$XgQtr=*1KLVb`rY6cD0(4-uTC-ap)P{kBYt2<_`C2Q~n!DCK zwHD@Xt$AzBS8M)S3s`4t2b_Cr4YAAGLL_>-VC^FmV7a@H(SVzpmY!H^{l&Qi6OhH!%h1aGH1`m?pv5jW*>wT9b3$j67QSZk$PtJfM+ zYecP;YmKTky7q2!mD-<7=&Lod_D=*D%Z3#bk-V*1`=tsDryIZ3tUq5>TBFw3S`%um z)i058wZ_+4v-aABSg`_BlsI{jl150KyOvC}__o{Wq ze>`vZt$nltll={i{Y-XDcYq;D(g-UKu60PQBWfK9N<-YCwGOWp+Tn-8306wN9yZL9GjGooe{pHO8H0 zJSXvBm3lhZ8hU41d6t!DTX~L^Nc>!@oM+|v{rYxMtzSmEOKNe>9QC-EiAH(Ha;bIe zqIX5@Q=_YEU1N<`+Pqic9PE3)lWSdzf!Llc278^!9ou9qoV>BtO||Z-b$6|sYu!@o zwpzE>y466DZ?NhCw+ndf3-0l`d;B)ZzcCFVVnO%Ry0_ND*8jd*_t$#R>aY|)gCHI- zd`R<{{h``tHDoNfyGNMR^8CkZJyC1P>HH4NleM0LvD4_}Y4mihXCP{TCJ)fFwVuPK z259*KdLE^!)f%9DfL^TiQmx-={a)*3^uN~Iwce@qYOU95y;18;BxUcagU{=R30jJD zK#bp8)^ZZ5W3BgUyM9FOaniveR{xh3ETO!)@Md3yW+6o z^IBh^d&XYweqZZLtAAzX*H(UG<+oOTXC)6e>CEp3yZq70pRD}Z%3rMf)k==_{$Vq= zYjtY<4HHWSc;8M1qekD*{N@1fE<$@Zp%|cYfaVyWIR~g3pn8C&AD}@4G{AsQGeFZ0 z@Jn4L;x`?jterZ3n-s2RfdBSj&G&x>XvP8mN7Y$C-%Tuk{CQ+6o(dvhr7GGI}a`H?(XjH@Njq6|99s$@4WvxIeR9%v$Hd^GqaLSLRuv=1dZ%s zOw8m}3d zRdr`eG|XvrAO?n4-9Cx@MYr>ad7C@UUuA(Ri&a^?>gG8MR#~{pB2^YLJxHr=YG>hn zQLEAm7fYB<#LrUJ;*yrix|TK^<$pV*vP_jxRd%ehQc#2377mG!Dj5kK~PXR4`seXFGvv>KJ> z^?{m=s%%_k%PLz{*+e*EtjZQuHZx3VUhzSuvU%0{h@QkLCTs4bVM03Dy2>_Hwlhpg zDrUAdSVgic@vyz!?oee#`?l@QRd%UzQk9dd>{?~FDu-1$yvpuX_K>cs94HwlSN5#3 zca?pr>}6V#&K2I3?ptNQs@o}*fYPD(-@l69DNuw_=|NQvwdM}Co>J?FSoN`Xgj=^q z$dIZWUFDdn8-leoI7%I7N7*%c9&1K&Le;%ZAW4s_a(tB&$5*s~74Z{|vRc%Wms6^o zTIKvI)2f_S<@73NR5`QimNsfdmgcT1XH_}7$~jdR8^xpx2zn#TZ0|f{OzP4sNW^v4 zMd<}qF0OJ(l?%;mF0%g8cfa+9&ZXA6RzUI{$$puvPCu#9-w{<*q6>R=KIl?M6*Z-fV2#TIH5f&ja-#IMbe5Q9KmR9fqv# zySvIgvVki1_f(<(zf`9`99O7(pvr?)x7yNo1*N5jsyu9hOLo1FtYw9q>#-`2S9w7u zTIC4^|0>TY)SH-3DgK*lXjvg0>QV>kD*@=8uBVFfg{$owcj}tAjBQbVThYnpQSVjxPnBP*{8r`tDj!t&y2>|I zKCJRll~1dDR^?->rO+hv{={I-J=AMYPOW@imEmJ(pkrkJIukuHg{vHE7{;cwsg1pC!9)Bwi z+YW8Tb5ZUeDa{rm`a6pwHQ3Rd$zx^>wH0?ZMn*EswsiV=)1TH2^cdtZhpKzb;<-bl zvw7$%qqBN$bdUk`xSHK_BS_E7svb3!dUzhbH~lkTiV1o!A?K3Ffk)`MJr+^WD6E{s zBlTF#V|9+SkPl3-5M$NqpVu_ zx)$+R%tLFsMLlO=(xfsa{^Dh$OL;8qG1g<8#|V#+9?N(O!S!KF~Ks`zgmz= znX7tCwj6ON4XZh|wT8!<9@}|r@3EH0+8!HuZ0xa)$GXyk#|9qjdCqP%#7y;=;<-t( zHV=C;N{4ca4Lx)sRAhTjx`|}**wSMw8HQ9{spt=4TS(!?uyp$`&+Tk$*pdf{&ekU2 zHbz;mV2ihHJr|cWIbY)S$_^eoiUE%UWt<*6d+a5RdFJswb(%~g3=vg;LKZ~BwChfHLRq;gLg#v^ib^RLG}x3&JH$5Te| z2@fqp)caEVG(%R4&w4!P@wE&<(Z=Hij}JUP^mx(ZC68A#i7S43jUtkd3eWC0q+{{o>BweFY{I9Bae?|%o4|ld}4~y#^9%R zs~Mey`auMDKdfE1;sb>+T$HYC%M z**AS!zMFB0^PbY$zWY+Hi1+yn@tIFN`^@Px)Msv=;U4fng@HM3apvoC=u7 zcPxq8yjG;g6ASn(=(C8=qP`1;3;AxAqN6ek`)odY$N7x+ zonNeE{IB4%q5`t0SipU?h2d;9ET9j$h?doS_#HR-et z6|79D`T*JFu*!kPmAq0)KE&rxpCf#Z^rs*5I7~fdUp6@0s>@C!S2($Hl+V#JY(@Su zU)80$<9$x>ImhQ*pA&sfQndFu%|~W)vOoPHh@?KnchdmzAQL*>=S-h}%W?F7bITXm zv&@(U6D60nDK0djL`oXg!a=L8OMEVsZ`#a9 zeSL*G%jZ6y`(?B~SNq)PbCb_CKG*tO?{kCCb-sJ~PJ^b{?&(TA%hY8~`m*cIKDWph zeD3tQ)#oJn8e4 z&qF>BThSA8MkDg5-AWv(_c5QxrStjSBCFS@YD+qQ+UFUc=Y3ufxmV*~^?6MZtj6p$UiW#!=U1QKeBShVOMd6`h0ohQ@A$m$ z^MTL1W}j;JKi0&1ayMHei)Lj8HynSczL0*#Rz8w?^%U5QP%|HG`bj6B%I3{+)S+^p zFMYmJg!lPD#K%>>_W4%Eqwk%TWc7IcJ985$O&So{A1zG%Y_0#Kiu!(_+4C7W|3)LbkTtbD!PD*QQW46ZR}jiEKFHM|;8jkx9<&970bQLnjZ zrcMcrzN+_*K!i2t9bzdFP@`R=QzNU9*J#$9v#6-3xp_jP=0*XvrIAj%va-)s&COxt z0)o}o-5PyHycZ#d)ZFfq;JIoHt1*9#1&r;vYYeY3Pt8#f5A)XCEK!Se-OeXIZT{1v zxnPY&YAkA)3)NWI0Er+>O`H@EbSX=hwsb^|ku{d7F{;M$mb0ue zDM6%R@xPpLrQ6Xp##m8r?XPd@j;k@g#tJo7lyYLSn3Za*T;rC2TLV_9F`>rgb*`v0 zvBsntU)1=r#;P?Y*Eqe#88ud`v3iZ2YwS{EjT&p#*to_f(uQ_^YOGgdN{zK^tW$Gm zme#d=8M6kX1CQO#|?%at~;+YK!pZr?EzvW`@3T4OWyb&YMTXmd$XV~d&_ zrsaJKK3j^1S=|{ViMf@?>hqrZJ8+HdYV25JryASKc+4_IaIg*n)!Z~d$l4dxDp(V5 z>1x*+yVW>SWNYkRV-J~VjRR}!S!1sn``6KWfrDxs zY(xflu}n?~PuMxJGnHB6!5R?y7N9jhk!SR^xUFX!yN2e5=7?M&2h2 zxx+kENA)xYuN@lx5k z_r=Z`EE1aHhK5uDU)A`!##(jOuJcWeZx!_F6m`C< z@qLYfbq3Y>p~jDj;WhrQ@l%bTYy2)H8?|3#gjwY`gMY2LM}CSJ@=8&bTz^`-@;I5j z^z)A*Pn{X-%v5)CFxf427X+k)8S2x&{USZgT&I8C8MB74e)Z{F91?0kefsolmO8Tv zu2ZWsTbidfo9B)rso_bvM3* zmZMDV7AnE~zktq)O_{m-R1sXrIgnY-?Sy!g>LGQ94Vcmn2=HtH;7{HVueRNCZO zpw5DIr#)GVgj%?czHqXL;Ye?b)}6~NR%dbJa|uhAv~(#;m$r0-rFzsQSw_`aw$8XZ zr9m;)Y+=e)^#?hvtgah#de*I>TE2vNa1xhF+J;av4W5EFU9JeaW&U_U1bY#9#poh zyLc#j5RObsYt?P)Y+GliIyea8>N&*a3A8th=WG;`1Q0 zb{T+%m_zH%&6RnWF)ViwtS!nT>l`J<>ioOT(RH_YIj+v}b&fIkSW7jfRKBhg>YQBX z6xpGPaFVsIv23trN_Ds4dAjAFX6;HRVocW=mZ{ivmW-j!g>^2HuyxL@GtG(=U1gK! z$vbQV=X_I?e(fO}xIltiV7XWhTj$a`mzi_*DC>7i!qGfRK}q6VS?4NwZoupTSJ%0w z&O3G9t#fUi>*_pP=eau9*SVq2BXu6Fb7P&G>fBl9t~xi@xka8X<ZwIf58|!}8xW1-@k*zHO4(Y zvCdC*{;uma2Ivzodn{j<(rMp@xYblgGJfI)#n zm?2=sfSCej4)}A7GZI;dI-+0T2x=NLAfSKX#t4NVS*EHC4BQFf!8!#RFl#V<98pF2 z?;HVx1GWy>MmPapz^H&_1N?xRFazcds0RcASwJ2T21Le28n}oZ2kzXX+Lik!f%_tv zT2YIdTNVM0K$Am;1~dcLSyEIxaN)fbxB)_bAtpNkUAyhGbcm(;<*pFs5<$KBWz7u> z+*(G)rcVl}*6_fMS(+8hCrJYq4OlE-fk3}LVIkM3dr~YkUE)prENny;3EZ?wCc1dQ z5&=sGj0l`33Ry$^k^xHv?h%9VHI*7^I@E+@+&K3Ol4YbQsdTQ&askT+tR1jU!03Q6 z0h0n&4Hz3RE?}jAl>-+x$2;cTA5mAZrp385;1-oS_Gy$AvL+hM34t4V6~}rj)5(F> z@~j!KmilFw+m~KFaQnb(1a3c5Qpsb_h5y;GlpV)hPjc2J98EbHFYEdzkD!Hg*lzEpVs1MMTZ*9=I@Ame$ZaToIsZ^ok;DAE{ZI|iqlg=p)4LBm;NJBd;aDTo& z+{DyuL8V6-&M{JgUI7l=i6&(pYY4JQ`N#<}=75s}P6^xtvXcV$yB|&Vv^}EfnR-F9 zU)7awo*r;Uz~uo~1e__43pg*(BFhmxD{u#F&J8#_aGO!*n5nB){US^av+*}!ORlxNDH(1WqfzDt!(-qn^fje$@ ztvQZ%%e% zZaixo*YB}(+tY?Pc_!d_D|$BIIRo@jBjpQIZ%+$&NumY38}MGBFDvScDEbB|Z<%es zX5zmtJJGLm+{TFO0$sAtw++?-2I*5ed`AYkqMJ1SMe10gh zR`+9tJNuvVCjp-t@@FOG&jY?N_{%cqD+9i^^czd{7Wwx9KLpGXGC1VNfS(k)LuLs1 zIpCLozXJYNSP1ydr1&%7cLl&9=l7?g4O42eSOp&MB=lLa7U#8eK1=7fbOB2jv~(d$7q)Z}OZCyn#Y%;U`6WY^3Rya2MCjgi z5@V87`QmwG$f%HILzW5Mu+uqxV{7s_ZFk+*x@*&m#5x&yamX_ZGkbp&JwTGxhEtx{#tv zlL1YudK2k`Lkywmmxf#xa%#wFA?JpiX9Q0VIV0puYh{1^kyGDtk+Y1g zoE>tOA?RV5Bt6IaR0gk(J3nNa1P{4LYE-1HxQA$BOpiz9N4-g`UQW3<wcAy>(%OOr2g#$;@_8CkU@Ztqm^x1#s;15=aY9&>78iW6x}@!|fE2ST0>c_!q+kcSNI zF(dM@aV46f_K4*?YGyWiLgn$0Cqg&pd@@9P8c&7pIh2B!`b(DZtPy!$Jcm4Iu$GFV z^P&-XCFE7}%9lc3Ho4?nYT`9{rT%MQ{xjnBkT*;Nnj*?i-wt_45iFt>@ova_A^)f} z;y)qphkOf)BD=MHa&3ZXekDs&$9*b<-k_;pKq{<_a4z#@ z$Qrm=x7_fXkZ(hN3HdeTyO8fKI{jqK|6oBwGU|VPKgvOD(?*^9v%>74O0Z7lw~*gM z{tEd!NEEq9&#PEoDBj$^kCvs13^}tKlU=vV86tw4$ z+$uwKhUl{o5er8w6ER9m+LtjFQN@0hMXfDqY_W*Nr9iy}Y^i`HBbF-Rr41MnF|y3j zpC)=!Q`J>l%SVikcp>7&h%pgkBaVzXDq>v3_=s&Iwu@LHV#SDcBi4&pDPrY_NfE0? ztP;6VL)V1Jg+~F}o|+iBzSv4bK*VYhYesIrLSvAol&f1`sNFTJL)BAjMeeWbdYNc# z6K9=>-OOC4L`;p?B4SJBM{E$Wal|GO8%Ayf7X_svyOESLwxZ9fY+6#@JYqA0wU8H@ zyTq#f<#Vfut*yHF)c=&XF*HTj-X^dzw~yE}Vy}oDB6f_}DPre{UB!}N?qaEyiW+)E zcK3)qqUoC}vM)}GI3eOhGofB93ehJU z1KK0iuzp&^=@I8doNJk9M4TzL^tcTwXBi*{de2qQj@%(7_`ERU zqKMlfZjZP);*yAKBCd_NG~zPT_Eiy=Tg5A_q9|Wsw~}4(6Z^XKYU_O|_PU7cBW{Yg zIdTt7Z_upX>`DyW80m*`mDNW&jV(8^a*I3&ZWZ(Pu}7KQ9T9g%JQ(p%#9a}0N8BIr zfQ-=ec~8W>vN~&8fl&cgD%GM`qp-rS&J3%$ha(<|cq-!Qh(`_ciO3D&k3~Fg9O`Ei zI>sPo#PgGepstZhpNV)j;yJVY-cb`F2<>_6QvokUysSVMGjq%<5wAvk6Y*`tYZ0$U zd=&9<#2XQBM!cu+9`TkDf7>+H+fNq3cP#T=vv~!j_aiqc{8HloD3jAKS|WZn&2Q1K zGTXM5Un72t+|pi5{%)88{!kBU0Gd$wE8=g<{3oIkL+sY1a$a3(Zid*+hZWvujNMZ? zji>!$`o~mbyqE#;^awLc%)k;J6gwWoyslYeW{a8KisrCXr=yiWICh4iNxpBHfu%J| z>y~QgP)vp~QA}((s+Abfdo-prk11l_OZiVqBc>U1PQtkft(bPq>oIS{bYi+O`^Ov* z(-$)&W{sFNW9Ez*8nbN7a*{V@Sj@sPi^R+wGhE2B>ez*{d1B^O{sgzVC)qV(&KJ8V zF_TV##?JT`j9JJuBW?%VUels6i^VJ+vqbC$M;&YszUJ^t#w-=Py@(MpxtZV6v6E39 zs&{rq#w=r{BBEAC#cp1z!D9KC(J>QZCdQ00{P8g>#B4mdGB$ROKh9FEE>{%u`uUgP ztQ5NuSraNz6V58eiQq{wtH!Jrv$|vq+{Wx=6IMkt+OL9o(ObjiS}|+KY^C0hStr&j zLTnJTVa$3`T~L`4GgZpBV5rZktRK5mWRj&P&PHM{W^-{8vx(S?-L|Y|$q7gL z6nly=Tf}a*?^Zf`1l-ex9k<&iX4{xuV|I(#E@u0f9b$Gg1g%rFX4eA_k=n^}c8T4e zfOa-LXw2#buH9qyh}kP<@7Vo3LJy4gjM22PjX6&=V=j$3KW3U#Dv4z3_N8cPTUIK5F0!0nA6;zbA>+I(=5nzS zbG4a)O0{WoMa-4fQ!@CTGKG0f%w01&bG_DzG~>D<=Ej(ZV;+gQDdy&wdqp( z?i7B^Z85jYx$GIYwg;tQ`OzKLx;jFkK>N3n?ru}vJw{nU=Kh!mWKl5>#cphs8r^hj zM(34sB~4UR<Ph^TSxNq%#BwNz=KVvuV(lDXn=~IQNiIvYR zBx<=KC4U+7Rm`_B-x*iR`C2mS{Ev~6Eb_tc<;%8GmJR$6^JC0Uv0Hd*YfBRe&Hn?v zj34uxB1r-XzsLL$^LNZYF@IWc6Ing?l$QQ7+tV1W)srZzAs6`*W=xnlp>O}4SX^|pM`X>xX+^dUHuL#bPFl$0Lp)X;!gxM34gfwA}guw|xLYPoZ@Dl2Y z^L;;|mbhRgztc{;D5%G!=iV@(!CD97qr}a_(U}~>54M~_YVg7^#5{4$sl`uSEo`hkE)3BUH^Om`-mbQO2 zbremR#J%Gx^Crw^Jcvn|(1HmIB`lh-Si-_ml)Z2*WvW{jN!(XGbrM?@7f;+cvP3fd zr+eC`mG+iS7?H4J!cGYz6P8I>D`D+~Q3=Z?tdy{F!g2}ACyY%Pm$>nCwA5%n+)=m~ zBYBO^cnPA1;|cm@&kCkSb)O=Gm=Tk!Buq$HEn)S9iHS4#RTEAaThZt<$&mHzcB`fDDpW4C6mirBJk8T{s|lCVX>mdW(lqfAR|%NVpjuiV3QZh=d~( zPEI%_;i!b8rQU=S6OK_W6;&$7ixU}Mf)-qASIz0^yZ}*?s!uYv(p+6?(Wcp{38y8T zDT7Je7t~KT&d-qMZFE*$8KgQ|t3n;yI4j|7ljUB$+B~9iUc&haYox51GEGh)1*Y^% zxiI0Pgx3;YPq;YYl7zbx?n$^b;j)BV6K+emJmHFjn-Xre9ufU3<#7pD8v|67=qQKYQLS9V-8JkxjTW;jYB}J4u$XqCL6L^j=;m z<55VzSKXTMWWrMk_a{7%@VNX@#DmI%=0T4pJe0VX{vMXnjE*#>=YYfZbVs!xlW3+@ zO|%q1bbL#$_jJND2`?nPn79XI&n9k6d@gZYtlFr5-Z)p!isnlu=__WmFDGt3pui}C zuUfvkTV3!*!kY=-Bz&vjpx~eILBfX#?Pz^RJA(FU<$l`qze|d5em^OZYzF&xF4c zen|K+;pc>36iCNbeoEZli120YnhX7^Krw&iH~DYP_MFY~f0vDE{%>5#%l=OIM*~F4 z45@prT1nkMAf!OKvn*d4lSDJ7&S+;!U96DPNyGh92Ba*QvQWyvltC$lCgCZwq|BO9 zPYF_HOPM{Tn&PGCj}LRC&fj&8MWhC&?k{hW*H5`xf1pm?#+_n_f~QW53n5I2Qqq*n z8r8WM`DvWGK{H9+tU!}Sg(=11Jayx#a-{QSN-Jep%G@dKlupW!lsQwU8AX7uk?daPgBef64+W^QIhS9~P78&L`#ANmn_nh7~m`GZVaU z$|5P_Q&vb>G-a`rktxfhES|DN%F-z#Qa9MivzAP`J9n{Ysni8SQBZ#=m`i+Rj!IcJ zWpv7zl;u+QE|@a)!qoD{xfoN=YKR}3x)VO4Cbq{JoiCK1vQo;bV%vIu<&=pjlk9et zlnF*b)zzY=9MbT{<6WbZQ&vmac7e+3rdxH8sw>W{m9loqX(^|ttdp{C%I+z97`63M zHcHvp;3+9nrNh(>onmH#bo&0!hSr=GJDa3znzD_WNZBl9^OP-9wvu|aNR-+QO)A|& z6!vw}ZEZPvr%7JWn|y93ou}+(&Fzq~W6CaONIRu&+OV_X%Zb#w41Tcn;I65gD(G9d zo7-G*&y>AVjy4K=r|gq*V9G&uyKl;VDf_2xvqFMvk)i?mfYdF4Md8|GD+i|>l5%*; z5wi11?z3-)nynsYP00MTZaOlh*X~iK!{cq1tMr(ZW7ShB$ETcZ&7F{PqTy&tpe{Jc zDr&HnAQC}w7J9UTAtSAzfV}XSYLZI_7k_Rk<$Z`jjhDu1vYgd`c&;u916M zsq9UcDqbt6HYMMXa%0LZDYvHFWcX@JrggL73sYm9Vw$W}mv;N_NVzlR*_7wRiM$}? zp_GSH?n${e75(`h483L4L+ypZx*%Ig+MUQBr@cIhj4rgUkUDGMZXlSZjsbrt9|qgH;ujQ-+wL}id6tBX}SAag^* zz>M|mX?S~f_W{`1GG@=1D`Qy392tW%;*2Dtn&D-H8BvCxxn-S*)P!L3hkE9oE6E)K z%hAj7`XjdNN;pUBQyUpsMxIfK;qBbN-ZWH+D}}N~=05qQBg)Op8AB^`@j+eRHlUNy zHK5PZA(qZ*=}=3B9L!&tJ7ajpq8W>2%#$&1#zGkjXVZ7j=F6DhBwZkL1A#_Q@w{N> z##8;%O;#rpT0}UuvXep<&sZX3>5LJXTiqz&FPXVXi0Uq7(&@DVX#1ck zmdn^CW7~}7Ge&2uov}{Fn2fO*6EY@djLR6Gu|md*nG2*kQZAE|?CP(TGFFzEjdjag zEqPWEWphSxJ1Jw;jMX#N$lRDHQ<Nq{w*~l_Cwj8NK1G-WL^UX3g&)6bkODl5ooXo8&RU`!U z<5tF%rXO1yg3MJ)+fJ&^I56X&j2$v|%-B6+59u>wXG7a9b6ZloWG;sHtZ~=O?X!uK z-ng)5#$K|GjQz}RHHp%adGCyU%ub|yg$O-p-ruN6aH;D6lUm(zaK<4SM`s+9acIV2 z8HZ;aVJ#|HDb#3)QQa@!s~nlRxzw6Ee5Jm#Yd{AES_woS5ls zHrixR>nB;e+Sig*$U;ubI6b3ZPXC-UWLg=oWW1X3?~JoDuE@AD8gyYGoH?PCgYlnYt>B|k7nq>nbzaind4t?G;dH0(E=gkri_~nzR%KIGHx~Cwv4+B z5Zdh-ca-p*nf`BBQRdxc&OI6T8a)02m#^#oj0Y^|!4l`8jE75DXpd#?&4nj2p3HdM z1d$DEhN(H8=G&UiJ*AkYUD-+!a-Ks8I{V8+5EBZC#HyMnc|7LDm<`+xln7^Azt8?Y8+IW|+e<}E9 zkTXN>zQCZ?HP!#e;!-7d(fG%0D>LR6=yDfBW-?eSQ#owQhSUK$19L{@ESobZXO^61 zPAg~DoY``MoG@qhoH;}-r<%L9iR2nHvpcfll zbF!Q~M?-v)yErVpiTN~lVM>QaRJX{de@Cd1yRO$ZxVo>M)5%#VXW^V~PG8R4Im2^? zOF&dVKCSYF3bP%6-n2bNBk8zBY6J zREN;Ne`TU_a#qV(J!e(v#I_M6>||?EP3uJrDNRPZM$VeX>RLunM=5%mSvP0BoK2LO zGbLwg?pAXfTCc4ymFgst-v7$o$gAt01u7efvhBKTEVb7h8=K{9p0l;OQu@i=`NJ)x z-bqf_Ev&7z^({E-5h+>BY@4&4h)DK{&S6DXU7$?^_5KcquOVaSoL$tL1#=hdnzLKZ zOF1t~r8#@#oS!o-XV09ya*ob9CTH)QeR2-TIW%YAoc(eR$~jo}BOA7D>H~5Y5TuX; ztrNwDVD*$X5L%170p+lq!*hn9Yx$gWT+XREr{x?k zJI^^e=M>YJM&1*1w^lmI^e>Z>YskfvBQ?qmPgn5IIV<@&oeiXs`UuGe4`&I375QdL}df41t z!A%3Gl<=5zYxD5OO)gP*D(C5(=M>gNC$LAr>WirItZ7@bHTB~QhAge>deI1qTXpv< zIj<@t7R*@iTF&b^U*~+2^G42_IiJdxYd$ayE{T`AudEbmz_$SY;5|H;{` z{MC`V^+UPsxXQ;lA6dJ-zY)29H`TcSp7TY{mpNbMXb@MRQx|JSCu^6P$<#HDe5;_B z^IOjEIo}(dUvhrU`61^=3rE_yQmvnIewO9W>>fp_PnDxVO5Q5qkDNbqDBLXcuiSlL zO-=t}-Tim&;%aYhP$?X&SgKi~X4f+n%v=x^#0C8d`WI9Syn+FRi-)sVs@HY~TCG8a z8#~mkvlh%&xG+0=!5qpgTyPK@GKOB@Qqz7xt)N~I6zJ>98j;l<@+N64EZodi^Fw*P z7TQTcTF@=%E657+f@VRhpeS4z)TPs&YO7IjlNsJDQ!4GkeREhGc8nzjJ%8a8DLgOXG;pv?Z%aohC@b3+5>}rr_9uc?;$%*tlR5$x^UD!Nh_|1q&7|RIpUR z(gh0_EK;yo!QzEGo4sh^#v=*R(}NaVBEE$2xumtO>7tY{qF`jfvIWa2c2(Sws$~it zopKM^M-|+&vg3C7!bOSEg&Y3Fr?fi8D2y%K>Smm!;|o?Ork`?OQ6g6=D;dtpR=SF% zLY`3Q_>ddjRxOxZux`P61*;XTUa&^Nn(7_wYimQTs3-&A6T+|A-FW8}Ai-IjB zTEVu3+r-n_TvoSL!PeHISY2vDWxK+?6{Xz_EvwbKBHoS#J4s^&yA|wQxJ}Dl3b%Ta zw&m9{Ax%-9->kBG!JY+s73?9?vPqzHu4`|z!+i=jIQFV&9<{&ZRo@jHUT|Q+K?MgF z98%bK_Qtud+G?J8sBxvGmUb*Pw^Zg4l2jTfINA(M8dCsKEYb{IVMh}iJy|%e;P`^u z3T`hrq2R=ViwZ6-IH};|g0m%f!6^l&7MvkIWlMJ4MSD%B6`XD@YV6bGP){qgcKCPU zCY)zkzGP96tm52)X$2QZZ~72~adN(;IvOO6X__Q{E|fRf1m+S6Rd7wgwFQ?ITwZWR z!IknU`x}v_1bTpYRpDk7+7;}5QRix-rcc*iS8%=jtKjB>8;l1HWO`Rib#Ihh`s1OT zs9<+{{Ip@e$`yL9SGeh%5bh|rv*4M6XAABsxVzxdg2!a%1@{&_RPeBzPLGCV8`}0U z;`d7~`-6rkJXoOFmxdClU7qrYb)vdY*7$hA6Ndj};dX>1vPKiBMYF7@3ODpTZRt(p zD$f->uc%(|dcg|?FBZI9@JfLuKf+fRzodX*RwO%oRq??Bkp`(_wf|r6X2DwpZ(Ed; zuxd-OLY=PW6nx$(c(>$A@#_7859H4C>vxcRSn!e5GMqhz^Kro^(!<<5J2#)oZe0l$>_zpBUe zrRaj+4G{cC!Jh_;zHa}P5)8T0VEzURG@#*ln4!Up4Q6UEbAzBk*q~p7{taerFk6EG zh9k6r4bH&z{-6f4lyEO+_6BnpnrG=?ORN7M$G6OyrS*n;JzS)&IKC1!h#L%RFn5Eb zLE50N!H@=7gWQnY4GIH#Z8aJ+?e<^w%B)*gTH@S>KT+#6=&G*He&>$QIU5W$%()uu zN2PZuUx3o#RwQ^{1Li5YRndHgFJQq23pE(iU~Geh8!Td&yN>sis11{*Zku))*@yDnQAund1J=74dQAthQN@at7m8~0W(_q^M+eyHFE-?3vB6Fac5kpp zgPj}fA_f}lCi?ancDcVWR~uPbYNY#WhdcSxU@!GrgZ&%q-C&;v`|7gR|4Xx1_kacm z8gB<#kBh>d%Q^}YO4p$c4r_2)!;QR$H_#!~qZ%CD;0UX7q~(iGiK8*-m^? zYjAvn6B?XoIlZ&5m*thwBi%~jB%t7ko*BOB-BfIhQxM zvcXjiCJv}vVS>n0dcJUV!%f?+F*KEm)b$46E3^hTG`O+BO$}~taEIlK@+}P)Id5xl ztC5lkiGpOjT{$=#zO%tyhJ1H}dn{Als`Yw&o3CmKB2;3-3UzQNN5{A~s-oM#$5+u%9tSxL9c?2eNc8obzW z8+U?r$sUxx+|a*NoR_`U;PnRYGDN}J*D2pM_@Tj%mh-)(Qr%Ates1tfgI_I2Cu3DhF9j(5t-x6o>zd5kWVR+_n~ZBRdy_euWKHrWgPT;FL`~u*UK77bVAN`s*2`98FltL_SmvlL zUNv-H5t-m&a(QnGO`J6sG%umuBLv# z7pgIC5--vCL=9>NlTZq zbm^uW>_m1MyItPWQI;-i>2ii3mU>N(Hd13s%Hx}?(B$wYM>JWn$x2POZn902m7A>6 zWTPe<8<7c3rW!EO(n*%CYN;qsHej_TtCu-zG+EQ&waT2eo2=7h-6rc<&Xh90XHJSI z>z90PU>t5(a=1y8O`B|G_?ua}g{7O96#iv^R4PukENe+8%GtKbc1`wfvQLxko9xhJ z4@2J3(p}3Ice2}^o9yyGq;|8?-7OV0X>U&}6}(s3%DzqZYjS9l!ab>;uyi1O7ZYCSNtV zxyda}UTX5Pl-cCACXY0Ew8`yF?y&0jH@VY*drEEGWw&>m@{;rU`9TT9Ey9)y$dT0*pz6JfS&O{I zk}Z}p3_SYJ#mag;f^#cFoD zaf{VktkGg>i}hQqSxT{v0c%;hc1dboyIrsB^eH8KYIK^;{}|eamTqKekC{yj78{!y zu$iTsmk3+7*s8_nExu^6b&G9UT-xHY7TdPiuEkL;j&8Aiiyc}VU{!W(u~Uov4c@uM zE-m&pcvoX)4}*6zKE=}Rmf2Ino>sJ1$-GMUX|bB|<$#PC^x#vN; z)g^+bTjsyTe2X&-KC_gl$K=_%Rh1U!SpK<|o@c2joNrY`XPQw{dSQ!;tW@yDEiN&& z^hjOa;))iJw|Jt(l`XDnaf=vkadnGpTHIu$uC?^K7S~%vHF1Lp)uV8ul`2y$-uyrC zZ7puM+xslN!_s?O+*$H@SBtw_++(D~SdW_M2)Mt+1BUisi-!$($g2NW+mEz()bby* zv{(Jf7EiT!r^UN1o^J6>ix*qGWC+i;c+M#FT6x|w)z%Bvx`3CV-iTB?eJ+S6yzf@ihN+1kur zmd;U@dTsnRtv2m8wX!sAQ#Uwh6Sj%kZb%Y`aak)VF_oE>aNee9)396NH%mYabPS%e z#O$`|GkD1V;0SG~-Okl!m;q9k=*-h*-ZmSx*|^PoZRT&YLYoy0VSzSFwOP8&f^8OR zv#@0@ZrmK7b9HNajS_$D zHtV!mx6OK%FHEULElx3n^-Bh(8qh1+pv{I>Dm3A5(q_{(2e&z-&1P*jZ?jXIo!k7Y z%@%F8FS~V1tFo=7TeaER0P(qv0iwK}aoB4@ly|V(9W7NWyR_NWF!yV-n`Q20x4Rp> zN1HuMmG-z&y0;+C8AnfhBy90cz#YHixx2!EO(4b3~itOPnLEp<~({ zWx&yvicXK=W7`~85>ciuQ9IFcdI+bqIkn9>b8_ySoYv;_Hh&CpK6pl(Go`c+|LX8> zF=tv2V{?RjmkZF60l^VNEr3oO$Sp>ko{?R;L;=HfP&w7Im+Rc)?r zb6K0q+g#D+N^z*uGFmCyQ@?xcU#^>Ke3YpStXw1aKcKSCfXdN!dZ9=2`ZhPTxv|Yn z)=+O>;%0+ywe%KC)p~Dl_Kr4pT280KU2X1elXskq_q4fJ^0xW2&3$d|Z}Xne+C0$a z!8R|nd9lqyZ60p(Oq*xhJksXTHjlM=+^F?-TxU4GG9{|$Q%+AtW{foJxRqg3k`g)r;tje2~s_%OF zs`!@Wyxry<1C;ZwbgQi-odRw1L7Q*deB0*3HXpV5s>J!Y%_nU>wOgIdcxGUwvtH%1 zvh?#dUzG5d)^R=Eek~Q*mdM(PM89K~p-SnjAYW0sQ{p_~4C8Zqg zI}PkGsKaa>X74bIl`4N$Q8VocUZj6z4$B|hagQOCBeR!5Ry)otFVRzGD-FxK^$vl- zA}-{pL);(C)a6JKgH)T8`=p9@23; z|8sU2+F`B^!#d1urIR}hH(1&8 zEjw)0Ve1atboii;5Bu1*!*(6s?BlIIw(qb*hY4LKcG>@TgJkVj+ z4!bEfb~vZQ?j82%a9W4cJM3v@c0`9GJM7hA?+*J|&H)_`G+%#-VZ!>2PR=!#eIc*OK-KNr2FL_<{u-)#11f$9Fio!!d@b%wvs$%tOe!PUvt_ zhm$SyL`zlo6j@QFa;n|-X#N*p6wa`G0cUCykPR5m!tY_8+u^(pw|2O#!}%Sib-1#_ zRfcmxhl@L0V%0A+elD_9#6|5=!@1l_FDsiCGgp*2SIb*F++=8~a&3p}JKSKH*OfTp zK}9!OW{+o4zPZCK|C4jODfVuobB9&Dvn;)9Sj&>F{ia=gNk9rE2j-*;t3SI=s~3Wux;- zhc}FkSFP@A2ET4a=X701t8TA}w@c!Z{T)Mix5InFw<^MU-vE_X+m(+xe5^RuCGGM_ zhfn1o9e(NXS%=R%{AATd{EH4>cl4tozO)>*^;Ox*w?<7kKXmx6#Q)v^we{ow7fm_8 zcKA&pz01HZzjydU!My82?w=k0vRaice;du7M5^*nsd@2Cml+KIzdbusmzle6)E1F` zUHTiWTd8GGmsz@aU3{xDtEF=o!fah;{~tPoyVD;QS4%+DYK9PXsautxOK5;t($!-i zHhdvxUGgrAby>Vi(WTL4SeLoGG>u57OV@x_*G2fYrK;6unF8h%P?8eD&{B%IN`8iS zna7Y9EP0r>tUF(q`Ac{KD;0%>%AAF}EYfAsvR04tCAuuxWqg+vx-4awqq;2HWod&) z7_zt;*<~4nC9EngSJE77!17&2cNtT1*uzn+asMNTYOPq-TFLTP?y^eBjF2aFS+&co zeazO!7Uq9dByblJAcK3(?hvYlb>Zl&9I z*+KE&a(3ymYnPo2R*O5Aq;@OmsG(k4dz3hPTG3vX?rm1#n(MNEmm|6yX=n#ndZ?ub zb~&ia!KGY>{14^BO89WYR72w7s4mBKIljx$R^=GOkvPX1jv~MbT~6$BT9?zioK%uM zrOU}Brih$s$UQxr(dA4l`mZd?|98pxIbF`}@^qJHx}4YL{4O_lxuwgrE*EsUy2~|2 z>OxB|?{ZO>i;dbPT`sfCOYK%P#api{udp1kaisxQm2D~KTB~wHm+LI^`m#tBZ?q!O zxv3QD)-JboxxdQ;R&=|icXzp?%bkWJiSDu{dhOoR8hxtx66BFTW@!Hr))^bP8_>^-`dh`kAl*Vx_sQ_t1e$F z{&)Gb%NJd~H0eGoDX5jtOEy$jP4`;=rpvcozPF<9EET4TTyqBeP-^3+E6J@Y#+<@xnaobBkLpY!?)X7AN4*0 zBNAIGBB8Y#*{ujBcB}lfY^CU<(Z_s!%x^@RO8c0zk5(V;K01AL%PKudRkzRTih-eh z%+<&6KISo;VI`)D<~C|-ao)0NW%h(xppOOnSfY<5jgD{@>SN(P7U^Tr|Dmv$Rb0H} zv!{)v`dGS;kyi9yenymSEz`%SvN@Hi#pU}L-N&YVY}Ut^KF0R3ZXfIQF|LpCis4pq zg+5m7V}ey&sieG$0V|i3)w-xn>|;{N;i`tvlW4U*R_|ktKGw9%bu3-WFxUS7{P%dC z(#KSzykQ^f8?ZsykXq5D<~FkG8yl%jEbZ~Ic_07kV@E3$<`$aUTiq@D*sAaU_l z8(;ykAc_T0QLN8zXNUOV{p0(tHEXYZ&pr3tb8C`&lRLONglhs1hbh(YAT3?>y&Wli zzkWt5_FADYxjuv&LRcKak`QhTVQdKVLYN=IxDdvNFg=7BA>0(g%^}Si< zQV6$(Fd>AAlH4ZrefIOcLyq}1K)Ej@nG(WXAxu^5H2HRSP#eC__XKq~GlY9Xm>t5L z5bl$Z$!CRd{|R~d_UF=C2#-qsppf#1LwM-_Yx$AD@?$4hSRnqmaABa&bu2K}O ztqus~FNUx#g!PiV6vE3&Naa_Q#fkMvz9ER+7{aCy-V5RV5MB@AjS$|E1sZ%agl*!R zL)ap+RmkMbnwCl4lH~26ewb=|2=9ilBhd8o{XoIp^5jGDk3!ffvMbQ^ZGIdCKM6eC zBMGzH8{|U%c?kOg`4=Kz1_}3v@C|1|6Jtyq2;tihx|uk~#CIVa)uP|`oNP^0 zF!4hOKZfvA2!}#A#%Vl+!yz0Ad8^02h46C-zl88>2uDNS+e#Gr?=1aC_>#}>oHqhF zefu+nzeD&Zgugg<)%TL{&ANZ(9@Wa3C=GF%08ErIQC80QmdCU;S~W4qxsc+YyHe3a zB@+!zG%``yL=_YDOwWy~CaRgJWumr;>LzNKs3|#f=bF!d>oDYXOw?7>N#_67XDDZ0 z{+eEWInY2z`N<+pOf)rdig;t8Z?l<+<|fjTv@p@qL_)?}nK;!%#6;9Y$b@OaI>Ddt z2^M@0VTLQl1h>i(kn+KBg_hYfAZqAd8UbiiK2-T6Q`MIBl+nj&M?v1^maG+ zV-hYZl8jN=|Es08CfZ5Ay|9CcjwU*p=xpL_NxGOg%S6}zUpw7R^e{2d#2^zrO`L1u zd=nR#IL|~c6TMCJF}+U0OnICX9rm5^eW=#j;LBhan&@kypNak^1}NXN>wDi3@YPMe zX6Y}cU1Z{7uHl%t%ETom2GgdAp(ciq7+z1il-afR-tc5enG1iHo4A7hc;`!d@7nn} zUTxwU6QfLwHZjb^a1$d;jARiidG*7NK?_Xl8}YNgRrair1+=l)`^r?NV^}34VUeA*`zSj5A4apR>orUK5|2*eCr1 zLeE1Hs(oqVD-&Ov*e?lRE%-)+`w?6rr{=f31eiEz;(HT+DC!3jKbrX2#4jd(GI7Yn zVG~D8j&z59G4e7sRYVSY=GGGUYrqg)sb69!zhH23L_mxCX8$tS5z{n*{_n}gmI@n z#+(V`(5Xf)3^$B(^}_QE{-Z0u{0gHajMiba3FEXd?n@b`hjB(2tNCRI%f*jnxfsiT zG3LcW4zvxUT^Kw}p8Ii&b$;3(JOxM{&+nWa!{`)7=P<`{l!|oBr{4k!i@SKGOVJr;eObcx-JRZgq9HbU1TX-^zrmMK z9L8ad_a$L04P$E<+rn5D#_}*;VCM{DMHo-hW*E;Y6*F4Nz7*u^cg5!wqywu?kaK{q z31e*-Z-%isj2FXL7seZ5TvyL{DKO=`{WAM`*qck&3rRMF@oKxik-j~e}B>6Cqe!+_lEI#7+;3*RT%qx9ii`@@8{QH?3eIh7~hC6A*1*^5Jp9QvB(b0 zZ*|26gYcr^>v zE!413Q^Aw0Du z3r!W<%t9**r;0Zhwh*?o{&!asvT(YDrZ8;5vJkNlwUD;pScqAOTS!<)TBx_eD7VvV zCfmX!O-IZm zGgV^YG-W-6ml(};XDHZO*hc7I@7h^tZ=r{Uo)$V-=%}c(Ep)Qb*}_>Cx?0}NGi`QJ z6bUcuenb0TaCEb9j-t9-{L?q@j-6k3E>NAHYvB$HcUm~lLN5!wE%dQ4(!wYU=Ucdd zb!*{brM=KXKMVaW^tF!P8~7c2fMN$q=t~Bvp8Ynx#KI5@ms)tNf-zXlP4_OdFjT2V zSh!q-!r|%$S6H}GlBgIF+pUa&@UJ9c6I>uUcYp{oXV4>HpRkS zB2z8gZDCrF_8y-Ir(2j|VWx$9EzFkWKH>cqW{I%jI@a*YqG8_~n;{l@^|nle{6JhkP8klCNNK z#enz!7FJnU9mSd`UXaf8C}u>l+QJ$OYc0GeVdV(cS$IjjYy>Y`c*TMd@n($m7B;Yd zsvEp&;WZ0;*kLSew6Mv-4h!#Dc-_Jq7PeV<%fg!$He1+YVXK92xC_a{0l2izP3O|m zVLV2guR8N4$HF@nwp)0Y-GgU_aC5D+l=JFVz8TA#Pab*4I5^_w>4iW;b&-^%}Pr@w(yCCPc3}L(Z`z{-Zk-aa_**a{#0e2&t)GA`z-uu z;U|{S!j~2fSoqe$R~EizKcuUwc~1453esGR;>^!UUiJB%g@YEpx9|fC$j1=wdT_Ue z_g#EHgjdqi(r5VpFBT44IBMZH3r8&cY~dFRzp_X1>u>%S58vtK@Yf@7j(5L&?bE_B z3x8Pnla0$6th96o_X>F;GWP7&0J zpl$^D2nrFL6hXZRauK)@Z<47WK`erJ1Pvl+7(t^5PL3d?TuzCgaRkjHXc0k^2%1LF zEaF{O_~Y1QS|67;GFr-1s|ZdNq1=!1HO&aZ5m*sKB8W!3E76G-$Z5(}j%gtk5>iVl zm=aRW5n;hI5o81IC-<`>79%K;4;>;nO*&`F6jPlpa)yMhBWNQv%9(pxm8+ei7;GOz z`DQyu&?SPt5%i1TtO&Zw&V>=29YHto-VvOmwC6@}UIg96dqmJPFvwi!Cx0|Z?4|6; z`zSfd`4L?uhVw4{z4; z>y1X}*j*7!jbKIuGb6ZLu~fJxf@wh+8JsS;pF7ju8^J6|?u+356MXO$W(Sf7B6u)@ zJrV4U;2{pf2v$e1CW1%kY6Qz7SRTP+5zJFPFNt7&1Pg+8TqyfbMDV1nJs#M6DuP8P zII~##ezg;qDvE`oCo5$3St&dn$X7=2Owg=Ut-j3j%2sTTyEy!p~1Y5=Z zrg=+7$Z2_d1n)-hevlo7J0f`RgdiRGAc7B-{G$kViqHYdeG9t-%O6MZNd%upc<9{m zKJcFo^*@i`Py~k~*r&355y6)tUqx^rf^U`M*AeWO@SDIUEqo{bqwrt^-$(F+IGy($ zpmCC)B&7b42!4*Bd=wR;_$7j0Bls(Vzauy*%YR6XNq&pq_Xv&!?e1G+@;~JX75g%w4T&PNfELR|V(h(-}Rp`?`9Q6x@~q@|yg zgt1N(nG<4J-dq%JAfboFC`zKZCW>KEoEF9DQJf#e1yP(4MQf>bkD^T!XGVEuuh$lB zWxqq|#!&0*nZjt0xAtkiQ$Nbx(xLrMb zl5lbqcLX-?R9ZUE-;^ls3gmv;yQ7#UXYLU)YZ{#CH%Al?MsaTx_eF7k6tjZ*nH^Y| z6XngGSB-Ne`R|$cp(vh`9Hsi<+4jK|r0l?*PI zg|v*%$41&DE{bAt6icMGBCxYmWLXr;qu$c1|3vw86e}fvCW_~xc%D6(2SG?eomElq z{rMN7;Q0Z3(xk+HD|>AeFLHdv5RGA76fZ^bZWKF|>Sa~SE8?uN^-*jPe^vOJ>V)!* zQEZarb>W-BH&{mX&&^S6iDGLM+oE_UitSOn6~)_8@Og(Tv0Qy+d3iI;MbvU%8WU$6 z@0ssWLH4W1@Ie$GM)6Y=hobl>ik(q>6UBijb}6Heg}a43PW-Jw#wR}K$!zQxeE&a+ zJtBLBp9}X18T&;PUy6Sv{93qQxQ}0ytLJ@&^TZ0M3s=-=L7) z>~IuEq9_|fxfp)tgV{l{0$54o&7z3Y){QBo`^K&e%X>_Y; zoF2m&F|>}MjdTX{-Ha9nkIrT+-Kd}u)GmhhF?3PZ9b)JhL#G%zpWrRG8>s9LPmZ{= zV(1$4zKr0`zJK1!IWcsP;qDlw#n2;$o-quLVMq+;$|h^+{22J?dR`2CjO`UeZw1Nw zNW!QKq{&<^jG?diVbkarLx1rB!hwO#pcpO^zgT!lAorcQRKYu9xGaXDFHZKeUR-mC;iBZ70?oyu`?3{ynz5>8e9`z^vwbx#b_W0)Po9L2Iv&IpFg z%oy&C;XcXlk71Sw>zO+Ik?=QH!iR+q2p<$aBxHAbM1-1;iaaLdtUf=61u-m);qe$= zj^P#du^66=;e{AhvjSsS6vMI@mdCJINtVR0ROG+h|MP+4bVUqL$FNcg1+GP~w@>yw zd{&dgbCNUodz&?7{jI*HpK91phKIl z1=aO>3~$7+C5EjhBz!Z5%?ei30tofD#qd@PZwIL;c}EKMDjHlMVsJ+c@3HsBF(8ij zW3byBedFjC#|JTd7{g(H0?b13ST^yU!d=4MF?=jSolj!;G~l0!?1^D-Ao)Coed1pP zk}pNRis5UK{ek=&kyay&?_xN}*(nY)j_+gmfiqzo_2c+4hM!`n9tZp3Au6*k@uaml zj&Smip}ge3#PBQU1P)lm9*yA-k>6tYJ%*9|IH;p>Oc_1I%Li9}6w4JJn&R)D7!dc= z$p2MTX$(djua)r>7VvVQT*?Z~x<st`xTI4Z^A8>hjdb`Pt>QB}&-eD~TK zw8n%r;;0!%t+-dobrn@RjylTPPe}JplAN7~_8Y{}FplPNw1}fo94E)oB#x$1I3Ej%XY) zN#ZPEhvT)xo|B9t6-S=Mk0Y)6aim6Tmvg!h&#H2ALRUynSY5?9O5{Upsd3emWjrm8 z(ymqJFY=nvp7BDI5&>oar9B?&Wod09IOqN;@NUuGm-FjzD!a70ud@)D8em| zJGn{ClS{Q9O+GM=%I%H8tm<~gpg1myV|}S{F-yUzI}SQ9K}8s%B3v5BWkFen#&LNZ z1KS%{NV1;O9aoj(i1YqGj;rIiCXQh&R0rd_IL5@iec|D8jF21jaHPnnI7SDOYeh!4 zGv@IxzvJMJb1Qaf?dpz=V_Y1Y;&?rd@p0S~#|v?+j^pMyZi(amIA+ChE8ExK#E)Y_ z924WXO_J%t+l7rVXg(gt69Iox1V4II8phpTkZ1l=zpk&*Ru934;`V701_c9Ejsv zCETy5Z`kpItGuuFo#a0W4+_5*{=ln%i0{cEahg4>QXGlnXAwW^U*k9$$8T}`&OX4Y zUQv9H>sTCr1e|j2vHJK=9REsQCgoLZDJR<`S|+*h4cI7SqpXc~Hrm@LXL}0OY*e>V zUc7>^qOg*%vapJ)2#cH|Y%FYIqp1iJHnY(@;4MU23R?+JwGj$pS!tGyh>fI;l#OU0kBh`?uLJmB zPun(lXP&UVlWafMvH&wm+i+}TY-FW>bt8i(Rp#vDZ!2-4;4DG4f{oU;*RP5;N^G2F z<8&J@*Y(O+K5UTicZMwZ!ZtR}w9(f7-%fX^jM2eHN9mlBL?;`aZG4%)R|#~naTdKw zU{S(rpsqH0*yt(G&$iJ`Nhm+ZMt5<4CE;8f=h>*0Kt(MG7J9vSHlDVzQvK=~S$I~QQB+`B+Iil_DjP4@SRG{H*Y=vAbn9%qWaASX zpR)hkc*Vw68{2HGx3NLiXopE&Rn~9Xc+JK}8=GY94Iy)Ro%2A;<8!jFzuCr?6LNgZ z#@jYNl;jo?Z@so{1l2hlf>WbuuB>%PJuQns+W0%L@K=z~ zPy3IJebGFT>YeEqzyBWt;9q0nHvG(^p*gEcp-t+2|O+RXA*c;WMu+xl{vn=|6BskC$K7U{LO9N)$@75U-@5?z}f^} zR+1MJSSRw5kP2KP^Or+;cS`?Xk(~FXuO{$X0$UTD}fXN#N%MN)zB;mH(2!uL&IEBrnaQ3H+A8?;NBx zjr$vWb^Fe05BUJ~X99mE@J|B&Dwd7-x00}0F4bFS|CZy22F9UQ2LDK}OcE87sFXz6 zB+4aGK8XrROzh#A@*bV^RQphOgEzf=#H*Y{l_aVqQ9X%&45MliF9vEPzeWsN<{3v! zTT}km64n+{SSN|P0Y6EkUJ~_14(L9)VG@lL^jDHkP99&eZ=Ce5ceKz%u}za`CPGPb z5jI?_Bu-6YMG{XZ5u$z)7bS6V65&9zC}JfMNg|p=EQxp$wuJr=_A!w}Qo>XcZjd&e zgp))jdHhk4`DPWBlf?HepF}}IzIjUp{z{TKEs4`5JVV$|*gAQJ5?w^j5>m5k5@!e8-|RR?!R|@)2;@DJI5*(uiS$aMcM^TX`TD4T zc=!bhUMS?6Ro~?Q`e%O$2P832WRQ@#b6{SQ#NZ@mOEM&hOGPNZEQz5>%uw)hno8o1 zB<@V&$|SBzVtf)eC2_T4M%Uv2clSsgRy5OJaGzSzRlW zct*i@h0iAOToB8`KA*%Y1z+IUPhwpXs})=m=&Vg*X$6DtJ<{?^NxUlg%feRzo%JFc zgq&bsOJZXZo0524lDCt1BZ)VY*rwp-B(@~6l`|Fh@?JJ-tHL?NE-G(O!rxm-d|c1t z%<&y1*{`7v85}zx$Pw0QvNB{YM*8D!`t0cab99m=9FaARk-z0HB{M#hHOX8ro|DrE@+V>oZ zjgDU;e^eCn{fSqBBn~ThB#A#nehy-PN#fUlA5G%7fd8Jvv4C?N{TcATlK4B||A_pX zM5%}&SLudVb$V-^q-+Z1BquK~QbAZTg-U_Eatc+%s|u?H^6IJM>s_@{sGUOhJbL6& zCxyBx*l8rvI4Q-yV8EzAzrM%-VFO{q6dI*)viK<}G)s9?EZaEmh)EjkHdo4eKO@9x0reLfaJDrO;kk)2!bL9a6`qwR2MFnDVw@I;Fq|TmCwWbP=9K z4CH60&`rF%K2_j6KtFrZjTA0Sp>GQ3rO->cT#!QV)bXPQ_qOnAwNDD?r@S{hINuWe zZb>;U^h=??Qt{s|SRsDR43uP03Kxk`^WqdP3Haa?h6Mc56fP4VD!e?9UmLQFf8E1MMelm3i)a@^BSGPwJBVe!k84UXWvMpc^WsQaAOMJrtn<~V^bI>{aq=H zPvNE%W~Oj&3OBQ3q;O{nlT)}gg$dHRBj{S}EfZ6?O~TuSoDC+Wyju?c>q{z3N#U*( zrlxSW6#PEm_e`Hpll-0(ri<{uhi0(y8+h;DQ0+bmAD7MhQ<#;)Y)R&%@L&oLiO&^2 zAY`hC*%MNDEQNU~?~Mq)D!>|e)YpMApPecN_R@v2>HEN&ZAyqwNbSiKo=Ra+3X4-% zmBI@tERpiE6qbuD4brltE5x5q;b{>{R*F0$d{+3J#uuabW1&{3uqK7K6ty;m7gKm$ ze4TKEkeV-vyexbrh4q2_-2vW>{i`XwCdo$OrXbc|RD46hH-(#pTZCIv*d{^?L*>ug zDZG=yb_w4VevrZrk@tk}3#sqt`(X+n1(Ka2R}3|FtKL3N;gb|T6=$9A7x^rOJtBJp z`R5}0h$3GG@~`+WU;+2v5cr0JvA%I2<^8?Rg%ym0DSWRSkv=|K{*c0tO2T&hDTPA; zKP+-Y_;U)sr0{DBM^pGW|O`}{I<?!HvlRvFB zmV_5;U!Riy61E5|w@jmz_^HB>&=iJ+mXK*9BGEKrBJn`Z>t-^IR2pw)u{n!$8crJb zrg2{ynY1?#pPt4UBH1)@BCaqmEC`E2Dwl|yCOlT&n?hTsaoH_K&otVky}A8NVOwE4 zVS8Z*VMk#nVP|0%ArqcOo8o5&l5T076Y%aLJ<>eI$!q;{(>O1UUTO4Bi3f;55z`zaWhZMfwT{3i}EB3kRgpn&)Bix~3q>MIslcaY-Pd!jLpBWf>*8Dvhht z7#hT0p2igczcR2!JJ+N!O7dYr?C>;3h>r{;XD{=z9-YRulK8=G+l}2zjqB5x)8Duu z?LCU#n8w&N#<5VGz|*)Rjqz#Rl*Y|$L@pZeg@2AXaRzTqV}dwaYW0f-V{c2NC*Lv> zGI(bilbLpv7d3@hS23oiF+;6+R~l1AnD*{8rYT2i-lMcMPJ=}LW~Slu`_q_}#y|&y z9L%QAtN{mY9B}%Y%a(Gyqd6W(lz398Ep#2 z$iAM=j50>wzl@pHjpb>qNaOi5R;BTD8Y|OyHjU>v01F1|^O-bu^KB@7(_N@ySXI3x zjx~#n7g(q?)}*nPZCA!P^qifk5AzC~oKaGS8> z3gewLwsSo0G1~Ms-c5tAiY?^+T^c*m;P-3%y(jX18Xp8B{lhdq65lD@CEOjvauLaY za{MffJ!$Ms<8xKT;2K8nat15&Xk}v`CyJ&_( zhTaMJj-F(_vrxX5oa6_VrHnUqA4=nJ8h@toR~kps_&JSZj7sAd+wUzIPT8yL-_s%{aoO9jrDgL|D^G68l~#4bolD$jX~wT#{H~;G3!TT zOw53TG7ic*DCfX-kZ@4mK?Mi39MpDD(Lp5#l^s-Z@Ms;Q^(rrUthZ6s@fvQYOjUDG z-9Zfp{Lr;qZ)59tqoz1>d9I34$3a~OCpoC+fE|y&SQVqjVxzu;1`gih%wO5y2w-n% z=y+|{$ic}DPI1uK@%nZXVgs*c`tX%?7)>3pgEe!|T(K=2ghg5ksn$y5RAI=0De|2x zSdMqyb87H zU*qz+-k4%l6djZ}INiY+4p_aXIe2@K*HtP@nI+xLb36Nc{pU;v+shl1Y8q{sm(D;q z#P@$3w0F?KK}QFj9CUZk!vTj?X9wL_3dft`x;Qw?0hRgd%8D&5JzK#w%e)@TYGi|6 z)z|3h;9Lh6IJnTkc@BCx=wQu!Nm?PVTCvt;^1Znw>Y?z^O%F{9o)c~jkW6F z3I|uR73z8|IP`a;&MijgXN{{IjBqegCA!+d23`dm3=tLLN@eaO@8ZVSJ&Yf+%e4gigXshvsW89>A9?ogs!2}1NJJ{!7 zqJ!IL!NDZQn<1N4Fm{zU&e>q}g)xJfA~S?Dg|u_8$bAml={ai_F98nbIGF3;5e_TGKH%V?K>tAwpDLaM z{5>q8AAHQg{6J@3AYTwjX#9zQFLCgs_*23~fqbzDtt|~C%S4ttSix=(#QJ_R_h%if zXNx#^&cX8zR!L!9koE-!s~xOyur`pq7?hD|eIqX^>SYJ71Ui(z>fkj6-*d3h!6xx{ z9K7z}4F}r-%{N81IM^)mpI2LhT;7uWZJ}R9+r^ptyAF1okm`L0A2|5X!ABB)=3u9T zUE-fO*d3($_=F@h_^E=vW!l`M;NGBhzHsoRgZ&P^;e=VmII!RNirtUHf$z3yieSGz z;NV+z4F06Zu2ExNLV|A`XY6Nb%iGh znRUI4_c9(y14$YN@F>27NQ=CWUhY{c|$tF5ZJp zDMGXKgm_*Cy(H-^JYU!+(78Z_Ia0Zw_{GBh!T}i!6d9DkMIyeYU&c!$87v%fLhR5C zE?4kD;T0K7%;2^RuFT-746de7^065V%V2m0V-%$25hA07BQqEk$XSYO1AbjlC)B@Q z!W%NUF^Hw+xD3WCc$4r};myKZPDnc;;J0TmNwN0}?+{MU;LZ#ti%-emZV~2qm&jBh zD`A?*JwcGU&k&y}yjOUikZBn^OMG@9nUld>@dxCLU#kyE@^A)^h&-CX!VDf4e=LJ} zBD6MNWI<30N}kAIv4l?wp9(Y=1v*P4SsKWfi7?ZrGg!&Nt5Huo&t&jg1{)RoYzEJX zJfFcTkry&}F@tp(tX7cvYcg0X?)y*4OBt+}I^LgZISW7cz?OeU!n@ z3_g}*mvFbx_na0;J~=^ukNB6uy@CAm4EAO4g@S%UAHT}rYYF!UnlyMIgKsnVE`x&^ z{GGu+8GN6?4;lQL!BMIGn8D#d|0j_{LZ&?;@^c2i1QI_ZmgP4|{t*5yJQmb2WB<(H zFA2$M=idxUIajNFjVzEwW$`jul+B`I(C+23D4#`ztT$;ep`Vt>Oe;x;a`GyHepM0Q zrRrJKP_X6+!rJ0>gmtqxDT{hp)X(D7EJ6}C$fAh|b7`1GqbyEV@D%ybnEHVyBu%qu zmPKzEQ;bK!qbGO3w@WU(>jYbS)7?g+br5;akgUH3mMy4q=T@du#?bljxOS7 zWzki{x7khn93d@q&!Wc(vFD1PC+sEcEu?0jEY26dAd3sL=$l191uqfy&tj0s03r1U ziqMmbL@o~GbYpN9L$bIukX)X{WmybWkg>k=R|G+tx|%$T)mf~`VptZ#v$!>j30aKD z;>|t=pKiuvz2}{gS&YhJbQagL$UL(yi|R3B+LPX)Ol4~tw{!B(q9H&2%HqZ>#){u0 z94BPdc#*sL7HB|j$%4U)ml!{lHzsB=E9*Uk-p0ElF8*XODT_O@;CkH@`leG^?i86U z2ac9E?ox0njbt%RLMl`99?9w0bO~oG2vP^Ru-GGcwMcwE{kMcV`kiV zNx_%1-~-(&!u3K1H)Qdu_-n$Af&9I^@j_iAZyRrL@Gdj>nI0E#wq&t2i`R14n8P;Z zdu0w+3U- z{8;!&7N2JEnfSgez7W|X+?&PcA~e$Z7K8Yug8PME3BS(5kNQTz1Hx~G)MurAFaCER z`5}uRv-l~CLs=YV_Y34lM2=?hv&b)5{F;St=Ra$|W%0XW{T%-Y(*7y(SK!G%S^S$t zX%GPRN;yxlEyhS$)RZu&2l(flIA(I$l>%H&QP#r4zV2K zIkd{*)Eq(*T0-V-iiC5=TZEE`BvB!Aw{u8{7jj7EkP^=c(>Y{Bn932Mem0PhyW)AF zU;o7*wnXGKpEk;?)#W^s8AS11>1`l+tY;hG$l<*+=5VL1%X;qDx!)ITy%VA6o*XO)Nn;UY-mUt_lRN&gwjX4m< z<}faY@i}jk<)$2N6}ee>i?CZ2Z)b$R2?|ck;Wm*8bv^mf<%W|q?#Q891>;T`oSegy z9C%deT{%n@S6h%nkShIdJjT)69FzZnX2TO8rO}ogB93@GdJVZg6?lU$-RZ@91a7 z`#F4&!|ohD&f&uxKFVQd4!d&LQ^Q-3@s*kCK-4(KoeQlrev-r996rzC(;Q}%Gd^Se zaPg;xu_uS07JJL5RGasd@o!CoI~QN(@Kp}`bND8QuT@Lsv|h@4m?>QU;nX_AxM_ef zW}WBQ5Wf7M!}sj8E^;n@$l=Ev>ba=z;-?%Abvrw9Km!X@`# z*ezQdzvgh1gGHb2vIWoj%=7$M4u9nEXAYy}VFed|<-ApT{{9yENBFO>RA{)K0$h|4 zAusEqT)@k_;HDCV6>kXDh%sp;2cfD2dlUXZ`^cf;d+Cs zrHfV~rwS>#zi6ymWQ1Ms)-K}0lAL{SQo^gQsEe43xC`4w!bRGJ<09#Ldxa_2+d~{t z#oNUr;nrS85)w+*Xm^j>XD)>?oz%zKuLtjS%X%HJ zQ_|?_dfQu*INn`!chS?uxi0=Ryh)=6^Ww=Hs+{2k<2)D76pUUjDB-PFZ&h_4RWj?D zTNoF*=SaH*mc?p0rl{WaijV(#$Xpi zT(roeWgeHhxXi^g7x%ar>f&-2*SHww;tIOTR$!C4c$r%d+`=w;8xWjcILx!(8JuZ{ zyBOi(S{K*380q4{EygGpqt#?Tv+1?dbWRn63$0^ZTyST~4%`PUoxXr~aE^c)(L7jp9p?O{7wY+g(f8*gY-XS@+yO`wS4i|T- z>Zzmy4;aD;Rex3+58nCOc!NyO`nP7(1$qne0U_*1Oo? z;yxGmyLjBi6E0@CnC;>r7Z1Cb<6^Fh2Ut=UYYK*)HR3f5E^&`a7?Y}a6AL|j#KoiR z?d%LLxRJ#24zZ2L*qzjZtj77OpNqyC+ZP(;YZ{%)dh^DUE}o)I7i(QCa zSi(k>KCegYd&^iq+NE7C;R@l?!j-~jgv{kxk>@yUMOF!G>j{GW=OEX;7kis}FS=OA z_I2?Jr*Rm3`J{gt<0Z~5+OE2{ufct4wiI^&Uv=@Ci}zi8;9{eTO)j>&*v6UP#T#r{ z7n@l#<-P8~M>9SxZsE}2CpmSEk}}>N@$G!=)5Y5^-f^*=&0XFYvcx;hk}XAVS#R&U zs9o3C!OqOhUwO+WX4Ho+K60_g#aqP+r`H&PU`3NKz@M9Utzab`JcG>yPx+Q z`YHY4ZmDoc!uZ_9J{MoR*zbZFeZc`<^osc`Ca4gfQxU{XE*@A zW5-~Nbux0-WccDNB;Oa&xN*8 zE{|1py{cd{@wTme-kY8H?qa1pD(6upkE(fZ9yqwjSY5_g_k%Zh+0fPU-ZmxYq6O?u zdDP0I0VR3V=F6XX)Xn3hJos)vxi#KCDI2R^9`*CyL$~XAC4F0G%X3IJ%H!lbPRXNj z9v{>+j&1ikJfB#bEFR!C9qiNo|{h)iz@@Ss-E*X3Um)I(gQ}b~1$mbEt^ECq_ zm-p_w%)EE)4(Gww82GdDh=@l6NlYZ3hb@v2CWR>>Q>F88#52OI@b0+xY6S0o*+~j{ zZ$GzfKjX7iMltVQj7su2EsxXXVcR^~<#C31YatzOlgF9jtWO3xvk}|p(LutFd7LHE zDUZ&1u$8ISg+;cHD|gM~>^!;!*3J>BSjMQUw(FV4xp|Z;pnL)6<OOgSlJ&byf%;P@_3x*f95fxzA-wFY$q?rF?n2{_YP;+-`Kc8g#1R4DTepa%0*Fw z#Tl2!c-i@mPXW9(@nu@RHYUlf!U=gy%;UB^ZqH+iB$I^9VsajLI(({f zE$8YA9|7{1n#bKL%c)W0^r$f{k9$GU&?nRzVh;`#ZP>W9eSeRk}S_-Wgbm>8Y>i}<)`Tk*Z&6^&&XjO?C@+J z&nfnK&JTIKkjH8{xhBtpI*lZ}x@FDN)ot~?BQIXeW1aM0%H!ocUQw;S&JqFZ^VpEb zt18__5|!n(Ja!B-==>(h*F}sYU5qzqJde%3lRW&nzOf|_=0y)#?QiArwxSN^@eW5{ z9`7m0*aKa>PWY~ZJA~}0?{i9#@ekEc_T=%AqS#w@=CMmryX7Y<=VL{ElK0-&{8adv zkdEzDr~N#SeViNfJayLCpT{?Oe5tgT@UcK&5w?PQdy`S`z1d_$ErcJK`E^R6-luj7>!=DK_BSfPN&3Yb?w z#R4i7P`Q9A1+V@uETC$^n?o`MWDBTPK=lG@6i~AOv*2}O>eP}#-GbM|wF}<#Qb%dO zsEU&cs8>M!0vbpXDxhHjjS5~bVy|OaPA+&okakWfcvD1UAxV=0-%Rr){530}dB9r~ z&{DjW@KoU!NzW8}FS8C8U=Ku%T0nbMSBC;Rss=hyEn6>yXX#qg$=@Bb+4ZUvkpQ*6OQ!;Bs> zNZzx6b9o6UcvEgK89!fH_b#AM0WHon`pYYp{el8m`K*e*1@tSRe*ptz`Mv@MiZE(Q z0fPd5Q2`f=Um_eV91_G{Dsou?Lq#qx;0lo|3%H)0LHw!$t}fsj@nHpwEMS!QaN!7H zUWX%%F5o%^Kj->SKxI_W5ve_88x2OB7RE&w-#_mAfHgc?cx)K zw+U&VNhXQ2=kUkiodrw|B&_he3Ye>e`ywDjLB zV5P`21w328a|JwKz-t9;WE(|{RRwHdM^ayUp@7u|KD=OU0WTK7$&DR}8LcbeWfkou zVf-X7_g9pJWW9v^w>Va2`7Q>#F=xU}isfAKMggxEa9JbI)cE>_|Jz)^mIAg)=T?5K z#Jn`7-YVejf;S1XI6PR1HB9^4RhD<Od0!u$cF`dRKQO0T?KriI@zsK zf2<0psrmJdPbK-RfIS6tjT-$L8Ejl$1@>_&DBy4#9BG3u3;3#lxu@ZQ)9`fx`#E+> zFrWnA6mXz`HbtCS^xEs&0%{jgr-<*^F$(xzmj5c?Z+55p#t#MjSinyO9Fm+h^DFI( zA5mxfxd7hA{31SG1OKS{%x?w!Ucj*e{?NE)t^V2BDBsh&k^8fNUpgLd_kTEh7g42% zzJ~E{0i~)m=3*29xmTu$vPG0DdJ}b}qIV%EU*tK!Uh)b>Z_ckMcqllVC)GB&c0p3*58h`Axb!9mr&6C9I6;WTo21T4)#3@BIEP{}#nOa3}Qe|IlQbf}tnibJpa#Pr%h?Ygv<0F8Atjtr3-eevU4sYvqq|Ff{T=cFf z919V;Cu`9nV#Njg?Uy69aU^3tJKP7#?RvPIRi*SC|A`r zxx04*Qz)WX#K3`G!ApubO$JXd;tUySU4&WL^NrUL)=yg%|4NrDbb^=TYszS& zaFg(L;TuAh;>{v9i*FHb6|(2BjBge3cF?2VDPnsO@5;$qoNv2$OQyWTVXxrL^ZP}7 zpoAYX>mt4^;v)rjYHr!Z9$v)9Y&(ATTg0dAGxZIQ@z12gvHW=vdy3er9?l@UJuhne z)U{}w+0oChICi8@{Vsw{(sMdHq(z@5<=W>!WtC}fAUX`%XG_w{tX|KIENysp=E-uL_7@B4j^ zbDnc96Lu7`)}4IlEZ)V3u0Gsm8PCk0&u9Fw--m!mP#6+Y9u|rC5cMQ6AL1V8%QtMF zSr|AzB$ar|hbw(%?nwLK`jGL#;-X#U&x-Rh=R@A(#XfWs?=I{iyxa@z=|eA%_ofYS zCBPfymi21hjF&z>a1*_@_?!>v&wPD2>BA`>uJK`j53l;L#)oTt80f(wcPCAmR-Rgrb04>zeULn!fKq`GFPaF{AST>U#jv1TT%TNE^gP3praA8yqp z7cisMn=}LV-I}a*yJC&^VXP11Xk9#r(2|lJI>CoKqgz!3jM7QEKn`u-S+AefYqK&y@0q!jFY)fsfRiT%Xebw)pS~y^2QM zrz+k1~Gn$cV$4 zmu3CNXt|0jr$iW?L3B+O{HW-qR>_abelz^5_)*o5YJODr8}C<}oF_kiJejp>`Hfev z>E~BJ%)*8#&u(uONv)2suCShvaqEjT5H=Jx5;hi|Cp=%+#E+tOX1c%7k7jc?e%RI<>~k1l?6^`jG`_ps)2o8SkBGdCKXVz_Vesb&1iJ)o8es%=Al zgxSuVBKiMcHcJ&lqJCptF(FUnxSuU-W^EuG@NgKj_DFmb|@Dc*t-3^TU43@Z%BX$hzDM%oJxy z9`$3E$7hSo@nf#Y5go%mPV@8Ql^|XXVm|xAkADKjAQ$-Ylq%%}@U$P#_;J9GgMKXZ zT7Ih^&-$^*kHwO-qlfoniTHEErOIWQAItq%p(;GDPN7So@w`BZA20c_(vP?Oc*l=b zeysLmgC86Hcv(Yit?(7$^L+ltk2QXf(29s0BkTNlO`)#~*9!+(W>mi62fYUe9XThF zO@6$o(6@x#A+pWi75}Ip=l_5GW~sB;kM||{z>|OI2bV@n=O@SD7Rf(R9X}QSjQuOG z^|>D$yqmMu7j$2KY?IDjAyeM&#}4W5l&yZH(ebq(yQIM7J!`aEjrI)X zqG$a$O$+BY=*t=_J>v(LyM-5j(Ft>`Rj6Q^+AXqX)(?tVK;NTjh=@|(PLBzfQy#FEiEpjSug&o2T&t`ngO$lW^>gF zpmqSw1Lk%HFN*?b7%(#qd7S|222d|xRu0UC!ukO-pc(|siteVA)hK|*Yzm(I2XH|E zO#?VTU0w|WkfB>!)=@vlu0D3SqfSv(d5x|uJ^it5x#imrf#o7KdI1vQUH-KxDDLehD z0Q$2E>V;1=>Ci}hkT*TEPAb#4t{v=qh!a2p#ifU)dT zT0#Kh0vI2_y#Y)OU_tGaKD3-b6ms%DOLrX#p$`U`4=8Ms#SreRjX1JP^Qx0Zb3zA(}@3^8gpUiK5EgV6h%XX8C45@=jBugwSz$qcvG@|Ynhj&UNh1m1?Ev0k z!v^q$%JyCWn*-P)&I6G51Nca0^FaU~2Ka$L?T7r>t?!~Osc1o+)gu2ib2#08gI!T2Y96*DhE*|XhwbYAZi3rHHd0KbM{Nu$E7AWQ=H-%%3sZ(Sz?he zE<1>676nl!h`KBfPkw^t156hNQ9pa3iQt(OTRD`j%t#m)zf*;M0RK(SWnq@uf&djxTL5IuwF zrLLq7@A8-C6u|E0QBn|BijemSqObT>!hXX3Ug*^#*QmAkmpAtouMJ|LSN=iFmt7w; zixYMkNBv-Bx1$7ZlFrB=ZV?$0#85BRupowuj}WphH;Zt{j|$>e@mWE$6d4`FG!{<> z<70xjja3VR6(38x3gV6+#s$F@J8L&ScZkvK!$r({{M`&F0+WbM3sFo@|i0M+qfwfUp!f*C2$%A-Iqmmu{xa72f6+t{9K0k;jS=oBlf}nZ! zX?YM&$()`J;+Y`mi0ETEnig`n@loL*7KtntQnG|)@c7aomWeYp2C?KU5A%9Hh!=u* z(Tps!mgCCpr65*Hb5#(lgIHg}>{4H*L#S;|JUFJ-1hF=VVId3;VOUA`Tzc_YO@xwtJAs=q?Wi^=#e}4yY zDu{oAIHuYi7gByAh?5?tvHcswe`>e0L3~)*`0CR^oT24wuAxJwgQAC=WtqbB-Co2J zA>39HB||6`G8HKuLYa_RU>96j*$~RHmw9p?GO6)i9z7uoRxt!(C1GVLR0)|CJDah3 z2sJ|J7(%BIYKBlNgbPAw8Zvu<+9A|erbSAPtyf2J>k8{pN4o%~+#qDeQNxg#h8ihK zW8rxroG-$XHwp1Ov*unTbvj;x3qxoYLUR?VRS2y^#ur_r%Zo#1jJFWB6h6u49u>qk zVRmgo#>upmq@A#Rf%E>a$fY4%CQ?{Obq=9R2-k&heF$Ac@P#lSWF}L;bgnLA(hPVh z1Vadg5Dp;{LNtU}2=S1)TSuJ&CPJ{K+)wBTy9<*cq(ss}SC|npdR8PS%nOS{=q6Gq zXAf~|ULHbE@m`*!x5yPCT@D6QNaqkG>PLbO~7%MVPI6j1am5pUi2=Uv&#*^O_!bDluS}9BlVRgtj zdAG=#9KsaY;oTwJBb|FgcwUmJ!uvv)CUU><=@1?W;lU85hwxAcvqG31!ov#U(0D{- zhVWo*Yo;fERD{`4XHE$7LU>G)xt`|ZAv_^IKVr1th)W|gU^h^|$lAy*;No8myGdBs1-unHHzV^Fz`N>{ zFGBb-g!e+&tjqU9_)z2nxuyv`=;Pr(4Kjo+8fBk^@Tn5yJos4%pNFtj`kd&w4WV7} z>0Fll0XffYA^aM`UR7ax2s@;?Q%KFPB>y^uT_NmdEp$owFCyOxzYAfH$oF3851a)& z{!<7)7r5uExqSUi=^qc_LrP>_$Y(_UI)rhlgskIbVRTgPoN5PZ;^-VkmoU19;S0kbMj(t} z*gOZ$h|H0vMuns7kV?WMooZ*#M#G4OG2Kfu9!5Tl;xH0n*kL$fB*Vxklx5pf-gwuP z%9BO(Y9wet)W z<}vX{gfoSYhA~TIws4M+eKa?WdE$0$Gbs3bJd7ul?EJ8?cK)6WV?h{4Q>I?raX%Br zLRJ4$MSM1l7eyA4D22sgED7VeFqRfti5synmW8oAY}P+3_|&3qtW@LrKa61|%&_GU z=J0)4Wfz@86dlrk1bFa0`)Kacvu z*bp`+y*wmgAHAW}HVNMpz9oEH_>S;h;d{c(LPmT)j1R;=6n-T9Shz*_iSS?5=(8|B z4`XW>Uxe{X7{79mD)cM%j%96={cKn9xT@R{#!iKDZ^ew*@?Xo0cZIP#jBhxg!uU>= z{V9w+VSLX~$us}3xy8Va;2{hf?MJ0RIaA<+e?RMzgqL&G4}|nL{L@2YQpNm8p4{w zTEdC_P3?-rx%1-9ySn1_R1228egq9vo`w-LilDKIbe<%%;qh7woUhAdH|v53nkwRj z!qyQq6KO7mixl@_Nm@kEG6Gr)vuG8OyWk^0Ev!o-XcIwO>2Sfo&~_2DkDx;Ymqy@M zI+v*#eG%i?I!4ebVh&r_VysB#2)an8tB_MahN04B5M9h$%5rGpid)t1xOp2#ei*y8T#H_M15o9CCslfDdd6kM*eN_a- z5p>gK_Xv86u)sY;E{~w6C+SttDYC8*xzdyOiJ-5zPm5Ki$pu?~mYEMTL~u>S+$$fz zf)$${yf%V?5e#Bz1fwGuqe@*L!H@`sMle{HH>hWC6u(Kxmf=AJ7oWqJmrf*xOFlw) zv!^pMf?LE#d6HXc2|?@l2 z*%8c9C)SQ)ZUplp*cQR|2p&@>E{xz=wyO9OZ0D3UU(uh8U_k^=DdOAuXW7%@&nT1@ z*iIvTQ3NkVuu{<%t1wF!SV=JMDTnBFQ`*qjPM_4)>pa}$lm0Sr#-78 zSRKJ9UaXfRcq4*M5xgSFs}Zb;V6DpVI)@CfE`rzC7rLv(>4}!VK7tK0@)uiL8|8~A zBUN&KjwgG@){=Lmj@;8!KW!TU!9dzI90 z5&TZysFPu?ptxe(7r~zq?2q7p%D^fV+`e06J)tw(LrU;)1V=>JdPhb6ir{Zga!lm7 z@PzPW1gE^ve?Wegp8c*9$yipX5qc~4VF|P|0<$Ph2sF{*@C#Y!@7e;kgy~t`7HA`G3 z+dPVkq(**m6fHd7QlwQBtwk;ow(&ySM$bK*!<5^r03DR|rBPg_%PWda)jCJfC5oqF zcshozQTU>GDTckh$0k4IEsjZoG6k}M5D$^W73IBo)Fr~jvrrR z!f_WBp++;U^;^t zQIZ>lHwlLbhYE)YhYJg5N;gN%U>vEIxh0BG3c59lu_E-Pqt#7gqPUH%6gAJPu?-8J zXPnA8K8guZ+~HZ{T~XXAK2J}f(0(TBa*}YeaEkEmDDDxV&b?7g6~9k7O?bZ-8mMDE z7{&A`9#UbJM9qrp;V5RPkdM&AM=?)@nHj~S>P;%llJe{*_;}SEajp;^Q|Nr9{5Vsf zr&4NMCDLr3lzairEQ+V2ct+_j6f!OkI#}^%qgbTW7PHKH`is_1fAw4xOQpF?3G!wQ zdvJLaDqu8d@c1WK+yIs-Q z1v{hoDvGb8*cHVo33o^FO%w;jzZL!%#ZMyNMX^WZdm+>LL4+0gIf`GR_*0j^3V-u- z_KNU7$khKmia$L0J`u*^&c~ zVmkjs@vnscMNv9t{P}5Jo)MlE@@*rO^T+p+m+*MW7)p7ZkIDz=W_)Z)36N4{i=7PF0)QjPgm>EI! zrQ9fn#xXRAp`1L zaXZP0AcnNc<0_YoFe}Un^TJ|bH(_^S4=P~S$$);N@eILq`W`X#Cc@IOK#b&WwB!z8N0_VTw#I4Xu)V<th;08Ndp=fm!S8?Fg0eLK;YhoW?57L z_e=8$r9jC8F+3Q<^cWtB;o%tO5V>)S;gJ|-iO&>1D!dma^!k<-$!tl;DVZC?JY7B} zeB28v=<}Rmehg2>%mQqIMhESOP4P?&3uE{xhM!}2HiktqiM25-j+y-|2h{U1ERpaz z;ZilxGLE~J*76v5|7C@0an?3fdm)AwV|YoLOn*%bD`QwCh1K-`G4p^5|M|Ag1_RE=x+7~YFvGrfUjZa23D-dAcL#PFeP@1qz#j$w;x^obG*XFyJF{NtKBht!={dzRT&))hYTBh zhECqNUj1I_{6ITVfw>K*Q882M%mIFh;nx^W$8aWwy;5M%VUgdMzT*C&%YDK>mHYk} z4#aR!1wN#{W~N-t@(%@!engr_g?|bE79LYIkH>H#20nj&GKPORe3alR1@ZjIKO z$HHk~731c~5apRT6c~Dj@Zl-`bany|)mtH-N8j4F{&A6GGYsFDJjv@+s zm|@EjGJR&pMC!#+KMww7*y7FKI2y*$NQv{b?R=%*SeNI;&7D)0htZqFaX}nS#kK=_nTE)>ijc@|7D-5xM{`cxY^#%Tq*NX@5!{bdRHl(%~xzE{~(9QodG_UP4Z()bAa~6}r4q*hkn`$k3}q z`o+;-a4rtX2HoS^R$!M-K#S5Aa`oqxL?jn47y(tm(zsk|KoU2QKrZ7P#h1( zLBm_9STo{yB#xPJJQ~NGIOfJND~{O|TGp!mR^O^-bnxbs!$-E_cr1?j8f8rXakd_f z-!jwd1Z|)=G@exG0wLS#sW_fib3Nm=9%ra$<5(2OVwOSk*U~ta#PJ-HYH3cDEA=zy z^UGwY%$n=o6|yS|M@Rd9_I z*2S?_l`?LePl2j&Si;xiSTD5=adS|)QJj9@jW{-`F=^5)^V@N}6UPT}e5i=;O6|S4 zIc+uuz~}!};P=%#g(rMI;;5I}#*)U3Y>DHOI6h_L>p;F-OY1Xr4JX0RRYLBMSPM>7 z+v3=+Tn@*vLxk!78pqB!zS8B_aeNoY9$C?@xLI@VX5m=?Iu`Bp>0?-*KFd<4hdK;yBJK^RHfUoKS19RHu~DN#P$Qj5lVj|Bd6nxOtX_ zmF16K@vIa|CQvE?D`D)AKO|5hVf;KhYZTA_6UN(@PZ(!XCSiPjSs~vDS1w^*olQyM z37<*{R8An8KrDeO2~<^rK`JLuUHsw%YABuBj3`nwVb*xH#5uV$qdE!GmFFqbx(U=1 zsV{6GY$$9bY%Js}8W@qqJ74KEN#KHnIm&CQ%L@}`2i;7_+BHw$A{FN9vZlU_)gpnG z3A9R}bpn?p(3YVrmE2AnwFCdgMNR&ni)pq`phE(eCU98-ezgOGI;t356X+z;Ie{(- z@Q;Tn6>J{=RGl#1fQ9755s*$bPIGmwkV+C3MpRm+#+j7;6;B|aKydc$g-~o=RX&0&}HP*qqK3e^fXtf!QLA z#UVV;<4-2=m}*M-sCa&_(sT~hwM$O{Rq=RaKPS}PM+#j$+WJdC|MftP96lhJiDUP<6pwt0Wt-XCic zSernfZs^+$>k@d4qc4M|8NAL!5*V7qup~Alu#s)+V6cNX64;c$*EV+9c$1}~`Pt}W z%#;-O5o!Jwj{7Gfj<-Y zB!N#8*h@oA;IjliPvDybzD-~&t*DQ+ErIO`e339;JN+_&T|7yyWoC;YpFdC%mJ^e_qRQECf03ncLOAJz{XRw^FT`B@Qv zP2d;01wOFB(b3O*{%@FGdHQ<-e@OmwRjV`44Suqyvp<0Y3DmdIz&6!9n829?&L(gu zfx`(LN#JM#Clff8z+cQRf#V6BNPvGrIhFv=pZRZA=1b>UyPA1DW>Lz#PvalDvIPE1 z;Ix|VY*iyHAirzL$1}LPux!9aRU6f8l(13KMgpG6GPYU6m$gxj znj_4Hk>iLu>&sh}Y*dz76`|QI^DT>Y&tY{NHEa~wsH4!DHfq_ZZJX!wSp{m6OfI(g zO=R-A(y1pr+}z@yF)8G)p^ft;Y$T+lv5oUQ&U5J|HZHKyRFY<%{6djJNt)Z{?{9_F zT1XxiwzSboq_vGpMA`_u2-^zV3EK-h*tk^WG9eS}DALJBXWQH?;KG#ys;h)PpFkr1(kY$8W3cBrY9w&B{y*vQ%_e4mtY3$LtU%NIzojczu2 zD=tI3+vs8Aa$UYq&+2J|S^viO*6Llgy=?QUQm#^Xd4;XB4j%j4xXQ)`8yju(v(ewi zP#eQ+Ty2|Cz~49AvJFm87&+myiIt! zaICOP9c#SE1RHnQxYNd6HWt`;%Em++lWfee@raGdHm2Bkz{Z2L5F7W{xYx#1+pGkb z5r6!f7#o&N#NT~3rrEfkqlO*V*LtmjwNW3noNnVG8xOOcH(3o@nb$ZM;xdt$HXgMx z$HrV0W|nZakakB5+#2(>pEjPc zvBJjlHWu1=*2Xd=$kZ0uSZren`%5oR<2ZfJ#!?&HZ<5c@kJI;Z>2p5qP{e2C@S=@Z zZLDGA^T~f3t8A>cv64efyVp{D?33oy-Fn4Fda5z+Wjqn(d+Jyo8|!E)LrrP@-L2PX z9yZq7=-?@A(F)-wF8gh4Ql{_H|J!(rp5MkhlF*C`AM$1*tb5@dMC9)=wbs^V>AcTb zz{ZC*KC|(|q~!LY^Jj_)L~*m9bi#Jv+U%^%C#@+UAoG zwA(LjY_qYQW#CJPN?1qr^5LB}zLF{Ot<-#hcDuILZX4gwaXH+E;9DEtsSL+#?6L8^ z%>!rSmwq7H_}#`IHhz*xP{{Tq{%qqH>HI3BWUr0i#0#UI687vq8~4?>{-g`i3(WW1 zIAG(TjYGEi{?TC@M^vgqpIUsWFJHocR6~pv8Omqxm0F?Qj@vk42SJJawRF(h!6gok zwY6F~=BwWYIThMC#_|K)Bh!o>bkJod2bVhh0}eXsvXD;M?k2SZX^V+;mYjJpsH;jy zd-FM<$MZV~I0!oCI}7}l1To|w>=+y7FXG_e9u^5(Af|}EMwacsanRjC4+lvJy9ram zw2=C)NJf|y=7f1+v4etz>}g`nn`B+?pr?cD6lDI9r#ZKmgWi%{;owTgtcChGxJIO} z@G2qY{T%cczgh@=JY|6RwZehIK|(Io7=}&v`F+$sL7@Gb{Wh){o`gGml1JDB3&ZU@sG-0$EX$Goh*2o{mQ zdv!Tgc%Sgc3DyH541HMSLE&`aLk_II=i<(gXPSrXCt=&3fjadY@vGAo4S0!GxNcYZ#nSG8uFcrw8sIf#>*ca{N$iU z5;c?f*}*ULlS!0I;#UWIl}O1Xeshe6XTD7TcM1P+uutSq;olDSJ2>Frpe~OH*?NZ@ z92RF>E)0%}|0OJ}-;RkNcW}bNN%0cNb8F^P9EMY@f9P8z|4(>Yct&_u$doNbLDJ~+ zk{wMfl?3~}9an})lu05Hw{DK{Ca+aK$@eOtViJ{-piAMuQ>o1FjIeP?DtozC5viI) zHBVAKiLBoBS1XCyNnDUbQw0?zah|7BCyBZquP0Jp*g)7&*eHp{NwZ{ScI>$GlV%y* zgoWo*e7w)X+rCLOOQLxa7bVTtRmy57!s2licd=679Nj{srLdK-weXT8+9c67iFQd` zD@pq#IwWzWICH!-iC7ZxBrZ#$V-lS_c_4|-9`BMwSC9LW@Oykq4J#-f5{5l_B#EfU z+2#rH?m{~WM4q&@B?kr8L&EM87L?}Zj8(M`Ny;Z*3M%gdAK>FM+m>7B$C zB87hJBi>hdm9U?XDfCa`YL8!&!~pRvC1eKTgM`-!uNMv$GVTrRERWwLGDOJ24^LtQ z+c1qTY22K|NH%W@ol>|ZiBUByqc!=KV>GO=4UU z<0ZLII3bBUlDIR8yLc!;BS~Un(tJ>9QquUA@>f}JEVKBj7j9LiByl&hYh&>PUiT#N z37x+*r^?<6-#VG*<;CI2ADza7NlZ_gZ?#XYZQKQ`IU|Wjl31R^iX>(x@n{myDHaWt zj%b$n?4(%?%t>OdF6Z%5h}A zEKXvHC*f|0I!krAjP}d{Ue!pRPvV6nUX+|=dnt+Sb*w$A7uWeKlUU`Yuv+A0;VVhJ z>d9H2bxFLI#0N=yn8fQztWV<2B;MlrPZArGcq55TQvQ318H3D}HdZh*eyZl}B;HBl z-6Y)fPvX;-R^=3aNt*S;;Utc577*Vn{7uN9-;?;mVp_K?@wNBv@kGBzND{LohpF#&OlqICG@$G*cEVRgQ&RXSg^yFXJB54H6d$B;FG*Wd-xVn{YfMey zzLfdY+O!nzPvL=-IR|?%h3P5WUea1v%6!u3p_KXZ+O~Dp!zs*2;gJ+(rm#d6c{GJt zDLf<2TFhqQQ+QmLbA)q+^Jt9~&Yd+qk-`EA=L??{{x9^Y6rPrZ9}8oG{4Gr3SxLwj zrLfrJjPjiLQctohh2`Rf)Sg$BUl6jsFQ)L4_{tPkrLa1Mms5CKl2<&PjVZjE!Wvz! zWm9Y zevt#hgB*Y&hrQ4vB1eUP3I7&$F0zh`oDiNAGW}B`|D^D*C;3n0wD64ZtdQkL+IWl- zTzzqXh?h#Ev`CpWs*6yeY#Qan%X^XvA{B*|gq4L=gjI#rn5_IHQ>c+fO$iHoTUrHO zXq`0brqM8sMrqVbqkb9<(q`Z{scX?8gkZk0#UDKYg^klVFOBolX7A4h71Jzig_7WMgWs!#B-f-dK>S)^1)cg{m&WyJ+@KT&3-^0xZgJJ(%Wl>X)%~F~ z9u^tOMi3b;93i|pjge{GlE$bs?o8vZG;URDx2G{SjnQe0Nt?5~Ld)Ei#u`<8oOCFh zATnO7*mLLij=&FN!=b+`?H~gvu9mx0oQaTO|nz4UbD@4!2j* z=D_4tm48hdYtvYl#%pQ3lg7IoXlbnH;8m;*X>3emlX%NEreWU@k4~~!_-uD`YWh|h zZ>PaZF|<(T_tMy$#)oNql*aqg|3FBELch=^KTcx{eZJ(M2n%Ptv;npZH9wKh z3+^bnNNZz#sWQLG@4s;1^AsqJ9qbhTmRnz?@wMDSxPmpUf|=0yJ;!g-_?8~PMSB;asd}5T$FTC*+mr>rCgMDQO-qq7iHXY zo~NwH;f5AZ(F;vo!9^trE4pSFvb8h(L$1!ltGcM>qNa;lQm8Jh!HjaI$Jsl?+7hxu zi$s_v9Z?-|b|NdzsiAvSD_X&7=%SH}HZIz_XzXHf6N}$IW=+p?&G#J7cg@VzM0kO) zsqjK!GhuV#MZ$}PErczFt%R+Gmk7DsWtxTMbm8!`gNsXDjB;_Si_2VebkWO2Zx@|h zbarvMi=K+e6?GSpu0o#+zl(s2po_E%*G0%h*hPXRcM)+BbrEwBR|AG*w;TwM$-}dq z&txsfMN(~&60+S24ahqVY_5!ptczk7-CX3Pz_!hcFqEF3&D-5Y!H4&7!9h(02GK{c zg4LTEkF+yvUE$(N7kymxRk68Qpb`GB1+J2?3pWBT`n$N=#WgMlxEQ94u5~fc#f>g* zaxuuobuMm@{CXEJ=(fmU+LdmmaLCi8u%lU?Azo>Rs_sL&TXeQ8+i({n6m+wTTSP{> z*vJ=fd5uGz(JscgSVT*3ahr?VT`Y9*tP2hY`lYcfUKwkg$~@l11Q&O>xYNb`E*@}k zmy3xm?sYNM#UvM#UECv08dAM#W;roMmv<`>wg3+{i8t`hujJI3CPE?kgD$4Kc-+Mk z96@}PUHj07Ts*8xN@lotgniW0>`!M(_^69nBC}o0aWU7$JQt5ivR2UxiPYEK2OjA# z;(UcZ>0*J%Q!btsVGtjIdq(_rZMx}#Zm4RFi<&Yoaq*msr7o7Kz#L6H!Jsj7S4lDsEmvM-Cg;^I{oYh0{#u}+e=UA*Sv zb#|7gx!yhJkv6#I{#|i7Q!4)6aIwk7n_lQ!(&tU~>N2@^T)ZnuL4ULO`z}5Z`HElA|uRx!CSvkBjeJ?2vGmaHnu;ZR;x+UyCyx zj)L7TzH#xbB;N@Oh2${zhpZncaj{SGpIrRx;y3YMgiPUAnwhrDdnGB<=y&lyJRPR< zr;Gi%JmBK6CqL-okT_$}u#borQv1ur-yAhAj!VdLo^Wx}#c5qq`IL))#aV`bG%iT~ z^FqlN@)gi7&PqaVWz3<(nJQL^3`%BDDudD))Xkt?24ylRn=u2kD1&k$wKAxkLHP`q zE9T++3K>+)oLh5NBJp^Y462G(^CZ3Tq0+j5>uSxd(gT|C( z(9n}N5}`MsGS$xa+@8UN4DQHa zYzE^p7_XEWi;csf!D)+kgbRlccV=)w4o!2oi^kl`nwY_)3?^qVC4&bun9hdfBcQ@* z8QddsuTrCYY6ka7Qn(9nzc}R&uwGHq1rKHLFk@wLZx%B$c!Xw_HKsK)gGV!XjSog< zFso3u3?9#5wm22$h|JAko+sgue?oj=2G3?NU;IfgbU_ABW$<(c&&d8aX=mN1jSGEQ9O05-zfqi!dYd=eg5!{a+emNl}z7GX_yDdKJ+EBjprdotLU z!Jn$;_Zj@0!7my7z>2UPyaD)=q8A3^uNnNFF;CPpue}-kCY?eMqx?ZfTFpE`z27Ut zkqi!Ga8Q?r*q&N@Fz#VVczIOhFX2Ky0z});{iYKcoXns`7B#atmBBw!D4)f@8T^+) zi7ZNHaauyAb~b}E;%unGZpD(JB5QJFvW0w0Wl=hdGFf9VWu?HlZ0B;~g{H2MMMYg! z${O3KDqdMwMab5!mNk^m*(r<8B221~8WZeFq4H%! zwsRnhU>2b)!qU7mi%1sHECyyVD2rGY@hq;$;>s)%tVkBwEOJ>mStOync~VRl%m%lCxKvRIzQ ziY%VbVuK_v2-jq>Hj5XtcqxmOS*((6yrLi$X>}Ga%T5YbN6D)SqRkZM)^%CDmNhp? zxoal!_d1JR#ab^l3O8o)Mi!g0cvF&hnZC$7S@WW#x20Uzq)?f;6q4O6o%e+w2tUl? zqpb0JA7`;8i%&cQDD-S$bbqdX{4tB4vfTWdS@?@Az7*M(#djhUZqH&z7CW=}O17~p zi`@$PT1Y$jM%GB9`c?{wh%qpl-ySJ^FZ@ARkpC?HOBTPX04&VjEPkUG&7o`#zi06W zeR3B6Ww9@dKeITN#qlimXK^5lBUv2v#@E3t4k^dO8X)u@p@{K6T%@tn|H|TTrlYaO zF6P$n1P2$F`ofc(0B{Y_= z^h@jVdT(wmmqXEjPtLaLrq1g!3DV- z1%wnYvtb7+-A>l`l0p;Hc>b7;d{ zc&8wTOLJ(OL%ST>=gjHWR_!>LPGxQuq(ilix&MD|$wQScIdsjTR}Q^dHR%L$2K$vR0abGSvFcyA6< za~PGwtvQU&nY&apX*!BA;2gHHS4h zyq&{4IjmJWZ|3k;4(r4j>$MzS7hms5Hsr9;<8N@-ivKT1{#Ai(!iewY@Lmp^)ui0$ zv4bdNrHJq6@PXuP*bj5~D2I=8*usqH+i6AI4&?AD{fr(7_)PN8bJ)rz<(-RXE#65a zVSB!;KXYx*VW-MKL)xKaS%9x{_*z2R6*Ju>zFVQ+v31qh=mF6+A5+w(1#G z>TC{Ho*xS_E}Fmcd6W<@DJ+#o={(BhQ8tfqlJI1*ph?148IV`VqhcPFycDYDQCYl- zC*jFwHSy}g)ul{cY+H6Nx97F;=IpU{9z}W7$)j!__40T=j~DW&pGSi{{CNcOXqZQ% zyjfbb$fI%IJP&rhE-5)L557H;q=_UKc=Dzq7v{~>-z<;jd0dn~_vb7|zgV2HTISIz zkJetSj(J>?N1Hs_N^+U7ov^*IgYZ%zqcbV~NIH3v&UthZ?<({O`FCLIu%m-{q*>*> z@hYJ_!g)mUi0YC${Oe^*JT6QKZJ{Gf3R6OU(VmH9^2p|KYaXL1%p;%2)p=Z#M{yqA z^600==}sZ<3aKO{J#@)N>zPNdJbFvsS9nDpSBmf-pnW{TlJj?!F6kwhLjODp@5~&K z$F+Ifl*f=f1}a&G4wmL1;dOajFTz)lF_9bcm^93~(bFWSaA+PkOJ`Uf!}A!S#QCZj z{+J8@vNTemw+N{}N`(JY9+SsydCbV;kvwi!ns?BYT6goP=T ze^MTk^O!CnOFku!d-Is8=y&IFk5|sZ=Q-G7_vJB--B)DYub>Bnlr!#w;tV2xNX`DR zke4&_c$AgOoK-Nku^`q%g0IhKQFbwe44A&76{ogRCp?H z{%XxAAaZ7OL?>}Mu%do%wts^C5ut2 z7_0MmIghXM_&SeQ@_hd=-p}KMJl5o~HjlSe&ULE(MkV!{`0GMee|;Vs#0w4ehICkx zO?kX2{+5vc5903~^*)z;?@IVy9-BRV_8Oa)zYp{HD36al`L;Z^>&UyKUUtR;EHVpJ+dW$|hSLN9YQM35} zTO-Y~w&X>^I$jXv^^4J<7#9|UFZ^k!P`ZL9#b_knxY%rA&J#ahNaJDk`MaQ)Z|X2v zaQM)wn<=!p@FL;GLTb{YT6(-yFwq-=S7)~)p6ys(#0+$(l z?OQR@#pm{YoIqU(`TvUyi^QiXijk8fUyOdm=wFQDVstCU|D)eQw?w6sNJ&YSC>64Y5F%SdvV^iLlBKlRiBR^k)c-lpeCGS} zf4%1Qyq@zu@3Sv+=4=y-m>Im_yErZdI|3(SUc?DuCW2&y2g#9=k@9q;Y9^4JU%|wz z9MY3~1ceCv2r3a2CFJ+o=N$YiD@e+bs@bFw5sZ|=Xjz>d!Ket%k%TKv)FhrOBR3V$ z$Y+dvYRnSl8sn3lY2+!D=>~+GeBpIteL%Nlsp7z2YsP5v++|E&bu<{|H`-;Pr?Z z-t!~wjR@XURbL;$TM@Ib?;ROg`QMgtUtNp)Z`Vmk@@@q0MX(`)_aoRC3OCiX(y(r? zX3;tKk$x1x#}OPH#UW8_QZ)V*ZjRuS2)0D9HGVzmx{Etq5@zbIh7R3PZfx?r7CkqD&2MbRTo+_mOLqvuO8I99Jxf8`1;%5ra z5)Kzegi&EkNPprYwvhfLM3O>Rm=aQxw%I6hQCye8ycE1B@=+XR<7gX&D2h@18^yjT zO47eOip5cs#r-HMQH+RUWE8hca<=ed;V9ub!gHe-9mSX^#>#j>)J%Hx&}~%bMKLal z@sgh}oFEJ?2bjq6vP`*Cc~TS?%IYE^g_A`%MKeWYs_>F1rbTh7_>IEpQS;)M!Me)H zAK}a>E{|eX6jw0v3#&#HS271=dzFyNSBuP!;u?`_L;0L2=88i@k$ItfeiRGDuNU4B z%Bj3iF=3osu?tDd#rDXQa7O$k=kak1x2F?lCh<&qd8V3|sw+QLL828&SLz z#miB=62%%xI5`#^)m*FSy&C#cOEWgFMa>SY*Q02yol$SfmTBi0?;Y{?qu3b5x+vDm z_-+*MMX@1J8*NtQf;{B7;)5tYq&$i*qWCC^kE3Rn&L;ADRXV(BVY8|t%leZjw#bvM z!fir&wLOYY#Xl1UW0EgJ+uuaK5`N7-f$P6fd@Hg;_?_^3A#Hbx{2=^M_>*v#aJTSh z;V;5ph3%_ZzejO(UF(l9+&`n(6Y{-L{3ZUk@Sjl5x6l44tQg*pV`ChMp;`<>V>m5_ z>M_)ap>7QIVx|ME8AELm@>(M7Z0m>w{rLeg)Q_QY3{7HaAbGs*sKfQ&7*33Vq_41_kjDNZ1B3&GCkam$4vJy0$SJ~8 zg>*H9375CSVmLj9m*RLijx%C7Glu8mcp;9nVi+DnI)+S)8~;q^^O$o)xgCum7DHT| z|EQvsE$+mS5J?K%7*Zm^vNaEbv#MlcRr88DS$Rx*422kqF*J>%SsbMp%B)KdH= zp%TN)7%q>Qq4kIu#xb^>6k^84Fe-*~WE?9zS2%{{$V}s6J$E8&^7g>$)_Jn}p_-A5 zkKz0nCd4o?hAA;jmDL5p3x$(}yk3>c7sW7HM)HeA0#7c9VR{TRB$+0>RLG-SypDsz z%gdPU3jLt^)+|{qjNzsju885v7_O3JZVcDOaCHo`W4J~VhH|Y4Jt3d-A3l#6Roz-3 z$@~~@(Om)8%XmYeCJdr?GZkW39>bF{+{(Hd!#y$F8^i4}?5SoglI9&TGYn=Z%pc;N z65b`eJBGy~ffa4c^o2K`-_`fmy6EmY7N`gr4i(!B0rzK4Y z>1}lpYSxIOX2@%a)E2Uu)eGf~MGlCgzDNUMLt!H!{b8LUHj$D1z&M)6QI5lpqeUDo zB|kNeR&g8@N5?oi#c^;Phs4o7^r3YeZQ?jAjzc90(tdc{^c(FYX)8QJ7zB5uc+l<` zdIuSgisNXJpc-@*?;Xdnade5JYn=b%FqzgTu85?am1L__07^1ZR2s+vT{QGgh(c^jTK4poG!@> zp`+g8@;GM2adRBENO(mYb49L<<0_GD3hQd|*>PMG$F*@VALx9Jgh6gx7stFf=1X#u zlC~g@>t(z_xH{;I#23a*-^hsZVGnR?9Jj@BPaOBgaeEwh(0{4Xc9F=PVM-|p9Nrzr zVh#YpE{^j1;#d~PBhp_I$Nh0UApT$+4~ejgUizOre^^3B{?Rxd6JHg_<8eG8zEZe6 zjuj$L3ZD`(EcOOZi$5de@+gITo|TbV{hUb95?_p)fhC{SBAgl6x!bIyzY@oqINpro ztvJ@k@oF5e$MHrSuf@TW-EUVjgBGrXbAZP&2|3rx_;K-e9Ph-jA@p;49c!KV`gqj@ z#k+C57YAn=xu(F~CcJKfVSNzChjG-gQP;*taeN%d?l^vqV^bWPDGL z`Now>hPXA3ZE>^taC;nI$IUjCPgzWy0up{M{34Do zEhBS}CpDP%dNvNQak!1PHtO4GV57N>7B(8%Xe7-8Z8OW)*sdCjvOYAiO%-h_Y$p7= zzs1w*Ol(UVt!x}*<6yh$03AztH}~@&WbRTv#Ky+nCXKCa94d!xY|~30W}E(>e%{y6 zIwFkukv7_i^UH#h#_er%u+8i-HRQH7k-6dN%SRK})12r{&8wd>eP#xXVVx#t8asW08%KHqN#&(>4=vqvUF; z@EjZG+88Z9#>QCNEbG%NKIcg|!8VO+oQ?4^o-YhO8zJ5Q~u*8zhy3w+BD&%!s$Y~ogs3WZRT}pyj*o`mW?ZHTxsJf8w+e)Z{unkvu(_= zF_)2#S=T7fueHtgu&J@CGbz{Em}g_YtXOb+b$XiHv4Uc~LGqhfg>2ktW1);Uv5uXE z4QE>19>y}_bE}QpY}_u};HXQ0+=a#6L`+)H*zZGDb2Z#OAdECYmcGbxm#)_vA zM+N5xZLF~I9Ib3TZQ~gm&)QgJ^HbDXX>;np;xQacJLOvH=pT>b()kPWljK#A7lo_Y z%J%PnN%*qx6&q_rC||4EOA;ji4I6K=&vDS!!CN-ow(*ILEjHe0#rmN-jg7(&Z18*^XHh~3N=(BjQv`ejQsOgv@JJdlf5%R_&wS{$rbsf|bIY3xn*g)7&*ht9APv=d>99-aFl4D*OM?2mxE$19I z4zt+ygZ^Q#oS)+0RFOa!)C%@6LmiyvU>FnPpupU4aE8OPrKY4@2WN>ygu{i*9KK?r z4ub0!VoH15fgR?g;~*iP6td`94N?x$4%l+(EuV~otYf-`oCD9{42+d`OrLPiFmtU0 z_>+rs4 zV|AW`aSq0_f+-IfP~SRM^;*^h2NNB0*@Y#2UeL-6WOHN5Ug+Q=$4n$n7G5l*af*Yf z;+F`gh4M=sOc$Ra`K`6i8!42Zv!%Q_kH#vBd9h!rinLo0+)xlG&y4?Kf;C2UhI9TN1 zAqNjTxYNO14(@ZX#KGOly?Y$o>tL~Ch7*VJ7gWMW##Gg)`yD*s;6VpV9kW-Nc^>R! z=6HZ4s9?(+JmO%vqg$ICJm%mDl>%)a4_)!D54N)4l;xAMWmr^L;oxZp&p24=V2y*d z4xV+e%E61wRR_;W^LYm^h;Z~0ROTRD`tXv2mmR#~n70p&e7flfCto73%E{|tSg$Fu ze8o`b4JDSIyzSr}y4A@?=HxmD-zo#wJ9w9E*1-n$5)QUFct41MgAW~S6le1JeB|I` z2b&yhmXOh7HqvLFo#()egp#cewmJC1!IuuUJNVSWXADL9L44>>MPoB2kkR`}R$sH# z1Ofg3sovq>I|tu8*y-SB2fwg+N{tS8Ir!1RPi#S9ZZKPR%a&aP-@m^)_>FzLgTI&? z4*qcPr-MDp89Jv9V;h|Dr}08w0U@{56R45EKkCH(m1LjV`+lL7Fs+`|msm~6aR@nc zfSxdce1p_Z@Vq2$OXBt<>L#kb;7(1Vp7;R?)K8#6!n_>&C&4qb4JB`sK;s0OB+xX0 zW0L5dM6(1AOkjNi?2nunZzF zAc27ioRz@v1Wroe|qGC@Ie8 zByes5QqeSOtOUV2gCBit2PGC#|mn1MvlCcS#pTGq1^AZ@Bz zE2uv)feRA2D1ph6PfFlI5iT#%TPg&2aRO5kn5u|T!l1cEMo-L>!1M&JN#NQ9W+ZS~ z0#_t(r97FLz~u?d3Tp)&QlEYjuS($R1ZGQ(xk0NSAo@&O@;S01pDS{7s54*28xmNc ze7HVTqmvuONfst>lWYUuZe>GD;OPXON#OPb?nq#90{2LHQJA7TWxPwS?iMnhbWY#y zP2j-`yID8@JUka)DmHGkN zev`nriguv9BZ2Qi-@cbJb@==s{-g5erv!G%$?gPx4g(7E;kN{Sm*npR{tyX5|5Kd) z>`7p+_+RpnwjAD2PO>k7{p^I3Xr6?X1d^zhMD?U;K0zF)LqcPXBx)v6D~Z}k9FRo) zPh8|#abMh>?w zOyZ&>W+ib&5|fj-IEk4_TrQudB+V5i9Kuaa;*z8p-b_p4vZNU&Un(Od)03DHa$ZVy zi@uoXgr4&f5=QCDB(9Qgw+flStCQx_X14sfCW&k1e2#EI5_3ha3;moYGCyg)Ss2{) zN!%dGjT|P0It!DyNe>mMc8lbc(8%}?=lDN~MM)gvqPL4XlejC1IxgzExI2l(Nvuuc zRn-SxQ-4nq_ln=g`oNn@#g{N2l6XMXd)aJL{T`HjsaiA}eSThEy(D}gi5Epy3xi8~ zsq?aouL#!&c_GqkN$_^ckCON}X(oGL7rr5UGl{oED1Tez9pO6R`Xt^Jc~7`ONX_>} zHVQuwekkND(59qWv)--D*_^~DNo+}CYZ6~3@l_JrlGv^~@OcuSihL$ybz%!*g<-Au zLK1R*zkJQcmBe>Rd@mu3^4lbKsPeED1+%g{llUQtACve=Izh#zKWwVIRD0<;ePccR zIf-AA_*L!wuO$8!`HjAbuv_>ei9f~n2=|8aCR?q4*e!Ex&*^SW|NfiAK1nFt&$obU zY#}7!&iU%nq;d@xHA7y@MeUH&&w4Hna8chy1J}F=xas|=;TB&60|#0SU2{5;Ki^?r z+KAq|XyT%&i)Jo5xH!tifi9Z6IK)M37cE@0ba9Z2gXtCb9J;1)G0D6F?rq&v78v<4 za;S?ouIbhe69#vS86yt@yJ#!n5w2-9?Sv#px@aGAPHr6SqN9s$F1owu#I(5R8hFV2 zKShE$9L_l~(4c^NxajGkms{17uv~)p5RY|noQvTuA};#4INrrT7bm&g&uwud*$K?9 zdS*w^i7xsoi~70f?^eA-nPUUosvV41)id`x{x|UU7RL9 z%r)2EQo^cTo_}y2!az9k1ttUG%$Gnqn%tD7h%B)R-r}l!IzqVOH}~{YvXW{teT` zC|Qjbp5x+N5&DqULE|7-$4EHV1t)fzaOaPU^Ie>t!Wk({a52%vi!N5XxWL6E7mL^# zy13BAMa+E8nY)zmZ${pX2MUl7K`8GnvG2Nx;VUg9$6T}A`8eC`NHevy z3D$B2@g!@4ixn=OcJZ7f&j=Z-XGK>2r=G9+4}adp3k+2Gz{tGh;$^dPjJ0cwAt`lLjDW?;z!xGsY zz3*b9i$7iLVejPPLwUtzl>2$|OSO&*;vc)%G(yZGA04%HlX1>cbC&&c1hGvOpB3x${eu)7#&@jih* z+&<*uM;AZ2*u~;*Xt7bSfOr~fw>zR?58eYot&!1s>@|%8VJRrBGdR za&yal3bj+HpF)Ea>PTKsSXW5rlP8%g3J*wOqIQ=xOrcQ^3%Xv$Rh(^42FLVg(M=vZ(mOiy7( z3d2)~q%b0dktsw|h^0_Sp_oEE1v>>Ng+vN%k1@->tHN8+lHA*0$9kc*<%TgyiKJ8J z2d0@6vNGm`UJCh?`MRNV{&1Gt14=2BQ}9!$q`>uh#&$(-aO)|5L%`mWSEd~Nu61?_ zqf!``!uS-HHKHuqtNJA&cu%xPkeZMxQipOkrUP8&mjzF_iLcDcqjI&EmHRZxsfe%pHsvt8U8t zz>%rDlT|2%dsDb8g}bH3+~8niF`J$Sc=x5SMDqJtOWT+gOuAy<_<%B;o^ZKjX$lXe z@Gy%kg$*gZpTZ+@@~DtHW`w|AC56XRcp`=6l0TEe$`qayr|nZBD}+xA`F49Yg;goM zsnVp*bL`tg{pUqq5WXl}EqqD%vXHB;Yed!xUlqP4q;Ic_ydnIj4c-dnZ;QMmTqj&F zd{_9MkUJcLi{kk=RVMJm6h2DfuN3}H;o}rGQ745jl*yZkDQrvOlN7c{!ozwDJ*ait z<=bZ|e9A6ylKE!jzjtZNeEu?puTuCug+EgGI)!gi_({sF$yE539nleHv+<4;zLWfW zA+2_b{E)(rp@i?pUE;fiY#Ki+OMemmD*P?TWc{V$&lL8gu$Q$_8@%b9-tt+%jZ!K6 z%c4)Cb{hLq*v}q5Z8{$wgd-x2YH0*9iyEcTIE~)4l5LaFpQdSZgrr#-2d2?nLb~dhMvF9BrqL>m zgVN|A`N6{0X&fqYh%mUutxXz-$w;?Bv=5iDZ5l_2v=bgFY%l!Z37Vs1JUSG1N~5!Q zmo$2cbWNk1NOwk6grRWvNN~!gmn6r8a*n2$UM8PKPjY-3Com2fw9DYcv>B9Mk;av2 z^i88*8vWB4AmQa{3{2ysGzv1FETr=AGzN(ePUDm`PEDKF%IRsGk;ag;c{LBElWNv^ z?Eljkmd5lc7O(&1Q0JeFbtV<0&oiX08d!WcQ9mNzqG`m^h=-wM(y+yyP?AU^8FE)7 zl}1{GFFr;rE1nB=Jdu1Fn{>NoF>N+clq9^7=YP}i)2O5|B8`!0T$aYnG|oA zoGLsgjjoSVkzG{(rtn|UbVA9c?QZO4g>PviVFCZsVjjSJGaNJ2(z{8#38Gn3M0 zW&gr7uI3#M?EKTXIE^W3JoB*CEMqm}pS<{<)$blIk;7?eTpId6J&hS5XXvxLTW{4f zf4`#Vd}gI_=XS%dqUUMcm&Ot$b9Nf@(wHxPO&ZsVP;HLLT;X*>=FEaLt{1<7Bx`)* z|HRoySyDHuSQn;olgQ1&TZFd?Zxh}wWP#qHinoZdlH@Mo-NMDfdxZB2U(By`(^!_qBWXOE#$#!`pgh^m!G9Xd(|A(x ze?s}ZsfP7b8Y|LR#bdPm6kxq)_+`Ozxv0AJTpG`(v8bt; z+~d7590R|Y#_BX)O5^1;K2cb&q_HNAkCec*X}l`ohiSZ)##&BGrtv`8t;g#V@2X@iTL_7-j$L16!O`S#{04&r*PO9b8?w!e?)a-AMgKB=$q2moHqX< zs>=ya?txJ+x9ry|uervK#g8I5Utk;a#4e3iy`%Kxv^_$G~S)7X(Vvu9=9 zJ$3MI(>yQHz6Bng{yvSJEDnzS>RCU?)sJcXl*TTW3k!}{y0Pro^9wKMDPR#weof;y z@!y4i2>%rB5$+Z8OOVQc%d3Bc{|fgB>HmHaD+6RqaMgr+ms;e^r4IZO$)I)yjWcMH zK^^jX7Q0-^nd-V3)5X=x-~f^O8T0CCpgd_PNh9IkO-%*k(1<%->8hy|nq_cc#*As3 z3tI?V3R?*e5>nyd3=R=*Ej(1%MtGR;aA8{^_4#ksBQt29!EG7bo=#{1`{(l zI)jcG6cvF^8FbE|O9owKWKYf*@^h(M2Hhn|WzZvI2HV4B?3qD{C#o_yCWGEgX$Gtw z$7gVyY}xJf$zT@ufv9RR+fT?KU(-4dq-H&ZiNS7~HPrIoadFq=V6gti`&CQh9~rs|}2Ns@BL9HL~~@iVAo%=>GE zkYr>AXNP>0$T`Aug`+bVBQjP<{qsb|WiURJoSy+V`qJux3?^l8Z3c5PxKQEF%;542 zE>dJBOLDPrig0QMmxyq5I!)x#45o|B$lx*&riB$d7%KCx6SMdRKhzAWuV6h1_WxwS zPxY%ZxLSG0d&XvGaE-FMzY2G52G?aUFN684c)F^B&gremrCQd4FqG>>ZV=v>!9tOn zgg0k!3&Yh=imq9BaeoGnvQqK#AGMJOg-bJdD1(Q?RW+ACn4XG!Pb!TKve4oM2460>K&%pVIA2RqOgFiF)F@v8n<}UhO za{EgLyJe*0XEoLK%dKBC_$}m=|1Jf}_k^1JGT1BrR|bD)@Q?Vv@{pTzcsU8{1| zl3Q659F54Dddsh*>WWnjVNGGJ0GnI2v#2A^XxGi6UKZfwkC3E(77fII<%L3={Lh*Z zLgOr&WKAd2RM<@T@nADRJy5*4utgRvMJR72Pe{1yk5O%%#i3cW$>K0&ARFl(o&D#u z9{2i=;xB-e!)>$Xuck+2(JpI#n#mX*nMJ3It(U7=M`dwz76WrQDTj^}Qa_6?vgn*e zmnyCeKe7 zI>IxuIFq?2K0J$P7O^ZMGSY4EQAUhsVQ0S5(b(9u3KSyzU(S7mW^7PDo%MtDOO*M_!pMCJ;w6VA(GzQ_V0!@6D>&SJeWlq}5RCh?nv zw+L?yZEs_%40$m0S|sD0S==RZcNUAYxF;;@C0X1XR>k`$*O`d>W&41zH7`Q1Z9SC5 z!&z*R56iN6MC9!(9?jyhEMCguW#(15cjECZo{$3LzdVa4vv?|t6_PwJd^(F~L{?_8 zD%5;7YyQJdC(lVTc7drLFNC%)X0bYy2Uf2r#30Z$vRW&ARrs3lb>SOXyqU#Y;?!pi zC%z*igIFiBo}p*)UKSg&ct4BHO8Z9P2U&c`2!}1}BME8zScJZ9%3_)BCi*0l(3U=L z&0<>?+y9d@pDL`+q{exGFJ(L=ht@fK#aBQU-(>M^7C&e4OBOq1yIaTze<$+2aAy`j z$PtL-ENbRZD~EsN zA@%o5;a}lCA-%P7Kn~S%sGc+LsTx8CN`0bH;C7B2>g3Q&R&{fzmqWuG8s%_+B=vJ> zkTYF9odjhOU}M=f$)Rb^)TJOH%t@ZlXQVwMq{hayZWUx`ZlEa7`M&`_-{Mk92D>6!Wj*#-j z+88rh#xXgJ4dt!1k$YSY>vxHX&uM`G8%+BGO9B#_t<{Yk-d~Occ zqCA+4lH^KIo#suIeu{vZ^_}-92VtpXAZYXlUH-! z!J3mZ8!GPCbVLwII=m}~yK`8qbj5fGOT8JVVYy&*Uk*#yoITX=aDNUDC5MMZ9u|(8Z2kkXOq`2}kL2)Z4v*#Vcn(kG@N5pNa#*gyeJY0)B2VVbjtK4+ zV~u(`hi7tF$$Zw%F&>%W27ur%rO)N?d=Be#cvr4o$l*niSAx@sIlLs}%Q?KR4&;@v z^w)^2&EZv%*FrgG5?E*6knv67Tdbv_?K>jtgq*&3Po8hc;eDn^XV5lE!k9DKd_Iuo zhdF!{`tY&HCgJ8BJ`tf;43v4kRawMp@M#X8*t#_hLizVObK~nTIqa0TKL{!RQRFA#F5zzB&;O~zzvl2; z4!=wOM-F>(*qbv`>wo6VY<%7`;r_**KZk#%^S6)#zx~aved7BWI&Xl~f}Q1=o*$l> z^{VE9y)I{sYI>;U;VcisJ=FG4$3s^S-8|IwP|rgn4~;z>Acw&kWqt7mLi*NFWK}gV z6PkDkKDC-k*v!L$9-4b-;i0XEBRsV9(8@z=4~Kd<$iu-N4)ILK#fMvN8fZgKutlT| z3Y!ZPC0Ep^(pu+nmv z@sRb9^Wb^NdpO6#xgH80iXKLI7^x(bJd{27;mJ_l&@7Jw^LW$4TOPjku*1XK9^Ub=&BJz3_xZjDPZ;;jd!i_=-Kk)FO_(wv+7&gbTT zkuN=b<>52&4s__@i%_5C$c5LhW&Fl7I~$j2DVF3r58r$E%fsIuc6#_hI)8fj(Zf%y zZ_TYgJnWKiw`Vq|(JMyjXU|Nwvts<>;aA!ICj4DU1*)+X@TQ189`;JOSPhx@kB5KR zSLabbk9{8Yvop`5ZXQ-oj>S#SUsDKSwLGee)DQ;KWwr9=3I&ETTFhFJevN;&*piw$fHjl$LG;9k5+lK%j3vA z4$9-;JPym_@H`I5qjes1duZNd1t(znknm|EIkSuV<=WFX3fg-vmLFI ztlPRV0v9;ZooY92%KU^Y@t9HuCd(-q(Nbj~3MhktB$XXbHMn3mxp5n)sq z6UK#hSdPg&+&pIFaakTIS#`C{@0HWynLM&A`aHZmCgd?Ok9;15JVxX(GLK>&r98@c z_<3+kB=<31SRLQAG$hn+5 z&4bvO)BbskW0k0ezC*0>DyH+LL#tgK%#nQN+XZ<{%413%Q}eixI(baa<6>5oA=Zx5 zti40bj-3yyffa)fgS#Y;X?a|l$8^S@<5k}K$EoR#*0IB@?pLSUgl<)BpS{zpJg&&& zkvtw{Dd%xj9=GRlM;=!zPZ)t~@|evCoNg{ULc!9(O8;yM%0*s~#}#3&!VeNfzgEPu?sw z-kZmLB1>4?MeY|qkjI00ES2&@k_3PBcvu|z7NfWOds>g>@pv9j=J8Y>Pe`AkELVF8 zIs}ePC|SXB&*K>>um-No<5|@!ZUY+5zZQV;4)4TR@rTB0mc$ z`6Z8E^Y|@~-zC{2{3EpeQ-t}yH~`xRZ9yrM5|ziA}F9*0o4nr zA>-ZxY8FtdfCU9yUqI~w>J)Hd0euUoTR^=6+7xhD0S6RNzkp^199S^XZXj$_Ktp*# zNl-r<7fh};DVQv6D&!PO^8#8F&^pv?S-`;|ZzX>YDpZY&=+7Y`KU6yOmT^A3fVKs6 zDWI$Lj}Ue!pq+G%41H@Kx;?6ZqovbPap#@+ zcm?DOu%+e}kSf3tPY9C*({Hc|6X|EVU^=m^tTJKlQIeCKds+$w6lLoROUzi+VY)4| zw$wALmX-hH%-IEuDqwm6GYUATfO89&D%;Toj45D30TT-tE3d{&exCTag84+{7Z8y? zpD!Vke?bA03b;s`?9cftoD0Q+|L{&O;Nk+V)OO7&lF!q?iCxDf1x%BK{L%tA-sW>z z0W%A@PV&nOm{q{F;#U+*k94&Hy;A(DLe(#XD4$)xH8Qe03LeIAj+Ezy@th}rD4!qZ z;SB}cSioxqyk5Y<0&Xf`wRBiaHy3bU0ZUjX3%Ip_+X}e7fO}-i!POlF+*!a~1uP0B zyvLrUd^ZbD65cjOPq-4wLcdoMe!{aR++V;01uQS%$pRiMV5v&*u>u}q&U30qnh%RF z6K97&e`xingo9u`F8LEe7CmjBDquyyEL=Wcz|#dh!xYuCRu!;PI?oEZzlfTP`F@;i zJtqm*>?nCboNixai<56JN%FGr72z7;TH&k0pmx1cz?%hpQNWi4yj8&41#Fh>JHiiy z>k3$3z`LqB?@RKY_y%$ANoE{2{)c}k{*mxw;U?iEO$mM?zNLVz1#D9tV9|e8z;^LZ zWy>l=KPmrQHH!Qz$#)CCF5sI2z7_vLxPvXUfbZEJRduPqQ}W=CPCpj#Q^D-TrF@s< z*QxgYEdGn|*8+Yk;P(RlC}58ye+pk>ZuhAAe(aYwvEuVr0e=_pkLu*V?3s(k=Y8ys z_Oo|}RRko-wX!z-WmPMpx{Ni7s9i*zB5D>%S~Z?A_Z-$OqFxaP6j8s3uR2@b zb+uO3v(_Z6zBy}gFROu+Sr1wL8Wqj?k;X#q>*lD8ZK0`NaLtN1P^7t#@)kw36mJzu z4l3ec@k4~Ig@+2;2oDp|?cqhV4LSeocVrRmiC9 z6N)&o2=-ds$kDfme)9Z`BKjB2_Uu!Orl%ztP{hC@PLl1(MQ~tnif~X7gC#U03N1+x z>10R|LyKk$CHZMZ43j^n3n}41j%sJh;aNot7l{a?!k934cQ{4tKHBJymoQO8Qt5Jw zNQtC{BZ|m`>CKAdgq|>8L?N^-ij;~dhZ4Vtia1lj>>63b*)onQ;=EAj9HsZ%B1TIx zMmSa&EbEL5HG`};U$LD~#6%Is{{j)(UL-P&9*RsZ;$o30LTXMGxkSh*^ywm37cpC8 zhVZf?W{O-coF%+Mc%_j3TvasxS!Ol{_q|gxsG2oLrSMA;zZNmKi0g`&SH%1xUMXTt z5etgAo=reHHwf=5Vo4D7UHlH=qELQk5qE|BZu%g8 zkMQ15&W$wphoL-L!~^0FhLWWs4;ArnC|Op-BjVfuwwRm$#UC%?i6WL4@ezOeT*S&E zo-E?2B37^hYh&#--&s#Hv8tKGXN%^|!c&l|i&#~}b45JQ)}e2r7ex3Hq47mFQhnEu zFU?plD=fZ!81C94US)7ad@SK>MZ7EWy6_DlJFz#_)x1^2+am7>DPLE_`jE4v=;3>E zvO)O1aHH@8;fKN?=uP6AL&+yaY$;-^jGqa&70nsp?ZQumqib1>p0GZb?H5ISDe_ej zJ4C(~ek1%=7<_Xv)!!BIy)tB{@CV_K!k>iH*(I{Oh@VA*{n)?BpE@PfE#Y_ZKZJh@ z_XwHly&``V@pmZsN95lk_JxxDMQ+_TJraZ@)k>%y@){-76t5LZYL~$DQjJf&5*n1y zP*w+&P(RdR0vnakxP(+0=`xy>(6od@N@!g|vyvGovI6ju*aJ(ZRx~e}_fZQWNy`#i zi6109SQv~YIL3Ihv2|z(ZAv(-WUiOzD566NhnLK6gZQ*9;fRp8E8$4-_QIxXEGitu z&`ao8LZ=e$E#bZrI+xI;WNzQRs)Vj3bSq(a36YZ7&`!_0m(Zhxo+b1u;WUMKObNY9 z7*N8%5{@n5xDrk%;lvX9$o6=7Mc){=J-kX+|CZ`oGFP|eW26u-Azea7 z+!i_|Bt+;cDdMu!M1niCv*IOTt^_ZzDxoMsR|OFc(!nqQX^XB2PC7f5nL)-BsoFDQDrT@Dr`hpTBh4KqUF8Yt{ z6iF^GVQLANlrT+oiD6Bb{L=qu&M4us(4UzitfkbPC4PnQ%2L%$*H@P?Tas&7Y9%Zz z;o1`BlrUGq>x4muFc0UIFu#NaC0wKnpXulICEOsL;HK!CO1Qa%+e)~-gj*!1&aEQM zsNHlscf4GEYauw8>M_7|fcubPzB|KRIo9g2-J|U#>DLG#$;|k%^LI(Pb^x3YT z4JE5ecrN60`(g>JOW0h(ClbC?!W$*LS;EVq&MP8oN?2RMtKzSf@Oo$)lnb-&trFgr z@O|Ms>=X1gv95&mlDsQ?PZ(6W4dQgWv4juAKNN0KP57vUk7Z;kf}){^TO|3ags)53 zTEeyxwud^OmGG%}P}ZM^@-IZb6f)dzO8B;fpJdz->U>|qcOhr1VTe0r{Go&&LwOJf z`tWlJzm(9vj1Fbfb^OXcxr|z6{Kn3|gg;97Qx%)h*i*vZ684u&4;#elFZuR&3IB)$ zx%aR5zEHx>j^0)mRuj@l%^LsVwache#(`xtFQcyH^~yM)Z0ZJ;>r2wOTve$WP_w$# zP{Ky#|7)#H%4iz;*{odEnp%|6vW&weZx!0ksb(Ei#=+&Pd(jUG<*my&G~{hW4imDk zYa7as5NRhoQph|!s*Ix*y<{03%ji_biDmSaZRaw2l+m+{E;4o%b`vsb-NX3z3MI#h z98*T`P;#sYL*YBIkNEMz6GFHB%IIIlFbX9fAUw5eGM-$|V|&C%}rg8DNjQf2& z;A46jGs<|WjF-!}tc;muGkf_=8JCwatBgBkyrPUN%UC3SRT)>8t9EY8mgF9;yl^3) zjBCr7!yxFEWA!qwD`Q?6H1i zwPn0o#;0X`R>o^(yk5q(GPbiCN3A#H zb#;R(36FPu$bPB2^}g!l#xg!Avz*)qGUQxzpL+~rVm~%QcF4%*7i|H zwsnP+)bnwG_AsI>HA(j*jwi<_yyh zxARR`cBHVqj}9VyCz}4vH#LVdFdcm}A=8OQkuE|?y87rAa$fk*(?>5KXZslC;~2&5 z`;OK~AHBto^>Lh!KFm5U+WI(E=O>E{@-bMXiT-mp zMEp#~-^Wn#(}cr(obH=ZC2!Bjj<(KV40+aoJ-?5LkBpD3kEoBBkEHbDK5RwU@vC;C zK69d}zzZu@g89RhCSD@#BjqDaxAKrakJCI}&WGot=%XaB^2~V=cGQ1BN8pO}ZH|w*GV<+1e;Bb>YFhJsEbws)D>l>X;|3o$`dFyA(II2SaH)KgBsVj$ zTw&>A(IKDPB)r2%yUy0_zImI_3H2BGxYGv}=)4UtTTsirTN$|6$2}tV3Yoq4`B)Ni zb}|q8SnA_1AAkFJ$j8GzUi0y~k7Yg{@v+>;lRh5x@tBXteLNwD?CyAH0%y#EU5lM3 ztHm5c$J>EKn!e+i+P5xcsd%_Lu z?nHuqfR&&3Zf)peHfnzCW0Q}~K0c8G-(`#&Yws5M#x9h~lx+2}&Bt~hpAxlL_O*}C zsKbagHhs&I2dyty4SaK=iqk}2`Q}y536pPpe9Kzu<2xU}`uNQU4-tRw;}@lIr;i_e z{3!mDk6mFszrC)t+sDt6bEg6CthiEl2Qg1}sJi~{;}0KyN@4E()*cbs?hR`ukD$`{ zkB@)pX9dSsu#Z9e=vqOy3akoHLEDPy|EpDSS}m)31vM&W-I>AFl$?obT0yM}9CrQ{ z)Tx+PL){AMSJ0q>dKDZ{F+ESSAr^Ol+-6w~D`-TW3Yt_a)bj}9~Nt##CBIGSaT2*k6$ibofkP2FhA1Z7U$`7mH@Q|~Z_#9C|JH`A+VS8bR z3XT#vx`Iv>bgrPIj7)g2g`kU!tnHN0lkOGtsGw&By(H)U@Cj>;69NWt>C;0&Iw~ax`LXgS?5;FB2f_k zF|uNbjH_UL1rudFU*$U?bj8wP4zQ&DA6@SObv4mO3un_onjlR@6a*Ads#28R1qBPz zRN8y`$>}*c2T%d&pdtteiXw;;LXuD{HSk z&ph+YWLjn>lL^z~mX}q4YyoU3^F;v5U7z+p zT7Ve^XyL;RK0H={nFZKafDf2}0z6)THw&<_0J94)M|NH;z}x~nQGnG2SW|#`67n8b ziOes+lOj(QU_k+%F2FMdST4yzCa(a`d-{u1A)hP2VoBUAWouo+a;)Jze3yEf%l@OV zq5v<*x$-|kTMMdufyDtEKcD2;K`*iLNP(M&Un#(=;%f_>X&sZgj&)wckM$z2312V3 z29Y;BUmn%9iS?uaZx!I}0_VqG47;TOTML|>c>I3$Sb1mX*tP<^Bm3Kh+@Z?R0$a)s zId=+ou@!UtFMLn9TewHKSNOh=YTyw)1=wGJl0KC3;XnaCV(g5x03R3NU;(};z?TK! zUgAUQ2AQhE1vpZGPn4x6)y9vC9}^xIo)CV@^b}y|r6|kgQ2srK4O#P`&6}OxfTm6{ zA9#e0-ne~LfUgVijc(!F0(@71@5NV?F!+fFl~2q0Ljisi`KbUuvmMC}2UKUo&lZ4R z`*K+Ii*$Y!o)i97fZs)E>W>1P_c)(lf3x#1zy(%dpVQ%gvc&mJo0-FPbv|g|!;d^g z&F8$`DC%?eT@>@7xHMS}N{BGVKoz634`qC)<-?UeT;xMpd6n~l);MV`QN<~&@;+4X zp&~C0EcrmW*oR6!RQBN#>DTn33ghyjhMY`KHJ|=P#Rt74d-eU@rQ()wS7*{+1%%BpsFJ;-tW~S>}KowoX1T)VSV8>!fSnKAkt7sokl)f z=X1Vj=5@VDV;`D$lBOcfe3%$@zHa6h4V77a1&GI z!`Dj2&B9Z<$F}0_gzbIk;6q0rI{DDqheu%&{w3V z@D?9>`Ow?t9Q^Y}#JLznBfR?f{?AJ9?eeu~WAJ`{-fJRL3x27L(mkoCd#A?!m$UKt;vKA5a> zJ|rX=*vuJ9#Z(oKt~HWAXY@N)%cLYJ>7>0hFy)pcKQ%ORKIDBE>%%x7_y%XB5BK}< zfP6>!Fj~a@StRXqVeLUlXkiTNp?>W6kPqX1m>@YbgkC%rgUD;5g#3x&6d$Jg@RAQN z`!LOi={{%WZIyf<_F1g+7u+J}mZOxeqJYQhZqAbJk|Lj_1~d=Y7tDeyM^l z6SCot;gApeB>B*X{URTDb>@JaAG4%*_=C8+TJG9EED2Ni ziO3P*UB!%}B8)NE-#G5W2{}LY;iL~77g7G151&iu{@jz2FXa4E$R_g{cgOLwU*+ew zK76MhfIXEvq{;BlFZGNc*bn>g3vK%FlMg@paK?wTKIbGuj>KreeN3?DVfk`P`8gkc z^TF@~e()1QD)2W+zx(iqjMI5u|68YPc|Kr02@m6~7Fb#al7x6of2DXl(eiZXN z-6pT%ev}X|=}B0cW&F6vk6M0Q=|@>V%K34rAD8)2-j51?RP^Iwzq3BWy%|)dO+EoD z`JIml$az)v;}XS1UPYv;u$r*CA2mek-{ql+B^Y@uLe&>m~O$Te#bM5$XjR=#(AkMOhK8|SUMIzO)W^`n^|2|tp4G?x)tXz51_@f-ZO(T|gl8DF+`EOYg#l^?C;)y9vT z{J2@1!~V8@v|~A1cF{21uRy?)&1 z#~?oj%j+JYn+yhbtqqZI=zqex3d8;2%yER|1)i^u#o_UQNKhE^Bkai|endTPip2bg zdlIf{ru;}V&3?@DBjbnV$K!s?_9N?uEwveb*y(qM zG}M2}k7xW?=*Pwq#sWW{X1(IJ8TKbi&$9|%wz{#%kHt)PeRQ zv0QwG@C8r4(vMZ*tA%Sk`HLbi`SG%d+he>c&iq-c+*s$wdXd+Jl)vuB2JtsM$(te@ zg`0$%l`T}>Dr;{E-xhB3;~kOh!W|r6c|8?xiq|gXGjnXWAA8uQ0_YOJUO(RV^*ofd!4r@ejHTaLNy9ArHvzgeB#IVew_B>sDgYa z9M6A&i5&Oigdd-Zf9A*6F5&oJ8c#<#uI3@m-kYC%m>HkK~Z*>=(RJtqPKlt$@ z`^EsO1n`p-*ky4R#w_|-&NF_T_2U;me)Z!V``!S`1@N1^{_x|xAHR$LyUzBfoJ9lp zOXP3iKf((_CdLRj-9Cgx0^k-(I*Z9!Tu5gLk&*$F5-BY#BfLmRomS(VX=ZsjFAg|^ z{|ZDA|7^#rlDsN=`g||IxcEe?DoHhA^#E!FaH*%$B7n=pFAtz*09OQ1D}V-)Tq(R( zc$JW8s2xBZ@vA*aU6Fdi`oe1haP!B#(}of@64JtT0bDQM*poC7X)0_MKy#6QbNB{1 zZw#Pi0IdROEoUbot+f%kNqDoct+1W2y|9C@BZH4~a^A(R0dx!C?g07+&^>@20q5t5 zw+7HNfLj9SB`1~nK;#UL-|zR9g?h@%IY^P8I#D@kj z(9;?l(pRoNlTh0AB$9fHR5+1rQD(5K#Xn34iEJ zd4%_(F~-OMxaTk$fT^sA3FE>jc$z6!({N$JWg`zbD%OIfQbQ&h@c>XNdZg_AQOfa z#*_f2vc-k)dkE74m>$3fA$%CZ!vQ=J!0SP52!cnLKFZt(V4e)l2%rx?{|sPez*#Vv z6~N<)wCSG)zqOwoz#Q7=gC^jtw((jq+NlQf11J(i(IB1-;Hdx>1n_hKd)UPV@Js*; z19&xnwE;ZKTn%82B3c~4a{;UnUm{#Cd|tRzNXyHVr6j!EgCkxDV5R4~N@R7w`KK@y zUJT%+0A5!9vj|>cJ=Y(=>BWzo*9EXXfE@ws4B$21egK;T*rL00A7mQ>ctZx?^z3g8 zV3Wt)@z~Y?woCF>0B?(I6TTy)9jdWVT;*K>yvtIS7t`RzLa*JDxH|6#urGkq0sO$y z3E)F{oeW^V$YJ3DAuW6qz{lbTJ;|X!;g`ttJrcktk{=Zw6CM|y5PmBBO!&EwCkHa% z7Xf@3z$r<-XZ;^*d?o(1@EhT`!taC(!jET(-)J`RqngHF!k+^8S>#LrX9M^pfL~by zB^jZ}P>0C?3SD zARZ5*L=Yu|@CBXaol-%R4x&pCU4tkS#6>~W3gXHj$_7y`h|7cE0EP)DA4HWPss>RZ z=r}71FBVo3Qdn8!k|6%j_a<(sRZ|+O3u}1kxipB&#NC3f8Fbpn6`n5}J8zIvp{s(Z z9YmcVt`4GQ5Ur$8H;4v7G!(BVtS`JKh-*c7zx*>`Bk|_K>x9<}8w;t^B#5Ts&4dd} z8yChnCDlUC8-ln|#C=D`B()Brog{69HwkYRGF023bG9T&dr3M7J9@sIL^=!Iw%IL+ zK0)-Aq2^XK*;?o)=}5yYJg#hza{Fo=F4cMJOq z2MDRdDexfi!NPky`Mo0CZAhIVK@9ce!-5#@dI<}J{05V1{vZND1cL}kID^%L+kt`@ z7sNwBM3^C3J&p!p1`!J)9z-ID2c?z_A{E5QAVvj|4k8moHV9imnrv{+8nynzb3x?) z41zuRUAv`VTGs11m!bVT? z9g$7K&B86ht-`m0csqz~!NPCw-PCRmVn+}=gV+_s6(Og;dY35);`<;@E7a~F4vXvw zVz0>iLF^OZ`T+HLeGtTllI#~A5Pl^5SV*0NB8P-r$37CoC*ntgIHeLf7IapPjhu39QHp|ofyBAkdH`mUL;>h^0n|A;kQEie#dUMjHCHO5I>TKP%4C< zg7{gH8X=sK<{v?v58|vB>X#sX6+h=mehcDvaSoYi%{@Q!Pf7mrbp8(FACF%MItTVr z6QRP@o+2R>^?0!mii?-5E_RtT8U{ALemhsh0r~OW+5~W zIV)NnLue7g4I#9b4sG7Zn-Xs+JMI&?wIpqXHwkYR@=n`^&`#Xl!PP;W&5B-~Lg=g; zbXND*9&*M2Bg6}YJ|QFW zhn%xPNO%Q9g|$5rLR1QQp(%_}s8yG^oCzWGIT=DqJRNe{Ag_#wCCm!#5OSU`4~Au2 zBSX%aJflK|t@8d59th#V5XOY?dH=;WbHK_v9Ny-Vicjn?l$e!d|6h zOUT)##cPMi))3wjdE1k33*jA)Z)ayx#@WrXQ<7c6cZKf>cMJCjpU}RS_Z7=Nq5B-! zAHsnUz7F9V2|p5k8N$aR2UT!~yp$i7@QCme;ZfnS5RQwS5PmBB%tfyMgm6;)3s1tR zPlq3x5#)DEvwIv+#`Ytne2h?fe?TIdQko|3kcd7!|@e zAHtt<{uP1|cAlGmt8x7!;RPZ40d^*kZ;>#HhEXhx;&QT6DiKD>Fv`g3ro5DRX`x#` zFA^^+EGKlww-v*!#Tj;x`Cy^mJN^v=X{%H-&L)7`KISvxIFu&2}Q~ zg&o4^7)B@Y&SCWMbh?Oi6?PML7c#XyMQ#!H6884I7;m32`i3!7lG}w$aKA9_@c5l! z+~sjvyE}~jVGQsjgGB}k2Zfzwa|Y*iPZ;+~c%P>^L}d9CW0=TrPd-AVAPk=;@rMx* z4+=xVu+Yt@s7lrhBgTpmcD^S~hMg@*Z1Rb)v+IWcXGw*T4m(c=zAh|T#JCSeHViwA zKg0Mdj9eJ`Fg^+6Xc!~I7$t*Cg`|cB zJM0W67KEKg`5aafjaBA`@r3w1;e1d2WEf9*oC6yMd0NhAgbTxXR%DTWwholw_kP-z2hGxFw9Op8PElH`F^}?DOQ?MRo{xhOx_&zbo>d zaCaDcJo#Rc_l0iH^MUw>!u`SnVSFU=vGAafsXZieIE*7AZel1u7RGm;&hao#h<{2H z`8A1tZZ&Y)>4Lb{)?kM`$F{gX{o_WhHKwp_^PITbMgJal=Kj3Sy9%nwe~0l;7)>H*8o>oNs0glz zpjO0rD6jz{f+7(Vm9wg_SOmo*C?S5au%xh51f?S=6Tw9hREQL=yOxbO?S<8{oF^$C zajLXiS1U^B-g~78Do32j@+A?cAv5+Wa&iMtwFs(5P$Pm%BdDpk=zCejSu|$Y%Vor^ z!2do&uaw#~!mA>vEmB8#wXm*`39A=DeI`;3({0+<%Bw*H4MiANBa!POxL%~OaH8gq z%{-ls5i}QXA-o}i8zWBd)G~sbMaWx;w2q)n#CaawBqxsuqgPu`r(Fc?J>DVW9LPXl zrlAvWQ0y_wY!tSDks(pUDk zMG#>-<&-mmz7gCW!5tCjUtKJYXZhw=EZGR2h#(L_FoH)Scr=1g1mOrqMKGG_WF3eg zAHhi8k?#7cHbzn;7D1dA8W@QP_zHEX{&bd#I4_mBM3asn6LA)icv%r-J#LHS7)uFf zC5QRRdd1avlKUfgAc8RwjEy)u%^r+^FHIG7EQ(;U$a9{Y8$q9sU}*%)6n43A1b0~RMMDHHM6fb~RT1=wqHh$dBUr;a#wFqi zUX0+S2)>WtbObL)@Cutx1iK@6HG;L$*%86I2-ZiiIf5+_ye8p>2;LBRJ>tyGY3fbI z=x#CED6dUIch?OSw#xZ-1aFDByUVtTza!i(boU7D6yGJ|?~2pHcSVdn5$uiNXavV1 zc;AyBieO&^AISNk@Z$*fiyZKDK8iRyxM+meK?&Ui92P$!{Dk=+o#PRlkmMWTr@}8I z&d1lEMewE3;D>)mBhTpq<$Uf7yZ)bjWhA}o|EJwk)LYDZBgimN58E4(I(dLs3O)N$9Y zuZ^OCBrGF$+uLra4W`bUK(zfFTFNIaYqz)MsZgZ{i58(ib+x29Yy~r3Zn2uF+iI4vN)m` zC_ad(;{N|A?(wYA&f22J5YOh&XyG^Dln;wyxa1>TRJQn|2t@Hf6c0ubj3N|8GKy3b z;V2?fiwmPsxXpof%qU_Ky8S~!oRQKit!|LSmM|l6t6?l<*1RJR#FCU*t(4Hz+RfMmdU!j_qFAnyb@O~>6sw|G6UB>BxcR)=3+r~;FHs)F zItgDEz7oZ&B7F76M6UPrUl(~z=(aNA8&SL&#l|Q$Me$J-AIo=h6z@c_J&G-IZWX>2 z#oHoo!nTRCq;`nx748)7isIcU-V=8Vh{@P3=bmWcX&diHu`h}bBs?JekT+7y*dKL< z+0=Jq;XNLV;!qUFrE^$#R7jm8BA-N^9-dBK$COKq^h6Y&M)6q`pGWbnr++evucG)m ziZ7zhkl;(nPqCv@*lCRnR)B9LWY+Q4cz7D0?B7Z9z3{Z~hiKu`^XDke$kZ>)z=Uy@ z{n7?!@w`nh2YGQ%>2Fc|9z`h=rA_=HGh} zMNJelogqhY(>d$qtYfWcT!;90ax+dz$SzmaKS-6zM6?J#Htbrs9+ej8%;q^4g!yklA zgmgAFo#)_=%1(K4u-(GM4JKw@=Zw1PywSu1n&`DQ(S`|&;i?#JGI6ts2_`0*Xlpv_ zT^&tyGSN=Fy|9CDs!qA2LT3|wO!Sqoi?FM(o3Oiy9wI%N7!$q3w{YjbNN;8fv%QJ& zjs8h}x{pI{H*trFj0sCRcbd4%L_ZUcX#Jm4zq`%C->Gw+)!)Pb69Y{QGBMahz(ml* zJtpooF^mOm;yx2YObj(K6-bxG(r(Ua)x;Lvj73$A5hm`eY8068(Fl8n29B?vc38?y z3cmpinFyPRF)=10CZZ-xDg4^q`9hEb{*i5so(+u4yBi4;NqMD(DdBxpo$tFBOOsz6 zW=-(l+_s6F%J=R%&X1VgEp~ZHMhZs>M+@&~Nr^lt93vbnWStqOs`Zd?ypTsyOfoUq z#9H z*(Mg7c+SKe6LU>GZQ>adPneiz;wcjgOdP$|IfZ+^ZuvB?? z+shj!-t_oJ6Pv_03%3ZjdcJR&c-!OKMBXv6-IMGP;k$-+O}wXAcAL((Kl67wJ;|uH z4sz=EzKMM%_M13h;sZuk&5?h|I;p=!aPq~Mtsj~A*u+5-hh)cnea~;uI+ip}aaygN zb)T>xXy3%wCXSgnZsKzjC#8SF#HS>z!`^#;n&rDcHU!4?g^4dsoMHm1IiFcEg%t8) z<^0CPw%4fc@uw{_{+rKrZatZ3zQ{zOI4$Ecf*w!F(8H_F%*qC z^?|-rV+t+9C>C=<@#|gIxzyoVkjF!xfnCqxG3f{c`8?A+YzA= z)<#DX!^N^wDOOmc_#rUACZiX1cyvRRnA1_$5>}0&TFiM$Ru|R~UMjpyczFypV;H4B z99oCHcs*f#;Wff*g|iwvUsdpG6vGd3 z{20e|l3y=uENmid8bh-fn#a(BHx);vIBtmH#u#SA@K_8jV`vpaDu#3ntz&4zATj4* zaZ?O8$IvZ??lH8LqVrVB$1&$&*dc0H28B0^rS&}ZEylbp*?9n5Jo-quFVW8_3 z!)-D25$_d4Z%_Z$SmEr0_WQDQVz^6Qx5sdYr{hi*`o)}4H=oFNOWt4T4xtCdFj!7s z4EKoK7sC*ddt=zF(Kzi7m1LL~<8V1g#8BV{;l1b{{c;9k2*wZ+4-4HdZX)6w7tx?8 z9uv|Tk0B95Qblldt-)y{4N{(o;ei+)jKPv-*3-8|axvsZMhZuHzN1C%7rMi_G2&BW z7#qX57#@mYd<>Igm=ePTFVv(MCVJc*YBH>wfz!P?*R&X>OXp!v^AV9pg;bsy!>ky7 zjNzvk9*<#m47+346T_Ss=Ekr#hIKJK5yQL~mc_7Kq2|Z1Acm*KpA4H7#4~z zjp135=Y-6eMKLV)xH~vs62tSJgeh^$Zbb|)NceILD@E1_R|!`O84(TgdNGEV7?F1{ z8YQp9@Tzpk?V`r|7+#BEOAK3McwO>M!VNLJA@ZhhW32EyJ2%v33EhvpD0wS}cVgHs z;oC866LG)GqwkIw-j!shaF@`Xt-L4hPT}{)@O})3V>lw=z8DU~@KFpO$VodNitHD< zANPG6!$Hs2E!IOUBTWE5iQ#ArU&ZjX6pqF4xybPtPQ(h&SfkBPCHzdt8gf$P3n6{K zjNw$wnQ^!_Dfx!&#q<4Eg^(0LB@8W;4 z8;Ri$PkvtHPd-G{X8(!d0{ied%EX-x$`BTd1921)FDhi2x_L{T;*yjQmK2tX7p~Y` z6i3;3;XI|Byx5A}mQ_BE3X;%5MG?2{RE{Gb$H+J?iK9v!RpY1@N4q%M$5B0w8gbN) z^OrqN+AfXbN|DQimkVpgafJx)x0cAiwe%`Ene40Ms2eYw1J;Y9ejH8W;3~~EaaR*N(L9b8akPx1l@#3h;|=0B3fbaXi`*n^ zBV-3l`OR^(m6Q44Hp~ujbd2N9IPQw0QyiV+=pzNDt&2_+7;c zd!b&E^cLRg`QGN0OJ7ND7v3Rci(_u|i{oxN!*TSFV?Z1}IT`yvk$d78`jI6jQy{x}|pV__W6#_?brV_4#G%#LHMLXD4O zg2=cy9`fw)aWgTFNpVbyH%Sl2@kktx#xX;}nV#ljj9R_QEJG#c@0r$C5ank7Jdm zvowz79$yy!KdYB3Bz!@*G7g^U#4P2tI*v7-{)=(EB5yuyj(AuYQoD~1elYH*gz3E=>{iVE437L$q1pfnqXVrGdde57w{id~|ktk@J3P)g?yB1WF}P zHi2>plukH*uquNviO5n-_8YIv#fvXaz zoj|<=>L*Z#gZ~8TDmZVAw?Hgjzwj;FHImcXwIW>C;$Jh|b2%C%&^Uo630#-J_3~xH zR($Jxp4K#hW(hP;phdzt0-ZMLb+(AJe8is!xVs`-CeSK@z6so(Kx+l>oIsZZ+KAsI zWV|;g(AMMaMA{2G2syHr|NdHTO}*4%F)09SPi-K$wG&1n!cY+?PN<@waS2RLU`hhjd6ZKE6GX_zi%fpem?$#IbJA;S0@D)C%aK_L zOy}<=xnx?zcqD;`rBip8Gf#Omff)&G=K4(wU`n3uqO)@^>e%lgb^%mkiFU_k;;C!7;gv%8FEn2jZzGa`1MG#09Jpv`9$ z#UkP21fKI^Tq43_0eH(x6IhnOa%J@jHmDK?YYy$akig0WRwbNq9S_6gnv6MH~C9s|KU#rdQnL>IcutCb3h$3$Y-xO{XGCfT5 zmIU6GlYFblTf*X&u}$P1VJXW|W`^ugL_1mSOE~k^cN5_2NN#mt$?i@#+p$a0sl!gJViFf8Q7MVaNoT(|pF8d|;)CPHB}r6CBG=5ReiilqR+8#T)JWnE zS-3Qb%aZ7mMBk)yW?Ez5@+5p(YO9&V6-m@e;>skhN}_WTU6QDsM4cpBBymF$S0_<7 ziR+TMK8bos=RZ5wByp`s{Uo@8%0(m!8zj*%iAGFG1II}@PuL@&Z{sAIB+*PknhJSZ zCcU`CN^CBP>%1|EmPxctqFoZLByW?%O(Ly@O!Lj2J}p=3sRA4`IVO_6Xhf0=gjv#U=hkx9ZzA}cl4 zD6YOT4R@b(G|x?NFqZ^J9VB@cL{)?5B#f5wB-R=B|4BTM#DkLXr}h&?#w0OTWSo#; zA4+1p_ynQ5ONaW+x%ppqrX(>{UhXk#(^%QK2Ox=uS#9|LUpXI5Vnz}}xsnWHA-Bfy zVUfh+NmNatS_-q1n3KfDBsL{6H;E^bSd_%#B<3YCKZ$2#{K+Jq5_vj_1?;Kn82t8- z$!nsMR7p4jS(wDLto9`hetF?0=D8%6B=LpX`XAvsSy(T8P58QSgU}t%yeaOUb{VQ}Y?U(h$qwapi#oUeVG{e3IKUg9VtmAaRgI6?hp6ct zlqMUnYpZ>9O$B)&`H`y@^$@k;@pK*Ly z%$%7#9A{;XLe2utiT{zrZz2QO|0kVOp)NCx^GW>4PO^=$teL@MNdHP=1P^vt?il$e zS@@L-QYezbMJea)WYH9grBEt`(kZ71il-2`*U7XJDd%-SNeTIU860(lY<;W`Wm3-I z^LhRSAm!B0aw^dBLO!x9q@3|j#S|_Usgy!x5#|r&mxxyp@?}}|6ly3LjZ?T(gh{$u zQm7?zrI4CerBK`Bbwv2Cgz~!L^-`!Wa*d~Rtw@6u8j3XXTnLD*5)N!VG~C55gc z-GtqRJ%nz;dZo}ih2JgwVd2&kZcE{P3;QheNuh5FCo=dngWFTMgU&Q=Pvg!M?n)t; zLMVlPEUy%Xr!XRg{wgoGe;6P>Foi)W3}(f+aN*t*p5*3##--Ezp6zVhmx9&FIKhWz z3PV#k#;p|G|C0joa7Uvcg}?PCjvu7^WX-So6G%DDiWh$_A5I~X!cA$-WTnHe3|Og5 z@fhzhg+vO;6s}04RvM`k(u^pD<0)hqdkV`^Se`;Q1v`buQka=SE`@vw6H}O!!pIax zr7$Liu_=sp?Wdd-?E6#B)3723lR4u-k5e*EIu9v@uADeNg$b(jjVr6&r7$Ih=_x#% z!c^%`6aK4DJC8^*L-?rdvyoEn@>wZ7p2C6@o@W1_!kiT5r7%B*xk}p;|6}b*NuK&2 z`7wf`f3Err)p*qFkm6gJ5BjsNJpshngQnDd(@-zwZ9IVT#- zC6{kY;hhvdNa4d2wx_Tog*_?kO<||>cMErUq25j5J>4DqlYcF|FP(k=vF}>mpTdC@ zK2G6a3e9p(efvl{6n>P> zPyf+$b$JB>PNG?4GrY19?D zMp!S6`XU@Cx^WFE3-#8c(+8?8Y4;woLQX{=!&VORbHN3BK72)i#ZG;_ZbUgdK&Qgq?*=3m zF6@y;&opikzg0-hUTO3ech9D{&6D>@!algXDa@kuf-pd&KV*-Y4W;GiqML(io9OK^ns)=O+W~ETm*i354B=zKnL@@gi}_i>(Vy)}SeNE{{E0N?d3=7l@Enf? zX*`|AD`~u%#xpEdDXbAbo5u5LEKOsPoQumoc>g~}V4y_JkN(s)yZ zDRFaqlXNxLCyniCl+U0-20PN&na1zz+|t;U#=B{Jo5ptv z_+A?O()b{a-E!^`?iIfOpE~wo8vD~YA~}vGx%Hl zAK?X|k#WXg5Ec>A0?if^FP=e(jPnJ3$qY(K!WAd?04NgnpG@sVl9$amt*o4ogz}0R zT%18;`BuuHat3uXsF!j6cXLSwS4qyOtB6$1pqfZ^PhKN~OFe#>$mJQ-6uH8a*UI2Z zkF)EpEnY`>wb1P)ShW~Y{S2a`V7X+aCnmpnr6@}gXU7` zEo_lN2ay|uHwvlTQlyozwXluwrVMTtX)A0eq<(u5CbFX^>6Afdk9QI2nn5>_?!q3z zoJ_bA|Mpr?B(A+~Wg_!UY*D&fqzDJ)Lo; zGtXqOkc5`?s7c)2_$x9i$ zoWaHnHf8Wi#yJ^@vAmW+b^Zk=gSFCGCtNRdd-&Hg*pP8{W>T4j{ze9G>R#MRxH*F@ z8GMkzhYGSagYE3(Gk8nRw=>wr{@+V2)5(i=c zvs?>eH{ShHI4BDT#6R-Fe$1M$SPn^YID;R#QaaX&_Y+BudYZ>FI4(T>JX8T_2VnGDWm@M{L=GAP%{nA6GmT=bU=#&Dg7uSK}{pTX}L z{K4LpYdbvlS%f;(c>Y@klnj*oZ}N;YPrr~sX$xg67#3hTp^8{2W}&!+qH;1x{rHHn zP|`vv3v;sow@|@CMGG%4F3-Yc78-FN!I|0xgUPOG;RG>bha?u!UzjpEOfPSw}t)|x>@LM;T8+M z6tIVdcRL$BEvE!&mUbp^n$X$k&GjD(w^`urP}s);<^8#6!!4l7liP)NSh&-|T`H`8 zDpO_`Gk?K_3nT+9476~Mg?lYL*~uu`*%)MDu!XbCSQUL+E|XdqVqqw2gWHeq%bZ&`R-ZEBl^y%sKXG}yVlV`0069lT}bw-Q7MbcSzOiI;39C*tkdF(30awoXF)8HMae8mWl>tra>6pg zi?S%2#ee?{RX&RfSyYrS!(J@H%{Jsj8owlqDp}`+R6X5qRmH_Vp<31{qw3khF8#7B zF3+NA7R|D#DIJDw!kfCqxI)faSzO6vXHnbpZJ0%!EUwO?t|Zq8>j~=%xp|33uFaxB z*4fBJ&dVi@vbat6JzAEFxJ% zv$!>j+oW(u7Jahlo5k&(K8M!bsypxBc}OEe-I>K*SsW;7^vfdb>D-+~|11W`IWP;K z$ROch;XT58h4%@E2!{%X35N?u2pLg9w(u-*za#-q9?T*n?w)i_O+Gq_riAe#$@qI7O!S8 zHj8mt%w=sd{@R%Yg8v7C!7tugaFHrp!3 zd@m(WX7N-O3$l2ctyquj^M;-f4+&f={s-p*oI7Vl=UEsJ-u*pbD~th1AiFNU^foxwSum2NEL z{5X!2#P_^d4rH;LMQm-(m2FjG5eHiS!a&(TNa-yW4~d`QtT(Q_(DdQ;4ei^3BMA4 zE#z(-_88x0@ttbU_rlY{AA~;&e-cvj=Pb^MpB4V%$$u3&mvw%COSRvbPX7EWi}P9h z$y$`fWi~Fi@i#mFtaBVqNgEfG0N5yE!?2y+-hKC1)OIG7McC&{Sj@%_!`TB#NeSC& z%e+e2C~c#Rjf-qtVxx+UvNp=uxY$M|8|7`h+!YmURJ5In%@IOVjV&4P{amphV^p@W z>PKUHX@jFmo6G(-s@bS+qlS%oC7pewyR^1{sqH)*59olDg&H!|v~h)vIySDh3wJWq zvT>!2tL(x>WHb&dHpEsph1}h|myqyQ6xwnh+lj5;9Cfm-LR9*QZ zfYpZM0pWPz1mQ#*lSFu8ITcvPrr4Nj<9QY3G#k^!9~M6Hue_V_n2niq+E{91mhCL& zKVdru5EAS|piyp7YNr8=5ZS3QwN*il!th2G5U4*Rd zE06UyUK4-a#uhK$4I*y{-xO{XZW3-*ufm(!s^WOd#@jZw+0N|s12v*|*yJ_C-Jm?* zX*;J8QlHl@);imH0=_3C*)6h1xYx$}o}AtFhc@=xIAG%=b{FNHE$;mD3rn2+-p6d< zB@7NJE2te4<2_&N)5gQ5(nPJkD;Uy8#JL*!Yw}whI*>yWev*PTKf_ zHP*%{8)s~sweb}ji|za-j0)e__?A5n_f8ZszLP-;Pm6rdo`lbfe#Q^%PuMdEe-i#I zr0@`oU&L=2Y@FADQNPN0oTosrCGwOQHeTDA=bmRNaM31*KW+TQ{+}I79sI*8S70ow zX|ObzV;5{}O&LcT8PsH_#M>;Q`zo44F_Gdz%1h)>(&MFa;CPb4GMD&{=@O=9O{bK6V?}AYmPa%d|_Q(;SCvmBb|&?1K$a=1|v#?H3m1tTa8nL9|37rvN!~t(4motp zp;Hc>{~wyJ@$NbFkiwn9o;lp|AN^h)@14V~;9ElEcs(Y)OXYFg%Au&Z%r8gdt%; z4n7e-(~v`u&Kkxq*BWQ~7+=>j%5^t}G%&(BL~@AcVCE3ZAuj#@Riovkyiz%&MKU>9 zIb{EDHgif0Fq@v*L?{i-pg5z8q=0yFh7eDchs0Ef=m3zL3L8kySaY&*8Nk zR?A8KH95Q}{*v%z;VYi+t2wL{Unk_?kU?G-|98cnW9&C`*qFm6FI23R)A#Z*v{{lZ z!mXa~TRFV#@oggS2)7G&2zLs13HOvXcC#I68R4rO_T;cPhxg_6K@J~^?8`Z0PCowj z=Wrm0k8{rIE|bd5!yo0GS0_>R{FEHb;ZV*QbsSbeN{;X;AbwPMOn6*)LinlhGZ%UO za}Fmx{zVR7il6c%&Z1vmXRPvV4&SkV7>Twc@qG@bb9gh4jd}c#!;fmSzcCqX5&Y~c zhqF2SEIw7I#Qc)OuQ{A!wW;CkZ={ePG4Z7>e@xkapz(VSf5^i597gAHe;$A4@K+9h zdub?}$3NnHl3vKc$U9FrvJSvN{$m51QF3F=x9#!+GmPhS8 z>f}*9j~aRB#|ky`xK!kFAtjgPo%2*lc=2WQ6?xRk<4Vt$5?)t%I#=gWH;=~ht(Qmr zJR0VmQht`J?s;4*`9I|iUbNOgPWP7$jq3?^$b-N7Fo-<(-${ZW@|Phfb>T zx-pL)lC;dDmDF12(Jqhn61K_XCQtunk+#xdzz%tI%%hu}o$~0MM^`1Li;xQLeYv+x zq@=qWk$y1IQ~VZTuRMC^aqEA4Z=>1&IByrHg*)=N)8lvL(NA%?_tHO)0eK9R@4cSR zAd$g&+#}*@-j~OaJci~mEDtk}SRTXk7$JqA3>FCelK6yf)&;zK54m3a3yd@)az>Ts zOk_Ndgyi`=l6j=Wb9tmag{<^5d06sds+d2vxSMZobR(rk$tcB3od+aY#X_lSJSaXU zkFg@-@^~bVN5vl!j?ZI)Y);H$k|dM!m?knsI92H831gX_$HS74v%bv`e>{)bB994Y z3TG(+da5=n#^CkWgX;Q-ecB%NXJeIRQS2b4T@q#2wEgSOYc7^qs?P7J_+3!vH znmk_gbY9Bi3$9p1tPr-n^_Q<(c_`c`+VIKSQ zIFQFjO#f|0TyEhx0g+$0zIz`KMjUIa)rN$FV$) z=W!yBPxJVh`Ok-lM)IHK@p&F6*@`*B&*NK`R2$=qJicU~z|(|;UkSe!j=9s|myF-# z@x6@vn8#`5(hu@=J1f43XV{-4XRh-1qi6Cso5wGC{F=vk#dR+4tOx$iYM}A_Z>$^l zI3Gp+!A_6!{dP{L_h%k^8W?{u=k>k7Fc|H;yfQ|j!ALY535-OMk@^Hcc#*J}u=q%n z5Gg4vB`hsuZkHM9ymKTeI}+ta{(p2`3HT1x+n(FLgzQVAkdQ4YqRo;eD*H|%6(KFe zJMS{@I`ghSsYpV|PN9@UQKDTbk`k#D6>Zwfch5bhuj~JP|LdCTzV7p!=j`V^bLPyM zGpHCqr2y&$P(OgP1E?H8%>ZfzP$ht>0r#Y!8UgTz#oooKQMCZ72i%^o60zniRnK0bCG3;{X~co`wN5QYgmB zizgZt>uKCr%RPPQ!T_2C&{UD|l^>(}p_`F5jIw=<<^gbiJ6~`ATLj#@A&b*8fN_S= zO3u~+TTa=ZOJK3Scs;D}X7ia}#Y$+!esx0h|cnq%`jd zV5tbBx;KESKA#rAeF01lU`7Ce0E*ZR0x+3$0FHD*!l*Fphl&JX`J6MHn0P#Zgh(=g zQ~6Z= z0@yC{@7%r|z>WZ331DXcZ}`5u0(dom*W`>@MjILs@jzW;10>KL}vI$cF(O2;d{}|0v5R5`Hc`Bs@$MITFBU zBL6PS7Xcg%;L8BM;ymB?Jr=<60KS&}iApBUHc`#@t!$!-iK=q`-||*B&$L=iDby0y_QTdOagK?)CeAfc z&qOoH>kAtS&+|3UH_^c7EMp__3rsW?xzI!t6HUecql_0x*j(7cL`#uYCR&U9yL9B2 zNEkQK*7vyEHUx8iG?N}GqK3T z;{P7oQWMKeEdM{TF=qCYm6ESAvD(BM6KhRuF!7X$CrmtPVx5Wg|2^iXO>8vr%zugb zITM>ryl&zR6VIF2V&WBPZZ+|OiESpfn|M(Y@8nF*i}>z|vk@-Ba~klHyk0i3!;hcy zik;%SO!uAmtG@g-^US+|H%+`{;(&>dOuTJkw~2R5yel<#b;92}x`$P#rP}xW7~U7z zYhs@-`9Ng9i4R4*T?8MSIB4P%6Ne<^69LT&r!;&)eAvXQQttBFr}AR{S)9*Jd|~2( zFdBz()Wnx2YJ^ZTgs)5-h(A%4=tcP73!@q>xd zL6iyNN6G(SJ(&1O{FLx#A;bP+;#Z&lX5x3BbAI@jcnKxOprMvRn}5gE&i)szLYUmI~sGt)fUJs)=!N~f|=zeW%> z-M6mogScFz(=el~UKYoA>`xF^2GJ#mu0eOR_f<-i&&XE?-LrkJ3A#^k zor35rGHr_c$Vmxver@o~zV2=c!bhI&LG%cs77u@*au6mrMNBdHKfb-ojO&BAA&4D8 zyb{EXLG%e?RS>I#=o>`8AXX{{{_D*cX7m?l`~!j*7{s6;1_v=Dh(ZuWK@1IISkQe3 z8W0W-;?5wZ1Ti9rkwJ`-kiNGEag+GyAZ`v~j4!`MWNh%vU&F@9d8_a?Av+a=j~AaH zyhBLg#2_a5e6k1!+Fib6y2#zadxZB2rwXS9ai0i-Fsd2<;${#*IYU7tM5quBA|h`2 zl4uYypT|YKsFLETAZ*{)5lIJ;5y=X3zHeTH#he+${o+f5m=(kW;`4`KF9t&cT&ld-=MEr4~SA=E0?{bk9ev0e^JT-#2 zCWx1UcsYo*e&2Y4IpGmNa;_7u7j6jRDPQO5AT|c^Oc2ldk{3ia37->g7CtZB62w*! zu5U0=UN6eIEr{(Rl<3+;r@1w`h2$K zBj=kzyc=}a!{1Uo%=z0QyM^!gRl%Xk^_lmB*eiL35cnp7k?dng#Ri3p=QoA=J%~U2c>Wam zD~P{+$!QToNh5UTETiIbmJpT{mI`4kHx7xH5tbE}6P6dACG>1N&11!oyWCVMglqY^ zy|A*dN(fa&s)gLuGhWq0xV@CSPE{*}+6)!Kwh-!sa83xVLTDXA-4M&jDR0iel@rE%aR_Zf=o>=65H1P1FOn_`p8_T>6(M)8_~jvV2%%#Lb9WkazWAb$8-YT&N=0DgSBG#-2%SRc>`Sf_ z=@LR$k!ywBgxy2v5kgP#Z&V`2z+Yq%dr85Qc{^Le7!G+d~*7a+7d$2sei?Mtq!btdObS5`wqu z?^a)OTL|8VsPr8#;e-(G5SbXlq!1?ino~sXWK}EYcgg7$mSOJ+;ocCYhA=IJ`$AYM z-{~RD2;spH9tt54f*FDxf)hf}k24xVNIdLIA|Y5lr@@Jd$At-D()Ue?aAh^^ONvA? z!fXgRk-V@Vc2nzRw@PULsgs?w^4?{R0C-cT%>`{T| z;C-YNnbya$X$OU$2oDJl3qK9vh{$I`TEEXj_<|-v&M!mw)|Y=Ja!hzUgs(&RCWKzA z4IXoMWU+A-{{kkjlfv(W-+Pjaj0WwEA4B*lgi|5>tgQaRT54m^K67fy{lm=juOa*v z!tWe?A^gd<;12vS{tDsm5Kgnb!tTEUS*1LIu+(~Ys#&$U!RZ=FF=26Gi7-lrQ7Y_i zB`P1rSt6x{Wx^;MM!7Klywcq?^~?wtc~uCbqQa8XixE}|<7@@-Bvrzw8g{4F)xz$F zgnNdfdf2^9)Ci+y7`3Fy7g#*{mHUlrhf&85dyYumFwPC5o_PH*&i8%K6X6+04Z>&` zcGo%@g^?&{Sgnnz`tIh!Fq(w%WdvVE&@_x@VXR~&gmFV!vqm9TVe6r*GU+7K7+J(_Rj4K&cDdTeKbP)2aTK@Bz zVLQrsg%s$#iq*oW721F1fsX)TbQ0m_5IVbtacvmG!x#|;Cl8#$bql+P;B^n9M;JX- zfj5THhgBU$uP}Ot-Tu#~j~l|+)5^G>mCU_`dPQQlFv*!!ZgnGaO6D1*kzx1P^HIvJ_q2O+7-Pb?HH_QB7#qed3OG)c<0V16 z${0B1yFHBYVN3|)4(afyNj?O5!;tq}Dom7oQW%rNxHF6?axN3z6~^5n_Xvx^xL1TR zPYq*Q825!SJ&YL=CWL`7!oH3v5)_7no^g(ZVfi}IFk(KBi!lF5RtPI!&YaNkbM+)X@nIMT!dM%|6Jfj*#>-(m8OFLW zo|oo&q1XCMaYGnSafpSnF^p%zcs7hpVZ0u4S8sSxZLl)@oI)+4{STk{u69e~3BAK)(CK;33J3 zoEKC4D2$K8C=o%)h-(23hEXhn;t_npv}ziM!Z^%OVI0u_JRQboVRue@ER5r{Z()3) z{2Y}@{8GFe|0Pt%_)2|)1NQ4MzEQf2?OR2{RDKHMg!oC}cR~*E??rwP{-|L{;VA`Y zsGr05#pl0<@tgSX!asz63jY#P|8Egi1tT#cK*Y5nyeOeBCnw%XeWfBO9YH-6pK{ho z8K0Mppj-syBRDI93K5(gLFI@$yRH}kH=kFE;QrcfrL`{Z3acno^@#gLN!5tEkWwvz zx!QL1cL~&ppk@TMBB(93x)IcgxHWl>u;IDxYt16Vl`z6{l?t8Y^&>b>LC%k$K?DsW zZU?wJf@>mZB>4rx#t~d7(j znzuwSPA$%yFb}s$e!K6>dkTdUBDg~mcM(;!G+9nFf;%Ia62V<^-XpwQ=*4z#1XJal zrV63(J~&wX;}I-n&(ZV3zi~wbEB!eCEoY6bj$n-+^IDN7B6!l5 ztP@!u!3JOQl!#Xw&qVNM1aC#~Yy_JkcrJp?5xgXY=Y9PbM7Bh*Rm8g)G2Is<*e1z# zp=W$v7T*!UD@{#akUq}UBpU8Pgcv$$U@JIxoiG1z}xfT?`QJ*uRV-XyW zV6BBGEPNfoH#AKanppTYf)f$^5y77koQ&YR2!2v1-ln}ps_!|Pxc(#Ij~tJ>!7(SN zBKTRtUs#!({0n~*(%AkUasQb``Ck$IO*?O)nB`6;Pe))_?o#ttZ@b?iCbTuExaCG$ z-*T7!xNcLzLP-myEZ5SOwouMOdGRvBvO;bkImK1CqdA5ZrmV0Mm zDJo0Cn5$Z-W`Pn$yE1J&uXQ{QoSF=HwtGLSWx>){kW{E+;T#KfEu5?1^@NnudK|yf z;L<%O%;!mXzOaF?p@l{w7YM1}*gDfsnp$XPVX%cE7A~^T+(HWrEiLerGq0Z6Mywyc zDr%*AXl=PqMi*OXW8o4DZ7p=R(8a=~7A~`JrG=|3wDVKxAkyB#5x*koCCNWy>UueEu-wHc z7QC;oKR~3Pu)hUv<)!aHIR^>3GQ$iEwJ=Q1H7Y)5Cd1h)ER2+Jv2c`yn=FjBaI=L6 z)QiSg7;7P;w!X!}I14i@1T5TY;Wi6*TA0GzS{QHP4hs`4@RQgHjB2?tdZodqm6QDV z*Ft`oG1)@l&-@@G%rdpV0;U3006!%)-A{(bqJ9w970D7}^Van;D<$Tq`YZi8hzrrT4uuGgd^p+F7XP?(4X|m%lV<@+R_8!ANiUeiyXA@i7z=M za#)6o**oIPKl8247rx{uhfFEsOAB8~a!hz!__gpG;kUvQLPqF)X7!zg?|sP+7Jl?O zt>w=aeqo(k_{+kt7JjqvyM;ew&1jkVT>$MZtr??Yzhwsgws6`)%_wR`-A5S8ji_th zIb;w;FOh%`;{LF!>%~&E;Kccx{n5Y-OLO$jiPxJEu!GF zWV0wPin@~}YO;Qa40v>b$_&kBm zQFMvoqZmGpp(|sflO%?2QFM>u0KKB<5k=1^?vG+t6xT)3D~f(m^pB!9t0;=TOoB^5 zUNbdww}Rg&&SRANM6rv{N?i>8SCseJ0Z|N;@=W2NDDGwr6mx?Qj$%j@L!%fL#qcP` zMR98sBcd1?#m!NSQG}zSxG9R!Q5f~yo^wNIV@+T8zqE5Y8)GTtvVYY5g63JcJjpw6 zJ>#}0ZjWM86qDsOK8guZ+#%)k4ucByb-L6?jGQ766Pje z#(AK#agVZnZxmCbm=?u-QN*K2L@_;z8Bv6zh(r;H!i*vqMJVb%Z1V5J%p`L)p|7#J zhrzwaoElkCM3rJp3AHbVQ>~0YxVLkM`*E(D`6!$y(ov+Mu%r09x9iI+d6_t&*j^d#xW=F9wipNx|bA+_U4~xtd zvU(p8nJ0WyIA6FxNc~x@-BG+q-FvZ+{d|eY(3 zMUid7?NPks%U_OShtIvknfaE1*RCjD<$&elkMMQj8^Sk*Z$U!yq8CWzt) zhj7&Wpxb+OSVyzj&pAfQ8egcRa-u>jaWslAqxdR{V`?}y*@-BQ`~2%Dz7hXcNJB)0 zlN>B^elPqfiXTMi^`i(||CGqjzLQ?RMe#c=PYmb8+!cU7Waqv6=ATjg#cmwMX?FV< zs>j^%ix`TDoGmOKL&cbDa_Lnb6$8eTN1tD9XzLgYD zrRJ_tt*o$BVyGHJHF57I?j5|tv}(jqQ}SBE+CtVUFV-ZFkM<@}^P?pFqGi6Ik1 zHimIA+$za!G51|?IELHh93R7k817JUro?bp3=?CR6vHh|U4uE9Ix!sWW_;hn{ZfO! zt+_jfdsurh_eOAU3{zv69>WZVDu!t>?9{KT?~Az;a!#4p0Rn8(W(L1EVetF-AfSZ! zE`!cc4E!*J@kAtK5G#hL!p4O07!olg)y9|Es0C#Qe)EZ;mYJ*?g&x+xJ7~YOycMK24@K6ko#jq&mp2jvi<{k>MfTLBx z7xEDxhPmnw-_iby%!}bsDo@3HUp~HzYa$jZ2*(IpfmOk4aSTgT!;i5Z%=r+msx2w)-jW zh~bqOUW?&%wyb=2#qg>~vFi=yhqq~BgTBTaF}x}HTf${M&)lGI@9UCxR5T8U10wIn zut(&*7~YRzZ_NFx#UULuL9$QI4`SFaLdl0Q+}70~VZY_MGzV$?If@ggn82YJ4znl6 zF+Pq@V>rU8S{&EL@mUO?^EMGjy*R#L2c{8@qi!5uGJ7!Ee(KieSE{#TF&vNK>lnU? zp++1vM-3kI&4*0X^*3ilera=^VqApSb%^C4N>+ zP6>}`;?8zjc(+f+ab6tF;}e-TPM~wgNYQ#?eQqG>&6x zU*p0!n#A4i-82qngI|si*;V*JO5@NxjuvcCK5oR(Dvs8SP*GhTM;j4Fd#T7J!nQ*1 zso}CX+R52oNKMK+hI*w~ZIte=qy9gOWm1ah_IJ(EtD~{fA^oXNp z9M>s_%p|*|w@-tcpgQxjuQ+aq`yy_cw4dakF*3kaP(Las> z;sb?)g@c5P_yMV2EDlvF!-T`*7!k+FI7Y=W)=&MWIBpgnEo8f}yko?@qZOFLTjCh! z>(gM4Y3LsPO*tEDLL7I*u{@3yaZHS3QXG%OF)xnEaoicl!*R@wV@e!%#c{V{DAKE< zW!k@YPaOBMHT{^)IHrl;=S!xG%n$~IdwDH5L<$NeI+gbxTG6f(|-L}te^$Cq$>GoK>) zYX;UT4-tJdj`?vcies@9xJh>%};>#j!n(m*RLijvwOqF^(N^yb{Mzn$0+N#<44o z_v6?b$E$I?rck@%cwN^Uax#8K^``h+!ncLqe_P%We^*GgJtFV<3j5;tAdb&zuH)D* z;m2_tjN?OJ|3Dlc`N|CbiTJ0!?;(-Hv=916%n><16MCsL2#I%n700nSzM-j?!tpr1 z7Wuc%i8xMD7{~X1B>y*_pW-+bNAUzoB=B<_zr^t;?P?sq#_?Mmzq5@vVD%}ehn!V< z7oC5{aXJnpP%Pn|WyhqAgsV(4mxe+TFFz#{D3x&As9XZ26DX5FSvkG@{8K0@luzI+ z-^=r@l)%{ubV#6M0+kb}l0bt58YWORfochylR(`BswYq*ftm@_O1MwZD@qyOhfW+3 zwG*hr(%os$fHPM|W!2A3pk4y!C2)SiHPQ7GXV%is)@+|sAPRYL6f{cU0_n74%p#Px z61gyeCL&FJd9wsA5^pYSA#5r1_Odc;>jW;Aq>bLN+k1g;h7ChRVx zZ;u3eCU9NCeN97WFJIm}f$PO@5Z);4BkU`raz8aU$rp8vffDk?>mZTA2@FYKXu^Gh z;Pre0!x9)y{RBoPFf)Ps6Bw1iO)OmkkpxC3aB~6^61XFQF@F5FB{0_Kw}^~O;8tJ4 z$@%T#<9!K>Fj4&O1nv=;l)z->L3~OAcZqm+rSBTM<-J!DQ#e&PO?aPhx{zu!5(tQU z_oJXM4~ft|TOxJ>j!0A(OCX*=B7vlwDWSIvJ4APfv?O_9Mwk`mgiM!)wBYk15eA=? zzyk?9mcXI}9!%gN$sbK%b^>$6c>=@3eyB%8=KAt^zMMLIYM!6K0$;L_qfGbf#gaTN zTq1nj*I6pEEP>?-tVm#G0;?ohpTOz_)`&luz*>`{8`~9;d8>xLNB&0>Q`HZFC_3{0^8W(6L>9w*Cl)@ft?~R3wI>&O2YjHpIy;I zl3fYBD&OYST=^T~B=02fW&&@?`E~-keYvMbd{>e^zMK&=IdQktbu&U!d6iSv_~lEhs} zG)SUh5{;9%P{A7|ae)Xm|1rhnO_FFTIn569+$@QUl4vf;SYZo4RLdk*7ngiqM{PPohT>Hzv_1iJlVn7GCFT_7Y*`T<=S65Mh7rD>6XX&-d*w!b%?K zO9qMX?m5(#j7nmd_;BF}Up`W#Sdnp)$Y|lszV8?je%NwL663^gP2vvU_qHT%7auR2 z;LE)!^h7x)B{5m#PNCNm?oQ&KBo-&JB#C<^UnHC=WXn!V;=UxNCow~kh%g{DeVt$u zA@Q&;;r3d~=g}l$K947nNFtd;DhXS{N0V@pNQ=)FW|FvHB%4GoiM%*-QV?N@ihRjT z5f)^Y$OFFoL6L`i-#H==`@VBU9!X-JFQMg`@ACyoEEIoC$VU|>&09Hp`{PM0P2!0p zo=mzYrBl94I?IJCgcPn6StVR8Tq9g7PGig4$5!zZNt{gLg(O~-b6XNGCGm0++vQ{`9GE+N{z}sQ;Fl9TKGg3_ zVpq~#cX~C6*OGWWi8qoskizshWDyhppCQ+%1?z9jZ1@nI4lB;8kptVv?U<9yj<99!ki;yzB|AhVRjkt9Az z;!x7vrgE5OXPW!4yt|ugjrki0e$M<^5}(t;CviN9FOu%Onm=>-GKr%}_YEV>Ad~xw z-B|XPpAUbX#5b&vh6XpEe4BJ1&ui%XVM?gU>pN9NSsULc@k0_nCh-&de+pAmIF-cD zv{5P7djFEduSt|np-c+D(F`hV$rOH1;t$qg5`WRur%)_~zZKzW)}#WmbiBN@JW@P` z67ph4;#GdcnY%+N33<~mn?ku1&P}0S3guHcD~0MQ)JUO13KdhRBDG4wvs0-2uc*A= zc{9$c5>^v3>9)2}Glg1mo+GTCa_7%=#B-(2E6wXWGf)pC3aK7XeHcFv^ z&l{%B+%Krl>%tV8q;OFR%~NRV>ogNtqSF;THDZetTBh6&aL5@av2_X;r_d&aOHvq| z!jKf&QXz%wQs|Y!Wht~vp<4>wQ)r*U<%;tvVFy1CY>tj8T#>?+DZH(7u&ePsg4*cn z6t3~}(@CUr3SC6H3a=G%2=Kn(WvNFBJ^h$HN$(V{PoZB5{ZqI>`hA5r3R#LiBFE+! z+#JFOd^Yp|KZb$w8YB$yp@83ir7$doQ7PP%!f-!^ktvMuITQ7|%IFksPT^L`$D}Ye zg>mAysQH*K)w~>%f7lqerEq%+Ug_*rF1~Q&?4G#8Tia z&Kp4q@ni}qKNRneX`jzZA(KKjgT-ovTtL+wbX~sd zPhnFEAE$6Ih38V(oWkxD-bvy46t<+WBZXHKd}|6Xrm!uA7v%J+f^lw7xwBRhUN5Ea zvY!?ecBZf^h1XJeowekz&b{gff5X>&)0e#ESI*lsciI8_ZVG$kyFZ2ZME0hzFNOF0 zuuSEHe{tSoc+>eXg#&7%kK{$21xo#s6b_~EOA5cHaF|{x98ckE=^RPnvlKq}^;woL zQaGkaj;8RXDyB`sIFZ6h_BuJ46R#DR`uCEsA$~~V8{Hj# zlH`=|XQ9^_exun>p`?vcHvUNAPkEj8tK~1=0wiIaUi%t0V4ty;%yTgt#ch#Y@>>e#x^drQPoB@ z8|T`nXQR4}8a8U%sG}Ha+NdQmZ`PU7=cRj&gmr~pq8`?_alVZPHqMh5v*dN5hBg}6 zxIp=*kdb)tFjNy8O>MNa(Mmy@*=X*Ey~vNhg$QfDdTFDzcpJZRE>@g>HgoHNv0ZB8 zG8^4(^sv#+Mtd7qN&j*i9Yn6Q(NTo@SJuua%<3>M4CdA~v@>67NedXn4V1SK5 zHU`@m=<9p6I^y(Nykp}g8>4OHY~*d+Y-5a#ppB4?u{Lh8 zF~PJ?)0WuV?rVCr;UV*2+i>KS zvEfY^(sFtVSw9pt3pR>uEVS{MjhT`^WMj6C`)$m!@qi=`{!8C$>p3j7jrqQOt}5YC z8;?jb&zJKpm8Z{i7f8qy7ui_M-eqGo^Je358_RtCrS_TgL;fkqavLjr-<2YZOBriK zp77;sMc6tF^`!VZ8|y_j2%oa?w2h56p0V+wjcsfZ$(gs!Ha6LKj&^{r;Cq6LpA_e%GRZG3IxCmW}1 zd}HHVDgR*OgpHHp-wT=UcOrapA@?HrQIbui-0b~q;};vh)70DeRr25bfE;2}2vsxw zl!V+1&UjASFdQ^-(9{7O6mxL4gUXI;*@`1Lz6gl9RZAW~6S$rILc6{>Y#=s)r8fBUY4jpQd5#z4r+_kad3`y+FLN@IoP<%bGd3$U$od7faGy*izWS`QO%T z<+%4jM$*Q?B@Ws-XfK_%!pj_7D#FP;YunSj+(8EiSNM^zTpd{o`SLhcue?_~xW>V1 z2WuR3a?sgvKQUP3po`;vI(MCeUJklCxYj{82i+a?aM07i#$+w}T%5tLH1Mcm;M#IZ#d*wuEyB5h;~?!I;~?uG z=imVc4?4&@C^)#Eol0lV7O^(OPgFPFHPF~_cO1=f+^t6~wEN{D2eTbK;$WVGIqWS` zo+~WWFjxt}8g8NH*DxM+FyFxf2MZkpu6DD{i+iG2isMa+NHW>+@C>k)rc?P);f5?!6yz5Ie5~+ItM!)>~gT) z!3Op{2hTWoN;SYbdD?OB#U#9VoG+1m=~)Mx9QR~tcJk+_KiXXw+3etX2U{F$b=-~F zytX@d!Q;Yh!db%&&-W!cUl#5Vz9O7H)p*sxYYz4~_`t#I4&HF^wu9a5eihwKR&R0? zXczZev@`smsgkj?obir>J#49x?mobGoikqmy{8IcZM-kC*8va8rgOi84>f!aazr#V z4yY_25!Ij{%ZsLfrSs;%hbeJz+`-oljyU+t!BH;tJNTTHqgT>jC@+H;u^@|uSyV}*Y8q41n3hJhG^(dDB8`!0 z)JVH)Zf(=JG>w{R)Jmgv8g6F#hVE)^5xCbXd&Lxm$XWwwfMzCc0vYEk8n5A z&#Yh^9d2BfM!Ph6rO}%ON#pV~I;7E2h2jz4`zpE}?}{|8R9$h5T*YkbBONwwA+)*4L9z3!njtvo3OjEhj0;(8!Bd;T54REcKdvhoKiw}XU((-{rY%Z>-)b&^_{EkbBea7~z@H+)2XX-$fFN^wFMAFC=Gwihckq9?H z!!#aDV|^MM(s(G1*=a0E<8f)uVTsb1pT@&-GBa~U9!X=KFFAOYu^^3wOtH8-9C$sJ z#()xM_#&w-7V`I$JcWB{8Y|OSCCM`3a^VW$eZ`H{Y0N2ZJdwteX{=!nJbiktyf*rA zG9IR~PQq%%ji=IhI*pe&Fg>+2HmC7?8qdi2tZ{mdqfcwOm^ar#*XBnKRY@wD+dGe##b*4t$n_lvN03fNwFxzMYkD>Aq;gU%Ur$>1u(=PLeY==CG@HcVBX?NVkmp&si$;kkjMWWzZ{w-jejqpdXun^$g>N3~rRL zkB~WJ{yDn)XD}dxVG=T`ff)?RV5mwuD1*Vi+>6}n35;#HFCQT?GUMJ@sWUo*n={yx z!Fw5u$zZH}pUvQw493wOW>CoB)(mdTU`7Uk3~tY0ymamsPRL-Q2y=3W2=h5fnVFoy zof%A#&};X*d`*s*dos8;gQ>n`y2!K)?i2A01#6yT(3B*RK{A722B8eX8ALLOs;^pp z3|>RH13!a!2408pOiC&PTWYxsoD9-_t1-_Rc3{;*HskKb^z!KqqM{6DX0RfIm9+mE z%u)=GW$*wSF@yOTEXd%Y3}$CAS6*|3%=5$S+p;-KopCJn`OYbBcoq9<2CrxEMh36>p*9vb-pt@FIp59TZ8gwt-`8uD zcjRPM(8+k-&tNa@SQcfou9e%D!RHx#A)OC0*zbq^FoOf)9|=Fs;GoDS8GP#N9LnIZ z&%GQTk@GVl+vsQpUuN)A2B$LkDuZK^f1kl|k#AKS%){60_W$r=#)%A0X7HWg!N&Q$ z>j%GbepGN4=jRN5$>6UH{?6c63I7!Smcj2F?EZcH58s+K)ng!2JT0~2Sr}PB_2Atv ziitDlC9)`)MJYK;3t52-$jfV*auQY(me1m>EGlGCF^fu^?PpOni?iiL{mPtlsaO9K zgVzu=gVnRBkwwicYGqN!*RL(YMrT-Ro+D>n-}hWUHU>X0i>}ugEwVU2>pn*`$f98u zjk35PiwXR;D~rZiT$n|ZEShHB&v>70Z(Lu_VCgvPPkIOtkt-P>6!VQb;V!Zt!aJ71c0pYpnC&Uu-5JMs2HPDC#k=^*SVydsM$ec!7@ zuFm2bkxs(S!Y;zD!fS>9>_p|WWKT(Q!t1i=l|^r6DeG={;5_+;?3s0*JF~bki#}QO z&7xlxw`4Ici~d;*$YNL)!?PHe#h@&PWHFSjJjocG#qKV~>aK>xlcsoVNGF3Af4O_2 zlQANTky(t+;^r(ysiZdvuVH=aId?F>*T`Zllh!|W`AySi9%{$ExICXBi`%l8l*QyM zZqH)8bnaktcQqztvHnRT(Al_`ySx<7M7E|#2gSq4`IX$1EbhwU?kw)fBFw3K7WZZ` zHH#Tp1hSaM&cF_t#dMKz16(J+5Bj#JK{T@nN*)rf>1n**+r6l>t*2pS5oNt)VP_GO zLOhE^76+uj7^uc8nZ-uVro)kiv^uY|CPM_RRalmn7r^@~o=H%USHmx?j(|qU7EX-|^K@xruY5U> zUq9`($bQyv7N2GDVb*=XJfK`H<68jsd_D+hlpW0C6ZUF;JEpOAm^$p+YEYuL+W&d> z%!#{SD2Ah1e3`{pSsY_saeQTQT<2#Yjoec_q zppDhg$gz`W@pBe`umZFAC5vB`(C?H~H-1ybNFLKi=p-!KUs?Q}#c8%_&V5YgS~QVm z^l}afDJdpWJckm#q@+lx97^X-QJcm{}w3e_%4lPC4dl|`;)^0^z z%-rVCEr;&%VyH`~#)gyg(i|?!pfRXKDLxjKhy za-bT+^73*>XBYW4=0Tu23>=GVeJ2+l`FjFpiR13N9D3!D%ORgb?;NhrA(}%hhZ}OZ zF^5}oxGjf1s^`(lCqwlW>6b%)kpYZcWKa$x7y}P~$YDqhLvt7=`S9GCUQI9dYTm(1 zRX0ZFFiLVycvH^({?6<3H!IW_;n*B*5n;OHME1)bav$LBa*ofrtMn6cxFd&&IZVnS zDEZ_Z?#$ud9Hz=SMR<1(cZqoK_3ja8%&d@UIoy{+K$7V>%*f$HW4DSrm2;6VdWfd4 z&w&sU4+|qXSR#Yb`B^K!4#?r%oO^iw9wEtlIlS+4Yof6)hYxbt zul#(N!vPWIlT%8s3w@*k@^S9W(cCP^CpjF-;V?CGIFiGcIeeAFXKE%cKJYl2&s76o zut86s=5&`zfxK(wcoh?I z_y6ZnB9D^3ymTI=#MyRUS1*%yTfD4<<%G2S74oQ<$Ax(`$)i#pXXjBZkLr0;mO_<0 zs*<#F$0IK;3lllGYUEKfk6O~<=2E`dWIga3irSLY5uTGrU6FHz4TSZC^@Zo%k`Z}~lzf!%CgEt|%|hyo$z!a~Z^>hv z_^ra*gtz;?G1212$>GM+dG|4M6L$#EysP-nu+-{KjCoTY z&naf|%_7eWx8$+am%kwLqHvpVd)}Q(FvyNPUddxm9`EI`Gml;JeOLIZkcFl3e=U#K z^LQhVH}iNak9XwtcHZ6c#Pg^b53k*F@^OY{oCW_m>Drd}^VrKSRKT=?Yx?%(xsl%0 z|3ES9&*Q^94&?C>M_&Qm3ivpWgL!W40t)y0GD0epEufsw z%Zr>PtWY?Ut4al&T|i|CtNWT&3aIMyYK1d12gX*TfSQum@_lO;P{-#i=D9wgV(R1q|@{K#@TO4E7~ML|Es;3m8$r zgo3+FI#R;1zRsuuZu0r)0&W%`BmAdCx5zoJfLldw6W%Ule#VPXnUUY2Bqj5k6<`(+EWj?nDImm(Dj-%synsjn zRsm5Be}>{+h5^0rItMj05(OmXmGTw5nZqJkr*r|C0+tl;cmY`{EGl4e0l9*^Vvv`l zAS^0iW&!sXFiXz)1w2r|gH$VEAop$Zv9K1*#DPW!?v}SY? zJ@TnPBVACyLPbl-Vmt`V*kK2d;o z4_aTqh5|k>;0wv05%8IXyyZ*YE}VIKeMgda zeK{AY-t+nUB6|ziSHK4a?3eQ}v4G!-86OsKKoatgL_RLypvWh}Lqaaj^Q^@q1^4JG z?(*8E!!ACfNvURxs$m>0;L8I3F5q+lUrGO10mnty@xB)MS@=!CUBPB~zm@ZZ@FeTD zfbYeBDBvfNABEn0;FP%cvEDD@>_5MX{3iTe_=oV%0{#;5^qH1Xg!V+9k@KP=oFh_SSl8D%SEQcs%#R?8aK4-kirgN^tD#7vB3vNSSa_kZiI6%? zi_pyHHDEON<8L9-vIwnwNo$ddi_k{o5@B26r9$TXvLdweIZvhTP=t;}|GWSBiXz-7 z-z#|pXc4Y1!Zk&x&)+x}p;Hk$i+3+Vmm+j6!nH-{CdvO$btT|8RR8UUc`OhZkLxu&Wo{ym0+jZsip05$T6`9mEMo zyr&nvMBJ>oH`HAnJUiNW`g+mNi-C&jFC5^-V_vwMWYQJylXK@xl0jZP?nTKCp79+# zgT2_&(!$qnIy(|@w6A81@L(Q zW4##X#hX5?_Td>X#(PoIhs%9<)*O*NUQ7^wPWZfVq8F3AnC!(1Ugwr($crgnO!Z=p z7cY4+&5P+?%u#Db#&%>;q$^T(JN#Nux$h4K`+>JY{MNo znqe;@UPM)%w}mlb+>3-4NiR}ftdNps#l3jVizQxUys#xMqBoJ3g*hR6W8RB`;q$yj zZ_&PDl=)sP5ML%4f^i}$?PEoHqI8$@;pHwr)S;(Za8WRn-0#kUA~f}_aahYD`>;v-|Z z&5P~gAD@#iEq6-X<;5o=p9nJ~Z&5p%2&iaIMcdquuGl zbt2^Mb$TryY8&NxAL@wL72Y7cQFxP(sp^T`EWAZ{s}Hw{+%BZe9U?rX*7t!=^PbSV zDvf-&%ZCm=JnX~WK4&`)THfn(ZU)}tLt~Kz&76%uso&>A6FF(>Lo*+mi@Rg+ejgt2 z;Xx_xKQ%4HnX08oD<4{mv@v>HAKHmOBy2Bq*K!?w=%gTD9O&$G{Bj=k-GWt zh!5R;=;6a;A71d`QO>1&%*lt|KJ*l4@E>^k_|Vsfeo{E0xw9Onwf;T~VD~VVPx~;? zhe19(?sKMk{+{q*un$8N9O}aeqYo1q&f_RE=Um{!lRi8peWY--52Hl5ogfXyh?6il z)`xMN|D`-<^zrP;;uD0tf}k;f&nr05he^h=>=aD#VX6xVhlmde zACf*qeTexG*HLianQ}V}&Dd{K($hXzBD_nP@nO4q6mM5@?|qxO`;hY???b_d#Xh{I z#-HcId>(>qxmJX}=lYVQ<&p=@6DVUY+=^dIm^A=P4u4@-Sm>BH+jEHlS( zIghFSUT4}BK4-s268={C@P-dN+c;-)_smFK*(5 zALab`i>+GObDJ&)A@cB_oIX#CH*KP zo%Wo9N{N>?id&bm3SJ=O#o7tpZQuho3Oawe`f-VPd0_=1yxYdu_{J7nZJN#(sM>9X}^rOBXcl&XV9}WCy z=tm{rt+8B@Flx6b}i*MvwRrHM~hlPr{F+ zAGRM^Hi#c-KP*2o^2sCaUQe+AJj=KQwa{k`* z<10QX&A$dX`TMcXk9YleM^0$7)(`g)EOM5OJ^wvFHkjD;e(*HJD7Vb-`?1N7&3V!}I*zL!cETkWw z`SH1ud?7sB2u#aD?vc3Hk9{Ik26XW3_hUfMqUQSAk8gO?{LWJ3fFFlM$iMUBd+~!t zX)?)kSo{Ye7aKJD(T|_}IOWG_`TyCE6MmfZ<6lMn=f@d8JOLnp##*ux z`RmTd{sSl;aE@k)fKyF28gD5OKW^_J`!GK%P&(k8M#;+rP&R-I0=O`Mi=_dZrQF3;Hm(wlZUH?*935F0Pa%6ola@Y0@PA0IUAu)z&ZWZ74jcv)`h2IuB>hf zpk4s41+XN5n*+EdfJw5sHGta!=o>)40B)DU)y`cacLZ>!2p!fBpn-TpVI!eC)7~Ax zJ#6X#?hT-20IdSJFMuWi+#kRL0W=MuSpdydLf-0OA$jMAWp>XC4@z$#bQMPN-b-sK zJpEbkg*8sX1{SlGw0rW7+ zqXFlMcbfG!p8JUKK(J2|`>Vds1f0Ll2L$j~00RRU6u=V!JSoe^g~NCj2w;df`{Ym+ zn0+|L1%Ch|q`RG*_>_X90~iy)$N)wK@TVp{wg9X4v|`5wFfIW1SW|yi9iF3=M`XN; z^sI1#@VNk<7nvw@uc{^o@InAnq;LqN0+<@Wv;d|DFe89K0Koue1~4mtmjalpOkWIO zb^vq4ImCu&ZTv`EXW)1P@CD#k6ob6eMP$L)XC7;XPyk^?B?5>95Dg%1EZK%J@t&Fk z*-_m}B_+~BIsi+B%&@)zEDpd{Fe_wzb0YZw3L^82{<6p`0n8U!AY5o-7m08;Joi5o z`r)0}r2#ApIBSDVihZwyXSuOoA+j=n*8^A;z#9R)8Nk{A)&;OSfHjJJhwZFe6ZH0$ zl(z%_d$XSZ$-XObBL^@4d<_byHIhpS0W&z;3oMZ~m~5dR%!|0G|Z#se;G&KJsG6jO$g}e-Xf! z0sNi7KM8ylz@7k(C!ASguL^KHfD-}i6W=fVTFA8DkT8~~0O5DS?}Z12hlGcPH2Xp1 zNB~Dgel+?|0sL(EF%eEpCjr$MC~B{3*Zd`9TyHDPi=I z!J_9{%LGw2h)Thte|#Ra}wQ>+uq*N7N z7DTlmsvDb{LDVpu_Waw0Mdj~`Ag(m}RY6=WevR;2;dLgK|4CghJ~4<%LDUJNZV)#F zabplYgU$`En}VnpM5`cL2XS){w*=87h^9f@8pLfuGz_9q5Vy;c#&-sBhq(LSTz&Bd zCYIt|;&%sePtbWRfl2sl9K?On?>)zoIt`iy(LCrpJ;LC(eE2Ph2hOp1P`rh(rSPoJ zHbHcf(l&^8A`b=8A&7^?+Z&&>?|4o^20I7QMM_s;_aM3j@yP$T>0y#TYV=+~^bVp= z5PgGqR${*(`Uf#2h@lD&5I!z^OgK7O zGGMIR8nhf4#Au15bOhbBXK`#0&nR}BNyw=2;v{ZEO$g#SDbJr{GdYMC*z6%^L`(@{ zY7mEm_#udCK}-)~We~3iF(ZhXLD)f|ldI>uQSS$_DTq&l*d4^?Ahrat zLpChH2SIE%{6mqgL3|{#O~{8rX~y5j3ew@uAa<#(K9RytB)IMWSrDHG@x8<^g7}hM zOZ+S0-XQh`u}9o3Rp}~@=lxPhz7FCW(;J!T0qNff&mP}{K^!vnbaEt!qd`;*p;8Dx z2Jur6=Z8={gr9>r7Q|mc{2j#cAWkUBY2nErehuQcAbv4^==^u_Q$n|FEDy;aQfTm} z>PzxZ5dTU<2>*$ALe5;r-H=b2chEfGS=5Xu{+R0tP@aA63grIZPwY^Z2v zqp|Drq7W`tY&nyPQI{C*7PW$cmzuPdL#PtMEg{@0y=n+og>ZEUmxWMGO7#$GiqsIg zd0j4kh44y^U)T9HQtAp>q-#a43!#=#YKL&W>=|1}A|2ik!i^!^q~OiMdctqddHUkE z5N;3Q?hx(?;SR;pL&Fg66t6FA5GtC$>9bJ?cS&>$>|)~(no7J^c%QI|klx%XG*giL zewFh9;e)1*EE0dM6#OlO)*-YBp=}85LRc5VyCFQpAUC`X;h7NHhtMH}hePNX!eb!} z455>p_Y9#|2%SUd5<=Gyx`ogqghv(iNC@3c0nQeQghSq~0(tKc`pKq`u;)W+fNEq%WPnp`$gB3!? z#M&f==R{c4c_F+^dj($+E)8K>2=hZ&py0v~7KQMtv0p5*MEIH!zcmfAT*^uzb6;^z zNnQ_Om9b~OZ;G!DVND2ciN9@9xwUvl!L`Q2dm*e3;cy5)gs>rmjUjx`gL{$Z{SY>V zuq%X5WWPCt4?_4*e2dWawl##0Lf9sSxo;QQA!Ok{Ho36OI}QI-v3o<<7sBokJ`3S< zDPM%}r4Ba}ekFye+=ITy%vAfOA26|Bi+m&eR#;qp_&aeo?ZFTZDM)WD^N|pahHz5K zk0IyU=eYP!JOzYsOx&%Sizm)WOAo(<@T*bi|Mw71g>YKRpCSCEIpGf>lmE@dKSx;@ zL&Nx&lRxL!Fm4UwObDJZDu+=e41`fEjElq08R5Jz&JUw>7-bYJ9!3cfwWBGzjB{VcZ?YePQSC z^?T&Gv255Hym+}+oPT69=;q~OGwIFMl5UkBkaD&>Efs7dY!yap5!XrEFxn~jknmw) z`!G5f8#;9TbPl6S7=6O%8%EbKx`olp*gPWA-Ly=PFdj9>tEZyeQZdKg=LGwOF@QCd z(%)o(*Gy$TMM#H#UrYPJEJ4o)2T9;ckOWR?y{B#HR|Ug)v=ZhS1IN#V}@v zkqaX)aZVWFFd|{R6vo^zyb=RKpGoC6Z5T94=$v+lh7k`V5k}0!I!8*}5~hS{pU159@h9?3< z@M##k!#EViVVQjv#{MwA4&(DMz6j&XFun?7Zy5W+*dqfjdw9L@?Ky+gZ6en98yS4h zp&G^k)!i+?cVW0Ef`d9VuK0tDe+}ceFph+AG>jj^_(|d~O8avd#}zy#baOc&4=2x2 zsMF!^VVnx%A5QFHoL1}~Vf-n=SU1PN6#V;~v@G*~od1m(gZ$CBSOn)qP&IWR*5nK{MWyMk{ zFH$Lj3UYF((JLzGCgDpZBvp)3ErRM1Tp7Vt5!5jDmy6UiHdiRvys$G%zD1CT;EE`&j3Oz0Lj)TmNJWs2z=|Lf!LkUJM_@BH zg88yxUOAChBFKvrBA6G!%i?Y>v~dgL;(`bkMzAP?SB-}y5iE}2HIu|OTWVq%Tp_+z zxH5v*BUr_56TzAY-iqK&W4T(yP3~s>_BqNsru|u-brHO)sP|0T^(OZH2sTAr?{1p6Y`AHfF^d>FweoW>*AYEo^F;3M&ELT2se`!VN#W3y9am+`;b=wC(fSp=U) z@P$dsf_-@o-(xKInzUa_ITXR+2)Hl%iMeu6`zeVu7ls_Z*D}qxIoQ~j+b6mOE{VnBR;Xfw! zThk3#O-~fXqbLytq9_*CC4lh!=>OL3ZrMskQ96n;iY+B%7G*`~huk$IzbJ|dQCzC1 za#37tY%UQgFLaG7Mp0eCN>NmfqKf!sQB;ef>N#d-J(JXsUQ>9v(5>lJQCuB`KZ-yU z*FWefI(nEtN8XC^x-DS)e)i{cKqi7XHYl-&>9}qT)qNzwTVRPaA zLOS`DFaJi-f^&kd7g|a`+cIqwd?<>xMsH^lwvVDi6b~!dN!U^7*0i&@>!({3k3{iA z6i-U*9!38s21L;#ibtjN6!wmymx$Z)eZ=XlZxsE+&z9=3CutFBh;x*uq8J&)6qL?qvg7NgdFp5P{yej22;bNidaEZ8E^5s#ih+=&d8=_bl#p_Y5 zRqQI^+it2T-i%_k_?jr*GHp%|bm;ngN3qPE;yQ7XccXak9DSqsmMA_Dc|VFxBAbP- zw+{{fD2lD(uFq{o-)=_A&M0<8@oCH%(Vvj8pTzKN47;QFj1xr+*TwL86kl*AjG;sf zUux_hiQ;G!Uq!JeioH?}MDbk|`=Zz%#n)245z;N+DgIWRZ`d)&-}ee0j^d!mA!F$p z{GcG;4gWEUpQ89TivOhi%y~YFU&W6Jj|)#kaZ<#|h=2P=@p}}1NjW8?_-7QS#s3hx zPlr-Jxxw>y6#qnvo|tuCNT+^AX6LC{_^&_zn5W2Ju^8N3&X?lamo%{#ij)$Tj-iZ5 zSrdCf3~lt}$X!DB9mada z8^>^O4EKq%3Qa|t#GEHl>9AR>=+#9x$peaQ8^eP!w1}alf~|$Egl-w=r;SNS-Y$lR zVrVae4#J1!pHcjEl(Jpjsf&2O7`n#LP5cpIuNb zIkAj2{FxZWiM!7RxaFJ>!*ek#jA2m>&&Mz^hO}%Z#V|RBIWfEx!wXVo3a1E}@6;Hk z89rTP#yM>`D~1a?N-BSJyak_e2xvFTQRtu?Hws=jlRzGne|55 zEV4nkQTV=alaNlfhRD=9wF22jbWeR`$Zx=Od^Mc2ZY}VzZV`99um?+;AYPc;zx{fROH7P zeiCu}Eg$1K9z)+a`o(b~hLei=C5AJ6A}Wqw75q*3dkm*yI4w^9e~bJf{4<8XM9$7m z|0wvc@V{8m7n~7CvA8q&w-BBe$AxiR6vz1r78jNfmK2r}mKK%~mK9zgbn_|~$Hj5f ziKDK>OX8>!N7XpWD_B8zsgU_r6saVv9C!W@VJ$B+vDd~?Esp96)`;UOqt_I`TjID?-<6%+BX8#8WZeIs6^vu5EN2)G(?q7ni)Krfb7mZ~Ozey7 zQL6h(QbNMHCe|B=&v1Vn0mFkLeB?MR5;1x-j+o)`I1=JDy-wSv#eWf6ab)7KDLg0u#G1jzxyQ8pmS8UlUmp$I>{KsiE8^BGTuII9A5- zdK|0REOD%jW1Z~Z6uuS5YU5{(2p3~-8|9rie$v_P-8kNhHa+$E2kZCy~)G)ke z0+$wG^x^yk5voSVzPy{|(|d3YphU3Dh&32Dge2NnmIK zwpMMroEn zbHndX;DH1lOrS*qEfZ*)Ks!aXN}zQDZ4%B-Ts-TYiw`BxK7kH0J6CskN9mms=q%DD zf!-org)C>c1RgQGyGV}&9yLl&kzR?S6>pye`X6M05BUihqV z0^3mY!}AGDOkh$1lM|SmfH#2`WWe&w6q%C1RFP@I>B1R8w=T4trQnOg*$K=Mc}d7v zn)wp&vz3ezNFXX6G)gFeuz18M?t(m~U|g6meSe3vS?%-Ad!VRkEx@_GWR#NQCU zX>^XSx5PgXzMa5339J?0C|oCGzV9aRp5f~g*dXq{So*&BCKJ0kfh~r!3?GVb6@Db# zCfqJ`kHQY|ox)whPlTTecMCsD;PV8&NZ`u^_DW$|p0mD6U{9jxV!Y^1h|W9vjm_5y zeB<&24v2i0z!8z}g$LbO?*EyQOR)5 z;Z?+|3NK5dnn-nFjU?O+f9S`3h4bz ziIz!pNaEonS|!msiFQdmlmz!ho+{fhiB3s$ zNup~Ke>L%p8|%EZ(m9E*wat6CB>rvgc_fM5XFS)RIm121yGnmFiJnOeNaC?1dL_|2 ziGE4+r>mx(K1uXd18(MBP~NQIJt)4proGDP`NF22fk_Nv_h{-FlEkW}p2tmV4^BE; zVQ@EwPGi8W*N3uRyw9Wc#&EU3h@`Xm{1Zt$nZ#2`j7(xw60?(-lf-Cl{*%OWNj#s# z(>!WPJd?!uB))3uVb%wmdB(AatG+CQ^Bz!h&$CHPNII2eNr)4Zn3Tk{B&H`ZIq7`( z;DscnBvG5U0{9dG@BDC3h+os(!(v?B+%rS%Jd@>7o6O=KMEvtN3I3R>4j=wcVr~+V zB%(=plkg=GNFta-xn`cF%{^n9di=~tX(K8_D2Xr&po6uKAHCw$Qxfqc(kf?y*|7zh zJEcuYVZO9skX2x%h;|ZL_Pq@1XOK%GpTut|{GLJ~iFrx<$wQpP%SpVF#0PBlB<3fv zAc^;r*p$RVHS#*)BH^pT#Yw!D#F8YIChpJqPJpKE9!0Gnk3#5*~%xe*)5Y;n{-}c<=gRgOUEku|Z^` z&^^C%;@zy^79s7qF|4~2_*N;qllUx&kCNDy#CBs-@_c7P`#6amNoRwaox)v7e3Hbc z99C64wFWwSwe@b{;O9wvp@hG4PGd((;>RR@N@9=kwx8X;glBIO`=q$n7hfmw4TDJ> zU=KfY<_LRZOMJ%x`?BW;Dc>iZFGm~{Kg5yP!E;#30UpFNXULB#iuMftEYHV;ZpB&t z<2>|I$WJEmi}n(RU%iXa7_x=8p~QK zTqn*X%(}Mt^=@oEPuuahA%z=LXput86mCkPUJ7@ma5uB&ZGjYSOX2nuZb{)*DelX; zeE0T_6z)u+VG50;*B9~)%?2VopxnZR9{5HlUqmI|lS1PZnx)V@g?nYg*!xT>@+K)X zO*vn<=GHn4-k-t)ihYoSx?a&H5A?$*z82alh1Mx_PN7Q*ZBl5PLi-dt$i7_)51r$d z??JNwO!aUI9aHF}D3+g2%IG~=4#uu2bd%mg_=vE33hs-vZl;f>&{MkWjbiT<`lQe| zg?=e)PvPSf`lm2}RY)P8!ec26OkrXQlTsLz!s987PGL+6gXLsI3QwdkB!!_0vOL35 z;H+Zv`G1!4Z4Y0xPE z^%Pd6kV+w)!Ye7vPr*tdBhQ5tY$i`3r=a_qF#WTfEKEKHHYtPiQg}H9cPkS2i#7{V zSeU|VDJ)50Q3|gr`QlX3o($Y|!QEVf-Gj-Orm!r9<+N|<{MDXcSo*x}cUZ%ARI$m8d1 zS>QIy<`h0i;X}o4VX-w3wx;lr+HhM6JfQTZ#bz)Z`j zp2(4PD22l*{E)&C8M7|4^madw(b=Z>Q6>CI__OeskdxJMkrP693$I^N_*Fq(VDbv( zR0^j#zS4L+jXzTOGlf=Zv`#w{{$HHE(iluR0x@bR~ z^Ch}-CM`>*(ISnOX_QK%bQ)z8dy}wi8W)IMm_`kjgkOP4qg)ynOT0{YiLe*%|D;hN z?R=Mkze`0brcp_xvapJYtt!HMKGl@Ax{zCI@)Dq?_~mI_k;awcHwx+Vsx+=v!fTA5 zYty(+yq2)G@cK0Bh}2Ev1`(#^mmsDO^N_gLp7qkWIgMM=xHXN&Y22H}ZE4(|M#D53 zrEy0ZccxK4jRt9_x41j`@J;`-lT56==dLvFR_s0LqCFXC$q9kofJ5oNG@7LGfDD?Z z(JYPTY22@%JNmd2i@WEHJKH>{D0evUi17U4?o8Mwjkak#rWR$v6YJN|U~>L~X`C49;im_}CYIa2#nOm#bXd65a>j2W zjknWyM+Qk@Dvfj+RvMW!>@*gnu~1zin?@mxd1>U*$ft`I;clOKIgM9jGhaG8k9#g) zKO|q2#;a*8O=DRai)Hp&8cRgjjrpUoJ54Q@xFU^}B23H4&0Rmdp2jMPZ>W%cxc_q+ ztJBVQB5QE7i|M)}`@o8tByEZIy5?k{g}qFG>)h7lWZ9Ka~f-=J2g6y#>q5(N#j>VxhD=b`)_G*g}`$S zxw}ouX-@u}>MfMC@Mju-rQxvv3xB8aPa6NFaYi2g6|$A+oQof~HHh4|s+fiIESztl zxK(tP=M=;!cNZPnbIYAl7D`*V$U->_Wh|7naDjyjt)iKYg<-`HpW?Pt}-d@>44GT5Jt5~Qia+$E2kRzhH1^2t*ms_~PLI(>E zTe#A~RTdgpXlUVT3)fh<(ZWs2@mdSDEnIKmIt#U=aM{qSQ&EBISh&G*E=9Rys%znp zcD7-GsnoM@vxVC&++pDs3%6Rh&2ozEwiunbN6=jg-YL)ZEx79|cV*JZ!d(_xSZHbC zZVUHVctB>2h4)&x&%%@1X}O8zEM}Ssn<|!NXx7=&T>O64MVl~l#-skAME9i7%0e3p zZ7sA`E!gsI@!DB<$U=K_T$qZwThxvgI$3yvSzG9Ap^Jq979O+E)j~H5k6P#{|BqPc zZlQ;&%;avxxtw-d&q8kt{VeoXKj~wEhm}oAv%VHc_;VLa?)r0}g+UgES{NqJk6Rd` zg3)HM1umAj?GKk*?)h%GY(@wh3OV%SeR_#1q)LwOtqYgFL#tZ)(O)rRO{fJ ze<{|~A(&}lmQ}P19R0A&T&BLL1H?NUFIkw&US#301+VF`?_2O$@LLF22wHf}!V(K1 z3t|++<7A*1h{XGc_X%@1gC#iz5|EEL-=?uazC}m{%syYT^vleo! zNM+}9Y_yrj!{-_ZU$L-2gqHI~c$LlHLbcK&c0b*eVC-TY_hMepQVYv0thKPt!g32M zEWBmmZKYjl;SCFKT6o>UDt4;UPL56qFY>IG!5TUIr>67g6t~%2eZ6DgK5X!g4BT79 z?^;-|;Cn)M@6!$98-?`ALT<9K*}@hJA6WRp!j~34w6N8}E(@Pn_{hRG4g^kyO0wO; z$0BF%Lc96yl<4wLEqrGD?^dHRBmO=&3BMBAC){H!_nO%K7QPn$MtIQDe*_i|DEOU_ z-o9s1^>?{DCH`RH22noRE{>SufuCvGA*c zzX(rzockERiM#iI?&to`mh)Ba)51T5e_HrUM#a7Q0-G!i~J0Um&IfE-QxFv&IGq^H? zt1`GcgKIMXTVvCbKMv1p<>WeHtqf{saDAp|m$@57>SRz?WP%Sjh`3t>-y~iygPTRR zY3sS$GPpg1JLK(bdAM@mS(poq1{pNWU~UH93>sx{R|c~)n3KWX8Qhb>gp9MBYhya( zM$j4DmvO!jvFps4CK)u%;L!|vW}FY!H_MP=&2bE(WkYfD@nzuWo%sxoNC~iBX1oVQLc*{xl0j6&y?ls^Cxl5M zeWo%3)8qRYY?87$gDtel;KK|~X7Eb}TQm45gMAt7 z&tO{y+cWqigHJQ~SR-^t20Jr|dz|A=KfBmU6+Cy9@|0DO%5EO$48F|ZGrB6~`CKy? zr!StxzRF+^XRQXFz3c;g-igW8m&)+D7jFBL!8bgt860K7GB}XIp$rbQD{>0;dcMz~ z<77`m<#JFZf0z4eR`s~2o*y_E+j|=G^#|_%$zjO;oWXG>ui*K;m4}a4{j9?GH0zK!2AIF-Sl8T^&OY30Hi{h>N?#li;(_^j#Q8T^yM znG8H?$$vBWkJC$OkC&ZVO<+Hh}*m%rF8yjtHbXOFO+u7)B;|IR{D}~9=#!%^lY&Gh)xxmW@EaI88&9xm~Uf& zjafEcv=L?2HfGzHW5aJFVB;klb8Yz8F-m&a!mPWO^)2qHp$`(VJh{%EppB4?u#Je! zcm{MI_+cz>=blh&$898RWNg?rk~UH*h9yk1tC#YW?&vHVI14cq=k2VG97m9ic{aGx z&f8$8vqC#~Sj=B~2whK)CE46NtrT-D<~n8AB-oC@Bu@wSci zHa6IJ$HrP4@7j3J#yT4Z24Hz3=LRO{+e`WAuV!67rOejbXybilvBkzF8=FlrIE_EU zm4GVFDzN8lwegWGH)XNS#&#PIWzjy1k8SLbUMq{8Hg?%KV{>~ld}8BM8$ask@3!%o zje|1#+{PCo-`e<6#2tprpu>5dTj2z0uuA`VZMS%uy+E zP(^1dIAY_dO2SXEGx(E@pKTnoahy}DjbF@IU@j+Q<`(H!dHB!9Z#)HvpR)0XjX!Oi zR`BB|V(;|6#C%=RBTI)qw8zBY1p~MX@Zd$`)OToR`H#S(MA- zd@04VD3L|UEJ|fjCX2G!qPx4L73&u10`Uut2e(VJ=QH-=EUHSsB#ZJ{RLJ7eEGkQ> zD6Ax8F=*^2tYWfY@G`|#GfMR=YDi(5)D*c~c!luFEV%VOqpnu)8sW8Ew1~J_u$^mX zaeWqbvZ$LyTgIL_bAt?S%;F}KQ9UX5Wzi&yo5gR*;?^u~%i{Jd8f4K>;vHGk7r9fo zQw{rOFAVm28f9@;7WZV)SW#D$@@#D7xjT!1>Ak~edhS(}PfF7)nq|>OO7kr4&!R;Z zEwgw)%7a38vSJ0@d9_s*t))|O$0>1N&}o5oMrW&bFuZ>j4`^bw;Uige7wI9S+ebxuX3@(iy+!(D(O0CO(fPU60a-kj#lS2ENqkQDxNvZ` zXkr;+?1yGCEQ{e;jL71NEXHKeW29)xgr$@V=l`=uNNvS?(b7e6xi%D5b&f?W97H9E77E`ha zW)aF_Y8KP7n3KgzSxnDjMiwt-F*}QyS#^QNMxOl zAn+)&b0*bAt8jYEI@jiDA&Hem#&BCCD;!c91-3(V4@<@W&bV~sYVegT=4Y`mi$&_; zEGo;kAd7odsvX0f!XH`a;U(T{SuDxo?JVBOVrdr3vRIYH8(A#RVnr4!vv{3HU+bcA zw|aOpmIu0?t_NAiH?vrs#hNVMV(-m4<)=skuDW?r;PocE5Pxg4crT0fS**+A-7GhJ zbIughYhUHrki{L{JsY!lpS`rPhaXaBP1!jc-{%;xyAnUh;zQ0(ITX)fYZf16u{Vo- zI==D_;vw#R)eJZj$i_b(pH~JSMU-CF=J}IGfChhyd zvppzx6Ju#lENh#bk{s8N0t`6-K^jdD!n zxbTGVWEN~pCjV8z--N#lPYF*8{}BEu{7d+^kO}`0`B(T~7H32}Dm;Yj*firQm>Kcr z01sb@97-zc@|@HCO65>ChYNDfU8&MJlo6rjk#?R7#V?X^ZGF_WT+W$YX?bxDmq;%! zWEK^2xKzAi4wZ7KoI{lys^?H6hpIVTmUHg&^KxlW6HkY7o@zN<&TS>CIJXe9ocZOJ z6W3mSBKe9OuFT=89Ilqbt~p#Ia&r#1h+Iqi9BSoIJBRC~+>}F|9O~w9gM#k=hCJPn z@ONYGe{cHKlL7N$nQs;Eki%^`+@8Z73f?cgGl%*)G!Um{(;OP+&?twyq}*+Ecb2|K z!N$USbGXmMHpvy8TbmiBxd@K}eLf)mV2&fp>1-{HO)HVsIkYiK+Z@{E@Q{N1CTx3= zH~H>i1<%9c9gStD96F14F$#}+H#U9_-E-(6F`UDrIrPlIt6;Ajdgt(D4o~IKCx^Zg zhYR}&AJ3tG4g+$|h1+8}49sDWIRE*j!Y3A79Gt_D9EK`t*f|DnEGsxd-kuP$LypX0 zR1UKh9G%0M946&3Iftin7@NbhIZTj~aXCDb!}uKB?9OJ&e4mrS^Epi9u~RY5#*(~{ z!;~Cmom!gq!5nb`F?Y%qLd4(}VjDTmGCY!Eu(R8a9|&xbq( zIeeVMzd8Ju!wwbWs~q;^uv2_j4xfm8n!{%~d@jB_=X@WNX}?hL zOCf_iF4;;Rem8k<4*PQWDTkkP*l%JF=J2)Q-;fx7K;%2&_Z%!bgV5U{DTjqW2#@4& zROCk?Z8*}8iT^GZ1FrwNGU0#Qc9$B9%V$z3NJ9R7mA#k<|&uQ#d&9?cS#$@QV4Oy(uairApqJ39BmT&Y9KosF6oaqgHgk2xd@PSa(g&(WoW}WkT*_eKkUWOwF)WYaYIB}~M=*;#M&>a}20Rc? z=JAx_tVq#(sBIHm{&XH;bu-3}&0}01&*U*)NoES46*6{09?#KI!HIcH6`5pWCyTrw zoRTjZxzkMSbdecGpQYf7!r8((!k2_|gyphM7c`VIiSsu&tSdqsn7E+&$TPcIrP4A)ycai*QWzXt7*5t7^k9B#x zm3OXvnsHxXvb?P|COVyqm{+>T*2wuUGHoNt3_#mBpsK^EZK0 zyje~wZO&thbk`M?5A)cX$47Z=%VRsE@;D%akMsB>k59#SY$KmkLGbGkHZT7 zkjD|Za_@C8mgGl`4syEsIgev`9OulO$1h59()e)~s5Emef6wC-Tcdyv3OJp|A9*}d zK=%UvlzpuNY8UWV9)IWYPagkDtXXhQk^gZnEfg&^&q((afC7pYaGne<5YqB|k>UlE z5GiT&QU#P2FC#2#^xnNZ7Zz}lg5`vj3b@$BUQ$4L!z+kfDy%3>>qJ>uyo#`@@G@bw z0;-F!RJ1&M^e->ql@gvS6m?|*!+CqKfU67G&W}G95D0syTwB0(tO6e_=cPJ7`zYg^ z3%Et3P62fbSf*CJLCTE<+$2&@$SI4N@^@X!B)iS31)mU&X(nCe(SCn?b){)82dT`JFJqmcVfNTM| z0(#0aEbLW4?*jT1(6@jQ1w0|KpKy?{e*ptT9xGrVGt$0Tyr5&*9xq^U0Yena;IIOQ ziu3Y>S1ZGf&XPP?z*7ZGDPXF^kp(Sk4i7serj6-U58= z8=5eWUFVb`U@U_Lgv5EHhB|+d0-{o41;h(T7)z^wqk4?c;5;ixZ%oUZRJ_@;UQru_ z8-?!+-RFWfi_@O9_^^Pj92fJ@Vjey!U>oPU0{-T}FW}<>P84vmfE@+wEMQ*&`wQ5m zw0ni02tO6>F5ok@*yjc8k@AItY?&_$_)47Zz@XcVZthz~c*Iy975P#4Qvp94{a69V#n1ZrrGVcHI90%}1^lKc7RfEu=>q$U>^P};7kEm&cjvn;F$-^b9&K*!eaAKdY*G$IBy=#mr{Hl zN{W;ay49q8DFxlE%gjUBc}|z(?*b8;T_l5Y^KkJzTq1tCu)MIs|1otX;5Suo_bgN9 zc}^mk=OJSvMf|BmlBq%|l4wvgiHcB>q&cZO-*e~T+)G4JWL83Ho=1fSDc?Hl{I;*> zxzBpme)qfQcfV(!Vec!fEo5$We5mU~Js;{z($I%9eQ4k-Io5y*jl>%(_AHaid-+Rj zVkBI#H}m0K1-l5F`_S6Nw(y~)cq<{_kuhif+W64c=(H1Q??VTXj>1mD&O++5bzKeb zCUTw+-9^0Tlf8WC?Zd@B4D`7(sE-f*6nnmqz0_B|bb;wBO8P76Lg4`6MZS_}eO@Os zpFtWLR$zz^|MOw25953o>ccRV;crMgTx@Y(O>J`DHa3Jx@#zl2m9Au`g3D}5N{ zD|trhdHd0-5_PWjq3I{q7-`aVkN07M_`NFY8Xs;{@LD1DuM?RloaDn~Bfnnc2H_MT z8$$h?e3ac_F<0rT;V-JZyw#pCiw7x5A%F@Q1a6~%!V?I1C!mLiO43|l=T==99D@0DO<(@YBe8#xS@MnB@*6`ueR#!(E`E0kukqnk9~$~`roY5*zot|^q2J^d@FD0!NWriV3AHq0 zVxuCqFeZ!(*+oeoQa+@8$oR0&hxdHQ`jGSCUAkW%@={|p3L=iNUP_8Sto31?53d`Y zw|rPHzQIV|5ZUO%CLi9U8R#q~p3B7K{B8DOixl2A`tOKr^n@SB9x_fj46;kXaKOZbP~lG5(u{Zo=yez)cfPOj{}vLP?yM_E70`EiEd{Sc0KeEjjNOJ0R}ugZ`7 zxq_`AtNV<*|NQRLl1hG5mZXXwRsE>uFR6bWKdOt@5Z3ggmfvkVTTxpQug-*6_weniQQoKpp$nRcg&Qd{*g=Y(!_|a5^n&XKl-tCMzfb6y$$ap za=x&y$+N#77y5C#A9wgMz>kakm?njb{TS%SHGW*H;2_~};U#_yRwuAZL;U!kghPdt z3=_Fjc$puUi>%NJ^9nyk_%YItEBzQ}^hfzI+K;RKxXMWQ+Hs8GWBnzk63zXe+XLez zpI~D7X!JVqiKaf@7)_FJvhaF8ZV+MA6hCehze)NW$EmE3zI?dZkLiBg;>Qd>Zj<{O zrblEf^j1G+`Y}s3Ml<8(gEtX()^$DJoyzS#>Wj?w<1Rn$HpNk4j`&>RJ$~FPLOG}N z1Afe-jRnv!fCv4U@5j4-Z1-b<9}oHA^TV%7KJ3R+eysH45kD6CvB=c?aX%h4e6b%( z3|}hpm>)m)aaWA|J>kbP6T94xC&gD737bQmr~P=zNLKmrjN#Av@ton$`|*O|FN*N( zGt<5-zFPQ-A8SNj6*BfUks9Y%0Y8G`Z}|}tN&1oUBWyGyB2hnVBZ-N`{YZ%LH8(Tl zFYU*ANiu$9MRI-=MHrj+!!f+z#jdv28p%38UKj7t%x(Av@i$EDMv+azH%%XIR&a~( zZ6OoBC;2z;#Klb_Yo=J7UkM|AV&#QpA zHz+LSpn`{Z6)-yN`H#haFp^LF_*DEeKR);43-ND-U;6Qt$k%>+Bf>n(FDSW{_|8ba z7vZ~a#{MY&6WcEGi_tkE@~g1*Dp&KE9~A?r6u@yme)r=Kqgf{4ddNTh_{)zI68SWU=$ zs*BVJpr*)%)ov4No7g%mQM{h8zK|Y+I-IR%2GAqm&i6(EoE1Q0@fHEJ6ggYiMA$Td zb3~}zOypc)^8mcl0$Z8b4kE1sXk#R8188S>dl6QkqmgtH=`8Fb>>5Bf6MJ3&-Nmcx z8@8U}y-aNH0QwkyegJ*NFEEmR0rWTgLXiQ&Srx2-0SpS@K)^kf=#l^i2i)axLO3LV z5h9fQPh@BS!$d9(pbo$P3AlGpmj~RFPlgBZOAG4?NfHyRxqU6xb7TNl1~4jstCZ?R zA>XNu4&dql#sn}{`p*c*1u#B<2?6(A-l_ojM&p_Qt_|S2044^oB7mm?m=wU|0GcHXb5;iMwB%EG8>rWs9JooXt!I_VbHe9^EaC;WMJ00FUkc!5-U2A?D*;4g zCu;(DHQ>IKc`bl|h)+m~U*xlnR!}4qK$tc>$TbH3NTLDQ?Do2@ga#7}Ag(c*ty(3O ze=2~q`Y;o~rU2dyAR9m~fINqoho#V^bENoLQ~-qliW076hgj}6X6qDuT}b8i0rzw) zcFP;Gv5f(DmjquM(N3uRmW1yHusMJ&0lY2y%(bx|8)UtsnrscYf3USJfNus{{P={a z>{F+<2e2c6odN6$V0QrTtEx;zGuRWrUgfzjfcF9z*T$_9F?@-2O*v~`YiqxX_&^5C z+tPyp9HQyAwmy{n8)g;2;Q*oo-8)nMJ`UiM06x{wJU~ySf%rUtFE~>sSYHP40?*S^ z*L@Yh*D89O`u1D4l%=R{wSw-X{(%-%*ZNU9O!89zKXc9oa3p|V1E?HCm7wbce&gr| za4Z0Rz*cPSHu-n}%#)S>J%B%y{7=riAj$^aiT_ssCj$68fRh3I6Tm4|)iXcF{%e99 z0!#V`qLfH!A$4fF<-{up&k&XudihiouOz&|a%Vx+AgTpjM^Qb9>7`s#P> z*9@X^WmloL+FnPBn_ zUn+8p{y&J}L0l2Uh#)r56xna|{6UNg;;JC74B~hNi+eZT;&x+t{vfVpSMcFa&|LtG z31VyzU!n?p4PJF@Z)x|1Ycyi~KsJV#0|*OcI}LB-aOVgZPxwl8nWg+!VxA zRcV^=W+CO%MQ#aVhLPMF#7yx$J=}!11wlV~yRiPLQ+EV$XArZ4n8qscUjR4?d<4O5 zUqQ@K%~|=mBKHXI4dOnL`-Kk(sWUH#2MyoX&28+0ARY?h;UFGiWwa?~aS#i|ITnk8 zcr*xh+M&Gl+X!n(5KDu2EQrU0*cis9FrElvSrGq(Tq9f_#FIe`2;rg-R?v)t_&ta} zf>;^E(?K}2w;)#06oZHcVaslx4dSIBUJl~9pu0`)c?p@-3nDKHxmA#o)j{}!2n6wp zglmF$HHg=YzE9+bQdVs#2aP-|5;Cz75#AOtL;hkxq$P<96T+mBu_?C8ay2tXk_{qf zcwU5`{}qE+8^n7-ydT86AYKpRoglUbv7VzD#O5Hj&}o=do7ivSd<4Oq-!$^Kf?(w- z;qUDryjFOUZ9%*n#O@&WNO`+zwJV4n8ke0Co=)pEZLfs;X!&K_JSk*``-Au(h%bZq zO0fs%bAmW5elUnbB2@lRgk$k>5TA&DF7%4{G>FfPrYHHr)corpz6s*DAlN702Ju~x zyBA%n;O~2pA7ywy1o5X@`jdoTnz8sLh$BJ#>S;>B+qQW$h+`5S7kY*M8N^>f)C-}0 z2q%L0o1Qj=Dl)>8L7XA-PZ0kGaZ0I5OTwC1As~cOAv_~HIo)q%LMR(Txe#7akDZp6 zSHcRyiXl`o`LIi?hDwI4b_mrZuO4!JNDc9tA=DD_vLe_ zp&4O>*XZaR>uLcp-!rLl_joB_Z4t!qgB3hcG0BYeKk|${`F5 zVU$u06Al+%D!fd{tS+a1X=@-q{t01(gxNCINE3Ty2wq=Z6~gEcu9ke9i5(*{R_IyX zc<~8Bug|X&zd<-Lgh?Wkg)IGg)6e8nB)ri`riE~G2#1pS86n&j z!tEj4s^H9!y9;=hI4y)(-676VxI2V9Lzu1LUB-H;KnFEPLh`vHxAe5`3*mn8c_BPt zOq$L2yvlysrRJQl*^k}nmqVo!vyEQD38 zQV7c>d`kFa$o1zd#F^VuYR<|Ko|eR$6qG+3a@_^VbCN&*pV*f;WFhPe;k^)6vlSs^ zXq+Lekxnp#PzbMv@LC8yNtlUW#H($A{v5(DAsjLG{Of-*Vg86@nE8!k8Y$En$=jqjVTu!sr@CnJ~(Radz0fPL&hZ38QWpXM|B+!3tqi z4x>sK6&0jfB@wo&?k)Z!{}ww_70a^ z5c`JR>mbV-Aaa4QpRm91LSg4h)k!d?hoURFzyUvj)I&`yjz(qewXlWAuGw>+%WD5<6cQvpZnB-ryE7`Kp68(?1N#< z7eC#f4~MZNjHO{bVssXUu_%m374%xS*o^OEMrXOmgV*-PG%HLGCG^sN&{A&jDg zYlU9J*M;%Ag6qTB5XKwg-lSt&*k1BC!+4ACDB^ma&0%bznME)$g15tXhb}0BdJ$|5 zV_O)`w}QE&M)=Z^HOi z{5#WE9DOgVA1GnRa({%ng7=s|hw+P)Jq6bPR|S6)9u*!l`TP;apLE(0l#AdmMU_$? zo(SV_+1|-8PD##u{t@}t*exZNlp*vCrgQ{l6l5&T>EMD2+oY4Qv{tO?%Zh< z!8s8$i{PvX8hc41B`4T4QLw3y^`TjwE8Zr8wh=TJZxKODkya737V#?JRlA)eOxsbU zy|9Dwr^4wgP8Z30M$k2aZsLqRPlRc^i}VnBE$tOSZxh=mg7Xb$4KIkGUj+RlxG;h% zBN!FI05+2f5e${u#llM>7-&)rij-V^21_zT=y|GP;=_&Rr4d{f!Q~3_uIGR(>WT

gzj$mvA<081)8!!RTCLbi6*K&ZG#gH?fmV z>qmnO+V0i?KBUlo_Qb`^YdPDzsq~ylx2}7QYU_}JaN#`jc>#!<_nPl0STMc4E`rx1 z*d*cl2sW5%uvTx#8<6m~(eO7-Zf`|O)_8A6@J<9LBKVvBKZ0!$d>+9U5xg70_6YVx z@LmKvBG?(hUX#|V$*u@?OR`5eZ=`#n@x0CZ5$un+*Wbg6`apOnf&(H4g;eH}u)IkiHf9PWZjhD~0%zf-K@^ zBlj}=Rl(yC{1(AcI!UdasDDgy&qRNZ;131=3FMJBoTy)Q_T$lC0ADr>+#dx!)j)h6jI_E(-IuLBqIjZ|#i!8xN7SBC_l0#YVecsV zMBQs8A8qlgKR%tFRMxs6ihfb_*K3Fau+AuDRnU0?1EhJ8ka=Dl#Xw~~NJz;gQ4BVG z2%9E8R5(m{sfoQzaZyZ(VzgR%brfTw z?n{ud3i4#LaZ!wqV$-Qp6QY&7TXgTa?MIQOs1-435rhD_qLT?y_d7 z^EZ~VZj0jfsQbCv9Z}2{>CO*~*5a?Hgeji?%!c#%Pt<*xvQl*>IhSj# zC|+eJ^VJ)l0!8s$6ns1Ld=xK4@nRG&MNx}}q=vs7b(f11b&S~RD9W_8*n~AwsA^kO zdo2oI6n>Q+h$0vTmG=a#5N)rg6^^<`@U7@&^{i@DyW6d;9YrjPW;V{X5sxCF;b>|j zsm`fwqmGRf3so=^MKwOCk0KjIE{bh4k*C?fn#PyEDzTsja>^8Ga_VIE`8tu;h3lD* z$QvehBW=v^r9SJeC^kp2C5pG{XKYlm-HG{56kDTU2Xgopk93RM7R9?twLOX*QS4Ng z?u}w!6uZQC3-<`UH&*Xy1V0keRNhyA?iYR_JRm$6#UYUoh3suAAEy08@ktb)MsYHV ze>lgZ_&kbVqxda~FQWJ|iXZ6NXhl(c9mRK1d>_R(QIyv4s(iWmZ4~ACH|zWsNF&a> zR}R+MbpBEN9K|nD9HD#Ed9$5pqVzc$W!gF4Z5@r`SQLNIIY)6kir?wA%2>TiS=_DJ zU-NnpU;9RJB8meitiNTteA7yEqA~Nu8BOlrC{C&2Siy$ZpB&lBHhy74Y*ew4(RmuSSM%ks?Y?zwV56apGi^}vVoj^D zjYc-kVulsne7L4vU(q_-c3r{Ys@9&4)+T}v<-Qqf*<~CZ;W^8<7qos{j zHWt`;$VO`$ZERd)<60YSZM3s7z{W*3+S}-0<2)PPZFIEJ$wn7;NLhClf7s6I%;uar z#iJ(wt!8z#(T%;w6I8~!hfIFc#_GX#+2~{Ad>g%N^k#9DEGjoH=PEFV@$Ia>w(C^+ zyU<3hcGd+p91fZC>CZy>4@%?Rosye-S{K_GXyY>J53+HIjUhJvC;J~Pqz+4GO_1)7;fXuQPvg8YJ^JU)ra$Fr1H7a#wd}igrkL53#l`P zRv|vlNXCmy5VCdG*_dc!rj1!PCfS&5<0czZZCtP7s4zvEH`o}x(kkEHy3t1Ea#r)w z7IB)5n{CWc5A*Uj-Nr3a=8V3yoqIuKJrA|BZnd#$r1f<>>oyy=+n8fxuGH?ZaTiB( zq;;o_*(|i8+s|~B*zY#{Zri;UQ*w`udu=>mW1doR6z;QeKdar&?K=K8iCi|;deFvv z8!!8 zmyjhcvr%)b#a2*Zg^j0dtft-CSZU*FPB9xVu#GmJQKvm;Ozv5>PFt<%>#9Vpp&IKK zRpQHvdP&G8f5ju0>G^HEYQt|Mz=0TJvE0{e_%!0I8|{sq$qotH2&o`SSRc>4qc&_C z8*IE`BSzz~k!M012^$=>6z8VOO=^yJ>1btaWR*#dX=U{BGk9Wq3mQ|0({Ln!`3ORJSwFzf~5e2FL4Py8ReR#c+y6#9XID zA)7+ly7|O>`A%@y9)QO>D41UL|5<}G(D#hGRJIJd* z3>$m6zPFk(sUe`6lA1C1UEa|yZd<%LST}}xF?afSrPq(SSNXG~+(6hchBISm z6vNHhn@}t7uI^Y0^_#@dG={b@w2R@K7@Ebb38tX7nnG6!v9&7n)T0CQx<*tebjU`?tH6KSr_asIgMuWp@G_E(^IK zhDChm&Jy`mQViF{FfoQnG0f{^O^)Guc11;Z{ePD>sxT|wsZEJtmeSrBbJqzsDf6kS z9xs&BW4I-TmpGK%{}scnF}x^+nM@VKBQY$D;Wmxh{V_Zc!|h6Vhwx6}Y~fwPyM=Rv zbA|T^?-kxB3B)NFk@hSf2=62qDpax^F9{Avs#<@s6+ zK2A~zSsywOVjzag+gibxdsD;pOgM%}4AB_u7}7GHSPbzPlC-@TcswchJ^ftAO2ojT zui^S_sCDmncYw)An`K#+qy0 z4tay_B8InO*i4I+K83?7T5pQex)NGRHmdF}`M3sqJBD{+*c!vO7^=ikHI8><*sccd z6!N0KgWjN`MN7`M7#qdcCpT^wV`S*zI3hBHr$^IBV5Mk^A5q_k4 zD25MXsM*f?h&9)6l<92^;3;r4`%>=R2aWkNI{z5Hjo~}`u^9S{cds~K@hT9*ubZv< zTr-!lzUI7E4SBG6nY=p?Z0Ywj={OL_4>9~0!%v(72dpDZ6~oW6%wIGj?5pjitlwfd zN}pzW>6oJaiQ%|3e;2acKVtY({4XOpA@aBIq%dp$?R;5yyeBRZ~&5;;0=*oj7O6I-p^#af z8Aqcy&WgLY#*O)fXB^GrI6ICeaYT+-{F<8ct|`9)jk^!ESX{Gs$v6MB$rf?<8rL%J z+UmN^){V8SR&n<-)H;qf(r1#kakPu0eH=H*;mdIxy!ftU4j$=q1 z=PB4-$k-ktJ>%$QB)#M4WBB=T^cBBA*iYDBc%g8B@FL;G!hu5OJSdJ!4Cmo^l>AS@ z5yGKy3^TEpid-hVTsT~Kh0yy$pONBM#xY9dDk1Y69mmz;V}xUcc z3yQckj+q>B2WL5$6~}FHY{}#8ygP!oGkF3{61XFdJL8xg$6XrPItknz$DBB94lXS- zj(g&GF^-qwxHpdb;#e5RqB!o4bj?;Va{K+VEBEK*KBZ`yWk>=i}~W{RK6X4w;?savZDU@WtVeIt z)_a`J)hu3F-jBP7Vr}4mJ+pfJ{}xbOL1(D4QsG&v;<3#X)3WahST5b9wm$DkM-X zf$9lVOrTN%RT8M00PhqkC*1eleA3IyF731QUaO5`u{UOZZq-PjW&*VmsGY!(kyiaG z78|uXXVKfQZ)?#W){b-+Hgywj|JM`NPoRNFL*bc1#x_deEW;a%JUPy4n!q^;JfFu4 zc{EF4Pc`d@z3vtE+yt5@&?14B2|Sf|F9EF*Xq`YNjcgii5@<`0k;I%N+9l9FfprP@ z+R-6_j%o|9T%8i=oWQ~a7A4RnfvyQmNZ^_Tx+QQPl@l16K=%ZCBye#81C_jI0_P{t zSG zz~}@nOW^VZu1H{n6ueg?!^M}Xh>_x>gjWi^$8p|Ev8yE+lPG!rJ66GQLe_J<2ur*+ zf$P|N3Cu}gVgi#AxK&Y;6S!XF<^*mqsir0{C4n0iyh$zn?`Ou-B==rMPfy?$lWIl+ zG&vSJQ<7N;+$M5+0(TjmI}*54e74YQ?2iwF&&TFUvOsuG0{13xUjp|hFkg}fRE>G! z-fOZ4#l24O#^NDK9u~41kC-ufG=aqlyqv)51ePSQG=b#_JSnxu5_rPsKQ7``X_+{` zmRUhlq^&BrGJ&T>Sm-K|=Y-D)pA~xF9-MxA^+EzKO3wPcB;vgad?kTE0zpaEB=D-p zYo@}!1pJbCtqUa(P9V*RkU&IoJAqgNQE}$%bx1scq>&^{R*X$a$S%r?6ofgWnHO;q zC2tR@UzB96v8dM*SkIZ8z#9oPO5&^}HYTtsf!`DOBY`)iyeEOZ3A~lS<^;A#vQ5a` z-cH~h!?&6|-%Vh1#cx~COAnkl#0`Dd8c>-S~@O}dOCI3YDK>`O8I3(|P zKoVXPS>lJ{hZFcngtM4!|5)7XPwITC;Af_nzD(dNNscG*bpqeet0(YF0^dsbJ*zG9 zovA-__%VT>B=qw1rX*d^kpzxP{%ZoiiO`BXPjXB_&%l@iTl!}Lf6+xJQ89@VianL! z$sPDxoH{2({t^D0aKFRhWf4h~N}_zy^?s$3C?j%)@Q;~p50p)!oPy+RyEl2s`Fgif z5|xvvXJV@)Q6q_(3RX?JKCPN~bs>XHRV#_wM&C2+IttbmdgE0;i3SQb6rL$$T2{Dm z5@#ndFo{7)G)bZ}ArlQ>5@EsbU~k#mL3g)M|$9a<&PTER9#=G@lAb`a^FM2{po zig!w)a}r&W=&E2hwTnr-tVqt2+^c!dB+gHwZxX#E>@Dmg}UbM*mvV8}bzxI$PTNNSw?*C&_AF(+ zo5c1c4kmF(k{wCxOX9sGb|$eaiQN)zCknZ!RyR8OHs3jZc?Dv7cwluN-%xjvu2(ka03QmK;NUX+)SkS#qUh4SK6 zgcVY#Wb`Yh+&eP5smhXYQZr#y6I(4+va+q2Lah|elDu{bbwnBp>!wgYg$60qOO-e) zZ;rEjJ)1exQ|Kvq7ZZD)NY@m)iJZO~c2}@Rs^r7JUPiySNS{>6-nt7?=$FFfDGX1c ze+m~WcCc_j3KyGH7m2tABQi+HTgXdPTUy8vN+cYb!Y~mE+4D?tse+dY*@su8Fd~I( zQ@AdLkttj$`PHV4qZDMqt5O(kxYwvLDU3~FTngh;n4qX@OzT(*lkmrpnwY{Q#onC4 zWRWQ;+$eIr@CK8L`ZuL8O+xaiM$SyUxiCG2TTJYdcGk=kW~Jau!JooyDcqjI<0(9m z!W}8xnZhDz&Q9Sjkq1+_JB2yo_opy7g?s4vO>W*)_0}8rN$7Rg11ZciI&AfP@dYV7 zl)}T}kEF2hKlSuleL(l)kEXCVg(WF0mF8nY&!2cbvn++>5+7vP=WEGVYIw|Buyb=p0 z6|Ye14BwE#>*DK$90Fb)-VontblBdvQrMirjuduExJ9^C_;w2K7)`IBZ7IAf$#x-= z)0TFnuv@_oQrIK%o{)XJS7cwxUFT5qeFgUmy$lbSwjY%6knls{M?x;5K1tzI`p-0w z#%C$_Ve&CWeV)P>DSRn@MEF$-UyFPr{9gEN3g3yaJ~Rf`S`_?I_)`i$o7i7WWqy@} zF6*}xj;7q_>NRS)`!9~C@Ouh>DE34Oe~bK?!e1r_-b9}?{9js{;ogimC2vp1QYwwo zY228`O=*-#qih=e(&(Q?xirp5qh%Vc(kP!sg*0lUQ8SH->5^+ll{6|DUO8Rjz^h79 z&B&`WxjaU#G-{{O*vRXoQ9q3aY4;jYH;sCHGE>IlxVRls%4(QKBcpky$$?R4Nk|Jn zTcnAwX&UFGOYSPo|~=H=$J+)J_Smnt*LW6R-=p6-spE=#k4l) zEXjFkbWfv;iS3$3H^V)%>5)e7H2S2$YgSK1^%64ne38CJpN+lXKb&>DFpW#n7@Woc zBflt(iwz$rGRXA65C+p2lg8LIhNdx0v7^$s)aZ{$mHECR{R5u8(6He3!QhAbslZDp{DO_60nj+5R z3{FjB8ha^?m1*3Z#`HAqP2)Z(+#w2)R7IM}%rzFWsNU0}4Ko#=JBhOk+VB4@tt|o^MQu=K8RNkEXF$3d5 zZBy<$BD4Xo`R^*Y-NaJ3GmTve?oQ)9kv&58(%v-osk_*d40<_yVA38+ya^EAFl<4cnRGylr)uSLA!`%e6)G`=^nKZyKj<~aM7 ze)~uoztZ1kP&0$y(m0ytOLriHV^aP@cwG3q(7TlUnZ{pfoJiyEH2#(Rq>y?3Bf?sF z3!zg+&g)32jO))UWKc1K(ixOduxtirh%l;L=KuE{l+XPCy>O)rs$@_#gUZtM`m>rz zMFXIudZy&MP%DGlifWia9ivlUq^_`@$+>}v<*YnYypfTdCDJ%kV%tqKI46V4GPqpw zW*KzKpmPT2X3#u?7A94j3|fk}61MiZu1ak)XlH8JK7$UKl6w}mx}(%MYF#qunnC{z zF3g}?2IooMH-qjXy@b^7A=1;dqPLOv$>4l(E;-z%K;r#`%-r*713cvnF3RBI3a;T$h2jB%Wj>Uh?ZRxFLfn8Qhq` zO^Tx2i(->WZq8tO2Dh73w}{*-oFQaOXPVeqBDa~oWx01`aHoWx)o~eiR|a=WGDkQ! zgL^W#SNy&V?iZoEen5mdc$INIe+CQK&so<{AIjk23_i)=(+nQTU||MM289e3W$i*IGHSwSz)cQV+T!QKq^Ww1^1ohJ5Ok?q1A zrY5@-+--FBu*bBve9uS@h`gV{ek1w7%>9EI98x|XD(bNCBO&eoW24Vr{VapeGia2> zSy_CM!Iv3WSs;tAGWeRlI)mdGe3QYq8T_2VFG~2G@JHeIv3*ub^Gs3-3u+sVquoQ8|k$S(M4T z*MjoGvO)&SiJT$yE;JRyD`rv2=y0}H&7zuu4YH^%QY(wvS=2B(HATGPt|MMgST|d8 zO{s4*sngK#GeszAoWH9C*F{G2;w%P=4>A&FJJ|3cB!&;=0*q^$pmkXm zmuK-w4xi>QJc}z>=N!7`Fd~bQT%l!A$l}T@MrHAM7EfexRTiVOxFd@@v$#5oFYqJekFcEY>LYDIqKNLKZ8tcsh$!Ce^c9JR|N|<8xU&FOxgn2`?)4CE?4$)j}$~ z!nE>luS)Wok^4maLe?rIlFA}263!x$MKlXr!B`e?5mqlDk`yw3O1y!{7>U>FY!*35 z@IHj8f& zz9W3wcnPmQ?`E+*i`|OaA>1Y0DWr~9LsolF7JIYU#|g!cKNagmy)VwDdBFo&e3r%M zSscvbP!=DWd_KRrwryVBcVP2 zEq>A%5=%dog_U!ieB~S+LEzRF$xru!gX@kmXXRrr~vRsGGw%IW)_mo`h%S&?txc;thnIkd~6g%nz=A&hOALn}#6`{y>flGVQF3fe2SLk=Bt=p@cM zbY@xdY2GTgTMp;ta90j@=g>XpI)r{X^v|J(cuygPy+nEo`v}j^p|8jVLeG<2n8Sb^ zCgw1S!W=GEq1WaxFo!`oTtU~J!zDQkmi)3DhLDI46AsO}Pn=juul^*Lno+wv=dSB0 z8O~PgY@d-i_c0D7V{^DNhfz6PrA$T(DQ7dUHhhc-6OPMad=3+g{F+?JI?5Z+>x`Ut zk&|<{K8M>Sxj{HJhiN%X5x-G*lRBIx&Ca|zhv_-on#0T-ZZVxq*T-!SmkrM$p2Iyk+?&I)9F|Mxz8oIT;Sursb9f+!c{x0o!+c4+ z<}46@i2b8pWuI^cEtGI^4oh-aB>t$W9u=0FA$USP|5y%>=iJx#o;6Z|PmG_;VMPwB zb9jZy%Haj!${e1~VU_qZIXr8!dQOt(gBRQu2WMlux;ZM5dJSyh#R}LrWy;UFP z^S6|(JWl5DkNCgBQ^wM~g828ArSd4PRAq!TDh`2XTFj?h9%o2iUg(Vu<(2ZNmPd67 zD+{X#s|vkG?ltoN|2*vuRkEVH?qu^mZes7q^nRztI<17i! z7B&{LbkB`9$(Q)>W_g^OM;pa97q&8*E%In-xL5hs`I2v4PUq7ukM`2(And4YJLTP_ zwbx5s^XSG@d0d;vd3kit^m*5P&$ z_TKC~?#g3+9t-lgTf%$txK~3qN5Q#5&Kjm-CimrWza$UjF)xn?^CeeyZ+xl4`aC3s zM}(9-EW)&``9kqU#@-eioh2emg^%U&xX2SGcA3a>;giA@rd)oOyfTlc^?mXxAtld< zJS%)I@9sz7_Ldj(cqxx?9+5m=&bv-Nn8)G6)?}UnEzMW*SR?YP@HL@N=obd^?rsbI zSVV~3#bYseWdAu&Z-bglxyphL7kxfSarpQ})Y&H`62kV_YwrXV0bllIm zx6xfV?#9e_^Vpupjy!he@im=o9=r0`oyV7S!g=gr2OhQdh@C}Kj-mF9!KbJ9e1_%YaYL; z6aLBLsOgQ9c^nfzZX~~p{6SA^B!7vV5dNKa|4)#)c}ViF!7UDEI5@{a zGY1zs7~tSs2hAPybI{+xO}i{^-)rHZrGr+EJC(TUk7nQ6K^q5c9kg@YjX9kiw0F?K zK}QFjn5vxXE*kKz4HmZ;)V$x_4NbK!4!Sz-)ad58+eR40SLf$B=uSIiql7($y@V9@ zcF;%sd|_YV1tvCGbazc|FXdWD#c|eOqfsVgUF6_m2i!?9(7|vAS2!5tVDMPC`IpG@ z2MdP?|0f(O945R}c$x5W2i#x7%=fpkMyUB$I~b|lu5{cTucI9I&$zF0+||oy$KAEZ z17W6dlb3_B4#qhc?_ipPn;rM$jR}ss(R;FkYn1u54z6=Bk>lmKJGfar7IbMv*WlTx z>s8zh4yHJ`kzMLwswD1?s&>}5J6#?A$hozXyHoj_E`=WLty>+;blg)ixaoD4gWDX; zb#RY^+a28D;4TMuJGj%q?5);p2X;GaB41spbZ&Z@Lz5U|?HpxsqbsL5-Q&Fu?sM>o zgHIjY@8AIk4?38yac7<9(d2aK1S`M5!9xyScd*{U!ww#C5M}=AoP`dSI9MvaNcgCO z#UkuF@A~_ggB1>*a`3o=Cmbwuu-w6uMu%G+xp$K1obYcKyc@}t4%V31ryZ;kf5u3j zb?}_{^THQ|FFJV1!OIR-J9x!tax2rxHr9p>mc>Viy3)Ps;58HL6Y)C;7)j7UNIYyL z5l$;z@nag}+MF9Hdz;J->sjrtMRw+^wLWbITi#w^CFhVmWLV z&lu5&6qVIl2kS(*1&RHG1Ik;>u+s>+fqzWIVm5Q)9 z3O{r3IV)D(`ic$Fkv?qT7o0Wx7hoY9ML+O0=Z;M7Tj6&?w&HsSKN$X_gP+8IHj-Z) z95MV?k>4B~HIidAX5-9*oQe1ADO;oxrvCmmc}a5vrmmBwt#vC)Gy%7f_ouoPylzA zH!QftK)nyAT5h35#r*9N!d1+*xjWdW@U?rMSU z`n{dCqN6*eZF{)qCvY2D+XC7ZFuZ^(3TR(IhXO7rpkDzU3+Pn9c?EPYpmPCT3g}uu zw}QLW*_yUy^l)7kb67XRbzE~5D3uK!IuU!t9BX?+UrrRRLr zq;J8s!;fM0FW|xghOiF{7*N1P1zcRfKsAsR=FT`C{4$7z$~O{SKU2V9mQ~T>0RqIK z1q>_TvH~t=*A?8&m97_U=bl}_3b?)9&g$0NopB=y7)hOW)~JGeX3LcYP?JsI@iH{; zs|pxha6LRL$&+VzT*jCJ#uhM+Y6Uz~z_SHRDBzj`ZY$vS0vkI8bf=XGp6x@r* z7pCSjl-sQmGGVN$^;>(ldOV)ujsos1U@p75fY}AyRlwZ^%qf7w!IRC{I_mS+w6RMV zytjb+3V6DJRjl)9_hgJy%dPu077r9Kui!3v9~90nU;#&`fQJiMCJCb+DPW2CLg6Ce zqr$~P>NpjxrG`Hy^0@E`A!DhtT>MGl3gJ@)tQ2AF)Jg8xv2(atlBTdkXll zfRE@0%2|6kO}e|c9_O%ZjLW}|RW9rN zNdcdFRXufTFs~^Ed`V|pz>xyJD&TAORRKTJhrpU!*7}AHmS>Xl`+p_*PWZi$9*?>G zRKU;ly%pX4xifSc30E(_7VujE{}k|V0Y?is#_0yD(JXgZ+4Jn@;|2V#s%bcc zNzN*wvH00W(xix{hMyzStO)P4pB6>5ETTgZ9gApHMC&5j6w$T_ZdK;Fc~yf}8J&y5 zK5th<`=Wb#B#)0+q8fH8qH_^li|AH#FN-|nWMfaOOVPb?X1h9fbjS3IpnI-kk0N>& zF{p@3is)5D?;`paabXdCia5WB3ySDhbe}cN=xNp3ZuKp?m%01-zz5d972Jnx+$lex zh>ME2xQKzQ-cJ_ogqJ^_r@_Njj`>`E#z<>$5krc&tcc5t_+Jr2ix|eNis)3dn)bA+ zwX+)XB*3)KoqHhW|K`e$@UE(7DP}1QEUjJB4Xit?!tV=;=WP#5C zFgq7o=8qNC*ciseFrE!fi{dFjjaA!n>Xrj4NUCl9)r1%(#@HiZat!yzFgu3ZW0(@d z9X$3ShV>;CkDcN1M{SE~6P+5XGX;NnDZMqP5#c;O}GX(DuoGCa<@DQgqQ1``f ze+=_tcu@2|C#Lt5d1Nci?|~TR(n>k;9IV@smiCk!Ovga6Af^xc7#Y{NFos1jERJDG z45=8b7?#HHa16;94%1Fzcr*rn5u1xD%V=iw*?xGFFMrZtVpti&su+K$v*Fb*f&f?n-?W$#$vZ4#D>X z-xp-XV?r2$alwS3DMtNf4J_gPQ>uDJlo=CZA-t#a9?kAvX{Erz;7{} zqE*CjnqkVol?MJ`aAT}9v?MF_Cj+&C@&^8rV*DM$KQWw*@z@2FG*HR_3=}g^+&~FK z8&5D>>(*ZUFXoBT2Fe&HYoMqgLp~*me1yNeSOo*;893iSMFW)#R5nn>KurU+3{*8x z%|LYnH4Oa}v*6?ZJ)5U%8#qVqo-0UZ{+G{%k6d8r2QM*jp@EAGTx_6@p=JInK)&Rc z8lYufW}vQtmwEn=0sbx*ngaZhN#k!|prL_A1{xcno~ikkQ zA=pyzio)H?r8$^;YXfZz&`;Zne%cvm*IUN~-fAxiUL}Z|)ink>80cu=TH*ALqmzN_ z3`{m~yMfLIt~YRlfi7}4CT=)%7`hthW?-Cw@rE9{be9U=Y~V%_V`p)bp}WW)hIScF zJZ}+xPXoOSjN-}91_l}!WT1~+lG9g+euDi42N=3n;;q33h8P%a=y4Q(LxmV&V3-iY z3w)je#JeNqa+F}{(&|;H-gJ2JSWRmVvho%rv}K*cwO>(K?Ghl@S+eei6n=PeD)Pd?bZL`Ft0a6Y@LBMLadd$9LZ4rP2sE; zPQGj#47_9DQv>@9Y&5WmK4`$9DhzBfU>Jx?8MexUI}B`-9N#stoyK2Nrq$SOafh@gSbdrD8HQ*W8ZQuhbgD;Qg==(y11|mAU z)GIH)Q~0|C|I2-kTz+ieL&@bMxy<`J`OtQ~p)x-vslupoUM&Q-87-5dIm#-eOCCNeX`pXPKPRsp3E!t>b7D zN3l4H$5B0w8gZ0}qhuUq;wT$OsW?iE6k}eLsTarPaWsshQ5^LPG7aJ= znhwfv)Jo*9aU4zL?pmhFg}XlbZnHR=$8}U}5l1U2OiRi43PBcwgJfoLWgHyzl3<`~ z8^={~TpdTdINHZ?V<)Yv8kIF(6Gw+QZi=Hv93A7hHjW$O=pxB>66`DmxGv7`D(Ny@ zFPG&zXu7Kikmw#qH{svDMe}bIniCV!H^*_jh8kW*)6DJ`xz#g{UP7?6oU^b$>Jvxb zIQqrWKd$@DA#n_iV}Q^D;}{gzy)%D<3k2z_daGe^43A?3+m{DxORbmoQXHwKy6fyl zNfx68ZxtLPI970+;P^Oh6N2&+gqRq|Bq1ip!QO;FvzEFejyvO6VqvL;sc}q;<2e)0 zoB9h2)8p8az=sLk#dhJ#|8dNS>+fQ}&F{aH5PFu}TAI)T_X<5bj{D-cKaM$ZJit~? z=;`O&IOfG+#*vKU!8jhG**8}k;+P-Dg1G*6_RDcBjAKz8%i>rb$6^+q@A=S{YN{nd zFBN=P@DV{iHL#T8SKawNZW1fv;ODcM?8-P+#qn4itK)bNkM=c?n_DKfhRcMEhiq znOGx%nj%botpvWmMkju50_P=AFM-PwI6tBN9HGv!Cl7;`Uo9ZU?je^XmyEFtfe3NiUGN8becCD30u0|f`oxnCNM04F$ryx!$nan$;dn*NTpE&qY@Y` zDcmZWZ_deGO*K|H;}RH8LWCy>=VjTFW00X9CJX1j1ny7Z_5`LRaEGKoz0HtYcP21Z zh-re;8T>_n6=6y4md0f|_sHFug0lqg6|vbuQy^dQISD);JgGL6tRaA zSdhTN1m-7ncR(2ygAWo(FG^r>A+;q^oi4T2!wEc+z@rI##{f=qRccuR%M)0U&>hpt z1Xd-mp`qS_+`uKE1RhV|-5xr%)d}1voj&(%B;<@H9;#foGWl7e*3zn;(Bk z;DrQUOyGG*e{Bn$+Di$%EPWhve1$b)vI%TY;I#xwa^**`+pCK78wsqD%e8{<2(A-+ zQ*gcDTY_)1v_kN~AIs{;Hzu&Dz}cL@7NNHaZY%I9xg&x15^#m{egfp=bB_tfNFbg- zq9C76z%0;7AyNrg1x`NSj9g{~?F5|vd)JdoUoc1@6e1GL39{rn8M_KJ)1=ZqNPuTq zllUlsj~OUTTxQ~v1onz1OPKgnh(m(=qy;}qV1EJ(fFnxjuK7R$$Lp!j6Zk?r;!CkH zZZRKZ`P*wB;qPz)UnOuPfv*$zCV{hJGe;BnHi2If_?4!Tz@cX97z@K#CwG6K#>9kZ z49tZI9#7yz0w<*;G_93N7yD-hCH$L<(?FfqRW0X7aB8aG5;&E>?+Kh{^KsnEP%km| zj|9$0IhWVgkN-_Iiqp~XXo3HT%%+;!@RX^?9x%1h7Bew?xGHX9Jngm&N}4ETqO^%J zrXEvOH}yt&Sre1Hsn2VwB2$lx%9&UpF}A#k3MML=sAQtDiLo5&bL3W2Rgv-AxAk;@ zs%nDcVG>MjNF~%TwUO5}QA^UVZQ^_r7nnNWpJU=&N&h@~oE$dag;L0iOzdx<^7Xpd zL>&{PFJTMHCO(~lm8xr^o{5PjCYgAvo4TCon`mL8zEq)sWYc6FlD@@#EqK7=vO0biOD^0YPBDFDb4XeiPj9q|CiXrBu($D;C{MZH?VcZOLqi z8%4=1e^cP|25N-Z$;~EiksN!P=*4tus@^90n;2lCkBPpbIzGaN>nGVAD1m_@HcXxx zBw4V52AddSVyLM@O5Q7p!`U=ao{>za1e*2Iad?z8;%LEJ1;+@E6&xoxUhp=-34-%$ z>K8C3n|Rp7BPMPaHBK>chupnWlzE?tsV1gL!KPC{WN0~eiGJ=jF@xoiKzfg8n}wMr z#&fTU*-|Oilp|;A_I?v{cQ1xCY}_6^lB52 z3;jfaL#KF3=%)pr5o8xbVWwQNn|i^-izdn^Q6Y(!XfP&@vS21&G4ZO2ZM1D!!+g!e z7P_I(uM6>p;2OcTCe{h@rXa=E(>n_E+a@*${f^*9!A*jj1u0*zf!Zqch<LODV|brVB*%KkOc*BOCaQ1D{KDTJmvD zemU{{(8Nb34x9MO#K+WFTRr9Ej{={V*vkN7VxI|0?ic(_ke5vDfQipdd?B2J1^$<; zPA#3+A>rtB#^{+We@BG#wTW+p$R|bouAs@|Chjuuy(sDjk@?ZYF}eGbAh%zS`@>+UGlEh9u(!6LzONxd`02Wf;A zlUR_%!XzpsQ8@`dUL}b-Nn9e5Rg>BIZWXPvHOEMcOh|(3LTrw)ayd?Lyx?tu>PAKToG9sY z(`0fIw*nZ&Fl?o48864R5oi>=HRzwT;Uf#BucNz9PTdy=5Flfzw0VqWsz zBxWZuH;H*k+?T}tB01-O9%pKd4-X_k;%Ry6!6Y6^Vtzq}caL>f+iK~%i;`HJL|;os z*Ck24A-h_{mL~CV5|2oA9!+9d65O_9m8pc~V%RIh{J3;R&dMZKCGl7i-0z@fXv|dU z<4HV`#FI%pmDDSi&xq+hoz%X}N2q_Q=-DKmOXB$?UZ5qU&?SWz8T^x|pF)EaUQXf_ z+IdP_;Hyczmc-9VoJ`{NB;H6OOd?_(lUSR?dr7>{@~~x-*p$TPB-SVO-p2;Px1>gI z3tnDVYx13>4x1Z=Gpm#4Y!UN#S8%KFw+S-b@$Pn^cL=UpsaqtLgpouhiEI*ac`7BC z5E)Z2Dag0lC~pa!7TnNYr)i74C+G;@6^!@NcYUD)!A(+zToOBz_%exuN$g5ucM^M( z_%w+RB!!P?ll+6c$bTrvu7T-%Ec7RW`MU2D`2&KV34g!PLnrHeKNrpyg4fI1?4cwM zC-Gep-zV{vNPZ)DL}b1eJaN8$_NdU`3g&bFK_q_?{89MF1Xs?`WjikP3BkOseo5k2 zhD2%c-;y|$M41%Irto_br;|`AAca4qP5+{8@YAdE?4N>pt^O_aKZ0ik_lW+BNtz`E zi>Gw%C4`0PCB2U+-E4S(i zUY>&2?ca#qFomWmG!uR!!Nw^x5rQf6!R9HnNTFj2*9x;`3fBn1TUVseN@zOKl_|7N z{kvb>Mu@g4v@3Ahr*Kt)zB;9yj?tCafhAd_bLk}MbS|WPoe=o~T%XcAFO=z;LbntS z@>UAnQ@AmOK*VlJp+^eOr|?1wH>Yq*3Nuo;CxxCV^h)8@6vm{`JB2V3Vr3N zfhlbp{X|Rs1qTT7tr%)}kkEq#^PV*u;O&BKqzre8{B*&o!k;FXx2U^>zFRP#FFm(*GsdAu{g?=3`4tXhSgHcBaT%f=S`01oJvc3!M?n zm(3PQN6;1YxfFH^y(@*?DSVL9<8%J@2(eG_LlK~%ew4z;k`C!l zQrIi>r-JPM$o#Azxj%&i!v9?G3&Ah{NAhqAU(rb|bhmIMg|Fqo8!UX2!coQw3s+h? z?0lO-F$={le3!!aBJ)EEzohVM3O~x_u@rtv;dlxsQusNAlPUejqT+o0k3m>Q1!d(g z4;ORHBl3RN0vmISZHdYnT6&Y@>ytUA;Fi^WLash?EbvB zO27E`4JW6=bc43G(8fYX$*Zk}b{4J{y1n34g8UjdCHa0b@fzWD5ajmp8h-r6LMIE? z38%B*_19|2>xC{;Thm=E-EnlK9{560P0hJc?%r(S77I5C-9wPK_?JFnPYb;ZoL)lY z=ed1^&XraDEcCZ9z|yn72Q58)8)$(ql?}2m*uoGCLoLj|Uvz-m(RKLJ(&7G|+hGKIWXGUajvS1RteFvr3J zGK^=pJ6CS8;Na7D$c!ceq#OQakwd%6if+P zd78c^L`E=cA-@8~M_kF53vr&M|6Io9UtiK>^+OS+1|kbN3p*|Bvh?~e_sI5G*lpnh z>Y*~f$)z_gOLS8oTKLGq;V$Z9DI`<)#KK-`IIfyD$3T8`skYw4=i{v4XHxO~f(I;o zE-GSPUs(83YPW(b9#`YAg|94>O`|BSTjz*{Z>dsQ<^GzzfQ6%$Uems{k4~96erMr( z3qMGuc=jAaDsPhs-NX@Ip>u%)kzD#SYROfl@2TX-z=Pxl(`_x z+I8)!PP22NF|#46t21(|GH0M%+Z1``^;$#qk5q@boVB3RKw7Wr7fb7}zz=12lhy?& zAy_hvcRK2ZE|o^c8 z)2JqQ8>LZQhIhyW zc(EXg{VREiTwa>SWkS>yWC|3xTnbrVut6FP(|Q%1Rcp{yyH8`0Y?9W^#LK2>G!vR0 zM-8xqEz)S2#uaI_N^2LU%#~@Jy+LcBwWQf5jkamDOQU^S`xi5Pr6jIO?5S?5n>2yxxdbzwIja$;_DVpgb*fouALeMz7r*Wgm zvj8`x(IbtU<*5>P>Rkq|WA{pgq%km!E*vv7 zRD;qOoYouJOSuJ0p1Y2!Q8f(+Km*H=n5N`^u7kn#?w}mLz zOv`LcV^bPY8o4w!r?Ev6F$K2@zALzmg_K@+dm1~^cu$xtk0HeSf-%ATm?TayzHcHN zKA5BlrD4e>pUMi6P9swgAk!AwNyAOUOT$ki6iy&WfqcruJh3y4U1|KB#>q5xr}04= zKZxWWDl?6*(l{cQAEohW8vBI)IE_!z*ef(km9G&~{w$5p)A%Bd{c`Jo;46~jmuVbK zDg~N2d72+Ggqk@$Au5kDJf)0Na&andjr!H)A%cmzti|fm}N6Kn}*7ujF=DvO9(RkVnP%b%vY_X(4_=R z{|}$FD9WH*2IYlWC4;I$R1mC~K_wxWX5|d>>($i?oSH&Z&!9$u!S+P$z>+3b{Nj1K_$D)RVh62!4IOx;%sWLN~~u zWd>IW-7tej88jA}`8E-PC21-|vkaPN(4ugce9E-S;7Z|i&Y*P$ZG`Ta(Z0aDZ8K;m zoc0-9mBH1*=dEip+W0%jEvAzfCUI?n(suP^ZV6fe7E&^3c@tP~@E1~+BE zYTj6oA>Bjh+eD3&za@j7!s(SkZz1|*@MH#0WzaW+e!}UW!ORS1WiUW42WBuRgTX=% z6=XU?gkbu^gcvS3B7>0`jLKki2GfLdYX)O7xLxS6f)fOp!Z;zuXK=2*<$E)jox!{U|2`q+2;N_? zkOvBP=N353@xcrp%3!|SS|GSAgM|gjMM5kVTq3wMgNF-uAIad+0{y4#Coa!mMS-(2 zgH=L5Cb(Mg@xt9Fgm|TzdRmCLGuV*9GeSR0;}PQd3|3NGFT%7pIR%#x(wbdaMow=meBd9-pODiJC`iZ&0+ zyEFJeEO1)}=?pR%yqm#x;q1sDE(GoKy$s$LIwoicG6L{cq99{tkQ6#4XchQ;eS%`y z31a5e=hiO2A>GA zS8#s@p9;Z8_6hNsAQL%I;O7(kB7-l5b5QV5;qGB^Og{c~f%9Vq-xTPh8GKuyzZ2qn z!5;+sNZpSK{gdEvu}`LUGJ{_-D4Ru5R!4weGx#%uzcTnu#K<`%#P5QqGx$S@GlKa7 z|1ETJd7Se9$mQ7#lyD$etZ>(US}UzY79|UuQdyK1x{P4HHOmQIRj|AupQ<24MZrpf zl?AJ0QD?p`Jb%@)s4h&>HL|E#plb^Yo#f4d1B$pRw zae0AXM~F+ZxKxPC1ncJS3UW-#H0$R%9QF&*P_R)JjfI#nUgyhSQ@L!GMe{6L2;DM^ z)^6+*Pi;z}X%8g5g#+ct}K1)49=UM=*E1R zZIyJ9x@6I{aJO3)-G$C;>831tWN~xhZr?0!DbPK$=p}UT0;i74R{P9BEmc;}iCJIgx zoGi$6ZWm&T;2l}qS>UrIj9t^Rm@YYzzAKBn3-pXE?kUhSvzS$&@6BSi(Dw=6FF2=g z_r)rho5eiI;=wEyWU(-dhve>j!F;BRvREvaFAFZo;yDh;vsfyZ4`=a+5Hx^Cg;*^D-Z^IkNb4Klbg%UJ_YM z+>J@Qu`i3yvbZh4gaG@qI6#YXaj%Qdv-l#5OB`J4;L9uy(j#olwe|lo4>7XYxWvZc ztiJpziz8Wloy9j<6thv>#?dUk&EnTAe#_#!EWXd;r!0xbkBb$Fg|1uU1;c z@AbhBJT-3E59&k~KWA|=i(lwp{6~C|da=F!FMQX{>dJEZ3q*geSEsW0J&V7y_$Q0g zS^Sa3nJoUyf`6aqAKCan`WmHFm7(g*A?mLzc)G$#IWOoe%V`5Pc9zu1e!(5dV#=JV zj8ppDfD$%J+Nfcprj1fIO53Ptqmqp>Hp<#4vQf^)Z5*zYR3A1|Wg}JI)@N4mn6(Nv z?w7-kmdL>`m2Fh9QO!nmTc5uXRg}|mY<&dxXx6%-KIi13Z}fU^EgQ9MTqMdo$Huuf z&bM)a4gOXCJR9R%svbpZq8t~-LwnjZRTtVQe?~E{ar|F^JXLLnK5ODq8<*J_Y-5Ox zx;EoHJJalE~OgTdP}r18>^HqPcs|MZM2bk zwXo&oA`zgj-j~DcuCS5i%R)A;6rv56fNZ=_Rgq{*y>WfMlTPO<8&})7#zqGlBUulU)qlb;oHmpwR7* zF6tInx7&!@`t-RwZA`T>%f`JnrrDTo<8B)>NHkTSu20ez1s zWF}3nNULkMjr(YgHs;v)*;YH+swSoM@p|LeC?5S$Z?HaGVxEl$ZS1A0S#cZlZLG1e z*2V%G3vE1Z;|Uv!Y%I31%*JvXOKdE)@vx0YY<$A=0E<-1iu%}-)G&4VJ?c@~a0OjK z?$)iavC_t4HdfoDp0e?hjhCq(8_&>+*uFMC zY^037>RH+bPwL`q(Z=&)fozx29K$qGZ}w3<9*2FzD{KNAuiJRT#vjG>=|)ukYczG) zUmN{^qL1_FxjlWjXedN)7PTPbJl98UUT$#$RGKW8^EPXV^5H_i<2B zq?WDG>f#^3&oX8@sN$fi12`z=pvXZv2gMzfa8SxYX$K1$tC9|`9ic7i90oK7c1Iue zGqa@bDatzffH?Yi_uEx@2NfJtbWq9Br`+&ZW9G#l|6O~UNA8zWl^swsj8WAbRCjQ$ zgYz8Ja8T1hZ3pK#sO9J|!V^J957SYdG)F{K2+yvhNuTfF0tXj5xX3~8w#w=vf+p|d3asC}$aJA$z2X!6ncJP6NdJZmkFx|mj4(dB-;Gmm>?hYC{Xyl;1 zgR2}gcF@E@D+gCPXzHMugXRueIOq`R^Lf}8v%Ok6`09w_f0nOsz}I3KVHoNcFzh>M z&Z+813j@lIP>Giy7-+oP)^@Zg()=!EFvE zI+*0>Llq`C+Go%GP`5Gz6ypqEaAG3ga^=Ut9S){CnC9rSh?&Km4yb>sn)70IlspY- z>1l0UcRQHj;7teX9o*w!rh~^EtadQV!MzTaI(XQ@Y-Z$Ov4bU4^$_&~Pl0prTN5>h z95Lnx9LyD+%oBW2kS6_*gZTw|frEtwdJ(-t9^@IG!A^aY6C3Lh2ah^f>0p(EWi*3| z%50>2ZTj_c2P+(~P5J%+E2yKrQYA*JqgUc_2TwS7*1>ZQo^N7$|$sh&CL$(xZ*G7z;F~ye;PF+f$p&BqE z(OL3GfYQHY+>(=O(oQJDlTjInc(lSE2OlyTxVYTKM-D!Apj^PkCl2;HIO^bA2cJ6F z=is1&Lk>Q3u;0Pw4!$72ggV9b9|n-_sLI_yF@rDJY9&>JeR@PqwI61DaPYN*Z)gS# z>1+<3x=^G$6o&MV*Qk<}RQ1;S{I~DuL=Jv;aGEj>esu6FEt6$#sZR7&$LPO}bOZh5 z;5gfby?}$Cg*Ykriy()oyhR*4Qk@ddI@VV)Bc25Khl4W?{-*D+%1yN1{&aBJChfL= zQG1OP!x!T!k6b&;3W_n%kczn|?xL29+Ad1CDCwfeML8FxT$FZE#zk3IAJ53q{=AQM z55l1i75h^~#S@atyQtuzqKitdj{h8Nz*AM&sZ~^!UG2!6EL3rIeCDsJi)sbBx)3#7 z)D&X%>pC=@3tg>k8XLzImHKL@U@Nc;JO;Cli%VQw=Ay2P zOI`gTLiP>}sx-y2XU}rfcjHpbEYhcb)pyarMGxlXqM?gMF50`e%0*)rOK30XfmrzrWs6Crh zI~RI=9^mH+t4dJ4fi{35XSct#u`1V!$CEG+HR!trDcBDO4o6)iyn*pKyzx{ zQn6bZ>0*?NsV=6u813R#7k9Y0)5RF-t+C=~l&82D>*^kXDUWk8p4Fil2u={3C^$)Q zvf%B4Y&c5NYcAt-tde$N9XyNFbQgEIxW~mzS9b~=CEo4g;gV_wbwxdw)Gk9ca-Pfh zNgd91ai5E{hm42&UCd!)d1&k50T**!WL?-U=DB###p^EKaPg3f`7WMx@sx`NE*3Iz z7mv7DiVHk6H*~Kd^UUl)Bi~1Y&e1u&FS56p4Ru$7np|VF<<6^CgZ7$w* zvChStY!nw8U95NUmW#JtY;g72hVNF>K1GkFs_9eZYU_S>6YJt)i;JzqBHiEdM_;~B zhTPNJ>6yiL7du?UT_jw*$11ys(MqN6bPa}aCd&lrxooly+muNSxUkqXF4!qE>oyft zik`@KW;pD3!7($vhJ!kG(_1c_`(Xp5U{!WuS=;9Fli=#ny1dNj|j=1=m zA%X=E{6_Goi*H?gC-jek-!tTv(E<4fxg>o|I6pB#NsXKnE`D}#QUp#3{v!A*jdPoR z_BXjC{kx0Pu3i@SgH|U@(%e(~Q)sR^@bVuQXW8+2DCU8^Fo#C$o0O-6bJ^Oes-e%} zEbgI%r~7wyb_{onW2HTm@zB6SLl0#=6nUuRp|Xc^9?E;D;Gv?2>NHVk6Z%CCVxpl^ zpVW304^=(X@=)7DHHvwt$;Y`c<>~%9D_@SFzt3u^kMCwrdX9&4JzVagzK5RN0`T-3 zm@MA;o*vlncY%isJzV7B;sWOqA?gTng@iJf3VoS}x&@hf9vJj^i=7>vml;Jw4~;#v z@X*pj6Aw*2H1p7$^{TCV5N68Wjl>twi#8lfT;ZXWhbuj__HcTqt}HvdIl~kqITPnn z8~wVShxQ&G^ze{}t2|uoVFa`GaE*r!9(sA`?V+QGYdv)F(A7gH57&9P-op*j3N%Ho z>~;3Q^{&zU|Is!*2xLig{P)nEG9GU6a3fQI?uC0uOWovw6K$UTUYo5?SK6lD@1s80 zh@Kw!ZY^7|kB7b<26-6lp`VBT9tL>o@}dY{k5%%xW-jV-QnSG>6IKV`+Jz~VWx*! z9_}LF!we7i&^(|x9^-hD`Z-WbuOOxAl6=Y8!)y<880z^{aowxl=jnkE3w%H8eoPJE z-+n#3TU8t9Ja!744atO#qlNh%7I=8o!)qQEdRXM)aSu;;SnOemhvgntcv$M;VGoaZ zc$DRDtj0IhBU@Hs85PBknw8L#R?cqdJ}W(}^6;34)nY9Scbrx2ou*1PQv75dr^X*N zQ%`z$%ER*>Uhwd=hi5!I>)|=NNpU^YSu#|A#enlf)^S)d6*g2adU(mh%d~15j~rO~ z%1rHOOqrd+yyjZ?bq{ZN*y3TUhczD7dU)Hz1`q2zyy;=RhqqWBrB@?)8ZGt4o}J1M zinNN}@vzauCJ&oEkl&`Q4&YNtC~BK$r=RJgZf7?{?RkjPF+FVeu*1W99^R)DRn(13 z6PhqNhopy;2g}1BgZ1JG9fwxIeuo|RJjSSED(k`a@Q#m- zJ{%7&y~D>1K0FV;hjVm%?GdN{%$<{_f-vxz-?46VF8#9&oQYl$(9&mQ*h72}%>U>MxK@o81c(|mcUOZ&% zrB2wPa8SYG{pjHs&5whB563;6@bEK3v5%5IPI~x-Ue5sT;a4F@|KZ^`p-&0^E_hn- zxBTLd(0>a4CHS`>pUn%L^`Ly6ECh=Q78m?arj%Tk7cA|gj1Xl7iv-IF{wH6-M@8XO z609s(<$q+V`>5fgrjJ^_{&wMruhiid+K)I^@4Z2fF>3qzRhdZ){yxt4(ZWYd9~bzz z&_@Fw4SihX<6zTRJ$%xzyEU46{-G0R6cAKiTn@iCOj^l_7qem?s9=;7mLAANlE z^>K?2jsrP9>E)xRuX|Yb2t2mBw`k^ospfMrxtMl&jy!p=`2ZgSeGKw3n9rIzy#Jih z&Q5=%FLOD9D>K7<4EJ%TkEuRJ_!#NqRv%-0%=7i^h5=_3H9$ScOHEWAr+$2JtdDUt zd-}ewXU(km+}Y|jAI11b03Q>Dm?TKfWFc;+HiWpNz#sU8n&xA=kGp)_?d!E87L1Ge z?D#m*n;~t)=tonzM|8^-^?QBH_OaZ@3d;Mq-^U^!i+#-T@qmx{J{GVprXH)z_4N#5 z9<|4pe|$Z9+pe23;6%g zimGg5#Raz=oCWw;<>N^oPx*Mv$7-hI;|U*}L~}+-Bc#T-=EGS$Et6gF(>|W@@vM*M ze9(}l$)I$4NyQyi%CK3Vr%{QXU-a>kkC&yiYXx8N@v4v4e7x@C4IgWSdFXL`^~AqF z)`&E5o!oje{}h++gm}xx+d^z8@Tr7NJ~p$o0g3`_@v+s%VIN=l*yiJ1A0PVo$j5fN zst=Rq?c+V#n2(qb!v~jKx(!psR_OJIxDQ$sO@)0iRh^*k(*}437sY(o4DvqGJ~DL1 zN?KqVy8s`5$O;v`=@4K3r^`3d{`G-W-}B*%gV09;AED4ufs^yGvq0|>VmI~KSW$S7 zTy{K5EvS!ueB$GPkI#MV_3^2X&wT7>uwA3}`S|raRi>}rcBco?!g;_Z0~EWeFMNFI z0D>#NaK`` z-{~v?iU&ANrTIAH<4>`l1vhIG-84=8MTeCIGz5B7|2N}_q5ko4*5^{Dj!188*Ly~1 zPAZNSX_F-alnhWhK$!rg0&s-DQ7%_9_en%zm044+vGCIp z7ck8Ll>^iWP%}W4096B23s5}(zdJy)SH-kdaQ}kt%oTN}Un@ZE0OtlcPfExILneL> zACxfzC%=?rC(Fs&g#j)KP%psc0WJIS+CyClG+yj4x5CAPDd=W5Btm6g|8 zS7Ap^)eq1hK+6DEuy*_$3P64iCI$RbwNAVA*Hw5Sspj&|M0oXBh4fMJV?UsXiPL|JWq$m3<_W5m8j{r9Z z=o6rCfLj9e4A3h;?*L~jsgg7FF3fI2OLAt!xEFn@`UU78U|fLl0R}Kf8PbmpFfag( zaFA$&6&xJsa4|%1D02@mT<8%2Mhn5aBLj@eGxIAjLXRojW&EUJ{~=k^gj)D|5ny6~ zNdcbE;e{L~v$<(45h_QRLS<52A+8B=XMm{zJ`C_tfN24y2Y4;O>jCZxaCd+O0Tu?B z5#XKx_XW5=z{~)%0^A#5c7VnQ)ia*zJVZss^jERU4%HnimoDc7cp%V$XnugX0p_vd zMQV3eJt*~MLp&7d&(Lrb%}$?}bbpQn76n)wU`2qH0hR<<8sOmok5J*VDmW=rH)r(* z*`ooL1z5F4uQ}*0kL&+|UY6&!&Z+>91$Z&QOM!m>XLX<#3Hf_mw9Sm32=HWprvg09 zWM#ncT!3eUezw5j@cwzBUl8OaC10kVY5c|X9N{uq7-WmQ8el$yNm9KLU`+rkKsvx$ z7AC-^0Gnxk0oKzK18fNJRsi;xMYHq-wzy>dPJoR8TCG(a4A6tveDnfNMYjal8em(1 zcLOloy--rMDy7|Ldw?AQUO1>ae4=QU?@>!K_c_F2PoNhuVgU@Xhqxd)i2$b1Nx_t0 zzR%4B$Ogy-*creM-~{jk1OYe==kkIpD)mGIR4g}qx$YOznCIvYG?I2K@rmv)b_LiS z;DZ2r7>J5=H_d?KD!o8 zK!7g-e91CT)q}M9-SIiC@m+1$Tp2h>Ct9P9u%=R~!vVe$7k;#{;&I~qeJ%WN1dj@S zEBIZ2?-{Y#p~$CU=!3@s{1o7LfD-{yN^du?m3P(G20TuB8SaGs65!VWe+Kv~z;6Lg z1^6St8LH)=`kgWM6RnWb5~&#R80tBrXUcR#_FR7l_=hne08O0T83m}cS2*$y!H$*j zp<1ZFQB^EN@en0KoWoP6LX;PRbg2-fg)SplRdKWNT8C&CqJ5}8 z(bXo@7Q&FyHq@QbsA78Shi|9w8<;7cMbTCM@hA}ipB{cKZCAj zaj}KNi4eDkxPt*d#FP*x`{;LR7#l0gyI%CxsUfC?*i=mo;(X2r)Ory&-0YxSwXg;nA&=6Mphpi{6k>6xSKvoopwB;FB9=gcGuCISsYgOQ8e(;b$3rX&u{^}8 z5RcK2+N%|8$9wcJsVx_RLUiD1TO8VT*MoohHAikwgm^Nz5+V4i(v3rP)a6jb z43P}=yKVRK6Of{I%3H!Akq-6OqkfZ@E9?+Xh+K%BA>0sN2tPzX$&%_!H^m)2n&_S; z>a3~45D^`R|AKr=@5VBPT_JXd_=t)PvGP`Y5aL4$G*){gjBp2>V<9ePvR~uaVArd9 zGRP+WG{io7eFQ}KEX4j0XF~iL;y{Sc85=`<8G`N3h|La#1JrAq=#l?Hib*RU;@uEm zg*X!8YpL4Lg5QMrQHZ00-wJ*w$SQm<#1EnV<}5Fdh4?ANabcbi@(*bXKE=@Y7Y#VXKOxRaQ3v^=X`R1RhXOEJE=J zWg^-qN<=6bp;Uy@5x7dgT_nzGKQFKDtf)7uVWi_f9jC!MZAc6hoD^`~m2V%_iEv4TOCwwsVb414SzKS`G5$0* z_J&+U&2_`&5$Z>{D#Fzf8boLqp-qIg5gJ8k%rbD4@}mw2O(KlpwhM1@{U<^*A({)e z5Ns)Ug1xfS~qOV}T2>pc^AUH6>AZnnb9@kNl366*`GQy|`qa)nPry`6M{-(bASuTh%+Mh0_`2G^jW_*O(r^aa@V<7tuP9(YHvO!*4nHS-~2=gN>i1bHAC-&8E zc|F8*B=E9499k@l^h?N##7NkV?0J_)csRma5#EmQNQ6h(Y7w4~uq?vz2#-g2BEpIY zDe zZi~lYMtCv8YY|?L@KS`AnR0|zBk(m#x+l}5UvQ4hu!c!qy1eXt!|z^H`4KV^vXQ*6a*ysGIdEb?=8KUwBhpZvog+=)3VIRz2tkBUE^~sBAlFIg&eS$z z@@|>|V*-Ub2grXeEL3Kqq7~v3GS>6euCYd9nA{&cc_Eit4BN4ui@I5n)@J)oH5&kjt zYU;NV#2(^uG##pv9+6UkG&8M~a7GFK(H>RVC>d%OSK$Om*Oiu5*{>`A&NGtZA zNDpYw{ujG)I^sdFm|$_i5;>FReUJjLWsFFkN9L~w1Y7QL-s4ac}9g|nfp?Xfor5b`YbEqW*Uzp^OiSr$P^zhsq z&dcd3IX3~B5oed@=Wqcl!V`@INnDh}#X{E+yrjUtREW!RI5Ald{4UR-eh!UtXq-cX z9Nyfh-?igdor-Ok1Jl1y-V&^#s8#0JJckynbq?)vXqm$mIke894Xaj7waV!a zvR}zdiPcPp6AD@#8|8yc}p}?2*&2 zA@M!)n{#>;L`87~%V~J89D3(4ggVTj4->4d2IRnXW>&3l4*hamz|=#{Bl3SY5`1c4 z4uf(SEMkY)EjCcO?RxQz3wLy!knc$3FfxbRa+r|AC}x+#xE#jk^xTIgcWVw~ayou; zA~`mv18+51q+*C*-SD(qfb z2OJhYdT!p;nEJ5b-1F#mG-%kbkaI57bXlcv6Tza4o`J>sKdh@9_jF?t|*ajvLnq`PGCt8zbp6M{PV{%C3Oc3&GuZ56*$k*4+sMF$&zrF1|-{FN0uXcE?!;3MJbwjUlZ3>^i9l1%9Sj~S3YsJ%$#>S zyw~Bg4xe{;U)0(m=n!`3bZ|R(q6J~g8;-OEk(Jz88efsw^*40xdEJRR#2sdI_(U7j z%?PhV+cCmPg_E;pWpa*UFi~^k)OZ{=#NB|_WFNU zKGlB*nhZ&4;2K;m!7n;|DI611>hP6tzQZ>iW{PJ{H8>!qtx({%5<@+lqirJbqE=)1 zp~H_Ie(LbEK)0vi-r5~`Jan6;s_>kQ*53ru4okQ!>GFrRtV1uCd0hVL@V6G|GKb4Q z9scbwtD`Uszx-g*`1N-c!r+=s)Q%kam=R&!TqZnbCfviNr^}o!bGayCTR-Vp(yQlo z(d)5Fd(ZW%X4Ikmq-e3r-?(0T*SC9Wd6Aya-kv z+EWr|VV6Z*`nxRZ8Z%06`I&1NzpJvs#2Xb)SK>08wzHbc0Nvv<+~tHp zPM-+|83wuxa*+u$*fkNEA+}xJw)(n;?F_Z;nzkM0vexWh|6WQ(f{u#3{v)DMF6+4L z?Xr){x-RRv?CG+Xp7??xvGrZ(>1^N{4!NPrMlKt>Y~r$uUFoK_-NCk-xomDbTiA9R z+ivNymF);DTicG3KewHIWjov1e)e_Uv!m_rwK3BTrPLH!sSAji(D>sxlHpP<0zP-@vw^vdb+l zx4PWsa=VaofHQSpLpWN9Y$)--I|Nmm;B=?UU7~2c1;)1b2&u$=ZF`?>@3-v(ww++x ziMG{WbmxOE54k+-@`!fCaXLRb$~6)M9u+3LJnsI_&XUYhG*IjM&RXhi3MxR#Pw#FS)c3l3VHq=}Tb=`PQ^yrf46qywCD`#CR&Y~}p7XrRPbVgBgB z&MRV5eT)zkR9|&@%>wOp*D&ojZ2wIG(?!lV-T$_|qK-7)_gvn0`Nn0Y%LgtUm(rzj zaWy5E*d=lCT>_WTC32CLzUaJ;h)(Eth18fHCbIv}9!~0#x#TW|NVSJy0t!(n&+3QJ z6z@m@(28o8MoiM>Gndw-%jF}Nk6k_#f%h=RzL4iNYnjdvA@u&A+u;+TjRm+IJDY=CQoT_bxxUEa9=F$B$Zq%gFF`2$6OwB>*jZyqiq(AhLZiFRv+Cnug82I{XMg5 zy*>JP^!4cHF~7Ysa!D4joo(kbLS!+|*=b>CL63zz7WSC6hQYl>JX43RkH#Nu>)#i( ze_6~kZ{}UxCeu#{iFk9xHjQ z?6IoHYMvqUCFXZl@laGnGZBW1%?!urHh1L)rKL*< z!fSdA^JqL;kF`A3_P9-R^BAtdJx=jB)nlZ`D38$|V?5T;{5>}E*w|w|kM%t^@Yqma zRdoEjBd@O<)S@84P3EDz;+uGE>anB8PImd{40Ja0*xX|ayD6gI!)MLf(lZIMTiI5f ztv$A}{cUGo+0J&h_t;_fl?|S7J{@B$Vqsc)sw zae~K*9w&JyB}S%`%F~nxq1lSHN*2aRNc#pF@&h|LR z<6I8~WyC|)-opSyz#l)+Fn`VYe2)t}F7mk8<3i!sQ0JxIh65DV&K3TMVG1#_N1e;` zIE~|Ry~hA}RU(&Ezj`r(Xd*$Hu%s6B0l^Z;6^tjpM7SH$|rIXy` znd)pQDpIy@6~@}EGiBO~tH}Pn!{bhm=RIEVxXa^ik4HTolm0K*dQ9|~f^ zOz@B)CMn#{R-y^FRU4x00_A#5_IS|aVUI^V9`bblu=Cro&T%`NTsU#XKUXv2>Aysa z$333#c*bL@$CDxlkEcDR2z$pmD~&SANYd*hU*;~kH8J>K)^$_;<^XL9rfcvqUnF+@tcSwIf5#P6c~7g;u0f;Dqg%L*bS_+0;IKu7Kc3r_19* zF&Uqgd_MB{SX|VnhtCX;PsFP|e)9O#<1+!-<7tfjmdbpbE>ooQvzFuWmk7k;SC8L3e)sr8d`Y%O zZ~>8{;5 z&H_Gtefs$<=rbZWkXMbQ6dQ@!g?xk|!lD&y`cr?OMSYg>S=MJUpT&Ka(ha@|QySLo zBVADpVM(70#BG!hhT+~~R=T*HX4T7C-e(2h2<6Y-HAO(meo?qz+WyKutN3i;v!&0f zKCAf**JOMK_zd(}!)K_^AfLfLLwr{Ekw95?gbDs?U5m+gWK(|?y1hoXh4z#*GE(sL*}!K*pLKlJ^;yqneV<@6M+N5ET-lpSJ2`rg^UX-( z72L>YW1r1@Hup_A^Cp^@O;^~|H*886C>M$rIIyR|cAb5(mCx2bV}17U*~VvEpPhV0 zYZrXB_u0W`M_<{GX6DM!P$`yTF$$UpN`k`}pPhYn^V!`uvC&-wmU&Ed^RB*0ag;)< zR_sD#D42^9$NB8(v%k*)K6?qUTD8xshrre)@9z(X~ZRel_t88%Dg2%jT;=1A$0a+J@}K1)U{6>*HuvD$@zCj*Z2 zIo@Z9fF%P?@Hx@vb)PqUPVza~=MJAceNOQ?)#nPID}7G$Io;=cA&Ji!K4vNvZ zSw3eA4+l8sXsVVuOA8f=DQ{E8onS6bt2(Ul78KHZFZ8*{=MtYweZ-Lt51orOrG7>h zNYGqnky(C;|5T34#Ru#;JXeVdd~Wi&+2dZQ6Bj3wE*2}rY=T@KFd~O#gMmR&K8_bt+B*d1%F7-pRz02orpGSNi^|?oz=rhr0 zlFxlU_xn8HGeJ}-&aV^&%YM%rV|-bnJF$YvJ`akTd>$6F>f?O&prIgH@oM#;c?K8{ zz+*m-`@G=uq897(q|X$eXMCRWjmuOsQRaiD@w9KOIVt?TCp%NMg999?welZ6t0^hR zz_!o%Ot+oqZ7Y9~etJoN^m*0iH33lX)v|OHj%DNL4PaF`slo&~2_?VY^m)r?rq8!N zZ~MICQ~Fds@A|waYVrwv-uL;yr{m-LrkYGPnyg6i1Uc3uSUul}S8b)QCm!z{ppzMV zVxQC}^GU>N`Wd279-w9-7IcN20HP!5&%>RXc1yr?RA#WE182)Hm^N4f}=9mp)%hp)spFThN{Ot3a&+no^p+R56NyI;YwSScAB@c-* zZ>0%qrzEET^7&f~JYcTCSZe?Hyz;k^*WxGt`pgpA$hQ`l7Tb2SZFk$wVcQULfO!KJ3|J^&zJT5VeFEkW(88Y?W|TMCh6@BJX4Ee*!5!gb-{60F z_2LyrhztW33FsfNXkY*+T~6bRW5{18ycJd~7MLAbJTMVDL1w9dr2`HRI3i$~fMo+V z3D`7Xxq#&ZRu5PsV1>p`?Ev|mW(+VCA;i!}E`32#*6YxKH3QZQSU+G`z*+(81gsmdc3{*4+vH`U(;+8VsHVD`-V55MI1Ct>moAJfbCTuN;sjue>VKxic zJYctg-2=7=*fL;;fE@$23fMYeTY)8Do50w83Mt;z+xX07AL-oz@6PXRA0W(>EFQ1( ze*#7aj0xD;Zo$rT7-AQDk#sm|ZFbQ()~m3qg|kK*8?c8K6>vbnxPUza_6pcrGr7_E zVS>^3L@)AB?h_dL-7jEYO-#{h>kmmRS3fY|pn!t|4hf7KO@dPA9$Y!m5q)V}4-Jg- z@Gzl@yyE?w8v^IZfTIGg2)Huf=zwDa&JH*y;8-#LfKvia4LDxRKj6fGlLC{Q{e@sP z&QSukC`g|FlLK@PkMKt`IW6GyfHMQm(r6>hnLlR)XdlnEIb$klQo4d14w9|s2Amgg zQNYCk;{(nQxFF!dz+~fyJxaz28rpsRSN6qQ&v8k>r2&@(Ty7sHacr2wB1X?qM;oU~ zx2poK7Vrb^47euX+JKt^ZVtFE;QD|Y0&W!Y%xNOp3dCq+A&&&Eo^s-3=azt518xhr zJusT5E^3V`0n>hcGSYd@p0;sUz}*3p10D>xC*ajc?P_x0Kt4F$}H_@rX)U&c022G-quW$f zt&Ol*c^XGc?ubVAG?`}F3$ZD=3;ci}Ak}6CghKv+SeqLd$*Zg(RSdnqx4BudW+{7$ zFXRD5Kp9YJvmP*dz6#S8(SaB?03jwIsniB^1$-OuUBHK$Ou%OWp9g##Fhgh-@M(aS zraS>LcG0`^iYI0m@4?uC&KCh+27DzT=*}r7N~qmeS%LInN%?QIn?s$MmJO;BO8ES} zn18^p0lx+O81R!YKj0TJy}67JR?6pk(-HDW#>tcrF8vBf{hb$PfP{NBCA`PLshK)Q2q;F`LxwNDCLsa#7)BxnwSs*kzvvO$r zg{HhAbAcNJ#%sR;O|Mivh~kUOZ%pkflPF4teugQ_8nwXv~(a>>t$; zN=t}~5|;~EK4i_1VIeDotf=RP3=UZ-WaW@mLRJmUxgx5{sU{er)Beg_dS-;Pnx+~W z5fkOkz|h1lzmw-bWc83WLWXKe^BHTX?{h{OJ6B3hFJoEAY*{O0?U40C)(;u3S%r)Y z85Nq0DOqZA9%?rw$bc2vROWXBwHVD};WTTLcLuL#$1+cnJTJhe~&G|x` z2+m63a13&89A#7rOn^I`yp4}~E_mHt6dk9cn#_+jjl9`ftpg|#f zrqf=URmg!M2WcNe_6^xjAk}^;W7KAxDQC6LNCMDIv#(94B~&oFLp-(`4Ri3(8|1 z9inw&$Vs6oqA6_7gHT%R{nU`tLe2{ruZh`nW=;=H+QS*4!TB@oE^DLD3ORdr|D2F> zZC~4}pLYK2f9~tc2RIjoToiIs$ju=ahg=eJX~<=vQSCGhRpV+Qmxo*t8lI+jmL73s zXcW$CLaqwAI^^{A9DRP-!hEi^Pq}XPbFUA%VRrvU+Yv?I5^`(E?ICxB+!h*pR<2`l zwz;jfa;M!vWtQF*@`(+$-Yr_QbqXJeopgU9%Du zD|=AcfEO=jHvQRe8SS;^FJ#mHz7X%P8uZ0YJ#d$?* ze-1@;#R|j_gmMb3s0vuDo#WhP)T@e#i$QMM$ZA z5siq7ZR^_Bv#oF2z_y`nrE%%b*!C0Krnb#&o7?ukdn()i$hNg@8{4+F?XvBMw*Bw^ zk8OX3Z9lQ?r?&mfw*MRRb>~arjCfQx=PSFXQreZ`^_tBg`8MRckXa#4#P=aTg!~%v zTgZ=GeisuC`6uLGZIcZv{3#etGmHHzrN5zK|#5=Jug^eoYo;6HanuZVec zLuAB(XncJ|QXJBF=C~N z?IU)GSUF;qh;<{@i&!;cwTRUt*3cv)21X2u7_9r>H5^ZP`_WJ%l!rt}L)M95QmSVv zbw6Uwh_xct*1u*t!y@AxRtBB;k31g3BSu6VPkZ$S!))DOAcL>i+aV~?++Kib^; z^&>Wj*eqi6hz%n)ir6G#Q$g}eXJZYbqR~laOg(YyOF3we38hIB+ahAih;8+Vh^->F zj?B3SvhVh@&)Oz3VnyDJk5mRb&>20#h!R=rJ4Wmjv46w?5u+oT-!e{V!Z8WG$mAMG*wB6gK6QSf{PMLZpGO~kbk_eVSsab3jq5w}O&5phGrjS)9R+#DHC ztezsLkaU1sv^ztcTO-4q1)Tmi7IvFpXgBxHh`S>0j<_d6xh3-4O7qdNxA#USZE2B+ zi*?$Vr91t1r7_Ngh=~yoM?4ZSDPnTOgAor2{l=OCYMFt;c4aL}`s>kx_M<|oh$kYR z6d$k_qPX|tqEl-(2_`yrSXq?vjZBGnCgQb-*CVDzJR9*s#ETKrgohE+MWmYKduDtw z9C-jFvSp@8&Hm*P=cS03BVLJkH8Q?mQHpAmzIe=7+;a6FJ;jtey%F(d#QPB+M7$O8 zcEr08??py)xS)^oPGlSiq7kW-@(i}eX_I}vU~s0|X07iK6g(qY%;5x%x#)~vv` z3Yp2k*GVZK^mSr;<#Gjd1aq+zF_V}gqKudo;lxxCwZJP@9MMFy5nn`n8POH-VZ;ng zNf;{|Q$@;R4tqEsTUrnw&~g+kkfn1`$NAJ={7ekCzw>!yobBV4_8;+e#LS3qBfhbN zNGX*Fo@TB1g+`eeip=D#RgW*067hS)9}z!A{2cLX#BU;s!G=x!B05!-y3M$I*B=v_o%nC6p#te&DD`usbm1Bm)tggAmtQxbL z9u%V-U>P#PN#zB}<1{cfcJbhtzaC*wY@Fe{%GW2WQ|4jJ(3mx2!(%sW%s~)3rS=x- zdrz2>{Iz3-YZWo0V@AY`jM*k;TRpU=Gb(1C*c8HRrs2hP8@7cF>fR{1Y24 zt&ebEOw7(PyTt4olRfDCw6-xG4}8!Fad$Om+~-EzkB!+Q=J=QsV#dYn8FOUJQ89aI z{Fr@X_KT5*wvX@x0}6#KWl&rpV>ULYf@_`!2$3|bZPhu*b`G}fA+|l#wujmF@R%cP zr`Hpv1oh~cV`7etIW9&q3mG7?!397~Os*|qa`LuwV$4Y~r^lQTb8^fnF{j3y78`f2 zJbS8=7B@R`r~!!Bsnqo|W6p{>JLVj_iIR_+CS zh`BT7E_LLrmV_0>4Rr2~&0!rP9LY-kSJBD)V(yQ5AZCKd#2&U_2n1(hY*Jq&Wl|Y* za%e06C+4A;mxP2d563(b^P~to=FynPVjhoqLaUoSth7E2BK6XDjRyF1%#@gE0%L4) zIG+)%J>fhX8>u=~6SgX)RxP$a-Gcg~hn*#kbDocRL6q3Xk(_!_Jhsb}1Zvu^h&p24 zj(I2MwV2mq-i&!GMnSQWI_Bjx=M6ii7=ohnx+t%d$~xYSc`v4o=@PRVW#T4}e(k&; z^MNJdPK+BH@2e*a7hAJlFW=HgVB0VziiySaB%ACN?M`aH>PnyE4Q}N2dSTmAQXmHL zN%{I>8r$D>4M$%E&kyyin2%$Vy(6Zf?Upo|VOiNHF`r7BD4SRMs`ZV05%Z;{l(0a; zS2175%!-wP$~Q4H#gSrui}^O@yO59!ldQ)8s~g4$x%(K0%3C}^h%g7p?6|bHDQIM@H`3gCI$gC zLjh2@r-1bfI$gq0FjPEd~7 z)niPyl}=<;PMu_>5brkSeF`RkzglA>p zN+RgBFA2jEu1L5tVXcI<6UHU%nJ_$IM8ehy+a!!k7?rSb!X^ppB&?gTVZufU>m?`= zLR7zgVz5GL$p#iUC#~naIH&R4ibcrWP?G$n37aKsp0I^LI@H*A%6SkZFWuWDS6p(6 zvt`0on!m+BL1|mfGhs}^&I#Km?2xdN7M`%9z-8Smicrh$>n~K9+rai{TL8FA!mbIs zCG4K)D{~mhoo+c4xuY|o5j!!s2`<}3G!jTC_304XF zCmft`NWuY$&VF?c5;T+rB!JiqF@aQcF-FOsLbGn>%-+Kj4zs_?Gbvxe5dxqfJjyVr zqZ5uvI5y$9gz3GEh9f;k+T$lLI-3tQ8t)|^J0~WblyJTnb;8LBrzD)JB_!r7DUF~s z?*|_@In2@$PuEk%85BAr;Y`inM*7Z5I6L8-#K@O(6V9`{EELtRE$TBTDFZWAVp!zbL4aA(3@`iq_L z!wL5YJrX7-JeY8wy*SCX_a{7%Fu{)YkxqWLb5ow4%5pVBeV*OfbRN<^+LJEcJIj21 zB;nD7#}Xd5gFKO-`?u_AKL7ozUDhaFgV!+rYMrC?Ov2QJX~HpK-Hpz(BDbCoH0D*gLA;hzLj zx~1m)(tpLkm4BETDLG4&C^`ZHJyYgP`7G!2oVilwPPsGV zu8dwO^Q3&6@?FZjDf6Z5m$H9K@030%gHwj2%%8GA$}%a->ba?or=WkzqA3feER?cv z$|9+8bjwMuwM(x))H4wi5xX{Mv6RJAmPlDLHF>AgCmEP4#4iJ6DGfEmSvocBpIC|h_q8>NQ)H%>WV zx=GpEEM@bQu_=3`Y>~2M$~Gz6YCBZMzM8X@<}VkY+(aqSSZBNq7jBobTZ&vp;z--4 z?2uah-?ls1cC>BB*mh^z?qb_rZL5WAz}; z`_iZc5-4K1vIta0dO*s7Dc7W2n{rUf!6|2@oSkw=%AqO8q#T=aSjyokM`#?~InoKn z7^6cv$x*5C@oF?7yykzjKrOpzjB{Md@hK;yoR}iVi;9MX2|9fBq?D7jFQTBK#_4oQ z${DGV*QciDz{%5Wd%A5G>@vqkbQ3;{1Z-B@IVtC+T%2-A%6Tc{Q_fGhK*-!N!49!3 zX_W%+g?2z;<3+Z!faM#Prd*bCMaq@>doM@3sYH&;QzO&m^t(z3-_Hb>uTIU`P@7q@ z(off=T%YnmN+;!plp9lCPkAHdrj(mgUQT%>HD?QGY1_%ZNVzpNvir7_+f(ik(WN|| z@>e8@MT+_*Kg1DSk?j@=404DPd|# zfJJLE>cw&+!Ac>3lq4lh$?WPHu?{OAbNjWhZE4%ewzX)%!bG>V_U5jX4{hfo+v@tq zDKl(;X`53dWmSa+dL^jxqrOP_GUY4HBsCFs33oYU^j;omn@Yr$)9)L*w3&KJPvgt| zKIMm$9W!>y_%Y=tk$lF$jGt3}5vR@QlkscHZ=wqgnDTqdA1QyP{H68U+(i{8h-M{} zx0%a`Vhv$XFOHs|6~SrUsF~?#sV4rGZxM0o6#?0!Hk76lvO1}(r#{uG4L18 zj9M%ESG&JRX7nh17Ry*XW0j0mGZV5@6n=?}B{Ng@vQ%dL8%t*>6;>ai=rZ<+%VsQR zJImX41>3G@+m&p)vTgNHO|QQ_`F6F;a8Vgnm+SC{jKLWjWNer*BxCiA;Ta<`*2ox| zF)U*(ZNvy??W0&zi<-~OR)&>M-4RsR&P>*~NNj{c02!k)*2`EwW1Y;D0%?*u5K_`= zT{{6~sVM_Q=DdPja*=J6v2msl7+Ym*lCf#V<{4WEQ2m_E^z?bmp>0C=H!NM8tJkjS z_!>peGq%atK4XW>;G|Y0s^2zaJ55_OJIVRHpYe-sqx>9uTFdB+F&W2aoRG0|#x5EA zXB?2RYsPLFduHsFv3thYj6E{OWqdWwsJkkK_U<#fgiz@0AB;rUTaU}wH)B6_x;c6u zjW$lRk~d5xzzS`flRq;K$~ZjZh>U|X4$+=w9F`feC=Ag#!`tfpQ1%EKS))o`Ix^#^ zjAJv7)BLTUO2l$>#xVkjwIE~xDF~uWEwN(RJ11tGlyPasWf>=DoRV=~#`ug=GfvAm zE8}cE`f2C%%y=ixu!Cr`1fnxD_Lc&_uyG2>E;vWKrkK8^1+ks;k8sYui)N!i??ClwM2>m1iEKGza zLNM8k`Y3hcW;yHR+?#Qq_&~;Q8TV&AknurACu2g!#EdB!&tyyz5osnFk7qoX z@leLY8INdRJfn5X?$iEGlgTr{w2x*?waE5F#*-OOWjvjsQYkS{S@&Wi!Z($IYAZ!M zQ!}2;cvE;TRv`4wcs}EWjOm$)Z)$uU9xi?>dKY`Ya-tKz%-S0AIm>pw>jCo;Iyb}1 zs56=jKO@LUGqQ|O>>?x1NCcC&P1saPj8Z(Fkj|s()S-qF^Nb>+%&0Qs3eYmYf7`q_ zM06xIQdy}|3)_sYj88K@%lI(kql}L;W(c=O*&-CBJlVjC-edKNovIW$DJP$2d?D7F z@x2Ibq9emW{Ps%=gs*J-b;dWgGt;);+ExG*l&*f+`9VZI*!TfN4nJo6B;vA|@N>p5 zw!gV&uKb?yN5&F4OXmEU@mI#YIrHWGt?d)%%;}NyZ^kU~`JC>#p*8KPC`#!XyIYU( z`8N8XG&b4kGUTP4_sp47nt#sRIdaI0`ZNtm(ocq(tWKpF_sW?^qgkmcp4L03PtJll z3+2q8vp`PYoPIgCK4;vOw|8@{>t$3dS^WaIhxW9gqGbzL5VMROxW zv?y66vSOrO>bWvomdaT=XJF2toMm#B%~>gD<(%bmmd{xsXGLA_XJQj-^+!EaFcb+Z zdw-RjRdZI$8IU8#!g4xVxx4vQWG=v}Bhzwl&XAm8Icw#tp0h^I(3~}M^A8wte10H&gD7l=WLL(PtLwM z8|G}3vt!OqIUDC}lCx#bRymvIY?iZm&K4F38djj_KG=yrHjyTMmCI}EoNaQp)h23- zA2FO+99#PHr+NiUZhXbcCfy-7D)fKV=%aJSXqR)w=IoraOU|x2yXD59{&W}TFyw<`xNkGXybz~8X!5*1&RL;>k$K=LusU;{NDDY~_ zG#@SM?!M0PIVa?tnsZvti8&|boSbt?j&9aCI%!Q1P$W)sd+hu3vw=)-G6j|3G`f?b7^jvkMQJ@oY%fH zPxLl7bazG0l{ru3JehM<&eb`0=G>KYP0qDBH|5-%b6w8$IXC3on46jlnT>Kc{XE>f z`%+MqlAt7X}WSBKervWIlPS%a$Tz3dnY?xTn7E8H1=N>^d=V9^xocnSn z=RBBmztDS{Ga+Z9-L(gDb2itmC!35fnE;dQu$s0!x>Ec^-2$B~okwyW&3P>6@!V7l zN!=3p%Yh?zgz7ccOH6L(7TC>%@I)Ff3uo-{BjV@MC3Gy0GKAmAc~ij8>EyhX^LEa= zVh)1mK<6DjPNtcP2d(+6AgL@w<#NAom$sku{~RyJ&k1r9rPA>)vtBdM4s#-b_Z^dK zs#V81O>X2)V*i-hHnUf9+ZMJhZCly4wyi{l{fY%lqfG)x8U2H@5B!a7BBcd=ZBnL1@jdA znDbN4?;_ZopL2f6`8DUa+_*G#xX@ZU8Qa1{Y)zgViRM3Z{u0A4=vf#+EL{3KH#+}6 z5&;%BMlI>gvR9nKT-S$!ZnoduwsXwBeuczA!CZyOIg!>R=*?ZAsu>Z2s7Z>@yan?W z^eb4fpm#x^f&~it7Uql^1)AqCP%PjG%gn{Nbkd8|SB1P6DpZ}!LkL*7pzdA+mt%9`+h8K(|%=t57Q$l-%Y(^I5Rll0XZI3akFdSHk0lHzm zg7phdE;yxNgMtkU_AJ<|V55SK3q}`=DcGc7(}K+kHZM%Ft{!*lQHJ4cQJ4_Cv=POs zwk+7HVBYl|sj^!Oe{}4jZMU`UcDB{U?QLg=f*ogH*~xa~a@@IKmx5gjcGDIsCw7EM z0#U)cnCI>VV+-~u4678SDD)=87^gMbJVQZj?}B{_4lX#PVBdoMwDy7nwdC%O>H_vJ zkX0-1fyhC2hg80U3M7R$u+fJ@3l1wdyx@q!NO|qG7?GTBM`~yLI0q`3;R)xc!l)%j zYb$Y%u@gSlUeU$lZ0C5}o=|Y&?CU2L<^{*P;nafD3N9Du3QjLLqu{)P@dalVoK?HJ6_Nb{!_ddVi0%4Ug#~X7U!34CdKBi!not^wylh1 z0rS3s`wN^BN**YfP*4@r1rtT81yi*z1(ORNEO?^e$%2Op9u`FxJYJxT%}2EFIM?C$WmxMe8 z(?!k&FBH637&a?nQ~|Q~TF9oqOTp8FUMYCB;I)F+#XW2qssJk>%R+yn;9c<$>*0K} z;H|=(((|^3hH(2Gix`p=?^(=zzu*H4ijG){c)RVp1)lxt+cvOmXxqrPIs;!f>ys3u z_Ai-jbtShq6t*pGd*oA2Q_yNt3VtZ)D)_MA^MWr5J`$rV__W}&f*Im zdDo4!ox^0F5444xUlx2-FjK6);A^`Ol?Hqxo?zoj0;9ksj-<|amP|x|O2GTE;3q-8 z;Ln1e3w|m1t>E{9Uj-8#3xBOq&lDqGTh#iY;r2ojy?ptvg1-y?Dfm~NJ&YkE@LoU3 znI#11W-6gX*D{TFmv^+Jd&zPo%a_bi(xaqb$$}+4OXe(@ucUX$TqSdt^eUOBMC9|Q zeZ!Z6u=|a1<}JrjtuqZh7S;iWelrs5GawONQI~zne8{$}Ywq zBF#!R<_4pjbxYPO*|=nrlJ!eADA}-NqtYA!stHINR35u*SkaM^btSc_d)#6;4pURGS*vNOO z_bT*0RpVPV<22jRb$vbE_RlDdIVrp2?2>azt}eNzkXepA9#52}yhtw)5sIEJr=rD*r%Dq;(dwQl znOgF!ki=e>PA+jKH_`7(YaeC;c@oOcm%LE&X31M6FACpu;E#y6G@jd+^hCLUN)tuW z=QYi60p|_v_+Y~TU$?X-H@NgDQR3Sr@07e>@_}%>_y4f*UHjbkES3rx{+epsQxX#$ z(S_wgeo0W$mUNYbdZ<>XeJP1c62ZSD6X#jetn{LBj(eXuLERw9WW&eGlB%RGX)Lc0 zf@!nl;S?==G1wF+sjTTkO|s;(lFv&%wv(Ar@`6@>o7CO<1A7>VHeV zEcv?R8|nX+ghk78M(Ls2P{oWkRynqf>3k<77Zz1qUGalhtN3Ka5*0s{{45SxF<-?m zCBK&ZRq}VqZzaErluG{81Z+mJ^cj)T2Rf&^mvzjFR7?I9_pX?yVpeGmY?O;Y@hPW* z%CI|mW5oKpRfYj}x9uDiJ?u|CZ9AuJ=d$hGwv}kpAC;4%XURI#>o$5<^r={|Vxfxp zD;B8eThXsF=ke;E1D-T$kM{He`wm}$XyJ-QD*9I}Y6pC#yK&+fo6#P*vslIGiDp*f zHcM74RWYbyaK+LU%T%mfu}a0V70XpDU$KIo)ytf|s7ENr%vTsr{)!5Dq*tnp5+XRu zT3NMXHLb2>ItDAr-4vtW~jg#TpeuE7q(SR+;ljl+v)q zU&i^bkhH=9-~VLJaUHJ7SB$I}RhiN@@dTxnsswMH%J9JXt=6}0WmwR973)`QP_bdf zz7_jbY-AU{Yh^^t#SObJe^ zT$XowyNc~AlN)w`4H<|KcCxo=n?~!=DRZ4`^h!e%-TT?}~jY_Nq92C+9OsL%ECZqW@0L;yW3wcz=7_#kM`5;=qc7Dh{qV&t5sC z;?Rl{D^997tm5#BV=9iVIHKanilZuywzvKNUCVJ5$J<{|_&@W%>|ygzt>Wa0Q!37= zIJ4qZd)sN6p}r0@Zy47-|8LB*D$cGrr{dhoRC)hDSp7ekXw30;g!3ydu$>DlF0!5f zp7r0Dm)I+p&c1$G#pM-O*soXW5txUnT}c#Cac#w86^~b3S8;vCJ;H~I8!B$BxV7Ro zfnwIIn<{RuxJ5VHLs3MSa%CSr*toxLuehV)u8O-W?yQVBR#lF>i&3Q{Ri#RaTfR2X zXzBM=++Q)d;=zgsDkfA+te7N<(5sYs84;;!Q~gEyhUnts`<#a=9( zxhgeATuzFR#JYs+6BSQZyi)P1uv$n}F}>pXiYXP(Xfnd*ikG`Pay(8Ir|RZBtHoOB zFC#^|iWE)(S*-GfiWe(h(#_%wKN|_96X!&9dW-12*3BiU@mj^}6=6kG@rDSk!WYx1 zcuV+cD=0Pjw}mZMLwKh$`p>%+@7d1#w*A1i9oxFL^=zv<#ZLq@5v%~KkWgHaRHPMI zh0ger+fcH5#%NPABRD8BB@t6rRKk|eIQKK^iblKh5!Zc0ThXN*Z@Hr7Lv4D+ybbd; ze5|1=&Z;@P=97v~#i?or*L)@>Q!!V~+%;cRd|B~l#a|U)ReW9XqgZ;yHx)B0z89<4 zgL)g@b?9!+w-w*n^WR$OMq$q3rbEwOPZ> ztF`{HbS;J>Ui5dxKNa0-y4U=$CLrwj~y$=`zVUC&}H9c$Q ztW6czx-$&N7Url*NSRlgjc~eu>h!9ar)JTb#dJ^2d^LS*`qlKV=~FX*%>p%V4r9(W zjj)!0s0Ny7%j@>s{sn6ms#&;Zk=kS$i$bM2bhj_)l*{pvzE1zzl(dL67Oz>NX4#tM zYL={7s%Gh$Woq=oBiZIUE$2HOlenj`Tcx+?{^e^{s9CXQC5=DaSVl5=g#0VlhS2mB zk<2Q#ziMsBVKv*TGoUsYHPC*QK|Q2q^_snE_O4l@W@yc}`l)8knqf7Y)@)X@R?XTq z!)r$9as7((aKYCYSoZ`%!QyP<72vhBvU-Nd%K zStsUgUb98bmNi=mCIbwm>!p_3Q<2ZswXvB*YZ-Cc#M5d{uQ{XUObuxHq!P4-ePTQ|LK0aY;vwhMoLlpD%{w*c)r_yX zx8}Z@^J^}sxu)jYnhR?#5`NZPUUPBHCEDm&vo5XqN0kL~j_Dl)z0CV_j~l=hHCNVL zRdaQ1a&KhE3FUOWtuRyB6eWD)OXA?;H}&ry1V zFkjlmZ9;qBQEj!Z{AjP=S#wv--8J`!czZgJzvBovLOk&5-Iqyhm;WAnU3Q@Em zFJt7MqKLNY!gOMo3dc0tk%LSDSEaw#d{pysO(R;a>8klq&z)|yBU#Vyn9-;a31+F#&t8PDMDZ|e3?9RG{({w zBbu{eu7+L>^E75|b2o;0E*6e8x=?BhYjj3@K7#G(BPI4AM z&XFrj2UT@D5Lsc%G%VY&Lc@v;%jt1C#$4QHnBi2*Yh7{(pX97$m-dv7s#cD1V_;G& z8`fwT*f6MJaKjME@%xMsefwYb=myJw6r__+duYR&4Z|ANYEV^+Os9XQ znE;szh-55pqI$Ps&WMJQ4PzR1ZWz_DPQ$hWRKvOr>osiMuuWsE*Yz7VY)lAjgT}Cw z+ib_6<8U?AWkV zV=O^!qVdxXch))E{5rZp4rj4?q0lZ3yEg3Auy@054ZAmtZP=q>YGa(?vUFs_iYuiEdBr&T$63`!wv^uwTRe78CRc6{IWGP2`}zh|+~=2Q?hraACtm4Tm%w+Hgw4 zsSSr|7aERhIKJVCh9et}X*jkqo`>n*7$xK=3znlB>h(R0PnbbRh9-Az&F{!comHJsjXZo_#EXEdDIa8|?Fjq%h8+Tjqxy``+4 zBjg%2c(~zt?TF~NG3wTn4Nuw5qYaPQ&f~V# zPfys63WA<)j68bQwo`2TjBTgdRxdr&uhVS*IonSEKi6LnYRNyQ5-{6&so~|>S6;E5 z?fN*cH@qQAY#Gw>X2V+z|1|vD@OHyHnnT0)4evI**U;7QVZ-}EgN9CnD+s)4;?yF> zV?QxUi_Vnr#A=2ZbIfmyh88r0;sySm;&rpHFQ?)! zdw=uazij)*V~$4nNKB()hRCfkCxOU|rDAg>Jm{t2ihF)4lo;-Oro}1?$fC6V@&grg0j6YWTU~mxf=3iaksnx|p6~XVU%j(%7?Y z7TF)-nGJt6{H^&v=*VBKlMOU6m5PgT>GM)AXO@_MOW&4$EwprN>D4k%OZS#JTIOn* zyEPf4Jz7&d*t0c?t9EwI)~sThjw0`8vI0bRI-N-jVcwScT6(wiX-$|?2TAD#VQNLQ z^5oConqv+0#|2sx2iaN&-nJ~%vO>#>Eep3S($c?W(H7}}Qqq(vxvxTU`j-vn>Wts< z;{Pp6=!zA5OWMv-Elbb7vP{dew!fThm$$71neJbyW#yKEErVKCX<4;3C-ka@Vzt)b zylxoKnsD2@DrmJnXNArsZp128fw+3h8ZEoD?AkK4WzCk2TQ+GK*0NU1x-ILqtlcua zWmL;Lt&v&coFe}bEhAgQ&&2`s2$`Guo3?D$vR%veEt|J&(Xvg;wk=z>Y}J~2bEEDGo$Qe*Tel_;vyTpEu$rwNC&g@s zmK|GmY8l;{cScAiN=uP5P+8VvT9zAcrYcdmb8Fs^rT%U$yK9$Q4sRLTvPaAQEeEuW zYuQudx9r=RtSSw@mjE)>*}FAGg*xL%SF~mO2_`+ArZE+Tg6e@}}9Th3~^pyk4rv+a~L?eVsA zj&0Ai?Rl+{LHbGU`S!|x+jmjRB`ufQUoW=TRrapi{`>W^*>_$k)M{DmLl*y#t6Q$o z^)5zsac#?WEi+rbZMnYXhL))<&$isya#PFXmIqsIZn>r9&X&7cZf&`(<@T041bJ0! z+LArtq%w0ROg5rfFuc3vo|gMt9uRK#H1Fz_+I+8YMj->yvR%alO~4*{uj-76Et9mB z_KZ_q)NK#7Jlyg`%abjSv^?7KSj*$Bfu{tev}K*^rBouN?J54-N3TL|dAemv%QHfZ zdHimbj&8DaCEX8BR9VlcGGSeW*sr?7wn5g1#y=qvLbs@lXW6X=z(N zY5BCJOU|E`k6J!%(OTp>KEYO@&JY4vJl{)}uZ^pI*7AAFS1n(Q-O07m$1MDdmM{N% zkbRkp*87d6VgYt-ThsJi%lG1_UG(YVhn62(X36{0#ZN6ixBSuar)Z?**OuQ}e%Hp$ zFfkXkipc+`!1wKC_T?{aXv;q>|F)*mN?Q8*yP6s()tM>}LBXjoP{9P>2#mZf*(na4c`gO5X7fW}sU>6H@v1k{Ibs6JM8E!hYZ{aQ$=`z|# z|1M(*_OT`A^QZ{DTecYmCEhtA`WYPuq zZZV|Ael7NIF|@@#E%t3OTyO4ScAE}sp>1@_*@S^+qDetfkWr5x&|*Z3Q7uNd7}-J| zQI#?f%-^?$xn3($7n^I=2a6I~oY>-|7KaK-Eskz+OpC)?9MR&)7Du(r#)q|iqoRxK zCB`MprFDx!j%{&Vi{nLLEt5sBSet%Y)C5&66B?o1O((ZFMa0nJ+!m(_ye-abaaIfY z6VB|<=`Eh$&^g0mS;JFSx!!!XK7FvMr78NnTw&i9=eM|^#f2>sFE&AE`Q#H^E&7Et6 zMC}4@8K3-hwpHhP+quEEH`?~5|N6EZx12>XrX(eDTr z5l$@^46>B)oPEPoVWGtfEnaLf{r|jkn)vkpf9K0BUitsu_L{x_^%ifmc(cWf7Bm0P z8{TU1_W%EecUrvr|G(k(5yspTX2l)vxA>sN$1Of-@u6gxvcM+tOL13wAyh@m zjVq@p+qn#MO~g%Rj$SByNg!+1ayp4bcXZjwWthvpE<3yI;xbqxaoN>nHave(@}D)5A+E8%1blfUBmm_H(~z{QWw^_J zg1Me`+27>=mr*XG?JOjYMrgFUSy@1Ww$_*Tolc*d*ujCW(ccbojRie*S?6w?LtPGY zIl|>g&C50E9E!53bc4RA1Q>ZF^ie4uO5!@kNU2bqW&gFQQ^IXmsB3w>%Im6{l zmy=vhb~(-EbeH#f7)m%rh*qFe1h8O(l2#(cy9I4IqR(oXb?(dET}!*jAu^ z(Pi3#{EP>++pMib6$_Bu_ivNSIhhf!TMU z5Lg%Id;4F}qy)(Fl4CBu%g+L)OW+a;dM>$3hhb*zb^A# zes}r9fz7Y5bzdD1JUV)G@{IemgJ){nO1uoS z+O@=y%sNG{r1LD~v9QNM9tV3Y;?dP(fXC(@i+U{Pv9!lB9^E_^_vq=dl*i47(cMGY zK886vIk58G;vxBh7~Ns+zu^JP7j^H|^*F@mSSkHG5GnU(;S(-L`Aki&_MA+gkR@+V+aRwXW@~x8SMuZD#}9>V8pg zACLZ?VZ9CQ#l8#f>}NY0Ex2=I+u3Bne>b(A%@+K33y&>5_Vd`^V=IrXJ@)k&?y-%> zwjMishOkA7+j;EdnKfvjeQ^5)Z`;9kc3ki_ahwdgM^qrrV^@#eJO*h}9(#KXvG?p@ z+dXYNc)?SG$zK1bKh*a3`9D{NE$HjeF*&T#OK=^lp(-5$qz9Pe?2$B`aKc^oaobvF`8$$<(mX&DmL z9V7Vka*nlgA9{k*)~8rT^gXL?-V zaiPaqB3+O3JkIx!wW3gn9O>uS2hSDd^fk%J(%VH;mwszZs*5}>_PE63QqP>>s5C86 zpgc=jXq2gPnTPZNP3>}zF`_Z8IGz!kS86;u{L!{odt75X*LvJ&JNnmk9@l%^VE>d4 zN`q85<|g~+&9+teQn%gaal6NoAw5Fw@VL|C6Q8+0cX{0Hv6;^RpL;y+^@u!TkNZ6C z_jt?WZI1^$9`tz5W2(nP9uIqr^BC{(h#1P_QIE$g)^1IWL8m1^%kJ(SjJhkBJnk{U zW0J>H9#42&r^*i=N*vN6F57mZB?du2Y5$WwriiPiq31nb@OVXn-Qz`%X&x_mO!v%LIdl6MsOp7M7+w~f?Ewd3tIc%&i^uC8Z+N^Z zz}otRWq-5%Ru0k`o(V~d6D8#oSe)tcj>l(u+~Zx3S&~j3A9~F8m?K<^k34=@$Pk8% zbUDgo`%86HwLN*BKl1oku=SYhnH_L*hdEEmB3RNym*z=8^)(qjpL!-oR}xase&O+@ z$9GEa(M6B1J-+eyR#c6l8MOk1$WnTvXjqeKdANGBN9dUfGoGfS^rt!a;sVtGS*FLIslMy8v`^-dd*IW-r|>8}{`C0Eqw=UVBaa`&>B?;JSg&-xSkh?= zu$BvSn5oqDpFERpts}+78b5pd;_<7;Zys7){;&Z2U7~oB@tI3i*!yKi2VVc}@sG#9 z9`il3tL5}d_|$jgMU;gurA4ZR<8zhWUDDB~lh2|)i}`f+>Eg49PgkFXeDW8$PrH)_ zIt%+qualERb6iE`aiopdv!%NEEbg;}&yqgfeG_)qx;$=kqnC!)@L1`b$yoeS>9(ApH+QU@LADkC7+dj;{}yhP1zl)7Oqg{;ZkVjyYA$y z=Ciub8a`|KW>=Twq;zRzhOgxtt6aysC;?+_-`Hp}G{nX0`K<5L&u1f_4Sag}^!DlF zn{a@vZ_VyBMf}G(8~R3)X#MSLpWSJasixB3XJemDd^Yt>1tHlrV)K`0AxDrDQR!y- z%H}>>_+0OEgU^;eTlpO6bCl24KHK>0>oeSETc7QG_VU@=XQ0paK0EsC2M%t_&jBGm9u@$@j2J$JPm0vL)AKu=Fi>C3-`1+kYbz*eJ=93 zQl##4vCkzwm-~$I(V;e7N14t0ms)gRW?RV$>E~DY%zn>Q>QK?(*M%3KYkaQtxz6XK zu}0urwSprNq~%HKieM{VxY6e(pXYq0`rPbui_fDzkNMo{bDPh-KKJ?D?sJD^zR%sh zQO>2ANF}&akg@fGGO^_(dT`i zcYS7Q?mlyTBfAtOSK)e{wYOeZlUgH)N!oni^P%wK^RZy{mO1iFZdh3d(kKKdsT?AV zdFFAB4LB~~GoR0W)(TiV;0y7Z&p#qUpRatrmXwyn^Z7<{%*XTbeZCX2d|E!PB$8-j zyrc8}jGuO*BkM`l#NC~pK>X;F_@uh$dy~2liM4TJ3$!t|rk0Gj@jaaTXBz%0d`h36 ze17(+d}^OYLee)U5J~8XJ>_nd*ZK#^i7ll6;`6J|A3lHj{3aPP&=7_W z@AzH9$HuTE2V^@)I_)vh`OD{TI|lKor15-TC-AX&K=%LwIs_~fuy8=ffKCCO1G)q# zny<=HGP^W>1=dxpPl(e3y+}aUfW-p31uPn%3=O$MWs++#)rzA$TLDLvvNXsg0+tL| zCScis9sxZAmI_!p;FX@v)>BQwn`R`FS=6oomh-!_T)^@HD+a6-utH#tNzw|U?Espr zz`Jt5DgoM5wMJlFHvy~L&T4^SghQ+kTvHa@v;?ndAD7r)Ct%%xT>^FuSTA7xfXxC1 z1Z<$E0{R7P6wo`MPr!x&eFNiG-QyXz|9JjQvfhdI=Cd}z_5V9 z0ec1v2^bo%mr&Ei8S<3L`Po~yNg($&s1X(E<>D{pi|!jRJYc_o{R2h?=Fk}-Lib3w z(H8#Eh0$0>ntyS4z!3qX0}c#0B;ZiNN7&bSTfLow1GBJ7;A_FsS0pVD6P9Nh1w&@0 z9K}Zl92IbMz%hY2jYy=ZF&u^?2xt$ro)s967X|~~4wxBmq5u_ed%zt5CkLDoa9P0R z0jCC>7I1#R1p%iAoDpz#z&Qch`6bDDrtbO6kn~vrciY_iH$Qf^T+h_oIXB=u!Pds# zMM4(_ToiCgz@-A9O1gbuf}0lyMwyXyESA)020Spk?TO`%x(a4+T6NP%rL0DJ%p= zKRm~p*kc!r>d}D57WBv2&iH`GZD)dQpIGo;<%dYwmT&N>fXRU(i98(`AGPqM$%^=u z53dljB$6&Z7cf=)8}Mqt^8qgeOb>Y3a)j3X7XzkQc#2}>ka{MKs7bKY zX7<+tUJrO9;LX6;U+d}g=f1{)HX|@en4%3i9Nw~H6Z@+e-8%vA2IK)nz^s7TlGTEC zz?^{h0zMA-B;fsk4+1_6_(+4FX#5*;KdQ{^X0~*gh~$O=&fI``lKJ{*z^4JCL*+%t z=^F)nb4S0uO$g3I<(tSkIP;2Yrt;-e+B#<@Vn&s+m5jCXJ9-n zf9T@U&eA$$+>-Y{hI!3$pygQq?I&MWhz7lI$RZ&fLOOBf>D_q}Fg?81W){4JoFOyTMf)7iC zrWWGDI;<^ZsgOYtyGJY?vP{UtkVzrShAbCyRLIdG%ZIEGvUSKdAuEQg6w*7SPsqw4 ztAwl-vUbR-A*+R~9@)l_yhdqOkj#A#z+OF=;t#MXnRFZpa29y+Y%6RjEdy zX}ys3L&G)y*#$4#kiAYy6-#ay(l=z2kWEASg>0m^g=`!e%U8iiC1Cu=^)ff~HYrG( zg$xMUB4o>uEA}yKrApOpuIbn_=|nAB8Mg|J|5lLvWPr16$aW#aL-q?97_xoH9wCE6 zb_m%qWH$jPWT%jePGRSeT|%P)O1Bqt?P_r$7>aa-2!XedOC&T&j4EQFx$GITSI9mg z!$N~8Nu<3)hJ*|if~-O)K_{NlFtoKDsXC z`jGoV?hm;kHT+w z+#PaH$h|^nt2SXkWc`W3ikcUGa2^kxjjO8y*H7mF@ z5RFjKmewR4U|h&}eIn#Zy}YyYcxd9_6Gu1`^q?v)*_ftuW2Ih5y%8fk6*4*Gw~*gM zri45l@_EP?A^Dr)W@h-R#>=@08L`8ed0kWWKC3z-|DV4_qk zIpQ>cdBU3YV2GULFH$I3(&I}ZC?pHXHQV{^lCCW|0BPG#DN!exRf7e(8hq!9iT@^i>9A-{%Z2|N2UQ~G230cPFQT9D}2zVG-W z8mWfy{VtI{0^?xENmAbMtAf*2}!tj@3E}hqPR*G0TVwH$hBjjY0D@g~M zYkQX{M7p$eHj%*^5o<;ah}b-0t%$WFHi+mIu};Lg8db#lk+DO?disPkPvsOT%qN-= zLVHK_iP$KjzrAO}h`tfpLni{BA$?D4rCw|6fo~kKNn|25+J&*Hg}`Q!iG;4SgrlEA zt4dklB4W#k9W<$kts=IL*fwIj$dovcTE2~j)YI6}jg)5{-`vv~7_q&5zj*KfYsKso zv2(;O5xYjl5|{WDRJGjvu0;2_&Tay=Tq`!KVULKx5qU(R!9?t(@kiVpv3JCfh|?p^ zh!`5NPsAY+heiyG*f(Ni#Hfhj5&K2#A8~*l?_dI^7buPG5|ef-LsDX7L}Y4fEGG;` z92jv>#KD@{$_AU-&n20ufn6_^URs<=c1Ii@abm}aJ-(ib>L5k%?{Ajrll4x;1yqp7x(>u; zG9l%BmcV%~VrsGtoF21DOdZikkj5+- z(~kH-B08pH%#RU2Mf@!>9`SR;FA={-{1Nf1C1B}D%Kw*)`Yl56S4VXM{-CZueWkU#TUwl5z>VhX-a~ju5^m&9Md&s(U>kV3&kuPvq)@w?;>6K zjpZJZzf?j=dWH6&Ef&))X7QNrvEg_5Oa#@V`kNB^kDP7BAX4lR(=%r6m~~>7idi~l z<(O4smWf$5X8D*EVzV_#vPGKAa#CbDYGYB8(FtP%6e z4~DO=>gv2_qcdXgHDgmMaIM$~Z9!PUlyzg)i|G@yVa)n58^rXA=^Y!CX?c8W} z`kGBl&`Lt1Z%n_Kjbi%8$hR+vq=Vz-^OwI`W|7P~>0_J5Y!-7+%)v1O^sSh^V)l;N zB4*2&U1D~P*(zr1nC)T)#zsVZJJs1HHc18B#zq%X1VO9Y>u(yFvwh4CF+18Z?-U!S zgtEAG1k%p2i9G5j+TJZ@P|V<%Jq5`QW}C_G8bC*9kJvEmc`KP+0NU#zty{~Scxp(@ z(3k^aM#StBGc0D`nBf{*h^R%bLe*B1hkvZCDzKj&;r=2vk%ZEIVn)S`jyW(knueBg ziIg2|(QBRDEHHtBg< zP`VlNI5sw_ng~w@&IvIm#+(#$a%}dS$Vnw{gO((zK+2bR$74~<7F-@PCZ7*kNM+Wv%ORhmcL!zU@ZYsGwz7F(*pmln7ai8 z83@9NU2*PI?} zc|2x<+5rZVQbA?EOPc9%DS%JJJZULM`ivy@Q!$fcricw=6BAMLn0P^}v+A@zBm62G zxvwFWa}>*qc|PXtn3*vz2*ok4#k?LfO|yuZ9`mvUNcaEMAeyXmpkkAJs6;8{6iITv zD#Eaa;TsYuF*9P`ih0kT?V*mwpG?s%)2ok#C#YtD`vLtjCnt1j)j;g zQ>jW?bCoWx#5_%E%mgD1J`!ukd=fKPWch@#hQw})naYlvCrVQV>CR4Pn;rUj%omb! z2@55B8S_<45|hS!9rI0$Dw8}nVv_c5*5IH^>iOo`B<9I=@65b2ZZ`!PXG7!ygX zb#WB=l1|&PyCZ3-6;SqgtT$MHX%>^m%-25>ikLE{k*F8M4mJu^CB#iIj9iQRtRxrK z%=)V=Agu!SB|nL@-f@1G=!^L^=C_zXW234`AWK2|U1TOnqCHcmI^sU%^!^p|cdTtD z&OiFs{`@QUv{5->bB5AB6FMYxO6Z)>F)?K)Wjl+gBvQnia)?R7+$oal;4GZ5NW!uS z%O!M8STteDgdPctC3H*Zp0Gs1zOuGd1t>8p{WKd9_-34;BArAgdDSyvsf48ymPz<@ zS+hG#xce`8UbquBwa6}?utLJB39BWnn6Og9$_c9^NcgAE*1G7_a^c^BgTG>n5z1u)aoX$2Lr!F_nEt=#y|- z!s!VcCiG1hk}x!(U&2NS0~5AS=%280!j=hJC2W$gX~O0STO?@HleScBmYBMig82Yl zw=No~$6_DZDQdS)*d}4ygzXY!Cu;w)Rvcv)8!f^fhAuDJ4uV+1ZV7`Dc1qYeVV8tm z6BF-H1Wn{5JW2voY zI4t3C;V5Bv!svtp6ZT8kKVf9Ts6_ij%yJ-4$N`DL{)ogZJ;J+Csg+2d(8~`>I5^>u zghPe*{)V%_=IB;Q{q*K)20K>l1EBxG~|T z#JGC&yEEZt+rP!Ox7zkL+um;5J8Y{vHQBoo?zVs4W7~&pd#`QpOSs>59!Pl5c67f& z5Bfc9|I`~Ev7NEDeKavqHeDQ_@OZ*g36m2hBs`JuWWq#ofl;EI4Q3ljDBXLK$j?&I z;Z{aXNq9QpnS^H(Q!`n?i&LzxLr;lup3|B*-kEC2L)*j@r;}*uV+n+Wxe4T4O9B2^h?<&HK$E=>g{NktH@q!w@6W@fqYGyq--jHqzp)T zxr1}+zGexyVm6hYBJ8H#`Vqv+bc20T7{<&Mqpp@NH_7LcL8eynvQ5|k_ZhFmFN!oXC z#sp`tl)Y09NjWrSNXpQZ{ZkG|*(YUK%J7u^Qe(-A0{2bLS}zdkLmIhCqRBXwv>%Z& zGG%nifhnUj)DeagC3~eayf4qj>yFNtlg)Ba%E1;jLVA0$b6CpZ!g$KDDMzFnnQ~Oh z(WzOHWictbeZ?@teHx^e2~qfQDaY&aloLg1w*IzoEyg@a9X9!R!Z={@=a#qTHDfg$GopMgfwJF!7oSSl9%H=6zQqE7gAm!qeOHwXOQBsgB zqimjYk!Zj&i|F>!6yf&)*SSn1vE+T7g~=5uSEgK@a*c3j)BkS$)43`&2L}ig;-kAe zn|c~*uTQxl<<^wjQf^GSDdpyrTT+uC|UOv*HIcgnM(%#^7q&ufAmj5}INoqRY4^l@bAE9n1%I6@;&|5rPDx>zIS z)s)v#UeOn|_>MLOi)7bpI^r7bTag%<+{1Y@WrpNTN|f?e%G)WQrhJw%Gv%F>4^lo% zc{gQN%AAz?Y|0ib{O08&bYa`A+gbP6inB@Bp!t<(eSS+zoq<}GC$?_ls^Q7 zl)pq0!;KLwOYW;f=B2Dr#V!^0 z?UJ!j#wIzN<}94CNXCO14`p=CSTy5+j1hV^qgzJ5jEyoD&*+}9O2(=gOJppWu}sFY z89g$3W-OJlbcRfIiB@S)+FLE@q2+Aprwm^#m$7`t3K=VArZAMiBH~we&`KFUZse?- zAsH@{MD(+r4U4Rnv3kb(85?A*k+EjRS{Z9+CYMr@O}wU}2cqqDGS_RS2qlwZ_8W8;k7G6o468JlKosX=CJ zmN6h>^NcMtan-@@ViXSv8Ra#};c&2$lv>W#8QWy+lCi7cpiN#fY%^2B?j=nmW1t?l z-s9~x^6Y<}joS zqBvrRAakx+v!tyJ)jhU=o2S&-jNuvkW$bU^e5jJ&IvIx20w*Swnxr*lWX7nB3or5I~!T0w4m%utS0IH_buWgMMxOvbU9 zNz;;cB&A5L3?HovT889=IU(c3jMFks&p0XLiE#vNtdopg%xFh4vjJq;+_Kk5NtZAk) zzVzn*G_HH~#f@&yzWl3M?&T6xrT1=@a{gW1c~~5gk!9o>SjM9n?_|82@mR*V zjAt{R%NU>Wc*dlRr!po8O&L#SOcWla_AAG)gHa)*ib#@cf;)6~CTC2^csk=5y{(5K z28~A~Cx%t_k!GYte5zPDG@s*6% zgq@66Gh-PkgeP9sGJ1erOc&O2lkrx@+Zi)0s5M#fzK#_T=%k!T`&wg)Gb>|u#@89& zWX#EUFXPjU&obW6_#orsj88ISk;$C-P%^E9Nl^btosnjns`zfM#yr}&aIAUTJkg}J zXFnJEL`52vfGH2{B%_1~#o{21K@*Yu`8MOb3_l~t_&%eR;bwReeG28+loG*EEGBCu zi41naj40FYSJKR^;ISQy)+{Z)VgZ@t60JIH;-f#DLdcb1%vma@%BV$qIpj1M?Tp_u z{>b=2(l6tej9(?Jx;sB*re@~0Qq%+L7S z4nQ~GKhwIz^=8M|ahmD-9gKP}`O_h%W6okZ-EunRbk12w0zWrV@-DeK-$X7!y+J@z zIpsxi!*?=vbfs%A(YYmZq>4!E6Ffyu`j$vt<6Jst znVhw9*3MZrXStkJa#qb*K4*oT6?0a~4GT*FmRC^Zr=5K&_O)_u3`s$95#@m?`PztTG&7~^Le$E^OGa_eX&ZwNx0&FiMmsD&) zSuqD{g7fD~-4!0yIVd;YAqlQSa}LWnJLeqHNzM^D$K@QKb7am@ImhH2n{#x|H{+Z? zKQ#rnC8B?`YPNu>pC))h&WXZx&S^O(<(!J--R(=A4&vY0hOi=jU9Ib79U!0+e-T%BL!7l!&-kxDb7Q z!6ms->Gim@?#o3;IalOdX~|5ukW5p8nMAaTy31{)iC>d*ZO*iumvXKX+2=f&Gco6e zoEvi<%y}s1rktAvp^ad+z1_BV*!E7_-eudnZF`Sx@3rl8 z$H47v<+?0p_U}tY*GL`~W#){{c~l&yqooHLH=6d#>swk%9ux3Y4@4UQMDTJ1+4k|A z3AXcuZKdz&Uz2j4%6T^Dxtz&4Qw0BVpDUT&v_x|#oU}D ztdi*>PLZ6}Yl#$@-h$iooR@QE<;>1`CFj+g898s|yq5EN&Ko&ziZQzwT~{$ay8{m0#$UsvYdy_|!0bvo_lj9lJq8P?~~NR)eF`rSg&CHf;9`) zDphDRyNYxQW1m|@Nv%y)@kzm=NpjScff!fO$s(G*s@@&g3SsB=nVy16i9xa`??WmLXbFA{3!EK zcFooW+Z1e9Ft9K_fqpG>sP49f5$TFsDYHT&R75~1+p%D$f{~FRU}VAYg8d5iFF2s!m3ItCRnJfYM9)69y(yFazRHCa+77_M1&8Qyn}Z})Jy2hi z{4b3Bm&}w-B{EQ=l+GMEyx@p}6ADf&II`fVf};zLDU4?Ip8yfRAFBy|Y^)OT^>GEq z7sj73YnpKp$hmY~7bdKBNCd=-$!tmGWg1HUjo>g#mL0pkk zoKtYF2&UxClJg4AFIczKCQ2?SxUk^Ug3k&rD!91dVGXI^l7dV1^@5uVE>rNg;F^MK z3&s>&QE*kk)dh-MX<%0tMrBg2ti-9XpksP89R<*@E4aSkhJqXQNH0h37v(OB#;)mW zq@oh`^5M=c1-BO5U2spqZ3VX%+#wFKFp+Yl1yp+*?-HUr8uLLiWI3zC-CJ;9!Gl6; zVRS9=^8J>21^EXG6!sDjjDcxwc8zds!J`Fl7tAbptYBQheIFL+thRq(34{+g&-l!LQ$yyFkjxhXo%M%q^HF z;ii(R8o52ERp9zWvQDw}6U+tyWh0AyWZ-;W@I}EN1%C?81z#1E1(oD~!8fAt0$<-M z_^zN;;1+x@7XHDJwkf+_Kog*}KSBV}r}f&PAS}oVa)C~pzr+i@oka9$(XEe49Ld;8 z1rr;ckz-thWU?JBJu4fkE@%pV)>jJJ1wR!0Sn!jCr#b=U&6nHk`5(5k27zR2S6b< zshSJDrKwRSQtVn9W)ycXS{fc-Ot;yN z`iqxzxBVq-`^iE^uzWIwo~4P!=*YQ)WJ{K&M4_%PTe4iqswJzHEMKxh$;u_G=+B2C<$#f9zS3G(FIl5x&62fBW3h_+{@W2Cc{ODY5{7G+MqaH` zqGT-rXZ?~5N=_&_v7}c??~*|!yO;DS*|21*lC4Ynmh>yxv}CiAjY|5LY+SO59glK% zwbsjFrBo={1ro@{d9I0+Y*DghX>1mWDY3H*3Uzd9ukI z&9P*!lHn!$mF!(Iq-1ExK6<~bydLJ}y(T*4$3}UO&=^*-Z)q#KTPeDK$pOMk$;i@# zijMAYCMD0O;6F-JQA99MF@D5`@q+=ehj|9^gD%ywyIifWxyapBQb4t!FIiuvvlCw(AE|E1P zSxH*=rL<@+={V=2(rm1|*ix5-@MR^J>un|1l#D64qU6ewtAupVu#%C$iyFKuJyjX7 z(vGezxvu1fk{e63_FXT?k1(k+5{7}@>nizhQ>o;6BdBi{7DRHY7i8PpYg*Xq_u4z}v#oBsUtgSM-t$n&!@`s>DCQ~|Tk=H7lO>OqJXSKU zWPEA%EGPj$>>$c{ykvsKtd?2@TlEIH&EJ>gFPT*GRLNvqwr_79!w?t7DhgQ5@GP7jSip474DS5Y~C@D*3mCP>r zPE#wHqi0LLDEU%iq2z;-c_p7(TK%x(?!RtrE8+Dv3+H62BxU2}_iH zr}PFfjuuKuHW9g284-3;l9ps8xfBwsM@i)qTWJLsHh6mLv5^^sHoZc_Dr)`Mu(%|%0%NRcqnut&VZ zKPCT`bgt-9F~8I~yHL@gG9`1RH$Kh zW-q7edmMYVBj>>98<-_S@op*1-6|HZ*sfw=MfZv&D%Px6t76HD9u>=1tWeRjVyTK{ zE0(K}vb}U=v=Pz3GL>0J^b>Y8U{Re`Rn2b2ij^u>tyrxxJMUJmOr=c~FI`1{ikGcD zD2meJyLx4;>^1CrgkQ~l?TU3OHm%sKV%>`MDmJdzL~|cu75e9y)TP|^zV!hDRK+$G+g3=6+oEEt%G6}rQrE>h zk2~AhYED~MOgzXglsXbc9_G%DO7d=Bu|vg>ilG`z#ZDE2G`otOD|V^aRR9+RtQDj9 zqf&@PhZ5-n`x`&l9u{BtUVnoHrihV1F zSL|PLK!s+pU&Zr1jb5jPRb=_#X9n_up%&Ru6{9N-tT?DLVM>km_+BQWp-*dGl6wbN zM*UOZ@34x)D;}#DS8+tekrh`~Tvc&Y#nBaKRGe9HOvSMkCsmwWaa_gm6(>}js0SA_ zrixG|TGH1g#zk_U`pzj8rwZd0r`xG%WAEUuCPn$w_f2Yn`daSKsyMsiqKb>9|5uz_ zabCsw71M^BTt~U@{;R>Fg-k_nE~t!8>B7o{Mdbgyq~g+wF%?$`dY*Hc$g-QWelO?p z%E)BJ^0fb5R+UyIF_hkLb;UImcUIh0ac#wQ6*r6ODz2}%q2k7hn<`@^iRCBHK|zp- zIxR)qAyS#?+*)y4#qAY$RHo8}V5kb}VlmBHQLtXtC4P6sJrxgDJXCRS#eEg`S3FSh z%Q&Ow$lEME;dh(mB5-L-aD;}2=t$4R$ zLd6rpc*TnqPl^=9gB8zIOsaTFc&wNrdh2LnUUIT&kSd>|K}tdj#m`neS20zjQZesE zlMbpe$Pb_;Pc);62t?C_riwQz-mI8j@p8p06|Yt%E+B%G+AmorepeRs;O@?AqHyWY zqL!&9i(^K`Tax@0Gb@t-pfy^uP5=}QYwkLFKxW{qirE!kRD4-6r{cYePb%h0hKQFd zKGcUKUM%o08SVV@odL44yFV6zDLbNzDNa7G;?s)HDn74_Pexv1wQI~ayM`qbB#njZ zuPVN-a4WouZz{eO%~Z531xlW;t`eY?*?ptIODm9gl*%Cm-q*#7up$zFsi>e8@7ggc zAtRxB)(9hQ(uzzXw2^u@KNmxZbZgG3DJ!aqjcWSW)D?|nW=)TpcEt~s&X9nbA1i*U z_`Twfil0Ri6~9*eX2pvniR>UTtZeGj-nH^Uhx1naRq>CAt>SNC*_PfCRaAEM7y9N` z#t$Z@{!cV@sOebKwPw+pPBooty3{OGo9y>B3sXl$&QDE2sk6#tSh!}9n&p)4xQuZy zE>_d6X7QTtwaNcf#6%lod-XE7*89yeR~uDxn$*aerE1owS+i#8nq_KMs#&>aS-q`h z`I;4K6Nl9jqtu0qm6?yTVr_P_N@MY~qgfS)YF4dTt!DMw_zy*U8j`f)73LXnDmT7V z?zL*xuGyfbSIs)Qt!BNN^=lJ}Q!bx$554xK(p0(=zYA`?Yx>mmt?5^rO@h~Va5mJ< zeT>E{$tDk^FgQy7v_+kbYc{Fbzvh6NO=~u**|lc3ngKPNYveUM)NE0+WzBXq18cUb zO=Mx4+8kvf#@xE*uchsQ+6n>JrXIWaLVKxp&@sfFjk2_3%}zBt*X&Z$j4}=c$p=AR zi`0@Y8L6w`4XW9_W@ybmHG9+yuGzC@ui7M{Xib#)CiOs}D5)ZQ*CwDaq&6C(J|x9{ zm=IJmyk|Uo0;Wam^xeapKFe*Iko1rn&UOL znv-izsg1CbWvx0bC)S))8+||+f6wmQlA_*uyfL^=uQ{XU%$l=mb85M~(<)@7{hR0Z zHx|9%GorV1Zq0c$Gex>J=hs|NGq&c@nhR?#s=2=AhMJ3OE~&Y)=Bk=YYc8u9Q*%Xa zoD!E?NQx>X({>eY*jSYeF3tDqnrmvVt+}oy+0+1B0$B^9PK^C@mQk1`Om5Uf^oE*y zYHqH%rRMgUJ9NM5C-iY{6+klW5PNKzFBZ8)5iG|GG<@-pBdjDekSgujb*J zM+9@}NYkDBYaXyqJy`QlZPF4XpB1V9&o-2tl+5|!LX*|`Sk1Va7j<*Z_?pLSCf7`< znNagY&670~YqTV36Kegl>Ac7^qSXe-l%!G=9QXPYhJ63;VJsmw=^9km8mqVmQ+d9 zH*03pyjAmdZBEbG)=osrkX(^6-bFSV;kz}nYVw+*W_Hb-nlEdplZ=fMU z`nu*DO|ZtV`BsD>#MQI}_O8aSt7JI^J6r*0b94Xdxj7&C0GWQ8rf^-8+V@Kbh%8~p z7PewcQL^%aGCjDVVd{(Q?&h+ll4Pj)Tk>CwU-NU#FOvT?KZqV`eiF)DW0Xnfmy1BU zv0x~@LSO&2=C_(ZYW}QI7NR&pGVOPv%v$T`^mn8%3ka&W`A^NilI;zh8|K%lvIh+v z8WWQExTm$gU*e26jr{D`nCuiSm;JQ)w_%}%g&P)WjAuYhq5U}h7B5eHLTOHZo_&F>o;bZzQmH#kNu4-l1-%Qd_%iCy&L*8Y}g>`ong}sCDvr7 zJ>VKRZ`9DgVY`Nb4I4LX(y&FtmJORWY}PQKVe^Jtm4(~OEF4|z*;i)ZWz*VYQt#_LmT#KIHcjwhG7l+HjHc- z)iAtazlH-EMl|f-pq+ZhDnYS}S&~!?P;yBfEwA!*jBYrv;UIy%F&QIDN6}%yQvYO0 z37#^ve|XC|tl@CsuHm?bBN~ouIJ)5&fon@6H?&e8B^X-WLw`O!%y@)E%*QvJ&~S3Y zDGk~Xb7Es6?Be&6G#;BUARf^G6vflV=0_vAykShk zHC98rqTxzGxZ&!?*gjGl1Xzvg$#;zDCv=>s+FuRVHKqcCF#E>$g2?6 z_Gx&aVX~;m9=rTt!xIfpHayhuumIICwqcwYP_jk)e{JV6JB3lB%|)HjtaiM;{&>R# z+qq_lx%jYj68p}H4U-z45|!GQ=wE;1tTKQ8l!m7po)P^>!Z$px-CGUMHFTB1qCXp6 zXn3(Rv3Gc{Uy!|YJsY4~H18S`whsvYDUL0+YLwZ~TJdCKY>geLVtgHEQ_l@A*} z5~3SE5ot+pw9`~)u7%7z+v=&$8a{9MLP#ItxDB2t(7ykxhOZmGY4}#eygOqDnQ^|S zI8?*;78?3fzn1NveygKl_pk~ymO(wt&adMGX zLn#R(JEZ(NOIyxQFwo9~G+WvP*`=_q=Xw%d7m$L0T>zj`*(>4$g zc9s>aM6qp_w;lBbuJZ=5qP=+~+rBZ#jAYi8&Z_p$)od#=Ufq63G{2Un(B_6VH`;%# z(`LIi1KX_IW<7h)`fWtso3`1YO|Le++lI^Z8>te|Z8p?T#Xs#m8@1`zW-H4s%M!1Fj)|PGlnLmFkeZt)W*1wrvPo zzd7fzeH+bXhc-L5dBOr=r#3s=>0j1nmo~fF_nc>6yPKX>bv4@;U+gY9qhmnZ3~sY$ zo4wi`Fx2^My5ZKn+Z@#9;5I|r3~jSd+g#M|0NWX6+kM*%x1IfLyT5I9&-Rx%BW!=9 zZAUG*KH7E;w4`F**5*)q<-|6JEx70CHis|hA7ML3wmE9Sm0yOLVI0%u*acUPvz_B@ zdxC9`9nDE?PPYA1+MH=Sdg@f$Ijzm!Mrz_pCN&+bicRxPERMO+^1X-=gvY z3x5&Yg>5cc(7(9NCANR*f-4dumkYU;0I_H#Z<{Itpc`x%YrMnwz+LV|MoU_*#4buCJlA&T5x^pvW}j;r_H?! zuH4t={ssL9+B|6c4=uRzuzmcIHe>CTN83EsW?Y-`ZJuxQLYv3!fS!HpJ0Sv(rzV$!(^zdAiLrZJuj0wav4ZDgKkdnxF_?!r{N49(mEeYI>WO+f1|l zmu#zl{U>~0Y4c{A8Esx|^P2tF>$ZKvw!ic>pH};p9sk>HW-hq?$`AvJ^M*R_XgY(O zcWtXHbL^d;wfWq3-m~rdZ9cG_4{iIAZFTdGl(ZMAXRcy0Uz*9+STY#Z7(vTbbJ#I~vA zzwPJ^xhO=16htcaopt;FF?A(iG*s_<-tXSARa6oRB}pQcWGg92DHU0w&_X1kltf9Z zcG03ev>;L1g=kgUM5|Vb_TtXn_y2p|X?}nAxzGE&=R4o|&c4i?_k)&Y)jUwJSfqf#* zd#OzmXqEu)Tb+`?ehKWKK=T9+NVpvv9t65&ihFN7H!WKva8kk@vp-N_TPAQ&0<97_ zIDz&F9GO7t1P)2K$E6Pwwn?C^2qkwd@D3Gk7fHAzK0JY5jl3fy8Lj80J0x&a0$me0 zI^mY79TVt%iPt58PSWYDcqySl=8?~UACo}01ddOjhZHVs>>ZmxpQc{-1ddC%6Sj=^ zgY8cL1exMx^@+0FQ%*+FE8)&lQIq^+m3eQ~!iay|b2OVc1<+u^9rHU)c)F0zGZN?< z@qP)M8S(xJ42bx^1O|zpB^(^dha_-z#Lr29uTZ1G;R&3Za1H5%0OuueegccydkAm= z)04mt33oqbWC9l^Fgt;J5*U@h=mhRaxXs>+5*U-fRS8T<;Nk?vCNMF9%M-XHfpH03 zn!sgj&!1v^!d(UM^#~IZ?)VwwqLUlx+~;gC#9hu`k-($`u1sJu6EM{67P|Jf$Q^z= zLbp741u->&s}s0Bfg2LICV^=QOi$oCwuBnqwQLN#xb0;Q0tFXe7dxQ+T53Gh98w+L@#26?QVOIbY}&FcbMyE6e=yGzP56SzBp zS!|-s+A@O5o`PUX^4)q_c?0i}?UEzBPtmP0_%RR{Xz9b|ci+mu1>k{}-&X0tl{ZOBppGvr1_*nuQ zqC_$ypC|BzcU0Oj9G_+0|u?-u(yjtGn}mC-6@K|0b|qayF{Y zJSw117Pe^Wx;*bP1PLS)$R|)pAeG=5BxE_@v%j#-=m<*oXLpjH4VC*0Y{~2_JX2TX zu+RR*)jmh3voUj>do6Z3;huBs$R|zOxI>=QU(RKDTero{xGX>{KsPpmu;d0qOV7h-pjQfl?aeyMXoxuxEh! z0rui3!E-F_z4>3eUd(>MXNtK=!smP&251zZS%CclG!C#&fPDir3EUHQZ0EfCCi2cs z(*PXqK7HSPr0fiy{}0eSK#Kqe2JQd}hlm3LclY5rjnaJaJEP!z2X^pQ0S*puRDg~F zS_e3UmIE9fpiO|b0S*n&E&z8VIL@$VaZiA|0o;;hYI%0$hyd*a92uYki>02I9pDnP z;YYXI!{b}bHA8g@&^bW20LKRC5}<2PZJBp^fHMLN4lpEe({W!WhM#&5++Es!0nQBE>(qD%zkh%Mfg7vY z&UsLFP=Gc33b2B_t$T=^jLr_+BB3@H%rATA1Q^7VLIH*`YF)4oXOj3%OFm@HY7KBn zfN_C)dmC@O&ROS;P>dr3To_lK^8xD5rDmPJHHicdx1wKL^Rj zF#=o`;PwD_1eh4$@&MNcm>%GY0Fwet2{1Llm4SQX{Uz;PW8+5j(V!>jGRK;D!J<2JYk-cZ9hAPdgL&xO#xwm@nN@xjArW zvu6lz5#AbLaa$K1ZH{M^1-L7~eF5$dFf+j20cHi59k^X4-hJlo(3T_I#|Q5T+{fd_ zT;Scy;^Nr`F4D}K6X1aWj|F%XD`0z4{GYm!GH6IN$| zdw7;fogd%{cCIuUr12!%e}F6_3h;D*1p(3lG65E{3IeRAg#gbm@c~u_SjAr1)_XR< zk^oBs_hvI@hn4$W;BGE(@Ar9?_#Ue!!21C{ z2=GOKFV&~k1^86tLk>FuJ{JE($lJK=bRn*ngwD@IHU!uhNj?|3v#s})$j`#BBj0aC zHVMBC@LeSTUgQV%3z459`DT$;qr5GVHJ$H zO#Hv%+XL(nNklrFVp0M4!qS<`+`%M{Z!AnMcc0(}NLTNd_Q(e)uvAk>rcew}3h+q^ zpQca_+^29V0jex9?&fjXp9GS4H|3hQB@s)aQ4)=lh$rDEQ9p^jlBkh%iy!{?OrmBI zwUVeEN$Mt1M|>CIu918yj|XjV^r_ayd+e7`=y$+=cec6w%!+q zx`WdkPT6huNn+n5c1>Zo6q+Q_G>KD_=#xaVB=$?9LlQ?N-5PBFq-!mQB+)$S#wGp_ zNTNj&2PV-niGz|jSn*QcN(#IiOU}EHt&?sX;EUYp>hr_1?V5@#gQH;L<#xIT$~Nu0^DN@7$J{gW7w z#CcL1n8ctY&JjN=vctAFnDwqw8Y1D@Nw@pW=!VM4foqr)h9_~ZBrX}81tJR!nl@8~2hlJjcem?S17acL44CowjOOC)5bs60-5ypRF8k|AD}#3V^33NII4A$(9t zrOuT}Oitn|38x6B3d7`uc#R~}lDJl6x-iV$4N2UX#3M;On#4^>+$^uVl9(Yv`*(=k zlEkf%ojaqlnwiAilFt%8l*H^L?h(H?(z#Dnd4Cdfl6XL^l!<(hEmjZD zh6$$4hm#2N_*fE;%fi#bxxy!e^VmYv9jG5R=_e(BN*Gqbf+Q9uu}G35*5-%q4LlQqG@lp~mC-G(yZzb`HG?z#EuO{(Y#Cd4y^(0m# zu`-gpk;JNqhXuYmi8YagnSDEncam6_#D^S_BKca8_gE%PT?+YsUy=`m90@;4;$!h| zlK4dAvm`bo@u~QFAwx07jY)hi=T}L55y`(43ELQ3J~h8)D^iQv6zP1M#CJ)2AJrOl zSTa8)u{nus61gOPPGUpCgux$7;h_{Bj^vN0@JI@erof}T zp@qj%ZVf;_S2}BC`H2*sOyRi{o=@SaDC{#SJRR``DJ)E3QOdoMm7i$*{uPfOUZIi2 zYPZiyZAl7CBmHo&S|;aLb-$Ft%PG7f31^&FMQH7{)PJi5^4BF?AzUe3C43`= z)go(zZwjgZRtj&6zY|H=7`RA#FNL)!yr04cDXdH3qmw-r>Q}`lI)!gi*p$MrDg2hg zw<&y=!cQq|PT~6$en{a*j%?ga;M=gdtkr8e8XV$X=y^YL0|BKZQS1_$P&bQ*LMAPu8Ps{-yjLZVqej~81JtBEjoN8<5kY62Ga>GSF_viOWyH8AVe}JXUt4_Xt-(8IGRpDtgOk-o{P4 zk-23W2dCX(=7ZAiNLwoj*%)|Uv~?PXq+P?{L*;EGZ!6@E90RsXy}=XAGk##=4?cT%Ls2s;bu)kXHZ%Iwi;_YxAW1iGbhY#QBJXdin_ z=W(*h_fGTpG)v}$GduCV>nI75V*eMS1o&Y29w6K;G9P#OazAC$(BG|o=rtTcEehMW9@({2ZzFI8YJ z&QWy3q&YOSu)sw+T%377UtXirxG0Sa#2MoV`HoEELJ`^-mBzHaok9AJk=g{J$k;S4 zNn@Ne$16I%E0_;X@`M{3;iYL@mUhpHOiY7YA6H22av|ShF)8i#tM93=z2!8fr14%F zYtxvT#?@)eOJjZ-*D&fdW~Xsa8rP;VU6J0F#&v02pT-P1Z&189g|T!0kaaZ3RS+A) z&1v^hV3x)$p|7ImX(iUh?P=VR#?zg>JJXn%#@%V$mBzOBya(aZ!%|}UXGx!@xu}1y z;(8>FN7J}3jr-G>BVR`JpvVJ4X6K#|x+OVdc z=LnN<)%_xq+Sz+Gjn~*CWSI&tr}2uc(T+=M8n37EW*TovVMQ9N(s)A=tz_Et5*4PO zZDzG%p@lW9h1M=EcKo-~c!w>Si_#%3#&@N|uEAP^^C1P2(eG zDvfW`_%4l4()g5BT;Ka54W?(k;@z0WXK8F;2DvlITQ(b9yIS7H`#dV!FWH?rM6ki9 zu}Lwq5GHJLg8=UeF$fzThr937*vyue#t$3}6_y#H?@vs>^2L`>(aBI-)E>yUsStio zKWiQEKIqmK?vPfCTJUd!dMtHc8&zJ7G z(zA>k4;lML4#GTfok5KZcFkb73~FXjE8|AgIvLcK8Y_{?taLu*#G=?GyxV6n-X*SBBamEd^p>bZBk~GPn zX$BW$Fd~Cy8SFmW8TjXVxA%9C0~{dV78&8FbI!xQx4<-9x?;eeZZV z=}VmxGFYu`w-e>tOJPqE^6nCKdW$m+H++m!Gw4G#l^bufo|D1p8Jv+pU+GYJPzL?P z&lL6-4#;3&#@*MWLYS$uBp)oKa7YGcN1SRbqM;cKQ(2J@7dcmWp74AjR{|q5xG;lk z2DuDIsXE@x;Jpk+XK+ylV=}lngZnd>lfl>wF3I4g3~tU~Tn6Jan4(-v$l%fpu2f6A zEQ5&|OvI|;QU|I&(WpKTM zUz@>n5w>1-Mm~AL3!fV#xiPZO=FRp@<2-@PLY|SqElgMjw`Fh-J76d8_6+XG;I0g2 zswLlh26?$yAuI*%>!SgsGk6IdX3X_bDJbJNN?`Jea|A89blCLm51r z!Ga7HX7ES`k7n>h22Zj*bAgn>JgOuSii^|NxQdWnIFU#NsR$m4yGI%kAmonh|` z%x6%@;E$iZ&-r1mf$pVk5AsZJ24%K1-VSE>5%IFlSvw1en2?f~NL=V=Q6tM&(4bZp zyqpOSJ`u_5NMRS@uEO1fv`|;1o^bap_7K@K@~tnjR~8K-$=)Ijv)EV1vGyU!;)Nn! zETTykO|y8ufMo?VV;ZvfEQbv_?4L#REH24mTn-0h(IShBau}1tfmyW7;-DN_<#13I zt+MEz#c^32oJH#_4$tCtJw~ejX2Fx6R^gUOO-)eZ6+_Y8IV{YoEoD zS$D4WXkmveI%d%+i=*V^;XNLWtHV3>S#-_1^P*j{?o1$040hldJe~7AMh0o2TNcM= z5%hJ(LfUcLKZ_n&{FcSs-5`NSzMFFGB%_vre$$$77ws;vzVU6by?h= z#T`<tJe0-5SuD(AQ5MY3Bl3MRi$_Hs6F#2B+(>_(B=d!||3oAwe=3WoBl&`z zJB!6Bc%;t+(yq?91EMAIyUlw^q_^R-=ES8IeK~`q5DvNir zcvr$Vl!i6ptA$L%n<7l@TUopv@i6#%S*(+U4RWo>`@#>RynHCHzZcT$OOdaHUkkqxZpz|Yk?(}mN;%HgCO2IMd>hm&*Yox>?PoSM_4K&QE5+cd@8^-;3>=WtpM zr{{16^VQGg`b^3D=Fm@sS$n17e^XT$c2EvyHWD4)jbMVh$lv2y)Jv!$aJd1)zgBPpN zm<*IX;KAGrS2oT&j``H80EIt{i6OFfr%m!OL^FB8N#iT$#fyIoz7V0jQLnsTG%^c?B@BkB|@|mYBuC8+9?xNJ4v&emby0!;up={V^Cf>m z_@wYDA$6Y4VL`-)eTQdquGzerR@VQ9-yvQ=)3puULS%j*;2J2|Y&;lmu>mBM=x zt`)v7WXt&=3d;hdg^zOhSYFImD53Dv9M(%nPT|HJK4;&_D)JukkELuNb`U^_KW2EOV~W`MrMX;HQinQyWn}W%H!ZX4vG>$Ve803 zn>-GQco?v)oaBe)ad;jl=dox7j>w~Z9$oV|I`4+HBlGBxcf%w3wQu1laXLGSbjqW1 z9$grto@)#7n7kVej?3eCk#2b$E9LHa3?JZL2EyjVg!Pc{#5_*OqbDQf{wm*Z(Az1n z)%D8bBnc^}gac9Uyc>}?xb?~7G?rTdjSDzEk2CUEp2zEX^v$Cmn<`lrJ}7j#By@5vxH6B)c}!KwP;yn?JtaiK$!Lny!fB4r_*|36v^=iO zyPI_vJC4)tATpdCZaIfjk}+ zVL3mT$3x-|N0LWGxXyVjl02TrT=98ACW*dJ=J8Y>&r9;OaIug!7v!-p;*0WlCgS1h z=vg_J2$$yZT;$8Xuq@&)h`gA`OCm2vat=^jvcAf~;qDNt{uHp?uE=9$9)IWYPadoC zcq5O`Iq>GOIuAZ!#|nBY50=jwmCTzQb9CYPb{_BK@opaPDT34PS(*tx<6G%O?|S7f`2wx&|a3J0uC*pxdOH<;2@C$ge?j&wYzYi?TERWReY)_B0{GlLoo5!%zko+nn*$0M$gl;BC}2Nka?n@{<)bynu6Mib*=Jfb&($EL(aJM;35l z0b>ieLQw#4Evc26W!sjojFsFbA6zah!>_Z|C3mXl7k5+F8qCp@7#5Si#=Pz32i~ zDcS63Z>R=24y;y=!f|qqeBUhKEfEUe7I~+DcO%JrB5YTz(D&8;mkn^E(}x9Ylo#9l zM{2PjE7zYC@TuhM3mCHopD9xtgw$kj{X9y^kh}3!0bdvJLjgZ3>^B8$k|rlpc6k=y zw~Fz*0=_S}JzECvu+p{Ip9=UxnwwdP%zgpC6#ly&XU4Y{-0b#y0o%fg&JAwU1kBFd`n zas}j7$ZYck1ux235|#_7h%f;0dAbHU36Hdh+T@dJUWX!%D!OY8mJjQQO{Js4GI*yVIv3HUh^|E(UBn4R^ep0-C?&@g(M|kV zVRs=rETiE6csYAS!V@E#Cl%34+@<6+oGbI7+A!hBF>VXvx_*Vh{2J~A(5$}k>p&FVMPp&B#i64 zh@a0kpdeuaMiy~l5u@ZgUN~CFcrPkqjQGXEvBFD=7^mP=2p8?l#e^a*m2W7a*X43v zCA^}DNg~v|Qe?6)Ou!Uzj`sAuTKpQ}G~u;HOc$Z=bt2anaYH0wQ@Kf{bh9KKR$@jG zw@7kp5w{g_dl7dO@q{FI7I9Y*4;S%B5i^UpyNLUXn8QA$cEvQ`Q^f43%)eaWI@-NO z+$RY~Bq}^0{$LRg72VuT35Pf;ggP5mxcYjuh{uX}JhC%SWUi2N!Td)H29Xj#H% zMQkXdehGV(u(62Gi}<&Q?L~aSp@ZB0MSR6N;iFNY9OV2? z_}OZ#Zs`5MPRA`E;ZH?uE@H9`_D55NDDPgXNv_fSRDl5K8rI%M43c{k0 zN6~1rqJSJDm`;{5CEPM2E|9O4+yTOvBu{R4sj5*z%@XQLzm{+pVeJxzH1z6-vt(#t zSMl8xw)bEssVB+qlI$Vev*f0XHp+Da`8Fw`X$gCmz(QzPLL&(qm)z+ZYVK14i*a9t zYSq%Er;lmbdANi)wiMA1Afrg==32zoo)7^eDMEQJ+vkPlY;B*h_XcDs1l( zPATD@67DVG)DrrXaB&G^Sz;xeUc!a4c18((nZXjyR(d)%_WG4@W(ob}%UA}LFhG_E z3io}}mDO2_Ww0cJBsr&qp(TtcVWa{M6P{PXaOs>YWbHFY=PT?5!da7?gt4&h_$L`v z!srq%Dq&2Ryjo8FV5D$K3FAt*v4orCJHCVoC0tr^9}8pH%SxD7!qgJ3mha`l$t7H& z*e40ERJ?5YjQ1)@rU*B8clAXh*C^EV5~fLh?M}YeiC-_gL3Y?v!caGtFsp>wCCn({ z7Af2+J9n0Fo1C``?@%b#8bjSBK2!3$#o5PMwj4T`4E~>L?%h|y{Utn9!owxZk--N` zc!1ya7Qgs$s+Y`z6_t1pDAH+3C}8>JWaQ(geBrjh0h6}7qXi({V$Z4uBKo}iUBr-n~C3zV^*e@+1i|dz?n=Dw)9ZqtkM{-O6W`6O%~FxIL+OqxmOtt%Gg7E&ob(l!Dku%r@y!K z8<*YV`3=ix#J{o}#gF+QO8yl)RNJ z93u!b638;WO#_g?#5NeNT{uo|1&|o>a!kETS^{meE`C zKEhLkr|zVAn)vC$yE-{*{lo_d&y?l<;{0GAeFusU67oHnlng23>@sdF0cl`Pk6qNFWjJo5sGD`Bw>C>i(g#E*fK5>A0u4!g44f5 ze7ta+aG+8$L7WQwzWl^8E-&NiGOj7(3dye$PEuS~mNB^uzE73PVTnzV?^I!EZJPLX z!fS=og<&0CFFQ9#5?Z*qj2UIzTgH85+#>lMW!zcDt>U){Z{JD(E^$`w3Fr|;*ahmd0fhK6$|Y%*H4u3WErc= zSX0JRWjtNR3uU}m#)2{yma#-pFl~#?KQ7MJlXYk92qzyH#*n^2yU<>$*- zCT03E2=S#dUM^#K8L!LWD`mV|#%oGUxOy4e*gJY}ZvvP7WvrCW8^TpI)!D6i*a10q zF?PPu>&-IWlJEOvyj{jSW$?2a^y2^BGTxIH`CB!;wc@;r=PuI+WvnaXL#C5a>-jH! zA)4>W`IxV~`39dzlVczw`mBr%?5!1d<+8Et@T)SuF1uZt&&&9tj4#>9HR*64fEPsH zl(9)_Csgn)2a_^(tDtTL-`J;?KCHyPW|GVs7!b#yRd!->dKDm&n@GAp;v#+pH7cN!sS1&#Rt2>y zs3V14D%dp&La$J*UIn{Xa8L!UD%hifJu7ZV+`oeQ73@_(6FDhqP(fqyy@d@Ud7}y* z)M9uaN%j?n5{7D8K{HAAi}b^(wz-@KRL~-lA1Kn2*Qzx=uR&Y35O9k!ZWL^#v;i5g{;a+Zs3XZCvyNq{?;ySv5PU4*_=u&YPM@(v0NkV>1 zq}i>4V964I3eKruXa!$Y@O1^lDi~hD zJr&$r!MRLK1vgc2a|P#Da6tvvD&Pp=B;iQmg~Cx4j25}5f^i~agcs8$5C4c?B4kxE z8RNw#2BaLY6VwEn%C^4IgL3Q;bNIC-|Hfs z>npgSf*UJt<#r(_ohD9aM#U`xZwyuFDvx63T~J14pkW?cZ%F4;Y=YLz}*$h z5}z%k8g1TJ!Tl9{RKdp;%&Fjk3SO^Z1>3wV%$MdvDw&7H9}zw($z#%aToRg^Tfsc> zFttyJKUu+36+A7zIMQ5D!9wvx!e@j-k9FyJwt^)UEUn#2x)n2IJ zMM+)~Qu4COiX?2|uSvdK*i)8Qimw)~5>ojM4h~~oy!@}J;7!Tjs^D#ru!!EN;9WW2 z6Rs6f|NRO+5ML+!Fp@LWC*rKQ^%Z<79=4^=D%eoL#)^Ag3@v+72eey!j)WqFhE+X}wp6i~qrvhZ^STPpZbL4K-WvxGDl+N6bFD%d7pHk+*+09$&j z8X~=Zui%dgc2tm%B?v8aMoX ziT!hlHLRjh6?b*8nH{Wg75h|i;C|L}Kijv8CRI$SYg6l5(<-;|@oe0d#BIMS_OD_b zY&@)a6$ez&+p|+VYr%k3ew_zftK3KBBe%G&itDRrRmH(oKA47{RkU_;SDqcJIHbyV zW}%D3?|8?-9F3h$dm+h@RqzvX+<-bNl60){dxB1f|ISr(5$`HI zI+7nF(oJ}*u)FX$;qk&ARdkaP+BvbxJ8|eEc`xBfRh%qB-`-VTpt%^ilp^wfT9v~o z&Xw@=Dle&=Z{I5VRdJ^HS;GFp0m6a8K|(6?@yWpvA0l$L@EqY#;jpTE$})`cyec0Z z#keZp9>yC$7$JoVg;W?>#p8SYS0CCHgl5%FB zh$K%|@l?b)k}Rxp69z9<`7RpnoM3Sk&quz`RMCF0fVbqeM#zeLyNY+jKd$a{ z6;Q={k%hHYyf6NNa9t$-P~;jgkIWReUb~h44#Z zxZC!1r1Oo)CLt^6yDGjH|3SF9%Ev|jYt=thQBw8&EXkHg-l(y+t;+kSsO=fQru|zL zzssx4k+6zCtH{dv7YD#95><>=$^0YX_A34rd5Fso8Q)RGjZx_ZQchNp5=mE)VMA@; zQGpoh=M+3IEL2exDG8aduofy+RI7Ytr_l+aFEnAyv$)76C7_0QO<^rzXQii(_%5F9 z>e+6d)%EO9&)Rub&$Hb;MtgU~_ui1td{gWkRkW)SDlW-?P!4 zUF6vS&jw0iglB_1JIk|So(=bGuxCR&JIAx3o}KL(#|_36)UTWrwH|#9udUn2N z7kGA_OmTG)E>u`kVL)n*l-Grxjq+@bS~$}`#xgJ=k1>;+Cz1<#f*oGgCbe!MH}diIfc7~?0Ned^hI&pz{Pi)X)hw!yQFo_+1vH&XlDvoE5s z>_Kc=U#b;-#dzyDr%Q=vKX`Vc__v;Y=h^oP!l9mjHnSf+`^mG-p&e<4ZNBmD9z$*Q zY@28QdbZuOUp@QHv%fi#aQz>}`Xpm?E~9aUX3GplSs1}tf_d|m#M!Wtktb9>;bSA zur{!^umfQ&rFMw$AlSi?g;pYAbgf}wn>ly5vv8=q4v#e3!48W!^^brXuiEb;%dANi`;hubn5d zN%Vr9q;#Gl-;-gzMZ#6b7_E4zd8&l0h|^%F!_JVCV@N-dzCw@wIy*mY*tn_UjO0(OX58*}Y; z5^M=|v*|4dwt6{goZi8I|n+Cf%iv3#H^{^XY(`i=1wr$D&YhTQ%jZqZyI>78MbN{NK*@#v8t{J47hCQ)(PlW=e85jGShfse54eO87MFKG^-R z$6$}c=D;4HO&IUBJqUY979JMzd>U=CFo`tssC1}CJ{L9*_N3G(nGbs+;*5(56!QO+ zf>5#mwotJzlG%(czFH#*t$hglSjry>DG66cpG0-^8EgaWE7;dk*eLv5Nc&%id?{pD4#MBa_;-?Q zisavlFguL&d+{IG1!{QA%Vs(`io!gzEwEo;N%zuCH`H&H=62XNkza+s$;(Xyus_8A z6#gYN9szRSV>gn2g*Vf%a=HVSfCVxVc6=@j(y$DyBq42PMe?wmNI0+*+@W39Q$lCh zq|1_2q884m_}kO0zFEvHZnmr0Zf3q&4YOKiwT<=bZeG_^r=vC6sbjW_S!kAp$u%vL z#AML7uG#M9S{Hde`~QBlhl118ULyOL?Q7P+Y;UuMW{o6lY;Fi*z_5flwawq+HIY{{ zv;9PxnuY74dc3D#)>=YdmNqv#K=HN^9w=-nJV@9|$b=ot9PR05+i+Rimg9-ueRr+d zp=RyO4l_I4>}<1h%#JW?Z`RA~B(o#UI+%4cJC*!*7O?4~cR# z)NGj97_*DbhAYSjvyo=!nw@8Mz9dY*1!gota_Y0L1V}D48!g{aLVnVMuhY3m{O`K% zLz!dEE-{;AcBR=kv+-t^nN2jC5Ji2dl-aMtv|TRe6~h0eHYAhHrkG7NyGp*ic3>{9 z7Qe=98Y`%sx5oSbJTlaDwVbfA-C%a3*}*Yu9kZLvZZ`Xj*)f}8c8l3Uvqdabv)jz( zm_49?x0~HzcBlQfdb!JNX2kDi_3@ss**)gg7_-dSlF#R{PqQZ6|2Mnej7u^`%`dbP z`RDlaAl29=%^ov*C`#MI5;<#8%-%M8(d;F&6=o~VE~x9h%pRm(^NQK4 zETVl}F8EDV_M_!yugi;HR$brAeUoUF*&AkWvRb+MBjam?VJHSFj}!|czfo$&K03?7;#`N!;Enc_wSO@&?wa|^bV#;(9D z$u!sTT1;>g(2w1`wB#IA=kvC&S)OBf%;GUCFqBMjOfQ+0&G_jN8l+l9@@h2FQWy@W zkOIp#%$F}`Eg`d6BWB}fdo^ROwTB6=Ew4H;x89?XU1PSJBz0r9cgz~btX|A^kJ%nE zHvm$he$4iaxiOP{fw))98Zd2I?@>aVjbhd~W-Vl7pP20%vt}{dFXjg4CK5J{xt10V z+6=gV%$mpS0C};@!>VUQ{IjwSj9E+Br~W}PYbCXC24vVnLAY6cTm64<6*ey8yK@eF*_?}gJU*2W*5b5NEG7* zF*`eE=g2uUX2WB4Zp?z{E{xeIIVoqcGt?M4FXh5M zW*5h7tels`Y}C}&OX>EQ9n{sEA?GbIyH(^i zVK{2tA%3UuuAStwVm3QwAII#InB5bzds*X({l1vpAG7%}dqRz5PRt&T*(2f)Fz?cN zNEo)6N5vm!GMc&MJr;92T_pU^mDjwe9G;BXQ!#rfW-s$QLwxcpX3xfKNz4|+Y@sBJ zV)jhT7K?McGF)rX4$Eh0%$|$c3o`h;a2flrz9$vN#p-)e^8dyDO3aqW>~#rW6}}d8 zYsL9W+X_kEh}p`Rt%_L>?LX5LTPATen^O&UW%Opu-iq1VQl@-u%--P;-OzhilJ|r= z#(KQeeP8^8n5`4}FlHZ#Fcc#VXOmB3wmxRH;#NCupT%rL%>ItqKQY@Fv(IDpL(G0u zkS}8Pb;DP_h9wPOGy9?RTwl(qgj9Yy<_X>q^3-^?0^C-`26t~84YsTBVaU0aaMYK=c_LXLn zxHT0CTP(9o-~Hp(JZ>!|XTlDMTZ_0I7`JfCnoWW_+_HAt@^Nbw|8IYo!k16?4vAZv zxOI$Mr?|C^+o3XYWZc?`Q0Iua9TvC4~K71biLwsQru2a z@RNnTg<-(|^~6)-|6Pln9=9{3@MPTjii{Wb;}j6L{&5=+xAWt6LEHwikmWTjZfA)w zy0b+F3x^1KVReqkP$6~Le}{{o8%fS%ezlW1B9dGjw~=wXFm9tHxkxx#7;4ha7&*f( zGd6CQ$VvIQ_B-qdVJB{orIwkK1*UgnO_wb)$mZEa6R2zL=^Ral1uc z;qZ04`0Tjd6Sq6W?~L1BA~WN5cid*h-P(rZ=bx=zJ#OP?)VThS+kI>;Y>IKaU&;@} z?Lm<_aks9cCjSq`?O_SSxG3TE^<$FEjoUo6qQ~RLca?|w^W*l!PWs`7`BRcSEu`84 zk%e(vB=SroUmUf%rEz;MZgXne1GVk>xGiI+u4#2^+6!@ek*w2< zzP%E+S6M#1-uLabxGj&{w{iO}Zm-8}McmfK?ZddOjN2+j^iJH~h}-J8y~X@$aT4y~ ztdZ}Vabq*1gkEpQ-9-?)+q-dlFK!(9!#u8y+xt?k!HVPP#KPobzj6CGZeK{wP@izj z7iW-9Mb<}cX@i^_6mxcwo8--H}4!nWa>2L~c8+y0j3Kf-X7 z+Yz@!+~U6Zz6Ehh#;qK;O59R$OUErAw?f=9am&Unr%=o_Z-D-9q~ai1l)NMi&nHa2 z&TVz>Rb>Y-_%3SCce4Qh)AsVX=@avfoAaTh%O2uduW``PSLD zp1z&vTNlZX@vWP0UB#KIqeU3-Sl_yf_wd~c?Kt0#k93$ePE}kgQ2zv$n3k+uY4nmp zAKy;$?PTA2%Xx}#r~3bm`7A4rqVsvOPSfIPzMbyd8NT)P{~JhIAZ%%atJVI#4e;$v z-`?_Vpl^eGd(^kbd^^jx!M=_6ZGvw@d^?+Mz*VB1!zg^$yhr#pjCph)+OYFPhWi#i z$3fxwO40?wu#`B#jZ_6)=-Vh+Sii@AcVNf(_5{!TOPLMkV&BF}5_U;?jSHR4yi0w% z%(pvyyVJLczFqFyH0H>+D}0;e+f?7K_U%gFCi`}ktg+mf)3BY8O!4h2-O#7}ny5{Z zGlkQAyUw?peVgIi^}gNU+l{{6BqI#?zmh+>hO@>hzQwm&eY?%K+kN9u9Il1fiuP;f zZpw!v2`%5{+r7Ts=i5x*?)Gh#3Tn1*_xScf1aPtZxf^TgVbq;-3~iDSRr*4&&mViCpB{ zGrm3V+cMu4`}VAF&q-&AYHF$Y|L!P-nPM_tko+Yf?YzjOYGp-yne9hcBCkchulu%K zJk(j?+e$fC30M2}hT@_fw%9dMDAvf^zP;nyufF}}yUXo&eOv3>`{M5jd8P1yZ|i*f z#iiEp2&v}yTM-`0!!t-SVsxvgmmH%JoJES+DlZA7tuscyoI zeC-=ohHQr{bN0kJNL{p;Iy-;%zieB&m`4&M?S{Kfy6c~tY#fpH`h~it%l7SKi}%kWo4UlaS#pVv6Hv@j$}&@ynX{C$RI)@_+E%D$ z3A5C*)UpJYC~dN!ZDC;}OEXK$@@dAC?cz?BZkB;bEL!|$8IWa$Y~TKNvdybq+!?K) z6H|js68S7yX3a7*%PAj^VT=F2idnhql0q!y&3<0wK&7RoZxz6))T(N6xt=8LF6^i08gG2`M! z=`WFG$&@c;GO%A}RF-A4+>qtQEX!qCKFh9IcFVFtmKC$Con=gxm9o5}hftbiv#e~s zig8urYDTr~uV>9jXAL{oG_GYFo#i{d;ZU*Au9{iazq%Q7~72CZH^q!l0Dn~-ITEL*CmeM)C5ht25!Dc&XC z#?Ebx+Zkm)F}OpP9WB|(xO0|WOf)DZ(~2~A&vHj3JkN4emZP&AXXi1- zV~rZ$q>#*6$7eagLJbR&bb=U9%5rj+Q~sl@Ag9@Rrtx&+8Aj$!P7i786UYBOMD9gpJ3kB3QDa$2ks5lJ+`_gtZQ^4EmI9a~XaGmAdEbnFcILjwl-nY#UT|~0^ft;2oh<2_d`N&Qc^`|D1e3q8y z=h^sXSuslZRqFd)maolKP~T+vHjBOrm8{sM_I;Kgviz9kC+qx@hWc40@3}ZRkNsPg z-|h8BmVdJRYyM}Jzf%3bO%(OiZ2X&ZSuPm+8M8UaFRxUw{Tjy=>|>uxg2@R zbzi3Ot(c=^r)-u@l47sr2y!fuXURNaj(Uz8a@?4sk)xSovmBe}Xyu4<49_uNj&_cY zgU^$ro1>RwPCFIjfE+XBm^sG`IcBs_3#5TL2IbHvBcz}!d0;V1j@hj+YmV7+eRoyz zRl}PjwU!k7Tsa0?GPhC9UTQ;9ouN5~na^v~$wv8($T5G8RdcMCV}YC+42$JhJjX)0 zc%YENNGq$xbuFA@ksOQKO9hoQ{v~oOnPd4JE96)z$I>}QeJ zTrM@3$XB#;W#dXY^lLfESFux>()NX%tLIoR$ND+e$gyUQwVZ&pbBxI`Iv3vysNp54 zmHs+8)>R_CZ$EV+veCl#|}BRvop!E;@UCCPC0gVfykMR`HEBv=G}7ap5u@l zhvwKL$DTP3OvCP#W1k%R+PQZwUXgxrNn9HH<=8*R0jXNjQ}nK=TJk{_9&FSEA!S{M z*?Dx1!*d*Aex&gzqgvf0&r`?Pd8{$9sa>NJa-5OlOx3SujT|TCI622D)|r^&G|NxT zF>=k&lOtTXWo&yyvhV<#<2G2jV$CR0WO8=(@O|R~V*BIdLj#T_0Otc0SAT zd5#}){HSKHM*um#c9RhQ(vq)o@qML&e3Ro_hx*R=y-^FNzP_L@Kj-*8#~(R<&hd+V ze>MK*G|R$G-bMT~$6q=A%`sJde6D_fTj!q~6OyOxOUAXF$#Q!(a^#XJR*X|qGg&T_tQN1|${jMPj5qmDh-^EC1_^R)8JooAjr zk-cWgGi#o9o=%=_o?f1Tc?RVfVBZ>QkrXU~Pn49PRpl11_iGnwBwZ=T^M^W_;~qIRNKR2OQ23*=ca z&q8@d=2_UjvYd3Hm*(zEh9ryHYcb>EMh$37TXFTw;3qqwbd2*)-2) zsqb(A5?3QQuJX_g!yFAlUAJ`mgn$1M_A#MJg1r*X*|k!wDFic$C?~xJl=SM@kHZEMkV0neBTqUiFr=T zbAFx+@|>Rfo@sK1vE0d=rAD6T96Qg=b6!5)HA=>06}V=6RqKU$F3NL7K0XL>vBu;) zm*vq-rQ*6I&!ws5c(@oAm%!zDCR>=i?IKNGSE_+k*=D9J?O?hrs5#_l%&pq~?qLz^7jy$*Kxy=%-D3aMwk=|*^UB+bc8tIMn zd-FVy=fOPpDb4wKB-Eg%4yYiy94(-{n%9J`jVr4(YSbOP_@30=SAzklxO1bI4ciGQYB`=@z6%QK`9 zuM$7c^F^LYfog#-^L&-(uRMR-;MeMXd44eeCeOEdzEkeJTd3uV9+Li;=chcs=J_qp z&sO`zsAL@FSzF|HOa937XF6J{1k}scDa2#KKlYujK>q^&=9!u&Q=nfVp2~H^Q{8H@ zd?qO$b#M&@l22bCS0HbltWoVsSt}GM7AO_^=5cA3?W<+XjIPRBfuKOAK-coHK)nz* zEothhccVbFK+9fHfp#H&ilkq;B^_J|j%JS!2J{NdRAA-;0}9MgV8#Li9b}Mro z{+Fc;&ga$pECpsQFlT|e3e0A;*;VEylg9Sblo9s`ZAaXe8C+oQ0`u7Gdq2ET-bb$$ z`)ai_w7{?e^A;Fh;56&ZS71beZ3}EyVEzIN6xgW1#swBEuuy@Om9GLL3oKk<1=sQ- z%8toWg?P?Vz3W=6z~UB)FJZEzF;Q6Be3=5HQk`W@mU9A@Hzt}Z7Fa3Okz~~Zs})$M zz`6xiw|s5m8mZ2j1=cbjZA^@eNqtpc>zR*DCF`3=J}#APP++|IhN(nGHYvn+6Uxh` zY1%eReK$9mP+*HxvZcvZ#;pr%lgedh`vN-@I8fFs+_Au3COg@z?C)&nF2-F8>}DeQ z?k0N_*fW*L+TJPOr@+1`-><;_<_Dw_X&zkQkOC*Bl0yp|o$|vR_2G6NQQ*i_ew2yA zD)wW{k1cRq>U+G&2}YI7NvZr~lT!+uYBDjEOXqY)bVgc$aq}y1PJs<7jIVHRf%6JX zSEhfN^9x*{9#o=H;=%$K75KKmcLgpkFv-C`FK|hLOA9<%(3HVt1uideXMwv4OfGPR zp63?0vA~rDt}1YCfip*Ct}dX)e~oe73H`(+6kb>0`U2_>+P*%+z3ip}H(TxY0=E>H zQsCACx7mpFrKW(=*C3PdI~+W>Tr9l1z&!;X(J-=H?0av42MRn`;JyO)TTK>pB?)+_ zfMR^uaY4@S1g=FYsc4mkPXK z=il19ST6IjjVRzN1r8pSkwnF=biVFleAB*?yrGe8-`M_JmMG=o?^@>rVS)F|-?y(a zo)q1O1wJnDNr8_Xqs%J(x;}OGKhprUa~xw*T#Drj%>uR~{*}qs1-?loY9Zej;+5gw z1^y}ULxCUd{K@!dfu9TfV*YD^-%X_ao5^cSW&SX^^Wpe?G+lq$sbdfS7MQ9bw@9ZL zPf0q*UoBEA($7wcOjo48dBrH5=}odlawd6WA@wbql!}y7iTX$~I4EpTq-l9*tQ#At zrqo*I(SIb}BE2H}6xp}PfFd&#S*^(GMP@8Au*jlC7ArES$V^4%DKezU%tdB#@Y##Z zT8yWLK^}4y`)tK@1WxVGX);%l!6tJXlhh71A7ND3VMXROAD&9)Gf75(`OOz7vS5*g zij1^#kyLZx|7gzc#4K*f@sr*WEqoD#$}Dm75j!+rDugAE2f$&66Wp-KHbu5A zvQd$Zt*}WkUO8-DWK%mgGloaT!{Y?=EsSz*S!AmsTc>rAl=gP1?;b_AFS0|C9aG6J zMRqdZ**L9KcP+A8snp|YO*qBt4EL>{mRmRJTTy8Si zDBmlJTxp)@UtQ!HJFhKrW2$pqk?T`_gGo}MJ9UTlj?W$s$jg zBvm8dXY72o$aDXZzgXm@BEJ{;qsYreUa{BrMP4oHz!mQmdB4c(7RtigCT|pZGnKsc zpV;3i@~-96O8bK%pBDMd!v8DsVUdr_KQ?|+MBQJ-r2%4i<%_l9o^L z-P7l~}sOG9{KTu|kPaC6;x-<&2?C>ATI}&Jm|}MWXmf%JzNv+qmDv10z7tApQDRF=q$B0zSJC>)`ZguDEpcLr zlS*t?V*3*NmDs<;4kdOhvA6TMQ;D5R>|SDz61$YxwZv|g>$^9~a`L4kJsMN>?U~lp zUb3@F?3?UH?qm7Bsjq7AfD#9mII6_aE{%gq9HK%fajWJCVr91GaHke zl+F^Dlz8#I_`#yeLATPEr?FgBVzT)aC9YKe@`ib$rdY1F*EOZSGtAeQxS_ zV~LweJYM375;vE)rNsSKo>Jo068EU-YWy#8yLyWG9VIQoGk01?I}bA691?%X@oxJ{ zBK>>K?=vbTlIVJ%#DgUsD)DfMM@l?e;xQ{I7jyYveoC#Zsg||L`J}p4iRVka;E0}f z?|ZhyGbYkpSVw^Dm9&Q!OT1L#)e^5+sDtG%o5l@0576#9QWXtFrpX zl@g@;#>rlsa`b+Q4@&%z*eUU0i62V*SmL7+AD8&n@=r>9TH?zRUzPZ*#OD@%Vborq zV%MR4;d4F=_H~JG-0>$4?|U??jHq9KSK@mIQC{>YNBTdxWPUC2vxy|XXxQ|3Cw{Z0 z%JcWMmjATmuM&T2--DJE@cu;ntS*oTxEYUko*hLxGO%tCf5Rm01SC^NsE^OgI~ z;4NV1f~k)7&7^s2|IElT3tPBInMKPiW}dvdB8B8U{}N@Ew0x;D%aj>aj^Eo_+LELk zmMycKooXIB9H^Z}wfPmxtW;)9nRUvnY~R((tWjnaa~WT?%xWoDiLGhAb}Ct`%;=OS z+1FgJQ0rPauFQI=@A_rNraT!aHn4NNaYLihxpA3I%4}L@voiaY*}u%@WhS_V>{w=t z)WUXUwk)$%nXSugQ)XMCp2ZK0%Uq33g|DjAHud%nxPwu?dS13unVrk*QfAjOdzIPS zUb~gqz04lMHRHt3e|U_#_Ean$1NU*f`{W@(aZs54lHw0nUl*LROa9^ zN0vFN%pul4+<0i2!^-h8K)riwAHhAs@}!^?%h6?yD|39AW6B)smY~F|sFjx!ta+kQ zjX@IW>ugxkD^Iapz4FvD6U&@dMu+s&R+HV!Gs~P+rcblZg`ibT> zWv(xCgN4@`uPgUG#k;Z0O=WH^b6c64H3)Pvx0IRUSmKIv9`zhS|Q6ckJJ9AH&d&@jq=D9NWmASvn<2Ld@nFq@}T;`E7s}9RtJtXsxxEk}Y zj8INpkCu5X6(%}QlzFnuQx-m5<{5{TeiB4D>-fy`WnL)rs$+RkG3v9Q<}aBiDVOjS zJC%jk%DircH_E(O<}Gu*uO!Xn(3%#O@0NM5%ui*0b}7AI=A$wnm-!$q&;L^w7@GOe zrKc_QPs)5+=F2i)S>ZF|7iB(A_0|59TKKxmHx~X-=G!vgmHFPzWFKBOHTWl$^`qtD z^7_R*TOn8B*D}A^`Fok^Dsf}@qs*U9j~;gXRo2U!nZI2}s-}O+{A;e~Yg0`!mALx) zRpReHhz#l%zbV$g!t|B+?7>-6&fbeZ&u>gA`)4lU5N`&PHoNgDh#MFcZGQ>@su<}g*i=TtT51IP=(n{ zW~wl=$t)FSHBlE<5M4>r_~`!g{G>tjYQ|n0(1?T&3@RYQqW}Rk*UkRTVa_u!&MtLH{e+w8CZ; zPOGq$ZhusF6;4zTz4lvSOItfgUKO^kuxEw6EZL^Q_7!$8-`2RD#=U;=F_!e?h^ z6&|W^V}+ZXuX`%oY$Am_WW;<*gMTUp-#krACm*IciI@vl{Qy~4W{-mCD272YdfpydKcm^(TY)%OUS1!9DBA!uu6IP|DM|k`wG7R`|$jI#|AOzs!<4|EWr;@OyijHSWtv*mgBuB8vB_45%`s%Frq^=;O~-X0I|wm4Q_TRhh+MXR5}p z@avk{&aIcpB>OG1R+-I`WUx()&sk-#Tlic?MWKzLxvR`m?YqTD_7H|unYYTwDhpd} zc$E=V<~N_um^AVQsw`M#Axjj?A1-#;e0hO5@rzVh%wCID<0BlBNM~_Nl5-|YDR?fk zqa{mMS*FUUD$7<`zslGu%T;weBkqiAS6QLTid9y#Q<9ZTR#Ba{GAmc(PNyZPru$W^ z@#v(qtzKn~Dr;6*%bKIBeRn+yo4iVyl*yPX>sVpkD(g9{(({IoO^&OwL6yy_`piq5 zhViPMD*C&V_=Z(BvQUw3TxGcS_blJEik`4bM>(BPWs53XI!LlzvsIOCt87J@-5lTe0Sp>#$=7Xmwop(?qf`DUiPnY zK$VBuJly8MDhE}$uEF&U4z6-YmD>aE2spILVO7qkab}Ifs~l0~oht8EIkL)8j$*RP zu*xx2PP64>jVg_ksvKv2yzvC%iK%ZgJ)LalDaKQc6OB3xce*02a%PpYs$5Xz!YXH{ z<#1k=bIi{*PAjYP?Nkvd_KT`qYEu^*Csnzm`oH~8z4~;S<(C`dx~pZbsB&eMtEyaG z*H^hM)xV+2O;v8T^G3Hf8PRo1l_^zjb(@h>?Qry%_>1&v z5Pz0Tlp2E(^9M-~U%Y1=00~g@1bR(fE_ph2;NK$<*Rbt?OUwOigRHpXH>!N$c%j zWBM9d3v)FJHHzkWqjX9&$~E){%u22AeCC&TWVE-V1(Ko&YJ@cwsj+B{dW}Yn!8PWt z(X7#`F=LH^wiDIp*65kHjh$M2H=&_YMg~|iL#^*iK{_y|Y!0e1Q;pec%u!?J8ne`x zwZ?3DwH zr^YTd_NlRNja_T(R%5SP{6fd>HTH0jJ!^e$z9j2^Sv zD+k?T$d1Aam8p|zoNR^DYMfHz)EX1*)XVHij5>#ztOw*g-MP?F)w9%nY8(>8XL8P| zajrT`Kr`SxMN#9a8c)}_pvHwY9<{ZLYFu37?i%;hm{jAE8rRjhzQ(0BE~{}xjVrBo zd5y^?ifgSx-%BD_)wsIGH8rla*J+Ey2}^FTRF!Iw7fqMBp~j6hZmBWFIycq0SuwiA zR08_`oA|9YZmV%ejXRaXLVW+b;DP;aSL4)={CwS2i&q6QF3Hte_N!HEwN~T78uyvY z>weqUB>s@eBSxt`Yz0l?N$Yyda_K*A@pPt?_P+_iDUV<84dcm_GB4mIr>H zQK;*EjsFU6;jrQT)cjPfx<2lg`8bW`vl^e&_|)x0okg8XQS18L3d+J)HNMtZ7tk-@ zn;PHN_@&0LHNLaL4>f+Q@x6I6hX0gi`RAHmAC6Fvc&=x4_G!}xqu}CmJC?NI!mRRO9y@9eDV}yR4R`jmIbU}=gP(v16DH8=JvE= zT*VS4L$7SC9b-oNn!nf zvG$Tsmn6D2uw;BH-`GU*%}h2iZfd-)nb|z`onRs(TLo+#uxG$t%4xv1mhTp@UBLDM zI|b|cU+t+102RlSC#7+ug!F+^*!ccdBz>z&-){2JDwg4hY!aTqgjh z8HtI72ODMi(161N4i7j&Z6n}#{?W7a6%AoxE&iXNZ*AE_{0BV z6F+vX_%9MCT7Hu8-_>Ht$>yg7=x=WNzxioFeA9Ghz*zyO2b^K2wmh%XKj;T%f9Z0Pr#^^p9*-|?MKdM97=h4 zKHvq7U?IgY9!y>gcr)NFtG#4=StStgs`+aHuLrylprh%@Gg%EU+BVcNgSP|T3HUMK zr+{|@-V69F;PZg@13n1&FyJFw_&;Sw``Bb&+q>TckB1)zd=l`feYLTW+>I_cEFL7k zP@M*R8}MDgSE@K|`)KgDW-=UUJ+^Vbj23CSz7P1pUgEl`Iehz!wt#+Cy#)Ln@K3<6 z0l!({uYli8{s{O}&BG5^lhIzg(~38FtLxu@sT$rxvLTs}ej(F^^mi#K2w^->XlPYo zP8=E^!XJ{0N64HN@?qbwnY^l|l|U(^95N_mrjSZVHDrJ_63;Q6f!bozK{_i^M@=D zvS4ao`{cSO)#~Mf=`-Wr%q$$TNXU{QOIcyjkR?nsJ}+jnc*rOEGK15Q+@35QvP^0% z`FV}r^;j-s`H(w8?hIKWWW|tOLv{;UDP-l4aUmNx$SNUggsd5|YRLUlr>xQfsvY3Axr<|^Dn`4d1YE~ny?(4^gY!$L~$c7;sg=`$M zNyz3Q6I8Q0|8M=x%=JF2?3|)6|Ag^Oy`{a9nOaU2!Zsn>rcG$OknJ@rXsah=2ieSK zcC>RD{U%`gjJ|9pubo473H!d2tY^L|vE4)Vu-Pj^_6*r8`d42O8A?R9Q--F2#6A$e|&Jg&b~Q^(^%l3VW8jo@OEiQI9*<@+2|(%8R8gg04MIjf5ObWTgYKlUGhAst{DP5yX zE)SU;a)paG*%?j@YA@)jkgG$k3Ar}p<}?l0h1_UaLKxLvnTUb?(vNAM#GfyCL_f5r#Y&@>IwJArIQfV=l3WLLRa6 zVWYOllDs^s@ge1phdkkCtot=J@25ka33)B#bqk*jc_HM*kmo|4cRN=ls8`6%R5J3n@JQ1AFeV~(GOsDc#NXZF>Yqw({LkS{~Na!>g>a0^|_BwOO za-GHM%vooyI>YPCS7&gYx$6wAGt5bv$2i2OY$|G%=e%|%_iHK~33ZK7+UhJ+XZ|`1 zSV8lnlr>t8th2Bsi`3D9z)99ucTiXzgjl@J5_MLnvtpek>nv4gRGnq5zqE0gIv+08 z7mJE$Ii-AHW_f!l-ekX5@|EhWTxazox1FRcCaawd?=e zM@nWKB{g-?VfI0_RKCK=Ptkd!R zuilGST)GZbbUNp0wZrNhUgwB9%fA_?M1`h7@2EOQ*Ey!nv2~8CbG-Gn+oLXXWw!6f zXHwP}cv78{>rAS1iLISd=X7Pt{M0%V>zr1Pcdj%`N?-l!%sOY)Ils;Y);YV*xhgvI zb7V)YP9I9u7&S0{n^jL+bX{2IqB<9=1M1kP4?L?t^oURfFRkm)MckvWt#i4_6?Lwx zGg(o1C`d-RtLj``=bE%slfu_5qlJ*dURUROhZWZ_a#Nj~>pWKH@jACyeoviy>r64f zwa#rOx7WE--P!z(bOgA&9zUT|L1~QLGLsR%&k7G2?^io_j1Sa#&|E2zWMl}*7?Gcr;N|nd7-XP<-}Qj#`tWV=Tw-p#dD}G_2?HZf5rHcQOYl;DSWlg zYjs|?{3GKVb>1|2tIm6={@ZolN%^}bNqN3s=L0#_S-jIF%OBSJcB;icw&o{wK25`Z zX7agF7QRg7UzvPu)ZWy0b-u5&Q-hrw{7~md4Sfv;HR5dkROk0Pe^~Qp<1cl7HTlh$ z^o~F4{8gvepw!^+I{(y}&cXlHcBk*D0C($F`hi5gTJ)Ed;Stkec3q47dTqz=_+&}_tKGc+=2 zt3+z;1|91RXwXf=_LTBgCV6V9UDFvXpV4@@Z~bO!#1qZhmdxB>mIkvnn9a`l8_eEd zjs_#_oYSafz+8>^&PWYId~gHd+zsY28Dbo29A=!?D4pRA=1Y0MbU$r@1`9UgeXWHW zEZ$&=1|#iMb{1~1h|{LVyr`0)_kW!LwZ=?2R*Si@eU8Z2wgRT?bU zV0rVE8m!P@Mf0R<2o*5lD?2(F*R^Vc)vPAIx{1`p*EC*# zgIyaO-{6D>yIC_%NrT-R?9pIPOZIB8w~6w#PlJ6M9Ma&>2K!mKe}e-|65|KDMajrP z79MO&J_I4*VRj}v!_q&Z!I736Wjv2>Kv<9b} zoYIJg!BdSBjrtt=84b>CaB)KqZ8=M=rNQ|PF0lSN4bE+Fp1B@e(SD;iwc;Ic-1|8;qT$<|SD%{U79!XtfmH&->d+FpaSyAs8B9LWa7 zwHB(1Z)k91gE1}EX>n77n;U%G$?Xm9XwYcVY;tFV zyBd7j(6WKM8{E_2r3NoIxVOQ54W4Z9l)91%p}`{!9(9ZlHh8GP!{#bmB{iupCHt`k zk2iS2UK%hpAn4I{I8Usj0(rW@GYwv_@3Re_GkLy&ZspY8k`hY}$h~MUh0;CyD-B+4 z@OFcD8oZXu-)!)DgE!QvbA8_wQe4u1%L;0c?>2bP{G$f%H~2uj!G~%Ueg+{;m77pA ztP1?BF`17Wd}96N_E3HQ^9EmNjBV1d$(IejYVcEopBsGL;2Udx-{4yl+4)Yzm44q$ z_ijHl_)$$lzcLxv_eIlR8vNSeFE!}~zcu*1!5>%g2+sXmVzO zCJQ!Mw8>&k7HTrG$-+$*X|myv%x&o3*;AjmCRVN&Gn?xxQgde(Z?Z&_C7UeOWY2jr z^$p^Zt|Y?OLezyvW)C#E&6n3S*J>2<+XzHrAfqZ)2wK|Qj?XP{Z*Q*YNE1A z&M>Sd3x~z!ua)7NO)hJ4d6Tu8jBc`alQB(pZ?Z>|b(*Z(Wb-BynylB1C&6(|HfXZG z`BbYAq*|N!YO}1~c zmG!qVZf#VMrws>o5wqjcH@U#%LgPioi;a_vmly}ypwb|llbc-8 zr0mu^s9)xG%hgk~cXwBlyVZmGWnQ%K9-~IZdz#>p59kwcO_JXdsUv^iIV>->=(OmXmyG2Wl@`?&wH85(MvG>Puod52 z*Nw8N)uSd0Nm>pPwP?5cZb{^;IrO^k;w5g+zOxz!7-wiPV~c_2ll9EE#h?~5wc>dy z8FmzW7NyPa35w5V%_K*2I`-j~%++FWi@D8*80Rr23y-1Z!;Bh5=WX?!shh9Gh!*p= zSfItCN^pw>tuxZNkWrD!$igj7sl+cfE~4dA|M*#LB45145>DQdEtYSwg85R$rH#w9 z7-h1oaXF(5Do46jY_Yl}D;ZZdO1?^qRa3s2iArycRI+A^waiBw*G}cS0a@2+KB&dP zE!Hz%-#E6#xE33<7~f*s7TdMhu*F6#G@fi}+}OCeag!FCw%Du{e`8#mmdS^{r8%L+ z7FH0~m?qrH&aI8x7&XOg-(rUrd$riR#f}#4VwC<)sxtHB9P+L$cC&N$7JIbV(_9u3 z<8drwGW%G#zfqEXRbpxk#$>)Yz+MNo(BvzHLs}f#;_8TNA`Wxjk8E*Ni^I*2Fea@+ zcyx=)qqtujWBIWyj%#szixXN5kC-pw#1<#D_^`!CElyS&Xz_51M_QcPVq%NQEv|6k zpVs267H79OJ*|r~OwN?hb$w2Yb6Z^4;-VJkwK(7M3ye}w<*L#X6uG#?B`q$sg-OQ5 z>oTR*&g6NAgi869Ev{;DXN$X(>lW9vxVgnGR=c*v^(}5Nzs{(*ZZuIWH?@dAALn+M zByx(zgw*%e7Ppz-VTC(Vxis%?aZif}EV;MEeJcOdH%Zboe6YnsX@M&ug?+TeW6t%f zEgnxpJ===!xSwe8WQ(U-JZRq}pR|~&0YBo?7N52F zvBgie`ML4i7GJdZvc*?Up;Gm=iHv;XEQ?6^U5oFn|AT!K65rcnx`Bi4=>6R}Rj`VnIz*0tAqHj-FSAtW)5vyly)9!V14 zjUqOV*gj&1h)p6kwazvXo0&|A*dk){|CFi%ZW*z)V-epf&0Uh>ja4#GVm*rIwZKB!zohIVqq0BKD8CFyf+!11vu*;&77# zl@cfBU|TpO;?OjwYM(N7M8uI1XGWYAaa6?78rvgIiZ~|XSf?;4sN*7zk2t|brllcC z$;lC?L`;l0%`u*u7E9uLdc+x)$eEZ@?qUm8J~z$RId)2ZUc~tpUXaF>l%c#5a&g2Y zD_>%>mquJ>r|c(DOt$k1qvEZi~3xk~>oSNv7^p5T7JbjQ6NhXxSfeuZbku zMwaA$b?1ZQ4U>l=9*%e};`xY2A|8!+GUBO-$08n&ctVZA@1-iBHiZ;6*~DIHrOeY2 z&qO?{lJWBkJ;l)SQcoPD`9j2t5wAwP7V%QV%Mq_Qg~^&Q+1}A^u*mBXZ$!Kq@s<@N zx!RAe6ql5hJRRSCH{!jBpCW#act7HUh_52PmVU&C8s{TEi})zwiqd>stTv&}+!M&7Jun;zx}-DbKr{o7R9RNGA7Cflaarr0Lej^`S!rt-xsxw!cA#H}X8Qf;>cKlFG#XgUHSMw00TnuY7 zZ=2!vRYa2LdA*1dFrv-;Z5D7LEa*^4AtW~-3%6OM&5~`Fve%-vu(*{MYxkXim9-`8 zo6BXEHj!kM$ujMDpG`N3%cgQ|MXu0h#WshvIlRqEZB}lxWt*+qtkP!HHtV+;+h(;k ztG5~5X6-g>q+!=;v!;2{85K+N%yEo`>l)W-_ucWS7p&*lr8ch325mOC!uU2Dnrzx; zqc$5WFLtWAs=ktqO$E^)BizhhG9^C2d<&O=oLeiRHoLdkqs_MV+Of?}ZMHMtzReD5 zW5xJrpB|}8U)RoUc5Snp6?SRI-!M;($SPj>DwaKMeBU6*_+vYSU z>9{t>w>i1ZDQ!+@b7Gs5ELV(4fhRxFQ^}m#W@0;DnaFF}pY`;V;q+Ah3=>JtZgWnX z3sd>ICg&T^Gs?&Xsjp(WDCHNo(eGVk|I#*>we?>NZfkRSo5^jiZF8N~u4r?$$(3!c zGD*^zB?aRLZfP^6t^az&lUEY&?bf-+ct@K%P3~%Q zw@H%gB)WUs+Sca&HV?FU(7sAQl7@r`A8GSwn{#`d*Wyj3zHFjN3fh=D9Y{w|Sw>n{D1|^P*!>;$Lp_l6mszR+3lRyqfyH zrZO~t!>AsuZ*aZc<{dk~YxAzj2f{Y*najfa?Y4BH2HJxFKvEp^IMzWHGp^M zboisqpK)Ix-{CJS_v^$1-QR8gY4fioQ`=-Z@!#r88}`$&Rn3@_y=_8=={of9Fnxz? zCqCe(*puSYTV49h+LrqGvjXao4dn2sa(UmlBaSQ)?wZbBReeIVR(o6tgv8*5gq35 zut2J>hZ-8IWlEP?>_Vwr)2k$l*twW-(GK`T*5VzOuw+_mU%JCG9Zu?Sa)(hJmhG^0 zhiy76*NI=ESy|X&dGi&FD;ifaCZpx5Hn@6+H7s1sn2cjObXcdu zx^|B5u%XF%9o9D)YgDLl9X2pe3QdxYI&7Z$ZrouL^G%JL8Iv-Zkm_t^&2g+&9 zeLL)DqN3KYv%mQPsYC$}?r=zlqdFYj;m{6;*-M)8I=sUX9ga*TvLK-@`5t58aUG8D zaO{7q$@c_1PfXL3=%3QzRJFq{gS$-ZaGIKNH*Tw^r{!~o6x<-s>~NN{*5RBEUv>Dp z!?_*K>+ocUr_?(-T+rdR4!3u>&=F1Ua7BlUI$Z1+Cv~{Y@=H2gYNFKYQd~;O<*DS# z4p()!zQYY2uI_M6hwGe@YmNWSsY1zlV~3j@_LdGen@rOYnbP4_S4Yn`^+|Mhba>d- zWZ}*ZcXhbC!#y4Db?^s`_o*Xyc)&bKr<9Wzg%71w{78pK%@x;U9UiyYCyWY}q~z%i z&vbaV!+RZ`?eLs!zT`4_-uy*dcp;5Tp;RU>cX*}4s~ujm{4L|_9p32hrn%InMIrLG zrkJ#5b%!X4jJ)6BqYfW;_#pNAKd0@()cHw=Pt~dYyk7bGtiu;J{<$&9@0V$IWb>O2 z-*zZ;DR%j;!}l6Dx=h#Q2kZRQ;b#Z@(K%9ZUB7hrT?4)qe(ms^iP9!(e`@gW@Nb8y z9sW*}^iNuzQb-C=nCa5b%`(ZC_QynITz2|*nZ8TbzS7Kf;|{AUZz45)sIb%}=n{4* zTTP)VCRJmt+xJ)NdY6VJGjwToX?5v!8PFxNsZJWUom%duk|aGcs|4tpvCBYv4eBzp z$xNxHd}ry#Lr0R4*;4uJvT1(K)TwitXzH9h^&Q@2o^E{Xa7Z`4T^-tuN0?z<=Cvus zt4mK<5}WgPS-=60>#|^%h0I5H8ELY#ap5kDbXn9qc|t7meto@ZS-b?P!!7-d}6D6i$ZEZ=2?E-PBHS}I@3WaTcaq>@#;`aMBxZS_>LhRK@7 zwNl@;yNv0wPM3ANY}sY2F6(t!zsts5Ht90f%HxgWj2jq}_1lK#iejU#{?68SR&diU z6D;4X8$aIK+^A>V;?ms0g{gawj8;~={lx9_q;mmRxkfuR@4cd~Hj zF1vK&_sX^8kR27H4C;4pyV-Yl;~qvWQO?%;UtRX;a%h*sy6oF!zb*%=`mC^jmjg^x ztum!cL=*kNT@JB4nX{55!Qoww=yHtZM;edna^yPVSHvM!f*IaPyym-DQAT9?yJ&QX&yQF_kma;BU8|5BK?y>n9?d7a@ZZbh*3BJzXB` z@{pD9HQsN$&v{fuD6R)A(HiXGE{}A1qRW$A9_{j2m&fh(-#XH+k#;$rvRq-6o}_&~ z+vT|~uXlN)%ky1cu)?cdUhMLc`72#sR_}9g1ysusPx|$1sWlxndDHyuF7I@C%UqhO z`ggm$*X=t-o1{lZV$$WqF28m8y~{^kKJN0Z25<-bq{|mwzU=a8m(MIwbjs%Esy@9^ zr_cU(`C1BtGvC-Z`Jtg~CNX|*;ZI$D)-2HF$8O&_oN2ND(&bm{C?zkarz`(RB~!cn z+2yZp{Kn$nT?T2-zso<)f(E*zPo|U z%xmZ3#^J_Ad(78kg!%l&1&oSiK@){tsK-e2g?lVwqT^@Di*oW^EY)8k)nC$NsUAz4 zY`j9>=(KE)RV-P~xV&)%6}>{^%ZS_n6RQiymXF zpsmz#J=QT_*Ql`T^;qA0tnop=tFF@Cz{bb-*s#Y&=8AOV9-CM#sgzB7Y}R9Q`zDek zVO#dtt;g=x+^WacCfoGb)?_>5&ONs8u|tm??cB+zdof+QST zrj9lqV?5TVu*X~BgdQiFoYdo#H0;SHI-PZ@$;4hffShK2y73I-nMS4mtR82ZpOZ=y z_WT|f^q6%9W}ATvdtB7x_5s{6fQx%fQp+5`hyh&E<5G3x0Wg5edR*S)S6i6e*E7}YA09VF@8uf3ffkN0?>$Adi{>hW-oM|wP}5^#({ z=?jxCpR}kaZ0D&SPo@SXf4avrb|yh2dA`RBlJxkn$BVuHN7Z?NPfa}kKc5#xMFj;> z|4&c;H2g1ve;aHv z|7-Z-o_IOu@I`Ds?Q+gnx6jcbx1<(28pEb`sJR2INxu&;qj!kmx zm}93Lo95Uo$2K{(&9QloEsSkTgW4U?{+$%HRgSHVqR;5`D*ARgw$HIcj=@GhptqxI zx^Z@QZ-`NvN7hv$(Ra=<)QGzn6lK>Ol}laFFry4_(Z#=q;Ya2eDQ)N2OPTk*y>lF9 z^nG&dYsh{%4#;t!;rknGu1Xzb_@Oxt&T&YNOZ4|8`x)Qot))37dU%cz#&(23QB=&M zavYuG${bhaI3~xjInKy&W{y$Db7GE@avYaqw7nj0@Pw8POM=$rPHss%EypQ2PPJEg z<4#pq($ia^8eEOZaaN8Cb6k|;Y@?r>b9}O?E?03Trwa$}vLG?vom+CAyy*e%&2gUvO;8ig z@j#C8_WGc~hYbEV&TJwND<}35*&{h78pERoCmC!OUw`I$JjW9`zRdAejwdbXg&Z&D zcq+%!W-U`%a-Ol!sRpOzc-D~T3_hQud8Ao6SEG0-$ICfBx0W*97~aS+JI5=A&&V+| z$E$|VGWeRoW=SRCb$e~*@XZ|W=6Em1TSipq+d1B8;o^Be#|Js)=lIC%=R*scYjBP% z$DFNV%`=LVX~=>c3oUz}7;Mg=KDD6Fa!bbTilyjZ7*Y7uy8kD~H}ZRV=Y+pC`VR)b zGq}j$_XfqFv=sfv96#mwIma(Ke$CM_&r*4Q%kjHX$?=ad|B>U*9Dn85LpKHw^z?a1 zGikwpjbU*PFYmmiTC^Nv^Am=)JmlSiRl7Xx^K`IWX||$RdbDD{be?7MteB^3o=z6p zCC>_ZcZy)yJj>---iV!r+fH2b&H5>7Hk0WxJCzQAyTT{(o~=z4kC6 zs~YTSFqbEvr;x|b6B?zMclQnjdDmO%(+uHy4!_K0wUlSqF%GFHG|%+~ZYYrCN%L$_ zV8a5{JT(Q0SfHLK%QMVmHuCh!(=Si|{QuQgZwp$@;OcqSFl0@GeGDq0wG3I?U|);d z+yoyWW#-v9&pH;guEF&TD%QX}>l?m-!3|sVLHQ-8Z8yoYX`XHKY?o&<3*92mmU%We zyy?0nXRAD0=h-IjzFX0&G%2WB6T|j-cF40+o}Kdy&NC#>juuzVSq%F6yUBL^hTbkx zTAra6Dl^m5lp|5i;mYtlyXDzE&mJflSRMTpc0j2@$0!Q&)7V- z=efgznnM1|K$G+CJmahi?)m?7*v#bp79`Gx^E{B}L3@43q>XRYg0k04QE+0ONApb2 z^Gcpc#_)8WDY9F`C+B%Q&l48?$vjWBQfx|4bRo}J=(BmA%QMxIn`W@71i|O?ypZQb z6R3>6Wc-Tz^8e^cY%?sD=yC#jotfv=Jg?=MmFM+5v-7-Z5#MO#p_#e_N=t9$dE4m1 zo9Vun=Y2V-0^JLIkmtiZ|K?eoXHK5Ed49IE=H;26=kq*Yv@|1WA1Nr$CwUg+S(xY3 zJfF2PtQ5u2Oi>Bx`7+N}dA`fD$auca^Nk@265F?iH~GJB;XfMkL#q@D{i%g3=fC9n zRb7Db{GR8}Jb&f+qZPN=DE`j#k5TkFp`zC;t`>2{g7eZ%2Jr~d)2$V2W^@C$BOUMvt4+!=4-dW1-FslfZX|IK2RO-`kiTZN_t z)+n&1dI2NW42oViBs173(94kCt-*9?FOk#oMeuI#Bgh zV03}wE$H9^BMKZ*;E)1`8s#wQ&5%Kh-C5AbGk4nR$O0n^98=)fR#}cJaJ0&3_c+P? z#HnXgf#WQ0GjGi;_!A18Sm4Y8V+x#Pp{Eu&t-#3=Rai2PZRYTF%l{e1BZ^9)N2#CH zl6h`{vkRP4STeh8rhA@+Huo$pH2m@w|3w8ZHvEzn<n7w^8t&tN*9KzXcW-@O;|*B`17jmSS`Lg72+xs@Kjq+xv7dB(#II zIw`cY&oVxr`g~^eP6n6vS=MJc-}MoCltdGD_UR(|J}dgp|9AE2X8bD4N<#VjhD2sKp!DCvS%@if!IG@oz$6HM` z1xiR$&PhHe``qhupRCm9RG%w+uJk$0=X9U*eJ=1h!{MGvdugzonJQW-4QSZuhy%=WYwV!{<&zl%HlS!Er{pr$tx9rttfH z9`Kpw^Q_NNCk_ywAg?=ZO|&g26{x={9xSRP|#%lYO4@dD`c3V|&8qN#j(y z|0Sd-Q+%E=hN-3vh5na4iF(fGd7syOX8F9}^P-#>sl0hANzdbv%qJexzk?@ZHH<{TWfUsSB{poH+Nr8e{O~S-Jnwc!sko1 zi|*c6K3^O08=s$iem4ADgWnlkWbk`~KN$Sc@*p94e)0L$=eH)O=|ub2&5P6&`iIY- zK7aWdFY%8&ZIM-q{OhyWXZa$Xi>^EHinJBMaINsPE7IQZ<%)DLL_EtB>1g;;2A4Ld zp{#;B8NTfQP()Wh+oi|~MY)(PD+Vm2;Qzy1nAk)uM!+ph#GxR3s|8`x zdWEtfW^u+vk|KvxIkZYzq*`Qnh21LDiqwnjSYoFVS&>GOUyA%%q*syNMUE+QY?0N9 zymYsBP?3X+tX_0K8C;{tnnn5)-Ph~u6j`^(T1D0_a+|)-ZReJu`bw;h^c3k|WPl!Z zRXx0K=X(18+ImF>7TI1!F0y`+4T@}DWQ!sj78z7z<06|B*{JC5qZp&Vd)(!&5D~tq zQG{$(L^ncs65iQqcuS*iU1XagTPb^OUYF6{30nWrPYv|(SCQ?EsKZ4UPxsEMdxMJ% zDKbpOSE-A-=iJ-5$SzipoeW-LH&^UhbXQUgEpqc@m%8w6p7C}ovb$0*vTu<+itJf* z|C!xO#o5`*Cb{b@4({Z=(Z$iStE^>U46N=nh~-JWJ8ztBl^1hh$8+Aid<+sml(XL$i;@JI{uyF7^E4& zOHKG?21h>VU8zP<AAzwk^-eJ5$`H;w^7Ea4O(;smF{stJtw!_U*v%zPZyaYOE5O6 z^zkAO6&WuB)4EWRM~X}=vhw1^6N)U_tWCFKK3Zf_k;jTmF0$fq@8)^lce);=gD1_X zS~ZeXHYDc>6ZmA2r>we{zuz%DV@*S?<9Stqyk(JTMV>W$SIhr%7Ax)Ky-?&uHACZ< zLB3(g%Lb>_W*)^5|6z3yXYOwF_!|OfFvL_wsJrvAXbW*RH6^V*MgY+~*e&^ut8fNcX-3s^m1!+=2nYXqzrFd$%^fIb0hNkZU$aJjarNOAj$ z^9T1|&Nmy*b@#Up(L*dky{)0nQNS!t-#vo3fMGOx`$bwQg_+1g4ZL~VAvfMEf{ z1GW#?K_$|yDFHhN>=G~}U`L~<$J{C4^R?XPfo1K(T3SO5N{GtRy_<8|y9MkXa8$t2 z0eb}O8L(f#{sDUh>>aR=$`zoC+0`AWn|rUl>kD*IkIFSr_x}eR7;sR)!K$56?p7b& zlBANV0Ulxsnf{0~;6qJahXovN$OwZ+80?`wB4A_-KWR7b7{ew1xPW5=Mww1za)AJ!Zf!WVp74_my-keoD(XR`*KH!GHb;RnpRT26N`M{6d z6;HPXF+#ci_n!; z5_^xDVK;B>H`=6=`vV>cm>BRtz=Ht~1&j}PIADU=s_N+Qq3%!3`YQII0p8@gH}i|O zM*}9QC7M`Cdn{nG;ga^uG$&sd$P0hMh<|$C(*aWgrU$$d@QjuH*;d@C_Bu^@8|KZf zdCvtrZ$U2vycqCOfTBy3bgORbWh=sH8(q(6NqEhWnFe1~6yu*2@VZ(=!0doG1KzS! z+=sorT=s^{Z_|w>(tw)JyK-Uy-voSX>U!VgEDZP{;6uabs5%1X2h24FW#;D@-bXTk zfKLJz$R6go_9!?@U?1f@#69Kx#l3BpsSPA zG~@u4tM399$yW#b8}NO=4*|ag{BAAfM}xlv{1otWpr44jepUvfK3DnqRq|i+e!kP; zf5`J&wuS$xw)3ECbQ1oz9R8YKpD!KHVtMQdSM=8M+(Q)Vb67vSo>th^ zLO1G`wADk_kc5!QI!qF>mP)68Y3q9DZZ3z)Ugt@UtzXDMORj&&fRJ?zUpHjEkV9s8 z2k+y2zAngmv8x-ctsk;M$cC*FZ5=WwWTTKqA5U#Z&&Dd9l&M*O<#RKG%JAkPTeR>k z4cW?|7CEKEZ9-mo&Dr7hAv=T|6>@aQU{lLJA^V05u@rX<*(qe_kX@wbkljOe4H+6T zEM#~{*w1sWug&}P1<%uUmwnu;Y;_N5CSucOU)PBHxWkP|{q3^^&}WHYUQJG&8}eCeBywP{GB zE1)I$)R5CcPM2Elalf@v5^^M^LM{!tIpmg*%R(*>xgzAsP(S5zF8roVhz6o#I(b)x zTphY0%{3-j+PKz`>kM9R@CJi78obG%tnb#)btt!mj8!IW{4XKu`1XFrxu82k?oyL1 z(WS)QA>%?m30V+wPsqI?&xA}3xi92?70m=bU~r5(1}c_QRVqdyh$bjTEI(HcqW;Gv4?8ugoP z(?XsNc_U=DaXx48m5}E{UI=+H!(IS?QNn9OYj%_)W;S%ClLiBzzaLsD*33+*JDyAwPz0sP;{N?&C%amBK&`ZtPE?Z)`63drdo02Gns{31^q$3$@P-4Rp zT}yN;5tm3xtW=`ANiLOGxx^|Z3ijH=qAPB$#HuBFmXL;6a)P zb5J6*xQeB^kRwv+kx>+-Y)GZ#{?4=dvR+!EYLwMW)C_4DRNT5DSqXVCP0f1QYi~s? zvBv^8anM4Cn%Ej8)+{ltpVz14hGzpytW|O?ckPlJVD~lH&tQLp0}QTXa9xAz8Eo!G zEz(6mCD*qq?w}GIS)$vO*top_!lorQvyyIGV)GJPD7w9FSz;^W-@3G9B}B~4 zDDnVJq)FMn#14wp$@|0l$H5kBhzU_^-MPdrB_@@5tjw+@hL*T4;`)eTC5B5~5w(cj zO6*?Zof7X#8zuHEajn=&>{ViKlXG>6eU#x6XO8icCf`gq{N}76Di@a5{I|&5hac={KytXN^6eXjwx}h5l5LoEqQ5v*Bm|_ zS7NjU9p8#|f{d`uY4~KLoKoUcL(~PIR^s#$XIKr2;hte$VSd}puAb(wub$|gRpRUt zR~Yj-svQkz&5+J5ab5`xeiY?=E5Zc^FEn_O!HW%EVo)W$)R4o0bx0M)M;`S1icCN?Q zSmn5O-e32(jUVDJo}HiuE9YNgT#0*1yqI~{c5vfTjW*?Zwj1hc*47U1{t^$Acvyuh z@nDIEOd;ddW`{XXuKBFo-M?MDM>6k`5)(^2DuYp3mhqMv;^e5~Qv*@&sfO@D<~?5G zi4rfDm|o(^5>KhUlz6tp(

qc&5bEl3PENWEE3wO8v#7UEMH4gN^4(JgEeuCn*U1L?(1eB@>=pFUrVJnXZfzgq7r|bZG2zihZ4V*_^rf`C4MULv(zpZ zI?DU&tv2;&-`Sd~?7uqSQ|10%;*S!4miSA~Hgg)5DxS@}4_5ak>ld7O8UX)O;@=XB zWoD7%kuz_LAY!SAr6bx!w2$Zz(J?|ph-Rm+`W5m!Uh;C=tg+rQ5uGA_@9PEt%Dk3t zG=G6&q#9i2e}+BG!q}q*9|hEs4mVY`TVb+b3=at+f=TJ}`2Vh%F=5kJun$!-zo< z8%JzniApDWHi}yQKVq|p%_Fvm(7%<{Au3dZ*uMQd?aM#h$y;t_+g6s7tu1fcL~Lt_ zdI62$mA4%%bmxd&3>h3T#29uoxRbJNDa!tLH3rE)Fk+~>fQaF8{t=Utj#2yiQ zM(h=FfaZWhTvw~oNvpCw&D69!vahN>Vt+A2Xf!3CAmLgR`n%>btf9VUOb1yprH6wp z1BXPs*vZSi=pAmUpA>O�bNWh&VE0WP}V%xf&gDl;KB59An6_ksDDfbdKbE#B&kPM@(1qjF3uS zP~Anmq(R8>P9ZNx#50}hx;*U4vfkpw`Yo?k8fQfOvxZAc1GCp6W<|Ug@qWbX5pT#I zBHoRd9r0$wTM=)o%BFZH-`}R8^@4G(1!*PryfwT{`gzwq?yc6_^&RT(K8W~GacgdZ zKPO_YT6Dzxi0fYVGNCz$7ogNXk=rb@RG9@43nM<2SJBly5kEwH z7V&w6Qu#uyIO1!=zcdEjMgL92w-Mh(ERxUc?eTY+_6w8MUrjre~S3OsVX;iJV3B%jC-x%1(zO zY7tU)RV))&CRJX|&DDuS#;lB0EGK2-Uub{QjLQsab4FM#Q!BG}nZ9M}WipGhW|@W| zy~^}1qbMrKYGqazkG6fwOXj~yXqxsBY?j@pmDXBi*OO{2p>+F|S*OgpW%`#HpgeSO zHh=3R=Qq?v?r@c-*@PU3e8T!=HZQY9nGMS5bwh)L3~ppl#Er{rQf5cQ071rsJ$UIw`bb90g3jKG~8154k>eFnUThDsFYdeaI5hVWsWeSYFRy| z##Azuqskmz<|I{z#!33Zw9Ij3MwdCZ%&4*(S8Grthbg~we3=tW&WUCHqr~M+qhh&S zg({-bJ=uhuB8$D>3%YrympP-%^<{1-bEZW+zsv(lVEox!lCc^UIm2r&FS8O;?t=N^Pg^%BX3zEb|(R zb#0mJ4ABrm?os=*HPWGlH^bb$; z?ksaxnY+tq^?oL9*eny3mrxfhwcKmbCG&wY_m#Q7?DhiGk84q-yoUE+nTM2+{K*q; zU+$)7YR+ZiO^JSUE zO0>dPWxf_?nSU$~-<0{ejQGX;ZJF=NZe4nj!S4cCGaX6{M}=l%|IYrwwtXJ5>LLG)j95>R_;Ag{3MiU0ISz zG02uWRamydaut@Z(7WP%d*=#WDwHd(-dCuwq9HviZhx?A1q}&SuF%bhVpz$L?iDmd z)axoOdXEaL8m?5dd66?bU!hRJuTV5;r3!&o>$DMIP?Ck~kxz?^qLm!UtW=0ABrVBx zL(&RW6C(avWyv~NWuy-b2~C5F{1tX^S_3Tsx_u)?4UeM}((jb|;x*RHtw>RX{- zh5klqs&Rnf>r_}8CRa1r2W6p@#v%+2# zI>&U0*}K9%vW=LfW49NxZ-r46j#JLHVOnATiW^<%IlzzuD;!ke;0lMd=!Y3{sKKpw zbdK?G!$%lAqQa4ej5K(Z!J`cxWAIpmilrgS=!*NB_6Y`$uehOU*XO)z`+Fx=+*swL z3MW@MrNXHd9;-0fD*7~ox2jwf&Zux^g)tSbsBmS4vn=Qm*-3@7E1YAm=TWiaV{s3l(0h@N9+WjQ{zHTX1W-g}KXlFIf$~ zY(Y|m{LFO2HBeXd8HNj)DZ?{G%`(dC72at17KMs=w$b0Tb|lJ5#;iiUTj9M5-&I&t z;r$99RQR~UClx+4{y7!q8uDm6Z(ao{YQDWHqLlEFTD{emhTjV+EUfTph0j!{t$I|t zpPRbAwpd>n{L-NE@RcEw`HdmpnimzlS&;9I_-BP5TKqp&_^HCr6@IDks}X-U_*;c> z>bP}@sMX^iM*P|i_5D@h?+X8zWG|*I=HHgI#WMBwPKSDk?c=Z5`G+Q@eN2bgF?6&b zA(F3-ewmo=1H4YL>o|^k(zV%TW7o`=i&@?f;reIU3Nb6j42~HhN1@+stmbu%*{YY< zEp{GnB?*y)m{nrdiy0WxBWBf@dQ2A6GbU$jNlZSb5EI6fV*Hq5OkhFkvgM}q=#-rn zyPh5HMKR@=N=zKPF`+u0Epg-Rmo(tK)6+mmqpZ~8R%2?h>pnCh-Cz$->!ppDUKTVU zrgzM0F>A%F9kY7O8Zm3e^pSt-=gHH4^5Bw1RL!{bM`ZC~Pjm zYn5yrOK9B~<*+#dUq5C8OKYo`4GocmO=1ScY-DWBa&2r8wZ6A$%w{p0$84dBFrti2 z(`O|y=>>1-TvvAWAX~?56SJ)`Y!|bA%nmV9&NVivpS`rpfHa_O&>drTjTss{hq;sT zY{)J#SAXQH_?U6tuKEPP{Q0Rd!((=f**#{Dn8RWYm;aC1D`x+g1LXf>_KDdyX200= zq?!wB$4#SLn$4UR)94r{(PKU*OhA(|EQSbVor`ZC1!MtLXVp0U3#~7e9Q^4 zn@wxoKsh-v<|HY{oPePAT%-rBUg}80JF-lb#f|}-88as4pOk-7&Wbr(YKgf$=A4*w zRloZ8Zp?XxTpDwkA?F*sAm&0tE;4wr!AlG(mZmJ1xA1EXxx(O;F;}(dR~vFoyks3% zv961`z7={y%#AJlrg+Ku7V+F-#9IyC7B4yZa7WCYF@Glfm2g+g-Fg+0FfQhvm?R-h zxHsm$m@i|#in%}LftXifX2d)g^H9uFF;B;gk9k=6iFqt$Ld+vE6Js8Yxp{zFm(V0m zE07vVYI*YyI~p`O=JA*(VxCkx)l#$PJ-EP|@g+^Jx7A3L`9UU{HRGY+lB=pfmPDs0TlG1Fy!?L2LBZ1Z8;-|M-Fo|Y3e7uyAI zX3VQGAI8j)oS0cLZ^yh7^Lor1F|%XdRJOah_VVXY_hUY7<;yDGl4BX^X*{OI%y*@_ znD=8oh}{;|;wf&zo^*8frrDYNj2hb9n0YY^Viv~CkNHTPF`p>^wxyzpxr#Y!tUGJ1 z)iy1?ej4*x%;zy*$ap%rQ;xkldmE4PbRJuq9bfcv)8wyXzKK~Tp;N-QG2g}f74vt@ zqL}aH!D4=m`61@Vn4e;PmIgYwhNBs@_QCbcpauEq_2_$F%O^#ivkhaw{HXr8vn@Zgwp<}{Q2}>vLn1TGH zR(jRq#3uJ%8tT$rHetDh9to=^ET7OhpIqrGmI+%W zG!l9xtdp>ALhppt64pvsTV+pJBVo;iK8f2MeypFj;iqlN@V>L#+Gn1+xsBHF`X=;C z=$|kkar0;ys(!mLcBrQvA{nYW2(3b_moPA4qlAqU)=$_VVZ($$iQ7fefuHrYrQXTq z_VD)J@oPB!Z=!-EY?iQj!gz&RBhnt(7FHeVVzf##+Wv*Nb;33Y!xDxkY@4uM!j1_$ zC2XItL&D&MAqmaB4~dm#lwm1(kvLf*dt-jguN2>PSBAFEf>fp)jE_h6+u%N6=%PM{Z+1n0~7aOu*QAvT+MSk zIcxl?kIS|wha?=DaBjkR35O*do^V3Ki3uYTjz~Br;n;*D6GkQ+m2h<81|g@8b2-;m zmlj5}2&Vm`uV;Is5{^^O6OK>N37n3a;jDzS6V6FcDl#N(4Ik6ln>5#r_tbZ&g3eF4 zAmN&XYZER^xG3SWgv%2yPPioDQZ)g6;Q6tqG0&p=JZ&{<6-7&bSEwKfS0!AXI6w2N z9RbquD&?UmRv$H7mvDW;tqHd!+>mf%!p#Y{B-~_8wYerHucZ;1G9wRgMPFA_V^up1 z@AiZ{5^jIg)ApQpWMp_6vZ@mAmh(?|C1FOwJ#zjDlhv#e?n}5oVM4+q2@gnq!b37P zYjHPqa1K+ARLxdf8xJS$z{5!MmJ<^mO_-GMSmL~2a~n~56Czz{xT|*eM8cB^Qxm2o zJeBZt!jyz(WJMj^UWsC<_m`_tEG?ny_1T2yWKjt(sWHCM_Rn1J`NSRnd%-dzX4Sil z_GNjP%nbk(ak^zmgVmV{uO@sW7n<-|!mNbPWbg^E%lr}+CVZ+q40d^&t*W`(d(&jT zm9Rj|ycz)}yp!;*GN}y($u#7BgC7|D(4a!+7&6!3&sqX%(LYjcw(w63Szy8yMW_Dc zIh9-afiDuiO!!LfP9@#RRr)<2w<%Yb=?J&&&&s`gm#`?|=Y(GpzEAie;YS&vl~h`i zm8v7t@f-2$RUY`)gx?Z=Px!+$qqJ1%>U|WdL^ZO~j{M(pTxwh?Cuv|K=P&=0vO$WM z(w4GHN{5$SfWvP^E*cWwYL%UdL#aHD!gAXKmL>+qJT7?ZT_PE4F!BhU%8GQcCxfl~ZT5atMmP)?9ZO z{w+^j$CS;l)nA{EtQs>dw|lSvPg3%Lb;X zp=JE!cDvTe$CDch&)pz0pvX>0PI$*#PEQ--AMn6gvK0XQl_SyDl<+Qn{s=~=_zNVoS$+*%9$x+ z)C#(J=V<(&a<<=Pg0ogvpNC${Azdsg$; z>{8z#+>&yu>}0re^74&BZj-@i(aGjecck2z@?^?WDR-sZoiZ`y(Ufs1_oO_S@=(gX zDfgw^pYnjRJ-~@=9$%C`W$KzZs|v=aJe)Ei zb3^x8DyFV|OL-%8{j7#PYWrH%cRku@?=3Y+)ojZAly_vYDetAcF9XQjh-i=ltn4uOTsGN zXDOe{DWz_ztI#h~zLEiJZ+(dOb;>vL3^I=tjV`p?qVKu7cXP^7DjG8g`61;;=~jwO z`6=aRvv7TFcmAI)R6A}`@^2}>t0`r!NBAS<&y>GX{!ZO=Ud5MdlA$g+Z_~}`XR(>C zSEa4WqkY;GN|lebfKz4pD($LnVMjCK_Ek48?og#;m8GgIZLgv%Q{~M*?q4u^I#pS= zMgIe@bJZ=}>3->rs&uKcLX{P(bgi;hm9?vMtFls+T9ta0?nm`#HukUs2Q47X(&khyj6Nt+2aYXw=syb%iC?MRaw22qB@kOv^A^rQF3)psfg0o zB(GOxV3mGV`d1ks#Lio;YogYvBF<)V%7c5f1zcqV6CzxnCT&<{g3gv$PQ4SqWxFcdSJ|P;;8v`v=8485 zL_&6|vU8PvtL#^07ZalByQ(7W2VO&sGR)xcR_Jb3b~k(vgL@j>%i!Jy_c16rT8b20 z*yinD<$x*&nsuq`Ke)<4t^E9#nZv3aUggUMUo{v}<%lYaYjSxUS!HCE3u;_gZ=yDr@iQyt?+C z^}&c@X-9ATgWhnwsa2*a167`Drf5UNW;drzCmp2J1pmb=zzEkzylO*Y(;gMF>atSawSdEaEdt|aW3y zRsN~+Zr7w+Slk%b6baE)6-Ui8trQTCtO4^cQneraD9>&m+r?e3#_~0~*I2nm zXJZzzt07%#tWaacmQ2x`+303+R%)fL_P9!olCcTzQDfDbYvy`-8j`D#H>A*_`!$M& z2Q5mdgsgQ(CP$f6T5*k}#sM`BtdZ8J*4U!PmNjZM>NPiHTDL}4qalYQH(sNc5m&FV zMvdNvuU4baLa&F`=NB(tQ@9b=Hn^6>Qopab%h*oDHd+y?(ZA-_Mh4VeFTYOBwG_Rs z*4qaEH3rsLzs3eNHkObY8`c@8)(DwbniONN=o8P~7cpT4OUyYx9~L(rB)v zyA-4rt+A{3->Sya$9h9*>}V-&EmhRmw#Iffwy&{6jlnhEvU9c?BriSOYvPKiiQ!H) zb~ed-S}As^F|@`o!*{hJt5Cyh>{es<8hc3K!|srenr9!a@VB`!o^XxN_o}gXjeTnD zTVuZ(`&(QMBXymohDjQAEcLi21xngMH4e5E&#ZAsjYFlM8l!3)R^xDacnca~@JP$X z5hhAHRNRq95h6_ucO#uQ%4* z8k9J72vfa-G@vow%{6YR*$$~WoLkM(UKsA(UgM6Mb99f?xYLa4t{QjOP+E%kvCe*U z_QuKnHEhuL4mIvI{Js|D{u&P${-D8!430PWutCL|U`S8h0;(oy1BplFH#AtS@t7g= zj&-ApCu%%dp@TG21Z!IDXI71=HKxgKYrItB*&6!L;JF&l*W3z^ z#;7Xt3pM1}Woe?QIlNqBdX1SqtG}_al6fQe)v^sTg9B>@Yid+QPUYt z-mNiPIhpNg#p!J&q(&j-baIQ{k}Q7RQX=?XjrVJOSYuAj%_Btlz@+KxZ{c$dpI2kP zTt{C=QRk@kDC8s6sjZBCQe#2QZEk9{d0~xDYkXGI(ktr7)Mn-VzNqnKjd2gQX%a1W z+B~)LO^t7rZh!Bu8sF7eRO6Q#zsmpD_@Ty+G60zquFFt{wHBwj%#U;2H~T-=+)9GF zzu%NZjX!GqX$p~Wtvb4MT-Gt^t1+dneEw}k_{U;3HLR81wmQ^VH)Fkwc6HjJP-#!h-HpC-omJ|ZE;+g$wV+jv-qT>NPQLEeShSv?C{kL{ z=y9E-PEaSTQ>wd<#U!&_*Rb5-;#5l!tQfP>O)Y!1I(4H|4QfoH8D(Zcy$m)C%3Uib zy-k$ltWjspI$PJ-rcNJ=xTV3h>a1O-uVqjC{p<9z=*`*IfI92g>pLsEoUB`SZF9Xk z1M93`X9IiP#GvRK)){2@Mg})-(U(8mjX*Z7vzbvgH@LbzkY7Oo}tZ7pxx z8Qi|k4s`}wHk5}Us*d5VXu_qgolVZ6bq=euOPyWo3^mGuE&0Rh46n0W9eI!4>+E6l z1FmxSWTNYa>g*-^QO9KTeGKkva6g0l8$7^Z^A47S3|EN`u5(BWpV-Zn@$fn$>l|go z5eAPicw`+d(~05e7XNW|j%ne?)){4ZQ@+?n+w1XlPB7#|gC`k0*>Zb|!BY(?^QRed zy1_FH>ipywRjb>==IlD>)H%1#6?Lwxb6y?!vCCu$I{af=y`av8buKdek~){xx!7mEVs&jRnXX`vy=bAd#*14n3opr9ObA6p#>fBoA1`)e@ zH`ckS?zXly)4y3!Y^z$U1P6TV#^krvoj)I2=k_`}@uiug8iV#5#}G zx!Z7Mdz>Nn)Va6LeRb}y^FW>Pbsnzspp{Frq=#CF`1L9+O{nvT5u2kd(S=N^^O#9{ z%HZTWPZ%Qp#|;tBlZG_q==EuPonr7AgHsJoGbo1V>%36sl{z!(yjbU@Ixp9mUU%PF zXs1KlfA{M4%9Gq`*tibf=Dod{bzZGAyUv?xj8C~<@-?}j#fxVdd|mC``nxxzy1{N~ zOWs&pNU9pC^c~|VXH+uYt@B=;_pR<0*7>x~2XcUm7k^l1PMx`i>-D2L^9-L~cgxqW zJmVF*@v%`psk6YMD;3GteB`q_pUanKbjijHkQ)kv#r;1mirVj$Otn^8IkhS$!S9wR*;4VDrs}v7-w!eqpo(%j3gt?s2Zi0 z!J0ua)H5=}8!d{?BKB_Kt7WX-!q+fFrwt{uPv+)CYh|o$NMD2f4EAs0S_REmr-iHi z4$N3TW19xsHrOCz!;GsluE`i=Vt3D+&)FzrBWBZKFGB(fbu&eKFVTkg) zb;gz!Yb%5DIr1~2ZzK7-0xm}tqR zOGT%QWX8iYezo?pn-MiH-b2DO_R82hgZ9HO{~W*lZbhi8mvF>mv{7Z3GDW*n7qPR6+zM`s+9aZ<*~8OLUf z$~ZyhlyO|fXlX;AeOYoEuxX=NJ8p6p8urT+Z|vYkL^>34O2(-fTAdz~ahgmkHwu8JDUET9wtdR9|oLIM+5Wvl3~`UWJtdxiaIb3^ffIs#>~+n%-$`YBJYmT$eE~ zV}8c<88>9wLE|~Ksf?R4#%0`-adU<`5k0qM+|t5tHAMSOqL0nEJ>!myJ2URexVy!p z-E-Nhw&C=B+_F6!=e-$^WK7JsFXR4<2QnVac(}#?kRju^Y+Tys~NA!GWAjOsxAY~j{)B>p0^Fo z&UiE9EqOeA2#UJ z;FF968Q*0r%2?Rq|1#s#jL$MY7pDgQExL-(x7U&ndA`c{I^!D)QvSa+MAz(#=lhHw z?6s}oD*eZd-!gvB_$lM(j9<*)73EhoG%Kk}og3->k@087zZUT?8LG}4%Gl&sdO0Oa zjwFBD-zjIY%+e$`KcZ}^f(Gpxv~SR%LB|G5HCVdg{^2YBW?Tu;_h`b!zifl$8m!r% zPlM$fbZ(GqkZ;hX!3qt!H(0sBik3t-gNoI)!6x>F=1NBS&rVjc*HsPnXt)zoV(w|L z_1^9axIzQJ!DuuxHs>gA5jt97r{VC@E57;|4`qrrv^1~us4U_gWQ z8Vt0cbsDT|h~mmbmD{Czc){O!HRLdZIv1x7LJ~&U>k*c^obyo) zj&8Uf@Qen>G&r`wN%lI**u;N)gX0VzZE)|RE8__bbUZ-Fi4C`U77y`GZg7g>r%H%r zEs6?wT?6qypiDNn zzQGL*ZftOq5${*2wesKK-Uj-*Q*m!;aH|n-YcRIqD7QDbv%y^r*Bjo^V0~+?cQ+W< z;2uj_XR#Et=eKQZ%M{;t6>*=@C3#<|@s>8Vf`=N6SNqbpy$v3=#yFu_eA`=>ejaHs z(I~>(Y{z6$gU1?7Zn!V9HMCRTr)~FJRszU4W>7k(O{tY|`PF%zMAV z2Mu&Zs?IHx)^MrJ`G0J^1^g7%_y51|C#9&MU|{8&{fqXYmQ-Iu#dA=XW zd>H}H-COx#AU|5NH}LprAU_XedCyh!F9Z2iCfcK$$8V~O0d6fz+rhs}HwN;j#gg;r z@c2uOXdwR#bbCzt{vC+69#o_Y2D;g$=0uW)M<t+QXd<(5zt* z&t0Wo!sEF~?i$FV9^E}R_g~Cg_yrB9!q;H`ovkI(G`xV?~dZJXZF|d#IvU@lZ=?%94Am>am)~>YnQY z*0N-;;nCM)P2&-p=nq=UQfm8o?#(gfbRCa%J=XK+@3~>^K+nys?(3Z!;JL*#HE==C zaH)`9TPk?yP?PUb^eA}*9;rvmqwEoSBue27_2$krRXx|}#H-sA+O66Z02#7 z$5dtCV+)T%Jr48O(qk)+y*)-K@gCcF?CPck7$0!dq ze4Vq>Y+Xwkvfi&hmpk0!2#zqA?z4 zdYt2NuE$v(V?D-sob9>u9;z=%6OXD%7DE)x5zg~C-{S(03r!(K(KdlBk`7?2SYENI z@g*LYdfeo3v&Ur~mwQ~}ajnM{9#?u?<#Dy=PV#GRt{|GA{rPcj;^XcWah>|O&f|KI z8$5258h_;0Ks1R^0m}3#0Xki#O1#BmyvIb3NglU)+~zUC<8}`n&QUSypqk_h#7(nK}Th-cX%|lA($G-5&RNyzcRa$Gsl+c|7g$jK}>R4|qK6 z@rdMG@M#{?)uuf3$4`BImUK@vbb8H2suT5(sug=~>rmr|$332q=6F1%wmjEmL7(Pa zI-;Xe)pc?y+YFCqJznsbDYN78yoVG<>pxl((2HJLz|=jdSspKXyyh`m^&-{sc*WyY zGZ&g$>Ex1ZxGF-rJ!M{p_MN4`QdgNu#qy@dTe6=XzpKnW-tm|(mDY>&LvuR1`L4%% z9`Ad6;PI8m*D?zpA1MtUpNkT>jV;YF=XjcW^NGc%Df6e!>6(Lj*ts5Gc+B(oQd%_B z89mjhOm1PF4t2izRJ`AKeCzR@$M>GwO;!`o5{lj!QKJxpEST!(2ag|R|D~cHzsPW@ z)$8pb+=DiH-baQ`=d%8q=uT1o;qj-(KOXQ%YchMlr3sO)RvDciEZ zT6ZqbpCjB7U#C2s^YqU%AWxS(UGwzKvu2)dc^1jDbe?7MESjf#o+a}vm1nWMvwKVA zodsSz?|LOwieQgCJ@f9Q=!7{=Eww15kzp@M)>e)M(Uz!iHN9o??ox1{Jj>_ZV0F2? zyFVp^DgG7mtej_+JS*l|Nm1bXg`bMK*Ydel^Q@L<^*n3jT~SL7)L%$l)eQCMlQc~O zgU8h=Sd#i#^7IcQC2Z|Hqtyi%T-V@w29@`LdAvON-nmT#^IElV*{S96^Asf^Pn4%* zi7)2~^KMieSnLX`W8{@Qf+`J#5+duZ?pW$4vsus6$kWUd=NXb`<2*^;bvn5>JG4%i z=3T37yi${|9$+_Q(dPhN+%`A3`YVR;TW`9~N$(%?}BHKRW| z@0R8F63%cvupCGjZ6D))5-baIbGAZKFW zesi8rZgT6QY75#cl;WwGkI!?fwXEAL+4tm`kmq(&WA$GX^Gq^)vK7l6%JRLrDN=7O zR*cWxnRg2dcjcKXU9xf7-R7mixfrTCIAk(kTZ9MlJZQD^niSg*73NcUrsbKQ=ixk$ z`OX z4od^bYJte)tY4s(3726nP%qFZ&@2!aND8C{PMF)FOC0N`Ze%;4r)%ullDLvL$N~2n7)QDRa*s8#0hHq|g3xhgurr=u}zP-V13Jf&~+Zx=i zuy74TXXI4)I~3Tlz_0>4neT9eI`gyoD=vk~sj|Flf!zw+z`lm;XYef9f0eDCT-NUo)B&kX3Y=JQozcMs z4k<9Qz^DR;7C5TF(FG1GaCm_ulwhkGHF@Pu({mmFR&S-gSobcEDR69o;|d&KKsUBD z!jyVww4+{FgD#o7U3=$7D6I$wcT9mZ z3ydu=uE1ygb7v{>_H>noB6`~8>;mT$IJdxgs@(0}IA00t)6YJ(NJa8fYl6k#W;AKNzG5D%MO_wtM+2&M`Hw}5;puFBPn)aF^)kW~z>YH&4!tNR>dTL68{nJt_5GkhJNb$!RAHi{TVY9(jqT;Nmo2~`xvrnM}2sgzVQ z`h;t1zGhx6pFxJyeHuPZpV*w@Nv*UKMQ4*8RgiX?2K%h#8RE0C z&n89@r=nA4H}w~8rszMdo0-?<2DdP{rNONXZf$TIgW2d;Y1r1B?iC=P9ej2)X);_I zNUMl6eA>xpxX;c$yZDUuImu^NpWS>8@fj)m@3V)`em?vA?CGYKAEghK8N}ot!hydSLPgYu2%rq<1>`7CtqkK2Q)T05%`W)wTg3pOclJ3agkvraZ8@?LK z3Tl$5h_wExC5V%KPVqU<=X{@2eNOW^%V(^Zea`S1<8!9(?(b-xrL`ahR41aHi0Nkk z$N8M?bB@os%EbV;)~&2*D5d2u-M-h(yZVs}d@l64(dQ=VkI%(ESNdG#bBWKTK9~Dk z;k$M0%Y1D(x-}Nr5Lrmc$^NRQA;;A|*Z5qgGPJy0>$_Wo>gm*J%KU0^=F8c+8+WP{=u(nqi*EhL=N_MDO3Wy6ug`sQ3Mp~Fsn7u>4lMD2B2w-6O!L{Y$W}$B z`#kKkXp!zk9`Sk9=L4S)r7dbQK2Iq7vJ5)fYEZ`Mhn&I|g+a<6YH` zES0^ZHUB`T#!9E)N2&{-?|kO?eC+dy@n>G28vdEO0H3)&Uzl^=e;CvaNy3*#`O4te zKHvO@;d`I?GR{R;IQo9@`P1hwWBAeMC!e2Xz3tuUUyS&x!QTx2ZtxF-x>cm$YSDlD zEHKJH2LCmv;*xL9V#(%r6zOEn&IXm8E=9LiF9}_XbStt*(e)Q&zV6T^L>*RF@WqO5 z++HoRc#$QF^ss=w!Jb8yEV5LQUPaa@(zi%&qc2-zIYX8zwS6%4Ly zaK$1k6`jr~qO62hX$MgPRx@14>c%5P-GSiUfw24Tf!c#SjIFiqwkKi!_RCP}GwYt}3N|%{FIj zNKzy^itJoumm)iwbC^Nd*qw?DFY?ZU1v0am z818EH-K7{eX(qa4M!XOVr4D10wN_Aa_}K_d+AV^GU$^4+h<{>E^C!2=B*WKg~b z7Z<)`Gs-AO6*;=dp+yce=ix<;Y;zvb=2R$E&@n}hEpkqgbB*D+B4-pCWBBn!PB7%e zBBP6(WcaBDPd0dp!A#C+hM)c)is)yWbDY7m430IJDaP4Fboo)473XjXzRkYLUB(+|#B! zXvn=q?rT%-FY-Ve&&uQ>b51L|Io-dA`UCMP?fQl0oHhR*@Imc$VLni@egNXt7j0v(5R2!PnJ-Omp5W@|JX| z&H1h&?-Af~xYwRBs`Ousn6`5;@R=MXCT?g@Tkxx_+ngtmBGlQQSRJAxGIl>gPH2qu63ZCAY@4!Nn=@0P6-umVUMm?~uf)nF zRxy0l5^I)N%kb3sKnqlzP=$F z7~HVLMs2#%xryO>8Qj$1W+gT+u|w>78m z9oqCA+vP8wVI_BONXX7@-(3umUWvGCiQP)<5)NSc%u!#S({<7+K=95~r6KRdUU9uf=mmlsMGz!wep7P|H5@J+j16C5|p} zOo~w5Ndy5+R>+1SRB~C7JN{Lgg?sWE2oO*{x z6B7-6-<#ZVSnu2!CB~Gvs-#opxid?gRpP=D7nK-WVqA%HOPp77Gm*1PZu{mO!*zI| zTglBw&Nt@;CAW&GLAxj#)$7f!i%VQm;_?z#nAfF>y-V&g)p)ieskd=#h2hGQ8)a$B zM&nP-#jY-KO^Itw=Jh3RC~;lMEvadIet>?wSk2v7a_7c1!BIp59?#ueV!2Z8mJ;Jj z+*;zc5|c|zDKVkM?Ik9bm}I4`gz3p9t(lTv#}2|bcF)oSO?5_gr{3X&Fi zG~Lj=Ky`Gth1DvPEZ%(@^OxLEA`^ql};m0Gx)f{=>{J*_=v$r4L+tS zv*RL9nDa@468MxMPq%rVE%9859Rr31Ja4tHf|^s}1;b~Sm{sD%5-+J#jq-AdS4zBR z_^TyeEAe`XH%b)V=y+&~E9BYcHEl}n%@S{wc&Eg>(p%|X_ne5|Y57G5=TsL{oHGle zQ16%czyb>Y-74#&5@L{3-^V3BDe-BE&q{n=V$;BB@7xk!s2v$Tuf&%nx&)&{%$xH*B`3K5=UtLzr;UA z_h0Dv+Yk}g)k07S!373$fx|ltW_jrp(Anh3*~O5q2FGgUC!l-4%H~`wVDW&J4A+^Q zB?2ze>WB7!19}E58L(8qiUEBBdKr&=mp7z$z|sNB7`|-4ash&hOALbI&yW?2E-yLt zi7sCyb=*!Js~Em&K;D9^9p)=A74ob0?PlPR1B{gjQ&Hf2VAJjUj~IV4T%GiHYE+T zjL^|Cr?gIa92~H|N!TD@!+?zp-`L;~gORa`Q_iCwSg3)Unb+n9w=lS+!L0(eHbnf} z7&0_qTSK;M)3*=Up^fjL$3Fvx2OJi-k-tLi9I#K@cNar;4cN_)-P`m%0`_dtW2Lv1#a8SU=fKdStXykA35QD#T$*GB{8H#?WQD$G%A&Q)b z2OJS_WZ+iw)SHYBI4W=(f=34&BVBsk{R;Wmfa3zU{&T#d(3}5(8`zv+P(L5kktg*# zCk31wa7w_b0cQrB6>wU>=>ca1jFGc@?)l?$+PBq73>`Spb#g7m>s;K}fN=q52b>c) z`+q@yN7u@gPM2wcNdH;W9h~z6E|9d%Iel|3l=cR^xIQnf&&2_k1bkQH`x=)9TozEO z5>&Z7;0l#Pg;5o*47e(wYe=_{s{^hH*tyIuWv&glE+8mVE^~dr4S_q_+O5ou0XGFa z8}MAf%>lOrJQ46@!1#b$1MUs#H4U~N-p%x|6H z&i7WdGFj}nGvKa(y8}0x)l%E3x(NApZff9G*iN(avG=Hf>->f+zp5tS;eba19#nw@ zObeJEu-5Z#-l|hiuj}BJW;8Q$f3D}YcOMO0pZHk7<0@($&>hwxr+Vkr-*%7eJ*7+q zJQFY@KppXfm2CnoX`n7&~5>UG;s+52i0_FvL889e5&*)Q+VoYx*8#r={1Na?z_$TE2K*%52>3o=e!vfbyTq!~M7yu--nUf3{u-Y< z_63*zp96jg_%+}+>2r5?`b+j-0~oDQYlB-|xz+>!4EQUcqYP#K4)`bF-+%=wx|iII zIhBKWq_nv*2im*1Qh+`hY?SF-rc0TwWk&YM>3WM&t8&xgp>n5fbdCKMDYIyq?qwD$ zvs#(e%T5m$FVnls(q)z?)1yq!GE0_Os!Xr4`+uSqcsKma-9gqmt)%TW%q=P|Q)byR zE0kHW%yMP=lv&5!NP0Af~j+H6%5TdB;-WmYM(YT1oOG?3HqQoH#&si@>hWA8dN zw?>)1Wp*Z)FSBNuwaTnlrhl1!W!5gUPMLMfZedfqf!bM6GPF*s`(j$qkj@V%Gq8+T zMh{huo#V!e(mf?o7sfSWER^xfuB8_Zmdb9=S3;zddf+iEQz^S%X?ufJgBz5I45=BE zZ{3hanWiCeo1TOcl-W4L4Q|?|Z)V8mWwt1@Wtpwo z^r41qZE&0N!k62(ZToI#h%{}7Hf6^$!`k>xWriEB4pAA=w`-ZB${by0w=%nz*`v&! z#&Bra9p&1q%mL=qL8HCPj3~2DnSIObS9ZJe`x}&57A|H%;RlvE$mj=`IYf#lt?0<< zWQZh;Dmy4Pefxdj4lf;Mu^evvM;JU(IWnGO${btfvofETIj+p{Wpo(w)g+-zyMLH6H#Gl3cZEoH`+nPBu=EmgOfSotaeDg+_7mznsVxI~|9 zobsAtbg|u8<}M>nEpxXaBC6?SxxTl|eMY=r?ZS`;$~@SPNStDuR%Uvchs!)tW@cN$ zqlUat=CLx5mwBShlVxUh5*xGEgkRXy(UscGi@8viR9Ixk&jep!F- zUAT`h&yX+6eAT9WZOAtUzcu(>8FiWptM7+0{}}N{gFhMk+2Ah*#q+Bnzm@sjkU!e= zKg;}O_}^{H@PnM#f6FW|N-lJ%>M$q-Lpp_YHl$0N{@7!=MM4%0S*}8#3f)5%3ppX= z#E`{9mI$eYR6}}%^b8pgGB9MxkflP_5?yD~LVAa+7_w5x(jm))uJ>PF!X?n~J|TLO zQ^e|L9fE4_I^ZE>h0t9fo!!IXD~GHavYPR)qDUvZ(_E{EtP#>TWX%wr3(}#BoO&M_ zEBnEm&cy!nV6I=t+9B(NtQ)dkNdHh5S6x_*>lU?R2^w1Hiqm&Ja$e|6y%Jn7B(H!+ zxo4UEkYY$FBnT;oghFZy&k}s==ho5dg0=~$=SrfGTF6cz!$ayJjgU=4HVbKn#337m zY#5S+q#=Vs28Zr#ZQX8`1#5+z+1@0r&vp;Pt{fw5Mb@v(- z=v1>xNyjksbIHv^wg}O>!FC~AhHMowG-TV5twXj6-Tt*ybd)U-NU{c9dL6XqF|HNp ze#iD9J6PBqLxx#>shd_IoM8u$gzOwLB4nSCT|#yZ*)3%EkiA29;6%QAC{-bQSwIOC zrK^S(y2RAi*?je|qU>wsc|hp?Gq_)9eL?6(=5EZa^PizJ&Ig4YY{(%YBMlj4@F;_a z8ayoIa6^tTc%(r!e+Acfv^kFnIo6Ql3?Ba3OQta$gLq0+j4FTnGkaO|4YuK|42~!?+Cdo zWU8hA&UX6m4!I}f-jMtLZ~Fh6@&{GLDgl!=Eo6GgvmwugJRI^!$P*z?hVGr5N2O^Y zk4y8na%p~gnuA~Mdb(0;v5dM6~3n4Fsylm2DhRh0i@&6_5 zm5^6MUi<$^(-98IdEMx57<|*<=Epnw+lIem@LhxN8GPTM7{vCW;TomL`Ekf6A)keO zZbbD*B7SQ4{kh!SkS|RAblFFryf!@8!LLHT4q2dvP~jU{B(3Tg6!NWFeaQC~YJSKM zAwODsdC-33p?@E!`HSu6Hvcb%{A%zwgTIIT(N683A%7YEcboE$A^%E~b1o$k)lqQ? z=u!bggmWK;*X?Hc>T6Zpz4h#v)?mf1zeTjeZd74Ng{>-VU18(4gv}~!V)&+Qik2)k zH++ia;m}8q;+n3%A6}Rr8Co9i1ud@t}mHt<9 z<0`IW)e^m;JGa7l6&|keNQLt&T%hu)xYe@@#ZzH|D;e`q_E6k|yY=!44Jg?S0%#C5Bdm3vgBT_s;jm>6Nc(KAu6<#(I zvHN3=E;cEcu1B@HyTfv?RhV7jZPiGH*DJhH;mrzf$;#dC)&w+G)Cf?cK?PJvs#M>t z@Lq-YD|}FKce3`h=k!I_r+=4-Qz|j1!p9YUtnian+$R-2lj>I7rHN0aho8EWY;$E) zb)2%ow-vsqFwdM{R`{yI*M`e}>Mr;AGS<(>UOI7LB#(P&;x{XWQC05VNOU8Y@bIVs<<3gRo1Dpu8AE`WuPJJ8SHQA&yG}iM)9lUs}!nkp)X618l9A?Sao}L((`hau*%U9 z$3#>Vq{=&0-mMZ7RJ?jq%iiaaeb}kWaOJehUR8FkvP+fSt8S|Dpw@q^ z{CBG|a!PKxmH!ob2(jwsO5AycDo0g0waRI#g(}Aw z|A|$OHAK(TiT^mmCHZ(mPH-CTA{uSEKFNqDSKTZ|C47nzrQ|C1)2oa#-!qIjrY+~p zDrZ$0YZaG0@u#p7c(yT|Q{~($=UI^Rt6Wg!Lc=rp602Br()f}pm#Vm`OsjI47XMWg zRqm{Eg$cQ_%1u?Sv{YSHVxj8x^@10s!TOR z_}x+oTWu45uMzJvcz=}#RM%>H_PCSo@QQ7Em4~Z5Qsq&LV#b5HV;^%mAT@ie%F|Vz zsq(lrH!(j^Yv)-mg-OC`EiAYg6S9D}QC-qbhUT z7Hp1++VD@LsD@}G;4?!$H|XZM!*X9#nOEh@Dqk5<-R0L+zNzwKm7l77TjjedKbZXQ zt8S1p-`a>0uhB*J#;oe`g%fi>TLzV{Uk&-ipbGG}D!;dDN1S>L@XsoLRr$NhKUMlg ztR1zFY4}nG`xxvM(K~YgfLJqd}TvcF}P~v-h+|>StFuv#F`OnMd-P$2kp3mHaOHzscX;$ zf9)nHo$Evluz>4Eu9sOaa=ml^4BB#sY|Fq1FCrhI{~#A4{K(BO>Z5boVbm2lrBFOU z#8DB-by-Cr`!8t`JE({vqKI0=rV*P()FT=Zt%yMpO_LKxBo?*CLK2%Q!GQ4tp ztRJya#1K_SwD4)}4UI<(;?!Z7jV<^lCQU&kB!inrY!R_d#L$Q>+hVsiwyg|i5eZ7v zwno`LVmm{!*d+Z1O5{{OaH+UheRCKrjN9^4viRPl>g@R@Q5QKjx_pzQ!bs+*`8w~ zj#Cxa*rLYq5hq0Ss?oc~i4mhC?u^`K%}LVph$}6MQ>3V7>&8T!YWQgePd9jmK|PzM zb=@-~&WactG0y2KmqeT$aZbc}5$CIj2D(AJzH=jYFGd@n7f2N&E{fdHXz86?w<6o9 zR;f{ndO#7iaCd3MWf7Mfk0@6}ZoNo!;fnF9h^r&6iMZC1Iw9h^i0cg>A8~_)y2+g4 zztNmZ#?2A8wDD{Xb*m*$>)y8+T_)xBh>3OHEq zqZ;h*wwv`hgDURHh^Hc+i+Dcb>4;|{W<)$2xpRZ5ejRRmPwMq{)U@tX*R#A3F*9OT z#EVj!iW|vf3yFG2R=Lxf{QPHguSC2myB+ai#A^|=Bi@ogwN@?uM7*JDvb^iQhEk~D zdeua$$L~bE8|gJ>-jC4KKy+;%Ydu+04_Pfmt$nMHBIZPzr7}0-l+lq28L`{qgBhvImD8o)NWj36T_wOo7ULO zaLx4P+_J`2H7>7lMUAb+ri!bvw+dY6e`*Y^v2Bg*%(-KYVTNp9V+TV{MfS zqYSUHbB$eU>{@es-@6%6<8YO*+K!G@3lV*f8hcs^tAS{KG@`~nmZZ~FN;USYakNUc z#{M-9sBvh`%@<~A{intuHTPd0;Rn_DSf_w$?mVPUKaMn>Q3l1Vi(`k?IK0LYHIA%t zl+pD|AbDwf?uAkAjSB@l*61h5;7hDdm>4|1h8X0OI*m5U$p%ld80B?}IZv%|nsG{? zzHviyXIK`-)Hu_Svud1E<6OhX))=P(si6{3nd?(I2%cBt!WtLVIKRdPwS}W)S#(v| z#WgO`$)6gRsSNLTXAd;k)>{w*C%N?p**fuDS>vi2FV}db#?>{hQFdxftGU6|wFW2D z^v5peyuQW_(q!ppja!YPioUtVEj7kl8`ll5D|_b-d)lpp$b{ZjbMsBDH|hr2?KLLW zm{enOjk{~yV_s9N`tGW6M~yoT*XUX~QZt!q^0n@&c<)tz+BJ7yjr(ivRcg)P96=@uW$9w1$>&AFJ`Wg_V8V|LELPHJ(-#XoO$m znHn?NX?RviGPP8C)P6Mqm$c_qcQ$dG*_J=ckQXh~O9pi-|J53=8U2eIvunI=_{TNg zFysS+Z`OFL#@mL!XYidG?@G;VEk$u<5xs9-8X*5@tMO%xuWD{Mt?%0!U)T7?GN^~y)sECfihkg8x%oAIkis;$w84)x zeyR~PC^z`I#xDv|=i55kp_WDZwZ?BXewU%J#5`5!&l-QJ9o1Q1JTm?@`qo*q&c8Jl z$jsJRzD}-AN1ZNpy4InNnufm4hIBHhb!@%$swUa3&LVXdtFw5WMa}CV4gTv3@7roc zNCTcFjNYS8&-%jGJC`(yWNImODZ_gi?A@j>U1u4?mo>Oto1QJbu25&?I;+%Ku}xpe z5G@X`YRDP}SF5vno!C}u6_?)F%v zbh8I|lR9agmidZ4sLpYA2VA(AH>k5=oqOusTW6y>L+Wf*XX`o}*IhrjS)I-6Y+_+I zt)ur*)lJL1Z&7DU)uyc>3u=O#ZAfh+e%Y2fSJfF>XWKg4)!Dwz#YW$u&W?2st#eqN zVRd#g;y!hT8?tMi-3-~e&Mt=N?7gJv+r7@7b@r;WhtW0K5pi$BM;O$2Ob@eU{QK6~ zug?B;4ybc*okQx#>%ck(8K(lO?$k^&$r_xDtTU=DL`03g4zF`WoimJhWSyhxj5hpe zsbZbu4L{c4adkTNbOSaG8U+>nggPghm$pikDp5|VbFxuRF?d>?Qw`DHdX|RMr8btH zF?G&V?bjJw=bSp{)){Aok_c>&6yREl5|O%a%r8* z48Ppq6$Z0-udZ{AIVaWKANQ`UbE`QO%XM|GZ{s&eCEEB+hTLrM7K7srYTfBJLnhR@ zy-uS4hTM~zXq3P>7Upx@qjgbskZWTuy9S^40fP-Hogsuk(aTRj);jcP8}7x|ZR<>wH@0vpVn8dDnP8tn;2B9~gY!proCyhjET{R`H`cbBy?Loln}n z(qZw)MtyFSFY3%QWNzK4#zLoaR?K1zN z&W~;Ur?y`G(x&`c=eIh)n^R3bI}!0$-3@COYp{63A%C0mAN2xt7SwIUtU;#+of~u* z0|v#Zk%@--T^e+2u!s@6Hr!xdgBH;jHN1PnEwjAxw4=ytiH18zv}%LZ8uT!{XM-gh zEM@r8274J4TW>?Oudz%sVn4X)5&MMG9HxU#`j3`&k9tlnUah8yA*8uV?j zX2U&mnrbPdLB9rGgS^t;J@-%1&2-joxPinv4QCA3ZLppp{SAsTz>tBBg?EkB`|B=@ z<~!OtQGe$*oZ&4t+?=#zGIelTp+d#pVABQ_5gTq;8#UZwT4H$3VBKKDVAEi1aLRyO zYKTI$8VqVM*qrN2f+0D3S7gHm8#Nfx=G?g9?)$iLuffff>;|K)nzpd0HNP0CC!iZ_ z)nMxe+cemx!M+WKHWvQ7c9#a*HrTGg_6>HhfWsT?*kD+Lof>YPUo%9V`0Z&;Qg^*I z2;5nfZhQK&%)2(&t>MP%`p?4d4farpNpgd|8;odhMTcu0|Algn?#S(D5shkaXoLM5 z9MIsv1_w1bq`}CBPRDg?mTPiVgR2|p zC+r_I-15{l4aPUPRTPW;I)iGb*Bf$!G}Dlq+VqzdBl)M4L)Y@af447e6qn)hCFTX8H18M!w@CuxdzWSob7tSvh%j#GaJlm@M43P zjQEyS*~IZc-QFfHF#g@ZB|b66nTBv z;G+g})C3xQ+2AYbVQ;rJ_KBIqPYufXnIWGym}|%v2K9EwJSmlSRR-j~Zt#sPWD}{@ zw++5)IHaS=_fo|Me>C{B!4DezH~7`ORjPdPyeh4KYe5gPognF{Epg?0KASO?MDN{EIYM)V#VI z6lJj{i#J)qoIRTKY_g=``a7XEXZ4Wp!S*mtuQq>gLzXtUj9|_+u0BncZ=zqP?cH>i zc7-ODCeBUCnh9#RMHf|6AlG-wjgXi2Uz+SIEo!oVlhd1=(c}Q5AJydO zCI_nenjEZ(Td-hMlS7*v(qyENJ6uud)0*mGO%88zM3Wm&BJ(aD;m4Sl z6zQZU$2K{x$?;82XmVnc(N?y4-CawpQZ^k4(~N%qJ>5N&lbf7k0Z%n}T65vc{F14H z9n<8@Cf7B&zR6il#;P8hT-sz@le3##(B#4<=QKID$$3rAZ=ydBDqvB!a%~$I!wu4E z<*Uh^O>Sy(bCU^8Zf|l+lkrV%ZE~AZI579;%N^>nFZ$e_OP7l3AA))ra$=K7O(r*) zV%n=ya9SzSTIl?r+~Z3+)v2{*#duefyPMo&kxo@2dpU)_; z3tg0xYH5L2y7}^(%8{L}d8g@SH19Tfuj%%eMHCc+M%3>&`M{VzH29H0Wkd|0 zH2Jj2w@tol@>!G5n|$5m8)J~~T+7QB=A38nOWCn@j9I){EE)X1$^0gNHTk>A4^4iw zlqd~~>!&8anS`HB<}U^%;a5Wx{CAlY<=3E)KP{|~f7;pU6ubQXYy1nO^D!NwSdEA- z30WG1cQ(#02D`>|GemSn*WLJ+G^kW9X2{|Omx$>R)6;MrDarcNrDA#+rFYD7hAbVk zOzfJx7?w3exJ*!=nB|ROg_sp%R*KP@cE%+`aNzA4(>&5hs84xotrV-PO@nZ5ZK}eiSxVRfcX4-05a7{*j$YBBZL+0|-H6g%6ZSkyH1F9WTJ>e!XWrK|PM zUHWYEar`bHxqV=*)`^wm>Ds<#q1t)QOw0L zd&KM+b4<*!F?+@A9dk&`$e0l^`@|d&bD-7czA^hLB@)ufz0s{2%%WJ`#T*|q zCg#kT6Jk!3e*trRuDhu`%by zoEI}L=4>fRx7;}~U;o^p369vZ`H>PJ{QQ^;VlIpqzI-Ceeaktz4#r#(b7{<-F?YpW z7IS&bO))peToH3+%(XGs#av~Xy*lO^OQ({df>PckVc(v)>tk*(`i-g}{Y<>4qiba; zOTaBL<6|bqOp3WR=C+s#F}KI=sD_rH^@xq0<=2Qsg(gu7IN3x^QG1CIgD5IViPE19 zg-=z$n1@v?(w~@nV;+=(NgJgkF%MYSEK~+1R-yDwGq34Z0`gMgmCi?v_(aT;YNRob zTQ)O(mD^M1E9cWON~iY9MU=p2W1f>&LX_})%nNGiF`vcEjF}blmZFGxG3KS1S7Tl? zAuq?g67%K6+(<3COw8$%*x50!OP|$PRNeNNo1hp3GpE?ziFr5XqnJ4{@5Q_y^Fhpq z#-B+OXC_Sog=7Igj`^f5Gb4T;Ggr1Qp-;jWG4o;;$jT*r8S|BL7xSw$C+3@&?_=g$ zn!kiaF`chkndWBxFcot;Egq0H3O6Zrca>6PJ zt0$~sUaKao))uSaS=4=vBIlZIuT19J3F{>EPZ*G}ZkuPlHqZYOHt;_b5%UR!1V5pe zP)Z0arqbuNYmCW<@%AtSf|CLOo%pgy9JdW7{%etAu7koRB1>2}2S#PG}_z zGKLM>u@6pIzb#Xu6yt^o8~rDCQ8qE=%?yfX({|X+6SipMVpBS|PS_@4yM*l%hPL^) zZI`?l6nqDx@0c*mkSvda3lSOrgv%4INZ2)Dw}j&pPDt22VUL7E5=JKMnXp&FehK?0 z?42+oVV{J3P1?RQayxX*{ng9C_w^gQA-P*;=MG3XFyWwtgA;yU*HHu?*Apu`tK7>W z$1j^3m2hankqJj79F`#B;R#118rbKi(IK{7yE;yZJv!l-gk$BEAg}COzS?o6y8eA~ z`owl(!svvt3F8t@N;o;;w1m?WPDwb`giBhFK8`cvKO6sbNXa+!kT zQ55s<$eo>VPQrx=7bTpVa9+as2^S<}60)epsbna~h~;w^CtQ+nX~Ja|qr8+0iGA|> z+~f^%i>#OXw{ypp30EcDpYTA!)d|-m+@3Ho;o5}j5^heoCE@yn8xn3zxJhcZg-enu zaoHgbN}8e*WqiV|3AZIoP%Z3|n{B?k4RIB*?=HE$aybQ@lrTBru7s(Uo+$};B;0AZ z&$dlT-nI+gFq>*karRj%0dN#KJC4<$UC@SJKPVS2(72~Q?GobX7( zV-lP2s8nb}SAAKrWb!ko()Lus(+STc%t(+-#UcjPi_%cAOerJJC%lmGa>6SKGZSVd zyqNHk@rzlaRG3*y&L$-br{j;nRfA zET``o{K(+@20uvn&=5s8sAq1D;U63Pq)pd~$L9%i6MjqhUH0GTUnP8P$UOA|`m9S5 z{3hYsgdY-qG~e$MzE7BM3|Ysd9xCg_eo|ve_$A?2X|MHMSznWNVHx}*;m?HiQu?R- zmGHL=drHrge-i#R`HQA3NXVshO6i zCPWOGr~xShQ#P=$UP?ZtmQqhCr1&Z2lrW{3Qc4N_U%@4?qOcY`62IjogIO9HDb18L zrDZ&EN@D5Bk|9oggHi^ktZ%{pmqKOvmepO!Y?!i9%8-Yj?t7?gk!Df^@xm~v3czA5{q?4NQ#ik?}^ zlBWT-#`y}Ow*#KhEF24brbf>Otot3bm)4c43xrNnWFbsHTu0K<=T|nQYNHamvVi|jVU)-LFv-E zIBzgqzr(mW<(8E3DYs@BG~cXjHL+5G>jmT6QzoX|l`=JDQp)6%DJgd-3l%p+*LYj= zG8LERQ+HazB;S+$Pq`=M-jw^4k>QR(KVDJoWF@9Cp>q0Q%0nsVx459iw3O*;N-YX4 z9!_~A<&TsP(<=tqeb5q>$F(6#hNYFYSFL7+AU{|bwo|doJ~&kdonSrme*_1zr}zS z16xR!RPqx3fThZ7r*kDss^6m6V&4|~wJ5a+T5R583rTJfwrI5&)S{vkwrIA9TSP5t zE$S^A%297ut$HU)Rg;z568+sJg2Zx^8oaT$vkzH03~sT0iy zkB)NEbf`~~B}8z?7Q>7|xD-iZRlGa5*rmnpE%s=!tNHHMa)%z}HK@ax3#Dhz7JIcA z(PEz#d#ku~WzrTaBxi26KHSw6f}H!eIKYIQqBOKPsKwDOj!|v4IHbj4Ee>xnvc;$t zhZ>vqo>W1qL469Y>y3g(v^cWGQ7yM6ofVx@t4QT_Y>VSsjJB}H8$6-KiLHer6D3tV z`qb~7)Z%2zh@8rWvU6&S(^{O~;*1vKTAbZtOp7yHoYi7%3x(B*xGWi}GCho@fHH%E z=d?Jt#d#K;Qai!^7%RFqfG%utkpvE6%pfi{h8tSk*y55Fmzwi3gIBk>+z^GjqQ#Yl zU)82$P4Ai(*Ba%zHvRh6!uyFgwYa&(QiJF_gmcB;D$y6cel8w#l6ORz7Iu zLu=(&6Ny#-m7FQ#os#oqoK}8s<&RcAY30*a7Phj;B!AY*m#r*l;X$9)Gs-m*TvX@%Y=a{L{)Zb+H{>b4b24R0X9^ zi{}Ch9xHin--}vGmrB&!L)CBRv9iZ%9;+MMDjutPwD*u%2ak>( zojlhoMUkKA-H?RHdZI{X7mu|(avph)t{!W9^!3=*V;zrf9-Dh?;jymAdLA2kY~-=N z#|BnzcY_io7t#nNQSz&eJvQ;!)MGPCRf!s%|7|)*jn})(rRf!s{^in|Uu3{VNv8zYgBk*W79?!$~xNNesn+z)+1?M=VhaMS^ ztm*b|?bO`D3m!#}Lp=`jD0!4U_VC!#qvBEZXnG9usCh&lb&rM>6o)U>PTA#X4H%VTek13V7&*vDgEkNxB@Nn5MdQc2SGw!EssK_=>8 zk3&2+e~9Z6PYERXaE~KAPVyM-aiqsl9>;kc?{T!pF&@WyjFf!SEw+YKk|sk8p5QUc zgr8`VV-02Vm~)KB$sVVBoZ&In;}nlmJx)`T^>Qx`Ucb{d&|+K#RVf+yOpmiX&X!A? zh1WRBHIs^tOV^hbCI5Vn3q1GM>=>U5JuXtMeOi1j_PE63C6AXqE>-h+-0LyX<8qHH zJZ|y0)#FN!t30mrxL)z!)V{{!T0`0lc5bGKD&t6>8$53GxXI&Ybr5@-ptDhN?er!{ zh;+Nn<90=Ok9$1s@c5s{ogR0YG__`IWK~ei`h{`a*5f?JdrUAMRXO$?*EPDNCVAZF z@ubI79`}1Z;PHsZqaF`>O!j!l<6+AsvC=1&7Mn%zF-v;f;|Y)D&!#4xvSP$nuTkk! zJf?a)?=j8eX^&?-p7nSxX;U#sru2+uD(t-A@uJ6cj~V7s@)K>5{kN>R^dc5WFy2l$Hb3EQO^x2#Hk+v6RNcg5Uxg@xr3 zqU&4VA9#G|@v+Az9v^wk^O$dj4H2l=#Gmp@WE$C?1UTw($V7 z06r`E?BX-Tr;SfrpG|!>^J(X^vd>yRU42&ZS=Fb5Pe-5jKCAhx?z4vPhL5MB6+u3h zcH74(g|bdQYx;Ed>EffHtyb2rl;R;fENw$C~~8~Akh>E^Sp&w4)V`zz`z$#PUx z#Ptpvm^Sp;$Y*1pO?>x0OALA}iVYGENs_<0&lW!0`t%D5v)Hwlqex(Yr;V-O|wPg$elQ}t;Yz2+17)O{L0@=TdsxzrY_n)t=6 zYnbnbe$n+5Fx+Q^&%r*2`0U}cr_a7Jm(N~tDL(u7E1m~66<2k1&F+!f-{%0I1APwi zU0+beIWX3~H!V!7}?{k>X;U-7>^HpyA)OnQ8(Z-{&ED5Tw9Q9bAkv_-y z9PcyHXOhneKBIgt_qoF7M4yv<&hk0iXSB~4pHqEKGa)DYjP*Iia7_kci|O-OD(-Zj zGmL(wL0LdL#}*KNj?cM@^F9~(oab}C@myd~-B4OdLR|5SeJ=62)aNowRYS*NB<4BC z-lbmYbCu6+KDYZ^?Q@OKjXpQ|TZC<<%8i zUiy6GGtXzf&&LWodID|hoH-70div8AWfiKC@l&7Ad_MR2!skn$1wLPi(kG=4`t8+l z-zyd(HXXjx<_#g=sK0A()uhz7K8w}e((IAuJD=~>Nz-U?^#`9HRl79((){G}vrnfq zYo__d=U3^Orp4HP^ZC=~FQ4Ci{_t6%xJPQKyu!BV2&%Gzy8iZAX7qmy{!3qOx5`DD zmD03Nvs#)qCcIsmmD98}JQk(Ou99ZevMCIye*+uM} zri*3VBF$Q9x~5q_%?4@KHim9VDeG8XWn4GSdL~VHTzdC38>ZPL&8Eh@k#TOE@Tj=B zQc`2HG@B=M-70CzG+U+FI?Xngx2HiR^)MvP+sp9Y2K$(*eGOOX;_RPhyENG}xikaP zY@eppQU|6Plx9epp~{kGMX0RbU8T_wqyBH;|k>IYTrx@Z=yfl8Abixy+3H~D? zlhEUu=F=3@l+qLuy7Vk3c+HSXnrcE(s!ECMwr((%(=>dT!QHIlyBi#CP&|94*(=R4 zX^u_1=j*-G9Hj5qNb@xN8f8C&2N>Mn;DL{(4m9K-g9oQMB<=Qk>0GdOa7llKd z%a@;+<|IQ#i*CpmgD1yCy-hYm`=CxuD9V0DnlsZ}l;+|zXQeqi%>`*LOmmJ2KQGPs zY0fpZ)o1kyEPd3)vyG05U^<|r-K5%xrEUM0q`5TBO=)gUb6J|p(_EA0+B8?BxiZaF z`s{xiEzYarniuIKx9*`*Gu~eAOzw4Qu1|AAnj6z@2-aq4eewS1&)gve*-HD(^ey^Z z(%hQn&NO$Wxh>7@lBUK|U-%@o-$rg{+M;#bCRi0A#k%T1dYXIEj7u|KZDhl%LXd=O zrBPc__gm6T5~?PV;Kg*kG=E_ks?3dxKG;hn`0XGCL0>2}#4mdX8-8Ao| zc|Xku)(Zv&e3<4VSvYXZhV#j!KQ&^=(ofQ=Hd5~53zW8v|i ze>V--EMW71EdqK5^s-jo(%?1*w+h(W5VgK$4uU=GR__IR8zSTP3+Q8b-+*lc_hS*U zX>X@s|A6fRH~b9<*xr!-$@`;$0l(PfXNQ0t0|p1|6mW3BAptuF>=IB3s0IuP7#ffb z$OY^gxQ&`#fFICm__)p~b?S6L5D*4r0(YQZ-#rkUwzg_#wU!{XIa!o^KtV0oF{O_l z6s4_YFB`wuluP`A`mS0nAPU$kU~l75-m{i3uLlS=3^ol83)sz&-3=;rc)$q5_edyv z2F&g4vhNeHZ@~Tm2bj$LWcHp;NeP!eLJlTqL|J&y?7>WcCnZ4^n6K;=@BHgAs%7!z=Ez;R}C5sx?I1cRdto)~bFA)^h7M|(WR z26QtCmj#>>aH>pgPn3eENqId81e_6YrYab4wwy5F!hmxE&J8#(;QYY-(V(LO^@x;4 zPn{PSI?RR85r3vG3b;7nl7LGC9_Zk99WR*Srmy;SZ@eX5e+s@+_7Aus;PQIvO7p0z z0+XL1~Kodl|C)g;bw}B7EDBexVE0Z}oM4*gs^ukO84PB_wMrGTdOl=p87rAv?$dy;3`d z3>K~s)GjskrPNL#JFBK$QhtB;Y%BWEkX=Kr3Eh)gYls(eO30}pen>jx#E_Fhf{;)a z2stQpZkY+Ggj5aB8q5hAqSS&RMS~@S<miMhrrnA@!jNGh zyBV^3LLY93mcsT3+0*d7LiRCaZ-epIVD>d!a`p?^-*9EotuCERJlH6Qg&ZDoNWyuj zA@OG!jtDu| z+DKhMU!>V@ri)-|$J0X24LL95^pG<`&I~y#{Iw9mZci6GCUOWaLC_g=SM;w4S6o) z`H;tCy=_xVA4u(|k2YvQAmoXVC)HCzri45l@=Qp(_Nl27)g{$oQEH_9C+pC`sb{V4 zsM}ukjWdGQx~GMF81hlb3n4FtOb?k6@h)D;7PpN~ZoE?U0%o zGAm?u$m=0G)2DUsVRKp}Q*N(8M{9kG32!PXWb=)oLN{irB;b2}^755~VEK zC8Au)@_xt%p?j;YR?`@yFSE@HnIH0pYNy~I@=3@~AwP$FYBu>Ii?kJPo{{GGQ-2$xKTce(cOG1{0{Amn&3Hz7TUB6e; zi2P5;GE-Y80rktXKUFGoLa*e;%78*cFNGzC~IciFxuJhE*aLcTjg46UvOI6=<8(Y zW&%}^=3VP1`1%<($k08*c`vnSA$Q2HsSPvk*zZOeHqNj~hD|fHX7Dm>mT_ZQ?+kr1 zY;L%2x5%(%hOIKZtZ&h%p%Y}A3_TK_o*8;2c+A!}!}b{l8gW~L{WA17WV?iOK*qgK zmrPxQRD}#XX7nfS6_mloHYCGNhU{!`7lU!Gp@u8(uK&s9XDF%_GNhB#AVZiTlOb!A zyy>4a7^_-HYNXv?l2*>pNb*)PR1L2sl*o{JhV^?o=4OUr8FoujM`YMN!|;sz%ZxlB zhGN?z!=A>oSHiisA^T+9yAm<%uLhOdWNDk_zzhe;88SSX;b3don=|NjgWT+p42Nbo zEW_a$j>vF!hI7p2j?6GB!-*M=GXA489AorjGn`6vGT81+-uGi?xA*ajcS^~Rd;d-N-pWySO%?4X(prd z<64{2*HJW;l|Vgj9&O8dPl;!C%Xb;Rw+c?lFg3%|8J@}TY=&1dylV94GVWt^(+z(< z!!+ycFJySp5G5%HC_bpxGmPgYqraSC&Qv#`i~gGM3~w5JW`InBlz)?`K@-R*4d;L0?m7wWd7hqYU%pAxc#U>f|0h zw34P%?TT#b8hUt9md`SLp5f~Z-(>hA!X=!H|^t-ToD|r?a3Nb}-O#p`K^^7ZCQA>)duHith*EoH=`ACe zcl9wuoZDvUm!*G}?Tj)o%K$^fw!La$pIQ?BLD$qEscMwCbP;#Tx@e;>-Ve>PbJj(z zU9t?xy1$RT>tXNYeqr40`ZhFP>dRSdbTJJ-Blmi^5#`7DJj zMe*BhGs`eT$_6V2t64X8*RpOvj||ogHVn$)cQdx(2G#DnXWf2dWf@_VJ&a9x_sp_a zg72MWAH(-eC{JmLTfsle5vsMELD3+~G0&zB%en`ygR>lB7LZvEHL+9e_5I;lM)!At zQ8UA%vgna^TAS3-%4nuLHp|#7r(_vvx5pWjNsl+=ge;>H%87=YWN@^>F3Sha?vcOWjQ^Ib|ajTT%6^?gmRG~ z`mMkvhFog!GJ}^JRIV%JlNRBxlF@8A@oG!DMs|pQe4xkbtoz!}tgMUJH)Odn%S~Bs z&T>nZhqFAQ)GW7UxiiaMg8K4LmOJDaYI^N|nCD`MKD!}z(ui<(mV2^{%Q9Y0vZJFv zqE}sGQkpO;%1w~+{Zsdv7io~1D34vfd{UPC47uOn0|p;7IN9Js2KBiuF+ZB+u`E-v zOwIDR+)~|8YG=_WwwAo^exafj4|&n`E2XpuCNFwA%QIP?&GK9pxxHro^XI!rs5Od1 zcT4FDEzf6}W-X=R=7lUTW|?jtG9$~YR<7LsC9~Me2469#m*7(7wJbA@N6&`3mGx$4 z-6ZgJgKrp|qqhKth(0&VTZX@#P~I`*U4!psdEbx^lGG0k`ABZCo}1@U?dT;v0ht4a)5oDcmLaVne>m z^1UHH82m9w{VB`OhW}#lSA!pob$#deEPrHKl4WU@m2$Mn@n@F5)FN4yS+M$BCTel3 z$GQ}qmaEU^Xvsm&edS4)LVcVnB*xq3XqThCc(ksYW0f4M8ZPFKN3HmmnF5+_#ju(s zNtq5gI_A(*+j%)UehP=$xZVj$Dp>j+bn zx;fU%vA*G3B&i$Z=$>OkyWJ?qrU`xH9GfJ#hQiGfd~?Z9YQ1HStrGgyhHR6ghx9R< z#I@*^b7MqrgMAG4HMp(8eg^f@Uj~eAwY|yN+2Ft&gA(~W7_wuI!3kxj|7fy{5r-HY zYH-&atvNiyeS?`C=^TOKVU7nTyAo%QP3aPn%^^f%Um-^^$38jsHO^9wy>jfGqina8 z9Mv4P98r$pMyVT=gxzyAay0FBSdQHc`6K04>9$+$Z=qfgK`{fw?`U0#NeR@56f}5A+o%h;0QIh4jdhuIx5G}Mn5LU zv4%)~{G+{*IgU%Rh;l-bI?9j}bDU(z=!9OrHZ@i@wDtefa-3rLsRs4VOZ3wXKO^Be zGsjtmpKb6QgXbox`i#u^<}K3pf*cp-xG2ZPIWEa@qtP!-Qm;4UvK*Hiaz#SF(vYii zTy4lT3H{m}*CqIpw$2(i=+=>C^4)xz0lg%^#XYfvg zcNx6f;5`P%JbXfqdkvqMP$n62pTYYLK436B)(wIW8UBR9hYdcG<55GD`j{b) ztFzk}C(4sKo=Q@u%F{7Vr#yY~^p)5=o%3v+XPZ1-@~oAod!7yRbj`DNo()XGI(fPo zvc8C>#=54@dZvkl|7*G!*(lG(Nzt3+*)-2qcDtFuEfXP|TlOuI+qia;psES)k*8Nu z>z>9F3-6r}x6RWp&)_^e<=uK+|2#XG{O$4#Fl2j!1C3uY2ia|0ir|hWGcIfAJgt_x zi@_lVRnwt)cKuH-FOQ!mohQgsl=68(OU>rV<;f%kDP!KMRxlXXNKjYVC@QpSNF~V< zYgNzF$a6-XGxId_49jzLo@4UtmS^`od*#_X&+tUT9#-@SgOa>wf=JXpdG^h7gi-c0 zc#y&U^BnLWYaf{42j@A&7!J*ISf0ZTk6lQrO1NYmX+$AMna&~}Ym}4njLtJMNj)yl z@p(?jGb*8+X#C2kERs1U&&gKq>3PN`JaG}H%g`n&&l>IV;c1JYU$v^+aC@7WKeVo`8km${5PZjk>__qL{aHW5`3v4enTvjY_T_dX8^$ZcQdw~rL3@k9Hz(xf& zF0gfhZ7g*YgIgBZ)C$@x$-8-hEfPEyzLnhy?~%~^8`85tuL8Xb^eNC+TA8W0O?cwl zes&w<+Z7mKx7!J zgXj_-CU_>vl`l{za7=+?rS0(4oW7}Ifs%})_5T8g7TmnIQsB+LscL~*fyk2dT()0< zdVxlPW`SV^_9(Dtf!zx1USN2E5e2t{LW7+?EHLJalwK|Ay}VY8wLHF8fxQdtQ()f$ zS_ReONk0t=y&Tl5ZG|Ac2HL;C0R;{$a8QAR3mj5#@6p<|cgqf1?9v0fc75pesLn5F za(h_8J$xN*@CbuP8a&G2(FLY-bPV#Y)^G|D9fw_bOVv0ZF1ermqd=vw5t%oJ8r>J5b?Tvc!n+E*92 z#&i(y7ThoAKC3Z(^jfV;g1V^qTpi&{ItMlTK_5Vg|RIv z@MVDo1-`M{*ur0#@UIg}Y|Mp56vMYh7g5*u1%4>7evu7|{8-?p0;?2RwaCxvbjH@E z$ggIBWp?|U!QT!3QDBK7OAY>Q@XrE&84_zE_>bMnCd(6gs_5c>i$M&oR9w+h+7@YN z6zR6IA*#OewlA`p-F7j!deL=|&PCQJy8hC^h#d`fGPtI}xFO=|uT`XLk+m)3dX~D5 zL21&>kaaCdx4M+2dyx%`3@x&2k&TLMT%>oAKE}C;!L3Z^O^a-1w^C#CB3l@~r9sJ& z0$UrtjlmuUdm8LzFxF62RppXGY^gVeYgDh1gD!bqg zMRqJQ*oZq7*~Jvw*=}R`Lz1$@+*-u5+nkB@|5NLvkzqxmB(?q@`He)*Zl?ivaIikpsMON2qK{ZV$cY@|XtIk11x1g=-U_%Zuc&Nd{ifpdl=sdeR}{Ij$aO`oFLG6ptBYJy6)n)*wf*4R~+T=aTBgR0sCMIKD>$weMY@P`d~#GsB|K5jDKDe`WSCyG3&mMtWOk9)P3+7f z@%~Khhn!VJe}7PA-zYMt$Xi9;F7jrPx$@Fp?!(ubDal-VDXeX}GK=0*=rx3Xcl%z^ zy_fk;k#<(<{URR}`LM`GMLy9Yf021b<`><5-H(fI#Yso%)Ev6ir-1eKgU^b5UgYZ{ z-xT?x$d^SH6#1&?cJj#hQ6n|vQQK5D!oBF!CY*&u78Uun$l@aU(e{v8sVj#&Wpw0C zn_;$Y@7~ww_WL3~Xb33slY)PdUljI>w5g|NEojl!9W|~lZ8z22tWB@fvaed!S}FBM zktOD(OU-Q#FY#xQzf?+*e-zD13@ov%$Z`eJ5*w8ixo9b|Mu`q37uG1TnjtG06s3(J zZA-K(v9jT-lxSaaGnrLOD|R30<>q_7YfbU5UUIXJ_zhRb5?xEIU7}NoH7#%FlKbti z{P`fg@GbG9z5-f8Ysgx5Tc<>~lG}5#ZizNM-OMCDQL7g^>y=o)1i@0wttCUhW9qu$6()*o8u{U+Yk_A0q8e`*V*KAC)s=*OP!RFt&Z&ve^g z_AhZ@iG!>~9=4af2V2r1@;c)@w8UZN3~EO?!x5(5ktL2QakSy58wO~cWURB zI8TjoAn5}+zr+Rdx?$Wfj0;O#B&}+UtZ{LPOG1^dK@kWU`CEhIYc8Pc7lf6@uA4ttrHP!kSJf%Z4w?+RL+G$VM4c|36s=I9Ueu)oC zd?-&SF|WkuCB7&zUkoKaDeOpSDuTJ*q53uvral3}JxkCMAk$PW=pG@sN`RBTre zSgA~#vKtiI8f<4!w=0)d%y`?ES*^@lW!^5cdf7QxKjT@WOouWZ%XBKce?x3jX3a94 zEouF-`yzdpGF{88ZTMPcuF`*S6#vU~E3LE$8rX7Nm(&Jj zx|i9o%tmE4FSA9NjmvCOX45j8mEC_xbqq&P&7mC;@>u=6SOfi*Ww*_2D>0PakpwMh z=rD*}Nc%Aq%6gRDn9{RMuQI*M^eNL<{AIUeS%Z;wcW<)DeTYMQ7Y`nnI(%lTf0^yd z3@EdG+06#0l^IxOP}%LFU8<3y%#LNQE^|$p!DW4zmt)I}EVFZ&UCQiUX1Lj5NSUxq zrtAikp$2y?(^|$8UM6jnpzMZMt+D9S3hIUf4bPU{c%)oWnVcHScnXqPrd+0|vT*A# zs!^p()lzGsH&U8z#ml6UDWqPeVVX3{3@f|v5{Kp8%4qr>zigF1Xc!$)W{{Vv(GW(R-*CZTZ@+DzE>DE8BzcFhh(n`gFWezfxq>ly&=_a;A%N!xa${c3p z9&S){d7VZv6?BxTeRP?J7PlN@4yn1c7>+A*e3?tiTw3OYGNa0zWeOvcs{4%E-kM^{P=Ss{g*lI-wJ?gRvX9vQ3yTJjnS!!JJL1Zc1No^vL_W* zs?erF+X@?0Tx@Jtaj{+g)3w6N6;`RRYK8U{I#%dZVYLdYS6HJ$hYDKM)kwVrw?$U( z7WCAn0KWdn)S4AKSLjkj*}lTSgrbSW4i&dOZ^w#@)q}0Xohs~Hao+=3%Z4_UJG8>CnlV<~fY@5Wt8i$= zbsWD!xG&uTZE^RM8d6GV+Mj{0{Ccp$0+a z($6j{6^_v2!1Cp4i>ShMMQLl(dWA-XW`$uD_K?^LyH(h|!te?sD(*jDdRW$KjBH-& zmC_Td4o@BQacVC$ij=IduY9AE^@aJVPqFsj0d z6;7&fp3z5F+?LK$Dx6wjj8RTDIM$$K#+xutv)i)_o^J4r3TGOk*|^wroo%=0R5ID@pH2k83a&d)A3_rTnNw}=Sft#m%m-tGML?g_r9q++cEUGMDI@#fn9&L&j2SIu2>pDUbLVN!)z6=qksufqKmo|Q*w*{8yT6%;lf zuP|9%Qp<7XGY?hV|4Vh8lB|}~|_=>?-4Zdbjd1qEu zJX*e9;f)IOD|}pGj^djf^1GDQDCU~oJ~a4Ng|{obQ{mkT?^SqTE;KdOy$gy+@^(EJ ztZ`rJ0}1Jn`mmR4&5tU~v;L))QmQKQNrg{ks4A1Id{*J}3KvzmxXKsuKy~3NL6rp+ zzEWtavRRd{D|}Pop9;$=EUd7o;wD{x8~nDy&lP?#d~t>EDtuqz2ebK4M*Pum@oWAN zuO6#M|61XX3QH<(mHszl``vIcEVbJ|D=Qu(2MtgCrT%EchlJ=-7FBAwLU)xls-&v4 zRH4dBRoYcqxk{U=&HP1-$2gm8X!Kdd=*ru^%BqIT38jqKR;#Wku0xfM!mF%f44n*i zj+v7zlF-HQwG4JODEZy0PR|YPcHJuLRaw8v2BwCdb2T9pR9W4PB7Wf;RoS@8CRVyA zk}SA+l`X35TxFLkTN-oED!okXRtC2=xQ)Rc29>LKl|EIruQISo-zwWySG>LISEYZI z0mdfz+a+bG?z)Xj9Av3GRoxtK2g7%)GT1o95OYdfr4BKDgzsv|(CUi!EHYzj)eX2_ z72lA!t-~rAX;S5YD%mQzDtlDfv&yt*Qu!*wO-P|iF;=fiRHa^}T%}T_YN<6-<6j+w zsPsma-7K|PWtcID7$@y+blu7(BNAN7>}9wR`On^l?_+xIYq*H}Ro&{Js&Js%vC6Sk zMq2G;frE|b5L5EdDu-1$yvh-Fd$i>`vbtjTpoWH{61yE^#K<&JA3v_jXe&|p@l{T! zGOEgnRTs7N_#mh!my@g@-Hxepa+R@FPN{Of5mlp8tDIZqyeg*|<@73NR5{b|vlE`P z3{lh=uIH*eZ^)BXo-$-gm8n&pHvE|?&nBfyviu~j#k49f7{hB-UaT_R zcwRO*!{{#=R2K0o*DH1_#a>OUA$(?)S#~?yQeQXtM#8C#a>BV)-ZrzmWt?&C-ZA^U zTjf3ZVb#sqJ~EH`z;Hb~d{}j_21K7{(&ihC{ozvu|0>^A`M%2M3jS5TG09(=%-Dtt zjQ=ZxUmJ{Tz0hz~XHk`J4PR_9_T(R`{AjAKRO2V3ONZrEey;LMm0zp;R^_iMe_PV; zRsN{5#0rfo6&JCz%Adv%-^TjV+|w5(L<>+j%0SI{r^g4ry6S-PiKQ&46bD`wq&efw;Jo# z=wD;I8tc_q-x#*8v4J6*8SGwT!yI1N*x2Zs7~IrgT+_{KF0`sTTh!Rn=vx_# zYrT!(iZ(rJ^sLdVM(-MZYV=EZ`dY2GO@zcUV?77d*uF-lMz+Sl8iOp$F2*T_9ct`o zc?TQZ$>_?yv#A|7(2yEKYwT(afn{&4;nnaB7jxPWF~|I2a;v1A;f)&28u=Q98pR}6 z$q?yKHl$LcTBByAL^bM(-C~)7YNlbvxrf2sYV2NPxZxuV#{ZIt`DHgDd)3%aACRfB zPmO(R?wR7yn)?C4el_=;xPOfUY8+VOpc)6)IHZPV{(2tNrIlOZdaOIQXKI^I+*#nm zY8+nUh#E)MII70cHIAwA=*y|EUULtRdbgrndScRgow6KPg-nMgc_sdbrBsR zPONcKjW23^DaBe+qh;+HPt+JwKfNryIiYAw-pS*>ucO#Y}(DGjayn~xyf4LW`oLmOO0EN;WpD;&3Ai^I}HC{ zjXMpwtHwP^>fMH@i;XixJycmHB&qk-n3&*7y06ClH6Aeej~INg#^f3g8LrYFmZ#ZC zE=;0YP_WO?dZ<9>0wjzbNS&bHD0apT8)`CX4QDR#yd4; zn?2vCF{j4smRB#tFYC#hHRjgbTyA$g6#wiV#NMjWw@XSYJ*=-!)OfGPCpA8m8_Q2> zd?=@_p^Q2uCuS`a%&T$geeO4@dLK7meMC5$6q>5Qx| zQ7kZhzOM02jjzn{ltpSRtg%QzLv#2V-`3nY*`Gdl{UA=9WSLp4P0*KzHZ)jQ6E?Y!w6tQu{CJ~!P zY!Fj@%-QY}+GpU49#bTHEg#xlvCBmtuV) z`bG?n*ePOHz4?vUE^^EJ{UZ8DX#1kSQ;;YIin>Bza9&h_h8-8yuC@p$*2+>dS5 zE)$Ve=`vk}_KnEMM-6xXBGG<^Wp)l-XZDMcTl>;gGNc?)F(l~V+&D5FwyLvroq9wg zq8TwPVtGVLK~;?yF(cxoh~W_K@JdcV8osgdqr-Nuy@41mZa2ujH2kV zpHcQtZpEh5IN%&)Ns2;;MjRG#Rm9a1hesR{adO01%c9gHBaSls=!nsl<(POP5EY?ZaSrarGb7H5 zI4|OSOFcW{oQQKxnuNrq2*$!MP#Z;DWRl|~6%k*TMqFkRbbEQk6%kh^3dGr^Rcw=M zBCd@X7ct)WuQRrL48K0&hKL&@Zi=`$;tsiJ#4QoGM%)&0dm=EdQLKP)iB+L@M%)!~ zx5*JPR#^17bioM`_eMNv47!~d@mR#;5tAbBi?~1Hfry7A9-@F)Ibx2GbeL`;o%I^vm#=M^+8-3;!4HJzZ~&O z#N3FtjP2Ek*%7ZB{#wLLLuMJ2G-Xt-H|%y!B2APxjUpxAHsrgA?+tk;;@yb%BHoYq zz$jlvd>HYO;U7oLi8_z#U zMV1*cZqSxGZR@nF+l;;Ldi_cU+ZYtj%5~TAb**1#6~kAp)4tAXhOc2zxmK^Qc#7{( zr(>N?M(e>a0_zTb-^dG|44;tk1f}yq?kHEHT`mPWL(+#(Ku{|2i9+ zlA9QmgiY&gX4yA4xP`$j4aUN^snetG#@~T;de+%fZ?d|i`qkYi)~inMI(_Q&m112| zg^n)TYh2s5?iOh^`OyH;zwU;E?F6CtD|1 zXXiS*)bZ;0b%xX#T4&cft#w{%y2)+tN$x}9hwbkcgf+hCjZ(T!P$#UD(Oh?0s^4^X zjd?Al`G#gedM%=F=I84a>Qw90>J(MGI^{YQmAGfB^T+Nd@_N~=UvljFlM|@F$wvzN zbsBY=b+=L~ftsu6HIPQ|_{GGy`KjIO46iey!5$4p)Y+r%{*2bY!Jc*Ys&jaqBkJre zquHl9_Ax|4_N}vDo&D<^Q0LG(ht)Z-&Ovn!u5(D;eLqw0_%xl<2&-v-T)_i|yMeO% z%oexxaYpLMIuqNbj;nKgould;U3dFJWz1u&)zqfP))|@LTFX75&Zs(%*LkAOiFHn@ zb4{IV>x`E1-3wgKG-OPjlMNAZtRbfuJhjeg<}Ifi)cZSqM@T$p)j6lmxst4d0QD8m znCI0w-*R1D=Yl#H*15uNuNvN~2s= zcN1MLzl)+$#Bg0*+d-X>$#rh1bEAA)fx6C3b#AV6SDm}-Zmx1mom&kNu6Lb+x7E45 z&K*Y71BI;gzdCo;-5fx>vtDZNK8Bz#%->^nQ#b)Jzu>%3Cu*`ys`FyuLd&zni7)!i5P4;}65@}kkF*O?KssYX^c#er9i@`kA= z&e!V9G|DW4vki*=x=QSlk~QYk-TRI=jjk9qx6WHhta#h{f|%d6CV0=(P@}wG=Ys_Q zu+B$@%jWay?zov4KB@C*o!{&Hp`Na-#dW@}^Nr!38~noHmvt7H-SoN6uj+31qso%M zEv)l>ogWk=wfa5zJeFN=Q)kN`cEAF2<%jzswi4C{d-mXDQ!velR3@(}N zMvXQN+A0(r>3mfUE#<|(a)VVYqh2fMcD07EvI{5=|O2;0iw)&{q+ifCc2 zr|~FE^=i=D6jo)`+>+eaIJa%k&k+4BNc8O*&i@BA*uKHQ27?+D8hSK#&oVnS7}{`s zaK{FN8|>6z=LWkp7}7wGODaooZ@6CkwQ&zA>b95QMvYw?w2I$?o+sgkrws-MLxUNE zS%YHE8Im{n!C2?&CDUP8gK~pPgKC3XgL;ETgQ(#ixAj!3hr5)5kCq??rJ4;lt}Xn` zeVfr`*N?y&>~1w3Zcr5cesRwRdo}1gjBSUpx7Ga!S*gK34fbug&zy1_FIo^3Fu!O0EAH5lJuY=cu8T-o5N2B%t$&TMd2 zgVPK@T^^`yVCM5e?+Zzp-*GlusYd|-%5 zR82oL{L=;>S+03@JHNrlhJ2D(Kt+rHvj(3x_`;IDGAIdOHdtVIY#&j+Zt%^2DBmi? zHQ1m@_a@&p_`X5sCS95?QvJ~2uLgfB#5MTIvi#iOcSC+@@N0wL4391Rulzq6EHSzy zEY&DrxHOE}{%NpMlQvD3S&fz(Of_Bn*VQ7#a53w)t*Oz`DD9f8++-D_NOFfJt2SwG zx2rW>ClXQD>PA^35falo8F9^oC{<(mYZ*nkx=KQmb((ZD&h?DGZk)?BS>K9KMlo;L zWTPgTCRtp#GflsB&C!2d|wvB}N}|KKJ&C3swgU78GO zGPKFAOB|ouo4SR8cmu_in?u5Zc;IN&0s9H zYIt0F)TC~=|7t$0$sSGiG~#Yec5gDg$%up}&Ly~4lf9c9*yNxl`!w0N$^K0aXtH0z zsj~iMj?2~U!DjYDn;d3rhZu}g|K*n^M;iTDgGV(v+K^+c*0D_Sj5OkL8U+lAg`C*r zq$UqEd9caoCS#i1*5vjkCpQ_}k2==u*pqEzo^N@O)fF~$|hGexwOe;O)j@ayu#`(%~gee z4RWm$c019aY$8r>@{oG^Fxn5};UPHpmZlV{8zlBrA9c-Gj2#EtvB-A*(3LQ?A)b}Rl@ z4SA`_%Z8{?UP+|A)?{XrSqbNCLuAI+o4k?85x+{A+vKe#-#7W8$=gldG0p`|-Zf-i zlle{FYw~`R4-#n~CK5g}O025%`MAkvO+Ih(iB(XPPZNf?tS_2;ndDWf^!cjE*T(Zr zlW#58!X}H1M`D#rJh~QZ6tL8osJuTm`KigzNqxoni!uDs-riTTxK##KsmZuoVNa zyIbGy*_Zo!|7*?K>pN#o?6c24`}CPr%-ixsRw%M!J8VA#E4AZS5-Xcai^Kj!RxPsH z|M|MQMY2YbH4Us~w3Y4v!vl>DGCJ7k5TiqjZh}bhe>1+YUXfu%jxM@!#QH^s7pWIX zi*B#W21P~}8B=6K`?`^6kxhzjj6b5trbV}7Q71_MVE=6`NvPF?Ci|kZn=OSAb z8Chi8BHI<&y2v&~^h2EKqg?-7ixIm$)S)fb=YH>o3ELOhq3F(y?x;@q+8r84Y^bvX zT9J9jUHqt`d3jJ_w<5b2*`vswMK|kmM7P4I0}5J^*{jGX3#;qCwVooD6za11Zs}^Q zI4t59DHbUeDHo{}sTT2y=$xry*7TQVoV2G@t1y}=(s8YzNLVB)5*OXg&svGlGL05l zG)tBg5qS0GLQ|J<>6D*Ia-Smm8fX^D4CF>TjY`7fitKGzlM;H}ukC(#k^K!HP~^ZO z2esV~GjOocLyC-VyB}&m!&NU?uh8` zxaB#8nyH&?7jr;MSEA>sP>Nho3K10b+<1$V0Y0LCwMJ_M$ zRE?)=Tv6mo=|+`ps$5m%>LNFmxT(Z7MXoLKpO`OkU6JdRbkU7EZ;%J^Ty!Jln~G?r zXiCv7o=z&dNu-;LZjgS9(aAX|1MIJVOgdZvL zXd6Ff;Bli*6nWB$rlkW<6?wYIGg7c3pBCLu7M`=*JzwO7qMOXoF5(x9%upRH@=lSN zMP4d0tH|skFBf^G$g4$OE28sdDv>j6?|~S0|HQO=s$W-}GB`!vD!N_qn!CHZr@Ne4 z+N%{e?K77o-!1Z9k&lXeT;%;CbBcUW7wYi+ok&>molC`BC_@!Z%7q zKT{Z7_}0qnJEg8Bz^H)shfDpm!&z~Dc1z)xBEJ^-Lt%9(kPd$p`Mr(5)9%iF3oZ9Q zi~QAg|GUUPZTznRdFv=aiAzgdR-#LZt|g8yaYBi1CAycK{vTMPM~Q_>Y*k`piG@q_ zEHR+Oz!Hm;+|=a?B~~o4XoUviRIh=2XFwb5Bb|24bU$QN>?3 z&|;}!xLG1=f6Wbawk5WA+kGDc`x@QP=>8=RFwlzXpb`g{IHbh*5=WFcvc#b!4l8kZ zi3uflFTHA_Y>{Rf$81zMa++(NG=p?hiK9y#Q{q^i|Iy^?VFmqCN`5pWcU;M}mD(Yo zla*@UuUF^4#OWo@C^50bNhMA$aY~6(OPr?Ux)n5UraGt}b?HEa;#ae%*}OALoTYe5 zTu|cd66cgSx5RlRcNc+@Q_Q;2U6&8sr@vcP3cG9euf#rkRb32vy{g33<}Q4VfoqLkXY~3KHyBU`rduuF7j0Q|~Tuhv7So-epvuG^u`% z#dB|or7Hzpe68ZX-^%EL5)YQ#3GtW5x@JNx!owvVDe+c`w@W-);;|C5O8imk*iKVG zC7!ZSPn394^~kuD9Hxs0``zBtC7vnqY>DSe%q;OziRVkaP~ycBGfM6Zg?d&x>Z0aG zg|4EJeDu4_mrJ}-;?)wbNxWU$xdW}Tsd;VnsT9AO05Lqf#OtzqmeV&(TyGlHZ1y`P z-YqeK;0hUXcbU*Z!3pO*N%?dLNC zIz9JA+og3d^DBG(S~}Bq|F*<;hQDvS{9r&$WNUQrONn1qgUYN@b{YAtM6WVSl=Gm(PYME`@Uso$Lu*{$`tDDOjZTB?|tW{=h0|VObt>M7nG8>u8kTOHd ztW##)G8?x2tY=`j(P2i{FS~`0*4oDghLuyT=!tG@9yTd6!oa3wwkWfu;mwS0Zd75n zGO)GLkw#mQY}582Kie7J-slcScPz7$ft@9RGP@hz#pteOw|1##k1~6f8EuYw-OIqJ z_N!cE8OGRaE5%Zoa+%ID`bCKIo@7RC@)wHZSgkI98W59a+y;MpIYWD1LF3y zGN&6pqwR900r7LTfpd(WYxF#$EuJqdyY-_R%G_AyBEuIOmE$F4E;W2v+vRctSCqNZ zz*TMcs|{RJ=GwN)bq204Go!aV(s)yuNoAfY^K_Y;W&F$TpAL^JBbxjvb61(W%Sr!SQ|8_>50#l#<~}J~nFq=|SVo3d zSNiLyrZx}(Df4KV$5gTv*V3tTs~;-}sLj2loAah|=o4k0EHl0A z#=mMfl)9d06s<&5;id}Dm3dydtFUc_7s|XSyHsKE3Ny;gEc0ub-^#pH=H)W)%4nB) zrOc~k-Y&cGj-J;Hyjf;enb~Dtm-*@_yis-+ap=gfJg77^rWSb1d}=jT_#MN#6#e}& zbIN>C=F2i4l=-mi)-*payTA5)ROaI{bKACPUYYr-__|)k{MGnqtd*8UcM~ zKDE54y~--1ugZK~=4W&KMuN4K-|sB!w<-%=rlsDE{7;#EnL*9!R~-Gj%)j>fkLjTnPnG5W%tc=d6?ej201Mm2f@pN# zwL-UwYg{zfp^WsXxJ%j>GCvDf=xJb)id(Q=)bOA|g`MYi$hP#VutbHy6^2w;vO@0) zD^^&kLZ1rycffKLmy4w;>Obi2O1FS0X)jxG+3#C%Cx6R2V%AX@-o3DVWkCt9U|_$+ z-JX_y71peLQuwsR#>OPx)s)|uxW+ODh#WzeuYhpb8$PoqWNUkH`_pw4=QZf=2L6X z8&{l3ksrxwg!$JW09&QDd4-Xd&=w{xdE2tWR^~^OJSw%V+x*B-Y*%6X3P)5pvce7( zc9di)gcWu&Kcg#*Q6z?UsjzD+V1+#@>}hy+OF~+$-0f9Cb24ISl$EBIRyD#MYu-Gg z#R??@Wuw&!73qK}m~J&u4CgLZsM#mqXzK)SR3WZ#pt&R}#|q;r>|G%>7lq0yG)ziO zD`mMz?0LmmKjF@byX!+>pNfowuq&7SjPBo#L05*#QQId(751PC2Uj@6zDg|*Gcdlw zp_Z@HEwhKW!%nEU{Yxs)qbeL-;p__MR5-@?IkCb-1IJc4&VY*Y_zEXjMNnq!+( zwoj*5IHm39R0G=EpbB_e1s!Eosfm*_DxBH&bC!wjdI`;3#Q7B!&Z}^Kg$pWNXpWZ{ z)$l<5>#1=FGySmKV8SR^jrBGd0p-Sq#Nn`<>v~& zRQR{Tf5wUI%+EI!epOx5D4@dc75dQ@F&Qdj@K>V)&gbFO7vNNi}qLYh`((JFnbEL&wU z^VzG)5>*yAEXGvOOIF=|2z{z7RdpQpuDYJH#G)~v?qgiqd@6}$s(htgBHaqhRayA^ zLjNkOR-N)MUuA_VD~eTZ{;ATh%F2ed%T8ZcsUpiMZWW=rwX0Q~4O!FZR5bxr)~KQ@ zCWPgAt*UFwKDyg+HL%Jc%it#Fd2p5CRo5yFsWQ}9TF2VBu70Xs%%>s~lbBm?{S;<5ecur$bBu4mCX9sQNz&dzfK? z!`qHWv|WxgaFjT=HsV-&J*oZmI0MHUJ;CUSMkg9oWmKFeS2@LAPc?d)Q8oAabVijk z?e#397gRahz&S?GH7alCRXM+nbwK9ADi>9`xb1Rzl}ij?YVZ+*swND)*WHNmbWPy}8OQQuv;(%1k!*JI!6OO{sFL zx!h)Ss?pnx>gyc_6oc?xRqk%P-(%q3|MT_!Di5^3K4{>fs=Jj-Q!bCR-DgyJw8~@l z`nVLe>K4(SXn%cD%Gt(G8PL~f+Ahx;c+TkaMqjA%V*9I_8A&EgsYh75&a!TKEUG z0`@BRpA7tL^p~nziId}RRerDXhdCBJIy`3#|FqY?jQ(Ba9|Lm#*T8>9Tfs5^3mNTV zw5!o>M!OsBVYKC6eD?HM#4@W07qw4|8C8p^#$pMNB|Qdt4EE@4?kjk#XrPbLr9754 zpy11R^fkO}+hsWe%NvzpT*<&1M*A66sFe+@;?ckDvZ{gAJXSZ*Y8~WrO^>zAWo@Ga zj1Dxaukxmo!&hk33Bt=IM`yuQb9d)+{}Gs$oGf4**PcoU-|JT~>% zto?O!11%L*z^yz+dIasSTYK#8xdvhzbJ^BoI|JJr-O1<!@C?_C`kt$>PF!}9Q4LDy5qZQd z|DIdZ+1GI0BlTz)ZW`U&BQua2?KC>hs3KIrecD+0+OLiGH*kQ*fo+$A49L$R9^*aq z!@)y6j`Q4twYWOW<8Y4&9!Gc_>A60`F`l~=NZ=@sqs>KWfi9N7g>$9t|# zKf&WfkBJ^9d7SKVipS+s-C4*7$GR3%j}91Wie57zQt#6|*MOexxpw~yk25{a@;KY$ z9FHqKuJSn7<2;XxJudM$-{S(03q3CK+!+nEty*x@T*nh1xQlwUOt1NnOFb@AiXK-; zq=Vhewx;EE9#iXmntu7)4t`$kagE1~9yfVhtE4@y_qf4hD+z5QH>;p!M=jioRWYg6 zk{@hS#{=;|`AjHFqxNPLI1h ze)Ras<8F_8JYMsd<#Dg1?eUby(;oMGJmB%D$73E3dOYOuu*V}F(>&LC(^^2+$&MMF zSJk*)>mbUAiWcA9{S`p$V=} z=b2(?r}trnk3HAFdT$dad?h{K;}egsJihk$)Z;Uc&pp2IXzd4(98~%$?k_!7JIYO( z#k!SI-F}a6J-+k!UWz@)6{1p?03{g}?hi6wBOGIU-c|UyT^Cla@r%c=9>1v~nB(6b ze;D}7=$}T_^HdenqZQe`YuSJ#BKg1=OaAjDjY^HG zc*a$kSN?GKkSlW4M7`?XY`;dJ!qR+2jj%>ka}`_)|Bd$lTTU;qJSH{jHPRZ58qFHV z*Epd@ri|AZUvpEDdO8gpP-9%%Wp4xf)Y!M}vY&zdjjE?{pn-#o9&GfG_NP{yht@c( z#^E(4nENqC_2~%X?Z_HOnaj~_cO9%gw#ISxDlDJcr*UHY>sbaS);Oug$%apxG?$W>xCvRje;lkEL>dUk{XxRxXjfT z9;k7-HviPPrN-nMSJt?y#`QIBsBv|TYie9u<2oyS8FQtmC2S4Q*8aMnzqhM*abt~} zYD}tebIskqp}BP3g)4(LQ?1_U!ld4XzvmRD)VQ_Aoi*;Naa)b4vivpfaCvkCe64ZI zj_H(&z_A~@(fZvr?x}IFR7k}-v~XFU!d7z%!8~`gP(6Hk)6o9G8V}WYtj6Otrq$e5 zmWOLRQgefD&8+G|Lh10MHFvSIKo6PL8c!-O_ZOzu`0k~`s7bCt-0XR`4z8B#8Od2j z$)|_Ub2XkfaeZ0ig&Hr`m?KH{EX=4ev&O6%vunJhn5D*=RPW}lB9xhZMJnwTUKLk1 z{C`clG0S!HUa#?nBx4b(nUh%-ebe;hE!im5FSBFs)OgqM@Agwp)#CT9b_jf6?jI_r znoltLu~EIwH89WU{2HIM-9I((nbFT{d|^QA9SZVQjjwBbqcYW{5UM`9{L}DvM!z@u zgV7(2{$y0cYWe@A#;-MgGij*kWo&=1@kfn6Yy72L`E>aFUE`k`|JL|VF4l)p7PRY0 zQ&`%oc2upPIbM9a_;mH@=DT+4t#0m;RqaeuW4+BVx0EA0u#nHfJ`1HRoYK>05#M#0 zPN}n~?{-V>Q)k~gi}@_>yB0(@81(Xa<)FelYKwiA^y%%>$7d;@*8*k*EbX(5&v!oG z`}9?!KBxMe=Chp7@;-a{jPhB*XGKNsv$4-gKK*>w@>yH2YF~U-^;ykl6`%g*BHO5$ zMor$X?z4vPR!`RS-C<05*0hr9xMunE4DcD~v#!s2K7)J)`waD2$7hJ|Cbd*I<>wev z7=@LK;&jJgeb)CG?z4gK?h=t72~aUBTFvYUZ0Nh*;Bx8@2>5L4vz^bTKAZV$>9dvZ zj)=+QnM5`}ktg zr{Yuf@qB76p0&Nx_GU;jl5i{L&?l0FB?@Ck4Nxn0ny&vzeKSkF;nVcl+h-r2%qREh z^cm-)j4K`ukX3(m5>ULUKOlt>*w+ zFHJDU4wX#Q2k7IXRj3I*NBA7+bCl^oi!qr;2}(2AdX+L9>vNpX2|g$K9B+v(keJQ% zPV_m+=VYH#e0L&M>26u8~z4xc-H?o!y%g)>LH>v@%5>6;2p9)$1pxzFbzpJ_h#`#fOr zJSgSd$B9>>mN!)y`Fz;t5&Qb6&w+zFik=ktuuv+cUm;_!K&7koDk)g3#n!ky{!lB|l)ET5NUb1e9)MqA8Cf#(fcpq8_J zUiW#!YOx{=EK_S}W3$xK=N+H+_z^M-s2k`#y7|w>}@r`k4;=)w@vYUU+Ov z)@nMsv0s?$GtWovPiWM$jLV%Ky?*NRna|h8%;!E|_^bA-eV9~&>6SWFORK}_mp@Q@ZSR!D_fZl;y`&JE7RlT%}yR1e40Sd zRts1?pl`sk0V@Uc3s^2-`G6GyRt%h-7fY?D#j}FTHm)47N1_2ueY!k3;z($HTVDo@20yYU45wK~%W|o$+ud9z0n`(qa zD(02emH}G@j11UXjCDAMWx*uORvy(Z2yYj#eZVdOy9VqKuw%eZ0Xqk-Rw}lZ*u{KH zL`r41fZYT32-q`l<0*ZT5R{^l)8I?qx{fG}4j2;<1;hbk1BwA&KrNsYP!6aBRIR+k zq~xieN=OY9P>5{7z2->H&E`XFwXz2xtamfom((Iw%GKQOQvJ zE3@OIzzY}l4%o+HQ~$8F7^(rUqTN5>fPm`)t`9gc;Glpr1I`LKIN*?gV*`#07$0zG zz!3pQ1{@YRGkbWz1Ou{xdgP*KO83H1=6H0#F$QkzUzoJhg0C{F#|NAca7w_b0Vf7b z3^*y^Wb=7U#{yd_JKT!xQnRtA1)LsmhWVMeQ-?ln(4+9=$b#fGYy7wBVN+y<9rhqtLa-0>ge)z|{fQ1YB!h zmBEoc9D8E&$sR63MRh~KjRE%t+!t_Dz@&iN0;Zb(n~hEhxFuk+VFlEqfO>8<7qvvU z8@MCjP6KLa?vlzGzDG>9{Y!=lCF$KC@Ib&*0Z#`!81PWQqXCZvObd88;1MfaO$Dg* zrQ50k(w46^dlv9Sz>@*f1G_q-YhmOk9nvCch^W+6dh(3aIABJ=%z)dlg4iD!php8w?jb<$G=@WgulPN@J+zC0pD3{dTsF>nxEM_ z7JiiRmz@vzJ>X{gS@Ft z`7h9A1RNZ4NQhcx+33weHV^3%(lun|kX1sug>(<;9nvSHN611Ui-jy6vT#VxkVQfk z4V`_Ks3m`yBmGgU)nv$}SI83fb;;26!yRL|(ic$eUMghikmW;G2w5hiZ^*JC%Z0A> zQB-LCL{28OH= zvS!FyA!~>1tp5?1*$i}OtA~qWYqR`=LI#Hn2^ktL=%0(*)@2&%CCZyvS}$Z+$VN&% zWc`rgAsd8j7`k~a4WL@Nllj%4NvbOy+azR!vAU_{UDKP2M;5iE-dluh8Bz`LLbeJS z8M1rG9wA$YY!k9$$W9^KhHMwIeaH?L&-_77bdsv#aqO8GcMjPlWY>`0LN}{+oyla> zV@~JgZRtMF%s}I_A{URtL(Hhf3zEXwX!4s@~k)yG7l1I&`}s4a%jk%A$Nrw7IJvVg&`M(Ob9t5 z8iLq67lC4x%>?xHK?bF1NlawjzcqmbQ5|u?d zHRQCAvqR1aIX&czkTXNhvQieqI&i0`RM3h?5jMQSxgqC;oF8(5X_vG`!yM_AqLR;6 zIbIxcNyzmfH-uaoa#_e#Ayr+cZ zRP;B7+!Qh;h&{!l*(X)i|4H?>kf|ZJhumS3m&{v=p(0SU+BK@5 z^xYkDPsqz5uY}wia$m@kA=6b0LLLZtIOLI#2SXkTnHIX1y(KaAA2b^yti_8*Lmmrx zJmd)#nU)@O)3yFIVeNtv5?9i?r$U|%c_HM*kY_@k4S6o)d6S+Pmgv-WC^ltU{zYe4 zre=n`WI(J+?DEj+alIPyTF4w3mXKK?vt{R1Swc5Dem&%kkT<2ti@LH-v&Kh>yNg!~)gQjOfcIQ7BAm~^t$$CHb? zd|e{CMl2Mua74F=?h!pAXXN#?CQ_s`!pdFGh(#h6jaV#l=Pcx?*jhdXT6tU|V#$bp z5i3XZj_4DyY{YUAOGPXlu}nnYh@ivG__ZWFap-~=REWz*tPrtc#7f41icGms{89t) z+2Uc9i2f04MywUFYQ$<0t4FL6xfVx18Id22_tlh0_cSS?*R>E`&6XUV)(r?!mPDq_2c?IT7;Y#p&p#I_Ood8>q}!V>g2#@FMnz*fU~G#Mp?vB1V}EM@P=4 zsp`qI_T5QC)a5Qllp@Lz6>+=p0wF7FN?q4RNp#|*7U3&wL|x?-5k^E3ve>o~mrwbT z{^*f%NuFs$Bcf@EiZ^}L)5?^D&>1l<;^v53BKD5hC*rh-(Zkzh}n<6HeAN8HYv(gpS z2umIm?c|6l5zj?DA8~8MZ4nPeOpBNraeKr)5%)&i5pie4T@iPit!M>QkD|rDsIqfk z#Ql<9#Dk_+l8i>mDqne)t!SB-ha(<|crs#o#G?_9MLZtygz+YpR7P5f7JJHtCYn@9 zpNe=o;+cqNP3AHVicN7!wFLCY{|gZ>M!cme95EwerfN;ZtcaH)UXFOxBG)X3RQDDA zAgz0$iv?6#N^y3?>k)56ylECdeNid7mN^u&zKSXr??k*C@nOVA5${F3A2COjz0GsW zTT27wU&8-5Vs6Czh)>LqHs7jwoo84{w>TFwnoj>b;tSQFm@wwch_7V0V%CoNI^vs% zo-vEWd>ipy#NQGB$o@zCAPXPyo9ut&ZdCh8#@}KV11j-f?1rc1nFrbYIlRf6&?&PBV&^oUs~X5rY` zc}=6qU9*KRKJHADR6<-W8nal;3Nb6jEFRMc`PkW2eU&n3f>f2aH8U(uR*LBtvuez07I5X5Rbu)ZR>e`w zQaSA*Y!%SzF>A!E887J7s}mwqaP3pB?HCX`F>ZcD1Q;X`?hpE;7O+W44ajCT80%G3;A#9&kiv=#_Sa{DrTpconv-49>moy zF}ud>7Ne$I9b-+@=sr@ptAO^1+0(qK^i^1L933+zrV>+)85>iKDaDi}N$WT%ISs>A zrb<*Im7^C^vlx6St!ZhTSh_|Cj^f1?`d2lAv0WKRD))mID8v3e7d6Y2`I6mftm~&#z zjX5!9V$5kVr^lQWb8^fnF{hg5OCYUIg&G$%2a>0rGo;utXT_W?3D``RE{#9SA1ea!7Kcf{Nfb7Rcpm?<$g#Y~F1Ip!8s^T|$z6m9?o{X6u^OS{BJPM+K`Wd?T(SeR< zW1fq7KIVm(SC({AQu)eHOCM%iY0iv!DP~s8?3kD3E#}pj*Gyw|F1VE!DTBfaE85pJ z`4jVI%v)Bn%Cb6~t`=+TcDSp^%FDYk?%>ag`H{2|^9i0b(}=06$y#5w*G z^RImsZmlSFBy>&amOw(6gqEYeYL>6N1rhF%pd-Gi3EL)Ym$+GC$)P15#h_G_J3Tul?36GnVRXXI z3AbMax$!A<>F`ttNQw z*#7rPVS|J);jo0m6QYDTVef=}5|V^^LY9yxq!zG|(6pFa>zgfRq*~&w)ABgZs4JQQ zPJsI+?3ZwG!XXL!CmfJ)V8THOn?2DX35bXP$wWcqGTw^*P)kcO$U{q>6B3R{I3?lK zgd-DC0w3xW5P`dS0r4Sa81Is30E0ciuvk!>j_VSxPq?AYt*UKHVw#_y zlyGyxZ3$BoZb_J&FeTwui>eh?eiW6k7D@zeS4On$KjBV`O)|gBJU?Np8~U`Kt^iHA zFX2&D*o6D->w^goB|KnwaLFx*OiOq;;gNPiTBkU8jC0rX%Q}U}6P`$TI^mgwCljVy zT2HA!hc3vMytS;*vkA|c<$2zsQW>@Cg}zE>W+co^=%_=Tml9r1_#)xUgjW(?mEBI5 zlki%?tc14`-cFdE@Or`<32(NonTn(TiH@=3iybWmdne&tOY1$eNcyy-)gz@S!G4hN zq2!-1-~45>1wb(XEOLY)=O+j4c5H=uymSzk+j*I4>UGwrGqBE}I&0QhtIpbW2I%WF*Jo2FN@F5*a@5(-&KY$i2GTbNC zzLw?>1(b^xhw?M5&iZvW5?6JG*V&-XhQ^_KL1IAT6ip+jTcWb+)Wit>e|%s?Nwdqw0*Vvvr+q>g-%+mpa?l*{;rx^#v{X_6Bw^Dz(|5u%Kjj zs=F3VrM7FG-R$e0Mt3*5hnTc7ZTXS6z3T24!vcE7n4gl-u||tV6{KuHekyGj;aZ($ zove;85h1w;5ae2s~rL-8UquJ zo>b>#19I0^z*Fm-R_F9OXVm$z&QEpDtaDbKXX-p#=WMBWo$Kq|Q0Lq_=b2$Ib?&P4_;kPL0r=Hfb+)VZwAjDy^*q}mX8Y26*d)tUOH@$=$|t|NU#ohvOW;j3is z)C$zOrp~pB&D^DCVqTkjHC`5qR%M&(nH z-(KgAx?9_Nq|Tjn?y7TloqJT3bfO5(|pSB368&>eA>h4^CcotS2f3D8+bzZOY zhGpc1I3 zQ4^5THKm(j-N~t^drFVg-Os5_p1KcHend6T&@*NIl;J6hq%4}USjyt5+w?m$rB})l zDg9D(&S1&Z>E24I+d8f)+&gs@xlhVc29`D|mt|7=w(+tCmNUA1$_j1w6&3BZ9rD~Q zEIh1HK*}m9{Zm#=8JIFCWwn&mQ`Ssb%MyLNqp(IBNL|Io+V(mib(T;r@*qd4{os@q z*6WbeHG=x8ysVS5ZpwO=uN&?w3^TB-{ur`sVFU9fpPQv@Xn3QROWS>ulo5tEZM&#? zZf;{QWyh3dn=IF4r<9#jj%aXXgI!W~O}RVe z9_1@#_muNfE=buUWzUpjQn&MYuar^pZv{F!WlTy{<&rWsrDz^1DW#Nh>i+2_{~936 zipoyvK!N@^Bhy+-@l&_O_u!O3qD$E)W#5!2B~EFkWGP8XJta+Pq@4amq03zNlX~5a zrXxQ(JEJ=oH5Z+ybf%0;**j%h{dz{`l)~9BxJ31%ZEY|X*e_-Olmk-^Qpxr!9FVfz z#_pJs?9aj~z7O42bJ+y_5%Q3f@hOL<9F}r;%7hf%MW(NpjFi(<+||Mb zHx{&|R?WxW`W<{v_y2;atGTP>&Q3We<=m9>q&6LeR1+^+svhKyEa|s~>HxIn#xG2{ zGUY0h|3yYGPPxRur74#gxIE>Gly@H}6l_)HKU>JSI^`N;a!SgLi#yJ*O}S3W|KESt zr`(XbK7*3zJGWDN|E!Pq`!I&Xl_p=SJ=T zno3X|CrwvMp2~>ML*1KlpDacL8g2*p{bDk8XZ)4c11S%RdE;Ql?7}-*-1^>ZgG^>LMyNnEXLu*&TT%<=K?yQl7WE>5nN~eXIMk zp01UXU{$^ouIZSOGBagX%IuVvQeIAZHRUy_<>Q4{(glBwRR2L4R1)fg>F7bXwFF#oM<;ey`$iEd7Um2lm*DU7v4*GUsiEM;fvYscELF^0x2J+ zd?aZr?EH>zQ|2nUl+RPXNSUAVNy?`wpGgi%ox;?f?p&K{fhOc7B^{{wGUcn3uT#EB z(d@BY78>vFS(TC~QT>VjxITsNQoc|5A?3$ZcXm6Y^i#^uDgTO}zJ*_`N~%`=neuDO zZ)Q4vPx-@uG)vt#Rnnn>8nv|Ll{RY^@RKwM)Y((mN8DCD*k< zw+7uC^k}e9gT)*4YOrvFo(&dhuxP`{SzQIGy|S=agVl$*gGEvmWkI)(F417g2E7~f zY4GB+9Xd@QqpBm}Is+&_I*_tdgUfYif{cHIz73Xbuv~*?gRH^w4OVEdWrM96uK8H8 z!CDR0Hm+7`(9giiMprQ^=KD8TwZUp)qrn;t)@-{=6#A;3xu|;eifurH^(J)7C<=53!_ z7-)4)MhZ9B-CVXdx=n*^4Q$t7`vyB0R$99>*wOG#Mt5$zw;Hcq+kDFB9t}zj$_@53 zKYO)(j%qO4@R+vCSOZ0)t#~Si!v@v1AJ0I|sNWzk(DEE9(Qbvf?K5dmZ{xH*0$2OSVa6^XU8XVtXhWR|9!HEr?FrAs$;M2*43maV2;3TUNCpS2y z!Kn>SYjAdha~ho9;EV=mHaM$+ETsCVY6b4@>C{_mOgcjUk81`a||K5gcsV^~3E^Tm`>P3SqWMDNAXmDkNs~X&)NE%#ij<+!H2RRyX+|G5`bf)N{r?7!86KsBzzsxu zKh*K0Nq)M~r;Mt$K5gKc2G1IJ&Zts<-oOj8D#n{SOLCmq;H3sHt3b7qGRpNXUTH8+ zR{%BKjVP}f6_{mU%3#+qe!amP4c;`dztuo}>|dnJ4c=++ZiDw4eBR)T2JbhR(_n6c zc?~{j@L_|G8hk7*dZ6RnA#NwC4kPPd)mrP3SyNj%zriO`p$4BBpUdM8S?k!iN_@(f zuFs%9^nKajs|MdS_`bo{4ZdmcZNuFkF11lpCH;}MOSZr2(>UqHTYfXF~XhL(#^Dgn1sKxwniTQmI`$%EZXEB<<3Tk|2Fuq z;YQhd3QY$(nqWY1`+3bS*J$)!zJY_d`l zuSu;*za}d;`Eqz+_a>_}U9H))=?YHGR{tieHd(Fdny}SHn+$HUMw2z0+Aho5O$Ia> z*ko57{2x|GHgSb@`{M2@U4)@1vpyY^f%Q3l_h<(gL+nc4Tc0n3gW0*J#VyEJ)U*Z!zX=Quvyy~i>s>V`Gl zv_?Lsut$?Uo9xwORFkrFKH=VuO?E|MaW6Wi&(W22(b3sd2X;PKY7Aa_;q()P{ zM88R3eoko;Hr;H--c9yty2=$9jhiF}i8CI>b-sL8=i4rwx>$q`M)H#xM)VNDK~REvc-CKXf}^~Y*WIlej2 z-EttkI-tV( zCs~lGO>S;-OOwe>rZl;=$!$$!yEHzUInQ;;=3ei{DFQk_etVNUn%vpsE>*53Pc*r^ z$vsW(ZE~L~NI&-<_Qwt==pP5_D&OB^+zhuH?E%w@2ip>R$iOtC4>x(lz@tVVGumoy zo@_F`$y3sVCZ7#-ca3U7Rcb8Lr&*D|rZ}B{w#jo%o^SF(({(a+fz^vmWZcwse67ih zCNrD7)a2zRuQYj8`R!TI@mLkNF6UQvREcC~G@O~$WVRGQm8;2HQgxY^P24>jZ%UoC zRZp$0{hM#Hwu^7%UM0Qvn*7n^PvuePf1Au{@`0JS51V}6QZm&Y>Cz`=pgz?nYgjcvlWmt)f7x_@lKr*GS4}s#*7LQ2Z;XCx^gE;9H~GQ9 zk4EM5Cj&nl{Y7@qf=iiyvkLXQEQ#%K_^Zj^GJqLtW&G3RUll!tei{GCL}bYSN*Ns) zWc12dBBM)2*NlZTdS-OX=$_FdW1$R{g+!{&_PVZIlGH@2_QA?*E|Rfm#$p+ZXRZa2 zy^^%05`PSJQi8Ovt$$=uZ6QW;BUgde!3N}4lcpgV)SOy=&Mov0(U z8Ovv^kg=iyT9c|>kjU zq7IeMf7D&zpt05383QslResg&&lr@kQO3p@gUw}wj13J8$rx&29i!_SUC-z+qw5Yr?uv3bT8=GY3drQxlN9(#lfyG@2B7RF?Z&Dd7F z>6W~V?K5`B*fC?z%ry#{YLEjnVW?hZB&&@So&GaIA7^zlrqX0m5ge}ff)y7cp0^fy(Q-iKO<17Wkeae{6w5c zEA-c3^*~~k-QdFKx3~gLO#bzZ)Ih_iN~CEZGnyOiG&;`cyrJxyv0uji83$zi)Zblg zq3NTg?cxjdi*)s(PV^s~aY)9A851+cXB?VwRL0R6hh-d|F(Km!Y4T03qop3jmk+u^ zSJQB0hW>q{>io$wg<~>~%{VUO_>7S@!KFDa8MG5JWL5O18(nCi$t5ZCNf{?+oRM*6 z#wi)6W}KFBdgg8f(rp{_<`s*G=VY9#N_4mrzV82*(w>*O zNrvfz3zJ7Vvv!MC0WvPicqQZ2jEgfa$#_gvPg@8ifBmH;bG@3&l#uLy#+4b@Wn7Ham^&Qwin-2=&(e9=XI#H%_)8t?Z_mh>nemb&EcG7ZmhJTEiGsV@NRtxk4>Uh6 zyp}O5#_#)%Wj89ZeGCs@rJabl8wrk>OmxaIjQR~cVt{GRbg#y1(?S_S_uWBAQ(W=|8IvI*ZyrLD^UV20vHqdyt_IpY@t zzZ(6`sDiw6q#KZSn^f3#D>tk5w~W6`dd?y_|H}AFKXba}nvkUk-JXy2r;7_ z9XUgD)=?gH1!&INIRgxj`XX{A^})bE8}2Y-vDzZk03A@YY7RF}iL0>vjgV z&(S|b+}v&K~lq{XaQ-<&4T1oiiq9tV*g{ zSh9~Z-SVbMQT2ah!;3lB*wS7(r;=06@p2BxIWVV| z2}$n$Au{dx4q5E!D$1NRcWq6>s6aC(YvVkp)37e-)u(-O_RZNZXa5|jmb&gL_e(~* zBXv4WBZI6S!a+F)=NytVUUJ*mjYrf#{5r&Kc0JTIO&c0j2hY$cV8vWIcn{!;w@i`}$%jrf>G&<4fNjWFyoRV{D&S~bNbz5y%)s8{67pllg zNQENDGc8AF<(zGzI45^2q*HRv%{edU{G1DN_w(hOb1uxeDCY{(kc*98($<#NqVT1v zm1+WVE;n~=-Io$xnR8Xn)#h?T&W$QB!`F%$P}6_C0eNo4BO@SulQ~XOrLb4kuUm2^ z=Wgm=clfB@iT_)3Zp)b}$DBKI?##K%s-)(rq%Eq6YENad?lwmaw>Q+ZPtN^0_jPiA zClBO2nDdu1XdWKQc|sM|@U)zV4Ls8Nr1_tm$J+RD12PoTb9eFVten|7Pv!1t$Ul{$;=vVEp zit5{(?{a?5`6cK3oF8(2%=syIofE0Ip1lXVYbTp_vRNnHI_cg? z-%gh8q(>(U$(z;%I$5}ro}KiuSGg==pjRi0wp|u8uz07NU6h9<+U`pl=-uhY(Q?$u0(VHQE|kD6QS?bq}L^8r{q2s7^*3xZ{8Yr7+fB zPttyXPAZ*@>tydvs-1Y9|BtMZvyZAq|hvCa_{nwiHtY`MwXPoM_K!3!a+Hyy4O?$^NRl_M55K!c)G8+CDH>O3DNi|% zXQ#el%`nIls@U_%EpwEoYC`ci&)@z3Z;L`bPa{t=KYx{`Wu*Tm$=9gbd5+C9LCxE~ zf-Z@OQasK~O){LE=lDD)zFQ~M9H0w~O8=jHp zOe1F*DtA&iH_v%_u2b94M}hLm1wyG`nNMaWQw^sXUXbU)JQwAeZl{+SUTkO5y%m%Ap&FxvjwM1@5!_zLDq6Joo2$K%{5#xLnW2 zAI$Smo`>^1qK=m5={(QKy*!WSc_Pn~`Q+-a35+f@a#%y$T5;|vb!U6@tOfR2d7jPl zQl6LdJeTMBJhSt>pi=6Ytcq);=;5BZzpqJFCtlQ5X--ay3BDGH^1PbowLGt@Nt4W7 zWnWthWPI*s9r}ftE*x*=llkY{Y9wm>cjSgFk$X4KdwC8kaCm|D^UTS!k|v)8KFIT7 zo?r9)mggfI;y%sunL4bs4Yi_=jeL?v4O^$5=b4-5XA^#5n2w5H=J_hm*H%_)7(e9s zCeOE~@SO?2H?E&G>(?7n_|Z;($}C8(AF2Fer{8MXNBOlzI4{p1X+-nwFEjPGN&d<6 zZ=V0M6y=5vSLSUtX_*4r6d}!i1^TMN*gBh@o5(_cv-w^# zx1144mM^eEffemktLPf0Bpgs+l>*xp7+zr20;?6++!O{H4l1y=k<|;VVPwq$YZdfm z;3TdNEy%26@(m0nS+~I8jIU>8eZ#b}HY~7_oo;NniJ|=8w7_P@x6oBmOK{4gou(JK zEeZ^?(=83RDzJ5dZ3=8#NOt8ZQLPclh(7Ni>?|;%z#augoASs4+Z&OZtnFZYN5h>A zcP_9?fnA061ZTGb8qY@+k{|R)vb*V||6dqWV9x?$3yd@2UWWS{?rpe_;l71rGO%AE zxoYb;z=Q{y@F3&zBrT1DRlL?V4l((mhUt!)@db`3aB+c43LIJBr~;D;OfGP=>39Wv zBgYu#3(4(&p@3tju3^!zWLP##YdkP6AL>Rz!%Bh3NNiYD6&I2@fG*!Uq}(W=3u3cC z%M{v%#}zo%h!iFim}oq08)=_CzQ73u&Mk1B1)XSkYJroCoNTDLrxfP*@hJr!dnk9B z6`jiP^a5uTIJ3Z6R(ffnoo)P_g(T-^cBU7YYJ8gE1*UVM;YEhW3`_c{QXHnizrbbc zO&z)P@_o6rrRy!?6$P%$Y+hC1YU9@!UTb)rp-jo88w%W5;3n&pX=}XMxSHZE1#VSy zDlpR|uJt(SDCiDrZ}%6HbyqdBI}6-plDo5Zcu#?QGk%|uU%TWUP-&2Ru)srV{920F z<2mjBEbvHyM+^FAP;TUN$;W23w){kaCkxDV_`>0-0#B<4Ic(|hOo3S%g&ev&Nh^J} zz&GaGa|NC+FuTAD8l?-&Q3>cuSK!S8Zxwi{z{>?*De!86*9yF@wxI`q_K9Y_(fLLp zS=QEljT)FPH>duUd%M6p1>P<2ULje2d}?TJW}jr~SS?D+Bf7+BvHF7o9~Stmz~==% zD)7GoAFGX72KA}c^tquPFX~ytr-kG*#aiyu!sFZmUljPNz}FfZJ91wZl9g?(Iv#7q zDCN8QB#$Fy|JwrJDdYAM-1h~3DDb1@^bfUdZK^5ovo(od41X)|tC4x@B`xH4A*1;P7vO{|d}2=&LK-yI1nGdWh|;(cv9OAzzN+DB zh65c|H?oGqnnvW_j9EDqpvWMHwH-8DSjS2JNvD>q3(&d_gB{j$Sl?j-hfN(ebJ);f zBZrM0Hj(oO<~kop7Q3{{t*^BYzB^gk)!pCb4nrJ@Z4A-C+l7@H?A)N8>vg zs@7D?yBObfVTlHRhl3psaoEFQw8I#OJsrlGjwV-o89BgVZzKB{%GACN`#J2d+BD0O zD2W3t^dKjhsY)`|PPMy6T+R4Uhr=9>$SfSLN>MYjj{`^{-RFFy!%=B0v!EZQXtSBJ ztRrukDi}H{cH5v;bSOEL9XyA#9L{#|9Ri0_98Prz9V!k@hn7R+5IfWy>JC*WxzE+p zOzntJpHhYDfzg-$%QaMt`uDDF)NDH(>oD2jc!voN6CI9on50wtM4mPPsMBc=gNU|R zU$#i@1cwtHPI5TeLGPI^{aNx;?|ZfWwng%;hrX?+em%wEG>0=B&U8q3?wu~T*Gszg zvRWb0r+9iN4@#tYj>EYQw>jMIaGt~Y4p%x{&yN@Q}*T z;dKoK8u=Zbb9mn25r;>e9<7OEqs%hyA-+HAe@ZHG4< z-ct0%?6Y!e=YwRnH2q$94y%qb7&v~>2R!&hp7E)(5kuJX0RDlV(Kd}C(6b@F|rguMWRC{O+Ke7bUIRnJ#mZH7K=V4de1(lD{;{IsBt` z{=7W|v|mnWYqYL1^Bld*Pd}IbE*&nobaUzMvWUx~E?r!@x@gn2w#Vq5cMW>-M?;ww z7oVA7J(u-e)aRwDc|-kJGkuVvXjd`F8jLr$}YRO?BO!nWmlI`F1xwx?k3*_9Tey8 z>7C=uWX#b60!?+)_QtsE>9Uv0-Y&O{$}KuLsZ$lEHlgh|EZLu|lHAW_f0uDC2fG~L za-hpWE@NFZifXvfXrRXga$Z|&^bAqeafr*IE{C}s?xN16J8n(z)X4Rx3_Wqv$=0?K>SrRCCABT*3@m^|;0 zCn}=5h9;R(`%$GI=Q7FVS(oQrCadDK(NU$Ltq3kBxXCYKPjr)~R8w6}Qc-Ie+2s_M zQ(dOGoaJ)1%V{pByPV;2rb=&4QWQIEoFt^u)3B^DcJ>z?=eV5fa-PfiF1mTYU2hBC zox5&G(in6-)wM&<#iqGj;BukMMJ_k1vRtOST~#x}-dV^c zkt=a zcJdO0ENksWms+($wFhPYahE4to^*LijmmbL=t`uKL4~On)%TXLkXq3!b)36% zx{r9?Wwy&JZZf&r`m+vo$ro${5P8w%rHsGqCSNa+P{*q-uer&Gxn6g9!{tqvw_M(L znWI*!KJN0a%X==GqTj1Q#%8~IFnVq8<_j)bKOI&kg4qeqs2fq166axkDXLc9hw>`sBWI`Cips<;p5QxcsPbDdw7( zpIm-cO9;3k;1~Jta^k#smj(Rh^1C{0nS;vwp{C_hEm14+m&@NO&mvD1`N!p7mkC8C z7Wq)6?Xp>s&5O)a4=U18gd%Gcd05*%i!55CSCOTQbScucn7oR(RFQ5)x*P9Vq(_m( zj4xSaqrn}E7kTB@+!94@vki6HQ+K|-7Poh2?vT#hbUj)cnUj&;Mfwz3zQ_timMPNL zEG$<<`u&OwEGIhsi!58@XbtjqNTTBz4gN(|Dza*khwOCaA_GiqHM1=JRqS*{T?J&S z$m&J31IE*Jp)J+r2W z8x|>Q`K4QK#qPn-(c+IXq9thEm|vV5Qe|12xp}9SZ$>d7?YqWBz7r_koG~BDm z-pYvn|7a+p3+sNSuPFN)Il%Bh!-I;9H8RdnI`8z&O$d@g*2pleGk18A@kL6O$0Ldy zSwt`M=8GJq7Nsh%)6LfEU|h#B#&6MmiWYy0ICkn<#G)!fLcQ*4g>%uodF3Kr5x4kP zikxrJrx{9Tsu6XB3yiEXBIyx2F0#|32!#MrO2(;NA4b(Q%||A$nEN= z+*9OUQ@E?h-A3l<`!FMOvgw)6_sN;g-2G-ved?ypB&~-u!kFaoB99b#)c9kD!=jFy z)$9VVo-nz_5Jh}iJ-WmiC7vlVtH`rOo>OR%AB#M%epF;mkq=D&1;f`2Uo7%ck(V_( z*{L$}su9_oZf0LE@zb34^A_{X~QZGKtgnbK*a#YikfL(W8`%$-fl&qsX78{Hx(_hQAxmh&ui%^0$V;5*?=hPmyUF z`HTE(3bJtC$lN^Ro}3(!qr@Vn+0}5-5?zc)^Wk~9Vdji@w-T*tl8ePkEMB62iDgSH zQDVswOPA*DWO% zox!H2tJr!a)-Um+TE6ZPN@y(7NV`!fxxnqFOF)TD?6}{qbeoqLQesqz-AWA2{Mo9+ z7RHAeZkci`!>vnfQ)1f^+m+a%#Eup;yhLY-5hYYmDvBGe1&%DSy}74M>Cz+lPNuwb ziCs#hHKNY7Yia(dsKz!%gKCLAN{lOUaEZ~Tzjuj!N{lJ7r=9LqBJGdqb$QW zT;f+fF|^vRmuRRY%k(PKRC6uyZ;Ag(v`ZXY;_(tsl$cOrVu>qCTv_6{5|c`tT4IXo zx@WSUFuBC>B~DP`mpG}!$t5oCnbV=0K^;;!#WcmWoTAgyN}OKetP*FJk_+w`hG!aX zJ2O#`<~b$KEpb7K3r&8W;nWi68+l}IhvqiDbR|_8+9$9sGWjJXE>&7`K;=9-w@3G! z-U8Mko0pZi+;p^BqM-e|CMfw;C2lP-qr}xEt|@VCiR((-s7f#KPv4vlZA!o1BHmD9 zuGZXiLpB|Yvbac_x- zEJ#M~Gx9)*`;9Ef-Ggf9_5t>XQ+bI;jf@+Y``Pb!OcwM)s$Tml@l=V=N_<}8X$|`& zUM%raiCLyB`_GklHsiXaK3`(CoxWhXP)!v}NnTzq@k)ueO1y2MuaEm!H+~vBmnN z#HXrj%juYYi6?VQd|^S~mH0BV{B?=1GOkMeCga~~WY{)|^}X7*1|qeqU30&vg`2`p zC4M%Nda_zS+U*d1&&V&c8lbh@$4Oqq7WvAr%;5_R!9p&Uw zk}IPb`vxVp)>O94B4rje`C^7$%E_SA)p)lu-Hr4pCu=fe^#pTdZuE%U;wD_e>?~=# zr=g6mHzK!mncihKDYI#rK4q3Evszgbe)?uQE0*b3rhl1bO|rb{n(;nW1I&C^Ndu7McCs$_y*BWtpuq$?!5;m)XWn zw=J_>CVyp0l1)v4bcyLKCl{I#Wkwni-`>a$Wp*^OQzqZJ%r3@vEi=l9ZdG(BimdHk zPTsB7*gK}oo@I_6+_8@(w^uot9*@z>Uu86s>+a*g!5#aS(HuY*8da;}?r)k07>*l} z8(U^vnR%*okAuq`QYI=BmpRlFiiU?79$sdAnIp;^DV+hiqsts+$t|fhz$qQu6q7b~ zOqqO{LRt5lImdiZx@&6}s98`UXo^)bUN)3Jo)N!HU?eoGWT7g(YMEM@N6I`}re3B| zW@?#f8vo0*%1kITvCPKW`BUatYZc;Z)dzMa6B}Izk26!65lu2OxyV+D;hs#Tr*hpET#L2vOhBSsbX3A&y`E%WJ>vs7222P z%-3aho8IwNnH98S!RlJo^sSnQh3;*oy0zqrXp*1QX0kC&1@cRoU(5Vf=Jzsxm-)wZ z{xJMA)Bj8T)Ev{)=wB;FMf|UfOz99;@9yxx;~9@x9*cM^>anuN057=~ckx)pOY+s# zORf>!47(fl@L0@aapS!_miAb}V@W&h>9Ld%MOj`eayC!yok{u_`NPdAbnOwjz8<Sw9+_fR=3>#>~2@^VQlKVCAuT)~?^l27f->2_%)4|OF?ELZVZ)#DV8Q$1GmlBw68 zh66oT_gKSYO^*>CBR$qK`DPxQdkpee+hZM*Y~r!0$GXN9eXz%R9=dw2?>CzuZ^%G9-Urty_P9mol}(YbgH?%#||EQWWMd_v5Uv99y@vLtTH?z(but4*W4(1Woo;7 zT%zBsWYbhl(qwA11&uLGQ`yU7Z;yRE_Vw^R0+0PX_V+l(Bkys5X&&S;*5g3qN=4Zb zj??(>afk`iR1VGfVMY!&9B+7p;gN<%86Itz&an#~jz`g>WJ0+r`>sbiu@skD*~7EY z*Za@^++pwEm;&*8FFw+!T+~JZ|#1+2eGNGd!-hC}(<{<#D-j znL68Jsv3jGIUeVl@I2L^5mmPobfi^tfyYH2(>*Ssf}d zu}kvRYmqBFuJpLd6t3~O*2vX{O5!>rQj^bV9&a$ojfTJOl32LK<5rI+O)?|Xf6Qa1 z$88?Bo8%#nhdu7_xYOe<)q?IO4o>3Uo$23WxRYJCf)~6HU4FfAaX*<6n>eJbv-`Rl}yopBf2G`FAreHN_Gt)?X(1+v6WIC5h5X z(-oiR>A$MzGgyoGiM+#4vXkaip^N%-@#*T*Et5-_hDt5-%irv#x0l_F2!YrKOif z5#P{fBcF|ZHd!dG1!hHbZ0<9}XPD2HW@@O<7Dg7B64}bKzqQXcSt=6BD@7L>?$ha0 z^Qrrc@EPfIsLx?O+xzU`vzO1_K0EsCC`b7mZA5CRC&Ge{lL=FKYOUl`_Nn+pKAw;76ZnMwe9xts zswoR8iG8YOC(U4rQfv4$ea`op>eKRR`<&u)s?V`L6MT;MIl*V5&v8DJd?qhcN~wnn zTs_f}KFR0g%!jn}q$V=O=QPFjImhR8pEG>U^f@c@M>-1^QR@7;KIfUj0y|Qh=5vA1 zRX$hyT`Aqk@*yob0pcF+$(ul&#eXj7iGOG^RS>U$FH9pt++~jk!&vic6 z``qAjW7d*W$I@J+j@{yOtIrIdnU>Q9rWO?VZ6@!fZJ$1Osj~;H7;v}GJw9`NzVNx% z=RTj;d|vmt-{%3JXMAS)JgA61kNZ5~^RUk&K9Bl5X02DbNLz2}eCo-QK2KR%PiOr_ zp$kg#S)b=L!u!1J^SsY&jr=|@E>s8$vXXIbyFH~zE`h4W`vCk)&z7+nK`5*^A_4&-_^DI;nDWpaErO#JB^R!_) z;A@|6e17ry)#qEE?|i=Z`N8bS?KGAm{^;|Q&(B%C$c{pj6!rd>&+k5e`~2hchtHor ze_5hwTB!vo>-1lr|1u9#3#m>=00BJ%mI_!TV9|gc0gDB63FsQoEuecae^^cvO=G1N zWPkC1B?6WV=DU<;Q*tTv3RpUzZ$Q5w>9)NC`UEVKS(8F)MA$!I*?{E&mJgC4A`KFX zr>AOrD+R0^FgjpNz<_{N0yYmA60mB(Y60s84Azt&VD*5tEx9!U*0i(+1*~O~v>b%P z%sp9_SL=STkz+nOV2J9DbP{7!L{R0jNIMCuQoVv{F z7-#Z>0}iny78p;-;Q`|VjtR&I91(D2z)=B5FJx*#rc!H#04Kl=C}!4VXMv8m)Vu&c zpcT*#2m-=@T0lLZ5)cK%0o5##cago@a%vW)Y$ZdSHk`ssqjUM{!+lpMx^$N5v@B(;kAI*1Kv=#iaOp5cq`y- zb&bxPmfE^#Z-a6g@Ses%t=RO)33s|O!S@5^1bh(ip#^tlN45jmNz$eB(%_Oq$ zx$(J%Ul@LA_?0dJMx>J_^j*OB8n{B%3i%=6M-9j!T|#~e_&MOefO*>g6Yy)mp8Hs^bP43(mkX{NY9X^LKX{IJY7Ej%a-mMuWtIt(wQiCAAx8Tuazx0HA%jEK3)v-P*O2u?HVD}!WZRGpLpBN-5;D|0**IjAkWE9><&}z# z&BBCi9wv{6Qi(QzZ4ojoWGf4jaLbULXC^+6$aJ>0AZ2{Jkl`WQhwKp288RYdqy?pg zBTP$GWXF)5WXD2x7?V6J)RC%5XH>{;AqR#WWD2{7>>09G$Q~i1)sQl8$5^NeXYY`G zLiP_iAY|W={Y)-D_0&&huQim7ILsDA7Z$$pVBhB)pE!bOXb9n zlR{25F5k4zc9W+&PO($@sqM|Dg`94uXBw(KoRNjzVQ#C&&j~p<Lv9JVBjnDITSI1q%v8r*sFY+%nzyU^toP|ujrlIs zl$pIp=V?-V>dVCD{UHy8JQ?y-$b-t7_WaN)?z`&iy<$Cykg0{tP!AZ(u_Ckn~V%< z-fO6VeUf`U)h8jJhI|$BwfXZ|$mbz*jY~%(*cTyRT3j_<8PuUIpx>Cc--djrp<__T zYNnteT_q{AKWgv~`7dN%$j>3ag!~!uSIDm+zlHoB@`vdwn^KlRB_t2UMgCR^SUvu0 zlC(KVF0xEWu0ltJE)}{~(1#2pU!=mKMwAzMo0h8N-70ji(4)d)m1MkCDzYHC%2TMc zbSzn+XN9dQY+Yfg3cV_9UP-19OIPS!VYv#+SLjn=nM$(drhg@w+w`q)!N^>{O7fi+ zE$nyNBadY(49=k)F9WsmUrCQ03aeBYSV`tNt5%X{m;c!$ zVYLd{G@^Ne9?JMk%$#*oeli|)4b}_Q6;V8pr*6)xTyQ`c> z)7~|Uy?2v-WO?Bi}C|0Oes8uLcC|B?+1eIi;lG0T|p1Gm66dKu8yUs@DDrP6D z5UWnjjXBn4>J=KQrV7VbXjW)dIJUwBi#W)vwT+LT(jm(eRWB7LRhZYA(_=)nIvIJ& z>h1)UPlb~!oKoQ=Yh!vUs{E>5X;!R_4X0K(t-|R_qBA$e3SV(m4w_-=fuQ!psv^!Z z`FVzC8=hl$u3^ch+~*sgYB)_jLWQ8ozn#j$MMkC@UTk=Y;iZO`8D3uD3M10jUgfLP zAZ@*_a7~44D_o~eJv@2ddV^Km_3BEab6P*Y(N0wks?(b*+*0Az3NtFaQsLDKGb`L? zWu+Y5Ug3@kPuc0674E9=kQ%ufMumGS++X2=3P+C4-CNopD$G`swhhBd?gi_Wqttymb1!KqsPJc{<0TtrC+f~i(|+aG?gHMhZPYpk-@VOB+ z;JF$G?UqXXOA~%o;p;5)8zbLV_|C}phCdkoXsB3f>c3R@RgFAO`sQyHepgV$TM>V# zQuNkLl;EElIV=2K;hzedL~I)IZ-xIV^p99JVxC6Dh^`UcOt~XsQ6oew68+!YNmGR` zCQs*_-6MKL^o&?4VzG$DBbJC*GD@yBx|*aHm-Jfv%4@ctEn?}2Wg_}UoP0&ccYSlc zBl?)Ze)g$P`I%mkPwwB*&*THN|1)Cwh}9$3h*%+F#fSkBt5~R#SSey<Q$T}f6o zhgXXjn0YR<=_N^_YeuXUF*ss9i!~@>?TB?UYtqy;PPlHAyg4qie#8bAx^XoB&SJxe zjg;l=dacJmx-Ls|vxv#JsjVWmHj+B5xFRaj z?IMOpbViJbl39ejm0Y1BDHrY#v17!p5u?n)P7ymt>|$lEP?fgyHKUOKyG877I(ryu z#cV-okB)fM{NF2L?}$Sp4vp9+V&8}ZBMvhC{UY{{IKV8Yr6o_JNA5kzJN#vo*Rz#ov(5%djC`Obb z%BqWqt0KGzUo9u%l!zcAjA%u)BPtfF8c~agB4SHRrqcVedPKt%ni2OdmXwb+<_S}W zkByiRF*)M+h>50lT*M?JX}(fTDW70wPmDOpYDe<4ScKxIMofvA8Zj;6w20Hq!nqM= zM4TCMmWnary6+QB9eYO|x|cae8L`GD$?@8N9dW*zy7?xF=4=;4To`e2#3d0InL){? zTaAe5P|}x1To!S8#1;QPpQVuI@#=_c6dLhx#Ix*ZTP^O55jREL ztZ_q2f>H9{=QNegbPEtMGvc<0+toJ+bk+Id3#sH-74XT`y%c!gGyaT z8Y;X$;(>?5P#7hycM!XjBvZ*QESB#_;Cl6n@(>JnEJ!DUV-i~-DN(R+q zV&08-Pkk+Bmzeh>=4cR$=@;`s#D@`oM*J1=QN;fuzKi%i;^T-pjIlI^0P}! z*Er$bW4aj;S7{4%GbIO9+Kb055z{MXX;WA-rf1AjD!u=ADAO>aSiNKV#4KZ)8aE_K z)r9?HmW|mcX5*OUVwR6tGiI%r6=GJ5Sv6+0n3ZByj#t@!{;u5YOvw;aW%!1OQ7RuBnF`LG0 z9kWf$W-*(a&M?CvF+*dvFrN0N1#1^u#%!fbWuuVnY#Xy(%=R%m#0-z=j2RK@mss<= zPnwo6Ew}V^N3*<>;exB}t}&xx_KVp+X1AE#WA=>MD`t;4xi1?XGsbL+>re@#HusL% zCuUzOgaxYs3R3o^c0kO5F^9w)8go$0*qCuK2b)3N6<*dO=`870UaJAR<323r@R*}w zj#f?S9=2~zl`=l&h&cH~+xA*lG@nIutzWPrmyapLIA*pS-K;YBBW~-R~>)bR|&Nlr$~Qit#YOY|aB zxX`%lOFrEsB5FC88khVEBbUYK9_n)S6uX1g4FAfQtJGmf=JvCGac#_XF*hm~adI=R z8wAC@J~gP8Y?7N}Zc)dq(znX3F*DTht8}ZP{hTvnZi~6yoRRV!F?Yti81qt`+{ND& z^MG2iJ%G47<{lH?Yj~fbbnaK#o|zMQP|YCb;h0C{jJA4O89u7=*9Tx?9*cQJuY{D* zrb^v4sBoTCE7e>p=INMcVrIoWA2VAGen#%u7**eMak8gW(`nrxTx7RhFT}}~=I!-L zi`_W9ESoVO#(Wer$DGuIj8|h`i+SBj;0@K9ruQltJAEtWZOiF9F+UGaZtCBSdC$1& zS`y(LT>_LNv#&crtvviM=HrOM!q!s%1|xj zYa`znerxz$%=cO74>3O)*NvEzKh%_IQitwVeu?=t=C_#NH5kVHqd`9A&zQer{*IH4 z$0{5(RCy~`b#JREx)D3&$y_(xy-x4QRr$U%*HMLPvR7Ocp|{=^sj_I5)i+F{>xQ>W zmFKKF6xv;{BwLPpRq0Vp>U}Z8#SL}3gpnl;dsbO0lW%Kp0WV#pcQxq+y7BK*O;&ic zUB6$I{#7=uvY9EXjV)Vcxhl(7S)s~0Ro1O0Ybh&Mlijles!4BJsmjV#_P0IQV>@%J zR9UskYErg4_cf|qqIH0(Cc_=8o4zz}n~__y%39T=<0~VBEF)`InP|nLB2xATn*-}r zS-;8#RW_`$ag|M~Y*f`WzN6Tg+|ugESr1aZ>uHhpW^Z0)NR{zbj;JON{)Q^uDtnmy zEviW$8K&q}wyLsqHQC*|O_gn{=vGvfvR#$oRYp`9S*5ee+x9q5txor|(%inv4pnxk zvTK!ZI&(W#*{RCTRc2{EX5 zxJp3B!LnTC&?;(;{msr{Dm1+aY^b6*vdU3aPOfrFm7}X1qmt>&om5Shes`&`3HgN5*5rs$tErZrCtPHQQB= zRgG6UPT4nyReBSu$=Z>;)wnUK%3xc8oLuF2HI>fX393OWI+dXcP!f^tY$Q3g%9JYS zsnShBrZmEwR^@bS;b&N*Rl7a2%2~$G&Lrm;Ik(Dx$(xnQF}2FHDi>6fMJ+WLC3K)Os{gW%y#B3sdA~Bw6$urcI85~R?$WvE3}KEj;pF%t?oRPMW%91m1{MgpTUeX zxUS0eRbHRM8&kNU%8gYRglDsQNT zXbWhSr>i_u<?$v0n)?o% zZ{Z~kEN1N$3wqV?wM8U!r#k4#5Fe^vRr%0HPTSL0vf{~69RRCH-})RIcUa1q1Qx2`q1)mW>>pc>t4 z^su0nYb;h{@fyq2=v!k66ZWjJRE;H#%TyY@SB<3?lJqv-CzGU}_p7nIN%|WuYq*@@ zf_hxRPFFNs$x!wO)L5m)s&+cia5cjPsjpsR4U?>y$z^bD<3nl;t+7sxb!!Z+v7UrA zHnO1gYiwX7%|ePBnXVy5Y#$Gk{u92@%sIgCteQS)baYT*%YV2QQT#bWk9FV0uw#I=OKgfuRA}x(W z?DTL$`EzKE!)$y=LzRov$s-Cx2+7EzLRjbm$^T;r4)6KYJXaYBs~&4@IQ zt1+p@WIH|H^0FWo3Oy-PlMkuA9*O*#knw_R)qPQX#)tFx6>KfNr(8V<_t#Mh6OR}aSwaYE&iW*mDSxzlnWpXK` z-dfKrDI!z__WyPMJK9D7+q#v&FNR6j!JY&K~Ydm2@L5~@Ed?Dp0Ydn>O%G9ikKWF6G zEJx4Rm~E05YP@Jf%F26+uhe+8#!oeVuJKxp*UkAkhHn_YTjNb5ZyCOA_>N)vcE)?g z-#3(5y~6N;@ed6@64v;*#wRtt%XB`i@kPcztMPfp=Ni$kbG|h4mEqS}=r=XK%@mZ7 zj_+&ykcIweB)wt(rN&>G{8uBt)%e}WABKM#rvCqJ{2vYeM*cJGs3#Zkc{OrI#M9R+ zsI!Pk7Om5zPFLg08Fn-5ZrG#FVs#d;vqYVx>-09^l65xMjtJvD4f}V`^)e#))njvg z>d9Z*`qt@JXBp#4cY2Rp|9bMi)v~53g&wn$Pra#}^}31_R;;s9optK0TW4j{k#G$o z1L~}jNmi}1n(={#s~e{8o2+SkEyF>EYa6DY6C7M;Jv;rV&iY1X){}8{gE|}5*{IHv zTCu6KU7d|BRH<)bWYapEDa*!()Y;O=P{S<@hZ&yVBl(!&R>rqB+$NLD)bKi;b*9#t zR%b+=k#+n!L7naE>`;I)`SVhZ{M} z@SHxm@tHhTKC;eHCONv!F?9xLiK&0`PF&uE={k>VTzl1uS=>^ca>hL)YWZQEN}ZGB zMxCfmoXYD|GtGvPnql2g_M2H~%Sc;p*jq>w>~vzC*SRs)51m)E(j&h>S!$U?8Ib5)(I>&aW{^8A`ieytG+ zZ^$G!*SXR7O_@Z+a*Od>Gs%ql{QW|D_w6vi6)^Nva0sPkr~`BtX$ZYG&yS?4Q_oDG&}@O7PU z>dedRd|T(YI=|QXPGe)8A2RvRMt(H>$uP~uFUEhZ^Kk#<$}6w_sPm5r_1%d->-=T> zZ^Jor(AldRKV-HZ=zkmhcElWbtPq2We` zZ*QFVvq^(Z?R2vSTNsgW^9DnV56vVRZ(DbVyX(euFlHm-Q<%EPcb~c!3joAG)yyilJS!b zQ-4l1KE?1fD-&h>3_Cru!C4K?Hhyk{^NgI6rF*`erbebN#4l`cQG;0xo^3F_!Nm=3 zX>eYVx?}} zY|Tl0MuV9R9&GSXgWDS1Zff^6xWmZZSvK!%aFU-fb}3Sh2 zwZUr*UN^~`hHn_ArT3Qcw+&N$$=_@6NrO)tyx(9>gAXk9BNbGG4~?g#_pv#d#!9pK znT5*2mkmBQKG*OIE95lAuQHvljeKLM=-)T^p~1>c1~mDx!A~Y%yvffEelgzBO#1Av z4gRy!-x~bh;1A=H|83+?!@msW*gsk5znNrSCdoDD-!ju=ktU0p@g9abqxm_ zu9rEvVXD?-b0ZrWZfv+olTD4J^*F@%mWD$!`4&co8Kwwi@782@J3Yv7k0yIH*}KVTI~`-Vr(x=|aGxgo zXOexJ?3Z!bKOo}=E+`Fc1Z^_TP8w(T1NCKiKZOTnzOzc(kG`V6PiqHGP%j|O^#C%Bu}&_nX-P; zy#~o!GhJLiYrx^~Nlzf*=5ihdSi_zg6p%;8?wT=$s{-H5rC0fo6ImGvzo)CbFkZ+ z+@TiLV(%7rHn~gfvz64>-BvjFn*Kdjzv+F4g6?Z_f0GBAJlN!+CjDD1+v4FSk2IOv z^9v(>s$wc(Tb;O`f(Otp>i@G%p0ngWZt{GS*-hSU z@?Mh{n!MQL^(JpLd8x_E7V)(v2XxK7(oF7#UNy;idcDg&^Cd~QbvoW`@>Y|#HH_F+ zH|1AJE1`F+*-P_gQ+~h6hZcQ~p_=grMx^;sCi!0``NZ7&w8>{y=F<7xf|gz_`EJ;k zO}=W<(SjCVo92&AerobflW&`R*W`Os{-MbS-4cC8PY)I8&rN=@PM2%(Ym?ua{MF=d z)BnB6A5H!=uB<8IpCl;$Pm_O}{MTfjB`0eV%Gv_sss0D6<`!wOXp1FUEZL$@uY zx00gkW~eBNn|jrwmGtGsS}bnOAoVac*t5k_Eqa+;ahGn<+m!p7q>u4s%%JpjNT;8j zrj9MwV)+)^wAi-A3N2P_u|bOsTdZU{tF;(t7FKRCpv5XJRyDJ!ofKC$$r@5?B`?Rx zZ5?a1ShvOC7K2)>-Ae8~ml~W~$4o71O+syKJ&U-$3G?~^aj%>j&qggaZZWKtTp~9y zh0R+GF|uik&5X#ta-l;G47KQ6m^_szbjuc7nPh7VmD=*FC5~;EsfiD7B|Ws$BqLgk zG?H50!T64uWTzH8XMC3yyJmb;i`|UxZn#G#AKhY1#`kQY&*{kQKFU#xwi0czUyJ=) zlvk@35qKYKu!+ zT-stvi_Za673*9hGIE}g^E3I>h1%)`CcLo4MMkD)Iu{#J zqq;1UT-oCCj9<~3zpizaNv<|b+y8Yfu5Yo!gk;3NA=5vs&5bQ?YH_nkW*gqp;?@>3 zjNjhkjutaB{o7ikx3qVf7GR@zN{BHP1i$62DlK7{^zZyc@Y}Dqz7V|W`x9Qm?*G}3)55tZ&7+J)y ztKp)CT@0fhxo$=jrF;AT-XdJA&ElDSiT3R*1By5w^^^v`X=ANP^+>sqC;(9<2IYL*}cskZ8o*gt=nwVX0tY%w;5uR zVTMBu6>E#EG{m}*6s zLF%D&MwvvXyS3+!1LC7iIJV80HhUW1tIfV`_A|bBn|+Kdu(N-g15I*(p)923b5Q2b zIFlc2c!=Sl3uzv1e0-ZD+8k*--=@&!DC7E++0pW?oy;844}3Xo+%^xjdDw)-HfOdu z%Xq0xxs7Msx9F4G1Z~1Ll{QhEMw_OE#^zhCP1R1*IY7Ogj6dSvZJBE+iEg>J)J$Q* z#EuDVCK^A^;!5pv%jqObC_O#C%?WKzY;%%no@RKm;i-nF7;1Vf{VB%N%l+wX&al&A zQ*)cOI~00$n+w}q)aD$sf3Af}eqNjN+e~fq(%8hvv@G=t{y(a|1pKP${r-LynrNPB zkfKsbM3iPqDiRqgX%doorq8`+9`1ZE@+F#3A(`iy%!-U~_Tq|{1w`)gCTa@uFV?GwpaEphDawb8%xkgsMg-BM@FN!?W&-7(!M zm*~meGPuv0ntN)&T8dNMSIhr%!2{~&i#kN69<0SfwRl*m9;wBn(qwW*J(i@}g*Rfg zc#5@=##L!N&8#_5q_IyL&(>m1Eq<=WFSU5C7SGpWGfmavg<8B=i??d=b}e3#o!3}( zvr{kE;uQs76|R%dYirS3WnreQz}IWBz7}uP;!WwCU5T8DUEh zxFM;Z_Z6i6haw-;;tN^+NWo3QK9X#y#nxJE=iuVUe`@h*ExxM7*HYM4i_dEDIr*BX zGkhW8mr2Lls}UxxtvS7E>Knl{ZNY^Yw=Spo_sR0#-C-R zeyzoCwP=_|qcnc6#UIj4rSYe7`KK0lEwA~D!;t&`iG4Qxj)XtZ8Z~Jkjh)iiIgR>k z3w{S9jd~(qBgH{P32zXH4J2d_A>TEP-O|`SjXlz6oJNy0TBp%Q3Qf~!o<@r_nkm>| zQl!sc%QRZ0qw5ZvhTWcXJAI?PZ92MkkhDvqeHw9I46>y<$U^5d_DrLrcqbuanWRe^ zch8I*?wZD4lE=Pv6Cb%ex_j!LMvpWmrEx+UJ=54XjS*>#OruvCz0)`_js9uumqwp7 z4p6GT^r29 zVJaP8?ucj9q3P)AHcU|m1vUM+_*cTc_1%NR(>Ov=$D}bz#NubBswyivqW@;-EUQxIx&rt(zrN{OVT(wjmc@8 zp2itzOp%?LY0OGvY8t1cF)fW#)0mOQMNOibp^@qGoScvNX_@!hy90tD=j}}!t7||C>{i&15%6I z`qDHmOCytpk;dgpMYStMu1MF-b@S7xW$`6Ed`MJw&W&sZGYu<^AdN5$Td|(dNyBBg z$)wsfi!xWTmRTdpFOiINktg%)4dFBWwkZmKmgLtoeiQjc828oR)A&O{ zj*ecc5Ssccjla|QNAj9X)LuK%NQuzxd->|Ca-7aT$<1Jw3=Y!WV!aINXRv1mT{38p zLBkB1Wzal>Mj7m?v`sQ~rKZ8%GH9Fu%Nwsc*bq%K(WQq`Ei!1CL7NQPDpji_Rci(L zB$PVsGH9PchYUJqu)7pk=X+%SZ@s~5BGo!6N#{&dCsbfA6z-Kl*9`W{pic(fGT2+r z?@P@Lx@XWc$*zaevV$=pQ+2Ux;^e&~@12QuRw?JNFAI`Ezf3gqGk8D-2WHS;YDbT) z*=cfAC^l0ZdvFE=GB_lILo*nj!H5h7W-y4AX4eePL`R-t<-?SmopwkDL&f9d!{lw; zc}6B#Fv;QKM`WVE&|>W9435lTjFgWOvXjI&)MGOkC&_r>(ZXYdvBJa*j?3UY3+G!n zK7&aa+>^n*s+JQnn3KWj%Im}oPEx9qg|t68gDDwIRq&JyrisuQM)7y5g42aFgflak zB{Exhnvk03H%y(8!I>E>$zW*)a})XE49?16UIu4pa83pnW^j?B&ZW1B&PA@}cnh3>Ic^1M8|yiXR`NgbG|aliVn^ zMZzsQl0@M$1y>4h65cGlMYvqZ9<@S*6>@6^xAFYHf=qs=$f^wP5LunbS)98vxH}W= zqw;<#?o0P&a6g;Uz+3|lWbh!T0t34lcu1+f%;2jG9!@MgBJwC}GK0rCzA|_+gSRqx zn=?!*^;8DWW$--58qa?UpUL1^5lYrbhwi-~$txMWn!$_WFC{uJONXY`X0T4e^%=aD z#8Uox!nuF@hWML_gt6~r@NNd5WTM^O4H<0AV6$T1%iw(x>U@ysf0V(8;_)*tdblYG zek`&j(cGGN^=Ss%GWaZm&lN>$Ux=_!G{PXs*BN}1!JirYmBF{1E>vSb3Ab~W6XBlf zu2X9`MgPDljt>Ha_qR>`oWU;{{3@N_g}(`DmQD7Dc-$xd7N?z^jp*X?PX;?O(TAJJ zQA4!~JUjzF~ctB#m zpMr7hfeELDgAEKYFwVeuR*r!~4IFOZ2m=ER3^Fj(z%T=c85nF}$bV9?P_e@#!wrm3 z)JP$1@<(~BGs?hd14k+9Na2`7jTT~m#!3?FA8p_m11B4pY+!XBn7h;4>4Sn^B)U+rS2qa}1no;5-B88+cQa3k+OnV3CQ%CN45? zv4M^zI+?h{z@-LWFz}**%M4s@V6lNE2Cgu0rGbips)6|iY7KY>d^YP3sk8ypfMprJv-ZG108*r$@O91<4v&choj#Cm2)xbb#plG0EAZs9JATMP`QRfvzC!nZVFrteH zXZv{El{pGD%(K- z$moPB$;GMEs`jZ>2JT?}XdgaymDd`U=q_b(kMM3e%mT8j+$#w;S}$sndceSg2A(wV z6uVj1)I$ayG4QAn{rUUD>^b#PYa6B>Gw`^9Cs^1<(UC}2EZwF8^*MFWji(K)G4Py$ zXAC@RMECv_a+$<##%ILj&&$-hhS5W%mkhjY;0FUg8hFLPs|Ge1*lb{}fpzRZ1~wXa z&A{vIIR@S`uwLH2A!NB|jlZ~_-!|~B{Av!m`L;82Hk_w+6m5@RfnD z4SZu@l;&aTQ-=?oX_kBb%yhfbelKK)VZHIIO+OjFtLk?dKzdunNh3lEY2=X{U~1r z8whVJMSX*RS3$G8n%K=mYZGluG&a%1L~|1@Oz;M+sflK0G*R%!+c74gotCmdo2^8S z9}-n&JWSe}XlJ6mi7u)N?gs2`Vhd~DKdq06z9#lJ zF>z{CcINv^i>SQuJb9pr{w4;R7-Zrg69=0ZVB!!H97Jrm_%A%zYKNN9Xo{v_1U>*BCV;@G8Z0V=R)o{6UUqQK=a!JJp5_m zBonht%rb=*gJ})<;-CAlgJNB_!R*nhF zgl!@tw+$0tZI7IZ8`o4da`aK+NWnG1*`Vj>)SLYywZKGZ;wlqYo5-5TnJAhlNi#1j zsB|nEdlW0Y%&s^;s*Q??Z?uN*%W-E$-(vb7Uph9iz{GVXu2;D@Hm_wTk)3#)a zZWX5mR_X2HajV@SzWP6syJRZrU?%QKIF;`=@qmIa3m-J`oXA5a9yalaiAPO5W8zs8 zkIC8-CZ06$xHvPV8~iYjW@#-Qan_OBz zWG4$di|it7V4avW-5n1vA%#vTqAXIc2@YGlIWCD{=cMp+nb;YbT( z6m?WmuGn+t5*rzBVTy&R7LK-Xj5H@$IKje+7LHYrniEBi6CN*|BxG}(WZ`5BlNIC= zls03tvHepdpJU;43)93;6;2mYXNHBD7G_zPEy-z#oGlw);;D0ngmZ;w3Yo=OB5_&H z7N_Pp7S2sL=ei3lTxj8oEWXU*A`2H=Ftf0-xWvMx7VfifzlF=#bND~+7HTbAuC!MO zuZ+3=QYvjBV_~HvhS0I#(wev>w1w=xLO;tQIbmK{uuv2! z3FFtL{GW zE(>={;U3|=7OqIFv0Wap@E~^-vzU~{Llz#kaHE4o4jz#*?K~>7PtVk279O|ogoP(9 zykX-_8&6qyn!Vb_7#q)6c-F#BHg>kL#=>(JKB3zdp11IVg?B8xYvDx;FIiY;;WY~{ zTX@C7s}|PMf#ahK?uOOTmh3=nWAceAH+WySu-?L(7T#ix79O1tJ!WOKJgMt1H|6L* z)!w$E7d-iH&ISt`Eo`!|*}{7k-na09g%3F*+DG;m&rWfH!Dqfq!Uu34sjm3J5Jr7$ zVT*;W7UJ!9N_Kg^hEHuswpsYh!p|0dvG6%NFlTrR-&y$5!dDi)w(t$-v_{zUM|2pK zgh`rrjS9jnwp;j~Grxr&tteA^OZoJUDLzf(S=OH<{6-G^YT-8ve_Qy+!tWOT&_MW8 zGba;rMZJ7X>gM68zbt$t{T&ukHfn6ZMs1tOEUP8n&E^RKwi=z;#YR0Fd)wH@MtvI% zY_ze_)<#1cjchcr(bUGSHg>bom^w0h_e`*U=x0AZ*W>?L+h}g1m5tUmR`g4?uyGil z0!aB-?I7`MKTJ4eeB{9PeNydgw71dO#-28Ix3Pzfjy5{k=wL^e0J@jGHq}r`_%N=; z%xHI=@-8;^veDH>H#@r1p($#z2rLNQ$PbPr-EH)+aj1=fHhS9F*G4}Z2iWLkqqmJd zHu@@y0S!|7*-=&VAq!LOFCnwwa+-@|N)EKq-^Rf<22f40@q>Vp)|rQ>Xnf|ftX^u4 zX7WKSvW*coM%ox`V~7-n+ZbwN7|ZC?@L>~gggNK)_JN&{Sq$L%-^LL(MkTcxA2VQK zU*5lFv>p9%UXIT|ZH%>1vQf4%&c=8f=h`^W#?dy8u`%7o3>y<{9LqYfG1w2kWKS!KT=lYGay>Q{~JlLRJX%SwPMM zZ0jfHML5&OEE{LoIMc>#8>iWrW8-w`^Hd(k8jHq?Wy7uBC&e55xi-$SG0(=?(qY5J z574`}iH77kbh2TTq#L*WZCqf(v|-t}(8fhJuCQ^Xjf-tuV&gI!m&*cuxKwS&PF2+X z1s^=IhPO^h&1WaKk+EU0_IQA~ODe4-+xX-(Zs?lSsxZ~0UCOrM*vQ(**>G)mHUb-= zlzCqhJpvXVDEquIq%}I3m#|=?XyeA;qQT1_$1h`9sEUoMjk|5!W8*3tSKGMB#?3aa zv9Z9$4NPL=S~_OqIvdy9QP<@r6)kY38u#agHXc|K^~po{{WlwnZ7j91%*GPs%fEvk zw=vRZ!S8FEYG|i8^Y9+w78}cL+-_qPN1u(AQoc=9!~t@vf^0|LD=}?ckUMOwwsEIA zHvPX#I&3d0@W~7DUK{t>c$QPNjr-}9jmK>~VdFs?57~Ic#-l9Sk5R!NW_uYacI-Jk z`NMg@P4S!qH*n_54oyAD`QOIV%HqqxDb5TOK4XL9n&dEk%ge^|HrCo$XX6DMFWPw7 z#w)C@ZjnDPaU_n8Mj0QjF+29jS7mB*V*fQ8uiIG9;)l_M#w1)#al@h1CiRw$w>eB4 zOmOgyjdwXgIcVcxgN=aOu*vw{9U;4gv z-LVj6!G23mw(t_BTK!c1Y_sv19nJ83%*`zYxM!S zX==fWns@j%3QrTM4&$b2#bR>X-^Nce`?HNx8bnj#FBjHuE03vY_BR{9bJBKD-@zX? z{=Dn_>;H^*Pb)&`wJ$ zC#seiJ9co%(bhpb2ZuN~)IocP6C-*#=S}odvWd-_JoG z2M0Rn@1U=P{T=jkaDWqC4qhJ@y#+)2aWUiP&P;fagM%FmaH0!S??!d)%ZUP|)IbM= z9E@>rl!L<@40bTm!Ql>uI2h_+n1kU?bWx)b-i;F33L_jmHX(Jenc5<+j&Lx_!Dt6Z zI(X^0=z7QUQj?y?T`2BOV;ziFF&Q<^iB1yE;fEk3;Z`bz$2yqE8k6KW2gf_O*uf zgZa$SLB_%LOKWOXKTKXv`JQ)F4JXg8Pu0)?%Yp5{bKq0isNt(RjsutN#XSmj(YeXU zWo-mb^v_f5w>bxS2NefZ2L%U32PKC`UvSiv$Vr+dvI5!9zZnx<`>t|uwSxr?u61x* z=cvZ6VW#?5Xs#sL$JoUDR0!qQseY~(E)?D%j2BCb9W3Es@iEZHQU}W%T<79?7dJV$ zS!yL0w>VhtpskB`E><{L>ELq*UpTmxS+gD-yv|m0u*$(h4jyKS9IRH_`yAZq;4TOE zD0sIpKD$WASQg^F4xUzTyx+kCNl#wMBS2~qcI-zSJnGo&jUWc##9a!K)6|a=Or=td||U!nx(BsK)q< zmk{gJNtl)rda~ZZ8xB5n@R5Tz9lRxj8yvjN*=%#oO+53-tAKCe55A)$VV&lW-hP$Xf1;+TwK&7)zU>Px9&vHzxPVaqK$Oe;>@ePi``uu z?_!dRJzR8fahQw2E;_pC7xG*&Qyu7{zgu@al^L;^agGDr z==|_N7l*hwRQmDzhP)>l$z32xs652QP#5DB9Oh!Ui%~8{D>y=UxNszmXrM92BiyPz9Om%UJlAJ1>mh_6a?=kD?k~28V#cUUIT%0b+X+oZv zp;v6>GhCc02{*B+Od->f%yV(JiwoUoSN|L-oa^E|H@d&;$xDC=b%Erue!MQd$i>Aj zE^%?GqAp`k?iKZ)f4!PBrshf)^Ih0392d2$M%9(UDN(Zrl{0SCI!t29h$W0IxGp>e zb3$Jjx(GyA$xNOV=f){{UcBI<=wgQzN%*50i&<7wMOYPH<>G3QYlPHXAabqne@Tlk zba4ZV>ERL&H@aBl;%^uKxLE9BiHo;fyzOGCi)AjJaPcJPe-}5qxYxyfoc~=ccX6i- zu5iH<%eT3>-Ni~5x4LylrkOAQ8!MhAR;ixvaKQ!4YNcWlewFAh$ytiK)j;=fm~aKh z&wkRTi-%o2B5xmb!CM9nfrni1Yf zi)W?$l8ZHLCZ74>)WP}R#q%1WOc+l-wDzJj<7RqUz44W##u&TK#Tzc(bnzO?BF*)Q zew>8cAhAotchn`exY+9AT^Ac%Y?Sf`Ejdk?J=%{Crdi*uwiA%AVX=%yg%yL-`W*1^Lbi9R!8R7VBblzV#U;$c4zeVEEa zR}Vcs?CYUhtnWqJdV7m=nZe1SyZDXuQawEIS~i|9cZaE7UNpP%*E>$7zS`Hr{vHnT zaA=&|!+{?9dpJNYaodFY2YEQy!vHD#+cSChO%HjDd7$Knc^K?rkT{c2jYx$dlCX3P z4)-v^!we5IJ&g2lxQB5b#(Oxz!zd49q{$?sRnJGVjktIlRr7+X>oo4(c+r`Vu^uka zmHlWB$9Oo=!$}?{csSO>aUPDBk*A-HDtV%KJONJfaDqxyPv>uWaF;cFvWLkYPL@uGz{2RJRzXKooy^P)8{XKYHQQ%yTO1 zd$@wWd06e?N)Pir+`!4xLoFNHL&ZbYL&k&Q!S@h&Fg;ivT-Af^!SSN?KwK`)W1Mza z;dH=L{c{x>ddPYxdMJ6wdB}SxaMbWi2uq?=@d|_%*tl^|F3WPQWsp-~i;yK^)N@uH(4i5l{~cl_}GWGSD8@c5o9tt2JUmBF zJiPAVd8xhZ;S~=rczDsnOOiyl!)T*y3TkhwnXX zmFAZozVh&ihffvUCj4CZnFrpwvc|qpFt+(M=i9wf-%9e0Fr(_?2G@5A(v2TH{OI9N z4}W?1NkTgFn}?r0{NhD>Tnzr2$YZm=EBJ?Mm6E?b{KJ{tM|~eVJf!@nSMTJbMg&4i z;#DqppSXP8*~c!DvmMzX8~AAGqmhqY{ivUCsKyylGbS7?O?))<(Z$DJKAI_QD<7?W zG#77?N;bWzb;XX$AxY)-fK1TXD+{Y9jQ+*sEYvX+!?PHXW(LRop@iD>2@jfQ`I9BqBLaN2L703CApIn?E`AI%b7CF(6rX%Vc?MD}j$$r$b zT+8u=j#GS0^KpicGku)uW4iQb3;C^#89rwEn8g}P-pHUQw7}nKKIYJD(qw#lg2K5z z&hl}tkMn%YlMxEfR`NL2ITFUh?R@bIg%?PNQ!8)wFG}<;^>GJ~BQGAGJyzU2|Cq?a44B+NZ>1$KG7SK5zN3*^WBB!{q^EJs-Xwt!yhk0w1A| zf{!BGaZ)PlBPW}*Lj~H*b3)KRs+9a_GN-)kNBbL5rfQ?AkE@h~_ce^YTAXFMmX+gU zv5zH^T<7CPAB%ik?_*)o$~S0GFcnu3aka#6*(^R!i++A9wn=i8?n%lO-)h|_Avg9P5P8tY zL+UVeGWP8eACIyFkB!z#k7||<7FSu_;^-EUi7g>ghrkhc}~bx z1SKzs^K!Y;m5))Dm!-t<9hxy zj#4nri!OaGoo{@6;p0mweC6Zoq(V5*;+5pLiuz8-RNF;Xt4ICl<8L4T`1r}k&pv+f z@vD#Def%LEUKXkUo1Bj`{nN)^i5*Jf`>!27QUU4((VHnX0T4u~b`GLRm1L(N8pZMI zWtSj&l1m|@>PwCHLF~_s0_+-KPJq(`>=vMLfCB^cmqL>OZ3DCm&{V-@0h$MBA>KMb zn*c2Xv{JBUeDs)u#`)u&W?XOW1MJS&0NtgtM}STNItS>WAT>J%(Od0o#61Ia3D8aQ zy#jOaU1Q-=ybbvzx4CD+SU|10S<_yGb%%@1G%Fay*o zm=2H$qJ7A?571A(|7Znp0=QDJ6-zs;c@}}hV_R#UCl3P@0u-g04Uh|vSJ`QY?Zy54 zQh;)RtE52vN`PvduU<`Mrc~qe2u3XkaBYBF1KdUns@TN=mISyi!1VzZ2Dm{9dB;cP z8v`s-kTnx;oAaWxG|A-_k!1mH3UG5!wp_XSwR zk)qhuN_$s;I~AmbRSi>j2e^lWT@PP)oSP3{?ho)lfJXy77U01E57E^o(RrkYm5O!s zhzKu~aYUIHlGk-RXimUcg1G|tYL+O_+N;MV}Z1^6bwx9muRQ$GawF2HvA_SH`{-;2;anj*43 ze+=+bfS&{W!Xcw9;*Lj!#vXnT@JE1Dh?+2(TK`n?e**j!;P1p#e3@YEj-;O;#7@$$ z7h-3TT|#gj+j(e|FGmVnwtg5*M{ylCl1`ftZA0uDVz&^DLo^A|LUJZ)D$*>ho8_8^ z(VjW|=OwtMqFRM$9Y$Y&nxP`_gh0Cx?L%}8(JjR8A@-13rw|=vgf=^dbvw6l<#!IT zXNWFR+bgWw8RLlH=%AB(Qyya95WU!)YEl_K0tnF~1gDgqVe~9DUZU_WvUiC6Li7!> zzcOMC_epZ(^JV7SPgxuwJX8z*Xbl$P;1FkrI48t_5Ql`A7~;5CC&cg&BSH)eF(|}g zAqGo6G>p#X(I9_A|EKWQfD*VTiHP=Z)17Ax4E59pcCkVm=ogk5Hmx}3Nc%;abJyf*xOJ0kMN8TXNBOA#WO?9m3%rs zqoL6>F9g>)Jp8~F)VU$f3sF`poFC!>)>{ZC#DyU)VqJyEgt$1wB_S>kafR$$8sakc z&!Khah?sl)fs`vl%nwm39hRMUvb>bUcX`w?LYRsoXMeE7*}GU?H-x8PUMBmQy0@mdW`eDM(%nQKJ7NqDSW&PmZo270Ibn6}c+J)gspj7YO5eyDr4_ zA-)aqU5JGtZV2&mh*v_~7-CU~`$IesVsVHiAy$M~8AeOBrAmIY{9G2|CIz|Y$$W1S z=WM)Og#Gr`5VwW6GsIm=OP6jBxq*N?q`=_nq&Jdx_Hno5_cGtsxJR7bkJ}V9exHIo zZ26$b8sS4B9uDzHh(|*_72;{;64X4#5f|bK&Jx<%iZ9$xs(pFCc^*&xa5S-FhtVP= zzUyc1yeK>u;(5;hvP{W~B5a+PMB>%#t19?gA>IzLHpIFRugUWI5N}BBbp`p!DV_E% z>T64kV(`-t+d_O9;;Rs!$$`(M$xhBD`yxrjKJ&GBZ0#HI_?g1?5Z{OBlSSVwehBd+ zXV)xRX7N*qpF{i;Vn>KyLi{S@e}(uhvH53+-$VSNAdk4PhU2cqiv2r`p3cPcXDW-D zEE;6dFbia{Q#QI@)D!NUjhx&iTQ|?d-~6nvsQB1PqbzpKqDdA_CEP6=^@qkv6<-0F zV>2b^eA`?)ENQ%QZk0vrEV^W|R~BuuXq&|zS#-#vT^8+$&7xHVJ&AqZJsaJ9$GoHL zbQX5Xf>Q^#@Ak|_lV`jq(^XOXWYIl~ZgOewSfUxMM;1L5?48BFS@g=*^|aVHbEJp+ z$!BioQn-H>{jxYbizBi)Ad3UD7?Q=%Ec&yUvNI@)gR>Zr#i0ta2AJv)6@k{``E#J6 z;-ff+i4RU{l{&++7?H(D$%hN$&O_|oJL-F*vKTG-(ZVCM7@Ms-2sB2LqlEEbA16Lu z$mTmHiwRjAo2@(MG*J~5uc(ic4j0TPWN~5^r)P0S7AL93re<+U7AK4IYoC)vrevdi zGZt`~g0r%ioyDna0tIJeF;j#JJX%Ji|EDRtIfEAF*l2|6r4vV zvp82?oh`}z4O8c3alZHkS-i@5sYmo2nU-mUgZwcqWTy zrSNzbPiFCy_!G)~A-DZyGtT;lb0crpWbs@UFGC# zsXmg0P5)7#e2aqgZCe&wHNeR~$>MHa2splyZ=8OX#plwDJKk4We9eh8huw1ch7%p< z;aoJ4ekYwDh1(O$-;4Ypd?ugzDT|-8_(j2ZL@?p63jQVse$Pf<;{79wKSll${w@4R zxI>uAMQZ%j7U3C%Hd#feyW8D56xj<4pVbDC5J&d9G1h;IUJM2 z;2ehJFh-g~g(Gt~JcnU949`W^S*9J4*o+(Wh#W>qGO%M^4UbmvNFmQxGs#inV{;fM zLdkfxQN2_gJ0XYTbC{IFu}SPik>hfxUq4EIf`TUtPZXXcjNeF_EKap4xw>!8Ps`y{ z2~QVJ&tX=gGb4wY;#^=b34gP5I4y~tlZ)P0qVS9y&dg!1cvM32M?~UJ zAw8A@kA6}3L=I2p@Kg>@=kT%=;&y)~hi4UBBYZ*lobY)e8|6ijmy#f@y^_PL3a-uJ zH4zHeiO}rpIjk3dL-=McS}sz7KgPb3!@D^&DqzibnhbdGwR;AYt4^56DLs#{-4^l_P@( z=P@9UL-IH@k8>0?FpoiboFRT#9)m?r%VS6$L-ROMK_(oQ$LKtc%wu>SBk~xT$KiRN zp2a9B@WzLq)9lb7T2_6~B{i@|4c|ZOQ}Q@9 zkLh_#&Eu3jrX@b}opEk)^InqIecn*d$YW+6v+|gokM0?{dluinlXFvjFTUbYO3hK) z(-RB4YdbUHb4AV)&dX!oqSV=W@G~s*nZI)-KQE8-MJ^CtC}b>m#V^U@(mb+x;oo>KgfTeI5()xR#zIsjibUo#E?6R9l$G4SC!s zKA^$KpUixlkFwxnP$5!!m zD#fSb+tjk3iGMEqLP(omim)BO$>ZBRY6{WihQIIf_(g7Sm%{hLAA~;&sq>S}{w!o4 z_*L@X^7uWEKg9nQ{we%R$W+YhA0^o#`zhtflK!b>JPO#UfSn82Me+uTKlMcF7jR~& zu5}tp!r*QNG%jFaG4i}g0Zj`SD&DMs<^^0)z?B8GD4=BlV+$BpK&t{;7ci)R!wP6q zK-&WLDWH1+?FwjLz}^h<<39!LA+lEi9Yi`6(7Aw)g=nVYk2?JAsi-bO3RwxUysISL zgt3s=qkx_T98kc41?;P+zQSGw^cLB#fIcEL^6#^F^8F?3r>tZ9{Utf1fP)G+SUk>U zfa-*v94a9zWMCoM7GSEuNllI@V2Jq8L^4cdxRA;t3piZ-hysoj86_N@*ra`09wXsV z@`}On1sq+#^a5r`eoO(=L>M(eEa0L7E>;w4KK{E6MqMh&WvY|QRb5Onzku2T_Af^LiaO~6 zt}EdB0y0uI3NTetOTlXkunTYsaFx6$Q=T}J`yxRBp-5JkOJef{6vSB}R4$1#$FfL8 zSQTDXz||tx2p0(BRMh{UJYi2*D6&X+gOIT|iab;=wYY#K1uRwY$pW4dSysSJ1>9V~ zEd?wu;LZZ>DquyD_I8n#1>BlQZcAEuRU)}VWc7b)`|biBk?@`Z?k(WH0`4#1p+x_I z0v;4+L(o0mVX+_&OTs%ozJ2*kBdK%NT~dD0naG-xA55lUM*m40c#SS=R}?_ z;02Kv3wWu3my_66M3{Aa8CqAsYXy8>z!wF)Uch?B7O|DeyMbs;zVG)fKRbSYk zh+`T=AAh4}T;aP)zFYDC>X5EBk+7+dn$3!6o^U$WvWQkiv@W7e5uJ#7xp-U0ni|A3rUPW{*qFWJrbFfQ?8#r_z-gzL2tFdPh zy^829g?)?Qi~Nk*Pr*J#^i9eVE5~=NROna40Yw}rwf;pMQpBM}9Hby)4;C39jQt!~ z#E>L*P!Wd}F<3#CCAJ)^4NG)}7cruUkwqL{#1TcDSj0(1j8g2_BF2e~F5*a$F-06z zj4p+oXZWM3@sb}?!~~I}h5YaoKRE?%nHDjzh^0LFQ^fH_Oe*53REj6NPAGzJYVh-| z+(TQg_j*{ClZ&`k$tM>vrHH9ToKl2agjdA0B2FzLQ;fbiH@%1%MVwc}`3lY~VonjK z7coo0*}~I=?5os2gVn{ay-C90nMKSMr;x#UMVwuXJ_UA85$7g4jG{lW!UaWKR>b8+ zTv)_KMO>WdTp|)@ap`~f6-CTXbgmSko!Uf_{*R_1ZWdvQ*g{7bXYGsA$x0DH5ut)v zVWEgz5}Ox^lN5_6DOgToDX%8{sv@oyzecz~7$;$@f4JO-pE2!h=OTq_htg@nI1k74b+Bj~4M*5sw$~Y7uJ{ z`$Q4Xi#*9rSj5vsJfq+mU7+JZ@vJ2AFnKQFFBI{jbY9|^mGEUDlTee(crNDG74e#c z8;W>cUB>7!PNo=1Ae;4r&XY~^5m9RsxQ1ekIRYHw8_qTb4 z+9{FmEW-J!ehCdq*iFHPNo=E1U5)K3$-h1{Rk@D>$Ttp(P9}VR#8+OBh$e2+5BqVN?ktOE|m~ z&DHz}TYTXgUBZzi{&8vzd*B$3wH-UyQeAavJ4y+uIlhFW#V3|PiOvZnoG5-$B4LA05odO%iA*iw6p?AdQ%jg$;`UB73Ct3b z%oK?`!)$SueU8ZKiOv}%-bG?=31^isuY{E)+*-ofC7e@&UqT?Yb4$3igv-RwE8%>R z3xpR6FA`oXyhIo;OD-3uCq@ZZh+iq3FRT@&g&84_GE&(Tw}iIP5xPQ87=IBuEFoLM zb&}+SRbgIO5Eg|cVOdxa#(7;Oezou#;et3;_&*`1YkGBk2@6ZOL6T*{8-TM<5Uc!4NykEkq67DGBu@WAa!fN6DCEO`;m+)@kJ;Hm1 z_X)4ncf21Ee^B_4@L}O2!bgR1*`HuHF5%S@)|T*;pgqwvQ3%3Zj3O^CX8${d0KNEf~{6hGp@GD__Yw(Tux5Dp)+lAi?e-QpCjEC4S zCH%?`S&qiwZzcTBNuZ2l%J@S%6m~1)&l3Jp@NdrH(xm(!UIj`>DOe-iwG4>tl<4eS z#x4o3S4RDWHxOx9MkA5#)1q49t9-=9Wi%<{T%P|_RNHcN)7`9$<{~YGl(a0PRl-}B z(I(+MpVm$Z+n2F>8GDq`p^Pq)(0Io(_7v}wNII7hw`1qzlbCyz(N(eWq_;OMm(g94 zBZWPZv^~q%w~SupXn%&rdzZ0a8GXv=TgK2tXa6z|p#u$4{mM8%!UKf|m(gG3AR$j! z@zX{F%F(KrriRx~9a_e~G6pGju#ob@%F$O-NcbC4jz0XtANjB{hL?JuB-J_P=s7!wL;R)a^CiDfc!BUzJ)OU(jEfb#Bo+$e z>uijdmvKcISC%nfQHHQqm=@CiO!@!rTTKbAGHek?=n6d{^?i{*7?$hSKe;mUWfaON zmT`L-tI8-zVVSU8Mx~6Z_yXZoLR!08%&zJE+8IP9nm@<02j5U%!QO1*HJSF~&@M$T~X8ga{ z&z7TmTLw8-JSPQuNdBVu%Tj(xIuvq5yi&%iWvne@ofMex%`#pSe_gm<_=YeZBh-0I z!MBC)2;UXPS#M1E`ywBd@uA2^!jH??B(hl;KPjNiEedWegMU24;I=Y8E92)1eyQN| zGQMDEsGwTGmt}m#VOYVO3cfDm81>Q^pS2*1O9@+5(E2~IJo4S9g0>ZO zVh66EeI@#MAf4yG?-4slvvUP|igcu!2%}=NT`K5WK{pBaszjsmU$5x%-jY+&qk^6l z99hAb3ihp_m*hh#=q<9pa6e%mVP9dKMZXFTQ1C$EU}1mdbx;KdSEB3h0O29RLxlr{ zgM?H#OoRqw&q;<>Fsy>%6^y80q->5-tsX9ZgfMm>F41U7$d9UEYy~G)a8d>1Di~kE zv5GqSKS_=epYR{a#0rj6@Oa@Q`5(9J2}x_7T)|}V8Pb^|oF<$q{Zo=ur>Z#975uj? zW=eCGaJDe^{B-flDmbHpGsWjt_-#O(Q^8pZ(v5i{cXIQ;g7Yf4NWt@k7bZFvR6vD) zl`oe365*wZ4((iC!4(x;DTz~oTfzJaYU!#ZrZ6KkgmEQX;`V0T@>Nmy2WQh1euRDQ35t1Gysf&~>^Tfu!5+)tefu2b?mE4aRb zg%#Xf!7UZsP{EBAELGH^#Qu^B7K_K8|C{5o3T~2|xx_WUyn>Y#+$!M;VJyF`f>jmV zQNiv1DFu)J(O~CJsnrsa-=!pX3-1x$D~$7fpn?Z0c(#Hy6+BeI!-{&kf=5K?)e{vw zD*jjnk0{H6bB($1?2uKkaY zMqaOAeFbk-@OA}nDC$jNT>LnfcPe;S!VO8(zdd>5eP55 z{cq04l5i7pi^x{tpf;&bMQC$d1)uQ}px_sr{}VZNz7qdBk$fZaZ3W+nY_H(^3Vsm( zN%*6XHu+Zt@m1#63VvfNSEE_z_X_@~;PfiasN&BG{^G<{#er4)UBN#Ubd=7H3Q|=x zucAd2HIg(IGC8W)Nqpx-vWrN)D(Y9GS0Eb*Ng7tsDB-(Sv72~vZN$+|lPa1jAy<#h zs&)USM0v|9+E&p{QLTing>8h~qo7XvDmo}gzPrdCLT*#X|IW~{~^zDtaqwKViHF%UBZT-d8sFuSWm9(vLQE zdaZvI2UT%=6_ctsxQYQ)465QVX&xdxR2c6T4y@L#WClw(yowPbLxe-C7$(BJ*da$& zad;KSN^(RZKcLL!*eN3P@RUTtL3C;r(-oXi#q2~rvx->>r~YZ;bA)_K%b|K^6?3a7 zR8g$rtSaVJ;Z)&D;p{3hBIi_bZWZTMaeft-RB>q)7f8-tcTp7=inCwwHi43hRah41 zvMMfD)ch*0sA2>E_EACB?Po1hsd`c8sjVWd7U5P{o4r$AJEjcjn2Dw(VhiK#6i+-5 z`a+f~6v+y6LgtcBVoOz&#g|o4iG@{MCsM8Asw%Fo;u;076*BFDYTb&FJidLqzKTVP zU6|Q=7kKN28)Zaq!=$1V`(uq7h{XEmKEdeVyrL5%f(nO<&|Qr zEXJy0ysG4D!WBaI?S|LI*9hMb()nsL=GPYEO^NG@@s`OwGTI4%6W2RNdAArF4Bsfi zAm1~}`yw9{W0T2ZaV}ex+#%d1{ID1wi7`r{TMb@tNVY+08B} z#$R3>_2R2y?BQB?5%xNh>et0MSd5=#yjQrd7~hC|ODx8B;O<4`d=d2ziLze>E+i*{c8R*b{NI8t2t#6l}CelNx!#rRV;M~m?{JC4Wy z#m?_RS?RH2{8Nm^UT4NTUW^l(%FgxTq{vxbRQ2K%cLBvXU5t`ql=Y&V7arL|Sftf- z=RIN>uQN~5b9pZ+cu~oV$};1uSkVyjDu$maSj~&-UYsMHVht~9dvUfGHNB`MpA=o= zI$qS3Sp(_xR?mz2Qdl*UXMDPx$%e{3&x=MT+Vj1*K%#5Y#EYg%UMOrKY$m+Oi;GpN zxsqp`w^Y(y+14_+#EUi}ZG~(EcbmFQ$qrszF4A6jh44z@Rl+m&S1Wmq7afg$tryoB z&XI6~7oEMB?8Ou>Zj|2BzUfd$i$8PyVu6q;QovC_BztxN0 zUi9&zuabkjxLf2lFK!p>Td!27F(ZIEwD1DL_k9qO9IJ2HGt~ef;M^3o_Bek8tK$l$q`*&+Uk7oU2uQ=Dddyx3*-%U626g{#JS(w!=+`B2@58nQXthdMsg6sP}MBDH;` z$Deh5sOQ6ZK4(u?--iauJ=ceGq_{p=if(Dp(1?wEr5hdf3w&toLlYmGs_XzCE;Mzu z_Mw^K7l~Z#LvtTmh`02il`D?){8qwUOEVrSuv!Y)2^6}ib+cJraT z;jaH%WN^E%r;y%yiQMW#Z;?L2z9#oJr8+7qB~qij%Mx?(<=|52Ji|$cGU|f53wJTbA~5 z^L=>1hZlWV;6uQNpbrauSmbk#qxeDuuTd9sQ1O|6AG|*J=(dg{x)Y0g?~?nhkPlHG zVm^d@h!`99*oMX=aXDd-NjnNybSL*9pi4~u=+=fgKX zEb-wbAKvz1y$?%e{HhPH`LIm$WltNo zTh}PLRvRf5S7h!wAKp?aa`y5&K5Xz|yAL1xuu(-e`LNlCcYS!zhxet>>;psGFt!*E z+oW$bxgYxQkFafj%)jKqgyisw5Y_KW=K!}mV?;KM;5ewK1T_@j^o>ES06^DjOe z^5J(Se-$3~;fUh-&4*eFiT3=Eh+E?y3WFczp!k>UkIL=erm3m_BZcHRM=Y=Z`*6}I zT(#3alqgxz506HB89&O36!`%WmgTW!Iq?d@^1^*OBcKx+aH%A*vapJfrK9We_M?X%7x{6qA6NQul^@OhXyHd&KQ8s7rHWi4Y~@F5f9Vdz z4XllHa;|JU@yq>a?|1femkC`nw<)erS(kV4<2pY&`Ej)$*Qj7eKdu#V4Tvmzy&pID z(bbQe{OIh*jWXyW&u-iD4`MXq(oI zevDU~ZdukoQOQYuJSKbUkBczt2|p(LF~yImemv>NO6k*BwI4A*;(kn*5*5zyW2VR~ zKc4gBdGV+HnC-_LKjtb)pU?O)&v0Icr1GpEE}1WVp&yIiSPUIfygF5Hv6%~U-~qxd!d+7aenyF zkB|KLRA$?S9}C@>cZf5pPs|wJX_Q@ld?xO$%NOFi{rJ+4ul(5K#|b}9`th|Nd;R!B zx%*7n1AcsC__rkD-wF2%zxU$@5w0em+;~wB@%|{~CqE8~{OrdsejF12&5y$(zY4j3 zXUs?Z`29agid_Db@|WH+wT%BdBDDiJ+bD-G^wbrvXB6&7&I#aLB`+2>6gCo`CuFJf zMJ^CB^2Q=f0%&TK3j=6o_(fb1^Id}G0kjC9rLtND&{m|i@DgL+Cg41*PPdmDrCk7* z8Gd;H?ZvMUUMajv*g?pGR|l|7&qQ4tz;yxi3!uNUItgzL;Q9b=2%vKSH%jRt>>}(I zKv$8QglBrHyOKBmN4!P6r?8ihJ z7{FZt3<}`x0PdG^PXL1hxR=8q;M@Qj62Q;^h6RwV=HXZ0-P;QE`AZq+Q?bJX7@<<> zZAJX_T=z206(r`44B!Fjt2gC`1-ZNxz}o?=m%%#$d>z2v05$}$QOdi*59Iv40Nz)U zPPi7E#OYyk09!bEn|iiN*(UrjfR6&$&WS64&jR>7fE@wngp13k0em9PBCfJi$z4Kj z=3f}gF9X>9e=WaKa*wfO?fX>Sj{$sR;`!Dk0emO2U--T72jKxB%TB83`AM9&8<_kh zfJ2-mg7`3qUjz6pfVDwqkQ_Gl4+L=}fZqf7BY;0S{RUAvh`$0jDuW6^XVU&#{9oZQ z;XlIT!V|)i!czfM)Q9^{2T&4#N5#tvi-hzBkut)v!g4}(L3w>MmNpfG&LAhL62w_S z)Ci(x5LJVyCd=w3mj*O*HIKm;h-+m~KZs^*fglB|{JKJ$Ale3TMG#j8acL0kg19`0_OicB$di2@JFPZf_u{8! zSkYBMbO_?=Ag+-Ozh%8uJ{cRoe8SJ;_nP6kE{IM++!4f`L0lii4MFq>;uhI=4x&pC zUBzz6n{>=oUoxAZ`wVzxZS=43EfP782bS=ov(>Ao>Pzo66oAMDHN_sQpV2QfgFJPdQ6++Jim-uQ)E;=my83gW&Xh6gc7X7>a!Smf>?ScG8= z31Vmv!-BY%>(bQuSs@E@3*xsacmbBx@#-ZTXGE~{dqK>-Umo1xc|H8WAVvl8P!OYo zCu9I7c{FIFF4GbiUxq(`qiy2A%V3cJcE; z%$LCn9Gslz#a|RI2x6f`#=sk<%;jOcHwd3{{Xs;7h=~V;!5~5+;UFSGl)Ko&f3R{{ zSKAX0Iy>J~5S9!QK_sQHm#L?Na4mBZGs3K}dTYmtErYy}-WU(J%_Tv+6vWaXmdWSq z!j~C?_CCv%d?koigLqAxrB;fp5OQd(5?Q2cr_6mLh}A)?;ULlcMn4qa3}RgnZy668 zI5rGlFY=C%@oWs@-5}lz;{71D7@H4**c8NOMMZD5DmV`YyPlccYRYoj{7Afd2-}1B zIEWoVd=kXJL7bNUDQC_gjs~$ah+RQ^7R2Y=V0HiW3mNPdaz98{T)qtAt04AB{5ptV zMD_-;Pvn~*eh^^{-;xCJos#>5_+I472A(iKpL>zh0tcl07{pH^2ZQ)ogfAaWFDY@~ zRHE4-iN6Ye3*s=RO7Y)=pxGbnDcO_%Da9@Lw``6Jj|u+~vWZTJ(DO-7bcTOC*9oa4 zi1Hy+2*DFVQ3wb*yAtCDyVYCk6k`TTR;fD~~gwQsGS3-DI z#+QcBU8J2UdszsVhtNKRD?+$ZV&@R9GP&1_bO_;Uk!yq5i_(Z=I zzCq3CMth@dx(GP}yM}O6$T=S1(k$VVX520TO{X-ZK!t@Ykgm6a)cZP6(2qR@PFoeM&3<=?`5C%!PTX;{%nTz;YIi5r9 z+Fx|2l4ocL_l9s^2*YH+Tvo(ocnBk;kaKQq_oVaD&IdwxFocOAObTIC2oHrYHiSn) z7%j_(Ll{E?J&(j!Et*&HxI2qSLl_srcsGFR9==uK&MFf^&h*053O+XcSO|}YoQd(t z5S|EOatKpGn94EG(us$^_#|?1A6B8;X>6GgI%;(B?2Ml$ni;~Z5E3CILwGub*&!?p zVNnQkLYN!Eb0It*!n_ck3E^2q;=iNRC%w6G&JW>*5MB&nfehSBD_os5hdqll4RX#e z4#CTg4j~+ZF9d%Gfe?Zr@bG}$JZk5uMOcNPQ~JHYCx{z$XAkO-xgUP z!aE`xLf9zsZU~!=&3hv63qKHU5;DRqB3p&qgdYmIYIOdw_~#*fA+m$pnh3K#4PmGF zE~9)V!t=-7A$%FacS?RG+#}?_*GH#3UyIYj-VpW~{!Iwqy4)!4hPh|C`wzn3g};PwNaR-`bAJ;#9KsPTMLfvV@<#}N8k@gFj)w5J z2tVLMo8uvz2%%;ewZhJnev;FB7!W@d!oQ01bOV#2OSxv*J7e@Us z&I_Ya7!4$zD?CTYCgr@>P@GP#)s6o1m251$APo29m$^-(FnJ+s(YDXx7l+Y2jFw@v z3ZsQ|W^q&ELekoJzA21L!e|pl+b}K-JF`kxWzhpqKii347RKdav=8HoFs_txgYc>_ zI)-s=7#+g6I_&)A?HcY}^hZB#dbe@fml-4M6n6euM&S-hB9VTOYboHgwdBRBjt`T?hNDh zF#3g^y>@?z1Hz@}ac(V)ZD1IK!nj+xcL|xr<(@DGn$7~OVF)EBl!gy4<4++NzM~CsS=@)Kpv>z*-6^#>_7{(-#@nK95p^fwX zH^Zld@woUCVN7OIXyRq1d=+u3^e2VW7*ZJ1RacNr5yp%#W`;2O&Tv=jR zxg?fIB#fv?Oc)O%5k^u2jAJYncK-WG!iB%@WT~{wGV+`i=7hG8RV)r;Nf-yh_%V!^ zB)ZQvEe&H?7%zvhJdCfTzY@l)VZ0Z{`%1nR#_M6cA-+PmQnL*SP5nL0&!7zRf4%oasu5I+pn3!~lvO)|nh{t$Ym1a##Nd9GNq(<@1?h(^%yp?3LH!8MiQrs?(IE1_ zXBNDE+fbt07w3sL5^{ZAv2g?~BWM*t6X{JOxbQzknniGtl8pIck>vMe`~%MHI$q`mM8VgE{=t4wYO)~Nr9bTrC<2(FFbx(GT&aJ_PG zjo=0mT6PubtlDqXx_1#W>!t|0MbKRaJtDY8=(i9|JSm=lC-}gf;%G^sAvZZ?-C9Y-YvXG=)UJTM0}`_Ei+8yULg;_MnrIb z1dqk=cnl*Wcp!pE6wxRij9^p*H$~AciiaW?9l>W2d>+BW5sZo8*$AGCV65>uP2`aX z9u*m9^zji)5T6*qB-SF%4;)Pqd0hB}aI%n308Z5inzIl{TZdBSIeZaX|5!F(k*3SSV0B6u-^1>y^ZLE$2`cCpYa^hMwo2?*H{ z>_j3%3bWBvDk|I{j71QSAQ3?_f>Z>nCDPc6;ME9Tiy$3ACW34PIc2>ZfgM3Uf~86p zB3K;3k_cW>(!BuaUQXl_r@TtZt#X<1$w-z*@Ct{Yd*f1!tmcC*d4)_N`4i=4-p&? z-y{55xHp1*5quNDx9T-+YfhJme<$28{NChpjTr5Z5&Wd$mf zZ$erg=9X?aXU;z&_%njPA~+gBQ51;cZ`E=lf|C&(6aPneT*#{3IpI_UB~qCDSLAdA zUzj<>6D_^AP$r79QB;efdKBfNC?9p^vC6^g+yPT~&$9b*rus zMeQigj-sXvY6;yDPWw7C?h-{^>Gh(hA4P*G&WWO36qiMDZWIlpxG;)lQJfb=qbM57 z(tQ@<{3tF^lKWiuc&|wmO{30khzbX`yDz>didIpyj^g4dnn!W6$kQU~jMbJ==kR+C zug>wF4xjvtI+v{5MA0_toR#mb=DF03_GxF;Xm*mHeU74i6xT*^T@+VDorBD)qUaFC zm9nH6-CiBVHBoeAs1-duuJ$w<>s$ai^Ch27#`1M|9D0koY}O+%3XmX%=w@^AIURg~No*a$9@2lKag!?x^1%#YkiGfXIWwQQQj{ zeYD8KQH&88D||%wsBoNcypTS5(|J-9k16Sk;&G!t6U7talcSg-GBt|1CilrGrg5k% zIX#NmA~T|xDKbl20i8c>>^V^97|s=+XZXZAo@b+YE{f-+ydaz}WEMTVXe<{*u`r6C zcqnC*ViB*9{{12WlN%HX3B$tn^E|OA;@l8oI4_1o6v-&oM6ouClqvO66qb0}C>fD# z6gi{VB6(pUip5bZiQ-?KCGp2wyi>n4ie<`uIf_@KcrA+MrtB-x(&MoeQLK#O^(fwm zVwJ=*+cL>&V^7{&2Pbbvu}SokDE9&)^m#0b zf1)@Z#R*Py63fc+R1_sjvedsKr-l3{nkR-L*&v28BDM9^1qR^WJS``&d<+#tDhewJ z-S3{A6+=}e>j+t}S`5|2YY1y{+-juNQj#&$7CBq!o@LaHp`McUW6n;efso{!7|s=U zJF8I)=gVwV3>U=ESiF_6iLjZlX$%*NurAKM7l~giY;N=xF|;(CF}IH4k{H^=&^CrE zVz@Hqe1(R^FO8vH441{6T_kT85-DCDL;IN1o8%|mFTcfbKM!|f=n%uzF)Sc zhHFhN*T-;O44q;)RZ=o-rDu`$DL2H>Ifff!=n_NU7;cks*BH9TaI^SLF?198>QSfD zd&F={47bM6TVhXPuUP2`+L`O{?rhvAR(d7m_89ufa$pSoMeY#N;eeQPZJ&h8oyMO0 zt{4W%W`VNqQ7;URVTj1k816HDG%SXD#o3HphKr9dxl|rd>(S?fG4Ns+74|HV%0sGR zbPNy2Fh+c=aJ=x57#Op zJt>>#Vt77=Y2r`CFg=DDG0aqQZVa zj4g)UF}x7Ni!m&SVIgf|2&>4V7>Z-?8lOH9mhy|xNx&$<7!Eb{aEZhajo~xtF<~Z# zYz%R3N=hb$JOW9HSi-cho~|Fd&C6PHG1xIo?C8nIP>5l13`=6z7Q=@zycEOI7~YEE zZ53P=!^#*|#qe?r%VT&Y1|A9UF3D>g>TFE+?Fn9muIO12b1ph@$MJd$Z^W=BhP5&0 zn~H9wt7D)IFJST>=$kRDM?w$-2En(rQCM#^OQ=j zV;qR##~6N+nLB0<#_)3tzp%TxImgj6j$dQ=Erw=sTolJ)u2&2dM-7`dLCZfa-D7h@(Lq=fqJ{dR<|yIBJWW9Y-Az`k_Pj zh`pW^Mp!@YyaCFrbK__zv9a*HILzZQ zyTs8|{H8d%sV;hON6yXCdl*Zu zU@!5z=&bYIKb61LC-(~CviEzg^ zIF2E4jEiGD*HPkV;jlRF6}c~t2SkR)F+$}2I7W)lAw8d2g$Lsp6~{x$V(+_sM4N}> z7-Q_m#_>oTk1FXta>Fj35XZzgrc0b8oD#=Wk;jCO$MHlQlm9=x@MIj*xPn?oR&=Ju zj-5O+RFL9Kky&i;`W~KN%#LGD9CPEC7stXl7RB*Q9M8(;1>tkT`Egh!CC|sf!wfp% z(<9r}*DuDgK>hCS>5Aj<#*v648HX={QQ_@Tfs9OQ0wLBydgw=SnG)Kv@w+&d0jSiI-2HLIM>N zsH9}=1S%&`C4p*6o|SNJBDnjAs^U)B@}BAm)Q~~Vgfq@-iJzJ6&rYC@l)4Gj7h$P- z31{A>F_#93(qr0&37nTen*`d*tWg3NE9-nEFAz3PpovJ+1e%G^+l2`*493Rgq6FLs zo15Gg3A7Y%l|btRF8R+|xTQEtTq=Whs*WMiC&kMXXisl^S|fq0MXnT5xhjDU;_h^J zjd(|sdu^ih57C`W4A+a?AcM|Aj@zy#_l^W^N}yW;-Hp;iV#%J??p;dYUJ!u|;i5Mi6M$ejrcRPwF_h9@vWd{6>+i_qX6k--TJ zG0ISpVF}!8l=~9SeuT#NConRB=Ms26fd`cPpwP`7CH|0bbb`PA!k7fcCh$Z8lM{F( zfk%}!DS>e!6NGd-Uc?P}Vxsg}-^V0AF6947X*MN+sR_)H@?-+j5}1*|OeLR6V7dq& zT&Jb`!(x(I2|S&^Y-PEJ6K<&N%DD;5lm1Ks&x*KvkTd5^^AmU>fftpz zOX1|@NK65rA$fj<)XQ^wyV@QW$6U*!7)eh@j3 zz>gw72@jg#@w1Yw(Os!SO8zSRErG)#M~uzyBDDM~fuo#$lQ=8stkK`n%O!CvfqxP> zuH?T7oKE0`_(|a@p*ti>#90{NJ~)*y*RO-Xc1qPxkxSswZbd#LO!;ys0os#g-X8s6JP+t<``o5<}+ z^b_fC^Z`lSA%15P14YJF^4uljUJ1NMd}$KPk{B$`@P;HYG>KtK-kU@?iHP`p!r@7b zNaFq^Mket<5_6N7$IdlnrzSBfiHDLHoy5aQj89^Mvc_<;>g5@mbe?l&6YNi6oMSr;@M?PbZNPcLu-OFqed_;(6%>;bP$uA29d$Ka`kQ!?RR@;EIka#~5gBSWz$1xTcGCW$=XFDIo!%6Sd8ypV*s6;r5`a$LC!J)D(7 z)f8%^P*Y|sUd?!`E=wx4q|o^66l$AXI%HNIV?$m~S@netQaDHCTw~ubh4WHql*0Kb z=Y)dG1*!i%UuZ0m2WA(h&@6?^O{t4grN=+?e{l-UQ)rPwOOtzP3a!Lj3ojA2F}ZD1 z&b4uVWUrl3E)${Bo+~SUrSQfSu1cYU_|+*~C&C)95$PzrR?$-Il*08=ZV+}Bx`&i5 zc1fYD#G6v+mO}RwZcgELDJ~Bkze!GTcdCRY# z^!_GyK+3t2#w;!aQy47$E|WVbg}cS?5xOIA2v;P9Va8^73ipcNXOtKE7L73cevvBo z6g`l_gDH$k;h_{JrSMqFIY=0-+%e)0o1Pk*!Xqi?xZ+WxjFZ`T;RGS0ohZU{fyYIj z5W3s-wQW!P8ZHdVW!9|;nPBQuQ4};c`5vv!e1#olfttp zY)s)@d3!E}a0-zWo>y|dkj`I7;YINUDJ)E3k@y3hJ@+^86dN0_h)?KGAz<_%*Vk~4 zglGz}6mlupDZ~{OBezmWh$n@q|3sS>&j_>f!`5JtdtxGaU2Q&^J1OKKC^ zER{~ems5z#Q+OqXS0%bmUQ=H%YlX;4`Clb`UHC={t5aB$!rBzprSO(UJJ;gP6dLX< z8pZ!y@O|*^o`}ceX;T%W=_s$zrCZS(i!ZF>qIr|`b`2Pte4*_^^Q5w`P|6tOkr0FpNW5-!nY(Te38QL6uwO1s}%MrYme}2 zA!{sK!LwKVXY&`2ZdcG4mkiw55`&0N{gr$BkHsn8vA4=h%$j`>+7fzx20pG9x zF+QBakraNH@`unJ+uW4s>SzjoGiD3BEgVbXAI=gMZnkhdg%c@UY2hl%+1;E>;dBZm zDV*Xi!1N|{Hnm3vMHXO{&X8p+l(kBa=V?>ULTw9YTPSa#f`y8*uWX@;NF|~B`<1gS z)Ks#ng=!Y6izjM2an=xbzxz>3oZ^s*o;nulTDZVMV+-}H(l@mmTBtAHz`{9}v+Ln5 z<6J4+-H@Lr-pJUWFB>{+Vxg&pmKItmiv=&V(9FU`N;X%$7n>~lX(5H=<%>M6EnLDZ z3+;?I>TP7uRz+AftGLWUdx@7@&hF2R?Fw->HrjNs(9y!R7Ou8%jf~w1)5Ys7+#r#b zokXtZ`qpqZx6T%Bl+s1WU+Q!fxk*U-ZX*26O%DsVSa{FE`xbgi>}{csNH5{7rZ@Xq zxJ}9iA!E3m4WfCzpN0Mw21vid!UzlZi{B|6XyGmkgDl*wKm}5E5hPjU^y6?sC3hFZ!p0yCM5Vi1} zEEif>WZ`)W^DVp}p1A#0&$8oPCcEQF=AEbDc} zn1#57f`!Ev5*Csc(iSonQnIv!`zm-i4Z5LbE#xHTE!ZNAfetytoVoeF#KKD!Ube8@ z!cy6=HJ1Hn+jpyeMOm*3lRAZYO+$!pwyu=8%EId+Z&+As;Z5MMD=g1m%EJ{QvdOlN&5CaMrv2e)3uNHpeY>-BSG!9!hVxe3b z<3oEz_u<$o0f6MtZ6uoibUGinzL5s7IPgpp~(cZ$t z+wSfPp0-e8p^Sp`2#eBy2z!K24!92w@b-OKiF`+O+9YQhuaL%BX;e+4Vj7jwsI1&7 zY4BPNb9pnJ$WqnPsGdfxG-{_&BaK+XDO*#oH^@?uq?L)9wE@a z#&pj)X`GuzyEHCKqoE9%rEyUj=cUmojq}sEAdSXpG*OoOXaQI7OJ4a&<3fpiK7p@R z@xcJz3%fXt=4o7#MjJZeWW_eJ(=Jk9A3-t6bfj#-2)^o6_i}a(GV~JJR?hjlpRQNn@zQkA+;pVQJi(#(hc-Ph)f%4~vgT<9?Bm z!UxiLP-IjZ4~ekxS=_ytKPHW_X%x~}tgJ`am}$&T! zOCyzrB{7~x!sI4J=qD|bGkPYCtl@55b{hHrC`;0KDUJ1Myd!aG8mrQHJ&k1?7*dv} z@tU!JC5=}NXFMy!R~p6j|3(^bN?C36HEFChoHpwWe=Ci*4R?9z}C>zswH;wnw zc;6_S()hq|*1p+rZtq*gw;AQbG(JjWyOM6Zxv{xZ-=}HpO5-!-?&L5q*T+6jY5c@VK>Py`t?uVEevy92#W-7~0}L9Gm0Wzaf<+8LakLE{XXWKbuAx*43C zLBkB{Wl%qZ1{s`_DeVPL$ZRFIcDK3C%b-yP=Vx$%v2k-*I}KdprWstQ2%BfnEQ5PGi@POIl>mQdwujOEPGa!POaDlR?`IF3q5Q23N?YT?UtBaCycVGiMe?NLN>8 za1|@!UgkgE&e(L!;Mxp2XK-T%*JaQtgX=T6L6$7b#cfsBp1g~)x@K^b*71z)lAAN= zk-^;=+>^mA8T8Cx04MMadS!5H2DfE!dj`E#uulek6_s1d89)8xzrP89y4y0uJ0;%5 zy?_W6-uWU9GObNMID>mLxK9Q{G8me{Fyo5GtZR4%BQkhU;{6$n6nQ`%&O|~#OV8O%}cQyJ%5(9?x8gfoQ{XNf#5oUKw6>3nVm^CUiFET0v5E`#TdGGBxh zF=iH7n8Bh9(yFmoNHLm$SKOC@KZAhLLm33m@FGuGJYp2iFfs8sH#(6dhkX zkin)5R%Ea;gH;*4uB;8hH!^sWQ%44?jr|&twHdhY%Dt7r+fwLxy+~fi!0#CQ|5@tU zX!yG#?+M=*GRVytY~jjgus4IP8Eng7X9l~p79R?CWbl#5cHzfD7G#5P`6Po+jVrF; zXUe7ixrPeK7a8o9_@&IgGCGa-n1cH<_$GtH9NYZtkMR2peqgTncf$Qb_ZaMe_`wW* z&frIJ7W|3*UfDy!k7tC*CY- zW^p2elj`MaS)7thg>32c^=}5JrEtAUIR9szT}F`*!ZO0L!g9j$LcS0@!#P>BCF%KEk?YhET!kCV zI*yj!Ig1;O(nX}J@TM%fsYrJvZ_c8J$SqmiCPG&|v*;y$t5JH3^bz*Wmi~A6_AL5I z>7T{0Ebh%>Ko)mMxigEqv$!XVflA($#UK&X{NFFR4bEby#35Pd@(AnYIiq_Jd!O`? zLh8dsMhNd0x|b#%$l^gIM`iJl2tByhKv?QwDPx3Vvv@>=`lDHlGkmXfW}9ab&SFXyQ?rgj}U$oTMlZXKKu3kmQg39j zI*X69*pbDWEY@c6UKZ~gn>Vvqr%2w)Vtp3x$obpKrT-0CY?Sh@v1dGPv#_oY%sOt# zVw3o0qp;qsS!~PV!z@0Mxcxt2pIM_%viLNM16ll-#m+2tW$|?ud$agVMZU;lx9a`e zlx6K-X7N=PdrU>HD;M`=@l6){v-m!XZ&@UZ?@YlnF}v~qpyK2#$c5ymEDmOIIEy1$ z{G7!vD)^f^^pK2y6}ras<~sa6i$AjXOU8d1pJ(bi`k&hW$>KOWD~H!|&Xj(F16AZC zcL7=ao5g9)jX5-vSdvA#9Lne5QIhsWBFLePNLitKZth}*94bnzlta}Vs)<(?RuP^h zbWiH5=Wuoob#kbYL(Lp&DXVtQ*1B^%^$e$F|(IVXp6 zr8E>a5}ucHcD~%bx|iiI$bnaQ8Y_!#IU6?>cf+_Shl_LQnM1D}noI8{Y>`9D99o%D zSLM)J{F0n=4Tnpc9NOk^X%2ifvYoKK@G{}$IZUnV+>c=H6;iG=N(bZf>Kv{S@0i22 zIb3J-8*}I+e!cJpqj%1MzsBQh_*{!F61(PblZZRVQtzI_%~E;@ZxOm{%G_I(d@6_D zIrPb)uaeX!<#3z$?K$+zp??koau}7vLpj{Rb>y>}!aIcnbGR#4dgp~%gL1f=eUZap z2JjH;4Oj7@orjqwu7g3(FGSJ{qaA4+tL=y1AoscsPe~Mj0dWXbxkI z^2mQ8aeavvY!xM^aa?Uvd;Ygr9Maop+lfr32-jJG}!wgx@%wd*9 z+Oy!(In2&sj+AGOJ~xMXZb75C{%QZboXpSRg&bZ~t}h3F4hxLsLXkzn;vBpp?lu+3 zA(%rthYX!aPYA;~L`0&(xG*MUja(Qim!y=G&@#EyvpFnNGM9rblFwmr4oh+# z@ueJ={zq|Fiu%hrESLU@$z|4x99D8L=W$>8#cfhi`5C4;RjIIqbBZt$TG2YjRkd z!<#vr$l+uT>vDKYPL2rQ=A6Utn~AR%zLUd-95#x-o5ROB>=1u1hxc>%Kzx&MTMnB= zwg_48)*MdFb}ll1DCHxgZ_iXwGN9SMp#EKZqO<{%CA|(j-IYKTG+==!Zmp zzt~EL)mHr2%kRqiL-?oguN;o%@VEGJAsrse;UB}@0mjMUR1W{LH`Pt-ME51T(=sce ze;Y+MV55wUaW=-=C~KpfjgB_1wNc(i1sjcRG_g_9MkO2dY}B_=*+vx`wQSV3ah8p$ zHmcjGVLOrY>NH;~u4aQ*szbbtU^}1t;0(qr9_jJ+1mis0MjabPA`KB;JKTO5pen%cO~Mq3+~+Gxfi zHd@+fCCiI#v=C`7WF%$z292(zvv!8m+Qua|4x1;S+Ss^(&vJ0`w{e+`t88?zak-85 zTrXmG&puxFehOFE&K(f0DIM~g&)c8E)ixe(;JL#s8aeIYGas=?~c$ZDW);@3wF)cs#(eyrJByYSCDYmPc$nDg$n7>~uEZ;ijHUNy!8o6K#ZS zgl$Z+@tBQyHlDHZxQ!=l%&;-j#$+2)Y)rH9ltv(fpK9Yttp$65711YgF0cQn3Jyrx z%o2av#%$X;0O0+yIVOO)A|2Aso6B6IXKg%ZW08$w8_(OAuf}IXae2YU0w!huBKuk& zpJ!bh8*X2CxpDDm-$u}ePiEBpij!fuTfO^7*NBa%401MNYUG5Cq?EXD<^oSjL)5a7 zww=e}xS{d$BN-YS&m1kRoh@wJ$lEALUuQv*jR1jed%j#tmWXhv0lkHg>TtdXG*#IYxlt5 z9UB{LY~a@WqqT{8GgNDrUe_(FWQ@Jr!WCU=jGuf_KY_X)ody8p8L&c=Sugn3lW<9i!F z*f?h69~m4F{%Ye#8$a1Ns3dFrS%fkFV!}Hlh3)g3$YJ3T8^0UNKScf%{w1WJqauF` z>Fu~kg}k%x<8s2rNhzm<|Jpb$Qo;#smNN!CvMdrpSVmY@NP}{DlsDYH1XNMUO2W#* zD*4ju_SN#Jo=3a9b0knBkD7U0oJaFKYDuY=NBul%i=UlGojmG_Gi=(s*g&o>luq%S zJkHIdVIJp6ar>@O9_QzAfs`i3vavB>sixvJn>cQpksBLU(ZcXc@@Q#zt2|m8&MH`{ zjgoDJmkOz0mdE9Jw9n&;Jg(M?|LgG#h0}~z=5bZtITPt%{ID+S*W}SrmappApi>^# z=W$magYvi`kIs4Au3TE)n8&T+UGnIf$4%lrOm4S4x{Kc|bl+uTsax{sDW#XtZ6E5r zmF$y8U&TY^HYtp%pGbe<0O1`%+T5APKye-gB=D6y?s$W2(rL!fC>%gwusHgzhzJ&Z4vOcv{MA;T+*y*GAjR zvw1w1MeKg2xRL7O z>N2;K@Z~&~i@YLSpU0~rujR2qWMv+2iL4U7p2r&^tMhnMWKAAx^Web%_kBE4;^D!% zJOX*=_>KFNw`IfqzI!R)ojf+=u`!Q#^LS5Lp9tRd-C|4QxGrs$j=vf z?9MxfZCB|ii_fcYJoM5{map^Jm&Z5C-Ak@D%6BV0YWB}%<84l&~YaT6@qUBQjmdD{dwk*NcB{-7D z?|B?sjDHs6k39b5+7<9|0e|Ijl%uqO*#-Pf18$oI3@+fGJdX3!tbk4hoXF!O=iUOE z7jP<%fAcu2fT{)j+QW02lP8aU3nM`H367HcQKL z1;@U80Tl{3-OE$4fMNXjo3OHw$tnfxF7F|!RzURv8WwO~0W}J!SwNiv>K0I|fE5di zY8P;J0rO`TjqhJXSFDjsx`(G;0rd+wr+{+{;KP0m3eLCjzvCpVGYA%B^K#))ZX*U$ zK+^&)7XJ)wxjyV#y)1#Fn>JQ#dY!RZ}-_KiA8ivn5}aJ7oJ zDmc#%Us^!B0$LYvi40hEn*!Rh>83m1oTmZ3(bZ)Iv@hU_0v5AzgwOW%Tv@T6rMGTC~sUpuc1?Qz>@{R>uTL9OHqK998F5rd&ZY`j90i9L09Y6J1z>SKh zO92P;Rl2SsY@cogbZ3w}8|C-^3+Pe6Ed}(Hajyba_bcjj%&Bxp|DqkeJT&W5K;HuH zmS@I)TLA-D(UBs$y}f{b1#BrP>CcdK2E?%MDB#Wl2AX;Y6>yh0U)x~^HCyNzwa&Bl zMA61YMMDZ0TEGJZJjkvu;NAj8DvbNIcEbx8Q9$NI5i8xS#=pM+w$d&(X-Ua_d}h0( zWK;nU6)>TIi3N;SgpB-=0v=W;GQu$hjFmTXwiR<9Enu81#~b^0w-!w*;IRUx6fjjS z^LPQr`g#r@D|$l7$wD@T?_|-Fih+Z3dI8f4&PTbQDma%Qm^)%{(ToCC@h*VuXAy5L zq9wa{P62ZZh!qeoVBY_u>N}vOrk=O64^2b`5nsXH6;wb)Q3Mf{Do7E-43HsiWx z+}eyy*5s~l#tqGws{punb?(My%vRViv~ChIs~IC{ zc&r&q)SOdtshT`0c+pT})#J^0Ld5}Va*X!n%~(MvY+z1pJR>}*;d@H(I8L`_JS#Uo z*NiQ>R~%tIpG62G?Ios>W?W+9Qrk?ZSC}_!Y;WV$X1vyn*PHQ1Gk$2skIh)w40`^Z zX1vQhChc!&yxvx9(D^j=y=J`Mj4zt;Wivi##)r-Lv>Bf@<0J8Z+>B2sR#zO1{63@2 z!pBzp^p^;q&&9^+`Bk&|6O`XH{e=iqJ;w1zB^6+r$r)K=z zjJ7t`webs+BvUaHIP*Wlp4pxV@uZB*v!V} zHny-q31lD}wNn%yB7C;Cv5k#wshwXv4K<<5sz-)ecP-8BU}HxcXKUzpvdz5S+eU92 zJKN}LqnnLgY;?ELLq_gOoPUdKtVvwE31@8gWGfl@?NDnE+pKzg23%p5xjk+4vdsx= zFG21Zi0@-#UmIg>9B!kJjs0v4vN703UmN{w9AIOBjfw(ee;fTNT&8v&ZQU^1I?y&V z^dK7t+u$O?#c`mGtFABuLBFM8FvP}C8zXIuvN6oYA+qyO+x(4-siUpoHbzJ$lQtiA zv*3O1(6=IJ)Bu+21N=Dd=Aws9xvHmug*v1K3Sk&e&tf@u4Sg68&ZyvxUr3m)SvDa*J)YJ?s%V zx%$twajOit&BpCE?htMbvzD~Bm^7Z{J;t%QyBRs7t@$?YwJ}dac8_9%i#uiBXJdg4 z&J+g5{Wccbc)-Sk3c~AF=gyyN9o8^%94fBY%Er?+ewO9WkVoEr-^Oz` zo@Z9)M5Zg&7;nE|<3$@UsYl$$(zcgvyrMW^ir9Cw8N1hQydeqi2(Gm8mJp8Yn?l|j zZoMsp<4<+@ zrJ+{)JpK~?w?^=6_AYsB zDx^tp6T!}cT!}WzV{_r#=COs4tp&Htn+0nt;p_sn6K<17y1Cj;^zHN5K?pZ#JQ|RH z=RCURv3nkSh~7=Gdmg*wv8(Xi^5&Nm6qQ06&_nc|d9y5%zNd;5wYQL7f_tf!VMB)A zqL8^y9{c5SNFKxU=$l8sJO<^>60?6E{b>Vt`*|FY2Z!d_nbyI13=r`^LDn9`D(#uM zC{QvXH{taB;5>%paoJF_d=JfISRULpac@HpQ22;E#^iBW9*5>JQtHyk86|vl9xU=S zF*c9G^LQwahdHLwc%~S}<#A*lN9A#J9>?c#f}DH|$F7YvK5uqV$L7u1hd)?5E{_R$ z^U{G`CVg2O>%=@x%Hwo4pKa3A$$6Zb$7y+-LTNf>l=&ALwdJPeG~<3k)s`k&XXP<5 zk4bq<&f|_e?#$!tJkC+W8}c|ekMr`Fq2l>@Tp;9%yxEXkNLS=>Ih~Nl#d%z!swsk0 zdMSJNdydFdQBr(bR-244$$z?vW1DfMkgEi*796Lx*9f0Uhpb(Dt#G!wPRR9w6nmo- z-IT|yJZ{c-=H@Xw!*3BXN054N&4a>kQ}K4eRM%a3+^ymRdCU`Xe;x~k+#@(&@ZLP` z6GBTCWPPL=T>H{KJ}CLA%t!Kgbf)!G-W-k=X_T8eh>I@ zJSO~6nMdJ#9v6kJm_1lruHuS3o|LqdhgFO^vpVGQ9Ir|Wc(#D&^LQbTQ3Z@H;6+ZK zJa`o_qJWo~7V_AvfXxedHILWw_$rUDCHD2a*;wwt%YPMD=J948Z{_iJX3sl$yqm|z zd3>VWLhbK~lgRr*KFH(4jPj9u$f{2{r>2>7%GL0*toCyuUkHAgaekA>x1^?8 z@qHevX;L1mc=@AD@@pPH3gJZiS;$XWmLuht4F644zh|8Bz}y-pe`fUpP{3cJ|D);r zcg928*5+Z+KiUm)6GDM43TRnCn*!D;pjE-F4t!b{{=cl)wt#h2wO#@3)I80NMwoaZ{;aaf<@BETDSfQ?oz<6SvPl66>S** zj!CUO3numLUceqg_AFrU0(uwBHA1ff_M%CAcbtAI&m%wq`xnr^fPD)l@A2tVz<$E} zW|V#fq{)Z12NZBn0SBvUfZ&0GOl|{(3=<^hAR&Vb7?M$j3Q0vBB7C?YcYy5Cp#_Z0 z`p7PiDc~@Acuj6@!CXU)E#Q`d3DLs^k0@YV0Y?^aQ~_rea2Dl=PKIOXWGy|%7BIem z;|iEi!0D>x)zwb0jCIIx}cC#g;P6mE@$-E8ULxBSiq!$ zSy^rnadH8d7BEHl*#(?az_|sSr{YCYbiQzkxaT<)B-Lm;EDpS zEa372rWG(fYy0+alU@jUFyx_(_*JT!DR{Nu48dy(<`RYs*Q!Y5Iw98=%+(f)H>!A( z!h^+G1>7vk?2MnOmGn6UlWn+C-&(+J1>CL>x~G8oLhdNwP9cn|yM){=I8SiEPPuyv zxUYal0gDS*P{92KI0d)`EG*yw@?^Rm6!Ng(LmaQMCWap=V38;sf|OzxkT0N6K(T;Q zR>fLAwi7eCX2WnEVU)t$^PPc!9~kfG-R9N)h!^ z0V~z;6f!7OoO*w%Q(m{MfRb2JnEa0sI-Y(#s0zNI^Gde+=t9Lci-(yZ= z@-N^6As;gSIiZC6H(9ObTde&=MIsk+cOTTdT;?3A~q_b6Y;Fo2142w(LuymY0&jWbFYAx%YWBBZn6;75#7UL9S`7uyxV`MY(|Yz28yzm591tsqnP_C@TVRyzvr#Mdj`Ek?`EDsmt= zD|abk*CLh_v9yTYis)X%X+@k~M2{kR7BRSpAw}c--HX_(h`o#0L&ZG>N$(|u!_>Qo zeI$0jqR9!I4*M3-M-;|znriwM(XWU%R_FFFng!+HBKj9`KoJ9q;JDEF2Nun7fX|Gf zxr2&k!Qv|w+Br~i2B{S%>OI(Ozr7tJz9Ymeb@^Tv-CYfKL6^+|#g zia0*=#tA}Bl;u1xlk?;vPRVLd6+&N~QN)==%rD~JBF-veVi7kL@zW@4QW2AjCSTF8 zv(<%*inzFlbBZ`u#q$JtbI!mxzlaM|yikxU8UyB%A}%fB22sc}MaX4>Q;Yw*@F)H9 zBBqHry@)G>Tv^05LRfoM5myVJA;>!=68X$5;#yIz%Q&wuVry01_%CIY*_X~L;^rb| z7ja7wbBegLXpUWTi{>8e4smiIZY`Q?klO@r7v%j0+cGBaV#9ND^!DBI`8+kbN095( zeMKxNqF6*pbN2os9xCGDA{G|SBFIa#2a0&GXqIET@vM_fq&>pPQbcWFZjna6IfcB; zT$;->q{Ufa#!yc=YEBV;5rHDXl_;-hGE7;pQZ)Mq7Rg!Fn8t#kU?f;m40IoD)hR~@ z>ZFK95sOvJ7+`Gka*6O!&dL&YDPdU=j}`HF5l3H1D$zb|4{5kCn3v53_i zAWoAaelFq{5q}e8t6zoi>f?7I=~}!dtNmNZpA3(Tk}~|G;#&HrWODwOiez3UunR3p zXjww5k{R^YCA2A-WV_Rd+&U$+C36WIsL8se|J!%9E15*Gp6Hx148`^(lbp8~r9%lD zmP}0Y=~%)>C3I48W5LY?n*=v0p|cQjb`i3vw6M5&M&F`@Elb#{gsn5mwk2#MoO)9& z+hxTaO4zYvX2DJ+bQQ9*Acu)WKF_Sm?OMWaB^+MD5gecrdX&szc}xjCDWrtHCG^w4 z?IF0AdbDQ=y;P*Sx^AlXE}?e`%uamvDPi9X?^D8l8O|xQznULd!a=gIe+dVaFhHWx z3CK4`2bVCggkji93C7e;>XRg+H zC4TQ}oms-UB`}|`YiEgJqTr+wCR2V1=cq_)xp1?m94y{3Qv3OeOa|u#C0tlCpA&Ef zQOL#OzeLVt?WIDdlrXh~%SyOh9%F`_RzmtFi&34vj=8dgTT8f&LB;$pc(ve+60Q+4 zvxI9)W+!l63D=8~Cb1iYv(=3>Bg1D2xw&L^T(e8KMWeuhm{Y=B;koH%Ty7UzEO;;DQqF7eX5rGE{_58Ex_Mkd%i?csQ%&+t}3R zW>M^no)=Omp(v!3(VY@p;htbQqgRCZB?LmM89gi^5?&MhMXzS+B_t&@N?0u7%Oxxk z@`NBQTw21TY1MFRnUKdycw7k62pRY+S8+uNPnPgh2~Vr|dC2IgLJ( zF!!r$^`dHD5@apIg92YE;nfme6OlZxvlqG%+@PLCqN?5}r;9#VKKgHk2!G4a3-oHxtyM%vA zSS$KE4%#}f9ON883@ru8*}^gR&wNElyp@C2j+q*51W7S7(Lp;0yF1v!!FmqXcd(g* z%^hq&dxl#b9Be32?I~Y3OC23-24 zQ^%Z5IQ_S9u%&|?9qdFi9BeIPc5twbknJ37&n~yawvIUtaBA~?BGVDS)1b_$+K}w* zpsRyj9qi_yn}c20Fc039@d}73l>Op+!|o2aKK9J)?7=?j`kHr%G;B`?y&Uv*u#dXA zmsIcVU|qe{rHi*-x6AsPzhY2}E48t9akV%xlmqFworP^r@Mmree;4lYc9h@!V;SP>) zFgcSm&cV?Rj#2SQ2S-T`%}8GY9_!#t2WL4LpV5zVFhTh74o+}zqGNIzpHqdLBzUsm zDT0^Xk~>Yv>4M}ugJZG4y!fM?6CF&FG;YsFE^=_Oh?fY`Gi;j*VH%`_sSYlac!MBi@~a`jn-n>g#%Q*KTO7=DaF2sI4(2+z&B5(r zNJsEiwPk#=c!wn4nMu1#!E?84=2afA^vN^d!F>)EFz{CA?){gOk(t@do^reOpo51T zlpHt?9#$3U%|ae=u;@R`q}wXy9TbEV1xcqm8s<9YRQNonHeUfdC^KleTsrV+o`b4` z#~nQ3AaoEpSnOblgPMa_X4kVA<`g(;L@p7LE@}wjO0?9$qYjoicr2sPcrx%|mQLe; zxq}s|eOfj=Df}tNe1iBd=Q9qTb?}_3_+poXOW~|#N_oM-i_A{^bEdj6Ao2kiQiC#=%!YNcmdG%X2K^-#Yj% zqkr#U2b~M3?nlZ0NxIT4?#~XMUX}YrHt_3|-yN)W(B3uYi$5H!anQ!aIxhayAhvSR z+QnaD{+kYT%!gQOB@Het*A)5WT(e^#(!xbc7yK^e$kA5%&NscW;f)jJv+r$PlNI>} zocpeIT@xYgqm&YXSU%f;R- zjxaZ4y~UGmm^o4$yFThK*Pwos!{CuO=tkZN^molhl-{5l4|H)5gHy4}Jt~Q`f!`wy zaxs{`N{~x1#Klk-Z%241!Z41Sizfp-6=1lF5iW+8F`|q^U5s?`nTO9kjB+vB#r7U{ z@G!>3VJ@C_@r;YHE)I8bzl((~j&L!~#Y`91x;WCsQ7*1f7z`X~J;L`FE{<_=tc&q3 z&U10Ti{o5Oa52%vBp1iKIKjouovjmHoZVy*>A>(9WS!*Vq82$i@MIU@_y2;Yx;Rb9 z>4Iknvi3|DXJzQ6rIM+oEISTAG$cR0e_h2K|+e>mqo{wB?+|&A~hjpEc>s{RKVxEf|ToibH!5uyYDwuC_ zL66O%LtM}dN?f$asf!98+`RhZs3-VXw#P1MJSwYK&<)U+j~ z!9+dGy2r(QX|(vp%Ef&y7Pz1aD*9rGMV~)FzwyVFE*uvRx_HRN!?eeR?cyD7iDeQ6 zHgj-$n30`enYN_l)!%}e7d74(e6bg|6EV=l^S8@h;GROoG9{<{c79M)unRO$Jy z)<%P@nmj}tK{ z;&m4SCpfH(k8NDdysR7azFzaftN}O>*&` z?4LErn%UI^;aT0R-zHlh(p@e-cJT>k5RbYPs6PHW*m#4zV8qhe&uDg&^|^~Lm`{{g zzEnrP=4U^&jRVwV{ovv|h8aJs(o7b-WNkVRDvVL{(8xy97 zO+EbXVl|t4X!7ufdiRfuwJz4k|9?u|UoQSuPro|U1T!tMJmfsA>!F1xE1XL?s_6VLo#(as)r?PSqun|a1{ z+lhH|4_kQHk`!(d_~pNctwd*jU~%jqYa0*SdS(t%8h=-k&W;^D?BwAL4`+JV*+W+k zr%FOM54(6c*uy~T@~|6WH|rn|-97a1(8n{&Q%?`Od)Qa}dwAGW$le}$d7%HPWiJmC zw#_|PL~=- zaUt-)X~o#43I^>U4}(3EG)_`yhj=*5!&nbP$>!k@4-APzJ&g1)+`|ZI@5w7E?$7;lB$qzf448tBV zXHMl`T4<4*;Nf@=Cx~Ihq#Rv+>SQycnOY|gHqk|c?{BhBW=LdXL|2?9ob%#z*?Eg) zoh6svE;!M{BoC8`i*2rlbA(LwaG8g5J)Gy^d~sgr;UW(gs9$Xdo1nVbGye$e5)YSp z=C9rI*FaP^Ma`Kgw$P-z+`}{vGd*1EVLI77T33!%ZG$c_4pJIfwpX_^}m*(8+9di)V7<9Px0zoM+|u zw~k4_Rkqzm?MZrv6flA;yR zee0Q3b-gmyFXKB8-+Nf45&yx%kIXi5$WI=A_VAB~wH|))@GJAYhczC4WAc~A)oMb6 z(_K?)|DT)}9{$!KQVzB7`B)**X^>@=kt?HB8Li7e8Tr9hi!xf4O$udJUpC%Mc|Jpi zSZ&H!r;K&WXjewtvdMm&yyQ7XLq<`|;iS;X8n(EK$5?xo(W?wjF;ey_gK%%b-et3CWRb(Vuf+B#W4|)` zmeH?_{mU34QT+uE7Cb=q&`Sf#IIxU^%HYn#(yZiYl0HyugUT2zgp^)`tf9h(Wt2nc zSgnJHmNBx7*L}Rvk=SS^wlrxz&h%$P-5zFUX70)Z<{EYJgA!n;=dWd5ud0;t zj5f44l`)Gx@o}1uo6DG8#73viY-7w+g>aw%uOF9h@oL z`Kx$WYE@UWHDz?oE8`x(1H#Eqd)SaL#UG}B z%2=e@v?`^un|2u&aqdVpo3J}2Syd^+FT)Y;3es$^j54Q&T)`O~l+EsCv1WI*jIfNT zj9M9qjE~FU($Dd#%U#q(oTJ~6H1_ni-K`}Gu%%*nH1j8`9xvkw&TAis_*h=X3Pwc* zlPY+!jHftHE7+}qr^|STsj`9%DtNYx=a`x*CW}5_#tUV9S;kjoyjaFdWqeS^hh@Ah zU9Xn$nvhq@I7R#0*HwJGjCaa-L-GvxMGUDWX)D6+A|4^wqk^6l>|Vhh6&zH-!4+_0zh?z|SJ1nHUJ}J7 zdu0|9-$%rL73^CCgOS}qqd zO>L(OULkm;VA>=4VMYblS8ziG*N8q-a!9|ng6lGzeY{aPTd|7IO%==%zv(+SCl$=8 zz^)))!Q2XNmFl|%Zxg&dvzBe|sNl{D?#cwFG70BZaF2-dE4a6U`zlya!Gje%RKfif zEUe%G2_Yx#Nn24namsu+lmCdUS|r#km<~{(f?@^lRq(zzOBF1ot_qwA+zPx3$`yna zL~2qIPf&rMNuY|V@U*|R3St!(S5U7Y5r0EHC1+}0%1O9HbRx?tcuXC9wSvbhc%p*m zD|n%TJo zf>jlKR>9{Ld{e=0QJ>Dp*s&pW-CLU;p7`k*e3K%JPx(&C;3L10OAXv{a|kZnBEZ#9RAl z<6|8kZGCLyqmz$yeYEqjfsgjSSx44WtM&iWmc$M|HkAC1zFAEuD%Hg*J{$XJ^3lb| zrfRi`kIores+~M+vYC&~MQ2-5Qn;0mt$p-UL-K4x8+`2MV_P5FiMYLwoz-dw6?gQp zlZuo;;S|zU^lmbb5_VBB)!5xf4<9|%uar48es>>x_}EiTdimJP$KJxzR=p*mkB@zX z?3-0l7oYt^?3;CPe;@sYAK+tvj{`GZ2a$fZ>GfbA2dl|IAA=++wS>Bch(1)!Q^SV) z7~$hsALD%->YFp>C?BJJj8sEzt5)*MPalW*ILgP-KF0dEx5+xf$2cE{izmI?8Kz6E zBYkrP$A@=lr*^gacC(K0@c=J#xV6sZj!SE)-NyuaiSK-UoZ#a`-)v$}5+uT#5JFnZ zzuUHP2ZMjPqjkEEGko0dW1){TeVpZErjKiVO!P6y$7R0RRq~WKnVH|mxhkIRo7H>(wH_R-|Um8`ex@p#Ru;h4yr_=J=TF<5u5XxXq{kecUGecFCcscW5B)^l_IE#?0M9=J~iMqcAr3 zNAT{G!3)?0U7XS_yz73z$AdmRA7vj8`FNOq^HK2eh>YRb9jD{`A|K5fL7Q=+{XAjO zH!lUa&)>42RZ^`Z6|NwOY+mu<`&j1VF&}}(qUs~0VNGT>ks*?zB|d6CVjp!MiI0Yl z#SF#q=KRGW;LTyHA^*Eo;H5V;E|rQ$X$*3-iJ3~5mb{jyc|Q-dE^d({@~RkK6a1H9 zrH?m#>>gl`0A7>zmXDu({Nm$nAMf~h*T;K4zVz{xkN4?PooGH4@`2!obfA!rISPCW zEZpMTPhS2D|6K43xq{8?Ve0=NUJDJ2je$Twx*StRCGi6+kvBB}B zR0-NM^1hn7vOgvt9@)1VDkWfh@oA8uiEC;`1sSuUy7f9e602Hw}h-a z*hIAzAQzx@fHnaTphbX|0a^u^-DD1u952p&zHXxdy!q!rc%1-k15ow4fk_b@N;;6; z9M;VY<$3`ML#*`!Y!IM*fDQpR4$u@}!vGxvY!skVVBR3G`SgxCB8*)+O`Sfmy;PjyE=J7hupx z^WuOKwhypFfE@$u6yVDt)`26<(RgRtz~mo*ms;e1Xo#7iy9C%(^xXn>-R~KoSAZ)6Toqui0DA`*Oi=-P2iPaTfdLK*uy24q0R{wSX!Z-x zmmceCboG;+9R2+R@cj|ZAl^T~0h0fnE}W_N49<~J=H{ORbZ~%y0n&@LL6i?OE<*zh z3vhaXGXfmKm%jmy3UG9Q5t74cJ|@7S0Y(NG73iK#x<*U;4Nc~~)nNg~1~@#x%}o|5 zM$lYdNrV>Q;t1sE?0>9}vcevba15a9R#Cj>Y#z$xse3^@J3IU|Y^G@UO9aAAOp0<7q&Tg?EM1h_1~aBPVwPMOqS|5nyouCxA<1nye}_p#p=Pl>lXh!5|6e zJ0L$mz`3SXa>j-xMT83YC_pVhtS;2m<%CITuu;cIqed>EOW4iU)>6(*%h2hBM*}Pi z@K}Jy6|qdA%L6Vb#Y0J_+yzQ%!(R#s8V$zdWC3LcZb<2>(v-8^LcS zje$f_gx_b(6#ip?pO|>7ShtFw1N_1SRYl7xehu)O*m70;F2t&u8VHF*#SYPz^f*WMa zY}g^=PhGJQ<%`nkKlG;m@OPb zHdPEAWO63snbA(A+gH&?RXbF%V--79v2zuBiPBZDSJmWaa&}X37r|WxcN6R`*h8>q z6}t=BLvT+)E*xym*~B!pwv|4ijlj<4bbb&bn3Un%los;9NI=Op#wF_Usc7`Rm`B< z`6D3x!Av64)-i)Mvx;l0xUOoBLR^OUN{h&iRq$MMa}~3zxJiDVCC~gc$l^Z#7L5Wo z63nr4WD>tIp!VCUxV?(yRjjDujwd$^dvkW;|HMLqZ-Fd_-`OV6z}!gfS{OE}U6hotf}U zRXA0+Rd~#e+VwF?c?RU?B3vA~l9HdCRN+?TR;R#x$56%{vA@5cZ^)c4Ir{ep99|(RZ_>thpf}aSE8fExDtKxGNIf(Staau&atl}#X$-sYu z!jSkzo%*(l@0hQ+N>;H-z2G-d{E#CZsh^nh)#_*Unlbr{f|mThaS5nmwQB#Y;x8e8 zRIx?~a}=`yb^WbkixB?^A!Th9R%lj@oFD{QOp{wn6=zPg+JsmqL{o@OLbMG{Zs`zW z!w~C+=IaPDw+pdei1kBk5Snb$Ua+aBv78Uz-E)+=pXZQu49&Mv8-*rZJB8R-D(C@z zDb!i5HVv^^h%TWyNs)eg&K!lPg>p6z!JX9>p-G|7G+A4R*e1k`5Z8p*HpF%z4hu0h z#P%U}2(fR7J|T7tu~UfML+lY^=MY^(bPv%ZM7I#{v^1O8-9qe=^?Fw!%-B2v(7ioF z&~gSOGbeq*{Ih3>ULksi*eAqZp~-=aPYT&PG;0$#W;BeMid!}AIoX8Iejx^gI50%t zOiMo@`-kYCQ4SDt#YF3%5C?}C9AXH~)&ZGf2g)sjq+--~qhe@?VId9)P4cG!!_}Ph zF+xTN9vWh#5ZW**#Ax9h%G4@uzzz>_M2Is&oEc(Vh$F>tYKWuQ>kucXcnsY&#yVaj zer$;Gp?T%qll=V%9n<#KaJn zhL{p!Qi#bRX7e|g9N!S4F`Wj4xI8o~KGy=Kk!doU(&%2ktY=!gGBlZ-1A0}6t3#7&zSW^%W{7J; zw2aUy!gUP45buZhAjAzJZVXWi5r?=b#4HI9L)^?Rgt&$KYQhk6Ld=(8b3@!3;?59v zg}5!m?dshff>)nqoWnJUklEnw5c5LZqbidz_=PI3vxG1*8TLHk-WOs)i2Fk<6kAd7 zfzT{l4+>BJxza?uK7 zvOL5JY2j_>lcBjuCh=)eo(b_Rea=7rtRlUXI*J#Ml%L~=Kp|dYlIdo>ENQO@GFo0` zrc!!&J;WQKISF$4SQ+9?F}xMx?a+J&!gwG(U8i`YeV1cuS?`IbbARhYIy}Vc5PvWY zhWI4JcOkwH@o9+9*hekLpDP-_AZHKrr3zJl8RDxDUx)Z6#JBPc1C?=jV0Koe_n2TA z;j2RY5aLIvV|RWJ@l%MOL;MorS9Xej>zIM9t0CH-no2o*_+`$T5PycSBIF|c72qKZ9VZ#U=Bdi;l zjK@zL*N@OHGHcd)kx57C$#;VY?IV*O*=q{vAZGGx6rodu&Jnsq*f_$%RwlP|_BDxl zlgL~|(10Gf+@@->WrVF%wV6!XJi-={`Kj-NYHFXL)2$=O>lUGLbVeP!(#L##eR_KUzv0Q#XXd(DKi zySa7gADQF8s0ar{7!ct=^_M1%kf?(M4~{TU$RNSN98G?XB}il_e+3}?5W(RYJvHOd z2qV>sGWj7o?-NExX5k*g{_-FYVXP2Z%iTLEM?@GG;YbmWig00siy|CNBO@FeVSI$s zBb*W8xCj#>oTz>sAK?V?b5Y=5t=Gb+Rswa7lza zBit3?(g;(St0P<=VQOUN-T9NOX%Q}q;A!=|Tv|A$(<59F;YwK;@ZD~Nt0G(-VTQu# zng}!Le=X%5cz)?-2Av2WemQePgc~E=A@fLKblntTmd5wy2y>)@2cp@Lxs$ntY`T-2 z8{t+BG_Uw>W5Lm)9u~}_eJJItoHhJ zXYD|_-gK_L%Ccv#3I8GTWN<_xFa0z)FgYY|@O-Ko+F3(W4PP>MDZS)s_&UNj5q^>x3}a4A!fzvd zr;zwQ!m0>AFo646KSr2zzDc&J!CWkU)(HNhzWgfqn;?7rdxX`(|A??g$e$7Zj_?mx z0TsEZadlWL+^U($MGDt4KEzQ&i<;5ZvW8YQw62*c%zaUt8rG>{gBse`u-Rbq!zjf9u=&UL7vV+|YCFr8lk)v$Vy74zD^rB&ojO={>|L$?}ssiBLk+N$=yPwzIR#u_%SVGGim%vqI-JDYD=GYbLd%huxGriN{6 z*iJY*vV)NAYyY?N+_8q8MBG`hYt7_R?n?=GtzowscCTTN8oJleqlTU}vsb((m*at* zZwh)UqG&vcCg zMIw_J;gRAYL(~B(?v|V)9QE!=xG}XPi70o?F9tH9SzmgEgFA!v$>uBzec8ZNHk z684urA*ta~Mb70M$6Rho&8+f#rV6=Ckn1DIVw#5d#r8RKJH!#^Prz!JszV&tZTfI)xeL0DVz_J=PfnNso~Zd zZd0qdnkEcjdX)^fi^##^e&Y_|cM9Gmc(>p@LGs)qWWM0NHQXm;f#Cgu3kAu^-xoYo z!^1U{YH(_Jq=rQ@vcS>Njb*bOZr98rl2^xR%*rOS0WNA>xD2^9cr^qJHhv_o=DzSs zs!{6#e+)&=Y7JoxQ4KW>SyDqRne->;W?e*v0gDZqr0q1fh)X#THS8IqSBzyfJjOH< zWBnM9*YHFQFV*m}lrFE~1=+cxh9_(0u<%q3PfI3ydSsj2Gpc>IX5RXJ#J>Vm!}E;i z?X2~b#$Qw|N0U8$rG{5)_>c*whS%ts{??l{yj8>NbPJaNb$q3I$08SQ!nbR9U$r#; z9U<@5@Sb|d8ONpJ1NuaMBg4m>8co)^G1|rWgiAmTpE3E@@M{*yU)1ou@GmpUS39wB{XW#Ht#8sNu&NeiHo`!Jh@wH8EWQf2-klX4e}2P#0RoSR)=QHWQ!E zpEdj?%HM*d{8PhP;Y?60=EMoX7Fny7v6((;zHJ?wb)k*mI)ZHlnTR;h99jCAPTL?x z`xu+W*qpU7HjJ@JjLtDS#%79b9HWU#Cw~H_Vy75~Ww#vdds;UPF;k;UY|aIoJ`BiB z#YXe^?sbb8TgKQqM%Nfy#pa`e9b@biW9t~(#MoAxRIx*h&j(rC#pWonef)p9B|Yr) z7-glu*ym+M?GVc(sx&9*;5WZweTRYSB$-5 z92#R}jNUQ!i7_O`&=~v1=o6z~jQ!QqDIWHV(N{P-m3pavj00lun}oqJ2E^tNH!wD9 z@quDHNI10|EHikO(Sb`q4E|7pJp3_W8luC*JUqrBbodZ+!^S=82(={xU*>Y`M#VTX z#!+-vj4>KkPR7GxvzcM-SdH)DF^-5aE=J3e&+Nc+bJ<9?2E zjI&})j4>m|H8Cc|m>lEM7*i-e#yK%AlzBYjohv__7lSyvN#WnRENItwc z#wF}XYjfYum63-CUK^5mstmp?2CwBWk1;Ja_axH=uVh0Zq};b*?y4A9#~{KYpR?Lp zGhMj**u!Br=Z`)eG9(8#yly;K#2muXD1)b)0gRf`eFsH=lXjKwjQ2yY0^ZnBoLzs&sEoF#=1 zy}^eFBlC$E&%}5(#_|}?b z1(8O+664hvmp55o$#1X4ct0EW*M+GRLTHgG}_?_9Wj_vAL9pjG}>(#M-9cyCz8KZR_ZR#d({}m%w2kQ7+&SCWa6Ppd{ zT7`sFH+i1dTrKJ*OSh_*j42W0fOI)$7#FMseM`+2pjXn>5bIvt8XJ z%(I)U4eDrLM^hb}P%k;_=vc=_Oak2Pcg%6y%uG(nd@0sRx;Czx_}p)Qvm@fSE1jjH zOC5)4o3v>io7GK<=3L&qjxFkDIoq;setN%69b470bsfBUVE!~2ubD=4%zKB(Q>e#PtZnKZ6qi-Gk>KG#J`?Cv8)`4{# zR7ZbFK0wYP=YTpU3^wV4%@3CLfr4BjNgPziVCm(E&{sogc^!w;F}!Xv;V20iA$VvV zA^*gIMrWibybT^LwlRW-362#!T#yousAHV)BL$BVJUXl8G40s8Nnac|nmVD5<25c% z)^S1|C)V*$9S_%W5~HGyxpmxH$0>E3TE|&+Ol1DAn>CaV*Rs*^&!rH4%_4`KU&jS?Tv*3Nbxg103OZKvq5}`JVz@-`Qo$*LQ|q`) z$mN3MoF;@>>q=?4rjD6)TqXSKOz#XK++tl@$92@ACbZ{z(QgvGp^h6fesa#r@YJN) z4DXCGM*%?9w`tt(sN+ug@ODn#k=E0LES@*-s^h*o7O1m#*D+5F_Xy4xyjPGjBFE!Z z9SbF#Gw6Xj9#nXY*T-_)9r5_Xnfpi`i|UB#sMXP2hh2v&_vSUS#X3rw$OXya=7h0F z%bl#JPA=!wQLdws`Hi~#I)XZ?>`s%pI_BJDu!VK-uR3rW5Z6(!qoEN`)QU%*XPV4Q zG)~pUbu39W4zZT1_ED)`rhe_XcI{(zJkDv$B|vbw;0nRYLPLM5j;F=^jNof^JX^ihF`yg=dn!-Kj7da;g|>Udf58R4}274`j9&3&F0ne<+ltKX<&WgTzU@fL4*>iD3J zx3gC7)$xw(d{;2tMsg6j>-bPgi9guQq#(NPW3~E3@KZrX%V%|bp5b2z`I31?$k%mz zBjnpUe#>~itK)m&s|0@#{4uNjsg9pB{1+j=3jVpV$wI#iUtPx^Lb$}Nshi!-pMrl0 z{w?@V9czV{+KnwFXpz8Pf&2=zOwcO9=*KbUakNg*Cc)%oIC~k^NzgXI`HOMEVyv5> zU4qRU*rI{;60D!#fdmgG*dRgs1g9oAEkTC_8}hH#Bp8~YV}gwm^h~gOf=&rGPOx=? zZ4xvk*d)OgWY#vRbAm1jHcias4=J08zPTWabUq&jlRdW;Enl)sTo(c~NxkI+ymEca*rn>IVI9a?$_qh6cdyaR1%aD zlPKKGY0iH<=1C6a`w4;sVS*?@RYZ1#^z@Y(@mhjd^wia)aE)jrSe)R|jDJa{g0)NK zPa?}y`&d?_%;gDIBzQl;2ML}`@RS(dOz?DqXA-=c;I#zLCU`EviwRy*?ehs<5Ykgt zrI5m37V#Acr(x;cDe13^vQo8g$SO7=Lu&k63ErlA#q(~0_r%6l|1uE&Fu~WNf0W>3 zA)h4pEWzi(KmAWnzew<9g0C{KvV)Y9s{1Cvw+X&elT`_RNbtRI$|qY2Q-t`>s%qW9 zFA084@LR^2YvA_;s}uZ@U`>L560A+|r)vL7@VAhEl~PXHN1l|4TMd(M`Sj!~fCgGL z(6V6?a;wJwvLbOhtxW^#G|;wzbsN}34DFcw8|Wl_{RTE5(!hodv==3{IfWgif^s(c zPZe$8&SB#QnnYwRQ&VT*T^iUl)4rJ~sli(|uvG&~8+f#VtsB^;flC{h(!jP2Y}de1 z4IJIT_6_XNz<>r0q*Ar*(Lm1zc4}bf2D&!TjglMYNV1D+cm0q2R0}QXE+UQJy@5R% z*tdZ`4eTl6UJdLmq*vCkw|cjaifo$-Njtt@1N|DqOasR@aIV^R;LT41r!;UXjc;H=1IK6d z6B{@|gO$oZsezL-3)zYSPZQ@P!P6W3d-yn03}-bkG2>)ga?$|a&rfdPY#EjcJSU5U z^BOo`LM{-zSnxu@iv-Efo!%wFdCrf) z4ZJLb6y9LGDx6la_(lUO8+f;Y_ZoQf|FQKY;8#rl|M&CKUP`-ANz!I1LMl>PwGxU@ zijX8rwn{5ek!d!GOE%=3C)=Y8Jq z_j#Z9Idf*YGjk>XNbzq|(x?--`dC%`mE<##FNB|O#&%9r?Z_Q8&%fM^9jZE*=WkTp zwHZG$Nb&DBV<*=E@gIZ?gZe={KW)a(o3Upz{!jo+^6t&}Wix)2=5Ji~MFM3arzNk8 z|CEqU{@#qg4)M8nv;XMJJ|kJl+diAIe=`mbqjngfFe-Q^ANH4eZV02Q_+epG3Zt@k z6;n&+L8qu$EsW}6|IiRDVwBVj`^#x92|LJJ9U0aq8V_~D{v~|9@PTvt29h@nqfr=* z#g7!yoc#(qcyt)YgfTFTL18ovqgfcIhH+XL&BHiW%I$?M!Z<#RR$&~c09s1Os2JV} zhPMf$wK%WTSk*R+c2Xv1TkOk;EK1?zFgl2wA`E&>osNeTJB4vh7~R7-J&ZHLI8#+! z!sr@C=P=GXM3Z+Ix`lDJ^23MIf_vj^lt;RA!{`x4pD_A{(NiY9gy$La4$5Tjuz%Z) zVf2&yd?7vb7YPzIz?cjUV@MdI!?-Gpp%Pvc#>MOrpD+yLLSs8j68gL(jNxHip;U}e z?PXz%6uDIGvLSAln_Q6xEnXSMD5(X-F=32VaY7hZhjC39*Q+>Ac&!FK(4>d!4k?b8 z!VN;kb7L42!?;P|-7MiGVbCrWZZVpZ!?>OE!NzGe?g-<~FfO%lnT5N;xI2t5!uT?b zDPc?v3*+-JJ`UrPFg`W4d>V&3 z^b=%~%PEWO`*tZ%xFd|OxSClw(!$qad=myN9A@F$Fun`p&oKT9V`muOhp{`1U&8po zc>YnNyh|fRKR<=>v#NpxmXcpp{N3pPW@gKtF#gcI<-I;e!g&4;V{aJ$8choKiIe;z zLT~?tvEK+o7Ah?8&_+4UnbJy@e?+JwtZbo*g{l^+S*U5DmWAq;zw*~mEls!uGxKms zYFqvhCx|3)c!Y(z7V4?CfsoGY8}o)18p&axOl)G|C<|RJbhB`@g<~w7Y~d6OO)WID z(Aq*93(aMIoQ0MajJ+h0`o_vT(X_8>k(`Gc9yh)mg$W#xoTd-q{w;u`tlWAPe0soGYFF z7J7*EviRXR^t5oEiqz*u!#)=JO483{DUb&}I$u=-gp_p9gdA+)0t**f7$W&lQyYXa z%)-SMF0pWtP$34zySE`(#;IX z!kt{$E!--d$rf(6aNGa&%$V=^zmmHxOtmo0!W7BJE%ozrkA>+LW|*O26Wl0gyYw(y zn&k5=%&~B4RkVcfSlA@;u7%AafmK+XG0@x=Cy9tSMlEi^weYuvy%rJ{k`_L*@VSMQ z6mk~wB57g9Le_$3V(6fKtze3-6l|e@|9hjQ+vyd>{z}+h*Y->3nM8 zW06m^Q!vgTY?=gQyM-?-{AA&03tvj}YYX34*dhLvFtGa8!grcNyDaRq@V$i}4ymP1 za3G`SAB~*njk^usW8oJIzgqasNPZWgesE{|4-0>)gMS%0BV_G93;$SXY~x59|62IZ zLS-9OZ0wgBY=4~(2`hv_7!)3+VkIG6Rkcyg#^E+HzYR)L=Y zTi9r6<9JmacZj!EiYJJTnr)R9ViK-Q+qlxkC{KoDOfXG0Dcwrj`;a1Ui## z+%C0yc>ZtWP8(BfOqJv=8+RKIf%3udrb!++nQnAuXb$i}k=Zup*m%OmlQ!bAvC77J8yjpqWn;CC7j3*`<7peu*m%yy^ETGlSZm|i zL;TYNy#`Xr92>qMNlPzsu5I*pmM}NKu}IK?yc2StZsxnfuWoVwIVn? zf(DYaSUZ9`X~h5{|2wh-y<@;_B4}&m6n46+!O^`j~d)7A%-%H-tTpq8@@I|V3lXe~pb$YZf)^urDT2)rgd=!4f>$Eg5W!m!yc)r4 z(tk68*F_lf8-@h&a2H!|+M@rBs(nZJw$a=a!Mi2~T5+=?up>xEkcl7?ffGSI0$2Lc z2x1~sqr(6bk|eqK8$YZHhJXrL)#gkXo(Sc6$pba&mm>Huf~^vkBX}=@E#lOCKY|Yo zXOSk`BKRnRFC*9?`Nt7_8o_4~|F*^_CWg;dwLO9_L}*1@HpGnwi?1U1TJoI{d=tU9 z5qzg2YXdc6(AM{I7{vKw1V3>pb8w=ApCj1Kh223d2fsw{YXtv9@UNWw7QtU!SAl0Xv{%aeOuKyOF*u6-7r}lm><+3p2s!@p4q=6mMFw-2gG!EnXkd|B zK&nciy0Ds%@*0MaAMT*GgQFcBBVio}^&K=2Kf*y>2lbo-t8viZh7KC3wuytrfg0aL z6AALkw+@doa{6!TpqYc?9kg=L+{jxvIM#4l9p|8>iJbd>(9j7E+Bj(Ipta-wPSnBd ziS48roIF$WBnKxu80=t(gHs%IaL~m;R|g&C|1<}kL{4=M{B(P|gEJg-mN3XIb9JVC z(%V@g44Ydw2WLCzIoR&t3kM%b=Mx8?I`~+e4!M0M&VBQ9lUq9JplpAss;`7Qgsl47!8b;eH#gYL zoesX|s_x)d2R}I2M)FQ)%G&pntahn}gpS{ORB?2YY1ohmZkK zjS6(~wlo5Jc?tZXcR@` zD2|Tem?(~nqKRye64Ew!zK$krqN#)=&7%Hq?g#H1Q_>=ema09@=+NZ&C|a?PvRzo$ z|E6f0DB4DGMiggCtz8ryqUab!`zTIigi)Lv#VM-d!@Yqa{dC}a5I2QRHJ&>~ahiD0 zwbPB9#m?eqMbU+QH^|ZP1tQQJfn^4@rXK6wNv4>i6eFX!Jc=u#xGIV<%IB3)jEZ9P{~c3?%_g{wmHE}eptHnlqqr`L8>5&Q z#r3M9<_%GdH@vt0DQ|)qubZNn6veHk_GXb=OfB0AJm1Cqj(~UHBqdM;>jph%E{AFtcv0(@ztiqpp^ihIi%fZqj)Zg7bW2%e9uSmLKN$a zLZHuHlf0x!`?ByA;j6;egs%(V5WXo~FXWoWslG9ax1+G4u%mcK&NoHzu4#pt*&Ov> zl?`jWf@Lrmh=_EeLdWRGL;?lImWZMp#d}dCqew-Ojv^C9K8ivVS!sGvi{c{_22HpzGl9=fqxdX}&s9tR zLF$MB`7(+fQG6T4cTs#5#n(}Mb4a^^lR$H)k$+Eep+5sN`swz^D1M5fK@1IJ_&JK* zT$y7)48KJ2YZQM)@plxzMe)1L{}ApG9(2x=+ds{m+#AI{)&3{^NBFNW=nk#+M-hts z?+y)ncfw;=!CS34yDchsbNkP)EgjflydCc3>S2 z^y?da78{8l6GKyx#xWcjLz5VeGCD`c4txVMux%DY^O(Qax01rK!j>_#h~c=He}oE> z9N_V)B|jmC*5Y*1CWf|$#6wr@RdpiGV>ns-v=}bVMpPqLSDSn=jkz=5yN>g z^orrk7&^z$J%)2*I4g!OF`OOqza!LD`rU-gThN67&x!fBQ+V5?N6ddHH27P1hu5o=B$C=#UKayUnUSC-ybbSot>54~znEyp_ z9-SHOgcxp=!bF+##Wx;^Z;s)X7-lGpTVuE_hPz_8JBG8JmhG541@UOE#EMT;X(0-jAUU9nQ5V*c2NwAB@ZMF zU}BHZvKW?g{>0Hajz?p7j59xuqvKc+!{agRis8o?o`~Ve7~YLxa||oh=(ECAF+3H+ z>KOR?7<2m!d(GtYqDI5<1ke9tSgU>o|A6pZ49~~#f;#wC3>#xu7sHD&yd=rX^0|(LluvgHfW@fh3~w#D#K42c+$F?ccLG`Rd00k>2PX~mX_AuBn* zWWpgP=3^+Rio7VoDN!;yWs&!UTVi-W=KpsI6}WvM$v{J@MR32%8L4* z$MBgrtypBc+d1JwzMma33?dUEm8S`KL{$3g2XYk2?;0$l;e<ffXkl$n2!%@@g(tjvvO#WXn{HZ;WGl3rp_*-%= z3;w3PBNRtP++TD4RgnJ)_X|0E945s5b+vNbKO!6!N2NIUQ6TaS1O4}ExkFWp`#UT@ zIdym()#IoUN6k1^SNNyawc`HTOLP9q2C;S=b?7IKy7Jj5j(T!SZw*B1#}9m)yDu zmT`YC;KP>3$NjSo?$;;8(OM>LgeS()R-~Pfw(aBoAM*u~oFw7NahxI&e3+4)>ZszW ziu|;=|7D3z%IE2EoDuieBF4`ooE1lxIL0!DIJ(BsEso)FjELjxIL?XVyf}Kr{ju&I zM^7b{owd&kiyj=_@mRYT0)fH?Z8cm3nwX#=A=pHXQw8yLqR zdFEFR_`zfj=#aQx4UXf2I4+F)pH96<%8YZEG}+L_aa^J>m@#hrc*3P|To%WuI7Y`Y zGVZVKY=v!I&fM}9fVlrK>XjN+%Kc@wPv|NN%@34gRCRx!&^01+AIA-GOwb52s);hWG4Agj%p|7-yF5u5U>G;YaZ4Px#&KI5ljE4CoY0B` zLA+hXJL0%gjD%+n>*9DZj#uM&jmc-i<9J2$ipgYz{3IZUfbV*fzpmk6{x`<) zMjUU(u|AFsauu&p!A}8j|KhszR^0!MgR__4D|lPoe<$w0O}|OB;rVFU*@df#%we5M=+B#Y!b>ULbmRyty~;= z5lRXo#W+eN;_q?p_4A*A;>PdHd=STnar_p??{RF6V_V!`W7o9{eH6#XaeNiW*E~~V zuKI;OSEoLWqi=t|>CY5DS6a@!?V8wM#PMYuJK_h9DZ!D2d-pdyn)9onZA0H`CQ$!7 zx!NiGUid>CyF`8z{v`ZaxLZi8UqpV5BY4%9G3<%s&p7^y;}1=Ya8rNj_&bih$|PKW z_um)y&%OVR;~$yxOIFmOMNV_g66w7OBKsf%Xv#-Znb(6E(b zU9@mdI-{%Jq*dXSg`i#R)E2yJ#Z`g&jrOx@c!4?OmKGev*-#%$)F; z!bU~NgYRmd>f$t`(@ErXA#3>wqs}hQQJl>DSt4Cr|LnS}i*By})t$4IQchrgO|H9( zb6xas(bL5+7ZS#T_oDyO?1#?-aSqjM3dLrns1@;xr-s+#?U134wFsOc%3U%$CA^s-@Z- z7xy00)?63&yLf=(D76JfZN6!mejZd+;Pzn`i(I_mVx5b{E*^35l#A6amPlv0i$`57 zm6K&c4k8U7Q!Qg#>0*V8$6Y*OBu|FT zo2FG!@(-n15|&-O=VFVC_f_?Qglsfuf>v84rxQv(=FZE7C4rU+eCpye7yr8W&&B61 zw!8Sz#ZNB2kp9;~ntbVEhl{V20TzSIkbL9fTNmGP|1vH9;NpAnATz{W#_DGmyIuV4 zVz1o(V&v5M)x~e>CO!Y|VviL55dJCrOBnPh2!MQ_i+>~!Mr6N>Py#g*sFgrP0!a8v zW#xpw&a;WbRIDVVoRTVu1AAZ91ga%aJ@LQmrW%Lv!xLzfK;r~zCr~GWBjlmJ@l!W} zdTJubNrMC$nikmv8#>aoa%=)kRCSb)Q5`KO$0X2Hl4io@LfTTHh0&z*;}d9=K(_?W zPT+(DS|@Nu0%s=BCV{pIbV}fKd25%z$qK%`iYF#;Qb4qG(I-PXMQ%F?I|@$~o+f0| zL7oHbEOS}~#j{lGl0a9}FUrqJpnC$BBrrUIbB+Fm3G_&yX9DLX&?|v~imG=4eG=%G zK>q~#n&#MI(BELBi03CTz=X}>pacd>nQaY8V5s;7MnVP3hnaXTlKf(0K0;)40#_w) zsrY3Hj7;G21g=Qn$^=HqFmMudGvGuP$H?UB1jdT6A#T2!Y5iL6L~TRYC2+kI#wRe5 zRSDdXzywYh{aXZkccamtl)%jiOiti->EDvTtqI&FPPK!1Cch(rI}@0az|;ipG76OQ zJml_#|A{9O215xqMjPDWpPs;s1ZHxg>ZFKY&Y{m)3ICF3ww%mK;9efibY;ZzqWdL$ zIDth8JdnV=1m-It3uUq(;a|2qn82U^g&tzMloK{bZ)|RH0*}c2nFN+3urz^{DlQYQ z5VG~&a|Ib!Yxv7=I@4 zR|0=4^Bjo13WGCnC2#vsfnRt_qEZt7CBW;}{X&vZ5*0~b!VMyWG<$ia8C-)`O`=*7 zCna%m64jHakwo*Pf0AD_iCQ9!lQ>+Yei99msGY>w`ZPhEq<;-^L=ttA{?|q72}yXn zn>$p)q`$Adtec08lK#<$yXuiie}AO&CP^HX#L-Fri+{%?(NqfL!Oq((>0g`hjP%$f zS|o9tT5p^54`dwZmPs5heezaGoRCE8q(1>TGkIgAO%gnb4O(fJMEj(F`N`smYMK{E zr^wsrB(9=W5*?E`HHp)b7?8xkBs#H=eM0;+G;b!Hp2QhRoS8)DB+gBuM-pcx(Its< z6bXarnnX8dBl*80X0R%9WngW0$phXqiQY-{N#eXDdKrCIQNM2z{gUXP#QAbd;iz^8 zR#$Q+jjjeIF*u3Klei*@AxR8PVtCSDyDmuLLgo3QB!($zeB_C8W`p0czc`8YgF}}{ zfpeQ_=O~Ow;?kr)8!r=*j7<7pA0^?R3sdJxC5jmvmGt+B?fpVyl(DgFQG_>~uMxRU zI4%i(GyGav^{!meT?_K{NsL!59j@NL|HdRHGIc3*P2r{_CMEG+5?hkEIf+|1l#N2M zByLUOwxoY)vpR{%N!*^q!XzF};*KQlOyYhD`TxI3+@187-+PjnqB%f5Es3dWotLF- zjyn!BFkO>#hLmT@?JVJJ;T$2`x;KgY#ODfmokigT%H+JHztqf6VnGrQs`eoUqiM#; z>35l*{ZzY;CjI+$i<5XHi6t5r4%t!(nZ{*iwk%KjD+a45d`yNbl6aiEKoUvfhX8T^cA2g&-%yeI?SxVc@Du#tt5_V84 zbcEE2im=^y60S0kNW#-d@v1qQL`p(-Hmy`=lE`WVg9rI?N={x*3P}`IEG7MafaQM8 zT$PoXy?sOPC-FfNjZ-)>g%6Y1n#Au(>`7vqynQ6(8pV)4*64ha#HUGomIPl?=8W2& z#OG>-13kKm|3UaKlK3)-9Z7tZ#Mepu%<0$2-${wzaNrn&^mhq&Ch>g|KP3HUrFgS~ z4vAdN*xZk5`X?c8t5RWi62GYUtME5j`Oce!{?Hy&ErseS{F%gGN&KC}-Xso7`SXyo zXrG$qGZp)j2&GWL-HpqB%3q3klZSf;*ZdBeRFzVwoI;fps;2xk zIk@}}NDWE2Y}QGkX3AgWYo+`h^Kf~idF_;cho8wgB89qAu9xyxV6NWvQ)rMvLuqmx z8>RgFV{Dxx$j|mRN#Upznx}AV3P-2>qs%e#e^17bjjcCLp_zKeuz8E41^w^`^b}4` z;kXo9rf_`9-~CTibFET1A%)f{eanhNLhw zg|o%aQ5fA*I9E;dNTH8nrk|e5)p;rON}+ek{~eQU@l^}@8VvN!i6bZm%{Za3`^l6H8d`Ti$!=ZbhvtP2@|E+ zK0@Y9^`$BQKa4IDj!fb56t19&YPr0#xl!Vyg;xp32$|=xB3Gwyjgjz&8!naCru@&d zbF9awa6<}nQ@B5crb9y$Qkay&%_)E9x-o@`%u>o3a2UG4~JbV*}#3SsWfY5y_)7{OiF|HqKjv%{|5W&ykUt8r(d{XGk;0df?Bv8tVTU-YzDnV1!@m*v zR`{JTI41s(!p|!164L5Nk)L=)rrY3@?3N^G?$;E4Q}K7<9^oHCYW^wm7l&1`aoX=w zN;$IsXi8J^Zwmj3?-z#B{%XmsA`OTiW+atFDhoM1s)-zxK5!*fJ&hV^)J*$_k6LN} z@X;iV!_%lONu4wrh_LpEH0l~&Po#eOe_!TrC`lt>W8slRjUfLCg@N&~a% znktNDoIm^bH&6T5MEoJ3g#tKE*fNdd(`c3Uk6EqLXp{C&y-tv4E}M*}t*TCxq+J^A zRivChADooN$!VOTst!WRyEP7V6hGBSPD`Vc;irq7Av`mU<W;)39qA-O?DE#sv!O z>@@nP{blW(G`gp8uG;OTDu&uaRXx)A_z2OZ$J; z#)Xcx=gY|eH99bjK}@Vhb8s3%lr(=_^t8`~(!45-VUjbe7l~Xf+e?JQg(K3qRD=Os zmc~f&%Y|1M`IRE0(ij~`G+txmaIElB{wJM!bWPg-YsGQu#kFbwRDmbP{(l;i)BXXS{Pwi} zuY#QRcWGiwOXHq2?iOdprie^U`=?thPB-#dA~VvMDZ;O^vzFWJH0Br`{#EXMY5(BJ zF`cV0?&q+!3q7EY&r`qnOX7oR|NQ6CG#*Rip)?kz!9QB!(f?tYEJ|as$RlYiqeNK7fe=dz@ z(pbaUTjBp*@>(hLh`<<_pJ%1RyB6HDcpQ0w=}O~8W$#@s(W-qZjhEASC5>0p{(o-1 zlSZGO6|afEp2n`~Aqw9}<4sA{3pWVg5^fZ}Eu<#(H*xalj}myO4b!=veo3TZrC~F@ zX*g-b)ih^XG>w?yJnr+UHcoGDE<2*j^Q3lsYNkZeT0@vRFYUjVP0df!$fc22#|vo` z(3d5qcnc)7y6Js8~L{f7xfEmP5akboTwc1 zkG0eBh|F_?Pc%S0CHpLm&(qkR#usU{%b=tJSe@WvQ{oc)P20i^l%4Ik@`Z8NW%>HNx()bHa0p(if|eqmBG;&9Ao6iX3$i; znUORX;e|;HBRMXEmg1a346>CXJRyVD8UHZXCWE#jepdVW`yKJb3{J}6RLM`y`2P}k zO2(fjyiXM@;~nIrW5)mMOs=jx&pa*TPv%Y;oSyMdHP4U&?=*6BI?I;kXNhzXb`^HZ z;B1j|gw*Mt!MTR_$e^d;=ZW;nptndLBk!9*zYO}TSfR&J=wx69gEDCKAx`)ZgEJVC z@o%+lEMaH{7i7>TkG6SSn8C0N(phA(xF~~*=_iZ+SzMCA@C@F|V2i9qWN>)~S7dOh zikAuLZDa=5Rrdd};>rw0W$<_gPh>DUgR3%_lfk_ijLBeZ22(Pan!(i>TqDDqGZ-gw zo$y-WJr%y6>&3@sz~T+!6EgUYcY%Zxg*Rm|N#wSMAyyG@$>7!uZp+}GW)*kHimoP$ z+@3*;iCCpkyEB8kGPpZ~N7WW_cbm{Oww1vwDNh&95C%H*GgHBYt20<<{5+k(Gls7bS)0MLM)F(+ z&l~A

|t>*2A^iIlY4pwpJnj5# ziY$;toh**X;;^hgQMpymqLO&!EUIKt)yS)5{e3FXVe2)rsF_7A)gEqiD5pYg70K&n zQ7?-oSsax`eF+;08weX3HJUUQKT^md8#+3RW3o6di3G(vn-ltF3dqz;=tCyVYXo|{E4ksiXH!t;bwqcXSNS@e;Fysvs1 z$j{H>$}C2yM+34LD4juB49;Rm7DKZbA;|^8VZsZAH0M5YQ5F|-{Wp@~B0-~hJ_Tyz zmx+uNUM{>Mi-#54=q#?v;=U~AW-%sZiq9>AaZ5%QE4~(o3AN{FhtJx>vF|z3Kt} zniO6azG3#Y^;vAl;w=ej63Jp?7H?y8LJ;fe#+u!BiWtBFXF!ne-r*L+#{s_KeG7K@Sw%L zS?rf&pOOEQ#lPbJ34=4bkkVBlq#uYJCgcSIB~`@hd#LK6ns{|#Z4Wg>Y6_`YOXP4N z6IDm#2vb{Eq@Jm5;Gv<1Mjje_802BFha){S@o=JtlRO;d;b>`|;Nch#O+6gvp{0jr z9-4bN)ftmGojjcGVSW8jS3VD4 z$KN(R7n*&8Z#W8}&K}P4aJGkYJWw)5;dSxQRgrWPHsaE!UA1n7@1)Nup&lN3dg$w+ zpNI22^zzW#Lmv-`8lh|JgqAl6%@`J{)~kYT-B`(QtG|cyJq++L&;wmjp<~Sud&ku> zNC+Pf9^zrBhw&b6@Nj{L3q4%n;Yts~JY3}AQV*ATxY)xb9)^1u;eicJ;GZfE@%>cM z0vN0(BR#NPKerqso*1a(YrBL-c^K{C8V}<dUuVcVWU{ybF`x^Vn=g@pmBQ(LojUMjuaJPqv9&Yk*n}^9BCV9Bo!z~_e_3$)b zEzt!CM=A)3eP@ujd$_~Ho$`M^ukR}S7D*U0Fp_IMv~RS=YykwIBQ$p6nfV17et;5)I3x&Yx_D$UKG;pDxMB@gd$ za(XDs32UkLzJdvOpt;qg@FJy@wy9L!Y}235>Nrd)V#aKM(sQ|HZ=|4}W<0)x&R+ z{4PA$)}J2!^03dtKa&6LVekJ{2-^MEG#A7`4CPQYhiW-g zfigLpqo3+IfBx6X;qV-4I}`{ z0>dv98790)cySJwhzu8w5Yp<>94-^z)!EPLtQkIXyCR1xa~PGwXw_aPyvkUO$ziPc z)xv9p<4oXjp-*VWM!;dQdl*4Xg^|MGYZGJg~|DMAiIs7Tf9wDdAUpf4p z!#^tS74Fjz&^*`}{J%N;XY^U5RfY0UGmlz%AdkcHsFX+LJgQ4xC6B5i)r8dNMsESq zLk%N8T*S{$9<{~mr$LV>TA>LJZrm(Z{EMXTR z&vMx{Zr$=YTat5xlynzi-+PGkH1hLAdgakuq>r$#u%EC$Bjgv<`TMWP0O3I4AmL!) z5PGN`qS}Rd49jDcY%dbtCcHS0OY#^l&UmiKV}$snd0ZyK*hZS#%SAYcugqgq9;2Bw zNv;=;5nd}CE4(_7Yw{SE$7-#bu`Mn^yoW+AO^ z$>UbTd7V2skK6OOBab`tcsP$mdEAx9-FZyUV@4iRI0rPz@5y7T_%tCqMR|ZT^O%*# z+&u2jW43Bpb+5=A%}*A&-DeCR$YWj}52-jmj|F)=XskG|7$MyTo);REz{6q{AIsyB zJeK6KRK?}ScA1F3TbV}5X}BVf$MbkXU4BwJD~$qcsq+-mo5#~8CvS^9lgFAo*5>hS z9?#|RS{|?G@q8XHop18^R`TymEn{Xj zzUNUOk6n5EDEaTgpYr%wWVi4);V;5pg&gv|2 zurH5)xRw@hbOHb7@n0S_3#e7VemSWu{ZIiFA`l)X9ADj!ty1B@NL7)rs*v((1ymQW zQP2sSo>My9)HW%gw&8U|jwqn6NIfI3UqFKb8mic+fW}51+^adV;Qv<3Tam%t$YTm< zT0pA;PAH(6(QF~oTzG83KR`3E<4kSK0**JFL(p2hy|9h2t*LD%5{$)(1)OB$CmVUk z0!}TUR{^~xIjw+m3g})yClyZ@o+0FU>6r!pthI9iXNhzXb`^FLo-M4@#lL05fX^-9 zJlXaTQqog|@dP3DDWGow!%S^Ik%7Yg!t;d#gftl>GPr;tB0~$fpnwa-gZn4kTiFWv zMG}%*PF`NU2EHxw{Id~yLdN@tRa6NNVk>6Xej7jTP;w+e47_~*%#2W#L# zen$a!7I0SqcNZ{4n$rrHdWfIEn{Oo{4cWDs1-Jzy3Yb;E>;mQ#aBl%m7O=8_`xMm@ zAvNcU+%J4UI8QiVxS)UsMII6^6w>NpkwwDA1w0~>t>-trw18zQE-&CQ5egqIV5fG# z6-M%S0Z$mtv#C|$?-a19fTzS)7w~ie&xpSwTq9g7q|awXo-5#akr#}7oyd#AmkM}U zWP{G7Y4vIWuSxQ{@C_m5Z;GrJZVXI4EdyhPYW1T#ONYEQy7(s{!06K0oz$D;L8F+l2Ev#fWM{lmGEmJ<==>W zEBsElQ}}%WKNPS_%fgQZ{3gQ1;U|%wg}a5n2!9p6#g~6Y_6YwF((2Cw{xUon3hh-B z`-J}p8Ogr|{Ac+7!vD^|E7S!PahT}~lUBKiDn(S4s98jToK0< z(X@zWMsjQs%?%G6woox}*i!s>VJjnVqu{$0adr`Hi)g1}`yx&%;$-m?g^R0%P7z^v zT}3(wI~H-O$Z4jwlgR19GlXXfI~Q@5NEhMytNrIIxP8_#bdDtC14X(Qajuc{D59s~ z=M~Y*@ZLrAF}$xxKVg62`9%y6>ABx;Wl#}=RUA^pNRgq!3xpR6sWwdHBH_hFTw>(I zix?q(sgYbJQcdTCmltt`kzXm|R1IBK#F!$kF5#LI#*%PKlyEqU#RIo8-Y#NX5!V)R zT@lw8v9O4Tix^+T4Mof>Vpb6oiny_e+lrW6#6-EhS$LChl8{5pu({n*#I2H$bF6O{ zzpIG5i?~DlPE#A0Oeta-Bav{b35mATixx)i#M4DQYxJKfVoeci)ziR`7?9_Rc-~~-VAYF7yliY= zB5CHw@QRTHA-!J221(v1;!U&vt~WaCnpe=|EfqHknI(4oogy|B@oo{DiwGC-T@gEr zu!^vYc&~^pMMR2lipUn>6%j2WRzymfi5KA(ktiY=WRicEU@q2n?hdW&5~{_dMJ`;_Z{5uX?RvwGgH3{I%%if7Qs-Oa8I1MhP`bIMdwO;EnhC142Wpg=&{j zr-W7|oKV6M(xh^;66%&vPsRErG!O|UNkj2Q!p6cQg|uo?!cm4FUBWSjH!bM@_4S1_Ymn> z!g(USguPAeGt)zTOXycZ{}RqGVMGa+mN0;M*4}+l2?I+QRKnmAhLmuj2|c?SBV5G##r%Sh{u)i zUnH zJ}F!&TqS%;xLU{zJYB*whOZGBvfAHSo)v#i_bxQHrf|J*gYd1=fot%$OL(V*O(ncr!bw|j@)m3^AzZ@NGPafdrNiP=Gg+ zI3+|&_^X7!aTTfWiX?hltcBJ}XF zNU4N!3GbBNRVe5CRQ!kQzmfk}!hXX;(qU8(q19n!R1&W&tRk!`38iSuO^zBzb|kvA=) znc>aLIM(nMWgI8oQh2oSuGUk;rpYk%!C}UI^qs#sxd}bNF%ji=^=Q7SJqe~fG%Q&};9%XbZktL`NG>Lu7=vT&tWek&t{$&glIlqhn<^OXhgocAu zHCQ;LjG?AS7f6%6V6+#NF}#csWn5gwC8ouoxl2{NqKqrcxJ*u{KeCL=jh};2kpYK z(Bf@nOfF+~8FR|Gy^K4kP{#B!?o{NAc3K&C$?9%dO)>tb8Yk3YTQgLgDP)n(DW7GE zZ2jIc?ki)ik=$?mKVTxHKCKp%@n9Lt%2-~;LndR3%UCG>uyB!(tB}%;06MFJYPeMR~ zVnBuO^sZYxyg$CRX6?0W*QryXtE;=Kt7|T0VnZf2X5tisQoC<6@gw=BOl;1?mdvc% zs=b-^*Fak{v5iFd_Dt;1d?(2+;&++YP4c~t-6Q2MV1IYBPv^2f69+Uun2AH=hlxjs zKM;=+j}g@pTq)sC3?9$K30CSPgEHnzl>AO-;tUnxKWE}>CeCHzd?qer;v#h!(Bvog zv2w|7%vTbb+TNK7gWRPRH;IQR>!y5}@Jo+!Vzd*1Oa$fpb)vZwp-hBjWOJgR6A>}a z#9vGj%Y;R8D--cdB*?E3lbJ|o;&LWZ4BlTy@k=JIP*HPVQj4n$1~~QiYbLHUDEf^| z+$5jDy8ov2-!pMr^FK22C%N+WcP8#I_)jMO%fwyse~GHI-OEHar+qn=pMxZW2xr!H zT=eWt#3~}Oh%?Fbx`!~qnbpCJdaVV9yAFz3se7Fk_giPyJ3ir?o!CNsD{&ifJ5dHwG1x_Z$ce)w-w}5czjtB}$zCV+IkBJoAn^cE zlFJgEe!4x6IFWQB<-`w89ChND6F)lPb;5MwCnt_Oan6bJPMnZ&Lxy_dN#ZG@bR^Nw zIPtR+XW0QHs6=%^yx>Hp6HX^C(q3XO$#G{YgNmEz(xU2J9_`A<*pL%pC;a3AqWB4t zNL~@GSR_#=Vv4Y@ie;R^1X28_ow&@VC~M#sC$2b=%|LboS1I0h;twaTIq@rl*PXcO z#4RUo=+;x`&Tmfqt`${g(f_3KuM__{@s|^SGkC{|e@Ik9X@9Z5>%=`LVCa$GK!)b` zy(!Ba267rGY@i4Yav8{LARl>dVjiMeteD?G0Rs;kc!;8MC4LGTC`3gq0TM+Orl^5O zsTVU)oa7M$B@C2&Ah|eE#*Y~&MZL6vG9=26%B7rv@&+mxsA!-XV=ECKCsrn^NdQSz z#Xwam!sYy`PF{mpQ|n?}+dv%yKf3Uf%kDFE&e@O& zn;B?C(wHbCLlZ>|G$oN7pC6$G|-CtSz>Fgt7*En47M}So}>d& zedy8IKo^$ef`P8o`x@v+@|=Ng2A*eZcPhOM^k7g*-qXlBBcyD-8QVvUIj7g(zzYWE z8JKTifPohcj5aXFz(4~p85m~Z9Rn{Lc*Vf$1_m4UNIuBGs|H>pmqt^EPmv)8-Z1bs zquzYLK=OUdz))r_T%0KTcMZH}V5EUj28Oec?;9AwVk@^|DdiXZz`%zFKGHswD5%I- z10NfhYG9gyapK3oL<5s(Jl?CykI}IF@)4{+l1K-Jfj)6l4b~DNM2KMO2R|VKheV;z2`wbi*SB-Pnz!3vK z7&yw7QMssulC^4|p9~x~aK^yT22L0_Y2cKB(+`yYekw^Q{H%d<%=A1`2GRx$8v6|d47d!q4S1+XD${_MTzMA7r+o$ugbXAY8#WLjv7}TaF`~-% zKE^3ZG31xj<-aV0KlOhNT#>=wz%2v6QMqQ|x`7+yzv}i;-fl9vaMeV=)8>wW+a#j@ zL4!XH{6+G&&Q4nOA8jL*`p>{!1NW$8xBwR%uB%_b+6n3GA3;7t#Pke}2fcP*6&w?%#a@pg96jGJHs0+nhXy(E*E);j+5f`eu zP|bxBE|hekybBdvc+`c*Tqwh0l+uNf|pwzFoi3X3Gc z>Mqov@+7gQ3w2zm>%tQZ)^ee?wp0zGP!iUoE^h0)(7=U;E;M42r(9@E(u8=wzCxP1 z@U$+Wco0|3U1;G#XBWD-(31A;iLG3C)`iwCv|+HF3vEe)i|y7^KJR<(z^INcbRton zyOMWzp$ExxE_Bne&+9VubfK3E16+8~h2Adok?Wew@VFo|&wX9!=R$uM(swc>sL-3! zF=C!${cMLQ16_E@g+Vkv(8ckx3$HNwn%NF<;=i8pvuyt6!fOp@Z5N8l`hOROyYRjX@3`AgTlh!MQ^Y`v0pKVdthkfB$gdmJ7cz_`3_Y<-E`%su(N#KXuwWBpGhNjelJDm%;yB zxJPoAd8rY@;m#WW#X~mDbCP5y<{+vpa*^lON)$yym@Ny=%xyc-oXujqytNOqOA z@;HgSr>;s;jaX&8eZy1JjVBm<#f@5S)OMq*8_&5>$BnwIX$Lpzx$&eMPrK2~jrtU& z^%}X+fV?45jm(YRXyV3GRGMl_X+0JDj2q1vt!-Ml@vJ-RhFl#@!8VLl zLCLWlgY6#>JCb)Ib|!YwvEAHwp7nasjqVitG1$Y6o^JG_B0l@L(VJYAu&+)oQT=s! zUZ6NYM-3#ArhCbam&sMyL2kUtEM9Zt4HB_=-HpNILx}fB%QxM4OWO=}+w;a^{Ei#% zy0OlU^=`b!*zs;maAUX|?=v{UjSqCHk#3A4mrKlP*;|bKBR597F@}7cwj4|Hu{&#S z^AiSF=X8{j#h-3WbYlUPNp5^bGTV*GBwrAxxG~iYwG?C;6)EcHZv4zy<>^|P;l{$8 zj+t)EqM~Bwkk2K~BhDwv3w?3&r6h4<5tU`cuZW9@Vz9)GrQ{x7WtMAwg&Ql$R}ohe zzb1Y|l(cI|*1EIi**5TK{!4Kq@mn`Gxv|-eEpD8V>bSAhjcsoH$k^>}>~Ld`8++Z@ z>BcUK-?{C57b}*|T8pyVjqm0B<@W;W%f5YX?04g^8%Jn=z>R}$93q$XA@%f%5m__y zgBwTPIL4^!746oz+RXlPT$Y{4N8CSAKkmi}IhUn`eKStEaau}S(jh~%^dkAmfG^kX zvu>PoBjHBUjq`3?a3dfCwHp`Rxa5Z6hKsH;-Eg|?YrSM7CzQH|y4~=&v##J?5+99C zqFBz&>F{gbGM6Jn9uXu7>s}Fa!=m%J8|6zlo|26e)@Mjw@{^2GZlv9~?#2x_F3X^i z%W=hxt8%`}`hRKm!gejL(c!N|slI%YFA3*2aolv{mK%S#@uwTVx$!#MQ%d-1ys#J2K$YMy4PnwqkKdFu%QkYFb{0dw}CVx4lv4T{rHz;qV~CV_yUx z@&F{l^N?ioAUjD8Von{KizGMkYDGt0t>+`j??L&__HiuW!NXJvdhnPBrN|3;P?)3$ zQOt^ZP)zgU9y~%`f>@IHsE$<=t))GvNTm$1EU}!nDNj;?DE5^|)OP_@JgDlyS0OA8 zp_&KPJ^00kD?Zflpr!{ayjbbQ6CTv^V5tYoJgDtK9S<6N(8Pnf+J7UGdc-F^sP91o zkNsb4QW5zzq<*S>hIB2ZJmtYq58kHU)Ptunk+&f#x9!P0c z8y>t#E(UMuS|}&OJb1^0xgN~(;9U>i^I(z(pLsBx_8$`8Cyvk_MtU%cTyptE=#nogFrfZui9!w>lM*N)k1@V46&+uR- zm085u#5u$%x}VHva3OJl2Vat?7LXhlG58g6u?I^?)F&IurK5VV&x8FQtfaoqgY_P) zB417Xnkat0Az4FQt6OFRgHqZZBpW^WmPG6~(Ppy;TePy(gKZvc=P|N)=~30(DccOn zgO~^3kqF=I!S|Z)A=%4R5_Q0XgC2a~#fM%T^5C!s?Y-#W#SssFU`F-5IO@SM4=&3o z>A{a4{N#b*fy;yA9-Q#tq6e2~d6Ia>gHs;J=Lx4hD8%zlUZ?)-!C4Q^(cruX7v!Ac zE0vtG+C(067TJ$QQpZdWoU~E9WXLja5#1hmC`LT+dSH4GX3*z>--D304|otHzyD=~ za-xFvMUAmB4=j>6G2wx_$|o625!2Gt-2Osxzv97F4@!7Z(rb^y*F3o8!EYY?O3Uk# z{7%LV4|WW~O*U*&*0|og_qzwTJ;>ulUN8Re;7~;f{CFWgl8emD7t{UdYus zx7RLqdwD4@PcHIze%w$!AB$bci^5*y_u?Th3V88Zhm424DCmVGuf!*m_3{MDLr}zv zqFxkds@okMJGkVmm={8F%KmR&`_sa@a(5xyK6vq%7uCI};YBGgN_+9R7k_qhh|e-! ztdc+c@}jI4VqDG(_1TD&t%4U78C%JV%5*FCgJgMty#0~Mf96}&i)zyA*h8d!gw&M5 z--{<1TZ`4)D8=xiwik71DNf`kmi4@-CEI7^bO;wdkh zdeM^l(^7c0Lvt^hdGU-FOXvM>HcX;g&_K?wR9UcBqY>$*IHy%^%f8(yrInIA8P zQWyRfi7d>1+lyh+G6ftWN>DH=fBx&ma2lw==Y8@K#F0d?8AT$ClRqN)TKY#d$(26m|i^U z!(%>t?Zr28bW991vBrzFlEjOc7wf!O&*Z0x8@xE+#X&DN%30&ZCW>2$(vq9K*g~$V zCdxK1w(Hm(Bs+<_h~Ig!o8)`q9^zi2q}@ldpC~V?4w3w*V-L$!K=U8uEYtj$H*1CV zPg*(d#R<(%dU1;UehJUWc;&@eFV1;!-U}~dFKBzii;J3H@*>jDYi5L2{KmOdip(RR%gNFX9aLG?9=2ki3g&kL@Whu6gk*m9!U^ zb*f*yxZ;IFo_(mOQ~SCXH@qleqNItNUfh!L*+e!Izj^Vy7ys$Bx4rnwi@&8;$k<3x zZRjeq9Cy6<$BTcprFt|gJK7-|WJzJ}dT~!OWx+CtBFbucLD?=KyNMho9x_qDL{1aA zOyr|YZWDP-$c}1x&8&5^B@5bX{^ctG^&voh6EkE>(ZY_0O%yay)I>2REM%gvi6W-G zr`hAx>|CUpa;7)pI?UoG9--OxO?Ff(ZaDU+iN{PdFwxLNDHEklR54N2L>UuhO;j{d ziAlD@;P1H6~$3zViHBCHW zqLx?|ambn+NiH^GET|UQ)-_Sj#FHlKo9LO{Hjw?nWGZ0F6?;!MF_UMFMkX4Yc-BN~ z6HQD!W#SnV&6#ym6Hl9HMlNrhm48Vk`%VkCFwxRPE7RU)?ZK?)yd61U6NPj$@x12UP4pm_KCH&-UUbsiL?05# zw=YRQVt*4aNb%%Q7Ia91sNYK_UN-TmiHRm&F)@gi;_y`yubCKb;(h5SCI(Xi+r|}mS@~N6Z1`MH1Vy81tz{^>^CMBk}Ni{#KavC_mUDryK48zJ}cYn@P>$Zw5_wI5zvF@6cP93j*lS`p#qS@863_cg9H1h6zX`SWCVn(=m8pI*aomK{gu&nm;u+#e6Q@W{6ICsKHgVR(ITPn8UNUh($6h2+YgDAZ zVxLJx3g9x~HW8PB+Jwi1*F@Mv#DrcUqiF-O$6%{_@q)&01jU>AdIY{o;C6^DmeaJ&GFEO9bKBme* z{6FMF0UsXrp`Z`NX&~MT`A|gj!n7B$D3xMFRj^02O$i@LKA@NKp|lV0`!K?XGCq{` zp_LEM(x99VPm+}Pp#n)oVl`qVVrAmv#45z9KD5p4=p}D~8LUB+BGn{$!iQQu)b^o{ z?|*}y%z4)Jp`Nysv8X6XH`oH1*+Way5K4BbU6MA!+VI3m;lac{sQ! zZ0$oEA70XyZGGtK!*f2g^PxS(4#ZAAbRG`zt3JHuvoAew5nm?` z_GQghi9W=KHz>ZzRQJ!Rp+3Cr!!Sm@Lwt`0@3OZ@Lir7+E=flEFv^FqK78!M2M_p> z!hGn%M^r`=#}GxA2MWP)J{BFZ!O!Q%rwx3G!8F8`?Q%Kb1 zej54bK72tk{eh?%KFnlrmM`nu&)GiA(R{8C^E99DgM7j-t8f?6ehqPvRMv;ZJ}hBP zzwu!y$qFA<`moH0^C?=mp%Pf;D0rlaC4?p;D)Q6zFLy>_5w^4GgU<&)m4FW+AI9;j8f2_E4>L-&vjn3)#C))P zh*MAckn$lxu1+zrNi%rahkvVQJ;zDZRUfX&_!h*7Ab$1Xx*Q!pHu-VGhnqfh^W%9x zZu#(=4^R2g)Q{hNxGkfTpW{CrX7?ipgMTvkmk)oFNRD?%{vrPB!+#`qeYi*B@FN=& zie&}~h;p;1W*u|-k&8+#KXUt#$B%M;l=maAANl+!!KnOxJmj~}`XYW5@Z({B)~s(q zKMMI#m{Iu#{I9;MqZaj}7^8|4AJM5)dzSR$Q9mAIRB1oT_)&^nVpR_>OM3|_r2=E^ zC>E)rAC;&`y((+ZRs5*xM>Xm-wS9FzYLNfKLFNgqt76plXYFKCmu~C%@uVO1{b=Av z6Ds0g9o&X~G@{a2TH}Fl!&U6ljB4daGm>YB&HZTM&wAPwKP~-PyYfCON4dD8wI6N# zXiH0p?c_&0^7h0I#EwMuaztJsb@ro+-(I`YmHKl;^-v%ly8H2h9|I`%@S`V5FQUZu zX2tvX(U(d;t@rn5-NC--$3Tkn{dh^oe(uN1%Hg4aEdA@r4=%g$|yfRAopOR`K#Yx1^h?9v^h*SNTMxq>kK`yDLlg#jArXREXn634> zBy))BWD)Tz;$lCRkSryt9G8=?AWFU~{aB^>YCpav|3)io z{8&rAj<{ay8~oTv?&lNbW5Yb#|Hhls(HwdFnL5Ne#A&D;$>poj|54QC=OF3X`(9IFMeFP zA6vw6P4i#+t|-XTix9}>Cc_)lBj zCAsH^gEf`1WsraSt87(q)hd8z187Z~b^){}X+vyFlvEu8=omnf!A=2m z4&cWCehQ#V09^wZ5x~d*o(rH`0Q~~!FS^X^1<*5qUIBCuphp0*Eq}Qp_RbzMch@_B zK6KSr+{#N0WSugy1&X}%c_DxS0SpdcNB}R=?3Dlp1u!sxmjZZMjy2C&S@0nJM;0Uq zz8b)50lXft|0O{>o+$D)rR=mX+i|=Rz?%UK58(X(-U`?Y7={M$HuIIUQjCWM@D6j4 zRI&@@yV98Q3V@1woKdHYbWTY-Du559-2zw~z=r{R6u^W4J`G?r?LP@%e8ArObW8wa z1NfNPiQ93El>$r2z5J$0KAuuH_7ek`B#omjCkHS^cwWaB0sG$vrUo!{mt$H0vb1AL zF~{fhBP9`^(*u|hz{w)^Dvp@}`%!LI0J8&_Bej#i383X%@_EGhM476U*e@Bokhn-8 zn{i11O9R*#z_$S`3t)KwtECtLtf0-nZ1#$dmE^04QVeOLZ^+jMu#RMnoVms9?QUfM zne_o|(8o&^d&mjLrT{j}kqTh9_?N!`3)o+OY?G@%z+TcLKId`DbbA0h0@xYAF1nq> z?<-|WS(-(fPJZ79uqS}M0qhIlPymNn!TmHo7(lj%9R~vN6w2xkGFN;gfFE=_AElZ6 z4TM}DkC98hQtaaaoCx4z0GFg~wSHEv0s)+6@Js+dll15Oo*FA8?YRKX2XG-^&zG() z;*j-1B4!5Q48R{iAOIr(R{$o{x}{(Nc(s4Ev5dO)m6xGDt&0*2AQV6>04snn^@yMx zCazmkmlerKDk2!CK_c+Kz2eo|r4;pa0GCO`@)wdx{4DNT0KWzBI|r6u1Gvtp8^oL1 z{uYT0hPMOwBY?XB+~er+C-uK%NSSOGKz@G*aEIbQI_$g-P-PK|IWa!qv=MK?Vy2 zv#uRQf+!k9F>O;ah~ngrXr%;+ygGk0h{u8`6-4PEo(iIA5M_cW8$<(bSuTjmQUwOf z6DtH!F^Ed!QfyVtDnV2YqD~NXsaFf4Mi4cFsLo6QUT%&H2+oGz+3@5YGki40Xw|eGtuqXc0uq zAX){{I*2wwJS#2C|F2Q6RD`z;;^oqg)w1$alIOPn-A1^~W^@RmBVBb0LX>c`j@f*3%tKk=@-tl`SN7p3kj zk|<&?_(~9if_Rr%zZ%4ALA)8nTjC^$!9ffO;*I}nuTm)-8pPW{3=86&|G&+9^gNuX zQjH8^lpMhjYKHJZ5FZAyKZpZCd=$j!Aa>JoOb}y(m>I+@20tcFC5{W?6B4QW_#h?( z@hO87gZ8y@auAb(_>77Saq7j{6b9wuD@mr2e@>L(7eV_XH9d$KBr+IEaCQ)Lg7_wg zH9^d!7JtuG;2N?aDia;?if^GeNE$uZLWYZ6t| zwLxqQ;#(@~f>=+ofhYrrWGcT+L2RcYd~*<6G~Y_HjVLc$cW8ZQ5W6)0PO3>i-)m)0 z5PQk@5!EiB2ZJ~iL@JOdvPmWruUQ)vQ$M+u^{44#Cx&NoL zxJ&&W(ZO6YLI6oNVs@f9T$tC9i#&G-c}SG=ydgXiLWvOag^-{6Lm@mILP7EZp{&uq z5Q9ZRC>laxa@Byv$i;tgZ7K8E5>+x}Uy?*G8^WWsc`SrdA(SRBqdim|@2FYR{=d<3 zA(RiHLI@QZRV`#sfK(DEAyf&WGK1=(EIzABlk(_`jod-W5vfiCiFzW0S|N;*Ati*` zA=D9_4(k$|hVXO<^+I?ug!)t@NrMn%lVl+csWc)sCN?43R|gWws2PbE_X^>e5SoY3 zf=YX>w+x|G2+xM>)oZOoXsh)$A$x_eBy2}T#&$KlcL<@Qw&_IDnb?KcHH7DMY&VkU ziQPl!LDG|0kuREihtP+?z9GCo(l3Pmp{#{flC>;rA3$CBiy;goe@QDZhwuvdAg#O_ z!fTqpPBNG{B!on%th4V;DsP1_G=#UwhY{Zo;T;mm>)jCE(|kDliS&&TA&k_0Mr>4f z`Y?o=Xa)3I)rbSd^>RsQF2^MvMz-6BpZlZ zh#TejhU}Fmn;0x5cOmSi@;&il2zx@<8^S&Y zCDlQa{lo(y$Tu1y9%Art2uDKrf&7%54m{tFhH#9EnEgod6Y)6lLZ2&El0h47!^n=YWqqgvP8d17*)e4A3=o(s)bQKjOJmqU~G*r z>W9%FjGA&z$yI<@i&&eru0vjzyj~bjl8B|8Tv8#*g1?YTJK8o9I+em z`7jRhab8mO4CCD}-V37_qk4zYCyc)268l;h{WR|%hAg6fA#A_=8W6^dVS6>Td{R14 z4gvYgL=j&JW02;rhV4&KMHFwZ)74<&kTBjLd6W1SaVYU^qSy}$;~mY_PME_P{3ML` zwLT(@k(!Sp`5=rBNj@TuCXOMFC4Nj4|Kq~;dS)T=8&7cp@l)c&FeYis&qyW{rx2$S zr-ku3$rnWNqyBtqW*BSrnKFw}v%{DZ#@sOGY0H&i%nxHh7+-2-3CTj@B1ulNm?)D5 zYTjTegUg7^!&pIbzZ0$s+jDoTA>_uj9B7#zn2jv%E~>NR$zVi>dNO;10tR#@#UPh2agu4C6)^H^cCS;Sb|# z*nZLv&^Q%FI*ec#AqK;OVZ`J-lKnrWw-Sv4>=jAO}fKq8NyC`Q?rv50$(`$wFF5^!yAy zL=^uIN9^@81tTaFL1BtTMTwvYx!B85D;~ik5j?7u5)qWtT;^oNv$RZw(vHU{mLirW zmWiM&Njai;le{WMP>I1t5mY9r8Nm}Ik4I2NTUM2;0C{y{4Wb&)Ymqk~iqG04b%=E% zs7LZ7u|83yYDg~j(uY+yeky{d5qufJ!U&#@pjia3M=&^oXCi1$bp&k~Y#TvGl6J)Q5p;;ym*drJbM-9HDU!8|R~PM}YXr|}-YtUXHSbQ+gV-~I zUL?IE=o3NT2>M0vLIeXS_7@L4%d%#EA{a>hB`KS{o-UrXLO@EZ%wA#aAmXdU*CJVO zw1+S_ohT)LBZ4={-y#l;;Oz*8k&lXGeWCe|bVVxf5r-4sCypSFB&zwn4xrs=O8LKyU?&yfntrY@dx5j;xVF>N2bw! zB0o+%K|J|D?3oCDj-W*pEu%Oa!MO-Lj6JVy43_xBJ#<)ef3x4 zzYOVegE6vaMh*SHTd;K;GcU_Orz+ z+bB&cZ7x|3}KqGl9NNJXOdsVaZ7E}sC1y?QrSJ8FNR zEic04>Q*m`C!=VZlC))sNaU0Aet&j@?|1qi7PvGqkZ=IEtoGJk6k*z-bo6 zn(Oxbuv}p!VRJ@FP!3-!$&10h#MV)CilTEAZ5R}9ZAsci(VnD();mVCzJ2IIrMuR< zk~|khH?2HRqV6YqMA1|0y-0c!`^anq4@y4<`)ivQNCrglqE-fyyc9+Kc6N&misDr{ zUKUDOcrA+8qj)}s?lBCGVu&357z)SiUiU^6Z)y*6_PrIw&?w%f@?jJoMKO$Aj@>)b zg`}aPc#mW_@qMD`BS=O@F-j{RkciLGQH+UVWfZIEYHSn>NIs5Y9LXod&xzxS6NsNi zF_A>dIf>*m;^Zi%XnkrF(==Bn-4{_z*UF42W|Gg+%50K3QOwoKJd*kPsC}vRg;6Xb z|BASnxP-WrxQr-eTOP#^2}OTYtVQwbe0WW<12*7VN(29e_Bh#@D>*@t7u6+`YA^2CsriYk?= zi1^7Dvrkp|<&WVZ8i-gxTM92ouACQ%;fWY(#ZWYcVlfnFR4L*kG5g?_h@m8dWt%%5 zjp4DFJ*vN3+GDO=Gz6uzGe*5IZIhPhB~x)l2|u}dL*g}Vkxit>&MU_X5Ym%WK?TnBVywinvgt2 zY)X8ZC~2F;@CQJSp&Of26QzY8F=tBdzpV43jDPW0(@d)EJyG7%@zvDCNwI;qw^2U~qa2b7Pnn!weleGlp5@ zvtyVO%i0k|?Ta!$h6OR~jbUF5U&gR7hSf2A9m67N;TV?2u#AUwaSTgHq%i8tl7?Cy z!-^PI#;}UcMUkH}5F%!R-^8#chOIGdi(zdH>tfg(!xp-dSSk7X7&b5{d}9pX#;{2r zTxB4-_>`ZJ?Q*1I_&$a`w2>@!lI+qo{f=a}?lY1^oXAfs_s4J`hLbUzis4`khhjJy z!!c%kIEEu~Qqz?(mh4pSKgRG=498N}_JcfjfEiwE;B}Eh`=~&it`eiu>Ip)Y+#1$QTRhQ&CmBJQ^ShzucGlp9+{1(IS zF+6OcpoQBp{2}8{4FAc1ApiU*XS7@bXe=aeHOJpFGRXRW;y={o0pV^8_hcBiARhud zEc=!$n}zHaGAzKdhjD2c)rJz4g9f>XIf-ftC^vZ?r5AJLv+RuI%~yUZ4-pHRIvL=F$=}1tLG8*YQ6-OlEg=ebF!nfg)$a8#?dK`vKGo&7;RyU zh4L0ESQu{MeOgu|R?>B;EW|<;ic+J-Bvma`vrwJ9hJ{)dYLnL_K0%arsAHk7h58m6 zSg1#bPZFgH_ZvzzS3?VpEc@amQG$|D6FPayLQ@M*TWDtCISbt^JY%7`g=a0aw$Q>t zOAD=NshUN3mgM534Rzsdb$Qw`cgecFg%0E$iJgd@iCu_YiOSpa7P?z_$HKex)5F35 z3olye$pVZ2UKV;Yst>U*u^+KN@dcthT8gp!23i#QSN7 zSa^fVo5Z(>Ly2z_hY^*%YRUIl7s*S4BN+PuaU@anQMw`@QjyJSKCuee-uOh<=2mM;9j-WE)z z<-fGB(8AXizOk^#!dDhnSXgOcF_XySq?j$Su#~}N7M7DpMbwO+yn+;iK?NME#EDG) zTUafRoTcq!w8p|(3mYwbYeD{s{Xd6eLJ!9}3+tug{Q7=_g)P_Zxq?j=He0yxwPTBA zuWOYDaA`LoTX{x{tIX<-9Ts+4IAY-k3%e|QXJMa({T6mx_};=E3wtf}eZux8_Qi&0 zbm*HQ(-i83$N>unEgZ6N*s}i~@tLFcM?h*`SBNO`!TwPT$1I$(aN5F;7JjmD+`QX;@L9MfZY}sN1S}*iq$~t2ge-(* z*tZ~mgD8F^t-D=DRNAnlBUcGWg4x9^SYkjfYnatXA8P$c+QMZES1eo=x0f9Iy4yRm z{UQy^IRxph+qY)O;yw9Ymto(+-xlszxM|^*h2JdvF1@a%F3JDbpX-xx zTTVbYWSZg+3x8VpOFACMA2l2EkA;6_V2>kP9Iab8{*&RTxV<;RVA%q~!aWw!!E+%a zjyAH$nSYddwUs?jwTm0wi(^(CvuV&Rj<@3&7RU2(bdRG)96jTBlTp32 zhyEnJO|=DR~@w;#fp|WgM%d*5r$cONdK}%ZO5v zVVD20#X>o_*)*l$>j^>M7BvX;0`$4b89VM81n*<+=}z9mrw-b}MCacm{orc-Sv z*%8N1t?Y{9JM!H`HTdt1V_zH>d5^ zj#F_Qi{r;Qev(7qJEL1ZJFSq+ZjR$|oQPxjUl~eqc5s}g6AAuIawd-9^Bm&ytc*o6 z435Z<-+7kmf-bGpE|b+XsW^!S(M5C_$~bj6o}ocpM4xWE`nD(s9UOB}1b8>TuwajBb}f!yrCDy<_bS)p zxDkhO3$9zZ8OJR-B3H2O3Vw^@_c)GU#)-?g9mgLsCZ~`mg+Jr?OM(gfnZVz1+=*jk z0;3Z6Cysw*#7Lk+0{_KvSBA2L?f+gJ4w4E9WF&wD@+a^Rm2AWu#Ow*kUzUr#{BkCc zi(+nKo&@qHkS}2`vMsvQAw<@D$P$qP2|S!YY1&Atf+U5Avh1g@){7)il)Mp6R9 zr6)_@Um83AsIw`mH1i$uagWW zN_mFJ5hQ<;ScLarq7O~rZ7QnKM0tn7cZu&MFq}m6_Y)XFu6C9AfP88K(-Qbl+k8Ya zI)O1-8B6kU0^_vuNdn`^ClEg+P9#nuenylWCnqq4Twc^l@bd(|NZ?2UKO`_cff)&G zl!i@UrnX<2z%26FTA7o;T+QbtFrR#ZR=!MNA^9S$d_}T2fh8nYdSso0%Mw_wZB`_( zl6;j`RwwW^`8QfwlfYW?b;R{r-;jWM&$x-o<^;Bos85HsCUAhkZN%-w9Ym@A&IERm ze@EO+{9ecIA=yjZm%x4!^`1h~9%S%P0*B>56tycgvY6v&0>=^vClF!mj|p5Nk=UO| zjuTHLaFXPdjy;{g8SiBRH1(T>sy^xMALsFPn zgjh6*Vmh`s$s^9o5+B(FrQOnjVJg(!aH z`Lr5&^(1PL)Fd_{K9NK%60xjJQYVSJB=v|-66+Hi5E~NJrAJc9Al8J+Q^cl3xz~C+ ziDt>HcO}n|G*6<1R@6P%vq|)zz4&QO(uUZU*e;3oBprwyiJgdI-#LjcqPBwkL!lY}>k zSCSYc$32NjNxaImW0UweiPw^NJ&D0d459c@5^s>aM|_j`7Ewwvl;myVFycGJcaymP z?Z$96)ceE{#F4~NNqj(J-~W@yd;if)K1LdZ(*<&aI*y9u^(o0G#PLZ?AW?szC=c~w z@L3X*llU%)-APPIVrmjAl2}QzX-Ui{`J5=mUyw{sVun^`CNYbAHgOJdE^!`FQptVz z0`f133$?x|iLW$YOtK`2rCM2*#B$Bmih@;1e4E6kBvw|bfvL=bOqP_noiR5yEeypR{7C+jR*sX%9I`6s=_Jl1;iUL8@f`6iQT)r5 z<-Fz>lDMe(r6e-Rr7&V9y~SW}aS`2&8aCHqCgCH$nS?)y0Qs*;1W7I@@k8>a+P>3nRRiz&Y<|eK_Z>=7RhhK-*xP5l0TC6 z7hZoR@fU-C>)1O<{G+*i&3%_VM~Y7YT6d(7K?Ov~F&jyCWyVcHa;A_=$I7i&-W2ks z(ET!cTt@yB9!jBV8r9M$kix?$EKOlq3I$UrBsMAZNTF~FMN(*(LZcLlrcf+}nkhVy zLh%$HNuiYXT!Q4$6iRAE_Go=fb2UPiX0S{OWl72r%coEwg^J`=iIs>_m&z$Tu6dPI z)`tV4SEE>+SR-Z6O^H}5h1yh}B-Tlx9*IQNC6O~%Jw%IAKZORV|4j!qPN7K(?NVqj z-co2v`_?HuokFt|TBOi2g=bP|PQA*stTzR!Qms;WmbwHV+$%|PX_G?Rlsy?DJyvGe zMCp)1R~mOrp%Y1GVi%%VDxc4#(2a@&pC^&D!h5FBD}|3z7@b1z6#As_Mhb7H&^LvC zG#ivc{}f(GVW2b@l>sTds9h;1f-kdFuRP#cMZKEBYmAbh{9dQQ;1q^v%Y}IyZ>2Dl z!BHu^ox(8k5jxd7DZHD)d)i*gJUoT>rM2Y`FLGq9rWVg5rKfSVlJE~`{Gl9cj;>=; z7@NYh6h2Sk;}pg*c9I;d6vn48A%#!%fs?fAfKJr8i&8k3BZlxU*cWTRBDSVg0Zs|Y#7)1V1OdkLDq_CF;`%*YavOk3b zB&tS&hqMPN%nvCXP2p?`=TbP9!jFtPlfqBh<^*#;{(y&*DV$>P^nIH=j-NGGxtveI znSznRg%mEPa7o8zl8B9J2UiO26ikX9ZR6E8(i&ps)4Dtv1ycy6fHbnD5vG1Ch2K($ z2u~rFf|bIrDO^t>&e&uMsT300!~GUWYvnS@FT^V;TqU_iR0rZl3O9AHlk(j6@Ouik zQ}`!^e^dB__J0%qB#Px<52U)I&xrpR>qy%p|J@YsF{qkCFoU`ZW=|tW8pYBmo<>gU z1&O)R$W4-mm^Ym@^yNzTzN@qRhONC#jIOzm}~?UMY>r zB6+oK#PvMjD6HIFd%qG@eLfQW~G7Q7etwX}q4s;56!_Q8$eiX|znEUK&rP z(I}0^^iZGJkk}yoe^yUPE={O6BR-WzQxegiCXp96&!o|uTuov~9b2XGY#M#j=$A(8 zG}@%mA&rh{w56FCv}0qc>bFm4?Wx;Id+wb^XYww@uEghbY&VkUiQS1kh&|KjMWXJA z`sf3?ytt!(8ZV^r3S$SP@nRY;lS?fIYBS+4>AJtMz+T%kD2-QX_L|nkM#?-SjW^O5 zmBt5*eKU=B(s(zGx6&Az#@pI>n97bX9aK%aMa+$cJfs zMCH>oMyD|*jR_2nC5|J0OjL6bpO8!0#GMDXCb`TxN8b5cZ@qHQxDM}gkq_LM=dV&P^rLmv2 zkT zrE!|cGt)Sueg3RF&si$xi05_e1(J)zOL9QD#@?x8r5NrsJTkUW@jjqS6(rV|h72sK zw81n&X~fd7XckT*qU}{PMs-Qz)RSqX(nydigEaXS;{T)SJHWph|M$=5Zm6WGMP-Ec zptPsaP?|zZh|p3fl@*0hGO`s#JA_Iq*(IY=$c(Q<@Avz>_d4rS|NGphc_JI{QpL{K$?^CP$*f@%>|kDzG;%_67~LCpy2L{K+^QzNLQEP{#+ zysaHMF^kqy)aen_kKnY3?>5!g&l^bIP#7d(j%P%0rX*)k^Z4d`bThK1nnc}9zl-?Iw)1A z2s(>&6w>W3A)%43;@yPwFepOL2rh}>(g=D*Fr`TeCTU z&`%O_UZNQwJ}8u29>GBIU~!?&;0T6Hu@-p@K|xUj&DAdP_Sz9tfSE8^OHDiJ!YY7{NoKJ~!=;MDS_}!DA6D zP}GVD7Dn)R1kXh9Yy^uW{I{1r5y6v^JQdn`T4Zs=|GpgE;6df*!r13UUJ$-0d`b9n z1WQDyzchkZB6u}|WufFXk>x^KdtD@`%#|Tu6~XEV)`Z0jVrgxC1fNOgjR@Y1;H?NY zD7Za>w?(M4If8dW{;tSI;U*!UTA|K+;#(qkKZ32QZDzqWV5D6VkFNGVWy~89_?C7(qIW&Cq^%W9=d% z8%lB_dA1Sfe{t?)tT5J&z!7&ti5Ees_*xa;h@vEl)1#;#^~W!ws3byOCW^A+<%H!! z`AJb!5U&_Y=qSvJ)Tt9iUGdP|(lClMMCk3AQJf`ywy;qszgN#@oTp$jVdE&8h%^m#f*-UskD^5= zX(`ewiq;}+g#3FZGin<}yD09J@4gUMJJJC+;%bo*QA`#YDI7)jM8-rhPK5TaiDGQXuNAp2 zit9rO=h7R*Z;WDm6gP=a5Z)Z>+#*8Fi6WE2VBr6hC~gfkr;1Dy-WJ8}q5O_0ri;@^ zkm^naX9{OUF+0?}D~h|t?+GP5#lA0!ISSq%J+b$AAdHIPSvO>Dp?pR&b4Q zEj`rK{f2_ug>OdjRumh=Hwx+D+am8o@vg{vnc5`2nFSHqBHS9q`y#>Yy-l1Jo>4P> z5XFvA@}bB_QG6UqK8a$NW(n$lF5%b0os@?k>qF;5fSDd6^RM?_+>nbgm_Yz6Q+b|VJ3>K2-7AOBOmgD zNHGdaB$z*)FxD0Eq9_d|ycuo8P!dDM7%Igy|Hn{Hq>Qkvkhui6t;@%7QYfhq!|T2L z5}h1Fc5SGlqLLP0>iL7+4Sz9(7`<8$-PqP770= z9{az0_w{3FAbGH}Iz#--Q1dL2vtwu!O3o4CU5~~wG>KtS43lGMD&hGtTp-dchUTGu z3z3#Fv=V78Y$JTDy6<7z7}_Z~E`|$ZXdlC%7zW4CA%>1IT&5_hbrR_oL+4P^MWm}R z7=zto=n+HD76a%Buxg}kfUVnhrhV;B{~Xr&q}91~i&M(x6fsIQgex)`pH zow#1je0h!Q2FY&}jt^7a6vNFSzeQw%a3Y(Amyh_^PYk!l@N5jv#V}P-kHqk34AWw` zEr#1;xFd#p*m)E+J%-sL%yC8xcZPgs%%9U{v6r6Z_tLv0zdMZOxTf$v1?R;uN96u6 z_5qQ(eB4eg{$MD7NaSJR{21nI_IpghCxr`y3x%}*cnpg|{zMGiwo%CAsTiJ?e6jGE zP=|Bl^WrN*$qQTsVt7fxmxaq>SQ5rAjo}sXSB3vRH?>^B*MzUfup$QD!4K}^uab~H ztQJ{AuR_T>k@YdW5lXn}+Q9x0!!=2aP2!yx-i@Jl0(BDD7{jI*_L$gfVsi}d#c(_Z z!}JHpmKffTVQcKfdb&;4cwh3D7`Dgofr2|?_$tih!x%n_;o}%S2_;{|@M*|Di{W$e zox)v0zH85nc85A&id4=SU&ru`_#WZ@81{17Q>+!evjdg7>Zn}*`_i4DZ<6>a14LN5a)yz!;u*Njv*RDEQWvB zV@r&qF+@b@41+xWJ;5P2l_MqG%p_w-@oCQ(auTM6nXp!woN9Sx%7g{k{MVWlgB^pT z*wWB3HwG`X&*VIgg~1XNFj3RQsV2&(5z7gwQ&xnQ%Zr?3qJoKvVQdu>l}x_|P8L=c zo+6}>9@0Wp6V*cf>LN8v@F(evs%4_KiP2$f9gzXTx+dzGIL*ZAChD8$Xrhye1|}Ms zXkntIi8D-`X`-3(I?Ke_CYqRNYNC-ObeQ((!#O6-4g4|D*!;ii67-EaR0#YeZ*HPZ zUH|e+D-*3vv^CL=5~V%g#05&rSZXpY5Aq95zmvB&(Lrke$^*5|Cc2ooSW#VtJxug8 z(al76B@7%O_EPLcLI(dmE-`VbiQXpqNWbrY{HIPo=`*j(MEZvwUT$Kbi9sd?o46{h z+aV@~g?y+9o;dKhLXzRaD}}-1e^-l-5V9Iaii`>s#wfdMOpG;gt%>VQEH?3siR(>_ zGjW%RyG`6+;zkpbO-wN{UI}kDaf^wY#Dm=?El)5p(ZnRve}|f{U{jKsVw9O;jO4rC zCZ?L0ZeoUsX(nznal45-*dk?0cs-f=0d7S}@bd4SCT5zLWn#9n;F;9FV>b9$3f1mm z6`6R%#G@weGcm`+gC-s_aleTNOw2Vg?>{xnF~|pFxF6#k=Z@N()4hjH%r{Rwfz0QH z_>qvuOe`?*go!6jEHv@BiA8dN%A9I$9OXaY!T*Xf$m1y!PlvI=OUl%F*2HrrHkf#u zt!&~26R(?CVd6y-FPT_s;uR%%S-8YR@P-awnfdVe@mEbOGqK#nYbF@vOJ2cex~FvX z-R3VuW95vMY;F_lO}t@ZwTU$*)|yzSQt<5-Rn0VL3Mi@2E3BMZgr7>P_UQp)~6Q6QsFtOXjXC^*3vD3sZ z(|>&H=}vwH9%ycK|DlA{9@M~>CcZN9wTW*`{Mp+md#nHE5x=Fw4+U`hlswOvSkKsJ z;#+pkIG&ATzbeo(Q7Ur4#CImXH}QjlKbrVSt_?cn24H)sl)$DIWto1Zzc|j z{BGipu+K0_(8`<#4x9K(smPC*_}j!k8p20SL?r)rj57&2N3m%lZ=zr#ZX#hKDf?*? z8IhEd2llfja-k7Qm<6#YHJY+bSmOU$c1*Zoaw;D)aoj|$IBLiJ_1cJ|LL3$2D2W4- zl!>31C(9~WPDsu2A}7TWyiZpte&W>iWXS_JD#vk(f>nf7h1G=Bg|t&6j+)}93WGb{ zb>iUnoEh6Fj=G^{J(1Jm{t|O~9Q8#S2pbA1KO>Ga#m@>QXN#~Z&WYn(@;DmDF*=Sh z%p#7aaap0rPalUe=9eVXI2Be*$+Q-o$ zjtj+SYAInXT?%wM$I(Te^o*lx9NpsR{vU%ubIL5|tR~&c8acvye#c^vKQ{%Wkj&X5Jh+|?LH-s78s8lQw6ONbJ zo8q`x!dt>9x;IJsljE2YdJ_0d98}**Jbcpvb7{?=VJQ~M+%6(28_e+yW9*ARZ9P<^VP3p78<|+7K91lsK@`q(J$dn3? z#jzlcC*yc3j)ieN9>=0Mo=_VFM*fSm`LyhiEDm)7h36QIV?!KoOW_6OyCRMk<9I2K zm&4qbh|t@mq2v{jSB1;sSRTq>i{o{1Dl?0f;;Z6VEwUz#H^SJpBI}gndSQ^{%{bnQ zpST0UcPDA&ojCGw6ykU{j*W3_ieqyezbN^8acqg>C-L{=*ebFoj%{&lkK>CtcE|An zrw++?3O^Kn9>+%_wEwZlC&EvKpM|wlP5&|9CE?QQ{_c^-mvMX*$JcR~9ewwBd=u)E z$IBag6@(Q-ok}7n zCs0`==sbJM8&wpnDy)`3brI%OLnL?%p7W-300-a5#a#5;!e^(-XKXf&K~9 zPoO~p?Ly6l3A9e2O#){maApE$N!~1sJzJzv0_TXFD?CrwSV$k5B+xYE-03wBc?*%2 z!d5~S=ln3Xt;hw56X&+HL!U29puOZB66hXkc1)m?cxPdkP~J6xZXxGGeLX_nQ>0e{ z7l~XP$}bVQRMuc(0u3{T+71O_QMSa=@i{{)66{Kb^V zumr9UXAu}=S+0`WtOTx3U_=5V6`U#@mB8o(#)w~^z&Md>gkux9R)iL=OPqMN_J#y* zOkh$1lM@)P*qcHfZXRwHza^AR5Sf@bajj-bD8E&N+XL?QX?$7&wBFB6!jn%SAat^^)T;GqN_ zPGEilYZ6$Sz#~fXR02;Y@Mr>$C9ojjzd-kdscJmKFKT*R8;r={i?)p=5>8h$c? zm-zbFU}JFt&m{0l0_4o_m1l~^I9S$*m2uR2>zMDW#e*Z0jP0Y(FA?LAKN$!~A z2bp$D0`DiVRc>rk6pPPCT$ucp?FQ9$B=BJZA4!21**+HeB!N%a>v&SYg`lGGSpuI+ z-hNpLA7kJV{663dHRZu3ey80n1$N-C68JiSZxYy(zyS%_6ZVR1ooDO|CEq5nKTJY} z?-KZ4!5@Ub2oDN>OyH*kepX&QbL6=szgh8X0>342ND55;zXX0y;1B7ro6#S7!sE|y zSRF~=?*wWmQ74Ii5;&SbMrk7nL`715Kjt&uXdypCwAu91ab-F6DTOw zmJda7OWb!)8&M|#S8_V$B~U8gjwMhdd19qFo`4}IQQ`GuoRh@4j7p-hBrTF?l0?%ankVrU zPbc~95uQQw{a*#ooMR-)8w}F;$K{Pyp|#c`ZIU=Yi3^fwn?$=L286K}iu6jNy+{XP zM`5QVIw#RZoHo0QbWNgLC|Oe8=n?XsNicXWAN~m?7bkH^$S)P?okX7``il2U;<7N7 z3HytaFr&-G2PQEniNT@HRY?p9`B0HzNn8<1h9_~Q_}K8hu&a|8A<0PLDB)<~7~%UZ z{JgGB;<_X*O`~@j*C#QKy(NW8Dcq36jY+IXVr3HJlej5~hm)9}#LY?ElEec^%uQl~ z>`W8}ElY!wl9(*X6ydEx%BPAxvQo@yjPO@gmZ-V3z=8&DC|519}+$&WXB8o9(5i`;;|$aNd9OTOZmbi zmL~B^5|1abD2XQ&#m>1zt zs?@*r_G%K#6t!IVn(%cYbKwqWRT8U{h$InBVoefjllU%)@1?LV$!`JS%_P<*Pi$;h z%(pbA-j>1!A#do=6pwe3cvq5*No-1Dv-n3ze4NC4;?&ua#QWk~h1-PNg&zoa2tO1C zR{)sm69vB#ek%MdiO)rL3U>*=5bhR!DGV%pE&h#gk8rPWpYU7Ze&GROkm?8V-;y|# z#6gw%M@fDX{w(}ONDqG%2@?KJp2VL?{2^g*Q;#ijIEkZ@{FU_ot;1AD6#QHG53~5} z|DI!yC1FbL3gg0rFz9T_BvJ~}PFf_BL^hP7HqL0;7@Kj-~6l$kXN4&1EUJAjFKR72d zcOIvwP+w^qr2Iv&VG7H5dL<+|Q{*h+*}_IC|MC>0&XYk}XeQD)g(jh-sR&P1ny1hr zg_bF_N?}3@6H{oNLYou@r7$>!^HaDWg`RXNg|;cQOQA~&T~oMF_0~Rx4kAH&b(E8= z&rT9D-_FW~K6g`8_Y`{kN1t*kGwnqwT%1Dh6#AraNeY*$n3Pk2Muzkdn?L@pNwu|yt2QW%=Tbtzn*!mt#sNMTe8qf;23!j&nENMWRsT%{aokjK^k z;j|FsJ|=~0QW%@UwbG~X-zXL#D8)EV{wm$gDcqRCc)5C0s2?PuCJFJD(A7yPOitlB zDyJ|dg`g)>sPQ-uE0vDqoymBRfgJRs$} z^&@9sCi!sb3)EkJc8tNm1?0{Wn!?j5EKcFE6c(hgD1|3v zpRo%?9uIB)o9am!d`cMPLgi;tcvhN0olrvk7gBgJh1DsnN#UgwUgn5P;Z>Ps?2;6g zhIs`JFH2#03a_Q`dT2b56IX=2h?Z9>qg6sitxaKF3h$<{QK{Ca@P?EFhu=)$trRv$ z`5h_H!rNi5pbmqZQrIlXd!fz1f0kuS3h#%hwx+O63XI(zYJQl)M=AUg%0EuwlTe?= zKMm!drSN$QJ5$(|!WR;LBit?gDupjaf{O`Xiw8GW_N1^kg?%Y}o5By0^HxhRZ|_&| zKnmZ9d@tmS%yjRd_>V#ce@fx!kkjn1;=c(Gh4SB1_#^OK$g=;L!r_qrC2~agcMAWA z91UYx(pUQgBo7 zQYcN~7{|LlJw)UgP4F=yCN$C~&IL-+fOwfS%8CT1-lgS@@@bruMujvgrqMW!CTUbk z<7DZaDXc6!J&jY+sFFri1!=ry8r4ExU8F`D!OxCQO`}#CwI!^ZM!huZgqp1FoA@!V zI>u>|1b6N0hp`RPXqd(sX@7?2c^S7i%;>B%&Xz)>G|me(&k;E{{eK%9Y6iVGz-DPQ zPoss@+6r3=TM1hW+X$KPe31);>`U#^xKO-(8r?&k4rz2uqmzQ2)94z?yNK|aif*BV zrRx#$o+7={xG0odoW>;~r>lL^=$po68T8MfA4wX=(m0+*|1<`qaeEqfNcr+K2Bk4r zd|+7WA!!UvV{&M1SQ=x~{u+8k8pG4LGL%ztRT@_-I3kTvX^a*hDddbXh84@lKEoh6 z56Z8V3WfIY1|-kqj0?NCgIJ(TZGh~ATm)nNf_K3#I%3E zgb%QPiqN-tX}mt#?_Cc|@`!N0Fqljp6=x+-XMy-aA%l;nu}J(0;giCr(s){AFq{6cN|WT8!-g#j z%pzD2UAg2*SSq9gMg}DrG|!+#2FUoUz-dB~G8zBmrL2PGgyl0hDT4|bR8+8X2B&0D zDT9+U__4&`!4qu`iYggY&EV7wYGqJOnl&=0nF0H7^^9K-l7%DuvTr%y|97T#26Zy1 zn?XG(4{20VqrXwJzwu%f-yn|(^^DUqsGmWD3>s!|P6p>nGk6Q~4DmBFI7{SgA&oc6 zoVay$UgrOs{2NQ5Nyh)%OH*Mp;Z0SImWpbhL5B=lWzbr|HeqtMUm6!al;j z!hS;PaE%_2!Q~mO&0t*y10|o5!L1n#%3!d9Lo)uo8C);p3^I#xieevQ@J6;fJAfoN zXD~5Lb&JS^P;-*VWFajuA$^#d!ORS1WiT!D`8JW;g?9+23uk0-r%3R}pV{KHa35=C zk#U!TcMI>KpJ6OV#~g9ycz*^DWH2{_c^Nz?;gcCWl)=LpJeI+NjDL4yeg=s_FoVaH>WK^%h4z_*vAmof%w|tz@U)^93ttyLBYal)96N@{3mLqa z!AlvuoWU|lmIz-FvRq3=c**Y7P{Oh-5BY2KFua<#B7>Eod{qXk#n-6Y2b05kN!}5@ zA$(K#mT*G`Z;J$vhp|oH&0wP>n=;s*!3W}-h3^TsWbnQS{oIt%5Bh4Yp`0`h%`DF&5W$?LzJB7Q1Y$jUxLTPtPLYrS@@O1{?D9G4-YMng_?iF&o z`)vmMLw)KT$iPtt`yqpa87#?TX&ygj@KXjK=I~JtKWFd@+aiZMdD$m}-!kAwJBQ|Q zD1+ZKSeV7*S^PnR8BEV&Mizf&a5#fR2FVQm%HT)_X2$<_p!r>U^IgmXG^a5`pZc?gHM|pEt(k-uH*dpr;^vtB9lQj11keN13uuC%iuD@ zC}faVkjZJh$WgD^W8Y-Mk^DNhj`^f5{^I3}CNIW1>#Y8FP;_p>AmWKkxI zvRTyc?f=iQTo&cUPs!pW=}=fnq(T-IMX1?D$|oyWSx8A0k*Zl#%c6P~l++0I-{5OU zN>VF}+7g~FtRt+KMO_i*wTp2o8f4Khi!-t~GmFc!7??$GZvM0W`f_#_ zD>+#iMx!jw$>LnLkzusU;=(M>%c5}>O|t$P$7*ktMbj*r$$0ZDT8gv?^I|Igi<4@t zvuH!-_18`Y&(HdQ$-E$owjxwxuzeOCvgjj8Muiz~7ip2ZjiuVgjyAy4tE#MvjWX0Wy~g3ZT$Y+e6PYNMnuT5<-j zQE;sATB%(pWE2yQ%i@MCZd5EKw`4J1{H9QHvy`bhA&ZIPlY~>KP}`U+HRemlZp~t9 zpe#?=7OW^9w@c>^wGM;KRK?Y~fwPyM?UkdsLbC3hxun$>M&+J|LVc zoF{xx_>gd9J-;gEXYoiDk19Ln*wQc_%VI&+AC(-`l&}Xb%HoMEwoB*9ES_S}Fy74K z=`0p!@kZAFgZwjW+-AnF{3lBm&t~yl7SB_j#j9B?%i={DTq309m$G;{-M+4W`rNp-u|mSx-HeqY^liG~5AD@itOds$60)mMInn~7N2JESr$n(%I8_^6!}@WD~s<%zQ|%XdzWE+nZ-9*?8)LQ zb%w7sSc0*}F0oh22eR0g#kW!jqW1rXeV zPM8f9=pJ*-he0a~JB#)?bjZQU!sR@f!4xXkh5PtLE& zVE!q|0XdYBJP-y*H>g0YkVC~BD&=spbSR+$v2qTlMflkI83(}neg4TKGafwi-8I6H^dIkd^4Q4Z(i z&@zWsvQJaY;@lk0lX2=d&Y?+|wrLK{#G4CSgz}(VOiRM!e3@#O!-Y9qAf2|Mt29Xa zJObs8IdsaQPY!)^=$u2B94^k`k{r6`&`tGx(SN+^E+aj1=qX{ZF!#V9Ez{`@9InjarW`m0UBxQm z%#iaJ(5u;Syj;xve-0ya7?s0l$;T*1P7a*AcyK#0mUYg}zmViQk?V697fNmrxiN?F zp=1V65|!gEIZVi5Vh)pXn3}`1946-w?Pg42^BD#=3EZpPsvKEl&PBK7aJzzwbGRdi z={Y>4;0*52a=15#``G$}j8V;unK{hLVRjC8<#2Zn_pl+fYS44;1Nqh5YYgMA+D3ek zF-I02$YE{{_lxgpdSZRy6gn@52Pq8G(hWAs!#T{C<|D#KbN(LVv7EnyT9Cs+1|@$| zNc}}3Pe_fyrxbiTjHOG@XovZ1&j0x-6`o^@@Uev2#tS*TsET?ihZU@URp86QCBmgS zypqGKIV@Aq;5i6$scS5k@z>O3d>)=33}n-+%3*a5Tb0)u>HpT$csGZ&IjqZJJ(H-I zZ>Ud>&_3kN9NvO!j{gexAc#k)1*+@5*)KdG{4Uh_UgQVi!5n@RVF8)&=Nx`vE6D#wd4ERwP5e*} zzvu8r4*yfrSIgs15m(60a5#s*ayXL1-#Pq~gDv^d93naYf2kI0OrtC%ti~S!ISnn$xdn&;6|@)mit%%iJ#D`CexI_1$?oTl33 zalZHk!nVS8!V87%g&l;02m876=$uCvN%*o7gY59Ev~H4g&!b1)pE@WHVteIrQ63lP zaY-J1^5`qIOY`V05~u}r-Y=9~mdAUY4IYf`FX4bZE*BXn93&hp93mVVNaUg0)E}f* z=5due_M>@RoyUkgCgw3IkC77IocGUvN98fTsWCc_F-)HK*9$H#V@3XKYFwN5*9#uk z<#Bx;nugh&V%RO93yvyp4^?sJ>vI?B-&*Kph{_TtJ89kQA0{OWxkHzxj@jMnulALTjk;jvH zd_2bB^vJRKl=6C7cn;@(=|3xE>~ncMAMzLScv1YNQ1UXnjb3zmC68D0*e)NI<*_`E z4SBpRwb$}kAvxcqd!1wXR=?)y|H?d8Nlw06WQ}lb9_vKbhp}(y7bI^A-xBf$98VnD zu-%&(??~-k<+U-7O`&g_*&9Q?C6D(*zExzKuuE;@gFJTR{j;IK8lCxwm6OLOoc!}x zS-#Aw@?}2D9nF|$d~V!;b|t$?rd_$H5Y z3plTUJ$dZS!_LFWV_zQM=J9(Tf8?=0j{|x9kjKG1zT<=j<9p`2&)8)cytc4|kGAr$ z|2z)yN?keQw>*Bz` z>f%}9jBiSqFwY^+RUnVr`iWRE4@;ac%~9@hxUsMWR4AY{k7Icp&%-Dn($bjR(fGBF z!QaD`6#TMOA7zY&e_IU&lqsNW0d+Y-xfSPyAo21-MpZ2MHPfJgh6Pj-XY!K^s9eA) z1ym`ZDm4rKbz>gY3aDN{jRKzSXjExo)TDkDgPaGApIX2Kz6e|ZdF=w~C{>F}1{2mR z;IsnxS9wn-`g_^I8*+gRlwN=zp)w>u(!JLCg*78lU8fMx~%QNSl?zkn76^ef;p_MCG5Z`4{A&`O1BExfpZHU*qtzy$@c zpL7zEv@M{W_=TaQy+{Y93MHc^8J)$u2)hcq3A+n>2x+aSNH5_<1u!9ntkp{jxU_)Y z1@tMPuZm-LH~5{Cpih>8(Z7Hn%NdpU;k9AL06Bbl0RsydRKVZ@W)(2IfFT78E%;YE zZ!KV00ap|-PC-hB7cg4<$^xzuxw?RnVeAMIUf`hSDDmAe#uRW(0b>=sPIzq?MYZe2 zgCsW;aAN`E3%H35Cpi^v7MUQtrGP+_@`(k|ILYKtbIN~Wr%E_Ycv}It7jQ=b(+ij( z$;<-o3{%kvyM17a#_uZN?gAbSWA7>8!I0luz2nLU69peT1qX+DtTxpDp8?$-+vx>2_fL985m7Spgc5=rsI1nBkX6&nJRI6nC z6EP@xy?_<0_9AXBVr2oV3NQ&kFdwfK4@xDI1OT%6i=K z<8RP%0dEz+*K#*-aEZKKz&j%E3O5(9QDl>lniZxS#P<~3Qb0Kcw<@@;fbAk52tN|; z5Pn$je_u%DkAone0u}jGNSlM28&&zsfC8>7F_s@cZm%sg_K55iZZ`b6;@blD7jU3}?+W-{ZShCJpFDpk;CB)7gB(yH|4HQM z0)7c4zl!`;z@bpmQT>fe2GjnJ3niP%7>NRsoIi`GSHxEw*9D{t$fy+FNF!Uo^(DsLqm2qhf6~qskT0MhXNv5N z1sFxYM3y8rJE4dx^n|5C>Kqf{Z7K2+r9#oa!^L131jFNMx$a8oGmL! za&pnXu1pqk4=)f$*YnK?Eis-CZ%Daf1QDSs2qDK*fix^Tw&mwviaaj@li?~P%y@eMGFA-iU zqy=`ZKH_~tNk0+JCyX6X#Gp`qc@YD}S#ONu!9GJAT152{<4Q#hE8+@~;bAI%;O?rB zUoA3%{Xrd@V`o$mqv}TaT{Bzym2c_w9S|*PpULG=IVaXhadY-K742xw-<4T zqNW%9MSq6yPT@@9tRlu$HuzUi7MwSd?k-|s5sz~|++y5Q#J%b&_Z2Zm%J&yBSL6X9 z|4hn}I8U6N{6Tf~hl+SulKH|%gpUdz6D|-kE&bsiPC08Cd<(3I4%}%J@g&=wn}6Zc zLIxKX@l42{6?snhd=bZ28&r6yh?k34LAQ%oQpD0Cj#V^XVHYhieqC?$7-8f$7_S!n z$12#{m&t+U!qQ^eXLRu}O`CBtH!@a|-Zv95?8su=4zV0kl( zlRsO8|NrIMQOJNnP7O_Qy6}z#BP2!t{?+LjfVbuGf&Q_6a!tEN% zjNK8&ekk&h@MGa8LU!HHi`ZGjMhlxP>?-05wz!4q7It&YF0=6tTDHuUyx#5o;PRyiu}yATDoV>@VU#5kD32a}nPa(Xoe-@FJ11#F% zB90aj2})7Kkx>4($UmG<)F-JKl_XI_EYvYY;zDlVlOm}w$RwE}vPI-1VK84ru+J}q zl4227$eEE_gjYmm3#V8pmAstgFA&GXj|&Y+N`#Dpg)$*8Yn|}6yyc%?oMfSbqAChc zwopmr-xAT8Dw5O?RuxtgRu|Gfm1~ClR1392UfV()@w&o#!oYHU3k@t>VPUw1h8E7C zR~9aypB)W$wlgho!aqy;XA2uyILE@d;?0ET2^$NWSZHdUn56@MnoHh7*wR8P#RgMf zYYE#3xm2~aFm!)Oo2^D}h0)IP&x0EOe((K}tG_bhgkXlynsdc1k@g z^tI5>LQf05B)`b=cTK&;FSc-r$fZJB3pP}Jq{ASO%Pb5EWBXee5c10{3=|JC8Z15} zj2&uWSjcJfN()z67;oVw3;Bxv9`b4n(RO}sAE8o@v@l9!w1qL&i5)V`R;Z6&SEj(jkriED+7Fu}R!fXq7S$LbvFA(9LaFK;4 zEIeu9DGRL9ex|XrlJU`B#?z`~au#Z)POhJ|@SKIE7GAONyoDDmylCMi*=f1X-%0ZC z?VQS9w)}JUw*J46j3t)88Sc#61QwQASZ?7p3p}TwkX@8JpV{S%4IPa^?Mq&_u)^|J z?Uk0l`mD0B+QJ$OYc2mm$GaBRSy*r3Z3RcSFes$j8y4P_KKWaU+F;@6WpqEqrA8D?1l2UJuzpW$wyG z7{}u!-@a*ltRjD6`Mb(bEqtcn=fb@fc8cs0ej#KV?H2ixtANPY!f%9oguzNg&3zWW zm4tl1g#+T>{YU4Zg&!^aY~dFRZyhN4$-;eQqmYaXcip5LYaWDn=xOpYI?{$CdU+GtEH@3+W5tUwD13rP#BIvBrwVMI8} zMjFx3tC$5-gDXy(dXSQsvhYbcBW+>BH2=~>KV78CSm33q=f@#$p zw{emU+k#^OHp=km=#LTCg2yqUO~QPB4A8<{E&&#fix@UaXr#G+iuC1&29L5f_6+yk zc83~2aptix@K=9VQ^7_>8hLOGQ2)bhTw#OBhs$|dGvPbQb#`F~<7yitY)rQ?!^TJ(qio!4;}#pE zZH%#Ty^V1;uCX!J#gqSi;OGeQI;*pB1FO`=cpEp#6FNYD=sedKjt(L- zonT|4jj1-K*_dQwvW+P=Znd!he$}z6pDW`lFBs-mZ|j=IZ8mOKj(6B#+37RCT1LWC zDyrRSVZQ8 zxZF3^@lA1Z4yuB+ak#nhjE!e)d~0LBjpuAUZ{uAX8*RK`<3$@QZLG5Kl8u+yqiig< zvBbtw8?V@SmCba4Z;F-w&M?0|Sy#P|lrZ?3jn~yrm>qp%qp#qAEirbgtE{%M#>N{q z-c(JlwXx2|dfQ)Fc+$!W30jZ|-?FiRW7ftyHnyqTZz}7TiwqI^>BMzxl?rMCL;Bp^cAhd~D+rb|m%r7F7*SLA+GU zB>4=S_ycyP+1k#9I_+1P7ipGp^GL~nz3 zr~c%!#sM4O*+|>S*!bSY4>k_l_{+vYR+^39Y#g%jlZ~Hk{9@x*^%;K{!g%INzfZCz z18cwA_`}BkZ2ZYom3^OSpLqopNX}7t#Kzw?Vm3@0|JXRndbSa@!AhV_zZzKz_@C*c zO$OsO5;l@HQmPZ?#Y$#3V*yzfE-qBd+Q`{B&LQ9+Z=+ztvEg$5w_$PSSHWqJmYu%- zpyp{TCp1s;QX9uKcJ@~B&m8H4Uo>9)aR3J=IjG>EjDxZc$~h?SfMp5Vf}wIXKxtW%^Ljc({`P#Xs7iH8va@f?w*Z>Y$o~`3@d&P~AZd2bVeM@1UlGQysK& z(Aq&Q2emneJ2=Zh9S3zCobI5$GxgX=O zq8n#BXyl-YgQgD7p@M_+95kjRoKb_q?p^LrKAiWOIcV;ng@cyLC@3j&;cUYi?HpX_puK|*3NjUa-c{2#%MnMHc!92ygU&2nO~37^z}&kz z=Z2s z0~}oLV4{Ob4hA|HR_0ID;x}09WpJu6SE^>PYde#Y6l}6 zjC3%{@z)w=M0uCdCt}~M;dj()9E^2vgM%9#Tn>keLV@T!Al4wh>Svb?;VNB5Y728k@!3I{74ta7m0!C%c!4ED`x zO`eVgjl0gldIwt^yzk%*2X8uf$HBV}-jb6W9K6kLuc@0^uoBpr*$+25*yLcdgZCV; zAaw7()y9Gre!f9(C)w&?n}d%WeC%MmgAW|+aPXnba+q*7V~6J~M15{N7MC?Xaqy{w z&!xa|{TW+9`Cb?9z-jXf2fI0TT=aDDrGu|HU%4pj;%g2N2S*)59PDwh*TF9ies!?V z!M6^+ckqME?sss&!FS?8hbQtCDq23s4)5S62R|#8UQx*M5_@#?XFrnP92|1+r-Q=| zes}N(Nps_W>PxH>CSfI0%_k0yIQZMaKhg}6^0q_X}?OB=mxztT$H$g>(9EuK9(MG1K+2NQO-qq7iYU@Qxb8(uB(_Pee!HpB`u#BAK=^l&E8OFEo;!GE3$!#hGrZ|2%kg0Hv zi*sFE;G(UI^ISA`(ZWSb7foC=bM$8Z%sdz zLbfksY2TkNV6<~_p^Hu~I=g5uA36|4sLUih>7za!?&6}Wi*7Eu((BPV>_>m-8(k$~PaEZ8 zw2Lt=u3=?X_2vK0hiu|tR=Li_^)9BkxYflt7dN=L*~Kj`ZgeqT4&0>L=EnZfa=rz6 z!sT^>i-|5KxtL7jWlnVRV1WzzIr&r<(_GAOai@#hT-@&B4j0p1|9%j=I^SI38qG@1 zH}_`}mU^a(SuSR~xXVT97QfY43Qn_+Y4;M$+xNP-&&6{to_8_F#r-ZGaq*~&2juF5 zE*^3**Tp<`uyElH_U#Y5m@l26wmCD?;A1WpxOmdVQ!W;|c-+Mz7f-PNZ1wvptCW>V z{hYx_HaQ z1{dpGtatH-i#J(ghOa}1{Zrcgelsyhvv0e2$HluYHge!=SHQtbIW?Ii7<%uy*uvOS zoLq|cU2J7lcv$3Nn~Uu(26-6l;R6>tT(t9Wp@$D$e8gVi!gcYni%(n}a`C&1PhEWG z;#(K{U3~6hr;D#Ry}Q`u;tLnMIqj?L%#_;_RvEEIT_A zHA$$ziXuPY;ydTb}Ei&o@?-gm$@)UCLyWfp(-tSsOkA@N;P41&!2CDtpaVH z>YL4jwM?a4B^>bn?*MLk|y~J#_KV)k8NL(f4WBKVsxJ z8UNFp=D|1cd&=xZ9xnFKi{s)XV~vc{EP3#5W^WIDJY43Xzm)kTUSALWJpXH%4;}Cw zpk#oD%RLPA{NG#fppf5tBnEbdco^#8Ru5A>4D)b>hwD6C?_s!yD?N;2Di2qAxZ1-A z4x)k@8Kp7H_PVQ^2Y2TzI!ytKMGNwFB(tuFv-JY4^!A!P5mgU5zm;1PD2dV+c!Ni z&BJXT=6JZ@!|fjK@G#56Y!A~t%?d+7I6U4KljR!`&Y43k!7*J#Xdb z%Pj8oK;x_;pY!|A9_D(O@8J;-^E^E0;UNzXhY5qyQFCJ*<16^dANBBhRzy^BOybhqpbv<6(t|l^)i4 zSnpw#ht(d|cv#CZHQw0K!^fM(7(_mY$sn!0;o(gWZ+X~2AI2Db;Vbo~QLBx?pDa+p ztzlHDYrN}WqlfoBZ1u3o!)6cfdDtTTIZcgRQ{OAvJkZxqOTNv+cFz2)BIP@_ub=f* z{MBY(UzwI^pK2d_*yCZZhfh3w>ftjFpL^Kt;Y;>gKK$chmxnJrMArHbw-e`1JaK#_ zg|FF^BKb>77!|0I?DO!g2hT&Phy5N7cu1&vzw_|Dhd(_W_V9y;gC2hM@SBGpJ^bY1 zXAi$fjjqy9ddRZ(;B!{v{W>}1;dc*zuw&4mibMZdlYHv(69*%f8N{2oC z&DQ7je-*!6U%w8i&l-q&h=+hhC}b4YAC?|5+4E>rrPXbak8>@g3=InS4(Tq$?zC@BR>QKnS=K{E!e z(L=s77`Rlv6epFULMbYi`h9@0EG&H^rw$FWM3qZ%N-5TrVtpy9l%i@WE+|FYQdBEN z^-{Db^?O&1Qq(NP8KpS06sMM=Rw?S0;P9;zEXBf7JYI_SrRY$KTS_s3 z3Z>{&ilL<#R*KH0=u(Q_rRYl7H!&O7nLNHvJ+8}w2?%c_C(9v`M>AAuE&3#dEVzepYu7N zvoH7DbMGzNwq@H&Q8TXAmu-i#?I`7N*kMt0>JSUZJu073wr7@YXDQG=t+52cxXv!yu4Q{}*`6og zZe`oOYr_YAB}{C&*;uC+dgI6uWT` zVi4+IQ?}QZ?O+Cp?V3s$1#P~aaR2Me_6CK$sceUq?Xa@FQBDrU)ZciMT`=6WB7SLt zr9^ADmhEk2dso?xEZf_qN#UJkJG^Y~P}`uBnxXOtDTMs)vb|T%d-f1gc~lhYfwFzD zY{!-DGiCcw*^VyTv1R*s*^VjOhs*ZSvVBaY!S?)!2*Vzz_Rs9Fv?+h0Y@aOKr^@ze zc94H!VHFUWS*D-aAwFBS&z0?jvYlAA&zJ2BWjnrXUo5-%h<|GC?ksfD@}#nzT((oB zFqY4Y)p80gcE&iV(em`NeTjX%Z2v3U8D%@OY`-kq4Q2as*}hV?Yn0Ph%XU`Tt`vW* zY-gA4g0fv$wy&4%oU(nZY~PMr^&4e7R}rz|-i-3dS3u7z+jq+L-Ljo8A;0@`X=gJ( z>HcgmOb_$EsB9O@_r0=RQnpLWc3IgjFI$cbv=DyNjoArF_~Ek^QM~V$?J9*`UA7-8 zogc`_WbpryBrH7^_*(Ig%XXc}CuRF-*?v~G>*b_E*yKJh+b<*uogr>4+po&@r?UN- z#>@8Wvi-Jfzbo6#W&2IpZYkTX>`;62PJJv~K`|6t&cheDA?y3H{h@4sEZc2L7#n2R zQ^Go;0t?}nvi-Gex0mf-W&2y%{$93!l; z(ZF6V+koS3VD}Deg@b=!(}B$dHWpYL*hJvc24Os~Ua+f+y{t5|#ORw0Y$~u}HL>uS z;A~)Xfh`8M6xe)V3xV~e5H?q4zteE{;%<)BRe`M**y@3;5xBK$UfHBg{<)3~^S)1D z_YG|Az}5-ueu3RTum=YApuo-h2Lx^ssTo*K>m-yA508k+c@AuWcG=QZ4%g{1G^}&iv!y8{7q4&kF1Xp6N4_6%&Vz@8h}^8!16sp-uGe-q=01qPqZW9{?I+=+&X_vgSIIvd*c3@yH3EWZbWBIO;CT1d!Hw5;wz+N8M{z{44xVGjw zo==c-0Lzod@Wd(S6Ev+>ni|v1)qx!p*lXl_ZD5B6c35Bs%XyuYhlpPv*}Or7m&rE< z_9l6a5Z=u85ZF7!ZxP-qye+V|i*W0M3E=-uS>Qe)Q%E}(asNNCBLjOkYnhh-fqh8C zZ3G2&RK)KSxnKBz@Im3Ba9c*B13N~}hlP&_9~C|(WNV??6Krn@^ITw`R~nuS>{C&` zo@QZ+KNCrwWjEoBpp)S*72Gi=HjEboJ0Y+$0y{IX69YRbu+suNJ+S+%G^2Vrg~@7! zQv!GYda96j8D0w9_5wFKb2DS#a7D!ZpTNGtHW1ha%%k>TUkxljG{!{E3hZlvWyQHx z5!lz2o;iViLu77X--%NAW? zKa|%;f&E;B@-=~7tB5|9WL;oC3GDjF_cQiZaqb>anO9-NF9Q2zU^hfMn*+Ns;$Mku z5`HaYkZ(k`aGa@B7<_ABzmXGdUnM*MG)e**ij$bXTXeYO(u>J`4{&BiKxxXFzS z{O2kb;_-_0L=qL77D)SyH4R_u7au`Mqry$T|Jg%5}BvRo3Ws@Q5GY_Xw* z8glMcv3p0F`&8_{d*~ccu{A5UcE#4I*!6t*bH(i#pWaKovcm6E*jg3KGGX^Tq~c1O zf9`d&4WHD8FV%PLlYRNHiaort>je7|6?x$G9))zLY*oKjBBax$ojVta*IZZXK z*kda8)QUZ=Vw+WXz?)B#+2bmlp{S-E4FLJ9rin`V!KrA*%dq6x`TW?S4Ir^feG_h%sF|# zgLl=tSL~I|O%H|YDYLZPt73ac{9KXqD)#(}+YqL2pNj3vDu|ri$>eNuQHAHy?X?wt zx`+?z+DmD+!pnI+>&J)wc*vX|{B;LG`&ZoAFiw0t7`Bl^L2tLoMoFfZ8CbDbSL~pQ zy@u7=+%)~hJxbZUV0a(-!!BlM3s=S0RrrK5zt+SpS$lnj-?-;9Q#{^gdAE9K#hoy0 z`n{W3hE?p16@FHUU!8XCf&W|OdyDXKNp6$ZSkK*yzpabG*XE9j<+B3|IP6#K$cnwY zV(+QAGo^#7xoTx2yjM+e+{)&B|Vjry7M=JJFmDNKPJ4R%5RE9fO zxpI4$C8H~m$0Q#s40m7YOY&sJK2@>340;eSzJu!Vmu1$rbw|J6ghUKeJkWGl5N4Eo!0*TN&1lA0Tt(+_Jta_GuM6T`hb@ z#d7UI$x9WtT;T%(b+mM3fxJ@Tu|vC@18>F7s@T_DL*>qfon5i7vvD>tJS#Xy>8Jg- zT&cRgFjx4dkk6h_@^;0}W8vh@$$Xuu2LBB)GrwY4$TK~&K=CeAYiEOBRI!UAzNEr8 zWw~CkOvqh0@)aEXEB5`0T~)CMtckUYnUTF*z8=(B*^95Rlzdp>iz)002CWR%RP0)I zC>M+UxMJ6-yM5wXV`WKK*H76ncx;Au6F#e0&exw;__VuQIQ`VcyfNE+S+U%`XQSGn zhOx0?zf!qvs@Q!D_GOc)*v%FDO~r1h*#9cFT;bZAU-027i?7qS-&O4Q6}zosf2!CY z6p$VHM-g`Fs9#rpj`}z!bpC&<*x&h7ZpH4X*gq=vPw8(Lx?xbe?z~+~va@3UuJB1u z`>%X?--`R*yH_tH)CnrKQn9{4(ZCqQ3_OE`;j^S*?Z6-|LS?3Be%u8iPa32Q@&*Ni z&`#QbUKwFlL2|-SpU7iT>?0&4gDQi)q)BHrgX#t~F8m5lHp^}6J%c1)SgCh+Z7&J7fYf#Ui zzM^9q_zx2k@lRuIf4W&Axe~x#8HhvdTRoeYOGHHka||7<4!2VbIfnePJ4( zj@P{^UTAPJ$-Hy6J=fqogAWZpGC1F$kHNzRj~Mi&5rg3dcNkn~(9hsngTV%z!q&cI zE;8Uy#v$cmNiH$C)Zj9M%jKjFKl$5V{0iZKNFF}#aFv_`4X%#lgG8vHYM@91c4DJ_yK=`2WAz^r*t9c8vd6J8o^Y5buj~Prb zm}oH8;BkZJ4PG$V&zdI;7A!S;Z7@$NM^8m1@U+3Wh(BZSY{Z`vIk{lQvupGGkHMYR z+|G-&f_pjeaPI#YOg5N9YX+N|m?^YB-b^Lx5jo~)n!$9H%uB)UG=`52*0G#p*gu9( z4AvWb#bPn|RK4aigU=1_)nf7smH*{#5moupfa^^DHyCUbZ`jzaJQ*F2uzqd8G;CI9 z|Hfd8!B&HB6}un9cLv{cyp6e$mj53N{xVWFZ1Z(?qUhzYF_F~mbB zPd4(Vbd=^~3@P!nFcU*oBqyZJe9ZNC##@ktX()8N;D592Rpu@xT~vTVd+NIOc{`6`XLnD>IQNqSiX*7x9=!iEJIe=e*kD)ou z#?Uf`fiYYi!?7_O7sF*STpq*mF`N)Xml)2Dp;Zj6W9XpVwGpgxAM#L*zR&hGF72sTZOkp`nSh0T>K8Fk1(vhQOfLnG2G9FD*1ykj1gg89*SXf z#KXS)u$*k+kHs)HhNUqqi{bGYo`_*FUwxz2{v_K{Ju@SQr($?IhH)`G6T`F^xX1e} zql#RF}xSUS{3yQHnx`yul?t)kFlq(jN$zlc*vat z@+u{DbqpWGc8%B{#_*AZYlKWTHEDKdbMr}z!zSP%?%~rIK4X4?SAfrB_#%dPEZ(*F zGKLK?{2Ie=F>GX}x|pwJhi&OA7FrD4^5r7%N8c65<`^de@EU4M3|nLPmVEGr{nq&AghV3c=ST~#eCB8$r zQ^@x4cMSiC{~JmEi=iwY2rEKkT@Q^3Nh~vK+)x>}@GKG*NsBQS4=bXS@KlSmMaCj) zk+Z04QO_c8QLw0OQOClUT6K#W*3B$Mi;_hZQIk$J%Q4^0K6LJ7vA0Dni$g5-QKE9$FyQ zw`gE-j72kxhEijY#!7i3i=#xS7TRoLakNF#JuEZc=6ur5;v{J@ER|bY9BXl$#qk!c zE!xQJ2^Os)`@8c+{k9hEEKZbHm?{cG1x9+Z%(fSvBBa-87N=Wuu;^&f-{J~}wdiDV zuEi}wU4fh-YrQSbwCHScmPHqfb1b@BoNdw7qT3!Rp+UwQrkvQrqNhbKmH%!b3Dv?> zou{zpTlBH$YjJ_aMHUxZTqrqp`bFgv2D!xIQj5zhE|&u13hjh#AdG^-0Tu%-u9nV~ z!mA=XgDkGGT+m{K#kCfLEpAm&TxT)FVyMNiD7DvH+z`bQTE5ZZCX1U{GJDiJy>`dT z#M~xpOwa8W!!7QJ%9*L6@Ggsy7WZ0=lI6RjRNWIrO11ke?w9XFma7!kD=BfMn}kix_$>M$i!ET&pavzQ)bf%^RKE)%AZe5S?AQeY@bUQvQyjS6R$ z2)$;DydEWBj>Q|2%oV;V+?^_td2B6QPPcG-IP)zQSo~n|BOgC9W}(Gei;pc9SuExU zX?wUwP~DEM#Zopi?*9mv3+a5%Vukoh;ro$%mBniD4Fa^#TxZQoU0$KwG;G}l|P!q6lKOZOpaXR_5FOU}T zfP}&(kAjo$E9L!! z`wOXdAaD@S2sjEj7^npt3DlMEA;Keo+9Gv;LzNzyI!qFh!$o#SS1*#+k2I;%K&fgN zrL8g0L~17hM*~fPW^#u8i2BDwVVg(RT8Oj+jukl$I6l$|OOFX)z&1cz;0j;>&<;3J z%I5(m0Ve~e0jC4)74TGfogxe^FnDOB18_Fb73j!v13F2kvqGIAJX4ZT`7H4+d)Vm~ zCG1?_9H2YUL%y`%Gx8$u1@w;OG!V&Df9T*Ob1nvgzPz$_s5Bnp;?}{ui$UVTlz=Oa;z$oB8c~O3Ur1L026^nfyaRHQK+%NQxSh$pbXw!$U%^Rc05c^C*MzSEvw*kbm>0)u zz--{tK z^j$8p5LhI#ShyteT`ICn$ff&xzzXq|!qvj}fmI^3#``kF59It%_z|!s@?F!^d@Q~$ zl2HFs;4`4Y;W3WS***FC-$u^J7r>Xm24JI<%fMI6W6XRH{2<9D;n%=s;2ZHR!mUDH z<#9IoR{T2!q)q;Rl;lrfo5)YXpM~`OMdVlEZ^GY!KO$dlU~U)xOSnV0Q~0;=A0h4h z%UK}er|K440JqmfuUOp83vJ_Q7l)0z(LWxC7f0hbn#7TiZz+zdIFfOsIR#<5=<)x~SX-5w70_lje0N%j$j7WR+h06FW&QB&mb zIF5+pz&H+y<6ub+71k0SBCIW}Bcz=$orlHU)*PKjN?tee4Tbfh>@<+PVdUFLzLABVs+vA=^ok_C<2YCRJmL9~d{2WHNO+;JUmO=jIv2-ri8z&+hRY*)7`DHh zR|p3PuM}Pt$3T&=61katO&l-8F+PrK;}{&rb#V-dV@wx+XO278Ocb9a zoE*m#8JQZ#OOnvew76TdO&4;+o)O2)IC$G@lO_)4_tiMgi@A;E*Wzw%Jc|`kaBKM4 zaktm;x{zd!$QyCYjU;cz@s_xExLeP^6UV!8tc&9lR*=X0jCe1O6>%(xyX%65aV(1C zFKyWJf$_z0EQ#Y6ZbV0=w=9n3;w(lM{>nJGie3}P+Bn{4cC6Co zk0Q=>GSzrKgf;$g9Nbr7E|{bBar_j=%FX7}I6jNJ<@e``Xloo_#POvh8{+s{WTTMH z9K^rjpI8N`}e{hgg?fyO@#YVoRX+E#hRa)WwqyD zm4M&k_&tt4!~@}2Y zm519r-0q>8hw2`Bc+(wAkzo9|p6 zkRQ*IER|pw9eZvG?>ESBR-JoHyhj_JzK~lTM!wnvWdbrlZU`ej?Fk}x4*NZb2 z8XV@~Mz!r*JlrJ0wtce*Ym?_5=;Z%amOLCE?%@s(Q$0+Rkvly+7+D_S;Vus&J>2c# z9uK2D+!uvnzNF24^K(>bYwqFXQ=Qjy*y0tFww*F9$xS;-ouOkUz2tiBn&ml!(Mt#>TA2LG00*mkSz1C+`~!_?|XQUVHN2L zg$g=g8V{R2eB)uQhmSpc!H7Jp^YDp>&r~KXjrH9Bk9b&U#LxeK ziEWT`lZTBSzKXoq*jUtG?-6#3hpkHaA0EE-@STUBJpAn8dk;T&yhDv`d(_nKS_mWk z#lx>2e)I5qq(kG3BCPjN=T8sY72RJRc6iw7fjU(9TS3S}=RY3)RWic5rjfFofv_Sp z3B(ex33OZIV&R{JC#k#y@(Fiuf-_@+vp~Yltyi`%sf4?rOLP1e$qI8q%CGO`4oh_B zwtoVp1dd6dSptI^nyLg2O5osxTclM>pgJvc3P@nDgquP3PT&BMeG=F=;V!Hw+)omc z{S$5sA*rcQ40xbOs8%b1!xCuIz#NirJ9xE)b%cisc~FG%!xP{-f&U{CI5OgOMd~F` zKaw;MX_!ExNOF`&V__5F(Frt-eE9~X<_UK()iQx&mAe)Rj8H^euO64c=}PMH!V{QZ z^^{f#w2pWik+uo66FE_MQsjHGNc#j%5jjN-9e?)F)S-#r>NY{NZ?HI&Iz2A zK$l3~P2_B0S0U5S;yp*4rP?!rUJ2Zn!2JpIPPj{_D-sxxz_|&WmjI7zQo^1W33OKGzCKUg~b&dB>eI;i}{M1lZ2`@|+tI7^=D$mcWe(+@yTv zK8xL)z%5LF0=KcU_(EO1NbU8VhOOfE1coPYM*=)N%r<`~o80mkd%?Y|%>?dB@D{CG z2{Zj86S!L$A-{)m32AKnFNEPm=$GOfgd2rl2{#G9PGGZ0XliQ$-zM-^0y`4;PVzs6->VoI`ww#d zn83CKeoEkHIVt}|BsB7?_;14B6Zj+2VS2W!Z&IK8exWjjJ0)b}{Fn8`8yUQ-o5X({ z;W_vVsUL_`geHkt()sew3qT|hPr^&?8ZGllB*c@#lrSyK2(v==pj;9>9~+Lb1qpp2 z542Y$Q7wrRl4zAg^(1N}QID}4YxYWlpKD=y_Dy2%B)apZxJg{dkF?HmFJI-(1IQov22?}yQHhE6PcbQIwjq>cTy53C*3T`e|wQrgr^Em6P}(#2a%3KYI5>DLz(KH zM2{rSOrmoVXGzjk$kOYQ#Mu#NjZ@MsiE|>!h*?h3Gl}z9$P)HSqIcwbE(Zq%=_AR7 zk-V?S1xdGuz~KD%OX4C4FBV=BXhOM3Mm_jACFCS0^zmgV!<`l*Bbj z?32O18C;vh;3T-hZ21nZmFnZcJix65k|olY~zu z@s!BTN!*getx4RL#O+Dkm&E-^3{T>YB<@uL?vxs9;VzL8LO$0+$;c$`j(qPC*=fzF zB=?}4FYy5hA5P*Ckq3njB{5orI%7l_iu_UWCxnj)#|j@8a`dAP-yZXH662Csn#8gs zo=M`_BwkM973n;e#557Ek)BWDg(Su&@nRAaB%GYYL=oDVBoba6g*Zi$sY0fFI;Vh$ z&q%t-nxST@v`JoNbtEx2i8qsYEs5DlydhrMW$cA4Gmm;un!0mHur>{G?v|j?zgx zzb5fp62C{e_(RIvSfJOR;*6C1FOFI)D@pzp{+$GCgkJwdx&AMSauR`jDG%FfMNa0+ zrhpXoPvL+R;wgA36jLar+$fX~W>QFsq*CrKd|EtA33ak^=7f1+LFfxvuvIBkOJT1R z_D;E;TV3)Rsa;z)tQW3|_mPm+sK0N@4UGGx+;WZ*X0v7r2c~dD3P&j8>G-sq>(fkdstA7Q)rUH z(UCrdO~u1bL<`MQXdd~t5aHsD8%oEf!0&4umvXDk*!ma^o}f(KKF_pHp-l>HQ)rjM zyJKKDV#>*DO{Rz^L2+5I;L<=3f<-W zUkYcWaHe=CR-f($c9!$36uPkdb&HS~PV{HXt7{6~RE8`@di6-5X9}0dt5*uWQ|OaI z-xSVG;XDb?mz~gfXplTKctHvmrqGWqM6pwNv4VsObcTd@Sqhh@(4V!O!u8S_kiwNw zs4#_Br7%zlyE=tyQn*%XgQP=+!6MhCFhpc`8p2%Mkit-f9j4SWYW{Cb;U*ag?cbWh zZ7Dn`$?Zbw+?T>|@jHZfrZ6IfyHXgL!rdv{6Qz)vG{Q*lmD;E%7E1WPUr|%xfk^)$ zsf`wfDSRY_M^o64!p0OHOJQsZ^HW%$fRCr}LJH$kcp|E@CsTMTg{KvKTnf*!38nCi zj5C%nCC|$@OaPPjVhR&dn3BTO6egxHNv0-82E+7+I86b`-$-G43NNKFBZZkMyq3c3 z6kbl@l@wl0VOC^6jFI|bTtrGWE7vZnM--MxsKg9nOGBKg>uM~Fd zA^9hTe^UrjsHE_phvpL7`G+N4+p^i)A*ocQIIbKdCqqTyx zO{1M8Z6XUNrg2glr$nJnPNRLqX(3EMEt8y{Mu#-|q|rBxj%oZajkD6|l18UU{|uEX zl^O8NG&)CeI?s-HPm!*|ZfTq&(mjnHd(;T^d!^A^UgxH9o(P4se1624o(se;Oru{E z??q``Ea4StT$0A6Xf zTpG`(aa|fi(iok_m^7|eklWI@J&ha0hYE+KaihphY1|@mGfONQqi&TXELGz0H11C0 zo;2=A0G?u6Fo`QcY zTp|20jg=zr3u$&$8mq-W5XN;ZpYo67Tq9hY-gPE~@^zAYBII7^r)hj9{<-ig;TOU$ z)7T)wP#e>37lMmA@=a-c9mzM-a>TcYP>t#TE{$L0B>z5*ACxKbAJf<-{!=9RnTtSu zC+OG6&Tk^W3;#&t&q%&Kz3U{;&NTj(u#~|+k+03*--!PwQWgfniqK?ScZdluX={){ zT-?hbE0PcKW7!*(;LoodLfj zLWTV@sC%R3`#hgf*!?p&AmbW9%?u9A;Ghf+&Y(>OZ8NBq!66wm$e^JVY76URcHJ*H zG=sx3I6O+v5h8q{H&c5gqlo17GN>;e?zlFR5k}W6gQLV7%eP6Sf3!%`433E;yy9ps z%@$GEmKhwIaks*c6OtS+azX~JL|R93?qIje;6(0nWN=LeCuMMQ24`e&ri{0j!P7E0 zC5r1*mVo-s>5-&E1|1{*KaoyCrmAxWXNmXEpi2g4i(i~U*9^LepP#`w8FbH}x12qM zET5htVMM*67|)G-&x?HfWYAaqf(-hJTqq28BQFwXGHCD;ags|#E)!m!*>#ZY3T2bN z10=svcvS`iGq_ruy)wK>acu^JGq^2-+cUUMUNE%iAWypaLl55rKrq@A0=o9f+fv0?M@X9n{agi}BU^F_$t&G7c6Az2_v z$QNgLBL<(ad1SCO<2L`fJGwT5Wf?42b-yQEoxutbmetA(-WOjLNoeW=@ed=(M;WXU zrx$~8r}yIw)-lcE3wQ>P8|E4OmT{Z0pJniQ24Aocl$WnF_)>g>aAPF@DuYcC=LYy@ z@oyr@mJGH={M!t^%i#MAe#qd*41SK}+eCg6a?^l+#>fqjUo!YL5>oPe27hGmX9n9d zsGdcQtXsPO#nR58oN;`IaHsHZHIjcg{>vH8vw?Ue1Ea8fLY!|N<1`(kGYd%Q3u!Gb z;$@M@A}P*uQ>iS{S!5!eLKfMG=d#F0oSL*iEN0!fU5eyYBGrU52AaJ@4$R^pk-dfc zWU;S^vmmm+@PI68ityYQz4$*ki&~N#7+pK?>D@Y69GXSf9J=LjSQdw8aefwkvf#e` z5tL`qEsGaO7|>!WZjU$Guu?_&GOV6 zFwV`o0|4absWAC%ZuXkKSzM6CQ&~Kn#f4e)V=J;|Ko%F#!Vvdp>J?dBoOS(+<$p;Q zmn!UKLP{>rqQ7|fwMvfg+$g(J`d4K!FpI0R7?j0`Ebda;t`Xjm#kE-s7QZfw+eC&4 zuNN{GH)Jt1i(y&ZD9O!P+>*sj;^E`E)ZyTEt0W|J@_)OW!-YI=d8Y{FOxVbXKb*zg z;`a#e6^;_#C#3%USv(N&2eWuce6(;(BoC*vN3wWSlE;K&Bj3lfctV`dz&@GX^`z~% zES|}tRSvClcvj^$EsNh)@Sie7F)9TG>gxq zurZ6zBh7HK{vwMnRU;dOG)wtc(%Gc0^tJeAAt!VyY|Y}^EWXR)dkML?4UepZzHBG7 zuuWbyRh~a(@pBfxWbrHeQ4aAOev|JGHh?UC&*Bd`|IA{07JqTr)R8$N-*3QebCSQa z_$P}Xi%J&%X7OJZWd)%x)5AXtgpr1cH#x*|usMV~`C+O;FE58g4%Kp~o_^+a&G!Q zl;eL6hl}&h5hZLh#IZ1SbEv0)jdG|jg$6k^%<;(@r$A)vR3jc0+5dc6tVzU=&Y`Jz zsM#!%Hy3FkY?;HcBF71j7oH#tn{Jz&8)MJTxjCq9&JC^YayT)ElXC9f$C*NslXGYv z@l$d*HR7kyRKz=obQJzi*hzSXaI@Ya-#Le~}@87PkvE3hXLZfb2wMzJmL95>h#H>ulNPR3x)l1xG0B<71yPbv}$86$+-jM%oIai zmc!*L0rLJ~K+jy6!&R&W4sJON%;D-BI4Iqg!=N0l$>I7OZph)<9A>@i2CE@C3>LpG zhdVUCgz~-(%+MT$aggNM&Kz!J@_5=`rs#E34mV3e-{(FtlrSv$+>^t-GCN9M_vOGZVKHI%=kP!d56bIN;X}gF z!ZE^!g^vgaG<2aJ6CW#lT=<0WNnxl%wWpQYaZFVM7wWkjo>%O1a(E$!@j1*?f?v#G zLJre%n4ZJL945)g)Ep*Dnbw$vDXiIshK06tkYRShGJGkA896uF(>T2-WJE73_$%xw zEO2r9&X(G1Ii6xQt@%+5J_4ZXAbCTvP&hY-Hx9|6eWL-CIy$(kJ2M*L%ub;3{Br*wAlvm8Fpxkbwt zLLS)YWeu+mct5%^-)oe^S2=vm#K@PYl{T?qd*=5ByI!uy_Z|H&WA5l;wlZs;OB>%z zMQhJYa8>qQ4&QV1+$1Qr#$!pvU629XXJ5a9-S4% zS$XsjVbopnI6LB9^XMjiP9*6r!UcKHNYYEBcO*YAkL%SM&(EVz-pyitg%=3vyfBY` z;ul4di$(av&1HF9o(I1iJs^+YWu(6{bwwV{^k%KQxc+CQ@Z~>w{KJpG3rVidV^GAe z5xF*x!6M7~ofK~Su6<+?>ZP%tapW=5cEt zx3QG+n9B;vV|X492Z*0waZY3-1x$D;y=fFOU00 zSkA5Z5`K2H;dV5QWX#`M2#v|(;XEG6Z5P9?OGok>Y?bj-8PU58>l^JR$O= zN`t;nMC+c-mONK3P0Uu zCN(i^pB!WPeb1G7yr0LqJU+>TZ%b&p$*js_bsit6tXTDHIH2+TkMJXoY-<zU=!ve#ql$?%HvI$Nm4jn{cc=MZvCZ3l3T}|;1;h)0o!oP$&ggb?Q3tRB~kI28m|Ab{BKT*d9 zX$st;boDZjU6>CN77#C>s(@+*cm*U1NEVPPfC_vC6ZQE*Y#!xJ7x3xMT^|O`6p$^r zj+_&cR0%{e|ynq%398y5-0*++DbV(IoZrJhb z6kIPpw1C43Zsb2)=*E8r(e*x?N?mf^l3>m96i@*TL>dYk2`N8Hq;UaFM2;3V6&@pO zCalxM&GIb^IJSTj3TRcpaRnS-z_)eX3zn<+z!w`ZpN@17FSs_=x_}ii)2857{%s3r zSHOvEW1OK1=p=Gd0Vj*J7t-q#ky8seP2_Z8hsd{M!QDxx+8G6$S-?33beC6WVK?Df z1$2q@&lc%ga63^96^89mK+gjD7H~lUy$a~9LOZ{JbCu3ehsx(EEY}|7eZ;woc%eu? zA?5Vt3Eqq3yjXaN@THmN@&fu7aCHHLSVsj6DB#Kht}5_`jywL%xBT%n%dP60kweV= z%gw+7&fw-SPyQEhZ2{L6FoY%0(p~coE?|2D*W*~W*Q*KLQE*Gd8wwa&z_0>tEV#+{ zRyB;93T~>prGT3Y?%im-mgJFs#>h59o!g{&yKr~`-KM&iXWm%=8{~+Bn~$3BWf9G_{VbvaW)$#10S^{1sesAsUj>XVU|a#u6x?e$xxkn( z$BZf9;Q}5h;87*%c|J$rna9M(3Lh6fA$(HEls{F#(-G%di0_wtmUbq(?`b}#+IhZ! z7gS&43z#7CVpx4T{mzy@ktx@`m?;HJEnr#!(+lp78+UbhY?v?KzL1Y_u8nOgxUWmh zEZ}9fjRIaT;FSViEnrpwuhE$?cTRARIc!;M`kn7C=bu>W#*jHI{{rR~@FrK1zS~u9 zx!!F`lzN%B3aGo>tSjK{0+`u(EY$+uRoYexnYQ@_EGS^1oQs6Z3s@|&B+^+bvW)Fq z3ps{*kDVy;rTqPfuM$};{GfmjBl$-Ktcmzqk&lI3LU8=~q=5AWx34w2fxAlmoP$5d zKp!ceGYd8p@M8hn3fNe{R|R}iz!q}7!J8dK&-jM=JM`&O2l zas6Mw_XW4w;r|Dbrye&y74S1hT^|V_zo;d1r>O5cZpHg6M}|t}Hx8r){2~4)M^2IL z1^gwlqkw-!cB+g0tr#uGe>r(g@t;UpNO@2I9|_?!P0NN?0ltgE3Q71TAYxp|4-m6t z*iHE7O}(^_jE|y^l8>y9oR5MJ-{))M%(}@Y?<3e65liu8(@YTW;|^-YmmIeH`XvCC7i?O$YoR zA#$XT$M$u#T;F%o_p;jV-T3V64SY28(a3iV^(Y@rd>rkgvF~OON_b)X2G+u$ypel-0NTdGo9f zw%g~}EPcG-W4!OKF<~zPPnLfIy<-e?E&qC${JFPaDt!fpseZ1~tsgGqo7B{eSeE0gzRb9;+ ztXAzd&sApM6u!k4F2c;tW17X^jU@AZED&EPTttIDmiUO*GhD24_n56>9bac{-A4^} zHZ$G&#a6IivqhC~Sqbm^SjF@g@oEvPeSE+kSHuZLeCXpNj&DWSBG&j=>q-*e(0B`T zZ+-Kzk99si;fSH@sSWA~>wSFc<1=>26HRT-0zQae2)`84xt)i9e0;^&^%Oa;xHqY5 ze9eqYvc<=|dZv0K^I3hfl?M6p2Or=0_+IV&H{lP$ABEe5KM8*p{vu?qe`TMI&M*D$ z;}0Ky%4@suZy$e&?1=Pta!AoE|Bod9`uL9{M&w%&2_hZZH$^wNvFq{eZ}B41MP!Qb zihSRxxqqf4m*ak%$ti+HX zQbaBB@Vyqbr9gR|A`TTltcb&lIHHI?HO-`&W_V3=B$KDzhPp-6i}dS@umLv|X~c9E z(YS~vOqjyb=Fy7im?D}+q4+JNX5!7G^e~o|k{nyaaSBKYw?0^6t%_(}#E2s9Dxysh zyq>zLh?|RO%Vab%7tAs3ia4=|lT;KZ7jaI}tyJ3=af&3T7I9h;bGY@#XH8Bw^lP}i+2@vEAo7!Gsx3l-HYf^M9(66F$+apEQQ{} zKEiX0I8Wq!A!9jfg6SLa3q&p~qMyjjYWyrn<&q*UEn;91S5sKeNiHkmaw+sL;!2S# zBK-j(oYt=rsq}FA95DtJaYNA!&ey0+D7;n*gN4@>F+}8gA$?nSGef06ERx(P!lJvS z2;N}g73FP3+*)*Z2PW!R8t0VTRnEhUxI?4`F9Dc%eNTC05qB5ya1oCbaSyvd!i-VJ zxwi;@DurQ36>(n?_ZRU%5j(g6JJmfR&HsZ%JXCc1fun^a^rAj*Fg;qtV@15omN3Ese_NfAp`EXz2y7x97k@*>`o{*#KNazF5x*4iE1OUeJB#?O zh~JCY&UsB|kp3v*Pma?1=s7<=QTR{PnFy(z)q1ZAy>j7CDbk< zUqYeevQVo8zvLzqa;{p7C6r32D!KN*R|y=?tCif18%HaNN4T$$I{THd zf5|;O#s2{%J~O+EA6UXc;s-|(US(vaxfIr6;s={UOE|3L-c-PE4jx_t_l_DUdCdM1 zB^+6DBS~E$Nj;JJC2;eZPNuw}lpB?Bln5n_MVbhY7B(&6n8>%82q&zTOiu|tO6Xa_ zaU~pI!r3KsE#ZU`T9weHgoZD>1q^4j)+&=WDyz1_cES@&IEh~3EXGbHv@hWlIZrL2 zqsVEI@98CU5a-SemH#ImUgMu3ex|Uq@GN1dxo)NFXx&OUr{o@<RRQ6NgZ6mbrEOA_g`XeD4{`9b7KiZOW+37u#(#XGIQL1&P^q^qGs#8xrAHT zP`Nc!!fhPKdYjuz7+%615l0i5=M)R5k4$@MEIzX!Fh9>mkcEQKQ1AiPnGa= z3AHww9`((Bb7Gr$n?U(xn|y|aR;fH&LgyCdqJ7N^C5$iO!xBC!;l&aruoIQ=ZV3}h zn8d8rGxJJrAv(F_mb)`b?z1dYN|-7_K22o0@TC$qHFW#)GfQ~6gjY&^c}w^vQ=2hV3w_@%ft)(2`ff!upQTsAng(X;X19sN z>@Z&o6>yPov2aNVOGTCmX=-^1??rrt$V%b+C9D!z9r=DB@+TW!32RIEy@WqX_*g~9 zQH39ixxzE+O8BIN^(>zfK2!1jQo`pVKbEkqgfB|?l8r}_&BBdBw!p7MHVMCGXVGrk zH<9m_61Iwe8%e$^;d}8PgyAgnQ{?+ITfX{o*iV0rze{wpCUp;AJb?Rz6%ti$BrjCK7fA|J!gLifB2>tV|KR@s&J6x`w9=Na=mFk;r_w{gf)e{Or|d_aIJo@^lL>n52-@!h}RK0 zRCrj`u5;!`R=JV?#44Org}PO!SLH^$SGWsQg$7kl9cRGC>1T= zv?`^2&;LI6n124(HP?OJ=Q+=L&c4iv|7iInaa6e*C~X~;&gTqdANqv zErjkN{2anBA@pEDg|Iw?XG6F$gm@EciBfe{2v;kSy+Rlq!jKTIk(0^p9m2KZeF90} z5c-A8-Q0CTlKvtCLKqlG28GOD$>?=G8ze{65T=GOG=yOx+#ty0-4$sybw@F}6A z&tIm6Fg=7P0{Oim%nD(42=@h&`$L!!GApi`!Uu$OJ{ZD7;{JceAC~^(!Z|_Mxgk6v zJ};0wD)N|czL1Z17l<&~%;rMzMIkH>nb%8xlaLR6x^VngT|XJZQ>x9UgO;{T-^WmUk_n}FVrw-*8g&D64K6Qwh(`{!~OpdwgvL-A-pNRBam=U z<8ATxg}a2i1K&L%yu(3B&b=HTM10F!$T6Z1B-tn2&n^?fN8ANSHjG@@?7CDABNRs0##WUus)|$#<9K<| z_c)R2VblnlU5lD>a)@RLoFLw|vU!Us97aUWXc(?YER48FBFqyE%u}{x7^yJQ67n$$ zL)qdanJ^sjE)9&_6X&xz@_ZPDFlvQSTf(A{2T_(pxCuj@I$_iefiu`1ymgKa+w;5|ed2cGD*RI7zlgaygm32lKXNGZB z7-xsgta`cdoG{K6X(7BcjPt@cKa30HY%OdlWRMHPXch2h=a^rtULV##Lc# zN@H^xSBKFnjDB%k7soYW^bX^T2)>Nq+A#WraYY2(BIrwnFuo1rP#D*R(Lan0VZ0H> z05-fZZVF>m7=u(|Hwp&}hX~mit``{^#xRi^n4NZ(f6;e%7$XABks|cEIgHU^+!4l| zlH3x;xG=_tF(%NwHH@)=GL768$R~y|;TZYt$M8vE+!e;EFjj{#IgGpI^>P?f!nh}l zN5YsF##9L(2;;#prio7%Zs-5M!nltOfQSD`!boR?F;o0johh-g2$u?< z6jJl4FrF4~nK1F*uHesx@mv@y!dMx`^I-6>WMY2Y6 zI@gL&@=6%%!gw`|^OBz(nTBfJ%RUHW zUl{uX-%rB$FyJ4Fd>lS{KK23b|A+Bu7=5{e$B7^)pDz^4S3#&RMWV+W`(KA~FpO^k z%{euU@VhX+=lB+Z8^Pf)ehA~Z2&zZ$qXPaM#xEj23H`+X8b*}}sz%I^`S(5*B zNU8-oe!10%AR0j|f|?N=AHfO7=!e9^5tJMgMMO49;(>*XNJ5y5ASIFxd~F7-V*>iI zdl6*i)hU8p1o;Rq4>SwZ40ut5L25-%JAyh9)Q#Z$2rh`AUIg_cI6Z=<5j2RPVFZmM zXcEDR5u6l3BNYV$GS|$SPlzW+a7qNHMsS)G=<6%|r$f>#g60vN9l<#foDsp9Ob<8z zrB7d8elAGPl~;=h&I_#hzC;FT8Nr1STpYnAQfn2#MaoWVIsGKH33AFHmqySwf_4#H z7UbHuLsRW#zk>q)7X_2iG0-IMEZ#-fHNtbAO**?r&?AC-Be*Yuo)KIb!SD!1L~vCE zS4VKYl&RKBq@VB_VQ_Zxc=sP82eh+atIm z;CDulNSZR?ER5hm zNgfeC6u~T!*%8e3C1uvb5zG-kIQwYqzS(&aJ}P`nIA8d<^1C3&{vrvPjFk~A7GDxb zmWn(X!BZkn3zr4H&qT1C(>Fi<6+S0?UP$2!A}d%vQH#zOBX~&xUly(sGM#?j*F>;Z zl2_CYcZ#oz;MEA$i?iHb6Ja`Ek6?rN8^VpkO~TDW>TD6&8o{MDVZV6dn;_nfMna{3#bT%PUd}|BjmKs}x1$D2|JwdK6Wns4AUm zGD{u5ihT<;qNo|g@yB@iz9&dRQ#UcrD56mmq9{fYiy|I{9YrRJL=?#=QcU0TvM$uGG25A;W^C-@U;>;+{ilRdx zKRb#`#LtQ1+$dUzw+ejEi{gCo3j#^YC@u{6V_{Put>wHZiZ)SPEY4Qv4@#E?nr%he z2`>}2j~-pITpmS7NjgPwg-B;1Eq4*=D&(C@w?N)qqz9XUUYPM~hx%7Vadi~E>f zUVg1z8%3We`bN<&iiJ@uisHH``bV)qY6GGe7{%RDOo?Jp6oaD}5yi+ThD33F6hosJ z7UfCBRzp6H;pS~c^GeSR3V0*Ua_hK~DTm>byjRh>DT+~1+!n=zC~l5obQI&{bxRau zqCC*p8XHA#HYDndGp5M7nthh@__+G+ck^#%8-qF^FtL@_gpsZmUeVtUl9maFrzZxmFxSJ-1;+5JiYCFfSM z9*E+>C>~KdABtj@$lNHHo!L=59K{^wbZI%-;l-k0%9&+e|5UW*Me%49k0}=V&X3{+ ze)qAj>~R^PeNUQC1g&?mU<{hx$q0& zmr;Bb#n(|BjN%&(`%%8#eY7_D>K!{TZ)8}cm&L5_qd2S}p%{LM;>Rc|#LVpQlZ1an z@u$eoQT!tEtME7B??QhZV35D$v=sdBDE^W2Um<;uD32s%QXnZO!v8grmyaDi^SojV zm13wI=u{V}BCHxiHId_l%s4NGts!U47>*Y?K}b1$!!bl+h{h0;aAXYe7!ombh~e@W zk};%WI5mdTVo1ke$51PV+A(BeaHL-px-k?)yqKA=SV!3ya*{BXyvTovDJdg#Qmsx5 zbz^80L*p3g#ZW(n1~D|05nrD=CkFa7MdwNK^%LJDhLdABC6G|)k9EY;V`v(~`7vA& zL$er~D-Gw$)EP0H9m6>>GZCLD`C0#e3jL^C#BiQ;{!2;A7%q&VZ4B*VXr&;R#Bga0 zt;K2Wq8QqUGbI-vldAtLP=1*d+8>iCrnX}Yonp8qhTbuBmO{4}y2sEZhOTl_hheWc z#%7Ngu8iTT7f6r zPF{oLHCS?ALa(8L{*5sVi{S=2Dfg2%Jcbd{XHif>yeWoJG29%(=ooH~;STBF62sUS z#>Fs3&RYYUzLD{APLQ43g4pRbF~~d3-WkI^F-(nNQVe%Ve{u|W$1p|wzoPK-GA)Mb zlFx|Y-Wcu^zh6kRzK)+-W^?9$7Gjvi{vN}RG0c|mg&0iE*b&3d7`Ds#rjT~1`BuPp ziM%bOe7A_7q<6*N7qUS1s&L+uljHCQG3<+Be+(ZU6XYZDFPUr+#`Ot__@{y7fXHVt zd@k}uAm{M@RSaKq{m(IwkDg=rHimL@Eb>D!d>6y_F&vKJ`6tJRuy@%%sMWP>T%SFqh=guN_c!6C&bYp zj)rlB;t0o4D~{T6MC2QbBOXUoart$Th$AU4I(enyaFqroBOQkw@Jt*|z^UfNk&Po4 zNQ!af#S20f1%sO_a5Bwx6idB0>c-97K_f)U>nkzjC&qD798IOxD2~P=r^V4Ej+5g! zC5}@S&=1RiesH2sP7i$P)hv$Yahwt4%U3unj0!h0#E{mgm93A5597mTp4%aqiLa)o? z=qR;Lfqg%DUAdDl$rZwG!tTNz!k)q_g|u^399IXtR~%e4`Wwi-17{?&yI)U>O7#zotI9`n7r8usa@(kh7IEKY>LmW58Fwa}xhalOaoj9EE{^dcqvNq$zExywP)d~CCdr+`3BrkS+%9s5kUEug$1zFH zyM$b}u`rpVDXMhp+!M#tK!2L-)A!yu?vv0j;roMlXU6e>@iDPY?TPt`yjtz0FlW=`t^VK*ORXjQ^z9ylc!Z*Y>#j)`i;pRBD#IaS9w}ji` z*dE85any^KV*+-FknfZ)B|S%&guNZdt~ho}$Oc2n9*#f9n?Cz)9DCzW-}`M~9=oE7#A{Ci3E}fq!MNV zN+(cDa$C+!0*(kRxFVjAn%M+$0ndvRghiqVgHWxuc%205iqsRHD6F4A0}-k<6k(8) z6ni5%8w;BRIwvP^O2AJ|9K8)WJ%OeQ(oEP~$ef-ba%KW&iJUDwS9p$)akUWf%kY8( zS|;!y3pRlZ6KIt{w*+Zs6X=w{MRK-D;Nk=>N#IgBFBi5|dRX}F zkkgNXpK(#nc!`}Q?<(vf^yOCs`aKfpnZSeuCMIyDgx4o9G=ZxUxLVF$2@DarCV}1w zTr1vB<!lw1oMGozMH$wC)W;-Iu`q;xmMu@+LZ74+Ql!D}mYUk4Yej zhZC5Sz}pGzN?>jRk0{8C!g<2SgpUTjk9OuK@VJBv5_lqkg$XQ5;8|Y$`AY&z5_l$o z@<9M4FD3AD0;>{O zoxqv|wj{7Mfwc*|k}#v+#sqJTt#t{kPvEr#UQOU|`LbQSljS$a6|L73ctfUGH5(Gx z&lhX?YKq3pO^KtAdN;Eva%B~>wn_8N1a>5_UB(ZWtS*}4cFOB5;jbn0D4gqg;%-U) zNnlR`?~NhC$82&*PhEs5ijW{1`IWvhP>udk-! zw9qVx=CVMYGbE%c-?k#{k{G2Sw?h(_C-G(yJCf*_M5iQ%Cov+4&PjAh;`+dH*Ccu;acvS;NYX8d z?jk*s=qWa$c82|0D*8 z4-^hgVvq=pQ+bFugOd*xCmEK+4FSI~P#&4YO-W2o;$G!tWXkVL;)x^{CUJifGnBBI9N`rseIF2ckfj$$W{J!e`s>v>Nz9e=5#hWf9+mya z3n#FIg^ zd=f7Q@;zEBzQ7Ky0$&-lw-=LmDd4QQRnlKAToZ(4<-U@{I(9T^`gOfN@O@3>^&~a~ zk~c&)Cb3Cmvv5n`yH#YHaJ!HOcP8;x5_hFAIfb{A*pX#0TR0guI*BFH&ogDbJ6S_#}x#Nqi^a|C0F9Cr6HaDr*Ol_$-io zp2Qd8eoOu;kbf<5Fo|zOz7l7~I=6?!jrEqo%=cI6c z3KyhsZVD|@I8QoH^OLKKEv{i`jo)Mba*@?Cg$q+?l>)sed|3rZ9rEE-tcy};lfuO* zT%uBHCnJ}p&^86?_|~XKepz6jPKLcag-$7Smat>W>M|fB8kNG$DU43x7TLcwg|R7& z5of9@cQlC^m%?~SX7)b%Xq8*&6C{}^yj@65t~T!!pA<-#hPzXklES1k?n>hx$zMrf zT?$iEn3lry6z)yoffOE0;l32^m%_}HS#i-IuNji~9gRZXfIpPNg6`Im6lSF`JB5dX zxE>Li!+sG+{DFO53XcYo$3*4}9~UkVJ|SEvTqIm9WI-_vOI6EHO7aw&SqjV8P_|qU zWO*TpZ=9r3+BDkAl2b^D?@O$fM)fpmq;Z^lsYZpGfd$`545blHBbi1jjYt~NG!oK@ z1)A|=f^)?9&we@$JB^Hd{ivNZ+%&vn^#6+`pGF~##%VN3qnJiXIt_%i(x{V0UGdsN z-&(yi>dWcJNFlF=X`CqGNy0|TJ{5eOlhZgQjb>>ym+z@*oE}&>O@!&8X4AB(9r82M zI5UlN(l}SXXQgp=pzo)F*g}%?g#QU?N_b(~yt~pyyp^!E@FHeYHFdF^404Ic zr9ql6OQU@nJ<{kYc?Th*xIEDBDAFm7&LUleU4>T&y9sHzJL^KT-j!)wmB#QiM)3Xr zGw623`%22;Kj62VQ`Rs#(TXq zDIAu@4T1bd>HB3x%OlgcC5-jv2Dk(<*P9jH;$SWaVX8n>k}A+SmNnU-*!4 zMjA6k9!O(V9qYj~_-Z|OHn`m}OY+%iJem{w$>L zFCxDRe-r*LJdrQ|r13XL{xtqg#B7YzmFTphrhNdqG~pdv(0Dq)os+U zQPVa@htbL7)QHE+%XfxtL~KND#BB53`pya_zdWj!x!@sP{C5U>${q>UNbg$${fp_HwEwMv=E+0%A-YcHu5%3v~iMceh5xYo~Bi>F@xuS+9=tm zWt%#!ZKJM@dN%6V_(|nVJ-=Bg=V?Hy_k zg5YV-lfNu$VdFd-=i9izHsA7Z44EU@|Lkf$@#a^4JXJf%hrc#j+ql$5TN@YIXk+7I zrq(uRJ-zyoG0PgEvKO{~sb@`EZnd+~Z>QDKMkm^|%@GIfZPR)?*rsV+F62Q#VUEyHm;V!Bo0$HuC#HL4f57+S;X5Gn!`7Gv2wW!WTUqT z`L#Csi1%fBcm)fmzyuj+V~~wEY;3eK*v1eWi)<`rjoTP%W4MhG%Hs=RQxwB& zu#w!L1m7s+cdYL%H7%|7=CYA2bMF7!7-i#T)|!o5Y&>jZj*SgVtuZ$4SNd4e072YkJBD_b)mP6lZ(wr{5S9qV$ zw>Cr8W=isa@Im22!db%ELSLUY=PJk}Hae>5&Xe;|;bSa7ZvG1&7cLM!AzUb=1?nuZ zvDC(ktbH3#+9>d`FYAIQe6rT~^Di6AY&>IQxs4UJSq(mG<2f78+jzk?Pc)XaHwQ0s zh2K-t^kq8zl8tAj>Vl*9Un{MbIhd3){{oxHgCJDVtA%TXYlW`}*9l)0t{1*0d|gp* z5VDbMVyW8L$-&&l78_e_ylG>HjcqnYt~RGH*4u8zknL*TeCwX)ldNB6&NE>%e%r<_ z8@oB|D^(S@n^x5R!!qKJi>=9vEdHfvFSEwcCIdTz_icQ@!NJDQHul-rZ{v`S?`(X? zam>ayHoj#_YFi)MSh&#|7PdZ7#{b7rg_}RZ1424Kv+;Srzp(LTz`wHbwfI3H$6+c@ zs&D=;z>-|M*!teaVH-c#_>lu|H|vRIW^ClCWkeqQNHrdQ`-_cVZGo*&} z+xWxAf%fK9jX!P7ZB*_r8-J_gvwQwSQ`^n)N=G<)@DYHGM)l2EKvo82nlZ~|P$h$^ z;t-b4pn^z6A=6e#q;dwVX#W%SYLd`N-{UfK!IvLazuP3Z8Y!LW1%$Of5 zFbGF%&XTpOS&cL1xQtUXXp%8!8=jmoClQ?@B&nP*?dmjUFoUKUGaEL`;M@#aWY9cg z&T!y$Mh0if>n!2f!gDg%5gh8sGiuJupq1q33u)&9k(R;>Gw^5C)`9OuB5g9bIFRuC zy)U%;}xoS!G9#^vIy62>F#PYP}H7Mb3wZ%Km9=nrQC~uFaUU zKKf+Lh_ST3RlS~>lJ>`~_xaeD6=yy*wMJynUwnX&!hs@#G8il}B#>V(GBkr>f#ik^ zZWJG$F=s^Z;@J*tKOR!vI5icX z62LP+h@3h(nNDEKQ9~Wt(7HW?JD7_K7MEwuyIXg%uW`!GVDi`I{ME^dg0b8!G9`n1 zGMJjdw4hbY%3!+qy~6v1_X}qTX9^z>J}7)hSgoG<4;ru88SEQv79MjmcqD^LSyawq zUIvdc<(`?fAIo4qyMu$QgU2&ikilCSyq&=l87yRD&fwJy7G8Y>mSylvP|nLUV6m`jc=5E}5Dy?KXAZjOuO3&hDQ2)X zgIAc}a@LD#RGdLxV#8x=&tO%?e50{CgEb-#RJC|fLS%ohS>G&gE?H--&)~HTwq>wA zgV!_Ikii=nY|MZMQZZrdHMK^VMzu+G%1MfCcyq=a>$F9zBj6Mj_5wm716{h}do!`v*)( zRcjx8)lK$iz(Qbu`8b15GB~J=|BqE%-6%KNSk{G8Kn4dgW`O1OSq7g6{0osUGx$p6 z>p*_xfie!}}zR%!r20vu*V+Kt8vKkhT3S?3Il)=v#{FA}IYM;Ld zf6w4owP&{f-_)K-{*e7Yg?|Nc{Vg(4M@bxE$8pRVJC>%PG>VSun z#GIr3m#etAcp{J_9i+t5LOYN%)XB}v{O&qt;$s%rd2A?V#YG=-^}rr#Sr3 z7_}VKchJB=Z3lH6)OApgYE8}mL0;1lqiiH>-mF2MbJEbki4Gb&XyV``2aO!_rxFhP zT%~W24wbt+ZEdV?@s6NhGwW0br?D6vobTXtX4XM-2WL2F=77IP%$;sdsOGKBj@qU> zvzu`AIMcydj+qh8W_q|@b#Sg@?mourcB6%32-9OYy z<%=A&aqyvsk33xL;1UP7JGjHarHt1>I|r9J`1>QXPRPDzet^>6F}Fo8b+GvF;|>lk zchFI_f1`up4mvsL?4XMz-Gp5obKW2$xSkb}YU>cuwT zppW=9!roHmuR8iV=qE{kHt+J*bwb*w7o!;9V4wq^)0grg4z71FR6&lF(`%T7H%On( z5i)g)gE0<9I=IQfC`C%MHwQLH2g#uD)?@fs2jk=%FPtE}P3RvmH8J3KI+)~Os)K0` zmY;6%R`f0hlO0^F!^-Y<%yctFb;@eJhlM}W;>F%HH)Q3yTGQ3+?{#pWgZmxKa4^%s zBOc~?c)-DfY&pDd^6-#@Sq>(+nCN1*gNGedb8(!DIS%GJ*zI5sLphk|;3dZ8;8FHj z2TwV8+QEDd{tgx~%Z^$6EO79IgN2Scs)gsb(>_;LMBYv=QFKckJjqn)wvKXc2ym4( z=yYqDgJ)R64qjkR9X!h}#=7P);4qWpd*#h-HJ70L`@jkZD;>P(n6uM4TGBFaFp0Bu z-peWns~v1)A9t|E!CD9F9lYk?6$k5-fLGaNMwp)tFm_s|%^mX%f8D_b2X9D+LZ079 zA=5^)n;mR%@TP+u^4;oSn}h9+Ii{F8EbYOkA2qns!CMaAcCbr{rx7NM^EK6YR9CY$ z7V#Yi?>hL&!Osr%I(W~)=MKJb@V}M}y6dE4QS6WIiP0Y$*eKbFCBd4;E;pw9DMEIpo4E5e5+jeHkmwL%mS4e z@OutB4t{X(Bg?IvF+yLSdCva^awSY1I)8ESD~CiEaPgai-`U?C{Nvycnf=qjUmOMl z<;NOZlg~1@Z2vkq;_yF_D09K11=&>m7>V4@B2rS`MFkgCT+=Kox~Sx$vN*kbgUlma z4pUWCa;ohfWmR`k!^K4|+PJ9c;&>PJT{LiUf{Ty~*M;XI>>}bK=_2JK>LTVM?jj*0 zekJm#Qd(o_@t%lrrCr!AGA{m@4dDV4MkEvBI*gV*VTMsnL)P^ojba94@GhLkIqLGVJU7Y5kv5O`y zPIhsMiyfQFSQNCz5;*@Ui_LgqO|x!1-9=Lu&0I8h&E6UpjefV{FM)W#J6pw+a@JWc z&USIWiwj(wchS)`9hMg@a4|!q1sbH~E-t#d zxI*Q_G;`MA+KFDgn$)ynvC_qhE|$7@(#3KY&$@Vu23;(3@r(;D5BzpWYkL|TZ5~X|b1t5D@q&vL zDl2vz+Vrc5|C43GvZ7yd@v@6oTk%Ef9IYh0{V39u4b2+ZK}Ck>&K!C!T;-o`kWAV-?Z*eYQM9ll!E_TUxx7y^XYb>^H8fWXG=DRNTy4dgHLxy$nzKaiB?2|rq z*eYgrGWR=7tzU*8x%k+{CocYXOv`_>u8E5&XWely`OL-VE`D_JlZ!80e94j4#UU48 zx%k?}K^Nb!6CG#DnfiY1uw-g)GqHT<;(Mj@2bJ?-rKIsqmaPen%G@*mnNhPByZFn+ zuN?ec{O;lpc1Av!*1W@Ul2Z>?s!S4X{>|aV#lJ3&xL^;ZknP-Wa*w`laX*#;%Xt8A zCp|RvP~JlY51xmthl(C5c?f%mc&O~5iiheRYUswZs)uSGjuU4~U|}*x{(N22!|@(Y z@DTD$s`%i*?^B%MSfp$%OheQ|%tP9P?IG?V;UVcE<)Ny2B2DpPv9O@1%!_kh#)IR* z^^VSK%o^JaFOr;xyoZJ!PV`Wqf`>XD>Ut=7sO6!yf2XWjfU$E_VKNx1o`?D#8pxMU zu4;U1EJh}ql9N0%@o=(-Mjje_W~}2yInzcw#lxu{PE#H!=aS$*uVx;ad*~#~XLvZ% z!$lt2csR?$*&fdKaDj(&Je=#Hg@^Mza|`BYnHI>IUp6Y{y`_f>J+$)B+B3^AzchSh zHU=h=!izmz;-S5V4jwM`(AGmc50^=w9gU{`vq@!!^@CsTp`%hxArntwXAfOGboFqB zhn@_sRCV*v-9ry?zt__smlL#kl`7)up!7H|(<|Sw+%+D0d$`s^9}nX_+~%RLhkhPz z@NlDt>pb-LFxbNo1svdEpoc*o*wL5_A_qy1eyoV=r7+aPFwd;4*uZ$IGw;!uYi>#m z_b|f4Xb-n|80q0A52HNX%yt{LK4@fyP^$TzixOHM22pZVyv9{>$uL9wvL36f{3}$<-Z9!)8P*je9&y^)SuDbS0bf z9oNHtQ>U*PoGV!Odzj&2mWSEQFBktF9^|rL?TVUABo`{H_@h049oX1<*uxxIo68yr zBI2J5SQONGl$9di7d*@tp>Uap$Hf`bsk>zu--F|hN-}d#J|Wlc-SblH-!H7GUb~B=N1u4wtCnW2G*hZhi0JFpH7z%y+XIEj6v^2R48T<}tyKO2bbceiq@j3A4cKR}a5Q zLjJplKLY-zhrh)C7XBmrH}E~;!OEI-ewmP@Towp;d65djidnPgPX%tTRpAa~7LQW1 zoK-bzwsfjxaakwX$fRMTabEXHh4MGqX5LLF#64 zTGkYPJvliV)X$F*2Z!BwSRSo;5e5 zP37Ax&}p8<8G#WhpRGbWUr6UUS)4217Q*v{{!Ds77A>>5P!ejk$)c5b>p*gm2)pgY zf#i}bE){PZNZN^9mW97s=HPjG7TgxNK8uc7bjqT07G0z>Ad9Y9T#-d@IlHmav$$Hk zhmdKwGK-!8=a5CoRdV{nV6QB$34AHJHj6%T_RZqDK;BQp58FTcf3xbqECvNSgR>YC za27kOX=oP1vbZ6O8?$D*93|i3;vqSPJ*+tm@Ngy{%{s^#ODeh5&A9Uu`K4Z zHRepH$Fo?#o|r@R9G=KxVHRIy@pTr9vRItO>MYh|u_TM7S-hOZDk69O*)Pg0?qfWq z*7$T5%d&VzCBrg*No08z&jym`M4lJEki`m-m4WYzB1_AeslniUYwrnW2P^_>Z5FR& z@kJJ2W>H03I_ua}mRPT5u|A8}vUoj&Gm9%Hn6G^RF!aW-sQQot(c4f6L-`kw1j2 z!9TOut2d%~iZY$N{>kFs!1qX&TjypB6?58S}}+HFIbh7 zlFB(VUsMs2aJ(gQm)kzxT3o@ZkweWKGC4Ro9G}ApImB{^=Mc&voI@mss2VC?*x(;M zxIMzG@wxWmPt5jsB8OxS=^X4FQVhtKfjMbbwdU!)DemMn;h9$*EKWLZ4qguRb7+u5 zHiujeb#thfGxr+v^~@-rGe3MOC~L(WN+Pv{wS{$r%r)1O91m%eziwyMG|b_|98Sui z5v!&gkFB;AG(`Ib8dB_U7p8rU!^RxmzNL)Md^gaPUP*E}$mGnoLYs5gq8|4uUnEwt z`2eUoU;D}7%^Y^*u#@#w$2_0iy3TY}?v9ebMT49W)nIn1mg%*d>Cqqb-qD!GLU@;b zcBC1O=*wrmd|NVF(b~sxkAu@&31I%)H z>q{1O&McVu{>JCj=l{RxtZ$rcc@St0Uk9!FU=H7~mGa|XA<3Z}z7zjmcsP*%ki(DS zyqBcfFFE|maW#){9>3-Adk+8Ra3qI6a`-cczjOG9&7-lYCU$|pG?FuU&*;ys%qF*h ztUSu{I6jXP^5!XXxjeY##lP7iZ+cVtJSyZ-F>i)DUNuE32`lGOMWm{*nvgojJmfq9&iM*)*{8@;IMWkT>ra(YdsOc}25j9v9}(Dv#EAT$IQ4c??x* z+vL$HZ(hy4Sk6m?mkQeo+X*id(pvjGIt2XkJURxPi@?r#bjhP@9#`ZsK=N*RbkCzt zpwlCd-Q35Jv!`(R0h8dX^0+$C>6OPd0q-qxt*~=BtFK5u;dMfW?a!*zpE3ppl0kV4 z79SEws4y}gW($K83{DEV07d7J|B7$H6~(7!2+r&sf`!j7Fd{&$HY8t&*KhBxI$>5MBbUlBuVZHG&vG77gO@MKaUxC z+!M&B<}oec(?#yhzp=V|yNNvJ2$# zc^*6R*qO&CdHgSrxAJ&9kM~)&W!A2sw8?kpu_upr@<(@I-pk|Nz;~~N{#Fd}1IhOZ z_si=;;YY&%ar~DT*TBzyTUL%Q|42@9fC(@sh+1Fd@ns%A=J8V=U&;4-;n%{03jU4w zw?ek1LwS5B&ZN@RVeub?oOCGpS^N(nWBEnoSK)6Q%=yq$NK=1G_?M7Q8vHkpBY9LS z;J5;;0?G=e5ULVI$g30p@$$k7!ioh{DwtxdEN30Hc|UnR&g4WauaK~Ykk)DzaJ={l z1(Pr;GZ~bJC5#lX)_-}gU`GCU0SS?00T~erQw5|8riI&*_!cO4(A?248j3!CDg1I5Oynv1>qRR?suOxLSnD#|I7-dKznAM-z?HId zm5^gX%bjI>m72c23%Is`>kAl43l*%-np*t-d!GXOGHZITtX~1wF%;DpyO4X@I&5u!8w(*pM35Zavn#K||Ax1q?4>1XH5j9)FumIB5U zaBBg~?*;E#TvYJIt*-iaIor(G0^ZRids_h$3Yb*DT?O#2lR6U%;BENr1+#c#?cY(r zohnB1TbG!kTluo}mu3~aX%YX0jVO= zMa(SVfdbwt;Ozn)EZ`xIq6NHEz^nphGqY-t4+|F*@I(P~#OD_9NCEQ-c(j1WRS1ts z&PK@W%oiu&wiTCf>tHP`U{L`}3wTl~Zcm@gJ`yyephhI*=ir&Z1j zNar&JEHB{M0-h^iMPT{)0$vEXKUwe%(v_01a!2wt#R66p@Ol9o3Rqph8hNc_PZxP5 z2+OSo-flCNR|CmHNK<@>^QQO?;m$x# zYr6{AUBGV)TfiPxdI8@SaHxQH3)sslF5qK!z(D_fl@(VD9~7{!fc=v5nKGmJP@EBw ze^S8z3izUcFAHX$@Y4c5E8ue}94H`poY7%{5Lw7Xek?}(s(`Q65e`a|H_H@$!}Q4J zcM|?2r2P8=4vYUF{4tRG%0DaKUnKlh$ejLBz@G(FEuvZxe--dI2l*n(74eT0j&Rs7 zn&I?cHpTMh^%(Lg<&HK06j8p2ic+W`q%X5Zd`#J|R77RTs}xOt^qb9bf#&f=R1bKK zB5I0r@y6i1PADQ&1mg-95h)@n-(;X4D{neohhR6>+}!xka=Pp>amUZbicD0ts6RX{U9d!}fVm!2QN{F*6=WSZnQyxU7g7 z9BL$NFC0`vhaxU7qGJ)Ais;Q;7ty(hE=BY#;!5dsEuvcy-HW)Q2*2sFKzbZw*%w|_ z#MMQtC~sX;G_9B2xmTd$EBIB=r-dBM*2Vz4;JxM5l^%HVfy1kMa+`#>>}nC@rd}t!Z||bYhDqL7V$(8 z3mKz?j~B6^i1}*yjMs0~e)nO)E|L!Ai-ShXs#zlCrA0g$n5Dw9BAzMY-6HlDvAl?9 zi&#^{+9IAS;`t(07V%;cF9g{v<$Z7fozb!4| z?ZEdfwNDz{B?(t(EW z!e2%FT||`<0|ZG3U-ChN1h*1p{)-t$YipoEqsT*xx# zSG~*4gOYm|TCGah^O5zOcA{FB%qK9c{V<HvC zc%Q=DR& z@-L79ze?ol627lzZg6_5JlQ0;kY@6(=N(oF{Yp5lu~~3lR{|H|!-V~XbPf<1C>$gl zEF4n8^&&%sXO)=+{0-tHH;N1wjwoSd2{)B6ifyulJ4(2-gwZA3qO|eZ&6pt6t!$sN zGggvu!tuh}0-XsZObqz#C2&iS(M>AhE(vFpFj-`p@NVH0;XT5sLhc_j6tC$e+$+g_ z!uw0$+p4_iHB*uYgb%XbxmFa?i~F1pmoTSfM^(K26>$At?@ctT{MaFLKYi$#_QmkOU0J|%owxQzAN${1W;!VvBPv3QRh zd9Gv*tT~td>@#@@4NS_}9EQSgc9G)F5%-6J}KdU>|#AEo>}^K zg|eqAmzgB>us$upx3={EHFX`(RTV*WldISjFnq=ODgK#!0Ta440_F!4hz1oY5`{#G zM8Hr4LBXz|SO5!Puc)Y4P^?E$5y9R?P!LqGpnwQsyL;n1$DDWWxqo(cc6MfV_nqYD zJ-s?-O$KW-s0(@1_>a}xPdJytu#P$zG%)OBF|a=v4xK+r$+cNk=e0w7Kllz$Xu%>|u9Q_||S$w-IzyD*{To{EQXy8{Zpa9u!|ISHSA`Xn2H^DS4aM7W)H)jvPrXhQ7GOhku(nDnNGZieFw`x*8(9AG$5!xb40G8}AZVQ6W5|3w@(t-j3+ z&E+jE(1%t9;Sh_pY6cg{sP(o~V6_w)ZsikA4Ov5FSvXXlQ@NF)wejT|p^e2SvCtp7 z$C{xsy(*RuZH4WG?F}77*xJ$1DdC+Bhl?MPNRAXa%8 zB9y92KL%W$=Y(a#?!q31<3&yo_7u|LUWVQYFE^Yhev+_4*hhG>kou<>P8IK)NKP}p zTqDk%^SWMnA7B`0aR;d1WGW437>;#xahz!wZ1~*pg&ZDY7)~PPDnqs5EW_DqYL)%3 z>V_I>R7mF-hN-DmDd74#S08z7F@q!J&y-Y{tqh)Ls56X`!f3-7!&n)iljlowoMF6y z4pVZ0VS?deDf8n*!zA$w6Ujw}IXvkaXxBpFqfKP%2zwxRw=Vn8o^>7`ElYG(*As{Ojn9;RY2OtB#B4Msb$Ybdedt znZlcdHw$kO&aDlV{HEu?z+5!RhB-U}47VHZFuZMeNB-PtxF@OJyA<=g4Oc5=_p+En zxKFM38y+w`s3<*aSZMK4w{wLL2_I&`i%>q#@TlQ2eSBQ_gmAuaQz|?u@|5st;Q}H1 zK4W}nd0c?c8J;)1VtCc?g5gEOONN&XT%KI@yy805%B`0WImbnY*CbpbeBH2Eg!*qN zanyM;k+92KhNb_rxlB#edDrlsCi@xJh$^`u9|WP+4`k;YciQ!X*k@s); zc_UIGR~{>$p{ovIISbFQ&G3g|MN&E67*>i??JJG)wPBUWY9Zw;TGrAUsjW49tD(PB z>-UCrhV_OY48IySs4SyOsJLu0}Dvu80e;fWW1V^5uepTjs-0E9-EOLnNAfy{R zIvO~3a_sEb#nH^s+_9@;H^;sXMrn7)9*&e_ACGmlr;zJ+FA*NN4IRWr!p6eAg$2SU z!pdx57j`G|YU0%Hx3!~<<1pu4R%q*J=U~i>JZ^o(8fZ~rXfHwu_bayY_#^M==%k4C zEsxd?7e7MCz#b`bl<;WbF~Sm$iqWt=)gG}!@;fsWI~2MGr|Dn)4d44wiB=k3;pOpHKPedri-j|XwT5QaKx91l1i zbexmezgNx-bJRM{l`~^P7*1=Bk&g2mvsII$xXis1YxAT;jM$E=}@y*3-AijwL-qk8HTqahYSL3i5L4 z+~BxTHm`78DRPyNqg*XAML5-QjmWi0>omu8;@1ng`LoM(M-zTq33)T_95*{|p||yQn+he`Dra$t=@I2DvpJgYZI0U=cX&L%`eehMj=L11yFG3o_c&it z7L3MIfzOm<2Jd6ulZ^8ynd^9nLpWY>JS_Rs>i&r4J5NKf*Q1Wd6tTyJ^My|+K~FlK za`5Qnoo!tq<9Jp!nTv&v=OlmL@q*(;SzfN2?Ux)cbG_u}G5C~l&w16c zs6Nq-*Br0Q$eY@o-f%2dMwl!PF(?<21-3*wZ)u37GQQ05w&NYydDrotgiEB)F7NB( z1R42IeLr%1?D)j-Y2yEC$7hbum9j4!%caJ#7))CD(y>C4mBO!tUkll~%Ky7-BL7B# zS|hV-9p5^>Q+;yBU~0Zs>pFGp-!$;2thBs!aZ$%yMQLfeZBcROqIPXNrMr%)sjW&E zr@M_9Ilivu?4hI6KBQ31>0W1!>s2$nD&1rFkaU;Y+H^&19+j@B9#vg8wz}$H6_fn_ diff --git a/images/nginx/rootfs/etc/nginx/geoip/GeoIPASNum.dat b/images/nginx/rootfs/etc/nginx/geoip/GeoIPASNum.dat deleted file mode 100644 index 85c2cb3296dcc11843ca958c2a34a61403280b3b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4638365 zcmYgZ1^5-k+dX^l-I?v(`=h(NySvLS1Qk>a6uSdN5k*jJP*fBZ0}&II?(XjH?vC&5 zd;izZ=b7g`XU@Fy&O7hS&fVYMyE?K)1=NFi-^e8u$h%3KRqG0qzBg10{gwKntKGm5Hh{ zPz5MOgNdp%PzER~ynufyN0d0V` zKs%s4&_(nPf}I3A3UVTxPG{kzCdKn&xdymal;)yb&*ht_ZV+VajnZ_JAoW{;+a#X5 zfUZIqXLljD%S^ig3^g<5J4C-zQk0od4{7QN+@0;q8TA70174OP?iYLvcpP{@_=AGI zfro@V3_K#FkKmozSv)G$p_1w+B!(A&CxNGcr-5gH=VU|<$4H(P0}@uB7bTNkDlba) zrL1vZpdauG&|mz2!JU~I2zVEGP51yo=IV7J1A#Y$yeT+H@GZf?fMGF?VW)0bKM zuYgfmPP1=;Gn3S0QAPvb0p9~ZFe>0r5q|{62^o{^^^=gXf{M9`gV!0JZ}=fQ90R#><2(0u~EdlGT@T$`a>tQC0veg{)#!z*b;&)?kg0 zwSwye*9&eC+z4zELT{UaRg)D7oo^G7gfURrnH_hpkX^uTV2^NGX3X{h`$ajBRoIuU zhk1|!+Q3x__^9OVB5+KMj{_%wlRP$ov%opoKc~6GvN5*szKIKL#!V zm&NB5LBohInXBNX8xt0;PQpM^swo4e0VSME#-@LdxPnuZWxzI2XNtORigFAPT|v*l zLsOJ5NHH`J8Auz*F;KxkMFY8vIG8+wxdmxYC9i>eQq6Cmq!5Y)gcLMT$UtG?MGO=( zP~5-|Q&dq=mP+?CQxx?Q21trbRi&hv?ls47_ZhuYrD9 zoBjq~$?}YGX6OM1-VptD!GT#Dw$kiPsSc7j8N(0*ZyWf=z_$k8F)-A?2m_xPc-O#t zVmaKv`vyJ`{;}YP;^!m5%!qV5Oqw!bFy>Fh|EJkmd@iljzclcLa1K3ENXElg21Xh9 zI%`i$>Z1*OXJD*>pACF3#$yD35TwnI*;$bPBq9SCXW$nDe@XRM1HTFR)4=c9UVmiQ zC^Izsj?en}+rU3!HbIcyGB%S9Ofhg=?(U`V_yR0(6 zDm~<$rpixKYYnX9wLeX*H?YmXR-9YNEB8n(obg4BL+U7rjBy@)6_8o$EGRfig?0+KV9)2 z@1y}@$LZ>ffwLTUhI%G}a|X`y0#D%P1TKg{z6A0oaM8dend4;xsRT^kflpIc_(3Bg zIdA=mhG0T4Dfseqr4kr7U9sdOpcAkXuto6%8L*Rpo8>g~69`0M6HAytl!)iWlKzib zF5$To$RmUu^9rF&fdmRBP$hw?2^12sZ~{fLtu!c_K&b>ui`!xe6qn&jh(XD$86B1p zPEs*}vck({mGVL=2-0CCA(ay#=Ufl3(9lpDm1N@kkGTbRsAD*p`ia00g`aGO-SCUB>a z+XcG`b{D)uaIS1ZcDzffJrd}dz}>>{N#Onj9!TKIbaih6y@Zh8CnVF6_+VD=oxnrc zCYtq0;E@C#P2e%&4E56t^|)l?$pl)?P)`W&EVneQK9#`JqLb73SzZD&R5(*TCuYwJ zzQFaJsa{OPe@MQRz{?``6=bh|(*2bL`ipYM%s5?iG9ZCH3GC&ct5enM2@Fi&jRfA5 z34TX$iW-!_TL}zKU`PVFW~pHbyfagMKU2L;lEBQFiq)YByqmy#32d3EJ`jU*Gu8W9 zLh-`{K1$$YF<=u5d(qqQ1nSLFpCs^U0waWfmcW+@e3iiGQf2EG35*opZI)t{w`Zdg z_$CqGr+rO_az8-)Hi6Mn&3vrCJu5ymzE9wX1b$3lOaeb8uqlDf3H&}wjZI*30#g$B znY$%{UlRCL^a%<4Cgjfq#tZp9fj^|M7c)luD}jG9O|#VBl1z#$G$T$FoFrY?IyHf5 z3CvGmK?2jIX;!xH3?VZUpc(tlPGF8Ga|P!K{yX%-1Qv<1CV|BXEJl4@@;zsGqjx_ssE?W}Vn!xS^PR~-?WSS&9 z6WE@>4iU+z?8-KgbD)g4FM<6DbV=fxWPH&bNFbGjnZ!ZaSBDZf%)K;Q9g)3yDS@NB z3}>rj2^>%0gg9jNYyu~RpUMm&ct)`IY}vii>%1WCFYx>q{_Sb}xYvGEJtAc#) zVCNY1uDkez6kV;5XNx{vcP%M)~ z6;a5`CQ&Yl@=~pkL?s~=lVD-%$=Ry15OYqYRAQ+F8Ah zkZyBSJt6f48zj*%iAKU3C(%U6OLJ7yB$^3tE!bSJWfCofj1_a$*Zo5b<~Q8N6YB%YA!!-9PTA4%fTBpwq^507U%lJi#QNztFmwmzK% z4OpH_;`t=rPU4*;UXa#)NxUNDMZuSncsbjvuMqa?pTw)e2PN@ZwsoM80ZF``RcOi4 z-$>%k|0r)|`QRjmWH~K|Ch=|(BeKeSNqn5;?+f`r@WUiN%Ifb(W`-p(T$E3;`ls}h z&G2VQe4f?6NMfY$F9j!v&DX-mB=M7wZv?+hVzdy(|6LN_XZa68eoSJI^c|bT&!Q|5 z9GApDNlXy_OA@~(@tg491;;1xhmb!7t$FbV_$!HgLjF#o#ymwnF^Ne@%oUr-NlZy% zmhh>9GX$pz(s+8dJ6+ApinE1KnUe$!NahL7Phx?Pg-I;V+AI>ni-?7mEK8GECgO6z z6@n`TR|(SQ=6Pyu66=yEnL?=))+ez+n*0YXut3Sf(Hc;39|3c^VAXHM+J{1ah$`=Qu-Trv=XlK9IzDAy<>}qx=iPFA81~ye!DRS9n&>|6i7j6zmjkl4>G_WGc>c zN|3}9q6BqD6s$O3IoV#WD4rnw1Sy2VBf%nq=@fEO$dy8FsnT;kA$d~Bn^pQq4Ed#6 zAccZiy-*5;v%LR&RaAH}!Qz4?1T)*FbP8os=pjm3!Kx`#OQD?b@`4ovD+*Rhp>hh} z%~u=dt16<9uv%SshZH)dP$Pw!Dbz}#b_%UTuaiRE6dI?{B!zk@)EBXl;N|(MK`K6x z8q)Iu)qTPL@=T>^3e8ezkwQzcY%WNh#~Krosb)y)6xyWFHidR6v=_6CPGc5wVy6^3 zOVe#BbP;lW3OA&1P1gQeA=jnwdNzg|Q@ADDdXtcwQ}|I@Z_QTeylV=#OSM}HcVz9m zr@#m^LEf3dU0I#odkVi>@E*Z?Q|Oh#eJR|Z!Xqg>n!*DqJea~mDLkA)?`+?xGBm?G zEu>Ehr5CF13*&4&#vG>bL<&zz8maUX{izh5PT?8x!0xnXVfSZ6Vc)R})e9-SDAjo> zyp+PrDSVN_$Q1gf&@Y8y()5bp8!5b*LVw|}3ce;dKyb@K^?C{evz##u5>E0?3U3J? zEI35)Z9#jHYQ89*!q61nP2s&1-WQ$9heAF`A#+%LBvqbZ9}9V4ks2=K6TwdfM+kl< zNDrTfEQN{@V zBsf+u(>hK#NBl*|uPOW{`<6ebCuoK>dq zoLLx0 zl3Os3AbsW)l8+si#E}#*QP4yo6NOEDsqmFT5fepCysXeyq2>}*%)~Pa&ngr*(R_(2 zVWOmoQYK29*lc2pi83b2n)uwr7beP?D9^qo`kJUD9tSOCdC)|4K{azHMYsDjc-SQuXLk)!sx0G3#U^ zGZ4)>ivO3FDk?O-#>BNIZZpx9IX7{=iJMH^EKN5MWki}W!jVhW(xvK_>?pU2=krVB zfN5~MiEbwDFmb0;GtRpU&%Z35*IijXGr_z0UB8JJB$#_m^fK|di6>0lXX1Vn51Dw_ z!~@c$cQzppGVL-`&VqC7W8x7LkBUu=WpRW|1)Cldg`9)3Jjr!8@vMobOgt@l$mlJW zsprJph8wgb^|r2KJ$ek3{^; z#K$IvN%v1U+%m=74woic4q2u?HIeBxLRu+)vn=*7(!`f0W}BE};wuxQO#EqLyos+( zd}HDliTqm=qfPu|VyubpOnfhHf0X3US*CuFIWm5F8zW65necu#ad??xD#nR%#^zVa z=WjBp-^KC|!EkvzDdy@g6BA8L61RVw_(xhN2xjue6`X8hiixS&OimNy=_Y1mgPAF* zm?gdbjfVluH8Ib`3KJ_$aG%VVFcyp10uu|R$}kpX_rnrtT54jMiRI#)`DZ?9!(bTg zDifavQa@RSSk*c*~p-+;3&8vQW+*2fE`)rAy5bvN-309h*W&J6;vps zkXGQ{&QZuE9dj$>RmdkikKml;D!=;QC00OzRXV3nB1>VO^C~`mizpOTD3%?a!L!hy zgoP*$OwLV1M>DqejW&=oHwVnuOPNjmZZWG{+U6{;yzSE!*- zTcM7Mz137$w_IhGsg~Gh=3ZA?>j`GYWh4z18Y%QrxKE+6LKB6X6mC{%s?bc~1{JS+ zb9PZ^tI$s3WMC~7S}AbW%mBApYlSuv9yxusSLmS7QK6HH7ndQi@UrTx&_z;xt->|* zDLKik7o)vS;d%vrrf}AD!Y=U?B!JBJqbn-6DBP-Wn?hHG+ZB2!^i=4k&|TpUg*#TVSuu#cFySMqR=gq=Cw>HL0$2NWJxctU2!3_qyQTNd;o zg-5v4mc~y+S=Dtxro}bjW-@r%-W)dXbTEcEVo} zq}XAFdSFEyCm+TRTcP?XyrS@t!p90fu2B6IhA6zPFnxu3Rq!>10YY9E9H{>H9o8EP zZ;C?8K|Oi-dhyNdC?$6Quh;Ql*E9(uIU(lNF{YOcjIaqEnnEO>{^n8MB$9 z%u=8@o2P*^v30J(yey~X0)>SNixd{~e9$PN@#8ABgx99RZm#SqZYwNPST1~p!e)gn z3M&=Xu2QQMRx7L_m+D5bStqz&6n1CXAPVhSHt__Il31;_^0b$xZTtvO*daWl(2@r1 zOC;Z;a7N**!d``a3i}lf@Eh0F>ZssBg(KqXkV381>aZaDl4qP8lVFZ3oKQF^197a= z{1gzKJQEuOJI6zShqH#OaY5mt!d1mLieiIH65eG6PKVViQq6EfBcWkxD2=2>N~4d2 zoe7@E@U;G4M_asEQe}{I#c@3iUn93h9*saF)QB|F*)Fu92jZC3ammpj<`Sfbyc+p5 z3TPCRaj8?xFUT+oiCIyp(nDd5B8*nTV=GB99cPbSN@|qS=qQ$@HOfewjbuh;HL7S- z)hH(-{gl_JAbu)pRFY^JQe{y{Xi!a~x{lYhzD5m=ni_SbFGsAU|F`b7Wvn`a3?LIm zJ*j5q+d#TB6l9hfYc$blDsJhyjYc!!%{5wRw3N|X333!JMCeB(Np7Ejq5aSlVGmbxIyFAY@9c0+#>v@Y^XP9bI6qbI}wtu8nB0j#$Do}l2q^JOTQWqWkxT4Wt<5lKltvagln#KT)O;UYbW1z-3jbAk05aoT1 z4}`p_F-XW;f`bKz2)-@&j^I#1dVW{qJ>ie9RjjgnDAg|oKN9>{W0(-O4%hfZ<5Q`Q z5d1>$GmXzR-dd|zXf{&BZ?ZnWlIkeIuQN@8-)f8&!YjXyNzW$pjen4~dTW4tJT3H~kkkKhDBjyq8Z-A)lQTX1T&b()ar zf-^K`3gNtF@v}^(IY*Sag3JINvdkBLk*2Ss2s^b^> z-}dm12g5?b!qYCEagnr;vQW-Oc^jq$Wnr0xNEabM37M>$W@riY6ED6?J_vQWfAQ44L?tHPq(v0fFkP~1WZ3nfK)VZ9os9Fus_6z*MP^sqLLCcLEmX5m-NG#!R80#bH^iaVu<+;x^~MG@ zV}q(?VaEogH>$c8>RIS%;cg4{Ei|xj8~s>lXrYmX4i-9EXl$X0g%%cCT4>7jZj8M( zx6mxhskGgwdTms#m>&!6EVQ@KhEujcF@x;F!fHm(U?&TmE!<$?MhjgmTw~!{3)e|U z8nYwK*yZ}Hw*fNBO%`tE)GXX8t+dIQWeAZSf7_^Tx8j@LL7P-JA>A$9!OgHy-D%-2 z3q33x+^CFAs^})wc~cx)Z=!{JEts2CFALvqQgb&c;+{?FKCb3w)oQc4d$W4L!h;ri zTj;-8eQx0k3lCX%*g_u*k60LNVF>eV;V}yXEG*fg9=Gs>h370hFJXMXSv_gtDehPc z5?pM_UM?{DE%3$JlrTVjWO z1xbF}qF%Q!(83!s^w}-yEemf-mqCKt#nRat_bRbfy=~zm3mvoPGkXWP_g7CzyI*``>i6F-&e2&PDs zv4SHld}(1iFM(a^D+@=qsh=&3voOlS*A~99@U4Zh7S?W8Ionn3?P|1z@3`pO)%O;D z6hi)kg=e-ak}(#3Vzk145!|<3UEZ#Ku~2)5`qRRA3%^>peTRBthx*OJpdIRW3x5b9 zpRz;!W#MlN)3`1>)jt-t?NE~}OtvsV@-|Vh^3HfhQ!F&!siq2EyHk;8l+SjmGdtA` z3o|XuvM}4iVy?c0ITq$xSZHC9g-*NFqr22RCV7{dFG#Y$!kAr(7D*?pUk?K~5*%1$A>IK(DJgI;^ob9>ZY3;Vb(d(?gl7cH#V zrw;HUvT(@4sy!w!!jpT|;Js?o z-gtH_6wg>V%X4F&I>(*1PyMq`-Mvqp=QXlVT@a+%B@34=T(NMKJ7mA|Z1AUCh7Dyy z+t{;DC2S;xkcayfF~v^-QA$hIve9I}a%|kYU)gqiI9$6w4#2hX;(o<4bieX#1UCNK zuU70=2llJ{2UOaQcWGW5O%EuN92>c8AspJubJfDpL2ULC=1#A?wG3J0`l{cJ) zY!tRp#Kx=xsyI7x1rMmAHi}6Mse^G0C2f?lQRSd&dQcTOs7l-5PAEfH(n?-d6sEL- zjfys^I;iHLl8wqXUbXQW`%<)VpN;!%RI}qhmYdsXAz@dyQA5V6X`_~n+BWLgsBfcz zjk-2&J*ev0m~c=HI;ch+RQqMbQis$vhg3rwjchb#-fT1z4-Xtt0}rXDbZdiz)!B#Q z`1c)BEp5y=qHea)%0_E0&0*EXMi(2`*l25`osFW0ReKwqYz#fDS{zm#7~WykQSiRQ zYRqBP*~U~MD-Ww{ZQN+%CL83}30^OF1E+aJQM~hr>UTtaa76ulMBTz!*jRT&-DcxX z8+Y00YU6h9hoh<+r+idhe^li#j9T2@W9m^GkJ)&fvp%Mt zu<^8wXKXxa<0&rFG44HkNRePpg48#vWI{+xWxA8#dmwG04VS zHa@rUg^j^BhS>OotFubIE%=@wtM3RIO6NkB9*-ZAyl>+J8y|}Dk&TaSoELpqw%2eW z#ZSb>^#wn*F(TXgnGkj#Y2!=bKil}q#wg)G+W6YWH#WYP>bHWU1v4Yk=XW+T&dGnU z@$a}}#Ox=*v4WYv#tHw$#;-PhvvGrjl=1fQ3H7Iqxi;q67|%=I#^21+2{qBiBwjwe zBDkYYsM9BucT!b7sV2+%PPH-3M#qzCid0EnI;p1f(&hr4R5JugW(pa3Qq2}JC#$bN zsZO6%RZgk-HWu*GIHevrrQSNF7TQ?ErDrNmsTrr#;Zv%}X|>eGG8@ZntgvA_a2%}U z(P87bjT79HHrCkKX=4{phSTcp(`qdPW)4rQ^)_0bQQK^6u(8p`CL5b=Y_YMGb3Co) zN;!L46*!|Ror#g+cIm=iJM8%Lf@C*OP8)~0Va}+YXVhLB2V_U_b8sJzotmzUOTHso>ddYAmPLZds6V&S*6Y? zKw6%gQ5x(@0&c$QOeP~SlV2e&x5)j>n1 z%RwgxogFlG(8NJ&2W=cQba3Olk;f8N0h4nB17k%Jcp9V)lvPr`Zu{lQI6>!Iuuca`1(Nk=fQv(m00i zFohT9CAHLv|2CQGV48#J4rVx*^1DDi72aD+BQhehX!376Gc8FwWw)ywLd%W9Q_ z)ehD;c`cC_&RteTuc(?=)CL|wyx6a*!wxn%*zDi{_tI6h#lcnw`yA|du+72E zSJWN{ORuQy4t6-$>0lSv{fgQxqu+l;^}V84W%=%kQdiYpo?TaC!qMwoRX1N%y|1c+ z+z(9nRkiABJc|QY)e#3r9UOCT+`$P>pNA@RE$AN5uR#xoo(R1X`U-SOLpL_`83$(_ zoO5vAK^~VsxzZOHJX4+2zKcr^E;}$>BwYU9Q(s{k4ZYjYS9v)bnj`Yxad_U)?;1Mk zBIUwzVY@J0D3`xH(mfOUoT0TFe=ammXgV*O&@U&n{jZ#Uu7f>fE9XOzN>oy)YTO-ICP#T{Lmg)I|Xo1zi+!QJ7Vw zYr81oqNt0iE~>dG=AyXEFFIpaC0vwru{WhFxP0GLmvT|sMHzNaX;#a+xGts3xhOB> z#gu0C11VEdx}u9pjL_7TT~rZ5UP0WFRCiIsMNJpA7^hI*nAD!0-b{6d7f;ugU*K*34 zCas^*`g%U%({UI#xfr4K?^@sNf;dn3Ey8aV+^BU|H~v=Tb{E}TKGf3PWzg3wO->JY zx!^a6_c4B3_i*`SL-%xXw~H}sWgcvOovl|``d$~rUV>*WeZPwbTs-Kaw~L2dJnZtG zTo1GLSX(c!bssl=+Ed2SkGXin<-Lu5RM2xY`Qt90aPcJ5<>(QPeoEqb&e7wYIG$%Y zO&4=r%yZ+fP@i}4o*RD``~veYiG9gMUl;vkQZKu_7PzA{r|^o4gRUOxqQ8r0UHvL! z;DaC+16;i6>epSo5fcn###~K>ILO7%t{&pzZ6R+74i;SPYBs&|ABFn6e5~r}LY}Va z>G!##R>ddk2QF^%^oK4!a`CZ?VJ?O<^Dh2y@rjF1c{MTAcu;)i;&T^YFhWm%?CEKq zzU1lLz8>jfG!yIVFI{})Vw8)oU3}x>Tkcq2clLD;U%%?>_kI1fuO|rd-1v?IL4WV! zkRKl-Bx79s;^J4)e{wN44j$Cm$}&y}jdKEBEzqq4{hN!Yf;i`Yx)|@GO{izO_{+uL zE@tp*4fVJ{|KnmR50Fq#a52%vBo~uiOc7;v5F4<1;xWu96 zZS8Cqb7Z;ug|R;0#R30*_O)x5+ay^ixer`EVw>*9Q|zT~9uLJmY<02C#esP9V7rSQE_S-u#g*EuhDQ3UNKcORnn>?ITTHhh!3u%4A1@WYdQ!Y*m zKjXXkF8EKgTX#Knhc%|f#aVsKILlHg?*SA<*@W7@FLIN@=ZBJCl^L&}RiI38RN zrf?;wy?AKLgDvF09yl(WJP*Eyz(bfdpcws!=Mp~!JrwegTX-J9ydLt2S$+=%vi6K2 zdg6- zw65TRPlGE8RubewSMgBQLp2Z8Jv8H3Il5MkuHm7khx>BkozRYohj(*yZ4Y1O=sF%I z$6T6)-*lYFrLXlsyiPFo zuw&N%&oh7 zxWmKX+FwAGmq}YjCpw6!xJ9v=X5+g%vH{- z`OVSGdGyFU`autW=Fz=9Y{;V@l6hUtqZ{SbeLOtk;Za7IS3e}>G2tKO)lYhO%EQwh zo?!y>>V0z#iz6JE~{Cbv$3I%k-0{Wl)dNwz<2a@CYct<>%RF2zpbHk%wF>HP1@&?dD?AJ+s7DvnD?O}Y zS_*1b`EnX@dqKU%!rV>nafS7MFa8Sk zfQN%#{6`k~%))wmVa=D*j__*raFV-Xg*qyDOz^meQ-!rIqEC4^EsE>o43B-`rjK(% zE_%2m$ zj5eNBeZjy-C?xWc_K_o;Ho1M|lG0W}qLRl)H{tnx6!0<1$Jagz`tf&9*ZR25MQ~a@rF5}};5nb6wSs&$m zl=m^Gh_2|zCu#*jR>`*((Uqi$g!WaWS5+U?e0W7;rASd-(?=~I3ybOo49rIzA0vzE z`aY@_)%O+EFBH{vebl2U-xR-FRP%ZApG7t8>7T(g_R-eI`eJclO?))<(M%%0P*gYf zQL~tC;iILGj>U8f3vsmom=VF??osafDju+D%e01?~4efmd#dRl6yf|<9 z;(4_z9@}%Ehl}eW#r62&`g$KX_;{OHEv*+6*EjmO*~cwDZjuaB*f<&akNbGS zM^_1~n~&~3ZWnHq&_zn6ILr70S4$UUws1mxDkNbS|@o}+) zzTd|KJ|6P%u#X3QOevvz3zE>7C8JPeE35fS>PLJ$>fA8+`0 z+Q&0KUia~8DSc;2{j84{e7xx6If^AU%kx5pmDDf!c-hA*KKlC@TT=J+(N75ZW+^1E z`gqNUUrG-UtWZj`u-dVd?p;a`FQvzo(r@}$RZ3SYtq1woS4!t8ty`7WZ}}MPV~CGC zO6#Xe>%pZp$vZxV%0%Afw)b(Qw0_UW+|s-okCEjAA0P4~Kx|n3I7>Lw;XXd`VVBXL z`uIZha%J=gA)op9+((BpnuV4uBYpHNqrdd=l^Bpy{Km((KB@$$8ep`K?|f`wb)6bq zMt{$=`%t58mNET?DllJr5omPz9_E2o$ESn6Y*kNG|p@M83_*vBGn+H#t$ z{}NVNSY760IhV}GcrjoYG+QBER&sBMNI$E6tnqQ6oX%A~?zoQEDX-9jYJ&t*wY=tc zWE*{K^0ArY7L2PbBwKxK^ReB>4o*LS4zSb5E+40PEc@8)V-J_!$59`9{rK;xgM#~f z?DzlwFRTMTT9l9f)H)=sB!`9EU0xsK#V-7m;0eK#f_$ow`5SFuc}@K+4}Tw*d9eF9 zF9!5;Nyr6WfLVnDu_K$V`e3hQ5J$y-wbKxi5S&zAe{F5AHTp(B&(}f3&u)s0#)t#9O9{dQ!!>+M}X=uVTEniv%bdpjd$70m=uc z5THbWk^xEuC{544&O8a+S5cP@e^k7;XjE&*-|aC3lb0$dy5`T#f3LuH*A;yU`T9A}T-Zp=FD zD}LztmH@W~U^NpAH#T|K0JjGi!(O3YQdu9Ytnc80(ocYU1Kbs$M}WH}?7~%a11UWN zbgdGP@^lqVu^01GML!teY88E7fQeP~)++k`01pJnbfIOvs+wIM4$vpS%ZwoazukL; z`)#{=D!`+hPF4MIRsC3i#{;}pRX-76R8`ILq!7mTbbx09JR9J-0537a)%4$0^^&TZ zKQ?(jz`?5e1;G~uqiXt*YI;yL-7ml^jK79{CqVxIuLjs(T@T?90R{wkE5P6YpH|Zg zs_ECcv8(HW0p1Akrp$K`m#n%jRz05Sy@CU)>yg#>B!QUKcfV(;9kcfOiAD z7vTK>BLaNJ6%6oE4L!St9vxH2VZ!N?h2ke7ei~qN4b4K4r*u$Le;%Mr zP5p(mjuh-tGj1If;A`%^5UoOd6X4q*eq**+h|vMQ3ve{Ru>jw52qucJnygema&ZIf z39vW7PrM8RObswCz|R531@T+HlLPz`;8)=j1b-9!E5Pr(c7*>aI9~9fnwq_a3;r$2 zKLKV-b)r<+I!VYH5vTA{lGll+i?}qvvH&vz%oKfAfVlzYNz?2Ab9iE`iC+bAYw7tS zE)1|p#09(_YsEt^7JZ4}?V=2>rB~L{%LA<7wOLnh53n-8ssI}TYz(kEz?uN-0|a&S z)mnNjSE{yN$783qzP+}dTw5Qi9lLE;M{g3JTLNqqvYC6hjviP?Zoe6L@h~L>;QCA{5Ws z+yk3bpL&{a;ti?CH}zqJNQOv-7$f3>dO8t;FX`>Cr}@I38G?jWtG;HF6~YdYD@5)P zPKa{#wHv|sSLfciQ|I7yxmc|#Nm`OFYs z)Yth!6bMmJyyce|*pYG4Ib)-rA|Z-~@j1z{I8BB(xqduo@en0KlnhZS1iwM37ov2C zG9hklsCzZkWkYPLuPcP87=n*e%7rK&;%t4Lw}HO9fvyyya)=tzk$2`*LcGvGR}H~$ zy?H~zv8sg_)<9Pev7&)K*g)3|Q7c5Ep{^aGQbXOmp(d{*N?pNx4R!sHSCDQHqG1@n z7}F?3^AHOg>c%0Ogm|K%ey^eay`gRzqM1yG?<{d3-dwc^vA3ai8tK-eKN;ewkk41q zHjH0HX&0hHh>p_KUKIA~6ryn>eOHJcAv%ZX65^T=*M_(`#4YT;Q(YJ0rVt|=>FY!A zrHC6s+|Wqh7~+9OnuIvHk>-zNZVho;h^`@S=X}qrm5ub-M!Iz4_^+659HO!2?P&K9 zcQA+Yw#=Pj{LTymAok>9h4Ewa#~51}|JC+DhzCR5*;wBz*h}!f5ce~^jpM8mdvlF0 ztA|27EM2~Dtp91O`-E8ESRWGpNC+yAa-gDd)8icFxOze`r->#n(?mbbRz6_i2FTIR zgm^Xt-x_)@#Pb{|#ET(b4{@N0eksJuA^L@Qg*j}Zdp6O1!}zB6nI`e$`u-u_ZxTOP zSk*+o8sfDO4Yt4G~U}{2j3& zADT6IKjb55K4iw+=K8}BABA|lxjr1?VHjvh~rX`fIx7+kGLvrR8SD=f=bjnrf2KA-)UoJ+IuY z>f5HVzND!h6XGY%lv55dmN^OWONd{2)i>4S!~uir!bA+2UJU9*|) z+)VSC>R&Q6E$?d!`t~hD3~#^r17|BdXf0yWA?>i{IH#VmW5azVrz(P zynaKh46!!EI!4t@^YQyCUY^or4V9*`LO;8jX-2p{#D)+XL-2K9#;_^GX0hB7;&L<1 zmxpsT*L-wbuDNEw+e7RK!6*3#B*L8`_V7Xuu`9%GPWEt|Z8~A_`Jkx3Mkp1bbQHf8 zRx?7G2+dpSM_TF{5%@T|tYA5M7DA=mRU%Z)@@hh=N4TM7{7idL%Q)4w zqWB@qsFwQgmbz|)dJ%4q&@Dp!2n`~%j^f8e4I?y)(7%=DYZZ+nG>Oorm2MhgdrQsl zcTTs|e6-k1#O8u*ZNdBtZzaf|p;2rT#Wx9UBeaXqK0=2GH;Y1XOe@_nLZ=9wBXo&y zJ%i-jBU~#6ms@GtEN&H->mm?YWw}xO+$1)&TgOf^`YjP|jc}XjT{%kYSf>GTKx_Ru zf1ny+WNXc@GVh4uuYK=~a94yL%ufWqhj4dBYkH4yp*-<7vYr%10%d4O8*G2MtDsE_}6|wgx94b zyJuVx-;6Lssx%uE;VtPtIBQ1n?W~h`vSYm$;eB2OX{6KmAi{?c7I8Tk=PLCPw@MV> zEqokdScKsbK8Y|R!psPtav|F2(Gk9jFe1Wd5k8MFs*V08!nYB=;95lZtBw9L!m&1b zl<==2tZ1VtQu$g!BDvZ|7i_B=x7GKw)!#?>Ap-yL2gdnhgfS7uvtxvxBD~aAkBjgN z-L}Yxc6w@rX%Pms)6*lc&;vPfOglX*!u$wF+G+CH47Ht}BRDt0 zJi2YC7q!!yrFB7stL=2uUYBUEIkhDbmPR-o;Y@^O5tc{T9AQfo|CVz_gf$V?MpzkP z6;C|*mE~$7yw)O(bvy%!3Y((%<%jhVHb^V^Mo}_9?2Q zw;;NO2_Y+@R>lNGzzCtB#m3!>!NAA(q0!&qgWab zx7R%U*`onS=aiT-~1r`fEckig%r*S)% zfUkh2!JnaZOruj8ozv)&#?5KmlEyXZ_y+#^G;R=bt>ATO4D6_>v)sspr$L3B;)sr# zc&k)z6Qlu~x~4(GrfD5@w=}w^aYq_=atS)=2A%X>Y4k|P|8`2Mlit)Zj_s)6J!#yV z##WhBuQcuxvN(Q z6KOn^#?xs$DIVBL{TVTSS@^TUpA&pu@C8BkeNhNU$++q(q@Um`g8c=>Kcw-UaE?WrABB^Q;mUT_&vuSGe$ZL}oW{5`#>=?Br17heKhpS3 z>=$;{zo$XBSpF0nihrf?w~RvZ9}!88b=HiEWRfV81*Zs36`UqGU2ulr%rx?J ziMtSIi!w)$%3LAy1m_Db5L_s@NU%m1y+p`T!DWKW1y=~J6kH{^T5yfvS{`?4tmoC# zMQ;&hLmC^Ux+#s#qA&)wvXEqyZK7`%+#$F#Yq?9vZoxfi>=m+4aKGRI!GnTycu2@$ zLH<( zn;ZRd<5C)z)3}g>i#c)A75)T12lwRQYC8UZxr`hna?m&jO>&UTK`IC3b5J1%W)4&i zf*gc7(9+Qrv~uuZ7fnBQ4jfTlk*X)0x}PMH(ncw-JGv_&<`@HXsxifQj zc6Pt}MHUxaEV^Cry5MucPhs;mMo1euU< zA>=~Xg_sNTE2{`i$%(qqh{?kJDyumCZI#vO$|@^a{zfUA3!;*c!-bqK4^^r>sH}c-+Rx|0`}93k?BNw~p`Z(e=#;La3cHYxei1rFsrBd-ci}@8 ztGZCag_15*aG|0LrCcaY{}UHJB1p3z6Uw+Ce-EA$2e~lV zg&~X%sj5~~RY$9;YgJXMYD%xBhSMMK!UPvakVjHSQAfKl#)Yxuan#0aQ<{}QPIO@s z%~>u?CQPGFp-!dtXa02Z4C+j(w6Kh!*)Gg+VXh1F($g^ z7cx}0_ei#f)zmT%ux0HoCBh=hb=_5oSEuQmap9~B=h)^sI@hYJ|5&`>!c`Zp zx$wCQ7a6+b!j}YT^D^NJ>J?dzYS^>)K@Ig4ov&T^hES3Ix8&O{d`GxWz2U-5f>gZa zLT_e%@4_7y9=q_wg&$nF%YNae;GZltD@!HqZFNaKcLF|8Zv3F)Yn*jce2TO$klhh}5?CPPS%l$Vn^E(#h%QMk_a3yX70LXiKw$8|~c4Ut6`O zO0uwQjcThp&U|)qqcfAcP~~xfq;;2Rabu(#qul7}MlUx8x-p0ez1`?XkhDH-^d%3g zt=4g1{oNSgM9df8%NyO=f-}X zs|VaT=*A(2>af$^b=88pYFk}()NNl`#~2bwUQowbJX2Sla^sh}>Wmv_38$$tLfOu_ zalwtx-8k>YXKo}H7V+g*t3)rlamkI#Y$sPeRgPwR>X$UXl@pcll^b8X@r@f-YteoyBI>K&@8Zx7%uIZT$~&n*7x#y!G)s{FFh z1KA_8{J4;$$@Wkt#Er)^pSb1w+xXp$r?M#3SJmpPer)iW8-KX*+zmP3=FvG+UtMzg z`jd5Ey73p`Z#VvNl0lWEDEH(4ioz@HwOb;4) z(AWdZ1HT7lJowmyfCoVja(a-J3yu zW)}6}141DW3VTq5+^K<@-awsbpo)1=+=EgyKlGpkp(OPYTT7m7|29yiJ^09D-%$q| zs?rVZ(SG7VSr6)XaHydw=RtW7s(DbIbt`yK*@G$`RAf<-D-l{YR8<{Ec2>?bIl*es zsqOeRJ*Xw@!D#j}gSv)VmpS#Q^*v}nXy}35c1jnr{n}79q1n=dRvt7ZH=|0lIiZCI z$-CCp9<=eGqX(VnxAmaC9MDGguCPj7mcX&ECNg9-Q;w zyayva7$x)L!59y=d9dAsv2u=iu+)QP>}9+MGd!5-!2}N`dN9d@$sSB&NZOe~m@0MI z`!~)QrhD*$Jj;XG%vt2Y91rHojPabD=YeeV8Oqeyo+#PmlvpT7UvAQ>sJxBUVh@&h z?DwHkOzLtEWQAPq!5R-%u2 z`tRfnW%ZfV9UkoSV7~`DJ=nzrS*3S7nR`6gOWxL4oolQPc<>!-o%GlUCW9Z)` zOQ#E)sP8=Z-h-d$+~K6j-OF7MexS3B`9C`OXPc;>9ln>W(nS42cHJQW-k-_Z)%5jQ@dwT7EWRMiO#bD;-yUSp@TP`;Jb2|nDxTQ?dhEXt zk^jFgjr_-Cd8Z(El_}_?q)MoLQ}u?1)Ed$_PC5-rLs}L`urGPDFLl#vSj=KZ4Vg5A zHAFOI*6@}Fj|NRc7N-Tb2A9J-nyM^3!MqxL8cYqA2AxsE$+^g8A2(Hg4FL^74IzfS z%~aNA_P!Txrm8ekEt{#K%~VuFjM1!`eSyg35N9#rw6?OD%I5If8ji4qoEmazD5K$H zhH`5ttf7d8cQpB%Ci_y#qamM$_ci+_B(H||oEGjhQ~AjSWjCv+0*?QpnJPpl`La^f z@joPdKrKcsE_>A6-is0}mef#6Lun0Vo2ygJ)khjyG*=_YlJkl98tQ7Or=gteAgff< zP=QcMLuEom3Aya83X4^#QeAFouCuS|8fs{$ne;W(Ce+gKj8VzV&_dOr8E9dTtv(;zCtyF*Pbo`Wt)v!Xt zN)5}L%;j>?wR+uGPQoe;s~IiMViPC2PQwNb8yQ-!p`@&t@=!>_W)0hEZqcxnuuW#W zmHnVhMlz+9I@n6xXr*>Al(O~fzIJOkqv5QEJsS3E*r#E?TxA-LYB<15se4GnL5E|l z)nT%_l!a|~V3a9+bLI-hCw)5vG7)#nUd z)No0|Wes1jc!e5oqh!pYx!TzJwT5prz>5@K`wYLT;U^70Yq+M#pC#hDh8r4wV8xr# zi-zyXw>4C6qrQ`qt&Kf+VNu~bj0(#ddzbv92HC`!-bUTia9_jka=B@EK=UE>7iq1j z`jwn~^YTc;V+~IO^!FH(6C@*?cT8(yUL!tI5}i!@#+FEV@amKSNgNXJ>q z=tX)jGLYY-u4}7Kv;CV+FPZ57!(tXMDztljlwI_#c1rWY>xG|1pBK6pCRtu#Wiz~x z$Bd0x%c9@MX(8Z6kWTW1jCc|CBD)tkyok}yN|kwtdy(*B0xQbPgse;1ym*_@)iiT@ zk;{wUotATZ@h+q9I4vA*r}B7_m&I%C)E&MezwbqUFS>fs&5HtF6!fC17uCEd#ax`0z<^6R!HT6xjIi;hgl(LuGA zW9mg)7TZyiYe;)?G1h8C?L?RA0#ABC5P_FZE)X7vp`H;KOn+R!A>CWcOjE7puJZ%8RePSnb6cFLrye z$BVVBxY>&>G7ny?_u5ODtXDDv8yMP1-9$azQEl~Nn-{K5_QlOn6KdvU~zLo6m=o{o}_Q;$)l@sgd?334m;d&-N` zJVw&Bj8k63&v|iPF8L1XvKOB*^V?49q8AtBKy*@{)7ikfmz*~L=%l`2l`C|cvAZ9(nQDi{I!-Yfrp*N}kM$;;iYc ze)r;;tjTTF4w_e~&%JoT%s;8mY5pyT#)~XIxO{l!#lNy>`|M-)pBEXssFXgW@&R;G zP$d-ZqTcW!HH&GfX{gGF{9RP7E~;-AHNA^U=RYr3eLUFcWTGj>%!Jfk z?a*63mWMz=s_3{kKom(XzD*I5whnhZAp;^_3YJ?m-SF8JQz^Oa8yK2MR1G%7T zNe??VslHCoI93~I)VXzNFd|1&#jr3uZ4?|^QeHczh%n?2u>7fK<6Og{{ z^-!aI7~_L{M)0bK8cWF1Q)TaIN6YtA6MdK@CzXy|Iwt!t#fK+8JoRC!57T_O=))x+ zru#6%hb=yA^ixnCpXl!aL80`93W0p-)dGMfs3dI-0`n z7BgRpOJ$w!sh0R~jJ`O_82X;Yl|HQTVXY6VXs)Kp{hp+)^I<)Un|!$6Q*H2JBOzTc zCB-0hGZPB+vh%n3u${$|KJ4&erw<2xIOM}FA9nlX$0#5#<$IX0kGhvCzpjvcjMKQ6 zIzVR-TRSY%%i?h#j>_O=PkD+iW>mV{+e>}ZOP%mRREnp3IL-VsKAiXAGat_SaE{LH zUMfXzJLiHApUa6#mSUv0%F|m_Wbv{Ow|uzm!xuhWVXZHHxF#d-t-kW%Yw3mNRjSnO z)>}>Mt>m-RZ{Ho|q$bN(S<(<{F*BWx^emR_r!wexQ^#96vgpW2Gn0qgFqq>oA#Muqf}*Bu%!i{Zv3lP)D|8b!wC<(J&#R zV4@t{==O=7mAbZ{I^EAcv2XNKZ!hgjD@iZXNIFXrZH}j(2tB(NSJU z1s!>Hyr-k6jt_MCofCTC5DRW_((??9mREg zNWTQN6tyI^Pk&XKFosoRHT#&wPxRMornFgBM>(4ENOoO+RZ&MJ9kq4Tp;=i+4LK+S z?7>vg?e88`)lp4HbsY!#t6OaLF|{W1Yl#x_uu5Iseh$!3Mu9E*%hdhmJNn+A_bRoFRl$Om0u^Kus>! zopf~8@sLsJw~LOhj0$&?W8^%o>ZxOZj)6LQInmxa`snD(Vn1qsYTAMJY-As(2C+Dd zI+!|yI+U6`Op-ZVj+8tr8>mL=7^P#hjxlm}nV4l_td4Oysv4+f*eAny9hY@{p<{xM zi8?09;;&lOAbXcr=~zF= zeoiaATE`k4Yjv#Cv5A@Mb!?FJWRTj(;uThrq9n%#tIafv4OUeLt8F^Avv^X+4jnsn z$S3j#;uIhNI<2N1GbbPDhu8tpdT-R}f)xW38$$3-9EgiRY%o(D-lMAZ5 z+QpWoUwMpqNAg+xLB}72pLG1J<5xMEb=+ek52%uVUq`y3_JC#kMMsGI$ca9dG4QTQ zqEBdk$b{c@ywLF{ooCcPsLypYV1k@KQst$NzjXYq;~z$Q4^^)S@^JWHSv~mfK)y66 znJEmUG+^;$mSQRcX$_<^@P=W(KBlIh#(**~eyCc>F18O<=?!Es;4z>Xc+)^e18*6~ zVjvUqGdr!_Wqyib%4NV!v(GTQQ_nE_L2HF!%4@(!-!LF)5|X;Qfhoh(1{O_5uaV{J zMnMB110@WUG!QlrF;Lh*5d%>JF#~xFeV4${veg^t8xsHK)2I?EA z%c89R@}k_pKtmS08fZjlVW6df#s-?O*wjEX1I^_u8ez|d+{TE?R%(Q5WuUcz_69mI zvyFka2HHs%%p6EvMD1vxlY!0#x)|6)=N>iVNEIKc3Xing>}H_5fgT2W%FG++V?b`w zD#{mu*m$Fns{2UQmmK9CPV(z;0}KqLIo6P$7sFr!BUv0m9Y!5Wl?TqrkqGLM*+!K+r{*kP{)o^ z%L#J+B==&4ft7T2j#3v#sWk@H$|W;eZ8xyaz+qO z9IY0PR>uq+H*nHv;ml}t!r`Art5XKL$?fPEyVTL->JOp2=Ou*l!=kjZrdbOUJ068ItilkYj4#zDzsQPEmhh z^d|X{fyV~^Ht-M4CkB2u@XWwd19G$X8%_BLKKW7p9|m3+_|w31`tncdqzg%VY2Yt9 zQp`J6RT`^Wj8(6aIi|g!{p&>klPiL?QqY%BO2V?SDz%9;CcGwmCKS!|CNh{v>tv=Q z$Yt`TiHs&(EM{_|Z<)w!V((aWhwW!^{0!rio9r>6$sri0lAmqKXArsx!$inLmokCRk_-_^mc3_+; zYT^SEB}|kw@zpq0%tUeK2+OEs`_RM-aw!v~O?+aatcj0IlrizK33I%imTtU~Z#2ng z-1d%)SLN73c@q@~vNnoenwib0l}%Ka$uUud2@qYX?nG|`BBm7zz}OcPX76U|HvGBMaha}zD(NSWwoqNRyeCc4V8FwxpX z8xtK&bd)n{f@*7`or(5rt?&dTGnSptD=G_{=uE$h9FYn3t_`40rgmpY%w8sXnCK}( z8mV?nP!}2PZK98fA1Bz;B{|8LnEo=E6YZki6sr$3kz%3>PgFxp43+&g?KQmZL^aIB zNE4$>3}@O1s(i;lDvl9k)YUxBZo<&KRU?Takukh)KYLbb`CZ;et)x6^0YaRdHNou{r zl_#l<@u<2#2&fQ8Ja#x$tE4`WAPGs1NESc zyrw#A;)sbuj7r)+lkD?ZG&kdD z?YfCOCVnt+!^BPca?o#?xNYJ)Ib?L?I(_2Q^-NKBY5pvSrjPoOEZzNNB0k0L_nwLS zH1kYR4@~@Gq9*;J)JG;Bo3JeSEj%&t)I@3vX)OF^;&&5&%Uqdw#_H>*sF$)Yru=Lv zUeNiIntbFno2|)vfxl=uXkB2$n~3hs$IACROPnp z@9PS8o2oPmUS|5J235Bp&mk91Ri=gU^3~$0>N4vFEabG1%RQmCOLV#Qkz_lTE{|N3vD>U zQPleM=aCzcn^OmCe1 zJ&nz?)K|0AU$fLA`f?vA5Bio`SZQIEg=Log+;6#s6$EKhHgV)>(rOE9S!E41%WS*H zb!35Tv(-imn=E`~;cE+qCZ%;E0gcXNlf-H>aSF3d9@Bgx=MO<{-jZ)=f4A_= z!XL68GV?j3FQ|V~rS40@Ul#r*B)@6@uZ90Cxc%_>0YBtjY8pS3-(EIT_>t0&RDQhS zxBplswclQd%FI>u<|=s==r&iSrIV4G&M&`fZ6{=)zUhbj4X+d@&Q%-ds!V=l_Tw!- zviMQTf{Qt4I8^xzRMMWzRhl1OKe969^F#L|>_^XeN^S-WKP*4|ewcownP=y_=c#}n zK_-X%kPn^3l-RgDP|Kcarbm=O0P;m0KUlCxo+lCI_2$>zt~eq?7(PO3z65ajJx zF2c!q>h?VKt{-{)sN_dwKl0KqbQ`H|0$_x;FEzaTX-Ulkw}oo^3JSQfM* zew0s|)DQe9Mkr1#zb9@YweRAe#v zHQ*|KRQ02cA8q}p=0|lu8Z%nMkD7ioAlDKl)RVONs{HW{4Xzqe6&a3CE3uNiN zz8_B=Zs9_Esr5~+C7bty!l5cyyvp`i?poT86Cr56a zMBDk%-j9BM^!K9!Yjvk~q;{fqrb==bLRUY!IZkq~d&mhxrKgK&bWBeFP9_OUVAZ44t;za5sr}rs- zOrqV93~{kDLKdd zI7#O?RbEg|$X@ehs`>h|>>B}!3+#tNWP*qu|ZuxQBkMI2Wp5{+} z-0|ZFKkmx1Pp9=lHG<=m``S!JeS?}hfHVQ90MZ5!rjw4UQ_}~KA%Hgn$QXc!P9~}}k|lu5 z1CH4hfSZo|<&>n!rUl@o;1NrN*dn zs^s_Akc~VjfWZO0P0miu5kSrWas`k(fVu(H3*emq-VLAvqj>_zOZYf|_X5ZlK=A-R z4B-6$@&{0qA!)xr0ENi~11Llo!67C8Ouk3}@*&9dMd|~FicvQ+p#-@!wIo%(s97oi zQEB!gI%TL*lrQ9eLM}@!=lJCbyBDd70aPMarq&9eN&r;@sK#OqsO-HQuPC95J1ZSS_RP1i8c$M5xFt73AL#c^(|J-$t|cw7Qa5qtpn&z zr%eED187I?7(k~0+LJp_WrXtiW@mCYYL@`I5~?j$9h}xiE>=AP=ovt-0D3dpKY%`j zepGo!);D0kWt+z;$)*M{G*I@=X=ezXanzyIVbtN&5!8_Zj0#{hc}xIf2{O*}iazk^6u{yDW(P2b&RpvJ0Ok=SM=}=# zu#m;%07REK(dC4t)Mfu~ge&N*q^_cVbUDo$UhiwE>!|V@GV24_K;Gy$n*!KO-a_3< z-R4BM2e5;@({b)DR(k^28$gFb=vWB*0@xow^@6BT5C;M{7(oB*7?2%@0yr!eQC5`5 ziX#CW4WL#OpGI*kfa3xD7Q*i#oCx4#0N)33Cn*201E&M15k$=(&IE8))~Fy-1#vEb z^8wrm;D-P{3*ds(U94_UKc{{jz(rY?mZ(bsTn^w1nqN|{P$fUx5+(W-i|>-ZAzuyP zS^(b$aNWu5y+qYvg5=)};FeS6HsL$!_taTS)ZGAnB)_8m6u{#Eo{)bI;9dat19%X? zF9AHFxoC;{mGDr`1om>t>FZa*(*XWt!fyfm9>6p5^Q5y_{XuxPM74V4;go|c| zATl|1-y~$D)?i1O$!`VGnnkyh=?%i;utpfo1Rr_TQe^~T24S%n3L;GKQv=kXoDZxb zV~zw74?OM?Z2C=^6tIv-HQEJ7$6L?ZytK^XWM{uB1yMPODm1H7s|B&giB_lc^)gi}h);tU z7sU7=Y6np#h;~7=527v;WaJHlsONBfLW3ZZoi+-hF`Xtsv?4SOqFE5lgJ{8Ga$1tf zE$KX2rdku)P}@?a7teD0Sab-YTM*rY=t#d4wKKJgli8IZ-@EG(M9(0G1~Dv%UNrj# z(T~tOh(1n!!R4yI!-InuKpq&xAVRt2s{L{`aJd@dMX}U#@Uz? z#9YUDL1%st3+ODQzO~}@IlP#~B|$7DEThVN=3Ajw2C*uLO+jo9VzuM1BdiHxEg^ZB z){{3lIU9qh!S=TV?e%j9{jE-P8)3W5r!$6~baqj9Q&+A~`-0dnt9KBmgE&A_Ms<{M zka~!En0kbIVTC$Ikj&$R6G5DGoLei@nIO)}oCoo>tpD^cQ_lzSSr8Y<7oGgi39mTF zOF@KI+B5bA%`4O|sm1AkL%vD98pO3Az9nC$)@05Na)0tI@@=X#`<)zI`acA5H;CRL z^aJf{NgLo3e(`1PHEQsHo z%x_n!Kgjo4<g-nL~Js+=Q7~LU4uPrsD}g3!yuG z$(+ARZ6o^_)u{$mqWc)~hY$=Q6heT0a$%8ZID|w9Swo0~5M?MvjZ?p8-TzjpY%EHC z_7L87ILB&xzjB07gpfOgcS5KgLY)xa4IxhmABXS>lk-KkPTL*Q-xa9iKbm+?{9S$YlKjfP%DH_2^ORIsdYnW9zu%{>V;6B z(FWAUAv7d3q9%_*6LM3kwBL+SYmI6dLaPuuhR}&l>k!%!+Blir*;l&|+B;4MLVx<5 zVLFd>AA1pit!i7+|z`sH#; z2*p@;S_soam=VIv5auvP8k`lvY=?)fRkDdG+gzHmL@yvLb#fMlu*l)XAuJ(JcWNyQ zVL6=@PR>fg^0jJB2x~*Q62g}utP5d%2)jbq9l{1CY^82=YHcEH4q*$o^-lZS=x+~U z2Vp1mETelu*c-yB5KhzF7s4^Z{tym?aFBc`gu?_md5#c{QtvqJKOh{JcLDTe9!?54 z(K8`jq<=Pqb0M53U!Z5<$jhreW{6M}I z!nYyZCSRvY@=d}GYGGEtB`cD%ihdWu_YB>k$`|mYifnh~Re;VJOGlZA2Mum|tjK4zo zTXMq47{))WtHSo$^(usaS^SThDh$w(9isbChtVjE#$gl)qhJ^n!l)QVA?B0_qhuI`!zjXH(J+cTbw3~!qn_koK9r_-7L^L4 zbQoow%#R2kQ_F<$3zI)_qJOVf<-#Z*hJfsjY<+^L6h`GRYKBpZX;s3g?&Mb`RHM2! zs2UC=>wd~&y)bGM>QL)aB_ZzyRo~$TVKgL{+@R$Ba+5Hcve=EfA7TZB#RuaA2ca5XM6K>%&+S#$xj7FqROcm*rtBb$A)!r;Tbw7%R!EsL2=W z6r1eft)a6vjCBN^ruZ9J+!)3t!e*-Y#W$&KVQdfMWEiKy*b&CgF!qOWfC;;(yQ$qa zsXb1uyDX#*ApB(=ci)kYGH;n(th}a8e zst8gLgi{i-Y_VtKjR;aZewi&wk<&(yj*vW~(vvep(2P|wMUXjybrGzO;H?O+l1jQrxFoF_JzU)Qit*_6(QZ!3b zyU_eNf^sZ=;^dc2!dg|{aioPx4p%2srdElds^eFSU^W}9;W+Y_L7zrYJAytD^o^iS z1a%qe7D2rT>POHbf|e09aPk{R&@kdW0-`AoFq=5hrg9EM(458d>_{GYwThrMolX(7 zA+)EqrM9EW5qZM=4iR*uC>A+f=^@`bRJ$ zf|(Hvh+tp@qaqkBrxSCAIhlhALn0XJIP#Un;p7q2k&Z8`@fh-?2qs4`mOL(k@q`Hx zOms4ba*%VjsVQ`(JN{I{v zT^(}#!-RpXax8+A5uA$PIL#B(I-irjpi1;&1eeH{ z9p}gG>I(Tw$N4IPugU+gg=-OfE5|5;pJ`sFeiy+FC;w&yw;aA5L3D?`zu!l2CxRd7 z=jGBW=G_S74fT&yDc+0Vegsb?hiMNYc;vM63*pxY9y(6Z9qO^ePY5y^F4B`TMDZpeBUSRJG5QvZMig11aFN|qFVz!;Mv(k{%=bm* z|9#s7knKx4W)xNw{^;vvC%|ZOr@~Q0q9_{02T?@nzZ1o~QN*H%vzUnD?I^O7vr@A~ z@e7-k_H#s$i)K!$I2m@T+~nLl?E%P^CyMu@$R9;s`tMQmQOh_v1z0RZEl6$3P+@Wr zYM-5|SQN#hC?7?IC_ap$L=>MeB)yc3;v;e?YH7!x$9BrF_;C~$SS-t8IqG#f6{DyW zMGdD`WkR(msyI&7D4sG?`l?P-Ca@;qCH>k_)QO^H!k+oMQPhj#ix{rNP(O+WGWjtC zVrUpeqbN2WC)8xot#y>)ClsJD8>>-Qb$ooM{$C+k~bdXXpW~&pi1wL znJ_tuWpt)QF*S;5QB03wZWQxq&Y;ew&ZN$YBJFN_X6CS%!C6D*N3kf1#WWX0v5+8X zZ|_!199~Lzi#I&Y#bH*FHupwxz~Oy_{W1w`_Mqb*BJ9|$ zjyTRy`4pHeFTv8t$tX_Ac^Ji&C{9OlCW?!Uo{i$1Tnps$)X%6=<@4S4W`na_JYew> z6E0IT?onS7zK-G>!dG&2@3Cvic9qVz)N9lh3|)_6JmD5i$$S{a?I^yB;(I!Gqxg|< zhx!9`DXaVx#l0x*NAWYw12iAVLd4>)Q9PiNe(&osWFtI^;xQAXuP213QIuflSrmUn z@kR`(WA+96Jc_@f_?tN|qWIIP^^%hyC+a_Rz~om>^xr7{lgoCmTEsR}Fq)E@iYhH1 z+N;vUpkl}rL*^LLI{ur4bTOnSWN`dzY$_v*f9+Lo5j-(yF=TOaTrs#Ej_*@mhYf;{ zs>dLYD`fyCix#!$KHCY#5QV~8_9CpAHpidkdG z7Q@>yWT%tE@#WXxYp~^9baGSQp}tG)&8W2SUJM0eC=^3J`r^D#$R9%i!U$#-j-f~l zCY)@@R{fixSAj?RC2kc$w%wkt+7iVnZccUX8kM<<=rS_sqw08`B94^gv`mxxb z+Teg16vN;c*2SPIPAs@`FfX?ulV<45wl^9mBpD_Q!C9IR~hRocx0X z`Gvj14oKajF&vBGIGvMD<_SX8gRgI5&%|(+&gU_lb8^lTGRE*3;R3a(GtP@KTyiom z6Gj|VU&`qe!`3*q#qo6v-^5TQj;e87jp3TCb#Y{l>>4599iPXA4h>W zTyePL2*eR&)I-(d&G>W5f9JN_RTCPW^L#-Qsy;9YWqk*(fGpUl9yk%-avpKaXwOJfXoRPGk(=v`$ zgiZ9@%AUs2D~{fAw5Q)WjxKR@Aa|t7O-m=jE>`JE?m_KF?M}UZMD-*j@5cMY(Kn94 zbYz76;ut{gPyOG*J1~wxbkZMveH@243B%(U5y!MRrpGao=GZvK5k|!^njkHYA;`0r z@o`KbPl;oq6HN|g5{r}L$j)A-vY1@?XT&ixj8!vM3+}kWD~*fuz4Qj%9HycXGsR$;_2;tfD#ks9H@}LzRjPn6NI6^>J*7 zVrD!vq&aYT>3-mhZ}9gpJ#AqV|aahzuHOdMwk$w`(L&N;;k z1aZEK8V^b11GW9mzS{H&i;k?rd^zM*r~$-G98W#L8~H{*CJ#W-%o zaXXGj41Gtv8^@1vd{4eZmDYYBG~nQWisPOv9dv${^^kAV9ypl~)&H4rNgNb(2v{Gk~)Dj38)0pGL$iabc77l^iF=>T@DVJhmQFCJCbh$HrGL3Dk6QY9x?6UbP(OQ$nK?s%`@H z5@_c5^%H31aDxOIk_WJh#^fdmG)-VW9T{E{nkUeL(d0Y&RtdCDpiKg86ZkrTZxU#i zK>GyNCa^An4heKjU}6H366lmb=LANuZkGhQCeSZ|{t0xWBklJ}pu59866i@j>h#{5 z#Xi)&)E^icKpsLJn7|;yVCtJE?O7d49!8bo@B|X{N75OUz~}_VIMMM5j3tkAoDwJ1 zgoOR*Rq8f5sU|!A!UU!yFg1Z`2~4LshdP5Qhi@ifRsypLqu6Qk3nX(Bm`8Jd0t*sY z$? zHzu$tfz5K}C$QV8wKahq7R8wuP@;0cp&C2%`|`{eHu z_&$Lj$+F{j2y(*z;5c^)@{|5QInK|7dkO4yj?RMwesQ9|Ch*YVM})`XF!QMt>HJQ8 zp1?DL^!tZ%^1N`IKM8Vn{hh!+vdm_+?-O1n@UL9;S&=a-{!0K^p|T<^Ln*Q%RaU$~ zPDxGPsH7$rKdsUb^wak7P51v2(v!u^kQE&n70yJ{Ma@ioD=V@%nWLEI&I*s?{2xH&dia?;OD&1H_iks?pDq^vA?Xy&EnGh-8b6*Qxe8DW}| zQ`ijM3>(8D)X&T?6D%snN;tDevn$7EhJ)-h!)1nB`Cc^~|wFZXIK&G=WvX~TK`Ol@n%cZBcF=wL=i&gTa+^6k@pq_(5BXHA)ECo_IB zqqiA-%;?OfZmOw^8C}_3hLFteX7n(lCyV!Dj?|PUS!9y3^p%y}r}a0ZA3+=mWf{Ow z(gw2cAnIW15Hp6FG0cqNW{fgpv>7Al|6;~SZY$ZyvVEkKOh8t7j2UCi7{?qLT}-Jz zai6wY#@(w;G-Hw(H_W(c#$+>oHDjF_>&=*A##A{kWK*-_G&5$IG24vk3}s?72s5b{ zxKh8FF_)oS{O6buN&b{n}dP$dzY<85_;mXU2Y-o2Wa@*lfmMW^7TJ+X-8#+o;7jy&ZC9 z@p5v&mWG|a>n4$4w3YpsLgmRyHc9i`a(`3!c*!qGvu@8=Vr*45>IlJS7y9r z(`z&26`xdl!|;FmwRZ-{0|DU;^I?I>f|R`AB(Wf=1VTGtoQ|5BnueN|+WA0yXj#%T%wYMnH^s?hL1vm+sN!TLWV0Z<1;(W^2c4W$adH## zQ1e=l&w~6G6tEybr=SIe2ySX&3#Tw$qlFtsmTs%vPhT43{~I zbed6{Q(I8WAJp0&)LL24+JZK8zNbpxwibLxHqQEoR}#c*XF+=l2GQ?eK}QREs{Brb zt`_`6=uGXRT1Rmj-7M%%rw4U8&0ZGtwxAE4pQ(K<=x4$1gIa$J2G9|f(Pg3&<5d25!UPK@5++$N z*@9m!m}0?nI#Vss4{0+jm}$W@Wr`z<)Dh=j_|1Yjvbn72V8vVu=2`H;f{zybZozyD z{;}Yi1q&=#Xu%!}_FAyWg2fiBvtT_3T4KR63zn1ru;5R^Qff7hCBv;?xSG0>x{5lO z32S(cuchF^;06796wSyag95IBvlSrk$mpwBVElr)4aL_gLAO z%o#c|P}alRImJ@&BKeAPE?IC{v3@u{v8$F(@1kF)f6Ic~gd5bG@&u1*cPzLojs;IG zxM#tAwmzahpc+49ct|!@KetngZq)QV(QWV0f>70IngVMQ7%(pr&VjbH9kQ8lWBCM!}Z-f>t< zO}?$hN@qnTI_XtT20}(FULDplABk_P%vNMktyu}~BU%nCa#~T)ib8a9QS(`mTV>`U zd;$oE7D*2*_|&l(3?t6(Q!ttVpyXOpZ`xlqg{w3w~}zF@{A|Yk9u&`Gpn5 z=@>urlwMylEJH0tElo8J&azgt=kuZpR#dd2krj=tsANTDD{5L%%Ze&Yu1>8=m73M8 zSk7q(e`Q4tqo8uWwxW&|b!mQMMQy@kw$>vzuzq@HqrMf6qo1~6LpI3`f|^*-)QXl? zw4(DZwHZ~mYIA~&+k#NzsMgwwHsl|vZLRo$@SPRk6IvbBC z(aDOVRvfe9Co4KzF~f?PR&=qVs};kn7;Z&3=J&RukL*pdlAoj+kQQ@2w*Q~g1#d#|(FySKg3iXl|mkAZsh*z!nhfaMuH>|iR zA)Q-R+_vHYS&HAW;-2EWR!lms$(PFRD`(4b?V%Nq7+yWDJ+|VB6?fDq#)oK6+4_w7 z+=^5u;;a11iq}?T(2-Hc8!O(*)mw+A$1mXTm)5)wOi;k>1vN6m_&8{N{VFVxJ zZ!Vvl4WwO^02F zLx)pG2RbetZXH#0RMp|p;g#p)I!fvA>G11_=}6QO&=J%T))CPW(&H}#{$1qtf^d|k zOv&&CKG#u9#}_(^8l&)0xVVlII!e-!91BfR>1Dj`D6ONsjtV-;FsH1Ja{s9;U1X`K zqq3@5Nso6lx=WpEI;!hvrK7cuuXNPV(NISt9W`~-(osi8T^(Pu?>9PX>z`iENXLJd zdOGUsXz-sIN|P~FfyO$T=xDB^g^s2=zSYr;nMQY+#=k2iAYn_k$_yo;jgGbqf7Ij8 zY>nr%-_iMA#}9;mxbNDLr9yk<3wNa1Nykq*I_v17qbnU5MM`zk(Vd|@i~e`%rK7iO z5Fftsp^uKfvS*zrSo9V2zf8#}Vd_XbBP9<5`H;`b-w?+%UE-eD z{;FdNVKOKG@0)A_Q+4Dz8Sglq2{UxeB+Sww$>PfctLPjZb9JoL<8QUeoagCSz*54$ z6XweicrxC!P*z#TVjW9#EY-10#~)1ilUkQKk~Zk1ww%ri>OA_psjE1O476Iu8XaqO ztfO=DWc*z(Sp+uf*rX$^4e4yyEI0qraYe^f9b0s4)p1nEF&*1;6FN@oIHP0v-`YtXf9vr# z7=<7Ft;t(bRieqK3A&{ zULDtU+>p!2EbW<&n>udkc%b8)MDedlmR7?r))0uWkdqjAw5@H zWRy@A*)QpB$Y4Vuo;w-U8I;q8Og3b;A&YXd+mKapHp0hKS`OvNv!+}&(Rh+v*oGoDd}f2$1{Yf`RGn(2HsICCW`muf!v-foYL-8( zb!2@v9gp(8HuR(Kw;^Cd(1wr=HEgJ9L)eCh4ds{_r53Z{3qs6>L{;H)LQxy$sreVT zp`>apVT-?IXFRd|(uPttl(wM^Tgy`SpVl6*qdZ|KZ$kweD$=h?twgO%twMdHMyX~) zbvm+kU&&@X6W?^TZ1|ey_cnZELv3;^8|v6l*M_DH>#1H13H7NBY$(PGjcjOaLlc_D z3#f1Ce=7$V&F0h=RM|Bx2{N?YIbXCj!!}ZFkJgs_oehmx;Rl94Qrl4_zr76|6!&6U zCx$=S(AkDAHgvV2n+>yRcDJF24TEHp+R)R6UN-zpzqhK;kI=`4z6AN(G8v*jd4S4U z!BGbC1UYm@8)Cyy8z$N?$%bJz47Xvd${b?j3C(-|Wt;MsWn{M2zY z$J;Q05T;p{I@yM4HcYqSR~x3-FqH|?QMO(qCd{BSQ~9#lXDRM?R{M=S$A-CtdDQtf z{7x{=js@g})Ge&J#D+g?_+ZCJJN~p`sSU;LC}GDk8n4$E2a#lM+K5F~)hLU`3@3;*o zY&a>74QJSTih5f0lCK5I7Z;7ujYIl8n=Vl=P%l!Y^|B3D$XDh3Qoq*_xNgG@8y?&6 zL@uXHxJQ+;w`{nr_>K*)&uVuW3f#9rzQy{0;X~>pm6`LL_CGnO?=0iT%^YF;+II9m(vN#GI|v6dW;u zs!>g94tvjOsqIK(M-Dr3(o9RuWJfxclirRDiZc>qpv;6U%Fk*?HpSTq=g(=m2u1Ap z%#Pf4-C2CZdChoTAEp_jMyS#&N|<|IOH_`m zdr@*R<$OVq6SJfpU&@xZW3nBk>?mzV2Rl02QO1t4b~Lo3ksamiC~rq~JHE1`f~ru3 zP|=P`gvwNTq>u^7Qk7vfs*F;@j+*4!)LM3YLy*j`)sY~N{u0))qpltG*jk@z93j%w zfT8@1uCX0W>}YLA8#|h+I?e6)mfVcGj2o(j9W5CiXV^-OCDq#6@gtkQql)vr9X}|3 za$aj^hg=idD@Q(y>}1DJb_}y)xE-DC=win}wsxiVqjs~SJE4aiz3k{s?nzB|LF+^4 zOVuxY+Ex__{p}b)|7U6onuExLsWQVMb_^vOUr!ZhgdL;o7;VQdDrY2N9J`MpPoR#q zW1PwvZ^wKlOjM5iy!Tf-rpPMWvBQq3c1*Klsa%Tfm~O`mJLcK(yB#x`{~L7{bv9L= zo*BDo4#T-pNB!Psz8wqgSY*cnHvPLd7c>0BjwJ+H7vo{#PdUu^97&wzc5G(r3OiQX zvC59sc5I}x#*VditS8GGS;ob49m928wGDO{KknWnr`s$|?j|G!|6;-xs)Sn!+w8c) zE<5emWyfth?%1*0jy-lTv8vviKwag=b{j$gj;qjr+?Rud*ayfl>U9{LpvT2_Ay5$^N8VNJDw0OD*u@suk3hj$8-8G zsFMFuwl;I#(0Ql)w{j)n7YN_eG4?(jNaDb12i7={)PZCUeCNRT4kULVg#%wYP|AS> z2Q&vP4p<#9IgrwUEDmIKAe95D9r0b6fttpF^n|oj@zXgVH`5T1+iQr*l95fB9LP*a ze<^NeBj<7;HzB(NISA5}({L_nc^t^=Kmi8|(#dy8%cmeep&UyUa-fIkb4Q2s&VsNjl(g!0CWj^>R7jQS5d=cDi(t#W)On4)|5;*h^Z7oJb8j z5Ftbzh^ZX;fXVob>2n8)(k$jcaR*8`@CC!!oTSv3-ZfLS+Z4I8c!+eJc^3v0znlbqBIv)~b<9T#m2BSL8;QwVH%lRPj5qwYCHG z9cVzajsta7YdwN&$zhkZh7L4ypt%E$Xf}4B38AS2-xB7t)DCJ3I<2WKsjaATPh%Oh z4Y@5cGd# z@e{eb139n6*IKkEn|e9ocNFREKpzMC(y7aY7Gcc4k9azGIKO9(2_>;Pnx{P{@^ISoe?kgQwMJ{|bUTv)d>*QkML{cZ#JFvll%MM&| zU?X#OJFv%rO%7~!;4f8SJ7EiTs{`8zS5|3YJZkGLOv=h$nZGB6I7`wcP{!{HkSjZm2=L4Gvu?%*?(0#@4y9y7pa%1&#!6) z{)w;qRR{iY;FZe1=D=+S?l^Fr&JE??bl?^_z+QLBj~sYRxaYuq2Of|gQe|(JVWtf6 zgw8Wjf;dkJ9hvalffo+EbYK+2&D7TpykX8;>PPB3>U-)3>K!J-8Nc$#DVfZPpR0*x7F zb0WKPayZeOW^O0)IAM3f!KS=Ud`8IUM1Dd6Ckm-v1)ZN>%M_+lMETRNX=W!ZPOM~2 zD}9}6Q#t3aX-+3xPDGrD(sVoFal-3_+?q@#>2tzQKST{sjYpOsIqCKIN`=X??_z|a zP81^~Qa`6gnE3^{1hqKT_-1lRvQ#MTL>VUzyK%&gvQCt9VuA}3T`2EF1tr`wg3PuiLDu4H!Z*s7nbdWn zo)b--_|}Q~^cz#8mi1jgs-p1?B8Giw8ybx|izZJE)6D+Rf@=W`Q)Zg0*jRM zhZBnxFL9z3=kO<;rOIzdQ*NHNLQW#thEA+@Vw)4&omk_ECp}Iw~Q=up*ZWrIX0bl;xgd^ zRa!4P?CH~-16l=G5MPJX#Sc%%H`EcM=rB(C_e z^g;O_37{!|c94{ijGEj9`H5T#vUFK-Q!}}c(uLeEAUPXuYIYYKF4S|Oz6(wlTx=@mg4+cTxj5A; zbzBIMeN?{-0m3PD41`^XxsXURLXEocnysI^P}GGlXv(<72(lfr-HK1u*dQfnmUQ7u zLMdt)7fKT(t;{X0tm0<3wDK-gaG|0Lm1x#>p|T5AT&UqfO**}9X;odQMy~F{S6rmd zj9c+VKwb^ia^V|S{AJPCOfz0CNk?(&(5Xu`CfUG+hA#ARp|1;#Txje$F;UHHL;E;Oafk1lj@p`#1!l+&JY z>6X@s&{_FE5uV-BBtf3@cXgo~o$fC5bfK3EJyd4q+gfi|{OPfL)l-JhZ^!4>&xQU> z812FU7k(!H;=(`|2DvbV;b5wg* zarEUD0piFqo}m<+ZNKb3=1cd3G!Mzfq;u4TV=nyT!ZjC;yKusV zvo4&I%NoGp*MqzRhstot~u9o@Ur#YKx%0AWI zkZ+*b8QR>CFQLirWsLQ5-qT!exZN1-#uzs|Zg}1J!Hpl?@VVi4<1066xDjw8=tdcN zTFxRNH)3uix)Ej=p-RE1JO0fsfzRD2>P9L0#oYLUP|}U!Zj>M!w*;wvPm@LRzjVjH zpt!Y@W_(StG;_M#)5^I~o?O+93Is{6>_$b!l?Ws5X;qXXhmEXhHHOux;?#7bmK#mo z_*Pa#{so49UFtV()F#xSO8xcsw0dsTccTHFhHf+>Y`dp5CN!a*QrlUenH$aB_?~_X zH(I*!9k~@%YPNBswc-!#*p^}T`=4qWd#9Zn?dcDoc5tIRp`#m}2tQG~xY3zloFiSy z-Kg@XGcsHcH+nMcMeQrcGocSv5}fz7e&qhjDRDpE@n_i)ZVYl`up2|%_=T-Qsl!#~ zFhV2dk05s=k91>{%9(jz8|%h6H|DwVJI(QKOmSl>c>;B!94#t;vOEeX-h5x1=Eih4 zW-Dig8#Z;s&ZIeuD!WqV{F@td7|vDsNAGL%-B{qpdN($>u~7M|-B{$tVmFq!@rN5L zl>et2%g9o2sT=YqN>Wyq_|&?_jkU^OM=! z+}PsARyQIU;uRdMv%`&@ZtQ2mF6v&@Yd2vJwd@0JpYjdo0KA8xPz#=f-(AZn$xi)hBpF&I1bv6xA+vk=W_f)UjZro9PS9Sq&dh@CHL*+kp z;}Q8W^@-uD);$ljXKp-qieFM{-O3!Ir3%i zq#h*m#HU@*gXA8h@F1fHnLJ4FK%<||0~0}VQhVa>w50SPm2wiyS{lV^J%~Mw@6+_k z$>90){rt=xWTBbQgRF$?9^@co^PmoU<@6vIoxIfC9^@fNLF1<=U72RwT0Fl81=wnw z`-MCx%&>?D7S-!B56p@s%}UmlGxnk8@WAOoT@UJc;PSxjK_w3=d*JcF>p@gjhsi!_ zkm~m!KrlWO2$927nP-GB<)N17!RH>7@}M-Gq8=3U;0vf^P!EO^hEXqY4kO4i&tC|}ZB9pfFx`V09*pr|tOw&f7|+&UsS~J^JebH6;2Pda%udT{O2-cTkOUc_�UHn+vt=P)1 zh41s=kaG5Wa6s`v!e3kkDRR_skALLLI-3Z{CUmPY}_@^Swe#kU`8 z=g8-&7kJT=`N&PwFRPp@1mofOst5mga80%kKjXg6CexGncDv=lZ4c6Vk*2aPy- z2^?4>MW*qNotV!d?_1eCCCjP`Yt^w(^oqRQJN>MbL{7o9t9K z)!~KH3m4gVUh({i=3(gd!bk8^174*6U%XmAszBI_L^egJ;zS8CYVrSRpA(9zRyhlb zdr`uROkdmiGVC+OVlDRc>4?=J#Iw;Kh%0 zI#SzFlG(PR2UJUbMrWdok81BUgFD9v8zj!f*JW@HM2&1VwyN~r^oEPK0 zn4oed61-2fC=(`o@v9e8RO@svrjn;ANB%%+2HDtaGNsuJ=X>#+7jwL5$vShrm?y`1 zzW94$zcazO@GkITp%;t1SWI)NH~udD5-C~w+J!9U5}S!WqpOnF|t(u-AIWc4AN z539Xc=&#R2jj>R#$T>e8q2cTf+KkIMDRi^Jq2UXnRd&I+j0(i@mj9`Y<=j(Bf?!T?h&N^eZm7Tny}_$hR>)^RL=jrc&fM`)1G_r zLOCzx%1QH$7jL~t>q9zUeA~X0tGW*qAK&zVyN8gWreZY?8_WA0j?PeF)MC`Qo=639Hsk z&$Sr&b7~^>JnI+rp_mH4AV{@0&$SX{@IS_8DI%Bd#%h_6X&_)yb_ER{eIFXU)aHu%(9nn8^5ZEV8nNjq56ygNL#H{lB~@nCf{^$^ zYvn_0vhjqr&I_$ALwN})X+MxV`S26rM<3b|+WXLf@EuR;jxuwuduN*6snWfR4_(RK zsKzazdyspooL)Z6W#7I&^z&h&50iZ8@52BljPl`U9|rm`T;&h)VTcdL{qP6-u#J6X ztf5R8M!i9Egb%+k9I5)gd!dc?VGP5uK8#oXIA8o%Z?a6FBOnE3ne4-KA7=RQtIC|> zgS-TrYNYv4hj~8y?!$Z^7WlB8tqZBE@52QjjddK604<~*2+lNy=oc7_Y%0EMpQHpXV=agUj zm3EQ*5A~ArFZ*ys@l`_GSK2kgb>-h6+@ua?**iWw^WnJljx zeWfKOC!;=P{RBTWKP-M&{V@5F(vKW|1G*nJI*ESR{cw=OemMPb`4LdP+ypPxl(9~Jzl=toCCI{8t_kIH_u^rIC!R*`GCA9ekx>PIy?)u}c8_=+I& zsX-X_TC3&9*M5A%u(oQQ`&yGlp7zwE)5wp;g!dX%lr z$t|d7=(HwFuOA6*{Af$~&X4c8oqu3x=#|%6JC)y_(82#{cmL!^XFrCi)-HbZ^rM#_ zUFmdFes@25kYB6W_Gb9AAAJaY{pd&N@5cZ_-Z$|*TbVkL&LBSq6NXTSQv1BoCNpQa zA0z1e;>Q@mNU9VWMHubJQf7`-{y4&T>cKbKBtItmvCEI$e*Egk6hD6VW4<3#RsL*0 zrje)nF~g6Uj+ifY8#cag|Nww&4j;{FMmF=)sJlq zxBIb!U_5f|G%~Zq_r)GR_WE&N_1fphaX(J@v0oknXdd+AFyRo@s30AW_;J*aV>Fw; zjh7lhJxS+`9B%~iPx*0Lw*SF+j_6tX=Tz(5x7r0iF8Xna&Og-4)GK~mRmY_Cm7%ZE zzwXBkKW@ryef#M<9`d?X_>LcUB|m^r0Qda3???6kas=?ekB5FF4Io({el>gK$4ft6 zvD9Nfo(Pbi`th6~InU(cpx)tsLG$`s?X_zC;Kv)XOzEv3@BDbr@abDk7U}*`Wr8Cn zp=Ny-Z%Q6OdWI+ge@0pTot7bhi~)3f zr)3HtD-|fz6hXr0A(4L2%uyDrO97XOHpO? z=zHy3PNR%+hP>Cx1yDZl>G4Q%jMKj&6Dm^5H?ab1+bZ5T%WfFuq}WC0UQiqJN;b&><(ZDc_-EMQOo;L+e6+*mHK-LzK_~| zLj8~NK@X|cV*wlv;79;Rm17LogK5VDIHCN(HRBym1#l~X+X0*o;7kB#12`AJHRhbB zUJBqc;R5wy0Havy3PY)IRjyI$z4w0tF#bU8I$Lj0Z>r3d?06@D#{oPE;4b}p0o*4% zpgs!VA>kmCuTy1|{{`?efL8%L4d7V-&zU2>tlf)1{7KP$mH9e=w`_f*a$;V*BR^x# z#{dvSh9EKqktF!(wLt11k_M41h~&!Af=EG5pvom(F7hVTnv#$zh^#Qhr#Dke6GU3o znvRg3nir-_1_Y5Wh|ED`kzOh@Cm~x9*$Fw6FCR7JQk zB!_~C1(6s;m|=t(rOLyfjP*IWIJIaH#e(>PEKTyYH~H%yff95|Dt`$~rGqFFM4ce& z22qxN#ULsX$^}uLP=RV3-j#!>BJb)1@pTYY>3>D7My*bjf%d{wLvhU@j6VzbhK^CE zHrdbT2KC4dsr9K+p+OMOxyKs?(Kv`E^ri2&K{Qo4^1)~`GSoMXTLjTEh*mUP2k}D? zKL*i8<+lyuJH_A2k(nfZM72{+M?(8x{B>mqIfO37w^*kjehQ+q%8|dI>c&_1-Gb;& zGaN>bAbJMzRR}dg@txi)hz&t(45D`seS+v4M86=W1u;E{{y_`~Vq6g8gZP=+lbJdL7fli<^If#iWXA(i~ z0rIPIrUWsSZ2YnNj38zPu`q~5G-pxgQfCM88(|JrKDv@Y=LIn|iRpK$!2BQn$(b0$3%PD5jh`<%RqiVy{94tiPV*hZk3qaw{s%&Dwt{EJ ztfZ!7AtVnWUkLd_ND)E;{j5|igbV~z2q_7vsOdvU9YUHA(lSg(J;1Uujh9JH#Ypp%oDo0^Mi?Cw0|ywqqiQ-Kf)h7b-R5<;O63Ws11 z!4X0cCP+<72%nM7$}yfTTSL&5V+%pv>yTt89WT|TTHPUd6xU8>@`d0JA)uTfp|;!w zlyG-pyiPQPSP11pC{HsngpwhA8N%lw6s1!vgyNx3Z(@8wrzf{S3G$3&rc#75R4G`R zAeY>-%8@^Zt)RFnp(3?X2$e&qLSC25bctoFsm$u3_z5coYlcuOgykWu2;u7xz6oJ? z2qQwM&CHe|vU42;YV9J>dsxF?FoA51|ts>E40Rky;|T=_f+x5V~+a zUDbw_%=*bqJwoUi!eG_6R|x$==pRCF<@6!+rH)E&8bBCG{h2BUo*XlS$Wis~@sJRP z(veYysqOGf2qQz762eqAjS67`VYJE|Ll{dP7s7buzZ|1YR6Hq!$%=m^$mr8Tm>$An zhBK(YQ)h-Si!eKcIfUP+4t_~S<~BEkd31!ACO6GjydZ>yiWd=%B#)niOG5ZV`F|3Y zhOmrqmkBFFSQSFHFtUfSI)pVL{1d{p5Y~pUE`)s{>fR8lG3@}uBOx3m9Hbti9uA>3bB={@ zJcP3$oTGn&dMbpI1R4GB5C$>xv~teKHG$6g5H8TX8p6d8E|ITLFNe^8A6p+|rqp?u z!em@tu7_|#&WI4+hHx{4TOm9O;W2yN4&ff*4pn;HCCE*Rgzty&K=}^|nG;M;2rmqu z`ZR=RAv`Cq7zM&8NX{Kb9ztGfK5BmIJ60}4minI&3R8KWgFe-#mRpnQd zEp|w&EOWM?lIl{0rucIAOVMg!RR51tGmKhce7iBBNd#Yq@l6=lG*kKrYKKuLjE!Mz z3Zrfq_2e86V@(+K!)Or3@-S9}(J+igVe|>3Zy1fkXc9)JFn$W7sT2&OZ5ZE$(Tv5V zek(%rFj^?5rR-wOBu%a9vwR$eTOr11XY@3h+nA2Sfj!i9mW{tj0jjSQN(0FlL4Edl>V>m>tG%ay&D0j+&%w&$<8UE1?uI>MZz=znJ;U=qw524{j@& zk}Q9QvGhNgM&ELpX=NCzWOr*OVOdRCgvIQsnbwA}E)4nN>v}ngG}8vMBnXRcX0@~t z91G(w@)qjWFt&xUJ&YY;JPYG_7(2t*CC6kK*TdKy#-1=v$OR;fy>fsx(GG@jD2#pN z{nP_g8A4h`4>LSUJrah|DuW*XPnv|1{C5~FV>^N#SE`iA+J7C~YJxg*FEL6`}7BghwlJpxAr`6DP0!DkVeBPbXFOs2vS6k%E+ zsyP1zO9a*kY;4k*FRcd1Gz@S?;EKQ(fuCva2s{yZBalp~X5<(eh#(k2NL3T_ze|LE zlxoc3^9YJEEE7R7!k5%9A}G$jGKUfolvFI$#3@BBO*I@b%SKQxg7Ohmh@c{yDyd$^ z8W}2EwMqn4Bd8`@(qyX6?cX4RuLw0Fs2M>mx%fv=kB;Pg6G0tvZRN-=lclZ-C8vG_ z5(nrw#%5>lFGL@<+mttm}qQ<@s3jCUE3(lj}x z>9+`ek6?ZT!gC^+8^JuXp^~;h#)@E#Y>)^RMX)%66sh9fH>5NziQsrj(;pEC-`SGz zC&Q)GWz^-=71Wi~Rn*l~>3c7w$(_p7ngyq%GRa<8FV#5JjnvnvOq(JQ-7M#I>iD=@ zW#dOscvHgN2)0MCgM5~{GlBzzUDRT!O}ph-O>No}!I0FZy%Fq-V0CKKeyTXaQs-a< zhaxx}!4dX4E(cNsN6FH9j3AkNn0zvVzuEm%1ZN1RBao)2Oc0Pk&#}vS>ILe>2rfl% zIf5$@+@vF!S0ngG4o-HLNy>a=I9aZ<>S%>q#riQ+SI z!6*t58l^E6jzU!O9s3i^QP`t!L}7`-8igK3{rw5HC?=#aNvp6d!pu*uC* z-Y7f-Nswy3D2gA9PeW9eplpYO3E?P01aTycM6qRm97GeN_&kcrtWY$HF3C|Mijqty zM*Ttx%6tyQlSRLj%@ReqD9T4sT2}2qLfI&u?@##SKth=)M8%Qir{r<70?Srpf=o%4 zN~|eRg-ts-=jvoJn?~_f6g8r#shqlmT2XvW_=Z}WT8Daq73z_tLj5QjkQ>V8jpBc4 zOpT*xLPuCjYs#HAzLjM8mS(dkniEEPy{wbg z)IN$1Q4Eh_1pSUt3?Ou({zUC8+ct`>WU1LRif-iY%IP6%y(eCd+7n5tT*5L~+xrYVpq%^=UD&Z5qyO4DyqtmS;>Me)0wXfb4qVSW?~qBy8> z7Dlm&yeNvrQ7lpZN;$^Je=27wVObQ*qgX-SpVlOc474hW)lsaWxq-Ttx{i7|t!aG} zqLTR}t!ZNvqQaY__)Csb=In`LFJWsG+oIS`-Vw!af+X)G?4l++lpu?kvh0gue-sDk zXGmv~5XHqPjz@8V;mIh@5TxVZgj3Yh)Z#37mVAzS zo;q`P!X?5r>ScqsCtQi*D)}F(q)FN9%%;zyk< z59N%G;sw(lQ6J0Jlhcj-G>T_Y%uZ+OzzRpxnS`a+OSy)}kTix@@({qxH&GylbNk{o z-$wC{=6mV~>PM=PAUV$D@#JJNB$uaK=}Z#N-cmhthHscDzNCrP=0F1V7}k%W z0V_yrLsd;$Ws%v6Hi@A{3@u}5DjnIS8MV2pX7p;sQ1aUlT2p0iZIv(M{t&~DG3?4{ z>Jvk|7~03sC5EnYK+0-nFm;rLb8DEvG$n(nQw%@F&^ac5nyjtKV7ibYKA&zebdRA| z483FM!Q|{2P4c~zp5%ATsgNLQ6<))pwNyE4WV39DVPgyzVz?N?rWiKIa6~Q?G5jS5 za}0Z9*cZdr7`DZ5Hl^CuP z{^5L#9GT$_njhFj%$qUXqVuUv4EJKt6Jbll{TLp^kTwzN5>Ya<>0u17<&22oQ4Eh` zcp{gM%%(P(P5)EyGzJNu#qd0a7csn)Yd#$@CD~YnrPtdS-o-E?vnfp?-pBAEhMk#B zS|UEuOqz&fi9ljJL6#(m_=Av~PKy8d(wdM6NiZ@^iAYIKMNO@I=`Qu}XEvqIVoINg zY>CL82;mIWjETsUh|Gy7l*N=KF@BL05Y0+QAV(rRSxmANNkq;>8 zWJ$;x-tYO2`M=)ly{>b8uJ8HXzx#LZ_c=4qIrE71#Rf4nl*m>ycocIrW}FzBmXheh zq~>yKA+{9h+^XbrK{cao3|(WO;L$FI_R<~1jwO31iOw-}k(eWA`kxv@w~|kHi5_B4 zu~!Ul$dijM9z!Yylhs>VmWUxKLCr;NanNJ`u5L&6a?us}NzjXdA29tG(y{0>FL#U# znG$!R^__~^LnphC~hJRHNhF`O4e#ahO!7zW4iXEoyvj(!a1$56exaRIZ(FeHYHVz@qr%W4`I z$1pU8F)?hfVGN65I48g<#uYJ)h~W}C#4s`jtGY3`x^Z812CQM+s)ORn7_N#%+tGp=2HAFX+0`*{p^c5s}DLb z?9>?U)e@$j7Q=LP=3Oz|Epbl_qqH{`Pq{p2$oW2Trnt4Ham$-!_j4xKGG@onyOuFW zd_a6qoXak)WiW~JXI=~(^w%^29uXhqRUn4Px&O!TWDLCAycEMzvFMwPXJdFShNn5= z`d(sw49{p5@rw~oBpwUcoYK5n7{l`={endCYZhLi7R9ibmKa`9iLb`M8OUmo#VJkA zgL8Wc2Q-HFVt7A>Wu+OoE`~Q_=o`cG7*`qDu&fD%%~OhB)LZVE%9yfofzJg z;QU-00}l#%lIsP8=V_ zu#+=94kM0_WB4S7qvLqDma!{_-E3wIKgaMXYf{VjPTV8z6+esN^BBI6-Y@PGzZAbJ zT51{0%j0XE9*ALIE#n(r1th2|)Hc3X(m|1)Kg4jTq<@s4+hGZ)Zof$XTJrfVhTj$K z5AjdVfA0U%e~ZPk{*h*JjCPdb6oa$GW8yegmI`8-NPFYj#&OcM;;0=*r8tg{;{;hw z7AuPO(h&|)z^`8hVk(DIl5(zOWrbIIiOQKk!8;2LikT@=i!;d4aq<(Q^ zBtkJOGHkg-P7Fj2Vm^*S9DU;GE6Zu(jM~QH+D37RPmkja8Oy}};+b)rB{3k5!4ix= zFpjfJdQcqa#Br{M>AX02(1Aln@;E<^3re0BmQpX4<&roqjbmsjbyyt3rAL%3oP>;U znNF{XW2D5WQtIV#jF!GayfTif;uup(y*iF!zj1uW%E+!BCvj~Y<0Y<($4zl;t8M&L+n68=>p(rRq^HL*DUMs?xJ_>Kyd#du(zlCKL{^?jJnq!#RB>7< zi2?75gS=b3N4!^@Ay%zp%!=dwI4UM!BrrRUIdOau$G$ioh~q(3=7Tuq#_>=bFURpp z91qL*M5&(hBp!+5QHjS&_Q&HW_VAN&JQc^&vOg!z7oQQI71?$=FNkAd9M8-0g4m@_ zG&COEGtU(WpTV&(#uO@NB@;^ zuqRi=v0ABX#G2yUalAtzP0w|4td*Xo(y7x zdV3r@BtD8`j|9uw$*Vv~e-g*8lHM)xX&l8G(sQpYpT+UH1ZU&73jSprzr^ut9ACw; zUrArb@q@$xk$Jy~<6G(PN|x^>4vHKX`W%YmM^2bHelGbOmZ((M=vFrxqu+G;cO3u3 z@w@aN;-BIXk#2v*(NF$JL}8B>j}phrPUA5N94ku&u}q|WPF>@;1S%ykJb@7j9G}1m z2{cKdX#$lKI5C0R3Dl8umBjyDl_$w^aw6Kdt0r)YPOBwQJ%Jhtu%l{;HN_dVqy4<7 z`@~U~x#Uk{J&F1WG>~Y)O`x{XNV>7e8nTFH2{ccjQ1nTlWdex=k_og*pmhRW66l&h zn*`b>&{;n1#13M6k#RV79i=;oEQ`is{8JMsj%+M}ZmM&4v4_}GWW{<(^cHzhiz^Q8 ztYNBDiYH+vU`f~|yCdNyqJ4vT{RG%8X&EzOHi2@9oERn$NEA2Hymaw?qfY{T6F5x~ z&Pm|h1WuPeL+mH^PvA_6vl2L4Vt_bMWMf(Sp#Rr$o{G3Qfx&9v`QioQh2jwLB9X1; zF2~**n!qqkjA92~lE9@2+?c>k30$UtV?}z7lo%ymp1^2{E5s|stHd$l)gmj&jMqq0 zjFY%Ff$=5FbqQQAeS=ucH6ekU6S%izxg~)+O8yfiCM9sI1PAW61SU)0E>01Paqg66 zxlb9lI5NR{v8+1sF?}ON?=}JJkl5UbMsH&;UwlIF(-isI9HR=$FT~4<+zi0t=)cX5LcdM-q5c`mvJb@dTbI=_e(g5}!_BzQi-)v*H_dqcK`2 z%~rgZ!1K~CB=BMaFD0-jfz_qd#S$wLcv<3=1YVVRErDecuZwSpOT?ujBeNUdlwK}! zKG3*QTqPE#3XN-Y`c?vOOVIKTh4fl+ow!~s#-Y#q32aDUV*;CG-;uya5}Om)B0-<6 z65A5^Ab}61S@iY<{#SvW34ENu?gTzf;1fCQ5?Og>FLIA8d;dTC_jQdg5+JK5u`huy zrN0u7Phx)pUrQele@fsR3HpDVz;{JmvK&m{2kAp4%a0QO)HQxi;IQ;B2^^D*iu*Nz z-xByefj<)XD}lcg_%i|eA4!1z6g(*C`A-5!;;1B!PDVx^H2zOeGt03_R7j#M8D*)M zgdtCA9>>X8Nn|cM^Eg3uVBX3SCyG^)IH_bmIf<$zeTqaiu}i(EN;RZwinYYrNz{>G zYTYF2N!L%JK@ts5e4sOk!FR(`B402Zky} zW6^gdad#5;sKU%xtT}ma5;J7HPvbRHoR!4=60^kzc@>a&K;%$zOy^2JRI+f0A4%d- zoz70-u_PXszAl9)B%UvMKAFT*(oc)?lhHF~&qzO8@_8 zT@uSBRwl8Ev$1Y8OL_2zm3XX9;vMB(BfcfREi#pE?@F)zkDbQ#NxYZD`$=q&eM=Hs zlh~NVCKXf+zFB24$hIUtNTL{%Nvsl&50lX^JFzk!C9zXMK274|BtA)Ew@x?KGY;1? zc1bhW3H1$j4h4@rN$gGHGbMeV#8(nui2IWGG6`m+8zYeWllVG`14?C5F#;XFP2xLl zHAx)gPMgF}N&JumOW|=Si7pa!reGa@PU4p&ewD*vkx9QL@w@a9`P1@;;xodZibf0d zUrGEe`#-Fh{2BA;6pqno#>8V&sGCB)6e^@pmO{l8j1*2tp>hhxrK0X)@A0T4=S+R$ z_*B$;6fEMz6i!K@S_(X^l8VOnB=O`Fs!GsuS$%{4)l1o#t40bnQ>c|fZ5iwQCyA-_ zub)DL6q=^cEQN+jrM*cCjZ{|SRMg4EytK2co2Sqsg{~=_nnFufzP`~Wg|;cQl4g@z ztA@0*p6yam4|kHKy&O8E&{2X8{HmWZJJUzyvS~c+#u9l6kPlB8jh;Qko+eECD4#64n@0UV<9Z~T5MsbP`NZ~T24ouhKTfBSKqiOg^P8H1_lorIqS&bDU6W)k`ykL;A+Y=hz>59k+O_R z;c|)5DU6X|#w${|Qu?ZrWrV_Box<3X<(d@6Nf$?Id@9=On3uf1rx`DshK+r+B+6GfjHB$Z~1CTl$`o<=zx#NZ(ho z%#@fV-k-uE#hH`B11UV1!rT;)#!+cJl)}R)>~Qgsi+L$LlEOn49=7l(H-FA^3#}|X z&dr}~F)`7^lPNrvLN^oLO+1~#{1m=T;ky)`N#WTP-cMlzoi~&{m%{TYypY0z6c(ni ztARly|H?!0VhS&%uq1`0@~pL~Y!N5hhO)&eyqv---1c?)y7(F|1PzU*4GlW*&m!a- zveURs*;jC*Na4*CmaCNCH%6r}=BgA{r?57Kbt$Y#;jI+jN#R{?2%E|Z4Gp@zokB4n z{dvmBtlN6UWL4iwfku`>O>RtK69+woFH+c?!WPbl3ivpMtto6v;X~#6K%~8x<(h`Z zc6MwEAE^od3$-(a=a!d!x2fzC`R__$cM6}%XK%@Kj|6>~>oaz*1glhxyf1|>Q}`-{ z{V9B%0z0G_+^rCa13LXCg_#YbXK24q;b00Uny6yphZGK_aJ-2VO#GO_Puz-4R5bB3 zcOK?4akPnFQusB6zf$-+h2IqFj}-o7Z>aRe4UH;|jJA!UfnZrjG!~Xl|KW@>@l6G= z;jAYehBPvcF~RKDRY3m=IM$5nU%`yV`U{PwVd6M5sxvK>OtACWM%ITJX{l^RO=F{& zml;{;NhVG<(bhye6ID%|Vxqo@1}3VR(XdW#WH3~96E#fKq{T!X6Ln3{UfaZPtD*|? zVA1td2NuMG1wGlwXlSC5iI$4f*hCW*-9mM1YNDA5&Ola%bEdhnysH{Ad$IDZOtdcP zHYPq&P1>uybf8-Y6CF)-GSS(@sV3f0{~X=e=pvu4BL6>2tHx0cncBldPZQ^wIL|~c z6TMC3OavxkCgLVM6TY%=DJ4uKRdh;~XGfVPELGArk#B4`Y76V&ns|O?S+NL~!j9$S zOer&pM`(!^L3*O<6U z5yqIfT0P0f`{{gs6Jtt~XlEFwdBW1KW%U$?spDBU6W5zq(ZsmH#7!n9n7C1=T&*mK z)9hwttk%@{u}M_)BonuqSZQLFiQ70WP26u{wu#$KOfhkniMvhQVd72`(@acf=a*rs z78E;~B^I|Mt`TZ>_&p}>HF2MbnP${8GfKTgw=zKLf{ zJZNIBiHA%)%vn((S_K>}Ogv)ZQI2?N6_0KjWq-`XA`?qZEHkm##LKLwiPz-7ned9H z9Ah##>;Jm!4DyDFB^=h8QMBZWsAvX%Q)Myua&^TDcG_{#GN;dK6KhO-Y2qsrZ<%fH$bN4p!tBG$-e8=5ho~-S|8>8cU69;9XW?1qN zuL351;{LDUJFF6EXK?OC%=nwu1)Fok#P8C7nD|q(g+2_z1;PfB|CoS8yY8A(cC!JLIn$D7Ajh(WT8(PSfXJ?LwuYS4H=gS`--PLj+edd#$p{BC4==v6FS*UHHj)l6a zOg&YG{;U#1(P!%6vIZ6!DwP)tmfpyURt-f{3ryvNY;K{M1?FX=n5BjF@4}%^Yb*Lt zZ(DFI%x-G5vG96RqpgK@7TR0rV47k|ujXZdIs)cSc z7L&S{9C}&kZ6RqPWg#YG+(M!hp_uo7H05CZCk~@=*K#dfFX376t>}h1ZK2#kPC8>D zD?xkZW=6ouH!}v)-$H01Z=t~PvM@;Yz7|fiFhKfr3uj22DfY9#qd%+K%wUAGMT)Z& zoTmfj7A47Nf*j6~@mve%Nz7?xERg*I3qvgoV_w;Zh!=?$i_1#!hg-PJ!bllMh?iKn z)B;OnG;)-M%PowtaJ7u1EnF$LD=hFR7ROp$B_k_8*1|OwuC*}U!Z;ZjhfTAttw=%7 z>(o+;;^~fN#tjy3v~ZJ!2^Ma)@Sugc7H+XH(Zbyp?y>NDGh-5`L~~;@=Vx={R`E9V z3{P*jFvY?h7Vfk#oxz(MQ#tn}rimPyQO%9pbK_nMTbdg)I1erC zYi`W6a6hM_g;_eKr9}&4PDwwY5{pK1XbWRp3u9IbV`&Rxo`pxaf*dq)@Ti5yEDW)6 zk&VZ>WGpnY(b&e57M`;3y@i7op0+UG!X^uwEj(l4Sqtx2c-O*n>{1J>EUdP$(8BXv z5nMPHUa;_@g_kY7V&NqVi!9t#0gEm062q0qgG;iwDqq$5;^KOZF*lU)qDD=JB^H)i zSZ-kj3vCgt(8?{1Wm>s!a+S4=_K@>i{=0{))M};A8Vhf6>~vk`^^Qfb+_zOdrmnTH z&cb_KGTJoOYkwHm(kR}^(_sU*ou`-2ocu&iJcX&o-%#T&pCsy=WJNJ`ME$p%IrG>9#FJ3J6TKJ3(7QW!Nxv^}Y zy5c2eXO?l?hg(MXiu)~mtsXdF;adyeQMWR_k!4VYsQ11uRAl|RiTz;VkcAU$RJQS> zg`X_^W#MlNKU+AgzG6LpVYEU;ir*~!s;+3*Dyli#^1FpUEc~e&7B3J-xNo#Fu54xe zV*xfQ*eJ7clpXbOG04$2jsB^U8U5pQPaj4O{ZEmYTHpi(~}2p z|5&|xHkiFhYoor61~z_c6S7*MhhD)ZFIKL#YQU| zt!=ck(cX@3t!Hg6Yhy>BMB1t{EQSC2vx8z%pV`{zXh)akPO@+uY3yp_R2w~Q^s;eX z>u5B2bhFXjj&ADc(8G?dIGp*tl`EmhF&l9kU+#~tdYo76t7NH^lpWoXa;n=l92=eu zUlxX9+g;XtQ?$g`foU5VJG$rLDQnJ;b#%zt2y6_rakh=nM&8C*HU`Lzp3GIS(Z@z# z8>g`*Hu~AyO23c89D#>UlhV~Jcc>{t%dH5!Yk<~I0Y zoZHKF^yH^A8`rZkwT$OmM+fV6lZ^>BZm}_uJthY>_GT5q=|P7{Hg2~u#m22_>}_`R z>6jB{a&g);GI;lO2j|s_=$3=M%`DSwOt&%1#{D+#;*zO=yKUSf!7AOWp`n(>igF#qfUd}$Wv0Zt&NO#!yNS?fr zX4st^&CSuR{w^E4xi8uH!p5gI_OMnP%05%@yFV0Qr;L3Yh!S?VJST2lK)351rCmKaI}MC9F#dx zlV`X2cQzjDMEhg~ksEkLr5YkXudxGHU>+nAzjl!E!L-DWZ{agD`O)E{Gh>T^&Hffr2)gX zH5!U7+Wy-jW@+l6nS(zZ{OO>%gBA{Mc5sV>mJV7uxX{562dy2nagcKmIB4sjor4|@ zdOB$Dpo4=h4!WxH9Ub&hq_Lx5VbW?q3>CRr_#fiyd6! zV4Q=Y4u&}x?cfRr!<}f&UZzq;h?h9HRD)i7Tl94?AK~Vz9I2#H;^pG{wnp)z`jrl@ za`3H69K$hfWL)iFtn=@88jQd?U+ZAJgBu;(-lJawa=?!NH3TUUI;Dd(J&ZV9Z6OIm~+i)_lk2GR|;bytpV{ zVLw;EtLjENv-CGOwH&t)yrVhE zf_T5jh48NWWSzKHWP6!fTn_I$*x=v`2m2gsbg;?6Ck}Qw*vxU%w~-&Jlr0XnI@so* zk#3Byw($X*+0v+`25xt-!@);t=1%#4EX|3>uHzRkyPfE3VYcpb**~R!3VWpYil2$? z+Zp^ymTq4<_=-EZgF}k8U;K`(c5r~>r6zM87Gr*^yzBu^gYO+2)TYY#jPs+CxX1qN z;3sKbaoG05>?M8*aPX^)ywLxqB7PTn^UU5p;@~gt3@*-f@wbD2xBjEy0a#7Po zEf+_-IL5{CE>56b+Y7G($GWKCMx~dzsOZ9Qahw}XgW?ja$HcCtTUZi7u+T zIE7)kfwzukMHLq(xj0$5_`(aFdAq`Z)nw_{&ZzE2Uvu#er-mEdA#=Udc2UPgYd5-} z)K%&AT-0~Lb;^tlTr_mi%tdn-ja)Q#qp!GW=R9xXqN&2N16k0G?V{rNKj>Sy(JEk4 zOI56u3m&wyl0~<6F50`uxX8Nb;G(08q>Ge`PKwsm#i=ejOLq~A#W8O;H@YyzU37QR z!;L<+@Iz2f7roqQ4%4l-i_9x!gArMjkMS<93@dRFX@&% zc~jx5@@YAFF-|yExOu8FFBi z`YAGFo+U9*&I6>`BG&V47lYjBGZ!Q9FG_6qc`gQXL|n{b>s(ymVvLKc8My*3ba9Cy z3~_Ohi;ES9rSMi{sEc84v@s4>D@Jfq@f*=f$nHY-x;iak&fbEx+@#fQwb_ zqL22YU0lIgsy{$n>EbGdrEz~dW6;*Ju`aH0akGnwjNsy0jv&9@cQM|LZeVzDL0#wK zdKWjisMOxz%_l8v9Va=rubW&}duAbuJ z4i|SS>B2Jbj%ccjX)a#lU(ahs5x6(9;di;XTR!)=nBn3+H~O>Gy>4`GK%e3YVr2Hi z{Vry^Sngtli#aYHVC7xB;Nn3SbJgCbT|89k&&ORn>|&m3@`#H^T|CBN(#-Fv`zwwV zzv+EKo&2PWr`%}lSReK|IbT(J#>KNPo^!Fl#gH;A5Cp-T|4H-xF6=iwJ z#Uh51epyLu0t52H0Fg$?Aq`au2pp~zg@S+qU{?{x98i}`-^`<9=$*yZ9=4|_c9)^g5y2t0i1 zVvmcxEKa) z7_0i7lGva8V+1Qh%Rx8#wr%>hvLCg~54-rq#ZRR^`I*ave+yRSd4tV^v-)=ze{iGr zP|3reE{<^3csRz3Cj4LWGY!ceR*Ej%iFIMG8DFLF4^ixwc4+sR(kA|4O4H>xq9 zhn5~%d8px`riX?e8nF%v#aUO!Lv1gbf&8G&?95fyLp=}mJv30j;+HKBjfN>3`?hA-X0!$dWd<5d(l@7y*%_*iQM^l2@X{*d#tyz zB)sUmqo>*%DRn-(&h(<4tt&q=C>Lv$mT*0I9(d!#f_#la@q(W5ko8br8VlBe!9x#u z4^ur%^HA{6$HNE@mncqO4`+E8Abpy6x`#8=GyOdD_o7SfnXOa*)R_mdAL~394a3+t$61)T#;FG z7JaFQ%h)F#uJpaKG!2+#f`^+u+~P%9CaP#wkM^_q zhhRmxO&K|+G~Qln;}nTIJlyGFtu`WZx`(?wEc5WDhr2!8JgU6BgW^X> z_5+8Kd_qRH=t*Yb!#4bzvWI6>=LI6~X`hv#^K)|M7%k)~^YDU)7d^brY3AW24~w`8 zeQX!ynv!J?!)FrH8LP?Dz1aho3xr?co4>$;0=Y!*c#sJk-=U zxkU-7RA^8d}l@1?Me$?Qiw{KXB~ z$4Nf^_V5oo&4=LwK92Hntd9zQROh4p=&zi|NHbS48p9TKnGaTg`Zynzd@yolAIB>T zt9ODQxiJWHktfQbSUOKn_EF78bstq}=Y>*5)Kg1q_^9clwvTQ)Wsq8aR5Z(CcIK_) zBl&w-U9p~6U(9zfMszS5`55Hm93PE+H1W~YM>8M2eZ+h;_tC<~{0`BBf8#qCEq%1{ z(bh*RA3WvJ+K&c~qMeWS(%pS@@X^u7sXD!{gVD(c*+uLuG7Cl5k^@t_u@iL4q#izc z`sk%o`V`&bJ`z6q`RMOsMTh7wcS#>9A3Hi2rVrPL=fhGKTXag%f{GP=A88+fkI=`# z4o1dD)kGwmu~?PIKun|<6lwc-<qu^tXj|Y6rEqOjDQDo7LSss>go{vW)9`*5r#A6~uJ??{9iou`s z@sy9JOQ%ew{TUz6`q9I&&-r-X#|zR6#D(lPJvaNJkC(V$eQeOOUF2h##9|*W`*_92 zt2$lk<24B`+t($ymf!HPM7p@5NiK6P{5O3p_p!pqN+0j|cvsuSDj#q8c-zNnA8Sex ziu(!o0Y>B2!Leh6wenx5J%{%7KHk%&LARp+MvXX6KlZW7$7V&_;^RXf+oiYq*yiJd zQYqYRn2|N#;o~C(FP6B|2Wwm0_dfBl%g1gXpZeJE<7*##l=`{2S7h}*<0yBD7SR{7 zJle(B=Y#yx$5*P=N~IoP=@P&C_=c7D@trI`i%j}n;vm~tvK*55QT)lrFI^0}9oFeD zB_Edin~&c)t5p_H|MKyt^bwKGq494Y|ETRGPubX`(>NxL4|4c0hhx*Ikj9EER%TI_ zM#VHnWN=A_|9}L?rSV!CucuKdjpJ!g@S`vo+ZYWYoPSm;vn%Hakx?kOJ5|OFJ2&CC=L;CmFLCML&ag@aPg?KqTTq? zG%icyzBFdaI5Lg#X07kt!NtRp1+r-J@ex=?aeV2HrI8~e`P8W@CQJlM_ z?-B16XNYZ;IxCI)(|9J0XVaK1`@?C>OJk1o1LA|?T=5~%Q{G3UpA;Vz9}^!JpAd)1 z^C{`4#rfhLvOg#NlDI%zC_XQ~AigL*DgQ;%i^Z44SHxGvW%79=jU{PR&!9#IOVe1E z#+PY)mByQCEKg%g8e8SOB8|7xcqfgOI$b5M7T1VxiQg*byVCEAYsGcqdhtE6a`&jW zH%M<3H;J3Y4ocm|jV_HnvV16hEN&Nfh#!eN#k6vLBE3u8Eq*Fqs?@#GpNXG~Ux@p} z+vKx9jjz-AGmRr@97yAvG=5R)x8fo3JMnw*p!kFMpd$Pz{ge2!cv$3j#ccJj(!Ytn zi+_mAl=rVR{^karL8T1-k^R_Av?oJ6N<3OTMqGG&v^Fb9mx&ccL;P4VkC#44JVC51 zo+wrke~{6~wD+4=&+8NZzpnV1%GN>z`#u+rppq_Mnv4Pl7 zY$SS$(^R^Z*i39Lwh&v2Bjnjyx{cUYY$x8L)Q%Z+${;37XR*83MeHh`Ds~h3uhQ9y z9@0IaqZ zAodY=DgJ5Fr;BHZ{Y3u7koD(rRtD#0a9#!jWFIJ=Ee;aT5s&H_`45)9NIYM>K)g^K zBG#AZ#nMB?Vd8MnQtG7{T*e8IMeQs`W-uy)H#1nC!Q~l@&R|Xk4`gsf23KZqYX-Mv za8(9ll>Md*u9g@tjuo#F$BEa9160a&($|YOh&PHOl{!KCX7LtrqBu!BJTe;J$SpN=#Vz7iahv#oc$Pf3OYaar5_gLHQvz%I zNd~(z*e%QF;-}&saj*E9I9}1dklrVLDSjm`R_cKazRBR&EGlI2Z3f?E@LLAIXYjpz zei9FgKZu9KAH}Z~;b-Z?;xFQ_Vx`_u-~J)}kNBr}MEpzqTkI-NWTUIVQR30!F=AG! zWzr{PQ8|l>(uR1PSV=ryJV*W~N}nQD5l<3N7ORTa$+Mbtb+Lw6Q=F;PI$6}s;?gWG z%c5Qu^|MH3k;QuCm=(*#oEV6m6ge+l5c`OI#f(zV$f92sgR?k4i~h2oEuJZ!B@Pe= ziWe!@An9|&bH($-$x6LIdZ>7zI7GZiyjYwk&tcNT#S!8q;%23e%wkj)_h&IXi_5bZ zoyEi~CduK7EUw97TozaA^eS`*m zEDvTeH;bpUn4iT%vOFd}EY1@j5g!#NDZ=B@Pl!*7Pl=By^%?2s#b?Fm#0BC)agjV< zkbY5oNi4=$oW;voydujI@m29P@pbVH@k7N~D!oj6Q(P{-vnSeJS7os}i+{?29M)v< z78iawMwa94EZ*TtFGu5Yyqm?^EPl=6w=C9Wu|A8>v-l#5_p*3Diyc{fl*Id(Yxa z>9557;@9E668(;wj<}idI9qu2@s7CDs<}h!vC3h}4s=FE$VxicOT-q#RAlQC^N*IhvKDc{zHN zqh~o<$fsR7+LxoHbSts7*hXwC_EDS;(p|)kVkfb)IJ|h>ls;ALCUzGuQ-og9sdAX* z=q()+<6=Tgic{ooNqeF#I-)BU?-G6Kw3rdI;){w9NDnB-z;cA;$d{ua%Nb%Hv9EZV zc)GYndHYHC7ta*W5|{rKt;(~@F{m6vWjRN@Ks;AGPaG_sFMh3<7fKHiFA^^n|555N z>EYrC@e=V;v0f?~>rv&nyc{o-%d{AV2`7Y1H(vOSt#7D$O z#mB@Iit~i@lj2k2)8Y=LJ|q3C_?);vTqr&-9&JV=@=`e#mE)6g>?+6Na=gslxEyQC z@k%*fEypT(z9udcUl-pHmxxQns*3ie^m1{9xKiw{)YZ~!#J9w^#dpN><+H9F>&x+> zEbob%#rMSx;zn_kc$IQ(k=`n96F(4t-X4AU-7dXD{7Bp>ek{&Ygx%%%v>e}*L`Zs9ax4e=!cpluF@f5L|SX~?}|C-XZ#M)vVv95T7d>Z7? zFo(7|w9BE9?9Ii-ViU2c*i4+GTrH$qimk-fVjJ<&)zMzpUb;&TU32Il-BIi$b{5N8 zM4qQg_Y%8_-NhbaPw{z`+gmy&#>IrVPN`-N7Ef~+l7lUKA%{LWI61gEc(Rm>zL*v> zVpcq)I63J+48^=y$&O}7-yBZM;T%~`7ta#U5c`S!#WTew$~8cGpm?@8NX#kqT$A$xhRK=bGTBLp+&nmOdKwb5HArg6(=h1Na<1H<>F}Z3i0Z_(Q3U)dQ8zG zjuo#F$BFY5?YbPU&*6z2p3LEf9B#~ES`O25xJf>@i4(+|#aqOQ;w14_alN8VmcCt_ zBHkh1DNYr?ljmJI+?~TivfLxyFWxK85bqObinGKc$~#+nj`)E1pg31N$%#hxVd;6| zBjTgtW8&jtQl3xc@N^EZ=I~k$^JRZQd`5g$d`?^-E)<^^2P(pg(l3dN#Kq#v;w$1f zdA^>*8#%m_!@D^wk$t7OR9q&$DJ~aRh?A9fmGo+Hjrf-Mwm4fpYo#}e>%{fqd*b`z z263_cH%V_6w}@NCZQ}d#*`C9W91iF4OCBHPu#*cggcsuD96rh6&Hz&b?8;#`?E$<1 zpXRV9hZ6!+4zM?e&vN)9hd*=pJcloG_%4UA4n!W*N12z4kI{Wqu|bJ6p7KjrXq z?%#*%&(%}$%*Z&u=As}JzbWkRBA-w?B7p!$vBLZT3RULs9RA5gKeG@$B&;7~I6A;_ zLG;k(F+o(TV*^wOP!^zK5QQ~@=ov-Y>A;5YAuf`ql>+cph~t%oFF2nVph|#t0on(V z@uUE?0@PN7lLJ%@a7qxpC&Knt3s5~kjUakFo=;}hWc5l9t?@DDIsxhiXdFbP)DtNh z1*jjOfuhxPjfM=qDSB|4Pep#HSK*ojXd0kdfaU>O251!^c_6A}3ssL@!AIcu3|Q*` zZ346nqBp$wOc#UjZ3RB;J-VsUAwb6fu>kP^odR?Y&?AUm9qkhQ`y_d{09^x|sw(lf zEci||v-5q)?rdF~sAqbrR=tAgXHr;n?;v_&mOcqqUPV~Sn+%W&V5(w8dvOr$08S9S zXwTQ0nB5PM4lp9XB>^%4vH|)9=pUe58QGS;0dfI?0AUdQd{7_R^8pG$^zp#jz!S4m6w0cU`Ylxg7NI zoOMC;Vhi>4K}6Q)rT`OyXbDVKg>McpN#YifO7V*(ak}oVg9AI96$2h(D`#+^r&Yuo^3yc%Bb@b~2{9P~d$pB9U zSfo;(W;OVt)26a#RfqWjp3&T9>71+2X@)Ndu#h5%9$`jQ4> zlLqSQ=nifVBbEDes%g_*Q`B5-S3%RK-^5 zbafE@ej4Mf(J6l*f-hF^^ldIi{yai}cLVV0bUvkDCw%t0k#GBIKU@L`ao_Usa78b*v=)RF6FN_F&CHZPHi>Za(Vhq1?-al zo&dWgX#7-y>xg=<)(#8$BEUXw0wHRL_%gs(0saW^r}lyU0e+Mld+F-{2LgN(;9K?c z!2mz7?E${m=>WaY#g~Qow(IiCE5RFt8v-9mI zUQ-%}(QvaMp3=ypS%~H#TF8xK#5aYRN;@muIz*cgZB<-{5FJCb3(-D|wt7~Eea;S{ zXQvRIC);Bjh*ZXvpd(YxV1rE`xEi4e&UJ>}mkMDGx>FzU2;$XBkSj-uwT zT~VY;HD?E!AuOHRA)N5vE{$d~e=Dh};fF{wW*)ur$b`s-SQ}zpi1HA*5VwSw7$OJ} zh8P-R7`r+|A;eiB288IN5$PXB?`5-~z9CLy-NI-DqdN0f;8^sgvVQE?#>S1Vac0TB z+r+>SXNMS~1`Y~wPKfh3rkkVQ8&n~>aGV=PWO63q-8AjK& ztHS8=!OF0RF)EH3$A-8j#67wgjSKOJYp}OjBHgaz{4BlIetn1=Lfoi;H>nO2!sr^! z!QwdH%pq$Pt(r+8ZVmBFh-X9G7Gg4ohQG(_uoGA`bMY`AifxakNPtsk3}IC^EAXON@9txY805nx14y3_=d`5 zf36I%M0#n6WfE_O(J%0<;H2GHwp??MZoIc7SF!g(tO@a!!oIB$Va(!Kvy^v2ysM<* z&n&DD@gBFSJSyh#euxbrehl#wXJd#>A-)Q+Kg8w`TU736A+|~|;71|0h4>)EhatAp zK`*5;J_lt7SMho7~OJnmHi<9Ln@jT z`5tT|tTW-0~Q+r_bYRLDm`SaTYUJdVqwdLA|M(b})1q?7VEK93XfsGR?I##T|Z z6Z6q-%v{B>J2@Zi%vF`;6nS#zsV2eTHJO@6n>^a)Q9F-1a%+}H-BQek`DkaZmq-0P z8pz1sxL~8WAvemSu`Er*rXrJAG_PpQb=o42mU*<2Zp|j^GDL@>PdgRYMQks2$fKj2 zJL$BuH0#N(;2utP&EwQOx+%50$kjx9k9@S@bL;D!M=X!m@_0Rucpiy7uFK>4Jd$~& z^5~aG|2)h*tUUVU(Kin}4=0ZTE&L^!e6+9f$mZeY;pdUgW19vjlaFR#an`Z&<$2`f z9H@r*e6*&*V$F4F=9a=W{()=o$6n}vnvza0azoh}8Yx!$%skG@V|X4T@)(fEz4G=WrmTx#4gQFllfe=jU-j9v9{@RDC-nkBf@_?V^2#{dTcVi$BrB z&L5Wl_btLp^0+jQF{;mH@}d8gd5p|sR34X?>N#3dlzZA0^5KtA@$UU9rE+N4;aBG| zHXnTsy++1yiq9LNYuOOZ9JZZPf<@nu$BlX1oyR?S+?2$6m+;Z zj~N`VJm%#=`+a%L;lgQY%*^xkMq^eU_bcY?{J%d|S)9hK`~!JBn8#eTi*X*(z%iA5 z`$!&-=JAR$K9>{hu>FK4Nis&Tn#ZSk zEX`wC9_!h?dAym&@;p}Nv5FPbb#{eHVe=VwwL0w`Z7(cnO&)J4^=-A6{Yjs9RRlkC zt<7Uy9{fEVdh#RE`+020{38lsM+d0dF;*O`#cWj@foLI9^d5gZ6069 z?Q7MU&imM?Jif|fzbq_^-AFqJ;()5e?kavxDgKnfclqcynYVk!4|yEQg0;g*u{`dn|0Vhu%%Uv{+WaF$EmU!#9|PM+I4mx}toTRH=aD3#d^*%>qs+pmG7H zC`%pRII(~#1)QW)hB{e-S*jMm>=Zm`uU694izWI-tpaKnP`6Y>osxf4AK$1adwn?< ztI?={#s$~~I0ZB*plJb}3+PfnvjUnI(6N9{h3L-~e3ZRK0WAw?RY2LhK2r;rR?^cY?h@}V;2w#4OQ|y?n0Kbc ztdjly0%l9kDOnyU;6drRCCft+4;L^`qS(gA3V6JL9qi|f@k9Yn7O<>f3s@xaQpt@ziwk(UfLCN8ixG<1 zUoT*Z>~wphltjI>pX_v|C$sM_Rza`^u+brsN8R9|-s_B3 z-poA3KO5mMCBHYqA4+JMAILq=;IG+#6#veb@{71sxR}>u76vXcP{=@GBkbg*28t-j zS)(ZmnF@^XYr4!{X5exIcT9LwXN*=8v6%1T!;7$W~8Mw~C^=!_-tp-Z9iv)F~qJdd;guk`j zVBkgrHyPlsZ_M7z$m8Ny2vVq%JR7Y;t0p6jU{V85osu&=W^Y~TO zKy?H68o1jCj}%PR4BV6FRT&@Z%A&e*pMe?%4%U^A>dO5F9x(7lBJ!YtnkpoJNF`Kw zSS2JBKE|etM>-hjXy9=JPjFTZJY^tdAZ_4j1GNl1XP~x$Kk7==dh(2c26n`%C(jxn zzB4vb$3VM!Vj74VsB54eM}4lKzJZ1Y8tJ$iC{C>>2A80oFmXzmNG#5PzBL>-U@MO) z@(MI3PiQu&ICo+sW56*G7-0y_8es%x@(sAkJw+B#n8U_w+CUSPH&bk?n2V6jmAA-C zS}JK}pmko-#z5OVZ)c!=p3^wrJmN8;lY!0#x=?PQn}O~I_=+(kO`AV&F8lt%;{i{<0%y823yRGx4c` z&x}y=xq+Vz{K5!e;H-f!4SZ$bTLa%2_*yp?x7#;VK2*S$`pGxc5Ak~gKjuq+P{NJ* zlaidmuLgc&xHeJ9#5n`Mv*!l>VXQFlr-AbZE*Rl?elBYLr4cxnB~ph9OcxFOYXD|g zD<>i5cwrMoOk8fFsEJEW6qpbbmzkkjL@{?2!01g$&L%5fVg9et|F>4$LDWLZ&joe(UFX1M`1pyoL$WL^E18d5b`zCNI{+ zF=3goO~g!IgG)*=&ViUnn!NHArW|1@Q`$sEb;uck>7`i{t_jbCZ-z&cz(ivcbl056 zK5wFliKb@w$xW8h!-@Pb1(63ber2Lsqj31GOtj|SF)`Uh8xw6!j5jgCL^~7hO$;_M zgtKa*qlr!?I&;*G!dc~^vqdB6Vq#Du>Cav@lCCDYndok!2S;t9kI6G<>1m>u5~ps2 zStfpdKPTyHqMsJ!?z^&RfEj*$f?pLFNV8nos={ze9BN{iiQy(jn0Tj=Tx=wCdtUC9 zZWI}*OIF{AjG{vtGTOu#6Js@vQwfD(Z+91v+-pc(Lni6~1IO?d>Q_s%gf*Tg(k;8g?b&Q}FCw8+F_?bSpVOH3?PUM-Df zCYGDHGL2$stT3_C#6K}yjA50D)h6axm}`Z%eAk%x)5Kq9$k&=!XJWmH4JJ04c-6#f zCN`PaY+|2@{cN4e^<ISnCB7FRCf3F&$$7yir~<@v_MPE3YV$v@zv% z6K|OK$i&BL`Ark=nmDEWxQVw^^KFv{tkCQUwRuwU9Yvab&&2yCKF~g}Eq0ZO$62Ni zRmh5*rB6(JYvMbdiqj^}F!-DJ%*5wrcu;1QFSL_iDV|lN@h_FI^{?}iZ?rQk`d*Fy z&alkgr2L(4BR`t>$;8hlexVb78~M$|$S)$lDra`IDd$u|PB|N8hdB?N!}BICm^c>2 zOHusIMW-`IabHv}n)ug5gD4tCfhaDChAaMD6osNF9K{n+JQ)Se7Kx&46jw)aX%q!f zL{wNTisDg76qiMDxk|23q<+yT)|%W1a-~Z6RwFr6i72kh>y%VdN|DbnmsV0H3UVeY zmy4o&6n92(R}|MoQ6Y+3qo@?cwNYFb#m%aJeH0ay+^Beiwo4o)6FjpA;VJQzi_DDH{k-f-SR`z)oY>UmB{jVSJq;(;hw zM6-QEc(AK3!<1E#T@1H73W4V zPYFxw*usiAH6jzUi?wuF6w9Mn62(&0rybVHDX)lPrRw~@9hR=v(lv@}qo9O|1~){p zF&c*YBT;PPzN;U)+3qMdN3kV}tx;@KwOxwa6?dwU9m?4R?XcZkTdcb$ioNQ(`=Z#d zb>&SiL=;~}aa_CfRupejV#|prK4A2V$;l|*iQ-)qzNdJKZoIpII>h%? zLLPnvG>VU+_&ADB=o{Q?QJkiuejGUy1;2|$WpXC+&sF|~BC|O;KN0X%6kkX2dlY{# zvc;r!OumWY+bF(^;(NweTgJuYhbVrG;^!!SiQ*^rBqmH<6)9)>HHzP&ILBS1LY7iU zr2Nk){)*yX&PFVByiJPdIlylt7Zm@F;-4rkDrbk8SOhB!BbQhxWTCJXDqpHdQp5@a z6iKd%Sh&o>br!C-aJdz>Qqn>x3q>vd3KRD83JX_SC}yF!g%Z~Pdd2RstLz>XuClPS znv}Ls#=?&=DIS-y7Ou8%4U;Y9ER?rGU(LDSf3bopT&tzjtZ3oRxKtssmE8q5Sh&%` zO%`sp@KjuGwNS~zEt)t9RH$s>HVfppt3uOwI5|`x-k}yq?y^wT!pe9UJnz=dSGRDl zg=)(0QRFC??z2$C!owCGQQ`d-9<=a~g$FcEh=)_bRMSG~#gW`HQTV78)_sfv*LBS4 zkUz;TS!imZnT4k<)Ux1M$Xa;D!m}3AR(KomISaKd@HdF4g*q1MT4-RQA)VY7`cFLz z^ql&dCCLdJSuj*i$%(j_$}dYul|=YkhNaeQ3o#3Eyn_CRI=xL#sx=l+9 z?Q}s|)JmPLwS_iH+U8xZh=ukRI_RJ}TIgb-tA$P$I_F2taXpokZWg**=%K>gz==(g zGAtR+15bn)e|oEbu1JPKvM-el>8FzZ76w@1Bas6w47S3Tb}I~V3~QU{1{N6cwkU2@d8a?ZxW`dYXNLs}cdDFf zl(W`u3ww00-J-jXnhfCkEf9|=9-zLGLyD9iRm7dS!*b&9Iy6^d8dD5m6UCoC#y zqm+&7Y+P^SDjTJ3l(!k}QN~7D8&@mg%5qoo6ql=9&JG=eJMnQxD%iNz2Cs>jr2OZ2AIZoI~o>CH@u<^7C$)8m6l>NUm&z!=uHnus^!bVFQ&)KML zqmGTbHe5SAy{TuTzKsND+vd*%XlTQ>5wp?AhG8RWgJb71nRa;phlDdg63&b+A32NS zHi#^xkR+uOm9~+|3mqFQ%BqoEMI!5ZHhfN+jmFwgXv9Vn8%=FA%PUij$~pb!Dr8Kc zu$2u4Wcprf8}B+HX=8_{*_?;AHrnOqq`i#}$~)#Imt>`jjjkH~{<6`{Mt2*p*!a?w z9yWT0&VwU1dfDi0W3|qF9~*sb%(OAfMn4<{>vN77m7*!an`1PlebXK}%g^&C4A<_vpCfb;4W15XgHYTgi z6dSX%;f`b4n+^Zkn9AhSZOl-GT$YlLvNGGo92G87oNHr&l6i`(J6{PO?p>&awb=i~ zHkQ~}s*+_kmMfwC6*gAdSfyG1Q3#bUXiwN8vukXuwXx2|dJfH%{Wdn(*l1(BjU8HL zla0+bwkT)QTkY^~nrUR4O0IW9&d1Dl+SsL%y^6bSJmJb7Dpw8_a#i+e5#v=0SJ>78 zZSkOuL+Wyr&>N3(Ag=H#?2s!ju-#t@m|j$JOz|bfmldi1s*Trdyl&$Sn`ij=(#D%M zj@$T%JH^IZHr`gp{?Nt=?s1I|@7XwM;~ka1t9VMWz>{iTxJ{VexAB1r$)E9rH>`5< zPi%aam!DR0M)6Zc&y&xUe4&^NXkXd*TBGjIHomd(t&N{FOM~C3+K-CgEB>I^v1Np% zIU@{xzu5Ry<-aNZp?HoFQVBJqKZp8%+Nh*al2DkV*fR74@vn^vF{vxG9E*VyGFz%`w~(L$w(0iSY^x+dZig!<|Yh#ZWnh+hVv~6N~OpIX#Do z*}F7*w_;UADo{D6R$V3cE8ZK!eKFL?m;S#&8hIdw2UUlh@`q!1B!*fsJfp%#V|Y@@ zV~UT*@I>BzPM=kt(xRso+4QqY>cmi2$#XH(RzgiysTV{27#b;W5JN*Htd;9Cbx4f7 zkor~(b`0HP=n+FKhB)UlhQ=`@Vo1i|s%A>jQB22>Q9@I>7PI**t$8Z+Rl+RWdOn6G zF|>}MjS8E_&@6`L`TkI+MGP%tXq7h-R?*3)@wPFvi=k5towc-m3?1m4`AKG7>QJAl ziz;-Dp_`WGI+iOU_Kcxd45MNg9YgOJ`ou6WhCy1TuVR12eu~tmy9r#vEtk=ku$b4`!Q>yM9NY@UzHm$Kpn6;8}cCdV)(hN&@3i(yR+Yh#!m z!;Bb~#IRH~XT~ruhWRnfieYvPbMiLl{%0n0ommjWqI~JX|CBCPVNPe6@|B9qV_2ai z*Yj1%*~8U&;kuk8h8;1ik70vmH^#6zhAlB(FNf2`#Ohm>Z~KoVXOpEnRk%lSR}8zA zu$2AT8^b=$?vLSs66#aVQl`T(9EstAZu6rtybud-GJF;buhCwN;T^6iZ~n*d62pQD zDSt!BD>1yPs1oG0!mh(#fQZLO(cm(-dXO)KohR}Z*{Nq@jz={MeiK9>)cO+0Hfx>YViDOS3 zd*iq?j)FL<$8m2Qk$4z*OT}@O5>dP?9yWJ*97W@}B95-UjQ8crczC{AERHR{eCYEI z4@$&QG9Lbc2qjD;_kCJWI*x||IdQh2OdMt7xH=95!gNa<<>Dx>*=ypsK8}iUREXnR zl`vM2Ul$L9MoypE8{)W8OK(!VSxa+j)VVc|N?N6I9981HYlPcW?RE}X<{3j$@6F97#oDb zI&svEBNj(o4c3ceeIO0us2|6|AiQwnmT4GAqd1H>%y@WXEgJvdePiBRW7blkt;j6z zvnAq4#?ds6W@?T115 z$A~yavU|G9^leV{s5nN)F(w{{smXCn;Tpv;E)L%G7|+3e9GRfVJ0TO}n8Z{$yobj7 zBqUSm`Hh8Xb{x~Db*ZgXzQIJU>Jf_;n0rg(TxwK9%XajfR(JlPNre}h{S$6EEwb&Bg1S;|D8+^Cu? zVwTl6tC1~=TjMCD=V_cS&gTyHzp?DpSt`UA!5Cg{l--K_hogOQ?C1Qjl#Rx5Fpl@* z_#lo$3?^}$(!g>=W604sUWj8;W4-MY$FVrxh~rI8bz^yn?Z)v+9OoJfv)4T@uWD~! z&q-A0ndgOxrJSGRalFm8`1`NUOzz~L@)L2KjN=`Kh<`QKZd_O8#Y_ON31?|JM0lSek_eAzS0=*!BFdS)EP>0F7gf9>FXus!VX9aHpEU`0PzkM7GJ#Tw zFm7{)UX=*vwsZnz5-6*j+42cooj^IwUT7j$H4T5=yC#7O3EZii+54Ib`*vLd*C$X> z`*}kGw<@_&k)<~&xmod+MEFBLg-n%HQaOR!l-#b!?~1eN&IImCV45~vHG#VmXqZ5w z1ga%)PXbRQ@MHqj6Sy~lhZA^&Y6;X}2kOg%3EZCu4}$;iR}Un@Lpg`Z^pK9XrlQ+4 zoZd$h;Q``to$$vLna$mvdMbgZ6L>Cx+SIX8i=_!XtF6#@=nQ($&s~1j(YicOsGA74 zf4v0iYb$&Vqk$Gtjm;SemP7|U~mGXboMxwAxcIjFf=b2mcVf3 zBl40Zx~94FtDE%3#n=SKCon;$Wn6ytCaOLslV&I7>rPH!it?$7oMDzu*9n}Fz)U5x z6c;MaPGF9bxr*}?=PNEyT%%iKk#f59VkJuwSgK@MUe4{XGJ#bIY)WEt5~~wflfVV; z&;-^duueDoYYD7Z_t=oY#zc58l5*C;*s~b z^i4wf`w4uI^K(@w(<~Hn2p=c#i5fhuct-J4>L~eK@e9S8%|iV|Gx;ikuM^-oFtgw2 zx__JC&t&0GnVf|06Zj#4a~ef|RQx3$QGZI{XXRJw6C=Oo<-aK@%HNcg{J~jL@>c@q zm6YP|$nzsNX{~<}xR}7BNj#RszX>3T%aXV}iA$1U3}K2SQ7F#~D=Cu1rAi7Eb5TW- zVGzsRxhhI|64xeiT@oFe2~U}>OrlsaJc1NYqI42vlHuLm5=jhfCMA>MPa&m}xJt=I z{bht6RW=#=)z!%`qUIjDD3?Te6;ghUk_w8;o5}T5OX3k#rf1%eM5QDuCvjskbkv&^ zNp4Q!7Uj3*C498twj^#(;+`a`tMCrRJCmrA*Ez^XkCLdWSysF|iE2rZP)?g9_iEAo zNj#9mefe57^7;=dshO8Qq;*;GVU^^Ja5loLfFzzsqH7Y}l6X?5iF-ZbP~0a zcqWOY%AZZ*xg?AvOwHC#qP`N&aGfOT=6Stjc+jDcsX-DAlW3$8Za_+M7)>IU*SC_e zmFJ4$$`kog3RB9{No15bNw`X~id10oayr^XkVIp)m_!q8x1(ayBw8lXDv4&AZLY|E zwotOZnJ~3ZqFoZln@JlLw#^q&t-bONN#umAMYT>zbXIwn|LAv5;`?UOKZybKlVo_7 z%hWT8UdnstC4H3iO`>03a-mtc90QXWoWzhM266Rufq1GvG>KtJtVv>R62p@ik;JSd zW+yRH+nt!iq$EZqF*=DcNsLWmyvmC=mvKsRn9EK`f`lVtnw-RxB&M{yN}-b0nv=xbWcaMY>LlhRF+Yi=Ni5Tf3siGa5(_mOZyEj$yEus@NnXtf zjS$)N@+8kNu`-EON&NrQgSib@ySXrNW9FWSSf@LEBRx=WJFnO5hGh6dQZ7o6Y)N7( z9XN$2Q`nZo_9VVe;+rIPB(XDzkCON}iCszTPU5X3-cDjq5_^+)o$}hUFNqe-!#RJ6 ztJ7Tev;W**NgPVza1t--D0tm;B#EO*yr9`hdOgL9rVRftOdqE?mJEM`ZjuNW>*XX~ z$*eDm!-nX*y4(pD>7R&g)8#>$`p#_`RgshGr$s> zEtx_oC1+JwI)ySRlud=VFK$kScRa36pAKbo9g?zu` z`V{_Z5$>kqEknFT@x~NxO2Ka_{aOk+k;e|6e^yFiYD>8*g{mo3PKCknwp19*S@HH% z`0&*oDO5?}&J_5-1|PKGlN(&MyHlb6Ka#?uDO5}0o)oI5!fQ092UEB=#g~^O_oYxH zh5MB=%X5YYQeYxs_MsGNDt}moIR)xJ#x0{icM>00zN2OM)BjT`Je|Vs6!xT0i>;^7 zCWW>sJe$IEDKyjm)J~y}4#8Kfn}V4_RCztc`icz{8>Y}G1w;9#Iz@lB6ic&dMLUI< zl6VRUom);$Jsx*d7#;$Ylx!s#C5~cN(M`eQ@LPq`$Xaz;NuYA_#!8-7Y?2DEznZ4P z=fFugrOi`lp<^L$sic)+Yek+bwo9RX3JbM*2YN*c15y~63ZHW6#AS+0Px@*KT~hp9 zyzmBESI(FfK7`OM6+WEMo!f^$uPf(+6J9Inl|t_n`se_eW$Me$w~~G-^j8wbt! zl&+G(v=j!XFeHVcsqm4fQ7Md0VOR>oQ{mam2(>d(k+GB#KH$MUGA4zI^z9VJrZ6sr z@hNaOO-O;)<18g-BIj8UadHY%QsHGgIrka~?}1NGVNMEjQ<#wo@3GHRoRz}t)c<~E zppbXSiStre)+)S@G+%WVDDoCMix#D@I2GQxT9U%X6gDYeO8pd;r^1Ww6)CJvVND7v zHM>fY@|$}{*5>(oCF@dnrBxW{m^P&Flk&~<_SRCpb+{2owxqC?KCHs+DeP22`3@!N zagkklLg8NB`xh8PQrMTm{uBt8%zmvkddA_~1yr04c zn*B`i!xTQrmwuGO$9euzYdM|gXOw)J!gtysYmQyUR$nbKFk_u^DtK_=8{M|NEQTYvuH|FIx zDY-d~Tk?`zl}eheoW^ZRZdbfRv5MlIigzhiRlHmAk2YbHyC;q6Y22H}eQEse;135i z(zu_(4DQX~fixaWV}2S7(s(G1!TSoPq;d0}f|_YOoW>)ZoVM~$2N{sYqiH;r#^Y%` zkw*J8I;8Pr8c(IsC=DZxr_-pF#@egot+w(EE4GzBZKZY^&!+KQ8m)s!v~Ad#R&AwD z8gc6(`>261?MIn-YMX)i6)Xq84=)u+KnI!J3ujux~@!|NbDJIJCA(oRcvbO>AQ zm`2gk!qg{?PHA*bqe~iH)996#cT1yZo_AN$L$UR~0;XKu-f857ee;_Al=RQb2c|KI z15bm?G%C$!BSSJIjiDTP8pAb9$;dQDC}+o*Wny+r8e=)(d7W`eCMb?q%vH(ZB$Z57 zq>-uWCv=r*X-ro>Lvg0!tbFNgC3Di4o0rT}!jIoBOk+_RXVdsHjm2p!N#ngV-cKV^ zPL`(eLK-jfEwD6}b4PTP6>02FV`(Q@nZ~L#8g!J^bj4?7dm3x#cq-}GQP!ogK8+1& zY)oTI8e7wt(@{31u~`YbeYm4g^0^|jEZU|nMBxr@@J_N*v%9#^orGy*C)tz6-Zb{5 zu|JI?X&g=CKpF?rIGo07o#ap&=UylvIoC--e4!vm$SZV~CpwGWS&pUAuCtu%EN`Xp zQW`I7_7%m~6<<|+O>tFcq4FDPys6pa{}H~O#)&jes^lHT^J?~8<);*L4SkU3pQZ7k z@{bfhR{TWqbQ))rd`g?zD6O&j=V^SQ5@uOM{3?yF)3_sp+1=!uG`{7&?ji*le3!=e zY5bzuAJVw7i!lAD6G%eIPb&O5ja=!kx9a@kbipbqROMpK1J+1~RxLgY#)z zpv|Y{pESC4k-ybi-I6j+H7UQC#=oktwu>-ZC=*8POBD-ezz^LQQQXHKR*Fn56WWht zP@=0y2A5@Uc?Lx@xHg09w8|A3l*yoM23KZKEQ8`1yi!G&N@Y;JtCYx~q!Joo_Nsho zX(be1ok6{>GN7xJ&!Bx*DVM=Cg#EcDg9;f?zO1Vp=_>6@$@Ljj%!C1oTjo?(xgmp_ zGPpT|8?_rZcawX%$t@Wqy9ra}44=#WAFrf@Hg8jMdtTn5n^ei*&J6C#psE_->M-4% zLA4Bs{Ms0^_h=ETGy8HkIdi$(mqCpT?q~4N;3@~D9Xy!9Lm5oWU{VG(Gk7?IbOxCW z9?9U*3}P9?Gk7e6$1{j#aPCOK6B#_2LBk9hW$;u6yLK1U&fu2r@<}&&TC=q>cqW5q zGkESl>C*1uTGYw#nPJpp>)oY(1`XJ~?lP{sFuSR{ywqKO?k+|qe8Id*52@2bOfEr> zup%XF+RDJzK9GN22!0PqWH97F81u=K8KiWQM`{%(gKP%FbOu~5Sr2KSL5B>y48HCm zeg;7XjaiyO>kQuSDNQnHn!%W!(u&L1Q<`Paf-}%FY`wV}snJtfX3)H+Fj2Tcu}uaS zd&(WXq-`erph3F~zp*C#6W)%Tv|iFJgYFr0Qr=mS6}x26HP5NT)I+laGU%B>uMB!? zbJXmo@;-`v^HnJCuL?9mK2ULx;$Y5(lA(&MLIoa8hI5Sj3P!MRO2|iLFgnl2WH2_* z$0-@FI3a_My@bk>GnkUWn;9JEeD;zTd&$%cE|ivO8BEV$Mh4&Z3PZ=S3}$99OS7{x zSfgZ426Ho*m%)6^uF7D6l9h_AxG;l7$`>mxQCzCHOmVs53PtMkD}q<_mXP$4)pX`O zUz@?Y4Ay7(Y&kY&a6t7pDehFhHedIGv7axMn;F}D-?<1dQ@I?k^Gx$;smhCHFW%L8ZeTDpy zzVa=De+J^SAqQd07() zi+)#yKNL9$e=$DylkRCxsjob`Wu}wx1MH zywu^Pba-T;ga&hj$UvPt+|;TRx!gff2P9WGD52y^2e0-MreY3?EB{`zB^{K~?0L0D zg)$DxIxrnX9bE08oP+y#QthC;gKHdAb8wG?3J$LAFJ%Wv6%q&6Ik?^lcVa~cH#mGZ zA>=nYxXHn74sLhwOno!VdpD3=+|GEDl4IcX=i`=roY^wGmw+q>EMw8 za+ia5%kmZ_8V!)U9dsHX^9IPS0aBeK8YuTVI6WY=S!19y9w_%ac)-C^4xVQGchF;? zLIq2wMy{dKLOgiZ7;NTEBuIX=;ccsq^6}mC? zyK@N~)Eg>HJ(XmKN*@Q^hKe^##yIFp2XN5e!2m9hgP{(V50#@sWgwNi%9)`u$U(7T zGFXv4ALd}VgV8$Ym50fQJRj*`6df`a&M@U9b%uo_9qVA6gYga~IGE;Ox`T;qbeK$W zFx9~%2b0wlm0628f0%3;CT|Xt?}y0@2QwYaaxj~lWw=xyF8p>@qv6tNxQrhz3x~_= z!)2a>`3{cL85}HdP;!JEb?^cw(7_@Hi|JroLhS&~);rjsYMUKwRI*8t`cI7zSL<$3NuRu(?V8=`V26X8GSzZq zkAuD3QzOFAu}{?w(yJZpSAIZouYMiku!AF-T|PpnKxAU0FFLq5LMn`uSDo;b=9uD3 z4qjF{C9kN2I86!K6mgf z!={5TIFqA<=_@5?9ek;TniPKR;2X{6gkO%5@ALXUDfvMaeq=2*^0Nwm$?N<+N^Tr2 zzcJ#CmUD`!(ekH*znt*gctsZH9b9l=jF;tE{LO7XTHGwWEdJq)IpM8|e;wSC#jRN& zi%YVoSxyRNQIJJMd11vOikB+#UneAs$)lx27A3Q|EQ`ytD4NCg(emIJxiX6nM#~j6 zHAc#f2_?m{AQo4&$4IFxuFB%tEUwF9(ikb7ML8wpWt5avyjpR?7@@qp@@ulFpyV?Z zUY|w9EZh=uvo_5*a6=Y1vfZ(AQx-Rk4ZVe&m{F{hMdd7>&EmN%Zp-5KEUIU5Zx(lC z!}wNBv5MlIimZ577FCtsotIFP>7IP{zARYu5T_-J8d=<*1&f#-$bvzV79Pxo2PW!t z9xD%L@n{y0W$}pC%Gnt|Rt}Ao$Fq1MizhjCW96wVp3dUjSRuc2oYcyK{bzM%pHT(! z+F8`e!q#ro&7xiwjj}MZsGsjG8>RgQSv1Udm3?5BOzn@QJgPr2n{Z9-3s)G>c|gG|!?% z78l1!hb&rVF>jo-qlGM5DQ~UVMv+BrvuIaENM0Bx6^hDdpAae?B(EEXwwOgljPOEkMQFJuoXWK1Bg%wkm* ztFvJ^X7N!LA7}B2TF6z;b&Ncx|0!pZ(Uq>1#phXkk;V5}{Gj@0 z6~D>i%PhY7PrF~|`M0X@og(`~n?GjplV<6TFzz# z7uUMD&i$W1{I?qwUEJW}My*KYoBpFiwV<-x>Y|d1%5HdPW5;;8&Bg65I=XmzlHB2< zii_GV>bSVm#e3uBK^G6XxXVRV7k9g;=AuzWsiAm}i+hz&Qr!g)PbBxLr0|50->>|E zyv}12q^669T|DaIF*QydHt~omkg)V|7f-P#F5iv}Tc^U4TH0)a)XLj=mYo?S&$yT| zK~`!*&$;+cNnIE9T(~Yg7xi5X_7ZfBh6LP z%0+7zEtI!Zq=lJks*PsbDYjMIGEv&Q=-}c7RX8Ihi=;LB6yR^HYuZw;zhPfE-hC#2ti-9f%xfpe{V1SFklZ0e2UB$&v zRbZC2LZKG1$_N)DIk&vwlT%R5|5qMEQ!1zalu0tq#dvLZf+9^(ILXCi7gJQS$mRR3 zn5ul5;&jCsiqxO!VwUpRigWVvxi04A`Fs}(@_eC^%-(_}bgI`2Y6qwjV5y5`E|$Ak z!QuPp?_;HlRW9E2aNNUc7i$;?Je2hCapA~X7w^0Hz{NTj>*?o{0~)b-}tWJ5RU@f$jXmS7A6W`WL%meZKp`*9}AwGBF9|3 z8j>F-_q;NnLYOQ*{3Q{^X4)KvLk zs{E{VDfz_(k(zAxHx-`C6*1aO3*~>gIM1l=p^%3QF8+4$%E%)_M~x)h6C>7mu%1qB`=9>l|C9@I}I!L$33%e1=r;@ahb?R`Ki%xoxIAJX0!qxPjf9 zDK~nk?BO;KH+i_(L!x&0Y0Z8!Mlu8~B&kXx^yN6-l6)@f5f!>wlBzJkJ z>Y*hKdbr!e{92JmJUr^5numKlRQGVNhX*{|UO94~hp*Mt{T{BIB{kUkEO~rZXuSC> zc~Dz?DA(>Rsp(#b=8(TZYb-eY55I?+d<|Ef;2ojn?NRdq{amduYhs&JoMQ^f}VV zgF!oU2y(84GWqdkoDuyKCa+=23uWAkNvJEfxs*R1b$12nRx(;o;pA1#>;rUnny@%Io{(1D?D)bt@N;p_7}>2t@znOIk!;O=sc`doPT{}1INg@^{`8u+oVRedYFO8 zX2mUvfBjsr&EwNYVIOvQsJKWTS|sF`FOuCJ_GqnxY9Y2r_IlXoVZZKr>Ksrx30JVy zBH>^Uai4npm;eS{8Q~Hf_3(m+7d^~dBrkh-#ltZVFL~I!NKP!0vy0^XB6-zAxyACD zhu7)+i>2;jX}(x4uN)b?Sl-aFOj|5`+w?6DUvcMpcx$n|?coHy;;n*{40ns=9nL&A zqlfoAe8fYchxa{v;Ne3KYKc@@63*>YOC-KT&RiQAzeGOqaGEpk;WH0sIK4~c%Oz5H zsq9rvhO*B+e8GLaRDv>*TbIgNt|PbDQX$e5$u}Op<<|C5+sAhvzV~p)TLn-1_`$=E z9xC{_*5`Z5_?e6DLwx+ge$v4_{OjR259c_m9{#2)E|slI<#%qPrSgY|KRx{A;k+g` z#4nA{|GR*RoQJ}RH6#CUnC!;Va76HNiH}Qt6!^HXR7xz9LO$+UCWZa5lSLF8E(!5tN6In$6Y?E`l!1y466Q08M9KBu9UldRQGXurR-iQ)i^CaNLYn@^3igY^j;-JS4mCI(kf}NN~W)povY;RDye!~OS|iPU)bml_ zN7_fmM*|-XeI$LPd^GZLsg0E)zG%iJK#ikE{>ZhsPnW2`9u{Bi+}C?<4ThgiiZhq(tpVWA>9?Q9I=9CllpN zO?@;|9rBN!i?rb6_-N&$wT~`7y3zsGNE;vR=#6Wot&f-2gp+W3jkNdCfh)dNYOj@M zYo())PCkaLm1S$Cvk&6owbIQ;cON}{R9GkPuMI2q;FOk#{J2&MualQAi}d39u9MzA zo?a(?eDqZ^Vx2I1{CvRx_TfUoa{&hW7)1Y}eIMVmw?2mY80O<`A18ba_c6l93Z6Xs z7|F@^F;y33w2z7F_}V)r_!#43tdFJZq)45}7wcpkhqGSFt(S>(r1dhz$8+n2WRhkl zE3&uA_0nOzO!G0_#|&CnFAIGv@-frLEFZId%<(bL$9x|<)`z2;>*KTaa#8sLGb`!)#A96nc5mv5BoHp(*_Wvh>EJ`VXf%pJ!C-6%^p%8MIi@{O|()__*Mb0AChIp#X&g6bZ0?dw5;IXmDb?L;^^Fw-G5D;IaUh2PhVx zc!1xxhx1=Fz!gFG|7gr!8HC3U5@t&TC>h|Y0Hp(zQgXu%d2ojitMkv?cZ7AB%4n53 zJLKvB<;ZtP`2ZD^bl)M@1Q@qNcI=Q>cgVE?zR+5K?vU#P5GyL)5a327H!0q%$kJjv zrBZ+!ek!;tK-B=1mEWdF;q3wL$nz>n?o@nqr`#Q&TEH(=yF& zyJg^RnYvpVbBtT$dBr9Hng(d5eBEwo9-u{lW4q;t-Qk8RyGL3FXcM4qfOgc`BfM&B zu}Avvk%@a`>mF$zphJL;0XhZf8lYQ%&H>)sBTQYCoY@o3A+zW9NcR9e0`v?(USV%2 z=|wM6(pw#j5-Rr#&_CdpG%zl}0EYblLjnv9P-Cye_DajWGKiABGC08Yy>fi7oZl~43@3b_G~O2)@4ipg?~||h$@l;h0)CDIi&!PV zqyY1|1rEsM08;|Y<7U|}Q(2uJwO?iiD70UuYbVR^7xEb@*>SF57By98PJp>esDI|E zh`V1%j_sFo`=#aqSwJs65O!d3fF%Jo2iU?pKLG|Ekc|O0(Z~T=7GSxO6^fLs46rKC zR|i<5e68ZTynMZq4P3PY!YZE}5FC`-56Tk<;j8fKLMK;f|n%058#p1MFuEIV48{98e2~=#~fNV1Sti!#~B~C=Lhs>brtB z4$2P)p+l+5V>Am9GOVJ}Uc<%E+VPs(l;ay8zz@_<`Hu^#76d7Eo*y-}m^fWoPQ{ z?(XjHiWMo+&BivnNj5lbp~Y#D0!1qnXrVxh6^hh=LfzfnU8%SKyD#5-ew_0^XU;u$ z-n@A;^XAPY+0D-S?{2fCUgXH;`@;Qr4=x>#*mtd1>K7l$LcSWRE7 z<}Ow@7pu#|acekkbL$(9tHV)eiT{yzjZ1rpx;`8?hU2CTpEz@gdTEK@?uI1_CR#34 z{g$enOH~!3>F?gfG;*29Ej*JoOehm?nEp3XZ6dFU?k0MOLOv7YY8YQGSNTm8Fj3G% zArnnZG&ND!L=h9^O;j*3dZ{WZSkgo>A(Rw1Q6kHKU8*Q4Wuml+G9oN%qFlE0Fsm=~ z6)KvjB*J-poXE6CF%+G|@sz+X%9#rI1!8T4yApPkCDt?Xo)Ug|JJV zOwb@xHxr$OcM;XG3a_AXkq|2 ze-jUxc$gAy{wD4=agT{1-26>22tQk)?lf^|xw^|l+ZF2Ca#eMO8ook}TA>!KP(w}J zZ{h(H_nNrR#FiB*=So$2rE0ZO4Kp!prCPR9J!s;Ym1@#TwP&SYdS#_5v`RfY^5hg~m4{OxRYt$$c6W6F`O{`v{eqEzzaQ_;WcdZ(**5_kPJa6I! z6E8A0OuTF&x>k)^tER72^Cj(AtIn-e1=p!pO}r-d$I=_?)ckd7oQc;tDeHVYmf)Kv z-ZHVGqH%Sd8gJrl6YrRK*Tf8&U%qE{f{D*e|1Grd36i`ob+NpoxE^KZ{K)F|l$(V5y1C3{Dfv zOf08|IR)$0Y7>90S1V17U$17Y=b1nMN7k6wx?VA@HL*_kdch5X8?&XGgq)|QiESqK znb>c_*r2wX*d=6#ASFAwtTreTrrjp?nAj^t6mrc{IC6t}e}npcgTK2TGI7{Mt{`#; zam2(?6aSjHY~q-SWb-KguHIzs)=hRwr^B9H>pyaRKrc`hKZYE z;ek!+mWkUY5cGF@rkp|K5dQckzvoO;uGYuM6GYx1@<~x32qUYnf_P<<(m~J^mGcKt zAc)dIlnJ6>5QTy$97K^ICT>#SZc=}5QrkAEGn-V=AW8&5!cly-uq~=Z5G{kavRUQdqKK`6AgQrMwUI{K1~Gn%Y8OQNAf|0m3%01W zThzfVs$H8_YNLEIUHvsE#T5xhgPEV@ewtKThM&FBmj zAtm<*@r_h@P{;#843i=XsrkoNwP~w*B#7Zbd`d5E445<$#3$_VPG!;gLI1YSXt8{J zs|p7Z2_hOqEQn|5>gCD~A|8YnM4D!UJTePO`d0MwZc_=)?>5zTn?Jgt+x!di>1}Gl zHuY!_j|K5m5Kjm3cn~wUDW*zG1BMfgLol`7lU{yh?j$SH;4(0_8?vj;`Jcj5S>2Tef`&h7#qYm4tBd5vt4~5 z_@*eZbbJtRW%g^!jk?c{aTXBbaPqH5d@sW`C8EIMlb~_ZCxPOQGn2RWgNg|&d z#1u~J4mD?oy12t{j)Vrh%bWpl0FHd_%8oj#63IJ zj3B-W;%iQ85R-QWX47wspB~0{g0lp_4dT(AibCS|A|d~Qp8~?CNzqS1{2as_25k@v z#f`rP@mmn{f|wt~?;@f7xeSsL{ zD2Ts<_(%HuTX$n+5Q~FY62#IV+U`;lb}92{p#LtlEQsYntO$bKk~DIcTEz&w7`T?p zn6*o-4PqU4Ez7^)zdnc!K^zO>cn}+d*c8OUAfM63<{-8Nu|J3dL2M0TTM&DK*c-(5 zAa(??OGdGIm)a?W_g*;=-hSPkl{3q>{hwX1QzX9llBHq$mE_2;$#q~*y3(=I*4#l`~W)xDmun zhQuDl^w3MjO(86Wg`5_0S;%35S=uSLSLL>RQ+X@|EZ=ggy^8ww+Q87gzCnhZvY;*G zwUEz3ehXzR-z^0!6tqyvLTL+yEEKl<=XZ)*C}N?gg<_U}FaFWJYV2PB1=FAG^%HBA zuu#$h<(;bg?+PdWvR5tN>*I|s#%|(XRn9_r3l%I>wD6&Yk1SNOP}#yTix1JGisj$c zVj5(js)cIoyoDMTnptShcK4~87V222YoX>oRm(zc3tjiA2llDe9gVjR1)kog>RG7I z!Cnb8u+Y##BMYzZQ@`y~jV&D7r^cTP+*(&wh1u zzbbq{-GcE#9wU7~^{~*>LLUo#Exdd{eR@Fkve4VY$Bm5h2UM-8D$haH&q99-11t=r z=MSnT2i0r;2KpXU>4R$QK{fTDntf2wGlMM*5ii{#c&Ff9S-;(F;hroXD&$@Z_gT1K z_yZQ0G9I4Y)_BOm!xmx|YzvQY>Ps6D3wPI7n+~esjEY0b!WPUn zM(;yvKvU!SL#jeQBg)zAXG}Px;ugL>q@J-b!h&PLwUDrowD7crrw*%yhx`ahS@0~R z86=kfS^T7h&4<*vLn?4sJ!au?#>Qdwgdhp^8y!|paS{)!L5KZIB~uTpk#ys7^%~74@s83EPVE1pVQQ1=k%`OBd7{O1D2jwoiWBkBX1 zI--6*qCU1Tk8zT{I2(-;Ov)n^tyw-7oU zIDbS1j;cCG)pQGASol&(yVo_ou`q)ZdQ>Hks;}sLdi$uFDcSi))wZMRTL!1alN)i+ z!uJ+_u&~U+atl9Nm~CN)VfuzmAYkI;J*Q*l1ysg*C@ir_RP^Aq!6h$l0-N z7IxCH+*>*t+XZ)67+c8S;`m5P}hc3ZY5}RYTAry#RON_7$b`6<<1$oW&M;Azz(gq|TRJf(Vt&|3&OJIqAVmo`tUdrqtHY1Kc30U2p@%TzJQ-)x={cVIsEfHq!jLXH93TL&#NgR%sa0>34v+Dc}4yieH+3L zA^aG^v=F9;Fe`-X=M~cz9J25)vyvGhe3j+w?Ki?_3No9i^{r&T6Z~HES*6+qH9Lf# zLim{zcR`K5pyu!+>4N$#gt8aa#S7|}5Qx7D8W&ZQi>l{EH7|tujLC0t$G2F(7!G0c z^Vsq{{s`gE5Vl6JErP$qhv^6&jbKp-e~0i-2#Z6w8OE(JmV~gB>n@BIVJu@%g>Wc@ z!y&8)VI@}?!zP4PA*`n55FWp%nAQkcAHv$KWL*dkUN$nN8$#G9@=gCKWziP)MLN$L`sVa-gU{Jpc2BXgi$q&lENu06-MbW%1E}XUV{D-jQU|ryrdclk~9dT zVHkg3QsfzI97dBc4v2)vy3N8MvWb>qv9os`}p?-@ofAw1BvRxR`qSM&{|Ul{#Go*DiC;cu<@ zzd0Ht*}-AZCVP7)#~#LJ5#AlfJz>ldJ~Zr~6Z=sZABS;o825#7e;5yh;e_FaF)WM+ zMIkQuP#9q$4~OxHkl}(>7^V=K3JR(4pg|rI-lC%4L?n!8RwpLJ<`n$vzh9M!qfUg8 z3}a*%qrymKH6It^aTG!x6?`mPYW=I85dLHsPYHQi@EPtEwf#n!MugF{yx+>RVLTVc z+oCW!%wuWsS{P#``@G;wVZ0#ZMZuKx?d33D34>kDH2SI(vD@Q>yb;EmLS7fljP$KA z#!Hrsj{H|KOY%+_?}jlUEB`>qdxGzW!GTccL&Y2*LfG_YSu#z?bV1sAeyQ{`Lag3I_RAcSGOG>m4#mxr-J$V$Q0f~#a9Q;lhjNZ7q~VXPOvA&gBzHVRUQ z`hz8H31e#*+qiLsaWc#kWwAqa4u)|kjGe-FWozx`0?hKgVeAWIzhn=Dv08QpS|&Lx zo#`s}j|e}S-Di%4aXiaU2+34D9mch+x971NimxWvj z<7!rtDY`D%8-iT~Z*xK;$QAJ`B7z)3j%9nE>$1unL7oT#5f~A~q*O(qBmP!-X9RhL z6pNsE1o?zhoVFb-0XdXc$kv9=+ELchGHx>Ss@D{>b3TDi<5`I}q+eXkXf<7W? zFUTgkMf^{V4iR*WppytYN6=LW6sm#<}ih2n4jG$Kpy@mg;N?*xRvtI=LBN!0D zzz7D3aERdGh`;k^tYyd@SviGwMR0cn_lRU@1jB{gD|nya{d8;u!y)&kRW4* zQA7*GM?{jzQesLr7=aZ*NO(BHBY%Bmrbq<;)67Js9YI{8i#8o0u3#d9q>vO_zifDd zna?}dtezEx5yD3bjuK>%d09Ot zrK1HY86!o{3%)>`Svi|{C4yHY_$PwJ5xf?`*a-gQSJnu|Mew?)EsWre2;LOFAcD7q zd=tUU2*yY7b_DN4@NNWOi+qA0%}$PB%w_eS;QJAL5W$DSKcc&Yu=HagA6!1x+H94GLg#Y><35CB)c5Vdogv=M@VX!R9yrAk2 z2EcHG{vC%{)(hFd2)x^%=0?eG65JfYmIy9gR+N{#;^X!Rb};zU7?#G)2zEtqC5Edp?2ceh z1S4Y@6~o>L_C+uvijh(5kKjNA`J*Th#X-vR`VUznibE0qnd`$5|74XT!jFmvjzw@h zf)f#(jNp6(7a}+%a=PVA1gEpS%@yBKXC-@%{^vd0xq*x9Y6Le#_^;rV2(AjbEchO9 zO$e2*3wa+{#xn+io07f7c!+>%ln|+wBkK1vXB4@FHq9_{0_$#Vd6g8u$6-DtV{=TA0L{T#8cc4@hWuqt; zMQO>F5yVx0_~oN$dsQ)2j-rC_ih?Yv6vdNL#L_BJRApOHRL_>yh+>YEQj-d`qda^Y zx911CMNyZ{EeN!sW)$_Js2@dxC>lo5B8p3^0)rO>8bz_?s%jbqdE+RW2qEVwUc_cm zG>_u^RYjivnrfM?)ruAt1X@QyA&ago3bc!&LlhmOXfFmSp~CJ(flg6$iGqZwvye9z z1(>=l!XJ#{AAEp0>h&)qj);% zp9m3*!ixH*UOW*+D2i|tb`){;N=m8FL=KLKinUnOKSsl^H8pq^g#Y}d-vU-708pYdDyeQe11YZ_>Mex-qUW;O^@HYfmYg`nsXL*;(>dh$Lk}QSH z65om9-6*C+@rlSM2!0gBdqUn9q@53<_%O>e20xbUM8Qddlf@>LnWjeZc@)#4_%w>o zvVEWei>62MMHF8}@pV>C;g?a&kW%uD8Zkp=Me%JE>!Mg6#dlGBAH^?G{3^;n2+oP( z$86o%LVk+kXCaxcW(NCP6u(FD7vnaHxlzoM-u@vtKZ*rH*dpDsP>>{({WDwicNG6b zu{4ThVw|Omg)EVQuoX&{N3kM`RoS6YvNEg8p{*9aMoQNTr;rslM6of7ZBcBGVpCSW zMaX6`OC4%%&6?d2#ZHl&5M=2tF4ZXZM6s89dsetl$N_!|WQRZ_Ob5jd`$m2^iX%}R zjpCSOj|*msGDw}1QJjk6wA7+oGM+ideTHj1=7;))C@yjjjQIvHMe%PGxnsx^!)38{ zGm2YLT#52{d|%;Oc4n_faU(k-$}`PzEVO?+3dE2j=JSj^rx?!_^PNm#AO<6b5;2sF zLB*hBC>TQ_(a#%0{ul~~em>Es@r+s4B`F+35z#CzSX4AAFD4|@Tn0;tLb({q$52{$ z8PO@5t@6KaXGp~uD#cJahAJ_%i=llCRb!|YL$er~$51_n8Zk78pr9`^PXKhJm8M zzA;(`#V|NqN(uXLXAF16kd|2D$HCn(JQ%}6bltqbJ%U38?-jgH@P5GuVi-pEUh_Zq zGx)H`ABn*hVa{9_9)n5C>_7~m7~B{VF@$5d*cuU0UOUpS9*rRu!v|7}Sv!Wflsba^ zOrbCt!>Vg4B@z-!JmKfAsZ!U~qtgG!Vt70T9(TZzJ|U7P1(|(H$kQ=ABVV^L9$dcudA1ZzaGOIF}x!DRl(P?I%8uPC!ETe zD(_rZOyuKZ`0KiQVPW8#7~U5Cj^Mk36JmTb1>UDCV)#-dAI9*Jkk4ZHSO}|s62rt8 zCdKgYbu~GLx;NAmDI#H_!qlwhr$WLv)aOE`W#!X_e8HiK{*0{rs~EnHVMa!HLls&S zn8~p(2+WFM>kaj73>)VMzKh}e7=DQ1#~5bEuqlSkG5i$6&omOlq8R4H@JkHyV^|Qw zuQB|_y`rj`7sKyDI2X*Gy`kpH6m%)!hh@H-Y9V*6yy{O8lKde=$?0k}Z>qmz_$P+d zF|3JUaSTghSjl*ZVX3ISaVfAohGjAIyQ!FHkZA?IG|=EpBJ!ths*i7~B{$XD7}mwG zfdh$QeGEJim!*eps@kr>hl|VHk~Q**YIaL);gDlE7Q^uvw#BeLh66DijA2I%J7d_x zulmw-A6B`gcJWt$WFIZ;TNo*J-ngaq#jrnyZ*Tc04-*fG4i%2Zz(f2F$8ba>8$_S- z9kuq=v_UK+!r9P8ZS00FZli<^zV^46jkD6vIyrQo9J-{95jk`z8>MZOkt#G* z*2bh9`WH#euFs(>*r;Knrj3d=D%t+OK`Ps*BKmck7)NsG8##1U8>MpUYBs8ioSb!Q z*|=j*ppK2Y9Lr2qo2>^?w4hPXMtvI%Y&5jdC6B>>Tk$_g#2$r=hBW1v zLPiHV?OLF}jR7_~+UR8C-JF`wxpZdJw6-hI)kY5+d<3SO4W5%wZ+D=(jhmee{@=2v zjb1i-+vsDXuZ@19KP#tZt))3N|Hwpgdsl!s(8eGeciOni#$elj3U~;|ZsTxHohz5F zkV`ksrRj<}m5saELmPa|f2fWAxpX|2E@BwdbLo3+{FY1el!^On5bqZ^k_?j}KWO72 zo9|D-BQ|UsaT~*Jn4%LR3ZcU*+zwd61GoJp$rQE`u@PlBNfAq9Sp|oteo-kKo(-4Q zPAcAfPuTt+0FpL-4*08;H|5hd9=Gv??cbn()W&0?z)~tdY2zu8kF@c$jb|86lI4GT zd5@ThRd_Fznk0Ya^C#A5+eSV54(x{XlO0Ty8&}r*PtI?8vRB+W6MScQ!t?@tKX! zZA`N0ijei&q0ln15 zG8>C+Ea5g4(9;5XQ$SPBwA|(!YOqq&js-LmdsxoUjSRiU##$Sjq-dRu^)@ze+p#gw z(5B(5jWG1vhW^gb>kNIs(3@>+v2okbmeQk@Z+tu5E7cF$*lA;zjeU}3(QX@iIQx>F zsPvCYA5^-C*7daBZ{q+Lsn!oOyE{PTLtJ{Id4xW+aZLCqttV)|8*H6ACvBW!>oyR_ zX&Yy3T(a@6Xr8rk-o^#t=L8pOy-Vxsk}le)oL9Hct1sKQBBeKNTxCGoxNhSHr!TL5 zHm`ms@BevhdR{$0uih%zTWnNFjyQ70@k>6f;=aRk#gRv{++LDqVrfabp_Ys67Aj#_d5!=h;%&ElvXN1Zt8#!-)BM*>c7!!79VsLvMEt>b7DM?8+LMKu2< z+cu6NasR(e?bxL_I>ga2j-GM!Eu=pzs5`~cEsm1~b!S?OgOaXs@TiKF1vPi7nFV$C zIC}6ix{xkgNb|U%7KL=LIC@L*JbiX+I3y&4jw9hm!jzJ4@X*IPQsKD4iL{ed6aSh4j2adUGLt*-`g%mJ90#;%HJ>4~t`1VeON` z`r$YpiNlH`6!%YW7#@eox{Q{>`i;VRYGFOMu&!K0^U;QI9L0kH%4=sD3Vv+eI|p z!c#sTi{tS)ek*M-JrT!~!k-d+IxBxBjuFB~3XT$dHd}hGw81AVMl&9YYCa$Fd>k*t z@gjqPdpI2x$IEfN636S(^sDjzdy-cIHnZUQ{(tNj%jgx8pmfM8F(|Wuc*FQR8NoN3$g!A90iN%FNLpGm?7k= zIKCD+`&^}%ZeC2!jH6#M%`_{HZ?pW-V)_T^&tGx>L-WTtX2;R1xbYL$KG#SbKgTgA zj+w=Dv!VtMUfWzu{}%WEzCNEpRb2nh_%EhWT+fYTp0r!1xSw6Xj{s3{i|apx{3-Zi zam`wb;`lp`f8tmi$ND%n#Ic0EEv}cwv5dU9K2TgQkE478W3||v+rU^6$I3WXN%n&V z{zuq-4UAR|jWuzsjbj}bW&`7Kk>74$Y>Z=59Gm0dpQUdV*F2AzJah!?cEcamt0SD*e zIM3w}$Bj5H#Bq`FU(~ov$CmK-%z`ELr8xeT9yTrMOL~;lSGX`s>Z@^F6S5$;!R*aA zZpD$?@z1`y%{VNne<`VRI{2idhJzeJSe;p7F2~=`w`F)KZ8-kFSo1m7bT_+75Uc!>!V~p@SMX19cqKb^Ph5M>#D! z{!@5N9265tBg)I@#txb|XzHMugO+U3L38@h@gL3TP)0M6!~|KZwS(`=_zoN|*v>(F z2Ll`obkM;;M+bcz^mWk5!SXVisk?*D4!St#nw4}DvagJ0%INfPK;Bd2y##v;W~yZL z`#I<@LRO)Ckb}XJ9p+$2R(_X*I~?5k|7+`R2lqG_>fm0{ykGD>!Hn?-{=**>{*d6q zf^3m$CIiO7GY&>LupEROq#U$68whhkHw0o5IV2IuMg{35hLbHtaY0AWb&wFk(xk*8 ziN~3pq0)~3mEchak2(Gkl#e@jn%>J}@Bz#x96agZDF^HFgJ(7}k??8yD`oUZ2csP1 zZJ_2mc-FylG+tg$CpsumR=@1v6$fJ+Jn!HI2QNB!NqSzltai(4K3n}lSzWKK!NXEs zb?};lNe(7E80%mhW5B_O44boo*BO(i0`E9@!@-*jW)@9S;~l*1fXCu-q&ybyXjx6+ z&9eGk2NN9dkgN9`FugClPC3m)VYHkcRZf58;LCFQV+Tvi>4}0QH_GWLG=3=1t&#eK ztERl}T3%0e@TmhzJ`0c{gRKs>i)5Q1btq>k$qtb)OFpKe{-~nRw1vtoq&3>R`G-(BRy^P)q-hWIe`CGMpTu5w(<)xUz5 zxu0}3_^9T~z^C>qSJwGlbgZmLRMtFjFTaZdQkR^s z!7b#Xu^MK`4dmoH>Q!K%8sixzCcMOzmw zT@0?`SLD^6RvcOt-CA&B6-_>?if-rnXY}>#uU3j$2N$)f>fTj#M;D!3JWy44cF{#h zrYDqichSSe8!p~-(Ubn!7~szNn2TO6db{{-L!gg~dtKb;qOXg7E>cx>f6i1feTRz| zs_FrP16_PkRS#nKT>k>a5Xml}@xS~pX?KeLU4nND-Xl0vkcSz%n*#T{{xK{O_RYmG z7Z1AFUR6KBP+=HU(+|0L*hPnG`p#1x`f=W`iB7hY#$d^OES*ydEzmWw0RbjU?m z{7lXV{u3$p2W_9hkNK?PMe$++(>blF?0KY??x)`A3g$f_kX{<`Ni}5bs(TR6lyzAm;&UJ5Nf{XV!9WK6f@je%YizzNXaq*#xk6e7y z%9zA?Z*6?+VxkMTm2s?#nAr z?_zolUP%~Ra3L{Z;`MYi(PzI&{*PviCOaH zE>^f$Q$VwntHWplC0$tcClVGH@ev5VuNr#Tg1AXg>MmL zwm>aSWYKmPJ6se^pjZMsUF>pk%*Aoe&hfx**Z+ZV)Wsebd%0oO(mVK+ZY{k}_M0lNh zvYh;L!vz!7csSc_F0KSlS2uJ5ITF5**Y^Sm|2(&xg1Hj@d2YEA$RnlX)G-oJ3Cyjn z`JI_(a`Jr3yb0t>Ab$b{5-6NNkp#-r(GBY8f(Z<(qYFvh{+;|ldbN(|j zB@(EdK$QeaCQvGY(yW;9y-K%?mQ+@<6$HyA@K`B>rR9ZChrFT`Rmw`LCj5g$swGfe z2#rwZe^@Jl+6i<>p<@bl5~!Q-FUyxnprvy4D{3oLylx(*I_`o|4D1N@KuCQA@b|BC*fnEtj z5{M@7RbAaXfguUpkwBjWuGQ6j6X++TKSv>CfFO$o3Zc)*2Pcrp-kI>PB;1$4{q$Y} zcXOnN)jjNdJw2?R9xB;;1t~9BPd~tUOu%G^Sux?C67Y9DeYBo_D1nC)_^6(KB!QXr z^l;&9i-}n)ft&So+v|Z+^>v6{ouR^l{OV2~qi^eLFM)Idb^>w9ItiqNu*gjyAv`HK zxW1;4iN<*t-En&$PXk@5fqp*WU*DLUz`O)rNZ`c;UP|zl$C#ABfu9oiIf3sI_+E;B{Exy9bcpSz+5ZvF5zZd|mcTCw{7UDDPNoUs?@}w%llck! znZRFCWr5&A!9N74yeNUc6IheL+64X);gSTFCa_p|#>lb+mM5@EBy4wukd;}5j1J|i zr6(lo5?G(W4sPQKY)D|EXl_klQv#b4*pjuwikZ5Zp0nb%1hz|QMzSlTnZQ0FyA#+W zBvWgD0tX~}MDSn&hY~paABBvO3?9wOPb6@Xn_&_qlm5ay#aipsCGN}&a%G$mBsrVF zIpOECk_!o3%<{V%=zkNqoWPX?u5uGj;#5ODp@?xUfj|;Q64!YPm`jrJ*2&0`^bh$Y zxs|}}1dzm-26{>ZJ+FaY-$3U~B3BX%3i0LL$dmMMN}g@t-(-BPvww$CC83kxfxv~6 z$eTothWe3)deE^zz9jM|Q6TAmjucFy5K9Z|ZVmlJ32(}ijBlvdH`GOwxZO|}OQN_a zmuaM1G}3oB(xoI@Gl^R4Kz^e%EnEwfNuq2L<&r3$M1>@(CH*oNin$xlDe-dRHYo?Y$*lz12>NVD*N*HaD z=q;pu5*?EMDQz8-7}i+xiAWxs@MvQ_t+AfpSa(jMOA=j^=tlh{9%cC5c`_Sj0q0pCtMw(JzTtn&|#X%xj`2Hqqn*k{Fo8KHYNCfEaRU4Yde z7R^VJsMAzak`ay%_-YvpB@q^#ND@&Yti{syO*QS?;z^!p8c)JW!c8KPL^6qIk{FRh zDhV%%bP|sy(Wrzmu&H*N>YMulC}ljB1bBE>Lo=;+EGo5PY`~L+IGW&88 zEiMIqPhu`zoy4nbD2cIL8c9q^Vq6lhC-DK}d6#-4i8qsYo9(`%-b(tvhQ=2)#xr!U z1;#ehpEc7wGvu8l-c4eDGd+RJq`Bsu?yb%Adr7=6&5^U|4;eqr^+$AgbN#U($wVQO z=$7W1*>{`kPm-9McnR5dG!Z@JKBs0GdSSUI8P`y}=@*F59_E%c8` z%ueE`Bz{i%uR@r^jjM%j*+SpbLO;<$^SJ)^TWH$+l@2dq{3aDSqIn!LJ+{F=%zQx- z3zN9Urjz(1i9eIr#Ze^jR}zboSd+xsB>rY3Yzi!se*Tm6uMzRs)x}9HNn&XdzqZip zTKIiC)Iu*$;%W=Mg7M68^)Xf@v6>smnLy!|n(q{--%{VzQmy(5X89CAhf3Kb=+wTDBa+mkpc z-rJYNfg}zlv0wU3H7b9-F>ok}V@VvBx`)|f5=UvOrREzP&bQQsT4{QouYRD-I<0iK zR{B&DXSkIyN|WI07&1oAi3ctv@oy66rIQzuxJd7nG1yP9m43aIW{a0aji#>9CtNk3 zD!zvzI@Lc%^hOfXTIoOvMhZ8RxW!F438auag*++z-b$}-rT4eeIa1(3^f?7{30`ca zc^Rj0YhAmw?$}zZ6m$y3Qz(%_-W2kskUxb2DGX?>`KAw^Ix@VqE|>y2Q;`%32`?=8 zl;{-AmKIClZIP5r;mLePsT4}5z+>Kd+QT=k_0rb6so5D!;^Eg(L8?kRBP?O{6&gbS|f#;!fRzEwT09XtSeYA zh5Fgj20|JNHWF+s*d&EJx*9atJcSMG18q`hn?j3}zurgpHd?08ie1fblxw3~r~K2; z>bKE7+h~4eZI?o-jekeDeae4{z_>QLQwp6^$l)QUhb}2}P2rUkUQOZiQU?Ed)h&hY zDfCF8X9~}x{Ihp@iNQNlxQkv&@fTu%f3E10Lf;hnrO=;Kkix(e2BpB$rFi5H!+=K! z4o=~#HhOCteXEUL*hUXw|5G60gY*vzo5Fo5+@Hd*6dp{0 z2PQm_!s~7I)V8{JTm48|J-e-bD22`BDgNI~Kb-PE^ht)NVA4oC9ZbOzVWW1MS*EV- zbR-3y0>{H25*+m`6-^l;tf5AF3+DGYC~pB5w;(O&b4(1;X9iYG^<@GQrb z!srxuC+H;#Q+Pgw7gBgJ<)3f!WqZB2z2+HWIXmd)9W-?w>Y#ar|7BL`;NN$CE#=?u z`y+)vQy81VIQl1rH)ySso}a>-Tp;TMyl?d>Lp_D@Dg4wyzn#JdDSVj1JM3-BKcI|% z(V39KvJU#a6t;KJ?~BJsIO@|K^hYU7N#PR;3mG4$Fi}b;r7&5D(NQx|b1IiWM?JKo z9@|m3=%{;k)SoegsNYdfOW}(YzD!|y%D;Z~b4R_kqn^Qd;H`Su$MexJe*Dg2mC4|me6Li{;}$2;j?Q}|8DoD_Z$!itptE?u3= zfbXQIiye}AlHJ`&FJK&s$1+Hd@z?raDXe2`ZwxGA>=o4|I_tkv{`)5WNnvpcOHx?M zSS@NSXSC3DVxMi*@2pp*(5JIrO{e`ESS9j@I{W=!!)4W(k)YNJp=3Q*ZVDSy*d%Ia z7|HZc3j0!cNE_U9wsJZc1}SVyp+h5MQfIAe7~gi*J5$(|@;}Nqb=ExKi-$Mv=9bk( z?-AUaLX$3<+5IUTNa0`#hf+A104v^Dkc) z`H!Ty2MS9FW^_tQDb*-1!!5D5(a}RE4`n@+ljh2MXzcl$Y6TA!Jyh~g*+VT4wLP4b zu~+d>)k8IQubbwX+ckt#_x#-{BdO{6XK|P9rt5fU*v)rWJr8w7fxLG&UEf0k7J1;y z;2Lq%-84y!_xyLmQK5;4rXHHH5A14g{|;RX4=p`(@KB+DOnj?_c@e)>xfT|IR3Fu=n=`nc7sE2z!|DRyHyX%}ibcr7N0T07G zJm}#e*3!C358bPWHhbvjd+4n_^obt68;5%^=`^h)bfyQ(L&!te!|fh=cu!x!>#2E= z{%bw;yqt})dw9mf2oEDYyxYrH=0K>%e|>XkOytjb813N= z4{v(@f8NG;c-g}%wBX?d4=;L{*-O9V;Z!gEXD_|2m%i0Y7w@fK^-wRrA5r5xyyjsn zv%PhP-hSWi?5!W`tzY*ruD71jTfgODyoZS%CV6<8pqJ)zdso_pq_A{z9xh*4MW`rLR8SSC{Xn8E-Qr>b?^ETJRge znS!%Cd@JNTLF#`mBH{EKlDZogWp5udibHA zUfoa6^Dy7T0uJOewU7&^zy5X)_4fzzmxo0j{$_mk*H4M$z5aSJXQaPg z;$f+WWgeD$*y>>$mz#%`9#(l+O|$*=ana|0^FC{6tnsj(|Arr+*U|}v{M(W1gfuH_ zY@l;IY?9K=9=0&%|5D`!=+*9U38${#cjmH z9&zkm5Bod}AK-WUjRAVv0KIU4J}^KxAE*y9$Oq~p9u9HG7^n{mk_;ZGkJ7#QjIWCs z$GGI>lkp@YjeA-emD4!w;f#lCTu|KEILjU`am~tw@$()o2>;)e?Td_axzPQu$S-pd zl`^gfUX>zdc@6xA=bz`sP6pDr>G`isxy3m;5%}qR;I;>(kt2ilVZJW!V^XB14MP#T5P;17^uY4ELK zBt_CFDiZPy19kBim4?X6rBObO3X-juhARq` zXGoPaT5=Th>iR&{G{z6o)zYY*MvXKk)-!6R(J+lh!fT~bJB>PN)J=nL8)2%SM!hWO zUO`C%&VrD}X@9Zv+^}Y8d^bopNu#M~X7rnj!4}!N6t+tHujy%>Mw>L+rqM2qL1_$5 zqkS43(*Dn!o@sPUqZ2z&%P2lrcTS^A8a>k3HAr`rw%A#utT`Qw27~omgY}R! z?o5O4U7a&n-;wseVyzsk?@HrtKHE;op1?iQ`p`7)P2;{at_{{q_luB(O_v{{A57z+ zG&YUF<}r9UjYl|Z&*8i0Fq~?Ij2jHCG)(d|ERj5x#^Y&(goo3J2#E?N(ufIRMLUhS za7WP1%DGD?g{K5P!F0Ct(X_w+v-%TsY#Ni(n8I}=-U&yy;F_$G~+X?!j^UkXkWoG$o zWQg84L|+`D|Bxb*rIY>HT$IM&X)F^VhfK*o!WRoJ5nL+Bq9p^3<-%78t`uCA#_BWz zcldQ13a(3Iy%b$eV}p<_X>3hnqwr0FRNkD8hixL+p2iL#ciy3Qa)qXGG>u~-*`3DT zH1=^(xB35=dJkwRiuQT9lyGl@h?oTg1VN$%L4qKHh!Q2|{E{>5?(C$^JLH^m&N=5C zL?kJKi6BT)K>-PZD16V(tcV>5Q`p-l;%qEuM3j&i9uLG5xfp}!9t3=N#)qB( z^a|ivA2Rrm@FVF*MjtZyaLtEbeaP%Xnh(=`nBhaZ56XwSKGgFeiw{|SDCk2WAD;6e zn-8z~+}@ujzDUgOgY@`yyC;FtoCZGq=?~lAKsvn(}y>G z$m2sUAAYQ#p4)2`Z>;kAkdM^@#J7m~i62aN7t*Z8>TOn~p;X`Tp|B4h`cTz}B0d!L z;XNP9`cTY=;y#r2p`;Hbe0Y~lgiDcDQc97mZ>*%8ZLG@pAmjnZS%Im4yK}`A0rfW2mMN)qVKbhg*!+U@v0$zKQyT z2H~5Us83}keUOW>7R5Tm+Qe*4-4Tkdz7L=KVEJJC(7=a=K6LY;yAO?gXzW7=A3Dw3PAq(2Pp+|APgZs#ZR<_PKj(JL+wSZDo*6-Cq8e!t817eQ=tpxlL6k8oChw zm%{96oqgCyXID>=E2W1ICyS)__hEpnJs)~8)SK9s*vE(CUjBYmq&m#CACtx7 z!wGURpCtL3_>Ei_j+^0IR!R`;ddWu`thkB*L}Dl8=xPr`SAxm4}JK@ zhd;@0%7);>Z6E%U#m_zb4)uFJ+?O@qEbXrBTFm)3bxHn!q#nfp@sSVk;~78xW#~U2 ze)~M_vFCq6BL6e!SwAxPvA(5xQTBg7GWn6skLUf!>_?g(S^e&QnC^!n$wC~{Qi)%5 z!QV-q^UHspN|VhkI}H+g!H*{l3C}^Evz3x0FZuB@yA%BtnkC8WB>DX)K=OtkIsM2* zp4*SSB;tS5k34?lZ{>DfotTfIw}@6N^|l`c{ix)}2YwXt;~nZ1{3z^45kKDZqpTlA z{V3)~Nk2;YQQVIbeq3y&-lcP9E47DdCI1tWms_jSew6V;LL!!K?V^-&^p_{TPyD!h zy1ZeKP(@Z7&{^4!Dt=U>BG=c4enhBO^+P@t{1NruUe4-%d`zW=AD@scWoUD2^_d^F z{OIXNFF$JgQHRl1e$*vtO04HceK`w$G+;HgY#RE}m{l2ABR{@vt?n^r6N(wzsAeS1 zi7kjNiQ+HVMztny<40RR+R3_Yqq_Lf)sOambnv62ADzVDM`zkPwNcLm-N}iyapz$) zQAjsGdib%L)$Vjkp46_}+mAj}LVolm(TM$s{rwo=$3SvFQL_2`_=2edR4$PR$#tUP zhv|pq`E8OXZB(wd?x@17Mu<_*6Z0c3%Z7&fZI$E4AU~cBAVUCy{TSlMK0o&RG1QM? zer)z*iyy=N7~#iCKUVoMl6gk^F~*Nklve9Wr{J1a8ndb=cxelsy2X_Yk@#B#n zkLmo^kN^BY;OTo>5uZ^1h|WgDXBh2Do-u$-0n`nkUI3W`NDH7$0Ph8m9)Jp<1f5v| z$QnTY00Ps}o(mvb0QsmtA3*j1UJKy$0A2_nM*uH-{k|B$OXNleHN1mb%D!F+;8lu8 zI;eXcRGyCNjR0~6@MZvc0`h-#RW3$z2hgUYdt74ENoI6ZdpoMU0i0s>t-#ZlNXbxu zP2LWmU;u>zcqf2jR0;=BB!Hsik27YoKrD}ZC3UYlYa>F!wOl(T*SEdyv3z~=!p2%sSiO^J<& zjfrAzLh?r^)r_P$u|+`s8Jt?z-tDxtOnU&`sJA6{BDN#8Cw3r;xg*Kz|5N|-l+Gkw z0_aLoSwh*4&NwmnKQ)zp z8L$(Oe{1EAd@w^p0yxj=E#h#Bd#|UBAQ?#<6~O2K4qZq~U-IN=hXnN1@J4Y&i=IYu1}A&U{_VStNJ}4zqqajP`nXv@0iW(s{Zua-VERt`E5_x z(^cIG;BEl-0=OT*Kc4=#a4+)%iVx*FqVkB3Kmzc1?a>ScxLe z91L~urUtVr=2tYlN@sBmuaV@^kXys+8sxo%GRLm>_CXvj4HkC2e zT)k<*biukB>S?I2;d2cQ=*-;XY430MP?bF1NJC={O=#%YLp3GQd#Gj_nrmpmYOgny zl!-l5YYlBQY?Gjz~M;uR_K&(~Jor=liLRM**qG76rX&R<$SfF8{ zh8Y@WYM3LJm?r;HIc=7#D@}e$N!4P%vhsz`^D@jQ3HMa18C}Hc5)Df=EG9oeeVK;k z8dhjnN%1d=gPWwi-RtS`R_vu#Gqi@dmMA0aO2c|qH)z->SF4828n#f8oqYUo_xx^^ ziKSECj_%N~Q$xleG6k_q!)^`dHT+Ef9u3Dd9M`Z{!#)lBDIU;pP-bsn+Pq%s3k`=f z9M$kjZ}lakUlFB?!zBB9sUsx!d#Oyl-NEPYtxixmOZ-~HHyTcA_*TPD(pPU)nYL3J zPHXs17MO+~H2f$RMQ_!Ip^?N@#BIIR8Rki?t8?V3_bnI5uWGnPa#6!CB$tRXlFJ&d zkl*O7Ug@KLmCc9MhZ=s@a9zVa4fi$N(C~+>qCV;lqeA}Fa8tuA4YxIXRULn6sM|+{ z`nX3ol_;ClU7C9u?)v##!vpQ<8(^uf>?7afbIt!~c%fcX|@23h= zDH24{Ac~QXAC*=-2tjGMqn|1fbf2vVFBL@TAZiCuCx|jZycfiWK~xQ*EL&A1mLt9& zM0t`5L8PX1c?EYqD^dI)h{`1L2(Jo>gwFI+ACcD}RwGs?eoVaC(H+kxLDXdR(;#XE zpFZ^bEGQqJc1Kvazl&1p2GKl-7D3btqJ9vcvq=+TgCH7`G$J-8*6J^x*mT=AWmQPC zpnN*fRayqoDu@n2gnPM}TL;lDi1xI#A+{xM-|7BIBCm8C*s3GNPJ%&n4x&pCU8#J} z=v|^@%Q`^y2%={YM{FFm(JP4FK@>Mp!bG1S`UY`H$7LP;g6JQVA8f>5K@13DU=Uk_ z*cOD3IYTnGApAiDg3y8pQnZPB5EhB_WssP%2nV>wmAZaYS8gPTXb=m7SS065W;KY> zL5v9^5kxYGp+O7_!twG9CK*I5#Z*Jc>yZx+VkE00h+oc5FWVq(6nW-p?gWmNi49_U z5Hnp@gEA}%OFk#aXN^@L43u~3F46;j**D%C`oOfI_@d|^Qo_c_(pb{ z(`hFueoGw8w5xpTyCA*~;-U;Yh#!LZF^IE4oD1S7+Rk`+F3_LRug(YYGsO$U!hUyn zorzK6CD}cKxE93aAg%<_Ah){@OkwB%QL4Yn!uBf}=kH8%J%}4Y{1L>Ttft<^-z0Ak zP`6~G3%I>}7*KbDxGPInM@+}PAnph8zK-%b{tn_n5ZQISpyOc>|HvM$BcqN-LHrxU zGdlJJ)PGF)IEW`f2ueaJ-I*D>{8{aG@vQFZa$iL-la918p*4={CTAw z2Gr|1-q7VeysDw8cAC7=atD)Jcek3nI^NWgN5>M1q94&zJ{@l{!*z-og6eG@1$C6r z@hg^tg3)Y9>xj;cDU>-bp5M@(2vM@ijn z{?F5{RSg}V=%}gVQyOY8+L@SoJ33NVwRP0dQD1l8uhykaGSnkkud4$z%iZkHWzPA! z)`+2|I-2QdOx}cen@(xlTt`bP!du9U8Sao;>1ZwItGUaiG&58?9qo1W($QN-2OS;R zq??XTLdd%iI};5<^gcN@s6&_iUq^o(J{^7? z1DHylT@KXoJ2Sjwy5k8@7ow3=G}VN*?jQ}_{lm@DVN*9{HS%FcNJm&l#B0^YR3`Jx zB*t|lbnMWvQ>IjhqhpSaxjF{v7%W$Zj&VAMuKEo2DMzYfG({QA z7?S&@+|yQhEHz%o1Rc|KOs76k$0Qw-IbbnMnL>Rkv5Ms$W+zL{V09L8CUG1?v&mPH z&(kqq$9f$bbS%)ZP{&Fgt8^^Vu~^449j7g|gnr4nlqB^AW1pp#>sX=Vs-@)Fw?s4A zYPIKFt78p$McWX464Qz!=F__Sfj1%F>-a&(kJQiVI7jjm@eHwkNS)X5vyO}0 zj-*L6q%JTdd}c`fqPvfb7cu`8nNr!Q3@kNpO~~P}9Jt20BU9z-I<(8E9^xg@M`z>KJIm zR&@>3BWYluzJbqKQoWpuC@Cr4(7@e@$`ns~KeW6EzJU|^hq@dh*lK?89E3EFf6mI2#ACFz+e*bETVZRt2<+A1j#4^ zqe(^*&&1Ri67i2Ec_yy%#@%5|Ffh@;90PL=Ofpb5uBIB8M$cpeQ@mF7Xr69hrl-sx zX&qOy49q6?$JJ=sB<(yZi-_|LEHJRpz+^^O6Bjd-`a5Wuf#tFn8S;{f6$Vxs_}aiX z238qZZD6l~eKfBzu-?E1xi)1r@^xF#3fdh=5FmTYo7Y2?PIBMXKfiJ1cGvC7`Um4I7 zs{=4mP2VGb+z+mL*i`F^xPdmM%^j_?Dp`iKh(wKq8^jB;OIgC+=X{ZxZS! z17{4JHE_2anZ@LLZE{k7m&zbIR(wcl_5fq-?#0w_!iEbi?i5E@0PQRF6B6-!s%OtXC zyh75KeZ6L42FV*Ha+=6xA~&P|IqFRldC2n;GuCw9t88`DVMkqHll;^Rng)W&aKh((2Vgst9>ePbp@)ci1HKu8EQ+T3TpjxpP&@!~zowO_VlK#>9J) z&_ojxO-+@enn@#6VUpqR)h8B51;IB48ps#65~BMBRj8!t~ni8lq&Yl;{;kZ4)7e!o-NI z=b@_1P}O3n>xr94m>6ebyosa<$HZ_GBj_AtVu&2?P&JrUd50;VUKna(nDoxJo;CZ?H~Zej{;Q@ys2XwE%M&G3|& zCaMi{N85gwiVjnAsL%7Fb4|=-bUu|eNQ0Mwwcj4 zJEv_kvE9UO6MIbTpt#d?Zx_f%ZhU_1qVoQ5_gMCt*k|Gk6Nf17H*vtkL78wyVzG7=NV8T!V=NfRf?zb49OPNey_CQh07UdG02Da9MXeQiS}>sBpRZelc;$L}m+V7A~8(V&aa8 zyEI&tz1_s0Ca#(I)x>Wmem8O5#0^=2Bc2{t(GjYu$9s-YH`(wuarg*zi)1wof60-K zQ1ZO*o{9S={xk8I(Z5YRH1Us#2dv7do*k(kdHi1!gATdFzTYqHhkj{Ks6S)jSqtDs z_tr>vBpJvvTF7Lf5fu?l5~-$J7&}ra3t4EBI}ces@`8ouEM&9rJeAWURd$jsBh@`N z&td()*9gh^vV|fRiduNZ!mAcuv+%lwx7p+k3pp+1wdDUvsazIvTPW8&Esupa8I`uF zzg}~XQld*WpJZkzzl8!U)kmq$qf}y)nlnljv{1-$@1=-S$~$xxCLSN9idiUb;S(`f zC}H7U3zaQYVYH-$_brsSP|8AS3uP?4XQ8YNhSA%jRNCmL=Pvaor0{4}!9qnwYm8Qv zNIqZ&>32f2GyYN305|W}!86e(WhVEX1gMYT+{r4dtX*m^@n5 zvQVF%+7{|qs4KSA=YB1$rvI8Zw$Cjz@Uj&cqZ*SpCpM9WV^mWM%~l`KMVaW*cL(-23Qzq!LT6j34Ip)Y#X!?Adz>2 znuV!MyOgL?mv2c(LMbMzmW3}F4O@s%Nm_`Kh$l`GBg&SN@btT5ltZ3+^ESl7Pzw_+ zOrn@=tQuxvxP=j{jW<>na_b(U}3t285ZVPm}_CCg;^G6dwHC(YBrN>BF^*l`6TDZs)y7UT3BRZu@_xJ zlCz~dGtZ1u%Pp+1u*t$^3o9+Gvars=dU{q{SYu(Wg?Gk1oyn@>REKfO9;Y^V**22Q z8>jY;Q|HF1EuOxOWGnIRIJKQbjaP-ot6dg$TexZAmW4gk56P*qu-C#qS&-w^eu@W( zvP&Pd+$XkQuqtCV#;d~?zOr!6!g&ivEF87)1Ea^pY2jN7r(~&E_}aoZ7EUrWdAxfF z>&C0oPZT@sfpKJpXOlF0=abM0L%=uNJObxIyJN;_tGtOmv4)aiaW4g?mQ+u<)ms zL2hz3o~SxZRJSesCHt!Fc67(WT?|u$YUKPl)+Q?!ftBnjc?@;VDx1hjV7rV$tC&{iF{$?6&tUTr=D@VMjo7` za@xpcql1l(Hgel|)5ga(YS_qQBd?7LHY(c4XX7m!rEHY8k>5rEwk>MoZIVJZ-my`T zeC(vB<1fr=5#nNsCnl+4Hj3LQVdGuuC5hMNxF$bsRc*2=L-Bp$o`Gra*(htHoQ6l&Sd0Mm5|0_JMFITPG{| z)_{EX^Aj62Z8W3*QyZVj1d@xVmW{eL>e;C6DRoFz?MbWeDGf+IC!XaX8`?;p;`Y+m zcK?=d!cbGsUto%AZli^bmNr_+Ztv->N!r*b%0C-ZD0j@-QEzXf7;|=#s*U9~R@mrl zql=A+w%q$gR~y}Igl$A@bhpvN#z5)aMo)S8Yoo7?e$3O`Mjw(-m`w)Rg`_{l0XCAJ zzHo~2+X&b&Y?wAQ8$o(>;*lxpvggb^RarJ{>LDA2r#_wG#w7l!DrzHUW0;NMHsUrC zHU`-kOn;K-*qB1|4zH~|+8bhHsExy(B4217VPm9?F*e597{!J%{?RtBdY;VF+^)yj z7;j?&4Y{ejJxzT;GMVBO8&i2|#5~Q$bQ=q7EVR*Znwnu_o*YXh_s!=_8?(q~v(+5p zTw)q=zD&!-%u>X>$i`wDOPOQ|qaya0rpEJXU1q!AXPi_iU2vt1RW$6evD(HO8@pIt zYhxYBb}`%7U}KYw%`#Wh)JE#^*SCDBQ_^l>b*qhS(&IGwCtR+$dz#XRy9;{FSt`<8ldyQ8J7Z zHolhS5rP%MH#Sb%_%MX3A$)7&lw1WNsE|B0z;`yT+ql6b-`hBA;~e=9vJH~RGsmB7 zoFOkX-94Q1HhyOHnvDx2mxvdMzYyQ0Q_PobT%jWTs*Tjy`IX9Vp8mT``yO|G{;=_< zjYl^AW$31jziiwgzh&dL=a&_Dm;3?oo{jq?ZQ1GHHlkkd4{iM8wVFR&{YRcLpF4y%L&y_C z-VpMKP$1+!dXthbgttQILXX(wexry&q`V!1JwyKKhI%K2!XZ>(&LYGTA-o$x(UAK_ zs~8pW7Y|`J^OU4gHiU8^lnSAA2xUU}h?DjnL)&TlafZ4s!waE&$i3nMd|}mz6+@^L z!UrK#roT!EQc|O;+aOJf@Q*^M7DDR~+Avf-ga#or4B_JtYJ~7f2sJ~f!%&8q>eCQv zlYbV1RHb>X5OU8{<;dmBuysSIM?(uL^~paE!DLnZjY4Qfu`yAUCLuH>mpivoZSLtU zNLq#&2kUlPaYt)p%UcTl#m{R;k6nyOW7fW zLijy|>mh_gh=edUgmEE6=@}HlV3Jq}agv1BHc8^h0^naILs%V797-I<9;dPQ5mZJJ zM};stgfZkYo-4D|E_%j?Fd>BPA?yfYBBQfIm=nUJ5GIE(h1sTuFe8Mij85}1$XgD{ zGc$x)o>GOUEYoZ?H-vd1tP5d%2=hZ&5W?~hR)nxHBo897G$j9bJ}vc5V{r&eLdZ4S zojobnogwU!-B?a~2)jer6T%T$U?J=cVP6P`Limyi_Y)5i4~Smh z9jcTsq!(}GhZ)T@M}0+d+S8APaDvKlV(B^Vk$z1s+oteuLpT+}FCko#{a?1S5YC2h zE`;yt`7wl_WK|DUKge~#w$kJbLp?d$`W!W7jyg}}LP(ysx@PgD@S@E59CeZnFNbiA zwkyP|bh=-Skq`e+5%L?!wK?iW2!F_a7{)7M{29Vc>MD#|A>0n(F{^(OABONx2zNrb z8^S$VuKWphtY{u!7Nm=hVfh&*~oJcpARED$qWAn<@3NVvMM=WA{jnc zy-M;%7&%E^Bfd_QojF$+xx*;T>YHKY3FB?@yhO>9Ka70jZ+S{6>8_RnVfRU>kb<6G zh~ypOc#gkF7)8S<7DjQ3B|N9Rh<9Y$Qel)1V^$cm87f26!+0-@vSE}9<9+ERjL)f; z596aSs)bP@jEYn$g;6C8`8LW2tjb_2hp~xW3;!^Ts?@)m>wfO8I{7DI)Fk;hj2dCc z8#!^-u<$9xTEx$YqRU@-wZo{xYTYpEk;p^&tn-u; zBoZAIMv?hXM?Qq&P+}h+Mv#mRV_X;`J^!dMMw54u7Xp$x^VN8giD66%V*IpFqVa}JdCwrtP5jB7%SzF`DKSyVXO{gO&Id+ zp^@{|s`={pe07I|d2xaJjBkC|y^*^yj1AsMN-R*D!q_YmekV=7i`sO7J4@Tb*v_1L zXxkCSF3-P{q%Cc`$^8q|UXp!b>?fJEKy9Pp3%Me6d?g#yLO1OpM!yW>Fv)3pj*uUf zYb}i9_US6n`ZCBy+n^J>220 z)!s~UE{yXGi7w*LGL5~{CXiqBvi(AGNsgELl`yVSxkmhzcy*!rjpTPC7O8xT)E~0> z%Wf9ITM^up&0jXv2(m?RTh@OVh~SwB?u2nSjK9NpAe*6udtu0npo~PyeWt3qNIeYW zAM*dg7_dk^3gh1}QV*5njr8C}YVjiVIE*LsoLb~IKf6dh8$pH$RK(qIG7>XIkeNjO znoA>*PvRTk=5i61V0I+EvEeItVG5xfvVjtE|i;FSnojo>9O&&v_W z5A}3itcJ4HYt&ySj$Qopb7->`tDF(!ieL{txg&U!hCIZ)5qu}j+p1jhE9IPl{1KF4 zs6Yg7M^G?=LJ<^?phN`kL{K<_VvH6c7A0Qs#{8H>9_mS|cOxjpsPK}~e96<}Djktu zwsiS>UbJikP}0?2o8{RmWhhMjvy34*9f{r;G?s91U=-q$a_Z6D}p`|^kr3^ z==Jupea9sIBET{?txW9srD}i|9VknJx<7(I1X={a2uw!x2n-UrT`V_>rL7eCvX4bE z_0^tm1d#{^QHe&}@0KRW#Tk=RNnVoqljIJu{xY@9N*f%(5LV?(4JDCQvQdwSU}OZ- zBbX7vDC*;gqdm`<2*#32!_=qd#z!zAf{77K@;p-_m`pC;LXxyoBbX+0#gQzn&Yhpp zMG-8HU{(aPBbXDxT$w{Y%ADurSrEZ|kI!K9g{;EA~_!X5Sa*^_#(ovb2t?o%b5y96o!U(>N;I-xI8yPt-?G&D3s~;jrELW$=rO9^@ zd{16?xjX;zmgC0=e)6KJj}o1W;3}2#5&SH(M1Glgk@yQynqQK$xm?MoR)k-Xso*zd zt}*&6@i*d<*xT@v3f;edv7R4J;)uSj8 zbuXn>qtYtS{B9H_qbLW|=O`LS(Ikpa^f!&7Sro0KXv1prC|Y=V zeq5niM$w8@x%K^odD^ntK8g-ev?EX5qL(hJ$j{1A$+Ob!F|{LgiK44asq74$U9lSt zJ)`IzMUUvyU&NBf;u7k`P;a7C5XFcnMn*9(3Lg!F=(j!U>c?2w%MidLEOskbXD~h?~vn6@0^f~16 z)m=H{d2)cfCon&X?>Qb37e=v&p428F%F-xSQdve^PFz8}$yTe#SIcsWVlBC}l8IeM z{=%xK>wIGrd#G%RVl&B>D0X=Mtt8us+ljI;c9QHO?k1-8hrLnklSNDAAW?ceAoD-b zJ+3dP9E##glEYDaL-JJ=M|jeYMsYlf6XeH;(&}q^QYckf8!~|RR;g1_oQ@(>44LJ} zY-OUN_%({(qWB?-AEUUyRzDHX6VDLO63-DOn+*GBnMUqcpRQ6DssBQ}6vgEzu8?0P zrml!<L6n`*!i}Tnn<}F#b2H-3GYR5KZ^fk(~jbA zPydJH0r8<+GTdaO?ISAx5=DGM@@&lAfVYM+`4|{3Xxx3dyU)*Su(|ZO$0-dP**m+{8Cy$m8j$ ziOt9ATQTJK^a3OjEfm8$F$`g~a12Fa=uciWhGH?)j-gHr#bYQDL**E%#PBYoWr#8- zC1WT>UfNS6=X)`fWwji!d<^gZpQyB|z-q;qdoflb|9}`;r9LF79>d2ZRb%*wL|RoN zkz=nx@~NkPLQ*sK^qt;ktk&|P;;$P+J*mdfIfnW%d>%uK7+S{A!1FYXp`phc#n6~s z#?~Z;Dc-f*jAC=ImsYHHAhss9A<8)0^0?Zu+Mc+2mFh^+$@9o8bs_IT?CR;=V(9L1 z@$`(L7puKv=u6Uvm|6h+{*QA2`9N8sG5E=?80;7VF=#OaJ*N?aPAT|1hLbc%?t#vjwx$Y zwm6=TBRjc-POMQP-XXpi$4hZkiQ~gKUXJ6HI7&&jLz$(#N|KBCS{$!?`WtcN^!R`b z$Q{RkBzeBIN<30Z$5DpLdvW>B4$6^N^!)F~QJ%a4F_pOz`3Ih-GD-W4sOl-TWDMlh zh}DT76KfDZA=V_y7(ONWERG5s)x9q=*N&qO#kz6Si=#ey!#Enn@i}<|;{WJx97lMq zYDT3Ax#Vohs_0UhQ*04OOHUL->p0rP(Ke2DaeNcU$vE1_(LpBRQTj1r$2gXeh|)<` zMI4>u=n_ZQIA&4r7Dx9u;&CM6=n+THI1K8&;^-a609jP5j(e2eCyu^x^kcPu9P`(z zkv-gwqzD)E#Sw@@i^Ctsw^Rg!ab#Ghr05h={JnL`jKhkFu{jz#O0@CkAt>y_}ya>>LoBMzB?scbbZjvpD4w$sUlh$3aC zSDhWloH*vjF)xnAY&D-K&V_L-@OWwh7kM+bg!)oqY66#g&J}U2BwrQB>NwWKu{MsK zaqNm?T^#G<*vhC(?}j)wG2uo}kxu1&ZRRQ4LKI~iquV+2($@~29hu?XaqNlXNE}Dw z*c->bI1a|~MI17X`%?+myEA!!Gbwov#gUr8!<_#wi7DkP`ehDN^Co7QpW_ry#PKy3 zMrx3f{M$HA#c`U`F0(4m6qiLIW9B1P=7sqQ!yq-j+ z4eERx_v83Gj-TVW5XZ$heu?8!TKY}mCE}GhE|cWnpd@rP6-rCL7RRsTzY%{YUMJol z{y~%`f5uUyf}2*#EsD3}_$!V((>)aUg-x36x3TnFO9q;H?DmCy*h5j0vRwkonaFGLZ<+nm}gqG*3w${*-0eB3nV!b=)FNn^(9Y#ndFrOrc-~-(_c^EjRbNgkjqo@ zB#@i@P2zU?B~@Nl^Cj@Rrxc)4G=aBC#8Z%@5b+&iVPX+E|-`PxrA&ZC2|L>n2c-q&{)#MzwdNYM4Ny1V$z>DuKocG)bUe z0{s(cnn1GzI?>sjD1EgdX^}unl2*jl#P8W%Tk>|q_C#sbfuv&skLmee0-Y1+La`^Y zE3q4~J5gHoNT9$bck+9AN^g=r3H0?8Sr`Kn7??mLfha{^0tShn81S4LNsy?^31ViG zRm=0(353YQ#Afu!0Aj2TCdP>gVv^_(2g&tbhFeZVc z2^>pcYy#sFSd_rx1jf@dlQ7OUc)oxq#~ z<|Z)DQx+sJpZt_}bPE&sgM3K>OB2|Vz}5toC9s^f4GFC9+O8p4NnAx-oxnpc&)Njm zdCv6-WZmqZJ1H9}ZX#|brk3=!1a>E|hst*1js$j+>>`%(GVD#@U;0D-z0D{0l6?wC2*SJw+Wn$rb!nf ze#a~K#{|AlVBco-1D$6!D+%3ZP9bM0{+YnJ1kNY$a{?Er{7$@>z?B59Ch$uFmzZCg zNVzPtv_;8-d*RpU{4IfBNkl2X#q~&c*Qwkf{y~%*L=w80z^w#s|NnlHzle8;lIosp z)EktP`w9F_{=icnlKew_MEo~_|41GarPY%J{+gYZ%J2+d-JVS%LlPOuGbQmnNoHai zF+CO9pcF|KV%8*{BgsY_b}+N#%ufCSF$eKQqJ&-|c{zz!NM0q@+2S6^8%g9$;+sJ@ zIS9Fu$eqN(Bo-y{W)gXlD3wI%B=RPaFNuOl6iVW)BwB7!1&H~HJ+~-Pq`b|l{3Y^E z5`~i}!m6O?MZJ*NiX~Azi4sZo&lxGw{9W>rM5&5cCW#xx(#LO6Rg!p*yev_~a!I^T zUY=ON(<>%XiTndksZ0{uqCQNbY7!qMQ7wr?63HayZBf;eD7RGwlK41@8cBSTM9m~R zB%!vdPm}m8i54>EBx)tGYKy9$#OF!WPNGf{b(5&aBD$2+Q3z>}M8hPSB+)d9Mzl5N z5lKk=(n?A*@2H!Tq(q7C+@e|~adwMpmqhC%j%-nFh(g-ZDMUJIpTw_Q)IVEP$0Rz5 zo`C($Q~zTWsn{J+DKE(WkWUlRT# z26}@`9iy0qI0`P9j7io>p{5Sd9{6NyL*#>0)z|h;DU{ zacUBSk{F!CkR--!Rl}1Qk;G8)ty|TwBn10i&OA~M{Bq{8q9-wmd^Ay_W0DY?M8^{+ z5+`_32~8rOoWvB*DQ3~9B{4mTV_VhPt!hRR|7}$>W!Z02mA0u_Nz6`SP7-rvnQe2& zIbT*0d8)d=)1|sNi6u$oI;xHi!qOy`CDC9I8V&BMoWvILHA$=`5q(_}>&Z8G%0`k+a-z2>F>Fm@TM~Pd*q4O1&0Ub&lNi5E?MPz( zHYH^z$u8n<;+`ZmCGor9b|vKx zlIz49#4I~p{ZDe)d~UJTZQ@_VJH)$0NuFzm`a6jSa*aD^?BJoi`IjxuK|u$PWQt@D zcaYt|e@Q$}BF#a%gStD^6YfQ$cPQa-@Qj0J9rtR=;2@)eOb%M_a7QjtQ3Nv+MVUoi z)~9lig-x;&pCe`?if!lC^cNiDaPXRg*B!j*;3Wrt?@-V0RI8Zb=nnO=gI62~k@Bj8 zt0ZqY$hT8f*{R-ikkdgf2PJksJ$Jd8T&m4>syq(ziqnDcw}=HCZ<+;!s?ko+fKp5>DNz z$~q|L;C%<>9jw}^4(wDJcDbjlf`f`|(tMYCYnQ6zxEE#>2Ol_)s+7tkWp}9$9aLph zE?CJaSlz+L4nA{G%RvnXpE#)L;8O>Ec0E1zLA%uWU24uQwPu&vvrE->P)E)PyZd^V zdbmqv-K`4jR`ncI*{$kx9zJ)_z=2GQbRl!nkVK}XiG!vNHaplNHV4fe4015oK??^h z9Sn5fbI?i_fP*d$x;kj%psj-r4mvt$v|IUhs}Z|ZI|uEVaKUbOgr|3_%ez%42lu5) zUBu2LS@x)I4!S$&>!6>5JbPS!4+mxUsGbgb$zkqMz2!(rgiBP4kmh?-e+L?s62;R8 zNVYvnh~GiLf$7M&|#O8a|5C=mY%yTf`!7vBI9ZYpF&A|u< zBOOe3FvY{VkNjC0&wLikwmP#jN1Iud=NgB^R-B!(m^TxR&hUUhM= z%DPWYcjV_#Fw?;-xsLX!Li<$1eM(lTTq(014A}Q{uI6x_=MuZ^Qwtm{bg)tur-MZf z7CTt(V1P82z?pIQzxm?{v_p7ZAw#gYV3aXg$$db;9&<}Ns|5Q2>tW+t91+= zb&&Z)=3@>nuqqS&wS#XQ{NUh62PYkT>)<;F-#a+PhS?6NHxH=OBr2Kb4$?_1xB?p%s{39E$ zgDbM3$+~iI%fU4VzdE??;D#*wgRb*8xzZ1+rU%vUaxqd7@ed9reo*~MGJyJR2Y)%Z z^gIGYktd1*3q!XVPdJa27OKVz!@$yYp~}yqC~~4G z7{%a)YQ#b{VPWWVe4z>!s?QgypBE|}MWHAfMA0yc!ci3ASv`u%Q521$SQMqAC>;%V zbnz%kL{Tz|zr+HKuU@DQEmS;5m5HKk6y>5QAH}~5!}!T23N2EV7lowpB2^)ZE{jw} zK}xDbQ8kKMQPhs2S`^izs1ZfYDDGIK9*`=G3=@R#iTv^+RVRwNQPhi~eiR>w{D(#1 zgNCN&EmG?isbh;&qbM5FeiU7!Xc9%!DB4ERE{bMRG>@W16fL9Sny0sy#RBU_7OPg# z@Y&ruiZ*n9acGdK@nY3JiVjh9ilQ^qV#S&27{#!~;Tq1>8MRnFwK!aL-J-ZDiat^F zjiP%LJ)-CpMeitHU98?(tP)jJ&nU(+8qZW;EmqSPtHq1emc^=H6#b(Z5XHbKPA(2( z{?)}wEm7r{sLAyrgE(1HkPM;cOVm)|Y?qOr*;}HxHHz1xc!P~DQTH!Vw?%O~M=y#y zqj)BYXQQ|)io2s26UD<(+!Mu=C2DvSBckE4jr`td_#7D>#Yaoj$Y>Zw?h_;#6~+Bo zZZA#UZ(R=JQu|aQM?#M>!qsq(y$B9)8vsBoT!rgkx(*;Vx5-AhXo*qVS_gM)BdY|5idutfiv}M95OAy&1(@QLJ31c8L$u zqWE3pZ%6S?6z@jyUKF23@mUn_b4g3lC#)`n)qh;3K8k|)u}DZLq#CoINAX1zKd_YN z|0uo^weLiYC+)AJ_$G>P#b&Nq)}@^3d#O%4KS}AYQT!Ig&r%bpT z%wYVFVpbH3MU$noqxdt5d6JzYI5!uUsrj7KWr}Gb*Biq{ZZ?X)NrbaH(;~@|ERl*! z1()Tjv3e9MxM63hm4YOzgsc{9wOp->Vto|1#BpmJ8=~0A?GQsWhD}jy=9Y}1dkkA- zksOQScobWs;VZ^AL6YrJ?1*A#6uY9>9mN5W@5z?#i(+q<_gt>_XZg_Oiggc0@lOGb=e4#rZ71 zAmq{2IhUij!tfXim*UkZt}&#?kP{1+S$es;PRU>DMihvF4|kp@^2CrghI}!6vRrLk zu8uEPB>7{QE~H=#kr>LwP(B6~gN~tum?{(lBS|sA!Z8$yq4)|_RFHBeW{XQHi7P#VrU+Nze3d$Y%Ewmh6b!6{KFNhQ4B;TsxdVYc~e2EwV*RG zw2Ps=NLmTDiJ`R+)@7BpVlbC8+aZR|F?5NcV+@_LYPqejw5v4NErwhPk*)NIp=S)Q z#PDhiy<+Gc!`(656GNXE`o?fe47bM6FNXdx42ofJ44c>F@Ig-;5W_$z%FR+|h-8O} z&QRf0W4c)+RA6HEwis^D@;hR=o*DS)vTuykd&Q5X6v)fjll~2%0e@VzAh${W&}**fBWVbdsgSi-lK4Busv; zj$leK&0(JxmQIb~%^2pyFgJ#`Vwe`g=P`T{3-4k0*kW*aTReG3@Lj?81mBP011=}w zA93@>@M#RYSE!E#xeJ&+i-Czkaw50(moXGxscNrOjF4Z&@O2E|a8u7x-wOT`!*@cy zkKqR)KMMXF!%sqvuLvtL}GF`~;f`7y?L&!|QS%TD=Erdq?jA333^J7@R z{k2l@wyn=fb=OMuR}6p0@J|efVptf%BF1M0kssAy}%=tgUY_7uL7>;n|#8EAd zqcI%gT*Of%j^i<$h~Y*IvsS5-+%K!t`4}$5a4Lq=F`N;}zk+84X`DLegp)9Pk!x?2 zx)Q@xZWH0mUKaB9Dn))R24=6z+GCar@7q-hapZ|3ZyfpJ&~X%sBYzwP;y5BUbK)o% zM7oH;%FTQE9TZ}6GyvjmA2vu+`2M{oNqc~>B&4bE{?~AjE`fY5DK3V z@}%Gd!KVbd@SYa(j370i6*4J~gNJgMeU5!uqh5{UwK$%aS$iQncQ3~AlJJ)WU&+cD z?O%_FkDhnpVfcL`j%XaQIO1_6Ifii@up;1#Pn7i)8cqrBs|qHQTT2g?}=mYi<}ap?bAw6&_<+AyqjTB}B^RWGbn&RX^E zTJ>!l-^DQ}j=5}Nmg1!%-)+B-E7pcSe7jct z9>*W-rWDPHV`dz)xJcHi9c$G!NhQ`PrWTTVuT%G|Q-8)WFOKhCxf#_>-ahvHZi$Kp6P#j!b#C2=f`V_6)_DO{&`E6ewko$JCI;}zoh8d_VX zRtl~XTrG(8s_1&PHV)!C288u$J>LSjJA_ln#ExudZKa4$TUzFO<*Vz}VTRT?&c|_q@js4Z zjQnw&;2^V=_2H!O4Ybe(bux~#GLl@$r(`{!j^m6ZN@(q0&Xl|wpA#~kZwg$ujJgJj z8{wB1J}xhFnb85p)eQ;;@)#kx7RPmwklzr}VS~zRAfEwcgh4*PfdU5qIxZrTc)?DB6L)WQwn{dNTd6%9OQV64F(Iz?sLG%$#s8>niar-5Dusu`$mpss;> z25K1Cv>|-g;3w3YMi`@N3Dy>@BS<07D(q(Nm!tXy8W?D3ppk*b2HG3wV4#VCrUqIW zXl|ilX@H!BLSh>O?F_V)Lx1GfpeoiSesOYbmnr*NKvn7unI zXLfj&j}UTiR+D4SCCx=U%E0{wMzb%RRs#>RbtC+C%$uU8H>$LZ6+e`WG4QbTm$zq+ z7-`SC`@NIuTM;|8{|qJi-So-pu>fnN%w zfpr_zWUh7tyai%<*1)7J=lD!9@SK6?4P4l$m|ijPg26x9jF$|&ESM{&15CL*d~_Ok zgJW(W%_Xr(MGYhjSO#JSdTdg01BL-pcrH@Nwrm4;Z&J^1Ql0@vIJ2%022$TZQhfew zlUmX@a!Zebfq{&Hw?xQm$*Ei+^VGUc>P;j3A~thVcvm^iz}p7)Z&LhH@b4y-f3tee z!21S1Gw`{AvYXWh20jwo-lnZ*-s37Dy5XL=nGk6Um5sXO20JzyF~iNz_$i| zGVrs3?+koz;0FUga;W9`-e9xpAZEEqdBE$xS>3le{Ma;3gufY>ZeX5)`5g8cYSL!) zyDV34v--mTafX4J24)GLEjZV}93gyoQGw~tY<7VWe&b#u?!C8J{l#^)MExze(7+-C zi-og@oN1|nWgIR8E4UI2tT(Wd+ij*=BNkQ}SS^HKc=;7L_Y?411Gyi3IVKwzIt*+! zuu;^gK(#Gmfqd)#zwQnLI}Ow{QOm?G1G^2tL>?1+4D2;<#=uzv`#4z!P8m3D;J3}{ zfPo{MRq-uq>1K7%z&~_&bI1<~Im}WaM+J`w9v7s}2?Hmye9LCVr$e||x%*I~ zR5d|TMUW1Y=Vq&mP7OgSv#7R-Iwo#2al47SChD2!Xrhye`X(BfXlkOFiH0T`nP_aH z30qmM7_1nkmU0XmNBH@PAINrXQO!-XFwxpX8>T;0OEZk>#kZ={TU0CI`L?R6TUA>V zuWeQBO|&yHV5=IvHT0o_iEo7vJDccYqK}EbCc2vFW}>HwUi5H=TC`QH)x2;IeI z55ePG!;iV#Xyv!5-X{3XrNuVY&qRL{Lre^1Lna2A7-V9w30`6k*rp~>bE)DtEVlmI zw(xynn2DQB+``eAq4-%XwM~7nP0iXCD%@&fgOEE++-c$k6EB*$%f#I#9x^e;#62d4 zn;2!{eiI{1+-qW_iTlJi1_XZHpb-ui4=Ve&g$Jb3EHd$ci3iQ_;|Q0{xoxW2cGYNm z_=R!myl}D}Ht~pw2_~L0@u-Q%OpG-#&P49VtPb15!Q{*D<0hVvhQ`y4?O{X2C+XN< z>ap!A*sdm;c-q8sCZ0F(^>+0PyD(2pGV!blHp;{*lTAz!BQv%u{wTtFv2%F4y1HEz z-l1MH@v@1eiIj;~OuTBsGGTKbO}uU*Y9eOh4K9owYT%CWc9aI&?ND(O25Ze%{Jw9R zNQnJsc7*3!o@wvip?C&%Ot>aI6F%+iP{|$Y;~n9bT)u+w)6b7PLQ`oIfyuwskM~Su zOiVTLwuyI4ylG;=j_~q-{SNh(iD@SIHb;G?Tyl0tIK_Ojzi;9L6CaxR$ONBUd3LJm zJHvh2YNzVGGkmG!Tz_hYKe4vW#C8*(aS56D!o-&*W|)|1;wui?PBnF>`junIiP)*W z5hVH6#CO8KH}QjsABF!c_>&2y=XWZq{bGWNgxTLjINikW+=gQLGm*21t<0i)r&?@c ziHX@J=9ri(6Rf0~#_4|l5h?7oS=gwqZsf16k+HgmI!vPCq@wA92Z6RV}^WhRzq zompXGrEpqc6Kh0)`kPIxHL*^z>jl}D4JJ04*p$_wWP8^0Ehe^R<#b?&iJc~DC&JSv z=V%urTLPsL*v&_PiM=NFnYhA0XJWsJ11A2ZOS9BL6aSbv%DFIci0gBwI%1;tE_GNI zPt{$j`L6KuDEuO%2;WtbmfjkN1O`u33 z3~u=n$e(~pKqpWjft&;iCJ>RLmb(>G@7;=fnS{ugQz(JL{1pk=aV(;ooLE$<6ceN- zi)g%rWT|k+ZdE#gDhX5-Ntp!7CQvSc@{+AASV6F&V5R>@K2}UsOQ3opd`YjBKn)?} zH51{5^T6y)Z$G)zt&>3A1nMPFKY@-3bV{H>0u2*roj{ue8YR#;f#wOcAdjI*0!Rtq9vC&|WN1p@T?rHL1qbIe{)B?2|y(1iA_DmB392 zbWfm10zIWgYUUdMzt(d}Z?T-q`%2w@qR$T&0}~h|gY%Gu!3hjWpoE2z7KSD;jG74~ z6S$e&jW9i)z%8PDYa;yh#@iCOJ%KwCxHEy$f95=tz+F;$zu?^oIJ?z7!iOg?B7u8_ zk4)e`A%Dn3j1swo4v zm%#H0ydaX14~KH57bW{r0xt`pDOWjcxfemBz-$p?GFEs#neoxp+w{z@Q7VAdWrHGx|E9ZxEY8YOQ^U*1Y!8pr2y zWa}RFb^`At@NNR{CGceeUnTH<0v{ysNdliHaB)G-hn%bhIUgl(Zbi<{1v%s&(_r3E z*k(@7X9;|sz!wRexfG!S6Fo^v>5)C^>jZvE;O7Ls5eL3a;5#ATC-9>XD*qs4kW6v$ zz5K5$VXT-d_-g{cB``gK-xC-o3L|Ib{E@&+_AY@L2{6mlY_B5DPGFAI%FWUU$)6%2 zpO?UV;iLA3WA%3e3llh-z`qGBl2JOz?ek~O;spO)3zmw6t7T&X%M#(QuP&FmD-u|l zz^bgxbqTD_@-;%%a$ksjHnCnL8?rOCi2+2+Zb@Jl1G|)N72L+(0u#boI}+F_e1+I4 z-YBvs0pgJa_9n0|f&G&GN09OZ2^g!I^_E+uf8YjvMux{|q1zOLzl-w z#Nxkmjc~o?wUEyW=QqEF6_>*c%mNm2L{d<2)V^?bsH~)l7Az!Kn4SnJDp*XgxL|IT zQWi>EXknqHm?|S!+hQDul(q2OK2^>_c?%URRJ2gZLZbya{OvZ@rIVE{RIyN1s!&qH zLN(#l1sNaix(79d*Ag6FD0H6kIu`0$czJdXH(EUl)Ap(Q78-~S6&ea@WTCNzCKj4z z<;^WL%X0pnHHTv5KGjMjVequj+Cm%2wzbg3LgoFcorU%mhR@FFV1eyTIgosCJWsy+-!vrpa)0h&z$}i23Y86g#oaaU~j=bf_(*9)K8R2 z28siZBqM`_blI=S2U{Qx5gaNwOmNc3u%TNl+$t@O+pn0t-NGFf?zC{1h5N8;gTI8c&~+#LhchB#qRG{)FF-*3pD#bG4gqeLN*H9c*?>=3x8UeXW?lJ&sccJ z!n+opwJ^y-+=5|YvV|!YUbXNVSCob4ExcgiMS4;;vUa~Ba{68pH%ML)^0MHe{feua zzuo`3g*PljEyOJRyD6ve0oC$AxCoiJ#_m0!GLkhdxE4GM2@4jRo0DT(Sb0FPm0u4i z#{!X6d<#hn84FV_q@pi_}an`7Jd}Zzp?PGg#*_jW9H^OnFrrl_+Dx?`bRObBGVoJD6VRfU)VJZ ze^{7d;Wts6ZsB(ewrFx3xNWJn>>oAL!Ym83EzIG}mI=rI(NdAgbwY#x{-fqvU~@B6 zr1&8<-@*b5$1EJT@RxEV8iJ!V(KhEiB{yJ*4^{3hg|4NWFeY zeSS!FFB7TQC$iGQDhq2ZtfQSns#>|oGZQ1LEv%upDzg8OBCcmc#R_sL3LRD(EL=LI zm}qLV#ec1Z{Tv4iTPdi-$w~-4^!HEWg7}jO^veA6EM; zFp;oyx!^$y|5!L;;i!c}7V;iZ<`MPI5yh|1hb`1TqW;G;GiQz<{Xb#hqy^Z>W8;*C z(-zKKxM1Oog|l3Z7S4$S97#6HE*w7+t_oVcOKbbyQvD zEF4wEkEt6Lu35OwRd+P3!bC#PN%GprXNN@D$Zw;7jU34~I;QSCrXD?}oMT~?f;Ko5 z5kY2|w9TK&2v=_r8%1q2w$a2!F&o8gRJT#XMhP1XHMbpCm2H%?QOZVX8)a;iw^6}H zSsPy*Q{`+#j;mjfsol~_&Eu*f<&Q_YmyP7HBb98dnw!)0xFWKlDmJRxs3z`lu`yAT zP1Lke%SLS*+@!g_)v-}e)R?VnW5jW_`{hV|8x2I*(8ki^VW&>)&S}J699Lf+S50j+ zv(eQ?Hyh1Gjh5RBXX8$n+D$gP+u_vowb8>yPvL!R^s>=g>ar*}p=O9OPn*oLRzDm4 zZ49t6(8eIqJbFUqoD7R<3-&#!hT0frV~vfqHg4u**|6!SjazNpW@9X8MB2LD#vL~9 z%rD{vBa$WQdP?1UNAOpcVP8Cm^&xcr{6@vMzWHjYh*|G7ujWc4o_G!hLeIx7PfYXZMH)?~(x`qwYh9#wA z9*;~qtrGTsTfXElu;Nq2Bd!h4#t$}rwD~XdkhJl!jZbW(Y@}_xZQ~sqfsKrfw`@!k zQ=gnxv^Leo#?$Iek&wK|e{woA=kn>W-FI!gXXAYvA4qAHGoi4@8TFxL$)}%DW6!9M zIKO9NNewm#;pV%&cHtoq5u&o=(FG0(;?Hh$%JO1r<=m@Z_djo-7&UL(Lp5#l^s-ZP~AZd z2l+3ms!sSv{03cAHR6$K4jKxn>EP9i>Wx>!rfWI)@}gRGF|=0KK|KeZ9dvO}-$4Th zEm@tl95j+fn>lFggn#9!iG!vh;hBLIuUrg|c{MMo<_=m&XBk(!T~ZwF)}lt84i4Hl zXzSpSOX|%_s-1(Msc=cP7X^}z4mxqHE{C3QuT{RRx;p6Qps#~|4sOcY>FJ=m@E#6& zTn-l%^_hA(=?Z?8eIuX`H<~#McpZ_-{s(L2jSm+oteY%p6khQ zF*w4(y$(h?xX-~T2hTc~B=Y+mJmBC#;iHKT*jZM5>WX^E!59Z)dAxV4s{=QJAVDYQ!aUT91Jni5at~3Wvisn-enq2*FOeV17SJfj|)#R&c zBG=DVwf1VbiD-dOShhRa!4wBE2XP0_Ie4B6!@+9~UU2ZDgO}Mgaqrw!^%DK5p!W0# zd&-J@7jAM*Rd^%vI+w=?yx}0q$t@eX{aSd8oOmsCz`CXk2c`p$1MVQ{Ow?&gHIiN=HM3x zzdHEb!50p`cklzZhJ&wY$H8};%>(Ld2YIiDr{Zt8zv2-lZYZ8n$CZoR(2+vyFzqzB`{<`{&d&j|S2Xh?!E((8e#X8`mP-mt{qSw_Y*H!=PYL)}ygzIXq zgFhY2b1>h*tn2Fhb=B=gsLzx0h#Ship%ys!%i;g<3Lox_=ZnP7N(ZYPEOxNO!BPjy z94u#`V5E8_^oQZ`+Z$@v4OIa8@T5?(T57FxuwKX-dc~D6C)8x=1_v9tza*~Khu-9% zXVdVJx7h*Htj9(z~~~siyaPjIymFttb<(+c01VXU?0QCf*hKq!97lRK$;4@ z-@yR~M;#nCLSzL)7s>4wg2njoP#S4t~xl+&?K!l$)k5cUvzL;T)HI6xyR9*Jeqc{F^uzJ z=OV9*JM-up++un3v^*N_f2U=RJpT?7-vMdok3717iyRlFU6gTA&_%>WF&D*MC>PpA z5f?>Wu(O3+9Ll5lT1{S9By5XWJ`=fdcz7rw_Di}b<%084HgD(*FPezudPT~*|J}z{ za8b@hc{hAdXOwG~SMwdGqKisWy|N$;R&i0)#oc0r7D#Hi{4+lIpNj`v)N)bVMHd%c zUDR<=*F`fI&0W-!>J3~pbWvZpBNiIDXzYfog3EwQ{foT1i3_&U)CJQ9(P`nLrHj@s z+PLAov~qFp!{LZkb;B;SbD(7sR`2g(fQx~wn@@AA zj?bsLNK*O2fgR#vsEZMF(&e>3e&Ults`Ju`%l;NtDHFL>rit@)8#^ofj;!QPA$M_v zh1`>s4|j1?g;UHl(#3r)MzNI}>YIF;r}6t;oX@ArCw_0$%8H)a^bjeU5s(@ zu!|R5yy)T)7mvD_=;CP?k1>3W#N#f;yBO<+dvhH9&##%-7iOPuF)6>E;NnR!J4WPB z31=Xp&ND8ab@7~w=c(ypZhk#QW^gh+%{HD`K8mKO-;@hunA-0+6^ zT^DBy==?eQZ7$;+P5bY-xF;uE2G8Ya28|CmdM-Y7@tHLGk&BOAe8RSJ^p823%Xnpu zK9v)C__>QOTzu`~8y8=SGNV?Pf|{%AEADF{)PMY`h%qU`O*+10f$#S(_PGSG2g}SF8**a%f)OLcNGlBoF5BjaB>UknSzx3 zYDDI6n&@^x?TXHy;_$43nr<&}@t2E5E*7)JXCvDS>c6@03hIT73=z#l3r!=sUqs&* zjqnw38HdruY8Pu}yeeNG(Q93-bFrSA+QqSm<~oVW znW3!G8@akvXnB*1wo2crG;ynoZH!kgj=0#);O}Cui+!9I7rR{ScCp9B>1QL$mF6*K zx6&QUhiBTnI?V2Oalpkt42;~`S~H9sbkR-g3XkDFttV;Co5uIGp0D*$I>Wu=;)09g z3@r( z>n<)cVi(p|T-;h%w<#PNxytbPOoZv#!a5_89|iMx$m^l5hk9NZ*7AAK9tsK1@1cN) z91naqWLPWcg&6U|Ly_|EXVcK7HHCFy4@Epw@KDi1Q4hsDl=4v8Lvar!Jn){Xq!&iB zONDi%BDznJ&>5bT%6Q?yd*>r4@8OXmx~zwC9_%8Ti3+SmtmL7xhZ-JgdZ^-|s)uSG zs(aX@!_(}SMZ)N}wTR~4yi`QQ9Xy&0g6&B?5DXP7qx`l^}MRlEGdPY&*(!-{rA!);b zlDDdM91suG99S&${NZBy&!Gi7dg$b#yN4bgI(z8i;U+J9eDI8671Ld1c)JO1ecfT4zY@;KNDudU80F)BAEP|n?_q<7jUGl*$HSW*{}nqP@bI9A=R7>` z;UN!WJWTZPw1ftdDW4-XAk6X!|6$boqQdFdbew>S{MCjO)9wvBr z$_q~de0nav5x(71&X`%fgnmZ!Ik1yGJnLbS7e2nbl+aI>&^$Fwk)dKF#t%n8?EBFV;0a}n={3EWW`b7?TAXX}^k9s)f;jD*$xpFuZ9!`2VB{pe_ z0k&Id{Xl7bTH+_4ZfA0brF1wZ=R7c-_i#akbcSQd&y+uu*2_xk%O0+Hi1<)Gu6nrU zA-|6TKCXMX!O`POpC3m1e@g3Xr8Ruykt|<8C|s~2C!Ze<7q?rEkAhOf-NzzI*b0}K z_EE@32_GeW6!uZXM=>A8eXMC0s!^w?k8^Sl&n76*WkM|FqqL9mJ}UU=P)2hK%J_J? zj4tb=oDWxYh;z&6-NJdS;tOeIA60zx@X^ypRUg%SH1*NUM|B@HeAM+(&qqxk5BEVW zAGLjyDjT*{#}Bs~6CWi!GEq|BM*|;?eKhgW&<{_WoyzLm2TddCBacJezqggulgjE; zS>4=63m>5z6;A~zBZ1g#K&(wru%rn$Aj#$j|r9aLq5j%i2E=&K|UVwG1a<#fUFx@LLZgGqkU;7QuyB4L+B;VB>Al-KR8$OGl|M7C8voa<*f z4nppFCNfEUtTRMhn<>ire;l?vMQk?`@JkN168K5QRTeZ1+z z;WGA-_7Ttm9j>U8K2{kKU%cWAFPnR+qE7iBl4pFpE#zQD{kM>}d`$DhXz;ENeiUG5 z-xk8f`Hl}_zDl}grEru!@bRIKuY7#%<0Bs*`}o|)7u@f~|9j2+glpBuXVP@nN}7o+ z@*bW)i&guy`jS&wNt>1QH$J}g@q>>aMU$K5`%3ydAAeQS-wW=o6h1G?Ro1;K>k-dI zIITbX_(kUTSHV{+YYKn&@dp=t5_yxD;bSJffnp<*aWxc>hvaVB0RsH51Dg8vtwbP~j0t7*P&mraHr(aH&yPojblN-7GeltksM zq>7NLg1nTVsTxVtPNGf{HN|qRWH^s}+u}`l-6ZNIQ9p?WQnbCAX5i(O!X@#F!^`T8 zlW3AewsXJ)&PYN9~em zFZMen@pEHP~5yC=~ji9Sj6O`@k5 z>6JupA^dL?ti|O~t44Su*Ds0wNeoD0Agj#JIV@kp2iMTG{ZNhRddbL;B!(t&@k3nt z5W|wVIf=j1SeV8wN!*&mk`(T#p>Ip#c6K&}?kU`n#GOfON@8;ocO`Lm5?&HMJxpRa z=Z+mAuc1dI@t}}<1xE_rCpb#*e!E52a@=6VnJpflI)ly9!~OSlkjK~Pl@C) z!6yW%Ha3ZI!XFnLpOwE+Lq92eg5bL~G?ga`e_HSv!JkCVqRC0TB9bYB&j~&+_=4bz zg4BE|iI=mS#$Ofwn&9h6ypcpSTk0ec6CO{(5Mm}_WlIxDtdZ93tb|!tIE&a&GKo|Y ze+W+tel8dYW(21u@n#Zlaa&3Dqa@xI!s_n}c}MVF!S@7r*U%pb`B0FWr^StrCHqMd zp9=X*kY6XM@P+U%1-}yfI*D(R_%?~}lK535-wRUtCm}y1@uLv_G!%tQKPT}^Rwq~Z zTN2Yn^1EQMnxWc^BxWWtO9p3IR)2O9bCQ_LwIPzfli;Au6Fy&%*#$}bCH&!`5!zXp z#3IQq7F@z;Aof|bRH~CKPhy3Xu1sQ`5DHf%u{z7w2w9s%?u@LL>;}P&f}7{2tS*Zw0>1l^PFVasS83b3SJVtEJ&Rz zNnFkHYm6<@IwTqtNug*8d4%UpAzuplg+~Ngw?GOxSzb`cb5dQUpe0*Ku(04XDJmws zoM3T5+9@HVq+qEON@wL|QYf3{{KMDfQ>c(aMUhk&tduRSoI(}hRkM<6DfDg?t`Mdg zDby5sEx}*Jle)s&3f2>>FW5k^poDRdK3s#fTHj}&^QFeQcOMA%F4f9zcfeT4T- z;Z7m_1pB8jAccX#Zx$RRI9PCqAk7X%ez)K~ zg2M$z2;Q5*NFjIB()Xn>Duw$cJ6e#{i*<=isiohlr5{M)K@mPAI6j3jLLL@;M3DNA z3VAGrv02GDA&(1ka-R_LWVUod3Qq~2n8MR3Jd?t+DgL+La9)0tk(?y_uUeWyBIVDg z@PY_GPvONBUK0MU;LCze3a<#E@~c8#6MS9pjTE9O#DvFFFjGjRU`Uqw8(Ky_x-A?x zD+N0R^4+y`q1s`)Ol}IEX!?RRYU^YQsT9&F1R|Lxm`PzOC%U$NQ?hTRaCdDzR*bw< zTfdzvtgYV>om|WBrSQJUKM?#-@FT&G1wRq|RPZyw1zE4YNa4#Az7pZrf=_&l4!XGK*t)u6NWQO3(6lSF`TR5G6ziJp} zpM9m^+!X#4VYxbbUJ5^Ujm(!UC%s-B{g?2+1s4h~5?n0UxlTB|OH){u!txYWq~NCE zrLi)FRVh50#$#!$PGL<7jnZhG4wuK;6wah@HidO5tWRNs*x4`0(v3nkrLZ}LEh%he z@K0f93cFI+E=BiAi`3j9*-<6bZXtV9V9_4oPm0byk@$5q3}l(#RwIIwz&)Q@D`A#S|_{ z_L?9yFQ;%t_|>c=Z{2X{uBUM0|B>evQ;{@O8u^4%Cx03Rgy&=>1%)&b3p$MwX_OR6 zA;H3F6iK6~@LqLwF(JhThu77Q)zziaD4j+%k(3cEpGJi=$_g(h$aZhZD5I{fm_`+m zRLaULr}3>cO`WRg|DNO3)2NX~&8$xSG-{<$JB>ObshdVUAuFZgIl*DWRRa;Sm4<0_ zy_Cb#T9Y)Irg68(o25~vUN}l0)zi(>Xpu(CG+L!`QySexp>-OagixoAkhW>GOQXH; z4rz4EmNu)W`_UMx(M?7RM#}RWjT%X5I!W0p=tC?qgNWe)991NfHVfC(N{|Q z3DOkxnfj+Os-B)Cehx~5*}@u}#1CdeXMrv4W~z7(Y7t2DkA{*B#pT-Yq zyj5TSP+u>suSux?6IV#K#b46+HI3iWm@fLW1gZ0T8h;3%Avja8bc3+^Y~gbR=L-HQ zI8SiC;DR*%N~2!`{YC@*L4&aMMQJSN+T-2+yI7LOQbvY1QT0tMONaly3emQyM$d*p3cQctg#^EECE930br|jXgA&#{M++N)=;BWM7u>dOz0)75+)%5SMX) zrve=2O5-CbK$8GR(>TVM8K7u@<7u2o<4PJ=(>R&NsWi@|aXyXH>|+{d)A*NBsG;uN zP>*k@-)*QDHPn|H>N<_|&_?rz0RL^|jdb|mCG!Nx8{nhHdR}9_rLoT6M7L|A^9A^ziT`WY&?Z2~0G$G~r9$g)h}s8e7lcc6v}8#-1en%ZFK?|6i=ifB*xj6QFN^egXP(JlpEF zZS_5E^)qdCqOG3ZR-bCC%e2#j0t^l?B*0L*)K1^tPCwaBr`zdY+UW!BbkX*qd$$C* zHNa?k7~r-5w+FZo?o$8SVAX_WDYDU9y875#V0V zSAbCgM$)SedTIwvWTNF?vi$x4>x4fL;6bjO0FMQDD8QHi4+nUJOQ@r6-BI7&F|0ME zqy9k1`i^>RfN=pH4=_H!sgAmKC*84=ez24Nu#=wGNgwQ_p9t`zjBVl0Vcm%Vo(}MP zfIk8}6X4kZQvFGAh^D>&gr6G5BP7#!>No0=+H$!-9?*S!giTH@1l(WW&k&U7a$S93Sb9t0xT4r z8(nm@uDVNCeP37oVpsisSM3K#1_%OV0<7q&k9E~4ZoO{0S~s2M2I=;n(<@% z#{oVG@M(b0IHBEjyu1FgyI$E{e;%M<5B)?B{ZwD;{J#@LAx<^kvrl(H#)N^|36Fv3M0e%TET?Xe@Zns`~U@twcm;Oy8 zj2j%HR4@HSFFhl`%m6zB>M^l}=P zqE!J_2iP273oQp&%aFxEqd$FgPG8-+uU^NM+*hv`oYYsp*H_Q$t2YHW)K?eirofhe9-xl~IL64&aKuP5KtDJ@zdS&HF+eXFp!W{Y zg$C;81NG?uX98RZa52Ey0RJ-N1~|`MJW#(lP|p~sw+-Y^9qHbK^r%64@*sUFz~ul} z0$k-%8KhSa(gz3W%Y$^u!MfMr(325^^$q#Y!Fw~Mhaz6ID;Y?6qPI` z#WLW37$;$>*F5rM%Sd#v=1-OLXNPFBlvpk;SVpj{V7Uy+3!zR0AzNEVDrZn7gM}GP z8WyRVLA4AX$l$>Ys%KCmgZ3G8$e?BhwKCvse47kvXHX}D<{7leV8iu-bu(y~L8A=n zWx`EeUy!7MkWU8d#<}uw1)F8iM0nE-n5Z**u;y=d)gM=oX9oVO=$09@%HZ3+k=7af zGAoCKX~SUMHUs{g3{yKHM+fVU8Fb2^M+QAJ=$t`?A-cO5>>|9YAcft8+?1;@rC@_0 zn&ZPgF%$+%o&)KycQ`)K3KB+F^{1c z49nnV$=)J3Z$N|TydnDZ5dAc}78HCYgJ=2I7KZ9K z9*9&L8ZPe+L-nK#CUaE`)l3gK>bXq#6Kl_N1RjpOkim-?{=JlfFJk%5^(RI)Ka%Hu-V(}WNw12+RJTWZVrP|eFqk{S3}&N0cg5M+?a z;9ZeV&EQQTZwtO9I4xU?23dva9U-~d_k_QnL9R0&W$-b__P&CDW$;M`pJp&4gP9q8 zmci#4{2^=aiwwTx=FQ+oj&KHFXYgHye?2Dh`cO^$hHlG_OAgif`$YJ0>U$~W=4F-& zKV|T12ES$SGZ()U&6bLxvQ+$?+f5|gyfi}IzfZV{W@YeRG5ndqjiGwBcrr(jMRPMa zDYG^&gK|S7O!G5XkmXJMg2s@@-!gq|hUrBaEY4s_21_&8*)Os#gFA=mWnyZT@a2Ll zM6yyin^>JCYcg1y<*c}#-e#~-CTpAECc({uTLd{-TZM40w`Z_}?MilcwscnpxeCEOQ^oD*_BgXQq-(S65e8*UZjN*W_rJq+zm#d>U@m@S%n(8uDwnO~XqXUe@qtr6eyLw`(Y%p`eCB z8Xnj1goeTzifAaI;SmjYXt-0uy&CS*aF-Sbx}qBH(QvnhqD{a+boBN_9Itj{6;rMI zYsc05H9VlG^cB zhK8CNT4`vlp_YbqRi(a$1{!K>sH5S(s!~@&Jq?7!Yi-IRyI@wR|uctvdY3ZK=`Smx4hX@VM`VnidU1p&65nvT)uW1+G`l8 zf!n8phK?HgY3Q$EY?I_?8ah`KznXL+qM-{-!Ijd`OG7uVVDV&k4Lvl}sFqgNa8phDzDprrD<_aHolX4?aPtY*&Cgn@zTIAO> z=opswoY@O?p}()Q}}qj!I^h zjD{&1rYZ_~*hJzCRVC*f4Kr^t&(bjaCL5dPYWPaSJPq>|aiM|>l!UKuvfYrj=w_9@ zzSXcq!&-WmhNT+5qlZ+NH5!)D$Qpi9oWsf_mvi@hBr7!#U!ma#g(Mqivr76Z4L>Rd z;;F@npEdlV;aBd6>atqH?+W=%L55!v|4{g!9P~h3<+df{xLlpTG_2Q9zj$(oh7H`^ zDsF7oz+L<|eNt7a_9hLRHEbd0v++9>pI4Vj)n%K~_8$d#$(vDKRw|j4wv#ciLUNae z-AXud9+ln4u&*N0>>6@F!$A#KHC)rMqq-bYLS879Jgnh}hNBvekyFDt4aXV2G@RCO zM#D))-H&iexd&%)<6etfhB%v=PR3c)#A%+_aDl;@Ta}U-|216FFur+g0rq12By6bY z>~)3v`a@yUbq&yQn~ugcB$tlddhGf6bmY;IS4UDuwvJnL#@}@wkpBbTrh_NXL^pO0t)ZcXd3aqm+*FI^NLnw2o(Vl+jUE$G0_PGv}*g?U49o z)Ms@(#}S7mpQoIQ*(@*Uc=0Cwl0shA@rpuTRgf3Cm9bsaUxuj2z9RdrOO z+SO%#P5Dqq6&;&u#xH%%c|7@%4np?2R8ttd3)GUQYDrBUwRF_i(LhISWwE+C_%y{vkA{9aa@T2g{eGzhBBGrXZMHTWXI_ z&Z;dPbad3wh3=uF&#U-MM<*Sfb*!l!dlW56o`bdH*Actv=&qxOj-Iq$G2wAbcTAGV z)!M>W_aCbxW$Q>EHM`+DM(FrlM_(QN6lH*pfePubAWc0;#}_&V>li|t)RCTb;=?0; z9a&l@9(SmYgLPz>VrDhFu8h<%iYubS)G=De7#$OJe5qrsj&bx=9TVtpb){O}_#r^Y zx}w*W6?J8ZnZ2#9Owut~ho(c<;d*jweevkD^~KkbQYuxhFa7FEP+!*8ms}0x@di?_fn>ORI;QEEu46z0u^Px! z9X~XX8V|?*z;dvG%+N8D8^58<(lML6vY`;a(fV9NnXBU~9rJX|*Kt|Le>xWE_*%zi z9b0rP)Uim%FFJnJu~^49I#y6Vca4rEj4C>o(~=EkOhZ|!<2xP8l;mZ4{E)fgJ4wPL z4JCggDc(pLHR6}a zcO8Gw-{>Cny~Z-Au|$f0V`I74Sc)}~l1=0<9qV;$(6N#FG?CAn$owXDbLVHkEBnC2uo%wwZj~ zOolg;J!&CR&1COQW;9diF8Mxa(Q3LlF82hO#`c!s)Dn(jK$(B;N zW!$l2OS#X${RSQ~@UVeNEoE6tdBDJtmhx~bc~FUcwUrb%(5;mit>P{>Gv~c+x;g15X(!W#GqFa=4Y;);jL>d~2z!kT$KQw1H<0JZIo}10!0? z($=z}wVZ7&CEG}|Hu8djer@8(zG(coMhddJzMb?gk!)(9xq(j%G~?_H zoMM-Tw@wB+8yIBZ3jGC*C8o za%XcC{*%t1tD~s^U6;$+D}J-r+L+{UWO%T>OfWE!9&2DScS?b{Bg>Zt*hEC5dhaH5 z&hay_%b@J|87U?3$5G)b35(mxfTPSp%cKmrbPQGX|364MX;mdcwvaB-ULvJ%M!_ix zPE~N4f`_Iij~2Tr{x3z(xbR4eT-Sw}DLtwi)=xz-9wmI4L#m+4ivy^Xw!~sy^C5 z-t8dU4eT(mi`z<_w`$cv*tFA#bH7k4mM=QUUIY6KoHlUAzapDFB z4vMef6FN$44z3G=sf z9fP|}+->3&6R(;mYT_OfkD7SQL@^Whns~s(gC_1XalaD9BcHrkWtJx55)k&CN?r{@On0U^_^Cq4&QPRZICY~|zbtmC- z`&cUzrPL6_H+7QI#IGfs(5ilMR;t^3c-P>81 zV2}rp%a|x@;sX;Ont07bITLT2c*n%+Cd#W`OqF)BZ1N2gZ<%P-S;}>mH_6sHR)Ysp zcr2xYiHasFnRwTX&&du_O<(s(zGwa~$4+Gv?<-L^4tgwU75A#5DAi5WF!7PXtD5|L zQgUi%sYW@S>@mtQl)>gSC=>!L46YqOn4@I6Aeu? zq7CT`CK{V)VxlcQ$3#;T%}ji1q9q41(cHu*CR(ULr+0~efbhUY6_p{7CneW(kyfgy zwTU(gdA_TB%%awao36cy4kmh-=xL&(iO)=QGSOLae$h3)8|UnJ1h|WdAG=C76J1SA z>nbcXT6Z%}sB*Du{6nLciQXpqndqAZm^2AOfLA?6n7+%48>h>4*lCYhLQVwj2HCdQf=XJUj2ntHT}F(yWu&_~2SVMek0 zgczCBO%`+$W=gz~n21?8#+#U6Vtuzbw*XHTPvkc2E?+9hQ8Y?0VVSVGp~k{6VJel_ z#9thR3dK&v;;2DgI&Jq@H^v{rl!-LmlHtxoU?McJ%*6L5A`=-Cb4<)NF-1w6Zej*k zpPpZk=PQ%bOb}ASJ4)J2#WTyqYP$&+f^;@! z1K7rRWn#M-=e=y-Q-T7q#m4rOB|T-AiQOjlnb^-r0_>stDLG`=-c$ZlqaQGF(8Lky zY2uIxZqib{gr_DCE6xJFVhwpzxuQatIqigrlXQLyy)2wEaoWTS7GAV)#>80@1uYb^ z@UMw;CURNGZQ;C$3ykyhZ3a>kmy}qhYsf}64+39S)hSB&RTI}tTsHv=Kdaox3rED+ zeyG4=#lVbzc`W3$aI1y<7H+YSWg**wSaDXvgcV;kxSf+$9O0=dVToZ0S}8|09q1+b zED+w_JD${S7H+ptz=|i%>Vv&wgSh=;s}{CU#KPkio}gq4cUpMB!h;s>vT(PB`z+jV zp{Rv>EX?XHRQ1E&Qq01=7LpCnt+!0-EpI;(|7XYT%wzsE-LJicmVd}X2@8){c$gCI zOdjkl#jW^!897DR|NdLLn-Lq2Jtq=ly~JVW9`$)_wZ+f^xrGnn_emVC00 zl(z7!h370hZ(-{7R5Qi!mAeErA;i9u~62+ z>lVsec+Eo9`mrg>S>Vv7$__NAkGx^wO$!w)RJ5?Jk1!hpFCuSQc-z7|%GC0?u&^T+ zi#Due;f2qofug)`p|XXKDA~dX7Cy94#fp=4FoP5MnLV}Z=aN#K)htw3O*Jg6R1~IM zpun1H2r}2Qz~?YoeWk92dKOw)Xl(A+{p3ymx^w$Ow|?kmh8T)l4`${6k_ zrzzcXQ&ux2jVVVc@DmFyEPQIArG?M?3X`6-ZkL?YH*Q+kH;&|6`$`)NZ7p=-&=%TR zxYk$NTj;>muaIO84RUr=Yr&((45Xha;Y7Mv=t`CPNe|W9%>vExRzKbdNq4pML~b~C zZwr06rWWQ=2Mc{IOtkQ&g?<+LTNq|xxP<{q$RG<}C}bch{bKb7TNt7!LoHB}~1a|2kOJ?DH?<5P8 zDcQml`hx}Cf@8t8U|29MSQczG1aE-L^p}qPWlDcpt-4?7FP>^jTL>)p79JfSDZ0Uc z*sEjsQ1VKVWS0RFa)JXSqVNGiWU7T}s^e@0rz<#1!5J3#{B5R!@d7C!b1ckNt(yl3 zQ#cf+)(jM0ZF!IJhZ=5;g|!SF*Rub#aC~5F|8!e$G5mD*b@Y_+h%!cGf(0Ju$w-LCfRKis5);<&*JDARW^PXfKMR? zEL>+SwQ-*f*vMt$b{hq3{%v-AoS$--(15)P+9+h>P8)aGC~U`bxxQw~eAU?y*tK#xsNCyU?bCV}V@<%cQ}=2fyY= zAsdfVnvI8TFr9UA8zpS)8XVs^F$LwN!STZMM(8-2>eL%cFn-c@4}scho|8z0)JVl$78Y)B?24voEnHygY-^6p~Z zP^o64x{bO@6c4a-3N>uhWVxEXeyG$^qH5cyWAi)Iu?1L&kgc8_=e;Q~Od8r~WTUl> zHZ~fQXrnn-+(uIy&DdR;g@ZDk;`ixPKCS@Tf%cugelZ>}9(Z-jm;{*ja z43|kZ@{JG{-H!8FO}6>{IMEbjnmf`B#b7E(A&w2##$wvphG)aKG1bO28z~!U8yO`w zpprHsR+;JLK&%5p1n+s~JsRJwu}q;;jriZJr`woqV~*-LgDX2iX4;r#^TTJtLgu+P zzOu2v#@9CH+3`IUQ={;A?tIn7y(wp*s{S-W7TIX&Cs~+M^;;WDY^+pGOKp5-<9i#+ zRdtySW~aQN4--_bP()ULV060qYn{rhvhkyhpKScB7=E$&6|LBrZyg!y#!2zdqt!Nk z=ZqXwcJPOdKN+$dBpj@elo`v9sdYos%NMSAlmM`y09wbBI>$5`+Z^2P#EBEHj*4$(vq#4d0SY)wr!NH^5T}I+i%?Vp+~weI2X`n1 zNW9aDvr7>vss^P##T=%NmwRr&YuUW=-m993JfM)`4oWz9P~i_bal&vq&%;ja&+N|f zh=WHRJm$o4jIsK0@*K#{H85$6mM6!9rKE$W9K7P-RR^UUJni6F2hUMqCytY}PiY79 zUyYI9M$6&R^1Oo=l)^8oL0{zD$HaDi$%!v6EPT+xDzEHi9F%oX-oYCVUUTs97%AuA zb(S&0gyF1`t-%=SIY!=e@Roy$4k|fVI7Z%fz|RD{qvUTG6W=^naBy*qFq1H^JMStw zGr_*+pdSCl9xMER_5%kWIvDF<9Q!)>$U#R3pE;=Npc?1yps9oE4r(~4@1TK$nht6? zs7nbBYCCZnt2$2n3#-Q1*ltX7!K5Noug_RXjg9r>Vl`CbHd1pxpGO)yOw}lR6@N1} z(dG`?sMh8VK5@`O*^M?YGA{P0Pq~N=lk7<=2j|t}O%B9rTjdG7Dz&3Z)bl~0&`Z)O9 zL0>LS z4!&~my@TZr=5Z+M%`fFFB#A|A&x)qn}cW zopx}>!C88vgL7PzQpu!?a}(t}ecQox2NxJ3*u;sS%D&{_vV;HF(ZN+R@Y@Zgk|ip| zUP^?o?DAD5xUnbaRxp=>MZb(!B#(={E^cv=<;K6H5-#`-@H4jy3#%;TDfgvN&TVV6 z2d#)d0-oa{pNm^viB2ixqOi;Jo>Iic zyf5VrmuYHbuNwVs7e!qRUY`9dM|V-o#p5nEO_FJ9}~riI;Xk1{Ml=&gFRodEUhfE}oyv_weOKmq!w$=VTcD=GM{f^TZ^d@H;7z>UAKyvWCgw6lxee!Q|Dxv1)*lZVb8s=27{VxNos zE^4@_>B4s5xTxi#wu>$8GN40SQg#c-v=dP`0zhN8ASXUCkQT#R<{rHe@}#<&>kVgi?y#<%%XMaEG#TgW`# z#Y|iF+j6@jFFVrOkR`}jf=G| zesS@ui{I&ZL{jpbiybMskc!7$t@`pIQogj5PRpP4_Oy&m$4%>8{Kd#m^KuGl*^`!H zfxI0^n;>o-9!L<#CKsD2&Bab`a~E4(Y*zyR4CGoM+Zc#Kc_);AToAHXk5I;kvWszp z``X1`#XLWh4WXP0<&j9Jhmsx+xj5`1$3s33M_e3r@gKLXi(@X1 zyExvJd!<;T#2M)Myh9|OC}!uUq&Yv7hGI)ao&ZQky9DDe~SF9 zT3??c9jC}8I=~cJJ4G(j0j9*guDZD9B9Di>9^n`KpB9VlHciG&lV#K7RuB0--0R^!54U-^ z-NPLo?(|T=LqQLPJrwb)1~kX zd2vR}!%|^}6jM4hRh0WZJm8^(hetd-=;0v`4|^!?;j7W!!xDGteEl?wes+hhpHZ)_VA2{@*dvsP};+@9$xbB zvWMrC4lj6kQ6bMOSYej*RucZ4B}WwUiiffuUZVkL%d3dq>>V{OH~`rk#{{9b7bKh zsqEnc4WT6MNv}^QH29=`>&3 ztLmot($T~0`O-l_GJK}!&p64P1=7VsR}Z)N$nw$6Lw659cv$J7hlidXTo0ayULJaT z80BHKhdv%Y_b|}IAP;>#^z+c)!vH$N0;#wlo@o;W$1ad>7RdGm@`Z=N9)@`s?%~=3 z8KQ=M{%aYkkUPGPyR`jUMsOg7k5u$A3LoQPtOuP-<6)eK@g637&^%1=Fi$aj>0zSc z->a&V6n@LXSY}ZL%P*7`3&r$cd9Xb=9==#8ixuUxDZfZsFA{rE%@98rg->eksMtl1s6-1#Zq%|+>2$ZhiTMJRTnLmnI2|&nCsyy z4`*)j%=R!x=~nogxL1j9WFAfZjriZld_{jp(HDAHsE_@QsIWJuFcS%N4_! zZ-keC2fvjMzK!K9^YFcgpg7XTs-`$B(L@Gn}^jN{`9cML)|6vyN55A$owVphhpfz0O%6#p{my-XG@lYPtNmha{1?`6M-1MKVJl81xbS+uQ( zvy5yE{vJ+vIO*Xi1J3tyoGbOc98;S2`~H8U?@`DpZq?<|V|h$Gtr!X|mw!E+^Kjn7 z1+M#YS-e~}FPE!|hc8t=vLa@_?BPE~10T74T=8&~^HTSO*OZVNE2P^Bxvuc|c=E?G zdWFneA$b%}UIh=YkfJ}x8$ZO-51FRafce{ZXb6lr1MJQJF$29sJAj6l!}c| zNHHJx`gqt!aUb{jxZlSEJ|6TjXQlkIQqHcFLaXGpRq~J$(tDLuUln&Rp{kGgOy?3u zm`SVTS4BUuN**KSw#3#-c+y8nA20iO#m7@VO8I!s$MZg(_VJ95(mtN$jDC!zz4xOu z`%#7{e5QgVzMv$(!v_`#A8UJouB8{VC>Q zsi%-hKgkSLzr#g09E^z_lo$6iIryIRVwjs><{Eqzq4&wcdu(a%SJ_EMAqJ_h>GeHcCl z`S`-eC?BJJ4E8ZZF^o`<+l_LDDtwrN!xfyYtLg#;zxJ_EA>0LISnT5)AK&^|;$vD0(^FXL<2&w!6y8W-8J*n61s@lE zEcda(#||Gmef;2KrH{XTZ1S3`fw~FrPx*^Nl=8$WB+nYz;A11p2l8%- z1mR{MThv7U@v+s%HadwJXB~f`cal$X3a^QuvQmNV+{r&a1vvB}F4-D+aA<`*Ig8*L$l@EYEPVV(SU80{QsCdR zd@5Tc6+fG$oI6vvOXnLFo!pZ`u@oLi;lUK{P2oOjcs~Bn^J7(Te+s46#ZS)3 zSzdjRj*sa1eHj|9cnT#_cs7OSQg|d4oAI#}9#7#>g|qtJI(Z_6Cn+I?r&H**E>^6h zYJG|WsV}0E65D^RJfl<^x=u=`KuA4Vo=>4n3T0DxA%zzegR@RvO5x>H{FTff*2ya= zyqdy}b#W#%LUy6F*HS2#!s{vUlfJC7oGcZ?>+9sr6y8eV^A!4~@OBFCq)R7;_HD*nttRXW4c zEV?oAI`#Nz>Hj?`&HN>`l=5{IterxgRQ&nQZ~v05N=`jRr}8KMl7=ZXN}**6trW3w z3QbdJrtl^T-o9QwPN8`UpQ`F73i6c_J_K%|@J55<`0ys#_yM>S+N97qg)a0Qeg!^- z&r;}=Lc0{&6Im}ERF{qlCqK)qKeCwYg*)9^FU)k^l?#_b&lGy4;ujA2$oI$f(mjP9 zs^i~k6xk53Y;UghhWPn*pH%$jRl^O^FNOXoxG8uk3`k*M3S(0kM_Z-vMGC`Hd?JCt zDGW))pC`L9`rr+*+C!D_VPrd$O>ZBW!l)ERr!Xc3XM-%;5Wn-Ojm_pi#bn;OLHKs- z_!K6jFquQAFfoNM>Bju{Zz_HZi*F+r+9- zwiNzJVO9#WQ}{iFKWNVs=BBVbg%wKRS1Ej*!a{}5OJRNr3lv`DZ{dFAv++eKEKcEj zMf`^D&G?{jerUMV-|-7POL!GX;X6gF{)}-*aYNE`w3R$n!AnS}5}3TIRk@skQUrQm4=`H|nV3i&sM zb19rxI5{uS6?-PxdShyr8T?boHw(AU!W9O8hW9DRnu2R7T<6xyplt?7BUc)iLR=1! zJB>VP%uVB~H1ei#OB$uqcs7l!G!kh%md4|0JpEE4nZ|8t+@8keC$h5@lr(Y_l21X> zZ%re=!l@Oj@BWr7kj9;9+?59Lf(jN=uy7hh6mo}xY#r7dcc*c*4T`04ZyH6@xF?O= ze?pF-O(;(%6G}!cz!XHe>UPK}(5363z_N)?VJfd13Rj|V*VIjkS z?OB_4XFZX|^Lw(MOyj>($*0dGODYLZai(XIr3h8^83oBe;m?sjjp=F3NaKYx?%t3! zER8GMrlWRoI>Sn_R^2e!(aTcuSR^|wl=t>jjdbdGX*;-qjgryUDDvhDYknWJ!t%GG9ZnfYTVvw^hu+a!f8qJ(3qd6 z(Kn5LH%)qdtMpHUbTSm#CNy%BZ89*8L1}!E#^5xDq%mci3{~S&Lho%dW}B?sChU^` z9~qv;h%`oW1=ARvMv89#PfQ<^#)LE`s_Iw;$E7h|A@?eVFBR@8I7z|DT%esR>Qku*-EagqTxU*aeYyHk$SGe68erXYzM ze~Y6{rwfS)Bm$E{*eyqPt=}30ci|I^JlP zIN4n?XqQ}OaHC7_k}C>cRgl$dX98-W zV1WI*leg`WhxbU40CxoVFhG?6cLumC!1DoK2yl0Rq5&QbP&~jr0g45h<{azV&U!rt?PJ6Px*elNlAbd_iGQ1ez zr2uaRcq_om0bbz{0m=q2_R8$N@@jw|m8gIA%4-4ook*4o@a#VMR}o(iP(HxB`{J?Q zxQVd(c7S(S4e(xo3IRUbCk0_TWMom%YJ#?Ob*{K&Bzm=d4Nv>Y%HH`@0XwV%bA18^VxAu zo+8B)$M;Li0IdRi9-wc4)&bfC=pLX)fV>B!hL&v0B|aeS0uHtuL6t>FfKqQz?1;v1560u1@Hq*3~>3NG%b?QxI6shmjNaPn5=NZ^&e)FsMC1@ zm;tN+j)FF;C9}&N5<-@H4+(MiCNV{uACfc`IG44hSoX}e2&n2IVF?uyDM*E<2ACFL zHob*I9FpnufvL%M`LkyP_-K8SWoCd`3MVtGuRWaIqF`cnPC~yoF)zUU0Kd_@0xSsd zb%0g$ZHhW13j;h@FtH@SB3=RloLLyhu9b)68-;%x;O|31;?e-$1y~l~`v5Bf{19OI z&2s9Hu;e`)mz9cmgL3y_`6<+Lez}^7+7;274p(2TLTeB8k z%G%G(n>)Myp=9+Va)6hB08R2?S>XiBp_};80LKDc4RDS7^oWc*BF6)q2yimMsQ~{4 zc;l#?rWpgA4{#yC*#Q3rn0`dgDY)`TJhlA_lE`wA)2ELyN*|4@WFUO*&r!K>G)@;u({<|(n zCq%vw`H#s%$K=Ih@_WTZ^<&cdnA{p-z%j`mqS@)J+rl`Q+^(Q~Olt1VDior}hO8$- zJQ<>}!i$8sBgCB{?g~*{QOIz2i2D^@RKa_0(u;+-H^hA*RvZ(u?NRW7o2?Iqcu3(7 z-=qxklO=BAkA!&iCjMB6#}%IMcr2%6h^IoBA*>LkLOdO!ZHRUuo(WMpMCA}4gm^Z@ zb0OXi`2ql*5Ai~XvLRjz!5fbkL%b5A+;Pz#PP`O?@MQ%#_m0Qq)evQr1&EVkAD40= zXwNr7ydL82XR^yH$R^@%D$chQY*r?I*Qi2>iXq+$@qUOI$FnMNjwj@!yoq;1{CQlG zCxozcCRu4#^6eAS@PvFAqDqK{AsU7FC`8o|)k0Jc(dC5PcRZ`yrmQbd$Q<@MAvHqO z3{fjY?GW|Vh;_nvOV$lhF9bK>t`l*&u`5|^pm^>$8PB3|h$bPLhxmjBIVp`#O4ASn zPs*y3(u{11lQ=mKpOkw}NegOqN^vb$=%dewh75h`}Mg3^6IhkPt&d zj0rI|#IO*e?*L)K?KepX&REAO6_kI%~VH?k+5$g(Lg#P1>g z2;qkCxHm&A4B>}Jg~)`M5+WTU2oZ*eIN!4}^{lKqE62`C_P_G_zf$#I>31qQl~WEe zosJZu{l7BmUrGHdKm02*L(B>>FGPuRGFz#a>zvFDF-PIY{*CAL)lE9_7tYCiZh>>M zKoN;73b8oE$`Gr#G$Fp_4h```h$SJGa@Ees=yS5BF|TyV??NmK@qLH}=VZC+PK5VY zgp|DCoUD5yu~p$ehWIJOZy{DQK%JLj=jEC6@-r9uy!@izuiTOa6Rg%dFQd*2cVgze z{7HWZu`k5_5NkuM3$ZQ4KOz1Ku|CA+5L>tk)Zx73T#$P&$i@(VlYU+{(dTbMR=09% zU*O>sX>~zL7E4I6#P$$7LhPXfF#apetqbza1=$s1Hy!3etUn8pwHIX8gV_Zx%F`F+ zK!}5s9O86{Lm>`_I1=J$hz~DHvx_qLqG%Uo`bAlDQI1jPi*h`~i4d1AigzW8ry42*C+1R}f>p+baQ5pqYkJ3`S2c_QSEkUzq05pIc)6+t58MEL1M z@|(94i3sg3$!mAO=kdu-l zJQ<;6go61K+GV*v!ivlCK!gV)JQU&K2-+KXJVNmZB_cc$;Ze?_J@%JKvRH4#t%Q#} zl6)+}xywT06Vc7qcal#7z*v8+EPB%hA(OoW%!#7lGB|Agg*2+u}%jy5Tfc;-JL zd|p|A$cqselV4Ks&Hv)~{EF&Z@3{m`S2n_H5nhi_o(B9+%F(2^Cwf!hIeFso#J;-| zZ$x9->f`Wr0^Aa?244XBF(Qz6{X%s5voSWT#;&2>581Xl=XR$1d*B%YDH)ep<#sD zl@eR8NbLw0ugGnOv+B?R4rkR>upW(hRq889;_TZJ|LsmzxhhRqA~cQABSOyz%{W$s zHWAuJXddB{2z}0G&A2KpB77R5`&Ai#Rm$$l>iTC^%Ls%ltrXH)K{mCEa8JI((?t^7 zE@ick&>=#{2%kmh9H9%B=0xmNofMG>t4prNJFdfH**H)HR-GPiSUWRm}~OfnK@q-)FfGFL2!kUGi7+w3 zm-O}s!y*iiFe1W~YqIH??58$o^*E3Yce{*mB*sLiWJO5s8c?1>^77;nl<9ztkT!z{p&I#!psQkBK#F$ zR)pCR=0unqq2+a{kuR|W*?q6eSJdRXd>dg&goW2-o`UluEKp;8%__Y#!r}I%aC(`b4SiWu7yH~AC7S3CcYjy$0M9z*vX)D1}7t&ijXgZTQfKv;Y@@?2FVOQ zE1x(Up=_DN`3V22d7V@6B$F}ICfvV_u}bGWnb<=vEBwC*R~Y{zTw}D)Aa@4W8S``H zuz=NE@x)nfAZ%h`HLsFzi-K7S-k_filGpCae)G;mb_Q*lCM1I#g%Dr;67pwoTLuqh z@Nfonq1!XyPPr$80vQy{pil;dGkEiS*4+vgQE*RoOt~Y2J5`nVU1~TYMHQuNu6TA; za^)1u;9k{qUk0q+uON{JGI&tYiBt0yxpInU@Yt2CM>FV^E2o5lk0>}bSI)9rIge%V zcm_{oK>SGsOJ;CDH9eIpR2CruDd6=Cx*0UcprLB5mqC4n+}J_?x8oXR;yu+^HQm@> zY-&dPXYh$4HqXTSmpnJNCt-^WKE26Lt=QB`Ra+}a3VGUPFm^*$mkhdQ&_06>8FZw> zXV58w&cxSe@!yv6e`Zz8lf!4WP4ndJ$de#{w+y<|pZRCj6!gfTX9hbm*vYldpmzp? zGWbF{M&CR+eKN4~@rQ3`I&0?XJ8#$~W+Ll$vDa*oenf}%XPF^iN* z8BET=qE?EiWuRwZWbn>g2{P|dz06E3iiH$**_;I@12==cib8sxM4VFodJa+-QC^YUD6GLh#;YYfCwU?2!eooW_D&aW@qCgDUB#dmx6#2 z(hY*b|IAtE_y0c6ectE2?>*<-zB@ZRyZb-bexrwj^F6@rDcHf=Dh0bzkUKrqN>6;# z@1JzU*Mw6x+P94Mq~Kr*4y9mk3ik0rO>ehne+mwy;7C>PQjkGG4Fxq7WK@tzK~4p^6eKIitRSm`Yzn?|Qx*l6-1J>7 zFNZqrrsr;c9%B>)eg1idy@m@aV;un;bb-dgK_Nw8bHXh2a zpn!sc3jEhyg%lKLM+Jo?TSP%o1;rHmZXqW&;FKUG6_iy_PQe5Zl@cs1SVoY|$}6a# zV5x_yD5$8Ql7h;TWo4^}7%zIr>!o^Ls;Z!x6jfKi*`Sw(dTG9wYAL9#V55Rf3iz{| zItrR9Xr`cLZFgO^R8U`d0|ocI)R6gg*U*cuMhY4$I8oEhoRuaDm^`fMZmyt(f@uog zWlIIE6b$33QP5gJ8wCRu3{ucmK|2Lq6?Ef~Ponl*T@vvRvUX6=k-LyYofLFY?ALMT zokdCP4$e+bqE$(>HHo?_=%Jvef?i_TS3y4oy%qFP@NXk`u1hXX?HjrKOKI{13=lmL zhYbcR7{YDlQeFUuJU=JV%_Mq@=t_QfL86*O?TAJw7^z^Kg7FGQDHyF_jDoQeZ~)OF zA|KIVqCd#q>~DxBD43{Vl7h*+5;9Pg47T1O15M!p$v_7)&|Oj9kqA=-{TXOFFBkmj#|q{vSfIenNQX1h)r>@$s6-}enu+q1@ea>Ki+J5C_*B6Xt|AjH%|wSX*^TUz z&wVcw1}Z-zq4S*^aP|*Is7onwh@gdCyGixsQ_lE;H@UOy@Jxqs+8fv5ygc zq2!m;?-XoNkfK0Q_^Uwn#n{{o;51W`&rvvQ@DAeksQ6MvKtYff!EOb66!4=O`*@vaAts#m@`in8ll|NyDOHngn-|Hrk&GV| z{47iHu!7CW_(?{azZ=4z;Ij?iwEsoHF$E_ToZ|J6g)ZLk99J-%+$VUuDQHm1y*vx? zrQm6v{cP?nS%~l0pHXm@cbV5tr|-KiDEL*uEd{p~{HEZdf}0BdQt)FI;uGT%KS+~> zepk@^oa?fJD?+XcUQ_Ug5H9*tL6)q`g zrDA?ox~Jfkf`1g;SMWf=Lj{j`#O``tDtN5miGpVeo-24Nz2=3{dN?>SVVf5U{ubke z&I%W`lG1;<%?i?}wk6*Ic*Cb(Q#TV%5Rw0*XJb}-rKM9*fe${_el{k(3YQAE3Xck} ziX;`OS?Nkv%AL-eKiOWZovwSfcl4&sM)|T)i){8)86W1ER3xj&tRjnw+A8X($f_cn zin1!osTh)tva2YqqKt|hDsrmGr6M;g*{N}M%A+E$isC9Rb4(TaRTNTDSj9WpsDO%s zLYQxp#H5IdqAH3BvdCU6GCmhlLPbdxrBtvPr{wI!iA#HDr!m=SesK zso0;L&S$5)*(rApDxZTYtEi%)s*1)rXjBfGo`b4!!*WpbJ)Y_+YN)8GVto$cv`bPg z6-+o=S4BM)!&D4cQC~#^6xoQ1A&xPDnKdn2K_4~@w~6I4u8F-gUoJTzIw@)qtd z^U&5jbTSX|4WHz^lq;XROUCT!~^V7HaXub-@1%h0< zh}Ug?>Xx5A|73QSns8GZn91x{@k*PUWYsRjgI9PQ^F8(p2nLu}8%QZVaE#Dohm{RcunB zs8CgGR`H#REhfZR`ySawEekEEU^SY*!Ic5mgaW5$Dx@*VCc^^)Ensp18&r zpj6&08QdER(3}GFy^5_ogTgt&4i!7uUd0b8o|j7Ma^ICV+57!X7r#J<3ebfD^soT! zRk2USuPT1yov7k~ijyi%abHv%Qt_jT!zxxc@n$SYB@0r^f;6Zg{iNb3&ul^ZS;Y|^ z_EYwda$@p}ieoB{^8gm46Ef_qGv~zQw2Ct-&Z;;k`!2$v>e>g|!$R((1?g%*If3Q?^>bVcG{<@4>C>kmOD?F-R$Ugw4ALLs}x z8!B$9_=}giirXrDh3K%?J-ZO`?P4bTBzsTAeH9N>JXG;mymA+&#)XMLvF%*M`-t~! zVVYc+9;%-qFUh;9x7wSH|;sb#Xnbz*Sb-n+pc&!3H{^~AD z7WbmKm+_5?3FGa=LDKr{TZ=BA&EFDCCz#%6-;LxVPHs^+TX3}}$p^k%`LZzeDDNR3 z7&G{gQAj31R+4?lEIf-~R!7g~Lw1Mf5Ry|cmtbxm_&-zFJ)aNxeJJ2VK_6m;smMJK zzYBQ!*wr_!w~!CrGP|q$P}qkeJ{0w#ZL+tV59NI*=0kDGmhhppkdlI>1ljE1QCAt^ zWgX>kVPd_4WGf3+^r4cF&SUM!oT^B+s$exAI0%bZ3sVgr7;E}a%ZF!$skUU3iV%zS ze5mikc^@wL(7=a=K78)OavvJ`(AbA*KD^6aD?)t1)`TbSxTmQP&3tI?Lkl1J`Ox2o zmOixdp`#C-d}!?hhIlx&71G9sd_8TYon+e!b`UHedS~HXd7ymgB0OQwF5P*Yedy^# z=;cFi9%u35(mrC`R}@|hth3_)9|rm`Mv4Xr4)I~A4}*oX7n{B9@R2?Y^I^EGmJuQ* zg0LBF4~O%3XZtWm$V?w*3Hd;fi<*tYTp#B7u+WD^K71(pe5dpyA3k_B-wkK77l&;G$=h z537B+ciQ!(4`2DPM))^^Ukk1kTqjtg2(cxn^*mz2`Jqj|uCBAe!;;6qRb{FDzNA50(i`moQ3un(3G z-}|uDhlmf4icnlIDi{;wxnP}BD(_ZNw)wE#hn+s`@?nRBP3UaH#y^P7ZXfnIrK~3m z*m%DW2Yfi{!!Nwo#PYBYKlyOThaV*r+a&Cn{OrRK$tINltL2!8Cj^g6Eo{K)q$upj zmZzQ8@?G3>d}coI@RQ-(Jbowjs}H~NPSnv~=ie^CB_0qBVGVq(`#W!E4UIHh<{9TL z@53KHx>x?86fuZt}46B>HgQ2X|4bSd>~6rCWT~Nq6q} zaF<(n(=)!R_sli>hS zxew2a(hJ_0b=*v@*7Cmcp?WcUw3CZb(PH%4hc|p~Ye=sF8q#P;tKlsTy^GPfVzgW= zgT?4@F}hfcY9xDI8r&K(YsjL(!+kH~B@G!gcs2WFB8lDQMUye3D9M7E1RqGWG{vc4 zamuQpVR8DYIGrZG-7P~nm^vLr1m zNoz_{X$@sG)X-2wG?dp+K|_>F3wke>qzsQ;k4sWT4c$snRqkUcs-&T^hAP~c zQpDLhg4HyPE=AQfaGFz!nAg%!TSI*f4K({hqLroWH}Z8f@H?Zr8tMtrOA%-9mZE%h zyq?ljsx&p$&_u%`4U082)zC~sUk&{8)Ry`jn=J z*F0@C%qmU%x#8`0-gYvQOH11$*-=9$4c#^L(9l`K#?o}OH1XrF-Q`c*e^RXZvdypkcCxDH;Z97^GnokAQ|s#oZOk&|nQi zB-&67eag@<;cp8zDPuQjxP}oLMrxQ*hL)Ehr3~#YLt`|YD?`1?(wMR|R>L?A_sh_D z4U>3M%F+Z46L}?+CFYzs2$wQ>N5fPN?`xQ;VVZ__HSD_YDO<%oohLM_m*1hh#}j(a z)9ajv`3$ZxH!UhlUzep>JX0FxYWRQ~)5yKJh<7#z`ODtsk+L*T!-2B&iG~j~aF)|Y zLOvFpFStN(#8@v|E);wA<(n#>YFMV>a}7&0e5QdvC0xqWddxLTzM#rvxrQ$^Y|!wn zh7}rCYFMM;YYnS3tk&?QhOhVxdCS``ulrJ2;z!w^lqKHp9Gow))@oR%;TsL>HMq)A z>2k#PvH502?Q-@V^`BRII+ml28a8QAG^iRjYxqvX77Zyf{v*p#yBzMd^X%k<;;3i4@EwADqlT4Tyu5RH zne5T9mv^p)pET^#u%Aa*!$IDC55dnqxYJI>%8y|d2VR9E99oeKW<|yw=~@5jV8QjMdHNbJi&V+-WOCwxm}SS z@qtr`($w*0tYr7%sfK47a_Pve>2##m;o>449vxmCHHUcjRiYb} zh%u=$Rj6!Z=gP#7OOcLwLNe({){#|5HXUm!Q)V3xntIPvrg&w_qT3&YHOlHuTZOXg z7+8h)eSNMfltV{O-F`KxP{r<79vyjgl+saJM?M|-brjZ7L`MM~GpdkTg|L?_MIeYD`Li~M=(^aUbj$%5BbDNubOXw&mg!zjq#K@Lqbd=RmPDgniC8|=bs?@eB zy;GIeSEbad^r|Y=Eaa`Eqq2?;Iy&m8qNA#g);ikgsHP)FHL9nhK1ZlV)dg$lNGj#7 zsiT&T+B)h;Uj|g8x;mOwv)jgeS~Xfo?gl!V==i!CHPq2aM`N*M11{pkq$#`T;3r9% z3$_s4UyWJ{VZD`(->MOlwmg`Xz4@yXU#sxV-gY|L>-Oi!oV?Ykla9_hy6EW2vsRt> zmEu+dcf0CT?6GHIb?T<0yN(_@Sm~+byT4qK>cqU4@ZN%b1p5j;s7`D%fTxUCl#YLN z4AL=J#~~d*>KLM9D0f81Fb9YYmwG&e#&JyuO%HLb&S$6Q^zbFqjikY zF-6BaI>zc4r(=@NKip*BH+ZWCjn`4I1~sff6Lc_66y%ZNH@~0Ppv^Vx@tmq-8ZQPN z@9TJ1#&CNL`?ZyC98K5p9>iAU0 z5?S{>_jEYtD1j#WBV>sYSi3mq$Ttklt}g}nmbt4YUqc-GgXXiYj? z)9%riI=DZzpMTa83Dq|b>iduG!Ot|s74uiM6j-Yhe&+GGjH=A)c znS^whI>J0G8QqDFGvVI>=EUw%9Wfn0=-AC+b)@RprenKA_?|b*CD&Hn{=aGdXI@VH zGsru1?9{f)4`89{l?q;57%)W=lB}F zHl5IMQpYI~SwAD>G|%8KF3z6ij<@nK;pUy^wegwzf*_M$g>Zu}@&xJlUB_h|SH+!= zPDcwrQCcdJ7iD!bpUL*Le+b@I2ck99oJ@sww05(YK$KI3zv zk(UYM-#YjUeatsx^uE-Qy{Vhi_B!;hj@LRy7#L~bjSd*7X`q&YGzQWda2xO#c*{UK z1L+O84EsP{UekTF4&|?FFPOS@i68#&R+sp(rz8XA4OHOgpA2L$P{=@G11HjW$JC{a z1~M5)HjvpsZUcD?WHFG{u=h(2!EA!r1-oUjzpchaoN^k-CE|j%?#@||S9k%(ET4h= z4rk+n!kKV{W#4#;7${*tZ{}uR)UcIeg2fHYuS=XQX`qyW($cANf@KVpHL$KO?XOGc z>(aBj#GU1Cma0b;xr3$Ll?~LcN0kKI*P|*1sv4+fU~oO+RKq}Z;j4>y5(<;r2I?5- zWT3Nwx(4bQXl9_ffr<5~zJbQv=6dvTJ!)W}p@BvQnDdtwxl$%g476f$!_PE7hki2D%#P zVek*%p__r>*Io6idRNt_?yT3Rx%G*W09nYZL?okFt8%X7b z85m<=tbtDqEHp6Az<2}i8JJ;U0uPsgcMVMEDQiHJ3^Zs!{Aku>15*sVV_>R*U3I+E z1iMbMIe%Km$ohe7Zhn%VpB~>)+x@#EChl1m_|qT-3j{XJrF28xX$*TV(Ka3s}pG$H1osmKa!RV3mQ- z47}dpDbkRdG^9ffXeqBi1D_jM&V#`Ft0Ap0!1|>Ib}45$G2!nlyxovi^V;B+G_)t; z>xT4|0me0qLi`Phv)>q4Z@_OLU|@rRZw=ge>AKjEHX7JuKrx`o!rp9Pix3X=9orxE z_S^1FaTMl0iK+2^5pr09vuH?4WZ$%K2YLTCBFjLC=VGUalW8FA@V^^U#6XnSc_Tuy zHzp+RWLey5V4H!f2L3Rx-M|h5#|#`du#+dwz&-=}4g6qWw}Cwd_8REeh%Q(6zN+LM z(TMm-{#lJ^Wh1)Zhz=MyXyB-UUwDY_yABx`*qDAYP^>ZiD0tXFlg7kZ?(fgi%_D*{ z8q>1Iw7D^DYfP6L(+LA74O}qrEAJfxrwyDlaNfWf4p@bXHKDV7`ZckG3~oZ3n$U|v z_Dk)7CUmh0{bt~zflCH{m&lKs@P~um4sfoley z8F+5sx`7)8?i+Yu;HH7U4BRqsTjKO?N>iH>KQ8j7qW6x0%}r@Uc!F1wpugF+tNL-fwy}zdST#i?u8%e{CH{L726y5 zmp587TGWizH=|?C=(T}G&s^IddEm#N&FGC`BgaYOw-5ZZf;r?WCA}XmKiqzJ{CLyM z{s1ChbE?*yMmMK9&B^P>%I1{)tSiY6@`K5|<1WTbekA)*DS*lWWcDMAA2Ag+5O1vM;t2O{(p*Gq9>5EdHu*I$_78GclG2KTrF6@kAi*_@}saH zMf~XNM?XJ``cce}rhYW@qqrX>{HW?jH9t!FQOb|` zd=tD(DoSZ($EK2yP;=sTx^! z*|n_bZ(~Ez8#|?qgw$_g$8W;3w(Y<6H20&OAMO2U;YUlcX(iZ3u(coWhzonQ6=kMm zJNVJnk8XZ+^rMp>ou#OYAY0OMJNT*=)LoRGe)JO3!;e@C+7|Klb}ak&!C5xu^ivD! z@5cZ?-t%LI9|QduBxd6U2m3MHj}d+h@nfhcZwn6dhiUunk{L99~1qU1Z%M&f>ngq$#$_~hBz8?#u=!1{{ zo0qDsXptX_{rJp}rG9)WrEIxG$g(BwHsZU?kI(&BF5)mzK5j*=yLmP`kyl93O2Jir z9Cq|CMfpl_jo{aUYX#T&@r@tX#dy6a%yY^1+2qG&KQ8-m#g7{UJ>U7E@{;yri)2|z z@k0^5w3>&roHRe;JdA$mei%~Z_rsD+$E5)wLD54zR+8l-A}qwynj%7?jvnKU*4jQv zzV~CR9~XH6@GA0SyB`O|W``d;{n#%7cL{PW`~3KU?R#OjqwMixufxZ6vD?WFJ|GI4 zarTfz`%&<)A3yo=vmZzNIOE4zKaTqG3-41uPWf@nkK=xv5X)QXJS|((P-)>D!PBC1 zOipV>Ip@cDK1tfxy}01VuVV0&*#OD~z}fPGY{?=wqoOp1vsD798bIv;>I6_N zfN`CZI8_hW3n0O3h*(pwmLPl84WOP(Zo2^L2hbpZrU87~#naG<&?JCH0W@~J*d-B- zBQz7s=7Q|fB7l~{TRBQ=A#DWP3TEtz_5pN|8aoPh66C|7v-FEQ$W?R;pnCw(orvv3 zj{tfGP+=P?ZnKMe1@N7TEhc&g&?kVt0rU%CWe}@^=pVp<0DcePasUGZ_D}h(4`4$8 zg8~>Fz>oljO7PDa0~i*-Y_=bT;Q$oM+;yDk7@v`0(iR5^_Adi z9@4aS_R9eNOlv3RYov(D*8!{*zRpp;5yEDCne=S{ewh*G8w1!Bu*JuxKt_Y?G zavOL(sKR}MnxHPojz$1xTVfL6UAfy83?Re`mj;j;!1n>v&F!%SV}cRED4!AoFfzA? zOXH$&c549J0yrGNPXTP_!=Wwh15%342`d1UKm`FPoi`ER)k>b4HNsJuf0sIxfEe;aEod6z*csGE1ym791?+bEF<}5x4;Grm++Yu+$ zAB+7HLC&)HJb)LHT^_{W0lW;LO%QE^coo1ue0BvmJu{0^ z1!uDcku8YqlFcPHIfBS3myPp&;@J;i~foQGn}}1{9Pa>{VDu5vK}PiUmh{{2f6N3stR228}{}Y6}!=VzG=m=xAAgYTC z^F(Qa)D%ZHuH}qCT`{X4L<1r9q}go1sbLVUL~JBpje}?sMAIOe1<^wE=1wyb_FPd* z(GxYc{-4rzL9`EIUJxG!(IJSAK@1OKgcx@UqK6O;(pg9s!LEYc1iMRXIc(1$dIiy2 z#D09>2hm43k9l8dId^kF5Cf&^w*?0UF(ingK@4^b*qB2l288)Ar=8441~EzkCb}>> zh$%t56U3Mx#){dvASNb)^FN6PF~O;wqfHW>dokG=TMjr?3}yx~Er@r;V7lN8!T0{h z@_nb?SwcPtVz!VuLCh7xk+~K|ZrewqED_{dK9*?nCA%PqPl8w&#G)V;2l1&Cu?w4V z`oCU(=EPho2FnCL7i1egRKEx!(vDUHaqb^a_Do5ugZPpsF@z2wd==zBbij>{^zjd_ zuY*|2+cSi`A*>66{|jti5c`AphBtDrr1iY@KJ{z};@coL2C*rKXb`a=HuK7#?(qeo z1@T=FTcq9;Ui|H;S9`kHj+7u&-sbIz6E|BA!U!VF11?!V*S^>j6t93FXE}v}Fr6%W zS=@8NvtOn78CqH5C{1v+wD3NMCJ~3D2N|}I4qo7@{>b; zc1n)~aWsfur0P?G$E4`EAV)YMG)G&my z9Vz{EPmhk&IE2L=sYwV8^CdMEY$n)Ta2*@xzfsN8#GpW}svTg)lgTA;O0Wj^IWL874Sf+FY`e-R6;^ur!o(0iH-hQh-%d11a7qY~LY~PXyqKKC;yWQs6`jRt5{Gq;!$t3fFeik$ zA z#iD!~!V*bb%3+s@!Ix4yH~aGtmW$aJA*={trSR1ua5LCzmBeAk1Y!5D#GRG3eE5g3 zJA^$U`wTp_!}U!F>qFQO!nYwD>qNUk*cig55VrC1d(Shh6KxK`3?UrCcOh&EAteMB zIr&3SLQq5SiK2&KgrJ4MgiGg2N?5WI2q7qX$T3Kmv4IsrT#6!stVBbI3I9Kv)DXUR zO1BE(ineoSS0wG=O*B1eC-9#_8|uAf3+{8{jbBOVRm7j_i!cnBwi)L&v-o)pex;vN@A;DBdCILEug zM0XQ>*X6v-NPZI+Lim*r)wcAYlbwDG;bI7vLijy|%REPX*oJT=gsXgJa)eU$`^`T> zxGnt85Uz#n_oVL!a6N<@d?4@~g>Xwm*0XjdP7ONK*v|G_R8Dt7xEsPfUb^y*g9F|d zVQ@{mDfZb;eABU=jiWup#mlfnkZzVu!&kGYMUrxqNs_^ z0>M-&M>+aT6s>lr&M!M0pdXOq4cJmhW$Lp)w}+9&vGEW6mZxlL{s(ny6;t zeiy1_BDD)uHF2^FF{x~#iYV;DSw{Zv>FOpjbfwB&?QBgGoH}+TZblswbxpK2(auCY zX%Yu-Y2ux(RNq7c6Aeu?;-&RPQd1MngftdxBFNF2ix-m?CRk*`iS5tu|GAs?>u+np zHi9g+H?gWKbr8#K(w=8ssiO(TPJ*3HbTP5;zMCpMsNwBUWu0Pa^e8qkdfnwZ^<1_=)4T_d#*W#siHf6|)35heoN z=ra>bO^h@#%EV|BV@&(iXD(ZIq_HNZnwTbhoQd%!CUCuy<iNNj&!j4?~Y!h?Dl6hZwVVWnc`q0EjCO$SX z-^2px)Tg|_y3;2n7MWNqe4*(4qQ;4NBFl5MM0Bn*J!WH*>tD`cJEH-cQcUP#66^sSJMj=o9AX2D_I zDaC|h!rY4RR;VU?JX1wIN)(z2owsuYNf8(({3bpLV__Hp6G0RAco&!mv7?Eryv$65 zO;{!_o4CTe+eFmFVG}=@h?$6+*u#1yPpXOUIZk)_!NgV}%y*jDCVact>=5L!VtY=z zB+F*IO)zJ|;$9Q`L}z8chzA4@ipU0sO#CQA&74F1Y~qNCGbYZOILb3#(ZlJ4kY7w3 z6LQ?qH+Cm3J!#^UD5o9$QYYK-oMeA9abCy;6Tg~ZU-n8kUKIV3;O~Om04_RL-1AP? zq;1`a|5)lz6W2`KHu0B<>n3gpxn<&}w3+Q$XT05=I5FYGMR!cxWv}kUr3uRiCLWsh zP2;R#tjh1%Jra+2YA(ATn|Na4DQ{$6z$X4R;p#!p1^*U&A;@80@{*Ri*nku3uT8w+ zgDZ@TVIYh&VY?+sVLL+FFy0Cyop5$!dQi47vWJl)jElXICycyd7JB*t> zsD3v$^P@c|Ul{qr7!=0fFbafGFpRok)C;3f7=^>A9!8BYiiA-#jMY7cmE)_=UFv^8do`dwHGJ<6VoA;!?J!y7Nst^VfP6@(hmBOeTMwKwMp2Vq| zkg8!El`JdF|LjRGds2>GR5OgOJ>0bfYYWy9&+Xl7UVw zL&6wY(lb1a5n&7!&e^xa7$&@1FaG|8XJii>d7!q_HyR4^tO7fco8TD}*uRd7Xb+Ad^=;7&od*%ihQ4(H%| zh5snH&(ZgXaX|P%M>!M*8?*c2Fn$W-XVFgz9uYk1SpFj9nBeg+PB{7j8Ix0CaK|~$ z*)Yz9k=DXn7S4xpLBz*l{2In@d?HEqqT_oxj7!3Q7k7@32y#WltAc+B{wa7ZjO$_C z2;+)Wnx>CE9e;&!D~#J>a8K}#;9bE)@9rnK;6p)neB|`~iK9FX<5?KbCHq3~-!T3b z@>1}X;6H*Kp}aKUbr^3%fn|>Xr!*E?Nl`ir=`Fmr?8n|*7TgwcTF7OgT4#?(Fq;Lh zg(M4Pp>1amr%XaJSjgxoe0nDf&+I5!EWFc)vRe4853vhJ%P!G!2-=6gg*+CPT3BWw zuZ4Wv9t*84=?!b&M^CQ1uOZ!To36t%Q)T}T@qPYYu# zjJ43tLVF9nE%dR_!9qu|?{1-!kS-Rw3h8ViYd@;g&u(frQT{IOX)oCxlI>}smyqyv zHzzjhYoVWow=E3gWgta^EDW|Vz`{TaH&JOXLg*d6~!^pAOY z2kk7Uf&=Ii5f@olY+<4B`UC8~d}?6{uV+y@i85AjR}b6qa|_FP?OFKQ!WR}+SkNsP zJl7UhSy;zj7FLVz8o@7R7QPbB?kgqK*A~`_vPrV*Eo_kN77O26*l1z1Wckq}cHy*1 zvJ)@Z{5#?M22cub3Ja@?i^q4y5zLy+%bIA-Ch zg+DADw{XJ31q;7gIBDUOg>&M5+QJzNXPx-&K~!~+-C9n~2GMy(e|r%9X5k`_n1#zC z&KI*w7BnH1``Ip>u1M*@LG-7P8$1p|uJO(l!Zwe@_Qq;emyRV)n?w6CsZsud##asqn>vDL$B9Soqt*zoNXfz?1cl@K=Io2GiZaly!(* z5sw&Sl_B(okGLU(2+~Asl2(w(TM?v-AiZQ=5qKQkEu_T|;>2bYL52v1M=&CSMddsh zBPbR@@dz?S?6;Z85o8vfd6o#WMvyInLhU_yBe>ATCfOs%Aqw-H5#$n{+fnie=`e)y zMetr{52ySQ6mWP!E{&jY1VtRBXav`uxf7P}4xwd(JtZP&8$r7WN=8sBg3=ND+O=5( zPliyL2><;z%0*B~n85hgTO;BZ8Vj7V@z0 z<2qeDbtKzRu&!Xe2@1NLy7s{J;3j?I!0{l6hY?*xqGrEI40qK?I)&xjodre&e(#g2kdR|1^Rn!V@;EES2ms!OtUDF64`d zef^xcTwE2w>IgQ7{-xkIg6#Vh4~y`x1=l+IIwASrru9M+SBc*`r5lB8ieR&l?;PE} zKozb;phnN z&+HKQi*}xj#XVai{46oHN3bJ;oe><3;Fkz?MesueyCc{W0slx&{kLgPC(n$Mp1l$5 z)f`T1;$uF$_*jm@6-D{to~L|n z3waj7^9Wu<@HZc5#XWB#cq!yn1pf$`)dc?vc`e8`Ul;dWI_qKriNFTT(+Yn}khAHc z=qb8uIJu?48KUqA@d_phl3=zS_MyQkqhvD)CJXW&GM@=;WXqM|5O9KBK$m7_?+=Wj$-jiQs_#>PAtI9eDtws2{b@w`Nf^kD@^o4JF$sil#!isIibHg1o5{ z=L734qG%gMyC_;ZmaU>_?eI2H6dZ1!MeU>LAY#`jItuA5$oCUEIi!mazK6i}oVrEr zece6!-}~rZQrcgzw_qQ^zJmP(*^3Xi0Z|N;>>!?5A%mULAwq@KajEQ0_XC2G&LU;rw2$|?)6K$Rn{r@BLP83reuW8a3uH`*PnH9wh zhrcgmrqfdn^+6P~ol^Fi=kRZ$_%Mo(qWCz9`68~2Vu6rPqgW#36TyXoi=tR8WT4Cf zkLPDmEEk1qSt?{%6rVdv-4PzvzmV(-LGI})A*-YKGK#OFSR>hWPU+V|*lR5}Olo1y zZC)S61}XZM$HeK{Mo~5iZWjDbaEoB#Ws7~)D13bXKWbm0y@=b$Nsq#a!XHH-ieMDS zV>l5*C<>F;e+*S(2uEQ>aU+VGQADDMMsYNXU!sUb5szYD6#M!7kK+3%evrsp1$PK; z6WlJyb$vUWb_(C+C?#|^>${`aBg)umhA6QT$b#W zDE<_3Rqzi%jz3Mzu0?TOlypA3n}0=dD+-DsLkzd0xD&-cQT!Xl-6-yf*^4Od3wad9 zV<8U&AM$#WfKMd*OppUU<%4UA9huW}5v_urzn#*TQM_{akrDJ-c-ojf?{9=dIA_zu za985L6+=1^(+hfHaK+#jo^B*@Vq7k zkX1-FK@Kugd~?K*Qgs4d3zVyG{qP7HOOIJrkrgBTjd&@6`LA~uSliBsB`#ZmUC zHWlURzjpIlIHj$Gw2WcOC{jLkw|4YzMp3&M+Q-l@hW;^hh@oQ)J!0r72AyK)5<^$v zonzQ9@i}a_7`lu2n<#%fdM^?C#L!y^TNW5?H>s~=>yD-YLIyjf17jE@e04Wjd&2vQ z%di-R$1p91cVie4!^jvWI9{WKj1?Rm!x%?jB97xEJ6@1`Ix&Vx!Y2#9!y_PM>H@pQ zslqpjBWI__Fgu1hF}xSUj2PaR(piFBI#WpT&uzyKVrVT9n9q&jqZmGx(s_a(3Z5QK z^J7>L!y?IkBFOd&V|XAnW*lP=&SFQeGlo8kVQCC%489na#qfCy>tomu!}1uuh+&Ob zt`J-;xYF@mC8X0B`clYOjy`4#eeLkIF|3Q>8*Y-++j*LoYv=TB4Bv^(M!`*v{pJ`p zizVA^5iunOMaZ@%_8@36=rL@KVOtDF4E`7*j&C3aQ+QA?bt1$8aHr8!_CB;aBnfJ%-CdeiOVH!zCe$rBz(l70Lb?!&M=y{2^rhefKp- zxh}*UOMeNu7sLG+ZaJm5W4Ob|FE`1F`PW!_5W~Y5o{P<+7#<6G8p9LEi&rw&m1~?m z$j|tI67s?+{X2%gqxLZV6T`nTWQ-$|yxhMQ18*E}Vn7^eM0_ibbaAA0t_NC=qx5mO z;&8{|iDQgJ=1_}-Y!N&tm=p(zR|dgbA|?yZE0{TsEOBIwBU>Cfe&9iWJ4V+XG%bjvA6}7)MPZwd1H0 zM=jxrSO2=g*|@%tdV-I}Qv)H%6YTyr65cqDCUG<6{-WJYrh6$N@+C5UpXh$Cv$M+Iy zjHCQIfyOz!XLHZQI3~pr;HivbavW3Q_$-d4al8}9)HoJ8meb;x6~_m0yc@@K5#NjB zeIYXh(@(U=d8Y6Z!e_@ZCyx1|%oY4da9$iA3TZ!)#)+jp4sk4S_<}e-5rc0XWszhT z$MLBUwqGK|5QAlLd>zNyI6jYKc^qFjHebfEB94`kT@}Y_NB>#8E={DbL|NnL_1<%@ zi{l%~DuU|;H^#BSvH3O*OtO2rDUQt|eiz4+x? zmjnw;{_oVf9LE(=>Nv`uaommLUL4orxE{w1Dg7&sTS9KeF{(DV# zMZNdqco4@^DShbJJQnguaDli#5uP%co(Xv_$kF1H>F+pR#_>v&{NJO%_xLA{f8%(~ z$3CyvR4hpaQjsPVZBo%T6=_rPRw^o{qEaf-r6PSQ@}(kwDqN}diI<#;%&Bmv!jlSb zDw0IZC`f`CQt^}1_w$n}lZbY|CR3JFWKBgLQL+iiMQI^roYJ0Cs9Y+_ zr=o(Rd_IMyiA!ZsYNVp3kSc;zQ&CMwb-_(ySt}K_CEF|&by87Rcw@nOsc0aCyHj6C zhehs&sc0m8&rI*SGxnNn;@JE@vc3Y^it3MgOFZs-hi*htP)blxQW{Y@1*AnlP`bOj zySuyN#@xBxbcmoLAV`XYD9!hqJTXq^TXvNaTZ|G;C?d zmkiqxTiMatjy87OE^gF*MX@bW!oLS7DMF;=AE-Lo(aDaUR&8fHzOkdLgqG69F25`= zW+bJX9p74dcajPNjZ{5kU?jpvk@T{oza0bY=xzD?*wNSG{YaJ!R0Hi8WXEVb#@I2~ zsvTj+5Icr497Y^&$5AW)#er%h#Zi|339H81F~N?B6vq+A6W<=BCfPCBj_H;{60meX$;2VXWP^6>APL(Mu_MZ= z1TjX86ORs2Cx@tG!){e_|{A$NJ8ZHsf+wp@P7s!7k z79VPKeUZF7`A_5`{!H?V9ktK@yTh-@S!2f?JFePs&5qyfxK7V4J8sA_lHVkb9;(LF zG*(s0BBt$O$6Y(_vG$=Ie~?J+pCtE*I-L*5m%U2&$d1S4f7$WGj=$|VPlL3&KU7H( z^30Csa+P)<#eo-gyre&^!?=vUlIuLlYdhXhhXZdpptVG*VMf~=L?NkZOXEN_DoG5} z5vA7VK#|GD3MdECJCMbJtPW(bYBM{Kkvx;7v}Y3EU86}h2XZ=)%Yp2y&EdevVQM}N zxv9KuwaVkb7V3Ga93s!}Kmi9@JB{fSbfAy}2OT)%Kw$^ob)c66y=80;6m_7v11%hQ z&w=+HsN%q>%JR1*Y3)E8OZm!y3-n8db`;w?(1GMN_0Hs79q1;6T%27i&fu|e@_%=>k+Dt1AQG>=)fY1{TvwXzz7HWJ21e3ftGWK1B1v1TS|W>9LjJQ zaUzwG4oq-hq64EG8129q%RkP6u@+x5LXEe$XM~#Mz+?wzIWU{z6bGg`Fx`QvmZw|) zE<{v*Ma$#a~?_IBN)#wG!|HTx{+$J14|s(ESubcrPNnDu*QL9 zzk*HYX-Tt{3_+|JsK$IAC)k*@>eL*d4gyz*Pqv z4mce+;lN1;TudHxAS4$V2iy#G2fPmW$UP4H!!0Ta{SE{umSZoiiK2%cNKlVB5G9E@ z5GR>Lk9;w;ljN8K$ElxSc*=p(41aRq49R&1esJI{xnw>^g3-pLE|6bz;76cL@_7Q zJCVVOd`{$dBBK+TXwKtAW|C}9WOpKql_4uhuQ4hINiIvz>BJnX$J`YC4BsZtOMHiT zlX?O2cbzCmQixcXDC2xXPZ1}ITFQGe!m-ATiaSxliE2(%mpM97%85_t`GEML_inODp}5k^nA*&suNuq$}rZBRW+Qb zNxg*=wVbH!L<1)pQmNy_=T3a##Ai;_rIKe!x@Vek-qmARpD5u8CVWh6VeX4NR-5GRI`3?q&p4tGMndXiQn89rdYqn#Mz#8@g) zHQtGF7Ec~;tknc3%-gfcPE2uPl@qI-nCiqd(VbZA#B?WSI5F31HIrmEaTakBFKBbf zi;P$EoS5�)`8TRoRjB)tO|86U(VDC5pbxiD8y!1;v$4thAIhvKmfobYiXLU+2Vn za^3Q5a$+l$&6a126PH=L%~H0L)SREZlVlfhH*pVfFL597A=@5w;*b-Mo%qX%!%iG= z;ulFP*MBGMPWYV&IN@-@>4ZnN0iOnOIiWe>maD`BB`>>?@V9g}DY|T-7fGK?P+rUF zqeof=shqX+kP~4iB64<2Q0*otdChK=Jmy54MDzs7F(-~Yaf1A$6Q`}(QzVl4j76l$ zIVaAui;>mw1IY!BZSAF`A7yPXC0!(5BK}1D*$H{)h*bSb|4k=uIdR2_s|>F>aovd< zl7yj*(_DeyoseR3;~l|H+;QR$C+<_c>%={)Rz@N#BPixSop|WPBPSlPR&)_fZsHRs z{+8>l3z=N%LVY?e`RlKJUt~v zj)-6y7i`qix{ySYj@YlTVQXMdPG%@Pg+#fK-h~Y0@}icRm6FS}HD;07g`zIJ=Ry`2 zvbvCshWsuRAjwY5LConwE*EmUu=`vkMp-vLbm1cx z%DPa_h2+2*yO@y*~u>KabXL^?ZmCbZA7z|9WLx-xXaoJrY^YGg##`ebYUM2`-!qur0S5B z;fM=|EiP3@EiU7CxZrfbMMZbPJhHr}X*ffaEq&gFA6&TW!aWx*xbP$O-(9%K z3|C#a=E5Zxeq#8u3zuE^)rDUeN^>*+6`nYf-|XTyOTXd5b&H#|;=k#_Ef;QE`W^Nt z^A&^OA1>T?;e`t?UHH?52ekb|eCWboE<7QBM10JCCFkEvVs;@(WSUQDkP$v3c}|q7 zS1!DktGb3{4R7SKuOY2w_$A3(8d7VK#k{U`eiRAf!M4l>__d!Vbp@xs7$5yJ+Bvn>OXWPdbUQbjv zC#rH9ktKOy%JuRY${T8tQ8Joa@u#**r!<uc3p6jvD%ZYP&z#SjOFx)!E7FQaRh#GI9-FIsPt05mQYu zJl!;O*YK@|9vXUT_)bI4DXP{K_3acjrdjeFdbUqdktwRThCUi5X_%~`uZDgahHDrh z-Dw!0VX%fF8U|XMZ4ehh_L6iVvmVM$g%6{_JRKw)sbQ3cu^Pr{7)_6u$5=^(i*vk& z33A|A`@e+JR=60ZXqc*Do`(4vrpfwfn5kiwm1>4XWbtQfn4@7X2PO?gF^`DkG5G=w zi!?0Ou+SQ$*p_Hm$|TFIv&Ni}i7R;=-*Ou#%PI}4HLRg>jkuN#*Adri*q~vfhE1}E zschD;MT4%vqhYItZ4{3Xw`4ijNcQ$r)qbk6H^xmhjCHpk^H3T#SHC)tiNkd3OSi>3N)70&$Dx%?-hT|Hd8e+^J*O2sH zx`c)d)6}#owo;wb6`!U~$h_n*O;cN@san&FQJs>7)i88Pa+_)D?y__Prm3?U&S^NW z;Ro5$)76hM_h~Bgbag>4BhyvQ>Hp4UN9Q{62KC>GH#OYSa9hJ2xd<0c_e#TE4fixW*6^2{YiyfthWbOsqv1~t z4>UZK6ZVPi5t|pBp=!)f-_KC{F&XzLY~!9vXO{WYIC@e(+&A?lZ#18 zyOGIleIa3ei-1t}&9UtlV#EtT9)N-RXM_$2=N+cDD z<|n?&Zd7sOQ|6aX0oC28N-pE6W_2oh4L52sG;g`LrHz3Rq1>NDJ!?ZzDPnVj`3 za&sNb43cWT8w=!+xv|8Jg*1pLo<$ZHr`cpFlPn{OBDy$NxQ%~P~P-AFDgxzmkPatJt>U2g1l zV~-nq-PlJZ;l_S94!GfRL!)xgjl*snapTZ`#%~Vws2g@S99%9_kuIFp@pZeQyAg3C z>W0S+uNwh3f=uEw`>FsxiOk(xB1s}8u3T8$c;Lo8H~w(r{(mx?)0aHvY4y;J zN3505?Aq+&3B{*w{O!g+);dd-xo%>9?#2r@Ub^v$&Nm$AYiqP-esCw42~&}$){QGn z8uGL{l60igjge&0kyVFHN3w40$rRc$=}&QTlj69=m>}T;ykvy51$Gl!;(~(`r z`#Os0$e|;rj(j@uTmD=+a_h*W<82*zb-crd|C_IwQ}T;aKu19xMRXL^QAkH&9q-a? zuAB7x|F?RN21!z!q?C>iNJ{7^X;n${(j1K0ybN`dm(@{D#~dAVb$l!re;waRt&Z|K zD(GmYqq&ZXIx6X?qvJCjm336nQB6m69iQr`s^dY!bV3Ao%~Ypns=sHd8ais~sHLN} z%y*VDt7?#Ro26#VQsS(u<8vJibu`lPg^qeU>g#BrV=rsZ(fo{u9Z`jgGH$wAJyF&O&ok-8t&} zIcnYj4u@?JW6>zJxznvOm?`sx^=W2BCLI{NDvtYe6d0n9v5 z#~>ZDGE3M{rY}UMKUBvs9n#%!9jR2SFkB*@Wl$fQgTA-FO+g=^}bS&4gLdQxS zt90zrv0KM#9cy%~rAIQGt$YjAIwoAN15wCE9h=BE>)4`WEBSUEJ4m+aNVQOj zO^D!5q7V@!vy6O?HAe~elOH4=Aj%?(=MYi0w1h`>*mYct;!+e29Znq+J(%Qyi`Rrx za!%>cbhvfsROAee>F|(yi9VvA7$639gmi>;M06BisG<}Fg+E%GPEeA>DH`Xyj$`D< zE#-uclRC^+Vm_netlYMFP}YNUIvOuj7iAmkI8QF&4G)a4dmh98 zi;l~3cIbGe<5wN?7OE>cuF@?0nvUNn{;lIW$vxU`kpE7+NxVh8O}s9;ERgEj=<>Dbm))+GL{S6h(@V^i(8URu3|GkkNxo z9%QDNg&D*nwPq8+Y!pSw?m-TV=ky>Kd2UO|K#id;xT3|!z=n9!~5jYZ!r&wlb0ZtB$o2v0}o1*e@HAt{EO2xxg;z{u?6vC;wQxN z9#rt4q6d{2*7Ts32bIaI5T)&>Bvpykh}DTTh?N(q+9Y*7_}qg!Gr?P4QaOAo$e*oyeI2dzn@s*ML!ZR^NHh*Mol4zbE$cptlEo zc(}zNBN6P+s=*!%@nC=l13ef-MQY`Uo3^1I45K)lD7qYdbIXm8Q~rc;E=w8Z!Dt%B z5XTZlALqe%@(DyU|6~uQ$f*%R`VgjiFwKLH{rJR>=^o7Rps5$lyqM|1ED!E@aMy#` z9?bC=?}BlAFjuDFfx`o*2NM>n`Laqcl9zk1z+?Q+aJgPBl!bC7Eg~-VUowP(Sw~H?DAmwVzr65 zmAKi1EhM5l7praL+dbGJ!(06CcO8;hYIif65GkVUWhi8y2m8qnaClNHLzRxC>M-#L z(QIxf7mpam&at^Tckv6?sL21w)jjZdaB{KodJyvXukI4(P6iIQ@HQJa}$-UXZ->;1!9al7{f&Ew9mCk{7AGIJZQlV<<{$FVc{w^+IYzkylY+ht1&tWMqm#Ez2?|6~V zi#+6STb{gLh(Q`kktX@QD8QX8$WvfH}xutyOMO|{K62li>)MF@3OkKnVR2q8G$cx5uM3x$B)x?Vkn+P`d zqJFJ7hikvJ(VtAeB(9#mv|2^x{`GBqPrKP_*yQ}zqNSlrN-5x zrx)K@iqy(KJn!X2Z!h|=Z9igPukp{)M=kyLKZp1CVk`L|FD@)qqlcx8@M5rR-DPTs z9Jpml%21MFUJPdurNJ_lHpMnl`toA540xH*` zuuR=prqpsJT!^6fWie$P1fLJIP4{AkEKxyQK(7B@%<|%}7e~C9?Zq4~c6hPVi@9FR z^J0Y;E4}D4*EXNH)QbgPEc9ZL7mKMZ@gms4Fh~*dKfcV1G zYsuHinE&H6^9XM8Vv8&nt2Pr)v!iX~+pQ+1xXX*(UL5kGWFSetGCDH{X;)*97klNn z_fEIZi~S@Ayf{cAqS&MesaMzdL3Y$@yr)Bo+Y39ngXpw$7m4P@gO`R)icZC28i+nG z{AMW6f{siM%6`aYI7429sYi%WV$6#;NrHHc_|bAD{;!v-lX8qgN%x7Th!URm;*1w( z8J_dvq8FFEIM470%X7htAH9&*tcYLmCog{X;+hw~(eR5Gzgo`ABomh_DObp^da-7? zl7`nA-n5)Iy!hSXYr{#m$ZuQ99g@4mdtUru>7nK7Px1#|JoMrb`3t!Wdhyuu{N=?H zFaBouj~CklNzc4^N+QFMP|9;FlzF|93%<`-8F>@UYiS!!dgBFr2JyEwFcoW46UCOs z_wUG)d`Rar?qO^`l=PvL56M2H_>4oZe0bM~B0i+|A%hQRmaB|DqF-ytm!=-*HLNcsSLh|_Vwh#Gy$nV3h+$nO>Ny#g{Xi4u7MJ(V$ zLGe6FF6=`g4r9~86bUajwr%TU6C&oKG?!bUnygUok&F1g55>rf6H8dS+_rt-GyYTk z@s+B%52bx5)f`QKGgEzBOl88P|k;sefZResy=+;LwO%6`%uM)UMo}u9|mT& zRq~;t4-;3Yb6Hc?u2Ah}rG!?f0e>XtkiV@cY+KSgrJ4_yd!o7zHDuXWsLU^u^Q=@d z;40GZN>yi+t+o$e_)yP>I#Nd2qU5kHCBFkRihkh&7yp^g6l?FaE^r4Xtra@XY z=CTM8b5rtW#H}k;3m@w5OKvI0B2CJdKD6?owa>VUrd_4l`q0LQY{8_je2{W)r4lZB zJ0IHnAVf+BZVw@yea0(hZpbF_;cFkdNPZu>`Vd{Mmio}mhwieZtJQoTn!il`)`y-x zeCI zQS{GO882KI?86W$!x;{@YDbfd@L{A6qsZscaEds_hp|44qn>58k|L=lT5YG2Od?M9 zVTz@frfr%J(=BC&4^2#QwVK7b%qGt9VJ^u$qD)q%DX(Z*z%93sxQMuzxP;imi)B76 z_hE$(D}C_!;P>H=)oPUwJAByb!)hPa_^{T8bv|rnmDH~HVUxu-_^{CjtWly1nq-R) zTWQF*Ms2g4+kLP_lEk))$^jn^`mmdP4{@&#`+O+QRASptQJNegaS;#uaD?Qj4-OJ> z+DU4!QBs^fbYupNqT2_Z#N&h4hpB5+Z!5p>fDb_*PWo`lhY)RXVwf0_t>r^ZJn3yx zq$4Rp608+|jO4fvCrBb=e0&QLa$AO1wrC@i!l?TYPIQ>88(k@60W^=<$pQW=px_!(F*{ z`BB)9d*bA=$mGX;AO4gR&2Jo<2R=OX;RUNCeB{GF8brlWAPdpZApHllh9Jq`;knZLR6M69c8e1 zMiR5@%zk9?BP*3`e!OjYvip(4kDLs15pxq?rZEPbhy0H&JH_;_oG6AfLr1z5VFp zhkc#8woav4ZzPn`kB0ul>g&}YKL-1;nBfpVhWas0zLxQ0m>i5EWHHEd(WU3$1wK*R7xif?MTtDXd zG1HG(e$2L7!`vB!_S+@*(!`-rk>_xo{x{Gg>ABFR<-NBlTSZYOF) zhaXN7Y3uSsY(k{CDe8WBtXi+%xG9yYfSgJq28>(HkRM?`UitA_4vL->@#C&sD*cH1 z5%VMN$E1zwlpm)_62xP~<9?hVIZ0f+QHfJ-RL=Nu$&a7>IP1qbKXz_Z=lyum78m{a z!H)~l-A45z*FlIBS)6+tmE%hC&lIl{fAQn8AHVu>#gEJ-8N&V?ZsZHw9Gn?=muWS$H)RxeX z$A0wRr2aClGkE656E^vq_zzKPrQhY7)N?=NC5-tttMDfELT0x~y(C`Qq~sl=vfyw0 zKmczAkSbuTf2IIZlL${HNkdFaObQ^KRci~NXT*5ZmXs8VDuDC>)ZVNzSe}d|9X6}X z0b~gvtEJ}-Ae+Ur2atn2r={c~>AzX!A$i-<^9Jw^c|Kx(VgakRAW5MBmTorY^=`m; zSzeKVe8rShl=vR;ePZvKhF&~?5&`+Zi&6nh3K$>fKM26FS(Oi8RIvsp=P9fqF;P&a_j1HcwTlp>@atLhVrQQtMe)+m530ellc z;{cij&@_N%0nFZ_ItI`@fEEF?l^;w2v<%?O0NRMtmDI|@)+80T7@KFr7WI`C%B_2Q z@(z|F1}P$TqSBf8HSzIY<6*h30dxysPymAi=pMkg0eH8lzQi8HUc{cVk^y{Aert=8 zpJig}%}_|60OWpNNIxq5i30){NTRl?>RXN4Apr~xV4T%zSOBBRhX*i%WMlxNtlEie zvSF(lLuIU`%O`^I0m}0G3EYiVKO-WC8c85Gji&%8p$cz_I|A|HoriiCJtbEqzr0 zrm{AGbpdP*$VYy|u%5UnfDHj`4B)?QrFJuGw-B$e-|YeH3Sc*t9RchlNxRJ$(w+eJ z2CzSX16Cdp_XSX#wFl`uL=?T+2-{)uBb?MxqD-gSHszr148RqD7Jxf|02Q6+k>w>Z zhw3Bu6Wg<+h1-n9k;#Swh{)muu{?+<&+BsmoF|C|5GP3x-P_c$0FDQ6g5gQxS>mYx zPRkg!sWU{mIGDO9KLl_gfDeKw9mJ0TTnykv051c^w+)wwzXtFVi6}n@@QcMS2OuwJ z7x78}R|B{fz;6LO3gB@7*Xg-Oyg}RV0o)82?{>cx!0iC;P?S)b-wi;D$p!xi;65Av z8Nfpl5g%9{!>|W`QU8bdgeZCbW)gEqPXl;n>CZ`|3-P=n+Jbm()xMFdN)T@ajoMT} zq$Lranj{VJ;d5J(MbZT!p%{{bNC`p(kv@pGtyUR=$Qm@}l95WLATkI4T_tIfg`$ik zTM*gFa}aX}ku!)~L1P`nCdDLqEG2Ic?*x%Ai2OmkA4IVr3b0{e!5|6-QON4WY$yXL z5=7A;-lI*#{}ri{{KbPP$*K}WQOtEKW#uUo#D_r)V(mvklntUcc{$79B#4iL_#}w( zK~xB$b`W)fs2D`0AZpT6IfyD8fAt_frBaP6Q1ksR0l1nSIws8<<*ffY{K{OAdMG#*H(ItqML3|lR+aTHn z(JF}6R;xA~n~dr!Dl!bSv}Y)KN7F!*s!l<4<{Zr)O|uN(n;^Od(JhGXLG%pbyCA*| zqK7p{v57~DNxo->URF*?C3+wB*q7LkDE|H=1Be5yY@!biVn`4}gBTXX@E~RfF(-%- zL5vJys?~N>5MzQE%WyPNIvN+m_#h^;>j^I# z#wX%L5Nm>1OYSGG3t~$UTZ357a0788aT8HmZI;F7Hvq!71+gcHy{y_E#16}|Gl*Rl z-yMYcWrFzk1#u*Zqe1Lv?E%YkFo;7IKODrXZU26Dwg=(1bVm?Qa+jrOK@{HpuT!V! zA$o~EV(R0@XYc@dkQfRgOcEhRiQILyB@mUb!e@>MAFXb@Fl|P6#tbL0O5&Ac?WRNaWg^VU9PeVi6 z5RypJg^)~QBbpw;6st*w5Hf~PC4x^Q$P_~65Y~jTHjFGGWDVhN2=_wB7DDzA=7+E# zgd8E{454}mHA2W0LhcZXg-|?Xyx%rY2n9*rCgvrI{!R$_ES^7v0_4NDE2%1E>4iz& zB^C*xD9L-o_lc|MmnJ0`Rv?xPp;QPTgixBH)RqgOjKx1B`6z_4Btd5Q*sA>`g!1HO zt+cJkuoAH{u?q21V$~3;g>YrNdX(OHMQqIwYK71ugq9)Hra{C8Bz1_N5$h5^58(@v zdc^uf@fS%XHMDr65E_#=AvU%2W+5~uf5P#98A7WNMujjsgw`Rn388NY{b=|qgw7#+ z9YR}%?TGD((pLwPjv;g+3GFcsnUpRJzYXCV%h@%AZWixOB2(@WLQnGVh`os46V(pY zn?$np38BOeGL$%gIFLAqIG8wuD9yz`jC?q81aTy>ekEg^W5{O^B^*mKE`;$R zObB6O2$QHxB~A`uish8=nHw|1v=F9SwWc_e;Vj~8%ReWCxfY)nf_yP6-7O4ZQ3wY@ zI2gj>5SGxejkq*~b(Viw2+J+Lf@CFeRS2u)v?5;{f)vTwfU_2|p5cZNHj;?4DTK`y z-$JsLm^XuMyQS|4VJG=6;%-ad6T;pQ_Awl@KUvED5CkRdp%4y-@T=uK5`rFrCxoMx zVh_PV?j*X1-|tXb2yTl@9&ZS~5Ke?}G6X+$5u+gl$b-a?rHAEM>`)Qnx*aNJ>2Z<- z@mL7QLx^%gOgt6B50>+E2xlyQHiUEJ=ZROXHM|hQk5n#(a4CeJLU_1C{bIHHnM9P! z7LfryQ%w=ZiX<9yXdy1+#wlR34ereKZIUk^bX_C5FUik zC5&&vcqkWGxrBz1Eo|I4Jr3bn$RK|apAaSdJA{A8pIXZ4ig+Hvix6H?K^Si_!>bTp zTb?&0e^o>(RwWZthmj_XwB+fCNkr*IathkQkS0P>!cbwPXKltXGLd8mPn z3WiZAjE}-78%AMi6-G%`6$xWiWn*~nhf$Q--m}JVrXq@w7nfo4A(;{kg_jCrnzDTm zM(Hp_EEC3u^fcn*G=h?_To@mR@hO|gLp7g-QJK7a7!|_C!#0vfN<}uT#C0%xsY09d z-k^$+r+OGQ!e|&qBkDETV?FX(Vbl(zP8c%Z&xoH>uS>jN(HP_x9O|`-s86v0(Olcc zVKfP&a~QHdO~Ys=8Ccsqj20wq!e~h%!)QhFB~dbq()vIAt1#OBCu}dHmFIsrwT@wQ zVwH?RT1nfl*`siCf?dPt5k}82y2&2q^E2J)|CT7f<@}E1`~RS{?S0+&bk-+~F=31i zqc3Yk=@&+S@&RECBpDROaI1E37(?Xj*r|pRg$!er5GfI1OEhot z=UJZlVJrw^VHk_3ED2*N$zo#ZxyHxpWnoAWVunIigt3xiUPTmTH4QQm`5t3k80W$` zAIADHHiWS;j7?!AvQ5G;c7(B0_GcJJ!q^qY?lAT< zt>oVm#@;aYg^{n_|5K#uKo|%AqaR`uu^kP=9)`})5r#7iEev-UF3W7*BufS%CFIGC zcE(rwo-n+!^W}L7-cC!cU$*XxWEpcHj9?gV+)2ViVbt8I!g79*M8k-M5f9_5ok~!O z)C!j=ALGQ2hjD`BB=HpSG*PzVnJ~_B9ZIw}cIFRZTnNiwDC6Ru!Qr zdQs{^B;otaFRemFC12 z5wx^Crc-QUZpB)ul2FQ55wwq>1H-n&c2=v75p=T5oh^Tt2)-tlRJEoV8NOk-a)`mD zqwehYTdSdn-^rA-*(S;IM(}+Ey&~uxL7xbQMldXbzN{TY>_-%Hf06+a478MwcB#P@ z9}+Qs5hFG!!y_0+eMAH!BY0RDqaqk>IVBtu!PtoLdmL#Zp)?uK+6hcDk=)d$L@+gi zqY>C6m=?kG2-ZfhE`k{m%#2_~1Z{VzSrN=8Swfs6`;BC71oI-8&yr(u$^wc_^(5ia zY7s*ri%I(KQcEpmSp>_;*X}ZYOS{t2S4FUzd<{{mr1|;?Hbk(G%Ekybk?bOFj$j+f z7NVH9$^-*RLbgY+gW}EzE>jUv$ZpHICxX4?GGM9NPkw-SFoHvzl<0>eI6`qwAW4cS z^2D7Z0zHBvjg(VPmKDlH)QE0k5qXquh4Mt;jld_DkwUgW1i=XW5#*_b%_ovX2}K}9 zLg7+Gj7AWP;KQi#Ga?>ALK;SmYt*p_jz{o74s--3A~-3h(i(NjDkJOASpCyhz=w`Z{hj&CtqV8A(Hb(1UDnN6~XV!CO=>1q)NFR!5w=3j9~lV zl)Dk!lgqwb90sOHXe##^it_8ZlohXR(;M3!MesO+EKy{Q;;#svM35?q)KUB$!9Nka zir}>z*$AFR@H~PS%s+FtI=owzwxwL&t+MS=FC+MPk7~F_4ceo6%)y%o5XD7&RH zMaC!^ys{mp!Lvt=evpj4#%g4W;^Vz4a}>R^rU=OvMfNE2MUg*>98u(q;vII8D~jAv zwl9Y<#14}7QQieExulgv8vQdSS=d=|xbGi`gK zs2j!SQ7n@@QG5|ay(qfKyrQTtB)jd)C|b$NlS|kzibhd1j-rXBG>@Vwc{5A7v{$vT zcuSHydsW#gXdOknDB4HS#;W~_q%CnpcAJzAQ3#5;BS|M>=P1PUHTio@lo+~3(JhK8 zQA~}ZdlcVBF+7S9QS@M{Ua}dY=t=$^QAYkfi8;tVEw*#SJvb@K!TiLtGohIug;>lSqb*QEZB0a}-;s>>$dr$P~5`w?(m?#GIE@ z?PR!%xSJ>oxHoEi5|OfxWIyo$@gVUK@o*GJNX*YWcKH)v?qp{a$D%kMg)0gz3U?H` ztXL>1LG%#AL~j(nDE#DsD1s#BbNC^0^MQP68(|nF#-fOm)J$!pl_F2D%O9%9V>9wN z#|h5jWE8#jsZ&v$j^a!di}tDP8B@+i5!$Ej?NcA_H!dva>HL9sA&MVKIn>Pkq z49Vm)0dTSR!F7>dMDG={?Ti1Ka>-JcqtgWjW3B8HMNyl>SOi=jBVnW|I_ zAH?u+44=eMI)*Z=Qa$it3?Iofd!SqlWht6Cftf{@{N-b)z^W?5iZN7*p)y;E!SsvG z_bvX>|;u-_u$IT*tshKFM~ zN^-fzW28U&qhLYA5gBF8320eyw%($QT#Ndq~K<6D46SP!H~+yH zLNW9{sElW-`6(bG^O6q&F_^YQ49DbrIgP!iaXf|-5+29#<2V_^DLJPSsGY#+7|zI$ z;&8@|Z+OnekS&hvah!|cd<;Lta3Kc7@m3r^#&9u)J2BjiVMh~nN!B?g|BEK+rx@lP zR6ob?OAMFg;vd6rJSbPhnJz`jwHU5ieA_`KiiFo=xDhkHMcL&~+Q9EmZpLs+w!uMl zTaL>(n|x0qT*$o`{)pju3@>81AH$z9{1wBK7#_$;RM57%2Oe5vRu4Ri;W0zuX071g zG5iz5Q@N7RFZhhyG|1mS%K83M4vLiQDYI`T%f0C97~aS!menRVpK{b{H&ChKupLsV z;}Cx5ph^=*+BlNpc<+#Een@2?Nk_EBksL<~xr!q_iD?t3NixPEJX0K*NwUO|HIB(l zCHm1rDn}eS<7gSjmvQ8ZBX?Zh#H}jEktdF~86j(6fH9LKwH+&QH3#Zf43 zTqyEO+LE>c#DYW#Z_h;KXEvEpkvNLRktk{VKn51a`*CA}r4FlN(&J$zr6fu5I7*O6 zt*Mu?l+tW28Op@*VH_VZEE`8TOD{XvCPfVI7E1Xfj`A|XLMc)z#L?!k5>hFS%5hYQ z<5THkw5@p@RpY1@#}{$bi=%oRHRAX@ZroVbj2n0Iwd1H0M=f%>g%d@}XL1Pksk(8P zilBs2LdH6-VzlzKWx59PQ$0A4j)1y2sHWj*fABEhCJ}+qYGxI69LEH}eaT`~Pp^kSddR zmGy6;rtLTI+c>_9<9jMSh&_qj_8DeLWwz?WvGpaU>t}qp>qp){jsbBDBo}e8Y=eF& zgBY4khLFqYHY|?eag2y#q)aM~32}^y%L}-b_=_D;LPp0ihRRstIAVHMO^jnw9P8uQ zAbV9d|8L0);#f#Bg*Y{iX>m*^pFx}x$4ru0L}@acM0TU_x#aVR^DTW*9E-_U#IZyU zZXC-QieFkSBd>f!NoXo7t=d&_thV@?IM$M{vlMB&F^)}f?1*D0H{|9xwsTpw@Y1(6 zj%{&dx@&wjAw|fn6~=zp6~}Jc>@u~+wmos&&MxnLR(s`$SH`|Lo@cU2*&oLN@`J=f zmVP*nBNjgzH@-p?v!p#eG1(P|CdYlIEpGzuICMF+6GrHX!^K^R*90!Zu#GyITpw9IIhHTHI5T;oQ&gwT+HJ*#S`ar9A|if z$Vb1k(kV}(^K$*CDCd-vA9&tLm7H{f7vuOjj$h)qMExhCStWRx4S%I*HkVWKS{%R0 zMvCL6mG*iZH>|W~=3A_~OT2C6yu%?$+Iw;Q!K(YL`qMh=CAswSFpfuYJdWcpx%MWI zlE9NV{*EI}!nn--!)vS%B=9tjXL2~=coE0zINr$hv$*Xg@fFcL`XWj(6{&qIfm8{k zW;V$qo{2|{%YIraNyKzktu0|}8>v-P(kGB1A@4>v{23F-lt50)nVBRTF-rnjNj!9l zIXlA~3H(ka7sK4dJVfz4Jfi9jGCs(>lR&-%@+VLrfhq~(j<;X}g%ZYZYAPn=<-)3P z0!0!iO8zcUeih=)m&Z{zfzK1DbPSb`;fn<7$$6B3ose3!uY7TlB%NdkY2~^Ex>^H%;j{Q5|R3xd1X^tT+Ns?82n|W*ulZh$Eph)ESrWe1% z*wUG(6gY;0$B_9LvK&L!W5`A^_c3HA5nGO9knJQy+U7ilT-0TI$iJ<~a}587s`r3) zqH4c~H!U~!o{LBm=|y@~Kv6)7fP$zfD2NCuDuU7!Y=F`cRGJDR2uM>9RIp3$HOXX> zNirn~z4zYXzvl__``&M@v-a9&pXWStdZwO~l4xncasia_a+MWQ>p#U@%*#+QfGPo0 z4WN=|b6)_JJ)Sv4wE$`dP$z)u0o0Hre&x+jGk{tF{sXeh>8fr3^#XV>fQJIOKY#}U zXeh?@1K{{+AV{;b1^vuILWS5U04fiAN2D>M)SCp*G=TC!R0!hH0Gb8xMF3w0&^&+^ zV%#f$mO|PG@KgYg32zlZYawj}+X_A|_=I4IO=u^Chj>y*v;Wl7LOKV~C4grF=n%lO zqI42`POzh3`%Z4jpBGN@!vBab2GApbR|4oN;!B=QHz6+v&|OGP`N?43S0(zo;A;W& z%tU1jydnHe!6Bl&6+rI*`ULQH0Ph7bNRr+OpuZ4$>l;8nk7u?_84$ogQQj4tCVmD7 z@O}WJ0vH{@2LXH-z^4HW7lV%i7#hH^06q?2h$ssr3twFPBmf2;g~NtX5{3~0j10K5 zfP;izFA_78VvJZ$2w-dgzfV=LE7f!;!ZNxtJ9MaXq044>X1rQEkasX2T_%(pv z#9(Rwa{`zfz*hl$%^AuqfCBg~fSCbI3t)Nx-v->xTV_ZS37yj+w-=Zt*}o59b^zSS zg<@tflW=PP5Wu_uehlEJ0OpG&^@Rcc2eDe<&8$VD|6i`f0W1w*SpZ8!|Jln`cdOeP zzeqGQt%%D5SP{U605;NF0DnmFRt4~T>IU<42oB_4nofF(TPwVN$bCxE1<3=t(ImF*|v ze@_5=12`GLsQ~r`us?vq0UQyt0|6Wq!rHM-*rA7H{BYnM75%s%%YTfWIOfjp>4^aU zHPW4%rzQ2Q;2F=7N#}%TTI^x~mjcKN!XLzCc1-{XB2UmABv-}kI>(F<9)jYH0B#Do z6~JvF6z^WC7)bI;#sY$j<_jXfaGqi@>hq$5b|E{6oFMKAqC^lXh}w<51Hm6pqw}R*$#4yFt7cL_aD)3=D#I(FaJGXRUJEr`{^nf0f!c#Q)nWH7JO|L5vJy6w6k} zudhBosKNcJ!$Yas$6XC-JKa~SfWEdfZA(=DD?ex(>jFAE` z*R@ru+-fy0h|hu;AH;+peh7lM`aciiiy&qN!BRC^t!VkBIGISdK}_brqgfEsg19&A zn=1Hq5MK%DwOUaeAvj%>?}C^qwaDE=g5q2Qt*eiXt&GIenfOC;mZK`iw=WSkIxWsNvghWNJx!RB2a#6Lm& zD^*?*#P31;5#%4rs6WLayWlTr0XD+lLa6)~#L6I?)oNo9tAwl(TrKTGoyAxyd>x04 zko7_~2xt3m3SzUgKix85joK;&;ND!@czb`A+8)FXDLHGpQ^>9$GF1ri=6?`7HSE$5 zW);{?A$%D^B#3Abr-L{Xgb_q6h=V*z(VTb?2^k5ygD|Dy>|7@ZOE`~iXGX$P?(>~w z5D%F`-{cM5ZwulJ1S@H;evqt3?Ld73K0pUKuEYE;R z*}`)|P$A@oP*9?ULf|LicL^tw)ADYQFj_Q(Vj)xyp@!HL7c4D!k6;PGdqXHGq?90? ztXQMU2rnB#IU(gks3@d@U}BB?eN83dB=-raELbIks-9jg#J@stEg5QtP{-4238@_d zKg7tS)(xSamwNyI=nX_{7D7WI4~Fni2#q|;#zGzzd?bV;p0_5VG!=YQu*h1s7|lay z5kkul9utwu6Ctz;p|wQYgz&hKI%`!Y37N9B6|r3iboC?$fVg@(gl9r{GlX6tbO_}Lw6xPJpGjrUJc>35PEvb z8$w; z6vE&T-WUFXXPIg0j$81Nr+h4Ah~Ur=hIx8_X|CZC9UH<3Pai2{R0yMmj1g=RxHD76 zN%XT2#tUKDCeU)N`aFbJa{WK7RTD#)6hdAN`7}%pVM++wL)a0*)DXT3VSWe;B;(g1 zeCK)iCWL9ir-!)hygMGgmFNt?j51UBtPs8zGCPDhAGfJWCje)HifW7#LXdYrS7`Q z;8qd03ASCQc80Jk#Qm<-82n*K*V}cREsGuRp8+~yh2|-iP z5~Q~t>y+d1q>xky=@51c|8SjRpxNFK_E8b>gx~?egMu_TB;>H*5y7K^#{`cH?&cPA zA)E@~v_#Kw!54By@GJ+F*R~h9{)?FTevSSwNtAauuka@zgli!r?s0b_x)H*4PAEC8 zCEjGSOjEZ6Zwo?ml{|ucGl4w6h5{PKY8a=%r@4(>O+$4JSsMHrvNiY3$wC_L7Lp^V z1ambM6hec$nB{Lp!cbVlJsL_#QW3$T8j5Ksu7Ue9oyp@m%;3Em%4jGnHYEj1Y3>Pa zX+dM1DyN~mhDsXl6QzRKoL}c2sG{&IAG!|>D@$q>4NPLRsw9!njQfz+(9lK0iyCTb zsHLH{hB_LWX=tvwyG_>BP+vm>;q?UX*YJQ4rsiF*8VY|%Ln9#%YInAgd|1OH8k&mO z*t2gUgjyo5hNs2g zNx}9So)YrrdNogMXqF+*XxN!iG(4xFqlQizUeM54?4K9R6o%WHF;~t8#X!-YVTgvI8ir~3M8l_&#IEO-#hIhLAe9{~I6}inFYn&5{?Q&EBZPJ22LhjI_)^0} z;o~(-5JLTPAzujcYl2B!{5AIk?{5uLG)&d7P{Sg&Mg{*@8m4KOF8pi3Z|GCr;`mm> z3=Q9Fn62SENuoYW!%UAed*)q^IU43_m@oPdf_y(@p7x9{4Tgcka;tfe`xqq!(ZNUGl%Ar-+wgxtKmNlD>bar zuwKIk_LPRq2PtcXtkK+$P^hf)bVfI7*rZ{rhHV-)YuF+-nU6=9`n30@$#!PZ?tG;} zkx8@(Xb5WPuA_&J5Z5sdk1#$6BdkH!c>RTvVMH`UHK;Ih!!R_&G~Cc|Q$t)sLc>7~ zhdAt)DO1B62ZZorjl&v_ za4phsQo~UZNlpnlCU{)%gy5PDif-xZG*>MRXGNrPP6I^}9+yYI;OQ4NT+(n^qE`g3 zYy6*Cw`|u0X-v)?GKse|+}4mcjC^4r?A{mRs+cE?yzN!z(SB|_MkQV@=by&z$9MU| z_-LfRKp4I-vcmAwz6Y|y$O*eY=zLJ}r93O)TLjEikOtd)MFsB?EF^fhAd?CUDH6uJ z-fkqt!YD4{J)TVoA>4kXR2ZehXdlK?VU!7@Y#5EgcsPu5VU!PpZq24-3hLW`H7tPOT*|PO99*V*D!t$;}2=x z-@;h#wfPFK2mcghbr@^H_$!RRCHhYo{|Wh5Ftaw&+e(S9Vlg(l1Bqd67@I^~CrD*| z7#oCd^ps5Y%@W-rNM(B%JHlwLqlJ#0VeATnC9k6+5JoVJyL1%d`X7cC#+fkAa{UiO z55ox~$&oW%MZ$=M5f39OQ7Q(<|91C}V;B-)SfZO=>bjk7k{#xwI+vulGK6s?jH6-f z7Ms0c>=UvljEphO_KR|eYl4u2g4DTP9`Ue5t&QrKkQ40CFpkSQOpyksL_aN<-gT#J znLn&K$1dYirsI4V7s9w0#-%W>hH*`dFNbkO2%VJJmuF=bH7J7dQ+me*d4ok z3>lj|I`Zo%pu4SnR0wcTd8M=eu>3(NR`M zVI4(u6xC5o$Gu`%T(E?f>mDHsH>phBOL}@K9i@e{%o(5MbW|3lyk}EEM@5fU5^|p) zOHxHgRUOqNT2n_Y9o2Qz(6Pg--EASYblk8bu{~*EG>0BrlYHlmvpq!(OO4G z9i4P{r_eS!9@p`N?k?|{oj=>^cv_MeZ71YO9qm2kDZ1kBf{WBMIy#8>td1vTkI?5N zT5z+wedzNn_GZ;Z#|FRu1>OB2>nuo-oWJZZO41U)`&g=*WPDk7f8tplmW23Y~ny;-}>YUpO=%l0$lrq=#< zbcA#KeRV9@thR4f9X|8(LzMx#`w)lEblw*-P{+GM-V+=oI9QNo^z(s^4_VW~{)%7t zKhkk>v#LGG|FMoCI!G9X>Nru>DpQLGW`OUkIVjTlXi2xzCRt*rF!sn5<)pj;T5> zPV~3iqQ2Gfm5#5a4ZqPbT?pHAniMiah%+Smo#0Hb{4Cq|I%eybqhqeloto4l9Y5%p z$AWE93w6vFZ)|}<9n}KilRk9MMi}_D?2kHr5|J%4ev9JAL9F8v9Y5<>nrX&PYMFGz zFYE|u$)+Rx%XO^a>Ka8bir;noq2pQv*CY5-$6q>Li=bx&f9v>1$6*~ubo{I1KOMS` z2pg8(hWU5t?kjK%t8}c^u|~&Q9qV*#6@5L2nT}1K%_3H6i`vNfvc-LUj$yNoEjp-> z(|DVZ?Seb_6QF}4lW35!3GgcbQ9^=D(pU`P_2ny-DA%HHNbA_G!w@~DBQ7MN!|`&N zIxOL~r*L<^q{mbGot-N8=`i^Z!haOAmpGRl|wrCAdKWF=e~~I z2nt5r!Z6oy4o-2!=t-LCIIZK1DENuz4hK`$D`Q<>Dypmkt&=TIekJ}EHbzG6? zRUOwon`=V8z2?u@+>&VC2=Ya6TL&V@6S>nzG|1TG_Y|Ly0)iPoS;8}B*%9P;mP*L_ zE$Xfa3Pn(f(FpDq@m|5gf<*+23UXtdVi6RN;GT%P70)Bw2*}g9eNai^r6MRDK^fuY z1VP$hyVB4`^y)d;FZaDN03MBFWLsz*>mEHfJf)r_E4 z1hqw}D_BR6{^_co@XTID^&@ByL9+;&N6=98hazYc!GoSXcfxr%f=41~>M4zdG!gv2 zeR3ZCpD2&gLZYoAXes2e|9@)h2--yOxF>R(9r|e(!IKemir{(C+Y5Gx;3*+b3)1s5 zLRgDug*@l!9ldsYL6oi$yd9A_i|o@M#3YBYaC1eIj@}f_EbLIC5vFroIup8^L>G*)M|r z5eyKX84?4%LktqaqkkY|a0KrQ$uuwbU-~fO?!xp@1P{q}Otc&l!BFY?VS=BCJx2lu zz=#M&N_48=s0hYI@L2?-B|1is9>zx8W+xdh%0$5l5qvJ>3qe-@OCdDNG{q!|P8OUZ z$l>}`1Ybw+O$5^-m=nR=$eopBdIaA_FoP|8FneYMv&8;8NzLpj`n@Q#BX@Sw<#I&* zhY03Huvn7jN3bA*MG^cc(S?F1Wvf*hXY3jMDS|V@^$KJ z;cEo>1?AcZh+LM}N3cP}je?m^GB-uAS)%m0CE|YEO0q42?GfyVU}pr02+Rm}MGz1( zBZ8n1T`&}ZCM5hnEyhNOh)7paAyi_X68HMTiolkR*cX8#giXCWf@B0Ki85E(BTS;V zJrV2`g`BDTJ)Z}J9F!zBK7TBZaCEKpU5(&q1jjOE5WFaOf~Ae%R0OBlO`@Dh1w zQ524%SQN#@zKCE^LAFL_aMIg7qLlD-Dw(8GQIr;u3R|_z|8O>Yc}An|EMTY*MMdG2 zJcS!9R~B9+imFmh`lJ)OVwI~$QA51d6s+ZWt{uH|Mo};74)|B39qy0ffhg)n(IAQ^ zqG%gM!zdn%qInc8qIf8ZMv}d$;KPEA1s`FH$v470XcJK~(MN?hlT?1B+)|>nX)WY2 z!B&EtIMmxj@wjJGlHUbK@njTTqIgln_E9_+MaL+fisI=go)NJ_6weBwJwxUL>QemB zGK%L#@5~y>84>-zz%G_gl`~&7Q|TJT%VPGDU^hYPEPr?5Jv=4z$^WZSye3LdPk%j% zH==k`qP?Q%?dfj`dH1wCYslY;qOUY{e`#vAc|VEv>f^TmfG7q=@vfJ5XcX^7F(`_` zQM@0;hoWc7{DEh~wc;b;AA8D>C@Au948uhHMDSC=;esQi1!yojiZM~liDGUPW25f5 z*|$;5kg|=7;xjQGAH{?yJ{LYIipfI0h~i5jbTUx}USBA7G6MhBc$>}6pKZf=h@5`vOsX5;3B~vWo-WxbwNb2#;@2pCi{kGn{)u9_Wc)*r$6CRw0O6VS=TA@nD+($+ z!=%l>QLGaEKQDEqmu0n(HG-LSjP~oJ*vt+RaRbLmA8Zu9NqjQ8Rid=qA!J(=+lBn! z8n{!UyF4)zg~qvH;AsQlDD)^Q814t=ktm{3oQvXo6h;)WD2_#OJc@V}3AVsGpToL$ zQhY+n&)dx?EJkN5n{%zO-`zoCi%Le3iXt7w?kM(0aUhC4QS6OkUlhEa;zb|x()jci zRdB2O%<*6phd8eC;wY!*X2sVC4~w@WQTLj3s9f3cV$FC;@#2mJI1zO(rBBjlj{j5? zr=vI%#n~u&-0kPJCmlAD3p!qxU5Mgh6g~r41};V2>(*;gT#w?iy9 z)qT^94sURY{=%Qfz)dLwuODwkaXac>&ckq#3Nf#NdRay;~J8%qtqG zWZ*snl?~K2P)`cUmf>}76$4cbRO3;WXID2+!$3`O%fCRXWuUghxTVPwAiK|Ht>jnRt8#2Be3Ne z8XIWBs)c<`1xX$?(9Gk_g|slx(!gWFyKYkqG-G+#^=y1z$g|}iH}Hgkwg%oC;cv&| z8fY(^e`CakV((0z=x3vGs6S)iYXjdH=wRSk1J4=g$SGi8jDb!Do;NVmz%TKtV=nHpl?U zU{Nkz_p>nXi!qZvFz}&)j|_Zl;Kx1~;uV8DQ=U&e|HBP@DxB3}#u36t3XbB~xZ$Tx zWYSmz6WA|BT|Q0>J`)_zc_+nopZ^;8!oZgXCW_@`LF$tXcV{_)RCXU+plk)4(AEhYjp9+~>au1Ezt1 zfuMnqC}9J-;XY#4B+4hnU#>u2{ko z{Mq7Oa0X5pIPD#aI-Q&|aGuLf3=hX}!N5hXs4*0YxqW(xi*^k8W4LVKis9a;y(+zY zTksldu}EDPyutO~z%AjAZC4CTf;h<|m{+jFcK5e{ehS3kk0Cn-U(9tvF-r_8uDBDW zk|RkfhTIqm#&DNJ3kfm{zkB5o?~bALAU~r;W8lN(@-bA1;n~UlVlnq-b@3SPiJ?Rc z_r_2%hB6{jFBNm28IdrQ7BLeoE4-W_AA?qmp;8RBW2h6ueNsF=yspecbjf*tyQ&gH z)flSLdDvG=QmYGRv_=dyJw9c-8r{QfOoqBK)QjQ%nERxRTP*U=;~t2iK@9G{$SqLy zW61ok9CQp=k_lV`vw{qcJp#p%p7Q+}}Kg7BRGB z$z>liwh8aL7t?YclM=EFY+;J6rH*Y_H9i84;R%VdHSU*Zd{44>w)vhFY#+l@La00~ zcR~Jk7-q*XCx*GAEEN1faGoH|=Etx=c&i;*I$?(@_H6dL7`GBq>skFBYJ-gY`a9i4W>XBCW7rZyP96WI@BBB)W^IjO8;dte zwcV*Y9P)3EVMh$FUdv(F$(FyBvx{xcA+b}<-KmHgJ+$$gF<3E#V;Gj@*E!?%`yw$! zV>nSZd&f>?#4x2uR*VZ#JUcE(lHgpJ;3{?uP7H`6PaMe@&g@hr4c|HL0vAI%hTSpj ziQ!NThhvEC^zV(K_%3x&_&(OUC-%p1K%z`7uuCy@^4I<&F&vd@p5;W2;dl(ExNaZK zIT6G91vn|3&Twun1-W})p6Tq>wOFdxtF0#P8)Fm$dF@89& zuEcOXh8uE}t1(;?!YoX>8N)4!-WDXM$RrY)<&EQ7zHEkqapa35e;frw$r1DkW(oS^ z$QJVX+Zgw@n@h!!8^@k}*%^f-qu(7z;W$diQ6`QeaqNuy?v0~l97W@9j}#*}e8uCq zhmHJ;f9ft(g2!!_)nT9e0%x;?uaub8D3(2}x?(eyjbr{U^=KTU7yHY_Q9h0eaa4@s z{x}|pqf#9A#nC?Ms~Jb&8~?^#?l7wy=a=BBN*q<=s1`@{IQH*S3=|n^NGhYuRV$9# zlD&=~mAY}%6P_J#4OoEsaWrBrDyZ@S)qn*EsD^?M3O*#*DWDz}n@0p23pNpKD%d}u z=wV(!HH#y5!2j)OU&}ZiV^SQu;%F5|>o^9+@opS#;?S@8*qA-zcs!0L;%F<4{BoSH zzWdt6@noFeFsc(QUK~%w@pK%|#L+d*FW^*%IL9!$#8K{g&U0~ejN^qkI!m+@TkLwy z^TJ7Tf{Hc_)Eh2x?O&9noWfaDUW)VMHPuaglF%~`-CYXML+};BSL1k12vhs+@m;^> zdp(Xf;_gIacr%V(al92rZ&CVsdLJQg$MKG*bPTF~9`7H=0O1trWp9~;LwuFt|hi(|Zysc}q*nw9CNbl;amN9vIDU&`c^rTGup*A%h5Y5? zb)WB#IR1{~A1cxX?1jJBDTa@hQWn1Ie7RUBDo(n049dUj);Swg11UNnuzH}VB z;|RtPibIph7>)DwX%&w1D`};3vd3{eqzY@QK%MOBnljh|aWtRlkH?XS!xY|KQ&jdA z$+qOUwjht<@K?a&DIp^@wI`0fT!j*-n7}@+EnLbH__<{^SB3*|+=%0590%h#6vyE> zj>K^xj*D>|jpJAxXV|KmI;3YGr-7b*ibGup`ALpINjfdcwDGRNSve@lxj4?V`s3YZ zVe}GvP0X%|!&znBABZb)T>YQCG`lX*Et67VO01o9-@zRQ~cJ2%t6#C!?2 zEAuB%KvI2z>|X|^W+#x7K;Z<6BwR%$a909_#3om;pk&V&)A`+E#wa;MQHd58EGG8! znMo}nt;YtuS4hbON(m{QKp7!r1SVT>LgHCqV*DJAmsi89!Q{RSk)I~^D;2nFo6dX zpvcq=Qg4*N!=ATCgt)m9?(bbQ;%(of36z`e9~$O+aq4PVojUD$E2OKI2|SiS&m+E8 z2|Ss=bGmBHy6CEn;NyZ%B+yn!y95}R%5c4;dPP_56MQE}J(a*mx_Vmh89|EACD1W} z$rh$q=#;?o39L1-&cq7|bWUJ)0&^1RlE8}zj7ng10$me$DS`i@zMctmOSorfJ?K1v zmlK$%tL_QDAEN4*enVHUCfr}}*Ajg9L(Q4*U)U(y7g7Ei>h%QPNZ?J^zmK7xkX{MA zl|XOdeFWc0;BC*QS`qa1_^cA>pTK|w1}5-s0z=tu3A`t%9|#T-9Gt-WLSmn1m5wML z=tEXnl#d062sX3bGPJDW8hj#IMu`5Y;BdjYnrkzXv!JwF<}nG3l`gxSrN$-jSprje z0-wP61STZ#c>-T>kVI4>=FYVi5j9?Andf}nBI?ToZnySNOkk1_^2tJ`2&!22*9r8C zsBaRue%m)DqPWCOlR+{)fo~Ih{;OsrFpH!2V$RZt`Yr+DOu;dwvc6AXW5iwYmY2+) zo4^kVT%(@^<|Qycfh`GaW!EIIFoDGhED^Vh68JHJpEz3lisw;0oJkMc{UxI6XSz*b zGrKkFTb2N8`X{TOz%LxGQT1yAzX@5M!0$pRt`PEip)7_!=)X`F#lI8yhburbXRYAB zf~z=wgsc>taNI`&hSd^XBiKEv)(Kgkz=j0OX4xABHzhDUsu-nx`cbv=xO)?I8><#o z+Y{I!geMp~rGjPxRsy?(2NDP-5K2HxAeKNpfw1V21fmJ(3Es4KTQ7r#DE})a5}-%} zB5mvhoCHoJa58~p0;vQJCU7W$bb@!t6~q1nb|Ueg8L+iQ3e_ukSLQf`r!nQ zdU=nCNc~s>$326L*{K9hCvd^DJd?mVkDpC|-ZDo&@8!Cfz$JE{=vNZBDmIxSWh|NH zMglk4xu!d*Z*eHH>rE^(0TX#lJZ0i(6M0SKGg03}0~7g86fkkGiIOIKCbCSPS*cr1n&@PryNMnq*4XNK6J1Qa z$X@{youyv7t=cqZ3>wLSTE;=eJ>4y7~>J<~OGM9-rOuS~| znWS2nR6R|6np9JSv$@_h(aXeJCVF$2rQE64Q*dTVwa(4{JEa0C^$v$qS`A>gny8mn zeNFT;(ci>3Y4vkj8EH4yyV46oO$-zAp5P!8gN3{=$lm;bqg41up7ODYAs)|k`X>?{ z%W?`C?xl_}F;e&_!O?3=`j(D7IVG+O1yO?Y6+c-RgT2vrWvAc{E|STE1It z+pUi6R%Q06A0#i$=5e&_QSa4vY~UNtW2`^`lAf3ugHSYhIK6Gy-EGwI?y|C4*wA140HxZUfP z@NW*SBH90#_}6q#xnHi4{huf+O;kGJUe2!)1f(?uj{v)h?_{57`j*OFtO9bF6tcfhx`!}x{#n?$b=>& zEc&gve%df(NYsQOsZ?S@n3q3`KkZc}XK@o{v21%4gKfewk(6l41Vcu5_Nv_`_DI?G z3LY}CPso131A+$yS^n&Oig?(>5mAl`PRVwwcEZF-6F0b+hWlrD=TDaRnVGDP8Vj&@PSj0k63&kW#SDEb8 zi;FAzp>nTDI#f+^qV!S z7(1X|^Yk+Z)Ek!j{~7}<47Bj3gw=BGE;T;RT*-atUN5p&w6*&V*Ukm+2>~Dcl z8WUOIcP+ffQDI?}g+UeuTlmz%a0~BS_`t#t3q#oyhx{K3ek54ppnI42W8s|s42&`i zW4%Nq&xj+eJE^rL%V{p+2J&flF^b}_K+`<_9_{u^#8|7_$ZQ&aWr!AbZFwMer3%^_V!@{=~W?1}S&9}nBcNS(^_{qXz3$r-v zi)Ay+v+%vgXIq%#@wq~N5bS$U&G+;L^ycwJ7Jd{y^`JY{mst4O!g34ee)KOosD6$4 zDJ~U*WrDw0_|?n%8*3!FE*wR$_6 zEo`&!pDZ0KEv(|SJ)~B1cnDd;Q7vR0mys%2Y##=a4g3kPu!)O52aknN+SOYfQYJ4a z#fDDKAiK*UwVhMd!cGgj*gl6;g)_c@g&^lCM?w`p!;!`Q5J$)%HzT8A(RB+qI$&mH zf6F0R1{b1)FU6sL#22#=w~&y57ptNi3#M>O@Xtfa<^mwn zQVdKjYNMEqK}XcYBdR!E9Z|EE`tP-IkMI(Lb&sfw{^Su=+IH{km9eqlht zWaD8QHErZQsvbP59)BdemW|pr>e#3&6=`Uro{jr$G;fjBz{UeMFUNcg^@V(}*T;}i z${$s|J7zs7xgN4{YL9PhrL0$us-Z_!tIAp5A5~3k{Bcw@weezy>;omUwjEWx+~%3m z^DDEP(Z7urHpp8FwzBbbQaQuaP?6r&8oY<%LS{&GwW7d}F8q~Jxd9L?$&zA-k&+U~i~IQ!12PUa+sk0Zz1m|%nC zzT=AcrHzTUdy8+2jY&2p+n8sACk#{A3%OZe+xW)DRN;(%C1hwWrpY9lZsS|qov;m$ zs~NU?h5p)c^*#IUxcW|Trj1!L0I0Cmvst#|YK|y#1%D8v$kh3qDK-|`Si~~3@HT#= za~r?f_|3**8%u1In1^2^%g;8(ORho3)lwVF*acp6$#J#wxLR&wg^k}ihHdPZr0f&w z!8QJsIqtC-9y_7_w(*aR)iy6G@h{77W2KE%Hu|jb_dlVUl~JFaP&ab3-q8J4G4;a< zwbsTu8=Guw<_c3#y;w}Gm%?m1p*Gmq$m!N5o194h2TrJTZg$;DYO9QSw(vF^+imQS zEIS1$?(zt;gluSR*c2X2A#6jp5pWQ65U~;E_;E1Efng)Y1Y|bMaCpoEYByFT@9JO(bi$+mZIpR;-*llAE7p{})0GsZl+RJHpQtcDmFF5R^ zqH@s2Ase0ADcT$sOOhi(;wRO_i@xLR9hJoyeZs~OCY@Bdr_^a1XKb8f*>2_Be@ZQb z+u&!VY;8`dzNgfQYrcy%F4-vRpqPWptkF(?eg_2{T(NQ0#x+qW-nMa_W0k`)?mn2N za#Q#%K}H$iAdllF<#k*$l6>^Zr%0!i&q0=hf(}-kQeP}`&u9D&vK{0&n0HFGi}-UL zev#x?5@kk;t9n9}&%Vn+uNnSAf_DoR7AztdKBbB~a3Aik%;u7Kk8nmyIJnp2B^~^; z$9(~S2QA~Ev4bWK$~x}ySk6It2NfLm=35m9RUK4xP|0y`j@{>=)M*tv?W-(ND&*B1 zRCmxo>}xov>7b5-x(;fw)~9_89S36FBiXeb7Y8pxJt5Q|5OTjDZK%|DKm!sUx}k#y z9X#Zqk$9%^h>(W`GdAQ+9X#rw#~JsLbTbFd9lXg#aL_{P@|=T?4q7@Gnx!6d(8@t; z2W=epM)Wfd9(VABgC`xd7p1LWJHZC0-Fw4{a&F<@089jSO&2&(?YSyT;iYIlw&Z=1)FlW{Gg0mgW5kiHjKXA%Keg4J% ztwpouJ6Pagq2s=c@tcF?Je=?!9sJ~AF?(O4zc~0=$TC41FO?R^5F*2`lEfAuUm^St z2fs`B_&(PlWAm5v!ry}bIQZAWe-2hU*y&&wtK(p`5>BaXy#MDHZR?02phNt8<>;vnk4mqb<)24}s4^NxEG8+VXkKRWISuql{!u-kzpoT4qn zagg+sl#tbD6;t;JKPb4@!9LGszmNlhX|X&c{IG)~4vq>x=HR#x`nl_zVjy8S>EM*7 zpB8dP@T}lDu61I0!NEnk`p$pJ!EGVrmxWw$aMi&z;nyA96mmnb{W(RmTf)Z)XB0`~ zNxH7`CXr9bw2H1-e&Gd@m?W0|B(jt4!`7}5e@+s=oKvNeD4m2#A~%VGNp~4xD3Rpz zAQY15-ANQpqL}c)NfhyHHl1@P7o){Rxkr*R;=M_fOoE&u1I@}L(SN$1r_D9by955( zIaNN13Q06f;=v>;CQ&Jg21T;Yoae1+R8FE=64jIL&CJf{Rh1;FGW&Vev`NMYu)ZLZs5Fo) zBo8IgD2b<%cshxPlXxVFwn?;0qH)rFi|0^B``9!b0+I&;05#H&n7qNgZt z2)-`(@HzJuB17h`V=obTXR=QcZzqvVB9-J)jJ`>Hmc;lZ`mvkXr~7>4k{FQ0z$8W_ zk+`7VP2#;IpDbWFXK|ivp6~I=;2<_d67MJRK@uOj<1J?>yHyDJ$3kAapvZ>^AACU# z6Y`1R^b2am1;qwr5Ar5J?)_OKS&?fwye%*)iP1@1yr3AyBr(?G1unWj-y9(mlK7m% zCW-k;d?D@sT@o{s_%ex!5}hRYwcupIDS}gz_(}-7tmH-YjmM`YF`dIzqBD~2IZsJB z1tOWn25Fo11B-D{)x4;_XK!9qvjyh}&Skq@R1{}jbbnSBB(abKBkA6aUzEg;N&J<> z-%0$G#9~g^Bz{d|38!!pOOsf}+1EgAx~QCsYVvabxr^@jFM3IJEuHmS63dfVk;Lzu zS(jAV%Q;V9a#R0E;;l>Sn@j3gNjLhZ%z}IKXaAGLze%h~Vr>%tC9yJzRY|PoAug#6 zmsCXZ@)DrHWp(dmH{-e_)+ezgiLFVLs;f36(ebhxa9M3+BP6joiPpPw8eLYz3>kG< z&AhC(C9yq;KQF5tN$iwEhc7EePhM8LlJ1Q%dJZNLNP8YV z4y`0i5#wB=t|;mZe70yMaiL6>oy0Jo>x7)aNg{v2JL_9IiNi@8Nn*E@VUOTmK^9I}PluhAS633G`k;KU)a#Bz!oJ!(!5?7MAn#38FAy~O{3#Sj!6ynm_=RMputHL^J-upGf3EPtDHKVepzyl{3wbtor}%9}7M(B@O`(M7 z#RQ9cHut3P@0dF__oh%Xg;FW}C&yy0(kVoRmrJ313iTydg%m2LP}}oRDTQhtzfVZz z6sicRD#+XTnKD#Qp@wH!Q%EhrPSdjMczWFw>UsSB6dn+MQp(UkxVq}L|3fJ>N?~yt zOVW5ag-25OBZWUxXq-Zm6kbW;)fAeh+-0pR&93G=nnJS_ny1hrg=bRekU~o~P6|(@ z@N^2TSm3LwZOXlW&hgwjg*Gf|vFyhMpAcm9*{iBu${meQ3chnywNHUah2it7YVlR| z?^X3|3U9B>eo<_mOJV<2)iH%mDLkLTt*few=r0H|S7#A39>{sWj=bPC^->Dm7)_yj z3bn4O9x3oFtJyVmZomJPYl`d4Ybo?hVO9#?(^U#@r0{JDM{4`uOrci_gHjlr!doeD zlD5b zl1Z8_JfpDbW~A_)v?2M-6l&g;O)@)$IUF|o-B*$4vN|dJmcsHB=A|&7ZIZ%5HuZHi z_PYAzx|(pww-X|wIYSc5#R4A%)X(<-EhbJ@*Apg)c02kf3rMkv`ph4PTmyuq_CHBHiebE{W41N z2J)&DwuO9~QrMir>J-*Ubgkfq6xIn@FG#bkHxzMW3TK6E;UZx83=XH$zMPwCE6q~a z&SqKc-;qKfgex-iXN!*>^{r`=mFJeKe@h)p;dlxsQaH)QKZOe^Tuk9~3TN03DV$3o z`*nBx+~~>AcHBE5=RJkd_P5+2eJO>@B4#Wz#@AA~&Yzex%B8urh_Cl8bt8qFoZ~6n zP9Zmqf@y%OR(X{_jRI-pNh5C>`O?^#opp3EJ}s{p$bD&KrQuH_C+!x4B6)V&HF!3E z7PHevNfHSS?nWHDBn{dZl_Qd5oM#9RNB!7h+?z(pG)kvY zMjTQsCAoMM+B49SB_x(l zFI*gyq}kqEiuh0(O+;zr=?@Ee zM6fa2;kIkW&{UL11)HVOTnKdMpq#(2{JpAUKUQ$J&l34-MRK^8vVHbr!noe;tv)F|KR<;<+t4@ z3vZdkg84#@n8qzhoSc#vmco2MT#NjrWAu zVm#POeP77k$o(*lkJ9)!jUj1#md5xrhNdwrjge`LV$=E6Cuxk}L6N)kiL6iAp2!`} znj-hq6Iqjy+hLmjC*-CM`+4O%I*qN!9h1h`G{&);@@Mm9HzLIeY5ca#|2;=h8lR`} zMcQ5BzD#3E8dKAlC{Zet(wHnfdw&+AU#0OiXJQ&N(tNuK)6$rp#wi{exg;50KF^)# zcWKP>QfCTb5(z`&>%KW@EL!59m&V*Qevr}oT%KG8-ffvcegFl4) zDL67u?mub#n?@v!Xc|{_|9@!&csSuJ1y`l9I*m2L*QT){jg7+B39e7$`#iZ@^W<(y zV>25qjqPb{VHdEo^5)LSn|nP^Zk@cjTlVKXl{a?>*QhjhrBOa#E|0Y%Z|<$UE@5i( ze7PZZ#MeqoBP?Wq=F`*MNZiN3BqCD{X_G`6W*RZ!aX}`r(JT&$u&H`GBqwCrmoqM5icXxMp zcXxMpC%9{n;1XN{1PBQb2ok|vgC+F1`=G)8)B95I_pjA!ujlM@s=B(mx<~HJ+&Je; zxEQWYq8&`4iRoqNr~0Um=}RggH$$?#K0OqU3x<-1WetRqN2t-4h!I{aAQy zFO3&{iFM=8!S8uE^6k0*WKA|QeRzqFat}|c6;G;tl2e@0^qKmF3f*vIOQfS(Qca*; zQcd1=NTwsXjuARW>M-fX=Y*^1sH!7QN4$;{I#TK=prfD;O-Cvn`E=yhky?j*E?RC% zS#%6Zs-@A9R!2G=>2+k#ky)1yw*B9hi8V6kvPrR|1hVSLrX#zK96Ivo#s{ip%c&z5 zSw2cFpQFxA7LZh4RU@fcNi}(qpS`mSyaOEy777V3OeM^7P3_&RH9aM>8GGb=23C4cCoVMm5687axurrDL>ie7SFyjxjpM>c%^bGiBu@*UH^X zK2FDY9TVi7Cf6qGSe@H=sW?%`B(9l?$&K?hMOMzEX&wV~viJZk%%C$Lw)ybsW=iT*r4h*6CQUqhoSyyKba5Pz5&X*ra$fVGDIDb({2` zT$8fzb?l(ClPdk}BJ8H_(Xp4XPv(#yP4??JpySWv+Ci!~KQJYZY=>zc5l5LvRoPEE zPUxs$M@2h+*71v6CKlYa;G~XIQf$UiGfwOHRYxl`TAOi3$62{Qn32+q-*lYQ5zrCT zabCv-9Xk8JsN;7X_jNpA_=k?mI<6$_TE}06OH_FWK!$o%$2Ep`sn>Pf)NxBkB9nH5 zPG*yKn;^w^2vtqSM0KIw(=mncP{$)?Ur-Eq4*tpa4~et{Vh(*A7_lvtHY;i`~*pb2p@HP(h(*{ zbVLa;9dC5JCBM?~noyrzNpJ6T{6|Olypp zlA4i>VRC95)nqpMl%C^NrJN?sj8tZnG^3Omsm(}ZMt(C2upq4&+04jpMmjUn)5$>1 zOwCBmL>(KaWg*Dkvl9Fx;&Lb_j~O`?=Q1O=;yrO%UUEL_Z8Z-C%_vT%5Vf!wMdTRc zjR}{ns2RoR3+JO*LY6L}v>9d0sA@(vGs?22615z)ylPc}P|=K4Y*m?I6_q_svpT~D zX4EjFCb^awbqTf2s6)6Eul+vJB*Uo3us&5n8B9Yn8Zm5aMl&;-lbcYRn(;SxAt1#q zr~)ksZ{xK#X0$b9ycrYdv@@ft8QsiiuPQqbI-1c*Ih_ez%#h~NRd+Lbm@$%OPcwR% zF-TSRCiFL>k8=8&(T}X9Fxn0v52RM2GnhPtI@F9|gyCk4APi>BeCjAVqp4%4W2w^Z zIKti(+C(!ZnX%F=|0&Wq{K;m_GGn$GQy5M)V;W()8BbDZGtBsg;Su&flcttZlhhnD z<}$U^jCq7bROxfR84DCIG-F*a<1VyVIZMo_m(n=WWy)D@mXFpOgON>kw91UtW_)kP z4l~x!-(bc@GuD#7GoyD(ZJnxLPngUOH<7neH&eGz%jYzD-e$&jhQbMV@117sRn9Im zb}Qav#%6Z7&y4*v514U?aFF_gs=S+0JFNH!0h)HqjN@j+TadznpUgO6hQ$mkvp<{h ztK8(tznF1SwLK+|0_1#}F*9f7=5NMLGj5r2&W!VBTw(SC^)J=xq8Y!N@dv{yn)asx z=|Q$jW?ZJzihW)sU!zL)x*0bV*LZHaO@1twh8cIvxNF8em3?5weZ>Rc7(G8^_{faK z?D>fqPtDM2KBNAl>Yo!{P!F*9Uo&2+o5?v%Gc)y^DVrH~Gv1l;o~FYLpBa9#(+n3u z_U<;rL-s1?HJb;_h$<&Y2vNh-2sK+OV|rs|yfWjp8Ei{9wjM zhM%a3XnrPtp@L4rtt>HlCOb)LK{AHPsnV5+5J%mfN=s>hW|8k=V1@;$EJ$rZYYW;~ zkj8?v7F4mIss-sRNN+)23-Vcz!GeqyWVaxP1({TzSqPb_r&4KI3E8Of=}OtDY&k8+ zLnjwioZJ??K1paq3kR?>pPgd!FcCCEil%z|R6wc-|(pp)cx zV;3D#8?#z_QhX_zrK$21Vq|Kq99gmz3FR%Qpq!U3qirRIl`RM^<|x9po^ewwn9A%l>U63+kCjahVWtJM#IfM0 z1+y)fW5GHL)>|;wf_bc5W5Ik27Fe*9p)^@YSd@_EUKW#=Q03OK%!1_>tYG-91*13A$yBQv&?y+D$K~j4O`>5M(rUMqp9>tgQ^#jdA7W|V&J8Z!bhQTyi>a<3|F$<1c zaGB;$7M!r)yag95_?eCroVDN=c?n>_De05u84G?@S?PaKGGh|*E&jSPf8#PcXF)3q zTO|q;F z>ESkc1e@Qp;JyW;Y#43B0}CF?s##2rWv9}EeNZc2qBzSixIM>Gp6y4+y)tbw&0xw?=ASK z>i;8ru%HGjWfxNaNoBjz{9*xku#%dQPD^4%QY*63NoGZIE7Dkz)(VpqaWpk*ycH=` zs}zL6Q&MhchpCjG+KLl&(piz7W)>?lsB9)eMyoMzvTNBgTM^x1%$ppY99lLOWVa#* zA*U6&3Aw0O*|QYOtmd;KzZK=Js9;3_W{X=4lJ$cn;N6tSWx!(vovYiB2^$D2yh zDWm*SR+J{okfcnuvV?M0AiXi#idIyzqL#{5wxT+@3bm^8tI3d9FHLIDtVxx-Vr@bl zYF(<-)FU)buQjxykriF6=xRk{E1Fo*j;W@qvXvFh$jzxOtY~RP5AI7i0a`QFhT4`Y z`)yC?K6q|=w$OJ#do(MR!=^jbf~{pDQn$?8Bl zgOoqmiXn=JTCtO(9bv^tD>NHY*)YnA(N>(X;;a>8tQc#>cUG*kVw@G@typNqA}c0X zF_E3jqE516I$^REQ>>V(`kzKP$Xz_Aeq+T9D`r}8?=RyRjoH3nnr+1#E9R_NvK3d@Nz;tlUxZ84E~?L~46j>pjj&kx3C}TZS#ifIU)98IW@XpgGivw952*4W zc%N{D4If%@pYXR8Ppq&o_0)=I1T*!y75`ZAuN5yCdRhOHEdA?N#Ah;&H$SxoRYEHZ zY*yG+<-kmu%L=y@Z>@Mo(_=+IrpOAfs__y0RxD;eAuGakUQr`f#0XKjNm?OOBs&ri zmF=|^ZxkQNq`kM|KZbEOe6Zr9Je=8(#D-5azo^R3ge#de*pSEuQ|7PdE-xXe4asd^ z`%h*=ZIw0AY?oP!C!|m{DQ!6a&^Y6%ZAfF2Pbr|D4QXviXG3Wl%Gi*el{sw4X+s7Z zGTM;I2ASt-)YwrK8>-3(`J|;9Q-AI;)lfAxZKx%a$xxQP)Yq}$NpGWJeH$9s(8Y$XHZ-)M zkqvEZXlp}b8=A1br43C9EvU_?(y%!paTZOUbV(>%D>|*^oD$mE(B6iQHpl_W>(+#t z4l@5)zMk<;Hgs0KRm-Avv!S~U{cRXPvxg0R2t94+MUX45H{pLPysr)Y=t$=Yr*ELm zct33z%|SK{wqXc)s11i_eLW+MvuIK?oRuSN7)cPP9OA~?hUqqZW5WzOnbk9&nG6T; z@aNbt&xZLn%%v&gpGJQH!$mga>SbC;7Le?gEZR~Vmf5g@=5iZW*zg^BCG}eyRuN=M zSKF|Lyq5Y~7VQo@_o$g)XTy4?r04WmjnlEwhD~%fQwz`(f13@v=xkT@-xGFFcgl3} zozLAWyT^vTiW{(#0}PMZaFFnW4TlJaZ8)MThbQdLhNE(tXfDgD9k<~p8%{7hMg3XT z|3WxP&0R3%X+mMn^I5r&ZMbQ}Et=2!vz~IlI6ILWz~MS;SU@Br1O^z32))9 z~auXw4s8;1?%%<7N4yu!y@scr4j}2bA zA={DEZVbc6)N333HUw-4GK>i1Fs|j04PiRMP37Goa*X6Md#kdfMEyD5tuS;@uh$Yw`&JBl#OLCs@FUORG< zWo)_Z$gQ|;HZ32ypmOrtQGh%u+t>SBAv+4wNm$-R$s3t1Zbu1*C8=eprR*q8kbRZ0 z_Xac9e3Wv=deAsA@+W2iiJN&5r7J{Ab4pJ8IZb(~dKCoVBBt z9kuQF#*P_w)Ul(k9bN3`YDYag>f6zt-8QhJp&hO4Xl+L$I~vn$ZbuWf_ojAKQ|GZ6 z&AU917IustWNJy3(Y8_b^5&|9ZS82M90%(=FzjeYC*^mRHIUtyv2Jt*+A+wE?soLB zqo*Cc?C4LwH?^;7)rXKPyVg%RHL`016w4#UU^|A`F~*Lub_}&+m>mtWYa{I#&YBU_ z@!uQQMO&w#vW=3XP(Ad|u8p%}ydBf%Ot5339aB_xk{y%DvpI5Ud$OPL^mwWrG9-cN zs!}FrrX92F*l5QlJ7(K4hpBJvm`hk_$0EW!>U`<~YC`9W$;<6nV#iW)scy!?SZ2rH zeT|*2peeA@j$PdQDmzxwTw}*Nf;>jAwc|Tgd5dN1?bx6knS{-DY_a309mnk0YR5J^ z_SmtP1>5cTURC^N`7 z1v?(F;G$iARK!@Bx9#}Djz7uQsejpVg&^5Wc3dVeXNOmnf6b0VIkby3Z`g5D`L_u2 zaBzokSNZqsxNraZMn|hY#uPoY;}NruseeZ=Bl5?i|{RBPOS+@eo{gxRqndX-vCUuCimskoeBkS9)J%Jz=Vdpo39!jE=*l3S<)`5gFc#}^JDhXZgRkpt-* z#)(Mmke^#IKyx4|K{(EVWQvnJU{ahRrxs66p`4V20;}UwDJL}{jRR>3Wp;jDndu$K z;6O&2nHN7i#g8AW z)WQxFbD%i62(_pK4Y(KSr-TD#XqKdkQ;JZUI*?^$9Vn-=3D4UrFsw+GHyf)sP?g+_ zTFrr44%8-Bcc2ELCRO^M#y;!F7?e|&P|tz-%E>S&uAu{s9B53Zi36M2N}ljErIQd! zZ_OQOL8m3P6}2_>cQ$F~Kzj)tIO;$L2Rb@1$AP&HbaJ4x10x(5$>J{5-VSsnbfZfD z-5uyb?&*;Kwq~r5mpL`r1o}A8*MWWx^rt_BI)FOZfq?`m8|1)8)+aoX9!h^0HGM8^ zxPnm*jCNqE1Jme?p-!NVbzmG}JXQKElgk*uL~sfa)BHx&%y3|) z;#q{YxitB|=Tbb6;YJ5GIWXUW1r98vv(kZY9a!YRVh5I}w#x}ismo->)E-wjjCV7n zw^dAir|MTbutxD(nQ&FVj^=vm1_$=g-|WB^VF&g)uvNAC-hpk3w>uE0Ud!xoV5jnT zIj~!?e9m*9;zJJXCm&GGLBbEzl&4IG2}h{%#*~czm;=WhxZ}WG2Yzzkgaa2H_?-nm zJ8+61Wxo(kI&hXFKh5x0>KQQ|_>Fvldd`9K(qS&`6E^{QceI+k|HG{Gc8&0-1Ah@N zIdGY9g?d$~{Mk{8uQL?5LAXi1MZGO|fZRsSJ%{{wk^CwV(mL_Lfrk#n9C+oxBL^Nk zV0FOez~2r$ao}Io+fxUglbjetPIf!salk=# zQe9N3kLq1Lrb|B(F)PZ=uS0H8ryq5d9 z1793?; zXzN5f7FTkjz7q|cs4Oo5oT#e$tVO6st?on(LQQIwJjTkDtv16tPShpTqlzz2#u_Sa z?nEPUW92j6Pabm3#-#IbWiD^zOa$>O) zF}9lS#5YdNaAKwt^Vw<^b*>ZhobnT4m?QJB-nhzS%aB)-_dNu1tcEOlZT!{tt_By`EEt&js@r8Jjt75&w!)fz(YuBLU$+3Li4@&+e1I6l;F0Z!3iJdZUF8Mhx>~dnaTq7>zbYYJZd!5joFgvl&iTzGobmDg> z4mfd;ZBIM#gA<3GIOfE0I)_E&KEMxs9dY6rcXyO2If|tDw4aXfQ)lu!HBi8D@|Rn9rWZ!%g|o_FGc6RXG@$Ho7aPy0h|GEUrc;yx?? za^k8J*POWI#APQe`80Wh{fZOY`WdH5zM*;Di5pJbVew5TZaHyV?JJT`>)qOvI=@yd zzt%Fpc9;IR{Kg0$IPs9-b0;1-@mP+O;osCJPCS)m!%8VWkYBq`MggPk3n%_@;$LnO zzH}PTv;}0lc*10H!s^6pC*C+=bHdIJgHAXIPA6PWB+QSSj@Jnv!9&f@UHHiXYK;O~ zSDGOw!gM0km=jTg>~|&$UNPKJKzr-NJ13I5kj#bmPWi<-e0Jgsvmc!Js9N1BpnX#O zrho<)61j{8pM;v&h2{l~YT&Ma;%WOIqF4B2gP|L8zl+lGu^s`bkQ?pQC7u4bkX*mjM*<8p@ zr+y)0NL>qQxm?KYLOmDiyO76)ye^bs{$C(^@d)n_G!@^k1_ zU8v?l9fsAZHK|fuL#B(DPc0W})2tRVt|l`(sp~Qx-{mpAfeQ^?=v>Q)*mct%VCM$sMSzTxjD$TXJh^rNYL+wj;NvHt1wrN1f<*bfFW?kqo=K(9MN` zbfl)c3w>PZ>p~9~db-eyXS}z{W@wUf0b5CBKNtEdU*7Z7r3y{g+=6pEIT?OeyIz~ zT*ec&l`br2N(R4zaFR7osNc$!NLb^-S{L@Yu-}F6Tv+GA_bgsd-6ZSKg$=5ojf6SN z;TzKfhDHl$=@Rytd7X0eM z1;QB@&Juoe;XL6S)l<~?x`Fg8e^b6l=XV$WaN$p~`1y-z$%=hF#>+0;aN(v4SD3v@ zz2?GoLcL;Ifp3h9NVZ!p+*Li?cHxfV{>8L=s#Y<%^^G@<{f!H6UFhgWCpX^7l9QXH8+qLL z&xH?i$95y0-#z*0LSlk6`NU2>Q@>EbR3fUWxRyj!CM6_uBe`-+Zah40>^FrQDc#6M zUvnds8yQtiYC>9S8fwwv#tBVFPEXC?MpK%Z7)mxXA&VPXl{2QemYtk~np63?+{Ue2 z{)m&;jeKrYcB2YY`Kd*y1*iq7g{Xz8n~G~i-6%#b?nY@h%D7R2p^TxV8>JMVF0Pd& zSD=slNcNwo)>bOyt zemghnxlvzc!;NNcG@#jtDrF7b#$QEcYwSi7vY4`oBNtI~H(I*U%8eFoBa}^EwY7Gm zjT>#bcUhSUzCglfAf;`4H#)F?dBae`&Te#ZV~!hh-RSB@H@EycD<-rUA`?MI+!Wpp)3|> z7-2ZIZV7E9VU)^_c4LeiV;PQfV`>R)ybP5cN?QphF*Th!nL34PWC_#U#$%R*vVB8m zh8r^pvsC45!s-&*JU8ac*>Pis8w=c6=*D+$taD?L8;jleR@Eqge081~<0T*{CWv6E?a3?;V~kZfsTAZ3OuPiX4%=BerR4pH~Gv6ryVjRS=JRB82&yFTc~4|LL&{CcN7>_);z(52?68$ZisSW-LY z#&KE6>SJs_vB?QHZnsS#Wxp`&Z#V7+r``C~jdUTT58;d(XJt+L(bA9K+&Je(AukGh zzNEz8)AzudUw#$`92)4$@zRX6UsagX6O zH*OKGQ>EbzH*PAfcp?5a`Hpg`mei!?z8g=J^FZ!kZaiZ6*p0uHf4hT8DqEM-o+{@V zq1-yt3pf68<6nk$>Pt6tH_WQiO0c*wn7fmHY_e<=JKS)pN~!U<;dSGa8=vLS?j-lQ z5p&~}8-6)_`4tE^g7iafLEX=(Sv**WG<~`@}R+dQx59A zQd(vYvUrfygKQp1n4Kyh?_|!|8ZVVOS((d&+#cj1=T&VbE8DA5T7C}-cu>%TLLQVX ztrhd2Fl!`Rgsl=fEJ{;)F781IR+gleqP8!s$tKOmzcrQhpqvNgJ(yNnTTxo8;6X(X zs(4VTDtS=Z1MyFm)`F$A)Md0{Wwdt#Q&#iHcWq4dJ*e(MoibVt4{CZav5Zzr zLJ#VaYkRP!j4@H-*Q0Z|j3$nR@{i%JmC+h`&{(b%4}SNci3d$RnBu`y51M(<+=DJ2 zboCe)P77*#YD*7VdC=N}HVhqQjK$xUEYQv)|HZ>ttT>|xLp>Pg!Eg^o zD1RiO<*0b6xzNgJJKBRWG{>r%Qf0OAiYE{zdN4^jlL>=1#ZU8Kx(7Qw*yX`D9?bAy ztq0%90)Co&rUwf>SmePh4`zEXhvt0hTi@8;Wco)`_D2tnk~5bx z4qUe54CPo(c;xrY@r$bb&4ZI3oML#Idd7oa33b`_tg7r(PCG|FPrac073H))JowXt z4>BYV{_-Gy|CD#-+V|j+Tx-qaE_-mrgR62-<+N+%w3~8A;w|MmRW6?!gr(NxwC!_rT%70}md0U@NE1n2_?32ai4Y+k+<_`N?$r%QU84 z3Ss$8c&7&e5Av4RTpqYR@UY%T^-}-bWBhWC|NnD>9)x7S9z;BN?ZF!lOFKDY zWZBUx1(nMiH_5ji`JolOr`f5zCdFdP_MhC-3dRY1^5C-vIlQRYKJJU$_Pt2$MH(*> zd9kW*Tyif=ULm51L)P=&E|?CY;OYxhI`IUi9^%m&*3`8lOX!Y(Fph z(;OsAMP&!d;JHUB=v7f0?8Oi-CM)OLirR25MtCv9iaf)CFFg-D}L=B8Hzjn-&wk9cY-#yjaO_IaQn$UMzZK4B%Vktnwnjk*x7zt*lAq zZy>CruBRrcWK8Bp@+NBTO4?R0w#hSRFD`ho-HY$(pYUP_VXqha2s^2}sJp3qyr|9& z_j_@`i=#9TQV&yqpvoQ(5&Blrjwt6x!putAF~V`>|K!D>=Ej=&*^6JiIH~+Igj3Yh zUi_;3J(aYxihuLs9QhVUby3)hM_xSk;twzW^x}>ecfI(FHCMg3M!4j~WrFPVip(V2 zURTa7FK#HlDYvr9#stcCTdrlr_q=$ZYVH#nG4)WUWxa6{|EBp;)jaXysTa=}KBxXe zeId(L_4%(CYsflNW-lyWSjp0%U2bLMBdXrv#Y3{&3y)mUK6LWI>xIvYJU-<0!7qpA z#V0R5%Z<^CkQeXRLzwzX^&IgcsyIe4v)k9?H`KRY{HON&UYOPM=KFm)B}ix==A zwGU~0#$7Ry4{?OVJ|yuWDOvpFgk(Mxs$$HoN%_VL0dfi-Qu?4NKNX<^i>FZ2`jEwk ztUjdkA-xY7SdfXDk-Cj#(s^cva!birz*uA1e8}!Y4w|{BIjO&^`rJO4$@zT9??W?Y z3;0mbhsr)wkum#F*oQJcl=Yzqv&DTVK`2Ts=EHmTP?DkSv=kv}Rjssg3RE=?yd1-d zK9na^pf+JjvXx}U$W?u)=0jZ{>an0YwU!Sx2sNovpQW# zJ`C|;s1L(fFqS&phmk&v@?iwS2kMAM`yksGny;&BvdI9(F&s~oFhw=PoaDn)AEx;* znZBIIDTIR6wCRMI)NiO#KZ8(>ZD;u~o8h6Z#(iL(5A%Ik?ZX{E|#S}ETg$nW{h2lx!i{ps?y!Z^sVAmKD6&-%=TIzzVl%>{dGR9Cv2r|pl+gW z^g)h7>Nisbwh(4l)3*7rUAAi4_de{Txr16}yV1XFyBJ=ortR@zFL@vJpbz^A2dGw# z`3LeLsfx*pr^&xk&rq{gH%^mmzxi-ZRi5{uH2sUp`JM2G4}U7B6$>u=@Q}_GAFldv&4=p@ z@A+`Uhnqg!QT4ZcxJ~Y__9)YGm(DlJx$naRRqwlPdPIJ#oWBWAWa?P|+=mxFy!PP@ z{eOJ0`{3~5UxqJz&_-wmvigzDkEDJi^CPt%Y5Yje0;x&ihlw1goOnOvO*2WQq@z(&sjPg0QBr9cX7nSS z^3xMC_%Vee&%`h@H4Aks{p{pC)Ev~DROvI9AGyh=dl*-4UO)0N%wVb#RJ(T@&(bo67t9|!#Cgz{8a(_Pt5e87D za-bjQ*j9KjP5E}%Fh7R-G0~4nevI&Aq#xr{{V2j%>S#a4DF0baEm18kLoH(%eb;al((E{rFL}J?h6XKaMkO%;rClSA8-4;>TDzC+W;0Z(fk{ zSBB@QXQ;CGv+`E}#pmRrTM;kj1wSsz>h=Ss4tkZ`5{O8k01Z~@sf`0(c*{hhgnQk%0d#;s7rjXF?hr7@k zFOG?RiU8sW;=~i$vEX^J6dJ=+0i+IKNq1A40Dh>Wovov#Ww^YKCT0fK^qU4yEnqCy zS^?A!pgK*dtPwy>a>Aulhg?5^1_9JnHT4McJ2q0^Fo4F&Z$#)(S8Jl2RV#Q8sjIaJ z$bX%~vd1nAr`wI5 zy9Q8ko^hS_2%snZe$-ynz5(NnIG zROx4C0J9YLWy3iE%vH|30Ol*6Q%_q&ULL@T02V8M31Mjf%apUHp0<+w9rfD)RuNVQ zuvXQq3E+V`I=R)X3t&A{8>pKC*hqM-YBn>>QD55@z;;UjRP_aFpSG>JI@NAjk|H44`5Cuk(B;fWyi^!lf$(vKNxeM08XgN&BcvXdNP1tm2)b9(~4^jh(8m+S%z|?zbU_0eeHYz7Z_d);7{fM z9>5=Dx$`IN{jUHn(Mg%s7|hiGt_AQYfX6hiQ*Q@wgCGSr1GtrtVh?u$xEsJdI`>tL zJdJsv_#t7#PSf9n=gNN)z*F)w<;a}8Q2YcLCc!qX85Aguf#AtZCoR7Ckvf;^FU9l#s1{EYZp z!hZpL2;f}+?`8S%7V)0eoi7Cu+ijrp((HhL`JWiGp8eJ~1H)RW8QlL72#? zf`}u;Q$1?^q+pnmDnDQTj(+MO($Gmu%@9O7LV9Zc24B}+MuwS!s7@zq5ZQt#9z=;C zvNM&ND&x!%L{4%p<;cRw6GYx1@&%DUh$8e0Pz$M=fum6`lVI9OlCQ9C2D!)R|ujadAjPMau8MMR1Kn95D6E^MrLaUQ7ecIL2L}7 zb`W)fm>9&QAnFEDFNkhIbPu9_5DkK87DV$P8nU0JYF~|lXsoyi;XJ!_H_%!H(K3kk za+pE1VyX?bwW^n^PmZ^35Xl>A?P%s~sC87?EH*>P)J1nEAX(p5F@0rL!Q2g+a_y+4(^vOqUca3Swyx%a~eBT@o~2HA_l1Sz59s z@X8>*BY#U>6~yWw)~Ia44Q(yM2Ry)aL9AC=!d zZV>l^u*wZNi2Ka`OMMW;!yq07@i>U*beab7cMwm>PlAwZO12B^$S)F@8f&Dz zB*-3hf|+Werf96$<>ntmB#3Ab&LCX$gVK2r9&&){rTVEpYO5}Bg&TjJw}e}FD2Omq zvai;SwOA0Zg7`$|br5fY_&|QEYTgsx$$FS&l7G4NpYn&W+mAskAbbwuOArVlQ3y%- zj)C-_ID{l*dD1T7udFQB(Rd+~T-BIDh*KONLJD$9# zA!7*nBFG;>rVuiR@Mj2rg^(qLtRXB8VMz$tLh=uM(LaO%A>;@lX9&$g@^5XCD}>x3 z)Ci$w2zf%t8$zX!@sn}+LdYLNS#p683KEKkP>4{3T9_)u2MZcaiZUz~!qdi@ge4f3 z453sArO9QeW@eK#F=}Kh7eaaZ6{zA=452Wym6cP4P?cJZT0MkKCyeH@)uPiNgxUmg z>JaLNP)|AaL+HXj8`5c{{Kg?PAvdM=VNHt=S~BbzLMuWCs`T7Cgf@!X6555(UO7vf zXdTI&Lg-BBLhTkpS5@<*0=koXD92JJu9xE8gg(^1)P7Vs-hm+uB2T9drcMZ9NC-ni z7{+ikbvShdRmMCrgi+)*YR<%3QKL`t(YL`N|ELTk!o5Q#g!qpHu zhS4dEYav{hdrlZB!?+Q`%@BMc_(QlA!tD_L3E|%m?u2kRgeS79pCrFW6?hoJeewh9 z<@84Ok;*3%GS0nUprqxhRO+qcI45@Ay^}=WxMzb*L(`-y_Ky65sy*DCEY^F6K zEaYIChtVR8cB-Z&p-mXA2(6WWgvD*cUuQsiYtK{%>eh_tOz0oR0792Ax)QpD(LIbF z&w1Hs^3geqFW`r@A=CCk^6NZE_lpueAldfbN!Eizt zBf}UK#%P9PsgfNNhNFuq%%d0=#(4U2;!Mr8iD67)I5~`|s(wlsg_>(!nrqYOOjo{q z?pJ!78OG8umW44ZjM-t#VRn8P3kY+=n5XJx%^Wo$VUP>MSQN(MFyzk)31eQOmY;;n z!&ni<%CK?0OZctoVOKaGEn!)1 z31e#*u`phRu`P`4VLS-qVHn?su_KIQVH^)*XBfM}_#upGMdD=J9mWC0dkA~O^6%!2 z?0)5U@y8z|&z31-t3zQNR@ozA{762koVCrhpJe*vW^1X{BsZbfilBA`byT)N1a-;v zsP&a!wWZO2Lxzp0jj2O>$2BE1qe@Nl2wIR^DyLCPtxW`N8BU6zT?FkT=o3L-IvuDz zBIroy6hY?*x{$k3yHY1{0MdW=2#zW489^^*#qUkH*;4BlL4Wet2nIwjFoF@PW)NX$ z1cM1fs6o}+Fowe;sC?1*)80siqaqj`LF!gt|K2wyg2>#Il9g>-1mjsFJRyRKBYDNSzBY0gG_1S8U^5;h|mpqT!Q|*001Pc>1gj(1AHjhL*04qjHbk&i@ppuE)b$a_BuK%=2sRNm zN3cDD?<3g4P*PhX*hb!^#vAeMU{R&wbHIca5aL55j>)KErQ!Bd!2A2f}6^@ zMMya6JLJ0&+>7A8oX2}#KS%L^e&N=}DSJ$QLH(Qhg!+{FEQ03*`Hf8}{)hZ;1TQ1d zBQQr`r6Z{ptu+f-KtdbYuCl+qGPz`OWb&gp6on@OZv;J~=oN)80>9j0q9_+dAc9~7 z8KcM)MJR%B1j(XE9z}%xypfxH1kng$3}4A&TYdC~`-Uhhbi7 z{wVShr0p;4vp^J&2!*34!c+-rQEG8&F=~)yY1(QfqbLMQu8jsnw`es8yq1KPxB=tJA3wMTa}dYm(Qt)#^l1H;Tql zG@(Vr&%S zWX_pwOPvtKL}n*NF)fPeQA}nyg*ufg{m*WveG|ouDCR0>W)!m(&x+!E_BMyk8S*^x zeCn)LDIc`c7Dcf*iY;`OM6r~xhPsTpB8ue%*<-@wuVnab6sw|GO`bK`INm@zZEY0a zMX^rRZzQabVuNzhw%0b1H&ctXH|At(6x*WME(4BYZxs8Y*um^>>Q1VZ?TSL03+$oO zS-v?q(X?M>4-hu+1A7PMTGNdo9ggCN++<=f#qeVkN27Qg#otjJi{f|`zeRD5t$vE) zl#Nfb|`h(-~M;+d31;brPY6#qnFi^3kozjVyhmsIINC&YCyI zbeyVwg%57U9)kS2!AJ1RLjWO24a=hdLHa4(L5nEv)>Xx7m%F!<# zL&+FQkxNjAb=2hRA*Ev|6N7wmJK?J$(lFs8+~s4az_K~)P5g>6$Vbfus>F=1mkQL4 zp=u1(VyGTN4HnmqVFT-HGL)KHgp(b$Ix>O$IPOOl)T3WNh6buqo~cTG;}|-{&^d-C zF*IeWSqyDrXd6TG7+TP28AEH;s+A0eQzUI=DYm2EL1o*=jO#*DvUQB1DDM(oV(1#f zpcn?n(2bS7V(1-1ch#x~p(i!(e&cbW54nE~eN|1r802eik{Y0#fidLhWH>`&7#hRa z7{@+2E+_zL=;g06Hyf1*`3Yv-Klkd-~XLD_uRTw-P6psmGw-C= zFj@}{^$el1)hL*gV>} z28KqmIIA$UEQIAD>95!tdG4n}pZ#^W}gU}J3DVdH)q{nvME48rXQWJ7@x3 z@`l;`CLCWI6KqVh(ac738{KX6ura!cX_Ke=?YF_l<$BHoDn(@0B3kpI-@5>B+9B z6C7q^IQ!E^ZySAV^yR8+pfJR4s(HS=vaO$}{r3L7gq_v!{|>us#EvD(HORo2>Ar=)5#)1jGR!dOL;4K_ArOKodr zw%FLpfexct7=JV~+iZMn;}aX(ZG2EB{|*~FIXX6Wb6jk^&pqW4VdJokH@RXoH~V-< zHa7>A@3(P4UFsAMsYr$HTQ&;J&aK|u9I^4X@^=)=H#ZsmUCz4Z=BOfnd+pKOe88j3 z#z$GC!n+P=B*$zVxACiu-)wwp<1-r<_UE0n@j2&7bMv*0+4Xb3urYQk{gMH^NazA!G?xNPHZ9>QGWT9_*~ zI<+u=D!;0DwqlUVH5-3v=;P+ObpPS9ZzINo&PK?F%?ZP$tWuB`=K7!I3tAW|yA`9{ z@mwzklI*jGMzK97et{0%4di z3WO01XpXlX(%%^j@_bM6eIL>TY3GLN(} z#lxuI%FI??G7OSytxV}K%7pQF7*B+8cNk?!TA0e*m)7QhHw4w!g!h;6-Ko%UJB#cFrEv8n|Oh3VCBjuwJ{uSiXGZ`$dVIgA5y0{kZz6kpYXHN$v~JDbfs(8iomUOS9BVKfY*k@js}#rk2? z3wsOxKW)6v%?2ux+}_sfVUB)dRY;m}r`j6Mlja=y)A{;@(Kn11VYF1Ym13tbS}XBZ z^)TA9<}li2l@3bUhf%p>9uqod_3CX+XHKCox~kGMj9yB*DRx)v!Ft+yt8Q zq+b~Q!x$09$S?+I@-W4Lip&|LWN;WmvdYjf=4cJWv&yeyF-rM_tTI~37{#%Qk)h3L~VQdIvV;G->@p%}Vctn>D?o-^XxFw9O zVQdRyySjT6cPQ>;k+$B$__SSN>{gNdtcrWpWx{^W#xM@5`(7CDhjEB2iMnrw@m3gb zbK1`gu;4o?zN<+0NEo?q=)?Z1+^GBm<)0{isJ;4;@{bi+>WMeZu`E9x#-~}{{0;L( z7+;3*V;Db$@s;YQ6u-{qoCxEaEI%2>w^`on4fCDy@3YEjB|j*h31hmp?dNRtHzj8k z&ncc){3VQEl`PTx-<7k?fACWv%P+DgHF_nCt6Xg&s1U)QVO(QxM36s%zry%C3`8Ii z{1yma=c>XrutSjipD_LndtylO-p4%t$r~md1~C$bql7#fMof7;jD(V;Vp=g3#`kX+ zrn%~p(6u7)MZnXHd=dCb^o%-RJChT^A8!~MmE!G8AcC6hOi+wsBDgbxTOznMg4?u)+ao9%L6Pj%*R}ID zdWR~+j9WZ{5)qV&pfpR>LCFa2()=QIJeSBKWg?*69l_AMgGbvLB8|#D5&YQBgxZ;M z5!@RA$$g6VM^HWjwD&@^Irjt~jG$r!bt9-3L8S;PNAOYv)g!19!Lxq{9*^LO2p(x~ z9*W>$5^X@^_Fiirjez7aMY>N$@KgjJwKwP6o2MgqMl)YvB}y({$X_*r=alzoZx*#T zRGyFUh2i;GmiA%<)ig>@@#P3=L{KN<-2wgzXGjP0dIY=+>s9476)CA3%6d;J7c-l z!8@tw7D4w2!W~SH2zn{$8Ns}ly#eJF0P4L}B<~mT-s*WMg2NH?k6=Iq10xs|!L$gb zM=&^oA#8a^Z-0kIFf4-coNOJ<@Q8Qg4Q*@$BO(~7?x+aHWcASz6z=HV;gh*VXPoML z^j^UU$|puJNy+30resU;#Z4?SHG;>r?2HIzMzAJ=wGqtXZfe?+2<9kRpg1>Mc3uSY zmG{%K3$ywnC5t0itUBvo8o{y%maD!(adiYMBUq(;Z%0F8TBh;qIL|wp%@J%-vR-jR z1RIqwv?+prI~tO$5ftiV_Hr_GGTYdz5$uRyX9RmxXJ}UhyOrPD$vm${kw$T!mf9b| z0VM|&IaoB-_VibIZ*p@H{1m}k5xgD2I}sd-;OhuxbTaQoa5REXBls+W_ab;-r_e_c ze4yk*Mb>k9w>SE|I+>3n_#}d3svlRpT0f7`Ov2~c{I4Rov>RV2eyQUBa!y3>O#~;o z(K^BJ6~9$HrTCrV=1$%_%4nz6{Xy}J;*e0_XHM4$5)mXLI2Z9=y?7;ps}Y=6PWP7x ze&wPa!S7r%RlKBlLGhwu=B1$TcQTjNWvP0pygwtjrfx*>uL%B8@^?1pIuA5`z2U#A zgd(t&eBH@}xdinJkgzI8#b~xvEP}Z5h(=Qpq`5ddDD1%Ha_1nQgMj1pus8_4oA-EU zV>$3S@H@y+{pQYw#sn%vUg-)tnBCbJ2e}S@s}szxn5XzgXG5icgBu(abiCK>({6N7 zNco=5o=dwa>u#Qvdy9kOj@Og7I=Ib25#>c4oapTB&h6^**XKJN6mxK=y3`rXB#`sJ z*xcoyl!K?Dcsh#G4$3&#<6y6YyB(Bu(9=OL2lqHA=b(;*x(@DTJ&t!mTh+n+4$3=t z+`$tL_{Po$98_`ekn#!+9&}LAK_zviaiDURkTaR~uqux#KBAe-c}(3*sVBAHo^tTC zlDKx}GrA+}PujB%p3~6nUA%sN-oXnFUUX2+!D|kl>|$PWP~Gvaa=hx`WhLaVXptJ~ zveW>*3{q2Fid0zebuC`YL2V`c6sB0uL4Edr{k#qi8aQa^ppk>d4q_dHe9g}5Y(v37 z6V8hI!DbGcJE&O?O&wgV>nSZ9B--S*R&1%*N|E9lT@0~}gSHMb;u{)jr`X=XWKHPk zpp%0QUCf7F%r9L`X9ryzq`H`{4!Sw$?to$s2e)@M6v-d%>S1q(Pgh~3gH;atI_T$M znuF;M`a2llV3>pXUA?Xw$nouJT6Z;r99)a$4R$cZ!BFMf3K=RilHm?UI2h?*l!FNl zCOR1H;O(wv9Op)-z!(Q()#Y8^Uv)Lq$EzMzK1oAU6elY(;r?!3+EjHv?&iJ7u}L>G z!@*1kvv{yL-UX1}-OL;Za~&*ku++gkw%NfV2a6pn;8Zl;$Nj=AA*YhjGe~!tgXIoZ z=-@JwI@A6ubvoZ_2X}Qh8~H83!IW<1i*9DEgLMu_*0aNv{MF6S=x%bb*}=2j%@zkc z*q_}E`Bn$pR3zW-poNM%bt}8r&hBP+2D=;beGc|J_>+C>;DCdJ4o*Ax!NDO1haDVs z@ScM=9USj&-r~X4!=Q&L+{4uFVcvG|j@EfZ@m)<<1r=EuTDODQwG~X-9h^zk&o^kk;NAP#WA07PU;AaPC)usN6l5>jZ6=(G{zbg4n zkvXe+nu@i8e>k|{;G%;|T#Gsx+GPhvdK$M@{wqqZDpIHTmxI3@RF0xb6xSX6!^0tp zqETF^7yQ>jlr7|1?ck4|#&!@^5^>=4G>&qQ^fZjddFXK+j-pT$Ngicf)uSlY%kYY2 z+JPu{9Uv=G=b5<`g-?~Ly$mgrpA$vCsCTK834thr%5xR-E9NO0#R7^sa={y; zxJm20MU|Ts3rCUJIvc>`TcfxwiXxeWia{zgHsFpZibe5lFY`bYcScb>ihH6M(#!jF zD8V|p;73t1>V1OH?uw$hhRUc?Hmlzq1%E)#JBm6{w27iEN3cO&-6)zw(KL#BQPkI+Z4gDHC>lo5 zskg}>dw{&LM)^;Uru8<>qFCMAw2Xqhxnc`NX13B$YenWz+27lo?QNpvg3;cleH3@} zF`N#rGvC-QA|-jRq@rnhT`-nW~e(e zii}Q?p*c~^jbg$7$)6X+{3w`4V-9iQ|A{W)K1Q*MeXC=!EQ%FTtW>^SIeU9hU$4)p z6W2t&7qipWtGiZl9XFvl)Hg)2F^Wy9XEIr8EBhgeLs1;&aa1F?T`M^d#f~U;MzJf3 z-8>}E=GzwquQ%?AVr^eTLffkfT}Jn_VFLmrto9%WU7K;ZuX&U0f7!gHhvAvNrg-b% z+flp|#gQo9jpAq&??>@L6z^%1_yy44&oj2FRF*LGaTK3$SYs#@!?7riNAWig#wb3G z;_O zMK=n>ATd}myfwg_8sJ^Jk85#X48a)g8t7H!k0B?9d@-**ff#5cw6bM`xiRFAAur}# z9V(zmVq&;=pm(w8hOF}3KyzaZH^uN+43Ecfa}0%JxF?2kG29Zvtud_Wo`3y7@2l%= zG29VDv6%NIy+{nVD&wUSaXlvagB2B>m(3}s{9 z130XK_FZAz8^hG5!JI*+N(@(<1n!IB{us*Zu00S#g%}=;f$wc-dKQ;91uMo-DTc}# zz7nD?0d|q+FN8VM17nN7zh}84C=;fGqGD)j9$kd48l^9-C@Bq zF^r6%V+@^Q;B*}nLuV!AJ!0q*LsxEnus4&tsoq_Y8>K?)8AGoaddJWwhQ2XWDH0eE z!^FX+pN>d>#dU+thl9;&E7D9%Q%*fGqA zVRQ^*Vi>E+L`8>{H5bs~E%#C55wugLv3=6WHX;c<-t&8D!3`=5I8pE;}mdCIqhOIHI zh+!p1VW?RjLy4j0p`m6K2ef)%H4i1NWNi$zbuqj+)Y~YHWP=vjsJKayHEfRIvqiZi zeTSNDG3@4H62o@(vno4c*qPg4|f7B?_ zGNVayeVCb3GkEK8V{=g*Zu;)ebz+Fduq%$;al|+TF+3l~3vnc3NXAe!jyvK=#gOKr z9YfB69Box>9!Ea)N480LYI~6-CwpZ*B2NM|WsMtx7Zbs~)Zl)#O;^>}@_K2frmNVKXj=t(nild*B zp>YgT(qC~v90QdMies>nA=&M+ZJGLqt3H;qMaf7-wq#TsqvK%Cn5>d%+qgK!t1>}x zqGG11$#G1HW2!2%+RaI&TlhaU_m+ zxkSYAmMR~NG_<$lAikr@nUUsb9Ph<(EROBfgYPpG$47B|90yM=K8)kkD;}ZowFb0L zv{XhpUOjj`j!!l7vp5)H0!2o@jN_{~evIR%IKGbKL>%A8aXJoXr1?hi+c-|@nnq>B zW2%fYzq0ZAs?y)$_+9Jd zOA%T8wNd6`9GBwwGmdLG)SEZ<8?VKP(>8oDDiY0Jo0>xFoD}hoTynLw)q9!z*= zhL0xjSOOK5S5mC3SVi$6#fKAkL`i`$-kIS8V@!=P=J5pTB~U+sClYuvfu|C9I)NGq zypq5(2|Sy?iwRUqpx+qtTmsK4A+M^0t2+4$?0F?GB~U#9x-Tm-l!;Oyc~#S1OW^ec zSiGhpL$y?|!_)o*7LGBs)y7ahHGyskbXU$&Jrn4W<-870g+E^RPN0v9eH8~O_Di6DHgiA%1C?iru+(66 zhbXen;R%dLpwM{ZOJZaKqY~Je;Ft8^=mf?jup)t#35;bY7c+Abn47@31jZ*YA%Ter z%+L;;l)&T!rX?_4-6;u7O@QkUm!18udLPG|S_H_sf{}Cinwh{X&7?A02@|+daTD_r zSftyUulfQ`kF)s}DrZ?PWs4J7qAvf9)Y1f&C9qtLQLc@wgd19w!0H6HXgzB373C4s96{FcD)oLb||MXl$L1TG}Nd{)Ix zXUL@lE+@cEWZM7MIP+%$-1@Zy{z`!T^W!+Lseg0**GgEHjbT1XC;>ZxR08P)!U;qY zh-Y)01fmJVbaP$%1h~0O*RfP0fn)+~JS!oxd9H4VAxQ#BFgY_oOt6y3bgw^&oTRr5 z=1bxRC4nS@N#rW0UO-9yB=VG)tp3b+^HWW4aVVHXp(Jip{T9WW6mQOE7EYqucyHOH z-KyekNfc2sQ}sKND3-+gNqmsRokcx$s}G%qIwc{B~dDg$C7wFiM8WR z=_JZ0abmnFlf>Oglue>dsUYp%B<@jOE~`u~9=tEh?^m*Gy!my!c_4`jNj#WDMfOY* z4<+$1yJCWI>jo+(QHA|8!IV??wF%~tBpyxTEp=CUK8Y7pG!sqbiRQ&5swHu)L!KFxmzv=H$oO&+HIitO zMAIZ*Va-YJ&Z5RFHPO^eV#-8QH;LDhcs+>@6HP6}+DQzWXz12amxOM;BCdrO)@nD zfj-*izDe{;qTZzcYNI=lMUvQ;#Qr1(CozP*k;GKuBr`OLF-eR~V&x<=EQ#Ssj7Z|h zBr`IJQAvze&Nh%_+Q!hhr1ve1A9=+p1ji>aA&H5qOjewv$b@evnah*B;hUDk^d#0L zu|A0zNz6=QaS}_Cn3crrBzQa70-_S~c}nIgT9dt-&E_lrc~XFUq4GtFcWHE~@)e59 zl31>UnNy>Il}W5hVznx3IQf-SnQWfe=vCEiU+!KvP=B)7ki?E84oo&1lh~BR<|MWx zu`P+M|HruR{U&?;xjowtD<+$Zlg-W~b|tYpi9JcsrR`PXD9@W>4)9={VkX}od^?GQ zoQlN^?NAbjv;0jS9a&y+ig|~J$ze(adCDczU`8J7D zS>?zS^PLtv&Dq|`{GfP7@y8^7O5$hbXL;}@5t-usj7z(Hs(E;-NBEun*Cg&pp;!vP zCGk5ad=eLuuu|})a50HXN!Uq*lgL*#a5;&;lK4A`D@j~U;!hQ?DKc7bsv&k)ysqNE zN&J(Ij-F~l%2#MYM0qTUcoL5CsN$iiX5?SNgz{7p=_HcMS@YTD0arOvkQ8!OUJCV9$sExPHR2SVY$!I?p3Fq~6Fk4;W4brDc?qsX z3N6{54rX8qtx{;sUg~SQq|hdXwygI1e4W{u4TB}7>$03eyA;}|&_OHY=yYU{X{b|H zq03Tjr<<-RbW5ST>Z_-l-YN7*p=S!cRLLM~m^t0_QKfGR{n*sUP5%@IC?RJ8jbu;? zgHsryO&y`gHV@@Y$nxQAN%j}{ktvK)eY9dzz29|Q3gc5aoWh$aOh{p33QJR1mcpbI zCZ{kng;^;~N#Wz^W@-v+FXjC<-P|(6Oyj)L>v+?Z%;1!p;e9&fM9^%8nVmwRVSza* z%uQil3iDIgJi{zXVF5QW!_e6Hg}QfZ-^xdq(Z!mxM6t`-+~vIaKZUI+Y)fHf3ae7y z6&Q}oYAwZIZ#Sl}hV9|}Phq`^{W}CUa2lwwe!4{dtiOqMra-bqk%R-WJ>~sN@f|7b zOyPqWhHuZ{ud%yQ-n}JNW}4k8>`7s73j0#{X@)tN!hR(Olq6;tiZl}Hhcr}prgVBfV~XwD zdjBN)vlKp8_hbrRWb?mH;ma)lN=Z+x;e_&UIJMOMHic6h%9-Z76izGoUXjY?nTGg- zx}VH6yupLb{yBxSDg4R+%>!le{0t9UiLzFpzW*Ok1mDt~cVuSdN$|Z6#mKbm2Cncyf zA(D-*nq~N^oSm~wEalx)zz5&rDI`)za=Dw4%Ln305A}$f0@Ape#-C|O8de%lr}0c0 zzBK%4JetO1Y2>7lFO7TBD3`_$vrHh3LTTKXMlg-sG^XSF}+?vMiBx&51Mv*jLXpl>hcB*dh z4ox60ro=znke8cnN~BRTjWTK6oyJ{hl+tKvmeqt-v(1FrCX>v3>cp~XtkfuPp1(JZ z2hymJ#(imgSlQg4_C7w!D`uV`p!;AN52d}c_upolifL3zqjDPL4AH76=M!oVYtAEz zyoG~({&*VhY(sl0jVH4F$ut@q2vFqDZ9H{(HjU@fIL;19qiPz@r!gsw$!vcbFQ(C! zElHzV8ZWU_8V%E^p2o{*yq3o6th0rwq4=ueD`^y)V=Bxsb7tkQ$;>&13ANIwt?j%kuc>-o9O(%3)8G*zTX<4qdG zmW*l|-BxMu9)5~#RQX!d+NIGxjoxYWNuxs=9npfmJXBNWTG4luNJu3@x%gTUxC#-uTU^IxBB9Gk|tG{&dFXBINb zr*pj>kIpp{HHU85d1eYHc^aG2*qp|+G^VGqIE^K2Nu}V7G-jnSJB^v@7STr<=WuA| znfYlfNMmjq^VF?fF^^*Zd4{+!jYTT9?hxQ(2uoC4n#Qs;)~2zJEpKg>a|F{^mBtEn zsqCHSJu0|b-8Jmq-g$JtoM*1iGwajdBZ?aoN%#;`^)_ZBH_^uMy{22z*qX+nG!Cb+ zEsgCQWo_+_GxcX2o0pXA(_VVic#jQouMcSPgNmKzn>W*V zEA2hs`e7Pxr}0i2N7HyOjUze)?<$U+Z*F+k8;i_fy`RPhs?VEm4$Sw4uhIG7M{Iu@ zpJ-K0KFK@ALC-Vi=Nmrm%E~`W63jEBep2n|flwV+I=hFBkvu-Rf z=T+qIqrku;pF5>*mor`7dt)}kfSNUE4pOe>CE;N8t7 zE-V+fxVTm8_qizG;szIf7dbBSxd^z(b&+4AK^I506bmj~VDemizrYv`T~nQIW{U+? zyvao&B@}OTaq~hidUIAOtc1H=M z&D=Lt%Jmj=-bU4Fp(*3yZWm>F{_mok3tsI!SkT<-;yxD@T~u;0Y@xZ|MR^wwxY)4J z8@LKe9(3_$Bd;FbU`hQ;4OMpWkc)?1RMAa%quen_d&I?~?5_5?*pEfORjfn z&4liYyl>xi7nvF^UUAXbMH3gVx~S=*@M2TX#q34qtwrWF7e6dAue;!X@~Y*cwu?H- z>nc)o78x4J;AC!n*E^GGpxDqwBPC@Q8;VU`G-LCY=Js;Y+(io)on2ns2-I9`TCyiy zv~|&nTVHHiXK=A0f5SyP7ad%5A3+#iomkt}eQ{=7kWHfNEN#fnR^QJ(5Acd^37 zO4qxijIZ5bOIEp9<6^Cg)tpXCJcYZwj>l~M;Ki1~?Jm}HKD+3##B5aD;$o8$Dx29$ z4T2tdga{Voo;IO(FsQghJ7As5G8 zeCpybj~y59yZFGxTQ1&q@h%q)7w@>(zQi1H@zoMT%Zv_5T*dcXFvMT#dAdmPLl+;p z_*j#vGx-xuIHpR`rKa*yuaeJPeD30F7bjeN;o?ip^fvK7vc&MVJr@5)i!+olD&M*| z<>EW8U@m^t{L^fJSU1qMi_{&8J2y6b^ z#dQ~X5Ci##N2QCj3zzj=$`^7GQ)0UaD~Y&>Dq+-7vVEENsOG1qbBS?P5-yT1QZ9}S z^rJr6ouRhxeZc8mD?4c?jGPqIiE9ay907bYq%3q=5oH` zn$xzc_kN_35T13PxDc#aBCj-~klBzqkh>veA$1^iA-69#_dxE4l!ugq+za8ePQ0F6 zZMnG*(&)Y1_RGx!kP48OAvGWmLMpOnPUm|FGJLt&xZG5NywBwFrZR+B1#(f{harzZ z9)&yxsS0@>@;HQdPdx>B8uA3>N%m*Iz@o8v)(TT}g<A&+CdcR(P|N?eDU}%w1tN ztuXZ<^|?oo5s(IuhLA3huDYl1uP}`ujUi1SzpOAVAT1$Hl{ZstuIO877;Ob<4QbCu zklD{GO&dr%C2hG~$n@9qQ>1b0G?FJ)nvU9}PV5uaJ9BQo@4fNtzQU#(q&s8)WFYrz zrJ1zS^nlEL&h&)z;^0F1sM`{*Vnt10?)>Jhajb;wUdL->fu)AwwWT zA>_j#G!nLlIFgIM?)5C~=h2E26vsfuDq**egN)B|j?_fRB*Kr^~s-U&H4@=0OfX4npQb7C?5e>sFa7E6qa4BFJJ0|HTGxr@wiXSpr$D zowk&r26@Z0s^yRskd?|;DRPU=-CRBLB50h z067EUn{d8|@O>|*`R{O7c`ttPulA5uiSLx)plFn@e<{1#5YIu*b47w&=0O4Z74jS8 zcOLAky$QzG-LO3*e{lU-Z7%8{UQp!QZ>X<)3|Ammxwd=nW0pU?|G_JNvz@KYUmSFP z9b4^vtsALGa$Q6GLK=eD-kTwW-`QzlCEu;~zU|U=)V;pi<8kl49=Tnls7TVg%rE&w z0^$`+L%8ts&;393SR%KsF*Lt;;c95MED3l-SQ%Q9nb?>_OmtK#es?X#=DeZt@V&rUdeMB<&>zZq{dp) zXRUcrq?$+#kyk`s5@CnDtUXhmziU+T-laff|BPO1UKOdSd-S@x$G9X(iHHq`pW4k)|TebY~kXHWq25ggeguAvVztA>q(B7ipn0aCVIr8N<#OnIyvA8>_Q@yylM+`D~6iH%hNF z6IADQHoAO;1#z+nucu8>)}>rXG!}A=8DV{nXd^8 zL>4kM+A#Uybso~1t}{zSmWsC`t>KW(&s`?6f*aCFvYfrK&YME3)LpH(Se3mQeMatD z5nk+N@eLvy*>X#sv}6;Tw>I#J$T5-4B3neZYX2M*IV7@8WV^@?Rd$N(V%oa@KEZc$ z60S3QM1G}GFmUU7vsa|zdb3Y)zv2N!7CFqtpS7(wABwys@;0aOdh>zEJ4(pk7dfK* zUB#m!?}@ZoZ-%TlbJrUt(CB6|Se;g_k;L_Qb!ZN2$I zn6R;#`NpVX`SdweWfsN)SONwqX`7Oz_ z)_p%l(pm@OUkKB##AfrnCABQ6ZOIFkyl6?!&8C_qO{|YBbSHgYnFVo+3PWPv$=VTsbfi9OWIk|-jaHj)VJjO zEr!qBHL#?iB|Wy7)|ND~q_HI}ENN*;6K>R!X4>2RQ^?rMTTF9RNLX_#cKGBxE`ymp zrMP&DX=6!SOSUmVGpR6I@qu6mOL*;~qb2qhbHi5C$&${Nbg|^ot)@F0U`ba?x@i$A zG`c-4;Vof(Ea_`WFH3r>d%0?Naysbrk=C8M8L$-#EmVBzAEm>uklC2!Ltg>Cn z4#l08{G|E2E!ktqUKI~yGxu4tUpL1VX4-bpl0zCj%qeOK8^#9Mitku*#FA5%d}qnK zmK?R@LrXrg{x;KTn;EywyQ1~6C0|%_!-HnwHuDMR zk|oEv7u@tV^SMqNPP5OHP|1)lE%|Mm`O1>7RX<^gf4e!!<3b5Ji+rn`gzop2oVMh5 zOa8Fr2TRVdIA>kyV6js9hhNVvwcY&4ez4?cOU`n+>X^Q$H2mHeWl&UQnQMv_t3 za$d8&V97;Gu4^-fZ8w)J`IC#xDnowRk}I5A+dY0&$)fGv_p)o6@RucjD>In-vvIRe;+DKrGnlX>X-UeGG#7uL1bpIJ z0-t?rSD$nneyi8^_FPQ~d z$qhak+$(saPYU{^P_{OPSkFybicwZx*eAF6+BT z#eC94f=no`ZenYogimUe1Qps{Dwgs|>1?SoN**qbdwf#PClQ}GKDpN?_xWU%PgeWn zexH>0Nqe7k@W}%{so<09K6%+E5Bj8{PoD6}lRl~Blgi928GO_yRg^reNaZ0Vq3z}o zB?WhQ7aM7h`Q&k*@IQ)@KeNL;rO{`7@|=>V6`xUTy~9*h@`6uZ^vUzeS*l0-K&E&# zpS+~vXsvw74pYM?ulS^nPwM*QRSmtaSTkGpH6?HFFtwD_&gy#_1nc>vzE7I_q=io! z_@p8GQ=^R(8!P^%8_L`1?MqXiG-J;wr~C8SKue#r@<|(?wAJKl8fwiBRPu(3%xveA zzS&ZI158Jsbn?k$pG@&dXPkvbr(H^y#z*hxXUm@3X%_lqkx$sAi+!@pC(C`Z#3xHtVRCSnDb>{5`U;<{ z)KYvYS*D(5BXZaHWUWs=_Q@w2TIZ9^KH1`v_3CcOZe^pAO`PF4v zUhX_AL)jpM39=Q&|P`y&XL5 zlQO%#UE`C;B$alXGd}rIbDAlh^~pJ(T=L0fb62?3x~|9#{pFLtmGk4^>2Cvk3GhGaj?;QV%59&7 zm9U+k?lzI#Cd$R%C%5~Bk32tccQEdge0~Y|g*@Stq)$>lNpmRg4$^#naeV@fieD@x zxqD2>J%*Uc@vE4lxbmGq&@YefF}y-lKuNA*e#Jb$G~Qzv>X*V<@fN=@MDez4vfvR``orI%l-_~jwL)bdMhzdXze{Zid8 zFS7^y@|a(q_RBMVdE75(nn!!mFHb1nw8vzWr~I-@IWN~g>zC*K@`7KU^Gj8~cLD$S z9@Ascf4|qi=$Ai>nwM0srg&nHxwz-Q-_~oWQd992zr3m>u=l^{YwEtv-QR1jw9l>M zm%8jIzqIp9J-^iVOH;oz)0_s1js4QlFOAq*tzlrco+cVyvez{COAEiW_DdU8S}L~k zi?7aqt=+FhsBkaZDh>>o_I~N$m#*q|^h+ndbXLwBzAgN?7U_~zF7Gwn{L)?B9_-0| z-oD5_bI(50+b@0mGRZHK{nA$xhWKTul74>a@0S6}2l{1@Uj{30rp0^hGwYNLQ*oqU zMkyK288yv}P|jwI_RAQ*jQ7g~RmS>doRULY_M{>kb7h~Im~B}8{a*8?XxePQO!dn& zzf4zmrs51m=9JrSW+|__-?Y(EbNn*bFY{EK@0SJH%+C8w|NUmlezVvwOZ@VMU%vFq zQoj7zF9-Z`kZFEd;g?N*+3c5wY=mmv8)X z)-UJ$a#HiZ^UL>s`BpiTPjTjJsne>Q@ym~X`9XO-)ql!n{;Z_iK{HA9^M3ioFBklB z(J#MdbADIyn_t#x4(tCzm80rj^2-&!T=mOk70;^pr}Arl`O7aMRSF*R_TuQy|BkPJ z{NiZNzf4eKD~7o`X(p2+syu$kM3uz+5?7M&OHv7QS{yR5GC>lTQzb|8=SYc~!Rd#L zV%YnJYbEHbGKnYa_AO3GHmCBKO za->|2l+KYd8v1{9eFv}<#rO3)!0ycK_J-MP0s%oqq9Te&5EKC=gG3RKBnA)_L`4L} zh$u!x#fXZC2_re@oO8}OqbT~FIqO({RsUaA*Qs+)-@e_`)7|gwgq~6Xl=e#v|JA%B z&np8cBe9(DDq&fn_lU)C>%FHOVqUKpK$QTlQ*NaIu4cUf++f?41GrWqJ-=vcQ6afL zfT{u96hLkI1W-*5H3PUYfa>Bk0+`~rc7sT8f>&d$e0=db0o>w8zL{s_oqxta-2fU- z@YaX=0W=8Ut^hg)a9aSk%ek$vVE`=xXc<5wItWun?^h-nDtt$NOaMOx@N)oP z1~4{&uL7X>T>#@JnQ`JYzZUsM_^pty(tj@>x{VLu2cQ3_Dk$=P@h<`V8o-1A_{Qbt zNoJxta7F+#1DF)RWR8C+(}h!o(*j`P*KK%Sn8;@ZFgt+x0W1h$j=04tUI!fvZbb1%!&16a#dD2U=g ztP5a$0H*^u6TpT5HU_XSfc*h%3Se^p+XC1gz>gOdYzbhi5+6VKZIVe&_FiLQ+7ZC6 z07h4|cXTP($+d2>H#T;2^_Xn-2=@wU@=pDM01gIljB{s~)xEBLD1aG_?FK4xSp9h< zfTIEM0{HK@dY8fJc07O+@;@o0aw-7sf=F^UfZy1eLBxXiJpjIrS15?WL7WTVj{yFZ z^0$y#=L7i5=e;I-@9q@@y&}9r{Hn|%GOZx&AOhmd4U%xTimPlVh>*l^5aZ=v_;HK+ z+R4TQ5%K*`PB!r%+#oIp;=&*jL8Pacj4&yrnIiG|byG~%=eZ!7Pcd}pGsRpKM6sYZ zo-Y<&A}lIoF7>fbS~U5Epb|lp3!;1wd|;rY@UkFEiIfiF@*u7dXKoq(3Q+3yQi$eN zL6i;R3s(2F#YFNJKT#J1@mgU;VWl9h7P&@PSx6sVt0CTb*1A53szDqJ;&>1@1W_%B z2|@4)M9zyFgXkVak07cCQ6q?&LDUN3&LBDjag!YC1aY%S?I4ko3L39bClUmqW$d>0D zPoJ(*=-L@-IM1SQro@!|3`G6pvlsF`afk8YK#4|GK zFer$@K|IZd$)Cz#5f;yvrNUeWe_lmi5Ps_zrWb>FN#;=D7!`blQz?jXL3|y=@E~3b z;@u$LBe~puJ%~e7&D-K{2;byD5?MagdmY%CW<~@-d`CDkh>r)F>q^+~2T^*O`6P%> zgBTUW2buyOGFRjy;f>S08No!t2ckv?@nz6^lIpV{KIaG*r#U8w{G(G|mL8oNtE{hr z=&FLxO*7vF@k0kUN@manyTVzfUb47Md^S+Nc-_KnT z#6q7h3Sw~(OJpwP+BMxQ6DMJj$aJ$Zh*d%C;~)=Wbr5TU*vz?qhrKrF-Sb^1EHT}? z54&D`gK(p8ldxD%hq+sV*vi#!lGzr-F3#oYhJ3q}9m1VL_RsDh_z?9TA<15m#?#G# zAow8tNA1mn)4hu=2f22YvJVLl3y%no@+c~L4kv;*$(7K;r4~-<^cAtZlXzPE47czP z;x{h-K@>=5);VRJ7yc2%pCWf={@DrhFPVRH)~7s$&jt|-`DF`R$nTjMun@FhS+Ff! zpj^j7$U;UuY{6KFi${b}AwzLzyqM3cB??>%2?jY;SCBmXY`gdq;6}M2r;+FhqW1*yl%Pds0aHEA%7D`*FXrU6X|5&&} zMP?@ouCzd8*|Ji~2(J>dJ=DutC@-^uaKRnkR-8;%Tex1zHNwgkt`(^wyiT}Voyjh( zD)RZBa^3Kth$B8>q@!RLOl^G z^+mWDDf#WNHeyNTYI{7@`tDR-u&9k7+>?*UH-{;*e^zi-XPdE2kxX(ggU%B5x zFAKdbJRoJG<(-ZP#UB#(QU6e64?paedc?wv`d%mWv+$_I{=z3LJSOtE@45DXcgO=| z=Fb$nVvvQw7B04NiH)Z%JY(U6g_9PBSa_DrwlK%Sa~8HuHy>E|(8BW;UXb~sg;y-R zD*lp%p&~B}={(HBx?2s&a9xH?~1=C zd|x=qLj8JP)<+gTw(zTk2^K!F@TqdYwlG?R4qu9VCj4CZg@rL9rDk{$n8vbWrI3%a zz~Cg`Sol`tI}1Phx!;S77yiI?V5ryNpZwgPE&Ss1v-7Np;?sqbgp-9+gj0png!R;t z8R9dAvxE%ZWQLh*VV;Gx>{1K!eSMk80^vdni+p{t$Px=neWm%QUL%*wTp?U3TxDUk z$QmJi9-Cp-Ti9UXps#GSuw8tUaI>#(v9Q(W+eEH=D7-^tr-fY>c8l*5?h)=4PI|{- zMf{7o-}3%$9uQJtI%MIne8`VjI4XWjc-+^=sH09<2-w~^Vmhs?GZxNT_|3xaGS6H1 z%fdOo)E^>$3iHGAZwrO}2n9AEUP!n`RTL3FAs)10*|2Rm5;MY(jkpNg5Vpa`LrEgO z5*3LF%}nEpB>dc@NJ^Nt@z4(M1Tkf8vNp=uxZL)hCt>1EdEyl^uN0QC!Jj@9tIhOwBHGl^ zE^p%+8HB_jTShX=&pQ8z0Ovk94&8 zodpKrKXPqs@FTE2Z1Da|TN~|cw70#VV0YT+Od{UF#$7f#+L%7ebh5!j2XZ1)7aQHA zkatxs9lA@&d){NCr;U4U@XOba*x(x__u06g9WJGhu$Pbyy=^?`^9{2Mm4|FR>?=EF znZ7pq*?81Oe;dyz+G92zw=vMhQ#P8nx1Zo4bhMx3C~ayFuu-VEP4kv!1;jx%26N?S zgIg8QlS;`Jo_?%l!R{tD{aM{}HlDYUagcTJf{hn#tg^A%#!EJa+W6MScQ#(OG0esn zHpbX^#m1{P-m>wwjp6J@8zW|$pJtoDY;(nI^STWZrZ;Rfnr+^c*>|=X!J%d2BO4#v z7%6ezZ1b*-IdXo_#``u#N&mpchaxOK_z8=l=t=y<#-}zuw^3$}DKf{f($R8b)@LFV z=}DcxXuh;@x^##;W{kDHUs6n8*%)WzYnlD^bLJcIPIJunHpbhSVq+@X(8u|~#*)(J z<2mL>8$U_;SvW!Xi||+B!*k3;85?6I+xE0T?! zws%cqyNw+p{pWg@EUF6I%{9CJBU0aM)D#x@^P;>HwF2gI0zxCl9GA2rV;9qgKCxEFfL!IXI>?V#TvZ(EYp z^Gwdc1rEA8=;q);mU2+l!3_>BcJS9cQ`A8*2izv{631I=_$cP34vIS{B^;Eb z-qOC@!DSBkVk1*&2c^VMHY;Ejl{~q^!Ig48+RS?evaEx04z6}^jf3(IDmb89MIlMv zr;_~h5r~x?T)=)gbsXI6ct6K@A(59TZ*ja!n)Ip1ex7d{INB*@Jkn)d(}2qC{{{NrImx$s)3! z_`QSi4kkI6tj_#_3j)WIgCAx7B;?s)jr9N3!2|~r{W$-|CtPKIdJN(0T_894usqJK(08iySO=uu>70I0!E= z_up+Vr24h}mw;$XL`-p9r}*uy!?rFEfK7qR$4 zbHKqt2Zy+V`Qmj84PR=@oAf{G;JAYm4vr~KL%E$4XAl)=lZ=N6&AruK=Z3OEg2!s#};mI%thGB(Zhwx1Z z--h6X5DMYN5MBx)9D)gQgO2qy$LghU7zgm7U9$&k0K zF{MISvC#X?o(>@+@x(%t70LM~b1w?vVwojExI~0vv5@zIZBZf3Z&L-ADyz7Vx1=eS zWY|R>DILP)(yta?5yDj=lnvoZnRF;4!fPYs<;2Si8KFW56~(Vrs7fL4O)3I+|LVDlRb8cS2a^@<=!l; zBV-rd5<=Y&dMWa)A$;_xRWIbdp#8EGmby)zO+vU`q@j>{qYxVVoNos-6>lbN9zqMY z*3Z2ogf|r}-*s(5XdA+VA@q?$yAV2ra90TJW!@?LO8y-~=oCWN5W0oX`9HaA{M{jR zky0yFFt4rEJ%k=1+%JV~yC;Nu#e4e7)J2A#_l2-tC*lF=z5LwXBAXYPheRF@;gJwd zsSSNY=oiA%(jWEx2Zqo;gvUa7JcK7g7{Fm10^>6{F`w8BnoLjmr3Q%%7KRslgXftL zhJ^5}l;?ym2%i`3f5c)xlv!+sa(1i>zQJx3c{zk(BCiNv6%H5D?X?hI7Y{sW(PVln zg!e-jCGqVLM);oZh>R4z8^U|O-gvS3z~^H^_)z?#5Iz?9MEF?VUC|WKZLpB^Mv_vvcS(>7{cc|Wh}l#;;ImqhOkV0xo|}YMScI3Ax!oC zSNn5t9fw~CyF%C<@_s~b2w^8@-x9MigiRrA4q?e+!?ZPoE#iDZfabOkwukWBV&g9H z(vA?yE%DsCEiq3oF?&MT%cbuNbC^Dpyt6QFiP;yze)jMZb0CC+A`6z7Lq4H?B!qzt z%+U~zg>an93s>Ex-rtUsoLLitr$XR9d&ib|3KPj$1`nZl7$w5^J%n>ye#3CX;M+id zgz#qw=R@E}qslBbe{o$}Y6^u>IE>ay&EH(QmzsjG_ckvHqY)o%6)wUxKMXsJKo~Tc zf?;rD84@Rqkik!bn+qEXn}pFQjK<=5e+FzC zMzegbZZ7AmXyGfZc=p4%Cybt9wBdQzy3|pmZ5ZuD+WY#QVRQ)NE}5?_^M>>vUAzlx zoxjZ$!ni*Se%XeP zONz7H+`imA$b(&O`UoEq@@zg5_HL^74WsRH(~mxw1sxV#%V^SEC!+0@_m%{iw zj4#3%8pg|Eyc@=QVei-6urP+RRbjj$lgg_i4=*>bhw(-j@A&$gVZ0T_+cIBWZbta} z56iu0pZKWBNMD(CvA5;d`(b<>#wTHn3gd$?KJ;@x65)T3dACn}osZFu4&yVK(-rfV zx?bclVT=po>oC3yW2|yn*H?b21Ix`fVSF3L4`KW$@jI^ke(v{SRP5kAwZ(lDy(SH} zep1$iFn;Dt4CB;m-s5vjze;Ch@`>X13Ns~)sbMS)V_6u}!k8Y${4f@>XzA+yaq7UUSXDpu|iqvge${X z?U!1mdh?!ZB(CM0?d(0vw?2#wVQiGRRk+D7wOM2f<1G89mTh4)S37rxu`7%M0~qWM zV-MH2FpkN8Zx{!{I4HhPxL^2U{Sd1=6vmM-9$8@yOQgaM$)C;RVVscoXBa2hz2d(K z=}*toVVse9R+umKyZE^<{ty|k!sPYyGXD~??B60hWrYm5mO2I@gTe-%tT09RSg6FH z&^E9PxF6T1{I7q-HIEOFu2N~tU*aB6t6J2OuUpq zX%P;I%SH12aHa2AhGDPuy7ABobGCt9&UnMGJnL28a`Tgl@~kAhT6m4H=vUr2uVQeW z!7T=L4X!t+YH*Vd;Rb_h?7)?#rtn6C8X{Dxi*U!GJfTuc3QZn$ZG$=@OGdOd^s1`P~q>U&}Qf>@s1ZqQIZjfCu87Hn$J%%H15H-qK|E!6lK!2c?~y|xGT`@D8HA~w8aZgC>1)u> z;8BDA1_KP9l*40;<9mJ~&nIMVXy&zH*-A6e;3+AC4BqvhNFQv#5pry$8N$V%v)Evd z!E*-B8~kGMtHBEfFB*(C_{`uXgP{g*7`$olvR~IQ4$f8o^xi8HUo{wR@R~S3HvKwV zc+_h@D|(AvC;bD%T?4)2dXFgbj^W;Q{~YPN##z1mdyDEOIDfL26GJN zN|`6*pHUWJ`fQb1AccRhXf85X%p&Ui<)ZFo2g#Z*E{$%r?LX_k)Q@(8Yr;Q9!zP}ViVD)_}Qcf7W z%lkK=LIf2fs3hg;2nOmHM?dmUU6mua)-PMdud!+bH$-rI1Pzr{ErQw+)QRB62&%Iu zCD!sw)r=tj55P@Q-cj7S;_V}7E7DF#&vUB{r`x|p zNbZWDa|Cxs&@tjo&rZJQlP@^=HL6PlT_fN>82Jf1w5Ruuc8>@iji7%7_e8wg**zn; zSLD739u&D>$gBrMdPUG%Wc4Ngyye{|f`@#chdG4A`$o`Dgg-)=Sp2aF9%tW1@Dls2 zr2Rw$Pm7Qb5P6bk(^sB~V37F15!PVN$`Rf!6VFH)B7D~Od@h3L#a|G9^Oom1G=i5S z_%?#?BH-71hea?V0(*^lMfhq2!$n>bz8S&mB6N5of(mO43Da8k!h59Cfd~qJv_YwRO!LM={FZ_X{PUI&cqx~$x_D_glVgw5! zSQx>i2qsHss3{RljbL^Jb0U})!So1bL@+Y~R?XscV45Y93OPejpR3$?5zP17!z}9g zQj5fCu83f91WO`V>MP45SSHRmeLIEe!{95WtcqZD1Z?n{2!=KK=PZz{k6;7mP7Fr5MIKW{h?nH4Yg2UnkQ5+FD6~SqdqY)g7;5f&&Oa?j01@=epz8h1X zoQdG~2+qmjtnfEsKKG9Z{*2(f6n^}grT!BCn^nl9Lc+b<3Pn*^?FYO;l#)^+ijpFi`K`^@MP%60QCzNE@_g-AM!7c;u8N{; z6cwVVsN8bG@@mPy#Vbjqd9@!o-^j{QTpLA|D6Wg5S`;@%alJfm@cpZb{Cm9Bqo^U} zrYLHP)Dq^~lW%8jDgRb|a}>8kQ8$WPqo^0fgHiN}qJ9(&qUhv%-WJ6j;)RVlqOL$6=~+T{NKo|v_%vxmHTg>w2Gp26m6nt8^xVbbWmV6P z{)k9lVL!Ep#rsF`SQL*(@kA6)Mlmpo0dmMk&bKxnlgd*n#d-a-d|nhjBOD^6=d&Wu z37;3fAY}2EMCdbAfBMrn4C*) z6icF58pZl3Hbk*3isezPiDGROD@YDntAs0sJQhAOvD)YSawv-PYs{V~_C~QUiv3*qqc}*hnfH1c zgN%`LK3X0R^RGY@N2AD_3`J6GtvRkf=PskSn!+&@i6Ic< z9xq{T;T4of-4da)V@rsp6GJG5aLl{xAB`aax50Zg)zL+(SBr|xhRH&V5%KNd82FXyTn$qphKe!o|71RXP$`D1W4I=U$_jEV^>toYCW=Iw*T*nno#Fdv)nlj{ z!}fLN1|EXGWm8S$#u(15^FCoyBZitW)QaJz80yAwYYeqxsKbLDU~ZwpU7*E>@Z&t| zy#1f45bMRf-Ju&OtA5PenmE6qG)3~%dUHFEeZ6TIL!+4YLgn(Np~f)~*`Li~XdZ(d zhZ9GO7+S{gRt#^)a7PTSVt6oyJ~6b8dDmy|ilJi+ZNzD|6=^4IFT7LOf!)5|yG+N_ zNlG_iXW`w#E-`c!;e}tib&sJ(4EIR6U)WQ4ukb!$bwB0sJ}Dd+!&4%IgttBAU21zehG%3B5k42gvm(sm zCm^5qId=+rF@~394vk^BufHrZO!!I+uloAEYQ}3ZyzVP+h`cEry55Y4;hh-P#jrkx zkukg*!!I%X8pC@WY+PVV+MmTRDuxflM+-lU;iDM7Uhh4+%z^i@#7|=2cP^-W8p9lA zk<;_@7`}*MOblPf@Pj&<40B_c6vN~gX2@ZRa9Rv(?Nsqz@}DmL?FC*%GsQ_}iOgo-%4eR; z<-+;G1u-lXSro&P7?#GcSmtQ?b4w@&Stf;K_6D=U=PP4a6~pQn)<{|F>(90De$egP zU^c|Ckqc1_r(@t({5Hj~JBB?mY>vU&Xtu<#HHK}RiN(zhA<1@;IY+}gMRxi6lq1&e zUZ&JWvp0r)oN;S|`?X>m7Tr@VBpwJRtwaJ9y2*+`A9Jj>5EuMKVG95=Ij)-_Pj+jV1j)Vvu zToK-ROvaHC&)=OSX5+}kQ7(@1aa<6`g>jULusw|=8`yy z#!)PeOXHY4#2S8gxI`SqeLnu~FqM*V3di8KQ?`&#YTTBgxii59iRo!B0#nEbuxhd}b z5vd(VojCFzvY|;*H;!B5xGRp1alBElpk5re$I(#E_2b?plm^1v;^?= z8b`CZcN09e-)_RDZZY$>n2p`do-L+%93A4Yx0)7lw2b49xOe}QsU4dUM{AjFgl$<@ zG4H|AvlG1U$+nkxr||AUp3W9tINs_MN9Q;`isNIpDvmC345v>VUE}B$N1r$zilciR zJ>sac)jSZ#J#p`25KQ-q^b{7`YVPAX-RkN0$I)|Hkc9rd;^?h{xy|(6 zW}f0%*k%UBF<9iIZHDHGZJu-C?Pf?E&&Kgm97E%Hj-APq7{`n9%m<-=&FS9$E)&0E{O>X=LCd|2Y^Jc;b3nDtH^{D#Zi?Pkq(^JW}x#c_JOVR}1` z5kBWJ@}tiq<9IiY_u_az4w@ebNk+wy-r;=}`a@r-zr)P#YCef$bR3_>@hMN}4)b9> z^ZY>T^EkfXDR|p_&Hn6R#&Aez2>snSG^Ljru)~a%`Bfa_M5wU#5jzZT@_rY`_i_Av zAqpAW+JU2?0k(=?H|Cyu@H+!x0gF4S@CkK=%R4#sgbj$?5g zisP`9Bf@+eh{x5LCncW9;|CTy>J-O`-#ogp>fdCN6n4F?{ymO!QvQhJPm%M&0_Fb2 zb1JjvPOrzft$)7X3b}YnN)Z@T9&};3-Z{;mFOrapu!}+o6i&dnh`4ybMK2do z7cm!?xhUl#?t0gLnX)cipC?3;!jv%WA|t}5LFk-wae<2!JI#eIE_QK=_(d+}G%euE zI7MA=b8n^+E{eIh)J1VAKmS&c-^80(()D)v&YPuOT<+pp7gb#EJ^CwLyl^I1Ui?a7 z85dW%IJeU`RQa9zu_nEJIl>nGzR$6cIpan{8XE(W-mzrJpYKp*u~c_ zzH#x1i%(sA;bM%7(JnqyZ+!lLmHpDiSQlTp825kW<|BXW;yV{Vx%k<|_b$e}_`$`G z|J(l;F8(eixS06AeWtjW>SCjdO)jRnnC@bUi={4RxR~i;o{RY|X1SQn`R-!w|Bkc3 z#X=X0TrB?IKFeGzcd^>V8jd=-t#q;K|MFk!Vx5ciE;jsMx%uAM>|%?HgLH7Q)x|a! zyIt&YvE9WE7du_-`rl>uy4dGpKPUD7_Brh0h>MdhTJJVTT^!?FaB<>)`=4@g`v1@6 zKkdJ{-q%@pE#-IDdy4Ozi$7fNCAB|=f4ev@@|UphZtvBzf`sS5#BV3@!{R$D87{L$ z5{M)aO(4MKy{R2cz)HYQz@aIHFKmVq2q(NZHD3tpZ;JOMWW zIxshpKr(@paxWC76UZcxO?WS9@^#BR<`TF-N{6oA3z!!raB;$WXY-N-iYHJafuac% zlfqoS#d)bXidu;-vcN>!H6R4U%n*`b> za6eCeR^)jy!g@ZI8Jt zfjT|BYYuJpm_B<LaCkBm3b5j=p4=9!a3DI0rnE@QDNlh&(B*+s80#Py&M!cqxIQ3GaU2)57P3&m=HJozV1EK1B=BJZ3ldnEz()yuoWM`~Cp>{q68JQM zuM!x?G09Pp!1{9qV-om0fwKe67sAziU(8QmCNMSunsj60zGPn~@J#|gNc=W|?-JYx z2ICcnxeP)#Vm<uUVA9Vm3H|H3=+{Nas}v zEKOip0?XBy6$z{qVKee=U^7T^wamO)W^DrN64;i&b{=U08xq)(z*dFYn80Q~<|Yv~ zAm6sSYCoI7AUhJ+nZT|DcFX*rhSy;F(|HePZY|H;>&NL`(;P_PAQ#>wGD#fbGL=9< zlAm9~5sqYbX#&4-+9q&3fs+ZG;@srC+iTd*d1U{e_Rr=SoveKS@a+7az&Rb-UkUu- z*LXgGKRIk_m|lAgG2h#NCy?(1Vxc4oClO5|mPC;x0!f6D2q(c~3?{u3VJE$_U?sgX zLPFgUC&?cszwE_>Wp2bLJnDE7Blem^5^fSaQ%vlxB-hxQCZ*yeERszkmqh6#E>Gfu zBrZ&%gmNzuUXn!7q&I*sPI_aN{>5ZonndxWH^TG7FF%aQ=}%h>Eg1*MYSQ8SI- zYpzJ*$|Nc#Q7MTsY)=y9lisOe3yEcuD3|ie93wW-{mL}MupeZ7&$H#yTpq^Yo(u(`1MpfC%z)H-uV z60Jm9C($X1&f;x^ZIfu1M0@c&g?9-%2$LhNjv`#F&hPaux89vZ4=G)Iy=xNPeBNE8 z*gkWQNKfItN!%xLzwiNJ^?ink0Uu1F4;@mtKZS>qcsPl+DYQ%BktF&iu`P-1N%TwN z(Ih@iVsz5`x2Jy+PbD!ZiN}(7Jc-u(Opkr$i6klycKAx^fFzzwdheDF6p}o<&kRoD z=_H0H@mdnkBrzn3p-H@)#Is4fx6eGE#0xy{4eaNHR9+N$DG3sq`K&w{rmR`@Q*P5@VD2C5c~?_$rBU62~X;brRns@tw?Xg$4fa z(4UTazec~8IAx#tA&DQ8_(>-9pOe_Q&-=Z})T6sYoRGwnB&H@YF^Ne@rVrCMvl9-;v423$j&)ol#Io`?S{rSU|o^z6z%c+{g{3I49u_TEFe!YuC7ACzN z;PWy0!+EL1Wl1bgg1?KYuaL4*SbV?d$zRH4FSFMq(eo4M+Vb|+B-SRej_U~*;qqpq z^bMTm~NWXBypZ2znRVSXA+C{n>_!Ehba!Z6;5H#t>HrAbch}B z+=`?S>E)0FrCUONwb4o8YB{|2gT-7!w-jPobfd zTT-YmQdf9u3iVQW@}T)##it)M4W!>DO#kV%hpABtO;c!=LSyMvnxwE*MVd=#nZg|+ zEm8;_@{X}p3azEI5tf(O{E+D`veU8$9Ww1xAYr;wq(cgKiF8b%Qwp6^xI2YzDRfVv zO9}rg%5d9)6JGc=B*UorCT|Vznwzi!)Ao=9pOkJH|Kee6XCF7dOw9xKK~$v z8WKNB;o}rON#WBJ8Z@!L5{^#cixkF)f0n}MJX1|<<`T(Cz7&oX=Cde{ljqkdd?WoL zV^RD*h4CpY%wSOlKk(vz3ZJF%c^W^Z@H1y+8b#CiC52y8*qg$>6egrFF@>cm@0ZJ@ z6ef!-Okqk2Q^jYeFim8pkZ#jcm?7Tsu=g(w)2tMFi_h_W=8DWqVZO)$;V}6u5??GF zd)O@T$+8rdi?85`NMU^nD`l<{vX<2%Yf@M%!aI!l+Ba}`OWByhrW7`(uqA~ZQnm`W z3%3ausSSCa$6eBQ3mI@v3fotB2em(i11S_rqi`Arm3xK@cnXKa52tWMU($c~bI+ylhxnhu^Z)8<@ZX%OY402{@w>c4el4qrNFt47 z8i6!|X;@OiLR&~rCykKL*)Ss>5k}L9r4bi*g_j=rr&k*vF)1lIVOp3GW`&H*4!pqU z7m8ez#>KwE78Xn6(lmOf@n9Oo(jmivu#Jd7> zbsEzSR*VrJ9+Z5+^)zwh^-{v(*qiGtg(`Y0AW@)rc zQ0W<69{RdA=oW(`fIvxt$30JJaYO&Zg#%>&<)YPHA*z&!_S15yMYE zG_Pa0r!F5J=#oa)G`i`ebWdZ;5z|w=M;iBtOgiFSOTU)^c@ldYZgq8k8V{t=%QyM3 z78A4R)+deE(|99|hthaBjYrbxo5s^=Jd;MhG#*W35RXoK3-nK8fcRs+@^~5rN6iy5 zS6pe+?a4F-rty@N;_VC*#lbSU$p-ll9!?rV(|DORYA;iY&!zFad|pW7MV=t-C-9OK z=2kxH1sNvu)ihoa$&15%pVxR6aX}p~VKgY=z$w#E|P8y%2@o5?(IZE}> z*bmcq*XQr0@qQYkWPae|<88eiiJ3l<@-aK}sAn=hug;A*YDTBA>8Lq()O?Y~7!Jz} zs%P+J8e`Ki8ALMpDvfbz%ui!M+Pew(bsFEM@m(6KPmHuv^R}n4BaNLB z-#KQO=)7Adk0qb>am`QTkSf}*&N-k?qvv6n>?L~U@mLzi)A%EeKNaMJ@T~Bp@Rabh z@QkqOpWYqz-_rP9Ciyv$dB+UHo=>At28DU{7g~R*4S#c9$mAE~E20_iSsA57jUY21?*-X^QN8VIW!Plu=oxwF3T$jQ15-VqL zZ3a~`peJ+boG(JGn!ydeNIjoLAMSk8x~*L!gPIvk$#`#()XLzd44%&5nG9;PsTtgv zL5B=(&fu1ex0JQYpsq+WiWY9opq|Y78Qh*h!wee8yiM5cxVQK)HOiog6!OLy@Ea?6 zy{SZZZ-{2|3|eH+Qp(dTC^Ev2&^m)QeuTCev=eXdD>IIpyE5pQLEjAeWzZ>u&KcaB z!F_VLTX;_fT{7sJK{vltcMSEPB*#qMDOYfCI?+hOBOYsY;5BmI}4Ep%I zm^Mv%Smqp@2Jb2Ng$!QI;C1nrgs=FehGy`x&xeU@c))tqSB7Wsn$L?H^F{`5X7HAj zcYOVAkrBdjC(KBWgcIgnbrE}s{C#DO%HRW$4~3s*@KFXIi+>_aUQ*Eggm=87Wqu~4 zIrxMb!>O9Vj~V%K~+jla*7mnwz0N-<*D*8EtNm70h z{wkc{`%KK>)z027=#!=7JBL$XswToT;dJ4Q3}%Wjcb3R(;T+*y;XL7d;R0cc&i3LA zmatV>{Fuek43=eZPZmA1Sf0TOPRT5)Wxd;WD>GP^!TJnVWw1JfHCoen&5)b<@R9hn zTw(NFcco6@4H^8N!MO}JX0R!P&0L5wIFiB947O&ljq6Ecd!KN720Js@mB9{~+~%>11j!8c$@i?0*lCR}d2B$MP zBZU!u%iydygXF6q`6Girxd>xU2I3WmeBTnLRo~fFj+*hh-UF>n}V}<6x`Xxj&$)>(O4GbBrKlDBALadSrpG= z@;*By%n8$3WEkh9Vakfo;esqK%;KUfF3zH87R9o-MCo6Lf1OFLKWR#2Q8J6GvM8Iy zWm%NU;tCFfex|gLWLUqM{rs zDIk5Q6Ir%$7FDviPPx}+kq^k+>s7X@kZv7S} z-LvQ+@@ZqQ&AhySFVELZ(?9Fo?z~TUe-;mj^va@l77vOu_mM36`23+P9`^allculF z`-wa%Ja^JOmc`>)JdwqKEMCjv^(>yuVqg}}W$}F0`xg9DSqv?2E;wZdWigmzyJYBT z;gBqz5$SiTfa0?n@b%9YtZZYrYw-(Nw5edP{nEUcMWs{bB?igjW$|HIypl!LrUk7U z*-WoyF+7VrZ*a;m-F?cuk;R)?e3Zqz+2>X7L?;PMhzAB;!SX z|K0j2i=R1kFF>6O@JklIX7NG}FXk{Ii;0}VIb4*(Bu?`zc4e_Uiz!)5<(jN9FfEJe zS+DgkiIR8L8r}j zapsaU4X@%A+$r(Tie?Xco4uL?a@d!}{w&UA@kbU1>2M=O5Db4$t0=8zW2Yjda~y~y=u+ySqvSDZ0bbGRXgTXU$VtZF&b%%N5eH|9`X zN{t-O`El~(rW|foR&8P8tf?bn5Agc)7V)|~#&ql*DAFK@+kEAA#*t5>92)1) z#MhhU(A4K!M_SFrPu=E4yCa8IIrPn;Uks6Y4&l#*n4#{DZ$aBhlUYL5*q0dV>49#J8?*Gws7SL8y;oH9tb?@b#q2r#M z(=&6QGdL{O3LlJ1aHqy*^(X;4ZerMpX{!|$EvF#i3%|N7RN^{n6f z?04_kvuDpfJqK4)F(MTsQ?WZ0dr~nf6{AzJG8L;*F(y_1MgenDF*g@%vQ#kc!2r_=(Ou z>H_MI)cL7M^VB@Xg{fFXN3{DEa{!m5VyVmrmP+_@DwZ=rcv&i3mcJqu70Iiu(#@$@ zLtdMTb+Z0j{>D^nAb-pJP2`2-EyAhTN@oXE_OdM%+sQN8pPiP!D;0aKz3)xMu~ZyS z#jmOOEfxE$oCB#?P};UX6(xQ$kM3Y94zcKW>L1j@skp{=j-=u!oy^Z{a@k70Y$sB2 zDix zk=u?NskoVnL_3n~xRr|Asd$o#r%b++iid=|skkT0+O5RVBaJ^w z#bb+?JhMF`zf8p|S!c*EsFicrc09AaPQ^bA)7i~+KEaMO1W-@0W%1K8eD%zho{)hm ze*WjSWO7!^$!JH49X2}@I+>}NsMVjF$DW1UpDbZEhS{k(s5$Le-rOAgR6Fc;1nmgX zcTn9_ryVZBY^xoQ9V#8K9X^8Jj(|YJM04ZW6bRd)*-_ArLd?@;;Im}w-idWcwQOS-U?3iaqWjm_a(Nx;EqpBV6 z+0l@7tJzVVP~RG*_wA@brzW)ywHCFu9daXO+0lXLwz_oc*)i_)n-Ob3=ivkMvFrmo z8Zm546{iUy&tC~2+R@yOfp!eCqlFzU?dW1hS35qk<6}G8Gp&^!tqJYyXk)c-?zye4 z#Si+Xd}7C^3_p`&;ZC3M{C2RTqaB^B%+7?*<&3|u6@6j*f??+=W}m;b<10J*()rqs zZiHSkJ}=B;{Kk&%cJ!dxliH5{NU9|CwxbXINp$*=`%{;^unn+aupL9lQ|%Z^7;VQG zJBHaY+>USQNNXbrBdDKOPZ~woXYFgO9TTj~adwO+pJnMpJ0{sN*(#l4$NM$S{-=Fu z>NGp1+wmPsXIVKj?3hW`m^0gsISl98@jameeW~8$rR_&M=G$?_j;nSouw$VeyY1Lx z$09ox+p&)MKiRQ_u-cBLcKl3UL0v{&PHprcp$}VL$#4}__R{mKlr`kFR9R-lTyMt) zJ2u*}$&RgdY-7=8QGz6FktLM z_)V@F$zyb{uB-hn&G%2}h(6`cJIAJ73vOFyWLPr|mdN{*x+w zsDHz}BF@-x&W`gm&&m|#^2Cvz1-Hw0kNO0hW9XIXx z+m1&}xMjyZJMNQj+i{0*m)e4LrTPOoYo%=uY5rwL{H4MBCCrv(du+#Z7CoUprHcQ| zjsaE+FQiv?ypolWeSR$~*sX*mRw*3F=rGS$8VAxkkdB;46*D~{1GQQobKy!NCp*w& zquGHJ2W$=~4rFp5yHzW*16dr%%21xkNLn@re&ZhH`K^RGtjxD>CggS?)q&X#%yGc( zfWv{-4zzK=>43|DQVzW1kpHuQ#{ta&-2v6A8z6Y8KC0h=$JTKL9SG43Q&V4?`!yVh zI8exe!VW|oh_R>uHID=N2$Gi9f%44HZ#kbaEa*VoDdIq%y0*7iTGYxZ=D=4aZ2e!` ziaYQ&%^$u`Ea5;&@^7zgkJw0Q2g=CkIndOBvJRAUpq2x*9e7uE>cD#rRCAz$EdH!j z#eqsz`;}!J{xOfD6tyb-7Ub&W8dm1}gf$wq%1HU@(g9Gy%Snj|Iru|6$$$|M+tpyG& zbYPJKiyi342VYS+E_o#`dtc(f>jY&flYe$#8KL{p#7#|;RyweX;Wp}O2Z}=3=)f8W z*3wz$zJW@vX~zy zoS>d`;7`IS2c}!K2aKYpBa2Fgw5-?D1mCfwle?m6&CmNEzKJMe)1U(~;;4`pOdnr(XL znXf~i(0t~=a|fQ1#f(2@y;)EEZ>VqB!>``PrSwK|d#T zUMX{x$W2bA+NokXoN!uPoz*=~ly#yUO_l0(!smqFi2%dm)Swd~C&Er>P86Y|J7GAH z*NJ>iMCin*tH#!-<;Ys!qH|kQS;rQJwt0UlG1` zq8s5yc6%4KJDna>X|tyjy)5qS#IDKaj`}&#--(s<2RJd%i8)Tpbz+bcgPj=f!~`dX zI5Ct7qp8EFBdEiv-%`(|RYnpbv6H-ux|_O(dNkgGdyUPB=&n z4^KQy_=Eb;svDhbE}lo7I7a_C^#oP?lTQ3;ahCMTX(!GwJnO_|C$5msQO{E^IB}71 zi7G8Tn=FGfL=K=LE>O-m& z)%!T{u@g_6Xy?Hv9z1p8nXDmhly~E~6EB>Y?7|cmUOMs0iK;HV=fZ0z{*hJD1vn2@V&WF1TE9yWpq4I!ltrB{v>P z^17fBg!iXcM12gUR{BiRP~C<0E_86=eHUuD(9DGoU8w0o zEf+rE$*s-g`c?~dT&QbtJr|~3H@hcW0~Z>)%=`AsCig9GWaTt=p$WMu_4>QE?4`^Z z(%gl%bXvI3lJF6=HT7d^E9#gGN*h8-mc+$(655eJap6;$icQR2e?}+%cA2*qOP}BD;Wsq9Q{_H>JzZGJli16J z-d27e!k_f}yD;2^Z(SJR!ax@Wv1o{uIoO3px6Lyy+fbUrs24LRBM4($80*4F@+j(P zs^mXm`{P`gNM}5C0yRgXIj>}!#GVUGm6PJa0~h{sVY&<7xp2yb(=N<#VWtb~Tv+eI zEEi_8`p?ukF3fY`M;GQY{N9BhTo`iKeB(lX&nUmmlxF9<@DocHxUf(rdFzx#3>Q-i zup9DGyJRkrfubo~KT%oc!g7WysHtL7j|0Cc0xP$WCwY1PTMZRZYyV0qVlT?zqxS4g`?7-ylcv$ z-(A@6!T}c!x^PHdc<}d_a^UjoPV)zz@7UxNA9mpn7X)NmpQs$O+B`uxPL0o&laj{p z1UqxaCEsksT{`DnI8V6Y!Ue(=>O~hW5#&5xCdeSjE6}TQfaS~qx#q%k`eI5b+f9bI zsJC6XW7T@do!)cdKAp68%~|)*g}+^JxZ!l;kqeLI7~RO^#*=uC8|mD5>cTS@p1bfu zR(tv{sWKC!g;!)H$((Qh$U}e|aKBme)41iY(oO$|oo2_y}!|R664b_b)5p%A#sFLI-2i*v{5wKd2FAsz*j=G__p}S$wiBQM# zc-K>qaTEGg*1ZjX@meGIYvP%em!mh0SI^OjatmQPGXtZrpLBk{gxXnC8ZGH>$W%)s0VO zaNKy$jcRT*cB6?K)!lgCjStw4v{1v1T5i;Kqb8j`Y_^V7THlSj&26>PoS=R@!jB#Tu%|ULAAPjb6h#N!6(*NOZ3?omQ zXHJ7}rEz)Ylkv^080p3+mX4-|GAeRMSxFnma1wRA8xsfoIPr8Glu7A zgB#o2*zU$g`kQ2w-15)A$`*#dkY#R2n_H>lGAcXV*y+Y^48`9?*ezE98{ETiuN%J- z7G+fA4!x2l+tu3%2i!R5#(6g`xN%4(m>VbE_|uKUOg`e4pGx5mvg9u>XFEndPL)Y0 z<_U{s4VUng8>i{);8>j@pQTFaIXBK(XYC@*%hXGxz@i zFol|t+WK~a&0`L%e9Je!Tx6!NdXU9~tR7_ZAiD=HnmIhk=|L_Ja(m1hLCBL6dDbTn z(5W8SJ#cu;2XuL`j^C+6?!6#6PLFx}2=Qg_ZjbpC&f}3kRaE54^|DRzeIEG90m}&z zK1oqD4|ETzdGJMBb65-y3VBf2gNQWiLCng}??E1NUdzen!D#EK3wTh_^5q$l%E3B5e%?SWA*LCgrXp9cfv5Lnuu8ZRA09xStkX_7DgFb{^yxOwoS2j6-y!h>lZ zO!r`<_>GcgbWWb?!6=zL9*pr|EPFml&bXqC^I!r);qi3jkY$_bk-zLwMk#%=BQE2eUo$XAowUIUckblp@>rgt^ojTWvr5 zC!FuW0uR=Cu-=1((s(9isRuvHQDjmUagU2V_=&J0ld{AE(c_tv7nzi09<1_U*tx{z z9=WBwvVyvj>dI^;tY+yNs-&$Y6w0h@@L;3IyaB?T%*v;kl}&PtRcu>55Z+APLj8q0 zD6=A^+nBT6gB=9<2B4U`J=i0wN8JSZ;g4*4Jviwxe*`4o$N1HQ-#pkSQ;7G6+*LDa zzXu0AILHGzb6d@8PZaMgpC zk|v|-NV?|1T@UVgaGjwzHwZVWw>-E_xMP*dU!mQXSYf(oc+_tL0HtK#vMgm_Lm6&X|{vM4?E za%LrokU~wSX0(c=mW?c+5YlB)gtMr~W%*eN*{Io7GE zD$1xRp`s*L-z|4x&bXm>8yw)p4w2F$V zG;67Nk09pzs@$vDJdf2a=h%{D32UgRX*qe=NNt97sCA`#G#jXBNasrxAE;=gqOFQ{ zDjKV3qT*u~HKl&2qPdD@%< zKT+|iicTs%r}-JRgNpWq1`Excj%0y(S(VNfcTw?$#qxV1DecN|ANTkb`D+#3RD7eN zyOr64aDh347A5v(I9SCH6@9FnzAE~W`>Pm07)TvNmG4!`z6vBH4OKBr#Z(p3R18<~ zt%`|EkkSz<#*#;>7^Pyg<&PmC(RPC!7{_qDiV1|Y+02u>c}wCXD}S_W4aFwt| zHQTvimEKly)8bo%)!CIhvPNYx)9%vQ#~nRT@fX8J4a}m4D*k5pNW~KsPsxvE^=9%j z6+6x)Jf|ti-Vuqj*CyI>D6dq!R*~I{9A5mRBEgHyUUS8eH6LDNB&YErtrzLMNbf}= zoeW-l9c6!BH1f9&v`S8s^?Hrm}&Du@j~PBCCz4{*?*~7Hw!td7ug8n$fc3f zi(FplUKliUd*SxN<3*|$b~+9(oL2tc;mIYgCAb)Vl|xYpelG%Ec*#C1b6gH3XmOYj z^2(h|%-(92e~4j(VIDaaLX7(RrSo)^`;DD6cVFUosS!HcpimF|`E z;uWv8cj;uyY4*7yxw02kyr@Lhaw>b9nrnNj3uafV%I=t1-HZ3VsLh-j)LoyM*L6)V zYB79zzziGaRO&FSOKr}&^~nvW4XI_XnvFO1qKPz{Z0qSoQ!ko%(awucy!gNTSU21k!w$@&>@uIC)?s%YV@(H!r^1Q{8!bY`L#lf0PBP}Wazrg)Ko;b8VzoM{ZFQ|IPV zW)Q@m>BTIIf6b-L_2PTEy1hv7;Ri3~d2z&xqh9>z#e6S*@nWkN3%pq9#d0rJu;L=> zQZE+A+wo!v;c6}=O>T3%G|E#cGzWwQ|-FJgm5mTs60{ zk+7M%iP}gv+mUSx!}htAZC-5mVviSlz1TrhN_WeMDYl(n?6RE2S!_i)?SG|nz>9-k z{N}|zul&T%?5%A3Su`QHa>%N6nDDzCV;0-0+{zyePc#3R7stK0;l)iaPIz&WMHi`m zdU1|$%8S!poFSj3K49G<-fS zGjm>%UsLbTNrX>c93i(4<<2Lh^&y=P8GT6cne#9`HG>a3F1=Y56X_)RkW7%AD{Rx| zLv}if519y=sadI6eE8^OQ>h!+Q)Rp&B9A z#e{Fqzd2tue5gq?zMj`6*Rk^JNckY zoB8me56!K*Eqs`29nmVg@{#4s+-vPa8y`ONp}h}n>3>3PM=fKw$tC$ISzlw$kPc*l zjy{~>W03GxyVBW*FMR0jLmwZy_|Vmd9?bmG%J1gGR~CQmlecATa*vm9ET=o+s9otv z=tceIe8RT#34O_fsr`KDPZ&TQL>)-IXIEbH7>6*FUJWG-qn7(7WdvcF56gWR>63qk z!e}4H_%N6LSRcmu@Ev(Pb&?O0eV9O=NcB3*IWvVkm3nBFIVRJ5n9i^~6RJ6s84PFo zFpDsoI!DHt2~uT{L-}4F0(_V!L*c_>Nnp-=>LMQ&_^{B2rB?oahZ0}emN4OGs@7`wLWb2VT%vzthyV0SWmWHOV}Vwiqky0 zO?3WU&wpXK-G{A&ZPbd)+(DKqJAG*9RDvGc9v}AlaL9+>efX87`>mYc2>ay1XI-gv zz=wlY>9I+Phkf{i;VJ47ACCKQ!iS?i9Fro}O6X*+t0$T8r&af@KCOOSwh9O}#^H zZ#WRJZ&-Zl#7F zH5u0Oqb{MgRa%Fz%&pY3oce_EO;bMbqmdtz{Fv-VV?Ubs(aVqCel+!?8FN0Pe&|Ol zKU(|I+%LCPG0$~N>PJ-LQo_ds@prL@Z5X!mqb=b)%}>amTA9z?N_#&#_|egiPJVpl z$Ja8KJj&;OeBnnIrgipXT?g|zm948EUs`nwddxx2_=h=py7|%Fj~*=g#t*qv#q4Qi z7Qd8Gf=(Z~1pF9HzaMp|AH)3euK^g~$3QxRse`D}Nal8CQ$rZm@hHOyBdyYJ2_yWt zxzO|@Uxrm(RCVnvL}1gZmbm@6p-n$2K`xe0twTRd!nWdkDMy*iGmdF~=%Cssg|HambI~ zS+viO{e%NlDLqKo)7YFahsnqM_=9l7$~j6{-po8@$H^zCwY)gx$7w%`22d=3Gk%*9~b3}`*Dl4F8OhdAgx^{T=C;7A?^F-E@ZpT@CJ35s@(SD z4*8L+X#~mn%a410-1p;w<;d$ASrX-KtA}*{w)|$LY>&xLs820_qN==*1(0F70A5)> z0(edShnf&DFJ9R;s7e}((*|&qCq?}90c5cJM1s8Ko-u%w0D=L80tpJJ#&@g}x0(d)s5&@J8;9b%42_*w4!&>rQN~wVPj>N_-|v31DgfKL#+LRi?>V3t(md(;0q8 zm4#OtpB2FD0Dhn&;T*#E0n8<=S!SNu_(voH^W<=>_k5yXeq|RyoIid}+#A5J0UQtDL;$}9urGi^0sPK{ z{Q(@bG7oUgkt*`wD005=%k4B!^wb^!MXe#3SrfV&n;2kw&} zP!DqNf0G|kC1K~~gvYY9GJHyX9>6ogCFZ{%zobfj#^ScuvYZBx5CnqeIA;tZ4M8|V z5NXNjEGNCBC7NTHNGHkilY{1$6~#}XV+%qFB9m2`C5X)ASfe+OdRZAJ2b3H^ii$X!TgYX0qV5m}M*S;XU7C$*;?#R#ZbY@%7 z0x`ouXbg3#5k%I&n-!*)J1G`Ko*)XdNRsms3Q+R}k)II%cu`6VGAtB?ymujCksyi& zQ7nkJ=$D`tr@kG8y!k0P`K^7Gq~9>0yc0xeX@Q|6R12bP5aoh+H;D2<^UExVx9FUqF#3&sA77JD^CiZ0`l}Sf;_{gzEH7Gl&{wd2o?X_EI~DZ-VF^ zM4ce&22n4F`ayIIqEiqJf@m1T$3e6T;)5U>v11Q&2%;r3KeF<(1eHM0ENvY`n;40nlf*3?|AoX8=a1cZ2NY0g@GCYWHgP0V=!rBj2LMxJgtL1xYfVy5NH3Yx#Cs~%G3 z(zz7GWy1GC{6Lr&#E(JD4`M+O>x0-3#6qbO#PT3kFkx{JKNEhUE-{DBTp9X>6xjrp z{l{M!#Ht|H(pgPi^Pkdq-F5$QHj)ogHwCddh%G_<62v|_TZ7mZ#I7KA2eCbf9YO5; zPhIK8zuTT5_6G555WoG${I^s<`njKafEsrW1@U_jhlBVdi1YN11aUNoKZ7_G#IYcb z2jveMaPt4trZjRoh%-T)m9PE$|8p*|<%`ySrPdWW>9TT$ktU35L0k`FXb8hXxDmun zS#Uzg8^Wz1ZU>PZLdFp81aVic;vk*`agXi%6~sfred+`1AGvIQ6XamG^263g3};+R zd>X{FAQD1A$Q+92^j}k7P+tb|iXbmtB|)}-T%6n9%JMv-=NDE zLjDk1h0r>L0wEL(p-u>OLnstN;SkD%P&R}jArxhmQXv#0NF#5D@Rr5J2~XLF5+Rhd z{O~mMBhhylmZly*mryQ*cgfX5C?7(F5GsdIC4`Fq);gb1$ztPlVpWUZBXsnk8sV+5 zd1l`ap+*Qb>C~pyqK@U`xFkqeFNFFbG^gKy+JxFLgbzY!MDE1aB)@S8RV{AHqGlm{ zNSJ8(EkbBX=OgOJRC%*ns<#QDZ3th7(2Zuh5ITkMc?h3`@F|_osK4@MRQnJ*gwT;r zw@!(_u>H;qzodRam1ety(3O0QIbT`6{QJN+A#`WhkJ=-Io^qPbC&(rhdxg+Dgg#cj zJO%Abe!zD6lLv$_kT58O!GwL*cLRomuy=(y--d_qZ3r7e*cify5JraZeF#5b@PBmW#U_k6O`7LiM6Z&riFvLf+` z_mX&~y#F7<&lb!3X42q_5Y})75MCL=i=K(ALRcNbKbdU8)%ott+7Q;U)_SVE{*~lS zA#4ueeh3dj*b>4oA)F22TnJmGt05c=;ZO+ML)gJ8`>8ua*ds$t-bLLlmkE3OD?@4a zH_P8g*jUoMmJe8^NVfeR!r>6k(D@^TBZQOGqahr(GLMDOf-Rr0oUb+I&k#;AoS`YF zEs*waA2#&{xAwy z+*Vf#hfySqQenJ9vuGIcM~z}(yhW#Y*!;F_i7?)_YV~4+CBtu?VU`Y~Oc>R|s2)by zFv>BlN*M1F%3HPM@~;p^MTV8AmBTpN_s!@{VVhOMn37_9FZ||>)AyNHms*2bGmKh< z+F{fo$f2#!75SGXfqHa?aAj){M#C^Z2%}LLL&F#rM&mG=gwY|4j$t$nL;i|oL*0~i zVKfWl!!Vl5WcVQQ<1ku<(ISkN3_tphp3)UbXdOmdn!;_uxJOgCOr4}pWWpHAr(t|X zC~GLPwGTra@jHd_c^JLr>C?328M6}8?6GwY$vyGBT+dgr07-Pa1OP26% z%>>c@TQW=tV`3P`w%NW5W0Fj{h|;c$?R4{`$#O!&m?~4fd6I0?3DcM$p`OO{XK?n; z3}cpDp1p0esdK4wsLh`z)P0^HMf1Y=F^p%W@Vpe}hp|BRRREI%!*0R3DOx z2VtC)VUZ~p#`Q2xg>gEJi(y;}<4hQ5!#E$tg)q+jXS>td{IS4)oy%cdVQW|alO{Qm zDQP#txXIGHVcZJib{KaU{@@mMZ;Yviwuc3g3f@~xniX#;ZX?Pw{#JShUmgA(Y zD9vKjw=@)&EvmfDP*hl|l+xtikx)THMGd7jynLJ}W_dyxYFTPI>bsixp`PT_kD9+= zs-&T^hPss!<)0nocUV<4RMSvhLsdCn{2|qQ8b)?Y7Jgqt4Gpz5)L~I${^Y7AxfXTw z(-cV)zb-@hNtc8TG&Gd!TEi+0A82T#p{Isk8ZvH7mS4d%*3d*lQw_~DbkNXIlP|Z} zKGe{L&|H%zPNvgRLo0&tM;bo1xNB6|buXp022m-Jt*wT38a`pdryAN5KBG>LD)F2P znawskY4}1z7Y(1Yv@=zjlA^9ufo>YUBukaAxR04WYY+9vb2e#_RUh&_~0! z8b)a7tG)UEyTKazk^55zPzO>6QO|FE^B;CY7!IWlqYkG^+DO@>h95M{(=fcGZM24; z4%jAZklX2xk!h@9oQCllzK<#sIXz?!OdyCe$pSIAMU^QUrph$XFkQoU8fI#krQz|g zq!}7yTQf01_-Kucvo*}oFjv~ta676jKbzr~yh&1YvQ_e$Dv6tFWXu**e$+4}U(%kX zwiO!YYsec@7HC+gp-N0yBv*unr5YAXSLyVLDY8k?&l;A=%FkYnrz0H`Up4{R*2R?7 z(i06sbPUz8R>L~EV0CzPtkRxLR+ zsTglc_%Zp3<-|K9{&Nj4H2k9>LB~rCuQ(2`*%PTQoAf{42y~>;kyb}K{mszD+y6H~ zAW=t>j%+%z>qyp-QAZ{nnRTS-u<1~Av%&bTB{^PEG>eX``kTGP_Z2V7p(CdbhYqKX zTsm^=NY!EI-s2tnw}p5uF!Dk zK!>J7*Adkb(_!d{upQY;d`I!t^61FR-sa=s{69xjP)8vh#dN%-qp*%5I*R`1s3rN| z^HN;L+iXV~7eBtqE=uWmM@JPMRdtlsQAS639Tjwx)lrW5@BXJ&yi1}LbyU((+3K*g zCe6ye{_XjDI^Ne&Lq|0o)%7<;@&44*QAFA=PtBx;qd}USnZ?B}~c;nyb z=&qv&`z8tTEnd`HM;{#nbPUwdS4Te`{jH|r36lJ#Z#6Rx(lMB07;ibguVFfd>o}t0 zsE%)SjF1&i#|9lEb&S%nK*vHIqjikYFzc4r(?2?DLTgMn4n{#j!FM(KFdzy zyPnEDPP0y^3~an;hK`v!=IZ!f$1EMQb5E^K|^EWBz|8Py7)6O-fV;__y?!j^nz#CdGXnCv=?DabCv-ru|7hqvI4os+_i}pS7HG)*xJ@ zb4ABh!X=K|Wh?(0;iisTI>G)g6 zGab)$JYurceL{F_)qQID@rm?8)_)zZtkTznf2?jxPJByaAgy7}`HTkA8Awk~qGq5b zQsZsLHQ9KxxTP4d8Bh$f&zTHlW~Lm%zscffGmzcD90PL=xaKwSg%49GvPz-7Q~z+=EKgRs`78t@wE^pOejJVZd$M>bm90?d)L zpn-S$Ckki=bOR*~lrmr#h!`kfprC=MftVbuP04Q{4?#GefxH&y$zwiMZXtJmXm38d zmaUM1q6UgFp|F7>gl7jc#7o~Y@HU;|)LMDWDkaDQ@(&TB?=UP&Eln+B;NP5b(q{wZ z=~tjuq{esAF^^K&KotX34ZLTdwt>}olxhZY*GQ@^2UsU@NTbAod6c<%l=o$*^C&f_ zHL10zGEmt!+3FZLpGT?L!B*cu0|VU+^f1uSzy}6880cuAk%7jB`In$As7(wsCp4vs z-;D5~0r`(q3FChe+fq&e{g0__479THTN}ubSCP!N2HMg5L?#U3Q>y#`K}y?`ZG+AK zPVGb%_>%CsfzFomg@G;>cQqg%6G)nDU(x(p9Ktu$6#hABPXiTO+xig1MMIKEZWBKoN zO_mnMF&s~wAR}MgCgx-VQw;2FZ!3~ld0abV|Ky~p2BsO9Zs0ouvpBtH81Us)dNxa* zX&_gzq&Uktoy}7D5|Qxt27WNG)G+_%garoVmEA&W zljcc_3@j##`4eFYwOU@~X9LR&EH|*iz;y#R46HP;%D_?CW9G!w2G+Ne`?yvoy_36duHyA156`8#!w zfnN>$CZohqa^!EF_Zir4;Ghh6Pn$RgB+O(&<+jOPPuRpfB)!^iI)_>74+BRCCAk+# zIA-8Dof8Jm8aQX*q=7$WZd-dfW8k#Kbu!uF70=VTWZ*In?Sg@eR*u}tNp^R|z%|Rc zDp$}@^DZkFIRdlqCEYY|-@pS|@eD{P+ik)f19vUw9wB@Fq?dUWZ$2eMy_6F9l)nu; zlJSgUQxuO4JTY)6g5M)}YT%hHZV^Ny=6h(*4f#Ah<13k*k21V4P$!@A(!jPEwp`Z| zUmN(xKtcqFz!QNQL7E8CMvyat#v^U%M5`wyN02dsPx2}0BghcJxA~OB2$Be5$|g=q z1V86fGDnbwV2ePBAX5Ze^C{xXCXh9PY%I;eQZchL6gbHosgf&#+!5T(r=&*UB-p9q zI3oDr<3s@$9d`ucNSL>1l9z`WiP=H~AJrd0fDoi+zm+IM5spC8G^&73FsRw`E3pXj zMDS4rA4iZkf_xEFj-ZMh?1>EdBPbQYI}sF!prGW)J3kR~Jd2VGQ;S6KB-y;~ibe2N z1mXNj@d!!~gx_Y4KuODy%u4x{(h)S+np{3&{)=cCYFTPI>bum%wG%5u&?>)Dky?o= z)y1hA!Fv%jiJ)l&J6qYRMc^)=)Q_Ng1Vi&H??+HW2I_;vn$$WG)QX@sc}0HnJ^7>g zmAVnslR3jsobqi`8bnaOfYOj1mc4usK_i(75p+G4ETL@U)+aZUZWmBw4999opA}F( zj6k$GwM7Ii38M=rVz!E)wT#tT+vW(`M9?;Zo)Pqlpq)&r2)aeEpn&qJDB~4Ve&*^uTSv15Jce>K~noWHfffRj3N4hE;&-o^T?ySi(s|PuC|HdtYN}|0*df@^2P`@5RTCle^Ue($y*}$g)?Mp z1iwZg@7HaMV0#2F3Mf0MyQw=P*hNSws7TQs@?NTh#R@92ApaJ@z6kb5a3F$%5wxHw zp%jTqcsPPTBIprC&!~C*$|K{E2#!W@EP~^*^hJ>_YF^zZWH#2$ctJ*<)9=p+PDOB< ze2#jCdX_qBgn8A=c0PhmuM#A@7{R3oE=T08V?1P2(%RJsZdiPca9!qGK}CvgGQ1VR zZNhw-cgT0C_o(+HctH4zTBf&6>dN+a1dr%EmL-Vrl=_TN*_grsJRA)qDT~oB6Ad3qBvMkNseNrKjXTOk~2n;5``^_Cj}LSnyru` zEL)~1gk^A!XS8LFA~g!TI8kJeLYy4bTv6mC$m3##yeHM8ct46}QG6Ih zjVNles3Emh6jHrT6tx-39^;MIWmu0|KZ*uXNK^6FKA_o%+L+peDs`I@Bux&ac@!-e z#=G}jAteqUN6}d(QWULN+B%9hgtpZ7)OOTQsGm|lqsIHzA&QO+J5go7pA+KU>k`G6 zQG7+GD|J&LVzTVLUec5(ig&Qd3xTOoOp9Vn9@}*4%qYGi z%%FEG7SJIg+qEiWPG0(^(tEI>IXI>L}J&nTrZ5>&ZvCYiV`^L)p>hD7MJtjGsSvk?lqlor)-lrxNAXb~mHAC6{d#+ij|V-14q&9^2h0?#XE_Xp`+e z;epKCB8r4ERsN3Rbrk<_3O$ln0kZZ+@s!~U>NBc2Gi6_|6668vC7oB)xRVeAVkj2F zTQQ`GA#Dt~V#pmsx){>OV2eSCAwvv_F(k*3F@{}5%vma$6f++y<8Y;jA~`8irKloK zrWi8E@amW?TMWUXN(pXRVi3q0gOtkFy^t-tOn{(>6i(=COO3%EgBF7xgF_m$ zDXtjYF*wN*b}FiPEcOx97`%jGMa_3w{4oS%zgA8thOzX+bSm(T6oZ^MhI}!3QSj#T z(`XE_81gV&%__;=Z24m-5JO=rry!wF3@4coPcA~UsFm}ys8T$Jw_|ueh8i)*ooP$N zP$q`5F_dH|PN^8)vA8rLYcZu<4E>W5<(qg_C-~W2h8EQ?OAKMM0`qDGE|7D2N5Hp>zv=J7<35|6A*>z4qDn+>+ZSliVb2gLopT7|YO3 zl=gxhf*9D$6FJcq_X~6mqDv56nJ|bxLG%rJ|6;laF{z_gZ@JbZh>b}_rDqVmB#OMZ zkb_C@%&;HFRjd5MW4&|8{y_}j7?bnKfkFlaF<8iuAchJVCOATHxM1cKcO>f|XVGJV z7#qaAARY~3ToB_qdYc92vgS!OA&9kOw22(UDRoauaZR2S#N;5R1Ti&;X+g|l^QP2v z!G{EC&S1_dMZz#Mh|RtHB(sB<6U4*flR=7%dPJJ&d@~>48#zCS$AbKE!G}RS9>jtm zUJqgm2itIMVGvISu~hgIf{O$f2eCxRqdm0wDfLtk%fwtCW75bmTGQ!6X!7dp| zh&>_f4dGM}r@4ZKP%?yXIRcw{*VcXv;!F_VaYzKcljnOI2EJ|PYiFq+I8!VYDi=5# z#JM2Ob4k3Av)xiRg?PmqKL_zk5WfcTR}g;(@f#Q6kaj7E%RyWS;`bo_;4&D}-n{0c zeo;8dN=sc4Pyabjzbc&MnmAk+{FA@4OEjjX{!b7$g7{b5m66i^ zw5jXAIfTL?LT zf=AlLy8=d&cx%?AczejZ8hLLB_l3O87}$wS>H7dmje+)K*kT>IsrG4xxSs4a96H*eHZs-}Q3-SCWu43887$ zzv*LI3m#VpeM0CPLaPv3htM&EPU6r;u)Sbg!FKEgM?U@~CUfIgtviR%C4`=$bQSC_ z*e&Z*%TYbDd{@$YWp^(zdxx-ok7qLU6J=-!{X-Zae4yaq5C#dMPY)@2h?uh-H7tbT zA&khzjtXI9mNVN-gO3eiTnNvFurh@4AxsG2hZcbaAxsQm5{KNjocR>X1ty0uGlW?o zObKCX2-8BC9>R(~Wiz8J#Wle`P#REXp=eRw5=S3}qo!Ye=IP~5deIdN4<0T#Mh46j|x{k1p4?_5mEv9?x>PI1d zjYa!1gs(#QIE4Kn91w-#CqfQ}aEMjytu?*kqxdPCG=w7(bu5JAA$*qgKPqHaTG8!< z@Gk^E7hEg)kiUEAm2sc9bhKqj)zjGA|;WQV2E@dJ79Kx9pzT@K4Byc{2t0nP$ z2tS5!mgA72q&ET?MV-iSE`%+Ac)u?h@s|*O4dFLQPMvOh(~9JRxX~x$d67$H2-icn z6vE{Yu4H4cN)efyndHw9{*tUR#r-Yyxwc)S18efHq{`9Z*WuFv9fkD&)#_#;H|bve zGya7|VXAA|kTaGh$t{w+n2zGvd{~DP!kPbV zI!dymcWbxnD6Qij;dcn$DR`G)DIIqUIg(a%zE?QOgF5chc}ENn=qRJ3g6L(lvE_A? z%koUZj9F1cW>`r`WgS5wj15UanX(KW5gqe&JfkhTxvQff%X3^+HOs5%DDQgb>NP}J(oU2y~e-Pz+hy6IS*(3o3|0@ahP^mWdvs5fG%5c}xpt7E8+VLJLrp#yXb6w+S? z4BZCl7_4K6jx_~}W?R9B3cS-cD%%UZe1_{7q2ow_8mVKHj?t0>KVA^+pPMP@Oo1A! zW1NohI%>rNQ*}(!F+s;f9g}oS)-grL%)Nep6)!g?xwDE_R=A3qu6v&}^H>ezJB zyD0Ryjs-fF>sX;iO*s~@#R>{%T}s;b4DXj3#QTxR(djJvCxnb@m3HgKF&^=@KrVAv#NvyRt<*q7->tnVe5>GF zf{c1w$Tq?4g74_yW(G#>)Uiv)ZXJ8LfGo(}&+1iGdpQ9QYb&d&cXjOJ`p=0u+5e%` z{C)leh{>8$r1_EP9}7-qZMWqd5Pnd{AswFxKceF^9iQqrtRvpY8EB5_O!_aY4uLI!;$r=XCtSp?)amJQv<-is2_AKkHchWG>BLCH6PL z_n*k8=N4T%8V&rR_ioEMH5C|=|8Qcd-pk$0VwZbsgpI{wn} zxA1>BsjI0Q!bwJo8^S0QMqU{CVcZnP&0(xH0=Z#4T1^!WBM`=mC$*}Ra&y8U`olOp z)<^PcHO1Q~d#ib^q=livc)hx+5Jr)(cLHBLj1plK4SSc-7;XupSe6f%?7uaP+rqdf zjC;c<8OH5l+!aPCwkj)MP2Ca3o%FA+O4RcvAeFnrD9z@ruIg1+4QJ+$Y2l}MUv=IP z$GwkgWx^;M#{FSD5Js2kUJeVYt6}ND{?%H!Fv^GV#acgkCaZFT^DBn&V3?=DTBR_; zVHjal4kH*wNJKph2FC8Mu80?^tB9E7F(FaG2WzN!7!1@~jMb81{CbKPTaXT8{8%j| zXoX>i`2!JfYN#$Xlp98+=QW1vVH60jB3LzyYGI6cUONd)uAwqMH6*HL7`24d7A)-x zFt%P8^}`qv#?UYtgwc>uL9LfyqcGZp(N=ilFq(wXRCqJiQwTkqhq)8LOR}0}1+`Yf zTMP1nB$al;y9&~5A4Z2TI)<^chU&x?7M;AaD0Em{)XR;bTNvH5sd@K#TO zG5dzmFN||@wEkfX3S+Q{0|W<#kz3QN6~n`S`?#HnWLOx(!+0W$MQo)oMussVjEP~4 z3S)E_^9SdR38PU~0) zVU*dP!*F4z@8NHA{;B9+5a#YX|3czU9|=W<#kB*A!&nl=$}m=i@g!H3Zh@s?UaZEg zP5d>&fmJotvM|1`sq$*6Y}bQsTs@vQJl2Q&t{J;!6@_g|#WWovmCxT@7s ztHW5si5$lBVei`Vdd^}YF9@y+9aA6O<^1h<9HaG zS+O#KgMzPdvWKxHj5oq~Pn0*q*eYaq7;g!o^E+X@o#orY*e-lu-+V?f?BMvx#_kfr zj}qZQHbMyt&$gm-Aa z7xDhx{1(QAFp3)}Vc>VJs9cr}6gF@%j33VC{29hyVO$F1au`=cp?FQmRl!eJXxFp) zcNcws3-=jlvm=+D|AcWP8~bkqcV6g6;*0Y$e;S`ooeZEhCwJV`PNc`=D;5Gw>fyVu{k_K)!ygTw? z19up>(?A&mWex9)>n;O#8z^m{l$h&tJaJ%cb&rAj4BT&c!~R|aR7e;eFu;)E6w4Xh zii64qf(9xWsA%9p1CCY@mzb{pD|Ipsj&+23m+YdFKqI5TK>?i-x540WzdK%oegz4M-eGK$9&|5ewPlbUBk!Ip$?sW_dG%(1( z3h{X+ow7Qn^%HP0wjk=S1qL`35G|@$MTAsH4^g0xvesd)&b4v-t}Q zEaXTwu&Rz)WMGMbCxtKO+*y!IkzuKU|4fR@4XiLQ_E-OU15X<~xze69u#!h4{8>SY zJmZ?&EO+uo|0)(_V0M?l8o}oU*BaQ++DGvP1M5T?a>d6ai|YDbH1LvvmpLEDX>S;K z)4(eRUZuZ*jRsy5ol%>FY&P&t9YvGjlRD~k16xGDT1VYe*VDI(xjmceEdy^G*d}JW zu416iJ7Vt0`b5WRyAA9y;EMne?4^Ip{38ZF<4CKk-Zik#z(e8o}0C9YE5*FuP^>IY~tkeo6=XNJ>4z7;g0>ZywcE^z?VQx^n(H}Hp$ zDfKmqmpL7p=lv~s#lTe|*98AGa9zmedfqN0hQGu-SWo>Ugvt#A|7Q8`^;Dqiln1|rB6o+ntMzML-&*2>pcMItB~!R3@zF@jqn zC>BAf2=0!ccmyRPxIKb9BDggIuCBL5P*O-{DW<}OH?t1k8Npo@|69Z9pGjCwGA|!N1<5MokU=`|C?1TUlGMMlU{H{HjruAa zfe}Hy2=_0_Y7au}*aK&%?U*81w_`l@;aH6q-EiCPi9Mn11@1huoZs>7x$ z&?ea4ADNu;{`zG-(twM91a)83nz1n(s5AZmpEhk2LF0(`*eOGk2%2WO+dwssphW}K zf{oTdwGve zUJi2`sGeD$UP5|D&?l?(ji8_K6SXxu4~$??1mi>*EI3kdh~Q8`x(yRDTyO;2t%0J* zFpB*v;+U-G*a*%`HO7lFL2#nrB*DpoOj{~|sS!+zV0r{IM4TVNLqg_ceP%{5OZe;v zPSnxnOU_LDu!wU79}%1v!J|UXee0*gW5OR7q`4r1g%Lav!6H$XWc9@ne3CtuXZ(07 zf@KkWVd6^@%OhC9zKEkk98X8^40|eySEG0~g6AS=9z}~NRz|QYftc&3F2)0DH?G`Uauqop0w|psrmm}!XPz`CQxI6uo2sX-i zBY!o54H0k4dh?Ece?t{(=*{uXJivzPH5t_$(wiHqHzIg5f?W~pma)Ax;{B9t=V7k* zzZJpTLddsCwj|z9fcWf)U}prsznM#g$TPq_lI>+FXfLN&1p6X*kB!q%F}yE1WH@W` z5$9tI|NaOLaO5{qA4d>tq)I%e)o-K@vgVD{@dysFwwH50iQv-+4o7f=gSnA9Cit1) zQOR>ojllFqict(yPDJoIr^a*sFCzFx9KMX;D^X5H!0@$*bU4&V5l=;MT4Gr%#?m|^ z?f;!1JL3BYe#r74g`5>U$5ATeC&8Zu>HkXvzh?PwLN2hOvI@8CUg84FwdSNgVxEn>t9dsf_&0*`QB;V+7X_lYE$UsRDHO$hvwe9{ zgMYZw%Qc--d#P>?s0K=z0 z1n!CA-Y6c3qD&NB`vvZc;{GTm_Y07ZtKbC^nq{Lny~kHhqFC-NmA$BnQ9Ky+E^kJn zs1)^{R;wIEP{{L}eKbQ+gvHbasZhVL#Aig2afnKC=I~2vUxK;y)|@EPLd+ye8AUDXjlHX9RibFySWRrKszyPqCRkmt2Isg$)sCW06rVL#KQvZ# zqo^lM*CdMiQ8b96aTJ5v`Wi;Dp?9E>a1tsRB;m1>H;tm1`1F;imQl2dVnh@pqi7xV zuGjU9qE{4cgtv{Nosjl|U83k9gl-+9=p?+eV4#V2|DB<0lv}L5e7Xzv5G@wDCR{mCW^75KO{I# zaEjpgC?*JDZWDz}5}YhJv5A^0WSZb~L3+-JVoMqCB$;8Rh_j-YosFFn#lynqW|d`4 z)T2?%XRk%^oQRJJE)slPa6uFcg*+kn$E{wAEskPI6i;T9XZ_2gSStLftg=kV=S|d# ztnzde&j>Glm-czL{FTCA$i}XUVzux!S!FFpukb6`9$6Q~`fTirLS7PlIf_zEy*}L# z#YU!z;e{BirfO3ZN253v#pWnpi=t0c^*Wb@6FKj)m7;iqy;COeXjAoO6kF-gRJ|3& zJ5hYwRFS_e%C;!B3;9sQ9Z~FzVpo*+{q(FVcRC;zAVHqxh4fZlU&j6zy;LF0+rKxG2h&g&Ors?CWNV zAlcST{T0RET+CxA9K%0R+~9&AL!lV{Wn=c!rq0gy#Xwxs#N&NCX*+NDNEmL4;Y#aV zlC_aQP7MAS0x^)+0dix=iy>dk)6Eo9Q75_DOpz3cp=b=1V+h7@OAN(gxHpFTVtf_= zC1SWehC5>T(+J!e!)-!}H&-+nO2*KBjYe`OtJGC16~o;^?usGQTv1^t9m72$lE1Q2 zD|ISBa(@gDh*&Y^HGY{G%EeGVhO%PvHYG)d3SwUNp;2?yRWf`qhDwrZIv0gkvybh{O<&ArbTXF&aZm$d2ZUX2CSA?F)VqQ^X{*+T)qjiFOQ54Ebo2yze?^)*R6ldqxjG;yhd!-`=uk!kZol;w( z$m_&#ot2-RUoVFGF*Jzbx%s&ajbeP7;D7vyf&Ru>erpTWEQSSLwDvJ{h@p85En;XH zL#r6tO8d8tp-q;s@e@P+cen6*q@9Q)Ra&TyF?5Qddkj6K(>n`x73>m2pB7%fcN24= z@SZXBilJ}J8@dd=h4hKxl@{JuWl%$M`(H$AmzIjxw6_S^9K&lu zUKgZ4WBL5T8=R+c^`_uft`Ds|ab4TMef0v{V%Q$TJCgZsL8jUf!_F+9bNfv4JSupMGf~Kv!d^jN#PB5#Q2d{0rM`;cObp+#`&y}!F?=2Kb~t<^cuMee z4Braj4oL>azSv5AAHz8|bt`qEmHL6L-Aer!!`ZBo(a($iQw%?6bvpbS!*4NMh~f7b zu5xHy&iO--dt zZw$Wp|2?*kI10saQ`|ctu`Bra9R1C4_{E{HU=Ga-8Uq~yqR=Ndjy&P{f_Iwd|BO!tGs(?3lG1K`xFZ#Z758=rIdSid#g1cj=Rp0| z-l@pK3W0PSZX5-1REeWz9JS)88b`G_s>d;^WnSr>+R8>+&(>;UYjyQctwtOhoZMog z{42W!YV)|d1)2)hiKDKNdVrOMj>f{9WEK8rY$m+9U<<*P+1OUBt?)L2 zZL@m2xcA&Ei|80fr#OB|;MW8?$I&H@dI{7|plcl6;`lR;zvAf5CW_-(c3Iq;p*`c6 z5ywMu^opZ*9DU;G8^`!KCdAP%j{b2BiDPJ-Zma$No4DNYr7$gMyz3 z9%BE#?G^W_m?VcK`H?t26Xm*?)Q`vUMI2v>cp{F^g{&X%HJYz|{#P7z?eo8m?7sx0yN&b%GpSX9iqFMqsm@Sv71ndNS2_S*{6L=tjLJ8cI zz^w_~mcY#k6iz@(KqZiqfIoq}1RiYVd$UU*kU(w%Bs3W+iAXa)>rffZw*D+DBK3($ zs;FS5M4~BXN*t1c^v~o*;v~>%f|gFeP2f;lRqjje>JaVwa)Ha`^9mCDPaUWtST%tw zwY`q3&K!Dc3^fv{DZExzshvO_;dQeLH_GxSB>0FTIwa6Bf!+!9N#Lo6 z@;fEaofT`R$UBSDg}(v`bW7kuTTf&t-A>V=M*=wpTPch zs$T*V+o?6}6mdWTXWOZPf`bwmoWMWrRPpxerOR5y_G(xH!xK3FtTr)$5eaWv@mGFa z0wZ~($8$y{Fj~kM!LbRf`&*;#w)cK^$0yLHy_%3f(+;_(d-_(?_l<9_CM7UAfhh@0 zl>zW%do?`);?Eo@Nfc;CioyHHsmPYT%OCm=o@%M63$C_ zmn$zm>C0*AdyMnz0dK#=6A5f>uO1g%Ah=M_o|(IdqjZh7I01&^?G^b_HfaJ+C-4l% zLwmI>fn*2OroCF80QbVJ5WKB}w=eG51f0jUbqR0l>2nFJWdE+zRwb||fwc*4#Pv)b zKJj^WAHct~FR<%7X}6SB+B(EgA&6!oo28bII*p$GL z1U^e(a{{k%DQFqkmB8x>Y)N1z8>FZ92FHH_Z*<_6MQtnFp@Z5k_?F`&m`1okEP%<2D>4-)6qM_|0t_` zETlq5bwJ2LPPYU;Nr3ucQ9jLjR*{6%k8&2|XkRAqRRYI^9~V3!__-h*z7W!?qdGcT zJIM*M*ncJgUX1-Z!Pou=zDeMe5c1PPz7?F=QGG{3PxhJ-IL}7rnCYl~6g(?-Hj#;*ruS^-?_8Np+-BkrcG+bA#RM)TaG8UItFh^| z&(#F3alI;%d$Wn_Ldbn4{!HL6G5;34!I_nf<)^#o^DhUX5SU(ahC(K8%5q-tr&8EN zPFC>?2?$>5sPatYo6t-s6SsHr&c}+FC~Bg(n70T%JTRY848^i0NeOYISdyZN7N)m1 z;|>#dny^hiER4HMlrmwMh?uzBL}?S{SdCWs?Kk*?ozy)h+I3R*nz+wIzfS6Y)B6=D zW8wiJb2=%;QYkAYd3k0v(OQzSBzA-BGX1|}MsXk?;^iKZep799Sl_k%(o266_H!d(=fbARna?anT$rHNK1 zUOeS*ZK5r^po{vxgVx6Mt^kC)sCFjWo9JMoBS)Z#VO>-w!OkYSn3&n+e=XBhT9_t9 z7Du=4S%+RGdYjm4;w=+>O!PG|j)yP9l|}S3(ci=X69Y|*GBMi3AQOX43^6g3!-@N0 zx~OTFHM9!s@1l5l`8<(_zf>D;Vgv{FqCE1EqL90X^2eCozofAoTJ^MJE47kcy(iZu zn3!ndNfS%iCMG7cJx$CrF~!7G@t@1u<_4zmh}d^s)pRju2vUDYh}}GoQL{|UHZe!s z9yYSM{`slHC*^GJVFxvnHOCHeV&! ztzYg+_EbOb4jsd45wCPr^}DGd-BhGo{(^35*JW*;iC0X#YGS>KPmXA7x~UhLe>e4# z;LCysx~cQs)Y8@d4JPhypTCh6GqKr3omX>TH?hUUYr>l@^;0R?T@l|f@urEO@W$O0 zMV?o@&9P+SL(@C)*v46A;vEw^#H6yv#7^P61a}Lv=9$xyy(Zo@v5!gmcxNf^No@Nz zzV|b3lK)4-KQZyK5W4LbazOB);2{(5H4QM6PsKbeNY5iCJ`;Y_#4!`cO`I_KT)$V< z^S5f;q&mL4TG?IoYpGHB%EU=FnvD%MzBcg<2d#xc7EYNsZDLOfdsFz99mD~jLZ1}A zGx5EN*OSbr&nA8`amB<{)BCUVtKc7k zznQpT;&l!(WF=OO-bA=L`$M@5;;i(lE@XMZ(;a_&~0sZ?{86F68TxB-hNN% z*Fz~$ie&YfJ=85p6icFb5+#y+W1&~ddp*>pn{jIrw~5KeOcUj2iJ}WqY2Q;tl87czRg_o~@g(ddoFw?iHj(7J8jwoD%=&j4;kSfu z%;q_-r%ET`CQ&8n{e|@YDhf&8jM*){e~~0Cs9F-$lc*tSYYEmAJRteh7EZV8JypFV z>a+ADrXehBw8lXDv2gZZ&K60SrSdNX*rjh3vVH)_wpQC3vZW1 zdm(KE+a^&@V(HK!iB2MtcTA$A=+|%fXm(AaTM~nl7?MPH@#&pJA0a)G=$S;XB*ynr zPfC(~y;NU`Dm70Vm;~$4FNyx53=m|7M;ql0%JOe|si8>>OJZyiEBAee=&)dg}fwKua7!D!prmi zBsPe$NpPd!=OgkNwK<8`#2ns7CA)idcq557IVDrLFNLj1yp_boBrYZKb`sl?IG)6b zB(^8A$tUw)$Sy&77CCs>}99)QC#u%CGlPo?~Bg|oPDo( z121ob=d+=Y`Z$UGNqi=;2a-6L#HUFdPU28D&rg!r)5jYgUkj2PVc%`hxZqq7<*0Zb z%lhwG?f*Q9FOv8!$(M(C6Z6X?z7g`3;K?Mu7IH(9=k-;mk~p2jw<6O2OcIg4UWp71 z`l=t2_%VrJlK52|&T{2X;-@6eW&Qj2RWq~xKa04gulg+;`+E`##^zrTb6;QeM^-=C zS6xoxN)rAQ0x4Wg;#v}aC-ILsydX=;b>V*|@mDsL>Zfib@voRSr@W){2^JEBpwUm= zl)~AL`OW)zM^RWrlAIKV_VfNz=cbUC!tE*CkwSh7S_&mnxHScpLXi}TiGR^-s#}CC zldM+tQ^m9Thy7G$tlpMYN(%A6<_)SlQ@C5qy97&ReSYt!N~gf*Ea-EOh+2Pje+mzz zP>@2E6w0JfR`g^Fsg!eW$;wnnJY{ znx)V@h3YBPkf_FjHB+dYLOtQNQmCEcJ8I--qLu&m&$V^!z1-@H(lCVvLXJw&jf9^R z-b8p)LHctkYr&eN&?Uu}+ju_^tx{;4Lc0`NXMNhFz@>xE?NjI=VrRjQf}I5a>aXq? zpv(bY<7_GA>y|?I6naTi4?*f|*q*}gk%^Ew{JtslOJQ6J<5TFL!hn>wak_THz`zs+ zrEp+?;%id)Na^4dhH$X4ssq%}0cuzZ!&4ZY!ih`1(yja>Qr`D{Mx`(^<^AKBIl%iT zvR-hEC}Rb;iZUUEi7BjLO;VVY!sHa@rSND9Q&O0k!Xqi~nU`sTvr?EXWO@oSQg|qZ zW7U0(Wtho9-Yh^eM;usOMt@k$xhe2NjTz;SIllQKK9Rzr6dn`KsK--SkmU=7{5(J{ zPGLz3%TnH>SlsgcWC~BQJ1lRb_|gi9sljjb(r zBzL8-J5>B2p*0n8KwL_t@hK2Tuy62CJ)_O}4rw&U_sT-KdlptQhrY3V(?Y zxj9(fNMWHo)%9-*Z3Zjup*>O7dq8RMU{%OMDGPU7xXHrJ7Wj7J!WM3`P|`w<1;2$C z2djVu&4Lo1E0`ykFUWj~SSV_F@8KySc#DN%7K&SNoBJrL=Dyp6x;9Y`W3|6Hr++!iltSsDX;XVtxg|Ou<0{2^Zz(N^Dy{_>O zGPk*wwNQG9s$iiUk7&KWydcRfL%g>iSG4e;g-RAGTL@YRS>CIX85&CLlI8*O!9&!- zA}XJ zv2>^>$4=7F!l%6hO)NAO(#S$%Ar$p|G_%m$LTh%Yg@XsQ78Y6wA#W+9*g=hf=CuRb zsXWhz4(%;;u<+P+?cbrQqlHcuMjh7rT9`6ab+*vWLU-X^1iK0@9jdksRXr^9ve4T? zPYX0Xh3|i``0^`HVW3HID<{4MVt-KvaHfmrU<*SmST<}MLoE!maI5Y8D<5uQgoRxe zc3T+9%2;^P!cvadVQRF6ajenlsg}@QhZ)2Zq@e=2&=GJn2kNJ`hKT49>Ig zsD%X<7Fw9+!+g3~c-+E&88Xj${G6G*X6FeDi!3abQVM)tK8#u-CLLJrQx=wSHd%Oy zh1OKdEv#VvP1WEA0e6^s+QKuI_vq8J7FJnUZQ(gFsjOrp5A&XKT4Q0Yi0dpoZ{Y>u znJ1wpJ*Clsccs^hxL}xiahQ79!YdYDx3I;+s~qi|7sFM%;cBCWW5ZNnxY{gali*LH zyk>zq+xZO(Z(2D0K;FXPYVdHim7Q*ZgyAhAZwvBn!gdSq2;X60XV!-~FpAE5EbO)L ztA*bzylY_}$Ag7$EWBsoeG8v(JX`pHEnFe6Uy$TO3m;|q$4ow4Q9O`U4q7-Q{EX;_ zg&(tUT*wi@&nz4j!i0rKs1sTKrG?Lhe_`SN5ni?#{7S@=g7rtJQ#^34T4H`H_=DgX zjyg&8otWPX&KKoJ;b$%U+|GAS_{tILCm}55XCc2>__Ljl<^`@Q77E+QvGIq6ix&R2 z@DG>Y1-Uy$s7n?uTey-Plh=h@6}%?M_n&Y?{b}JZF@GGPXx^~!FIPNMyJw{OdxY}Y zAl@Vh!9un-Ln$)cY=b6=-$ua3;AL7-8#P9%TpP;vHl>s2*~k}B6Qt5@q+(PN8x4DE zBusUSq%CHnxR4Tp^GAA7x7jFZ<8~W&*m!r8(rw&n<1QNy+Nflsl#RP>l(pd-rMQ2C zyQ<2p*Gk*C$Hu)j?z6pDi9TSXjMVvl8?Vpvo+>R@S01??sooi>?jEJe*(fg#6$C2^ zI-?YyZsx1~qHKpz>cP>f&S(|05x0?$ ze3Cq<(aIFgqItcDX3EB!H~b`yjkJwNY|OLavJFqWuc?h@?55G) z#n|RjIxEo5Mhly-yz?s4%0?R@t!*$+**jXb%@UgJg?A97NuSO(y4VCn8O5nFZFtsq3B|Nr|Q}W8zb2ZKWGf2gp3v(KSqtSG2X`9F={4< zhmDDn{2?1tj%$-_T<;T@W@EAq-u0d$I8~4)GiU5{@tI-c=v5z0ZWpO{HNa1B&ayGv z1_{F)ArG^Ztg>;8dertlx3Sj7^ET$&c+AG*HWt`;&c;d`3vE1M<5}Cgg}TVbVjG{1 zQBT`gV&h30%Q(l&`ZZck&gjn_DI9dvf^x{WQIp$;lJ-UNBW#yK13Ip%F_wegmXw{7gVaey5$UfX74 zyN!2jv}>JPd92!DW2cRMHr}(b%f@at8b{GswMV+?T|p|WHbr8FXMEnb@qsvhXyaoZ z?^s2jkFtcEZhYpEw}B4YIAr4!wvvsLyl8LZFh^{g{NpxG*f_#TA?EAbbB@|LCcIeN ze46z6TuhQLZG4f9qRH@;4Z86M>l+)VYu8bwXz3g!#a%yV$dIPcxd3@s}_W%Y!Jw}^SGgJKSfJ18M0 zzoo@5YSF*pICYzYmf~4bqFz7mzth284(@Yszk^cQ+)4|%TabGvnD!pw_d2-#xu50( z4$3$vFJf6iisc++-uXj!wZm&gykRChqE;h-if?|3JfwH-9Bt<@D? zN3iI4RZohGjQ2`!=%A5fpG86Kp_c>tG$T zWvqjq%*Vka4thE0?O=j~i4OWW=<8rsqdabTVukxT7~){4gZ>T%NS*^7%$T1$NI1#h zETQu-2gAi2=U{|`kq$;X7$eFk2MqM#N1%wARAWWSh~tH4GMvQW{d8{i)`5o{Om;BE z!Bhw5*XAd#`Pkso986~&9OSJEWRN+K&vfwRcr}Z2VS-|q?O=|BhsC4=14ZII2a6pn zaqy^v`3@eFavyiFK*+gGzO$QrM0ze1gB1>*cJPb?X7a29?q#CRv_!f+C(fCyRy$ZDIWUUJ>A%*&^A29fikWJ>=-?#> zZ#&q=@#f$a2X8vq>flueJTGFx4Lp|1Iefp?Moy~!4-gKh@a9DH`! zNAp_;XB>Rz;ClzZNz@O5=h;E5KsMD`_M?OMZ}DC_l);}J{F;sZMPg}YqUdu$qJ9@- z!b=V=a|EWnx?OQ_)qzj=HF3Bhc-_IDk`I0U66J5fe*`y8P}Khw&J4*JAej^ryeW;F zg-|b?#s}i>Pa}{WQgExf`N(Z zjx_E}+(`X}RTXFj@if;7b z<-ratagyqkMwv;fBb$1Xsy<0|PNPd2UD=Xp?}|s}?Lghr=qYB8w0Esz!X)qiCZl+9 zgG*DNG=`@!B8|Rj^h=|E+7ky04iKa{FpWW3USy}A$`CP!^0^(-@QGV}m z8jq*3fJOAlWmufXLg7zjl|@2oPF9RvlE#x+efVUxERD63)w5|lm&SXO)p8E|x!MZB zrv;x8Jk7LetV-jhG+s_)HRns^0K-}#YXskl2cA#kg*4Wsu|AC#vp$z6dt;2we3L^a z)hlUi%*MVdWP{+nQ#`j#oOD87OM9O(;qkuCDS6(%C5<;YN~fsqQ@jEERvK@o@mU&2 z)7X~A_B8hMxPJ4#Z}?6cdxY=EDm#VjN@I6csXsh-ukd%%*eB#YPNFnEO5=StvM3)u zl1sNtp8P`M$0G7njmiPx2h%ttPEJOn#FkjT`Kyl;Wo={uM%zoC+VpB`0Ah z8#X!9%6&J-_ z@A?cwF(GBn`^eb>%}iCo^}hc?lUea?)wjF2!^QnB9&mA|i@RL!#!6`yrCi)CoVR8& zcU%6u?Q)NcdtKZov4y581|})vqO9v}P%kIQ{pSoc8OpQfQ&j~)nw4BscG1p7dlx|$ zAs026#D(r6?DDP1NV?v9Hw5D@UpuTK!lN!?LLyVW8x0BJnXi1NTv#p&TvTyki|z_K zf@#5`E4?ouFz^GWRb5mQk;%W2Pmxv^ldba;dW<$XS zf&)f-UpSpB`H(brz0a*Sk*FF{)#k!m3bt^)^KH7d60^07HZIx<&mcdX$5@W!4la7T z=;NZJi%u>&%kb_g*u_Ox7u|&S5Tt*17yYLG@9E2@&iQ&}^@q;+=1f(6T?}!(R|Jsv zbJ3qAZp#_qVxWsbE+{e#7DAnY=1>>ITnuLyxESYpzZxT5jB+tXc;@R%qlGhyuSg<} z6?64eHJ$^{MGL=|ieaLQ(w+U=r>ZF~rn=bY;yoABTukS*?X9h1o49z$#X=WPxR~jJ z`*I(5vB1SF7qeL_sV!?YkMn)1df3HW7mtWYlYvo>x|r|cF^M8F@UuSD|6rR;Q}<3& ziD_yP8*`d^hC`RdO;d|qEOGJFH1(v5r6j_a3G&yR`f}kUD_lIC<$I@jH}B3&Q_o2S zR=OxO-BXCGU954j*2VKKwzzo1#S1RhxqOc|UUl(%wZM88FAJ%?+4myHYMcC*Boh+G zQrzHTBfH7P>!NQGpUsk_@n&Dm&E7u?x@DZ1>P;70UF>$T$HiMN-gdE*qj$4!nFN^~hlG>RWTC{uN3_FSLXT)i1V3|eR7kIW_wfyK?*EC5VxT9F z@dvKkF3!3*=i)ra-fXRTEB{X}es*!u#U&TNxcHR^?&1#@^QNocTwD;sn$u(;$tdI` zmt9%vz6e-#9(c&9fgK&1jy zE10aSrkhav^I zr2xeWP*hARjUBDH@Dc^M_5acJ9#Bsd?-%fUEhH~wMT&?NQ93F`ilRb#-DH!{q=+ zj2Dbjyv<3yU8IB;Ih&G>K`whKFG_n+MmC(3%6f697fbpZ<>)Hosvv%s@NO^4i!hb` zD|%7Mi^^V9@uHfHs|uN`{%v_g+O%ltBDv3t>Rx>B#Q`sBcu~`fHeR&#qLvr;dts`M zwY{k0#Y0{^?6ue7)D=G9MLiKJU-UN~6tC~a2W9e>Chdhxk4S0gg;%73*M3EaI)l%P zpcf%8{7MRVan)mcKGoj{v;DnDNT(7N;il*(3nAtO|00ijfdTefET-~b&ZHM971Hve zsTa-IfQqtfG9p%Zm;5y?D-xj$U-)7#m<5ZRGY3Fgknjv=?3I zcrUA*%EqlY^B8AX}OK4Ksl+QY*)U;1`+@h_X_y?DWk0bUIBqPG_>vQrut z?C-@h2RzM9&r4ps?8PhWzKnZUd)Mn;yy`_Cj>cDv*SzTK#dI~@zyZdl)%HsSwCU%? z8(xqw@N%057%#rz8sx=bubwB@_6+f2s23x>7^UJ3^J4fD?h)d{SrWdgv%SFS0S3j< z?1HO#W4##X#nF+TF~TNS^SCqWn_i6f+FPVDENzi@wXrQu@?x?V?|QM*iz!}A^S@vRqS z2O0Z?-w7KGGN}CE#X&Fr^y0i1Kk7C-ML%8~^5Q2i4tsILi(_6K_u^-Ev=_g4?Qa^x z%I0wfs9!dZ%cM!DobcjTFHXt>qg*w&uIP0G-oj^;>klDQf8*eH{4mOJ){ArhN4em| zMb6be`&yTrTvtT?685BK;`#D}6j-0eeoABy?x zO()6yH(ufLvF*0+|Csh z6eX`Bj zWo!7+!H;o1yy?ToKJ4{jJR30Sp60`JA13%P(T7PsO!nDdx2Ceeo9B@br?9_T+ox?Z z`qW@!h7U7+Snb0a4%EZ0Sw1WkneD?IALfcvUnnw9INyf_j^1amvB=?zMV1Ih4mOx; z8OyKe3gJrODxsY!o3%b{^I^LW>l}SO$A%9Z72V{+7Lm

Yl;IR)-IL-9-*!^p@!1nE4c>EPF`AE^-KJ0Pyi-V0%eE5`ekslsEKJ(#o zAI|%5!G|w=_|k_%KK$gvKF(B)+-&^sMZWUkYab8s!MBPs={q0xt0TzWLyRgzjGX-e zAAV4;G4DYiesp-_A;w|xlRljC;fN1E`*74rJ?_IVK2+T1VmKx;eUXbEPRQU_;h1YK zUgESa`n!s8#)se7N{uuO+PazghYx3cI47Gwh5H`O>o&xG2k@c~mwdRHPeU2J*#hqYGpUmvdcaMg$Ze1IP}`0eq=0mg96hdj1hBlj59mxNa*GUH8t+^nPm zeiRg;?h%-0DXWMX40^&zZgm(+6bJ=7C zKPvihd_x|i3{0xxM^!((e)#;T=EpsL)bry3KkoJ8K0j*uQOnQmo9xrrtNT&IZyyK$ zf{qR+@?i1%{iy9n9geOcwoP5XeeQYAfYJXl?gy2H{1HFu`|*(fdg{Z{FDVyO8~D*s z3bQck_aop(b3a=65%eSEN5T)&k1#t(W^uoLZabauT=l3QF^LbWV9fq1&#(6**}8P`h?5{b=RKlhPmaqqWEryigtc z+!Go+u2Qj5ZP*TeyM1z3WFgzh_$eU`Sa^0>M?W_EvBi&0esuQZX+OI7F~pCd^y5c2 zKVI?URlmJ1B|6mT?ne(lp7G;ZUa?%EZwGijFY9@Z?deBvKYIGn%a7;%xLVfMN#+hU zNElx9gZPpkyN4P(j^#1D%zkfbC-w2;HNU-xms`s79_;JK>wfg}+f(sJjq_e;=6-|z zo4NZ7|7e^yz>k6AgZvmQ!VgLs@bj8D%#Y!I`){4KevI&Aq#rZbL4Mr!wr3P)dq3V3 zA1xds9P7u$p#}}cD>})K$s!Yk6NPsTvkj*BG0l(ZeoU1}rRP}}v19>+WiZQ+*?z3# zt>;I_Va6Ok=KHZge6DbwaM&6F??R8St^Ol+83Jf4xOe*Tp2)krE47o%`z(x<4|O5#$CBHU zg~q$2er~9#2B8&Hl$fu6CFBE0ooc)(h-mgWz_v3)bH-3EUSnl`ZJ8_nW z4uA0DprVI`Kl<^LV|mCaA^p?%2qzFfj{cv#zx*G5!f*d6aK?|{M1J+-q{u1ZX<=>) zi{JhD!;b<1xB~Xq`?G$W^W#rHCJeW4rSpDV@Z*{vc>!GXKQ7O9z= zL-c&(JQ9v%;=g`e;r&9livA}X>a?Ndn6_>Na6Id*m0N)1iPyi1H&^v$^19&8W z2JFWGng`I3jSxU4VE=6K1>g@LAs!Hhg-i;HgoN|D=0`-L!k92Fq~%}34O2YnD5(G} z@wB7#C}CtB-Y9^^;!PZ-X#mZ{%Z#vh{cRCI%K$nB&{<-u0NMo5R{XI5T8lg`d_u_L zG1rsgPYK%zDb|(4_KJ20prfOwMi@^!{Mi7y1kg2rZc=&(yF00EySblnc+(NabK*T6 zrB?vYi@zY`8@|tuF!-X)O93niU}*p^2k=S&uLjU3fN23t57;jUy%xZ*0EP$9SJBsn z)cXbSMgaXeHlz%4^noHT$@Aa9X8}K z%CIPa#Y)YUoXRpq-w`ekU_}5c16ZZ#CgEz~8sS~Fl&H3^>*9t_~e z01gH4QvkmNa7^Oi06rRFKZ#{H62Q+Aj|#a5EXCvECxnc0$pT;RN9e;z|HlIj;s$ zDv1C1@Sn4H5QT#F!J~OW>^hTIAP59;Ll8FxaZ?aC2k~}MJKTE0lfxZF!BD54#}$M- zi2NWvENV}-IrIc!P&t!VEQniz{D}7y3F6)pp29)g8pH`%(wKx-EUN2%b2+bg5Vwh! z2;%l2N(S-$gQyrpr69@$?W>pcd&&oKR}gnQK6BYw z>_AgXY>E{du_l)lr>wWp{}ss-_^&z|8~s{4Yd&N)1Y`a#qPqGk|vf~Xrr z^n|BY5cdaBI|x@XyZZD@w>hjA3d!cpFJ@ntxf;@^ z*EY_zsy~Q85KjitE{I?dp&%Ls(Kv{35Ro8~L8Rm%8bmCJxZ{m}5# zi@^#a6GT>)X(4OJ0`ThWlw(EFB#5R#G!LQ$J5i-#QnMgf_(z?(v<#wE5RV7(L=ca$ zDf)R@=ZfLAn~Q-LYNM;S73LZwSB$5EXdgu9Af8s14)V!McMPHv$A;fvo9D(u7Y&%M zL3C3|=#%58dl1hkBd^j!1|-i0@tj1X81D0W*p<%*?Z2g72%>z`JO=)l?adZz5EH~F1~Dm!$&OAk z?rD2jAj8xkrb(afq|Ok@8O#!&9mE`wxx#tE`9gZQaip;*h{cNT4Pr?UOM^V86&r(C zCULc6xjcv!4qqvm^?k#9E2#9GmqbiIK*pAU2D?E8HS{OSo0IEr{(REKjGA z#tw(SE%FXqRae;=#Cz;kCv|raA8-IDx+{o}L}tjcyxVS{JyJdvzAycgAU;*}vmm|_ zq1opmUkJYx?i2oW+4D7rz4*7n?}Yn<_Q@~I$nbp-2P6i%7CJK0_%Vn>oG8Mm5ynqJ z91fyq2)#l$62#9zd;LK75RL}%3)?M(S|J<@;yA~42n9np5yY=ST;enp#L1xj#s0S- ze&?|K({n0_(;R!}JPc=o=u*N?{X;e+=S9v2aZcnutYeCf7XD_rv$i6Pa4I$hp{`bi1pKCWOT0rOu!7Wm3 z)b-RtA(RZ^ju1Q{7$MxERQf3{QaFTLLnsnLQAaNpg4fCW_$cEx=_Q1>hrpF}JQQ-H4dSPc*_u)I;qV=XqMx`2~NMXP?UdBwGw$u z*jh;cTSggAgwRIOwjn$%@?;3@Lg4?iPleDSgpT6vh2O~S>JsQA%g&CUDd#+0#Jh5c z%BEY$-V=$J;N8?Cgl9tbZS|~>EpL?(qWS%i6~h)fM(nxpWK>6zjS z9c5MsvqP8@!dyq0AHuv4ax-(U(Z&Ml^WMy-!$snY9m^#mONApx8!JLsDZV>|RUxbn zVOt2>Ls;Y3ZxUG>!aDj7+3V6bgs@Q}IhXe{MVr z5Aj54yc@z!$MU@pK6m=!q{s&$P-OWTcJaCnFP(39*`5$Smaz|;fE0RD@rHdh46ijkGVcJ4u){Z zN&QhIce$T9_Nv<>NPDOJR}{UGtAIlIFNAB3{S9H{g|D|T zL=L`UH{)w#j9jZ02*VXdF(!rK4)b_!+qj6Zps;Wlg+!=(M2s+QaTIP^c&o#E|LrO2 z@Ofj5+Z*r)O3?uBMdc*LE`yC|^Mo>H?tTy&~u85*hVJwWe z2>mBS%rHz@T8cIiriB?{R!I9sB8|gbylwyW+%$}4VLa-jJ}%N+*dmOUVYCY4F-2Po zzbTu?r@qWs@6Nm@q_h!^8D*ae!O$*@u2RUK3ZuQlJBV}?b`o|LJ}vAbY&X{ECc?bk z!|37gXTo?*wd={gDDQqeh9_d^6~^;nybwn3FeXGXF^U(%cqxp+QQR8E%VE3{#v>6l zh~U*Q`h;;Hj34MHjJ{zk4P#jtuZPi(dBd0(#v5Vu4`W2w{*5+3I3#SpSv*jDkdR4( zMRtxghC0eHk>Nt~U(d)eMzL+3)NvwX!Wio)hsN4llD?_vc;U6N#w3yHVay0)viKAs zEvJStO}yMVJLAkSW+}QzI9oVRI7c{Fc>g$Kei#eFSg2@E9LAO~HcF@GO(ILj8CxA?dl=ioxa|)8 z=pJXh<>!xZYduN_XvL) zXY3WZ;Z3`h7(P|>voJmvDIG&eQz31IUc?Xqxxyr_d+^67{-sR zNCYJ!IK(giVHAkK6~W;!j&PucaXyTn!#Eno=`hZO@k70`6Gx(d;6{o0mZeFIgj-X8hZ6kPG_D?vu_R083MV}J36JC?vK7xu9>><=Cg3b}V5JB$q_buvHv(OcRr6eAcBDr%#2``k_JUEGJ;VN431z(1nf{| zXBZm6un30JkIbkIzT=0-42sY`_OBUt3*TEM&Gs%N31B>5AK z#Sy%y$;U3O^koqgca)V8tj!rmuv&z3AT8HKP+Kzq`MLCGn2PyTYBqn7n-;{!s+G zBls|9^So;phmcaaEnaKOvquxi$4VV6{nH3Oi(sE)|GCH)!VfhQe#xGdB@6tO^shNP z^|3pYVSfY%Blt0b@09etkop0UAA~z68iykIN&FY#;Rue1(9)RW`dR#_qijlhj*0*L zr#*6h6+a)r1(A~xoQmKy`&7|Cgf#mtg5Sk|c1n9Tf^!l4DG`(G25)%Hb1{NTQruDe z6~W&eMI1sA{3G#-kd~Jt_*a}itBWh|)d*^dPPWV6t_j~#cWlg zs2W9yC~l9Uq?9sIl#SvJaT=5oDJ^_|l5wY_SBRpV_+7%gqbN_3Theye_0uGKQCUSL zRf?jr2$d_7jA{?9 zl6nYxM)8cuvqJiOPK5hnk@pgRUid=P-WH4^mtVdV#ptNLSoGy6UWww>DEdS(Ac}z! zUlaBd_7%P!<=fM?J;NJO^p{A^6`q3}K1^hA6hopID$dkguHjLPh+?F~QI0)Ra~_Ce zB#w<@oXDHP@&Ct?ch;mRzK`NS6qBQv62;Uga$7RK8^yFJrbjU&ikVTYj$%y|v!a+C z#gZtNMlnY>+5#c{%oUjz#e9+d8?S#$Ss2A4$7XR9Ure?qkY$d-jYgM8u_B6wioYdX7sdK0Hi&PEVsjK5#c7uN622vhZH}@vii^6|b}8ki7)6`7c8I_2 z*u2A0q)*kIQM{+#d_Rg$qxdX}52E-`%C0E(h_H)4iek6Jx17xT*x`FcKH=b>;+*^_ z&L~)SgaH*$s3_nJ3D2ji13qox2c@aJ-rFc>NlJGAf#lNHYNBpwzZ^y$`PVX_?7{h;#1ARl8^fJ3l#B6&4m6A5t{CoSt{5JSVQ^D-`50=&aKCtk z7%Ik4DTc~1REgof7^=rmHHK<2+!MpSG5dp$E0?-WHSVu!%>3FuUTxY`dxcevn7yK@ zW(?m=H8x0Ll$@KU{xQ|49kXBauOlR>D^gEbdYVx`hKFJ>V@SsEa14*c5QrfthYe!z z#_WGL8ZyfFf4Mxqu*)ZfqF?3VwgaJL~`|@rx9(Y8I6Tagq+W*uo%6j8IQ)$JO=K< z`t5t37BRGp;p(^cW>c+Vcr1ny(~KF@jMffev`q|cIgpaLDTyazXcxnzI3~yOR1EE7 zm>t8M7&^qzF@~OeT*EfWx~~M??f!Ciis2`21Q)~8F?5NcYYh7@?eFf$fW);9G+%xLp?BtK^#jlT$^UxG2Iv)!;lz;#xN{qpO7^| zNHRQzA7b`tStA`~R15=5TNx9>*cisCBg?<#`G9w#4t04SutFc=$>KRJ;MmjFnrxTZD$ya&SlrLh2u!ZF+YX{ zw2a{rdz1b6kns+ORt$?`Sj>CbV=Q5j{w}mWhNUqqi($FMRWYoNVTJfgVed!tS$^8D ziD9jjXCJUP_#&>0q0bDPZ-`-|k~YP#HHK|5Y*v&>TQ~-07+>{uZI6K-sO*U0EhqII zWq+GpKf|avEq`YW@5OMAcgjrT{TM!o;ma8I#qePayJGkxhEEwPxY^Dhu|w6!dt%rt z^0Dy341=Xz+ucJfGt=gu#X$0T3|}ZOm7M)oF?=1v&oLa0;Tw*k7!Gn`XGwU!$MAg& z2V(Z$puNi3J6#X0%$~L1p8tF}=@{*J*NM}8a=%eepH4A0K(>*`e5eL04IV<5RAB)Q6|W2QmE7n85WkQc|0 zHg3dmLmW58aT7hvG+c4q9LFm&jRJ~NA!i`TDFx#w6vusWRFA_GhY?5dIBtvMmN*K> zQ7n$9r{=9WQee$YDc^NinyAx z*D|hVaXcDFbMY2&JQhdmI9e*&O2{lUtH+~7wR6SeoaedmMa#UlaXcAE?>JtJ<7&2G zyEwYV(VeMr6pR?{$GAA&)Hoj&$M85t z#4*wt)nnoq6~|~rXSZ@QJHv4WrmN+ly7!3pWU#E^Ta%V@n+8dU$rkabmWyHID5fH_kD(NiWmHVCq{E%gwR* z+pMXQ$oWd(g8c<{#_?Vp@3Wef+#kfTON9JG4(2%q3ByMcZ=Rk1aU6R&1H|ziJAIDv zNgPLC@_ZY|r*V81$LDc;5yw~RzAuIB$9=p79RALyp0CBfVOM&vaE?KRXC3k^hVSDz z5Xa#-j>K{KsON{cy|-<>8gBA~Qhto%P#iyr(`|`gJnzz2^3G@*Emkbafvfh9H-(q&FXW~8(>d9C+8T(T;og}zs2!8ugLjuu5nX` z{IhYaZ|)&s2+lSBWUfzL=i~N|?hC?;LPmSfHU5s{pE!`f4GCQ4oIEa{`-fcR%%hrK zaq7M*FYiA#S0gvWwK(z;HlHxpem9@5e%zQq!2}8=a8m*|Cr}`PWpj;Z({6VHt^`Ql zS2RC?!*dNL5uZsJo&<=u2#th&CL^PT6Sy^jA`*#36ZYLiz2L)k>TL-g|A8tAR88Ra z1WG1QDS^rf+>t=31SacSerf94uAsFgtUB@e^> zBDID0&og*B$)4_><1c#ZC2;mDPn&s0{RAFL;FSbkP2k}K9!a1{0!LvugfDk?nF)kyx*H|X znDfItBbh)d0V{!Y0+|G|35;LrVqk+4x8Dy2lJYA(+&AFTaJR3fr&$7zvPTkVpFr~j zxZiAx1X{9q^Nhk{J*^UWEMdPhwR@h?I)PE?f^8CLEAqJT31QE4!RIFBJt^MK(W%hB zLjoN+U=nEYtEW=}$LASc61aQ5VZG|=%n_2{4qExfeEauH*95w;K{!Hs+q-8!lRyvg ze))EE&rT12`#eYc1bQXxtv{Ym;DyBXy*_#;>>Ws65|X@_!0B6EBn&T0WM%s#@EThw zftd;PP2lwe#w0K{Vc$gk5*U!cKz7`G@No4F_EyhmRc zh9xjOfe{Hjk?=5#5*f)xn{VWl(NZ{{j7wn9d}C6=-aDFS0l&$vNnnC5G%_ zr@@{D2`o%tMFJ}mSd_qG-ognS(N&04mL#xLAtx?ZDiuaovC}zL-S#iyH3?jrZ>;5z z<35w~jkl|Ni0cx_k*Y1+8_7AU4;A2EQkxRkoWK?uC$KGnw-VTq!1e?xyqfp<1v}7& zKWT|MPQ3G&hkvu~OyIo)I-7Xf#QO<+z&qVUSrZ>7u!}`X;O7KBN?>;a`xE#sfjul< zqx{c#%X0!*V0@gw-UL2L;DH6kryOq!43f|6M)NQ8?l4hG;xZ}R`JbyY?le)(M9f6o#9b!tHc`vO{U*wrs9@qAmdC`A zg+@ga>yNs4JYOXfl}$X`*;7SWRrtZBylSTXVf5!hd;aP0sC#t#e6C@;&qQ_8-ny2d zhKZUEFSp440#MsT1JmBhua3zbn^BXZi3d&8H|_UKA29KUfP|a&&39RPch@?H@Pz=vL>D|(Z;l&kTf!}^bb!{6O}&l zG&a#hb*E+P#YQs|kDAyQE!5mZOB1b3v@p?Yv0Z?zGxHylWor|Un;0r_-eTij5n@{t ze?9Iwy4YxM;(=#8PYT;Hi^!}Vg(!9~(a}UF`RU)nibQEiEla=ExCk86q1%f$00-pjaOHSvOp-W)AiV~-xc zylC2wWnL2I4m5vR{1qWzPVZylH4}YJyw19q7{-ux_cPJoqll zlU>QqH8I}A1QWkDE5z>=6HQDqvB1QECB|eEQ%uY@F~`JI6Vq5uK9*!JFEOUG0hbsv zgcL_FF&LfYM9Jr>ZRZQ;2^TK0yYD*Zu&nG}WMZ+2B^(AOjw_XTNr7aAiIpZcv%z_5 zFEwf`HCCBeZDNgywI(*Q*nZFU-kxe8&6eyoWnY@xbU$cx!y;nX}aR+{70q4w?AL#FxBn>$<;@E0TSR zer4iokM!_gy?S`!MGm z6WoOSXW>yHqa~La$4#6t@tcX?Iae$*+AlNe-|G6+#7PsQml<=H8K-!ME;CM>I3q&7 zeVOsiGUE>u=b3kU{%^~SvnI}|7=H>`fHV2HVB(^QOS}iw$p0~^um6g zPd;L6hy)qHq$oChffo_%o!*!-a|@ z(Q3I-G>Kv&#f4N@o!gTrnM9qWz2VFqNeo_YluP2SBua^w7M2l~72YYN8T0bQhr5%g zlEk*pJ>=z+_MTl8gcXyhltg9m)ys{2%Z)#m+egk-O`=*7_at#|689xhGl^PBR8Qja za--@Bqejv`o#BoZwsS`BPoj1buE}`}{37aKVYFOfJlDWomyMIe1FTLQp(MgdJeWlN zBpyoI&$t>S(NN@J;Uh_`En+_bVDKj4Pa;75NCBUa$8!&?j#T4<7xotjChd8HJffsT z5~fI07!$^YH0GR>Oxp7pU8Rz+#M4RpX#+(*WFzvMFrR)mN}_QRO_FGuM6V>CPoh~8 zk0#MAiS9|?cG*l?VVt+z%bz!xt7{U+YTAC1y*#@| zdU~+eUNxRc@<0J&%?jgL)|YLbL{E{uD{S$FBzhp3zAR;??YB=JoW-zG67iK$6!PvWg4rX?|*898i{n8A!m%uZrX(*ECyuN=-2 z;rowkR@#5&&SkG9u{eo&jy^w$1kQY0xOM6?5|uqG`!vp|8PQ6vHx{O z!WFr?W0i4Dq+AMjrI42bQuesIA%$B~D4fELDcmIGX3qR6xKm&^6-e2`gM^m(DHKY< zld?xh!4zg1*I$5T)R0K>z$)X`6pEy9M+&7ZbqD20bpcqCbE7;eUU3py zGBxmjl7ix)6mpi)6k>GJ4tKRfJcUFGm7AbS6PPI^Q&^wDh73|Edu{x)7MIl8D`Bh@ z(kWz8$fnRJg&irpokHUjnxxP_g#jrvO`%!J-iXgzCGXJ`ny1i9(H1GROrc8(T~lZ! zrDMu|-{G+oS}V%`i5^eki4@u>`eX|2MB1jXX4Unb`kqRmeF_~?@P2G>+{f^>lKLI> zkatRCI7c+x-!rPvHeQ>7BwW zDZDEFqVOf*%PH`pHxxl1Mf=G!FZWsseWkpf0>fn$?+snzf7czD!ju%IrZ6al!OA#9 zI7&EFI4p(XA}r^K6h?|)ylNMFwD_15#)^zfVL}QM#orW;PvO?p_WK=^6eXD~QggMz z_beElmcsNDR;I8jg&9hkC!8sqC7dm!@thRqI=ty>V}1$?6kRA>DqJL7oWc?j=Bm8Q zF6y!rmOIJ{k<{w^)sC{2J)6Q>Mb`;8a@0Ag8&YUd;d)PPN@263ZxQ+MU)MH~?T-Fd z3Jq)9_V4f(OW}tU4yLd(h2J{5x48}Cdnvr1!UrjQn8KGS?BgBE-v7(BTlkUip0c*G zCxwrdk$i6opQP}qQW^c6vxmd!_6vv8|5xJsgLVUS_1(cbuK191!waO!_f} zL!449#4P-j!eQRg78+VO!dsQ|qy@JHUhZfLXHz(r!Y?Tt;~d2)D}^(3o5HUtoJ`?V z3a3>QX~DL=F1 zN}Kcful!v3|9HE`Y2U()7H+cas==~z-C$iW3>EshS)=vfcgvDPctml`PbT}b%phWtWmB=^({PP;b9Ap{QuX>Yr$tBU?FJP zBh9aR@zUgMijak{b^VGtpG=CVJgjfrLc&5*3(YK;x^zaE6sCl4CYj;*Eri zHWq0jWYr$E(A+{-MO#>CX`#J^4i;Kjc+5f@3vDg5*1&$;!V@BN%fJgU&;$9C(w`Ex zb8K=+9i8iTmfp#!3rq5}g)UAiopclLF6<$E#_0$e_q5Q9otQ!O44${}f@Oc?{hmf| z3olw&n8u7N%SFLoFVtvCzT{ z3o|XuvM}4iTnqCodt+y&GR%?LUSA%S`5Zs1jRjJ23uBJ0wwJ^#lCoI1g!S#^qR2<( z%Pp+pJ-fzOVev?D&r0Ey)du-$3u`Q_wXn{@Mho0&oMFAl24RT@ZDr|b`>5qj?9KW1 z>VmE8XbZb6d}Lv}W&bU^!@}DZ-lCt+3q7>PZUHXLc*n927k;1jX~zAoaHoa$M5r`c zV{ljM4|qeB&Hs?y8getbn>UMvPgy~>{9B%nIV9E?W7ZgZ75zj=z3Up|bKZbz-ft~@ zDe~#O{I5m!S@_Cn`KI0Szu~v02JSUFmt@fzW50#(oYe1GY?bz)g&!?kvyhj@Ax{1l z&axQ?6+Fzz-@-2zj#(ZsAu8CwbRf;Qzv> zES$E$?bps&V8{_71KWoN{QHi=LD94XMCQQkQVe_A+i;ev&KIpCl0@TvGkR@t(j zSCe0|@Rv$XP7f6SQPO2$nYG59^^GeQu5wbXZ}b0TOoB9SNTYZfx23sU1UIE|OB#jK zDACT%e@t#pqd*$2G~8(vO7rkLcfOG1!VM@W-gvFSs7Kroe!0>^<(_UX7UPw*#;s`- zNn`w4qo|OiSlZsmf@D)RzeF0P(a( zM*B4GPNRGpEz)S2MujvgrqLjchG|qvqjDP6(zu6~FBrSm8YkBpRnn-+==K8tx@~;8 zym4ZHM^!FAK9m*&P|dE^XNH{|7b zv-Ym~X*`_9BWXO82BQaF_YiYDhu$=NX*5ZrY1&@5kiX9Grx8dam_{g#R2o(q;WQ#? z#M4Ny@Vh+GG-B+LPVTDf3`V&zU1XhMvLfpYhNP1Ce=&~`{kLL)rSVuAZPR!%jn-*A&M|Pv z^F$gahkELc^tgU-^;>7GSZB0J`R8WVfEx{%j3y7Iar-P7oiM$z>KMTR=-?ZNzP8qcMX zTyOLglJrX3>-0!^r|}|Zel}(rUDg}J*BktojepiN7hmmpC5>0v8fmx{wX>M%w;iOMUZtV_+JC(qM}XQzH*fV+cpJa?yr?t;a6d&C8`x<60g$ zFE=WU(P_*~V-|f5Ei@*L$!SbUV{F>~6MtM9Z*uU9PZUlN9$arQm0^;im)09i+8D+L z`y`jCY3y$0nkJksoFU}3)*UL)xs!W#8gn>M($*RP|0X<`#*h365dSHSqiOt-#$iR7>qr_uJ3RLz?ilYEDaX?|k;bo1>Xr=# z8Z|vuT{8$geaRl*`x!KF{eogBvrrkj6#XUrOVO$X`O* z{4Mg2@Nydeiu_vIeoz0Z_9$k`rKOZ{EX#_d z^uzNm@v6eRh2=A-Ai}&AMJi=bS)_`i50mq1ir$mKy&}0?5%~P1Mh2aw)Xeb93GUCJ zb_Pj4X35x3SL$T&NCpiusHw>m$0o9ZRc1%l|g&)4#JL(-YJ8-mFwvYx@6Eb zgKio7@as7lbkCqi27NMkErVwyz93}kvl%?+@SYj;a`^Ki+nVR~c9a)IUdrHQkynJT zI;jme8GSQ&orTF@d_v}$vZfMAshxR@>rgs5}(*) ze~b>#U_=HZGZ>Yzzfp|Kpknj9(HV@%V62mOkU=kY-J6V^8UC}6_cQn)gAX(KTp3xsT^a1n z;FAnKqFDxeq<`$BeznP9pxLJxQ2b1K&W7SUrR{G5Uu5v5^nJoBvi~}RZ!-8cgZ&x& zl)>Q)zRTeI3=TP-4`gsKgG!r?AB6Nn{-aV!7$s*oB4t{@Zpoj;j|zVg9uuZzeT)}%agCE*^_|<~^KX&CX&$SHlltg}S>q2}J=Z38P zhR%&y+?2)5Sqy7!*Q-DlM>ZQ5HXCJ|x!hUgXHhVVLRt8-@Mq!4!pNdw)_#_Ii?B=< zWwR(Oerpy*vM8EGF-1!Wiwkeh;x>^ILT0~Vi&4_ycZlQ;d?_u?XSsJ~Q7&tL4nCB{ zU0K{My>1rev#5|o%`9qVQ89~3SyauUno=ugQAMO{HM@l0pS2%E-;>3?S=5kzpRl^H z!WR2Eb`K#hM}EI_k~$)_v&a>U%IGadJty@6kq5J=?zu1WSq#qNN|vuSU`Q52v)Gx%d%PpE7|zmWu{?_rS&YnLZWi;hT#1Cy zSxn1fdKP0?+9k&LEGA@eaf>llI8OMcu zJ$x&0aTZ*ExI{>@G>ZXS?KR9R*f?2!`*Ls2VpSHac{?xlY|3Jd3cv-l8+b3@W2_af z6RsDsz+9TOF$-e(=RM5D>17K)0be3-?qEWXO(>nuLvaDB-0WfuEbFP1-xk5#r$v-m8Fz2ct;M>MdT zanDxc^DMq_0^gjXLY;5wog7kV!?XEEW_iBJV#nINZ?o9XMr&of*4pzOD?Tp2$NQdI z+l*6NjqkHKki`#K9L(a!ET|k37T#tsFlyWMcOA*%=Pb@=aUqMN91;yYr?WVd#V=Vr zzRft6#c|#vS@8Tm`v^agUxhul8B|VXF;!&iHskwk_FIa-W$}9!e`IksYpDPjS? zJ5R{(`+w&5IsQ9OzgQ4~dStppi@mq$@bh!QLr#brVm z_r2+brK2blMP*US3RZ~XiYUrO@!Der<)fIly)ZJdkXTVduN15#n4YZP(f^d+1L`Uf zua4pxAp<0|N)%P2xK5Png4G1aNGPM%h~oMvYKmAZiW`JXmC#*+dVhnqkvdVXY(c#! z>POKoiuO@7h@v4Ma+Vq`qi7_Ayjc`C32!WTb6#&EJ+7;2y&x<4pIDA*XSJ8n+Dt?*io>Ppfg21 zK1H<~Z^WYbWr`ZW(r&EGD6A;#D4ZxBit3+xH;Q-^U8Cq0g%^b%MLLR16p5%lE;boO zN=OjZ<7c}L`l!}W6dvJ9$3tDSQGLKGgSzmp-J+Zg4|TmSitbT77)4Ls$ae)jB-R5_ ze8FRa^C>Vj2KCB&a|!b7*WOX|iQ-|oXn(;+qIfilzEM0D#p9y%WB#Y;u6;z1Pbp7` zPKA#vPYQoZF!vbf+M4NJ&HGkzZu17A)^F~Pt|`V#t0{=EZ(u= zeOqu`6z>SRU4m#cUcB!Kz8}Q|As+}b^g|)eRQ0itPXs>|oGAF2AT2* zzGgR%p-xPnZSf7C?b&jo_%@2~*u`YSZEn8(eN=C_{R7)x6!en+#FCWr%YKdGwk5mbSQ6C_S~CUb3C@aQwvag-fBw}E z7<0vI4Al>B^Mx-ETqw9maKu#o@U}FHRpKRI7RB;BUm;|rVE;aatA(t|hpy#-CaV$n zOtK-0Em3Th%x{e9r_D`*o7uMInQdDX+gWH)?2lqcluI?RCyKpdvnz_-Vn$24+!GEl z_iRHv5XHeL4vR6phvX{%Gs{Ie7R7Ns_QZ6toS;rbYgVlZO5ifN`|C>g_bVtH8%m&b6G@KS;m1xpK-iJ@!^<%CxdEHB7J4$CcE zA>PO|U7MAJUl~K?yiIx0ua4oG7`PYlwW3!MTy@f@8Uv9Lc_YqxVpXP#%bl1?{#xdL~R>h7&^w#DTaYD42q$14EM&k-30EBAsRz020w;G47ZOk%ox0wp0&1O7&1-SF*q@} zOrdOHJchKP|L&2K(D8G*vGpQB3|wp4J%-aejARU{7(!ac&?SbhF`P^pnHaJ{KAxuN zrOOeD-D0>e1{(a&?6yc`$u#vq3=hWeL=637*fCA@jNvgRIJuabu6o7rPz=3e=o7=k zF+3VW-x#i)t{#c$=MYZIkn;CRlgV>mlU?Pjm(&BJQ>4NtijHaH4P&J zc+1mOi?q>gNYUfd)zh?`uAYhE*%(GnSLDR!Vi+95#27wfvBdB^3ps{2Vldl8UWnmU zw%Fg*&=|_sHC_~aDTbGYyb{BVh8PyZ$J5o)>1yqCb$+_yOV8J07#_oj7+U_WvpQ1p zMndt;7)HhLUW_NTVRTIY!j6sM?HI3f1!oEJzuRmfOn*)cbMvJ)PYC~@Es)TK zF)WH0#_xi zXSQS57{jI*E;ezAiOn)F?v7zk3|oYAoZKp8TMXNU>=4{3xJ!_e{4}H6E8Y_^?2BQ4 z3#S(BY3UgZTY*XD&Fe^tC^@S#Fo&SCTf|On8asE++d=%3D-y5$BicHn0VX4 zI0to2)HCs-g_kVUH_^bvITPniG&Ir3#0MrmG;x!O#wG?bwfl^lP4I()J51au7iuDS zi-}u>u#|2yal7!2wdH5mL^BiJP4qDJ6MJ(LtxU8w(L%f}1*zX<;%?zh=M~c1#zb2a zmI>QLJ1+h-(b>ekCOVk7he^#)9Zk^XNGBoeIP^X{Lq$zJuEtE5CWz#@pq#P8LNF1U zNSlb8;K_i#iG&c3b^4A${NUO+vev_;H3lVUUh* z|LG;U&qOXY+TU;D0m;TwCLT1=)5N1D`kGigL-jJzM+o^tCVC4$GDFcz_ppiUW~xU_ zoETI@@|cN!CZ1r)Y%Qd7>lTdPSNOOIB5#mNe-lsUL!aJPI3R!TPn&o~__KNCu4LgL z6VI6#Y+{IsQ6@&4c-};lnR>m!3ntd>HCoM7L)kD)ykz2KR=SDTSRFIfD<*~sA?I}; z7aVS4go)QpypgvVnIkh5&E7OY_q7m4Az3<8otde|n0nW~w@i#>Yc%y@B)ah?#+i7> z#JhPVM_M#i@0oaCM1F)mAx{|PBNHE+m}6qDiBC*?YT{cH-?8PJ_{_wYCcZNDsa2nw z_`=ldb9SXvrCF-OEN-R|;T}+vm^TyOn7Gl2RQXW(v(z)Q6u%;QXO{Zj#1AH>nwZ8k zXQ>}ee!{P&n3xb4KbiR1#4l2$znb_>NDq0xzFi3g)$b<${jP9^iJ2y537;((o2}>=G|$9*6B|uzGO@tKLN*K&ldYmrcjzy67nyi? zwt9WG`fawVTFY2sVyTH`CYGC6VPY+-&jj_ACRPhsB}nDdZH2@&;$=GI>rHGBFGV_v z#LXtQm^fhKpoy)_!)&$9#C8*Z%~t%#^oluZhlxEVwtZ^sWOUkl$eM0sNwx6R8nK*3f4O0F!am2(?6K8pMPT?^V$4#6vahgL=LF5Dn5XlTVvvgAU zf;tg;>CTw=GapJzD)F-ge@Qw_>TevB3)fh<)Iu=}MHUQ;A1vz~T}I4NB`idQ7Z;?+4NRCN&gLl#B`sWTp_GNoXtuuC zrXl*veUdhHQQATo3zaPW2v=6HoQ3j2xLYR03c@Q|xI)O}Ia=&3JJVh%3cZyrTqS&& zgkEc5S+uZ*#m{e1F;rD7{y)_-c--FPIt$e-z0XN?!6S1Nd4;6fT3>%~UDMK^TGtZ1 z!9r~dH(ID8Ug~u%6wFm5Wds{oXvmyTH14s`$iht)T3Bdlp|ORVE!<(DXC~5cu4-cG z$<C;QUyL>u+FH86+gWIDp@ZYsV)eioXAvJV*# zSa^^%K3_+_S+JMf5xq<*Ghg);C%Inw7N$v^kp+^q8_vGxP^D-tA65T6pBw+ z=ui8$5hgNyz8ca?|A0QlOj>xFWm_%sjNo7k&k7kRI7pD8&k0#GUy%>7@Vt0m5F9Fa zT7q7-@Ctj4jrul*S$NgLSqp!$30W9!VJ6Gg!Uzi^E&O2NM>awWZ&(;duU+(}g;5sX zvM|=dXx{z;HHHl-kMxqiEz180#dj>cYhk>F_bhy7;d2Y`GyThq4=j8rWC9C(nnC3w z3m>y;EPQI=6A2=rPItkeZy`B@zOeA6g>NO|R~9CT**Ag={aOmY=K|fjm^cZee<#M@ z3sUDJ&`%bJVob607ZW~VJw=Waq4{-hKAf5;U6w(t+fVH=m* zdbf&yInLX-$mX(hiT4&N*pWMI#22dm z3)P)Ah~&*}a7Lw#jkY#gFxiEwrH#96Y`773GbgrghjjE3TZ{Li@kTpa?^d*bq2lhH z?QL|hF|NJ3$3`b19a-J?7pFq(EK1HBvtinJ)#eW$EE~3sCv7}s!?EGoxX(s+X3vIa zBeapW@&0SYeH%$32^#?$(jrB%rXV+ON!b{fHmGE5WNmb{@o|F)9hYSiyV$t@;i8<< z&Boj=h2%Xb+URTZuys6O<3Ss}ZS=9xQ{parpm;Bq=<7ywg7It8c*zFw6&o)L*_YJ%r;Rbp z#_x+1gN8G!Homa&rHzp`UbpccvuEQC8*kbeYvXMjqu5T82HhATqXk#oua&oiZ(O9t z*?5QLJhW)Mjg*T(eo1!WeizZWTrTv|+=VB-TDpV;`+#)nb}%*;nZzNx4)_Ay)I zVns4hL{`~n>@`mnkbEx6d)p$Tlg3vzCfWGe#xGJPU$fTI{FWcz*!b4QcOrhz0z6;9 zT{2i!(Z!1RqnOe1CmU@t1_>|ptBom=?cb!)PG%v5#=ymjIMv2937RhWJBwnmz8AWh z4I;B_%(n5bjdM2UFl8ItZS1hI>s4bOd&CmO*P8QfEU>ZA#v&VQY^=4h*v1kYD_BG} zmfBcmW4Vptm*b-2k!IVCMuM{!tCHJ|r!U7UcGB&}YQdX!7|oXsb%}#w4hkJyD&CDt6vc>ma|*o_iyRmZDmtj-fQ!$SgHjGkJ18k$DwjEWFT2Yf zaPvBCP%To1$u3pp9h7xIZ#ltf^9}L}jvnZ)5Tp$`UvppSpo)X44k|miih1Tsa0k~2 z;dUb0n~q#7-v3G(*Ey)>;08y(x}vM@pr-H|4z3q6u}|UA*Nt3gEhf8Ek=J(kR~L2i zvFbYLSY7LMt(K|=4jMXm&_Pd*|Fm(Cc93z<*ul*X+Bj(IV6?pYZ#>l-6qK=-PvIS#;rh{I86;PzJMCrR!ISyP0aR;7*q=S?L zUxE@20tdBjjpXbHELCqT)f;H!LPEbp92!QM;ttw=Y54dCiv}A z_0~><2K^m8>EKOP&=B>Mg8`2I^?${|(+-{yKGeap4hA|H;^27)gG7AJ!C)bk<&l6p z2%TA~KbxX^LG(_=3i#MS?~4vza=?cN@|Ptjx82Y%;jcP)jW_6EgoBZy(5&n-m3!WJ z-N73U9$BWJH*iga+ZvB@PJT_{PBkhjS75*1>lUes%C0Ti`PFy@Q_|{LIG5>^b;RMC!Z{6?#d2$)`5i z!4wBGIfjTbRq%HQ(;Q4^Pmx%(e|?!^#2FI$^)fZv!5jy39n53@ZKE&B?;41?#OI6I z;$@1_7dcq$V2OjJ`JCkPvrKGOI9Tamxdi3(TqalL^U1{5I9Tgoos<=eYqOB`f*S-k z3T_hQd9}3JLhfLjgY6>j5WK#h!63SO&lK!-u!p0N3;wOx>tLUQ%UoRUV!wj}4*qfQ zuY-dQ4zU$EIO*W9gCh=(JNiU#ZcuR4(fcYKbMy`g++-lJ9<}* zzZ{&Qv4gYDg?~2-O6&bP7?FLAdm8-Bk*%qrs8iSQWi+;uM%kTJQNo4cLWzBmtB+Y{#C?L?a)IZ4mvr?u4s^^z zDHo+(Tj-d7Fx!d?@+FFGD*Udz?zu(Pa~ zEX%XD)D$c0Mi+JRysnFXmMMx2Tr_myx$s>ya&eOj)79@&8oRjJMKc%8T{LlVi;MJf zHD#P(cQ1aci))svTbHZbT-@&B4i|U2XzJqNfr6Zy`C%amTO&ye7cE`HT>Twi&DV^( zTyVu*XBT(7XvKWGXyc-Ti+fzOb1DGq7}-2O~2x?znh<-qX#Akj(?u^4?|1QlkOu{6z|V6Ya?xAT z>?_#E#Uny^t%qH7T%kxF%`5#@sKw-xGX7u-sV z(}ROtJR|&BL5c%~u+W}ks~%bW#=w|*s$htV=Uu$OTW)8(=yGujh6-Odr06x-+w)}? z6YE{r|C5As;IFn&JV4=9UNKVG;$=0$#Yh*I#!)Pe*Im5f;zt)hu>-Cz_NI%`F2)ES zCGMYgw<>K&=m_gzeIv3`YmS8%-GdoIqdP!vCK@u7=P zU3})^BNrbtZ{qz#uDAa{9iPjBusmHkgxKy{qcrmFjC3-?;eJ z#dj_@BE}Cccsw^BRUCx0=rnq>~ zFXUsxG#Ar30=SsrVy>$Votb=R>lU7ThI;aI`K zpKNS(vCYLs;q-2Du{qDT2U&tU(vMSnsRUUO`@Kw_JtFo;=wngq93F z=;9Dt9m|Q5K{x;V#rU!~5v z_)7@+-yFw;&lEE%OL`hBSE=*-6>w1y2jaLWuAh-EiR0ope!Q}vUPXP_0TpgnMdiig z1%+`$;%FP!)2GGbC=o}kIBtleC=Mfza&eT8L&fzcnWY3v#&KC3mkS?WPV021SLw~= zO2<(~bn>!7E?=!G#BoI&)x=vdA9`&ZmEyQkyp`j)I~bz2nde3#i$-f4GFqlux1?hl-74g$EH|2jvGb4J&rnY)QzKIKAn1TG!R~2@a7V7 z7lMuAxG9dtaoj9Hx5m+gqy%meZxyjQ`HMm2HqrIvM7$%8JL6~?N3%GZ$8lF2cgL|{ zfYBn3mJ*kogvcnZL}@LU3#Hg5Z`Ll3_HllWgnQ!X9Y>!yI>yl{4x0vXaM4TWIJlJo zmw(?YUMkTzVtH=HVF^Fkx`07$9Pv2Pab#E^)gqo?A`V~3`5y|L76m~ZN%5xQ2!*s; zt#V&LZ(Ua`8%LKo?vLXEW~Ni5YaHF;xKDV4QwEjparB78?G&Now&8Rn5600`L>lyp z<00X+_g3rBX9XXQgPYrPcpShxisR8ZK3=W*vfhP|KPIG~AbZvmarBSlN#;k!x~Fow zoVi2er{h?-T0IlTvus^n;lMbai(|0xL4tc%t08ebAIA&grA_6RixVrZQN&hj)Jt)^ z97kUdk9l|{j$!OOar_;}t8u)>#N$}R4Bu!BkK@ZYzKUZ+T#C)@|IxlHHtQLZ^toI$h)GyAIAj#3y9-AlDy4lLOzJ&L$R5& zMr~T7&WreQ9G}GTspu2q_>BE%?S+&-XU0UoVtFxMh%0A^lj8U~ju~;xjN_ZQK5gX2 zKI)e^zK!EMDbnu+e~jY?A$--CE9al$_*s;uYxS>;y;l7i$8T{=j$;a2T0dhN8|PX@ zGL^L>WO^LG^G4Px>Qso?-G#H_n9W#L(Vl0F*=yAt#$BuCa*SH1=CNSoT$rcRU%+l6 zm!o%a982QZ8ON?Tmd3Fxj%{&lk7IcpD>!7uu_2C?>}w6wY8Kkls>(XGDh^_kb&7{B zt%-xUmMIG%AK9hoo^`6+G-IP&VpANO<0#(W*dn-7`X`QmIkI`E>)~7+=h<#o z7*~1tFOC8aKM%vq81+@Ku}0@d3u&9$I7k8> zz(dmGZs8cQK`m~n?(y*ZX``Ko_Cm-zc$m6Dk#zLX$wOxk_j)irSRSIDKG`JZA$N#L z4mWR5bhd}Mr%ySdfg_f#m{IXO_#P4xnoEH;BqJ1g20&#D$VlTsInf&GlC^I zsxBV7dgzv~ulqc_T|xgw>C)zd>C4-elL>BXRW>LEdr z-X4Z;RP#5ghdupZL-&Y>N5zppdBEuB;c*XtcsS|d2@m}}yyxM4-m-_MJiO@PB^viO z26%YJ!?T|LR^n+7>o+PAKH?7a^n>mY4}*k|KPP0chf-$>=%ssJlovb<&D${OWe)xx z-tsWk!!Qr8dU)N#8y;R`=h~?5+N56SYgFB&hO=32QX>RM@?NHBF|y6D>KNQ0=uI}H zFVrYc@4GwNL$6J0jE73&4erp(>vC7vw>`YG-{4UZqrf`<=0 z%kQY3WWi1Mvq1*N`cP08EaA6TBkPd}sg`2E?#FCKpN@SBH) zo77av=VZYt>@Pyt1}1OP|5&H7%$KX_Y`{Xu`NwvahuKs{8#_JB@i5oJVh>9^%=2() zlWMYAak6^8hXqXE!`Eyrvc71M@S@F%%2E%@JZ$i=(Zg~ND?F_Bu*Snm4{Hw}okASzotY|Wd|n@eYVK6D3rXm`CnXP1ZF9`>-a zY*q(2CV1E@e4pTcw$jatL8CUSL$r(+9`|s}!(k6c#Cue{)ai1)CdW_YLr-})%~8ll zV;^Tc{K>(@$F)ArdiaZ@u@B|rZ&v7Lb*YcvA1VCD!@q0;1C4Wn7x_3Zgvx&$k$fFQ z2Os?WFvl+z@e*GjGQvFky;&9WQRpM$qqvW2wx|+5ihTX^K~5zn(p%EUWj-qS;M(B# zd+T1$eN-;@QOZYYA7y-$_4UpwP1XnP%{zgR~m3&+&oZhR1 zRQA!5my=)Kt9{%j{0&=G@o~M6nm(%fe8r}&6RajkZ*?Cv@|=Ha_(HapuV2g76}&;P zHdlcPp3ONcu?mNF)#>5He$IT0Um@ z$oR;zVXQCq0o#L*u0F>5c+W>SR*;WgJ|6PX-N$IBh+nYw^zm1ZNDm+P`*^^|gVKbG zZB-4ns-IE3(gOv}x9Vqx-ah*Hc-6;iJ|6b*h>t-&o@255=ZctdUCw~s;XX$A*uGW0?PDZM-pBV38KVW?5F91=rr@hv z6+?Lp))*ge`B?I20li}-h-A)IWtKF?`FO|2yW;4j<5f7z^gcTp@3FJ`%!%-YMVnTU z|F)_ReSGBOV|HO5lYD&b<5M3KeSGHQb01z$W6}oW`jy46*`~f=U#=N>dwlWKHua^C zuf(<3rpu7{jj!KL{N`h_k8gc^$1M4nzQp)R%J2stKMJ{%$0o`n-_Jgm)8JPTnLRHL*U%uYom{I=qaZZ%;k`5E3$RN&v zbJ`pUT$I4I3GN1lixapcfzk<-N#N21iX~7Yfue*i*usP^`G_Ekw77^Q6paK_0++M0 z4i}Up*=JlPNWuyBT*2~PK&b@ya)I_`6DXHJjM)?FPB*2ZeD<$-+iYo*wGC_G~ z!PgBG8Rbg3E^~WTLKpkh30#xVdqFdZHNw{cRTH=_frbe*N}yT-)f1@Aq!Oqh`DFfU zC2)NLH4_)!1^lmJ+>lr5Bv3bj267?hyq?@b{RFthbk1?pX&@O@Y30Mi(33N!{o&-+UDA6&254Wl5+tlBU6c3?W zzfE;YpmRb`j@_F;R7gzF6g<9772B@#)LBA*S??#%YP)jDS#;ZV_w@3F-tODggdr-K zKq`UF32fo`pFlc+eoQKX=e8?8sb&($CeS6JX9&OZjr)ak73?N>pI~>v9)f4i84o1z zU;;f8`YHF}1RhDCR{{@-w|4@4gfM7m8Ex=#89bU-`U=VEj|pe!6AAQBU}*x&5_mF! zr&uNle3Za|1fEV{SOTvm^pDyz2@FZ#`2?O#V4x_2co#y(e^o$(!NU7}Q273K^@4DU zF9{hc_#$g_`-K$(FDLLy-ln;!*9^Rtz?%t-5^;C}BN7-X{B<_kvUnqbBimKs4z;&U z5sgPDFoyY0;9aqKD}lF#j1{Co^&M(lo;TZ}#wYNect1$seIXMBiUa7&C!os=4f)VL{O`z|N3#Bwgf@TR$O<-CA(^-b%osqyy-gVw` z`VMvGI(;v**`YY3Brq?5g$XPYJU=2YYI8sYU?LdFt zLdzQh?y9QEjrl~FAYHuxjRM>x>DL!*AlNX_$CuFYoD`Zh7V&1mCW1_jXQSK};PwFf z0~`o&hZJ@H08a+EGeFY-%>pzJ@KAu>0a^rT86XiL2yj<`y93-CAR3@mfYyN?_c{b< zBZRzNfVRRp+|k=Uue0Ru3D7Y>r@YcRZ%l01rsS2LtpH(o>KTX>jc&y4Cdw@Nj^~m>HHv zG*UzU;5@>H7mYkB*f&7=(%2l;e|#Pn7MQ+5AowQn_-s8XMrf0Po%ud7C**L~h%y#szvd_#KLDRO=MocxGD_a-#VC zK(82|5a5GAFAo1uyq^U4D8R?Tg~PA8D>7HA?=7#r69aq};PU`q1Xvbed4Mkid==og z0Fwhu3h=e$_U8cK1o&1Lg|3V50({SiGmSrQ!5vo`KZy7v+qP`5Mgx+Z{)?FXnm1<9 zlmJr$%nL9-z%+?CBf!i6(*yi2UZ$B#c~*eg0p^Oxh}7rgd6|cF*QT;SQeGHf5${eS zE)Kv@x}^b@TU~4gtsTs+jOg1$h!WmBJ*-UKb&uO^GCmk}xEc z3cW;?_tN0p=P)=TQulJ%3Ax<_%9 zW5XmGabhHi#$t0z5;qHJBDidiI^lej|+?qm@OVVX^o`1K~e zuClo(v-=z5cL{HwLvGtWX=C(%YoTfuhBz+PPiyj<=o_lVv(iH<@#Nr~|)w4nh> zED1A-AxS)+gq4Jy#4~Jc+lx6#xJmR);;|&+Nq9+gO`=;8eiA?Pw3j4OLJ~;?LMYx~ z7ZAfF(n(~J{JcVYvl7}xFsJ13z9hOQ(L0GgEYBnlhDI;3c|h>NBzm$s?1G$eE@kqE zB=mpRdRV-V3Oy>?I-de>|5+)7fr5hs zpA#G`$a(%3k{FuA>q-4ex9)D^#Ux&4`%L1cB1DYxLLlQqG@ssc=f zL|H1hOmMm2gsi^$o_iy!l31I>Iu2aX$m%4htV!xe2ogSWuNQq+5*w1(n8YRyj8!6A z1UC!j9?>aoO=4RT+mqNKI+dM5Qr&bqe5&6qN%1Osq%-nqWPcI|lIWbmy(zrbC~}Zv zR|-{xAL6e-5=WBA?o&sT_$P^flQ_nFo+>z=#0gd$Lj&W_B+e#rGKo`cY5UaaB+jr& z?^EOU>Cu1+`Cm!=&0&1Ms<2;e-KUO-LW6TjoKNb{z00TYUlIi=6s2IKfD|rDp;!uq zDg80s#VK5p!lfx(KiaJcSYx)b28Ez-8OCVNmM=s1!=3^fq*5Qn*YA zc_|^6r_gA>{&s_|bP8Wry1>h(P)-b@5?UdJD^jSKLZuY0N`b4RuM{MyEabn|1r1sh z(0jFbuMvE9zoNn>T{VSTDcq34bt&Ch=&GeqJu=~lvhP)BsHwiWoY%F-Q;JE#|bKN5RR#x<0osHX5xI>gXQ~aLj zLf(3{(4?7on+vuO{AItoTSz-W+O!hVI)yeu+6pd{3o*2P3LQkbN3f${CqX7fgJ=q| z6ndu6D+MzJOM>o8!4?vvkW9f5PGeU{T+kErQ%K}P*GYn@6f$`w6p~J1UD*rwl}({b zKD4WlZYi*+nK)f{QF^3szmNy=mJhNb0=+-^Ln&}iye9-ndZ*AQg@?uah+tpAM+L{W zz+)-&6aF~wXsu$D)B82j^%wog6rM_9KnhQ%@JtHhQg|nYXHyuM!dqf6NRalUQg}}I zV8J2m4nkf?VR+tVXbLY1e<_8RQ+OqXVJW=IE}X)`^02ZII_B#Ca;7{Yg^?2Lb-_1M zc=P{j|MDwpG!uM9jbR04BP3(R@@)~B0u|!B;(afL@k0I=`hE%%#Qp=p4^#Lk#Unyc z{eYrlL^_g*DSVbf=QQq3s7~;zmzDl7&h$})&V)snp6nkX~-=y$u3Ts)p zDSVg0_bL3E!fz@3kiw5Cv^$`lYGnMx>YiL|k6Xy|k$)EcGnw-Mi z6y~KcC55ReOk>_o6rYj8%oL`l5FSv!vv9f;@ze$$x?1~%!dZ-aK+Q>ke6}FHbo9_VX5%9<`~OTSf0WP@y?xN+}NYA(;S0lJ-Qbs zu4Vy7bS&De$w#5h`V=;#us6lc0C~W7WMc}uQ`nQjrWAfZpf;zlC55diY)fHR3Izw% z_7rwV&`w$&P&dnZZ0a;7(ouP|N2GDrNV02$4R#23Jnjc11W5N%{Z9Cp%f0M za3qCeDI8DXXbLT!Ec~ikgk;6u2#I-6onSXfaR)6tbx^%`P>pDyW*t=f4yvL<>P!lM za##*AbG&gjg zmxka0vMdL#!XhaaqEHm_NQm=;i%3d@C<;-#f1wegOo*}}REUxx9yp{f3vuoNgR8YK z4^c{#(jn*=^y(o+eD{!ga(7`ln$;{UFGw=79(Qs;r4UU+Gz)QMh{_>u3{fYL^A$4*J4CAx6}~8L@)9BX*Ne0d(SeEgDBdPS+YmepiQizh3*jDCew7mUgyyIln&3%hFNDwb zv#eOJ5H*jeM2Jj?Y=|I4Qj`=+Pe>SoQ$w^N=17+iT|@K;alaUJ6TB~PPs{G2uzXq{ zQ4fUZ$s0VP9%SN26bUg$9tzPrL?6k+7YL%bp#=e^m+xg&b*;xHD}?!s3?ye4Fsh$A?z9#wa( zDICcvUQ_sbh&P0gvmCgIx#Cd6Bk;3?V5nnC>ZZ(N9XLvX+1cQ{bXw}B0g zs_`M-3-LZ1!%_8Nh>t={2=PG(e%#S+Vr1vm5=?p87X=@O_$0)qV#Yr^bls2YrcV5v z{UXE(L;cKTLwptDd$}}2Cx!Ti_t;d=5`4{ual7Vp--h^3bn?YV74e5qZ?W=Yh@bL$ zqG4qDD&vtD=g71WvqH=kgXtlD4>5xVrwZ=*tAJ5v z3MZKpVlI2@`^F*;ECUQ4BR(%*0`o&G$n%9lb{G7ga>Igt{W+LOmQg-&l1`q<+GEyeOs5zR`G5N zv0Vt)V(sAY(pVQSUx9HU-<}YA*^AS-B8`0^_J=UiP-(qV;y{Q$I8cN*7$Wj%_X6FPX;I$5d%CxJ>YJ!BT>Zwd6s5Hm;*{9YWbO*1TL;PO!Wn z^@?d!O6zq;8~dv()2N(At2A1taaEdM`{JfF8mIN>bWIx9rBO}zwSrXytEQ3r9Bz1skN%FpWmS4;@qF zM5b_a8cow^mPQi^x+RTU)3_~-lE-!Eog&^Yc!%KiqCelVh&Xe_PC-k9j{C5`hUdx(&#SU9)b*=dR&dX-*_;Mhte3e*x;uGJ=5rw z)*m3ahl>+;tT%e6(I*WOx`%~qJFd!{P_x=a?y9U8jE%ZK(l3o?()tTxjxCR~Ow#C| z#*=A0#mSA{#?xsGNaM51HSg1d2VRsodXwf1eKyU>QvKR}P#S~N7?Q?wlFqRI^HuWm zqA+oaL#4!C6lBr8B;@5ZUJ){kjVF!QgpbJE3{T_w6Z&7+NKrZnXW_glRr9Xks5C|k z86)_XAZ^ByR50Ea94F#Cxgc3gJ6`yEX}q7t1mPc~@o5?pg?~t_V0y>AJX_SjW0O)!w#FqH)7B9zY;P@jF|$nLHst2@6z}_4eB{ZJ!kV%8b7BoSz`T? z#;Qx=|7Ckh-aDPe&H*Q@o8pW#W~MPB!`1SbmBwsVLXHm@da#g7 zIFP|b8C;wJc@CMYOEcJULKPFFw=koJ6e=Y$;2eJC46e$cC<7w{l|ji2%4NX)S1-%p z>SZz@md&79)e$7Z_EOepe7mIB9^xb z@<<@YWt2NIxHF@-S$isjro810{0tHqG|!+#M*ll#mqGass$~XuWiaIr{YanrL$SHu zok6RNK1!)IYf4DljDBlCW!)d@=pU+m1|2f`iQ=9NI%jZi29-{#ju~_kk(@zwzBZy6 z*u2574Z2tcW(F2Be@c6|Pf#RI25tuNyp1R1-ugu}U}%s*G6QbK@cgL4R0d%NeKL4B zgLDR&3?9sI2Rt-Csj?Y#&!7j(HiNFBbj#pAA#XH{(14EQeo@FD5JH2T4V7MO75Pxc zrP5oF{E-YE&ERo1vysK=`ex8C&mR-=R(*`BuS1^@Z~qLQ%v?|yM14R8PfIO4BREL# z*$f5>VeOp#wt)DYcn1qoc_D+L8N8a|9`6M&vZ-(siWa=Wy2#+=j6OSqIx%;A#xODC z>*m*_fl(hWHVl0|gEul*k-^Fg-ekry_$h;*GZ>x0m<&G3;A6J%jQ&L)FF024Z9$6T zguIi%yLsjIh6V5C`TH3zx7Kk#$SWTTnNp?T&9)b2-ag6T(+nnN@R67}W?MJo*A-}M3ioQ_rw+yCbFg=6G`B+ng zOy&J{)^mNoi+8Tz48fU#44Rd}Y~geA${@MKJn_!YU_oBzNsEhwFBV*q*Ov-emceo% zoPo?uLaySdlEJ|YR=*unSRTsYa0Y*iazyZ?;8DS2f=umr1~ZD`1ikEuf9iU< zqlvE8QyHAj+nmYZ&pbby!C!g4Kh*aBWbkiZIhVotJpV6)g6xHvTL@WoQeB+ICBiSw zqIec1gcr-AFpG%rT%*dpek#hMWEPiYVPv8Hf1#IWafOJb1WOAtKV^iJ6)Y!MUa&$I zoAPB?F^ftf(*DXUDht0#@anwY>4t(TSybhNL=R+p;JPfTWig=}KIn$(S=7iP))i(~ zT%SeFEbhtDSpY zHp=3rEbJ_tEE;EVa~Ahx^&aC*vbZISHo|Ys;x-|zv$#ErJA}8$>R%jwF?VMcKPxm9 zu^G#At+hqI44MEJ*QQ zNhHeB5Ml~ig1lCyuX35InvtX+NnD7R)ict5776i^2cisbfmGfy%yLpin`N@d@*agV zh5NGTD!iLuZl=1sa2ofJ=oBB!qNngfUC=9whgh~<;B-OnEc#?owhPL2!NXZRlEsuP zre^VI7JajLK8qK!cr1(8dKd$;csh%ISv;P_6Ip#KcmFJopH#!|)CK-zR=-7hN|1yv zkDg(JJf&JMH~QCzJex&Ft8iczgM>Vn#SkHb1)H8y49)SOEV@(beKxHuUd-Yp-bfa& zWHBm>(OC@3;?*ohWHFLi%3^qyXSSAD`I*tH6ngD8!cw@u6zF|Di#M`(GYjhD=Nmm4 zS_%v$ACtvfS-hRaxGcu9NJVEN3}W1OvUoR(@mahlDKnIMF7Y0cIBh=2;=?Sy&EmT( zKFZ=_=CEnxt1Ldr;?pcv+!y&maH8O6f_+XY>YrzEw3a4xUy4p;l0;_;Ukmw0@a{7K^i(lf~RD=CL1{`cLJ8ET&B_oS(&Sr_{1jda`Aq zaEgadsr?fpOR`v+MZsycjQ5ho$}E(`rj= zbx9Xo+65)M;QwLkJD{DY+Gw*u?#<;UL+?maKu~%S0jbhKigXZ=^kkAuDxxSw1+id3 zL_|cyh7`qyf)y)@sGta9FNjzWrPsG-hw=Suy|>m`d+l$Z?|i4sIg?~EbEbk1MLryw z=&iTQ!*~dp$mQ>2SnLk%?sb1tk@I_9Lsj6{nKVes_Fj zAxRaH)9>Qy(t!p{5VDeE6x@-PniPKGgByt@W-8eW>f>y?JQl!;iOkt~}zc z=fj+~-ta6>g+}G;vyqL;HxM@T;hG~}n%v{`0{R@WM}raOjVxu%CO#}V;^luCtM0ac zZ8h_uxepin(0N4pPCi`b!zDhn@S&y89vM2c_o0;!t$k=Cg<@NtntIqNcQM-eu;z$8 zZuIQnLr0%|wqd%|hi^C7znVMy(8Y&-KJ@pYs}Gm^>*YglAFgopK0a*k=B5MF%rERs!y4aOO#Ji4k^w#p^kIB%&6Pep#zW)7yFNVb!xKJi@Zn`2p5!RCaj*4Zoexj>u*!$0nRUiB ztsT}VYc+?oo$bS2TZz0a@EIT0`|up&v~fQxY1it2B@?n<`yM6e|hdoXkmh3FgmXsd%a+g<< zZ{+-~kOS55xR+lGqa*G8Nq*o7il;9he&$3y;QmcW@{7n`AAWU|eIlnSV85drXl7rB z{KJPoefZ0V1DyOkCHm3KkApt^!xOR}MSlECU3WpB_SyF@9rEEYPrp7Kl}Y7<$T2Q$ zN8wK`>L+>rca%=Y`BqBz8J~Uc(^;X*5BO2WkFtJSWIE4}A#$54ES6rwkD7kC{V4IH zydR~0RPv*;A0DRR_LB~Vh*!vau&Gq=qoT~&$GtSGh*uX@6;=~Ird&Gk9`9Oy)K+yD z_)$l>)a#4X6`n7w=f^uL)xhy-DAGvyi?S~Cqp_3QM5L)7y)wnTFTJ@R7yHr0kFI`P zqUu;nJNdK_w)CTw-+s4UYd_lf(N>%$`$a50;cYLs4nmgg=*Ojgbn@deKRQdyoUprm z@dw)!mOCe)Mzd?J55&guR5lh0pw3+((2p_EiH|JC9C(6&xTO=*J+D zWhd;zIz;?RAWN}1=!ts+hO z+79!@CyLX&L*_kx+$pj^c$e^QA$?j~rNnz>778x%W2uvSzsO?Y1AZ)V^ar`bdb(Ng zAxBvz^02VWV($t+9upuKUR^5KjFudA`JDEAFlRx%+-FZ@#8s1 zUn}yAaGj91w$klcKi10}5b)Audfty0q+I)s?ZC9bk5~P8P2$UbydpwX{C2|2#31ka@xGJ~{P@_9ZQ@(}_)vrnABk)gJ~+DM z6F)u`=Qw}n$96w<$~<+ycZVNea6YS|&n1>Q>22s7$1kPO{L0T)rQ@_8XZ-luk8e0X zhm}9TmEy;D;=lRvy&petS;=JX6VJJR6#q&1v!nlgziTg>J*@n%!hOPm|9(Gy_k#s# zGX3GlpN{#LL;mJRfFJ)jrH=4Zz>h;R4+~kmkdCUxV}2a>fQA87cgofZpoVx&A*X$z_Syl|381dT^8=_C zK>Yv)J8hUQvh<|4ksO){FJL2i{YSj1u!)cXUzYzx0c;a#?&wc-M~eVj2GA{l?g6xt z-add10kn2}+62&6yq$2%q!I?~DBjuexio-I4!=y~PgT?Pb^G@MSW!e!=(=u4igr} zbA&iOuM!yiSO8`KQv>=P6o5Z~Kmfsj{r5*i7z$u%PZ$3>A%+7ex4eW|Oi}54J$GC+ zG8!*QB@`zafEB<;U%6NjF%`f~MfPv2OaR%yx$9jyr&QtM*tOK9Ob_6?0IrwYtx{&F z3pem1Ab^B^3xFm$6CLIUa9aSk z2XIFKcXP??^f28Sz~Y^r1-$&|waHyFsnfhiKKBN&Fo63U|3w_M<;8`v?o-~yYUcw1 zED4-@oju3=L5WM%B=(V?amxaDn0?V(cb5n7NWd0pP8{P}8Ng!!+!MmRAv_+y6RazU zML|3nz*Ah&L6i$(6%Ty?djj}6fYkx431CwIuLkUkz-t3|C4h|qtP9{7DbEUD6s{LO z7r^r(^nXF5{we!kfS1HK1n{zxTezXOaIKj5S^%%}Xa=w~fHxeUcLR7+{4I5Gv+!-< zJ3@~3N4nPip4{FK-~*8@!ViV4eaI>A#}5CTtJ~q91n{ZDKNHz5+`%cNX0z-U0qm6c zrEr&!`fic0g!i5Dek1Z@06zurt@w9BdVVkRgOJ_-nG-&MlL4HPvNwP~xX{FZ4Pc+h zZ^He;--Y}mgQ1xI3gDQO0|ERkaxj2HBL4{gE%4>Vt6IAbiyv{6qax3r@*a1T6I`3l zUDl^1mJQ;J$XUn76$FCk{skx##4e3Y-Lke)6hv_lLxUI=ggc0mAZiCuCuqNzxV*4( z5T!wQg75}m1W_@FO2Kol)2-l;&d#fl8IZh65LH!OwIHeoQA2M3y_LA8vT8Z)p?_Uf z)G&xfL7X2%J!RDwvQ&eh{Q}}b=qcV?*h@HUm_58qSIF%4q0RdS(N89Mf00tXu6m&Opdbc|3~_v}WUo)# zFHmM0E^$&2BZ9aph><~z(&&v3VssE=G=O8}^WTvo87G~^Cj>E3{uHlv2=&Q9ObOx| z6$}Lt4q~dfPv{rYEf7S|;lXBz1Q8A5+90L}5p(ox5Tg1A12xk1d6I3tKzLCg-~2AOoYF^HKCzqyik zj`&SM-26Y2mTv6wEzV54HHi5^EC}MRAZ`odc6r|E%wBrl;dqiW-5ta|LEIa}LirTL z!bB}_;{8D^=6ndDFHhP{-46t@KZxIhSQ5m8K`ag8p&;G~;@u#YF;r9cQ#^r-JS{8^-2(*Om=S!Vw2-f^EL6;gLosz zceS_*iDBOgVzcABDD8hogjrk*oZw=yOhGo5u@~Oy| z8iX^ay*q;VJcyqqej)rSh&@5z5&2g5ov_9k?+;Gy zk0L(>vGEDJAk!~F>~(T~71CK^za_UpX9dA{-Vu62wuF?q}>Hej|P{g-{eiv6EXq1h>OWM3QH`rH;ahVT4dYW_4l30>8mi$?>TyQYD0{AygBe zqXs{G##PPfw9vA@mO63h{k)Jg3wu#_Sh@F9g5z{viwqVPFV@LKqyv z)e?sY>3NmNmBOJR40H71A|r$~&U#0NFiL!M2;)S?2pM5)2qTBu6LP$i3BrlOHfQbG zHOcXu9KsZbUn4R#gb|T*=bV6)TSEwnghB|15D}jd!VMurLx_c7N?}+_BpyOSBN(?t70VB)e69+gS{a0tsocqD`sj>5fM3eGDXRG_74!Ituj9jVXvcnBIVN%J`>KMC2e zuS57Igl}bjC;UJIQDAcTW5+43VK;{Q6zp%4y>H+LCyIO^!fLO3pd!cmr3rKdwU6T;d zgi$xl|FrC*P$rDBVX#v2^Q4ptX_gD4NW56+cJz`k$~)Zawhw_P3~v}l7!|^(sH_@c zR1&EgMm3SjVN?<6r#7=x|DLEWg}hQV)D*8JtS$7uW#27!ei-$_xFn1gVbqu2Sjemf zVKfwPB)q`UFBI8*p{t3bG!5e-hc^qOxx+6O3Al`wVYCY4Qb%tcMmvYM38Ss}f4`^N zhtWYwN8yu;O4t~tPGMZ;l{Mr#-K0;hwZB_BP0$HvWhFi80zq0VGMWpT^jbQWR47Dl*ni&cZ|qlmoZLc zyl{e(J5l87FeW+5WRWStS6qfK41XB6#4tC8Kp4R=Vo{h;gu)1iu{MHr5k$g>hA}0= z_f#SlhRI_ZL5m3DVI;!%K8zp2NQPmB@lqHY!bpXY4&(kX7Kf1uBOAu-Fy@4j3nL%K z^jFB_K>Q6 zI1FwuxJs;jX3<&$AN6~=S&TqRr`#+op= zq2kkWX5ZI_u`Y~f!&t8dKclhY28@MwBo%r}`;7LMc%iPh!+3|C)!@J9j2OGdMCXG4 zmM}gH+gp0lWXB8o$6(%L_||M}H|U__75mbtxas*YR*CvY85LOdb7qWP9Q`8i%PZS9RC_U%mdBWNJfP)Maw1Q$5`!h+B4;wBO9Zs%?)yhup1nMm^p zE_RfMVYG~(RRnz^=o{f<;O^EDbQWnNY#Twl2-=G?_fnA#!j2K{(pEyTlaqUyNI~o( z-Zg^Do!o8_bdR7%1U;qn7WQ&--{I|7n~JW8*e7;#xSL`7DQl9je*^YrL>|F{107|%@+ z+#JEPWsF-Qc&n}ZR`I#QdBP9N7}V!0_cn#1d1nL*BDgDpyCe8*y=&ik7m=fMPXxb@ zEM3CozutAPoEHl3i(pX%_eZc;{`6#`&jZRWlzmWTDKb42!7_F8Vd3M#y-jS+0(IvVbNCxTZ+-V{=KP2_dq8=U`> zN+~kEC1o=sh;S=Hitmb(yeINLPg7-$55%j_E%{L7Bgbc}$j1?EbCjlKjnCAiFC*9$ z!FKT-PVVO-UqrCeQHGW^c8l|^<%L##6~P`S_v;A05l@vhnEPD>-z(q`Tm_ELj}iRj z@SjC~iD0jzyf?9Q9}l<8{So{b!C&IPNAQQ^!`>YqV$$gU_5MVY95swpe- z-Z1;`B&Gr>ilQWn@=+8=;f~sEE9A0xX%rqs_D1b?GOLhF&S-S2sN5=1R1&EyWL?av zDx^O>t4C2Iikebr)>UI_sjk`*>j>Gr^F>&^UKI7CXb?q1N4X%1M&hR;_8mSKI{MD> z?j}(*jpCvxnnf`riYudN9>v8`^oXKo6qiKNB8tnR=p04MC|X6)HhS(GMeC^c3D-w| zn<%(XHJ3)aDB8<`-_iyeFJ=pQ# z*QB9Q42xn?6qBPEE`3xKqoWw%_*@mmNQbjiW1<)+ zmCNr@G+E0Oo*($#K8mpPsX{-Goe003vV{S0j!ZCWHm=AJFmXM}w>5!1~IyM46l7LmD8%!}ey`P?mJ@cB{P7RBvRyjH<` zM-+E)?KE_g-xt{1e5$QTx7&q8JWEahNCV7|O(OB#NU^oQ=X2 z!!iEW9#;N%6er|KPJbfrsW=(MDV`6T+BbEaj^a$zCd?%kNWqiNWn(xmW>-{D%8Ap5 zWtm$XvxB%}=Zcrc;EAD43~giZ#$d!yCx*Jptq?<15tgkeQYnVYj#5RW(12><)rB>L zHHEcesO_|bLC%k%Ud(Pos~GBwG?80_7#haVNStmL#&Chd3-KGvByXxx7s+fUY#zhK zF{44q@> zqO7jMZo7&0+romLfsP-kMOyh=?IUMrj)!*wxSFFr%aBJ^ZpksGCu&lH&z!)%c` zj((HK&8m(Km>0vXF??_02NUySxGjd$F`S9v_89Jn;e{ApjN#507R0bJhR3*Cmlxj^ z!vira5x-k_PYn0Q>~C2MW!@*G=b{+y7hmisC(kn;6kjSVJZSllle;X2hsBpW$|E8x zVtCY1s+2PxkKu_Jo{eFB3{S@Jl(JUE&Rydz#ANMH$FN#iYn-xcV_4_#XGE^*ZC`+W zPW<_peT}-1D83ZKh8RAK;iDK{j^ULUHalfE#<0oZh3a0F`I_+c7~T+hQ}~v!c{%$! zHq+ZO-x0nW!+Rp{3qKIjXNySha>mveK91qr7`{{6n6)j2Ph$Ag@%%D|&&0Po%8nR5 z7yrUhc8VkdcI~@j*zM?FiR_8tYe)HpOU7yE_c82?;WuUd5W|m-&rc#h3xA1WugI@X z?hWOP{W1K`Gq$7rK_dQV41dLNK>TlE;cD|iaklO9wyuB04+#$oj|h(n>BGOSj*Fjg zl#?->ayV}^Ivaz_#Pud-n1G2gCaRjKW}>WVuaU|^PW$srlrvGpY2OdU5-XW-nao9O`0pp85QMIxC@TR_*G2%q{^7Y>LzNKxK_by zny6*s3e&!|ueKCAw~$%KL|qf-o2X}^zKNzLE;7-;L_-r7nrLj=x7#%`ae)XqADCt0 zeRqW?XPZbb+?ChNL~|3D{Ez3w|C3uN%XYRj(aJ8c$V`8j{i6*W#`F<#jH!;Dq&r}8H|B6tVWMVQ~zRop8b&(Wu3o(5r{3enn zEE53}K@(9EF%uyZVH1)6iCOS3G{7_wS5`tX3t5F;&>>|aZ6a$Tr+PF0Q*Xg1Z(^E? zvmhJ8BGfsI(@k8b!6)auy}`tdCU%?n$~^a}G1J5>6SGasG4Z85Z!&SSiS^>Qn3!wg zVH3+u%rkMTiG?Qa7M>|LRXN4UyNtTwU6#G@uwnt0sA6AHyn7eX@g|RgiFdgYAN0OuVl$TjSN9bAx*{v( zd4s9Yw)Zq|-{%w>VPE{`iG})yCO$Ipsfo`_Y*qY^O>E-`=t+65-%rE~OP*pu-)>?D z8|=mBDza1f1^ZIYU=bz;-=(9^DtLn8%-Lh&Ybgcu8#RXdw;HbRggjsILK)je{L#cu zCVn>Yi;2A^&Wod59KV{_XX3DlBPM<`v0nlI5&kaxLvxaG{xtEI2~Jm5aX`pc{cYl) zn#z{bWY)jRI^-P9qb81-I4P0m4LTebCpjU)#-B2A+L`%h9Pz9PSKRhT9A)At8@E?| zq3>)ANl_fdad_h};&988&gDf);`ZkPO`h&brFeuaSU3Szh@)a0mE!i9t!ff{FV@4V`q|qdfrg7YC;T8)Q#nFsyNTNy-&EvQ@4p#z5;F366 z#4$ULIdQa%qg5QCIKpwXj-yQ+{o?2!N832sF@79<;%Fa7hd8>#(KU{aaaKq4k_P0z=d){6iN4L2BD*5hl^b{fQA@XizS1*y?!n5TJW-U$I zJEHUX>%Qz!KkpY$dk4fZFpjZtjEm#`ah^eO?49Nr8pq%`8Wb7ri;N*`VUcmAa8Qvk zERNyq*CU=0ag2;(6pKINxhjrTEGC7VZ4u7pBd~tirEOv8IkwM~@8Hgh&GE-tCj%XaspYRME=8nZ-#*vR>S{(7X zz0(n2sho==5l1qPGv#c>lAekq9Y;o-Vm6LfiwqLJd6xK2k@5Su;sZs-wHoSKoU!+m zOpoI_R#eWoo=r+L2g*%wKuWaA$1t)81WRpL0NAh*OZ zH;#wmSQf{;IBt#Oo;dDh1LC+Xj@#q7gOhVtQDIL}5~e$OP>PLfhS^VpE>P}W!n=ii zyq<+|+{cL>$EhR5Yep0=ii4OgHs&02-OuJ7bG6EN9#HNQ;e*1Z!uyI1mU=jj<#D_o z#~X1x632=-o{8hxI3DH7n&NpXZa-JMGLFaMcsy=D=KQ3P-z5w~$O zG5*$KqrhK|qse_9@=bB>;buQJ%LuQE(|nCx$QP5m8OK|3?22PINBCaP<~TlxV+&6g zalFI!w{gGAA|m8J78~z7{A{uDVH_XD@ktz?vR-xVW8oWJd)&rx9l;aAlbk3wpO8iRC+zKdNCr9z0}e^x$^>R5Fgt;v z2@FdhmVlYSqwjgRPtNcJMkH`m0wWXfCE!nBR05+DxH^GJ35-c#Yy#sGn7}bCF$OOz zA&yI6#$pc%(?scg#VJl!ktqpWBb~V{GWCBri!AV$1QG~y0{Baqf(eAgyL{rI8FBQe z$cz%B!Dw$hflLC~1X7zz5((T|Vk8r=XtK?lifA&WrPItMkWXMsiE%>$za%}=61ZOE z+61PHtSvFFa|j)nX2?8p)WuRaChR{TW-0>7oP_U$qaU;Jdk=bqRje@jRKpQwgl1 zTZQ5^T)abzpH5)4%nsvR6fYg;qPSKH`P}lx*nOV$oMQc|Ch)O1 zcgv)wtJL5|h2)50W2nyhOF!*=rQS zjb92J-w?PRQ~9L5DU*>zsR+3z39rMCl^PWsUQwiyu$ITDnnblEUQXhb zB&sJ-BZ5S$h}F0pf#_7@WjF@#|Zj+g&s0?4>z0iD5}hNn-yi-r-4%NMhn_Z~MKTt5{JI zW0M${#Hb{m3lxt|VoVbAFG0UfUg9lE;C$dSMyya&V6IqbX#K}n< z@fal6Br!FKZ-&{)r+WQK1d<4fpYa%M39kndBS}P)xHgIDNyL&clSm~o+H1sl?D}{+ zd+pgpl8~7cTEbdhyd1#!05xRqtS#{491 zOX7C%JA`*8@tD_O)&}8SN!*>pJxSb~#M4Qv<~X;u=iWljmLwJ>aeoqzB(bWEcX1LA zB=JxZ%aYjH1xu26Fo~r}eA2~k&#y~MNPaECHsaEfhm$rgS5pfP)K?_&Xc8;gfFzzs z;>jci=*9Gp%Z(dfGtN`2ONpF`?}=t2S(C)tBsOpX8U|k~x{ec=%Wz!rGi=g64-;QD zx}LK|;`726g)gv!$4d8jjhAE|_Zlp9db>AL?A@5erX)NTycS+f;x+awi7$Dil6WJD z&y)Bfi8op4WcLS2Y)Rs+BsM4UwiJr*CGn2K-{pGOJLcY(Qs5toe=7V)xHXB7lh`Ky ziSWPI$uZz(Qnm|e?hs)p`AP}M>;3)L+&vT%Wg8Ww6=sBNJR z>ze7QC0x?n=DVks*0pfHg$5ShGz^;cEYz0+b5|G!6Uonp(UAH~FZqRRL!A5hlLInI$F5Y!i5!#%Pe%JgBzVJd)ZbRThhfsR|}V0=w_jZ8&rtQJrpYL zZlR|eP2Ta4AAH->(?Tx`pG@=g7WTDpg$R{C7N(f)JsV0o)j&TB{T=x-LZC z*&Y`9gq3^#sN$Ff(?ZTd-a=er(t>5#w}&NU7H%g?Ny%79i3KPtXbL1;c<;Ykb6TX@03Qx;ZPSZAT0-}AJE=9hSWJL_64^8OE=o)3A} zSXj$x`H;;IRxqC7?7gb^S>bvi&F4g_Ry257@WPb`r1UQg$W#x(=nZ(DfB!n+pUzOt~#!q*nQvG6xLV&Pj0-&y#BQ`*A!7Jjho zeI0*g*?#!Z!cP`{ma>QMf3dJ~h%N5rks5FB;z;q`ipD+*zggHXH;TXWJlVWF2@~D^ zlFm{z4+t6L!+!XO-M4VY!dZ!jc$6(1vvAnL5miM0PxO|P<8nC3nJIF@!p@2YbL%d% z-;;QnV|9Vu7$TD^g|aD}m$Iuv3S~sd5AuP96zE(e<*$lHp;U1S^rElF7+Ep^nXUzGf^-`#x!m*y-1}QX5*?&C` zt7IfA8Mjt4c<}KEQM$aaVarJH&ZyImtN70K1?J@Rb-`*N+B)I4(3EMDP$dGcx5B+@M$75 zXO&!+!u2UUk;0QH%t+w|HYSA!Qn)dNnLLxHFh7N4Wn-2au&c5$JB2wZ+?2x2Da=dR zmxk`DY}}FpajtNEWnqoHyjZd@h5J&tUvB)-bjdvXBYRN_3#-_}&cr4yN#Q{r{duL2av@YP zmZtDf3d>SBYj|kRSnGK>h2>m&?Y!h~S1}I%;CV#m3L%56OxfEmJ;s^e#NJ`)@f5zR zVtl;a`&0_6Qg}IK@0%pG$!v9bRyh zQkgHMu)$I2@Jb3Bd0I%})fC=JVY9McOW_TX*BwumeN()Vf-vmcGT-IdK%`I?_4i~} z8{yiL!iPM#X?sidk5bsmGe#P<)A%@r%!u+ortnh=+c@~_so(u6XLSl+ihm~DF5Dsf zT=)ggdsPiOGwqV{jc|7gUy1Ayel2Vy&u_))|DDM9Dg59lU;pCypq1z66#hx!U!FJi zdw*fp)Y82v{F=f(9@!N3r*I%;zXXAso&KJ}pIl`r{2`@JRfBpVi@79!OFt-F8!w@9 zD22m3*``r3jUy=>O#x|?N!wd#RIoX#}ep%qpA4d1-jk@TO5NjiR*u1F(D=#UgwXjOM&5U?M4zIev`&3$aw3zZ1!g z^f?D|DwP;e_f%I+qjK7Q)pC_I_%`H6uXGO|>8h4S^)$$-)JUVI_^^?#()})CoiysQ z8KX*LX`G+7Ur@NDm3v$o_0p)HMuRjOrZF&$L1{EfBl>AklQf#9ae?@S!p3PZF^lWs zqBNR`w@;(F2=#U%7Yi>*qlKfl6lo=FEo>ufE1X}|U|B});Kc8k#-(X=O5?ILI?Lw@ zVV5+zi*yyT)a4@GgpAfhq^FbHOQg5($*M*lk-koDKau`v3=nx$%@~}8Y3P5iSOH&MqQ^}V;p5{8YQP)6vwAAAq|fC#5AU) z@!}x&)oFZM)!3c&OiF_|nFsWki{zR#rl#SOPk_@Y4ZrxTVXmITT`U+%BO)a%q{1T- z6(^x-rV&pgkw!8N?$Mn|!%Ex#@-wB=NICpeRf9^CYDShd{#=|(W9(&~d>YfzxK{i+ zA;sw;!>Snt!vDG69E=;&n8|sVL6r<o!mD>-b~{y zN7*dW>(fl9OqiO5Z_sA%ij*`_Pol z*nR)sHqb1}*n`YeB2t{O@7{4|&P|E(PHt%io{T;57{{A|AzmSaiW&QMP~KI=ySyr8 z?EAZT6Iay?s%7jgM7m~BJ%bt!LIx8vxSI2% zq5GO2y^}MTB>v|FTVa|a^N$Jk2mMsegyC+V3bIlL2`X$fgHQ%x)y|moiO7>aF%dI^ zxJostY=1pq;-5`c#=fCwnlL3y3p2uO2DuFK8NTnsLpLJLYcrUh!F3s2FP~e5GcuSX za)aw#60BzMb|Y3%sBXS|ZWG=vd^zG?kilIU zJf6W58Qh(*_pG}&gM}jZaFS@F!uv8Fv4Je9#JR-M7S8N4UA)m*|Etjl1H zn#TsS$TMmls^g6ep3Pu=2G3>id%$B_ z;>lm;#~EzP;1lsOmGG(KbA>kd3k=5g40dGjxufsO;0uTE6#0@zt(w8GOuIAqO5z?N zw}_GZ~!C z;O#8l$-@e5~ivWt7Xp>uaQN~ENW#@JB!P*=$u8J zEb3;_B8!$;oS#L#EE;FgB#Zi4G{~Y+78hi3sM@*T&JDB3Tx5T%yig7#bUQHJ{)ek+ z*8YIIM0ima%^Zj3SzMg87hoX>U);nz%3(LRedQYf|+VNCLkV_Y4w=qP@v z@N6erXKp8%}K@WYH~)?lOC*CB3rfDf7>p><`f5<~H`p zqHh-cq!%jvV~E{xX7$hF?-{nwz$^x3F*u7MSqxPc#VfO5KzhD3!Tz^#nDn;Q?NPca zi;-C@%3@-F_oysJXE8mC>#`W5V|sNKlSIa5F-~N>bF3$bOk}fH+lPK~7E`haXA#Nb z8pp?<#Z-s;Sj7;}y?qdHlwcMi@hhquh4~ZZ@sbkD!ptI`MM7pOi=>Dpr1OZy_G8zB zs~hQpgA*Z}MJ|hc7Sp6(D_rd4?m6zcK8qQgZ&}RE;s)i;5;EG2A~S{ae|OCmnd9W% zl*P>s4==Kx=AOq{n#G-2+*&9iyv^~sU8KVz?*fr~9R02=?soVKeeA_@ugrzQ`?B^X zdoNcv?$2T|mtGc2vRI$RbIN@%i$;4`s1TO}?$acpU zS$v|bPlcalv0Y?G7N3jIxp7M{k?d3vk}tE^<>c-bp~Kf%e3Qj@S$r=yuA^@`>$=-3 zk@!OvKRU&Ka@HXApH=*qEcS~0n#DezzEoXZA^CnTIXVQ)*kjhJ7A5BYu`20XZOtGC7pZ+1+Vy9#$;zFqso^UJeEGt{Mif>Ngtca_3Nz z!(BPtokRH?N^=;KvnQ}82QQs-XeiUjp@v8WAss5_P)WS9u!^v%u$r*Ckb5Mqu3^*^ zuO+N4WP~~*b#pjhq@J+8llyTEqfrhQ4D(sQN2g#!*duZ zGQ#n>Du=c=mUOCVcX?C}qa8g`(-@n>IGN*xz8ofqOcY)%oFrt~$s$v7xW-YY<}gEH z{W%132<8yVVOkE?<`B*ylC!smP02YbOy&?1F@=kQGqFXr%44xi@mSq>XGg}y9$Gl#cCUe4i_95&{#N#?6Lye2ZFmWyt$=kSKi z6}9XqTwW1wW*>9-So%A{_jC9lhj+!_6Vmy!TE>qO`vv$NyhQRLD*I_2&7^uJ6Bi+9PRtN7)@?s;?*`ABYb=#fWH zDTRW3(&~yl2IMg?k3Q^6(8JU>kA4pCpGW@=wmvA2!Fk-v6H6XL^0+dOY#zBhhUPIW zkEwb1@)(}Sh&;ySF+Pv0@<4s}$UH{naWVh#ukRjBaa++C=^MMdsEieVvW1)auI{c0 zc}&VxKV^sq27tqUySDTSy*n zaseAEz4zXG@4Xl4f(=v@eMzQfGLwWRiUKO4R24<4hy_usC`GU!B8pTMl%i6t|DF@$ z|E+b_Ui+SV?z!jIl$p8H`O_k-C4P0@nO=EzAskT_bjT~RyGXJSULj@`Vs;_?LUg`5 zFH?x=g-8`5U5Mw(hZ*hV-g#ej$zw}tKSRpSlt!@@cGp9Nm{W*H3h_kWphH;8!)*JF z;bgHevBRDsb0s9UVqPKU7vi--yk3X}g?PLWFBW1I3l`$ZLOfH*$D^=NVpvoN_9wkP zC1pFe&!eBGIa~G=Sz9B#q!3FB@q8gx7GhZ;ma~^6)D?p4AKEi82LGHy%kCm4_Su&A zf@s)d?9!JCvAPiJ3b9^1uaT^^gNa$_qhXf z%=>`Tpi>^nhn&Ej@;C&X8y^>9dm%n6#OHoBi}y$&ek{ZZ;YSN`ObGXZ<3heK#1A>mBc*~zpH3FyOiuHY zke>xl37!^g5Q>}?@{8cFg1-sU!xN>{g+g599vDT%C@!(PxMN3A5Do4m{Jju=72@y0 zfd3)*XCd!4*O>gL5P4A)i6RsQqWG$A_{u1*l2TVhc@Za{HdRUn1+R|&TjZ@$Dys}f zksk$fS&G7&616BIQCuIz4dO~gQ9Ozg;;mQ|*@7&4jcBfm;#%>^8ycykG%1OaQQR2C zO;Ow&1%srL1+%%Oq9_wZ*(gd&sov!Zs4pkE<;D3&BSQ>hQT#n;mdcvIi*-9?&3(SoIR7iliIo87g$NK4`S7v+<)NSzINZKG%xMgJ%UL~(2T zNc$){M$svX4pDi-b^8c!vAgRTt#cGzqUajMiH_QdQfm9q(D7TeZc%iPqDK@xqrvUC zeFb|((OXDC?jGGflH?7#;i>4y$sqcHQ4EU0jKYdya1=wLxFd=?qrp8AL!%fU#e^t^ zMKL^z5mAhcVssQ^7~$q3?jr4$C`Ls=!YQ|;yGHWpjoR2~@D*ZQ6yzjS5^s%SVic32 z!N(uV^5-Z0lM`=?;&#!K)5%>?OpfBgC<>#P!ftf5`=Yo%io2t@N6hYxVyfs_oIj0& zIQJDHpBBXfQP2Z9kx61SidYo7*k`l8>7vEO4@((zbw^-NWJRO9M{F+S`eBMABq8Vu zCb=j|D`utG4>turmY<9w9YrRJ=~2vx1~*GDh+<|Gv!Zw`ig{7Yj^d$caQ8Kh=R|Sg z+Q?0P!;jFWN708l0|(?WIadlkDp9Y&sC-6x*ZtDT<$?*b&9fD2_#OJc?aWd_tcO zgboFZ7kii`=L&ur#b;c?QS6W6^C-TE;!DZmA&tj=&ue}Q_DZR)?IZi5_~n}5OmCiu zxNddiYxZyy-$rpD3MO}z4*r`u$jwbo7ynMkPo));S{Zd%obWvABSMY}@^t9$IUKC| z_q-FL`H}O)(aH}C4j$)GkS9gS1E}d_%QZL^#qUx45yj~!&P0Plyw8fkIpMzu{u;$^ zLTZ;$G&s-sMxX48)e$OblgX zXdgp|7|Jn>uZq-;p-v3tW2hj>iZN6ZQc19~AkC`8P*r&UGQrullV~d46b-PG%cSFo5s*AhUQ|>T9C>XF|^F_RxvEk)!s&w zZ3WxK@NpS+u#D;$L#G(-h~dr{I>*o@hJG>h7n`mz^vwC`CZu}|J%miDAMB02a=E=Z zUc&q4G_&t47!boiNsbj96vMDw?qDH9Vi=m!9Pe5%Jcbc5jLd09$8bvwqa=C0jJm1p zzkN6+hStKz#V}rSCkRdwyfuc2LKxn-&5_%L-!7!oy**CF$!F}y3u_i_zWe%ekAzu{}}8PzFTlt44>q}W4$c9N0KC; z$M8iA-^cJn40~hvQuIe+*vIWChQpHFFHR1`@J$R~3(q?FHim;S9FhjIm%htoWqXXy zvt!NVQOPv#9@3^yg!^5W|TWPR8(43_r*4o9Isoo?)pNPUkv-rC9ct7=D%9 zte-5N6AkNSco$>1#BDr|E91B<`aikV$MC!Op_4yy4r%{)4FBZ3F_{+!;&|t#2swq$ ziC4vg<&Yo8)o~PwBP7YNAobY}p=D9g6vUy$|D7RJGPhV9#pBo<$D47Kh~t_#hQ={0 zj%(w%E{;}lw2tHYIBtleMjSQcC>h6%;;Ne9O>vZsqg)&}$5Bc&r3K3fW;W(MF0-qA z92MfIBFc(_mEx!@BpU`B&S1!^it@kKRgeGs&gEKh)Q+Q><6{GI30gV`Ln+#PMJpg>j6EV{{x-#EIq?LZDPRWopIb1$K7H%IcuLQm2EO@?up~xT%6evq|f`s?14C@3CV{2pZ{na zMjU1wG3nBH9D1(j>4C=dV8xM$!xg>FPl5lbH<|P43-JV5Fcn8S=O^2)8F9>v7D-4?3o?>L8}gRKv6QiiW?4?ZB97%b{z+N&Y>xj@ zR6#9$MHcN zABrYB*4so+PH!KJ=k2+QSjDb5K8a&r9ACw;JB~eZd?~q~3Vts5nRshbRHOYDqS-6R zWLC+T_e(9`#PMw$UyJ<#v0a5-E|_)`%-W=j+1fxlxx(_;_#HkoR&;zq8^Xm>G}&OP>8P%wfsTec zYUrq`qqaCf~vzBdjoIX_KVE6E2I@;-IuLlPQSp(2PM@JowFUU37HSF;vGe9o=+v z*LgISwzpxphmM{)2I;~7Z@qN%)-gcGjh@y=u%C|pLi*~#4=Cy>S|d&Q6ou$fsV%+xsGKzp3w26j;D1zqhp~MKcxq+lA&?%{ue!Xk4!d6Ld{}EC}!kY z{c;^EbZph}4*&n*TF~*D9^3%@ypEMR*6Y|H$rp627Q(C-b*vKpk|19VOy!zf?pht| zba>^}in~M9zpMv0_ip6m91!M>yS#ar$yY?VN$^#{<>l4uI^NK+S^T^$$RclYprtJN zTb$43gSV(qP7Td_mklWv`iM#$@9Dw6bBEuGyszT}9Xwg_fu{IS$Tl6n&nrsJb{#u( z?A7t54n8!!Q^#jQ$am@Zg!4p_dvtu7)B8_^N{$O1D6eSqxhTI7yjWiC)6t@lc2LK6 zocTKT>-btU-{|;O$N|o%Dq-4CvV>WObR5=kTnwl`qT{HJW4VIV(1r!GrM}PUPv|(Q z<7We>4E#i*;~W=@j#Jzjbo|0~)IWTNQ+GgK_I?09SbA2J*&73X)$yAonM=zHIxgz? z$O!)HyQJeXm%o7l27cG^2WOyx76$&*@fUYI19c2^KN$L(GkkE2Cg-5 zo$>Eb(u@xOGp5-M21**Z(ZEdxDjKL{;AR7F@6t*eC}W_M@Xxvj8cJCMC7Jc`U%{FNYWog}dix6L$L5R-!Wd{^kP&?JEH^ONz!0|1!2Je> z8hChIc)WoL28J1Uc8oUMzz72)4cua2l)=L;u>s+ z?GGZ8c)ktWJ18{aA#EaCdPtjO;5Gxd8@R*36a#k~xYNL01|~}`4H}&d+ZEJjhqU*1 zMwqZy;qLBV}1UZ3K4+ zlTb*e=k(Pps#%;o*B5=-z%vGB8+gbF_M$lk9yRco@P`dNVqmWDjujPUXhk*8z9^ zVgpMIkWiKiS!Q5=MaAR_j;4X<3_NdOje)gnuRM;y9eX8b>43Z!xOfMIUo@~v$V&!R z8~C}RqVnoW0j@K!-oTp%wiwu8;APIq0pT|cY&7tSfmaQ@W`GZCY%*|mNZzP%;VS$G zo3DMBFob3v;&2orfY=gn;+JkOK- zBzF(41tHAMn$h62fiv7HOr_Jw@{DVQt^LJGKZ6M!7Q4{|d$TI;GSD1mHtIdDUMZeO-Rc5fM zvPkwpzao;PCM1?&^Z%b@EHDurIq4QO3js#$ckXiE<{|o9JMoyom}X8k%TiqN0gP zCaRmLVFnLY&#I&ePns%mUifW82%^G)Vj)~)vOq%fM>Y(OJ>rPAwU0GdKsjgBc(wtE(dA58$ zg&t;b1WnB6lr}Mo!)oGD6OXZV59YTXUGR{JIqZ!eBM+MxU0vN@T|HuAuJ~+UUB!kK z@KxQ9Ru4X@>vjmwGqIt%`m(xu+{69q4Y8m4+@ht1Dp_U8YQ$syx;=KhC%JV|J8ftM3#pH`7R&n0eP-{)R zWa8MEf?YM#Y7@_kH}W+mi1b{vrmDU>e}jpaxmQ@Y!oo%qubBAC#D4awiC0a0Xkwd* z*SM5SY&P+xi8mxpUTEeql{IUs?lsjG6K^pFZZaI8n(A#6@3QNvg}0h`$HbLegWp6H zk|Xnj=T>;;&j;dUVa*_n=54|snfTbm9uuFM*v?WlRY5Ja%ft>7Kh{(`O;AXJvYb4% z6rXwD%>`aL+@qHIjFtWn+H2xV6Q6UiYN;v7pbi_4+z3IUQ2y# z;(&?MCeCo$oA{Pp#HnK9po#CenQ)^sQLA=Pwo`32wzjfstEXzK^z@=fB<7z+q}y#Y22`c%?e(XA^#j$SFa3K5OC^6BkWf zGV!a4-xzisba$Pm(RV`vcStw=&9~=uShuc*S6ScaENKFaRUn9umn1R~$7H+U`6SsPc z@5K(iKTPXbSCzCtyissny+|q6^-iR)t}0_;d|g#qkj2YdD95rLf-K6z>mn5`RI*Uh zLM_H)fd}$bu~5~*lXX?4=GuF8)v>yYyhbqh5t{83jraB~ro+7{|qsCd0rpKU)K z$=e@Hzq%IciCkYVuxwo~*sB{^Xl$Xog&r1~SZHdYt%Y_Lnla9n;nwUWGt%5b3kxlC zEo~)aj5vu4wh_%k^;CNc9V~RQ(3S1APZ`qtBmKBq8>lJ`g7^no7-Zp@ z*F(cB47SjwfojpO=uitoBp4=XGhT4G4DJXE6e_(2YLtc17A{!0XkmZ>KzK*YhkK|`=niMHbw5YFwH_C$6Y>HuV|!qRM zXPj>##mQeaG|NJo9d2Q!bj5VR_ZzAiIYQ2|loJirgM*7++epo^_}C+sSy*o25eswK zMhj1Ik~C6}T6o;T6P)c9=5aV0sreQbu)7*5O4bj_lNOE*4=rz`wu|!g2%K!B7Fk$q z;p>%=qK(zloac?zGZy;hYi20C#6tVVYAO4?v7*q=3JcG&t1Z097M%%ykkOvA;51gh zJ{x)7!b%DLS+QJYVP|8t#==?)CwL<$v9Ve$xXKQ#v#{Pm^X-u-P1FVpFLUSTXda5> zH&H}NB_W-fs8=n#X5mu{pKiYogv_ zi)tYKMd%$1-!@V2(xz^B;;>-p{nA9eXW`1G>U}|KwpsXy%fZ4P3m;q9&agR4=jK-! zq*ZOIx;0fh*r=w;ZK`(B+feNjY2&JzTk|qaFnBO;Y)U@ zg##A$S@_Drev8j#YmJ(z;my?T&D82ow62Y{_6@Xe=##6gT)|-r2Q7TZzHJtGo_V7- ztC^zakOdMZKWnCbYNn1^IBwxL3+F6+Z{Y_v*}`dVmCenT9j`!SMfjdFIl+E zJ;BBR8^3dlfu?hajP z2S>m1Eaj_gFiBxuAsb;E`8JB$Xxu{eYN6Z_TDy9|D;^4LXf~`Cinn{++9GIC#KxmS zirXk*<9Zu6*ui(v6)n^?Hmb6mL>V+-^M*HRe2jXF#sDQTdJ}) zzMB*&Wuvr>GQv40JG2a{pkzroRvpo}Nj^1RThLNfvQgPaQya}}RIyRjMlBn)ZB%2W zEmaL02U@Bdj%n5HpeOmh@0tu_ZvF-F+4B#rj?Jf{(8xwz8})3|x6!~3-j`QF9+$he zm7=g^E(MC%D`gKXF~921iFY-2dNNZPP>d*|^_E)JDw4 z2a~jEHXgLWYYGq8cxPdFdTVt<8Ht)4s^`Lne$ zB^XQaah3PhC*htw(OOX<7R7ObCHbH;#V~aL# zcMs3BG0O%CrFWa)Ju-7_JZxib8}(ot_0_$hN65J%q-+*fi--9(7T8#9V~LH&Z9HLv zU$dWK)BMPXZPb&THa5<;QBT=e#CU|WUdoMa6@`RLzF}Ln)W$L!)7vVyO=LM&bPsK6 zTlK7s6;k7Xw)_bYbn?%|LMv^&VBl(W#wyNm2Mrv&WMegV3>$xNirQFf<1-td z+gN8~y^XinIvX2oyli8$jW=yf|IF8Io^#m1y|s<54Uw4K_@5w!8KjqMDZfpL6od}!l+krVCIAKM~Z+Xdc= zw^!S2jBT&<_Ua??T)%yw-(h3tn8+tKcC$0vtDTay%jV-hk+tpBzGu(8+1_cng8@uiJ@QtBHjzl?lkW512BZC-c^HJ%&_bx<`rs5Twc0j`t| zL5<(qILN)o#vwM%#xc&2J)y%kj&RzD0h1)B=Y@`o+XWpI36W)gv~j}5FE)NKI^EaJQ-|6{P&}%6Z{9lKb9j7 zl!Fouu5nPz!A~7kaR+mL3w4|p;-BObZw)?2u61yogX ztm-(Z>!4j{HN3N`=ir{sK`_LI^z1-)U^r;(poxQ#4sLPK)Il=`y&Uv*(A+@_2OS-B za?sL2D+g`q$_YMVE?*9@KU*_~TeLQUR3^mvy3VS-gANWp=&UHLuCs&hI;-wZ@TuCx z!I{pgtAlP5a6uPEp-m45e|@j@6lF!x^l{MF!C(hN9CW`m)XzbGC-^SJ?*^^9r~woQ z104)=OB1)`j>}Xs4YY@1jOI80}z+gS*-7 z4#ql|=wOlqenA@NU_7T#)zHi?!SAC963?v;k~JgI0g;!xsM{Re?%+-b^}4F}x~Okh zwb)$hqKb7@cRA?XRZVtq>QdhQUDfQa>K+I8I(X1Qp@XRo?sKrLt9rlzhw^?YxOhv5 zd>XSFhDq{|hTiL{xFXJWRZ-6BZYt*B*;$degSTdC6!w+Lo^KQkaYiv<2cCnQe~b7I<~P{wK7F3qn&wKhwdA zZfa|<;1|S0oJbB9IC$K_!ww#y9|!Xt%yoi0;UDER@U?AHisUg#vee;j>hEr<|D_23 zkzn!(2TyUTcUN7W)}EwIcePNES&O9kExQM1iybU+u+G7H2TR#S4pwm+cd*>S;aB`ceUk6=s78s>8@UI@VtYS97ORzeq*Zm-Vp54crhMY+7h1r=JZf+N?jyxJ3P`k^sa;U--fnwaC@lPJ=8mrOR~6!x-c{RfrAg(_5@S{+Z=r4 z;1>tKI{26iuxI!i&TR+V9qeEyPt$ff*yG?+;k)Qu2=%)i)PE#I@|lCr9qe=P6-Qj& zcJYOSy$-(Q%4#0TYIgTf`b^1FjSg#0P^S1$K&mXcS-15G1)G zfh%+TDj`=37D*r^BrKROSX7Xu3KGzS59}CXvRDGe6KIw|^8`vHa7_YL6R4KJwFz98 zK$Qe|pUL$J+(3QLNQDGSCU9c{WfCZx;5^Z8O5o-MN(q0zEJ_QR(<8{j6^d9+G%M?Y z%JKfDkV@k$9tF4*0%^QN>)#xMgol!Xp+E}o>nt~`Ux~hpjHC4 z6R4BGAf?q6BpKf@QZL81-XEH^F!<-0*f4=cbRxVk_6f%z?1)ZNwIwbcl8Y3eBFuNH9Ws_ z;@_8aH=l|w33N>$+EejO0TlZ0kw8y&bpm}8!G|VaAJB^dNI@nk{odF5Ns>wuCaD~d zz(6)95uC|9B!Qtq1`G1wWeW9_Vd8Um)^j)9lEA10A}*AR(TU(5gF*(wu^tc}BRE!Y z9J3Obz*3TA?p;DACNL?dxh;X)h2N3W+{u0z5~A^B(M(C;ZXx#w-YCg>`g#Vz)0ZX1RhDiOu$OOO(2;FuH@PYIEmoEG4kvY zWC@OxoJHm(;ET<4!IWSofwT}7$sVUhoRPrH1ZE{LJAsE1m?IAVJ8UiMIh&lzd6>ZB z1ePT5nE08Wzyhgpo|IzMk0@)`^B6HE z6Gyf632aD!gz{le^-2QumV{nQ;PnJHiRG(;$9gL2-w?i8kjbo*f*bIbXx>TS-2~ni zzEzM1rm>dygnuOXegYpP@L>W)>PEJ4`8dHraOAg1JReIW+r^Scy)kQN0=p9UL^PiX zQn_2m9tri+1Q-C7l+Q)a^V7aeU|#}fxe}${zDnTR1P&&!KY_0kIFP_M(ueHNY@ZW3 z9N#5yD1qY%d@rRACxY|(jtG(*P2ia5X`CI19}@U6fu9pNCEiXXa590P#Gc-0L;27D z=>*Q?29cp=Yy4F-7ZSKAXPLC!!0p^-xK&Ffj<-YD}ldrbpLVHf#sFbC)-)Ju_^xDYOoEKQI~W)*W$ z+{H~P+?+xQ7uUGB*TYl~*SfgQ#XuK>TwL!4$B$FWy0}4j$(-g!md){-g_LqpT1Xke z?Qeuwu$+tXE-JXF=%SO0&MqpssO+MNi>5BBxOk}~>bR)uqN?qYF3G9v8Q{DEfKm z4i{VA%p)P*E}DkD6b+~$AyOtwa*B)LqPg%%W1N}2 z6%7Un&UdjuvL1Kwq>F`FGr>YJ@O!JLTr3jJlHMw-T*6`iMi;BuMVW%>fRu{bErNjBWtp8_sMBbC?K5+4&8{7i=z9jcNs+}4X;X8{N$u=(S zu>slcVuy>}91b^l@$pWYf$#S=fux>E(#ZA`Y10y-0V;g$<%)e+VxSFUHtB%ND`qW{&4Z9i@#m`65~BvCSnE=hDv;>ILyN}^s8^^>?c8T5@keFPOz+CVV~ePYZ2MY(J+Y?NwgGAqa>OMX)M?ziKaq+*r2i0fj+9aB+2i* z8m*FOokS*BvL zL&aH0LlYv8rBy(<9<)UJ~<@SdhfoWpZA7E%4xiX@&*Vr5SAToTXcc)R|JLbDf=c#)H#znUz`C;F?^NvvUnNvs#+ z4KL@d6%x(OmJLa4OoHp5=yqedFIzC^8@j<{im;Pw?F&st-`-M;Bzn{xFGcqW?tjqa?N` zu_K9(CE4fqz|T(MB)fzhd@PtnT?VM#N$lail*DIAd@fmEE)AA8Wzg$E!TScNFO%4p zL@N)iJ$#kKey%niJy}AnHwYbuD7%!+&P7OCwNHkFlXZc z#oS|({2_@Sg&a@fdm&3D_e2tulcJ$<*UCjHB&U)%oy3Kl{!9|T<@nhoeo5k2F7tFg zEq{6f`^J8DtV~vp{2)bTcIlaxv@m6?V*l`svfF&DA_Mu-9t?wH3Sb2P*hTC zG1`Fvuj`?nho&Byd8qH9frmyO8hdC+GEfm29)+B;CNKEow~2?Y1B36G#O5Aahz*rl zOA_9#9j_N|7}YGjlkZNA@_H`c?lf$E{7k-I&N z^RQ*08t-8OOL>^+;dT#qc<44ln>3h&!o!nXbc4eSz2Ib?r-aXTBIJuaJS|G{XFMzxzNKzpw#>tF4~M+q zS&tPSp7pTX!yXUMd3c^taWeM{uk?b)lh=7zFXROeFLI>_f62odAv9R+;fsO632vZY%*yyf9-4_iHK z^YD>}O9RzA+@0>y-WPn=LzBtcdxF;uQXhDzJ4iA2L&@zqNHO`bhn@UCVMS!S$J@6w z$_|e2pnyC$NbU0QiRfQjoKMY&7Ll6=hd=f3nTOBWG!Nf+_}0T-E}vKOzw$7CN`&M~ zN$wLo@JeXE=)V@E!2yoifP9kKT_cw!798Ys9i>seV?#KHM`?%IQ67$ZIOgFZ8|C4+ zhwnN1gVgJT)DIqh^l;k484o99^zVE?`^m#e;p~=uwRx1f_Oln@DZ!7{N6ym8t>Iri z{Kn0EV)z%qi$n7s8IgC+!+Cbm#4wYzxgeZ2)bQZw%N~CBz))+~)qY$P`h(L|kNnBG zaj*85hrc}>9Hjo?*5LpSuR30%rlN3? zNO8)k&JUPFik7pZ%8~bSDqmghX#}8IbeKhmY+(!#hF1%Iaaq-Nej7bHDnl2g> zYVD(qkB-vhwm#bV!H>QUKHB?u>DC~CI_L9_ObD??f3RYbxt+wO+dQqSk8VE3`55n` zyN@0|2KgB5qopC?5w0tD-~H7^!ir56Xb08f%=u zx#Z(MANTv1=wp(PDL(G@`QHL=_c56>ioY%e@APq(kc*?WME?-=#Vbb&E=Q;*XY=pz zF;#m0-rVR^91?U(v{5kh(|i<4S3e-pKInsY%~9X9YXSQ_Dp^AtLHA+!c+$s0AEpn> z$1ESS{ou-l?ZXq|2qpxncZDQ5H--dP6MRXge58eB1ZVh|E~Meu0@} z_)$S-&GGTDCxnk5qDl|Wd&( z$j8$@p7F8R#|rVVM9k=OxzD?X0#}q}l9iBKDPMy z*~cj#Z*g7wIPBwykF7r5@$s>b?c8>T2A{Ae$41^|LwvmN2L(S6+{RTYgql)A)kitr zbf`L9FTBIY9v`3j*vY_rjG!Oh|1Ue+Zozk74X$5*=Hqi8-}v~}#}_{K`uLhF@sReV zk9|JA^0A+j_ORCYux5N0JatIC^03Co68U`M0kOQ|Y`lQt{tX&9*ta=LbY)b%Jo8SNTK>LRZ{RqL1vXop>zu4Q<#uKnH0*V&?SYg zso;V|xfCj-P%(w_lH^4VDl0KaN!CrFN(xm|sF6a=RB+Xgmr<$-A+Ihr*$XSgS}D{{ z1y=y;q=M@>Sz}_o6zYp*gA^L2&{%jw!CQKxN!AJbN=VZbnh9YT%~NQR8Z*38Ii&*DU1^R$XxE|6vm`5HidE0 zOZ4+!r7V~&dus|4Q%I!XrZ6dm+fukEg?q)r?J3-u!d)rcAx&dhHi4xkr!XajyZ@)> zsi$*hO-qqimYS8q>=d3%VPOgnNvX$jW#SqnBhC~3e8B~Rtnu*_p2+cYN3^F>Sd_vCDSRl(r&Cy+!kQGGNnvpc zOGLRmg%v3*6~0U``>v>GQ+SR^(a`hr62J=*z{(U}m3ftoWL3`QB_UkYYg1U4!d6MH zPhmp}n^SmGk}q?Cv$*h$g0Bef6^E~-@J1@QF3cKVPvN8}|GVnCMJ&hi74Sl6^R|%U z!__-N-c5lQg5Tp1%Nx7iPvOSl!RpwS!bd55mcr*^_HhcI2-z-3gB>aC%<)|*G>}re zbDBLuJ{4s5ej#MP;9kKm1@{Tk+gIGR<^-3Uzs_k62;m4GOyN6D*Xg)tIu509m_wh& zQ)wJY;V2hr8a>iDmcnuFX=zkXkcK(S zMnW2=(L~4wiM)9(w|yEda=fLGR)Ve5Xd|R;F1KA8A4=H{IZa0)odi1zc1fdaF1K46 zV-5tJ*)xq^X(ZF|(&(K=pEO1@OU(MFF*s-6kNq!vfZ)KKevpuI4TJU$5k6FKSQ^7~ zHY3s)Df||}Q8|5gJ2W-Q|IOLX@uH|E?@wG!F@;(nzO~Nn^SsX9>;_q=%WD17(A5q|8pEb+bGQ`J6N! zPUDd@=H@KtrSWKvKPF`K#h}!D;R^&G7kna(CxtLh8Z1iV=`=cL&?OVxg7r)q*JN;Q z28+{J!v3!qUYf?UX*?%yaU>Yx^@nRYuaN?!0DjnQf zur7`DLS9N^wGb-T2w5vwWq96(G+q|IHI0ozUQOe*G+s$#6Ia>rJQjIpV1Tcu@kSbN ziOptq-QX}~OB!#cK?Ck!Owyk6cFuWFRyfJKLf%W`eIbV~hp60^4t@@Nn#N~oe3Zt= zlH8ugCqkIDLSU4r>j!n{Rf`1gF;{i6I@ z@IV^hI%FRC=e3$+ujpIUoPU93m1=9E-jm9I? zk7=9~J#9`1q4Fmoy+;JUTu%Q_?rpP*o=M|uE|-?SrtzEjIVX5{V&3_jlMAAu2g>C% z{z)S*gWuEmBaJ^9;l#YZ1nHB0_!0ki8myP4kiiuhgfl_dS7vZk21PPKsFbUP(1uyW zP$oF?J)6wWplAjK8E6?qq-<87Z4^0WPLoLSOn@Z>>4bdJ2z6Zs*R#g2ij>RXhD>li z6{VDrlAPoN!Z&7c6Ftk>P&bQ)227R~UPiF281O`q@)=afpkfApq^M}57erk2@c(ADA*w9ftp6_ znGBj_&@_W)nc#T&=Hh`>XAkLOagtUUw9cTTWVOkltq^9l6Vg6|4!OEmFe}XMBuW;a ze`mOB2Hi6FC4*lx=$=834EAS&`=)wk&?|#yGk7k8-WjYM9=?Sk4GbQ&?vp`Z@!v0l z{z3+1Fern;84Q%bOvKG7@NTp z89bT6IBrK7I2rzlhY2)hKV)!U1`{)wl)+sYOwI)VZrzr_9YQwUjoaxV6`D0d-6UVc?#bZZ4DJ^G(D@?N@NXR6zd<3nKZ9wR;Fc0Sg9kFf%?uA_P)K9BX@UR$ zL^FtG5SM6~q-+|Y+RiIVVq{=uU}a!u@X3haJ_^d6W^h-=q^+8pK{A80Q?+>+cp3N^ zJjChBm`7`=3^Ex^&mf(_>2rD1@J5Rn8O-DmWH4K7u80?0HS%Ad{AY|dH*XC+oNL|O z3?30)^{;}`Bh{lBJSNG+_TUdjHvi60WPS$31sOapeSe8`m7F7Ftr7H6;|gNNVLmI^KxT*e7AQc+1+A(|4+BF}S%WUwiNS2Mwt zg%>hdm%;qf;TI)I&8iGu%JJ1g)(EZ@oI6szy*_U}_quxF4eXP_1uqNVn87PTT1*Hr z>$MDC&)`!=n86zvyxAi1aRzHfs?FpXY{}rQ4BqE34J)9$E##dHw&pZnw#2&`yeG-e zTLxzChP)3l_%MTQ8Bp^Px26K@Z3$X3_v@C}&YdK#?O;FLtL}pJzb)B7?mdl)5kSr69>ZAzyJ18L623I)eile8cInvnb_6 z2H$3IFoW-MnqwIp%JIV)91(srr@5wmQ1EyL-;3slV5bWGC`f%a_oQU~l)=wJP6?hC zJR|sjOkD-E71jHF8|22j?;Qjb5D`Hdl#&!_6c9xzi$=OTrR(O*+^Ku%?gjz7MKMq* zQ4vwV00ji4h5w%KdH?IT)>(V)Z=dgU%-or|GZzGJy{MSv(medly)KNhVf-@>m*=5a z7{$Z5!hY)%C>-|i>O5Q%^ZGnwiE=~Cn}Yue((Tqf+!kKAi}!g)gpp62^9u&UxI;*R zFnmJ%VFZNK7ynj**Fy*!xU8!@WXE3f?DJO7Ocno^$CiRP~%PVZ6U2=Y{Hl za+2p$VYCaQd>9qNs2E12FdByOXc(2ls1io4FdhzjUyGka(Vegy8bL6AO)xxMA zMh(&9qSX8!UOSBXVKfM%jwE5Kxw0jK{-h6-JXVnugILjF#fx zOt5*_`wntmU>zP4F)uAeD&(!hcp{9pVYK<5f}RX}v3b?b^M5+*z3PqOxiFrQ-eAYJ z52J(dj)L6hJB7UszjGMR3ZW0p=fmD{WQph~Pa2Sy=qG7}` zu^PutctY@(1wp3Og@3R)%MdbUr{5I9C`*Vf=!D@4No8UWby4%fSP;g-Fcyh;K8(d- zED2+ym`ep$XZ)9i`O?(?dSgWxD}}GhC>Oe@HNw{lt`l4@xPdcpAm*CAZfk$+52LTvt`4 zoBBA6Pr~3ZF_X64yz}H<-PD|J>NBay{xH4_C0+62>=SoDAbs7)QhSHjE#_I3DJAoxJ}1K8#~wOzrNK zxT(AM3PFBl^7*y?A9?X7jGw~znWVdyv#*D`c-{X}5ARr0xrdsv(tkRPU&1&O##v?+ z#&2Q#E_voPjc#3fs0lsPnjY#8Y1*G$vw4M{^gn(zXKxSneGhfBhnM*U(bsOyx){c# zF#hJ|AI8lv{^cw!>z%4y7IGzwtI~TEukoM|#`TQD4Ke9?OOyf;FCoKiF|#7xRt&*> z5#$$ghah$S%Alt&0)HkID-etzJAzOIIT73y!QBz>=2vb6cM4Gv6coZ6Sl(%Thpa+k z9&4XfID#U=-zwM*gek|5up# zHx-BGg3Sc;n$RM{9~aU_kp8WNv=+?E_K6ICDuQ;bo{h(CJRQL^5&RR!@0f zV)!+Nj%;QG??t^Wv~$G6=~2vx;@JqEi{SYPUWnjm1m8yRVgy|xm>a>o2)ahlErNj& z4C25QM)wGMb8bYuqh}Ano`Ssue=Q7t$*4~ReIw{6ioXc@3mG8DRQn2hY3VjNf*}!1 zj9?N6^f?TTU=%lb&Z1v)hKcj=2o7J*8XU?t^fb{)rgQcdL8n2O5y8xe_f@7@g0lthErmHksI$)D2qF=z zh+t&|(FkG@xDlixh)0l!;H2ctJhccc$zRWuVnmRPz>I+3V>&KvC)yJ02r_dP!L(`4 zw+I$;p=HuCYEgzSi+EpXS}eFEf~7*J8Mr zV}-FHf{hVu5|cglw$yEN1Y08B_nz3*4BI2vAq9OI!OjR?iQr=~cS)+(B6vN5-4X9Y zQ4D(`cr^lkF^Zhcc_V^1BlsYK4%n*11zQ9TRC|jjbbc|dtai; z^i=GSkEHYW3Rdf>7%1{~{8lOe*c?4g`oMHVrzRYdEWJ2<6PxVyMfd{N|&dK`l9^;CC6Q9!saic>w+t)8k_FGUBYB?hD5 zGev*p%*myF`RsP}%|Qi7$Ue9+M|8M=It zdou1lURXBj{T!|sMI|BSq9`wfVudIc^zwceSB_$LFZECq)uN~pMb#)Clp^wwQOu`$ z6rcA}3^j$+U_oM1sU^zIUaC$Mb)$GLisz%K7e)Ojo{FMf6b+(yB#Ks1w2q=-6pu#H zEQ;n)G>YP{W`V|0G>M`mKkLvez`!3b#HLIrN(=FMEQ-gaN-d+<*vL!uW+OblBP%b} z*(+IZ56@{6#S>AqWv30#ncNdk3i<6y7OzCzemeW0_Dt76_b7S@c~P(nS3%D}SHW&kywWp3vnP)uQS^^u zKoq@M;VAk<(U&E5^3KyjXFTlKDXU);#AiBXt!Nh@4vb<@6hosJ7R6v`=8z~DMQ6s+ zlVNxiBiMvaSv+AFnTgHImbmY9PWg%$!wK+YU~ClQqVn?RC?*S;AjlUxPZTmqa90bw zoYAL5F;#fUhjXSyL8LQFpBaV5*&YgMNCBU zxR8V(PhhARQJ7I!;-6&iNh&)ECyF&utc}8rBE<$~a!3oAFP=OvS`fv;C>DviG~=^4 ziY3DHa$6>R`Tr;@qgeGn=IRVz7sdK0wnniniVY%eiefY8m~gg^72ca^*A^+1MQo2^ zhd8_u#ZC@=6t9X&=UqZ}XWF$#OkS#G6vJy#ye>*!J>SfvdW&;a_&b6;Iea&YBU0}B zQG5`^hf#b)pBUbWVQ&;4bHzpRMb!Ij{Xa)>Fp5J_9A=?Wd=tgdC@#OB%QsP+8=B3JR;0G(MknWf8%4R^ z>boeukD|`T++*DNqxdn3J2vM2AUO2<+!Imn6BxX-{*yF>yu=dkU1Yp=agsYHb1oM+ zE%*yJ5N?~oe-~sF?}qRu2=9jc5yhX}vSO$l!?`HVM^QY6dt$i2-5?6YkS~UdQC#A- zoRj-+6n_gLzY@hi8Gbp6roFvCfnF8mT1LMvBL#5JPSZDu!UjKNLf@@P1Nmj__H+3kok3!x+i)PBCM>Rbe44t4IuY#c+2F zkIV_?m0mQ4Vwu>I4Z$nGC1NNY^T@q1l#Jm%;WY1$p_K5U*Ss}I<qxrr&bIP z$511Nnlb#7N`dld3w2Nc54LY~=xjf$aJ49#O`7{jA6G>)MO ztI^xblc7-zLr-~x$h1xW#~e}!En;XH!(-x4PdemzGXK^ww4wfL&L>X=LI-o7h=KTY z3~hywKN-VQF|-r2{7Z^~;xn1p_RRSu)j^PY=NO)iVRj62Vt6iw=VRy_L%$eah~dQ; zy2j8g=6&FxOU(NlMc0>9zE5%v7R~7%!=m4Eda&U!?^PQoj_0nw>F*W8h{idiUsAne zICegV;iVY*2%jDe((E6@fEcF6FfE3GF${`fH0K5_>ksE%>*If63O~`CGdG5L zF_hqy^BBU+ForcTtc@WWLo5a-1~-Oy%sYW$XudBe5rf83VlZN`L{D-i?DIa3Y;qAD z^-bF6ov5(uh;|G&U-E9o(IFMX@)%ackd9$~3_JJbEMQm1usDW=G4MC|_rttv3rk{H z8pE;}y6?*=*~gp7)r9bt5V^mP=fkj4ie4qSTCniGoOME2)_VRD40?6m5W~h8HnD$L zVhpdym~M$-YYf|@+70?BhV3!zkYOTcZ5c)#_wS0~yVhB|B~Ol^x3%{1*5j+O|L*9$ zCggR&H)42G$XkNX_E9`cyc@%NF?`95I)?W}|4fik9|-v{hL42o&FCM;@QLt!8Rb(U zx3=*QUxClLaM}mH5Zo`AuT0=;aX6mwKM=z~;fDlykUbp35l%2}vt)J&x`AZQlfXxqf2S-K#QE?jyQ_VmQ5=oq-mSDIaWsviSscydcp{Frac@bE z>!(`8k?5!Rhn<$pB#y`9XeCjt<7gvfhs1u?PmwUmlW{y1$MbQ#5ckf6+r{w=FZ;yt zbR4()d7n5Tc8H^69M6hFr?~f)JnEe}lZHa3oK zarBT_J_Fo64u=0XsW2;IZ`Li2KH}DEPBz6k{S_6G{&5V5fv3V`v=1;)t{DGTDa5F`i=~e1zag!BK*v;}|1^({gMa<1(E0AST8!DULa! zOctCW_;SW)N*q%&e43Eyf(!e5530=+K1*=6VBVv5bA``~BP=8$NdIUYMGB~xAWa4> z4m}P-9QaI8GUMsQVG6ed?TnuHERZW^N-!-rKaK?%pPl8i77Je;#~L9^;#iuAT_$9C z94j))$~abKcwYV2#<5P6yocP@XJR)9(duMv7P2jl?LxK)ZjFOYV54@3N%CqOJ2U*1 zICcr&Ex1Q;aQFY7vU^SDDwDq%$6Imy7{`e?-j3rPZa8u56X$p1_)rLQeox5zf*-_j zM}_~Ms`@C7y&`^`@hq7ip9((^$3Y>V34Sj4h2Z`;z7+D6AoKrPh*sOn_D~$(#qoU{ zhebRh_>JIE!EXiW`OU-L^OhtG$Kv=w^y8V>kA3(lj-SQ+GmeuP{j`u%+;HTPLZ(&HA&!90_DE(-H0PA0VHsf+blQgL%s&R0=Kv`a0@!(>s{0T`}{!hgT8zT1G+#GoQKY?NiJeWZ0fUkH0_atzC0;Lluk-)uz)X()-M23cv+kw63X_5k%%0__rbB!PwrJeokG1fF0Yeh_G!KocP? z1lK$eq}Wt=Gr{J9bq6TwEfaVwfyWbQC1UFY+6Y-v*Gu(w?O<d&_014#r+JO6X+nkV@BzefEDnfo@LVx`<_eS`2=1N@kKVgWsp&M4&-H8 z`@1DT9F#zJA>=(0=$YZY66h`brHs-?NMFHz3G~nC1B47@eVY533BzDfh6oN#U|7a; z(g2khpdz(`BNG^vz~}_VBoI#^k-*pl#w9Qefk{HhCnPXY_*bj5XiiSx zWih7+PEFur(eq+wh&VTac?rx+U{(To`s@VeWO$wu7SE_4vyDhTjEZFxW;>*sfAs*R z$((;5t8od+uFI}>;%f!aU&eoSCj z0=pA3qO#F zJ($3u3_qN}5#iq?a5RB$6ZlTd9}@Up$gzy)&jS?$3t~8)i9P&j;6wsHB|y^VK;UPN zb?+?l(+T{-%`J)IN&K3?ZwU<5F-*tr37p~1prN6LvkCmcJxxO?4S#YCCU8E13kfW} zDoj{g`e-gNyK)w4z|8n{Xxt73nAy)-!3{s3G zzab|1%>?qqTRa?OJX;P@(2!393B!ArL-{lO4h=L52>Jy5f&syxhHN492?@y&>^w** z4Fxstt5|mm-mUTf6rNdFkfex^y9Cd?5G*RBn1DhsJ7SV{1g-+Wd6$E;gB^pJ*H zECQiw8kP)F4AnK%5MDE*yfH|9J4ijOp|*xP8p!K%>;|d&8tTayQQ=56(BK=ast;Dg zM>RBJ({$XUqp^l28n$TIs-dZdW*UZT7@?uLh87xL(C{KVU&CV>p3u-%!{ZuSX=tsX zjfQEzgxU>O;lXO_VD-^p_1$3g`(TxShP3g4s<$BZzU)a2{WT2Gu%mLY z^u_GRQ1w}h;JTq|poXEG{6oDW25A_qVTg3y;h~CwA~&UBns-W2V3-=IVU&iLhPZ~& z8pd$MHB8blR>L?A<26jsP_2@`_%JVF1Hm`W`;vzOFAY8kTEV!L=|#t=F(p!zvAH z#dEdb8V#q1tNl`2R`{lnbrMx%gxVlvqhON}UW;BFq0Y7qjvk?=jZoV(Y}as#IdB9u z?9}k7hR-y-qG6YY*EPJMVK--*hF95dTm=GO`p^<9JNcFCU<0I6?5$Xf(8yemhlXYOA{vk*0M_<*Es?|ufYjwaFsn8(! zv4&4H?}_=f#6Qt5|$UupPS!vSgIA#MmgvJML0 zJJM_KVGSS5_b#3NvMa9y+|uwHSDA(j8vfF7hVx&;d8x@A zZT#bpg#OU*`6zW|l=@Qx@tk1Kn!)e={=jH;QNtw-H#FSj@?^tDtA3-^WgZ122NwGH zXmv%yRSi=|t7{sri%!lc29hUE1y&ae>Z8^6LjKztvUG%WRR{3>Y zx#2r9TJ0XK?$A*{_l`T{#A{!L{vNFYI${liLD6%^sB9fX#^&l!ItuEzQ^#Wk{r~>t zYdA)=9is~AD6FHXj{8~$i%6=wb#IkT9HZ{iL1fy!Mf_BXN$iWqvwm9_D52wC9Sw9m zqN60!>ZqclsyM7&6)2@+-WYYij?y~H=y*WKzA>tjj>ThCSsfLGloKp3xND4J6n!d+ z=MQ64Wzk6}UKpcz`t+cVhyM0Gq@$XS>N;xZsH3CASXE%GBG%MVOU%JV{SOPNE!bRQ z>k6-@!@QAA=lWuH9jhAZcvMF#9j$dt9jg|NRgI*S#;o(X>?S&z>S(5;xsDb(t|GK^ z?0@4$(vsb%<8f*7Nzp$NY@_1|9Y2>2J*}gD!%+22S#5P(b^;7f3VBMfosNs$vnW2J zqrHv}Iy&m;rlY%#PC7cX=ZlBB2tF(Lyx?;>B2_|+dO^pFIsX;sQC8I=9^>5QXB`I`#|yQt&H5 zebRr|5DtiWFcWn|$2b4uaFk;=NihjCWcW^^z8CSBjvsU!7ruhkW4BLIKW0p(BHuMh zo#g7{7Rt@=SoSF$r*-@y{8t@+==f8|Z(=g`cOhp4&+7cry`so)PRFH;&v_vibo|BT zOkI3JlmGMlTVnqaT(cr;O*8-AtemS{wmPosxS^wnfx8Uc)bX#5{08nYa7)K+9a#oo z@YCn2?=QZmCws$}YUuse$Y*%FeOQzN27CsTfr5tD)qVrhUgpP4Rlq>dK(>L9fgA(5 z20sj~{*>_0%lz!Dx_!YrlO%3?Sxs&fx>NEjWZ;XJRbjysFY~LN>TUx?4U{r)zky-~ ziW|7cKna7Nxl}i9`zlZIYW36<)oY3xH$~lRpk1wCNx}OB`& zr>F-Ee%?-fxG_-H0P(;S_3ISH63+z=H-JGEm<@ z1GekB@7XaqtUxsb)eU|;0yPbcI_j$>_~KMW{;+}C2I@$=Sjl<@>Ixq<)vGf@da6nV z{X3_s9!-LC3Wpvw(8xd^1APrNHqeCiH}JH9rW}!Js)d1;2AUaY&Q8ekQ(>T4Vw!r) zz!O3qH_%E*YYynm>^8zl80gkk%qInDJ|&f@Jxx6$q=SKu20u@u+6%IJoeXp~(9OW; zX^P=l11}hO(ZF*Y=xOSC0~cqPiF$?O_DeIWGy%NnqNh}Qj)I{ zTrJ4lX3SLU46HY>$H1!wemVM zw*}cV?@I4^({h&jfXmjvX#>9)_{hLs14mg&10Ngsgu`c`UplbQz;A!}zBKTaflm#5 z#`=h|UvT0q^#$j^EJYuNKMH0ooTa`taL~ZkS?Yiwl>@UB@em6Va)kTX_0Tth#bzt= zYO~dM2F|te|7h^_W$JsuV}d^zI4-2?Y{jS(27Y3H8d!ZH^xACo#cXxbz$wm<+5hbZ zYi6roSvLdulei;^-wm8G@Rxy$2F`NH82FO~8GNCTsyIhAo8zTAZ(#gC+1Vxiop1Rn ztO{H(Kzw$Nx@6#Q?seSK+2_pUbl@@znxjTZsw)Pr8o0*wJ4Z2G7xGy;$UyV0Icmv@ zz`r~MaGpq?BkAq-hvulPB;SeQm77nLi^2;e;Y%WvL{1X^BmzkUlgOqrS3OfESbDCi zIadvwt73E2YA3LAEeO6SFo`=Q&q7HQPI}k1j?@Ts%JCDk ziuvzmhVxYEd8%j<`L_fv&sD@(>jL*AaXg71lPHnIy-Acz;=UxNB{4mTQc2vO#K0s5 zB~dzwGD&nxqI(i2%7h+BqGl4ck|>)*xukbNyL=Lrlc~q6jCXP$LA@URWo`u zArB_;kdXcoONZ)7)DXoG<>4f1C-GzwPbE<&iMmNNOQLxa^^&NcM8hN=rSl12gCts1 z4?H4#<&Z1}ic}gU(IkncNiI*B%tHZS25;@np7 z6ISnp@9aF)E{Uhv=lT3EB=L-pj!AS%qP=kH9oW@jMbcT6XOnnN2z3VP49^Rp+lxZF zB+)e!n-^8IfxlE(^+=-XnLy7Zda>bQ)jNs)Netj{C($Q~zB2B^!-`S;#DS!9SVhC$ zOxr1Ba1uk3n3BZQB!(t2j94o;A?clO3{N5)@{bliLU5$us3i7>y>q!S;y|CVNsJRd zUhstEKQW1-wStobCkxViIq6+gC;2C=i~|Aw?EQ>5=m%6VuEqOsu4vWJ&9xzrYJ^|{~YneJO@ie zngb)s5$+16l1K~5F65sQQAR{9OkzQ3UVBz8&uuL|xK+>->uStzA}`sXG2D2a*m&{&@eMmxaz2>Ekt7a>{D+8~rSJJ$yyv}FXGm1-KAc1S+a$hYhj8e_Su`2N z6Ugt`36flodVO2ta`vXEI-cMEV7|}^?luPkKPB;V5+{>5#myl%bR~(?Le3`fM-smX zr~a#u-*^;A;*4ZS@%^YG{+aRln=6{NjjHoWToCauK_;QwMZrtrK=U6lNiGXv-L58a zP55=eEYnMML-@@k{uOd7iQ7@-1tC|91z8+SuqOEg^9xe+nedw^W}>)>fQdiu3l=uL z+sY(C6WOAKOw2yxDLJNhK*<$UCJIXIoq~k~8A~_b94TUYw@dC4yxYXR4T42Y7*Bgq zbhyXFcoP#$lwcIeA>V5UeYIQrOPaXPL@5*Zn<#Cft%)a1lriyuiMl50nJCM;nW$i* zqKWdvn5rLBf7TCbVeiSb*0-{+)C*NIQQ1Tl6ID$GMzZ67pI!^F(f-j%?IOjI*b z-9-DCYWhR=keJ#QQ#DO|98NHi7ib$CbeoM__)NfIL2~% zdkqo2Wr5)KxZ>5YPwEH1jjN|jv@_AuL@yIhn|Q{=3npG<@BI>JZ}JYl%Ae!!V4|am zzvHTtiRU83^Q4=u}%S8l-)x#X zF!5%);HO-nhI-S)TPEH%@ecPE6CaqU^ljF=Tr59_-V;tjrR=v^ADZ~c#9ppAiKUnq zKH=z#vd_eTpS|l9OhWvOtMYWV)79 zL!A^to|y$$u!se9oG9{FZk{ef8BqR;fV10N^(@r4FxJ923k@thVxhBzXDu|e@Ti5B79O+E$UALe zR?k^@o~DHn>>>*^{}DAd~mQ+2a2ozMJO=q~0S$?6kZ^|WxzR=qe? z9M#iN)h`BKve1Y9c`?Ay*TP46;v2pJ7REFWU3Any3xg~SwlIWg9W_jF=>Omg_xkh9 zkrqZ-7|nzhHXQKfxavMv)pS)`S2e8=9PX+zjs4@f)mund&@4=}Fv-Gf3v(fNKhf$f5GEzGkJ;q2vF zNU3mMx2IH@l;S+lEn)*-4J;O1!kO0G+x?bXSYct6 zh1C}J-ppQUVR_2C&foYOpZ2YH+OvkGvKLH?_1u-CO#1SP_Rr>Z@rXw+<&2Y@QqgfeHK2o@R^0rEyUAmV_LO26F8ezcg$DC z=BqC()SRz+%vbv@5WlqWRbC&?_iA#Gn?JWB8%1m!=H_qVyoC!EzOiuB!YK=%-XDsm96%tnOPwuf24oPkE#J?m&*(lS>pJjWT zWXu9ZOqLB1^NW&arWPoljgXBT8+#Tgzm0&6pp9%XS?Hb{*#{RWM&;U2HvV0p=G+x3 zXyeQRRmjGj637{TD(R<5yvxSjHfq?YX``sk{R-7=Z#OG$;|~>lz(!dc_t+?5<6avj zZIrTczm5CoSu@0!Y!izwRBaZj(l#Ed87gCgoH}`46tgO4qoR#Ul5Ke#6@*Zqv`|&H zQN_lCOlzZRCW?enbjb6})Afa_x{a-O2RANMwQM|WqmGTbHuf!4KQ2`NE>yK`?}-}z zTCZoLzKsSp9$_UHsn5#=Fj-q0eQeCKG22F88~tpIwlT&=e;WgA47D-L z#y}f`Yz($B#Kv8V)yg`duUdp^E>^7;t3?llx-3@n7OUYlM%Wl>V-!nStln9y4ledO zgyGg=Rd|W_4A@v39V}gx|97K-M@<8P!-fxx;OH`jFYG2FXWE=0^^vzzP zUgo^293+`$W4etQHfGvLEm0ensD*w%*Us#Qp)bt9r%RMk%0I`(TpR91AAe!-G+>^M zn2orNFo!QIhaqAkDty85EcbZUkfVVFCwAeW&ZZp=Xzb6Ufp?Dv9y%H@M4xdqVA(jn zL@ltf(8jeT%H}M6Am|9Xf+@kY;C$A0scN}Yee-vyTjAhyOBHW&EwQoG#&#P!Y%H^} z+{Stv8*Hqw!4v*dOVvtt%Tl#@sp|1{XqAoC9IUTHYXsK{t`nqqX{p-C<{$9QUZyrI zQ=4q?7b3%EAzK8u3U1>LuuP3urgqwR#l|ihyKV2_zOZrd^JVH#S^pjzuiDsa<6|4I z*?65DZsR>0Z*V5tc$-s{9kooo#oU&wYRlE|8s51dkAqE?tB%W6yk78q8y|3r+W3ew z>TZAE`hGsC-gmj$O8-j!3V#1b%he}bdfc~d9I^2!mxGPZZG2(l>~a-ap&neJ_$zh4 zjSef+0UK9Ws4s1N#ksdaOG}B@x9Fx8x&ck9$TfpSn1{et2hr_BJH(%C{A_!dL`JVyCvBXv@q&XF z9dHUwS*1?f_{GMrHh!~lg|)KrJNHIzboPIjF-OT&&9gEPys-HvJ4*O@?)KtyArtkN zjfOQD4?cU)DKamQPH-gYSG<4p zI_M-OGh}YhNafo*=pZ5$_85_Qc6RWrgXbJPFFsUQVdld?-i6{%-u2HJKlr*j=;oli zgB}hn2eyNr4thD5?BHbwy&b&dV7P-34*EFg>tKL`fe!jn=Sp9#?pdw+J9uxE;!j8- zZ_6GoA8PcwZ;*q*4u-IcR;!_c!z2k!2Bsb9V3dP#4#qne%?hkmsnu$%gE3TAt1DlG zi0j02?yb-SN&B0a6CHfAT1|5B&iMeJD4XJ7s)KnB!Vac6nC@V zdp})U&wLbI#}ait%H<m00iu-m~NP6G!UnbyHB2b&xmIUU%_iB!bjWu4kAeYi!C<~9f0 z+4Jkv4mNY0+9{mXASb@FPIXxu_;#HldDX#d4&HL`wu9Fl@CG06uvA;G&aP8$ICxV6 zdCq!O>C51StYEA4s{4Ay-zo1o$Z_%N2KBy!4;*~x@CPH#I5^8HIr!MYZw`KUP`G&T z6YdO$e4nx=>(xH?+W{ZRXAVAR4?FnlMrgl-FWIyovdF)3@HN-FgKr%iaBz_0C5`gk z^nN$(y%9Pj=3xg**Q+Cf6!W6KbMU=`pCv0Q#~l11`7>LZ#~u9W;DjXqiIuz&+Pz+V zv0jm6ZSe4;gFo3_F5rTPm@ymF zInIg=ich4UcR;+rq8(gxa7oM?4sJU5+rd9#UUqQB!BydG$TcBMbzNFS!uk*y7E}rS z%h^@Mf+=ERnA3uAr%CvRCG~EcxAyV z8U3#f>OmI|xv1u%x{IbRm4Cea`CW`UcFyc zJn5pZi+(Pia?#Gk(=MKIaeIR*woygOhniIiKDAM`XSuHjy1D4!qWeb0(9uPw4DZZY zm*LO3cwYDm8RbP6U4(ZPOgHg+Ik@QIqNj_iZP44rOKb&EcBe5L6*}ei5tFersrPp= zz{PNmj*B6e0@_A3(8ZdK%Dm+pwLa52-xY!`D}ESevf<${5Ph31+6k6kvYunWCl@P%J}!7a+I9{SY9 zo{GUXm$Ex_z7iV0Y<#4z-FZ!Q? z=a}0TMK|KrEsB#l&%Eg3k_+NL9J{UF=>MG|bf9_J#T7}LXI^)4!$nRCxhdRq@vnikMg3JIb4F32=}UR*+Mhxo1(rz85KJLEg-{CL z)bK7_IYs@Evz|^=DHKehND6nQaHpiDURX#W$-m)NFWa6{%H5(D6=daaED8`O+#k3n z<=u^{l|qRW?oFX&3iqYpY*i1XP%4G{g;!3YbP8pJS4iQ36ee#~4CPWNE8@DXib)vC zi@8^L#S|)uc}&bI!mA3>^T8CZXHr!YvASRl!J2|RG|(1Zh4mu_Rqm=$hhHYxHL(=Y8E$=q;ps3O!QT!aUFWdWzCZkYvCZ^bw`6 z-~sU*Abdy)LsJ--@gJ1JVB!CW&#)ARr!XcHJ3`2)6h;c+pAne(=uE8Iu9|LFW5pcD zs&4mUQxE#<6%S5Kp>O`2vD?)o_DKpar!XajsVU4(VNMFuQkX8YZf44Rev(s^VTLGt zkaAXrP@J2>ycD7-#8O~XSfU~shrG1$6cQn%g@bwh-mkRN3yrDb&Z=~>M z3OvAF{~^2M4)sn7@22o+3ZJFW>`&i&DJ;L!&&L9rRSvzM!UrjQ$U-msK1yM43Lgt+ z6vHRMZ$XIf^@eH%eKfdj4gM1ilKby%_%(7DWDuu68xSGPX6b__tFoiXzeaBK5 zu|pk7;cyBYcBp945X~dp$~Z%&;ddcF3!Y5jln_RpPT?2fzh;y#cc?SM|489aCfuRUvXVO#ozID0wvhik_t>4P z(oRKAo#CQH{UdmZyRi`JGad?F&hRTKJi60!<}a_M4gJ09d;9av6#nJTna2HT++vCK zgI9kK-IvDg6tdFZmX0)38U@qHmqz|H?nt9R8o@NO)9|I?Pa}|qyHkza>22NbRtvoG zZ#K!Mohp<@!=nD2G;-74vE!|siss>+-jv`W?9Ma_rBOVMd(tSJMv*lB*{O=M2p%2M zxH}CV1(=G?)X8&RQN_|I`-*qyDUtRL2aGD22K9T>;2*E3vqU2GeES1?{|J;R?0@tX zRhmcV3ZXJ-^egOtKw4B*u$*9d!QtQeDyC5>jml|MNn>CdgVLy)#)D~eV&&6#D2-}q z)Jo&wG^(djBaNDAK877il@5LRrLX%dYU=ImH5Gz(qfqTM>ZDOOje2QB8wdILnfr=* z^%Ye=4W3~1JCprH8V%BTgq@SdqiH;r#^bzn|B7mqMw2v}3U4fU^%d1Djpk{zNTX#M zH1E0WV`#cFaCmQkNf^jmrSaLt>^4lh(-T{#!C1PHm)fOxgQ;yAPp0uy+Pm4*E{*m= zo=)Q#A$7#(>0PQr8XeQVUTJ)~DZqz|cux4$E;aN<_L*I(cN$mf`(H|<4@)6$=; za_8jieog%SIYv$V0|fK!R)fs3a)uc2gr=h1|r15eZQ#fRM0)MPK$RX@+|2{7*4)IakUawSlYbkZ(mAE7Mq& z#{V&O70_}N+xG6r$epA*?(RwiO$ZSP5Ht|n1uLNevhL zS@0LZW+S3+dA}Fok0OjN!Wf$L2z97o>d&HRu@=92|5b#)i|`NIwq5dH!BIsR!5*On zj!+cRy*omU9HIKRNscW-h4ZONMVQRdIzo*T94|OQaH8O`5o!u+T7>D+dR%HAH7_l> zVY1xl=$E?kNHv3#$w)O*aF!sK_0BEAJPuwR-1GbH!r1&GEa5OI0{H^Lg+*8-WU(OS zOzqE^DK0o%R)pn6SW$$P90Chs6Vq5#gw;jpnnt%Y*05k4$Z1@W#`1H8{JB|Ig!M(( zP=t+~B-2Qxv8f1~i*T|Cr;4zp2wRJAs0fFPu&oH&i?E{zJB!e4r0P0S-8WJl%_epg z;kA)!ADe5W+D+amzNZL#X+I;?ZzC1GB=bkA{WQEH9Ark~r39nY5l*BI( z)hLa|X|zxC>pz;L(KLroff~zI9vtv}tG+K$I_Sh)>&SMofjJHkW z=CSGmk+&0kOhP-RabX&lrg2#sf18K2}{UI+vvJ`dCHBbULN+>sU2tUSwTd z^UygB;^k@Zqyc;O zR^1`|PCl|1_SE&}Y*az@ao&JuTiR(|Afqak7*TOye1eRUExI-{(Z zCp#Y;2N;4?{|E~%Mm%;H3p#vE2Z zjU{O;rJZ+4%}ZmUkolaH4#XA+&K##I#^Z~GFJ`BANzu!;q5}69&@pB56-;eNVrv>J z`4hl-k^}QtY<(IVgsc%xF>V?s(zt7U^zeK#9X*XdEu8OL&ZP12cy%@%J$O^dGSf@70v*sJ%~E>wP)#8@ zbxP}~Ezk25R_7}q9fd3dvmT`4IubgPqVJE7qVN?^IUVJ7RM1gThte@>yrR=|@DBoY z=$K9=9mSk-68=r7qNA#gYC5XxsH>x%q*+5pO&zuLXu3}EAF&=4hA)Nc=$I|V>Rhaa>vUYNqq~kCI@^{J z{O+kon|-bpyhiX^!Cr!WC#V~A+{m`l@tBUcC#air+|CZwaWk{HBHmlaEjn%$-bc`# zpeU!it;EYVxl_lzI_}fuCqu{GLMXpS$mj{`ejN``XQHZIKlLDOqkigP!H0CLoS+gD zBa3=O$D=wLO;p_`s`nFd&M-`2@Wg0CA2&ht)6rkYi#i7BctXbj9Z%_aT1VSai6?c; zov66Xtoxb5pC+o!6V*T+gSmiel6pqRvpOnGQqSplUdIb!70oB9Ri{&w@azuqmvp?W z;}spRvH&|`{EznBB=ylG^~)qRb&~3Rw(#gA^@ff&nTw8jI^JSK>0HT%5gcVr;_tA7 z4#WoQ(O$E6b-btJeH|a@_)y2k6pFlXvieA}?*3B&)v}dRpRyB$zbre>KGX5JjxTh4 zspEGYfAA4h$JexT9f6K-bbPBLLp#y&osJ=Tbn0DN$M-sZU<>OgqVZ2w7fx0;PL5iV zq0b5#JXz^F3?0^F^|wfnoRESTBQl|S;)c(@(w-8GH5mI|f zbUYgWf{oO1O{e529iw%O(J@xXBps7=yu>y6Q`9&e<8|CLMNQB#QBr2&O|OXmXG+up zQ*=xf;cOk#*hEv*Oz}?FF+mh&=vXFXmL$R`?c1d06sI#qF=)Py1)Q=BlrykU$08kj zIKk>ztYZm{R>vwGOPPp{ z=Y&gAYjs>SRk^cM>zK~A7~Ogy8wBf2Rh#u_vCt0IeX80*gMYf*R>5s-XDJ>fbS&`O zJySbriak@i1b0g)z58_R*KtnAc^wCI9Mo|_$4L&r7D+A#J*49>`>sLah>l~-<+3>W zQ4ZeHk?^=k%C3!3e&1B}>{NA%iBDChCGqd4sxvy*XGZ-P3 zfqDii8mMHTvVkfF9y?RmVVb&fntE|-;l=TIRRc8)e#BH9@70WG)K@onuT6o`Fj><; zEdx(aQ?(7$kutnJEh;nJ&}pi^fd&Q|8fau-$(+QD+B3z$#w=>8#p*kT|Zr2V4#igwt}^%E6QK`Ey0~} z?G5nHdk4Xe1}-$vf4X{Sy82EIV@Tr1nQHY+^{j#C3_LFlb;m6AqJbBL zcb^s611E$*Ml>xj=oJI68hFpZ`vzC@;&lUW8hDF^oTc6pS8e)LRq-ZneW~-qF+HFhJ znxl$npS1ruimuh7SjK>9z&79*uncTnoY;Dz@TNJc)0`-7(H!;T9F^s8yCLox@C>Y& zqkIDa3vXcG97QkHE}5%tnyX%!tA-i)(ZFxCX9GVO7*3ls@GC1aSFN3^s?AeBb6m`e zqVVf&k9n%^JoV~4^@o8!4g6)`Z&q`j`f;9OrD*Njdd1J*keohG?VG1Y7#L~bl!4O* zMj04wV2^>l2F7qgn6J9cSCiP4lhjx?h!FDeLM8}K6l^(PO*Syaz*Ga%46HM--oSJN zGYl-|U^lq>8nbBs2Id=>ZQ$;*$vFn*3VCY2qWi3D@*N=yIQffw5j#TUL@N9>Uu~JM zmeK$WtTM3Lz;ZU4xRnOZiq11-lf_9&w3!;6UOs6;n?pfYxV3&Azm*_Liix;Sy7N~ukEf=alWOFN@bvBFl;VRLo%PKN$B9DrHbPgQ~+(Z8)ls zWZ?M7`ly!Sf_YqJU(gjbclKxw8)@k z2K6(bw}Bu@!web;Z(Jg2BBZHcGr{H=blgx#<&N`WtunYVgPSsFP2s#)n+)1!a6ty` zGPpd0E*Z4XphE_oGtp0BM;57b@?yaY1u48JgEi86gT%Io%BMrduD#j{oub}Nbi>d zQ1YOtkvxiy z7$}lwGI&0N7czJ@gXcuy^g=~P9XdvNQH12h5nmGT%Yv_D@M;FHWxx`?p21rgye<3< z!8ZkyixflO$>2R2hDhEOY`8u~`3D(%C|+_lMMF`h`SEq}CmDR2!Qc!&%OIVBp26pt z=vR2C;1?NuDdejReh|W-uQT{Y__rmJ?}QA=;QJEErHd3b`J-GUlH$00)of&- z7GAdSYX-lunkELD_&tL^H~>x5Gx28ze`T;SgH0LyoxwjD%+Fv!2LEO-B7uwc1NuJuEH^#4Kf(Vk+rMvw|^4jnae+kXBR1Yd0fLUi`1kH z)-6(e$ef(PluY!rNjFuNj?m$%V2#5By<~uv?^0>a|T;7*q6b6#>!w@ z20Jp?Nxm>qbBXG;L~Z9_S)%@Q6T33loxz?A_R`Le$6s2aK3$^BB~eCmm#9NaROO}W zKn4dhNSY`#aVUes8Jx`ER0dV9j31E!)pDsin!&LQj?+l?$LLOQTnsOu>+@{nPG@k2 z?Jy+KZENZ*Cx1@tCbrCrooADpC~cyQi7U$%z(gq%oy!(5DAzVIe}0TB87?bZP}T%7 zm=}2m)>d&7OR%{@eQGF8)Ox$ha z9uo~sG&0fML=O{B(m}q9AxrwgJR0|WWBpvdWBH?R_)*`ue znQBu)_=>pe?ikBNIc2`aIG{MuAuQu_; zay4jaf(=U(>Sf|O6StVSm1;X;*PFQ6M4MJAce%QO?QepF?j{o>gv?v6dYd3_TCR>S zS6o8b$HZ+WZfD6?s4myU?=*3TaMrX~a+e9pFW48m*Tj7$UN-THiTh1FV4}Z?CrmuZ z&NA_siM~u~h3dB=`ttj*iASX3kD7RGMbtt6DIvOex%BRF6a7s5xN%4SFzSw#>Uk3{n5er_y(svS z;2`$SN<|?Z$*auT#0Mrmq`6j4zD^6N6o1pi8z!DwsRpl%ipRB2Z<%=8#5*S5HKWyr z?-OO&;d|nx4uxE5_>qashS%yHSqm`>$5<&7r%jwOaYB+hY2uWL3hUH`>(uq@)Whr4bL-U59}{OyoHKFW zM1h6OIyHNpdMlk+w@w{jr(ofh^^rZ4vQXMW84LB+D>`OTVHMh`$b+mA+g_agtS?F$|hlSP_+F0mhp|gdy7A~N|26eH8 zi#Dis7RGc+U1*`bg$^R=XhlCj45A}p=tUwqa({WoxOxm=?8BJtFw1g}*i` zdiz><+`^LQm$ab?p$u5zP+@ux>dBwu3tc8ucZM0IKchF_|U>f(nO!IU=}_W z&izVk(!myftdi=nSrHSPRg=w%-zmPZ@TG;X*bb#r12?M=Hmh&WroN}nX7#Ow?<}M( z=q%(_$s4v84zV!3Zt{B>L>xyy2pMWcm$4QJPgX5w(DoL@91B^=IwQ?x3R;4;;Ox!H zwXkioI=NZ-7Cce@t!A>_iNeAyD&T^I5s2?r-#C~BJEDX2svxRXM#f8vGZhVTYoch2Dqk=4uZ0m7c)`R- zmP!cuC?R}VI)(;dfrPC`M>2u^I4?HQ!X##~EIN~LvK4LqU3@4pX^Wa-fiEAZIaR7N zY>S#lhx2bB|)E*1Oy@I{BsRI@cT7b=s`H4do4s&E}Q)fA&Zc|4r9Jg?S{UY9Dg7=L{ zGU%j*Qx;B(#2;R;{DXpUcmd^fXGF+K&Df^SSs!+BRc@cCXrq#i z+BWLg_-VVUY@@o3-aYoncw_BI;ZXkw$KjaD|A+W7S5#GW0h%1+hHhP^{I7i=L&@8lh- z)lS8On4T+}YHfqqMzF1o3xrT|?M~IfMn@Z+ZCq|+{o2B=`w|!0xX4EDZHbF*Tq@)e zK}u-7#LH}SveAF1`f#TrT00dFz3F1(_nqnr8(nRz+Nrt;_7LnYcwncZ{7Rb5u83T1 z;~E>++ql8TwKjU$_-<74I#za<>bWbr8|eOB>g8Q3*rjf?ag&W(ZS=7*YL~j%hF><0 z-Kw{ZTciQE>{4`W!`p1|w61%0t5xYx#98}n@3 zXXAbwU)%V`#sfAUw0X7wUS==bc-Y3XY$Y3y*m%^&GdBL+qyA&#pWW(d#{EP+W}~l- z$8GepF@QF+N6p%;`b&A9U@>;9uf{|_>xXu$Cv7}sqs1Q8eUG|hk9uN{dUKB&XoE-v zK8W%_x#w-XVB_$a*dW@>?9_{PbRH4s#>b~5zxpoGO;2pzqh7J`s*QJTyvO;USu`(v z-NqXMa`cUUlK#=>NjoHr}zLKNNI>_?OMb2R1&l@wtt2HIg6N z(W1&vg?}XYv5ilJFqCr_&vF@TM<=@QCycKhcumO{Qb8US_@x~k82A-iY_B5umfdF~ zuo2oAV&i)ohK-DkA8dTFSLy7*XA5$B)leG~_NpSmv<*rY>{WaAsy6$S$tu%yZ8$dA zxqbF2o|*IZzUbSExlc{mr?NI&4z7(UPmshHvSy#k*~r@%V`Hq1VJxtXUv2!x23Z{A zF-Ir&sh>E;_p9MHezx(8aJD=hkHGq!HPYg}_p1>${;=_1%NvHfa-jfplU*_do&8b`F8F*wD> z)DpfuSMU%|`O6hBh&Yp3@S>vqs>g!ZoBP!)+R1)3+r}IrV43dTL4R{pVi_p3vD?NT8}kn+3bzYh`k#WP%M<%qD$y)B7zI^3s1DmWV&jyJ(>9LUIA-I7 zjgxlt28mlOIviBTZQh@#`W#gK4=Nsn(ySoGmD^`nP8+2ilySfX5+58?=Qt=Xk3Z8Q zdEQ2W12`ZrCCIkT9gM~uUy^fs9lvpxb)t{mF$ZxW%gQgBTI=Ik5 zGY8F`XgAs5;fWRwS~}4xmr_Sm<}f$57q)WH+Cdu!Z5_0CF#oW+z`=7|jx|ZObMVjM zs2#|O9VB$;VMU#b99-<+5(k&E7)KPhA@tZ?$iGn!v`SvzF?Dr3)$@qz?BH?-M;#n< z(8a+O4vsj{R_LyRRht*`O>Z{`-5vCBa3!tO!6FA&Iq2!&O?H!ms~ue9;86$vad54J zUJf2~qQ%MAIk?`zZ4PdCa05d}$8L7e+rfJ|sLI_Trzqczcs(4US( zFX-O45*v?1HM+yWolMZdy$W`!9bq8;V zcZMX$C~rG>$3fn~FbD5Cc+bJN4!&aw4nA=3xq~kpe8|>t@QH&@rENcUKv&$hyccG$ zB>0&iGukRCpB4Pl!PgGD9aCS4e&b_`4-(&$X!bd#hB)}%f$6|<@B~UfY4=z;obB+4#03>%bKq9Fu;~h+JFw?;-2NNAkaxm4wG*;ob zn(SZ-2m6Vrv=ff2jUAHAoyks@TxQTnj{nyJyPk;1YzOl=HXY1yFxLS)_qMVrBGp*^ z;(lKsaqm8%7IWfqu-m~N2TL6+lNxQ4&RWhvS30$twLYO%I9Mr!d=<-iLXoU-u-3sk zPG}r`C)E}Q8yswOu*tz@cA~8AW_flL*pllWMDEP5GB6)pp5Zhoro-B>i0u zawnto*+hG#{0C%=>~pYR;&S{lI%{-LLJv7OEM)pgMIpb6a>3zo2PZh?W>GPVlMYVN zsu#uzvN$ajTo_NC{?j{ZFVWRw%}W(GH7BSyaxVXBM3Lst~i$E440JRLi2e@V5N^E2Obt z%`9pOsV!JPi#kH;3NmiJEDoMj#qZ@BWYMrh-iT?QisVg1(lm=^Su_{kszj$n7A=cI zMYFZ=HYK6c&!;ZPqFom4MRIY8yh9cpOZbICF3RE_N#T+b`K4K0mPIG=cFy8*Auoy! ziHb<*z-O>Kvv@U&*Rr@Pi@RB) zEbh(XnJk{oMqiHZ%SH!_@p!BIvv`2*RwenM;1gLql*Pls9}(;;_-GdY5kk$!vb?J| zPD1y17X3=({j=C{N>MnVMDnDNrv#tQVxW*KKZ)Y949{hwwfbD5MtnYt7qWOUi$Phu zl>P6D`jAuNK~s=bu!PuII3<#77H$cDv{tzwi!h5{v-pi^ zX7O~T6#p)<)03xFK8s--)Tb5Qk6HXAe7NAxf&)*hU$V%G!tYsBS({j##gZ)k$l}i| z{$lfHF+I!kmJ|O7j?Q9?kbkonA!MZBs4VEHwzYO@Y!>5$PZk`X#Y7l~j79So+ ztyvpAN;@hr$6iWi(>CelD-iGbY$T*6 z3s8)u+(@Cc8&!mHV=m$@E_2bzMZ!hWm5pby3YlyECe~iyDkVwOY}$CAY|3 zeJ1*SujS%Y>3D6?uOoQR8CB0keHRzjiZ^i4pjoQ1@P>ko1bImlQ)uF%sf%VT@WI%i zGpcjvRC5`FHpWt@MmcX5>)Eg0x2c(vd)g4YW65~RX)E^a!jNN#X(Be{#4T|DUG zAs4+}@OI;S1aEP1tB^h}?r?FZi`&F|yCBtgbxzr20m)q=xw}Mu&%@>J6@FiddoVn3+?1wHsa^bkhy7<_|CoX<)G1SGUOq`9p zF!h~_&s==YUtt$ti{uNzFI_A<8|{@oElBc>i*F^U^0`R9Y;TG<#6`z*>U)vXd&fCd zRKiUcX%{*RAo_-jj06>lclbG8LYD*1Op3VhgJvTj4g)HqNV!F2?Uo&}|ZOZQp{ew2DQE-JBH%7H)H~opa84wL@^1 zi=AR`l(1ApdiS{4E6V#^ZU`+n=wiQ%11?6LS4@G(Ij!TWf*RVi?7j2yB zUZ6c#pcTAZu9OF2Y2xVul9-3Mhw>hjhlGcZ3N#)gob>QVfyR>46?!~OHJZ}P3Gx&U z^34SrSF`i{v7TUkL4H_l4XvSvMjpCC+j^kzE@(|XH1lw-Vtno4L~{=< zJY3+RorjhlUWC@#LmLmR#POyAO6b~35QXFvwinXD19`C~7079X*CkRHdC_004Z{)_ zd$@!R0*&rc50?q&S>^Oz&YF6-!NZLnuJEF}FuHo^=3y2z8qWuE=jK*u-97a1aHTZh zRUWSPaE*ta>^MY?+_IE*t%qJ7uJdp`<)yT{OGWZGN@-l0%f(>dmD2t!rQPJ=W)HV| z=;NU`^F@4HDUDy3cu>YI9@b4s%rB)KEv2POM{ygL*6#3dr-%1FeBj|O4|jVQ=;0X; z_jtJ1!{Z+MdAQHR{TvP#ruuq#z{B@lQk@xHi$Cb$At~*{L=TU7c!X9Y5^g7_V-|F? z*Ax^BA56x1CVagg68$|q;b8zZOKUt0=JnFr(9+tI9=P>}S57?TMORTgEx0LJ@T`aD zJiO`QEf3Foc)`Q#9^UXUva~i=it!@T(c*(VyyW3!53hK5)x&Edq?~&w#vDp)Dy{MO z3wlqL*0_0xrK(m&d)vc19^Uov9_^uwc5NAr+pbx>eq}TsdX_Gu{aHr)kk;%o&Q2n2l(ba$5h?>HsNdl=^7M-M-F*xWA3SC`L~)wuD0IOCSpW|Y;=mDPAU-_Krj zM&B=jzY6|UR{O)lpB^TAnBw6t4}W_Y>tP%R$mv*(n09$g`^Uq-9!9WtSg)8iT5yyg ze;OzmBbHK4yEE<00lF?qjZpd7QUBtoAV9!vYUWJS^oP^{~jpVp{SKiM^|mW#gK* zEmb3~wT^3-$F*f1mUHI!uu>ZBrnvTSTswm#7iDo_=b*U8or!Bato5+V!)}fv59>Yb z@UWA8Em1yfliKQGqX+Il*~EtRuthk%gN#VXS$b$(+s0mtYug3c0=4HPJA{cb@u)TS zc-YJN)(3p-^RVCJ*LEE9aKOVs$%0!W*T%I&9*%e@=7(7%iA!Zlj(a#kdt0r}dRTKR zb<)FW&K|T(+WFc7zD1;voP!Kdx$uSmbA{Ruh1ze0S~nJ;O0v6;9&BMtJ>D(FEtAs=tIACLIp*KJ-<_$b@cM}L-cdF(Mk zl72q=`gmNt`zl0-_E#yVQU1w+f+s}SLA+dP`IL{ReGFuM%V~YfX|I;kp7D7_g?hoq zv(i&+z~`8Lzxeaw9sE|g7kv!!VVBch^1)TyByB{LaS^w)2@7 zcNf|{qr>*U_wj>|p+3y=+RXCW*7Dk)<)abDGd*;vsX+@@TJz6T#*e1uo0VqL29#zA z+JcWN&Gq5=s67mIhQap{`1n1CKXM3tZtcVaIXsv{-p4Q&DZsY@e)RDZ$6bJ?0fy5g ze607e!N)H?e)TcR$7mnFF%cgle2nC9IFz7uvBm!2I31+^6#Pr@Zy)~%`B$*-xs1ael5_c6iek>J?ZPfhkQ#m6M!^w#E9o zjg7M?M&9HL(2>mWG1JE^PW}u%lUm?o4kv%Ml@_OW9w#xSeWjwOl=&j8GdNisv{1Z@ z1Q)Zpl(tf7rnHa^ZX7k(A;v6Hh3yM9Pwn~&{2c8Ke)X_OFm``F{-sE=cQbPLR0!GnVP zeC!uO`2mhZO(UT@B1URp0pH|SgC;~zBI<%DFV-+;=vH@ZNY6hqkARb`af><&D`;_B7L9>Y^NeTm` z0+b7)%F?@Kc)dcM0CfY@6J9?+10j?ztEe>;P7 zjv~BLycY$ySiF}AQs=r^iOT|X3eY*g=qv2DmA}y#ekEaB~oS z##&cNkLlJRIPa0IvpkB*3Eq1_pSB(F5$R6z?D4i2#oU=qujG1^Wp$ ztgO*dXMlJ~o?`zB?rd zEx_vmJ`V6nfHwlX8Q}c@ABe(R?5qIq26$V%J4OG!lGJ)t(W+L7O88-kgeCt-_}e1? zRQP8BJ{K~$B=;`@e91nlq7~QlD+&Et@cSy-)GATMzY8!Vz|SFm3Gsb^A80BeI)@k< zpeVq>0EYsk1Ly(91sET|2#^U72FL|416TpP06uFfXKe1NqS*nmM+zOmYyelt7eRRn z>r~a+Rn-Dc^-FkLM&in-S55UxhqW zRnx`&TUF!kR9eCxoFA%bU8-q+(sHV4e+m8_;2$BB{3~RH;K%@@O5~%3j1e45+uK%1 z0xS!_YuAn(j(**i2Urnc zWq^&Kbn_Jjr?mI33^&yD|hqjH|Al<%BP-L4J-lRy`WsB*ao7N{6_( zh87P|Cgi0UC|^U1g;-HtBcWpuT`_0q12wegYiOwu<-%yPtxo+g`k~>)qZL9Z;hG?Y zEt)02shFx5qEZMFy2>G{l<=w{stNz3hQ=VThBl)|vQ~)NA)1D07NSmwx*@KvsWk~v zFGPLn*VH=H)T$5RRUK#)Vr-3wHw<|>m%4>_M}}BgL!*$${UZZvYRyBm2+=-_eoEe` zsST^CwG8o8?RcvYtwXd4(Kd`4pekZQ)zW&^(yk71x?_qP10Sjt)#92E*M`w{m|lX{3DV15csGW)Da0)yZVkb6 z(RsA{mn~8^hj^iu)?1L*i1eXC{p8468ZUdgEyUnj+UYF{_sLK!^uJY}i-$P>6>^JRB+N$=x=P~21EWt*e6_DqOpLp;yIhj=bT<=Wa^ zwY6_*YnRlHUQpy~YrH##n*1>RQpn3$@Lh-@AzlgbYKRX)d>G=j5U)#nz7c{qr||fC z>hpfUTNWqY4DnWow?n)WVn%K4y%6t*cvqCELkW@BsusJCLVO(JQ?^xzjkUE;SnIfU zq_)<{jwYzjLVPX}`_|FEpl#IA=)MW@Wr(jrTvI1X>gy1#W=EwZep@1B(D&@D5OxTM z^M8n<5EdJ}S~5+O=oP=aaf){V@PcVQgb^ac60VQ!TpxS6j%G@ZpViTZ)zK!_(Xt`j z5cv?pLR?xu<%Qt+AxG+He#kp$_#ajanf{_!PB;m@6ejCxuTM$+$k9|+`$>>wxR9Su zr+y9b8z+Pu%H;5Sh(AJX3b8rFpCPZC!MqUjL;M}$pAZv5ObqdFh!G)1g%}-jA1=7m z=c|1wzFC^rCR#|=xvn;bL!hq4+Kmm-yRPodfGGfw2vjqa#paOc7|z+cU6ehG)T4;2kFw}{+|&;}a6qH<3hXL4T3_G1H$+pf#z5X+%m4()S@=a9&u zb`EuNNaj$OgO)>u98x*VXrPtPLFG^`hd1JhH?EWbD&|s<~+5B_Z}|sJ*zau!czPYpB)CfmlnBp>=bpmqVi*8s|_y zhXy&czA)7=hmRUY@6x%z-fF1*(okF2P-~Jy(_FLxp=Azx8*0f$TC*IQ=g>k@Zrw=h z(@5L!VU**mjkH#|X!~dD9NOg2R`|D#G)gYWp_p{Yp<@ocbGRjk3v;+Ahih`UHiwII zxFm-wbGRypk&U#ujkHU1xGWd_N$-?HmmIFhp|f}|7o?nj`ZhMwy5`V52a;}rBrFMe z4=EnK?W)Fas}Sc>jh;DFYOGx?*s8JCD~IcH*wi4^eq7@ET(nb$rx?+DLk>6Qa1%?| zSi3ogryEBJl9PPgSi3ccJ~`Zx!<{)EJ(svGhud?}<#gQkk{{}{iR^{3wC`vnn-yH!9zK`oWm=*=um=(S(qFi75*P4mBYXs z9?PL`4v&j)fM7pC>h~A&MDD+56g*iXe@cii2NXOb`~|^hbG)EdJtz3QU~~+^;@FEh z3=)Nx1Sw%$o(S=34t5Ss4zEd>UuO@>K^br4@MaEgz^=kS4W)|3(+I`MH1pXBgm4qxT)X%2&P_(BvuhJrc10?J{S@E--KP<$jQ&lerehRxv@cIA@TuM)~2 zy5EFTAzH4G!(XgRJ~1_qzjOE}hshk>x#(+e-zM6>Y^5gA+rkkX5p39nF}hJgMhlL~ zVQdcLgpU`TAZW)5s5vo*N#f;qLwcujFmiy<;B%Os1MePPki$YwIMN90(3#Q#vjk`7 zFh>aGbA`;yVSb6kX`=CLt3|o!^~K>Hsl_=g$zdsrJtsxCTF5fN<$@~&R|>8YoZUoQ zBZT^Eg{;eAeTig44pd;!<{Y+guE^t-JhtYrjZ;>h*RgT)0(S7nG>@`*?95?T4(D?y z$YVEC$l*{9hdIYK)%J44HPt#c)%NAEKZgT3SjS>?E04tv3g^31dXMCAeN*jh4*c4C zG>2n39M9ndXVe_daNIT3PIAbvkDU@;{MP+{g_OMBR69qrY^wd%R6`!6@+h4LkEiBK za(+#i*ED*2u)nERrkNJYBc4aaJSydp$Rn9YVIHY`^vqwQnRZb#?XOm;BiF>s<-vC~ z<@30!S!A5=G}BZbL@kdBLdf~+Q#p?+dDLVhG}FEl&8m6)+)S&MkA?$X^*m|_UnZew zuGPw;U30CrU>ymnD@b93JR0V4aUPfC(I}6`d9=x+Z5~bXXv*s3(L9fy&9!@)Yfm=U zerT@o@70{&nRG*gGo|#GhOS(0WK6!kd$2WQ0mdEXR-sOiE z^SC3AJM(xXk4M>SdEA}HLwP)$hiaX?Cl4MN!cU_2=5b#h_p`K{V-E^GAV_b&mKu>> zZbPfSHMP7+@+%f5kH_+OJdb{P^kvtVifgU3wd)dpw$zrk)cWV~L>_Op(gx-+AP?SA z{#mEwllka)y*911r`Ub1w5P?}rlk&^U(8H z(^@lVqC&_sk`W0V)8y5YT`ou^+GyE4+&nyvf;Q1NAbxlD^Z1cjoQZvUZ9K>$%p;e_ z#0mvn+i3YbhDkaPx6$ZjI*(qS{3(y&9EmiB%agwd{>lz&qtQE5@Q*zH%wrUXc^-dp z^3UTR_6z&*Ol(veZDAX&N?UD&B)h~-^k}P%6yCmVl>V4J#^y0DkMW!s%fz{M<(9S@ z?-7_lQ)#R5HF}K;wAb2d6WIcJkW9{FN*>v^k#LjXv^=KgF(Z$eoT-MP%&=(L;Vd>( z9{V_bol&#%JnaW_h0hb*EI2=p1$itKz9P9mhdSZ#|0Z57-mxLt6E;7-9^g1ZIx2r?a} zus@Guc^nshAdiDWC_g0Ra2`iWs&iB%tlEhZopVA?3ZBa2bcy_okh6j;;dvni(wGp8 z+Gp5*n~Qms9foql{#&WoFvN!;A!^BCNC}}%;s5BfB;|)e4TCle6^5b8FjN(_|D)gzve`}9O?DGdu{Q)M0xF<_ z3W$I-QLub>pP2voedo-%=gysHW@o2mvpeOUAPQ#fGr27!-b}p|38H8a#YDMJkT#hh zre8d3St^LqK^zO=cnJ3g-H8VkgQz5=j9}Ry$_Xhi=uW2$qC%F_zH$&%f_OWKcY>%I zM71Dh1~Ds$2ZN{{bRRId!Cj3YY6j6Ih^|3-BUD4x3Zixpb%LlH1kXh17(~4w>Icz0 zh!#OK2x9WbzRfjMBc@!=-!O>zHPp^>{yiV~8VAuNh^9dpmpsja*jvNx3;YzdtA;uz zyk!urf@mGY#Tu$z5X1KQ+6ce1rfMr!FHuvq528;^HL0fR5X8os>i3$eQxKh*=li^s z3%hR>?yse~1<^f-;X#ZDqDK%tC2s#9dIixth<-shwN(3Bs!tFjYpK2x8oUsAtd@GI zmO4~Rm8-1=1kt#*8W_Z&ASTsTgM(O6TfI_S4GChX*bftA5FIZ%GKf(@ObKFY5Tkj; zQfh1v1g>v5HAK14I&nFAL9ep@^9l^zmfM+5HAOLUM*e?A{2xc#CEBg z*GcLszQcJXLH52Edk-esADuqlN1g6_llg&=+n;{6~#2;##aJ__P+5J!UeIEZ}p z6x|m=d?Nf)!Oyb#=d4iS#l>uYRzD!*OO8=O4hix>lu3OR#L*y51@WDT$Ab7e=)Ndp z&~Z^t<@bLhgvz%;oCxBtQeL`~Lb&Y%_3wlDDTtrN><7WqL7ZW-`TajiMUXVCr_S<@ ze({i>%ZlXZ#q1ZsQT5ctATF`hh45GimxK5%hzCNb5W$x5FhkEL-dg^cHFyyZ0`zMHh zgUAU1A>0|lT_Ja@yCVeJY?I|?CF{F{%kk>hccXj6pj&+AQAruMWK1sZ22xICizBy!q zYqF$72qi=AQpz$RaLs9{5K43K7yk83_XW;y$t`)=5Xyy6Uape41+F@zLB$X%h0rgA z{vlLm*`CO05<=4us)SHAglZu?7(%@e>W5H01eQ{b5Nd|N0;H=ILhTUhgitqxSL-W= zGQqcn9FZLI*4VroNC7qqp`qLeS6^ldt+9BSjb+XtW5DGLI^riL&rgh33F&~YIQ5i%@<;X;N=vP-!J zIfRiRj0$0N2wVfpO35t$97BT;G9~|T1Gk{)c+v48Opv$}Lzo=G6kb=n41H0|*qq2& zR?|b65yFxXmWD7hgjpdhkf7Ni%n4y$2=hajn~lr1%2+8$;oAmo)pX~2@DLV>&MYlv zn`FJ;%*!-XE=}bMO)l767Q*rnR)nyUO(o>L|h-jhHU6YUi4%R4K}k2gz#AipNFu8 zc?iJ{@$_?S4dM9^q9Jf)mYxa>S9}9jW_^BWb7|Q=aJkXHSclU8z3SoZ;2SWIgUxMb!I;dcr$L5dy?UJVsBRMOzn;MY)C!@U}EH3T%=t>Nc`{`?vW zXn6Kl1Az*HG|uRiHB`~iSVI#H zRW(%8P+wv_sG+)sy25K{sHvg0hC12&*V4cYFim2H^SVs4UiOOQbPY5#6s3{o&h(=_ zv8je;BDT}eTu3Votu?gJcz}poVwt>UNE;1p|0m6iNQ3qoZXeCz?R3=8NkeB1T{O(s zus}ms4c#=1(J)p+cMUywX$^xkl)9PQQ$sK2T*K9d>e`mPJ{r(S>3?|oYv@aRe*0*f z*H7bKWbO~g(R;iD7`>4@ZV%QlM8il8qcjX+(^Y6sbLz1Ydk*QeKkZksga^1 zDR?HA-&IFz__C4uRZheit@rFf>G%+be<1 zYy%p$Xn0P;Rt-VT-Bjv%4KE0Jo!vpm%Nkx0vQ5KFLb$IKE!Q?yuWHz?;WZISC}x7l z-_Wo_!%i0d`Mg~c#Lzc|Fk*&;#H(ot3!$Z+HJ~y7Px0|4sv)Mi=gr00A2p;jnBt{k z2}x*3W))k=D~(lJ!)|G2pJ>>l;Vt$=@xCqizTi6=_6m7d!+S!U#{WGzWXK2EP&Uht zgnz7o#`MyCD&#W_pJx>Y?bmQX!!ZrVHTT@TNnZrMWZ}2>9@N~UH0TZqIjrG`kgu}( zQ6Y0q;j$=qhVh$*D;n+yyAiL7_=h0v zuL-#>ctgYQLT(EBn`eO;kPET$=o@ zF!G7+3BwzPFATqU?-9%uED%OONPfYWr?@+`=Y^rf+og%RTgWiEP(k5^1Zh?{jH#mE z7e>)A&znZRIEsZ)JdE#je6OQK7$w7K7Dn?hN`>7IPjr>TC@uVc!7^FBtdMeo<->R& zt5*Eg`i9>x5A^tMj{6{VZ=F zq@iG=Fd7SK5=K)Y8=ELPCf*{9mSGGIV@MdS!e|{vw=lYg!LN9Qd%62^v|;F%p0Kx(eCV#C@2jw?`N~<%-;AqgUA7W{~Uk(oGawe(x~)g#YUW zeZ%ON<^6>W5F8lBpsfDXV&Bj(hJ{f0 z3buqW9$^!0s#fxjq<^uCWxNlIPVb{(JSIVF!k`&L8I&=5T*wn))M)CCSIwKMo=w%V z9|KRZb%n7mjP+quKkj)hjICj82xDUy&xElljAz5{YEZ7?2yIoZP@)*b%F&L@HT6vPKI%c160`E6M$a2!Ohg^FwTT=C5)?K{20bh%vcz|hQax7 zKZkLiB#g6RoD+q!<5-(ShEgPs+lh-|E+=tqE(U$}hthGkj(a$U>nN$CppHU1it702 zcA&5zNf90Q3Xe8Z^wQlY-Vd9pVnT`w{+$girQ?1bWptGOpU|?x8MnNSa>B#geDpq$ z)$eJpD(R@KYbKO0B z_U-1Xg^q`tt5=(=mO6;fZS%F!(N;%09qn~@e>^rqmBn! zs7^XM>*yl9n_yQ#zQSc_hWFIbOUGaxLv-}k(MQKX9fNetYoVTKp`vGV`|9YYyNhk< z`U@GLgG+9CR%xh(`?Z>X8BVlNLv;+(FS4jvIv(Lgh1ZnOhON}&%zP_#xRtvK z^$8tobv(&d)JmVGdL8tV(EE&zO*)=s0qVHiN_~DZcQbGH4-b!T z;Ml_X%$o7&1kw1rC-V{T5m~28vQirX>VP}8NJxun(n!Kq+ zygOPe#@(%BkB(y;TAABlJny$wZ?W&3_Pnj*9UXghyvt6i<6|96^F3O&Rv!qyuj71c zMK9flI!d*1$tOBK)$xUn{W?C=@wr&;6YS7NjccP8iy3jNkOMltl+a!!eFudc5@b?` zbsQ1?mEh5=uD4M)|IOv-U%>rjTzm@x~4o-}rJE7x18%4rluF#~6Hoa3lspq7F2I)338Yv3*e7j*opBgX&?x1I3Y z%0(TQ*g`n2>bS1shK?(|)9hlmt87lndrk068%6%Rj(^+v{t~>Y;}0Ew3coGLpj#X* zzsn)XAj#hn^iRe>aKo{jI}F_0%75;ldk*sV_Xd7zqw*Q>7$|6SYX!7V@YdmGTB25Q7SWFJ<-0 z2C9ofn<@sX3a@71K?8PMckLJ*gKA`Lm~3qWbqtI%Fy2621N98FHqgdEeFMk7$!TDq zAv4(|u&=FZWPr!JH{m6Ydm0<=V|*8RIB#m8nc=QzZZ6odox6Uyh47XJS_wJb))m_t zXlG!kfnf&P8|YwQfPsMqk0|wZG|-2QM0q|yPcwO4+A~L+e@&w z;06hD+Nr*hPCvo^f*X$cm@=!3XRq*Z?Lo{ut3J<5H-zQ?hAR$u-p5ae!+DR@{38sE zG;pqpe-xt|7{l@xF9}7uv+Wce$pixv4XiM*(!eAGlMO61u!y(d3ru0o+q<*ErW%-L zV7lS1zMLyaGQ+@31GB_CTX2q`ue~bS-d%u6H&2xLf(uw9qR(%ywzOA^nYiPB$oTIJ zz9mAI8d#Q9mK)gB-kmM8%D}@0RvUQ4aJw+~iRGIO&d?t9cP^&{eB53gZ?D!Ec-%m@ z2)ak`gn_jNE*tpGz>@}^V((y52A(#s&cMq|-@tkU8w_kQ@SK5-a*Glsh; zo^BJbmF3SG_@%v~*u8_=YM^_8fTx<<4WE~+zF^=*A=?bRWMFm&H_ux-sNEgZs|L0k zc+J4;atS`2-hIZ$6NTO|u)l-a$x87Ae(RuiFsmIDzj|LO6{ykHA2bl+r44*yKr;|F zkT$T}fNr>(fluzJ)^}8ffrx>qftZ0LyM{FEI7a{jmVqK2727$H4Tdj86QWe_sK~o@ zRE~iZTg7eh(O zm7mH-25$Lsc0o%W*gXN;0xY0+qr?S4ZPb?9T5D=z?TLN z8aO20!v>BB;U(yP>8R*veAK|dLXH_I*2xvWG4QQ{?~MP}nw{X#l;tOd@WJW-R-%1x z;0JMhd~z428K}`oJ<&;Vy2wuke&+bkZq8&m;0rk?c-}z2PHIjk^{aSka8byW+X3=R z1~TM|fvX&2Bgh}YH3QcTgv*Oe2yw2)$L;njc0tF(-i=cG`Z6Z(++#Nx+2p){!o(Kv?P&$J9BPbL>;Rp_Q zRwW|1H{zc3L{~I|BEs*>Do=D)#j?D31TS?~G-Iri61S8fkL)ZHaTo1A5J80q$_l5q zoRIQ@b-SpZXL2h>+!j?if=WWFzn(*}N(5CSAg}Sd``Ln6J%XuS)Yn~9vj}QLP&0yB z5!8;LVFZns|N4PC5!8#|;V!Cf#NFDRv555}Xb{1sE^0>?x3!nL(|z;bID)1T>=vbo zT$KE`u{p%%5wwWlvINnxWdyCnpm0|=dfN!vMbIUJt`RhG@)~zltM~icN6@pY>LA!L zf=)uHbQZ$#lWU{+Pj*!ycev)P7=Df7Wb7UcjkxcYrfH*vY5v<~<`_gP=1fwFj9l>7_jE-PT1VIfc* zU|j_3BX~4|$0Aspjk_iSUg8PyJ|4kGl9LPB{5%=KQxQBZp@D9SE|bp@f^DKaD#|Mnyc&TKK_r6h5xf>bDB|vo z@OlJq2-y|E4j~jDcp5t+cr)_f{s|d{7!(7Bl54`l5$MdxArD1jG=dnrVFVvU+^x*w z5xgD2I}w;{Icysdq`RpUtGJ+-2f8IAup@9H__963nJJP!CTVEY57Gr zx1FEsrbzZia94Ll@m)!T@4@&G@?HeRySq=eAF_}m7;@TkfZZ*ElNAG>N3bt~6C3eK z1dRS^1fQ{!c6XENO_W6Ti{;erN}c!dxnsfw7$nS!0 zcUOPNEpS7*Kc&oXMclpSxW(Mx5&Xk;(%SEh;@=2zqWGx0@(3b|JEOQu_#J}$#?8=t zQT(qr!Zaot%#9)-B)?z*L57w-mZPG$JBoXvC>X`usQX8|_g(o5MbRsY-cb~e z;@&8VL~&mfwWFvLMN!&BQ7MYbQ527&L=@$sC?9pV6euZpe-x#JlomYN-Cd_&CW^9A zcYgq`yXO*nUk~*_6cxmPA`OTY#Y+Qv>8eCgT@>=FLaIeku?KslYd}J*!DI`mnxfQ_ zP>OYvRv*RXCGn#O}g*r#*!9WLA5+ zx6>zzzEO;bVq_HkqPTR~Ggy$Me-s0R4-_0EIEgLrvS&!vW~h*1g2S^0qoNoc#gr(f zMlmLev8;ut`!{D=Pj#TDs@Y48i(4t8iq%o>`RU_~&?lmJB#OO11|AiB zEQ&QkHk9{Md_0P;ehiST8P@pKgHqF5ir2G;3*4>#E+GL&xXP9Gf!9|*Z+ zUyDAfe;@U16kDQrC5l(0;L^+D*L}}LVcp0*eIa*i6wgQTLKNgL3ce(`EsFVl6vdab zgkGMa&YrcMdFZ2FV+wuL>w<3x?hvHdu&94m6u~IcQS4?XjY5ke7DYUYa1=V-rab;B z`?inzt&cKzBUAF|B2h$zS6=5TclA|m`l?Y)116J=A`wM03Qqn{36j`C9KoS|-E{#x z*Kbc0Z$=G;@n;mb zqWCz9Pog*%#rY^cjpDN?zKi1fC_ay3UliZ4K|bK!e2@2wD7aAWSQPuCI1t5`QC#k; z4n=X8`H2Gk6urbFylB+@wK~dn(ogZ%imrM;)w-YJZ`ScBzLshwGBwuPx6FJ_;Dq2w zL3&RKnbA-E5XGbY+=)Z6e(H1-XC&^AQT!Ce&rxja=cYhM<*Wo{_%H09QCyAUS`@oJ z%=?w?t+@AM)ZH(RyTAWzfs(b zx}Refjm!B%2suCH-;Uz1DEu+x#_)F(|3u-9!5727EWJDZJUY30f0YvhVt8?N-W`H> z3EmmQp$)E>PrM$%OZ^m;N)^2A`YZ05$Qud7kUxe(F%*trRDU(+Yxm5r0x{&ppklb2 zcp#6iU<~&N=e(4RLUL~mEB5AbCzGZ9Rgsvxkc95O7>Z_ju^99_{1i*ZP%4IYF|?1N zbPV^$P&0;FF_ej6-(e4zng5mcmyMxZ4CQ0)u}zg@s3PQn7%B*R40U2?8gpkp8_a4kRX66Io>MP|`Y|+!;e-B)f1H~LX&6JJm^&s= zY%B`-SN+|xY8Jz_`vc8m_@%#U5kt!uTE);hhL87qsI-w-G^4j|mft-#346|aG z9mBEffle{^9PK3-*YiXAHfB_h#+HFgk`lG4ze0pNRY{ zJ3NN|Sw0|!fiVmc@8B4Q3K=3;e}Fr0hi=&act^xAQoPhNW@E%VQE+Sw6vxFdK86V~ z{9nWjnItxo1*eE56PYGnlIcQb#4t0fv>%{m4N#m<^;t1L$EbNR%#Y!n81}}nAclo8 ztc~Hx7#4Bxk6|^7D29hP_{Xp+hKFPBer0@`xsORXMO$e^*Hz9xfouO z8sEwc4^-QPKOe&j;(akA4s@H48#+)CU(SjQ-5$ehF(hJ0vKzMXz8=HDfhr!u8!_x) z$=~hY8G{x>IEFW4*cC%iMCzd!xV;RM{l9%?bP0;aUjg7XxMt zM2p@3Qh;Q@37;KJVo1lZn>}TqqI;VqEc`7&rk2r3-i_hC7~W@RiMi{D z`A?RUb}9@~Z3d|iWB8JFTHgN=y9wLmAoWQMpT_W+@Dknqbf3%R-Z<~sCxi)p5yO7r z2Lxvha*OUD2ecRt$8aQu^X!8$d=L2a508UG2DpZ z_ZTi`Ew8eUgkKR{JxDP+-L)8)_;nF?ig+`ITjKpg@J~Tnej%Z^#h%`OMCWeBj(_9GF;Stpmn&p_ad2zn+&BVp42ffC9QorY5O+62=1u~6 zvJW!PmE&r3_LsZkxF_zuiT&zFA3q-yjH6H-h2yw4j>d5`iK9py_r*~zj`DF7<>a3@ zIFC2qV8z!6#pAd*NR_5>rQ8yNB?U{x-9}6C{y55r4ZU<_MW^^c92Mg3@t`Y)sEW*a zX>UViKF{qRV|JOC8%l~vj@9dV9`~NqedJx<9L3sdUvq;OY~|(RL3D| z^bl1?(yt#!T_N=Zsq@ke;%FF0BT?wh5C%1kqgfoC;^@qLUiWY*aq~D@#NCs)TgK5g zj&^ahilcS>zf-x}NDvR{ra_fD{`PTnV211X={lXy?I@gt-WP_bF1(RAdc>g(QC;Kc zCRhJxi27lO>KVuVw(s7dYH%FAg!dMt*hfg;IQnIk{z3-CF)*tP67u&D#T0lu!{Qho z$FVq$$1x&~kqq4zI2y;OI7Y`2iz6P#7+yV&RdGBV$GAAgvs76-1=R$G{uAKF7t`XH zD4gC&LM97NiDPP3e{iUp9>*JT>|l$EBP9Ax!CiuH#_{nuH%gCL1&A6& zNtw66JZDnVg&1)}ghT~940E$>#$m-_$KkL^6!h5w}I^6NO- z+~@s4Zt9yjzGZusKLRJ>7@+x1#?f+n-l;gg6NB#sH_N@Bj^j++eGdOIj$1;068t%i zvvHh@>iF>pBqTJ?v;^jY@;wDO%*lgli6D3WQGO@_SViToJ+;5_riS8!Km?&$a zsflJL%9$u{qPB@TCLZ8Vm5FL59%TB%RYemuhpQ?kDw*yN$A@QfE1MvaS2f+|=OOZ( z*=@M0E(W=O2Wl{i@LDG5cqRyqiFHlXGttmQBNL;BtNNz92@n6#uN|%$nAkpCk#JXp z#-{uF)E=&yNFt0|y{Esqi54b0nCNJtrHN0!$!TSxwTTt8@+Kb7OBeCBG11<{+{>P} z604oyvEgo?`b)5riOwdvnCNPPn<{YI?Ghv0&>ADupb_ro?Wd3B^e-i^t43x{!OUE=n9ic9cP{l{8dLz{^ z6T?l6Ffr0ZkCAG|NVR&TdVZwhCX=y|>XD+}=kE89VRRESP0TVe&ct{VlTA!9@$?N3 z&zs|CkqIUyn*V)`og~-dcT7&^xj0f48l|S1m}X)+GsYSm#@0AVAQF+`6iBE^~@cm7MNJbxcgmBe8|KS6KhO7Zepp4M@Fd<`Mr;t zSY~25%Um+B(!?qguZ~iCdLflZD~4_~@r-yk{g1eXO~u4#CO$W@)x`5A-ZI_C z;1^81Xd+@FYGRv-mrMjrgiO55GBokJi8q*Y)1B8!w_V5_nK%2I@Ohjl*hKAMp@s3L ziJe(X+ECy1KQ@|h!$eq!{{LHM>|-VpSv_vT%yLW8XM#x+wh2e{w29rUGR_OlhGsHD zvpremZ4>X9;77x~Y$|u=|Ioy{;-&JQiTAVo19q9wiXv@3GV!q(lYheQBb*bt>D_1I z3lkSjTr#oW!~qj0*g;HuY2u)Xqb81-IAr3mi6bm|6NNYB^&YLB9<8pP@x3ux?H=v6 zHy#ah+{D)=zA^DF(;2O}AtzrxTp6vnx7ZzHROvB_dup9B@tujYCeE4o-oy_kPMbKx ze178@I7abzVcrSjAiBrRg|=-C^NQ z3qA{e3wK$_XTf8^Yq_iTnDXY|1NK<;$ymi>vwj?_mi*?)wGgn7-$DTkx5lb_$EojI z1;(BC6grr9DJMUtw6z(hl!d!3++(4jg$@=vS}0_pu!RRLRJU-ig(4R2vryE+LN5!wEv%oKGtj~ymU%&c9}9h1t*nCM?vGl33j-|o zXK~VaMMpC5xUXtK|6mdK9`~&}?i*%dxP{Rc##rDH=d70z63SDsM_TS#*rRw~$2=rs zEsV3k<}}U1cncH6Y@&rf#w(ui;-8@UPH-so zqMN8l9u@Cng7rjs;kM_ifcFUtYb|hD@sk#w;Vn#5Pg!`{!a5N*SlGy7XX5Ac=x9b) z;}y`6(0CIct0dO5QVvvDEL$x+Z{Y&r2VWQ$5U&AZ=^@)l3p*@#C;3k%DqodAk16?gT6oh!xQ{N=*xuv4ANRd4$TIoJ z!p9aqVJEUM^D95U5%V?R(+2~;PgI|=qT9MX@%~9_|KoXISlDmjM+-k$IAGyR3n$oq zEF9#`RtPNb;a@gM9kOuP!VxO$%ND-2aMXhJ9FDQqOj0Bjfr1I-7jFT&fm@ zS)r^_G=aidey@-s3EY=e?wH~l7fYbHC?y0-3TA@tPoPW!EfZ*!K-mP!CD1&9773J3 z-~q`V*QN4hON9g;OrUzgJ%O}h0+oc2R~AwwfvO2qOSngrW{wu+!Jst~?yT%O3DixX zrf_;|B~V*9Pr{?;tMR9sTKWE$Wj}6X0{g)C8s_ zFe`!C2~1C5MglVhA1xSod#a)%p`$)W4CW>m_FS@ z;=MLiS+8MP0xJ_(#dg)fyF7sv3Gj6gZ*$GOy!AhM3Qbdd^IvD0dW4B5@MZ$L5_l|u zH3>YQzzYdHPWuGbC$J%bwM^$b&*Ew7_&xq7rAXUPQ%@!EG%IeJTXgG$jGU%gR|#xn zpPHt&B=8Ig{F_*z_xU$WQ=6I8H1%u(F^TdVulu5Js~`yzc`<=)32aZ`wFF*D;L0>r zXi6S8=_)>5z0A9qu3iy*Rgm`X{?F_PNAq~n++S@1ZzQlI0TQ~MLTD3AAe6wK1l~$O zOCX#;lo?=4o~~LP^UZJR*AuweFklEqp|Ukw7xx z9t>o&AF;0;_mMjZq(mg=$iG|kjPiB@?2$R}fditG zGpOs?+}Lz=e7d^!y6;E=U$JK;!J}G_CUA@cND}3fI4<4x`viXAcqMVa;Sh1iZ6V(# za6%M%PbP3mc!yCr-(|(qERY1eN%)fZF#&GP-TI>EX2P8i{!;=!CvaByIkv_GE+=q4 zfnP+qkif4A)SBT=sm+<8E@pZ68R|FIcmg-XjGmg6VsuL>t| zZxXpl1d_03sQgK&B<9alH)f~;N#rF_e5UF@QxPfNE#7+s3knuWA|jzhlJ1x25=nPp zxsNE`Vzd#$pbIk<9Z5;Cp;@UUN@w}~Ldpo172Nto&I3tQNTPNUb&{x<1Uq%LB=Q~h zR7$#gcT^VKeko8TiKn71MiB?IpPNGc` z9YkkP+a%fxZ{E$OZBwR?1CTm_~iF*S*4NlZ^7Jxd*(rS4jhH^<^Cl|266-0F4jWmXcilh~fb zYe~#W;OMVd@_kO+0eB~@D#Jh1)oUb*I9~Qp1H<| zPl*kevXZY$V!e1bB(YJ*(aSm1Gq_ol7n9hQ#Is3kNrH!?J(tARB%YU`n#Ek>$&cj` zUl1kVYDIZ?HCZdm>3hlZdgc&Q^&el0xEwrl2Ke45hPKk4fxK!Vxi*4PrVO zGmSnTQ0P z5d12MV?r3~s1WYXbUcZ#**4_ZMC#up@hz`-JGat%c|+#!kI zDacrN*~lmS$$Wl#eK!0y3fd@S8} z^Fwgg!=A!6F3(n6A$zZlA~x=`QPg%9%+i$-Qp`s2tWv^8$t?HHQKfBu-*k=3*eEZg zY&NuRI|~;Mo$|L+Nf@$j*YrDYS^f0qn3@@ zw!0DH&^e0#_eb6KaHRtioIOXi&gZRXqrQ#yHaghun8}9Sz{V4ER6`q$cy$|1Y_zn| z%0^Qgu{o-_U^5%vdcAa1T8Kh2c(=c`jW*(KXM;9$Z3P)hV|qzC+BnU-o~t_B=p^o+ zIqp+U!?~)94PsZpZZ^6L=`>eS>}8|3jR7_W+UR4WuZ?~-`r8;cS4HNkFXpQ4cYD#; z{Re$xt|~fD4YD!V#&8=WY`lLqa4~nDRXLigmtsznhG-QSr9`NAlcC z-YN6cC>uoTW0|;(kPXeocpDRJJZj@H8xw6zvN6ZTTpL_jIoZZk8`Es}FX|M*?mUd( zif_7&*{q#&9`YGBh%;@>5<Y+JQUZ%~v~_pGY2;#Acoq$tmu#5tNAJj1{(_+t_d8fDOY&#KyZe-m?+4@lRp@9+qS; zf6PYQhH1l+1XDH=Hj*p{@iN&Z;z;Nm_Nn=bByD52SZ0i=yhZyHe!91Xykldpkar)> zPw{s|AFz@}oO*L*c)zWRs_Ob8d4es21w-4~Y4f{8B>6+g zpMtk+JhDL1G3CFd>*aIcaqtg^g0%l%L6RKD^+NCt!8;w?C4~BvwBPH%=imVc6&&~- z;W7pV!0RAmQM98`6%dXaj5k*ek(vPeDX zxVwB*7bL0Spr-Iz4r&YeaFL>8P(26r9kg)J(m?|U4IRAL!rz=tsHC?`Iq$cNR3itC z9WLNPQ^y^1nmNE?b$O8@(o0;O&;8Y)E3{a(a?qM_FZ;SKR&5-#b=(tPa?1vOFB53z zfJn2B4mvql|!<3!7K-} z9lXC-Es&C&|2rgoq1Z6Dw13FK5(hh(0S8MRcjx5i9QV|lWe%1* zSm9u$gJ+1J_*SuU9jp_+TJUiPPdIqQ!K31ROmL0hKZ}(crAA<_c*&n~@T73hLvB!c zt^#9Y>*8{{^}MKrZggCoO7n-*CLx;zpJiWQr{J>6E-GWNm6tB=ecr(fY*)g!Ie5vz zxQ7(=mqmHi!FC6)2tS-Zhx%*6N!}3hx`TH|<;psxhJ$w;>}7Xw5Ov@MaMqh{1zP+_-eDm#B9gyyxH}2Oo>^`+^?`()hz{3e%UUPaJ&e zV4s68MEuOb=R#QH%+eZ3lbp%!7oC|gm#8lt9CUC)7i zgMS^|a&VhDS*rdP{40xY&X+1Wni1*ENx8R^F}NdzJ5#tTg?uS^Qmz4YhSE6W$o(ng zrcj-sDR*!Sq);q{;wj`$p+E|GDYRayo>{62rl5r1ElBa66s9ayB!yBaoWi{lohcMe zp-2k%rLadr%Pwo%c7XA_`luMy}3gjgPOQldch5J(|BVOudQ<%3*kF8>9=z$9|+V+p>_(d zFH?0=sGCBky?NxsdLok4&x(ywXq>{36o&F2E2}K!zHVxoatAcNziO63^AuX7uy>ha zD{9R)vrM&2p_LGF-Zf`ZwMn@LF}D?LC)i%FLkb;*bQ0_=NXsrMbWNdK3f)ugK2CiE zdkFRv>?O#c-YIM!lS9{6lzu7nPhmhdbWjQdg=hA6qW$2kmuGnole-w6a{qL5E4dLV zj7(uv3Zqk4pTdR|#;`V-L+-bk!nhR1r!X^xSt(3NVIu2Yf*3l9QI2>fr~X@dY{~lK zsoBtJLZ+uMBdgG0b_#P+SS(Q(cWw#`Qdr0u7n}K#AXDZPoy^9Yi$u@xhyEvYX$s3y zSf0WPNos8hD}_9g!lPogN+Lcie6=92{#Z7JCnR)@cpuM(X7c}}1U;3#?$ar(%W@iQ z6#ilg+fsNYg-zn!Ecm?Ovw~aL4TbPtwx+Pz@2}T?&RpfC6kbljNFkEKD=EC1 z!j2SnvQ8z|8)C^QuZj2dYzb#d=1mcIr4Y>KoO&qBH3`u}KFKPbn|nV`VIPO1Tb^Snd?7jy zmO3P4e+mbLd@0CS2UB1aCUrRFon8Ht4-eCK2&QsANU^wKfPbqT#8_`BfEto<9y)vXk6r|?$_ zf3rrG%f8mjRjCzWBBJdOKA zFPaAJORsb{rNx#wpN#cF9h$jt9X-fmP+qedDvSq^DD(#|{hkdLD)-!|7yqfQ!6rSWtc zbr~^@;c1LWqkh`m;fMc^c&K87G#aMSD2>KxbV;LY8e4O`P10zQM$0ssrqL{oiv@Bh zHkY6!9`DrxIjw}ZO{1NV)`D#WE0*@txP2NO)955h2f@cGd#V2=Np(&my;9NJEsgGJ z{)0pRG>0 zVomXmOuJtVCZ#c%ttE}oX^dg>NMl?Y7d2G&jxr&v=OhEf-uWxJ)pU2>Hr1R;BUGD)lhyJq_yQtJw@5^pnv0sMyoH zMsoYOAhZ31khN(%nN_&c=DIZ2r*SxqBOCy)1vaD+Ps3z)<0aDAl*Z;XcBK(a<5@OE zDbkk(pZkAQeFu~jMYQ&Q3cIsAI3+;^6cb`V1px&F%$PA^z<>cWC@4lyQOO`V=bUp6 z+tazH(~yIpf`MQ_Q52CN=>PTIx9`0FoI3Y>b?erxs#~|JXR52KgpMaI#n@7elPE2} zIGwo7iq90gV?rtD9urGJ_sD;yCYNH0h)pfUj8e=j#k5jPFU1e6wghIJB?8noyA)JH z4#SSii{_QLQt6kiKwbXRF|6#VW|eAh$q_@nQH zzqb^HJ(IJKzAsHqM%p9vNDsA7Qpuw)KDm5)p>A)hLqqAJrx7R zN;IUk|0$)C$Wx4brQu8sM~l*yhRPbMXt-WOGYwTWRMSvHLro25X*gTMIU1^KTux6_ zKdZP$PsQ(f=Wj3Mu8fYOQd_2{&ed?9h9(-CYN(|pKcp|zFko)xd=1*Ek_$9kGch%~ zry{;c!^IkEYv5r@3|DEmL_-}7muk37LtQO7e~IC84Oa+W+%t(fLJ6)E=H8y_Y7O-? z)GwF6jzwt6K}-#V@>tP^8X9TIDW(k93OFuG8jC=^Ug}8SOy{YoKewcK19Ec>Ei^o< z;W-UAXt+_s!x~z%3p7+}q3+bM`q#|O8g9{WtA^V&Oln%xl12AY1PlbXQ@)qFLnx!f zcWJm=L#JNq9u4;kAih^aE5Y}bbNJB^`44Cy=Rpk*37;Pjk;yN|A7Lqb3zzp&k7{^~ z-Fij(aScxiAZ{bz387C4?b%B`EugK?XM|4bm25J6UPC(#pK0i>B}e(az=AZqso_Np zFKKvL!z&tI)$p2zsFzCjP6jOhTanhSP^rC!4jLK=^M-Dj*EPJMp(Ab8EyHay3GOFA86>J;axVNx0>5qnY~rp-s(LKr0;9!AyHn+xu>_P*hgL1M}4H> zV-25Z_>{ewR(JH_S=>e4G(6KMsSGcCe5a4%&Y97DR1Xb3H7sFAtWNdP&|AYy4YM@# z(a=}JC=H`E^phblK*K-{{W%zS6n?IOci9Y|oZ^=VgES1*FigX64hI%gJ3U0hPf?3}bjLdMXqEbC;2^dt>aG)!g1zA2cj;itMq)G$rMbPY2!EFTO;DbE|~d7w1u_$!NMYstP- zhIsVyr5v6TyE$w1Q{S+c z+h@KN`km14g_5~P!w)|d66`17+-Tw-6F;(>IM8%FuH$D72Q;+QlYK9&=Pw!tWidF5 zUo{-m@EfZ{|IgyaEDmu>;ry9Jl`Q_$aF{cyhGX;%j)J=r*R9)69pU_ZtnhE41iN@} z)9;0Cz9_u4pE}OcHTgl!IIVy3s-A^jFtr zaa|TyWpQ;D^|Gj+MZ+u_WpPaw4TKWB(O>nFPzJ~+AfL>}Sv1Y!dcjSEGPRk2=2^55 zB@`p`f9XwG+?>TdS=^h&Em_=}#cf%%%wj@+#rvtvIT>#MzMb}|p_cYfzEa^)Gk4I8 z`_gv`y(^2m1(cmd(<+PmvKWxXz%1_1;(;u>W|I%o9?asQEZ)pw{^#o9ELvyLjt0+y z=il-W-AA%`G>gZwcw9Ko3T>0c69TsOR}^D-GK;5#L;Q3WZ3RCgl!xV#`5eoV=oz0U zQ6A*`ViqrD(Mgz$zD(!I;0nqkTzv zoG+X3Ru-M5EyQnU@lH8@H;ebm@%vePAh?TA?eiq#hgp1-#mDsIA5x!X(Op2dEItwN zsnBQUq{i5)ZGiS`%TD~sM)^by>7Pa(7S72Hqg&d(K@%=NiM%ToF4!QNWOVREy{pkSpQx-pGae%W^ zhk{=??QEL7c451mJ zO6Zw7D(k2sn4g|8Q0y!nXY05^M_nC1oR-v+hr6Dmqq>e7I%?|BtE*sux`d@{OPwq9 zJRP+JoG5u zbTrg)wT^l^>g%|Mbf9{Epn7AV`f#8cIxvys{vU20Sk0ZEIw}lOH|V%l$8|ay>u92b z{ANO%>bPFV17omwpgQmG5(XwU*U>_UKQPHoKIx4*ZqjkHo;?0;6MBn|TLsh@loZ!` zkm@Ahc0D<7^9~(%>bOhr147BXTgN?u?-klg=zT)(7s~5tD8}%hj)#Qvu+Y{*$$v!0 zqk^5;Nhxh~Ji%@%taPq{Cv`lf<3$}W>3CX4TRqu8`^=#8cwNUEI^NgufsT$k zI_Y>*$6Go^)lZKYq-GCFK7Hcms~vjg(zTh+da{?}ZBiYjgVeh^-V+Xu#z0ON9bI*N zqT^F4>8$9_-wskAifupAkr}K$7Tir}ox$pc!RqQ=so@u>hX<=3I(q6Dq+_s-UOIZ~ z=&$2*GS4k)KUke}UU45CeRa?+8Ttuep=}OkW(-z5x_nNPRAaObo`*KBdhr-N*&junV|6f0?Un2k7%wstgfjZ| zU^Pj{WIcHsJB0&Q$4p8}>NFkGbsV}t{WUo8BGOrU^1^hEj=3T~TPOt>D8Lu2^CTm| zLLCjdh(x_VX*-I)m^4zIe)wAIG|&Nj+Jb?j!?%cy1kAytiPUoY|`rV z;@8hj>RhU$^$^u*h&sUi|2nc9&N>Vojt-Xj~u<7m=aTd~I-ZUVIu>V&whG;-W0Qc*I<^RyFhntx z!4|Mh$9Ca=Ezuo1cIx<2$5%S`>dBMtYaP3Ee9PbJI(F;HN50>PxsDD|#B3(P_d51) zhAHQh$#CXSwNE(vIk`#3GCphtwfj@3qVyLhXSG-dCe&UbXb(^Naq{afGJWn0{=iB0a{*pT1{6892eg zTSuMJ(PL=R(f>$gPU=u{CgHz2{?k!l00xQ-qzs&9pys<7h6(~sH!yyvVzi=xLIX<# zuM=8qpu|8W5lffnI`mHFTS+}bIE*syA48KLLfadp&oofkKotX34OBBw-N4R9#b*g6 zI9tG|P6g)}$qq?!NEvESm66PlWz6#o)G~0sfeQ?rXUbZTfr||EG|vT z1D6=6W8f|WcN@6Wz-0z*GH|nj%Zgi1&$Y7Y2Yd;i~J)eO6nW9 zMxreYG%(Q6!1V@({aeV;$iQ_58XMSGQgE#>i-)Nu<*7{t)E%ZMdG|2YOrp(&&i=RX zxnb%JKXZeD8x0UJuyx$-c#DBM4e%<%TMgW1p#Lz{Qs^B9ZZ8L9^4l@evJ(RDF>tSe z`wZOA$}C9LZ&K8XrZ}y5)-V+eQ}+$aJT)-$fRSu@dQe(jd~Nz60}mS@Xf?lp^iczk z8FtMCZ}KMhmUx@MjCz{rv~m;fjH{ zqk&Ea-ZIeHz?;$q%u9JDl>y?i@Q#6Z4ZLTd*>J@`f%gr3AW`xeC9}(Lb$^p&I{MJS zM+QDNFmbr*X5do;pBeaso-;o6h2-sSpof97Z?7o-Wc%b)a7KF@=tKWEu+%_bw#dMA z12bqP1D{jgz*qwV3=E{>jYzzGkb%JlMsSRbP`?gWL+Go`(!&i5HNfaFp#)?y5KwHS zfl(qqT4?HP=8^z9F4wV7}l51{MogD3qy-IABLA0tSL*29_Jx zOSd<$!oW%cn+=fz!#iw4D6znS`_m_QfAq~xyV3fl={-ZS1fTuVbf9S z6(`vvU7c^izE3?oN{y>u^sRyK41CY#)8|L2QKJ;!bg!Z0(ZXt#RDP7=Zqoe*elT#l zi3(i*;b`KVY~UXQKhstQ4jK4^U{rFO!@=g6U+5SH4jTB)K#kGrcj-hHO3Xm;r-A09 z)e#P&(dw|I{w4HbN&VZvQ3KAFWLfo?f#Z_IC`0$r>ZE~F2L3hhA3Z-zjTx=7bxM|w zRvSkv-sn+aV$Wy=GZ`|c2_+~RqbiyxG*Q(=H4{Z9QYOwYkukwfn2Sx^H%9Rj@)8qi z6ZOWZO8Btz-tF-a>v9iyt4ASFJ_#Mvg!F;U&bh%w3Ybj=vm z>*AssCcYe_R?JG(7^@DCQ8i7Fo@*x8kr31}alVNQOk8MUqtx~y6BnE4ZK98f+9obB z@qmd3&E(~59TQDWTyNr16PKB|+{6_o8klHkqOOT6S!WaVO)68h%Nm^{2;+5!B%Ys-6C20`e|Nhp|Oj~*QzV=t< zITO#DXm6r}iFRzeiI+{hV&X*+V3wEIUMYpbG$ymZDkgf3r3jy`rr7Hy-Z1f|Br)32 zL?^-h#;Ii@wtigF9dC(RW_icNyCyy|@iE&qHT9kdzb|I_d7S#dL>Ic&c-7U!hZK{( zqlW9pCuK2vH<9mQ;uE?en?GKCW}>?&r?ws<#^(1FG0OKclWXoLj8}b4^fNKj#4Hp2 zO?+-*x``Pk2ACLVVw8!|CI*=pY+|V7WpV5gT5O0!`L1f1iQ)8iiH;P?5?MD&t{AVz zm>6qA%{euA`gq6u1(Jzg{+$uijl1HpnWnW+M%nP9J-FRA3WlpF0& z%*AXIb4=JK920X*%rmjf#B#|p-^3yli%l$$C`(_+0Wv|c6!!ZP6H7V#C#Y5vlJ28U zf)yrKnpkV1)Wio9)GEoinhlq7*KjcIDp(>|Gm({4(}d39a7GbFhhc&(;%M4ZUQf%! zZ-QMDp2)8=ku%{7&eIzws(=H3f{Fx(GH_TK_G!%V-dHu8m>8t7n_~Ufo7f;_k;9R) z$;4(8TTE=_Od<-mnb=M{bKW!Y1qa1MwZp_tP9RgzR@(TbiLXuU65+2nflN#Mf47Nm zOnfIyM!QZ_Lno?l+1FC^fF{W^f?=0|{KwI1;{_W97GPnkg>4p2vv9hFhb^?WP{Be)3(CTo778sC zSx8wZwvw&p$6m{D(ekE^nG!3xNtTP2{;w&%e@R=YWF;?U&JaqFvCw5=l2qA36$=kq zc*sIk3$?5ak0UrXNma9OmW8t|oMWM>h3hR;w@|~vWfm^CP}9P>7A~@Iv4!)JT)6k& z^aU19wkvpQdy3(F3#8R1DbfoqTuFtKRBd6_v2dw{OIYU@3R;Q)0maJlUSXlGg=;J{ zu+T^JTxsDd3s+mHXQ93n@rmSODswRqG_=sj!gUrJOA*%!-8)GwoRm0T6G^2c0ht8N zEHt-p8?9uag@qd|++^Wq$;E2iD1fzMxJB~bTHZ8r%IbN$g*zNvSdVe|o-{zmQHCa{Q`Nnl8D{k%MQA>|lc+|pUEVous zdkY;bJTAD6g(n0&Y2jH5&#_PoPg~ILENUzKXDqzFAj5N#Z~+?VX%_GTgF#<|S6Xpwi10?7!2iZZ3M&!fW&gNqr+zOqtg$ykTL2g^3nATIgh< zuZ4aV-n8(Rh4(FdV4<^>+$`{((6=qTBjEYT$xQ+83a&i^oh8~uqU3*Sp{s=tEqp{5 z`YugQHwzz^rw-kga6Xaf^2zEm3*9aBu<%{6>Sdv~g`SeMUv!d5;XdVgk55+pEqpG~ z5f%=9ml?p(A<=;r1_>B!VTgqdQ&iy;MZoMGrl?`;>#1tEMDLoK=wujaVU&f@!W?5^ zoB;C23Roy&;{_X2)g%j(EiAXN!on0`&bBbe!r`fEs)cD5rdyc7u`^B0EZ4&d%qqvN zrm5n;O6FRaXJI}E$X_L_)dC9(MPP~0MHY@tODeWlqDuuYwXjU0ZKo$mjIOk>ihXLq zvB0wjS6e7$*Ne;=3k#;JwH#0?5gv0>QPzTP!Jt8=s}s|OBYaah7H5VTiKJ_Rsj-E; z1@0+(IG{C$c#kQOu_3cte4U^SlCo9ztO^>EkOAB9d+Noajg@qkfvb~vjr*OFH__c*ytdfO)tmH7;-BxmO z28Yi#7QUscSomHB+Fus-SZF^}{b=DQ&H#cL-DhEcIsQQam)U=oEWcU!-NFIEzgYOy zN|rtj(wBro%+Y#?_Po59;SXUF{3+mYd6Y5?M=bm;9O9$wI}67pN+rZ(auZ|sKhh^H zoMKN|_>Z%kjcYjn+klO8ZJcN0G#jVesAS^|8#QO6f{m1oVjC50w5XRJKT{RjDB@Ft ztC2I48SllDCCg^2%RbMP*tqGERGJw-PC&+nvT>%3%69UL-J7X)&Q!n7R8?$LwejqE zMKx?(FiTalakh8yDKR z$i~Gs9-XB=y*T~O-op21DV}vRXqKvNW9ck)iH%wTK0#c5+eL;@PU&)#^r?%f>A>Zl#qP72j;* zm)Xg8JsV~xRy}Qwx=nK3L7g^kpQDl>;FUS*P8)aGxVt>uW8?EVNiGJ0`)u5A<7pdh zZ9HJ(K^tvsJi+>i!bfZ@o}(VNlZ%{M3*~VE#E;r|%*Nw(vR>Wbc)_|kihwlOU$TFW z%5}&*Y2zu;@b>tm_n%=W+IY^!^EOV+QPt+Es@J4yohW?aaLLDK6*ZfyUYV<2wDFRS zOL$&^4W6yU?YMkj@Uo3pY`kjYH5=`1^tRE*Mh6?O+xWmn7kcBd^cyzbwv%%$I@;)D z<4xLDj?uVX=vyMwSt_%6R{_P|vGFe5vQ`oEzGo)~YrJox!WjiskEOfX_|V2@HoDvR zNOX3i2Odj*Y$t1g%+9tDd}8BM;V^GYp8O!%dWt;tP%UM8u`lE-j=uCy3fmZCqd$!= z^`R=t46rfW#t0h&Z445HgK1?|x`D#M<_f>@G>_irs+Z)1Z*H`^#2 znP{N4jgo7VP-bkjy>N@*tv0BN0$(s{<9i!>Z0xl0rH!v`?6SelK3|D8mQq&eZX4f} z>!I>*CG|U@dkYJGlUnVyv5&U0aZn`p+xU?qOYjfnd4CpgfCFFhmMLdV2&ncqN&Vf% zq5nUX0)GgHtvGDsFB?Z}4Ev{~nuD_({B7f?jbk>B+bD66c5uSRKeU6BjMCUge;^gKHdI?O^3QnR=4M){UL78aP-sUo~>DalT?wLkDEi zAlH`Lfw+m2JnWh|Xzrk?gX=jSFDp4PUoo)677lK3k}S4(#@;7&sv}!cF@|vBP@Dprs)FJZh`8tK+Rd8wl7eR zJ80uza7I1t;0Xs$in*S0a71cYd7)~$kaxKAZgj;`+B(Um#}~SnJm=tfYV&Z5hjz^3 z;2Rg;x_HsSOY}(xM;*NE;1vf`986`uIC#y$Ck{S!(B44@2VER=b?~|aZ(*`{&ZX%$ z9CUQh$-$cr9=^5c9ieXtZLvs^)7in>5+%NDk$Ts`dlG$LvV1_xk4rLAn6~8$=noxy zOk-9q{zw}2i151!uCXoCVUhaGL3j44gK@y zx4Y8d4nB7W(Gq=_RW361AJ|?ciGneU~VPNlO%ER)_%c9vXZ}va#?t2YUtYbFkmR z4-S5GaKOPY!u-j>&jOAuQIx-6X+jx(b#PGl#McV*?xl&9sIcc!HQ-^@`oHua4*sOe zUC)bq)M1W6T4t#_;-E#Hs@Q;I&4o-1Gc6sJl=3fW@ zv8665x+rh~7pJ*6-Q`s>ipTcO`8fIEU7(V+tgEJF3YV!u7e#JzXm-j)t!1jovZPjT zFH`-Nsp-p9iHly%RoX=*7iYN0xH#X%1um3}GhLkHqPoiqAXH@+Rb5mQTtz7VDKIeU zEEi`Bhcg?ayzr}ri<&OZbFsc*F=cM)T68Ws&lND0(+)Yc+~kkO!aGwJy12;20#ELTXm1XsDZn#HjdEmS=h z^<9i|G1|p7E*iLK@1lc?hAtYpxW~o4ZZbBnrE(WHySUCpV;4f$aJ{&K~)58N?+ zn~Rn%Zg+8qFz7vKnWc{2vJ91u~n!0;M^7i2g z7f-r)&c*XCo?=bv7PWQp49&YjJ?$pz`8>6Td7pLh-ISyP?N=ynLGRKa-Oj~JE?#!= z0v`dSbfLY4y_surYU~R2ii=lWyyo(RVRgZ@6pzthaS)#V0O0y6D9A zvQJ&S>EbOH?};ilu(OMI+~m6?YJ1zo(G`kqA%54zg_BY>SE~2v#ybi>aM8t0E(K^d zCH2C}r1X#2_4JdI$&Dlw_`YH?E&Mno^(mcydtq-EeO!FzVtM1@?k;+`=;`ttX4Pe- z>Lq%(;yvhiX5dQ2w*Y-zeC}d^i+*nMQlP(3f@v$&Ko^5t40AEuP2N2Xb}_`oP{HhI z20l7htyF6#roLFIm^8x0NbwLR(Iy90sxd6r#XJ}D>1nEX9F@D6EO@+&2?8bxWop$$ z1ycl1cQM0Fj<1>OVp@4>dQrj5ay;9`EEnW33p36s=g;Lx5zYd3ii@=_N?jDLQj1(H z6|h(+IZFgE?=o7+#R?ZIU92fjUFBl6VAg@c6eDFIQHX-=-%^ zlzEw}tT@j_u3X+15V#0kL@r`!FUw^pD>3h4T{)(P4K6mi*yQ5vxtVR8z65L*x<%+# zPLit>Q@>yr2xk}j+Qpabuh%o=GkoRZYe^z5tfHE;QB{&GyUVkD$7;CP<6^J4D33Mc zWhh-5seLZ?yST(d9S=Xa_|ZiL4;8)SJ~(>dsN2;~E`D}#z{M{ves%F5r(zEWUHnF` zc5%$b?=B9}nOz+Jqwo)*1cy1Rb3*th@m@xW%jgjoe+wr6fmQ0bixafxgw#paYC?+O z9|8AFNR2$Z==o<0PPzD3IB%^|!&j-rs}ys=OP1^NtJG;8NKY4FNtB#3JY)p_zDhC5aHd2nd#F+_(`vOk%fs0c zz1YJ!0&00U-$Qi|H9XW5&bc1W^LS`jqGy=UB|;g!z{7E)~>U!Y4b&Wk->ES95wNk08Jv8vp&_g{Bv;Qrr z@8M~cKJsJw8n*GP0^&v<_}lwhk7pmLm(DCYvRd6TB6Xd|!-dq3Gg3`F@MQ9)La!If zXfqGZJ+$y}gNGZ1d6UO8d=!(~3MJ^iCOIeMRu8J2Y>h%=o?V%bSfBbu zAFx~j#9cjn=p_#$V$zR2bn|%qU+NPNpVB6!YSQo|^)nCMCHirx8dR#t@4Yw0{Y$(1 zWqQ#iDi!ti(1(tCZc$%q_V@vBQga4&{Qx$~!*mZbJPcy>ZcKhYjrI_hs=*$Hco^zo zmz+A$9b6KVX}wu9wrE9BKvDmQd_cJdi$DQ;R(;@%Z(nVpu9*nUuolN_vr|)_54FsZ}0Ud;G*t@jP%Y!}ikD zD_5r1dLS+Jpa~#eqAA0JNy~VMJUrK+m|btttB)4h9vly@DEB=Cl+lzYG$*vI)nqbC zd_+@wN2Oxgr+HD{OMVcp^RQmP1`itr@RuI>W$V&gIJi7~7_R&%bxSts{qH<{&l%psj~?1& z)qt$p<0ZpzugpLDB-ehy_2+=$CpyvvMQ>~`xFClMbIE}-7Yil0NB|E@sV(3Vp>@hrFU|eWnKPXKf7+bBB8R#;T$#gF zIlQ042RU4wL%kgC&fy-mI)`g=Xqn@mP1PWWhB>sz;f5R<<M{1qwp6YEGQ?~e`A_8Vq)0xS!&5mtokQCkp2^`QBWc%Xl6SIDU+8W_J(uHF zvHz*n3puv&48vPzBzs!s=dd7$wKhffp|41Uo`q_OgJ6c4A(p`XUqL5DJKd#zL9e+EzRameoG?bDIB8 zH|DS@hc9#ZDu>N9=`U%XF39s*d93IbTJLb-)*QCwusw$_BudU{NbeB5Qz)ZkeoedO z@M{hSr84JypXThbJBM#__%?@sZz}#y=npx3pTi!(dvn;A!+yc$n+0Xz+)-foF^8Wx zt&PIZIULC0mvR~EA(N7%YixDXYnk72_?^>Ew`9b1xJPZX)t@;W<|OPR<>N0_sa7%k zL)MzE*Xf+d|dA1Y9IA{Tp_6xxKcn}p_C!#s&ZUkKm(!VUsKK}Zpd1R@U>Fb zbwV2pZ6cHvXzJs7!5{Li=)QCdA2;||5@2b78-3j5W_3Pu`|6Jny5ek7s;5>nBT0H66uOl;`}!6R49tNS*B@=>;Dz z`gn=09?O>_YR;AvS6yE9@tTi!e7x(Uy^jt)I{A3h$LrGjw;su`jof+rhR-`(R7XEK zX`f48FIP!^x4%UPYs^;|s`RMMWhY!|}YlF4_&Tzqs#T89Wam|O7@8#pd zsj1hUWQSp2)-zqiC8I$;`uXTDNuT=|;A0?1!IWhCF3(V9_F+!4VREpKAwJ5^ZCL84 zEsh%QV}y^DK34e{>0^|S#WWGUlzr!8p^rsA#`+lNW0sHEKF0f);A5(fX+9?UnB-%! zk16z!Nh#ha%7T7&6pi0TFxQu+`^m!B3?DOD%K1fHWMjL?r~FUHGIM;c1FQLdauCp5 z_NmWBTE*_Z>E@!=71PH2f(1V67N)6i+R+TVyRNIs7R{FWSmtB7nDho$J>aSpVrr_T z^KeV*Y9DKSZ1%B5TxG2f(}(4w)Q3iQotDb_(Ama`GU8Qqa|%3uwBW51;+jFzG&?Yca=Fk&oENMsc&ek9AD-vB6IsYFz6hWy9Gh z9-3jhio1?GG%nu6CRa?azPo6vk8M8o`Pk3d%*Pi#zVY!bM+faD3U~YX(#KamzV@-p z2YrBT5BBf(oJE%_ma> ziZTD)ANJAJQyh9nIBb1T^54m+p`Q9%D!{7xo;vR11ZR%`PX+kL$4Po-faU>C$tXKB zK;;1c`uNX>`nj+mK*a!s0TAG{AhF@;0V)K^G(x<`Q>Wz=aZ!L&fJy<*2v96yB>~a_ zW-UzdM6#0=(%dC}aZa6Cm~N3%nIKu;Rso*NC5@s@C{QIp)c|z@TpA?hRtr!gK+OPW z1vonZH!yRD&p83A2jF*YjCRi@o_TJ7^8#EL;GzJv0-PTt2d!KX@ESxlBgcPR$xx*j z^ls!ev4!vH~a!TP;(;~nP z0ot$*Ckt;3a8rN>0z4St<^Z<{vsHjw1KbwiE;fyN0^ABXqKrdhI<2$&ymh+uqejycwc~zpDnmw^49kir^JT>4o3BOfQJLL4)92TM*}=2 zHGkAka&i6qbzcqe)k0r!a@ggoC!}JW1P=M?=>Tm53<@wfz%v1!4bUY(*8uz{`&@w6 z0<;hCe1LWV?+Ge=A;8N4UJ3AGfR_?yOY}3;3z7~k!>N-x-j`B<$)X0 zeFF4LO2IdQ>PsM#>gNFl1jz$*p!7mPs2YTc%W<9mu22mLFf_pQ05gK*gL>9vSb*VD zhYGgeIqFfo8RHT7|*ri6-3W}u@^31Eb3 zYJh2Cu>+whjQF}X37i&YN(b@X!~%}f0DAMH*#YJRm@EB0FTnhOFGdruW`)~NOYt4k zpN-W*`l_oI1z60{6e*gT1yRW|8kQCdu#>~KS@DVhQGhtW$^ff4Jogo@7HS4q6JTwC zQfX0Em`v3KR4q=nUFni!2xXELzz*PufEOSaz?CFQQr-^`NHi3IvRtGUI~Fi+KES#F zn*wYOus(qQTk8HuEgYU{5vdIUHU=QLl$U5k>eEPV;V9dgS{tdYqHuJiwy_r?wO!~J zLRsjS0lwlK7@}f`uLJA~@JoPSgXG4C-JHAXs-F@cz_;|n0N)4rLA33mSfm*C3E0aT z#z~Z6zi=4+Q9xOgds%-DaDZMXdw^$h<}WTf7~oid6?N0U1^7L{p#XmbI1*st#YKMx z*nM#k!CwIm3uaZ%jnyY-6p;D1$S``e92^gDg7ZJ!GC)BHgg6!8-dO!7wI%qs91v60 zXYcn&A<`s)VR2fSAm)LYy7q99A!{7~V8+*1CjWGepC6 zs#&u%F9UjHo%;2Y%y}Vdg?N3PI$yM15P~-{@QAq~>(rrJ)kPsL4pBSAB_Xa1aaD*q z)UcuOa-o+BW%M!ucTd0-<(#@97-iDcA?k%_Kz@k&!n{UgZkvFzK$%9uxi-XgVZtPb zp)5OT(-7B($?ZiYF`9*F9^$4DH;2j53N1ohba@FsogltJI5!I2ItI6dxHZHpAzr1< z5G_Nz7~-W6C08d0klr5Rjxafog}3e887Al0-xVeYsofo7?K*W2yD3Dg5L?%&)*&7V zad4fwFU0*+byM*JAs!6zkl=@fUVXB-!g|Fd(nmu)7UJ0u&xLqAM4J##i(xNZubv3; zl;9^rFt9twWGKUJLp)Q?WD=RrOSD~imKOw+$-EpU2O4ZXk$fuh=GMaG@|O_pL+l8# zGeie=Xoy827KeBvM8^;VLJSPiDa4y0K4N>>k2e&(6($$Q^IMY6A>Iy?^G4ng`ay_y z1(5TefcHbRD8GxdONg$*{7@(llA>5Q_RFEdPuWxJ)q;cRPePEg6+Er#33J)yNQ|*msK+!)O6xLabY#M7tkN>UL-cm+96a5cl^CPALhX@$vYqIL);gd4)6&(H!P z)(hXK!waBH5F!-3YJ=LeLB-|#yny{1)P@inIo&ulxMSlNiT|ULxivR2new&#BTOigrW%Fg!neZk0E}dXPzqjj;ekrotvVeS~Ha%1*G1Mx*)v!8b`Rs?DYv+6_RPe{z( zUxWuo7{Vq;7!Y9~J7Tk97$mva7Glz&QXI1k6FvbANIEjYs0h;|%pgC)7*RMS!q^Do zB20`hN!mL;!UU-&O~;C{jqNrk-9h_L7KQI^POLFC!Zfi4`-_2QnHgbLgn1F>Q_p5K zTMC^+=4O@MtR8!|V6J4Romt5RQaY{C$IL7g?_zOFA}o#gvlhQbSQcS+;%W=K~@SR*>u3X_#&ACaGpphxf`mKVfYtsR{xsX8&WJpw89>=Y9{C|PKe#5W@Bim*4rz6iTn+X&x9_?{ER#MBHk zx&HWD5hh^RBX(o1Q#Fh0Z&5EiTd+UEkJKsM_k*;k@MQYu2s8^d9AN5%WH@kmvegG8 z{1)LKPS+8Bk8p_dPlUfXh_)nN^oP{{Pq8pPki{LLS8q|rqym3);@YB)ij`)FO^yry zgixA`8cs#{mxGi)_2Xo}5IGG0i9kV|L?N_nf6?i2(#8rg=p+^6WFL{cMWteVur0ZC znD;2{-=d0R)c-R@PC7=V7-z)D#ONR6^B5||nK96Lf{@jqJ>uPf!}sC*60GqS2}RW}|eHRjCwIHk8wqe zx-qVdQI>j@q!O2fvRw6P0pXWL8;CGMxi&A3)~vxwiw+c+A_xNF`kL>Y>Yc%+!^D3c8w(672}?mf6$U9-z~JP&{i?- zlW19G*pM>*gE3micqGO{F&-|LFKaa=AC2*Nj5aYI`#(uceImw_F`kmvQP0!mn%kC( zl_`HN#`7^=i_u>A?bxR=UZ%Iicu_cI_AC>ACC01eddMkbb`Z`RF*?S0U2qwnb?X%4 zofz-Ncr(UZlGIt~+d|7UQ|!GM@5ksG<3r(pAa?HZf2>{B*pFg-{C_&Dtdvj0RX&aJ zS&Z&6dPuZSjGi%im6cMi=YMNOZG9z)UeT}I#|Fe0NRL{FE7xIAjKS=$JRZnnNQ|K| zzKF3S#;_Q}V=RcVkOO39s>}DO5%k8bYGjO2F-FH26Jtt@sl;0f$HtftV`7YPF~-Me zD>S1=$`Q_TU z*0}Ta+*Z3dG5`06gu7G>pMO zK65eTV{DMrbwbw*C7%L32cGhqVr-7FCB{}s+7>70!;@d8e7i8Iker<{zKn5w9{gO< z`K|D)7~jX(6XW>i)Yma~3D_-^oNr=$TaLdI@DD2Ojj=CAojfkhV}FbvVpPbZVje%n z_$kIQipBUj#(@}r#yA|~7gi?5sg0T6V;rO>$i1Jx35S@Mfwrkwe28`9ELv1V4sQ;n zF!5iU!$qFaBedknLSE5(l>W9F%tFZ%G5(>R82@r)ZOojE!N62vX8$inK^{BCmhs@_r!%%H zYGako%cGX)XAM~dn@MdK=5cWzwWXkoq)^IVB9&w+Ey>bZ++}%Oo=4+6{LO_|%&j@{1=x?CABZ3J91EMIXV9qGYYrqU9#DD=zm@#4^2`GqxAR;P8 zK=16%?!?`hCFh)T`afOwz3=z?&goOn43yj_)~Y=OkCOPR=UFY_@QFY;HOD;nSQ-N-@UpY~<@Nw0|tee9oG3 z{9cYZM#)d*_@x}ba^CrBK{;;l)z3nig=rx>;_IKypYqk4zWSpaf0iR%j!ZfJD#zdD z`a7t9*t>EpZJt=nVtw5(;w6HY`-+@@%TZ4ERVQhd^Ovp?0;cIJ;#N71`HD|s>jWxW zj$Apm$ydHCfxzX&DaR3diE=)XMnL~ujt%9=m!nId3iJk?o@}T8?F$*X3A2BMj6^(H=`CW+GTamy(Gs3smE?k{<_ZZ8_F)E(D4x*I8{W z$EI@ZEXS^LZ01^1j_n*HPK1N{`9`&MWn0-=DRZZk#+U}ps+QKss}u8TcRBWy<3KqM zati0wBYCyA9M*xd_w#CBIrd8~VwN)}uNwAJhp3;tI?P-nu`I7XxuoVX4skgQ6SYi~ zn1G3diBc0)OjI=yGZ8njC$FlRV6cMHf~szUF%X!{TT6D#PBbg%!mlhS{t;GYB59(A z34Ty_UqQ{{Yp;WPFXNgfQYJnwC?zygP{g%O)G^W0L@SnT@*zK(nrLR~V6F8{Fk>SV zS4~Pa5ZX{Ezrw8&s>W;3e+J)-EP)&QXjPKN1nEK7y4ZY&6O`KrjL=$aH z@Tn;`bl@+OkA=FmZ-lCA=VV)EG|}Ef2NMfF(C?v+KT`5lsQ2^jY~myn>sgeEE+$Sk zal47ZCc2vFW}?4|0VZEY;8YXmnmEtIX(moL@mHvBKeIG5Bz1;~w>OrZX`(xO*EdcM zDLH4E=wYI#iL*`Zg{;ZCQl@j{kOGWp+{?s8CN4H{zKPzZzV4zoW4eH2aUgb~i9P~| z`B=LzC95WT?~C;lz@msRF>xvL?$h`(6Ah=95L|A8Tj*Y4;z|=?s7`-CU1j2G6SvMu zoxM7Fjfrbb+{j@nmR(n=!0XwmQK<@L-e7_%-J(iv5}BJ#3^Z{IvrEfwGcm}-PSGs^ zn?X#Vv57mV4HNH}xYNX4CY~@c!o=MshL||((s=7`>K+sK(%81g9x-vBq#BXBpN14E zzG8d8#Djt#l9GoB9xAj#dk+i0W27FHLRijY0v;DSoZ5&KnL{IW@>$6zO+01dX%o-z z%A88>oXCHi7-?d(i5E>gYvMT*N`$+K=t9wf-ogJyMCf=ptnfT4bdnU@-#b=uM#>D$3J}~j2iH|t? zCdQi>XX;0DOrNnF6Q7t^JtOt0FbS4Kigfl|Ei=KyL=#_`m~LW{$!Kh;DJG_xm~7$; z$;BVlnJ7Qa#F|KbDTPpt#AF_h6w8@mg7j;V|6q2iBICCvzBBRs1@T`wZQTT)jel=q z79~y0G5O*NKbe?o>WB7BKXU$>m?wv|iuyr%*P^OAiAe0NXkwX( z<${+A{cC1w1)H}mv9j`T(Fb_pGd&$vQ`;tfEvk{n%a*l?uQjobu5W6JY1I4JXkwFz zzG?JJV>25-ua!odG~e7|n~4T#G)!Z=i5(`6nmA_Sfm2E^-x!-cGPTphE)%;sbK58P zm^di)?lrN`#D4nHYvbe}5U{DJh}n`uCJvi8!dbjjbz7>)uK>sC{L?7TFHNR_G_GB$ zGMAQC7f?lLRiV{{vK*d`r4dhqfGHuMRA^Zm&r9|iY1B-EA-Pg%)JmhaV3md;VB%86 zQ+3j)n@0UK>PaGp;C})Ypivr)(`cQ>326*JTGk|uW@()MMr!U-)ie!Kw#Qzony1ks z4T6?J30kGGbeViBcqDn;N$pvx+AmXW(`c8*d1>@YqkS43(kK~+Q_{F{nd+Fvpk-=O zt9Yk0s&q?sPUECBx(Mznl+2R_utwr;X+5|Er>6Cmqo=V|!Z{<2?rEGUcvwO^`LojK zna0^^^ho20W$K+}iu4@8=ZY8)DK>4H`e~UuKaJjLT$IMeX&;QEzG7md2f|f`gmJVCG8W4oWUpPcB#8rY1<=S+4djS1nekQ&y6!x=1 zdC0`D*nXYTQE60Psa{WGbQ&+F@e*4;Rkz{QG+q|W!&lPWx-mhpqE~VZE0U&CX4m?} z8)2$#b{g-b@ktt=rZF~+chh(;jrXbfmFkg|>U355!byV{>Vq`C z-j({0c~>f?kJ5S{@NsG6SE`SNvhdH+_&kkiX?&T+u9d26l^UN0_W_@f#zc<$me`~; zrU)ROoW>V|t1L|LaB3x=%qHDc`&Fv|Ivrm>2?C5_itDW+F9$Ce3Rp2iC5T$sNK<$PJ4#=0~Z6pMIG8f#hOD#gUZ z^{o2KMETMZ(oJ;!X>6g}7vnkml+yN{l80C6Z?pN0#5OJgY3$vT+`&nakL^xlCkLGd zSuAP0T3xtW@f7)cC?f*uY$t&{xIEtx@$ z44P!nG=uw=mhpead0!@KW{}EoqX8Hh)XJbi1`RW)ok5)p>Sa(rgSs3qxe_Mes|4Z- z(7k2}6Av4SKx2`l022lD;EqjPwI&s;NVUkIWd^-6I6s3{8MMye%nZ)T;DiiL%%DvM zZ8P|IwOaB|h3)>y?ffS;Jke*7t~a&fuhszV<#XgD&iN zQgsu0ve2$V$sE|B^c2CT3gsc0%yqitJws^sjJ|IrvquI!GdMegb23=ACN;UCnz}Z2 z@AA}_f2YpP;K4Uie%IvVZtA>@_Dcl4Gq@mw8#A~mg9|w#8C;*i4QyCGc2R~Ob>OrC zrSxVOXV6!a)2~v8^FG6=YZI4dG`%c?{sM>x2)JD66+*Af;Ht{AR|~i%gKH}}*Jbq2 z^32Fjs%joeas#sMtJTdJ49wt`3~uE>&q=-Lq^hpbLE&1jQT^5^uY($t!EG7bp1~b! zbR_c+*QcI4J9$Tj?+TMIX7JvQL0Y4~Q5g9~JOm1`i1sn!zvu53_}pG8eTeWuh>Df&XBQB6vK5;gx5fsFY-lPfEQ{ z34J<)XEGQm_}L8BHc7sa!EywF9mXU(XL4qL~(qXm%32#POd@Nx#PWbi8cTQx~t zy(3_Z(AP3}T>wwLA>d7+ZwY-{sJ})>4;Y)lyVQ(m`~3_)$>39t`~9g8XbHmHw?=)G z!8jVQ3~|l1>cq8r#bn;kL|_6fEraobD}oqw{st4}kTR15kTXT}f0?B>^qHE$v<$w? z;HwP$41x@%XD}m!AE&3>48G1_W(IRJ_#vaeUi&7aKT)W-75z4Y@8}}rp7eVGvpBew zoH+v0Z(tsa;sm@s@pnewZ_dwPEQ1aS{z>Qpp+5`#Md*lWiG>;bmcj2C{E@-UYt<8L z6?6TW!MqiTmTi+a+sVJkx07Tp$}ki^mSpfx26hHc2LEPIoGq5sPw^pS^ zX$K~yG8slO)mImXslatwffujS0c18VN<6Smy}C}_P&YYwouURj(E|nY85HPMESzuY z+vhNYrJTGOL>Uxm=ZExDz7IRcIboM)u!4QJ5Vx?B6Qp)2Ll5!Psti_Vu!g3U!LAH; zvq>4O&*&c?whP^m!6rJN46ghM8->%4`vMD~%vNe%c3a+7$>9dyJ2KcQhhHX3Zj`fo zGT58J@eE2V?8{((28ZbC*{6XP2x6s1Ep+O}>X6vP-rKRbUyUI?maH54a7TQ{PalI;Op19|w)P!{jzSrQJ zsdnt(dez=S2T8xLS4_;<*}_Q{PO)&Rg)SCOw$Rl=Hw(MgD@KaoV+1}BZm>adN4< zb!n$rINico7J67<+|hO$6d(MaVWGQ)ThA$FI+M-bpa^o2KcS^A04p1<_(mWP{__O@^V^)@bXp@pdjQoVY|`DVP21=5QwTr8lk zP;&YSxWvMx0`A_RU!(W8Fu=m)RF{Rr7LHhY7v?K1yky~J3s+gV+5)%4y2jE@_*x5m zIK~f6uVZ5@++g8G7G&`T9EbY2i%^ zZ&`TT!n+pUv+xe-M#VIiX3uN&rRvL#iu8TqkF)SG3t6f@u=sVH223AW`ab&ajp`E% zpIW>Z(1)K@p8dSC97-Czh?UYNQO_JNZpz2;3jInb#d;1- zENz?o+QRo1W?7iY32R~JMs2;{T6){!?}QRe90W?vw(ygs!5j;7+1b1F&wW2wm}lWf z3+c<$e4$eqg~fuGSoo*%EQ7!Ca~g_KpxlDVdgWAxGjY>@-wqSxEZ7zt3$BH0g#WdC zCdXW!)K#Fjw-8t$KX_kzlDvf>o78ig6gQ4xlZtG-h20kRSXjo2oY+nd7FPiaD`<)q zR$16!VIzC@A==JLt+x2u5wkx;qYnBXy|otBiGvzbKe@gVY@&~vmD+4!i*UwnQd=!- zv#>)Bx6>UB(XNRF&iPO`>Fyzloc){BE)gK8S|h&Kg4ZRPU6S)7o?iGo{ZF|tKz zt1Mc}A=Ka*hwgJIhz$J#WrtNTWciMx+J$M z=$6GPSzM9Dm06sc#c5f(?o>Z&V2e6ZBYt`oXJpYmi!-xmvqfE)#i;)LpbO_xEQ=ml z^vvSyEV4m@me0v@P8PKPlde%;1c_c*J&%~qms}ONcNP~&;$L!9MIUy*OX4D-EdSyx z`btH;wkRHQZMr0jOPRfOskJ+GSr+}XAYdAh#pQx;+@g4RRTfusK(n}Alsx{z`0mMx zYqGdDi|exZWI+7-EN&5SLze&Z;-<>67?{P)!lw+|!$fdv7K4OYK^bpzd>CU?pTSvl zUYp#1yzD<&klvBSomt!^`0gx*2p~T@rKE!1m&N^AypqMMSv-)%hzs<58MZ||n8ia` z49#L#7SCkS@^QuVa2AhN;zwv*OA>r;{8$!`XEB@>lEsr*temGGCRfOh5aBiRboQqN zKP~jC$JNLzp3UMpIUJS6XaUa)eL*NMq+iV9r7T{SLzck26-8APGA4`HvN)W@kt|-% z;*Bi+%Hr=V-pt~yEWXQPbL}|O+gXgu;^Qpd$zrT9-xd0S(D$-^&xMW``qLIQDU0VN<7DCFwx}<%n8NA2Rk0Z@ zg?`Dgn1bn9%*f)aELc9%%LCNcl7(X5WHD24Pm%w&l7Guq^?eqzvY4I4oGgB3-Yn*3 z@k16rW-&jDd6NFua%S&aSJ(SfWeE$Ya4GXw&buuB5dLpMe;3LUTGde>iwraVDNMF) zQ5K7{Se3=Y??~-l7F+v(86ihnOJ!iW|kM^u{D`knl@v__+*SS7gjIH z(&JSxq0E`pOPnm+ES6_Mz9-brB48J`DhlMYC}dIOtjr?J^21;-3n|O&Z^Z`XVw9;U zXPH#`Ri^|Guc}_MBCDU*trW=~)l1f7u{MisS#0NI&tiQRTcp7oB-f^_4(YQ|@IzK? zN+!0MBbAAj#Y$MwR>7>D`045;JF?ivS(C-iEOyZgG5B*9d$QO|-%`DV%`1&*I#fEy zEC;06gHj#KWb+P*B*Esb>L{Ia4k`!YV_XHYC=m>yHHB8mp{fANRLh}yC646~uf&NQ zN(Gk*O;+-2s`E*iI-p?Q>xB$nTUx=N#TB;LQR~ z%ArdR>jP{EaB>b^bC_wP)B0pL3g^%}hYNBzHHXu3=#fLuoc@bIozAWeK}l`!=*Xgn!}(RF3a)DbKH=_jXAKoL;q1{&q)o);qn}= z$l=NyuFBz>9Inj)QR>UjaJ7K1KGTQS2`0Ec2c9C6^s!8g5n9gO9J?upt9vAGX0I9Y zbX9DifLn4%Y}5NA+?K=bISkI>KWxm7Sodvez&2Iyp48175_eF0@22=)%$+>T-QR@X zEp+fUH6(|71oPC0ZR-9U9>`&A4)5mhU=9!E_+S|?y&>Q%nrJz`wIu)bJdhpp|Y{BXW3}1C+y)a!Afo0(iMgJW}v;LZ78_ zgjpeQ!ge((r?;(qpjmQs4lm~LQVuWELUMRBhgWiXciJ&IyhfRv-n*7N(vrhev2pF| zB5>w*#ZzxlpR@1|yTBc6Mfm#dikREozL&%MIee7ExSZYtf-S%Kh2#eu+3o5>p`*4d z{_)rMSlOrB)yFyg<=7`Vd@A5Gq2%yeuL(I!%;Aq5{>))g4wG~EDu?Mge8FbqFpUk! z@oRr%wyWhV*^XsiN%fEGttfVHSG9Mjm9L;P|a=5>7@<*XJ?NIY80R@;Ah|JGId3GVE zhM64MzU=-TdMD-Ia`-*>|Lv;$R}O#Yup)<*IexH*#W}b+c+8u_KRL|X$$tv)Zw{k( zsPY_4YI29_htgR)l)pozb4cw}8P2Ai%E}?j*|AeSuv1OisV(I5eKDJ}XZ@I9t(f{cq3fwe4%053mvrAQRcE)_lEYS7g3aF-^42?>5<*+-4Jvr>9XSNZuu`h@HIULR57_0j>bs&dBIXv~P z{-f$3{jK~D#lyon9LX^lzUGr2XBEY=s;drZ$G{R(vqX9fY54l$^9%?=3QGw`yjie7D-VTeY;& z%0_D&C)jA;w$#|8+V4?)_NbwI)X|?)C)yahN42prZI5azlz{In+S}-0{Z=t5T9YAyN#Rns#9#7YU4D)rwgSF`J?u#Go{#b zZJcN0EE_#+^b~=!ZJcA{^S!DRd9Vqk`p|=WUUKV@1jlnkVs^t8~MzON4JA`?s z4K{$n_4ero46*r33+}CyzfXYKPTeoyflB^^m1Pd48Q6H(#v?YKmR_^tkJ=bv<4HMu z%*KRSc-+QtIeem0<~wn=V`qWsDVoYa?UpNc8-Lcub2i?i(b{<4#tSxHw(*LMQB=E) z7j3*mO`54e(^8%G>8aX(Myk&~^^y}S`8@HejWIUfwDFdW*KFLfPnr7^ef8_MUg_Qt z`piBxWuJQ6#yiyNetpx#II&}G9NeeWejPLRU5>kaR`-F;CkdEnV-h=VW1Nl8Xeumu zYU*PfhbARn+7f$lNAeRJpR!>)l1y#(t6uxnr6bg!{c1dWy}e!({0QU{?|gQ9nfdLvGJ{q?`(W;<8lvI zc$j5lwvD8V8ZPG8m}}!I2Uk1z!Nxp#DjPd({Agpojej{kZNwAtpKSbYb5mL@u<^64 zLo@xt(iZEmIltQYq*HvMjo)b1+&qYna1SU(R{7J$Uy}E48w@SQEN2|h+fedec#&`x z+gQR`#tG6fKHz|2K&RmclxZVvVNW5@XyR+eS{ZGpvV>0%U{V zJn(HbVB;wXx3DVX}TWpw_c_6R^R?Mp5$H2h=7Tn{8~dv6Z&Xja)m% z8KH>bVi-b-{bk~dV3xU^T|1yPw#&wD8z(ww<6w`Cz4XQoYC70wV?P%H2XO}nXka!< z9KgXLR&C>`jbk>ZE-PW!r6V@BUtV_bfKmt5aXKizqnwan?fd|e4XEPa<p{hEG{j9D zGubw8j;URUwA$7WgGpMe)s=Fwy$|3zYl$WDD9Q`%gg%0{S=;`2W2j@6A*TMM? zdOJAJ!R?1sFKH?Pb;xlaaYzSa;kd9R7sx3F6Vva19rSZ>iGzzByte>-rK!yF_91nt zgUcLT;owSP_IEJA!R4&FT9Sc%m@XTqKX7F^9CQW?;${RKscRfu>tKR|i4LxFaJ_?P z9X#jY23k=fey4-G9Ng&OCI>gO>N)B*w$|Y<|G34$t}0+;UjkCu@Av!DCX+GY%M`?r{fCI2gf3PQY*(1qT1&oPCly zbnrBV598Q)&5o zBJiPu_vMh1A5cFNb*QnA9E@}HZd@O8I6hSu9?=1gPCTM-b3T(MF#sKP__>4elBI6V zI5j-U!DI(Z9V~P3g@Y*${&MiQgQ+aa!E6qegD<7784kX7@Rft<%(5@VNI@LIEme~< z9em^9J5lMkG>jvPl&6@8zjrW;hjVpfm>xW$=1OS`9Q@2xz`;BRKRTE%{rX8VGQ1L} z`71{hgOV{I(l2x)4*qcPCuNSPg%1C(!S9Za!o&i(S>abl^b)}FWh6Q(gj0!&#Uclb zWe6NcZ`QEHLE1sa!9NcEbxi|V42+#}6qIeQ)Ocaq6R)d2?w9hA6$ zi$e|$)93uDX-9=28 zaiQEUoB|B4ML=5Wf-bkr1tYw%Ve~UKU8Hzz;9{-|<-&0B9~XDHsO6%zi>@xZx%`$G zbzQV_(b`2l7xi50A!);t>lP9=1(baZx-ah@xqm7G=M^z^mZC$i;(VlcdqJxW$E-1`# zq$U|_j>$c$I=eW@MHg3x7dzR-3uh?myzH2EIBdWvE>3lEDf`Q|xj5a$1ya!&F1ouo z*Ts1*&UE!vO%E461)L?c!!gA;er(~{F3xfBcL)6xomRv^mrI7Hdbv2C4LcH}ujVwN z^Y6`Cj%k%%=%SB{JCEt5?IM?vuF==U$YZLXi%Y261u@_Z~b+PD}?i~%AbDz59TFHp<%Z@2VecX9W-Q@B= zEWOs>=3=0WTU>3BRC{r%o}0J27)1W~#FI~^I8)dRmUg=oK3J@UoI73I<>D0=ue!L~ z#Sj;dyBO~3sB!m@atNds_e$IDb8)|9rz6z{$so*9`!E+nML*=Q-iKX0;^I*kkGVR= zAZ>$T<#@GF^SGYlPq-Mt(p)^};z=6e#@JIXo_6&b(f+uiwN&gY`i!fu5Jn2^b6h>o zv37NsH7+qPPrxV_FH%2?)M#lBd&gLUFS&SGn!&Y+En#58F)m(n@r8>iE?#%>hKtW# zjCb*-%TH)9&c(;HPZ#gFc-O^yF2+h{X$F@~(ASM@!22#faPc9lcJ(4lSHpOxbjUX! zSERgf;#yEOUh;{nz0;>+Y^<8z;4|uKksdgX&IHTYTR$sX~W+}DG@>%lNG7ubMa=vl#t&8uZv{^!_hwo`r z14?He*S>K!M|nkp3*Qee=D9fTqQt|GF6O&f>0*_OpIj_(k#>=B`Hvocaq+v0KV(c9 z(2qm&tBZx4-8o&|Z?2BNN?ZEV#a}L#xcEo3{kMz7$JJt2uZ)X0Ufil_bxd=bm2Nt& zXe$4@dUY;$VNyROM(YyewvIYxpe6lvU3f0CE^<iAdmrj=Eh+|5iybc3x>!fE znSgDa0wuYU}c*g)?wDz#B;j4k0%a=LNeZQ<-VO&j4>5tve9EG#kfwvR4$aR^-O zl}@pi-Lx65Ceo69F7~@PDy}AdnmRzw@8U2WDU5?IMoI9}BQ7QkD!FjF4pQ0@1{-rs z45qwH&t-UYm}ujnt%s_f4(X8aQ0k$Yr)N-g4>3>cKkjKe^y?gfp76>B=ewLmx9z z!8zO@%)>bz&h_+l9aoCsRSb6gd=I@n9j*6b58MokZtVgOZ&oob^w7t{MV?;lcS04U@Lp?m^;c*YcXnr0Z@$jgpgB#Q5&;nT+Cnn8< zSHHZ$8Sdc;4Uz{Bev-th3Ao=34a zJ-p@N9S>urF`WKyd-|G<14p0CW#wH@UkvcJns-k$;7(PIE2iia5< zzNTW^B|oidOr@#Nl0AGSGj2LZ`C~;t%=CR#ZL74InI693a~=<~rG?*m_|C)kV$Xay z^KVsyt>uN#vZ@9zkmiV4G8F1zDy?Sx2P%#JUnc1S4?laD@8KsJa5dwOY6i!P7sJ0$ z+qu|?YR0eB;psX~GV5i~(cdMP>%sHzhlf8o^jrlz{Nv$Y(c#}7|8d4*4@*4oGM-E4 zyVVSuH!s`DJ?wj^B;&#IU`kUtWNCV;YR2WOV_D(kJlK+vef+JOK>=Q5Ids zzP@^Sr@FQTZd#i3QNu?~Uz-`{3vUp3ZNO`6=1uwF1qpBNYWe!&s;-ZEK5F~g^E1`) zwR50JbAhYxqoJ=o9{CM?@L>+G^BehS>}#8E;)A2cy9|yvr+;%FEqt8iqlb@{K3e%W z$wwC-t$m!p!hLj*Do&IxwDZx%M_XTS)%QzvgNgm6_0j|IvZ14oPCh#OSXEtH1-nc) z%Na_qaDAP;tQ%QxB zlHW(pUgYCq0eyw`6MBizONCx0w7*d1qQkku$CbXe;fl+it9)GJ<66=D)xKVFIF5Yq za-Fa5q}Yq*ac!|T`nbu*C?BJJ-0WkZk4Jnw>f;t4x3cd(?(p?B{2(8<`xq?vHlaP^ z#$f3YBl*9+GI6IU>RuoB`MAr+-9Co+`cVlhx`!sWuaubP$|1g=*?s+_bSOuBIvy0U zhkWfNr~$^irsOam5BuPgLmi#FU!0uBd_3-hhV;CT;Xa=5F;cq5s=Z4}M)-Kr$5XVu zlK9g;p5YKkcxP&rc~%6T6ME=*^@6Wm2lYQXZoKH@B_Hqkc;Cm%K3?(h z8co{At3Jl~n7J;-n`>Gu3*oIC*P}OR!#>{eF_t}DsAmMvz9mX{+Xv^%Cvk(Fy=kHD z>AS+GVSnJ`L)xd0@oa;Sabokdx{rN);^Q-Rc_Fy6a~?g#OHS#*G5L$KsqRv)K$EvwZwhQ!9;8-^u5!nIm(DmNw7Fk3RmS*^4IU`}o<% zFEXY-`B=blSruC!H+b>_)7Rfz6_R?&&>)7&~BYgJ4xlGgA@8f`vgFX&1 zi?1IXu|VEhauRWOX^p>39P@FUem>B*jl)Wfl0fUfN&p1lA)f<~KDzk7Pj#vVs2(5| z=qK&Gh<&Y8_pUTRS%9tqx&_=a2Q>mT4bUt=%>bzY^#ko3Q~)F3<^{T8*ViqjHfjZ^ z9iUEtx`BSQQZE2+<+%FOAx|qccn!lU8U$zB&@7nI5TA0-PG4XMnQ<{ZH0u z)LWqUVqgO(d5#3P9{g^ zKf=Ew&^xVgi1}pc?g01GHUiy|Ap!0QaBqNBWyXChydr{nnb9yCdyuW|8-FOk&;Y#Z zVBTRef{z4vRL1LJDU$~C7;UL${Bfc2q(Q8ogeQ#=9G3v20*nsuRDh=gJQv{k0M7&% zDXkikGWxpV zPa3Hj#)&nI4+DG@;O_v70*nh7D+WIVm`6L227f^#3Giuv&jNfNfEzSS2rx0gU_NmQ z^kZ8(J<>^nC$nL4NDe3d)Bw{0d=uc?0AB|9D!>deY;EKLIDFg^h@O*o%3lYVNxQ9~ zt(`8BPnf&&3OT@R))?UX0J8$no;goB(6j*>KVQ~xhR&4{VO_k6{*fh2NGy~&GC#mi z0Tu-KnKN3{`zr@)kzVmRe0+U2xQ3qizXkYRa{UqDPXW9eP{YF>lKqO7cIS1!!W6q8pc00j7$Jam|3CRTZEn3R>N=txB6@llU`p`)8Mt%$^featO@i!CaXBm zBT~G@pa-V9)&^KdJ=fG)eYU1vo;XuBavbv*p9kZjZ(_d=#Wr&w1Z)kkEx>jUTxJUNf9d3396 zPeltWNY!aUB+<2*U+CG`CN)8^il zxKG6?>B~ieE9&Z($0d2(o5y{5T$;yadEAo6t$Fm%V?Z9)=5d_}UoP~jJg%tBd!-CV zg`Tg@Gk%mdyowfHUnz4_9ye6t8!P*Mvv3Ah@|k6j;5+iTQ^0L`+%8~n9{&-*S}IB= z;JDwF$KApoQrSB)?-35g?$6_aJYLM>r92+YywK+=TU8-EN|-Edv;cPDq zL9gt@v+|f#)A;oqwWFr7vUfa@GTNq$d3pSp$NW5g$|Ke(S-!OFhLkbrywU|6(3G(# zkHvZXoX0OT4}Kz*GJeftVIIHb@p~SBm3gdU%TvaBp{w&)o5#95 z*5tAD(G>ZlO#eG1XM;$Rvzf+251+@bJhrl_d2G*P2a8P^QP0v{DWjn>Ix3^ZyhNf# zSs!KWW~=D=*?>H5RK~r^ct#n0JCyyP4E~jtQO3(N5(o1*lt*a+Wd$70<47J=3#eAW zQF^n3CCBnOp2tNms}0H+?k7tM7-$%88Cu~eph^L~4TFh?)eDFf5HBE6z@O`r(+y*E z&*ZO$;bjt?!o&xoa zG8$GZt;6zb8FdS&SHS4iscUN)yxy*Ni@L9tQNMr&1vD(6Q30RVG8z}Osc>KBxwQ-) zGPXdo0-6_aNdcD@(4v5r1zb?Tg#~!Ej8+A7F5u1{@zw?OT3U8O0VfvFMlcUM7SOhU zc5>LhfDQuwEsgUOQw8WG%;tZlPAZ^F0VfyGYI%&QdjVYw=q87!6mYtLQwun)fGwZ?fU5;xQ^~nj!0ok-8w$9wfD?8nZY$uX0v@kzFuhjWxLNSP0&XebR!QU! zDj;7-RLJ~MNZigsB=3I;xLd#-91#I`74Y%-z9n}zF-XnCWFz+wmfr7qRdb)rI z3*Z(fm-bPE-Nc3&c&LD(1q|ca0v;(~gjmI+LTMh47x3aIiO1;WYHN!fUceJ_YJP2_ zTsTk4;Zs7l3FnytMi%fa+g7y()5`*$6Z*W+7le+YeF~t=iv_$SnBh_@a=jvluL>O_ z^fjTc3#IT|1-xCrGZ98cc&C7|wCWIzL%dtSdj-rYV0J-2c%jFBzkm;DPOD=4C+Nch zxJ~Ux1&k{&d?G$6;A;*#U;Y;GnSg0RKNmW&fbjw-FoDIEmJl#aDqwN}UlcG!&Q29t zah8a$`WQ4@Qv`ltvvgkfbR=@9HeWRLqJuxNN^GVp@4Y>tSn#^ z*PsIC7f@b+S-?*PEGXdb0u~i?jK`k~c%fq{gJZmXzWSwrUu8rV7VsMtb-wzY9;Sf5 z3iv|~$>C@+5may%tVp%oRkoPrpB?YwC6*NMPXYhZHPtZ|XJU=(7~Sd^X&Qe4Rsq=p zmX(yEi`tY=+`1{5E5I&bT`^VnbLB|Ag#y9?T*01DpL42!A$5!^x+e3LfQR%y?Z>2| z0*VDJEntjrRh*EMQXso8@pz0b3=JUsl&(BG^&DPWt3fd%|4>>@MIq4Ze1A59bIcMfK!i zq5BFrP{2XK`-Q$W2Z!j##)E)jOaw=`1XP|q_J7Wngt|-!eQ>VERYSe?DpNH9)rH1{ z#zWlkpEysIg-C{I5Tap-8X@w1)MIsxF?EfaAyOe!i1u}jD_WJ-31Nh|w60N0dQn>_ z4{xt))D1y_dP3_9IPHZ}tDQo04#7WS_$SEF z)}<$fI5p(YKFKa2czCiQD#exGBWVA+8a8Eoq4BL);+a zd!x`DtMs=hOX}(Oj3fIe2Zp#M#BCvN53$Wiu>_`DLkyA@DNXgcudYdE|kL8)iYL@o9+9LcAQ}l@M=*cstaO%U&nNTKFBoACL+d%T++Ydm-KzaKc|;q9oHtAwCu+@i-PJB@lnY zY4v@I;G}u#^AKN!m>yz$hzTJkiu@NLri7Rzm@<meh=|SsMo$8PK>LGQAhn5GOR96jL;^+-ys%-*cW1dh{Yk6 zgjg10d5C{P{2L-0BF9nKTgG1<54Vb!hcH7NKPkzS4w0$EmVg8GjrkYGZMrG(17l7t zbwZH3Av^&-J%)gm4GbopVtCI&$XG^*LKNAmnW?2h7k!{(ev<0=pCML;*b`!Jh*fOB zdx=dUzcx>;4zY&*Kg8=tVoWQWsC6OMhuBcb*+_rVz^FJ&usOt*5L-F9LhR<;Z(wW> zu|oiVG}|d{CUci?1~xFBY+&&4Q=xMk7(oMLYXf82*`)_)`SiCDYDG8{;&6y~ghYfR zA*wbsO54P_rW_4%j5-NX5}{gz>JfheMT>?8QxySc39cHU0+7apPYx4>>)e~_-Xd8V zp)5i&V%T2PjPxI)S2r}cLm#8A4Q^=gFcm=wpLomdCAFC`LZb+cBh-!XdP9T%WiSX^ zy-2Ta^@TPN`g=p8VFXh08CksvYmdO~`I^dEM&)W2p?RdkbDjL9&f79Vs|c+l{5+sE z-pFXx$QZu2?1TuUJli%xy9n1sxIRMr2puByjnFSb#|WJwbdMNg9}KVEIYPGxr$jg@ zLa#;!Qx^dzN9ZbG%bFTwo*Ln7bX#27& zgp#wWWzzfH$}KP!oUc(MA+TfV9dRE z6NAylSUb)tJ>#@w(No92e3Jv370Z{LqCz&t5yDjOK_mh%+_lT>5f^S0YS{@MVNoBaDeKCBoDQuhEjpIi++mjml2E5n*hEcLl#G z^sNXB2A8}Y!TUGyj!+)H7vX)H0UHqE1CDrvk0Oi{^X}3<{(KXI*8ac=YL-fVA=>*i z!ev6JrtwtEoZIu&HrQQ{%xsu`eQ!^4DzM z51#jNV%D)_{YL7m2-72cOY>vZc5DV4(<*6CPJA6&l8!!cw7&n`x_F5n&}AS`kf(SQTM4 zwO2%0k)gKr8poGD@gmknSQlY^gbi#@5h!9K=WOrzwg}q=Y!bRz=oX<{+2!U2Wp>En zo(Ov*>=e99=x(8{MP^@w??1+2))--bgae#S->B1?8wa@rM0i|eSXBJ4)X@mXA{>{z zJZ$?O-e|6SK}<@SDn;F}n9!<1s|l?x^b0BK^e%}+5y#Hs54^D^AE5rLDp>?0$*5wS>b{#7qQSCh8PHTDORL0*LDu(V!AHETT~*p4Z%HT12xV z`W10WQIF1zcA|L^EsAJa)UlY_716$kR)Sj#CG!LUCkkyNw5?F%sj?15{UK{lp&g6p zR7B?@PAcN8B08)tYxhk_mm<0qaY_*<7xnt`=-RTbMUWDoTEuBZ%z`>YPMu!FmDALa zY1)`6(7lK=i}<&>K~4p;hm^TwN{S_)UBo#>oLj_sMO-NSUPZn6EK_d*=S!J9yg<$p zJi7#ainyqVi-pryD8%?`t)tXp1IYi5eOwLaQA`PUS6eGxYlF{p^!invjlaWmE1!njFrl@{7g zxZCN#qTciL7NNHaJ+p;zdl7wSChjcat|BgNVGI`fpCay%q#N17xVwlUMLa<5^^MZFK8EsQ6Mcv=AQ2=ZH$K3T+5!XYN}naZ<;76uQWD`J#zo)`K;<=H)Q zc61RHVlT1HMZ8kPhQAZziukywpOe2@#F!#pE8_Jc-YDYGWc5}NZx&IzrNJlX&$l$r zX=&Ws()fQ&eFd}>N7MFwAl%)17w#4gL4v!xySuvwcPF^JySux)YXT%BK!AkY*>PPU zgdh0TmE@!6$`SoRq&PsEDPc%=ZV1YMoTE6@9? zIIXD~IG&A|a$XEJCSp?}GE2xJLCGHCwKX;;VoM^nCSn`cEZdfd?TOfti1UfKkcgd$ z*p-MQi8z{w)Z4L@0=pCa4*y2$@E+mnz1##6v0vZ=i8z!9KE?HQP;kD_=2!Y*fti0S z5yv@hU;E3CpGd?n=feD&d6xYk@F_u03wlP-J%7iu%(+Cri{QHZyKeAeA}@&#B@rrj zn8^e8vW6}vLdr&05^*&V*Aj7Earjdr9wg$SVBQxOZqH6X3vf#aoEG$PBA&3> ziIB6?Z;43cdQZgDM7$DbQ|9pXONofEKq5Hbyn?g+k>7Jx5SW)r(-IM^8CRrUSWon) zhZ%yJT!a@vOVE37Qn0+62rm&yC43A?Y;{=VD z5E3A{peY4SA@Oztz6__Z1p17(?D8D65eL| z=<0AL2{V$!E$SF-_%N1NlgKLJD+$>oWS6j6!WIcRB;=IPK|)6fxg_M4P+LMB)+QmZ zgwhhqNXRE4zk~u33QFL?rJd>H_IC+C3Iz&D{w5cXb5KzUg(Y0gK}96LcTFSKk}W2o zxP%gt-*!q#c$tGr3e12xoEVgqP)ab>aY!FiXO030)*~l`vew2npRJbeDMDZw%zx z`I3Hpl+Z(hRWIp@nk`#2%0rFl@S7ca?>;k)44coZEl*$-Vio0W&`F(n9J=& z!YT>#B+QqvK*B;Hz-x~*dmP-IDXz`a*hLa{m`ldxP+)-y$D`vgu3 zyjsE<2^%GBl5ns}Xe}?opPN$Up@+F?odl-q1>GR1!KV@ell}^o%0q4P&{hfCB;4m} zm9U+&mhhv5pCs&L^Y$hjk#JPPE(yCO?#)7bSib;!CG3;1U*H3R^4U{+WBx}E3Fcu5 zpO`$W_Lzh-+$veE8ayuHgv2*NAD@!I^Jy8J7DZ;jMLQ?qyo6gEgc2@DxG3RC_3(8D z=MpYSxFQZO3py%lkgV@L-KgWEdQ^B_Y&I5XeZ-82_HE4BbXfVwxLX9>BfNW#pV22t2A`BL{aWyu(=+1l!pxvg1brhI9>ItR`iT+^ ziC}01{e@cw2+H0Y7y;8k5eycbQXBlJ;F1m#mwbvbJ{&0yCqyt&fKh^u7IciD-$XE0 z02Uq>!FYkw9Pq=Q6YJrCVK60vscgo>*p@P;MKC>rR}uUf@n2GAM6f7=#RAV1be5pA zBbXDxTrQV5Tqx-L2o?x%rhJ$aU(Or`OCner!TAU-M6fJ^mnMzN>B!?1z02K+6d24@z1Uo^x(fC#>Ml~#t1e=z+khWTLk69tpaR|V7mZ2KJ#}9 zuuIUo`6&Z$uKhk?Zv^`y*dM`xi2q=7QqY4D92Ve^po_##zDERRnWGUL6Zp8GCj?!Z z-|s(9MQ~aio)PqH1Ye}^Z^4|-2@cPu0(J(f@|Co)5NVC8Rq@k zcv|)K2yR4hKY}dp;&~svn-PD3vfB}VTfJKmd>g@c0<&7?@Vp2=!ef|GoC_>?6+c05Fm++qyl{LnV(F?>;l9BK^bu}s>-M)BVP7L;1gtoWrPGy zE@%otw-q2h%ZX%UmU-JLUpS?psRT_eBaMu-GSZ2|jDn^YlqE9=Fq&6^mXS&JH{;+v zI6m#okyXZ5GK$D3DkGcBvvhpT`321(Xl_As%E%=EpZ#=U9vOKBC*Nm2t1a*u7Zjk7 zpoK+_d?BY|f>TjOaTz6KloW?$1T7^f%aj&?wUw1oPT=w~Dttc6d`_RVRgzIz@T+{j zg!%m4yt<4UvcD`p?`OoDXw;NZOGa%Ob!0S@(MU#J8TDkpopL+6QQ-gHJL(HggU@_E z+gL^uame^d0ct96GeMgR+T!!s!Hf83gxFRxTFYo7!zg<1vEyjX12+EoQuo3G7%IJ7pv(NKe$*i86k^8lEI$vWzJ*rpj0%V=4FlGN#Lz zBV(?N88T+dn8jf)BV$3TRFIk!q=zwq$rBQOc@XSbkR}(Tc`~eXG4o|CU>Tl2Ge2B) zYr_75bg3XMl%W=+MS?D7FKr9*;W8P^Wvq~~QpSgZ#5= zWq(hiJu>#n_*cez8T(}Hm+_FjA>)7y=}f|T85d+6lyOMLVHrncoEA15m2phQ2^lBZ z!VSUWGMb(WU%l<)S%v77491@*o65UVo{@2uTaXZwZ~MZ`WO`A?B^kG5d@JKJSMJ8( zbs0BgTwx6|+TO<3U1M11HIYlN$3YgjDGXr1n!DWgFZqrej*NRUZp*kMuHr2K?#lR{ z9h)w|m#-;A41Sbxyb#^zV*VW4sX^c;p=ZbCga?ANv%3G!&LbI*Ww;#tGM>ozMTRcJ z;0ToQREEsGpN!vpc}OyfZ44%gYgsv88xck_zEOx&zFaJz!Bi6&F`o@KIYMOE;wmYu5}og2M%5pF}zMxesTDp9(*h@j{&XQ^xNyUW!aPFIM}9j8`JZNaYZh;`L8q zF6nCy=|{0&ZwRvM-pY6<9R8P#zdzg4scXzX+>n0?TZM?}e;i}AgGm*ia{3?+Kgx&^ z9DL>{QSe1!`Xuv(U?vkZRzcviOi+Mgg(;*Uxq{p(@~B9mAVI+#1#=ac_k&>tyoPO7 z1*9OQf>a8kp+E*fQ!7ZLAg#d6OfNt>LBBhIO2cB9$tk1Ye5oLl0GS0%Rx2)x;>$4j zNPT?~B@~oYP)hL!wO-c=go{wgA{0L6`?8$sw!ZRqNsmZ zsVH?QN;MSJR4~4%ucwxR+6wjvyzvH)4aU|}P+vh~1x>hIyz;+-ABxiZqSTN}@iv}Q zBLQB%jon<;3npar|J7_}6X0nc;e#Gs9WwhG277^k3}g7ylADj24q zgMy9_Vpy615Sh$mdEvthIQpR=WyMRc{_Y|L zD5x?#A!~8}+L2r-#c7nFqXixKYeIwKw0lkP&8yg<#c8~P2@0li#VMGmV3LB#3Z^JH zwllm;XeeOE?=4Q3ij!TO3P)q7E102Rwu0~X#LQGMi*I=;1H6SRN>Jt!evV~JP{R_` zWe=||i1`Zca^>EOolz^WK*4GSYZQOe+l2}~WQbd&V6lQF3YIEZreLLlRcuTNTFy3H z@t616Rf1M1xGL1L=EM@D4G+hZq_qmxDLAG0W60|jY*6r|Bpp$(QNbn!XG+o`u6--G zncbyehk^_xX^Vob3W}E`PTPb7TbHDrToDTPDcG-IcuCqV_y5TxS`;tf?Eo{ z<;p5W%S+L2)?AAC_tm?lNGrudrt!BG++l$?u^Hd`pZNLI_uL#5+*9zQ0;ou$;wJ_7 z6?oj76+BSzP{E5lafX7Q6+BY#tAeKr9m!s#e+-9tCykIBFE(~V&5oW zI%;UlU)<#?_>aR+!9U{c{xTFPL;osxFAh7GAx^B}BL}L27}f9bSb*s#kW|GND#9vA zd6A}DncrPs=qmAoQj3{;y5vGlr%0=S(?-j#->z}PDOeZsZ_kL9!Ra?$Fh`0c{ zsUnk#%t9uspjp_ea>R+{+q4OPrGhEr%;hMD>aR`Fv>fGBQM?@G5|mFd=84C7Rpe8V zUqz4N0d9Q-R1{P(RK+kAg;W$)(OE?o6-87ORnbI6#h026SC3VxC?O6@swk_X zoWP|7Ev=%=XUSpZsJw~_>@F2GSc%|QR#8PorOz@e%lYHjRaI2`%sF0;eh|!>f>TG( zS}JM_khHunUq#TmY@`6psV~kp5VWC+MglZeF}6JY?D>-kxd=^FG!tcME@%ruTMF7r z(AI*s5tQZIs%ZBaw-=y;pdD3o`piF_FUWrx3}1?_D!QrY&MsBaTSXtPAjVE?PZhn` z3H*=zyLg@(!;7L{DDT%-UlsjS^j9%J#n0ubP+I@C`>Z^1Pco1zJ)i%DJwpW=q++lN z2AqZnz>{I_WQx7pqvpp{4U)t5~XHnd)zac|yZ-1}v%h8%pvp(MlC3RGd_? zitA2<_Zs2k^(xk?{(toAxIMNE^FsGqE6@fN8&zylv023)6?;`|QL$CUE)~03Nd@|? z0&P>ld!B9=wXj1_u8y55K2#tEym%mg=la%+=lSaURP0xAM8#3A*@v-woBQ}8ctAzU zigZxLApsa47FIF1lsQV5xislum?1(VaQz}lY_+G^iD$b}ltKwU>fwQhi zGb_?L6+0G(&#Sng;-ZR6Dz2)yref#v;PTV~rk4f2A}9-_Qe&?RdQ-&>ku`HTDwy69 z{LK~Vw(9?we@DfWVsZSn^lC-A%cnBL9o`nh^d9#u-1Dor&u_0u;%2^!FOJ$J(vnvg`(my>rwHGieI@-OT<}8!jCIb!$)yXRs5!+bS2{Vrf5ZqsYE#{ zQKAY-1%rs74A?eRg~t7ria%87Dr#N`_Nz?eE0dwZRAH&GRd_0*9I+SSaEBHjdQMfXF_g{#|rj}L+tglRMR|H?H zc*Aw7;-iYUD&BFYs^UKt+nywxu1r5wroU9wsS@|Mp#N|ws>J;(uvMAfRi^VP!`+I< z@!nN28lWMGhNK$uSE1;OINtTOY8B#b>v@{Zfy9I_G$hmfdqn>#6sv(L^Vcv0UIw4Vg4#){sTRmMZijE_AsHF`v(lL^zogn^nVC zY*Jz@U&5zyX#Oso>?PhsafB0!RH57&@@Ockp_u0H_MTTm-ip2(KUSf9TwV}1l&wmIL`e&4D59ZRRllVD1?8>Si)%bf8KpIp&`?tIAIxS}4G%pCre*kA4Yf4X z7MGXPP)S2&fy-;CpkYQ;;#5%p)>%bERSh-7Av2j%O+$47Sd1}qIMw_tP)9>u4GlCj zWUs!A<=u7badz_(c2}kP8kl}!GX1V9@!2LCnrc|2VKJA23$9^+hJhM#6c2X_hgxW8 zsiBpI)*AX~*f1~LMnhW-o!EOK>vkGC2=H4~YOf*X>i@H+qlR~@eB4DtS0T_-LpKfG z8H>Xng0jHtRcM_qz?XlL@1@~QRq8Fy@_X@@)u^wA3zw4j6S=bi{ly`JK^pi|-4OP3 zHNUeO%x?K9mcdXB!!!)nFhavv4db|g2=U(WydC^V4Wl%S7Mw8}zR@s5Yz@!*#doeo zt<%Ph*DyiDObxR%Ow=$*!xRluS&0ystnovpzgs;k_I_YWRmhmk> z^T(N2_z@M$lhTJ)rOB1E@`-|;U;U=@F0KO6%98uo;E{Qxp5^Ayr@CfG%&p` zD09Be7v7vN%)76i$`)8zDU`h?-PUkN!%rISbH2&q?rONlRhBvMJ;(OUFsC25OF8f3 zAGx*GB!6S~n#2Ps54hpfq~Bvg=c2I>In(FC5s~0y4No-a8Vn7;X!upbQw_gy!05r` z#R6^i2k)&2|K)~wWs*ehi~fm~G(t3`iw56`bf8*BN~NUqkRuny9ZMn_s5iM8luElQ~)zBZ-Oc{DPCQ)&VD zTK?ODzi6b>QJ^-Z*HNQ3acWnazSNOPM>ZYVb!66&MMqX0U+EZJn-@*!!b=1^ROGh;w)$_&iztuH#46Q@e1!c3R)uEMj zh!?wS78l@uwA)mVtE;1)j%GTV>%5$DLZ>XD`Z^luXebPBtfPsJMgs2@1;1E_lsdcw zqF*}R?k)g@j{>*&IS_BuM~ z=*Xq671v2eR~_BBTspewm{6CN2vrB`QgIGnV|09@G)R1 zWF1pjzmAzKn-l!C3=D}W^Et9mqF#{wM- zbu7|Rs6L%_VyoAu!S(5As_?Y>#2*FL*QcdAmg!ipV}p+6I#%ddtz(Ujv-Ro6`m~b$ zzc!e?0j(01#bB)fO&iec2DIsV!a5Er0XFK`q+^SYtva?hpeq>zn{^D#7C6kFvwsYL>!uMJIFVVZWq3JlGNu=ppN{=H4(K?j<6{F#*N~F* z2|AhNMSBV^fBX=s2q5n2zJ@mWFh)A^p^l3Kj6*+Kh&j{7EovBRZwyw2q59 zF6lVKh0<|e#|4fVCB9T6I>%Akh`#2;cauiMFB*3m5x3dPI&Sd#k|9g>dkb^M^?fsThd?&Q-{6!)5yP(vB@-?B~ z1b=@yzn_WdkaajZTpfxIRfnm=;^xzY`Zgg=$I2$8>oB-zP3TDz-vDkDubL45X=rnw z)|ARM^_iZIs8IWydnCbm#;q?HGp8x-Xi5dgCtPYuFLnIEJ+Og*fmb^I)RDwMQUkAb zywUMi$2%Q*Q-5$ESu@Jsj7m47Ca?YS{-xt@?lGFtKZ5=%=zBr`6ZC_i9|esud`V8c z8Zy%(8RNb%Fod^#KZ#@p`ZlA<&HPAawLt@M22vVGWgy-_$UuUDu;F(yS$l+&8(7hd z_(M_(!~dMb%vHG4NCz<~LBlKtThA*sIOyix$K?q<_`Iw}f|iFWG{cx1geIo`KQ^ z$`~kapoD>v21*H?BU<=jyrc!~Z9#X$Rc~8RS#heIf$}V-#inUVBT|RTw4|vmeYKSg zR5sAWKvM%%3{*8x$3R^J)eKZOP}4vy1M6GTnU++;z;`X_kCqf@MYXxet*Bfp0{?OL z!uMxA1N99wGSJvS0|u?Ap@EgHXnZTm0sj}~-L2?)E1Fv^@U#{2MEzz4nj2_spba}b zcc_JdmIhi0{JNEISo+qKqqPs(8u({jOgjVZ*_hVUxi#HP6B;f~buci$HD#_4>TIBk zfk_4?8|Z4Fn}NX`CkDD3=wYA_hYCBvKu-g`4D>eepkw$zYpR|<^jmAXI5Xi-p{-0L z*v~+J0|N~V;y`LcW!g}~HZ(vuaBv%1*2cHzL>qe8hK3p#W?+ngZww4KFv7qn1Ebl1 zuV^G^QP_`3PXDx_bZz~ssx)5yaFX^^pglEj?|*Gy z#d+lj^lVQpu7%mcwFcI4JQ&#UNo{-D(w@l#{z&?)r4pgNBwdp{+g{n&(Nb5i!I?zD_ zhYTDxa75($Wk)L1k!p3M_8nK+4E$)| zx`7+q1Pt63I&T`dW#C&jsS{oAL~bW~--#|d!9tzsj)A)dzBlj#d-!jE>H;sXTCX$p z=uAhaB^b{_i#pR!2JRbpY~Tq;qk)G8em3xk-PPG&2lz&3-;=WGkCgr<@Gk~_HSpBH zZwAk24!rA3Tk^;AJ4hlsEnBc%7s_5GAaVcGg(8B=f+~Wlg7PWNfG)7{ne)buwGBAj zjhhIXa1D3{-WmAIK-9o91AlNwWZ=1h7Y2Se@RCEZ3zhjUxUmaOdl%wCwzipg8^qWP zUFc8lOAWj+@YcXjU5Hl;dDexb3gKK`sX{aVFwTWH6D@M94&P6DdukGLgbWf{CyRGO?l??dV3QyV28bw9Acu*NwQ74|S*1 zCeoNlXCl4n-!%pv@Vm9NCcf(KXR)_bxMX)~B=DCeGMUI`BD;yqCbF2w%3>zCi|*N- zzUxjEt_1l#npdFe**`|>PB~2EG?B|hZWF63hTnCkKo2U~gX;Al-cEW%4_|*i6ZuUX zFmcdC0TTsH^fuAQOm)aklw?; zA(l4%6-UdMD9e|BO?AH}egld>73}aeP5hcFn5bx?Dmzdpsbr$Ei7Emw`aOg@&Cwmd(woSw4^81F;UkE^fxiU#3U1wO$;(ADX}(?n7VB!$cEZ`q1@0l-S2tGR4GH6LU<=H8IV^bQ3d7%rx=0IGZOB zNZFV2^`+{4sZC#+#o6_x*@E)5^GwV)vB1Pa6U+M2j=priFByF)rXTSG01IUAM@vjB zHL=OWW|lFr+{79aYq@opSZQJv2darO{V3y+VB3ClITAmlpKsONesrrJtuwLS#0C=^ zP5-~PmS2Z|>qmd|BkE73`%~xsbi97t786@d>@=}U_+gug?Iv~zJhVT}>Cc-r#O>@) zwSI}+ZDNn#D)IEYw2)C{DjYRAM+=(4v_u)e(4x2b<;k<<-CXRCJuu#~- zF%!p4{BGig ziG?>N-f|Cb;yp*ZiN82*xf|gQcBpS#`eMn;52da{X~j@FJ(SF$^q+|jCO(>ovB0_T z|KRn9QTK@neTMn+%ZJgT$Kj+FzOWEyA>KkV3$Ydg7J?S`4kPblEI+GU8b(itQIg?) z!TC!>$U<@pDJ&#d$Tgh!w%cg9uWj^jS~8pt2%OSFDhpXHd}SfEg)|m2TKLjJS_|nc zq_>d4!r#NG*a#ZjD$F&-m$w+?j4IFp6UmVc+nVqw$>e_Vp^^@~T)sS)&O1ZA_3 z-9jDDkk#t+g z@ZT%eNXj*e3Pxg!SUkA`6D>@#P|QMc3*9aBuu#H6NeeA4w6ajjLTL+4EHt%H#zI*O zjVv^_&|wsnvoLZL)yx$rZ=nKPazD1Bpw$GeBxq#|RRpLiD9h~b5mVhl4RKi0;twLI zD{w7AYYWOU^#ow~1_IQ#z)U`D_*sDQ!clbOeTe_`-!_VxS!iydh2=LfUKW5y!1&eR z{3tR<`JQQQp^b%(7CKpIYoVQm_FM!D?5_8tDAQ;<2;m|iUBSYYO!I^AfiiHgpHd>f! zVH(GSg~b-8TbN;Cu7!CPX0qQb%(gH`nIaZs3sDQtEGTS}1T zeW3kR8a9>QSa@sUorS-I%(|%*dm-WbsZ=|4=$%l=BkKQJc+dT*WVVstMgbdHY-F{O(?%{EU)jiJBfE_pwqKQR z*oGNYa|W?<2F>uZn=^xQ+sI=huZ?^*_7n+knn5>akSxv~c$E;GN%?0|K^ui^6t_{r zMqwL8Y!tOoOz7kv*dI(xNZZq|_f|7~ofBqKNiL3!(l*N2n3^tb=}bBxPW>>Gp8pj} zHjA>%qVhH>*cf4Bq>YL;D%ogjqn(Y)HmcaDZ=->Ysy3?GsAZ$Jjp`!18a8UOe7ZoD zS=4WqpWX6Vv}+bk8G<@C>e{Gh$6~@jSA}tDUs8(aJ_^8*N0U=Y+t6+4N#I#m(_w%=6Bn_BJ}$ z=xw8qjgB@t+304YyN%8^y4dJy^Y2CeYU*vHu?PS1t94eY6q}V`4_0WSr;T1hb7j^u z$IqS9kU2Da4sDx5eQor!G1$fs8~tqzurbiaARA}q(A_!o`m_AoFa0K*VXlAqP#eQ+ z47dF!mfCY^;9QzB*Y8`l%%xE_M%!3sW4VnnHombj!^TV=|F<#D#v~h)ZGRf)cpDRJ zOtf)wF8!J|PM%B2=J}60tb7VP%EmMs(`~T3GR^aIEHaO}&!gq@=*T>}J&$JDm~CT$ zjfFPm*qCc$o{jl7WFh=cP?}E@0>M1<{qS34W3i1THkR7{!5~%Q#MX>-(uqf*CU%`L$RUSIA`O$jk{b0HZIt>XycmA%LwC=jmtK!*tp7} zvWO-uqBRL|>lRUgpg)Mg!xx7a(G43nZQQc)Ei23r$kQbJa1kY0OucwVw#77lYWO>D z3pVa>BrhiZnQPKwTDF*euyN1EV;fIw{K%$q=_7@w!+DNo{8A&`9uJ~yQ@y9Pd`x`q)h()+8#o~DXjtNUi z=8kSD^;k+wH5&3s zcNq;>Mx})0q-B)%SnwYk|B8Iyb5JewKg*t7M)#HxzrVA#k2Yc)eB~gU12{MEatDzWNai5cLBK(><&=Io-Q1ec{$4QX_+4(CgLnr8mlOZ4Qg=DcUrs3; zBsd5=AR%ykIo)1P{Ibcyzb*GaS9O--Q#(lG;7bRY9He!S&Ov$y8HD`n<^HE7-Yzhs zgPbeK?h)o6lxnOXUKW@&WOk6nK~^EzX9dk&LH#cJ!;E|?yMr7KiaIF97dpu0AiskG z4stul;~=ktd=7X7`1lICv%)tfL)s9(q5rXhQmmwc4hlIa?4XE)Ki|jRtr%B#CG}oO zCEtb?uB06+$yiCn9h7iT-a!SCdr1dn9F%oX$^n0XF75Ez;J(_gR#BBzRL=3YO7s`w znnS$oPelin9K2jb)g1hHD>!8ptyo2s9aM2p)xo}1)FKpjZ52IQMS<1+5LrzJwH(ZJ zFv~%02X#0{2R$9sbx_Yi8wYKO4hA?F$YHjYs;s4!YiZJ2TE3PJuH|8Nims(04u(1y z;b0_3)H)jGfZt(xxG&c_8qQU`&Ug4I_SHICy^ap8qtWb{b;M~bCkNvkOm;BE!FUG~ z987dDiCt8iZmc67!{_;^PuI~O>nL_TJzt$L)xk6e(;duU|E#C->nX{-;HdTV-DN-U zIL%#8vmMNFaKOPq2Xh_FbFj|AdI$4at%IcwmN{7HV3C8x4wi_(Xq+N+Y&}Wq{SSYC zuBR_H5I-I)cd)|28V75+6>OlDT*X;K8#mA@2df=k4?niW1{$z|7;rm1x`DpkK>UGk zgM*C@wmI1DV3UK*>~jZOxw68<^Er2}^zD4HfnqoM|EV$F;b5nOy&Pa1*fss`YnOvn z=YqQ(>=AWZbfYiEj}r|y`ctj;JG?|j{GX3wtow0?92|CV!NElbM;sjG9-f`=;FyEs z-19p)$>Fh)Ms1`M8;NcOA8(|jn<(QZD!PfzI5_LzoP+ZY_)gSp6OG(N^EZ)YhBt4b z>zn*}@|PT3cJQr(@3_1Ut~$8p;5s*`Juy!<(bm`gt6y{z{rWaG$!5CY;HHCH!sh&& zsm^Aaw3%)@xZ~iSgC8B-6{ptt?7mpo0aqxy)v4dY6{OZ8wChXv;gWnwJ4h#p04kQPP1Jyz0E!2FA z|3xX{K<366i5<6vl3q$M)u6^zv&Fw_Pmc+>DFddkjkC7cZ(Hce7W!`s@hH0Mz;p0B zcMA@p4xTx9?%)M?n_DUWR^sL8t8S&HTdCJp+Pszc52HUEyyD);!E0{yiJ>!FiN6j! z-s%_1o0ftLpCt3i7!#ciWX z+o;7h8oZ6*B8iJ+E@E9IbuoP#9ZV9pcALL5=@%}TvfEE@qnJXWz0nYla>u!dcah-o z?!XASNbVwqi{4dZ?rx(MW>DQmskRgU$MNppSaOllMJgAmUH_KBpA>U!r;^*L`*s?) z-M4@Jc1q_Wy^As~%DTwlBBP7EF7mnf(nTg0*<56Ik=aES7g=3=<>JJ4y1SjM?eu0l zg?9K#vhASCJ1B>XoGx;?$nAm$rrL;8eRj~y9hAq#*&Y7>o9hHKzl#Dcin}PmrE^ip zMPV03T)f&rsdrL=om6Wl6?HLjCmr7D>tDN*in+XPnGZ^ef|PPm+V!VfJlaY8{m9x$ zfA6G6DdNhxDDR?yi-s;LxTxr&s*7qaDzP7SQDqlZT(sXsj0f(bX}joSs=zKYwz`WN zF6y|b>tgvXI<$*wy5NDDS}tm{ZNCHyq>AIjmeh0cU>ET(sEq3iOVaG7Vb>BGxoGU7 zm5bIcnz(4{qJ@i=E}99M(YtBEZsKvX=Iq$r)M7WC-R(avK2PHhwY6b)x#;MklZ$pj zzP*d+ZhE@gFM9_U{Nl+eZV&ZO6Dqog8t?I+CAzxk#$qm>x#;eqhl}klcJSpcdU6Q4 znBk%qM}>=#E=IZNy zP#42pjNlmCOWx67fxR@$MZLYgRbBVe>1)0dhV7-%F2-&}MTqjUrKUFUr?!2EC?5E}8svfyRJNMJK`)QSn)h;%;*yv)7i?uG+vCmy-`ziea zYJ7nDAE3hreDl^7ifjBfw8_P07h7CxWy!SRuWuy$dVu(2rFVd~>cMRs$p@+0L0^8S zi(M{$aBM7Les z;nwHkdv@B=0N;rY9ipd)D14a89QFr(TOFn!UHs%C;zD+DpIeQKCoX<*@sK-z7mv8x z=eSK88hn@*9i}UX>G5Gd3r>F?re9q=b@7{vL>GZ0RR0KlbHv}fL}H&Gq31^^=}|g! zgdQ9r#f9p^bYXFQiE7nd7%rZdi_3PDVn4>F>=Bpo=LCMWv|TtZTo)equ}7)WQEGOS zj=l(uI7+jR`h#ZMkJ57&FStkYP{_mYE?#oK>LJ0yAKW#$_~;_W!=El*yZo+-zg@iH z8aYaDUAz-n|8kW0@a0jzAlEYo{^8Ew#d{b3aSwcqc%nj{W7Ogp^*To5kI~X&^nvT~ z7+pR_@Q}nqz(deOQV(BvNai8d!-<38pO4YIW0dJQRXy&n8_8ckTO6l25AhyC9+G?L zbDX-n!A-~M!EyhS`m^J7_;e5_DC~heeB~jVhm;;tdC1@)qleTU(s)SgA)N<)*W<5~ zMNj;n=Lemjg(oPzheIdm#}o9WhfE$ad&uJX-+c3*q_!t%@=02ElFpx`te$^E;kw>; zEFrsx93Jv`$m?OkcI5Ps%R_Dt4^R3gc_%6LDL)Hd`Zb>i9`wuap@4^l6j$^VwLC?G zPf>Jh!u(TI*h3Ky^*uE3P}D;)50yMr_E6kI2@hpGl=D#1Ln#lXJ(Tfq>J(Y0=*=nO z)!rh><5HZayr-$*X)5obf(NZ_- zjXgB+(9%OI4^2HZ^U&Nw3vprbGrs1oXK3^pdhj;H9|ZZZwTCty+H$4Wi&=Aq=H3ie z_%C$j3_UtS&(BZ?4;?*p^U&QxCl8%Hbn(!YJ@7U(^I-y=^%a&7lz+yleU^G~Mjm>4 z=*5+rKG5+jO*>1+&Qfm=+%PkqBcoY+yzUq>;_!*CCd2iL<04W_p0y_!bHD{Z z>nRs#?*-yfopTrHXT~1(dD!pafQR=ND91&zeo3f!k$6@T3;$Z$e=0ca;RuHxm)gTo z563)Q^l-_;akjz3X%A;SoD^By3&xxhVC+SIn#!V!bk@T;59d8xU}G-&2E6maXD-qM zf%$F7xk#5iT=8(z!z~Y2JzVo}-NOxT#j(kGM)W@ysrv3yZ0 zaEJSxOEl{et-0ina9+DaiI*sFnQjkC{)2~m9)9zX=;22XKY4iM;jxGN9v*OS;NfQv z11{6#%e3#Z|JTp?%M^QsuI3=Vr#$iS3&){{r=l#yulQNFy5j%n&0xe8+Hi#=4-szH z9&`_~2gQRbgwF`!6}3X=|BJ78Gsu26JeVFV4>lWfh2C7Dz*Wj~)qhs3bCrf)rA1fC z^APorFN*w8JoE6JJJl#cQM};JpX!bfB)%hC#QRNT#EW1X$zwoJR^ufbN?&PCL7DY@H zh$2Z8Nu#)bjht(KsrlPS#zql{A{a$n6#OBe$#v>;ot9juUDwIDPDkg3 zxiuw^B1IHmMv*CsgebyMq=_PJ6ck0uC{jg{Itu@*gix6G2J!P`O>?0A!= z3*ikn{b@M|Zc?r&az~LTioD!`oR7V6lboBxw_5H2Sb#q(@atQFCuq&D2hZ;G>Vc@l!~HQ6vc&x5?nR6{I-_;7L~h2jc(D@BB9bze>}X55a@f$pY_51 z8Gnn)M^Pb)s!>#nqGA-4qNp526(P3h79F}pw{Q88z@aPOqCDSH^(bmY@&9Q03Mea% zrfnW%_wFw2?ZPd%yF0<%-60TMf(Ca9?(XjHfrOCY?iySJ+;PYMntA{4oH>1ZW@@Ud ztE*~Ss;jF-P@Tcfi+<)KN z1ob0m5J5wx{DP=|K}@|Mc$+7GyZVBU;p_#`B!Z?9G>f1)XO{S{zFiPGF8XhqT@*bo ziZK^Os|Z?0&_03=0iA6kXd6MhAiv?FcwX7J34HM{yJG~MBKRqS&Ji5D=sOtP3{d^K zJmyo7$#h9{ji6fu&mwppLH7uHM6fY}O%e2rpjQOHMKCpj-VyYPV0Z*0BIp}IzX%3J zFgSu=BIqB%0518j8o>$`4`5sZmoYy{(2)Gvz+mqoeDqVZ+X`Lh2BU#l*Qi4jbS zU~&XgA}~Z;8^-kS46WbqW={ia#{q_BUlo_(g-_4*F^biVqFC5BiIlCw7Mql7W0kO#A{;FHF5Bo z*vtwN!KnyNN3b=5Z4n%f;7A19BiIqa-U#+Zurq>P5$uj&PXzy66KR(Fwj#lGpQ?=4 z#l&CY+3#_G1P7SU5gcND30@7q?r*4{cU^3-qWYze$>qfzjo|kP{*2%ROGO07Blshr z>OcUW7{R3oF0&-_(R(?g*#m(;=WFE+!AI_{Umdy@!Sx7kut8%r z{OZf?-!}wDl=}CENP1Ibz3H3HI}zNC;9&&+MsP3UyWZW8;6cRy8*`5y49~P!cjpcoo5GwyP2# z;Y|c@S(YL&nYU~_+0I8GGkIS_C@l_-!FA z@Y}S1@M`jH!Hem9Yeir)*%5q>z=^<(z>DBx!0_X@#r4}ly)CNV@v(Ie(k~Hwjo@1Z z-&wrxh>dr|%1m)=-cR2V5AFzabUb%65=uxUAuK^iNGu_Vgcu325~3vEghopUNxWYv z%DE#l-xXEviawX(JKhy>5|Ty>xKfxA8pBq6zkG!oKE zNFgDmgj5nzOSlreWtT99;p^pHk@TJqpH4!02^l1042otoMueUbLQ zC~{xqm-wVAQ9wdLiI4f_Xg@yv3^{0Q{4NHNP*g%m38ex`ib*Igp#-<`eOBjCh6ke9 z15xXNPjhJrWh9i9P)@?k2V&0yG5tW8b>#d5@#KL>_)w&KC@M<$Q9>OFbtP0{W=g0g zp?ZM1iiD~`rs6{%8*j~S`%u)7P*XxJ3AH6Y15wO)D0r%2X8>^jp)eovS!SZ1g!&Si zNN6gdfrN$<8cAr(`2Q8{|MgM*`mgxoU*B))!M~#LiEuLs&4YqkNPGqmpR*&XJo3T# z>hwsome5AR3JEJEw3X0K!f**AB(#^%K|&u1eI<01&`Cm93Ed?8B%!l}E{u@D9*G5y z#I8sFbT?xw`ziKDfVsPb9uj&7g=YLC)KkK+xafS@!@S(qOXB0sqohZ^9p=@XeiD9> zFi65+?*9ky10)QTz(*i4!q~@x!yx2%EE+r(LnQnvVJM?w%#VHgul*R^dw*!|W06_J z?GK)elrW0hLc%NwqZx^WDH48@Fjm4i36msDmM~tz1a62YzOUd!miZ?l^AjK2jI_Sp zX#GS?ej<3KfI~4)l`u`hbO|#gEPo<)%2B+Rgs0S|q>L+*KknEQk?EI#B{*iD>!f960TrvHgi*e6|zuNL# z@H8)%xaYYzC*iz=3lc5{l$?1k3Z#pv8XuSaW$f+eLVYfxUx+Ibu1dHq;f{oB60S?Q zDd86555~DS*qFQ!1z-3GYrGI0UWfrN#QYcHu7rCM?n`(OVBYgW{QW{)`VdlHh*U3q z;M_08BMFZgkAi;`JdyB}@yoa_)B^Mzhql{M)UbALNNFd{lgtrn5 z38sYqBwiMTEJ2a*Ucv_n5eZUIZrhh)92Xak-u6=b6_krte(9SK`Sl@mazb3120AWB6CR{mP$nW901k zUE#H8@mkDzEg&PIjCdJg8Hr>hmJuT(Rz?yTQ8J=s-YD(=0$5x*-TYeo{#x96?IZai z#!us9B$bg&M(MuEIF#$h;8lh13pr**#UHf9nI3cq>}G6@7yI_P62(8JT31lTltqW*J#z6p&F+MphZwWaO5S zM@DuTIb`INk&D|X`0&$Pf5@NrdVKQ#MBe{I&HsGNd1d62kzZ!#7BS>MvFtxFx3S-m zIQE|?B%`p55;984C?cb%jAAm1%e>$o^(OdMyc0Rzi7M|zt9N4TJ5h=&E~AW$vO(20 zzVp4I_$ShGNK*E$#NB)UlretJ)4XH5h8w*XgWij}GU~}_ETf5x`Z5~GXegtRj5Slj zv)_y3@5S5qJX7cY&eDDmc|VBy>-AO?K!%W5g3m5c>kkc`$c+Q|4- z#!wk;WwevgQ${c5l8g>Ax-h{qI?CuI<0l!NW!}IWd*FjV<2vqm=!oLyyf zlhIv953X`V42TGxr|mx_yffmL$k*|R=q;mnw z4WeDK{qG`)GpjL3#$XvkWH$R^wIu$M#B)hFl8yBMaCnrA z(K5zxL8tw(&y4e7A&ay7;tI-Qyo?DlCd!y3qq^+l=^~3=LFTe7k|-j-B7T!GRmLnC zvt>+^FPo{^^2IPiZ!Y@ zqKb>b?Y}{~PR4o}8(3R4vG;ov@Aycsi4vNqp^42hw#e8i^BF_fDr1|B?J{;SpEZ&H zgD*}CHE}=_w>0rq6D_}lcgxr#W3P;T0pE_c5#KdYQ1^>w=XOqO=;EM^Lo)uB@sEtd zGLFbNF5?dwM`ipj<5=(^L-r58nyL%lR>`|x|CDh;#$Pf{1^`=i@u%+ZGfmzwhWod# zb-`QtPRTee>njLR~v$hgY#Z-^m= z?{r-}SzN19(aQ~S((nnsA>$@1k%HO^ZppaKW=cW4f;%$q%Ftx!GVaN^&vskJYZ(t@ zJe2X2O^1wsWjvDcSjH1JO{O0Yvyds2_ept}-^3KXOfk<6qdm*CIP3eX~VE1&I_yD+npRp-8MCiGrvg zAMc3Fj{ivqM~rnujDlDNaSDmlpTX5s6&EUHY&Bp&-A40t!e$ zas`Nz03d$%btDu~Mp54OC+t4SG>657VNwog-|0i=QD)>=BRRz@) zR8mk`@u!rlD7;7)JK&S}+LpIuMKk`@pL}AfE2yEMrh-GC#QETf9Hgl}i#iJGD)>#o zR0Z`E)K}0;L2m^O6f{)OPC1WaNvp<9% zm(K6##zu=)3R){@qo8fT=SiP^8kT+*ohrrb{wz*^7RG1MK|x1;tDvibP6~cf&{;tj zZr?AWz!%Z^i~k8@qKm~&o@WG}<1K>JeMf{!p7m86{VKZm z^R@3@0KoIHqZEu*FhRjY1!EM9Wk?0%gF51yPXPNGolhB)<(nuG+)h$3Ie0sT`NmJa z@no7<@Xg=av-6vnreL~)O$s(En4w^%f@KPpE10EVwt@u;hhfAV1#=b5Q!rlvud`fd z3|+&c8plk0AC!aFaZ@ z!CD2Y0+Ln-DI?kXUHtJ~JoqlwDOj&ygMy8Ue=s_~icdhr6A))=B%oeFW(zY=!9f-z z1=|#CSFlIHUIjZ8>{PHz!EOap63~(av^N3qjBEWIF&7fh!vtg}pnVK>l9wrQK*95D zalB~An3IEsaa<@h>ac<%3XUuIL%~r6zcUT2wuu!?SQ+!6OBa6O+-9_xjbXs z9sWeYLk0f^^l-=vCgYxh`wAYg)<^rC6A(AK1htrmBglRbu)tfPbgp@0m#lC#Hx3 ziA_NgzmzG7XR~yXLhMz7sTU9=t&a# z!q@&#iYUqxMeM-MynJtBPzYa;nIsf4n_M#pvWH15w(2^9}Q#1|KoG={i;!r@R#t0==V+)VIQ zRzMELWqo}B%qNa*^D(b7KrJ}ZqIx6aN zO=J8L*|~Im`na+&)IEmA#84SGs)34zDjKP1tb*f#%#WchF?2D8IFuQWL^vMHvlwco zqPdDTD%z@Op`xXVRw`Pnuwp2AEES8T8nMKU%dS3sQb)IsrFJUXtLUJjql)3N#2%Q5 zO2*CN=eOdv#u6`WpN^%@D!QonL&u*wepbJ+LR=k=PEfrM#WealT=JrF^)x4 z#RL@-ReX)3v`MLOQet2FdP%86QW}$#)+D7VDt=QjRmC)BloC>sQfN>(IvIV)9i1&1 zRY>Ny!b}yjR4iAqLd9$qb5tx;u}H;S74uZgSFwOK=tX@0WWJ2 zmZ;pLz_LI}IRwO&WVG^i?B8E}#|9%AC5oq&DpsjjuVRCW)hgDgSgT?k3uHVsil^@J zG$x)l#M7C0dK6DQIlNKDCKa1iYzc7c@kC+D9;Rwx8Xu-}VR{^_NX|>x}##RihU~ft2m(IOPE>->LvX8P7}oAqYHvQ2|BFeh>D{serG); z|7{VX*+g4|{GUXB)QtW^#h)tvR`HLD6Ds~<)lMN!GFR`3heX+v`(IT~PVJM^DHW$# z2UVQqMhu>NpW+rLr@hIE2Uhoz({4WhOT|SM|FIgXxTNB;iW@3!s<@)!s)}nWuCtm1 z8-5urr6BGqR8JV@u^tP+Efu#_yixI%tNb#qU<$g!QoSv7R|N-hxu@bjt8Zhh2scBp?kwQaC4XHGw)-XRc?MzL#Qq!l@ zG(7>Yy!hpoPebW6q}PyJLmmwoG-T9}RYNunKWNCLA+yF|Fws2?ElA_HZ=1gHd(zOw zOW_o0=}N8W>>6@t$f+ThhGJ=bgbmUX&wl@!mgc0Tt7++FTFR>-pN2vj3Tw!(p@4>h z0TbfVQSNlqcV;~Q;1)d$@s`pe8j3O=4aGH-OXp+bt4TWIe=8sI%X#)fETy5ehGrU? zYbc|ktcIEzYB9XV5u{OBLlq4bG*r~^qlQWv`lO>t>1bm*Iv*f>l#c9l6iQE3HB{43 zT|*5fiEqGWhi_E+<3YpA24p@v2p>T0N`p}vL&{P3%ImY#TvqM4pj zJ&G-tff{A-sco#GiH4>c{@jZp8E9n&I+B6TZwcMXKu!i~p`j<tin4tu(aO&_P2- z4Q({E)zD5udkt|JDR;)8T{6L=s zWTq(^e$y~DAZ%x5I-S`khR<2%quys|n5khNi?N1T8fI&lqhT&9OBTwUg*q1X2Ufhj zs7n?)S|j?mEVMwwLXD$9W3h$}S%`zloXJAZvd|I@P8Q0Ql{oGSf0AWt{BjK|G;Gtb zUBgNyp5ZlY)UaB^8V&0-tmpR1N*rabS5{ifG-UOu;)@UOKFD~o(k2a?HEhwaHK4rA z$oTtNNzO{)Y{b(PKV&1edpk7j)UZ#(ehs@c?AEYH!(PpwA1I!UIDkpxY&0qx9nMDA zv(fu(bU?#F4Tm%wW~sHc3VeC$7c;+*v{)nsN<`KZ*2KBB;bA;PlV>7qj`L4 zr96bZls^)iE-xk0kyu9(9Z>7IuOn3enIaz*$>(FMm58??G$udo$?xOIrX#zKRVR=mz<)bG zv8Nn!Mh@QQ){#d?0UZT{w|RBs(~(~X&(A~`pd1CLd;w})fch067V<*6FY1K@Nba*u zEkHX8P%$0Fbqvw*tBw*nO6q8;qnVCUI!f!PuA_#IGCIoY_)$kC9p!YC*HM9s(D9}K zB`rvG3ljUgwmt3Jmca%6&U0lQRdiIvuN9=$SN(a6mj$V&j#@hE z>u8{(wvIYF>guQ$&=y~aI3`TlLe#VnbuUDd3eg{hsG*KVIvVR}qT^~IG71qd#b){( z%PXX53j0McPnzp!p`(Y6o;q6UXr-f*j-Pb2*3m{sdmSB^SB0r9zbZ`Tai8FJL5YZPN%j{Z6Z=;))Pua15?e$g?w2rVx{Y^&Klj8l$vwyy|XE=35cs>QpI8e`Sjqs$-arWh@vvhU*xiV}_2II!5XkrDL*=DLO{$7^7pXj&Ztg zd)aw|Yt*7Bjpuee5t>nyCIq$XSCl5|n8f1Ez9mVL^0lQX{ib88j%hlk>$qE#QWv9w z#i(vE;_yxViqXPiw7(e5(lMLsu4AE&IXdR*n5Sbt-zJV`=cO7&!WWCt>tgh^7^N!i zH^Cwui*+o~v6N+|I5jCw{fZMGLCZ%WtSC;r0qs_CTA^d5j_q7`mTDcVb!^nJNyi!; zYjv#Wis)F!I-WN!RD#%FR|+s^D?xor(Bcxri_V*Mj;D>SI=1Q9S%Ut!7UEEE&r1-; zUF6f`d0)@1_fb1_?Bb@>aY)B*9eZ@_)v=F1jG;6oec@?PlJ;}Umh{O!P?DyWqyx;5 zlEj-*59>Ih~WI?n63!2H*7Psc?amvmg$aYM&t z9amV+bzEb`EJZVe64#fabEW7}DWB#{rRk=QTRLv*xTE`LO%^XrO-s|D(lom?rAZ|A zl=i{y>v*8!iH@f_9_sj4$0Hq&b(}3tC__!k5WAoc-X700$s@~9o9bDFH7mlQRQ;^ae5*NNpeuLmEhDfPF2PFkS|Y zp6f4RumLahqi;Gg8u-CLCIgub)cuiW|L9lk&mT$tkM z8pvlLzkyr^avR8FAg_T9mFRdSx?P^5)016^I9MMKQhx0pE?}UbfkFlfbCoMo=E_vJ zGL5KAb1IWrnUYlT$1=qX6gN=DKv@GN43sob%0OwRzlvXap&;#$Cx$0Bt5%^7Rj8bS z@&+mxsAynZ6KS-dg?P^q?>6Gn6IAtSC|H#~)CxB=(8xez15Fr7RT@^6 zmRF_yRp~}m`rj1so2t~@KnnwH4YV`R(m*Q%tqrs>@VzSKtVZ>!QI~3@{}8utmA?gh zNHuD2po4*q209s7Rn0H!*1IUX8nvzN=Lc1%HPxvL%Y%Ud1_m1FYM`5e-Uj*@=x(5g zfu06>v9ebu-WB_(I$6~zTMcSbgZkH?X*H;?fqn*lG0@-eeT;Y3pmQ~R%+EOuM`x%> z>=Hc4z+eNz4U8}_#K5lxh8h?a2w~}(w76)rAMcBuc52eBnsl|M|M^G*qnM3>zx11$ zl%y7wy%8SE&0%0ASH!@00}~9)HZaG)L<5ryOfxXuz+?kc4E$zbD(gZmA61PYZB~nV z2ARdRXhu-&;rpC3Y ze{Gsnn>ZNJ`r34|HZ3)<%)oL3D_DK%5FaR6pbmAfLsRO|KO&C9r!x(!4XiP+!@y1h zYYnV3u*tw?19uN%J~2aKgY}1}+=8V&J5K zzuCeYILG$iz$v!;2F@7J>QSeIA^xfHAFWV*s$8Eq$PANu-oOO|7Y$ruS*=e4>eKT2 zbfP}#^(koss@cGww7hEInt|H}?ijdk;D&*l25#|(UqssmG`4|X<@pV0cLRFcfIek0$5L(JePG|FG@@m}tCz|C|L7@U zKOq^A4VVTj1BwCFfNsEG_30!umd3QvtdjpUBBc>UH}=uyY)nlahHV3m0nflkZj^j+ zZXl3%YDQNHU|1zf&j|NvOvir@e=+ctjjf4{Ccd$nvn4l?%tQhcFcD=U+C)MViA*Fm zk;KG=#(r0Ab7Q*Im?DjdH7i*Y%HD)RCSpv)nus$|vk8r8LOg~&R6M*TPt1}gbh8N^ z*p(pOMA$?s6RAxI6J#QViIgUin|R-ZVwzHhro_>JpC<4vJj*ukc`4MC(wMx+j&vr{ zo2cHDIyR+jQf&XGw5TavYf5%g63yrb6PZlpH&MVuW)oRV3iQ0o>nq6O`0K`*j}Yn!NJqOOU0CODWOyCmIeL2p}7zLr$CCH>rz#R$Zj`#MsAnsh-HM`9`+~Zm6?HJt(L^5;eNA*S@so*eCc2yGY@!SE!9-V+1AvEl z>pJhIjNc#sS1WqeiZ-4NeQiZOO!PF-%S3MmZcW<3(7e`kqP5R7c0PICn$9Ii+Rwx< zCWe^!)kJ?2156AuF_?w34GlEG`%U=Rog8f_CMJ%3Yg_aWbH|`-8yae2n2F&gMwpo0 zhIscnk2+mD>PQ=s+fb^uRJbjTHZjJ;M-!h+j5RUN#GfWkm>AEZZeopzwI(K-m}Fv} ziTNfbo0wu^hKZRbels!E#55DrneAeNiF^9#^gxZ$a zOMz#!(zm0g?Py>-+SiVxcC^66LKDll6_`sV7MoaNVyOvkW%in8CmFOSj+~aWJyk3p z<~6$&CRUnQWnwjpO?w*Kp4POd-`o2fdmN;0ds=5=y@@?0_L|sWVxx&|CbpZ{WMVUO z%*0mKyAG7619j}+PeYCDKnpvN*MV|$q#Y)9n%HGxHw#`zYSob@bfm={X?I8B?T{xs z68}f`nb>dQh>4>n4wyJ-;*g2M%%3OXc}I%tL>!r)51M3>a&)5Bo#=NH$4neI@rQ{I z^<&0&q8}qsYdZNfFG~=8s1u#*M1OJT-^61RPfYx6vNH^>nYeD^l!?F*2OQV zSQl#1g$8t?X~FH*F7(vIGZT^t*~D`u&%|33|CxAc;+2WlCf=~>y^g!sh2-E9Hl(pX z`>2ZlOz+qRGG|Og*a|(4t@AT+R1*%F()ni^^)t=-nRxG*!Xm_PO;{#06S@f_Ff!|Y zrn5hj_p`syvq%a3S}1Ira7?%+JZ|N##B;N}{>#yLDt7f(vbaPJ2J+d&7ZYVHl(q1c zjlYQu7BX7+&c@$DG7Iq*U?HJ}XbT|=i7X_xki|cPiSQ(pX4qA)STv7HW5=f!+P;aJZ!9-DzicpL@5u(+?IhS;%K0 zzlF>evRKGzA(w@$7P48$ZXpL(q=yfjIY>EEs0UT%emZ=tn?HWn&asA!?Cg?bi#v{1?7b$QgVP}xEi z3so&t058& z@hta{>sx4Gp{a#t78+V;WTCNzCY%0YhrairRDFHdj{JS8t%Y_LdRpjZp*;(Og)YoP3mq+Vvhb6I&P+Um^`(ED zxM6*1W?!H4`}z{^-|T9kn}zNcdRTbWm)I*Zbw4WI&j;wyk4E>St^KICg+3MrSQu!b zuZ4aVezDNs!ijz)_oGz5_`r>Sp&7r>reFNQ$RG=YEezpfUl=BMdnZU4EP2J~FTYT} z0!fEk7-1p7SKuo~S{P+vgNKbCMq3!e1Uu;BV6264Tz4C-Y>c-sfkoX$w2g@tCRsRV z;k<>(7N%I(WMQ*~-z-eEu-L*93)3u2w=mbjJPR`{%(O7e!feYwmOW2@`msN4Y9t!< zr#Ti5^`{H{eM2<3Kh0;6v#`*@A`8#^Q|ti0Y8>X}kR8irHuC^tbGp>RG7GCMtg*1% z!U}E|3#%;fhOBY}d^5{VK|_NN*__TBKx-|mv#_2k$S{lI_YI(%1L(~F`ZRzxvVtTM z9LZtU{n&H^X^Vxe77klDVqu$w?H2Y}*lS^jg`F05S=jwQt;`%#bfDi8=rWMT3?z;w z#6<41u;0P~3kR741L^ocx-pPG4fO5LA?9bbFz>(!->opOq&K12a1_=EE!K8-m!4k!aWQ38R1}J|DSVN1zRm;Fhvic2197j z5c-!z*TM@%V&SocCl;P@^97_nwV@t-rLyd;7~)s(uOY;Nb6;6_%@wimmWvod z<$m>z&wyY35y#by@jHH{lfTk?3m+`@)x<{&5et$9-GX63X0#Sm3z`KsN)LYZdu#Tu zlx!#!A4gOMlu`8ZKSXfZzF6&*dQD1c2aRT{W_eU6^v$4 zpF5oRkQ$cclr~b?NMj?djnpxt*vM!jtBq_n zez1|rMrIpXY*ZLQ-A52_TK5n=WCX1oLF@y}@vO4j$YCR=ja)YNj-Xc~h_`aE5IQ3$ z_eg3ml5*R~WBb3MUL$GzNXl=cfQ@Q4s@o`NqmYe?Hh#2G*hUc><+&gmD@W4NkyO;i z+mTev28SXn9;BQp5oAgRX{jJBZKF((DI28af|Q*B7&tu2AEoBzbQD#xQQ1Zn8&z%m zI*Qhfq9db-BSf*&!kVL@arynTIBVFbX`{Z41~zKhsBNRJje0if*tjx^>W}uDPaj30 z(Zr(Ic{Gh4?a$dZw9&{$V;fDlYTX43=ep5!dNe&5O&r3gsf}hfzKy2lHd+K%#xXt~ zzPM-G+D022|JrzDqpgj0HWt}fY@@x64mO6_7;dAZjZQXxvC-egPc}N+=wYL$jV{bp z8{KSl57=9740W~rldT$zp^0N?;~1L%HI~QJ=f+Sk8@+AxvC-GY!Gr$j{^b}-HI`b9 zr7>e^$yn-VWBXX*F7W^x18odp7TFkNV=xOduY$e9?_=r4Sb9B{csKV@F1lwt2a&r_ zCMNkfe;I3pjgdBfvoY1iC>x_~Otvw_#uyu8+2-4rz$_Z)*Ls|dUgK!SIO24ojZ5Qb z64&LRFCJ$$`-Ht3M;yA4GaLqo&o`fDW4etwHs;!xVI#wM;_&ISZOpVWE2wqn@ib{X zZ5&TW$J4d(^kzKGv%v?=EU+=(#^>>rX#y3VKpgaGVF1sWB{r7Y_}#`a8_R4gXLYc# z#l{L2JR56mtm77+Ks_hWDz451T5V&EjRg~E&jdO(f!`cr=+Q>~j zkv6fiOr$asiStbVRvX)F>}Hi@-m;!LaXW1so=7`v%nJa%-j6#sk#?~nPog}NXs?ZZ zHV!e2jr}$ba7)=ZJBiv&^8fFAjO@A~^J)?uv2m2;ZL;rQ#07nwM5QMaZ{ay^;|~^8 z8&_@oY2$>Ab2cB>j=yZ2v~kMDX&ZkBO!$Wx7<}G)GI54w<_wE2Z~vS^XPM^7^w377sWf0JJ+|?L zt&oFk4xZY0#&YN&p@Zi(Uf57RSe6nHKFl{(CR!t*| zyDM)(HaB|OxM|af-Eug?KYiDR7d+&1Essp2JJaYh8-H%WRpOhCuQt9^>2&u&$em6+ zc@^g%spB7QoO=efnn68g5TBT~Vg~VOJ?voj3`#bWgoDyEsrgJw;UJ}h3=T3nNaY~4 zgMzator8WeiJjroI7sVY^Gu(@S3#QI!O&UMFL}(IS@eU0^|L6mgG|rjU(TXTj{g_t zif3`~WtMLWvdyOK4stlC=AgQRoDOn1DCTg;8sv76hs$zM$U$BQeYPgZ?_kz!VjuW? z4rT6W{LNoyX47MKZkyxVr4kNGIwL$4ID67JqH{zsD4lo zZ=c^b*JnjcgP6;6sWFS_TuMF9_n>Rypx60OhNRKvquVh_4mjdmM+esZs7dpvLr~C)dH!lbCkH<{I5f}a*yVW?GoOBT z(AB{R7b9JCbI{$v2L}-cJsk9Ou))Db#?Rv9V6uZL+z<}>IvD0)ILm;8UmOf{FeoU3 z4?gS9Ei#{)&8Gnl^mFkO=hLS7G}yrqmNy5S=W^@34m0P6IygR`uFt1grDH}o7|H#7 z2jd)I0gZAnhD%)FzZ&fz%K~b+fEFyEtqX`v`gjKu987d@c>#S`K$9Hs4q}cfz#(lJ zIW45$987gE&%t~L(;Q59Fq0+60dK2e6ZG|2XoiEkEyCp%QrCsFaUsoiaD5@oaWI#~ zW+8F@hecF<5iM}AklV|_GOpv9(4wHkgeOCb9V}svEuuOVqZcls*NbSmgB1?eI9Tgo zrGr&W{9;<|;OipFvX~kzCO$NL*m0Bn(|X50X5#2#dcBzJ#T2)MHn9>pIOE`~ zgDnoWIylJ9SY*+JnwOX-}0^A2u1xZ~i0 zgNqF2;D&=s+z{2pm8EorImrO!{TW(LuR6HKQn!@KEc5ZST}D%u(M|q#89iG@>z2_i zCOdd_*TFqj5C<yR`|>P)mKov74)BjcdS7x=)HqED||eM zgOs1dtt5#}frA1r3c64ns1Ae+a-p%WU=CqqS6k`u7q zWka#jUlUAsGBkK4ed4xr@ZCWI*SGLrSbiLQ3n15=3GF`><~62`D}8I0o&B#?((9E3 z7d(hy;KVMHxQKBP>mtg<=am$4ar6m#--wEKk#QCAPmRI&T&*}4JTsrn^`k^4busK~ zY@=0v?c!a8gK~SXB3_f4yNZ&#NZ}&0i!3fux=7_Bos0A?QoG<&Jkq$}SdPb55l6a6 z>*CESdi>h=c;w4lMH#qI7o6eSA6#T|QQ&TL*40#ZHKl(L%IYGUi(D>pbBU`dyNjGI zeqBvDT->=5S8Q*H1AFp^OIA}J7yDP!*VUBI#o5)A*9ALSJz7oq15#72@$naOQP@Qb z7cE^BaZ%JoH5b)g6mwDBMOhc+T$BjlOS&lKB5q@R!8KIcMb$OzgzuY5-qpx?j)BZG zsO4Q$a8b!cWfwDw$5iAJT?|-5t=AB@0%y3y&Zk0ET<~pG7gN^Iwl%c*Txi0XPz@I~ zUDR_?-$jEPp;|8PuAw?XzIH$WAIVzRg}a7Qt);Fb!wpoE_$q` z4lZ`DrS>jHujMgX+`_fg(Z#8?bayRrB#q8o7B}cR>gEQ1;4Zqlhz|MssH~;$T5RHV z)SdCTJk1_ed>z$a=Xfpwy+Gi=)aDB;nW3hR9~}>o~-k`H;if! ztHU}P>|zKrGaQax??24Ep31DJrt7I+a68P!r1do11@BPcx2x9ED5jZ($HNaE#<&>k z;-ZU7F2=bS?_#ryEiNXw9EuPNTrA|zT}*Z{og0hW!o_bcrn$&^A+&EjO=aC&PjMUQ z!g_kNo;WOI_6;n}2y5{Bq|ok)NYR1^L|@Xr7DtF5YdR&_*h@(Fa)M zVzG2=Hd?*f4bQ2VuyH5e0>~^uo#V!`|Yf&7hwDBg|>tde^4i&hcrD79J+C+Oc(cMjc&qUiqhg=+X@wIIz-f_N$h7Gqv1Izig(}o9Va<4pPJq{|a86aPb#2idE0WNf&>!2nC=2K9W3JsnS-u>-w=k`SyW}hpa@U zqo2C?*To|jk6k=rwxp#VTZs>3WSC)FX~|Y%n8T;zpSgI>HghW#Fv2gl`XiTDE?#q6 zyLit=jBUvB&|9{0W#i(v`EUPY<;oDv+henAqYo}3%%5$f1P>(_azGdZ6mJ~jmzKw=&qX*l_bYZzj>>-H<+lAxeql-_hN~xn=E@(S>F4S!l+D@FWu$?}; z_`*%>0Uo}xMsKHYtXVFeo(T=!?sH)Bc3QKYPHd;HH$w?MB=V48hd+Y5yPYcTpr$)0 zif33nB=?ZQL&!snhol~od5HBec88B4&O?Ute&1lu4%)JV;yr{t@VpFp_-6-kC>3P~ zafHN)M$lpa!fNb4b;htxYMwFf?HFO7#nJE=m>*akbP_fAUBXg&O~lWy;1 zud^^O2aMfGm(s;#@{rj>dk-BvWbu&ILuC(DJY@5b-9rfvB|YTukdv`_D9o5WY>?g-;HhE zE-L2X?k+0s;qWfvOsd^fZa0h{Pf*a)&tMoF_PoEeN+`ZRP^xq zTIfe6_>Tm9{kNMq)K8*4RLMiPGybTss)uSG>U(J5p}L0}9%_526wYUrVnhvr;C4~;#P-AkMHQZo-tJT&#t zX)lf1OAr5!pSzc??9?_q+6pFDK-Fwnyw4_z3{Lr)LAJiOmW(fg?@S1sUYcMm-RBpLSmD^q3mQ>XpZ zn+@`Q>gVAX4}CoJ^{{zAUEWX6_7evu>F@c=^aGd`2M7nK$N|6fJ_l&9hanzDdKl&5 zR}Xx|%rFnbJq-15>;T<6K-vL{I!Gft>`ClvboGNY<{*t`!Ojpj*29H^w2q$y#Oyyv z<2<}PNFNST=nzfxFv-IL4+}j^_ArHc;$fzT-&l$c`K3?wP&dd-^Dv#MT|)g1(Ja17 z$M~0rIUeSEnC)TRAv%1BE*~QK5T!ay^E}M=z~0&%#31is;_lfZ4~v;I9@cnR;$f+W z70ivp#6SII9+tBh9QI4(^FcZvrrn96S9(~*v>hg1%;o0{xz@w|!_@4E?`pfw!+KWm zBgB!H3LNnPHZgfDil1=s6SjER>f!f~IQ9|SJZ$$+{3A+y#10QTJw!Z69(H-y?cth- z>&!P6Hr6{2e|p&GVZVoi9u5T@JHUEWgtY(1)K@@XQGMag-c$GfF5G+1p}V`gBn?C* zY(*6DucDxUC@O-9s9+*u&><=|D&5`P-QE40e%~A(Z@sn7+UuJ=`_$h1oS8W_)5TZQ z#edVqv|O4FwL?EM;*!rmE=ml=#>)&so*4qi@y&)a&k%3U5c6_rel9IT1I(obxwH@u z<(Xn>F8w+~EXu`xd|IL~7W^!jA#SUgS}{XJGeq@5cI}x0VMQ*j&ZRXlVlJ)9C2;PV zDVCf_VOnHuF0IQYE7wAMMD;Nk{?<%%T-L^1+LTLsb7@~LZO)}FxwIX6%cW5>#a8rS zvoIEy0p6BND`tvAGsRBy9<#(A^j&^-S1#>_#b=49XNh%RCop&R!7MR(me`+52Xg6H zE*;OMgD`6@9YNEcB^J+$v&K(I52Ke*_-HPrXA7(j#XI&1Xlb_iY_>R+ODEB^XN#`0 z#T&Cld_b{M+LYONv!e6J+9B!CgSap>Q< zV%J>Z%oT;_iCXhS&s~{E=823$S%N8ED+Zhh!P7$vxNfFa}6A7=+N5^ zz2i_LhZ;N7#i1u1YT{5+hwgFcUZjt5I@HFY+mTw?WOEdLpVi8t77n#^sKdfI-{%)% zyvDG;|@(< zBp!9*wU>`M`0+<#wTiNPk?8Eu6R755(S5NPuvm;)ES_?xt3xk4)XSl#9qQ)L^A2@) z=ou6qzOh8yzC=6=oi7&8smo1^#f`Mz*IznWCu|9qNHZmWUBc#7|4a zrX}Jfht4b!>7{XLdpp#}q1PPh2eFQ#@>21NL#>vIz7D+#Juek_VZfJ5|D|HwQt`S& zZ#vW;wXT|Z!=b551v(Za@|Hsb92)4*x~1a4Qh`H?j^7=BmAJqTy$1(&Xf!P1&<75E z=FsO34RYv1hdyy=h(m*6!5P_+=Q1BT^x~Y@5Ff*@0_(A5apD7(iJ=aCw@gf3CV)Rx zw!?v+U%=-b`o^IV4t?ds3-9rxjjvIvWnvgKyi6pQi+h%f;ZFQD^z3r+;p>@ik@a%% z15$(IIkeVJ!w~(J3mlsC=W;O;WowjNg-eIVqTfcEi0jaJc$7mwJ2XLMJ;|XT9hwN! z)DdWXp!>STziB(YTugRo?}#*h^_a6l{Nm7KD+GR3JO#~gMO=|4E5z>({Q-AELw4v- zhyHTt@(M8(t?7vMw?qG}5ZhLW_g9FKD+KuV$~gQ7pMh_z6eU-RY3M*!iaIOB42Sxz z6eCxPe^-jx4$VOy;!*>b=EA8Qy6Dg)hvqx909}nk2OV1I&?2-ihc-F1*r6q8qzbnrD;Te=jeI&{q;%_VZ_I)oi^9CG0sYsKQV0z-ni z4sBm6oVCJp$cIa;6X*j2heC%U^sWmMxK(1EzyMmqb@72A9oGqVNp~sXQqm>ErH|GL z%ca@tgy~ZI?-TgD;`nu9(5Q^xJ#--oa3$Z~|-5@07T`KQV1())>RKTSYE|qktpo>FgMPZkUxKzlEcVt63m~<}c zQZbkMZV<&?!p@5>8{*j$e4O4~IC@^oQ_7{XF5$(av`b}B;0dmIyS@y8dO*OXhXc_yp~I~U23{f)N`qh zlBugG`o{V7lVvx?7JOKp64}tDMkpr==~82tnz;0UOAjKhOU+O$}&b`&_!mr6Z~^Vv|_XKi%G?4lZ?c>FN4$e^on`flkVAiZxTEY7*nG1OTArs$tAf(yzJ7Mx2gUX@%$F?;g(qDksVeam&R-nueemah8@+g zfx&;xrG74b)182kN2aYBN*uF)4;1cvd$fZBCu~AN;7%shHCGD-^W0yXGQ6S(_-K}DX zOP{&)xl2P``qZT-w~7H<^AYOOW(OP2_Eax_b&b5(r8o}cHAa&bg(xo*nt#xUYORJ%- zonpmKF=VG`d(wioTQ#-UxwH)@F2WhwiR!z=myI&bcZt6_y~(A`F70q>C)&>L#1@xE z?h@PJy>R$l;^kd&7TaOaMoC;w-4!n#-{sOCxNhytZgdxVyjKqY9oq|4yM$u_R_+ow zRTAGR2VFYk(pi_zxpWvU(WR3vokACSHgjp0IO@_dm#p1!`o~>50W0i|zy7di>Ym-= zv>R`=KCmzWH|w!moPpCS$@4Bol7OSvvN z>eh9aZn%WefMy%w&ePv5#GW`)*Co%TihIN}eRA;La^D{D`W_L&d0Z;zQF)IvkI18} zN5UiaNcSk|QI1E3N2W)%N7z+rdGS!joIT>u9x-xHyd)`sD0}0L^X2x6exGL0x>FwI z@hGoHkL?v{k1`(N_eSsS6%+Ty#X!K~9O+R$kBWL!%%l7s74WFAM<@4+f*uv}sN_D; zW}moTE3;We0e@d2RRjgtCx+~cR{$1=j7OzBDktm`9?jk-w(S$8Ju2f-SugIxPwf*Y z4=3=`UYu7i_Q&~F@Tj6kjXi4OQ6-NmdsN$_Iv!O4f4`{i;V?9+>QOb1aQI={{o)TV z)n&h^=~0))sp0!YEsx$(=^!Z_09eQOU~?(pbNk47I5w|UgUqm~{u_h{MyvFm`ibU?K7sI^CJJh~m3PE8j+ zC~6-Roezo+4+?zMPBCt^2wfE=+ zk6!esgGU`bdK9+ssFO$cd-RY;4|{}@tRC7V=ppflDt5g?vBof* zg3jS_k2-tQ4Mz0n2^7quu1e-fk1k^(*dr{_dHj(0g;Mg`b^3X&UrK*tf+J}o@8lrG(L#zeUCoy=o62Icr?hP4?X$_ z_^24{#mhLmo=WvQDjqr-r-SgZ7mqWHJSv8I^eMdSn81ATKS#xiqvA7eGm#G@zTG+#O)hMf@qdH6%Fpp#-6;+_z1{FG^RQs7?|Gd-FGU-f7W zTBt{JJX++@Vvpu}G!IICP)s=~=6eLqFYss~s#YqVtn7ADU=9n34?HQBz+@h+^az`p zmm!gpV!1~vl>2R(m)L(&oINRwQ?YQ7Q(~3k-*ZZ=^=O?(8$H^jI;-{QB@XAzJQa6V z8=#O=;*(QiGwz-e+t7HSPmi{GbncYsem*Y(zz&agqJugu+MgCr=gnewIbIKb-<#g! z(OxtwpL+PT&!hclgFaR8>3~NE(SQ0xJ{|JtFzoKp6_1X1bkw6W9-Z~*m`BGwI^|K@ z_cJHpd#A-os6u6d@*g-Ya?Xg;=+n-KCTB$JGvb^_=MnvkxP)%ujJV+8zZK%5s^ddv z#P~B})fs`kQF+gbs~%nR$nnVa=(6`%K8}lBEu)sryQSBKB0TJe6oE?C|qO-PX88n zKZ!H9MbgJv)&l3!=kY18k7Jod2C>e?`KEosf*F94>ay!OA$`i{Q!$^4`>{vm_o

  • 7=KO_@#EppqCU=djS~R|EdjNk6Qz7A?Z+K{Nky-Nb6%A3 zsjN@sd>q#q@1eN+y!hXF@ymJfO)^>0r%FDx@#%J-D*IH$r^Y@t@u{j$)qJY!Q$3%m z`&7fHuyC@rk5dXoO`mG{v}Z(O?|H!&M8OMj?sXt`LA-cD{Bc3l_o;zTjeMFoEzwXF z1M8rQTu5Nu2&U9mTo8LNh^A18PtAR50i9H`Z$nL=kAJuc99$4BeQM=XYo7*R6xi?F z;G*~|Z9jA|&S=j?afeTL`t+DjkNb3&Pi=kb;8RDG@S?cer+a+5*N^{J+)mLVmjs6W z@AGkJgJ_SEUy2jK;~un=Pxt%upid9^I1C|PBl-Xm++}^GWFGeM;G;*Ow+;fYe~_Pa zNhFTN)9#%QTb+G+0v7k_8K1iNG($z{id=kpN?EY@Wl{68=y+K??PJ@rDBU9Y(Pe=O z{?DgpeR|F({GxQx?b+vj>h5F9q1CgK z`Sg`f!+h%PQy-t+_31sIUh%1~PjC9v-;am#UiGm@O!NbV=Tu0wxgt7W5wH972CTm% z@x>J}`AS@ub89ni!HfL3iyPq6Kp#7Rgnl)?RracQ$Hy*=7(aMbyzkQoJ`MHhQ=bO; z^r255`SdZ0eN}vTRSfpAAYc5ggg0CjpFo-8#1ORlYuO>K?BiF3aZQxICO%Vc@P$vG z`&dgX`d$;CToYgV)V_~4`kI(|O?>UsaGxgm^rKJT_%y<&kv@&`>08*Sp7_qkdPU*1 zP2l19J#zH1s!+gHqHA#>t6UeOeH!P}cxc|Iv2c&;F(2Wz>*CAnVuDX!rZW?v#_M9s zb#djoFmH&-KKg~0=07EshN9o#q+swI@5fb?$ds>O1OtlGkx0N(?*|W!O&<& zJ}vNR4%*tD94x>Xm`=_0X`WB-P(q&$`*Z~Tp--oMIto2}m7UZebpoF6({WX=F|Ii4;&ob_^y8mxVMM){ zC(ihE7Pdxd)2V8nXzz*X&u7oU|2;9)!xJ#h=#o#DeR6zqO(bWI!VW8Wm7ZK&gQ44d}jr@&uGOplShC z4=5c_CZG}ll?*5wkO-(?K!pO50p$zge*1+`c!1^iUKFsCYoIc*ypt=Fo3#eG3)JvLtPsM5&&^S#t3UF*`0&8PtYx1xr*W8{oNwzJN zY#LCrfNn!kNj49tMLRBEV1$Ao`CT8x3^i2V2SaB?kw8})FGf(19~l>jsbN-UIBFt=>C8n zfHebpG@u6q!l&F0meqCnP=HDBSYvZpf`hm2#{zmhpe{k|PMrf<^L_G(0HGu04;3U)s~w_r@skk1eySg?*sZ)Nq!g5Vq3my z%dc#iO~^_K*(xD_2pp5~Ig}()~01mS(F+QLP0sS4&)PN=iG%27d z0sV^V2Q(RtZd>9Pw9`uVPXXFE;mpQ?3ArdCuO=im(k7B|%FWAVe}jAAm)`+3O3L5i zGf9aVu0PR6pt_{QHr@$IIW;N&3FzN|W(G7Xpxuh|UqI84by7|bXa-8S&w~HwCMDiv zQaN$rvjduoa^}c6s*d2)&XMy1nh&?hkr>bKpCgCo$b|tdLiGb$641(kRw3&gxfC9C z$yy%JH#IZM;KnVJ2XZ8(G2R{!4(3|XS70;RF7!Wr#U8ZiD#t zM_vu+T0qy)*z?Fw^2i$jjn5<3=aI+q$mw}xZa_{z00=Jp{1)~V2owz!jnHYFwID_z zaY%YdGH;v+a;ctIw#_R|mAe&^9a18sWJt(8=T5z&k`AkSzBo)#J zixW@hl^<2MMMwkk%CGavM|jf4GE_clv3H1Ru~bxre(R1Duh%qr1Bx*NA}$c z*q^3lrI0G4b{SbEqzUP`v`Z8%n33%>vU-Ro5#1M3`!H@+HAAWwQvHx>g;YDF6&bBg z7*9gg4e5+J__UF*CuOt-AvFx?0^4_l)F`CJVSH{_%aEFc)HI~#A+=@TiVZzq}xM!X=h?k!bSkNGo-shYKww} z)GnlZ!g#U4^zmASvvE3mGxFY$#@?MAR^L9CiR;xNq>drA%*q)Pvz*( z9t`Qv-WupbAD;>5Y)yghz$+Nk~INdJFy*5_SlF6w*M{F{F1w`bJ396vMfQ z)mz1VH>7`rd@sbyMhp->P+*XvABHqo0sQO_xA0l?aY!3Q?2y$5WQL+qw-;C+_o;G1 zaFFa5A$Zd&z>b<393?jbX00o}Rf%l4 znDawO=Y>QV9nwgJM=2^~%tUA=<=BwMh15k#YyD^L^m|CZgz+)vQ$qSRB%G^oL(07QWZ8W354Z;^8`8h98ay_i{5zzn zDyawZ$+z;!N%`cmeDXv-iA5&=DgHD>N!ejOSw6qKFTb1_(k$3Cr2TM@kmiK6E~ND# z&4nr1UK!G=kmkYnLRt{gLbS&T>80?f{1Q7r@e}GrAuWc7z;^j#vyRR$SLBz=LRyYC zi1ypYu3tdjS3sW2FN+nBtI_&WskI@EYM1TPI=dz$(5DMXFtK9xn`4O$A#H)epUZ9x zX_FG$4F7x~jaPbn5`u0GX&aoaW@bBdQb6v8nV_q($(1!X}aa~Zu#NM}_PoalZIwnncK(nWNPOXw0xlFnc`F}jYP1?3YT#P2E}6qHxc z(2NXzOn*J3(FLW8ZUI^M7dJx6g-YvY9MDAqOGNPFr+*4cKO`+8isDB}5YmC92+^)# zk%AH*8pjGsj>s$&zu@T+Vec*0v6m?%4KO3JBC20V;+){+XX8VQ8prg#(UyR5z$R>d!uB&DDD&TM^qr9f)N#p zsBlEZBPtQar&JY*sAxpR6h?vD{gRl5d<)4OBb8~CbPLIn5j7Z;mW5@_!m><6Wh44D z#h<0PTtwv~TBGw?ohw9C5#?b{GgpeJazr(VYZBj6SXM#wh#E$8?-qPb#I%~C)fKG~ zQO$@TR!dQU+W0I|xUQo0Zt?3Yfar}-wTNnKTt{PUtY{L^cM*LbQPYT;MRZ$4%_C|N zQOgKNGNw-NOsoqK*-@L)H;>S(~^wqWdChA5rhZ^6fPVJTe|%pBPqHg7#aV=oG1Sr@K;9 z3d^~L<%1DDgjf;b*sg~odL*L9p`s%4(TE;H33sJ1L9n^7{Bd1k^xDMP!m=}RjOh0j ziAF^vQtnnneo{nYA?uT^vQI_SHKM1H!umwFh@MdZcvlg5zKAr7%I6|_9>s2B_lu}| zL@z|tC!$v(dNHCN$`5-*IO$sUj0oW+#lhvviU|O_BlK2x0s2Pts*-{5Yf1)^;NOh$ zdPHwT^rp%VIS!1de?)IZG$10Jv;c|#KJeQLymL$Ptx@UsBl;ksPa+x;;j@uGjA(E~ zA4N3dY&tk(Rj-~hUB9~C1zKL!sR0R8jU5Q&m#I9ettByzGNy# z*dI2wzkoT4N`x;X`YNJf>T+;Vi2!DUOma?JI~bMzCL$b8J|d!T6#&lHLmN|6{t(fr zh}LegMn*I$qR|nJiD*tlb0ZoX(Kxi7i2jUdd_)r>nhd9kXktW@kWO#y$B2F_DmQIU zEbNv3qhjXR7HfV{`Ex|SfDco`C$HoT&@)pa!VBlGN{84OezB;m{6pfO>sHBc6HgpU z{1wsP5lxF|dPGwr`X{1)Bl<6*OfiY$$Ube7Y*b7>SWI>=CI=Lg$4c8XBAOY|tcYgA z^NY#DMzjnKq+R^=bYoo#8){ZYv*qi z(MH&@rv0-LcyMR>nZnr~e*F8w14FZ0BH9|!k%*4MUJ-4NXm><=B3e>h;HeM>&0@zl@L zU`mbiXI?KQqoJ^6^n=!H6H+z}-#DLX;KM&@CS@7MSNjo&C4zj8dN zm=9_EbxHYFq4;GOZ^f9UdQ{`bG{%z}kMGAd?yT?=sMj9tNsYUx%ND!iyP#k`t#LPv z2W$M1#?QbFH14DED;ke$W@DrAoRaccji1A%Z#}PZcQ}%5zo7Ap8uw6mdr8?-InPTP zzpU|=AL9NT;ao}COXJ?^)>x6PT1sLIOka&()%cxK@_mh8(|FnNL_dvRhaJ0Wz;9^$ zrpE7TJm8eoALb|}5e91f)-60h0W4Yo|81lLNyWLp6vpuw0TFTcnL73d8V}O=LyeD5 zObjn2|11?Z`HwaJMB^bE57ij|0_%S$feja*RS<8c#shgVGZ<-eIHw5CHBpvo|pknXK_o8vm^EFB+fH__W4T zH2ziN4H|FM_&1Gz*La4;GvQYn|B2SB@jn{lvotXy&h9Ub|3;Iql3G$q9x5gA%k_)1 zGykHdm6QL$MwOG(kocuE!gO^BFiYdv8ZXy)g~t1JdydA>zM5I0@m!7P!3n?2%-49K z#)~vwpf16=UP^*4R+l$vy0l!Xah@HCWr_miZcmJAo?WSN`_gi)#;efYOUu=Y0<2L0 z1zrdL*Vx%$ozJF0ak)w3%^L60csG1ZH@JCN4vauS=Mw7;$mpYGvi*DX~wMATCMqGpm%MEy~8)C<_HP zPOdF0`~RFMM_eAYAg+j5#IwuFO2n0ks}NTueon~`EGt{>%K;u%R$>Z!$&MV1hg2uV z5!S%9h-(u+M*KK&9b#vSr+g2x<5#Odj1LB4XG*Yy&qD>TSs_2|& zG{_?~SC_XFw@{#^qTsh8Zmn<|MQ1;wA>5(xo!I}qE_IipZHezzpdInO3XIsU-E#}v zN8FzHv+Wv~pa^{@Bsvm}uLt0!@YMVZu7#9fJ>CSLzZ8V|2C-w;4Ib=h|qJxl!7QTm+t3u0{9dye>d z=-;=xEBXTQi^M&MdlC;I9!UHW@ypw+SCBgZ@w)n%Uc|kL`w-tTHZgEJofx0MTJ*De z>Qy8q?Kg@06Tb%cBYvIu4Pt!c9^6bv%1Wc0L=+q{*14Yj7IBSENyL421r1mbZ%KZe zc#ul-9pZQ4*uT=WW4#KZfiKStJW z2KqqbQ_3W3#Ul9lKkSY%&{+jrE;vbNLO6?m($3Gp97u``# zjv)S4alS+DC`q~4pGOjpBHm2Ag?Kda7~*Nf(}~9tk0bttcna}&;t9l)h<`-HP1Z!> zg{F3gsR1{rnmD@N>S1b=i62~V{e(uUKqE`TWn)wOmH0Q}KhVVB6{hw(>Sb#EOl{l- z3laY!{+oCz@jt|q*IRv%&U(wKmS}2f=v4nD{*M@9|Fbl35M~h1MDE0kQ2tHUEaJJu z^Hh0e6VFiqV#pe~fFjIC1x;-Mal4-gvD}MN%1=qE3kQaqqSbiZ^VA44b}#w7Ss;eZBm^2?KQ;Rik1a8M!QzRQ(J1= ziFXk1B;G}QfEY>bCf=j&LZ67fmv|rXeqtyPcfsj(t0X8Aig%d!Nc=Y~zJ&4+A0s|Z zd`49q!pDhEparP}PpMKNI!aRSmI5JjHvSEJtnKrPUQiW;42*)im*W$f*&%l0(>nPY zT0L=Yd^QRp1C`-V3y29n2R!F7gavy zf(qnU6r2Lg?M4#u|ECg;yR zT6yLM%ng|%FI=mt1?$ZI?VHXW~ws}mZ@5b)=;#jqP?aO_z1O`>nKU! zm#0xZh3ntqK&%nRp9amDTQE0PxXG=2n<~&umH9SiloN$%sbmnPHFGN^(5Y1N!b@5k z2r%Eld?)kc%$=Fz)<>)!%r7(dQn;t0FEQuqksi0(!UMNA$B*6qiuPfC zMS;GGzN#qhzQ)||7Ji-i4TaxSv`;w+0gRfy#oX+oHGp{_GX^@|W`2kHUFP?ghcRRL z=zZo7m_KIzL|qP2bg-fyD*Cb-Zu;mJ9-_df%%3SR6t##5;dACMn7?HHN^xLiFmKYE zDfGm65%X~7ZijG7Z_EjulRE#-{0H-H<~_`R zGXKTAnt2WL-^^2)=Q7V@{)hQ!5xZZ-cqryymF9oU)0n3-&rp}M(PYZWnas1)B`_p^ z1I@%y=GuVdcHyo-4~Ittf1TTbpOWp7~K$b7zeauc#(-lp(oMYkxb z?@Db~05Ut6Z!&??CA0gkBu>4T#sdYPczc=mF^9|%^M2+7%$JxiLzAuSgUq+pO`d|w zF&}1bR6l!!`8e|lsEhfS3SesGC1}+;b|=H`**$X-O6Z;`SYDoHKEr&L`5f~F=DwBe z)p@n2E7|8!sl3`v4CY0&HFfKXQX~F+`apSkmH8U;b>BQ8}(z?!|hN7mTcsu%{yu3Ti!EWf} z>`ac%DV^)<+(73%I_K3{>YPvKG?LOetFu6|XW}=;k56SDuabJFxZScvc4m1Qid24` z3+P-_=VCe+)cN`E6NPl%{$+Y|d3o$&PGLPBF({(wxm{THW);`DgwDqgXRfqPmDIVE z&Q*1;rgLeX%V3;e=ZZR))wy;L?JiE1*SVaIZZmndyac_;tfX^govSE5m=L%rgS*!8 zM0K5O=v)ga=zO)jOjnRKb;bb#16!s*aajj7t(B^$b6q{wTg3{pc?B$?iG>^L+(_s9 zbZ)P6W1XAme4EbAp~mUy=PJa?Z>n=MorhJB2>3i{q4O_8(rt9U9qq1yY^ifAom=a? zW2?2Og5+%pfID=)Q|HeEs}RB+E&qhZS4jvl6UJ2fLoBcM@inR=$_xS4mx+# z`6-<*d8y@I>bHGbC!O!t`2n4A`H0SsD)1oe?x!Bo`C)YlytjgUOy|dSei8*6oj~-? z=o~7_Cv?70K_YG!D6OKbTTwn-QTD4SA<$Llr*-b8^D{7_&fTFLouAeDIhA|aKM1iF zk4}L8H7~|5==`F}?j@BwR)O}=dFb02gq{lQY>|9f=UzJZR$_e={ib4^``n81L`C_k z&adhGiOxfG?x*wXI)9||$8i}_y*^LB0mrx!5A?kWTfd#|ujpGk4^RM{feO5>^E(Q> zdyD^`0`DvOfzE>z`0&=%ARJeC-$^QSt0tMhj#QoHyCsc6&W zXF7kb^A}L#`b0<1`cmhwbUt5E4%7J?opBB-W>~(~dAJgIJ|~5_k{Ua$5$Y0mAK9Bo zUCHyk&OhipQs+@R&((RJ&ZBi6gEpx1KRS=qdD_0rM4cxoFiz+33QSNGxAIhypg-#T zGdxY_$!H^r^AjAkl6<6+oPy3DCf4~6<;;i(js1q|D6v0vo?l7+rSsnk;MTTE@^mF> zRF<_X%YSwLPv@CBpInxhrt@^2XXyNWOZ&yj60snLKZ_v@t}JKi3@}^Wg}@vIzWOn9 zS7Up=&P#M&s`CPb7TFS>UY;&t@jmJr}KK9=h%#On;Z1_S${ysTUq?szES5*3T#$%i=yCfRbZQ< z+ZElR^G=<2DZCr4Oo2T*?^Pf(fe04V`m!KC1IE zbPIV?$I%=V06qcLDSUkxol@Ym&S#LCvcfq;ER?*6zVs#SJlY*R{O@?g19VDd33^%Q zD=OAiMX%|6YFNCN=eoKC*f})q={MC4ZiJL0jo7u;mCazg?uX4%!eD7IK#NHPTEO6HV>9nm&bfFn!`rNa1{X3I zr&|CQHW-IyV7F#5gNqwn+2AS$MrG|12A4E=e&x7dtyRD-WpHVO%NShN;EF1*at4=2 zb=FY@gNN<^zbkD3_NyqB3~s(IekJoN$3x0h4X$bMNYARMrK%wXEmhs%8Y&&&I17Ud zSCOr&NYJ_l*E9HbgYPi7zQGL)Zf$TIgBu#$$lya53~Q2XY;Y5Un?ZFbgTa$0(IaLC z^hXt*t0J4DUIqgov{2w}*J^bOfH|~^oLnfmu!`JWMc!%fT?V%`_-=!zHO;=?B9&U7 znNc!x4l?&=n^l#2@5tV3@O=h9VQ?3N+Z)`$;0FzU$l#6!cQW{XgC8*Bk-a~Lr!m?0 zeAQTQ?^czq8)p4H_QM80VsK|w-|wr+4n6V={XOxh!H*e?81i;2Ci{}XFB@FFYO0r_eSXz?D{y-?31<6W6Lo$_cdaI0 zLom3X!5a+TXz=SOfWc#sl)-Nr+~44#27hYsTLup>_&tN)H+Z1IZyWrM!S5RUc{Q0X z7%!rzHYM?h6`#6EXVQQDocRC_X7DEl4}pss{7*Ic^zL-=uG(OO*H)7s8T_#V`>RP@ zB6{mHIgMu~I`zw7767wk~s>@E*W#8)Zoz>}~ z)#Wz^k1%+Y!J`fSb5DA5b@?q6d&Bz9;O~_=et=slaQ#R;G>UK&EWMJmt-3^89%t}) zgJ&B&$KVMDPc-;nga0#llEFV3{JX(_!2JyV3C>wV{%Y{gDzz!7;|TgiVNoNlMd_d7 zDTdz^r-S13uOSCNn*Gz@Z)?cE4F22Tsc4mT?0-4pJ8gii#4+|_Z zc(K7tR7sG_QU$yk5&@T0YAT)Al-T3E%HY)ouYoxX#?J(Rg7ZtR;3-fS?Nted>W;H?H9H~56X+YH`r@If?Q1G6W*6V)_$zrnlUJT>L( zd5>i;~2UEisCRj;AJ=BxyT|W7d5%O$rVg4W^!?pOPE~JhrWpY`Q-z$_HQ%9CIxs1sG2y^Pla%TM8d4E)F{fZ`6GP$zJRZPZI{_Z-`t0OCo zOq8fAYu1%mV$r6qtZs4*le?Szg2^>au4VE)Cf{pvZIkPmT-W4!CimH5d7CpWH>B}J zQ{UtUCcjxKQE*6R!oEyHlkYIOUtI~@$mGT*H!&HwsmU!&ZmDoHMQ>BIxuV-o#c^9H z+{R=uTbn#?1A&QfyW)4NEAKSP0J;)B$+D^@3yyCLW)XH(*SlR+Oa`9YH(Qutw$yDIRA$&W(A3O}hRBp+9xGaN&K zgR7~F$=K?RTTk7R`KhjaT4CG*ALV%lMK$>Yod00*ifh($s^rfrx=5A$MU#7&yvyR< z7WXvyC6w9Xx2)J?FPpp>jnw2`CijNUO@77Xu~3W2eNBGVdGz?5?C-S`PhtS2T;zt>d7J7X{gCx znEWNY%eOv-m;#@x+%Z8gt)%^x$-|)7{K-)!e{J$`L^t_+lfQxg3`&nM`CGW$_{4C^ zmR*(s#k>Om(*MEaktWZzV~qLS7wbvz@eiiaCXXJK8DsLK6`5Z)C&t4`OrCA>9Fr%4 zY4Tqt|84S*N-Ze!6q6^L{FBK)oBWH(hs`XQldh*Rlag(i9NsqhtI5Bi5!I8woBW5# zf1-7d%)DZzcKnlBJU+JO5B20!lm9^*HyO)5r`3x;SpGHnKc(tvsefxJR(OrcYfZjyLR{2!O8*;7-e~fA zW!w=_3MNLC7y4GVzTBjud}5}yn!F7ig2h!W-fr>^lgVPXcqiP_@>`gnbL%;e)HpM(#TOFh2PI$?6@ z35m^H2%ZUWN?m>yWN_=O$>&TClrqnoe8J@FCf_jmBGiTc$4Or`8P0s!74}VDH!|ZwhsujysV`yi!SyBdR;{mAqpud4{OeXLQVP*5 zzPN=-k4==mXz3Ok78kO(u*IgunNwEA;;h9O{kJVnSe&%D^8(6aagN0)ivw&*&aP@)~ zA5-5$WhBK zXK@9KD_UIM;!)cOWq5y+RmtMY7GoO%BBBYyT~R!Ecr}ZwTl}cSk6B#9;+ht>v-lp1 zYgt?ywXnFU#dR#MYjKeVvR50s)6z^miyK(n(2Cu%z7=-}SViB+;>L;tf#QoY@H%J% zzn*DkF$&Pe;@d60&En=3x3IXS#jPxE4VTlh;kbCZ5Hp^r6zGV8HvAk7?GB6Yvbe3q zcUp08)}(<%n&>p{w)nvYvdg#xR)gS7n|rO;@j6)CQHkAWaeFK7uNnmzG^HU5D59f#(&DEepVoRMQeBmGo`!X{6AHh!fyBz*XJAl^Pk)@LG(PSFpSQTX6|Y(9 zWAO_Xzi9Ex77uG^!(@3I${s3(o)*7k@!UE|%-bTJWmW86@PSL|O%0O0Er$8Pd|kd?q@NY_Ul$WW&FV63{;KQ^rlipkBPB9QQ!d6B2R`eq)epo=0EgE8s&N^&q zLo6O@@u$$X#b2XR+v4b-E8(v!{z8E-RV*|*)N7dHz;H+hlEc;IH&E}m1XlZe2R&H) zo5jCd{DZ|KE&fT>;?5GOQ5JtZo+ep58ZNri8e{QTWx;V4!+aAh9&hmkWo2lauP0aK zrs3+yEQ@Eu71bsDWTtA=-Q3I^nAPHW7SC6lhnHs%(EA}Q zz|+5B66Hh-!pHt%i{6g!g<2ZZdd#riXz#a zDvROc5_>G(i^gtqBb)bGyx(HoX2a$KX!x5g9MOEbxqZ;$Llz&l_=v^VEWU2>QM7uC z&sls@)%v)ir_fE^;@}K1Y%50Ar(r~O7yEH=c~)U;hCOfb1$4{EdP(B4#aAr8gvS%M zJS>U#>_GCWy4CJ;`n#dTd8aol&Q+Y7IXV{m76%r)DnZD5=yDsz4=jYx;s_nG&4X2@ z;E)}^ePMnV^lC#{vQeC-X)_+6md$wC27mW=WZRsuIcal_%@u5}XmiTuJT{lLxpO0# z*Jk&xbWxj&*_^gHWAp8eWLD84iV8)gqWNsjuRsAsAz4s?LW&kv6kC;%FK!jLxrEJS zP`s|%`>P0UUdrauHbbD+=1l)Fi4&s}Uyezl)&K82_#t8=Fb|*dP?}Q zu3CMY8>sZX(TNF-WbHAD#x^&x`5WjBe5{$lsG7|?uBMvVe4EY9ZEj(6H=Ccaxuwmm zY`(|ldu?uQb4NS?qu`*HviCAmO2=}Nji;WiN>;iV~KPgviWB8KN?Hy z1$flv$H1}qDVraMHEn*v<}NBD2&`@_k;q${637>H`N2$Ao1a$Rfb&uf)M`9WW|`3;*tw)qptE8zh)545?z&2QQKPOB`^oTl=6 z>p}jEi3&_o6tR9(V6x3W z-QtWIlm`D7o2T63{HnljHvg``AGi2_D)5)0e=9l_{<(_~9mBc*!LeV~X4^c?#;V0U z2-6jqq3BHI8?zL}Eo>cX+)U1e)oh+`^8#2Z!Tl4And>s=6ANu#g!Z`ET5R(&o0luR zMA4=2_RSVBN`n@CUPS~ArXLc3@NfH$SK}00yoO8}OXONt8R1iVHKoCJeQ4~c~KqTiN zS&(c31VvE!&h-1eul`kCr%vC#9j5zsZ=iI$Q(O89#ew-uozO-N+z_oBGZrC5Wm z;m;`lJH@|I{1?T8DE^M(qf+wII_n{uvCd+6q{tr&ZNAI~NsO6jnd@@UAb;Ta9jYPen5d9yT+)rTK& z8%s-m4a5Q(zAG&xXO#Zbr|pyd?Lry~Yj{aRNex9bJg=dshGH6iE-fe{Im<>fm676K zX(P(W3#zo@8eY_}pp3jZT$^`w%4i^#Rk&T{ z;t|68Wx`L8N*XF_Xsw|Q`?IW6(O^7`G|^C1Lp2T6HPp~hPeXkT_g=PZYN(~5wuZs$ zQyCq&KDCaL*VRC`W@*ASY@nf`N=l11($F|PSDK`$hGuM!2D-;=$(EOu7K-OA8$J~G zEwtjZoU)pf75aZ@tD&=oE*dy_+iBQZS8uPOgCZRjQqoD0b@|KzWu>cz{u%}_l$CB8 zx@+j6cux(zHS|%um%_ParLTs58c2APNGEOhEl9H?QCh9Me;YPeih25a21qAz&b zd7xT&eom@iPKIf?lRdiQht&5hhabMLXxOadGaVx}jG}pH7^8tZYvp8BIr+4lysKfQhE*C?YuHy#9+nG_0lrv1JiGVRVXawt z8CG82V>#tzt%mnG@ypA(@~$!wJOTf73GDBVaw}R6ovs6<$DdgH5}4#nCm|m z9F5+QA(dpGhA9$a&Bo`O84 z;kbr@m1IFB`Jj@ptWz3((C|AK3Js^(`3d(j*DeibG@NBm-Zjo?xWI*oV^>MevwN>b z9#j&#EQ?o`A2nR!l2uv4yVomA%gQpgW6Bi`H#FSTa8<)KcEzueL6wDX{I7GYD+_z< z7DwuU_OpgxH1KTZN0r0xKfkgKmE|`+U}pXM%EFVFi7IkO!(G+?54haHEmTGR;9S{?R}?`Hy{DCG66Fxvo}~!d0b7 zRe7voLRDE&HEcO_@Q3e{IgpNQ5cX`%4qS-o1RFkL!g-c zwPaG5SqG1i(!7aTbv&h`l8(wcvgydKqmYimI&$d9sdJ;4RzOGdCT=brxpm~xF{GM2 ztz&LASy4^$>d2>Kb~Y!!j;+|swP=>TKB5SGdiBtQBcQoI$o|W^{R(MlWD(Z zSC_oirHGE_Dc4a-M^PQcbQIU|B3BQ7i`Frvy720O!PSM%jZ5%9gG%y}j*>c7RF}`H z%c1J>pn6yxd!V$AGCImLsfLtguhx)qdN}%}YDmKx(zk|8uOSt5RAdWl$iW(tQd2V5 zlqx!^>S(H?8K1X`RMSyMM_nD&b<|+@>fvmvrK2`eYYKVAn$o_eY>4VZYDzsF^>sAX zvFBB%0gEkZHq_Bb=bvEioSMQZ^GQwFQ&WDc8P1U=YOu1@lIA*E=xC>7S1oC&qm_>F z?^+vcNoyT#*x*BMTOBXel3KOG=Necm^rgV3<1A>eqXT=Uhx1!4$xvH5v28lK=;*5B zEgf&`=%%B)j&UqdM-Lr6bqwY(>FA}Sw~l@~`s+BE%jv^TXl^&@VfEF+PwITNg>C@` z@Of)X2Nug8p=I=eI*5am0?AMv!*mSSF+xY)E!Kpa+E!k}eLnIEmwg>$bi7wvMk(bn zb@kC~fGUU1@LAee+OTp)dbo@;LB~WL^K{JDF-gZ{j<1fXw9m3p`usUkTYju9({xN{ zx2(}x)R7rFW~yT6>X=0X(=mrr#!BJ88G0SbQ%6eGp|cUY%YWS66uyUAz@l`#u4A!| zObNYj9eIr%Qb!i5LKZ1pUnhJ&g-xOLe@dW0{WSv>zQuln&KSuh$t! z7#`Mo1#Yb-b@CJv}D; zZMZJ20SdpYD_C~x2k z9bf9Wr{g}&Psdj}cGDVlY}4_zj&F2)%ji0bn-dD()#i4zx2vj4mx@j=s+$+>9XfXE z_>QK?73QMNz#r7#D^9}bULE_mlF%5~pL4AJI{1lyggtyTazMvH9fx!jSeD8_$zdh` zb$9Af9mjMWXIETEIms0!B}Q^WMYGf6wT>USyrhQ0G(4;09MyF2PSu&$!f`yWy$M*Hrkh zo)j;nJ;<&Tf7bB}mzP4?ubd$DWan2_^S0qn$lq1B+*Wu;$6ZDKP{>sNIQmn^UtEU` zmyNm;-HZIA<6oM`T5V@N>H0zV*UDqg!83M>fm9=$ zZWrrG`J*NbJYnGLlKSBFDa5QxtoDy0j~+)NM%cGe1DYbb!m$U!?u{9U8xRAYfk*Yk zGElI-RIe{QDP|ktc`?U;s|agh)HjeYF!gKec>{r}I*)<829gFc8Q5^i&TQZ*1KA8b zX&{Tix1y0@^@Z}R2F5Cq-9QclxePpQ;D<|gPL+#=GxaN_z|@YumfOIo`ofFz@)^j_ zRvCECKmh|K7Hbdc%d-ZaN$1Sl#C0-kvBFj~YwVa5Fh;VfWauA&Bt8F;}!aRa3c zRQ@6IqQa62OBi^`!1XmLl&2xd%PNV{(gw;X-flrEBi# z`WqNvpo)R22HF~EXP}ya>INDaXl$T{ftm(t8K`Zb-esdnL%Yn)2w$0f@{D=>aiorc z&Ux&*>_8p?Fi>BS1_~Q0%+o*^nA*fZQv)pxv@%eqfsAh;%?ymrqBl42Q3GLUVcO6Hw zUx<~incWTaFwoOLFC#pxm)5J@%a{`vYrPHR%WwX$O6y}_)<2O;S?svTvG_bz5KFh!;K9_+h zG&uufXhH@i7?{XuvO0B~f$;{2+({D8WHY3ZXBx^R1CwbX4W)P{oA~+t$TVdSqZ-N# z1JhL?=Tnf+Oi!9^V2**g2Id)f)xc{8<{MbRq8=D;?+ZV4hzyJ_RB}qFz$nRL18>mU z4ZLMwiGf}Jm~XOUOGbI3XQ=@qb(R@ePHVTKiy8_8$=e2Q{cG+#V>hcFeTO5Gh`y_k zWTg?lJ|kIU;5`GM8`xrCt%3Jhf`N?&*0GBWd|=>1&idaY|CZ8I#>cidluHd|<@xaZ z>|YJ#BLg2B_{6}c1~zdXHIl)NWJV(?+bDeY%`CH#TyG?gRrE8}4@Vox7Y4pG@Qs0Q zm1L`duV^-$t#>1SWBJn2d9?Fuc5h=Tx5BQ!!rpFRhk>0mIa+&Tq0@jCjivM+dzTR& zNZ&)_e{BBOI{LkV-3CY)So_q*vR9SAPa&fR4IE;zCZ08M*uW73|5D$;Q3J;~;|yFi zaGYftIAh?ffs8_RYxbVqj1z>jrQ1SlmSJ8MtrY zZvzk6ux#3&T&{oBzHTDxo5)}M6flta&&a9e4quQRZz7MlQr$J4tQ!4Cby11zCR_g4 zK#B?1gqTP*!xLPliI|BeOk^+-F%dO!{;rYHM1iu-{`z{Bz4iyWqF-FsJ}u;QJZ5Vq zbQ8;WSPX_DFV%G7CM*-S3CG0sCbGGp8Eq<;vzfVm4!>Yjy%&DscqV)k*-hjykuVXM z$ZFy#6G;=Vo!2s%$dp0n&N^!Tn$yl~;z<)(OcZL$qro;qwWdNV?c7wdG3lN*rfFz_ zIZfm;k;g<{`u{P*UBRC;m0Z6Vxy|rHZIRO1-&FFMXkpp~O#Ita@~b40tj)p_3YvJ% zMDtJqg-jGSQOQJQ6GcosZ=#fm(k6T1Mp=8kA4yufbBY5U8+BCYQm6--oAdFQLV zRZLVhQP)I06V*&qH&NR}9TV%D34c4+E^gN_QB&#HQn*9qI@e5oZ^lCwQ8S}a-$Vlw zO-(d2(a=P^xfE?KjoDqzrIE@)(u9u|iyrKp!i^~0i}=BVNag0zvAMKlBTe)&(c468 z6Kza%WEK-`O|&!7-b4ozLz+wX$Hw@J5xQi|R6%c6O#d;LneCC$*+dr;T}^c3u--Ab z^>kHp+1fn(h1*@#%X_#EHkTeIh&`3$N^|LBqOXb3CdQcPXQID}p(cizsPLMW>5@Ib z#6VizPtidpCS`U8t6Yqd4^a|!wcA35o7{1szgy89Vd51Nys>(u(j2Am^@8@j!#0Iu zIathPVzP<)MNBSA<2kr3WLyiGVDgP8NLV0oiiu4vWTqcATFO)t(@acPMKN`TiTz5A zoMg6%IW(RGiX<@C#5@yIZA`N<-^2nF6XKW{4|kEhYT}C+zKr2D6AMi&GVwZ%Ifg7T zEH?3miBC;zHnD^qm}NZ*TOn^> z;^y9!X1D`wg9-9gCRUqRqxgFY*PB?Y$omSZvrdt4t8lvHLlbGjjjAY?_K_kVE8L{; z6NTKg_L&);yqIvuE&an)uShZzg_cn@xOW;*^OWOl&jpwTay(_NZ?B#>93L zJ4}3=-m7}2l${*tPAT7+*rkMHm)rkz4A;Z&m7HYA32m>5eI|~YIL1*halphOrCj5i zROUUHUfNH~?ZYOH(3nqX%vI|@?sKq@^BH+0-^58(AoZC_H3}I{n>eGg-(Y{5IA`LL ziOXCMO(ZrAG&0sAhz6pO6q~#^~$;1^CS4~_~rBT9=*7)nHOxDFFQFznDEfYU0 z;VjmH#KI+1iy^J?Q58+o*JChZ z;E1H~=P+?l-A?^+jbb#tkiD4=`{zf*6u9WQrkk4D3%f zkAW@uUoD-&5y=|EQ!$K;VN?v+V#pptl^CkVkRyhivG7+(xfpWA@N^6%V|XGK%^gFY z7z)QwBo=Ps${WM8F%(ohUkv$UC_u@;@UF~fV&Sf~O(VlEX3uc~rbL%M8-A}KDWqE4 z_-E~Tm9cmX;{%<_MPr~&F@-NEWOml_qRL)E75I|Mdnu#&vT9E$g{2jiQCL=CwwA)y zmXD!A43%1PXPs7&MCDD0&QMu#CRK}}dJMCVnB1dPBZitWyxmeZwUk;h)Q+Kb3~gel z6GPn?ny_0Ixb7#ga!HHy(U5r`D>NvTY18bh-*O@%ELwuqs7OQAw5 z)eNdJOWPRQ#n2;$o-wqKp+gLvW9Sk?N0p_MLT)f)`Ds<8WhZuxp&JWS3Zqrqh`nOy z9Yg;ZCPD8LLtmBJPpL6Atq>x+eSp##sBn-%W*JQDQhcbwVG4(*r;bqM6;&pcN5?QG zhIui}k72Abo2n&semsri$i^@shKVs${4+9#xfGce!*oR^$1o*^sWDvLW?gwBH4Ujb zBZgT@fqZ5R7v4xEVVJFiY02K9R@`bOR4CL+G7hjwC?{@FSW6}CtfFm=p;R2D+9WZiQ4h6vLhv_NwT<7!IV% z_bbw)6+Iz`<&Y2=4y)*q7zQ6oO_Lmp;dpwk6N;QvxT}`^1BWb!c{+wabC?X|XJa@= zgZVvjK8Bky+~Qcra8XHqjNytROufX6ivN@@S=oxdl*5b+*SLzta6?7+wUS${!taDX z$M6f+b|w5ZUGq*1zoqlvW4Nt&!@o@Gr)B>`N$x4U&vq*ER}2pnp<4gCHUmjpJ^Cny zcs$%W_D>A|#_(SZkNJTT#}jeHT1&GP*1mV0lsH~&E%cSythGctIvL^^*IMq?cW$(n zjB!Nb{MW^a#$hO;Dby8G{(5U6nkpKLipEh)@fTGpg$ysmLABy>thpKP@gpa`6h}!_7x~MoB38jl z%fwMO9{SSZw)}E&l#io1n-@o>W04ARRE(n%Q+uZ{S~(tmsMU(2b{tjsfGS!|VTO1L zld8v2Lq*AJD)KNE%IhfJD2}@6srBNhpUxX7(oo^NHsN11jTLXAu&Kgkaqg20i)tB1 zt2lbb(JPMDe4-T^Lx(upDBd<*(oT`~aZFpCN`;Op+9{6Cadc5*#4hcwQoF{{O-ZOm z&rQP?MrzH#(ZoWgQdBMU| zK1dwXkv@UniX&ex z{p~pF9J6NJ3%^jk!%0_6XLwhUm2s?6WVJ#nFllWZ@5k{aCu1CspEK9RQR}!ypA75c z_<-{_jty~aiR05aHqzAN*v#Q5W!`QhA1mR8&$LZ(e8LWFE2Y~Ckx4}AFnkur=PHRj zP56b%P9cx^f2C}Uzc;t>!QhC1ICd!EcM5mLQR-~C$+KQt;k}L9 z?}bjYcgJy1rS6GiZyfvL^pg;lb3kFAw(>^XaHllGwzg6*YxGbYhgA|K*W1dmIF84W z)xuL2PQ-CCj;ICA!l^iZh~p1V=byCGah!?cQXH4#C{j>A8^;Aj$j`-bUX4!wzTtP~ zi%R}ux`e`?;{JdM6ayO^Bd2Pz|I7n`=Kb3@>Nk1#$uW|gQG=EX4 zl>Z*b?Kti*HC_Mz=1ME@UL5!1_%n{bIF2-LEByNUfcBFTeW>tn4yBpG=p!1NlKiXi zzc@Ooo$yTBH{K?uT6n@j1}pTH%;*oj!(0p*Eku-rSr}daMJiFJu$@%yX~nH@(KZyC z3S$a$w-d{PZNahNTF7MK-}h3)LP~DkxA=}MB%X!5xpm6P1I3d{PDz?Pvx+`xAxpZv zZ=X;(n}zHaa#+a8W*jy7Hi3uWxL)P5P|c5Wl#PGQr!C~R@WT=r=PHwgnBBM<$G_%lL1xB;C7iy*@5xJ9xZ#`OBc%{A2&1P#0 zZLHAuW?O}em9T?_juyIE=+4pSRLZUMdYbDQqMa=~w8D??E^NLVt_iBV)B*FyF4M^LY6F#TpM&3{a-^NBi(w z!C*d!g%NBObDfCrDzu>%mW!UXgAB7UTxpV1b0m$&)@xlisK)3hl{A|6v)bZe*l`>P znzw~FEKIO4(ZWm%vn))qFxkQsF8GXI(w6*e^eGy?Q*M^Uo@Rx;8zq-O`2ZDEduxfbSGxOFAMBdFW2hQBN60Ecea=da zqmbeC^ym@`OD$}+@R@}-EiALJ(ZWZ3ObaV4theyEgS=(oZ40X`tfrBSxB2$)9SiST zI9M+H4ZBi3>}AytYiMaNN7q_--@pJpM7=yF*8?M7ww1e#YBF?u8w_Dg@VJ8htMJeA+dr)Jm``<>*rg;AX)cW3#{ z!tY$iI!lSp(x`LT?fr^7e^|K3<&@Kzrh74RpIPok{DjZYFs}(-9@W{eH zTrHol(=eq==!^LMvi7f6jbSIv#}=}72@8jfCu{^Zk~T8f$Y{f|VcVc9x2O%>hGC;j z7irf;G#k^^ErGo5$E0$NXqN2e(r7eh|L?z`xFXs2n~n|FhHoQbV`LYZUNQPw7ZDqt zjZ3-ga%)nFtol?Jx!*;iT_ux^%r^4c$Y4z(zqE&)Im!#@Ait zT35+-T6@;!|E{q~{ZhyEOTGM!{jjUhwGRCb6|wQWjkY%0*(hqGn2nk?YT0_A1*4lq(uPPKeb z8U49#Qqe{w8u8n#&>f2~wuZ?~-`m4IOb{9$xcbA*pCDKFk_K-m~O7{rucBqYEHpbc*XJfdH z5jI|-vDs+ZL-x(F`uC8jJ!C@<*_^|qKj%^WH~!`5Xd7b`A?Np*@iY}16KzbgakGc; z9#uLJ`;Q(iddg%Qysu%&R~BEbPEjp6SIL=fV+IXaa9J?Z#w;8AT^w*Rn|)zY<$7g3C_1RzNC$rHp4bWwkrH84R2_af6cl4 zf1=w}C+twzqgOb-yZF4lB;QQ+u(YnsCc|z;_So2)E@_- zh)wM!hZP=CcvK;U#}qlvPl0sFNgJ1Y36oB9$Vx@aPqv$$iEODHZMDQbXXCt$yEgu? zalyt#YTEe8#^1dp{?Me(k9N3`^%CdQ{M3f?Q?Jm#9vl2h(4)6pwQ)v8J za2(WeP}hOWYYQE`?4Xnb&w=mYSqB9jBpgh>Z%%nf%i$n!kaUn^Y6|^pWpa?&;g@#( zNe5XRWOYCnZG2JwloP%#&*mVzB56XZvERsZI>_bVX$QHP*8y+traX^>d=BzE;RjP* z2d8?67WJz_k^&B1>?3KK#2IDv=^t3nIpKTKLJkT$DB|FG2aP_oN;)X&pqPWPeT4qC zD0xB2i}M-#$ZBz3RM8R&UsBk!PpGz7VQB|t98`8tg}s_5N)LGJ`bb#^K`SgW8JMR8L3Y zu|BePfyF>l&p~|$Jsk9O(7-`M2TdF_Wy2iw`P*3de3V_I66CeO?>k;1vfWRb%)WK?e~z zT%GSvM>!bnV2pzf{bZbj@rsO9IHR9TaImtUOjNnpFmeWxDGsJOnCD==gJ}+?JDA~M zrh_l~37y*v=EuEKyP9gxayWj~u+?;9XVMt^u;r!72yqxujG7RcEz>H4fh6=+AfC4s+LXeihI=wB2pg;~ z9c)$PGY6kL*rNCs3eBUbR5&+4zH+e5!44&)HLdGwNFoip}0*ze$ggVmpmQ#mGuOG4xIXIkNer#Y^{xPltN^(41 zenOFx3jaBh`a`<>%I?&&eBO7pqArTLIOpKJg9{EW^5fEl?czrVmmEBD@Q;Jb4t{d* zn}gpSTyb!feRag1y(je=AHl&bhljOMlgCKe&NsE2{D!bh<2h3zg}*px-7bYkN`F;y z9zq@X4D2qRU8Q{M z5&Lfk50x@4inaXf;6Hw3xZ&AYmibtE;I!fS#vxX9=t z;v(uIMn1&ST<9(g7p4nunZ^g9T3S=t81hO3g@<9|E_jrQl{zk57tgqO)`c*Oi|j6P zxbWTZ@iV)4(nZ2W;9}p!)TE0{F8U0VmIH;Ue1wSuC5tNRDHqvXWaU?^!=Z-+*2pMz z7+7ge7r9h4uM2kU(+YFDVQ;fBRLJ9kxmH!M$@96$@1lSko*kx;*m;>&(8cF_QZMdF zE#!uy_MD4{ds5i|^1^I@i|3U-yM;YWe8EL=7ZqJpa`B>z5-v)+DC6QK7bRW1?4pzl zdS_w}EE*^aI)&fCu61@c4U~q(?6NM(xhU_Vf{UvIrS!8728G{FIqw$UwKES2r$4tZ zR%ZKM)N)b9rGEyus={gt8Lh5J4TXgVNo^N(T&!{No{PFJ>baQeVw#KFMpO+Y3rh0I&bfyLpty1;_Z$p zEUJr(t}e!;%e%Sgm(IJp=#kEQy6Bb8dn?k%MPEhI%IWW7fQk-uF+5#!kc+|Te29yo z>3o~OJDk?+#w zyA=7}#cmgS6yM8rBRw^(Ls$;4FF)wwsEcDR4!JnY8SREI2)0~HrCV$|!RGurP9Kw8 zOayZTC*AO{)er%lft+&jgNxHH&bY`a$R#+-W#7dE7k|4r@8Sa278kc%Tx6MM^s2%i zUAmTzTyk-lQ*V&`5pJH_oA&qV2@fNQ1^>C>Klx8c=vC&iixfesgkO(YCf)R3 zUalGMXkWym6PIfl1Q}J*Tf6Ougl>Q6dZOZeOBWadOJEC3K}_)BAfZ~Qs%=>XPYIqB zWKnHMUWhOpuv3yJQnLy45f-blwX9Sh)tvfsAG$3HzVhEP37J^Mazx zE1>I_VghLBo9@q)5D>8 zloON}Bvxo;CG^om7dI4E5RB-Ta$;Qys~$R7DzhI1H3hWBy_LppKxSppl@iYC}DRERFBl>I)i3==*5SVCnRIcy~!-K@&l9K?^}s zRn!U1X(pgUFqRp*06HAG@xW@S3Teg8siz+-8yz{^qO+Q|0{$7oFi_A=&|c6%(2*l6 z=tX@&XF(5@v5WAo7IYJI=ku<&R}YpGgJtCp?maf+%Se_XQhJEA84~i|fQ}|rxB2y*w zKYX)9^y9OUStX+Ru0^H^rVD29{~y6DKK}X0sy-={uPYJdR-Y~}Mdu3U2{sBo63iDY z;2aTbU=Isk6TYel9T$AC++N5>7LYJ3Qsi~PJ41xgHv~%rOOKd?+R86*3eLg3SU4hJ)x~++lI<2h3vie1Z&mMe7GX@eXe+dMJz|K zUXe6TH4+9AdXhBOIf)+D+M)8XV3XiDy&p;Vm+vQ>Wyd1?bMI5ZX2EBI&jsJHsB_j9 zg$eUG(yrMe9^oLW=rIA4SS*G76E(VCJE{8Q{iBgn zf*%B@x$F#+GhF-?VLzNx3M3Z<=Y@BH=~UqUv<^45i-I4StE}1?cqZj17A~mfp}L2w zf@^{!Q8T=U;#lOmpzN(k84tYQ^M>H2;FjQL!7p4zJ;XfxO4}3s%O#p?k>IxAFTn%B z9l>3}A8b5VgJIHpnEZL%Y>_28dssL|_c^$CB7bu9Rh0O*;Gy6VmwnE=V&>jqvaVqC zmto;a&#c467^C<5U3)A@@sQC2uVYE|cjy^ z!T0d(aJe*G$~>*#A1=-aX*NPCXViy|kfeu99$r|LlGVfP5t7-%XCvfE51-CUT|GkP z4T)y)KxD%%kC5eS?d%?McqriE84o!<mi><|CV}w4{2d$MxD`Tnd;$r4@Ft~EApI&A|77tZ_U2074lG+jk&HdGHJd{_Yf(?dBQ<$WBz5vk>2gNKbCYI~^T zp{|E|9%ixS9_o8&;GwUFejXZnXyl=zhfW?EduZaJrH57?uH4k>kEAC7y(v30t2ART zQHT4WnEh|F%Sa)P8!2y(l-BI(Cep@3TaM01Y3HGXBJCA23x#RCGau7K4-Y*(eDKIT zJ5su`!Eal?kCbj6x_cnWFiMD@wQ#sh@kYO19=@Mt_x8|75thbie-8uL&mJau80cY; zhY=oL@vyg}HQ2*1`OPdP^&vF5#i>I*4D&GDL-tX^kVaStw_uIrb6q#ac_=eVMtK;` zP8cO)Jd9O@LIz64dzioyMul^Vfn>6WDITVJnC9{NB%OBwKjOu>qvS*Zdv`Z`x`!Da zX0or^r~IyR9T+7SM#&rxb3MGxsYHwQFyF&s4{vx_K)dqrnumoRc!eTH%M*F@AZjl1 z@K~aDA%`bcdgj(&=hF?7T%%=)hov4?czBCrdM{FEw7kisgB?3MY#|rk<(!glrINf> z#^epW!$!-@(Y&G^D?P0B@V} zBky#w_l=Rl?>ReYW@Dx3SjjLpe9~RC2M@bF?D0@-tnlC@cVrD5E4+=p`7Z5oFSo}^ zYrlsB9*%lA=HZ}+Lmm!$IKmFB;Y=GVJI2b+o5u4oJNVDII#zhc`f*NS4<}XC55|TY z;m-DOj{a%J$4U83+G!7GJUsC5w}-PH&T%F8aLo(1%-Z zmla-8$fTb*t~n`-L9?>70cy-1czC!+j5b zdbsQ14^`&9bRA}4_B8xU3Da^BDSzmpma6(650AJoJ}~cP4cE_q)l>hckedl9DSkha z;`8)zN_Cr8^Wq7gM^T~~e7xv~FTXPSi1>*5&?xtj)kpREj_$+v!9UpyAEu9(kGK!l zhfwIlRyvMS_;R65HD+NTVMt5$lnzr9J^~*}A6*wZnN=3*Wb#pFoRB=JB>Ogpg*@dW zn~!IeB)g9sKJxg;tIEmg<7riIE)`{6ZO8EdvXk2nmok!kio7>Yp7D|2M**caXq?Pc zYLrv0ppWN#6!KBn$MZgl`Y58*ST&!8g_!TS#Z>Jt_$aO<%(YdOK%Il*q=b)`e3bO@ zvX8Q=#!@~?`?!26{I9!AI$@Lwln@yz_^9aPnvd%~D*34FV~~%*KC1Yr>Z7%fHa@pD zp}LR8KAQNb;bZtQyAew+6@9*#Q`1K+Hn^Bm+eaNm>iVeXqrT$T$4LVp3{+^S@X7H~ zWSGUMkz!UJ9~%GlkF2JCXx`0yH22ZM2QL_E>7x}#wu{|yyfCa(f%3LK+WF}1qmPdX zeXaE=W_uqz8{5I>f$Ol4 z=xF!GcXk0FPx6^E@MK8E_3?PHFQVeAthBYeEV{+S>X zzqSh|LZ^izeT?!k!$(1w{4O-w$3!2Ke2nqKuSR2ijH7MmvB&dS6j`)0mC=O?e~N08 zefsj!ru&$p2>DbR&r2!ORJ8pBp@e*^f z@8csMAN$zk;}iB|G5yJjQh1{9s`_dZyhJ`VVpJW*Col)dbP ze<$`JSY3@L^|(41I2rG}>?SZPBq(Q9j^lPPa+n%5cudc^?;iT=c<%v^^)ugh}$_TJ1+4jXK%6 zCd*YHmpHrGm`S{y0ap|u-#AO@1TrR| zCtxH{e{$&Yn|CyxC}a*c?Pvm80wfG}Mf11ZQ8NK6f%Dh3E-y!82@vB7o4p*h6L1o6 z6OaUQCXg!uF9AP+Yzh4J*hnN0B=BScSrSMl=oAH+mHhivDNH?_j+{`8W=-I!^wj^K zlwC=3D5MTEKAk}B1i$cy<>yI&lKcr2NFZ+l`4V8pw8Dwcr0058k^f&NGd`C5i#NZ_ReN+!@JfxZd6oIt4r8Yk$h z6QvUK>~FXsHgPPbkeSUY^Vxsr1DZZt;VJaG)thHQf{6=iv-#! zwU!CAQlw3Ky{%O=EmvE`(~51Mpw9txOrVp}WMewh021h`bQq;tS|iii*)3`}4U%}+^&rpt#UaPZ^st|EqE2{cz17>!V= zuP7X;gawL*S0If}U`ztLjzq>LFqsWdd|U$K6`_2BA`=x(VpqSBO5xN5rm3QqD4d?a zyaeX+c@vnKz$_)4Lwhc&&sLlj@hYXcinDFJQ)z+X3lmtR$g2swmcTce9k!OasQ-Eb zZ>XfjsO*8$#5U}XYV61bYcssvV3p1{`$ ztfAzHmic((qeS=_{aylV6L??obqYUBV7($AD5OrqE7k_ZH!5V5!jBW71HDZONj^#7 z({#Q$fzQ(U=Lu|4{EKwSmkDf5=U*u@<*rHBxGeLV1inpRdjdNWxIj}s9@)t$#{S=I zomRLjfjtTARs4H}yV>)LQ>QOZ-Iu_A#g8lb0nYIRjws2&1P&=-r^&*ijwWzSMVX6v zDIww7ejY005=GI$2}ErCSpDKCz zP`kBf0z4ap9?bFuSbyKiAD}>hs#B%&RGBnY3I=#CK=A-C1}GF@$y6y4;Q0WB1F)!1 zr^=bBQZzuZ051fgbGiSfN{7sndzz$vpwWFIpQ{85KcJNi@G^U2zxEO(E-K;m=|DvfX6ds zY=FrDrUV!l@MJe81enM!B^GiyrhF&J|3KVXQfij8m?cx$q**c}z{~*C0!$CEV3urV z(n0O?ESVKxc7Qnn<_6*FdRxge&KCNOd~&wbn=L(N%Yp!}23Q_oMS#}=Zb-nA080Zb zVwM1l1H8eO%nlu6zCK&NnH{>R%rGY`p9YX~jx0T-y%}Jc>WZ>+gf1~Tnr{VoXP@>C zm;C^52dFrRKsqBB#Rv zjgy6j^g$3hip)4yvdj&gG;R#ADZnQIKH|7*?#Bwt%$0_7<e z*dAa(L5pERzjvylhL~Y{!qEdDY>yQ_0IsQNgxT{Px@B?-Yoe* zDf}JaVSq=Rl3X0(=D!?SC8xq;wrYOr^?8z#{ND|dEQ%67@)Jo|$3SSBTo{=u4;Lc$d^QZ#h+DJKp~T!Nrpo}!cZ`YLkm(# z=rnKOOJ-r!c>csIlB5?hWSuYMMU&x=zG4brNaAHBERn=ZY$2mb6#drbg&K4IGk85T zpO?4&(tA>=B;Gn;mR49M8GavNw0sg3lIWg9k0i|!IjcvjCs9LHS}BRjNmNOqs%jov zSS=a)dP+k^YqF3e*8FF*+oaV_axY4>Z4$pVw(BTfS7AMc^%XWy*pSUmqOsyFlW3Jh z6UCb>r#d&lIDkScoHL$;C<5**v=$w%@-}Fj7?&s;-eIf zRyal>6`oii<7j3a+y(N*v2dU5p%Tu-Bqk*>Ir+amX0wx+qWDyW)6(VB6`7%MroveY zUsw=sV4Fjp#5^UL&yM;$yqSWb<^p*wiG|6~`~9+Gkwt8O5?7PBmIP-6cN;EFV%PiD z8%ZolVrdd@Cb2b%uaa1n#PTHGOJZ#jD`-ebtW07R2lQa%muI!N6?rF#D+ePC?<(?g z#*|eDBRq<@nwkeAYm(r0l*$=XO7Je2B-SPINfMu`r1eQ`ROEvsK2(HrjU{iOVP{NX zfz19<5+5hAiAG)}g-K@)r`9WwR$eMwwM;&Ku{C2=u{A5{zafGqHm>Lu1YL`CnX zh7D%>nd^Jib=Q-)k%XBEu}rv0+fzn+CmH^Q`*RY%b3jW)f8mN$$@#5X^jA*gYSG^m zQbGq5w^^@pMsfH5(e>WZPE_yraPAiGoqKO?VWdoECX+JBB%w=DniP?y^xmWiB1)C2 zq9TX_3etP;y*KH_f`WpGf+8RSDgt6b0TF%oJo&`+{r&N-b=F?{?DL%G^fSp+Zt_KO zQ?h$B%&V3CM^XG)6t_gVQxty{Mb}B{Z9#56r_(HG(a5Q zry)Z~0S)&H`K_0S|2xu!bLFy7MR=xQmgerCgC?mt8gez{X~@?wJ($fG*YhKlOyYCj zyj`TA=Dvwk)$o9ZhstLc(%{!%X(+6rh=!sXG!2F%G1aF*Pw_verrnvEMv=i3@!zRw z0S!UnQ4OJ#r7a|^;jff^L_;z!v&<@%9oLZ1u)uJi)h(u>I7`=2L`Mk?B{kIeG<~`c zr8M_`u$vnG&`?@K84V9=D68Qu4R7=OkB0IZy0Xa{DzG>W^))=M;b9FG=|MwH4V5%h z)=))5RrbRqbxD`JbEoq5Oj3&-D|q4MeCvGfBO0n{X!5zjP+bUn=}`@}G(4uEwg!H( zL#b(yL{9i0w3-n5^EMtUjrsqlV5Jx@hRcCYR05o1*Tjk$q!s+O@f9fAerTMYYQ3 zH<_Y#)6iYRiyB_i@U(^=8lKlMfIcl#L}4>i21VT6W}9EIMw!!>+5CGU-?>N8W-*I2`;Zr+Bg zbNQj(9aGg$rmAmfcvHg|4P&_+KF+%~RUP$1-e^wsX|5$tw>~sYZ8S~oIZYj>VZ4U- zG`z3j9SsvStktki!$b{}G|bX4Tf<}xQ#4G~Fio0#uwdq)A9Gi{pF3T{=xOS{Y3ff` z($7@RpP_*`Q*h-pb&iI)8kTBU#u}c<9rs82Jgz3r^WSn8Xjr6SvG9e0KTlJOPgj?4 zdQW$2$Ut&$ckXfxt60M)-Qiv#rLSbqi_K~cYgmElY7%L%Uc&|ryEN?9uu;P%4O=v9 z)v%d!{+u#*x|-c3pWi;FWzfmq#(5jd+rhdmP__$BTkJV7U42)>PAQ0-mU}ep)o@V5 zA(HRXm9KKYp04iGu%82QIqQHR32!T+@y+RK)(n-eN&G;=hZ@dlIIrO_r?H05Icd2_ zH5}3K35QRLSQ5=Y$~jp+KRUxL>lp1Xr}NUluK7Wm)bKSs zS#uv`J6oB??-&!*~oc)c4Q!~^ar*qG8N}tZXGDH1V!vzgj zHC)s1ora4VE@`-|;qMvhocHr*`t$Xf>amTv-)o2*E%*a>l9_JZe&iuQ!%q?zZ9Y?F zAi1vLXAQq;_+7)jWqCI=-g}?T%Navvs=sLXRa!w#OP)65S{Of5^|#3XQ^PIp*ghye z+~#)2IiTS#w=aG(Y-%1qi^F%r@*`z`Yq-zn{;KD--Fq5O^<&XY^P?Bw#rSg@(Wqf$hhlhQr=tEf_ zUi~?@oDW|_vn$L}o6b_pOX(E^9};|HmODE9_;TgD>EFDYxp|ga#fPds)b^o{50Cgz z&4=nf)bL?^+`YM!cVzLU$GO3b4xRHZ-pQ`%!|Av39u=&`o|iy}6zg&be0bc4Cw$-= zmFxTP&e&YOmw>5-K219|OXW*1d2_|ZS!yF68vD?PjrF044^4e&>q9#qn)%S&ht}*& zAI_c5D^fJ0g%2%RpPN~&I83wMnv)YdKA7ETw)(>orO#}&y$>CH=;A|H_OK5fIkI;4 zr{~hA&sI0iRy)yEG^4Y$ea*A-7C|4n`EYl(`m7IpBXM{3!04Z$I9; zR2l4ZUnSl3r1Bz1ymrPAABGAce?iDgTXSFXVVDm;&B}e*hgUd`K3p&}N-asFLL4sj zr^2?6^zr4QnCQbKA4aja=cs(`F!eWl=sZVdc+-c`DLzKXSi!dh-}Yf#Ds?=^D8(lT z;g{|Q&r$jAh>rF1Ci^gTjygqfs^B!ijdRo)KFsuCmJhRi{3(JXKFsl9t`EC?*yF=I zALje8%7@jmoPR9g-l(&{hlM^Y;%HXOU+lv&uC?3@h9#mbl_-;zOLRplx>BMv<9(j% z*C=azSnI<&>5VNuZ1rKi4;y^o!r$n_Ceg`R+-Bhv$r-l!@UEDVZx?Y#%9!>$C25x+ z^}Rmq^Wm@$A2HWs8T);>ay6Yt>f+Dk9q@s8(1$~u9>U)jKOYMJKsXIp3i;6Q6~2_d zbm5Hj+v!Jr_=K~+nk6Msrn~?N8)$*X=u3Ckm_(a}|hK~YC@9W8Y5)-^wyqhu7ImrwvveJC9k!0Kp-cuxM?^^lv{;QY4npQBp@K9i?^D z((#y%GCKGkn}>B&)bXH>vO1bQno&;2Lqf{ys37E}f77TCKhDgcK_wlPMX#=-iV%vA z2&pP&j51Uc<=|YkM#`q9kVgeC&sA&dsH3B?jwYhi6?{TRJt6gVclA9kcDcghc59A^khVHH3Zd9eM|_aL0bB@ju+Y0I$qZ?O2;rAFY6egKMa0BiWB$FF0Dqndv&6286Br%ypDHt zOwch&Dl<`#wJo#AJw)F9#oan6PSr6@$9ndjj_EpP=vbg*p^lll`|$gh4`j~MF-v!U zKFtJlAGb&Si+U&sHp#j=;N zIYO4}SfS(EJawf+R|zWfRoZl%udb0O`C1(#=d1JPs|V#vY8!QI(y>FwyIlM8)wD{P zo4HaFnOk&xUO$gvtB`FvwhOsDU!_=Tf9{rL%1(}Z&AeSYcI()~G1{vz>=&|EaG#F5 z^VOt&K*vE5?^MgC^1hA_bYvUw8u*aitK$zHf9m*%)zI;ij;lKON|Pfxj_d9t34Br2 zQ5~Of2`^9?KGkt7#p^CmKhtr7)zfiO$2lG6b$p@YOC4Y7_*%y)ZWrejhSNIcpI0XL z%IGx7%jg*$-{?5YE$F;L{oZ+{;{ugB`7=*?ztwR;$0Z$?CHr?eF4B1!Hcc4zqnrhNUyg)m!ICqx|DlY$KTxH4g6Is^PY|y3)D2j zeWg|Lh3Y>#{*}2z?lC~*jA9bR;64M}&!!bH+{s2U-9Uzcrx&Vj6V zxdw_DC~6?jK)!)O1_~RPZ)HrYo>$Po_=T!!-~sXZNa>843HOyOjcVjATd3CmN#PUv z8aICfx&gyL^Tzp4-Iq7&R@U}~>f%Voh4HzGLYaIGh-Dza8X6d9AZQ?D;4uTW4TKHY z1{?!1gAYyQ@tDFNHW33+1OM`S2TMKt&OzKj!axP7KruGiz>+g*eQu_g5T%rX(gsQj z=a-V$@G=G-G*C_yM)%K3EJZzw%;r_#_VxX#lO2R7(ezefN zmh^~$Y6fZ;sA-_Ofn*X1lW35Pl0RyI(OQBO>lmnOpr?Un4fkC-^@wKn;|A(eIiJh$ zjt5T|XkehBfkp<}8fa&rv4JKA&MZ`08fZ%8KyEXM-biF`nw{TVcnbqRFI2M@xnCn{ zW#EVDp4JB1818v{e!3{SNF`}+po4*K2D%$~l5H%X-^oB{AsyMqMJkoXi_|U#x*F)e zNWHT(zq4d~iZwi!P7hCWGy~bJ0B1H{7pDzGGklS3!RdImdLOjPgta zlY~&2Y+#D;sRpJcMP@wgUVvkmAxbhj%fM`j&Jmm|I8SiCV4v}Bu4<>!7qSNoEat2> zu++dmocRWp8CY&$gMp0(PF+anQ%)-k_lplJ4fke}Rf4Mp*9cNvYha!5^(n=Dg`I)T z(yKcRY%#Ev`-6d7RWkTXZw&v*o=)E;IywK-ad6)?u+zXU1G^1;&G}|vkAb}gjvDyH zz&-=}4ZLUIeFFy!95ir<6)sb7?%DL3U*z+Ja`aGdu}b9wZvF-ib2%99S8uv3R$ty& zkZ)^gcSsq$SpAqgOl@~M9g(`tSgd|(;Fy6g*;oU|4SZ(cgn`c`b^T)Xy~XO~#qLJu zS)!igdEi~j7m`$Sx%&(1+hMt<4fh6yuef(DQM(n)_7rlRe`DaRfole?8#rg+yn*kz zUJQI|@DoM&&cH^})_>GB-+Xn7%x92=xs!m_3-espPRqriT&yUF``C_SBWSKf@Nj@)1 zCQSEjR36hkbn?Oz-#;1J<++bh6D!`t$~SSpiF6Z>bwTYe$S|RpxE#gzQDmCPGBF^8 zfgxm@@S1odfEMZA922=Fx`dTKE##TV7yhM%f+kcG=lnSD#{(t`nfTts4<-tmC}Lu$ zi5E;1HKCcPH9V)XiCrzSeI_gu0TVNAMK|5aUO(>vHc`<;CE+WVsUM1c6%$oWJYu4ni54bWny7A~hKVL7nwr>I-BZ&Gp(_TI_ifwN2D9QP)I94NqD?(T=D0&=iv2!V1mU)l?og@q~#6CK{S(WV%-a z8w)lcoJLDJXCP_De&)p~6OC(lt~Ab=7E&%RQ)%4FL~9eznCNMujfu8WRu9(Gc8h3d zqP>X@CZ1&fnCNDrqlr!&Src7NbT+XpsPr*%^McC9tG)64=`4%N@{(>PyGw~rn_%iw z=^kD*TpDtHG7L*7TWWZoHPPEd9}_fw&O|S1J5$pexK}Ovns}bmjQwB3)6WF$`%Al6 z1gqWgQO`gVgG>xIdDYA_M4WV};faUbtCsAp7frlm@;nc|GcnA>%j{=PEsiWF+v?1j zCT5v<)x>ZUuW?vSjN_1TayHHwY2r;2nN@ShUpFy|(_8e4g*^-uN1GU9VyubdZIz7W z>f0tZv{&BZ!fC6VXs^7{MtQrfl31?3!@la3v1NDq1QQcYOfoUq#8ea0h(&Wadx=wI zK9fv0F~bD0*>aUpVv>9_-aFgGViQYD%rQ~?SkCj=S#wRyGcn)90(Mb$7Q;dzFD+LW zvDM2}D)e7@UG7p7>sdVxlZoXfRxMXom{@IMjfs^K{cyRu%7lx{)k$^J*0P>;)7A;n z139sOS!JV%ttLnqHVN6x5lJaGm#f=^Zx`HQ;$0y;YP|4wCbR4|vB$*6CXSfc%Wb5I z@}3~cJ`?*>{D6>yf`_=7tWasd@V{0b=T&sL`lvGIWPFF zVAT~Wx51078<$VIcUF(IOD4XqkVe8lakRSUPwsxQ5O}qnQ~eL&TtR1!r`djREzm9e|J!7$)$r6jo_-$<0?PNrlyvHT z`2Dc_Q2g#5lH*6NADMo4r((t|KeGMs`rVy}YtyXZ)+)~rIw>Sh^8F|%sVet>$lCG5BgD7j6;6J z{D}Jz_QUog;z!gEM+!wF&meKd?5>~tJqbUG`BBpEZoI|)C?O4J>bc`-G+@P8y;6RZ z7QKu(`KXqs-3pcEmh-y@I1=u|<^8B2sSk-OdZ0sYL6!WdOx=$bepKEFAB{z9;zu*TdjM_v|JqQYSxZ0K_|aC9S_!rmWa;gM(B?@$+6$-u4(z&??n#V} zesmJIoh7L&yG5e3Vd_(UbW8bRl;YDe&wB`R!apOVr{J@GJeSgY3F+-epOn&9NIyUN zrHHw1?ZzUIdWKSuiTx*u0IdPa#zV+KaAw#X(jiC#5PdS)x+}r=~<&PWNMmA2a?>s`Ps>&&3$XTh9gjcGYx+-7$QKqrNaK?{sgr7|*4Ogn)`f-6Xp}4Z#!gqdLg*_3z^a`)+gUWR*Gi}@e1ZxXdB7O<-Y(6%udTUSE|ce|F4Y? zSV&kXCYFUP6t+;rLQxBvg{TFGc`M~q4`=x-=oSnM!TO42Vcf+W)57JxUcca;zl zrdkMD=v-K_1;c`^uVqq+2q!5KQDPR~k)D&@GCOXeb~(kbaD&bMsZUOE3neVHv(Vl` zNeiVc)UxoHh0+$LI||QW9B!zTv9N7q&Vv@pS}13syoD+js#>UE;UNo^S)V4#!xsAf z>8WU;l7(JPvL?lpD}ypRe&l_lVHU}m$J1!@h=o90scxZ$g$}Jf)hxU+(z}0PMokM# z`=;HuD(6uP1J`8MZmLkEeQgVMEHtsu)Iwbg^(@r4@VJGQE9F0CL-#cDsa`oxh@Yy> zGa6WEXz`7IS&al6TWC4K!zjb;C7xy$npE%dN(yrj3MAjvZpe&69GVR+WUb1D5_C9T{lwKw~DmD)#; zE406b=PkTo;YACr`g#Yj|0j6OQp&b`WuS#Y76x;G@|7VLh6-u6N@cXC;LDDtn_x#%mVdu<)jZ5f(;Tc-=z95?+Q;LWt}xMn_v1 z!)~!K!NOQJnb`+;$64STlin7-b$Pmj4rcKV71Cw#j z&e>&Qt%Y?K){97etB?&AHl~zK7B;8&7S80=D$N+SS=cW64#9U*HamqZ+m^AL+lYm| z7WP^A*y1Zvv0ql%Aq(#bIUsn@!p*vATz#*vcKhmm>8lScd}!gY@Q(zUi-88jHtm$7 zoI(~pv+xPW@jwQZPenf_*lc9luQinu7EW6D!oufVS(`jm>ObKk`R+$t1OBu-#VH+D zP78iz;cE+Lgnz^R%EFKA?e4i}IcF@KxA3in3tavdzUO@CsH|PBmMX1$XW=3b0TxEL z%h=sIjW=tNe74rhon+zY9DRlNiiMvzi$-MsVc~YS?5o_34|{J~xMtyjGRk#n)X#!9 zEc{~OR|~&!y|CsDvsN|As`+9Dk(?o|thYiv4@0fe%GWD$So2%-$@#z?z`|Xwy8xaE z;BO1}xM~8Z8o)mm{U4oR5$ADRJoU-kbVKTHY+5DK6~03`zm2Ve&f4@Q^;G=>y1ZxUjsGC+x2(vtva$Z-IMgcSqpk6AqegKaL zK>H^|X&}Z8Q&nYU=%I-uwGnI@Kr=~Y{hRZYT>vcuXqD=s*3ukyRI=OK2GCA&wGW^} z08a|%4CyEy=($?}odW0_K$ifzirD71=cxdanCztwWC?c<;OPKP?Mm+%z_S4i z2w-3U&#{-pbH4z33!&%tVrhMZlk}AavRvx@rAwbr)nrfrG#Dn`J2-$Lq7My##xF>H znEGM>FNx0HU`Nr(%K^M1%BzB-#OH9q*91ohjud=dkbYQgx_vW%(E*GJU~B;I2Cy@L zw*q)OfW-kUVP|&88OPECm>$6R0Nx2;LI4xx)aaxDl4k&THh|{=XgN86DUyYJYQQ~9 zKr%y=xdF@zV5aa{l5uv*a*jl4$v}tm16UBiLMdXAV6v1XE)8H=0P93wF34P~16U#6 zRtB&tSwxStWa&&@Bg)!Teb!5^4T2j3*d(c&1K1|Y7Kv^Z{LjPo0CuFxVl{RJu$${K z1pcJi6Tsd8{tdzt!oC3ZvnPWX8^nPC4s!T{7#hSOjwvTz5bc9_KY$Mc_$h#^0el$1 zVRmU}n*sb0z^wpoOZ4z&55+&Ztk$Tb)~Mun*g0#|zXDh) z(a(SP-dm&o9l*T+s?5ls0mEp?4ctFVV0%?VW7;n4w3`HcGY>O`l zGYEeWdeTOaHc!=Xi?)IYiV{famAbkfLK3aFR*eJ^4dUS-DhA;M5euSp5M_dhi$Sp< zXM)?42^lET|c)0otwKpOGEAj+p~$_7y`#h+iRRuKMBN}01(trSG% zAQ}YGFo-HaR1Kn55RZw$BSBOTqK5ElLF`_ue!o_&S|H8SF1uzBk8)|W%igfbODw!j ztsO+2AnFJ4co21is29Yt5oyauq&>XO9i5hf&k8d7L=e-3HwvP$_-_$J6Cuq6IW$d$ zY+0vP7?IXIh)GS{o^KgMs~}nj(MD3+3Vt;pn@L}+Q?H57!zH{Og6Pko58}xnItI}x zh|WRu41!5r1WCFJ=^DgSDWzKwCtBw)iQ#Dxdj#=JDwRpk2Ju`Fy+nDuWp*DSy#<-K zuaJI%8SB-gp8*mb6vRLw6!$x6#K96J=g-;~xRbO{US~~qrN0=&OF;}1{&En*C5ieg zLA)ybPD>AsUlTq;%orUR#E{mmK1%dAf_O8Cq$S1Csf=$0@pcgVxrqgN%aC_m5FP3% zQ-T;D#5+Mu2x4LogR7@amefgt1FO47lO!@}Y7o=dx3)5!Js-rpAa3vW&Jdg_I4g+R zLgolEFAcKmB z+91}kKCJw}j5X5gWz)SIpYrmrE0y&@YzX2i6+tQtzs=8xZ^{`pHDe1GP7phT*cHUK zAhrjwBZzl{xc_}`u@Br(H#@gvc5Z?0nTtnxDeewpPY`>9*vGA=dnOB_pCoSIoI`%G zhjNfzD!qD5@Vy|82l1Kk_k;K#h!2Gy7CainM?yXpJR-PmWCn+Z;S-5|8pJUnRJc)} z2;%b~E(G}?75EqXWDs8oA^$?imqDCLDW|!3J7qA5;p-sI1o4d|oekoA%I2Jq=I?sH z6;d?n8Z%rB;)j&Yr64Y+`1e8%^-QD9kHW7A{=^s9grr`&4a3F4k4k^d#+ZV-P9=_zK^|B)!a z`P17)g!=^bl)hZtnj!c_u~K?KNHBy@N(l?G1rM$DL_=^w z2)A(8axCO-2=NdSA$NZ$CiqAQ#X~3&a(l952<3#3mkOb@@G^oAru4EQ9G5;UFG__F z9tz=M;gtm|3RV)Fe(8U+s7eS`MfpYYRtuqe2sJ{e8A7uVnuqXc2(?0Zj5Z+@-Jnj~ zms5R%I`TwLoeUWh zkhFZ;J@3>rgl9wOCu31~qxxJ3eL`rlQSB8%ZxKsxRJq&yvoEKwL@Van!k2p^?*@9mj%btHtNDdiI(p9&u1 zYE9{%g>XW6N%726tS3Y6$=feNFk5)oqSGOK6+&(pd0~9b#X{pSGQ;?WlRSj0AzTaL zTnOhwxER7Ewqkz9w;_BN!m1+~3>QME7V}h=z$B8(Tz4V-7{d2r%v73P5&NG+VKkYA z_6*lU_&tQ1V(@baH$wPDeEv#fvH!o${}AO)2!Dm}X9%}KxSgs=(u~gUih}U}YWQ~u z_fj_haCAm{{|&*DN=*|&ks0p`qd-c(KaBJ+hF|n%2%=zG_XcUKc2*ePFml3RaoK{& zRwt1L`C$|cFe-&%vr0{sXc&%=NEnx8WGTkNC>2KOFydh(!YC#N zB?OBLcH5-Z8S15F$uLH3Qc1X+%Y;!bjPhYT78p3O)Y_c}Hg_hi`K9*AI(zEb7f;Gf|HuWT0 zKa96tb8ll{cp{7jA~qCk6h>nk9w(I*KqX=)hL!dS^w7RK~2W`waYj74G03}aRp zbHkXIs>AFs=5V&i>Cj}Yi1Q_NfgsOrF_pMjqD#YA7RD0cw4_d4F3}ZX_iSy_n7BHO zHDPQCV=HSF#yYXt6vp~6HiWTJqBLVj`boOlEP9et-xkKZqHGUiM=B|qYiG&>&GvA; zxA1%z#^EsbCZ~{eJ}(jO7qbIgL82TA<2_N{54#r-KVY9Xbt`b9m8VDx&qrZ=9Coi( zj4!7g3FBxOH^caY{j)_a)W`ct7@vl5ER5q}?A)T>2;;LbPK0qjjBms4?Jl2(@nsmN z!Z<0>F9fO2>7bkr<16m=VVo85>oCsnKp?#37PaRVm1Ybh24tKQ@pVxygz;S%KZNn4 zh!@#3A+)^2q|O=1T;FrgDdF9*#mnfGFs_DiEsUR1mK%q;X4k{`S(N4CxyVu1_!nsi z+wv=SMd7~-c3JAB_-7cm!nhm8-<*Ljdv7zlkWrpAM*m82{-C-S#y?@C*?{d@{u_qJ zcK`j+lK8gZeKrb+m|-KSFzJ3#(*KXbq)Z!GHnMGaZGO)kX%Xbu$h9%n##=U@5_Ol4 zX2WMA-*#{5TpLje+IYN)q6$7BSja|UAw>k4TGU3)W)F#O!?01&MkO1j4Zn>AZF0)k zuxy;~;I(Z;q=9{FXhw1HeW!RMoZc-L~X=vBy2d6t5@B$nD}Aciir}9rO~Xo zjS}Lgq#*s25>nd6Coj0S>V2_AebC1B4&Jgh%GoGygBhtmWTS%UER?Af9~QT#ZhH8e zq_T}iZPc>epGj2&tJ-)(NHsy~)rHg$tSR{G7WFY3wQY2?(aA;~8+C28w$a8$Jsb6H zG_%p%MuR~1YdN`(+c;2Kd4f?J4Q-VA$lJt5QyYzJG`8`3#T+VGTUBC*=4nKAj<;j; zw6VRszi!WLQ8%N7jmlfqmV&JWd0w=wjdnIV*m#nyE2WfL;B9Z?-k07cTixH`1GlPK zm2)O;Rd;MvJM;IpjX^dB+vv(3v(d{&ZyWEH$mwR|8Fu^QIo)kMZR119+e3QwitwH` z?%$?9EBKt?>mzfh6y2tNf6m*-MqeBKY`jp~JsmN?<{1)~KQB0_MOIQDC^PeyqG>~H z+}`MU-Nq;zLuq5F~v@a@*A{Hn!5w!kle3w%gdj zC4AG%Xun3vyP}g&Y28TKZDWs(gEk&~!t;EK%)PA7OF38bGxi?#?&AouOAmV)4sc>` zS4j@B^S7%*wyW>ic;ChcoIj}%q{zV9er)3im%NQ%Z5-t~wQ<45cQ!t?(dUr&D-QGo z?=c(4CF5r{PTKf_LuTW1cK&vCgE%36DF&x(oECjYDrvtMd~M^5jc;t6wNa*h#(DNk z7lnl3oG5uc-RQS$(RP*O>+R~9y2?cxmpCpqzPE9MUD`YI2OB@yxN75?&DWPHS8PnJ zqx{4zu29yDs8XPgLUC9X&vhFVe-<0+3YWz6f;D3ks@& z4+s_#EF3`*A+#?VftKPscc?}LW(1WYs4SvCf^Y$fJ@gZaptwYL zJ)IVfz!83|lM;&{9zi04VxrLU)0UnyQq>X>l#HNM1f?aZLIh<}Hf4o87{M1UUFQtt zA}BB7-;(#Cl;y(_R1|K%>o&iN@W&#k9YIy$kEATCMNmD08WOD;K`kMVrc#?6$*C#zMbmSzdZ{FlX- zakwUe)e~GZHe`JS8zR^h!R`n)ip{oEu1!KVN3cc6)|7r|r@B4GcSP{6@SQ2;>P~e} ziXV(%Z;I~|vOj_YLh^UHoxpHNqWuP?eGtKi+!LbkMR7QSk0SUxf_o8s9Kn%@dnVy$ z!J`qJitwgcd=kN@q8ty-WfvDSc44x>mgr`LT zA@@abe-!D$3kXiB=gEjd;gerc_g6im%*g&EPhxfyUP;P{B0q|PQRGIECkhQ{Ps?OR zqMFj_q)-%vrHCSeREi2=Eqe2B8}%j1ypKomgz)4%Y?RU)3rP-ElPH>|^zjwk;cF4alTmbxqGd{N6-Db5ZzH5_ z6zznx7wnKqeWa|XQxu&g`fL|z&iAl9w2#6^j?C! z1^c8d`wHnN*q>v)%RL!5K&H^ZCZ-46hotUA&Os)X03|i#VB5iVr~@k zqNrIvdsq}Bqj)`vmpOmNdKq33@@f>rQ_5>XMnrMpl^hz3isB6^XnYiJMlm{yy1U$8 zo?}FOOOVmALTLGR%6?pm(Egn$CPXnYib+vSj$&36v)Sq>rbaO>is_PKiD2gRfES03ig8Xa0EQ;k(tduBi zRtQOENuDAgu8v|&6lqg;X{~-6t*?_BTk|9OdIPX=kI@spM>l zVrvxJqS(%56~!k}d>X~OOp4-A6z@f`D~jD*#kVpJM6oA|y;1CoV!wExlTRDCfrPF| zhzG@(_KdzC#Rn2S62*ty{G<3NijV*Q^B(;_d5=YLJc`qzd=|wCAzw!Ec@!swe<6NY zP_ir*m*l6|1mRyr@wHfbLe&mEqU|0fI zIF2=P4mm z{1L^UQQV5+Hg{bIc@FMG@mCc0IVj-ZZWMn<@oy9!$KAT`Npb&hYx;jr=%qP;9Vh)O@DwZ@T<)E~K@*H;|^LnXyxDu2MruFanRI3LkEo)(+Y_ zXeZTflWK2!iFOc7dQ0|RCkLG!JnP^&2VEq!n}hBSx{^yY>7T|=JLuuy83#R6U6Cw~ zr870zExjD{mR$WE^bxbZ4*I2fDQTI^^}K@t|8M=-SA!f3b}+=jP;o-HuRD0b!HW)F zaxl!ns}6>Xx0fBflCt@)`L8(`;b7$dTWzK$%cZwblJth)n<+DvJI29S2X8re+rc;o zTO4e4Fy6sC4puu@<6we=i4NvCnCsxue(xj)9d@ZR9ZYsG#lchu&o|1N?%>-|nGDl} zusHG=9O8ls3GXMLVorYkXI#&FER@y6N5*_j8@KXY)x!RHQ6I=JQFwu3JmeCgn4 z2Qx=1r?`RaR;O&rzV6_(gRdNX?cj`qa}Lfs_=Y1j!JV#Wr3tNetI6oM4lX$O!NHH5 zfxFf3ILZz#JGdxOD$GLsUUE_VFM5SLzk{n{Mx6!>w7ka3>{dxwlXrHf-*Dhcl`Vaeak4h(=m|L+lK?vR#LxC9X7oHyDCslaczq>7GP4bXXCuYTv z9Ye7gipSuMAt#1`Jw4$VawS)h7~1bi&l8?6SWr+Eq^k#FD3s!bW0>l3ySHcz=7vm- zJ`bfc_+rq-hTLG1aDNO|41pMeF@!`JIV=00<(b{~s3+B|;nK#w2h;5sA~Bw&hZ6&% z2|<#Wka!Gh4yH58&*0H|fpwK+710#_&Q6FVdB`P5Pk?^AZ_-Ifhqac%9K0UX6i843FV8@kS>jWL!py zPGbfdY_IHjL-eNYJ)>iIQ#g~@8)H~d49v(Vk%2@1b`0ZK$!6|dG+en8Vwf1i?!D@Q z7*D8Tatw1NIz^EBbRkn?n3hub>JREOBsx=YRt&RKsdJDlu{PQ zutYe`Xumv$8oN`&E*io+89n;%KXyG+7iP$_W6a(^-|o1 z7;3$mwK2w*v}AFTY>MHlz3OH`mb*2EZ82<*VMh$_$M8W6^zbgnQOHit{1{d$%I+BU z#IRTR_=+Be$rU~OB+AqS3{uv?7%!~5+tGXMlZtLXGcc7t8U0Xv9**Io7(R}{&7~+u zgfR7JjL(C(A_wjm+so+}N3S?OW4pLh#Zf$t&to_l!}S<`j^PV>i=ptQ?29p+is5t& z7o_N~V)$*Z`mOMK&VPIfm~={~?ASIZOAcS7Nv-3i(eda!rz`Fz<~Re&PNW$L)jZbN8vgvYv4iiQ~5z zevjd141dIs76;>uY4z-!a_cWMGOe zo5X=NbMA|yKpeSok8Hr@WCy90P>VW?&qi{VK`eIEKVAG>#YI7#_!Kan#+fz8J?#;*k8&gXzPB zzbyEQ;H!e%58Jf!jEK8G35+qy8*z-3;buKw7lToP9B!t*8OP{2#>6o;jw8hthPQ>h z#W^!bDfh95HWc59V?rFe;@BO>#5fM#RW`|5o)pLAIHtrgHIB>s)zLv^S{&2k?$4f; zam--N_p2-7V3_XTY(>NDZv-#KaaIVGb8(y({;l}A zAo!i&Vflsd`FhVKF}Td*&Uz2UALFY(=BS~qZ zL-0PqWLeC0f5NRKb14aA(l~*F31mqwre=#Vi}NPjX68sVS1?bIHpw=s5+zU8jmOQx z3DixXUIIlDD4IZ@0g9HuV`An@Ku^F(z)T=qNU55DKLIO&@{$@zAecb01d2;Elt4rX zD;XAI3tkT?(FB|XViHZH#CQTsqA>}vgkY%zN((8Oz#B3j%1D$3WfOQX#kqXS2~V!9 z3c?>s;Nb)+CQvDXZx6U@WZeOkO63HqB%mHt8KqwPp!!Gx)uct$6R07Ct!sNwtttFb z!CHb3RPivWw)n4;z)!C#+{8GywS(#P6KI@3lZ1OzdOU$A5@?Wck5iv-aF0g~6KIsG zEss##U7IFwa!>lxbgL=N5@?=4iv(IG&?q` zFFdGH87k2i1YZxSYVNQq{K-csqgN!e0{{AxPtqLSARyl=6mbL~P3qP5_I|)okU`7HnMVTl#RdABvWWgzdFQ0HE|-13o<$@ zfo111we+^C%NV)uqc7W!WSfP^`N>if%^`*bB|$30xLPe zj${@+q%IYkWrE8ES0qqYEdTm2b5#PX6IheLT231g*K;KvQr8L6)rJH%Ca{Uan!pyx z{(7nulAhPxr(Cxsuswkt3H*Ody#@3Z#rHq{@B-fKvu|>S?uPevJwbyY-6>)5u~1PF z6;MP(=|(ZY?iM>SXz2#&?(XLQ+VS^2=YP(eduC_v+_`h--aE5*W_M@K7pwDd`-_QR z^6+aOUivlpTOJnEf#l)$Jj_+q|H#9F`Qq<9%-)&&GY@~MLK69KzPNQqa$X+h6Cn== zR4WVB-NFmRB9*DUK==#9KY93NLEO`&d03W*U0+BO5@us?5 zL%ZIdT&v(Z1@-x{QmMxH|OEsJZ#Cs);#Ra1Ahv(Ef3rCup^FIZVqJh+TR3FGIK|4|^33^F$*&K=oFXw{*ZE2LJPLUnAV#2uC<%dDs?VdxT?j zM|pVI#XuJ)@^F#^VWE?SQ+YVe-Wgb7;P)HJGkIuc;1&aC^KdQ?=ksuZ9@0QX0~hmf zDGx;q6g6-;4_ER41NjYH&BL`kBn;#;Vn=tKRx=<`Wudr1y;5B5R+7nCD6aR4BRouZ zEEEL{6f}@Dpc{B)VJzny1BDD|20nR2n@~S7v3`P?Re$D;AF6%7P!uYwMItpp1dC2Fe-ut5czSOKT(N z=1i}nH!GzbUMN~TrI$C*tbXi0DjBG3AT$sesA8b1fjk3-focY-8>nTVwt*U|n`55V z#*ffy8Yr+xFtKjK@tRyD>KGuyk&%maECOb7FJ2O;PBrAeW#l>1W_}19x+9 z4cuYiP6~W_;w~c&PV#PxB{Ao>EfIYF`X6Ow;C=&xUP}yB<@Zu!Ic*Ks?lbV_60uAb zPA#QBXy73O!wfua;9&y;4GcE$gn>s4JZj)EGB!PNd5LIIQRf2`=?~(F|05o!wEu~l z`wu>8;3)$`3{cK@{=+DD&Xy7SpSk)_#e54d-!le=8+gvZNCVFr7-8U>NwF>s`$xR2 z=x`Cj%jXS@GVp?dAO8_YpVnS9aQYwdsHW9TYNM%O8Tj{dvgR_8`%U7;Fm35l@iDu$RETBb)@5qc)V$2u z`ExZ)T!DXO;A;cF(cu`FLvb1S&cOFnylDyE{Z>&Pr0V`aaT)l9-BE=0DZgCMZ@gSq8#_i%jnh}svCwOo zc-6#e18ZpACL9xM4XmRZGyxOq4Qw#5&%k~I8x3qSu+6}B1DmOncNf}fAh9H2E*Jl* zer=&jm(|&?4bao2wH*d_8rW@MkGi{y3Z{5#yj_pT7<44hZ_3kqIT@REX;6{OJk@RgjbU!`X5imm&Gft4%7 zO?s6_^>^zPIk-Y3OyplF%C8jJl_I~10w#nBX`-Ns921326fsfAgl6*JG>KdjeO8L3 ziPxTIus!GFl|nb;AQdS$d{%4nZf;Q%#mqRkTEfJiE5-3Ku}T*=F;v%gu8arq`btsK zL@5(hOjI>d+C&)>6--n#^Q!QO*P-gbWOpH({(2{Cr2-RburRjb>hSx>m_V zWfOx~PPed1R5MZCL@g7w&3KOcK1n+Qy_HPOyQXd*Jv#6(jQDHCZE^-R>KQmq!RP0%tX z8l1|>DuN`Hw^}r=ptoNw8klHEmR5^KCK{XgaG&6CFiIyf>QS1w2 zN!~S7Yi^>2iCayq?5STa5+`O_n`mRkPf3l}#MP^;5jB)IYj2{1i96VYiH;^ZnYhhF zZxfwObTQG*M0XQ2)(ASB&)0~q9G5lX&>C^RqTa(qPZPaNFrT|tR9qXAy>+di!WP)Iu5(K2v`!2% z@wlRPzuJUi@PDw0Crk`pCuXk`->nlP&L@XZ!Av}D;u#aeOzdAL=&UZU6aPJ!R9G*Z z_2SP0daLzfgo)?Kt%(UHMw)n@ieX|jeZ_EXl!+_FwDId>A-q6-)(gI{!~7T%<4jN{ zU#}NqO{`fTe>a=u1Lh;V?1F#B3A)m{@A!4HIutnN9p`;w=+zoA}Jc z=O*5v(wg|d#D^x{Gcj?4Xgx!(wNZS#LA-Bb#RhS1gVX?bYOpJOx4$uB(;&(;F(e$}0^9OZ)lelw}7`I9M&EYn& zNR_|4N!+n8XTHiWFtO0YznjFhO@ix(3Y+7m7n@k3?tV8!Z?ah|GqK#n9y%QMm&QWh zZeoLpRdo3KlB+pb?D*6A-J9c{u2qFM4kXtp3JiDmZB}HXiA^SUnAmAzGn-Slwkx>B z#8wmAII^4hD;%+Hv#9!S%tPaUMcr=_^H;=j*k$6EeEQgb#cnFn<2n`N{(r?jY9M7o zhi2jcHI0t|CJxcv?M)WhoqYdaaoEIB6UWq893kibihNsQ%6*#TqaH4pk_g{OoHTLD z#A(Gzp1OO+M0Sg)`Go$)k>pwGe{qeO3nng_sA-{=g-a%%R#4PJF$-5rT%|L&P|(6P zx^DU?3;8YFFmaQP{cLi?7Ljv4nXr)0irwa2s);&RVt4(&8`|)J+VC6N(GGf!g+dnN zvCu7O7J5$8xp1BNjQ(HLJ=a2EHdk5aj^X=TL=g-BY!N%Q2z zX`!^me@!C)R#AGZC~5JuUXpvzrL1@-nl7bpWxeNC@nbQ)tc4LEw7iZnG_J+F`G^32U41Ed&-)7Sa~(?O6E1ZQ}K9BD4@G z3O_02jD;z~lC+w77C#*sQ$DdxBEws1L!9r^bSGS9{78Z`y+E}QuL$ul< zhVBsUREuxyh}oWSB-#9}+|4`0*&U*@g)SDh+Sq2JD_gMu8~JT?x6s4F=N7);fLiEf z;YEvon!{}tdRutJ!lM@YSm=buf_+Y2_Yp1w}g0e8c!h;s>Q`K9YOy194B;qyXo}J>SCXC7sgjx0&pqN5N^Fl*_DyFl=x7pm(1fQ*D?h)@;_D5Lhr1iO*EU4=qf; zlKjNNM;1P|@Yf!3YL6(qSGapc&%NSP3y<#=AMF)??G@iu)xWgxm4yu!Hjo;Va1!3D^z1u5gIP%q9z)S>3{M3;$Z!VqvF+U9=qw+bnFiu!EjcXt@W3 ze;}sZ_JH6UTg=>dKm03Fl;QE7H!ZbIK{;hh6wpMpgD>3}#$k3>lh(GFQS z%!Uq#k_Sa}P_#KHj#^+Ed{E3hC{9>7Y2h**IO9JSPFpx@;T(tcC7oNz8xD#y7HS?6 zeBL41^R&uC;v!Y|khq{A3op@x4~f?f#e80+^QVWmadJxHy6S$}!y;khhJ~9PokL>t zA+dg2^4KBK>u`)e=&<-Azh1ybK^uc?JZ>Y$Mj;zn8})2xHj*}~*{E(qw~=c@+9+wG zu#F-%O4txKKaZ@BJuHe6bFyB{MsXV-9Tsa9@iPj(^i{5YM0}y?rEHY8QQk%c8}<=V z#zwm%g5z7(Mmd|O9}E5Wz`~_PMK(Q5uVSM?IlYpN$~J}^5q#)i-07_&qN)u>eJ@SZ ze>x&+*r;j4v|-t(Wuvx@IyUOs{4{7RE~W)XM4lZ-B+48Ww|C2ZX{>J8xO^n;yKTcE z|29%KT+$h$bvP<~8yIhd(a=UC8*OZ~wb9r{6C2IhK^v!ziVvRGnks_L$Q8wPOr(y*WSP0uMoSy3 zR^)J^Z)Ky)G0~btZX`z?i#y8<(c0N)Z=;iq&Nk+KmH6zK=wO3SsU2;sIVP?g6D5v| zE_D7jjN@W=+g$#lg|)h=7W+?)Wzy3|FB|vTxX;FIHhSB*%f{Ubp^uGj$Hnb7`r7En zK^d)Gdr>PtF-drbjXP}&I4+1lcyNN&-^L3>?w0#M8xKxNoWGi!dtBVZspq&TdP3Z9 z;{h8F*?8Cn*WtCl&mCZcE5-+HRJ@XmPKeu2h-Xg39Uo}p5gU&x1|GAqQ5AlCLL56G zik=jMZ9HM)D;rFe-p+C8_(G|Jw)T`lw_Z=G2F(p zl>bTbKr#JJ1zA4Q#)n;UpI6OIJSj%mV0t2$G#9Ioo{2l5* zd3~P3dEdqd*=)*Kt(*jQv^v5jwSd}rf#8*^=ZZ{r6WzmQJ~XJO8dHhw-WexleKcOD_FiyiLH8Kd1mU{-(Ox`0M|87cG+m=;1&nFZS0{NbWqB{UK{&t+_aH!u;0c38|Q6YuyN4FAv$52 zyp6;3PCV+Vnmc0SsLEVBE2^D~XXoQKPSD4m5-raO!rRY@=g*1LHqP4U`Mdc1oH#=v zoQt18&z}?LNdH{iK|VrWv~k78RU4B(%DrTx*m-eTLEfc9;Ogj_jq7$CtGPk>?2o+% zrNPU54&b1$gCY*{J1F3wpo1I-*-09M{I$=EUz1uP2O4i(O_pz|B^~Gvave-RA2;1m zLC$3#o{z)bMI97#P~1TY2R}~Hn|+?U7cX>YO)FE5HV7e!r#w(EkxMe*pxxC>09FACd%;~?!I z4uA5Ze|=HxP?({E$cZCqbP+c$ij;$nmtqPvE{Ts1C$kRfIjHZTfoh`v zB{A%hShPWJ=%A5<7MBH&A~aUFnmA~xGT*4``!0zBmxXzm0z?Z3Pdj+V!L1HjI=Iup zT@G5YgATen=;ok}gSHMjJLuw|og(r|VZEb+_6|BYxc{;kby<9HIp(U9y1PZ?sQ?#M zX2Z#3cLzNj^mA~#gQ8bNPleXoK`#flIjDT)|HU`zUlDyA^i_A+WhPF_ckptY{?bIP zjoLNnens5vpudB`4xZpG2lqG_;NU?AL$8Q?$&Z5{u88~CuiAx}re6^ku80Sm_+M1! zRq>F6hp7M+<4_O(Wj2ttbiKc(Gye$nVRg=<4jxmPK?<_uaR;;CFT%`|4xVx_OtHtM z`>`it)f&Qvu8N@wuDzCIq7xqO;8_PRIe6K@2nWwO80%o1gOQ}UB=LfS7aeSGm;1bf zd#{R7Bzsj%y&4PfM@%Z^^z2QKu=XLSEgAZt% zE(*K&(7{IzHaOVm;A01$IQ#+t{&w&wh40{J2fsM@+`$(PzIE`OgD(}sbJ)!(+E)&~ zR+odXi^Hn&A#jg&2 zbMS|QKOLNOv|2YrYfb;18e2@COZB@U9=Z`P;U?UOyRhULZJvYq4wgGu;b4J-g%194 zu#|4$ckz~{FLJP$UAQ4u-4LH1PcCtAT4m(TxO(QMSVnWWDaPIuD=9q(>m00iu$omK z(P)@!9L%{XUb!cCEh(3erMKaxxYjz}f;n?jw7;0#V|_I4z6B`hm4P_qYorGDO62JCYJ1Wu*bmx2M1}?3CR&;;a&&(I0ZO(G$Fm>IukRz zb;!XH2d^dMVX~)UfZFxhUa6xG3$Sj0>rdOS&lK;+{^qk02HxC)~Fo=R=ltQO-qW7ggNY z7RtM*sPK33r@<<7fj^KukgUY=1Ig@xMm-yFkF}}YPzW9B2QHj z`Qs*PD}r@g)K!JQe3;w6q}DjU`~>>ivbyEMcKM18TvneS?;-NxjtqFJ79UG}RjW^a z8Mp{tyrgJ;nP2jGKkXvpqJxW$F0wA_xoGa9g^T(w8n|fUqN$6u`DH^F$MVZYF20|Y z_+eJ!o|1ZFH-7%&Jf6RRtWiK_3&>_J&i6^&;-Xgp`B(vYtBaN{TDxdNNhV~Cr?ggz zjaLiE?+VDaE`A!PlgYvbWjhz`UBphNfTX)ST|jnn(V28y+@{dFxajJln;Rdoqs4Vs zbb2b-sG#iOqIPYyOMf;1)2Gu%G~4P-v2APPi5|R@xcF;3~=NByAkjhS?(v`6c-+Nc7qvaq@$iI;Cta*|vBt$yE{3@H$i>GlhPwPl5MFZe zvWur(Jmca;7o%Mack!%?=h+2{G)In5@_f$4BRR6oV>$!EBV7=_%3J4?@~hkzTs%Hj z`!PqZ%8_GSjCC=|#bmZPCSD|ub1|NZO`k9zF~P+|Rrf-UBn7@MF-1vrnu}Ws#Uh=m zw53KNIo-t!s%0^Kuqr2<>Eaa^Z@GAz#^vHQRq;(1ud^f9wQq9tSu9t`vnh6Um)bI? zkldyU8FPNe#k(#(psROrv56BQ6Zf*e)g-rcenOSGD`6E-B;gnWeOIbQCTwySUW1oa5EHAmJbT-*x zc-;4FVabztS6%G8p1j5;78T|MebYt4Lvar!Jmm8L51NOhhx}eVWfbsG&;!XnU0CL* zl2l=xm%LTTi%&r_qpR{F9*U|=u7|=Z^IGA!chrYs9xfG@9X`liUpUrD;qk-*Dtf5o zp`?eQcO=SsDCeP+he^Y<(jLlqC{{!UMI?8Hx)+gL)gM;BF)i<5!J%XY56>2n%vAPJ z#X~g@)jeciiT^ZR)x*n0Bv+*07m*A)9VoBY@KDo3Ef2Sk)|lcUDcR2gdPsRld+;a+UGqHzWVNWw6qTVW=~`5NthO5>)#bzI zk{L4Np@D~n9_o1*QdIJ^Kz%P>?No11gde zbnq~ym@NH6E+JcF>g=JbhcAoCE*|z3*BNhQ$hVsps}1iG_Vm!p!=oM^^KhGo-lXZ_ z9uIvy^!3n>GGyM?HW!mKN9#i-=>?0+J3QRw#d{?b?41;2ammcx9{Q8{;&Hn}ip%$k z%X>ZC=V5?{2icrzk%xI`L@SER2Rsl`Pc9Xg52;=Z^zbkhql9cyLei)o@#5c!4k{sE zEg=Wd`P1incv4{w_TuxRY=!3y2%n;~sZJh-dGYMV36X`rmyl0;;9eW|-}4FijECW> z?&cCPdwlGD&cjF#Us1_DJnvx?$Hl`eQt9g7d%Jvz3BD+~cXQYmBiifElUh(j%hiM+Bt18^6o`n~7^mRp zLM{>Vu#m-MT=<%YjFeoLemE&Xw>I0u8y-IL@Ue$C6{&YTyzAjDmG3L%+f<%;In2E0 z;e8L+N@*YPu9QoqeBjAs-H($WdN`&i6Mo|1Qx9K|XI1?(4}X1>yT7!qmz1BY5@xuO z@yX3tuwF?y$HO-s7J69Z;ad;idHB`CZyvt)@Pmh+JpAn8M>bkq3lQpL3e|Y$ltyA$zN}i_sTeUvDq~x(WUhbW$e_Aq@ z#sUw6)q-=ehb101d-&JGKh!kU zxV?MC!%=#+CpFsdF%QSdd1=X|>^O zo}eV{5}f!DCmP~(4>r}9gm-Ma(oo>q50sM6V|%;P@xs2!Hd6nktfY-s@ljPZSHs7Kva*^VM_h|P zpjG$5-9WN&sjRG6PS*6{mXo!Jyh$)q*GHa@z(?rA@L~F}eK zi=|C3oz~~FzhyMfhwp=${B}9{MLEg0Y$6{i9~oBkv0UM&eHMN5g;2JQL(W`vS@T~H(y$`0J)MY0hoqcri(bWf!E)b#d zV0~+OS*U{K3+CM@;R-USAdeL*)RPo^^rtX=+{Tge(a*>2KKhVag_v@^qsd1r$i63X)>E%g3EQs!RRAp`803EV{9RyjzXP;R^B|ANO)Zd<;+})E^GneJX#y zf+Z@(l=*f*{fe@GMftFgfj)-&c-F@wJ|6Y)gpVhEJmzDNkH>us_QCDH*Dfa+iu~`y z=Aeplz_nP^Px%<)W2lc|Y_zm?e60RPMcG*D)IcsFo>t9$S5ZFWgOD4DBYZsPW1Nri zK1TX@o_w}UjP)_f#|sqNA30Yl$`^f%W`9*;6MHI3o_1q~Z<6R%Ke9Wdj`gq&t;l!y zN8Lo?8z0}Qx?fWtD$6+vzFk><$I(~iC0FUqy?lErOCBsF4?p?%*~eTTfB5*tj}KG* z=Hqv|lq&L9h0hGpj4HBi6*-)RMfI<$$TQ8grB&qLR8b#?eH@|j`dHxOUmsh1EcCI+ z$0}0uv6yawJ8M3cQA^9{OMLvJ$mW|APgTdO$V2;*`K!w1K34cxscuD8Wt*yUU{$%s z$69&`9~*rzay6~0T<7CjY3;kJay_-8YRuTus&W$*Z(h#0H*-5w(>K!+tLc0xb*qnU z^zc6R_}I>Ypz*3>^9O4rclvRRBD@hZu*>H^T%@cf_xjjJ&rfea=deZi)g+I#aQW1u znmp*^5Y>2?KB}6W`IP>CwYc4*K92dw7XSf{`#9m_f{%+nPSWAfbxy~id)&y` zQB9s#P2Z%?sV?uU9Qv!>hhE7lD}R} z2KaG?UO0drAU8n07qt!5WvLpH^JZVhdwB#jK=A+~h>s#dK9<3r5=wE}nn`~bBB)Cph*a01YK)D1AdhBO1@1u%kmn~9Mz zCT7-8(=8G_C04v&)D7@^sd!{%O}SC=9|Q;kqyuEwshV+*`qh*XS$e-{DgdXmZH4rw zYD&(_*#IvdN`6>V)(b#L%!UCP1!x|iMS#WungqBdh#%k9*Nj7mCu+*30h%dk5IMJ& zj3|rjeTA9vU5JzB`=@sC%01pHh5TJK}J^}iZp8$OW^b2rjfV&iXw+DE= zmYiEl-d;=Ip-P^r6?bq;E%|&+?e2gdp^7i>32<+K`vTlgnR6xCw~(kUm*>|f71JLr z6g$!zBlHIYJQQGXfF}Yx9AIF8M*=*`F-=HDsEpe3i)`Yt0D}UwDXtH$E%S!y=U&jd z*Orf~cA0sSVjreI72us|i9epuxcF~WNS~rd1EkeiJ}ibtT~kR6JT}fS&?<6yW0kUj_I&z$XDd4e(ij&uQk5 zYHYWAT{*F?{G+bCTvs|p^)CW^sXALZFCND^0lo?FJ)58=$)wUQYSI-}2jVBZ9(w}prBe#9DZsV>+i8{aayAFpLhUu>zlvrH zGv;tByP(87(UhGF>N^7LRCoEh(8$$dSAgB@xGA@rl92fO0_>+{(Y*xmp}qrjq-T?d z0~`!+D8L0%+Lr8T$-$Q7+Uy8>y;(5G^JT9%2+#CSIsIgSQ*;plt^_z8;0(R7uAL8X zR<(PMqT8ROihg9tJ(gr$#tAP3xJUz}X;+OMS4CUiGE~1B;2K2~B3~GLhU=>OL0jGk za5KOiww!6p?`^rtmSvonbLu2_ObUc37@}N=@*#3U6bex+MDY+>h-8S|5QRf-lE(OY z7*8An968RBMZ)-Hlj93=X^9^>vZ%VnO!q{hM2M0hN`(+%yqPOQaPRL=M;>rw=@4{x zWfU?=6?J7w1&=O3bWh&mxEg{T~&W{6sx6iy`@yRu4%sv)W={OTcUgjl*# zzuT33k6;RPCR|AJ(9Td-(&6yUg1RB{*mMXhjH6p@&Is|QE4du{97=0rbZ*|w2_++kOiwAshEOwktYwrwG{mqF>qGf;h>M|oM&-$sAH|{=5#l)xT!dy3 zMuvDk#I_LILyQXXLWpled>7(H$|S@qAzlqJCdAkfQ`xl;<3fz5&_Yb4d=xd>;9#|% zIElRrL9tJ!f-M)%MDn#r@(Fs)9fhZJWJA0Z;$_vBcc0ZeP0+q5tMhqtW{4s}pOsJN zt_ly2y%ys25TAtjG{meBvqQWS;$0dD5kkC0C$=v+zN7YLhz*_eW}f!8BKS)rxwd~V z#KA}!DfwZD_d|R@BTY%3uV7-YKML`22u3yrrz8_gJ`3@Ah_7e}ipZNO`Gv}S8R9pE zvppq0FBiMwVre;tikFt(gxKqwU-n^v>2}a zTCeE+X<6q{{iU@0J;YoJ^AWA?2yK2^{-N3;@hfThcZhi*mW22x#C$4t32hN=Eh86% zSV%8)Lo1V!)M}poqLMFGLS}sIzKpzIZ7WQupf3-xf-(uQF~rIct3s@ytW*D&+Ebji0lc7)hTe;A>7gk2$a)8s>(3$Z7}-VjGZ91XEgHN8K?0hQqv3}=>uDt|b{ zp)fv3!^D6g8)6jkScu~xPKP+dOqW6|JV7<9uAK~VD#YIz`QOROof(;v)XryQv1~ko z=R;fwfe85{>NzfjxEkVGh|6L8ZXivY^T-wI9zWZbqyMhfUDre02yrt+bwwc&p<;fW zr;hVQXrM}%C*=YW3Pwmq(4%-Mn-if>1TBi=?TvW^B`bNvi{~YXnHynd z_&sHoGsQ=CFD1EwULt~sP$xp&2r@#+2<0M_kKzOHr6QD$P$t4JujI~uR{wsCHc!{f zM&Qxt^HURBbM*@3Fp9%vH6v7tP&q=i2-PF-bVQXXo_eZAct0!uJJ!Ybj232P4OXca z?-cA;jMa+p?O458Jy|=#?e*ki^<-WIBSI=dI)WL&BK-(a6o2!+z8|A z$q(yEzUH>7p7bLG5l}ytJX87la{qNLtRL^lUpbx3P&kxfgoY6g<;7Y^*P5sLLiCxcahk1IZ}LEfJbWm>6MFgccM|g#N4;p=E?t5xPg{5utU2 zHW4~S=p3PKgm#K@d-C5PcBJHr>tViM+#y2m2C}1qEbJ1YYlLnJxqji|&o_{K4*IZx zq*c;i^^DLfLf;7eBHYF*5j|Uc-j!<4Q-!R~dgwYM-7N3gnK|}dh zLwUWS%pIYTvD%H~&Blo~jpQ>ChEs=$8R6LoBk1!ZJRjjXY6YMBW+(1%B=4V`XgD?T z)5D2TQM}XiX(PEdU*d%bvl_+3$3z%QO^7gos**_3lZ;dBwf!MEeowsJu&$B3*hsQ3 zlOs%t@O^|IB20}iEy8Z%!n{M!W$7@ituuTnGs%5U1p?(O*|xZI`&s1yiSCP z@u8I0BJh)jyj8lfoE3qubTR)Xh34Vy2=7FAOI2^ySpKiETxIPVsZDDvxxD-`!dDbagzqAJO%I@JOmiZ9 z$yR>L`G$6T}?jFM9z&s_+k_JZ4=1}^gt7NX^j4Ngn1F>M<_K~|EW!(ix-j$A}pkVG?7CJ z>pc8Wu&G=U;hzW_Xh9K{MpzbMWrS6V?0+AqT+Vij>MQ7Hn#xpDxjMoc8gk2`PZZSG zD#q4DSWi=G8uy3~q{Ev^CT2E8*c{>ChzD`;wyraD#!a^mo5nk*3!2KUG`AAk(Wa7< z*NzA~sZLpp$zoT8-E2LL=IPiM?V*cHAuko@_eR(kVSj`J5$9#(PoaP+KNR68Klq@S zIZQcBNgN@Qh2z(bjz>7b{?e2poQ(K4E1aP(qA~uRbG@lNO@CE7{&qp<>4}QXWRL5~ za~#KJ@_d8~)VgUppTGJxi~Dss!j%YDBV3~rHj^|57Jl1IUXS8v_RR>16mBR6xR3u& zGkKty%$EXE@Nbb#f6pm*i)?j^WWHbuIVqG)pau7Re3hg3aU5F>lEf>Nk(^OQ%qITB1xU zKD^4y|4cqPEm1y&3Mo`ip#~eRu2oFMF_6kB+*L}el=^=!##TwiAC{?_LN&!h|K@T` zbIC(xHB&J9C0MIgDn52tvZ!8LA-vOE)=7cz+vZ#;!A#+s6uwQtO2JNHPzsNy;E?$g zdZ*AQ1&=aGp-Bo&QwUNBQ^=-JFNG+DR0(g_bD{ zXd!2`h{g3;3&|+=UoGSZHKOza4Y#m3SX&OUn)pCRJlrLl5b8<@I_!=(&2DWzDwbIdXE%trtm`wKhi2w z*pk9eDg2zm;uMyo@JkB6rto(P^HO}2!0##inZjR+?Ce%@F4c9o{znROLC(rn@^C9z zq_yO6^vlp!%}LHzYOo-Mg&dbZa*7>IE>abnsdM{vTF0FKlfu#z)}*jDg=N%0n(&mw zN{-8s^%JX9-PP2<*7EVz@}1UlT?*?{*p$L%b!!9F`(`|sZA@Wq zYsthspJz)I(6{oknzl8CZ7G~i;YPNAdUQKlun~e8U@lQm`0H_il&j1Mxiuv(mm6OSPkOQU!iCDITI?Ub4hc*Id_D`gtQ zVW_rb8l}>x+g7%08+WbKNUdxd<q&aLUEC-+57KDePKFAyB&~3=Y1B*O{WXbFT-ebcxvjr-H+m&WaB+?mE*X;8=R zNaJWb$-pLCVKC?JH2SN$_YhKN+ROXe$9-XH-Cn-bUf!F=x9#PM_VR%=2Bh(D8Usmo zm^QDY_WAp{52o=@8pl+Xo9*MN^AYy6L%fqxtwT&_P#TY?@q8Mi(ioh^6KM=f zz;DDTL?J7^&`_ zP!wKB;tG!`p< zzN5yL(tcC$dsXs-fqNMp!{MHzWJqHxM|il?wOX{=3S zPa1pESeM57G&a+vq_Ke}KP#~@jZJCHkUFQ2dygjhnM9_YYEsye#?CZ$rLi@QZE0*z zV+RMZwYIBYBHc;$?<6O7ign=B{}QabI}PqZ-%uyh_NB2ujpH2sG!CS3FpVSB9EH&C zx^_rqKJO$Ca|k-co8Zek$zwDkZb8n?;mPnrog}|fbux`pX`E)K)HfMu4ri1k@98W> zXL&Y_sI%77ID`{M%56_@z2G`QKPB)%`mcflQZqnOl z@X@5ib@k#lS38Le@@4S2`urDR{tOCaul zX^{A%v*fBTH=`bTI?KW;Q@o2TmO=3hN@Y-*ndylV8HfyI2B|Lc$x`v@P=0KuWCp#u z$i=e~Ol2}Cn?Xe)%u1BYfN=@NG5Ahj`3x#3nooC;GrP!nU1X&U_H>bzGpLe@-^1cw zQlYN0?15GOY3>+lHKW^NDeI> z&%$0;$rH9t25ts^20;d%!r3w`K6%R*ALyCG4Cu8QmC>UNxK=zeC6US?ok82Kk|MgR zs~p!=*2|!N2F){QkwF8ZWzZ~xTQd0Pe6o=u*d!C5&TXt952Z9!g>$;fWnJa8=(eBy#(&%PO~?iQb~ z=%?`C>n7=H*wD#t@~#Z-&fuX89?qbD1}{!Z+?T=qM9biw4DMC9?jq}Rmi0a%egWfM9s`#lZs=v>n;ap@B|UM zOXi8d4B?OrhGsB6g9#Z7%i!q@p3h)Z2G3Ad89bN4NZuW7?I&IMU8vS zPjr|5Q`)rdlIJ~MU@tNZ4r2^Qt#mxW{nA}>#K&f^xqH0YpLZZRjyBapw&@|C>>(#+ zFe!s+8BA9^PtL^Om)rD4VoC;6Gx%>@NQB3SW@J#WQ{t5jUR9VcW$T*VK?JTtv@F}Wgxl^JZw zU~2}esI(k1MQu$6YctqDt(z6^i@kI-`SP^Hx(wFSYR)D!;{D=_fPTO<#9g{2D@|+vI@TLc5m1Rh8lMH3?p4uQRyGo@!bmi+tJGv5dP-_B)7tSyauUS{CKAsE|eFEUIKtqqnS> z#kG+-AI+NemX(O#TXKJ4R&V)3Z@Htl3{E7g6D^C{iWGfL%`9e~NWRan!St53R3SsV zh5Ja#DlZEoiym3@%)-pV%A$D|EwZq)aI&bEMg1(?EW9jIS){Y@RdwS=_B9iBdPFJrX(^7r{>8dBZt{6j-E*V(?=5a?UQIg{45$Pgoat1=pz@Mi#4ij zU)dy!rdc%0f);d37Wej*xAv7EjMw=&4$dRDX3XJpPELvyLE{paYk>_=8J#3$p zXp=>gSz6mHhWCvnIp}2alat8~S#-?e?Y^>87M)dE(pR48EAJSm@hd}Jv)sNx_y6lr zseW-qzVp>9i`%jol*Qv&^vYI&SAWiF9tSI@tg(yBz^wyES}Bc`7B1Mj*s~NXu1yYDQc&EytMlr zojE}MHpBudV%Oi^-tF$~?(Jeh>>UI|I!KWYO79&}dKHk~5oywUlOhTzRXWlUq1>}3sVu3=^5#wD|I>+*%q*3qGkH>3s&vWA z13kKBqdVon#0w^RWTPkNehnNl&?_6g*@y`I zB-=C_W3utfg{)Bo(Bn+T34gJ&jLpWC-jQ*-c15cQry86pG9eoivoR?f-)Do9LNr+f zuEun|j>EwW8+2+mre$MZHs)tzdNyWcV`esHQQppF^{FCbtH{bK^6ybIvo-QL*_g|^ zR}p$36I=8XS&)q%sOj1Gu})+m!)&Z89IN(;SeLREu~L!PVhX<=Ffjh&C#r%=*;v{5 ziIyS1eEErt{6tpr$;PT|>}CbCu{s-Tvau-}o3pW&2&t8oBI~oU{S)CN1OFUrUCP>^ z>3Ql<)<&x8Aw|rM4C)d`?B#n?NU|QuT2oG5X<^Qe`Vyws#2q>9Lz?S zs>0JgnQ}ybI-0Fq%lOKFu|KnM>_7NNs^veKjZ+jk191bVvvDRH5d%34oF!q|xSEZ> zvvDpP=d*D!8WsAt}^fli(&?f8+g>fV+KkXxXVCk0}mRwFg8-s!2b-~&3KDwkx%6w z1NRyzWvCxLX1ve9OP|X98g1!MrP-&#fgI=49x&ATjhs4r$iTz;Ygq$BJ{1yk=xWv@ z2Fe)lu4JwHR2Y)ZBcICS2Fe+D!N7|Ko-k0}z;gzk*LfRF$$HYjQwH+3k3DVR83WJi zbiPJvh*d*461Gc32M5u7eIwlASfz$!8!!x528wbH|6EqWK+*thTB{mj8eqsmQ-(TE zn2BH45KaWy2A0#n|$0?*+>4S7}1A67Dy``POT-Y|gAROx&ed5bjkjl8Y#@Yku- zXY!tb_YJO(|Nmdc2L?Vg@R5Gq&_X$*@|W#n{mQnZ@QHr)Ka zXrKng#z0*SP*aDs4Af>8O#?Yo$3VBwgwuK)d~(=X&p>?x+>9{!GnuQgeQuzU&e%eS zjSVz0&{W5>{>h@@szS$6{o2exa|1jIa`R{M*Jo0urmAL3{izkX*EhoDhPDRU8JKKf z3Y){gR|dYNU>Im`paX5Vf!+o>8t6o-40JcpS&MxajU=oooWtp=<27r__?oiupDg~x z_b{-mrW6?%>q!Y87~{N99|L_23^Xvvz=4{=6}^7crdrb9zyJe})DkM}D>^*+PuAB| z`99IX)EYha@{Pv-X)Wc*H`Kr|17i)0Gcer12m_-Hj4{x%mJF#Smm0=K8W^P?DIVKV zOL-Zw$|QiF#%nwi4NTIJ@5t3!^kG1b+QK1p$=cFcpB?eN0q$m^*Va@6)2LPkb{Lp$ zV1|Ls6eI&P4a_p|qk%;RW*gu<{5%8m4a_kxS7T#|+!w%Iw+jsXU?97;EF@QZD?V`2 zh9S4#)*ch(F9wBYF)f3Er8IY~)$MYd3{2RXXPJSYDEvBcg@Ls?LV%SzvdX~f|5DcI z2uoS_U&?v|8~%%L{O>D|3949Iw$hLejchZpotoPyR=rWIW2b22+EQIFHtjU9%fN32 z_8Pc6RN3d<27WQX0Tq`y`qq{`27YCgYsG`rP2d298j=68I{CqeMuHk-)PF95Zm7lq3*M;Dmvb25uX;W8f6YHgMIz z-)tk&Y~Z49vcG5~sm_gK^hQ2!;Nv<Xz)%gqbVjZj zxK0~r;0766N4U|0>Bs7bGC}XhzG@u1$wD2uMSEUXIN=aUAV&hZ63CsPXUqTVe$Iqi z=r3DW_BW1ItgA}TlYk71G}a4G9Ghh&xV07cCU9Q@`4Y&_uL;BxD3CzG1d1e3luW2A zg%Vg)SAMT6g%jA?Ejmb}I#*ZNp|CG2d^4+90>u+3nZW-N_@}8NwS=bOt^~5`3D@lC z3&G(!od)^o?gYv-iQS_^zTTfesRSNN;PC_=Ai)VdoWLUqJeW{dDb;Bbd$XQAlmK`4 zb7ka-dQv8VvI+1w)9>mD`-u5XVvqh;-{$qCTmnxdP(Fbt6WG%v_Cq~2sm1#@$>iHj zVo#AveWHKVlcy74$kLxn;Q0iqCQvPb7ZP|efmai#m_T*{MgndEUIGcG4~wJ{u=urA z%p`oVXi|slGH%urJHdMm6we)UtiC*1UtX;*4eHC(0WqJbhDE{zDkShteaWzttXQDK zMfGLJOOclncqO5P_GOlvFTyQazt)#K^%ZTeB~U4W_Y?R)BY!=Cw-R_efj3yk2ErxX zH+6cW=F!(0$UAJK1}fLP3A~p;6CEGaK;GDv_rnA}O5o!JDks1WlrXfq8yZLzvZ#CX z&4w!1*#`1S0uMD59-vp9XcK6ZKx2)+Mgp}HsFT2F3DndnbsI`89pOJq`-W0CfqDtl zPoRNLTyP^R7#ZP;_AHILp-x=iP(G*DG?cqOmnI1`O`vrGZ4&q*fo2Icz8c#<(ma6{ zta5uLDm6ZrmI<^O`ux>eG=%KKzB`5uLOE0&_l<2>Tr`rNb}1QIb+tjS*%|I z{Sz3Jz}E@&-!veBHO*oJDS_)E+=$0Ml#}p(eJ<>>X?6xDz+o-t5{D!(G=Xsmj89-# z0>cy7|8Zng0wXBljbx-Q%WI_SMGU>GMA#{hPGC#|W69@6vY}0k42O$p@C$ zI@+a?@>QFtvrkH3aU-?Oc8Y%GPZpJNY65(I)0k%@Ff)Ob39L$BRsypLpTLp?<|Hte z(n5vRej4)O(il~wGxoF;B0 za5I5h3EU>BUkGocC6cRpG5rpkuVpM^ssSn|6TbaIa+qL9fLtbWo5*A0(8>tA@53!) ztG=53sn>(FaY%pBBxfw2p9m{*aCg)nH{zlr{0RiDy`@PJhhA zr@k&m%E_M(Yw z6CWn=Q4)rUgo!OCwwf?aBu#WN(bYuCgk|Dm6O~QaCL9wLO}u6zZNfG2vWZtrcqV)k z854ntp)KU67Si^O;j-Pl8N6nFn7ec@t(urmG|@=|bY|E##@~Ee74C6h>7`psHxu1WOgAxu^FL$` zHO0gb6TM9IHZjP=*CzUy=xd_Ci2)}1kwtx?HFYUGnJ3*^1~O%4KF-#1Q1R)9kusl0 z2b=iDR7;S&!}RgCF>Xz*GD!IW4mB~%#6%O5Obj`-g96Q@hR$oD2DYa}1Hi#^{i zHpRqL6Vpuau%O~?gbz70)5I(jKbcr=Vz!AnCVn)ri0x=%o{0rIJHZY_lnTtJ4Abpo zM8s$#Kj=>jN&i=|ciYHf6L0Z6WE0CYZ@@ky!^k~f z#ki?|pNaj{I1PC~hksC9SLUhGR>A?X7H#DqdGclK+qQDV#8DH+X+uo>Y2ug$?lwF^ zZtyp4O}+oDR?H@PZC6>hO{dFYAzh zTg>usJGp9N+ua3UZYS4FTsQF#jlXV%n^co_GN+x8KP2OqcB*~vn201%Ac=xWWju2v zkvEBG5=bIv61kGN-9MT~f6Dcx!oWKh@#2!gv*6>J~ zB+6>czjlb->JWSJD>V`(z~f1jOXBGyp3zxGKCQU%L=xqb__Sl}$t0dis*O%9zmhRu zDGsa{9(gv2XZuB-PvW^G4^)hvI-Aw0W9)^ba!;DCVT>daNxYgw#U#uml1X?;_(`Oa zu*m085u3=_3x6g2#o*Ng1v*OI7|q@TR1$m>bGk;K~?>`f9}H1_ZS^@sje62o*s z4BttrN!sQEBL6bvy(He(c|S;ErH0|5iyyOPlem$@%_OQM@ktUh$<-vPCQ&U(Cwz2G zqB=`S;)^7jB~c@Z&yr}AL}ND1$B~*z)JdXl619?O-zio*37+4`p%KSO^^&Nc#Pc1L zUNlHzYo}PlBtF*>vglxYx!qoxcaGiNLAY-CuTO82B$_6{-F!5gG!e~p5iQA(BwA?7 zDUHO|I*B$E?-7wsNwiI3N$1#CEIo;KNqm_E5mxG;HlR&!7wwQlNAiC_q|k^+y$&*> zgK7f0Mt4rCPVnjVd3fGww%u)* zeOX_9^a_dOK&Wb&*nlJk>b9WAHH#RW#5ZJq5<@6vU1D^@U}Cc_G42B$n#6Do$wNzq zCDj=w{4^qoQyrvaM|q*6j80-q65l5=If=1Jj7wrX#hX>D6RqA+I(Jm?ob#X6Q6>=o ztgMMiOiJQdM~QZl2RjKxdP-7t+0&Akp2Sqf2Sg}Z|BlROQ2x8doK8|sZ%CY-#GEAd zC-Hj{bCZ~t#Ofs0Br!jU1xfsv#3Hr`H&7(8knKJ!Qmd1E*j3qN`l~M{=P5`@tkV2h zn#51U&`Fjh!KY^@Md$J)R_Mwe>?AZGOv%|<$pfF2U1MvLSeL{WiUh?*BVqbx9odk? z#w0e8+RpNEXKCA6M(B(*Als7Ip2VIcekITI#D1p0B(aOeB&oa|mUkA0hdZmXb|>)* zYmq~pZ&s#@O8G5`y_z20RJf1BIi4t@AsOMsuSx(a>*=;VJ4-v1rpSayE&-lDL$_ zo|jZ)g3j3*t8X+E=r#vDfP& zN4f~tuQ{UN71Eq#y+x}|Lzlv{DcngSlEPgnluRK<3P_=7N*Se`Ddb8aUkdqC$emKX zVKjxTl$u7)lR{p8>MFe6n&G2e6&cJDODXT5%3Y;E3I$Urlv0+bYxh{su4+>Zf42*# zl+R3&6dI3+P;I$HC@I7Vrb{G-;wjwfu2!R7>JclELX|{>Q#Ak6Ums54kreJu;U4{Z zZwe2jP&$SCQn)__uH)Z3GBT;FluD_?CmDHAgI(^b+L1?5J)~bZc9k+ZQZ9ujQYf3k zqx$u+6duo2WD2Pi`izLYs554#V5E>pVQ@DwQ~0}^Ec`gKxSJf+NURjx6g-{L)}fO^I)$gY z3!gW;i=RSuS|JGpPKl-PX8c<4^#Lkg}VA{ z$Nyleq)=4@e3DYjL(Da*XRKNZ)me16D1ECwO(|#W8vLrkCiRfDJ>azo0a)1{tX&EtQW%*+uM~P~R6}&whb^uneN*VC zBmGktNcy`d(=i~0`aOleY=bDegzTvo;CdhRt&FNOIj z+(_YO3JX&BfkmWnD20Wz7%6N^VS5UTQdpeAniSTiuq1`0DJ)N6MG7zf9GlZymZiWM z8_q5Kl)}c|Dsr*66zC%>Q&>e+>Lc&>kwMQySEqPrM)bWq(RC@Tr=3Y*3tOs>Y|sRM z+ebF0u!%H$Q1H||HNV7x;?h2{H3hmbabk)o3GM|Zi&FTNi7D(%;Y1(VokEem5iVlx zqOzBi?7s4DU-^a7(pUDdA^OVFzOpxkeXM&5zq4w6<+^&*pUWS*nP{wd{NMrd>UNY5 z$4-Y+IKoy);d}~5DTFL2g_9{9`w#wj3cOM4p?+faQszEAthEsY_|Ld?Q#9lw)8#8PHIhlQLLa_KlM>>3c^F?USQ zZ6S|^2YN-j^_OY=C9j33g&$&3cB$L?OJsoLvyh(v7E0^91uPV?P*leYS}0_paaOGK z04Yp>0rJWK5esn(cU!ne!xXb{mxYoRid!h5QyLCX$7l>5AWaTsP5C1BKT8dmNy*)} zv+mUZ_gmO9K<=~D9^u&ogpO+021qI594I_;_CX5|S$Nz+ISUV4c*Fuv@GD~>IZ&z& zl(qw9+w6R0Eeseak6L(4Bm91#>=~%I^n``-7M`;3v;~gL|7sI`(o){e{|uB@nnj-> z&4c7QOL@&b%k)7~ZICd0-ogtO2tW)I2g!;-VpvF6xMbn71(QWv7-nI(g_H%$LIVp8 zE!Y+u3-4HXm#A153$I$JXu-4KTL>*wu#mC9gIR735{^Rm4wAqELzYtZYvJtQOO~1g ze3?b-T72}i7Mri-H4Bw2ylLSrOAQ-dw{YZZ;X>hpujLI342gl_mt(NJtuylVg~9Tk zh4(E~vryf_2NpiGP}xEi3p{4wBMsJVuzbwN0z+n@gAG@)8To_)@EodISgg~T@~MS7 z7V284Vc|0iH7(S#Fs@OwHY?jk4i1+5-zW^v>+tn&q}eyp?;ELSp}sC?{5R66WRcHl z{4I2~(2XL*np$XOp|ypk7QV31!a_?6>zUU=bDb;tt-@JehqZLb*G}I`8w+hMd}X1% zg*o4NnNw9t!!WMQDCtW9rCMn4OEEcCV1c~J9*sG9B`BK`HJ0z>7Aq2dlz zbWSfG9c1Ba3xmn1p%O05(`%?K94bRB?H*}yCPc~nmZ5TLs1zP1BP@)xu)@Mh3!^NI zwlKrOObcTyjJ5E+g~{Zwh4B=y;gJcfAmwdmj0YBRQsUo5LyF2oOZ9G(NZ!}-%rKc^ zVXCEuYBWTZhe@+xGR@*vU;Jz3h741CUS?UCZDFB>AIUw2dTwN%g}FqvQyp(hBIj!) z3uqQBtR1Gjy!bFe%!@26r3`C;#TJ%WxHU{l4Hs*;Y|Rt<^AW;( zANq`tZ5C+cw_9qzGqW(tLcS~x#a9XXh9l+yIe2& zqUwr;t5j7RAKCcZ!Zi!`+PKfgbqoJkC}5+YjT=;93lSSRY~0eN+$P6p%F0I{8ld!d z%_uoBN~tz%KCJ$Zvxl(Y)s1&C!asLN*H9O1kd0QN%`38zpSqWuw(-5nJuDFJ>do;_ix08ZE0w ztN)bZEOCt3V^o#t8B$Vb|DTPTW2Da*g_GFs(TSY6zTZYE8yOpcjR$O$wqe*v*m%&! zL#)E^$O|?ew(*FKM_I~PDPt>3Ue;C;yKsye|NNhO6R&*{j#C3y(^Z~R4D{YV~h3uW72xMZxDHj*}68=j4njs0WA zvSHhJ_jndLNn#vLQrbpjoT}qJI%LEr{S~5A;m_&C_pyXFD%hxG<8|`c#>+M;+IY=Y zm*{!pgzGr3*r+v5UezJ9b5fN5DgDMtWM;lMY`n=5ZMFh;maK_6s-PBYny=7|J*f?HlkpLSf$E%v&`<=Y_oz$~YpJRR-pWCXhQ8agp zHn8#5cS4^5&X&_GH)0!UUNt80cQWuh`NBps8?9|MxzyZ73teK_N|BbNQ_rG2dLnE6 zchX9yGtx$jO@VWTIRsY&WZb^A_w+vsDXY=gXvvuY1aP+@9<^tUm<29IO<#>NK|r0z$N zfi?!&_}a!`@~xy2faVi~eu)ej=ku+NAvVTM5dP6GpCH3+jIc4@#&?#zY&FYeIqi&%&ALV_Y^<@dmO4@-w$jEb znh1?*%|zkz$3$6Yt4*NmZEUcSD^Qz*Hqxd|l8rg^;Bb<{zs1H@ook1U@{?qn#=PAI z7xE?yi2Q7;bBzerW|Bfy*3AJ)r)Zl!6BWI3rQ^EsEt2uoS>-NIL7J^QoHt;e%uDWmr~y= zGPnbXA)oMjIc?*Njk6R>8<%WcCjT|I3$$Qg#?EVTZK`u!wAH?8<{JIIT+uL(PFA}D z*L*KmZ5;ew{`p?6+xUl;(7{8FGIuv<03Adf++-JEBP={ToNMQ#%rU)N;9*ToFDXE~Gy)RCYVic{ZQfI2frpgmjJhUXvsqYfU^@iNoInI@$ZIiAq3Pda$YL3utMqwR-9IJ6_G zDta(L7vg6fJm^ zK|KdAJ9vdH=-@pEuR5rxGrr~EH3yX(ys2O3OqbVnXmB1DPRo(WyH_Dm!>~hGb?acs|`{NL2?v&5&vi zPR(FJ80mbgM*F^8nRg( zv~bXp^5dYfgXWsfCjU|Ug`-Y0XsSbA_wd?GX{JBXfvUw!RaPqptsQ*jpuK}JGo_7# zc8(gNw{>v*Sd3tV889I7rGuq2W#3FK>a&DS5yi?#CkLG!^l{MFK^F&IDRmBdI^geT z`Cnq)bU|hNMY`+Al2;4z?qgyrKTCQ!@McMG9Wte#gZ>T%JNU-I0J3qAQvX3Z*FXnc zVrV!^zIMQeF7Y%e-^`M49dv3M<5^Wh91L|ZZGy_YNjI80TO-wT8mx;6mpZW~(Dfx$Zz+o9KWO1*D%#nUg5Jv!&W>nL<@{FvG!2 z)^xVw$uvhhneU2C*K{u16`Mt!x+})PFuRrMvt_n}-Lr-Fkj`^3-@y+K7CKl!8P-1$ zbjM;O?;QD2XJ6!Cv5v54B4488KauASmN~dD7HicgT5gUovfRN6{k7s8=~_I>aJ7Rq zG(K!K2WuUybMP~5h=cVGHaOVgV5^4T=wOqB&6Jrr(tnOjnxks*vkn>AreS#O%%wT9 zoq{)43XCtX)4?tWduRvxMv`+CJTLFqO;cGf>lYnXml@wbC(4hp4FIF0KL{&A2yjXY`Gpt04hA4%gD`}BEoN58U^+YSoO zSG(0-n6LPdBMsi>l{2ln3?}AEE16-uhW?s2jc6MA(#W4i7UN~HYQF5BFR?WG%@;ld zE|A96`N9Qa=3-w^FpawwNNRx;Nuy{Q|4ZX;ja(* zyqHFI8fDTbo5mAql-KZ&rtw%BkEcNo1kT;@Lbs=XkavENa%s>qwE97wBv&^TeI|`( z(|9V4r_<>5gQA3=rv4z$rNKM+USN$D%FZ9;d5!b$AA}FT8fhfbaMDPpVWyEx!)Du6 ziBwuBZ5GPFg_26cN@K-BIk`}Z{wOqz{2y`C@X`p<2-DyJCUl1PHCppW$@~|o^`lf^ zE8H978U7^ZC7n(TuclEkjn-+jN#nINDlt8c8fm7LqMUq)0?<|tanmlfN z;GJuvp=uh{(x^^mp2^}YE(Z)utiMS5ERxUCsF_CNG@7JQD~;M|)K8-UE51nTq)}?I z)J=o@ytqi-SSSE!ht%hlQuIV8_qcnb6kZ;st#d%KfHd-uA)A%Bd=4rIhFw+)G zvoww`R-08hS>2M7xkSt*>L^`iX_W@oI`3T~ZPRF%M(;HGr151MU!~DCjc#eQPh-;9 zNT)P9r_q5NTOu9V;<_uWzeH%&iKGjKaEbiurC+x}v^%A@bhJkrKP*vG96c#`OQcs? zjchM1k@!;SON~h5+cbtSBgIL>^FL)^8iUdpoW{7N^3qa;x#?2*TGxU@{cqB05skmY zbR!&^#xR|0WE#WSOvkfmBw5yoG}bPaBTJ>gG8vV|Xlk_XeRvu`xn(jgjq#KX7x`U$ zm&SxNcBZi_jft!yn>CFkX?&l?(paCyR_a|E z8z{-kWn&tfG)XzrXt`WAv-#f6wVr3s)I`ayzGse-B7`bhYGhk=I4kMV5=nTIJtbtxiUYx#+xFeq1fTua@hNVd!cp z;G&=l%Z2Ttkc+}D9&+)piy|(Hx+vx10T<#T?&2O-Id2zpQQSpI7va9^@1BNt8_qw>x#r-a7uaS0Z7f-o7-A>i6tPab$c+>?QMILkUxQl+pVnx=<3u{%bCtOrtE9G50$@I0t zt7m>%E63N$GcKNWk?q28@f<6)PR6d27hF6~%IytdU;YqkKT{Y|+ zyk0mT#c9B#ixe}im$%j{fTrukaglcMmW#JtxGp>wuef;Ch3~4(iJ^-Mn%azuz*X0j zGuOZ2vh}LNeaQu#0bbTH+}cyo#cM8Jca<~7(e+Y^4RJk-KDRkGsNzV;8!p~tLu`=7 z?AmnVJ1*XH@xI3JF8RDcns1N~Tzu%F8u{R2;s*K1MHLsHxcJybWf!YA2zQ1a-XH}w zDzsHuijFX@4y|(0a-*RzXoQJwD>bZEq!;2p3 zyJ+BIql-;08oK!0#V8k}T{Lph*hM!N-CZAOj~xVXAWZSn5vV#+3=OX`+Q(!)hh7vGTiE_%7>?P8#dL2Ni40jfFK&qZJI zd9!41mQOZIe-{Ht`DPijSypUTWnJGa10Kvr$DXeVwnYZ(km*BQ40SQW#Yl~3n5&%3 zJ73C5Z;|0Hs%{ZphTCR~ki#Rl2q(wJxESkVzKaDe#<>{pVwTSM9i_#^bQd$&f-WYx z;BK0!F21JIia+oI^XxkarpO`~pZ6=$n3r0>d1BH5}&CQY|0nAtAo zxCnO@olBWHlf{|gc`kNum7Lq;`EBxpi-j~AE|$Ca(N(J$i(D-JSFX0n5~i1ra>%sI z#ZsO44%iClHrQO9E>W+(5uDSx1#XYfIifxzGE*SE)(srr2UDml+&sN(m z8(if1S)Tk^R&JL)+hwzhEwp$pZn)U$VjBr?@u!RJE`E0LE7gz&$Hh)vH05EJju7oH zG)iq^yLHG{p6j(oe_~{>i+wKkyZD_Zs6dQvemsbSFns=SamdAC7YAG%B>da**3Z)Q zXXRBj>}N&o;-BRR<$Onskz-^&<1Ws*IN{=?i!(0Hx@te>ou8%6>U^hMoTe4pp)S$m zZd_*P5Atg}lyAU!7Z)gjF8-#8c5#W!`H%9C`bV1Wkjs>o9kOGG{JleYNM578-KhxR z{*LR^qwy+{;Y}B}Xk9&&^l;n79U5~FF%JS)&e9@y>Py<19oc))|PTdM31ZaKYM9`{hr!;>DKB0UxJJ)t2>{UYT(wIH}@NLJP_^0bF%JUmYtE@i#?iz?z- z56^jOz-F8-(%={A`-?DSH=Ru~JoNO?%j4;$Fg;ZDP|ZWqL(0Re9x8gUJlGyW4;4H( z9@3uL%O7}fJ$N2g{vsUDO#DTB5B$f;cq*P}TOLjgv0Ogqf036wyzGHO`9x8cw&%^s3Uia{Zhj%=@>)}mZHFiU9>By&h2_E5(I&jtFpZ;T;J=M)@Esqd++mko4C zZEED9F^llf+`~V=N)u0A=UweLY3kt%3iEI3PEY2tf0F^f$->`+4b;NJZ@)=P9a09` zcxX#rdFbGw9a%9f@}-BbD61>-T=`8(?iH>D&%Zy$(mQ(SWr~NX9_F)AJWTU2of$pMq@eDX#jRp=W^TG)X0fIo=4s?}sC_GCu7@-GW%z#C zwqK27bN?=%J{v6+Mt<pg7nu#t-ShpIvc9rCYp zlZP!H_UP=JsWm#C9xQ~}?%`(-yFL8kVTXt7f5J56TG-C&@sM4%^_lK&L#kIVAlKNxnmJnx^THymUy$ zACmcpWbYxB>%4~x9!B{X?bA5p63g}B`M6A(@lf37g$}st;cr@RA31$oV;#v)8hPpq zo11LW9=t@wTHn-lyr41Pq4D>T!^b6E{UV3u@xxN-uqu>Wv~u~#?IY$RpN~8~^7@GS z$nupHj!B(klJa5um~~8g91}}_ zWyJB3*74tt$*p7Zz;W??WPH^3(ZEOGBlPi}kN164@bQw5H+{V2<7FSO_;}4nC7t(G z)~I;2;c;@5TTEce0=PqijPk;z{KNf*jd@f7L7mm2!*Yxk7_L`Nqe$K8E=i?yJAWMLS~dX&FMQG$l<=D;mB&EhDJuIb-atM(XtGI(-b4 zi|Ic8_A$=Kcpp1_>?AXNOz^RQBJE?Mk4ZjeP;q>G?_;u$DL$t9*mGKPosn{9l#@2E zKVTm;O=EuLj7-;&#%E-fkJ&!v`k1Fv>hMZ;AJ*9{F5V69AK{HW!_UZk{b}VHIebPI z`uNeuIv?wOEb_6~$8sMld_>O55+6TN5-w#e^|8!XYvrZS3hS#D&HMg8pI7=wot4!- zR_TZPCg>!##>ZMV)>-L#R)KMNu))VhUFbH=!%dV%A6L%GjI*-&-}JMxmBrx$HN&slEFVdZqO`eP%wj=K5nst$RJln+3?#w?yylZ$}gI)i#493 z=Osr5$RK(_4JsJs&LB?)SsBE1uDltvx}e4+(G320K%T!KA6$@p8RhZ9&64>uYGVZ_ zI>ua3R29mga0dU&;O-2HWKcAtSXw*-$snEq-9q@vImQ(iq*z9sadGH^@Gz(n8L++X z%Alk!k?v}FF3LR@6~cQmD3!qj8Qhz}eVPA1S@C`iRw7oA0MxS3TZgR&Wt3_i)=hX4x$RL!7T z29W?c0#s)~6ow2IWl$r7&obziLH7)5W>71G<{7l${7(jTGN_+HgAD3w!niC_FN3C6 z6agcy$jU3yFoVxCXu?EhpPi5H_l+npyd?c2X`DfhtFof1YVI#GYR4rb%`zx)RqU&> z;H0!9-!kZwLFWuwv$7d{l|g%5P+J|gBSWsLvIbn0FEiMpAGVyQO{=Px4jR{V8k_{-8))X(LXqYZ!`cGo>pE{g$~VN7@Hu2(UeL3>8M zXH|Ft-;;0Gg>ee`^KGJ2Gnkga+zjSrFg=4A8O$aVu4T=n7+;rJ)RemvNsKeRd0n_Y zWDaHK9~F7;ADK^V6b4GKJ`{p5KhBI0`9fV>>wjc%21{rzGB}XI(hQbm@G~)I@KXlM zGgzC!I?CI-vLb_(8LY~HcM9_q%GDW6C?31?k1BNXKeC3FO2^k{uz{_X!B)+djTvm# zkxjICH{{hD(&UD+T|9Aa_zg8nxh;d;H{{P7vR#8QvNMBSI=+{mXeFp|)a7hW^~i_c zM)v4WztV8^%FBQMoHwP(-&r4W1*%VEUk3Nwl>HgJc~gGZV2m8h;1ET6ZPBY49M0fK z2In$3pTW@#{>^X zbxVPfGyW~Pkio?auIPel-I7aW&VOGoXVB%AI;>!;PWd~7YZ~l2?SBS0GRS>f;o);L zgWEJ;x8;%Ba*OiNRi)pd{@#{Ox7Ep|2#__Dj|HlG zT@Z=0h;jj*2$Uc4o=E&gBz|9xIFEp1`b#;~*QfuZ5g8y@l*gSfE&OIV3UVXXq`aa=zR|tivy$)SEFm4 z-W745z$^32Mx2{c!vGZmycyuF051i2IlyZHD*aoL0Ivq%NvFGY#*2toB=VebdMdt7 z$ei&^*}^=+kzV?51ZbL575a97cLKc6$_98h0401t&iL${ae}=UfFY+xC=wqAD3UAA zyP5XtT$KY<3D7%0p8%iG_y=elph0yGHFFu@%jPw==Y(&w@9cTQZ-0_OJ z<4ps65#Xx;?E{|Of#v~P1!zrCDG}xHgG^`yM$GC(c=*?mC?qdg#de zdEz|-^dd=l;@k(v-{%o|;(Y`33otgoxB&eF3W)XSgV**^f zQ*@EWFh0O{0cHo76JSDsiEQN$Bhvy*3a~qGoOh2-p`rzt9N=i)_|?4eXjGLuRTuZ5 zj!zFTBf!i6vnbU%h4a!}9Vk;%^;vTR%nLA|oY7exyPWl*hN-W^UeP!^qaOn-qCAAC z8DepOB>`>)xE)|=fMo&p1=t_prvS?XY$PiJ)qkxBuudaf8DLd_)qy(rv0N+J)g!hh zz*_xjRy4jX8vi>QUmswDmQoI_)oGl~l$>l1urt7}09yiV)$rRWmRa$iX}hxG+jWYa z6{lz54mQWHQZFk`uI>)-Yk=PZ{GtK&=&*ZMd~#NNFF$3)xp+$Cv6$l0?*aY@a3;Xn z00#mb3~)lj9|~|dz_9?w102yQ1U^dOUJ;(3|7zjrpVUz8;_^|tKr$BRMkE59)R3oi zSTzC&uD`1vp0?(dp;O2U&OP?-q!2f@oNQc=1pT0EppYf%x_U@e&~za>ea` zA?_w*h{r$%n()xJ4BM{h2s24 zOzHG@3dK7XiaR0bir|JwhnQF>&W9y(2)CwCJQE@a@luGFHH*Sfxt!6;CB{Z7gqZZL zntORgqoN{I4Do8He!=)~d;4owif-6j^z{&LFmH$tL%bQ{tq|{ocsIn`A^s{9FHu;P z#i4JrzLEDxaADQNw}$0?Kg4JHQ_sTjk3xJL;*$_n*$NX?GgT-Ps~lo#;dm9cc;Wb! z!f`H*RnugA8lt+6lrEw$S1c+u^eg9nYf*$kYzVP2M4b?ILktNqG(^1+^+U7^@nwhx zAsU8g5uzn4vZ?6jY_AYaLNwAyKGZnBDiUuRqM1(lLWgT~`qm=x=4{8pF%IKdG`$O2 zg=kH(%f#A*Acedky{(2n{x6;o?L+hq(I-TQ5FJBw3DK4E86r|t5zk)$?wRdOb+}%X zk!~Tn>+C&4<>}NT{Qvt<{@s|+D@5@Dkw3Ezz5_3b$3$Y}`(h&1QEC}&qh()2A zZ22G_?--B&pz$x%;h=bYc09f~#Ep3T`C{?SaYe~80*6==Vr_`!B))lURfyFgR!|X0 zb1?IPO`Z}Y@->W zzJ&NA#Lppig!m=Io)FiI#dlKEx63Y#jpvW;=GU89cNdQ{%=cElU#a88<9qej-*m`> z1@?v5PvI;c?^Ha_=`YfAAjH8Ce}*`wVGe~j%9P^q!y%4@XnI<8;-ibl7Zs0}JE`E0 zYp{Q}V4R?VEfMD`_Jbwjr)eZZT%;ulah6&c;(~@8JxpnLrbPT)i1Rw7Y6-;|_IGsQ zzD!HSx`gL;)KGySqjI zcNck{^UO16&+P2(?ChL9dv<63rJifZuOY1=k0wq1jT-W5@}L|v+@Ml=-TYr)j8aHG z4L#HevK$Q=4TUrm)=)r`n@kF7$Zkw6Q)K(D=i&kLe5IsRi)kpX;Z_Z|X~@+eG?dX$ zRznF5txCxvZq{&m#LQSr1bRQ!E;0YnY>!@L48PQ1tuTRGpWV)t7*N|xFs=?4;YH&4p8qSpwmL?A-+w2I{>P%V5hnK_pD4ZT9 z`p}&S9DxI&$0SXzUVIVcIW;(h><{hjOd2DLZ zErRn*Mpt3ta1D2B7_DIhRYDPr(&St6+P1EN^)W`nSPfG&OjS?EX_%m4qK5I5`8&DW zZxIjQA||OvlQnF+Am0e*RB^A_qL z^E4dRa74p=4GT1^(Xdv-LQPItmr|)TEK>MlJ}M`cXmab(r=RB|T&`h-hE*EFMaeHg z^5?Zu!xQBMH%anb#z^H%;2uo|3%giOtYcmc+cn&$7_Qf_NyBCh8z`&tvU(d;b674% z=oTtrdBGi4TiH4d=Woq$2M8~c?a;7OQ6AK!SL$6F_G;KieWPMibIOZZ<;A}8;_dQc zzXo1aZxshLq;8c(47ydU=IyQGkcRs;ymYJl9wa=f;h2UOG`vWC(C{Ezp)pz_9@6lz zD(g`V$2I)1GR5EMk8mJwPEi$qxK(6s6OSo^$El*V!CRK{l!g-;p4IT2hNo#p7|F3V zPH8x)C>tvpl0BnguEMD~&(nISe>9w^@OnwZX$@~`c#Gpp!z*O2;dPb$RSjn;klVx= zb-V96x7XO|6-1W`;tf94aFMO3An1aXyB{x5%_<09TPn!vU92G9=3x9Q=Y0*AG`yqX zT^h#CsrT5xoweq-o-C1S#*4^D8a}42s3>@P%cv;mc;qt; zpL3Y&=&0ih4PR=gprfLWuQYtE;YJ;Kbw-NBx3qXHNW*s;zSr=RhM$>OMDXj9{r-c7 zADMV0r%y#$)n7P9D#}N{Qbn!wJrzZZ;{|@B9Z*mIRCT+m;U5iu(MEljbEzV~&Omsr zp8qNW=t$|vqhpm(@bo;npX!E6;szaDAZ=7hQs&cQCSF;$o&Q+D5>LS9c6Ts z)lo{Nm)61YevPJnW#LyAx2W{;3YOEs&j()fD~nro+@|Bc%7Pon$?BELqLPlvI-2Nc zs-udIsygcFsIQ}%%1fHMI;!iap`)gbS~_a$sG~DXv&_zm$lsMk*(&1lv&Gw1kwWNO zMcl5VfsTec8tIs&5*b*Qj~ZX+$u+2lReCcW&2_ZCp58)7OC7H)O}$-3{82@;x}ILG zs^r{8-L}=yPDgtkPE}F!FFARbSXFe=(OJi29aD64(V>x2M_(Pf4ns$*Bhg{%uynXO zJYBBaWOdj&mRA*pPe|t{yd1^OXo6?j*``6WxDF>SiA{e^1cuWDi#8`wF;31^w=qE&S_F-ON-9Wxc>EGn~(7BwV)UgH$9t%jJVW4?}sIu>!{))0kjikdaW0v&uo zbgU^B>sX>=86V|lxUF}oj;=K&2W|@DEPA<)6*^6H?%0}Qdrfh&rdZ8x(y>v;CLL>Z ztktnj$GtkP)Rf=6d20!7VOp|QY)Dmtjv02q~J5^oB79CsF?KV=D z%Z#0x;V}muE8C%CXDzWy$H%qAP8~emHt*BoguAIZBE#$E+G3xM{W^vk7-ryrj)NTF z2GRx&>9}9VB^@8=IIQD{j%Rf|r{k!OV>+JH@sy4SbUdizQ5}z|(jU_CFvn4C!L3%@ zS9x5=BUHuOvgYgZ{WqGp0`NH1;J2JPwZ#*xd2MmLwm6~VX~p3g9Vc~ssIr`*7Ojw) zKzF+(>PRM3q~~?KpyPENZz%c~b-b$MjES;xOL z+6I2n@vDx%bo{O3Hytnvfk)onXdthFdMx2kUVcPP_KdD(dLo{ zq6UKgi?4MdrSV#N>nsu~P8j1CP&b;YoT!b!|)+vS|v2I?57%bKXC|7$2Kwz#3x zZH~?QDlxxuM%2(iBLj{B*Fa+fO~}VUM*~d_G*e`44Ls6NG&j($k!WS0g@Kj^H`a>$ zjYNe;f{rp;8)#!NHoD+R3PKjtj?Jl*+n!l==dNfZ_`TD~V3a)=222Cnr)Ihsc(Reu z4D40(Iuozt@?zf0Dusw;AZx&8_14NA-Mol+27CkE4BTNLFc2C@40NTODZ0jjYm&?! z8;m$C#x@q*VZOYv;Hjv?jm0l~YM_UKzO1T&o=Tp*4BTblPSs5A6=9*hsRK` z*|u^Mp*IngMx{qJ5i^?zo;mGrV4#6P27?lc0V*Sr!3Ow&JVf0xLNRf&dbx=hZeWCg zHx0aHV5EUj2KLiT8MxcPXag$@#&pIQ17i)$F)-J_I0NGiOf@jgVCZK|R1Dpw;&Kx) z$-ra-Q&dWUrlL|)!96E!6l7U{q z=CbG(3f^a6hryTyGUaIne`zjuQ)dim-?&n=#{idl_zQzeo%?7*{>mxZLL8*=r*^UV z2JSa-*ucXEjvF|_!E4}{fd@FcPv&diLJVsm*0m51lAwhcT{^>tlhs28Jt_ z+)_Me;CTZta1gZ=y;_RJEoJLY8+h5kIRmd7c*Ot%W4&tNjLObccmC8nYk<4rUn9Za zIrX~dKYu*UTV{O2zy%JFKXcC;*xgcagEteKr*kiIpcToSXer({@Q#7}CekL}HSnH+ z?+koz;C%y^418wba|0i6IIFTgX4?&1G3dikR`?^{wiE?gi6*VY*;n(i8f5;7flsM6 zt;Dug@^{!52EH`#m4UBm#MDpEJlxULN^rvPjRA&EV-}tq`Ih$Nm0U{o2LnGExN6`Z z13ww~ne8(0JNu4WR6g{$g#%Nrr#Zn6wsMTT6n4 zt;N3vQYK*H1`~NqdY2O7%?xFDvbFf3wYbrgeN?rL;9vf{Ci1CU?u}t$;Wi@2M8?D| zCd!#8V4|Rj5+-gkQOHDL6S*dYDdPbZF;Ub+F_ZpkWT8A~UEGw>A~veq(QU-@ZN%>i z=Zv?ciJMK7Q3aK6E2yhsPJYND!%Y9?+|i5=>p zlF7(5^4~p)E1GEAR+d{?J*A6@DkcWDmGWm|brZEzIv2-ku$SBC)--w8Up(4Y)HYGa z1fv%nZJn;GXx>(QZa2}u#8Hc(%+b(9BNIQF_}N5b6HO>U6IZ? z6SF#qV=GdhcaZC`y%o;`9YlqWqOXa2I|}-7?WYp69VMTECI&H!iP@B}i6JJ&nHXV6+luECy5=WaDV`8jI*)u8g=Y~{Yl|I45L=#g@ zOk)w9#3U1w70oX7bc(|HnM}6RO}QhqOlQ%wvzTFGrh4?EBKxV6m}6qDiIo%rwZg=F z6N^nOG3EZ!1tu1m{J|~0+L&5s$~8Co*H z&{sN()h6ySvEIZ66Fm05h6ALFSf}XMD)>=nk!M!=UXIFHlI=zlo7lx&WOiOHx(I%P z5!uQfH}RZ_=S^%kai57}CLS=c!^BP#drj<9+;*ARt&nZkIqWg2PGws8a1KFB5&O}W- zV&YN7g> zF!7>^4@`V$;w2NOO(ZtIpUNP~8iSsJUt0vBxc+JEa6J?uAp8yORby^qa)YI2# zsSH`4mI@M?Y6!ZDT4#tiO}wRO-enPc3cPLN9TVSXbN_Zy3~YMfI{kYl-Zyc{1h{6m{>$?IQL`jeK(V@Xq=vcNsYyLnqO^MNYjcT40| zkMdc_Z=rlv*5Qv#x@A_-BNOqAg#s3CvQW}OK?{W}6ths=LSdDwh$TIT^vjAFSy5D_ zY*HLfXGN|B{*|b13t^#zg&$RV5nJ-VnU5@#V{sNrTPUM4-lAYx3!M}V53`W6S0*#w z78`AGt9n|~5w}@*!WI{8k>3%OEL678!a_?6RV-AsP}@QsMOn>4bqndGDaLnL_CmfI z7HV4fb$!ZpL@f(!HGSL>*0oU2LL&=}Ejh;PTWDZmr6VhOyW%s>5e*e`R3-AOq=|)Q zDup`Sl`DG3EsU}-$--m{ce4|@{A*#Hq8V-BeNT*0I7bkP$6M&^i-~e9hzS;M@I`fB zjPd28DXKYBElj({-xt#rGRwk;zL;TQrn;pUg+~?rBg;~=snvnt8Qyso=3BVW!VU`y zEG)FJ%ED?3i!3a*u*|}8s!AZtKnxDV5(`Tet8IbcCfhdxvBE;rP}~^`M$lWS9{nAN zdn~N6u))Gc3u{#(D|xSl*`ZjcAaB>J^sS++|0WAO<+oL(Y__mPAy0;a7oTpku-(EB z3g>OfNbFPudoAo!$SwtUD~atw{XD1{T2?Z6fcsKu7eg1F}<1?6iLq9IDLe| ziNuabFeWu89uHV}klK<(&nzCY@UVs4EH|9txP?b7T(R(xg-1DLEWBdjRSS=ER9bk( z!m}2hwD6RLQ>wTV94zxQPcw08Zmm=f*C9_bOJ_mkxk!FWuykI}S$M(1ix!@z6^g~R z14=I`4(ns_Oe{`Ycv)qv9m@(2kHr}aXDwW?aM8kR78ob=oQ2m_miHCS8y4I|(51$2 zu{ck|m5AzzcvBI)YvDZ$Z&`TTLcc^TO2j)V{cs|g^LpRnHrn(D?D4j^#KtCq5imcr zaG89%N}47Ler(|r3wg3Y7N1)9j8@LVPZmCBKU(ht7=5FGKEN;xAU>1c`dR_%{vT~nf zzAW-*kiQ5MUhxMEmKrIg6x zrYss|(Kw5eS=^jOg)Ay&Q7VhlS(MB2rGqkAlvP=7VG-B)%(+ACxk@zJwrkwwcaI;h)L zS+vfgZ5HjaXroe?k!)K{mmgN8dq})v579mgLWyV5DT~gEvP%|P7QIyZ2nAOu$Os5V z7Hlg0UuG@T|Y!>6FNO#J*jb{b^lq-jXld_nc#jGr5XE7y+SenH>S*%g? z%d%L(ELkj9w$^i^4`&Z6)LDda7R&oKqpX0a}d%~@>8;$B66Wl3s77V8!MnxZ)| zK6hgln^ej#*XwZ22ijJZxGjqw>K(cxi=A0KoyEy4c4e_Uiw9|_v)Gfx-YgDeaWIR0 zDhsQzpY`eWpAN9$hqAbznx6%wbU2G6itLzz{4PFv9bv`?6y8+jeV9T}wQB#Xzh zc;Xtdf{!WKrLs}5z(?<9@m?11XK{(0731C*A7t?%hqjMaJ}zf*g}94WE%r@G~;b&0H8#gHq^cKtGOC@bNcP(w>W*en!ymyy)_qF0z?~?ji#zt9No^R#ZbI#9ivB7y- zIR(orc&m-u6vFfh3aMzLl0rz&#Hu!`*{Eq_%+geKTZSoNTPpPyHEeMCg5T6vmt^kh zE$C&dj*YrDJR81^dN%6YXk(+TjoWQBu+f6mu8?kMqmhj!3g<1G)>t)!6`s&rG*#)% zY&5sAvA1}nw_F=J-&?d)G;B^Q8?9|{V?Sf_<>@2Z*=TRWuwmNhV56fA&4#X+lbdh8LFyRS0a6fCP8i^2?|f z`+c|!^WBH^wsic`pUpXyudj{w`v~r$>}TWJe%&YghyjXc(Ha^43ma@>h`JqNW2lW` zwzRQqEU)1d{ueoU|0no%adFEVHrP#zGs5R7;mCg2hz+uIXvNum6&+t{31Yhy=W!P&^YikN=X zo31Ug(Z(hl`)usDvDwBJ8@p`mwy{;w+{Y|7wke!V+s+GC{iUx| zpvlLvbCRhyq|d9#@qcw$Nu6)8!u2+{Y9nz zvPCa(yr|z#gZqnDRK;GkafW@dGQ$8;+@yV$LuO^>reD%?`irgo#p^cSu<@ad%Qnv2 zxIha-6}5R#6mL?iS=+1Ww^WPXwsEz;;2!Mv`U@f~>(&9{T^oeNFO8R4bV-%?feroy zVPf|I;);!rsFv5`cK!TjKD}sW#sKjtjlYdwZ2W5Da~gje-`n`X#+NkyHoj9Oey!lf z0pc4Qw~ z__EaRHcqX~{6PygQ2faOI8bm41gm}3#y>XxRm5~1Gi{()IZzyHlbdpo$KihCTwWja z&%Mz>UIzyp9CVP+L4F5a9dvV$c97$sp@T*aG7btjsNkTYgMtnUIVj=aCI^Kb6mgL2 zKseYxP!x4g%t3KS9x6P;vU;Sr?t0@ODM|YNU*%Q;x2@-lmcUvhX6IZ+~Wn*+u~;0b-23q}O1~og6fE(9A(w2kjg*chJH?O9!nS zgsB{ASHZ#mZOf^1M7||kJ80ve{|fm!=8K?M9kh4Q!I8#_DOCnb5k-SVX9ryzcn*9A zngiW|wn?bB3pp6g&9 zOL4Hy!F&e`94vLP%)vrMv&g|>g>aYJ686zhv23Vni-OB3PY0_UtajwgXV*|ckG?A% z8CU4E+CYAfgEbCb9x95t|Go8o9V+g1u%3GEV5fr(9FGpRIoR$<5A&O-NW;Vy2b)!$ ziwu)x^%^F&s#_vF0&t(AoHk7U%QNSucRAQi<#({p!5-H3PyzZ>JTOc+D^gcpkcAf7 zP+04Yl|SXk@bRC$DrfA^s$4W&#Cg5o;H+|^U39o;HC&vg^c-ApaM8gl4qoL` z2d}aIYYR}3hMdiup|MiCiOx}fzR8(6T)g3cm3iHf-p&UM7v~j!+WFkJxs=J94&HI_ zu7kIz-hFa+4Hs|IAQa8eKka*p@_q83l0H@gPYoCE50~=)(7|N~KRWoy!4(G|k+XxZ z9em8mzk@GTu1~2pn{ppIoB6`QXAVB+Ku~Yw--e5#Bg9cdZdN&aBHsy$g{q>md`GFy zNb~Q1%Mo(($@fY!&E}+kpuQa|FlmJN*}*T0@=u3r!t$l_o4V!vnNzRd*&P!K?inHe zV84%$_2l)JB6xj-_{YJ&4$8SG?;_=*%=}EoMFAIiT)@Q*E^c&@c9G*EuL~|uc`Z`; zTny-u`hJ8cG*aYuK}d#WMhfQTCGq*0f-Z`>D8{EQ&J9Wxc99(^invmMLlk{+7r8D< zvqTrdMG04~QI~YVkD6&C<*ACBTyT#%k(*tVa>2HfGY?-7@?2+G7ps2F;V#xSM^d-A z__#nW-4WdC;x-ozT{Lo0!9_(EwOrJ8QOQMR7u8%;cTvS<@F`K%l_Q#Goknd;T|4nq z!$nOOPmB~ifKyMc@SOQ1=W1=#aZ%SreHXX8_)68ho-5}DT#6@$78~Wfr~&I=A-&{? z97HtNja@W#(M%;aadFcqL4EEyFxA{e3svql_wUU|Nh8qOMH?5Ny72D<3%q6=l^qN@wdh3>*};kqzfm=v;$gDX>gMhVNs^ihJN zo^f>twnRR=fbD`&y0~q_bK$!PT!gNCiyavy_%7yqAyReQIWzszC=n~1lL5A7#Vi-&Tzok_J=w(+7vo(_a4}J(FmaN~LWDct2&Z08pH5A?PR1VLqZ#Va%DcsE zg)CNZj*Gc2=DC>fVv$N&;NlV05Gv$CR~mL++*9=D$`n^8*t#XEL{?zAixun|7l&M| zr0TlZ;9{eCy4uBB7wZ&$kBc=5VKqKeobPp|ky)=2r`3>Qd3n1@-EMWUO+DT0Vv9=Q zqeGkI>vg+}T`Gn6eJ*ymGU7nnJ9Brs$fxI4J6LG9i#;y(Dw+cd?sKtUJ!KYN^ud*P zwCtn%T^x3C(#0u7cErU)3OVZHn2QHoJjk(DPL3vC8?L4o+G%e3df3Hr3dhBxE}nGp z6vg#T&SOevo}j52Egn~pS?*A!P@_1MPPiDOZl6{~T>7N=GcKNW@urKnTs-IEc^79~ zoTVnac+tg6E>0`Tr$>vARK}N;O248K3r?0N8EcLauX1RQ5rw}k{u*tOi#J@Hck#NS zVFjrCEJ)U$lnj~lTh0X+7uD05W26M$cJYpjD_qQR@ve*aTwHSTfg*T75xg%gm6X7T zD)HAbqEndRPPnS$`lQbIad7S;%67X&|-`gN5=}T z34AwJ{I1IVVO#2tYoqlW8T_|ovGm_Au9Aa?{2u;s@h|PXC+nZ`kjDcZCUBgtI#=AS ziK62KJhT`m<#3}1ZUlXj)y`X3VX;X4h20qIVs@DiTWMm#Hw+k zYtP(kuk0e8^zC2VLs1XK6!DR9f}vnJQW%afSEUfS$wNsGRXkMnaI=R}9?Ezq>&cf0 z>%gnDqI_kXxWz*`54U-!;K|^R<%!d&mxuIt!GhM9X@1Dl>{RqnZ@j4N$-_96JaCpy z)J8ry~H(neWFJ2ul>ag-Ev95=|#tTN7yj@kJ zu_xcQ4LmgTP-lYhCx}L#{Kv%4gzu~5j+!7AP7uvJH1{yT!$3;XLrV{y2j4?053N0P z@t}EVrYK5%!j#qGkf)f>FE-nDF(AT%8 z@=X@EPZoDf7E?WRI8T;Jk0knTXhE$=X%&NS00#a1T40 z`bm9WDr2Usr9w`Te7@fsm_h86a(*TX(fenRf#nBAP(<$)%eMU0;!c2k%h7=T*_Xy)R-hXWoCdN@RF z%w#w*sGE_3y5GZ~O!^4gaiQhWOrOFz!OrrS>sPkI1rSS(Ft{%MMMO39h?UhZH#NlAKm%fs6qp7HRk zhgUqj>ft#L&wF^$!%LowP}Aro%cSJQ8>}=Lw$tkbhYfU2Lj2!y(W5 zu%#Sg2XpI975-H58tn-+e5#<=M@CpUPq9oD7db9A=Ds>rTwrli1?~1XQ^lK<+cd!y zt#>@U>*0!rk378RakBv~dH8^4YMNXI|D$}S<1|5Mebc9j?bF1E9xk&-rV0A!ApF?F zCzMiKd`>emO?>KMYKi=wef;3zM-M3_3)cAwlsr0K>E89#UI!E;!j#I zh5vm$<*GvdVHPzs$bt2NFW(3>=6QYYoxqJg9%gN)i=s2+Q=0UAihxLtkBpB(J_`FN z;DfPBxyzS7tP3iF`ih>566_!ze`DTaK8pJ&?W2s3Tpz+m2_HB4a*dbMC(gRN&k!Yj zaHkxJZ}xFMEpwIfF-@`BG((j2af^@Jn6X0o*%_joD(F@P%lr6rhM+63d^2S|`O|?- zsN|!vk48Qkt1MM~)b&x%M^zuyeAJ)Gogt{@qqdJ4K5F{tJX1O`V0I#eTrh02Azg<} zTaeptrl{}ZcEyJ_gvPLek5x0Jw(x7Kp)dbg9K1QxL{+A#k7f!XWpf`bR4&>9R-1>E z$@%z9(b`8FA3uipDMVWz?R@MGuqQx!A02%B;^S8z9es52vBbwx*3Cy3AA@}i@uB(9 zef03r(}&^1^pW`J>cjGp_2E&ZK5QTF%#0Lg0`{+X^ zK32~Xbd`TBoqK$iXgM<7*T+Y*L_c4CgWq2=lXtc#HCqf&x%h26kiwZQ1}S);RA#7; zVLqm^$9)X8jsz=;0GS0_K zvxPGwJ<*p2aFUP7tix<^VM&TcFEdBb+0+ycv^lbir~8=UV}Xx_K4$uu zN6hxY&gHRvcaE6D%FGe#RF>7-<)`|5Dt~kNx1B|>TNn9QtSa#L=2U^JX}xm(Wj>bs zc-F^rK34cx>Eob}L)00H$j5y?cKEo*#~L4-eQfcu*2g*@8z{pf`S11d$Q<$YnDlzp zFIVP>8|I2CbHzpa|VkIfaFQ`Ib*yWPjfa|Py!os{Pv zsog&ID1u$SoQYjKWVhGHewA2zp4i8+_FfM6s1NL%I-nA}H!O5NN1~78tci~!K92f$ zh^D}of8Y2jIp*U59}lW)R-ydb`8$H2!2=E-x`CsonR$cRW+6bIsE3Zxq_aLGLJJcpr=OFlmE z@glp}#~ZA+kJCP0_VJpJb3R`2@v4s|^948OFz*>3oUWW@p;wBF`EnC7U;S<7%U9Ct zs;pYdrs`RBQd;j_3`=|49)$|?8VZL~edNNU;Hwl;6_Y|C9bsK`w**K%?Q~Cm%nvy($-JhAt3`7Knoj#BV-+r$Go{ z1^9!_r@;(RF2G+t{^qz2P&B|*AOHBs8z5hRe|@9^+z{Z#K$`u_3q&4;TwNd#fJ=sWDL{X0D`v_(xXy2U2^2)q?%QLqp4(o(gDf@xLMVtl!D_H ziA{?{*#NJR=OVeIo6a6txAN*~^#C;j+#2Av02KmM3{WLNRrQD`3Ue2WN`ZW1Ru0f? zvE2F3QPA*{;?)$v+so7Z9;q3iR)BUizX56os1u-hfEEGj2H5gjPJNZVUVwP9An~%r z;`RU>N95BWK*K-|t40boRq*(0(b%Z06hZq3=jke19S^;M}Ua!3NUkt=o%miq`$SCZkYi~q_eeCPMQY+ zcpQM&wk4u_fajNpA5|%L2Iv)_538qYSbV9ti@h@?-8+z>QF-yqRNp}6?Y&gKRr>|l z^-J+8Np9<2E^5W9Wnx5tkpYS= z6D^hrp3ND(OpFdNCcyXr6W9@|0=2K^99Sm!dL0*lkg|Gde0m})`FU}E)$(2Q&N4A2 zz|;V%1Kbl}T7c;R<_B1y3Yx)O0p=)tW`KW|iCI*tMI2ooC&G(#{h}2nF9di!z#B9>Y;1s60=ydFbRef*oafMcbr1vWE8VB+! zaaKWAgKBw>70Z+1E{CRm#OYOn zo~ZYw(}YiLOkWD{0qaK78sNhKmjnD1;O78W0(?XnHpPztJ`V8RD)DK6&sfRT;u8h= z?ejTDW!W^{u6{w2wIEIW%K*InNi;A^WVLu`ij1lKH;sRQ{2|gI{-H_)$P)q~QlT{dyw0u`D_4vCtHlkR zm#!9hL$I-&Q{AWt3g090g=lb(WJ{P6A`_yhdQ>2kYF{XXb&vR9L8f2`LLRj%9HK~w zkt)lkdjx$QRO*o`7J`S_$wY*V{ehYxYK6EdL`lV}e2AMvlnVd*a4t<6wF9ASh%yR) zOmSo4Eg`o)9->8vh9Me-+}AB@ z*z~geY-t=~V3ACd5cGGkZH=g~GWX#%qFMOgysKr1R-Em#N-O20v9)4*X^m*35Jrt0 zlAFo1Ra%_(y%I|wSpJha>F`N zYn`|wME4NALfjQfcQ^dz?Ga+h>zSS*?hNJpO2*z@Cm4f?=4jYDv1FZ)IvFwyABKb& z8lqo_{vig17|crkmNS5+CO3U_ofsHOhkpFg!#xu3uahOdJRwbEJ1oTT5Tioe9b$x% zOq+YfZ1sscGQ=?3GTrW#v&X74Gvg}f@{c_62_YtiSQuhah)E$P zQ{O_&2{9$a)DY7{%m^_pl>5x{ES26Wp4gaToC2P1n0l|Q#>^12)U{RJezhcZ+sV{i zN;1TJCC|)yQDePW5aR87MYV?uJh?1)F=Y~B71b=18_AZ2SP^0+MZI1uqyDcK%h`kL z<;U0a>tzv_*NXyQYYh;6jtAr6Gt9^$?byF=_@*IbY*IlOj+*coCMZTkjU?zs(ud-J~7 zAofz>UoK9EwEQc#kE3{_d^)f`4u&{HR?p@+t0o&w3(9biM?xG8@kEFx*}4!9gm^5( z;~^frR?iT}Ia)W0hZO9zQ9Kgj(GYW&r&xh%)1;Z=)o-J8cQ8#A#JHSKg*c(IpH%Sa zkbA~t9eC|f2#;GnOKlAC7Udk``4BIJcrC=a5HE&!iQO0CRoaA2;xui@U$QOC`*MhO zn*>+thHVn^N5G2(&V)D{%CHoCI(w6NJ;WO!E{1rMqvOWRp-tjEhh*pU*-hdCDL2VF zq&7>)HRK-O6?!McyCFUc@p*{%LcAa13aw&@OCdJCk@=8A?`pc@X7K^dj><*9iKVw+MzwnzJ-z{E+iAheL>bG0#Nc*ATx^KO-!N@Oy|q z*t!UAgg-<4#eo*#mI!}`xEdmFgnSYHQDT>kjqtC+Ihp5eo(PCAYhmu`rI~M6W^RaZ zV}yEJ1TQ|#A0ZtRrW2`thh7VeD41daGJqFw|-P9FFJnz;j3=>TSaIc$wT*tx}+~`OSOqm zd7EGi$BR>CW!gtzFdd7WC#O3o*ipew3U*eoi-MYhx`Kv+Ci&;csRcI>F1lUziyh&P zZG!fVxEG;cg#HnH3MWDsA&Sr=LQi&Rg>)RD8;K(%5xPb){?yWKqIzrW-Xity#O)OXubcSY#UW=7!lhIbWlAJyvH=F1ZeFQ3iyWvx_DwgC|a zMi?JqLWDsP21ghkVMK%>ssckJ42$sVHo4n@^(nSpc&}xeZxU*w$GE~ZAu!$!hr}|B5aLtUxXbIwkhdRV%rsR`+b7=xO17E5q7DRz3kch z#O_Gi89v$*fiKFt@B7cn?Taw~T&DhZIVC$7;eHM=Rqi1ccTS4;NQ9#ijzxGtaeM6B z95Nv*E(;Lh#n<}75spWAE5h3m9*OX1gqJvWIQAnv9^q7kXCgeIvY&|XG;Pkg%#+ly z`@~Zb&fF(*cF4+{ROMEDA|K}}oMRAqR%Llk={8^1&qsJc(d>Rb^CI=OCOs|7vxF~4 zcqPJX5za-pYkTU|2&orkbK36^XCj=9aOd3o{dNdKCcYlwjR@yyYC5Oyej{^1X*E4D zz8T>nyL*S&xI^R}pFZ@ed>OqH;a!T0svhCJ2=7PuD8k27$nB|15k83UAv^tz3}^M1 zBRuzp6j$bahTN`1IJrZ-ze9Wy;nN78MfjX8eYLn;qdTAZSGBj)PSI(nZ1`6ZzNX!d z@JEDiB77U+XWEAd-$nRdwRiLR%nuQMjPO&089N07k#Gr`-WzqjAk*K$0!`5 zNQ^2ms>Uc9qgaeGG0Mg$9wRr#%`r;F5V5o;&rHqS6r)6p-_*A%VM$fuhpL7*?iQtE zeE4+^-=~ZM!Z@dA;!78b8l6UH2g`&ty~pjR8p*}?H0c+ z&ZSxA9F@+`tHr1uqh5^qF>0_5il%N1P9fagV)BJdtr)dq)QROhinnA)c+G+2?J*j} zXsog@y`e&e70oodo>HcGx=9SCG>tKPx7f2=(7S94^|W=2HVSE}U@HY*-Ywe3XcwcS zx+Txu+f(ghbYMzZxsdYfZo%=@i6W|y?yMkp&vv0O_lS0Tgb~Axk;Le#vRg5n>wK~? z9@w6;*}qD#ZVWGmA0vnnDjMz;taDL@Gz~6hMqbQB?9)9Wj=>$d3_{mU(R7c|BgP%q zdGb#sYuGbJuNZexJ~0@^ly326?GgJgW_riy8>3&0J~3V@mHA&RL%i|ghW4X-ME_X+ zuP?q=42bd39`WxU!Kk={B@Jd#RxyUEQbxuYMFCzfad?ao*YWVvoV#O;jxj#Q1eG{O z!ErIhDuiA%Sv_9Y>NzpSx$Jl-8objQXRn_`UXhVk97ImQ+aqOK5K zu{Fjv3Oqso1lwcW7vuLBf5g}kV`q$)W4sb$SB%{;9*yx>j6E^-#<)MmVUENVseLi_ z$2h=IvsYYmEOwBkj7if2)gkt5k^JB6mCm@1#Q1D!>S&B(s*->16%WLCFvf9p`%sKe z>&U=E4|Ak16hsKws7KgwO+o)H%RbC`JjN3-PQ-XR#*;DDZB9K!+p;WGWuIVi{4V${ zf9}Z`r((Pi<3&{meIF0@;@KF_#dw~YbELqF`^1QS;%ukfwfh9)(X9O>XW;D2l43b8 zscM{7kPg6Kjd3Q%C#+SBvoT(a@m7qt*~S>J$9R*6wo;jYJ}!Po?erTl&c}FnpSZw5 zaVFnIg|p@b_sjZo62iK@!$jJj7?)$b#{n`s^MNYp{TP>GtUO$x)_yVI#>~M#rD|pO zi~jq?l^FEg`!SWAy}4g(*)P9OAE}qifE1s__&mlpF}{uQMU0uRroN2v6~|X?sY0#t zXTFYcalh#Dba7^6e9!MBzK6O23{G6_}`&J;+%Gcvqgb3pL+%;7?X z501)?Jt(HBlv@+rmY{xu+Y?ksP%%N>1RwmH zQz=1ZrsQU-B-pDc&m5F}!IY{As;NiBt0$*r*#rJqbAv@bD4UHd==&# z5)Blxd}*3N0h%5X4HNmjMx;rCrj$&AY=UM9nkQ(JplyN{30fu?)IHTY0bAE9!NJ8D z#=+#7i}6i!ha3{K4~cdO+9%Kx7zs8U5*-qBOwcJoo#oP|@jpf91YHtn33%e;@k3(w z*#Ew&7<8DERerOWiHvtl;tx+2w-Y!Cx+SAB38DmXg01t?Trc$#1PR_bBtmw< zvedz4DdLk}%1ILZen<*=ZfDVzeRRKgb5(Br`$hKzJreXz&?kX^zv!8uSArw=i`n;! zI};Exi(9Y2T}muhc$70l3WpQVuX&sPYV1lO;oTM}o3{J2*!959vBp8}t zW`bD>h9wxDV0?lJ2}V%C5{yaY@lU=AN3nqkN*@;2ZW-ombb{8Z6fz&HN*~9@9u^$qE^ESWKb1mdfyAmIa5!v;@-=%t&O!;r)lj6Nkln`EzF{n3G^p zg2f5uCYYCCL4t(|emE@VCn)%5deFByUAL!rkqJAIV&_QVs^*de%gLYhWE6M~lOtl8 zf+Sn44w$b@{oqvBM8XA*pu;QIv6vfmS2PH=_8KfwzLE+%+0!HWrAN^my8YY9%P zR?xh>n&9OGuO#^OsGyOleoR=$#E@g+j3QWmOq@%kxqc(Td73qqc;uL@&jp3w_Pt!c z_5aS{4~VxCyq(~^1n*N;$E3x0N71}XtvFEpvdY!`0dXlo_XorW9O?5jjG*0QQRYK- z+*R2lA0_yh<21pS2|nQ{UYh!xT75e8Ddkx<5l1+L^BSKU41kZB@;@4<8=o-g6I^c25B5O$BKp zqJkhD73tD;Z>OTDbOk}gUg(MlRxH>>kt)6SCcXFGdx!5y?#u7{ua%WGd-h~9nas@2 z&dyHqYPiq^7rWpV!*~~5Vw1bz8e>kr5I2P;Lz>DJIx_pEbTm?4Fz3VcI{T520L7U< zTtBrpXVX7o;FF;{4E`Eg)I>-Fmor`YNATx@Ywt#&;U1M(b#qRhYsl1)PvcLH7&#&o z*5pfZmL}I6lHk$FBBIIIIIcc-z(4^Fg*D`8&?id`7u0a6QnZkU{*%S0lf{I|qTU

    $yI3`1iW7Q<*3A-RSNj*MZ1km9+Xf-{~`F)*-n^06_Di(!>G93R63(Ps-z6r3N! zq!=a(cS4@KW0(@d)EK6Tp0u1E!yGY~!EP6wmJG9Eph1$eIFh+B%oEFGMv4n0x-f=C zG29cw;ux01@IVYJM88+?z8IFqu#6*hk6Ud9lI1bnpHe!c^p#@&a10N|@X-HFeI$lQ zQ%cf9vJM>0H8DI9!;{hpYX#TE@VF4Bu1}5rQ!zX(;{F((5wbaDvmu6!!kc%GYo3_D|ZRSaH;;pG@#kC^>p3@?e&<#;-cndOxjwu!P`Fms05A>^U2 z@_CtvHm}97FNWk)d_9I;G3*wDH)7Zm!<#ANz2f;TsRrG$J`61DZ83O9@Lj>ATY5eq z(f0%o#_&Fut#B?SrgGMO6vM|Hpc}aN1`fw?B!+4iQT-x5iQ!YWE{<2@I4VPs;ULq& zXIuikyvJfV9>eD`d=bNi7%s-}rP$blU&Z*=MVyG?mpAhnI5a0?_=eSv;oBJMRrBgG zj2~HugyD1yXJYs+hO;qzAA?T}eh_5pk3!CI8CLV|6Z`X`eAd9tt8vnHPD}bRVlXAi zA44DpD~4bUp%}t3{C&{1c_3vutaDm~YpQb^_jc-0sdG%w5sV8aVkqDmpW%L*3=kx_ z6vJ)qnPPA`hM$D|EO;e`t88)%zs7JghCgHYP4sJmzYG2$xKO-Z7k)$V@3rpfD}MVwF+;&YVFz~zC!xZOBt&wLqs zs1)(kYmi;hK_v%69Sn0&*+CTteI4|3P}RZl8LGV3+uA`j2fh*+)g9DuP}4yz2hGJ{ z_ubjG9W->%$Uz+kbsaRx_SAFGz`>&*xgX#4#q46gj9tOB-NCf0cc(RW&{V`Gg0}{` z*Dad~|9!W6&Pfa5Ed^T%`uDmvtVtUOZ5_08FtSxzdk1|awS$9>4mvsL?4XU;+si>0 z2VEWXaM061bcX8Ypt}%q`e8_lNo16{dP`oqWwgfMS-fDv=QR6^{{artW~zaLg9Psq z94t6Qu)$14o8b;dux<`UIr!k6%rP_7Lo?ORneHF8qaA!PQyDYe3XBoAV+F?vj(0FY z$V98`HHT&lPdj)<6!Pi+q!Bkdcs8YM;@W9l z2&+7oW~rL96%VTFJ6k>PV5@@{9K7gY^=$Wk>6aY5?BF#ve6{x#_Tg-`!@*7m+Z=3{ zC|g1C7sJCq{;ITvspPLqE@s>%q*6WXaqy;t-f{GaW3Pj^9F&ZsRNOV*=iqGz??}ew zVZ1BEa9}#v&xKYi^MHf*92|7;zJsqFoZy^saLBEIht&O12e;9HKAgYQK-?ch5hX9WL0 z{(o?APV{6oeiWW`OU36v6NS~#`Kcs)*&wf98m{69IItW99o~wGLUACDu!D$$pB((` zxOYU@4&n|HT(%O82|9vqs@xz^AkmA07aSy0FFCmExOY%Y47&=+6$e)x+;s4#gI^p_ z|J}hK4t{m;o8(HGC9_|1aNWTTF-tn3Jxe71<=_?U8=kt-sLOID+39L3@&E@GZw3BhEQ z^5g$AqdiCA-Px*i9A)CD7)PZz%EnPH?p_)#FZ0tkTiu%N&LS!m;_k&&+E*3>D%Int zBD~5RRW*)k!h6keuf8%%jW}w?Q7ewxany;Ut2nG1N4+>&#?gv}j`DCztRF{%I2uZ7 zGr>l2G>)T*@TP+F#)-i|(mak9am<_J){5ccOtco8c7kmL+X_za=w3T*&$dgnV;r4@ zbc*8{$xiGdN;1mIbYo>^s_t?05WS~hFG0FGI7ju3qhB0P(?gu^-Nt}8?uuh@90TJR z6n9_j{^4nSGe_|+VA}KGCO$ zV{9CAgpZ43d>qr_m@d%?aZD02QLv@BnoJ(Y@VRPA98*OnXAy2GLS~3KQ;->FarA}H z7NnE8?94dkOLU>&g8vvS5}wSmIF2Q8+$+j`f=dNi*0MN~4#}5`cz+xZq*9m6RV(9o zFph^rd0g;e!AIhFG>%nqtd3)?D31x!&l({G^}G!AE*DxS(eu~cF=bdU(I*6-jN_@e z`;RU44bP-)h+|_Muf(xUQlE`uQyiP)*fLi=Y^5KatG0;FlR2M@!;qaJ?{c-o@eQe9evY-yc@g5a9gW{l& z_v83L$f1<}VH_U`=Nk!=mb_s5NgSWXaXgOC<2;Zj?PwgI#c_3mk z?*wU9Yo0p~@0#kC^r%DXMK>Z|Ad69+@ye79#h{FE`` zat0D8%&9UzFROg!9SQWjk}-Xr_nSuWB;ZXTCxP4qG7`v4@SXMeXlB}_<=(6Wu)oCZ zcn0~x7t{W(k4p>kiX>1pfno_1PvC_Wc}?ERXqj6gCz8=^W!{4;^OpTtyhH+{hL^|_ zWa%XnD3w6<1m8H1{3_nk36x8qd;(=y=LGJ|^jWJGfmUss~fNCJ;0&^3W>33N}Ohd3!` z=Z_ZWJrn39%HRZgC$MI|>Lbx(^A$Pk(^sPX1p6m2Ac27i^go3`f_Eh__>|jA#QR_O z3`t;U0>cs*p1}MB7I0oAFjDeP6&#ho1RF@Z@5OircV zErdx7Qxc#VvrJ21dIB>Nn3=$w1m=p(tORDKawUzE&gcCnFZG3DvxJ=~WKjb52w5!1 zBAAO|X#&d=xL=~n1n-m5>EVF{RwVF{h^)`b1RfNgEHsJq@UVz<$UoLsCGboF4$hPe?#ZKu@6LzO;`MI80;7STHQ>lLVIi=#JF4 z34EHsQPDq3;G~da2^<&lc>-Sx`9hHPUkdq3a7n-H6Dh)^Z-k#p88GQ|0%sELc|PAI za5jPO6X3xKT&?lDE>C;HSOdyd!0atYDX(m5sMFN%> z2L+=XWg%g~h@dUVzd~yDbiWwHBgZHZFpvrsXRux?56kBE#GDgX-HTuB@1cNVyuB)tGhGfx4$ z1#aGClt`XcfcfG!y8tBC|Q6l3sso{lr2E10{rrMc4@Y2PtL~+-G$>UROJc~{5hM(tP+ud_LT}yxd7D) zP`vQ=V^^$XCT0QDp<5B8*o;)`7S zh6QLOm7&sD>eGCYYEl3qmF5L#QGox))mK1ERek?IKFTZJ0}y|o|(CG?>%KC z2!Af~eR|E>QO|b7-ydeRqjElc>O(F+-teQm4;6fv$nkxs=tCtQF(3Z%p|THEeE7qM zKYjSjhpIkQ^P#%W`_7Xq;7!Fn?dVZEs^LQ;pZD&I&wXg_i?1m)))K7kLmeOL`tXGh z4Mq8qi~I1E4-I^%FG>`jxAR8wzslD>d=vAzu`rHbeDSRh-}&&p4?jr3W`d1iC zAAS?C zw-2p-$h#?xe~1-tPt)6_G-&S)W?Md*K6LV-vk&ck=-@*~pLZdMzwR=2ZcqH!5x*#Y z1UviC)ravuOz@$b51ZP1H>mgVp}P+~eCX-JmG;D`w~$_f+$vTg?WwO1{e0-}!vLO* z9cYx`KpzJCFvN#J(XR0ql@2sC#z*=vEXIcm86l-OCMV{jrQjGbalx@ZjElKNeJXUI z9vx^%2b%1|6d(LPC_YT}VVVy+ec0v0bRTB;u-u0g+?_dbGksX#^WHQb?@OEI;}bJ& zw%{DWxq|Zq=L;_C;2oxgQt2YW#ez!&m-?_wNOWmk>BGJbl(VB(WR;BYYQZ&vJk)D_ zSm(ofA2#@~k5LDI zXMH#)^)B$z`mr(nSX32*xGmLFaG=;}vqKi>AErXRKZ$m2&|Kg#*>sUP|L z$nVD|ew6j&9lv*XaraJC%8z&bD8S3_td#czi}_JdNFhH83n}8q2SV8AeIZMJN+>F1 zzz5dLPszRy>vR>T}_GH4FzkJZy8?ic_skR?= z{P^CFAN;5*)-U`xuruk0&cwGn@-O!z^St+wIdn2`O)2v%nGt7=;23CKNkA2i0Anu^zviA9}E2a zzNxg{e7yYV>qkEx5I;uxG0M-6Cwss07zg+<(2qfW43@Ag4ioDT!J&SXh)aw*59ir< z1|vl0e+@?aF~*PSe$4P=tRLh2{2p@8I^K^75^Az|PV{3^EHXEMQ?wTxYN|L)^Mj*t z+He*##X3jgRO>>s#D8|I6#LATBJ+4i&w5?pA1}ST(2=>`#m~ilEb-&M9}oOk>c=ua zcKWeP0xtJsvmdMcSiueMLMw%@_G3>MZ>F)b#*ejrtn*{N9~(ty(*~|3#%Hfc+ay^g zY}yj*#a2JI#rSqVcEosx!`RJb{kSH|UO)EvaYAa}AM-gP<1@hg?Dt0 z#ypSljEz}YKk3IQKTb=u3w~Vmivh`}L6gzO( z>wer2<)+kiOYkrV2Lc zO0Ox%svu3_&BF1zBG(KRWEa9OhUE)`{9M?SI^O)`CpB^?$f+Qg;w|7kZlo=J#k&K1 z?}3yz6uhZ;=fzusxdq=A%%h;o(73z`@<}$o0_|whJHnZ??&=-5_Y@RV@Uw&F4hktK ztRP|_-9Qlq?{i}`q-pp-K~V)sDw0(cQ}CgJ-3s<7D6XJ{f-wrlD)>mk_EOMWK}iLr z6qHu*v4XDbb~&w#f=?8DtKd8CyMl5GK37mv!KVt!E2yI2GX)hCR8&w&L1hI)yVBaO zbge6m|0_Z7N~ztbQa5VcjjAfBrl7il8oX+Cqh;Obq?LA{8`<3`p*!X8PUX8(Ed{j| ze5Ig)f;tN7D)>UdmkL^Sr?K5>S9f~YowE0!$~~x_f}eU&eFdC)_Mk;QsG)+d6?~(h zk%H4b=wT1a+S41Qf`VTbNvzqEzE|*rg5MSVp`fvXAGzZST5u=@O%ya$(2RLc>eZ8` z^rS;Q=~hq5(#zZM_h$voxxc;W>t4jzQo*m>Dh0nOXxEDt_M*$ZD84rp?M+R3)3DyO zzc>A<;4cMj*+IeI3R){@qu?I}cY0HNA1c^~e(6Jl`p}X-bh-~c>qG4obWqTlkGq0* z`qJlpsa0RLkd0S=^WQ_oYBzD$6K00$#lz z^-;WQ8hsV?Q_x?*0LhM!QUetXQZQJ-5XlbbV<%*oAU_$$q5g{_MIR+NT5v)Y&u5&1 z@w^l$*v0MSQSIjq`w9gU#b=U&$qJ?jpP^u;kg0;x6igR#e64q;%o09N!F(aJ70eOB zrnw5-D&CK7P74$)6MdnAMG6)xSfXHQ%yaqyFBCgR3G?ORz+|O@RSH(eJU1&?qhPIq zUj1mDg7q<-vm1nO6x<}pB1hPwV5?-=pR?N(Z0GTeDN&K{u;mqiFCy`!lD!J{DF|}o z73^1VK*2!;hj`k^)o+gQS+>N(3XUkazbv!UkB%xhrr@%ID-!d#g0n){^Mrzv!cPgF zj_GHF%$Me!6MkOsf`W@eF2x)U^rNc^t|)8ZD$C ztRPYKhB~4kotL2g#1|ExC^(ViU1G|h;;Hawg3kqC2)-1IQ$0^klM}K*^-hFW1ev@l zB%@%wiUc8V_xFBQ^Ph>MS|nvsk)mRcioGgQRb*DNM8#4SSya5H;tLgDs>rJ1brq$g zh1pbOS5ZiKnhH|!mWtdea;WIvpWYNbr;1!c=JlsHgs_Qw$0?e9Tf}@S@<=Jx^Qwq` zHO;T$9kITv;ytl)*#atpBfarqUQk7c-@R{}g;f+0&-Vq3tN1`jQNdz@9}2Sb-u_fV z_(y^zV>&yOR`IclGBM?I6`!amtD>BWPgPVEy}XJFDk`a{ta?u_RNj$VkrjCv3-gxW zXRgAg9jR>kOvs)7WcH_ODypmCx8Sl~L*hi=h|BG%DcM?rwN=y+Qdf|z9I&2>_yOL3 zNt0F7SMimK1}Yk=XwThO@wJL?*jYsj6^&GUtD-Rvpo;G#!uKkEP*Gz5^&3EQMkTEq zK)Jq5d^mu9Qqe?3Qx(nlSP!HU1L=o>G-x3Gta^LIpBzZWK$<_0nyc6%q@{{qRs5}@ zwTf0MepB(MioaC+&LcmFIt-%mgQ(FU`h(jr$UDBf2GQ+7wC7n`(+`u|sQ5=kTNUk8 z@GD7Q4x&PXss3QMqvAh=PG7X)4w5`=G&I9mm|-fcp*vq{BH;kyKP z^C8RST^r=YWS@u!RUA^WU&R5{doq_Vzdsp4h2(`Hhs7bAh9fGD3O}aejEb`=j!X80 zAV)i?;#7>E=7S{<2%l4NUWKW`Qu)y*TvTyS#eEf*R9seZL&Z%MSGeyguBo`LBJW80 zc%-+3&o?7!G$yz8b?{iQ>uo{8nS43O+&x&p7ZeWGT9T}p_Ycad{8vhmS)u9p(_)|&UJst#EoIXZHq?uQV3hW67sc%Z!|QBi4BEt z6^(>^E64?-{o)`$XlShAM-4w|I5>fL)6DY|Xizt=zxO6k;zaKVHq-F4hPE2oX=pAH z+GzNP36F60q~a5)g$Bl!8h+K#O89Sre`(&=jNb+S(D0{-tg!Rn8e0EHVG}=SGxus* zgNf8_BJs@_ybW1<4IMO0mo{{idOK<8tf7mBt{SGXiRXZZ?ixmD7^$I$hMpP*Xc(xW zmxkUN`e^9OgFiN5!$dkYk&-4+Kb|dO{4Fp(Ld8@Nj91>jgCyC@HASaVX=lK8kX{mnojkn zd!6bvon}v`y}}<%rxhAjYS^G*qlQ%)R%=+NVLh(~GpN)ITEjDE2KAUhYk4GRc*Qr* zpvyC8MG94Wk+w<0W(`~TjNnCMCQZmd#b#2Cnbc_}O`YjE@0dwDH0;!HTE`h3yEN?9 z@Rg1RI`(MT%Trg!7do!bqIp=vb1~hP*A$;vTx;c+h=X-ikgUj`52=ly}Pe0G+4RgH{ zli#2|d_Jw3Pj}|i6Ae%K!$JpiJk#)8!%GcuI+7Mp(FOEEL!AZm&jK&num!Ye0UcdH zz6JD(j#qVL)Df>Ec_CF_NbMGStM`h9bYUSS=x`T$MG|#>GS^!hlXYa$k)k72M`0aB zbY#|%MaP>u-qP`!j;uOJM-CmY>&T`fyN)y+;}YnHOQ1zmbrJovhcx~>$J;vI(ebX1JUa5~$fqN}j)RNo>0&CngnnE? zzb&D@OK8;+y0wG~=y*>@K^=v3yj()XmQur|G-@gBSV}jS((>2Rcw5Hzb$p=XQyt}X z6xC5oM`;}&>-bPdaUCUee8fFkM(-}8I?JfZGAhZ9Uq(lkQHJGIN?OZLk#L*K==elO zSsmrLk;|#>a%#SuCM@^HYRPg+e35o#IaSb6QAZ6OpX;ckqq2@FIzHq0E9iq2)L;em zSV2{FOj|(@DkZF2LDh6r*Ri=)0?H*!znIuBHKC@CS~_a$sH20oqvha-SCG4c-dIUh zS5oVhG-W06HI0=ky_d#(siPiuAuh4LAQQgpprMYhb+pp)n~ra!{d-n=uZ3@<<69ly zajVK@<@B?T?}h&$*jUGpLVnWGR7exS&B=-E+)Q{vPLFeH&S6DqA=pyKuRg3A3FZj@t2Ojb<7vNwT?DACg_-`;~yPub@b8ES4TS??RE6GQhMs> zprfOXt~$Eu=%k~wjxIdOkHlYE>5U1an#a2g!p=;(OQ{|@nDa*oi|pA;2fK0VErgYR z?51P5juAQr=oqMDh>oEWc94$2LO3RSa$>@t9V{{#ChM(y>qY zenECPAS5iWvN^2dcuYSc$s!iu8w~K<*+3=(rPq7AX|T^1>#65@nzWwwtf$C& zN;Qz#Ko$e98OUnjbpyN$_B7s$vkYb5Ks(K}Pc~4i4c^|Y*$t!_AOkrJd}5%ift&_% z@s)W4?;Ci-z?%m08pvnhEd#j?ylo(lfvy{9!3L_5lTL1+&<4u4(QCu<>XhHWI|kk} zP|!e?jr9FSde=a=jkIwi6_Bnmu{Kg61En@mn@yCsi3*F(z1_r(`@TI{okVkzU zz3o(eyBDzecG_P&dDM2=xSeinr-lZ;Ht>ysMm!C6P`Mq{bO#OEK|6NP!yS}uCl%RA z-y8TrM#dCuY+$|tzBl_vK9mNU7-(vsuYrCBni=@nKsy8N4K!zG1AiI#+dvBgEe-r( z;7;K^Db)5)6c*^2HNuB z+eNc?dA&Hfi=OVHH+ECW-Bc`&IvD6^pu2${209t&%(H@>4e*b2-caV--PDEoZkn;1 z*6yamyZNnOlz9*JG|zyt#W z4GiKo8yIC^uz?{4h8q}RU??BBy|ipEUEWLI?xkS{7+de9@Lo#WM<4B@M*C>AfiVWg z8W?9_!!OC)1>Oqhk9}TWrtYJS`{>+0nrL8>f$0Wj7?^Beih-#HrpcJQ`{?V>6L_ng z68mX;A~j8+@AlJ71G5awHZX_h`A5`cKTX|FdOXcFaBRO9dF%V$KQHt65cl%33k)nY zu*kq-1BVS9F|fqIQUjX|Y&NjWz;Xj?46HS8>1I-nUP2df5{;HJx_5rGW zfLa}(F$ZX!f%V)M0~-yjJ3to?P|892_#pjqka`@X1qbQyLE6Fx*T62G)dsd1*lu8l zft?0$h)NxzzYcl3439cQI}Ul56x2hs$G~0#`wZ+ikb0O3AEuUvsrO+zzyora4jPCs zKkW4-`w=>1fRVRdKFa+yaMi#y1IG=VFmRq%Zv!U{oHB6Qz!?L4Ci0%k<&MzotloFy zv)r&Fbn6JUIYQ@nf*qmpN9dw~O9n0*xFTboe3U*uO3jXXdm@iG>Q$O?Q}T5KHw@f2 z@PN-jgKt5^T?6-c+>X+zqja0s&tr6l8&Ed+onyq<@%8796pUW@UpLS7fl7C`oxo)!QJ=TOm@IVGD*@Qnc86!MlJJLDGfb^v)|N?svD z>&3kj0G~LeizU7vz`Fqy2;jW{dXI|h+ccq200jfy7XVKF!I@Yo%$?!~0Yv2N2LTif zpcoGVQi}&rLi7&<=ru6Yv*Wa5Sf-BxC>22N6CN)a03(Mge!@FCAItcZ31D89R8F5r zmPy~U@t+3JKth!dph5r@V{NDtK&1dGOSXz&^#DE-QdO{;AO~-Ef@%c#Sq!i7H3e%2 zP)i7#Sd8+z0elg_m!f|qSWmFNAp1n!7#s2^1@KJ(jRN>1fIkEHR(v>AGj4eR-v{tR zO!+B*#xee50E47P_G}VB)0ocU&jB>&Yyd4p{4Ic%0sI<3tC$Zvvl~bFU#Z{4#L8a* z{2f3C$+i}3E7(TxA3-j~sh#llg4_l!+fjHY!Ons#vZ-6Zdwhu#zf!e(06hZe$%it4 zB>^nuDG@-Q044=6Ie@+a^b26D`1cQBKma3RWd{Z@IDjEMR;$tmiO6KA5Y7%4eV8Cu z#3tq=0~p0U4PdmmjrorcTgL@3K7a|aP!q+I%d&}aN&r&>m@j-<0Mn)H+yG_-FjG9a zidg~74q%S>aH(keU-Rb0+*n@_z`_6)Nf35eEY3_gv2|Gh%LCXTak%OgLe>bb6kH{^ zI@bQR0jvvPy@=7Fh&Fp;0GmYI9KaSKth2*b;am}CIqeW~G~m7bc4q*)0@y7|1$p`H zo&fercAwyW!2u$9RbF9B+3}JWf76Tbjfo5< zV4{eL_f5QF;#CuQ#FWuQypUWb5=!aI(6P2@9?UzGO*-w|Zf zyFv<>-n*AM%c-C!g#-%=vgrd8MNNEaqP&S>Ca#~LQi2}}78fib$fl1>loTF!(yP6+ z@Q(${nE1r>=0;h`GAS1$T(E-hIwtCxs3^RWiOMFbnE1>@4HKV>SXHpPiE2W)7A_m* zHASgqqIS$0)uZ@@i7&;Wp^17z8VJ@G69wY4b zr*N+2FB5+YZ*8KDiGPIiiqXzQThm)Qct$ZskLK2_aUD(cH!;9OClj4bbdkBu)4QJ( z>?+vJM0X)Q1bYhhGSOQ|9}|6r6p*9IjbT#fr1z;h(8M4UIW6R}yi;bdi8Ch7niyhY zsEJ`FhMQPnVx@@@CPtc=VPd9qKR>Q5@n~cCyDon9M4@l zNt`(Bs*`l`Bt1V#`A*Rk6H`r0<6-18=oF1OMQcvcrBn3iRmymp3Z16!PV<#g%r>#e z#9|Y3Ow2X0z{Elm^Q7;~Pt&2(G+%i4(_Z|*Y40BjCUwrx5)(^JEHkm(1plk}dn&a( zLzB+X>N9lW4BbCNub!n$6T3|8=6;={KIdrFIof}YoOATvd8%55 zYM!TkCia^+X5zSs111idIAY=`Pr~!m_dG2-Plrq#Hu3Ph7m)GAdCGc$ilmYnN;_fV zq={1|PV)(P!Esd$;4$74>&Tn z*2Gm4w@lnNagEO!6E{rUgRTH2NYfxJU;sdbQj!ao5B>6Zd%*WufaA z$-GE8FHxmS^!+93a*39{O^-}GHer|unDCkKo6t(w zdzpq@ra71C@MSVhSSD-}4ma;IC10V$*C;U~mApdVU7;aYXy+9QnF#YjZ6U!z#6-G@ zI13ppJTdXq#0wKIIl>i6yGndt+%x_ZkU=PW)oXwAtJLc%?YT;Kt`aP~V&PQ_85yrp zu4^=}ES0|I{TSrC_3B-tPS+^WLXw5oEM&EiY$20{%oeg(7;}xbT%!~V_pebZi`R)0 z|Lo#_ueg?s<*CYbdfh@c3)wBCS@`if4ZlvSuY31EHZMvSt`k|%u2T*<(YQ#H)YLaD zbQqk4pS6$Tn-<=(z}eh_ZwqoZkA=L#^I72Z(G6npT?+*)?6R@j#(NeDa)WKWZljQe z!WNcVSZ1M!h4(F#w@|_2ebT+r_`pJ*D``b7e$!N1F~JW7Ia}O9i5UOLLdh5}C8V^4 zkA;+p>7NKGYoT0B`PB0M@#IikQAHlH@tI~>;6JP@304-YBKVnwsurpVXXoldYFPN( zLQM;`EOfNc$wF-lb!50&S*UB_3k%I8`=y0?7QVOegJkPlXlUVU;a^#3U}2*Csm=I} zg+>;>6BB2@74lz)sM6R%6EXd0;U|f}den_eHI;y@{A{5)yGgdC_;cf1{3qtGF;CWi zv+%oxKP>!d;V%pSSZFJre_P+>ca8t+qFSw9sy^}3Wk?b@XTds@8cB%y)Smx|A z-NFpvGh+&enk}3i=2)03e4gNZ3kxhPw6Ms+Vhc+wjOd!EHi>)OB+esqJ&Y>ZcVt*@ zVTFa2d?0Snm>aap!fFd&KA>k7)>v3;A@FzTex81qJ<3>Hd;7f;h=?07B=&_ zW?{F5Ef%&~*k)n7h50vV`wg;h(35F#J1pMOoA{owUvJXRSet*kNqa2pwXn~^ev7wJ zru8@J%uUj7QvO?1^%nhkiw57KLwp8VIA!6qg(DV@S~y|hq=jP^_|m2C7A4>2oh#`$ zcj1<|yL8Fh)ZjMty-mH!(isb9Eu6D(-r}v(crz~w+@?HtsPrA)sEB6Wp}QZ@B@35% z0kPn>aK*w^3wJEswQ$YCbqhBv+_ZSZ8dC3g_u=HdOXcsm zdfemH&%z@Mk1afqJ{ou8Z{DSc7VmxFIWQ*PqeAzn+&%j79w`=73$_J^mp%)+1=E7X zlk*;JyhqpWkzpagYw~^K#Krl(xDxm2ulqFfJ_Rkf7D7_X$@^s8r>qaW8^udK@I2E+ ze=7Jy@PPgATS}NbxA4NkOAB!}l5J$Nk-_%nSVlnzz9PtfUc739|0HE=yeJ8Ri8hKi zPDm1L`&$xoe%d<4MrIpXY^2(#{!60UJn>|sIDYJ!pSFI@20vIGeFQt3jqEmlwb9B( znhmni$i}xea!BL?f;nyEvhjxSyn=5Ez9pDjkel?jjXW{_(*w#UJip*OG5uX3?Dn3G zg1r9QC~Tv$jVd-SK8Y)0;{zK-ZSYOV@AHSn&U_qQC=!# zrGgE{OTVNtmh6)f4fvUjsy4on##G}mv{9EUwNb;y=QcQ6ZK=AZjapKi+ss{9E>*C# z4i9X$3{1Whw+1#E+NfuvzBtdWnDUj4M=Mj0JRrueZ5&^j%4v6<3{iaWB#t}#U2NRG zxA{GXw5?C#4>lUx_%WvcY~v^4O$3_?HWS=D^WQnvT(Z9iwh(N|16VVm{h|!%Mev)A zjW#yf_}#`IHWDAwpElarXfK|B+4x&XYr!^xe60Vm(N=i1U%Wf3JJ{%GW1@{oHagkp zY-6yEAvU_$=xU>{jea(|+30Sgw~anFdhp;pB>N%1!-{&^=*1J@A@z7jn;&}TOYTS1 z=MiOf(`G-S{x$~K7-(aV&2P)0BaghBGkuRJ^)VHA%;a9;A%{WMDkgvrPpbkI*@ zKOnxXV!n+9HWu1g#OJj_PZB7vLVV|5HHA7WG)?(w zS13uPiYoo0Qp++lP^H-_-|k3jZLG7g-sY$F_|`rurO}rf-=^g~pfOmZ#To@QdQGRz zJSG?7`P&x{=@x0*R>5t8+XZ*n*eQg4>hmMOHul;`a**s`pN;)Cp4oVAKB)@S*u3@gbjCLhcIQ zvvJ?X1Mb(zWVY7QiIMqZ8w$_K0*P$(ala&SmaVGjQAM|5*a%1!T+0(1rVUH7wqQum z5e(XJg|yRYzV1!tu#Jc)%+rNL^{2vFd12$FjRXgY4*#c5w{(g(D9%9!$LkaXnY`lQ zRpA*O#0&Xqvgg2<&!C2NGrykA`zo8sL5kzOFC~}wq&oQEYFbVQnH^+tcq<=db@+cz z$|ly=1>K6?2MQzW*~OYBNP;;W{@;+;#Bs(N#F5`{z}vjO>EJB~xgEUiAdiDe4k|my z>mZ+lV(j1`zk_%92`>kQ9lYzHfP?oO6m#GtF9Vdv^loV9=9M+6sY%5hlyLB|gE9_2a!}GiDF>w;bTw(YNoP!ow`g4` z@ePYgSTrJ>_KAbC4k|dP=%Ac~Yjcv@STxq6PaTw(zBjUn6UX0U(FKcMSoFS4RUCZg zpq_*JJOU1?IjH5Jwu9;pYB>1ZK~0BOV5*VBy8(WH?R^hfWs_o4f2aHdG)R?Pw@RNfk+-sLsxpc%Oze_J%DiWe$6_T4eXy%}M$rMg}=h80@ zT5wqxyIr(&@T&tih)@u%9Q@`WXArr9_?-{21KWY);71>_N|o;RykPB=S5TOel@vt?&P&0;x~7Ve(611z0SdU2YY#; zcCf+0My}MsHi@&z!Da_r9Q5g#XRv$6xH0JkATrl2MGYM59F@@d8Ea}XJWUI%%? z@bj}FDI0bWagZ+jiC|n1Pla%e&m24#{zCAjV3n{p|1$(-{TJlyD?%EFDL#mVAYKc4 zo2ey=xF}3*-$+b~c_s&uDaKQRNEM!0FiT8tEmdR<;`Jc9R`sS+HZf%vOcNx*9D+$p z;@$}2%^-#aFCj7%7igT9_|Lee{gp^`ub}JP` zX>ltT#K%HDiA5+AD^)f|xCqzssW_AmA{wDm5S4?x0;6^iRf6~|h#KNhRj|60<%+6F zrCfWo)aOCej75mHtxgbirAUJyz6kQ>L04X$MR-k(}*BO1~E2>aY2jzcAV;;m7K z#dJGDZObPf3*vYX7lXJI1P#h`B8W3Q|7)aVPN$PWoC>1qJDE$R)9D}>x$M~>&hddu zr^e}Yp6AS@q|WJdfr(fz2XQ5cTM~cL*C|(nxE{m}$zJ0#D^r|zF-Ni-s&aF$7vI&6 zyB)-xAnx+wGc;4JTk(8L`Oeab_kx%yG1=!~5SEmB6vX2od_nkwFoH0HPf!~T-8H=%_+Lu#I2RdQz{M*rUUiY^BFV+YhFLPYh!?_~zl5LY zm6+gSSg#b$a!PiQD%MOfpA;8Ac28teW>K;TazR#JcfH4Lh8{_K!$mfZ|HSJ~c4<|b zAPMGhk<&#k;ZbDIH(k8tBDagTU6gk5v5P$7P{>7L7kORebCKW0J1z=}{;uGAf&~Oi zFY&G?M|l*BxOiVoAG!FzMN#1;ToiNhp^M^@3`E6@^z4%r8UnnTx6}zIXA1i)t>ayWrcN`IEiY6RII@bzOY!g0q}z zGKulpF6s#9;bjxI`3o0cx~M0m>bv+>$X6~JxM=9&Ysofp@r{t^o^)I)x-DH){LcM% zue!$K)8YvYenLOG_{l{R7uwELPQSQl8sp7`{OqE6OgYd#Lkr<8W6G~W60gMn?&1#@ zyR~#wTr1wXwBXDtxw2)LTz09!R7O30-(HpH6KjyuDxt z!H$BR1Un0|bHocAgpsS#Klk-qa-`b#c&rRT#R%vYhEJ1ldVyQ6nWB3f?Q;oi{;|E*2M}JrRpcF zcCp6AN)cBHvdErM9!1V_%=IodxY+1olZzcLc1i~`J)_O8_ij4&*&@Zay4dDoy9<8C zgeNB>o9LOhb5?<8RN)!zak1CMG$6cIoani*p7k6CTb#dCo85dVwTyt^O#W}7;n#2t_ z&x?|aOOn07C%#-ZiC)rSD=Umw+yf;>k5;4zlzhtPn>hp+z&GN~TICn1y# zp`0j{1wR!mAM>doq@rLY!Ddh5xNMaWK9g)!K~}1T5H&Hc5yIyo)C}Qkab~4f2(?3~ zBhGaN>xJ-z6!|h1A?jRTvR}obHRK>6d?R8L!A64LhVWeo-wWsXKMDCkuyF`K3W)}c zVpCC?3H~hDT<{k`j=*le3U3p_KOwXd{+ra;Rv=h=k zgbqSFhR`j9?jdxNEZ5jMgf7Cn#yT4vz#bv=6g?WSSInQYePX3pX^Fo*(!jhQJ0wIe97lyD%NVM-hr4TNMa7~meu{c+SMEx0~gxh~Z^k}qOA>5Yiomi>6 zv3ehb@GyijVSEzCqYxg4@Faw%A^7+tIv;O^@ZdT5WwBBORY5HTU5F7vK*+e^|Nf_D z@|yFl_v_CN;l*=uLI{e3D;NnOB!nHpd}^FcVISt{A~GMoGSf3&%){QJ^v^j$2rom3 z3nOP3xx&a02Es@QBQ=ay!gw|8eHJ8#kui+;FcQO{7sM$+NEF$DQ<8YHiFu|lqS?%0 zWC*kO&qd@@p{Y}EybQ3CoNh$j2sdl_bg^6*{AewI+OpfHVU!P}LKqdps1(NM zVbl!c{r&Nk#kpD-Rl@izjC*6_rp`lE5m&YJE|mTBFsXVNHAG>~)>>iI4kOqEt=lKo z348d3SnCQO_f|41&UEh})(_*WFnWg3D~twVGz|0Zv}h8>*I|4UM&mGk45LvP1zu3L z;)(o~;9H5q1-}d9d*MF_)|%nX!+-K8@he%lJG_ZZ(=eKa@lP0S!`^cu{I$9NuK1tB zXwLp&w1~y|BaD_Y{%aVmV*EEDzYA7*L4OMQOYm>O)`DDV8zBv4jZ%(m9MSLfXF|PF$Q*H&MEW(L)F;?9)4pK4BaS<9HZ-!{`^r^e|?G z(Lam<;x_&T4HS~^QNoBY1_>W5I7D!$;4s1Ag1zf|JHd_QsrV>iR2ZYf7$bawAd6$e z7$tF(sdty) z+%V>aF+Yq2VXO^fT^I|)SQN(cFjk1e;xLwm!7rZWI7>t+lRt5pkVe(KOYtj(uL@&z z%q?FB@3^lK{i67+4`V}^ua$YTYhxIj!g%n45?|8hFt&uTHH>Xx49k~v=xjXic(U^a z@e|+eT#t0knQ4cV+9}Ad2f4p5ez)*Ff*f$KkbQhmZp7W0<5hh?l!IX$iuoK4uSJkqIQKM*koqs_+$it! zD_aEFBlsY~S3Z#z0Yy+m9CAdErEg-+2y#WdQRVkO@o2vh@$Q+-AHjr|^d{>^l)}Ta9-G3kY)dy$A{lFClMBCGjpma%GyX;6(OvACWMPHuNpytNE(wG5quuO7crlj5!8;LP6V}L#rZ)P zb}Mn+D^)jwEfW7rvDOpx?rD#tHHe^L1V2a6Jc6$y_$GoMBlszTMiG1)!S~$M2)+~l zHWG@XMH|pqdcj#v9K4D6G!tZ{X#_7~J!1Y#1T7-?E8;zE(K3QxBlsUAVfJ zX!R0ZBk0C$c#6NDqI(2ABG{CU&FSbFL9Ym2Nyn?{d}$heBDgBYw{HafB3Kc@$_V;L zFhInK5e$rAknkZ=%kh^qSh7sGF}z2^&dqXhC)!BV;UhN6Ln()PfY@Hs#j0k2%Fe`%D5iAgWP6Tr!m>0o($?^jc|6k&Q z3nN$*!T)qtmWcDxSmb39EEnz_vO8E6!D`7~iC|3xYo#ogS|{Rh!S#Y0BG|}d8^LDD z9_6{m&Ji4p;7|nHc=O)~_C&Ck&*BJnMzEV_+E>ZDB8Uzna}LXcIlPHCf%iqQpBJ3d zIKT_kWU73HK4{ z-eA@{k(4nV@$8U}W}+mdBPAWF=}1gRk|_Lvo1BhJ!kfqCXv+uaL0aZ?WJ$+|=_sC# z*V2(ytbd%ukhmNi_VsjROGox}q^0BCbQDMji36K*r6YJbK8IjV!Hc!ML-R&D-b}|^ z>G=H%Z!+Xg$J^=1Bc<}DBVRfuqt{6Yr&XLAt8m+Q6wGj zr^9#B>oVg9+@8y6XX0`ci+O52Gn7cjN9ib^jtc2e<8qWt=YN#EcRsfXdCkk1AxG(S ze4Gv@oXQCKM6j%2Il)iUy)B~HA!~*l{MNfW`7%|MDk`O;ayqIA|12F}q~ptUR82>< zbW~4AjdcFU3U$Q#c{*yvT2(V0pJ(vKlT-5yIsT{D6^EV~a?}&jFdbhD`F~V>2ecH$ z_w??q-3dGIJ>uIY=bUrSIfDcd1r!7Y17HRdVnBilh=L-57yv;*F`^)5R1{GWBp8q& zWHcV|M`9A^r=%_H%w1=PtVTm?Cdbb^AbXb;R#^~eMTkZ{Dh2C)98d;kdO-# za*_Is;cBV*iFD>x7&ulv^VRXnsnB5p6DDM3f?s>dr3smokU0stGa-``a#=#IOUU&J z32pbUgZ?U0aCt(e&|!b^)P!82m7=<4)}q0CFJge z+>?;G3E}(h_*TptKu)tHSNFP-I!Eo~$y-!B;><{>`cf<3Hdl7 zN%5zm1Je@b6J}WJ?fANg-#83`*~J3~=2OMb60%!Ih`Y4U&>zM{$8oN<1m4grpO~jzdyg2?-YN9i_NeY+Ks!6GqlyXV`2rZwK3Q9&q3`@nNRMKi?#VU$@ zFY;Gl{=XivdQz@DS6pt7Rf8G!STz-EC8f3!Ds{Mn0k4;o>+Z2BHcU#Rq;yJ3=cF`F z`X~1eN$HrBnycJ=_ePQ9vWMEn%y%g z!~+r2Cn#{l$@_PT9JPmMH9=IK)gr^m9a?~mz42Zy*SD5 zCj2BU49x%G6hD>mkA5!Itw*C~Qc{SM6)#h~TyaWLrYgBYkzGW$tCKQ~(;(?z3AT%x z=~2U@hW|OvQ!OtEujP<2>igm+lX87hZb-@lNm-PX81zmRX^MyYm>s>;Ctb)7O70t5jbdxY2=SO;V`vF`=iD@-#d1`+{eZvMVWk zY3f?_T$hyfNqIIY8b9h8Ps&>wNIjp8$W-qn<=v!w6hyt3ln+&ZKPexm z_!dEg3$T^l#3LuuShB@#l6}JWd()EtkZke4msblKu|_uD8r0%b#g1 zN4QYzFFu)+A2pD%N0V|)`SCzG!6@Yqe;A^}&q?_uDP?Oqzb55WQcfr3H?97zNc|5b ze-{-ISm@W~`4o0ObZU$9Jx zsZJ;*-)MfMB$AS`DH)fNXiBV+NEmP7eC9So=ZBo)!-MCTuaKE@0?G(9y zbPO_dO-ZMebWTYZ-DrM)=|Ivg@L|I?e_q&AJGt-)yH`qjr=(9x`l`eEDe0$VNJ@sL zq<;`KASDCY`L-F9lEEsHv#>G4QgU8OMyNPkkv@4(T1iHxWRynb11XMHw+j@5^e3&luSs;L@HXHqBtof?XoV*WF?m=UY?TS?4PVl`BS>DY+pfAEe~N zl-!t-n^N*fN*+zg%#_SZ`QH&NO3BSB;Uk*898-5!@hvI2H6^#DgkNFYosxS}ayutv zkv%&lcW}Borb$nCPD-|SwC_yGUCjSnXh(aOg=B6@?oG-4DLGs>#{VnXaje9=l*~`b zCeL1w;;&F+OD2_ANb7;Z`?zak!X$it@`03Wvr7!`Xx}rsYp{-U^dsMHb;XsFbK zDOsxIAw?<=r({{cmn-4Z<113~SW4bY$@?i;sXN6a>r!%A*n6BuU(#BYlGQ1BA|-25 z@?=WZ>TrC%rD#=8Z;oT0Vuv{9X~k!_Q|ld8*N*kxcFg*eJe!gYDQU6WdNCziQnE26 z&!yyfRX7Ktu0MG;aW-ns7ZiVYeDS4}ysU29Qu2!GO!As4ucoBu$}p?1tG-q7jg-8Z zl3@+~BatS49YC@@C2yr-tlXJ}jRemS0lxD_4WGbWO`|DfvAmXHxP{O8!X6pD8(&lG7Uamo|z1Kk5#0 z?->5KZi0mK<)WRIXj;yxRnmgA@0Q?FGpA%SB`MX((<#X)&nnUmda^93huN?OO>=#O-o(1R!hqVF;gck z$780tDmBtlQ%S9~)K+WH!y%UPo`2q_Gd=66L;bWgNK3=CG)hYgRp`(-ElmU7gc+{& zqb$!fQ?a=st1XqZQf!?T>J;hORvXz)vAtpk#g2+>f2Xu`R?b)dvDz&y-P3X;EkCBE zM_PKOWougANJ}r0-O^k0*U-$*j4073Eq&9{FD?DkG9WFZ(sDj$PLVq>Eko1t6mQX_ zWpG+9I&O{f%(!~)khI)?xabkj3`@&->M%SlBhoTbdA(3*Kqy3HAj#;oT#%MK(lRG4 zW72YAS}sq^6lP1yST-XqlhX3+!4l)ra&cNNNz3@OJTGphtG&rH6VmdbXIAxdCvsmr z6DcsP^0n2I=~K(OEG>L<_4=w9fqA09+?tl#(sFxRW~b$y0)M3bEHEt!&45Dl#dhb4LUT`{xic+yrRA}- ztW3+@X+E$gOVaXSTIQzZ-n87u&P?;}fy__Kg0w88XQ64+*L|zd>?<^zZU3A4Ukgns zr^EwkS(KK=9K<4HiVVA`agkwTQm*f_G%f6?WocQSmWR^va9YL{nVXBuq9ViaN7$2J zSdXSBRW8Jm`kX?ZR!tLc!IXVS7Z&8P3=Nseh+p5}pH!c;C{ z+LSPJ`ukfPRl-auVMx}cWj#kQEgRC3u58~?!aP{QtSe!5lrRTMm~cry|MO|tl$Mv$ z@^V@>r{#sTyqK0PJUU96wyjD|E@|#8>5uHHV(+SNoX1Lm2Bk=9aeJ z$0g0FlEx`zYHPX1a^FnLwzPbomLJk`Xqva3OHFB0r?h!1Ej!ZkHisiEUvjp0vfoY1 zd))oB?Br6@-hH13<^cNx?q*4MK^K?2a?<*U>rYySpSC_t%kD0Ar&8vVwCp-sv@4HC zi&n1+e@2rYIG=O8N|`T|?@7z#QvN=!E@dcwm6p9}`8qB8((`%)#Tt-Tn&-NA_ z;7*k?huFR6l|0D6?xjD~SXK|G`LFBN?_)}RmzEBjik^NhwEyl9@0Ro^ZKjkqziur) znwDc}$)+X8Y-u^cBQ!0)v)SJi|HNUMUBG+4x8CWUOv}${A^9aOzjCG>aTk_0EL2L2 zj&CS!{@`&s(fKnif2HMAT27}WrS1G%F`>xaIm7m(E0oRV(p z#%jfkRLw}WjF4B#NM$ADRWkmCEeW$#&q$q&^eSU&WTd8s*UCt3B^2qvk|%XDk~cL_ zYom-b&PYS$^kGPoj5N(i>x{Hfu~|l1WTa(Anrro{VKKI!ZEK}@m@~gS%*pUPwpY$8 zMBbU~puD4ECq=q-R?;OST?2(zD?KvOlbx2823hHqk>1?9jBLtCpN#a)$lV#aCnNnb z(mx}kGjc&j24rMlM$XUhFRlH(n^4BwR>lm<$l#0&$;eR6JVJ4p;(3b06_;zDj8r~K zvCR>`{k$#tLK!nABNt}m_KeKV$VC~s>xJSe8UJR&*o?FaJxTG*($eHFuP*N-KiFVDzdZntQGjg@&zm8qqtazI8>AVC`a*g7-da-MjB+3}Jq5fNZ^QV@4xUA{^kaJr`%J#4?b4xv6)}I?6 zl{I&0C(Kd2le?@WSJqT0Hghv_Z$?&R3*%!`anh&X&&l%(}Nj#NGI)5#Up*goWLv(XJnZw%N40SqU2Gg+OO6AWeKCZY* zadk$XP(q(I8F@0`PbqntGeN^?UCV>MLwuc)8>r4kddOS zl*r198QGGNFF2YRc_||=XXNvY?8(S08M&_5?9BLoANH#5>1&FwXJl(e-pI(C8F@#Q zZ5hdz?OI(@Y~ISqj*Ps`o-8&j9EEGo+9dC0QWG`o6Mowj9{da#r=x> z?d`#g98&%(FGbfC9nMIrAFU(0v)^XqI~BiIO?d|r zT8$|3kx|}(v9e-k#R;OkthmZ!fs(&(S)kQIMJgqgRLM%!tdvq-TCt2`Sw*&?ILk*& z#bl+NDiyO*NlAId3R$^9_nn@3QaLLWS!Jn~mFiikq1A1zJ-%1%(YSdvZfa(wmWs6% z>tv;FR_XlyQ$_H8bFe{C-(j+Tev+_n(nr5Y0R_@5koUAm@N{g&qla*_; zayD*SW@Sp2zhZV;Wuoyze3rL6qM}M#h7kc>7JDyT=UI;=c!ALx!IWRD+?}|=k?0UW@Gjm^We?lzFFy? zmBazNUsevi=6{$Bl`{jfGLYR>&a^FOE-B|{7?PEtSs9*{5m_0Qm7B_$*Hx$KysSK; zoIk=EnUzslnXtQXP0l|Zf2sOtZTSUR8IzR@m5)`tNb!$yrd)ZGTm0WIRxZxUB-I&y ziINFfnHVUSW~F9%zde&xxlHkL#q2A7xK&HVBvexi6?d2>%z=4R#Itjx>GNULB2$4&A%io530CYaVbY3E01R7p{zWdm1Ud&{Yx@K9+zwN=kNWwy&@|s zHH7>zPPY8-e^ptf_}D*AxPo~iD{Hdyq$*Emhdcv+@y-^qkbl$;VmwBr9ceQk;`rS^1RfQqCXHrz)6j70hQ@*`1Zo zv$7{E8Qtq#Y5R+;{FIfGS@|+6UuA{L-mH9+l>=G%Ix9Pm$M$7qzdG+Z8~d(;KPwLM zD9g%^Svi`OGu28T&dRr0`A+#)rR95d{vj(zva;(De?Ajik18g{M*26Mj?uG%Ij(N` zgeTa}il%x+^K({y$%^-r^>0>w)yA+rr?c`~R(@BXKeF-{7oS_*Ke@#U=9-f3^z&k; zG?n{H2_~oi-^{PdKZ+eH`fWbTBe$YC$5kRLNp@F7lU9W!rB(WD+w5N#WHlgA+XP4yt#|NvE82&IwIja?&*?-Eu;o zyj!!O4hwk?b?%vyUODNlyq_XB+9xM{m3OV=k4S&zdF6Ul2B|Vwafsqj#bG%)FDJv5 zk5U|wlaWfe`13Ud%yzz3M=P$@Y!~L_qMV#MA!Bp$UM0hSg5Y&7J;&u_d`?1B{qNj4 zOc&?mlAPT8bBPH#naJ>*q`TXbax$5%eY|MfX=mher_Hp&(GNL4v~s89WNJ=&SmcXlq_)AGU-PZkauX0O(*Jdu+%Ie9WCPvztp z9-cWlGr@azsPnWYZ#~1ltg=~`ll3{i;oO>4$Jx=(d6w-T;yj-d@(qd`6`x~xWkZqH z9^K@HoV=KmojLhPH}rXBvn3}l<>Y0pzLAqRbMlJvR~5N~ujSR z<>YN9Z|$5L=xomk@h!z2?ATkvzmE#N6GXjBB`5D|^@E&z80b5jgjtxadw(xi*?gSy zUmp00T6Zaas`#1WZbg0?{5&W7zSB=QIr%Clb_h-gdvo%2PJYbEQCc~0_2NwRZBF)U z)HjL;6uG&BIXM*Y!%AKn;eHn=-z)hcCr6ZQGJXq-su-Jl?rVR59lif6B>8 zB|qonkDUCe{Fj{ks^m8=fH`@zrbB-glD|~{Tan7CoSY6kSv`}Jf3*6q;@QB&JhUcq zl2nr7+8zRxbWSp=WEDdpV!}?gc2c?)R4*{lnSA=^70{+3G$c_$_BhxNj!uBX9~E9a$3!|q=NE_ zfoG+lg;i9k8bY-Yst4AZN@^(PJE2wxwF4`Y*9)P32yH`X7eWKon}pCbgoc4nqYxVZ zPk1xstrVLpwg{o+|2X{Dbs@A-k&UO)K7>EPA5H1g4N(lYgQ6WrJ)4&i0DH#*O;1Gs{Fd~GJAq-XVJVmx@m=gBMa3%jW zyNVg5)zKlGA9&_X7le@SzzajTD1@;gj0@os^%);{UaTbVpLd=RD3>ak6nIV!;j+NQ z#!L<2iV&_1tXGCGJ>XXotLLU7%ba!VMwZ7{X1e%v8)bh8rTeC4^f; zSRTS7A>0f0)?JS1OAYbheKGVB)^qMLs${Qi>f>p!pabyQ~tQ((;++)!m1Ef zYxRi`o>a0%F~8SODbM%ATIJ6wt_ytD2M!yQYz*{#$n#p=6vAdDFZ_>nO9(G%_2m#= z4`HkFS3-C-@Odp5Bevv?5Vi;Un;~oqICnFDRK6X;J0W}*#`j^o8^U`bj1J?1Fy0U0 zgAj&=ab6f7hOm>fk!dyjqY!q7@VWAj6+a1Kmy%Bvx!uo#HtY%Eix7TL{mT%(QgTpn zZwUJX|F4zo3!=UW^aH_Ba7dNIA$-f$2G;KbYrfBqgz#esM?*NK4nK!*T**&?|A`>~ zNmcS={Yzl|HL(5>!k=7)!e|o4Um=_dp*W0q7^g${n+tLnRv2eO_$P!^2W9%FjD}$} zQk_=n`8;{greQP-qe~cF!)P8xi?DwJ?GQ#wCFHHcXcce{Wt%YChS5%y_KNxOr6);8 zRXQnlR?N?tZeer}qhA>P!{`y{y~F6KyqDtt<>?bf-@u2*=>X+}6$b|TASJX836!DX z|5kEtG2ctWb(cpdjtpZ|80Uxa9X|(dDVo>O;irxm(z7!#CCRP;BbWKtNLC-@H%Tpq@hFlK~tO&C)HpR2>TB8)4wI;M)b zDj*c6g>gd_Gq;MFt|IxhLDUUlTo>@`*+|{58v`ZQ(7$S%snuDE{78077`KLTn^x}% z<8CFlhcR0T{qImRCyYC_JRkJcJz>lbV?h{m1J8TIm>2L5)or0x7b)JScz+lV1U}za zF^j`kqSXh(cqojAl`rL@r{P386PIzVt71qVRfqLqJj<;&bXJ7H&+U(eu~G^7<6*2) zzFP4K#WjjgDn6z7wBj?0YZb>H39k!-?^0lr4Pk5y;{$FqjOW65K8#ms;_-56(WWq7 zQbN8tj2D!@7${qm+}*=@S;;Gb{?}dc*Ok8!#+zYm4fOpZ-ECoP592*m-co!=afjmD zicHAOy{o)NOP{~5oNxRlC+-a6%P_tQ<0I8S4&#$Bb}8SjNViXwd=|#JDu&h1!`KtX z7b+50Oz=|?_Xhq4!uVSGzChU@#y0`yoTUFjtsV;Fu##^T-`r40(+^=B;i@I5F8&hq zV;H~kaMR&C8pg3Oj)zfP)tpdVGr{>u$w|eZ6>0rNNw?eF-!(ADMW(9Zx3_{H{&RGBQ$`cd_239qN zf(xsfiUt0yMZV6fT8n~`f>MIgf--_ij~7-D{9U!6tf2XKg@y?Qe08vU)Q$`K?JRuq z;=*#8yu2cPn5QBG1(mtoqkh_|f-1`MRVu935Y!Yj)2Ld4+JZN#nnr>;g1UkwRZV?0 z-B{JI)Kk83beMVrwKf!t9^$ad1+cN8iGYNqsbJBz0+NG#JMHm!OZF1C1=Ivu3)%?2 z7yKY-D`+PeDHtVaFX$lXDCi{qy2`t(rK_2i)eNs&M^rPN1ziMP1>FRLwHe(Nxfgu| zJ(TwhlwN|~0WYDK(tX)Ws`OVJz&;lYQqDg%Vv-W0OYt4-LsS{6I82eI^8~|{j}Wk2 zSIs{ooX;H>ydrp2O&18}2<{Y&;W!E|5{wnxAh=O5PB30@xnPQVUd;WS=ueDGluS^Z zm=_gkoh1HhGgxB zFq_1L%yX0AcI7h_X9;drw_60a3U1TJ)06)H^bO^sSe-4nL;ds0UCJNepbPF+evjf@ z#d`(w1oH(81ox}5Q1EaybDwf%BWEGWD~ma`)U;mkppwTGmkJ(YpkSHcF;10jWtOY{ zsNy4nLzfq@{L-rM_jBF~0g*XZs`Z)XexI)rtQI`Mmpu!f5v&!^`AKznTJV$-D)eMw zm7KUv^}O|2!3M!bRp|4)lIMchO@hsW7gT&vu!Tp{_x_2MvZtEqvdI3U znt6=}UAOp`g4YH7x_K)@1aAtq2|g8kCfKg}`+^SyZwYn?-d3e^b@Q&^9p&Y!n-n=UVah$#=#Z*s(Svpo%|C0N1(9EB!6kDQ!1WT{5$WUI-7S^ za86JJlz@LY^s8>BS2qd&S6@i^PlF;OZ~zy``nUNJ1uWoH?~q;)fJ=V!?xEj$vxd)V zIxMV86DI=v)!Qdj+H?;QZAR5}coQ-PctAnm&s6lx#};Zf@>SJMN#LF8|9$c-1(XKL zXbZ~%<&?0s#Y*CeMv;eec_kGT=~GcjCB@2$Re-8WswvW^x)QFFwSd~d9Nf8tD3p4~80gYAZpx8vQsUkBsQ_>u05hyKzRsnAfv{Bwxv7KUj z#r&e(Q91K;Qqozmi(*&BZi?L%dnoo)?4{Tn{wm571kFFQ@y|90AQe!L5hQc zA;3`O^gmeLu#hn7JdGW$I06_6i~`P9H|GNvs5qJ()h$j>iepsCSH}j~9^F>VQ{gyZ zJa92^3I01vl5m#NbSc2ISb=dQJmg9U3B;p~`d0uLG_JZV7yD0B!s18xUq z19zxTK0mEYp3l#Iz6+QK%-24@Tk#&nxxl^J5BY&0<_U-RKHz@f;|M;9-~nI}JtLSG z!D3(ua0d7Xco101V@LbvA>d))Paa&rGJrS3IY3VU%YjGOZ@>!Rv7pZlds`3om8v|h zxJq%gV&1w2coKLDc$zH%J^`Kq)&kq$f3R5xtOs5MwrKTP;5p!VV1riauo2+feP;~u zKl5w?HU}e1(+hzQO)mj2vsc+60NwJ=uK;#IM;`kz_-#DwQJHM+B zKOX-93~pOUg`WJfW6gnL?kp$CY2a@T`rN`rAuJ3pt5(L+6jyE(>BErn z5mbnvqAJxCD@9OQqpE1NY6OgBl6)Q}sjfOR*NmW61hpfm6G6KO+DA|~f|&~oSsJr* zBB&oh19ff~L8Az!j`Ke$MVtAzzkbu5Z4yD#2%1IEJc7QF;?@zgh@fQzSC=ks#eS}7 zYS#4ofB7f=^~j+PMQtKz%fo-TU*%Sa9U|x$LH`Iok2swo=o~?>2zp1*g{7wH7D0Dy zKv%^nHO*Z$O^*n6)-*j;S*`gGOm_P)L+zq|D)uEm?kBH)zMHwve?VeD1P5xG-YuPh z5e$l8&OiPxTz#oCB!Zz442$5r2riEJr{Lk5f!5JVMktPqU{s)=AHk-Oe~MwbAc8Rw zTo}PcfpvTYVI(VZjRstLhCVa3I*Wl?y)}Z{*f|m08NuzkN3*#;cXV#A!NLgci(r}h?7Xyq2Pw~<_wy{k@$K&|QY2ZdWJv@M zDp?xn4@K~Bz>iLeFV{TW#3KtWh4X?O(t?9lfH#|Mv%YQ=Xq*f1nVPsR=4l0up+m0NXa|3{R!|br?isqxry552St)25&RhNqY)faemqckM)UKW zjsG0MFI;bX<(x_)E#D2+k-ut@yVhPp0(wM>)yA zfp{*0LEtSn2BI~9mA64Ss>t{D8f-+7e!tkkVh2RY;sHU*osW(C~*~I ziu9RN#}r2WYrtP-6%<8LB8rkxl!~H76fL7D9YvWaYSAHzvQZRAQ6-A18XJ$Id=wR; zFj16K<+VD7oExgBSV@spiY%3*paZKc)uN~oMNM_6uBN=652t6HDC$PhD2m4FQ%|u$ z6!rfnC$lxwob+dSlPH>Lm3q@4CwcQ=)2*Ut9YwDwdPmVFindX7j-pEx?KHeY6dj{z zubjC zKWGo#Sm-}EiXl-94XSxDkF*YtVq_GfqIlu3jEG{d_Tl+ajE>?C4oU6l0?p7sV9a1oMo~lPE4$a!H_1VDi=OL`AwyQhjn@y)25$qo9>0 zx=mGbh2oWpS1INlrbRJ5iWzKxw&B(&u8rb4<+IpDN^VkQ3vWh zignEbB?}d6|NP(mmItDEEQ*y;|FpYEad8w&lsu?NeQ6XADStRnmPN5#`6G&tDy~rE zjxgkL-OAHZ@c3G#e6`{eifa^~ROHI=l#;%64V|Bff){Qi>!Wx!iZ7!0GK$OUnhjBG ziQ*;o+!zJVU(a#$Ii>5EO^PI&Ia>n$qWVyLIf_@J_(TI=Wp79EHrpA+>rrftVtW*C zMg98*yaSNy6M7?xH>2Rag>6yrPC~gp|J_fZvV)6uO^1ZH6yA;Ey(r#~;sbT2$QusS zKU5#`kCp6H{D@1(_;CJi1MgID>~?8mKBZO3ZpF_P_b4u_>#rDJaewO?es0_w#aUG- zejUZWDE3G3je1fkv0IAk`TmEZILw91LRkynM)4ijNeg1(`zU^h;#3s3)iYh|nIr7s zn$F26$bVEks(4KCxZ(-LpST!S^+V|Yvqt@*_$&81ir=I7L#wp@6~&**FH&bJte(~u z{vE}cDE^7!U#;dibLyG1im52hsh9}%C8;|1B^@Z4D6#<`-O&HU7_#u9?(fun#k?_8 zqQ2pji&*%io?(evu$0>t91E_67=0|1v~aqf@hlW6DX>teBp*c+OI|6Z;iWCmht@oD zyMssC#TMcgjO8DIjV&~>P|iYm3l%I>wEQ~;4J=f$P+55$#VU%`EmT!fO)-BJU&BI8 zt=3Ykt(d>e&tqK+^#cF;O7a)}4fCSnsXei#7Md~tAZKe$=iZTCa|>-Pw6j3oLb0V{ zD+{fav{9tBetq-h`Jwg}I$P+X89G@01%5}xP8Rs68>`2M`R{V+s(and!Z%gI-IYI4 z)4$8w%R+Ap+g-fnqK}2X7A~?e)oM&OUh3hO_Z()RmkrpOcm}p^?h4Y!&!dMHVEnHw>jD-s=^sH|_Y8-!dKs@zl z@$C9$eSLGFzA0{C##tC|;bIGy(5Hc!)WAH@z-(<`PB$=B8=BAVi4SjRF10Yp!c;!q zX<@R3%Pd@OVG8F@mH6ci&FqF|V?*;=LvyB~InXrjHZoUQxXQwG3p1Frar|lvn;V%g z8<}Yq8aFay8kxC`%)v$`(%4*Mp+#eJE!)}Hu&|eIuyCV=do0YgaFd0Z7H+d}yMU$RYVZrZeo-O$`Tq+|53;xY@%l{{kM zaV3u`u2AIQK4xL1@@35ptEWy1@d;I4;K6HQjq)cIpR(|@l4mSDr(~@nL)KYXZ{b<) zqbkIWN^&>E|JI!Jd0v%G7SbnWvvLyZTP*Cf@R5a=EWE7xD;D0gu+74&T76BCp08Wj zs{9SbZQ5q)+bz5o_`IcLhlRH-ykjBnNuPKBC**w#A87SM#k}cbt|453E&O0%mxWI) ze63c-ex~FL#odaZTi6p=^PBk6!dHQ^H`wkz3;R|4#=_yidO*oR#Y2ku&i~fJcY#k{ zKVsphK>5+aQRT-Jk1L)CtQ@$L%6|@&UzD(if4A@l7gZajZ2W2AFZREMj9O1|7AZNc z__yL2Meg-K7XA(R*Z1rJkr9qzSY9SZR~Gh#+7#eZDH!QG!<-Aw9!s;4r}TARI>3+EvK@L zDmJRB-oQpf8`YFow^74JO&hgr)KjIljT>5;`&*j2HtN_QG6@wH5|;WlUJ7_48%=FA zv(Z@HnkeQ&=-FJWtrS}*whR)sw$VnFwtSCj-jUhIM z+UTZ%y>0Zd@!STxyNw>IkoUCFOAC3vwSCnzh-U#C{gn@}F;EFT^FAvFga!wk;xOeS zZH!WKo{iy3Mg%^;p9`HI@G(k8+qgi<|K+?;o5B3!Y>a1byQuEsVjGum932!pm|$a~ zjW=y~9<*_fjkz`!+2ETS@3k?{#(l~c9+LSS&{k%lRu?FmR)z}S-F-jj zgTBl90VQKvnZ-7!GYQ{r{o_D;sf}eemfIkIh<(+{JZvL7(0~2)BQ_q@Y%4h*-U=~f zg;pO^WOYd^^LW6S^9hdZrs9oswz0;>lWKa(#ZM5-5lWe!~mW@BSxalzMu(4P5w{5&*<6Ujur#3#b@t%$MZG50DVH-ZO@u6CG zD&~9UW96SH?o#BxJJET!a+1%LaK!fn$`>}i4ER?{PRxvdZDSu-9~3&CzTwxaYD&Yigd`w{;btsZ2W5DHy!cc zbynne;VAo`?P+DQtxSP~Q#MX>&9rewyCv%29}Q0_{;SBeXKkFbk+6}}lHX10Op>;d z;Y?G{kb|(}Pwbp#<5U!fUrqT6$1CE1g%0E_6j}J*Ra+e#Mb|;hfv22Sb_@H2TdC06 z6gnt!KvF`nq#~=Ol$2KFKMYXecH?}VtAnTu%SAZ{{I}K%9bDv~JRKZVbWq7beFqI3 zRCfGXR8z5vBCA!ERC7>WNe#tagZ^7HYdNSLc-C=HS9!fa;p-(EI%wozh=ZXH8ars> zpu2+}4w^b>=AeUvjt-hTXw%xXa?sjA3*{|!uPJiJ+c;?Jpq+#E|G$Z1zU19HskMuP z&OwjS+SNff2h7GoH)2l*y&Uv)&`;g+8|v+#PY{(?`a2k?$^b>CqCUvMU?utS;_wYq z>u^m@@w~u!goBX|MmacNl?xnv2 zIe6H?L|Pr(>fkm9lN?NTaGite9bD$%atBvCnC4)LgQ*U#(rqz659BKxT&dM@gY2=| zpInY;n(knRgKHdIt5$mE|05uO?C1Fn4sKNI&5AcUnCW0v;Ljv{2QOd1n-94q&~JAz z+rj->y~DvA2lE`vcW|eJyByr(V6K{YkTURY$6uNAO}*Fg7e>z5n+DlLiVGavr_Ku% zXKMSYb7g+O!6FBX9V~IMRILwcc>dVu>PokKwq*{MJ9x&yS_hBNd62zQ@li!qS15T* zk=uRT!72wEONCZDc+$aB4xVtZhV!bGe>CwVLVVisPcAHUBXXXvbFkjQE1Kk42OE@Z zVIBw1Ie0;<&ns?nu$hMg&r^f!Rjm#24Mma{>AcV*c}YEAR%Dg`pz*4M*Brd=V5^GT z9K50A&A^8z5qdH_uW-b-r##uY=RUsO<|psWbe5gM$tZIXLX# z4+nqhWdC(=R;yY5XN!Y`^0b4b zl2nk2`5UzH7js5s9IPu9Vyc{jkc+SjaS?I-2C%S^^x>mIL{|N0hFsV#UjI%U7p{w8 zZOnCTOw5Jng8y$-?4rO0Ume4D?v->=sJuwAgyL&4ht^UqO1q%XvuzBqjPkNBsIwY( zVYvRg_@;?d-bDo$e;g_xujrzZi>j)#Jya@d!>TCm?&v>E*rcid#YznqHC?oI(auFJ z7qwk9chSN{9rdj1qMnNn+L#7c#Ou2_*T%3gssS4iFKVbr(nv{T7fqBj4fJMgLtFnX zA}w9Ca?#pF8y9?W<)F6asxKhQ*E-rI%xpKy`Oi@0Sv#6b6 zAQj?ODo#^mlB-qBr=70c&&*fExVX{9P3m@?;`N&0h9Db#W~zR(;w;5{n{RP(D`%Q2 z%zSOu|I&H3i#t@AHE6B;{*eu&`CnxOhWbPM#;v zx_I8jCbe#Gv5{K|obw@@)%2nwqh4_Fe@V8eNViu4>sA-92K+TH6w2w(;&0K#n@YAR zGLUW9;o@y>F@|+9yyN0s9=S2Ji{U*N@AI&Yp=AsoxcJb;ZWo{PSab1_i;rD=LWk}C z|Ii)X;Q#B#e%-HKnwiy4m3*ei|8Uvk;tLnWG5-?|ox% zIex5zDc#Yu?r1LVXpU5j-_gEbUJr(B$7cXc#}JDT(zakrCMIyc^~lfQ`>oy7ikyEJDDAw%-&8W*~yqi@ur>4MV-y45ktusO2tq*hA~~u`ZDpmyP7Shi&w6QKiSp1*431W zp==BXx*8U4Hy(qDpsK)Q_P-3=L!8Uj|U5Y415dwowcj4QZm= zZK~Kzk#5anxV)=>-PcMLHoJ8UzZ~>8LEc82RQ6k^eGDC9m=(j#F?5WfQw&$fFfE48 zF?5MxL<}Qi$aOVcWB$?6H-gW=65k8x`=3aDEJXf%45Zr?%CA(sN|E6-O;;qD zp@hf#HA=3H;kp>E53Dnl+@N@);!TQGnh6WTH*|MziQ%>wZfEat)Q(7R-FKR1$MAFv z&%|&?3{$$9IWgQB!(B1l9m9$k9*g0g80KoWr7_$a!@L+4Yn8F{V^|o&eOg@*#Y#W=>wKP*EK%{n82(RrD29h)Sf={&7#@k?QRO{#xO-@|AR z&&BXO4{8sdhfOhT=B$q4*BD;VY%#Yx0OACX7fvEg{x7sGz825SpWs`5M<{CbXbi_=I1$6Kz{*e5^#6$`I}N8l zW4Xnjb-V9(Grz^~Z8!h*{?ogg-(&cL$9oKX;nlxf*g0uqIHlFoG5n)B|JEuU&M1j> zH+(e~)1HeV5%ZtRk9dA~GKMr4v=~zAmUpJk_iSgm1jP{Y{9`TbK|JI$uu5wlqaLh4 zXVmI?C2jS0Jh*|L_dM{E6nGfvVU&kL^(pdD!b3?9r98Cp(AGm~4`n>m@KDo3Sr5e? zDtM^qA@0F=DCeQPhex}cm%E$ay8ClxV82+M9_Gl3Sgm#ON**eEsOF)%hps(L6%V}{ z#k+KlSM~5j58s*ib*K0hk@$`t=4203%R_AsjXX5=P{%`E4-GstWZQb0dOgjhL=SiM zH1!p~tna+i(|pm>gnF6xX2+X&Xv*I6(9%OQ51-s0zqFT`vp!y@muc>ydoQ!`>auft znN7XS7rjg?53N0XK0p3fFGFnSp}mJb9{PId;Gv_3ZVd6z$wOxkUD$Z;dvDXYw;9sg zOzLg!>TRNr$1lCp|5~tzho0Oo54}Cye}8;UZ?mtriG|_~8pZ$WZOZmBZTpyh>~;@B zJPh?Pz{5ZfgFFoOa7iC?Qy;UUk9o6?Io!t-^fk@817+&ho2vhf4eX~ zrLS4g*Bq=6|FEw)-Pe@r=l5RIer8BNGpV1sz{401>peW{;X)4=c}Nd6k9!#FVd}^J zKmR^9Gd|A4cn=qIqaJ2^xWmH)4--9HTl}wH&=U@=3%;r8Ekfcb7Oxq?fLjq{rwhJsT`lb zCBD5={5lWUdzj_nW)C-bxY5H+9%gztGq&*K{^r;IrtARIV}O}5z_jcTUo^nn;^9^g zw|ThT!+X)w@C8fdovRlH=Nnd9M34~sl3=6vvQw}<&27I?VF!(0#d zdYI?ot%3fRwuc6qqCuv?Aal_mbHgArb#Z*5hx<5Q9v<-U*dYH~Mk9b(>;UNzXdsyaS+hDV?cl^)6rtA>Yb%>cZ#5_2}>=Y8F@oB|p6zREE z$vO|Oe<`eP@UW39zlY~NF5u3g8~l%dd==^@J$}hw@vvF>3yOTK{YCbn@|P4}R{T8Y zpZi{A5@zX-lt7>;@?|?tx{Uk1AI(@Jj}+awSR?x7;>d&%h1gzq-mzA+P^w{^lybXW+JQzMzw# z?q=X#2D}=48rrWl@3R>dGWg`Q2O0R2)3~mBn1O#Xkfh;}Wd9O;EJ*9$8F(VRXE2Rf zrYsuLHK$;*=G@aol2t>h29Jhp8V|jvrHDwKJWT_$Bn*;>li^x5A-eXj&L-`ttN4C! zzQrl1A*7**hUc_@ue+gvui7y=n01wS! z$gUxWhNm>-7M)^F4fM$+*{5A+`X>rLBMNyw*T0~K{K5;kCI%_wTAvkC*fkZ^z}JjE zui*s^U-h=a_0$XXoEg%ho+_r{MGeI@l+aL8LlX^6HI&j&T0?aWH8hmbP*y`F4V5*N z)9{jp@){~=m|9OASZuAVr@pSIeyXRE>#K?yg7sDT`cCARHB`}1RYNrm&FZV(_0_`q zYDax_tiF0u-`PC1#a2xXwKUYzP+voB4RtiUqM@#aLJd^C25Nc(b!DctrGa|TK$#6y z&4#LhhK3p%X=torctiDGL$$r3y4Fx-6tuE8Ql%QH&W%(v4b3%l*3d;m3k@wbwBt0> z&`LvV4Q({E)i9}%TF^-CY^1I=QV$!ce2rCw#lZw-CuAGL}%Q9U&*ENk`Bz|^^k6LU-xwX%uY*F+t+ zto|AXXc(wrkcPjSs3J{O^ZRDkrfN!4^>I^mps70DR1MWIjB}|d?4lU1VT6Vi*|9P^ zMrs(v%V(gNfzcYqXxI_JR{@OGFiyjVJ}mcPyoL!}H9G#%F_GQW;MWn*FPe!3eFPDv%`7!(`*fIX_&)B z*Gw(cut>vP4f8b2mk2XnOMP3z@}bU3Ctsl99alfKDrvEXcQvfiuv)_sUg&0OrC8t7 z@V#&3hoo!FL*$(*tV1(gdF-Gk&%yR zI4W^|bX#(aBbL`0^An<6)^J70Ne!ojoYrtg$XRY#LS{Ep*R1)#2gNaBHWSc(A#qL)YQe;nTrq7@ppre6~S)x#P}X&p(@~Ky#e^j!&tbu{m7**a>hPa}y)HYyksj0@hJq-ST7 zI%MR~@sy67I-b_?vW_Y`a_PveqlAuZs&eD~l=7Fd`dMRYx@)&B%3B=g8=IMMqsR)znc-M{VJBt|N^k zNffl(n)P(l*U?x<6A>GTXG5urZEhslM6;W^^|CA*Mr@&@rH=NT13FsiXsx52_^{<| zcd%i zs*flnOnr3}d(BI-?}C?)fF7WOuT~tWV~|YI!Ga?Nhv*opW0>%x%@xyd9mEkj_&+3P zBhx4yqjikYF;?8Dun2LSAo)ZclXRTZai06Xjww2hFo=$+I;OFO=d^=5rt6rYW3P?| zE!1l|Uf1!djNWn5E-Q9dGMcpkp>?xWu2YBgBZw}o*9SJ-_!BF zj+Ht-(y>&>2RfGN_>gODd&-P?#^W*RwH~A`XUFF`ufE+o#8c)4&k7y4&Zo5L<5{I+ zwT^KOlRwdsd_V1DmP+$x-vE*$!3T`mkn$8b)Y}*bUU+MUk zUE^FbJzwkS@?7#aT+2T>O+EN&S_v(*Q^zhY=UGX6bX1O|Gwg10&S>H6D&Moq?-(C9 zNzcDbpo@rQ<=b*yNiE(?-yH@hkh_gW~e zrMjl$I`@BW`#Sy<{U#T97CwE;^9Qev%YW1HyYSnBtd0(MbljEfJsl6E?0rF+5)O&% zLmezd{#eJ~yg**e^5Th(f4G%-@q!mgUS#nirx#Cqk?aMZA7Oc+yf|_=g+H%k^*YNT zn-?iUQUwEo9xu|oNcSQ`vR*;W3tdRtImzW88|~&K`@HbG3PVvR21N;ZVF;mOdO>HB zu&b^`upJ0B$0$vpKqLA=sy{OgFnK?`(W6wC`IWZL#WR@Rbi+S;)7o)ux z<3({VN_f%7i@sjWZmCLoolj&JTdGoCl=h;G7iGO@>P0gz%6ajU7uCI};YE2bDtNKI zrK%!fD+*Tff~m4_nqC$M5>{H(b*LsjG*PVSMIA3*VVlLXwjd+WTGxwuUNrQgkr(yF znf?v_r!3v5G!|^)MdJCoR1$h~>Rxp4qJ(uc^bVJn$*{8sW6k^r;tXz4%NNI`DK;;yCN)Uaa@x3okZ^X{#3-rR-)m@+KjP;9G>V z;5P5Sr(w4XNm#$~Vy_qb#OG@-zVYH);oosida+yhPB+3HA>RuoTFCQ$k4`4<_u_yT z7eznl#SdPb_Tr2ehrBrK#R;yd*6N5CN5$c|;E%jyLTF;whz$6XDF0B%OQJK>&t6=1eVF}4_*E~id2!wKxh>>|7r%OO(~DbP{FX2Y zF1VP?#Ij6pTulCh8;ciry|^dVKLzi5@gPxz2j~8DoQV&;c;p3(Fq??*Hz$}EO?+tT z!#~{oeJJF^vp!_;A=&3lo|w;heo$5)d_MSn$R=Wn52-@;51Bq>7yqYy$R#9);8Q;26v76uRBquUd4)XVLmnY)Ay1Y--*M*ft_B1~g_nC!z8(Z}&yARi|9Fj2C!P7<=OwIbj9a>i62 zrup!OYn|@HYc8MR!@ByO((k0cE($q|%oIM$hc|^(U#e03rL~$P*>?r!3eNLkzL2+l zc*lo@J}i)Ixx7x1MZy;gE?xO=%O}m!mWV=!_k4IiVHM2U#%VDB59!`U&2FQjX z=M)t;zDp~i>}sPnioy%J$%oB8RBC2z@nNeE+eH7`hi`n??!%WpY}u8(gKgO5{O`vb z8NL#Q{97NsbNNnAMVIfE2=v_JbM8u@=l4GBb*;nKnBVM5KH$SaAL4#w`tgGghkUr^ z!*w4HbF<Dj{ESF@Do0q6w>Zzr){T%pO)Is zxV_`6g3kGHUQ8E!_*wLelD#CH4lH}w^}pi7FaM)wwpGpAsvAE1$}QKAY<}DnD;LY; zw(6D-zj1N-FgBOxt`GOvN8P;5UgY-t;lmvtiaqO@U0$2m!E>KWpqeMi?<}PUygHJ7 z=)+$=Joe!cujAH~;jbhy{q4gO?)>5~^_3*1gz5F9Bu2<05t98_#`D2`CngCo#qazp zJ9MkLr>#o$I}fz<_>tyEy7+tj@cEG;T=PR0GVWUH%k?~skEi(k2>9_0A3gNQ2>Q{Y zs3+uy;m7)#9=-tA^uzKa?1$|KpA&axUJ{Yc)z797BYs5vh>60k&Cl(jNV2M}8rdK{ zyB|6HXy`{HKc4a#)UVjKSO5N}1D&udI)+dA8L1wShKQOS?WerM}us^iDYepHccRX=JA zspdy@KWYfC=|?R;S|3d=_s}FJN;Ny0oZzqcQP+=ptn{H-U;JqzZy-G3)7XzDeza#h z{bfyV;(K;=^(ux$WiiT>F7r% zKRWx-#gE>icNP4thqF4Ey7|%Fj~*iS6zt_k!kWN7BK8&RC)nSQ0VF7@wXr2{21@Yem@TQdAclVf>boe zkBNRv@?)}O-w>Q4I8|_(AJaL_+Btg>afTnSN%nO?Dtu|+O!1s0_@>}&!M6kxFV36m z$CXyrJU{09@wOie{8;11Cw{ymKJWXnRLDX<7WuK*k9Q@@O5YQ*gbP91K&KUz)tu^ntP|5F!OsOZ2(I_z z3qRO~MAZzkkt5blQQ7Rr7V+6CxJ@w8)a}CQ_LU!B`|-VGzwzT+KXwcMPH?9myWAGC zorzM!Jz`~Dk4I!-kiCBF6D84?gWUZ6xb4RuoSzk)cV->(Ux6(DMY47C_Zr$>{<30|*3=5r7sz3k{Qp3Q?mzv@c>h(EQ*;vQL{`d_D}dYqJR_z&0Td9DS1_MoenEQv zUeP&7P%wZ4uc|^KJ}byq zWdM8=D~mL9%Qg?7MSy2`oF5R02|`b1+wyt^@MZwBCEGrLPdcdaiGl%i2%uvCodW1A z%D@1+2Rj^wC-2>$sH6E#XgcvAQjfg)KA3zf&*NKK|%%xFeHGX z0Sx2b9>6;t)Ns*91~4js5yB}Z;xJ1-+7-tJFiw0ZGR=LMG$DYA(xXWM=g;wL!Y2z( z5u6&pG$GRk+4mVj__YlEUk~67DM&t(!~R3^tbp^?2fr&gdLj9(06q_3eE@R;m>a;n z0Okjm29lWOFHPOVPAyH{EVxB*tKc@l?SfzO5Al4BZeIuR4d-wO z`9t_NfbRlW9>j_ub_TGEdsGm$gV-Iwo&bsl@q7^9vkd{958y%o`#5!vnFj(mC}h9j zd8GXygxxvHE1T*$BzRcxNB}>6@1gi(0LKD2E?FvPg#09UB7ldwvuAUGTQxAA)xTOZ?`ePjW}+=dk;X5Wt@SJPg1NA`---0RG}e9YlH% zj|2FdyLu44pQJwt;Oe0aCO(V#p8yJWRGbn?L1YOcIfz;vRhN#=0vXd$B~0Ymg3e-3 z5lj{I1hH7$GJ*(P^jJZtAhaO#AiP1md)^ZY!U)0_gg=NK9aSKRpcG`B(w}&_Wz8v_ zX1dDBqn_&$?cN_L=T~|{om7|sqs}fA4I(CPg@T9&kr_m;AaVzhUBssZa|m(}=+Bfh zh^Iwq-Ra+z{!9@0g2*poo*?oDk#J@~rsF4*3W%woTZ&in*&qr__U8M}f+`ZkbCM+= z*h#$*M6n>s2T?)97lYt?5{m~hqmy%YPl=#28|hh6tfd4?3ziWqD_BnOr6ATwI~k#( z6s#FUB{5ZRZB-6}_;L_cgj5xzQY}G(sNpIPYB(PymOgLQ3F4I?UJK&&AnFEDFNiTg zj18iG5DkK8AyqVVTiAQ9w^7hp8cdCaGzp@qkY=vloP9r&M2D7As#OrJgJ=^(+aS6J z(IbeXom9IZI!T+`3$i7z2GPOg9fjPGZgv*lC5W!BwVRNvoq4njy;!LP>>WfOAwz=b z8$>_x85Bf+x70u(0|X0pR!uwqd#wk%I$Jd~h+z_BxQHvnXQU`>;iw=+i_XJ`iSvi! zf|we_G!e%Ko&8~g;6%Ymf|CWO1hKiZI?~y>+|zm8r3eS#={Wz@OwD*Bh?zmm4&p5t zv{^yC>H4q;6NA%pP7rg0m>0wiY1{lD-VS1E5CfYA7l=Q776tK+@P&eQ7ghVQvqdlF zLK9_);Cq~tkDZTH@4Ms!(Wxv8;zQvTyQoH8)XE?}3gU7QSAtj-#Offv<2D<_$DE2m zY+~1f_(c3S3V!OwSsTP>L97enb65Eyi1os|boqDuH~deQThkWl{`Mfg3}UO8wz*{| zcX38zc!a{m&b>JRx>z~xuFsK>(p7JMT3 zk6=>B*{_(ggutpv*#4{`WQ3rFoSi>g2r1%|D(DeR6HFImkw;RH8z2dTu#_)^SP1bD z{2>HF2)dqj2%!*+5KLE5LaY#SS{93kUA=5q6$v34a#kYuVQ$nUnPPn=gghZ+7oJ1# zDZ!kAY|qmnCQN|fh9 zC@O7W@#lrG883$LLWnPeOIxW2i-malB1o~gC?y0t`cq4WKupwIT0)fxp{$T{A-ohq zdEr$AD+toLqL4}eX0qm9zu-}Y6>^T`kCm%!LP&Kh0sB+<|`r8 z4WXX!`XMwAp+yK2yQ&5uG?YPTB-mJR4o4}3rox-K3Wtj^TZWuJnuofoU#_IL3W3;K zu#I5b5ZVc$-d@O-uBu}QokG|W!qyNvhtMU2_d<9-gsvfU3t?Ue^F!z!LJwZ4Zq7yN z8A7iR`i9Uigx*qnA3>V36-}hcF<786mtD!oUy)aV~XJ(?S>=!VvZ=gh?R` z4PjUa<5<_;jNu`S2;tYO-Z3GJ3}KXrqXkRT69ji1NSQ2z zrl}!J5#I2gC*jEkkW81Bkh~tk8{$AuW@m;lN64%Y-W2l2(UjRj-g2{vICDeTc+81; zv7hg4URj^B=P)e@;T;)=h3;r93Sn^w?@D%wAjc;$N=rldAcR#RtmYthQ+(9?=x%CR z2p@{ua={gXD+NCi+_1X=9;a><+{7lHY5Iz^O zUhqISMHABo_Cl0Rf|~{NeC?%aTL{}j$Z8;)fiFYY5yFKKE{5!!$wJT~L& zt}cb}`%Bi(AzTjO3YS9&Sqx_*y~@o$ghvwXIye6i9ti(6gqtDWBZE7Vy%oZ5j1aA&@EN%Jt20Y83}{kHH{dle zSEB6`Ec8=~-vBXSAZQ>YZiXPsUOJOv8u)Ez7E2WLP_}^!$5NQG8;FP)6^seS1v3RF zop%1(<}mP-ft&`0TuI4iAisg94dgO#F-OJ;EqQ!WYHkD17|=Thvpn(VVMltXyaveY z#ykZK>^qY3tbxJ?3bK&~ifX9?52Tb@nsoY7dYK-o2o(d*8z6s9kTw2s$usS#v_?G? zk7>ptymC5j2XRgn^O%rr2|z$*DMef+29n_``9 z;4L9@49pWUSCB>K+0IIzZ{TgNqtmGiM1LSNVUdBwl09PJT?0!Dd}H8SP5=@8y`0(d zzJa9%J}|J%z^4Y*8u-w_a&h>?zzQL&jDH`|w$i{yqVNa@%dX}XF`OsNtP!L_PGsVZ ztDjM1s6f&tDe}32ja*_iQ`Z~Lb8ncwFtEYpJYvDbr_*dUu*JYuDYBj0zJYDR6Onfq z_)21aEuknTo}a^3F*4tGfA*%+u*^W^(je-+X@a#96J2>4#Z>Ja9E?b9T)sb@PvVrhVzn_Q-UO?4V)2v)>Y04 zIWNfH{w^8#*}z{09vf)E_rDvsV&E6U`DTDMmTc#Fsh489YT%lI>jrKZ_*LrS!;x-E zujzJIlv~^tx$*J{je*;YFCwjX4Ci@$Bpf0he7a}gzJUj>^`VeI*`sU89Dlk!aB0O=Pp9)M6vkGPt96Md(o=ktH7QIxui3}6ZSjb~R zGohPkVWOo8uL+-tnkH(Q@S6xo*pjC6)D9L5n&1uiArl5`FkzX|Uk!d2kiE^{D@E9}G(jG}UO*}1iJtIE3 zgy%MqwRsl1yEBbRhbi5Eyrlq{6`B3s*A%`238u25>TLaD_~ko;39weS^B%R9D7CSrcEH=_R`-movd%v|ln&o}p@ZDsWg#R57utgr_3g&jB~_&W|4c6wbs) zTk|KCswS$Ns9~a->HNZyr-<_fLg(IUjHI#SytPf#G11IKa}%#fjSV=wM>5iFqbEn&@O=oQd%!I-BTXVxWmZCc2vFW}>g@ya=hgU@t*t zdzk3y@{cCzy@mI2m2YE7{aoJP!~mB+8lVRcf86HH7oG1bIGu}%`CKH21rNLfgxnV4?kbrWxh zspBH24Kswl#y|R(oFGgyMVW14mK)(sT6a0lZ;3KTaEG*WzKOR@tTpkOi3KLk^ihjV zyvvy&e4*eXL0)=Vmza3Z#KAV!Y7_6v6<@}SD`csO4f_AM zRh)IAe#C7g4CXy`NF!8I2 z2PXdHo_x%_Y2vPldnRs~_|3%c+y_Q@viA1;!4*Btb6c=+Uv)=fQaLzS`#7F_-vqJZ zk#u7B6~Xz_JP)}rD|r7l@yNtq;yh@8XFxptv5DnvlbL9JB0lV377NK1l!dSbSjcLD z&Rz@IETmXSvvA;YTB?Ow#ggv~N%mNL;6T#FD$b5dOt+9>VT{Zi&4O-Wk#JfYjZgJi z@LNdF?+sW8SuiXFEtKh$Hl=y$^p`Z#!p^?RvcN18ITML(Az~rU!5Nt)YT;q_^g#Qx z!XN4}3q>{={9X9YyrfJE6Sw%XTR7WSRi3Ip?yH`%oVk=!kmPA0#i}LQ{hV1{w4WNZ z%gk#bpM|Ctnpwzip@4D5nFu<(tvu%d-Z z7AjkK*}^MQyoz8=!K#AQ1gG><)h*O;IU8I{cx_jy<67&AQqMwtAq^}v7Q!M8g)|cU zPzI`rt2DRJf}>$!u!WWuT3P68p`V2dOZ69fYrR)$tu3^%(AGjbrgqNz?7CWLFZ@+k z>0qIwg-(*~Y@v&g+r2b8U+Jfa-9+gw*uz3kA-yd07Q!O*=_B};`1hCQnf+CZ{%U~b zoKzer$fw+p53w-R!g)5*!Y~WNEo|SU9kDRN!bl5yrR*pRqb)44@E+%_g|QZRti7@+uBbs-lQr|tpIp#kc2QU8m(J-&hJZq?ui z`#sC*2Hv-@)WRAIpKw-FwD6&Y<-(Ts#ms2D$Oka}v6 z+Qcy*q_(g}gVbgVtp}-Gm4jO?Y_qVC)Sz9Fi@5T{AMTDU0+vlM^hTs?x+fx3QsKjW5L7c zdMc;=ZHA~Mg+W797Re?HQinoT;n@V=+7L`pNOd_K(iKJxQ2~XZLWbg@N=*~g1-*hk zLBHUvA!@@A6;kL?&5B4IL%1nO(Na*t!-BS}|2RZN6=DkSmeca`xC@_3T3*ktkVD}q zh1(6X@O;<6>t+E%Cu&0#KWOAq$gNOap@zaU3V9SNDO8q9^D2}Ul20MOLIDoW{nY0K z3kntzd{&UA!U{!%@9L4kY*FFQE4(12m_iBHlaER*F1-0rMbDDLOSx7SFC+Ex>3Zx! zIl-3%%L`Jhpiog^z))u<5MOq6-iX8(m+-;mgYQ;#cG|uQ{S-b|Sg+8ZAp!W#+$Id9njh1aCn&;7u?1V0W{LllOJ zGE8B#!WiMh6-EddDL6{d8S}MS#tNUPFiByY@bQ8Z1QWkIOcqZ6=?YU6rYa=9a-a4; zJ_%*hBkS}AGuI*KYn;=olV&O`Pv z#B^NYCxsKj`IMpb0?wTdrzJaSn6og?D4dn-IfZKq*M*-~xS()R_$7raLVgy!tiUu_ z%Ch(`3RguZPlz`p`9bf9FOg5jW)0(s@P7o8!pIUvviR_}R=$^g_AuvDGm)j3vWba$ zYS?*eI~9*$ns}zWq8^4f3_FZS7``z4VXR-~;g4B?FsiTc1j7i0vEY)gLf$kZjD_F% zd6GeevHVGjDbXxJX1^;F42MCyJt+8AAT=6BER1*<#D%k#yq-!<1B~dRB#&cm54WnQf zg~E6?jKbnpB#hn3Y4oH|p7N>NhpCPCQl1avg)oYR@nRTXz3LQa`f->lE>)BW<3aI^ z5)V@B`;I>EVG57Ug!kxW!YCWYI2+?_lndh}j!YO|gi$_>3SrC*V_p~)!>ANS)v)tD zSmiJ>hpU&vXf<4Y+tph3dqx#$(&*vN6{*JY45LOEch01B3!{4&HN&VCM(r@_gwZ^V z7Gb<1{*A(D97f$R>PfbK7!8Fq5ZoZq7?4>$C7?+dO~Ysw#;JUvB{PhjGmM^t(|;J@ zxiQLU$(DrCo~6QQ9Y&il+J@0C%QA`7gRUjn6I^Khse6|NYgnLl~XH=p07J zFsgXdbG(pD%s0!qufL1b-ZhMm*BMMydW6w4jPYSi2%}dRy~7wGJ~Z_Sqkk9!B-=NP zey*N)B5TDX=(vRt10Im0dWMi{S!@w(KWXa*~t8OE$I-sEE8 z9Ckg~l0$u>!QFkHPK z#!}A1;pzh^PO?n0tZ2C?D+E^xeiX*4u=96hbr_$DLjG|WYr^=1i?qhS-~aRfuC-x& z7REa9VW`iA&>`_J*@iGShVg3{H^bNz#^x|~hOtY0wuDh;g!5h}mf9M|wlKDHdXI3f z$d{~Ie7*|fTQ~C8LcS5C+jl}(ivBOBW^g&|4r5Ok--od`jEh`H{jGgr>=%dAVH^;0 zG>jj^I2gtcoE4%plNt|)afDk(LG7zc&bCiH7RGVTdGYy4@TA}g!TwSzai91H!q13) zR`8q@JRb&4jBr6j@=Ls+VO*BB{UUfpkWF2D(6}o6n&5R;zri{4VFn#;h4C9VWE;sg zG7AT{jZnXHz4!Iq4&x6teuTOscwg|Y;5|Wh=K((ggz+$pN8J6m$#ee~(_?8E9ax;s zBuoj@KjM&NJCSLE4c>vS+n6~!BdhIrX0wqZB-Mr{#3Ps{m@b$hczuKl9&rv~uFMhi z+VI)%+X&dGWuvx@ppB4?!ZwQ7Fl?AMa@ojj!?K}l#MxOJVH@cq6;s59Eu7JqjoOI0 zS^hpqCA*CrHgekN+c68XPuZXkiww=AW zcNV2f!n(y7gswKaNne_cR7|{ZJ#F-|F@zV zARB{i>^+%8Xa1=rl9LdJ*%)qPv=kX(J7-)++Sqf_+0cli+?FuT7#m|Hh|^kW+XNdE zZLF}d(#9kklWk15F@sa?M)DLJQ*BJ6GE(th+{M?tpO17ta-JWlUbFGKjl~j~${U>3 zqg10&YNm}@Hr{k=oNr^c@V5l#2+kFpCwMn8Zd+2`mh1w-cLWy-E)t~MyF%FJB|_e_ z@xG9yuKt0IWx_wSvE0Vt^Uk8Ux6k<=<0BiZY}~i;z{YADAKN%!sMCUHY?K_MT8>fYY@D~TZj8FXP4dr_ zXddU}5kqDv@SP>{u!V%Dc zZv4^HmY84F@WdjBM=+sKmdpqkjg7h0Go5wO^i@$$4rvLy^OTUB5j-sVK>6&J6WbZpEeEa(8x+iG+!bOz7nz zU^XyTCG-m7|4r*8X3M1|rT?8$Ye|64l^J=g;)n4xEH z1T~_l8AbC5T10Rnf|DE*4toTj^5RC&I)XM4d=$Z|2--%_E`k*itc;*NBXd~fdG#G4 z(CT^mM$j*Uj>0<$c4n`IbQSCsLAMCH3-1v@Pa!P$+E_*0CfHlVK7tp=s{RoSh~V`I z-iTme1cM@&7{R0n21hU?f-w<{l@1P#U_=BXBN!&x;Ss)XF%%f*tmRRnkdJmvv{D}@ zI6;uv@vfDe4wEH2HG*joOcDOyQ}?G!_O%FR{7(^6f`t*h8NqCEm@oL2 z;9S8u5hU6$PqK*`iEl@+KonXN4vQjK62W^BEEfIU|M7o6f~66BD9Q(dY!XW?6aHWK zmviNgQ#2Kn(OB}9vt_N0@T3;jMDR%jRmZ7rVwxn#^8?F;(CxDbc1N%$f^}}apGUAh zf-fT25Wz;S#|XZTU{eH}BiJTBTLibd{yWC0Qxa{vC|?TxK2Gh3fXFJCF3xiP5BWw+ z-wJ*wxHE!XLT2}I9GJe3U~dHbBFGr8ijPHz2Mcy&`x8fgyxKKhor>Ue1lgiUiQ-HIXCrtN!C&m`8t=IX z&PQ;8^RT(~7S!GG>Y_C7as-!z{45xm;PmT?@LwXh8o{*)u5*0aTMr_*!4)0B9}(P% z;HLOc|6Rzf2!0d7;uM)~i$ZeO)$d81#Aw_Xkwxh6X9N!=oA7)b!Qb5ZBlt(eJhh#R zUVeh&vs-&jP?IO9q$sjPLBfM1Lj;ha@20WnBjOT))$Qi}cQ3NJBqh04`=gdQ{C~`;fOcZ&dcqxkVQRIyxUlb*z zo%scyjiPWA1%wwAEF{R{zirP_M0hd5=b|VY#q+{n5WKbB`7weiL0%NGxL_e^MoHnN zq9`3jnJCIiww&PqmaQO46~T&vj9E!YWxwMi(+sTL!zi3MT02#mFA!*>P%D(qu4f4<(#A%MbS8lCQ&qvqFWT* zqiE(v?#RCaQM8DnWfZL_irzYk2@_S@DB4BQMmQTrg~%+iy(^M;5Kg^Q6rIJ|B?>yw z)K!ZA7omrU{lvd#6uqM89Yr4z>D*VGNthDF`-^FS;6T?}Zjy5lacC67qWC0=Poo$f z#fYf$@}M`O`2CJPGKwitgtwaHqeK}U#h56@ve%Q;xF{w@F)51iVxrFk(I-z*lU-%) zBt=h}rb?V?g3|?O2)-7@>*CB>$cZzfm=(pFQOu5FeiUy<@m3Ufmj{{VMV)gRbE23l zguP>yddKSN3!-=@ie*uJ7{x;AW~n;*k|-7lU(5y4J?Y)3^BB*$9Wr<*?!749k7B7< z8Rvs2n0}h%To)o^-kPMAbG1fsvtH^-aa$e5M^UVbV)~*aioZUeOhV_6qgW#jiQ;SB zm_J1ESrqG{_*|5oQS6FheH33ru_20$B7POcCLvp**c!!V;i;3IW^9XMyJU9=e#x~d z&()-ff1WBA$-?xtn7)bPTOr>?u`ew>w-iqV*)95B!97uYFN6^i743^+zbFR;4+^p% zgV5(t6o;cYB4Pq7PgcjGI37j87z)MkQxqpSurcr_MLuBmq%6j!47C5o$DT=G33f2?FPi2r48 zMDeTCax?1ulu2vC#5=W}Up6Uns)z$ke?)Od_Fq<3$V(`R}7IT(oR>4%kY%!z=p=Y8-lJpodV(`Zhh(QypS5OyB zw9qGKhFme^jv;#t zIYfC%@M*!Eyp*yX6?aGAnHchki81rUkk@r%HovPEh=B#EJR3vd7;45)OQu1Q7+#2> zn3$duEGqbX3|pj;FUC+jhDtHatmH2trgDNM1xpE*7AzA(*%&T#aK3^_AjwN&Dj!1y zAyg{Ha8Z0JOU#!AtHe-M$hpa?nvm*lwgzY8WX0NRbMxm&KDJ6tQLn`C&o1X4jTSM~ zjiDZgcZ#YXL*p2l#PGrGv<5LWjG62nlJ4-+zTigRZZ8}{xLH8O@PZ)S{&VYHAjG3@?6d8}~i-+iAv zA%=-Dd=$f~7$(IqIfg%`I1_S83{zuR5W_n$Op9T<^mk4SGh%ox=A4|T&+9Sgko;R> zdV?K|VV3YWd0A^ZgG{&C!g=bR3i$Rw(dUZWycp&Sq37G2E!Ui{sTaD+`!OsMzF6>G z!2?s&k{I5LfrN?vOiRV|K@7`c_)z%r7*@uxLU;lb{w%mU2L4aDh24DK_i+qsctxhF zPhwav=*y zh~cXkPRDR2hOcAzCWeDC{1C&pF?<)p_c831*6tMC9m6gm<)=D*+#{TX*?lqWXZKwz zO$pBg9^y2P;W)SV7>>knG=?8zIOh8N7l+P?#DFI_|6@4i`cS7^BJ5c%w-_#Sw#0DW zZNnvADPB`I!hbP;b|bKzzr=7&{I9yD81}kw5<1+B;Z}?vVQ^ovzwvSi`CX6>w}sI8 zj;q{tl?Oupj^RlRf5z}IhDR~{6~klK;lDv+ai)LV2wCDz)k%VEc5)nugU;lMloCg3 z9M8s4SbRKj#N)_}BTcgDab(1y#i2`933}rQ3h@atzF$Znjy6-(xTz}S>V^+1PjJdNJzUACLM~z@mw4w<0uu!mZ_>Jv-$kHq><0Z@q)C94Ja1Ji!LuN zq=ewbuak~XRX3-qeA86zD`wd^%Egg26WKEH5(hbsPTUyds1QfRI2y&#IF3qjRF0z> zyB5dGap$o!RpO``2X7s!F-@&&l-_=tnlR0Il245|YR1tZj)rXTG^OY9)RIbT$8o5W zr%oKN#8EendU4c`<5aHY`V?)qHrIJ&daI0nYiLk6~A9R1_y8Aq}Fo`0sPUU3k63-%H0E69@xd}lWw)w?aL;@9tk z;usvqkT`})GxAS&I<@1lxo4t}SY^8EGhK~{V`LmV;`l0#QE`lpV^$n*ihrpK<`^Mk z;~2+r7S0G$;+P+%$6@pWg?#%$Fw-sO;`J;tLv4Mr^hiPj@LvfF*c3q z^*G*$V`dzWq)BvR*!R0yv*TD8$D%milE`!7&Px#H3ZECp{5al@BQ!%T5QRm^-w{s2 z?BY1yjboE2O9WTO@e${M@b}|b8pj91mkTb7;jy0~5_?qie$*vV-!F6$b9>;pgZg4%nkct?DX`_hz*>tmzErMGGw+U_+tW+iG z%Q$MKrt(*YujBY8j>mEQEv9edxH3bXh~v9Bc8anqj{R{Q5WZV*PaNNKvdvI?In*=M zzBoRv>RBZ{Wg8BP&(S#c&QL#aQAqZ%;1NOk&_w((j$^KJJdU4)Crl@~cH%f4#~Cih zIBv&r*7dv+$GJGp$8jN!i*fuc`X#~3aXgu!m?#oi1rzx%aa@h#S{&Eoxar2ZA>>y# zLc;TwYyC|KgZv@nf#4m%yMp)PxG!ZHKhXw8_%n`&oOp30ic|T^wQ{jPk%H}Vdj1hY zYf>h%WIFR9SrD06^lg^$D?D7nDVa#k#I8*2&V(luX_;7=iH|aoo{5Z1V|p-a}A3124sndrJ8%@QODWFja$hzL(OM1_A@B1>H2 zo3&FjS+;g+cEKEiPYLGC#M46lkFEEBlA;K^hL^p%JIgNY5_TH_XL@oDASe=4a*!Y> zf&zlRC@7$SieSJ1B01-rbIv)K$Wa7EP>`e`ilV51@ZY}UyvO%D|2cK;xzBw~uEb_DDgYR51;f~ru{j#_qv>8vhY~6V_IT)Fp?0DIZSHwHp(M2uyMJtT0s~z3s zqE0i3uiEjN9k1Kb!;W|C=xxUvcJx%hTf$y;^c!NlDV{7vleuq8XPtNLc+Zaa?f5_< zb+%-WNuKQJLpugY?%EqW1}6L?AUC_C(^eh@h)S#9b3h> z>GEU>FVY=SJ{HoX_-QJJ{Q3~1#84wX)H<%+cI>g^mL31tvDc1$c6?{YX*>4Yalnpa zcI(4=h8?t{(z#4Ni|r5(t+eg1@Q9G+7hE$Xa*o>Zr5)41Pa`KX@wgogh8kZ9zZRYl zej_|7JSF^A*lnnBhDTw?4Lfey!O6M0CjYD*C+=jQvt#^FE3**nx&uEwli?6_*jA9h@~<5xR=v*Vf_zuUn8zB~G5s1X=ubQorFw%_~H14}B=)KuHJAX4=vn zfCG0qaJK__4(myFOwVw@=0KLidV$Dvpy_afdSQ999mtVF7aQ;USHyv$a^(u&)*r>x zi#br-ff5cR6REHWOXWLI;DDjxeg^^$lycx62TD6o#sRkj9uBO6QPu&6V%W>QB6cBN zrUOm~T>n>0j)$T*rTbDbK`9J~IuH^M3nM9=SuqFVG7}Dzci=wpa;XZ;t>8d%01U1u zZ>5R_l^l4`f$QzZ5(Lt!1E3~<3L+g zXy?GQ4m{@oJ7te-OtFZvNM3NDgOpCfjt;z(ihNPT>Nlly7GbGZ9O&x6M-KFNpqm5T z`SeBydOPr{1Ft#I(}7+Nyv}ht@CH*fNM>0F<@rD|{MaQ^l3X}s$0T?gKC zpq~QXci;mD`Z&;6bvWk#otzI9Ky!j-AbE@f92n@pNC!qaFvx+y4h&Zq6Nfl3lqX$1 za^8}ql3C;5NNz$6DIJ21t8sSeC^V3q^Z z9GLFFez)yv?KI*~!WsWjW{b~rV2%TG9bnkIKNLyEm#c22EM#|_y)b%)vDkqn4t(mx zXI?CIV3`9uo!I5XatBs8P}M{=6Dw1rJ>DC zlj%EoASbO4#CA!fcaH;mxiD%L*iNP2IhnqXM=kS!0|%AP`fQ9p?7$HRzHs2E1E(DL zmZchIe#!X#RzdP(4rKT;k2~;{Twe=M2)_}Y6fTb!VeoejoaQxdqKXL~<{6FWvcr0z z|DOAm%yYu?4qOmvKf<^u@`D3Eij1mI{GQH4&3DaX~JXTmIMEAhc}UL;x@N^Zo($A zO{AG9Wa4fU88qvsrJI0>yG;Bt!pIqEotLd|WDj^Rr`$**(}c}LmT4{N{#9(%M;h%P zwly7TbQ@`$?U|EfqKJuNCJOpx6*ZA-B2SSF9>3>Chjp&+O)oS+_6sD*O}HE>_(%EGA7EJ*w);7F)H_39?@aK zG~qIFWI@jC&gq>-87=!~J53B7WqoyoJx&~Dcun|Bls9po3BQSeiHM1)i5~}M2Tg=b zgiWkfA}8&L$dM8`F%xkU2@~Z^4C5nR%jB0di&p1n;JKOXB7L+myj+nACMue!Wa8m? zPSIy`?lwRn+KD`CqSHVtcq1e0*$#|0+M9UZ z#0xy#CN2)h>0+Xz$V;<9>Yc(y>!%LpUi&8#GB$A&s!$mHmxsrv2l>S#ov{eIu$0q zuk;U0^bzT6;zN;sCO$IJUp)D{rvWAgniynS-<)S+lb>^}en%U`p@$%*)-cB! zv&I;^#u(p^u~zRvWgXJ>LX+MGV~wt3jW47h6+SKGS!2L4@#7}G;t`!rqbnKnjfs;c z&YC!9;uKfD$-9bK*WhC)yJD3wuCw@2a+z%P0oVdq{KTKRV@u!KuxOF>mw-bLWk;VTp zaYOv3@RqPxTkG}iwuw93|DD##XG?dYka*GyCzg%1riFNTtdZdaF;|!=v^kOGL}Br4 zVG$>CMDoTN(Q#H*QJF7`=Q&Z#iQ-O_kXRsOOi7V^CuS;)iXr9DIO}!|$Ij%GcA|_E zWi>XB@Lr)^=n!(8rV~ylTr%BG%(#?Jq`r4Wrq_ubpXT_SNE>gk`9%Uw1f2+phZT_Y zGLp|DW+Gcm72?8#u$&X+Md-axq=NI`XW2jCL?tJda^9SH(22@UJmExhC#oo{mJ_u_ zstT()@sJ4XJS_5v6V+2n4Uw9{(&LRfPU{WT<4&|4Z`5_7o)h)i#dw3QiAVz{9!)6? zooFQ9IHm9jP>g&`W>Y7ci8N7q@9~DKbJmkiv~Xgax{FWGZ0SThC!Td;(s<)3;nTua z!q&nz!e@kSmB`@dNSx>|v%M3~JJDPG1z}fV2PZl@@uGMaCth~qB_}#L(OKxtv%Z(k zmLwF(UlB5L(L&QfoG17^lP7HHm zxD&_58?`2;o{*1{GDbLB@f7J|%vdM*6lR*^otWUnL@v$=#$?4z5@#5dDNamv zVww}votQ6g$q7~kwi&#RoS5arZ0U2Hm@Cqvm^G8cc}|p5FmZts3!PY`0D6}=u~-+o$p-&Ci`^Kf#zk!PxD@9$r~)RCQyo6Z@Pf<-$EK z?04dT6IY!0*@=Tr9CG4YPAT^jCyuDjDJQ;g;!_Rgn3SVVd?~^k#Uy(?F7qql*TNIR zZ-gg>{PD}CKMVLF*l8Be#u+ER=Si7qyP(Saz4uus&N*>j!7O`G+YeHH z6kc-Taw_sC=fC$C{l$r^PTY3ljuXE+@%q{HTTcArL|~%vn-kX*|9dLy4=1iW@uw4i zN%=daXO^%X~q^JvQljO~Fp_mKBT__=ui6s?7Z@yv}NwGj^q+F$4DC5Fc zE`04mSr_hg;WZatcfsz0!-b|UG;_gJFmuB$I9+hL;C5ltM1#%if=8TQnna%qewTHc z$OB3Y3PZxYxwh4HY!MftF2r1jyO409steUzDCa_X7sk}FJ?O&miN<{{RCM8f@e0Cm zONu<;LhmI-NGeGoPnwlgyo!)tq~YC-9&+Jf7wWoDPvRrOnl4m#@j0jYHG~`?c`X-e z%eyI@UPmNmD|~gLQD6K~7aF?IK>VMv*6MBKLSq-2xbT<@R6I=!v)vFOvN7gy7oOnh zm}ETbLUZNvrfU3;>XR3 znPjlN>%x2D@28XxL{5I4**B$pDALb`k5URNFn6E}!(15d!XW8`g+qixg~_lHE{t>` zsU(rPqg)uRn64@{PGg=X950+8oG6^+!ekdtJF};_(07tCRh)#46Ea;fGlVmRvs{?% z!W{9rLgq4(jby$H3tU*p8Ix<33yVco2$#69)P-dn^CV-r6lRgLk*t(LZ?f8Iku@%? z6nnK-Pb2BeENTtoi2PKWtR)P zMfSLGKxD5AOx(wp0A9R*q_c5&R1Uguh*#_U%)>4mQ6xFNbdemD!pJXOI3|8vm>k0i z7rt>J=tjtmlP;W+E5mIa__yLWCmG-IM7Xegl5xg`UtRdkh3{QBEAO63#yJZ2)%Cj-0+Lj75KlE z!)`>}C?_xWS+CAfxApDcn3T9MA*?akn$q&(_qkEQjf&zF?|0*wi`F+|A8@0R8_9=> zJm^McH=YVvN4Ga@E7>Zoni~(fQQd7|M zc+HJ>*`^q;3rXH|qlfq#!k)rjDK7``miXJkcZ3vsYivw^&yDvbe&EIckv?wp75Py3 zk+7fe+!TW;{gu1m(H!!DZVZx(1!)d-V;HXp4~lp&+>H@#tZ`#4SA`q#smA5024{m| zqudzn#uzuox-rg;>2A!>QIB_Hvd9D>cZrE^OmZW+T_iV(DQ--amvb`BjTTd_l{wRm zS#B)k%)2o=<(=oooD`ocvU#d8Uu1!h1)09sjU{fZaAT#!rQ9DxSaz96|6A5=I@lL+ zl^d&5UMfkEbxKV$*156XjSX&WWS?8Yx{Y;j|&8(+I|!i{ZiZ08Q( z#vwO$xbd+YyWQC1#wT2OZhY>>PId9wfAIck2HP$-*r=0pFnitD=jQ)Ga6o!eWB^@6 znv6W`#u2VwH;yUs3q>9kPlhq(xKh6QPj|^8-*EGHB$O7??pF$kp7b!Kk{sfU;fV+I1)AnUy&<$q*vYe)s27Lxb4PoZd{Y= zhVXYcuDkK48-K`5_QeW+x$(D@N-b^XCG*pUrq!jX46O|@p*W_&J9^gL;&*R-5 zWO%F-nkgi)d64BnVVT(;uu*)jbPlno2e}@U^57m1y6!KanCG!JfnpwT<+By{phSw7 z^dMinKxm|NuE_z@3}%&9ZW&=&5AOBA?t#OD3LaGS!1TcBLD++c2JG^{>w(V$w+9|6 z$qR?*_aNXw(1Vc2x|&#-7Ze+LGKL2p^&sX!ISJXq?%G7px^+~~mykqyF?9<1W(5??1=*-Q>Y$54I?b0oz2j>SCw4U1qY#CtO0Mb52e-ZcR5n_24rPKKEd!2Uk4! z*@Imk?DpV<2j6(G$Ai5de8D0f?DJsBbmO20hdkIXen80L)DMf3P&|_2bdi7Q!BmsYBo}lHFh8Ht|*^2>b z1wDmbym(pU72&JGu3mH#=`Lh&qnXBQ;;(zr!;3dk`p%gKy#s~4ym-@#x4d{;-rmA@ zgiK)=+g-Da_Zj1~edI-dFFp{b*~g2%DgL1s{ZhR8ENiPA;KfichDjVK93&hp9O6YX zY`Dx(TDl{|M|wdot1)1-6jmFP${O!Q$<2kPdoe>P6SzX;nk1YooFbemoF?R(2Ns#> z#Vls!X7ay9v%Q$(#d0rJcrlk#*FAT!7lR(mn#Va`nmeDDSWe~wuA+0cg=_|!Id9m4xRbH(2VvQGTz1S!{nY&JWy%!s}b(Al3^rZFG6ynfI z)@P4jW@nbWn6br+tqR-b#R8jc2M=MEv0Vy(FF@sE>7NLh__-H5y%-X-bO7stK$O8PfK4)|*>iS}tHxWc6{jOMpY$;}+(&HPE^J1%}=Q%63dY@5Kcv7oV{)>!SD>XU>dS#*gBcgqOWwW57?HY*)P4aU|nsFMi>k zmYsRki*>V%U%mV*Aa`Jmyo`ex6+SD<|Be36J23S4?!RP_TmON zY9F$FxT&)6S;cR$h|Jqwr1?-t;vFeZbk2JFaxunqJzq54hYPc;yDQw~!`(i9Ckh3# zjl^st%ZE%KY%=Nn{KYIH+uJ?Ta(pP_gVP6>4@G^*^`Vpx_xOpj~j>%+Z1T#Q>^#aXDVRj;Ly zvzb0Td?Js;tzfT^rpJeKiX`_*^!w2Fd_KQ474ji0rGgKURD8mRsCX=;#6_~^Sc5F* zL-~|`pARE{$qvmiDoVLOr9a?9CGkc|sp3ObADa2_xDVBQcu21L9BnGTmdGPMR2Qis ztSMYu%{nx;+A`}1>-tbngnI6ewg%#l3LE;+$cM(_O@!?=hR1wp>ci>pGm_Ovp75c$ z53l<0nh#I<&_cm4`Os3NwGVB4cuJfpPy5hHeD-l`4L>9PtPjtLwDn<2@3eM4B&W#g z!iVR5c)^GE3h1pdbnv00591G~zv#m@dl80>n`5k*V;r7iRO*=3Ns*m>=pyp658Xsw z@u4fv;2a}($vU~$RjNA|+g$5(u)Xd>FCX6Yp@-t%5cU+(TefM|TRyxk^L-!Q5qVeG zTezafzw75cnU1-}2O@oheTA%3Zm#i>5B+@@;KM*4{C61}PZg`xu7IvVJ`CpE`Y>^x zF~o$3A?buup}b`Cw{JD$O%?P08FPaj$TPJaMFiUK78u~H^c7~L!F$Bg=bUVb3U9Gzrc-)E8%cDBY#MFx6Lyy`|uMt zRX?))xZ=al+|PZu&H&zjMtF|H6hLl@;37BWx6t~tMzZ4|pwhwoBru_2GGw$-Eka)TfDV_g)VEWxMGlZE! z{(z#eAK891@}sdIIesiJU%Eyg#9R(Zxr+69zRNp7x$xtA0@@} zg@&-ekMi>k2A7iASiFq5!w*xWtRMG^*o6%4G~aOg;qoJpQrv!c{qXtWk-`9mvH4~4 z3%Vc4Z0;-(^jqK8r7Pk`)Q>8DRP`g~N8FD}3QqV@&X07RVWRkE|(3nZ? zm-v8?Z^n`Xdr)TO)JUrN@sJ;NBr@P(ks88B{HX2+hstKJRD|A|e$?`#w!8=I*=!W+ z`cY3xeLo%*X~3G7GU)m?Evum)pDoX3i(V?;#BaUgv+bO3JVw4Lqp7f&@Nqw$@MHFT zqq!d~{dh|JNk3YMP-i?j@o7I=iL{oBNRa_;{b=XM0zVe|@vI-u`7z0l$@Kcso(JMb zXFuj0v39fPmGXkHgOC+E`tj|2<3&GS@?+W0g^Mn*dhFuI%M9T5=*KI5boJvSKl=O8 z&5!QVKk(yKKVI|W9ht8SdkK38yKF1^h95mSHZJ(wOuqEI>Bn1sye%)4X5VEjD`Q=Q zy`{V>d{6kkuvsXVUba4d^p!&Xq2Jn>`^ii!Fb0rpvOXyt>c>FwLBhepA;RSCqlbwP z7czc?A0x$+H-8@O#~44xro7|*7$@Fhfzf4wF~N_CGT+hUP@Lk&R4Ma`xtY_%M=mg? zi_8$t6wVUP_G6A8bH(QglXqp|NUR&V<;Ob4FEH5XBCb~1HNv&Rq-(wS2I0n(ce5W`{MhP;bCB(Gj%|Rk zO|I?29m0?O_{5J-{peD>@Z90nUk#s$lTg{ItX)E;?-tqP$0pwKm45}uB&X}3ABX%n z?8gya*H^7~K8G}B*7^kKg_H!;kBJ+~%2LaBk+G+!L;5{3HGsFPWmbfBSKR+qECJB+gxEy-u~x zv)*af)CEG4761acE5OeTts?0G{QWEc>0@02cT33>W(X--muhY%&B6g>2T&q_k^$^s zWnB?D4BM1ZB!Hp;>&{fUGO6SRP)xjdN*VWOTF=L9Unwy^fPw&w07?aLj{aKdV|7iF=oa?~y{Sls`NadmWPCV)NC35{t#{)H*XUpr#_roUz_@y!y2D7g_B9>QLlQ9vWId zAE+BZy#VS5(11k(cvkTZg)IWe{V}7Fc;f(?h&&cRvj83splN_N0>10KTI;s=sJn4B#aWHHf?*It9>~OD=#L0dxuAI0_e&_{&aDP(Jg@P0rUx=Zvd|b@LB-x1n_16uk*5UXT2@#A$%i%o&od{e@p2M zV+`vMU+9uXWTV(S0GjX0`(6O=%VgLG%A$+>!vOjPFjLA$0rVG{7{Gu41_m%HfYAXA z3Se*mLjxGjLs)DKQOqzYtU!gBB;+IH9Vu+IH)l)$V*{8VbDUDfs|c$xC5g=9d;CxE#DERsGifcXI|2w-6VwU-#J zIIByH2lnP{-kbB$5@X5|WA5IZ#fn_D#Mr&WSQfx??qC622w+73D+Aaaz@7kBF@|s8 zg{y^Y0$3Zsx&YP(uvNRq29D>KqMHKP9Kc3#+fr+RZBaaxHPftDAI5A8V7p>yQcMPX z9Ka`BEdhKMz~@ZKu=XOhom?tQjR8xIU8++_HRmoh_6G1p07rSSOO1U2?B_KVz(JXZ zgw&5LHHe309tj|6Qu#7~uLC#{z%jXwr{cd-3?muyO#t6=*^8eH;FL(xbz1za@Js;T zr(DV2&&jlU=Q0c6hX8)#$hqwYa4CRa#H-aUbXnx*0Dcm=BIFZ#82MMx!k1&&SEc+a zY*pHN&wow)ci|sGiq`}9GsXYney9pJ1GvQlte5r=UHnTn&GsC1&FAd^?gWq)M4_NH zs=`5J2azt0Anp>mTWAwz1d%E7-4g3(Sy@3O36U*FX3-#uC?*-1#9~1d58~w@UJ0T^ z5G8|%1rZM-pOG91x9cDZf-sa=DhRs>^?O802T?|(tngmpxoK9SL!876!kOZ(An#0K zUB8|nyg~Sa@CX0>mVO`zPB>jb1%KHiXT=+7p&-IE`R8X4qwA)HE83#+k}xtM{@u>} zazT_2;=Uj%1ko&r$AhRC#QpL%4&s3zDg{w1h}uCs7)0eD9uDG>AgTmWHHe24RxSAN zjor?)w}#hqnbGBMi&U3hBZ!(o>+W#;0T&x@0hh!&LDUVReh>{(=}f8jAO2_%4OO2h zY>mW+==_rQ#NUdq_N(>esvF^Cssb_$|%5HE=bNB#R9Fy3vZ zi)$ z>DkuX<3T|T4q^yTTG^DY@7M1hZSd;Pm!N9~ICIzuHgk>R24q{3W)kCNe!qgz91#vxy zKZBSa#0+-L#Sp~IAZ7*eX%L?UF*}GkT&T;9bwSJxVjiyuuGsq7^VJc%SRTZJAQlF( zNXp`r?pSUtVW&ZmFl<>$r$}>!aHVjSaJ7&{)~ddLX&QT3FL6T<8$~t+u}y>(HV3gq ze5>%8eb#y3p7QPx`8bGAM9P=7E+>M?1+8a&?v%buxLdeKxL3&F$WPYQy+4Qp zQVs@jNaS!3$AkDPh$BIK5ya6TzEnFFMC0WKIgyD;PV#jSr<8ai$j2f58_ci$pHw6t zKk+TMyC6<0hR6!Z^s_;n<0%f}=OE7Wnp$o>NQ;Lsc)4+bOJ%unQIS6ge-vH{;&UPinMH)j#G)ZkWSwFm6c3?N2oHu(B4qur-5#=j9a%Dj{16I4FhUsG zKI@(kN{K9cw-8Ow3WLa2I)pMRTUL0lkTLAk5rWBrA-F<_g%G}x?UpwXLNEl6xL4>4 z;jtBlUr55-5aUCLgb)p(u95ZZ3S-a;W9kay*5eb9($v#`$DJ?;+@JY{$V8h@4B{@O|q_4$a^4!auxH6SIn!j(%_L+4&jv} z`BgLqc3L%rYT^&2l!rwg388t+I-;5()C!?xh+iDF5^IOhEQH5HsKY^q(Dth$^`sBz zZlkw;2pv}%4TO&h8-~y*gvR1cc(5XURvHXrYbtZD>v zc{uGucs_&|Le_n!Y4T}$#1}(&DTMAJysEHH!Y(0nPGu#7Usl#DA#@E{*M2v7ldjjq zdxY>t2(PDf#;|zL5PB(|eI*<9w?cS3gm*&d9YWs_J`CaA5Z()+PYCa;G4TVDdMB;- zHf$tRNcx5FQ3(CTli1>5I!RcO1En);kjUT=hNP6CBExt#4_Ze(Qs#W&s1Qbrj1f)= zVQdKFLKvS4E^#t{LI@M(oy7fLghd#WtTr`-X(3FPK3g~=6*Du0S>nmaIVpW^2=o4< zv)Tfg3qx2G!s3)`Ns2IFc?c^)I1|G6A*>8xRS5e+*dM~`5Y~jSHH2*nUK_%vSJJnL zuM1(l$Oa*cY!ulf+^oZ-$QD^;Y!6{a2%j)LgpWhuE&KRc4bi-sQMz(g;f@95pDD3h zY1`)^>!J{Sm_T5H5spF@zta{3QG_gkeWB*e;1&7QQpPC{wN|;Ai14!mGkxg}-t0 z4B>b2DPLqPTV*}@=ufVBZlqz93iDdSjS$kqKo|`M=iUq?NG`A2wLct?1A zl~E{cjpynrgLqdMcZZQ1#={eB8DSJ#ZPYzmGAoQsahs3@sjps_SvU-0wlF7*A|geF z)ESniI>m&=!zdBP{i}_VVZ6H9VEz0s3c_f<+Mr0Jc~2On!2Dx`SjF!ruCD)NX#9uQKg6vl(%D@$$Y?HXC45rYLfA5l zr$n9>re812V7AsW+l28<7;VF7C-XVsvqHusga1b+-*vnYMu#xEh0*KLtd3#4$kV;X zcqNSY9?8GBpwLTUbmEGwYwH}wjnzhn1-V^x_%922;AdAG{1!x49?n_Yuz^LpbJ>LP zS{OsCXTBar4~2bw$$IH5x5j9)#`s~rtydUthOsJ!)iJ!qi4EiH2u?)sP8hv;Qo`65 z#=9Iq7_-Be6UO^td=SQnFh+*aCyc%<&gG%XA9A!+(ifkyHt>F7e3Tkhe~|%U3=CsX z7=vZ{0#?`%@%7(Yd^i{F(X^wd{;km8w2ca5G}m?*(-k&GIF|toz6c~*tQ~!m0@fMV>66xBLBGmVXae!-y3n`3)8t2(C&V_L(jKg6Z3F8Y5=BQj> zthFYp=sM#|4ft3X$HVxFONAF*7^lNH5ym%aoR-S#jFZYrylri0r^LS%GB_D@oN~rsm_ka3$BIndl(NCEkPICA7NY%gM<}`f2CXuxEaPRuGwOPIMvhbRmRy3GWtW2$xl~RyBjy6}AsUlM?}dC;ngr zMItB~L2d+j5%?nrL{Kb(;`ByPTEQiRgVq@(BgmJlKuW0yjFgMLu+c0NLD>jg5xC{L zHv)SE4sq5@#+x#oLS`-4mFbDV8v(oE3kt(X80k|0Nif2v+TlK#VPPzScm$DDg=nfW zt0g3s7nV!u$$}Lks3`q@VI|=M|2L*`1XUua8bP%Po{iwS2p)>y;RqT>&?JIKBB&lg zoe1hiP=m8EBdulxwIV2d$5!KPR_zGhs8nKE7hA5q@T4~BZ1p0jAHky$G*n-epH6QO z!N5ydD<3XFZzG8u^XQe?gV&W@u+Dfaf~FBX89|E(nnmz<1W!cJTw$NMORW1X%VF3~ z|5Ci>)a*n3Y?0g&EhBg;f>sfL1YOkoixK?z zdsh6O5-&y2iNQy$pBJ%_a3pj+94hg01g|K#(qQY-=pMnV5xf?`>k$-uUb62G)_Z`S zTZ`8!TewFAG~bATlTfWiI!DFfy&1tpLye=Y43SnZ4e)+^FyX&UpmOBUr(u zr4bH}SWiJ>v`g~TOf`4b`Xz{{~oDu=a^a!SkkWW)C$qZ$Y%#>@EaJG;Go5vA~ zFNt751Pi&?UbZb#r`tAXvoYrEm6D4iAXaIePw&zQmMMjtWmiV9it!Qb)xoZg;1l(@ zMz~hEE`s$U8zR^&!m=AhHVNkh(zisgHG*vsY>!|^1Rryj^tws>f7++13ZIF59>GqL zT`7HcD%ZE(x+5j~+9%h3;Q`^n2o6PXID#Xotm6@U!Q+bH%an3Vo-6+mP@I5c{D5^$rHiB~zJQzjgsP$}%^W0~m zShe1`5W&R=e&Dj__83KO6qh2n96?$Xg`)T=f-4dH6~W&T{2akA5nPMl_Xw^=@b$H< zk55=b`Za>zSZ%4bR@si+%KC%5;^~rqM!?Je$@Ru{j;CnhT6raU#?tA%5y8y}ZgJaZ zas4NqyUN<$h0SkDawWg-Dsel4wY!Vo(UFp*M}a78QDjB=glpU#g?B_+Mijh2f+vdK zzcQQqOlB1O-zdpojwh{cdf_OtqsWO``@kPJvxrx3*@{GQySMeUo%)m0@}ejfg*ysQ z6vd+`5k;ve?unvg6!}pUL}73qu4FNnj}d?8YF2Sr7u~ITHj1UAC=-Pv3Nwnb>VhtN zls8PX-5bSwI#avu*k)8rXLqa0mT*R`*RnO)C0tPu$-PndqKHKikHQ~CAc{~F;VAe_ z^O_@V!BkD|6%plfe*XTvWHgH8Rg)LCuKh$5<)SDb#n4_^?1jiZaIC}D=6qI#C>ng7 z&sLGA`#}2rG9QTItvpnc!gSswg!k|~wBB%U$*&g0Ls8V^ltz&_p3fV8KFrD4obd<` zN~A^*XBUWj5$6l0_45Jkr*I!DnZiWj4J ziM(DxrzoaxFi3U?Yj4P((#3c=idUi-9K{fI+Ew^L6y2ie9>uFNdqweP6t9WDE@XE- zMBd;SqWE=#!A9{diSG*E7QQ3wEo3BP*xrlceepY|t#>$mcp+!n`U*)tjG~|TM^W^T zVu1L-C$sTYQo>E{gF{?2ckj z6ceJD7{yBN8&OP(qI5&+1LR@_MJGowg)9GT&eSO8i%jDL@?4A05zZ9O63!Mf{=tpL z+!UXeaxI8rVHAsGE=zeAN3kTumqx)vrY}z^D|l&$kLg;lnu{t5J{fS0j$&;T>!MgM z{;6<76dR-16vgH!c1YP0#nvdcMX{Z(7HR*#?c*pu`M+My&u2>iJc^wnRCZlRfAv=8 znWjbeMzJr7liZx;+8@PNQMBA>upNkE@hz z42@#=k((YX#PC22m$~_KdyK&w!|g{iuSD^86gPA%KS%LP6j!;JQ%8L*ir>U}drVFO z+wU^}5MGbs&nW&%1u!O1x6sWfwy^h2M%fr{Mez?e=P2&*1t^BRn00Ubv>5J=Aw#@S z4Cyf-_V2xv?}}Mhhs$AMW(>9%ib|oG6+^ao;gn+Mji6&FlFCgcCZC8@EQaC=yGKZ| zghB*zQ7lgpn7l9ia7v{8-F-Xly)&ga~=L7|N&keKAxJ zub5K!Idi2L9*m)Zs#T7mN(}X4s2@Ysn6+o}R~xMS^2KjI1NV^tv%5#gk{OYPQWr+3)iomDjV`;6~9nh9)t*6ho&N9*d!A3@^mc zA%`FY;6jPsh+oyftS= zgaK_to{6EYNG)F`#b;CA=U7erxstYIwdZ-3&*itwMMrh?qOi?6Yy5nDoWI%V97C5F z=Eg9O(-OlgG0cha-xK->bc>;T46nxUS`33?7#zdvG4zPxy%^q);SJ7k z4DZCyJBB}or}g3|KQZJ~PcPdr{mmHG4^87cqPJtX_ga>(RT^Kx>+VR~+s>;0F2|N_ z<170IG4zSyqZs)9Lc&T5m8I%tmtGu(Sa&42&UdQkuJmtwvAl-40*1 zhr}>6h6yoDjA2*|!($i|!`K)`#4s|3(K_nRjk3>gHfqMQM)7pCOy}E)HjiiXEfy=V zyKylb8EReH<6}5}#(I}EDTc{0Op9SU2i78eN(_hlWKC5m{$V)PQ?hKd#EckbN|_bI z{u{P;E|uiFsotUV@Fy9wxmxl{JX5AH-;1(Z&XV-`F|3GTWenFh8w+AssKiCW#lj`R zrNZ1T#Dh5 zRJb{YEir73VOiPCSKdo!{I(cM9?#ew!!uc#bDHMu;CXMF_i+rL#8B?;;?GwvPV=)E zKIb`71*RMn*(Ka9+#}p8+$Y>GJix2qPzF;D$viBic|_!k7>eiQ$yuzm4HLUfNf!U^dR`Yg??>`tM^n8^aIW-nnwN7;`!n zfB$gCxfsrC_AUq+b}@$Cif0VdbGBOeQw&$QT;nJb$ImhR62tFY#xY!t;nx^`i{ToV z{TA!$W(Afdxl+S+-&TW9m$)9opDLamx87Cqk-mS){5yslG2G-e7{_fPg+aoin8h8oSw`B}U_`N-jgH(t&lu_=axdST@< zh81{2q^CRN6pbS{j)&sBH!|{Ae^c5$ag>hZ)FVbQ1s4~V5SA3?3k!sXu#~XbR-=qa zK*%o2#&K^PcA1ViJSp82amL|_!!6F&J~pO!W%`7EVe-{87)L0MuoQ+>iX#$7G>%vt z@i^{_qXOqs-g3g?4_Vd9i|0O6C}~!dd4C*9vvHN22U7gOI4Z|cMFC8#n$pRurHVWf zNA)=B#Zg}hKSQVyM@{isanu#5EvzH#wDsS2m0L=offQB?RLFlcj)rkGlJeu6%oZYz z<7g7cV{we$YBY`GiBxd=+ciNm)Pc{2{PXWm=F zw}tP-(OZQ2yK!u&no06O9DP_Mj+H!XzZLEqN6~G@P!;?zj(%}`6i5HmI0uOgh+|+% z`9s4PEOSU4Nplzn5XXo(M#eEWj(Ks6;^~N^#U0zMIL5>=HjYVgOr~DmHctA4IL3=m z`LtU4L~#75xWSL4_f$8IjLIIhI8CyrsNc_@y( zaqQy?&&WAZu@G^;_<=YMicp!@!Mb=4$8jW%FXA{F$Cq(@AII4^j>U02j&I}mPW^r* z{6_e794ACde44?VXPy*iol_!fwi%~W%9%K5()Infg-OmyzZl04ahy*DUx?#><9|%? zOL1IQ0Ba__$5n@=evacu@n7TkEsk4p{1eAD2Ippmw_ES}e&;e%?)5lsiu}n9e7iM_ zzhwR`ypi%IU3@OXyoJ`yY;SYN*lyerrX^4)f%Jr>Ac1+?4HCAyq`be~$V|YNz!M2H zParFS!U;T-z{3e-Cy$ubpDo#4;E+TA_){tAUA=$1d1iB7nfiH#S3*33Ax)-)#KS`7MiPkr#~V)|k-+I4Ipri)5-%^jPgo&=iXx1;U*v%VhV9Ly z$!ZTKP&rk(N&;7UXH^weW7*-EG#^QTzj=Q&frbjJos>Xjk*cc zlUZNb;6E<**s-(q?y*q&>>j@X{^Hm^$Hr)RcXq!Oy1YS*`T>{T0@L~clCGeb5UP$1_*E9b|ygjFV zhw;2P2}^a5x1*3@{4oo$lLB6m*g1hNA}P0E94Q=h!P<_d?=bikg)s??O<-IC z;}ck!z^Vi$q;h8`FfoBiGAAc6ErIC?Oi6jCa&_r%z!@U5Qu<7h-uHq5>}5^@b4BJQ zuqa_Y{&K#|1;T|we#pbf#R)7)U}*x&5?GP2K4@ZNfb|iOx=5OgWLurUdgZPWt`)8m zCU5DyA%TrDHzlwofvpK_mdV^?z_tXoC$J-7-2$3zqwZ0h#7`6WEP?9fP@^0^Phcl^ ziE=Q?VHZbO+IB60-xJuKz#bLco4|Rl%ys$u64;->fdmdF@Ll5nBkMb$q$t|1m%X|> zv%9bhvRjCNC|QC`?wRhH>FEU&K|~M%6;wotf)WKpQBgqzMGyoNh@u2Va?UyDoO8}m z0r_t~W537m{O8oU=hm%TPgPf%-3i@Tu~==Yj?LAvvpRN3c1v|^6S7q*u6aH^c-YD{P(TQIst|Z^pQGIGL7Kx$Em1BH+#Y0j zkm*5D4{|-o^89=D=6Fz0cp*p077~+-DlEK+-~)oZk$tg^`MM+cwK{DwBNli>p?kD z$_rKy94eh*>0=&L7p1ZXu3c$NRfJR(tS0!l;M=tdcs%fW;Pb#QRU#e)gfLE6NYI0j zqi7yXaau_ddJHLz3dRKEf~Fwjw7=@&SCaBQSnI($4{CT&(}P+bJmJBM9!%Jt_M`{3 zJ!t5`a~?d!&L`5Do)J<Iu?N-*G-Gq=6tyS=7jb3u!6ix1~KV*~Ws@ zn|RPv_zQw}vr{O(cJ}>yy`(84?ggqg$JJ;b#?Zj3oplmmRuxH zyI=R9wFhm4zaiMlgWkF6{H|F$uEC;@TLbHJm8mUe^GAMCEDK$DxLne zRAjAAToO;aXD)HEv~RKW-qQ=H$hsh4Em^Wa?} zy#+_-q=)=DEPY?H-`y&3Z;ATQgZ>_T#?`e{edIx3c1HLoGC}=3_*Aki8gwOdpa;)hO#9NqzjIuJJoth`aXcfiuRt;t-B4h##Q92aWc4CndoYaK%7Z^V z81BJ09{lLRD30V(HE~k*2oFYj@T~{83S{98ZkCSr;3p3j zFID3`7~{duV*Aa5UpyEwA$xk4Lce-I=UCAPEmgL%RI%bXQP>>$1mP0}8ETRTe|oUM zgM}VUX7DX(vptx@Rqer452i`L86M2^V7hQd*tb;mKbuCvk(ni(yt-7SFH_?$xrSUw zo9n?m59V{_Tu3tur9=y*kStlF6XhZOtI*j$%Sl8 zNna)UYQf(!Q*M{d4D2h!4YJ;Y?H=s#V1w+Jje^uSc`!JbzFBaK2U|toCPwK~2WLDu>p_Yy_Y_yMFZZ;pgf-q=D&Oz| zm#K3!dvnhV9`)v4^kDWfbxDxqvXCo+R|T&LUKhNn&+j=B6;+=f(YA-p2{) zUQ|BgD(r>J3%3_)xhmvEh8LM$6!cp91g}nmH)udc^wih{G z`=#OSV;NPKt7n$0B3}EauMc=p)Qem%ik)?JxRy4fbUI0%WR(|fm#fjCBE`LU$cv*E zj#((-MM*E>8cYqPym;7)PXhQffYM$(;>CO)7WnX}7iGNI?8O!@%6d`Gix<3j(Tnn4 zRPe&%h1ZLUUR3hp>&dy*ym*WkoYj<#8{ni$8OP zVwR%M3qO0}h3Q4Wi=dQ-ykN!H3fsUSnis^d6h#DeK|?Sq7!zzJRah$_*`{7tLh=P` zcu`YGEiaxG@`M*pdQn?=T`!*Y;wj;bP{)hUoM`pDsPE{{2w@Qov^DUep%>42(MYmQ z1fLgd%&8HQtTNn*#vcg0nAa^_o8%_)bG7`(~AyXboAN}GV9~T2VT78 z#oJzV5?e39&R%r!qN@|RhZo(1clY8QshI2oBarlTiry8{Tkt)>_XV3ve?Ii$BQL%Y zrLPwsdofh_CtiFiWRMsAgfQj+A^kb#j?#Ul`ds)x5t*g!3opL(VzB66Ii=Kx2>(Jn zUke{5I9!kh1{vY-kzRc3@bA1}5e+}cw)#DZO(cQ1YuK2C7F-~>TdoajX|4xN9n`bt&)MDCwnOy*2+ReQ12i)CV-COF%R>0Znb z-e9f$xAaWmv$#0druOct`{S|CX0LNAh4Xrpa5_M{4nb=4@r@N_B6g;#=$cy*S{-NiRGD-aNUa=UflHJmKRM|srOgef0porw!gSYRwYPp%$GzUHpba4IgUyK*IFrD#Z`4pYYiqVb?xpZ}X>o zXtr8aKkTmKLtP)9_Mx5+U3}>3!!thA_u+LP-tggB9~$`3oL%*yAs4`}?#4be5%Qc5 zjeL0ChfS;0y;X`uB*dmZyy(MAKD;2dYO8IrnGZ=1{mhcTBIGr}R|Q)*MKrV&PC~Jj z53PN8(}xZ|v~l$ILfQ(plRnVQ#P}T@&)Yt{@Qiu(msG#x<*act4Hoj14?}zyD*S67My*!Eg%1;C zmgyVOM+mawcRqaY!*4!}^Wg^{e)M6i55M}r-tO$EMsbnfP5X1T8tnt|Cm+TLA^%y( zFM|A;2|IIiwMt*3%CAx5eVD+tB>iM|q7TF=TsCXe?}C2_P7?f6aIz0;>!#B%RccKW zoGv&+aHbEP)~H$BCX$`w1Jhg|2Cw<|KPHk5m+dcVF7#m$FT{^gek}H32@fJaQvF!U zi}GQY54(L>?!yWnR{5}6qOl^=O0MwRX-)U1uVH6=*y+Q7_4b=-v(~6}Vq5RS1|K#G zr@m^9+9Z6l;1(aY`ml|MzYjYc5B+o!X(kz6>)+?l?eXEX4`+PXD~4?+a`*YL--kof zat{a|S)&e;_;A<<@*_T+6rF~nLXP=x+)+;Oq+OZDqEn(UOMX@&|K-EqKAaPNUhsn8 zMZrrxTo!VLXTA?NgkKfBCU|j;x+#R6zvV+xBqw=zt-8%^E2VdQm|iW5=`Oc`@Y-t? zvt6&bQv4|MM#{I>UGU>RKPvlC#gF^_Nb{qlAG6k~bU$2vl<;H3TIKfJ!^OlOie~tc z=|}V0Sy_G*@q>4iDk#}Pg4u#Og7g#?(tfRaz>lJS&c2zfRb2Q( zek?0hfLZ=A!*4m3^5bDYO8fDMA1}0amG|ROA>?IwEy6E1Nny5}ANe(0B*Y4SRP>{g z<9y7Iq$g>s>PIy{Uiae-zx^lE<9^il<5@qdOV;Cu*AJf`em^Y6^dsO$(2t0ehWxmF zFs0?K%)bt%XnxdlXN3hxZX8R|#bfvp^&{p-+>eAP=6`T}W&6^SN)111O3~AP)Dps? z+I~DCoDDtc2OF}7!jC#4ZeOeF`oU~ctS96d!CgmfX9M9)1se)JC)h}khUbMe7Hq-^ zI%3y)L9#FU@sc0Sgug1tqUL_QEc_KgzNtvDh49xLPfI`cpRnUFweq9CAD{WrT1wjp zw)LZ(koJDO<3|ra-t?n`A07R8%a6`}bn)YDKaQ7kb@F52;S`eLiIi^>Ddo$%x=O|F zg53n!%0Fur6SF=2eA5G;i2knN`+oHCqqp$)1nFdz5B&JhkB|K5>&Jg*g#2SszB`!0 zU+2;JsnqHxm@FM2{3}5kK4&K#KFE(RgnubGSn&Mulw~q;L;M)($JZhb^JAot;ey`? zju1@F^0&en|2sdv7yg4_g>`oSNBi*;7is_v0vO}R&r8R|d$m?}Xg3H~X_k)Q0x6fwMUHjCM5eoXgc zh95I|L^z%=58G42UNOz~WBrzbNj^_(i~N``PKpbJEcAm_II|2waj72*il%S!V>9== zAItq%;pbNbvEGjjest?tV3iow`mtIF&1&+}k&S)DYO9Qi8{MhQpQOCT^ zj~#yOl%nl|th>vP-F_VK;~+Qh%z}IT*eCwIVqidu`=yA4*+YID_Tz|jk6AX9Y>T~R zi^n)t(&rO?ob==;TZvB z29Op&x@27exP|<;l`K&T1&}SIVBp_AFmg@+g##!eI)gtDK+ymgpPb0cO0;lzgn*eX}YR!ANdy_#T|0Lls}7eK`TDg{tpvK;3M0eda6 z3i)FJR1v+hQ<|K(ssVfY$R8J-vtK>HyE@plynY6nn5NX-CPtCsL5oLWzcNS&e5)~h-~>IyzB zSWoa7!TN%}_4eO34FfpeBQJA<>Jz|o0W^}L=L2XQKoctB>A5mu2+oD>^qVr=@CG(D2ePwuK?ba{`3~4@?HS%JDgQM2;jp2J_?{O7yJhGv0$YQ ziiuh3#C`$v4`5CoS4j<@1u!6h_kwsoh|dEU7=Rvx5yYSXz6jt-09OO}GJwGW><(a0 z0AB?#B!Hm-e9cxCq+MH-{bgoB5?&+kKRGOb;Q@RTzzD_Ed>6p? zJkJ9d8^8}TWvn$?$d3Vxa+D`FsGl4@CV-!XQ>2;c*8s*lrN43aIh?i$0Zin=c9cH? zU@hv&2$KVt62MHSbgGaU0Zen0>5enmlUbtAc1n{$<^`}afK>s^=jM{4g@Q{1SmZbt z2e3r=tbO+X2u#ZYSRTNN|A@@4cKjOxSR;I`;5u&Y|3qM@jR9AF)$wi=1}!GXb1+IKM)}IOhYn;3yY`TngZ_qi};<3*b7> z(jbZkaU+16T*f?dX^=ke;)>m<>Tmpa-v18Zb^vz*xEsJfJiUX+2;yDYs58;V#41e5tV?XnW(JWZwj5Ck29Yg<{zB49G6F*t4x)%S zlVORuLF5Gy2qGAS3ZhsLmBsL25XFNi7esmK14BI&L=x@@zd}~ z5Rd*Rc(S);oer>8g&-;hQ7MSW99z=E?y)B{5UT`HHHd0KJRXE!uA;irC=DLxy1YU7 zgj4+A)p0$9g7#_5TMKGIg#R;o5#cmPgNOz3P7pnUhzDT?@mvs%f=C4I1A(c25Gm(# ztswFxRE;2N22o3RUBM@Ucru9EL0nF_o+7D}!bHwght4TBXCIypqMrDl5v(`GejAf7 zSkDI0Ac*KAYDU4VhC#G=Q<1ai`5;~n;*}tN+Nc^!l_r8s1z!++QShZ8ng!8ZI3JnK zdlvDL@hwiJ&Dp44WkBjdv<%{HF}xnc8$q-W;>{phiNdzp3280ZMzF2mwT)_Qr+-&$ z2T>a3p`(zu{$uMTyt7~z!LEYc1iK3s-ekw=8T|L2B7EKX8JBT?!Obue1h|@)!DL6wER-7eS5>}iW#5~Ea3}Su|3xZe@#L^%Z2C*oJ z#nN1|#bh_w5XrJ2mP@S_f=L65NEmjNkkvt~k?jBUbwR8TVnYxcgV+?rX3pcE_S>X& zHrYP{+9GCzFk`dY8pO6Bwg<5zh$}%{4Ps{yyMj0s#OWY*2eBuJ!<_L=YA^XVdrut* zVjs`jBG@lVQas2bXj(Q)4@vO$n^ce2Q;r02G>BtC91r3|5HtQMe3D0Qq~MR66b;NW zk)H|T`jxbeo79CM&hk%)2HEF0R-4p$L6V^*irm$aTI1NR^vG+z#SS5VwN(OO(GIWGGg&Hmkcl(70$1x&C2?H>-~~EApQ< ztCSFk^}O!)FS$}f_BGOfUkJ|}O}k$(O^_lLcL*6FEC^v?2$>;dg)k|EKSL-OLZJ|T z58;mxvO~xT;ggVkvK0=YNC>Zo@J0v^gitgDGlWD4xgq3*P&I^VA*c|Fh44rSkB0E> zzT5{xcqoJtArzM^72aN{WC*1~C>_G4&5DXTlS=X7kbT=C5;}=2DicDv5Xy&8RuqaH z+X`&rOlqYN9uu)5mqF=tR;(=9Dnx05A|tTM;~`WJArgWff+qxT2!RliHlK9BFBOw! z_8}NTNE9uE(KXy*>D8B;bIBRakfOLCv(XS@4llJuF(5@Ng!~Ym4WU5@HA1KvLY)wv z4xv^EPlQlcJZ$bs>G@M3)Mod#D8?sND(a>=c?rpJsOQ9gCWQJS@G^_-x5uzy2+xJ^ zLI^L4p-~8pLuexWdATlLBmHzXm60dm)x9Lj%OSiXq?urIPRAB|teCQTs8>U1A^K|} zw3LaXKDb;46DO-x2(3eSM+|KQS=uRtwjs2WhT4nxRtRr~&_Q@|emf@3`*PoQY9%kQ za|m5T=_=SQgziFWyE2&=yhjK*_1~ zV_7*ITaNIjA@mEOe+Zw2>4Dui!B7!kq{ zDIMl`hK4}f*OH}qxT8}U8N#T+^?2osWwaMeR^#*RWM`lq7iyEb#3*meSi$hov z!qO1_TAh2+>D#gpmWQw+gq0zz3SoN)J2)vJtO;QYqpd2mHiUItx8h$f$_C*Xa;HHy zu~D*gl5Y-yS#qYWqHhz0MLR>-6~eI)j)$;2ggqe~2;pD|d&Ne>ej)n=f7+^EEn&~X zA;}&N;fRE#vRbZ-9mkDf@irg)3PXD2;pJ~=^9)b zE`@M81ZZ|!eV)m@62dKxPYC2!L%0?~$09DK>ml3-;U-V2W+}`PnK}=2{VmSBA&}n= zp-i)sJA#bH^bZe#fv$UkDVog-2&M`$PQ7jFJ`KeC1=9ps(XAmvv-?n7I+m$HX(*;4 zOG7~og*0SqD5Bv34LM@C988_KFs-m~24RGv8YYa%%oCog+5b>i8RR0KIc$GkRxGvX zh);4E|3T@=)fFk^4@rw91ixNWgyvFG@nONzf{zG3s-X<~vnj2thH^s6YX}ReprN9W zN*byQc}zoP4OKK$m29VKsns-mJEkD3KQ0RS_x&=M^=R;l;?ockLeZ}wAUr7e#x_Nf zNz?GojG{>%(V#niLr7FGCfIYEN@%b&j4&|LK)!|=8u}Xe*g#DUwKSB}QA)=X8lKb; z55o+jwuYxP4B+Txr`OR?S3?I49W^|y*>|_T*{{HBoGBUGXEfB;@T`Ug8k&pJP(!~J z?j{G--HQ!z&uf zFLA%B;r1f;vTgRJZlU4#<@P+bq@T}!5hQs-Ln{rfHM9|>tzhekSuA2|C)xHI-gNvd zdP~FGlI48@I|=Eg@t#QNtReTlj4o8>rkRn#UHQeZNa0?~GT+hAgCkkS)mKALDW&0k z4ZVcFD_A4T)my`R4yS>sk7Pd({7~>CLE1i+fS(9{D%el3zaZQCOvu)4>T?YPH4M`5 zg@$XK1%C3Y*$-n1h3#<|tl=vSLpa(Rj%qlj;cE@UG%VJzM8j|m-)Q(#!(>L&FjB)W z8pd)dYWPmWXbnGU_+G;goHY%jxP3yIi>kSZ*S0C*gWGNNZdYS8{Olwu>;v)7!)d>2 z_)Wt^PK}0f8pbn%2AWwKH`9sZ&bx{HW%M5!m?lX>R3_x)63^zOPth<{!z>N6HB8em zUBe6wGaWNyCTk_D6X$4{t6{!|1sdi_z+@4lwcPAlD6LajBz?HH)9z>E?P{rpWg2#9 z*r{Q;h7}stYuKP+rG`}+)@oQM6<14hYozYL>vr881Jl`ODoiZhs9}?aEgH6J*evOP zt#2v!?=^1Iuw5d!hh;DVAGfzl!)^_SDCXqu5!|nVz1^!}pJqSMgfjFu8cfv|nayyqCP{dNV(4%)8n zb4Yp^t}q@6qIZGQ-FUBRh;7aTW~QJuDOk2b1fHZ&h)`3Wx2rQ6!89 z!uA-B<66zJ|1Tr519@SnFdhn{L>R@wcrc9O5{jMN{e|6seNrJtBPkh1sW2W6qcm+2 zgu!R`EcnCHLcCaBGMg?FM%gf`hEXkya$%GYqjDHk!l)2N#V{&`@tAY@>;U~tthg*0 zEhm>th&qS*@i3}~;SVDqo$-X>4Z|nbMZ-sK*LJVnH;x`LC?0m3(U{d_zjMon!-xpi z1r5QdV2l^?zWu4Y!{`#m8)38x<1Hy| zE%>Hj8^N}M?F3o3eHc$lD;*rAV;C>&{`VPtZ->!I^oC#BPwDC^yqDwb7DjjB?+Eq~ z?CF$_dBhI#ZWz5qc~9{DF!~7DIOiZ2C5g?<6}x@O!~u!}uYLAGzKnJ4SG{;7@`KIBJLbIgDSz7#qg$E-7=~wU-Ce zv>oa<@r)B3FUT&jXrfd1cWzjRPZIJcLv^*Ezd2R1i^EtF#4`W3bE5le7 z#=0=phq0O$zBzTRl+wRO2p{T7k$giK8^hQf#-_0S$YWwM(aG$VFqlY~-6j>cJ8^b! z)0J@Tlq|`fF!qM=W&|A~*cZlr?#&2lL~tOCgJG16pi~5h!Z;j8!3YXP?3ef>VVnx% zbQnh^$T7j=f+qw|3ew2~?F7F4|9_N|jn95HfUA#_oEqv(_U#02rnv_D>&~t`w3G@I7zVx9u!_Yf`^2Zh}ch_Vi6O`!x5BbpCj-` zxXkR1F;$4*QQ>6-%Lci z`3M?E&_tAGf=vZq5M(PaM(~oPBN_HAG>_or2wsWc)d*UOr-fj~W_yV26v6uAxy){N zuImjkw2Gj$6SIwwwu0>g8mVF7O|hUHc%9r2So6B1RR{?<8i6*B>6&0zZ4uS_*Dc$ zB4~8?-=|FSAy&gg|2~2rA{Z|G8^I9~jN}Y*1PWy{G2nNiSC#(!C_J}Kq2vRFM@29? zf}bK76T#0B{2IY;V)!M3u@Ow^nUc?E#mc;_uWN@I7s29J-D|qq8jS|>Phxl#FQkv;ez;={%&{sas*d+0_(_-&RmV)b_91KxF(+K5!{I2 zW(4QP*)#hWcV&6pk|HZn_-`SP-Ym#Rqu!0+p9owMqR^7SZF425+R(UB#*pkN`vY#li|K9@DaDwB4p2Sm>kEGn2Q z$WlHYQ3>bvXZAti#hucJbd(UDe9qv*I!fy(Y9QCZBRU?{aYn~k9c6Ts)$x^%;fvkn zbd=Z8K}Sa&6?9b8QHwTt1Yso|kLwsX*IovX>8R|qQbotBZQNCLR1?zm$pXw)*WuCO z)#1}&>Ud^ohM#_Z;HyK^5zrCTv2>R@v`dxR;~udm_x3Io)?w&~>WGL_*Kzsdl&|Dn zk!>Rixpv$CwZ)_;uHzxeCUjUj@=XEsJ(NxC^(oho}{vEk1 zcBVnz=NT;Rj+*O!Q3vr@-<0M$UgqHFXrbfQ8uu$Y?k;n8-IM#&u#E9E>u9N?jgGcD zUf1!4j#gYSI_9!yk$e4aHDFlAVTpNogZsvA)lSEl{qEhn+#jxTXYNt$b-d|}z#Hq_ zZ|Qhj$9p>7*U?EwXB`JBrS96C)@_cv#2(d!lekB9)zM9=bm#2sQ9XsfBiKW*;KwPw zI23yn)4Mu)3!k~l&1@eXAL#f}Z1s1zKh)7z$HzK8(otiZyW<{JIX(Lm9aFZtKV#F2 z+@I>`N5dZV?H)B@kLs_3|AsH#qXy^*FLi&;6(yne?NNhtT->9+5G0xXntQMm9b0I> zGd4s=vAyo0I=0b3C=S9b8(R24ICdRM0SLu7zlfuX9_*KU^PT5{nbF1BY|08L?>A18og=D;r zclIid|0jFZ?>hcqH`G-K(bP7<<6|;9B=|9W!)n)v-;- zOdYdyEYq=E$7~&QbS%)Zkn^r%o{srCuCz~CyjShmtM2Soh4!iP`;`0Zj72&Y>sZ3= z!%5kvTJ2L8SGhmir+(h2rtMRU_o*%W)CwIdb*$I1LB}c`t97i^u};T{eQJ#k*M7V6 zW!Ae(e40{nnY+Y(b!vtCp>^(!IyULptYZsz=zdjyziPf;O>m`m-!EHlw;H%#ZP&3w z$6@XT9XoaG(y>>^J{`L`)ccixk^B5|H@mTiW3tb#wV!K1#~~dLFLqDguMV;s`_-ZS zikz#3hQIf#qdJbUZ#quuD0x6-EOmc(wa{^%9tTvD1FGWzbxOzfh3?Zjif?ugJfOxO zP)iP|b2`rJNHD z1QUD0MB*~wmZD#KW>Cp6kZFKCOR%7ULI$!8{5&M1h$uP23kx3oK85-NqLZ)|f3wWx zlxIL0C}!Y611}hO(Liwn4;k@m{_D^6+3z9q{ zE>b!OSFifZon`Q6|NmrF}~H`&wdv@ z&MF5L(_@9)dAr<}fu{}B;{eWg=NtApT!Wti7^uZDneBeUKpg{h4Kz5Yo-|O~z*7>C zStdqnd(b}ONCuD?sBfULfhHX4gKGXk^{jyn2i2w(?gj?>Zgw{`@SKoF2A&tv@mLyl zR&Q!x(*ifgyx3|x%SHQ=fh}t@UtR5PXP}vZeFs%@11}pmeNeI6uNZjMKxB^lr@ko+ z(t^D*K+;l>A5yfnH}Ix`?i<`447_ci6AcF5;#!*Pesi1q z?2;no4yn!tx)>-o$NhnUt_Hdpc;7%D1D#j7bN0Bq8+eCvBxBoyt8`dKPXoOSylbGh zf%gp9?-l3dQfK0&k=yU0yV8fQbMIK<=EQv{!9S9LWh?Z2V&GE)+?D+ej9%;RXW;q< z_qoch(d*s(8{;#s(sj0NfB}7r`*SuSbq8^H=eWNx@TCE3PYU^9(Mi5CFvP%617C|W zTyU89lg@7(C$rxg_|CxIIQGTyy@4NCF@~>W_|d>917AfkB#O}ne&VDU*l%DAcbS2y z2BsPK#lTq3zJcEite}H~)KUO7+iH2>CvR%jyPS%i2>boSnTX2u#*(-#G0|pLq zkwj5GY9B<04BRsCmvry2fg=Wv8aQU)n>y)NIni~~j~h5);G`H%8#qHxo%B;Y?)++c z;gqum&Pfro=MDR|(iaR|6y?{#_7QQ(z-0qhcpe7qYyZK)6Nl6_E}^&VpXFZX!U(7v z25veEtNd-?Hvcx3PTnzaS7PQ$_8%VjQ6P$YA~HgX=mnxU>#{HEz9{aGB3s0?DAI*w z2)YE_QT*e#`@@^q^Kvqy$P%4>E*M3jD3UjDrh&I{&WWOM6h*{9rDzlnL~*%cfhM<7 zh!wK!7W1Nb{ZOikqL|nojG{yoC8H=V*@vQdR653=AC`*ZVG&CUCUs(RxY(ITqbMUq z3|lseL{Tw{cob$7JKEWURw;_dqNprRZxlWuRidaWq?+L4g4G2*f=?~BUljaN zdww-hm<O4z zjpBtUUW}qa6b)rGo{!==PG6n$Mp1hyvJV`(q`z?#O`;g(vh}87&N^(*@=H-Pi=qW1 zN6}p3zs%kWVe72Uwwl#Vf0eenc0g8d8O0k>wBoczv3*@`#lz}>LH1Iilat6=ZKG%x zMXxB{jiP-NZ${BAYHx}TQFM%=6R)>U`db{0rg^OOHdjL3bP`T9_ekd`x5ET z#71izR^5fX6Gaap+!Q^d_7O+ITD_xqFN%+&_#}$=qxP2Jy~jTgXP+pp7PWue$~YfJ z@lh0gxr~GAjw}`KHR_+rQ1_4G#5;NY1c#KsXHuP|yspn3K2XRY!7l{AjAF15w#cn9 zl#|5`7{h%r42xno_gxg{xTvBS5yekYjNyXm?HVan`W#m7wYlF$LHthed%+(Be-s?W zR{9ATE#i}S43uktTkfmJVQ7jiez{pzR5E@oXqwAyC5XBndYX#Q{(!efl6uwoE z*-cSw7QV$%Xxk=yyQ5UQm$EC0-BBEKls!=#7QQ!%eNpUp^n*eUM6q7lV*Eo)X>Lh(3POB5%gI3-1=1(Rmt8Am@K#f2y?a>a_loS%F4u;OEI>A5UQ;)wcuch(iI z)hMn-aXpHZ-MP1;xD&+{6s-28Ao_mBKy0ecO}k0Qju9! zzegTJff!O_cK?~e8|*u8u%Y{7NQe*X<=w~9yjp3~$im6x(dBT<8;QYL#{-9)w3)25lB9C9_ z<(_J|F*J^0>Jhc%hSfQlTC_rCW|}{@rog-`(p@*PESzC{v#?JLnMZ1 z3^7rXPF-plPThD6rj*u-ArXTWLk-EY4-CbWFP%&_UDK(>>=Q9O8AH-WtmF8f6;fC5 zX~B9iJmZws7xGv!`zH1cgf|p?POwo7NkhS-_Pj7P;grSjLJTj)@KOwK$IvN;W-&C6 zp}kajIfhqaXe0d97+S>8O89Frw2a{m;jjM(0}?r@wEmCYHd%|m3y2|E`lcuyVyJmk zF?AI3mSE^nSLYbI#PD7W@5j(poV^6Q#n4^IJ2CVW(nGM3w43DbiqiW(rF~-fK(d2l z_%Mc#V(1^kXEF4R;o}%SiQ!WzZP_?wsC@UnpJX{cZvVRsuI*CllEcLG>!VtkJVi*>~@EG2VqeC3u#4v)pERGU!jEwQdV%W+(cq;ch z@h^>GSq$ID@B{z;k6}~{dycAkF^rDkrx<36XG{z~3z;hTOANooFfN9%$*dc{3K{Fh z_!uU{@J9@jM41@F??Tw;U)*3K`BRk1F-&0uQIa}~n4RYMr^hfuc+xXV_-vKN6}`aJtH5ER3yZ0F>H@vM+`f8e8uf?-W9{{7z)Pi zYu^*Y-WXDZ?~7r73}<3E8^eJZ4#sfIxuQctj>K?SNS9;(?x3SFj1+!c^b=eXF`N>9 zT5w^qRPbC3=VQ1U!!;?oz|-ltx-9%+43}caJg%s)SHvq)O7VIOH)8llY&T=L6~o^# z+?Fg${}R$jYV|y>?!++dxVp>TAqqn=drv$UL@5wQY8;5;KDp$KIPMqX5@ejTxE(Xy z$-3j9n9OF1m?cP0vgtyS&5k2SNMS*?TO^JLgl{=zA2l5ITp9d4K_ysB@Ik@iaf~^Y zI<`w5oh9S&#NmyjloU~UIF8bBJQByFqEvMBGI5l3csU{ErO^s>o=~jFR4I7l%KNSR8SwVt<0bzyIS1##VhY8f z2@g9;Bo1A;5l2+WBL~yyjLcJ*Q*~Cjin#Ivv$jgqNebVmvt8uhoGzr);j&?#` zkK>IvDu|&~9IZucBiJ^MW}>q$NqZ4VXzm!tTXFj?ugl|jJC06q^oXNp9G&Cn!hxD> ze}9aLgsE#B-9#ks9>+VvhrX7_Y_B-pjbm6G!?}7_=kojKz2kTC)GD`j1Y08jKJtPzLhKu-|<}_;XlMN@ud1u_$WbUY50koC61rt_$7`x zamKLTPkS9E&ApvS}jg(zaCm z%LJ4Cp|~QBm2s?!V|5&B;@IxQTpPzGhp!W|UT{Mk8y)?-G;9{W#Zk5j*%k+j7<`9h zcM9$j+%3qWJ&tF890%g)nn1S%4#shaFVhK>OyF=FM>vcoCYm@J$1yH=6Rk`fkK+W7 zQxnDar=FB(*VzA)>Qo%3C3_~0OHM0ig`5*SAIAkD7oF1L->A#NuQ=CNfN9ny6r+qKPaM1x-9`qO^%ZCbCT^6U9vAm?&%_*Te(Ia*7a5 z)IX()nmBh-OOQ*9-m}poc z^U>4lJ%28fby}5T*ooQCx6WyQT0J7><)>A76OWoGW8(AEs;n5wnfUFrVnc<0&!&IV zmpL5=Wmhusn2D%~n2E|Js+jPb2$-m9q8eK~TG(siarPlQv$_e7X&;ZFErqV1Ru7y} zku$3C88zaJ@^J*tX3RLFf+j*HbdFE)9KH*nnFyPRm{@;CZT}+Y>>2wS{|MUMHaH+> zmH(__QQfoZz^cM$FSz3-OcMzcmWg~5HB8hr(f6#~;qhk`2Zy!|XVulSs>;Q}Px1oG zWIk=8o{8GRv&&>YWugwpyi6ujT}OO|mv&AyH1QnAT==u5{kuQ@0{qOFN`CT^Zn51&`=! zPfUDjqMxIDZlXWOlM7E28far;#et$Ebt+#-_Dd6kO?+iyh>4*lzW%=+nv)T}G3|G~ zSgU_0*9a3MO?+$OJ1*4o>Q|1Ti62b-C|N3v&a2+%70D$~1Ldnt&ilM>@ zL=w=YZ_xxk+nHtvZ+Fb@UMzul0%ih<1Ui(+ZJdCWKz;&GCr~ee8VS@);Hd=aBv31X zClYv)BQMpvcTQzu6$beqXO_IKgreR{49_IcFoEY1sGq>I?7#)pKnz53R%w(#GSu^; zCu?=Qk;$PhQTXqIe+U-3s3s>ch1Zq9YEh;p zFeibz2~6W_}i|0*Cl#d;+@?cyL=9-(j8=Qe7W(?M{HWM{sWf`-D*0FXVvWK|ybE z*O3H{azoWk&wV=m7>BD$)|CYBD2wC5PY9k&;8X&q6F4K;iwT@f;9LTuM`T?PrJ<_; z`S}DIUsNPajB`nfE(;!=T7=3qIrcdMuy8$r8wuP@;FgTxKMDLLj;pL0=k$#_r`z?E^q*?asg4;s6Wxs0hb;M=a zFEM<5;U|w7+;q)V#lxzgg+dk{v{2l#KU~YU@D9}Qiz>%LuZxPQu#h4a9$F zLijqBXW6e-N|0s};zQB__F?x$Rl-6^3#BYPY@wQk$1Rk$@Q4_ySZMS|?xPmUTc}{6 zjD@nIOueY6my_!vVXA21F)1RiWMSRPRFcXT=B`Xl@~TqG7FoBt1&_oxEO;&WENB+O z7W@_hVhafdr8*<93M-N@MMTu4IvEymtcyLL*$c8T2*Y%QxW)_-rd01#|p^b%CEF372^@bqHs}@=~{510VH7I>3q zlD{guYB$g8YvE%Kc=NnZ1W7)%(9c4D$$n;GfTOe4=fX*7`@+JP7KU5+#=>Bkrmrmw zv+$Mhs#RP=EDV))$=MwLCgkDY?~=N_&VFSdVPT|&Z@JFrWnbOz{*LRgQqC{jU;FHh z`91fSW&auWqu?k(W=C82$-)@P?p>r2zX`x}`%+EWdAHAd|Tln*mS|lrhKYL_p>st1yGTp)q zu7_GFd_WJ=ObfHPc%HGpUPYY4rEX!Kh4~hiSXgRdfrW(@7Fk$qA+3JOh2{mCcT3$f zECsDnuMSVy)FHKO>(pfymRne9VU>7Ra67k7eJ>+-^9dI*X`}P;ZmDazg)Qu2Z!N61 zu))G63!5!$wD8v@#RotfZfSQi`?A_%VXK907PfO4|Ka8jY!^S}`gXf(2X{@oRAzVb z0x5cJkww3kb?vdRpR0?5Q`WUta32@guoPyQ4q7-Y;vqpQf3-;^9+B+84yng2oUl-? zF3Q)%NeibK{|QWf0;esU;egb_f?7Ch;hY7%CXAXmZ{Y$*FCVk>agmc~;kkS?%Ex63 zS9ogWqjEm3TDT@l=#hL}=W%!0-k1;OTPMf6b;q`zRQC=gsA3M=*FDxUPuMOih`8{ zlea_Rp;09t(R{pkFE!(;s+x~#`FK1Z)y2a&;e2?6d-LJThd&=HU&{)K5)cgLgK3E0 zzH@m0$}TM*|BtNifRdv4zFzji?rdO}u*)<#g9suZCXhI>Cr5Jri2(rxj08oJC?Y0Q zf`BLzR1{G`1OXKZ0+LapARHX+=R2p)J@?)B>Q!}hb@fcoObwBorG)}o zI&hart+UoB@sBcFJJ7~~whpv&puGb@2SN@w9B?||b-+}xr)!2w#4Th+j{_waWm5M^ zNpXML8xV=A3A(~EOFd?bq;v;j4#XW`^;AWY4i0p5;CTloI?&01&JJ|pI4FM7S$m%h zt^5vjci<_BJsjxiz%U1fJJ8F4-VQwMz#|Uyq1S%e^? zJeF_O&j%dnFOfQxlsGUQ^Ps#89wcS3aES2VJdetJ!hy#`82q>hA7%~}Sy0cq^NtWd zKfpRiPo^Vz6eAsY+JRAN6Z-V}db_=W>h zM5YQEGfkxAIeVj1nKK-ycFsOiNY^X}-g02J18+;2>%co|n!TE1olRTWRwc;al}MA- zS!+Q$W|0H$iNBv#J`h>xz=t9q3EQ5tW&+E{4lI`PiSSb)_0M=*X@0bOg=G$W!AskT z$DCO1zzVKN4qS2IO9xguu*!ke3hs5z-p32xvdMv=hPBphcHn!7gU;E>scds##`2uQ4*cxEb_aGiu#*cH z#l3dhdHZg~{OG_Q2Y%oHp0lq!XTNh_&faw9pSZ#}u-}0L3^->$nAXWzn4jg4M7oYR z@C#Rr^OkBtr$t(<5na+mN}^?&lTmf40GbjsSvZ13d16~O6)%L$JYUZ?dH zYqt~s)}oo(TP9VD{qZ^BccOT6c0d_|PK2D`W1K%{W{0IjgbZMC+=+w}_ee=P(LtoQ z6CFhu&`qS1u(K0gM7pNEtM*t)y36e0M9;L|%ZU%W{qwIGeJD!5JMHc31Or&{UMKEz z;(qbL!hTLXAkv?G7Gc-`k%7WBoE~X1$O)PZ7$W6iAQ^Ju>Jnh6NCq_Fl#)+{`JR=-?K5v`?*a|sIicowmtxpn} zAbj45iB53yG2SCya9Yo<$zOEhCC*7F_MNv+ae{xq{fZN>Dt@vPuSu6 z&v#;h6Yoj?K=^(-hU@A=@zh$n$cc}+dT`NjVzCpSII+Wtolbn}#Ai-?<;2%cEOBC~ zs;qS4a|R5}{DRBA6WfMnE^}hs_ADxFbcGXNN~E4Dbg`^*Vzt6jk>Bt{JF&@$%}#vl z#9Al5V?%RGu&i@py%QT0JTogJRj5C`HH&~dna z6Tk8jbK(alestm|Ck{EWM`8P%*zd$%adwzTaX|c_j*$ufJ&ME9e|F-C4v;REUz|9q zVIgPT6drftgcE0+_|u7#PMmV$cU9r|oOa?j#WR?h*+W+OLzz?6&vHRfz!fLXJ8^+? z%!$iRTuj$uJo8kzU?=%^Sgtzp7iaj^tTTK^zXy8IK7jALk!EMES;qmkZ`;9I%bm6-Tc9upWH}Q}~Zcgh>Txcr3 z=zkR$#@p!G3-;oR_U10!87Y0M3%7~fE~Ih?Nt(BCq0L1*#a8UC3s+pYO2vh?E^K#U zhYRgoXz#)t7v6Qj;eykJ7hQNs2jUWjU2wbLaltE-gJ8Pwz{P(?+b7X447d;!38e!V z7I7i!Ld=D@3u9dv=R(4Tqzm`CaK8&3c;Z~>?m`b2I=RrEi{JZd}ig|at(AS0O zr*ns8S@(;3T)0=g`un22>?Qm4{aJM`S)K3a!Xqv`%C5T5pKpOL*$24rkPCxc7|0W3 z4MKL8OZJhM?6WS}2fHxDg@<_-ax<1(vcFQI%z;bx!pl~kx^v3r%`SM%g<&oXcj0jt zp5Vb&$s0<3*-pZ*5JWFq-!T~B!blgMWsU)oRrOcJWRl?Q0 z(p}hm#X6_N>sRdSS7)zr;aeBhDj;uf@g^76iLV!K5Pm1zC`|2=&B)Cze9v`hZ}Ao( z$yOJ(iPyhsr@7OGo6F?ycj15wyIfehDRZ|n{J?AQs-5LWo?`L6!hOQvclmT3bm1pH zu~7ylIpo5x;)jJl3y%nY5grxt_je3FCVpIaLU>YmO4u~R#u%30Wd1Jv!-X>x>Pcj2;>3ocw#x#Yq3^%&mo1Y_n z_EmccH!|IT8ztQ+<%Uft)!bFRFOkQx2UKHx7q#oBJvaihM(x@Mu_e@8%| zR*S;B-RSGaJ>vHX?-izE?iXh;&GHNKA8@0;8w1=J$mgQh>{LjIBci|jCbQ{H%7TJ#*MK`oBg+av>PlW*0J!-;NSLfZm^KheAbQU+<4xNiAu$f#wNJI zLc+`}CrVU!!3`D?#=q#sOK!aE#w%`2cH=d*GW2izt8TE6q*~#h?7Ys->)&>$Om$J`S)0_vEO#%9XIB6k@sT$o^G_{5F&7c!Pe|5W&yaF&i` zsrcu@WkOc@LS)t7_RWe}$qBs7`Wf}}9;|X>wHsf#@wFQ{9^`tgDfEpS*SSD>u*QvV zRd=l$o7~v!#yXkn-Pj=Vop7VDR-Qd&e(%N>H!i!a9jCXtvCWOsZv5uPb~kpoambCs zZtQepmm7QC*yqM>RsT`=gD~}ttUdqX`^66m5Bx{}=|B8uH;(YUOZi23OnB6dUwOsl z{qr7~=JB-7gFTt%r_zMt@8aip2qI^Me+thEE7|_}Ka2A+FSv1$)5(#4Nl3yZS2O}w zg@3tmP2}%19&2Rd_>}M<^(l!>BcJI3JSgcwDVa=??Ln5xah*GIio9{W*eNH^gM1Ha zd(diSPH7JcJgDSB_f45M*0FOPEA-&4F}5;_FDoo3EH5nbpxA>7;uVE<4-66Gx}Als zq)dMJRatr!VO0;Rc~CvYn_5p_YlzqMpq5Bey&J0IL0u2(d9co~HS<^-6xa9gr4$-S zX(FWSMh_Z#&`9P@!kdMSg@INXEDU35>f!HgEq;p!%{{o)gWEjl!xlZb-Ge*m^&sfM zogTFCpuGnU4_bO~mj|sqXs3>~@}P|f`%JOa=pvG~X@w?5DlAS9JRW#GaCzXCm~y4i z^uXtVUzz7G&!fmBsXQSM!X9+;ptA>bMLdXk5ceReBvhC@;X%@a4pLYv)eX8j@}M;A z#4a9m^`M6bJr&k1ouRwZGT49J-b)=|!rl^@C*{4{gT5XN_h5tv_jqux2M>8L$bf@C5cJykJnF?~9xUyyZ8>_PT?-$Zs8BYA3fOP!CvtLLRQ}=vS0Y(fy{$x{in3@ z)pa|&_p{6+9{l3Lj_dZL9{lRTF>&sMf1HEE&q+C9JfMpT%~KM8^Wbzkj1{Rf;EV@< zdT`x?3@^@laL$AC94-%zT(|GopE+=djV-cowhZI9J;fK*^d;eC53Yz@6*A^853Y&- zEo_ouP%Pm^rWbv7*lzHGe@h3ib<^aMThfbCUSxTZ?SctYM21nriy0ZlL&pl4vzEj!GK^IIIx_2eaWJjam%=0syw-fUQP@z}NO+U* zibm#UFPeC*x!u%@4qkNhqL~-Bc+uR;zh}bJr}BT!w%z8%?Oueu2zzmd7k7G5*K6~7 z(fMXu3olxFaTiCggfT0Yd%C@?l@|^#oL;o{qK%iI_}kig(awwZ;uHNDwIdl6S;$#j z>Ws$=w+I#XIfbSgVp~2DzZU_KU|Q#wA0l3S(J=F!{#J>4(b$$76UK!JVN$rRpqSn+ zMI}0U(aVe8?7t4Mi?FM(o3OjEhp?xR+R4 z^Wq6FhI;Xm7cYA;%!}b(9Llv#@?wO>kOMg0YyIWKlU_XK#Ynd6wXVT2UX1l(l=x^N z#mTWe;y5p!Nh?!xz`_9Lc~+U96Hf5rd5LUmq8BfSe|W3)qWVQIPHfNMuxweA_lg&< zdNJ3Fd0z11o$SS1Ud;Al>fz$oI5WL?Llvh`5n=W1mF?5Sr+e|H$P6!LrM)vn3d-cS zEn!{DZ+oq;I}R3qN3J=-cfGI`W_Fc6--`uayvHN*f*-t2mB>H+{IZ16Zh7GcUM%$D zLoYuc%=^rXC0=|azDP*%V=oqqeMl{i?D9GL1K?T8~?&nl|c}Ir;0_u6S{k@w>BH#B#a!{)5rnYhL`#Q|3j6i5wHT zCQ6u?oN1IYt#RgmlVzHKiIOHRZ?&-^%X^tdmb}>}Y$gt5!M?oTTL`DF=&wOMiUK9e7HKRk%?POZ1`WnO(q(f_-dl<&FZ-~o7g+i z){LWx{8|Z=#in z)+QV#oF>{R$?8OATN6j76|uwZOl-PhYj0xwGuE2|qRWJvgJ8mIV!-sGN7m&Xc+C1* zUC)(8rmDvtDBsp?8(5(zU?OND&cQJeG7&bhu5)J0#Juaah>32$m#+P0(U~o|QIj*% zMlx-CZY8%ZX`+LPE+)E~=xCziZDpKQayyw=S{mbg*&mH6-`NCl)TJEO`XQ%iZJ+Yp zcr0gfnwQJ%X`+{jekL9;(OaGAL*z(m#bYP$HgT_s`%Lte_sIc8_n0_2)b@Ht?uLoE z{y@7O#W z^KdYSRYATFrF|&ySzlD{lWpghnfW-B4{uqqtPkaUXv~iJP~M094>IfeP>+#YvWk4x zlq(ii@WJkbAzo2f%ZExnRQ92Y4^^eq5LWY{x(`Iw9nS9Ye?3YWHUBl$+uAbg2;7A5?sl+ntE z=Hj;sZxi0`!yP`{>BF>AMoTHo&_aaDT|SVLP-KSIJ`mgZz%LMzu!q58HvYz~y$=o_ zzAj}rg)X66=n;B_3@}Bul`;Z81bukYho^i9`4INuF&`fHA)=pnis>hOAXV`{IDqF%$sd%MYGsi4VBrwq z!@@^|j|$o1weJd_5Fg6nZEHQN>7t$tlQ>*BLU@0cG17;peR$P}$x=r7Fu{lCeHfo* zjOH|uI951L_>6G8keQzqdCtc@6Rd-s=)>kLquGgnp7FjQ?gzo(OL;}O zuo7PLVR+e$_k4I?%IiM7;lmUkrm`nf^Jj3*oVA{CPV-^94{!SLOO|n6&5_g{pFPuu zSw6hw!)zbk_F=9M^L(KGj&P0-uOu^Rvb?MODL$Wl_JImZ%EhpX*~SMx)Vv{gi4O~X z_>cprDs25z9~Pzg$383;|3nxvOR#*F<_uoy!{(y7qJ zve}2NQoi?L3s0_eBF$|+Y?q6vn4e{r54(N%iF4bBAAI=HhrK@R^I?y|Qhi`f5@y&h z@qmyWrhZV!rVooy`I*;|T0D|gmSh{h`f$vLb3UAxc-)8IefYzN6F!{u;grPF>3C+| zmTmkdGu8PsKKz;X(see? pcK3w+UiVqjl`XwD2J9AaaHQ`@rFOMZvF~g4%e)#icnn9~JzttBKlt3n5b3k1Bpt z6lbkUBAsnURX?ivQQeOkQphPXpr&;4T2lIL$s(tht~$cHe$-1>q1eEW8)e??M?(>c zH;FV7vc<+C|K@4pM^itV`H|`j<4K;d8N&zIxMS6=e%z+`+x@u1k2}R%2xqE?EyYuM zEAiHTwDF^@II}HmV10hq&X4wfIQ(!*UvbQ4`mxMrxMaG89zVS4T0bf|0|I^o{dnEa zT}cu0a}NQ;{Ydx`QDoGQn8;?^#-k9$S#6Mk04 zw(8;Re&Ve4fFJ$+7$9??9}kKARD=ipU?c+uN!j19JUQDMq81+(KH|rtB995_ecTVe zN+cQT$1p#)CdLRI(Tkj8Te6v!Cj!zvS)pZ{B=fB&55#|!dKO2<64EAu6F;AP<}!dHcpg|7*3$g$@0 z6hEf=@sl5i{Fvs)bU!xvv6-W-m}HLetskqW+GhAM(~ntxyyeGiKfaRpZ9m@eW2qmX z`!UClcl}r_eXbw#I3|89^kcps3;cM`kN4$jUE6;2M%zxOja#lAZ(vKAANui;AB+6> z*w3$e{^J^QgN>zLaRE!|`nFH}_>^bIk0tEq1nX8y(Y(Pbdk5w%^WzIYR{6nA6_#^0 z=4XGY=B`!63eMH7S*>%7l~U+pU6$1{|BhyUE%J?UO=sKYr%)^W!f+j`%TmLBa0|`$hP9j&anFU;Q}d$8jmAg(rk3g{Op! zWZK{SU?HLThaYD+`TaP{wbZ&!agJ@}7#FyFWms=~&MT4%KQEv{ye#DkR}U$Sxw@+S zr5vL$*SO~A-oLo+M@9fe0Tc&NBA_)tfKnovLIlt_*XjvNRseYc#WZ6b#H|LDhE&{V7*GW3k_k#0C)Yh#1F?? zA9Kv@SX?z=z00l{z$fD~s|8S9W@vt1jR5}qCW9{WS^?BntvYEhUG)RFA%Kw)JRL!U z0B#Imb_j2W&@g~T0X!JQLqXicLuQ@;&IWLE08Ik?jWa$9plJZj0&oW43gDIixM@cF z02~492bj$RxHZ5pe&CVj_S*w!C6W3a0o*CxBCWIx;4X1SGN8418(~{vJ7Fq@zar=M z8q03Ab5C`*^w|Nt&7&S;_i(fWFaz)f;18g00QUqC2p||hrvN%DI21rEfOr65nGs=B z$fmpI8VT_ZLhj(5k>fM0J;UZrL#p?xK%av9*W_cyFLN*44{`x zZXMrSBf~9}`6F(6|0n(Kfc2Yh9`d~b+!w$z0gMme{s8&~@OS`E1n@ur{R0@p$q>MR zfVJhwK%S0(wH5P~J(&-QSe@CD$?Z)@ScY)419&umhXXipIg`IYXLE0twfg*+;yG^Q zLjxGbGakUx0Ss4Xo)V4-;K_isSqf`$LmO64?Se8&-q8V!5n=00GB$v5G9S$~XmaTI zv-f8McrJj+0lXH#gaDoo;AJZzCI;|A0FwfEF#z_Q@hm@I&U`7&c@#Xe+<7~d{8i~Z zQf_VidH`<(Fe8AO0Za*CY5>#ay{v9b3xI^%XfxrP(%E_b#GWSgSpmGo1GiZ%(&UNY zuZiDL7{AFgCxCZ#(ajBDe&C;N+viE)5C0cvDBk0_<2(;$^Vj{nBtHmXVfs4d;4BK@ zV{2fsF@VLKgaLdiFOTKrT!VA+1{*#LU`YT=IgxtU*U0;M0LudSB7o%qe3Q<$B7jxm zU#69n%vsi22Ubh@O8B*qsi<@QkbEm;t#F-iy>NqYS0if$W7!nIF)5pc-v_WIfUN;+ z3*g59_5`p!fE@wsE2^+l$SPD=b}4?h@CPA9diOFcfS&?5#F$1_1yz`ECz38HM!ioY1ZCC(OAxx&?KX7)AltHQs83v-RX1Gp}4Mi2<1WYCH%5k#g6 z$A>0MsUUKK$dxxMXpLL8xJ^hiFNl2cf*?wZuok_k0P@0g&T>JN55fqdVi4T;r6_29 z_B1@(R;+GU5VHUFAWAi}o(bF5W>pHJNf7UB$*L@Gl_07HQ7wq-GV26UBVDUDJJ~R^ zrp#JF@YgpqnS`Wn5cPtnAH)qoGz_AVVj2W-qev<&g*OG!IEb77KRxB$Q6;Zw5Y2+P zC5Yxh+{y!Kkkc}V+k)Uf9h2WKh5U{nMwQNHxig3s;`GvFhP#3wwhE%P2zmFi+3kX8 zA4D>U4na7Aa0Zc3A2#P293q#vJBVL$4Nnl>Aj}|qK}4lf^ve|vA|NH0)3PO|K`d3H z_p7abK|CPRUpPR>$blS_#@4IKK|u@-qH+jTLKqUn!$Eu$#G)V`3F1*s55+&mP6qKr z5JQ7FlV{}S8};&yjfV<`1<~@4tnop(^Nry_j8O2C!qGuIB{EX@v~W}kk7tfLo_YVl z;xR#tp*&v<^VnPtl2QfwYCkF9?$mAdws!TS`FLl2Z z#LLoO34&${Q!a9n*MfLm>Jj@n#TjNtqD@<7bJ_R4PU?VJelyddVwd^F#9H{Vzw&RXvU@xJ&6X=S0vhkR*t-p+uJgIF9yaR?Pc z_#}u=g9zqX>-J|sEa3tYvK}xl4dQdI5<%<_Vp$MhaIRjo{TRgZAXWsiMdp`5tPEmZ z5bJ~3m2a#H;_D#331YRpUkQJxV`IfN;@=8Skmki8E^z^rc_oOeX?;d%<1cZNC8dqOgSZ|ob5N-+~5kfMAj|z-hoys*1 zSvSO+LueAh<^rQ>2<{L(Av6o&mJphUaBB#6h0rR5+d}BwzckC8A>5wkcZmE}U{G%n zLd&#nD>PcCxg&%&A+(j*PS`$#sT=ZHrFNlJ(J9d-{I-8K6>kV;2!RlSA^3DGJcK&o z3_tUn&1az*3gOV&(y>ol=8O!xx2oHtuXb6vmxXcz05)KZbbs2-^5Sb5$ z@CYZsa2pjC&x)+am7mFni98`3Dx9<&XzF3Sr;-8B;dP=aSsYR!}ufLsUb`YVR{H}hOnrN!7?j^8R9dA z>m*WtD}%NrnPs|FSK?m_kKbp#X84vTyrMYrT`5pGq?kYwhn zmF0G%`IY+C3&q_b{18HeFm4Rv#}M{#9)?jI#$H|p1MSyBXmO}`UkLj{I1s|wvc~VK zevkvsD=UP*UusRDt;t{UqqPyD7)P(vq_OP2abhsoR`T*85B>X16YyeR0yX- z_)TK%az=w!tiJUrvi%Xl8Lmhnke?0VJkNsoIbp1vagiq|gsUFzSR+H;k%bR12e4 z7`4NwuCSV6)KFnUmi6Tf7Lt^n!g^uU5943uhW~H|Hw>du7`KOU2Xk(;9u@L;nm2{5 z#lNxeW?>UyQ(?0(ZV98g_^n~wCXzUBJ6z7#TrH0qKi;XnWt9Kt>Sz&0%P{T=qg5EK z!wAaDhT4ST48tX}Z5ZvsXfN&v|FbhcV;U6YxWn*-;g`#suIm#q!(hPaOL-(yGp*AR zNb4byurMNIS_Z_!NQCiF7=yw{hS4F6-eL3!qhlDI!sx}}9cL}|Cl=>*R(zK*y7B<8 zROlvTbL8E{dkA}m@z%z?sybL#dBdt6#@%7`4dWh(_k?k882rz{2gA58jHk*Q-L_}- z595C2?`CpgTojS#*1OR6vo40JQBv}Fvf)OXc&)$@pu?d zaBTI8lvwcr>!s;XHmA(Pgu{g+gii{aUbezUhOxZ7@wAjt!VmtmX2RGo#)Yv(y?Q2$ z@nK8|W7njDXBE#X&ncLMh4IgaF;M|8gz?^qtc{MsM|RpKv8#U-@N$w0GgSSd3HGH63y9-u z*k*)%u~g>gVJs8* zB8-(H%Y`e1UkY8SvMP+#GQSGr8uvo-fs{-Y;i!82ux;--j`&mu=mM(p$sW7Uol5+nG@Ab{>erUMn(E-yQn6 z$oQ_v*v+Y1Q2av}o07JxMaGX|Fw$OZ>C2)(+u{xS+Vi6k{=QN62?)HUxg>aI3{vjxTVWKzu`I=#;O14zlZS$Z$=U8nmxk{ zjq7j(*%6%ObSgIf3gcQB=fXH2#)U90hH*tYU6;bRoaU^{LXqXFlG986w=gq;>k=~} zmRLfVstfUwYMmKMMXa18wg_?}s2V}F2y!FHi=cc2MGDIomWiNrx>i91g=x-TnzMS@ z2uR9Bu%LZ&b@EKF5Df*aCGgLFma=Mvg50%D^GZj#-w1|L6&RfG>5o>4QRuQz0piKmAWm0j8v=g?Ez!8B{oOfy# z2C%pz@TB8M&$Ia=@JA4dAR0j+f*rqSazch92u7^uz#+{~D%*ayUP6?(CqEWJJc48d z9U|bqF%%OKtS>gssc$qps>9tQ=p@ov*hSb?*iG2#duwg%5kb!gdPUGX0{5LcgCpoe zZv+D)SpKK&?g;uua8CsHM)+q;+1HjA@aGsaTV~Hbmvvu++b`!l5W)Qs^owBDu*`8k z+uj&aLyci4wDb(MBSa$w;*ps1W!hABrE%uk%c!u zUHDW4{cB`@nw32&g3%HD700zW#xPq1J!0q?!?*~)jEXT)jE!PECqM+NB3K>4a}i94 z;H?N|NAP?E6C-#zf>$_)w`c8s(EftPYElH&=4Qf|g!5+PQ{g))j^V3{nJlFFS_H30 z@P^DO5xkk!r}9*aPZ#oSAcJR!&rHY6O1pUDdpm*;B3Kx~I})F(V9a4}D;V!aFjr(= z1oK4}MDV`IdntS}n_--3#1A9*D1s{$jMS}gQ3Rhv@Tn4h9Km9dMHQ@B{h2t)iU^j7 zFOA^y2$qQt>T5m0`$BxV@MqQfQk<@pY4NKFzUJhNqGJ@_M6f1;TcT(l#kUIB7(u;j zrPuPqJG-$?xL&wH_?>WAO&h(NIOQVvK7uU~T!`Re1Y0B67QwLyjz_SaR|-#4^U_Bm z*crjD2=+y=U&?Obo(O)3;Kv9CtDRlorg@4k&Q}cMUfpvjucy3U(&Dyy*>r!Mscr5=_m@KD2k#uio$ec*(l1SIS;&C z6yAg>WcMG?D@0hL79P~|At5TBeZHVjv<>}pX|kD^`_^`oev80M)R zMa?v?CBpbRQPhp{XD`+fallh8-VjB@C>ll4ART`r&7J@B=cXu{NN*g)%~9;saj}!E z+cb)1QJ9DG_aDe+p>k^!w?*-8Me8cKJ&Hq*m-9s7jpB|d?u?=Zo2Z{%qN33zik4B_ z6~zU^IP^lnk&4-^qG%mO&+0iWQ(q}D>c*V5QMBVQ*2-%ig(C`Q6s{=TQQh?_8q-`h zmMRqu7Pi%=qG3i6ih{%^^a}$~1fv*M(V)&k5|$o`A{s?3ig*-BDKDgB5>b#FeBtgY z&nlgw=*$dJ43DBq6dNiUJ=o7Ex~eB^x?2?8#hcZ%-X`>lqPNUPn3g1p2cqaNDyh$x8NBp#Yy#1&d5~E`h4=IqZlP~bQCO%uU*L+?Qu~& z6UDM9zTo;F#j{b&h+<|G&qXmIis@0jso>{@Usp0Fa!8|?6vc~COp_R^WW2;7RkoL< zyb{H$QB02FwJ4@UF*SdF6vXL@B ziega|A4d_cY*1va#Zi0`#iuGGrKE6)QZ0?*bCK!Ctyc@nqgW9|ofzuI@MRP$qc|JI zxhU_{wpCHiU~_rfhvY!$J3u9)pn>_{s+c`hXW5XFyC9F5}FDE36LH;SJXvrl+1il3s` zpRRQvic~7*JS6cjSB$im&9NMj`HPUQVV<;U%ZVY)+W>qm( zstRir#84PR8R@607^SNkjjI|Rs~QhgHOj|OB;6iEaSYE^H7dw_r>gNS?>*IwqT1Gb zC_^IqP)Ve+a9`A#uBnc(pCr|#Q>-CUQ&>w_I|j3wbqJRCWM;h>>Px>N2JXVtDuxCz z+!#Z{7#c~xEry#!nhIH~vB=HBCNXPA%~ZB#G29}tx$suuxE0oV$a1^PJ7Tyqh88ij zlzCSw(rabl{!}cjV`vjY+Zfu#5R4%dL;INZbxNPmA#}#zioqR&Cx+qGa_K$(NVb>9 z6$1%Njjg5csb-M)V+g3qH&rqi##-SRB2v1=5RD-gL&q38#So9-a>ty6TqF!8CM9-= zVQe*nW-3YN7#yRsyTs6y-tV(0ep)$$gjKq$I=6D_6+`bB_QbF^hCV#T7*_BCkKyhZ z`o=IhhSy@aCx&}@(wCRu-zzjMDt%uJ12h^#%Vysn1F>HW4~UTWXQO8_Nd|JjV|XZr zK{1Ss;prF#tJW~#5aGiyJQBmBF+3K-6U-39=@pT z;hmWE9`HTk9O1jdxiQR(VSWtnRx?-_vp_lt&G*GWh+$z2AI9)e3@Ps-=^qPOoxv<5 zpQQWqX$+riP6hVNr&Tn4LS=F9IUK{!F&v4ZRZaUTHA?bJ3`b-5HHKr-kH>IA zgfF7#9i5eb@;@e%oQ~nQ^tk;l@<$A3(n`JWGtR|uUS_!(#)TLziW_lUV&*_j$v8^I zaXE%7Tq{~-UyZ?A-S|s9I<>^L82(oLbuRvK@HbpjYUgIe(L?>uj017&jzE(-apL)` ztT@WXQ7(?`IBap`#E}~Ze@$E%M_wHHaTKUZ>HlE8-qtBdDU2+mc)mF;A4gFfZ&WvI z<;xVuaXOl9kK<~08%c#YPTi78GFUyS7)PZzDk~>bRga@e9984^OkOJ0pbV_$TenYZ%<{kX7o(aYGyp;(H@FrnnAzi#n zHW6w(&R;aU|pDAXg_LlXn!M&R~|#adb&HP4US-w(fj3B5#j4ddAT!j^1(fk7Ga_ zeW=GVX}MMLZpGXe$9t#q`-?aSL9 ziepe5kHoQfdH&!yHveKhwi=?~Yd2X7!o%Wop3itxF^>ru{AsBYPsA}aj$v^Ok7IWY zpm|VmjufwD%Q}SJOJ(2i!}^hWpBkXJC3)dydx~AX-$|p;_nLQ3g-#u3oj0{zaPg3aeN-f zGG5W2WiO25Be}>wlv1-x-l8}@mbjSLln66_633_F7s^|6W=UFKnijth`6`aD<5(`f zLinX{rErySwXkJP>vicjajc2sXdJ)B@ogMy2&m!!@FCwW8){ez-JdU$c7=MDRVjREA zJSjXSJgs&a@Q2Jlx#a$weMX%9A*YMxxj4?paUqV23b?9(OTsHsE~l$7en?&>3(4Pc zT#sXN2fWq+83~j~V0jWNlE_Q|34E8p#so?xP%44i3Dikg$HmvrSqWq(U`ybunudRA zPWc3K639&;PXXnG`9j8*PM{!xLYZX}D4W)g)ihWbz><4seo+F&2~?2RNT6Z@o0EBV z;U~$w>*>f!2~wwKPj5wi`Z%=P)lBN=C6D(vu*TNAh~ft%QwT2}X(CD1s5o6}|!nbe!ARx0Ke z@#aDX-!9TJfxATRNZ?M97Q$3TW@wc_n*`cQY%OHnb|Q`hoC&lSXA`L^uK(M#CjoB) zW&*wh;t3=Y@Fx&Zm8dY7Kv*Ostf^0JBI0bFW=x!0!K6MfrjkscLjoP8cS)dY0-eM= zr)xdqwO(X)OK=Yyi=-;{khiC>m+;Z)<$EX4C(RkzH-UQ+cs7CO61X>k`{bHj%eX&* zehECBz#|DfAd$fX6X-8Kfa6fhVCh-Qcrby7Bo0boun2VqvkXa~(sR~RokyiVnZQ#C zJeI)YGM`9bSOP;8JX8v^4VNIsZa2d7$Lb7K=2C-E8K_ypJ) zdWkF(5_mp=HBu%f@InIf6IhVIn|J0%-jSQx;3rYEfLb~19>|0OdMn3cd=3CvdHzd0GqNETLkCxJO4@A67XV4m7d zc^RLIc`t$Y6ZnFQKms2murPte34EejA11I!ILH&mW zeoSDGl=*!#C=&O}r1vM01Hyyp80v?_4=3=m$R_pbC{J92GJ&KuXMRoKSOUirIKfph ziE>GtOyI*6h36BvAaW{!(+T`0{(Ayv68Ka64`D%VgTZIT&k6f}S=dzK#RM*K-ADp1>9MB!RyYxF)2FW$Nw4EF>8U&J@xtkwhrn1d`|_o+WQi61hoaCt;Jx zY>dBSO$lON5~Y(Uke)AmqPD>n3zH}#lQH8yu}x66@<|jWaZ3`-lPFH2LK3x;sFQ>} z2_uQBNmNUsViJ{-sGLNV-aB#0}!R6n3L{stW7gl*G+RG)bay5*(tF=~PV>)+~vu*9sWMQm&41YZA95 z(JqPhN!*^q9Z9rKw{m9^Et9w_i55we-(h3?Ep?1m@}{~?k@?$5X)6rXu}-cd31|zfI!@`I#Dx|ALnSw+T$s}eZF*At{ zNpwsieAJeDdfX|Ao;>xMuAPNlgk6Q*gx!Tbgpb(KJBdC?Je;h#zDeAZ#Ns-}_jQcZb&PwHxG#zOlgO)UP-G0Te-ZF)E4CNeq|w$t0diqHkSe z1jV|>f}gTy)ip*Yv9hl5wEAORp&#e(uWO7+Vyv1QT+cXL*BF4(tnq9V@ z(X5`)ZcA3Qp4GjV>lqW0cs>aRPfVg|eIrrdcp-^NNi3>oY-5IcM!EXNOG&((A)K1TG?6L7A@z;vNxYfjb&S{Q8_Vh&+w1>xADqQj4q2Zj zzr{-+iMJI-bDqdMNz4&>S2$Pr-5%>X& z`aK!^f$-uaK1pI}5}!-_G>OlWSdzq6Aw$#h)Ws3Pi82rl$7+xA* za=>|YcR-a6Se3-;Bz7dRQ!)GISRMN+iLYgTBV3cjw@Iu`Vx7!w!u3gP5!sN$cS&p% z-z?n36-LjHkA9HN@_iCSre)d6bE-nVJsrG@7ke4(PU43oF4ebwsqv#+zwOOmb%U`d ziM>heOJYCQBCa_}97y6|66caQpTtl9kF58AlA`#&$9MPQ?(FW&5_h*ql5@^E=Nxys zr@N;ob~i~t$vNjJD3T?EAW@JU1SClgib|B61VIr5;rIHD^ZkF$`JYqgp8M{5^{Tq6 zx~3;}XW(WA9%SHQ27b%HEozJFQvTZ+xD(}1Ud2QPg!FqExF6M>#l@oxJf_iO#@n8Tcmye=~o@SbM&GwXbmu z@i!Tu7*gJ4;C%+1Zn)_B-)$?I-1vY=tQ&obi#Rvn26dQblYZ|<0r74)+(_h@1a{F8 zC9xTKUz5z7-ngwPE>f6NtsHJ-b|Z@$S))oeH_G!b?y|c`ikc-3{SJ zPB(Hzv(fkrUX@HEK!qany73{qrZMJoBflF3-1OmILX-OG1>Gp*Mjdt)cB2TBDsIqo zOp3Zu+Kn=96m#1@zbWoU#Y;I#FqUK_vlPb@DeFc#H)fQ`TyJSgc^2Om7nR(&S6ozx z#JK4ej`nm^W;0uf|IWm!Y*u5e?nVtJHQlI12g^Kyjs5nY8tS@H&yD(SG;rf1H+s6! z(2YiJ=x+GjXzWH4H#)k}$&KPAL{m3fxzXB>=!W1`DH@wut5<+7aky82X_f|wA zUmg102)JRn(S=)~ib0Cx=E7XXa3j)Hs%6sAaaXBhUES!;Ch6TclEQj0p?(tY}Ie0!EOw3V>ky7rRkgGyf`>^ zm>U#NUMdknZH;ncv>OxLnCQkBjvvc;j^1=qXU4fPp2dRG(y7on=+@*f>14TR|4^2iTjIu2H>D<}E{2Ruj zr{gJ@$~HE?jYjTpV<&fDmmB-s*w1{o8+({6Eg|+&Z+RUaaN|2S&bV>bje~9+a^obs z4!iL^2cK}`2rI|jIPS*LXho_{JYrI|A2^syI#Md9+&CRoDDoUfUSvGa87@R4smdic zeqOg!&R1P>Z+hK2PR6jiYs2N@&8o zsf1<{nlqnLA1x%@y`5uaNfB4-zgM4D5?a%tvDt=6TM08~Cs#Zj-$6o031JC_M33{v zcjugRv)}qPvv!t{A;B#{;-Wyd%>0=ENZG!2h|1N*FF-goI%d zD2((7j^r@Hh&hJMDU4$!jHC57B7MAsi4rC;pTHPth>}o0CrfzC?M~%d(-^56)0r&j zobqW@`JBlt3A3ZhXVQQDoFm~27U$BQ&t#s2`4Z?rsEJcK?UQsN>pPi~`6aC@R+ca> zm9R|0atSLWtdg)=!b;X7ID{8Qgj3x$?D~q4T&{T=Se^u(PKc1hSRf%qN?2Wagv-z#Asll?T^ zJz~fk!GjXMXPuNo5)Mas#CwFzqY{pBe<+5U(@VJKmJ%mfIWJ*aI!;Mg!Uubr#WU0y zCKP;5!uY%PSw>}RDRD`{j}rcs@J_-{5-v;lS;8-LXr;u1LRnu%&#Yf*HA=WH;R@%u z%J_g!gd5BsNq8*bCiCAU++uQD!W{|s8Sk=^rL>@Oj}_{`0~Q}fU8FprO{uhaA>mI6 zzcYWzNa8ale=t60oE}d6E9(7+$x8`;N0nDhUQ3`bs{SUbzh#B=_Yz`cIAkQsh?VWt zwW*q`X=xG19E_P5KVXb!OknI@&W@*&#AZbq$ugWWTryH*6qHd&MrIjVWC$5KWn`6+ zO~%xlj&vE>Wz0{oyJ!5>O#oM{r4wubVK*qLUmSv&L^j%nC86{+tlu<-R zQ5om=IdkVrE+*rzJXzA8JBrI7q_+B(7NumAmQhB=o12aw?>NfJ__|u^=0}cl+(aM` zlJCWrm$9_8sK7|ID#@rUql%1AMCKYYYRYJ|$5B;AH5mi*Ip}T=)n&xrxAWJMQCmh+ z8FYj6Ix_0Ys4vqKLKAkB7LD#EQ>jO;-;;A0jK2!FQWq;T5pu? zjgB%pkt=}q0d$s;A!Ch(uQa%2NHSI^SgAmk;gRu~2cLVO$WUqeJjmsNMxB%~g(gvk zF2hG{$(Sg^FC!q^|D_!zBglQGL+&TzpU;v)GQu(p7EK!V(xMx4OGXzaT^VnewqL)x z%jhBFBN;te>?5NWlaCpDGg4TNGU5~FM9A#RJfifMF@OeNw!fmKGEByxC?70iNR$s{ zLf@Ybk18XWjHIQ)-@Ve^FGte|gwn<^j%6GtW4w&_^IfD9PLeU1R?F2m`VUm8GWP#l z>Cfr(@2Y7srqjCe*ng6mA!8F-yj5N+@Haj7>5=moZ1imok>f z_#%3Y3uMe?K96yJRHvK^nJ6=UR2TM?w8 zi;%Un)T7zfaW>M|v$ElTYHgOWMaCf+hh=;tV=KE3$S9_{w#nEbV<#)$(nvC~Uf8b` zyJYN^u}8*U7VGeobuJ@T%ud?J%GffZ>yvEzWe`&QcXZ%o#5za9K^fm2uzx-By^JF= z&e6$BO_UKwWgM4rg6kfWaq5o!sn-uOPO@@_6eh3A2v=Egnj*`H>t#gj9Q*GQXX!L7 zE8Jzp1v*R_KgqZ(;}XaJNRid-7X`Ddy{K~f?X*A3_(jIAGR_{iUuA}t6`Lt12VCP? zBwnu|uFJR~vOmoEWmhj`_NrcwSDt=dgU`MT`f8q{n&ez1_{6 z$Oj%cJ#cvt??HkG4i6GNNb(@rgC6C@k}^r7%8UEW?4NC{Dlg8I7k`!)DIR3zB&i-` z@gS=Q+1SihK~$|Ef)&Js3L-lzTPlbg9{dsW-}~`27LQdB!)nF|4`M0`y03n25At}> z)q`#x_Gt!3VKk3t6%smt&j&LJt)OyVa6hiMH!1R7H2HM zn5&{F?Liq2s(Mh(L+=h!%6d@6gVJfSRVs>d9+dZ>0x1_Mp879Xx2mVQm>HfWjzGI}bjpD2PxYu_JpUyfgC* zZis^2(H190kEPAVRFyV=55jbS9&BMf-kav-NS)Eg=w}Qt20d8lj}1kTUICvc9Uqt3 zWEZt!G3mnixT5Gz3(12~9*m}bvN+O%SzFV4M&o;V(A$HL+5E(V0UiwWpbwjU8T&Ez zXS{U6@%JhFBlqFC7;%f|k~f#C(?|L*(1S%D9DZU?t5Hc%S?s}=oN5WM#&lvzVcwZ2Rm3<>%sC$Vv`5!*!-H2@~>yI!Gn!VB0nVC?7`_ug31;q z-!N`v+~&czOfv0Hp@5wpEIpM-UwR($V3!BGJ=hb?yw8KZ%%AgsQ(ODlJiz!JF|)0oWAi5uE_-mE z`2~87_TUop9~l=pQX`qe#bSSEh0H4+{KEX#s6q*^GQZ|Qq|xghJnQB-@-+E3+Wb98 zQ;@FUwg-1;lT_eT>@R;m`P+U$yz9X|5AJ*Lz=MY##3}awg&)zfq{UxZyrO|Ro%+Os zr&T0sE?1r^j+&_F>U z9&qYL&8niXf+7lvDk!F4X%$gXL2)L;ODQN3olVQ+2bq}NqYPeG*V2$I-P z!O7&51Lsp4ad2bCCX7uPn<;3nU~i0lNz;OrmW&IR*-9G)ZK3aAPdp8_v)J*o_`7e2{A&&vaUyXEEkXs$6f9TJe^(;ifSN{(_5^yk z&-c~Eqv|4S4Y5kWYC0)YR8+A>!B@0FsSqmGDp;rBp@K&WzE-ea!M6&wE7(9|b<0UN zbls+4qk=hSQ#aAzD4B%n{;%k58iJ!3=aW!m@nPO3jE z_=V1n4XM8>xT4@%TsrabPva&(jk`)FyT~N*MzpP)3O%0=w`l*T!Awi1a*xR!#=F$9 z1Y5t)@eddqXST=Wv4SV`VxgkPwZz{QJXP?gg1;z0!QENOcL$~s{=xCj8DB6`MY<*L zT)r!By&B@Bg1;5KQt(>AKXeqT-FfOZg}qVmR>8jt-f_iP)ozqJ|DMelHtD!Xq!Oos zI2g(NKt((UBrqnaa4;cP;{Q}kW==U>DpFK*`Z--|?w~c9S+!SY7RIcM*%-4k=3q=! zk;a80)f$2}uAC~0swk$~7ZSM`bF0Y1gce?26(6d|ry{@l-zQN8RTN-O@sV?<5SxV= zi!ipK{a?j`$uZ?rlvnZTsl*bDB^gUGmS!x&SeB8p{YQ( zMHLlQRV-AoNJTXj)m79|QCmd~6`qpzby`go(+Aj3=cIC|vHh;Cj*74fLq%QgQau&* zRWwjBsjZ`(iuNiRs%WI5F?*Y-Xs+6~ZE2#SDGkW*B)Pw%gc{RAMN1W_1s$y@{#N4K zkx7Mr$VSg;ZLOk>ind&rp0e7%Q{1fS_QS9`sOYF7zo(gA~cZ z#JzVCssE;meymtjOGQ`aJsBx~Hx=EZyoZX9m|y14X?sQW-b_AL@rjB)%=@Z{#88He zo@xD63{Wvp#USd8im@sNbJz&R{x!r96+@X*{4iQ|HN1_sF3BJzhbhM)?RrRm32(MR{7JOv7)`wo3WE1&-SrQ*~qM{-U3 z(6(`^ZyC3%*ui8cBYAhJ*d672=mcDDU#sk=!BJ64Lun1)sW_Tv|Gh5zYl`!%kKk_SyKG;k(yv@DvG}8kpO{=`{FyOlbNfV|S<0TZD=MzC zcumDkYQ3ho&Zj4>@Ea=jU(2z)rua?8Efu#_+)Zrh{%mc9R~c*lgAh{TYKNUVl94IgOsF+xKojsATTM<*|tW&TZE zH$BJk0giYL2^`>{fLfwREkPCUw09(HaB9e@A(sZ1h7=9iHRRBcSwj{LSv6$S(6*Ks zQ%kI=CC=6ouWO0CwMCQKqDO6!sv%87x(1`ZV}yRHJoC zjJP6oDIl!D&|q=^c`YX0Y2ui4(a=>xx2TumDTa=Ys(+-Rr-okaBE2^)0B$i7LqjpX zp6J8J*jGb84gEC?(D0dt&uQ>A4AL-0!&nW2H4NdfQH(=13};fYOx!Sy9s+Kk*CRBH zjEa38Ws8WTS&8s*v@$hJ(J-FH2^uD9n8ci_Q>y#?)}HuO4Kp=-s$rUj=^QYFBO?KX zRBM)o+3X@tUaCbnN5dD)mur}-VV;J?8op#@KI1|S3!=ePh03C6^(Cw?WsG!~yvzQl zhbuI!WH0Hfn5@>Yte$;#tktki!w))6>iAm2dJSv5_{xh7v}S1Kc+uXAO&T_9_*27Q z8n$TohT=7x)UZ{Wl3fc4*j1OGv{3+SoPxyDIJ5dSbVR zJsS3EI9E?hl$`rD?4uSpq`jyos!mJmzbNh2wxoj^4r$oralg*fT-+ejk!x$e_w{~u_080C+cJZ5~t_&Z~l2I3hL z>d7BWo@;nPBV52P`wQTuhQDdc^&-`aR~lZ^5qa@}7yoFuekVTGi@2ALH(c>8i`=Z_@uC0|((`)pA@h7uCBGMgIbp%5Qpk(KQC@_}_ixha`@0%r z9mTz%-@upfqNEq4yeREO9WUy7QO1k1Ui&U^HN7b3MR_l(u~~r*#EZ&aRAI9cFMq*Q0U1|!9gPGT+g)@GB!>T%A7UNrKeJ_j^lj089Kq6wR=ylCo0Gv+P5 zXwIYsBV~>>9q9&DZ0$uGcD3c?)F>6wJ9yF2i$OF*UUc%JvlrcIsJ+PW+FQNb3yECE z?Qh&<9wJyGhjfCi(w%Uusi|pTSoylUK!gNFXwO*{F#jm3b?f+h^r*m0HvW^X2 zY@`iDN4$7_kE_iX#i|^Qb!iyigILQ1E_125;nNy#SF*)MJQ6}oK zgtW%?P#kA-LS3AUMxOEF6!X)J6*-I|&$4;Wi}TUQR&$dtdGVtcPpOAq{N%-DFRplT z)r+6$O#d~BV1Oy!3+Fq9lY={-({J z_I$2O{iH@;GmkX!=6^E3^Wr_dDCqWXAEVnxN+gy^B$%>+y_p!vO9zsm+jr)7=t$J< z=eE#q9;nbyhVGYk?EELqsl%nC7{{mR$gHCvbDt-Tp7EE3c~-`3I)=@!6MK&wx zsJX>{U8_ukrlYEkYC1aUxH~SPx{ew;TIgs=F&tb^M|~Z&bkwHfVx?{*Cw2H#EEUSr zKu1FzO>{KX(TKf`|9>$Q){MpGIwG}5iI7&Tx7X2HM;je&qjlRwBXcI(tx)N}u8uk) zN@pDzI@~%W9hwd=du2w2(G$&}vKeVnkMe*HAFT>DBMBq@39{0su`qO)IwtCv#EPY3 z?3=VM%!zc>(M?Bp9X)i6&@ocSN9-D+W2lavI(q5ot>a@I19S}3@rjN;I{I@=U&eln z)T>#I1r;I@h4>&HgV{@*#7O+GXgn#ynI9@)p9NG#=@=jNj@B`Ty2@rG;W*}$WWxW5 zlXZO8Sh$+l`{5KFQ)#8`NS~%-HWT90nap6EspC^7vlyQ?78LLq^UoRQFn+-}myrVK zqlpDN7V0=aZRuE~W3i5XI`-@KZIHjzu|-GmCSnQqYANF~#^pLz=vb*^747Xh*6UcU zV-1N(&b2ze`kz9|y}S1BH`Z}QGB@bhNISod&9p3E#*jiK5xEWYU8tI<>IBuW#7Ip1y+|a7c&TM6A7*ewa$Rup5k57_Ty3W4z8dnLB@z`EQKW znOiz;M|mXRo{mR49_zTz`h%$Vp^iu%s`Z4$XF7h5dY>|(RDUpe9@R!|OQhdnl!^tLeF`q`)0Pl3X*Ae5x(Q8yNaFCOVrNrP+=miAl=R_ZQ&Gi-sy>wRp){Li7|Z)m)`xP; z?=%%uD3VGAA1eA#$%o25kQfOdBwo#j>OR!-p(eLm!-rZ-$gHr#{`Q}ccx^W8u&Zt~ zm|XRJXb_F3;Kn{Q@u4XzbeBI;#@|ct(=n+TE0Me0xAdWv4;y^g=tFBC+W0WjhfjTI z>q9#q#`!SbhxQyV)8YHj!H14Mbn@AML88Z3(KD?mZD$`cIL6H=F-Ba952_EneCX|i z=7ZOVF6`BPcu6zD+{c_uzYhT)f^2r_m_VQLk{I^E@WJFr%LgiUMc!|TboHT|58a~~ zdQd0%OOua$=ozgNsrxa_MHc4}#!r0c<3nE``uQ+`mAQW=l9x(BBCboo^Vo`ml}3w~X5vcQESFf8Fk8^N}4dfkI8-? z4lwzS@gO68T0#M|R1W*_Jy$1wgvn6~U~)XF7bq5Y(uY$%-1Xrejb0%KJ;?qvd(ZfA zmiB)i&iinKl?#lQ880$kVx;^(GWm%jx#^#M_{E1`qu#4NT#0gup>oZK>rsWO+>G+y ze7ME@Hth^dC@hlpKAW$jkq?+W^x=^Yk9~OJ!|$xTWPIww^JwHVAO2vT(A*xD7e4&S z=3h~r#E9!}A6`XkQI&savuZBhFurB{m+>7Vx!(H_j!8 zn)%V(j|4v)epK+IqTk+r6a6U9gm{u4$$mK5bor6$N17igY-VQ6!kE>MY<^_-BS*AQ zU9GvGLL}V}!C|HS$mvHe=EeQU?MEIz3i(mkkGy_-=tn+3^7}zIR-#%|I;b%>o5dEO zT90E3`t4h2QokD8&krMlH8L>o>Clqv}|mdXsxnL z$}!$L8@H*sINw}UqOoG74t27ned$8~HK^i8RTir;R%fi?M@=TR{HX0m@n-f#ICY!e z5D`9aF6#PG&ky>wRei<=j1B#0#H9UUx+H@i9^S zQ2o%Dd;QR(-bj@Q`dJJx2Duf|!+z9nAq*BxMlvnxA@i$mtpH9G*qF76@fFo(3 z7E)V&EcW9|KfQa!*Q_t~W0@bT{8-KAaz9qmeC2elh}L?@V@t{!KfYquI>xnrPz)7v zQF1bgtmj%A7$X@r`?1B3SAM+q;~PJ=`thqDSNz!K$G3ib=f^=mw)@ezr5N5)9LVEb zBRh8ZLAcY8U4HCl?rSOb__5ayBIKg7&yW4=I>1OjmL`$9ambIqUc{f^4jg9up799d zQO09_9A`rD^h3KJ{5a{yDL+oL_!C|KGr7okmhl|pdBzKjRG02$eJRR+jJhsIm7kgX z;zuO@svp-_x#!3AXv~NU2{)MEWc-cs7UONkJB)W3sl~^)o%j8Cz~)27r;LvnA2U8- z{GD-LOZ$|3#{3UIp8N5_k3VUMXhZPhZyMnO$e5Q-NMTfn(3b+F{Nu+PKMDp=C}6wZ za)tr{{OiYomg1cs@BN4gAU1%U0ptoGE&v3OH9$8xL8bsc2;go@;be>tAdyJ|Bk2w% zpVvxEVv-!y-?kL408-e@96%N(kzlGtVcA(pkH+Uz4QtQtTyPEMQ(1@wHAa&TvA zO^&Y>Kp_h0dxtVYXIG%{ro6^?#z2I2KN3p@;w9S6+rI*PUW-@c`qZ8J{&eU zfWA!n1<;?#fB*(Y6#7qb0E3uQHu|sb5avSz7{+9H03(=CHVTVGjtXFO0Am6e%dXEE z#|1DcfXU3qGfrTfNGqqcJyTQIBr+?2sR2x5b9w+X0+`7>5=M8$`7{8kMOWhyWp)6c zMeCAI8Rjs45y0F4<^?dHO-g0gni5MD7X`4GMfzzp#eW$?l%_R+?NI)X92tj;Lia52;ezKQWYxnr;NXtyrff@O{zGsjd(@ts(B1mq(bJK z0N&DO9z=W){|4|bfS4d+gLdZk(VkEk)r|`RL1YTrOOX`vQVjJW(p3@@f=CP^i31#r zi z!xN}(b2i&Bwg{pn6Vh7+(VDrttst{4^L9~h`ye_*`4^)TI|q>w#GoJs2jLFVLwH4( zAiC140LRGm5)g#KJjAF5p#|ZMX7Dr7gYYq#$}Li(fgpm>nB8qfILeJ6Oy*WpIo(!t z3*uQ@d%iwq(w(sfb%se##$JpR)|&}^EI{#}1ks0wx-VltM$-ESF(8P6Y-VaFsE{~> zrZ2`pWq%MugBTX1yI5mH5T6C{c@QIm7{&23f*8$YD&v?S#s)Dii19&8Vuex_Y9}TH zF_FyyFH-7o{>ed1p>b#@$V-L7rUfybV15VM&K;`lj1d=bR5AeIL) zHyXb=XL5w`C?nlD|9B85f*|rk5T{x6(!*kcpxf!6Vl!WRaV8pkHi(FLA&84X{1n7x zc3leMM<#jBJ4?2=r%!G#eh%W7Abt(v3cCii7oVI+r)LUW4dPl5f3QfA*Mqnn#2q$o zFy3VRjqw)a@8xheh8bHaR9-OoGl;*Kykw*s-;wKe5dQ@6AcTh@yb0nhol_z74B_7(-UU%Fg!&=84tS(xNx z%*vQ8gzQXmFs6r)8bVs=|9cBVnFYHdt>j{!n=udLZJwqNL&z6G{%B+|CIvz$$fQtI zFC0P<=0zFBJNv|;QapqbA(RZER0yR*s1!ow5Xx{&dBzVqh_WG+V@~m8R*3S7A$p9O zy;Q1%P&I^_A=F}5wGgU@P=k3ShL8#+sU1Qc*6T)dMqHGHNP`d>vbRSF&rT*a3ZWB` zTy_(US#QGFl(AU|%|mDrLdy_Zh0un@*8hWfxNmJ)X~#%P`w%@9PIO@G$hf_@qcaVA z2<{Lh4l@|#5WFGi%sn9}OsFSn2paPSoZrVh$moy81en-iOu|u%5d=f&RkbNt{k3*QlcMcrdLC_D;`-adjgzX{h z2%&!n14397!r~AHhA=3Exx_n&!6A73PAW4)7!tzJ5Qc>?JcJ1$OblT}2qQxn%Q2%u z7#+eG?gn*W_vJXMMM$Oaz_@WCjAvIwp@2ytOb%gM2-8ED5(4Qx^QTUY#uOZAUsund zGcJEBaY_}*N%(09vqG57k)LtXb3*t$T9NWl@E5ETpT|crpOFq{K?n<(Q=YvY#Frr~ z34w-Ua|laASQf&D5H@nE<&0|>SA?*V$tp&wyE=raVf$kKs}Rj6Q;S=;-ESDTGH#{W}A^aGE=qP^RDnu?aIT^yK5Kf11 zCWNygTww7W2qRL<5k?~Gt}v3AP>hpFGUJwH zyDbV%VKXyhmM|J!bdo-xqiE_B*}@>q&baGnYFZfSVN?vGQWzqPmfywC>nMtcku!{3 zVdM_mZxZu_kvEK!tzzvrjC~Wv#l(IXM!qoehcRQAla#_7Rv?UmVH6630!SoRgcMtJJuz}_F;5p zLe)Dk=@>?*sPacgk-^-}_Qv`7pMV|W-N!WhPdl8{L8|7(&snuEu1-AKUr zFeZdCF^oxJl<6dzbh0;)$d{XiJ0?x0Wtp5ZB}|(trg5z=!k8PT`)=8bY6j!XFg|56 zD~!*=_&ki+Y(^eaMV!bSR;UW`dCV6v&X4K~!dMvPRAq6Le;LLS=1Zf>fuL&z@%pZs z25K2t8OEwGR)?{MPF@2^2EGboZ5ZdnxDduVTIv~gSNDbSHJ$rMQ`d*FA&iZ*<|n07 z*%ihn=9|OV62>=SYz<=vE8D{OHjM4jNa7T~JHbIE!gsRrpU!*_aS?toj7zkI8i0Wx*}JxrcoW7?VO$R5=P-T=;~6bonwl`K(9X;;SHrj##{DoJ zgmImfTVdR0awAN4Y{qZQM|Yy92>tgeb0>_uVccUq5)i>iz{4;ev+EJpC6O{jlKjs4 z)BmYR2lYIRKWW=%@kP}2lF2K^zZoMLsG-+v{uAxn+c5qO;~k5XEylom<~NqwryG@6 z!(Is)nNu!v|1+`q0b@L40;7ZRJ;x*)2o!WUJ2(m&aI)?)kYdmWR>_$SWM_qV7FMz{ zW@9W{&XI$?sRq&vq#F@C1pvqx%v1BB!y zLP);>C}g0pfg%Qq8YpI9i(lZuQb4U}b4im^0f8OGu<_V>%>43sx8CvSGD zTY>eKF)_p|F|TZ(N;H^6a#iEjiB~sJgE{4)Qrkcs!~U_>k6logNfQH24b)>^pRoZW z#WXa~h^V+_nT@R@< zfrf1ym$Rkptn8>~B=@Xo-?wVAL3hFzRl<%Lo|tI{rW=@HV5Wf!8G`=P-L|RoLo1Pf zA@Hd|w^$eX-E{wUF^l_5v|s_ho@Stqjd zw^WBamWH&Mmblo!rOU429TLB!!93|)!g!}x%5noM3~Vy6nRb2ys|>6)u+G408j7Zl zHME3i(%tshS~px-h9-2Zm9X%>v!7dhZD75D4F+=bblw=3_}3@S*>16so8HOsTMT?- zV7q}G)K-V29PJXe8g!RtaoH`l8TghXDJ_{h4eTZ}PWU9L+NvdpIVO zWVgPbd8G}BCxR&jSvhFnkbye}?ix5unQ06STr_aRz)=II44kIrUDtKYzzG9C7&va= z9xs(eO5#as=#h(_RCxHcv#v9xx+I!DbDc48-azG+j-o?cXAPXA1D6Dq;gTr0-q~+{ z!X?`L4O}sB)xb{%E>kN5<9;>pGi^uf5*JD0J4yUvpvATLE!W}+|JvaiRoHROz;y$+ z4QzQC|BEDU7P@`Og9oKuoT4O#q7dx&gjtJNgsnSnoe#OOBW-DQ#cW7nSs z{xa~A&em}9%wS@t6zAtn9aXZYjFQD`1OFI!Yv5l4dlooX$YQT7-Wcc|WABhv$~xW| zh&2&s;ypDji&&3{F+up@W#>361t!{hM2B`s1wEp=N5q>*Fzx+(u?dHXL=$ckl8Gb} z$tJ3rsAj@x!et`Ai2^24Ok_5Z!$hiyEGDv=$Zo>&h>QZ+%TIQW3p=uzpg;5#ei-vX zTX}Z!y3X!}fJ~VN@h+|S*s(B?Lp9#W9 z43UB+3YjQtqMV6fLTX_XB~47;<}6~OsEKnPQOrbf6D63hIqxDRQkO_66KN}4rA?GE zG4i5){XnI1`-Ji)DwwEjqKb(&LlOp+bI_btH0_zKWa1BxpxZ{JE25(!K0oPfvDjJN zL=6)SOf)o6(?l&3bxqVW@p@cRA4SwQQMity4jrQ+s8AE#Iy;_bO092V;egn_qZ4Tc z8<}WKySjB>tBoI-AI#8C>tm)YQ@SWBXT3E>%=gg>1q@vtweY z3B`nJqN|B+CNvXX69x^q3EhOxMA*dqS}A@L0Tb&_J3Hr33z|5YkP@Q9&q$d4RRVEE z6~reEc6Bb}v`lp2&Ub$wo75zW@uTC8lrUgaLU$8AO!P6)*ThFAdYb5EqBlp5SH)aa zRPB(kS*3sRi;r3S!~~Ulsy%xBOwf!BBs9^Vy{VcQKnqW^z03PJhmUdA+3FljL&wT6 z6T@jpP0TVef+m`lhlwdBMwu9GVw{QbCdQDrc*+P(boJU7MPq3$xb6g+*>?7Cm?xQ- z$ehe}Qp%Y-u7iQNsV1hGm|!rIOi4TO0H@{>SFtV1iI0R+0?!qP3`D-&MnsOnDD}+r-$3S-%AsJ)Bb58kA+vX)zEHi!DZne z6K_mpvhab0w5?vg1b>}8iRiG08&v<}oyP#FH%$=BejMv5?t94hyLk zvRKG!A-jb`r(D~0kGcIxpQu6yZlT~F*G-?OW?}wG*VA@M`{%^e zv{1{!Fbl&i)V5H^g3p5ALR|~>EVQGcvrykc0}IWm!xkEH=ganvZDe8I*yQrNT#YR> zp)pLf_mHL*npvRjx|o(gC3lXbmKIvELL1J$oe8Zi`*NtQg*Kdr6sko^>L6zaR@@dO z3mq+Vve22DZt8gD6OScFh6TFbt5-i^jyqYl;ITlvjmA|JnhvLZm7C}nDlGuNaBX$b zzIK-F<>D`gK42B)v^$_(9J@38o-tg!$KDeT`kbLY+A5r?)-wv-HWb; z{ajP$JG=Bt9Q9KwE&fi;96e~1X1nIKb3B-w+{;353!hl%Lj&cvXa8dw&n77}vpsjX z`f~RMSQu!bpM{nIdz0)>%Z%T546-oTqF;@QF&nedp$*{!9BSdkdM6zt6%t2S7-?a# zg)c3PvM}1hYzv>!`m`|C!bA&`D0Al|dTTt+!tGNeN5)J~Y~4z6Lf~Qchq{48cw&bX-PTE zhd|e3r!D*P?2H9^4XXdbMej_z4vQ^O!*Sli1zLv|u3ETAUfRuQW)C?3A5&KXZd3KX z@4au_bFOnPF4tWZAySdZJd~8sU>;Kvg}cWy?K55TJkRr(F&QcK4%{-#FvFQR*1aHxnC7xQ3FrvXN*<4x-Uds z>6(4KkYD@C{`v)V^96OWD4X|eCkkjvt+WDyvKXXkk#En9nEyOw6EW{s$_@xl%ImZWOUn<1xNcM$7{91^Mg*ZCFU19iW zHnvRWgff{Vzj1DM^IqmK7Q$2pN_e#z@U;JGA+E{zq5rkpd;S#um*DUh)!&7<$qRvo z;uxfhG-eceB};JWA6_?=eoOPjNU=Q9WAXP44YT0>>i=6=G!>Z^$5 zH8fo7ub`nqX}8mfl{8cq2kz3q)5AM8RMEK4sV4Sy$8%KVCgFHy_dPXgU;$9qwba)bO~5F0Hfq#MeqgYYimh`neB)eAs+K!;|bgQSPIA+iGa1 zp@W8wtfrm4y^g2720jS$8Nb?xzD}$lO=-BX$KUsmr{-NA9?E>(F}qJ4|M**TyK8t_ z!*n(yUDEK3hNy-ZJ3>QG4gEC~YIsgVFFLQGuZHK@cZRpOhCcKmmd$&B7c_j`Pj%{= zeMBBJ&-PQi-R)v|`)OF;$MbJL#g#$Rplb+f2x%}hY;EQ@HCSx({%YvY{uY{tp{R25K0@TK89D7I>?7Ey3I7WPdf4#c3F(fwyY!@AYxS4!R?UPshEi?2#HqagJ!1 zs9`j%Rq>A1@V1>bMtUuEUr{lTH%`NNc4$|{K;b0z0?lfereQKiEC+coi?`Xw`@7@e zLVwl#8(*<-Hm_?lHO$hmiTWC5YnY?q6^>X9b2ZH4z|*jTwbrme!y*lf=|f-7%zFNX zRIsw{_qaDjMJ+rpX;?}J+IdzKW-QV0Z>Q{HV|>fRLyqcZRSI~iTB+e>4XZTX{;AFH z`Sah%t6HcU6sk6b>c^UyYc#CYu#SBU&FooeSNHdPoY}3-M3l8dm8p=*sEa+ zdriZ34Ldj)HN4LY!DF6_g^GJA`)~L@;JoYVWB5=AjeNv5`N6wW>awAh|D#vEyV$Bd zGIoo^Rp_GjY4}*f0WKGGc(MNzj@y3T{jBe2zMA#?MN9p2y7+i?`%J@O4WDZ`sKKwP zPHXcHr3p7Zj%b)U-CtExRi=5r;JPu*JLyLDmm0p(a7@E-4t@i119{vb;hfUZQO7qL zzSVF-!$}QZ9XUF_<5J1#FT0DUxh811s^OZ3?=}3O;TH|(HTx;U3E=&bxA3Zy}gpS!u{1pXB zd^-HXbJLQNI!XyIts_rInY8>?A!P;g1Fi1pt*qlt9aVHx)j=V{eLC(EUQO_B!FvSn6|62u`!#f~#)?^L>bPG=EgiKbsjZF& zbkxz&T*o6i>PkV4bTrmcPk4R72BO?hN6Md$JzVF>o9JjN3J;3H!@?gDY$ixe2A2D% zC_FCMLhv!cmV&KxwB{g8o2C8}B7ahlWj&>%O`4~guASI#FGxuz9i4TY&~Z{n7ad)7 zEYPt~M>ieabwqSHI-b_iLr0+wO~*4jp4IWZj@~+Y>hAvv_F}Y4&iOkFo@1)!u59a~ z{sEfmqvHh~FY4&4W7|Q`&_BzWb^Tnpc)NJ&(d?<3>ZgO)Uy!+U9fppej*t#hho!^T z5nu~%_s!{?y}X?#=R@z_C7#R?*-JF_QRkdG{oE@xLs-X7P4S5)sw1XjoR0B2;yMyK zhUgfoBdMc^p77(3Iy%I>yl>~K&h6!aItH<7ay!JU;b0vXG&QPtsbM;X>$ovEd$bPj zw~vs#e5@O(W0Vf=?X;-n?o(Zz;2EQ1td23eTu;b}6Ld^ujdV=YF^P^<$(gKU3Y&DJ zx0tTxj`V&|F5kO0yYtNw({;>XFX)(~^GGgxrVj1}@#;KF?C3}H@6_GK%&eCCVCU?) zI_Bw^FG<`NVqnrDPC6a$>DZ#>HdQJw2m!^(F_oIQ+Km-YvhYW3%qASMTWVt=A?&`rPC>_x^bSHA`l1 z<-lNj>Nu$5eH|a@*sWua?tVe$Lwe5E)3M!kQtgmJkLap#H}5VTS9JAlH{ZQ0yjTA! z%kJ2#W1o(1oB8(Z_*k0yOh?ashI?c73D+4R2XyzA^;1ET4u(3U*RJw&tDmEkufu&woqC>QI>^5gvI@3ujG?$k z#Cuw8n2&qB=Q$vCT;jmc@vF4JM~12#^R6}2MTwG(3;1}0w7YWt&Ff{a==g)$8o zZm6pqS30h9QMy$2nvQ$-`~MVV`*YVT+}6XZEsy7J>bUl#C&NIlss7>g8JhjOq5h@) z2|kh!hI%s%R5DeTAoCV8P~1Q{0|f@M4R{Rr4EPOr4R?gR3QjDq(q^~G9$T?1U->KUkSfE8cX&ClmP-T*f+(C6*!h6aCTrGB-P_NuRm zfu;sp7-}y|Ufc^;^E_uWzeIXx3IN*DUF-pDhiv zqS+1}_Ity1Wm_9~LVSDNKnGhX7U#ahG_vY|v13e7%W}yb2G4L#14X9oQR{xpN z)4+35Ivf1oL4lrGb~(i3Wyolp2_1 zV7P%1^w7Xq10y+R42(AL%Er8fFXsMmy(}+z?`7nx#o0W>JR4Bs42(B0!EldXeL>ay zcVCk~%a#u+o}o`RFvY-fj%@=|4flLxKGDE51Je!6Ffh}=JXWDo_AIIFqd`SJTO=fN z49rb)CRviYkk*1~v4NKiERt}nlDjjogq1aTADFd_EjiQ2?cCkHecZ^st(jkY&Q;*$ zk9%tslv>5Q7riz zZEUx8p6#>~Qtun!a`d5O|3I+awp>cC-YmN_q;?qKlg>wiN5#}`t^fx18aNkHIcxm; z4BTDY^ReOX|4(R@LH>zwMoYZw{nWr`27WVe*}y>qhd6%?{Al2?fzLTT4SZ|3=W$02 zd}-h-u54lT1=pOgIx0xdk1lktT*nM>b66b;t9`RGelqZjf%67_=18dLzqlv+tknG+ zT@9;J5tUylpBq^hxFi~Qf0TPFcad|an&*;%CK1Iz$?pcP7|1k{W#SJ5R}K8bm8wqW z>%D!~IM*WTrhz|MK?Bzf++e%;{eN?*i6{~VT3{gIBExO`f7#I{rf&81>zw0j?WV%S zEhchIlrT}uL~#?@Cb+y0{waH|IKUlaj|rY`cm+wA%V)xG^0I=GCb;o+d{dr(y7!HU z`ZS_$L{ziC%JMNe&qNs$Jxn}fqO6I0nl47qFtBKo9lsDbYsM}23 z<0v*o&UXK@+*~$h1rx0tb%zPFN-iJgttHvdII6OVJ5Ah8WfN6QR5ii<I7TBds;u5O}+iTg~{G;zO)a6Ie0qo&?dmVx^1c9rFz zZGXKiuWohdl8M$P9yd|XM12#@O*~?vfr*AD9yBp%g_ny`BNNr5s;P;_CYqS|SIR9J zb$_M!_u>rRML)zQGTl>b+JD#tgY&Js;yr4jg^8A|povaV*V|rCWIkph(k>@FCxe^h zm)m7?$8}w1{u3siq>hQsCZ00U#zY4b9Zj?~!KIQXp09QHwlmS*#NGw|jU{sJs3JK% zwd^z3+)B-gsxIt1wsY9u&BU8h7X9JgNOx(mrv(p){8@=kk=CTPso1J=2Vt?rU8n z46AyU=oeE-aee@=0vy;e^-4@_+u}bEQ{0srY+{IsDU_QSYGRm)Q6@&4I2}`$O6CtY zF~Y=16IWv@FRmKK)pu*Xmkt#lV`8j{aVEx_yq4wiO9!3eidXzVTum@B$;3BtH6^Yl znz+{5|8`t4I$4CQ>@*Y8P0TYf-$Z6Y%`h>?#9a3NC%%~`X0iI>ZMlSEpg#Y8r=-&+xQE#$sm^d>CROjG`q9KsCeE4og)7n?-_It_nmEwa z!#)3K(meouJ}39Qi3=uvGjW+yph@nOqB?#3fFv9r^o`YTPS+E`Yoi^X~n3 z&I{f!&+?s3s;eA$v}~c8g+J*hZ+k4{S-5WE23Kzj9t(e)xM>0wZn5wWM-+Q@wJ*y8 z|F$>7au>-=3pHlDEzdxbI`4Bzd5T#$Ue`0ONR=v5#i>)IIu(d&*cSYoWY_3KsG$yjG-?h1P>J z%Tc)4UqBCAdALY&Jl|^JHVe0ld-RHAN0B>6?yykN!krdx{&D*N#n!H5q1gp@OTV&( z1_NB3s+Rjat`ATXB+AXhyDi*f@f}e#wQ#S6>a4qk+N_b~UW@OuP}2g>zm^YBd@=QY z3%v2;Nq3i48I1DE`+$Xd7V2B5V}X0l!~gKrwLsiIKsB(?&_bKeUhkW}Mwa{R+1SFH zm2-G#!q*i@*4)f~(85C&TCt{d)xyIT9<|WI!o>mVmVv6d)bSC)+XuS-KW4f6ExhgQ zHBhw_-g=;-*Sh+Wh*)qe4ExZ}Gy2>?>YhQWLa*#7 z*E-D~6J%KoNecrk475;0ua5X$=4=W;uAC{0eI51dlxs|!VFf;;vPO0kIUhEgEKAnM0J*h*=&&K{MB!9=iujq z6qnO^)Un(f)cF<`SXh`I|BEb~AEa&>>^AA`gB4fQx`WkH3(G8Qw(y>Xe8HI%kev;qUgK z=h?xkbN3RX?@${oykX&O3-549vm@GiHd>fI*gaT(%fiO4C5i^CE3N!oGwIbP3-5BK z56b2nCcNe2tq9*!+G1g=g^w+KVqu$w_c<{+ax8qnF~AvZ;UkMHsv6wO%j?B<3w*la zW6lSI6;G+y#no#2x#O|h!afUM4OS0U$=SnIuCLlF$V0kI(jfaS9AK|mIBMZj3!hmy zY~lBczQ2xTUq9oU6v#fvMPqpOA;C65|K}EtNW*e-kDf2TQSc@0vvhj9(6_#)Tb)Wn zRHGqoYai#}{LuHcAfqQNoV1_?pa<}sg;QeZ7aOP9j25cexXZ@(TtF<`VWXmrA1(aE z)zXH~#?KbcTKLVvWlk~2<9<21u{xKsAb4Kzg5a-$7X>c~j(y2JDC{^y@qg@p=e!%D zu2}ekM_*=-Zk!j;!j&`XX)$*?u5MP!k zvt-%$m31#xaEs)kSqh5_C&{+qvEjAd;&KEjEEwwQ`)%%QAm4^LHNT{dsSQhZ8>#{) zeWh%awvlI}jE%BsJ0z`!y3NZ#QciLeNU9RNRq!^!+XbmvUPuKSLnLn{$;IOC6jE96 zT4q6&wEWPP64h+nZDWCrg*G=^+`2Th(a6TV6lS5iNNAykjr(lWv~jH*ZO+w6W3FMv;vHHrm-}Z*#W?{cUa&p`(qSHlDN5$wrIcvbxylYNN9ae&{px zrJ-&%y4!fh#hl8fs&>jS=h}HsCey_S#uzcISP1ATPYV zETdnY$Qx~AjE(U&CeZD?oU!81n+eZ28-H9WYqc#wT-3fq`w1TXWZr9s^CsJvVq=Dl znKnQEo;B4*w#q5&jFBhvristfZO~!5JP3tBq|o zUbeBy#s(X2NK?PUj5c1gvD(HO8#(`a*4kKSqej&-i@Im=)Rh%~)syqOjl)yi7ys7V zcx;gSmxC=%d5Le@c#HmXl7foh>~kV)zQn|$XL&N zHnwm*36^0l29oz#W!BNgCpJE`vE9aQ8+&Z*u0EXGuLPcup{-Pv!GAF0i?{p4hm= z)iQwmfV*VPtvuYl#G#GU~>7jVBwQV@U&;MM?c3*hzuo(iB%0ObSRWJbdP8U=7i z02KqM5x{)`R0^PS0CxpYEr2@%XtCd0C4j18kem|MHzjBE?f~u$pt`8tBgoVgAu`kq z;Qj#W1W-4CS|X_(zym_4nNm&}tQSE202-w2vj}GYPoZ%DO#*l%fJXyp8o+~+)I5NP zgft7_;j|AaYyV|*oe`Z@0kjU_u>e|1G*t!S;{iM&k|(9U)TfZyQx?wG@U#u!=>SOD z1<*c#4#GPJ&_zf`!A=28AEv0&RiY%_gp~Ng+dWMv?2%4=CV*$toLPDW@P*^yUx>5N z=hLP44xo?l7gCY{`UbFanCd6d{=!p!7K(&PMgV32J%e~I2rB?PfCB-18bBa`U;r}% zn8iU7KsbOw0Spcx5`ZIl2MY4vT6k5B1`rD%9zY_1WB~PUDSO#pcIgXcihDiH0y#wi z3<#i8ZW;1(r`#`5emqPK31BE&Ab=~a-Rp9r7UhNo@E$+UJxmP`U_<~T10erxn7U)Q z8Wq6k01q!PHh^&fObOtxy?G4d1DF`VBzDtqHGw`4R}@Z8M^idXnkxEphO235GDDo_ zheX*LvjdnDz_I|A2QXLU{DRv&A>}%hn;*co;p*$*YC!azK z6=ZY;n>v8atWf|jbE1t0M?6ye1m8*iEh6s9=;{GQSfcScLX;HzRMo0=l+Z7mH@VLrhMvNq_zd{egJ#e zj3d+sqDJAa06t9f?E&ma^N)n=4B)rF-MqWg@)t*_y<%aX;KzcW2<{jBXugN`KMUYs z00`oiAPxm^IDk_DoDSgg0FDIkZ2%`^IcnLw;0v*Ql+86lF?<=oS80As$Z{Wg(2-AqFc7t~ipxA{Z)3 zv~m!422n-$hH+Wz$7M0;t{|!fad!~+1kpH%CPCaA^r5YEx!=S_RQMh{uC?B8Vr0=p00sAf6JP_Cb98KyDl1Z3Wv2 z_LEbj4ngoxpkol7M96o@X_L``jXho2*Fh|8>LKqYlBSjOpB4!T<Z^Rcf_OfN89~epqIVE|f*2CS&>&u*@gR~x6a~>Yh<-tYSZn?~gxk4N?lYrQp%6;6 zAoMghf-r?!LD=lObO?&@-chRKD0fT&={o#usT5u3Sw{& zJGXfYcX)@;fgN5BiPP`qGtktqAcl+n_#j3EF*1m8LHD9CN|1NgwMVO&qtxgi#<0Gl zTs~IFcca{^55IRjA&5;)GA0J`e!Fs%ObTLh5L3h^AD4>XT6QWY(XC~t2~HQB^i%$< zAZ7=#F^IQ=m=nZY4k5OA(0%Nh7sUJ^76kGAziwq02EkHBk55<6nF z+cL{|4dq27$dh6$9j*AUYg4`}SQ$ioPyVZ%XrK9C7F;Fxis0%X)(BZExK5Dgo>V?O zTD=wo@pZxVf*SM}qh~El(9k{4$8IM0i^8nBX@Y zz(T$jq}m%T%6%Ke35lKz;*^l@f?${~E>VY^c!oVFb_o?&qX7G|mTcA;`xiTnyq;5I2MPCy3wD{r*P~mxcc>ctx0 zr2X4MxIN_hUonL8Ayf$A4vA7igDIOS`_!)_7Ai{-&yG?2pRp<-R2AV}g4C=Q!rj8} z3E|!ls)xX@;MEA>zL0zNL)5JH_09*v}Y2n|9wO0^Igiskkpbf6C*G!CIj2u(w1Mdc9RvcN+jv=p7~hl>v%qZpcnaPd^m z!-CC2cti*#j|yoa_*e*Q-^`_O!x)t_HurJ*EJoUe@FXp-$^B)Fdk6B_81)p}JOq-q zf@9B?BB5IWIL21A1o5{%#MuxEDc=4i;`=asy!GR$R3Sn>v zLqZrX5+)55GK{#>%~<_D_b;j#Mugn2z;FmnZ0sEs0`cE5YHSGOLRb*O!Vt!D0FPCl zj#d234SRC}bwZfLE*`5UhcG9ExgksmVQL7|LYN-HCnwxty{@i zA*2X#z*wc$X3iL^rsZYN3t>K6@9&&z=Sn{4FKwL6T_m~Am+_Pzrxpu;iFFKNsqj|> zmkBNpVMPf4j8!W`SS1n`{j!j~W3y9awM5qlQj-d=hVWVlABC`!Z5zV+5H^JH23vAN ze*34g`;1e=&iLL8!GES8b}s*2>hQO;A#4oc?GWBcm-5bd-{hD5n?h(7$b2N^9wu&< zr1u232yP8wTL|w9|A0Mm*ta8u4>M`L9AQ3SJ7~ zHz9=&XYwt|--TZh{6p}nAV0%*jgF0T`}8l76d&($E_8o~P*?a(4v!H24Iv|poG?oL zp3jgOMls=8f=J765fZD9;%P~?5KkChA^d(ivzG|N7luErQ!0$yG%uOfEG?3}w465c z!zdRljn1!1T#T7}U%j9bI#I9^o=W7T+dTbQq@pnMp;$18>kVT>0-euoGv3RV)V zEO@72=BoUvVcZo)wJ`1u2gz?9C^+Xs?3VBM9k~U$q72Zy;@&rX83+))j z3p5f&r!YE)(M1gQ2;-SBx(e?m*jH{-Km^kjRA{5ip1f>dC5UN|+$`-J&B zV)yosyl)u&!iX^Sul)XD6bcE2p@pFfA9N(k2*V5`Akj;0vaK-eFi04fN_^&ERxmAz zAIYMruqcx|LMS1RhmiDul|tCaB?I zj0j_77^A|NCGw#Y)Mz1-!WbiDY#8G>0)ZpOBiwwb$GcGFjwP!k8MyG~pD^ z2xGc%?s=wso5|9pg=dE`Cycq0x)1F zE`+fnjFn;R592@>FNe|Mr>s?BydoLTOi-(Zl$q%E?3ysvvUw+{bz!^{#-=b{4dXSD zye{}=80&>>5PU+BZ6ND9u@pj@U0%+<1|&xH*BJMdStn;c?k&P+b~Xq@sqUS zNkKN_84mk2KNZGlE~+)M{;Hlu{5~!JA&eh|Q^+g~KTGs%80XSDzl6bDO!_s9i(xz* zLGuVMh4C8~zzE7m_>L&Xp7xizP%b-y-@~{f8UGOcH;k)cToeAM;NP?+ zZwhBY|Adi}lV?QSDU%sNRs;}!O9aItC@!2C8KpuBJrQ^#cxR%@iJ)Wz`4N{63Np2nXfiJYqj@4PBN-_vD^Z#vFBiedW%&gWC?U5B-X=%|CRK>w4$;4NlByU% zr3mUqP%nbY5xjlBkKw)u?u?*{M5{({kC3|rs|nsM`13?X<$Hx!7px&jA(MQQR83ZA zlDc28mSF7&9*Cfh@Kjk;pwIOqd^Hyh+GIBn$0%tSK_lUf1$Tbt_Gwe$4+=gc*zEtM zJ`%yB5wwb+UlaEh#hRpANa|yPEd^6g*4%&{HAy`Y!IKeWMv)ceo4sfgL4gD1plt;0 z*jy2O7eV_7Iz+H4f>$Ew7(u59Mn*6yg3b|iiQwf)Di}f62>AKtzGA;yggb$FS|k)c z8$pi(v~`h55s)x?>dumUMCwr48=kB#zvI~!!TTJFn>=lnmcG5Bdt>}a&5|ERuswnu5quQE z&Iop~ohPd;lhq%S)wI5)IvglfZi?C+!JY`LDQa&7A4l+s@O^aevWLR`5gdqsNQ0R@ z-H&?ze$mB)5%)g-NCaO*a43Sq5qvHZ-s-3B|9SI&G=eWh_?0M7o_ZoU7Qu0me;vU$ zLS{^HbG<2eV9NhS?9WrwDbAEp>hB0{MsQmA8S&)%2!4p*#|VCs=rzu!2+l_EheXds z@Jj?2xyW+~ovO}@kmQ1pUnP}M)`CdQ-*^e&$}h@S(mG6~Ch@B1r#Pd3M(~$tl3$PD z#{bj*CxU+?*q!g=M_`$n;h@@7RnkGGgDeMdTx(tjISy_SUQDpKgKP&L;j2!%8Jo$e z0Z9o54?X4gOOnq)^R0eH8FEF=C^ub8IVkObB+o$^2W5qq6U-N65_fk~{8k6IIXLU! zoP*mPly`7Uj8|}QhlAG~yzZc)N)9SJxYI!u2Q3}`Kmb)8+~uI2gZiwU zgS#Ev=b)y;UlZV72h|h;j{GtmB}rWUn~QjW%%5&_Oc?4?Ae&;M8{SgRHoN#tv3pE7!z9QwI%1 z(^a0PHrG^-PgC8dsV=`2GeMvV z+QH)vx;W_S;0Xs$I_T)2lY^%mv~keRL3{Sybl0D@Y>nxvf$$Dgn6510Oj_s3-hRAb z_;mHlj=ate7K*%^gHNWba}T+fo}Wb0gZ4{%o_EmO!85|273?YaoM10OzQ{z)J`P@R zFy6rg*1|zw2SpABIOyk~zk{HI5WCoc=D>D%W`yh+N_Sv7SUN))Y@Zpf+r|v_`3z+_ zARcIz^UDlXcBX1KQ@uD-g&jm3#2myO44tVQIy_VTI#aEjsiM+uBnb|xS*pt{6`rM* z*33!Lc+H&Vv(!KbgB%QZFv7uL2SaFqBgerjvsAx5<=&sAj?PjgW~RmO&L-Dj(j z4n{c`>tGyn%~qowd^THU&T%~)<6y;XmsFjjo}S}=FLlTqHPOK&2MgGk4kkO8;$W7; z*TON?!88Xm9L!{IiZkoys6%tqJTY~7j;b=(HPvyhn&V)ugLw|-i`uxkYV};TZ?3vA zSKU8PJvvX#SX*w9gT)S3I(XT^OAeMeSWaggJU>s3pQm1#rm+76)7ZpKx0`>3tD0 z=>rGUC!ziAf;$9165J`c%R!xmu2*{;>~*kD@-lkF!N>r@(Is*UnVo@2U!?g_Azuo9B}nDtLcVtJ4O>|F83*4xI3fI`;CF(j1Wya{FCA*v z^!&g9zfk=o5|SS!%0hp3Ku$v8FG9#~I5_X%f<%9Ha7D%}iRxa6R7sce2y?KcOP z9sJJmdAMNwLiI`25?9Z-wfIAnuR6FU}+XQbHq}z8yQ89`~qi7Mu z><3F!ilRysRimgJ#hp=XT9$Wpp*o!Dt-MIx6~%o|W;c!E)r=C=qPRPXd!o2EipJtb z^(bmYQ7?+8`b^9u8O8lk)QX~Z6ilikNb*2hp>A42BlU$ddjm;rDA-7_ z{UWt^ws;>C4|l(l z+cJvr^D;>oT1C-1ipQgvAQH-%>nYJ}6Ghu7HjZ-ddl~jT?~-;=w2z`g6dhTFsP&1W zvyf*6y9joTqFWT*h4&DAT96j{E^;T`Gf|{SPmwP4f>$d0Q0krzIbVWm?-F#f~UG68Ubyor1fhbQVDm_lRV# z;3sXeDf~Faqu3wCfhazW;v(x6#b;3*jN(ib-$!vMio@)|D87*@e;&orD83YagnhI~ zeIZEuUkN!bNfaIvLWLChHp<^Q;#6Asq>%5T_%A!jX%SMNxqgV^Mp1NR4%%4A&Ot6XmSdFi{dhu^@Vm&bMe%18SA_o&#Z|FPJDV1{>+N4r zT#q6nhRhglMDceN|3vX`6gNemm{KD$FfSzxSuuAmK#)T66c&#mJBFMXO2qzW!6Q0U z@Cu=aufLz+6Yh_>BbG@FxiPn8NJ`1nE*(Q&3}s>{8^b*@+#5rF%)Ps~Q&LIF#ZVA~ zis4p~R}{Q0hTCH(A43IEyF-Lq_GD3?$YHa8PgW%nR*vC6NflA9DtMP*HNm?DnS~jv z$52C}&11MPhMF-nmFWF3)DqHAu(p`37sCTF{v!2%MKF6^Nu{a!LMUk%owZ~`leGgA^l?L zA46dbRA%-R(xx7Rk=CSfJI#Ya0-{efhESUGInjw>h$ut_V}fzPgkUm;q8J9mFi@g{ zg$xpY$701mgQ;kp#cC+Kb+H;(NA(f;h!{r3;4D_F7pr3;856_U7|z7-eGKDb7$3t{ zF*QMure?>$2djxOOp0N03n}X}#7R-oY zCfniLf?0wjG%_cKxiQR(VSWr7Vt6Bl1u-m)VNDEcV^|c!;uuy*i7&;lB!-vMr7w+P zc?>Hgx=irz^6n4$$yffrXo^$*iU?N=riAN+zb5!<3@Ib8OO*QSg;4lr3~x#5mKZjQ za8nHL#_+Zj#6sVZRBCRPR7z-{_+Hv(O0q46_ha}#bUu#Z6Coc8ZjWI{3?B*K8N*&7 zyJFZK!ye(pMlUG_I!4@=mhX?@Kn&l+F#VMGQ^C(;I3naT!GoL*r@V&*4|C!V@-X^^ zBr(g^F&vHIOG*7IhGQ`t7tSPx_{0nR-?95dqhn@e{Lx5aUL9RI}dZw!dzmN+uv z$c!T^{=cW8KVMSCmbjL;ukuw|qKd^)JPsAdt#O?Fryx6yyg16lapOa;Ck}5MIdPPT zW6QCEu}f6RIDBHqA4hH+k1kPNm#7hYz2*{CD(?Q8^^VQn(xULn5>+xl}MDvB0 z6QqzYGuNE$J~H%5KgDcXqRPinA&zI`=qXw5h@)a0mE!n*iPBHzR~BK@I3A4S&N!;X zQ8kX6OH{Qu?xt|C=PrqoJX*$cPaOBfQ8NysjOX4sstc(hNXef~GU8Fs{c+TeS6L^HPk->%kE1~xb>pbV#;lY1$bf8y;vL*v4dZAOM`Lm3dcNDFM9Q1Q zUA$+hdPtI2 z6-S#m+Q!i?j;G`35l8ztI>ga6j&4$1$2dBtTey=DvwubxA#eB3V6#X5@DRJFbr@YJ zl4rz7D(Sg6dd1y$6sN`Ud>jLADHsvQcU$v&$I&N_7wAtM(;_7jarBL&UmT7^`^Qlj zM@YC9haN{jxFKl8VaH(#XWmXr6$1%FN*I)+6c5J{No!IP6&@3er{y%5jH5`R0|bZ0 zF))rn!UxAOLTNom69lsKlwF=wfo|GBrqiGqs9T!p67d^6*i6-UVgN+mFx3UOSG z<60bZZL;jDjN|1vUWudFGPO$VkkA2!AC@Ze)gpYdeC|5Yq5L)WY+A_Z>%wbDt~cU% zGmcGhyvwl{$3{tdCyuv;upovpjoqtQ2hpdUB?k&NODcu$#qrL=Zt2@ZvQzN=I6e^a zp(yVV+%8B>hL70SVr`eG(dXT9>=90DbnN3eK8fSYIKGNwe;fxS=?EvO`14sD2h$l3 z38Br;<2Wq!Wp>t`Zd3V-bm~!wrb<5+$G35ukfh^re4W<$MhI(nk|RHkpCo!Jj?-L= z;`kwsGa^YLo0`^sOy^ArCp?k!Gndmi&czXYy&M(j29f+iTJtyd_0AH%#@(N#T#VzA zM1Aj+pzyNj{4RJ!@DIV|gWWar&p7_#3LnS6aaWF=frkiabo6cZ#_DZNl!qD;+B6R#-e2$m4^3Hk+d1*yMdnJS$?UIHx= zcr1Z336xEsUIO(K$WLJKY4>%ng5~`G6BHz%61X*iyA!x4f!h+eJpq0ovPuHwg;Wx( zkiZ>6DkkvTGDQUjlFA~yQ}D?@3Q|c`C3=@&wFD?H{uu6+Xw3xfPoTPRTBsr9zO?aL zX?dLlYA5hO0?bG?T1b^xR}?6x{|yqTP+s+3uK4}shOA%}Poo4HC(uNA(*zzCLivM2 z9ujOu9m&#MqK~9?9u+cjy{{#2{uAhyK=*|EM&jQ4e615$y&?bc1fF1B5_l?sb_ujk zfS`b*hR3bAXA@Cpoi3GLINif+0P{K z0;35$n?O&IJSW&&u$SQTfNEV8H!RAGri9T11|%?0G-C7$bR^ zeMkbs6Br@Up@PE%xB7exBNG^%)*K}^`PU*e!i-}D#|e%Xq(0>n6L{uk0mCFAlM|RC zWNKPIErIE2&QCba;^NQVFG7Hw0(Fz9m&CjT=5u}}Q7nlC2`o(DbOL7*{5%jA zC$K$%9SM9stK3ToRQ;e}T>?wQhoyqc1eYhUf^#;3mlIeck_&%ktV-Y&j+})1C1rY> zLjE~0lNeo_;I|81@@fLFNtV|W*d%0q0vi%|LpT-Q7V@UxTY?(}_b*rP2%%0&@@@i~ zIYC6YC4u*aY)xRB5b7{67xh07$%pCaM+xlYyq2V03G7bb>jb{rn7=21F8hiz986%Z z@O=q=N|D0qo&lECEzsKD&h zAz|zNk-(n`{3ZOV;5EV9Zc(`_)b#}ZO@M^qMgo5)a5I5_M8bV$3cos3oS2dPpH5~H zS;CQ){8htKJc;ZiR1&u);YorLUlRT#yuumHNuop&H1+t{3`TQBUMf)VWw4-R5~Y$T zEfN+~E{VK!t};T(3g!!@3N1)GFvE-6lDIv|4`OEY>yhgZ`pPF!eub)##2ragOuE&- zPq0!Fm4)1yL=_=xww9>7LRC%Tt|Y1@ad#3mM1D^a_a;$238wP=j>tee3?xhR@Pl&KZ5|1U(Quxpns#OvzR;YmCJ{Y!63(1-EWD@N} z@|0kkB-*BwyOj!bD@C35BJUtbBb0O&PVyXUB)n@9-IC~@#M4Ri6iJUHo=M_a3Dn#p z87U;0w#}c4Qr;_x=S9DF5`EGcUm!`_p$>EPlcfHFg@T%(E@%k;B}K4D>?8src}m7o zFo{qS;UpqS%uZrX5>67)B!(w3B8gZM@g(?>uOUe!l1L^oFclr?D-tpwi9kx7h7Vqy}Lk{B)Wu}O?eVhmejl$+(C*cmTLmxND9 z85!l9oWvC2)024rMh3%FiB1#jx;mTLXCyH*iIfpWXC<-sdRdaWT>O(*oy3|X=5z5+ zVrde~B;&#)UgGd5^ejqZu}E0%-WwS-vP7c)d9^%=mqoH7iIqZV+&{{NL~@_ zQrx#TiFHZ5lffIzZGc}11l6WtPElF&ZTy&nM7}y=#l3-sj7xNw+>HAO=b_i}yf)c8c z5O*c9JBcr3Jh zoeM|)pM=q)Nqot5EQw=D9G9f;*%V29Lp%Rwd?%7`WjQ)2{DffY(#el;oRa8i!83wo zE4jb>_#ufOCHhkm=Y&xBvyij@Pwkf^Qn`L*cO-FV5vmm7x6bYv-=!peOX6}8zjMB? zRJldClEfd9*IR_ELT)7ScM{ix|H;Lfe*~9w|D}`RxegnvcI)Qlo` z(Id&EsWUFgDsr<^p_n9*c!U%$Lbed5GRxAMSyU#;5n%~IpP*l`ZHbJMMJOe_bP*~F z$tyw`A!UnDAcPk3g_J9TDgB~~aBC56E5hwXC|`sMMPL#GHD`&!9YtXHFG^CW2$e;` zf3(}SQdKR&UH?bccR)!|d|xkIVHem1NlO8WfJ8w+K*2{%t3sqexL49&K zrMwFz$;DsFh0^4&x#XsHcB!(&*NO6NN>R!=yn@UATICx=Ar(m~xlq|r-XwX8c$hO> zbTRMMsY+j!uZ9aXU3l!m6BlZ^@U{yxT$t&?J1*3AVTcPZ7wWiB*M%M~e995ub)h>+ zJr~|{p}q?ZTxjn?2NxQ;(8z_>F36Xaq%|gK=0X#arjB0ySE6c4e&9k|hqoj7G@Ru_N9pQ9NAgaN(wU@-3rW+I)amBvAGz=``6tBE%r>5; z?*5of-q!2MgOd9(_HyAf7e1Glo5~>K7cPA1!dK*d68gFfeM$Ng`w@Fiv(MZCE(~-b zL@uF_ubCA-*s*CY=q|Wj@VGE`np!hW9irb$L%wLfA6@Xd;CCV5LePcL)I%EF~@@ zipRc@d-l{73|G3aiexo0ky^*GwCQTE3%`)BcVUAI8_9PPH@UExWQz;iT-ffyR)%dj zH<|nnD*uVQT-fb`WJTHIIEC+%S8BSFvG%)gzy%=(T{z^zVHc)OS4XKFAs(VF!KHo` z7f!fv(uGrUo`&;XcHxQ(*Qcw~#52URE}V1WJbBg`O0pMRxX96^!X@fLuDWoI;sa4g z?l_(sBsYn-T)0iL;cxprG--Dk-gC)K&i_p%3=gUQO8kxZJMj(CiH?Em^}04$q_^ zv%_DXp;9zt(U4U`Hi|iksT#67o-_?&lOj1ZyvV*1N)tVoL zhEf_zYj|)ei&PL4C4ps}S(TNUlb3Up@+1|AZ)h0M%6{VElTDeM%~09qSs@?qam$q z^2mFch3_hm{MiguJA2Z*8g#Cq3|C)615Q8;c1Ucjp^1i;)SD9D*U(%;Gjb^+&KBfS zP52K~T4`vlp^b*MGt>vnmMWVpT$*^Kwb#&1!$%rAX!uY=M-81cbkWdNgUnD$b!IQ& z(oy^}8EG}MCw(lshR-y7uA#dub=l;e8hUByq2W`8iTa{TC|q>G-v7fJ+_d+@mm0p( z5Y!OT(3jb-H4N6!PeXrMe+>gE4stpss!2zg#t;oI4PMz5vaw~^%O<u21|x0E6+8yQPxdxC_Ud0BYEtV zOsws24I?ysOZ_`y;eU2HAaKrSPkPejMp$h z!;czfYM7;AqJ~KtrfHbYf}Kj)h@x*LkuEzl?9{NAVWRIY4ZAh$k@I?{5+zYqa37WZ zPDd$nP!7aMJEY;ToSVlpAJK4B!!dGshe4F%8cu2Qh+8{*f_PG{kPYoUc}6Z)^yFTb znt1o@yoL)Ju4uTbA-zV%iyAIzxGcOyy8NmsO?uUzspLJ|YZ|W0Wl%>>9Zk!n-H^Rq zS>4lclM8!`c$;{Kc$YZ%EqmGT%LPiqLk+*mm08CNI)2meyN2g-G1u^ihDRDwUFpx* zMToS=8lK3-+?D>6V&|DkL<#?-C^d!rE!Tf$g^QA;+bAuAj*R5eC81=}k%dZTVzLhD zl0r<>%&H@sj#Or|6Vr(K$|6@;jyyW@>PXj7f*u(zpN>N0 zikM$V0UZU&UvfOXxUpZ>AtW|ay`rPAjv`L>RUJjiC6$e7I^Ncy4rH#Wqf@4&KW3_0442kU5>cMsE~23DIyxHbXriO8j(2tZ>PxOi zXCoc&k<=$PAd0`CjvTY>j?%{LwW~E{sAK$2}irKOHmB+tFD z>lmP8ppGH5&2FDzkPgAGWu8aVGQ5&9SckmzcV<*Z=_SpjLrc`5-%a!oCF_+V3fZ%j z7SLhpi0TM38y+V<^X!?tbUBDAG2|PqUOP#c&-XbS&4g zLdUl{zSA*D$4@#&>iAyAXkBiOjUTwqvXY58jMA})6ou$k&eYW7O?n2+3L;g`xs=Jt@6!Qm8CUHSt763Y_*hz7PIYw z%j7JmYVY%vI#%h}qGPL$)jHPb*vxISR>wMBZu)JX1&cbWU)XoOjMY)eQ*|bNlsv0j z7U{lG$0nv^O~jd4nQc^d>exlHUB?a*@keH>-8%NjSvgznr?^+gK9aAF{=38FTsxrS zAXj5?k*snohve{Qr5)CBgwCTnj**BcP0F6saZ1NCFaGr6w2m`6KK9}hFV5;Xr(?Vu z6Wlnj$0J!%H#)oVSjQ8&D7o>L z8&75OI+EQ;apO-N&vj&WBgu`wbo{N`|0{gKjem61Dv~dQ8yVfUB3TKANCUYj!bKF4 z$&G|~qm?aYaU-i6%8mSPWTQFFjqLQKa-c-1M9my-xg|Jqx{=Fm|7$Xxn46f#4f&^J zUUKOo*?i;)rGOg+-6-cqc{g5i<7GEWxKWbB6>_7P8x>{3ZWMN-2*p>4Ql}_MV#0#O z9bM*AiU*ZA#?sVZbIXUp>|-zM#_J?fRt{6}b}LkH;|(5HWoHGXZ$;WF@kk|19A*`Y zjofJLMpZYexl!GX8g99RF5Y9RrXY!omFV)eTkbG#4_(`hI&ReE5bshE!+(|QQ)%Ev z!~YpEaR}143A3%;XhYJJ*o^o-vAG*9NLsql%8i#cglko^JGVqpKU;-1x|ikKO1_U2d5FiQ9gAN^Zj_T%KIkgRio@ z(4Wdo2HUUrXKsA%hT(?kMsGK?AJc}o;d0{(H~P5orL*w{a>TC~_9ganqd$op{s6cA z{ShHDt3h;rO&sjJQkomO8$Qm;&6LLtFIPYgKXEwHSBRgU05M1m5yQj?Q4TrVQ~Ud> zQ8#{YV-!V;7;_`;#!xq^ykh?^_!~EdxiOsKcQlAT!i{gK%$=N)CHaDiZab>nzp9nvd9rd7jX&0rA~!qZX^sVsH}AKRc@>%Ph{VZPIjJ{J&>dv_4#&x&-F~VJL>~>?18++Z@ z=f(w&xZf>zIL9eBPRr_1IZiy}#$h*(xN(&2-fa7C*keoyPlP8JihhzFA=1vcan8}t zl1Q)fjw01AI{XsJW#Sb#u98ezZx3|Cjhk-d_1N#Q-E!l$8_(nt?UpAy{QDdDZ*JTr zzel`JeBj1Ix%ACZzcLgQo|x6|RQ_<|k^BfCe?t6#hNo^M$aA^)%eC5rR1f~9LAq!0 z;2$})J;>leMh`N1klBOk`!m9W7d%KhlegynjDiW0?6GHULFkeV2}r&$+*We_wnFM4?ZWCus6vU#8MBEz9Q-C zWXtDI>POz6IDq(IQL=QD_BBI|IG8xZ0~d*8OXjlwy4O8$d*JcF>%mVAQ$_K~EA_xm z`5os+MN?$9LC!fu3=<NJbOK5T*WDl4)5mo@4^?M-L{FOwVGU zl7f>N3ZF_ch4`}v(ow`|9(lkDW>B2tIA?k=%Y)e-6q@_*l|)FQ;5=TP=6kTfgN5Ax z>xhdySnRO26n8fcM{Nce<51x7O$niY(*f%^p)6#yk_ld`Tto-ISDSvwK zT(0wSJ@=w}yQIJ5`cJ<+7d|mcm69nk|CzjX)dvle;Kd7G-Jhkp_t{1(?=_t9p$W1Qqn~5Rai+o6f1b~h8GpRNE8=OB`@A&sxndhA|`lMD)ougyr}L) z4f1!1HNB|i#oJ!I<3(L6(y_J|b;u`k|A>+xBGz*}@6jX923|Duq7n78WpX$6+TUc6 z`8T1`)bUG7>P+m1UGr26FYe7#Ip(XDUbOO}wd3jFMH})Dh;51Oi0z55&9;BtmG&XS zj$U-~qO%uWyy)shH?KT?$le=blMlQ}7iq$!3F+=d4=-kWF~^Hfz3AzM?uFZnUS53W z#Xv6xd2#bm%I9A6@#2F{X}uYW@&!rt`AYbgUVP<6Uyjm`wgF!B_aa)){v}XQItuxk zDd8@X!E#)gQ-{bp53qNa=o%{s@p$3&Vw4x7z3|cO_aflMe}*7OmyRKluon?83}J`GG{n z9plAVFD5gTF5|qIlU!_jILT{rTFqB`$z_uJyx8x>0WS`EaY)|1@#35phrKxB#YuKQ>XjR| zWIRFtF)xlgN18YgK`C;I&eL9;`Jb%l=c!*NUhv`~ONoAoij zr}^qtqL5-F#eFE@v;R~SMR3u4Rmz8>d9#=H;WZNBWk|{rUniFHp*+di`AQ5GeW=9Y zzV)H94{!P~dXfDT|1BS?_z+{Ns!yJU3ZD;tAFBIM!-tPW_o1c_wR~vi!}~tDZ!O;O zp@9z#eW>k29UtnkZ(XANo9SJWNAp#d1$O=SeDa_)R3(>CzC_T72H}mF64JznrWBhj zP|~_AP|ba4;X^wg+WXMbhgLp(;Ph(kLmP(=U7%EO(glK4O>K3)J5WRL+H}*h0Hhm4&Li4?TSNn%Tw+)u%pu z=ELU1~Sf~d3FvJI!51LP&5N9`?HQhdVWWni_js~gzab7I4)}{5=h$$$ub@BCe`qpI>8`9ZMWX98a9!!;d85S==b?Cm$yJaLb3=K1}i9XCF@b zaLR`bi_}yfru#61=4r&=pJtrt!z>?m`>@A{**?tiVXF_@e3KZ1F)V|2Lc%wlgc@4j*y?fe$0mxB;q{on1xF_?Zc}+`_g)W`WfO`;yIa~5B(n}7l>sLyeOy1VkPYo z$z>m|_;A&SYmR=?hwBc%A=d<&#V`Dh4|jd|!-q#cjDJ04x;x7~4k6>-_u&EgLr3|Q zskrtmN7Jc#%Z(RFX7ec47`cK3%LNB`v2Px%|jYJr6OT zA9?*qCokj9D$e3&K5>dtz>k6)F~`BoFZuDZA65LQ>PI1puMkf(v5!|;VLyuaQPhuD zsf+T4AI1DA&ai|ZrTut~yrdtc9M6syP{xn449olRx}%r#LsE&#LMkv6k{GTcZI%3} z?8lqrCF`ZXMIwsys^&*^Kbn%)Ac|PmkD3mzB@?Ti{#E;MX_?*1E zA3bCP_|cPLFQS(xsjNwY^rqN{_ytkS(j?p0kA8j(^ka~t^!FoCWPn2wm8II(ehg-J z;Ua2&=nPFi+WNBSY(Wci-_2cm?Mm7CQ|m$80~^J9@8i~W!<(X3po z#``hBk01S*=(oQPlcR;b%_jLV&5!AF?r?NbCX-C@<7bko@-j6_8vANWv_{GdDszZ4 ziL?Cj!N`oW$sYjHq{3W3=J_$7;sQSwl8F9$G{a*y`OnT0S-s1ttEKy5wbYMg^eiW? zAg&~?B1&Jet?^^6AM5=1#gDyy>|<)ZA3I4l__2{>lOLP?*g}4PvD)g#Ha~>yAWAm# z61ANuqEwbpa2Nf%{n$eyiueWh%bq7W;KxCdLw+3f;~4p2KaQ|TDXDYZ52-JTa6##Q zl9(9cj2~zHxG0P7$2mXFGj%~ON}NEE53@}!t?H0p_T!4YxB#N(kaLC z+>gKfNDUw@fYBvV{`TXA05S#ekNgP`K!yN@w96(9BpCw;El~;ORP_v*14x!>2kbRD zJ347|>#QjOENhY?4?52hupf7RWJSt^B`RA0g5n7jOWE@*dHE9c;J37mv-9N$K=4Ik z&H!?eE#4D^{C}3~DcZshAP&j}h0Td13ZF;2I zs{yd|m(pUWb z*`;y-ZwBy|qgNrRN|drvQ<|8o2T+4zO=7J865S;$$~zQm6Ky|9-2f7G>ILv#0QCd% zkU@L#I|k5D7F@2_3>yc~B!JfBO^Gdu%>sBofaU?TV3Us0eqO4i328--WD|NDk`L$? zr5(fe#0~*`NFwI{{GF(D4xmc_T?6RGPzI8||9S%G9>A&qRtL}{fKLM$C0j0lo&od< zpl<;E0{E$i{f^nL!pWZn@Oc2e1Nb6fe-8O8*6Bko;g=-x%wpk!{h8H>1Bg;&Aju%& z*8vQ6^dSMPT&i3|v7KJ3^Z?uecmnVS;0xfJ0EWpH3Lp@GWa9w@W!sZSiQxbY63IqL zYI(8=Hv{->sS;uZkZ+kyV$3G^Q1an@Z0B(D?}#G;_?ATUs>{^K0L1e>l^-0v`7$*o zfUyBA3Se;n;{q5Tz;v1CGBqK9A9-j~1DNO>w-TK4Zw`-$RY;uPY~#DrlQdC#u) z%QS<0CUF*Vb^vn%m`gq{fCT|8l=X>am><9-r@jygB_+R%Ns%QqFC|L2EP&+8^ECe4wD}to+KV69wQzno*K|BfIX#i7}t7ifHEf@I! z{-ohK@h@V&8un2n1????AYKTfUwZZoL1d&NeMR4~TxAL(C5S9RWDX)Z2vJ0rCT3|u z#F^-l%8oAvkw%i8n1i^v^uJe|oI&KGlH1WGl{bj=Ao2yFf+!Tk{pBh@vr=5RU;%~& zgLo;3muVAGTEZ-(NDxJXxERKzFkTI!SP&~Yc(Ip6P5I#A~Ai4$7SGG+MKefvGQ4n8{d>lmO z+8IRoB#7=*g!c&IQ}Uic^a|oLNB>;RWo)yw-a%9+@52gT2JsbbU0JPd?F{`H4hUi( zNn(^iL3|y=V8=Nm2p74Vs1bGIMe+Z_nqpob#0ICYloDlg5L<%S7Q}XX zw#xa-A!OWyLAw8^2-y|H?jZKioVdT781^#UC+ow$2ZJ~i#EBpp|7E}boIhDTT%isJ zQT1B#ksywe2tO9Yaq=uHm4xCfvr?T7;*4BlLwFRz*&xmZF(8D2A)M#5-w2^%2p8ny z6U3z;F3VLVWG~2-Ag%_HJA^zTTnplQ5P!;)g18aH%^)5G@i2(7%~Ng>?*?%@h&$vv z2V|5cse5uIbQD+1BvF11;Tn0DbliqkQzc-2&YELSDEblp(Ti5ju2i9AtzJ0=$EWi+xu#Yki4v1 zB!r?Nq=%4CR=9Bn6+-?H3WV%$g2!8?M1Dvv7{bdT6q1#kmG)A|ejERK7h8WN1i``~ z`vFX;EmP#P1oGWdQCvPAoyp`f)bNmZGOL@iiW`h_V7@$zKnl97%bi z=oLcvc%^+kuM~nj1Gi=fwL+-O?3={5h*gMHL#P%)^$^BqQZ=YZ$LftyvoQqU4&j{; zI)~6Dgxa#gA^X4fEkdXp!n+~77eak1^+GUKssxImK?n`0zb}hM(v;Yk*dzpTicPvS zBT0nK$we1K%Me;IY#l=T5JYJc!UrL=rP%I&dL{aH2;svJI#TcS|7E*|&@F_|L+BmC zN3u9P%+CZv=q}sIIqHckRS$9@vIrwaX6qS3FIn~~8AZwTR+{`@N%Suq|5qXOarl=Z z#A`#k^bMh3$R=~w+ZFn=yYwn`Bxz6xo)Ektd>z83m1?llcL<3q1dT)|x}B{2JHr=( zKZLtf0wDxL7#YI%3`4|t2w{>4(FnmLiH2a2$OOVoRg7GSghR={31Jw?@DRRroFhVz zj$-?cig5A&5W=Vs#%@mC9m41k#)R+-!?7WZ3t@H$b7&hM!US1=If=N26GNC3!qgC^ zh451dlS7yi!p|W*S*c!GrRuLzeO9UOSE)6t)TLD_%W5?}gc%{s3}IFX6;`WutCe@P znzmZ)S*@0CPW^4QDzHY)m2)$M)f|0(2n#}38p5&=7KX4WgvB8&k&U`W^;)BbuTjg_ zsIzO-3u~3kyv$m)JcJb?tPEk5Y_PS;Mg6C>YWrGsk38=>wT6|~hOkcNuuipGr)0L$ zeZ8E#A#9Y_E`)6%Y!6|xoL^;Az3bFgk}dM$uCu>mE<|t#aojq!i)5!P6thAkyC;Ob zA?yobe+U;txD>*H5DtcLB7~D69O4{~gm9GPFuTYcj)icXb%aZ6IoU?J!kh}>bO>kU zqD23H>wHcw{&Lw*$#8+Xtf%;8J!K_@Tn^z%2)CKKDwnJfZiH|%gzHqqkXT6}vTlO6 zxNbsZt?p2fRgzG)$34FK_lXaP59R7dBH7;3t=RO?fsdFC?qpU(l1Kde_>XN z*_>3ulfX2J*~7>|@?sb{!^lORhbTpIhcT^4O3Tq1^HNE0(N!4lg;76@{9zObqad?y zg;6Dpm%?~Cj6z|&62@y`lwqoH7{$UUPF^I8qG7xmMmf&239$rIQn?iMl3|FRFqCFW z!m?q!9>yDCR1}ZnuMkH0FcO}GUn*A$qcRO|av&)yP4vWfnX58YGmKhcR3ooW6hjS` zl4@^<@eaj$Vbms(3U$M%<2YqL?~==)GTTJ`24OTL?-NF&FdCEhl4A*@X&CLoXdgy1 zisEk>#{1;Wi7mqD#idAKt1w!J(I$)!!jM$(7uA+FA=0FKhp;@)$R4+6SZ;cQPQn>> z4x>vLABFL87+u-78*u`AeLgprbV-br7^r&~J!t-vHpz;45KF!hCvb!!z76ki>j45IK z%+!xz{1nFSGAR=|u9zoLm(it7rYKoyQ^{w@S>}k-*)cIsnar#(W`{8+jJX_ZSs3%2 z`791&ei#cFE(~K4Nmu8nJ?qsHDoY)|q?VJfaFms@;PkI?l#^ks4P#vxzl5=#;{Gr; zgt0Mkebp_LivKpKkL=0Fa%E%&k)asagIdv^I=>d|E-yA zz8uCCdC4O9F@nMy)KxjlB4``IwJ@%SaU+bIa#f7rMP_e>@i2^EIk(%yJH)$T+zaD= z7!MdGu-=A$cinGcBt?)RVxOVEhw%qJkHUBy#uK^thw-;u>ce;@7k@dMm=&ie&72BC zBotBFKeUN6BMW9Bg7`uNnIgzco=jX-(Ek5aio?_X$(WT~#B3y~#57{|h}_xi-#c35 zjNs)63PsSgMV?#{Y6N8>C>ues2#QlFK`ccq8NtYo8N^nap^(=iaBWaRq`gkDQUv8l z%12Nkf;Svz#Rw+Q*}YPB+wYWmlZJ`&lBz~fErPlcyi27z@oi!aV$BF@CBprwi4osn zSesZUf~l-uFM{_X@*NrbaOx8q5hZL8K|_bH-=G>t&_ouEN;5~_*e!d`B58^G%_+7Z zwu~Ue!)(o^YePK7UC}Or_7U`yWsjgk#QreGhY@VNZ2!IdWP|ERXD4Fk2)abjHG*yo zKbBW>qq_H9>PHO4FX1QT-5sSz1fNDA|3eIXqU7I^pGEL_1bPJS2ztv}`P1ZfNqr-z zu~B^yL7#~IyWE$=uZWeBGKkVIf+bIq`xAu>AQ>3Jpa{N>U~mLOBG4$-Se4r))f^Oa zf_pfh7%^}s)f<7JF9N@i2!aeF5g2l4!CavT!c>HdO_~`&luGZ7O2W&@DV8YY@d$>p z>^Bj7C%b}t7;$(6BS>a+!nY9!$`VQYK7ujSh5r!2D2I>!AJ15dhkvMPerjYq7*+B!RZJtM{p&AGZCDP;9Lafovf6S zCVp`WUWnjg1eeJFOI>AnBZ8YG*CM!1B7X7Qir{tx_o>_=-i_cMNup)~#rePyh5sh! zk^J~DaIPEvpk8*9dcm;g@QC4K;uF~b5j-RRGlIV(_$Pwr4C_tE_*cY!P(p@HD#<_w z0~rlK$R;IRP)hyBMag6!vw>s|A*nP2Ddbs*S&7+*sl*(=+Hajn%bo}wF{gogn^Z0X zxeeqoke7NP1L-6MiTQ|%n4egH*oL!uiTvgN(O)r8*gz2jMGcgq{;B~nODkcZ7?t8w zWIiI6G#~{cEdvb=G$Mc7z&i$Nlh+~EGfXS4eN~*DeCI;FWXiuf7ftChZkvB8&zJccCEew3INeN0RAqn1^VH*P< zkhG;o3_h-N2Z|DQG4P?oI~wTZ@XjO&b5{f1418qZV-cx$CyFQ0q>hZR%Y>W58uVGw`K>uM7+{Fvvh(X8RNS5!V*B*F^XLC;ZyLU;{%KN=o#E z^FNd>(sUZ!282t>%g{&k6Z1iyT7{5-FvH;nA|ykJh5?f#YQQ3qvBqvvG4eQ3LJ_5X zV_+EDE=L(b!?(om42(38FiW*j21d&^Hc`a1-^mwME_9qEfc18e3K8t*TJ<^c4nH8dzmuHH$=l%^TRNrf*djeCdZur)=D+ zo^Ms_4E$nXuYr9A)*IMhV7q}G1~wYlWMHd-ZE}`vQ|-2?%?5ni)D{_co029|y0T3@ zN=biVyQ;cf?KH5*DR183#JYv8$1c@s zm+G}k{uW3dyGuP^m%e?My1Pr=GH~0#9Rqg_WZ$heG)}KOH2v+}>Yj+@(p|gNxZUbL z7qk6tdk()E_|3pG1AiL$-M}9Po)~y43%FZ7-mTL1s7D4K)8A;1?f+zta_>>&_NXm; z)N=!W8TiLQl8L`%S#qcUy+;+^YunDzTzjwjX0MvPSHZ*!CUTm{Wg?S_%qFs#NHvjc zBE>`&6Io4c-K%cxRr&X+qWe_meacvy-nl~hxBFC@iR>nFn0V2|vVH2(KDF**di1xv z+4kFyWG%m6wcoFDo5*9LfQf=8@|s9Dkt>!_N!_8)tUY3*?#rb0oCMy%5UP@ z5BB@RFPV7RL?IKenE2v=8g@YaazI@_puSm`o_bJ~JgAxbI!&Eh?LMQ|2E-dJJ!wsA6KBiC-iuOP8Kq{^h#LL^TuDP1G=P|8iQuM9@S{&Zm|M zxgFx$Cf+eo+e94`-AsIBqOOT|O|&x6+C)7Q@0n<7qM3>MCK{M%Y@&&YsRz};gX-=< z)lf!1q#6Ftqi54bWn%I6w-94m|53Aw@(<>ZS9SSVRhoL%6&vle=)t`5%nl{TCXE&=n>V)L}wFSOmsCd z^N2cmL_Im8iXK&sj;h{A)zG7A=~4Bu9G!`NCidcyaW(w7+HqVxIIaqv zP`ys50kTz0xJ+m!2ATL;UOp2;WIN?c_n%NxPuN@f;0cxGq-wIrKFxI#ZWBHeeiJ26 zDvyayCzb1@dcA+L*M#7qp1CKTR4=`k;?~laoKztbVG}F)Iz~(wCKj8xds3Muq9(pI z@tp~aiiqEk#E5a?P&oxoDM<}8F`UW>;`^smdFmrgd{1Szi62aiBA;eL45LjG|L6q`+Kkt1g{7Z_J?N|a)IvkA^Zb`f(qDG3u#e#sj}Nfu0x zB3~3LihXC4v_d5Li3NxSqj<^5zRWISdxc8jD2k92jp9|u^Z1M^7DaJ}FP~M?N<`7& ztX*6?t4c*7Sep16u?(>+@pWQ3q8#iSQB;g#T@=4WQ7MYbQONgJ;!!mJKI@xN)QaNm zDBfZyN)?i-QB-r3>QU4nujwfA;Kg^Ms2#=EQ4EfvP84;c_#%ovQM?;Py(rp6(LRdz zqNpE5izr$~(Li3BD4ImkG>S$%{Kiqtu7Jcx!T%%8qIh3Mk#%kX`IM}nq~s8Uw2GoN zJGPD5sWwr3z%XGDlqR}hhbTUb;$z81(J_inQFNoTGs|{~qN~$U%>NDX5yeD>?osrJ z;xj6rM$wZa_G0(MWD>o^{CO0;c_5-EQi5NyV}Ds^5>fh+^dm}NQ3j9?jA9Up%tXW? zQMjUrQPHB%qcF*%XO%mOP!wU=nNfHt`eas71ftk<*52O1D5MDyvos+QhC&P{C0xu= zcCm=!6eZDdXcXVD%djYZh+-7^aN-E!x5V#=Bcr%;R(((2xq8azD8@vwfZ^CE#ziqp zmL-buQA~*9=P0H|@gv*BC??5btsA>)TP2aVqxdI^Cs90&;<;SpWvgFM8A_!*lZ|vi{VB_MK}nNe$d6r6cjl)LX^=JZ{>(`h zGFZrH0TveSOi#Y3id=0`Dt+J;HT8;$T}WATMHQ2|T~Wn}&#tIa7D`*F zXd$#d^J^9+WJs%E;SCFAEc+!cOMIPJj#!>39?43Z=1r3(MBWmwWTCPJA=2Ko@Ro%t z4672W6RQ#PTvatJ)O3_ujwl^#%duDpSO{9EYvElBAIn%4>REWtLOToXEtJ2i>Rae} zReiu|G_cUnLL&=}Ei|Fh!a`FE&Bz;GwNL8zEi`8+JmE=TONy;5v?ggIrLHPzA1+8< zRxY)ztV4geuBr|ere9SbS@zoz8zpO@qnxBym9$P4I+J&Cl&&P*ES#s|NvV`Q8`HX5 z=wYFsh5j5!Zs_qTNl#)g;%CIqE%dhV1^Ji6K16$wc`RQs>?@1LZ~#NiLf=*P``ZH< z4kCVSVK9m4Lr7c}5@)FH=xz%hhkHqUL_e|plcW&IObfFtge^oY7*t{wYF|?(d6Z}o zU%F;5c-+EJhTmBD!NMr=VHSp47-8XChTmI|_8qx&8AuTQo^lCTkx2L3azoCp9Dz$BvjTSap z*kNI(h0PYWSlDV|n}zK+)V&)j{ibSoQ@L*{y;AD;H`R7Y-L#KlmxbLH_E^|!;rUH9 zVoQ3tTk5l0YUC}ob9zNTlK%K#@|+_ES$D*#==<{@u&1Px7C+_=DmGe<-DVc-%%gkQ9Y`p zU$Ah|!VL>IEnKp2*}^po*DYlB|9k)BEAr~!QCGR(LMAQCy6lch-I^|kf6Kyc3wJEs zl_eULp1dOc$r4+?NAurzRH3`-KKa=@_VJ#&Z2vFyR|~&c_}#)Ea_x=TZ)iNS@K}c4 zlsQ8TPe}f<@Hfd*;xh|>l8EOyNvFF?_&?-HF^t%1Kj}3hv$yr{Vb^>N|QHU^2MNH zSU(gSh9Z9q1!CwINB=kq#_&=M^J7>L!^<%gilMKhVt6Hn!ZExlZ@BHU7+#N|T+Dt5PKg*w#ZWqCKi8%t6(O%NEE7Z7nEl|JO%HO3^FLDFsab&} z@yMGu$ScNBDTc~1`w=}Ci=lc9EAFcIh&5uU8AC1dcVnm* z!`m^u6GLq(VyhcN9f!*sS^se%30^;j1~fE`p>YgN$Qu#G(A4SMJcefE?-Qkz6c=pa z)M?E_=n%t)F|;B7fY_GUj@X`JwLNo0r0KD?*om)IYve-p#77>1LNAdV$|8^d=ojFf|l;fEMT z$1sL^yL(F7s2BugENLb7CrKz|9C18R!U^mvWMT}HY#mC-L3u9Om!)tMriDPjL zOJdj+!){U9WLYX3jI&zi%xyWz+Iwmx$*LGu$FPQcLkt^ZSWCW+_zQ78@f?qOQw*D9 z*cQX~7`Dg>TUu>pwsBiX>r&cYnU-z;J=1r@(5NkT%DLbudt$f{!^If(#;}ha_s4KF zhGXOhhzE&>h=++sh>!27<0LY~=@?FspCq0lCTx;D!|*Ke9PxY%(p^%07w5ec!=Euc zmy2NxSD3vT!_63Okzb49I?0U~4mZcTMfS$N9mAa%evRR`816DF;)57QgNWrZ|%0_L_?=GZo<}aY##u+2TkgPm4ngiL79PORpE> z$i3B*xia1Le)sCY)!wPY{5l2OGIkc*AR3fiT ze3STA9981jlO=0|`>Ov6`(sPhs8^4p21(60-j3sb;~cdZ&b|NdYx)jD(d&@ZCB93P zBK6{UkGwvy0r9{#`{Qbj$={Eoc^pmRkYC`XHI1WL9Q*Do;esvVXcJy2R4(KxI)^f=scc;fKJ5sstoCi`si z#o>=5z>Z>;CZe<;^$>OOL>z+=heFjuEo*tl71( z?f;gZ?}$wwC`o-!{sVCo@e?}7#4$FGadC`~V{#l*;+XV6O%RM@BKePTNX-P7%0DIg z$`1vSpW~SBC{szM5v7QjXOPb%Zhc_?%$gHN?uV+v#w>H=m>0) zh6m#~5=WIZPBqn(*Us$mbcPouchT94AQ~fZPjwremly-sP zMdBr53j0!%o{Nv~HRor?4-GN{O;BC`spu3JvcsJfQX5H*fd z-Hh>qQMVjTQjx4;fQo^tTh$a5xm2X8$Rg3Kf~;o~l3hiPn37XP;0=Y76cuSI>Z@p= z!oy$wRg_jyMn!HFc~lfsQAkBz75P-;S5bg}AiPXXy6^skY<}PK#(j@bHoogTW%+$i zVHHJGlvGhl#isk7qTFNmJ;hZNQ}NS%4~LF<-Akq=RJZNfA9zyURH|!Ag9o0e4?Ja6 zlv7bvMKu-WRa8(>Sw$5Us~>oNeBk-#fv2L1N|G`Bj{7St*AAuaL(iCpZbwyDQA0&- z6?IhT4?Q(i9DC@=YAUrtV;s%WO7xr!F7Jn~F<P+J#e9^it7VMK=}QRrFBN zQ^gkxiW$Q5U2-oFao{56sF7PIKyc^@|c@hfe8`3z-2H_vXQa1`=gFl{nKIBd2nOobBRBTc4v5KwI zsC_E73E3;SUBxFVcBt5?;xkcp34W?#H!mOgvBvKxi4s2YZjYq0+o%#f@a=OE_Y1P} zrHX?pKG(5d$5$#2@k-QDO~=sQ?^Wc~kW0f4 zDt=UPOU2*3*i{@=@r#O!yb@I$S8-a!85Ji~oK*3%ic>0%TyrlzSA6E_`ONdyGtZ`H zo?o7MGClX4RdG(mc@-D9EzdnA7ASGKly=WOp7LpY*U;4G?kz@_R9seZO~rK;zjF0d zT;&erz2dp&cTRfl-hFiNx#x+rio+2+iN{x8lxc*deL&aYzZmMX%&RvfwvlRY$ z-u{JW)C?%x(Q+qvIDld>wG z|Kmy0@W(%%WErNUS8nN9HDuF}T|*8HWnXzlymJ3^7+6UOz4A<5t!#hg`Rh8uDn!t0A9;{2K1P^5lE%>HOL=^R?$zqVmCO&*|5m zC$Bw)G!)iQL_<+7G#xcaN7phc!_rYP4GYuJnxmPIr=#K;)}nTMg|r zT+B#GnTRJ+#Z1&W6V1v*2S+FHHO!70I&p0^bkVRO6Ah@X9L+?HGbz_HQT>}r`pi@< zGj-F@T|*BIJvG=G91XoR^wuzohg(A*4Sh9?(J)p+KMnmg4AC%D!vGBfH4M@)m@AN( z__o0HJCq@riSKp`Wu`Zz505b6@BbQxYZ#$nB+sQ*%H_=TEHhP%qfr|8n(d%Cvg4>l z9F3MNOvY&#uVIRYsTw9|n5bcrhRGUs#L?ezln_r9WpF(8TdnYYO4Bq<*DyoF zObx5zX=^;4ji-`L((cF8i#w_L6DaqUlsOvaYFMseg@$<==4)7@;Y|$-c!p?Lq+u}+ zQv#h)l+r26&;;u8NSU8NYZB-{0==c-Z4FB`EYol*fzl;X{zPh-NK+H3`KO9Ek={!r zRfDF%uff!yYcRNJ8hjd#Cb~WFAd&JWxum{e-y{lX2x!Z>TN(Ht$^9C>&~RMC2@MA{e5v6Z4M#K_)bN#tuQeRj-22cD z@qnK5OwB^qrn#GcBnutNLNBsV?yU5!hVOXK*YKl;%30}q?uxARb5KS50#VI zXw#R<1r5LO`qFTT$D&=@oorMpI~{qXw98Ion=6-jer6{#JN?Q-pPlw(rz;w+@=hY3 zQ-5ggQRL6FQ>`3yO}hHJ;Gcpw1pgAeso|E86WNLR-`qLb-P&@v!=D1Y^=Y`T;em!! z9g2>J8Xj>Qb!5`8M`nSCF$-M4bA1&d2=rMDHq+$MZ2mg*>q&rkwZsL9c6ZVO5RP)no6e* zDYfn@wNfdUj`pdvEY;1Gro*G7xQ-G!NJnlR1#}eDkw-^f9r<+R*YQp&@z?$@Q|VDE zWl^YdUZs{oZzxnqM`0aBbQIO`&-=;@h2B@(F}l%8Ij>ML9S_)yKWfvcq>fTL%Im10 zqcm4ZM_C=^bo5H2IcXG3qjX!9J!y0!jo_gQ9;&FLl8(wcs^}Qtp|?D=!9#~Vbkjqb zh^i3{B&x2XhK`jwR_UmzC4YN)Ma1yLQrx`Oot>kD#H104;8pY$Yi zw26+UI=&<7th<+Vn(5d?)K++N9W8{k6l|rVwGjT(wvCVyliV!a(snW&?FBmsb`=@=>o!vzoJO*c$PT8|XYJA!TAa0!ReI>t)U7{Q6k2JM8@=-Ixl1TsS=$g$O@g0o2g@#j<+wX`8pN|pQB@L z%yOQPOT*o2EYz_?qKgC<3;s#&N9vn8ZgcgcW&1M2d@sFBo*3~a$s;uKu1tVSd@^CbiI=t9hL-}-TG2knUtFtIdGIc zM8vpgjr6N^tkJPo$37h&9Z&V;rnNkU$|S#|W1Wt7b*z_B-lgL`A=?Gt*Resz2Rb(D z*eVLolTA84WG6i0Pt$D{@$0SbOCPof|5(TI-2d)EOt!^xMN>bK=nlc1g6xFzeyU@) zL_ZVUBN+YK&%X<5?QuV${?1Kb=s2Kbq8F3A_)^C~9bN-I17GPlq$8JsR0Cg2-fww1 z2sy0d8y!c4r{p0H?CN_Rd{4^>9Vd1CAe^H=>i9|cQNd#|{kV?Ie=2P7vyM|b?(@!| z9g+@ z{-AlDmnuI>z0aTB3zQ=Dl-oM)=(wxn9{&i+N1gN0jC^G0qoeugRz514pStF!hdLhV z$Y>ywfyX+Y=y=InpN^+Gp6Ph5;{}g(PUUd9v<3NTlwTRNIdN-#`k++W)%^5I$7`N) z2GSe2e^$BMQb{U66$?<;0+hkP#sYMy0L?ByFx)MjNoE6a2C^8)Y9QV~f`McMDUw=f ztCFoCB^oGKkdj347or4U8{Db|LbWRd%K+2MQ5?i#St= z_Wq(M2GR@+F)-AC#{e1FQi^&T$Za5xftm(t8OUoOpMlZ_${5IRpn!p*28tOdXrPdR z!Ul>Mcvgr?7p9?wNh?e{3)4@9DWM3}EJDQ%lrT`zKq;wVmm;(`z4BqQ@@?C+yFVmO zDMHJNP+4w*fyxG|7$|R`f`N(#DjC>bg#MVLoGn6$MX730>Q|H&6s0h81Jw*vH&DaC zH$|yc4&~cs%FtGcH;U5Auu`y?J2Pt=sAHg|fmR0U8mMQWv4JKA>KkZaprL_A2HF)P z^DSj@G1^{?e)&TAvl!(sPL+#OQv=NmG&j(K>s*{d#pzISD!M`Wqd29OpbjNyaS3W| zppAi!209sN%dQNxH_(BzEL7H)pzhU`esh(tO3;H6lv0wam88xFx)|tgpof932Ktqx zM;|Ibm!xh6rj#VLBr)DBNqI_9Pj*s@dKs8eia6+{sE>iZGA{k34+jbMH!#4!K;b-O zf0g=ouNW-K8wN6#Cf0`;7%s{J10xKK`j;WS4DBpKJ&!8q%22Md zw8_9`16vJjGw`8-k9d3yd~Bd|Tzl)k%92R?2;^j4nrO%h7HFpYe(?aKykK1A7e|Fz}^;eFi=^u;0KJ94$u| z%Mm}^l%+gPE>DY=DCcu4T6sFin?LXQ1`ZqiXsxonJRRaSeqA|K-tFGgU z^NxYL2JVRxy%*v>&*YC>507~B=e@;?dR{y+@RYY%FLHVD%)oQrw7rP;y3_lGV@J(1urUkk>-WRi(+0B_kz60?L`4E3QCqd zg82mVdND!rvd{dYaI}yYg}o@^MNu!eJ>h#(U60j(cQ?4#$L4XqAd?!hqxwQwD2OuaIyQ$Yb2D};fm=NZ^ zu8Dv4O={@{V=FIO3t_h$<=3*e^I}lP_&!DB+k4T$i;iCGk!p`An%KN(;*XW6vs9*w z7hS#R=0$h5_hPUYJw)#-*i*2VU~ez_c=4+^VdQ8((fbPy5FF?Q2TpAej(flf9V26V-=|K1}suniucz z(D3}PMA4^drh75NinB&DG*PGJ5^I`*6#*0tA*zLteFE)Acv6yZ4VsmBsNbo~1m~0Ww zA{W7dm91jA&5P|`eB#9pG1%qBP9aenM$Qs-#r!ibzVhM_Pd_jAda=)o&%HRnl@V9_ zz4#)Qou4LSdvz#_u>aHe)QreUJhQ|@ZzW! z$9R=hNdC=><6fK)%L|NI<4$^U+KV$@{OrXk(Z8!q`3J`TUYX8H^qd#xy?7q$fjm{* zu9#Ri{ueJUdT~i?F7xE{B474@|6{6Ig&K`cx-dNXcQ3AZan*~s3(42KxO*?hAKc*s z6F$$HWmpxu&i#-z%PevDmlrpAujc8|HQ|;Qe|z!Bi^pEv_Tr8g_q@2z*`+Klz30-T zEESSJu0l<(CG(5mA9(SQySEBmtU_F|v5n)OaI2TQzulhl9$u9`o$T@(%`!aq;)NG4 zy{J}|UVD+whktk@@}hrLnpKsG^-a*KQhFaU_`nazj$WR`UBMZ5sBupVC$0^oX7VAc z57~Uk>_eOn@jiE4l6*+^Awf7t6FJ%`{^P3jZGI2mF`nW>7N2|T_|H{|1C#7NZqmE_fTpX@1OU~!R zlfSY?^@2VW@?p;F%;kJ2>_ZVBiuzE@hwpd0mml?`{PC`g!pQ-;c!9~AFBCK zou2~sfukInElKUJnGN+}m=D8a8KY%Iag^j5wS2SXQ>aHE~W8VuU;Rf@JE0T)1syGQ(8Vu_hE()Gew!}L%wS6P|osU zcFbl@Oq}P#d>)r-w7`c&J}mZOp+wo9#U)(glQ<489*(Ii&Z_^{T8cYIhU#_tOL*Q`s0l=np}{$1JzAKtD;9|$tp$ek&Cv*3q2nWy+ULXPKJ545i8N1eE5-zu14!eq%g95jy_o!kBPx?o<&m7&r;`AW7BT?aLR|%KAiF4tcW)R&k0@< zJTG`b@E0F03VHCgI~de+l)og)O+nUg z3HjRxHsE)P|$*Bcmvp{QtVD@FGLJ9|?Z6_oIU!iGC#c(bSJ-ekA*m z;s+m^I;=Wn@niAU)KotdKe7tXCdguTAvyfWDI}L*>iJYoO7p|xM-4w}`ayo=_M^BT zCH%CRzAL z8DC&$`;vZC@S~z1rTi!@NoCkWbt)&ktRP3r#|V3!$Ej9sLF}rUl>2)n zcWG1?n^iYmUQ2irZbHcnwf(3g(YkK>RDzF?K=v}9aTL*b45Xe{Jlk0cK4r(Jb- z!)flv_7d^)7AHr)-?k8&mV&JWTMM@Fqpc7(qY!^}>gY!&Kl=L7&kugNd1pU*`_adb z_p4JEKe`I(CfHq&^&WoojPYK6=qV{IepQ`rau;>+ls)LlI@w*$g=$cLKL+?Q(2u2u z6S|yB8|24eKdxR#c*Bq3eyq6cUg;eoH5n>6Ot4N3at}xHW28hg9ZneK2jgf#&N5E) zU;X%vKLz}lAkm3_tn=etKPLGx*^eoHO!Z@V4O&x!rui}5k7XPc%Nc%bdz!SwkC}eV z@?*A$>~^6abNrYq(RqF>5Hq%%FA5V5Y_=$7zgP&TzA2V(`SCWlG?p68#n`?Et?{PDU)r~hkzOvK}UobcnMA3sa<6t8-z37=`nt~hY?Y^*o> z*Q9gYI=QF%ydM{0{1+h?{kRlUF8fivCb8x3eq7;cX=0j*tA6~!8<&ZECa&?u$gMV! zWa3ZpZ`7pcLT>o+mmfF%xD_k+5${@l+?MDa!TW-D{kSJ&R!w(Lcp#j~!~ckn{dnTX z)0icvK9f|odEv)PKmLj3%4Fh|@YjOrOxgcUWDo+ujDp|QBo6F~LuOIp1mgu0Ot3Lq zCY#vxabl{8J=;=y7fMVqk;Md)tb*ADvkT@hkyA+Xr75{$ge?`5&qPh;kY>UooMK9D zA$d&HC>+lQ`ArlsQP4yo6GyhDX4#(la$o9$MM_~4{0K&~&r(a6xLK2m2o@DACRki5 z$w?(mlrmA;L>Uw9Otd#q);p&Xemq~)qb zx4uazUyC-(O7wr0(5x0!=ZcxAX`+^ieHRjXf0fX$7EP~3wWW*dny6=@js(4y+mrQ8 zG%)e~4tF_k5+zC+n`mO9g^89Xnwn^4qPdBVlQC*{!jHA+w_23GHWjQ*Gee23Otd!9 z#zb2a)oZ&xEB~0#qc*kldN#+$ji^n(olEP$c})!FI+*BWqBGauL?07fOmsET-9!%) zThbEe*QRbJ%-ZzLGPgc6OT=fs7QcF5LQfODOl+=A99ZvbqMwQWCI*<;Uz>iaO}A@P zavdsKhuD}G&Oj4`q`jvvyT81Km>6nejES)(hM5>{Vw8!|CSG1ht5JtWnBZJ`hQyKF z%sRxxF6Zf8hu%1lFuV?pGcn%8WD`@wY=Vi2CT7&3U&p)GOsqOINeW`Jxeo2GLl^2$ zQeB$PHYR49m}6q57|aqZSeF{qrFHY&iwtu`dDFyOLgoq1H?cqn8!R-jD8?6?SQ6vB zpTBKlNL{xp3?WMemkBNxTp_3mYJ$2Te`0Cf+v@GGTE` zO{_6tn{Z5oO+?r@l(?iWy*Qo_kaFLvODj!$Qc-O>w6YChgo~-q# zLOoi#Amw>oDzVzrpdLL6CibjH8%%s);$stAO>8u=$;3xI0eFacXzJ1YdSun3UdIwX zxo zCO$K9z{Hol6`0t|E5gL*yrS#Vwi=#ykGh|*D?*87>r>*W_{XRpT0Hmo#+ed69-QE(Zo+C&Y3uG;;4yZ zCQg|+ZQ{6zfdTh(^Q4J`_34D<<%WPjR5XR-P$&zN&(zA z@xa7G6OVW!4Iozlk4-$`eK>%O0X#MF%)~#uy_J5P)BFL=?Jc)J1ZZ$Rf8(5nVi zsbbn2P19bRNEbl*05Sw%&sEB=Qtm8N62Dc7HKZC1sdGab*^n{?kU4;)0FncU3m`s# zga8r)80u5jH>B?x(mxF;%}}Z}qRx$IQ6owTAWHyQ1IQLYq!I0FM7JAJ*2dJhF%4-< z*#nsLo)TzGIRaqheoGBN37|*-MFU6+z!N~e0P+Vw0pt!KPXKuX*w>iuG^T_mRILeh zYeMHLC^IXh4KAk?2%um9g#swdZky1WCbX{!eQSCCx~~+jp`5?0{L+Mq1yDSIG69qg zphN&A11J?h=>Re{r94fkVN*&fs|@>D8Q+u+c1nA^Rw)-i`2Z>eP%(g|O=(9{_jaQb zO^MGioVH4N*pwx12%ry-NOQM2J-HtSW$6__Z^?V_rh7(K z-vIgraHUgx{{Th=Fp^u;oCXAVabXY_-JAyV+z|UW1cwN+&UuFkAKjdW2f)b6C?-61 zqK^q+YyiWH$B%3mH%=5bm>9r#;S&VcNiNozRBD`aasX2TU@}!OL$wUdk2j|oVmx1P zrr<2W*@ANdm@9<+%oFnO*IMBV16UNm;sBNe@MZwZ0$48kTLHW+{08F0z0c;ImTL8fTLIDhGLEZjNvv?T>@Q&ol*Mgh?R`POa zK^($DB0N}UGDnqFqO1;JP0VJkka8_(T>$R}uwMLZ6nrm$`Yq^v;Tr@$5M+_-zbSyt z0emRR7Qv7HWApKUc)>pI_Pbq_PXgExz|H`61@L(Q`$haTfX{^N7K~2RJ;FKTUS7+A ze;*KtJ`3=LBpnXm08c;R2Lm`H!HlPX(|}dgDw0X9GAF!1(~K2JlA!7o@CT zV&9y(auG!Rvy53f>4HnvwCQDD2@De+mR}I{;4Q z5cPkLxBUQ8g2)oYg8&`|@H~JQ0X*W(KY%B^?MwE1ErHy2{G{{^1Qg z=<2Tmc+DRc!qWwjJ_ttE>xw0l3=&1mAd`^Hf^k8x8HZ?=gdh?{PZH$3$wH#3S%VnY zlJbj^Er{$v)6w}N;(h^j$U3u2+vp?VNCf*8y^h?+sv3ZiWg?SiNsM4ccS2hof> zEr@zSG!gsyK{Q~8Evb=28wL>#tZ<9io&%F;v}r80c@QmvXcZxg=$KpPV|iR8 zI$m&sV6=velY^KN#H=7@2Qf8>X+g{s1I{=-h#CJej#e+4kyGbL()=Li1~E@Kw;~!A z#5{0xk?_SqED7@4f><;2HiS7|Bn8S6##eE*c{vZyB_=RB9KmT{YsnO!T z62d%J2#13BTB3)8I3L7?AifFWND$u!apQ})AA|TwQoj@YUhoG&PCY8*WDq|GaV&`A zl7-!JI3Ws?Q)0v9Oc1AqNB_k*8`ID6cCpxfmj9O^E(UR*w_i!R6vS;ImxK5nuN2msQ(D!Zj7)u4y^nY1S9iX{3{?*+NJP{ag7IsY!Aynnj|Vi`&9A z%r4QKA>bgC+??tkr48RkS~P% zAruIquw*YNSV*v9E2`g$#{J;_#*8XOLnszP@eoRcu(D))^$<#iP%4Dpr!!Ovp>zlp z6BG{RLntE#Wd+L#vd&pJRES0;SJb|82vtO^8bUR3!dWtV2z%hVMayNX6tkg#IB+j#&-}VOR*mLl_vspb!Sf^dV6qxQd;G zFqFAOM}#m^$auj~f@4A$E##+oceflXe4L=0oljN?VWLE%P9`xAfeogFFje$vA# z@TY)~8G>vxOGwo79BBnNWUi2Tg7ZUI5Yrb58Q(W)NeFL-5C|d2MdyxxD+D!!BmDls zR`fQLRgeOJ_?}hNb*sKcSoemV)rE<9p?31%_>c=5`62guUwuZ1RgzZvvG>MB~ zgPr2!Q^~llfoE5YL`&Qg!d~u^5WW?CUkG1>a6tIyA?z0t&GKak2YI&-;cF42E&3`1 zPGz@;dCJ|)!Qq<_xO!YwMvi_L!uKJZ4&h7)KZNjO2q!`~8NyE?91Y<(_ptN~BO4zR zC+v-*oc-sR&r?$3|J+8MGoBUwoRr8}ehJ|sU$=4amxD_oT;_FcqmGSVL-;L(>K1BP z_&tOxyx~|VZsBSOfAF$x?atn7AzTmPC2zmnUE=m;2)Edq@V^8Lisj$JIm_b^ZijFu zgu5Z!3*n*Y_XQsaetOyM2R@;T@sTKR^>R6fCm}oy;hBif1z&`4?U#SQhj4MPLU&Isr)IJcCkpe-7NV)~F@>W^7LqM^L`kub#X=4XIW1%r zC7WP07kkM5pJ*=OiiK1Q(c+?JX|YnsLT(FrEabIN$UI)U{BLdHa+)7Pjj-BSty+M*CM|*cty`MYoYMJCA7KU0F#=}<@nd3qMYZ_x7VfpCtroV4+X)sXT9{;EvV|!Y{1!|LQ!Py6Dp^?0LttTs zg@qOtS(s^I7WdfG-9(o(KfTbkdNoNrQA)X1{J zf@(ptpi6DNT$x?&_r{z@;|y*>6NQP-0te@GVvkOV0SiH~{E%mq1&as5!g>of8(3Iv zVU2~bg@}cf7FJofF*UB$nYj1bQlpj0WqT!^Y)gkKCqHQGZZB&syklXVcuQ$V!O6+m zdnxJ_-Zs&Sy%$POqBNns9Z4vxf z@MyW5+bw)z;gN;M7Is+JY2l=WpDpaN@TrBbEgZJ6+rnoSzOZn>!X68IE$p-KIXAo= z>4%lQk5l)yqZ{ogTYK7Xf!}1orx4d_PhVO%$fIE4kcIm7l#cD)nv85uKeea04pgWE z)#*UrSU6(gM+-k$_}0RA7QVOe1JAt&shL(O{HQ5E2g;{zcI`lyjwq8l&{3Y!T!e)a z+`}Dc6MN`Dd;~Ec1#qL5`(V`0y~-&Ir!D+p;hKdr7S39@XyKBDa~959xM1NI3okoR z?v7NYBlRh*4DLv8b)^2Alsz5kvV~tQ{KnfpZ%vn!ofVaf9VvY$D&C1&bfPO3ADXRP z+_VV&tV zZzJu~nB22)-@*e64=t?dOglPL(HsgtjQLB-_YtBZrL?8(C~*Wmh&@b)|(} ziJ!pT)|Iy0SAOeC{CHIEZj{qTE*oh!JT|t?R8nm$%&JuAMv9H4XWdPSaYi@V*o`i9 zBeIcO0_(54Q9c{_ZIrc9&PD+n1#J|wQQSr$8-;BYu~F0pb*E050Tv%C9n%17Pl z*Y3o}1eLH+(ncv8rMd0hX>i4~3O%S_51QVC%Glti(!T3K8+*7tP~Jub8&z#ovr*AT zB^#A(RIzcZ2c`9-hCOL^Px>v7Th&!PiOwt4ZPc()(?%^D!)GgddeW7i^r|QE8PsfZ z*irbwuDUkr*;wOXt%LeD8rbN~JQo_;Xk_C%8{gY#Y@>;dx49o|G_}#p#t<7rZ8W#h z!bW!+J#4h(j z^`;FamCiQ0*yw7bn~l-EDcqZm^`>XNN$Er7`cUUSG@=jnw9(5(e;#hGp^ZK^`r7Dc z!`p|>|E^TMrEKX#d-~ANeduu?x331;7-VCxjW>Ao`_h-&l!YHC75Y-|zI546H2c!N zzBG)x#m00SGi;2oG1A6(8xw4d;%e9!V`Hq1Kl;+n-`y@v?nmQn@V`|2{L$!sZV?sx z(L@`QY)rK=&BnZbG?^z`yTrqiI)#hoQ!)DyKSRXl@s{XM{rl5Q8?$W8x3R#+Y#VcI z%;k(s`qKyfU7ug}rzU%pE60=@{fXZ!v(UyO8*kcpi;M10{4nEU?)k#B#0CepuP}hx z4xs4++`R7%pk>_QHa6J!z{Uz2stw0R*oJ09w_(}{*f6-$cwX7?+u(zhz8*mL22hcK z)N>%s8A$v*>H2{bv=Opl*|2S#`BM2|AUzsLSq4$@K~#Sb^&CVq2T{bvN*nLkSZ8CE zjnzDhY^>!H2hs6C#D}O~ALKql^Q$v2p`52n+D>F!|4 z@dnj;!~Gv{qm4~A_So2KW3!D9ZS1hI)5b?Ow%FKi;}f22Z_u1K=wmMK4cf{})y9c8 zC}{|l8$$ht(Ci_!X$bu~gkBAyT{b?ovD?OHyi|u$-JvwEmeOme`>)xXL+O5tv>iif zpN-FL9JKM3jr}&h;JIq!OCI;3#7|--4s$!U!7$3QNf|MWc+)#%<7*p7YgrH50?;WT_WEgDXnhr9d6cf;wtjSDt@w{gYB zqv7<6jY~EzbH6o6zQ{{*p)#smVx&aRl8ML1SAey*s2` zvvHkw4;z2;Ot5jo#$PsWvh!04jU->~w0a|H=t%cWgV`h9=X`J5xMSn4je9cp-XBRT zOy$%_y3eaJS;sB2-6*$|M>ZbYfP;(ito4_jM}2gDjJS z%np(qBs++65bq$tK_W*-)9GeuEl1Pf(Zq*xFC0z$_vqHql;R+ZgRBm+Iqu0qKa8dq zqe&SFLAf5>JDl+sOg}VgN75R-vnAXftr<2R!<0Re+La5G6ym?v`9JYql6_-- zw~c*-_jSR-6x?N=v5FkVrqbV2DRCMVoJJEIOmr~A!Au8} zc-lCa;$SLw#Wb2Zji&#lgr?Cn2V17my=fFbosK_Ao$lboGDngGCMu2VMt@9V~IM%)xR8Z#sC(!P~q*9AuwC zd7?t^6^AdhK){EERPxm@?;4GRoi{5dt&cPW6XC1uDPG-?ThuT_BhzfquvIPa&is3&f-S#@=?5HqDZKpSG|qC!!Pk!adaTpDiXA?8 zG>yYC2j4h2;^13ReiZ!9!S|Ap4So>ixfuT>{Akp2MOwz5scdjuq9+7T3jQp3%Hgv^ z-6HyQa&O)^$3@JdapT;3xzF>~I*Tqi_(jM?!K;Fo99(wrE02^!+3bpg-(#HLSj|c_ z`iF?u1g{JJDab#vZaTQdt2>NVVf^jjHg7v&R0`vcgS!rjgi$n%#SfD2Imj8tg&m&z z4jxE*AM)-UMuspRN%S#0bnw){Gl{--@Z7-*-c=;Z4S6XfirHoplUKY^&vu76UD(|` z|7U|R62nLeBcte;m==adIE9g0NS-kA#!{xUmKUrb_-hT&a2ROiqljK(qEB#frQ zn+Y}-EK@K(YRS>oVYCUu7luEKwqdjjqiY!5!e}qWaY4oBPzT{11v?3L4x?XKCr!utvK7aSnSNlnDz;4p@UF^omg zhs099S&=e4j1ghX6J=x=qqt|nm>S0Dn9YPR#t0uPI4+FwT+iL^Zzv8-CWbLd#K~cB zDvOM)PZK^{aC#Usgv<Je4V)oH0EsObCF66&e)xt1hsk-Fl3V35?%*`+YVSE;|35H?Mq4&ZFg<&xd!;z#l zVT6UO5{$&`R|*+4hgJ)TM%RY%P8jQAHtWN9H)h5qvJHp#!`KkU2VrasV|y5%gs~}R z|8W?bg?|{vM?#toRJOzv_P}AQM7Ign?T#HnSl=DSPT{*^%BNwlA5Mzm9&YR$+AGRF z!OsQv3w|MZK(OT-?w;^f7>9V~uR^m`_&SWkVH948A}jGt7)Qcr5kbocz76BMF!Dr@ zH-hiO_f{DV__T*<1b#SOyk*P;nV08YeuHU}izKkC!BlGUt#O zL6Y!f!Ib}-nk|By5!9XQZaCQ`DMtjU68)oCe69!>Qw5a>(uA<$iGX4}w-Da<@rF&_03=+%plp6~WsPbc&#J1Y;u@7eSW@ zx<)WGf?*MKi=cZ1gCgh~L5~P}Mle8luLyceh5JR&hbu6b*nlg~fjI{z{UhM8OE@b7 z#emJ24~`lO4vFBM{qDNvFg$`$V!$>dA{Z&0buNN4ju!hdf~<^>U_t~lBbX)1#0aJd znZ#Yey~HCZQLaNYd$dZ7(<7K6NzB>p>M`y%*Ul0M;akKj|` zI|O$M`sdNkd9+*jXAv-GWlscqMTvT2Wxqt(?UxaJ5#tA9<(`!izlz{c1YbvRID%^t zT#w+J2#!Q>mbW0@|0DP=f@2XJ=lwr|A0qfEf};_;eO zr7P|aw-XVZjNs=8PVo|$PjAhqo%89+e0n{f$}XT{pDL$$SuLP5g6W#3osZx`1iwb` zTLiyEaFNG4g3A#sUqGKOpzjw@(XTvL77$-id9{G@E~MWhxDvrt-mG}9SV%WkDf}k- zAEB%!rSn4ivqj>&j1k<3;86sRBls(Vn-ScJ;BExBBKTXn;x;#AA-!Bk#THSEMegMe zz7BIQg8LCXh~Qxa33b!PeWVOtLqE0HWbMKH32Smcm( zC9;W^rp$2w0jBVS_#I~l~9B*PZQ!1q?O1mgirYAB>opH?@Hub=`Ps(f&~N% z3KkONq+3g<=t>k@iQ6l2=l^l_9Z*hG|M%IwvYUln`i6Z7ihxLw4i=CuNbjIjK~X>j zrKuoAK|0bqNv0&3OeP7v_udh)BBBB|>?n$Y?SJPJzefNFd=Y3w8m&s%@ z!}$HUhkf+ppdVHJsOHBiKUVuu-H#gV5xeHcy;8T1A9ekx=|?Te)=p#Aba$NV`BC4G z{(cPbqk$g{{bqk4`Ec(wIc}G7w`O!zj&VF?9qo*IeB-_=GZhmx6 z$3WvA!c!i~_Q~$;$D@8cCV^38R7?yY#rukreu61|px6xaW4IrW`!UFm!G1j9#}GfB zVo}-yt25Eh(^7Y+=*<4-`I)rk2qDk<@m$)54UH83{QoGUg^%%LET`#D_xs2=c6_>G zTHwcve!S$z%YKaa<5fRi^J7A~bc!FZ_%TtklLRLV7Rt?gL8>nkoa)CkKW1}%`tiCS z(|OK0UCs1kh8WWc8>)Lfn>b52$q&=j+%$hf$UGhqGu)8oOSX>ig?=pZV{zJYnIB7p zFBMFAUM_rv;7UO{={-Y@pW&`OrZs-}{RsFG^h1-O*y4xohao)Shbe@XF+W0ng#Czc zozGBF(JkRDrD6*wNo5^BsKnD|Nk7*5vCfb6er!tn+#ppp`jPUJ^1$kwMIqVh$2K0S zY5QH`bB7;0MWH=ycKfl%kG*MSpV&}m+Ard|8LH$(&mlj~`0*z9jge&z`*FmNqnryd zpyhF9CGrz#a#F}C!P9;|`Z70Va8{~(;Ky4+&I!IP_>Ld%`f+)Nde4vdMIop2teGyJ z_v1r9F8J}06n*K(ML#|k{<$BY2%*^(KRy+HN$|2CC#$;G6NsOQlFCy5!jJ!yul%?w zrCLO zfQ>WN$1~NSo29b@@CLve2wRpYUSpz{WW&VlLbKdKTe>XwO8vat0EnIPfba zVBNGCou~ZQ7bV3T3cpW~k`QswiIlY z(wCz7QnU%+kpMzLgo9`sK)V1w2;h7G?Kw~Zj16F%7a_ zZUJ-;pr07@2%u*GeT4T4pmzX|(oC|`W~ogwZWm{%pCsKiTlJM968h;Mz<_i`)}_Mq zcmT(q%pDZK-~gTwk^kX(GJqigJQcvx0gMdb`2dCnFf4#)19&cg;bQiTV2$25+CP(t zuIhI9_b#;&QZ)2Z9-nRXLI9&BTXA-gQ4Dof5k8HF#$!Y*J167C0A3P)CV-a%c(+Z# zssL68Fg}0@qQ4Tr8v)D@V4`Fv1u!{)DFM71z${Vd?X>`24`6x#Qv;aB*_o{t&sKH% zWoxt5i~!$Vt7Znk#4L@OCC(0Dj#Qs3I8X5YIfY+enRD}O)`9>Qin3HHE(&0=WG_kG zB>|L}<2p&c&&Zs4&TKq7#3l6_7rlL4$1owb-~uwF_@nB5q_rT{hz z-y)c@`46`Tus^Nu2w-ObyCl1t!x+H60QPVVNJB)XRF-%kfP-Rrh$~9SVO|0X;HdB; zV!3>dA|bLl4$cV~nUjL21WyZoD`Wd+0B70#7RBBQ;9LN2OA%|mBZNBnyTacSd|!}e z9|mwCfLDT;7{o^bTnwOC5XFOdt3%$$0esFSJu>eTG5%DLel7)YS@@N-@|lp<{jfM_@+fwcdjD#ovWym{3u8=eXjaB zfa?L=4B%D(zXb4W05_zRcX!ZWyHq6kjh_Od^S&cyFNywHH6Qt30sPJVJc#Td{t3Vn zL`D#qLB96OwX7@Hd!CvyPk}a4@wOle3Gco#mx?!t9LeSdVT(P*!lD!r%nkBAJFd5) zlFfg^8Dm& zsS`xqAnFBCKZrg-^bMi`{RGh_h)06_)erXv@lX&=f_NZ^2ZOw8*V8x%Yoq76u7#Nz zrFlwe8bq@ong`KB^fO|^qLx9l3gY1)TK`{rdZ0rlTDA?MT@c-a=n+KwAUXumIfyPn zbPR%Kodjt~PKQh>PV6d0-2}V8p=i)Eh)08XEQnq~^p=<@rYaIyg^4Zp3!*=31u-Is z0YMB5VrUT59}i*>$0vv(;&X5iPo%rUifo!TDJM?_@wC`bOnDv_#Bfob5qvh?ddhxe z5YGoOE{GR{cp->UVly^vGdhSdX>YVo#hfB91uqP5YvUv2x3+cvxAr^S=x`6Wy$QEAm#@7au#=$5>xsc zLCgf>faaELtffWxqyvg9-)HTDTW6{E`g> z5fnm23qlue2%2gA7Vj73j07=Q#}hiDJYYGP8b)h~1>ppdt07NAJcvXPze=rS5Nm@t z9>j?t)`_w{hz&x9+;A_7ZVX~)5W9ld6vXBrwgj;?h#g!5H@v({c3TkJ#h9G`Zuk#V zb$3hAq$|05gzOFSg(mKkp!NmP@=X4I!2^N^1rG@x7Ca(&G>BtDXuqwh_fR#Q4C4JD zJ_zDe5U0iM8Sc_SoD=@0;MpMf&-c{7E#3~|T@l%rcZ9I$Jt3)R&j;~g5T6EdDTuGn zxX<>yz>k0+E{e@3;_74JsV5)OfF4{7;)@`@l%gv^d=|v#9GN=*{?gs>4$oIXTn*y; zAbz0dAifFWwli+&>?>K{2Js#BOYYg!hE_%YmKE|N7i|zfag>61{B$Ne`$TDXkPFXO z*QJ$TxT&6XBfM|EyY_B~_?zJGLEH@DRuF##0S&il_%n#VxZ7+0p0oWOgh%*4Vt@CO z?wQ8G%zsNWHKg9xP$+GmEhI}rU5}Uj^=in`P*_8ztcoIa zYG^2~p@h_}tf8caQW|d8P)4f&#%(clx3!UrAqW4%BWl`blqCgnw^K?Naq2;M1} zs(6?1ih`9iP)xbKTSFBQ?-8sjSWU2lj2?a7tD&BT`Xbg8tR+}mu#Scy{9Rt-t4Q6C zh6WlMYUr+^hlcw!+^^wb4Xrgiz(zGR)zC~sBMpr;JfxusOV9aU=~-sVe6@ML`gp$L z4OhG;>aY2#xrP=TJq@ii6z%A%xPZ^zSBn;?y$e*;E51t$_%LnNM#Cc-I%?>op{<5? z8ro~=)p^JvD8oKdFU#QM3RJ;f2n}y1=NZq$c zbz7vyE>b-;^kTo*DGj|fJgQ-UhJhL$)6hplUk&{L>+p~H*AS&@VRez6W<68Bf0i8yrA)EHtIx8@17;<$*F~} zEm5uRcW+M$*7c3iFjm764M#PM)9|9qPT$q)B@HiYcum7p4dX@R;7rjlLHH|z69p%w zOD78{x6~cRSGg>OOw;hXhKL4B!*mTZG%VAwT*FKavoyTHVbL&K!yFBBHO$kn`gB2y zrD|!0@3EyScr$yWk$ zE$mySnk`c+G_2I1Y0x#SqFW6CR@C^SD_^f=Y7Kk6Od0ix`Z=dUPApSbm#IIG6nK{_ zgTtjEq#?|yU#^ByS+343S2-)x{9V3#SE%MIR8)hlVVj2S^q|4futCE{?*AGR8j>2; zauHT5Gq0!X2nh8a8X#qG2n0u|nPZfbZ|0d}a6f z_Am1N%hOuQhz2;k<@R8ZK-2kX_U8 zv4&4He8fpyt&(efJ6EfV8o!ShF!BCLy1jI{;8SiI#|w&I&;Mn$x}xDT4WDcHLIdxU zzjKYMzedem!yjeTmNn{24L7{LuQdF$MlrGaH#`tD{G#Dk4c}?_Uc)t(YWRU$t6%w> z_y+jZlTQ}@ky{GMuB>4v3wC*ZKeJ!o`X)~BUDrUQenZ1=8h+PsQ^OR$+UQpw_*IF3 zsvb~$TTT0bx~1U{9$5j!MEk!r{KJoa9Yu9`bY$qr(vhtrQwMb1rlXL~@5PEQN;nwc z7Z6o4s8%L@4+q`4UL83)is;DId0MDu2327lPj7R>SRZs>eR3kGeh9kv02k9yTt^ul z1v*OTD5)b~hfl{_pBC`dB&DcpYP6+XjR$vjQ%BfjU}@1b;zY>09?%Iher<4aB5 z?s`*AbvK6ox(e#*t!ut7bX7seT{>FoXr-f~j!HV}>8P)xvW~lTRM$~MM-?6S=%}ir znvOg}H8vFAamM%4buiS$^}Zd)ea{-|UL7@c)X`B_M=i!#N_BXvV6Nf5o~E`$NOJ3J zLG=!0jv4ABLp9LRP)8#jjdk3o<9;0v=y*^py{2kts?MewYAU|N;$@<#9@5c7M{^x5 zbX+#s5fp?}tB`8OAzI)o6mlPu9Z`yN(_@+UR&hM@Jogc7TA16^qZyk@)Qb%7Me8bVASA6$H)MGmT?C+k~^ogh`5w$g<`v2$~ zpkttp$8`+S@l!c~Zw~2BsPqqT?wp4;@2wT-Wi7j$t~6 z>qzQYtK%6R&+3?~W1f!Zbd1n3LB}hcdL7T}7^`EPju&){(lJ`c7#&kjOWUmCtpTCDUYEP1G?-$5b8DbWGMUg*|1E zIy76Iv(*h--5zrXs#{D=jj0M}3SQSSUB?U^Gj(i^sivn2?mOZ8`b0tV1HOWtzF9hE zbNpqxQ^;TC*w7m~=F_JRUB?0)3w5l}u~Nq(9gB4=(Xmv=#hCh;O*pEzqxkyig^sH7 zj&GUHr}V4kg10&rUZrETj)0D!j-MS>Gp^Qf4aAjS2h;kzJig)Oxwu*#cR$Jx#+9MN zp=Z^YfIvgEw9SH`RP@59!c*1>U z65km0eZu`*&P}RyY)HpB9dGN{pkt$sLpl!Y*u(+Ru}jBp9b33abnMWvlRL(v?p+Yu zbbQ{ZOueMq&Lc6YYM(90uU>|4+U2hPL{jb1v6p?+aZtxT&O*|isZB|D@$Bc$u+W_^ zenwnKD&AWETT&g-aa6}C9jA31({WtK2^}YO6kDstZ}#o{C%^GpHF&M!O|Yyud#yU7 z<4qlB>5Beu^YQ6k+FHdA&@-ET-deuBYt^N->Kz^L>iB}YijMbmyszV99iQm2=tg%Os%%tz&0?30>Y0tIh=E)K zB@L7^xVxgLfno-Vi}C!8YJ=EMO!!I|_~Dmo;!Z<1|psKsf{D4OBEx$-o^3?le%rz+DD9Y;w;wpWUSRZsl#w z++*+yy?{UES2l3Bfhq>>F~B$T@|XJAo7~8cY*M#2x$kA;L-48_s9~Uvfw~6nHBi$) zEd#aL+-6nS;~TiyeNW|>&8p!A-*3O>FW9W=8K`fdfq{kwHa985AIhuG@M$G{k*(m*Q%%?*AZ^!>0| zmD!?tR`Rwmz<?fk6)yYuHfO$FbkbHe$iQF&V-1Wm z@C2(Ec*el9-1*rN1H%jqH}JH$;(Nrrf9DT1z?9tT`f2cX!3SH_?^_k$Wc{3h5e7yX z7|m6&%`F}LUBO5L&l`Awi|QjE@8}>>Z?R4Bk$@y)*p^tnXy7FSuNatU;AI2j4NQ<0 z+h_TfZd3cVsUNqge(w}Cc+WS{}kl{)S zR#I-jt^65lxg@r`<4oKj#?&{9%|-*8($#5DJi0p4_D6UENCo!P-iwx-vZu)_@i9#m+GVr&73=^5ATl9|@cucqBH2x1+mwsTn)0%RUWg2dhnSjV?v2R zfdrG%>54&?6+NYtH*tp;R5Ed=i3%p}GEvcVd;0&S|N2td#NDR5c&PBoRaFz!Oms2% z?-*}&hHav=iPxU?-Ycy%FwxLNO%t`GmD(cKHBl!$M5z^3&qRGuQcsJz&&2&Enwe;B zx`*lmCK{P&Y~n$7YEV930l=nN@gb?wM53ia%ckkbTbO8RqK%11Otg|l*`0^~Yg9<8 z3bCz;_9i-*XqVP$Or6-#L?`i?ijz&O80~(a>T05!iS8zPm>6whjESBmdYKqv;wclo zO+0F1pozy#JZ7Q~C&)xU(|!N%+U@Sg2R$4;>#KLr_vv=k-^7jWYJed1K_&*9c!H6b zxcFF^Ki~J2+o9sU%lvlHZMWMFHRopj(w>E#{j+e^N7 zzxaYX)PWu9_Z^DoAtOyZZ{h_LqquB#s!luA?44@YPIYOg%G;&x-K9J~=Z`fp&csv` z(@eZ*;w2LkO-wTJvWf8~CYX4IVs&57U25bmwPKfAze}Co<(}bW?pBjcOfm5)=bh;D zRobocR{Q$wc2D~k?N7e4_7e#ZTUG9m~`#5 zGU2R6PF!hX6$d|z{$Z@W%ZZFX1&z zm?lCd!fe+>g6pur8xgbxEx{;f@ftn%HLIClf!L*luEniBEYr>{UBW>@x9=iFZxxmbH42$DN5i!uJa96Wnj& zfQd*&T)L|Wk>hY!^kXKDn>Zr;s9>tps)!RN&X{=9#7WbwbxNwAHo^4znlk_SIcwrA zsd!Gz-WJa4DTDVU`(yiJ7fie_`~$)Bf*%UD>hkZ-_K{>S3Vtm3iD0w2xFqDVi7O^P zGx52JAGsj+DyAhUd@mxEAJRn}hjx>}MDdy! zP`Pg67cnTbPyH&SXb8nZxMAWq$^Opy;yU5OKTX^+@rQ_infTkppTh6;xj%g}{bM2{ zgv<~;AuJ!@etjcC>XP3Uf_>Ay%*AxqilSMfXNTYoAtzmw8$#g_iiEJ^;cQQ_9NH7} z#PalH_XnfmA(W78S;3Ma-apO;kB&qD}B9;@Ra%Tt? zgbxm(@ji8z@X-g|gQ#K%l|rZ-!rdWM3E}<_9teT|;kqY;>LJt!p=t>4c-$Wvs)ew& ztlQSTA=C_^RtU92Q150vWELN_Pfg#a>V!}?glqd$!w~9)P(Osf>Xm39ZQ1+Of_Jm} z%`LuvpBi7TIBo6=q3nKj{LkVKhR`U4o+0#NY#}@pLh}$>gwP~}&ihrf5Zb?z*))Wg z_PfzW_p5<{;ver=@jn$;$RN2q*RtZfLLgpjur z(msR^X{Do(;s;b`AzcK!3U(9hE|@Z-f2(3n?+_jhVL%82LwGENJ|XNqpw1moeL02) zRKF1VvkM1Q(+gRg+{#}Re&T>yeLy`P!v6DF0}d+Upb)MeaQjmHpyHn?79UhYLU<~K zDIvTX!qXv4+ndELYjOxfh0}6a2*X2oMny$3r6DX6zFcsH;7Y;T{XBHF zhMRu~KZNjO2mx;XT)H8=%M{OF8Oqi|&_ggnFhe*P!l4jCA%sKN6LKG0#O5N>TwKr! zAu7Zcj0vvo21m%(`^qFjNT$RPHifWR__`3*)2$p?8-#2Woyrz2?_-%eLzrCNyETMu zA#CRgKbE;e4A}a*cs{cvOuItZEtcf8=kI8HIoEUZ_6hD6JP<;I{4x{|hj1i>Gdv#q zd5+4!vex-gnRWYlj)ibs#^;3KNx@SgoDLy1!YSm8ycxn-DSb=uoZ#Dn^uw{`ntU&W zk3zT@!uuig+mrQy;CaCh1uqDWXpqTL+J79vXWU+PyZjR&pK@;zayhME5pwIC=kv7k zg^({p_)5st5WW`jO$gtmZN3%4THgy9Hr&G|u7&UucdY{+9zj2|gWQ6`Xb{Gf`QBeb z_=j7!@LzeX&G+62;Wus0h%mMDLQ@XA>ai~iu?@AEK`GyNr{e~ZX$hB&DdM%NnN z%rFqfZDAA&qjVVgVPu7o9Y$^#d0}|N$PwcrVb^nE;dIN2sfLJ5MMWqYERHqDR7L7e@Oq+NLdO)*+0JVRROy)BotHwo=$F zjP7APCZ#>nHoe2>8AdP3(k#{Dqv>#(IVqc0V*9597HoMhG7i z#^5lX5dNg#vtbMo@|57yfc+n?Hc7ot5f{cpxlLTo@PUBaFye2qRaGD@XX)`^H z8DY!}V^$b?7)BVg!Nuf>~!y9Lf9AjkB5;ELY@p`ZJMtW!d5nhu_=s`FM5xJu{n$_vM_ds zu{CYED~xTzw+rqN+$osqH9eQ;=h-6__X={2?Gv(J@POb!!9#+F1-UC8m8RMHF&?49 zPoxyVQ-YHw7d{;ZvE1RzvthhNz7dl*;#?SSlgBVQhIhhvH;g7{i}bhMKYP9x#?>&s z4&!~s**uTwgD}nu|4{IP;75WN1!?nf7@ws1r(s+Yep&E};AeuL3)23JFuqLlufpz| zZ7F^e#Sm6+agPIB%9(z(tcR6XavO~C>e1hFD`nC|0zv*E+wU`OB>$8 zmmhI&U-U&#MhJO<5G7bPg4>0Z6HMJkcxMC^BKW<77Z&b{pkf3IB3Kwfr3flV&?|!8 z5xiE}+p{T11dBEVE?MsRXl!Q&AOl6XeUbvLoWt6d}nlIT)N7SMS z7DwEJtpRNjr?y)1c!PQ{xpK()eCRw;N^{=mn2S#Ws2jo2tMa_cU1kzwRco~Aw}Ot@THKi zBDfmC*TTOMWVF+~**ww@cJa2Z@BNM||8my%fvkdGSXS}*QO4m8v9RF@!&vDPM z5!~P^vhZkb(aXWy-?$$}aFZL?wLESSx47*`@OK3NaMJy`9arW4DGskcjlYC6@1DI+ zMw>SDoM9nS#~TggW?HE9d+E=Ps@p6SvT(ASH;ame$`-E|z-uALLSYM|>Uj$+6tR$N zp@fB!7V<1yu=5($@)omD)N*|`eI)zJP`rJ&x44CClM2e$&C5CFK46x;E@h$KF;&_^ zzJ*T5l+QvL3*n}D+yK`W$tEfbWu=wdE!-)DEta!TUiclU0E!l+$W%eHcUh@kA0(!T$U+kf4_jz$p{a#t7MfdVAw$GgR<808_r^UfEwr-uFfmVy3E9uc{@<#$w~d8I zEOfBYks(=VXQ91?sd?^(*}r{urdVvO8Po!k&)EZkU}-aaxXd&3j(z z-7WO6Fr2|#=xL#sg~u%nve29B$3i~~{VmvW&tn$)Sm+t3yUM4zO@<lmipgxcYvCytUKR411^#kM zWvYe4_hgVyw=lzU&oTPim}y}a!;9kiC}y*RY_6-fQ5176%(HOb!iStV3-c}PvaqVQ zcY%e47UC9oI4rWT*aG*8poJwCmReY2!B5M){ACtq4$fT3g;C$TTyTXfT4q;Sm~>37 zmPJCsumc?D?EJ@byxfj8+-;1Jh6c;UgY~iMbTNXaC@TrBLII~>~U$Su7!q*nQv2cZ3 z*wmnT@rQ*!EtHC)bQHaY=6p89`!bA~TAtD6*qK6t_h&XLx3zC=S%~{xG62KT=)tQ7*^R8~yjRr2XJLDj&D^ z7KtL4M?`0D@hI}5C>rH+AU(yRV8t&U%^t8ehc+F%7p8|2QIw40-pZ~|)+Nc0!WYH< z(b>V#Ic1_Kh@xB+<)dIjO0cZpoHm|ijdN~~f;hRA?~W+$jJh8#la8wjQQRe|Vici= zyjL5$iG&}`BzH#zSQ7ekw z$K4}k#c?%wu$PIX=m}MaT|43GwNI#e;;_D8v&!CvLhcj1U+{q_9^^1~b$5QIzq@!E zNAXY;O`>QT#Zyr{9M5eg@w6h3qPg%EQS?8dT1L^Sr+Ykp^Fl%EDCYO`c8a2N6m6n- zB#O3CtduZ12x%wSKI-nqDZQfv;BW8g5=GZ29*<&B6y2ie9z~xh`pQi8;7W+1cN9G( z%emn6G4ZVF(I_61xqGITH#L3K`!O)FGkX@fSTg_VD2B2-y}ZMscvgZO&Y@nD`%Dz;FBADo!e15~FSzA| zViCO&Cq*$iibY&rZLb!na zQ3Rq0Mset#3??lKU5Zj!erB1H4GD$?BZ91J2^rTXCl-Yh#nmXj<^d8#B8sz7ycI<< zinTl_xNLH~>o_k_>|<=4+$c6iu|0|%QEZB0bJRVf+sgI)ta})4;R3dEsSvmED9+3% z{Xzk=JEPbY#U3f$EmbJ0%nW`ykkD+e%phxV!5@g?a1=+PIB`N9WbY)=IkQK3c%D#o zefdMy zK91rY8b|S=H2t372ZHaXl=lA~v*)AWVf$wnH+vz9kEE3Rw=SMf7*7;cUdj7{o7G8m ziHG({bwvy=M=|B9yL7317RBdMbnZ(pvtLH>703DRqWh-gBueML{AiJHqWG4(gpEQr zzKi1fDE^7UW8;S?evIN)6smLKYf=0Z#jjD^h~j5au1E1p6n6~GWGPdMG+*u^|1FB& zqqxcKQA#VMZJ7Ndia(?HOFaB7NP8NjEHi9(9wC@1_(lh}<0;Itk!_={je0h`Hgar~ zw{eG!!ZvTWMkyPmZRFa>vr)oENgG9Nghyl+vr(MJ%M0_|EM7dH$SsAZVLTr`GBT5= zXFRpbx8bu<*2e8N%GfBd-P2lSBbn)*>Gdd@%j~<`+>_frJoPQ&DJQXUucLmajS4oZ z+NfsZE*lkX+-;+ZjY>8u+nB)9jJSsTq_(dQ+#e{H9jlMgtp<*l25`p^f`&G_$$>alefR zY&5db*v9xqnGf1-02~2&quYmUG_ldt2HJY~)qrQDPk&RGgrCrwegsZUg=)<6Szv$J@jf>8kIa1SM>oQLw)=!q zeq=A}USxocfi@nuG04U^Heq8hdv~@7({ncZom5XSDk0=UgghnqwBS&|VS>X2pAmf4 z#^jTVRYuqtY2$ett15Y4urW%UbBp+Dpm($l;usr;lO7VLu{QXIM3R?mWZdaJY2%cQ zmpKJo12$fa!dBO)F` zg6ErgSQHjcGiEIsyqU#Nqg-i)+`5j9ID27ZmzX7NY_PFWcv5h!jdeoSb45v1jAxT5 ztiDaiX2C6jTWzqRRCC*!lt@P!zjWf3UO|4Z7Z`!zay72crer^2O#&g!jTQ<(wc-zK1 zHZI$^V&h#K@7cI$<6|y~oQyM-yzkrifbq)##m(Wn)*kJo`q1VD4SYoBmAuR{ktuHp({EhxT|6Ye zi<07hq)Y$dXbAty#@{ylZCuL~l6Ydsh#@of|LcWfC>C@5XT^{mgExj8$>zmSIEEs^ zb7TLuJFcyljWW%aFp8%2;$l`J1{#!%fu*U~O2?2NgD-|MG1QKsP7L3)_7(_MjX}jw zHip|JTO}oq$SxN{`IvigqiJ7Tyq29gSbcL`P$tRz@j@NPkx@e(@y-y^QFyLhU_ zP+fS97-|Y(>Amb`7Y_+jtr#G@ZVdHeXc|Ma80yE+AchBHXcR-k819SV0mj+Jwconh zLvnvQn^GE!=Z6GSrA^Xp(Rs>0Et|*Cf-@_AT8aU~csPdEF|>)f-v}O!;jtJViJ@)G z{SMVGhR!i`5#C;~gJ4I&PBHXq;hEUN(^ayx?-@h4H18fmk2K%f#nUUzd&j^mjr(w5 zJ9>x3Fq}gdL%$gMi!wxTKnw$8cw9Kmo`_+P@WE+i*GWbF$r%1qo|2-c1&5~fXJU9Z zh8JUaDTe1_7!kwRn0qktP~uTAGKS}4?s3Os;e{ARar|$(U#3P2As-`TbFU(_85jHa zAbmN8@#17+3_rE@Ob`$MwDG(mga;iDQaWMLlo(!(;pqg1Ch%GeQ)B2I$D?sfi{W+7 zuY*PorZd!v-i*=+3)UM$CXn)V|EO4VwfAlycl0=m>Y}XjTq*~5Qrfd z!-5zVGLje;$J~pMr(5RTc*hnE{~4BOf9LEe3=9>WgdI|V83ieYz}?}=fr@D6-!fo$~w4Rs@&zEoRIPk?)V=kcRHw$&ZY)Gg%w4tlrCa(RUA~4EcrbSstW(#D)&05 z>7c%Y22xZ@u&!Wj>2IBMm3q=~jsUASba0=8`_o1L4aEa#g=UQ%Jj5x8BR7swmAp+H zv~lo=1KzyXRIr&~bHNr4S~>__EyB`P4jvYZQ`Z?(DV1R>x4u&{*%E99f203_wO*`&)hry2fyLsxTb7pJt7rGT5isVl_ z80uh{gW(RSXLa?QS>d_9!t)G=qDNu!MMK;l-1#+mgo81|yki`UbuiMw^E`r{^uFL= zl!Jytye!Ha;vMba#}D#b)>GUZ+ZNnuty*0`B;gnm&aS(TqaFBGc*})bbh84VP8IOaF4%RtXFUsmC zb2G-}PPm>u5*aku-LvQ>2SoC%T#62MI@sl4JB_<|b_lBX$_#DeWvX(m$ZiLF9PD+l z&vAe0Na-{nZ@RQFuY-{sWXulUbMQWAe`cA(4o)~Y>EMWiqdcId=f2k<@0f$*JfM1H zlQWT=a&X$gTMo`~4{4BbM#l53;F}KkIm@A@PV%;h%)aa3oitAwRBMp&frBQe)kOy% zbFT7AM};p^N>4lWD%)Ny}krgDYNiSmWu=Ysr&f<-i- z8Oc=#U-KAraMQsz4!(78-N7#ozH{)s!?&ZlTPxEK4u0gQKJI0z-pi9h>OYD2vzS%u zR*2)SI4Z_bDUSQ&cp#3- zaoin8tvG7OQ6-Lh;;0eFy>V1!Eu_ln>D@|t46qB=tA#Zg~KUHTXM z29j+U$9-|IBD;{Pp27#?XcXr~ezcCGaU2iPCXNN0BRBR@G=qlwcg)OD1m0-$e zN^c`d+c?_A`4E7ASIB>L+l!L2U;^-+u$KG`o(j|_rLO8bF;^;2CM_S=^<6gpP zPbZJX(I<|_66lja-#Gfk@mU<7$I(BI0ddTaV?i7P<9IxdnQ_dDV^AD}rTR2MhW!NN ziDO6{PsK4ljtOx*9mmi(#>6o;j$v^Ok7HyU&&Tmh9M5uL#4$paN2&|-km@^;$_r97 zDvr@I&i_qW%9z7GE{>OE1YS&!Ose|J>6xOc z>7VKKIIqIFE18zW8F6r-k}%B{eO?@Mgix6)6=}dBeM7{Q@j~Hy;#d^N;y9MXu{4fN zA}*uDIKpv6r0$A1R>!d>j+K&SRIAd#_~Qt~p~qpw5fo9A4yL+5OGayo9!l3`QL5C6 zBg*FDSR3c>`|kRQ3&!Gbgro+O#tF%$YONDa;|+1FPY))GHl}sfVy`#Hu_cbJ(w%LB zJLA|cgrz&;?l0*akX@qePU{r+3f~vU{x}ZAaWIb4ahwt7hXjub9u_>34&YcE$3;02 z$H_QO{okXH(K5m}<2W0~M{!(?OaKsW13$R^46T3pM_jc>%YYDtMHV;?{VDZ zPMAQY1a8IgM;x~&P%eQ#FPB8e0)Z#3jLH%;0`GwzcYaf3HOPVcZuSchfG#Z;O+z( zB+yXADhb?^Kvm&%UM+#@!s{eZBY}GpsFgr%QP@PyG@*04r9zUzx(U>iQY!U@EIO_3 zOW^(lS|-p+lm`-MltAMI9+d9G+!<~pVur5Q!uMcgIf-b>syfo?*&3-%D~Dag`Z3G^2JXj-{= zXD%PJ+&6*#2@FVpykEk-2*9uZ0~2^WfhQ7pQj|dn3>L!60{c5=R34K_93l$&Q)xnx z)rTc8Jb^t4>`maA1fES`Vgi%codiZCFfM@?6BwBQUA>UNs05xDo~k=KfiVe;m0(f| zk(PA(X2*<|5_ma*35<%r40g<5z~iN95|+~Dl?2RM?#Tu(=~V3LnVi6s1U_l&eKmo3 z3B19pKnYAuxIa2f$4L0ZB_;inCAQs=Zl1RvNu106$z|N zU;z)A^I1#_g)9$z(mk7GRRXJ}XiEZX67UPR1q1Abkf0!q zH6eNehLFb^xdDXIrC}ivK`Vi%kVB^xZDI*Hl8pdi*qOjC$?g`+JL9&#FM<6DB-SFi76%eI$l*$2RT761 zIGjMIBswQ?B!Qy|WF(Q9#Ic0?dmJx>zAfaq;0eK#f~OKV&0|40@78-WfwMfiD|p{Z z;GBr8&TN-2y`?L8-$~%z1l~*F{RF;E;JXAqNZ@<|pL6{uP=8y=4-@#9E3lIHvu@rC z34D|Q$wfhuR=cx5N#Ijjo>7+suOx6;)*cra#m|J3F#BZ!UnTIDyikwXs|m!O&#<4* z_&R|OXVf=hNiwBeMKgjwu zftv{|_U7G4xBgoK1J9`6d9X<9w-We+`#%HV&d&{B2;DM$oss8By2lHPQduIBxGjka zN!*o0p(L`BC_6KwAc^dxdwHRxpf`yeA%z8tCQ&4bT;X|1TsfReOQx~j3}P|SiziV+ z$f9vMsnSwOlolmlkfKjW8Nu6<*@{imZ8z`ty*zi9%(y*?a!K4#GNVU-Z+Q|aV(Fbi zW}Q(LlclBk>H!>sUN5{;6`=$ThPi3UkDWW{zF%yQ7~OXB_{9+1+xom`Pc zBrIy2#6wAtQ)!Y!(_?Jln?!5jZ3O>&x=1_8 zb`WfzMBlcqtB&IKu|Do)qAp2vO`;ErIElTA^l$6!mPGd?dL+>^30_s;ol*P8X7@^B z!KB>YNzC)O*+(V&SQ6wZrC$>LljtxecT^GslI|tq!R$qQ53dXlq}lS^#{~x^!3)LA zKEW807?N~00}>nAf<`b^TjzC`kz6g?}*(h=4#}hO=p@D@F*b>DNlZ^-MiMV3@lq0#l9-%yzr((q#48M@muI|;29*ht zC7GCXztWPVzT{3x;x#GaaJ?#ZS!=40|Hsu=Kud9SThH7LBlpf#vec z2Lw%mYeKLD*8~E=Ay}A}@ish2aCdiixBv9H-@NtSzgDficI`TKO8QhyPfvHxL?0%_ zjMKl{{_4XNnk64*`Y@F}lapz&>cpqBNXD~h4t<#K!*A?ijt_I$XL_U5`n*`J-vY-HtcQkZOFq#sA9RP;fj`56^Qzn;+i zkQ0SHlXE|l0AtXH5Y-x%oe~vAeNZVLeAwoL=EI=v?#(`I@j>T^qM$OEnAFd_ag?pQ z)MFkHjvWwA?D5cMyPfuVpY``54~u(t_~=)Didz7=seK^L649MXLTFAUrQg+Xmo`s*ePWy1iN6(Mo zoDUn`Tc611eYilO>%)B?F8XlEhuaipg@LVG`3G0 z5OEXC{UZay0(t5*24DQhYz#^i%1jk z(T7hyxJ0-`*hJXrBlw_aY7OW5iJmwS5K+97i#R>jL?nZVjI0oMFmZ~=c~GG2+j1Vd zc1n{IFCsyNM?}qOiC-TS5=A75NG_6?OxV|zA|lY-+MRN@w*u+&Zi$&h>cRw)pt!T>Jmf{Dpl+`MdT9c3bUu@5m#;zl=6u9^`Q0f z+WnwFB(I2kqV*}3E*20`P(&dSpNXgA~bbG_i-Qw&({_3X>jeh@K8#NlrCi-+ym4?E~Km^;m!C2QD* ziWny1ClTXB3>Ps%#267{MU13r%xD`;4b`yGy)L831K%G)x4zI#FF%UbO*^A%*h1F8Yk5l7ahGWLWop~ji`XDyBP)M%59x!o-Ee!(TyfM@QG_I7 zvy3e=WDyE2Oc^<4_-P@F2up}a2vQ)4cqQUBDIy|tj6@uv<0wKEu~Wo9G$IkY2t$NP zt9wUc#X|z!GkN@^lm6a)vxqytCM;;1utmgHI{z2Z;gCRShlt8^Jlh%570T`sv76Su zh(n_FeeLE5&mKB1P2%^`0;B`+%Dqp-0ovKVbMEIIfHnaV36Bkozx{6_{kSmsknrar z;i!mXB5qUDB94nVA>zD<3nKnLBy<_zJbp+xNkzk)r)WY%oMC>J0;wdCdWf?Gnogaio{vt%JL*I|K>QlY~_^B7N( zkR0={c7mNsQzX>S8&|W9Gn0hO5^_uQVpU|JE)`D7&X!pjvoXqD5~zwG!OPhk5^_q& zC1H5X|57Gf4-0uEsWl#%e2gz^$9uu@h+IVR-6enj}W zi8U3JDzcd4h&4G6n4 zPH_?Wn&y!81`--dXcY6%Si(@QJ2U2?iG-#Snn`HRHZ5Y7Kb7>5pC)fTttGUPFjB%O z32h~OBjG!?X(yq*gkBPQOX$E#X9-=Hbd=C3=BGnpPge=uIQt*Q?h<;$N=5F**&{+v zR$ND|N%&Sm9|`?g>C2d_ycHPzVzr7M6$Zrgff9tS*4V$7@PmXwtPhJ>4wf*4hD>K5R;xEa4X}`c=XdCiJu8)1v~8S>u{6VTOd?B`n~gnG$A8n8SP) z<7aF(m-%lJ<}sm)^O@`(=sd#FzL1t-2P^FVpksGTAijtVdUN$9#3gK$@VA6z5|&H& zi%UOsa<5>rTEa>RtC-*Gm~aV+Q@G+9R(!{VwG!4bU(dKf!Y(#=&bWz1NrEiF$DDd1 z(%L!x-_@8C8!e4OSm9Glb}mDOKZG&JUs(qNH8UAmas*! zQFe=jtrCt))_LGI3EL&?ldxaH4hcIY?3FOThUXvZq=emMBVmKXPRcNweXZ9?iLyg% zmO|-YHm0Hj5)Mi@B;ha}>!z+r#q7T{vY#7cKO$L=t5j}oof{vOa7+R{v_j|7gmkwX zb>M`AliU;HrzD(~aE7y+i+L!Kc#c+mOIO3=La4asqJ&GdVakY;aaqC@39lu*k#JSQ zH3_#R+>vly!jqb=n~XOY>-lY!zDc-6E4Q(&j^9S5cO~4D@JPaA3HRCNAtMz%U_xe8 zg(^~&Cla1Zcp>4bWS!+2RqfAc@fP=x@k=&-MPcK&Q6hyB)ujhs+Lv(AGJH#)0umbQ ziSOxHNcc$m83fPZCzla?_V1Ldud385v|;Ea@s()p{g3qYRe}w+!MAMknLL z0&(#&5@bxN?8+u1YjKZ9MzV|)=823+j5*pSrOHTSo>@jFCfiEesR|VlW+6pJkK+RI z@r>EoEqNB0cp3jXF65GtTgE6Eqh;igkyl208Iyl^=97_M#@8~M$S5GApp0TNip$mw z9))Cl!Q?YWQa)!=n8wHtcNF1l(OBu1vNgR_M3yCFd?lkS7nNizC8M;AGO@bp9?Hom zFQcZ6S~4ogs3@bVjA}9}$*3%&3RnDszeK0or(^Y4i#7hQH)^-GjCwNa%cvux?*A=q zAfus-Mlu@zU;Tf3ZYrahjFvJ^9T%pSOl(g533^)4{FF(&>P#wcdKz6zY$c;LkF<@9 za=kpck`mi;md5^#jCL{pb)JL{GCIoWB%`y8fik|6(M7f{EOe(sCZns2Zseh+jS`9U z9O!>!^pw$;ZF(`%rGsyo^p@%An8Z9??0q=U*`Ey#!o!J zakK7Cr;oZx^JAiFae0LX5xDQTUYkO&`~Zjfo3nETnVn zuM_`}u~^2R%oj0IPl{x)!jei!St?_hjO8*`$e?Q`8)fSxbES;+GWOoEPA^xA~?@9X2lk~TYO)`A4b>%Z8BP>IdAyKIe zMMgkIPzL=Qre8+U!8Urdgg9MJC#?6u;-p7pM7g>qL#2fos_Eo?W8P`>oRW8Msz|jhGhS=Bk`sT&k5nKj9W5p)AV*sd|lW@`W@y(?#Z|> z;{nIsLm7|Qo|-q|c*0o>wwnvy(TB z?-<`Qc0VCdBA$C_;zyd#iCJHr5I)JUDX=SuQ{YtKQUC=R6l7H3P%z}gfA3YBc|ur! zLfFnoJ#j0DSCBwQt%0>nE}Rf35g{}BBAKKhSwUt6SrqFca0>Z6DYP!;8UEUns(>&} zK_F4HYy}&_+R91&tMat)Pj5riyjr=#G=Z^^-z{@$UEC zob*PQW(t}s$lAlzLP1L!+I#n&bN0)VZLJivrsF%#P6{P8XWTam+9_zSpo4;rOU?7E7rNlC)1WH6G{lGUiHMA2UvndLuQVb|q zMuBunm_|(~m`~$f?3}J(hJu+2W+|AhV2*;h6mtBAE5h`&nqHcBN+A4A!S4$GP_T$P zR?~Xsg3~4x^jdpC2PaP#R~pZu!N3a!$i8vlmc%`l_W|;mMd77+p|K!N(I+O zdgkBS(^txyZODkVra-GR@v}JCT5bpn`o0_A3Y}2-7N4pwm{cKJnj{PKuU@f+&Sn z%lP~S5>$n5LAMd16H$W>N`Kd|HZD`aW`({5U@PtO3jR^Bjb^o}YrBFSOgi(!=7jVX z0y=@GqFoAhE7(KpWgST0OY2T_|EpMpO6lA_{bc@tf`bZ9DmbMeTQgUM6lY>E@sNVU z3XbrGb5y}`CdU}*X;4ZhnA4OJrx)PRt)8b9IsvxN=#y3bkNcd0^R&eLXyV5O(rI(^ zBgKzP3N9;nrQkJfm~E4;D7dBIwt}m4^ndhFy2j+Xf*UdACJlM0bJQupf6;M=0*q#x zmeNJXT?O};5WlbBL5wdS?tDxUsNjWymlSW`x}I`ZpEG~Pc%{8{Y5hc!z5FBVGvec~ z*4tL;V*VQiHb3Yb{w?h@(-Plt#rL$MHld$5T^|&DRPc$ji%$uAPYER2{fP79-k?PI zt4)2oct2cz^qH7QNG}Z_LS_km)UNJc(?5ofa&Sv7jG?{3zl_QMUQakHWE9pEH@A&qKyvFt2l3_|lJJ z%u6yBXDq?k@3b(TeU{?vGUi|TQPz(de$@1%oFC=6sHz_o{HW+hWzJS&d|fh;8Zx+6 z6;>#F{t790jEdL^~=W7}d^J3m%6aJBNIwck4FZR1B9+4J38 z?fup-aUJ~V=tn2!T^KtvHa{a!X;E15y1~MpL0Cz&ImaMdj|P2 z*bgE@7%io@D?BlAI34R|Npy3F(84;S80p6-KSulUL)pZ!)Unr@$56yxcF;~vNOyPK zQ4+`b@iUD*gl|F^@5cm6K}@9N$0R?N1h6z|~nE{H|a8_?6<>kEt|u4$p2s zrui|Q-Tvdp3_oW2vB;0be$4V?wjcBT_|1tB5f$G-M{*yZ6N5GGuA4~mM=Eq-tx>*k6mw1-@v4R7Dc&2Wim45nr@kC0i zn5<@8L&H2Hkhso|^;CC+=ia%*4SsC&TVLWN#=rgWG1al% zjC*EyLVj#;xpY4aI*!aEj8R6FQDdY{l`QF}Rg;3y4_8-KMwiv(T`7l9Hy6l z`fVi;~351T<1kUj{9-Kk8_+Q<)j~{srp6hlH)1bOom#QaL@R0){nVotSeyI zWa|*z6fHfhisKM%8wU*yksT! zS*xq1&I+$NOT3?$_LjoHkM}X;YsCKnNf%00fX2KvDo1DE`^T z9YDqa90534In&GS3ScBRM4W8mW0na_JdA733dsSa1dus^ECHmlxNd?yEr1Ojt&5zL zG6m3Jw>2(GS=k_40494*|H;4`K#l<($y8 zt#k6&>{Lpr>p7uJ0AB?#Ab^1ZlntO<0PO;3A3%B9E@(snGz_3(0F?r$5kSoVDwC4{ zs>fQa%A^|OpmV}(ZkIgMA*&TYZPx1rP=`rf#)WJ{*PPS)P@hHhoX{vhe}9HnoTZ|# z185pRvjCdJltbr)<^i+_pk)B@s*^n2IVU8Xw?_IEW9tCguyI?)Zy0SIoISa;LjWBE z=n=qw0_YU5u1+*XpvvMV-Uk#wS=}hnEbrx?h-ekN*8wii+ZUFaKdC7R6@iF6r03I?S zCy$uW*oi-3d>X*BSn2ZsUc~q}c|ETJcpbo-nDUXy+W_7%IrS>@`v5+~I63^p+!nN) zQ?fIOW2|yf$Ph%vAR>ib4#u28IGMPDa5ISyV%qe?WabIXJ&cJ#oavE}#MtYikisHa zrZP!m%oIfCn4X16R>o|M*%<{!FJlhI*){FCxH;<8;x6{QLF5ZsS3wH|kw0kNEc&>$ zjc#a9Cv>t`Fo;4yd=|v#K@<+6au8L5^be0H5=5CGz6zpf5MKsSBKY5LZN-AtDPQrR zbw6bK_c$UYxwKRerGuEv_euUwY1tsk1yP>usUlTLFRBnk#ULuNw{(TDY7o_e=omz& zAgTvZBZ!tkvmB?T%#MoRt=gB(`SKCWyBG%jO#v({EF37exCYI?zPLJWwqA+BB&#so1o zh#zB0xfaf!f*8lypBcw9()%|Ku!l)BuKcdbAyf%rauB}+@oNxMC}u+VDuk&Nib42- z5QCT=wC?byQS4~#ni0hBIbAb@m_-2-#GD|O(-s}X+@N)J>yIE7F`36WKZxJRp80|x z7BV5TT?3qiy~k!>9K@eN5H1a()DG)T#U(M4o?S*0&LZK;Al6a5wTxdC#A@nZHP@OT z*0RB0oNZUxKCfB)#s+pu>x0-3q*vN{HU?3=RZ_V%iIn~hqHKT9CPvCiLC8TQhL9A3 z5`;g9x3q}5B?f{B25~Kj>p_Hq2nTU6h(i=PK}3Uyn~-=Q2sH>Th%FTSLFlvq`6m)1 zh~yD=N@fuB3&>{1D^C)MZwq335W9oe6T}YIcLwoK5M)CJyO_}LCgi8vGY=_y>0kx1 zpG!$kceO9(Fum53ivoRXxYH~9;UJC&ae}Af2;w8AEV{;0#&8Mkyf#7jt(A@gY>Z^xtdm zL_DmMNM^|)q=c|xj=NEFS851pRO__kixAomPRtZS<`A-kaG-~)#~^#w5VD1kH-vm4 zWDi-FI&+3l#PARiIO}E1!Kj_f-tS&wt`G=wliRNLJj`d_OUxgFyfl$gp%4nB^DB;m zA(ZN#K)1`1{#gj0vtBr4-8cK~XV#nLiiA)!gfFQ}&78$TC{CSEc9w5%i}tWylU^c( zdGT3Fl9LeV~c(mXmMv#Z+6hEOhq@*z|R{rB0Z^k<;xxul9Aq(7rXPaaj`Qp(b| z*Qz1Z2%%=k`X*bAv3dw+%UVUXLZ}_Gt}QeOp$-?3STBUS%;{?{WhvEs?g$D}J`w-CBB=|S^D2lSn5#+JCAA@mBNH|zZ zzKmo>-YE6w>;T4rjI*}HeILRPAq?U<|A|F9D1$>762j0BhK11Wk}x`iF(C{OVFYJK z(gEG!7!^XT?T&h1#8ILwnWf`cw)v55NE{c!&vgAKgdKHUe_ax$hcJQLni#?)+WA9x zurs0k_OvM>{1U>iA-| z#<`4CG%tkt%ztD2J*F=RVIlKBV#=Zr?zydwP1@>M62ehF97{u37Q%80$juHhL{~Pf zKwS~S$`JZ@cdnw9mBqC>gf--Zu5R6TZ=#v+khnI4bs?;$B^koT5dP+2&aYsj%QA%j zLnwRv>jYm2x0@vVuq6{UA<>edj{s`@y4xSZt`J&uv;{&4h7h6yUB|UKge@V2Lx_YB z4MAnmpqOW(Gd^mOuC4}OSQ8z}!_qZ%fI+XT=y}4(`KMmno2+wKDS{e8GTNfoF zuR?fD8+91YFy4glmd4U0Q(V}>cOh(R9QTPPhs6(!9~o&X$iT*CMC@UZo?e77GK8(2 zJR>8Ok`q@LZqBBL5g$fE7%7~kA`d%B4kIy)B=$p9s5*H|N3tP8DJ_glVPp;?3)jsW zMz*lk!}Ly`3trqaaC&&-+!}$VzeL!|3^ari$EX1xCt}PM)iTQ8kP@VJw>Hsz%N` z+iHYSGmPqNMp?3{#k_Xd+EOS>BBgX*f=T@_uEe|ghS4C5hG8@cTRT9LlJO5l6~Tnd3jExjKiDG2Zp%^tdizbPb~$&EfR8 z?lkr=dWF%0MiIv1VsYuI|KqgYVGw>BMjzIRQxOd?os@l?){hLr7(nfY@m&~W!}yUV zA&fgCUBki{9>xz8PHC<|VGIrGOi0_Jrk<6f!5tl8<9<{NMXnn=gh^JP0kFKff7bAruf4Mgsne! zAiYKgTPTb$7e&H|#%xF*1RJ3qh7rag*3B?BGua!)mYC(vFt#$^#<)GE?+9a0Y}EgR zv5WQHvC=(EI_|Ri@NXFVV)}k22N(}By7xN{$4ZZcag_P7Fpe`h5yr__X(!lDF)zSV zeU>(V+J7P_7{U24E>IAL@hOapY;!k^dtqD(<1%NjgmE+G=PHwHVO)y3gck7|)nI2;*VQ=1~}rnLmjsx337#nZJ!GFT!{k3O-ie2n>HO&5ybvj{53Y(9^m6!XH2U&Qnx5fqK!OU@Q!ED=HR zSn05w6&TA!P(EgPp9fNrriB$+2sExL5me=DwFqj*EUQOQ zgLzHHS}{GC!B&TPUB-Hh^%?K(cQlBgA@fFzjTygY3~^h{B4{4Lu86fxTSU+@VtrUl zj#!@{^w?3W2wF$bhDFlbMnEEwZz5_7Jbc~==1V2PDD1y!rbfK{q z%Cvn>mK_HiT_flb!GGx3MUZ7qe0N6OOe5Yif?g2}h+xdlgx+MspZonH_%?z*5%i5< z)+l#$mi4Jeq(^4!^R7ReZC+xFR*4%J!FLfnpXmBN0!q=V0$pGk9KnzXhDIR=BW`p|>XbN&muBeGg5fD=Meu?1M2&P0ZH3B&TC4y;We=+X6qON5TOs9$6 zWu1r5h+rm-E`r$+%!%Ol2o^-F53jiq%#Yx=2(ep6VK(KhwW?6DH5L-KZY7 zFoHiQR(rS>M?fF1}4n6mbOZA0vc_#)UC<9|o6iTSWWaqo&)AJ8IaCB}&d zZ2kxuZF6jmU|R$M<`aHT2yzI8A_zwip(7Q68i5vp9>JlLX>IalqC})xyDSEE?3!TG zcDgTZ$~B?)=uDd<*ndsf!q{%OYkLI8O~=j%{-LAX*S3QO)x|cqvW@$eWfWPXI6wz0f(IP)hv?8pa4CYzoIS#LI)bB2sNyju z$0IlqQ%**3DuO(fY*bn_*?Q&s87?}@c#b{=m|S4I$hcZfATvr=ID0FCt4u60g6lDU zBZ8aEtNmj+zs>v(zjYhY>uA;Bf>`BCthakK$j+*j zf64fY@$Z9HE0o@F_ATQ(#`lbOuL&QSkj*FhvR~1%kBb64rOAvL7~>f;M&V%MWOOl7 z6*rUbdSyYRK~PeX{IPLN8wv$O(0>mD6&UUEQ;b$2yBy|(aV^F zF(+d#Myi!Niab%|vJEo$I zQhKfCQM6#OC1a~7S~F=A#f5(y-!N~>NLfnlSf{!jqUgwarzi$RF_?MhD7r+^HHvPW z?a$afiXKt?hdEXJmPyYjdc~C9QLLO~Evr7P^o{BLm{gsYg^C6+AISJ!6yL{eeqge0 zuQdZhq8Jm?hcX!!#qgLig2~7zMll&3(`g#VM)6}5Kd~|?rjKLta}?v5Oo-_dnH1qe zIhpw{QOx1_oEpWnC>mZxqpO%6#f&I^IEq0>F*Ax;)VJLjyBo8~IEpW}pvV@?jbdID zRZUbgF+YmmqIjg@v5McLSP;ckavsIYla7T^Xi?}<{1L^XC>BTYXB3;FsC3Lxvw?H` z1;-Lvp%>zpM)9zqb6FJ2X|Y^MS`o$SD7FgDl~JsU;`YF_j@O0J*M$w&1>?G~CW^nJ zcyL{ymjkSgTJH*27sYxe#5Y8-k@??@C8Kr{eNmJx;u0C9DC8)VDEv_bqX~R$#W*B%9v}l&4{AYF~<+b9J`}1qu3n9 z7V2{pJEGW0q3CgLW86-&=dn@tXU2b`NGH3P49(`GQo=n^?2Y1I3O3zwi5Aym$G#}` z)BYdD!6+`Wekh8=QJkY4W`5Fg1HVV>vxoziZQAE)_U)uB=!s-`}V*g~jx6isq>%QA|If^SZV=t`h8x4|e*Q2;W zTa$`>DsED5|4nwPaH+UO2Pld=bY$zg=wh8(#d$Z1dr{n{V-&^vC_d1^rSOPam-603 z@tC%nH0KlA{AuPtITq!1Kcg<)5MEFu+!UTiar{y|rFm;?FQa%B#hWLNY&QkM*HP>n zpR9IFAwO@~+dIa6ZvH8V%K3uK^28me5T@a6;)JJr79|3_ew6NqPU7LR2(amQiQQ6BW1s210p}=Nh_hE zyow4cN~$QOqO^){8d(VM$tL74wswOYXS# z|K@Vt62?7tEkER_reaS|>(sY8lXFgI4Qk?+P?ND1V{OJdj8xRGfU~}e1}Zkw0aDRW zMI#lnRm@S*SjE>WhN>8*qKS&8Dtb^)R5Vl3Tt&}YLPr%XRJ2slUPT8LZ=WW#Qqhh{ zYZYynw572yp;GD?B_gCys(;Hm`~Bisyx~mlq@uHmE-L=8IlD0u>B?l~LOb#9D%L01 zi1bv^O9lOZ%@7s6ReY;rpo(>)1Ys`y*Q0u>8YEK{*u#q(Q2mfOM~D$L1Ai&QM8g`ncA+rknR zOPMsiEl~FR+txu@d0Ti@K4FE5RVr4iSjo+`^70x{@fS@v9S#*2ZVPKwq$lE5m#Bv- zF79*{x}Qv05})4|HmUHb*8R6d?g+(Q@gj4|N-AXLN=)%H2`~m#gkpM_NrW-VczeA| zS7Fd_&e=_h%wx%GpCm+2C5=3mJnNX%v?nfMtBUl)glcn>kEu9Cv7v(aamEvjCmGw_5za6yCa-_=;)Q=4BQbWu6KRgChduer?j(asHfo>1qlViF~?ULUeLTXaOTmFSHnvc zuQ>afHghB-X?R0RM#Vc7?^QT7_-;BrsQ5^GzJ`stoS$ejry2gsW!I4Hq|K&TVKXVt zeff?MrvV!M|FY}l9f2^ThD>*b(-qxqPdS|I$Hm5O4e=ThG!(sS&3~eX;!o@z4K+AR zgv4YGDH>8Wq-n^m(d}FKRNS3OLl(_yT{4q1YuHo4P5ka1M^@^IhHiI-k#~haYx~^^ ziCzs&@}}j~K>w4KL&Nv~x^2nsTpDs~n9Hq%81re!uc5StV@DmYoC!)}cL8eaxTBzk zLK;5PaQ8z(G3uU%&ova*@P&pV)NKu4YB+RPxRTR(@2=2zm@DO;Q2d@Se?W?q#a;iN zF!P0@goXjnTqQM>(lE@KeEvi-y$5F1a|dk^Wi(`H=$ur?Syn?i4dpdd&`?Lim6MK& zJoZd(Ym={}p|WOuN>*X9x`wJusxh8dtn&v-H8j*@g)D1nsLed%cb11YM_irL-1Rjy z(D0XzwK^JVXr$q>h9?>tYxr8jat$kJt~4~&Fj~VH4b3z(*U**bQ$q_4Ej4t|(2<;6 zN@=B`b^2ktClpFbXrrO6hUxc&J_}R6(a@t$Qaf&a#XX@txxHr{+)f%gYk0_Qc3;?bU+B+`4$v@=3F+tW3qQ~#KM;^3VYr4t8U|~~^(x-(Pu-l~J%r7M zYRL0I7^b1@1EJvqVT6W}8b;B;9|$8K2&Y1+w1LOTS;lJkQNw%W!cvt5^zKQ%1TKxC&Ci^u6Gz2w-G+cK$-H(MzzSO&qgs_HP3E4;~ z*4(XX&?u{6w+3BX8n$WJ9z!anaZw_&Q^P+R zet9g==kJq!scRn#do=8&<@{KPdm@k$eJuQ|VIP^Tw4RAO{#Z~)q#UG0t>G+%oQA_1 zj%YZk;S>c1QtO;{9Hm`C!*SXQo(SVNr=H*mug9Dszw;B}w1$IEgsV@4Ga5!b5ezE2 z;5e`0f`(ffZfgj)O}(h$8Vz5=B@LG~6nHAUte+}HTvs#@US<5zoqB^J_H6vAWhpl) zex3@-KdGUo!e6^w)t{%{(Qr@0eHsgQ;O?%}i%*3Iw8W^&4%Z{v(s!qRcq(|G3FV#% z)Uo!@gr~ImYpAQEo{s0V`P06tBTdIk4X>dvnrj4eu!$X+^kF-)MNN;T?tC zxs+^Kvdr6;s?ALuaM|&Z)@B8#UB@R4HXWpV_e}WxnUFj;kEj*L1S zI-EL^bZbBF(>#UHrNgZwUI)!5rJK(LN(nkVIudmdfA!Asj>TjhnV$1^6JQ^Bb$!ww6i@Ia_A6roJmRW>KJ%4x%hK|_`v}!_9l3O*Y!kL_ z5pwG|e$$GRJUWW6wiR1#%dew=jxo=L!a54-$a5)$s(-GdkdDsJh0kh(&xIq;g)em!(@|ANHS(sTgpP7L%Ihepqm+)aI^I1OT9!$Eo+oA3#-!3Z z%J6J_#YoD{=fcMQsRin!RM1gTM`ayVXmYl@D(Q3rDU@57^7(aZw=DNUm|NF6X=(aG zDEJ|%x{jJUYU!w<)Bjtg)M=AKrL}d8DxG{~RZ1P|L*JC%FNATOQbxTH>g#AgW;zDb zEa_;ZqrHv}I=$8dU+ZY5qq&ZmFN7xa0r5gO`$C|}X{w{TkdW!GlomQ#>e!u@)>cO= z9j$4qUkYt>JbEG6UJ5%Gr%<-YOF>+l@{NvhhN~UL*h`_UnOee3?Wm(oYDza9-F0-L znbgrmN2U%b{VFANrR+;#{!3x)OX0vvp@%gac==LTFgUHJjw>&PUOI@=pr|vw>A>xB zeXFDCiPS!feHr^PlGvZg06OSQzKiMK>-ZtYOAbjHqGPCzsXC_VSXen>n2zx}CeT87 zB@EXwLdQs&KpmrX{G_ApE1}3MVT_I+`ACh`QTvr}BGrmv+amjd?lxhIYaH3X5`LyC z6`eC)2@`eHEt&i)VYY-xI!}MfET;L_F-ym9 zI)2wNTgSnB*%Dq0bLfcVcRzY1%+;|XL+U(6BJuujK%3L68B4Q$Y{k&eEO$2$Jju}Q~a9Y=Kdbci}O>)4`0(jn`J z=!nuPcq1IjpQ`Ba>j>xw621|_6bWyHQE!A0b?=QpQ$dsIzn)49R@I?V>^)C)z7=%t z#{M_L!#9GVTicGwNF*)UwpGVA9slasM-6RrZD-@1I(EUPI9OIG%w|wPHD~F3I}xz{~?u@UXQoJgtx*` z9mjNB&~cHr4mz?rTNu(66t(zPIHO}_pVWnKh59#>Pt#!E3NN;}Ha$(E_+J%r zozroi_NBK%i-oB#-wKy>T&BHF$1U1+-U(WK!WA7?DZt(d*K}Ohaf6C_Bwxv&9DEV~ z_*z1{cfyEw!fhRQXk8c2@<7L39rtwHr=91k#5wPTP49&HrBipj6S}WXx%5tWNSpjS zf%-qJc=8h+PiZGH@VS9!q|^3mAl|?WT5dYt=y*%BUBmf`MzkTdzl43sudhI(sY#K{Cor3@I<=M&ax z24x9%E3U5$(CO1uUuszc<+#tp=`*zcxU`A}PJR#`eGo2fbL09=y&fNhb1T#8 z8)!hK2KuZ^&fF?x=tp7lN8xJ&O$_WZu-iaW1I-LfG%(3Pb2`2Tz9nM=Ee*7yZW!ok zptXS&ABDQl6WY?zd79kDK=7k5u4(Ew2HF{DZ=eGmz9lI)J_;QTbTV-GqtM+zXX>_r zt_Hf1&xeUK)}>IYktKl=b&rtDDD~jMlK3*KqYYkdWh((APje z15f&YLJ1dpM;?Xh8Y-aV2DAt6T9w@ zvyR2$>#4)(7#SF8U=$7Wlkn3g;jd4^u1~_5PXfIy)@Jh_xs#gB<{e`5{%GJQgFfJp z&+ffx^Ck{Yjk9~-Hh0rX`Pl%Sn3Xx3I)R3HC8boxwAyy>WCOn#kPOHMel;+~K-uE1 zr3R)Nm}X$1fj!?=l0+=^z?dX`p+Y z_iqEM46LTT-9X_u?;08o#YvoZonc)d^~8BIpK`3F6?e)(rKGRtQaaPv$knM!KgM}C z(Wk>1E7E)hZZ=63xj!4?yo!N6ao#Nkw$g&7NAu~ZiOB(q83Q2$VFM8ZngQKFl*Ym> zmdWlc3U4EL$=jWRsfGd5z^hKFn<+%2ssDlZCoZD57B7WYSe8P2>^1`dcz46QoyG|7 z4%*+~-D$v`!TS$ILPcjmPud;>dkuV|b@!#~UjzGSPc!hrzdxAOH(-nXv(~<{g@J`L(J#AR$pJy1? zWbhVpr=F)S(J(Ki+%s^|z$F7WXo?K%%;3Fj;41CL8NF9%uk$58%HVBOBQ;M(?==J0 zS+AJUnuHvwskeAOZyVUW&x*9>8NGK5^vdYHYhZCk@3D;D`vx8ucu3(rGW98K^#&dp zcx>QpMsL6KDW5yMPv|4S;jQSf96qP{H1L{ciIy;}3x{`_!@Ins^YJUk8;S&n_bmk{ z9TbQ6ro)@b>Ah%kA3EeH=k$K06?fV3Mb3nCudHpSmD6i8VK)(H0w(gA$ZyiM4sQk% z$tF_boEc3xOgK%9_z+L$iU}q@tVnU0aGQuXG27|ApVM0Y>zrPXiHAr{G?8S2PSyT( zdi87`!W0v!Celp$V>RTWh90{zo5*4!y9vRxK6i*PZE_SYvJcMk%#q40Xx~}H9<)C`QLYX3z#Ts;!6_+P1ITDDrDj_6Q5JN zF7L^=$zPZ#Y|{T2T3^h)F7M?P_98Uof0A#Mbr&;H+(bnal}wbNA()uB%vH`rDHEkl z+(*J!Ci1Ryl`%1TbW%r`mv~v1x2%aDUEWnL?@pKZx;>@5iCZpj1ru43N^V=tNv=!- zaeJ$9Zx1$fR;rXhc;v04x`}^H>@z{UhKZU?h}U9Ln>ufzu8Ddk>YEsEVuFbVCK{UP zX`+{jMkX4YXm6qe+keg2(nJ#zO-(d2Q7hiooW+{)Hgem7x#d6J*2+X{&bBe}jfr+_ z-1dJNQx!5JoHt?H4EttWFmchu1KQuimd~s;jH3t7~kxC*!^77nktr5?*s2o00zICHz|1!_B!N zOa8^9tHe7Xxk}y%{I3xBThMeAX5OD1Bed56L7~88-QFZkuCQI5EF1a^OW@`$W>#iv-hgTj6W7tGk{tF z1po9-h@sj%@U=-xVrblfboBzLA3*m2dIZoQfQAA0=AvT&jRI&KK$`&O{}p#&eL|A} zM!t4$mzoC9EP&<#Y>%N<0kjUFMF1_?s#-B8VyIEA80O1juK6g-w`Etn^tKa}LHhtY zq+xS?e5U|92hb&et^srlpwoBJkz6q!a(eEhB=917#=(=x!za_80gMS?YyiCi=p8_x z0N#v>8W7+IkLW85?iaw5UEWUu=+9vj>qeSc)U)I#@1Ot%2QWNGFgJb%E3XtYHGpXWOlNJev?i9$=JIrD9kb%^ z_*1dOe*i2w*4?0THn%MtHV286gwL}p zfIU1B-^K6dAm8FWSR;n%UNPg|`tH@#pRu%GRQtS-J}7KEBny=qW)z6ZCUIPX};D0M>9efP?*_81UPxF9HaJ(p_iE8+tDU@MQoO1HAhjE(Lfa zwRGQbVi_3~5ccRoMh-v;Koyt|aVt&8Fg5}(d8Gsp;;b&3SOM4pL;|?X8A&u@oen3E zIO2v}s>Bg$Ao@GyX!ouZieIDkh2b4Sc! zn!QuhFGBKHLAlCezYF}DLpp#z0{An4XYAVmUIg$mO%;o=aH<{#uY_T#&EJUTe+&9n z(06IA{t?ypqMB;b&JWQa1IQ;Mzl{I*sEl+n(#wdJ;gQ`$QL<=Et2lxTrWs^p6oB#c zIP%KwGymK&&NuYL$l&}CD`=dIOfoVH>=%>|#mh*LktidJ;7DowBmuI@$R;CM;7}ZK z;U+#&O%XKp5DA=JP!`A`Ku#IC1W45&`8;`K)f^<>nSkuMX~Wr3$Dm(NJeGSQq&G`zC!Y$j?Xqp^%;GMbA~G?7s^Gu=BZ zy~spOW!x~NoSA7ZU9b^oU zF;GTF8J%SGkkOO-ji=5sy2|J#qYE?R-PC=%t#4X9b(i^eN$OqQw>zG0##1jDy=5%i zB=zHfNuWOb6UPMVD{Q+pLu#Ht!xHEd8U1A}NT5>*RA-$3X#x$BF<8b}8RKLOkug-p zNExGK43jaOjY*^tGEx%VPPx=bq~(e9RU+L^q|q|Q2<7~fiZWTKPZpY+g~rR6AY+n@ z$vo;iDW7sMWTA;NPGzAVvQSErtEW*Cwa)CHotzheMr&kj%0>^n`qzpob68<88$HQJiOKX&4*w<@ zo7t*l`sGbZ@nq_p>zE&x8LB^LdF7hx_ zXif?pN^!fkQ|Olz3doRUd@JL+3`K@2BP_#_p~=u?*g}aR!;}#cG$=S({H_LOGPMLv z#Y|H{M8?-LzTs@+r^|v~`F~=m&94g1wX`NTgcvvHqfEK^ZC<&4;&MkwrsD4e{$5ZP z811JYc=0NjkdJ+G9Jo!#C`ecv5a5XpSk=e4oOdB z{NtyRM8C=y@mgw5^qY*Qyt;{g7nBFc_?e97GG57eE#p(77cySTI6Kq7^MrprkwNsD z=r7Kn+3Agpx13(G)5PqwGdqnu>3=7~%1(a^%HSUX-pl+=UWuz8IqmaWQ{Yz+r68Sx zcm)Xx(kp-huYwo_(+@})6jaSYU31W*?37Uf(`Z3G3M9dtmxH<&lWM<8iB%A%;Fe#? zq#(0`b2%uL@<6WTphN{(6=YKoos+UCDA~}L#2uCP7tKjca?-e*lySS1tYA$}k`%n% zBKZ^qbJG2sL<+JiD8Wq>qT4jKHdzmp0pD59XKf?}+Y=x{E&or~V)qCB~&xPpVZNy$yEa?{-0 zR7yc<1(g(3R#1kMzk+fK$_s5j<)%z|sC*vkkcSHBDHRk%I{PY$Lo@TZT~}eJDX68O zHurVL->;-}EDu#vP+dU{1!f+qso-NCDwLNPvwZWs)ITrPQBYUG=Dbu-L7RNk{;*VE zK?4P!=cPaMl9Z2%=c7gn8nd6T_?igXTtQO-R^+2*3g%XH4{>48NF>k=LlEOT|o~80~LImpL#0jrJx^= zS3z$DeH8RnkeHuh-XqajQ}VXt;tA3PvgzrC^NUM;D;cY(EE20ph}9W7FihI;#Nfo$dcr z!9)cc6>L&4Nx@_V3l%IOvskhK@pR8%<30Yb3eepG6uIcn zT9B$0q^gpCE)Q^ye*s7A5^0`-`P^!SzkNZv*xomL+mPr-f#+ZF6kut&jO1v?e&QgEs;?N*Rd znA#V1oin#E)juxXDNHCrd5TcoA~dK79pLa*a7e*n1q+JM)DFIEt$d#qp(6^8@^UCj z^^4Lm1(zXxUxd;XrC|a0vG7S&uHXv=7ZiNPp~&l6!FdIz6`WB};GlGtW1}doDM}ZL z($%-g%!w4G{U4HF6eTJ~jf&Bi3N9)LC|F%W`bxni1%DT#qQ$9iFrviaK= zCs~1_KvgijIK5wyiHpX5SdodV1}_=T25fe5y2%+vL8CSPkOE7AtstzxQE-hTlb0a} z(op}RIsSdc>9T?=JR_H+uN7Ps;2S}ibK#PdioYpN*A-MLLETFbU-{hNLACeCl%U%j z9wq3Wf*(Yf-QnSvpzjoXF974ag3sVb1wSeHS;0fjZ%d_{?R@tYyevT+JP#D)DM^h= z(jx_r6+BV!i-P_oXd!5<3#RPcO+}1~SQVL6WL6QUx@q>yGSpv`d1WYGMS_YX75mH5 zkS`@R;7%DzRFQ=nmZh>~X;@jh_$E2!ODS1}q$0bD94fvpOP+G%Q<0(~XE}E1cQSPV$aVaK1n;hPfDoUv+qoOQd|EpNq-Z!QK zy?>VcYg4It1=>=9%Bd)?qJoMYWu-4F(9;T(RMAyiydqUrQAI^V6^&F>RZ&evO%=7+ z&WcoBMGfJlkrmww#Z`v1vm(`2@kK?dqoS@j^r|A|u0-7{(d0^0Pepwd4Y-#|uJUjt zimptJRWwo2LPbjzO;!FUCVs3;Uj?N~mFd_fskw?im1#v~I$oLlRj8GUht+(o+0-i3 ztqRSlLTywqWo_+MbYNi>eN}W+(Md&j6+KjRR?$U8R~6k<+>)e=Rp?O_N~}uds#5Q& zw4f>-t4cjpM5NKu8jaD&6#aNz76A)! zh>n>mW~tbuVY7zW>>Q45%@v-jVjho<4OTH<#R3(}R4iAqkb|V8cZr}3774Ie&`#pK zxm3&}A6lVerHZdqTvD-0#cCCYRUA>VM#Wm5Qx!W^tmA-Gv7PxfX@iQ5HE0VDP{qLW z(nhvQ#b&m%20gDq2{qkWYgUuCsTg0AW@PriE92v8o^<{PHEEZM-75B~*ry^xE!x8# zs6~0tO6657OPFI)onbMHoQcl*QA8XMe6`tBurZyc_aZJTI73aD4 z+H_pSXDU8daYDsOUPRH-!rHW>Hl0%OO>KHrn@+1Zqv9+NHj?u23u)(8sc0SQQis;m zA-xWL!AY!+J53i=Tu|{P8x~4QsY{jX(!jd3OHZCxmjWte6*oD|R46J`6_-_9QK6~O zIW|-TIevag`Mj<>a6`opbtzjzUsOHfOU)1`C0^b2$X4-B4WGj?T#v%S^9<(IqX_G) zM<43Z*K9E7%=*;FmacM!S?j;{ss9G2m-=)~#kVT1tEgO`#@44z^+~HwXMNJ69{$@Z z?x=X6;%61#sra5(nTnq{p(XosG@!dG?r})ROF!@op7&2XCVkaZns6_DlLmC31LjA` zevra8^F8lF6^~Rr=H#iOUjv%jfKD`^-x^TC>{5o3zCuRIFPwW-{HEfmF#dNHe{hm- zNF^K6;D)raAzf-nj~fy{I`B54=PF+CSX8{?6soy@4STKPFBQ;`K|{Vq)VdM9QSnyA zI~5=I#(q%oFGt{E>2LOu0Ph7I*~-VviH+zZ$4Mhfr@8b$VL+6?Y&>()3%slmWz-O@ z!K1;ep`;^SXhgp^qWq1iX=57Pm=-m5Cn%OzjfPAbGHXcCkf`BsV~W=>Zk7LIV=@~P zUl>SDD2wKvCfYZl3QZ_U!-59B#8&=n8j>|g8hjc?Xc(y>MT1{M9SwCg{v80aYbd6n zxP}}Wa%w1`p`eCb8glcfHRRW@q6uASLU}ag)%asHG$TpM*pv#5_WPUCHBBnp)U~iL zb2JpzP(;J}rgXe1MViuwrc_iz)@D?#8QrKMmEZwtsGy;uh5^l}l!mez%4sOAp^S!= z&FDlkSJhipD$ku3^CdN>!M9Ux3uYw^l{Hk?P(wo%4OKNPZ%);i*_>K6cUz4Xbl7SC zf##$)C!W5V8h&X`wb-#Os5UojL1S7_Jq`6Wbk)#J<{CQROlhHE=U*uWTDpDJVcL?~Rh3$6XrrN{hE5vVYG|jSy@n1f z*^a1aPHD4DEpSGg@o1`7B=xi(MuAv9doreBA zDSxK#siBXCz8ZRI=&j-BR&>3HKSOKc{|}aKO}CFq4O&w_p2sr&S*>Y+hJhLeX&9_w zPiu;_rd8ibY~&CP4_ec^>nTGu#J8c_nIxWtVH$>uAgR>G9mpsRqczOcFpnM5hQ?@^ zz=mlU%b}&AXBla+5F4-Ii#Eh=nW$lsh8Y@WYM88HiUz(VnWkZ=Cf#a7Q#G7;DSiGj zd44C~bPeg-(u^lk;kIr^e6p+CmS(Z3?fkO^og?U<8!?{)Rl_!&;8j zwzOEo5}x8Q{_Rhsy=`f!hGjhO92*>mZD}>fj0V0p;j&6_xFg1VD3z139q~#`X-Bo& zQS7Jw4ZMg-NE_L!?Px_i3bmsL?TAk$TX?WK#_QOsVVj2S8g}rK)Zx*wQ^PI|-)Ok1 zVK=*1!+CZEcdB8ZhGQCzYv^}J+OOddFG&ptG#uoG)}C6or^W5*OnbW1o{sQR>Oe;| z-dI4&+<{tlpdlUTgocwEKG$$s!=?^&N<*HG^qB^`13m0Obvshmj`ZyT>5PW6JV9?$ z=5(YD-$;RubWQ_P9_a-QUurNkm>Mo>_)3GKLDg`H1$gQ^`D6{hb#yOR_)#Zo<11B9 zC%Rh5t8tvaOwQkl_z8o~nMXWo2xYDXt=52mWJCJ?r^M5 zl`dA6250v3{n2+CzSr;rFQ3j-wlm%3*_kQ*Jj>62gSyAd>Q*!}`8woBPAt!pf8tOP z)t@yy)bNBCIL|_7dc?l%Opi5O>+C+$n{`d9P|NqLhFP6`?`QZs*7yIW;i-n-HTA-3St#WHprKw@>f4oOcBNIN-37S6EB&Wof2==BM>-vWu5_a-rPl%7&C>U~ z(W|ahvK#g8Mj3Q0=tda@|3EkL>WI-%OGj-Tu{z>(6wpynM*;u}@?_hVj{yceDcWQA|5B*^|l&K7)-ld>7A2zFt(Z7gf?xSw~eJ)p*Dq{8e;}?nS$MQI}rC_Y`+~QFR?P zbkx-GZ!ap?n||%(FBI@s)l=H{raC(6>gdfw&{0oEeI0FewA0Z*M?)PgbhOm*SF*p6 zj&0|qraBtySkc>^mnPh*8*S|o+f2u)EAE^&*P-=xt!<^FwT?DCQ+?dT==Vx_w0KcNbrxM%b2pU`L>cR!&q ztaF_I^d~e{2l`W){_a>N==fB}KAzJnzKLv7f7(#lH$}%J9g{^#eSXW5Q*}(!F6ou$j*huHF7>A;{VDeVsx^QX=vb&@sg7mr^Gwnr z9hYnR>NM~#*0Ds#m;tn5099Kj=>zD^07@L_8dhN-tz?}#@(rRjI#%oM)6w8S`gggD@nhtk_2 zbZ4&rtCqg9L#g>tI>S>il)}rUgG1>&XA(9;#}_&-@I30c$PL+kF^q1V^Ct|a zkPg0hvvlzD6I-muu)sXn%Q~)bIx_eK;Xd>HnkCsA`RE%FAy;)=)A6m2>pFhb@tckt zI&N~5>iCf-h^JUw34bSa-sTV$fSG(E{$Aj_f^tXqbns0dgP(NV=e1MP`&h>Var9A| z%+ER=3Y;p*!m0Y72<9(o8lLL-ou^wz9XsU@9e?tAXJaI(!!_4Gqb%tek50!69WQmf zVlS2T@dY-Q*MgafnOR~uwHZ!tb-dG2X@@lMp7b~8_QlfF;q;FVrtbx1GydhE((#{; zC<7};Qi_3e2GSeIY#`nM3}i46J%T(2G8$MnobsNMqWSgc5-B{~eXnHp_InM)7$`o1 zJRvKTlyg078lV{*OEpUptB0m*>R zz~3X>2MDe9NS{2F%2$(oBdNwn>OYeF2LJpQ*$w0{kjFq?133*G9!a?j}U#ZmKu+yp`(c-`BEl-b@p&AiLY8WkEU7%Y8$9ypswL2fu5uN z=SS1;qp6;O`Ud}<&_7{^lxqyN9zzSpPy++2C;1v0I6a1XUP) zyUu@TEZJizCcpoWvDC#tS6({?#u(^kpu2(o1_l`DVW6jhJ_h<4n0P-WX&m)3(Az-1 zTvGjUl;n{HjH8LC{QV4k97mrRSUQf3ag;Kiw)ON6H26ag(jWtad4S{HC(J_(3}q*@ z@{KYu%)oF114~G2o+Xbk+%>gtJdI@G@vhC+#?#~Rlx+gVd`KBN$aCO`u5zzM4RHC(y6krOWfBsXVivx(cTmm~LPOJMB{% zE;#!?rP&7NaGV%eXke~^c?P^0rTGT#e@fXWQl{g6R>H|P>Sc1XiB#``RL0|9#L>7; z8a|Ph8dxUGK44(EffWX}8ra4wi}6I-Y+#FlRqVjc{?!K77+A||%D_egn+&WspiLw$ z8w6N+D}_sHl>r~+^7}*zMoEd2=v@wJyMY}B_8Qn{U{FWjPF`F~rCq#;&iYd(5#!y0 zvqw-KY_n)-KRfM=zwacfKZ&|zl@1D14++WwoSKdrIL6T)M42Ft8#uusWa5U2lLk)l zG?^G?;xmy>%bTcR;&To~17|qk4fsuviE|uI>?;Eg418hWf&s@s#NcnR;-bO(i$deM zFmTC0z<|sim_+=Xd3#v;Y!cm@M2avb-DDcP*3TE}x&gz0X&`90IluU1YCM^SO{Qg& zDa6HqCFE_6%qg^X3WeE4lPP8jRhmMV4O}sB%fM{|U$Yrg=$e6V4SZwZs)3PTNYAEF z#b|%FsqR~n>pVwOY2Q@hTf!Sc=S_}^sWf0J-7)Z;fqMpTk%7r~QoiTF_+7dyWG+sn z@1_#J==qVCs)1b7h)+-deCGc!m6p9t{^qabpA9@T5M?5riAM$=vv~&ZB912pe&KL^ zn*KLlywhmNDrwv_`jxZFdFjRwKM(Dx(9cWqPXo^kyyL`Z;JJYpyg<@P9NRBBmZs4w z1FwbT>1p)CH2TZH8v}0*c&1a0>C|;P&6rMGrc-D-{bS%guSWy_afYAa27mq;^nrVv zLI3iSnL$TpkUfL=AppOrym>`RZvrL~OeC7fU?QUluZb8Fzs(@eOo}$)F)_KhRDC85 znn}xMQmlzM6PZl#!-N5=rPDJh<(ufsGwF|+l-WeQ2?kua-z+AQOh_htCbF8yW@6+l zN;diaQ7SNtYX6v0Zx-#HMdmC@G4Xm9)tXI>XVdA4e*bLBZX$AnNX zZz8veJSOs*{L_8(m`!VE)8W~);;y+ZWP{*;I566)@eCX+aY$=FsptRK!G4 z6D3V#pG(C|6gTm{v#*4SZCj+@JNxI)q2`}S@*H|Ghf105Z5axv00ci8>}~3e447?7E+# z8PqjV&qPDhebL`*F4Z^Dz{HigG-WOwn(N*dbMN;L`q?4;>x(8l7848RQBxDmOz@+{ z<|ew#qasgJ{+mk`=21%%t$6*;BYru^kBRt~JZ(+1GttdNcN6VRbTHA0Z7|&*BwU|I z&*o7_F`{pNOi7+kU3f+B^><~H=F@=rv~WI+YT)l-qNjc+{)B^g%be|q0Y*t;JCWt8!2e&*?F{yF($^E7-wQ5t2Hs68riocR ziUl-mXJ-CIt^>Jj5FD;0TY*-`3{;mWa6-i{EOXwD=wx{ zi|MH7`k0C1CQg_*wwRdmQ3g!;%<>t#i=@vvr!6LacIR0_{FeVLyVQhjB5dM32ZjmN zgeDf(1wk*G_)-8~Zmj1k6PHW`Ovr+%2*7+UERZV60i&BRdB&HJ!O9y-WtLFqB@{Ff zGQqD|Efa&Ur!e5cz%dcwaj~mS{5{vdYYE9qsOtd#*X+Xr{%=fNHSuH#eOM)36C-M{ zl)mLGwA8hS--eG|N;gHM-7;}o0FJ{yCQElr-WL%+@Tk)w_Im;D^4bxvdwvuV%gaAL zh@VW{H}Sy4&pab+hKYylC=?2z5D0w^Cw)hz%lB5SfGcemTVjk!=N)TtWQnrWebJ zfAQ621x;K*N;_Xd(7nY-3?fU=4X30aq#%4jWaTD7BnNSD1-)HC-aY=hG5*jBN(sUr zM4lk>20=k&4<`$IP9Si26Y^2;%4(y0(UL#rj{ZA%0BFA;FIV z8V1oQhyrVg3!Bt5h-N|eyw+TJwdPv-PV)0>CO$M~tsA{;28VI0AX*2}CWy8{vb~|F-$=VQ694>T8PCf`S~S$ZGKf_iHX)P`VRaB|*a<;=8N}Kk)&;RQh%9iAGS7RI1@UVTzXfqAhybrpv2bMee3Zl`EP%qfB?wJmJ&2$HMi3?s zY7^brMABwTl@EzSmY{YJ?FHWnA`--9!MrNy6+yYl*Fk(EFzey!HG#hs^m>}ijDony z6Bop7G4P)Ry%WTDyfk+Bz7OJ_;4r=`I6L#>2f_IJmZ_`K@dL&@i2%=%cTyD zJ&%KU#PNB`-|c34E>C#rHTL`x1Q&jT!1!qpzXy>agp47a*i3%}@lO!%IZ*^*@Af?l z;&~7+IL&URzk;s7%OGBHO5Z}v;h20a4l#Jc(;@J?AehPJZ($pYvG9i={^jMcg;*z- zk3swwM8z$x2BuLV7jsD`KzczTXlj$_5d8ed><~O5{$7Aq_BfODnKhp|a4Pj6SgF~nkLgf&ehtMMAuHPyl)DNM7z*R$7`#gQM zkh^NChfpJgnjzE*p>_y$gaFI408a~HifV`gdHL53}H(MTSM3u!gj{0 z|4gUEi3xG{w$MLYsQW)z8f>K=Tj@k%)Gl^f2z%H$TV22H6jTv(e+UOSqBxjCxUrQE zaun^3KV-%q3gK`FOY+7X5%d__BfxK4iJAY6j$)cnDzQ)F#FOlS>ItiIc}|HS`HVw7 zbJVIN&zTU;hMWu}^C4Uc@!!7S-A24&;};=xEu3&6gfBz5$jhO2%;%${zDfhV zYsb7f8YPENU>orta_erR(3NO~6JWXYT=Wo(5KNv*9`(~$-fpq+@NE06_!+s~|FVTR zRJPIUVo6pAOefDu?}QKu;hzxRhj2NBD+ehA@5p0CaESNTx$m>Vp- zKi#zuz764e2<0+)xVrK0Xa+ZVrn1CwxfQ}~f$s?VT^j%U5bg?mFO4G|NH-upuI@T- z$uGT|4tO7g@N)>ih47TatX0fIj0-Y+TeXF3MV{8eyH z#(REe|8JvL90u)@{s`gE5O!^&XM(;6;kf|J`D}UoOMw}1^>qk;ad(>UO$hJA1TlUa z!YO|Y11^83F+YUxZwPS~GFkW-!ha#8w*U(Vb|=N&@kUv=c+&T98>O?{^vEEC03Hjx zWyF?RaTzT{TVTK?YCCx?e81isV?kN(jkWNsR}@znXSNV;A=!dtVb#6(6F0mG7U~y_ zOSF*1!rq$6NrGk*G^?N&YbG;bx;G_(H&0lb)swkPlHUSZ_|(Eg3)wB?u+YFlLkl@A zpT+HX6J5eWlkHT}!uWb|Gv39O5*}#y-2E+dSqtSX zRI^asLU{`nEL5>j)j~xJ1)X^QTN&@(R>{Kie2H8t3&5>157?mD{O?g_;)X zu{T)BF9|&o+#NG&S*UHHj)gC_Q(X&O7;q{0Z}i0?F_kMMUfIsS{7-6Rp|OSj76!0| z7MfbWzyg$0h}|F%<07U-48yGQcYk!>urwQ%xa!u}o9&O&<& z9W8X?;jBu?w!?Ku2Qf^>#YDBUg$}9w9n{T2cMCl%^t52^p!+-Mx;kA=P#7!P?H%ca6jT9n22i3O%tKcpXMVUUI47DiYYY+;Cnp%#W&czM9v zV<){f;(zO$xM(M(ujctu@^l-LG}6K-o&^gNxJk~qN!a57{4Qd^e8z2e(IN}mcM)$syx0Pl zi)E9xmrYt`VY!7h7XRe|18#a(unq6yR$2IL7p)ZfAMB#l7Gyj9lMJ5O=aPBsXZL#x zu6B2-*}xNLVH>Npu!+6O3(dk-?tM4a*-dZDBt00E&~rDP%NWy>H@n_VJJ?7IyDaRs z+<%%c+f55gWEzwq)5+ar?4~{JrTB!s7Jk}I`vhgMpI3SsK4{^Pz=zW~M+7)3=rKWg z-{zARPFc__=sXGwpYs%0xMbn9g)jiHNyn7O z6|;xFwBX-ErT5T9;e^hm-LLEg*bkgKEU3ITcX&JPp~L=!k$Y(89-40WGKLc>{uga< z$XN(ma4ZBZge+JVYzt+dM2{;IbK|!6+#YiF(5ak>_x8|>JruEUnUj@;Z!BD~;N45S zIe(G8bT{6;s`*$ohWD}I4-nMaOW#_!&VI828#gT6wD5)_%EB!Rw=M8qg+hMx2dk8&AHD^Vsm(?l#?feV&rHqsJeKkFmk~5*M8w|7d1XCL5V; zqf6!(-nclyMxu=@Hj->ix*na!#-&70RvXDSdhey!>Yi-eOLb3j0gq(EXCuW1=e_T8 z$K|l$w?W*+!Ki<0d$QZ^iHX6n)ouvow2{k3ZW|N!x=C#5Ug9QsZH$jgIKG$i*?5;b z=6&gyeq}wMe~jZ#8}kmXg>4kEQRhnZc^gG-6ti*C#wi=cZIrN4iTf49FKMHUjVp`d zxs(#1w4hJdrDM;OwNXxpakV^qBh6zK)0kCkRJAdY2Wz96jp{bq*l25`hK-sw7Tk?$ zX=B>*s9MaQnsj-Mw>Fz(qppp5Hd@#?FgdBdjRrQF*l22_p^e8i6B~=MGiW5LJl<5? z%m#1r&|FYvGWg%2S~0Arm5prmJjLQ;THDC8(EZzZI~(n7jIc4%#?2$?I@suHqimUE z-l)8zjZWJl42s3>E@|Y@|vuaK-qQfiQTOs18q4l6sU6ja(kj4(9+HWn;9BF*e597{_Aq ziJ#iYl$d@z&%OvL^TxW=88Fj^I?;i`y*>O=RAvEYlFWhlKO>_b?l{>sP%#}lfPfE zQ5dsHP_AyZvCYPA8+&Z58kDe|qbttidFnk-*R#XMPLBEa(TsQ5*q%8(y?3Gi+}7OvjjoRBVz^kG*U1kDge#xSCJzBVUtN!5A( zb$s3?o<@}P=&E;Tbx&LvnZodgK|GZuy-qH7v){~N%<{#=3z{HkVi;M%ND?@!ppu~3 z!bldt>I^R2$|tHR;r~^$hmj+UQel)1BWD=7!pIv&zVQF{Yswu4Uw&}OBY-?Qs(qp- z_MhndVJv@+3Zt;VTrCzx5e~UGag2)!@R>h-@wB5Q!YC>5xjG&eC=*86 zFiwT>Ss3NQC?Ce^FxG@oA&iPF_IE;;Fe-&nIgI*YGzhy}wNweCx&Vx;hEYx6jPdSQ zQEG%yGmKhc)E3OTg5DYK9;(CM%a_D}OFhAVJUgLb7>&Yc9Y!0$X&grLFj|DsB+R=K zxqWTwP7_Z((Ok0N0Dvk4R=Jd?@BXd;SFxm-bM?u?%(LsQ10dV<{If~8e6h`MT zc!!x(dzf|&qgxo=!{`ylU=a^J!{`-8w#=SS#Mpa>(KifbAF&_$2u`fWy)5q+#_qU8 z-YTbm7z2dBz%T}d(T5xIF06kiJlN;v)gfUF4I^f9{ID>lgz?`#YF#N|xBw#r9U0~? zK47%KW5W1U02Ui7z_>8R3ot=Y-d2bYahb?VOmHUuzoS#bm=?x#!C4~cj4)=h%>vIC zbheYKWz(Rdl(19I26W?Fm{Sr*cZmG zFn%oQnNZTRhkY*OFP3zjyf=)hB|RHUdbrB-wV!(o^RxH#{|V0FFph|Z$AupMC?7XD z8pbiUv!sU$D`d4NI39#rR+6Kn$6THGc^Id|IK!(ZF6nXq#Is?X3*+lBz6s-e7+-{; zhhgwy$>Ld3E9L?(man{DhH){Bufn**k-!akvFxV+=YKALxH+obeoBAEJ9IxS+E3f} z(`WlhV-5S=2swJj8`)2082n{~U>G6J31R-07A|wZ>`DxW;e-(pqvk4K9FEHxH`nVa zSKGtYE9|ZrZmMK_HH>RvTo2<$7*q3Q`Id9qX?GV^-k6uS=Kj5W7Tz`b_W$Fn$Z;X&Cpy_#upkVLW2*h4E7u_rrL=8R<`NW5jhV;eE89 z{@oh?a~Q94B-j~Z__0#mjGo7w{KNPqj9y>-4&6lh(kG#K! z@dt;fgXs?b4C7fCnH~Ohf&0vgKaul1j2B_N4C57B6~?VHF;C;%S$@rN5}){27;iW* z;uGHr`cD||girn!6bD>Sz7OMrsOq=VX}8m{@JF8OFrpk+TY3i&Af2FJOiQ1^K}H8L z4q_cdJMcL0ibE`Xep-4KV311V1V2;S(NreORNU=NaL~(f&nAfuvN%X`kkvsY2bCRU zbCB#HkAu7pBnLhR*&XC?Q1k!|yBC|{!0(`B>zH{*qZV(DA_pCZ`*?$_oR0g5gG=25 zl*>VGA#=2H-0}1=+$x`g{0>Sm)4}<;m;w$8IVkM7k3kALXwo=l?ExynT{tM_pg7O$ z0eW+QG99FR2kELOrpiI;evl>|q*4w_J1Fm1m8aim?pq+#E4jS_i9JF-M%0W{H%^Wm$&_W1LKSXN}(V;_R9HRS&DE2Vr zJ4~$|v~kc@_@BqvXHQbEOztwTd6|_uw$SIZQ7r#jS~rNjO3^j!OjZ+?BEawLj@Ql=wLy6X7TW$YArELREM*+!&#U!si`!|!Dt5)9DK@S6lz)3 zcp)}c&~ZG#Bg7iGIUkznV3LEWX_Av2Oc7#yrN;`nFyO-c84hMT_{G7m4i^5JFv~%y zdaj>~c(xj?MD;=z2S0~4uIYJNE+B%6`+I!Nk6$0sw5{qr%sOGAJ zEkbffog^-s1kSrBYOBM4dctl8dmL6D<>UvaLB=z4leR+IymCsgoBgpr5_V`I7b~Eb8y_ja!>khp7d-LhsumP ziKiTV=HMJJCK)4s-{GusQ!RR~tKx3!7K&r-YivDCEF$U^|HL zL|08>5O(0O{a3wgr(2E@7w+par%l0UhnGFzdgdDkR~=k)@U4S~B0{b^xZ&WggL@8c z^5~Ay9YJpi%GKLqT`=JC9p{R)D(h#?4-S5Ea9;@j`2UWw*aHVY3*pozOj-VsgU13q zNz=pp-*|amjr-;p{m#)?!uwRvg9{V+ea9cX-iK%V)4?+b&jo(r;EjW~4qiHV<>0l0 zzc?=)r#8olC0`$NsdSv)Iry8G-f?=*t3w?6M^xu0#Z5j=z5mGaffLB@(JcI*gQy5n zBH)jOrHi;(`gWF>=ZoAJ>xnvcbY!N7e!@Wxp_#$Ay*K$n#k^eo9%8)rK zM+7+|m~k01FT1|V6+xj03P;@MQMn`7o#@FUXkJ0{MUYE*A6-K*Yrl@=QZ2&Y!icRN0Uu=&v)sCP}1doqX z>-W)hBd8a_vdP}2Jp3)*`Vlk|pn;$b1!ca&6BO^p=TGE)KIsH?j(}+w zakQ(TT5%i9re*^;}SotWr51V(#Tl5!i-w2i@MD>dxZ!OO!f-)$| zR}1w#10y*3z&n(u>{sug2nGwaL->I}|0w407chrKFg$`R9?uAIXr#d3ZgyY3_`XRu zCW5gM%#2`G1mhwY&z?U)ar+V{MDS?@(;{FE6WOZbNoA&`pAx~O2qyE~O>-~*xGUk=+_214C3$WH^CGw&!Ho#!N3eh`kKj}U3nN$*!KMf{ zN3fVj8o?S4g9w)L#6_@zT@k@@j+qm*@B|$?L48jA?`q-x3Hoq?RL8V}Zbu+D?^9=yL? z@&1mCI_Y(E_qrdmmn>I}pUQ4fD`S%fn?2a=!5$BGE>~MT7`{SHTA{Xju#Iz{6O(ce zc5xIfSLrL%k7hxG73#0^r6#mY@3=y}v_h?4q1w(Xd2)p+wo>i);D86Z2VM^jdT_`C zj|ZB^`8D;)m5PV(b3u4#rQ-3AtUk}8H#{&s@Oj{8w_Yt}bjs$nKJ!@_MJ3-cNnuu z9hEMaye;Jfo33>B1rIKIa8iV)1WyZ|@!+hGbAsmu=dV&*S2=xm$%D%tT=C$l$Rn%N zh4j*ECS-F6(G4ohT9f^|2iMp~9$fdJsfK16{`BB456Ww}N5c&dZgQGy$kcGlgWDds zG^A+wn~RbM|9WtTOGNRU4O6pu599BvRMS-Fdjzl7EVo*vYTzMIcWEf5q0MUba&Ff1 zt5u_wrP{t(YUpa!KdW?_hI9?zuU2kB66Vd)P+Wu3P*y_;4J9>{(vYp8-n{J9t5uo3 zC68UtF0CO)!{ANsJF8W$hB6ugt5t!9JPk)jm1M}*oP{yLNeVR-X=pdiY2nLKO0i2R zcWe0LY)Ux|}%CiYZWi&8nBi- z4Aqxw)snU9-DWxMHFVI>Q9~yU{B}&6yq}c#n1;@*to47t(WNYN|9qrm7Y$uCkTB$) zNa?2GNewS*cuB)k8lKkhyoMJvbl1>B!*d$KYgL27QpFaeY+b8*YIsHi3B$9}h9tc- zl%JS$eyt+Dx;vxaX7^p|)ad$oFKg(n;Vlirsi|S_J=y2>@~Ri~(eQOqa z8s63Lo`zB4_DDfC(Qkp2uhuyu_Wh(}={n_`=N`j@&vX>%7^`8Nh7UD-q~Ti)-*Gy` zGskQALc^DubHMM%8a~nRsfGy>{akROhR-pP;Nb$^@0|Xv zYnO)I8ax^_4STq5j7&YK;gE*X-mJYE`0x2X!TlNz25!S8locnVZAcfD{9`@ z=}cRan1;B9edRKab2;6h4s)n%aK;k(5iVjHj&Tj#pct($@*g*-^o{D2hSM6-bfoJz z!v|LlH@PfpIH%#fh6@@l%24DD>^!ym+jZ_s8ZK*?STEzAb?z%c_Z1DlY51K@7j$10 zJoiZYH7*XU$EQ&8@f z)9-g!*+h1C#}XNMeMst&8nWo|Mf1lsj=W zcR5ijFE$+=9Tj!xI=nh6>9|kFdpbtyxL?NuI=bq3T*retD(iSeM{}Kf@=;YsT^;pw zRMSyiM-3e{bu6otHFA@hzKI7XX8iQEn@9B5(s@~)s;#4rj$yAjUy6y0*4NQMM^hcm zbZpFR=jKM@tc_=ucp=AtS(efe{8dwGt1pxM+Y4pb#&7C*Jt*< z-<0gpKb!lV9@CLMGV@~ftogMw?%7zXvkqbxLHh87j&3?$)$y8+Cv`lf;{_cr>Udg5 zcOB2@cveU6&8i10%Tms{d+K<9vvQ{v5_1FY=h%|}qy;vsUQ)H^buj#X!uj-hNyp1N z`snDZq@9J2wMe!c(A%AB*{ZURxQh5gWwJmBCYoy~R9Sd}f*71RkDLSU=7{g^>$3z{U z=@`d8(($Q|2|7N~QLc5y$CPx=UNtFuypEsGq>y|fS317a@x6|(bxhasjgA>? z;k1m@I$1ZTI%BM7ot&9E&w*F7b)6XWe${zw2v+D=q+_v;B|4T$ zFE4q-*_n3eozmR28G0yV8OP_HtZ`DxN*$|otk$tc$L59E=TD|_KT`WDne7+5c;D-E z(OIu!gN|J~cI()vV-q!XY|%0J-^}+9mRhwhLx-uR+!}P9GgRH~=c9 zGwc-diBUk_v10lj9eZ``=TPSW%TB+&jXOo1uQ2p5HJEmgv+t*p{Npu$yShJ`c1VXu zhsIurItw5rOBUrAI!qldFH*el>G10~!ilLP!1@j<=-ei~e4Xr|j*yP94nE9Bbyz|o zg8!~cu{p1WAJ!313aJ@fl|p2o&M_Uwxukqo>b#BCh1o=%eb@(zbg2fARp5H&~aVIpE}YOq$Hl% zNJzj$I1$U<4Ed%dXW zMH4R`@}iO#_jys!r7*pqRaWgCDu0JF%j$Yj&x`tWiAGfV$NsdAI}|tAyu3p-^g5qz zyo2MXnrP%jV~Ni7JLB+SFPeJM)r-fyXy(NuUUc@Nix=ej0{Pk7PI ziymI|^dh)JJ;^>|QZ_3$;CJIdS@uII6$GkZ1#j9St=7opj!A$GNQoK0i zb$0#_@M54B2fg^Awfl81-Vn3fy%^-hU@zu-@sk&CitsZpKKEjX@S$D|^WrTphI=uZ z+xWeB+lzO+c$ZDeM&7ALP`K0SuYrOiy%@!Ty-U5%;&$>>G1dL!{P0dyc^A)Ra@59n zG2V-hIqJL^=fyuC7JeuNkuds^NT~LS7oU1D!HbEK+H;rse3yFso8phT^SA7BUikfS zmzpF=vsk0u>I*Nv^kOo{;patDy_n|36ycX{xO}_RS6+PW#Z0!|#lrEQ6;1cz8!u*f z@y9Nev)l3N!QJZN-RjNV>Jy31W@GMFbG(@A#kU*)yVdtB#f$Gay!WVXd(@ykYSJF{ zqZjkMd~sFH-=p^LQ3ZQd^}T9=7e9NkNqk!2bS1%TMv6w@mlAB=(+rNP` zn8_E;a4q*@g{ZCfVx4=fbc{qROq}{b-cUe`a{lZkD3=chet)__2Q`5 zF}yIj{tJ%^emK3j-;03opkOE|4-1KSK^@w+Bx(!B1ml8-1&;_)jmp_Cg5iW0C%vd; zptgZiUTis*{~P0XBZgxnq#53NJ`y7SJ2C5i*150(^r>YvL zX5jUGimwY*H&DZH-Wy_+ftravtz)1rYf3c(^$gTE@ZN~x9AFI$G&JzEf$mazBLhth zG&4}*x0J>P->FeeME(#Z+e$oaVA7=g<3D9SVxYO0EqOhBROZ$|5F#kyd z4OZo+?^gqAWZwN!COx5k4+A%}f)@Svr^mb0IP;pYSD3wC|Af(lw8Czl?`|Iz?) zvS^Y_qXh#q4a_p|wSnmdzA-Svz>Zn&K6MKA9#G#m%|CWPjjUIE$a zgwv|_!dlk1QPvg%TMeue&ggmr8w_kTut_AFlk(M@c>`e9+$rhX3~V@%?6z#apCG{&{Y*vmR@PW$Cj#;p6?hYl)k^*LbRAZK3_EXvMX+bq4* zdnHITmXe+4HDE|a-9TtkIwht7pCtJ?o2C{~_|moFJbHym%oySXF>uVlaRU(pQ3Ejp zaRW4K8L+v!1`Eh}NgS02Ow2qiMvkyY#H$lK9XqTP@xfc}69!HiIBnpJct~NrCOBm{ zC%urUu#CO8aw@NBC?s(iWpk$p4nFU&7AQDmZ$iTh0O90RVg%0yWc zce5-xUEy9K<;2_argQMZJ%SZP!YI`$iVpexCLR#J!o-6nDw}xH#8W1!Fz5x{B&n*2 zY9^|is9~bDi8iKl#9U1ijZ8Eao3%{THc>}-T@&?8)E7>*20|K|AYqhE%0SK&?V6Zq zYNDBmhfF+dqQ|y;9vc--E#mRHkC0E*Fgo*YhI+*BeqKk=+COVn?6JPO~D&8pZn92PW>f|A{Q1W&)@wmx< zY}L9kMJfN}6?)X89@Wj`oZZcn3V7rl8|rBj-A#Ndt-)hDc$`HK6Fp5lWAd7E3^VbT ziRVo8GBJqVs;TEqykKGg2daq|P3N%O?>*{O6EB%~nGNg9?=9Ge%_4+Vps=rS5=M7; z)N3aH@>Bf;`wQ}Bf!9sE!5V4mElvI9QP0dT`ZKra9!(8q=hBDjYKV!UChlm?k*c<) zc!p$UT@5$!He1HTCnnx8F~Y6Fi2ckM0}?_rCDa zf^>=UuXQz+KIa$J_Ns9vK4g7w=N-`1M<%Z5YCK1{S26I^6rO0r*5fG|JPc=oiHRmY zGx52J*(T83c=yk4szytZcylR?>uQ&@P<{$E^ z(_ZB=R9QoPV}eJX&SbZ)Dw<)!_h!)}hI0t&Ec#=p7f%+>HSw*9#U_@R_|C-lCVrI> z_yeooF#ksr^GtrSD6gUBoA`+>!&@6Fs0AkeHPk{5Q6WDIvf}?Gl}xpW&D%8pVN>-q z)lw77oCa4s%88oGg|}*yKVykAC0CkQWn#67H73@wri0Wm6YET@r_ZKypw8lp)9QAzP0FdQCbn@t`jp>PS4~B-U7|Y#Sz=qCdc&vonAmILpov2! z_OStds(SAd2iUn>o&L)6`P93I3jd*I+kB4+&2(6;Dg%<#$)c<}WH! z6l1M-=6n6>u!$qIFkaoE@t2E^n%wMK#H$vLn>bjCvUoy^a_ zZsJc9JTv?nH90cN6n&6UR5qyoGQpcTc-GTx_D;0$hKUwIbyM(`3=&312Gut~^)EY` zbIpfNKDc~H@gdWPEC#(G)rT~nbF9tspn?y?y9A2~vQ5%O%`Hg%3?C9JNpT-a_?*?a zz=x8_)G|U!`H(H7v=2ExR4|>8>vKMCs86JwJRkB!Ct;29LLZ8JP(GCP;cg#l`cTW~ zocC4Ehw?t$BiX0(2sj_^_3@fcRP&*t50!kl--ic$*mqwMPqw_zhhR{h4>|_~Ri2Rl zpbw9S6o*Y^AF7CjtdQft10hv+e<2?Xs{2sGhjAgr!)%`@TeKjgYWtj1h3ooIkM-J+ zU&rUHMeK$8KIbgZhka=3LjxZg`q0RSjvo~@_MwT7X9%d-{}etXMWlzFV>Zu8K|JHV zna?>^uDuVB_|TjVht;D#wDO^~4=p50e_BdLCbgmP30FIblC%}VGed5NQg|J02Onl% zC~O^8FNRg2iN}2CO$F(`&OUVUp)2bv(WeBT5bP$%E`HMI9C%Cev=7~V=;1?8NqSlE z847v16|aMl=yN{w^5J>mFA2Wj!;3y7IE{Q3RtzNcpBdSweSGNe!vG)p`kasQS0xt} zUi0zxZKqtS5qa~`K%et%o#!Jl*XuG2-VhwbZqf?|3+L@ELwy*=u@pn;7~WzQAI69A zaTpuNxZn2Sz5wnI;2j@E`0%a|@A>enAC)$zjr3uZ5A%GO@5B2(jP_yViHw;(eBk3r zCTUXy#|Sbymc8%8haA-+nJ743@M9l75%Q_v1i>A1;zQl*6LYDck+J`lq`x2${3Lz^6S8?9WO{H+H59@r`l+;--WCMFdQaAd*(7kCc zH8)Gr7QwB8+XR_J<()q4^1&;T-Ga-*>VS|v^dYSF3hoo!FUX9PAN1jn4;~*Vq(t*U z7tSOG3JsB)KKO+AeK;v3!1ck0kPl%Wj);WWBR)iZuzbkyq@7&tRM7VEZH2U>hKoGr zL)?eMv>-_l!^I@Zk8*+>Ogkn`uNhf`v&{^)6~Cc ze{QN#(oGBPKTX}Y(h0YH_**jmxbo*cWJU4a8p){8tmG?L##m`3tr_5RxgFmDDfp|G$23xihV#AEo@r_M@~PIes+oqoE(Uew;p=cDEnp z{3zo`o<#Eniv$b&e5ugUVR#@jSNTy^q7)|N<^8zFk7|BY_oIRz_p(Gk?iZbkf|dMe zHa(Tu6X@7s1^uWZsSoQ-3Q^`o92 z_5Gk%RQ{hojM7LWKN|bd%8%B5K6v0E$=KYFhy7?O{1KKVBvEJr6COV5M+-@6nN*;C zCbjXStsjs1(b;;{`unWMAxa zz2e79e)yNWUiPE6AA@(M{qTb8xh-jL^>>jFDe2=!qsplizUIe)A!Xk8W3(Ur{OIq; z06(s4X|Mb7h93ht67t;7)^JbWnALx(dypSP{21!Tw|{30_Vb!`9Ioxoj;JaTb^Te_ zFh8MsN(*Ge&`&KlIj(+%xDTRl6HJT68Zr@ zf*kqmK|dm*MmgP}!GtqJ%MaU+m>+Rw^y9J^KP-60k0U~k`f<#U{5|o|Wi1Kh6ueAVptH@LjHi&J{nd`the9fBAW>u{C>=mf0L4X(k`e)w6kaMR$rd|IV#p1kFo2=}zX~}8 zG2{u!7c3Cx6LKYz3IUW2;BMjN0=P#=c|oeNrVI)FdjqJLkP9Z{4+QXF0P}*FA4KH< zssvz+a>oOx8bGxGK9Xql03QF+Jve|j1E>)|%>ZfzP&?o(4ow576F}VnK7P;5XuSZo zM%DSKsviI`!5au~7(k-{8VArMsq>J?ndM<2{YqsrOS1qT37~lZj|T8^0KEff5kSj; zv+zC>K&t>+2hcHqP63qgmT4o{E`YW|ZVb<)kfD759Yn~V9~pftfX)GQ3*bpn>k>d$ z)<|@i`a}Q;wS*D!rvi97fF1$#44``e+n2d0d}o%6$}EDGDIqdCILG~L0M7-`i=7?- zqb~&TqL4bzyBJO2OCou0lKYhaGA3mX3ZUs5?mhwZ4dB%Px&#Ua1~7Dt`?UZM??wLr z21qDwDF#-Yf#h{Q!&~YN=Cu?9h0H=bL!>v~3ShX9p#cm_^fJeu&*}QN1AMI>@ACQo zKl1ki7%9;)f};W$E#!T{6+=>)@q_>HvBJl((}mD-B79oGJ)XTEz$XEG8o&g0ZUEZ? zm>9rk0n88JrvN?=U{V0H1DF%Q7Xh65$32ZMZO!>IfXVFrF_}}Of2Rr#v{bjhGxqn- zn{BDD0{A+B>C9`XZv9c_TSZXPkboxIx>u1TnFo0hI_%(n<0W1z+2}gSwH^V&- zyUIW8A|aAj+m*)8<>dja2w-IZ7q6FDAHaqHRt5Oe1R5VJS`)z90A3p5{w6)QRqd2@ z?D0XEKc=vtwR>X#o7fufW^4&ya{vRoXHJ@v8=9S4>FLy=pSbge72L4YOAlsl4xrs25^kiIf&*#9Oo9y`%y5zX z!J)W3^?Cq*2JjcB^TmuC0o;_zzCGT3D}dV^dqtV9ApWN2Z1;%$Id=m1hwb)C$$ta* z`$!SP)$M6LdgVP^x(q9o66A?eKoARUbyv_?k%neDLx|DzAewzprcMwK6}sI)WCVGm z6S9IR6GUDR#e+D^HsK$pL6iuhq(n;v(a_~e$P=Wr$a8|o6_OC<2T>42r6BGTVPO#E zgGkw&RuqI1N!cLo4x(HT_5Ndxc^SPYhzg=}Zx9uQu((7L$^9a!97Gi%4+uW^A3Ifp zs2)U(AgW0cGqT+EKcvM0rjkoofV=A7q(cs__1f*|iD zc>00V7lU{y2$J4Gyd1=d2U3}u!0Wd&$eGkP=se*M4PsajuLkj25dDJaA4Ka1(uW8R z2=Ztb3<_ePL@9qg$X|FA3Bw1UWfBJm@us9sxs}6cx!Eq_TR{wG`v>vm)||J4cqhoa z&&q_#XR=Zwf>>EKwN=fGcO}<*Y>kO-1|GLNDhO|nOosP`jArSbvOW-`a9j`{($&ZE zW(M(55aWYbJT7%o5Fd+>^3Q_!gpUy0(>@Ji0*A-ARC0!iBBU~PJ{M&seL>%ZPYz;Q z5MKo`MbxN2RV^+%DTGHu_?eTMqcn)!LHxoAnCo5@#A^CBAn(^876sAkt5ovEK`aSkDLo0|_W^k; zM1f?vD3Gia`G9Sy)L#>X`{%qJK^R@L)&`v)m(u2EtqWqsjhyu|gf;}RF^Ek;aD~|% z#I_)|2eE~dE2g%JLi?B+v&H%J|0zAQR9mQ&)mG%LO^xeJ+UeL0kx8PigmMs{NI5F^CRt zI_vGFB;hjNYG~foAbw-B2XQTkn_`4^j?T~eBM9R4ApQ*EFX1-?C-=>xoFVjE#;qW3 zi|}vB_-_#Z2w^IXB)BW&R5m4q)R5y0Lbxl0Vj*x6O*)g27D9Rmk5_Y-5H)uQ#Y5P( z*?Hv15J{$BmS7~NCX8?o+>%u?gi;}-Ww^6L$O$1ggwmo==^pp}HB!rja4x3u1xfNG ziG-mbgxT}Tkf;#KhOqR>ta2gD>6n$fC++SK{^^l$n;aS0BcmXOHD^wfynIW|G&8t4Bg0QhugOR*Mim3*qw+ zT1sjwW(=WC2yH{yeLm-n5O#LSY8OIRc0>s6mb=>1NluCoI*C4wbPnM$;Y?+ep^HSX zO>tg&eS*yu!oS0v=bUaK=Yj3X5S|L*Y0>E(!pDQ$w~L&y*Fz-##?><+JR8DuA@mC2 z)ev3_;rS3=U}^|`LYP%Qb^q?H7ilVlmnHO;jI^+GlAD2qp<-?(pRf9|F19*zIR`D{_WS!GEbNf=iS+*H5IzWDObBB`7|-g5 zu=+#yuGHLdAv|zceHg+=98{Nbqg~u}b8<;oM1^q9qlZ<$!)jfo`_mAJ69gxQaBQ;E z$df|&f`clI>S25t!sHMxhj1l?DIrXyZz1d#f2M`7DTK`-e8uq@!t@Zn3E|fe7KJb) zgqb1C58)@aFegF?KZekvf_qK~b3^!EIHTW&P<%#V65P~A1sX#I*BqW@SCQ7kFh=mXrp)E)Y zheJ3L!db3eoUr{|M?*Lf!b#!BI2uKb*;(8v5wf|?gm5}(nNcPYsdHW$>Y^lFNGe}S zwjR~4hVUB~(lD~a_&tPcoWdd83E>aPawCMBAzT;!r)2+2c%quOq$ya+-(v8#C@}hu zL=zsm!bk}tGwk$BY8Vib9>!f^6bn1Gqn~L)5!Yc^Ur9`fT zZxy8=mc{6OVcZ|a14&8cFdj^DW}!|MiB?UPUL%Z}VGIgma2U11s2#@BVP4aKI$_ie z<54P$emyC-iSYViGzg=i@J51-!_Ek#@q`Z#h4FA0O_R>kt7c(5B06lD=8}bk@|L1Q z{+I|`h0!{UHes|4qg@ys!{{V(8gCy)hySi_@p#g5LgC3U zo)QUjQNqANdxX(5i~(T`l%!|Ecp;1zg+D9!To}ECQ2BWw%=l7L@~V)R!{{BxD+ys3 zeUquIU7{4`eJzZBVf2@z|H@wv7f7N+2j3Hr+4r5y>_s}qgh4Ee(BSr14Foq}f z6L#K~=sRJINXp+$w)6iA8WqO-lA7@6gD}Q~F;*lWhVhY*aWWnf3jfRaNf@7ou{(-A zQA`M9Vi@}(*dM`XROWz;ph5&sjn1DG#^ErIgz*JG0>YRa#*{FYgt3%uK01GD7}LV| zDh!v2A1|kV9me#qLm2%=6lR1mQ&OosD~#D9{3VPzLMZ%R$Xvm1IjuTpekaJJA81PC z^TPNkj0IuLmndIAV5;kg`Z{|tQ zvs=U1E__EAyTZtr?i9UKB)_|h5`>aHVeAzlCHuG%x}6#w6p1GcEsR6L*^(?p55pTq zIE;w6VMvmhs5o~hNz^YG2qPFqDA|m($-pL!N~$HuuA$Ht9utfUQpk))StHrCo)f{b zFph_DB8-z^JbzS`j^N_b{8Pf|)#)(KgmE^Eb6j#GNR8lp7#G6$D~uaqTx9iYXI={9 zviM1UC5)?Km`Bw0Fn(i|!?+g4A5t_^8EBK3C_Tad6eD!(rWm;u#_cc?LMr?n#y?^F zD-!0q!(kS21_O(BwJt~)yzi(&1b0P{6+!U`ibaqXaU8qlEhMH#kP$&<1a2AXG(sT* zeIs%+C$WUsEEPdXA+*m_Vs^4DayCwG1Z5(4wx2ssP(_d*K|utC5~aK-g5P?&NEq&~ zkFpWm9YMKdYWe>+_1*|7M$kQi9uZWE;JyfIMz~=+?fwWJi11{sf*Ml#gAr7ZV0rt( z$`Mo{S)N~2u$o{~dA)*2_oy@WsA|{7T`Pjx5zINN>O_!x%o)jbBd8a_$PY@aII8ML z&>(__5j2XRMFiGS)i{DC5j2gUS;X1s+pL}QHSnPb9!|E#jOUy`2Op6r&nIjy%eG}1S>T5#! z3HFa*KvF)CB?=!D!Qcqqk6?5JZ;Iq?!68Y_p%Dxd{+8fyK^8|h-ics@MBil}33=~7 zI-~x>KM?+*ATy2;GFEV0(vy!QI$rQ&L6*fZA%ck!td3v}*ME*QN%}s5NkXPZFfD>F zgwyhuLM97Nk&dSDD~ZzQ*+RaKV0r}K2%jN1i{n-ZvrwObolE^W(l2ubzZLvWyk*n< z5W$ZT%!^>YWLXx$PZ2B-zDV%r2!2gkTPWn02>xfEWU&aBBz2aGx0ElBU_}HgMZPMT zN)H*Bx>h7RBG?(hx(L=wbc5j52sR4YB)C~{iy-r|M%#pM7o;gxlk!A;cL~`Y!JedK zZ_?WX5&j#F-y^sd!J!B|5kxurA~>}mN8>cvt9%jX{Te+2uMl!Wh{Ro)*da3q(<>i1pkWUj-V^*e8ACcqF#vNuBh{TLLo!3=>K0L zqv=t&qsWLNGm00Ycrl8sD2hk%XcR4?C=o@;C?1I7!6-^aksXDKqHGkUqj>h1DicLs z6gg2$Kc*ORMab$il)584{B}tS*{mM~PiK1~7O`@n8MYSlZM^Ph+gfm3y)Rdy@L{T@2T1hu* zi?>v$m-MiKNa{=8MD~V~)F=u%%n~1xyv?F`B#MWlXqvQ;P^M0E$xBVvk=QbdR#EUZ z#%k*eTSw6*if&On8AaPD+C?$5b$ ztX|YLipNF&33l9ZRd`%6Zyw)lDx1$zo{Hk>D7r`S%$odX*{2Vc=pmfZo+L?5-+o(@ z|6G*Uf9LgLw_eM8UXan3qIfxqccK^(MeU6I-cbyQVxaI>qUa-}ui&duye6by6#d!e z)A{34Dzh+Q;Xh@;=?E=-pm`#qHiY-xYpKwfVk79=; zZ4;zqr^t7S57&+>N*I`NZxs8Y7;0gd<*eSHFD=|3#R1xn;!qUVqxh4>9V+l}zSoDz zS=P_33F?C0C=4N#^O5rQapjA`&+cgL4nz^;sCcF*6vYYlW)$Hl4>Lr?6Dk@-Jc`3n zSQ51bDUWfjJE2GtoOmRPqfs1-;<)H=vXBs&bSjF|QT!1_-?_!lL~%BXt5N(W)9PFl z7oxZ*{Cr}fMR6%P<1Uj3zapk+jZ^aXD6U1pmkRle_i9f5$0tcyp^Sw*rdl{QE3>kN0tL`8P<6+7)Z`Y_WLb7U}0Hx=iK8O6^f=-D0rhZ(QvRbBT3Bdlp_PTrqI2S;a-C9lpHh#W zQUgw@nWt1+3+>qE7P?w!Z=nNQ-a=;!Yfq_;Y{t{h&C8v{X5f@lXqD6Ii_>byX?5zf zdfdVj7P?t@(n9VT)#!}se@0C^qZXf0C(o#qv#RD<)!jl53wcBa5 zwq0h*dDX{4_4De9^J>(2^_qo#7T&Nh$U=V$11t=*@VbRX=hfl!>Ywwf)&+kpDX9nntnljUnBF%1y${$qU0?L!!4|`!PVex3-4I)SwnweW?7FD-6FDZbFcWD8R`2QB=-QDVW-GL5tYA{)Wo9> zJDrjrEzGm9fKwxi`Rr~k`=ZahR3p;V&zAF8MSUvJ!q zog`l_WQ8DS`YH>nEv(@nw6MtnzYG7-tHhwWMe8gazo<&0XuSpE22Lx>`Gtg>xS5>Q zccpI?++ksxknMsIxd?-)J0)tr?%HEH3p=0Q_gdh(O}@`^9_;rE9uPbzc*ufBJ{>d* zhDdY^UJGx_)t~&-ATdSGhksh|TL@SPS_oOVWZ^Q~c2{B8LZ_^_g~Jw(SU4&T%a&v#v$aW>M1D+k7(Hom&lS#CIBVgw2&s_h6sEG@&q+sI zV1Hdy=Or&Yh23;fBqV!o7hJLMn}y#kT(z7xWfE`eT(j^8r;m++Hm+OvlZ%hdtA+5F zg&XX88x?Hav~Y`SvW?<4Zd-gg9k6kijejisYazu(s_lIJXSid*WjntEeBaag`p=&c zC?R3E))>WXq}fQf;kKQ(uoEGX%J;7`Y-CE_8wJkK3w)QkgpHCm@@(YWC}kttMy`!A zQdVgjIkuC9n!FZ)$d|YiQF6YQU0|coMmbR^vY~90wQ+Yszj->d@Q02z_1sz|cZ>JZ z`3YEFlK2jF-C)7JHY(bvW23H(N;dAZ@qmp7Md5y1_Q*-?3Vv`^wo%1KO&hgrRJBpf zMs*uCZ1CC$+9$FWM84}yyxPoN+s1`#=k4;kvs~M2y7`uOJu%xru)ZMuPyCkBP@?2b zggj=WvyF#rJZz(>jb`-3Mhhl2%6h~Gi)(H>AFt))rx=#o(nc%FZM3)1+IHT2Z)2ma zn4&Y(Y__^Mf5{>LvRO(88y#(Q63;U(DQ53*IE`-8co!R8Z9HeA7mb9|9=GwNjir4M%WlGL#tjBye-)|JZP=aCB?y+=n>*b z8>4KzFA9t@ux;r)fA|_L!k%xt$J!WYW1=+Ihc-U4@rjL3ZHyPqkEJ_knI{hrfBQFw zIDu8L9V6u5w#xX7pG3(hPdrG>i!W__W#elpWwMPa(%n-fI!*B1H{EQa={CNx@gv*N z#ta)XZG0=Kvuw<^F;_TCnPY>~gk<0)#qLYgK zzcR0lpKL6!@w3fMefULMj4u!Jk`%u1$o^sn?da%UY-0)M?0Y3v*jQ>i$0jVZvD^m7 zJUR7gko|S=Xz7)7X-fK^{IkAU`f3|%Y^>$DZSB5d)5abfdu{Bp@yL`EN_Gq3@0|N= z?5A&+)bUG-4%F)9yrMhvk~(PPkXZ9@eY;l3A~Y_Bmy|B8eed2(o=6{LNpGLXb<#92y*%o>-~VOoC0G0VeDjtD<0NFmQY zI$`4^9ax#^^Aw!2aoWaN8|T>gi}KId*j>VL`};34NX~O@v2j`aq_ERvb&)grvbrP^ zl7x`a-?)G@z)c&sZ2Zop*v9Jb@>x@cKlmwNW58wgr!)d3f7!T^BgSe?|=5|I8hKSse*v){rdB zRghu4JzC_MGn&2K7L+=9bXlLP!_7T!IhR>F#GRp9pNczRl zKZXIq&#iU3fJi&9i?ufd2MG?2Vc2XZX-Eu1V>mxLuVZQVFunpD!$UXS!($j1!-p}v z9m6{@j1VE^qhokChW8{oGKTksu#{0k*4}jA-_J$04><5dGFIG92!#wigne&-!a=hP5K3gq0<(XObv5JcbQ1Y>Z)344bJhNeKmFBD#%>Obkb3I2OZ>7DNDSc^A~8hS z<1yGV#8`zYx$8z0Z*WBo8RCwMCoKIin{={MafYr}6!X^amUldvdNzg=!cPjG5-(*?9lIya|#PM|vEkr8svS8F7?|qhuVJab$_Gxa3M~&QBmSmXahI&yN3}KNK>W z6GyHjl@ZK~J8mZmV$p>ntQbe7IEr{`e;j4wxI2#Waoi(G3H#;#!z;vb@Bixn?c673 zAB>~2Xx=aQfC!mdMWWRN=~7jZlT;T;qKH~?)Q+P`91q1&C#l&$3aXn>i=)1fM79MSV6kb6^~=$8m6O z>KkzkqQhNXUrx_mGOZ+$2Q1UiH^ti_f^Xc$*9IHEJakYFWjuCOZ z8+VRM;28+-2^lGFj}rdA;Ap`Q1gYt~1sun?I6jQyqc}<(M)qNhkK^Mww#Kn7j!)wF zG>#wRm>2*5sJag5CXVMV`vd7@*_LfE1_?q*=)H#Cdxt;@5CVkW0-=WzLJ6Tm=siHF z2|a|~5+Fbby#->G(-rB8>An5uMnC1{|K7gueLFilJG(nOcRoueOwYuOOsvhsijl(E zV#3T!`uzwj&jj&VjI%Q_hsj*Vd5rTJzh@-P1xyw)E@E8FxFi!xnRNKWMrtdVuVGxt zxQcN#czm=FzaH(v@|&5s#nrzVZ^xRVy-4|=Ok}dq$4C-CosQ$yM5xe= z#7u-TA#uD>@N1cnnJbJcW0*0*c(6+Rv=!-kCJe5cnRuRw7n#VSOF$;>QS#5k<4ios z!~;tHtn-LgwMsmdH|;E>QHVU{re}=*mA}lyt4w6`A-fN+x%F)(Y(BhU9_<_FL%a|0 zS<&*ZL28N)VfVq|LxK-39|Yh3hIW#LcGl3OL%kAxNb(_>Eks9;nu_w7+gx-@Pe&}( zhcq8@_>gy}Gp7$3KIHZx-G@%6)9BmxxqKLUBIme4);~}4_^dqh4x@+BOTCzoJRg%O zpIc8w@-r{MSkQ+;|IsPzqt9}~?uWyVqCOP!VUiD%eJJij2_KsH(A0;LK9urVe{s}i zEbYVlOh{73hqBDeF_vds@Oyy z%xf`{8VTz#uN%{;$9C#7HehVX*vN;*KHNKIb)k;Ud}!`NKOg#Y#}+<(;6n%IEg4%e zwq|U@*w%-3OxiP&9rCuL4~ z4DsP*PGKlxkv6U`nGEw`IBjkl*9ad*F(E#ZNw1wY;-h1HtPkUSnBc?L92on3@l?jg z_(UI`9JW*W#)rq>*oaUo1=SQv{ytpu(eIMbC*DC{0dBt2xzmSf#C@3V!wesO^kIV! zGkuul!yF&z3qG%YOrK5RbU5t}fBixKFk!9_^L!|9Hf_ES%Y0bw!}mTc@L{13i+ot> z!`623`KQ$?S2kkV=;c5@<0vij=ILQ^xu6r<3s0T zX(!2Sl5mRgv=4vyFp>UHqMP2MIq2((!`i#f`f!ep^Df(;yh?AiCe!BOjuzPh#??G0UX$oU#+kU;6Nh$!o@VKir3>Mf&F?xz~@pe(PFL-H&{JyyHhn zKT7$L-;V-*>ygo`p6LbsR*2Gf;fwfDh&ff?W%8aMg_%T;Br3c_HT>4sg=+dyi@VqMqoE&-{HR0A=*Qu) z!tnVv`Z|0)Km8NOQ{RsUtVXk@YGXf|_|evnb}Ve_M@v6i`O(ae<}7L9$CcdHoi-IB zt-0F950XclNEp>@??(qeI{NX!e>#51`XBl6@&DJ4cJJ&*7e9gt!eHLVPZ@jr(Ur+( zesuGrJM*55wEI2$=yTQfxgSICI;q-=Pua|@M8#7 zX$9sdq-RSQ?Z=mX>zkgGsfPJ6oM$nDaU|m?Mp}mtzDOU#JNT6!WBnNC$9O-c(Ne#0 zPVnPvKPLGxnd0rPXGZJviGF;;9o_dl#qW9OokIQE*rxa~)sJs!oBmAOJXoMtAIx2s zLvN9z@9czS-&#+2X819aItDQ*h*^Hj_M>S`y{%{Gms@j%OaQe~NC9LpcwI6$3!b(5Ba|x>$iJYryTjK}e z58O%$kE&XyZ=E0O{iy8{eq<#126Co`jk;{&fk$A`_?^8aXHNQYik%@(PV*dTvLruCv-aZxonk-!Lr1dtIx?f`PK!CWy5=>aReX(_1CdgkHoB%zLko&db8ke7{@ zIBi98{(vYQ^2~%n-)OQ347-N`Ufz8d6xivKLT9?_$+{KJW6lk-wNFW=t0#0{&6HsyyqE~ zBJ>QPR{-X-9P93RCNFpWeKgH_3mkXp%SeOvWAbkC_<;co3gD{%#s)ArfG-00GJs(L z3<+Rp03&wVo()Z)(tLkB6(Yj}h)PB zWFB#R022cEI)I5>oy7PJBbg${$il3hwkfeurZV|9X7jrMrqlFC3o`;(6~JodGXt0v zz--F@0n80xIW5=4obzb$16UZqq5!^U2?-ZaE{eW(;2PTTtCFN^X!5Dp5k7{~5q}p5yfZ{$d|41#mfl3(PMvmbsBYzEQanK-EbJS1A#FDHQK) zyT(=e000R|=SBcG190n3;H;j1e-{}P?gIFfJNv;J0k!TcrTE5_H1 zp*hxL7F!T;K{$d4+)YcIkq{rW{-VED%J&Abpn#IfF=N31ux$ z5V>MJBZ%BFo+pSe&&HDi6>kuES)MP}`VN!)jQ&mOg@SlDh;m$gFQ!wHNnyq!K@??D zEY@0_Nr@op-1kIBDHTL%7M5Ww%Q$!2|9mJPLqWURzknXw8Z85wZOy63MJL}Qjz z526N>nvC^=^z|0&T0^BalRAub8C$U%^@C`@)rO3u*@#wkztyWr5KV(<#`3m|&0{(( zn6wO{6_eIMv|%##zK2S5#C9xcAH)YtIxtRUhd&JBqaZ#G;*%iyv%C{yH%98-nMs!* zK4sFC@iWG;)vPH~=^jK6mVD0GGl*VHdI!;$3F-7^m zIL0r67|CP^<4_6)Cc}al!GtUf4`K&fAVO6tqkV5UYb&!)j}}`wz@XjhtB*<#hjZ)<*V!FR? zLqQx4(q}<&>WXFaXb{JEm5vATTg?6mB0P&Io{aT96~yTn|AWbyAkM}l=Yse%#%ZBw ztP4S0rmZ|`zZkS$97N?3lhku*SAw`2#I+!<2k|_J7eOqWEZhjf2*M2FW)KGt*>45$ zchGuE)on_QK?H-i6U09(>3_+d8H6v0=*y`H{XyJbX=Oi=LWmMwubf&CQV=rb&n`AK zi1FWAnN|rRUq=VYiOUP)!$Cy2iCX`-@1Z9EI!W$(hNdQD1yMhT@R0E?<2}avj1L%} zRkx82l}B8C%=m=yX;gvnesvp7=Ox9Sh@{i5R}@r1>ru%YO6j8Y2C%n5*hIvM)^!A; z*BLxVn^Wi4RNk@2rq*>a1>!>#n$Gy2pe$zPU; zA30p`ipVP>pNMzJ6mq;LqV@yN^NaTUG>}NYcV;ihScvgmMiN%&7Do?lhSabX6;VvY z@JY7%B8rPBA)=mWJ!dW{V&fiXZCZ`h@uftR7EwmT;N4Ct)tQtPQI4j`yn=|zOe#`e z5zf`|QO${yY*kqPzKE(Zc{R3AO*9Ir)nJ91jI~6NoP_(;UZ9UO@l4LtO{6N} zL=oSJm?dI1t4$K|9h2^A;$#t1=n^2}>DP(h(ni!xnkM4<3ma9VIGu$w#0(KLxfk(M zhBfFM>S&9r^dO$>%;lzejPpfA6&8wEBx0Y4{UR1~(^?VhL@W`pRD`lEiAGt*(^)QJ z1(TH&07RIt60zz<5>5GsXww4^@ez#cMf@mYn~3cqN~(z)L~Lc9jUqO&<;^0tFbTDY zqk*Up`AGz=_Roybm8V(k5V2dt9(Hf1h+Ryg{_otD^b1#i6|q+YRY`wCi#T$F_Tm6H zonSo3c!=?^h$9rwB93wOI3q1)bf<`rk>8?C!yUgfIY}!f;&g1?NP+AVo)vLX#3hlw z4TnEPoR9Uoz~nF9DN>WutgyK(;))27wqC?l5!XcA6mg3+DGaWQxFI5{Ny-#~gnx5u zrij~2yzj)_5%EuqpG}LS4f1i-FCsvPmw7ZWXgU%Z6rqXGX{p(G`Tmw!%RX;Mm@z_A zGiLPc$dSE4BlfBU8@Il;?%^4tUygqs7XYt5L$=ujPjlc zZwPrqcp=i4Cg2PqA%s^V2DVM0f)HMdcq8I1OX5TLt8IcUWVOaIZrp7nPDmwN2-!oh zhd|uHNKN+^+XUuOO;-qsA!KmhBt}w5VUo<~4&nNkIO>=hLK+W89dm?`GlX+GlW_p)DEFh2#r~%P6+iwXu!NKV?D;`Sk#d$G>px?NeE3t zXwC{z%Y@CiN}4TV@|H|aKJc^&p=}6#xY{m+_Dntx;e!x5gwQ2~PebS!!iO>YWbLC6 zI`MozX5~*9|6Qfdu>k1Ga?E!ZHf82DarPtRTzu>75Jq_=1A{qJ3qEe!||qDg>&oW<1i+cCe0ZZ3u1Z z+BSyZsB5ElAgl{veF#62a)`d+Xgk@;7MEYxS4EP{-D)M?9JOFuU!Sy0(MtCyh)0vN;mM(Gbqiq$mzA*pG#9GK5nh9H)g1 zp<#AwtlvWTovqR6BkI~nE$aX25YE@J{lV7AIE`{Hgg@EIiW z{1w6lN;?e&DrBK{UE3ud@iH$Ut64E3@id)M{BZpbE=Y& zHsqd!P7*pxXeXh)gb(Q^pLR+@_d-Gk2_2bCK4#hcvyP4CTe5)gv4l@}8KaV@O?pFb z7YUzA=*Alz-TJN)K9lgr1v_n`{quOzq(Qs0P2xQz^pY?{!cYmlCG?TdU%~+HPKUIw zgnm3P8k%;24ALA2O7xil43^Ndmu2k>30+&-=(tVdV>P{`@TG)d626i!R>E)zBP5KJ zFiL{2u8j&=C|B3Eq>*hj#e;;y4Qyojqx#nVl4Ii}jF&J`!Z#8oNT9s*HAgZXD@tyQ z3tEdtnUj?1+!3E5VXB0!5`L2Kt%PY3R!CSW;X4V_CCr!by@VMOW=fbXVGb>CkN8;< zD4dEkvKb|becV2e;<>m$A8%W7+3qeNERe8J!cqy#BrKA!n4_0mrLu(A zXF)^T#sb!1Sx%wb$X2*_JWY+N9ZLzTB&?ROQ3CDq8VNs0STEs6-mkS1)=6;Iv*o;E zuUtZ)-!r1<-5^>2cq-q(>P{)>)@A!937cshj@Zk$W+9JAAzi6QJUOtYM|^F~zMXnW z_?1SHu#;9v!X8>Nil6MZ-MnkJ>R36J=6JJP++Maoi$-tuBjJ7t2P7PqaDsx9r$+Hf zmJdnR1>&%TBNC2Epfx{6!5__>9PnZt>y**@A8%zVWw$+8<2XstCE<*OQ?#&jYKq#b z7qt;m(^(1UC^fYcO35hH!}TX^(}_f?o|o{KgbNZbO1LNCzJyB>E>na^@JqPDuHKYz zi^)~V%FNd!T&GKbgf4u(ZWR@z3)VLM&F7I6ZcDhs`u{Ly(nK0qCyvUEy0)@)O%4}l z_X^7>BBLlJ)?(yp;SdDvV=3wE_7V=KnijBOax>c){;ds;dgQL*wrrPB^F zrpox1o&w4EP{v0xK9=!~j7c&+k+CSR&`CyT87KPKhl65G6u;Q%-wr4_L0$7MnC5L83)Q3z@$c=BJVH6mV#5}p<2uI5FZvwlkaneK?qiA#)V`xLWC6ALa zUdC54#>&|H&~txq;%UYS-1;>eB(>$|lkh_l8Mha4EE<+LS;iC@;a%2)N4$@sm4@Q#A%GG@qFFXKlUGiA(@u|me2j)HK@K3m2@I+eHVROZN-%X}W=e8%r( zEZ`E=*_9`KQA~faj3vyMGA@hBmy6iL8{diejL-Yc=B<#vd5pj1kt#SSMrL zcH7KWIjFiprXS;mO5J5_lChaqQpN=tTV!mN@so_7DWdAz7WT9*xRf!r$=FV3M8+XL z5j$k;p|dGtr;J^6FfZA6%T^lC$$v-CA>B($&9_DeWH?I+zslGrV?V71{kkY!&Mw<2 zA<(6YE=GrC9FcKK#%UQxWgL@noI;CjQqH6_OOLXDlhLf0@VktYGM=up?!m~bCVAs& zAUc>-{*ZA-##tG30n)Qu$>baz%zW|ZW&Fv9I;p5NE_p)A7iCep37x+m9D3x zK-V3**3gCZnvCmI8VWaL_+Osl4X794Hn~H}iDAVN(!CPloBwOa&m$>5(u>>0V&XQC?v=+GD1V-Q~vkoFx?T+(3I!tkmgrV zKtVwT3o0cQQcy*~`wHGw@ScLg3W_KwuAqd1q6+fQNKAd?Ni3MIb`^>#c=jw8k&+5Z zDfsY_r-Fjgij`!_Dk!I*jDmWPJXA=s!b~4@Grr~rj`9jt##=fS6+G;kSc#EHW$s9% zDw*v`pWd_AR!~iW{E?%&f=y#{4``KCLjhq;1+`e2em{b$zNSJQ1%%(#5a`)pJq7hS zKQ~a&PyuD6Ml>%4Tjn_%D`=vise)z-dMW6wpt*t;3VN_wO9ibIe4?O}g4Qf)PwTIs zje@oc+9@z!*#^x_)Lz@FO>vP~DjituBLy94`phRJrBk6M*E;9NEctYsld7E+bmeLn zMv{E0V9+Da_m4cEv7{UM%!DLVNP)`d3VO!$Y4kn{`YM>9;A;i_6!cdxTEQ4r7{EAE z!N8dQASQzqd=ZljQ81MGmyE+0hsRn+Flk@kF|1PDC<@WnHgC>^uM~_`FrJ&nG1^|+ z$P;RfdPu7=QNcIdG+n_YCe$=l!Q>d9qF`}{L=t|hU>Xa*QxKSHEem1)GQtc6Gg&@M z!5js170l-9gX&hVdCcc4_+G&_UYWCue#V6gDz+6CF%ntKWQl^MG08F}>3eJ|6|7RQ zHiC5#EBsc|zK8L77;6;#pjdwntfjLPM&7W+*C|-9V8+a(AL(#$>qf>?DmE$D%zTT2 zpXi7&-^w_*UL5t^reGJx=XM3>a#@lc+`5ydRxggqZUuW3{Gwnl#ej;zDt;ve3Psg& zY`=m7lq*yusyL|Nkb-tMb4p4dA#1<{Y&rlLzmxxCdsOh|dzZ6_jaG9GfD7eT*qJ7B}=@7rdQ@hGK zQ3>G<1veFB(lKQDEygXm`R#-1Io+VRVkq zC@m{^t>6u}zEJQ|!K?r1kmvt;6`j{xUK8SEGhT&5g`ff|vZ=_Jr#vjysx4vD;H7ee_<%4qNs{uDvGNp z@gF0kA048!iZUuHs;H!*tcr3f%B!dlo9Tajqj9NAWj0cUhmKl^j!v!BRMb{cM@4lN zHCU~tidsyl_1_Wes;H-;kxKvcu~xXgiUukgGADykn^FBHDw?WjrlR?OW=c&_9YV6% zQbj8jtyQ#9(S!CvMOzi^cvCtvwpY*#FFeMkM#h@^}>!xRrQxQWI5t zqhgYZ$tu28F^yZNFiwrFPqh1YEF?SAW0s@xnJQ+fn5|-titkk{P%)P^=g0KtF(KvX zhznILV#!h!iSE3k)!WapQd<>(6hN|`F915sW{G(-&LGo@*CrSSKuT|qMn~t@rQ~tD$Y{U2;=V_ zu5&8>n8|a-Cn}z*c*dN%{M+jVOK6l=Ovuh_ z6>nlZI(l3f_AnfDQ$cSHWkeX+m}F-pIcW+pp2)<>m=K1GNp!@dFp|S?hmjISj+lNb zN%q>(Vro&%oMEK1ge*rTl+ecfV$03@OIw_WiHG->s`L^73I+2%|Lh z>S!y&j+G6g9FwRrA?a5PqY~>AC(X)XRAKvM?R{2`%BzP_BaG%@vZi_V|n{9J_w@&ckCE5NX9>m^&)#N zF9_p%<~bHvKMX;o;h6ZvVJr#by+6`dhpo5o7Vao44P#jt%fna^#>y~Og>m3>=bBDJ z<9kWMW6!dINtMe8-KQqd`?}YJ@k1DE!&payhVgS4>nZ*pduUA>J@)(<#)dF@tW4Y( z#^x}#gt3Vhyh0*L2#FJ+vXu!r^WvYR4dsO1k3AilIJSqeBaEG4>`o~XXaRY{1G*rv>=Fsh6+ z(AvlJ5?$z&86v0^ff0sD2{VG!2(rSs8^#+7m7>BuMj}tcxX=6n<3q+rjE@#nTc$ws7e8r7^^eZi1H_% z+7Z-=U{nO7Bd8ley$HHT&?AEStk5KarV%t?-jJ~oBMs3wf_}M^i8PC#c?2CJ^vY#= zyPY+cwu~(qTgCKSGieh+=O>;C>~p&a+Q(Wyh@b;aaD?T2t7SUOGZ*27Qyfs9}&UG2nOv>Bl+Pco-q-8#Z4C@S3OmFBvC& z>Py3s5vm@hM_6U75syW1Jc1Ju{KikTs3|IscBH;UPSH_~;8|+6=c(ELh~NxO?KL*M z#@PtY(OGzi{txkI1m`1YoP{P?_$z`7=HZxxZ0eN!BPgq(oCcGUKjlmfDH`rZaE~&xhIkG4BX|(O zQ(B4$9!Bseg2xd&iC}I~XRD{4L#gg7f}{6S&&;QuvgwY>4#)Ed9NzfX5xj}uMFcP3 z+FwTSDgt`t@()ivRhl@@J@veepy&_6$ueoXYPf6~F79%9-#F=aPN5;220?>ULv|`= zoLz%MLvJmC-p5s^uH)(zyKhq-iLm;av?mH00Fa(csmPt|6C(3=O$8_zF9MH|+GL*_%Oo9?g15c%YJV zPd&$(*VcPA^J>Va;T;Y6HGCFv>FLfQKMM2OI16Z~UD0VivVUvX3u>sC+mZ0hL-?MC z!WxQeD4}6*Pg@ZUMKu)DFvXG5$nBVREV;Uv@cuJTcN0 zaAtOLH4Xh5x@u_joYr2QvCCEKey^s6_H*4t3KuK~cw&c3B0(G23R;*8= zf2=gr&`3jL4NWxsbW0F63A<*v^D4rshAFsf@Ab?x>Zs6MLkkUUHMG;vQbQ{Ztu?gK z&`T8BytJn!JDP;;k003AzvpQ0x92D)qz$mO*YJUc4jK+jNxncgX3snwX`zmx5?i6o+*ZGA)Zw-Ak^wkh}=6Uwallt6K>A7cs zhJhM}YWPyaAPs{xe4$|ojsD#8D9w4UoFhlxw0aALN);VvPp5Q>cMj7qT*C+rBgv~Z zo(xGi+}c^~N%|;_{zvBA^4wFhx?{A4$9dCcJogZe)i932Mn?f1<26hm|216D@U@1C z8h+HULBls1CTUopVWEb}6eJp^YnY*7s)lbhOw;fkl{KD&y1i5h_uh<@(^o zB^-b5nW%t|h|$URrX)|^)8&ZDqdV7>2gzJ~8<#GArBn^P(2 zns-xJq+zj!6&hA*SVA$cVVQ>I8h(9lul(44@43BcLHEsa&eFH+w1c!kt2C_EutviV zeBzFlPf?#+nP;trJTE+1!IWv2GS+EWuOTbL^^=-h#Nl|ah-0IMO&X49II3Z@hAkTQ zX!wQPqtMduvxaSKt-=dW#WE?HWZ!t-wOzw5T8hoW4h=gs>~lG5PE8}Eu{vzZ*i9j{ zDPzzJ&t7tsVoAe64Wq`V?Yfb?k36|%Kc2_2UjyNHFD&4bXa6`jQ4YxGVYX(m(5LRtXPk!lX|I%{1_HFyG1sr!Y{G-87K}$JskbB;JdnO%K z3fh;RNiRM5Q?08&km7BvQ0C(lNrR{%#MAsNzmrOdEB1JPYRYREeg%Z1lhz3oA zuEC)5IM3bfrG4p3&!9ACk0A-lR$+?AVbXECXkE7MQS#UDK*K`~GaIHfEuOGL6zZ%^ zencnzSND#Wp2sf|9$QJ(dR;T&GY!w_@}VPD#|sTFHQ04HbiC5=T0@+UcpaBtdLA}Q zRkJzXXn3o^rbB({8Twl?mDE=r=os#DXV+0b!;ww5d?@kCT8&EwZ7n9b1RYKtE**(F zY^Re+-s?hgf{rSwwtdYUPxc9^qL8E`S;uWd*tzFLMXl)78bmY*HTSp!pId!D# z$fYBLhgiK&Xv?E~`oul(>fqlAu< zI!e(H#a%zW^4ySxVHI4D!g>CB<@q4RQJRzsyUH-q9LwvdprbNPQ%B^Lr=pIZ2Bp=0 z?Qy>LRH6lW?V&6C`3~-KrCe?3vZAA^j@4V-AKtVR*3eN?M^SjQ(i+UaPo<3k-E>G(iL2a;!Z zW`E=9$m5cqi|HxKYipOOWW4c|c;op%$KLbEl#bCl#_0G;N48_hd)P_eP4~mft}|~uJw8gS^=`^| z9TO-ZbxhImwN4+iPZ&|h`HhZ=Is$JzRA^q4cun5C@ifYtHl-@RVDPP{Od;1a9pCAg zt7D#y={jcUn5|Y-UNCLGj_)akbu6aI zzV$57f$hSEx1NQpKk2PCZqA$bCA5a7og7|DzHt*B$^CCV7vFkT>R6>?n~v=iS~}L~ z*ra2#jvpvObZpSEQO7!p?a{e@q%D4wx?abjI!@!QhtSJcpI*6~lpe3dITzJ*ZPBrn zVpzw|I*ghQ+83dib*U;E5vt^OrrEsqlCB*(cIw!tW514FI(F;WqvIFqRWfB{HP@T$ zZu=DXwr6&FS>0ZWE}QpP9k-a-QmX5nR&geL+ z;~yQFI?n0%Q^zGrXgbd8_)EtHy6xBT#Oat~^L8%iUTX7xI6Tpp=eu6&+W} zNgaRdxJGladFfhnL&tRzR&-MNX=(CJYPET(&}#VJxNp;{KC*}3BcAU3cla#^r9Xe&CiY|lI5{f!{+|1Y<=e?)nK1GXxYz7|ac&OtgC378*bUfDa zoRU0^e%n5$x4ZJ=geN+l>Uc&L+>Ts#69{Q&znbTR6~dCc_VaPx*E-(NNi+~|VE^{y zw`AvJa;`TCn`%031_;T$CC}|*oYxuey%|W(ZoqCJ(Lj;`hXKKW(?EiO&XcTYiN7uk znV7ppyw_!*N4)o0e&_md3dxfVxDDhqkZvHwK&pWp2AXaY(hTcr@@E5QGr{%jg=L}A zR$ITKu3QE(46Kd!QpOvT=ze+GIVRp(XO97|fw~6j8OUoOpMi1)${TpcKz;+o4U{lY zz(7F*?-?j;ppZdt8uu<)o=lgdv+>?{4G`w6@0gV2C}P0ob{?+mDr%sZfq&w?PvX6C z9jyECk_Ji{C~cq&xeae=cn8C~6kZC{vId4ca$hg(+6K#?3I-|~sA`~^fl3A{8>nL7 zeS@Cp+FNb4zT$ln-ql0WZs&K={XbQ!8>nHRmVw&jYO=GYfjtffU2t}7ao>XX)zY+# zY~DHs)--mM$!6KFZ=ivJ4-NWGG#VOcWT2&iRt6dyXhI8UpqYUYuacMlk=iz!_p5B) z^`p|-7Ic1}&D-3-p<>P!jCUN4)&|-bXm8*Ha^OfxTLYQdyxFsR+Zp&NoA)e_l{=fW zgvZ%|jJFgz8kn;-jY`$*-j5A@VxXIW?gl#1MjPm2;8R-d63&jZY=FRX==CaMWxhU1}@J}UN|I$kZzj`WTf;n z(BHtX2KE^kU|^tuMFtid7-V3ufr$pbG4KT~zJW0YzA`Y>z?TL_85nKgV0P~?S_cES zsyX)!v<)|~BA;_WJ}Y!b(yTv7C9>su#*Uwb3)#K&$JbZ`;|z>9Fu}l?S1EV1dt2PI zZ|Lv7k;9o`_tGEBUmG~*bhv!BNd_hxm}y{^fhh*28klZi1_}2G-;x`4YmUV%+SYTi-ugrV{$GPJ?u2xl26fONaNQW?k7Um33`4u*JYm1G@}t zrEMa!2DVYKy-NPx;ia@gSM%*OYe~=@-W(6zJII>DOXZBiyPE=-j+lYHloJFm{fp#C z4aa;f4;|Qof_Fz&LOa2`-@pL_e;aiBhl3Q52L3c~-oRl4M<}Zs^z~;PHE@iU#lQ&z zJq7RaTXt89EIMh8!dQe2;S2M{-Co=+hpKTW5?-Nt}_O5 zWjNGVIkZOcS9fHr61*E0r=AeJe;K%7;HrUZ1}+-7M1g1E3Z)L8a6|Aut>Jhsc%M8^ z=zPVs;#yp{PuZ-`N1eCYI&M5O?};i{3~O}LU0ri|Cf zK{pJ9x&gz0X&}o$?=dN~WgXkQQymU1V*fkcdDp-_1M`2%xNji5S$M#lZrJ)Ic&Yl> zz!L*+DY=<=YT%iHR|Z}i*nVAjPKSuD_=A&Q7gLLSGe@@bb6ygdvdy9v7qx+}=(@;Xc_d%sQao?Vba&uX%0 zA|_lWelqd1i9{1gCO$RM)kLxhw~0z7Dw{|#k!s>y6YrTwGm*nYUK9CD+b%fYF_GUyK@){c zgbrH50wy{v5w0or!1B1!F6%7Zx+2gY>4i-cF;Ut?8JdNOVkSzOC}rZCOnXCr0_hYt zQNo0FOQ1r%wz#~@^@RO51e#-66Xi@)Fj3J&fmG*3mp3`lTb{ZnddDStFD6=tE526R zowaFIOuTQRg^89Xs+y=~qJfEqCaTj!Ow=?{%Y>5XZG9v;KFPajZ*pxDBOLC!ChD0e zoaC)zVnK5^ky=UK`eY=@+x{Ilae4^Q$V6ik%}g{m(dJafgd}gz140uMO?fXGO}DPL zC4P6WPV!ECD4ZJYZe^miiH}TtO!_9;nrLUDJ+0E@)NAX6nbn-*$~v<(b9`W;OI24# znu{l`1Do2N2m_%wOzA`bE;@QO4CdTnZK1ufWTb%a((}eM~N6B6y zGn2i|9taanJh&o!VgUXM|-YF)gn)sINo1ni9uP1vacXf|lpAi_B{2i@Za|b=; zm~J8~*$OtoSte$iSZQLFi8&_bnpk9Fv59#m=9^e(;*UYL?@fGo+dko3^1L+10t%0E zar8imy3Z|`HvWbE*x$A#CYGC6Vd7rR^ra@2vCj!^YY0yn*T|yjuKdmc+uf^8tTC~H zPK1dcOsqAr&cu3?9$VRul}vX>>~-DVkKEoLx%)D=cd*+_M{JXc%_g>(*vj(k4V@eN zx%(P+`YST;33sOn$?y9Twwd$;TXn%HMzKOM0OX_H5|54pX|E4tpKI;K8Lxa9U8Gwp{=95!*p#8EmUZxeL4cf=8Fjx#z2dOC~OxkW9!Xu9&!L z;J3n$OZ6^Hb%-W{l>Igffr73!sosWv)@baQqH=Wxl3VS;yy*Dl_A}aQoSi@)_jk@PA#40 zeMmcA+2z_QRPSbcLdoBRHw$^Q@XW+>`eQ1Ke&Y-;OuVG5o`q~#cxB?XiMTApXQ6JI z_YGy0T8_6AnYCQXSE;rv3}@qn!k6w(YP#3166U9QvuDAc1xFTyEbF=4<}~kYRp`;e zJ>y2ku{7`EQ7M=1q`0z>n1vi!$eD$tEF@>aorRPvP+XC>zE{aN3Z+*~5hHIlOtY(DzPq;n#Lg7JYC!ZbS}m z*2QT z!Z`10^u+D1(MuKP7y#j{W%3%(rQr#ZYSIlbj_dP`@aOxFL=^cB!j98KHz z^1v$W?p?TCpm2A0cXxLS?k>SKAx1)g1b2cM*?tG-6pKP%nX% zC4+s-1%H*3>#PjaPoM#_J=J|}zEoud4j(dhlK(@ z63{Y%RtdaF;AH}>6KIpbssvUi&^Cc~35;iwS%L|4NT6>5{SxSyK&J${C(t8-&P-_n zT@&b*K($m_V1z0(2ye{i=U8i(R7$xJy;i{AGl5osdPV;-lh^; zaj1s>w&m-ezy}G8Okh+30}>d>5=>xd0?TKm<<3eRp&i6OhsOse@VD&hh9&uiF%PrS zG(?9dFoGqU(LcShTiD@`PGC#|V-pz1BxI! zTo{u%OjH8%5}2RBu1IiKRtkL-;iaNtwPV+_(gJ330v|DTUVQB11QhSC?b+Rl;-?9G z#-NzY1U^sTiv+$-U}*x2SrwVLqtlq2uh>S?Xo&}*V46E(%`|HBB*4+IY01Gm^&;A# z=r;*`o4^WIh6Gx!PbsGcQg8UWr_rB#-B9hQIccZ&A>~wD{}5l{+bAv(f$pzGol_{FJ~C2^>h^Fe_mKKPFIY zer#nnI+cwMvc<6$WuwX2TmnDNMn@C4mW_JX4QI$s#}aszjks|1@8<+gBycK$(`>WZ z$#@w$$#(SISNwVQ2H9PE>5-inlV1`ToXGU6S4W%1&n9p#ft##63H+YG`2_w-;7S4) z61bSap9x&%^G!8*8j`>Gtr>l%r0@o9`!D7u$hfhTV z^@Ce)WIn$uaNHkd4IG?4nQfz~wW4_NtyeR)JR5w^4~S;| z4LRs!4&sMGT2}uk)t6pC1_2obWD?*L;1>`O5ES^klkpolsO_})p$&0%upIae3E)Th zqZg5|;2MaWgCYW=0%8JE1cZo+k*g0!#85C-bn@F!fySv{r}t+OkSd^%fWiW@3P=-> zOF(W0B_O+i96T=Tr0Hu$G@a<-^1zK6F%nR(R5Yi67nxj{<`IxrKt2Ka1(e<#_nE%B zB~sti^XKj#T|!hq!0@}Ff&vZ_-6G<;h=8I3$_uC~S;jhrMA z`EUFFT;jeHl@U-oZ*WXb7x}UR$_Z%XwfSe4oK#UjB>`0gR2499RkSiQr;vYfPU1X) znG;<#SR4&*&Pmk-l)aNY;c=*@fLa0u2pGs<1=JDHPC$DBb(tsuO$0O*P+vd;9z{T7 z0o&>a8w&W7Aq)@BP79vv;;v8SYwG7kz(D3$GXc#7v=Y!-z%PcI!T3BUwcw|KCxQ&Q zT%2=f$k;{zzo8e+MH`04+j@U-ql18s0(uJQC7=_NFQA)%?gF|nGWAl=?1=C_=*GFI ztAH;;?)ya#0pn)IIfiz%b+Fs9;LZ6-y#@3U(4PSc*xw@9m+>r>nR~Xc;qS*p)$n)C zMLeOxfk3O8?%L%b0fPlh5-?f75CKC4j1lu*NDsFOjAt(DaW3U}E*d4k zE*?zIP1$}*87<($YW}CWXqWieA=W5!*xC|f#pscnM(3s}0;UT5 zl@QF~y97)VFjK%R0Tu5gSL+v;F5pIre}*^Q;@mEmD&2|f%}w9yzW0xOb6J!E<_lQB z%qbeYkek@vbL63e8*_{=8;orYyj&6cSimCIRS~&Gd?Mge0XGHwE#NZ&p9}b2zz@tf z0gDB!7qCIVmjb>L@U4Iq0+tB)TEKDv-v~I9*U4{fdzOe+~&C%B0dd<)kb1#A+qOTcacn+0qU zuwB3oCMQRHtAOc>?>lDB=%lk5(%s8L+XPs7h#NZv-1SB8PKZSE(wc3_T=odqD_|cB zS8%niN?sb1KiDxZWlR@dbJaIKFNyVo2L${m;8y{^v55&dB;aQOCj=Z8P(4e!V*-u~ zc(gg~h=7mZM~-^bEyzo}e#)r+Bp`ApH2oN^r^HSQI3?gTt1%OGFcNqjSeKWa>ZynF z(%*TB0|L=}bVk5g0e=X%B;cHY-vyi(aDiD@(e(ovtENIqp83v&d{KZtFCc5pchG3YTb?6rNs=EbjujE+F0H&<(GyQ!sE#z&`>E z0j7Z40`3TSCg3?Uin%S|A(JNHp1@}&z#zCXW-F3Lw7=zh$) z8cz2_z*7N9qvO{X$2R1n_pO3Q^ARV~yb$n`J-h%(z$*c-+4Bn!7$B3J2=JsOg(Hq{m}S%4xyV;TkUEJ$VbE)*z{pH5T@wjYxetr1OnlKMgIFlW(NY(DHlMMOk6 z?ED3!7m-24TLJHwMiCG(a7_F?V6MN|+`QA8mTg+-JSQCdV1 z5k*B56H#2mu>y3n0R1pC^1cAg_#l?GAeCS^*L@{D{L2+|;g=CnRzx`w<@sVk%JSUx z>b&yhdlHyekk)04)=^U`iKr~1wum|+s)(p6qK1f?BF=4z94SaVAE+jxI@47z*x_+1 z*Uz_Q%$7d++IwFu(M@n-fOVN~BI=81AmTA>xJm!Lc|#ME<~+Fj4MPn^2H_wbL=ie*Y1VJ zO^>w~(LqFK5nVhoFBPJWBIb^YJSs$;L~zacJb4f`3Q?>=Fk@lrE~1Bs{@htaPZ7OD z^cK;F{a%G&uEQxi?}nZWp}ySbyFj0u{!KRml?qco5v>Zla0ak~i5MbcsE9${a88-v z_G38)^Yy~Sg+JjvOhoz)(QGe#I}6ir5uX<(E`0AO5u-&c6|qdj7!hL`NfGmyA`#<7 zd?;d?hzTMlikKo|Ds!V`oR?SDR`pL3ak(%}W}Pog6`y72oP=)+_-ht%Bc;k5t=Vz0aGgCQxOYAygr%yk%*5) zJS;+ARrl*$7m6=pxlf69-Qq?LKV$q^KSg{k;tLUrMI`SI7*?Do(qD@B$}59@4f4;- zMcr|07bTvCjTd~JQ?XpcHzKx*_>Q$g#0nAXM64IFQp73|YecMN!4;*|BHAyDa)MvK zQ|@~4w?%1pQMy@_`lbXoh}bA%lZegCmcss%2xlqA6T-AD9!2~JZdHs*6m!SjCStpY zy(0FB*uk8#qlkkdI68Wy z82uok?nB=J5nQ;##bR_w#LHqNcFr6wPKUjVQ|m@Mca9ztaa=@38JT4KB;sdQBniDG zoDgx69fE{Z38zGy7V&~1i1B&0})ONjD~0sqvUX?^Wb%mW@P<>H)K!nfZ1tj$MMl39$h=igNiby|J>TX?SU>#T-cTbI6+Ox)SP1Xd|Jmg!&R1NN6gd znS_QC8cAp(;pd%6b4wGyVKrvt!|6CngkSFVmL^`SYA&ILgqBRKhr>M~`fF*I!zdJ7 z^Rc_8-&(@%!BMF+wUf|ZLKg{LC3KL`Q9>sPoms?X=)jz4p)ypf42^!|+4}DXHo{fz6kXB}`$#9m~5PYlVa-e+Btx-rB)>mwjAT zuzFnft@P?uUcK6@*Ld|>uU;o%y>~nJ_4p3Hw=d%F~oGsq+rS zCYC2|e>x~$-wAzL-j&6Vd~bQ$7KveNj>8g;Ncf5MR>Gs_fl-}fhbzR6N;oFrxF?`s zt01p?a?FGiV-^>Sva`BWo=!1Di?@J>RqjC3--7#2NS zk={#gQ0rbrN|N2IA#U7U8|%C|VB`%hY8uTT!zaTpBfxbfm(nMx(W-{~b`X>imXZ7} zR{pvYuQQsRS^fprTjjs-~w=&h0QLtnRH*!^` z1~M9Y9ZFSp;WzZ^CNi4J=pm!0jAk;L%V;m7gNzn3TFPiEqn(UpzeifhXyg9nYwbZ8 z?%m5k)>fv5#r-)N`wxwY?XOH7Wpt9!SwKP$lyBH*7jyOjTMYgKcd&-&>XHf0;7;%aj!|R0u zumhni&W2TfQBZM2bW!#Z*PsV@VmAf)fDcq|% z{mY`S9~+Sr=lVW#czxud*WrOzZ*JqhkG$FB&TpT{cq&7XAwBpXsUv!C; zQSf<-q}TNWWfgGAREs)P3s+E3Q9&gIl@)NVFHfb))}jY5LrrVZPoq+*C^+YxeNwsOlk10FEK*ieBl=)EG#kPflmI`_(=&7KUg4Qe`7Ar$m z&{jbQ1sxT%Q_!zvyz1WQ_}bLoBeqL=H)7B8C7#M&`8nf;+SElsR|VY^bmyVfaOH4# z@#etkf83XX6SXP#@<5N{!Cne_^X&=-DCnc0FN0+=6>!2>y`sT?lY;WY!27$t^~FNZ zYE$!nf&&!{QZQJ-5C!}o;Kc|Ylvf!l9FFqVq-z)5*uroHBNWUxvB1Pg1*2H9I`Zlm ztze9TGb+xi7^`3$i&#Yg72_35P;gVh-wL0Aib)FgEBIc)WCc?ce5&9x1yfn270gvI zPr)>WL*JOCV79^w`oZ*dsBj&c!6>Z{%w*-MLrH1={~q|-)S)?wn=-fNgzMqwD_Ef5 zBLyET*qp(?&|})ZIy9t?%kxDFe9fYd>QJ6o_!I9hzW7TW`dq;m++V>K1&bAY$%>?4 zg@UgXEK#r{vwyjQuN5q1wCmC`h4*7pfx6VRE{%Wc<0}m08y>VSt*=YR>e5ONvQU?T z^=OrX>vd_hS94>H*I4V->%4lsS8q_T(Q9n-YVOIg)2#}=Q?OUTJ_XwpY-hufL%Y~6 zwCE1z$`SeX(x4vwpx}Ul-&iyXpQ?(3 z3XUo`#%j<0VR72w+x6&_0(L1K>d}yT^oxRDJ@OCKqucdd&YV?nPQhOat|<7O)rq~mf=j&r zSAq6%gp=`jE%Kswi&Br$>buG0HR{u8&fHUQS#dX`z33R{`l^C!jG=-X3V+=)-o8Ff zuTM+s)A6e*`|Hz??CI{*r&|jCQIM=6or>Gc9QI2J6a{w`{HyR;taz^Ao`U}rJXG+A zC7UJ855)J0z zYe2jR{z}1X1q;0nT#M{c%ljqvz*hsCy^BX0(2u$ODpSo~omEJIuE0=WD{vH;>`QY7 z2j+}kYd~yh7WyDcWxi3NUtJA zMO;M&6+RVV6&Y3dRRmN7RfJUBsv7S2GSKSV!18f%p2Qx@l9j`f%^FfB6%iFt6*1L) zjL3R01(BCCpQDzd9cQ?acfotHwdO*bTa zxFIzz6f9>YU1~@N+Xi#0$fY8;iaaV7>AvBEqcw`h=ihc0%krwYTQZoZ5#_EJ%g23q zQ)(kBsG^XHaqKQs6jo70MPn6BR1{TFOhsiCRa6vLQ9?yo73EZvR5@V@rB#$+e9{NY zH6q@$!mf`K`@3z8^{)|Z-H6JosGy>vib^Wxbcl^@L_4d57c`<>jVSd&jG6pZqu$qK1l^Dr%`nYE1kFmt}3VWSYNd)!>S^eUBFSLIViQC~#^W<_IH zD{3^RPF`c%l|Zy~tf7i?p>&Nre!lDJZ>pl1iasj(s%WmFg^ErpA6|-aUIR7_N{M#WkclT=Jr@sWy;RZLMam8GL%u8I#; zOj9va#Vqgk=_>YIiNv18W_UkWHK7AdT!v@qAD_+I;tT%a{ha6hJ72{D)~kO551UYO zQ>t(>>f8@3WaVi}^_tQm6`!bBuHqXNpQ`vw#aE223f?jFIm@wLw#CfMru2nZ^AH;^ zB!9`QyXhj&JCY_grLR?d(Ug{|SjJpxN^BZjxbdxu6)IM#SgnFh@>L{wswu5x&J1uT zOWCve&*X_+Yf7ve>r|{)u~)@D6&qCEriAadl$v023y6`DSh)XuFCXDyP+94=YA9+Q~S)4Sm^+cCjFu5tqQ@(2K9)1;hw%e5?J&w_nBg zDvqo8NyQIrN6(WFsyL+LfQr27VyE=*k19vAGBz9*SybPDm|e$x-%%AuJWg(I<}&$M zGdiZ?y4U_$#R(OsRs5pjqzbbcwRz~P(wt6t{UgoY{>_@xudFsIW;CZ>VOI^#2;pJx zedkpC&LYH<%pn=Y*Y+0n3wbsrZMbsp1~{e{T50ci8an`!bYwefV7uPqv*M z^@8(8rfpvsJ)b?8rB3{Tiiav*sCcR3k&4GEo~U@r{;ICOaWOx?$FcOEsi=D;d^dL> zOD6ww75y4SZ#So5pM+kic&$QGA*)ERyJ$frTDW`=REX@6TF_8$htdCPMFp?R*lmNV zhsgpl%=t(LbCNx_2A>8?h0SKma5Ok7-l%x1;++Z(ebjG3y<5=O7R2YxF7$@DpVObL zA)N+jNUvc{3p&_>_#}tY>*Hfz2J9A;mM1I6)BG9&8Zv2!Xb5TuX$Wh`s3Ci?V5B9L zSR0MKNG;jYjW>2{Nuyd)R6|TdiiV%hq#ONB%EFek^j2VHONwha+LA_`aNqb+HDuM$ zP(vdPX&SO=D5Ie)!_<&NLjes1HIRm!8uDt$r*VpPB$tN&T2da(eU-@V)odnKOP5#q zTG4MtY-S{wUvp>s{J<@wp|FPH8lQ-Tq*H++8j5Os;CAYeUKvXVLX}!kF%4Yvz0F$@ z?}Ott#F83HX(+9se=8c_%8l;wzvVQP*HA-4O$`+^RMb#KLsf>>*R{%(4|($)+LjGh z_G&(#fiE6u=&z>XlU7t+bA1<=HLa+YhT0nHX{fK^c`M4$nu@okIvVO~ICnD2g}XJ- zusdIH`qcn$3TWTj9lf!JCK~!^=&PZrhGrVtYv`b%xrP=RT5D*d;l}gm*w(b5HMP{x z${X=bMt8DZ=$4Q3n%Zjkr)koL*3?b|*9TftM-82rOB#A>=&Yd&liY^7^SwI)T{U!L z95&^++M4($HyBP24Ly0FHZDF~xWPWH&f~D}SztsP>c{NTFigX69$Lcy4MQ{x_0X8x zh6ZX_(S`oGIJ>v)sBQ;FcFh#>C4Wl)T(=cAc7}m76 zzH-$t)@xKZvmC7D|EfTEf(L4%hDjRYZT}Ce;$DN#1}VNSTDL9bjQUw&rfHb2;iiVa zHO$a3Q^QUTyEM$wFk8bi4a+sm(J+^_OT!l$=4qI(VS$E)8g}f7c4|voz7DLe8~li| zYDrG-`)Ahn}YdJ zxFs6S-1Kpy#H+OPZRx!)e5Wmaqv2Z(8yOU{OT$XGL=9^-tYUL(N5$F^?~LenC9s+= zdZ`FJ^g0c^4mGJAt!J@nkaoI3QLg*6qsoJsN(|@T-Qs8un>8q~WlJ{Tja4@S}!BAff#^*FU^DW8lqbj5SH)fQEKQ&y|aF#)7_?_K8D_eVa+_49e zm$s)1p3-uT+$FwI!yg(7-3(;(%BlAB(g#&~*)Z z``CLi^nJ154G*!~)g!q(&@HwX4R18O)o@$m7bPS#2paBc_*cVY4No-OV@Je%(C~n- zD}iPms9y&ctB0(^kE46ihxfg4A6t)D@eT%Nb)csjp0U+yc)|A7D!!xx<*T0h#f11v z4X+q@2g=lu&Ug@BYvA(z!7O~c$YNzAH5eLX4T=U;gQoF^IieLi5(me)Pm_-Hb->?0 zDaIcNFxmNQu-WZv_@P*|^1p$e9VuIqzhtg>wz{r+nctD#X?V|WTt`$#l8$5@J{^7? z>2yFxdL0>btm){|QnO}Mf0lZ+hQB~Gg~OXiI#NJKP)9}`nRI;cYb2zD0|=?RQ^Nd{ zz33xX11sDMRhkm{gCUHH#B`+S$gU#?_tcSDN2-pjI*JwWXVKBUZSeB@P^Ax&SYBy5 z)@{r&c4ItO!{9x}SqIk)jdbMHkxNHz-CaUW7m9s*A$dgw6h0EE^H0p~NW9xOpN{-G zIveO>pn#5oI*#l3Nk<_ag>{V4F;+(r9YuAt*3pJX*HK(YEgiLWl+aO9M@1c#bd=Ij zT1R;u6?Bx*QC5dBBJfrD_@xir*du3Cmt$l)5jPHgmyv@%`a|E`$AQW^s_3Y$qlS)$ zYok>eY$w`LGgeLKxk_}N7UjC84*hbP?|7u`f_SG+E?sqW)YZ{MM^hd3bkx_;Ku1Fz zUypG8Hm`kbEtgWIe(JDJ)JR97e6X>OMc3RHG_ITJXs)BBj#fIK4Ha#{^1AE$y%X*B zAm8ak3rEM+4z~`LS)bgpGxgEI9+H3Z+YKMa z(%*wHq_a!oKplg04A(J2$6y^pbPUxoOvn6mK@L$4E|hw?RGbeeIOoNJzAq6Usblkq zbfY-;;%F-gZ{9kX=I)-grL zR2?7cn5M&A8+~YnZ)>g@UhhoPb-daha6and(zQs(C(ITdU+VZ&$7eb|*YSmp(-*=y ze~7N>LcE2O4`|}761Jd&UFa(vOLQ#Lv0UeG#rp1cp|4pY>EofUv{XmcuEdSDUFr3K zl)hbwCpIf|tkkhh$95g7bgX8!Fq2uzI@an~uVVv~*_AkeX5|tmR>&d+CSqbWyY~^5?T;XVUI;!KC4&H0Yn_swo(v5!Bae^I)frx>VI!@_$s^b}RPscAhuIRX` z<5wNO={T?Bf{rsf&gwYF)}({aT)OixRHi#M>rR}s&x=Y^yVG$wa8bt}Ixgw>llfdT z{Dtfa>q2)I;m214ua*QZ>)3NU@)z50qbN77>A21whQ+~NMaNAYcXj;BcZ%0p z==g^kHluyjhKK4iw;4R!XV zJYtk;`?>IqYkJVMTH!rCh$E}db-d8=R>wOXFIg>hXzU+!yk<*hi)Q6yme%+4^2fH3 z5kZH@NcNy~J>79jd$po-pf9TG?(x4|>h>gq6<&v<;|;6X)j+VE-(pkkNjB?GPvWwq zO^9P+*$cUkj30Z_dv^W?d7tCN_DW zz353V8q&m_&m{MD8FD{4C7*%(28tUf!T#SsK?6k$6lJizsgQwwwvRg(HrzcXrF*+U zw!vyjF-GjNuS0LTP%zvlkW$h>DFdYqlrb=hFIM-ryO+}VmTyaMs!~3Dty=6@Zz^w~ zf`P^cni!~Pppt>Q2I?88Y@mvPss^eV_^UTP>rKghs8Am=YQ?JapnP4-Qo}$^1Dv|U zsYF~aC>gG8ppJp|eOwZ_EbADnZ=ivJh6WlL7|@4!xBh2+C~aqiXNl|n^zmtRE#8Hj z8fa#qwShJUnj2_gprwIUOpBG&c4D+lwQ!@CQR!Wjy(M$$Y#(ZCpdF85po4*Xedr@! zn9uR!X~T=EDRLj`Xdpvh%2qk06N|=cbT!b;z)J(K40Jcp!@w#7s}1xt(96IK12YZu zHqeK;WMH&`zRX?&gA5Ed(BHrZjJbh<%%8qA<59RnUm8@$e`9Fu}k?R-1k_ zBpx+4MtIK2$yfj5Vd;J}#lTbp9~zj(jOyp|mfwK-_M;j7Xu5%$wc@`-V*9cO`TWLN zthWX}Gw?af#lTzx9~t=Az&r!<4J01LU46HOD6?OSDIqc_Ma_4f!O7(Z23u_FlHE`a*1q160tT(XV z!1o3=7}#iFyMY}BHW}D#;5!4`3@u+1z#g{fd{MbVbV+~O+MhDCjqPPg%?!R>6*=0U_8H)sQToBa0RyKDoHp>I zfrAEqGVrs3Lk5aH2pr*V1`adf17cjb|1kp(Lb2maSN#;;U&C!~Joi8`yUbbf69)cl z8a(OM-2WE?zZy7a;CBPRvH3j7-t1BIl@dB*;4I_w0r9Q}-U7@G-Zagjdp@u+{|9u@ zz#j%~8@OZO5`!{u&A@d7m)Rr@TrqIf!0`*otZXcxS|3n{4~S!=13sWRAJ7d}3d--3RVeTt{La98=9Sl<>vSeyBBO~+CeoY8 zU?OB9Y@&ZPzt2R#1Sd85O;;_Sc(-sP=>6n*=KBG}TbQ#Cq)KIi5ff1pF%u~!N|lHY zD;TWueYDX)TG}_pxh10q($U$`EGAM-6f;rWL{<}NCUTj`Z6ceA>?X)WP80s@uKw&z z4dyWM(ZK)nlRT;DY`E`j%DRDMCWrHzC}4sc1-+UZg}g># zuih~|UB6oXqNbY-%S+59OqArdi3*IZiP9#@nkZ-D=s@~!AcY1|8Pi>A=S=c>t)k~r zWA!4zDubw^iApA_n5b%kzaHCa5LISO1`z|?Fvvx<`|Uu(zkSYwXblrJP4we`P1G_` z+e8}^ZB5iMQP)Hh6HQIjGg03}BNL5Hbbb?UxHj6rbl0F8nizK=a9|KEJP_cmH>~Xp znIDwROf+Y4m}qI@%piA%a_O5CiXO&C2>I(ZUIH<&tmjk_N5-Aw$oElYP3Yu<$O4R#03lr5TJYjQ6Wy-oBn z(bshIQewVv|3YC-a(-JQxJ!<7A55&wAD9?mV!Vk7CI*@qWMY(w(Iy6)7-C|miD4#I zip zFzpyj+`hak$3zp8Ow2Sf%fw_8Q%p=ZF~h`E6K@97G}fpgB zOdiTvF1{V!h+RCG2TJ%a%;8hrkf`sP-X0U5c-Qxv_};{iCJuU?b5{y)9ZElNyRrX( zcZC~24<-9z;+l!etjQ*>u&YTQJ^McT*O&3>!>D!>Huk+9m^o~J2@k#$gSC61S|Mb0QcKzu~vXE@K4KC>{ zz-uq`I`}O3Ercy(w9q1RFu>ZrJ@Cs23R(zRc-AtSwOJ-Ef3%F2DxZ>dQS?$3cd`_< z5VKIgLO}~D7UCAtEM&8g*+LczsTQ(YX!~=HTO;W82#SrQt&e@|V@r>uQ2uy!3pp(0 zv5?n7hmk}Uio&1E!t{}p)2kW&@{yF=!ugRd2ZZ|}-T}JgNFbku{FeKKdgom)WTCKy zQWi>ED8fK26ths=!ic>7BBSVO#ng>i{3R?5I}{i-iq_OhDe2u?Z^WtrmgJN`$kbU3)L-rWZ`2AH7wM$ z(3kJEP|HGX3#}})wou1HT?>sYG`3LBLVXJjEHt#h=ZQ6$6XgTDE{r036!DRCyk(VR zO-(E`W&T@e$)dTO*31HDXR(iJZh=oB&NQ01E;QOrd)Ss7ZZ(?PFncX@vC!2*I}7bC zbh6Od!lcpk(`f3zyiEyqw6N)Ilp_XQ-x*EWjPU!>ZaPFai;rJMZwq}a^kAYaaCl+X z?6mk8>SbZf7?(fXt~-W4A47Z=Ynce9E=}pr+_Ny=!UPKgEDW?T(!wYUgDecTFvP-8 z3meAJ`Th~!Z+^rBGK|R|%ZX~?;Vcvj|9KZVAEwAy8qEV)7;9mig|EFsV2+PS8Zp-0 zel=$-@iArJjirf94(o%385Sm6m}22W3)3v{dLoPX$;QA`3n#`BKS>7#Q`Xh+^T{(j z1D|POmW8<%=2@6+@oron9~l0AEWH>@b1ZPp)Nv^|j^$B@ zrg60AOk|mbn2H!<4dX^Y2)&0d|3vw--P@x+BYY`3t(!X68I znS}AQ(*j3smp_W`vas7Tf%RUJ=hgA~@M=kth;b-P^MOsuSTyO#%vv8cnJ%P9|4$PAt6X*mBZUU>W zYqKAD*MG6_tA#Tb&RY1*azDiL?UgX^7ufCndual7UJ>A=yK@$PXML_0lQ9s_{&21Q&B$5?F#Egp+Kqm@vD3#qyK+xjvevPi`V3seJAD4 zE#Kc3Zdtf(;f{q8F9QE~h>f@vnPU0AUy}UAyU<T*vtU>-Exfew%7SD;w(y$i zwIEm!**QerS*Lf&~3-U8w>9(B-to3k@x`E4itaOmh~v~&cf=n7&nq_cfs`atH98OktP#e z>7=)j!A5}3?6zIe_-yo?NPjGg`@Nr2Teu#cSCj9zkAFCkLQGWsSlFw7nn)2FQ5$(| zDa#~Etq{&-MgbcInNt4C20zWU zDe*!!emWW%If)9};F|ldp5(@p_f2yDEn%aijZ!vB+t@!Uo|xor2FzY2SbQ>#Efnh7 zCRlqim9tUaMkgDcZB(#P(MDq%O>9)MQQ1Zv8+C0|u~F4V4I4Fi=oNv!lZiJLy13Wt*{E;h*rVh|%=4$&S4}29oU?(AhX13zmMh{} zPr^qhQ&StwY_ze_)<$z1Eo`*3(aOfN$@FG2MW@iQ-0^+6g2ks$Ya2a2PWifytCsC- zw71d0Mn@ZsrqHeHf%#MD$BaoA*GKrV_3ae8IEA{{=xSq-jlnj$+30SgkBzU{F*e597-r+ZouuJ5M%Zp<0{=VG2A{V2b=0MIl#S6Iw3DR+XFrWF z*l{+-+nCJUWB0NZ@MOH{P&u(}rQgwDGr%TkNaZpltkO zZ9HPnZ{rDD zO*}a7W$1Z|f1?zr>iv66@O7L)&uzT0A=!{^ytMJkhG0Xq@!CV_vl+z6W>xp6By0@# z?qaa#|8qBt@GMucq1w=F=&Tz(vT_0*=gf1W+J+eSdT4#cBTF5IWXMc1cA9B?*x)NvmlBWJpti95*b zAk9HG2U#4XI>^d{?snb6(wVelCe_X9zciEX&!p^(o`XCN@;ZpjB65(+LE~AJ(}Tv& z+=V%daywW!i@3pIgzM$P>t|6uMoe<^w+lKbcF!whl@&MqUZma`1ckl-fK>G@3LrjkghX zp6&Lp=b*lWW)7M=XyBlsgGNlRgHf~TZHeHj*~F`9P57@efs3=LQ$v4Kj}JWb_p_;m zgO(0jIcV)*Zt-BI!S3|(=+nTH*>vQa*c%UiJ7xvn;$VP-4h}jx=;5HJ1CFhAVu~De zb-+`I&JKonXVveCS|0OUFaL-CyA=#e&luKCsu-%$c4jS!YTNk6xeaqA`bA=U|?L z`OKmZqpc=H)6Juj^JoFfVjh)g9QnurAF{g8tNFaUk3F!R=ehTO>fkd6%N#6s@VSF8 z9DMCyse{E#={&l(H2Rf;FBvhfGuQj((Gmw|_D7G@^j~V`=N%cn*Tnc3A`WwX|l#`@8dCUCd@VmmFLr>`Lt?2ZD&g~lAF(Wso3Q*9D7(LSYCHS`{uiG^;#m{ zkBqNMA3W)!ef)3Ozn_WvB*cva4t{iS)WI{fS1eWJgshnx%d z$9&?wTE`vy6r?|VjyWPn5CjI{B$+OR%WMy_No88$N*^tecCbErq z%a%>qvN>C}aHX!bdbyx8u(j%VvOwNZ`L+*8a`*q{$n<%ejJe(P?b)(}IBcyZHcc(~ zI(fOZ+MO+XvgKH|9H$PKU)q^pR`e>+NfG>RM9f2gV}P3Ttr=Q!#bQTynbn; zYF5s8yN$ZsDo2$wsiQHfnHhIY-`-C@ku4`FdbMp*lNSSCoXM86)DqcpH(SnS%Xuov zY`LB-7qaCdRcN+c&6Z1S#Ik7{!%w8kaf3tJMA+cemkuk~$mE00jcmD@Ew{4eHl<)+ zYHO$bEKsC++VT@g;*)tgOT0(rpDns4h9@4Cf3^hK62=;g3mPR#rZIR5OU`JclDizu z6NYnI_F$%X0#8g&EKj(TxT%dASS_7~E6pb--%=^tljCiac|0lIR@H8+UT>=y17+*61edl5 zHa(2x_oRR)Sswl4%QtORyS8d_TeYUG%4nx(_W$Ayi&L*co)q?^geN6Ex!;o-`HcrW zDdtHLPq<%Jw^v3{Ponfhs$*`ucsuo=CpFut;$HM7N_V2k!$Y2w@}#UM4|_sS*QGt- zX3%Q|)0#XbW!Ti6d_2Td&J&)@das?z+MTaQ(dfNa(UV6!sl&!SdDN4~JgMeMbx$5A z>O9ddNL5c-*LC~NOg-sIB~L07?f2O)!>+=<{+HftQj+-=?UesOs&Lx6+)g>|)l;54?aA|=)c2&GC(n5DtS8TTLLMmHUUe;(d3#6( z-N160x^{c@@{8^Zp1hi6yy(eG@n9Lw>1F2cOO3CRdcVDTCBFIUt?2Ffx+iaVa@~^~ z9(Nq%El(zUGR2d(J$c8IKRo%d`(n%($JG8o_y*_BTwFEQ=WY6$p@su zlkSI}@FQ-`p*(-JS0BZ_(EAE|p=EMof?YVj_D7CS;`?9a%;3K8XP$iSNmEandD5@F z()Q+ARNm#ZidDYwdE@owN{?|7MDCA%~>3Cv80G;7LbM?&UVxdeY95_Hp?g9TX1}?QWcTzJtnF zC#{nwojvL1Nq0}W#03g+`dURkeG1vUs3Fj~3io>f=dY zPlkIkg4pn+zsGZhGAyq3PDeGslYyQLivJGwWC#b+F~Z5fIQ=g(y`%bMv$Je~!|j-n zo{aKjf+rI_InYs!_GC;aHIAt#V<~{0)FYkLN1arwPHMa-D>|t?ofOl1V)rkVG0BS@ z2C~g#XSJ!GO!H)iCp$fv?#T=m_GG0eGd-EbVuat5*`EC4$pTLnl1t~hb3B>n31d=R z?WE?CJ7urK!jvE2yFA%VwMNGCWRE9%Jvl^v z_GF(Y`-wwO4tny!7n!PyqM7UNqX|0Vp7m8mrTg3lqcV?pa@3P!UgT}Kd>8c!vWQ9c z_)!=2TNicGlT)5t^yCsD@#Ksr7h>SgdNQ|*sxdR`LKk(;lk=YJ>Jq`piy68Z&)-#D z_T&mRuqW3@{j+Hsdqlc=%aCYtdvkvzT!rUm-Sp&^C$ISOsxP-axfAIzDelW%vMY73 zFB!gMQww?G_zY7ez9)evA(fRM&0}+3$aubMv=YMBbYI|$>5Jiu`0{#JMY9=R%vgS; zIeB8;_T{&(sz+DF{FtsP;Y*q?NncXFEbgi}f!xzosR zt4@;3m;AmI@Flk|d3?$1OFlxYz2yX_TQ`;Ei}Iz>5&ixc zfP!&a*q8f!DdfxeZfapSwY8g~1?F>I^7-9V5nqb3N_X{uFEzTWVsV}@H0Z8=?5;}q zQqq@NzSQ>RAzw=Q@~AJ5`BK`KGQO1ar95w5Pb*98wN9+-t{#rN>(M=;O9fx{cUO=2 zk{GEuJybpY)|^4^`QhO1`wt&@Y_G@m3G@cMmo0 zNV1wQ3`#;)so_iYxc#BmBchY9Y7!MsMVwQ|m%6?@?@N7Op7P~sU!L{lIbTNfP*WGB z>iNR8vJqo4o{6i^?V+~zP*-}W)=hIhIoEl?mlu6`$(NUj-k$%Tqv+i4Mya$?Jr&<{ zwR)=8NL*k3@a0cm-tgs3Uq1EaGg85qw~1|E-uLAlU*3%}7eEHrNhK>8um#=*Jn*GKlzwzZ;Uz*2l9z5-+ zS2LL2?WxjxMPnRzJMly>ReNi`AAEVOm-;bIzv!h}_|npsUwrwM^cs}K4ePcnzcTro zFTcl4bxo#P#hHb1J7eSYFJJ!lrKc~wNIqZM_|nOj&c3wurJXPBed*xK&R(j{sWh%a z*BqYJ(U&f}qT|eGd#T$^ZM%Ze#h0$WboZr4+&DjEx>2}#M{d3f42@pCrFyH!QZB9C zdi&DHmw~Yb@!z6>Xa#NB;Xz#Zw!vbYxWH+JM3 z*D%SK$FZ(D9zRV(-2q#1F`tpx2bJ(LV z%YB*a%RFBe`m%^EtWTq@!hBz*6wW-{TP^T~DFMFTTP>#O^-<3T1(x`-lu|h@QbBq8 zL{C@vveK7TzO44;l|HKE-U3bgsN+)|o~~U(U}|UVJdyV4sOSx{-j{!U+3w2@UpDx% z(U;A>Y$4T(Msl=?BAFB#3WhNmt(#h zCkFbcJ$)2og0yLu;J5h`6Y@!4)!}x&Q@)(`<(x0)IjCIr8KSy++6#Tv*_d8M`bMLs zGc=|&=*>UazU0egUvBtvlk(!rRbQ_8a^07jmFHw&gS_SV?GigQ0MjNhX2 z_vH>1moK~fsylrZ&AL9Tndcs5vvoA5nu%Q5zIZ;5lcb8@OdY$CszfVaU$j6T2&7m* zH$Gwnk{(D#AQA`yaRW&NVg_ObVh7>`lDnUJw4dUVSKSgRUT^e^z;518r3I2Bkeq=e zgXlFevvrDYw7d3GqxvbD-R3))mI`ELTsSk3T!CZ-qS#s>c>>8BNWMU7SBqAb$SO<^ z_fz=;o^G)2>#xFoszBT(GX(>=FOY}R<^Dhl1#;|Ag6GaA7FSR9SA_#%%DQ(;rHTYn zG_FD_@XmvQ6c6O_K%NMsL?9&tDHlljKpqODR3K&9U?BDStA_nm=|Fz$ugdVwb8h$k zipD4W&`58Y;MAHCLn;JPF_1?Cc`RT!m?VvmcNcRX31n=G#NLL+r2dibms@5udw(*J zN`cf2q*fr61E~^7^+0L_Lbsg%9?+@=vb?`ythZ``9PY1p;F`0MLIYH_0qUaxs&*iC z0!CVtr-I1y3BNHf^v?WgfOj4)_863QTK2UKLohLiqt7X4Q!9U_u zS(@=yAa4g!kdNZo$h>tq8wB!RAPospAe+w>cshP`A*Ws8YV!R+`o(`g2&BnC#Ve{6 z$j5miL743+s7LEva zY@qrokgo%29>{lbEt)2N6G$*neH#d``vygQ(eUi`L8{dt^?e{(sR;i+1@dzsJp<_# zNQ*#P2GTl^Hi7&S$ghF?8OUFO?4O?;I!OH%$nSxiV0AvqWB(EN68-I*$-fLh@JPD`IO?bgH1lRe@#8x4-&?;S{=Kn9VZf%GLZ1L+^g00K5R^7uC_E_3@( za?xNlFpwfcqAG=d$s7{M&_G56GLkeMqFN47M}JKp7Rd0p<*Z84h_$je%?mWLzNQ16dTv;y@+@GLf7R$gDsn1u~i1K9K3u|KxTa9$cB6KSWIpq;#_k zt_L!GG{c=izKwlm?v8<(9mqd{%nM|GAaeqlOO`vs<@8h-KW%g_f@A@^OSkE!j9(TD z31P~n>sO{r0$Cc!>Oj^6vW#*;EfL777_01h1zF zJk0YX@*OIu;fhPmcd6NiNB8fM@rJAKhO0iql}`yG(LG&C{8G8q2vg~4Q17Eyk(nHA=O72kJ8lf^mnOGvN^9Yq0%FiPdFTyrqgqmLQkrk*e9qsKFv( zWNchCPU*@2!BDv0T|A_BN{gPmxWzUkF7{9;r9!D5N{vuT6ZlXb3+3@p%7*fAC>27f z7)rTNR*Y1;;_}=XFCWs+a5U?9B$V?bRl!k;_Lh%^Q9N9XQcRx+<;hSgg;F_`1M@S= zj#AH#QcsmkXGoVS#4~k%DDRI_RYUoElwzhp7|o??hEgk(=R$@?lG>rv3FWC!o(>~1 zsT)SV zP`(?j{%V!6WL(l}A8oQs7_A5fGaE;%*F$+DlwU&mHDm-^c`KC9i0V+@4&|LtJ_zN* zP~HutK`8Hq(lC@+c19(hF)V4H8?DL@cHa0Z)rhke`5o^l$GQJ)eghb?BBh75@---YshC|`u~Whh^V z@=YiUUQ2xy3LEJ;MztKHn&-Bsk5LR^_H8K5Ls?nP=vmQu>0s3I525@R%1`90F!IP$ zx@e|ze@4Mr8@GtDK^|xs3a{;BB6R&0%I~4{38il+tw_O8+J8 ze~eVYH*u{Vp|m(rpcf@#x79NgUY+9mEYLfY8DrJ@v8rDv{X-cM%E(X#gfcLcL7@yL zs>i8{}xa#$!ACM9XTGdz^y#iE5@ZjbWsv5&P;p^Oe?4Ab#W z^KoiyC}Zuc@u7?#r^dyw^%xh8g|Dp%VPxSV&c|l-Z&D6Uw|$=Cjy1HKknIpzg^zq0FTKPRP12PURl2)~-&LyOU@- zUOoJH+M-Yv$6YTap2w?UnRRA>{_$qDLkC`?%l8XtvMmjd5DuiHaYR7ecuh%B4^)$0I#AGo#`}MW;G1OjK9Ms}rO4KaJDt zq1*_ih=!sXZiaG;+E_zE!)+>rP&5s?hP$EMi`((T$aF26XlFa?)5cF!UVNV!25<~W z%@Ix*r-!d54Gp5f*5GL1c?7O|@0_Th!PH=BxDfYFFq}ydFhi!LicN}q+N5d7p&^%s z+!}IfNNUK?kf|X>s50#9p0%raGF?OSxE9lEJJUK(QuJ$@Y>>%d$9XhdYo^_=A+Lrn zk0Wobv6!V$&z7V5swehGH5jXsD>+K@G(< zl-5v2LkSHfH9VxD6rqjXhjJ7Qmq3*`Z%F3u9oCLXs;q{GHI&m(UIUjO&rDL{X{fA$T`uNZ%B{wtm zH2gkAO`oC;<+XcEQO{^#`fQxC<@y?4(9l&!Hytl(c!|8B;g*J%HN2u>kcPn;UL~$H zw9wE}!|NK}(9l#vGYxNQcuT{F8a~qSwuW~!G|=!KktX>MOi|6pXS_=^-b_{7rZ?2k zNW+47!SMZfbRQ7lT=vx|(dZtU8m0f!@Ue!*8a~lL2lbrvHk*=;b(%q-6}UN0^{RpiXSPzOj9GKsdM$+Uo`xxp$k!@;WuJZLwgM!G_=z2 zhlam2{H^sW2P8%L(8)*9LplO3Gv2NG>G&^YJVlw`XY;5%_g9W`{) z(3!n+&XC7$I6dlpah$&1JF}aH?i%`N=u1jz=&7NXhTa->O;-#W%XI*bCF_OMh3V@1 zUYR*&&{P%uH4M-&P{Z}&X$5yDbCkD<*o75bnpCl6hUXYU=G3rS!x|04Gz`};MZ;7L zBQ%WEFiyjG4Wl%S)-XoHSPc_*S`XBUrsBgYyT$gUm28x^_xG!9wA;)ta&L&HoB^T_}jW@(tMVXlUPg)-^h_8$#% zVw|uF|Nc26Lc%=qq^A>;Buam_OpeNDZ-^f)iVIJfp_WqTv`a42uv`NTiJ4zP?=G|t<TGu2v>NyB~(2Q;kL@UMpL8g^*dKz`7$Rl_z7&mOWiY2e=9 zmbjPAuU_M8S<BA@{n58}ZPXZ#+wNjGx}taEBU6$KyKgYPd(z=(tZuwg!(XT1QSDK6MWDxeiN5 zNSJl#It(3qpGyszrJCl=T+R09X3W-A(jJl!^WBPVsFbmZ4TBBtxe(2-k5p19Kpd(91z1iyMjdT^a)^N7U{YoaAEu^D_j*>bG>$qP>5gkQ! zJgB31T&($Q#UK<9=qMIneMUw?J$<%fK(Vc}qjR+n=_sY6oR0E3O6w@2qpXgHb+nDw z5Egxracs64nLqX5KdRJ2cBOw*1syyrSy9I$IvQ0-d+i_9;vd!TAN8mXp0Pb&CDQOu z=y;M(b-b^ml8(wc>g#wxM-?4ab=1}Il#XgTs_Uqsqo$7a|EOF4D0`0L@Qck+wc_E| z)liyn(WBJV zm)xy$)QdV^(($^EH*~zL;}spR>Ud4ZkvZzloXD~??_9+I?oCcQY~=B~i8pn;75DzG zj<@3sEhR=)%kvI#GB@glX#*Ya>G)=@YN(?}e3SPXmg@r@AL{r)$B#NbVqG0gbu`oQ zv5v+%KGD%c$K<)ucgOO%k=y+JbJeHB#=J<=ex~Dd9rxy{T=Sx<^gQ*2jxX7Zj&F7J z)YIv}=PMmw>!@8clFjzVtZ(-kP3EaT=BYtvo#r~e)A4-_aIbla7Y_#hq~m8Df9m*4 zM++iTM=KqFkV&pszv%dtz|2!o{8oMi==eRZn>{ZYW5#^N!-;fxy0%m#xqs_uOd=^+3qkyZuNZrb??N`1 zA2r^cNYnAOfqDkVg$sw$w~jtKR+Ec#^wrT%$0S0iqrZ*;I!5RisbipyK{|%% z7_MW}#Ax0)I0k!&j-jOQ{Ak~w7w6oTtx{ldwglt?jwP3!Qp<||w zUGvqg`D#|ou4P|#xyCg|2d6jM5NE!QxjN>NvTvs6U7)HiP_Hgf3u2f*SrB1kv5qA= zR_a(qG0bug)Jb2eW0{WSaT(f3tkCgWT$1_43)G=FkA+dtjkP+~QD5oUM+wsLuZ}G` zwo-}ZGB%LzSM*IfHpcDb-)?={OxsM&vrzG<7yI3&W4n$WIy!FDpIoSVw9QXwd4DH| zqa$yA*{x$wTz6~`aR{g7<%Ze&bsW%fTE`h32X!3Maa_j<&axJ&!#e(6sE$&y{u|xG zXmrCCs$(3^LdDEUs==eFZ4bL;mS>%c%Y0cb!t+@j=cr(HT+;E?W#_z(!wXfO5{U~s zc=6O5ePA+h3`?F*v!`}Rze<%$Wp1F5f$KVMP!$_+4cydmi#ptZVc@ooJJj$x0_uMv zp99aCD!xc%>+q=UW7t})br_eK7c*=;q^5d4Rb!FTj7W{s>n2k%00Wi*+d#ub$~5rH zBJMoWz&QFwJF!S57OSThN3bOfq#4L-AfJI8267t6Wgxc!`eIGSX}W>Ni&ZLaoS6&* znFd8B%0H6%=n}>EZ~3&;i%Zn|BO^nR5(Y{d zc*p?dl>Wzft+~%FW1uX{vqu9D8{lk{fl&xvxwv1NG|-a#te<+?a2da&Vtn&|OVncq z9yd_kKn(*=7(n*Shhq}i&Fwq(?Bf) zwGGrUaA1j|Cjo}!tC8t4^F_nFbq(-n+fxR(A!RI$J_nvL@T`Ge26`KK&cO2qni=@Q zKz#!*7n~N`E>$$op1m|8F&C~I7VF1!!hP=UB)@JxHo%k?TuqoU@R@Mu)LM zn;M`w&ARhCuP+UJW#BIZe;fGPz&8e3k_iobYoNJ-pUFZ7zBBNBOohG6)DP^=z)uDk zyas0z1D2`f%hZ)K3I1jKBikfzFH_UcCaD;IjjQ}&;7ZH*T6jTq=EhhMjIGo zV1R*v28J3KW?+zk!3It|WenlpzK$~`AKe4?S*~_2SC_V@h8q}RV5EUj298ZkPu+~- z*v>DRhp*lD%jExRpLKJ&8cR40Of@jgz<6%{8kk7Vr1-2*^;f7bS43h`|8`Nh);it53{AoW&>LdY$KIdsx2hSuGEB; zs&`zHg|{2nX+T@0cEpWujPI*eYFGT1nY{+~88~F%FnOb4X7t6H%id23HE@s^TctSO z`m0pKRVq0>@^05MJ?*!TQ^yP(C&QR%YvP1~lLjgRj{v6(oTkju1VC`cz*!2rpswJY zf%8;%f-J!W0~e`s1rDRNQ|b-eHE_?s6$4idT%+12T|Q1{EcNEA6w!Wzm zSoE!z5)9#2KwQ1a>ImRmg4}{Ug1iETH02#$YfdJbKJG3|xx?$a`2_jnt8-jl2?`3z z3LX~RCnzL%P*7Y@Sa83fh@dE2JC;5_E}WKbKOo?qX6jh9bxU8D#p14ytX3riB?S)& zN(tzhyv+rR4qfTljJ;1Ro&LbARB1-YIhIjI@Yuxyyjf0AUQkI;Sx`YxQSgM|Nsh65 z>JgS9Bx}^80$wZ}u2zo=7$&Ax3!CYj3rT+JGWIv!7*-Kf71R*a6jT#5-I?NPCVur- zk1JMK6XB%Z8dXd1dF8a9*C@uOsU3~f{dkRfO7JwR2$~7%37!$WC3u_Rng!1ZUJ|@a zs17Bb7rY>Nk^43esQMhm7>8fnJbW=KS2{O?x~@^L2wr8ZMZxQW5o;9VdT(8$>J3i5 zA=oIXd~xLH>^165vf^6B%sYa21s@1L6f_XLCm^EUCpOlq*Vd|rg4JHKkzm=&_BU%I z_<40*t3Kk01fL1`a`{*=YOQKQoCJx+f=>hs)~da0qp+vUd@87)HzQc99$cqB7tGsk zeOJsTzkMP2QqW592P+D`7PJtw6nrE2R`8?XCyCbazFeo83pRg}PB)3)3BHdpNq>ny z2)MV%%+G?J>!J{BZ*Iuompi9YzX*O6{3iHaK;r?*?ATEb?=vN|%#6F9_*3wgpp&4p z;BP@|L3=?5!GL@DzQ}aj2-*_!gYLwsO-Q#pl2{(6Is>yoQX1(gWUiA_56`ZDW5cCuD7c3X7V84Qaf+>Qj zlu8awFh($z0wowq^a@4`CaqV)NK?jl4Kr4(SHoFxeFRLcGR{Z=)8p$^|Me+`E#t~h z_s8vVg7K^+m@Jqe*swA6z`yG0f7L|lhkq3>hB{^SkN=H6OMCyTrU|AC=97Ga8G@OD zxuh3KUomr*;2!}4%FK@Ozkqca|0T{dbMjx6e}ig$Hc7WdpXW_26f6=fWkq6-+_*t8 z3Tl@P>W2+#NnC}Q!ejFBlx`EGXkEEdu!{PD?UUIAYY1w@t5_>oCs;4|SMcfP)aVWB z#0Hhvs0wdXH8w^794wx;iM&A>7i<@7Vf9N6CvW-gCh2EmE2U$oeXw+{#v>w1-R+S{ z!>wI{-GW1c!-746y@GutlYpyvEJJ@jN9bVTVdnr@$j#tnhJI5Il27P8HDwV7r>F|<C&-Qr`6KQ0{w7tvf!$)0nl;ARwLbZG)jSL`8wxbQ1{^?-ru+~@zlX*|ljOfE zL^e4C<2FrjkhAjUM z$eC&H#wjxmfcN5j!~eU}2zdYh@*e;n#(D0=u<-X!rD}X9rMIfOTh%8(6W|-*+Zccb zTh-rN)u+H`K%N--#p&1Vy^qdE{kN(KTcc?+A^aZr0r(5} z8~73UiSz}21AYct04;%E0Pb)N+?9TEYec(STUGvTis$z$Z&SYmtpI*<{z)+`mU?qr zRNxO{a(nVvl{~GssqWiUYoHC#8R!DE1=h^Y5Il$Y&Mrav%% z)C5)l1A#%nWMB#~7#ISK2F3tGfnmT1U?gexb)xAD(WminR=F1)q2+nEQNT0X)w|mj zQyPbi1;zp6fe8Qu6}8{4hHY1?;_i-YR}%qx5|{*JZ&%$4*$jw06_^Ih0pMT z;2+YWsLc%^s==9LE!UnEr|g<%>JMH^aAoPsf0FYkJM0Bm3@nI;|MZUNxWqyV=8kB9 zOlcPT(GInQcP=_hDRcns;#%xbeRinnJJd>G6|e)?39JUz02_f#z*=A(`5D+ifO&I= zQahstsUj#r9dBoGu0HEfo*FyVW?&0&)J)q-n0G1$onf&rcPhq7+(w1Q)-EPE3Z}b& z-M~TM5U>Z>3+x9D0Q+Ldhdl0bTe_kI6+9B$}@AP zItm;ER_=@pp8sqABsFC9OzvLMT`)Zs(hK4l;4H=8L`@UtsQk%$CQ>FY02ir*O^At0 zz-4kKa2L1&T%||?x2c-S=eY)42X4gh6Zo6dvE^*`#XL``Gyjf?!i&%sJ-=S>k(xjV zXeJi9>92Lp?*TqgZnMqR`-3}G5D(DUr8aj;&$mnICTLMyZdZg)m@rMGnP8}5%Y(sT(%1(_Wbu^WOV4D|Ig)E45#OW{KJA%vn8<0O_AX_gch+aw=g$>LH<4kYl!?+N zGEL-SJ0=R5$ZaAI@24C2P2@FExK;A=UFws}NT~D04K~=N3Yf?;BT6X~1x>WxrT!z? zk9+blU)aR`CLT0V+(Z#GqGoR+{{tq9nlPSnd9kTtaZ>~05tT4e(!>WjqwiT>&y3W{ z56S(I38n=ePcLJltcl7ds+f4#L^%_Wns|&)P0+U+y?IwOQ6X;a$epZxXOoYZ;59F9 z`SJMvlP1pWQe3)!!UUH?sevoS_nVfBdZdraswS$Ls7?~^R?9|33cU3?hf!n7>{hji zG!{1Tv57h+>Y8}n#2Y4_GVwG4F!7>^dM2JR@vMpGnBT45+pT!GvZA=(?p8a_JI|XK z^j4~Vj0d7(=5Fmh z?M~|r;=;64Dbl{cyC&QR?Yw(bi)C45_ozlD-X|tad}x9e#bg7{ly*)@MeC(`?2k;; z-=qHH|HdXhG4Z{LA51hc@u`U~OnhnLGZUYiXi7wx;L+y9#Ps*~sJ?k3l8xS@7Vn8H zAHFj2wTb2?zB6%{4OXG?cEoJS3A2S+7CM;dNDj16+(IW4olWdBvEM`&6J1SAGcnyn zHxu1W3^Os@L=O`^O$;zG&_pj2y-oBn(U)j{)ZM&S$v#D^ImSfjN2sc~XG+=q27)ylY zu^H`d(D%tE`_#C&&G9DEpL9p&j}+R3_)e>R5hf>_pmX&pCZ?L;vJ7`TtvlABeQNGL z)qRIEg9A6Q&cu2XvrNo3vBbnu6aSc)V`71cg(l|4t<8(m`h!xdXQqx0$(nD1Dcirg zFEV;uME2gBX6{#usbuy?{Vp@H+{Eg*)(R6ViRAr}X++umY881VF2nq5`_&o~2lnP1 zx?im&D)y_L`_;cDHc(5L*kNKL`QOAA6I$~~fvDe| zCU%+FZDJ2a?|^DoJdJzMCu5H~XUp3y52(GdK=CB?0TTyJ1mp@6hscoB(k3pOIKrWs zI8E6%am>VV6DLfZG(q9w5?uEKYRmz3%0$JTxd&8FqfX#qtCm-+v*bGJd=nSR13B!^ zJ?nf7Btar&XIFQ_DX9vdWGp+Nu9&!L;*N>CCa#&dZsMkiTLj>MvK!b152_m`Y7}#F z{;JnJ7=6CoHu2^`^~piSx8Xe#q@ZWQr$mr3`s=+9Mx$PIP#r(0vJa}odYWcIw~%2W z(}H0^ETmb;VF7#tSPcD$goWGXGcAjId1?Fx;98$bXpR+0V!=bI(joQcAqJ{*Y3jc# z<>s`Iw2-opZsE5>YQiD4=8!sgNL@dq3LI8%#hjeWLT(H9Stw*7kA=Jz3RuXpkk7&+ zha>Ph_lh>T^2c4&KO6=B`u?!G)Fz*@P%yqZEiP8r!u=MCSSV`Y*HOteht;9Oitn-~ zAIZbDod+!Zt?XhJh#BH%KryF;g_0INx6stWLl#O|c+SG}7D`(vW1)(Lsus#xc$i>V zc+^5U3*{|Tuu##$t-~tqh^l@>JyJ4SD0|_ZXs-3j5%rjb$1OZz;YkbMWm}&eQO}>S z=rsG=pHq#yCWlv7l`K@Y5Wa2jG(njexvE*HZs92lPg|&Ap{9j87V28~{fMGp=mAGm zEeo~T>0Rx796OJ_bjX!{VME%z(}{ZV*q^cREE}Ahp7ZU@pNnM9ITB%P*AZ3U!V4DO zvGA^i7cIPG;dKjdSa{jOD;8e0@R|j>=CdwaGmx|d}PdW`Oyl3GfKDE%$LL*{tr1m}sa^70FI7dw_{n6s-AH;P( zUTpkh3ysM$7MfTX`CNpw8L70To<*Vllz84_bvRYvGYid*s)}`8rp+vTK`m;b zvxP4$d_|g)g)Dq+;TsD-S@_w)w-%Zc&lbM7@aIuA<*2GqJJ*JzYCqf`EYS38P>0ly zZ2WxmerMXk;%0ipsJ~d4Q!4dIp=fG!;HbJ5L-@OeRu)=YXk+0IHW-)u+X4+m{vz`q zi-O&APQ}5}eF1G&+gfO6p}mC}Q!CQdT`Y99 zFx0{@3*9Vqr_@;JXQ79Mo)&sr=tF4xInN$by;#h%euxk3vmy`ZH9DqRA5;A;46rcR z!Vsc#XmX$hx+-PViTjpj45I8T&6sdZ4XJ7GE0yQz8&1(*GlyFkVPTww@x-=;Q5HrM z7z@;X49&2jaOU=vkxXs7lxM7kQ>D`uAB$)-!NNof(=1GnZ%(o>g$S9bP3C!~jAvn^ zg-sR~Sy*ggjfJ%qmRMM7VTFa26#wI@{&Dryakb3Ca#BAdlNXIJ*~Pc5ldEEe`Q%G& zHPun&oRjN0>tbRRKWc2Su%5(y%5K#q`7e=nTro5KxEen{wb{ZJ3p*|Bvar>{HVfM= z>>veiMQ&g>)v$NOL%4E0^7lo1yxkALp7LHlCV&STV;}%X>IBVgYg_A_Ah0_+!kjMT^?yi-}i&U~}l>Trr z$yc`ZS>}1-B#wl8$-)KdpQFi(aW8zzt{a|Em)U!K=bDA<7CZ~Sg&P)bTDW83F0~W! z(KxoPAXatDz^D+WbFOkNfp*fD`ew-8*5KSlZ3)Hdd8U|HjdOx<5jn~ z&Ap2UZIriB!A5Z#C2W+kQQ8KB9F??j>|}K6`5`;{ZsNs-S^c6_#>T^Tw1+rztzI_9 zOo>yfT%4(VDq@3*HXh+H$Lf#T=(IZ3;1pefW$y2pu2+jzY@V?3q>X26`nE(R8|Y2&vxQH8x3vDvN796BOCAAXk(+TjSp;mXyZE@-`n_z9ohKG#@9AJw$a!|6JprL zivEsuMin`uKCw~vOa%F7F-Qxm=WJ%N#AU`)0ZO z)*1CpT>e`d&B+_1RHI84z2g6MMh!cos_(XbAYyI&ZljfrpKSbWqlJx@aCAY`l|7y_Heztm5gvch9O8 zXO%H7)!N3&YZ3dkv(ethP#eQ+bgo_p`D6Y!qo|pp8K`XnRZ^ z7#!Cf5~o+=vE(`zjcB-y5jG~Vx{Z-GM%fr^V;l#S(;jW3OkbzYIW;D(#lmIcDxaKF z<89Du)&v_9If`>?Y<%rIr>5ALYGay>=|uR6Xw&UswFX0+Icl2 zNLy~>iBF>8tRyd;S1U-7^NN{K=hZ5Piz-D_hXl}3=o?;vg=wY$LWBZ<15ZV;`xH=Fv&S$t< zvvI-32^%MEoV9U|3^OqQx(llDnZzj@r)`{x`#p9+@nT1LFGlIJ7uDf~sf#u)k(bDv z?bL&C$7XPx2`zTzHVd6#YiW#yQps1V9FM5+qh#xbD%r8YvY~`&xTKx zcu{4O5AU}p2I(^ct0S>(JCH40u zWjfJo;(V@{V=t-Ym(+k#X^e1}aFE6-Il-Nb91e0i7?i-^1dLfVUkT!t$u;-IL5Vh$dRL4ANtT~<{tD-!NM>jJu~eLsJs zUP?N6$ic%7$~h?IptOTB4$3;{%Dv#hS@gL?=L0PEK!*LnWkrXpS+h_E~cJx@c9Ub%N;$3 zI`s(f74^v##kBhsMIhP8a}J(&P~XASD{Au<)#Or6-h9cy%MRWkAsoCyYC3q$!RzFW zD~f_cUpM8hs(g9!)VZog)Jo%K@mmhwcJQu)2Bgk5>m3J-PuJ_JdiQG7#qz7_JqMf^ z9Gsine^oVfu(DhlGaoqk&_QMcaQ(wc*WTikbGjNuF`gEiTs4fq7kZ zcF>9BE0Vf=O)>2fKdP`J`WQJ|-7fv8+gmc!b%yFgF9)L>jCRo5K_3T09Sn2O*Fir@ zkb@uTr`XRw1I4rX3g+pb6W8SY?&gORNM zj%+uxelL+uo6I6ws#n3xp1JHX4#u)D5l;UP4#qo}BZX2gHF9!NJi#N-V{R|#y20fy#L zkc--TMmvShC+Cx+24qaUp_ndmu-HMuMVgBx4wgDN=HR%4We%1**zRD5gB4^g2kRWH zcd*LAY6oi^tc^R}cq8(m!B8f&+~aArOE*;Mo9bT&8yswMu$c^B(AgOC*obxMFWrnV zQ>%K~76*48OxxyQYupGu3i7_-^1z5YsE4TIXLX#)>qmQmcOYwyb`G++T_qi=qT0Q+z6j1h+7A@*|mdH z4o*8b=ioef%)wczosIJAX`LsUi^sl9Iq$mQ;G%=;4sJNOa8ud0)FlU(sU;j-b#N_) zoXr-wrFbz@HBMi;r7oOF@^I@-!owDFr17hq>0Jl+_#$v&xX5_+$=Lo;@0-wQdyNMhri~KG!T@Zn}T;z6f`8Fq+Dse~U zVS$g_x9_ODZuFKZdM9eF0K0afToiO^Ntpcdj=KMv_17JBpNpbzq|+#oWq8(->HRK> zxG3SGBp<~sJm8|3i@ful@fFf(Wx*Zu2jlz4hB(FJ%!OsChg_6$@vw_>E=tEYm)=oj z2!9Tn^Ut#JowU1ji=%SO0o-TU1=gs|kNH_Xs zc5~6)#l&p2AzNLHhm-W8LG^ag$3=e*#09NW`nqUwCQ;Fgys`C*J7tERu^l7-8=m^s zQ-fU$q0qS)>td*jVJ?Qd7(oC$HN#UIJauYUoCWT(2p`p zTr735%*AqIubx{fP<4Z-Zo@!vO>)W3B%Oh*aivf-QC^YE!{{XS z1wj-MK|lc|1jRy3RO|*3R6q~}1jQf(k^i&T|L>eVd-m?#ot>SXovqnfLdX!R3Rlb! zmO`yOno78Hjom3jifbsLp`?aV8b)Nu?HLL^T9l=FGa3Huv8>V>HKkQ#ISu7CG}O>Y zLj?^LHPq5jTSFxcl{Hk?P(xFFWKb%%N>bCR8mcko2aT)p%)>hU3zxGNq}1_cO%3a7 zsvcBFQ+IpoYN)4Cy;%-qNPUfpzLLRrgU4813m6SF&}YiV1f`+5h879%rW%@Q>PAnK z&$3qMXVVf$r?Ey$4Xre^*3gFa&6MwVs^Oqkrm%xB@cbs_x7W}?!&D8^G<4L^Ny88g zLp5~P&_zQZ4Sh8%+m+r`LpKfGHSEa9?UX5d&SVYClpY#-YE-I}E?e_@Y3QwCd8Ry@ zDSL0K5w@R({u%~p7_4D{rmjnHsm1;C_09c(tZ#FlX=scteRudtrf^*|j1|!^R>L?A z!%2J%qcw~nKIaOK)Tq)X7NqUDoKbA|b4nt;qnChF&0$ap<6?y zN-!kLwcGEmBcEtgyu>#;)@#^6X46q$$3`+X`=EwDH9ST9HGHn&3k{n!Y|(hX1A8?* zt>GCBFKBpC!&VL3G(5|`reV8=MadgC)Scdu)b~^Y)h@d<9vup2-OsaKlKAdfDt>mB z>`p!z;O9$8_~pc3nI+F;$t#+=$+(A1-ZW(3H4U$8cwfT@8s5?~o@OhwB}+lwe@gzghcmBc=9kgF)bJJMkA@Q(zSeL+!*?3KCk-`xqv4Q-Z#8bx z3OSs)I%msaMwZV%qG5ct-2J6u#oE**$jbgf!%>#2;W+zIBb~=9`;)TTyk$|0b3^BOK__?2=v zM@ek9I3G);-#tfu)3|Dui*mfHJ(QqRn><3Te?8y<%f*z}&pUx5F%7cDB$I~=k^VN}|gSz(|Vrt|{zg(G@ zD}0@^fQ~F3x(-7}wvHSfxjHl*!Dni&SSD~9G*A@VS;He+lFp_MONXta{Pwgba)rtX zjAVkkKUqxR>F{-w(!qG_rfv%H)u4CLt?e`U>~IA2#| z&6l~VWee-LMMp6m#R;KOP7xivKvYtbqDdM@Q)w=KnN>ok)RL=5-4`` zGCIoYsH~%kj&j6PM@1c#baltP0tq-rnaoO0c4qF-6zA}hTv1g=H668d)YdVnQTFkY zA<0->M-3e{lR}$~u<3ZQbd4so=uT@Yb#&BCeo+&W_%zVbP{$%2_vmQE;&cqsF<3_v z9Zhv~*3m^rGab!!wARr^$4lS(Ep)Wh(Mrd&<=y=c*ik8^d%RbZ%bK*+(N0Hu9UXKO z&5xOQ$2q-*E}e9tk}!+wsH2mPe_E-|LK1b=(M?Bh9es3k*U>{qPaVAy^!R+n-MVbm zg~`qgP-he5uD&|@>DaX?ePEJ?hL8H|FdxgIEs+5_-qEGyT^9ACNrWLfhLR>aChHi+ z#5%_47^`ErjuARW=@_kJq>k@&AwRPSwhN13m?H6LS}w)rI3444OwchgDeJN>%Zhrr zhE#pT$|{q~XZ!r|_7okr>6oiyo{p(Hrsu-x0yN9l%=M;tK&T# zpXvBq$9^5}v!+MWKGpGojt_Nw`HcO8DIYQZQr5>hK1m8?cuRuAzQoV6q_8DlFtLuW zbsW&~6?>~Cg(i8UEH&JBwq$h`y<~%sGXzTGLpr`CcNv&w;INJ(6jKJ-iL8t7DfbL$ z27b_Sl=4=`6&=TP9M|!yj^A|rsN;l=(>i{pM5^YT)Uor7c1p)jIxbone1Mg;e!GFv zwmPHZEO{>@_bp4#>G*~6O~=c9ojWW=y?3|ethD4p60_A3#$VL&yN| zkoBl@$QIpzVW6OaJOicy%YbhnFkl<#Z)CLDoaq^G3{-T4)M~R3#9l7VL_(?~)|E=WMTR%Ga2E;&71H}v!GEmsSEe47hc*~Jvj->yqJLken zjv7z*?QvIVxy22XFi_G!DFeB#Do9+Z<_fQt@U`XVUe9A)${HwVpre6K2Fe?#V4$Hv zae;~kDjBG0pq7Ek2C5jSYLG-|?+VSEPj(fHQrK2EFr%KjUQ~lXAT$m`wS?LR>KLeN zpq@cRCN=6UbLISG`&n1&8#q%wmj;3w7~l>1PhFwk*gz8ltqrs>(9}RP1I-PzNJyRY zWF8Z zU@)^A=xU&wf!+rC80c=Ghk={3l-fC6Gf(b%B&VkV`n?P_$oBT6uYrCB1{fGiC21XHrf#C*5B%ql1TTi$d&eoyh z=V$|C3`{aGIZ06c$+WQs#?Bi{0 z6kpo;GMx=!;B5o@49qkz%fRErjXY*xj)BDn?lo|`fw>0$XW&i)^9;;4u+YFAOyJ7` z1Ep_w-}Ys#ulVF=U#Rc;%s)0Y`R_7tw}C|l?jf}1xtz9T1j3gT>ebUL2hy^j-6xPG z2JSQPkb#v3?l31N0gHutD`d zJZ4~xfmP&zJ~oe*b_DXMfz=6p)&xSwqvV5uTnQACQ7G#SJYnE@1G^2ZH?YCLHUrxY zY&7tsfh`7}CjXzepJMztyXDjNCIg$vEul;}?hFa#>PD;oPX%WZPAJb9_{GlOn)n31 z!@#o!b{g2lK&XnN%W1o-5yvtBUpBAMC1Yh=Rp=`R_0*}yC0jvI1@FqL2p{)IUFfnc&$-Iobp;`LWNNSeKe?F3T z$O#6H8~D+{dj|F!_{zZ72HrRD0lD44rv^SGr|ro9$iT;B)Jyh(NT{Q@JurCQM~jP} z8Tg#i%)pmP(X<^(3IAuLL_}^Zba}BHFmRBqK=E$i8v}<7d`q#PfF+(Bl=-MD18rlW zigkF}{GP(!z)=IoI4G3Yhs46&MJAw|9t#(1YhyWK;G}`y4GypPi4`<(*1$Ofr;{Rn zrVvQ**)!ixubbOGGxb6&6y3iVIB(!LQkXT3fY);64N8d1WI1L1uLmHB3}7QPsqtf~p~ypqi=HVobArinXS^PQF@LP->f~W1@wL zmL}?&sAr;)iN+>=KagJEL<18IO+505ovG`Es(BUn=FOPs@$uFsreeQlCYqaQYN`#Z z9e?O|U5{}ks&h5{?RV@|1*MgV)+Rcc=xm~miMA%%nP_j~c-1iTwBpi?hPhir3CxOR z^$sRFCY0%3Pj%HUCc2vFMw0#)`IYfPK_N$-E+|f(l*yB~{?&S!=xt)IiFqdanCNR_ zf{BSH`kCl&VmPrfF@RMzd3ypwS*bi3_FCQ`6TE=XHBSbcSeU0MLpRLCTmOa09(h8? z$dM*SnHXbYtclSk4j*v2q&m64Ihy>vo+snTE%_?t_ykF^F~gHgOg1sq#55CA$Y8s2 zZX=i8n#QM!w^hidaSZZP!F*k9CiA5&vF{v$sJ5AhW;%*af4^3kSr-hce`LaIAMU-C3m&GRTHF3X* z2TWYbm*uDQC8oM4x~hVGp9%U*#)WekQJV?88~dP%v{jA=k{$Gj_H)Uifn9RjfuxitY-U)(2VCek;m9&XiO=2D(mYd`oN<({=L>(6YG*1 zJt&H98%%68@i+UCi6>1wW#WAkADGx=VzWuJQP^u@i;1UA>@e}HiDyh~HL;yQ?6l1y zv-JG8M7EjuDuMR12w#ZaX=0a&mrT5D;yDw~C&d*gB)iD~C30Rc@giw>Fs3#pcfoj; zL|39z_A4e%{$qc0Du=J@mMxV;$st^ zm^jFOWa3j3pPBgF#1{#+Zx)iXg%o|l!t$kwuT8ZDU9qryMafWDniZA<1Ts8D$25mb zd~4!66W>!@l*~TNUQk%&?O9lkP`D*w|Dd&PioLk7yi{0@u>+boZ{h;MnmA$Nl!?}wVr3pY)qQIcEGETmh=u#jyb$3musE*0(N4_O5)bwBy$Es`oC z^s_7_Z>tnhb)iLW`sXX?-3#ct1;c`A!Lm@Tadx*NLSrvj?;dQD&k^L-BC@E6xE4GM z`P~1t;9CeRL>6L;mao(@e@}NWOn@&j(zxDFStv+X)7zPp#e(uIJovHFX(?o(u!UPJ z6d|^+=It*c-xral7qYGuk)oD5Zz`6+k)l%ELJ12?>*UudDxABvFDj)il(EpzLL&=h zEtIoR+d>@+ z(Aq*93r#IFv(VB)D+|q&EKF0on6w~-j1(O|m)v1pd@-cZXm-hJYoVQm4i-8liQ8Ma zub6C2Aa^b%o&FEP$3JMDEoF9qbva#3x>@LM;j)D*7J69dY2hggn=JIQ(A&ZcR@_1# z3w`m5}KcDwmMAn&plvA$*#rO$nK0VYY?) zEj(ahj)mJT{LjLj7Uo)*XJNjD1s3?^)BAy9;02}ig%+OvTYI{MbZwD)M*{rr5~}pO zn9RZw64t_7f9LVi#3Bp#SXi8-;qK_Y7CuT+Qq=Qvamo&xpLR&Sl=FM1!0sb(;wq_6|>X=WzaOxjxb+QI== z*1|IuUbpaug{>C0S$NsPD;Bm}*g>AR@O)Bwp9lPfCFNO*+F96T;k~4+@BgpF-4^~V zDK92{~0r4&|sEWB!AuZ7oGVh68?n_Hojy!Wtmxt@OJg1&l|*Q1oY zNy3tb7CyG{wuOBxg&mDtQA*yiz}-c{dG|kBB{1K&u&0#V;-+!e`U49eCclo9k`L~& z{wyU=3`zTh6t?gg{jzS8X4$!=<#S3fH~%XOUs(8(U9z;=Ip^$-e#g=Z&x01ev2c>b zSvX|jTMIu}IBMZAD`nw(3%`t0JE-4Tp!xx)d7DpVjVvv9mXs3ssgn5~X_cIl^bH$605dwa+I& zE|4oa=h9s5!H;tIm~UPgxyZy8{<3h1qN$AhVWCACIr5M8XOfe{Gc zqpFQ+HmcjGRZjYrlRMYt(5Q6{TN$X_RZeQzsF`3mr<}s@`*Kn{`DCD;jrukk*=U@^ zG+>LAlZGTqGVgWEtMpB5{I5p-(SNMX9qp#9OL=KrUg)>5(UQ4HE*q_Ew6@XBMt2)+ zY_zq}$wp@z?QFES(ZNPX8*enU`<9oL<)wk?rqZ%kw$Qhh7b+T3bab)N)mDdPB^PJE z^^?v9;wAkaHhS6^Xk(C#UN(B$=wqX=jbAH!+-o8Oyk1^-kNA9f=|?)3()-&OKqjf6 zaHh|PzX#hGVq>U{VQh;E^2fToW)-B`ab;QVlP z=}9s+>;9q+r=42gSlyzsak!>V%T6v%&~Dh$!p_I8*|ARHs;${z}DR3d{R-u zC)^Vi>W0RlB(lfHtx2u$i_WHyOQud)?l4WyF&{Z-kbGAC0T6a zUK>knHBaE&fZ7+Fl09H!sf`aDeCW_(5*{R{IjHGixs4Szj@$T=Y-3}kjW=14jfZVK zVq>R`T{c$Pc+|!g8&BIvQES=*!-A9#V zgN=;|K8GsFxk^HOm}?XJNM)&4SvW3iW*4q3ybbh>jjd#Ro14JcM%Jn znJYc^gdizbm=8t@#Xd==?iMVic4oqa+TdE3T58{gPCWaAwh@3QaP z_|(RGtT^du<3qZZ`OB-wD^=uu8^2Uhtw28chza~`GW^F0aHFb<|IEhcHV)W0XyXeT zU)uPZ>{nIFR+X>FkOvemF-$+-S8L>fWpe+Qe6Fi1-;#@Ld~f3iX4#Q{#Kw1tWBAd{ zIrO;&arFNpk0oiixx`40DJN{4q=a-}IQYrNDI34r_`}9&8$T0g8|NuGZDqvotc`Od zU{!gt1h-Y?Tvg$aomWk&P=}L!kVqED*gVp%P|mJZO@6a+F{xeWY6|B+ZTw{;%|W_@ zOExZ3s@S-mB)Gy}JklYaS8e=lqjnj!8s*!XY5OhCJ^rEOCnitj+(;6SNTAKFCO4B$ z1~MFEI>>U6?I`>I+&tV+O=!etZ#604;FD@{rJC^CRE~qzrb1)sSu_yz&l~9#+Hs zkQyreq{Oe{psIsv4yrp?mBjE_nKx?4f6p0^_n5MlgW3-6a&WhUIu7bO=AKhzZZ7i&u4TEd-{7PW+v znt=`mIhf{Px`V+EhBz4MV3dQQ4u(10qfpf5WO!%s?76k%RtLiqx2~3IxJgUx-L+)2 zgE0;!IGE^w{cbF2Yh;geK}XgT)T+b+E?4;|`WM zxX-}~2M;;8-@yaqABuf4d>w`Gs@&|a&Z_zOgO0lG$iVUhY-*_@_(}&4J9valMa=66 zr$d|Ts153h_q%)Q$mezBQ3tCXJeJUBN%dSh=347uor5PGJmugCvaW*-4mKuWf3G7( zT`68y>eQ95M!G%g%8a_Q$-!oJ4F_8t@F;u>i>oVp>&n=k`A<7IaU_d@<8@_!no%^( zo1M~kuvoEZ9U&wFW(!9Q^Z|}ta#ld+87uZ0K(kml*-NnlI9(P3fO!LzE@@jqg-N7Fe&aSeg z_NRlt99(zs59Pmu%MPwMxJvn)KqJ@^CoPKZzsV|1lt4&pAlE1~8pzxRa>K#D4sJR~ zbHV#W_7(e&qI#zrS@nL%Nq2FifuNyexY*x7=$N;Fi!2wW3(G~eiyRla3&TaRhLY3ML8GcUF5qE7sXwaa8bxbVHZV-fXj=nTnys9hSI)9 zevt$Y=bW3z*tBU+~AD>UDR_?Klz+}O^wArHc~bHr;!>)OEs2fcUetbG`|EnKv8(aHts$tOOWG?p`8>T?=Pi@EtK#zi|99bI&Cc{YvBjpf_M@@r#x zwXt+?L7$~`cF~2+*F?0I&dFrEqpOQ7(|>~r1)8FOHPX>GStN|7f-u*hLv@>#KQs? z3tfzGG1A3tE~dIl4|9}@u`b4ub6kvJ<8DtI+eGGH)v4by-o*qL6J6f@S0e%y!q+#E zADakY1)WT+CR=_}nUYZQ(VrCl(_BnJAtGbFsq3LoV)gahHoFF79)2w~Iwd zq4&DDhjmO6FE8n_yDd)Qmo=5z6I{mMPr|xb>S7sD^5w~<@^(}Cv8imYn*X4SY0dQM zlkDY5mMcw#T6Qa4JnV9p6dPPT;$oGHH7*_}m7dL^HHk;rc13enyLgNO?O$!ljVwB9 zm#uYC;gn8YrVh78cs zJViv9yF2j-{75r-$;HM)+RGFX&1KXs>y-q7QWw?idasMuT)gh$4Z><9$dNm82XB_`=1f6#gy-H<#JXCF32nxG4CK;+B(5T}ssL^PMkUtZOb`B|hU1y7fD8|r9?JMA>nnSm z1w5*GV4a6757{2Ndg$gM$3w1%N**eE&^+iK#6uwuh6mF_>>=gB@?d-LJp>*Wv{hq} z?w|FS-p@fGb9*TPS-`ezIo?0ff&CwrjCGA#OFSimZtC#dp%0pQX7z3m7HiLcxd9G znuqEh>UgN@p@xT=9%^~0?I~psj{Bcy*wnRSy{-<;XZX2aa_X_x9vXOP=%HC_?#G5q zNv>dGCTrxOZ)7M_3fJU$V|lN$cpLlZVbEvWJbWg^xy6E~N8xk5}H9=I3-J3c7pfLC7BF zlC~atc^KtkG79}j~)3?X73`jJE)26=d;we=8WYUgpR9OGfEN6jKk^DxfC zcn_02OlDo$2zS~iczAlAHPHhNQPTD@{VC+DwCr|I=DgZQ9%&=DC14qt?qP<9nI2|& z_^yrYy3Zn$P#TZFp=9!GV%1dUB#AG#QPi8~VZMju9#)VuJuLKauZJZb?jQ?!xSK4* zCVSl}`;~iVlIt!q`3;MXc^_(&eUAsXt%9@I<9kLK9~V_;?n6$e-{)behh-k_PjXdj zD-V!c+RA-H@+;@rWzXa^c+Y;2obaB_LGU3DD?P08@TiA}$&K679!dPSzsllY?zz$D za7=%-hsTI*t?b~LoHZVez^AA!`8Z>W>mQo-6CTa-;AanKJZxZddwA2sTOOYD@RWz= zJUpKuvx&s?@QjDe9=5RCu2eYFdd7sdvem;j56`myj!65kt(v~lZTGN)tzSXhc0zwA z`M;g)Nzs_L6EZuYd9Xbxk=oan@a{y}a#VpN9h;4tjXU!@C|n^6)Vk#>0LO?|b+lDW!jV zg}{RLvbw!|=z%XYe%)SnC6S+a_|(G}9=>ERrpQW0z0XO6MQUUmH&`u9zVdLrz0knX zxQ{H}asJvvl@8LjgM8!RkcXolj#2)2IPBqj4?iR&uFABJkV>`n@Azq}XN%c|$9E7u zF}b9JR>Q3gHhDpMet{XQU-30>29;^ z%O0*!h!)VAstQXee_&Rg^;2?iuow%qm+*`jq+!7lKX~w z#gk+u65sLd(mra;@t*1=dpjw{X7+ME%KLc5#~vRQd{p!?*2g#>m3&n8(cVV~A60x* z^-<49eV;mqsP1ES@!Z-3<%3hcnm%gz_^Oj!=%lpcHvg^{tff1hrH+rfJ}7=!O8Fx> zRXa-q9}Ru9@X^voBOi@@H1pBi2PafxJ4@!yxQUOuI!jX@YcA!SdEWabNAc~`ou$IB zRx2N^eYEk>*2gEeS?_k18o%g&*UZ(rNN-We+HuIvR_DAOeRT5C-^TzSoqcri(c4EK zA6W$4<8$;Yr%8;E<)w2FK4EHhE#}FSweGE&I@u?=Jx&MmNN7|JD`Lc_Q@G;Wo1Cbcx<9rw4Q^=!|#5Byv zWM)?>+*Rro%-;C3J>JIzAIp3^=wqUfNj~QJnD1k7GhWpvYg z?vgF=vCzl8K9=~n!^i)8+~Z?0TVzAdwyts~o5RQ5J~d>pD8YGm1*h7NJ!NE1`P#>Vo{A2%v+>}U;gD>*@KpO-ABTM$ z@$sFH%{}GyGdTx(%H^IC^pdi@Ekc5P|KY9y@ifIuK2j>BP~FBfWLiQ^YJf* zJW0CMURhed?&BZkWk2dId{mU_=@@>vxAfnVL)+auws{!=G6Q9uzd(RDddt4Y)x%6b z^_Hvvzq}i#^${+;vjgM==zmIO=dCXKdH^Fp%>cCmm;tN+B?FWSUnXFwORmVaB3I`|_ zpm>0>ePqBT?Un#V0(}3RYVo2;`t?al68Uf+DM1|eI5f=2zoi3|2~aUWr2u6EH8U(9 zpaKDAJLLj!bBw!WloE{pwU1~G@+$|Z5}IG;LplN{m0U88o6rgc{>3yYP0G<_Y@2jfwa9{bn zue^LVtH7NB3DPV;^8hUZvXIVHdD|sOPc^~19T41B|y6X?E`cS z&?&%?T<>OI=|BqilN$Y0%Ax&)Tjh)TsdIs@0lEd~9-v2nwf*F?e)4;gh7Wf4WQ+Hg zy#CTFq24E^+Nti#HVSAr81qB)4=^CWg#f<>7{~?+@N|G@0t^l?B*47^mXJQACu{$pJ3j!<*Fq;{P ze}MS`%^}L|Z1-QXcJ-IF{bg=|YCV*&I-Oy^-(R@>d!fJF5#WCT?hJ5OfYJjLeVCxp z0J)o09w2-y;~omJZO)>^=eTp%09l;i$-sR9?ho*2fYkvW2(UE3iU1DiBYiR|4pRl7^H{{U|X zc#}j+%jT#zd5}Vn=Hlr;H%Rsm62gBsz|pt{c{U$dVX_8yd$m?t z9|icBeLuht0X_-vX@IW-90>4PfX@Sb8Q`k`Uj(@LyuG1^zWCRIJSn4EZ?IoUtq;?) z+Ygq50lo=vD8RRr0NoYjM_$dLx&CiIu?~}O2g{Pda)iynCjK#p2k8B>Gy*vq;8=iD zWW@k~-l885@MC}z2@y68mXl1MoxRuBN${VN$TtV83jQ463_0*MEoecy);6CP2PUN;x+~j1V6$wb)W- z5`QC!cS5)!{18EiGDB6psD0;!*mtWcD-6{HxP1~Ig@{9RF!OoSijIN25cwf0gs2!o zLKF&7JVc2Qg+tsDqDY9MA*TPA_c!h0?)b=1xjIx@pUEl~Dy;x#m@2Mhh_WHdg(wxG z@-Qh)G(xl=Cc_dpJ4v&2n3QLglkm$`^h!(_qDF|CA*zI^8lqZ=>cn}N92+JS#n*?) z=CfM0TZNmMR2QigqIQUSA<|Z>VW>`0{i42IH$>lCWzns&`&Ow>{8#7izg3~sC`4n* z)er+hGzrl(MCTA)LNp7}JVcuiZ9_a+C$mL}mLXat&<@`!RjczbRa%ptCshBfz9q9A zD-xn(h)(2?qXlW=e$#U~9YQ?#y)ygBv5719Lc^ujRl945ZXtSx=oO-Sh|ex6JbSQ$ z!xcVs!-h-m5PgVnh<+g+8ZP^W3m=KNcB@T|+`QLR*Z5|*3=A2Re z>=1JjfHOnX8l|MitmM-erAog&#IgNOw^1^7l>Al1o16S%U_pq5Y}^RdBHR(;e<8jJ zaVW%{A?^yXBjg1r+#O<3h*cpT4RKG1#UYlFydmxlu_VNOA?^>6$7dH#=9lbaZy6;I zunWv|KN}@yMhVxdOUW2l)n3{15GzR45GzBZkEV`RF0Wcq7DfA)XKMa)?(#><;k)OZhDGMfR*Q(r}FIS?AHB>`NiIxlPmM z0~tg45MpnL*9f*lF1IZ17^ASFzWrNcl-ZUuW8}>cZ;@OfJ_+$QI~V(Gi1#U8#>(Ko zoWo~w-U;z;i1$M9pr6P6olh!8{UF4LAxe)`&`umv1ljm%`bWfSrE~fY`&06Eh%Z8X z$$l|bKIdmY89P=Q7WMez+rqK3d8~XD;%gSVP|2SIqy~!~EBDV+pA38(;&6z}NIg$= zB*b?iehG0t#P=b72yrUJ=@3WBQ6Wx*IGOO$ak9-=(dOjy4%&~zwu;(eqoZMbYO(&5 zq&aZH{yD_$-=&`kaW+(@=coq5G$(%1sQGh_(2k{d-=BUV#IKa_A^r;STgW?i_?^u} zI**g)yO?>ER63i}zlyhM zoLncV$H~7T{t0m-!RKH{jgC5~H`zuxc3Px-y7VNF5#i`K;b(yeSrNPleuV4@IT4Hq zW`x{G4If$rJ%T%4ij9{6GB-Uam#+))5^3N|LcZa!xXJyzo}DZONbQV~igVLoqNCJAg>lRmO>_J7X-pZzDV ze1wWDH$sKv?~(C}!j+S76{0agt|u|oCJ4jTBh-knB*J|WYDTCPVPJ$o5o$-M6QNy% z_7Unvs28DGgys?IM`#eCVT4BfJ3&GIxOwib6I$a4G(Oyvkw4`$Ny-|W{9RiolN4(a zp=E?N5!y!TT!XnB|_H- z1Ip%(uawPpX=2-dPLOU9%B;@etn5Dv9(<6fXM|o6db3$8t9_w95&AM$q#pR|_a6l& zN`LaeM1^^k#HX$xO`#5sFeJjX2-71BjW8_2xCrB!CBpCsqa%!oFoHNtlqC~oB>yIP zM=^n|?yam(KF3BlKT(WH@^SJxA;QE6QzG0JVN#@ap7{*@yh+k~(!&3xM3nj2wWg!vH` zM6f2y!lZ)dW?2^#IE<+=S?-K*SA@k8?j?JF?X;ULce4p1^^9PpE$R0p__GTC9C2q% zR;5=TV6T24|NaOMMA#W&SA?YzmPL3X!ukjgMpzzURfI<)tcdVXgq0B<=4V>=>dCTy zvYeYNk0fYBQ>4Ze`LedsKwBN*u?UYxSj*O&B5NY7em>-OBJXVOIi0>P0u78X*`eX~ z*eME!4G}g*cqYQu2v0_MD#DfsPeoIB*Hrp-i`1c2_AvhT^FpgXK%^j5Xr>vCxrTd{q#2V`C){QBK&wX>xI{{ zs5!&!_fI2y7U9bXUq$#lQtOnvlaya18OJ2y^@-2y)B!jc;Tui>3Zi;J9E$KQ&qGs4 zPvJ1hMJ9|fHO6=Br<5TvO2_ztf{~IiMox@l5spXrl@%urBpn+i!r2HXBm6`*L&nb$ zPLV{nN!r@HUv87r2@aqCU+L68KNsN_@_&R25hnke$NkBoQ`Kd8zHLWs6JpqMs$7il zdxWbI{*LfRgg+zv72(*w8N;S33M`*WiKh%fUy5)!;+;`!PU88Cfol=2lk%~8dGVhJ zHxdNWWBeQ8CTkii)#bfY<-k@iUEP;eVwx0Sc$#Fzs8e5^ z<`15x%FT_T#Yn{{7(C>fXjAAiL#3&h~ICB}VR;9yKwU&pa?)%670xs4df_OpLNIy2j`h zqg;&gF&e~Z7^6ariZQCks1c)5jLI>p#;6vfN{s!}h3rRlVc-i4GC1yy? z7`0;5jZu$C&QLSY+fA=FX~nz~)MXP6PxTYzA1|h})@}0?+Kpl~j?s$MkI{tWjnN`T z%UH21`%aq~(kw>vSUoj6XolQ9Lls)SUiN!cvsc4z!}u5-VswnLxn@qg80kB5c=5S? zQp&Ics*iU{!k^8MlQX1qj4sLNkF%|<38?NddN3x&@EAQ~^or3x#()^TWAus9H%7l0 z4**9mX>(T@}Wpu{C7=vOAjxi(#AJn^kE$h3#vrf$RUOR2q9+}T;ZbM_G z>oP3ynPo(bkuk={m=I%BjM1^0yN-#~h{oGVocSC%VpDy0Y>aU+-dw9B!+-w77?Wa5 zCK(O&kfkb}3{%tzXUetzsr~I~F{a0OKF01CGh)n)u`0%+F=oY>9pl~@OJdB4aeIva z#ke!ZT(V+}g)#1k@xdl5UTMvb@$`Gvf`m9#W-228^=Hn1n{5C2cg46T#$uxJZ{FRp zI*eYFBF}Zud z%PcEmJQQPPjEC9!<6IgWr#XF=yR>O`YL>c&@JIrmy?AxZwKg`fiDRsZ@pz04F*e3n z8)IFJCt|FpUpSjbX(SHExZF}6SC`#y=zN2ZdTxaIWQ?cC(#;$`BsB8Z99qcV!urP8 z9%DzWZZ|&@V=GxMDY0BxmF4w9?hi+E_&Ut9F?Pn-Mfs56S!I?Y&hcXUw5=BHsJEUa zEc%5QFUI&W#)%j&#dtZ!mod#3;FTDAV(g3YPK;M$?2YkSjMvFF36MFngpXgp5#y0r z@>WtbUw?a(Xv`7@-exl$%Kdnjl%A6RZjAS0d`vR31IBotXrIoiH(MFH{2<1MF+NJT zs6maKxviZNv*l`QHGBD#z3D>E7v$%5*`LMuoa{YYCe4;*vt{dS`C_)R2laJ~12Mj* zFpqIC#y2qzCzu>!b!JQSne}sF=i4Nv_8e95Vhx-l90ih?j!DeXBz!E!aZ052*_~gq zFKkSkK1Wu}5$a}~jPX;9-(&m{<5Y~(G0w&Kg}f2tOpLQJnl;H_vgO;YN7l|tZH&!%C0$22F#PG^uNxk zo5HFj+0aUs%u8>OLcfMkzEV*c5n?kp1`Td2%{QxucX_V7@d@p+yQUQ)rdK z=}k`2`O;~=6g*&2Gi3ODx&0d@;oGLrE`@O^j8CC`3LQw#6b7cyF@;XVB!ylnbWWiQ z+aiS?DXf?;T@#W{uIhA4f$o+0stUY^I6fJYHa+6@PN7cE@!fj7s!|dtFeiHe1S|zVPXpZBd8Q6r7$^#+f$gE!ju$l zOJRBnGg7#|K$cBU{jR5`rVuZbX^Bs0GZP@Q6CVq$S*+uwtYP)l5&WDavhhNhmjo81 zu#k03Ve9kO%fDvQjajJhp}Ql6osvCiVa8o4+?~RMDJ)N6Q405@@IVSnQ&^nBy(uhf z;4~2Ujgn#@x6cHzHkd~QJ>vCyPxd~h=8DC zASD*4fY_~H?8I&wK}tcoySt^OyHmP51tgUJJLCWNJp0TuJ3Djc%$ak}%ubxsOr|xH z6|Hmn9LnrW?p>o+D!L@lHG%GAj0AQyli%1i#nP@dlLt5Ebz_fj%p==yX{#i!@Feh; zSvtSD^h$ss%l1v6Ujq9RIFLa91O_CqFo8c37?{AI1STagIf20m3`t;Q0;3Wbn!vCG zh9@vW%UZeSl3qNQ{8qiWG-)pM+wwpyYjgr*5*W`WGiP&I)m+9V=s!`dON>ikkFGbp zg@i3+>yW&Oj2(sm?s7q*nu39KRV39L(CTT7`PDZRQbCyfWT z89ClkvRcW;1U4nGozwdSHYczpfvwD(z&9teKl#kMt+LXe&sJ9q!zXSfI}`XbfxQXr zV}DWMknLN^wccj+RKy}_1`bn%6S$PXHO{hu?bBruhUD zHv!MznR|fZaIbl(|~QjF<=o|8>u_cq5*+>+lUxo$RgA*ue6b`+eqmk z*E8T7C}-eS1A&3iK!JfWhH4`XPV!J_WT0Cci4D{$lE%oWHnO3Olr?aqjnY(=MwKpa z;5Gx54BXD=sA2#<6%1tkBoz&mEs{nz!MoFP4!n^2a(>1WKgk^i?lkbRiBC-2WuU5o zwFcH1xZA)z23i?tO*{?UXW%shuN$al;C=&*3_N9^x`7%79yL(cKuw}#;2{GK8>nsI z0R!*+MDt>x*>)}<*U{9jaF?1Tw)jc4dhAc~h@sXPPy8fHbxJ)0j~Qra;7J3I8=z{f zZ{X%n^84k~Ck*AykfVG94d;te%8mq|Qc;%KR_J#2X#>v~c)`Gn2A(zWoPp;JL@9;o zsqMD5l3gled+R(}*5wi0mkhjY&;k-(HE`+koCRg`pJ^-PI{)^Z58KM46LXukl{Z+6 zfzJ$lZlJM&Hw}Df;3ETX8F<^k2O5WW47_V_CnAHJ3-1{i-&Wq&>6_ciskTzIooXY+ zu*PB9>c=Mrni%-hfY(lHwUf8osm|hGmVG$hVr$8Y|t5oks2L@4~vX6 zFp94R<{21mU<~EjzzhRp4U97|!NA1-x+6#%uOqZX$5J<|=T0(kXi@G|1Cyy7$OehD zJE~he8_z-ZXa|{QfFX0vG%(A+?*?Y;;@zK7_sy?$kU9F5YiOKEa1vgBWa@ka3k)nV zu++dp1AiD;WMDDny`!AiR{HXxoLSY02{v^jfU%GQgnblF|pDz0PwH#h>*u|VZ^Ec|c_8Qn{V84L_ z8i5l{tb?PoQ#(oJPEzBqO!~!c&`Azc!x%Vk-~#Dm;21g3z!?L_4V)n5I|+9=Pg3Lu zrnl%Mrzka@)Sf=$eLJb`I)@<>Stf26_=oD<1Wf!({XoTQqL4|`h>DDTYpLO~u!(kuGe>PH{gwt& zud@^}Rqv+`NliD^x%8qY#?H6WbRr`eCU~}u8M<_qVkT}eQQAbpM7GH-Ls~gNo{2`k z=d>x4HgaWl*{T`KI?LakCErAG6D3TPG*L=}qFHPL;lqgaivnnvFilt{#Kf>GrRk30 zj$h!{^OjI;c$;9m@KGpcN(;>4}HgSiE zWxohDWEE3+wB%CoN&U5|iMvhIG4Y^@dq^1*HBHnqai59TuNAFsqT#Pnjbt>zYcG|5 z6+Vpo`m59+V!x_Z?`W96@K>p=Y4U)H-M`AVrrFnjm4{3`Y@)7-dW6O&+pRQ>nL1ylG-lS2gEkc%-Y+;fddbzaEdSQ7bv`oA|)QhbBHU zLDx=If0M===%-Iw{-)rwAvN>!ny@3tT^14+J~Qz-yTHV96JMD4(nK#4y-j>&;%gH> znP_X`8x!A}_|ZgD6W@^mP8DiVKb59v$NwhZoA^PueWQlo%tUh&txU8w@z8+WGrvg- z{k0|eHCfb|mz#cT!$lK9GCq9KUzv(8O zOf24;dLr*P6WvU7H_?OqP$zAs{W{FtTq!itRNiLCP>@YL+g(PHjJ?uE>yY`!nV=!@2_`0*7|%}3%i_az_5Xcw z%To`hebQaQpJHOFNh^O?Xkwa)=_Y2Im}6pwiJ64cU5`}VcSh?GO^jjIuq+nY@pgV)$!m1r!v>|kiJeHdeSzZ za0BbPp0dTnRukJz>>yM1RITIDooyzH3@>zNB4?+mmLI$H6dH~EQ={?Fj-s4w?=i90 z#4!`cP3$wV-^3vkhfN%yvg#>s@3fkX$~|a;&&u1>jOz$V!Mb`1U1yFyk$KbvL#CfF zaguCf;tV@o!~fsD%woOdl*Z(&3GPswXW1rs=k(Vyy%dHQOk6ZkyO%uIOBjCCOD>zZ zLYyrWweUAJn~8s@m}=1#pbLu3+Wbav5;*c!$PKoEDOafwM_k3Y6cznGBYu+rhQJn4nNzIKBrAKcQ9G7q=gf`q?8W% zYFIEWG`8@j1vdQQuAW5J1yL0;T{Y3TKK%TTL0%$)xzC6fBW9@%CKzi zPyLs^thd~6p}K_z78+WpVWB3eXQ8fzS{7fV@2EC$a>O3 zBMZ-4c)`L`7M`~7jD=?{yxvE??<3qR8Qe#nv%n?&+lQwQ*_5@QkD}g-7GAROvV~VH z9P1<3`$$e-3H!>cYz+zyIH0e*W#MfLZHc^v zcPzYX;adyeS$NOF`_$(oorMo9d}!e#3m;pU)>nFT&NzRv&Ypg03rO~$g|95Nn6M8yrTfX(Y>|lX|x7B!oo-k<1I|EFv>!yAtlFH7;9m) zuCdqvRpU4v@6lVew~S8VKG%H%q|pF5R5Wd}g(=hwE>^ji%5I|2IS3p~w=l!PF2QcW zObfHfib7Y6_}#*63q=G)1#>LSwQ$J7VPb1xzJ;|G)>&9!VWEX37M5E0!@?p9i}|T> z%A@zE(I-?V?JD=kTlw_mx6HzF)^1^yg%ui4PEkf2&v-}U$&tFv09j3s<+XBxX4V>N z1AW40y@d^AX`*LgqlHZtwp!T6E*l`5iPC*(^WM+dLYVzi{?{UN>HyhpVf_HvVbQl& zE)6--yy4?@^LAReJV0(4D7!7}v9Q;|K3cdumCl9bV4&0-s7UwhK-q8MfQ5tl>7Wz8 z)Zr2KJ2kU~tCS!M$Ej^BoTsj{aFWt(;VhvIl$}kKCOl=~v~JyOU6v_32C69&&+cBZ zaM8kF77fqh!a#YTMn>^LLc7qJJ@YxcxU5TEp;{XxGy}-+nuY5YQUryBe29N|^Vh;n zoo&>cDGdh6gEz9@9i)J_U^qw$i=OQZAj<0^EhNt!B=o#f{H@Z2pC+Kwm;yl=@9+9L5^Tnn6YD!aPNs{cydLZ2Xfe37Yqw@!YrS@RiRgl?uup)bvCAo#@|5xA( zB0)@>XM<(=V49-DHw{xJEiV}g7&2$-5V?1VlsZy!zz``bC?}{cs3D-4wDJNPI;tYL zO;ABlNpQPh?hxUYA1kUTSUp75MZc4~hw#^0c=_lK!JSMWnR2h-E;jAfoYb*7cMGa& zB+Cw!Cx^-hL**X*`pm_w`vkPE!NKuFRC_RdGId z3=^Ihp*?|yf+vL&AM_Gl9>Pf@g`CK%YLw^MV%yFAH7~yrCh# z$oP6|D=nD_?*iv>U%Okitd7HE)G%eV^L1up)xra+m_JPR4U>z*)UCr?hpW|H8mc|* za#^UV%Pthxxgl1l~M*d0Z* z#93MWXaQrp>f(+gWY`Gd5X`c@1$_jwsXPUJ1^oo01!DyL1p@>_1;Ydb1%m{G1w)9; ze&vykR*UD2P!~G(kC4=n!rzVIf)Rp|f>9b(a&MWD^2|t~j%6RcDeB((Siv~K6v0$7 zvv3mx6UlpIi6HBPk<#T0CsGi0R970lyF3c*_PiC}?XsbHC4q2Ld}BEe!&hv(;w6dnuzreFFJ z!IEl9KO7w?|MA9h!3x1Dik@I4JGxvh8H}@Z<|#Ew5xm?ep)W`}Y+WZwh6Ygvw|#I8s8!KdwllGql7KmNt7s+8aUxI zvPZC&Ol6~mjeX=>Y7ZM#Y#b0Aq&~D!%*G+XVZmj=6~PfQhTx>&l;D`)xZng?Vw5x+ zC8La-Df7)rm(>)7DW?Tz1Q!GsMR~|&@0=C9*f#H+;5;cmO6Uf+?80=0`$oy4E2aNp z6{CbUPcD(YODgY*e+#Y(ir6S>;~H6x%HKv|8#kzLN6Wv0n}UD-uXo(a#prf{8u<3n zl466QYM>4oNwx7J8BT}109bE(YMPC78yPm*j#jm2+88ie){mA8qyK;J++ri!hGQdX zBgaOrjgmG>*=pK+qgSCk8~H?Rj1(uiw5zoew&H(pjNCm&O4~@-Fl?C2zc0N(c{L)` zA0w8HJ@ZYmVcTe3Uh&e3ljZ`S9nQiZ`+e zb7=GYJ8ax(<2f78+qjDe+jzvrqc-lgagU9fHfq_p*T#J|s@b@o&$(2NvjomlNe>p! zsxVfWgQ#w!hK*Oo3LmdkPHh_x*m%&!LpI*nn!!<{<5;OX~3Ar3ZPw(*vYw~4Tg7fu#>)y8W? zb)39APF~m4W0C(6a~+?0Non=QHr}++Ohe`?Bk$OFS7-Rh#(Op|v?e~VK_uU|QKCkE z_i@6IE_y%Yrw0@RoJv*w)x^f9Homd(t&PuYd~V|l8(-S$_nhaAM_11|JWjI5EByc3 zR`e?k|7#uIHeSB7@x6^7$rXk1;?R6jqsqd(A8c&>LJc%c*%sRWByq;eJL836OB=0h zthcd&{AQz#jnOv7*!YQTZ=;8eo;KRq_}RuUHh#6y-bM%Z{_xb!HkxZ3I@;(qUOH(6 z#_5!E0+a+jo;Xo9Nc7rZacf;TsdAmyO;w2HO~7qmPZg zHu{kuDnsR=TG=y^G}Oq78(2J!0-rDi!qzI`%ts0KC6#&BCXPh|QC z8zXJ>nwnF0qKwjC&mGHrVQ5M)Q9c`&J(m5>j<7M$#&{bOY)rQ?!^T7#lWa`3F~wHn z7kP%y(#0iOO_ZqwSR`-$M46_c4V>)zZG#{+KpWI&56B zaoNUZ8(XNQZ5$>i5LGG}8+&bRx3R;^K?jk7k+X_&`s9Jg_TjpFz^ zSx(yE9p^K;;3*rYb>z;;!iNy*PFAbL=WSfDanZ(KWJyTs1|~9Hcu)ZJV9tAj465J5z^uo;Eh!m$p~KDKb@xvFuct zH7qN~L9T;@1H(a{gM0_Y9h7iTWvbfsI8Zv{si{KCW`tAH!Ny&Ar5u!Y@Yz&ZJ?#hZN%)ZE*6DiFrU~`x-45bnp<- zKBrp8@KFbK9X#&f2?zBYjGiWErb+g6dCbB5X~Kuu>N{wliSwj`3&+$hPt`<5LpCa* z$oR-(IgMD|V>y+l%QFt1b?~l(_Z&Ru;CTnHIe6W{3l6upQeSlNl7mL?D?DG;0AJzj zbXiv{qQ_*&KZ7(BlR^BG)(=(9FTF z4!W=j4q7<)*+F{;EgiIS(8j?}x{F)uD!lx(*YxoH%KY>@>ZozNt%G*@Qxjb~E%tP9 z(AnWJQFL_B?^&ypqZUysP0s76Gti^Tpc&Htcy?C@zd7jbppS!Y4!S$&;h?7mwRVOa z)tP&dOIzjMm?7N`W>f33y1owRGID?ePUidR%-J)gKZSj!YGa+6B?ppqXG)0%8ABWl zbuh!hOb5f5-@!Ns;~k7}Fw(&&atk}OZrU3UW;`=ftscDhQRWzuWu}^Pk9Dx-MsYrb zIl;k12a_F4p=fL`+HI!HpDB|Z?9nyyK;2Y|^R}YX9ZYku32GCQ<_Ku?n`LJ?_}#%D z4i-6>?O=|B1r8Q!wC6gQ$M&XWQE)2vPMJ?Zm?@l_F)Tex%FmMDKhFR5Smt5}OGrQm zt0)VzWT}JY6xid&G6I>Un%v}%j4x-&3bM^C;ooT5)A?O=`f4_TUHodHiTjH-KbyYZ z!3GC@5HBtAlM0_L18iY}ZKs>0pTJ_yt5#$rk(oqJ z61hoaC9!_CP!rygM6o13tgH^gG0fKakLdi1wAHD~jjlvckgeT!9;U!@w@#Y-)W1+>{b50V;Bxd|wy6GGl zJV%z#QHV7@m(CTN6LTa?B1+=vB%Y!EPof}++DSZ+M42SYCUJKX_asp+iCdGXoJ5r* z$|rGK5|!pkr6ejOQIR#yRRI5;qwFW#UOboK<8$TqBp5RNjwJ3(f~yBT<_iDC?n>gz zxl%QW*Yzu}Ch_&&B<@S1S`zmsL9enLvL~I%nm$+PVWfHzwUW5&!L%Al)FciIbGB-* zj1YL%JgJk!gGoG*MExWlO5$Nn%(_WDLiFaT|C-8mlp23jr;q8KUN4EqlIq`?hJe19 zl>K;8g%8b>21ztb;whbtoBS1oE1$;`}_Z=d0Jo?5QN) zO5$yTnlC@hms{IeJ?G0iMBtG1p3XdezPy_R!`s&vr8V03li*SLt^?9PO42nFz931H z_#}xYNqkDSOv1UYoX%9aoWaXgnB)(4K8#XNo-VMAtU#tZR z6Rtjem*mD`28&eEDL*FBlE-MpP7>w$ZoYW#%@(p)0tuZ#7?CLB|*Vw*)~aRa@tuO2)`b3!ccUuux_s@#8|urW#Xtzi%d6y-?^HY<3cJl9->w0z&vy<|frG zGuAbaDRkbAthd`_6+4}|d7&~$#q>oaauO?&See9RX*zYE$cK@)4Ozxq&VSR66cfnJBh1FTu9Q~1pZ3m5*zzs&Yi1MaqL7Ph7db8p zyGV7xF3E5KR}Bh9UGRGCy^E!Yi{}y^Q!57j7c12? zZLus(Fw?xL-#o{cH(k>D%k}g~q zhRz@^Y!{{r%SE^QGVYs@eRV_n{5Yfgvg|qi3pqMZjU@^zUM6a^L}=iS@xVpsqA5k& zMdTuOQP)L17X>cLxVYa%br)q_lygzZ#qBO`by40$1s4@v(7N(%E`C}fPglupq9OmY zP941GnNMEfsjO?f)5Tpb`Y(|xF7D7Nt98z*F8<21?jgBc+^y3KEmgP`(LSN>b5YI3 z`G1w+BQgfV8ZK(GMi&pdYQw9Ri`p(8&;?)XmT~)1sk@Zyq#!)x;$at$xOmjXONX=R z+Mq=3QoKBM@3_1!6-&OqKJWFV@|cUqUA*t&0~b%YsPEzx7q7Z#;G&_6XIwn%qTNz? z(#2D{ibgJWrpXA6Aw~FU7t5E*-lg)Ki|1Xu$ckLN;Nn>GJT8_NE}nH|sW6_kOyTn~ z`Q(w5TRUg6J6?0~x{J45yiKw%lQcER&<|I@WJSSI&CK3XPkx?tF5nGDqsW-XI< zT)gYzJ<{q*Q99%1LoWj#GMkIfU3}r2feg|adatMMyYG-WgJ~DM#YQ)E(TI;SBSMjwQGor zp)Q8G81ACh3Zc8|N)^=KA9sPDUZJ)FM(ChQxAGRDPN7qeZ=aWT%tc$X)=F~h|K z7ZY7faxs~*qYr75Gf2 zcj~(Uth(|X^TIV{lVq-oc`g>aSfXp6?_z8#zjz~+ zrIxx_M*eiM!Ug~SNGoj5Vv`HcgYRLpi!ClLySUFal z;v%U{ekR&=#_=ZGXRZEwj%`Ddb_%cO}WdsUAEdx3H&|<+V2lc=%(b;;S?d=^l!CxW&We zm6GA%o>lVI@SIE!Svr6AD&fPNkFQeu6pc@(lSy(t zkEdI?1Ujr%PDu|8S@!7~C3y^~b>H+?SBdGt@*o~;51+46zZlHG^O=r^uB#;JDT$t` zYjiaN!%8bs1Rg>UPk5;BA@UFtPY?HcDDY6mLnRNldnoInoQGRIl=sl3V&1k@az?{R zT`jjU<(X1*`es+~P|-u>)xy~(`H-uN1YX(0ogVJ;P{qR?p4xtTWVPHlRfvB{Y|dki zi&gdT+G_c6wcPE2A+L$Gkid& zOkXXVS4$laTp{EnitCvVdz{$dQ4e+5N7d6#ua+Tg6kpZz@WqYnDaQ>?{~q)3IQwV~ zjWlL97@Eh!dks7^^zbUN^6;dGMjl@9@S=yOJUs2;ISpBj=CjR9mA^dX~tv zR5P(}iVAma4rJz1@xJ6?RT^IQ@Cu8sQLCEFP~o1O<}I?Tq-MSD;SCROdw7S)duZ(8 zO%HE*_-u^~TqCpB$e}grc3#$6HAP{;cRjr4;e8JuP%sZ>azx|NT#7aqd+%H;4c00& zKKAg5hnXH`d1&I{QxBaz{6d&y1`o|VG-ty-eCgpk58r$A+KI2p+aA8v1l-cc{Bf=H zT`N2*{<{XaZLJhpk@H(Az^d58XZVAi*`xJ=Q5~xnRX#6>2$_9lK8Ycx4T>%y4m?IO}DghZ^hU)5sb`LPged>t!ef%ELGh<2?-bF!Y1MqdbiE zFhW;EQy3#XFeHRA9&PsKaEzzJzy9uFwugNl_IsG)VXlYu9yWNG=V88wr7Y`V zfro`27PD#8GaB-1p}M~T}YuWgXt8)T!0P3&|JyQ%*@Z1J$w!!{2*PQaX{ zmz18fLAEn-gY2ZNt<2g%T`@eJcUAcHPYt~0W9qE+mHH{eDx~i5u$TIwSlZ2c8Qfa- zHp&4H2R;1d;gW|#9u9jr?ct1vBOZ==IPT#DwZ}$P*D((dZ&bE5Dy}JXl7h2QDYu(L z%~QIT?{%KD>>&Mmo{A__?N$A^@HlRxT<}1n85ecP^vjHRxalFq$KM{Vdick~zq;%- z62ErZ;cF$Xa|j^0>Su7e#UhI~$}hQAO8KmMee)^Zg?tqDk>(@aN2;$j!TA*N0bdOS z+ciEsCs5SqS&3|AEkVRJ|Z8beI$I?J{%v057UR`Ls*5j*Z19<8R}BffvlBd(`%;W z(p_>=*X8>Ne7HW!ZxYW3pEq^w4c%0#l#buzx7sAJj{;`!ahs1aKFazi=i^o%pZFQ8 zHc4Ju+OB4$_id6}HVbF_$F~-);G?3CN7gI}`BzT$4s$H*a7M^gp!^fRI z9`f<9kGp(S^-u5oH1zSLkGekU`FPC7<34yW=|8jT zH0@=5nfru~rDwC)*Y$lgAd;msXzz#*BaM7K<>Of&&uNsN_Hp>4mGx-JXMFW9pJiuW z-z*c^_~2c!OQM zMgHfbF?+dK8Yhi(Y0B`@(V|?vdGSgqdMtg{$9q2B_wj*dHqPZZ*l|k3g~X~`gqLUO z&gNs)LHNSQmp+>K_|(T|K0f#H^%nW%fm}{qhHgtI=H<0nus&Oa$J)Q*S0CT_ShGd_ zhf=283z-bbrQiGb!AA!l9ew=hqp6P;K3cMA^a|voIccaT0JB;t)wgw5W-A}9eYEw_ z&c}r<(uOoYV^rQM&%BralaHc0@-y4JRk6h6tY-WES1ALtJamL3$AA@`>^Re8=U>`%sJU(Xn80uq~kFh?+X~Z~|4fioZ$L&}0 zNBS7$W3+x9qeB|KD}?*r)l* z4A)e$_pG6xGFHq$L~Jo`&i&(wvRbJ=K7eYEBd8LcBP?e{`uwUY>sr? z-FUhnccG6zd@S;@*vFsS&*{b1x zp9P@G9$9^9Nd>o=EX&}|l zq#vY`sVTBUVLP*Yf{NvEm+T|@>row!xhwaCkCT)g9{y)TOd*$&$an3K{`qReIqTyb z(GHLw;5?boM@oP~0WSLZ%f~ez*L_^_ahW>b$5kJ^X?}$aaA($wy3)>2v(pcDNU5|e zT5iAL;~$@%yKz(3-fo9-fiz3!9P?7nnjJ#^FB~8>KvsZafl~VjP$WRn03S_PzK@xb z7J$p$nE}!RWCUvYZto7ca!Cy+AAYY!s9OSL2gnJK8z>LX+>N5DT)rUvn}&IpbzKkC zPc0sxM1U|r6rf~)QUN4@9iVi8L;y2@6<|}9G=o*_RMd;~hB#S;!zDv*Z8!mv0lWZy z09t$_BVKK=}ZjcS@6*Y2|c5 z=A5%rcI{NhnRunT{9{(d0F?q%(O+*5P&q*DKc!2H{0pq>PwD@s;^A{)#_U^4-W8x~ zfS*FN4RLpXdjf0@uqD8~0q$dZfVKgu1-L)Js{vjMP(47601W~(3{W#btpE=Pc!cl+ zJP_a^Qsd1OGCbkeVg5hmhd<@P01NA?F6j2BjQ>*}4Ny10;{l!su;EWdB|h~6Jf^Wd z|9>g<0~Ft-z7FqGi1t#R4A3aR3nWf}rvf}3;Msr&{7`0>+`CIzWqc;Um`r8CgGHVv zi5|1=>zdzSm++@-)|}Lr0=!Iu&}k;8rn}^o0Dl)GnrZm22Y4gE=K;PT0s$Hact5}g z0p1MoR)BW{ycgh=ZdQ+7>N@S)0p1DFv12J-aAtVtjPzSR&#w1HIxp9JNM;N0aez+( z462hcc9-yvfdAdJ(B33Kyj!U4KMn9%fYrO?#4btSty=eGfUg4l7@%o@uLC-0z;^+@ zCy{HWeH*Bs#EWNh-n~W5$+HfJp(`2j~!>Pk_E`RDezax&-LTwiiR^0KWvB zO(}YEXdALy*6$YXO>ofpEkHM&-ZMb=0Bj?r>E>=Zv0His=y!h}BP`V`!1W^1TZeq@ z7odNDp#g@mT>+~L}-6-eU+;nQ--zfrnWka4dTZ1J^&R&@pU_P}6SvtV$dljBd z_e%G@GHI`HY5I=Tp#0^i$-zRtPlZN|*Q{2@7 z)&y8jap3xoF3bJs9{UvVb^7%)9Urq#HWJ!CA>(Zd)X2rftE~aHQ9p#J5Mq0P9RU!c zNQj*Q{tR%A>X#@5*d5?#fMWsnkn#Zz1USf0gWX3B(?5SdDcmUY#y%;CG7kmHbI=iH z_$z1Xvb@6@hy4Ar`iS~xJRaagfRh1EQOe5Y@Pu~N{qoFyIUV2(wbP08UHj$Z{c@Is z+Amb3o%HJkD*pig2DlmEuKU#pErOk_V;sK}m!#LIfeg5M~G~gdM`sC^b8% z+9*2S{h;hSC`kf5BwmOs1(~i6FCP>?#Hw8>JY&hsQHVH1L5MP;a{E=`kkB+K)60e^ z7oy%F`TUUF8e)F6lI258%P!ofT1m!-A1?Y>GOJ>UN+Dhh@e(N$qH>4_Lp&6sN{Bl` z+#BM)5O;>Si#k8VJ)ydH#+@JnuNvZ6C>nM?q!6BUNY)&ZY9a0qQ7c4kjeqqJ?L4by zh#LC!fX;dKkkBIN10lS_LZfyx*-ayybwWITSd6=J9}e+Ihz21VhIlkYUE&|&F z!Xdb@wsAq;a~k0DAzlb^@UX)F)+(w|rH-ih%OPF~(ImvDAzlsfT8MW-yc^>65O0L| zC!_G2y7;?~7W$u#aI3d*h>E)GTRP?K5d0Sy3N^aD7vlX8A25Z4JtBQtThw4QlK&9_ z9ue+|Fwe&!J_*tKN@hx!aq3nz0)7_a^AJCT_%Xy6A->dLzYo=@^p%c(8{+E_-|+b- z_uC`V{)q73?Yj^Ij|d++dYFGi{T(z7(JVys5G~lnb<=o7l(lnxyQK!gE!x&0T7_zg zOTpQ3MB3=|es$Cee7g`olPe-rj?g|thY)*0>qe2YQh@Chpg9+-W3<)ujrF71wEiJ~|e~>pk#E1|hL*@OaA^i{) zQC;78NFi?Gj0rI|#FP+ILyQYCKE$LDlS51h@phcmuBN(UI8j%@D*)f^^WGuS(;a%SrMzaCTAPCF(Wj>%zK2s~}h4KXjox)AFrbRiam zSRP_Uh=n2k2(g5EBUCmJ7E!Alm&GB@X$Y0HLt&2HcV8%4`?;KDB=3dvO2=g-B|XGy zN+0j+92ahcF|4~wDX}#n)`seTmJfaWZ3wY3#15+T5S!SiA-06r8lqa^v_s8LedJ zYKUtgZp_KOPT8cSq@~@^ts8zqb{|duH^fcq6DSS;0YUW!{os>^c(kpaY zUWEJzr6QD$l&lqx)b+Zumr_eaC>g1>tZpY|@<}D9Gy#{;K#U0gopPs_VKY*`h8z7a z$By7cC=;P6;6+$`Qgznp5A*y8frha4q~x7aiE)Gqr{w!n!aJJ}p5o}N zTKD=XDHq|^NbS_z7Aezn<#l?E{W)~f!AaV%Q&J&9#R!#jI?W6cAPZKBa0jJ6LWc-< zMz|}&TM^!lP&LBc5uS|DD8fAv?v3zZgoh&B7ol2&8WCzn*lgWti4^PX(5gv)~ScJ!QA~)P0jZinj$q~6Ne^JYl^>lj6 z$8(;D&^bG&0l%J>`Z|$2JIp|iZ5Sz@VdSX@Pe*tq!mAOUiSTTM=OR4MDk^2XeOfiM z>1lZ(!iy39IxT(djF%$39HH?2`MmALxf2~>{Bc@#oR-%jydL2V))Ha$={*08R6V1L zH#{SaBfNV?x}1@lKWD!gfnmw+);mm$@Lh!OBfJ;k{fO(;_$KJ=a3C2t!srNN*s~Fa=ue{}<%w*lmbDQPhD8`o zYU}(g!UzwWjg0W$ku#=nt#53EaS?u4RA@Yre?=Xw$>@>IHvW2ECTN)R=cG)IFeSp0 z2umYOjW8|3oCtHtGs9D-lL8TDN0<>|CL!p$W>Golf5}7o_0bk;9hGOl=V^e8D6~R#!*0bHX0PRi{$x*4G%DhSir5`t4?DCR2A0F#2>U3EW$;89?5FaNP_6*C7T{on zLu8d0KgT#sMMo_WUHi zT#$1S&PTWq;iATW%mrC~L0bEIeJsLdop>q2=?lV#MKHH;>fFLtBV41j#z>8EJ;IF$ zDKQGg%7@WETG#!n3trz^=%$Vw*{+mN+C@oUpdvo6pT#H=BP~XHtoEQEy{K5CX#D@z z2Qp%%FtcJ5Bg|N-(;|8defy%q;g%TLI1fSuvJJKZv*QI|NlinrDv11C9n(^{+V|X$A z7ZlG#w#&ijd4$mdt*EiqkfG0VpNM! zBSy^__s6KNi+nauT?f1KFNIQ*zob@-+A-?Js2Agb70aSQo5ynCMSxFjMeF!D)0u`W9+q+IqjR}KOST8Uvm5}X%M4fjAvpz8{^3sjbc0% z<7wTeM1W&);Y&)DIhTY-7j~A-e=f%JFz~Q){gJD+&&u-st;eM)lu>c=apYX-&`6k~Xd5ithGYDH*BjG>g% zE3){CP|=;bQfQcNo&A&&ijjm9V;spCEBmOsugK^aH?PQ;7-QLqYqDvomyc9PpAf65 z+G~HSf2D~rCdDZIx5ATQmA_?bjA=1e#aJCA$Jh{Kqb{!;Tgdc_KGO96Nd|G#mTyNygNGFScV^SWz( z0g4wOQ2?U=B??fo0Hq30x&Y{uGvb>1%UE7o3Bf?YB?17MuW1?URTRF?hR#EvrYjXEI_>iJXU~*3h;0N>gu-8YFy15 z@`#SpI?AIu;y1U-7NqSipYeDBo+v7?6=q#JsgI+&a@0T~^$pY-w_wgGQ z;3+V7UbgOQXKUC2HyB}rg(5*MkjkDie+*T0n3g4b~- zF*b?qXUfg9=bt<)$7a_jaYGW1C-DTUGKm|LxI2j%NlZ>+3QL{DZAsje z#MC5iPU03S!|H++XUngzQT9KrCYd4IBsDE5|Hn(#X5OB}9Z9<5#+^wVI$Qo=clkS< zcCP%(b6Iy$i_VpEnexQUv>DCPXOg8P9!%n)BxWUXZxXYUcpwROMjN!meatZ{`+k;P zc}}}&N0whTF)t&t$2rOW!)!0A>~oTMQ~{5jlhd$!^3cCXHoeD^SgtVVCNVFGg-N`W z#FI%pmBjN&%x5l1JfjkFgio&^&$3)+vv_viQ_%4Y(NqkS$RbO|r;XGYHaq$m* zFEyuH_Kz%Sn)pExU#M`RBXT`-UlPA0@oN(M)u)^4X8-th&g$C|A6J$BZ+V>Un>2BV zg-zmA5~q_mlEl#@{z&3v633D_p2UeHeow+mm!v33}F1Y*pmvr${heVSM!LH$-B+ev}p&?Vl*(A;-k)|PC!}%oc`a5q}hTwWimkde& zGFPg-U%iZzQP5CDLzaeYO=@Q4g~gLHM2;pqCdTAy_{WiJVR;JSSw*3mh5`+q246!$ zL!pMo8k%S*(on3ST!YY1T|*5Gr5egK)YP!*RDLZDB^o|f6h?L|uB`~x(Lng^_Qmy% z$eUhy2JKLW$juaV{!>>&Jq-;sG*p=NHL%iYLd*Y={4~s>IcqviNDOa%@G=(co(MWo#h_3Ev-)UcqN7gg`^c zR2tpSBGM3RXrZB{hLpzZ$k9wgbCvv+OtDp6Ps7pI7nx#I_XLM1tu(aO&_+XB4f`_1 zsZ7C{jVY%SJh#ZKiy($gDCnS}qlRu8y0fyDq;=BJMMGEe4AEHwmrIDrhtzsN-1G?cKh6aJPmTtd5f0%0V&#HiX^Pq+y?>;a&~*X?P(^ypttn<&^g~5)Wv2 zP{U&y9;dDz$$Ut|qZ;OD^o58=Sj!C((D0&$1sWD= zIFKdSSMK~KhrZKaQl%))mQr1$;brRBH_|l|T{JUhiH4;bUeoY8c~f3i!%shqvK25~Dg1;V1AF){uSJu-eXxPB4v&Ba&wZh?l=qD-( zZzLzqMg`N&+GiR**YLfDy=*BOzSQuIhOHVlYuKXUD-B;O%zfD+nIrn}$&edYXeh48 z5mbh48ot%AL&J7rw#>dKM@s3khWR^Hs@)oPY50z9L7m0Ex49hF?$JQ+b38!zNHOyAs})BY4N|!EGg(x#Eq1`RO_`bY$v)j*?vA zpBeL>#$hxrg_YrVy6kcRi*mu*Sr_=gsa2TQK6%m4xeo62z5j{KF$+7Ov;n6RGwJJ zk;eO)U})Bp_M{wmM@0p3yuL8(^kc_Q(=66 zK}Q{(bd1$;iH^=Xy3l&-=&z%zj&3@7l9Vnl-QZ;q-F5WPF*9HAx($;0e0@=G9es54 zr37@W$QRt-m62EY!K$*Ui*tDXabv#tK3`m@V}Op4I!3W{3)2Sb7@}jSjzNln!7BVa zUrLY9Fdf5nJTkHHu5?+moEaFQ5I9RSTE|5?F4i$dM`=~T&06eg>BEXU33=+_e>yjx z=Thu9EzG=B$7MRM({a6y%UK;duF)}G$CWzP7UL=%|<3=5mbxdJ$9p6?J-2F?2 zPgIo!VM}KP?O9ZEiw@q(ce{=|bWGE6tB%`LamtR!k;Cd=rIPT1DxRsC&O%iacdD-w zt4S4|K~Yor4HOx;N5?E3n{<4p<6a&2=~%4e6&?5Mn62X(9nb1`K*xhRp3pH@$3r?E z)-i{Tg~C)cnbAYl#G|YTwMNPQg1cUqR}+t`uOC&DY|qp2q%%q zzpGgwXrP|c@w|=&IuABTObL(q+^kem)V;B%%jIS z#vFRH=63aI3F}M88XfQGcvZ(T9k1(nL&tI|k}lT;Uej@mn2GFVjk2pJgq;w>6JjOv zZJ4=A$J^9N9Xz)4mSXtkgv^dz&uZ1)&$Q3JCMUmrLGD@|>vVjmW4(@db-JR$lj-TEa267IG)RM~WKz#824n6ud!&2U60aZdC9CPZoTt%l{w(pX>NS z$5FDX<4YZzb?nvggN`jazS6Nn$4(tz>-a{;Hk#9!X@Au!S(*^sleU%2IMV;Xb|y@S zZ%OA!9!L0GjAll=bbO~{H>@-nq5g@T6-f7J1lj{Q_u z9Y5>Xr{fpu8x2>Xl*S#$@&>Ic?aKwhT{(RV#me9`KO#^$a|nDs42;uYDH2R%p$?Y-m^$lHBik!fq{e}-Fb0~Z%*r?8;S&fIawBN zf3=Sl6dR~+V32{q25K0nX`qdPwgze$C^29f+zN%-2I?4SXrPgSQUhfM>KkZapj`1& z&yY=97^rLTyq;{}d6!^*)CKM}AEI0jM%Dh#*=JOhD&P-X2K7+WlOn#n5`b~1hWz1Ti6*^XvaeXQOro2C?gn~r5$f9V-iveSQ|nx@s8d~x ztuA^S=wskQ0|N~7HPFvMe?uH*kZ2 zYYdDxFu}k?Me64lOQzHiD{BZ2LO!V>u2nj)yN0;V07FukWZ*^vlMPH!>dO5UoN(rh z%}pvf5t21U_bxK8TMSGy@Q{Ir4X&=@HiJt=m}%g4R-b|C2JWOZYD$_dmK1QPHln8B zs>fYa)U51`CV6)oy!Ksi;rku}2JUAqb0+{vDR+Ey=sGkX_Zc{%ZrYu#6y^Z~53=pl z6l^toXi^?A@Th?&49qn!he|?iRD8at@@3Y%d~<6}ak!?K$L40>8C5|UwZv0w6tzTL zOFYebX^`NKCz$*rp70$_6i=mpkyu8vP2LVTOz7I zUplQs@YE;ie_-H41M3Z({zd+k@Oi96ym~b2BLg3+w6B&(HZ~gg)WBW?KN#3#;4=eX zlMMr(8~B0^umGDC^7<0-r2@X#leKCMiL#d`7yoGBCj zG%u$Vwd-q3iP75_2Q~!WtS!zNIIljXnQ|hR!-ik>XT8c0vt4ec37Dv5qQpcM z6Imv5P2`!l@^D_ZDaRP>rjOMYIVLYJ6V>X7d=phobgLt1nPtCVqQJz;4F%lH6V(w3 z6OEhI;8Uo8A{7>^u(}FssIaCAr}oIGZK95eaudSDweOXcnz9?Zr;aF7z^FR1EW9Ic zNgdJjWP-bN>YHd_qNRyeCK{S(WWqNQkeZ1mCNvYeDLYdd&!&n3lP4AMK^(bvuhlAVZK92dt`wJvwkFz{Xm6qe+i9ub(gy2-cfEBqamC)U&Wi0$ zicY*zR@|BNL>Ki+pu344CVHCaW#Yq9+3S5@D*7LlXiK^moh+6AJAF;`V||%;*u(`U z`kT1k#0@4cG%N*onJ~1;Us933ErPF!UXk} z%VC_TX;miWFxtdLil2*BIJQjwt}>opdZ>P5Oj<+2u@qxPDZZ{h`0j$r9C z_8ArbBI&$PzK~|0Rd70U0WHRM=?ZC)V*X_nt}GWv%H>Q5=`1m^)WmBhUN`B?9Lr2B zH?e~4NC@8C#LIe!Q+WYXMpDR$bApuK3)<7bd8!?#l%-s)VgA= zmpknS*+BS=tDil&uHYbHtBGwUPm1AN5=>7#SXY)}eqFJ}N^m>G4ih`sG-gY&)Aj$Q z2lIBD*kfX%3skD%7;U^P6oA`~YZepK_UrZb^aa6JWtBFG< z4x8A|#`|;m0TTyJtgS1)sw@6cS@W1DeQPkg!g`XEVEO^{?t%_r%n9BX0BpLfxtOs#?LFvY~`D=Y<)qR1%~75 ziC)j8XIg-T)xXPv(+zbM3#~c0O6IVEI;`iEL><|fCb+| zV4;(R&K5!ok%hJv+F6J#q%1VI(85B6%C}v8$#XLWTlK}73G!4DL=yM-QkD3q+kA0ZZwq}a^tI4Wp>g7o4=2MfP_MPsxPtliSFaoDi-8sfSr}*GY72uc46$&L zg^Mi=wJ^-WNDHGB=J;bd!!6m3j!>^oXZg1^{G}ZB1taH{ji&yqQjg(R3s+jWN}-Ll zaH)mMEL>vYy;E|baMszZ%US82b57S6S6JXq=1Q0cgh#E+snI~tZ4{5$USnarg-I4} zv@pTKL<`qjxWNMb)n9ATcZZblbt(%sYQmKR8?KK~Vf;7JCtH|e;Up9)g$FD=XyGBnWaUPqO%24u79O$i z@HMi5KdL^>q39Zjve|MrgTSaoIZu#n3olt%WMLjwLaQ z=KhR@XPLZ%JYh}!Ki@#iXO4~XU$n5m!VBc8q2NQzg;bk{VyuFB<2>P)EiAV1iiIVr zTAAvWhJx!#yq=!^^WRdFrOPZVXZy17frS+;orP5v-nQ_%g*Pm`W#Q1$bP9x8@km3l z(!!gH6g}0fY$&L58ykw%7S>o;Yhj%#>^myt=(_TmjRZ%tbbrC{>z?I5)WjyXTnnGGn7SNb zlcfcX#Mh0)iAG|xg)J72S~zCmD+^y+_>m^s!Z#MSTG(k}mxXP#1{S`xu)~te_oTpM zj|_7gi}J>T2DzfK_|C#^3wvlWER48F_HH$9kvD{nZ7gnWEcRMh*tl>}WAOtkuCbK) z&ldJs*l*#0D)lcGepSGB| zxA2>Vvlh--IAP&;3#Tlcw(tjyzlFan{B7Y+^7dCbx5rOwBE~e4xpVKXoT+OfZatpE z-;m}%r!)M=!WqTGZiRE+LYj>{8~HZUZDiQUv;i9@)z`wNqGeOTF1U(~99vF7WZB5J zr7`c@RD7)EO|MlWSG`VbDs!xAqneEZ8wp#EL%0&ehw*%Pc{XX2ubO~vrT#ZP_H=Z8;}%)ndGXZh;5{7RM=>yIGNC~=Iz_% zUtx0_EmX`yNx`d28M8V!r}*i#)?~m&FB`pWw6)RBMrRvcY~IU;4mLX4=w$Quz{1Mi zDXn&=2V14B;9d)MZC!12v(eo~51YFw#FnJkuQ(?{PaA9(vo<8oB}IKr^s&*`#!wr> zZ1l5nfsKJS2HEIu%ilegVwxr{v@yWu;<7Bed^9nbWHr%P7rbj}h+;lXmtTk57-8dL z8)H=DNE;6v%^z*c?qHM(S=|?@PrPTDe`M@}d+MTD)#|tSWtZ5v)W!@OGi_XE<8m9< z*|^@u6*jK4akY(WY+Pl76TIVW`8P3ZbLMcB=_D17w=u!SL`8hQE_mFA_tamjUR&Rq z&AYU2urbNTtu}76aifjNHm2IR+2-7@9FQN>#S|MiDg1OpmZgmfZ?VBSmT5NUAq5}C z(_!!JHtw`>7q!L4bTaloX=9zES#;aWrR2NG{N!R5dD2&MU&lQ*X4!bc##|fs+PKfg zgRBCQRe8;(h-@smGHsS2Mt+&kF&L9@QT1UPkJxz3#^Y4`R3XbQC!Wl@uZFUoYJxJl#QotJY(Zo8?C1maMd7pUrnAZr3HS@mXo4~4Dq~;4-CPF z6kfEkz{WxwFDaHdo6Yrwt4G%Q;X|LpBcEc-6)-8yjqV zVq>|D6*ksTH*CCS<8>Qv*;r+R{@LEJvC_tyY^tWX^SJ^xI`$wOx6?N)XZ7D^`(2y4 zn)Pdn>87w>l|oo+W1WrlHa@cPE{kmAee$e09KKVU?p3BpOXOCzuMcfr7AEZ^)nmp_ zlIM?Y&>JCZVWZ8f6|sk}Ha6M#%*J*K!N%t{zOeC?jjyQ#iY!TOR>1G3*kXfEO-stB zvGwoo>NhsF+Sta%rQ-SN(rdDJ*w|^~I~%)I+FdjY>S$->L?3a+TY{(IxLJ3vjUTAM zWYxxxHh!|DFBERtr^j-l9lo_-M)x|u(0HY#~4t}$7f|l9FpOs~?@ds@Pdksr`WQi~Dm%Z>`HvYD8#>QEt z52tMWLp$c?pH@lstI~a%o1MQW?VKgf(X6#7#Lp9_80|P{%>3gEEEC#S!Bi$stDw zT&5vFk2G~1)N|0-K@&$hhUF|leFqI3G*n4gDg0NWL*PaZ7{1Xlx2c1q1I>Z%;Aux> zX38dZ=wKcC^dNBYA=yGL2eyNc9DMA+ao{?*#lbWOo&(>(a0eqC1P($6-5hjx5IKk) zv~|$VLCQgeBd7aXDF&K3XyM?RVl-E;bW_7z__S27^Q`>V4tV05F>O@Ln~rGDtM|Lb!h##afQd~iTtZ0+W0b6e+NhArww#4NRhhG!2kv1x`KCF4R$bupMK9D=AgbS zWj<7Wjc$~k-2@dg(!nSPS2-BxV6=ma$gP7*C})K^hM|K;6y{o2eC~=LTv5XlmpXD^ z`ehC-XV>ouR?x&Cr>@xLsas$#e< zMoX3Mi(4Js=HLZp!LJVPaPXjmha60IaHoTr4(@SqmxH?**(iSorMf?>mM_K9%$GxD z_Qu}&wVWB`Mmp8IP;|3Hu*o5s<>a-!xWB#CmlTH;86#296ave z30B#giO2X!p-ocZj7EvM4xWEHr^-R8Jo6l^Q1MSYc!u!~<~yLH5`N+U?^$x#Ir}-v zR&BS~sWADeZXg!0c{*6>;7tcFIauW2RR_x)yzF4HgC!1@s?xpU$T1ri={7IVBv26u z9-G?uNTK<14mY$fS8`iH?Fw=`)+u|_h(ckl+=MIZ&jhrnA7R!KT|-@)4sRy$bZ z;2pjO#dY*tcDU4GVyd->@Rm%C|b$=3sXq{tN^|#_w>j)4_L)bg*l3f}`JEtmtNCjZR3O z`6NQoI27GNv6pR`Svc57VUAAwkyc_}+D{Iy3&j=VA%&^VA-i%J6$oU&QRbrDMO{}m!_MlHQ23WBxSmU6g^5vdT23KV=-BB*BNvTbm@X_AO>}l&g^QLhDoDgdbNAoF*Yv$cQ_qAa)UJ|NE?T?joE z9C}u1N8z;1Ztuz~sOogA`ReV;Xz(nsDrS?EXq%Ff7uWT zelB{sn359Z&zJRfF;C(5QOVy|@C7b7)EHg&65#6jS+_>tnQwi>N;y?(%T4i!m<#aB-5E zx)|$XzKa)JT;k$V7t@L6;xZSPySUNCWEWRZyez(pYh7IBVw{U>T#RQaD#X<++M2}l zjQqzdWU1d(VFJ%Na3S4sNe%CQC$ypKm4}buq`qQ>+&kk0~Y}r(jhDaYrT5=CXm@C^zBHbMd6o z4PGS8&92;3%)i=aTs+UnQfZE!b@7~{FzC#`eb5KZ#EUK#xcJ<~7u0+gFS&Tz#cCIe zT)gb!4Hqk2EOzmVi{&m>sC<_wC0XjqEuGxc@~VqvRH_L%L2-5M>g==kKihWWP=TQdi$}@s?s>m5Wo&1lPDJx=KHj+~U5*#XBxOa`CZ?wJz4V_|V0A7w@t; zRFOmd_g%cFl2>gm<@14pN3D^R&vwk_Es*Kw^7mUg8>nxbrFXH3Qe{OPDA}kmIf!l0 zTy6tyu9APo$VB$$6X{>N*zDp57eBh#;^He8J6!B^@wJO@sLw98F^mMye6h>BxVf0y zT#ih(yZDv`SEP21mj8geSWFk+yV$F;+wFovSl+65eRHvg1yPuL_7rd*NbhF3`Q*-(!N?qhSv1i!<+Qt@wK=(yC+m;m`p@kfq zcGSf&HuDxz8pnC=xP>@DR`aueQw&U1@xLp0O^Lj0nimgkJp9cnppEs=(8FmL z|G3EZkmKQui?cNE9x^?gb8+59nul~xRi)C&MJ?pQed8r%WP@4+>P@le}CzK5zF3Oy8gJV`D8yQ`_R1s)O}y^_jOaBBL`7UJ=B1;rk$ zmK+nJy27d2Qhu%Jp_YdZ3Z~x!#?Opv@>!D0xlBIDi#RzU)^Dv~P;BirI>EZMg z|HA5dsIPElDGH4|H1^R$U{u2J}ot5e@pRgC?zwmc3CqI%{{d6 z&{DBPjbhh4=5S6c5B(OG)@UWm%je$D)7yGzN6YD9jED9tzK1>@`g-W-p_9k;N_6+o z*+Ul(T@@*-mFUt+TIO-B#J!464-Y*(^zzVKA+-04DEwzziEBD!(@il?7O)}r^KgNO zp&oBJM1Kz#dKgRrdib!F7{FR+E$AD6poc*oc#Q7XR-(<3+;go2_a~4^E=Jp}#c&TJ zJdE~m5jkls=CqbY80ks(o}(zws@a^qr`>zAwcM6@ifhpPRj3{T&WBbu4dxw0kA(#Ct3;Nf}?H+Y!n;oyMc zYgIxnsuKS?Rpjl88KzzFWbp|FPxdgy!&DD9D}>4c+f537Bdz=v57Ru{>ftsI^lkNV z^=z@DAis^Ee$w+2rFXlBJ3LJHKy$}`QiiSDh`T+^pu+pe_c7DMJsv({qoAsIxYxr= z9u|4H&%^y5=6QJ1!)y-^czD>uBdXL7QqE)39`ZoHA}lYNAJj%X${KH%F~`GW9M&bH4f{OiO8=2S39u|9e$HQ6=uXtGEVY!DD9+rA| zRi#}HTdFt63c?o}UQ3_(|%{CvnKbVGpNhu00&_aMZ&e9!`2V=Ha-96U@cHAMYi8V@cJtv(sLd;&-;$_M*}Q z`JWzY9O7yS{-)h%Ajbf7C`7+K1n4vQADSr-X+D1(aF#lmhjTQ`Y=-TnJ`iU{d)cU; zZ!a=@WctYRk?jLMxaj{8*>=nL$6dvjw`>#0@nyeo^Y&c!%j{=!`I^Y)c&Vz7YCih< z=;x!rN5Y5c!}3w+qsZs&ji~3N*hh6AB|d8VsNtigk6J!v??|JlPcM^q!F+M5#@Vgu z^u$%iN2xEZM46ADRe5td2(F)U;8E_QPX{4XNKWeeXyBuXkESf(;qm_@=J|?Re zMz-{`>f-*pz{UBq=@viUFqm;s*g z@vM(SJ`VeM&d2jUKJ)RpkNH$8AFug%-N%bQ7WllM4olgT)@CmBvB<~Es!hGbcr+H{lp{JxJ5 ze0;*@>ElBm>lFgsWO2{QM?OCGu|e@RK#^T=QTdc^f+4f`)R!aJOQ#f)|4phr@@(1{ zKECv^+s7Usn|*BYvE9eFKECqtwU2KUao%{#23z@SPdZzDY*XDrTO|<#nkRDrP27J z@-ZEY_WL;CUhBL3l(MOnY(&^a5EU)WvzxK!%cDHdm0;XexDv;NUt%i-?*-9?T<;Md$h>J0x$ zs|KhRpge#GP!J#ypn8BB0SXmnQGntA&GO|Y5LzULe4gtrY6hr9vH@xb_~<_l&vX|& zK2X*}u0GcZP#T~tkiLAm&w)ct{#VuwP%l8k0F46F52Vix{?Rm08TmZ~8Ky029H2>n zrU8?Pg%>{f1(Gtyocn+3SbAgDZtbKP5?K+g#iWx@B;V& z+6U+mAP5i!XhUWKL;>OetpcSK&*oq;m52kfA=hd{ltZ0miWG>I#zjJ*5CI zV%d9&i&e;1`LJd;7mOuY0V+=Aor?G zR+`Bx4=4w!=*p}lK|5L%m^?uK;vGbxKHk# z0q#@fXi_9nDTpBkfrIf13VDmKE=<{(wzG#Qaizu!Yo>+UP8aB zoObVF3R59G8Q{?Xb65)jo(OomUoL0wiTPLnrX~G>y~NxAv<%nw67vG=eY?i%_ZOaN zrKnBGcqYKJ0bU8PB*1e4r^>N_DjmpOQu716SeZpH@q(hpA2enytAppi0xSyfvO?gU z3+#p#2l%*`tUjh?xHQ140bURAMu24jmMhHHRCutLc%(dcg`&yf$9a`%Wq>yWtP1e9 z!g-65ZzNTv_U5cgv$mRzSM}y=6asJmVQsDp@Gdno#DyW=3%Edlsv)X{_#nWC0rm$t z5MVtGLV&LWd_xWcYzVL^z-NlcC#?MdpHc~H%iG_0B`$MhgDUAQJ`eCkfGq*OQkY*- zXR@UWvdwJB&(z?P`9k@qr{&6fQ9`!0tpT=Cya9d)usy)H0d@uWF2D{lFt0G^EvJ{PGB-%WiOUif_g{-W-o@^E+AKQ-33i0DlBH8Q?e#=~g+UKcOW5TL2mmY6vC# zyUJowZ?S>7B(muM^R4=2e+M`f;BAVgt^q7daFM2O-L)kD+@QKIsyp~9LWDm$-zeMITYMYUCAX^65A zbwXtJ74x@9vs0(9%XV4@B zuP5VV2sf2A4Ur5nqNBVlfO{bbJkeJeAxxE>7s3i*hv0c<=CZRxxf8-wp9nMNGnG4m zt3E9VLqs9EgyrxI2+se97{%J(S)Ldyo6qPF7l+u~ zPh6z3o2zmu&yi&r8{!gbNQlcq)Lbf0y)lwYf%HpBfKT29;>r+Lg_saxVu*1et`2cc zi1Dn`49OuM_X5d0#mI2L1>)L}%W9JN^-S1Ut_9qhj=8!qYCqZ5D$iUD8#(} z;*P_K<^5%G9uDzYfAOq3Pt6{7PKd`sJRahO8_S=z%by4_S5*^d3pp=6FT|6I6k%RP z_p_q#3=u-S9b$Ee=R!Oma#az_Ld++T5HE#T6yn7Y3sk~|Y)2Q$e7T8wNR{%A7m7#eieZwcS7$C~qYm*#h?OCJeLU?oCV43B^$^g!#>uBdgd>GO}Wg(0IZe{6I zSTaDo{~xfPGWjR%qYxjfnA8BVK>-_8NV1v0sBlwh4PGqH)y8i^Imn?&;mr2-5Z|&tilu_>2(dH74-tNh zuq(uOA^JzSFv9K-duYKTltlPG#NH5RL!2XKh#x~732`*UPox>*K!}4O_J#O`atpDa z(jFjd;p$MT-?{;UM__gg5Lfh+6ZnTh9R9Cdtam=g28d%Jj)yoI;!pMIw-A5)hjT&! zzpIcQ0wx_(#Z& zkP{(2LPi8cs1nKJ%>0@eNjdQ8exz)039=&aVywy-9`MhNkQX5lp)f*zgsKs$MJR~m zNSo7!*$wk23>4h8ScyMlpeTw^9Ldpa^+>iU8l}WZ`E}VqQ6oal=-+d=yko9*ggOzL zM`%I(2xSq>2v&sh2qHq$2+0U_Bh-t~I6{+1j*;p|Xr!`k5OEb-&Qp={@hw@~2MYF* zoafZ>1NS$TG4 zKmOf{^e93_gk}-0A0*-k%qtbi@%FN8IRv6FDTa3s5-lUNiqIuO*9fg6w29C@LI;)U zf$C@*pvtxh-n$R`?{?PsLn7?VT!p!7--hlEeTOD#A+<7DX5oVQ_@05pIq!B*M@Lmq)lF z!mtR#BaC742qPkljJUf1qa*w=NDdNm2TO?&xQGaeY%Qn!VwDlM|1o}Sgi9h^8sRdM zO-WHC2aC$7`!0h8aYm*JuZ(aNr5E9b2;(AL9brPmrF^dY=Ux*@kAF-xUeSCqTaNMg z)Xh)3R>fSW!ki^?NIWURjS(hCn4%)D?k*E@ZJp!8(Td5Nh%i`eswlf9!n6oaMR+>G ztr2dEFf+nE5pJjcM7S%$-PC6xf6b;VQg^Cwjv_LHNqUsOnJ3pqD|LW3UJ-LvgnJ|0 z7vX+ZaY^nxr3temJfPCj_h5S~=fMa(^zo32VUmXx@JNJ5Bg|3oV-cSC@9X0VXrV6P zn5*DcJO~hB`C##h;^dhK&qjD5!iy1}i}1X{nXkgVg9WEg-|C+I$6&!74)4}LlZVn4 zL|CXANYx=??~hqOAI^U{!r};@M%WbLl?Y2Byd7b6gryN)jqoNL5mlWzMpzNyHPy;! zA-NVn{dqmY8{{@EyWbG;(`soel0(EwHq0TS)ex~NLgn!U{@6Y~L~6*I2=7FAkA@|} zjDzWGBdm+?F3GB|MA$V%a7Kl|2N6Du@Nt9<5l##d>s5(9V(U=8xGQD;iHan0iz($? zrP|2)dLxe&{TcI(@J+-eU3?MYONI7zgw1Sp>M!-H2wPZ#$8*?DIfSk`R8;!J|AeE5ioFrW4;3?p zik~9<%mx)>NQ`|Eexap`(Im#N5%$x-#>k3sAi}{2ry`t=a45pz2*0t&5soN=8FcQa zfZh)m98(26uEJ+NEMQ@OX9JAzSA@S6&PmqSP$_55ko+0Rd6IcU1#K*2G7jYPzJ`A& zK$`a$nK91N{+!NCi;=FnxpUN?CyLIi@N7^-e{P$b%2hBguNd*a9RU|iwI=z8HYT!T zxV*kj<(imki>cyxZ%L%CR7$Qd97(AECUvHL?ta9rG zja~zluwjfwF`5n&ZH9@9hDiz+ca*lMX^doyHZj`9&|>H@f*4^8BZe8niQ&eWx=XfY z>p!mS7(e_Z`#XA!f z9plOvSH;qD^3$ndavkBCST@7)F($AGgA3_7gp!{agJ!Ktlfr9NS}wQ{|ArWoV%#3% zjuSc#y|2sX# zoiXl>aUY4qxI4x@3ZI{nSC-FUy$=^NRm{*QB!yWq9zK-Ar8mNSZe&M5fy8*}tpaKS ztA>#e5hupt7_Y>5B*vpLo{RB(j5#qLi!m?8lhp7S-&e;IG3HXL!=-L;{*w#1bmU0* zsTfaJvaP}y!^M*d=lJyn&r+q8CzJUxum6*5EK=c%G55UTr5FohJR!0xm4RO=Qidy3 z@|Rh&>a6aP7)xWkNg>C0HO8_SD`LE+=q!(=xn`0j{=cpG^;rG|Fy@UI9}E|~wtgim z@h|yxRgAY|tYrXYa4kF}{f9g6Wqrcv^&H z`J5XrHYGKmA2b9@) zs&maxMu@{Pj?g&7I3DAu%C558;$@vo!iUxOn~JAfq`7^|{)llh#`zd&Df}68Yoe^6 ze`5R{<5Y~(>Xk96Vi`|wu?(pUXV?W$wqw(HEc%?nNsg4#NKYXng{%~^Q^-t7WTa3f zg~n=%iLW%y4B2<&q>!6JQ3}N=T5j}60JN1q2RhIq>~oz za;Y?54gbSwqyRF|_`jGQBSkU=Ed?(HKLtGnBL!Q1HC1S-@N`w#*7$J2&Pl;lk@RE6 zIT=O>Y5E4GFm0q*Gg1smVQ32DeyWvouIAq(#Z!ArN2D+^h09X7JcUs#Upy^BXQWX1+G>=zVw9lh zW~IRJ-V_!+Ac6h6X6+!Ha~?IQg~LujC?MI=M~J#;_HhFeu*rl zut32J|HCB0>!ZZxQR0VDvh9<}#fsHeRJcTiOI7%43dwL0$-4yq0wE#70r z&9C!5bzpg|Nux!hcj~OC@lWB46uwNM-lmf3Ka_r)0>cd{6#ib5&nGEt{15(A0h?6# znF>E=tC^TNaeLP06t<+WJB7bLm-7H$rLc<)|FO)kX{p#2wq|kYSIgBUfP6ZQS%y%>(xwR@&?MdPL6!xa@0}(!~eISJ&6+n2u67^3h{H$X3rSOZ2 z;V1I&tBNGRc*Yz|anrQ~4ySM|h2si7qQavoRO0-W!U+}gy9yau8P8OIs2I}xi)BpV z9M#6iIYseq&g%VfDZ|r5*jxIK3JIK1z*!Z(I9i;i%qx&yfx^+5RVt8Gfs6{&>Qb9e zW(80o6_PN+>Q_Lh$hs=5r$VwFR)9mEH)rydkE>$d8!h|_1QiI?YgB=_0*tK0A#zH^&-%2qGNyS2+E$>Q zifmDVmKA7Kf&WwW9#B#g-}m^!UN^!nadvl>QUp;!zywa{p6;3HFd%{$F`xv=Ip>^n z&N=5GiUA`Ak|HRQ6%kQPC@6x63jf=0zT^M%JEzV)w_d$^_3BmV>Ym;1h$KUVR6F^# zpDC#y3&7@vFGcYHtN^IS(hJR$E5dq$iB#R&o2!1iy}EyY<8KhaExk+i3-Isf(J+8U z0X!T)Pqx+ETi}fu>HwNa_a6!1(EuI`;PC*S2;k`eo?$xUe=>k3qOj^@I4OM7nt*{gxA+8j<#!2hcWvb^){qprxq25I}1otptI{*@3?L?8aAbvl#m>1Gjb5u{h!0(dEa*8|uQz{`wq0Ivk_YRWzplFqX& zrq@#PHv)JwfcFFVAb__xZ@FFqcuz{-N$I>RgkI4C69d8_roj&bICV1p;{f&tuq%Mw z0qhB2ZvguO_(=Lf9k#_Pw8{RGCwu)#00#n~k!0z?lx1c=leKe5@N>b#f=2>48o;pt zjtB6406zq9LgZfsaGGl{fG;HbC0!E2MVIkuI@kXF0emfzZvr?gHH$3R^_4#DMBN^1@OCMF9mQprTIs|yOOe$iF?J> z0RG}k3u1N<*8=!EfV+dZCy0Lnm|8txS8-b z$C5$sOqd=7g19M&KF!s}=IW)|MHxX5|7cqJ^Rxb}AhLtV2_iR$QbFX?>>A(c=4w;7 zg3>|c1yR&O&D!U8TXxjl$?TBrvr<-PuK z0m&Vby)%gFLMW*r^`LAWPZD$wB_FD5i=ei4?MkX*yS2 z5HnL%lBIKkm>b02Aoc|@FNpa;aH76X-xx;Twg<76YbS`^3;c_MSRBMxEz}ahWkDZ}T)fe`Z5qOWiBtqWp(5HAO@J&3_Ay|uZ4lgi23 zD7Z;*v*4B>whDQXt6s=9L9Tu3Gd(chyV-d~oO~mQSA|gWnvmB8cL<(nn*L@GZw2u- zJJ?b&y(i=y!FPk$8N}xYD*h)Y{~(ADgV+_s<3oH*D}F7R_F4MwAohraoWhS7#ut76 zaOVl);~@42@ktN|g7`g%OFGL2COZG?*$Ar+-Q6cn} z{CGekpj0!3^@%Vfb3I-v&X0>^Li)3E~^>u{}zhm5#stK_N{seHX;JAifXc z2dQ#iN`Dm2(w~I$ON3A|g!GU%@eo3O2xUUJDTEA>WQLFv zLT(6IA!LWJczWiQrD^<}3YD2kg}hIztpr;Owh^R0 zO|=i9LkROi{3j#t8rm_0o+0!S-bt{tU>CuzA#@YcU6A@cgmB;P9RepX6EE(4Lg*Vp zzYzL|FeQYkAq)t4yUOqoMuad>_#pZqWJrjw4)6^VJ~V^_EfqB>A&v}TR0tD7m>9z7 z5XOYi$SD{rB>M%$#K}1>gv*t5p7u4G?sM9Z~Kg4)eD^ycWXi zGDeF+SW9KDuMn1mur!2aA*`07<*CtJA%wdnhjOLxRf3#3YyQ*uwIm-AtY`3RWW6M~ zL2zRTn}krlIfN}C{u?Y_Oi8wdz=I!)CVx^$WO`YOwhO)@_-abOsgt!Mgm**ODNEoD zSsHJK_}Nfz@iM(F7}@_8?Wk3-%m^!*S%koEGRlijMiaX58(!Pp)kxa(!wYa#?4{e5=P0e_XH+4 zj8b8w3y0uMVPu4n8Aevvd#pztKH19-BPZ-VkfEzYrq&gTSX4TUvSE~yig|+hVU$T` zn|b{zFT5xWe;5_Qs3=B!VHAW>D4dp)_Gy!(SoD(?DutoKD3S+3$ljnPloY+$Lx3* zRu~P#XcUGWh7(4EFdho?1;SV@j|+&2FzSW*zv14)8Kwur-ZKQ=`Ld|+L^}C@_r(u~ z(Kw7Jq^(B;9}j!?#g7VqOfY$mOgH$9C3zR0eWI{Q7*B=qG@A%}r!{V0&xi4B*xS>Z z3O*;;t(Br=ax2v=jOJmq2%{x!3X)KM;BYA>5*}RJgwZLC&SCEm+g7k$*!zW|y5 zBaE30LKqXn-T`2$v@(gk4r7W)l1&gW8EBDOn>Jz;Fpuvx?2F!piDYp9~(qcD0`@n>kr)bMc_`@{Goj00hOAI1-1 z91P>rFun-m%P>9*<4_n!!#Ebk=V2TU;|S+QYjsy^HBS}YbI|X!Rx?|xzb{n$bBh0X z7$?FwN%vZ-={0?qTB|B;RIH6E3i?ll@l_b#gmE^E(_wtg892p%CX8ln)aqtMquO}- zZ?{qLn|yCIEciBz@4`42#`D{Yer}^WCw%7YqJh)=O^5q`4CALTu7>ef7(a(`K8%ZD z{1(P9+=tt$U&FW{(Ky%9zpJ_T;PK9j6(4J>eh=eP7+1phlVRjcZtDf=izB{8ZPjIt zU|W@~7iys0G`@;6OKHf~kfWjM zIRC6&>A4z8Y2I*@)=*JMo`!r4WrUa4P@}ynE4-W_vsA7iauQ~J8VV#^C|D#&Wxs}E zsX}FDE2TJnxLG{8MX<7liSMOTSXD!}B7a8>oiyC0p_+!fB`?0;MR_r_2Ufr*u zj)uA#9?Nl%?VuWT@CP(}J=7P}u)c$OWUVixA*|t82UUBqcYe6Kr!boxGVaWM$EePU^3b zMVmUQ<{DaPXr-aGhEF@GmUK)Ad6Lj(8xbdoTcqFv`=Y1b|8bLOr14!kx^pIUR_=_V9vXUT=%wN6bblWWeK|TlUvGx4vuf2@tquD6Y1r9W zo$jngcUF~46b;lcNW)kLS;JrrL&SmM8iop?dz?1JVUm4vXZi>YBgKbN8b)gvlaeRZ zs6gfM8YXC1reQf}orXyqH4RHNOx7?(<2T2%7IMC6n5JQlhPfh{u3@HzE1eZfXQaq1 z4YP%}s^zDgrSn8GU&8_+NoDFM$-Q0FA`PJ~s!bO)q>I|#Mb-Pg;!+JyKH$6etZ#*e zl^RxSSi{Ne6g>5T?{pWnO5E;GOE}V@**v%~( zwrcpLzwa#_FUrto>d4ZuO~XqXUe>T(!x0TfHN2wXRSo;N6>E4+!|NK{Zt5KkJ2bqZ z;Vlhcc2$E0_}iHT|G6c=$MA%8ZK)1O~VNWO~dyZe$em* zd%+dm#eYsiqPuF7sRs~zU6%AuD(klrwy~5 zkdOaa_@joOH2kdLJiGr-#f^?{dw2BE+&*>_b#%f>~2X~=8pf261S zN5j9|-gQ97_g#ywb7$zO(sWGhscvw$|J=W!r|N1KmC$iZFI7^> zbe!m=HuO?vqk>DlRO3on**bD`%-6xoL9UKcIy&j-tfRD!JRKn&VIBE8%IK)7<2D^- zb(GUlq{FYHybfP)RY6BZ9o2iQM|!Kiz11sKirm+HJ{{ULUxAK79jkh)BmD|?^;X3? zD$y$)m392W@4o1`nP&T_k!yW_^j7_E6xQ#fZq-pm$I8*ZeRB)@^zr5r)3!dUnvUCb z)YMT+#~nKEr2W3Cx{lXJ`%d*yb*-YJzN&_fyL7bdtNQg-tNW@K8v1MNxLe0PI_}l6 z|6zaWgsqvM?gnV$JM^7YCo^(M+Cd{Q|tPv zR@;1<4qZnh9S`e>=rDBHIvgFQjwoZ>U&VEAGmq)~&D6V0ob9L9eBvKb)o z@_tuGLPvca4>Dr?ReGhOdi_;Bov-gM;x(lKjSTax>#z3qS3Ucyhjb7d3es9*9gpZ} zs^d8wkLq|#$5T3<*75u-|KmE^obvS>;Q9Q7jwf|A5l?>WuY3bk{Q+w0DE~7$UhS0g ztd8H;7d^1gb8p=M^}LQ|I$F_ThW$ukbH;X{YN6xc0QK(x)skbK=?l08FNiggHagns zXs4q+=Uxl{Ea@f#-a$wAhx{FNZYiE+a?g{2s*8@UI!5al!wEJ}brT#&WgR_)_Y}*0 zb@UR_Td@C1RK4IUI>^h`P_?hne`1L0UdR6#m%vape5g9a z$a577Kb#!*q3Z7@1;=!p((x5Xoa_3*oD(`uGIU4$U+DN!)W~l-KkE2N$3Hs$ z)$y~A^Exi+_=EeKj$d_L)bX2+H-@R<>wE`?sSBJNHx*q!U--nX^p5@gJqP)J*HJso zTQZk*T;a~6<1cP;&-niwrYa3rf9i-0R~?3{;lma6uj%+($L8Tmf2?TNkG@00)pZ>= z7?}vNBS?#&Lc@d{!#H(Y4H}p$`K45rM}b(HdXdliJ)o(OGc?rN2wd5)a?=6!5&3WBZAOq zm3E`zTlIZ+vesyIwY&fO3I4kx-if`YxZR~u!Q|0ib9YB@PXs|$iQw=k|Gg31A3>c6 zcx}Beg3Y5<-}`)LMyt9J{5snA0DEz)aOvg3%}*5s7}7DS_81k8K#L#}fe}HAF-ni% z-7)Ia7}fNGZ_*fLMi7laAFFy_E8O!#;q@`8>>n@TJ+QVg};wg z&q|!jjZ@D@&@6)P5#$~yXwI%h&_03=5scne)VSE+l8s*Qy%0gG2&{3cwP3pl+C{yFPDvI>^5YesLTrd&BUdP=Wdxfzr6YKS zK^UmEMDWmfwP3vB7PK{j7de#U)i$yGas)34VJIlvE}VqfS0i{W;$16WkAR_gQ}~Vu z-VmFV(=yXrl6_l{A==4sMeu$EABZX5M87m%%}{>cS%1iFXS`~B)W0i&-4SHm=HJ8q zM)+C4bS7^m>`d>rGyP+4v+^H|;L`~9%RK)if&+}(1a_pPCU__3iYI&}CaU9H#S_&D!IOe)@yn!zs{T_E zd?oyJ1YZj|69E(L^QuIwJyD(InwqGh6VSLMS0;BAGHt{o(iD^r%1EKn_bE_2&wf5@fdNiNZX?yUOPqC}W_kfmM@K z1p^fg@D{$Df%261^K&Zho}_#R3JmxS?@(QKch)05P{lT^DlMLTNxiw#sV zpbXTVtZt>x25vUcWU^wq#Xx0on4G>>b!+XH> zfPsJz@}Lw^nLI2)+KDip1}p=%0n3L=$G=x6tK*Z^`N@hm$fc*Kx>J-R z{c^eaQ?rfNyYB}1?hE<(tfQWRdQ((KmCY%{=Uoj9JY=Aufkp=U8yH~VVFQf~bTq&N z;UfkfB{9&_z+>#b2=~Yy`-C?E{7)NbKSez$*u=n7Lf9OI&lq^tKvM(H8E9spxq;^m zjF_UBl7wnW&Meal23i?tZJ>>TEr+~kp6jNlPw(=#HSoX^Ux}&euBob>^sBvK2f;&A zyxw&((Ahv216>Wi1`~Y^Zxiljpr_$&EZq(C5DE8K9?MzOOR^-rh43(MP4(>X8CpNu z8Rq9b%RmEz=&*s2hIbKU>0kpx3=HMOFfg1Gue0hfRV|#V-khqwo2r^U;~x_8jWRIW zz%&EX4U91`*1$Le;|;uWkFUZsRb!fJG)?h2SgUD@kB%o8m?*uNWMDEUl7Xp`*cQ`_ zX^P1soWnbcW*V4f@Izz%_ojJwSf{0EHW$uxHAir+fq9ZBVXcJ*78wYe&`c~gu*AR~ z1A7fD<)9Sjtv0a6z%nikK9a4KwOq&w11p8_Va}=)SI}7KhB|KG1Q+JM!jpz~e{^t$;-xTWrut!a zQI(nM6#Hf1TLa&5A2{qkZQvUNXAN98i@r9%Ul7iCJAm)SYX0YDs-D}6Cd^cuW~y^+ z-RHYJ&i}oE(=)vXr#EPj`@aE_p9D$X2>X8Fj>J9LLb4c%TcSE@W*DUcC*xddke1__?PY(_?t6omfA5({X=WB z)DN@N4Njq|{wHRu3A0uDY*ll%Drq9!M7D_>6EJa;i3}5&CXRgQ(>nU!p6xwG&N6X& zwrW$;$Bl@;GVt+Zu8C46N}I@|@*Gurj(Tp6nleY_o8S#88+~hzn!DUr#ssmfiE={9 z3(k4jM`1-1J`)9|w*%i|qOy=e!6FlWAuK93QAxNGyg4QBRph(XL=_V?P1G_`)x>Qk zUrUSXruTbFH50d+xWmM^bJXoW_^!=SSK9h{?^ZNd)lc|&(^td9T_*UW34g(f%vG)C zs@f**HgUg+IwtNhaj(hu^P}`=AAf3j!7AXvY4BX{C!uS9`0AQ?z(mMI>(Tyz>0LC3 zpZ2jdXky)5^~32xB99-G>n0*5-Zb%+>0K5L6Hl6GLMIOtm?okoVkY7yEE5l!XkfzT z;h*ic_fEX7iG+!IChF6|T(z%$LFH;iU(Qtz_Vt&Zr+BLyAMJn0L_-sgn0VAgBNGps zXl!~9m)r zO*~`bS<~BCUNF(r#B;)%2|h2#hv7_AXf9cj7A9Jzc(X(4t%SE0jPT5954fxlT*|LldHZ%ny0eN%S(_*3I56RSe52BUMAQE!Ht41EmWLxl^3aoi&Wo5YKw`jCSIhsCSEeJ-NY+2 zyGXtKKgdRtS;}9PB|x&n1igC0^v)imTNf?ZU$}3P`nbHG2bH(kO@^z#?;X?Iz~2=d zSvQ^hJrnPn_`t-6GGR`d*kxijXUJXt&rR$xy`$qNCJxYl6Z^RHbCva1@5T!*EmH6I z^?%Ijef|5n?R=O{a**?%Lu}#@*Fv#hE%rk6)M7PbvErleO^elGCT?yfj+!`Tf)CJ6 za3h-LJI;l_L_M)YU6(4omZ0|!O8qDv6yf874FnqtJ`_bmAyjJ=;XGB7UXQP;~qM+f50tz3S?|(ju zW>NeU#m`YRkD^5sGozTrA!A6R7!<|eC|X6)I*P7Qbc>=*6m6pz_fLh6QM406-ad-Y z{whhr)Io$>tEQ8865d&`OB8P{DWI^sWcv#Ch@xi{y@dCUqL0|2Cauu|6M4TV`isH< z!GTdEjnfp#5D|`!VoVf6qZlUH;esOtM?^s*R30Tr%S>a*qnI4U6cLV(VxkbLO-QLt z67pYLQ=^zJl4<|1d`8Nj*-^}i;)5tYjACvS^P<=o#il6cN3kG^!aB4KL%M!`DQM$D0W2g z25Uv}Vien>ctzB|4tO|ax|lOTe7Uk zA}Z{R;=L%|PuZmWKbut86~*o-zKY^>6nmoB8^xh0KIejp;-e@&iQ+&MAE)Z>Pep?s za`+BL@u?JjmYN%EE@_;W4@Yr?t0{_;Q5=w6LYAV{4brD=}K`6zyg;*OZNP5m0h1#ZPL zl!@VD6u)s#jsY?J9>t|7{)yt>DE^4zauk0>aV^Sk4dBlxu8PfM0RMB3S#mb?cgitl zuZ!l5DAHp8w=PP=ylyg;6q2k$yeWo^81ho3nK5L?kR#cwn788SZLVZX#ZWp`myJ@M zEKNqKYz*aMxFuz$d<=y#6va>>hKe!xL|!1641ThfU!p-%m0~DP)n$>2;btlNuZhYr z+$xePF;tD=wv=zxQnhZEQr1nTJ7cIGLyZ{jis4PSAR0r>7;44vKn#HxYR7PQ40Td< z?}_2Q819$sy)nG=TqXlWJ8V6PbyJ$m28D-X(1e6ie(EtqVlZMb#kXX%lbxkaW@#-J zLtob)7bHo0Ki!GJjiGl8ePT$&P%nn2F+3MT{TLpM;fa`cQEm{!L(JWn(}1nV^aEfO6SQKnh1X?hG&FO^J%HYA$T?=Vcq9rXcj}Kl%#nK z?M1Cc3@t_Yf?zwrRx$77(>jJWDgCx0;qf5pNe7X46r^#s)j5VPlIs$8w}%7@sOima;m1rW+)aW0(@diWpYLFg1p0F?9RHw$}sJNtQ*+ zh0x%t7*@w{D2C5tSQEqg2Bo%evB$7h_&Pxf*T=9y_(s7^Dfwn0QH_F6$#W1!B+)e6C7Qp@bwg7SeV|3A*n#lqPL~=9l@mLPO<-94DZMA zK@1f$Ibb2&~V=>%_AuW#MF`S6u0yo|mPR6{0-Cpt7CzmrFnbO|K6ScgDCJ+`BMz! ztZv=xW9j)AevzVI1u0>te&gmJ!(TC66U|F8TuGJw5yNHS^onNx6i#bbMKjqVkIl66 zcZ}~^$G5^s*UFTe(vt z)dg$By)iA=lU_59?+tzkUHIk^oV2SGQ})k z7~3n3-f@sH^%2rHj(#ag^BrXe#xaN!@AHfcaSV=QNE|Q4@p2qP;}{mlx;WOyacjNI zCgIHCag5;j#xW|6S#ivcV{{xZjw)sv7sr?sA1j2ji1P7qOo(HmNG8QGHI8Y*C&w{G zCLVQ$)%M;1MlwB)8B#iv*7ChXIZNlnvHO-X%LL~N&WmGy91G%D7{`fQ$}AD#Gw)qPTFIFsWR)OGSI4m?#V@D(DPeX)9G5R;?EW-k z+Rd39*^M%Yn*=w#M!58D$7RQ&@aybV$+*IBk$18Ds6~}2#=~Ef6#_=u(;y^~- z%Neh6XoLvBa4 zy%!bkmN4!TY?O;Vas1<^4SUBsd43ef$8mfb$7iCvKaPV!J`v>u!l_KnHQ!~>8q=XT zj>d5;j?d#bEDA>ijpgb;&Es+0btU6VM(n$c6LFl3)qaVi$MtLyCX#BA%!+HduE8&0{>HJ6<5C=daK?U{ah1a-qBgymVd9tZ2*NEs<9LRh%TLb`>d1uD>5hJ{QE zS(Z0rlg%ZOI=L1~SvYevql1Ie7V<32vN796zJ)RtUbnErLRkytEKIY|YeQan3l%Jk zweVcI?1~nA7M`&1q=fp3m8zQ_dj_{u4G(TTcR3EE!475+rk|d#&6E6Vd0^-{C8TI zyj(F=x4^GJlH6sX^TXLpHN`B+-4>?qDds0*mM>TLSXf@Okm+6__gT2#LLK3C1vLu~ zq;vv8f)+w4Nthiul$Ergi!dT+STKb|Q<_w>EZ7zrS$LS;wBXWV3k@y2aZ~Z$Q|H(bMrA%XspCQAe79O+E;e5^> zdByaTE7ao_`m9h_eyF(F$UQl+RJ9f*npk+sLPraoEIe)D84E3G*}}6Hzng&O7Ft+X zwL;yy*n5fJa~9rOp`I6PCJr#$;YP-`pR*d=$Z7mZnN}8BTWHTlE!6lv=l;UXHlp_3 z3f0y^JK?nR*ut#4_1um}^1rHBI3xkCW z5gaN=&0!XXr}&2(vmRTic2qAO#hBDCH(I&&3uWYd2eRU9hozc`Lc!W7GB|kU8RPf<}Y6vB(HI~y^%%d ziEmhVlchE+8*i~++*oX6*m%dnyWC-H!1kQnY2ku}ix%Fq@V(?j)K~6hBtNDkqM36@Qf`HU@G# z9nAa9!tWOTV(S)$F3G=S;ZGrd2woPv!noy@WGO?+bTyUb1?z8_3^y$NV|f>~e+5ad zTWE7fB@*hV$yk&SEGhVEadG7C%*d)T{m*3mwMu2$$g**djeBim+o{74HhwbpN;!% z3|y^_4KLSvwW`C`ZG>&q6$_L+z>30yDG6)s{xwUpVc0Njkn4gG+xr*|vrJJNF%gne zxbQ$RiEYEN(auJD8?KFnjjz+Qo7t#mqrQzNY&>b>K^xc7vzZ>V(STvM(a=UC(R{?l z!$KMhPUw)v>PdW5YB4*eLmKNoE?E{evGJ6RXX%(!dD_M^LXw(PCV4I;dH(-3+uTMA zktA)lWcO{fveDW`8^fu99V=-Gs1WcN;xy z^ptEb8%b0DVILcPZS=Fz-^O4YLqu(W;J}oHK|+!}8Y-Ng{I5$RY>c-tL5fD&JkDWs zvaXGBsk&oRO(%OnYZGluwK2`cB+;2HI7RS3o#{4arYy`z6(yVg{7}Xm8;4eAt+6qe zT{xV--Np_ZFEh@Ub6%Ah zK4Z1oZsU~{=WPGx=bYDU5ZA6&Z>(0otyVc}RQpERZ`pX8JHL&0ZSd=~iWjXgH@+W5%E#~hSK#b;xgb=IhTHhx** z9Z>JOwcJzND&4U;?_VSPfQ^GTKDF@~BUUAMVC!;;HEPBm`AyfT)w8n>*%-P;ea`Ne z&1_a4jgfiO#xWZgZTx2AxQ!Dw&f56a#z`AraHHU0+4#~f^CkB>E%W(k?kO8z*?6>D z+K~$x?}oB_ZAwcV&X`^{_vZ%LXV`Ze-y@T0`rh>KY@D<4qm7?rfpe38y)r( z{a_=lK{3hG#hE|b_|?YFqxt7;EMKDzu2H|(sI!*;lAM1*LNR}>7pvcGT(VKZK}iRH z*tl%t9~=MLxWW-!tFCgFTb9LJus^xzR;Q8t#YJc1@Bc~fuT@QEW!3p6<2v_;i#dBI zd&h$t^u)mz(gZQx0UTsG$ab*YC|>$c#!U_!m7C!p)4@~Em-#3=bN(CYB>QJ&6*!q& zzVM8c;^E)H0}cWX@*LzlsN$figE9`vIw*4BcTmnjc?UiR1r91WxV%<9dnPM;TcwJQ zcMK@E&gr}@@{=;wi3mrs6Qta?W0jTWYR>!+#;MdlkU7V*J+$^nsyi6CPVF_ztXZeNn~}GFor)jNia+ID zF>5;fmr2~~;64WzMpt^OYHn=@k0r{^`ziNs2gG{>Z(gtRe3cl$`yKCF5_QA}eZ8vd zfJi$*2O(B;@VJAp1IgdXz?@amEqt}+dR|3{pB*Ff)$QskXsH; z-Ja{x)h~&_?fGe|hm^d}%p_^x;2{T(IC#`SLx$+roW|l+ zBf*CSyNGYgs(9~R|6yHL^-DSYD*c2_Sx-24(m@LcEgdxB;5umLpt*x@zRG!8Dn8?& z@%LVQo^{Za<2$Xya}Iwq!t)NE8RCsQ)2j8#JeapPmVI=+`u&%z7dRpg+Bs(bGXM2Ll)%2X*hxuCX+K{C(NI9rSTfyg@Pb71B?zzqCl9_mqj_@@jFp zLN%Cu)N+}Ia1b2~lWg5hX_OF0IvC|(87IHvJ*pbb5qvdoiGwi?#yS}1U_9lV3=SqZ znCM`dgXs_SW9Odyy0M-gKZnsS6}6wx;bmTgALsO z9c*&YdvTdp9c*^6g|kbtTOGXU;3WqyOZL+ZY8!{%0ST3pJc+NQ^eLypYYtu)2}>#2 zomT2d*)kg^=D+FSEeCHqc*nuJj9b<0_XT%4V0w@EZSL$_b15fbmT8xR-46CR*vqhQ z&RcvquUGy2t3T%MlQ z`R7u~03K%drSzzSV-AixIKc(z;423w9q)Adg@Z4-gLU;@AI-yIh0ke)(=Ie@ou4VF5tywOzUF5mQcah^F*F`B8rRjP9G8GzUpNVI7 zK9WI$x4&4Co8*T-Wt4GI*7de`pNqyD)rN~%ImN~0Tr??>U*1Ip7ZqJ}-l)F2m}A$- zpPC4;r7tG!we0!JtDlYFz@QjORUEJoP znu`W59&&NJi#uFsE_4@nx~T3V#GY2muHoV?7x%fi-$hLqwOlO!IPV@8wS|!1?P5kw zNs?I$OAzmMF*~Ou)99<-tL^GYzv>E(*r*uxss3<2~#9YLgJ(TMRR=t#E38BPhr!HlYxG4#h>$%|POYW$iUth?BVuzB3 zE*dc!E}nGpu#2zKGaIw5U$b7>s19@}c*Mn{E}p(K_v-!<#K&Ab&hS2w$uz!cS`!za zZ&cel=P#(4y?JTgQ!a>43$hnYT|DQay^9Vmo_EpAMOzo`Tr_7$*QpBe%vzgN3l}Zv ziHi?5@wiZkgYi^J-^)tv@pA zZSta*Q=!b=zh})|kk`%S7ZS^L7wjR})5Vo?B`NIV@^^ELs)y0_(9cDGb~ynvfdMWC za;y^wCossxU{2Ho@)8*0^271?(8Vqn!(0q^G2X=l7b9F8yPosf_G-j}r8* z0xre~A1gR6C4YXCx|o(d(Z%R;-uGxGxtQ!?ii@d?n~N*5s`FS^*q>9-=S)D}g2iBr97 z=F41S^(q!!$>?!1=T(<~M}fCoyyoI{7kj&w-63=G4K{r;r`i_PV2gTji+cUNthZgf z>tZJ-!xr@pM{stTGh5VqF5c&EuvL8^t+zOybCbW^)h%jFqN2T3?RK%p#h)&&a>ka* z+{>kUJmUf*^{gPUY2CJNsid0TkdF_tuuU(vR@r{eKVlAn_ zQYt5#Bc78Y*80iC_bz@Ao7DL+3>Zm?ObGMhm`z{yTp}@-(8fP zS>lq5Ke+peXD2)f({;(- z5KI$c3Bi(r>4FfvNiah&Q!p#xJ;h4e$q`AeV5x+++f$yOK$!&YOW^(l$|g`Qfjbl6 zCz2oRkY7H5TN5~YKCeOo6%+6!P>_I1;LY_}Ooc-H2^0y*FRn!4b6Zt$0!z25N`jQ! zoWLy!RF*8|Bova2_%pXk0>r9%C zf!f0F5xiUQn`3EA_og^C>m*P&fd|;51TL-2`t?EvuXnEu$eYG5)F)8mQZ7Fxd;g_$ z3N;Ccp5Ti1B6GZKc8x;#+y#w9SG zE*;Ns6L=`(8KK-UCF zC?PWSNT6o|gSmkx&`W9!NMPgftlkOqNuX~6{RFAcM0tPFAz^l)Xbuvj8x+#*p$QD* zG#0fdUPv2}z{mu~N_G_G$Fs%=juxa5N3XN?>vV zQ#j=|W=&6EMgmh4n3lkTM%k3`?%%DNS0`S1w9LO-6>k{%v~~&Sd;;ea_$7g52~4b(`8pRux%}k`tVm#G z0;>|(l)z>V&DR;L6IhqvAGc$TWY-FwZ;{3#rVR{;NXT0pO-stRB(ODs?Fqb+z>BHU zZ9=F+&6g5*S+ab{kd(YC+1C;Sy_uZ#b^`Au@V@YO5_ng7 zTBBU{POh4A+0Kt8K1krh1okAbH^Kj62B!y8yj02EqDjJN@V0&5|3}q#KuJ-2U+=P) z-Pv6>0J34A0YM~*AQBY?QP}D3>6z)Co}OMrl9^-{0Ywo-1rbanm7stqqU4-&&N&Aq zhzg=2+3)rn*Z=Q3r_MdMUcGviUR8J3^i&sNV-YqLVFOe76u-|m;iF{YW{GZLCrGsH zrWA(lMcBawrwBh5VP_F`aa_739VxA0P+I-17mJ}00jZ0^(#eQ7=S;(w=z&olG1Na?{YY` zVgQu_Py+b5MtbD{s<0ZunMBEyrfF@Pr9F5!wR!-z1#o8o^#i;=!R-Om4xml|sr^dT zq@-V|T5LkIv>69eS*zTpX;XV7)eYc|0P0EoLrv4(Z<;pwP$~<3F*&C}0Cxq@B!H#? zG-RIy&?tb$0hB(Ry7c~BHnZ!Y)V8NmYc@+;dnlDPZx%rF0PYFk-T;0}&s^Lr?YkQ3 z?3~*Ur>6XvQ(r21UjX+9&@zBl0X!T)`vBKfv<~3G03HgU?=gkpebkx(%QOZKB6trn4lvV7jy-S z1=|IXP<|wU4gow9z_S5#44_j0PX_Q*0AGBb+c|(s)07(1l`a818o*U2H(I*vW2{)| zvX2Mwgh&odQz&P<_O{8LI>-Ms$7p+Y*8sY)|DVY19zahamCP8q*cyQYHgQzv;?n znQ6OUEW7CU!hQj~9>ALc3<%)-jlz$oD|4nRZv@b5iLbxl3V*5X)0GGRE}YXU?WH?& z1_tmBM@Pd$8s4Q>2QWN<5gh2wJ~u0U_Xgjf0EmMFct3z40W9c}#OMbi94a_0fDZ%s zNVvMg_i+FVMTh(oj^hsBr}U_enanjZfKhbU9jVXmOdTD-XLMi{HC24hPNqk(!U2p4 zU~B+e1K7sd5y1EWmISagfG-31iZjTUHZ9=&S~MYmDeRvBCI&DmfUnuT>njesobwIs zOjjn;*~a*|<=CfB_P3nHH*>13&Y8+iTbNpPyzj#%Y2OF%L%{o5_vfGGaAUb|4d3(t zW&|)ZfLW}60JW~CGRzh-FMv4#%niUk=NoZ8b2i7~$U?1}&iXDBqtr~7+nDAZpR zz+z6K6R8Ea=Ma}kh1Uu$7hDm*$^ed+&RoUHB4O^f=%40Cog$B!Hs<>E5IaBpKs*H*(71_e+ z50B2yp(m8uomy4}u~0=h(J!y!78M+t3M%r&?4Y$dc`Ax$diOj9^!ah#ZQG`_Y`=<% zDk`Z^RDKmJy}HUz5a#fgtja2?sHm#qRuy!)YASloR7Q@f(GtTQBQ@gBBHBl0Ld%9!`(YLBRfJT8RYYVUI9M?irV2|%RD~_VIpdNiUC#cl zcXs+LrRprjQ4v?+atKtk69pRNxQ}U)&S52I1s)Om?3oTK)~w1QVYhTt(Md&T68qZP^x!5^RsCZJvKo#$B>{L9hqMz95s-l~UmsGs0qB{*fQSliS(^us5 zP%)}fT2JcC$hj~h=c`NE&#HJ%#q%m&kgY;^zKX9% z&$Al6Rel!Sv(Q&0uc~;BoiIz8Guso6TbJ{?iZ@g|GfU~O;w|abHzhhika9MVO?X?y z$GyFc{dZM-)iLP<6+>0LC#@KyVlaokbmsfw&#XTyHbe!Bp#CrwAFB95#Tap+kLWXO z0Cf3WQpISg?I@9-tX7Uy{fw6Y`cJiTQ)ek$UD+sp zGkvUzFF6Iq`^Jg>c$J5|rE|sZ&DM$J`Mt>#RPbdIt^i-Fn5^Q4ikm9F;T&Y;RqRtS zMa6e27OGgpxv%1T)?DSMmhpo$=YuQR(^MS&m6c1Iu40CYnRIg1`?U0I+S#4Y_MW+% z-Trj$TRY2cE}gkOIhTIRhR;(mU+S=czVvM}*MT1zm0NftV=)I>#ab0hR4i4ojBWI# ztx&O2#d59*dsBI(II${cm5jw|Y2Ep&UYAZE>%A4TPQ`lGp-K97S*bRt*u){G%ZdJ~ zS<0?i%BfPhTU2aSu}wyw2D^Ug%W0ZE{|n!bvy>ewc8c;Y6}wgJ5uNh0l}57__Uejp zzMmSW@0Z2utcssi98hsk1>ej$q~e&0x~H4gcBSi6+g;M ze@(?tDo(K*Rh*Ghc)erKFiXeT%JP*t%)-Gsr{WhCmsI?%;#V<#QJVIfit{QisQ6v= zE|=rSB~zJs*%n6s;F>0r^yy0A75p!m7xbUYDjL6%eVz3zoq0v9T~%>SMc>r4NmG66 zFK5%2?g&<7>OU%yG~A`3p@w7)r8MMgDA16i0UB~NR&LY03mj`wLqq4QUbo+_p{9mibA2p= z(JEj1>S(B|;SLQ?luPTrEuWWTR`24tO7%2;bQN6p>T4)JM`jNYx`L~0V3 zzD63R>`wjppPa@TPYXm-4b3#%r{R9-rREy$WfQKa-osQ5N`co)xvO$oXyAO|&~v7@ z)bN1l(7jt}{AP4I`=qtzUCv0ZY)x&Wp{<5O9ey1}8Uh;5Yq+36)u3tkK*LZCx`v>J z_8K0cLd5$%tf3*KA*><7qUR`%22+Ej!PYQ7H!Z56@7Yua5=IjwCPGH3AD3LNV6k93 z!H3zCbCh0ll;>KdeNr~9gNBY8I#Hjtn%~6OgW@hi5qnsB0 zf`%9A24ZAnk8(+KJ%yJw^wKcnGcQ+}n&n=h)7C6U-dDq`8U~2+YwW-g$rQdJ(SCxj zYq&Bthr<36eN(X9TqRNNTN-GYsSD3!@}<*v_z0lkJq=qcrVY|CSln#IuCnjbGk;Be zaISLU@6_yuX+!8*bCnq=HB7^Y8b)du#YR<2uUReqBf1Cw(4nDqe%dF3B%cZy&Y>6b z9RF35pEjEF;=P=2>1G;?tjy0ee6HaO;bS;<8om@hR>L?UXFv45KuyiBG)!a%if}?n z66IfOI6bV~WDV5pFjx6Tq9jcEPQz3UYc;IX@V$l~G|bnqK*KZ*(=`m4nmmtvt6`>w zInw0bt#W2@tXt*GmQ*Snn~=mXS5g^eO&Ep>S*T&DhGiNSN$R9lIg2$cVGUb(lY+Qh z!wLbtkA}?}wrJR{VFw3D!^K-O zw+YVqCW(Bp;7*b35~T3Iq`eyUX*i_eu!j8_4v4}*L1s*-CGd!bqZ*D$QbO{dacZ8_ z@S}#GHJsy&mR6i%KWku8qEF7S55Gw|TVgp;hhHT6o8YgaoUoaw^Y4^%+0;=%#~&L0 z)NoD1bq#;9WAD%9#=_qkxWjOXPRJ)gkzCerDLd(khO45pu|_(#BW`H8$+cZat`6>3 z{KFMq=jUS6l5`~NC?%ZH6y4jgp&jT59`ZIixWSUDBTa`-M>?Z<5nHjbUdx2tB&e4%ZBI(>!_jQ zb{#Er+^3_aj#@ez>bP4+Z5?%V)YrkAsJc3M;drieW<8doduuOm$tHHGbf=DHyOVjP zZh0xYf$m*R?$Y7ikdN{4wbDj98tYg-SJ^vPX`-Vkm31`NQSbRAhJD?WMkb~4M(7^h zyHmYakhefZ*K&Ga&ADGkOWk`C)OEDdd59L;=xD2ZSNYaD9%2~d8@4j}L7kr_PhUFT z_w|vaNk@{3*rK&Ls*Wb}lz@&G)+Aq?tEA6UG|}e^#*b(CX)`F64Z*{uOGVgTf10Vo zV&zlP`2ZEwVe9C^7U_uTaCEfO@vx4#4wpJRl4teL`6Vmuhs>m69lT-SQ_0Wo{nUJJf)wG*V*2s z$*<`c^g_7-^OQF@G&9@J(am&z(mm%>deMOF;X1~3OsYTME4RVj<@i)GQVcR$_F7KmwA|5D*6}&r=EZXC zG&JYv zxF*c>`h1R#xjN?Qn6G0Qau-exckZ9h-HmV>5MZ(6Ld5m9vr^&SxAt6>qM#=-8@b zmyX>!w&~ceV~38N?BvEdJ+FKH$&OvuE1Pv@l@d3u+&7?wJu>~D|0idkj{Q0g=s2k3 zFe{myO9d)->z#c_2mfivhruH{j!NBD@wP5Cmlft(bexNcEJ`PJ{3zrn9cP4`5~R*) zE=Q$Hjoq4jwnXx?5DI_g;+C0qNypzhe$#PY#|0g~vyI16|I%@hi@%OPbzB>ggxhoY z+vS|9nZcCwkw0cHny(~&dAY3PijM3ca)P)@O&tiLbP(6sA*WIg|KTeY#0?!c>9iA* zmfg(AuABZ3_3Nf51wBj_%x#u_dcKkp#IoAuNRk#PzB_VKgGdX)7euLj6*Gf4^Gj;F z@C?BU3lz%B1d$a)`11n3D9b>d+#t#ZQ6Y#tF5vr8?>X%2aV4W%(ECqo`51GT0zui-XQ8qQqcls)@NQ`b6`4+P~lXOa%T{HC0h+b z3!;7y4T88Uh=xG~f=Ie8{q7)o_DE_ayb;R^qDc@V5D&6{f@mYzSyo#i)G6ZFO-@SaQ%=sH2N7gjf_N;5 z-j#B9-GCL+67?;vAkh9H;Cg4lvof>5OG>qpfF11 zAq$lK_hgd)d^VNQjD-pVN&6rk38F&~Pfo4K&`Gj)r2R%|iHx1uT?>^iLG<5Rk@|dd zW^aRZ{=4?^Af8~ZAf5{1=^&mB^5lPXrB^ghW9S(~H{sob=s_16T`sF2r+-E%5~e;A z#P3^DNS+Vk1-3DWKJ4~_oENECkn^%M_9a0Idr4C1Ny)Eplr7Ir-ymKM;tf_wl3tU7 z`UR0XDVh4O2f;u!`T!*)3~zGE2!A_>fkAu_!q5=j3F2MW-@wxb-V0(-5I+ZTE{MTF zydT7-AT|dvgtsX5d~<`C$6P`0_}`&H3}gQU@lg=p1u->I)$B*6)S z69s99#u>g2VzNlc69&JP=#&z*?}PXuh*|W*q277I(}I{zUs|Z-bocZ4(-}d$wosX~ zP?;G7k^MHCgiX%(d&gidRCtQ={GfNTE)RKI8pMJiU$`n*$mM9E(rA&gD2T;DETJnd zQh2Q2LpQw_jg|$y&oeC#Vg*NMSl&t*%?&}U3SxE8JIsH}0RI{h@~qdjL97d6ebD=M z1EUQ6Tj1G6%Eq8~q~VZ7%9bFu25~ruBQgZ+v28+lhU9j7#nZ|TPVgXh3Ev&WJ|TMq z_X_f;ULMj&&HX_f5DED~A%}wAdAW?Tbv(}QsI>H$jQjB*P6TmM`t4K@r-S%0hzX0l zFGKyr5*I1g7b$0gILole0khMM1h5k6!#M=zS$2)j*m7e%s5Vla5IR1g8zPgC~?jq4?iqrAjR<15=SN`}i? zNH>sSAk#n@17!`AGr*%Yd9o`{blxl0C(Aq%QK*Yd<1|Bj{WFTPR$`Yl@ zQl*UneW};3wk1S0aO!*oPB(s*NRzhc27(3*;UU4NCCg&j5i$)}2BHS|IXQm6gQrAJ zSgNdAs_;ugH0v0M8)#?XVFRv#Vgso?{FRp}U-{8-C3FjfQ`HvfTLi&N62Z6G0Id{4m=*Bi0xN4xgfgT3FGBCmL zre042&lq@ChJ#)A94AGl|22s|FPzaA47^yvUo!A=3GXH36~W$ueFXaozADHsj`cI} zx`8(g^f&O4fsg5d!}8uV@RotM4GfTGE*<3WuuK_f;2i_Q418#KN5l_Xro3zL6)gXI z1_l`zY+%tcWr%?f47@L#QTFOk;Ry+&6f(<}PxBZac{Ps<$R`FqH}HjlPYnz=yme`W zfl)%pM{+{RDl}Ro)32F4l~Um~Y6!#L4ToHza@r>7h|&aRtiV6EYu6g^4Y z?`s2-4Sd7p!oWNO^9@Wf@STBa2BsUBYJg{WesAChHg>T8;vN1A%M_md%ldQCn_*z2 z?Vn>{u7R0`cM^Nu<;pB}R}W>jAl1Ulm1hR}doEXarC4BKp@F5GHC*-$EHZm`ljgZD}g z|5yDBPa62qz)zf^hWGUuo(kJ;rLxD$_fO6Hbfwo29?^W(z|RK$Fz~109cp@xtIE^< z^9FulwO1;?O51-E{AO5s%}0~D8efoU^}FCjL4GstFD|(TE^{$&>76P4w`9p!<(0zI zr1=@L`m2;{2Cj3h4k06i8zpPei~PU`m+me3{}@OLAvxsnRKZe$DS{9zE%@L4Ls|$v zktA*&GDF^k<-ArxC=>F&y~tHPD}?M2aze-rp==2GArypAE`;(SR0tt2glcX5U8SD4 zguLUdd2}|vaXDg@!o$@wFBTMr;18i<$h%M;dBDGUmGbNDp2J*QrBn)m$aAMFhfpPi zsv+DO!gC=!Pn#j|yxH0z)Cr+_2)Bh$BZS*Ss2M`75cs`3eiSKhwbEv__pP7L=jHKR zpS<$&3-xtFcqoK6A>0u{y%6pUp?=8wx_wK*1|c*Gp>YUzh0stWcMFcoOlF{3lMtGU zq=jHJ!FxhzF67G1BfH#v6Y{>U_52!TApPx0CGmlecO~h)kawUo@0tdMJmitl?}soXgiqEe=il;g zUE`S@7Q%-iYzkpBl|%SAgc%{sq)rH*hA=sVZ$cOz!iW&YvPvP049P*eA$%UfDB+_+ z|DNW@LQ()&L(Pqgz)G8=>Hw^jtxxIVWgZW$ShYRBcs>3 z_=k`dhA-?@=_c2FA^(VlF>6wi!eF6HDkXA~6d@2SEtnd{e@KFKSQ=ZEp7)ZZUQ#V}a;+rp?Msa3jVh=vgkBN9fNwTc-A!|-uQ7dB-uT01kv7E}G# zD%Qv{v=*m@FrEtI=`f1fw_)!Ly^di#9QKa>;}L=#gtQOi5g`=vbioE|Q+VtiH9LjT zIgBo}DH$nwT*zaBayydK6IVRR4k{3Y~}ZtNMxGhy@!|9jNx zvtc|J#`B3J9{wE0i($MhQJ$OnlBjVY$ayp?8$$jH$FzD%Z)qS8R%KFO;jc=r*TU!* z{`Z7uCh?5l{$aey&Iw~g7z4t1D~u1q7#hagVGQJOv!BCwM{K@ZQf|U5ac~&#i*QKz z|IVPMS%yTdhK2DFCr%h2{{MMD3FFfe2{jW2M}{$q{vXCyVT=yrvoOYlF*c0PMe~cW zcOZ5`lhtMs<3v7QicZMcA(T%DV`3PS!}unQNnv~~!h`}bQQWs-ObKJEBz;#>dFDO3 zR{5{;)54g}B#x}V%#1K*hOt5TtT1MWu{?|wG9BiGu~5id!Fht5BlE*pAe^5jXLOP9 z#ez%1SSnzo!H-hnFJb&D6a=rGDcq4&y=?zlV_& zL2?8a!}ueNt6Uty_*3TKUtwGdg9pxYGX5R*&cI}kU6G{A;eXF5rG%5>dKfpt-eLIE zug4Bq&YVqXEL_rB7zKCayb}}O<6G8b1 zZiyf(;;j`7IXwR};tgL;1i2BErE@HFx!OolkziZt9Cka4pe6@ejX;y6#Gn`vgd*q^LFWj<5kw-0Mc_odTS_y6s1R~1 z@_*;?+QNA}Z(LH_MeuM0uJGa#{lp=??IR$0uC4wg+c#;ki!DEt| zkUw6+pAzzP1YIQ;E5p!Dgx&u~(jx*MBivJv7M_dX`3T;OV1Q`85J9g9UWwpEiM}LA zJ1-029bj)E{UUf>NFQPZuSW2icru-V_oa!uN9KAX;@u}FB>jam=`9u=!TbmoL@-c{ zQ1iVA-YMblM*h7mr?o*5436Oa2!=%PK?I{B7#+dTlCnOPEW;xBFoKVSe=JF#NLkFD zsL5~y$4e_)7Q$LAHyjEaK}3 zCP(l?1k)n;CW3Dz^*b>&rKBc_o|(#-OGj;!#EcBIFg=195zLBUw&a>Axo9)dX>&Lo zlv_lC~Nft^L+F268q7uHiq@S0H{<0GJ@(5N4Un#gsaJAqXK{k-4)<>{` zQ?fmpx5vf^HgRIc(I}415p0RzktjMuv6VOf5lpu*!@~9mc0}-{g|95^j9?eX!o)`= zc1N&>^VCEO6MG}r7s2@mE<~_Df&&qpiQsI6htK#9MsO&C!$c=dyIvt@d+HHdyQ}a- z1V=f))+xsXj}!N%GDdq^8cAau6g428|S*HwMrw}_0EBu-B zy%#ve-->qI)}pFx%fxmGm&oMj|l$c;t;_<5&RWFyUFFQMbPt$ zLXt}n{4J8pf>$EADrDa}g{i*v%Jm3th|O!G3R$tn>y;$aTiZ*UNHvjc^1CW&r36z1 zAxL3hy|;v>nHchz(q4Gh^ui1inI;;VxZ6Y-6Imv1HBrq(wuu}Q4bt-z6S*eJn#ea% zVB+&yzH%nYo4Cb9yFH~CDu|HsJRxuX>L-73y;5kxFOo`v)TFhFCJr3)6zUC6VYIS| zDpCrgRfSNEyt;|oOw=`ThvcmxNwrMeE~KU)v$L$)qEJVWW{0d-D6c2c`hs@~dc~Qz ztE7lTWqy31ppl7LWAmDtXl$a1bYn9k{Y;TJ*3Be|sm+DlV|rf1=zS*cH}R^8*VwTp zTA2u&h?sc5L~9e9DrH?e;eU|wtgL_uRmekvZA`QkQY6T+pw9M|1)2%n1X0~6N5|)Ht~ju{w4;Rc*n#x?*E(Eu_^y8 z69Xhl$+B@N$46(pZGyNetFYt9{LUMccTK!!@+Y4|yVxoyjCJxd9ziw$_$_f7%j=PC*CdQjMzd@N`;!7c42~xtvih+cI z!mmwCrZ<|HZQ>gf-_)IfG1W=JFEo-n9H~qq2of z+o)_6q-2MQohFW&IL5G1*~K;A#6ID>1^2M$>-dt z!hIHwbXJ-)$!Ka}O5OZs7McqozsJJ87FtM@))*+v-lQxmRk*CUuob(pc42!94_Ihz z;Xw-zSqNG%EVQxER(j*^O-d1~J*A9lK@$=Xq$#~5ny^frkcF@X$3omf#DZzTwh*(B zx;fvnFl}01RFF{yMk!<g*PnpxA3Herz|{Y;du*BTj(n7>S5uhrdh9V zQo8XzZIja7!Y`YYDw~yoC%ta(DLT&xJ}cOIv+@Ev{ErI#7=1M3MGG%kc-cZP3nwOK zyk_AQ3%y12RSSJAv^wc$=qr*0r&-D=iEdWj+^l@OS$W+8@m!s}H`yEuA2Dj-Eemg3 z7-nI8fq$TM*AQam!gnmZYvDZ$C!1lA$Vu3T41+EF+6?bYk|(KL_<>{@YGL|jh0zZ! z3|;46v)Nn2KjGqUq2?Ba*M;GhchMQoS+hkMVPT|&QS4zi|8ompSQu^LGYds+e3URS z?-_s zWpQF9ec*YYzuQZf|JU%Z{u6iS($5LnT6#n z#R8)Y^DQhW;R}T;h69vT$wjzP)L#p z>#^|qH5}Tq!R@StvEaGn# z&a=Wo$-l8NVrK3oVA}tD^BvF_i#g>xP z3=uLrLm4SLOE6n7N06nIi=xU)Wtv6NJPNH+cKIl7iK0Rjc~Rs?ac30uqbP`C?68#E zqNou?VHEx-Dn`A_L6s<~Mo}pWB?|P&s{B95REArls1`-_C`J$SE*1$)klV#V?I`L* zF;B~?DOgL8Wl`rqv*fx_(B>VYSx-3SET};gcSU&uX8~{UxXw3>qH)w)@b4BRX(WUm z(nLs8!M58{m~>AR_ex96txAh1?jw&vkK+C)p3csDNU)_KqphNNpoF)M;=vMraf`y# zHc_-KkrW9D2&#f*U&{+h&8Zm^i4jF8ia}~dIEqLVrtqksC0J#v!c<%Mgxz`Mj%18S z;R-2^;$b1Q*^YJI>Q$q?NEjvW7)7Tj;x=3xoulXy#ivmWXEmaDEQ(j7crA*@qj(~U z7dUWje0*x=)O#}OO~9vUA&RcT8GSyAZY8{X6g^6KPa)3;J{!ezLb%21j;VH6*U&c{)FA|#QT zz!6c5jABX@-$gNsZXCq~ah}hj82^y(^C-TEV)`+EpI6F^q3dq+E(Cn^AQ{VyU6gTx zXe$X9}^ujTLDQeh%Tr(4D(df;(C!`DJ4NAXP*-?E^6DHJAfY82mdn%Jmo;|KAm zxlxoq?w=O*9!{qVlFW!=rtn#Uvjyjrr2hG+GB1kxQ7njJVHAHv@n;l^qF5Zo&M0<8 zu_TJ6QLK+*Llky(-!j3~Q7n&Qh47V8tP;Z1(5=29TNRQuQLK$(T@)?iWf+}2GKomO zk;_O2Wos1MSb-=ub6pZODlkxi9Yuxhl5q#uw2?_Y8>b|)?~Y%pGA|YG)3XBQT!Ig`6w=keM(qQCjBmLych+`WrwgDG|OuI6~(0}a%|+< z_&bWrQIxikYU4^2SEKlcYrBnWQp63x>w?VQXmtfv^(H6jtKQ>tvW-$UQf#kpS?&Mo z!_r}Ub)%di%|^P73>!WXGKsVx!Q8 z-$n%+dA8RZ1(GG7NgX_W29iYE$t&8ZWJ3`h8mDF2XD(t@8@JlH-9}9t)ofI^ahr`A zVw3$t;|XgtmC&zcgQHX1_S}GhJR!fsMm-z4ji8M?ZPd4MkBxh6?-{>=jV3m>ZB@wc zveD4??$)MkRqkfFos>p`jRn6_^QqQU3T#zQvRa9p-2ZEdKcRwU7Y;IZrqOsc-kvu|$m4h`n+ zgkgJ66TBM?aio6p-`7bA+c>{9FJi;AVcCe`Vu@Ie6Gc zdm9BY6vps~jSh^q@vXJd(MBg5qil@k`fq~|GVj`W&qfzou<@9U$8Ee|<3$@!*m#m7 zVtcy^+%$N~#?v;smPEVR=x%!(0zFD3R7-3T5TCK}tfW3C_`Dz$5<3Ym*?8H;8#em0 z6?J^QZ1l0w*TyRn?JbzHIfF?IuiEHm<8>Ra*`9q$p5Er|btF=0v+p)#>>)ee>=#=r#6PO2R0~!ZM<(|2>aj0P#Z_KDRt@< z4zuy0WckF#M>dvhQ$8-SK+Zr@lr!`kmp4M}{2k37Y4iCjpWDb)A4yr!E&Veavu$vf z_;VXy*cfADtc`DMd~0JI`PNj1i8jXD_|nE#3CZSs3MZ7L?mCpt=p-A-U6ii{Ckyg^ zmCc{R4zcmQbk}!+?2R96OtUe=#!MU2ON5EON_5&R8LtE<&apAq#yomRR@QtQ3z$7C zi+8gNZ7gELZ7j8MVVhEFyVvB!Tn9#!;ZEr-+m&VPTTX}V%5odEw<{|IDJOqwyRyp0 zY8z|lS~I-66b6!YHrCtNU}K|=!|ZAsn`~^halpnwV#~rUoIxFwZFIsf%53H3Y+k{4 zQ_5`T%w;#)*kxm{jKXd%l|{ax+m$`^4XGIGmOnmeA4hPzvR{xAaz58{L+_C7?VYX} z?eDWT<*1EgHvY8nmyP2#PT2U}_O|{eZdXp)_{qj8j?v8uKeBGym9yKG(>Bi7_>D{1 z4&|(kpJ~d*uQtv}O%li?7DxV{@H{(B6qrOIvHlL_qK!X9*lm1ao0@r-xcJ+ce-AQZ zxXc#WxMAZaXUf*}tD=_sM+Ne0BDpTeQux;HKV0@>NQogS=Doz5EJ)J6S0Nt^AKalJ z=5=85fUMFnq{cwPkS4?@m@fF(4ka^&GBISukR3z$7`i=~!H^@QEG46oa)r}uIU%gT z7Y#CQiJ^i-^91u_czuV$j7%c>W2hLzhcSE*4tB&iwm_5^ChP&lhx4 z;UTFuC2eEaG%>kN3_QH3VVN{aikMxlDOwDA4Bcbs5koKrg9XLVE{4uKl~4?k7|a;L zF}~4V;JaDjrJc%{or)F1^qop9hN#%LW4OAmVAsGDq7(CW;a2Tb;xQ0i!NWV1hefk< z3|(Sq&r1MX)X%$T=pgcrf}KQ2Imh?W7#(hG$~vAH$n5JR9R@Q1V`mc|Q&Cvin>N&(rv$885`}qL5<;Q(h86 zA#2quhF4kw!D-!XKjKcS0&<5w-+?h8dh7V%sx=R@< zI4lO<1@Xb3659VbhEHPH62sOQK8;~`4Byg=Vi*y_$Qbwo(1aM?*rkk$;fokvm{mAh z{O2=4I@0GP`%_59#4t7nZcC1fVLWHSnv4-*pX5vWzesqS$LPcuHtbR+#qf0ulVkW} zZa%{|yr6ehNVXsKAK9gR7sJ#TR>ZJUTK#{cGxt$e&& zxou?u?QGqxO#HK8RSc`?7+G0d?)bymni$r_us(*hEOcz%Jte=d^=gU@F>K@<5jm4K z3!yxrwvCHJ45b{TIM@-x&KOR`a5{!vG3<_Ee+&m=*dsOED|l;r@8pX5C$sjk1BEks zFoq*B9HonL8cJgii!%AK7>={+*7#3S(ga&OdQ;&-$&Ty8+@D~Rz zhM!|NN1wbi?@wY3zs7JOhTmC44CmR{ttsoadb<+|WR(0Ohp!|lAz^CEJxcXOh1_uX zo70&t6!SJHE(>0XA+Z;6XldScsq;T<#nQYR!fy(4X>#@`Ne+@7Z>c0F!a-??Dh^T| zq&eUwMxFzogLDVHQ!VF!3ucCcEC<;RG9^k$86lj=IYM$BlodjoOs#kzg$mrTVzj*2 zxka#ogX0|vXqNJP2L%oa9rztobnwLp3dflxf)g*dv$!2>E2e&&I=HNpIH67G)yhrH|9MpDD$3bTYT^!VPaEF7|4jyz+&%w1l zN@E929Ng)kzJmsi_xpZB2X{NTOL*cZ{yX<7jU1dhm~wS%L3pp%V+>6lG;{E-JaX~^ z)ZD>64(@f(!a++1tyubbA1_JwIe2=nLVmyF9ZyHnf3Na@gQ?%=4H=S0PE!v#Xv5+h z#2pM5Nm~a+4(9At0uDkB!VXji8bhUQ-9di4!iTR`2s$ui)c)S9Jo}hJtT8t);vnXL z#B^W@i8`=_P?)GW35CQ#S1P#DOOH4pFBWVk_^@DmLFVeY$s{_E`tr=|%O+^pt21 z;Vgm@hG$Bm&q*qyOnQOUc%$$|!EH_RUUERBoIee`!U5f9ZzY_1H`zpFoF7XOh$LK63D}gMS<(#qo)QPaP~}DI8x1BOLFk zZIXkL4n{c`?cg(+HNT8V8Mse5_i^6moCtL9?&)7T;Qc3mDH}uOeaeP){;>|mIUr#e zFNCI8;#X{=gNaO?pO>n7ox>-KuN_Qw@Qs6S9n7XXalSbCj=o1zyOgO8zGwG7nlaPC z4??Cpm?2~ueWtpPNiT8H;HCD_3`&Tz9PkoMvT2_(mwx_Fh12_#c@E|~Sm0nGb$GY$ z;LDB4iyT~d)Z5MAiG@4w_1@H7BB|70?qCJiX9qhStaPx-!8!-)>DzsV*z8~nC;ongt>(jmyI=WXTi$jD zufJb-*Wg0(m-j2X9PFk;I{4MW9y*4DlMa4#u+PDM2l@ep-G0EqK?g_KK!m{)aZtHVXFI6eaBx!yIZI5A2YMlk$gz0a!ARHdtG$bA%)9( zw(y*|_ZaoyAtg5s?T}JdkUHeNox3HD!Z`eKREXobLH@ir);v-+gQUWjw&3irivKZ~1J&@zrzac^V%^JD%8 z;%FU5Bn~qUy-wbPaf~^nXwr&@q_{S5w2h;PWtG%lEooz-KGfGGS5VLp3<-t>*&OOv z!sCL`IBX%5$Ama>B$VAairL$7JRHYkaXcPJ`#2uqc!hjj;^-iRymK5K=rv0mIrrAtjNE66Sp|j+f%#>pdglc$wZ3$H#0=zr0rjN#2X2x9~o3^o`@yI9`+J+k*Y# zcvHyhal9d9&)yW~>Mxwv^Z`QN;t1~bF7ZqnC=!x);=IIrWzGEAlMfO;nBx-15aGj0 zG(QkBRFI}V6!K9?>fDolX8%N@p9&5aOxm6@lG81Y(Q$kh$9Hi|jpK8Ml?CGkNxl#= zMsRE#WJAK=~|5oh>*=aIWBrL(2R(7R0fT4H=fQEbjgEMw^S` zSRBU^I{#hCj4qXeyt1^c<#DWtV`Utx;#e*E37!8msk4r5&jrc_Tx^JABbSs)*$3m; zB!#lJyM$~O+#boVP#4u zrP*QSW*q-;sccx7$JO>+Omc3wry*^7dVO7f-l&(#0ce!f}5G!H$BRTy%EPML3flXO{|pOpvpT zg(g;vr(8Vk;#rY*73?9%T-{uB7oO0hq^CrmasORyD0$As^DbU+@nT7?UM^k|{__9i zO<3sTqOXh3Tzu|&zgfKMqMr+HO1$QRzoJsYi|^|$-f+?1#o)ur02gmjc|rc0F0L)e zpLJMy+r>Z^@3?rE85iWAJFH|LQQQUj@3|P{g1@d79Z?3m-g|Ux;3qELcQJ%f7eiTR z&K(!SB=x@+>Jl&ACGcbS-xuxp*!8K4;VwqF-XqvZ7o%K^b`dRkOe0}n5v=?dF80$& z9`cQGG1kR67vo)gPfrMBurgn|_}ax}7hk!k_nUu$3!V~S5AjcQF-iQKuc$qIMESHqYl4{kJY=by21Wl6*%WDB=0d@q>$LE~dMf!5(n2#Klay!7u)Kf+VwC%oaYU zL^4+hYs=L6!WRfGbg}4vl9swy=3=wUH=VHD^>&QcxLE6Ah47UwRY&!|V zIuUMkv7VOz&XiH!GX=w?u}Pas^vSmh-{E4XkZmrum!zg|OW9Sz_Xyc7NK<=V>=XXp z5rtQ07I(nKK^KQy9OlF?M&n`}adFf|sbZuQ4#VHr3CCUpHIhB7FJm=yUArvzFDuJm~Bc6A0!Q~rVxai^%N6p0_F8&n#zeGP_ zin$VbFT1$n;;JYlgfx;!BDwD32EES3KOE&Xe!e%JRE$@Y!tN*Yl8eFZ=){dQx292y z(#0rSjB>@E?8V3~_U_yHlfk?rO5exR`6QAflH6h> zZsv*Qi*ZXasuiPpF)9=zuh<*<%EibpMuG53#V8cw7i20&ghNwNqWoz<5kd(^xk@pr z7K7yfF?AhKQWVeo?)HPb;{tK_xPw_yf)W%^lpqL#1W~et4KuT|J2N{=5_13qK@M+sE|s2ae1 z0n`qlS^#$kP&0s90o)Tnby2Soa8KcAjfE=7NxwJMBMp`kW}Ou0{s8KxFq<9_ob-X~ z?x6tqKJ%lz3J8GJ1_3k_&?taM1UxL1O^pRK;lSqsciZm~Kq!E)-~c1GQV9nBJ1(eFB_|SqCYXl?J%Efo3YpY3 zL^3K(OdCsp6F@?&*#Y+va6Dy=DtvB8TD+B~cL03?cqM>W1LzyT(<1po0Q~}ZCV=Ne zJ$WR0HifDCyx`;`$QK2_#C-lACcEQ3lV;7z^G-tl00smwkO{L#c}=o+5T|L6q6gh~ zO$Q67>mG$c8xp`!iQ5}OhY2PB%>dp?;o$<_7CJ&`zdg$60N&xk38Huq?*=d?fWHG+ z8NgW1&eEa}1NbO_ae~JSeUIa9UVeg5g7*XXKya44Q1@{Fp9C;1faw8z8gOrZvV19E zqR>eJe3s&WF5rs*#_w@I_W4SxUkC7wfNuks9Ka8PzZ3d>0KbXk6sb~Ws(=H{Oa3U} zgtYSR#Ebxb4&avnW(N4HYX$F3@y!ZgYnJaPq5Se@dM_(l5WvC!_*CMz0QXERmY6RRN+t^@f>na?Z~FcWU`YUf(R07A z(q3h00LvI&xwW;No^btskTvh$ic}%sZppWyRt2y+fHeWE4d7G&rvq3Q!1@681+YJW z4FPNnV0!>N0{Dkx+*h<&=q8~&(W0p>g0}{+E#RIvl0z|`3hoSGm-yLqn|sQ)JAgd_ zB+vc6Jz2C@ns|ar`2ztQ4B$`zhlSa%K3K@7@DYY(o98Gef~!oJ#{xJWz=?o+w#jl* zdgrMf<MZpnJJJAn4vg&k7rO@#SK5KaF_^3jxJ^C15`(H-w&LjQIC`<5ey;}L^$Xs zaNi)*AhaOtAmTyj!i)-yqCWx1UcsYn?gLp28=Y{!#&}5un{2xr+SHyu=>Fu@*R{6ZLe@b9r5U&L> zD2Ty9Yzks?5U&R@B#7^V_&$iCLA(*f_#oa3Vp!1qXmL~!ql0)eh_|FVJctoNj11y! zsZ!vJy-M=4L{fep$np-?Lbh*=(07AKez7<y#NX%{oEMDKf*~mL;jW^wg!-#J-eow48K+^k5K&gn#&dd`k+D9t+}l5T}DU zBR-r6;$#q~Qj$rRk~4Ky1kMFxAzbAq6U5CRZUu2Y zh=0Y08$xL|IegNjanjo<=ZP~y@PyoiFD4X1|6iqe$W3V)p+I&BB|^9(gi0aggpeD8 zFNA^+@w%TIOT*UtzFow@M~OllDLZ}%+ zt&}JK??BRiZQ7Tnx+#N6JERn-7ji#)nGwRw5FQNSp%Cha&>(~tLU=KRh9NWxp-Tu) zh463)jR{`!wGE+(fX6~;8NwqWG!41?>X)Z8nhBpWj|ylWLW>a2ZSnAx2{Kt)h0sQt zT8F^YhR)gs40GAMCh#$hKDdNgz+J~ z9m0qZMu+fD2qQ&il+ffY{Xe#N_|)Ltl?Nz=FbGh48g7zX{=60ZAj@r6h;8 zEJ#k@4=K(R0c8FtV4BeBDJE^s3gM@a`^2hh7(a*bO9)l#d3do&&g>BOG6ANQpA*8| z5axyOYY6K@*bu^eMkz0EDIE)8K?n;&_$`D*A^Z`-pVIVu2#WNLxyWa~z0+9vcLp_@Y39Kx0m zwuapAUMcp!_v^Nc%#ILt3fL9G?hy6}PD=j2Z~H>nAHsnU4st&XyH`MmLO4v{Lbx5m zkr0lCa3O??A-CyR2&Y3h6TYsZl*Y~T7@h(q*`X5+eM^1(!xj&qeK`vVPu5e z8AKSx#CcB`bbyW(mui+!3S_20wgA2hK~uS5j51;53%{gL`oPvwf(iHzGili{ z$_a-~vg%E>em})m5Jq`c!zc>FFZ>EZDWil@F(sLNut??|VN?q9O)b|>WuY{3R~V$^ zR7uJ6g|2F0+#SX};s3tYtP@7{6s{qlW*D_noO{E#PcZN7)egJ&_xRmVUE$oHl6fGE zdMW&%fQQ1UFW{bi?srCw!gx50ej1+9&^U}H433JjDjo@=X&AqTF+YrEVLVC|#(zx# zf33H97*oUeF^m>rJQl_?`;?YpIAJ8hXcb25FxrIico;px2!v6!g0F2DPleGnj3>f) zGK@+4ly+fk+NX3B++Ju0p&ct`bqb?%7+u2X%iliTr)2L}2)KE63xmH&+nt{5cP~7r zMT-_|g{!(31j7i0p@pG`@!WnTudOc}#@13rY8cb@D=YUa$M-9dFpMzlFwWN~7_-C| z4de7MpA`miOsE-lk8!LXd)#+myYKfqisHKzS()PsPG1Eq$+s(LW6S*!Ykz22hy8WRE=yUkhUpy=qrf|DY0mLn(Do+1#=q z-&gp07!S56{IaI+*@Mc^Fy08`ql3!F1B!-)@!LV=O(xaG+_z*n1RT_eFh+*)aTuR) z;e;_djQ7Hr5XL)Uyc@>2Fvf?mGP`2Yr(sMCwU^tbE0ZZdUmIVTG7}eiO#GVSGpb!>}3`{UCI57*qbI zN4Gqr z-nW?Qo7|uNUdWJ!v4|@xjK#vd9LBN3${)<$FgAzrXBbPu_$!R1VXO*cbr{Q-@JEyt zVf-D&a^~a_Wxx?-L5spsBa|PHC@aG_(z$T)5hYfw@bnR7O&Dv#sCHDDP*7OvsIo4M z^(5_vW2-F#=bE2hp~-I`Fs`bWGX9xj3%uBnO^8seE`+*?3a9BEe*kuL`&( zt=EPAEA)oYn?fnZpKiV#Mw;sW|3bRz{up(J3Xh75Cl&svHB=N+QCvl)iV`YHsmM}M z;gpi2B3D4R@YzHr^M^D~MMsg->-K z%oV68ucA;e9V?<86_r)@g|~{Td*b1~`6fV7@!~QM%N;5z3Fl6scd2-FnTL{WBCR62 zRYjP()uej2P>R)1QBy@94ShA#QgN^9?okD(a}HtKx`?qblxK@qmhz zs{4}#^;A5lVxWrGR6L}jzKWoVkctK>8mefc;&By?R6MNWQ4U!}V--_Mc^^^HRK>Ig zo+eT?*JmAC=OMrCR!=h(+pKKj7AhX&M5t)Zj@Efvs<^$~bD@FfllGZxeXX%8U#6j_ zY(r056;G(>qT(qPPpW9AqLY|iv(D3AMF$lfRXlx4`MgI7emhXOsbJ(OrT(d+&LZ>k zg5tE(RYf(OVHK*1o+^5&&{XIm99I!hVW==w zSSq57RYOlqnyB9Lfh^jY_i7#;7$9!jDxX)n&w^*{EAFUBFwGix$e~zoP6Ve(#Y-ys z(rp#bs(6kW(jkq*>8Iiu6{{;}(I5WD7L7lz;sq77v!H?JbRTzsY@)!+Dqd01U&YwU zIj?eR8oJ?nVuy#HPH-So>gNnl(X5qgXON1)D!x|njf&S*3{f#o#dsA%RlK2Mq>520 zhN*Z{#c&mGt9WNq!CTDd9j?K1x61r}UltuB9wFmpY>8P$s~E%HDbF<}k>uT{9hsR7 zIEVRn0}p4ARD7c1QyInkDn3y0Aro?kr_K(~M=Cy6k)-!Gb?1F(mP;q9n8X;W z_(H{J63n}0fSX5WmV7nuOELA8_`|>d=FfJm{JV&Leyid;6|+^$QSrTs$ttE(QpFD< z|05HUDk`Ru*3Y4C(iRk2gWF7a(0CwH~7 zRmFN08&qs0IHhb+aqE;aWOCs@Y@J-VNp)|xZWhWaUm$07o9cd5!LnVz4x#)>@ZBo* zs5qeFpo+cRqfRTq)5tu`EJoi$r9l@7W zTv2gZaFS9u3Ha^jb#4M0I%)V<#SIlVC1T|@6l%D|jfK@x-ZTxl8uB!xYsk>x(EtsZ z8nQGL(_8_5B3E201KDLYe&p+Z%~YVF;zEyCgHMbwdDz9>b+Ue3lU-s=Mw_jk zA`KNZG}7=eB{e7-?$S_MgI~O=B$Ts%2SNRub~$N#)_Lw^rwu*yq>6^B8ft5(qoJCH zyEW9%P*cM_DXr?7JH<>ex;oICSxdvc-1#+dZBqT=>G>S^fj^3~m7uPM`=yuq8XnM4 zPs4*69@5<7Mej`o+;%t|=06pgnS78zoP23>PMjd@DrzuuRqw7PsqLst#mH1NmD__<|w4Lvjj zH20HX^^6kKu(Gn3-w|wC?0f!<^6nWWtbtV3plL9sl$d@-sTe82k0v6lYKUs?H#;%S zeL0`sotf-KIJSnk21jsf`3XB-(y~x^TiDZ6LoW@zB_RA^2S$vPzijZd=Ki$=0Y7r# z*DlX$cuvFX8ioj;rx0v?o>;?+8eU?C+?&;3D8b7DUeWNX0RCB$`xh1WW)09VFvWRI zdK{!-a7v4RA~00L8yc^;F+syH4R2}~%XG~tdP~D_&Am(;qq*n61aC`qgiuyTGS5?Z zw19VnzN=x-=`0E)wZ>`gneh0OB+rdGiuW~qrr~o9A80s`nZ@#)I=f1e8aiZuu5}J>b}+Ri-y@6zSHo%hRGU!&@fHI z)P_YG0*OT$tPd&ax}6t;|$^;p3Q4S#F= zf5U?1oS?Gq4ZzmEqSI#;-#MlJIc2qmH4HE3OT$_X>!_8a8U^ zd`|g?d&P5w6CU?%lImum{hSfTc~GIRY~eu-hcq11a9qP-4M&)D=ar+}J@)wOpI1)*T-f%!GUU0! z+2@rLlsT`Q#E{Nxscp3a@Iorr|o*-PFQa7nB_rlxr81suz{#Cln6w6yD^vuVLIp zWo#{9=Zng77nR!_h>mm}ys+)|kZb!6%8 zzBl8da`2)u^F<{`N3M=jmz1(P@^n0YNy*nyQipy?;cS-DF)^?3_e)9{9dBGxN(-er zIZa>nmD91Wg0JjlrQT)5r@I%D1v<*>?q7Hm>L}7tLGXKjc`E8qbX3!Ew+_FKJIL3; zKik@|$yZ6oT{^zKtlX)?ysV79tPJ)S=Kff?`m$1mp{rh0RmZ(WMbqXME@)J6kB+|< zdG6EEs-IF_M-8c#E-b1kgQ`VI9cvf4TM)%a*VT0Y)2EJ(x;pOH@qmsinZ>VW7O$t{ zL7ji`Th*TkQR|A*LC3AjN=F@sYP(0GPBP5AD@qp~PcaBr zl&7vJU3EmSDE+P|-E_QmMIjDw2s)nA@jU(45vCSnE4nIYRtLXg)};F0kM27g5y1oo zO{H+M$|Of4Nxi&k$PeWaC&Y)#tfr{fvMK?j-SByF-aDf5EJ zzoui5ju&;jq~m2BuP}zfe^p0+0RvL6q>-}l42oyV1f&ynOw#e0XniS^);`zqg~6wFSdDq6(%_gbj(i)PZLiC>Mb@ft8}c^G3$!*w~mchl$AQRbFs59T#={tK)`_OFAy=xF+%xyTau8I`=B~ z;m=Ap7Igg9dUgtil9OS{s`_6;ffJFw9czUuw<

    HY{Fq#F@D5W%S?o|)G(>PhQ}YfAkH z8br_}f=41~7(t^59*&@K1kDzD$8L4)PrjxQ&;jDxTf9x#6v3krG>_o$VE4mkmd_8n zt#9?nUnRXi7C}qy{}Hr~pzSvA;}Nux?ue^wbAxdDnnK)Gn8mIuPe#x#g7y(~h#*R4 z1RWz-UOp?pK}FChg3b|i5#esae=35mQvF494|XG)c_`dHf*#UJPR;8IIU%WP5rhSh zqY7}Eq!H_aBM}&>))U!TW&~CQeT8F77qpfT5EtqQWsf~0=oLZlluVxpz8mg3!$RXM zPm7U$5j-PcdSkcK=Q$k_9Esp)1TUs^XGZW+1TRPMN(8S)FeZYr5%iB>Km@}gcr${5 z4B&O;wFm|YU>B?o7Ccnw>k$n3pQbkiQzprLOR6J;4j1}%%I3%jMny1MJb5RAcj?~3 zbSknWJEetj5sZ)ETMkfk-;3a*2tJNrLIm$e@IeG03ZL>xl_dQnf=?s(Jc2JGh+J1D z3jIvzB%#SzvFXbQz7ozi5wPj&|B*=!fz0nCm>j`$X`;#x5lo3-s#Ix{y@MJ5M6gM!dxdU}V5fjB5p0cMTS{_A1lt9#teI7+rfcw1 z>K^v)66S89dm>=#p|8FBq`E(X0}&jI;E+@gbNWOj=@o}S^<$}wZC;RhJc1JuoaBDO z4Z*;p22MwCCW0aZ6%3q>;2d{a133oHbMuejCb#YgE=F)Ef~yf+i{NquS0YHPcQ=Gl z*WEpK%5|mexiSRTBltIh8}v~4JsRd>nU|&0aqsO2(hR^rF$3uaG7S7t-s>^k=}zw9 zYIXM>)Q#&(aRZqKvJ7M!cs1xAsw)5M_R?G^!Q)jka}DGfC@1Rq1|FF1EoGpzfs%r` z8^3(eJ8@42`DF~06*2Q)WyhRss(TIigi~OkyuqI(aeWx_ulpKdZ!K@LQ&4hKPLT_Z58=t!k zeB3YnOYyvhfd$jN_Zqm*KurU+44wvOtr%9a-E{BLf0fz>>WHbj4E_}F)wOP+g|r(= z&2oA53_NI{k%5Or<{?hp4W)tL`a)~mP#Oy8b;FI-NTH1lG%@gq@OhkSD)GGCIkRp% z_jCB>23i;h7zpzG-#|+P9Sw9c(8@q-15b)p8v~CUctUVnp`5#F3~b0ff~@Z5PFXtx z?G1D=F#m>9?55lMLFt{KGvhYX+f5X^76tKsBHlFb!A+bWx;DgK@j5M1-;$C10AF%<($23Z8$=XG_&FkT4K8+`~65e=)}m zW={jX*qY(~=*rvT>Nhu)z6PE)@S=g2M6sWNXAC?m_@373&lz~$zzYVJ|Kj!cchBx- zPcJd*q<68Xlld~ED#FCCh}hZYCHor~VBnz0P=yELK?VjJ7!t+MC|)Pv5{SaXs(}%u z@^>59W8e(~!wkG>;4K4_4g6qWxPi9~d|}{AiWwMb;3H;~fl&rV8yII`yn%NN{8lb= zjDfKR-WBYuDj?^@r_L1B(p&ZeY5B83yJV_|?En1G5bLWZ-Af8dJ_QbcVNU?d)F+%r-E`z+5I$?d*8X zoEJ{I)9MvU(0X$Id;=6-$fY{lyFi48UCK!c{3h1OU(C&iGi6|fi2Z5cF9S;jFA>V~ zbECIm*ddA(rr0(SBi<=smr(9VY^rv|9cj}=d3%L< zMCd*P`vn|evKcrem}2VcjKe9sb86aA1IMI#oVz`zN$?4wCxxC8+TuXQSp(+`TrqIf zK$`>Z4tCza1p{SF-$etL3|tmIt1R_RA7u!x8MtoXmVw);)_)D$5UtJ!GHwc>*up#A z=PYSa*IIhi-F4X`F^xc~AdL^@LO1@kaqh&A2)|Hhd7*)W?s!>>q`GNUM#U(UDEv{}5kLQYD7^@)QRtj;_fJT7@|#9s|$XrXct9$vH7G7hd$7sf*ECKzk?V_nmw6bwsRC+r1dGGNj~LgS(#mhQl&=} zfheAd;@K#IQG}u}qp+d~N1;ZcMWLtsr#f{bDO1rX_-7VI6ay}}v5iTUVCyZ#jv^jK z&nSAOqU1!85PV-LPtsxfOwc=uK2h|I;%PD4Py9drQ_kycz0L;LY@bpko=ZjMl_;K% z;)N()jN&C>zAQGY?QWcoSnz&xG2U)@j;Y7*NiXQXFa<+lk`2o6QWpLJL`R+?49_dC_ahemo8}^ zi$KSx(#WLzry@h}Srnf~u{w%1QG7v}C>BQXTNGbK@pTkGMfp`PzKP;n=2#TdqWCU~ z@419)rB8`sGFQs`-XDarJK{0pb4aJs|61w1KwkP_-t;JDFe_wql;M>cwPvPN2*_ml zC5pLG%!^`n6mx{RdAECKgY?%Z<}=iCHOJ}#QKu1JR8nA36u*o7UmTHuKch(M{=uj= z`){{jl4356Vp$Z+qgWxrtAzd?#YzD*_~>n=%WcyKiVFfRMsX>MoEyHOx0P3;?z!KUD0sGWHHvG@v{W<}-d4!G5ydTL<2*0%%_!EE z@(|n>4i(8~$%r8@hWr>jF(8IwF%*v>JBAW5S1~h&tQhvZlu10`J-0jJ+zOtY7;_YLJ^C>=wY7|O;_jth!+KW;0`vG>}fd8JB@j{{Hh6S%D{ za!3nfsE}$c5}=)R`F&K6KZZMEs2jumF;t4-&KPRP!1MOIVyGNLO%bjV1-7(ygvNo(uZoM>rr!;?G>9L0Jho|}Lr)SlQ;a*ys?q1{EN0($o$s0{|VmNWw zJ8wYgNVt6oyhhk_T7V5{)tGRFDPWJ#oXNVid&`6pd=J30_`8>F3-h$@7 zM;NOZTF1~vTARhtJcbs6AB|y7iLCS2eLII_JjR&E&`S8;I||60oaSet9hS#qcp`=; zV`wV^XP?a6S|y98*6m{W{aIgop*zz2#2M-SP9j6CU<{oFcZuPt7`h7Xk!tN0!TjctP-s zF}xJR%Q3tX!>iIe@4zIzqW!Ih|MPHwGz}E`n$STpG^?6V$ssWejo}OzT?}u;Ff4{Y zV)&E$e++NM@Ocbh#4tRDw__L+!&r`DRlx|MqlJzXI!Y+5y%WQ`G511%XY!OJ9T&s+ z7(R^QBlg%j>%ABTPR#uvh6ypeA4A1-fBKNj`sw}->HhZJUC%#`;gcASeV#Xo@`bsd z#xOC4(dlji#MAvfhP%t*vlzZk_kX=zK81+ks~D!mFrCa8zF~LQ%1w^p+Zeu!;d>eE zpQ26<0V&H5F-(bJO|=qJMc_xFTSe@0x_?FtGh>(=!@L+~#qg7~&W_>d80uvBe~Dp8 zhU-rt!%vkDGyHQzfSe^6{$FD}|17_dL5N{~3=3k|DPrd`{J9?gLmvMkW@!wIW1#Nc z>G|!svga4Sw_e_BowAq2@K+3*W7rbI(ioPp_e$OkF)Zgwr?+(Jv)sQKw=S7Kx5`>2 zU}X&bJbrRUd;F_oFnZ@r_W0Mvur7v09{+mIU`J26F8P4l%hK2KHgZ}QXa2(#m!7?e z?)7&szP84&Er!D}9AWOkzn$A%40~hPLFZ%G6~k@@d7~@I(vY_zdgt*)^?fn)URiJ; zhJ!Ke=QNGY+}A0egL2?M#C%9msvM2s-(`6xxZ!hVIY)J~hQfbbyqyI9r`-UVz|gn)kL9*OEFyL=4>Lz#FZGXa^E%q6W3z69>Xoh zpWVf9Lnh@WSL;@HXS*uT>HqO^&UqC!r=V_CcI@?^+$ zO&Jr9R(Cz|n)qUL?%-nn0uw$HZKTIYG5<#bicC~6QNu({F;dZl-^3jz6sc1E!8U1? zOx$UriixTw?lMtXnx4L##$yl#Sjzs8Tg}AXChjp&on5T(=Dq1Y3H?dB*jdbfshB^r zxWAT(drj0g(ZIxgCTepOChD1}BL?f5xZectBPDG8AhKVSn!H2&lI-BTX zqJ@daOgwI)t%7G||q)pW?%X zAwFI;cjWZN(8>Jop~=G=3tsM+b*Z@jDVj17FcCD-%|v%b&*vV{dx$lDElbS8$b?LU zO?>-OdEJD{FlPES>Snsbd^FSljDV4u{)maM1jkI6CZ0F(f(grnZK98fz9!-(922ko zQqappLVD>b)fJ+3Mkrf*3zNoo^z=M!;u#aqif}&@w=(@ttSfjn7eXF-)3< zm>4Rci^#kwbX-UGh{G_xDNUYHd2gE-Vd5hPA3GRnVic#?#=AEE9To4GSY=_g?PGTp>16F-@lVY+9P zn1_o0_k=5bj`#lKd8CU>{4P!V zO)NI?hlx!lHZyyft0q>PSYzTZ6H863F!8sEWzzMyKT0h(!Q0n#hR=4HFe@2wF8qZq zXTSJQaG+V%T9IF8V!Z&py?aRAU}B?*e}vQjMPG>$?szjE^}So)9o-faJ5224qBgP3 z#C8$u9&!~6MUr5biQOjlNE1zwvsdUoPG~>h;ErylH7MafVB%nM;3kflIBw#wi6bVC z3Z=}defibqy7!|_i25lLr%jv`982}JuXXwv8Zj}rg#VKX?(+P+g#Utxi`>U7JZ|BV ziObv%E%+^5F>#fP-9onI{yy_H6KNLGEnGM8uZbJXy5+gIxJ!@C9$j+9n))no>{eP*4-9rSg2{?9t&q) z$*gXn$DrAZ{z0h0~YF8XiQxT z4_f#u*WbWGG}BGLhb**-XVtf`HP?SO*T1%EenSh5EIceDy>{5mjnaAkqVIDbvG5pY ztwCN>3(YJ%YN5G>f)e>H=wY6}YhNFaU#zlhx--9}g;o}JKAL~a>uD{f_*^5N=Wol1 zS$M<3FbhvwXlEf|p(o>Gp#uYMp@#@}w9wf?7r~t@yxk~m_`MmSE54^JbhXgULiLwD z>@j(UT;pYTuM1cRa!^#U5V8=qpj(KD1(nk$V4(O(;fZ-}0IO}zFgOuIedM!hii~X` zZsGLd42!fv79X9kY2P1djs;#x5iid3_p;F2;v0JCZ=sKcz80Pr-KQ=0ny#OPXDqDR zmO=ci@Tv72XHavOLs1~JPNTdREW9X9FIjlm!YdYf&G7zvz_-LM=m!%XQBGsWnv-ACLT6oLCR~EjuFq{Fj@TrA~7Dg~( zER47Co`q2sMq7B-!Wawhh$0s|O|cY9cbEBC3*&@OTs`04E#HmO1PkxW=sx0NvGAdU zg(GEC9}(F6V8O>0K4CupnmHoh|Cun^I?2M9V(l}FH@)4CzTgBc%UC4>^-h;bf^RH* zYhf1KkBa#llpv@T1T@d)!Rko$sGnI&<4Yc{41`wA{yJ zzgWCah@UK+Xi)gGg-vU{JlpwbmX}o)3e4uVBNmp=@cuf}HS(*4`Ai85f6#)3g%*An z0ZRU6VNpt$k}TzSd3i&C;Dw*Pe_B{-VVQ*`TwfN*A^)@tZ8@{T!rvBFih4##|L%$I zlvOP0#*?LPN&gyYIr<&)t9-CTWL~{u_T(+{^4;m+{WFv^gj9 zJDn+hz`{WbM=c!VPH5pU<8R=Ig-5m&rwX?+>K6V}{DsVt#~DluCoP=f7&A+8B)nd8?$q%k7-A7S36?#%z06x5;Tq?-A0D({?7;w6(*$G#j|Aa#3}*77zA1@O5Z3$0bOq1d>`Ms*v08+X{KY@>>e zN;akydG54vmvp+KV*yS5^>1m?(^WF7+Nfr`!N1!EqeSMdl75bh5#VcAHEh(hai5La zHhwtittCC)E7ZJPft{9Xp2;e;>e#3&fFY%mcb4+kv+jb=6)i`gc0QtZ$Or@Kihf3H&hk4pLJ&zyf ziv!u#*v;F{HoDNm`q|@Zdr7<5=x!rqBW$CGjexis6iUZfsKQC41(lI6k)}zgT{l*` z3)BBxNyA3e#w#{nrIroTMn4&vbX}Uu?{_F-BxqonFTOR_BZojq>K% zSXRcrS@;WVEVQxQ#tIw1*|=E7|A&n~Z7j0!JGYT8p5kTwi@86P_17xvdbq^Kg*$SW z(t?e@Y#g7PIWFHld3ZjN@ot?gmgf=~?aKQ9wz1a6IvXpwec3z#F2CBw8k?_b=kzJ- zXZ7u}e!g?tc5Ci>4zR3$qm2zV%6H1#Jk(8?e}qZErY$zMvLhQOY;3c!-NsQahsyao zZ0xjgc|_I$#@xnk&eZbUy&Q%3xkti9e6Xy4pN;)owhv@wl=I(H&K<=;M&3r}a{j|i z?8|9Kn7zXPKab(2Nv`=n{IC2Dd;y@h51Q!>Y6-TB3if!`xNwcMT&g;(=P%4fK zkLKhF&KFuzXi~Vev{I{#Fw4fVW_ljweQ^}TabFy@<0v0TVH|hGQ8|vHI4Z<(N8G*k zq!?+%IFz{i%>tvj+Sw>isSw`9*E=NI2y-MPh=j7qdu(( zep75Vh{M{O(J+oiaZD3VHF>2o^KbVgut^+`#PMhx&Ev@3lks{vPt!P>i8{p=i+qbX zLbqL)9*bj#a6X;k=4$IWFD}qNjt+4=9!J|ae!G>?PIRA$<4KNPgx9Sv$S&|dekF_5 zH{$N{>=;L95$hzBoEr0Ty9jPj;Krd_9Npts9>vW-@q8RF#PM<*uf*}92-Dh2 zaZrVTrN*f2SL5hUj_gM|Nj976;Qj=RrI7@46`eIt%xam@A=)SFT8 z>(*RexfJ_3n>)$yINpw9JU8$-M#M2vgvZ7)Dvr@{yc5T}ar{%@KU3gdO6(ozj-8<( z9Yg-E|DHjNi(}$^*Ut%Y@MV(s8UM{*-l`(~Krlh6^8SzG_#}>>;`lj^PpQIOjbln2 zlj8U+j<4hRM$|tSAHIy^3jtK5Wxm<|RUG5)&Kk4c`>pW57utAb#&-hlD({~xfY(RU zFSrNysc}q~*&+Usnbtjh8W(I~$!Y8IW(a>~9J7S;p_SX$a&z(*u`n-=UqxWHROiGo zR{#aNh%@tg}xn9mk4#6(rGYD+j6USbuqR_uDj{V%Y3f=hE zF7yWq{fFW>9LJS7uEudBj-zp$jN_EV>X>L9mmP`ne4YD5952<)s`7k^({Y@M<6Io) z<6!muHJ)>aGtP?q4L$!t92eub6vt)Z^jPRESDD|;<|bbSl`%3q7)dK?}HeD?5f z95>>)9Y>nuZkRXYxW!Stn>nJ;Uq7P+3z^DpZ@RQ*2<`S**0+WJ1-G(`IVkR+go7O6 zXFAAoknLc(jIq%yFJA}UBRJQ=;sY6Z4)PuM@yC~ga_?B-Ei13+moD;`cEF4Ajt)9G zDC3~4gK`eM4octYYw5t}pujH40R*JczP&!|=3bEkv598{5}$`05{8S=RqQn9GMr>a~*lu!8Z=Rb+FLEZw|h5@V$dy9L#nw*})GEraPG7 zV2U{Qql0M=7gSA|445@>44%R!^AYy#i zu1kyD=fr2~ep11|iCHa86Wh9LbFMUbwp7^WV7r5z4t6=%;r#c~`<4p+^OM~JI>BxS zdqk0#9G<-Ksmgu_2OOMqaLU0!2ZtOa->y0A;7AHnxcv~%Q3uBy9Ot||oPL7aNSm~t z2i!HX+IG|Fw1YDau5!<0l1MM-9b9m5PB7oSq0B|WmzgJy`)1B1Zqze#x$&~;SOx$4 zWzv^+&A86ZpFvBYcmg*Z+;otZKzaiGo2K0o_1i+PoXISE)K$z#z>`3`<#|ZBM~Y$< z{ei=-SA5;w`Y=0Fn5i?vHmK+hzl1ckujtQ9AU}b}5@?w~$plIzP$Pkw z36xHtOalG{?nvP7>b|lGl&6sd$|c}UpzgZjz61)Su=VMReioW7N}xglN&-nv#RMqE z!fH~CDwPtrGl8mN_Aa4S#F@$>M$4PJl%z1NRb#6(-6LYvrC;({C{QbbdlP7wK%)fi zOQ3cF^%8hcB})-YzjY|K;s0OCGcnh zO%iw{fu?PS*sw37|YBIY2r?z|tdufG~qX$zhY4fR@0g z2~12tPau-O&;;H{z(^pP!1D>bzrXrF*|pzsO!^l%XQQhi()w`%6H@XYNCe)O zs?ovSbw5ntBdJywU2;B=YM@5OBmqAq@H3AB34G4|UpQYU@J)ipeRt|vzM_+d-Gj)t z34E8p6b?#{{M&FjJV*g|;o7H6wwp;sf!i0q#BOS<>|O zYgxY}Fgt;H3H&OYISI@aFuam0#=>cxpTNiay}u=}D1imix=`ro6JAci?}91$X9A0v zay2sk5KeFDaY?F`hsb3KEKi_$PqgTX6$$*EK;@pO(i1D09toUD;4DME-n*KSOkk7X zH3_UuU|j<1#mWlV zC9s<-sAAT+-WjdyrteIEU$0P?@9BLfPV)G;FM;3oW|W@m-Os&lu9uihfj~UWAgw3<<>sHjEfJvZ%>;Jt^FF@2c(Lla1kQHXetJ)2 zh~--M<^CU0*8wF(@w_j5a(8fd1i3rnkaNyC=bUrqr-a?fyEC)1AQ(UpB#0=2f`XzX zkt85sLR3^T7zhHA5fM-kBmTdstJ;@6cD{5!#Rlallx9{z{-@GKLz8iSqRM~sfEzi zLR$)L6+-T#GR4}2&{mkl?F8`MamNrkh46L=8$;+ELYEMtAvluSHH4ud3=5%K2;D>I z5kk)p281v$6ueaJ6+)j7`iA)0B5;+}(jesb3!#4q?9-YjvmUCI_MV~~QL8= zY|eo4`DST9KtJ-lxvguGP~eE=2uC}*~O(&dCdPc$^Fd`-U?x52&+PPJ%l$x zSS@^AYD9JKiQoZmW*KFT@YjW~UclNAwwF;dx8~$-%-bN$YsG^tYVU-wDTM1G{20RK z5Vo*KLf9X|))2OZ@O}s%gzzra>2)FO3So!nZXTCi^+M84s*KA%Sw`9FjMAsh_hkfc(WTC{LDgd;5E`J@wK^JoaiLO4!8FRO4uyLhd@W6d(TMps*m ze=RaCucv><`GkEG!le*Sg>X8Avmu=0+`?I|Vbb>^);q5}^{N#*AHokIToAq{{CPt8 zkD$@*!k0t162etURpieU*X3CEYr@$nk~c#5DTIf@$QQ=V5PlBf&k+6!;Z_K@L)@{S z{d)*^ME*C4{u08k%v5v}%LOfSS5gTmd@qDQB$~@4{X2wzLijI)gfRXU3-?1H|CI~D z4^XZ;6%)fq3L`ljBr(cB0nP&m2h&LDa!N`VsbQ1~qjVT)VdM{^Xc$>x6bK_dj6z`) z4kIIs%rFXyO6PLQdo2U6`=e^`Fu-Z2i0~g4s!GYppIuJL4kIUw62dPgl>FjhtjLo& zP);eC$G=ogQNkz_M%6H?g;6$)a$!^oqjDJKMW#X+6$RuguT(9sd|5bn=;~2EXs9Y- z{LwiWeMe;HRrN4xgi$Aq7H_B53}bS6rB)cV!`S+E)-&Z5uEuN^tEVxS;EyHLPMn{RV0IkDl8%8^c zwh1G5=L7le!{{JPo|?%$IMe8#pqn}gvvW9ji^OQxJUiV4bQe0MaZt6MVe|^4cNl%b z=o`kMFmg9Z_6uV`o>qSW`&Xt66p&uw!T1^+#t@PJ{C~m!zTshv2ty4+6S0wDj16O4 z7^Cv+j1FUr;QnWWMjkKt(J&?u2!2Fp<;0+169rEeI!P#x8j&9gBOK$OCVLThgyfB^+YfpzUD~u<@cq)t;VQ}BhOyT#apb#@K>)Es^ z%sE0iy)ckJm;NJ#nO;GeAI1XqX&5hrxvjV0!Y~$vd2LjI=eU4#E@|V=;J4#>;Sju6 zL3vSd|8w~$vqUff|6`IaqY4LtFkcSil`z`$%_RS51?AN+UJK)`FxG^zQVR2W7;l8J zO7LHKEwfspZwlox{D&(BecfVV`r0tohp|EU>o{hA37!Mr4r5~&?}V`_9PE@PharAF zaE7UU0)e^}m91fH3**Z$zM`vyv0W^D7RHV+c82kB7<$Lm?dW)bEz1#e{NrVp2y$M z0azya3yE^C*MTq&hH)m0@54AG%oAaJ9me4>j)ZYkILE>`F5qfKrQG{Dt(z50tMtJ0 zzX{{JFiuM9w;Y>!{8Mx)4&KIrqaIn3F}zZ+SNv=k=fb!c#-%XMhw(!g7esOLxh(GL zEL$XbAdig;=W-ZV!nhvBkGc7BC>2h)Cb-_1lzmRd`n4(CeMjS5Rl6bl8I_cqVf-wv zdyD-p;C2{y!uaG+(l4B!!}vXnUq$#gp=ZVf2VuC`>Bym^qo;#j;~e!z7=KFYUt#<$ zM#!f;ll~QYU+8~A$xKj@s0OJ?LJ5)ue1A42pNbR}FF9E1AXP=0igp&-Tgb1XfQsG* z`WQ%8k)h&$8XnP*siL5YJu2Q;QAkB$6%$lUR8d65!_-yLUPVzASt_cksHP%YMUKkv z^r3=^Vk(NOP*jvrQ9{MDe(IZ*lu{~6s(9BZrq9aZY(`FL6{M^YLzgz0WmS|@@#~U= zcJbgBXJ;j)qKZl?jMj-;M-}U_JEO9S^$A(Lu=HXjrHaaLwPd7LR;sJ0L9C*wikd2F zsrW)mZ=j;KiaIJbC1uuQ8Mwnx4R-W3C{~Ji=Ag9tlEl>bSH&BuXru;j*qJH+IyI)9 z+Ua#FE6vyxeEu(;)|#m*TBvBLqLqrfT^>9k_o%E)s;sz`l~=B%x8W^tDrQzz)>IB^ z)Imi@75!B7r;&mwom6yJ(L=?Dm6gsazOAfuQPEXJHx)ltR$iPF)VId0;yqP7ucnl* zqV$%mdkM{~qL9;vZCgd@EA;vKDFak2RWnAY7^z~Qia{#=y^=my#ZVQ)L~Dr9j#ZRJ z12T5kNP0s}8m=N-B`Dh{m77m6R^{Ouj1e(1pKqJ~jHD8eSMi97N0}sHh42smC$$#& zNh&6*n6Bb+6(O2c;Rs(9Y6{ha>Ou{nABi1Hg)PyDiYs|JMuo$utHKi;6FOC>uOhBu zir_6+t9V1jQz~WzjfutV6cta4%yTMcshCZN zR54FD�KAVlLe{l5<}QQ?;tnv+4t%oUdYmiiIjh<#CF%3+A^H$FdgD!s-kjnTb_Z zUQqF(idWR&ZiFRbcBzVG?4YX3OYHHg3c=;7%FFEQ$-%G8m{q|fyj;Z!6|bszO~pzT zt5mH0CuLW1PI|Qmxi_t*jIE~7=4uWTx~q!KD&7+NYgMe1?A8dSHHP&n-d3?u#Re7s zlnbV#r^VFreTna=i2j{#Wi^F#iwdhk>boko3v;WAZ7SDE(wMYoRK|z>^Y2jco{C*6 zxQ?+?vO6qxa__3zEu4$hln+=n6*pA;q~aqLAFDVkNqbd%qT(Amxr%)%K2>o@#bFhn zsrXz34yf4ALCQYbl=YQxxP9wOiRP;w?CU!uk3a_{iAT#>ks~UOs`y&Pe_IoesW`6U zgvjTnmc5b0kb9j)uI_iDOT|+vP71y(?;}nN=9%#`0=^eoqPlX9Eg<*@6_*5DU}{;UNvrR#*PxoUb8C!`kXff`$_!oU8?N*M6P==KmDoX4{Io@AxA?o4Z~_E zSsJoMJzhiMU32kmfrl5@P(s75veGc{9Y##VIqqInt)lg1@qM?iyyo2C*GzMzz ztD%(Ff;;_k%W&mHFgI4xP*npTy@)GosG=cva8<)(4IvH7HLTDO)}U&brC~N(PlL|fHB8fBXfQQ68eGZF z(hw0~3uV^VouDF7iT0|ccmjM4aSgFNnK6~}PZ2y-10QaetPfUoxR7YqQl@KoT*Hh! z$tN^CnTL-bOc}fE*+YFMRVn}&BaysqI5j%W?*G_2O}rkGm8!O|({<+mhC@YI%| zFyqHzy@m}MHfh+*CX&>R8r~6bwp2P#nw*hFNUp7H5$2sCiCZ-=$}M@5Mh8D?+coUa z@VTvUBl>`bg936#_aP03#q9NmavrH2 zbmG*v(~ogpJ(+bv!`Ey{Em)>Fq^9v${Wl`{Er*HBlSd~6nUa4>!)Xm$k7QlYa7M%T z8qQ0U#pC1pSq-bT_ z4Gn*3_*=tI8g6R%UBkdS%Fi0!no{hJhF|zA!2YeR+-B-qfhX|6^*URgQ&Sz~u7=+@ zpk}6|*HN-^g8yh_4!ECvk3*o2@&_I4kph28)fUuI{?YKSh5|a$b==qRA7^hJ%UWb6 z=os->u_PVIIui9@l4RIaN0}T=hmP;-C=UtqvpNbflTvh~>PXYUGnM&u6ssFB|B|Gp zb(IVqed;O&bza(;`e@taOdVAxCC`~qppcHjI*RCcSVvJE=QFeD+g0nOYIT+Ab(KYR zgFU)Aw5DTkpVXQb(E8G zwmKcO(#-xDS$=v&JvhKsSw|&F`c{g{)G8AFtFF@dc1AV9)pd+{uSgA@*Ux5;*q>5M zM{ON-sIH@tj>gPuVp=^N4Rrj|KDEB66s#9i{KM?5h7#ol{KV(VQyvl%~vg zLR$H1>HJHQuWteaK`R}tbu7{Gk{+z(w$ag7M?W2Hb+i*sdmUYLbQRn|M@IpjbaWQ* z>aiRKDl&8vPEQ@(1(4H2N2}|>igYg>z1b0L^PO1?xq$rsItJ))bhtVO>KLSBJPWU5 zu#O=*M(G%>W2lZ{Qlk+L$b*!uW;1}oqs9+YFHKIURhpMBB{Eq*zH{bAoa|}_jbl5Cj;bc?C ze{zPDI6^lFBdX))xhbcr<^L#}@@PH9(-G4#OUGqll!l?qaf=SFAhcv{Ev!nyrxFc&?eV~&n_I_B%h zeWSsb8gq3#%U120uySKye}RsL)Y7q7Y(A%B5w+sQxG0)?c6;2BEM6r|$rp6IsN;ir z%BgzF_Gi+0kH=DuO&xc2{I26=7F)+59fx%+*Rev!b{#u(ysG0h9c$T`94R_h>3BoO zY8|h$i&F~nn8wgQ5`L|x@PxvfI_B~mfsQpCeeF|tw1+gMzH;_vHYL~V*q~#xjxB5f z9UFDLqhk{@T9ul6`h(Ba3|~(wm8-Z_sZd zj?Z*_u4BK{i>WLODNpE-@;J;_Iu7VKD5*T-L*^F{r3^ewMFZIeawIP{c$NS*BUOqCE^eTN0X79WPi6#O!BSc=)cIf$|0_kUs$z|13pehD+^AQ-HZwHc-VtO9QP8R5eh|Kz#!Z3{*Ez!$55V zbqv%r@Us%sy%s^ml-zS(JX=(kiah*f;8gwKkR5MOr%mF91{xV?YM_}ExUqpI0%)Oo zuQV20Et}HZKno*yjYSLOvypkQj&*5mppAjf2D%t%YoMKh4hA|Jfm88MXnV<#Vz)aN z+{@XO24STu@=NXt|V6G9oQh(OKR(YdDtsA#8R!P3|4b+nRqdKP-d(OZj z(R#_i^8#MXv$>cx&BO0CP?iWzDHZ&;T54dKL|-c=hF65cKUpgbylUVz11k-@ zO#$JrGO*gfn}S~#`UYvil+*tU2KZYB))`oDaESnGC6y06+Y6-*Y+Q^RICJf9U^_gS z^Kk>^9Xe;1)NKaWU9ri)W&>M9WvkFNGlC!PU8RGEvD&Hmw{sk&=HDTd3x>p8IoxGn zw}EdAd@Cw@4D2=ViQxBzejxNip&tqTSm?O=8T$3C(fpH=zBKR^Ti|}tn++7w{r8I=6eD*VD17Fpk;4X#7&vO+nDD>m9MVuZZs3GO zyUz(KQn;bgO>XY`&cI2|P9}0poHB5lb0()s17{3;&zZr%Edyr_oHKC6z*Ph1#mEH% z7Y+O%xL(5t{&~s3WqLTDA(fox{#T$^Lxrnn*9=@Y@RLY#jpauHHw<)_eQ_+w z&bX6VX~N8J;zZTJwdjx+zs<@pk!j*#6OB707c^1GL=h2V5-VF+FoomNMCP|iMNMQ0 zlMCayg)C;GxQP}fTAC?)JfUj+IJ?PmrD26<`K05+G2r4>?#4o@9qVz8u6 zYozcNXetgfG2BF1EAWaDCPtdrYvL0VqfCr8@wka6OpGxx) zbG34*Yl6U&B!b+)lKUp&!kl7as)@%~cv&W$MxSq(G+mNf$id;GeS>F)Crvyh%#9{y zn3&1-F?m}!o;ESd#6lC#nV41f>fhX{lBCUS%i;4H>PLj0M#JeoEiESqC{1dE3 zk}~X&)SbfQA5ZeD9w@%s#2ynLnD~$u4kf)Wlvy*ibz|kDyu3b^@^l;>48UHEm3<~Y z{{9t}2hv91z-e>f$%oH21)055MOpW%CnQtUi^ zY-iRL6IV_AKy~3?6ne=7#VB)GqSTtxSh;56x`~@6eikOb0`sGZ8zz3rli>!uovnjh zZkf2vIp;{eUrg-#J>k`?lsh8xL1X21iDDy+5Asmt#s?s2lUP}ssBCjK-53lCZN z%f#O%l4KPBBf9t5J|_MZ{Ci$IB#1zw&|*!3rI_p0Qj;ahJ5g)P%e#Dh+iRhKg%k^^ zlElBRY1V`7D5L%CK~0o&3z-(aE0UREq3y@%&ov3!Is1)_f+D|0qD3rZS;!X7!xoAP z$lcSzr<5EEB`lP*P|V`do1hVji$K-~>7^``wxC!jV`1LXg!_Gh!Szp{1oV9X7%gX^ zyoCxDDq5&-p@D@;qRyn+7Agy_Vxg*qY8I+Xw3dY$0%{87k~M{SCk!c96?ofx9pTp% zT2CmG*ene#G?Hj53yt&m%>*>D&{RN3j#o6#OKl;brG}D{8R3Tp4A$8@t zz_;JBu!iHV*@HRoe#Ol77B*OTk6mx!Z3`PMY_+h>!aK~)!WIjghZnowC37?Tx|y=A zKxX4+3c>B;>71#K{$2E43p*_M&6MpHX8cuj(5-YnVC=Mzdy~=&&6M31_E`AX!d?sS zTlhd)=_4yRGWMZ`eNvLmLdj`7F6|S#<%=nwO5tbg>H7qH-%R<;!sixlH&ZwhvLZ#B zD_^pgEnKv4$-)5+D+^y+_{PG+byE*nI3|jREgTWR@53JD*l(`%Y97?RXZiHw7EVYK zF*)DTubL}oEPPLovT)MEDVA0(#(P#zTfscMSQPg*SMt@&JZs^ch4U6pH&>YS1Lvhq zNqi}DK_m%iu=uHz%NDL!_{qXe3s)_Cn3bPbtKG10jqY7J<+_C*r2y~9^|QB{D@weTAUxZuh{s})V_-$MD_!aXba@NWHO36Hl> zzWA-gUl#u6Tx6q}jpl39|KSgWjUsm7c>h|sZ{a@+2{saKq}j+X{3IK&@sQwT8*hmH zd=gEuk!s_JaA<+w^(Hm>{9p&K`!j50+QCQ7(rx@KG6iiE5=FjP*_0XV4=m6!DF4GY zirT1dqlS$v8`(Chh**w|Vm3@ydcO+vYFNokppf<|d zs9>X_jYp#?rZ>*R!vZYd0IMwXn=-lFVNu&%lZPd5X zz(y?_wQbZ98OqnQQP;*}EtNpHrSh(l^25Sl`MRNv#x}N`&DTgIZ_D1ECW85#Q*3z( z_vtm~yltba9c=$=VWXvuRyJDOXk(+JNRr=HKzkcoZzr}Byj}|5!N%*6bRNFzWTUf< z&xFZ*nR_=I-E9oBG2BKE8$E3dv=LsAb+}(jFB`pW^s%vOX#%5tZJcbWwC|PP-$p;d zjQ-J586X)IZ58y$AkiIcV~CB_<%2nMsBo&bQo6QMM%Wl>BSemkQ8q@~c!Uiu0%L59 zvoW6ax{x$h42H$vk1dn`CsCT3*-Du}v%;TbW1bxZ9*v>!5`h zp0mM$z`&QPe6%>-FJ-aK|3|@KY_}(Ydp2@!KX}Q;QX4C5ylP{ajh97WIUTZ4@`TpP z-}BR7v2kX8`eUsXJ~eTUeMnDwO=MOHT}hwG%kg#L@RG?lZMnAyjm` zjU6^Vw0VI>P@SDNcG=i%<2{KESR70gdu+Tf(GP^a^<^pp`Cp5*kA=C{#wTn>`H!|w zI28EQ2Ja5#hkMfdrE zgd;YN**Go+j|$ECFT-n`d_wToLiudNynbn|wEimTI~(V1{J_Ct~usfdRpnlFMB z0pu_>H4@k);C}2$?TQtMAU(oeaLA4zBZ5qkEF!dE1cf3fESLtVlAC+9jq-2=MI)ev z+)dzLol3}wpqNOOjG(vx%9n@)AEY2)V5X%aC>=q)f0AfNiJ(jbZ{^kWvo=ck2r5L- zID#e-RE(ff1a%^)8$sm=s))f_5mb$!S_CyBs2M?ZVbT->)tNmNTLM;Z0b&a4~1l=R(5y8v|o{per1ih#j!6Om$j-XEj!y_0G zLEi}av0!4ezff8j6v2Q921f9Qlg_2Q%WagKQvJa!t!xXS%uo>?7Qwccg7KSBD`8{= zVn~0Ap$#sNCXojm=u8~@{=RM zeIN{BiH2C<9x05f5v-h>NKm1zqBE}uOnR3*DqAAimwYiEjlhXuY6Oo(;L^=*X2&A% zBk%+>cXAlwqBSLtNj_H?rbRG4f+r$)k}W(s=j+Vm8L7#SN3gzO4zKW~%u^Ahtx1?c zw=WbdV)VHZ%v7@?m@U?xkKh>r3x&>!U~UA@3Z5^N!t+=#DJSs)j@-Ypxzh5Sq%IO# zbwTj^wK#$oB6u-^CBl4J=t~hSjbIr)xo1kOQ4Yi0)MN$%s=N{jE|^*_l8^7tc#SO< z!J;Uhk789Mc+999MZGAW9Pma2t0Q8kihbQ-+w=1x&t#VoFxIKa$ z5$uX!cLX~*VB0D0N%3m7Q&{m29!ulz-G2FM1OM&?Cnh5JFoL}ie8OJ18yuDWD1whU zQRJPRC1+m*pGLq;KNtSwGRefBMR2WpCV{&!XHc2sFC+LWf^Q@EE`kFQ9E{*-1jiyc z6v1K9JtA~?nPdiPF;MHclcZKXS0cC?!Sx7!lvHjZ zxRz&OZ@%;!f`7{6`0W&4P;cK$xfQ`}&Z|*mM{$QP#Q8Z2MDZ&p{|Nq#;C=*mIr+1L zBKV74FBbk_-%Sq&?Af1-wXYPE?e7S=s35!Ci!Q6UoLj?HU7V47b0$WleEU*AR9XV0B zg1so-Xs;Yd%YRjDQVSiFcob8ZZxl~QF*SY#7T)iYLC-Z zIt1Qj1|$6mz1O8^vsT-S#YUo?)9;RVMAoV)WT4=0~wWlI98BIz4Bh zsMG(S6X1#27dj}5qj-T{?Vz-S7o%7b#h+396~#+YEREvxDE4y%Me%YJYok~f#Vb)P z7YlDj@nyf%6`bKE`f3!fMX@p(Ji4!n2K%MA=au|e2jvZsSuK=xxh_d>Npy|S9%kbD zC^kf~EsA%A^L7*)qj*Q~*Ykq`vMGu!QEU~?W}yW-1`WmG(_~}9+Q*W&N3kP{52E-m zik(rs7sdM`wkwL=0`>^)P)8p4JEm3@^`hVAD~806qWCz9eNlWWGJB)=B#QgrWYw&g zTHvW*2zM0WXS*kV#=fhaJffq*w+3IZ5u*4piW^aU6~%!lzGrF_2ctL?#n(}M6UE^u zjzn=RisMln732K#b#qnlqqf2dUiW-`FYyFhtSshA7T*f~j+2sr+_8Tuiqlb?5%nux z4#UQd%KS&tj&xMcMR7ig3sGE*;@^(S%;Q-BiUgv-n&QDR?6tTNe{2UE#hW|yPx1zWm#ff@BN8Az4WRdUgr2Hz;-=dfyoZo5c zMqu_Hp9DH7e+XstZ~A1Df+;+@<=`I{mCYN)e^Dem0Y5=#C)q=oC^$*zr=1k0LNLKY z4)W#UBAt~q2l*WoaqzG(3pmKkOHCJ$A(Thj3koRYps)i*+jb5Pk`T~lQ3u5&HA^Tt z*#dGLjO!faUR^D9dwoG)QRZg;Cy!S-OdWX zFF;r9=AgTS^e(xBQ89`HtByS#42%Y$kAuDr20Iuc>irzdakB?F=r4ehSE{EDbTCMw z2MT2N5j*4$buiq)2+C$q*m zctljV17|#eV9tA#eAK}N2NNAkaxmFJNRm#LOy)nD#y=#59jFeb{gtE%|A{WjWh3~Z z-z4QR9av0tFkMn@2cCnNgNTEua2%nogYUa2H@hf_U4z!}9mE|>m82;S3S}j8>M*&X zS3aWgnDC2;`9xrH;wC5^XaP&eybI9M-aLyFWpIhqN~#4cE0BvEOPL?gT)S(6)SnB zXR6mA^#zCTyfR*NFmgcR5_)W{j1^M0Wpp|Ea~y5sc*VhT2NyhC^svIgt8`HpbzQvX zV5Nf+E@*s}gV#AQT@-NfhJ)1(&e35Uyy@UA2m2j-;b4t}wGQ5Mu*<J!C+EuAlGw^eIDVs63M&xgE@UDYvQqJuTb~vEGPHDP-#-_aA zA*efB<9JtPw}U;x|J1?z4nA=3v4g!1J{0Ch4o-cLczt*9Z)jzgV0rcvnsWG^g=F#> z{imyve{IH}HBvuw@O5V5%9#nDi(=Vs%9jqla_}u%U}nMr2L~M-ad6bZPeXzN9}=;{ zLKz+0EpUuu4o=XHFpmq(zbEY*I_KUrW=F~>>30rJvS1EQi_BR%fCKg~!}ktW2q1o< zo5H4`*&o<7oK+nB>ENP+OAc;3xZ~imgDVbhut<`{RkoOe>v`Ex@keR5+=gA&O}Q!7 z$p2XYOUU`;mf)PMVq7o%#lc;P{_0>=H-+Ih0aW>2`1geFm&*RdS+QICe-08{{LOLN zFaJN1`mclgoGRS{7rH47)MZF?0T&OsNOCcJMzLg}xblTe!oOb7q#+?)E2-y+?xKBRnJ9zN_wd2p@EBrExo9rxJvlI4v~4SU38Jut}YIbNVpmb8jXST2I-xLlY8V@dwE=X zFBiRC^l{PG#XuK>B&nZ^{w@XxF48^d^u|K_2_4iWd9Wm@5*^0gcQIKwBV3GhG0w$! z7o%K^=G@X<8RH`NTiCQyJ~er)8!U~U)(fm#mi0dukBH(#7hLdsRPY2BUy5bQ-|nvP z6#OI?89jnxghYTKOz&EfkdT_HyD(fVcJYD>(}m??nv3Z!Y!?w1o{N~MM1{IS9ih#7 zC`E<`E0exNr?{9ZATBiDwXCW9*!t&5kGXicf=p#Sl*e5>;bN|fXI(t$;wcw1T|6xU zGh9q5m-=J*|zRyLiUs&uHM}JA`>oXtAEkiC1z+=ed~gVv&pIT`X|1khrJv z9G#)3GP)107fW1haPhW_ms~7$vD(F(E|#$vE?%YQ zyLiRLatSM3ob4HuhdC0Y^in!^%wFkYm5bNeHFTJc*%f*zy?X_@7(%BBeapofDfv1V zYX!U`jqskNu9qsa3e?)jG45i!iybaDx!CMto5*hwn%-O4%HHp#@LQbBi1IAVyBr<8 zAJl87i(M{ui|~6w=k`|ixOksqzfT~uD^K$0-pWTVK6de^i@#j#b@2%;vw|-6x%kw@ z*P{NJi_huyE{?d^@8Sy=2ZaBn(65Bj?DFHmi0Ir$Iq2e0F0+sFgyeYC#W5Er@+6Pb zi|QwHgYn?G!8lr3Kj?*TTzu=|JCQl*;*<-nd6Lg?+Qk{+^YVvW&hkFWITz<$+;(wC zl74V;&Bb;4yo-x2F1fhu;);u_bi$O>@A@bk)}{X~g(=!MFjBp*@}r9zE`ApEpIqE@ z!GnjdjV-A5&CgHG5|G|@hfBIGuDR;R%qJx{Uzw%}o@r-xo1dVA>Op}&U#9{PIVWuy#DCG96h z2nMpFJq-0QOgMu*4DoOzJ?PeX1%pA+zn_wOhY9i1SCU4080A6tU`Qj3_VB2O2_D9H z80%r2hw)5mlKhCIa$WR)Ua-B8A9W%opLn8&Ngh-Wyqk;B$sR)VhbGCqpu2|%gxT`_ z3o^>BkD8Q%sF76SKVdi>2M27&N0V7UJxn z{lQOUsGm~f(ags@OcVYr57Rw7?qP<9nI4`H=93bT7Vtd+ee4}C*pomb#N=#Yl%q1QB-=c^>wz+KUEY1PU4#iJ$*?m|cejT< z9J%x^5AS>UK-9nR@S%WDJnZxEk>HO#?Dc}LnKMU*d;OG8J$&Zjb4l&+^n;mU^tj~H zJ&Nt8Ry5`N&KY0QD?A*KC^-j3m~+>mJkD>OGmd&V=HaA=Qyz|cIN{+N58rZVaLks= zW}rNmvk1P+Q)iUcNKbn>Bg}Iiz8Aoy z$M8)IS3F$hFo|JY4A(qd=OB%tcMLyLi}P3v!*2rk?|>_QpFWyl^$#Y%e@i6);o(mY|8S}ofxkTb%^7|y7L*HS zp?M;9Uy>O8tY5-b;Uvb86hm4J`D4M@Nsb|347{)oF+3!k&qVCM{z^&=slusxxIn`J zO4An$7KkA|hRhfW#*iUNv~a{s<^o#(0YRw>#ZWkppZh73M|P$Z6;8<*>;Xzv4B0W{ z$70)P<$Dj0O;LoLED9y47bLQaW^7C@a#6VhbZL#t(REVL`K&4F# z6=SFrL){qa#rTnErE&~aV|+mn)UHYl{GI|q^%!ahr;gB?G1Q8ob`0AFC^c^7T#~|5 z?9KpXOj2U3LvsBX8pP02gc~xW7@EY;G=^RSQyL31cy}pU%_Q19h86-!4-DF&d7;ez z&Ia=dL#r5COHqjj3{=|2&`zT5W9Sq^=NLMOB2zoYpo@B!7`h6xhtO^@bQi#jq$swu zf6Ahp!CcfchUo*96$6z%G4vII;W6|Rz|_Gp^v}ZsVi=f*2gUG_O(sd@O5Wo&{bYxhRI`V^|!+ z3o$H@VTB~U7{g03ERA7F41C&TeXH~ee#@4{@Nx{Vh~-1i6nJkyu&&Z$XWHCB%BwNF z7ULQDz@-<|NIJ7Rcvx+9FJa>#WmPPAW3_jXvO0!0W7r$RCo#Mg!&6_-N<4XHduK-h7UySBcUI%9sZYnzemco=?}g*{IT#m z?aaFIb|U|J?~CEnSa6T}XEA&g!+{t+k70idU&PR3BEA&ih!?a8KkZREl5#MHLv)NQ zS;t~H9K(?qj>b^xr(m$pVqFF+KcCNcX0S5*c=6*goDj+VHPadH4_3a7;XA7PIPBwO z45v80eDv^fI)*cxoqQDY@qG+uWB5IWdoi4g;XLQ?7;ePyLo9e~z7WGj7V`7p;rUVw zmpR+VaGmpi3|FP7+!om8>Vqd|Wk_(tBp-EHHqxJBxXF2m9mn}U7F=Y_aEmpaS@5~@ zNw;HYKP0&3h4fcpQtK}BI+^qvhn1KjhxY%7;ZIK5KJxkaD~7)%-vmFf^G^)-CHk*e zpeZu{6VAdR3J>om`bhGT><1nNp>!eQ+>2IHe5Cp)=%bL2G#~kWWQYs}3i#m7Na;SB zHp(8>x!55^p8wfga!K#bAxdE%MSK+XktHe*``|ZFTJlQ`LxPW?&|7FEJ2z>5&fOtO zaUUgoRQFNCM@b*0B&mXr(moU)iVeXqoI#RV!6JL2L6L< zj(FJ-L(8E`W8o0z0&i%*Zzl3|hUPvB@P-^=w(`;1M<*YheY6pQc0Sq*Xe)HfP^E*9 zSMCOd@5mNA`QX39t(K`>d~_9=@PENmM>qe$C*6xSm1*BcFCWkQSnQ*>k3K#OAEuAK zKKl6>?PHAS_V+Q^#}L5-d<^t4$j2{Zh9z4*Y#-BnO!pD-5%uBwh|`OF>>85b z`tZa!g{czr|Nlm#Pd21YktFgT^D)&2OY*}v!ImDYP!_*g{J4)Ne9ZNE(;%Mo@sy9J zeaw<#%#g~?6!nB*O47px$`4a!`*?;~UrLFwe()9}9de6fL$= z?f`#IqO95?0o#w}*rNM_j~9Jx^zn|5B|cvAvD(L*K9>4e=3|AASAD!J#i0FHeDF*e zjm#dVEcbD7Z@vw~l-GQ$WR55Dz2Re(kJtU+MKGg$Kec{Z3hDgvB^b?Z)wg`C^|4OM zuqLmB>jhjLo%*(q4V)-WC9r+iL2TG5!;&{~DEat=&gNr_kF7rT_;}yPHXrY@U~K=~ z8u{4aW2fMwQni93gU6EG>&Mv$yV>|Dsrjqs@3toO10Nsy_}Ir@sZr0@5Kq2CETDYVe=z|LvG1ZMG0pC-||sLu25!ncO>-}jwTDg(hrAcym>7D?>_Ev zDvP6H9DlH0oTB3>9LHZi{^pb(M{*qhh$1cg=i^_&_l2I8f{~vP4`$9pp@n}dfjAzD zBO{J7Bb0n`qzJ!29H|1*;>a)Ht#z3^x7BJ}`X9rU8?OXE#OcB>I6}#cqhK6QP7S(} z-z;0YEeEUVG)~kws_GvmX&|->z@-xsW?iOIU$uVmNLI-> zh957=92ckghA+wq&h_bIpoVUREf$HDgwEYc8(65Jl443A?( z9OKD}V`LnoBx$VBku4HO$1x_38Y7i{BNfugBb9M^x|7)#EVYFypY|u!XZ%v})PG#KJYwGb5F#@ELXJ5}{z- z#uH8~4nL0F4Ia!AyuD{?9FN7ZfYpp+S{&0wY)%}Hvq*8w%(L@k95dp0zFVO9lrV=+ zOlM&9={RP^v8Zn{x2MjI-w?vY+1`PSMIcu4NiNOsmM!hAK3*Wy?n$BOua zD-9`=d*j*4I9`wAjW|}tq1R6C)GxJ%6fD=m>Nqx+FXoI==sa)5u|~XTtLSIBvh2wKa}yaeNTRhjF|c$M!gOv8g3#hfu2T%(L^J zfR0D=?V(p6%}4e3g|lRoLQGvUKN79IaeOR*oQlU%89w2Jb}W@*pXPzj;`ls{{i3yf zlyXQa_*EPS;y4}0nK%x{aVU=Cah!o~rN z<0OZ0_0(@Am+#`JFghq3In75aq>P>tQ`G%Fjg)kmY1ALFC?tEvMM+IPS!e zFa?QI@QY~u$%#FVUj_drWw;y1?{VCt>n5c!u$rWQaAp|te^h-3lodtO_J&9HZX(ID z#6b`hB#H{6h^QnH$pWHCkerds%$;;6UqEusQ9w{pPz)#rz=VPUQ4EM;LNTIX`k$#~ zzw`d*^r=%_U0q#W9j2$Jr@9;w+VC%7{)bNi(W=vcxPt%A#DCHjjM7A8%Tkf8;uaNc zR6xZgDsEEahe8<@IVx(YxJ*StMXrjfDypf-Q<1NtSVa{T1;SZY#o_@-Mr5zZkT&1F( zijM{=4E0r9t)hWM8wzZuqETsTV?mmzXe!7xrF7bgd9PJ*T`A>y70v&Lr=?iqMuBGs zDh&rIcMVb|4pLeP2irYFS{+Jl=g|<`i zT8BiPYqIZHUC=>AM-_Ldc=6l9yHxaiC#Mt3oszY1N6ww>A!~9vGwHr~>gb}PtBP(a zx~u4=;%*f)Zq0aRkkW&>RL~jSEp-!g)Iy}UihqjGM@3&1q_8aB7g>Uk|6ZC=#Sjfc zHS||;Kf8ez_lf~32CA5%VycQkQWp{@s2EI~{6ZP6VvLHRDu$^Tu406WQRHt~Wu&CO z-!ontEbJc7+e`1wCY{Jw72`{#jT5B1e9mAJ!$hGxsA7`J?;3IT$wHx@y=f|@t2nIU zZPrx9Ock4GRTZiVjfPb*S4C2VuEJB{t1wiUDr^-g6(@$mQe)R%B~GYb>sIWDSXUs4 zEQnsA=vXXJ5voY5m_=ztIlK@yqTRaYzV}7!2Cd3?%vQ0pTJ{{8{cIUJ(c(ee557vw zQ!!t~N)@YAEKspf#S#@u*?&6bEK+$>Pr+g~dW&3gGVn6`Wh$1dSfRpgm`^`WbnwMc z;%e-jLCR_sYgDXLv7UC=oJoeYq9>8@O%rseMMqT|RBYs=F<8m}wV+PJa_?s3Y*F#B zif2_kr(&y$Z7O!DctXW?6_2QROvU4($qwqT;!*aHh6&0cq;IimgB2=9BeWf?(DPf* z{H!Nc>{ju#8kfcT?hyr^qCE?9=+G>CQ=-GxvU^oLBMhwOi~m$0=kqG|sW_nGpo$mR zQB}OG;uYc9ui_;Y6do5^FPEO{Xu3;>#m0G6jh$$*6X!sv0hiv z?DhCjJMP!~x764v83Vndu@OmpN5v5p7gYSE;;4#uReY)9D;4jt|FFeXe8yQt#W4;d z6(372K2&jB%Xuc4xbOSRY(-OprK&@e-Z z{oSz&Y`7MOT1n2J$bFMGs6N-V}EN|0ryB6Oh&WzocWHDEJ4IMP}*3d_UbkuMcn~AuF zP8#mi;%Psg`6YG114`lDac}9Wp__(YQUqV4x@+j6p{GQToKEoD7B}n2w)O$#ZXptX zYf=0|L0``E8t&I{4;x(riT7%_kEL9Q`A0ui#IUYY*#Q~`GNa^W(jX1{9#94g8xaOF zGtfoDFb%^se4yc&h7lS@YWy3qa;I{+qcn`xutLL14P!Kn)evY1HH>5XYA{6d1Pv24 zOw}+=!-H&>lSPv?OkvXtKKGi!|GO2AWnDHjdpi4=hM5{v$-b;_7T;@TIN6$pPwuUp z)SwHUI0J9fp3o(p)=UkS#&=buG`Jc(;c*0x&&#Gy&U5bl!z>Mtos8+THISe9TuEA}VUdP;8s=*}92oCCE)e?XweyrAv7r`AbeV=F z8kTC*05f~1`Qj9 zvZ<7Q{Sf6~A}(l)hKDt575X;zzz*@7&J(W{*u&$--JxNphNml)tCa74o!8s5}Ep2O^` zj9#cooIj}@_6v!>P2yi!i-*K}-3&)*Ne%C5@qRe>k=_@CH{X?{^3SOcIT;R7E@=2m z!*LBCY515;so^ILKeG#I_*BC;8ot%=ndo+k4XWXD4JS2xA(WC68h<^U%Lf4!{z}7X z4PUd<7H5~7@hD*+{+)*JCCiT*&Im&O9|ZYd&a*<{vBqCC{Hn!!L5tcae$#M(dJa+k z)bP88b8II0QvXM38+|cEInQ1B&so^g&`KICs8Ab4hA|JsF{S4#IYnkOrlm2mnG3Z ziTkC9+DSA_#;fQ$61_Z$x=CCi_|*ch6v#raN}^s8^(9(!sKP*EgVNMNUuHE*qHz*U zl4zPlrzGx7;+iCyCDA>avgo8F!u=l4zO4bxB;GMDrwCB(ZXBCii<=4ZYaYQmYd; zCUH{|t&+G|vXpEElc!fH&!*3_+9Yvn677;`pTupYI^3SbFwv@QDdo=#`5ltzn8Y2W z6w0C6^d3gY-QCVf+?7P%B=!tdx+KvxiMxff8%-@p&m{W2lU3sJvIna+H{M0*B}r4H zEJk}L(MKqYgmRDI{RG~d#C?Jsk)*!g6bwjWU=m}J7@NePWc=spaDjsbGWviZLj(>L zI80#w%EcoDAVzn^$KNhQ9;kNiV!A!}xE{XL?Y>?C~LfJD+*^*tzeQ;A zPh7~NuludS%;;4peuO+pyqd&;Bz7k8s3g6R#A8W3p2Sm0Je|a@B%WXglcXmF^8b$A zf=v6g;9Dv5uVKnn!nkwIFZEdI@;>^B#BQs zTK5*!)bUvopCfMDq|C|DMkr-;9|ZsZ5>T@Tq8+!bX=+9D#0(;QCG(mg0n8WMYno7>g#BzqmhoQ zsn3v%20Ci?&v7n^yWGbkl*?LGZLEVwo0u90l1|8%q zVQ4N{h%>a*ajw)FL|W;%S;s9p+6Z&*AhZ^QoHuTc-8O#QC+k)nw+XSq$hgEiMk?)e zwAV39$7~%Pbad1)TE`e2cj)M(qo0m@b=;|=Guul?4;^>u=pquj>b#9zX;?X)<$f8N z)lG<8<}un+M=u?HboAA6cc~7&bFFw)Mk>Q3%G41$hL_^o2IP;_F^aVqUclCQ zab&!t9IIoTj-(D<*v7LKI;QBDpktzr2X#!+@lm><%fy@tb1sgNe*F_ubxhMSL&r=V zXrGv_W1ToH{E}uY7b~WUG)+geyMTY>ky3A5WkZLl!`Bh$uyoiu938HXlrWdLJtSw= zDCMDBGOCYKJoYhJ(bXTN^lEf*?=hrI9cjtJyZrWx+nhN%9@4Q&$7&sOb;R*b6#|JcmEoTUu!b__ zopFPXwWatv9qUW+t)rBUIyOmkvyO*#Y}Mo6AGV0(3jM3pm~!zgW}6w#;}zO=6rR=b zoR0lc=<_=E36WVC_~Sh5@`8>RCAHj!HK-gfnOtj;4)CoK^=#5{Hf!-j@NX& zuHytJWF2p?UFw%VqT{HJHwAx7$6+0BiyZoMc!#sl=-6(=?_FNuU7^3P;{zS<3k-kcgg!m7>)~UFo*S)P(D9d!8eBFT_*=(6 zIuZtQ4gAZZIi(x%6?hp2G7Z4MB?ht#WE&{&$CC!bk7Z+{{WGL&86%$GE*}!ZXZq!T zCt7`SG%L?QzJUq`Dhfk^fwBh530`R6m(j|oFN@wg8CRB}yn&~O#4od#8mMHT*gzEn zMFx0jW@Q5dyJla$x0pB?=8unuc2xt_3{!U+E)$v;)-zDw0KbuuvRUX2 z4Ky;))W9_c8XNH!z$TKBADwxMkDvV5j@%Y&Cd6wEUQQQl#q6iYD9sJD5c+KfZZOc& zz|96)8@SQHO+s&F@Q${NBe&LAWl@i^Wt_?kw-{(+;8p{~DT<+A?K}pK>)Q>qrG^ID z8%UqduWT=7nOZQ2Rep66gn^?SFU~x4jXqkK z#~Bze$QT1-1qtLI!wCi^N_4XH&#$!X2MtVO@48TVp$Povm3Uz=#lRnzRryLUm@dq= zfs}z624)&i4QK{Tp(hRKf*9;PZ^rubXl~Z(0$w-s=vc*)BogB?i_SSZ83Vfn^3((!7#uxxf_$>YcoJ!fkG?g4IG?Bk*RC>Gz6<#@SPa z>kVu$u+ac(q_NYW+daHy;B^C! z8T2QErw!~Co?QZW8+bwx@;}LjlRK%2?=kR{(96nod!#&L;CTc4g!rt1=LF&1G)#KI zz>5YBl*-v};AI1^Nc1I+;x-q1$g3P{r997$Qx2BmhYVgW6D$0Nfj12tE2Y0>;2i@; zBzjoj+XCql|7a=C`v%@M@E$wT=1hK@;Kv2Z`Jgnl;h8x4p@HK<`KXl6-^4yK@F|Ck zi9RMi;{fDrX`%v$p@A>h0}cFX;FN(c4g6r>M+09OIBnp`yYs&{@U_VKR^T@R&xrot zmCCk4pxL_d1 zM8d>hocs-Bn8-Bo4-G3B|NEbUN`#caEEAWQ@jRbx0)kji6>+T5kx?0m((z9AcqP|F zo{4fo$v06TNLhh}oRQ=h9)1we9%0C)6=Ow>1VrSM!;DrfL`6BE~%XlC-J5~Zmy zOd1m7%*Cq~t~J5yEr|2Mt@f|d+(Zi#omg=bH<)N?;#L#4nYhu!O_H~@iB=|VHsd!P z=3;37dJzMWTTHYuHE^fPfUEnvblai59)CLS~~$;AC82ACLWVw8!2CI*=pYGRm)!4zd;2rb{Ha*GLZ zT^Pm*5(*q{f*#aIm~=s}@Ps+>X@_%1n;2tayom`W_MgfcYhs+JRA*rRe>IEwd?~pU zY@!f<3o?0|L#Gv0CYzWdl%$ENCZ-9lnwV~4hKZRHW$C9TD2a(mOQZ0Li5K{3CBcKD#0}om@sv=WHnEpO@4?vMGnynAh&*TFc@yuLIAUU-i5E<~ zYT|&27uo1ynU_txBt3_}F!0Wl0h0X{Nn-YO@=5EUiPufMVd9X9*CdIhloa$Pjcnqu ziMNIR`MUUdmwZrR;EjPLmj)g+@ve!FOnhwOJrnPnIA-EQ6Cae8Qf_y~EGhT6P)ghy z@D*~+uy}}_5aOpMJ}KpYNti#AXusb1Uzj*$;)geL@3ruyiLW@7S*T{=w27}dNm?kh z@QsOYIVYR=+r)P!zBlo^iE}2-Fr$f|ITe`r(ZpHuJgAhPq?EkLUOhSUCz`aa^24#5 z@Y9;#bjZ7YlJYA@SUog;f}c zBrN1w$g_}d(bJ;UJh1E#^dy3L@s?u$0+~{Q`OL+?w1Sv-$d5IG@#8Y2I3zu4` zWTF38xf54p6j|6iGNY(Y;^tmil`Rxoc(q#IqwiJxY}ln$BrlQb7HU|y*+OdzH7zI> z8e3>$p_YZqEL>^fDhstO)Ui<4!W9;O(pM5+RJ&ZVuWgjKcB-;lv|{OBPgUw!sBfX6 zg+|n5nsPPSrYXs3N&^cF2h^q%QWTVX-Z;0D$}clwv+SOs)Sanx zo~al!l`Zuu-(sPSg}W?tv2d$}+bndj(9y!}7TQ{9XQ4d{x~X{K%sB6>GnHRwDos?S zr>aa-l{+kSvT&z`&K4G_%3G@P>R-kGsxfChO}SH3rfW)93*9W-ZK1b??iPAj=xL!B zTTN4*)|9U_rFK&3kyO~1m}^&3>0_a@Yksfb(gj;D zoyKlVgIk!%`Wnh)Ls@1hj~mJlhLUe8H=4=_GtQ-1NLtV>7#2(mp2cfPb1VzCg_H%y zf@>-pP34%W#}_d>pR60S|G}V0@ql|EDN(O{9@r(3v(}8vM}Gm0>Rf?SjdL6u-d{J3yUo*v9R323JXhxVVQ+DErmC85wa}8 zl@>@OzDklxh;&!A*1|dqOeLiRmauIQ%0_`DNt-QfvGA~ktri}$@VF#xv+#(89Tv8i za(-qhJ1ubI?$J^TaRv(6W#I`S?zZq`X)1S6>7R$G{CR&5>-$|%rmgI?@C`RNw%E7DsMeMjJ73vUZj=gaum%n=JmCHk(w_bhC( zWApB_m6@*<9JBBt=WPpLSvYRtBMYBd_?*4h!U^I3l%uKt#r>#HgmO%>HxwWKCoOy- zL<-~wol}DIQw}%QPFwie!WoVf&i@v^m8686z5LF?_iVx5g@21E<}FSsKbFe*NszOg zg6fxVE>5w2w&D$wrCG{v7JlcvWTSp}5#;acj9&Z0nh;#zetVSZsMz)PIHgfFvUSrs}#E$zFL-&-zKqO%!SBQKY zV*i|$Qt~9)@wK9S8?#ahk+L?**{EWps*UnCD%hxGqsT@@8<*PrAuhJz`B&mTbJsU< zqgNIQ#R8i|g-f0+x^YkZKFctCTy`~~|4=#pNwcO6#YTM_SKFv%<1!mpNos8yb!=QA zICEWYqppnuDP^nZ%zeL%eO0b3P5m{c)GNh#;<|y2>pNyNw9!b2#2edaV&hsH*V$-l z;~E>yY*cpQ>UVMDK1OfklX~R!*jRjhNfv>OGU)~zEp6OkqmzvrZQNwzHXFCwXl3JO z8?9~JQYwnfd~yE2Z{lri+*+ztQ%9jcfwuO=&y?+Kw71d0Mn@Z4_Y`)2J1Z?CjuNW; z7@P4<8+Y62ZKJb|yKHo^(bYzG8$Co|Hyb5aq}?V}Ab(FAy=<&?lu4x&;(cuNwK2fP zKpXei=x3w9jr(ofTdLK4l7-nB)NA7vQJ+JT`{d7;J+M(wR#Cw?j+w z&aan!z)^m1lo6c#**Ym)k-{h&qit-r@rbaEv0>OSZH%=s&c=8f6KqVgG2O<*QaO_a zd650Hl(NN+%|6A(R2x&iix<@=4;0O?G1G?5;qX$Krm}CT3cqF}X=BjWMR#wnQpt@Q z^wS4&$-`jTh-{>7*ut5z;YfB@qQ2msjfSpr*X!j28==ssxaF(NvN7An3L7hJ z%(3y1jYT#V+n8%(o{fb>zAK7<{~-aeLPW3`P9Ha6OzW4bkL5gY3S=Z$8Rxt^x`te^({$GXKtHrd$BK4W8> z(6C_n*kj`<8(&MM__eOAr(}-6Gd7;3dNw_E=X1lbuBQz4Vzck~CI1B* zFS4dKUS{bchfe`sn8kg(Gj-xNos*Znx@kODyvngG3BeS8}CW3qXOr9%KJ7xuyIVHdquIM0{;~F zk&TaSd}8BM8z+Q^|JJdTxS+BHp9$r28z*g)^%ed~L;8)r(%)BR_{x_yzOwOyjUR2C z7S3;Nd`J7(_=Y{ikFVL<>&K?}o|gPP>kNx{B%@EQ_+^kG993}E#!r&*H-SIf_{GMr zf*+NPKMGU=rSsr;mi|MME=i$G3V+%-&-vfRUp6vQaq8caO5|S~|FEk!SGd>HQX#eql*%a-r%*EmC50*}egQ`fNvbAL9fayB z3p}kiuP()G38KX_*uTr_hw1@9_w|H=FwDfCRCSE-y)p>op`IXrwznL()ZNuh6wH?5$*Fx-;kgkiwi49!g7Gg{h@^8+})CMhg3{t2{FWRfxoS2!~>4wJ$t2K2|cBf}VmQ zsdOR5Pdv51EwEEar4X{)r{GAEmx7;yEBHaNIgf`iJ43*+a9LTN+(@TlXZW*(Cue+I zm)R-oc{Gp2Q=u|9g?TBgPGL<7^HW%m!jcr0rod;x!W0&zu$V^vFP2&I)7i6`xVv%Y zvJ{r5@YK+FjlDg3Xzp8V!6)L5+9s&}wq$=tASt8wWxkujckL1%u#J{yyeIhk0&}`%kbW$M4<+e% z3f0;tJ`%|DmMyksGx|vipK`iz(aFVUDSV#7TMiC8IGMs19C{A=I5?HUmz>QUC=R|# z;WQ^z2iXq3PT`vr{@~=C!nZ6jgX&i-BK-P6iBLFguQT3R`u!UaxBPHg$Vg#J$o|EBP_;3Uo# zne=+}UnymWP%k+KfT zIk@5U#c$I&6RT8oaH)f;4yrk*>m4+AaJhrJ4jMXW3?6G%_Ds1eaiGyYiu9aL(9q@SDHG;RCr4XkO-b_cxaGireZQ`%D zEm&CxHnUMLy1_lYNp*33Ig;YR(f4sH{kyByr^psj;D zB-&132Z8TBnbTg7XqNKzZv`C%e@tr8$-$itIY$sj^>ENr zknU`hI(cJ;ROuyAvfV9+o{FpU)hwm2gL@n-qS_AnIk?w><{;_dJ_r3BjCC;1!Tk;f zI2h(&xPyVLf=C$ZU~q{{2Sc3r_A3hHG~Q=eB4_r+Hsy`aBOHu$Fq(4YHiuD?CHB@; zCSEfzjG+ymDq`w*2NP&{VVLOPK?jo^Op%O}1o9e)hO^^!?9`HSnSD$)iCoi8cQ8YU zGaaaB2EJn~7_@KT+7{2jk6d+aj~A_u+$W400q zG(RsQo^~+H!CVLP9L$z5$H7D7JQXhp85+J?xKaGO&UdiD0pIu*(!!!FmT99ISG%+KG?St#zAbFFzHM_j zXQzWl9qe)Nl!M0{JT9D1I@sml3BiB>Jy!JZY=xAnbCl26Mq}e1 z(tVEd1#{_nr)Z7kh2OrELA-o}#P~T19gUuL@Qs6S+3t@QeJya_-U8wc#SQ6qLit{x zF-Q5)!C7{OD-yr6t%XR=UmX1WKWwD@D$(CKGk;iy(Q^*|aPX&t^Bk3f^Z#*h!NFgg zZ12hWn>}idLWJS5IZF5CG4k{rR)xyW;o?;@M#daaN*jq-R5TwLO! zjEi=w3idvbn{dIEQjWks=P0=@NX)#a3SohZLKj6YD!VA_g6HrnxbYwH`#UAdxhU^~ zt7S%;RKAq3qKiviR1yYWSjj*lVX=!UE~>i7{V9W#YA&j~sOds+F=9+MDK#Vu5lXA& z;xZSt-S~-52Na}mfyAWZhZIuky12r{?JoGg*p)7>a?#SojV|iBai47BqN$7eF0OXb zKq!p_HWb+Up?JP(Ecj@_8NJ5EbuO-V(agoQl5}miM0NR|OQgAr8-zHhTcU*vLT2H# zMtBn|+cdH3T$x*3v~tntiUhwa-Rz<@@g2qdy41IA**21Q=0nP@E^aHunYS%1FVXfc z?wgaB_g^fwgNu$XD)fnkU)3b*P8XeBoOSV&i@RLD_~S(v`(1Q((alBDh3=xeiykh9 z(~K^9y6ENNeis8=+|71z(a*)bF8a9W>*DCyta~V`bIyBbv;HrTNDAS7F8aG5o%o9B zl?ey3vcf;a#bC+)fI#vvONpGJE{2uLETN2)N{x3h!Nn*Sqg{+~G1kR6m+sCgm*l1J z5(P+^=wj_d%2XHATs-Jvl4R%oFOywN5uB;dNJ~wZsOmy^j)T-Yw=xtQ-F<-&0hxkw9}>mm@ubKz6lFN=7Bw0UtnZH7W8a{eJ@mW$aE zeaMX;AAB@0%n?fe?v>}#XrIJWQ{B1B0v8K~zRblU7mHmiEtSK=nM(w}V{WYNs#oG^ zmSMRNSFri!Dm*T`+Qk|d+gXs%*Sgr~Vv|cZ_*n0vkaEV2M zeEWFVjn90}lY+LnxOHWLS-0#C7du_-aq*OkM_oMTVwa02*mHWuxn}ZiDbAk@^Z^PVAX+SexEbKFovwL|e(mBLMnx3!o^kP=;NO>0cq7jbg7e~}A8CORI96TxnPqXx z@^FoZUtRp>qN0aOJ^b$C9Oqjv?$3YF$ehMKWP3R8;)08RT>R_eFV1@>ix_5i$@`lP z{ai+Gu@9Fh|GCKUV)vEIe(d{%YRODgu zm^f6S4jyWIs3Y`h9%_1cYj8a8RrlhxQwgS9_-%{{d6a4T)qA#sC;mZDE<4>t7kd0JA}EDhdVv2 zA5h38Q)i)c@z7O}y9B;DU+LzdyN4bU-8AjuJIgt#)SpKDQS5FH{XE?3p|^)VUc9F2 zE6n$>gDr?PY`H*Lc6n^@`#juVlC(hSFUa#f$`0@_(8Da@B+u);a|ScX!w?T!7ARvp zjP)?o!!Y3=?qQ^dQ66}xY=l5&VIWR8nv?-KM;0jKJdF1+iCx0O1W9_(gYsMPM8V4} zR6ZXYzbue4g>AP`ndV`-hpB>ZIaWZ*>?851l^MbxFAR=U)jT9UEDy0Fgzmxcpa(Dl zm@L%8d>;#Z*d9_IuJ+NuhvUIzhxd`^!}H*KIOyS!hrr{@Ber?i?jiD!_OQgmQd+>n zZ1ztnkwwq(FqebH!$Yj{Yw?Rf2`v0MbH0ZK!q$3WY~H>C7YSvt$A95tQ!k^c9@epO zJ*<$VRUTFgvQpp}$@Ogaj5QwC3dI!46Hga!@UYRt!$RETVY47xJi0!vQtfEbGYb_u z4RiLz!+fhGosf)=c-Z0LSr5;7*y-U>NqXADV;&y&u-n5P>hoX5E)P$5c+$hal8Zv} z_vFyESBtE?r)bIF<7Zq6?C8aVaj(dE#>0_ealM|GDCeS=JnZxEf*1b`#XYnaJ?!^l zgrDlFEK+t2EBmsCS3JBb{0BVn9htd!zW4eWvF5LNc-_O-9=`GL1~Ym%=HWw56dn$H zIO^eDjuc)QAlZ+2ct?<4mt8z%%|9{U6ADFr;NksJyy+r^dvQGLc%0@E;wcXwbEtaw z%){p%c8Q1fPdt1ose`w~1FF*^W!noGCpmV6$P0iLf0fG**-T>i(!*Dr6+H}JbdmCk zR`{)l?>zj*3Eac?9?o!9XWnu-KX~|2g#7H`EJxPCte+%GCjdO+Ten?Y_g}o&^B5`o z02I3yJDhdS!yg|0^N``=Pfq?G{$T@oxZvS04}Xh<*`=k|zP0kla@jGxom1Mnp)t(# zk>%qOA7%VFn(YHVe*ZPr|E9MK7>G0ENNU1IzuOZfshbul`92DK)bLT$N1@M8A*kZx zn?*`FVJ`A<$ERh=3tquTMIV>?@$;w>Ddlqb!!_}^KP*xz`*{DuxPryP{Kkz1RsDFU zu9{CryNT*PGIL^UmtCwVBC{^(K5F?Gxvk=5K5F}@L%3ME+y?_W|G7}9%<_0$vA#>< zN*{#v1zzQ&o*<;`Z<1I!7+?0tXy~JnkEuSU`DpB;iH}}B?)K5t$2C6M`{>}KnU8CI zwDxg}kL!F~@1rH_;$#20{N_Gx@G)w!(!vL~PkS#`2-hu+Tl^;0`tPbm?Q(~WE!WD& z%|3Q7R@S{4Z_(r|QQG*p)yHiT_kLELGlKS+Sds?ml|> z=;>qYHRbzP$cdIJA7`RME89v}Dn7{FHcaj%d2 zeDwE`cp`CpsdB>~WwMqjdEIMPU8bDLsrJp8G6Q`KqIy1t&@#)Ee#?}{n^zy~qURDXhx?KNvm6!`0vHO>qFWFO_1D^rA_*>a`Za%DQ(>zy*Qef%~ke}>>Q zeW*S(A4wlBCvzXV4}-J4kCYEn@>&9&e%%_(=PhvB*c8AU@i$*vAqd zkNDW(W2uj2KGv~+(y-b2%YCd7WQD+$0!d#b$ZB@W6$+zkOX_%0@QgyVW=O z*z9AAkB3F=ZR`pEKl0=Xg@LU=W=h-X<53@f`S_a^^zpcl_c%6v?DFx1k5_!W>f=dv zV;|4^*ym%9kEeV*!+z-FUCt5}GD?__aO{jK81CiM|4d1sJ|Flv=Hpw=Hak+}R*}m8?Bf@zH!jxy4v|3S-+i3(ao)!TAAfL+=Vvke$&q-hOf0`|EWgn(Odke% z7CPKK`yU_wa-t5P1o+QKMu7YP1pzVxWCchB_;MSj`7=l0B>~Dvn7Z=f=paJJ zR&34O0Q5ve&b%PjoZ1!!C>x+CK;;1Rn^Z19`2ZDyxO7^(Vt`A7xO-HRjP#yFFHfuv z11(k@ph|#h0ex(tYJk_PxmqaY)(GN?vn(2ur4z3e;IaTsIf4Sz4p1jRg8&T! zTpplqfU5%36a8tiD*{|8*`KZ(8-$Le*h}jNxH>?Io3DpgDh%|J6!gh%6rf3fJ$iBD z0H5l`HH~8841S;NW&y4Za6^EW0oVlB1-L#yb1HB??p-aUILaS449~BOkA>VA;HCgK z2WTy&*BKUDwUyMJ4a9JZWMPfyI*g99ZVhl-fZGGK4KO6Y&;acMv=4A+fX)Frl**^) zhmKSrz~P@VI|=dlN`)SYDf})L6rg8-UPA90pt~U5O7k)c*?LHn_}u||2e>!DeKg&v zGS{BV?-QV}q~0U2Ux019E}luitQ!3T+#g_Iz|ZmEQ--2&N6r9tm^*S>uZp9C1H4Ft zVpl2aRw*$~=g$E?Tcu14@L+)90Y(HE8DLa^(E-K;$Xl&6TCKD?mA|)F^|1k7-VrYp z#|L=2X}NJh?AbVPdwEhOh(7IBE0Y3D4lq5y40e*NvQvaUEx=SkNEy0Xxq4Hag<+-; z)d0b2rQNjHL5&u~UX+tU-?UmW16Tq63~*j3c7P25HnPXkCLI$_05^aazz?u8z}Ciz zAV3&kL4d|h5>bG3fVlzAtX5_Pm`!b&{lmfotK(YFVH+r5bfAms(Qszrp z71t;W11t)#IKYwsD>xE66fOf?*HaE5KffKE>hI zDucvRtumeo@LVa+voz@%h4klza;92>8&HhCz&<0C{Q+JIz(cLvWN3S3&bD=huQ2ps9V)WuFV-mY_&HDTQvtpV@IpQ1E6!<0s$QU0<#N6b z@C_R=z;^+D3~*Mo+R-QXd-kFLKd>o#5dR6D5h620R*38n zIbpp03xSt}C?m**3K{es)As)2C?|VW=j?r<8@JA-La!u{(Qd61+$rt!Z_Q$%R1HxrL>0l?uT{=H7muLo60H%U zuSg(e%vz;Zh|5AAlEI%t@@t3SfuHL_wC|j#6XNm^bwgYcqH%~OA+8K@RfwxYGzd{I zjJrYo5Z{ch(riWnafT7&7EyV31j`zr`dpxUci1Q;7IYZ(%g?3Wtdux@Btk=OMu#8d@`g;xpm3_w)HxNyJ~|; z4>3H%>`n1|+>j8v%^Jf(3=Q#6w|I6+nH4Pg+i?Unv2sST?WPo*%~5_XC>#@FY>2IM zb0>uuC-NtRc;flErsKo-o96Bc852W1C^)ZgAcc_plO@*_fg}DXoK8E0n8Ol7%nYH1 za6-5tv=GShIlT-<`7##JR0J$5D%Bie}onb zu`R^*5I8Bdh1e(f3j)Wp|AZhck@j+k zS3?{K@rtB!ZOIk>!4Rj5%Du+^Da1npZ+SoVo$>}7Xmw`aVW5-J-)<~-IKW!L;S&UA?lqC@eAiGPPS|#q1?2+CIh97Xr}xY;`b2e!g%dXIV`K4U73Lb&xg3c zxjjTigugiXhxmunz8H{s`R2kkFijUPLB)VH9qA<|&5Dp60TJk8y-b80K`x1~c~=H0 z3<;qW3e1g=CrG})0)gZqb6LU5l~T$_s8EVm6eL`y6h){UVOoUg5sD*JiEwR%>mpQ* zaI#5)ORQ@mdf-R(2sI*bhPf<4?Fcm^9J(u^P^D>AcKlnZRun7Go0#fE^kb5gJGFeAOi*lc8Y*`dDrxkPO6|NNQ7oWSjMO z0kvwzTul<(VYog*^9Vg6^o-CV!r!+g+C}lY@rDR3BitDAT z=Q6d8;I}cCL~s2chT9{wjqrcW{0`MV0$~S%9R=PIp_3q_-x;BEDSlUkE~R)^LApig zE{NJSgUr1m+#O*w8zMsQ2z?@qisEy0eIwi>RvI3mUxa%j3}!S!y|;7ki*SF00TKE~ z@e1KyuL|M7QrixS@O0^|g-h?u84}@mUe?eEt7K5~Ks%4P598eB#AAVBgk&5kaQFBs z^_?m&u2aTJbh5y45ylHLA;N=#Occ0IzKTu~yz{bxvsDYH2tHLHC4V|RXGVmX5tgK} zGz~R^#%VK+qBN2b^azI|ydA-aU`E&&VN(Pvf*oN&goP1O5u6BfM4B7Hix5VLBKQ%4 z2+ic?xS3tzT2z;>mgxwygn72WZ`Q?|ds*w1dh6ra?4byABg`w+Z9dye==}sPim*7s z@(3%aZG@%5woG8=Ads07&i|WnxNq@FS~9}g2Tix!p>6N9*MA{6#qWI zGLPeSI#Kq~DE@L?>GF7yMwz=JJQ-nkgeQcvh5yLE9N`s7d8W4#|gaMtRh>VH%CnxF(HeBKh>E1&z~al15XB@?IFO!@KW@TkzU6u1n*3q4UDW zl0$B7o5uSp&C~Ij3LeL5nZ}K2v`eGCu-%kK>ojgjqm@K&7Dyv7OPe%qm1x^EZcF3# zG%kDm;+pEHF#IC0;eDAMgze5WI;YVwjXTolB%$PUTg6SWw7Z0-tH3U49B-J}_N9wE z()`fYBaNPEJebC$GIJ7ROZyNWc(JzgS-(EaTcW)Z} zQI6l{rWM3{LHDOIAdSH+g%-<5@HUx&X$+!;MF%qQs;uFH4-rjB>2xx0cp4+p7@Nkp zG)4-2bQ)vQ7$x}Rzsi)HKjaJbwm0IAI$r4I#}!XZgSS&nNWxFh89+IgKf4 zxM_H4Oig228b%ss8q?F5!8tz-Esb=m0=~S=EY;y~w<-^dR>?GUj+D19&MMqdsfH?6 z8v8aWDT+N^WD8`}k-S7$sGmlV#+)=BN+V1oqWm;wu?L#jC4oE)v(u$sKFZ~A+9YLe z8uQaw!12;7d!7i~JgQ)!Ad8rtrv9VScbk;q>vAe?jtgqCSy`6G@-z~&kUI-2(pZ_s z|D)&3NQe@m5+W#}2nYy@@=n})&b=ouihy)?cXxMp z3(|t}-)CRmcm4ir&HAj*?AfztpQ+O`$1-p{1CuiF8~K@m4H@`71CukbAOj1@at5Yk zU{(fZXJ9HdTn1*a{XZGW=5%UbHcotboA{Y5kLHE`=44*9s&A{>utjNGJ)~8K;$ZWoPZ|bx9^Bgo@T2zf$omu+Y46KP* zZtC3_zRDZBj-x|6`Zi`@QwH{AU~dLCXJAVP>OM-^nSrgWuszelwhXkMl%4Ws>4_aI zoIhRsH9T$?^@?!Z?hN|k#hVx@?8~69&~cPTdIk$bK*tm1j80pyQFi&LQWCm_#;1&%WF5+wk&e43u{0w8{e>BQ?J_8psaEXN%GQ1y| zR~N$N3|z^;b?UAexXMY_7)k$im-zS@UgJ`r@iM`UqxXZiGjNAy?+iT4z}*boquC<^ zk1}wdb3Mqw!wmez{BPd+mVOYUM+#+T2zo~GI0H{;v{uSRuk|Bq*plUhvN6x8Dl+go z15pzGq2b22Z?7`&lDbDluku^W5dUW2KQ?>5y;o^c*7RrzF_L#KcuNAkCWw_l0W29X zLr|ckEE3`*Ok_?|T$U1X39LX#X%Z5dCuK^KnWQkLO0X`!=^I&DQv6k}91?O$*b%_a z0CLgd&k`=ExTqpsLLLbz3Q`s1m5@(DHW}Gv^jCA{moP!XFA@q!5E2SXC?uhygbyVY zmQX}OH3{!aC@P_tgz^&JmQY+m2??dS&_CGolFUmn9%M-w31vB2PQv9GB7$^K@3644 zgenp$NT|rsN)kwcQYnyfRp#$8zRUPG+l=T`mrz4Oa|taZ)Ra(5LVXDhB-EBrM?zf* zAN>Cr$wDN1Jti?TMMDXVBs6>))l5QT2~AkPDP#F0UyhlAkklgnkXlO#tt7N#h1L?< zNNCHP6zcIJU3AEF?9FD1_7Z;Jj2&2kcqa*+C44DifP^j*x=QFpNfJKFwD5_9ZW5@_ zk6A*5%yyU1gQMgXIp0%)%5vhpC43>FkA%-8e9k)LPo##4^p((`h5e}Sah3>@ov$Pe zlrU1lC<%ikd@W&^gl{E$!}^0I43R($L8V8kV)9HeR03h79=?dy>0ljor$=)qRzN9#pQmlRTBGksE!wgc%a%OIRRb zri57%=Fwm=QfEt;BVjI^+Ewn&Tb`1Y#gMt)!#bM7={lCw7P7)(&a#MHjmu6#QkYyd zcA13b61GX$E@6d)l@hj4MQu!7C1JIM^%6EvYSq{^64pvsM}2sI?tL>woBY0)GX(`Q zvQfe&37g5oNlCG@JPCbQPe>O7!;8j`8=tt9hVzhU|FGB{5_U>B$j*?$E(v=i?3J*a zCG|Nk&5-+O29t0=LU)#s=6EKT+jz6zA<29EOS9-v3CAQnq)sd0xP%iDu1UBq;iQC9 z63$6D&t^|cI3wXK^Dov!-xqJjehoYNf`p3_u5c1PBf3O=o4LuwO=^&~W|p{0vrr-L zpdxrf!hP1cDdCoc+Y;_bxGUiv3&n?t?GC^BXGCd~c#!S<#YqnssZPH7GS?#sk0nIQ zh>`I`!cz(Vaq2S(&n3K+@JjM7-CxlBAIaMyj+Pgzxht7|awkvzrJ+P$LYDKcS83e| z!q*a_Wbe2>>Fk{oV`V@_f{a8NZ^_6aBTj}-#_T4sbahQ3vIquYJm;b;f6o$0%u{8g z$w-!wLX-Av@4zXnd6p}ZD{H2HpU;zX$jB*Ug^ZOla>>Xo(=t|QBqLo$9vN@Tct=KF z8Tn+|+Z{z^B;n9ScW`XG?md=Mi&{)WHe_<3mL6tv|-+ou@xgdv2QD*9r@WO zwj)d0v*ixV$J9x7xTQXn(Md+#QSr3!*FlzamGO~`zT}LIZZbZW(Tg(5_(Vo`89im3 zY#!T#P0^ZoI}sZ<$7^vC(kgAeS^k-f&za2Kl%4~zU&vT^Ev^sM=NvJJm6w#vJ${bp zFXJm217#5Zl5qg_w?C38N@jnl;Tt65d=uZ-GHxa3r0A4-xrWFXD#MoH$QUN$TN%H| z_*KStGKS0aix$Sn_+G{c@|O0pkTH@{%lfL-kENwBX3i1Be~@vsl=nek1jkajGJcZr zql|Gf$T3Qy(6Wl4@Ux5wd?3V0ShkSwN}O+^j0_n88JY}U(|ccNvpq{6P)Z-_xJMxu()+`op^*Kh?{-5zanW{3&C)j2WCtZ*YukUWd#(GikPr zIWiWI!!qW|m?vXC>(HOJZK7kdb@Ga!+9O;fV=>idmT_0cJsE3ctd((C#t|9oWUQC5Q^qbC8)R&hF>zR~9Wpk_7%NKc9`M@5b$8?>LU@)s zp^OVM&XF^hVknUOqKr#2uE@AbV`oRs!*j)D&g=F}s&zDOKJR`@$90W``%0(Wq&_U; z{#-$SS6%BA_kNqGvn_nLWf0z>*{`kFaQ9{WMH8=rI0X-6JmkDF3jU^YY5p-%U&(k( zlfR4?GWG_2Pg&tPb^C7V&zKjE_Rb^P_t8=F#6K*d=t~+M1-%I47E_)o@b8Bq#~ z&lAy#_iB#B~Gm>x;Q>Cgy^D3~=*5VuArAMMXrML|^s zbaoT-#jQojl~-hYPeC;W?<=UTpr?Xf3Th~*si1{|mI`XoQ6EVDKtVkPwW;0|)MYoa ze4LBq8+j9i`U)CQjpg+6ne1GdxoQ+w}J@@eo^q5g3lEURWMA!7Yh0)_)@_D#T(as z74&0+w5AIE*0FQG=&xXU_ngCLC4Qw~pn|Uze4}8Hf^naCgM!}nj`=iamnk`j59W+R z7-xNyczM3p^xrD@PQfU0L&0!r6iywf(4N2EbT@*d&sdY9#@ErK6^v0ZUcpZa#wz%c z3R1ASsyE%8Zz24>yc(e2qHp}_&1pY#_HJ!r>9a0cC-YYY6BYcX;CBTX3M2(4^;-q9 z0!4wQKxchbfnPyDp$qtQdbmx$OOPqrUXw0XgRBrzU?`wyL&+cetR7#zsU`KDS5$jD(E|cy(51Fjs57wE*IEBihYNTdWFpa9BfHx1+ds*Pv z#JCx(aHD_BOa&uL`%d#J>#w_dhdEop90hY(p=z)6b_>MF1!94Mg$m9nIICchg2f8< zD%huBiGrmHHqmH3m}ME`Y6WW)EN4!_6$(}=7|}M4_$uoB?c>_h-`xkZtW~g{b=EO{ zQZI^x6gDW>n3?zR@c7LNws3SS<1Pi;m~5wGS7;CS_?-$UP)6c}yP3}(5xa-{PmRlH z9=o3pgpTXDf&&T;a`cdbqnYxT82`Z9VGm$Y#h4PVa>54e|4u|XvUMNyn zZY>nl0Z5Wn_5Ll&#zOj=gCyCRFF%%)OGR!K1v#3oB9DsvDhjB`%aVMIYuKN9VXwvn zIl~LB6gcm7?~@BfAr*yH6j4Dd?~$aaih5nVLMhM^^d(f3R8e0=0~MuIlvYty#k(rX zs3@x>MClesHuAE%+Plck?(IQ`}!K*bVO^s)K*bPMO_sikhh$R<`(*gj#96` zPNp}T_p>E6RMAMqhblU$Xsn`%iq}oi9{Y zE)qTHsU2lk(VJ>RMK2YP)89NvAUQp#C(FJ0SLH8M^ieTQ#h+A}D*CCIs3Jq9Cwur( z#c&nhb14H<3{vqm^RHA4WRh>Oi2E=1H!23J_?9I@R18%yjJo30n5v6C|39wcb-d2+ zC(&|MM7~p@EzEXfancACBUOx1F;>MW&P%C3FzLQnj8;KAN{}Ro1kqbRz`FbFNnXY1nij68ZshFu^mWstHmawVWq@!X! z^EoQY-Hx5BVjbsNz`{i;I;VQ)#DyvjbkFt8-du|}c!PJTie)NRt5~CAIct(|C6g5@ zZY&l_OT;Q_Q{HljPH=0as7rOA!i=oqUNVH}b@f)qY%2ah3YO#oQnJaZSZ_n%Vp)9^=P7758bBsd%O0FBK1HG^u!^;-QLfp2hvmYP4u4aSD&e_&7g&6zv~Zfp&_>_pL1$`om7nt#U=)5lK9Qwn6<=XLiuh62j}1+HMcG1Sa@CJweiZkkgdeSz zit>K%3!;*Kl=7oAW&9<&te@6KNG!wppN6~&p>+kz`9Tj%t~~ReaK7!wJAT?K(Q7i= zL8GD{mHha&UHWHB#RPV#s^9yC{5?Oa`SC7u`nrZB6yEovHcP7eQNxd#%t>C$kFP8F z!i_vNQm*rVa(&=OJwNLE(ZG-Pesu7op&vAdxA5~W0Dd&~qX|3H%#YZ%aZQ<5So~(+ z)#eBw6s16HYl(-%R?#Pm36!uOG9PdJkdxaV|1Wbv`+N%9pG|Y7?_Z5AxCHN zluBU~HM-w>O;0+JMQ=zr){h_k_{oo-{TRoo;~6Q5G$YCrSn>;19T)V!yj4XMDM)mT zerT+t_@VmY&$JLJh%mqsA`zRqAHhscLeme+k3apGPCd{M$B#*V{KigFs>_<;Obb-{ z?|w}7V=7Dj$h0$s^&@Umu4(LQBs#;7nSLzxV+mD0$!WCuv4Atq@ni1)sSPqdk9z)O zuj+-0OKMaUo(N=Si@_aW6SO@^FGl1F|#W&W7)Nv8bu^f)@kXMS33!>hWf3vx#+ z{KL_ge!OCGs*QIDbnEomkGBHI5{v0w};-1W=HPJuQ&}B^3^M-`KBy$Fox`;C;7NCV;X5 z6lb*(0hA1&6!VqmV@e0`FVEqd`+B~WV|jVbMbS^n#JtTC;_n17lhhjG6(|3ZQBL?*{N*rvCc@RAc^2WA93dLiGTqy@;w2zzKhs(RCiL*OaR9X4O!EL*1kfaarU5kLBwF(5RZg_- z;~AmQGJv)LvI#+%7fS#GXq8I6B^4?7Py^~B`?u&re zEe8kChe_W6`Z4JrpcO?hkolL40|GD)d7YoaAeMX`0R0n0(Qi0PKSt5*5=Dn_l=h1K zHh|MJlYb3hVgTO-Fg$?o*==(8#{fnIXmQ1)kpYaNRtR{Tn~Vvd%`!2X`OL0yBpDk( zcxW<_!?Tjcao+I({KVwv00t}*6POpN?fZqJBq8G&0W>~ezz)C(K%!dxDwiC95`Y?j zpY@FZ0s&|N1Os@xoOc7Ovz+b$RkjccAfb9PeJs>wXuKJK6~Ofo(RW5fPl)!=C9eWl z6~O8MCI#?Y01EHw}3-Z#WzX;GY0q25>NdLjfEP;0V=i05@ou z2XKsf$jY4OxQOG7rx{NKa58{XG;g#>xmYw|oA8DVg);%1B_qoOt)W!#&$#o{?c2m% z2;gD>zqayS3gB`8S7>;)OQ7gg7G7iARLMsYLQ1+Bz^wr82k;j)=*gtpGz|_)rmPA@X%Py`cHEbyQvr`852b;b#r`HPmmO*iJ)x4Fxm^4F$;= z4V5%h)=*eO5e@IKlSLUzXegwqMz8|wSJb>u2T7-jhN>DGXlTgtcQw4Pp*r*T7^^Y%K3t%NhMF4cYWP4y zEf&_+P)Eap<>J(G5xYW^Um-fJ5Mx(}dYoEc!={a1mz%S~bNJW_(MUsM4J|aZ)X+pj z?Z$BwnlWk0m~B{kb0(Kp2ufIB_2^w7|e zg&%6@q@go4XyIHRX?VFKxeN2I8k+aPmbvjH@225n7XDQy_7e^Fwk4DBz37!HAt98iuk?s};$6tHe^O#ILBn(=dvfNyBgr-*Z_bG>l|T%6_eN zbi~eR4P!KnXZctSKWZ4qoZKKa3K2qYxUoCtv{ck!O&o8 zkf_^eP{?6w?(gG*8vGgp%ylCCXQ-xu{>`M+S@+@zf9M}W7|Ik{8f*ZqcwgQ{H!_ zhZL%vHj-`PwFMK5T$sNu4P zD`cv@_nfohDshR1cIG>#s~WCpxXxMHtP=Ytq|bWgJ!BxfrQx=QhZ_FYaEBG{X}GW9 zE|t4VMAS(0FHU-(A-Kvrt{sezNcd^O6Ae!_Jl1fUg+)7y*Q-R))n0hUxrz-*_=iTZ zhN3!(>3BucKF!QJQgr;M;kAZ19X=gVI-+&&=%Ay;>6pUtNijNNbr7K!Qq}o|{#!b- z=-5*K)#5vm}oG)gUERN1BejI`Zkrsw10@oH}ypw5k|- ztrj_SZvzYeYVWuxN|;-xCCfce@-Wh8t`z7Nk|Zlui~KAssH2dM0y>0_d#i<5} zz1gy`jv}mcte`j7b=&5x09IT_2_5h0sHUT&j#4@*=%}cpw2m@5%IPStW8y%s(6XF2 z@{0t0GyJv=dZhmjWxtV={y-rGB7~K6RMAmYM}xOxE9+>OBjs>Iub`2%=Q3M}Ea&^a zj_Nw<>i9s%vQ5b~bkyQh;x(CUxRhL5M;+#FH_>dOcOg_yM|~ZQbTnpp106qqg@(-2 z*XC?n$2-hNBcmIw5lwV7WqGe>zJ#^$jqCVY=xC{-5%ZAoE+URJj zqn(byy0g_>f3qsZ5*Rey#P8|UqnvS_T=IPLN1a(Z+ zF-=E^j)E-f_)UkY!{VaDI&2+|4mZ=!`5h7{kXM9r*9dyW_NrUb@0qE8=$Oo$grq}Z z3P-oC5r68K&U}_m%kg=8KF;Lm!!zEnqWxA5ypEd9k~xgD_lj4Fjs-ea>sX^>p^inm z_qoL~R#?oqM91|t-k7DZlqE666PD{(p+h!fSL#?55v~<#4<9X={=AfLt&Vj%w&>WZ zV?C#CpbBKt^h<2gv6=blE8ajTRna%I^P66`O~-cf<*(|+j{fB1wVX-tJy!CtfzjT+x zoAc7@{d?Gls34+)hz}wmh?pQ^gLo^5EJ4p8g0!H7cV43%Lg|8^NL&y;P9lDrv)j$n z6N5+!A|;5_Ad)$?#DS=Byt~!9pG;`#KHi+^;yiNXy*mA7Ap;|O?N}}*i5EPB@ia}J$ zRG>nu2JvnXy+{(odqHp2>sCRu4x(BR?*~zx$|@on2GJ;p8bQU zEQoJ|_>5ZWqqxt5_#%itROhTYIEa39bkuG7`UVE^B@4fzzLb)40P}()-t_PRFQNto z@il9H69g^$Ozu&xv@G63zac>kW&Q0{le3hI{*L(%L5yZHobmf0Mlc!4NV!G@F>bLp z*2ZK?#sx7plmAE!m$~Z2cozOdbspnQLB9m?EA@5*sRkwnkr7125GsWr1tACVGKg0} zC^Y#8u_=hnLHL6R1YrhY1@Y7Q7%hk%>%4Vf^dN#kJnbVwY=7(VWa0)(s{H^v2#2~v z5OafYg9rz4|4h;hYQ7+T3u0=JJ~#FL)BHV%KY}RRO-v4Y?{SC_PGJfC$Vt&@LHrp6 zrA`lG%sO$vNs6eEwV7;lRuHp;nASh0dt%N$n%yT!9XRY6y$4PBf5UYb&7sPtbxF(3T|Hnea&IXojWF)h%T1QbJ zvV|J7iSKZb7MjM^AhrduorZG|JA>H8%68valj@MqKD&eT0VMXZd=DetGPK^8w4a9I zzNCYU2ZGqRPEeG>p&+hpOePZgJ^5%5-)D_$+a>xK4Wb}U1VO?ZLEL0=GKf=5PBWef z;%pG-f;i97t3g~~a)t3C<0VG2d6@=Xm*}6Gc!8o6u2JhZiN4Nqir!*PD(>$fZfEj4 zLEL42FH>?qh`%!V111j{$<(7v`Qsp-Fn`MUEK~lR$qUARxLhjk-ykjA3SS8EA-oQP zYBDb5P4!VB(6^e=%wrg1LjaSvLde48OlF-&h}AbXA%w(`w;yH65RyVj4k1qnd09Cn zgzO<~_{*0XLRtt9)(QIiAlG`4H3Y(JjE776a)fZ>gz?(5URfI%O6645JU(CLns`=KWDv5{eFMO(wDAIY-q4&h#5 z?^BkCUnNywIVBBRFDi#nC4?Phfm{mV-4NP`&>@8PLZ}u(gAf{q@IDvxK?w9RqIw85 zLZ}%+s9j?15bA_bi&LMBeKTI@Jw;uXY-!+~Wb1{zw-`j~vyfhkMBa=v3ZZcbO*pkh z2rWb28)a9jRw1-zNgKv?jBOcr_Vw&jxgA6JFoa)2m>5E*5ITqO zbqL>t&?SVfA@mO6GpaW#=rep0LiZ55arU8&qCXD7Uhh>@5308+$vs2p#Ys~Kc`GE) z>6^l*A*^Se&qK8ME&7M>We9y(E#+JErLMvoXZK?XT{w}o0nCXEWb#!AhbP6;e(Qrc z`eePhH#>Q72tz{nA%xK(3=Lse2;YS;oFx1g=eMl+zyCD94`F1c%@NczPx9v7AV!5S zr*te$!qt~~>j91l;V0G^8^VtvjAK4&MeKMcbvB3^y?l9k;3DnPj^4=~{_$35u zL^@qYX3*qM2C0@pkV8R(c7Sa4b zqnK7<3VBxoOF~%68B;fUM^TZHJ{2H^l{7T2dcA8^2;*0H_iL#)V|WzFiCn#+@(L$Q{&D>^y#Qmz39adu0|xOahF24%=`*t*JH_~ za4j?SI+GiWKXdlm%>QD%6T)34_ZTVTeH!u)(}_G_$-@x-4x!ZEJdYSjPW&+^5qTQI zvk;z#@Pa1EO=5Tn-#;O|3?bG447{RV`Yh_;M)5j?e<=%X1j#s)+m7T>2BHnb7~Ynt z6g{{z?#@Q>mVqpWr<`OU&VbKAB1hvH6BsEKn*;?S)hk3tl9CNXQqv4%HE_?seFNDH zWH(UBKxG4)R%g#)AfJKHIAcyWm5VVqW4eJnO!6`|XSMtW3K$Ru3K}SH;B5oHR7&48 zFjpaiR(?hi14Rv#GrU!RiWw+wptON921>Ank_JjKITM@vd$vXn6Dez8$tH2{Ma=40 z?}G5`CPC!CO=4X!-#Z5KZx*!Q_p2tp3I;0Dv9yVbgenHA8u;G82m|jLc+Ws*16>UI zI|J_zYNXJ9xJ;`DZPq=8WeRvTDj;0FVv4NNxhhk-E$ z#u^A1&B63!9MAZ(fu9W29-W)Q*wMKsP?uwQi7kRc<1He?fMh^1ppub{ zXqi(djz<42-a+}v`Jz4wbd&XSOYa$uZXjsDG2j{q88BGire0ydGQ2JDNM~tB@7Csi z>o<2m@l#B zrUC=o3~V>B*}(bx>03BsuYr9A4jVXP zU_Yy^of>O&GY1tfi|P^cn|UD`iJGmX%KaeI>!9HZQ=wIO6|N&oHlUAz%?2O zO59lk=Q!yyIcea6fs1s=IiNhXp_ zyk(+Hxuh&6=-10Q6Fw&KCK5~}nrM1CiR34@2|^0TswCfTOJ7W&UoQ${Fx7;SuP2@3=mxVmj#s`*DzRPA|H}nU6f#lR z1VtlAgcORJC}yHK$;o*WWlhkFwvr}FnJ8^~KXADP;^|L7dPXt&W-?t}&|A53Cf3b~ zDsLiR%XoS>N1@b!xC*BC%)E)|J=>{hqLPWq>{4|THB3}7(QLb@YT{iJ@0qA(;(f-U z>;t($gyckOny6)>zKKn`A$Yr%M(V9tn#x^FcT#9zg zBe&R*8*sW|?_i=M%ZW$s-#eM;Y@!Pb$?dL8NI#P0V-ug4C^r}7=c2ob9wrV<#lflQ zX`+`2|0Dz^;Zqa6O_aCswvEqBd~V`13!hu~!bBhH$tM0b(U+R6RKkQ?sk=<{Gtu9~ zmnIf(7o(_|Objsbm5G5S265@%n%KWxd~IT=31^4+#>8L~Ls&@i4|jOYoppy8#uDNr zB>c|Aa1-B~IJZNLFfr2fmVG8pNraDfh|wm-nE2hqWD{de{Afa@LohMU#CYoACVn;X z6G>j?DN-qQf{C9^gJxt6%- zc*?oI69OhQ6Q&8vgl-~8?MRipON30kW`pH-iB8CVa#32hy}l883^OGue&>_zM<6U$62H?hLRO6t0uQ}68(X}i7bWf_Uo+AUU7tHs3r zv|HRP=UZoDy@@U4hKUU(Hqvk~v6(92?f5CX#ljV-D|d@SocH?4l)tB?Z8Ndm#10cX zX$V(%^H1Wq4XLl!g% ziOW>aEWBpo?KJPaOyMd!R_Km*!n#f^l9}tYneCQ|+cbUMiMhkV`&180qVF=lM@N0f zyN&wG!~>R)!Q%gBY56Mp5%oG6>=s&CctRuPLE=jjuS`5;PSIyfo-@8M@lU3F`t^MO zn)r`qEelmGyfzVKL0BkgA=*NWg;Wb^7Gf>Hg3m&{g|{q}yBi&6c{3Q1EEc*P_E9@F z;JPAVf`vp2NvuG7_$FI;P|xd@DJ=PHkNB1~vs%bzA-9EemS?w+!$M9rPG(7;4Cdmb zDwng|tDBO?!nwmS`7GqOkeB5)+o99~7AQ~_Du_HOWTCKy(iX~CC}N>wu2_W4VX|gVm~5m%$iMDI5{y_zka!!T4-jWxdq~+*@CN- z>b%r}L|S~WHEVuoc?El!WWc{D7dsEO%3$rXNvar~~YzuQN%%=gu3Ue*Y zvoI!)XFTH7uTMSSe&!wh7E;GxIrZKpY=0^B`MSBOW=QA4>ijD#thBJ%!WIjwEUado zjf`t7tYfm4adf}jqxOsS7B*1WFV3*p=Zu?JA>n}7YGIp&T^4q;WIN*y#)v;Vnddv; zmA=QqUJLtZ$k0?!9{VjEuyBwS%Co{q-pY!~BIP602dL_3uv<9BIwZVm;kbnp7EV&? zrI<4o&RRHS;WRbDWbcXDe~rCq;hcr@7A{-3V&Q^?ixw_fcz1y}gKeAS{f1LH*}HLj z&?jr_bJ2SeqMkN-^R(?67j)gi4XU&Q;--aLG?yL_{SSyPR?64|;x2XdzTOai#G3ak z+_&%-^9PI%X?~7-b58l&!oPLmer%fdm`(vSS}i=I-fQ6%Yd*K|f(co(4v2r46QSs= z17gsnw0|x9NAo|+XT;?tdFhhg4N;7ZSQ`ax(3U;0@s^G3Hga$@i;YAkag093c*X=q z+RTM=CD}-}k-`#+rZGvi(f)JKCWWjl$;PO?lQUqZs zSb%K`8)Rh90a1vBg&B)57G*5PNZF~x5+D;uqCbgR6ki<_AKK_-qqB`JHvTv$c5d_@q%1rrjvN$s4tm{291`7Zd~9Q&jX^eg zb0w5Jvy>Wc%4I{_aQO-kodwz9~*sb^s_Pj zkXU<2tQnL-bwc+4Nz3~8A@TlU(d@AJmcsxWU)h*;*ejjzYa8F#7-?gajlp~%Lu?GS zv5FOjvE(}&!)@HA?2NZNWc%KRJvn*=r(Rl_l`c@f@9PcHA8d@a@w1HyoHWM9k2c2H z7|T&o@EsB3ZTw{8&M0qaQ^y1CDw1W*rmTY;31SzY)EIhv&j$ zV*4?1k5m6X%8O~(*v&?Y9Tzo@i+wis+c;$7u#E#OCp)i)dN1w|ab}7F4#C_<1|ao*f?wB9GShGQpfTAd|b>qF0?&azdVp~krgg6 zl1;i2xNPGJb&LjS&-Nu!7&p^*-Np?YaPXFcn>KFQcxvMr^-}6!HXhh`XydMpdp7Rd z_=~EAojh_}Tsba`AF@6y;7tqJPKdv4JhJiF#uFPQPk4QdwixSpLVSC|J1Dxsp@sdQ z+jwE)KO3)Y{A1&#jaN4QrOw7Wy9>o_J0UKe5HC)Ml#^brC!$C0z#U12ykjp_q2Oli*23l^1c2;|H#hcC~ z4`W^jJN9SUUC674{0<5@5G;@6ifl+!h$V#?i!c^tjN~doML4MEprnIR4oW*HQ*zpqzsW4k|h*Pi=H5^=$|5I2hh38*wUe>h;t>Z;w=>$)9S8rhNyry;_G;qR%NY z`jiNr5_CO3K0S^ux2idK-=XJ|sO6x#gBlKk4c{Em(o^ESKl2_wC2BjU!@kvZaIr{Y z+0&xUX>sX%mYYT6zBn!FJ80mborCrc8aim?prwOW4jMaX;-IO6W}J8LX>swi$TK)w zbB;bf?KJ^~7IZjyyh*jSgEkJ@I`D6Z9$r6QTajAqjCk*i=zK<)v8f##bac?w!AA~0 zWDA`gba8O0N@^zu1I~EXau!bOe=2pu%#?P;vUPLtv4h7qqd#$Qw`O#qCs`L|OHD1~ zRm-pQvi5Y)%fUbggUA$HBY7Vty&ZhU~{)}Hz=?TMAIBGiwS#rj9p&fo5eD7d{ zgOLtKIoLZh>Ic&2qwA41zNydaQ5j3U>2ZvMu?~K8u;Gk&&I;Miit+3cO`)VfLtugf z!-47G7YDyOnCKvbs@Fllf#g7Tpg2%DOU<*Q^I4JoYW`y{62_eMDsxrMIL(1h{lP)V zLG398XfQ50E8hMx?PB4?Lub7WLvNiGmIK?t@6^!jo8uttU=le$EyZQaDQCTx2){X? zeGuq&jClTYf_$6Isedq*-;#+eRgIhaj-^_=J4hv!6> z9J%K?nD2P|%8_J&gM|*3I#|Z~iySO=u*AU_*6*Gk7d$6Eyqb9Fc$U7?qLw>Y;b0|e zuKg%=BUw9`g{twb^I{DP$>91(D&soGdmKl?4GwLu=?#!g4z@Vh>R@xGeu491n}h8% z_8sh`p>$q!KQBg{7d>;v`Ok}G=LKEK&_1Vos97C6bMTyOlJgGIs>NS-aDeR`c5uYO zLFR`tE&H0r9(8cc!6}-)92{r)3C2EM-dtm!Xl>1Q0ArEy9_!@)TRC+|j|cW{AI z@16Im4j07x7d&#=!4(Hr9bDs7+SIT41<{?8hFlP#3u6Aogd21UaBzzi?$A(jaGQC% z1h3qC4(>bn+rc9Te>r&I;Gu&B7o)E|PgpfRrCMUPJxB7-pyJA=K6dcL!Bft=|AM$V z)A#s-c(Efb`J(5^3kUyjQXUsC9lWB6+C`F!e;xcsL&HU!>(%*dn*3eFxQKGGx;zs4 zcqhtO7t6Ay!KGL5D1K2i+LTt0ZGL!Bm@mBkM%7EF9-oVN7YQ!zz2VaakLOdnIONzG_!0t)!aW#iBdDi<~!?i*!!y`n48B z=XH_KMSe~#>Y|v70xpD$f-VZVDD0w$i#xaT6u2bbz2qG`Z9_><0zY9+(c&&jx+vwM z1Y5Y-&HLn|=6}(pIT{(-4GSceb5Y(!gD@I~@wSV1TugHDn~Mr`@$aG+DZ8lTqO$9q z+Sbm&AMLiew$p;q=U97ky{x0mzP6sZDyEjwbYLM?NA5mjAa_~Y*6PGp=@cK+M z7tLL?aJ{V(skR$l7A;-0a?#oat!LH7^;RUN(BX-%#AUC3+PP@&qJxW$F1onr>f%Ee zom}j_9^IKFR?7N4zSx#&YOmC!GUDPB7Yo<|898)W9GIWtyCS-~aB3&^ zaM6=$_=;$7#VdkHZx^4r_}0aDESMm#64P8dI}LU;LU!H3+|^5rb=@$)Wt9tzec6e43K|DiWQew zy@}Vd1Fwh|BfOqA+{FYJzqt6`#RwN8U5s+^qlGmmV`NN2a-T}*ay&Bb*Wf4G?9V!MkSE~dIT!&kf;Tuh^`=wiBy87>yP zSmI))i&-w_xtLGmXmRvx7js<9W&6*risIKiPiR}H?$^Wu7Yk{Gx}cHUZ*E%mY57*Y zn>vCOT78psDa{ftR?)oSVmWnJwy=^a;hI=Z;YF4mtl9BWmNhQcx>)C8J@ucIxYO6f zQz`8wr{=gWXtb8QF6vwt8`;7p7n@ydq2pQ?z177w7LrTXuBTG>4&O`I$&y1Z4pT>B zzS{*|-t3`1=3<|V{Voo;I7pt~_w~9i=y~<`<-OMmWF&N5%)c&5~Q#r!zq3D>(-r=-(VlP=Da(8bwIPtGyfTPgpLpj*Sf-{=p=rXW(i*+S-aulri<}6MWHZmxw!2jI_#a+@3^>2GoFioT-BZ8<=Z&Mgh6tlz7{h887@nS(dQ)Usn=V@qT;NZqI4K#!YCWY>YIWL z-n=QwF)z>fHsd>t6&NcrR$`Bk@uG8F3BwGVZpfDg}h6$|HssKKu2*q|J(S3eYU}OHW&l8PxRh<@4fey zO1_XnXdyr-0Rjn-03n2uP;T4Z?QNq&2qX{)HH6*?E%e@d=RZ4+fA9aE-n@@SBWW}m zX?L|+ZO?#9$t!kDPwErETLHWuKwoB(N^b}74%IuuZPdE~ycfXV*Zh~R`90VDMX&om zpfUsK7eN1jdoiLZ?qmLM1p$)(kZUAR|GNK^00so`CHa21z-9J5m83D`+;74YDAHYm%KKbemf6W_ir9V#g zwZ7s1ZlQN}0CNJE8^Ap31ubbpzVu-?{Jsvp87!tVogcu00Mr1q02T(YC;&MCg?uA` z4J;sK11gy~6wLx85DXv`KqLSofN%i+B8Q%>=aC!!8#nwPSC2CTumZ3HZ~}PwwlC_Y zKhI5nvzzWJbkCdqu{T|Xmj1K1Y8_5gMSK>r4EYQ^84>YH`TUuKHicjhfu z&%e2KyGfG(b}=TeqswK}jxl>Vx{n6?>=e4_9Ax=}H1Gp>8o;vv4hL|A=C?ck2LT)n z;8*~c0=OK&@c{k_;0#$WfD-|n4B&LO4NnCyy^(vz_2QQQ*3-nS=a;i=hYKuoE`aj^ z6u9l`Mxn`V|HbUQn_eee3E*k~H?uj{0=SWluTvXu`{!~-QvOx|w*$CCQ*HqF0=Q2$ zzwNJl(QWw7+y3OOc~?ez>B4b~dfBt&Y)6qMZAAVWer7yjg!>ukiyWIo-h6_QX`LJK|)>0z3HmR z8LLRBDxnhN$`a_`>$EOJ#a5$6NvJ8ImW1fL{u+||07ZPOhP$*_o8{{;UDV0_ilM|^ z|B7kedJ^h0vw?(0TnpX0G?d&Mm_~Q~4=TGQG?mbdS|_26ggOlqo3ngN#w{e!Qa>?C ztQ8rGU!48_tv8#=R0)+0|h3Ed@kmi}0x zf3>^yzQ?qugkBPQOX$O?Z!?oz{VfSQPehUB$ujRqcvo`oofh16A4ToE{`V#HmGA)x zQ;nRZpM?J8EyNE+Z@TNJMO~_5Va2#Zt=($}g^7vyM8W_GpGp`gVUUEu5Et@Pg_$%2*XWRThS{L>}Oknp{PMRD$}`%Ln#s@{${;L`UlZ2nCXJuTLF<-(0>U|k)WGtl8s3HmbBm^W#T+Uw-WC;rOvV;v1 zR0$esE5YH^poEZwFynFm^XW8*7@JH-Jc%(R_qWu`?)i7za~;EyaOSpmR})ZnS|vM7T)rfz3*>%-%nF9L` zOJjt(V4-iyeYgB2_x&gC`(NDm|IP*Gs^{(S!2gGYjS{voXA?F2EALjue=^-HVT%O1 zA(`;NAE$Z7j!G)K*u4|j&Zz`;NVpnw=Qj#FnfW)jCh&8 zCBY$@YN*K)4of&9;Vg|o2}dOylW;=9NeRcvA;VGsP#4D_JuPw51OKYANk`{+Pf0i} z;S9MwQBv%o|H&+G#zTLVhyIoi{kSO=O#Eg26{RuJ>Wt5gtMn*0fxn&fTkuD=ihF3-&8F^*+WF*Vj^*B03 z#^Dz3(1?1P_&Ul3^k|kUBcF^k8TpAWNb2|4PfIuBAG-?w_Sj#5t0R2;u|Gpbri`L8 ziplWH5HbqOC_**n`tO=mNJfEH-ZJBTjib{`7ma)I*k5*RQgIn2WR#RqiW<1oL(4=1 zA9(2D?q0j(1fP3#Gcr=j$|xtJj*Pl8%FC!AqneEBGAhcbB%`v7Dpb)Ef3GM0flvII zp{PH9&8*6b?Rnz=;fbqi4H-3M)RIw~`3;Ju>v8Fe&nLdQ&3~gV7dLHiMm-tzWi*k| zR7L|C4P`Wv(OAZ%Cw|XUKTR5ypZeQ8^}qYnzv7f{&hNfvGMdY1DWjE)ub;ZLw4jW1 z+}Vp*ns_NXpP8GV`rFEACqt7Fl+j*B2N|Er7$~Eoj7~D%mhp~^&N8~l=qaO@jIJ`e z$>=Vl2h~0-Wpz$(|5|Zpp89V;_0yY<(|0{F&;0a_ZEx}i8E?t%&#l%Ea3{m`Xa361 z{N11V-<9zmwNyqw8SitG`^xx0hVn9Y_6^VAXa4ce{HNw64VjVBU&ej4x$;*T{9Y z+$B=``{H^&_YZsSpZeVY&DFFCGQN^AS;iC@6J<;yJInZn=#yCKx&QccKMlr;N7F}) z$k?&M)2vL~R2kn=X)>nCc=0@zUcAz{?iAyj@MTi@a|w5!`=`t3`(<+c3;#?RKgf_| z$TDWh_)*3p83Ag(j5#uXlJT>QxokI5>}$haY@a9NkFx)*am|;pfF^(P+r#ceQQ?KZ znFR)(ihi8LMUdB4d?|V=w&Pm;Mef z{cB|07?d>VrTuWf<8QiRzVfeo zq0%R6sl<`Q$V;ZC~o|9Wrzx!gIlJjqje#T;bU;96M?WY0qQpOq& zUdebZWBP0Vs@MMJZ@i-t(-(~L9((PNQV^}+%=>9M6wF-iT7W`~0w}Jz2tR)9k5k}L zkg6b`;@%2o$;2y2P>`q~mxA01d(`Dk%EK-)Csj|K7O$l|t>k8J$N# zUIinWqrLH;d*ja^CG@+A>$iHUo=8qpkY7Oo&Yr2jub`lUbdHwDM26z-C8naPIO&3! zg%uQ0&_YHb#a*={`%^0YETgF69zH{#EfA-Kf|3dpZ+*L>1l_V;E0#<*6)D4g?G8_xMf^Lj^@qd1Ml8K&0^2oHEzD1%BtNSSK9phUH-d6Aq z8G!}fS3v*TBeC~5x|(b0tKb8U9*q|554dgVui!%klN5Zd;3J}@XE+Odtl$#`1BkQS zeGxoZ!KaJ|D!3Xg1~K*J5Os2hAqs{n_>6Or8G47YcZPzHKBgmZ;e8K!N3dS-R z#dI`NQuRv(;}m?wQOY=8!34(iH7iB8EbwIgd0`?m>HD2;6iikSR-h}G!kW)e@V$bm ziaW-?CG)c6GzHTc{KT5X$Zlyf*{cFR4|+F^A-He!gCbNRp_(1 zy35fk6|CauZ%kJ!Si|5KrsRjQiD|zoSj*A=dy~j*)+r!B*?(8Cp7|RTY-B*pKNu)6 zViSY)G2(EH*rH&og3~I_sMw}pI}Iom%~h0z*g=C@!9K;sf6*+&;BTh8nC@muse2go zfY`6#0L^16a;i9};1JEd3a%?Stl)@(6ADf$II7?nIe(P9`-rqUuHYZ?x>M1gKo}5D zpSvsPr${AoOPVCl=QyL_Uj-KwTvTvY!8rxzvs-i`)4hnVhd2W9znpQG6kJwtB|G)c zdFkY7_aJiT6z?5K9CqC8tQ!h$Qa|2~ensP2!EFV172Kl{kuUBJ%^`KYWpldDK&znl z6+BSzM8Q)94;4I8@R&>fyi$BKmKmN?%*ZKrie~C)TZW+0}&iVnwWqI29QxGF5m~ z#H+}wB2`6#ibNG&6+RWYR7{E$Nh(@t-rTA?`BP{S8y|=jzs8DW6)7t1sENs=x~~f< ziS#)gE9f1>tW){&sYp{%Kt(|nKh}wp;*eiO(uyS7#ZB9xf9UE>SMky9+|}d6gIJLm zC;TdeimEEAsVJnPu!;&Q9aoMbDvGKorJ}ToVk(NOD50VxD`RDN+r^3fx02qE6W_*( zcDGy|%8*m3D5s)4HUDtp!Z@+xQo@?E?jl33Kip-UEpeifiq9j_l~q(xL8+hJO}O+Z zY27~=XW~Sm4H?x{)KJkxMN<_uRn$^ZUqu5IwN=znQCCGhQnFQC@hYxgy^Is+>doU3 zojjtiM>JH?h}CPXf_mgDkNC+Wu3vQRw$vlawD3|zFVlT{Jfek)mMX@n7*FO^(ON}k z6)@2*F+W!z3hdlenB?cb5Xo%3#EJCXbucO-UIam6DBsu-lAn~Lr#dZ_5B z;$0Q*v3xHTeN?=q;$DTA-YVv=_|J3R=G1pod~n!PxwP-@v)JmI=Y17@ReVStM0^rZ z(N9Hx6}jU@@pwU>NW8h5&?w&ZrAhIk#7f`CDn3y$K*gsj?0E58ycl22y#!olnS2R? ze2>%{Ox~hmjEW&DhN}2X#V{2kRE%WhKUXoFI_^W)&32DUuaYZ{HYpMQLdEJ+QKQH> zL)>BbmoItc>%_6FHbuW=a5BN2Jewzo2`au)@rz0uyfKlyms+aQeo=g_;u{sSS$MLF zDJrI^n66?f*(bqm$hVwS;9BaB&EvjfTymjj27~Wa%%stAESBu^gNj+?&&;P>Rf~B? zCJ6FF!n8;@hs`@z#XJ`HNyX0$R+f%G)ztSq**#QnAq`0t5fug}1xQSwNEK#vk z#bVBNdH~KOi2DcANq>?b-`~58`2?~!D>=GK1xbN}tBSQMcB|N0_>=rCQ4IMi#|9ODsMwfYBb7se+-$RoEzI1eVry2h7o(34Mw6-T zlO2WaG!Xi@2KRJQ|?k$dl-t8farPF=I8X zVfzq{*N~Z8Viq40&7UPz~Q9I8mee$sG*UDs$3@Vt7QvR*HD9*H8s@H zP*+1O4YkQKN#bde$mJDxHs-CTp}vM!5pM$x4XV1=*#=%Q+$&CMu3t6Q&_qKQjb01# zu+q?4LmLgvG&I-HLPJaDw_-})a;E&^p&4(MR~$Z&*p}2_erFBsHFVI>Q9~yUVXxTg z74do9OV25$4W<9Gu_KI$ttG9;k8hS9!;}bnK^wN;$u&1U^wDpMrKGBDh z-eUTGWmofeHN2-`oQCll-e>;*H1uQ8m+1#gXZl2c4IgUwLUX^U`bfja8a~r7j8i|+ z@TrD@j0Z3c`@|p(gEb7%FqCWp{n zWo%T%WU;)R+s3ZRVieanTEiGFxo#%Lk_>gq~RwG zKXb;fHB8emUBfpTCTp0YVXB62HGHRGXR;W&%yTzcWNi_l#m1BrQ9MP=(C|I^kA^uK zW@`9B!z>LyYUq|C2B(N%ig=MClJW@JAxs*U&m$)0#9R&YSiNC+M2*3@>6uP6PoGb@ z@(2pDh6NfHYM?vnMH&JcBn{j0h`V`QBkUWQl8{%>t%X8^OM^z^cT03oLrBBjsQ40j zU72cm-DXajnGxYyh+}Io7@JHjrkz>X(Xg1KOEfHFK=MneJMxO|L%hqGGb69qoL8*U zuv&v1bbqA&3rz?#c!MYw#IG9GYB;aqf`)Y(e$%jD!vQiyP4DkyHwNo9Y+&#QwS~b( z4VyIl$(SU!Fxbp=)4|lO436g&l(e1k4h?@X`1xFp1?O@QpTgf7b}@4|(>+Z0YS_o% zN?t*M#13-wn1dCq`DT)oz3wDk;K@`G)wtp#wkJM34)5sDvh+wmz~QW zL>lA#ObY}tCL^XG<8-DOL6C_u8B=vxjS?I!6hvVLMY2=#ri$W0ln7!<5L1IF$^7y` zR0yI}woK_D$}ld=v|Kiy>a7?=r64{DVn7g;gQyZjyCB*JQ8kEaK{O1aQ4rOGs1Zb+ zAnFEDGl*J2)DF56IE5hzG5dSEs{ut*-N8t&s_Su51ESuz`av{H6(dr`-pQ_fV@_%w zL<5tUE04WcyzqHP$s<B%a6NH)BfO5vj*$Sedt z<}3u}wDEqFPkb80=Rph)Vqg%1IB77`p-hJ`rPaL8f*2Nb_q`LQKvj$gVq_3s1~HCh zzF<0r=_sb7nSPs3P#7BoQOZSNd=L|Zm=wf>Aim0$%#!(`YndxpSCy4KY z2(h0`V>&m8c?_lpF(ZiYgP57^ML!Z?JS&?+!(=w&Ia&N~)5wi~V!SAbKoCD?OU|d> zXS|TOe8ezsd(+E?8Dao5bSd3|IB(0nv76-8;h^5ra zA-o&HvLKezxDFvUgcU)o4B|u(CxciO#OfgaCjSZI7dFefAbum;4!|0Y{>pSM(}r0X;yvQw`HagCYX`03^b<6XS2emjUeLA(g! zWe|6RxEI7DGDQ&gS>^%L|FghD8klK9O^JKL{AWy`20?+enw%z{Gsybf?^O`5X{ryo zNfh4D%pdyi1LvraYYLL5HzpKfLO_V#enxv5Wl|WBCnhcgPY9KW8A5yr2_g7H5FsRn zkSm1L5b}kPJA|YVQnJhUGDr@&{pAbc&japeyrlc?qXdOKA>?I&U2MQK#sxws7()K+ z5-4vv<4mR*Ovx+AXR>C1Ld+=^Lh%p^GcFQBQ3lDgT_+)TDiK1-5Xy&8A%s$#R3?P7 zA(Uo(l4~c)duf9B~2b9R(QS=SJ{akNc- zL4i_xa{nNbP{Qm5HpeSvHXJOA}W*40iZI!VdmtJdn^DkzYXEL5PqW0 z3Sn9Z(?ggQ!jIIz(up%dm>EKj`YD9J=UgYR=DM9<{J@yNYzA{fm>0qv#w1L;AgI{b z0)hhVDx4p}f)LaYG!|GG!lDoYWZ{gMcBzm;keRQ9@ZwEu^x1@>1w@wuf`P%*b#0tR z$#wT;KyH+>lqUZWHixi<%t(`e2?A*D z$?jhyk-)BO$=wY0Fx|^^Q9*GagoD&59m{nbqOPPK4CCi8j)ZVDgeqZF4dWP1fHWh8 zks8K7A)KIjAcXtWI=UL(O}r4o#Sl(~a5{uD%sJ2WU#28*HiUE8_()eT?V2Dag-gu5 z8N%i4)GG|GhHx#Lb3KF`*|_rlSju&aqqmvfVS1Nome_+3o|6NF@Q|4#|0smV+4u>A zr%a#GG>-fv@G^u~G--!H-(^#HO^zBy3`gIDTxJyGXr}9)CL&uhmO)OY1x`niWLy{? zj{bYc8y^NyVkR;tR~Wg&NMfAK)XS6vd|}ian418F6lUgOTK#0+d|}Y7W}z?&hmjVB z{8>i+FbXiBEhUvpXB1?d9!3U(%rN|6_x(usd~qZ!n0bC_Qr)|;MYyO6VH6FcSQy2_ z2=9-jP=-N?FiJ8gmCY|rTAfKCfwIgg$FzKQDlK%AVimc}N?}xH&^nw>%xYm&4`XB) zUxZPE3JD{jyk|rhwZfV(lKjK*Qq z7@e{un}yLTjMiZ^XHE;Iw2;y=>@KIwyO7i-Te1U#wqdjjqkY(&oT;=m1qIQLoJ4#I z6z$BkOBh`lbYn`Nm{Agio*eDRCG-lTcNl#bzZJ&YVZ0LtogqVF@3PqYVe}=1JI1^h z#`u0-;!_nLkUXdE_{Y_O0v$@zKa3BV`B4}H!x$9C#~l5H=>Y0V@}l1|vgCi!T~iDW zoKtO-L6zMw=^mnFIW>)PR82k~& z#%#_e2BgUr8Zvc~N$l@1wldzvl$hHY>|pvA)16G|XP_j%i(1Ep?8z>3FN1wy>}Rlg zk=yn|H1pqyr7(1Q+F`l`gmIK6|1eT?EcEhH^aCU#_cd>ri)0rSaUjwwm}vcm$4_^y)k>3F7C1#_rkc(B|He@VHl6X z@Mee-PZQ}C1}RDJRf#?g;~7oDI+Aoe5937`u{z>(ybR-27|}X?6N1-aya^*pcPEO^ zs-^5WpIkLVJe!^J{_});Ra0V^4;?vmbj=Wxd-{fEi0?97O}_7)OjUSvB;4B&0@+4f4Iq5o<+)o^r>Mm$!GKXv~bQIE2SVs{ZC7D@NM=>46b(GLSn=nb3 z4m>1EVQq#u#SJN?qqGixrnnsM+tbi}|5#Q>IUVJ>gbF$;>i_*`gpw-hsG_5)?(XKT ztfNw1eLIm$o`O>N2ROqrQ#?IvVQkZb_Q2 z8tI_dh$)AX3bu#~WQxW*h&IvDl#5-HDb8hz7CKt$?oG%-9j$b<*3nHzcO7kXJUErm zfoWT&?U)j?z3$Ft1SoXW(J7nXnL!uo*=!EIh3}!Gr;d?2zR=N2M{gY;>-a=RA02N| zZ<6LZ-q!IB>7e61>YzuiRbOO^mDQ6^JSs3L;(MR9-L=NM`9k#nboA5FU&n{k#eVVS z<8*q9UDhw^`^6kJ^L@YgNQZPfHYPoBfR0af4At?Oj)6J`=@_hIh>kD)BIFlu8J-F~ z-4}m*`+9#o=c8?+!*qPEW4MkHT-{o~NFMGAJlhxh%X-f(zt|%CM(G$$o}*)`jxjpM z>i9~>L@HCqI3444OwbW8M6P8Sg@vds+^&2}hyzk-sd4_qBSL(u<2xO5bq;|CqHsAqNe zoUSSy2uzusl-WIw0)b+M+^XAsnOvbr;!iq$)-hkl0_v2Pu?;y%PfIL2)H||}pz~OU zH%VMXjzO(B6EErX-B1!;k7RNo9jXpZho!^T5oCd|4xK@W>FQ}w5e9}1lflYqQN*O8 z2A+v0Ou!-gpNU^W<3$H?vcghk5~idT#HaQ;nC@Vej@3F!87OVw7aeQJVIt@g!LKxg zb$B9(k6@jS->9xQ&mA4V>sYU2pN{=HHt6_+`F}CpsAC%glH8=@PaT_eY+=q;rWg0P z=LqF2A5V0<4thS?ku6Vnr;fkL&T|rXQRhC+M>4y0?9s88WvDNRLt%CyaX`mGW}YQO ztxP(kA0ffDl@N}n8Tu0raXp0fi-E%!8e2c{h+-7jH zkhrVko{szE9?Xf3;30!oG@0voq~o!UC(L<9)4q1ve~Iw z9Z`Yw&*oHQP$_~e->bsWsu5I+xIIe+R?n8C&!Z?>D}n|QG>o7&3)G3AE(`SRnO=`U z{cL&Cp-}{lBWM#rTV^(ipf!W05j2aSIpda0TQH>~$jDZ$7*k#JLNlvU!tEmH7(u59 z+GnSBVDL#{(V0Ql2)aekB|9~%$=xI9na$}D!7T3FUfG-_g~eMDydA-&2>y)Voe18I zU{VBMNAO+*??*5of=?sp8$s_?Y4rWaLc^9Yb>*@M3KtP8BUr_wV>zd;U`o@}Y6feV zlKd|WKDZbAD}zv4Ix#8y#?kdme`iW#ocJ3e_=BT_H%8pA8VPKUU<=I{29gbIjbK{@ zmm|0m!FEzIg5weV6Tx2*?2KT41P3_#-%R&Juq%Syj9XLNk9x=;dpWv~DHUGrTd1UU@E7`Pt6jR+n^@Hm2-5!{O4ZUpzpLkfx8 z5!~S{{?k6eV-%$Yf3- z#(u`MLpQ6Itfmz>TF9s%GEh`3E5@8R0yf&+~dz*clneP~Q*T8!Q;);t|_mZpDOinK@Dis$Uii;1Zr3OBx zel*a}Kz{=t8u*CJRouPJ7@gsxoiO{Kr2kl4EG;e)x}*;<@Tq};1_rT-4i^_!i;I`V zMbQ$XRtdK`T}p_d20k1G9VlH(ZFm2KO2~DV2**g2Id*~$-tIU;sR%(j}zl=c%GILg-VM?rNsgR z3k@tX5FoEx=j&D4Ep}9CL7V7g#`LtP7*Gx91|sCc27(4c2Eqoml@@fI@1@cr{<`^88+zzPE^ z4Qw>9$-pWDs|~C(@EhI#8(3rDR|9LwAPwTLw{u_plm0u)h;#Y8cgl!754^t{SZ`p1 zfj?*_DJwF{in?V*zp{c(mnC5eW6O#^4Qw{B-M|jA39Gl28p0q_)?LQjTvog(>o(*s z8Y~9>Hn5Af=9l}=+HK2;cgl&8-CZ%)mhdhYTDx zaKyl^gyfUuL|l1Mv%H}3*rU7{TizX^#|`{r;DmvbT)R?UtSK+-dcI|ilTVfxvwHep zlow}ciZgK0z$F7`$*BySH*kUF3sewwE4W&9sUSYAAjVV>N(FJ5jA=$)F>sY-PE`<1 z_oY8zv0N3!4Ffl6nl+JN;+BEi23{C=Y2c25y9OQ^cx>RFf%^s?7|E_g*!zwwkDIqK=7%CK{QjYoeZs`X(Bf*jG*5t0w6Bm|k79 zsqPjywz^neT{Je)#6(jrkd}kcHtt|`@r(uX*AOjCv^3GpM0XRdOtd!9!9+(BZA`Q^ z(T?n6V)?`5?l%(hSM`hPHqpgIR}*t;h#`l3b`4Semn1q) zYD*1qxrTVS-`m4PPZMvOc*jI96TMCJp^h{0sD?uMRa56X(}-C#Y>T#jTp6pNak^#+#U6;zJW3nHX+jgo%$$d}3m- zi6JHiP<9goO$;&-Q%e-C=2Vt6N*p0@R1K-RizF zG10{LCT5zLWYQOEm}=r%6W^Ga%<@y1mKl})Rc*1So%@FLW~YqrOiVK|-NXz|r6+W& zw%E)C4oZo?Q(Gj}5kHuiMK(7v*Tjz|X0znfTG1IPne>gr&X%6ib;LXqKbiR1#C#KH zin|M&9qR~sbvU$+C>!IOT}NE6BNmwmm^f*Y+@~$!h}LDYQizG*o0;xXd*%_ zH4&mF$kAaFI(gtiPgGq|vaV~lmnV{`)usuHymu086OHSNesx_VbP1=eE|WN>u2^DX zsfkr4R+}_sVY!JFCRS4Ub;X*xt}{^A?BguYnEqm7jfr1r?s}C}u%1{wiTB^u6Lcg3 zaeg!LyNSO{?4%KDVuOjzCbrPnH?h&gCKG>}c#<#evwE%$+w!E$WN^5ixLi+cHL=aa zb`v{H_kQwuJ+Y=tI<29RgZ=19ntU`lPkr&XiCrf4n>b+7X;E~n2lmnsqXGWLTcN(F zQD1yeU(j1}I+!>0viqahgC-7{IBeobR?pTKo0q$V}Oy3M-f%v?ExM1Sq zKCc^0T*}6m8C)@OHJfvd!PJdOH)--WaofZl>c>m5%NmG#4P3K)IxD$EL(!t4i|?Cw zKo&Fc)Wk!o+QefME&T2@*sr08``Q0ZL!mSjzrRX&X5zVt7baek896V>oNnl@OW$iK z5*vxyjl>%hQ5JGrNU{)ZA%}%H3mywG7GNQ#g;)#kk=Woga@P@!M4syfW;PPE+K}_Q zC*DGWg+vRvEVuTZRoqSNOB;#pjl``+f=-7!hD5IgpM^XY@>)o?=vxW*bwG-Rwd0dx z8VfqBvq)o+Y9XJ6Gz}f0(Tumq%iT)?Q_iAI2qlx(Teu0mgh>8{}S*UKIhK0%&s#vIMp_+vs zn~0>X$-gxb^f5@Y(9}XRDr7}+ou)!*>h3~0a4mUTQ_&^p+gBmA zrG-`&T9cuuicKE6vpQcl^<-1gdspJ^rb4RZZA;c}=2q9iLPrZdEcCR{$wFrfT`Y8^ zhI4BBW@2PB(apk(b;^-gP>`*jpp@D@wBPgN0cZCRzB}!nYQ_v+#|D$rh$qm}=qW z3QvQxzQDi9TEWCd*9-iUH}PCX+=k|2nuX~WzPB)w`sG2w3=4Bsc!q89&|xp6N&9ih zo))f3Yc=1G7G_&mWFbH@7Uo)5U|}KA**=<}=2`g30u9@rEzGxYB|4t4zl9)h_-}V) z(W4X54Rzxr3$g{pf@-;MC`wIDd6^k^a*mItomMRbbymL?B4ivrYnkl%BEH!a57TS*U+HddB(xb{DVz!`=9IvW3`S;SUR2 zENr!~(ZVJRe_GgV;ZX}wqow#E>>1tKeHnLOF4(T6Yq~2&6umt9kns)+e~|}TIAUR^ zg}ta5LA&RRG} zGp7xYjq?^RSh#25zJ-exE?Ky4;f96F)Tb7%TDV37{CI5BR)Thjz0*oK?|P@SaZ6v?Q8uD& zENksrj5Hb0DeHuBpj zU?aDUBpZ2cq}uS>@YzVVkz%7}8&Pe3`nzq!ls4i}-8eeCfQrgPg|tJCe#4DEu|*Y zp>Q^6{g7T7)@FSO^c|8?&qf0q4Qb*l0>g3q7PZttD=Mkw{nS zGVMe&8<&5J`ZzUl&4Z+tHd@)}LnYg2ZKI8i4mLV+L)zMCXQMrJ#J$+4#|2J(mDa9k zM)P*Al{(qzY@@r49yYqz=*sflNXeAMTE4hPgL3z5CkC{0A4z)J=w;)xLNUE(I@;7~C*HR4j*WM1yk}z@m;5i&_igmG@u7{6Yg!p2A&Ur-Oemwu$ZxYAxsEA5)}_p?bfImdJm`8$ZwHpbW( zOMTkGwFU(O<84eJYp3{nzU}>risjGnhjkEoXWvB9ytA)I2l0)K$u{QLm}_H-jYcKn zzqRolsoNz3ACw zH|EnBq$K(6WOw$MXX7UuAsb;EKiimZL$V>;SYTtJjYT#B+}LxRF`=XAogP=UquY=+ z9fe{;wV~Mv+Mt64Mt2nLGn2y|1uZ0gw z*HO@4ermUM_uD%*7TYN3Al<?)rw(+Zt zwX7Q*qy3AGH8$>a6tuaBbj#gIe0|4Tw3DEVLf-f^-8oy1NXe^W2m z*k@xGXWVUL583ceY`!}QG>(4mB!2HC4s;UxZ5&{MgEsDU5-FWUh0bn`k1KlVT=63| zj@me7Hr96*>q;fk&dkdP;&X0~U$@&!%kRbO z$L;Sd&e}LfGm?W`4$j-SVB?jI*ETNNxMbrlRZ2tH#uXdaZQQVNm8|+C<{GPXtFxdV ztR!@C^|@)|mW|tFMo#i~5pOTgr2lk``O|$u>B%zpZ9K5?l$?zw5SpBAJht(KMoJek zzl+%RwR@{TVM7-|zDEm{&uzS*Idf(7OB%T!xM%y5^GM6xd#W>C#2Xt?4stq(br9_! zhl3agaNJ4wSr;+yJ8$ut8B{Vw)4PiDT}7M&kArvz2@aZf6~&Hw-{~qwb`@Gz_j2}o zS64E(gCqxO4)QzjI`BD2c5r31_kLGFrIA2tH<98XkAu7pQXSOjCh{>&iOog$#eF)m z$47wfjtV%K+D$Yr@9oh|4DTi~9Ar9p%fZ_Y{0@YJh7KAzDCD59g9;8RIw<0xsDn}t zN;@d#ptyq)4oXtj9P_-D-<=tbr~6bS*Do6X{LA!}-9#A&WgV1rP~O4LZm#~9x`~C~ zrqg6tu)D}x-kpvrIjHQQzJmr1syL|Xpr(Ub4*vC^nuF@3yaVZvg1_B}9WXMfQFlS1 zYuV)54(d3l>!2RnvvYSbq`OVD=xd!RNWq;n}hBSdN}AwmG*F#uV*ACkL)3OIUup#4*EEtDDA5$ z_=|UD4_Em$J;XZ>-gWSqgJBNdbMU@{52$2viSh1LxUU2AQuIC+?&qMtgCP!vI{47R zM-B!!_|(Cj?a?2T%|FB^)JHu<%bwzco?>cGF_1MJlUzH%^;Yn<$0l7p`ud_&aqberLBlc3t?_7H4c8IT|gWqfz=Ft zA^D~wRl3P7zW8xS05ybhkk2u#y9HklHcr1luEJhsK-t%{S9EB4OPC7W{;Nh`Yl0Tg- zNr0kM&RGZNXo_=imF9m37aUw7-QwdevOtzRiIH$>&K#E=JnADTddKXdTH!AqJRgHg}P zVsm_yowTB6{y(O^1Imh`X?vG_*ucu(-6hJxwxWO{D4?h)1{4D-AefL0FFEHNBdRy%X=ufC)qdR8$lLAP6E73Qq-(S65e8_ssNkpfZHlw<0Bq zj3_drNR6ThFZKQ=of8*nQM6CVrL>~a&{l|oxwd|v!qjx(;rm0DAjP7{7KHV^MUdiA z^PrYA&SB%%16V;Q~se8QW#VecSLcgFx(c!?NL+|ytFWotx^<~qqr-IyQ8QgNz8R4 z`wgC|QT(5@dx*CP2b_DOxG##2E$p#SBZ`_)Ow=(+N3AICk78{M>tc8yirREe4fz@# zjN+jvrbaO>iie}96Gew8I!5tG6pu#3-_xz4s2jy&QM?|-8&NzS#S>99lq9A;8Abgl zo{?xhflmp1THq5c)U$%TDDb%`o{yq|;4cWIgdr_d<;ws4ZGS0>SuMilD2<|MEDSFT zd_`cBD4GgFvE+GGa3Zfou`lnx-5Jep^1OL7wYeZI1hy2owy=2Xo2hN0XnPZHN9Pgz ze*%+IN~b6~NAXq^W1{FH^j=Z)j-spJ-2_sH?t=6X*i#^9X-MxA#egUV3Z-up{RHVR zkg2l@3kKc51r8QCB#NPe42xoa3pHGDBIIB7LujaxQH&BI@zGJ7yAUo4Vi+sLi2}z( zF841#Y{zvRbOmWQ%fO!52|%jUpO_7lj{%7DX(Icoc~!bm?n1uIJ{y)S4|-$Ck>7 z!Vx;Vi7AK`g&oED!foO(-fgM4(_~*1 zpHO(quor(C#b;6QF63^33ExgRVs0OBf*(*O?=#BdqFguwuC3<5?f41PoHQb{8 zr#VYx-W;JvL_)3>p3lj==dYG7p<$+mSsF?TLn#fVHI&g%RzpV(oiyA^%9Kb|4fkj$ zr=dVYc?}grLM07_8kB~L8t%|=n}*v(Ncq<4dMh>Qmk0yZyHl9kO#?%X)}hTSYp9}y zQHHyiD!I7ZsPXlj&i7IEYHFy>L0&^G4fkt!Kr-?o zq{gkoKb0c{va%0pJpVlPVGVVJVRdV@ueGXuviS8Qnb%vZx*8tS@RWw9H9W522@Owb zsHdTK(>z{#(QIdK(e34m%nH8_*srtS&aJQE84b^Bc#aMIZ|+Zha`}D7&pKWg!gul| zZ${3}i@c!WMGeg~ys6a%qR>KqxQ#Fj! zFkZtX4U-xDC^CU+A1hXGe&$5_XXOY3<<~fv%cFH#Eh$(&HNr4W!*mTZG;C@Ij5GS#x*1~9MkZl21A3XVXuaL8Y~UAhW9kQuffsq)t*dGgU>D?I4hpi zz}s(!-XCF7py3^%Z_}_{!}3@1NMztw=fUq%-j$>?!wN|GK*J6VJ0&lZNcm91M;dl( zJa{2xmvFAEpZBqbJsc&@rrwal`QBN-W)uHJ!>8oY@U@1|gqg(8HS8ChT2aUs8orb$ zH8~&%$0f2I)bNc&f6(x)hVL{S(r}nvb!oT(;d@CU8y65RKb&$z^dUk@o$CchB}(Cp z9@lV!wOEpQLBmfsbDb9Cq=uh0oD%#OaZBpJEL7l(hO-o+;a8#mq2V`4qRzk5^6kRT zb-sE5FBUv6bRx`nQSeIw{}df~^~q%oAGcFXy{h4F4eew2UkukY{KH`_h8i*atKm9_ zwf*U3V@Qc1l?=SqF@_>B9+HoY7&2pk5V;f~J%*yO@Q-Ty&m%osmFDCCiCHlei=lW7 zIWdr!EzGwFydtW0t`z>qX)LE4L}J+Zak+BsRbCAFF$^q|Rw9OyF_enouI%vfU0O1h z5%^Gh)vSG3*`e*#tud5~p&*9xG2B5NVyF;9VGO*dhoO#854UDl9IByJM&t!`AlU@_^o7<)t;uJuSu6K9sX0vrP3^c-%c@ z-Yd$iy(8@GS^rZtW2hCwQ!zX(h2AfzPx31uhT1Va7{fy`JQ_pY7#^0SIx##V$o>D5 zf%JdjqK+Z|Q;!Mp@fe;EF{GV{@>H7av$quSkhfqV_2Tkj}5yP7?G>@T~6ht~3s|8hxp>+&xgvd>B ztpq8!C0tg~HimXL^?61_o!%Xxs17l76t?*>bc&&K48vj=9z&NHy2j8ahQ2X$6KnSp zw(c?Xpf3r&sC!tuHX^OJP#C4-^%Hymn;?e%f3;BZ`mh}+wjRS zb4v>Ij)-Ao43lG+62qt%M#s=9KWn@&pV3m^ieXF)M8?K2PLNZvu<04T?~^|vhKa&Y zhDm~Kdp^SKQ^omb#4t04X@Zk~y2xawV3-xdoEYXx(rkfqI;eSc*DEO$MG5~F%^tWS zm*!d!!@?LA#jrRAE>~CS zK{5Qpp*w~PFaR}=4|Y~uq``$)Wpz9^I{)P^%1%!y z&{1ATMICqOsGwt2gM39DDr6Pvp*{O_QM09|YB z-8w4kxYR{eAy3zEr$(f!>fBY$@2aZmxJO4d9o0qDrmkvdS9Pqb%I>DBc2iBesm~_n z-KV35j+&hO(ea?L-7k9Ku*y&9cv43P9UXPl)A5v!S7}cjPwS|!<3$}W>3BxRvowW{=P9I{ z;*u3+{JooMpyLG{$0|m;Ud)+Yn88h>Dc#kZEpi*`Xr!a5j#qS)=&l-5hwiG0j+a@` z%AC5z^9U#Wp53gwsy;n$sgpCbyW)*|uj_b2M{6BzbTrfPrjF)1TIk^kGmE>c3k~wd zXXcIkBGOWa@n`xc-?)6DQ?Zh_ zM0R%%>wB)d>ZId$GqbafE;_pEDBeSLqn@40R4bLubrIcZx*m!MJ8Ul<8@J@}{jj%= zK6-d)KwljLbPUwdPon(=lD>36WRQ-*I>zhaRND}NqXiDtF-*sB!I?Dj2BL$LBsXSA zMhT^1k8ob-Ey2g=7%RxQ8_XG*T_tq_P4q^%V`#FDDLS?$5KUmJj%hk}#IZAu={jc6 z$Z>RxW2TN-I{wk|ua4O|=IHoT$7ed`>X@e^rbE{;U&jKm;RYQGbu7}cnu_UItYeAL zSL#@*V`taW%XO^Kv5ej7KzfrYWeHWW@a((MJwmI_?x9wZvrOn$Yb9gn-@s)x5hzOPAEi3EQp6!h0<2xg`q-c5tZUlaoi@++vB(+9vYL( z6@@}u-FZ_2andVGw2DCPDX1F9J#oAk$4hZki=%oRkHqmPi;m;IIBE-9jW}uwLJ745 zxnJN7ttj&WDU?-vFph`fcsLF|zeuk`#iUT;=N6%E9FN6OFOH`q`{Qx&?BW}oPYC77 zILe6)pN^w`91Vo{OdQV&@;qCiSLpDR`CJ^|Eed~UGaT*_w#5s=!=#3BG>W5n94+E# z9LLLXydgv6mi$E$I?cGFf=gGS>bD8d^Gvuebf3ICe{sT)gaN&ECtZR6nH zqEouhW`=r-zDm`qwrp;JyYYLClF`GPH{w2vM;_DG2`eQN0&Id#?dW~(Q&*L zM|Tl5Fpf_?%IzU|&p3L;(OdAoarBF$&kY`t*8c|2m6QS0q;{d!OMTZX+@i&T2E{Qr zjv;Xjjbm6GBjOkt#~+ewI1SiaRqL(l^;V-q0{LI>t$4=-N7ONKa6|gyIF`gQHqKjV zFrKa+#|#eUaZIE@-uxBE)Ho)^F#cV6R#TqLn8xPltr(`qaZ!-h_vW-oRkPxl z9ml*l=F=t4rp}4;BDvJLad21Kk#EAjncGLz*^C8oER16jI|8z7E3Zl)^=u!d_s-$e z;?g*l#j%l|AII`IR>ZM3j&*UYjAK8cioi zJdT9a*AQ4EJ90<4vh(|@@4hL#=S(q+RemqRU<=|1bOj~_dIEicfxvA7x5x30Ak6!2 z9Pi!4-;d*ioA~aM6+Vn(R~%y!;rsSSaqOmJB+#2tQRZ|UXX4nyCeALqH;#RDA)y~+ zmE-s{j?d!QAIIl$d>O}qIKH4C&I&!5i?8@$8jN!zv8$;6UA{U zjz8nL97n@`>U7_NZv7PB207XL(X`^tK8bL1+|@Y#j^kP!|4`M{sr6pW<>imOW^sn- z&}32Gzx0rP>YIKlHGv`tWG0Z6Kw1JwplAZ=MEa|W{gvjFYtvt4B#`@DM(0)Gv->5L z%}ol$639-VR05?FczA5VNE8|0U)_?xlK!f=z#M@Qfw=S{Oh6@YTLO(Pr{7*FoPdo}!@t6rpYQvt zqd~bl61X#go(occJ(oJ~)68Bkg&%0Tn^`4+yAr6DK=lOfPM~TcY`A+8_@}?x);hQN z099px;>ypu1Js)7dG{u8Ujj7}AnrVw@yY<) zpTIK-JVYZT@OT1GBv2=TM-r%;z+=>8OD=CAc{G93zu&rkfZ9DkHT@uR$Pdlf)~oPj z0`(GjDuJgH=xbM~aJAU60V;E#;uVmrQQ<&!p>4sl2|Sm;O9?bg;Q0g^B=AB4FD9_D zZdQYVYVzG#55JoG-idGkeC=dz`+=%a0*w=RIe{h#3>~PNK9#|Z`Ol5Z=VZ9~Rlz+y z^5O&4s|mc8KzkY?f!7mwBY~C)v`U~^0&gbJJb@N8`}>iT14G+xSP+g^*9L~mgkJbA zt91fx5@?%1JF#JjL7_`OI7o4Q4w07!DKyCFkU+--x+c&qfldi@PN0i0_Zg%jbxVEn zYTn^zO3fOiUT#*?g3lzyS#i z6l9RV!2*W}WUirt3`=ksUMPfNgiuBb93^nHz_$ceU6?vHfpH0pPhdgVf(FFn-ot41soA?|-<|epPAQa0mKY>|ahx5h@ zg|bNCVu4F;^4t)+T%v0Pu1H{|AggZjtWJOmP|n%})+O-vP5Pz;*5AZ8&}RhyqeB^T zZWertzy;5Td9?&$3H)f{xCuRhIQ_@KFawDMj0B1q;Q~uD0ZSU|w*>42oCJ0z@L>XO z0!g9oNWc?hdjjty;3vT4=s^OD_NHzVx>FE-p)kBF(f0+uCy+CBq<@e=ho#|L-{Q;R zZ_r%{e3Zb~2^>sdHwS+a_;~_*IDm{S*vqKo;Hco-{ycB6qL4++%bZByrv%Oy!!KZIxxro1TG|yVj$JP#RM)T@Mi*-g@=Xm?*p^^mB6;a z>Kcc&1g<1-m7VKC=7V}zyT3UgAl$<6#@D6(P2jp@SB|GcvV^fixo=8(|<* zkfH|CiM$*3?hK(2`Dw7q5}aml8;sH|S*~TJ|Qf;AV-+KzYF{7$`JQW=N>*(?h~rFo<*+qFC1L z1}fg z+a9PLj+{K7_V3#>>Kb^=z~ct4ZOgrTsCs;;TGOK}=c8H-RrL%!Wnl3z)zHAx2I?DV zVBiG<&lq^tz;gzkm(qs~Rr*lHYnne88tzrUJXDn(rd~Agk^x@NH+fykW5fRQqUOU? zBLj^MylkL}fu;stFEWuBHx`(hYPFIUQ-(%305y z3Qe(MxZ)lkV|}EHfvyI68R%`Gn}O~IdKlz^{+vpJg#SO#nZn++a@hOGvo2I3s#rPi8g8#6#98+U?k z;Qe+fUscNH5z~f&tWJ1wgfb2M)Dd+Br}7RJCYyl|3?%7_BH4SX(iR)o7*X`cfIzB2HKf%68w zHgM3u8BzEf1K$dA%D{I9zBh1`zGUDKJ+?;ZoJR~C7CW#xsBp7R_(AH+f=WJ>@uPtg zG!ENnZRT--hkwpI$=Y#XS(3_HFbg?5Ps}Eyv|l(N@YRH z!O1zHepBXS0oHaKbxG zuxXYy%DU6Ux)F*^!z@)y+-2f!$xa=rn*U80-Xn5Isb-?Olv}r11?tbC{yq~mq-r%y zJZRz}6SYj-Z{h*5No`?fi_mV&zHNkh*hC!@j|%+};i1#At*If~uC9s4%&p zX^|&Q)Dz|w0-rL`z{CqCo;Fe6#52OoPWK!QRleX^iFT<~_`C_W=7AB4MZaj`CDz?U zQxgrzAaY(7%d-fE#wK{$152cwlOxnCCSIj+OrF>lMqe}Wx`{UgC-WzF=TRmRnvq4& zjhmZc*P|&|g_b5-nP_dIjfwUw$V6fPNL!la)6{l?)4iFcM<;YJ(a}U#6WwUQPUvK! zvxzPyXau$n8}acv5tg#HYiUAy2(3rh(?l=6d76lu=xw5piRmV0nCNSwpNY5F`t(&3 z156BMld;`R43hc|F)^6cWG(pA>x5UI4j;`7bdTXCMwl2SY#e_^3c?yKK9OU-nLk>h z*(3jZZjLoE!Nf!%j-!Wn!gv$+oDMra`^Y2{lTA!v>p!2tsphFBzVC=>5@q*cMYy+- z{y)>iEcOc%t4z!`F~`J06N|)4=hF8&VLm9or6-S0GNW(5L@!Uv7;$jm^Oe{CC z!o*TOv!2RWCa~Q|)xLcpqZ}baXYLeApogzEvBty(6B|vel_K62{&mdWC~M-#@a<^5 z(875#IMiM=L1k;bY#8KmqJ2cT#%*Cx_ODYhVu%%pEk z@OiO)Ys%@Zk?Ea(F-zIpZ^RFg;Gx@&^f0(#r;!hLR z+Ty&43mo=M)UKMz-Fz%@cgqS4Lq@5~%w^(=iK`r=K24u7N;#uKujb;V?*!rT8rMwx zW8zW3f?R;UT-gc%kxEo2KDDO--` zWLao6S`jH`fsk{sjNW3QxP=@G{NEk1!1YL^Gw|RD=E}EFV4=K)5*A8YC}p9vg^J78+Q1!NQAHc-nR&3oluiKSni_DEWyqFo`y4%m||Eex^H(LyH+oh@{+(APpg3wNF?-_=4N3mfkYy{?;u z?iPY4vU=Q<)>DvP0(%R*_)|_fxr~YY{Vfc%Fv!9H*7}douWrDn$Ewz2<*Ye6p5z*5 zVYr167RE?)q=iv}+&-oJ(6MT?g|{p$9jk~_2tPm$3o_OMC%{P=Z()Lki54bVm~3GR zT}2jVb9pmUr&^dM(xzMC%g@EJ>Xvb#obiWqx7QADBb{X-ZXsb|wuLzs=31C%VYP)d zRNKM=7Hwgfg@qOtSy*ggiAZ~3oOshTAU{y3AmYY~=PSYctM zu%+1rZ;w-}sMt8g(Bw#Dt%Y?KHnTHYc-z8yn%BZ63qQ}!_f}-~I8b7Pg?;1HALG=^ zcaMBN(p&3)?JgxA2aIPsfM$`D?r?_`Bfz z@k}1i&W)cVqdD(e_&{>)varL#P75DOG%_LNuQDOLpZBQ=D(I8*k%iro)OCVlVCr60 zicOQm)FeJ(5f+-dc*VtM7WP}1YGay>&n}ojX92Fi?h%@}i zq2tbQQsO5ICpp4%G+--OIK`3Q!f7kqU`XK$`{nPMpw@kznY}bpq-XAtwA^zRezowM zh2IG$sQGQf8GHVsqNutP^111l$JcX{?0E|pEL>y{J)e0=;GY6FcT6EA+A-ydg{!pW z{QQWG>l0MYMD@3YYZm_DfMcPkjdU9oCaUWk{B0Dmkz$A5UT30eHc_S7fQ?vg%H1zT zHvW@0Y@*^#J?5{4vnQ$yoBya#%tog0lfuKwvTfXAqqvP68woN`REH*pc6i{;3aOLS zU6WMlK{>fL^6YSjNWP7df|L;0Xp$n4p_D{R+sJ>QETd(SdaI4{RMJK{J2Y2;jee8V zqedA*o(EWHqlS$O%W{>C+icu!qoR$wZB(^!hmAXJRJKvYM)M=#oLD6rt0sji(SPou zsz*{wpUhdXvtYzs*_@dqa*vIBZQN(0nvLo4_>Jv&LUUt|@%rKXKq zG(yo^?iWbp0ULiG%OvuUjfZV?v(eo~9UG6>Xew5E)W(`mvKmfS&)TSK<1rhL+jzpp z(~|lm?bf`=Q?$>{lJ$gAbaJRFZ-XL*NPQd62%UK4$?7>9&)aBV;{_XyY&52*Rgo8M zykw)Ow~%&@^r(uaOgWTuT- zHa>OmnSes{g*F!1h}zI>EVi+P4r61jjiol0 z*;q;M6+>xlQkL6T!I5f8xZLiSDeA7N>i$D1t0lGg;?!Mj^7szC&c@p|Hrd!L^!02? z8yjsjoT}PSRX;Y0%$XXV7RAZQEyBPp;adgSFjX};lK#b16|vsUvSuG*B+n$Fo`D$ zd2$yQes`R%c%t3h>FR5m)JC?0TO532<69el*f?+FI~(8I_{qje8;5KhwsF+PF&jrj z;U75K97);nb9QvPnw(dLhiLt1ic+pI`+k z#zh8<**RS5odcpH{S1k;W%88_iHxIW*bm|4ZsMcB>hokb7(7 z^Ll6^GiRvl9QGX)b&&2L)j<&lX%66or|m^&D6T8`W`_Dha<#db``pP$hJ#E8Sq_Rh zD3}>aV|Zz%8aPwUo~icD49}1$?jXlORR{Mth&ae~P~JfW2YC+i9h7!Z#z6@OB^{J< z!cnF7op}qJhVJpF2yFhp+_DaCbx@8)IC$$y@?)!M$X2aKD2G9Mo`7(+O{`spVk)Y?XaETv@Sgw))_U zY<^_%$gkQC9+bL#Gh1<*g&ot`oKwfaBMu&S@Pva$9n=+u#~g6s0auKC_iEUb3_J?v zNmk)ZkydYv5 zI%wqJMF(AY&`qVtOHK$Wys?A&TT)+k(8NLi#|vIxl6mQTde=E&^+(K6uR3_mL0bpy z9K7z}4F}B~v~bYO0W0+;jgXsG+s)*M!z{_t(m^W+tsS(X&(tqSDa>3h^zC!hAwjrx z`o2;bS98LmdE!I|2OS;sbkNH|CkLG!^l+eEOzq;JtAlP1x;q%{XO@_&?w+fjm>X)v z)djri_4T>R`?fs)P4srq$H7Pkqa5^g(9gkO2SZpF2Ll`obTG)lh`FlHJ&|dWedSzb z%vHMuAL?Kj?LY=|a3Fd1pG9#rBfJ zC0N#My7c_8(0Ozu2ahdKT%obR!9oX19W0ZKiySO=u!P1b8{P%^Ao=I3G4qu-UoCgA z!of-htEj+js!TMOUn^CXW*(UT-`b~B^VM1h>m2NGu+zcY4%Rz(-@ykWc>{a*^C|B- zSi3-Nbg;?6X1b`Ixy3=kfg$)-fl)S-ATfcuz_>v2U;aDYyoq~)SPtx)6vu&k6HhuI zGqW)GLJS;i6J)!CcLX61QwiU5uxo+(ae;FBho2rr7KVnZxlnybx`U4#?4~6bs_Nfl z-abCkZlU^EDn*{X^rD4o4{h>y*fIAx_=G-FJe*o*AhO@V=Nxuily&iigD*MAyD0AB zfP=3b{OsVAgRdPNbnuhN{6^sS4h}i^R`Blx&JmRkJ2>LtxPucMCmkGhaLmDv!mwwd zI6DMmQ;K{9jDPesOS`_Hpo+gEJ1!O43CK=N$a% z;137q9sK6tccI^atrjT;=DiWUAW4i4TBI(~izMk!Arg-*Qdb+YA!0cD0ETTMHLrH zI4ioiLy+5CoGq4eyWsVfs5=FzB#;7+mkghJ?U$&#T-@!Vs*8JEj9Q{%OLLto=}V{P zae)vSW-U?Cm$It6xYxyfE^4@V(8WV8YPzW9;sKh%g}y}H@8Xvw>iE#`H~pte)ard{ zYxZTQFAep7*hL)|kGOc0)m*CXS*rMUI;M2i6C3kr#s*7Oo2BY87mvGm!o`y=UUKnO zc1Ar`*2S|fo^$cEi~4T3b>$fsy_c$KOV#UK@w8O6T$8!+Nbd748n}4D#fvU}UX!~m zBf=wvS+07fVAoQ$ZB@A)rHfXABy!7=fwP@$T^w`qqln)$uhn#)u-7u{X-ke0f>H1wjLf^+JF zmzVW+(MO_v1(Ls?AUtN7wO| zHoA*(F2=hU?c&0SoG~}0y+x;bG~4_*d#q5HMBx)$OqA$U7n58}b}>bwOzO8xZCa*w zEK@%(Q!g!7)MuKDsp;kR7@0F&%yO~V#qBH9Y!`D}99^y!x|r)?o{RY|7Ko4%C(3VF zuKYfcVm))-Xdh`mI(N@xmfKY zF*WRT3~T5-E7aSPx>n#ifusJ7tQTa1K>qb3Go@`3nVW@3J)^280F#{7aLZpVpTFeT&Yg1R6LrJub|(%IOO86iz63U&N#ed_Xw08n{O00!7bn?a#k{9DQVGJ;Uj#WV z@QlEkGgE_ZIp;VytWv)UB-w2i9w^sj|Ks9c7e$gtOXBz4IoDmJB#|mO8Ja8#XEho4vxATnBvCYp^dw06dq&E! z4^mpK3eA|6M6o1FCs8Je>?CeUA}@*jBzO^L@g#DRh={7Umk0&sCc#|%Z6`1cO-FV5|xrzwI+N#@ps0R=Q2CqA8GJMv16-L zl_c&;;%+IZY7*51xkn(GZ&<8)5;rauuaQK}BswP1iTWgQe-h6o@tiO}KqG9Z@TB0i zlXx(Rhmv?W37(JiND_|7dGMq_knZyf8yqFA6CTW($OGz}8 zT%4e8ltg3NGl|!dcsYqCNiY7&({lrmX(GS`I7*Z6Si zv?Qj}Tee~0Hq1z3CT;GciH})H%w_|5c*(<@B<>wsxFm_Cg3J{-PvCs!6@&~61z99; z@eSe{wJeF{N&K3`Z%M4+kdnk6qDibvg2#O@Y)Inm zoA`P`_%*jNiA{oUPGSpvV|6My?S+N4Ylnw~Xi3B*)k#86BA$eigemn+u)S8NE?=G6 ztx6U-tz`I9$)@A2PCfVWe|vuxT+eosNK)a|sWg26GYFp2Ryz>`7v8 z67P!G_mlV_iT4D*_CV zC;yZ9GKm9{<mV*3{QD#hNfJ{T-M>Z=o>`-gB*WFP3_m1sRPbX-{Fub?Bu+^5oItD%zc+sp z{A3b83vx=}F9J^sJR^{tX9X!(t8QfcJ&8Z)s2(bNIG@A?4kK$-mWPWR{F6xWkm})2 z8hNeyJBe#aTu$OIiC#(Ksvt~atr>_g{FB7LNnF3lL$?2)vxoL?jgfN zrWclSLnh(>g<>AEJ>24yH=hf*GLJ>+@F_fW#an`>1^spFWd!LyF>V3;_t#2N>>dd|c19vXOf!Nc4xVfM$*q;rEdCplFjGVX1~ z<2oC9;ZYciJS_Im$U|cfFMDX>p|^)V9-4Z1#Y0;U?L55dfoIQtUO%IShu1v3?%@qK z{VS2?Qq5*;ELy2#){?i?DmNT&nMBCYQW#o!Xzihm;KAF9;YMnE51l-8Cf!2^B8Yq~ zNgX*1u1-x^uex~X>V>NXdU(8nT6ObynQxf4yNJ3^@ScK`rQ6NGJ`hanz@3O>lgs^8KE3qETUAoQwbRrBCNXSO_*-d^7$89EU_wbH~cRjo(x|Q9MI!40#UU)F< z2Of5Cl-m&@Cx`T;6nB23+U4OR58rtB*28WOAA9)1!$Zw-dIe)c3<-lS%BP&-!@I$MZfKkm#eKj~9HrC|WT)t(vhs!dEQn*2qU= zq0_L}kj?BQ_RY#|>f;q3M*|!S@T!m3=okTV1HA6z4Ikh6_})h|TENFLAIquL{_N&H zy8GziqlJ%_tgMgLK05m7M9=vly^YUBbmiLnXzQb$&z){+&K9+Oi>kO){m(}SA9|e% zjkc=cTh*eisEW`^lUvq$@Qi%q;ClSJlau5mub`Hen-5XPV&g4$@G0n$xA2WPB8&j=f>YJsR3uCHbGt7WtU# zV;crmacZ{YO#+cK9-8MMdIrFHTet`Mz)JrkltlMK9zaT$NN4$^s&pw2a;unkDY7+Gt@9HaKFHh ze4H@VZsDnIsW&Xe?Bv9kpARV0-wxg2Ymxa{sjP44&);Sql;{n2`j*XSt4p>z#f+S5^|1!>}_ z@s3*IsK8NYX-46>%~iij>Tf=N=Oe%eH*(f-!|j~pydX&{U3JmNB_DrskQ54q|0Re$ zHjj8(QvJsC>9_)z%2oa2mINmo_I1N&r`KL)!gHom0Ip8)`I+b z0rIIpfZhR01mT0DCd&#?GC-*Sr2~`+aCd;J0m=rrHNb5FZVyn7r3Bzo;ld!?L{L7! zuZ5@(fSa(ml9|)jTue?;D!}z1yd|MxfI9+I4p1cschKA!gzJhcQBJM$L>QQnY{Pe_ za_7!n0bV&>j8jsVCgT*crw6e)k|>w zIRlkRc;PzmkGyd0aZz7A6@;s)i9ZwI*#IvFcqzbh0iF-=0!!zfAeqJG^6v%#cpwiK zIiKtp(i;Y76yRl=NG!nh)s4m4v{j^eK~vgRPLJUMGKo^*Niwf-@DI>BK$`$>1ZWn> zPNe{E(i%ayxSgxD$=rfsyWP@Kie|2Db;8{%JihGbj%XX8U4YJXk^t=koGiu91at_( z#pf5Npd%Z!H#$jnuG!|oZ)T(fZUN{Tpj&|Mk`x_=9)k1?!sYQ@I)|(1*;3rB)F(jS z07d{aK)(R}11t)#IKY4a0|Shwp#lsF5Fd`=0Y(HE9AHR*p#grLUY?8phlyC?ly~-0*oe)Tb|aYVzf3_&d|rWaBJARwZd7E*)&C&w7CK1QOL^FIl|BF4=sH) zKfrVw!`A1)6y)D^Hk@c$!dwB~4zNDJvH;5itQD~<0;~+MMsSwCN_=v40J*$c>(&&DSZV0e3Ks10BU{iq20k()&u)gGBixAmLA1j4Fz6@7z#RBL7 z5<$5AfzdcK_6qR{)xvfsGlNA<)@JSs@KFFefJ1)^kPPr{fcFA;0sH{ls9u18ouX=3 z5Jk-ws}iS)-Vtx4|I_~Ovwh#p-w|MEfb)~^L4b!FW{oTr_HG)DMSm!EyQg~D-Rz73 zz83xW1lSwk^8jB2*vF0#;8S)hNqS87ZkWDo{ON@2y|AByPmRnE^1`{nFUjw#uY~h} zKt@UDrnZA@)&SoI_)hqbuonb46yUHZKpt-2JL88t%V=;~;0O9)Mx@t;aDUv7LAZwP zY=CnCj*Hk60e%uBD^Lt4>2d*11^7jXly*jt(_uFc72t0~!e0aY#^G@r?%#&r1N;#n zvJJW0a6Z5Vj?&vuWE(C9xD?=8fPZMTb4C6Pa5=zVbkPIp!vkdm>b6UHSJ;RLvaSaB zn?3i(^kaeI-y$CW^>4r}0IAmlq-+b@x7Omqe*;zh!!pNeX8pS=Gi@9GA64%GB}LJ_ z5AU)M8(|X}7HWxtfD%*$6p(;H<-PIMKAyq?~hN2phHQb$y6b(EC>~yh=K}k8E zKIR))Qd8*~GBjjr;FLS>lX_C~4=5|9p}2+{FJ$vHV^aRY<7IX^8geyM*HA-42@NGR zl-E!}Ln#fVHI&g%Rzt6=$**f_LiOAMn!hzQabJ2l4QhVoqSMI}HI=8KBE1^&HTcPevy5ThMF4cXsD~9mWF#Z z)YiBb-S2L%PRS{*`{nPf%^>GK4fkuyp|ysGH8j@HOv7UunrLXM;SmjwGIzS-y~#s$HAPoZ-Jd${^+WcU4P}~Z zcw9pZ4J{>!N3NAQrK{JU%A(ojFQxtz$UOQ@<`Wv)XlSqDX$@^PwA1jUhNoDJ3sup8 z;wp>x=ciT)`1V(;k&<5~`xy-#G<4MPtcLKd^g4fJ);gBjJfJ#h_@i7}&q^u1M0k3Y z?B_MSpkaW9ff`=a@REkNHT2f-vW8bQyiSueysDv#hVB}AQ0>&rUuvgx)zFO@oRT^u zpr(teA*U-{45-(b<-b#xewW?8c*>g^-qO&M8Q1)?1Zmr*6aJ81&hYK5XQ=DfvifM~ ztD(P!_cip>@Q#LeHM}R~(7{k``uWRWSq^;-#Z}OQdA;(T8~l)|o;Fp99QCD!u^PV9FhRpt8pd(X zU&DCKKP&HRGEG(Usq7C;#iiQcveqW~({!$>xb}XLslL~6oab?A_(20N-WoM6b9~qA zL#Eo=J$q)??4LAD*6?uv0|NM2!xRnkbj;WBi-xJ}DLP8)_*KI+)VG0;a?3aHTG!437J1^ny3JH|V zv=nJTnB>rz8Z7aWPp_@P(Xf{V#Wu_lM#E|iYec{m>S>4;$}>ld71IzGPJwr=hIJaY zvLkC)FZ_)fHfh*U80(+BQkykw5%2XozE$>!(nkjR8QCt(of>v&*dh4Zuq^U-3m#r7 zX%Ac1Z)xPb8_&qvTx`FF0~#)CxT4{phC{4q4JSnSu+XDIj|knoF6Ed27C1GW)No3} zSq}9YP79y*pV2^*9*|O6n^EjM2Y(5=$VO$Uw>za27|iIGgwGPYs^OZ31U8ZhDc6Nb zaGOK1;F}tc9RM{mVnN(H!oMrDpu`e&6w#3+8j1>~1{5f~lfb&8mu)XaN2-oA-EW8K zLNj$_2q34Jj^cv(h^IG8N4Aa}VU`e@TPVr*K;n|R|Kdu?GCIoY{_|+8j&eH6>v&2> zdmR;Yz#VGgf6CRRvek@v-IiS<-64;WLrAMqwy}=xXYy zrE_@qQ>=u_Y18jly6oIX|Rq*bu`m?^DG|H(O5?l9SxTzHeZ?8 zNXNrEeiQ?0T+86zjix$x+a;cRBjFJpmhicoAnkVf$8R>aZt4l`X}YK(a}~%I~`AQOsJhwt3m~qaQ~qCI_PJX)BaO~>S-O%=y*rR zyDVfK9d&fq(L=|xIy&iiNyp1NcsNgI9nb4{LGW`ryr4QBR9ql>lL_gl9P$-5Dx3BS z8^gg0U38p&Iplx||9dGIAsbkvZ ztT%ORH~l&7I%QH;?91t;k=+mh-WWA-4KR$C8y5xK#3KTm4|GQVnwk>G*^}QdwbJ zJ$Wj1+nI8MbsV%+F-Lu>gCnzVjH8C>_*};*9iw#&7x|GwM-<@w{?mt!-WHDfLg<%5 z#|SM5CH_jsI2~W>_=XDI)OR*yjMwokdkwR%<2xM_*dBEJq~m)X6LtKcV-f`%o+YJr z4)Grl3!ca}998G7GAA81S;x<;Uma6*Oc6^0z5PEgeAS%zem4KhFMd3`=$qMe!uB{`;_+rK8{;_StLzVZSQrhK1Flu$rrb)K5{zLLDb`oFqrbVjX)$ z&k`NK>sYU2gN~&-{$PvM5!A6v$DcZMky%dtI#%lVPsiUnBBJmg9V;Z1%E|dxa6u3` zt8{3E90nCg26PxY3M46GiU5N`1(G^k9kvcfykUt|ps*l%R7YILYPMb-vHzoo3fGA6 zS{>_zUywvWy40{y6f(u_IyMR3tYeFgtrCl3+y4LBcCbt8*i{&7_x}mqQ<#^1I`*@J zu$k#NCX$DQ9u<06=nuEP&zxoYQfh zeeI{bTNKuDQTNxJT+?w$$7QBfC-n-)M%j}{&AbHXDm&DHWKKBKdtJv39XBOi$`ou` zB)F~P4hJP22>~PrkP<**07U{o07dDIC`u*;{DG1BPv4WlD0L(1&DV2x*GWqiep&$O z0e_7OWikT30lXK6UJ7&JM`pmkmnS!X5+a-xK(+u1=Ln!=Notr|kr&*Q6;7!DN(WGe z`SmiGC?%^+N4WsX2f(|BDg^wT=7}WJsu)0YM*=w%&JUn+08a++Q~)nURFwc~)1CmT z22d@4>H*XU;LnJv8Nj%R|JHqvs3M@AS^?Y}z_Kc3Ny#Co8^C=5JQhIn0PYWFBPK;MV_?|Rz6dVig%kP|?^0NxDXtpKi_ zPwE{&Pf5L30B?&DmJ-`1TS$Y+zN$VF%7S8wbngVvKY;gz`L59S0+^Rjj3zOO4+8iw zfRDs5Mj?lV$sn#Z8W_N!0G0>vSHNF6_KDD8qG7PmApv|UfQfzu#j zenbFc0{Bw!ND&wn!05tQU$6m){MZ1#3Sedcv)HZz_&R_o66Ko!#s~020FwgvHh}LW z;`afJoR>()geC~5@&^BbI8ku=TE8~COilbTfS&@G9Kd^PlPUbOgpS;ib~oaW*uMlY zHNcyCFfD)?BJ*1SFI3ASoi2c}=%{VnyhH+)z-+eC02T(oJkAMVE{idM`7~xnnxDiD zKi$)Z(-(>5O9S{LfW-kU3E+3p&+Q~sQeYk>mx(=p20&A39x0iB2e5+UhJm66{t4h; zwx0k_1+X%J{{mPYz?uM7iGCvhQ-BtLE+8PZdy`U3g{rvH&k7(IKuGvb0O0^^Nt8hp zhy>trGzcIrHjo(&z!QN?SJ6?190C>{L)QkdPE_pQ;U=oy}Z~;Bd!9RfOV)j{~mxZ1adOm;)0bG=bmxLBH zDn@6syds>d>~w`WrOw7v6K~M$0B!|vo8!FU*D2-ih;V}8cfh+GvZf~Pl3W*5YY_uU z5=167CmTpH(8$2U22u^48I@VaKv@H62GR{=7$|07V~e!>8L7o3RIjjY@HPsR$~KA474-&qaRHTUZv#U z@$`hyM-4O=Ku$9Oj|t^nOOG39A-JW`Rzi6tQ)>aqQU7YEHiFv1_l}U#K2$!LkuL;%Bm1mbbE&9HIAxxqiRmnZx}-j z3^Q=7TZPXJ{1;WJo_gL>6z=W$p(729GVrAV%8xd{xL+6;V_>AGI!!J{?_v?#KV%Rw6a_XeuRRPmUf3WaIRt1(69B$l%Q zdZ&%fI@zNvgMMcAf6MvBz*MntiqLaclga#*E!@Cw21=&n@;tZiV``pRZgxzqim90f zW*L}oV1a?zRA^wXfq4e@#?-Z#;+DO4f61*LSC7V3t)X!RPs^-e;7Dq;IM&Z2L3eQ8HgEJ&gwH@urV0;+rSC~D;b@g-N3(+&1SsZ zB(6%WRt;CHXI86K1~db@fq;beSgk%>?I-lB&{0~2*Y{^w27(5{1|kMR2G$-4D?&0hV82`VvXWHrm1Vxsx@l=8g*ffnv;Mn2DTcg_*eOywd$U=zIkoe zsvQP)vh>*04eS!*ce6bh=q3V`d4H{cI__6%)qVp9MBpGtk81wD6^5=@t2VAxx7Mm7 z299z>H31XH3>-Ib*}xS8Ck&i4aMr*%>YtNv%D`y@XIKuO_*amZT<6ai*IB0?U8l|) zxM1L-flKTT3$jO*P3gZ*eY;LAT&K3KQxm8AEA+0iDH^zK;EsXo25uO*Y2cQD-A%H3 zMYEgFD9=^jQx5uXttZ#1yM1%+vV)jNG*QF^hu@s_s`Yx+f4!Qy-p{@zw5W+>6D3TP zG?8M0^P$B}WSU4bk!~WxL@~w{$;?y!nm4-c$1@uA^Klj@Pfg^Q$QAuu+PZse=B@Rr z;s(`hgL-L$f7@Uw6Qxa*H&MYv853nq|9Mo-#HSnl-NY+5_?GZLZ0lQ@c_u2FsANKk z%svS^@nZH9+mjp5Of9<6-|Jo3L=_WNO;j_{&cu@@?%$}Yn`mg_0TVS$++(7qiCQM^ zV~~k^P1H6~$3$HdEjRjU^$|LBqxycM`aL7%=TfSk>Hh<*Z=!+eFYMpAQJvYSayO}l zn^ekAl^!(lkcnm{9y8I%#KR^YG4atR)!0N66Z~J$RIJ@QHhcZ-3X?0Q@IT$lo7AHw z-ZWF`M*fo3+{EK1o-onIL<^c>qLqo(jN8or$@0Y}->QG^Emgj8#`I0CR^~`3~d$XFHkiuId8Og@7d=7EBNk!1wBUE5Y^Ho{5-=cwy*j_V-QxU+gu)*jiH! zITeWwCN_$9lhDmVf9zXki-4^KOfQv31W?Hij$I}WnAmAzmx;Yw)NT>jD|Al*-lE9g zCuKr#(8TR6>aYZ{tPTmE?cs=tqY`wC!(F4S0!qn~CQflswUA}uG&>Y!Ox%&^XH8r- zamB$6W2}L5brIaH-)aA?@tQ#uIxu4=dOta z3#k^;EI(qR1qdi&A!innEU;#CpYcBui&{vw@cn5y-GxU$i`c_keLd+Gw_>Gc2#27U zh2j=Uyp}+mD~DHPQ=0`vF$=j2vQXASISVBvN@=0gQ>s9NY|tnpn5mbyP(g4-q2%XT z82Eud;ZQ&;S-c+6??;tIpsG-YRJb4QulsXck6CDLp|yo4EIe+Z1#Py_%EGvs!_3i^=z|tXN~4 zqT|sh9W6Y|tZhwxWSe^9ZYA!)e9pr27GAdS3d_*Ki;~TkEX>}WImIg1dz-)R<@*u- z%hjtEM*QlxkS-#VyV3udJ8PTjW}&-<9#WDl%(n%+X5sZh&KnlqwD6XATfgRCR^HP> zufouk4J(n;+d?1V^eyD~v+!A2|3a?!EcCbVNf3jBc;CVY7Cyd|`cM!bTKLGqMhlzB zu`s~GDhnDLhJ`^Erdjxnu`CR>@U?|+EDWJ$3tw0mL(LY3GCLMVS{P>Ga|^>+%eDN~ zK_Ayhq2uSk+HH!QQ5H_JthfrdP~grsRcpJto1F2b1=6pCj%7c!i?=|`F0iAt}bp@6?dpsJJfVCEiAS0hlQCIW?5KZVIk|$!W;{8 zEzDyccc^JQ)EjnYXotE(z!}SXQ|GfA?)32@3yUo*vGBWv?1$2t>{MNZ-+!ly?D21L zt@ml(f}Luag}*HPZQ)NQu~X44x4;c71$c#pe>nI{5cw-Dkkb7pGTMWcC`MtOgG{@W z&t_-Z76KLw3#P@NVhCCYu?rl^ap$LQkkngVEqCosxdm%0{XI6@u@JTpvEW)*ZDEat zs0GhLj0JAt=uXvgZ3TXqi57D_MjyUgxgitAyHS~w%}MRuzbY-1MA zSvYUu6bF9>Svbo+vcP{!?-|H^cDLeZ&fwi@!fv(UkIV}eE?T&3;fm#7)-Y$c(s!#% z?8TEaL&y9tj{UpUt=)>t8?IZpAr__wanr&r3q^uR3gWhfI~*~BNDQLF9(D2g?7Nn~ zN`WuuPhHBck(R*LTYryVdI+Lu5UD|=1^vFC97IYGw~F~IvMO#)tC5nzMB9jD*7dBp z&*f$WQA{Mi`UE}qsNzA4ZknAbl(&}W1d$s=^&n~lQ6h+vL6oNfB3~+qG6JZ%bP(g3 zCvDl2P&SBig2^O@G%tvXK~yW0tQ16k5S4?VunOY4i5c8O!3|JVM4)OAgZ8LiMf~CG z^``z1+O#4bd0E{P#He#w_XSZih*~0fuh2R{)Mgv7%5m`z>9?J;>I#3t9(8{Z^@6A$ zM1vq6WUN6+4TE?fh=#MuuGphU`4A!Hc*P(l)F_CDgFH(XO@eqbh^K;RDyrH9|M#2b zksuxoqFE4+1<^c+Rzb85;_)C_h*(RZ8}=xpo8M;WxFjrNSP}e%CnP9&uX=DV{|Nh) zLf1|}r@g9u5Kjm3auBZs@k|gMf_OHFP7*q7ui~$kj$#0xJDr1gE(kJT3gY=7S2E|l zAYN_(ro!7Vp^r2qI(dB#-c|MzwTB4 z?p1GfksZxJyctAKDhYy2ruddb-IB z@va07zn;`Ti1!3j=9n1seh@?7^n1rgL3}JhgM0TbgHUoN1<`U>I>F>1Z&y#G{Lk!wA7_#?MPwM4%wL0;7R1~j<^}Ov5NmcPQech< zOb=p4p|+U3p$gNe~MP6PtQg7m2WUoJ@BlC@gg3J~c;b*$W~joDD2A;(hAIKD9Q8)rET2(BK^j zeD7T+ob^Hrly77QK{3j266R*1saZv~1+kqSB!uTf*b&4|4n!f84`EjjyMsswAu)tK z>@`804&qD@`-0dnagPUaAc%uO90}qm`$Z6kIe5-b;1XQ5-)|>e+rZljcuw^(k>`SK z&Q$MvAnimDCxvs017i#STyeiq?N?`mI2XjVAg%{-K8OoJTngfH5Ep~~!ef4(aJes6 z&hWr?$}^QKL0sj~)Yd;9yw85cmB2SR_;bt;;tu)CaVzLA+@&xhGU>Y%$m&P5K={~A>1pm3f4u}3i;avm?KtD?T}w|T<^_e7VZn-{tz0H6GFWZ z>W9!E1fEp?;I>RIA!bgwxSdJtkU~54mVfCaO>Gpy!y&W@p=}6_Lue90vk)GW>m2xADkW`ycWXiA@CBqjtA6R6b|7{)>pS&9;`%1(38coGo7JKu{R|{_$-8>A@mKQ zUkIPHO#4{qJ1mM2`iJnYq&UM)V8mjT#ri*DQy^SZ2ADZ`ck){`PGO z98dMl{x0MntN7BLB>w7}7{U)BoCx8h)Y_yFW(fF^Q3On8Nghl7P4Le`r-bl}fT==% z6*^5Q?^0pa^HS95A^(EZ?&~vVhA=CH*&)mcVJrLNjf}Y=%ww+%AwZcB7KE@eg#SWV z7{a0umWJ?$i19Qz3NH>}iFkh(I(uC*nRLrS_$!3JL->HasdolA>bdO)LFp) zSE9dlQ1#AAqs*!hG@A5w=Km8gM8M?$5`r0mCEj2Nb_kB(kkDplQo{lwh28>tsK*N- z7Q(s^)`t);v}%ortrkid+PPLRt=hoK&80b#HXmL#irD^M_&Xuo4I#k>&p;kLE4zAw6dsoK>+a;i#Z;0F z*eGfv+4d9q@u1>e-n$O^-8SuzO0iMxklKAAyT#MsXXNw!g?Z z%f=&z)D!L0yNCRUbEad$A(d;RgpHCmO4&I5lmFZFbgkUEhtwXCIeabs+gDXt8|7@Y zu+h>+c^egMJYeHN8+o?>3UQB(ngli~*-*Csj#1f06&v|tYTx~SkE5$fBW+X{X4+xZ zuQ+NjJEi>h^Q^x9ELJTW_u8muqrQ#WB34%@gX-9*A$ytc6VClY`L*>`L;pLXfsKZA zU9woVoICnS_fvexMk5hxCiG#UkJxBzqlxW*sWoMO<#x8*A^$sJ=}{Z4)BTd6d(1|2 ziSoG60?Aesu<^8wXKXyd8Zk242_ZqI%GaY-~6JEoRPP|1#I zD+DmPe+1lnOwn~ardEpgKO3uUag{dP#z`M*;sEQ zoKS27%kUS)T|9ikZnUw9-II-k2e2Gh{P)2t#h>=Fx7mP$q7Js(*kNO*ja{~Xmf&3* zyKU^TaoENYwt;3@dxahlx=-kSR!3GAgXj(l=a7x}j{DXgWdmdB*|^LR(#8pn^Bmr7 zoV0ODGIg3`l;)3$M|$RdEm8hCuFlyw&o*r1BD>_eWWIK;mY^#_XRa^9ap{VUtF+L@ zEzxt$#&r(+Hh$Qi`sd*s*7%LGc^gdsGvT%f^gWb#hb@18YO@{5HBYFQPG=@Keg+eT z77>~xwA~3sezJoU$1leE4pJSYIjHKOnuB!5f5pmikn14BK`{r#9b}4Rwu3uulClK9 zd_ol|kw3CshLn z4IMn-;6VqEIcVXscpsoFVs(m{I%PdhktQavRyKi0*B z>giWcs&AL()H$V|anQj5_g+1DN{v3{x4=#gI#BaEA2yx`zP2d%0!Rh0D&U{~WAxa5Agnr)N}Bg^VB1r~s355N11ZV6p_lsX+%J z2bSY6a^8PN-8!R6pH@_Dc9zCmipH)N8D%U~(t*M@awPzJ)p`*;yS$|y+ z-Gqlyrk_b%?O=~&VGU&*tP{M!!A1w`1+&s=*d_;?9c<$uFU&1WnuA+bk^fHm*S2yP z$u(1VIN0f6mxJA`omIsl7q`E8Hr1i&O82{6sH`Vc5uc)pLNM+9h{R;;_%sw z_UHarM;F-RgkO-CD-N!THz|y34z4@6%@LKon**lsZwck;opem-wR8Rsvbzov!YC5< z2lmjvI9IcZ^}hfzl2W`t2pK#tJjVPpx&6iOw= zAU}z0@$wp@+%QUnF|aT%CBrBcMrjExU>2`Ys%#kLgi}6@yf7*Xt`O!ckZ)Bb@e(NE z&>mt2RSBbN7!AT`7)CXbxmRd)p*6y|CybhchurlC|5}0xHqNb3JB&Kwtt+%%821UF z!S{zTr_kE^VeDG$mm%E)VSn6f9>#-VJQPMFk#8JElQ13@%;q$uh@Vi?Fdhw~nJ^y_ z+FVA+9ufa@;IS||)lgwc;_)zA(8widDPjd_JrPEmFcycgB#gFUvliAiWUAi(w?5 zSLM#Dq35NIW%;%Iau~1B?MZkwj4l$l|JEYBW1_2I&OmbGRgW-U6K|g|UKj9Y7;jPS zG`tZ8+vm`mm3j)FIel9|FV@j_{`-7y@h&;9?DMK`82!R{M>y{Z9WuY-yKK+r6+uBc zd=SQmVSEwB7&b+zh#?~RaTo*GqQV#y#wP_F>Eldd;_0Np!kKi@KaJtjFg^=oXc)u7 z7$yAA!x$dMh%iQmae7~RjSH&L1@-5-?9DmZJUsS=xc}BPS|o?n_V;SheaX_epuP!X zY#3ij&^YNDUxzXNk3`mNw`{*!$A|H47-s{1i~UZ-3VQ3rFn%C^fBMWYCWY~17{7!u zHH@D`hQd?Am>l+Rz5iM0D?Ip1?%*4GLH){t4I^WQAN{v5)?852B^HAik#0tqp96^; z!6+~*jM;3uk`{w_+~3?V=7ljoj0F;FVVK*&kb6;aO0)Y#wYr$Er1aVJ-@{lM#>z1M z6R|(S_%|#YWWvZlm;7fK%c&tR>n{mi5ysyF$Qf`^{UbrtQ*AmrU(6zNRTx?r8^YKa zh8{*B3@eOa*q;#NTp}e6iEawza*j|Kb{Jk5G2u92ZZY$x8OL8#;V}3n#wgrB;)W4r z37kvh53>1*8SyYyi~L$L1r)32zsnW8-K`VOdZA?QIF-67jLl)37tWS2wuW&yj3Z%e z3uAj22ZX;PjGY4ZvayA+JB&R-kMN?}1O7AuDW3?W`@+~C#;S{I?M1%~dCxWJL5X`P zjB~;y=O{=1Fir^nm{492aFQ7ropm~lGhv((CM7d3DQ4{~gHKHzRl}f;(Z{4Wo9%pSXTw zMA?K0%0%$dn5@JIibRkU@rUb_2vP+gf}#SFg?7H=XD}^-^a!#d$d345lo=5ei=b7k zQu)bv>&Kkpf=6CbnGp=xlr!^^Vo**5B}GH7&=Mj;KK~C=VW|j83!nI@A{EL;P%eV< z5mXQ+PbSF|P&I;T5mbzzQUodj-cePVNncj^5uCWB&hPMFt*aF3sh3c;dLgbUpoY+U zgmM=Hg=A(?ID+bz)r|kL=~`b_V=nt;)ii=fB4|b>lI{!&Tvm@pK+4d~ zowJ@Dhz@1dS5&hrs>>DscDDQaW!tlIN7l=JZ~n zA{flZ6G4CBe8~10!TW+g5IXycq9onN5e$f6pfDTttT0HxCqfx|u8#_dIu0`QZXeUGMqB$Uma^*Rr6hsV05Q@NyAQpig@uy4~6cJ%ZXjtg#`zw;~3XVoF zzGpVQ@d#E6XF~*QB3K*2dhvFA#~;nsi8ihPVV40g zBDg^3wFs_9a6>q^BDgK!rcfGrM*tsNjI}bF#b0j;E)rc7agpQ#E>2F({JTu{*z7Di zmR?a8$u9m%R4FdfT)#YtQ(aJoAYC{a;w>hae9C0G$aZl(iW^bnxX5+!QWP&oQNl$@ z7ZY9l;G&d^(k?o4I>JR67iC>kcTvMdITtOisXUik@K9cKRuD?HQUGoPYUO>zXaI3jKy|pXz9v3xTJnW*ei&`%3by3eneHXP|)Dh*B zuj}GI7x#;ofU)Qbln^k91`_n3(1tD^5WpKiC{z2B?1#kL$i;Lqpoz=vY#nUc!_Rr}N*F`@UFS~e!<>umb7q5zZR~MYeW|S`CEk6j|Tyz)Q!}WK9w~#f) zl{S=l^SbJAF!>D^Z@PGkwIedUUG#GCwqWk~V{iJfQ~H4G>WAy9k1#ny$hV+(T)gXI zpo>8+-gD94#m5r*zR(X`e8?8K%wMkgk?VKKWVxtfMSco<6PW|t|IOwRf8t_@i%%uu zV4<@z@tKREE;xVwxp0PwJoPM;f*S5(go~d~lp$y9uX(q}`s>F=yZAafSG67gtXB-x}j-p)kJ_`n}KzE-1`UI!aD*@uQ2@Q9KdFPcA0AxZ~n3 zZE!Kgh3g{f;ujZFT`Y33n3lVkCVJ+&_>IlX#Vqks+YA9SU6_)WD?(?xm?QjemZtK| z(qcE%JQwp_ED+{G8goOva>H*$!`rLe#ub*h_}#^SE>^i%>f#S}Y8NY9EOYUvi{%^y zBnm(MX5Ubplvq+E&0UZ^Wpv*D#GHRz{Oe*R4fq5+667yY%bif$Zm4TFl;%Qr5p)r9 z5pZEp%!MUpObb*vF(#|X>;6!acT~^uo#aTLoRPu!Fd;lT^w<7f+MPnqb`oI3oK7O&S5PnZS*a* zK%y)>S844nb;`wQ7iV0YW%OGLw^hyCs{W^{#chABZ`a$t@(V65y12$c)x{+jm)X)> zTy-&{VbG$V|VZ)?{Trc*nn$ z;F&urA&SH(YDZBgiXu@YajcFaHwrH6DH=t36d6%25zpj}hsjZ-L@~LON{u2dirLL7 z68FBN#@$iG%kQXSQDjCj_e!~)cU18xF5OX`8)sxiksZZDch&QE{VeczbBQQQMxmm} zkD^o*rK2d%B}7q_iK1*2RjQ#}6r7J5epgMut5zOM{_Cz<@pGlTsNZWUMo}s1-&YmB ztA6U}pTm6OF7H{(ugr*1+!IC3D5^$LEsE+<)QEzMF*+pVzmbqXn3QMICggLV*xONl z0gJ+WnWL&H1@{Q-OUSPq#eGpUjp7jry+4WuQ8bLAo_MLDK1(UlSM@*?4@S`_iie{Z zeAfTeqI-y$O3W`f!o9IXX(E(ST1c!%#oH{3$D*J>r&?Lfg>(P>#1>IJF1UMQ{%48# zEu&}^g(k5|-l()EF~3a|ZKLQ+lVsOVyC|L!{G`yQgtjjXeOkbU#C!^Oh@xX5|5+wl zh&w8ObI^0*eO~AbQM_0fnz%TTYYAS7;;SgeMe%ABU83k3MK|U*iXl;SkD^DEn`H4` z6tA%~zR7$$ir!JY&Rj(CrsSm;pZ@#QTT%3kqC;=L*y*@VkCacnK2e-#?>|%CiK4II zeg*VmD*1eq;Tul>DBc%U1BHGN#fMRR6a|k7;$ITR{aE+|qPR87f1;h2Gf4&slip8g zl03FPjpDN?#z@l|Dxo8U4inlrH|cX`gZ15>HU6XQk`pt3jba*0_*n9+ zD1M7#dK5FFn91%lGmGEyD`)#d*8TtFaJ7Gv#hC+&qSRBQYD1K)dR>=NF^0-&a;%%PsHYu};JQCZIYDV%}CXw2t=`qk3=!7KaNUJ zhot-yQJjq8bQEV;*M;(flKeKtcNNmJ!aNrRjW3wUIxn2*N%s*+eTUUd;a8JqK9-386JvwNb>%-SREdU zdPo)l%A^R`k(5uI>S0m0tTdtY7V}WtLpcxSJ!E>m@!1}7JY)%`_heFjuHe#zoDv>N zdMG8{n@Ra}6f090TGsPtmd0=KANmzMRQFKBL!O6<9x8cI9;$e#>Y>lisreG6vfz^N zm1G?C$C+v#?>hHuttRq6?4Nm$hngO0GixHhZZc{KxVJE~ttD<<5BCYb;I*7t>(i%9 zJrDJztQrVy?4cpe6a1iuMgkrZ%JQ5t(=XMB#k+e3ns{g`_z@3}7RpSViDrcY6n@-8 z3lD=m4Dry?Ln{xj(*_T%Jv`yzISjfW>aJSDg->#Ireb{_U6r5##?_8y)V zerFHQc%Qq&zbpqT93a92Jq!~4R8IE^qb$fF_|(H^9)9sK)x%H^!z9H?9zORl+{4!% zzVR@^;~@|DN`gjt80}$FoZkz${%xLzh3v2_ zPY>@5tFWLj)mka%4~x9!^OvPJ1}x;jG|uh554IO)B_*bdjBrBe{n=9xi*hA_6y= zsh0li_f?MvlK8`K*F;?RaD&BFVDNjHJVWx91dS*H{&~FXAt8n$F(k#17(;hyC3XOeOTR?e$1 zAiH=BnK9HLGv?cn6+`J5$_UPmAt#317Xp%@woD4wS1R;T7SiJ@r>AH?us43EU{XbjzB=n+G+7#?GJ#?Uc_ z<}o}TLwkwXB8HYRw2t8k@wSS|UsSQY;Kz3x;XfHe+Zfu#FsO?EHo|LPejb$dlmxA6 z?w=a*bPU=EJR=;gh#==#!7s4TV(28ea}3YL@Vwyezkz>gZ>HuKsa5JF;k**Vs{&pY z`p<8E0d^7GO=wqET$*1U?Q;E~*Le6(3~$HKTSDK6;Y|SrqZS3;5^v8KdKCz)O8#k~ z-y{0O@Q!f$3hh@IT2R98#_%4SUkqP6iSNh2O>hJoUiDuIK8oSv7=Da#nLP%?FffKu zF^p!J#PEqI86Lyn7>2|!OuV1Q@L3E)1s84L|DP?O1RTvikNIns3OFM~W~9&pu`gm6 z6T^fUzK`L{7{_$r2RBKEb=`f2%e|5x+3F?=UMOyd9Xi)R&?D9Qa$7&M7} ztw9m;DKj~SdmClZO^e~@7^cMVOAIe$U}_A%#;|By7Ei0D7+<|eU;8wNlE1M9{-RFW zWoE`OD~7IXc|Z+j$1sPzZw<<+`hJI=JOJn{5^1ovETfBb=T_*HTq05C1U7bPU73>!={3o1$g#Jt8+odw- z#_sf0qKa4(pbMq)>UHys7|a-~LV+-!0x^U{0|n^p0%6wOYTp}?AgXc&&;~DtSPbzP zR>!a>H|takYhqX%!?qZ<#}Hnhye@`K0*KcO*uabzaz0PXCx3GcTZFT8=v#&FPxqeUE-W4OWr zGmi3cT#exx`$!x`oakaXV5@9Jz6nj-yN*CE_R<_wP3;#k|z7l%4K(nS0Xn z`4zhe6?iCg**N~W&+iL7`G-5CD#Vc&N1Zt8#!)ejN^w+;qgtF-Eg)Y^trAD&IGiEA z+2fY;ekFe|8}YRZ7n6MzK8qb zxId0YaXcJHy*TQ}@n9Se#nB*+hH*R)$Kkj9-CIK%RH8f$W?Fok;zl{zz-@8dgQjv4 z8Z-NGJQ_!nIGV=&yC<^ere122mB}kb;&?2M=5hSm%3sXTIX%D4Xa1Z&wQ)CJ%Q#xa z(L0VlakP%(i8wmN(K(JbakP!&nK(Mc(JqcBq~4=pM%lal9DED{;IU$4esiavW!uq#nGUceiy) z@=(8>bcw?&pVC!|j$YnivbaGdmKbplMv3FiI9`k6b&1Z*ekNx}ycI{!IC{nLb{ynT zp4WU(Apr}ValcQ`?;A(II0nZtB#w6^`Ui1*7{|LTv^e_5{X1(Y`FFuyjvwRrI*vu@ z`QM5DZ`goOWsYZd{y(bT14@dbdmr9~hYc+3>@JyIc8i>|faIKWGGXLZR1_2gm<3D( zBPNm(L=X@W5k*ij$DIx{9j2#eK@mg{5fv~Yeox(X{^$3dQ|F$iZr!?dD|UBv1>VOY zoDQ+P3-&d9iWMZ@r_1q-fNCrC+!384P4W41tS!g7ax5>$3ih&ctSZMEkvz35cQqRf zvr`V@%2?;Bt44XMGKicj7Z$A-;SJ?@NkEr8-MQ#q7B2-}DaU4-#|~SLEws5DJInEA zxt`5+W&`VdD$LJVGLoY&*&567Q#nqQKe}Qs}+AP*INkf{zG2AoM$--<0E90SATl+)_*> zhXfNGWO}P} zR0icnQ9X*hC~8CziJ~A1%5djz%_#DtXe$vphVy888c-NTQ53bJ=v_l`9&%WzepBTp zWm;7?ih5C~C>lpmKdLP$j-n)r22nJO>c`W>8oC*CQ!_7GY7|8&Q(;=o^()Z48j6=| z&_X^tnnckwisn(Yi0WOme1tWV3{pd7URsK`RaEa#eq40EUPHBwqFof@q8J}V`zSg@ z(U*xv(J_inQFM!P*pqn|{yZ0L3xChbTWkik?wCJi7Sv z8mbpF8$};lb(4Mu4Jy=!t(~l)NO^K&|0o7TF(QhQQ4EY?P!vO>djIm^C_a7!L!$ao zLPdwEbPPFqTL@_an z%c8hEib+vSj^d&yE@qUPY6|fTToA?7D3-S`9@3?h)p21|KUO&6v4~g^mqalwic6)$ zSe|?Y&?-76bVU?b(jHcmlXaEU8cXByd&;Iq@xGkV#G1W2ifhDXHaX^t3c0NGx+w0B z;+`n3k78yNH$?RsP3`V58OT3J7ZiCWl0oEj_Ng*{JL2zoTv?(8R_lHbt>b)Kcb^D7KI(zs@&{9wxUn zidWMDl;P6l*P_@S#p@!lLsGeTksdDS-Vo;H7wL!BF18KUcoc6%@phCaHs})A6UAOu z@nae9MDbKj#SH$xSnsl(H_F?)us%8aqWFldJ*pQ#ejqwO6v`-{MDeNMFNJ;<#ph9c z!7lS%7U#;|s;Oc%)zO-Yv-Dqy0JU*_LNp2^if^Mh$bNTmnHfbOz>2~a5R1YW5Rbx% z!sT!$-eszc^0b_efZhb_OO<8kt7H^m6e$rqAhbg0exVfR;y}`G#7i^2i{em}>k08k z6o;euUihb?I3nQ3D2_+*Llj5Fdn}5|h zeD#}TnO^<^s|-CI#hL%V{GU;rjpC|&MS;Jf_&cqK8p!!aC`12^BEvwYfhq?29?dE= zP}Kko+)yvWcEsg{A-0(fp@9Rnxomp$>4 zUQu7)fNdaVpn-vg28s=o82VcC6$Tm^C^gXEzyJef29$xGhQ8pnv4JKAIvVI?ps9go z2HFarLCp=cO5+v=TBh-L`Komqw=wX0zM`<+IxWohLOU2}9Qlvm*+93ne3wdK;5-3O zK3-NCx4VHJ!Z}~)i))I=?^P+Bo!8qyAHjXooPGkvbuSxeU=T~pz=H+`8yI3>hJkAh z3^g#!0PniJ!oY9?BMeM3FxkLJ1EUO#H!#7#Xai#mj5RRM0Pnp$Kceo8=mOs;H2=%O z-4S&lq9#gF^8(i11!`P@nqpw8flCZbGjM@{3k_Uk;9>*3QI~Od7AUVk{aB!?6sjhL z>if2(mm0Xtz^p=bxq*I#s{izQ+ge1j8)d&(sCcU^1+Fx3m4WF7i2rBcYJ+Dc;KxFh zS)}R|Dc&2~rAS>^q^>h?y@A;VZZgpBq0*TKPvzB@t}@XZ4BRePul5>OG|SNU`Q9_U z;AR7J4BTblZUeU%xYfX11M>{rCfQ-E+sQ0aON!Kli}d^_jk&|nxBcE}fS4R+WJi&@ z$H2V?X!Cpn_etFQMc~sSwf?Sr&Hzw&fq{hv4i%~5T8bAL?_L-o{~-g*3_NY%VFQmy zT`V%N#K2O)iw%80EGy_y1CJSaGHuo40-i9?yViei;FNhvn7n$GweXCguUB4OOFe5~ zN-Z^0#GVs@=M5|uz!KmEzAFu^Vjedat~RjKz?%kMFz}**H3rri*lOs%JnIasH}Ep2 zdJMcIahdTA2HO9xfD!qdhTcu=M;&rD8{EOFOZyekd9;?Iz!rAu+8VsdA~Nurf$auf zH?YG1FIuI1<$s^bKRa)T1`0E1mw~qod}QEb(e}21y(|_3yT!|h?=YKU&xNA@J>k>f z4@AlP60}d43u`O#KV)g2%H$@;PYir&pj?7JGdMe^v-y?KFARLiacSs(l9XrA*Am2^ zS;SETh5=JJmLxY=G-?em8K^z%K?) z88|JRUk&^wphF!+0ltNj4*xcj^o;NcF0P~g5d5dmTSW42181qn&-%wehKWoQysP(| zfq%uMWp#8btzx3837Dv6qB9ql`dR;%(%U7Okz;}%vkgo%G?8nfx`{j!HB8hpQQJgK z6Zs}0CJIcvTt|IcM{yA&m#kBHP)8M-C^GR|9o4X|+H^Fx{rKEEChD4~XQIA|Wy?zj z)>V6IW?xZP-BDNdTvgC0$e%E=tk^_}iPk3Cm}q38)I?Jg%}kV;P$n9iXky|?Dy*xF zRmFUa&MS$0UZvpux@uh8g61Y#m}qIDm5JM5Dabw9AXZmBv7)T%uHqAQRn>Zm574$I z+A+T-x|nFs+?nWTqLYbtcI$No_3A19Wmr-(!uRbRC-S=1Q(aA*XQG>l?ks_S8Wv8^ zOnt@?#fF<0VPd3-150$Nj*?JfF0~p_PmLAtw9G1#OpG%z z-qZ^!CYYF5DRwyP@_K4Dj|W}28`;#w1JkK|ovf{uXO za7b@3aifX*Ox$l`mZ|qX)7@cWw#l1NwD)Ecw+Wb&4!uRdttQH)1}Ss9iMhg@XX1!3 z&kDU$n0J}DyE3lOdn@t#4H$90i3KbN6EB%qXyO4AkDGYH#DkJemhdC=I#~~i_hA!! z=jSSvMJ5)TSR%|vg)SA!(ym)yJtnwv!~2sao-(o0#42GfGx4m6=S)0J<6p^m#{6%~ z&+-lh&x^ovNsj4qy$3hTuVDMB|6hHrHt{0sUCx<&!Nj!sio1u_m{?1z8ppiX`!>iOmAGnAj?yXr-QJx$1Bg{)r~|L{i*t;&oB7 zQ|Jz%ZwOr%&HcWZR7g5xOXdM~%#9f|_@)NBnhu&cY~p(p--xMVf!w#2NAaK{K}K3D0_4GJoe7zFywF&qn^_V0AF-J}!Va@sEjO3ndoLnfRCE zwuKrNGAv|T$hMGUp^Al{Kg+CUA4imQ%=x)$nNXkek9gi=Y@ zEtx9{%a|?`qPL+1mh)#jBUR@WG_p`?p^JsC7RoFr3#~1*vC!B;6AR5Pw6M_BLbG&2 z%=l+#BVATRhW;CAX@O^iwvwP$r}J4v*MFhQu&sr57CKt!WTAc9h7K0SAJti=J1C~^ z+RbkeeL#KxGx@ypMR@Pb~kXo7T^g=`H-X)@Gh=pjZ@r zE%Xyke@jcunkGz({M###DIxrgu7S71-HFiBFJYGJa4ug_#o5icivIKRZ{ zbb<>k(9vLCeSWcpODs&M*TOXF>6CMsh08_Zr53Kcp!nZ-{uLGuuEdoVuCny(7WW|J zHq=vFRK3NRP{&c+H0Z_d^Q`&L7B>Tv#Qky&G5t%Vl^Q~8S) z4v4kuEUdTil7%ym)g$x&1u>LmzR|)a3vWqYUa_#54aUND3tL2zzp-Amu+;($I49c3 z*=Ff~b8I=UTiC%Y&=?VZeYXDd^@e1mZ|}$ti*@EZy@sy4CE$m}gwb9bX2NpiG@Pmb;7Cy4@v4si?`z?H8;ZqBi1)Jl) zh0iT~#dd4qi*(+(Jorn&>#o)LEl=|e3sJ$UNI%rfH2=ue`gHD?1=oUSAufDJC{ zz0e~e;8@FT}b8wECwTlh(WvTU5-ILv-w;U5bpE&O8P4;g2EWu>r+E&R@+ zsGd>J%{*n{G>5xlHK17SdajgX3oYrnCG)*?y6ydG;V%*32=linfA(MfMf}3+`R6RW z(Kz7*jS#O#~XrjZB)0B zXLHv~b`2XfZPZ>+Fy(X({}AQd;2)yzQyHsH>t98MHn`p+RjeA@D6&zDk~ZqtXlSF@ zMqL~AY}B{Wz{WKN+0}n4TpW~eHtGAT3mOi~zPDIC(k)VAqmhj=8;VgT6?PetTWaII zhxDt$Tj%s9{d3E6o-Nirw~39hKjhFgwb4v)bD_)2^T}*wqqU6zHU`@0w?4BC?X=O! zMq3*jdgQjVaW<^pUMN8a8y7vFNiceM?xm5u&NeO|8R=r9tBvz)bhFXRMsFM4ZS=79 zuGpS7=Dt)^t3;b|zKuId)DtC&kDj-=CB;Txrf8$TjWb0AlC&dqtXY*{1qMk7VxQCI55Fu~Tx2wV~`o@`@^jZ1A@W@D<Fzcy0UO10XLXBKh*nPp?Pjhk%TY@Ojr)XoCQ^344KgW4%)K)U)3M%@&1<~<@{sf|b3J0?dK*;p)` zB~)^oyrkV0dCbO7rHYO^AGh&@vW*CW1WrF?4&kc6b==xVOJ{CX|)o%-o{HdHl{;22zc4X zV-l(jSed`c#w)@vjTO8t{H-j;dU~kbCj3{0wz^(-f9^?tUA)A5ZR}vvwXxI2n>OCI zvD?O%Wonm=w`lF(nTN{MDmRC(SXGsJM`G=RgJQ(LL)`WF}1%X^o7R)XFax{rl0 zR1463z{ac;7dU-v;}aXcjf9O)Z7$$}Yx8oS{LgKCVZ*XvGhG{B*(kRWwehv6s{HSK znNoKuWeA5lO&gCZT|RB@(EWlgW+Tpo3iXj(SKp8IN;#~KPDQVUC0;s~np+asNZR<# z#wi=2jTBq8jUQ}O*w}CL#w#4Oc`<87hk~jHYV}#hO!ul zDaOMw6q9%*qcT?Y>*_WY`4%y>jG8ZKn#yK`b&qO^Q7G+;*c1I#xOR9aWM=Nu@NzhjA6K7 zE;y&;D8Zv+7{d|>^q2d`NA&Z3&CR+J$4ltM7$(IqL2%_3lF2blVW!$vy?_OdTy9rs zJ-F)B7?@vffw_?BHdS=oDSt@}(_&Z@!{Qh&jp4EwZjWKEsJc9cYhsuY!xb@H$@!lc zrnB}3)cYTktF8wVQhMpGW)=ir8^d)m+#JIkk-0vG8)KLy+GfUZgG9fzsbZAbG2A5l z%7}k_TZMo+Z>daTZ`Q48on+o7n90qPDEGy1e++lTaAyp63FmI1rxKARP1QXytZu6A zjp4PX>dU6;T-V~tWkT~~SP;X)7#@h>A(5x%2Vo+m!!@_^$|1g)tur!93V%QMF zqcJ=d!^#*|v1P{aL=4Zy@LUW}#{QepdOC)uVpzt;wo!9pLZ3;89(@_l3tpb)WNy%6 zD`GhIvIeWu5!b}mZZSi7}klmK}E)T0hO^B@#Pp^70$*OHpTEt3@hF!-YT5U zg14kKlTUe?w~gf!!}dyrUdHP&eP{!N=ynM64WZvQRl8U|F+I!IDUP>e*d4=J4l*&k z6T_YuK8@is_KqDTdt-P%hJAwH75bjgb4}F;Ecxq8J`{SQfyN&R{#YnW{u3$oI?dGQ zF?W>J=@Vtz1cT+25NoyPDZ2g5@pIXz0QZ?2X!SG+}q&mC^5*wkE|i0O0bdA#t?1gOz}Q(?Th z;^E%EGQ}8vkKvCPPDvI{$8d&4ohUuYSant3`}F&8wHE5n82%E0zu9FPt1d0nxE6|! z<{iEBu5F>t#qe(oMRC-MBO{K?IBLfAi1F)Rb*sctH4elcE z=ZIupT0S?9>T%rPLids9TBy%ks2Y4gEU!V3AIG1xq=kyaQ6RW5&B<%2cSh8Xqj4Nf z;;0ix-8kySQ9q7GOen5DDjUR6EP%M7fU=f~t|SgpGU>{MuY^{vOQ9L|Us(sQjWms; zSscydXc0%-INHUzlLf8fXdOozF@9uAHM6DSG}Hypl|I^1EtUzc_HlHO(2j9zYpK3! zsW`E}_E65Tma6lN!p?DYiKA;A=f(9yZ9*K~;^-d7usDXt(IbxY;}|5-dkXCnN8dPl z3GOYlq?Ilxx_)u=k7Ga_o8<+mXDc}nB^?pRSn-aG zV-&MFv+BAV>yM6OOdJFhBd0QzadC_nNpdLAxpe`TzD$l|N*w3n_&1KJaa<6`fjGX2 zOw6kK;XZgn*sOcv!?1rBi<-j&PgK`{Fp3#Ni00cWGST zVnFbC98bjYY#h%?lqcg@7RS?ZJSAT1Kt5&Yo{8f#iA$?^1PwXQ$FV$)6(YvxZ)NGN zOsD%*m3&UKzYxcoIM&ATB5Oxx;Gbxv*2S@2#9o%%aYEyzbgT_=@PHaB-zXfu0}yYH zV@n*dIO1_^jpNlgKBX~i^KrZu$DTO$#<4w)*W-AL1A81hB<`C+--u&pTptEPJ^bH6 zO1Ddb_!>;i)OU-Q_#O7~Ci)y3x_9GvKaPD8^qx>QgAc^ukKA${qs1!h$9+@5yzKl{a?rNRT{JW%hQ;e8O0Q8u{xw>+UZcXJ%&1Qcx(n_ zrunoX5l0~2l+dJ5+7PB?D&tm&cfU{`k@RgG2We^?Cxr7I%W!(eu{aKi_i!BF3t-$M z0)B|=1ILcWLASSF4Px5!qcD$)01f^*j*}cP#rum;%ADqaEcmxH=ahg-tIi1iJ&r%p zp_Li`D~`W~b2iQYCtW5P4l*4Kb}+<26$e!vbav3i(On4+avfB6P|d-U<&i9*NN|BrZl|r~$kBhTRBcC3r*j^_kQ!%DU56hL zIrSXeQ&W#%4ILCaXy%}~=qzzi=0G`UB;Ha-Z~mp&m_a3th0|1M6QP4Hiu7xf+k3gr zNDBuo9kh1PMuJ*7|LtyO&}~Nw+S2Qwqk~Qk+B@hVGJIEO=>0S6(a|uTZ$mE~cT@6k zq^=G)BXqu_4@x>uXg3Gl1(4H2z^<)Yrl*5m4thK2eXL&5Z&m7nt z46HQRK{%|e#XI@cTB}(hpS)Q)7ZnV3FwDWr4mLU%?qGz2i&#Vs_V&*m>458|IA=AA z#;_zEjCC-{!DI*DY{(erV7!9~yrO-B&Imb=ZPPC&6RB!ITJQ|UzT3$;5rA_v(_Za_}1#rYYYAyu4}N%;3A$pKrqX}YzIpm zEOl^`gPYkB9Ng<*j)Pkq%ylr&!L1H&SjO$ne-}FN{f!Z4w^mow&wj17x`WwqaF@e_ z2XV#b0^U-`(4iMZ?tQBvXA!vWT@Ka=K8)ddpk2-kF!3qZ}9X#&v zmoc7p@C@5LyT&{`fqLbnQhggw(402&pCMB!E$!PNA&mX?iU)q z*j8QfTmG7Fa(F!--{@93SnXh)gY^zxaPXpoH4fG~c(bjVaH4?kAwgS}+fLirqn+ZF zkuR|qzf^UDqfg`6-L}!??bMuhsyY{7e^PssgSQ;K?cfy$n;mRn_xz;xs}8nFjcgS! z^}Oa_yKvrg@VbK?4t9#S@&*kGyy4*BEs@GqoqV9|l2AU)zkD-uH=Csc(}Cq+58DYF zm4iw;Gr^+2fo&RP73;{LT>yoh@#2h3X1PIP2h_H0K#R~i@q+hUF5iE>7td3To=_{G;q<-MV^ZqE{a^#a#7PozKa4ECx__|F0QeU zP!E5K$zuCLSO1Yb-d=GTd2JVUT-0+>-^IQzrFC8Xt7!HNjrq@ufBEU<=CbnHD0Wfe zqRfSI(a6;U3mw0YN?rYT?A@OF>aoTynz(4@qPdH`5pcD9Q&(^2snS9JcjK?U7HK|z zQSr}0YZq-?baBzuMOzo`Ty${J(M5ZS_1-g?BUhI$-TB`ytxl3?XIKAugS@ri)k({buqxj zKo{d(OmH#C#b6gBU5pYlhPW8!Vz`T;V!*r=Ma(IaX70F~Z-g+pO=Gl+F@ndrdfx#B zC^nWUM)XsL+Y=}`(ZwVe7r404#bj4+q~b5#De25oY$|KBhT=+o@-K36v5QMsS-~s4YYvei?*SmPa#gi^(y12o`{VwLaxY5Nd7k983xR}kPUEJp4b^fym*%jW%QK-Rtc>Xc!4e7#TplDso%xdF4nnN@8Vq-@40x% z#ReB|xY+69Wj3Lnxtm>Vaj{YGCKs=``pAwM$BO9)wz_!L#da63v)3OhX6QB-uL)+u z;5tt-cer}#AcZToY8f)$bg|3D9(F4iZ@G9|l<$^U6sAn2hId$TJb&XmeMSc@p$5|T zU7TK*^MQ*GCDuNn4Eo5$$1Xl~@tJTwadCF5wts7waY(@D!vB)}G?DcMd(C&+JetI~ zE|n{W|ui1X0e(`(L? zE)Kf*&egwcLZK<46)yG*Apd}XZ(Mwv=Ikh_f5^pQb_7q4)!(}~!XOuaxcI@vQR%H` zIR3l%kwc|;S=7f}{G7%=aX^@l6YRMi^iyWq?{$fPaq+8*-#B#qUiVa5vg)ZSrv;Nq zNxHuu%lOm9UmVFjz{B5Z$$tf$b@7jYb7}tCEA?2N;UUx0qiYqRT{hLJez0CO4_V@^ zDKuMXbq_fLD4grznhq+mASX{aHH1#AtG9*bdx&@_@KETXmhg-I52bR-)E3TcvAnL7 zRXq>&Jv8vp&_iPnO*|9}pT$_}p~OQY@s8LCPMIEUR!DxCaFhpbC#Scmcv}cz@2;YtrzF$sPJc(~ld6%@X{fUn#)_0HqGUv4LL zeqPaZX2H|{=&z<3Z3`}&S#ZUiq9z^cbm*jpbyC-QxQ;C+f!qYH_b}7L^*(0$n0+$u z1`l6(_?p$>VU~y49&YmRw1;Or-0WeFhlL&<@X+F)yjwio6YmmytB2b>-0oqnhj}a+ z4|lS894tE0D|`NxHMZWDegD$xjPhfhT++K)=@R!|5BGbR@8LcVKOL@4ZKQMyJp8y9 ze|6DJ7Bw#`f6&8&ozx-^4|(7X=HxugvSs|u$Ar5+yjIKzM^r3Q_UG9UBs zxZu}1sgF9TR}bbr<>6c>wamkNn^4?Y4d|@srG{rcJm+DnhgaDKvhcizmpp9nu-wB6 z4=X*a^6;XEH6B)bctLc|>Z~s6tmER*61~Wr+4-mHIuGk5^nuQ5YiGU2?CB*1pLbR- zd)Vk|8ZP~Khj)sK09wyv{q zQW+cbUY4GR&pmv>?0b0M!$%%I_OMTcKk)D&yTi(yNEgMkT*i0NKc2Wnh({8A;^9*d zpLrm@tBZQHi_Z0$F6zB5daKdHowDa0jC|?+_qJc|A<7ZJM++Z@2h+npEOSZ1@=)Pn zzX#hx%tPFReXupJbdHf z2w&+v9w>){BKbY7^>9e=VWCI5sNAmFa=MYL^*1=rayjbZn1^3H{K{4*V#nDUJuH}~ zyZH%EA9(e%hm#USOy=8*BNa=_cwhE!9!`1q!^58*PJ1{bGQWE$?W%@M)g$?$#rjja zQ&;sD2Y(M|S&3g~R=u-qT30nUZOPKE>R%5TKI;2u;3LyV6(0pY3Vl@d0Ur?`v+k+F zD{or$DXQjUYgd)!BkZcOg%afW$Q4{&Xr9m-LTd`8Oum3eHx*PnRNCTXgCZZbeAM<) z$H)9jbs6%yd49m2D9Fz^Pu2BNURbZ5uh*Y&K?N79H1tvIqs)i$b+MHAXyl{R$AF!B z(tvKbKHB(bE1Y(|KF7FHb9>=*psDBSy6Y_7o<4f{=;EWRkMn$V^U=fqZz^fmt9mZ0 zyN{kCf4<1qs-xGI^!Cxm$3Wrql_dK4=+D$;Zi*2pGeAPeO58z$2Mc9Ko;oQq%*Sva zlYLC_F``n^$2cD&eT)+CXrW_hRk=ROuQC_oeN6B%QG%`(&EznxNkShN&QzbpBY8n6t4)m!N&?8D}CI^R>voTkDGiv>fzq@m_besk;iRN1m2)XgIe1 z=Z{97_3<1t;$yimDZ{^(L3dT7hvI7gRX$ex_{PV#Y&I)%UhuKa$7?=bqM^@ZwTG#<4pn2$FdmuwvXM+ zppW-`yyIh!kG($L_3?tFwS$_cN3PpY=JimVIr*)J+UMf~A0PVoh=p@OL5uUXN&U`O zAAFKO_k8ttmpu2G;!k~i<|D?Y<>PZ7U-;ag2*byhKECqtHAf6q!TG9s%k1qh>+$5w zq=HSNhyQt>o|#d$7bY{#K_k1s_VLqz{OjuI1rpVJD#wTGBgp~Ehv&ohk?;}txVSi5 zwaBaLtgiu_Q@-?Dw~EOdrtbNkPxU-BQ079RBR zosYkK{O#iqo0*SaeEjO;d#3eO&IzGM*kybi6@1Lcj{>-C^0;}uv}U@~KF*|ZWyC+k`=^h*^qmf8ePkq%nb1-GkLgG%f#L*85~!Cz{RA2$&@h4Ny>k!VP_(LL2~V}< z8~X!2_0qD=T?-l|P?~^Bpm73UoGs{etX`R<*eyGIc~AAa)R);){nAr4OXy_@?GpS{ zMDqk%B=G07vX%+77C_u8fx*qP3EBv!tEa0P3YHbo)XhPfdL5& zOkhv~lNlwUkB%9fz=#A!CNLy{p_0L2LWd`CcQ3WPmwL08T6tl?s02nQFg}3^5;`V< zu?dV5+&r$|0l2J}v$8Au0{0%tB=&nLQvGmA;DQ9MOkhlJbzuS*B`__4 zOB1*_0Um^ViKsd`C_-UQ_WssO_4_ODvIH(q;0jh~Z}sz^#s7GE*7}v-3a+RVxr!CX zC<$E6(%YVSO#(OeR;zmJlM;9LR!4iQzkAiWjxYZSJd(ho1ZF0115HZcK1wF=Z*O&L z0=FeFD}mVw+?2r03Cv00mIVGjTw2;kjqjrt^-(YO(YHmgd@cW>Wd6=R>U1A9cW1r3MTQaY5s=+iE4e>`#b>e>CNQ71AS;{~Na!8= z%N|JJ!2}*k;9=I+tjN86RVRtE{DJIC`>Otj^A;!YR07KqSdzff1jua z5dxEVB7rA`+41GF&sP_0A6fQv0?#C{GJ#bIJe$xvZk|ivdDiuoOl}5Q&Ia%fxbtO2 z0vrF(FMhYI%OQVt0xu-6Hi2~syvPc&vi7`#H3@7!t5X@$CYyUw$h>Kv-kWpT+RT>{ z*pR@>RFc5f1YS+>7OK2W34Id%fo;F$Z5FykD3^thvrU@iI|+Q+SG|_N_5^nH zRj()TMgltp?+|+Ohw5)8uuJgU|A+sUU|t@yJ1xfOdlIt7fnO8g0U#$6_(eG5B_aN2`Axj1gmOb7FP3HW z-#Lg0=MSM=&bOc%KHi`67fW@2&fm2Ba2CNic8~;e0^|nB2#^_|N`R_?yj{GWzom8_ zm(XxEIN!_>=pVAx0!*!wn;O3?ES_a@UR30A4vT7CZq++xQ&^FK|-%%(*I|1zj zbVzf!DY8?5&f@JNv}=I#Z`EH4d~lPp<8%-7<7QTX9t;Z5GeEBZR|mKzK<@y30)3R? zMKyE#2Iv=Hbbv7|?EnJ;3=J?Wz`y{50t^l?B*2uQbe`1mBmERF_@@2?7ZtqOPYn++ zBEZN1qXK-=Pj&gD0fQ>~sa7}XSL=P37dG#&#s(M{;3C#qfbjt)1eg?Ha)5~eR@Ox2 zWt0@|-Cs>%JqEZSz=h1|n8MlpRo5PcKfIj(cz?B_zuMDZMVIAV5@1?@D+62=;L-q> z1-LxG6#=aN>d>;Hzxpe_Ed6^Tr+9$sI6w^?pr!|U4(fja&Xw!GB-HTmNBP$bP%{Gk zqnxGGGa9*;)!Hlfx&YS)m?`*1p=915z$?oo?zK8|c7U4#eUkRg0d5ySJSV^{f^SW8 zZWEBT9&-iEOY`p#aHr6->u^tidjlK|a4gWL_1+h7F=`ff?%W?>et-o576w=wU>!pP zJQ(1~08a&YD8R#kzAo*t0FOx3FA=&(=wi0dnz|VbyR2wwfJcQn=NkPr#G`s27ccP> z!GFK1mkH}3b5?1%+6!rVY;VMGpY;J=3h;V>9RW53cvec|Siu^XAuL<4QMAzeX!4vPwe|E;OzkK26!*PZWNEfI2)t{W(B&9;g-#R3Ec> z2lyhum+UnGK9kfxXGhM?UNcbf-t(Q=+3ycjmmjb9Re-Mpu6)+TxPPGP-z+C@kUpB8 zJL{VcQYIT}fQkV7S%v{(0sMd`jUXPt3E&3sSb9HaEoz-Revq1ee?h9GjPLwZ#cOth z07>@f04Zj9kg7jebr`Is4pt*=-QQbQE#uI7Aiy^Pz6)?Dz_$U~&Cq5XWU-VN+&Wl| z-&Bl|*@yY_H^7kqKQOrq%Wj%bynlZ_zc1#0sP`lAlBPw2)sF#=2dI-o-6Vbra3a9p z0nP^aIne(OP75VCDc~2OzXtd%%|8`@tHCKicP7B^!v90)pF;l<`cq>q^AG!GfSjb( zO!sd92+l}zG6hr-T2&|?8Px=231zHo0i1r%O`^Ksyd?6IhzPDBw5HHrvdFn0iCW?< zOrj`>9m1p@UOiU(|A^H~qJ9$Xh0`F3hDkI}qD2zL!cjsQt0aln2CGI%lnRHqOgIc` zoR(>l#J<6*snBLgz3PBo3bah3jmWf0OSYEK)8Cddv~3dYlDP0fy$brF?Yf9Mh*-xY zIwg4^hURn;dY;g(LMd4(+#`welV};DRfwKR^h#o7604HvokSmzT$)7RB>E*WFNr&n z=%2)ZB>tDg)k%ESp#H!l?%$I$GKntd@&*YVoWzhMh9)sAiQ!3%5GI=q1wQ??nDp3S zMLH^p(MgO+Vr&u@C2?^QfqdL|s@siIM+MAP@lfG!mr#eoh^InovbRiC&3MmbCY;W z^2J><{I0n(iMx_moWznO?oQ&#TE$EMDSnW(z$_$jAB#GPg-JY+#QY?}A*$fV2JMEb z1xcJ5qUbgqD;_vh^*>ek>gcjdhpLBItt)fr9!}yB!Ha~xJ-?95Hy0K#o3n~?Z>XsL zC@XiUdMt^@lXxMX^@PypX@G#Il2|6-=_H;N@JuCL9-;7af(f1)s+J30A#}s)Ofpv! zCy^B*JH(4gtV!Zv65l1UHi>mfe3-;XNvu!er6k@=VpkFyl6YB)>-8iyCb21rtx3F^ z#I~X872$7A>Lpt&ZMrQrZ5UAYf=lA+>#+#3xC_ zl8Cc|e3$iU5?``|h`?t_e4fM?N&QaFtKa@hT4jGNp;i**G&l)Eyk^??uO<|8p9`Zf zMO%Ux(MiHhq9Td?Nq9*v6-G*e5=jI}B-tv&%dIh7^>qKP%*xYO_&QA`Z0(iW4v0+U z>-{%^zZJUrXwIP|4ztIF;KS(qB#tC;CW+r!yx&y+A&KJxh>r?5CiF+4rNh)uNt{UH z=Oj)F=Qp9h2>msQiNn;4Vd}kMiqTK8V3Vl!c!4)eof)QzhpRtCj6r9U_*3v-Y0lpQ zCJk5r2soGK|C_{%!?iZLOfk4hh^hi0w3<+c?p+$m36UG3PKdf8xUIW-h=LG>A*%nA zpBJJ=h`BB6kY6)In~x*;AtE6z9Fgq~SBE|>C<>8NOAi{gLw)sdEumx2W^x-Hz4b!W z4^bMTEChc5H3-rAU=Ald8-^$j@ncc;f|oN%O9VFx5j&Gd?_W+tg*e_Q_v?7cng@#- zhahbdqG^a`f}0C%5#o>Gib1VLs39X%Ynm70qYxj5Xd9wkhyfu6hTKM))jmYm5a$W* z5Tc`iPC^;lSwI)+%*vp*Tc}5dUP1}Fhv<>U=kqBbc+LpLAiCb-?GvJJTBcu!{%QQ| ziQ+*a28UP};(-uDLJSRYb%<+13=1(l#04zL5F-@z$ck+eWIjBNeaMcp}7;A)b<0oA*RozLB$Mr22lOsxnGF6XMwr zt3$jH;<*sdhgcqBMTjRl7Bw2BxKC&M9g&qxbZZH(K>G06;<2ODst}}1=tVZa5NkuM z3$gKV)~r#g{xEw`Xt1sA>tvNP)`tj7NT5o_qlk#5K8`+A-)p) zwb1SJv~W};jdW?40;~{rniCVigNED?9y?kJFCNYJLnJ~pN})7`AVf06-yu%}Ko}ww z;zWp_LsW#=AL3|;V<8TN_=asP#NiO%vW1UP2Sa=pqTY)9d&j8f#;9#$)JJ0!z2CD~ z_TWf}A1FCS{W(TW8LRFZs~-NU__49->#^#`5VOarqQOPSL;OU|V^z*LRXk1&8K+K$ z_$9=d5Wlm%jZ?pdIL#sJK;Ca5PEqYRT??^s>cluzb-WsKpnCi9>JN6|@oMgP^=F8` zI1E-~^&hY32>uCij-zx6HBd51^%GS= z3e01z6be%)N@4y)^=dM2%|x|(qN<%jofOVZ)TLB4$YaLqr_dm!ds#^e4O6H+N!>9? z6{pa7k{Ufp7YKuRE~38&WhtnXUR~BVg~ll~NufsyTZd;iO`%x|?NVr;Li3b91hQoc zt+*n0XIYCBzTK*4R9dHShk-UJv}Inll`-{Ilk_>3bRSGo9a89+Le~_|OQ92!PN9pK z#9E^O<&TMQ!DMYuw-mak&~vgjthrFu-D49=&nGj5UMciWVcffgeNuREvf^=$*G^Vz zC#&+ws$UBIQy7ra$9vKZN?~9cZ~P#0a0)}jo0_cXD8MEPk5oWdn3OruN+m$9@{dP3%Mq0?C=DO@3#%qs<4l|tq9XIH0iO$s*) zb4Ci+rZ6*w8`$2~<4o)0?-8dM5%e&)s$t{PT4D}~t-h4-e>Tkm$P%4c!l4aw15lh4t))%%gZ$rSO7))k3++w^G}SDXbCB zTA{}u(FX$4y_CXc;Sg^~;pG%Iig!~AuLz)3G_TT8W(zw`T0Za3yw_5CmUVXu@1(Fj zh1XO1Z}JZIroP#4q`-^(_+M#f3Oogl?o9!^Qg}r0@+#j|${f;M)`qvOTBpdkWuisNrat!if|Pr}UbN zA5u7)!uOT9UCt2!PfXEMRmTJ$7y6^n_k`d5LmlyF+9u4CLVpoT{=ajINqR0^k4 zI3Q8TIX6Z9k;0!Mmc<;U@Ha>G3a#pF3jgRzM}~OMNksDLx}@roW(vPb1+P*nrMKo( zZ61VKO=u(GkeOY99O2{&C1>nZRigqmE6|_<4TYIsfjR;r6)31cVOp}5fT9ZgZ()5# zq^m8QPmA<6tGX4amzJzwfz$m9$t+HDN-I#3#*GB9l*$Asp^ej_H%?W24QN`SUj~{9 zZC-&E0$K_szm1R-ju2x>ulg1^QH=M+MHWK+g*FssLZ5o}H@h-H;!Bw&J6#D&Ii4(|TF zF8=$S-#K;ex%H~Ly6Tm5b!ih8l_e?L$C$$WYN47z)FPd1iT$Msi?0{`dlObCh`K@4 z3*xsR8VB(^wf{jh2%=#Sje_Xdgw^^jX{zHJ)r8G$!ZI`sY`p1tb2!i>h^9d_528g7 z&4?sKooK?OChT1fUx(6BFPgB7O<9pee)8NZh}J>03A$eaGJkN=mSejh+9%69aFSy^ zIwngx1<^T~cj4s5I&=@BM-a1um>opVAbJJetrL@iZp+*|hyg(i{G5K}pymModh$qbG&IX2tm9ZHAE^PuS4O3mrqAm&lQpa$@|XFewj zI4%rgQL=n76~b#i@~|w3p_k?gV@W-t{`>?(I+v1 zyph?%h1Ykx!R`xUKery>SfeQ;;UUfsb0q7LAdV*U&P~~gAWjDHR}dG2I7Njyh+V7w z=g7m|*waCrp$u)xNV0xV{8=gk*?pC>Wh3i(?v2O=PDpquh|ApbEiU;xh^w6ZlkD>f z75IYD^vJa!u5;lHQbJR9lXD_u$n`46yVUqo6&6rQz<)v93nHC>^aAb&@gRsu0VxDL z4B}A`P7vWB9tRN&LZYTV==NrXAig$bbXT$%#QnE1l@i^*7$pcb2t5cR=yp4`AVQS0 z_v47)U+yK0o#Q7ogRp|IskLmzDl}u%pClpeM`+WGJqh9|m4P7M2k|V3=Rv%r;uOS- zAT3;R4>l*C^P9Q<4zH`XJagGxuff1t)c==N;C2JwkEHJ^j{ z!X>#LxS`icV+8mF1O&thNG-SxCY@xSM!@*zkrY&{0Kb6F%^7v<=?{W_aL5A%MRUjT zf;*v{mOnDAIm;j*qu_Rf-?n6#1mxM9K9_*p0x}E8A|OFPRsl%@n1E~)v3e{~a1WwC z#6y1AoYAS~*#+bf@M{Z}Qvh|~NmnUau(u!FuD0!j!dDc}bI`2-XaP*^~I z0R;s7D4?K#CM_7Lk$&0ezlQ$N=)u+#{I=*TBA}>%VgiZ_7}mm-zj*GewKv;GsLBaFRgDw6Ot40>q^5vcoPWPCv95r60@@4c zAb_S{emnNoXv}#i!FO?8WK+Rycw2L9#*wVeIcdSMrGQq+ za=I#=T-yj}%O&lS<K@v1x(`P`_3%#K*Fiq&rAWc1WXg$ zeP<+}&V@6$^}A#?Nd(LjFo!#R4}U)Qu#ig@2=3N4dY1ez`k%Kf6|hWj*Xqzu*>b`C zAd*?f$qJ4uIj-Wkn&TP)YdPuoHi0~^=X?XljT}k1iIdG7w@?E2rYGTc0Xs-PB1VYV zDPWg?j{-gk*iB{rrst&K4u|gHe6N6goa`5HgcI^`fRlq94{(ta zCz72ew_>LR{3+lxRaF7+1iTk;R=_#I{p)lDTB(8y0&coG!CwL{3iwCB6#-ulL|zhb zS-{_SY(e$tyRBHCl7XvKl3n%Uh5$OsufE~8TDcW1eQOuV6lu+F3%Dad z6d(z>E8t&h;RQUR_Fup~YWW2`5J0=~8@Fa%TQgdJKD{-&+Q;2QxwSQWEFdUgT_gm` z(-pDjTeF69{3YVtX|MoUZ&e9QVmz)PwlZP?g0 z?3IAc6lNRtnoH`Xj;D3+={ClfN$Fn|beDL2ptf$A_gZYyMB78d<7qznXp-@>fG?y; z0pF;N5>Zw}gosEHB}C8xYbive6p>CudJzzjN<>-_bRWG(M3jg$B4R~%jgVJFj0m3y z+9DJ!xIsbe-nm8rj`5PHTWE7EIL=MsY zh-4Cx$Vp}qSw#0-vIG%XMPw6kvJJc0hK1TNUt30dg!8m@GdD>D6EX9(yKRRsr-)o4 z3W_KsBDaV8-K-Ir;K3Gc7+}Q!r^#TUJ;^ z5fMd26ch1eN$i-Uz{v(lhc46d{eRw)TzjOzQk?w6@n?!Woeswn zvb`-UC!)NFZX&vq#z>7KnzwNO)_)aIQA9lvzlo?MqOyqUB5H`JBBH8@_b*abBjwac zy3>}uXv;4S+Y>0zj@1-VOGIrEbtqjU;(l$%a%>2+YsczRuyqm!ugkLJgJ)1XcBvh! zFQS2nRw7!9XegqQh^8W%iD)e1cM(lQB*a9J-d69)N+%sioI zI8sBJP%VC>h*2UIP;x}~!m=rrf3)cS@r@BNma_P|XPk&>BBpabUc>|u6Gcqo)+rn( zb0nYXc199T$jx#yV;y9Zl`E0t<^*>j{JT94^EWfcOauL_eN)fAgWEOK= z!f~mHWt=SMxPoKnQEr@9Q`Hke2Z9|G-5;^FA~uWI!udK8>p9uLaU;h~l<@VgPZ~ob z+$v%hmlNN{$##xA=qtcUs`N?e(kJZ}u}8#SF4@nK{O=Rp5ji3UxP*S<+yFns9OCgg z%<+hbqnsS$NUq04oJi&;MV#XNPmZTKHW`~h-p+|QFXE$vPYy1K_)A0&9X)ki6mf}a zjf!7XTo&;+C052(8UKj5B4VxaOuhe3Q_#onwh|eNcc4E(WW$QmW{-cP~o!lDXd*&`0EM3%J>ay4HM|`7}P(q{x zI)IK&LOann_T-*OS@6(mDEeeTLbQY!$=#5ZN`i+I;!&JGya&~M|Hns$3S`s86;$skV$e|{(m~e zt|=RpyECI>pDTA}bn{N*&MZMfRtec9XI)G*5-v znNgdQ*oD>I5K+Agdo3oGA$b=@_dk}GP(i{k5`HBezV$5X!seBUqRSQ^y!F(-7C4$1 zS5d;-5AKKT&j?=?32h~`lTcMcH3`)v)R53v!tWAlN~k5_HwpD6)Rs_3LR|^@G?UO= zLJJ9xy08~Kgfv}Qo~~}lttGVKA&6&Do=ci`Wt0)^C3o9h7YSWC=|Fx+T@r?LWu3UB zGw0-o3<(LlN$4e^w}kEzdT>8!*JbI+35_*<_t{6n_s7XfA@r9pK*A^qqa_TajJWP0 zGn|t_90zk8B4KE<>o87=-_1xqM{qup^uULg$4D3}VWNad62_4lkGh?fUY}g$kC!k( z!oses0`n8nj+oEcqR92-G5=Hv)2K+xNGoGHj_l|c8CE|joH!eYv`uB<`vxPQ8`PhDBwZmdQ(wv0ST zSRr90*Y<|Vu~%b!)RCsRt*ekgH?6F=6Te!*8VPG9tfRUh(ZUj}m#{&?771G=Y?QD` z!e*)hOCu|8&f24!n|&Qu$F?aSy}BFQCSkjT9TIj@B~9zU)r~#p9%#5VRd?5C{_bp# zguN0DN;pKNLc)Ft2Y6)2wJi5DeQBb%pf9&4`Y@HN?rc+zlt-v4b!WtjNij#dv)kR- z-Bj#2wFw2HPe?c^;gp0wC7hRVLBeSXXC$1Ja83dp-cC&)&HQdJ5q&?UkGghNch)*4 z@Rx*(5-v%&Om#nHG`;I`t8A&~#YFXB1$waGd$9NY;;)dBC8Uzwk-%%z_)8%DND^*H zxJhN0>Zw2a76o$MbD!gF`UFV0E8$-W_qc?d{^Nvja1Tb-?~(_}t`C!4A9D=^ISL%b zWSuPR!DI=F1XY4Y4PZfkgp7~`UBWABDkT^aObJgUJe6QklPJNF5GFn3iQe9W`3z6) z2c8wh(yw{tIo*Th=@$P?!gC2PB)p{N@sDU4SR>6BO`GtfhdYLl)%MXcn>W;4Ncbe- zvxIjN-b?r(;Ul${5pD-*WXC|QwgKu2R&YG2d%D^Bg;Y&V$NR`{)VAF68PmOcKf50k zGOLUEB4sz)DP*MN1pkA1HhMi=!%;H4GNL&rg{P4blgxdbq~^G_aDZH6W%y+TxFk-- z{jb?bNM>NK)ahiTm(f)QZU4+5BcqIJGOEkSBqOto!ZM1;m>VCJMRtdSvdc)2kyS=E z8Hp5{3`X*vta49wFIO}j^+qM9?g9Vg5rHl}Sq>RFW#p2PTgH#F`&r2&Bd?77G78A} zflKmnB&Vx)TtnplOUOe(?pjF3Xs$HEqB4rfFnY3zH$BB=l#prOIkqgRBA>4$$Dd`C z;^ZfeBtO}c5tioGG8|V=@|TlQUPc8OzsRU0qcRWYSBmHE$ci#(JtqZwq_Ur|-?%^( z8E-XzRZ@=Tz1@=$r>v|Y)0xS>W-^+S<_mgj%BUrywv0M5>dI&+qmhhyGJYc!^>TB( zY4Pa#G8#};o=hT65Sr$KAMjsh{Wz3N2098*v8U1C9kujDuCS#zCVKRox7$jq`j3F|H%6J|T zO-)3x)KLd`LQcN)3Y?6PF_HqO+>}A*V@LFM)sn6^3$5|fRZw|*v+*x{<7AANF-68y z853kolrc%hWXh@DEb~)$1fXSaR%1gv1ul;Y%W2jUII%;d41 z#gU@jzE8v)D#kMA$(S!=t&DXt7RXpAW08!-GIsIE&``#?-fW4C$GutFK5q1u%J|fq zE#pXJxr`Obd?hEVWUS_7O|raUrKt5XHptj0V-t^6t3Iq(PXE4DaWs@MU`%Y^K5Tg( z_TiSd_Tt!WGPcW@tzeFV9Wr*(=S)F51-oSImT^MHNf~=&?4`&r@Xh!&yxtK^cemyAI1ZBIBrx1AW-TKFsOE=oGt4Z41mE)RAlR-1p?? z=u@)WGru6?FByMQ&J%oV}JEy)uzPL5Irrzp+Rz5 z7$eG%WXLiUDkrNFAM|s_-f0ZE)gyO2e^z23Rez?@CqRZyO$U`v882j*GAtQkN+8vD z84g9bKcgF3Y01#I{%lu&HzrSI(88g{1L$8H*#@u@16a=iZ1Mp1l9K<(_gcmq8LudJ z1~3})zcPTm8^H1pWVExO(m?iJMw@}`3l*(A{__Lb2U6xh_L1W!j-M&aL5zf7sXoex zP-r{6-=iQ(L8O8d3Q{V7f>a8sKZ~5Q!%IWfG}cYAA~S9f^D2l|5UaqiAVz^tL23nQ z6s#J=P7GoX2eI7IabE_pPF<2}4R(_gP!OjeUcrIEY)|QIJ$J_T8q6jQc9Z#RYg~H8 z9Z>3|xX0RLP>@kUCIy)llvGekK^6rGio0VgkAkcU9qob~3UVq)RFI^ADafwi(O@>9 zNLNP0G}f*%xGS&IA$3M(k0V4WFR zK*5g+3UY7l@4G#~LJCG!i>fn(6&m86W-u>p%AyL2DJZU>#}Kw+2$Nko(hg<$hPtnK zJB0nDp!-nPM8U9}(LXCFt)Ps8vI=S_sHvcwg7OL~DX6TV0;O8PuL>$Em@<@YAIeS+ zWp{_VFZy{)M!LbG%rI6(K~)9SC>Ip07{+$K3D9j0cZM5`eCuQPj9`_2OW9dL7X@7vbW<=$!C=Mh8`Io6 zomSVKw5p(|f?f)GE9j%3uY%hn*p(r1HD71`GJ+M_lVz3==%=8+f&mH!Qjwb*`R#ek z4os z`j(7j;RXJsvC;7Z1LGA;P%ufsWQs%mgo!*Y8#iaVU%~xulDWv=)pWVLM`Ie5hp)bw z9H%Ro!3jyK_6!it;?`=k@?XI`1>Y1zsF<%{fr3j4E-P55V39&I`|e-NVg*YSY*MgU z!BPdwsLU&%%Q2Tz%xQ$MhJQ6DD-^8cWEDqp+K@Z-8Y)ON{AAX0vW`mlxmdDpP_R*P zFIGPK#*O)u)3I9=yd25=C!+T#*s9>4z5ZfX4ank-Df}kml(-$fMeInxA@2j}+V+#h#C1(WBk?*L)QtC=jXHRB&;hUs50| zP!y=t9B~g#mU&B$W&^dzhNGE~J4&OnT|ch-Xr^=j21j~u>1MCB%xfzsFf2fWMUH~7 zf{CNq69vyXdCKt_N0KL=kA0EMUs4-*K9+>96};hkc+2slf_I#}=lFpmY3W%l|EFaB znUgOHz9vg($w8!w6slX~XvQa{3OaEqkBYo1QmOE$$e<#liYOIc6)zsdbsEE>Rm6~= zF)UZP1fPo3Dgr9vRHRWsCpYz30l$hfqurB69&nw|;^AsFvc{`Ot0J9>^c2o$<{iVR zv0YHhPdj&hZXBQ!BQs?6)jOS#NyXvyS^A&LoLNN{6$vV`(g{#1va86ZB2h)jUJ*$u zGUbSBvciAeAE43T(EFI|OA>OZ$f+WiirgxOjd3%J*52%R;-O!I)nnL)G47uooyPEk zib5(1tH?)TKJ}8x&q)ClKPF2Ga*}y0E5b=hjzyDQi>WA{%u8@WM?I8M@e}7ib1bW( zbh4i^oYa2qDaT29jupqc$4C6Cq9Um-g!m9Dsi>@?goctDs;H={;+2ZmDypfdu418z zMJj5j?xvU)Dq5xBl{nyP4~;?J?J0-LMuBp~rtDq2&{s_3h_ z^K@-Ec2d!n-maoO5AzQ$?7%tgj3#d#xr9iCA5wQ#(M3hqWJwQBx~b@%EXkuJ_T;>m zir!SZl*I23687Wr5h_Ni=&xdcih(5I!eJ@~b3)#Rax#P?MSx;LLNdcueCMN7j8-vS z#S9f=RE#AhsF*@&R54z~L=`KlddZ~f9YJZIpyJqe_oOM3Od|E>4}5o>s$v@V`FNlE z7eJm#K2yakE}YMCwu(6_=28vfL4Eg0-sW*vX)Ghj0u|roi&ZR9@sEmIQNE=rmZ>ZGq++v* zEh@HBLAu~>>3Zaw3z>xioe&zA6Icg z#Yq*XX!M>WD)x_Kw6Ts}{ilk*#AtBRfVP^MCEF{t6MVr$1}R4jV?tcerG&0Rao?RS}eWhcI4=o_YudlJ{!-%DxRo# zs^S?nrxRE#E$ic_NIj>flA47H>?OVNn}-JI@=tK5KHE=l!+%5ioaFzeB0|GkO5jJ& zhzaZ+wFCV#zE|-<#YfIRsVMbJ`ma=Axb+Ja&b#hCDTH$;Fv3U;DKvMXV_FRyy!%>@P#j(hV&XTXf(=!Od9fP_(4Nv4Oui~*N{U)f`+Ub z5;Y`g$i`p&DSK49rIB=g&Y(eA8JAFivnH}C6WytkoEmaz$gLp{cUpTe3w3_T1J=5| z4l=tZvV0oyYbdOth(@PO<3|kzH5AftW+Ia(vZzTc=Ok8f5-Z+5&~}o0tU*y8RB?{Q zG)(x(&AXwK7+v2(q?CrAG#u7&M8nS-Urw)~qK49%d+b9Qj%7KP<5-?!1&+UPByV)c zKqU>8HT2TZTLTSQSJBW|!|$5g2vpTjO+$4JH8j-JP*1~e8fs~%t)VXEPWqH}cLrum zVs%LQwE}-mVzgoN*)DJ7S6_V%4Ky^=&`5)HA`5+pZ%tyC`@~T-f3zKH1yXnSwsAt*Z~>_Y8a(qG%0*C8>C^VhG7~8b1O-P z@NkHb8LnX@w~o+2h9nf9?;gfz7^`8ThDjPOPiFPHr|$mDKTgAV%3uD->p2Fs6prbXf z8cAbLCp4YH=4)7>VWEaaJpAVGJ#{j~eY}=%?zV5@6n1tBTg>It9|V?CEz2FXOv7>w zD>SUsuua2u4XZS)*04dtMh$DIo@!X9VLgAU;FG}nDJ*d+qb8;NR5#kar?O2NHd7ol zY^A79W&aiN(K%YwIPaLsXif5osVt^j+zt&pHSE){U&Ag9yEW|5uvf!P9>|EsZY|C< zjnTb+b*8y15DsWKsNoRh#fTK`rnx_@&1R*IypfgaSI>kf>SED4;iDRkX*jOo1aDRT z({NJ5DQZ$QT%-8k@%>3HNj~2tY7MB;X*jFl990Aj7d3oY6?dKzHI30Fvoz~*L38hf zojHvi{FroM8q=n+b6PAlN|$-l^f$+UI9}24erFOnU8itvxtBoEp+h$)moIy7YPhB0 zHs@r$%gG%LAEz<0{+le%HJu&1=H9%^``;T;95;jxCG23v!pLC_#-&@_ao zPHB)eC>m5M0~1->>F%cWG1HlF!Ml4pdoi8m%@M6@Ff^DNEK=GGR(b{-FoVsU!4Az} z^hfq=27A~$DXig%hL;*%X?UvPnTF?7Uo;e*$x8Qkf3IrHbn|rJOg3kxd+y3>p6PF> z+2^F$Vgs2ccQL)qz5kh1LU#QY)_(oMpPZ65QVrH=- zv)pSUYt3RGWBn;YNEre`NEJeK-mLDeoudLfo5s`BL+e>=2i(O@UUCW{O$f0e%-@Tc z5PTt|4!K{4J;UPYAU;~lM*$Xj8{-er#_fpb!&3x87(0u_9n83Dci`-8PudXDg|IV( zT_L0oAwvjtL#P)*#t<@vP@V^sIpprhOA3K;k|l%$PO@^$#*sWEa#EZ2e{qsGgdaG` z5kk&nKeBD&5DJA*ID{fR8d?0&(^h1n z`#$5WIoizH8`@Nv+y#JfUDun3JF#H-q#Sonz>!F)mDp7t-^H&X_S_qZ- zgH=M9UON8eEJj#8L}zt+YH}n}gOfuE5yWe8UOR+3$*vcl`Doniw-7pp&?)4u+^!!& zgAf{q&?tn)A++Mc-#L_qrB9@_YAo`jXojt<)l{# zy*VLay;4d2Lg*jDkPwE3Fd&41Aq)y(a0t?DR^g#1Fo*pxhwa)G_;n5&dedLGYSOR} zhI0ju2;oxZxUO?pXt$TH5}q=LiCN<4OE;Rzo9x@N(L06;X9(j$7$3sq5T=AMA%r|D zFfoKlJcK&Y5$EQ(Rqv_nwuDndm=;2_xokRBlew;(&2?KvlJuF&W`!_2gry-Yew5? zz7XD!8n1iyhj1VSAwkLg;Z~9y<>Xih$2o~B9Y?}b zoSzNhTnK+A`#c@O8O~47bx&|TpDe$~$%PR9N|sbf6-^#4kxG9K5cwyBDgBUYz59UP2`D>9E&oyRh)j_){+y*ubXQZs7!Jh!sM>+Y8#9mljfcKqlL z7^dge3>?Y2Xf^DOSu^YSK}S9vS#%`OOLb(^kzGd)9f>-UbTA#&*14T+x|_S&1Gi(p zh`%DIj$AtO=*Y_h+&hoaLet!ou9qN;xZs7fg%4Qz>}@zv0+gy)L`HFea!jaq~{I>q_|^#b|l#U0xmOXH2c z1+1Qq-*hzA@w<-tIvVI`L>ZS3ITo;nI*!C;{ItSbW&vxkfQ?_kXzgng9ZhvK)6rbV zvIUH0QfLj>*|)w63z)QkeOSPneahTYM=Kqzb+jS1=;)}Ut&Vm&+Uw{*k_)lr*9H!k zOYkma)mO#-;g8C;ko~rhb<)vUM;9Gkbqrp}NQck)Niqu-x*F^ECUM_FHmz9np~R@{ z)3VaBnZ0!M*0IgTb{ltz(srv6N+$i8|)!7_Vc3 zj;T7P>6oZvl1|+uOyR|VjtHxhCMt3fOS_1+!ZBJ8Ouv59bh`7s1lf~W1f!1I+o~|uVaCZg*q1LsIrK)Uc^csie0BX$yx!BcINvVP?VQX}dbuGtr z9LXBHgl*8Vk$c$0aSO-Il+jBVJvD>lb}H&RPV4Ue(49JVadKS8Zcg@d+{1A%$9)`! zzHql~9-wNjhIl80kU+zq7HInr*^6I^~W+4U4Be{$58urr*T)p3rK z^E&?GghIH$NlCsR_M(oom)zK1*73KFe{@`-md8LE16OtTKkw!PxK0scQK^=? zqeD+p`)=vDt>c-F=Q{4_xT{0fq3HNm$A45pbUfB^Pse>KBsw1ID87`{-S4fpl=WE3 zW-evt$t?5UU&?|y1RbIdi7M1GMvD*WWTD*4Smm^F4VJOK%UDE27FCC)!_r~v2e3HWwXM(XU%SjOyr37eO>S?}lw>v%#%h(5T>+59p|`Ij>~R3B~?eL4HDea6Mh8QqFPi-`6wce_S( z@$n}epLKlE@s*e4^UK-eK0DGk6tD#PvGXA#qP z<{oIP!u%EN&uA}JK{e5vWPlm)8wePP zGZ1eelYz_z(i%u-AcKL722LzVq>-`oUfC5wRs16d7Z zGe9jBEgCPEJBGf4J&W(w%&gfBGuWdr36R50+1fnN=*UCFMm zWGPm$JgZp6Rm}arxa+A%=`G_96;?4&)j%}^)hVT`Sg%!V{VFz7@n2iz=2r~^`YLzg zl6Y+cbqv%u(17PiT?6$D{6=|{H;R6-V~6@5t1+I{jP{;1G|0Hb$+iuZVhXaAwWwbCK#A#V5)&> z28yim_Q((==kQN5FxkKq!`)l-`lg?-ei2`l`<~ou*mMK6NBP^F_Rb)+oc10yMF!>?m`7E~zygZQ8n$c=qlM7I8dhD1`)hj2sI{!>TDI6g#VwJa3Z-0P;M`re zc#rzS{fI0#u)@G*D%JNqD-EnNu+hLK1FH?UcS=8-Xym`sJARD;!nGXN8CY*%1Luv` zGLm;&>vpQCn?wsj=nF+bZQ%iKCG8p5ZeRzu?&e6YI}PmOoLUdE?%{lIvMUJ>7&vI) zgMp6*4jJxY^4BOkUV9H4IAY+afnx?P82HO@M|hU5WwgNKIBBC_(g_164V*IYr-9Q3 zt;NE=-tlJ)oTW$BvU8NuwXEiIcc?b{s!v+$7RZCe{TDXGU!*EiA<*{6Og_v;HH6F2HqKXPr38lciX^2 z%9O;YI|lAjkXU*h`(qs|_HRZy+UNo0`?=T=>)0a$kEwJS z5DYj5!UjYGl7SG_L<6z`#eix+GeC!;kFFP8eOv7Eb?o*!_I@2px1QDSH!zyMIk-35sHc$|HZa;pu)J^-Ej!6=B9Do@CjQCx zf49caE;%}yHGSix{3Z&R_}N5h6F-_LXrh>j;wB22C~TsLiJ~TsZeTArF#kqIyBce4 zbSEs@T0YuSP{Kq>6QxZ2#1*^83)GHkzmZMaNZ*v0bsOC~Dax2AYoelwN+!ygC~u;I ziC;|I-RQ2jaW*pFCRTV8tGUT7>c8@E#&2SkO;j;al@et_>fv9ri5=h`W~EHLC&gag z#Hud{)HL0HG}_-++e9t?Al-3Efz&Zk*F-%NznQ3SqJas|drwd1{$&05ERMS6FZN_< zXhP=!DyJfUH_?P5W}$+GrY4%1xNhQxiRLC+n3!*3fr*wTT2Zu@d#9LaZK92do+f&k zXlvrjCU;8xk26`@nP_j)(mwoQqO*xECOVqvM9N7M@!h1m9!Z3-tBGzVdYEnXX5%h+Q*U+^ zm}fI9vzhhW%xD3|P%5Y`qlR(ZygeiF5&T^vO^h-z+Qb+W6HH7rG1kO56XUt-^v&$d zW>$Ap?EbI5e>c0g^iDDnzZ#QG{QX}p9A|Qz z#c{TYIh@SpIFBP;%|MSVG_i@l&|#12;vkvmQ7qAIq9mDs}SZE^Lv+eFRfNjzk7 z;}wqNGq?`lpS{KaWxA8>w@uukYG~qL6aSfbV&bWZdnWFi zP)w*M9+-G&B4|P|@raj=ncMN0ldoG?=B=#KR#!zL)ld_%i4&6h*~)g?oz(u7&wFYn zLfpSi)y;%q!Zcw~@#7DYw=EysNB-Q(f?L`9NS|XOY`RmftIM%8+uXpPnRssElZnq% z9ZbA5@z%sU6R#+qm+{)f8#iQ6xowPQbDD2sBe%Je4)6I(KbZJP#fFDNLH&Hv9lAfb zjeVhJ-$Y6au<*@9goQ{8DJ`TS#N!2MhTu#9CBbk0sNji?{E!^Mk&ca0PaFI+V3klqbcxFzraJ;_7pY?yN2mli70D=gfijIdDILKO>V zES$Aa)j~B3<1I|E=xk)vu+Y&$Ckr(#)S?#KLNg1sE!45lz(PX{buHAh@SBDD7P{*K1^Y#M*;*%aXNru4fffc?=xU*xh29qWSm!U=x3q7g#i}+$`?hO+9r&Ri(2ab_{@xnyF1uFzB>k67-C_Bg^?D9 zS{P>0uuSA|3txA#EW6n9OwmPlu?qRK4T|!QvM`$TZ(*E;MycZ7?DVHd>l?$%_P{T` zTDw@MU2MuOw(>*fi54bV*kEC!g~=ACSXg9Xv4yD?rdgP6VUC6A^dbv0EzF`kdgoiY zi|yUzR-Y?U(zL(4f9+yb-}>iTm}gw+Ewu2|$y{W&`_vK( zOD(Llu*$*?J93$Y@VR#)&n|;Uwjl$7S@yVjmt1Yatu+GAI3)?qlthbvje;K)! z()GdLVK*DLo6XsuSYc6^%Y&;iQFA7XBnX>|r!AmSLMa3wCi2J542gFN-aeP2R)a?P2FEcb4G_ z$MYO7aQw@{MNTep{F~!tj=it?{`u~7-7_Jxd(P5T3)hk**Dc&g<~J#jwC?ou9Se7< zER|=Lg?}ylXF>TXTBXXUdMY)KqH&&k)FN4UVBw)fgNG0;NIZ3qEd(tHycX;(oj_lf zUr)r+G<}a@u`>5SV+e``S|>oMYr2;m8|~MquHE;CIO-e?jwVO)My@usjk3?-7`E_) zlcyG*b3#tfsH9DeEjKlmkgTsPyr$;DMr9jsEO*yi`5V3n+a+%;yyKGh7Cu<`$T`Ws zSooC8KT{db5#N>-X(NS=lr~_4*~o4ql?{)Lv^LV&h_d0ek;X=>jc6M& zHheZx+n{sc8$OMt4a;YD$<%l9+X&c*vk`A&?q0W4Y~9OF?PZrY#ope_ z7FCa<;m!0mGT2D4k<~^<8<}imwvoklzcuxn1!ykyh?V4|jsCiqW!cA0^>%-av)M?b z#M-!D)zvc@+C4!lE>d*x=dh8}Mll=3ZRE0%+s2PJ3fjnHBd?A8HVW9Nx{o#4$9}Mp z&&IfYtj7{}po4A)NL4BQ;0^Js_p!VCSRosQZ4|Lll*i=xKIYr+#=m>_tk-Kt=iKk6 zw1kb4Hp<#4XQPyjpKO%2QHEaq%#Bjj{p@EOJ#Hk@uQxS@P59%Uld}S8&(55A1ev!0xKg&|ut>dSHZWrS4epZE|N=h#1ZDOOEjq0|0CU$)rHEg#lPW{8W z^z43ClVdH8wQbblWY_g*a;j%j%j|u-pZ#WoFkg*?1{7diR72YxJs{J_M&o4uyN$C| z+&Q(THk#RJZleX|nvHojTH0u3W1x*eHd@m)ej9yBOE!Ai=w+ifz4rhcaDY8= z0^SXAl*~^ry);~3JAKxEJdpmRG#iT!u$Si(wmywJcz}ftu+InBU>iehOr&Vo7;0mf zjnOv7*cfhOgpH9lM%n0}Ds}pU?qZd^cVhqS=KpO};Qi~^f(O}HDh4*j+n7KFwO(|A zm+o$_?)$uz53-I2*|LM|_L;cJHm2B^X=9d+sWztBm~LZ+jWY)sElv69od5AbcjrER z9O+sAA@*Bm%(gLy$9cV)F0+!5VQ_5GLu|f{1vXaOSYu-$C4`i3V=4Ex*v9);k-2xE z@gertyTCFV%WbT%v6568A3d{b(%3`n*r6=D4zX3XyINpY+rXnkY*dH%wKmq-*lc5q zjrBG**w{!##dgnCjycS742&N=JK7(bojYBpL+c;_C6vf~2 zRX)s)P`>B#(~7mDHjdfu(zW9piJY*}^e`jxr|mYm14||xJIqc~gb%Yb9MAGspW{eE zQYNXCF2%TLw&u;}(~Y(6b(&`I!}WZTw56`jh9rjsK{93wrNy>ws&nkiG)nN$zctk8C`) z-JUrugbvyuC*6i&L*QKGNJ5G7h0?{XDo4$R{VX#%g}9aG`iYx1EYcMsOVWXOrk>h7_GFS+#(6MG~=MSgP)1y_LtyT%0bCsNu$83$##wH)_PLW*tEqi)%z(VJf!^tu$N>Y&e2_AAGV4k|gQ?7+O6m4sxf zIGDvrH6BiNjx`+A4#gH8_GQ>GL|wzTNrfDR9-vpdTlJbE<1o9P(q?4XN-t`549l8-UksQdL{ z5)D*VI>u&dF)fd=D&yjNIOs{*aM0U9e+L6d8xHz9=*Poxvsg?Re2mT6=$(IzO)bC% za`|8fLmUjERKN2aIp%8hD#sS5-5%y}2ecGzyn_i2MmThtre~ysQ4W-2Y_x-MTr$SN zSS}$~GUU{{eFT|_RItBzHcp5ywbMJv!DI(h987iacN+h62h%wD&e=;35i*_mmF_bs zzZ}eV=u|QHXgI<-4(9UM&Pz_qdF8S> zY@@c_!CnX39qgb2aL==g7!|%CdHy09Fnv{ufAGaRhxS!*|dl3hd{Ty-- zdpe4|9d&Tb!3_sD9UOOXf=BFc2PYkz;{2k6KOLNQaDiLTI5ISLc)Kz^@@Y54z6+D>ISZJ5hwMqM)t5FJB(ss6b~a$7n>Cy-QE9)kz7vPp}s!*kdhb+|WSuNme3^l3|nyqih(Z z!uTnSpTj5}#+>@mduL~i$P?FnVqEr# zZ&@GR%R`U9`s`^w0Zqba8b-4)o|4lkR^gO86PGfhTl-ps(UNC(E7Efq?Zarzt!+5A zG*D$&z3rRwzJGYXDo?-L~qc^24j1eRZ zqc0Vh9(LamCQxw(5;I@xX+;+hjF9_hlerb6eB`s z7tpfdQBLtOblaE7?Z=8!o%Nwik&*e=#zc; zS)hiV^zSKlrEK){FlK}?GyMP9`tIneitg=%JR~={aPLhZgb+yP2m;cpC?bl0fKn8( zpn$*&h*-b^C?HrsKo9{%1OX}1lp?)J@4ffl+daLX6X4rt^5$K?KfbkQ?e)x_J$=tU zWg32@o;{tMx+!R`8l29b8*G1WyNQjDV?rF0;`lX=iE)(rJK^Uze&J~j+{7l4fF65Z z2}Z=^IDU&`3UyN)|7>DIzRzhsBX|EMMt>MCZ(>)8OMw`{)l5{ z9JAus8ON?TX2&rnj@5CxLK=U@F_+qEVfsID%!^}w97||uY-S7MSQy8mI2P0JEL!BR zIR55^AxRoyPizjVuzCnq4Z*(Dl<=hlqDv`F&RG`6@;Gv4C#;BLWgM$`M3N*&u_y%s zYvWiKNA?q`Dfke;!x%bH| zObrzq5st?p()g;Jy78HmB_~6pcy}mq(D%L>hstZAajJ7l*%>rgz78%Swc@bjaN=;| zcu0054lfQrj{G{|d%`B69i8G~E`cyF*+rqL6Ii)$MwT0zykSpS? zqGij9C@13S-(wVo9Hl^%_=1SXL{#CDN4~GWSw~{n|z=+=*4<-v4Z2 zln!|*1y;FSRS{c{B$Ag>t0AJMh-XDK7Ewz?ZOV~HA;~%->WQdNHPxbZMGV*y6yQl7 z+Caop98kWL;4fPk6))5_N&*c^JEvz z%-hRBa}h6!Xd$Adi2sP_L6r8Pi+D-I%OV-};J}L3BHB)q=zP%cJ zZJko0`zh|K99kyym58AtzUG;V+t@H_naQ!r+u7|uLyI=&&{EhY+u64wz7sKA#0U|; ziI$(&NLDQF7k6P{YgEYm;o&vrIl#0(LCh?ps2hlrgb zW{H?BVvUHkBIbzrQ^Yb6%SFr;F;B#N5er0|+|F8dkL_bAnLAju9YOakq&L0nobS8G z{t`j-ZxM?)Sj_1XPKm#igMT;;EeNd;u~Nh;5vxVC-@%6MU|kkQ{@B4*?qK_OuGOzSzfir6ONK~HQK zF?J`TV|7>j92;;ici~P(Kf8J*hA;1A+t#J`$xq%RVlUY%i5tvaY@dj`BJPRUFXDiR zgCY)zI4k0uh{Ga|h&VwN7lW6mqau!pI4*+J;I;n*it$S2Oq!vt&?M8ilXyzRX;Nbv zJ5^)!D31?|tUi#}q*bi$E_PnT1rgUp+z@e5#3d0|MO+indKaV3-IrukZV0dqrq8 zc#nnRoQj-EoXTV>Irwo`a8kNXd2#Op5he#NrxvFqU~}Mbx|m1tIQBWs=QQQF2uVKV z_>qVNDabmJQvyeJu_OtQP*g&)glq|AB&0~e?)VZCN=gVxNR^N#AuOS|gos3UCE*hNE}KwM?zT%wItM* zP)RLJeMp zsyuEr3DtQy|5wNYK+$V*KBZ7cLR|?BBs|3<)+Km39XylRQOyny2}Ughm`R z{68%~Vg*HdPQvpN?n$^Wp^1bSBn*-8m4v2Jusi#G3ADhknS|yNUX;*6LY?369|U3kKVUmm+*#!C1sM{l+bs4blm4Lnhw6vG+d=ru#oI+3GYbgETM~pFV>*L zZq|vnA)Vt*ONri<&{aY=3Eeq!z-~5`x4`1v?DTHd>!axH-RwlmoE{SBEYqG6dU5a` zr^M;aL2M7}BjE!HA4>R0!XOEQC45YUp)TITN@Yj;NoZCj<*yUT10{SS;Zq3<&qY6z z(4X@Of6h51Lv8>y*Mew){1+0wlt2;5_|kT(p0d7JZF45u3FqxESac36msDkuX&X*7^S` zVX}nZsOxKHkX78ZhtbomZl@s4-z7}rEj*o5RwQ^Od+u=L+8&mZH9$I&;6MxWcuXs7u?Y8eTCOISqxdn0Fb)8J*V zZBlNX-*RvNC$Gm|_QILaQVIW1%Sc!$VVQ*GJog7vFm*3mvX|}N%ih0|vr58h32P+$ z`z^Ac&KuP(_ROB31+MI6iTl_(3F{?npil{0By5$ik=ndxjP_HPS0alJrEik3nX3OV zyXrnxuX@h;ei_@S_xA-SNNgwmzF><$@_oj22LAmf}0Uc&e6DyfA=+}KI8Cfz)%gB~dLB``U`V5Jdk?9J~v^*JP zxN>Ba<$!QG4svDC)0Vs>!(<3t_%Tk)b4nN0Q4qaC(BwWLPixCHD%P2 zQB_7Y8P#RfkWoIGUhSXAnq^s{6Q=up>g{L4N(D=&YRjl2)7&oV$q1JV)5|0=U*8|- z=dts_uk11VSpykQ$*8EHl7gpYG?Z~%#t9kE$Y>;EDpg#@voadX=r0GeNc6+xIT`{cQh!c5^>#CF9Y4 zR`LLQb!MzJ2^==qO`JE%sQwvdb#4p$FL8GM3iJsqlM-CWMD12T#w=GP=m|GgMDQ?$d-EX82U37qz?iW3LfIT?Cddlb}qaSs5y(qc&IQW3m-ZI`V{g-$EJM2uuQ>$oQ0VKI8QB!q8(269>o`DB}wmU&{Dd#xF7kQF9%N zj*{uN^yI-ZhRFCz#!wmG%J@#kFqt+DC4MdA8|sA($!!j@(aWPB9c0VrM!!4AhRYZs z<9it+WxOylhnDNSbRjbJAZwYHvG(ccvV)9X4oA!QLB<#vW2rS{OqB7XjBzr4k}+P! ziidghgRYpGobg5ap|3N}O^qEs$U0?Y(Aw`$hs4^v6qxaj9Wo}#!HJr5!OgES_AR0V z@d8TjHx8yyfqO*BOSf-NlQBoepE9P)!7Tv6MF3Paj%OBfW^piE#?_O7%v>4sWUQ32 ziegPjnNR&oeai6yP8V|e7pH&ASR`Yy4D}%E-9Dwxsj?J>CPx3ECgnR#k`A$DWEl>z z<(#hIlxneB#u^!0Wo)DFIG(&##zqd-aY~%^GB$AhZz1QqD|wqZ-puJ1PNlO6B)nb5 z4jG4K9FbAtXk;gK69>Cw?52{G4)2k%ml{V#<{?Jj{hayPrI2kVzCJKQoP)eW56K`m z?VVs((G?*~4_Tr|skM1%^*IT|KPlrBjS(fd_T@BW9IWyEEik#UyBg&sb~=@m}T zlRe~s_!l|2#OY-kyoVSuugbW_IoCP8E#n3UH#xn<>04a#4##&ny~pWb&KG4!GGYqS z705Ca>I)efZ=9bFG1|#U){=HH=%niJ=L|j)He{GGEb4UX3k6W%$Z%ymB(p%4UxrU+ zkPN(#HT{j#F}+RMUWeJD!|cFeR-8;<6+{$7sR}76i-o-S zVOIA@kXpMVEJF$A*2!gZP(ndT4*K#r_fi~ZDJZQVyHK*Mf-;3Thl4&xf)vUrXnG-m z0L@6|DZ$z&ra<7}F-~crS9v8^PF6v|;~WfF6?iKvc!F93S$Cq1sir3aKwdi3h<24WT^V|T zs-~csg60a^D|k)8iwasOXsw`)f~1xSEfu_^;AI8JcZXUjm~@0~JsP}ptvbSt?U55l zSX%|{6uhF~RR!h|R_rLNca)`Fi&jmFjlQ4!;ZZi_DC?l$bp>xLct^n-3f@%kmV%B7 z)=dxXILgi*4Z7?dA=-9iUg9ytn1!#bEA$HvC2|q+S0jQkvgx z*-b%rY6Jy66bx4|LP1Xj*Gs0-)N_9Yy%fBsptpke6@09quYx`bKA;9y@DX)N$<$8A z*u0y`{g1JftFhmXvB}Z0!?R=k6nvuKQw5(XSaysZ`6RvP+;Zu?V`J`TS8N;oT*3BZ z?4^H$>JLybkaSqVmkNd{_*%gr1%nj~QSg<5)5n4u-9N@;FKF$d)Mdv5PU>;Sjb}S6YD;nGeg0j3g#;KgOp)TXr_W$3T9KMw@sbHDS{3RWpttzd(Ke-*4zu$J^k!Fp2N6O1P72cHVP zeqY5r5xUAq9 z4H*Sz6r5FXLcvJ|r${lVj;Gjrr|8co+kT2&oLz?ElG9JIa|+H=&nmb`2Jkd1)gmgK zW~8W1P6vOb-agF+o@Q4RTvc#W!7T;XXvB?AysqE|agK(To@N!cW-q>!MyKl0!ZS+q zwt_nf?owk~$uw6^i5xr~9OmYpW?jw%WsZ~5o?#;C8`*yaiUNbWOo2*vI5SC8pi`TV zj@?fQULIbwf^!BMeVJ}4uzCAfTH@bEijpcaRa%goRzd~skGpn;op?6o0I&GNGwj*9 zk^U)VN~_3LQAR}$#XZXgpJlVp1}(FmQ`&oV?<_mBKANk7XayB{957CaBdB<+5SLf6 z_Cg{tALpEkh5Sk?Di>lBsGUUsBOjMKg|Da@t(Qi_}~yN}po|X+C+5_2Iac3JRTmj&0`NmsRNJSZhv6vYm=o zRLCk672hogy{h6Z6&*Ql&*^KNcHs1N6>q3`ljE_M6Ub4Nw^h8OVwj4rNj+3_R`HRF zk5zP0@ve%VDtb{O8&z2`f-&4_B z#Rn=rR57hl1|7NlzKWd_Vtpvt^3hu7gTv}+D{kBKL3j5#&-$w9r{YT$gH(J%9igJX ziUBHW)XDga_sIH;lvn3RKUYDC6WF*uGLSU6MryI@>`}2-#TpuJDt4*Ztzw;u4od_1moBjN)Nv`%4V?a~Vj~Be zINi?aW))jF*vcshZzEgrLJEN$oU`-)@F~r~7ub{hj--7m_N%z71ylbANL5}<4@biE zq^6Y;^rm-M#Ss-(Ra~PXsp6Q5(=_T;99MBd#Yq*XRLr`-)?Q%OF0dbSS>=n2Zg6OP zk+r+X&Z;=4;-ZR6D&oac&a1ee*qMw59pD5yvB{3XQZ*Lwyap3WJQQhA(qrs+fBz*kPTa!BSzXbYmcG z3yOr7Mm^wbxF{WsG*34Bn^*R<YjlZWkOIA=b-f(?)24+AdR~}zAVxGq zHN-TeYji6g`(R(>R*@(zt{(Y(>gdeU`_Dw_0!=zap@bHkrBIU7Obw+tDBCk^=FSGfVS(D1ChuWu?lG7?^ zcw9q84V5%(z09897dgXATd!@ZcbRofPc3zYRnbsYLro2}w7|kw(@yrG{1-vP%cA+%0%f39y@)RXvoZtu?gK&|br98ro7JHN2wX zRgJD0Vu@E-=2cepD*Mk>Mt74@+;Lag!3T*QDDhc%UBjRn!EvVK7F=a-Y3QioJq^7z zyshCK4P7;K)6hvnXANC6ysKfyRkoYXB&nCDUZu|pR`(iv{~ELMv%6E-H1yQaOG6J0 zKVM4!^BTK1Bx}sIAXD0UKy-ODyouyB^wH2y!zUU((D0##k2UnAex!Exl0(UFJdw_P&z)1`7|n&QhjD$6se(PV!JBq7en1-)4e8U@a({*|u3?0R z?=_4hDnw~l$oL*H++e~D*5n3z;|3eLtlSS8#%P$JVWNhy8h+F;PQy>6PQM3af@yHBmHQzln-j;tkJNR5;U>M#5xV@ zNda{HqGN-Ge>G@ixHN1e+9Z5J!$}RBG;G#DM_6p3-bo1^)UY%&b*qML8n%=EC?TaP zc4*j1T2ZU)E)Bai?9p&3KQcI$)39N9{=>Ar8un2~uZ*&#(ft|@km}|K|2N2GJQq8} zlReBSrGG@jQI3xla*lIQc|x&Mq}WRMK8^ivb5CnHqv5QEa~eHaa8JW|4Hq=rqG5YF z`63lS!*!0yds)L(j<0Z9=6E1;tuVCgaoi}xH_4P8M_wg%n{)2`ANc}436qO+zE~Jb z;y~7*6mnEjgJwyTi=n}!ajK)Y4vRGTVsaB5FX*r}I2v3s{$! zp#iVlfl;k9SJ(Jrft28jquL6yOj@oh(0df?jG?hn39UXObl+lr+qoR&VI?C!Or$f;3n2uZ>zivRD4yJ=P z1(d(dw!9pSxO%sl_)&U!9TjvuuH)c>gm$;tSGVbWm7rdWZnML;S!Eqh=%}uvhK?#a z*8YyFI;!b(Cr^PDb@4n65*1sW~>~R_l%B4IvVSEPN!8Ok!Pu8?y^dE z87*aLTqU*XUG}^VabeD4HLv5{Am64sn(25|M|)}?9WPQB9}G@dYM}=cg)dV&Q$sCz zcC9#lsQ~l;nNOcgZB3;*nc7B2TOI8FB8AZ5@O=aQZr@Z*cl1 zr*CnZ9L{=2M<>dHdpqms!a+A3?{YvXkYv|F{KH+=onwkfLF9Vq=vf%rOGiN{Egqwd z3GeH{2Dd&sKG5-@j*oO&w}T-%c03n-ZAA2A9es85eS_r9WLR3gK5 z4CN^d)A6;AZ}ecc{X5Rtcb9#ugD7!`Qjd(#@jYpRj!`G(;LrfXF+s;f9Y-ew)@i`B4DT+J+NIM>?j+J=9f|?f zz+@f2=~!=IgMleD+-Nu(Xlmeh9n*BgNlA1}*D*uKUP@fYA3A30!3L{!I%esZt>Z5p zf9t`WFXPsR=IHp7S7)w{dDPB}gV9=W-PL>@3pi&XrxaB4TIwP)6grmcSV05r9$P{k z(IU2t#+QzNbR?Y(*T2Vl_l&;PD@Ipb5#8U0t<Ifvv& z-wRrAJry9zHt6_Q$3`8SbZn&yG>U&nbJ7swXTsMm2w$6+1E zb)3+#=3a=d>pDV>Po`-~Y9!##C(UHvC^(m`&+?!ytWCmac-Q+|Ah7ME5Loz-Ga>-dbTpb?Sf1NfG23MOAvsauE^+`!+AaF_ICoRh( z=6lQX_H*!v^An69oqcik%c8s@Mvz4kr{I*lew-y6NHGvHkZK@mAZ8%VK-fTWgVz29 zccK+Dg1R>mgHETei5RptkBt-Azal#*vUCHqHmvd4a2<)Yl2}OtnFjq!Vb2;UWgyE4 zz6EL+C~Y9yKt&@kr)3P}7+?kj17!`AGmvW_&!A-|>}x5=g|1qwa4vWWTp+QTi_#x6 zP~JcV1CJYYsBg|aiCOVjDLJ^8?e8<8w`BH}%qkhEY~Tq4bPZe;162*05o6nBR*mO4 zG$ma-8Lm!MTbxIZTBD|cS_WzxsAHgkfu{`ArD7YXPc3H9d=OJ*)Zu^J;et%6wE|bQK)|>g&b^o-^>g0m6OHhMRCOVO8Ft znbBqjnj84kz-IBl7W|rX`rKl)&|-bXm8*(18oho zGw_OmR}Ik1-t>xj^r`;C(BQDC#&uIisjS6!866C~Zr}|AZyNNm&-SS7lFIu39y3&y zu{>5MDK$f5ZyR{Wz`NAo2KxS$(8)k&16_>ZXLv;|*zr0nnnIK|bax{ipawM1gJ?7* zuX#?jDp5Mghi;TEVx9Wdz3RJx+Ub`aY+9IQ@Xr4>={Vk2v_4^5vjkA^#Ht zot7n%z~=`2SI1N`kECV>1{xS;V6=fR418(e8w1}O7-V3ufv>0$4Ep9`KW!>|b56z( z10&j{Z+D=*I`eCar7=1I@jC;Mvx)v-V2ptY1|}L9Yv4x%;|%;{(93Pm(UVGM-O?C+^;DUhTl-LGyaCZk zApXw=elak~z^?`l?n!s2$9_ftsQ-2f7p#Qhy-%9UuA-0y9{Xen8M*2Dfv}PvTU^EFr zQ_25Q_Z?5(NXZ)5Y+#Fl!v>D<@@zG*!@y3Cw;9;Z0TsK2!FF-HuaL8wgFT$?%)liBmq}rohmIRKO~#7j6VzWEoHFQw_{0H5@GIji z=Um|Q9H-|wUByE$a!g{hh~D#5;>jrL6UmJ|(^5}Nmn>5C!hUj#H zThyfaVOontboZ&ey9UOW$cY=cM;e*dmiH zITkr=vSKERn~0c*a+xxEHXSu{n^Ln_%*3;!Vl6CI(F%%D!bC|E%!FVf(?lr~IVQ@Q z$TCsdM7D`CCc0SkI*~fe3YMc^v{;hOI)0u(W~ZEqc@2_sP2`!VVKcfIxBD}xzgG&T zv)kD0F%#uYR5tO1i3%njH&M|P34oX4pX)*6{;ss+g#1qMC{7CJx!` zhRrOSHLZ|Rze=cvDRIsNIvelJ0S+T?QxnZhbTxy+otm3?(L@UqElv8g4AE2( zeW?EGuvR8sGV!{JH%z>229M6RCfb>3%`th~aPZQUL~^fC^eKt2nRt~m+jB~Wj>O1y z;NH;>%e=`!Cr;lo(b2@)9FxpDCd_+b0+ia0jgiiU{4OTm}(q|gEmfyE}41Y-e*Z7enMkBP+=mRMM3V!4TO7ILlNLum!s88g_Fw9>>X6RS%(!ITJLcvev|26Z_~dkcsssHjue6vDL&j6B|uzGO^jj78BPUmf*6H<)aK<-nXdu%U^nMcuOdKPEo&Hj-4@a zn#z`)^6AhFqO=UPbTOPaalu5~gh+jD;*yEmWGYQuHgSdOOFC)ds)=hR&NpM}yQ3eS z%)M?x9u>V|f-s#1PnfdK^jMeav6dctr+E0TiF>?k_sQ6{N}>B)XftM$`{|FGr%a!m zAyIS_nhBlSyaW^zDy82eL4H1(Q!Y#^9&i5`F=$AVzeRP_$KmAJTURlgt9M8-S>&d=ubitEg%ntACWey;RFkb7K&I%vJkZpvj7W4 zEu>mVvyf~dg}fgpgsi~+Pxb;6y4qv&R%GTUM#C10StxEHV&SV{#fFzj+2^s_>tlDh zSehT4qnK_X!$OvY(iTcsC}|5lp0!ZP zLS+keEY!8|goP>;T}iHKp(+Q}Iqmuas#!SRDoR1*YH%i9s7kn&h1%Rpc-tp|Ks^gj zT4-RQej&d={wb;#=R94=|2UtK{4?CU*NHT?@SKHag`v-L(9}W`4qhna|H@;Lw|ODw z#s4GF%EBuaUbXO&g_kX~=0R;aZBr=k%}Jzu+gZ51Isol0yk_Ao3mv&Y2Mcd-@cRFe zf0N@L^@9SxZQ&gYoh^DC_qTP7=cPAyW(8I#yqsjd^ zhd@sYy)3-PnY}IavG9R~_qn&>&ruTikYfS`-jBHVV@~^WO2VJ;)IQ~uI=W;mp}&Oz z7HI68Y{3Rv_`<>*3x8Vp(h83K|JuSg7S`vpK^6vE7()8V6?hn@#2?B-NtgcQH^hBw z;X4bXER41=+`@^YVR9olc(^L@dkZ5Aap%(s6!e3IF;q4SzgZY-;YSM-E&Oa@oQ0n( zjJGg>boj+UZ|TbQeUx2~=-qrqzbiuzSc&J7ez7pg!mp&d4+4EA*Tv1=I3m*Y0h?lB zs)au+%(U>kg=rS1TbN^0;S!n-|k)y&aweSyhnT_5ymRYo91v@P4 zi?8lX0w|xtiyF(l~>z%(&SkM#toyw&?c-&XML&vm8i2YvGub z`NKmtuUC`~HXIiT_Sll!{E%I;aM{9L3->Hsv2fMG4GT9dT%+<_NI1R#*D3CuDQ3RdQK3*}|mC~c!G56$MZjEx){N`g=|QD~khjC?bXPI&H;D6HR&R)>*i zgW0HRqnZuD#$z@r+Nea#`$fvzs9@u98-qsYeVHiGR@||PLB*GGTG_@EHmcazohXp$ zph2|gTKHn3kX0?Ux=o)IsBNQ;jhZ%A>@QL+o>hk+)@6G;2}p!{VrGqn?fW zHX=oY>3d?W>j%&Gszrhfv(eDTGd3F8c-E#XlakLpmDjw8(7A|kx@ry` zfAJNUf8ItD8!y;sYU7V0f?p@Rt%xx5R8bJ~Ve5+m1+I+qI&rjxgcwzu&b=XBt7#l`=g{{1HRcCzsn2OT*j z`L}Jn!}059vdG)nMi(3J+UUxeJ#2L2+5N{xhhq^E=+61H&F9dPfYXzEdvQwFfsp`h zaeCjzCpJE{(T5uRNWl5P#)pOYBO4!c+?UgSoPOVlk=SQ8KBu=+8~@noZ)1RsF*e4M zLRJsm5yJy*d|~5D>UtX^YR9Ts>GSgT-OZis zCVy+=I~&7Eoz?~W~9Qtbhg;J{$o^(2Q5>Ind zQlLMRY2etHLM62Er;WKbez!4=bi>9>8`*U+oeR$(6+M*P>Gv{?X9ovO%(5|?8et*k zP?W4xdav8IKRl*n%D?r)zgA@PY|OXumyN$|Ea1@>+BkkAks>Zj62_*dp5<9Dva#64 z5*k5$V~JM+BXf9M@mGs6Ih#liVr})^fU<(>0_U{Ht(X zq0D*?ZeL3HmxGO*ZsK$^rw@_@N@^R&`#IgtDKU3&u#+eaShD}zTLpnUxxL)G&qfyK z9N=E!ALM|(YmV4BN;brS>fjjFnntdJ`VLNzK%3}E>Z23M1d9HXc*@3U8)s~swPD(@ zXh=e!@9}ds&fB%n$;c@7x0f`iAL;8u=V$--(b`NheyG)tRRE}eFHKklHSgQ^ayIjH2IvV%>3 zCp_U`>!L{MWzyiGP;0*_F zaz2HUBQXjhN*jnea{k*6-r-;mPrr+UYbnC5#bw@gK(}`-ogeDzpyi4za@{!S&gp+R zHBy8c$HKiF%xawTjf3|b^mgz*wS$BH4hA^*z`=(O`Z@T-!AA~0c7k22eI2|U3R?TU zknnX#pxw%}vG-F_j}rLI!RMqu5EgQQ!y&;936V3o108(fV6cNByr^F~7{ozpr=TS} zi_r?H!dDK4IvD2QYlluJNTvhKhi@-?X-4E;c9?ejH7uHN<52Rq4!(0R+`$M3e>j-w z;Clxn9ZYaA(ZMLHvV*Y>ek4_iCH>%F49{ig!Th9X~O$y!nbL{?+&Ip znC@VPgTK>+6KO)bRlzwkS!TpJ6>8QlDy9juNcSj|hMt2t4zz^{^Bl}~@TY^h4$RIh z5*F%(g_dDqfrEuKHhGyp3=4Eu>4b35&db6=US}GuSmIzgDHy5rhY3p^{6qS{h4+O8 znmO&;J}?M}F6XXvu*$(|2WzNobbqLwdp<0j}$*x=w_vbPRS zl9ebXY@`lK3GJYfNL}Dyi-S6|^T=)EU@OndTN^O9J177<9qe+j+rb_Oha4Psu-Cyp z(h~;<92}e&(p#l>DJIOUnt71=x0rDH0Y6WvSWvGc4vv!LcW|6aJ2Y!mF(G9~R?%?Y z@n=%{A4)z}Oz8e{l>X0GyBR*^;IxA?4$hK#JM?=B=XhcKV!|cr%3{KK2NxV%NQ#C=+@a|qNDgF@i3sD|NX1By4!PzL;eC!Z2Re-r7azMY$gmtwuH&Mv z3)6w+z@|Y#Ce%f?3;M($1M8C6xgPfD5#S)7j6WGJ7hx9<9Xui<@1m%S1Q&@einvH} zach2PY(!WU5iUi9a5TuBtQ=`?vWpZKAs4AGYDa^|1YKUU=~_I?TF7g?7ta2EEnt6M(8O# zA}Y}0w}nw*Q&cz+74oA(85gu5oVgHOsgYoqk zmwDVpMHl5cuE1%NWr-A8$wg%sHC)tm@q~*iE~>ex?xL!TXT4apm@xjC99l+IDkeM^ z69%pbZEO>}-7v85<*z5!qKZ>dr$kmAi1msIovx+Vb5Y+#Hy7PqJn5o=i%u>&yLigQ z(=M#kl=>M$Ll@7uc-}=57h_^VBVL&2C_C<@lpDJk`Y3qOB1Zx*xM=F4or_moG;`71 z#Y-+;cJZQ%7A{)4XvI^Q6AM0Ds9$!)gu5}}YPr1FzTDO>+PG-H32j~aTNb01q-jJy zCeU|B&2-^a3Ucv=OFvPA7JJP_2N$pNmTaC*Z-BzXqG3AHoQm<5i;gbdcJYpjUFiZf z^-T&*7cM;;&a4|Ql@VwKowi4}6?buiBdN)1z3ZZ@i;H@Q9C`oa24}UAd!K_IE_!m% zi_`Zw?agVM452`>5BGlH;zJII*(XEj>!P2F5!CWWl0TuKRQ9PG9JbSF6gox2pSk$l zMSm9qs0}%v4%HdR!4MZ;xcHJdFT+Hueg|7t?Wlp40Gw&e0;+> z!#Vwy)9+l6ONlUwMUI5&W#D@kBVCMgG1|osRDC5}^;~F-i?J?#b1{W-aWT%t&n|wU zwskSy#Y8tasqgm;VRv@=1Q(yIDo3l+_h$qzhsOr9NiKfneL9&2W>S=GEKAqh#WMt2 zUstz;FxAEHE@ruy?b1JROm{KE#UG>zC4_gT26ni231L_XVWx{eTjh-SEN5DYpm*kw zm!~<;#Xlv4xh_tW5I$ZSYvu%FBqKk2Pno=hF8*>csc6w(ix&Oc#Ud9olZwttD!SOk z5*Jq!ie5`7x|E{3Sf5aILqgGIE|$Ca{vk#_#0nQHU6gr%oCjFt(pnKT_0i178W(G6 z2zcn?!7d@JBRk{b5vAZ_gNuJ%Y;tQ-^Df;+j+?w zc1qgeVkgIYNDn#K&1s}$P{;C|64=X`wMz;II5@C@%{vZxTx$feIi<>Uyw+?qN86ryV1zzA!OA5DL+~J{jNq{q3 zl?=VNE%iRNj0@34rDLfMC3q%Fa_K5DC@xg8_GIK;r2U(!xzKr$?ruo^mug*7Xd)(C zF6Kpo?KUU$^DKN7i6QgB^(E_^ZwE*_8y-6=-yhZ2eQOQDe^5(yJc@Q~=CtcP+Q zig-x!knSPF13VP<5c4p5ZECWIzWY+sJPf1r_&nSzDTKVh8b>mPR1dYbrq<0A!XAoo zu_50l6!#F}!ch<8C>A+N;qiT`H%_OP@X#hx$l@tbXh{#5T!sWn6{b*{hh}qHhSMBQ zDbx2dgXhe2NyYvkb>4oH~1Yx0tw<)Mu|JXn`Xopm=;XyT!nhgl;MUhvSA z>h*n~e&m*qOlZ!9Ng+u~TY6~a;VmyvhL=3N?BO*J9XzzAHtAoijfb`#NSz3iYvyqY}o|P5PWO2Xfk<(*Yjp zmI^9J?r1n^kcYw4O+09bM>k#KI}gJ>3?+Tzt@I5K`r5;Y_p@mHQY?y2cH>*#ywutw zJbcgbC=Vlf?>y`uw0zMkSvxkSZXB7gv_F3EK!q8@#i&Usk#Qb=qJiUKj)(CcCV2S8 z!z7*;m46}!l*rFKBFX>iVX}wm9%gv>%>xx+s)yfs38(N8L7i1#%?M26d@9=?90dL7 zVP+xof0C5!pPV_D7n}IRnMZg~(tKWk1)P3!JoRr6i##0haMZ(M4@*33^svdpQZBH{ z!)g!zcv!~0%RQ{%U|`?ipw5*X_ZeQA@EVTSdRSK|u-?N45C2kMa{&@Aa0L-Jd)VS( zr-xl0w(=;%-{E1Khwa=;!v8my-5&OMIN;$R58dlwpNIYbKS@gG5YO~5&yl=T07~r` z7e43Vyoci+PIx%UIcGRM<>54sMVS_q^DK{EP=*U0E_%4ZB`~Co&l z)6z|obPfy;CYcMa^EIChevCLCTn{CDl=R_ww3`MYAE`d_$<&Z}_W>UdJv`!Smf+)w z;R!W|Clu&yqK_heFbd8bO(umQTGU6fj}*=%K8cYFRF3O;nvbxL!KH+lk77QGbFqjY z*q;J*r39ls-Yg|#?++@N?qh5zA;ZVCQo_Pg!j@7(rjJrS9`{kvN0yJ$KFazi=i>rJ z@sZ=>9tO;n8zh zm3&n8QQJoyshg^0`*@NkUXRk;5$vZUSI{gCxIn$q0(I-tJ{tOXhIerzPM_!WSxy`K zc#eZWa(gP#Cfxf1rxeuO$BRC?=A&CaTKH(`W0Q}~K3e&B$;Zz=e(~|LkJdgu^6{~c zHa^<=c-zN2KHBkOyvgY+K3?UZy^jt)Ug!8VdTlHHUu*e>5Aqh&f|zd=;*LK47u3l| zHy_=7boSAO3%pBZ;{qf@vB(99_~=0`Kr zIsK}TUyvQqZ+v{~V+`k$_d6dWe0*(yat<*m%KvQ90va+t{_(NQ$6s7*F{dQ+ zHwTNTF}ZDD!o5p*BE%uL+{X$ZYkjQaK`VW%=3rHUmuIwwvDL>T9|`%`=3~2$t3IyLc=xf>hx26Vqds=|$X-yI++H8MIo`u5J&&Pfr z2Yei)A-p5?Fb|qNDCxD*!XeVn(!xijg(JKSgSfUI^KsnA2_GkYoF`M`DyqviqUkIoLP*?$dnK8oa{ zRz7OyBPk!qM~Qrt%tz6DBr$v%Jk?uYV|&Y|b^)QY$TW(o#45 z-)mNF)u94Qnb>H(v~Z&72C-pU8l|Nxx8k%kPD_)tw57voX{vs+6wPN zdCSVutI~3HS_Y-%T2<~(-_kNr`2fXXr6bm5j8S>tRD%oQI+YLRQ0(#wj9jmhiKU|( zNz`*YBSX_NEG;wB@_1TqqA)G@q-DY`@0PTjeIf65tumahrjw6mBhzx5N^VWdoWmX^ zqgb(Yw6SzFTIB_^e~0or(=tZMU1_;n$;z3=j^-8ATnV6Qp4to!z6ODCLr)8;@zLJ(#)3Qi8m;7rw zDT~vxg#N7b7~V`IOkBKgs2c6RsgXuf(A?W;zOT-=r({)H-c8GUY55>6A8Pzi=l!(Q zd@^zPLh0zEw0xYFrzWQK`e;eY-t=^n15Vv^gzX((-v)zDUc~v}{Yu!L)pumhEZTk(Pao zpUHVU)3PfqdzJ4_3)7yo?9`@dflZt$6Q#>U)MVPPtsGEim_3x1!)X~=HaeM>Bij9A zMD7^cO)8Wu8y(jwC(_cPY|^O)idU75PNn6vcI1p&<8Jd{S>6BB@>N>?NXvOn&{pqk zT7FE+xwL$pmT%JXZCbud%lB#dL2Er;HsV>1 z9XVPyGRj52rR8@n{K6fzWVz^1Mr>OCP0NL}{LNvRYW(v*wF=fwIxU&B#Az`y$y(0R z!^ufdRV^2FD;IGmA2-@IGh%5e@669__O2=yNk)*7R7O5qR{WxjT$~XnBW^~#jNDo- z84dmphM$o@YlRuf$w-lmaC_nASyYA8c}6w&@Aryj{(A)}nUPDB7gsEyc-ge%e1j=B zBY7$*^*{2m87W8OSt**8{EU>($j*%H%1DKbL>YM?BM)Zy9-UOmNS};cnUTsFsgjZU z8EKG_s`R9&Q!OLaGxFuhSUyDMrvuQoe`!wX|GG8bWu&t@&{}ocWu#3; z9=H6q>I~bWOKi7&Mml7qV@7(kaS9yh7Z>lMRW8d&&x~}JNvM zX|@h8N0`$whj#AqpQZyj&cgLYp3BJd8Cjr3H1$G8=4n{Y{hz+G)_e_~7Zus}msJ1d zj4ad;qPMT8gqp9P^Ipry;*7kVk#{n(M7^baX+~aG&Ym(<-pI(Cnq8)TvdeE3_KOzY z&B%Kh`6weFYw7zL`GAN2%4v#;`USW=BP%kpCL?RL`bu?Ubw*bGkN?RmoJ_6D$ohQYOyG4jnp5QDo$UZ);*p=MT?a#;oZcrKdG$V&Hax^2y=qLXqf_ueu<48stPB)my ziJxWUct%cS$rqd#B@}*@k+aIbX1sN@ zr;bZb4!_ID_bNQE_(Mj1$;hu6`7tBsGV)Vl-Jg}P7OSx0ZcO^X2_(KUTQ{hiV zlD{(YxAGaKl8XOk%q!1Ljptaw>@=#b}U<;B%rpvbzR>VLi`(c!VxMOnExD{Zn# z>&3EiNj909dRZx+l@eL0kd-JaC9{&7mHY21NpG3*vQjpi^r(~~N$ISVQO+vNmQ&0x zEG@5uqr_`R#cXnksg{*WN-8T>QKYD>buHOL-l|+KL4_bqhJq!Rl+L z8f2wmRvKlcaW)C9r&f4PI2wCXEft$)rCC;*E2pqUR!X<@NcNvHm|Cg4wc?&r2IXzD z(k?6Qv(h0e*JWjJRyt;-Q&#$A<*KZ7&Ptc8TtWREUROnuZS}%#S?R9M^vFujtn|vt zrRG zYX)TH8YKg>GDr!9)aSz;l7_pz%qH*ptlW^5aakFkl_6QVk+Ym1-AYfgGBhj0voazp z!_+Z4aI=z|6bo)hZc)w~4?YzdnU%|rc@6TTI>)?=^P^E&xsCp0<@T)Hot1mCa)&D4 zrFdsn#?a6FGd@i&sZ}lCfm$R}UD=%@NikZyz=$_z0Eq$d>=g5mWuVrO%R+do0 zach~J65o>_eViXH&C1^Vs7(22>u25@>{M31$d8t3bAI_Kt0Vl5_JwPfvqpS3EAJIb z-dFO0;)jYKDOwz^tgPf(h^0j=tFp2>E9bNFXI9o^Wi1=c%D$|u%gXw!?9%2Q&&k=4 zm91IXmX%MkvXLt~D->>4{HssGxBL&^uABjXD^ zROjCcQC^hTO*UdT$170Kh*G&ldOWU~@; zM~$UyEJiG5EIF|hiN%V=j>V0|i$!8VEU8$WSh_^ffGDc7#(QXmHztZEM$r>d^lB9O zu>`S%v20Oi-iab=ve6qq^A1H((O52ur9>nt z?x}-bk&01nEP1h%iluZchE^H;Qr_~4(T<9VSJh&v9!rf_YQ}O{OSzAIr6gN1 z3MxevDn)f-sT)h9SQ^JtFP8eTG>D~PEX^xLT`MI%45$>{tYmzpXj-MHNt}H0Z5m6n zSe~yG@xav9yk*O)ULlxhj^nv9yb&Yb@R3PD!}O>mEz*Sgwd=;|{M!ESJV|SuBt5^?Jr~xsqOrbN6}_ z{yWVeCOf~j(sfUAS-&zCVqY~&a&;{IW4Sq&TVfdy%QY&$QIY$@z*v5$6b*{y+E}iO zWpFGv#4=}(7tSz{#xPlY5mJu{;{f_eZ@4V!nAL6DW*j zVk}c)nHtN(tT?y)B!&pUDo0Ic<=w5>X|X&K%XDpYqDmgG9I=QmV?3rp zuCkeN^2!9e@OUgw(4eZdS?A4)WyK2bNmV166U)=Fyco-ZSe}XHSq}ShZysmxm^b>M z_Z-7XHQzhvy%5V>u0%b#rAs$$^0=YRk7da5+*d#GKCT?S6w7O|ERN-6HqC&n9KE8r zD3({1P{N8tW_jlG`$_N8;~p4{(E}d$iZ`^mHT#phg|}jPTeHs@cqf*3WBEFk zZwma0y|L_LPh(lhZ6TJe-2Y=)9n1PyHpH@q&0TA+ zjb&Xd+bTzg)v>QCM^=?6w@UO0-HT;YEStHgt3=JKL_MoSeADKZD$%`ryoakqPgRMw z#j;%+-5tvgB|GU4hp|eus!FuGO48GB758XqtenFAv3#l$@&if^#!|FuqJK!UhZT9j zrQ~QV$71;`mfgpa_drHfjgD*SiC9j?aw?V!M{~c3oPm4;Kg9B5EazhRi94_X&%n>I{1VGQ zvHTm$ud)0_<)TjgLC){omj*e1#`0Gzf5dWLvp-zqFj3CW!lgzUB!AP?nH0%|Skhd2 z2E;%nmTW9Bw|xV@j?8s%7A0w!eR6E z(Iyo-WDFYbnlXF>fq^`&#fCxy7a6$NK#qYT28tT!@?H+B)VkB4CvOjNiy62?4VE-e z+yE_KSNj zpdBk3XkehZfffcD8favosext&=xt*IO$@k4Q?)9%?>thHK2K;4s2!S`BYz4zt|G>(ai>KF)+fwNG+loM`^f@B>zyAnm1f!C3RP&ZZk02z}>2Ly8#Z`7`~BM z&1&D(y+eg}YKxqLyOePHSnHm`7TKe*2JSO3&cJvBGYvd$;C=%S7?`0t4{EJR1|}Pr zVBjImPBieafidse{kl1=-_2)0t}u#BF)-D@BODObIdrMPiJqoLNZ2nf3XVpjBc&cy z;bVn9(B~(V&t}ZbGiDihQnOE~9fkxQrp_D#PpkYHq7M7Bnq?`&>3QWZ7?^8dp7K`= zylP;6q0Wm278LTAl)P+Up_0*GB}2N%z-tEh8`mEaIgi}W+25_+>x}A6#g-a)LzTU1 z(VI$^8Q6F<_od^BdrWWfEl`zLtd^|4ce!S(MU%Q2?-_XCz>sRum}=1nszCCQfsYw= zbNuB7Rv0MREbrWIZ+f+8LA7XAwP>}0HQe;Jd$o3YYYnV3@bYeNmw_77jP+cG(~K=D z*g+JEvyj&vWbZbx$G~3I{8Z)C-=`M# zD;`ihs7U=os&m-D5d%jJ95Zmzz$x|WGXuvBoG=g#vT1~V(g!B;(`x@rVNrpw*FZZs zn(5IYnwxSahHF zGxySc-Y<&38u-n?@5))q^oN1-2L4nzvn>5fOaCsET;MKrz;jH@eKPO0Q(l@Oamvdm zW))*?&M;w`uuRxyaupCWQ6nKjc}nF4Le~V-@>AaZr@X*KXyQ)`e_6;eQN#rA{hC`S zYT_aj3rxIZ;$joUOmtTZmnhaUQQJgu6D3TPG?8nfvdZ&JlrmA;L>Uu2WBGBr$4fum zC~KmeO3ItqTP+&6!pk>tyjt|tI`7A7Q3Vr`iGufpsa(-SCAH>PPsXr{30}dgs)X5U zN~)WvVWK7-E*|myRceydp{sSR1|}MssB7Zb?;cY3Z=$n_vHuq9V1hTsojCYYj7K+l z9Ze8frLy|p#Y9&V*R1lE?eU1+v;=F5245YQFfFCz78Aow+-~9y6C+HF z&8;fwQFg=w^j2Wux+J#vye)tNCSj?zB=|Ds5;?UUbQ;$9OEnW$dd z8LK+uP26wdKIK#xS6Jl%6Kvu^6B9W2MGW%RMU4MT6HPp9Vv>o;TJffFHWjEgOg~vn zGx3OtCrv!14N*AV#0<`qD$|phCLU8x$5`=k6Hl0!Rajc!Z8CtIN)ykUc)`RR6Hl9X z#>BHGo>NVBftH!rI)|NRndX|9r;T2vo^Ukgn|M(rZK_AC^0JAACOiwig;z|xYGSvE zJth`$<#L^xSYcwZi6tghR*yb5@w$nnCf+mgzKJ)ujz0C?rb`FCH%%;~DQ$)AzQqXH z;GLObTyfZYhkUy6t|GI8xn9nBd94hbBH!Qg({LEbCq(veLvV6Fh|6WMZ|6 z^LxB|R(fBr_STqKYhs;=^&HFn3GiS3gOf3LTV8|+?hyW$Q-=XCBa6F1E9Pb~L%`TMb!yVt}C6DLjVGqK+Uzj|=M z#DSf`5feP1K4{`oCFF;c99F!r-#g01&JdmBcmCAlE3%()h)h&jnYh=qMs&)=Y3_I? z{xWffRp_~i?@WBbsM9U+8xvo0^EYvpfqlyRTJeJ!2Ge^p3`(fRjr4mHKbZKVu-1=C zel>B<#7`!E*6c5e&lXl8`K?g$yY9fWc3vg4$#(xX@sEj&iL44&%rO2fEWMy4ZGvi4 zj!hUAQr3TcHkF74%Ytozu2QD}NuZ^4-cjNz7L*1SLJL(aROS9}p@@Zi3+a_!Q44Wr zw}gd~7A{hLv0^dBODq&ul7HHuS^;*h5#_2d&q66Br7e_ILY*>7W*tfN%N6qS+ExV% zk&=pvl@%*lczLHsPnf=+YE-jO-9jA;bt&KN)v!=Y3GW|jD&fVQ^4bNZ(~No+?wsZ_ z)cLiJ`W6~kXlNxXg`d-T0cvESv4tiUnp$XP;gCK|-#6K4waP2t#1T4-gVwS^@X zUboQ3LR$-r%()iYS!i$J2@A6kY zou_?X5NFniUZ@dWWud=?0T!;dlIuQG!AIt6EDW?T$ijuk!xc56`>MHIyu7mWUScqt zvoOrUO%`sjz!!D?W8v2t(GUwaTHvFN%{8L^HKNlsqM>Tjsu`888MUezb*q_pezTR_ z|L`j_BP@)xFrKkw;Z_TyER3;m7k#c7-9|eWZntn-&FI0J(bF}fJ1oo`Xy0jpoJN+^ zjCR$GeykbY&Ec|epM`rY+-qTS>rzIoM4{t?JZ$kUsTDPARcajLQ-u#$c#t|A1Pc=^ zJY?Zv3zIB#s})UTcWOm^2En@5)r!W}iXN#I@vL(AT63y}X%=Q!c+|r4wIaTL_K1b) z+O;=kZj@62Otd+dH#8+Hsjr>UqPg!`@!gCg8TbRRMSa^mJ zIL%=A72H^o@E(##;qz8!Hk$b41F zBE{Df7b~(ZOP5-B!$RlU(QXTGT3BXbi!Q6TEWB;u6AK$Hyu(pi;jOT+(!#qI-qT*c zZ{b4=A1VL90>hr&{8+Oj%L^q1@>MEdYhj&*)ymftYG!Li>kE0&+R+ByG}exoXrw~z zXz8)sO%^s=sP|cNAzFl`!nt^zlMJ2i1;FDL8 zy>|4ug)dadb1GKhnmwyoKBri+!TZ|6H=6xc@jJGw$6wUs$<^%R9^aBWXW=IcZj(~K zSeREk`q@H{qse!s-me|Ky2<<1!fy??zez$PCcJzl@J8yvx_-N{H3;$Ti zwUKAzUoKv5$ab=>(_CWQ#_a?%%Cm~h#uf}4rVUF=ZPllowM04PU>SkM-AO4+!@#&8>@ZIrQ5)6|MtK`GZPZdp1;r{hf4U;^v!Y@pMP@52;oVeKCDjzG7nas2EUm4iv5h7+>e#4j zqh6s-0~_@V`Rc`a4GVcAJGnc(%|ufh&1`hE(MgM%+h}8>t&J8oTB@X#jn+z7op);m zwdh+r6?Xg1ByVq{gPq*LvXn?kXB%BqfxO`6u&XNY=CHes9yTtuahZ+&HU`+}X``1a zU#WPxVs9G-cZ{@fg^fNcWOZiyDktej9UE5{YW|=8H8uv@xZcJ<)f{BwT06OCW)-IE zY!uibzrn^()fr;r#{X&JKX&rzfC|HG++>5@WR;r>71+lSHb&auYYYW1Mcis*w2j+s zjIwc?4L<09vTZ3MAH3dS<4%sYjR`h*1Nq|d+%Y!pvT;Y-Qg_?9$Hu*kiqoE1CmL(x zJ{#k0+;8LQE#5dAKea5ymkIOgL^bL}E$T#k@%Wzg-UBxHX6(On{D-%B580Sy<4GG6 zZ9Hsal8wnWX4rVt#uOXppZ1v^u`yM-_l!S{k^f90WSXu*F7U_HftgywES-7W2FVkO z)F*#R`|fV@Ua&FS#vB`b@AqjN&)Ilhi=MIZtdh&?By0J$IuSnt&#Du>StpunW1fxq zHu%)?MH>rLZC#z{Xr1U>orw0?mxVT7vGJ9Svo>C}liQ3FHcr}DWaBj(i)}0+Ipuv~ z<8>QLZT$$(7EgI^*m%!QKF*WB$!`I3^iFwiDZZ`vj^exae{V{u=JKj>8|%~=`m=n7v0nKGE#=)QB^wz4Ha6SXVq>3;{i?tl z&aF1K+1O5p^+tNHjU8HRr{b={-D$UtJ%yaLxC<5F0Tmv%aj>xTQzeJA`eDT*Hjb+B zn2pbr*DpM$;W@5F1~z!*$RS4P*G4xQ1GJZh7-x%0uP8r){S@vc+C;7iq@rN%Bu@%2paJZ z$pw5W$J0m(YYJ)!Y76QJ>eBf&UOi6MdheOK5%0qn*Ny568VLAFkjj)aRD&PYjhYCW z3a%FP7c>(z7qkqeI`qUuJQH+z>0 zdJFmpuH@Uhb)zc;ix(s##&mJLsIQ=(dUfbXGEltnxJtm!&P?=q0GklpNCg3(kMq$y zbp{Fs39i*zZMJ$$*9is-u2;zo9LcTT5am=OFFn;5Di|iXLvW|yCPCGD(MZ9qjEYs> z&4OE$3|AbXIAx8;qEY;nSx!y8sB67wv>IgVds>#do%6EE>p3F{&N1v)z35&oy^GN&q{J4@q*wv!SkGg=?1e*Jnmq=bY>{)X~56$=!)&&uN`-?s(tutzHYK#?bq?+M;7jQ-rEmKLbL&O>1#f=q9#CYJ{%gH=>P3fC z?Xcj8;Hco3;CI0vv@bZG{Es4bZ1VWE6zZQ4oD`hmbPK)~d_&LcMP~$Gs)f%LDfvR> z)F=5$a8~6xdZNqO{8sRz;GEz)E?B`2I`x$QQL`Ag@q!uuN$`uxe^z7>6@FDdXmt`2 z+>3VCix`~eliz8;h2+yd6iqZ1QRk`T*nQH_6>PIB?fcijBpclXs#npSg2EhFFUPGV}&=|=n zP5Yf*C!h(?6yU2GG}R1fPPeysEr8ZQ8=xi73d!mHm8Vlo?e4N!+7@W9ZnOh_yVanC zMIC^S012~9wAPv30lEU+fbKvK;LfdH+b!PE`q8#+iNdA8WooC~sa(EH^$L&5>nATe zF_2h#InW!p0vLG0>jUsL4+^hTeSXcPFF>T^YM?(YbC7`nbQR#QPu!tu1A#%nwMfod zXRh+D0|qlf)_VNeitB+JfT6%J;E^pJf9ih-1LJ72Vcy8PNbY`__>)RE0XGA~fe`>- zKDn?yd2R0&;N6qS435->=*F$U^!gFM2R#b7O~-Jwj@#|3zzwHh&l#{MxoY19+zs5z zSpc5c>G74G8oaRwPI7Nw>G7oZK43h%42%P)|I%7-S^bE|cMkv$0uzwz?R+DYHy+e~ z2$%>w3`_zh15<#v)_6Q9V0YHmkER0CfK&COS-_t9(Idd4tWIw=OUVo+49l4;+T<}k z0X(jp{VI@jq?Y(Ww84?uoU>EoACzw3%sr4{3fuB`WGcnwK|-3-r-7Y5Pblwo*R<9%Qy$# zS0R6SazKkj$kePs^f9m;_ypKUuYg7M-MP=@cDqn~C9sOs)%f3+xod$ng)=^MX$~dp z0OESZ4ZxNGMVQ@0H%hzPfbB{)Q?7)2zLNGf&H4@rMSCL=kf;89_4!#_bL9f zH^u5q2Q+(7@l)WC63Rz*EO`_-2Bd)u@R`cL1HK22a}!{6spO2}DaBF6?bGbCWwZL{ zz!$)mDrfd<;49^40j9q7awuf_2KZLxpMG6}*&meu%6$O%QTaK=pA@O^Gv}y~pC487 zaxeT{vwtc6!T2dG{gd-}+9+t{Zx#Nd_^;vx;FbmvOS3=>R7;_H3PuWMDjDihDR7Io zQ@BX8lt>Dx6r2>GlCfIXO~FecOd%%)zfkkz@@9|%)5_+#tXQN_UNi+3QNqO1i&H43 zMVF*dQb}>e5{3E`w29ml@(Lx-Y^dpbPvQ9s#@gae-4uxR z6mQv;+aQI8spJ~hCdDF;hD)-bv`h0ZB-Nug^B-BK8s!k`qor_dvXt5SHh zb$BVKrcYk)6s}0&vJ`rzu;lsNUh3iH%IO|c$G7tOsF3{16#iDX`=-z@g*M&H{D#TJ zt`(6J+A^oVY7R)@niLw0v%l?TvQ~e&5D_RA_9mcmUcxj!elXS*eZ;VFzrVPp#TrNGz2ZcU*>Hn}{FNnun9 z+deFDTMDBY2?tY`EDcLvoZxsQS?L#kEbAAlU=l1qi9wNPipB? zDa=k`P6~IaZ?hENRD3pt=Tv6_!!LywQkbvVt&O6&DG=u=F6^BAfK@^EMU^niqL+9T zD9j#j6upwdt0^o>f$vtmmcshFi6_tBnzNXJp=RsNlGjsM%2}QqzQJ{o!dof4saZ;> zOipBaTM32lrBF9EK4c`6DDl1uKS-hXWzPFi39B)GeHUl@J0Gijxnh3fsC(mRRSK)Q zUR*SGu}0-LIk?%uT23V$OX0I6Iong%k-`R+7Ii*J;rlM`M$Typn^phsEAqFbaPpM% z$KqmJQ`pz3$Tmh!KFL@e<4QS`#52>?C~|@hsM=}8Qz^`Q zA*XS*+EK2URMijNbNa4#A&M}@-_==;E!nY}Wm%`U6e518S|7pD0IEl$idL$$K zeF{IM@FRnvbIAkuB}R^D=>^3Z512ov@GCcp6n@d_C8s8D-;LOnc;z&SR!)`kDg4O| z*@5riFFKq;HibBae^U52g^bps@`V)A^kH{Wu~}X&6A9CS`L^M}bdo#!lmp92X54ll z4*0LWY%=Z1`ZmjPD90&{S#B2nNL)2R%oY%lI9McY8t)LC>h2NFE&~`Xyc%tgR300bev;8F*dIq2=+3I{zM^m1^ygWQ*m_N9{O+OR2X zV7NQg≺WbnwwjMqdX*h6&#;K|C4(_KW`TFGdfr-pcaPW|WiJWD_eZ;|i zRb9Wj{jh^c4kkO8;$W)Qo#vpb{t_U646u6hq%XDq6;_$~OHBP;+OpUtza{e_BMvE4gvYWDm)0ne>$D$7_OX zrr7%&?00a$LGiPBfBq+E)-pmV_mG3b4*q6E2S>Ox9DM8GI|s)ceCFVD2VXci&dtZc zX>F_CY&q%RhCAdG7gWpSVnO>4wv5hDbEq*r-{pe(QZ>&y_}al&9D%LYV@H#f`;E$Z zuXWii5+Z+g%jkOtKREc=!7mPe)Y5Yfep1rt=VXG`zmN=0?YZ`^4t{g+rxyLrsCIB( z`5z0D{rSNW34SvrzwLzFzf}IF_WfV32nU`E-$mL%MvGD|vJPSgwhM7#xG-H z%DO10$~RYa^Iep8QN=}77ZqIo3j!)@QANc{F1H=5RNrWggpvZw)m&6}vAC~Wph;m3 z7l+K;v-u%!=W4sjOiMBcuw zckzIW7A{)4xYosWE?T*0P01C;)h^n&XzSwa6>c9F?Oe2X(alA77ad%5R42PCc5>0# z#j#=Dp;pn$$4YeJ^eHLm#dmMy^>A^ii_2Z~c5#`Do-TTE99l} zcm;i!DI~-zIbVHTroJxvDZfgwMeB&d`n}!$E{FpZuW>O@2_=JE>|Ym>40dt7i&6ah zQx`Y57~HJ)bi3jmigzk*{W(#)+r@pFCBMhTy)MRT_I_<~pqd(|lJPFKX%%Wd=wcdEzhFXP z-G^LEbn&oeX?c>1$u6dFPMegZ{!|wQ&5_f{Bb?S>Qqx_`aPg>%$6P$);#n6nT|BNc z__T{BT+DJYn|4lwPpa_#*3napiq_HPW%K@WU1sOF*sV*r>A2(p&79WJb1p7kUg8B8 zbG6FzifhkU^OVeY@%-d~St`HiCZ9S<-fbPd>|&vdPZ`WEUUBiNi`Bf@cCpCCYc4+0 zx{Dc&)AHX^zQo1rN|rK^j+I!Z{0$dxy4c)0S>~JC=Tct${_t%V@3?qZ6)68e$$Ku| zFO*b2liV_W=wjr)#H){0zFcvI;!4F6t)o>gh}2o@Vx5ahZK6Fc*1Oo?Vuy<^D@uIg zV$wS${%##@aj{Wr)oxW}lakGfZQlytUmb4cJi6HK@@Cs)wg7jkg0;Cbj>%%H-7SwdvG?=zDacnAyY z<|rwmc;Z>_Vh_bUl=e_YC6{<8sie3f>y}XR>XB5glDtBBDJ4sLJ7o(c`5wwCAAeom zkLo~q4;56hRkM{mRQ7OFfSUtU@le&nWFJ#}RP#{XgX@D&ENXbD>4EPUpT|p{<8@9vXOP=%Iy|Tt^zw__VO8a%LMVX`;xJrDjT+dthq! zMzS=RT6$>Zp|uvZ@$l}Q$#;91K53iZUWHvfbo0=`Lq`vtRMJI}I-Qji{NVYw4uwJlv?{ z2L32=^xyw7_>YIND&#;7^)QShrrDc4jPh`shg&=h_Yhy{jPNkh!>wBS%FV`_o24L; zkM?l8hcO=R@<8Do9`5u&d4U>zAi3MaJs$4W>eQjZ0(pUv`&2&8!*~z(dw776;9-h~ z2R%&i@bLdM`jCf-+6pVuER9UkQW|7-s)uPF9#hF99;SPk;o(trhMEOcs8-PW|5)_wa#-4?TS3;bSdgt^XZ=R$S>}m4|g6)_YjZCOoVy)GTPI zzyVey+2G+54;%kSffkqwoZ%7EnLhbjv~;V7Z63CJaE1n@Pg*-vXiiG*`FDHRPZjrjIG|*(mE46g9b`ybHdC%`v&vx)N3`xyRXgtCn3B)_r`8GOtb0;P zak0;M_}s&Hh4L@d!dII8(&KxWiDfo%RwZA1_@+?vTP3vcy@ww>{OIAFhkrc$%XL>F z|0fT>dHCJK&mMm9@ZPW_uzzK=>rkG|}@tzisrFnx*`2 zEv?fwy1>m}g_e&DqoRM(eZxmqg|Q+($&Rm;+<};Wvc=so%(Q(>8Wf7pCx3~gW7{a@ z!}0M+UI`w+-hESWepHU{Bk*yjkHO2F&_|AsZa%vEDB`22kNQ3u__)Z (dh~? z%tucjH~1LhqnD4%ef0Iw&qr_VLd_N7l}fH)m18CPD6VN6Q9ijsiK~2E?W1_R=sF+$ zeGE{|K|ZcgLLBJhVB6&CP_uS8_k1!+*J{zPZKJ_TSoeA#)!QXHOgH)%=Hn(U`j6sJ z#UAaVoBiYy4buoExA+*&AZ%_^QgmDnaiq#`RczbMxy?t(%W_8h*swJBc7~ZYaR;s4 zYj&9*j#0CB`MBH1JwERBF~LXIp6*y5b5wIc`{+I&<9uv;A!odgZ`wr2o>=}EekH=Zd#|u85@bPf_XpWDkea!Olq#Aijakk>Qzmp3MKVlP~VVoED zpXH?AP;znmi2ON~T;wICbA7zz<7FT7e9ZUpqE=s^xNAvbgo$LKk5_!W?qjKsR~hrF zutf1SAB&Yxb5r|>iG;#}x^MV+Q#s}Tr}>sj-uCg1k9U>7ulSzg|EYbTSsMS?$8sM> zd>r+$!pBM<+kNctvC7A4ADevsOj@|c$6D2IHNslQs8+s_Q_M*rewkb!kM7I4ZCLo+ zu(045^Sk!Z))o1ieQfcum1#wO&>>>l#?7Zgl;0tGs+zmg$6g=%e5~v4?o!;XxJU7| za=H6`9Pn|7lXatcrjJpiv_1WD_pqNlD`9rQBKw#+_6ldm$7eo{ z`#7PJ(>~7lIO*g1Bc)EMgbtHGQ|^*h9U>-XS?dcQU;6lp)3GWwtATY^HL1hWZ@KAl zW&@NB@LCi1dmnCqUv~LF`1sLBj)AOCP$^YN39pE)d-yTADO&ByP`fAuk_kHM!o zfA~1><4+%dsr>UX7KOxu#9Du=d}3wy0{!pingOf;X9t}b8h8C2ONdAfvRS2x`~Ayn`J_yK|dVUPq;sQ@_viYVtwEE?dV z0GBOvN(Q(%K(PQN0{n1C&Lshgs}4!EOaJ>`A_;|*juWEp+qGZ4;^HTt;oJdaU9XOSO&>3H|5%_Wn9&e1Hc6Jjjv!I_G}HM~wUl>_sK_*DlHaIpN!!Un{vyf6SQ} z;9+fRl46_dO$w)SoC9nK@JWD20!$CEFu*GTW(0UN!2AGn=E!3KW^%m*cqYK(0iFmj zTm6}(_+)^mSg~WoxAfoWnCud(b|#+<=VXAQD;BQ?cqhQS0Tywq;i3qz zgeyJ3n*m-Au(ZJ12z&FY{F0p_CR$j==}`IG0XDvz!w=>yRQ}NV9P?r4JuO-hU}b>! z8NC5M4DeBaj{__ZaK8C}pY`DjD7>I#o7YrL|TESQFsouk*NFJK5Z|0oF0( zxJ6hcnPtD;fRh1^ z1USm&7T_~l=5W=pUzw3S&X{Q@*h%Z23UE5WSKPOII%fiW9^i`rU#gMO2TBZ9omE4V zml+TyFh{mE zOsxGD;P(K3aHzG26HVcFZQU;iC*yYg*xdbJyMJ@J1-QVio>8&Y`j=7qvvt*5C7Adm zA`>7Rzz&n`Iu2ljFhf`&SQ>nkL|VIEMLLd22oooik4O2ef-fC0>x9XfXN?dwL%1Ql z5PpatMA;Cp&+@_$IU!1h$PJU7q)3QjA?{0iMMGQ^;$m%a;VhfvqE{39mxL%DVqE8_ zM2Lb!PI;bcl9UQjuiSqls&oj-%V^Pp&QUo&J_%7iL;Srt1UJUlc#kpLbPP>KFBGtHt9mW897}(OnUuS=csiEVw(_M|4yEF zv=7lCMCTA))NIEPliS$W`N;?KP9bhOk}UJCA-)`IcMH)y#CH$Kt{@5B9%1r~k7Use z$u+cRh+ZMC2{BOZT&~zJMDGw+gy<9E$`E~3cyX6xoS8;e^}F^?qWY>3SBL1Yr2|5& z%GfOy>T&eYBGtP@gF;*zVn~P^LtLjiH##M*4>33de-DS%yQ{$)w5Zs?Bvk$rVrYnA zDjC%!x=9INsNj1PEPY~BFg(PF5Ys|D5@IAb{}AIt+#g~TH-A;WJH+S^w{ryYoiQQq z2yth~!%}JeXPE*c`J3|}?GoLk$}g(}_k_4N#8{Qw$HC{k6!!E;muSe&WFj62@nDE4 zsxu+PLm?gxF-fx%6|bsmnq8CeY1$y4VO+hNIXMLXA)OYcssf9aPLSy#W`uYy#PcB@ zRrwPkW>GW5%rJS*-g%NdUZ`KSYxHD@r!@Oah@ZZ;W`~#);^`1$z9~+F-MU8mF3Vve zXL?pOhj)!$2r)OrDn%v2zHaZ%DnN(Z-hQqvq_niAwCSTTPuDP;^Pq8xE_1B%R{W-4nTf&&Pv9TDy$7r@Bn&s zh&3T*Ut{D9b;sP|el^%!$C3EfH(S{J8gxJUxG0xc(VsnV!pEbz0gy_^Q+8Sbe zmomeS1 z@kNjPyShgcyGPVvHfHsw^2yB{^z9#5Ir!>usfFE>appVysT`EeLAjj&N7Z*gNl|=X z@3MQ@1*Usux~J1j_drWjkt9h_M1tg;bIv*E97GV1prE3dFknJO5Cszo2%;De0Ywlq zDheoK;=A>R`JMlFPMv#hy?XU3*Hm{`)u2E_p@yi2n5LdnifJgJA);Yd)3CUP(Y#4s zdatHI*VM75%pdAqY8o0RaX-F~^D=%kW zq@D;H{TJ!cOyxFHGiePaHB{12SwkreA@if5tXR8BLuqE<5jS(maAZ|+UO!S!!|rB< zS8KRNLwOAqL?M&gY0biQ&BALnRMc>thNmSt2EE%X{9011qM<4)TtgiV)ihkMp{9mf z8mdcis98e@tF(A?RbzC_`TF+@YKxqNAJOV+xKYDROrm-C@~}Mq`31|ug5NtezrKcB zM6-j21{xY_XrrOoiK2}(G}h3RTta(ow+^=|eyfHi8t!RRNZwMCYp&r`_hKzIwBU;R zcGa3gnuo1KNZwlFQh~g!@OFajHT5-fpcUz;p_7J-#UhVXTI6A{-$&TEj>UqcpTyoKO5j3OGi?@tW$r)1S@5@fs#*n5=<+ zT}sJB4U;4yd9-cb<|^vl;1qVqp9(U3nuh5bW@wnH;i)&B_k{dW$l#xE6}>&1dZ&)6 zhVNk4Z4ut7VY!AC8ZxhUR74FgoG8jCpjD!)XAD*puZCJ#T3dJ}8;#(IR}9RV2n+ z{_0YHWs7i=hR>F%<;P>9^SI!q7U7c`HnV2f?KM2d0adwhdyDWH4bN)obJBY)LVEe3 zhkT2M=b4#uMW{oh+p6Iu4PR+Etznyn?HcxJcvr*Anp*z7#_Va>A^a5$uL{}8!d6Z1 zV(;2zk6P$^F=AiolEV!?h5hctYs z;edwsG#r%Z?+Y>_)jkludW*q`A8GiQ-HDSqdzXg8tQHMNHGHapi~J)R=twG+(}~HJ zA-zV^^f3{VQ22%LFEyMLk>@sx&^Z3`IpYYpFM_)n_(TMgfd=I`ugLVnS3 zR>Kb(e$;SA!%yrjf@=?WG;(^AGMFL1ivDjJ&WR3%=UL~QA{Ru?tk!NBVRDrJ!6B*P zPYste{H5VgbqVMQ%b(GK%(V^*BJHU?XFm&iTxPtg(e11%Xw8i#W%IQey@O6~Z5sGG@gKBBvj9XF&C5%NQ zSLrCNql^d_cPn!Dr5qw1L(A)^pyN6nl_d0P9oOi%R(O|qZbc!)OiuQ{pjFmUMMqVg zJF=XNeD;F;kJ_fIiG+mm8ais~XrZH}j#@fu>$pWn106SrH6~h5M;#q?b=)YDn*wP!Wp`uc@Bk5BziLuHWlPandaHFM)b5> z>1eH^la9_h+UR)ZzeL@2T6-OBMThIsb~+wy6S;MKq=QI03c9*lmUq$7RmZfJVQ(GX zbnyPq?mBviLa&x#Pm%NzWDuj!4hdZ!9eu?tIfVlx%JppvYfdXNP{$x0gLO>as|q_( z#}Ek}s$-ar;le*0lpdku5otm4#3J=bGD^p2_JR8%V{~k}LrFet8IEV4(Q!)0S2`x@ zn51Kqj>l+R#}pm&bj;T=Rcum!Hp`-8x{ev*W@hDQTZTnig|l=JsYW+Pg60Y?TdOV5 zu~5g|I@ak}#PaG`p<|_l-lpSr9ZPjA5pOB6u#8z6m~)4Yg#pfqhq6v2X)-5<33TiU$9fJ zybVI`X%#-Zpx^=F&JyR|d(=*aM_PpsvodvT6Z?NoQomg1TZK~==RdCF2_0|i zct^*RIyURruH$7LPw9AC$MZT~V29E1teD-RW9~pTB%jlu|r2H*~zI<1HP#sW3$u zWK|I93fqKxbnN9!qT{fReLCLN@qvy*VrsvR13KR0l#;JN#!N zgdd9cBf&aVa`#rs{g^deQYAtBl=UV-UkHAtG)pwUQzy0#~B?z>G)a4 zuUVa6bet8wtVJH9{34paiR4^X=e&>~el`Bkago!bfvXJsspArBJBD2`{H5b>HfR*j zMe&c0e>vktacva;>9{O$uZkikirlEmts6xVA<-yeQRGFDA64ggi$<~dDJ>F3fe`ZI zqE;waOprpl5~83?9V)6tq5mHRO5)c(vf_HpMGOaa|OBqUak% zr6?*#aZ3~pqNtLMRZ~b+!D@on3sx7bA(+=TtQAG=C~k`k0^QyKUquV zmaeyW-#k;$FN*$AET=+K{%@M9`SDRqh+<$AgQ6H5#gHgQi+rfy2*F{3!&%ZJMH%Iu zMv;*sAs-dR*m9b(bFpBI2*(PJV=v83Q#dh-Nm0y-Vz$U9M=?DccS;mfg-^>$o-3-& z$nu#S4n?&af6kc`#oQ=v7x}y>=0|ax@CAa4vib|z6WXfDd~sINS-eZ4SR%E(ROHJ9 z@5t&L92r>=#mXq|jAB(3k3{ik6sx0H6U7ErZ|P!dqiV%L?GQIJ!z zC5q>x7!||l7+#3t#VBgVRL-|X)uG+@qxc|-m!jB4{U~0JVoy}P4c-yOD^a}3&~^o{ zMzK>8omr*H|;W=<-Hrl0ZtTA#BF`QXin^0a8Stp`Kli3^oo!iisD1|nHch7_$Z2x zqxdD&Y(9#Cn-t)%gLW}evBV6Lkg+G(929^wpv2a0_bOCNJ;%lIrL9_a>@a#$qr;AuhNl ztyaG^8!81$Bwh^380;9F7~B|kHn5M3y|NxAPsQNJP)am|7}7D66wc`FYG}hgRSV0t z+l-Ba)lz5ARJGJE9Yci}u8yIMXqJs(L`l6|4CTe!x_vlKYU3L5UKc~97_JpwF^0P& z=$ZCm36%l4+IEN3eB-RGpbiFHd(8$;ZSn zHiiddcqoQ(F^rF4ehdp@n81oXQgmtz(_)w?oZd-7CdV*ENU;KkLb~ZO%n`{9!I^@y z1ZN9Ur*^DhZVdC7N(Xfm`oS^kt@y$i7R9hKhC5?eoYlM|hTDWMiQ#r3RHj=R!!l}i z2+6sYVD#lNtjNY{RFJz$_*(WZA*%(~#PGZ9SiU=kbunzn>aQ1aui!m`pH|Rm^FHCs zB)3W5AHxGNY@{ntJF)4i&oB0H43ETkb%Uy(M`PF&!xrI>2~s#cne%uIPsH#fJKpkw zr(<|Vf;PwSR92^GBUSuo+09lc@?2IvpsDvfe*&bUD5rZ-g0{x+QdZ~GCo0NzcIFs% zi14@+@D<^&3Ubrdal8@3n=zD#BNE43G3<`v*ww}PqxN z={6t5@No=#W7rqNyCQi%h7W}7kKsTJ?+HH`!)p;WBIurzE`2D5i%W9p{ZJH0KJ5^G z62svbevaXn7(R{RNDN=aaGC=rhNCf@6wPBX9FO6I@XrND_RIT1$gds35l7X8L-!@? zWR5)1bH7jw2R)Vg*P`}a4ByA_O$>L>Rl;vs>N!roT?Ic#=#PS#pffT2#QCbDUa_MZ zh8crrMd5r5zY6(HuzJVv9Oqt9qvq$g<^90|a*oO={3nK+J}B|0s2!dcxg>--e+l`U zb4#eQ@oxq0V zV>l>Vx>toH<4DEvamSF(7sBYYoQ|Vp9HrtQ5925+g#0QYrQ;|gROz zys(p!Un{(39JS)8DEzuODha79c)eg1!K!go6T*lS?$wCZ#akoJ>ysRMS+v?xz`AkV zAcT@Sakc6uxiKrbiLvUcXPo+R+!DvBIKGObK^zTP{5bB5qfs1<<7gX4JBf0uU<<(} zf=vaR#rYpDsy?f?DkQcPPSQ$9>p0p7$>_9?qeC1MLLNd4mIFKS0qDFzLS zV{lx(5uFgnkT{0MF*c6BPDh5tF+7e@ag2^*1T)a6uxqDqq(mg4qhw4Rl;jT0C(kI1 zi(|a#P)OsQTf4OUS*60saZHKxD=n7CF*S~9am-Eq`#P%a>J%=E z(M!+ zBiTyJLLTZIZja;TI9`ooXIy=X-4O>b2zrH`?bh5SYw}MHD^k3%c6@Y+MR%!p_`9UH z@NwpK{shGFCMW+mK8fRS9J}LqJB|-IlZuz{T_mD^^WS)Dyp8kk)2**N`Lh^yP7ktWb zSGn+uxH|TDB#zJGI2y;XI6miuFtp&fB*ci?vlbl*B{y^lPl!IFd>O~dEN{~#JRQf^ zapW87*0XQo_%@E;Lk5Y>7*@E)heMY=z1%DD`S$-Dsiy+Tl{Tjz_ zOr@#%c|9jWJ`bLcm<(d#(FlvBDz+!^5W*SI{ zJY~Sj>L(4@S?(Bcv)nUq`LP1VIx$2coo^s8kTy^0UbKpEydfzb(+ zHBipr&T9Axls8bpz%UcTO|8x7Po)a?Wm zR+yt^tu2+cnOI=NOo4V4i{b1{O)g1qK!x>gz2lpWP|ZEv(orjPzEEy~U!yShpKkYTz{k zuNzoq;0^;%7hogVZ0FOJV7rYV*}21|Bu=n1RPdnG3m1 z*;qe!Q@e<%Lzf;_WV3;%47_TneT+|Y2piaH;3Wgk8hFmY^9Eip@Xv(&EfSq4xEbs4 z2bLn2EFQ0ZQ6ernWotb#3>sad*|Mrw#NM^0h=++&%o(z;_0|H}HdjUkscz z@S}k<27Y2^Gw^ix@a+QyA4rr-f;2+%D+h9mg5TIhHxv}>5qdpBdO1a0Fz~wp&4g~^ z4+9rDMVpwmrr4hbE*Z$@ELW-UF9UybPAgluyF>AR4E$>#&&1M^swe-)Iju*SW2&j_ zvgGhcc|F%e5mU*#^$59l(WtN143*@AEKKmq&QU$Wnk@_N7_D9=6iVD;CW@OVA^fW< zdPK z>Dq*EB9NdmCekKK3NLMRLMkT6My}2u`N>7aYMZ#hL^~7hP1G?_*F<9zx0<-o#7!m|niw=Lzn(;|Z{il}oU(2<(d@n} zsWgzFdXw{=l`8*@#M`Yyq(XU>r6wktn`mL8DWjOU>+Za}XXT%}h))Hmo zoP2IWncOrJ)0vqrIhjfC>Gi4wXPTI0;?g4Z>UEc7c#asE zD>zT^bkA^ssUBN8&(7zb=SA!!Z3-8gxXr{86Stcv-79RpHNDitygth2a*4IfR1@hP zg898vRdAouohDY9_{GFome<4@6R((fl`X>NGx3CpCs_~^>rC8l;sF-W#4}CQxZ7aj z9uxPPXtFr(zVVU!B#HWBmZ4_~tc@lf6yakg9x~O#7u};K9yalaiGIDpq3sKZRNf>K zl8pCp6O@o|W^DyuaW%X1iBd_Zihcn^aYu@I_I0DWlda z+-l;>Y_7J6@alZ`Wg%4FA%wp{J5B5|@qvj$CSGHkn%HAvuZbPCRPTMm#G5AGGO?S( z`4;;fiS@SN--}hxSu#*%p!C4}eJ0*zU9BoOXkvdhl>?@_n2rkXiR8w2HGW5UpEE`i zkD9~}O?+hHD-)+pd~D(q6Q7wlDhh`s%BR9>l~*-?#KeN#YV;j5aoofS7Ep9PH}OR_ zMJ7Ro?dR3&{gbA8zjTVjJmOZ#QLjWEX{bVb>?`=%#5X3sHSwK^A5EMw@x556+9Kx% zA=VC6uKeDrnI5{F^Ajf%&UNCYq-O8%R};UPC`_PO0_RMeH}UkF?qw4fgk0hTCFFO( zKbR8}f12Q0k!o}q^0$QkEBKEnWJ3ST@|*;66DX2EUIM(qnW6cDBuFTm8GTwV5IN0e zgvAp`h@?aUkpwj1u>|4?{;wjU36+`u#U(KkFte5!lnJ#Gutn$ydV;QCCY7XcDhCPm zuA_4TU4*0)D49U11i}QaN}yo^jS?uGK$!$;CvXGT{|S^!pejk9uzUg)5^BD!l)%*q zT$8}U-eJXr`UPwy6@IPo;l0D_5_q_G$k2nm!^#N^YNRn%l>~n69Tx8sR!iXe1ga-c zBY~O;wCfX+(2>wott_Fp4lAckLA?ZSPGDG{uxT+pRhv$^L~o7PvGN&YL9nE5mMeM0sbQ}N!J82H|F&b z(k+4RLV5`H%!c+7(mR2-`-B<&z6tb8puflmBrr6qIgk~Y<%1I#lI5@cr>^E3mcVe4 zj1U}|4L#E*9FxG<1g5`i?e1f99X?L@(gemQFd?B<<`Y@E1ZE~MNxYOyPGCxwPZcsv zaC!pg`=}>bx>;;@5zfwP&PiY{tA#zYZ#Z9s3xrd-`R*%Eor@A!oYlWAfhAdfdjb{v zD$C0xd(7<}LY616B7v0&+$r8Q39L=v*pl?B1XhcLoXU44aJNYAOJH3B>l3(FycwN) zvNowqo{2*8Kmr>Rm|O}|O5wo-9!lVpi?3WfoWLU-#SZcul=jk(vKLu+!@{Nn9!ucy z1fJl7u!X?FlL>52U{`|I+u|wdNG~MtB1f6KSz*`BtFQL2HsS? zPWzn%_HgRkSny5nTpk(NE1cdDgLB>$o&5tj2Ssw`n=3ahA1dX1kia1^`(Xly zg?z-$FXR&ruEqJh;g;6!>8l3sry}R0-%-|f0)Hj&cLK)~_&k9h68JHJFA_MB!080O zPT)&XKFP{wh9x>Jl#zw&R}yqYgx?7NE`iG@i+r2F^Easp|9hFfO8jFVy)kkofu9oi zodY(3pA-0n^GpK2C2&?EQu#i4Z_w_HT4|hPPfp+hr?u~_^J3rX7e0PO*}TZ==H$mjA#Pz+ z6P4S91x6NxY|PH{$bG<-A4UYUG)&$QN8dw z3zZmTp^Am-qFmKNH4DV+E!1178iI~wu0)}b-dYxFTe#UmeG4~;qOGnZ~G`m>nYN4rxW)_-TXknq9 zh4vEE(n2c>t%cW@KGQ~cTMN&OQVW$Y`-gw`E7n1Toh*!8kl#@_gGTWMnuQeui=FEq z5-I5>L47QA7t+H*Pm4cBD!07_tpTdioHlC7MAuh@{RI09wjU45MMsGKC}zpR*UR!RcT*Xl8!JhSk+x^?o5&JQtLw^nJwPda)xfMg?Zwg&mPMvEtU7I zlbcwgrBkZ+F1B!+h1C|;SXd%z6y9m!b_+`_EXzt(Sh&N&a`B##B+dnuEE;b9BwE!<;agN6Go+?%z0AN%UiNKG-)ZD9C-g^iZl zE%~4*Z2wuUITsHMxz^=t`9~}~YT+>!+)^*?H*rKXRcncdCHfN*aK0u<$iAA3kxSLoD$6w z9Jy6;zqBxDkZRf61yikazhdpl8@4W`^irQhzOnGFg`X|_V&OXr-_x>%pDeX{*)=Hq z!NQLgNO($`H~jF56`ErIBn}y;o_fw&_|?L1k|NE%ojqeUrAy8Q3%^^)x7B~KQ1cH9 ze_8n3!bMU3)50YSi$j-9_MPPI9}EAo9c>g5{r@an=HxG&FNn?!3f;lV(bR_}R0cku zmzO7@yh^mFjRKqdtYFwEv{B4P#D*rJ#ch-j@~G{fIMY+7T66 zUhJC^l(1ph7}YU16D!k2Z3${TIP`2JZIrW7-bTuXZ=<9HQMtVwI10p@7CbyNuauC` z##KT}+bAo9`ekf1-lh62-Qg9v6>MB>qoIvPHm^&5q} zCd!%Z&Gnd*iK=Gm+qlKXSqW-jWBNul0TLVAxYb4n8y#&lvC-5<8yjtHG_%p%M$4?_ z`f`z13-SK_M7ouY);36ThJ^QL?_?W3G{0R|zrB!ahJ>A192>oC^tRE(Mpql%ZS=5l znB<8xnWAjTz#dX=9EMD$f!!TX07QeQuV_vq3Kv7TQ>3 zW8oV`f3dOH#%(sfmJ%(oal4KCZ9HIOsf}eKyvN2JHkR91ZDWm%6(VG9+-V~=+F2%4Ul_n+$Y`*HU^4?`9s5vHXgL` zx{Wt%JY?fx8_%+;Z9F2HPuO_U#-lbi*?3GOwDUM65`E{02@i)a-g#XK!Q80&x z-`Mz;<3hYY+Bjq5d*MIWDB48j*`0C@LuZyA%3LI>3aKD2>2gMw$_@|(XgW?WKI9UHx zj!MPuDc#bJ0UP^u&9Z5SV>7bN@(82QhITZ5d8M=9A)g?1m@!?mL zhYk;q4{|9f=b*fU?q$;z9Najnux0z=YlerciY>##hnp5M|JOLURti#4@H#=tD+#GA z*ldti)j>4}*E^{0pc@T3sNtZdgT@YSbx_MeZ5B|7s>L>3?T#|{R_QQy9 ziV#YsIhZP38>!Nzn=amZBg0t^W;ri1wo7CBhVmK_;R92qWP z_9PaUMt5fI+$NF>Bg0olhJ14A)2?8tgJllxU~e3CC9UNg9iql`Yl^V-sBo1?);hS$ z!D`{tcnyMs{D$f$^==32M0l^@diFO5_Xr+9uc+Yn5AZgk2=`o;4ue}J9x^$(-QQA;FE&4i{;J2J6DxQ0M;{G zVRt06j(u!Yc%p;8#X+6+>doZyqWOY@7g>SdtI6}^z1lVh+Z}x3;IM<29qe$h+riro zUJ>P;4t6Aj}AX| zaKyn^9Fh(`b8ytb7Yvb>@*;zL!& zuSI@oboiZvZ-i6$t&r2B!|xsZ;NZus{0!%-Y;LVF;V%x(au#(Fb@8i%-yD3r)-H5$ z&cS&H|2p_jBo`P<$nOsR5OUGMpF*f#V@ya#Lid*l|90??kRnA2GxE!PRp=_?bU8wD zT@-P_%T*}JV7|!tzl=p)6bOI*ltq_`Rm?^4tc4OTB3Z7{PLV>Y#auPdmv&LcMcjqq zV#Rbd(oKF?aACQyT?9#r)8!73c zlxSWhnv4<(Vd#)C;VjWF>!O^Cn_Sd$QQk!b7uUO}?&4|}*SM%6`qv6p60GRrIu{)p zs-;4Sr!4**Oy#W2Rb#@c!m9~BE%s{&ujQh)i<-i@U|6|0{|4c81!<~|khdkujlz$Q z32$~$-$g4ItzF#WqJfJhE}BYcLl(bVL1Py*)yM_2K`-sx>f$dkLf*_pb5YKm9d6;G zr3-UxSWX-j+PG-zqO*%GF8?J=wL%9M9bKF`tF;%Tgsu~-bnKOpk|AAPba&B1qI45n zKQ`>?s_Pkhx#;cUm9gQ0)}mGtk8#7lU04aWTuq zY!^dW92etUjCV2I#R!QtTJSOrMhix|7$shEemG_h$G8~l;-9{%2JCU+1ooD`g%7qb zKGVfS7n58}b}@y?v7yJQf=qQWEn|T--`=I;H|rU!gmG#&AiW#r=P~*m7js=a;9{eT zc`oL=SnJ|07Ykf0bg|UMG8c0%Xo zxCmDYQil`H4Qo^%UhQJ_xR7oQgN|DnPWjy~)`{|ct~$U=$$A&}xVTq@|C=Q~Icz;P zF5KYaev!X6E<8Ohe9*;1E}nC-h424eJR(6)xp>sYCKr#nc$@`ql1KNX+@1S`izi)d z7BwbRI6iFOPgN{kjq%~rE}oH~%&VJcg}+xi^1O=|Tx@sovWpj8Y!&%77cXV)Q2(jf z>RSozbQvG+U?-8FSK0l>hg@jUF(@tD0Cu@}&Bg03-f;1$tL_GQQOo$9F-`?TzuhTN!`NZEEaJ| zzuKysof;ozn$P|!=Mv}V398#uerA2azb^jc%@6Ktoyp4sD~Q;-RC;G#9|)yF4H>w9ML@#_fSH-5l_{mCRlZ2-az^D8tOzv67%ru zg(5#*C}Mg@c&Or`st3!1?V*f^vK|}{u7|XTk{&z{Ne{k6ObOERpb23U$z=&topQRL*?CE{m- zl|)#Xxhhj4u+!B%T<@WthnqcAm!R4nZeX=|sOh1W2R=S$YMx(|8uhj7h|Z0I|4j(% z3Nd}{CLv6#%0!jP`W_m3Xe7d0JT%CLj-OJ{*u$+JntEs^!nPB`CPHRU3?G;nHfM2~ z(Y(BGT(!pLu7>Vn{LI9#hllBMny=fpku}w|-X4Z}80MjmhrS;A zdFbz9poc-8I(S&SVV*kb=pmRC)}9n{yISW-;b0F#JgDm*=S1jepE|=mjPfwrQ%565 z2#yqF6uL1U#(5a;sXeh{B`0NTq^}>LUU$ zS=cTmW_Xw>aT|UfOm3yq6r=ESz#I>AJuH+UO6GZ(PyJGAck75r;R2Cg=&9;~LhhBl z&BGE8cd^?@(CzGF9#(l+>S39OJ3K7+u)@Pi4{Iic+a`tIl+lh&Qti9#I*kVvN&cD? zu4X9v2|LmVHS3n`l6@X_d3epkZVzvJc-_MrqWq>{k33ZgH24-f>SUE$ zBKbQKx>sH}ANI&n51c9=`Ap;by{IHE*0?XO<0e_e*9@iq0v) z?^YK3+QT;<{^K<3;ad;iarWah?%{h;IO~C>_<_~J`QO7&ocTGYi5+qpzZ^Kfh-B}8 z2<6qA7gGP6hw~D8$-@O9)cjpcu}hHu!P0s7lf@TPl>9q6{L91NqWq8Gzk-#fgiMGo zCyCr7tR(CtiX@SjRH^GplqF|~b#8OFw5>!5ktCA?41Z%9UNXjJf<0kckNVos}NVz2F z$SXTWlxNuq?Db>z48kNLo;bR2H3XaQ$u9+H6Okz?J3zJxs#N?#< zfuNh2#1!FE1*Zv4PvZ0uYerUwd{z>(#XBd7c|zu9LvI)sp`H0jED%X1)?&%t+9d8u z;bUzjEq-o*NB#tHVWfCVjT9f!Zi7%4a{FwGzRaFY! zHbAo{lGr#+Ev@$mo=V~?_Ov8Ui1%wT6`LM@BZNh(HC-uxm&Es6|BLXaBz_k1qu?1q zmi?C`&I4(x#ZqwgSw&N7 z+AK(+FomjeJ9P4i2yd$xG+p%^x^>e-szp-JQ(%ym!sE;Ho5^oMRN_)dHA6zlT_I)) z2_aSro2Q4ia7Q@3RHO4KOkuAilsh8~#9BIqk||^?mr5Z_p+X8*r*M^omQA5t3Z+vh zlS0`UVeM{i-5KGcA?mKD@+q~}V&0f}8ox&LDZf^dru^xt`4v-WKO;c+b%@l5s=(WTeBi2sgb4TOv8aa*suLekN6rG31 zU)gtYa|#VpXp}`lirNri=b53>8B803icY7?i@`6#pbwqi{$H8)m30 zt>_&l3d03Q2#yrw`*wzoNnvaX_oi@P3gc23pTfKp=BF?rg^4N56iwQhl){uOpUi$c zQ+*4jo0`Hjkxv(#A()iVS;A)vQgcoUbF-YEm=_3Nmckt=EEK*-aB&K^30WezGzH$u zb-VCYOG|8?k(c>Ay*!20B3vQ3Qt(bernQPKE_qm!!demDmBM-rg$GjD$mVz;vLl5DQ+P=Dizz%Tcs9-!e`G6>1dqpxfGrkA^8>|oi8L`$Vx^}wzsD6l6beJustj1 zdpzpDoI=LnDqH7)rf~jL5xUQ2h9?;+ zC&bB5i2})i;rU;u@J$MDbysRkkr7G0PvM6Y3Vam$_>pbR!JfkJlKM~VQ7N1i{xe5( z$q1kBe@)@H6pR-N&WW5aglX#3Tk5sOc}B0Tc5(la!bQ&HK5~8hnZl(M{z>8A6#kMZ zRQOxS<=0)>`TT5T?SkC@Qn)ORUMkQ%P}?cutD4F80Uz|{2~v{z5=2r|6#iXQteB9f zkC>3+K1%qA2p@K!h~`80vF6Ew?JsH<&#JeJaUX^c*M}!MrVrbP<0Ik2^40NGesSaH zIcnDEC@c0Nx#USvPWkYKjGk5`@R9aW(nl$uJH73X7N@xb=e3$??m6K*>Rodq|IG|b z`zYh%t6alLq}_^8V0vx{Zk@KpCv!^e$2Zj#WNK5F~8L3k~}^ek1JIzH<9nAl0Z zvZy#KB)NH3SkK4JKI$_+qY83|7WsEbk-VWr$p0Inuz`<;zUooDRkD$oYV6}yAH8RV zX9hcC#cVSl&3z2>G2BNBA1!@!@zK>sD<7?WwD-|LBDV3-PDoop=7HCb@R$h+T}L0C zM4owQrKB?}MC^C-(cMQsAN_sw@X^ypFJ{08Z*r3_Ky|9jLq{g-^T(U7-5Xd_=Y4A25OMGnbalen-eJu5{e0I3j z$1)#xh{4sAuwTs%FP3sw`B>p&rH?y(be60R6(naU@7P(xDz((^$FtMa0J+P@-9FZd zow4=w^*-+LaW8vUv%>oXNshKIBzA36>;WGeeZ1&ntLQ)I<0&6c`*_I5!#*DI@u-i- zeLNwdn|wSbWacxGCuWCqOzue^n??BR>@ag=@_@*n5g`?x^YLs}f!-}Xp63{!6TToq zk6+W~C_68S_cb4{``G4VJI9@m9U|N%_==BLee4w8a!yFcSajos@ZT2R@bRXE?qhBH z*zIGFc&YQYkat)ubHe*?h&(u`M72(ly&~k_&{N@EHkNq58&^`rE&I#Z5 z@d0Ov0Hp#P^6{aMFMXW!@sW>@MgORee}lYFe04zVQ+CMDiXImH%+T*!n|FlcqM!bm zU?#W6d>r?2xLV=oKECkPzSiTHBFkGBKf$@nwn$EK!1^c>ATPjaA7A_U-Nzq%|L@~l zA3yo{Ig?Kx-~0H%$0Yd%8m`Iz(Z?AHVnV^lG#$w=KF<0$=i@vl9R3}QkKeL7JLiP& zX6x_*^IZK(AO2-dcu{ozVbS<2;Ny~b{}TM0)8^bOHQ(}jwHo}-$7LTmff~-$=Z19e z)X01J^Mc#}?dFEP=Z5(K5I_r{2Pi6P)GQXDK=^@UIfVg6h|S^wN(AaJBsij}6A^`F zbHiwWSO7PGCz5yoGeAPPA;>?Pu>#luoB&VF4et?aB+tH4@Z#L?)wy9()KUR_A?yCm z2?Auc5vD~#&V|8|xnUUKssObE{xbqf2PhNZ`T$eg7M2ZAPBg1>{tr+=c;x_B2e>A{ zb>iizy-lt1t_@Hzz}VlNKj(&PpHV}St`ddwuGCuIUc?pih7s1Kbp#Evq*`y#O}{xHUkN0QCdh5};9l#$vyLV8Z}^ zzAnFmk~$}CUJ^yej@L9mvj8muv<%dtnC8Tpd6(q&?D9{!tpc#{iGc3p)kqEGd$A5%Qj-_+*}XTIcMgs^U{SY1Xl{udvSiaI>4F$+X8G4ur|P5 z0UitRc!0YDtP5~|fCmDsXZy;3d)*h{o&fiX+2jIMIggZ$Y!Gj?1tIU#-WcG)01pRv zM1(5_sg>bF0opGJdoFMu4e(3f+{p{VO>6~`Fm(BX@Ci|VCcv`+o(!;=LodK(Gw*4( z+O0WXoG2(W!lC0|g;M`H)?t7b18fQKyhPkJ)8QV@3GIt-4N&cH;w2H@FWD=%QvLeB z9AHO)cLVGX@JfJJ1H2vJod7!n>r5t7FqI4`C$=$Dp+Nqs^`WF!=nL?1^6|&Kx-k4sLQiq#5Abz>c?-j@1ZnCUHqgS5?pq<0(9!!nH5Z1AOYceD`cZ72p`B>nUKpMWa6UjJ4K0le0eGIKLr02yqFz#mje71 z;BWTQ06hNxuY~f)lrEE#OFtImq>-COv9uc3MbgMiqd<7RAkru*B(X?Exu`{s&57{6 zVxb5#A3ll;XK0BuYVKD{FFlQD8bKQAG-7GQMZpy`(nzFX2{#3+EDER0E3ngW#LMVi z7KLcoAeG&b%k;8^C-dmgK)nntxW z=A|(|jqB5>PMtKGrcr}MPQ%=sZj?r?G-{`Da~k!<;0=N|r7?U_SSO9TY228`r)LU& zKcx(2whPuvW7UZK_{-K!SLaP#6yA~su|XOQCGLtv;g&@qp8{yVaT>QuLQkJ{>1~!q z^E3vgF({1|X|znEYZ~3sXq86mG}@=pA&nOo=eH3%ZPVbNyYZlXJMq4{>B=g-V;Y^( z=*%{ns-_OQJ*@e(dN3qEw4!4Kp1Md2GE;aj#PCuqz zOD!$v8lO`QG(hA#N8}GqV@Mj4(wLma&@_gnF-C%h(^Q%_eCCa0BR0w9>B!7?rBP{& z7KJKsTpHs=I3bORjM(H#TB*hAL(;kebBct{NMk0ekxie*^#4cIdq6u; zyzk?;J=_ZQXU=<`x6C_zc6WAXRwS&zb04`6;Dbu%@Gpl0eHbiqS0Z3_ zldK^E5>w4E!4rI#=)-WqBYYU?!zdqGwaOaf!&o0i``nvG1|B;wPHf7LbO*?I(GuJ& znKj9W$v&*`VI^DHhp9fy^?WOT-yI%w%`%L zu&(Z=u*c5#VSx`zeOM;3YK>G2*+p4GD(Dgp7O~zfvRz91DL+oAJj8xS(q-^k^bG>|@k5rq*W}6S&eb|z;-^wvN$=7?F zZ-+>tvSn#!Qv2ITwa16OKK!cTHx2uI*iZi&Uej=ZW7!9f2Cs(q#Qv-gpZRdehr>R+ z@52W^Y#60Z`*6g^1E6ryhmY7xN2%(g)G;59`*1>HeJJ$MwTE|W-A1`h@Uah{_^`8g z=44?hImP*{x~pRNR6L)Nh{r~$a~zUB{Nlq+AI|&mg%4MK_|bA?1=7=h2X*A+Lr^3Dl;KQTa6Yix=Yj8pskbgvY3C4Ns0yN`s-H zfQEt^3TY@TK7AT^luZ#0B{V#up{Rx&jW4rQF%88vtf8ugN*W#)n`>L`|-geJBDzNw+BhVdFE zux2!L*Dy%KU=2Mq^wiK#Lw}Y|?BCYVTSG6w6B_t}UGw+R&{xA(QflV^;8?{#z%W3} zLgUmx4Q+?HUH!pWHAKTZ8b)durD3RsVPZ2vXsvN>#NmQ_3tlgDv`EGZ9mB>w>rUO{ zG`ug`tK-x}4U;s?)-XrIWDQfqa+Zdv8m4Kuc_C+p7*A)1tm*cyL_~s_V%hDu`<|Dl zQO(sbPvdV&utenZg)Y>vKmcw28K)L$;J;?dk9V`WR0G!&xQ4KdJz>1!!UDr`G43^9 ztrDaJrF`M3Zhve59zG3M!d@p9-GCvd4CBXy?Ea_!oY5ao*vIK8ETkH#u`#Arj zh8r4w=5X%l`$@w!wwGY47!FA$e_;>Na7&!M*64rG#oa?iNWet;44yKGCh-Y7>>N zL+LQYz^@}9pvgqVKm&$w8*fO2wvMQduntQ{gelf?pSE~R96{|l9!E!vZgo_>@BWx| zt(o?PFO`9q^idtNGFX(tt$1^&f)loyto)gMh;^1e2bBg>S!jh z3d!R@6P9a|^3=~to$OAPoyR@AH+W4)OC7Crw9xUo?w-WeXp&-}4MX?AZe8v9!qY}a zTOFNsbkXsKj&?daigPacPU)K3UPlLEQ#_v3*Rrnu=j|jc;|>s4Z|dl-qlb>JI=YGK z#y0PaWGX#%yrrX;$YWpRFeFkxHc9o-(U(;ezzYHN)6rkYbptmHcbE*&aaG5U5^JE) zK{^KO7^34H9Yb}@(J@!YFdf5n%+N7Y#|RxGbxhJRS;r_HqjikeF+t*v5jsxjSoWF4 znN1qyCf*G(t%*7q2zXor=@h|Lcu=kGo&!V4{Yh$?4$|pDy_409Mc!FD`W4EY&D0lp zM?9ZOe4~5DJoXbE@98+i+Saj9#|9l6bu8lHKRQDa7emyX?HwnfKQ9oyJ> zVs1k-Y}c_v$4=26o~*7$+z!dG_lP@%?$NPN$9^4q#eny0HSgpea1%}2q^BJe;hD+m z`eapfiaM<0eH~|Ye5T_A9Y=J0qT`f~qdJc1_)y15u|F>KgwRS;)N4~zrvhB=XHF+sZ7V$I=<9#LC04T zg+pLDvQCQquR<%dcdv}BqHj39>bTd1?{s`G#y<$Haoa8X<%Fb%Yj8zyo%Mx((s514 zZG}4u*LB>`@ti^pg`ai&!l^^KedZ>+Vm#{}XD1!EbkzL2=xrT$#KW&bf7kIF>qo9B zMW(t1{DZTisE8{~RrhuL#aUFLgu>rC{?U<7A-}@EIvz033K3nY*B?Ag<@h*TquRRMD^8F^@u`Ag_uHIp_D>t1ydoU;8V~P3Qj|m(*CSutebng%=fGRd`LImO^cX1`01LT>L!kC51W? zw`yl!+wsNg3a+P6Ux6PpFgd=wBW>OiQ7ILPv!*l5SgtH<<1;)tw*zi=@5c`ReX; z-9F+r)A?!KAB@hT>Z05`mZ|+xd7K58nC?kcbW`ZA&`aTMg&tzolbKPVF+;C^AHK`x z4QFqKJ_`MndwbAVVar7?LqCbK^Kd3Z!4%KbdhW;_q%c@vio#TdAqwv(j8Yh_FjQff z)b>b);S!O?Bbe?fS|hfse5!CpVVA;gg<}fG z*_RadvOX0KDeRLd2a=xm3*b;aC?NZiTf>JH-d8v(k`EM)u(wxp+l!&lbMEoT>wk0~ zwK~erp-yldDSWK(p+a6O{bbVf%IPZ8O8-RIQ=&?EIL*9GS8Ypq&nkST@SVc?@$%YuL_#phHM86;`qtFBY*PM8E{#sPuu=5Pf*z;}Lw~AZx-2rt;Dk^ru zb6MdBg=?JN6|N{;RrpciCxygII$Cn`-4Al=6wmMNHmLXwPW}qNDBM&an{S33G+;76GgZKNICIjHEN9W^ zK6knZF^6kCp&yG!4A=&qrSnHUQ3H;FN(LS`5Hk=rP~JcV17!@9HSnl`a%6|Py^-|w zow=2UrZW(eQuvsGipg9hgrt=XR54K1Ks5tT7+|a?nS|IU;!;xGz*7dEHt>w7C}G5e zhXf{l&H(?hSi?X~1J6q;FR&_lxp`pH3@?iF*i2R1z)J?|819zgR}H*opssKkZ4Y~U3GjSVyuKaC8GovGfQ`LMsOnyH!?XlkIDf#wDd@67v07w@-M@*LTjee9Dw z*Lu0V@gp&AVW5?P*5c%K11$~wA#(THXJB8?%ytIai?)q{wg%oXuxV`GCmzk_@00V* zQXLFLI%hI;63~&AP$nxO=`0emT@7?Iu*$${1Kq_{PXlim=wTqYTe0yeDUn&Kmw~qp zj59FaKyL$m3=A>wj)A^n-`~Ih1N{svecc_xeY?5&A1JCpiM%yV8EoL6r`=oDhO^XA z5sox4%D^xK!wuxj${1mQw?;ImxaHwhU^Ly%QezE_5kM7Lt`(FSnlZt^L<2Jo%rY=Z zyiq&Fz~m(6Y(Le&G-0P3V3;BJtN$xDe3sh^vklBKu*kq-19OwH78sakV7`GJVsl0) zU(+l!-0$@G(s>EXXyDg6nJWzU9K~e@mNQ&SBj!%$A6h*8-gu=ryfsU$5wO|776WSy ztYdfjIc>dxciBD8=lM(Zs0=$Ck3A{&`z|uL(@Mp@UaMKJZ`o--q&8rJZ<1p1D6c0QsRt( zvj)B}@TGyz44gA?YeV{ZiSoJO{`mXcY_)r~;zs7Re)kUTf~dYSa8baa&Z%D;sP{(t zHwL~H$-k0x>v5UI<~;m-@p}V57`P(Z%bZdsW$^Ucs~p;M+#>vB;73u}MZH}Aq~w~g zjpwMJ4gA7sHh|0kZZcyWn0}1&g@#9wmzj5UHv7k%w-#Owq-T4vlk7{{#QNS(s-@thwul9m5#5-?UxN#zAUUi9O6k<&xzxr$YtNRb(MNo?x+QO}P$V#6d7 z+WLMp@Z)941}!O1P`YX)J&K*`6#+Ak<}{VKt^8>1M>9Y6kH~E9ch9AN)sNTwXyM1} zezdBW#TWPW=RUl4w3H}4$okR7k5PV%_Pa;WwDqHdA07R8L)dmg+Y8ODmqLS1esuQp zUoGh2M;AYMY7j$LKi(84h?h-}1YwCB1~c?MH7v`uO>S zUG!rpl*v_;{-PQt>;OLo`Y}i(?}%iuA43GxZJ>-<>n$4NgvViWtZ!H<1xaX&WtvB{6^e(Vs-&3^Yxk}ZPo zG)~>>$2O60t&f2YclxnQw0nf^_Jg5QA>5SI_ll5aJcRau9|!$--;WRcc+ZbRejFAp zKg7*HPw_*b#A~2ZvoenOanz6B@27p}$1$-v?#BsEJM-LLw}1J=FBwYDQ@`AIXY7yt z_{5KI{P@<7Q!Kb2pZjrMB7W+}SwB7#d`9Tw;^Z9rzpQ0d`QE)r_`;7b{rJj{iyUS1 zl>hIv3;u_n_qP!HuQ^{eP5H1=8XrjtbjZ5o$9LlGD$V@vpX})52R|+g=E5dFyt%>} zmM0g|AH|q9Tq?ZI{G7{S*uBxEH-!CJ=r4Y378T{U{rH2EyvXke{Z;61LVuTTMzedI z{5fw2T%Y$j`HMDP*uVYw&ySRIIsb_8U!gR6Ab<&_h*@gDwV^yMfRlffCP=UZ5CgJV z0pty!?WMGuBFPuP;{o?{1s);lcwF7u5fdANnLDUJLZUAco zSQkLO0O|)o<52-L5YRq=4gtJO96+N0UJ2l}09pjlIDn?9Ztra-`ENot;C^CSD&0LG zy}1Zq723OJ+MA`^HJsN2Xc<5&HvN26vYxlKXxj??zW~|=;0=0NxIuQvjV=x&Yo3n;zn`YXIGZrGFZC7fc~BLr(#337vT&lNsn8zz`{8p8)!D z{a-N4K2U7>2QWYa<5I{lD1gDDBBt;i!9xQW7QpZTMg%Z2sZB(r83F0&0LBC`Hh^&f z%nM*X@xt8kLZ<~VA%Ka3CkdSzz|$LYCkvh;lq>db)2K1KE!Q?iTn@0yrf$be^zD*ncWMX?Z58J;$LPz@-4bV^#aJ&IfQIfUg4h zLM*=&+9J)(4I(>;0tq&VLP3~ecd#=Q4uauT8P23RK@=DJPeofr2aA}Z#W1m2!fN_Qa+YI z5DoH2X?Q+}7lMcd5f7pgD0_At~8x@V#i z(314UAZi8CAc&WPs2v11tWo}w#Ny_rIziMGTrY_FLA<^|m0zH~Y3<=Rx;+-ChN5a5 zL=ypxf_Q~ZKRAPX=;)+r5Y5<3LA)l~=0Znsv3G$x54Q+%M|S4x%+-(XKp`Unr#M?=m-U3)reUp-YLDbw^IN@`E2)kX$Av;L$;2?$s@lFs! zgBT`~kwFYk#vKvFPg@EfU*N7Me6`DUGAf80!j1`IY!Ksu7$3x{AXW!4A&7}VER*V* z6vSi!^MjZY#MGd>AAc692w874f|xFtUxo2c*&mipoyqFDm&qIc*+I++VyoLNo}92;R4as1vXY~6yStXPCWy6c z#2}8d+XS&bh&@5<4dUG(HUzOPi0wga4C24Gxm!4Pg4h(qW_Fc|?mX6Jp>nq~$fQKJ z#Ybs7#Q)A9b_qy)#QSx(jNL&@TBsOU@O`5CAc!MD><_y46$gY89As4|@gV_+gLpqF z;b9R>Wzid+qv9bk8J-B@Lt#$~JsHHuL3|R#N5Zykm0huZ3QNkkr$j=)Ly+j_Q(?~t zJuCFkLiKqN=Y#l*v}^G%g7`9suY>r8(_IgBd7-)>px`3)mDpbtT5*y3Hi%1{MuNB* z#CJh_AH+2jzY)acApY#->99!sD3TvI7YU&DD(99H9)h2Opu@F`)U_b43#ObBs(xnE zH1ZPM3gUJUzXkETL}zC1i0W6NWNG$C5O+CtT4XUU{m{uhVJZ1jzM@*D7QOZPV(>?o_!X}Fq%?Nsm4J|bjx(Qk;6NU-DiHV|GBa{vaf|9N& zG$fQBs3NsYL`>KwqAcKI<(P<>pbbI7fPiLYg+5{8NfVEnC}*O)={_q}G*QXK2a8n& z6OWnTanm$*nz+lY`S^3a$(fIvF0E{$ih!>dE3#EhR5S6S={{Ce7fSG~iKhfVos>Ld zB7KRX>NyiNL|9Yk3nrcy5EN|!*Gk5!ZQ>;pbxhQi=yXC440P4N#LFgnnC|@C&_p8^ zisx;bc*R6x!R>@LG4ZO2*Gx1OmNv}bc2bu zNqHLqd>`4-MKUwH*X>6xvB>+a;=p_c&D3~VPdO^Z6;=#m}O!udx(kICgzw}#SU}ZwV!KZk%`47=9!o;uK1hj1tt~> z&a+g7mb#vom{@9Jxrr4Vl}pt!6Nx}of=$qsqNT9*QnlK|8WX*jD&qAFCf+sCv7vh| z3Xjm-V4`wX)@BnMS;^05F>GRmoGL-EMO4%_sg$za#10b|*z-;7G_lLX308%P-6r<1 zGEE#Zab~I7Yw}Pd>=%6dk=z54`GXv@9uHaOhgSiD!zSJr)lpG>Aoz%2+DyLg-XI+_ zaa`p24tei<>E5fHH1Uy%(oDhnIP$-1L61_+WMMEH^HsP6|cnG;6 zln^0Rlv7Bv1T7Up=@2T1P$dLk2wDhs2+|v2*EE=lu(WlMh}Ewh7bxN7(zYC zFljghOKc({WHa4do7tj?+qIf6S564A5Xy&8A%u7cWkM(yLhT{>%ZA*lepG1x&&v4c%N%8RzjtF=ngePen!b>4k4WU{H&xG)-7*`MBDTWub z6W?DwEyCN~+xJ;Lfchac5Kwr9VxWCPVF}j1;3n5Ngr*@h3xP-0H(@1+P4f`itxycFiZKB# zhpkX8*j{qd&g&txOyX7oiVpC!388HWD??Zn!W;AuLjMp3gwQ^OQL@nb7JEnt9Ya{L zLUj^hw-7pq(1j%xmS)`rbWLh`zB+{rJwoW2v`HMg-YbN+C40S-CF&DGU%~x^n$6s| zjRQj%6vD(1mK`lIID{drr42d5LwHAQj!Myn3LYku28=Z#gpp!7O6WMDqeB=I!dR+q zrO^o&<;DsaFWL!I$yvdZLYN%Fln@U-#gY(~hA=IJ=^-o*p>e%@GuV4Wm>0tQkh_y~ z7VG@^lsO@AbLebInt&OYEBF`5-U8`_3q_JGzfM>r_`Yb5Z}s-|=Uv9(wo*O&w1+?b zUd|d0VS6q2C*UOurmqfR4M$%XIbo~~VI9YQ80lfG58>Sq4uo(pgbf^Gw{kayusMW{ z;+%Qt-oO`&XH{6Kws1&>u#G-BMiyu84Pi$J{Kv=65O#&|`}sVldV5NAO8N3wiQOUW z34wqT2HNc7kZhN=Unt`ezZb%x5H5xAT?mImct3>GA$%GF52*PdgyXChj-U{ZhHxyI zldXTHO>gGjVtpu*lOcQ*!fpAm^WzXc3AuZFPl@XJm2T}Nw))Ol>p2s`S>`8%3n6?K z!nqK>AbvjOb9UgB>byi5Dp43KwNciLoQHn_`$|+_3%wY^{dVpn$u}WTvN{1L)k&htt8dz`?TJz;CCQVg_jwaPtm zu5hEYNc^e~iwN5Uu>MyW7L3#*0Qj^`8nla!JEr?>Y#);Ep6BYe4LR@>qE17QTi z_^mR2ugujagu>9uLNAMO7*-hXNAW=vkudBq_C~NTf@l~{7++iX#zKt#!+1B04PlfC zqih&&h0!aFN5d!=#>-(e45NG)6~cHrjAz2`Gy7v(7sZ})=BOEh0!s;Td1~SydlDNLOX=fUcdse@0he- zUn;eW;O;_uI-WPf=o&_y8lG+Qv1p;DMOQ(KT4+k@GwS%F;ax1!Wfg(ju!C9XPILK zbXnx)WI`AdgH?;PF>#$RD<4P#pvhdGGC*dBH_fbcfpfDFbRVeAZJ zR~WmQ?J)L>kYjT%M_CyA!uW5sJO42J^p|@JO36Wvce#srPrxCeJW20^Fph+ADU9#J zI2y*WFwTeZMHt7!I1$FFFiwXtsC4>=VSG$5%yTk~k0iO(qkRm#L*wT3PpG=*Zl?P* zj5A@LUW;>KoE3Wt`4jdVE#3Ri&y)G&edB8z+?}UiCM92oaY5|A3gaS+U(e0|u;KZq zRd?@~zTu3-gCN3~`&3qw$35SNaXE}%!nhg64`EypCqIR8HRbBlZy@>|HZP{4A%c`SGZ5OW^pZZ!gi zf))<1QH3mbj~)Rfq(v>{Sa3MmS}10rxCPyUvXE<`goV-;e3JSj7D`#}F-IkZ9bP+^ zHyD>>q5IW(=^QNlI#jd36H%Bq!-C&J*n(vtAof8Erhvpg*$|VHWk4Fodw3!iY|%!A z@&_O6%-kT8*zgs%P{u-43)Pr&CSl=m3zaRDvryi`V-_k}s2~yl9hXsOgu5{NU3G6I zk#NC{eUicgZxmx&R1x757I+u}ze(e>)srIGR@YPA!c&542z}bZGZvl|d^S7vISWIt zrQLZsmCpG|9v`d-YFb#*HlxAJ^cOAEvM|cRXbZJ1ykw!1h0Yf0SV)|}(9S|#3-v72 zx6r^s3$~+$mn}53(8NMh3ymb9S1dHP@Z}nnzE(MFRpYg8WxlgkHM7v%!mAcuv#@Th zIw$h~)+%eAYw+?qHE^A3X`vOJSZE`zT3dMXo_iGD@v(sa;sT8*_SF=wsnc3tcUAv(Q}(-mF&4&J*l*#0g>e?fTUc&kg_upSFvY@D3lo#ECRvy)_?(oT(Wi0H zS(qil=|X1+{b!w;%@Jf_p@l^j=31C%VZMb077un*%X;lBLqBo8azRU0g9wD9!Z6vkzst5fePf-S5`3)?Jgx1c?j*6m*D`|ql&E!}qw zJ0$K-q54X93Z-@rN6J+XS6~WX_wE(dJ`VPnr_=`Z@&IyR0U7UG_<+VQcn54ye^m0!DwBQ8!f^{Xt7d;Fu1>I)HmJ=T)ReeqUEFh0ghwv8 z)AA=4PFXl_;R|+*m$FY=IAh_gg-y4_-8TY!$kP!hQIKMq_d-!XgpoUr}Bx35rWx3Kz0}5`{lcFC*ZqLhx>I|4CF%*sAyQ@Zp7-d`wt^$`Mp# z(Ha-46v5*x%SJVuPe6@}kyeS|2{CK&Wcu|d(iyQ@1l1#WA%YhpcuG_?ggza?GXkC^ zy`S@31jRPFg(Y?==l=*6{9nfN5oA6nUaqdYa#c(0>qJmnz)M0Y@AjCtZUprrc#JTSWjh4zV{Zv=cM>KDPFhI#Lc-D6f z+>SIWg4ui;m6DPsz{{q4t302L9>Kd2Y=~fC1dAeA&QTM=xe0j}v$NgyL^rD?5iE`1 z^d`0Je< zBOs+2!ylW~{s<04u*Jq!8wXhl9Emm>+Bn21rAe_rIdMgBID+@t-y%2?!8Z|n8^O^C zjzw@bg3ma#2d5rq>(i~|;e^l+IRm#zImzrj;R%(=`Xqu=4DswUtcM5>PgXDgn{s)) z=hFzzJXeCjw=a`dC1Z=KutlAV;L8XuMDRIhxrlq!V^&GOU{&+JG+%b~i1(`qE=KS* zhr^@U1-p71ZBbnstD%>z6CPiX`Rx{!w$(MhEA?)Xj6=AASY8OALG6ZMY$ZG>hc^(^?N!(+2Mm`()ZFv4i zQtGV?MrZKapaGL8XrqvgiZ&|QC~TvM4bw)*Mo}9%HcHwkWuusl;$efG5w!9151z4GRpY58 zNmp-GN4F|U!Zs`$Wo(qS@zP08#75MHW20)#Ok3#p?b2i7Ib~da{werigM4xJRr&ep zqc-MN$==>I_c0sgY?QarD412jMze8aArfc*4e0 zHlDWeB$KdF%|>+_wGGext%^tLu?PjXJsczPZR+;G+d+i$@7Yq?ySXmhLoYL2wg3A{@UnZqoYU? ze|Y4fXZ#$xlkL7_$!wVQrj4#P#xyE;%M^}+&ms&ewx&CKm;p6!19wST+1vRy5-alU8nh5w2!vay&WsFv6L%|~aCcZXVLW4Vou zHa4-zntE5*SZiaQjg>Z5u_>!$uNJz7&R_D7Wq7TNXT6Pg*?)GZ);m<~5hWhkp*Ap| zJ5<>n%BA0UNAE5CMCZJl*)BWOdg(CRSou-B62*2KJ8bN?XEx5+ z*vlHTafH3g#tr!g<$fCnIHsi14%s+t<2@GbM9#Dq(n;SJ`3E*GODf#5?VaL2P#m*y zoE^+Y+U(2|Ha=v(wQ=pXdob*S9qOcw$Lr?%$i~Mu3hq?I3>SxFp5o{$pH;h0?&VJD zgF0k=YU7NJvywz?r+R9q+aW(^W!m`N#veAmu<<36w(*15T(EJ`#@B+s63V{HDBsw) zWaB%Le9Oj~k{Ni;n|KF7?e`)tTgr3A##I}?*tjW@ADLkr*KPb{gXhh@EUDk%FmIRf zvluXL-<_((MOpu`ahoH;#%~<*S08>qc}L8w$Fpj_?XCii8<5WT^>=OD<18ITo+$og zP1<;1<3AgJ+4$SWzY-;*nVW5fe}o;~%)M{qC`gGSHH!2oGNSGboE8NG!7|Ak0spi} z%5x4gqsWRPe-xf5@rrIAQQT_fj*bFRWQ(77s=Es#3Tb?05yc~-+FCiKqyTy-6~*h1yKnIh?o_7= zXK7LBQG}uhN1>uHqPz<#YDRgWuFoGuFp6KE&I&|vVW;|Sr&=`6JE4|akb}=>{q&)i z-#PIA-4zE2OcZ6KcqWQxqj)rma#1`H#gkE# zms~x@=mIJ*8!4{;O3X$SHFv4)|CfE!=c^n=iCwBnlm`sDIWPNkkutj!4=1b|MYSlZ zN6~Ya8nsJxOUXGt*Sm0+dMb*i#o?@!Y_9A*7e$RI>O@hOKBL%_r}*b2&C`LswA&QAnjE>@RX4aS}#zr3=en{hSOshuLc!|g! z+ibTQKi4xUipf#Th+<|GQ<$sGg{O+ar4f03mAupFYLREUNJj2Fa zFZFkaC&S|1YF-rc*{h>i9mRqu7Dll=iWMBT9xRGtaTH6Uc(G&*X4;P$M=%c =p269^HryM3xoQ>kMD9(%I z9NTD*`aB8-f(NxSNoh}(^gFfaCvls1gYyL_US2-s~ai7&2#ZR0b={bsPQCxQ?I^Qo*+@O4q>T|us&(d}Idv4;4 zy=p+u{5Ki5Ru=p49jc=EJ&He~_>FVpUe&gMXU!DvT{$fJF8k_?%zG?U!@P{%=$40+ zH#ybfo{V+gznI(ed0KV${>@2Xulh&w$zx*viz3BANe87Iq&i4*P*f@~-9d%}uY+s{ zaFEAAUI+OcWI9+-K8qpC!K5PY@gv0i`X#@_@;F%6*uBK?`@o`;GkHF60g)GSP}o61 z!LROByyO*eaIdR}fyN93ISz_BDDEKF0e98a_n-uu^+F1l_aAX^y^}kW5D)6)cFxic z0uF)>d=4}Rx_DMXspS?z!-3yH{#oud)M@74g_;gR4x$bm2Vt?~?Q6tAm%YkzFnq7u zQntt!2#z_3J9yMVIR_nQWR!7GHtC;Dwr{WES?=YN65hC8mRJ=XRC3Tz*49`1w zPH+vOH61X}AyqH1b%e=9#}w4R!F|J~d2Y5j2c=%hb&p#WFr9I>y0R z2j}*w(GC}`vo{QI`}{Zu6Ua8oLR!vvcC#Lt1e9~1>|_U194vIO$iY+x(;UopFvr1k z2W2K_&X6S9Ey=vQPt~5Bcc!qj91t`5T-Lzd6s}+|U|ki@p66h9eb0QM)J~c0DY9QJ zcCf_33I{74*!$H|2ag}~EOXFkzsmoYcR5FHW$%E2sn7hK^4X~p*UM$Eawx;$!6yz*CDXmy+wBi;jC1dB#^1<1>)jeCgl|P7XhKM*QF*eGtfg^L@`n2VZlbIrz)LHx9ma@C$p3 zgG&y+b8ywckCNQ?LVsX)643O3di#J|y;l-!bM=#hYYuJ*OS!*I#&rkd7N)JD~*eEeE$9{N~_y$Nl#24u|tL@3PX_zj7YPgT@&}#vM>Yj%NPBcHda|o`bs% zVp;h%98jcxijZ<9@wbD29HhjM8pFR19yl2FO^IRmir#xM>pura2YJ(udx)Dg_N?lk zn-)W{@>%IIyqxVhdO&5w+)FCM-tW^gW5|kOY7En2$Qwhx7|a+#G31ZIBW8LG-Wak4 z7mJ}lGH&4*3MO$OUcPIlUn}OiEh56ALUV*tUOa}}7)m7VOU3X=3<>*^5;u{b(lPjA z(2}ueK(|yWkr+b#LIXmBNhjeLtQcy?@KOws80;7xi=kqSE20leS~dnpa4d$h|G2j+ z@fga8q}DEXR6Z)WTnyy}REVL1m{FCmuM|VI7^;i*@fa${P(|<)LaWB`q<~A(F|wlW z1oBi2PsdO*hUZ1~Obj&yJS+6M|A~@F;sue{63XZ=#;|#=`xKVQNu3z##?YGD80y7P zKZa&8G>@Ty*tb}k*_iDcL&F#sPwrl=iCvGJ|?muc1L)#bz#4s?1H)3cPL-!bZ#L!+0x(MwMLq`FfV(uI5 z&Vswu$>K5{KihaShOP+-8%Q2PZ=QVkN1L88ycI()(WV?!Zwu%hLm&3EfP2O7%SJh< z`o++nZC5voxaC2$V@4(ewS!_9EKw%LFeHX|Vi+y#&=`irFr!M|5yBQvcYDVq7ic0{$2=8+lNTjq$setZ}py$poQ^4M+4aN!ZCkrwE;TP)%n- zF(8gSamdE_MSQ& z!>2KP8N-Db&ctw5%+AN~S<>utk(`sH`H2FPU_^#5VtC;_xAwl0oO~U_H!)lkZKA5b zjp0%Z-^K8K48IP`q-COJ5*{wc@PinaADXwL`1z65{z%rX7;eY#li+JHT#w;K3_nY+ zxEaI9_tY&o6`?_1%YyTc^J=3k+|#c*H1?=k!l!(G9D3Z?x$*8gwrCC`@c zWd2IZ{}%8MQ~cN+1rK8QPb4XEq{fjJcPGF_Z)c_pAkK(`#sm!UuBn-EWW^DV!-^ws z9QooX9!G8*`IGk9ad$D+6Nfh`nYB2hKpX|*C=^HGIEt{V^T&m~GC3qacu!qET4F|n z?4ohx#8Hf%r{v`}pReCjq$T2bBo2QZmroWeDO3|$Dvr_ud`VjTOeSq~VF^?mhTw2f zA6bTgutA|_93cTK26?H9#9_x#D~{T6MB{Mcs1nB$al|D5kH%3>KwM}Up=E^@xS3f# z4o^N$#W*U(-ED&v;&_bJwIGG~{(Gv_AvLX>=kYiyQ+~*8L!ccM^U^Bm`WndoB*r8bZHpo0snzetSv15XXyg zcMA{iT?_Q{w(OJp5~IY?GLBYp)QzKF98KeBCV8&URN{C!j!uWv*h9*@&D$`JSK??a z+D5dToy|Yotv;lh#KAzoq)D5{@oF5elMZw*F|WmWd{%aT+3DOu;;yo?&xf*qY^z$6 zjiYTGZ!n>3&%r}#cjvS=aReIVyZBT#vwgTycDp!s6w2X7l7Q{)$jq?+l!2!VI>*r^ zj?cv5n{jj%a3YRwadeO4fUrH{=o!bXIA+K3Rvf+J7{v;S<84+#9Q?@nojCf$(Kn6( zaSW6wA01LW1Fc^i{S$2d>^~2wL2(R@V~9vtA_D&8B3*MS*`aX^i(~H%Z=u7A_uj+f z7!k)v8W+e6A663^Wz|2d#>6o;j)`$hiep?HTvQw%#{?#QSapnLZHjyO;$zSzca%+z zV@ezsUre3BlD5fw{~hntI37LfofgORIHn#}D-SDDT5=h1W*oZ(&xvDh9Ph@lA&z-* z%#UM997|dD&S|f_;9U^MLUz0ly*V2SFN))ZA;E`*9udks+*zv}&%%i;Jj%l3ESwbnl`LEp zaEfNh!Wj-PSvZ%4OTs*#g$r4@nC0wF&9hFauukC)R;uFmRf5YLLMwn9TDj@+IrNETsgOHmz#5HFLfzD{ADxwY0M9JkO^p^Teb0A+s7pWs#T zor>>Oq^ZcOBA<%eiemOq^qc)@`Vb8RTL2orBr07C@Q$5ief5? z3ofCe>a|2Bv@FYcA?Kwwq?sz(NHO`!T3Ur7l4VqsQ?aa_i}N;Rh4XQDH@)Qr6I4=B zS;ey|vQ*4or#z#g3YC-jWoqsP-apnUeHuC6iPcnWU#I-i+B$QYnvpo%wC%+uY2RJ^WYDD%8Q8LT2KQHF>H;%qPZR5DC;9$Ui&4-&CaD&ABv zM#WgRgca$dRlKD-f7PdMP-=E_&u!|SzSuiX#dsAHR7_N{rLk+-D{lU&;XM(&wDdjn}RZLMaUBwI)@2Hrn;sX^Qs`zY!@-EA$;(ZlAY*6y1dH8tc+K*iul$#rr zd4n^G-SvK?;_nU0$0`B|>8Tr)X_7sHPgKlQF;~TxDrPZzDn3^+M@8?~Gd@+ZyKTnd z;>AA`@8;5JWcrt9mffh-*rn4LdVtP+8>D*jZlTE!aiGKj}JWS{UroPET^ zItf}Y^tzI^QN<<|o7vc^xVNj=!Fo}#RmC=rR}&LI4>>J%;BgO6oY<*imx{gYDW%eO zN$Ga0*u#Nnu=8A|%$1>@eQf6{2*{yZrsO`vcB106iZhbp5ury_To(<;R2&!1385z? zQARwaf-cvl|61%>6&F=p5}9)x27gRAPs>ztUtrTc?xb~@iAv}V6<1ZfTol)sgm9Rd zma;~j#mTn7O%=B!=S3Qknqr^ZJlaaDE^6H02|Qw2*L$2~8JTSZEQU8A6Ntz?<$npZ4Ud;w~W@!?qmSq94bP|k;SeysPSybl$8n4n>zhKk($<-;)_j{8vAhi80v z&4(U7RPmvz56ygN?n5;yVJ3a3?L(Fist-{gVm|nM&?LpM4}Kp4f z6Be9+l$kUoh=BZvVD5{g*Ag7}p}GLuhl%;THWN3EX)$^gg4^46;8~D)Bhej;swxpN-e@SMqaZYZjvnjX5Np4&C(9(wvK6Lb< zRgRu^KD4IhP0GtYwDIxCS!YUwuI>N9?M3)undDalboQYOf#6O;vtuopRfM3caJmWY z{(nMy`q0aVFMOEmLvJ7Y_%P0g@jmnwnSnkG@}ZyL{zCavY=8jnTYTMz!9I-iVH7Lw zmUoB`!+aR-!=l5Up+3AJVqL|;|I|t2Urw&H8R7eHz0I3GjP_xy4_u?Zw{GT_13X;c z^%j%fq>P~{epd+kH^@D4lxuHA2BmG zDew5OutDwxlH$7z?d_s_&xakG6as!MG)zzX(1(wF_^z}2%~bEr?^FA{mO0&r89vPP zVU`b{u%cHN3vX8Lx6Zh+Nh!QpneD@;K78iG=RW5>dFv@1-=gkUn zzIfV~K78fF4?ZmS;cFk}`LI|l@Qn{gH#-B=w?51l&H^9)*{skl6u_YGg#W!zdKU@E zwMAJXV5!h$LTP_a{{QI1Pd;q*VVe&>3;$0aR{QXa55M}b!iV2{_=9Ggk}`Tq%I`j` z6q)i{lr!ICR=?(yVwDf?&d;PHXN?bQeOT|q1|P~#`EOOpIv<8kNogwHjiPF^51S;` zu5U7v<~zTNwussA{N`moD~-9GH`VQ+TQq9=Q4E_IHapGkVahl3K@ zV2fj)LxPX^a9992%L<}4~Uw<@i-Dz};!%+#D+z^c{th!B@-Gf{_K62Igfzs2L$9eJA~-Dcpu{4M{vWTU!4~iO+K#pw8ft2ILBoq0 zY6-u#hB_Mf@BTT>*{DvL`=Y0=hUb~*5zhaJ3T+Ze>FQ}{py4GA^(8Jjmpf-R)X+#n zQw_~DTq>2^Sb~}et)n`>$jfe1nv0in_ zzo)H+_8K~9;QV$wX76&6Hp|mdG<4F?S;H&DH0HMd+DSIZo(%6IVr?a8&|5ly}Y&Z7FE8vfm;4AC%7&ip^WO`-P_ts)39E{6baX!uaWry4%f@R5d(HGIO>rD2+=ox#R%&NE#@UCBl^eO2%* zT8Zy4+ZFC0<5n{M6aQ?x!fmskv(%$qUuu}6;R{hRSHtcL?hh)umu^>Pxm>SK@?4nf z)bczH3)y`%e8YPD&NH9wXRl|0hGV>Jl)e6M@9OQ!ckGoK7HMEl8PO~C;&x>*tyJD! zZikY(Ls`PXZHHr@A0#1yl^T|7_))`88h#e$ZyJ7K_t&sOylT}ju!^;&VYP-e60|l)z>ao71gzE5&TF`!;f{v8!nvs7 z3R{=pOBycc$oJf#T+?u!M)=ZoOPDt_+!VmYW}J9r>ce*^CASs6t>H^a{T@4@hDRD6 zi`WC94~15mn>qch|9amO4S#9)TfN*C;S~0xhye1}l}I?U!#VuCm~e^@s< z$afOjUMQ=egC8CJctyN*J%uUusvm2HrLs7kh1tcAt}LJ*-Tmm}2W$T|KYIAl(~n*v z&`^rgb*GZAs*?&`@0>dA>qoyFJ5SiD^!I~Cqrf1^+Z%oi6Y#pw!9s`lF;u{`T}~;6 z`!T|g$$m`nW27IW{P=vQGQsa`d3e(g9=G_G-+BKTE%a;|?-)PE`oZ58Tpk~J&oj=C zd2RBHr(xAR*Ydh1`ti0OlSG($7%^DUnPz{-kEwoqeoPnqo*(b~@qr&7 z`tgw;9}DwDn$sWYN_?97r|6mC$0y7i3oZgP{g_STFxzRE#Wq=AIlNOjx+uA;o%opu zB<*riudt=a7k+%{$5(#L6+SuSe=V3`9(&m?#kWiOrG=B?0zVego__q~$G3ibCt^#5 ze(%SkoLDcmOjzv467h1)8&|&3=F9x}!H?xRGR-?Ab5t1}^Zx9|FMh1_;}1W6^<#wy z{O-qZwD#Ggw!M?rc@v$alhd-7(6932Pmx*U$LbtyJdKSq{N^HE%bFVFS(GPpgC852 ze;q}2Z1Q8XACUl8^u2|rHyaoCR|ejH^3@Z*lWVKP72i=B>(24cSd zb9eJ8@tzi%Et4&F&X4nKSAJY!3!j{Fft6l2;i6!Q(Or@#3%9zi`f*M0^_);n-!V!y zy~&>9$8BcA&y_hS62M(Q?)iZLas_bTj|YDI<;UNm;i1sSLLUizX_xZEkEenM?ouX5 zYx&2IfBi@fASHkVaft!!k)TDpl%#-jVFVv)#3{Ai=XWVZR}|oR7p?%$VSqP)v;a~A z_-mKq2{>v@pDjC4$ zJw=V(N@f70wRbC}15iZ&uD!)g0QAyPTPy%8fQCB5-Uy(205t+=N<#%u zGk{tWm-~#K6YzWhF9c9qFqPB^psrvZ8r-s0+KU0y3!q^Djf7c0fU#whUJ~3O0NxqN zC?EY)fct|cM%;~s&$D^?^4}!DpBK){VeZdJ3gZI*PrSlKjs7T)hM6BmC@dhrWWlRY~g~zyQGm19&}vMMV+^ ziMQ_Nq}{VUgN4J1(;)%pM0e(GSOCLCU||3w0vH*<)BxTMU=#}?{7C_f7BF7uTdY~y zP%twyP5}Q65g*&FObB42aOTLX>DvKZ+wEAGZnE&F2z^Ir?{M0C0lXi;>;PXB@j-w` zKw}!)Z~z|#@G-m69wpBt=Uaw=9J(0+T(05yg!UhwXY;$xi{H!uX0fSsNY(c!S5n-( zr|+`>J`dpQ0OkcSCx9;k_)3y{d5lKEZ6w*hx*iRWhz%s+tS>{ zrMcD0yYB{YkNsLlE*F}hgU~F9g+P?nvRaI7RjqSP43w_p1=1gh4(uO7e`X_>&QRI zMNmk`=yL9K9X*DpZqSQzQ%qqU_4hmTOGR|_6i`e@aUHo0k=iD_ECaNQ8%0m4sFiT3P5bBFP}S zs)9e-uVe}E>j>yjb@+6U$xtmvfF;s(7&=THVI4tHMGYa5%+|&z1dKvJ8q;CvXsM%> z4qHcD$MZT~&{17S4N+T1XiXi@>8LHZme7^^mCgH=+wx%I<^?8QSNJ@`>O~#(Saux^ zX+U8%5So4D5hb|_y^)T_I-2TersMlwDOJ;)s%fI*qSQ-skte5xj;ne8JM++&H?6gf zm$QR(w9(O4$1CD(mm}XnKzkh}4mkDOF^6C4fKs}E(-Au9=&YlQj;<2aUB{_H$=w9E zJ>a}!Z2rOZ8ry(y{wm>&gcA-Zy>)!~R^g#K-q6uUM_(QNax}lLqrcz*ItJ2uCvtVE zoiIo^Mbe#x>w|UVZSEez8hPYwQEBz4&@dgtb6oMA3msqU{2PwBw3`SsOVxOtZSSP7babnk%)KFu^^K1C z?6x|-)3HFrdUZ=#C}3+Z<&(wEzePGeKCZh68U9eZ^g(Q#DA@AcC5kKm0D8(!6MO~-W|RSzl89a6d; za_ah)j@vY*j=MTO6b_lKZSOsaeqYA}W_X5Y`61<@jz{9Ak8!4jNwdLI9e?RaG>~LC zz5Z{V3*_AYFs&BuuP1x|6+HrB@ z)h>6w)9H#B$PhkpQ3J(t@VMta(iKsT_| zz%m1dfuMnR4ZLR{WWY4=mVq$_!UiG+S{r!TK-56Yz>5az8L$l425K9qV_@H5C2pX| z5#>1p)eY1TPE7;%=D2E+9(LLQF)3w2N0hn-o;UD<0j?yeSQ)jCI0A!?C^L>IYY!By zZ=ivJCI*@sc*#IR14I8x{Wc-}*Ue7Nwpg9o$N*_$p{tK5-0{)OKuZIySY!jqlQLV- z;H_Mx4i&AYcz8?!cdCBTHI*k~wK34vKwks>*bEG`H}IN)9<0H3866CCGSHb>`nOO= z1Fz6r1}+>?QjaQCk18)6Rk|4HYT$8a=gBf_d1^NU-3<`TS&%{6|ETiwQKhGWUIv~l z^ANU9~t=Azz2dq z%#l&cWlm$`7w;kiGYotpc!7bLv=Xx_-q{8|We+tl*T82vapws5+`#?n&aDb`#9tct zO88$Jp!a|L|KV?hIbY}~ZUh$aZI0x30={RfuJ_-L?8U-aB6I~!l-KoxfqxAAYhby7 z9}WCu;AaB|3>;)-8Ti$}MgyA+tT6DKfj6`zBLgd0H8q{*9gZu?apg|~ zYYeP4u-ZUn;V@`?Bd>8F@6(Ombq3ZO*kFKoTG&lTu-U*C1G^0DHZWmF(X9qPILV&M95#pQG6D^gD=PY)zs`N~^x ziI;m!uCuPSv>QSfd|dRlfjhK-fxisg<*>ls#LmKcH}HUi%n2oHNXA3S3F#vPrB66z zr<+;M&2{7T3p%ec-!05I|FY+Ajy6l22WamT%3CLtgdh@why`HS+F5V?cM69lhI=9I{VZtf=Soqg+zLf*6>@&-{bh(bZ+ z3nG6I?|kho5Ol8m=Ca1NCDXY>ZO{~D;R%J84x|TBB#4Y4N_^@q9K>PCdC{OV3dK$; z#R&vIJ)xwZRLCj8+@4hKz33?wMCl-&4I(QDC5SRXR0yJC5M_h->6)ip5aomDF)2@@ zlgfRMXHhNB+ezu1?x++*zmrOpAgVG~CzZ-Vp9#Vo;i0!$kjwHtoXq_6q;hC{kwwLm z)gXL9_&MMQd7r6!TqpMrClxJ-c1K-jPAc3js0R^Z^dO9&bI*7%h#8+d)+T*?t4LTZ z771cOZ|9**7Y$-j=GBE93bfUI=1iK2Q9(>%}0>{G3TwFX-%GB483P1<^E!Wr- z3gXWoRtM2Phyk=o5c7i=7{nl!G>B?7q1a^>+ zQ-hO&n9TMQ#8i=)LNn%1%$8|=&KU~+sh{|65bufn=S!V$hY5drJ`mv#vokOz<)a|> zG;}I!x^O-X;xjg(AU-p6U674iC;;?FGS!= z!E=T3T&(ORWK{mOaOP2)?5AeyTEK1+#Lq!2WEYn9_FWK5gIE^C_dzTY&ikj7#R8TH z-FG3K5$S#q@48dUasfXIC4b&2$~vz;+%)xfQM%l^va%g4i6ymLRrDXsJ!EZB$4* zZ+7hpVut|Yog5aLr4ejy<{@Rog=16p2C*-Qqd^=CVt)_^f;brD6-Wt7_q%wD=!Jc* zU+yNHtekL&1IrxO;UJC(Aa2&ob36#9bwU!QwuhS>ohOBPDu{pgyBK;lh;u>wLvIl0 zgSZgHqaYp!aWRNXL0k{wMi7@p!}a~Ht88g^6RxmfpG=|=t_49#N9N5SZUu2)Bwya- zx*f#bAnwtsOq6=|y9nr*bGp)96CQ}RAcNA!q!d#aeH6N(AvjO6LwCHG~&Jcrk?BA>;|6atP0a z;0eJSf)YZR5Yj@(8$!Mi@=HWom4*LgtA$CBN5?5OIlwn*3QGlSVl%;$KE}*<9sTo3@9DXeU&k3z9luGIf zcwT7su^7})FN6lnm@w-LP3@P`FoZ@Syv$nuIlZw^E)Hoaph*Z#1vI0%LinLoDrH&- zM?bCX?&5A00%>dEbZw(Bv`q+YLuePmcfVz}7d{23u!G=^LSGR|VJhq#LYENUF)`Id z*ATkV_#xa4p?e6gg)lyZ2_f_dp=ZcBZe>&my+Y_6!W-i4BXp2ZhV~7iUkLrhJ0OIC zIsBkI+3!xK!0S1j!2*VaFjPS6)6R)5!$KGy!kdEW9U(y@h0Z&zyeWYE(E{EIVN4EZ ztblPL=d9XZ-=|Lu;q4F>hp;4sNn&JL{<9D!hcJaD70!ntd=$de5Z;xz?@{t*(g%Xy z7rLT#p36g=PyUbDdPDdmgqa~smmub0MhHAG_FikJPy`g46~gQgJ{9F1C#BGlNg9hK ze;&e|5WWauZV2CmFkfW83}IdfsmW_Y z_&J1MLijy|m7?U=5LSfno8Zl3m6kGTnSGM^b7z!4LijU;)gi13f!=5n7bzXnotNfa z6T*;=scpsk<{4!}2pdD#6vF0^vt8nN>x>->lgA$Ogd6AH5&}2u>;160q9QyfE{_4GZfke&_UTnN|6 z58-?W7ecr~Rg*jyL*T;2OCfab<$TYU7@Bn1sZ+N#D3x?ZvpiSX5_)>Cu{O^t1UG5S z3hrAW+-7??>fycm$0u2CrhYGk`|Q6anwfYI!b1+iCaRct6vAT;#U|2BJPF}x z2ni+ZrQ8zMb!qPmINIh-0MYUSXX0&*8ie@?(J=bQ<1 zx;iH63TNG)UV2|J@uGO^nRv-WL&5b;G!Q_6?5s8tZxa)Z1)LLY*%u==H^EoCHYVB% zXd$$v&{if|3wT-Ry|YP_Y-jQyJ`6T7#6$;aD&0(UH__3=D<=M?orT$1XeZP8BT375 zG4XV&r>ijOZ8A-H%|s6q15FHKO_}IrqMwQWCVHEga^Bm=bS|7NbG_it-o(CaMduZ| z>gScuSGsCncLt~dCXUr}XEaK9-2@l*^L_+=!KF8LbDPyr6K|M!%fuKH!%Pe}G19~+ z6C;@6^Uit(w$*b7ik8fu{-%i^T6jjYvrI0+KUsAy<@$Jl=SG%ytch_ZCYpGg1!rA9 z>mF}n0+k%}@J}3f;(Yj-XOfA@rZbT>#e{!RD%a}snELs%N*$S)=hs(L-!<_b3m8Vv zFy1%u0o!C46~p+@#78FXn7C`=V-wR%tT6GL>0IG4-NbAYpPHDz*E>V#Cnjc^I6uWT zE5~jO`pm@VCKj7mVq%VoFHC%A;(Ox8x#ybriam%8UcBVg^Lyvz;9*q~zsbS#1uQVJ zFo*N4$wO-s8D)`ho)a97C$98+mkMXOi62cYqs3@O2^}PqQGPP=n*Fb{08T zbH9lhEfaFZynmio4w*P?;;e~tB6GyVaT6y@92GC)9usi*ymB&!bK1nI9Q>E)KO^34 z9n;R6xM1R{iEAb%zZj;+B9LG}jeZ^$W^v z@n)|qqU4sJGwzwV&w(_Id|^DGd_C6__Ae6;1wRr>=3@c-ZYKT3j>(}r40jm+aJc3G z7)El~iI@-u1rh}}-IcWGX40%7g~?9|17YL}gI)^Ikx54Z($p~Wgy9Ku{CAZ6kM9+2 zX<_GH07juOY5p(@h*+603WiZAjG|!_3nN{aMT8d4(Zh%tIhfIlhfzYjrG%CYBU6%K zRD3&RqAD2#9zkuXdVW|oT8b49~Am&Y*_ zqcavc)NG45ct4|KZvVKm6e|JN53hVm7(aTra)XdgxgW{gq7XcJYA%P z;J>OTFLot=D0SL8jF-b`BbnzZj&yCqXeVOC%$6rggo0%K67hy~5}ncGm5D$G9RtB8-t?^bMn5 z82!T-5Ju(g&V1>>Fb0Xh@GxE%K<3ae2It@*0{*<9yb;E*F!I0ZyfbsIGJEoq=a7sF z<4rcjvhI0dj1J>1w(~HLUcs0!#)k182W_VK&^0cMNnuP5V|*AB!k8Gwr3(t(+XASQ zcwa1YN*M1*ic^`~(#)psrqD5z?p@(AL;{xg z8!7dCp$mjA6#8u#*XB3}Eq))yqA(VRu_TOxY*b+^4P#jt8^hQX=6QWs9>&Tr{*dH; z6uKgepThW=?en7YOBlZjlQ`P~+2A)}{x0;@i^{4n{-lNfNnIDl>M+(&!yIRb?t3ta zU~Sl0tIY2Lt}^0jOY6hfz`Oho=9(NXOu9LYEn(~oV^Oq9_T^3A9mZY`5scW#y@%oUtq+9p+eL-oa2Q8e zzhPVs<7gPi*#5&fAI5RE@Lm}w!Z^u(XQnOr&U-41FK)WeWEYA*0+=gF@oX4$=PoLb zE-Ic&%7rj4hGAb)_WYQ+_IWoC@9lm`xe~_JFmAFh(DGqiXYJqe-e5~>=Njhsyyx?d zyrg7oEz0v?Z-;S*jqsA<|G7Yi;+ZAKd3$tpy*VOv{@5b-sWy&y91p^H7{;S89*5zI z!5zbsFrJ2y7De7D{*oN#iNF)V-+Tm!_g{|i5obK4ONby*aFWnup(#RJ2itJ zCDbi6RcP)AicLzKngMSFX%V~=!PE%yMvyOpW)U=xAb$jFo4QLyP&$GF5fqG|Pz31_ zl!&0DX!!n;QaFMl5oAPAl-eRF9{KORv1VZ-ymQ>gMDmGvZvNMX=|R(r1B( zREeNW1a<`R2+BrKE&?qAe+1oNwJd9GnbquT1BwlEjjOs z^p0hm#cal1#;WhD@S9zi66Xaq(CLE(oZU=YPZ5tzccbIuv( zOA3>_4nI~LYsVyrz+!X>svbd&2wsTb#RzIjXzd8UjdJ)eH*yB;CbU(jl%|wV^$fVIw1{BTkixAacsYWW zBH1c}fwi2es_Lav+CAiadJtF8C!D|x4gWucM@FeU{?{6B79A_A7wD8}G;6aD~#%-=zCx2W76C#)x!FUniL0Dwcy)E9!LMKIVPRd386ybQT zDDOt_UIZH=*cie45quEAf(RBy@FCL`nXe-JQ-f&{d?w!M5j?jtb9TfzqVYT;k4&;EM?6Mx1+izZ4GVt6N-AmJTZ9 zZ|MFyf_V{q6Ty55dNN4KK4XE=$^SNj?;=-@YhE0X9TP1 z9pqiZQg=_`3jmjW^1KLjg?C-V*=e|*t)-OnZnG(Z%@JH@Nh8=2!PW?lL~vA8ZHr)6 z1iK^HdEUD{g2Rn-?;vK4Us1SDjFh?J54$}P?2TZ?6=h!p2O>Dgru(sHKkXytWfF%N zmyPGP^9{20ib7EEBiFGAjyp~*hae-r3lr8SG zGaNLoC}$;C1Q(q4Beldbe93SL{f+`Q(|6Ebh-Rb<@c{PG-9QsD_d*Z}s+TRiU!*M=}q$sKdy#Gd!5XH-HrN-}iZja8>^{P_3c}8*+ zDN*E(B2N^EB3BgeURAi|+!cj8iqt43Tva#+#bp3&Y^3z25B2a`H&4`gWG5!25qqPU zcU9SVRmm4c{wO|*;^Qa^L{Tt`SEJ|@MWHCtiMjYZio#J8i9(OUh$173qES?3_M#{j zMe!)gMo}*6T;W$Dit^W#(oE%KQpqSXqbL={#j8&HOueQMC{gfOvofNVlJ7n(P(F$Z zOg)rVC5no|uN=jbt=>w4yU#4b>5*pyQ_1?CnYFGd?0wHhkrjoX1&<}FQRhejUlbZM z?@!|dSF39ZpZoLnQ9p{tQ8bC7K@=}V;cJ@v#H*dv0A*IN7`Tyr)GJEu&~9lI^4D5JhXY5b>VUPzJptz;!9% z-6-A@{C*T42&jABMS+DGnIA?$N<1x!=~3t8?Nw3Ch~kqd7BGm-M&v(_;%+I=EWxvd zGRmh>d?vV&BStg#9j?Q_Q_Iie))?-N^(x#$6soHn@I1;pd#t-v#^<#jiP>6;b?_gS%c= zRti4#df`8!SpKC`kAFt7I*K(>tc~Jy6lbV5iuKaW_C~QGijC|eQS6|VgvkfQwkS47 zu_cPF!eJxiO(kQlJEH-2e^7v6C!225j6G58qE&A>%D7g|^-gD6=fhGAbSXJsc~ zu^39lP+CHZ$528*$rv(Y&e7=ntD8*~;g^e{d<KO zafzcb=ifR33vS0yOJtbOcnsA=32}`WY6_+pz0bu^JBB(j)D_`+LZ6S}g&h6V`C<;9 zdPAunLxUK|Wc2J58^+K`yp2U|bHPnwXeyvtjwCbLB8HYRv=XtGbMn(V_TOD6ZG@9; zz4kG5h#}EJl7)^jyb{C07`~-I44q;a9m88ObdI4*3?>x=HkYF)X>EbdRBD z484T&n$R9X|9#KfTR>l$@rcqVhFdojI;Sdy-#>-|Hyy8eQyCP)>ufDC43D9SJF&}a zX@g@J5_68D92&zLEQ{$mv^;?)>Gi*q%u{zp(D+LW@Nqmc2CmMk^R&>Y7^XFGmfyT7 z%8AFsFqY+w;o}&_vEpKw9K)2DGs8b2hKVtJ-rDK2yY{-?X0v%(h;M6?826@gZtXj? zgDd^r7~YFvY7Bd~7ae)i`KzTBPJ2J*>?Zz@8NR7}Ae2g`N()bFTX0p>tjTbv}fNc}&V@F(eylTW>0Jd*%K-2GY5rYHkc2HSfF_ zzKr3k7?ga8U&nA%EO1%`zKLNzJ8#&#Am-d^#}{K_g70GZK8DRPY>DAY2`q}?hZvT} zuvpBpMCekXDYukm93pNxRq$gBKgF++OAISx_#=j2g+qbg1gsF6aZC9rWXtdSU&-cM@JeI>UzYlnhz4nJ|W{(~_b z7UhS8u3F>bSN{>glSJlt3@2hZBb<|L@C|aGis7_)dyYw|HRivucg3vavoV~LUUObT zFEEGg{`=DW_Lg#4n0I2hOKZn)HHK?3T#w-tI6b~sl0D~7*C;lDBGHi2?^6UqFC zsehfxB?0An6iKi^y788hY$3%$z=Cc87IIloEUvGH%YxfNhJ~UQQZ3}R;I)v(@!xW4 z$0L+CFcN3eycY6VC}^ROh5Qm)KxosK94lqhbPEX^in^Zh6tPg)!pU0-9YgO3EoM0{ zMVS^#S@7Ieid!gQ;o#UjrEe=GEs(A%S%Shmv$3@GpK&Jr;4RC7Sa`-l6$|A>Lq!Xf zEL5=2`e7k{F@3pFjgXrZ2kS{6RLt<({nRP~&I+Cujwq}LVjyoDD8 zOpYfXIFUeC-$DZmFI#A1;Ux5h|`Uc%{jN9k*! zpM}8|hFIutVSt4}7GAgT_me_gQZi7)DBrQ8ds->%tcX{W9QzNo@P>uq7DiYYW?|an zgcd6+Sh{cE>E^<2TzbCx!T6j-{KNS1FFZctYzepJeW;yof zu};%0OlNgl_}sz_3!hjxJvVc5I?cK$qQurZArga z_|?J+3%^-dZDEat-z}^ZovSST!PZ`sOLNm+z3UXG?p=j5OMgn}_`Awl0qZQRr}0JL z>$}PZ3upUga@vZRV6%lS7LHpuVPUJt@3FAg!Zr)rE$pzc)50#{Q~xioqoXNZ2+gg>k9sn3$qv z1E(+Se<9(dg^Lz0SvbWi_j!^STu@_m~*VR95BxGA9&z- zac1_ft!fE8FPyx3`i|Y9{9y8z0Jvsnu*eYh%MbCCkR>*`5ur zx)$D3IL*cPNlI!q{M2tFNaeP(Q$Uv-p1G&+79qYz{oLLivSHfJsa*VP!zkP#xU+oP z-}jWLjhKx;Y^<_jF|Lh~Hb&Wq+o*1%t&MgzYS^f0qcP28qn3^5Y`kcro{icz>PSK_ z*tk_Jqpsk{q2%WUFqK00o$U1(>8fv|fsLm3l}0vRlF)`WwEIdq`A0w*f)ax=`rKEV z+Gu8@rHxiLn%ih$V`6U)&wS=(_dJ@9huE(gmD-x=J}vaJjW#xT_6sk!<;!iohOV~1 zWwt7p*4{=38+~l_wb9YWD>i!A=*dKBy8B9J8(nC58}sffze)DG(%`nUQ0FxpyYDOA zSwO#g@=PyrwKdMamAjRkX4Z>E9+#&#tues$L@q)d)WO})Mt>WFScA-P>14BH>Hr%9 znNTZF6WMgbgNqq`u#FLHe($Fav3b!U-mtmZ0mH=(C$D<4XI7hh;%vm=2AN(*z1v2n zzDXrEKDRN)##=VV*!X~r!Nyn{<7~WRW2%kuqTy|J6B`p)DJ>Hw3g?oPYqE_gY_4A? z^M@TZ=YOEk5%?Y`@3NsjP~M|i8s;XTdtW#|y#6>R>&V~?Hnu-)thP}wjzV#)kz8%FvE9a6 z8|!SW7tR(NTiGjZY!vUPe#x8IUnXU27D~XJ(BadBN&_-D6T8F4P8&DbS#0d0p=_MB zan8mb8+&aWwQ-Euu(4mX9k#(o_5m9QZ5$HLH&V2cZC%;F?T!d@moS;iaT_OXoD${< zW~`UOy&iO@g>%LR@of<<_DDHz0Uwh{BPLoQC~SFu{OF$`cz; z#rsJ~{KZt*`*K2OOG3XtQs^k07)MeZdE)TIksL=#9IiOraTFV)AdXXylw5I?jygLl ziAm{F|@L1{Sx`Qzw1I+?D32z2b?JkB0JQqton9ETA{ zFpeT|WW-S+j*4--SIRL+QDz{H;&Jdg%gi`R#Ze-Tl5y|~%cT0sh%_|LKWEup*Ka57ds zjv8@XsfDYxP?Nch<4FxXt%2v_s2#@#)$w6<)QO{R9I4fjyE>kafCed)vH&zy1J{o`iH+tcjV>ek1oE+j}dHrKl;tDXx^G<_s(2@ zJeRNj@|fjOevJ0xPCq8Gdi@yV#{@ra_hYOdxA`&NkKf1Tj`QR61s}f){(WjL3F|61 zo^^Ce-bD7*i@rPj-Y5KxFZ%dK=(*SPjEla>e%$59bU$YJF@^kc_T7F=^`m@v?%0by zUevC9=XI@VlFxHfQ)jXp^r<+@k9+)hZ*)dSrQqlOnf!^v?2EqHe(%O%awvVSAM^Zp z#gAA0nD57Zeys8189x^Iv5-1`JnF|HKNgG42L+e-v6S6dIBR|xy%&8C`1x=2JQ8Mr zEQVN&@1xOjAuC_{CL5S7yWpSSsh++z0}w`KX@<>-SaGU^>UKb`uXdg%6&GEXL;Fa>pc%V<;OSdtD`l`EiNUnjgRV@tYri`|*z-XW9Qb$~fWs!8f2T ze3{7s^#=#b$?7~pjh~wG#dRJpHnP6=LG(F4_~QKqKmO&6`ffShc|SgFltscd)kQz@ zQoIab@#89I_y95jxaLPn0I30_1#p+1$~6Xm`oj|;xUA*SK7Gl@lVcG;<$JR$1n^<6 z9RBy@?@PYSfcL^PT~+|kKAm0pvaezQxtyH>&;rN{AU}Y{0W=AqQoyT(ngNv2NB~s= zs2V_csP{feQ2^Bfs4fZx0q^dB!omQ~UGP4!ta({x?*K{yC=KAf?p~eK)e!wYHN4s` z7hW%bS^?A+?h~vNfFh(qxBm`It{VU^puEejA3%cu8cHZFG&`NvNO%iLu4w>=9x7}V zKLIvw1k@yE}8+1kjc?1L!Vl?F2gp&|b(peN#FFyuAsY zQqoBzodvrD&{asU%RV}0poe(X0QktxA3z`g>I7LuBBw$qfL1A4RE~&*2I-}oYD7JN zQ2~q&zzDz$z!G6RfSv)^!kqwIA+Z3)Ns5e>AiV+@9KetOdI!)afa?P28$ka628jN` z%f5a>o;#fT;$`3EVAk~k3=CipFGFqfc+0;%Y3=vRzM%o!Aj&rdFiZ$j8BUVq31!Y& zBLWyH!kYze383N?U%M+lqI<=6E8F_1+^GRf3t&tDV_ApHHhX3OFV^sa#s@GlfI9-1 z5WwxCy!gi4Wwu9uuAxIf~x~~h66KzH5_8!d%dM~dfr+IB5xnhT>XIWtt&pBGt6Il z@qZ|@4i~Hs;04x9051iwA%K?yXt5~omO**^Q~b*V^LWerN&v3~u;+@8-|xRFrbu2F z2`^`qzZt+=0lXc+#sIbiur+{9$rLvWc}Fnu2^jHR@xC9xHjZxLiKo^daGnwGM@jvJ zoKZ-21h6xJ9|HI>fKLM06~N&Djs&nF0la5lg*J#a37-^IwE0sIvJ&ZYbz-X2%I68$Yau_>@^ zOToY5y%4~~0L}}i4$pR8cU#7XLkceiaG5=@dLB95z^lG%EKU#^K_KYOC#izzL8J+p zB1ur5xc#XRL}n0KLA*ZKTd!t|4oOZBJLErin?5XGb=8*_M1BzELDUMOQV^AcC=8+~ zh$^CAHHd0KG?f3$GH&%C3X*n;=6i4MZIVQbgD452G>F7GR5e7WW)Nkx_O7?sraN@i z_xMm>%Vt@%gYX4WFNpd+gP78y{JS42v<{+85N(5K7eu!px(Crd=pBjKDTvOr zDMmUb61vCB?do9R%42C=g6JAV;(SXAUpbc6gT=Y#3k1FQVf;bwz|6nX(y1H_BE;Hz z)4S@0CA6E*dukmGLJOi#5Z48v2Vn%!Q&M4&8H6p|61+*y+jN3(gNOwY7vr?n`kF6x z&Bs^o_%>QE(d;dlIIFX75dDG}E|UI13}CEe==DJi3}R3+SA#{KKw6{ap+Vdb#4vF; zN+^YsuX(+6!!_>+%A0~1A!Xs_1z$J4C5TZ$Ob+5MR%7F=(Sj2NZxtL9#8@G>2~uZV z5aWeU5WHP5m{Em6cO-T03}RA}ulYQMK~sXbCn>o*h^fM-2~HQBAvjZTmLOww-Je06 z9mKsNnIkwi89FbB`NHoLTp*Z8Zn2boe-HOlj{DtwKX9`cr@^g3Y!TjRjMrz{Pbq$vV<%Oy zGBdXY@c~2YXMM$H$>*|I@=m$Zf6ESIGu*LbcyScvd8|_Pcl)^k)!%iSX|r&IR$W$o~l

    RHF;ew<{ zeadO=au8QIw}+7)#?>IMv5$rDLYt(EO11Ia0L{s)tZ1gv#QrB3Lzqxo6WDn)o8A zAcVpYN)|@HWh3V!p|MO{3pJ{YA!;0TZH)ivL~l&9YQ;i zw@HS!4S8RLF{phA9YW}sly?%sQZT5q@a@lf2N84&Asj*^gzh5j5rRL21)1qZZHodS z1VcRH+xs4hE+m|vVyPj}tB1gks%Rk^0>8b|LRc$bX)$QSyD4S}RtR#Bx1PzP z+B?#JHixi9$USKa{~xqYkape+;r)=ev-|-kij4Gm-P5;)@SY?=Wb_Xu)~Phb_@-dH z@O>Q7A?y_WPeRxg!fpXr1c6u9x(J+i=VKfh;Q5cQG*pjX^P1>hg6N&h8xM?7e|@ zYZ!l2OFvsJeQX%FvBh`fjthg^ptp^u&pC)54e`LVBmOF9p1l=%_%P6~;Yb%ogKI1@9G{6UN*y=7lj|yo`*!gx~13c;rYU+(37)nU9I#v5U*3FDbCUX{>i1)mpOD@f(% zgsc-B^=-;}AuojSVnQK|mxXLdcuTV;Kw+#`!bp(U!l2`yStxunjJLwr6UN>!-VS3U zyHXzf-7wB=sjvm!+(>sr&GZk#_%Mu*!`L3i zN1~QMh9=bLwF)wJgmM3|!r^DVJ;YDK*hTxd7w-;(d&*3Gwvn|jjQwGp4&&P}4uo+q zjN@YM(=ZOPZ-?Uf*86``337(>UWN1@I8`pn{Vt5}=>})pnL;PX6oczW0OOTET%S3#k-dj%ymf;7>j z*#Q-lj0k9o4iQuko+%h=kVj#51UV5@j376HYROoS%uLUVAU}ewCFzw!SS5nW5iIEI zT~;nnFRCiSSu={d&nT)cynr?%_@y#VBwew{O9V>=YeY~p;;rboD55J9&gE9^2)}er zZyrI52z(JJ5!4a=yEhaxh@h_UJv-9sMNmKD-IXNPR19qxL8Ay7N6;jKrV;F@3JRM= z{zE22FR^6=ts>|ZLGK7!N6;pMXargWZ6jzGLDvYnMbJLtefZW%u!A7I9V6a{btH71 zMc5^RnH9W7?;b&q2*M)t3kC%Pf+@4Szh8xfKPCDR;S{Pu79T7j*M+-+Mg(RAmT+6p zN#KiBsX2K_eoVY^!JdM9D=1yw$m|orb*v(h^cB2bu%BRmL0T9P!4Hy?fg%|c!C)an zA{Z)U;-_Ag=xz}2Fu_}<6jL%>_)QUv5JJhw2#(G4lt)D{I)aZP_&9=FBN!9G$_Sp0 zU~B}pMQ~39v!(gQMKCdfJA{uHoFI5Ro4#o(JJp>LOp0KJ2{E%!%NU2p)}KZUplpSQx<~QJ61ypI{;b3zB?s z1WSZJ7{SsA?vG$u1P_RW2_=+UT~1@_bnS#ZB%u#;D9Oea<&TNv$p{`7Ldo(7o{)kt z^NF}CBIhzl;6;(F5qwVY8Np{GSS#e0dEQB_>x4fqNbh>aou0X)dFo3M zY>42^2;P#Qmjz!Fd`0k8!Qt`<_jTcK2quib9l?7MydS~F2sTCVjs$Iupm`u`a|ByB z&?Nts;JXq!N;p5d+!n!ytc1>a+}Qmff=?zD&tK^s%*E~9?HryFWT=3OoeYZLR0Q8d zuq%SyV&v-x_C&BZg3RF+zlvaA1p6cSJc2JGI1s_X2tJD-GBoqk2wI-X=0QM*BHlNc zEcl#cee#I2!x3!$IPXXVUq*)1W#{v2Xhr4z zOV;5`rH%?B?bKJ%K=r=7Zm5F4o}r}Wg4`>^iW{l8oT-##DUDU|#Ws>=Dw?b4prWG+ zehk|}MH>}uRkT!j4v#`fD=9*238fwWMWUUGJ`5U@%U2@Xt01naQtrew)dK{vj&yo!+JmHO}NvmDiX1K$;e$ZL5$RrFG^SH(V+ zPa3m&(+(FKIZ7WD*U_?yekvBKSj1AO7@*>26}PCkUd2Gw+Z-P*b_S^!s^SLWg9V4M zzhx{;KWVuZ?LYVt->C)>-OJ}P^ZiqR^jshF}jA>O6aa-SBmM#VGi zIl`&1nxlA)H@`irVy%kjlk(>{a_(K68}U#mJ+Q;kSfuWCqT9-S2HSbfLGQwu#Ymyt}-k zIm#9l_c>WxRlLhi`(`#zfdA)JA0O|3)H-+IxZL+uY~$EJP~ii?T`E2l@)1V?$IDCJ zVwG;YiX9@~$tD)UmyYNXp}R%0hxIRaa}@3u$>$vV31t5%cb`V zP8TYUsQ6OFX$ksDkU=Me92Gn!cwF#n6{lV(rou__o)V<@oBzqfw<0{F;=5$%;9$y+ zD*ug$e>I%f@H3|`R#X(PM)51hBj=weI!3+PIIH3+I~(r;B<>$7{#5Z-($0Amf2;UM z#kr*9Um>X@a_JbI?t+SoBD|E;xvb(!l5-7~5=CkhB~g?{krqXI)SIHKM3E5%qNo@} zu1G2fW=Fk+Zl+*X6xAy#{5~ru3V+mV_w4<-d7?&MDT@3gPy9xwvUt^sO4TT;F>Vz7 zD=P6weo++sfU7{TP;mB=?Bb|*H%C_?mQo{%no-n=qHYvrQItnfI|^SEd_kJ8Mb(O8 zPj=3G1vz(BRGzD-C{aASKbNnA@{K{hpII-8`cbrqqGc2fqU^xlTkg%GXcR@`sP_X$ z9-h#I`Tr}gsUUMsPDj!_im8LWSBw4IyrVu_MbS3uo$~s?sI=Bme8e9YN3pS@vbUnb zw+h=u(LRbL!?RCSREV9T=p4ngD5gizC5p;#`}8P`D7r@ZG7{hBLJz48&8s>Dn3<-z zktj0zrv_Or3A*!09=&1V#kt8h$u!yF*=HoqH}W;gKqZLFf?@wd)F9m@)`0} z@vRa%R&Y!dKh($PyRvx7G(#_yVSE%5qPR1PNuqFj6n8|y1A-VjG3vd!S3Itej*`hy z+$B0w1*b%Dw~%XzJUcmc^1R9nWq3ckpAp5{D4vUAW)!ocxQAULiie|kgk_9^3Uo`N zm?L~{6!Tc0!?OCU%$^^`eIi^C#bO}~llqH~HPerj(I6oX${@XG~{b|i#kypiQ-F+ zh$uEi@ktcBqIf5Y%^WFFd>qA=D7Hp1F;Dp*ig%-UFN*i0*cQdf`M&g8pkt%Z&1?a> zw=3m-7{zbRbE*GGp0Zt9a3>opPuU^-qfuVJ-Ljw}kKEbK86b*Jqc{}B-YE7(u|J9f zqSmHE6@I+)dE31A^OS?@s-Gf8aXQ-@)St0i9?0dq@j2(Ze5E8``67yM2Up~)5r?B_ zmap(l$giR}8pR(`{29fuD2_+*J$q&pUq^8wif?F2QaLGjihW-GiPmyu2Hm$JJQKxt zoNeT+Zzjs&c8~0){TRhhqHtF5XU_aAukc@@F!Q}G>J@Nw23Hy+ze^Cw&$E1gMe#T1 zY7OZcPe#JIC@w^CQ562=q&+_Kyzphcv&$9if7o{^ipx=4<9N|mL3+J8r)H`LHrB#ktj z$X9qMV!BgILWO1;nrmpIp{<4%8d_>-os8Q`^L}>B#pfl_-qpR^FraO$(%TcQYRuq!FIR#N6wQX&!> z)u3rmg+C(3X}|P%T4FtBYOpl)($Jd`H8>h#8sehtY8XA!msN)C$MZ-S>(db#Jtb)1 zX3yJ4cwY_uG+d{7Ut7-{n!Em_cR%u85&BDLH9dECC1s$7K^n$s7_VWlh9Mem(J)HG zPz^U|7_Q+aQ69$3v`f2Dcv(lU7hSESj1ccg4L56`x1_SNs?=MZHm~ee)UkNVXbrb& z7(*jt)A$j6*J&kVHQXk#$c@Sh9W^ItxLv~(4R>ppsNoI`lQc|b!SBsjQUqs=?@ktf zj8`tYp1afTqWF)9}28 zl}ts$T2WY~VYP-e8lGY6C*S*J6#k``dz8gg29#Ta|RULJ8)YDN-f(msM>8LK83I#$sR8@*~l;|kaQ7)2F z9W`{+)G=UwiLxS{j>`PcuYRzgmMGNL;nP8H?I{_G4&F7_N!olq;(f4oLsg}|js`l~ z>S(8(vUQejn9rB%{q8y&5MZ>y^C zQ(T7TjLm4Tql1nfI{Z31>gc4Si;k{3I_v+XcM0NDk(MyMxv|zK~vomz&$5&+NFolp?LS|RUbr?m?QFkRu zOh;VDvfkd|Zyl>Cy>;}_ahr~D5_+AEK{}tap|6g9BI(aM*KxgYelNpV19k5kpXl6l zzCBJdM8{Aa!*$%G;|3jBJYZRr>$Jo$nyTit`-w^3rDTMTkvc}}xK+o^I&NXp7Zi`u zapKkD>D3fE>hK^MK7t;jW329dxKXTNF3Vm`d99kl2W8`ROwch)$2~f3*D+DY-8!b~ zxI@RCo;6ICqp6&|Xl&`lG`48iH_`EnD%(3v8+ zu1?Nu9rx;3sAG|iIXdR*-uFuLbXr_E3#Nl=jB=lj1v+=D6@I^&_=Iz@7-7&7 z32L@9Bk{S`G93@-*rH>rjt6x-q~ir0FY0($$0Isc>S$J7c~r;D)83ut3LU#jN*>ek zxQ^vIp3w26j$fZlA6Gw5n^#h~xOe9srYFft8}c^u|~%_9nb4{M#r-{ zo|F8n75hwrvFH+nLMqU^UP4JIA-=?7>Ud4~2EmsFUlHV~GTdOL+SEsLU)S-5jyKuK zb-b-(la6=Tf2u1RMRP#qRC3;$QF${P>rwBDKef6-@~)2ebR5_5HS@1y8~c@xPj!5t zb56r<9eZ?qq+DcInvgokz6u-frDq2_o6AW1sL% z^2!_~2iU{67gYSrQ$D2Qu#O`-KGX5JjxRVV9Vqxz3_f)zjr_}`oullHN&d@MX~%^7 z#K;NZXV^W2oD@8z;~O2Pg@4PbCdYgCjBfP#g70*EY$pk zZ7uHe{a%SYr{hl@f3c^D!scX&t{n2p^0$tEL{7fse8G7g7dRgpFbrJe*gTn5$v|ZT zm!wfHbK22ym6JbbcmpuJ7Edv}jnOp0R0ErLq*0hIK?z>LK&F9Qkz^UjHjrbWqJjVa zQISW)F%N$YNY4{Z@_YjeZ}5I4P{lx115FJyGf>Sybx~+wpuj+(@H(^^$tyBYVxZJO zv4Q)h<8u+xja^QyYMh1wD1)B)|{(gn#23i>CVxX&mmSV7#fz}3ouCAOI=4)f1 zt$~irXMxhrKzmW>VBq&=-l~Rk7twtrBl1W_+XAJNfzAe||64{*c{foe=`N&Cfzrc( z-$1}X(11#`b3+Eg2ArD35yN}hc41n{8z-vMn;=mGnt@R@i+POL4})v`Jha#}U>R6# zV2uHr5e?iz1p}^u?}n!LGtl2a%s|{gPnPTH%m=2V_A$`QKyL$YFGzj=j%>Q~X4Z95 zIm}yM$=mG($^Zk`lN%UrV4w&G8yI3>knnHDXOw*9P47d+J52Bf!4(Ax9fSDME{`m@ z$-oE$?-eK`4e-;>Io-<1Zx#u4MjN=*z+40K42&@_*1%)~cZr?b3`{U^yMb{A#v9)K zHTA2Od7YMSqUhXd;0_^_{8XS!5}x%%ZeF1>#lYPL?h(mU1Jl?L24;wt@7oL;>|NAm z8ki-L7y9zBW$!XEa&ARlH)k8T*T5XsNoDV@gz}W!T%Y5c&z{MiZ{TqQ3)sC4EMvD6 z3yTaaHn7CN;9I?iT69Yd+%G{BRL}A$#k*?IJ!s%z1CJPZNJ8rtdUeHiAwJ4sQkd$B zWVwMSMB!<{Ck3BkuMjfheBo~u3cL@2*(KI`cMWu_4DbR?@{ECJ4SZnWLj!9KJZIod z18*5vXW)4QuNrvGzP3G_B(H z>3LOxd9NFI!@#yeg}l20k&c%kaMaU!ZC!qWEhACk&kAZ18K^R33;?H;X^p+oWJPuI3V z{`c%NBXfUb&7Uv(fz@85aDpQK#O5ec=vX1Y8u-nCvKDpL;w+~WHs6i-=tlfu;7@jp zL1;Dze;N4Oz`y-*zCZpkaE`g^gAsl3FRPC8RUED2xWLJu4dlTDW51 zD(zdSW8s>C6cg{7c+W(ti8K@AOpG^?ZX&}(I}`0qz(fTT)l5`3k!d2!#J+i@l}v8{ z?k`fZP2`xUXd>6dr+bP7pMOwC8B22VrBk4C6%eux3mh)E-tKUB2ujE zek{AdM4^d>CK{P2GEr=zmWkRXN=%fRC=+Y6PKsu{y+v@$VAwLWx{4HnNUT?FcCGO3D?

    #BD5hg|olF$w{=}71(NeFK>F-DA!6{LQ`-6n+kd56j- zn7G}<6DFQCG10^wCZ?O1Vd73U{rDnUn_^;;iStsf$zta&!QvVUL+_T`_CR zX=0X%MJ5)TxW~k76LU?>GjXp(oFmAYneJdkZ(f~m;yx4fE;NylP`JRvu+cfJQgRBH zu=%nI?>DhbqAwMs`~edWvWFild(6Z`CLT8Nh>1rfbYcy!K{wP;cGOT(YbvERm7L#7 zA7{gv-Ws4uO{HH=?@n-qiKk3#HZlKr@k$dwR~pcbKzf@cyXNfrY_x0Wy+U{ zxI+q0E%z?j`2$OpTeF$rV%hskE}+gl$QVGY+&MN6Tg`F)x_^6{wPy^W2==ZbZ1R`A!P0-@A$+&Bv+J^ z|0Voy!PUQ|QSvW)zKN?Qu8Hu1iAyFf3%|(j@mpF#?TU$%gXwe$Z;FLf3t1MrmMdu% z(k;M(uUyHnK$jpy+OJ?C(?ZMaLVD>qpt3Erey$)f3UV#vStzhjXn9wMd<#`ARI^aY z!cXyx$`&4PoOM&VQpLjk<;uo#rMiV5cb2|;pzODDg=2@UQ)Ho7;?}fKVqx*{vO%?! zu`5bSMR=%FP7Mp~Ybj0uBEJ~rPQ@h&%#6t zcUY)zp@D^%g}8-=78+UbTR5|}YGVscXwyQ!+DcOkAJp=S*~0Q>_+}QGOS+t^DQsz> z6$>kpwt|1xQrcJ`GPJa|(oTdOYbzZrbhOY(yj=vT(AmQ5+6vXWTIgn>ySO#Al^&u% zLPxcLg`kDcYAYcNng!iL*h0jDnzR#T9(H;in2zLfZN;!av;<8H?4|VD7M!HS6+$6{ zdRpjZVT6T|7J6IgV_~r6O~}`Y{Q(x{`IOo|r7tVQ@-FE8EpIK#w0irL>n#klu+yh} z<5LES{!*DShFBOXMs5(iQE-@GhT?US;TCQZ@6RX7=)Kv(Ef&U!WR%z$BRE>{*8j0Q zRyb3?O$c{h7=65j2@;q5b~dpjai@hz7M``R*1}{9cUf3z!Kj%(g-vPU5eu*FDVu6x znuYlm?h|X%EzGiTkA)c)X0oGxna(MlGaGTXg?lZ`O{P9a2(N>k6t9h_GfyPF6=i{i zh3wB3_SDQ`*jOQ8ryHTxQ_`i=Xm&1LPqK53>Wm z>^-8~AeMJ2%D0O0sDwVo@nT`Qg(oaLX<-GML#A;mlhARU!0GEL%bVM;D$3Iq-;T~& zWns02H5?Rml!HBr^IPQBwM(C2XRG5~_n)({&cgc^wpn=I!dE>?US-W#SZ|^7Uj;8% zc#%z6M|sJ@vO3Dk7B(<@$I52ZQHZbBQC{JYsiUOT^(x_Y3!9iqUF8kdaGTsWExaY! ze%rzgzZ7q@5RG_`eK?iT`;LXp7PeT}YT;cA?^zgBH}k~ynsf{6W=<4NO?f z_6eD>qmYhj2gOTrNXVyx!|N)qcFdsga|>TsI4r_1lbT1QL|&BBrR2vf9Ji3`AkV?q z7EZ9|*qCYKq=i!!Qf#E!_{PF%3ui4p#=*C2xDShe5jYf8=~<;RoSVIMY7k z`}P?mbU(9(h5ss{za@33@P~yz#e3PpUz~O<{A=O7g?~hth(!zM#G5d9!NMge!o{SW zL|UxsD@n;!-Ua+mlr$UZHrm-}ZzID7Y*e#R-9`l)nKtrltejn(WqZB1qK#Y|**2a$ z>Gk#;8#C%EtLiG->MCE?RZ8nAZR#ocqF+g{vLK^Z5mHsK-EHXwHVSPtw9&{$k&R*- zJ{yXS5*x$oDK%}B*(kM9LlRwB&+B{J>nY_nYS|c6U#V^5uX>8p*z0VK>MKj?dkS@I z)V00KYkm8_$M5xQykB2=V{F;E`pUG^Weu2O1LctpMU8DVvC+atOB+pXG?P@OH&B|} zI6khZ|M-kx17%;oBJx%?Ivy`;!zON^%$=Xp+Qym&%EkstW<#Z|jaChn0S%Q7)M2h{ z47Sn9MrRwA4ckT+8(nQa*g?ofH|BhA>7p5>J#2Khv8bW4yH3H@hKk=tz{Z7!UjFII z8Yy8L5y_7(sM?6y(1f>IRMNeXH=j_GN46R^Op)K*NLka!v*6fpZS=8mosH&qmd0%K zw9(5(T-5f64i^BI8Yy(WZM1IeS?g<~pN;E9r@!C;8$%l_kF5T0*KbB+h2DYe9#cxs zJY775p*C){F~-IXHip@_*~Tpr@kSdr*%%>wxZr|ig(KN0jlJw$XsqmLtn44+<$sif zo^4Y)f_Dw<08NySFBOfoahr|FHtw=9&c=8fci23;6%%aSZeyZE2{ieyt|kiMnwi!n z+5f#Ax~z$J>6tY@{hs;hQ*7LAW2(fOW@EaLO-+zjSC2UYJ-ms~cnWe&) z?JK)KNyxcgdcekmHXdUAR4wV>RN-uSX>mIFBOGWy6h10Q@|cas#gV6ki=MQx!p1He zyIGAKJ~m#r@rI43ZLG4f&c^dLR5K4u?iuJDT4qq*{-joRIdM>JQq+t^`ar;Sf+?^5-6b0rkc+TC1XyZqSP zGhWa_*<)j`jT4-ZZR}&y*!arEQ5y%C85^J3_?&&ag{S!|tZKe10!WL(|M_vQgRXx~3IVYOOr1mKMn)Tl^ek_XsLW><9i$5vK5%zzJiUri|7WoRDNJivCwn zJu>H#jmtK!BujCXX^BBvyJmZfrAn>5;&7GD8cuhR=^)GTYCA&^f)yN8J5@?yw&Ps| zo;~QTMRO#mA`|VMaYws!hUPn{uX+72jWx{2;o$3b1m zUSq*}4jMRU=)i2H)E8u)8%aF=;)?W3J6T6EViC;($2hAij zz_MFj`#PNx-o6eV+*?N1Pe}hZ%JmKgI@np;yT}f5 zFxbIR2RAr)B`G!1+a#S+)@yzOn zrCZx5ya~Ns^!aFxu^4nG>%_qnDgGn}li6N&IR_E(ZU<8x+~Z)jgIP;5ra74IV1~Df zE2oz@Q)0~$2~APL;dZZsIS$UYQHT`I6;47&;e8GkI9y|RtL}vk7CBhrV5!5uG9kaM z!ds^%8@&mnysdJ-gJljLb?}&j2ORkG@>o|7vu+(cL`h~Ly%ct7tB^dx>J{(f4wgH3 z!oibND^I0k#YW>^JyU0e19}stZpklP>45mO;3~n@f}`6i&pKG^;0n9YfeOz#Sm)rd zgCh=}clhrTY<954!3z#vbnvQ!*QBH`Ie1yf20@l$c_8JLB)_+<^16dJ9Pjp!L2o*E zi$!jyY-04b%G(Y$iYA}5(0ih-*J|&G0twZ&I(XN?E(g0EyyxJ32Om4w?qHjA2I_ps znMY0kfJ3;Q!etdDABjPuow9=kUzYh+J5RXN!6zJ~Io@a*-cGr{owCQlUgk=aX@T;6 zw8^yEDFGKbgU=}Ml*6gxa|d5Au8d8F)^4wSDR#bd@V$etICdNy zb8uXQ-?E=LIN{(M2d71HlCwd3<&+?!)6vUWtAd)&AbQUTl2G`AgC8CI>EJI1KRNi> z!S53KOH$`I2fqsEm6222Sx%m#bL{P%w;7xX5#n?;`9X;-Zp^$}XC^Xy&4d3$wja%|&$=Rb4D^?_Il@s{$8= zF7|g&>bodnLN02$D05NbV(%Z`+eD?VSAie2S6*mRRKo=?%_rI`-k(BPpSUfbgJ;kdT8*(rJNaRToiKpo`fZ70us_qtsPqy2zAmm4gA?a^M*6wl zQwzHOE(Rny(;DdF`B|mBlN#h=u!|us$SJ3zG9wNXBR3{c#scLdT#OXSSQj_DxW&b2 zdR>f?`e&?JolBW#wjE0`Msh{r;f~%qFtw9%n~QOh$?+}{!U>WkCe5|Y9b)8B7k9dt zlr3ntX&2%qa> zUQ*|D$Bg@2EO4<MJ^T#Uy@9Mn)i!@gelTJ;Nrog{zEPvcJYXK-|t^S*J5DC zW9&;DCN7?E@vVz9E}nF;!o_!d$hH~sl76}xouhQ^c?d80Zh&#~sk`)1wr^{g3R){7G51wme3UvjZQ8TB~cpNeFv(?4B5=4C(*}T$QLvC~N0p|f12V8vU;v*M3U3}u=V~)+Gg$wtk?QpT( z^)}9!T;tA))mhoJyKt9_-7fZUu3)0O|JzrheHz@y397Tgh`f}4xTEZ#i%(sA<>IJ| zLoPmZ@df)5tLsj0^?sXO{<)Nwgx(|UuAP-H#mU#|XkXXTI1UL{xSqWHTg%qnxjf>ZLHi|;vka@vgH2Nyqb3gWgbi{s*F z7k{|;)5S0BEiQg@ahBs$Zj%#*W%S=AC#*X1e`*!}<>GG_=UrTI@sEphF8*be)=lTK zilKC@)w{cR{G~2le%J&Iz3k$Oi?kThV_u72b&(SDDvItJ2gnNVYMvV7Ij&xVvZXR& z_`ZvR7%IfPYG)`bgh83fScP4coER#`@YfS%HDkz)Auoo)7>Z(8zN#ochDtG17Jg}a z8C{has>e_eLshX*O>p+p|LwU1x_WcwgsxtOi(@E_p+*esiY0;+vJ~{vF%M-il*dp@ z3Noj1acv>Yxle4e;MA!bL%kSYjNzpi>c`L^hFfA76+^=q8pUA6V8_rnh9)rtV+h62 zH0G`4+QiT{hGsEud$f5BEn;XHL#r5C$57>qvfg#F);*R&m(e@p;==R?x+?8rXdgqz z7&^tUv8(cVSLN@nN{1NAx_JfZ97C5FPVO%2A=ovBZZUKhemtJ>MLdH+bmaaR0<7nF z2Kl!l568d@H=jKkQm9A_Y7C3_mqlaHM3OHzp1N?#A30oR#`woc<;2i3M}!ZAvxdar z#t@4k9z#zN4rIZ*DZOI2E{49sd&kg6f+%O6`^C^-?}g@!WKEL9FhW8pp`+S=UI`i<~0FZ_rS$ZIb2b1!LgcP1Ccr+D`ag9&k6aYo5Cp1 zCqvf@d4ZF|-W(mH*neB4+hX1t{yo9>1-W_pK@1;?!beFpW{GM$ zV%QnOK55NQV%Wvzh+%Jxn>%UD#%__5u)Fd(0EHy8^awt3V7t#`q&eg8wkv4_4$~;LkQsr4HSBk?(l0;zgO+E(vmq zyDa32V7*;s*J4PCBQ=h+II6}`Espd!GUCXMBQFlbQ6Y|saqnh7Gmfk{vg631d{r@T zKZ(2{B{GyZu$0j8X#l=VRr(s&X;Oh1{UHw-T7$T_GPD#|_ksW4P4PKfk06 z6SAwjcQr|@KW~a-M4UglQ@G4v#JnELEpd#B|oCWykFaoirqMB#VD!F_YCc9@NUJrq_EH77|BQ_1dHG==$$V?OIJj;V1>i{qa7 z|1otP&`uQZ7kTgE6Tw2sdoLKu01DVp5kz|LCD~-NNwzZ=B4Sr8 z*bqTLih^`dz=Dd3ie2G<_lxoWJ7>;4cfR>%cFH%ivy+(#|8h%BjDmBsNl{FW1~X*F z;zOrM#8q5SlIKo~VtN!aqL>-QtSEk6S;#thPJ(u|P}C{aQq75CZWIfnSQN!QY~^lM z=SQ(1ig{7oOWSLyD4}Bo###ntxi5LVg_Xt3H=@DE!lo$Ri((^d zK8m+Q@{Uya+rs^&Vd~Jv-sK3>w9slDH0$OlwnVWtiuXm6d1kU7FiTNvk77p@pKgt? zDk!1y+UY?iIngEVieh&Zm13wI!=5NUVxFV;Hj0m<*c-)XQJkPvNAZc&#?dJDM?o_? zBu_aY{Gj0I*8k3^4@=My=@-;ICf?(M3tOvCbL3bfyfaaJ$2N_@eyRBTD1P7`PD$!)6hBJ(zee#>6h8|;#}Y|xu&|uH z|H6@0J~YZE%kk;IMe%zS*{=rv-t=b_f6=HuEGpkd{T;=vy4EZr2hH^2KkD*K~7yt`m{71`xTpSC!KQmvWXHaitW4JUHq+_;G zvn7$sVz@j8>xxi?SkN?ANUSSkm@nUYOyR{gs$vWu{Zaa4o4~w7G2Q}HR2V~1EcgNL zrAI@>F@$5dDTb>)j#MGWP&$iREwdy=+}tx`cTD)lo07^UZ`9%7W^ns zD;C^ILdQdS*ThgKh8tqRqHEn4>Iu1Cu$-QMZ4B4NpiYJP(qRs%bGe>Rq`Ogc>I?EM zbF<{?7QqIB-^TNq&qlG}*OqoMwC7tOhQ=}69z&BD+QiV7ylwF1!jzlF&@6`LQZp@L zXeETT)KUn$Lu(g#xOR9yJF}RL+2PK*326nLzfu3N|atP zbYrPwNW`GW&?APPF=(-%k4FVbVlnT6$1&qW28bjWUCn@HB~U(ep99Ks$-yHIcj+!z)5w5~Tji zLdNU}ws>t2-bmIkUytF>fa?(dN;-JUJM_{us4Ry>^N-; zw$mDy6uvKfiy(ztg?tdhww&b6w(^T`3?Ig@llk0HxGRR;9Q=hZ@gsB;(tSjQo}hPM z44=gCT`X8qrrRIG(HM@2_dpB>g&d0EFs&|{pVc`cLeAmoJs!i!7*56TsR%z4JR!)? z4c8VDKab(77*2Co5c!w1vG2l^6Ti-BejCF#IbP5!awf;$aU$Of{~;$iE96IZicFB7 zb20o9!}%C4$e{OY48Ms2M?Y@mrNZyx{X_6i!M|eoTgX3x%*Kn~6qV9&k%qX2goe@@ z@-)=cP)kF;256|Lp^}C&8ZOpwxrW~B%Fz{QxHQKv(fFmqiDmxhZ54ycX(+GZG6~J% zu6;q2D{}f*YN#Om57DozA*7+2ND4I+X}C&wv4*gQD*wf5r><-lq@PVQBJ!%a&{`5y zT|*5GN}iroW3FmzxLU*Q8k%UhMnfG9w@R$K8tQ4dQA2$V*J`*_8K~9=>cNIGg@t#;PXDOc4$wo_dssA~J5mbz=`Azn>G zPYqGwG1h~G_7v^){xOqqM?@tlLcR0na!kHSg3gfY0Jy z`u!0)N(PB?Hl3jwhOu2Vj1}Q<4I?#-(l9~`raFwp%rMGm@sea?-6hHsG)&YmPWX5Y zbX3S@a*~EA;-zG=#w*4CKj+gm%+T?Pvo?wTKqaYqkNS@U2j)r$NtkSSr!y1~ahBq{9)bJF$ z`PQOmH9V(borb41tk;4!&h`(&Ket!U2+zJLp4ae#hA$eGe_g|i8eY=yDzj9l;AO#A zG;9!(-d~zRA{~FDe=R4x{=vM89aLsp_)YfEQ{f4I);O!n>DAtV-0gEUc{q_v;GGu`9$RVnE__?bU8{6YByptMEX*j_ibnhj*&y^y6&g#-|M#Fa;MGr>4)NoqE z*TTQjpzn{gyC(FFkZ%R4Lm^$3e6QgL4QD0j^(%`h|55l)^4x56TFW^Nzp!^dQtnp` zo#%!IoC-dHf1|00TAvQVROe3(e@U(W%@ID1yg2?5FYEcdh6@@>#e+KMg6c&=cn*SI zy8JjmNgQvU2)tRHEM5{v**I>Aqd^>(#!)Vg8gZyN%Exh89N{>s#Bq5%nEdm5@CqT7 z_JyyE2cHQQ;;0x$r8p|bQ5Z*29HBTy-V+Q3^p5GER;&qra3Lv<2VI+l>0A}ZkewmA zIivDN{8l*<=Y5ZbRRycXQC$cnTMm?|8Aq)+u8ZUPIBLg(-6otrUlYgGar`(n_>LYI z4<>OXeYdN9BqW$ z-67Zy*tPsCmu)7IHGaH zM6QXDa+)-ALXwC>7m^e-;{VE1qE7`To)K;eT5;H-Lj{I15sw*eTM(Q9WLw9BF{DJW zmms~pK^!V3 zK{A3i6UXmy?mELLwtgHd;#f)hiDPV>*IeL!vAVlx0CCI^J}!>&aZHF~Vm$bOogBv$ z23=7!NsymKG|s7UOcN_5&;D>mGE;1CP8@TE%!=b~A+rS+o-Ivx51+m?OuM2v&5Pq+ z@y?H9fe;1_*qWEcg>fv3^P0_I1>k`=9*kp|WN&diSlgkcF>gzRKSW~_@^Bn<*_9tI zJv|Z!EpU0xdLI>1zN31KgMS>)#PMt#PsH(L9P8qEI*z?Xt|ycp;7#al9+?_XIZy zQcfLqRjxpClCUL?t#Ry$U$Kv=Zj?-}*kK@yLa1!eCI6jNxgz!^r z$2tWk+56-rNWSdt5MO*$`$81H6r@+{sJ@Qln>fCYw**9rF zDbZQ!J3k6O)-m|*`&mkTE{0RPFQkdAf8xBs8)rwKGq;IBCT=Ext% z`8aAOP%D88jF><;fhq}HltAeOE=%C@1o9HdPoN-yOA>guqk`bY36v4Snxv5FvuVmE zaA^YN6G5}m%OHLnl}iLab5O#DBVLifl?hZ%Ae0Ddra}U&lS;xXCU{?y3M#5jL6vBJ zVFE=76pKQ(4zsfeBHdMq;9XEdFd|qrfocgrU!cK}x(%>b6ACJDMcWIKhi?)a`;iutuJqTijGK)^k(1MI!ixw@U(D6KI(Tw&1p6 zA_=sS{B#g(o6B3f1ls5L;v*5}wxf7E33g84r(J=tTLRq^uoC>Mkpj-vdL$4_Kue%! z0#UZ<_DGk*ktv;2#S_7MFrGj%0VBa1X;eaTr6+=Of(%NrqzrW;{6getoT0VcRF=~K za+6Qo6Ctq^a1wA?IvR}39DEvy%o9p-l3s~_Cl8!m^iAN71U4t}eiHo>=%2tu9g}q2 znZSSqK26}WL@+E5Okh+3qZ1e;-ob)H5*V7mutYEi;EZBq0>g#VJ3wX7>}Z*HoC5z}*skwjd>Q61;UMu!?z7jjX^26Sy~l`3WpY;6B!{$XUAgJ1M&R zMNYDaDR&BntOs&raRN&cc!&w!md|>csqf2*g!G@yvN~1`aZpzI3iv3@5r!O6y6uSp>uGogU0qj0^1VU&KxFiIDsPx zwCk*zod|!Jz|I7AC9qrSY9EW4z(>r06-gY7q&xF^5cO1N^)W}D&T6k z0a|Yt)wzq}1qBBaIFtaFkvY;f=%PrDas+E%#8bV;61c+2BWGtnob831b#_?eLPRcue|(0#(`2geiy=_;BO&+B=BcW@)tW%7sVjDe-b#K zlV3>i@OvP?NJnWMp$)~)b>RtUb>@apz8?Gr4IO3plrE~;p}gpxV80fHm*}XX<0>6x zbzG_kn^eo`L5&saD6iu(9hd94LPtd%m2_OG2Qxjo3PRRJ^Xb+{^DFD9vm+7`AxTz9 z!gPvs6f=>o!S!EZJ$SD*>Z&3-s_Lkw2MZufjTXgO3J<o)YEaTjz&6e(}NF_>jdlTxLyZ8F>cVowf7tKU`cso zkNlfj<#WPzla8Bp+@c5b#s)eX3L(E$$bU=gjdk3vqos~kdN5=)5o|8lRL5gm@|x*L zF9|nZ5@u)%kuTel*IGv#mQ=^*%1Pla9_hep?*wsDsKRbW676 zbrB)+pY>AGT}KZcaUBUAJ@sJT7}KHYh_beO=JSh&5)xuf!G&Gb+OFzwSM^lAf~1aT z9ts;eQbN)+03jJcHa$Zv;fzksG0oM{pToEgk7mGMwRDu|=q0>wRuV4PTSuQ9=dWN? zyF*96td4k@&H&bfj`}Tw9cTmf;9W3C$6z7kT+AP;W0;QNY#kk=bc~juk%FxG>@OOu zhcP;jF{*Jo#_G6B54OfJ+x&r&WblpQ@l5l^@C4>?L4;(ojww2tB+)d9sXC_7q?3pw zF`W&{s!Im;KU2pn9ouwlr!nZ5t>Xcme@TWpI_BzF#PV|Hqhp?q`&cOHU-#-*Abh^y zl@o$aN7qTqC*Ci@g|q?jvKMn4UaVt@j%Rf|r{f_VOLaV<<4GM4v$=IVs$+$YN670G za0W$OF1&HKf5*v{;(d&1?k`P+$61q?gxX8!DjlnJtkdzd=&aGPR>xDqv&#R?HrGom zdY@r0khv>4b)MJp0&7yo+d5v<@sf^Lb-bqIWl4mYc}4U|HsmA)+aj+^X5P@TQ3yld z%srHx&giDz5y^WxHtTp-IH!V}ba1Gr0w4Xpjx9R2aK;eIQvK+)eG!@u7}y zbbPC0Cr1VyCv=?Dv73Eg#}OSzb$q1bV;u)rpWPJQULBtZ-7ehjbjy zNwPtF`Y|2HrMZ9Wrub6+RL5sJNM7p}yu|+_r*wR&<15kpT<{CQnT_*L3t7KC%$p6q z7G7OmRcCa3r{fPDf9m*N#}7Jw;gGB2td1Xb4BcB=%`g5*^v?yyES0Carc)lcH4B<`(S+>i=M z+>*pAEsAbUVs3ZUAc?nI74fU#h3<;prh6isP;p7NQ4+T$gGJiLN!%`ktF`p9AkC6! zp2UbGMkc{4R$3$xOF~PcWfHBDXq`kGy0!&9lW3a^78|=J(dSIKT@vk+=#WH5$z&J7 zPLgtG;Y^%ft~|3)Tp#9vMM$D=5`&W%lEfX!;1D0(0Dc7s@1Mk-Lb!fK`Sx|?hy#-tB*Lus zul#H=LlPGYu5 z=CaO(%n{7afjQUB66)WZ#QY={u+EdXKZ!GYBa4$*n8cza9!TOr$$wstpbK9k*rf*# zJE(;{)DlsqK7;s1dzeM2QSb~6JBdfwPnQ)gXTycdJ)Xq2m4%Ncu|kqsnG7~=JtmwR z{<-b{i6ov(qQ%y{RY|N(;wd)klJM#z)<_x2nSOrr@XnV)>ymgniIa!&xEEr*q`;sJ zJ=C+T%p{&q;su8GQ12x1qC9j14Iqh^l6X0ZW-Wtnf4WyB;<+t(uO;z%5^u7$KgxSU zGQW|{y&#nRMV@8h_LaAisCG8=HaigwAQS%cs^WK(!Ssf1laTjlU0d=v)!CB7RzAqU zD+WH`)7kn-{E)=Z$%@zm~0Wv*P(L`H_E; zxY!7Oa5>MqN}`m3iwwX3gXl^d$TN^H-b#)03v-S^Wpcu-W`TiAaBGJ=zj zWw|NT2sVy#e<`D9&p-CH^Y5_p`Od9sU`9_>O%hzzQz-*A4YW4U#y~9twGA{e(A2=y z2Cgx1i-86P>KLeN;Ccf$7^r99S_9V^NS_FEs5ctrXUF_^8s$HEIPXRS^$px);AR7q zFo+o-l0PW=B)1wMZ)D&$14W1O8X90a)M;$scHvJP&TAwQ8JGI+_EgOb@Q402qw<;? z;9mU}%x%5GmIhj}QF^LhdMciOr*c~(Sib9IptF#6g6$1-5YkbQ3Zba#VxX&m?gn~D zJ#^!vqd^M%*eCXnD*i0e(?HZfj8(m%c*XT);|4Tw^m194k}<>cl14CW4m2>xfMFoT zYB7*8(AU7^eUWM-%b5o5V#)?A1Ga$`2SSdZC+G^ERe6;Ak`odxaP=~{vr+Xn(8mC$ zJJTgTvYt{79 zF^I9I8JKik!F1Y~kePy%Q^;4_Yy&*h1U$cZlGHV z-BWnOz(x)-DU?nHlZQ7A>@o0>fwv62&7Ni8T?4x~0>soNX1FA>g;giyJ;BWe-WS43 zW9SFMw;R}DfYa%1;w53whX!`$yxAzkx-qre0C!=vim8tc>@{$f!%NGeeFi=;@Rfnn z2KKY-88~L(I4j?e927ik;E)hXIIB5g;HX$dcB;e7d}`n`1D~@eirNVSCk>nuPW|k> zC>xjfCCezntenxm7R@t)-w1wd1k)!fu$I0v@V$W_Sf#nWOpN}cfuAG~KO6Yfz;6=k zoW%Mim;Ubt{xI+li!72q4g4)?O!hApe^=#f2AJA~oV--(-`w))l;@>_Dd-g`T$u`f z1IkYUDU?a^->FcL!euF3o(jH4E=l3i6!#ehgG|{}&|m7AdF4{Uhg*3;5(>Y&p>TA) z(AJg3@02dCkV3^2ZcE{wJ!LATP&tL`Bw{Fq!W2{rHB;OWsESgk!bb})77PnAwMYuL zz8I>W3T~dPnnJY{ciE|xF?BGe&c{@ZRB*K&gKBH4a7(yW3g(L9Ynb?!aP1VX7Dvu> z>ZDLtLhGe)tq^K97*UmuOZu_)RI?l0pOFH>bEsMlI6Rttm82p-~FF zduO+%%Enc@xSAYSZ^YHF@n9=X;}mXBp-Bo&Q)re#+Z5WR@LeXqc?vC3Xeqp*6DjUq z&?<%2toao0z6kyr@}@+v@I^;&`xH8)&?UuHO4TuiPAPPjY(x{PUm`f=G&d3aB=k%| zbxm=xQC+1gTUTtm9(?GDu#rN~6r!o%%PuCUNk!2cxD*m1B-bU`WG*z7LOO*^DwzGA z>0I7rMG3bAZ9zwnlV0k0Dfmo*xji1~%Q_L#OR#qeeS|QGFP(lV^iN?Rn>B?yQ^6V_ z-2fq610?6#;NTR7(9&{3O0vs_+0YRwj7;J26rNzN+7<9sI4XtFV!C5e7@NXfw2kuR zSqbA(7|%?mur!4UDNLk1h559K`JqWEOiN+9@X3Nx1g8p~Gt19NVNavbtQ77}VWx0y z&!GLxrseOC%%vr#z>OJmqyi~n(7Y7BY*ut?QgED^WC88xlF-5w7Nu~XaC+}g1*uOk)5Vw^+nZl|RzLsiPox++F-b~@G6xOEjR0=Pq@KP#RN@bNYx9cSC(D z4oA|cnnu$!nx#=qQsXC5qcp0gxw#rDjhboPEa^KvP%9l=VsL#LwbQsdjcdePPmuCD zY19?2?J7g>wP{?J{`al}-e$n)H>88x2Iy`SwfcfL3GxDJ%5M?gK=4+ zqp@UfNO5?>#K`Sw;N!d|tba4G9Ojwds?F1Akw(ijTBXrBjV@_^p{Ukrv`M3FI{2i$ zxnH zk2LlSh(yzfrO{J3A595eNt1j!k_H6x{W^zDeTsruI_R}ayqgNWe(-@luD|2YqaJmQjq|rBxJJRTv#)vdV zN{#hr;%N*_<4*Brl?MqQlE%<921}z{lM3#Fpc^Kc87>OU4;_W0q@~7)klxX0{HH*2 zm*jzRCc@?zpXPg36|@geN(UTc_~^E4f+z%W1rl#*;LaG*+_{rSVJ}&!#zysI_T46_iocN-Ha^)&-$z zPg*^l#(K6OO(p&BsPddx<4b8gpT^m=dLfNS;^G$tNh)O2?HSc_ThRuI^=2Axu_1&r zk=KO0F8D?o8-?`C1S!9r#ye?j7RkG5gcgK0rSV=GG)UGG@uvRadopVC+mZLv*pkLp zwnawK?GW;T;5NbSg8V3B=!e303holKr|_dRK9<`1ERDTs@Y;}i{UV3c*e9IcPtw>g z{D9y=!9%&w{_`W$Ka$4LG)RsKk{nOt(;TnVB%da9B8`)2oT6q%otqr={m;{2DQKu) zrE!`)F@tCZU#Ia6hq4T+W$H)%hEWP z#xESGP1VQ@s&W4PkzdpJjm>d=0j>J?H2z5AFEI~V$e(FsjfVz9@^?;7ej$xg8C)dK z>S3yhrdnaDPfYdOz2VXsd}XS<4DyBWDfDt-txN_NXHbyAB^i{>;L;4rW$;Kr@IBjq zbEK@L%4cv{1{E@>m9vP?%YG%+dgGQMkky;tlmeNgPcUIx6Gq@&$Ite>vh%iwy(veXTkpbOk6oP>_THH#xRXE1V3#H@1JEg5XE zR0BbhTZK^VwhS7})4NFux3jw1hdX4@B!i|IG|Pb1+aiOO862=wbHRQGA}mp>4BBMS zmi5U2N|0r2C-v4|kn(I*P~MS`lfKX?gU&hLC4;WQvmJpoz!88(Rn`u!YUI!t%RtK@ zo)L8@2Fn?DTx3ZG53!AG)qY4YSzVgJ99umsxQtPRP);FVVb9uX zWd@J2OG-mOp1~6tJeR@q89XTs{Zt0)GFT;?u~rLNBe*sb{F=a>t|y0G@^l94*_$>+ zhMtIQu+=k};5G4V277JAb|=1&!HXHZnZa8byp+Mq8N89f#tdGOq&8&mD!adtdTw-F6i~wgc{OHC<8GJ0Y zv^Rqz84l6dm%%3-0~@P0M=I~nV85e&anykf4oZm*WpG$X`IaG`w)?wv_*e$VGx#Ed zFEjX*!^K7${a;jy7oW-tn!&ETgDe&*=ssvp@yQ|bd(oy*`Csg{4( zOdM4>kb0`Er+$|V|0Vc`;Gcr0C1s}ecLrI>`3x?wV|t1$PC3UD&RZ@r!BMWXi9D09 zm|y}46Bi39BboVc>d1F%S&>vVQO(4qCd!#8Z{ji&g(iwj%<$CZCay4XrHRfvgV`+G zx&pn$;rHLpBd=(plKHRwS2hvKadw$v6E|*-?DLeiF%mYx+k>l^xXMJt#L|h8BV7uo zT@x(hJmIP8CTf^LUDYyi)(c)z%EZL>MYOJ(CWxF!Fq8w`H74qq;Jcu`WV^13+s)uT zThGL`CayDay@}f-+c!|tSGNe>C`fO86E_LJS@6(pAqwdln7GwMLlceuCzNuku}T}8 z@X7myo0w>7qM3>2CiwZlEU|uCNKV?BXlbIAiPk3Cn3(DZHbA7LZMM$E`>-FBjzc;J zb`IK|OqeDt6Xcx*yGU`mn&@VtyNTC))x(4)DfDDjjEh7~#8^4yi)TDv{NWqL)oT~W zrDYQ)bQ4JvhKY>mr%a?x5cf%Dh*?4*^Ty2ECLT1g*o0%kHQ}+COqtb71<~ncqPL0P zBzhkceN7BCG0emrCI&RCGC;6jmN%=?U&x(;J?mdO(8M4UgL9!na-ms;;U-3y!O%3$ z#7GmPXk8^ijg2-zH^#(R6E$;^yF|!PIts^|=wG5H2$E#ww1LTHFzuYe$~Q61#B>w$ zOx#Ojkh07&akq(?Cgzr?HMv-`={0c=jnfReGn3j^5_IItdIiaL>ZRtJSYTpNt`zqP zxj$Eyg+f?Z*2V+Evyvqy9%5sONl)*kmNFaTB5O=MY+@NZh>7JU9%XmiRXDm~=)wDf zp8IGo&fKul#A7Bty1L*=!N*NJA>{rh`4kdYnOJS&fhPIC4vf%CT+95+&y>V<^2DbF z*9)?hpAqt`iRW^XEzR>^H1QILSt~HSmrcB4;%5`*XzeCm<(Mp{$h&A>qgBt1Q0H|M zZ zy|itb{ed!{nAmUPfM9mT_0`^rjzV5xdRVIZn294MjuLyT7mtO$+#T*-6h1DQ{8aEW z!M`U5GvQMvJ~#1=iEo+1-s%f>(zJSTcKAz^lWLqc(WPTqZeqFWmEt*_%6@I4avw#) zf$j`@P~*@KtZJ5&LrNc2X-;sId)ApC*|R2oG_n4fP`^IvCpK;$wXcu*g&l!Iu7%63 z;B)Uc6Q!(RCFggk=RZvRY2q&vf19|#0d_%%;~}T|Ozj`q^R?mgf}BtCoziMiv`}cF$U-G6*uaqAS5>xx^(9{a7_#_7c46rK$l~k5#TLRAA{MGrO|HMI zV&N(aZRSVjER67FeP&*ynigtVoWlnZnJnKUOrH;;)h+F- zt`WPfBUo3Ewpz~$Zcn;aaMY~G4Hj;+@RW^pHtJir$wCzySJ}AP!YvjSTUcVDfrVRH z)fNU?!48Cm7P?sIN z3z~vd%Lq~Tgex@3riFeWSE zG8Zqsv@p)XcncFOOtdhGK_c(Tm4_zz0lra&$f?d$NuM7|vuTqSrdya{;odEwnO4wQ zxJJQu#4HPUTj<#@__}{?L5KrB-$ZjP%(ZZj6?8Fv8_u(Wbrp`f_ma@4EZk?|ek&N9 z7m_r|=O9d^H#;)3jo3O5iZ${>m5un2g{2n15OL7L!xolFZG33q5oy!cM3ZXEEj(&r zg@u(C9<#8@!fFeTTVU6C!orgl2K7@vT^Ig%NHM$Wynd?8!0;LiYb`uy;du*B_ft>N z&d)}ejdk=|NOvw?Z{gWoeLf?E!cz|hn;+Jl4ZT1kpB))}Z}>$EFIo7qpL*Hihj2h% z5u_UVs}hlf-q)p8->|Sz8v0EOn=HI1cJh{mw?+7l;JboZ``IjftA!7Qyf3&VXI-?D zZU3XZ-NFv>(wrE?cfn2zyJ$Sc;oTPYu;wj%Y~l6y^FFb#mmO+IWa{*M4kr67M5`2E z(O>a@f2vFi?-w0*-a{4+Te#RpfsG?#ffRlthIiD$F$>4pQ&Q?v3!hmyVc~_@kt@c8 zPg*!-;k1RXrTCv)_@}>Wbf;?4Uwy&KvGA1zv%i|!U#;!0cJ)`wUJX{dI5%c3eQV(i zAH?>x@Qa0CE&L$n^rMBJ=uN4!7C80}yHm}+Q~hk=oQ2DF6tST<->IHn82Rl^#Z}hd zEc{{NPYb_WV18~Gpe~vp@dv2CEd0&PSeQ3J(R<#)1!W=NfHB%KNoyvk01uNOXgpfgWAsh6P6xqQLS}aHswlVkJzyc#Ss@k~Q z#%vqaY*e@5*l=ysu%T?Uw9(2ArX|@9RntZ-8?|j*ZQ~jnjcnXz2g6+*qCADXu1IKd z*V?$w#`TOYl3Q%tDC8zVYSzzb-kc*8HpqqEDx{$x2fD^~u*lrRMpJpv?KZN-Z!=Ie z6G;mj&27-@w+$27F^_*6%wbsA)^_j`X=9_UjdnKL+vs7Vr;QFaI@;)BqpOWhHuwsr za%W0jEGEeeRO^kxZhT4g3wO8i*XGFnSmF4A!D`-9169;U%!XwLUjZ7QJ3o@NVc3Y< z;Foy9#c-t z!45Xy`F7CtO6*|R>}8|3jXpN|vJz~JvN765KO6n+;9b_y!ksh#8$)djvoX-dARB`j z-3AxHvn%0T1JACC6Db_dJWJ?E!E9(&nG5M$#vEf~oQ?C31jE``I~aBE66C0R`yiDZ zq-Y)!?cjwtNvws|J6XJ(*i5l8)eeU7X<~cRX%&9?87zp6SvJNFQgo~zA|-QZmNp)? zvCPIjd}xh=dF%^9xY2RGjRnG&*tky!Bi^42T`1MNNbms>@7konSNx@ZuOmnr6b1m|jAiYFJf7-@+ z8$WsY*~2q7p0)9Wizi(?XXAMrn;pFG-~}5m(gqwJ3=Hlcdx-`q_YhqZPUK{&pkb~7H98U(T{Vc^`b!c$#=z}&6**GkD=INeec5vS3h~QDG$=zAU zg?yURq41=QQ#P)3aGk?{QpOiHE_P7h;7c1{+4#lAuQpEG_}a$L93d+ge`DiY8{gab z!NwW(dKV}ntzYJDa4^iEQ@HX9ovr-{HvT1Bg8KQXjaqSSbZ;1M7h^jwSony5$ zS4(RJ?f9FG-#L;y$aCVl+P%E3iW zV7gxoRYk*8n_WSBZPOkLujtb>q)LI;;R zDCgjgKE;(BlxNv*3tjH;h+J^@^<@rv4p(D`t1BJM9j+=ksOSXijq8U8mAq@X`fPac zho_YtoF6VXX1`ZdlCjU3$Oz#XL~j#3Lp1x0&rlsY_0ou3)0yFJ{*K~o1U9kgQcN2_KInmcI0^hYaR zgx+hkdUSLUg*#YUJ7~koygJ<8L0bp^+!djG&uB%`PM%BB!9lb`9=CZjsFQ=vlD94t zI*2*w%9OX}b#u_&K@V2G18!nx<|*W6Z#wRE*QB}G<=N0p+F zl!LT%a0X=@m<}ulwu2E4MmlgLVqZ2r%kIE);7jB77Az5Dt@aY~&*-3r`#9iIGf6)O z{T&Qsn>xX9vu|4E-|1k0gZ#sx*XxI?j8TopsCwm#2Rj(X<}P16L~y7ey}X~CINU*2 z!aeY#987UA)xl^7VRt!)g)b27+aox0$J7=&c+kOO_NlVv7CCr;y(w9aJh;DcW#JO0?_imOha4<* zU=)T?TwHdn(rOkz;$XRhM;)wiaLI$ACXNBu*Sh!hfAY))xm2H)-f9np6Bo`hQX6`>)9v_m8;;Nb?}_X zIlj?0D11@8c&{h&LPebyl)?HwkWZ@Q#Cb9lR;tw;a69N|vh#sZWwk zpAVwSHW*1?ZLzIX70kn9y7KRNi>!8r%NP&1V6F?6B za_~3b0vr-KmX1@Uo(nbH7V0)m{lk&g!377USd-(_>T$s^V(bq6zOQKaIQ7do)#8C- zzGCv+;5}R31$n*;xG3Y|ViyH2E_G4P#U(E4jaU80t6AfN6w126%cA{wRsEvk$H%Md zcZ9aa!c5^ZN#}CGD_mUZ25(_H9;dD3qOu#j3tG7dxhQne&_yE`MJ|e6T@v7IrNS7L69^U7rD79VG zaZ%UB)h_70Mv#P$UcD+5nV@=3Q1x6~xbLFb%PX+=UGJhk^XcLS7dN`txHhzAUFf&T z!9JOrUEJcLfs0$+;JmXvDa1e3y|qVS<4~~K@4b&hLno-)+~A^>W^V9@6pdZnE;Yjg zGEH1Gbunv#dU=96-K_Ad397jmGmWZ+kd|&Rs?gioMH?4wrE)q6wi9eG*g=q)?|BBSsWe5F5QLUBIWWA#LFdJ3>sUU ztXq&~F~j8s((5AQ!gOJ|uw8H^t)C0Wh3lfXi$1iFiOO@)%SDHwk=rIJ-vzNm${rBD zR{9n5|I~Wi8t&`j4i|rREz8}N-bD4~Uq$_0+$ov^q|%PAEuJ?~t?E}i*u@YRvt7(_ zG1SE{7h_zEburw<2p1z=jACf1(3maZP@{qk6aW1~kkKwau_Da>qkD_)Vo6<0b}_}p z(TVE9L^a;U1bJ4SNkOhAx|k%6+?}MRx|qf`a&fnd=`Lotm?@@3qoTdhx@c*1^m4)W z>di&}3@Ij`>*5|4%UwL`VxEh8T|DSwv5WaG7Pz?I#X|O%riJ$j@_HX~-rf_76px;y z@~#doaiqFpQHdlgx7#@ra8DCMgmgAz$HQ z(eiQNIh#wSNU3}mMgl?OQ?8QnS(y&{qovcQ&&%JZQyIt&&E^yezM=m~gv0uEL z46{ej?WI@p{D~mtEDq%dMD3v9Ar~EmP<}+nQNd#_j`J13s*u#Oc+$lw7eBf9*~RCy z-kqWE1ix_cCF^8M-d8Tph~%_*sqnRUzj5)c5Vj!mke#zJ^m`XSh@AW^ZEQ>4k2I&V zrKxky#V;=Myr3R_b@7{vf280%KL5Ma=btYAaKUP%GRGfQ{$DQs772wsqjz3vjFoo5 zMJX?+y^91%N_+Tfk|N2M^x>h5kc$N`@lYUyDQ8=utcOcQLNA-+G7pz~!6?z(3$9Jhb*; zdayjS@zB--r?_zs?L4#>-d(VRhfYEm+EK_$-7X^U?4gT?t~p6JA#3j~$Dkgp={T(eBuq06>&tJV!m64bq#f$tY&(c<>77*vpw87 zSuLKd-kPkwoUAHNQFEA|DQfl3F6-CVZMjO9+r4m;Ndese%AoU8Rn2Lt z-8A*6hZP=P@bDtLo`=UgJndnWk^Bc!ugaLye!I9-k3tzU1L$53hT8 zgMGon1`n@#c#Ul_Lmir-{+yxe&s5$_HFl<2H&bn!sWvjm!`mL-@$i<1KW3`fEH!49 zsx~V~jSqclmU`F2p;?N5azP0X6l`Y09gTb-_`ZiNLbeM2YUMMCZku?wd)VROL*Y9G zcm0nVm3a*0Bj#{N;St)lhrJ&5dBJ{rI-WZJMEHKe1A+&0p@)PV_JZqcsC?85&bA-( zaNG+n>|(N?diac%{72;zGyo2p>>3_UiR5z+GY{p_G4ud(q_CSNwV2!Ok=j14_K|2=#Cwg(-L2~SsOO`HkDh*Tl9Wea&fk-FtZ6&D`hIXFLIWSS`nXB>%|34NQS0vDcvm;UhCUkkxLraiyv;{r;r#PldMAob6Ok+u z-rPqEAMN>QA1!^f^3ldeTOX}+DO{%E713<>KaxWt>FA@A2)nWEe01^ARlI*lXlQou z#7yfVA}@~a?xTrFqCR3icOs#LZF(ZC`Ka_o$PgYEO!&}+Bn5jMi%^X^DSCZme3(8g zAFdD254LRCJ{%!D_C+tDW~(VaCi$S3Zn6(fze%S0nC4@; zj~PB@vMJ}NwX@Y*v(?wLRlyw9XO3dmVSF~5f$9Y-Su`I{2!D+EpQ9)Yu7B}^lfr9!tn#ti|Mw=h?By_PeLUr3 zosXy45f+zQ&%vRSdVG#LHb-5Uqxd(AYOdmSZ9GEAl0N6-c^@zMc+uxw0o+}N*L}R~ z;}stpn8_oN^LqY&_^L=)C`#TCzEO}~24&q_(spmN7aWhgt5(fb+gP`>*b*d5_%?~`@NwG5*FHYG(#I(uU*;sA3;Dtab?6w8YII)-p@grGZ#cq~;HDCM>*I`%?|gjE z(V%U?4JG)&$5|hhOAso-k3N3l_*{b0CHPso*k6L@IQY|meQvbFpCV!J`(4N%g8qjQ zy8ncKi|`*G=Y3qr>6a=&g>J#Eyu5Rdm{)>)N=kx`j1rU)a#;y37E(~cGur>|cBVqv z5|k4;`KA9OFE2vwzcgH4zq-ptuBK;Z;g- zRS6;`$nMjoW~B?I_!nIy)kUFJ32Fb|H!A_(t+$k*K?!axLBs!}>OG*OD8BFU zWtO|l?tcs_(? zg0BoysMaFH|7FZhKJ{{*TaQ<=rnsp5YzS(=uM0`sRlpk|bPJ(7ZHAzR zpbN?Og0+wrsK%9ql7SzDjE49eCN_t>t-Be5C7^dmK0qPT34woO!P4CjV#35jcvC<^ zWHN+20i#5%N4`F@^bDbwG>!Nz0n~Xrggznk4dI;-CUKZTcsGQ8A&dxNWC-tt&_9Hs zQVmvVKnMdv7$nj6ITuc*m;Itd@MQW2Aq);-NC?DKqfGI{!$f(w$p6SuA&kwpIaOs8{(Ff)Wl>lCb6 zr{F9hZ?E>UGt3R)!w}|&Fi-fRQqKh;EDT|B2up-qB$A&`p?>O?5cY>~=RN%M9u9 z!NpDWCdHTR!wUXyLO2(~nGn9>;#0cB*$}=KccKEL^@e-g{G5K0_OTT$EBv3mN|5Z>P8{jz^OgsiH*@3`!X!R>9lGyHwu741A+ z={sEck&Ax_H@WO{MXlnyFxp3XqD$Js;Y#6JzI7D?zp!291AB%mw?gt!P=*<~I~Qa#P_z9cpI`U`qq4G8WD72=qL_-}DvGGMM@8Ea%DpP? zQ<0;hsEVIz_-geEd|frb>;VnDoUzQR6L-fl#2UR zlv7b&MQIgfM3zvrrR5Voaw2JB~9#PTea`eo`E>4^Ux`R^AsmaI~^yw8H2>i4IaR zsYj5}Au5Kdcy5?~f{I}(hO@Yw@;q(H80D2cUOy}pJNw5de|?uj{lzMl zaF|qlRW+SahVREHIb)TaD*hEJR&oMrD6L_Yiq-Te6&F;j;Ve_JMa5PX>)3F;$fo(( zMYt9+=kBYO>I=b%H>~j^)c;%dmA2(-T z{WxvNcxB>v<)Vs9D()qVG9-UKf*!SjKlns;F(4rrhZYAB{5 zH=j%;Q708@Oi)TlQc01eG?X+w?=7RDtcG?P+G{AMp}dCX8lKlsLDVW~sH{QJU`$XR z(D)K`+JhP%lB9|vC#0p#mdZS=p^Ap5G}P5lRYNrmH8eaXI;Z;kt7~{f@S_@@Zkf*O z?`IQ~w28{&8ft2ILPH%5wM3z|h99Q;D!JYtJLXPQKCA1^=qDwq!m6}VEwU%IFI!JT zeGSiQXsn@uhK3p%i2}X%X$^C(mUu>@^(QL*CVCyUexl+(lGa4Sa~g(K4tzOLX{zDX z>%LAu=QPu>_1{chH2?7X-~6-u@@~Nv8d_>-rQxkE-k37noT$8YI=8ikHX7P;yqX1O zl*^(I-#ozN5!aB=@Q;RnH6%6UX;`3Pp@tqB-qbLKZleS+GNeUmJu*a z(~!Qm9$91Vhvwt_)^0X z4NEm_)UZjzM;i7`QdVeKso}uo;4%$t?{bmMxJtv}@_{uP)@oSIsaM>eTGH2PSg&CN zTUX4h>ff@?pFHkMfz2AWXgI}6(r-0v)3Be$xqxWcp<%a%JzOQElDkAc+B9%c`r&#w zH+QnKm#%dnXCFuEVDUPW6^>f>$;v?uhcq15aDr9Ra74pV4aYPLnyhS`tX!My`QhEk z%KQhtnON$l+>_k=i}4cvtVUCme@FWnx=m3=6v;ZR;WG`NbJU7teJZl}=(G|iGdk?f zop+zVcA2a*8ejOrPa1A&IIH1n4OcW=)$olNJg?z`hI4}R4tlH8MGcoEdYLXN4CTY) zJU4suVA{7Du4(w5D~9M?=j;=ZIG8p`)TntwGXAImE4?d1$_V+NHT1bS|0F7kkGfip~D6AtqGk9`}*Z&Mfbi7c{ zcOcvIihD(^sL1<7=7QHn%pre$I`$ea`j(+EZrFE2* zC~+Abr@!_(wwy3MJA1>;P(h-lPp3VYuUT2gLxL-ctR(W>W$%WI;b9%urOwrKRM$~c zM=c$Xh|Xgosq?6g8u^%oKCbicU$dtS@PG8R&o@=6ElE%6d|&T>RjMPPVr8#-Pf2QB zTAuEWMFSlTb9ry2b=47UdOqw{8#^b9j8iXjacjJB22JS;58ku z3tloc$iPzW?cm97I=bsvvLh|TvUKp?u;oDiQ}6qiKV0nQ&Wy0mhlCN=keXr^wg23qlYNeo~AIY z`ZI?&$W&nHrF-}6+xit|mfq60Z|mqooqhbo6I&99bO$biA)) zn2zB(2I?3j_6O_uK%DTCww~wE15@rdL{f+54?UAc2s2j4NFAee&`Cz?7$YQ88D$_~ z7$;=m_1S%C==+Iwt4qPtmb&nle?Q9JT2>c#=Sd*=OmP&B+_~m^nJ; z>iA5@=Q`%;d^r^Bbgb7gU&jKDh>oQ?7IK!|$yvmSRwBR^o-6iZ!8FyZOWH>|mg!in zV~vjGQrrq1D|OtMrVvnvU{yX~lwobYT1sJqj*U9@bKG@olB8`qw(HoeV~a$$>bN_} z7o4uVa4J|o7Tlp@r;a^3_UhQBqr!A$H@$a+l6<0g#*h+>Htp;=RrEkcz3Iw6j@@*H zJD-C(4(T|l<6|9%bsW)gLX3BQ!*^82F&)S0@MFCG$v%}s2iOw|ToRutxXO1*$0s^| zJ(2aPj?@+EwB)s02d7T=vdnnJ_l1rxb^Jm1&~Zk`SL^{DKk7KE<7*w4bzIT$4X2)t z3py@xF2CaAxe)W7=S(U4zg6habmfv*CcpEk5?6J6%XLP_cS7<;tW;;;H68y*q1{w` zuj7Y&eP?xmff;`i=2soR>8R8^a8u`dwfKczJwsuOZZ!6EhCP#hOULh`$&-Xsqt1>h z_?M2`Ix@m26vp2=?y%=|q=mhD{-fhx(eE_FYx0q*{@gBU1;X%!QBV{}J~z}ynJ&@U z14}@_q!~)lJDL74GQ%hm#yvu2g^?Xb;V}N_>D}Tn)T!)qcV~>L=Ph^lhH+mQIiguq zkyg@s32_WtGBsFTcJ0g&YvZ`(gC0>p5^r4h&-u-T2iCjY}7% zBtImKp<#>-W1NiCFv&Pd8aO2Mj~0b7BFUu2Vm!OLiZ{_1CP)$w ziYJFLC5)fKxEaP&x@gtH`@=X8#xxFk7&Am|Rv5Fxm`SfL6bOv;o)?-E#$5J!7@NYF z7siKSEa!D0jQL?K2xCbYOT$=5XBd;VD2&DAEBLuEGGm@NDo>IbJ_=)**e7PvXh~Yh zNgBr5FxE-Z>M+&_pu&CeAj9JAUj5gHu_2#dG*h8*7O^>uEn(~terp)p!q^e!o9}$z z!M8n(mCec)f7d$(?71U*7uz^f*)5tWk~|s8y+ZC2`N{r_gJB%vc!lw47>C0+BK*gF zvW^NkDRR#H{$pHW_!EEx-g0uYO8IdZLB)S3=sy+4Ct(nb+Mh%DSs0&(aV?DNVSEwB zmoiW1Te)Y#_$rKxVO$F1Y#3j2SnK=Fhw)7q=cJ&(ET!Eafp2FjX|uelUJ$a+ByS(i za9N^P!?+@VOs!eUw_&sqWp>ebVSFFv%l_V6{vluI2Ft4TzY|n~6#sJ=zl4zyL7@nK z70tV0q($(X;9Ft*F5r(a2F_CMgz;w>e+hG&>pvYJ!!y{noVOb%rp`a2`L9TlJa{h< zfiHse2CTjo`j~J~!g6pE(f(gyCXH?kDy`%z%!E>Y%U(j$V|36Dnp-#mRhf@dOV6hX}hYDG{xf+r%V8{tYW}?tkB{w2|QA%YhLr0PJ~A%d4hhxipqI${Mo z3+NKTtI|5IrLX1Z>Kei85$|+`9mOmu*`28o42fW91Zo6Y1aC&rGXgz=hO-qb0$Z|& zBZx#0jlhuTUsZf2nb}JBT+cr%UkEr6Z-Gigkc_~MASP;Yk)viSS3dN%g?V(#p8g&} zGRoZ@1NX7LB6ur;_ahh>LGK9Oj^JIkD}p}xntdbQ2AIl}??kX>w!-Z1N$P-no&EyO z9?9kE%4L=cgM=9z!3P5B_w^@hcn$x2wlXY&;StQ`#ED=;1S2Du9Knf^iXy zXa7&~sz?1X5sXchB767=Da?m|1hD>-B4Ehs?fptPHG*lv&x&BWfEoE}Ol6oUoxl#6 z9l;#Q$coVjlRji0MzE9v7Xg==1raQaV3A;^E*3z3Nd#Px2uM4@(5Ps z7ssTPf~VXrmNrLO6T#XD)(OMx%(b2_+9i!`WMyb=Qv{niRih{u#g+)RM(|YxXCv4a z!S)Dd&QU&(U`GTyBRCep@d$QBusedo5p>?4vxk0L)xST20}<@yV71TQCp?o%%~1{t zZaPO{^pIdKs@xJEiQp)`PI#`sOg$07$p}8-Y>MFHd<&-p449*2?aJnz=BE<=!QP^_O5~pr+>YSy2>z1PZ-l%P!9NlFD+~={p7QWK&oY0mqAU=FFN%Al zUFlI2j3QewqR0@C8AW`aQb@2rih+`Aide`Jl1BEw!fJQqb%VVXrzWN&u+kJFe+&?1TyZkZ3rQ>RT7ZAJeTk?o>*A&M6Tw@*p2 z@KO{VqIg*t=Ax;TeM;KtD6&(2YL_TpjpDT^UXQ|zV(-?Rm**>8r4^wl*cER?(M_V= zMgH?K(-Ks?;NjH>3Pn5WQHFC}u?QRusLX7#+o!DBhO(ycb3PDEg!- z%#D2%??mw~2WzIns~AJSC|1l@7#$GB`>d^K4iw3q{0CCjps2SKU>F?5ko+X3G7O7i zcoZX|7#YPVNunC7mrA8%d&fpGF6!-+rij9LkrQcI02N+J^PFLlL???R!(GADD5go2 zm|OEV+EDW=SnIrP_e1+Hgc~N{A#r!B12uU3ly)cSJQU@xeuG&kZ{16a& z72q0+dUm#M|MSdgXvxR3oh_3 z%9R!<`=Zz%#i=MhiQ+(%#{xK>U+$qOjzn>k&hSs>VGj3I&j`aYP8P{de7UH1b95q# zlTmyu8F}$yAlZF^a$1?A)*!5b@*HL^E#qB8mj^bPt z=cBm6=5zgz;$jrnqPQ+uE=6%UiYrm@ccs4?m$)kAxB1rQrCRr$x5#`K#rMLewg+T> zV22;cJ##zoQxrF&_(M{Ej)G4Y{2Ik?68(ikFgokt0)^Y5TU^-|D8JK_3wjsvOAD0r zh032%{FN%MQL#}~ecXQBiQ*rwbp|pG{2RqxF8Bu04Q~}n6InoHyN2mcv?xoGVey25 z1r5OPMkK>PAyK${J(qh7hT032ECbmF?lX{Mps;}=28xOfH)i(;xL0KPl38sQDl|gl zDa!%FJMPOh(DHk)6X+yC!*dmqB@C1_(A>cD21*&Y-@qdV9yMSrR7x9o(7;0m$`~k1 zeFNnUCnKSl2nPQl?6;%s8lsjP4Lcz z3iZRUdK0R;fqjcSBQ*>>W}tzAh6WxtP}4vi15X;@c_TfxmVw#^=zdR#g`=`3oUy|@ z)OyN5T?6%mKf6$2lS$SWNl<8!^0a|x3^X$EtijJ?rg1+Re$nfn#s->*S~COB8E9&F zJ2Y;<=zdJCxXANf1}e8;2O8*3Wdp4Yv^MavfmaN)G0>Jnb1J8Ufp!Mk8+b_!z98~N zk+d-MYHk~`#@?fckYTi=flda$Qia#pM$zmdk_rstp7ZwDuN&xUpj*D3ev{MQ$j7N^ zNS9L$Xa-yZF#|dqCa)5~s06a&ereddmD|oH|plX0n+x>0<}dX3@xtqQcBft3?aijhVr8p=ZJf@_d^^PQfwSpF ztNOPK&K!|7X_R-axXZw91A7cKekAisQ_n2JUeW1UF6;Qkk_QY_?c+agcxOik4IJXs zGjPPfQ3J;~@h_E}912{!Sn{!*Wr-OGsDDCoofJ9awe(L6oaP#6;I4sB4SZ(cl7Y(x zK9_>NHt>ysFARK1-w@_217|s2k=&d?-qqx48?P&tE>_M-D)9va=LPeZTt*o#=0~p> zxN6`R1HW<>8@OiR2Lm?@TsQDr;q>ned~e|I!k)pDJk_Ze;c@C@MCmdS>*q3iD@RjS*+Y+;$9O4 zO!!Qsn8kJPoF|k`yw%Ns(dV-^EI?C5qofrin+EC>@u0j@N&Ql5OInB}!ov zMNIs(L8XPYG7!@gqfdx^ zGK|&{{G^GeOt94{9VXQ`(ZIwDCSEkr(8SXwnwe-WHlH!^tck{wv5^U8VU-w~n0U@a zQ(m)rO|&%8N_1L_WCN)~WlDy2CfbYT6iGWNQ!kn5VB$5Y0L{K^ zqLYcvCSEboF~6nE!qzdhi-}iF&}PawEimbI6J1TbVWOMKuVEl0rBLU;qS^dZg>@5Q zj;x76CL$)HCTx0_3ByD%=;y;)ynQn{pzmf`CVo!_e_HJOyj{>W5i`-(#5*S9CK4vz zG||&UQgZc>;#iYBcHJZ1Lx4)l?AmA3dzs$P=x?*a7fQZmqPOWiqp)L zetk^5|B>=#8~?i|`k8o-p73f~_$~jKxVIGO+j&igD*ey97u z#9$M{Obj!och!q*gpZ9mSdt@{cre`GPldkAI{TT&9dQ zF^;pqLXL&;CMKBpl3i_LqKQc+HksILVloHO#9R~e*x_Q0ha1y4G?z;9BxJgY8A5*d zWvQ7aW|^2x4_~GjiCL|)KQuAl#7YyZxc-}1Xkw{kTx8^qiRBVj2sv$;*DeNv)h2c=Q`WP+Cf1l(D+&XP`@b#{SSOeO z%aw{jo-VAxN@u-PoCQh38*u-%zWeb8QL=x=W;iKHV z!*?p5`9#3(9Xw4?XW^292=vpQ-zkjx-_r zFAh_d|G(%R6aR>QmW6*!++`LEJ>~|}Eaa_J(k&FUP{6{dm5R^umilJ>i}NYC%_|jH z_;^sTkcA8j*H#X@f9sRV8Ps${h);(^86237<#{V?fxy0 zTggIY3lCeUV&M@Bk6Nf|p_+y27TT{?s;*Wj`-vPYrmoEl)UfcFh5w?*Rx2cH<=2N* zy|G%UZGrL$3w10!DM^enu+VxI>RV`Ip{<1m7LetC+QKsy8nV47Gu969^GD&LKjbu$ zTrDj;%Z|0s#KLnHnptRWp{XQ2zeeGmb#RS$C-uCA*ct_cgDotqIGi(njZ*8|oF{+D zIe6FKifu0#Xl>!wF<$?-W4kQ8YT-2tFIaf1bm5mQbP$6tTIgeYE5MdD%F7lySs-{t zBtb{^(wQ6rhRznc2!DQH7D+DbuhSZz9ktNa!W$O4S>DC2JIz{1ZTbF_1k}_l=oZ3~ z%XcL0pTpi&*x(phNIJ-KU|Fy&s5Uek4jsV4R~F8)nLPZl_}yBJw2+{(h29q4mip(3 z>?N{?g*OHC6q!2Qc+2t*ThiobpgtD*T6oVwe+%!VbVR-@GIbJ?k^?NfZ(*4511$`) zFhuYNA_uc#Yn0UQR%`H#9`YoL2bO0~vM|}gGz-%$Oc6U%^R4lgmbbCgoFU9i3$y4Oa!N*Wwvcn! zGgotKo4MSrk^IoYd<%;$EU~~d0Wu3LEVQsllowa^e4}_X?{|>gwaQWp%PcIn@KJt= zEk~xUu)tdJ{%fU>yx(M?{u&EwEgZIR#KJlY>n&`zu)_jR{x?|IY=H*|yr11@VG~!C zRX&!^Uj(*T*vdhy@0Ghv3{LBoOHbZuVV8w{7WP}%ZDEgvy_^DT72aPn?V;pV^pGxX+u37?4Sp2fL_xlUWq8fkA;jf>kEKhzS zlDGWiKeO;Y!H zY2g=6XReKsH2#n`zK8qze@hwUV*m@i@%_WXpBDb%@-F;e7H(VkTkun_`%?GOcQ}LO zhWfQ1JtKFy=G$KHrP5id3$g6<2D|%y|-x| zjC&3fkNa!dcx9b3^t`{ejVEl>vGJshMmC|<_b*GuZA>ldf9g-K=bx?a?(aXkLHnwfa?QLU#)RtKmtXH0C>fgIw;Zy4u*DHN(yu4MZ=Zvs1#>QA1lWa`3G0w(#8xw3y&HR}iF(3BMV^zq#AMrFW8WoO;oxf_-F?Dk5&1vVD4ImdIiZd6W-h4cG!`8fSz zR%}G@<{}>@%`O!SABkKhlDB&+ZLG3!#Kut@t8J{YvBSnr8*6Q_OV``jU}K$)KjT?@ z8dRvZE_~Nd74Jr~kwJESO2ZaB*Il{VP4{U>dI4w^Y=F1WRWHV&S5&_bdu z9kdca`~R73E4YKmb|Tw5c)`Jof~odWew~S#@nr|E{Qnsq!gpf--^}eSvWw%b`Ha5q zpsRyYn-#~w8xFcTxUfkv9CW9G1J!}XanH_5Zc?UgQdTkinWH<1INsyF3}O07*#JQ_ zpJ9}*7nzRtl9A=W7QnI?bsg`WM247ycs@=z7*H&iWDf^#I;iWSo{OFidO6tYV4K4a z^`p0g*$(D7c-uiA2O}JebkNtqI}Qdq806qx4&r8I%Y~fx9Q1QAcC>egIQF4TGW}`a z!TZwQ4x5z^HY+?++TJ?*wBNe`ec)g)=ZmBcbui4qaMrCr+T{(t@Qw_EWP!A=Hu#op zRz^9P=wOnA(GE^-R>rUt2k-H4v}D#e2jd;IEA79wS(zZF2x$EKO#fsDGaL|1aWGZD zG?CLqzH}gsfvGbkI!k10VdgrR=YTJMZgB9SgZU1w@5@=~V1a|Xo0a7+XDxQHkPg`; z$goJjZ$o|LmpEAJ;3Egi9Dal!D=1&iD!;|c!q9jNE9T)<4pxiJH4fGbp#8N1)=3i> zC7|5sV3RPL9c+2iJIUW7QDeD>w>#M3;0~7~2Rj|?a`35x&m8RLz->_uIymHDkAuAq z_Br_Y^}@gI_qHqh*?X);+w=o8zD42T1IgoCl*0~=I5_Iy7(1Ezob{J7k2^TQu5i8E z2V+Wr$9>zI_=wZDD#f=dr#J=ZOPmW^mFQMw*jCTf=MKJbaL&Pb2VZig+!NTeRr$)n z83&y^1o;X-&;QAsnP;C^xNE7!X1 zN`vjnVo5r-P5EP+@;kFQxXl%~c_6Kp?@tGRamgK(R`)Oe;lnw6FQ(sig>RDnO<%1X z;0w9`(jU0KxhUZx&Gq^`(?ynx0xoKT?8emm<#eW^_M6R zFj~?@DHr8jly`A`yK=va(k|-v^B3QtY|rz**CJTPMOhaF43+zP*(=*V|X{xs>KE^rM;2xoAoYI~9gz0jrI;=(QL{xlE(U$*+dbdsN|f0f?@|&jk}i6?c-uvuiykijyaPR5 z>}c(6U)SV${oIQl>*DvkT>dEVPE*e@3U%`_^l{PG#Xy>M@s5jkUG#S`z(qe7wO$A^ zyvHW&^2V#zE@i?lWyvmuzen(!E$_RyB>V?12D=#MVmOwLa53Hmf61NfVv36iE+$Hc zlVO-7Nz6Od#Wdl`Fp!}p!AuvkT+DGXSMoB;Yyqi^^CbI+qM6E-k_%ldatguzIAbp+m$`az#mIZ=@{&^N8#%s-*F)ln>W~MuER0- zV)#k=_O^?^UEFl>vx{HE$Su0Ji(g%gkSxCmNxX26@`sB*CCZAW_`f8|q`fZ&@32v0 zv;N^6e9W5{|4Q^OF99(;wh&LiQ%3Y_U=&%#gHX{ z*e@VcB&}r&C>+DlcQW4|ok>}@aM62X-tk3F48%o6-WS9E&odZh7Je)u7(=lbKJS4q zdZ2g=C1NO(MA;-t#!xDTd2xIg$Ne#sj^X1NPBArxvN4Q_VQdWLVkjSj8$&FH3Na`# zG>_r=7#@h>!5AKmp+*dR&F~?S564hZ0GUbxDvRVDUzHfD#!yY7kBF?EpG0K_Mjwme z@fhlPyl1m!3{S*RCx%)v)XvXBgDIO&#_$vyD^b4in6i+v*&v37F*IR^ORlG5XcWV< zf}e?b?sV-)4)s%Z8ppuZl~IPKF*M6BC}ohATg1>ZhSy?vJ%&~>w2tAW7&?er8tO%Q3tXLl;r#7(=HRItxx!g9<4?{a1x2!|YvScq4{L z3{fGw#h}KZ#n7E*g`qw(Qc_D{bi+!`lLS#qgGZyD~?5$Ixx0w`%nfvTqFU2zY3(!a$xD z`o;MFO6VWM05SMJoxi8|#xau^2&guQ<5fHNgBS+0$Mz~iBubuSqo98{dth76=om(@ z8he$IF{E$H85QG!e{kMjg_4?|j7sCLf#YJB6T{pX#>X&0a!rh3dd&OLa8eADW0(@d z)EK74y!VyvX&SgaHt@{3+)kBz&2j@|W{4)0XT~rqhS?H*xn}ywgT-H~nLaNDevoHH z3@c;!FoyXtETF*w{-vBX!-ESsiTVZ?#jsdZ)@M5(Y|z|hvgO)+eaVQUQAgxQiWnMAdeW=eTy z47)g*F&vIzx2Wyo5)s25t|tzA& zT$Z^^oy_6iZGDB9>aH{_C061 zfW#v{CfyKB1sc2=!_P5f$5A-$W&9=*?CTh20_)`Fte;4qF$X7R({7b-X zk+e*Of9NV)*yBJPcVkFnV^3zJi!2~ArRIx+*_o8813`wA?vHy-E+mp9LuMRV|0iRS zIPQs~m@rJeH;$Y*0un7M@;;F%vniP?OfZgA(ad#LZU;)nQ8tbq2eT($$t=aIKpYqL zDh#Cslo8pae{Q)r%E!IWzEz0h!8jfgtcZMox%PRVgR2-vr8ug@Q8kXrakSZ|JS@`Q zrw}u6=qankQC-|16(vK38gV=pM{DZG@pv3H<9IfX#&Oh&W70mQZXEUEs2#@>lCe%4 zZ#|Uxq~OXceZ)@*Ca53Bia&B1#__a(2622o$w!8P;29wa8pSdGWEROLaXiO5-^lrR zpVBnW|5ZWDIBHzTY#s-%Sqv@WcwR6`MmLY}?vY!G&fzD0B-_T(E{;xdbdIBa97A6S zc8GHyUg(AVHoh3gOM*)k^ll|ymef~7Qmvza@WkBmhjO}zS~q${9IwUkxqk0Tt%s5nN)5s4!jM;=F(voGm4;>dn6I~j)=$L?x=D-Jsj zCk{7`zBe=D?Di)L5HQ4qd0@XnoQNX@SZ#iP?9DiO#?dR1c26IFFAhN*AH-4dn^L{w zcsq_kQn5bF9!I}8-iza%INpt;{+UvIWQfP$(-sAv+OKrouk?>&KpgMKF^~&_6&U(& z&ZPay+WpFj{mS>{13X&iE%^xf{^8&_hOkTHIM_EhJdP0phQ)DWWhNPhk@*ZUD>){P zv2jd{d#fmaqrcrUomJQp3yxo*zz%V=`yZy6h=&Opl}Opdj&7&OXs0 zo;A!jBaWGI%!+$A-E%}P-jOz26sAnbCOKCy!TdND#IZVoH3=+?V^JI(6X=w{;y9MX z@fn>kj-_#Y6vrA)nYecWT1HolV`Uu6IVC$3t0J}HV_K}+Dlz-YuFTaOtgg8P>*81+ z$M!gO#IYd`mhM$Rz($dq;#jsLEyZt%W2=zcM6!D1cgC@c-4e$!+Kgil%Z&sN#nJtM zvNw(c?8Z3u#j#%))*&y=JEmhQNn*;waU6-mH`d3D3~6J1$2kyj96F$UN`EU8ILS61 zP(F#{W6l?8!oULx1MQGMEvdwr?Y)uuB91TVbqTah;7lA}#c{ktvF8)K-N4szoaeF= z$2aukHQCDjS?8q3F0rcjXRSDzb1{xfaVQBqknoOSFURp$9Jk{hz7ogPIKCBpEsh`J zxDm&7iGC-NI^T23tSL_LV;n!l@oOBvNz%9UtR)4EiHk9l0<6-67VIEp72h>|0@NOnvp=E#Q#pY zsmau=1hOTmsK~+z+#{e!!aLtiWxrP#T1(aTK3WhaAd)1LiU}^0(oCR)fRZ9hrAYn| zkU(iEot9J9%1Tl>k>y2J5Xo|B_Cdh}4H9@Lfr<%KN}zHAHS_t06R0M*ipZ)WQ+cZ= z@JIrW3iFuA8X{?p3Xcm;)uC1bwG((EfjUCgOW;WXPl-%*LS4Zr%d}8GzYiNG@U$d7 zBeH1%jRZWKK;s0O2u_vwoZys&W`djNr?MI?II^R&S|-pcfqTpQTeF!56*ArAi*W4{ zXrI8#3A~cN8CAqE(wfHU|a&P zCh%GU?0m0#*Wc z0+9rw2^a~OoF+SSdu`9*6WY;(-ei2>NbabE%KC$flYpB*EP*)dEJ;l5eLL{iLGJ<1 z7w%;Cu#4p-&?AAj66l@4n^JDi1bVU1_p^eBJZt>SBLfe9-{u${Qu>I_n}@v5h%Gy$ z@Y8wk2*aKVsk^CKVNCHDS1y1D* zOW^yLvqmN`Jc06=fe|!vGK=9(bN{FWMkmncIUmCqDUlbE%)`p~1SZg0asQG8CMLWK z!R!R)Brqv~$q7uMyB=1ivWF9BcUbxSLeBIAX0Tfhdrg~}0K+Vak{Ks~U~U5Q64-E9 zIo&FoPs@Lp@Sc;Op8zqRT3o&_y@1xi~nW1q&@mt+Oh(dTORhGIjpQrU|j;|6S$DTdKQ|%{saziRauz1G2v~Vw91-WGEI&@3h~ z@T*x21pHRvO*)m7wc}p@pn<+$#oBKP+)Chg!8HCy0vSgY0){_@tUNf#hnN0N;7$Vn zNOoSz`P}lqT;!7|n8aNUT(k7FBnl+qOL|>RnF8FR4DJ|cQaX#zK_Q8Zq__Wk;HXk4 z3ChW7fh^H4lEghpWGA`(_HXXzFPucPqssN{EIt%^ZxXplen=2SlivQb*HPuZBq(!4 z21If?6if2d$m^NXNfb|_ghWdwQA$9OdEOJ$RJdQF1E0;Fan$pKa!Hg=Ld%1mhYCq3 zNt{pO0_(<_B+);K0ZBZRM8zatPU4j$DkV`li8@I0Ij6Rmc<4N$Fb;Oh<4(8Nix6BIEW)VYtPbBer#~`Cm zB~dqtXOd_{XBd%Hk5w8Gte?cZGv1kS@h1KTNi<|*oA?=?PU4HB3c<5UG)|&<63-{m zN?rv$^mbO0Bq*OtqA5EziCb)Y_aGU{7D=>B@*kGbo^^i9-zteV0*G5DF>X#aLEC($ zN}C{~FG%zykuN6EeYU65dwE(18OjHaDIJsOlteO#yd*la)k!3h-gJI7iPw?{ClO&A znSExk8?#HUu1UO+MAxh=h9A#ogpyE`-dC43kpv9jXNo^kd%0I!U;q5Kkf|;EB;*c7~SsdfPvenbrLKy{ShMZzl0}5`B``Ej`v#^n1|_ zDrCKtL~j9G=AC{_>B~+#th|%NyGe|HAh%x7>lIT$~i`T3LNz6=QmNa&D5^Kx(=Or;mqP*dno5aZT znFJpuF<(;e#C*w>Y0cVZFHB-l5{r{qlH^hxJetJPBtA-FU((w(ElXm#fGtU^5U^3? z$|P1Lv6^#%){Z}<|8Ix3NqCywEFiUI+RAd1*q+1=A$N=1DRS5U zQQIS!dG~UfQnGy5|@%FmxuCsxXeYbs{gMfZYOaiiK|I`o5ZywZYJ@w4Ab=_I!+0O z!@=()`h5~V&>9{4u<~OPKP9~vOgbG`s^7`v4|eq1ZpW2hlHNJquSxvIQVwSGTf6I~ z1aEOTrUd^K`Fj$7BvEg*j|{V<0G;aZBnsuhpNBh1{KLsBu2mopzC3S9zbnx+!Oe%K zr3)ZmP=Gzmb4%nQBcJEx?{be|W*+Xz!@X>2k6@O_Y>|cYP(%QE)}d$~?#siv<4Vaq z|YV?0vz;lCdc*FO&0l7*B-JBn)+Y zpy4|?PloZin!~`CvAn7_3*#v&6qA~V!L5-!Rx8hh(K3t4O!k8S!8)5Vf!(pq2@n#rrg|V=8G4}r3Vf16mgz*y({|qC{T8E*t zeZ)5?5D9~;_@1v_l$gK>!wkcc)bxw-8!O5XFqK#KxsL>+VcwGY-;3j6B*GX=RpoNr zFp^;m4r53dUKpt`28MC%tx$iV?}jme;rReLr0+=}7$m7_=1}%{7^A{?FO1=AlQ2g9 zpDdJNuK(!hFveu^rnNEY{V>LbF-Q0RIR8NyF!mG+RlFyk_g9o$MkB*G8^$?~(=dJuV`mt*`LXF`1FgAqIIv(PN`i)_13S)a1#GAv|62{grw$b_5DCf2m zyyk_fu2r}ig!;J%hi<<^lsvjt8MZF3;LrTOIFp32FO1#v+qJ&f-(mbi<7sL`|BmIN z(EVXtS(wjV;V0;IVH^zOP#A~9;F{iJVH{z1uT_pR*II>|nTsKJopPKr)jEZH6&dYb zHRog)r#Q8)E;t>=8Mgd7pZ{~*KaKEw7#BDdtGGqQ#V{^~0o9*ZFSFb*im3jYYDTYy zaf6M&PPxX3cT>^pG-F43hHsAL2ULt&r!Y)fm=#n}RK-my`0QNjpZt%P=U?v~ys2p@ zOGPmiAr;vwimT{0Ae19CS16;ix&}z+b`6wJakC17|CpszV8t#a9CkE73Edjs^T^k6;xDI@kX5>FA5B4ux?l& z+$X>&R}ph{5Vy%!R>2-uNTmgci@g%4qN1vbF)GHYxLd_NDtfDUMMX6g_o{eCMN1Xc zRotiIQ56kU+^?dBiU&nQ#|C~s)>QETtvZ=kOGO<4#I;3$pl*gk$%j+8@uM5bjS|dmq1};P=r;&=sRXic7j|puowDiG(CMup(@sx_@Dw+zD%cq+O z;Cku*mQp{hqJ=Q2jm&gXEB4XQoEKGeSJ7HU8x_y0Xse>5icTtSyq@1qXa^PTnZ16H zoLcLZ&g+%uR19A4yUO16%558z&MKZ)(M3g96)&)tRXn{xNo-K&Z}4TV2qj?lmsIp% zYpCd{qUJ^gfgIjuk1g)sZ}(FDr(J@VRs8f|kb$_5idR*HRj5o=@jCn6DSVUttD@aT zWoxBSn|nij+36eo;XnSq;J|*Nw^SG#mA6&&Q}K>qCJ~cHRA?$Z6)6=ulT`2k-h>KM z#fXgx*KI~sSb`a~B@2NgAf_U&V%|pO1v|8Eqd&%7$xaPPX;^~(H1E6IL2Miq@2VIe z83zjG3ipQrGFF{hanzK;$$~!=%5x#8>SGn3 zsQ6UH6cyj7_*TVK71LCFq2fyw(^Y)N`Jr;r&uL7Xe11&){c?8QO-k-v`CKdYm5Q%b z^jerZYLn7_lVU#WcbUFPnW18)irG?1&yK-a0=^Ua^Co5ICgr)4c^5Y+Uca2Lf6AT1 zk;V5p9Q*WtcDIV3Rs15%l1H-VshIU{&h$gs!)NEuSHW}mZ{4g=zU+)Z@BaQB$YQDE zuPT;sTrAFN+c$ryie)O+s#vFDxr!AWeLpE&nR(l^{NLC+DpslZo%6#qpYw-+2RAFk ze+phLv`e$#noJT)`PK{ZhZNlMuwH7hLB&P^i+UGsqN{IK25wfis@SGtLj)Tm*sfv+ z{Xc?k5$sg4i-SFa2P61P#cuX#1VtkFTg5-D5$*paYY+XlOW>3WUipEXQi8w zdGCtg%WD3$ zLxZdutNBm_^&)sUf|vXFZCgKr2GSHyMes-jkBWS?MSfDl2p)@|v7|PN;K;9m7xra8 z9s%i-5j2h93Bimu5pe9A00T2NlPr`cZXUtY5^WK|a}jim;F$K zC4!eC=n=vD5sZuAe-ZSIz>2_*pqB{08o_I9lZ=Mm5xgR}Plj{6Uf}fz-jHY{g1!Q1 z(mU+O2;Pd|ZQ=A2+EhH5b~auZpiDS|wel=;0iC}O9 zLn4R?f1uEK1c?Y-c2ETUg;Q-=z!Q*)fS7?sve0)U7$AH`(;PAfvDq_L4UJ$_1n-H= zun2|=7!kopv5;m^o|e$^(GiT1)aMraqmN;1rWPO2sl;36h-XfS;A;UBBbX#$as(eo z@JR$8N|gTjkpTMbrx8pM{80ZT;)@d699d1v&LyjNnql z-=u$8D8ZG@%GC(2Mc_5czaGI{)4%;7z9F1|=JQ`^lpoYkRKrc0|8a@}#gPvUHMb~P z8j5KMX~@=mOL8=SO7FPEzZLv&i?Vi$(rkWK2@N+>Si=LFziPdthA&#@-mT#l4QEBN z6sw~lUo;f3*4d%kG!zP;p3=fEBebm0aze{%xK#jU(l?M5G*lGM?LsSQsH{N|d{;*D z4gq&+{%t2SGE~t}RhZYG4Km!Lp_&H1WV=_GkGBq1*KnV3?iX4^C_RmVVtf}-OY=WG z)e%}-Lt<`$vQ=reRjI4tK@AUSsHfp!4UdY#`WhN&ctmLS8-;eU5Gl(Z!Y|&H9Wsn zX(5#QTe8q-sFl#x8ro=hR&ZOPOya(N{^W?DdarCQ@9Ci7ISm~}`M#~n|1@-B#i>n0 z7Y#3J=&qrwh8HxvwpHn-fnQ)FSMr7z%UQX)#AwR%xV*!8FKOtZf#+f|TCYg{%&khx zBY8aCqNj#lVq~8uf`#q#U(wJ3>81Q1r&8_P!s)myNdCC(d0`ENZ|ztr#*M@04F46lqS{;h@?bj8Vqb2!o$WX;qtTf_H)XKDB@-CPU&VKu6LKKF4D z{2=9a_DK`afmdJM`Wz^Li08JqG6?mRT>s(Sg2u{hUFR-aX`(_`c=ac z0gE{&%*rj-y|Csxg}k^d6}5cQXAvtj|K-@Y?aCkg3$Rp>%-=QtTrXDk$teY#l+KL^ z{Hb9LtF|a>wZ)psa&?@){#z5|clp`4q0Sx31)&#(GI~kFALFtKu4=f(rqEGN_b&?9H3W4O z6?}sudUkF=a1o(xClubK13F6RxLHS*j$*pM*epj!NcWEwV#wD0A<30y>EniSbrcsF z{{D%n{AXfG9k=Mn(~+;^*I$BUmJ$Ib5f|tv)KOYT868}`MkW6RrV>+(M@yC0QAtN- z9k=SZO-JrdrGoBn63=x)6(xGRP+GzyMaLaF9?(%s$DKOv(s8$rdvv_^QDMD4{>$Df zI;!gaLntw6HJvZFaleilI;!ia=jJ@MQ@Ky-b;nNshpmyF$|pOOnmS&dmpg4lkP8BL z*3GZ2qYj02Jgj5>PJfrs?!uh9Iv&*VkPf~^pz`fImFqi|`a0el9O7s3209K6&8ZLy zJ)+}L9X*{8Kg#n5jve~tJf@?uj<60@$KyJlVEgN6N4z+ziH9Z%_K zrK7d(&y&q{JVUeRgcBXZx}iW?IM)X&N`kKykwXESBS2HU&y2$7Uqi*?XKe`0iRSXLCKyv zdPyzbVe9GWO?z~_p>t!t|M{bjj#mXdB40yD8D7)Tq<#L?P*m ze<_V5iK(uRl#c$ahz?Kpzm9P+ZF)T|Q{UAwP;znW@c`Z5nB06<*0~}6yu>CQqT}i< zq2W6E{-q3+J{qR`o9{ju5gegoq>fSa2OVQ{j1|ezI{poRDa^?5zHr7#5oyjhe<>4m ze*)n#4*bi>L>-fKOxE$Cj!$(=(eaT8f2`vZ9dm=eB@6@%ye*unW15cXIzH3ED4DZG z=5rliNXCsKwqZ#Y!{#=5{0ZjQI+p4F%C2v8e5+%Ij+q?4>?{r(Dq$(?CLObN|A=*# z^}UY8e<`D$E%yAO>`M zFNb&`bJ2~}0-or_5V3RW4GEQeA+S_rz6kppz*!dG3NF{NLdS0$MDz1@>G(^>?>hd_ zu~Nq>9p!f`>zPz3^yBXAKXt6uu|~&Q_GzUYZY5hs{}+X%d!)xV=-8-Zla9?gcCg=_ z!Yw+s>e!}ZyN=_#^A^=9-C(!xHXU{=?rvqOU`BU}p4q#V-8%l(ah4uF*}t{>ha+9b zVd~ehSI0gb`*j@T^z~9O9Ud)}bAXdTshlc~4@i&DRdk#Ze2j(aIHBXDMAHJy_pgiz(5fL zK?B^Y&XZX9-_=dKm7)f2GQb6Lmx4Jk{2eH#c-otQECa<1T;Hu6K9)^7y?=h0QlZ>} zP_BWJ25vD>+`xU~a!UxkS*WovKn{OyRm$+kZ=r!a1NjCzP7D?Zeb6Xm;JdPiV)>;- zhA%VA87Oa{l7Y&GzqpI<_Oqu~yww0Lyv@M(!wM@1ttj+%$wg-Iec6hE`wi4EaEF0A z4cuj*ih+9#@U!WJ@xiJD2JT_?BZZ7Ij2|DYW`N&e89v)yzPf=re=7|4iB5tu3v#(7 zu%>|r4Ae5P=cPiP5AdLY+LSa<*WkaZ3wr(S@Aqu^w{oF&{zHa;irV*-> z9x?EQfhLAOzddT;y;ln#H_*@kPcmsF1s(64|Cj;N#+fMJ=eKH;&(&W~8X$ejKvMzD zgpzZzNT9iaw)69zmMlC}jb*ho(8|D9>`()(4YV=vs)5%GJj4-ND+@TLLRK+?cl2HrMc7%&a= zGw_aqhyl$&*zga?RfVRHy5*_1>Emt5*F|%hZyB%+I0j8R+VljV*apzKe+$Kz_$ig8(3pthJl$J zcLtUkn8kjl({cuIa%LO;#g`9aKXMEj_*-242Lp5HBnGbjtvvLP@BFX+qfq82&Ko@c zN9a8IXS9$}D*4600s{+0;UWWz4g6}Lcda0k(lia0N$q~;ypbQ`m(b-j??T=Rp}!f} zCi`gqU^9+Z7*-lsCHT(_XVO2)T4Fl+vb*B74ZdVFS4)ikmoM;HZJi>>Ym);kbeG2KX-J1V_4o zGlEYEJuP(Xhd~CecB9N$1LuU9j*?!G=tW)vGJFbC@+v2PPV6RNa;>1RKVYJW>4O_= zdC^836i!j|Ursu2mWg7*&lVaI$}DL!awN*U3Z{l7P)oHMa z#wPAFalh%m_-e3MsbQj~iTbAR2@ja~Y>%>Pk5bn}Efcj(%-N&V5xRO)9x+#AK4{`0 z)Bn!PzaiH%@vw=L`p@w7ynnRrS#%_W+q6lfvQnQ|6i&%H`Z6Rm_pwU?>|+n9LPL|fr}?S!}# zWRR4|=f@5vx|rx{qDhrv&zbmsuhLOyClj3oJTH{|^?Q{UO#dW@Zfv@Few50&5|wYF zUNX_c#7GmPScHk5CM*-SiC*k_6K|X7XQH=>SHyrOuN3w%@v7iAO}u7;UqX+s%Xz~D z>FYwt>1%>Goy3CPGW}bTeb+*~Q8DqkO5($@x7KqfLBn;tM*tiLoX=Ht~sx z_f3owVV;rr0WJL6f1^9u#CQ`EOf0z=n#isnl{2JN_EYEcCJ~?aKaO)s{7`az#Qtg# zth!Ixc31wVCZ?E}O3%NLy{e!8K>GPH|75diCZ=cX`AopnyMtev_{zi&;`U#g_{K#4 z>)Bbw3%+GP#&Twf*bEah1vK2Ja8KfvYkA+9=(|suO`G>A-?NwJT0*-hU0g#`NEl zZ!ob@>|bkQor(2=)3m~VWs`}`CbpZ{L2n!s+(K<8wh8|2`NE!qg6Y7j?KH8AraoWz z7u|1AaNM9E<;f?9;2%!@^j;GuOzbuN=b%G0W}&i=qsA=UZ=&9Q-z5&1XyX+e$sqKrss;%byYxErUFfgEYtT-%(J1t_8jaX41_TN?Lf(!b29S zPszQ-LKzEXEtHaIp3r=u1wspjQnIv#TL*>+0)q?7S*T{=UJK>Pv~Zh+3KptZsA{32 zh1)IMY2omGrIOG)gjTko2%rrNOl2UG^sY?Oq2B@IpF)xm&1Mfj8n9^h0($xrF%SM`LE_4pOL%cfYQ=JD+{eH-)-6mZExXO z3vC4}6NBvpFg2kUcF15dJ6Y&#;jSpEMDe_ZF0{nPlQz0qc)`Ma3%^+CX5mE(?^+mO zp}U2bEEpC{3q5GFg*PnpWt)GO+f%C0OEAx1x`j3U5EevMYSeR&G5}Rm1;ZO@BEsU}-%)%!J{qr`5TOb`_f#+~C z?|T-WyOuZJ0&g8hTNqN~;{>YmlG=28YqQ?G^|IWf}*3QVDYx#GN-*co74KVrx z-A_22F&Nfe%_j3lk-Ri4U=I!O0F7aL5DtDdbzmMXUmh~3SU(YT$tZcHd*}`smi1gqVwm^PpCkN(XWvhka zokH8_q@pe@j=6ja1VD*x)~cvuqTzeIE|l$hL9E5v9nGP?IA{@7?*i!e>%(0VQnk z*21^SMkyOrZQN}m&qltD+ikqLI;+4&p$-1CzPv^9a+feEQzgS;F3R6yqneF6HtLEE_u66 zw4sg11a$8hY$Tx0zP!c)DD%n@<%tX)YXqCxXl7%bjrBI3veDee5F0~nJZ+ zZ9HS6rH$8Yyl$hFjn?c18$E5bvGJ^pPBuE*XltV#d$4TiIUD?n+TKP78|?{}1-bu) zlt}~~C6(ZL8(nO4v+*M5e;eeyAk>$UETr9q!;C!yykx^W;y>~;P+{Ty1-)#4H1)Ch zH^9KlHa?)Y*eJcP;1wIoDS1?3>Z{^2JRj^0+yCp(+cy9E=D*VH%SN{GmW{_RXLCC( zUpTMrm*4l9+8Um%Hlj8h8yZ__WKLFg$e{dDMYo|$%v~MMF-5s$!(5ZY zU<;sfo?jZX;o3;rh}%fms6L`_!lfX0l*}0%@@$OD4h>*?9#sfZHu~FmmtI{jz-XG* zZC5yuF4V4Ykd46th^cv)jp3}djc@2(Hb&aqWPwj@j5?}}qFOeB4Zeegjnh@ab?DvK9eQrMa<84f^!37w+F7OM*L>rTBd}w2m)F>vepvg~zkJu*mzaKTo za2%X5@ZrV}^|d zHWu2r9xt3}W4?`FY|NtZHfGyApOB58^RtbuN0lFJ%w-qbm?KegsOl%dY04;>l%L1h zUiUM$tenHeoO5ND5Dy7lM1Qcc!p34YRGa)?Z7dP6ROm9Hs}=>BL`rSH+4$YYAFSX> z|DN;lE7>b;{5(uqYhxAX2dU0#n~N|prCsoh*uyR4+&|u7MHV*)ZLqPCb6pfgqu69) zvyJ^W4%pa2n{E7KV~>q(oJq9Mqswx++hx0r9X58_*d?0Hb^dL}UpD@>{XI3$jmX)} z;a1bXQZw)kK&fL&{bR~rP74C|NiO1pHV)aiz+5&Cb5tHv4jog@**Ie3sEuPbKA)d; z%EoDtKW^iMjgxfIW6F=m{3cy{Oewd${23c(>2fWL5U<%#bZd*y#pXrkY|cM#81*tp6L$_ZT)Nvgl>ugQGXXz z#VE3(C>F)7QQQ_qD2nVTZi%8)6gg46OIP%2EI4^8ERu62%=++!+P`ILT<5R*mBB zD4uAM+uFfBQB;d!QWTS;xHpRGQM?|-8&TXx^P*@NMWZNcF#ElshbZFk?N*{%{oaqi7)bktiM&z*K8>VBUfN z!DCSjJE63SqIDFFqj;PaM$sgS7VMP4q1Z14PewudR1{4GG!se=7gmurkAj@1qy9Q8 zMjz5b&qUEOim4}*^hjwF#j`X!3jfVX6z!tu%p3bC+DFkLijK@aKkN4s%5zbWvV+JZ z?Ie7@&|~NlMOSuc6y1gSLKNKuFk|}lAZ1>PqK7ckuLRSS0zISX6~)U@^k${16niy_ zR|F9E5fJJcASUI;|JUeU673tsn^EXd7-Gy@QS@Vv+{orO_P3)Ln<%@gZ6TxY2s0do zDuA3w6qDs93BXCBjN&79YZUvV_&ADBqWG27q@zYLC5j*DKXijArqNet<$fE*^e8?f^Q7`k z6rV@&wAdQg~++yQ278 zIDbX4n*(Y>Fs&zgxPT#z)66|0wwFVDLXb8bh~i)rB^})2;82u*i@<5l&ruwqn??P5 zByQ`tHofqelzt)#;^RX9cS zw0=&ZgVGMlI4J9&oCvIuT$D5h1j#43%>hm;`Af2HcTm9r&*)&N$SmuN5>#?f*@5DK z0t|NwxI<`V$<=vLpsItr9X#Zq9_N1t)f_zNp!MycdmU7FP)qQA4(@mG@@a*9h8hlP zI(R^m4o=H8KglJtsif9+P)GQ69rRxuAU}7ypZZ8QA3yA%zJn(nGl#OK}+E@7uq6|`m})GCF3&= zmS=Rf5>xqkbD%ni zP@#jU1I@wTrxn^}I?(A16LSsf+~?mMUOlah9aw15>&_@#lIlq99zUbR9mE7je)A{c z6-#m-d9#3*t)zo@9Sm^%i=*ct#V!_{zTTzjK;aA#I>^Cb0hH&}aH!y6LK&rIE<_wj ze~aOv7)CjG&%tO1V;rn<@TY^Z4&HY#-@z{q#<81r7fx|7)xif2#ygn6#;+0l#KETy zCbHIJawj>MEM|Y`_}{ZW63S9O7AAiXPrN24#QjrTcfoyL(;Q59Fw?;-2cMM+P-q|wcvZja;o}PqBDfvG9>VwgV{96!Ovpqi)WPY9sJUN4(2-e(eaOw;TbaI&|Bt7cHX)1`o({xk7OoIId}sTclum`|FM7PgOxJp)@XyT8TkT+tgR2g% zIaupporCStdh6L-)EqC%yc->C;+jtfTOI6JkjJB#H?!O`%9S%p<-sAYGu$Rw_|c)# zS!MXAg*zPVbg;|8Uk=VVIO||Hz0ScA2S*+J!=@FXmZoI>+C=sX#C!)Pvt$gn#841JVGN}td!FQF>dEzie8K6yW8Ts+lo5shamtFG zbd+Bh=`D56Diva=7(?-|gEeEgJ%&m#REeQ#43%R@oXvarm%O`TP-5UEo}Pb440pyb zw^cs7uh&_HseD<-MSx8rId{i!PYey)m#!AWeFBK@jiGu5)1><|xQ3WY0b2fmSXC>A z+5+kbCBLqKQD>EUF+3c@t#RBINBtNY#9+l>$M8rDkH*k0hW1p;<{cbr5yLYvG>YM| z7#hd$cnnXn1r}sI5d#M=O>GkMzfjQYIOOSy94Sp>{&;C7^eLguV|ZEs`G?z=ZW%+X z7}~^;-jw=!`_dfdtz*7Rvv)Y?o{fPIVr_-8jvb`LUNO8J!{RaJA%U*jw&D`^yv)&_6TPc zgROccd+u4qq#K-7_)Rk!gA>DNF?=qK7K>qc3?tZg^q&}9>F7ZOV{&=wV>0HS{piJz zilKiD?@Dx_Q1S<`cliI24yDt0u;gWv4iPXkhG7{_?>-pGX+MT3F-(o&J$6~C&=~1l z)@!ub%sP%0@O}*AV)!72@iBZD!$&bph+$$3lO>f?#H1KVnUP93feO{%Xw@|FPqqf!^Idb z#jrbuzhgKV!zm8B81}?)IEEuJ?2Tccs5&TRQUCrJ4hW}nHU9!l&LN4Wt47Yz7>*0) zScXsLiA=d%0DPKd<@l94Cjw_;I4gkTn#}WpF9>CH$cVt@7_P+ddWDKPaa@hz8t3*n zZi?f&$OPj4OwMqFgI!D_E)qvj_*}r#YC{=v5JyNjS#cDL`*S<5lH}8D-dbc!(iQoi zU~U}6<0v7Vn}xEDOC}YeaH+UIaTUfY<0y!OpMf|N^0>mkrWTf_6E4Uq z6Zd_arva3Wqnuzy%M0MRt`JAXI37))VFI_uQ7Mie;+PXhh4M@sE#qhv=kX?J7f1Uz z+Qji}+@Go1#&N7!Q3f_L>HcO#$zA} zG%f#aU4LjZ45dS!^DP`9sUzbU7611R>OJ9%$>bU>fMxNncq~VsoCfv*n>vmU(n*T~E#Gvb&T$1Dyg`L4%#;5#X+_z(Ua{`VPebL03i zj{F1)61;oC&m1pt?2cnz9P{H?9mkqDeu-m29LwTZ9>+o{<&&MkU*lLLc(G9GWScN7 zk?2yP?4T8K{1(S5DLO6ldmMjA>dK4_=}QLt;?GQ*ucfc*p$&0tjALC!|N1!6Q`x3C zHpj6`bh2Js;@B3)b`jh9pUzCKodVKBkJBbEsdT@;PM|~rmpQq`frLNzvWTmk`Qx}Ddag-cKH>!ueuoxGAecZU`IBuy2!9AnZ(dodZC6eA4;HR0uLlm zOQLm!)=r>K0(1KKf8|bl5$pb70uv|tUjP~ECGcR;3x96wow*W&*mOQ^OkJd;4n1Ue?rDS>b9E!rx94hcM$Kx@&{M(DE%v`wI$;PwK-GDp!Wg0%k-v$HxU z@I1v5=$Sy51iDI(_ekIc$@^jg-4p00_`jZgiA^nkTBmPN6$1ga5%fynWoh}|lBG`q zuSm1+eapX*V0blw*CgrF+Wu9bZvt;75Kcf9*L^F2evOLjOwOp9J>MF_NL( z3H&W{DOIJXk-cn!sRT|Za4v!KB5+3NS)u7FkY14J#RM*8dhoJv{u`lJGCh7hfg2PXi_2pXa8bm? z7bEcH2n1aebx~?4@`mCj7jQAPKc@9ZmWyI8Zt+mcL&!z8i@TG!Cy5*vxh_6+F~vo3 z7bRTub@8T)n_ZN2(ZIzc%teJRs<^1?BF{y>i;Av)eJOBJ=%TEPaxO{>hs-iAE^z?9 zTEI=jjFuPvtuAg8FuJkdSrr67QL_lw6LvhW-0q^1i^?t(7k6g#P{|#FlQRnS^U7U< z?+p8^r0#ZckBeF^Y74WPi~C*FaB;7T>MrgRCU;l;STlG_i*l5&DVzs{mVe$iAZSl7A_u=hqwdh6?0l{ zD;Lj-p4KitO8Jv&8yDQa%#*&_W=y3?9b7!;;w2Y7Ty%8N$wgNeFSzLJ;&~TcM3Q;A zo`Hej+tGfd7`nN5(FLQ2d-{~2yX)_L@C97-bn&W-*Ie{+@iM#bg7S)};y)iL-`m9v zX&mzVNG^icMc@tg%LV20-eCAj?nd5n@ir}YG1x^v7hFaga}js(j*GBlQC;XR3>OjR z?H1J11?~2~`k5{)7f~0E3tRYARtMO#{FSO-mot86QDN~q!GsIf#k(St6q*w1xnQSL zfRg=%!|cQi16+S!-auid1%|j7;bNq4hPoIgfRe)naKrv67w<_GJ`&Do7w@|m=VFYD zv1v}@f6My7#dsH!U3}%c&Opfk4 z!SBTKS%RsVob*5-_`&rTkdXPKm^a78To*aA6{WLmj{eET&&E*ouP#=(_|wG_ky+v5Hy2A?ER(3dJg?)gf#p)%zzfRnF8&by)$&Et z{<%`3wB)ZF{(gtAE-0%x|BUe4YKrQl#A2CJnQ0&bUlqc zVELF3Q@m zj=>~~CQ&wta!K5j1d_NpiIPcVB~dJi;z^W9%FBPw{7K{{kuA}!XR`TE4Nke#L(LUs zfTRZ+qqm4mK@x=mN+pq(M84p|vvbRz@W*Lsi4sg{7%YY_1?h?>H``^3Gs+o+{lDIdC@00i; ziRww*m&9{PbWGxY5vZL+og``qrp}rI9uQhfC_TAu5)UTPJc*~1cqoZ_Nj#cFLrLYD zv4;iJPohB*94wq_9uZE>F2xpoR@f+s$C7B0#FI%hPU7(-x?S`y6Hg@l!JBSC{=1n) zGcbG8B$_1=N%~J5KV4LwV%{pn2wEiZOcHI9cs7ZaNwkt8c3t$>RJ2aw{b&6je540s z+a!99SMn|?T;kO(iS|i!5aIM(@uuo~c&8*fCozJ(ki_#zbVX!nUT4c+^6SejD$Mw15^p7;`c=l;N%Twl^X)rH{|_BEeTzi zhEOxP#zNAkl?F7YXG7P`?UbE@B1>FXu?Pq^wHf&m>kP@tYX%dlD-J(11UZXeu|5 zO?#nat>Ee;)=1LMB-SReE{QFiI)t-6iA_mtPGUn68-=4@QW&V@zbL_^OUkw+b|k^U z$fWHeNoG2_D~Z3@8XT=j?2)AOnLPin7n&ELW6);i+MD#x%W9Y?JixjnaXg6=od3lo z=oLqjI4qcBkWq%C5KX9hN2$QJxjddl9J{5 z(|!q|#rOyyAX{jz&>YVnDg04mafwp6%RTuw3oa>?%P?p|o`-x7byIjSg#r(S9=`DK zrH9fU%6RDR;Uy1cJ(Tm%z{4XR%6llWr_3E5?(}f0hub_<@KDi1Wzl)NhijLVN|e0p zcO2U)T}?$&yI)q+%gS9Is(7g3p{9qb9`5#VuZQX)aF5Vxp8uzkxjp=$x^ZRjK4IQ3 z^xD*a$8vhOJwVGnJm{g8huR{*S*VTxu5}-MS$W7qJrBJ1e%SNpC@P$DS;_ygA`PoA zV!JLYk9uh6;TefG68gA@Cp)X%8(tG!;G-KINeq+i-Y* zN2b$NnhU?!6~Fqt_vZP}1iUJ>^w7#fYmeIu(Zxeo56_BZI}h#I<_iLCJ#dbth7Q7K z^`G;w>q6dy()k@TWp(nL>EL2gAcV9>N|};Y2*NeeEVraTH!~Yf;Vfe?~)WdayjiJj6xJ7U~F%(z|y1 z?UwF(f`kXx^Di;Pw1<)Oca$sRuR@UDje9!7f@<6)qOK^}&B80H~;=Q-HJ5bxia znZ3{E8t!2Pt8+MSl!s1N{LAr3&%gQMNGa>LU*yQ|%>Xx`$6#-yi))n<*YXmF$e}{~xA$m?lwT z{?VSy&pdoC9Ntdk%Ko6QJbdlp1Y5wvHy*x~rr7UchKHFRR(e?FVHVBsu+YOI53@ad z&%VB*{OsWe4|C{IqL5BCR{)pc(UO$|3V!-O(Rm)`dsuNr`9+uu1XGNG%*CGne7DrY zG7rCcSi;tpM}9Wukt@n_4}+g5`kRN}nM<-?UguwTDD#K+@AD4-BNn)-{OMt}hwUDA zcv$0Mtq5-ty3WJC!8fh<@SL>a1`iuKA6PBP*xluX}3{NwqjrA;rmc`u9e_;*Erdf|1G^nizhqTvt+ zjsUvZVGlJFjFX|CZy9zgwUtSsYzoy=xG#lrDU?s4atcZcx2ABL6n%RN@g?Od2(FmI zYg39c+FpL>NhOtpPd#^}aHrs^LhnkU|FK{d!F8X^zq%sp-DAPKQ@AIEYAM_+fxj4= zd^W^(<2guF#c+QL-c{uR$yFnTngYl_-8M*mtrTjD0C61wOnNAVdMTVr;dBZQr%*qI z2`NlWp+O3dr0`}6Z>8{P3Jp_uE`^RMG)m#I6c4_@GbuC{{Y_J7mcrvHJdr{Z;XIkb z11)^FxwA?!K63JgpZF~6VFPTzr3LqVee13?e!OrfV}=Ks0KNxuYp@|xeOy;B%|BfF2Jz9N*9A^ESeE9os$ zb6-#4jTHJy5-$gQgipV@di9#}b_)Gca8ih+@JREmhlcFmFf-LsJ-?!Wa=AmcqysMzP8%j7a(S z|MadeuKA;hYTrwNZz@1i7pcQi_isZ$$zpIroiyaKYoL= z+{N@;DPpO}kh466WrEq83@cLjO``u@saK}3Duq2M>`mcMdO`|YMPQB4bsQryBmF<7 zt^?YN+UY;uN7mq9`^56+}eD3Zf##KSc#80*WG7*>a^^ zigau!0xH-5QNW6d*c*Jm%mj3Y{UlY0n&dKL=ioPbFdawg_?-@%PFP11U3v09=b%_eiH^VK;BWf> zIrvwE6zQsN`{&?*ME?{$&y-WkI+8S{X(dU%aB&nW`LcPk2;3poa zX*o*Wgelk2Ku04XGD;`UVcSqwmc}Rp+t^e`g^u<*I_Rhr&K5da>ZsCDt)rPxn(G*P zK$&_9qXRXqbhOsdR!2J>Ol?!k#-vm-i9`rH>Zs9in2t`YaF=3D$00fnmDGDKQ9aAa zm(y07E1iZ8*Kvf7&N>d9(Sl=h;Q{rx&7*X5)zMeSnL6&gz4B-s$Lr{!qnnOnbQ~)J zyXyycJ15M+aYCV3{$uL|9VhBIRYxx!Ckg!&9X)lNEI4~4i7L4&;HORLZ0Qhs>o`rv zzlYcBqvLep;Y#uhR(sLG)@?md!&D0Ir{gRggLMqi(O<{eI?mUXBO0LN932C7oU1E; zlD3Xk#MR3noxctTw**OSTcojc;uq++P{&2ImRBn-mJ*9)oy<4&*jbkd(wgjavj5TT%lvQj#Q=dtPDGvfu=i3$CWy6(QzxY>)=-tuhMa~h#IY9j38qL zQpw|VwM1c+uF)}G$MrgH&@n+$SIWV^=l(Jl#0wK|W-W zbE=MMI;QLRXu5hDBBfiAHo8cgAsKJhaU(O*c)AtO)YVFo4?fkMD#?R+4MWb~Sqzbj+o0b=<4-3%3V*bDkiB?!etC=lJTC zh$aeQbwGwFUY%=H5M|C{Lj27;<@VJgAXa**Z zGV!F2r`Wj$t}yVlj%VmSXk9uM>UdVidL8fTSfpdIj@NX&PSxpnUdK|JhmIF?yeI{| zB#>KPO9V-`f?sCO7HO{th0mvUk+w|7avdvaA-Y;CuHZPGRz^$U+}d$=$!Z;3&aKh0 zmSa%Po6^G)X3b{(Hd>L)t3>e!~^Q)+BQ(FIGY_<9Rf&F9m! z&>gy3eta&>>5gAoja?%4I~{v;?AGz6Fnp!sYaQQ+O>)3~%e+GWpA^06lFILO{Gj7E zA^yl=qGO+qpE;JJqMvlosMZ&0tmJ{PiW|s$u=<5lfDAVh8In~szl*68XKnw|@i$$Z zfi4FAp{t?GHPFhyemXr)69$?ZC^AsTKz##c28s=o7=VFN19c6hjsJFmI9S-H^$cVT zG^(TOz(-E54Tvz58)#slp=9A({G=RNM{8uDu~0ZUlG3P8RfVB+)yzP11C<78 z8R%``bYWw~=$Z&mlPF)>Jwp(V*^BBnKhr=zmSW&M17{iNZ{Qq5eboJI;bHwb9kY!C z46J-u&9>(7>VXDk*U`>3l#k^{Q_nYWfq|h0E;VqW-kvh8VcS zP(zaAlo{`@qrFx~+a|5M%)sT6k>>YQqqS$98^?!D*NclsqflV^(I5vEm0cDmgGPJ83g!5(tvkc5IaHD~n47Ctq>t-5g z(W;U-*?3kp+rTXbZZmMZWVw}wadh#3%SxISYdwlJnn!wu#eSJ%KsON9$}tSs1{}#{ z3bd%zVvUPHmf{-l4Fp2>4Dc0o5>rt`8ciyS3}g)+DHg}V!!r@mCqG%0C$oX)3_NdO zu7SG@JYwKc1M>{rZQyZZQ_K_1$`GX@qK{7kwU$j=&hm4Bxx))uA6 zFN%jzZqw0bUNG>Yf!7SYZeWRlmkg|+DbkQQU=1u62}_yLz_Qx1Zd_W!Kq2gC&Q?5R zA)r7kGAw z#zg{U^3wzx4Qw)SfNsIWdj|h;jIRxRW8eb=n+<$sV26P%20moJNZyYOd@RVPqLWWJ zF4hzsx}{`viN;?s`eRgWw;9-OsHrWjIrkj6PW#-zP6N9Pd?DGHMEfM%ZQx6xr29Xl zd?it?!M-){9j%%zGO)+M_Xd78@QZ;T4E$)|Cj3U|*Gv1^WwP~M$3(G-<|bO0C^1pj zL{k$LCSN*6sfh+A8k(qQB4eV=M7eozcCK$KZScX6FkMu8&lmIbwvo_DY-}PubmlQ% z6H^UFK3r6q2uhUds!cpyqE!iVI%zf&oF8~(YD*LCO>{8P%0z1uZA^9a$@aE2)p-XU z1s|W=nfPFZnkG7$s4;PviB2Xo5psx$LrwLxLWjo3Nm_L}$sW!%k9?%Av#Ep}A!753#ufS2G)l|E; zL_5<&KXyl5C4v7^Z0J;;ZDN3lOHEv6;v5qLOk#Em9yGBI7~ht$<>pm~VSDV&;|QA?+s znI>*FG26r~rdqQLp3OJmm~c(RG?LN=o(bPXWFjk~0x2;RoY&P@?*Hm)v^pYm{;X%tM8f9C z@^A5qBD#pVChjtEpNacT%rkMfiF-`kYaYBAk}ehIvnFB;Tx%^6WP!B(0TU0J>cLQX ziPZ;(B%_a*c+|uacCm@aOgwI4p^0Z%H!l9AZqJx_ii7e0>1UIOojktzUa9aR6N^ne zZ{h{ve@-B$U^ax)AJvs=^+lFari_8~mrc;lmzsD*kW}-pnpj5t$Ya#4bCp|LX=0U$ zEh2EWi8UtPF|ppnTA{pd;tdnOXY0NuQO@;min`u1v5vk-_LH~uD!QB(frNn<0x9!d z!8e-NM7;@~{*CuN6YqnU6cu2%RA%D{qo9eNb_CRmkX;j?6{>m+ z5F%Y@#zK7y%`7yxP$tAi78+Y97o0uPz(Pa8wYmrQf0{_N(n3=~Dg^Sz4oj@EP%Tkf zex;0p78Y7sINZV!7Ft>S94IskhgfK1p{<1u!p!=#v(Ua4|8Qb8jgSxHoEJJ;YCTqC zsk?}&^EuQ)r&`X#EVZXWdTOqnEp(BjqpX8_+DBRke^%QV%Gq|6)T1r6JI(XWV=Z*I zaD#;z7LK!UyoDhaF0s(V!U-16w9wDOi55<>(91$^$$PSeQv~6vkNwiq!l@SOJW|c& zF1w!ha89#uI+fWs)5ij%JfUOt&al)tN-eXm;9a4eWud=?b1e)KfoEGd$HG8M&BX&O zWY$;Q^FTv2_B)mwH@k$DKhMJX7A~Mdg#Y03;|^S8;bIGeg~(j=&n$>XHqXsa{Wa9W zr546nxXQw17B06i%EFZvhFQ46!Uzi^CF5{`>84YRSZ4)xvESo)u4WyQrEH zrcXk8$(HyW3#P>-G;|Awlt|(TUU=wOVq0)Th-=|pXz8vmA0^1(i74teWYcz6Bo^`( zB4N&2hy}?J^779l@KP>03$!9$2eL5F!dzjvzxHhFZVUHVxYtrEmeh3TTS&X$S84SE z3lFfH9Q@D0gBBjLaI1~mY&>k?5e^(1?QA@1;V}zeTlj|iKNg;_@HU5ug(odMWnn3Y zhJ~jsJY(TG3(s3vNVQm4EHznwTk)$^jTVuos!=KbR9V%CGZB||FIafd!YjhF#KKF0 zyv!obsvOo%nbV=A8e5n4d*`EymswbDVYP)d7FJkTX1$77HI**ks{7 z3!AAH*`44#^1g)+*xs`;hyC5`%2JIFBV4zn_WY4l=@Wq;3*^fGr^i*dZlm+3&$sZo z(9<6OOmOzg7Z!F}*lpoU3%gPVS&cJeT&jH~6lESxlX7Yo0#GP0!M6D}G4u<)la9I)`0g}*KQ z%U+g;EDk6x{{Nv`N|keC*e}{kxABW?)UlN_+10xqoljjGuu);7(nhI`dNvx_YF^0L zsBfd(Mgxhm%b2CiM!K*}*EVEpXyd0+wJ>NbY)x!5wUtk1tJ!_&^KzAqW;U7&Lv^jR z7B*ViXlb&S z9A=}F4L&X%ZmVHSAq*U$ghvP)z3TuTqu3xqVpkhS+c?q2NjAFKIL5|t!gj2!X36fh z8ir)MQLbWgARKR_hcKLAqjxpr z-dpJD^{q451vcH9s#_oG|IZq3kMyJJZdbmJPcFR0$EE4nHU`+Z%Er|;&apAj#^pAK z**Mq6ARB{i46$*Zjq`0>VB;{1O{Og>spF z(4wfTOKo+IlTJpQL9Vbd+{S1dV{DADG1A5;8&^s$Uc9-zr&@cnztoH%M7p&WnX<8h zj}zE;gwlUMxeIZPP^Q?p&gOU5F~P>QLLtLs8xw6zk|;O-Nuiadc0SeSr`Ivl#?3aS z+qmAw3>!DvYL31^_^+y`TJ-v7>h%rv+{cSRw2fCQNStM3w(zjFw+O=8GH~jAsGfGa zjXP)|HvY76r;Rx_mfKiiL$_hrxZB1(HcXC%7MZ|CXv4B$+i+~Swp!8oHfG6|EKBrk zbt*xGO<=Vn8(A9#DKWN@<9HD~Z4pfhZ$ zSZL!u8~4+z+jvYk7ua~f#)Irx*&up|HE&(=u#HD-yirf%gD@rhQBUL7pFYmlJZ|F& z8&49hDB@@u^jHm3xq5%f#?u@u-7;?O7X(Y%HS6M^9L z$!xxoz-se^i$}dSUSTeN@Y%*v;bH2bx2tsyy>#z)tCrcgG^0k!N*k+eY_+k?#%ddD zY;3f#$;Mh6ui02<<88_QI$L4mO~L68skihg{w#42BgE530-Fki4t|EB}p@^_@UQzZGQYy=n!{ zS@j1SKic?(k~7*~N!n-QXL?leKjdK#s%1mBI_X^btBv1;?RT24teOVrYIwcvFB^Z; zp1GcM@Q;muZM1jL!NGnT2W&KU(8NKJgE|gM9n^DB?4ZO!U9KX;L((>=J$^Bj9v(s* z)4o~8L45}e9KN)x*vcG~3sPQR^(I5>M=N>FrjZb9IG62ER}-5$sBqBIK`RH94yqh9 zbI@FPQiojaK&!8%=Xz(<*G4*ZTSzK*u$4>)Z5*_9)Yd(tgj5>uAGUKay1quw(9uDS zgX0_=PdN?_ad4D_t_}`$aF~P64!St#wiy=~UC&^80xF-Y=~;b;u+h>8Kle zbSB)AI@-Z84vv+YbQ2iY*Oa?}*4;rP1JBggxbp1b-~T;$*^ z2mK{=kb|=w3~(^e!MP5qcPWp`aE_!tMw+(T;Qk+tT z80=t}gDV^iac~Li;NUVx*$?;MsNSI>Eq#c)TfsN47%yFR824-hUhZWuFC=dD8=}HcRAr&wj7@0C= zv>iAO5(jy%y8o$h9fUMd2c84JwiMQ$62df=Cn?Uo^h~H*wTw$G$f8V>S3{i z=N!D^V5x)W9lYT16Sa7W##wt@`=X;xo#^&iv6mfiLLow#d`Kbks)OYYRybHD!g*za zN$Keu_a#<3%2R#cr*e&hwGK8o*y!Lj2d_I==iqGzZ%D2;9lS-(jwRf%qFPu(nlurL z;-TR?4%Ul3q(=BI+bdnR$-#Sc3)9NBIJ_)}4;*Yx^&l(E|HeKM@|18(#K9-@Q7)Rh z_|(Bx2fwpW2iqKMcd*C7_YOXDu*1Pu4!&kbIQYWh%~CbecM9Ak@O>$r#07KJ{P-oC z^I1zSjK6X4t%L7`hohbjC!L1Kvv6I-4?_RR!9GELbkvp0y>xLusA-xjsGm8a9sK6t z7h(A59YtrL!U<_Je>(V!j@m_;i@)jo>DyhDxcHaO-@yU8eOEnfa&f{Yr_)>=S9KQi z?km$S>eGO7>bii7QWrdcVDHy+k#Us==3!bJlY4ax7Kv5O|I zstk>Rw@JB`n({X(*D769Nm8}IL&}vX+8D7td3*239FU^^FW z1>u$jcaNF3y+nC^op_ClBV2TLp}9Cj=!d#E%ta@`d0b8&HktNwxQq0M5nWsy>8kr7 zN4p38oLols zb8(j7y*H~iM(?jagmElU0mkk zVi$v53~_M@jYM`o8gegdjk+bpzNUnsu6o$vqavf1yBH?jLA|l3u5iH)<>4CHMz|R1 zViapzuBl<@;z~AuSvl8%oV(LuIM&5D7lsRyI&^WhiyK|soUA0@1TilL!3)8Nz-md2H>m|z#E@rTjwa<5~cKVn$ z)5Xm$Zg+8qi&-@3dBwN5xYfn%T3wBJtK!rRQK+AestmQ zvq)L8<-&GRa52|~SIF#XJ}Hxwv1F?sjpHi+f%5CQ-U6G~dOSt<*L7MFGT|CBIF1~W{xQi!Tyyaq@izi(?MQeBQii@XRJmca;$-B_Svo4-@ z@q&v*E*6UcJjZU@T|v`gV7Uy7&a2|pj&IAAoiMt@#Y-G|8;V#oqwJ2Q^bampyIA95 znMhvYVx^1aF1FSyyZ@HT&JDCxqUzL*Q#te}YlZTfi`O~6rmHddhKo0uMK(z51=W0? zj=q9(_uDSsp_gWoi}fzvb+OsS78e^_Y;>{7#e2l%wm*fW2$%QoyZFGx{zvOu@_)46 z4YUtkeB|O|7oSi$D~jm!(#eatI7#ucAI)i-i|wvDh}_B1;bMn0=L`B+vAWMCBl%f3 z!U=1ucDdNiA=Xrx7PF@UzowsY@tccpTzu=|I~RLg{N!Svi|<|h;NnLSo9eUe&Vwt} zy{?*D&ugH%`)3!w2oLf6HOfkf{LT)dljo-!JpAe6FSgFb0b%=Fy#2p)gGU$t!_n73 z;~J0h`Rvb(MIP#S2fZAh@i{ved*C$*T0T6KdMNWy?xCLWWIWXOls@Sg`3g4w#77D2 z4_drlBAOblIIi;Jq1twNpBCQc{ta@AP=W|IK#tP z9{PLeUaS9Xw2=F?g85=HHIVG`}wDWP$cW_sAiCT`Hu3_T1YQ(>+}80S&d;LcBrX zO&(@=xY5Jv6{;Z&)ZR=FH%lrPtFt&jI;)#bI~!=Xc(_$0+~(m9L2mcJK$*NVNqDEH zzMDbB@L+ma>fu!n7Kt9_d$`YoI&dsyJ%X%EkMc)-Jh9v<`X zxQB;4JS=%1^$xzi%45DqXk!gEdM8fwsb-$=@T7;QXj&ahxC-U;O31)P=|T_BdU(OZ ziypX0TjXIetxja}k1DJxT_VTA^J1mVhEy-{@Dj&}$B+DjXW1P7YMYlY(Wh4&Du*Sn$QXZ>*oi0W4z9xmT!dt2`D4VT(o=alq2mtoN|d!zK^!N-EX9K@hG<-eZ5gUqU(Wry2PsHJ=4M^RFQs^a8`yr&S_*aN@ z$m~aU{d5aOzABU+pu|UAAN75d`QV}mKI-|%_$c+2qvNP~?Cf$Xp_!bXb3B&&XyBuv zk4D142iw%t$;`6$j8(7FH1$#8qn(fTJ}T+VP9mNj~)jfG?o5ww9q=qCFl`8ERAIJK*#K%w{-F+PA zqo0qnd>rqihmT%9diyxR$B8~p@zGOcQkf_DIN4WgHXe>xD=UbcDoLq9QvRRcR-ESJ zbT-OIUms^kDz}1FJsW9MHIXxYH49KVd^~5}`ujNB$N4@k5at0s2KqRcebgdzjt@@g z9Fn~MImpL(zPbp?zzr@2A{Y9&$j8M#2D3z2GfV>vE~9)OqotI~ zeGK<8!pAU)ULkPL-EyIYZ~poi<>N~K;KM#Gjl-WybZUV59OL6EA6NSr>tmc`Y`#Dh znyzE7@iD>2wUT!{3l+8V4ntb2i9YxU!&Xn0wE?9~@o}BtQw2^FI9=fN0&fs_emAuX z&2W>CzkU28#F+wb_A!f^@o|ffTYW6|vBJk~K5qAMzmEkz?(lJ^kJv}f#~dHJ56g$` z!;s3GVyo#_I8q%tK3pGxkI)C*rsu;K&U6vThMZ?-A|F{FNh6I8mYbZv$R}Q}XVgdD z$Gtx0Gp~=iKJNB$kB_@(!?Hm%PkNTBrVrs^C9N?H)XA{(OL#Gc^6%rA8mFAk13n(~ z@r;j!J|2=fJnG{y9}f%u`Rbxa1i7Z7@^L|)68MCVCw;XRqNtbdtfH|!Ep$e^45@t9 z$08pu`dH#)vCyCM@w_1EP893&0+q}!DoEeGBuPtsyz1j+AFoh{@`@a*SF)j!PIy_Z zov=A9Vx^B&K6d)p8><7XAAJ1iV=v1RIu9U- zQ2x(!{vbk+4g^Z>}Smb{2AbY zkD>qz13Vj`PJrS7R|fcBfRX@p1DqV-lmG}&8bAwhNPv0)G67lyXc?e>fU*Eh0yGU! z9-sj;@`iJu-bZK{C_St9!5=RFqp{Xll9<}LiB=KtVn3<_G!q^Y8L9&HtnuK-YUSBH zQ0ovjf$Pj;TUWLU&^kbe038Fg3D7n`dy&RBT(}L@F2LYx1-%?OSs%g^gmO}#zAbQKpl(|+Bek)*iN+nFo&ov?I6J_p z0eS`K9pJP8X9Va&QBw2MMLy+lO!WfO7&| zOg#h`C`F$i;DP|>1{lPKZzwuXGN$V#Hj23}3~-SU(`u8#aWo{rB>^rEFf71ONxf7c ztHI^LWo(YE9x&T&sJS8lx9LU%7#U!=@Q_~GR1Fp$F^me-nFw*MsWv*mm;iGF+!bJK zfN=qC4RBk4s{&jdV0wV-16&hee1ORTriiEs0VWD^t-v!x>?COyUpAyzhU)@M4KPg@ z_}o3bsm6w+v)By*W(2r7z${6z^R_FiW(&^c;w{pg!X#B^^4uQa z4oOM^+!(NAK<S)(_$taDkJU^Pg!q3+L|zZ@Mu4{iyc6Kf0B;3YCv23% zrjdc7{*%V&`T*}rS!77d+7#fu03QbUD8T!Yv{@v4Ab2Wdizq7P|5)gh`KchE)Fy2W zuubaEQqr&^z~=#e3a~H07Xfw#*dtkX1=t$(J63i_Fd; zx`gN&ssj#k9vR}O5OIm}lRZT(bP-2~=oYFcBTh`mNcMhzsKb%tLL48Wmn8KFaYBfz zwzoPp#EBtJ3UNw^o*_9)wsEAzSrAa9=B*Y~lE(>wF2w~FD5SP~CshnXUt_U$a#E4q? z|HwO6n)X#1NB0j1Dm-#5EzthZrka#!*GJc~gGY=jssaK5CUl2`7a7W8J|T zrsYl!F(t&b5Yr{^bs?q-lGZ=vVaDr2+z?`h)cHT*luw44A#M&4g~*1O6=HS>J%kbB z7E#D;A#N9ex7OC}ju3Z-Jm65OV@QRtxU@twgcZVXv$AEW+6O@px@}Q{q!0o~9YcI5EaEAr?|;5oSermaZej z<`7##EDrHph&3VBvRi}d=Q+k#luqoD*|fC$g%B@>SQ3Kx!lmVx9hG@0#LFRGVbL7U zAy$T16@vfeToz)5j3eU9g+k_UhN$_DKS1ZZjSQ>9gFi5OjSZnib;+4q)qbDPW%we*_aS}=u`|TOpSAod z#MdFlttj0UVt0ry1)o}{=+h;|8}6(Ah8`)zcOkBSRjqpq;%#~@XuC%!Bz}2VvDUHd z#}Ge-*cb9I#+khWU%R>TXDY2(=9dt^a%jw`dh6N-SM09;8#BszdU8(YciPoC>i0l@ zhWLwhuF(DtQ73}`a25CQ{-OU5vGwKp`=u8SgeZ#eQH8d7Ze`C(jW_p-Ba}p_8vzj- zL}(bHG(x=yWf96FWFpj$Ft$=7LdeQ95J@S-NuN`xHHy$ULX${&W=0uOPSPtQR7L0$ zp>Krh2+blK6`^Z{<`G&%&>|cXp=E?t5o#oR>j?8Jwf2HjNSg?4BeaY70l=yYzNuj# zv4f;`6u3;v`uCEuqRz#KM(W47-&Sge3vyV5PJ+BwsgZs}gw7GVL|F1q6~mDcuTvH? z5GOo3LbnKKMCu=Q$3!?b!U+*hjL<#8aS@J>&?8c}oA?)%x}{|g#bvKfuG;%k#nbnw z*`Z05c2a~>BlL=Ja)eVN^pv_CQFTxcWccv1hP@*Yo*v;eLCzgj%_sw-EjE^NdOb5j zKNhsOd~C#@o1=e(Dmyw#gbC8dDFUx$ zwIfUt+R11cSLwU!UqxVq!~weAi{$Y^aw_T0*#?EV@9w9 zi6ht%9MNPD!KF=BYy5A!7om5x7LQey?^82dN>+QB&1IEg#JdydI<`6+sn7K+dRf_R zPDCXF^8#7KPbU}6jc`|ld92U!(tBzD5$@)Y;nyLgxJ^eDGcfyo5wZgsEQoMFJMNgu zZe5G7{J^Ys4_7DZSb;W?qqGwaSZ)ut17lL+anxx9HH!i&*Ck4+*e8?UH7(5Q08 zZJAdhydL3=2umZp8ev(4XclF9XUtG01!dfcxv#K=_7@bh9 z5xy3IfkX;ldr$FI7goQ?;U8fgZRx`5^%35U@OFfEB$_f1?w?(@A;KoIRcjkL%-57Y zSgjGhgR=L?47ItsIl`6*zeo6k1CVYo!j}=giturSPa-s3SFyNr@uzhDwEQP3XU!M>hC6!uNC?5x$A= z!mgTc1%4-x(LI82b;?QPN0IppD>gl|H^NU5_OTzEX+KBm&Hc&Ev@v&SXb6g#9A3D2oHc`xc*YKutglJy%!Z znVJulm6EeKtN2R<))feWOPXn!EarY%(J+ffS!Ln%1(pdc7uX<+4a-Y^TVC2YizY&8 zp2bJaw5D192B@+siwcR7QYpxq$raUEj2~5xU!iFx{3q_Kc=?u0i!54Z(JG4-i)se* z2DRK6Z<|HCEKbhilq}k3(IJcDvg#1OV-_`89F|3=EP8HGBa1=H;t&x?{LrlWL@JTP zvsfKgADu;y-;0mPqH`8qsFne0!}*m)Wk+Ullw_$lxvXmz>xWktHP=pPuCZ?2vN$G- zW3y;GxSlnvXm_r-I~_=K)u+cx9axPXS)3sFiM5oIvKZ36WPJCMo>`pA?r6caO?9s< zdS@{xi}SKLEsN8$7?8!4Rhi9GGiPMcCyTyW@Y!e2&iZH4L5-|t=$}QuEG}PGdX_*^ zh!dWj#Uihm#B+o`P~f=&$6P_=R1N#Z_5coyAjGJe|cg?Ds5YW^r>C6DT2zDOp^XMX!~m z;UAe(uFOo#ViI}wR!q*~rJluizput@ub=Br&0<;>(?x#ZW%QLre@)F?FVP#am?6lG zS==ND`<=TY+%YCHD~s7#WV48~xFw6~>WrR+K_zE#8~uM4cSx3ALzO+;nT3CJ9iG_E z$zmTrL;F+>UpD85rp+vZEW#|TEbJ_tEJ$SVvTz0GikeYha9&U$e)wSJt{EcQ=MFXP z=CVk#;7h@eWs%RKz}kLUwSa?5DsXoe_hi9eYu%N_JlbRnZ9ofUY4>I^pY;^{KHB^_ z0AJ5_msRr>U z1(|V0^)u|;EI!ZTi!7d{fo1XK;_^*dEaohEOXlS)UdiIQES}He1u2^US6w2=i*yTp zs=jKW)oZD}Boyv+EzRQ9EZ)fC%`BE>u{?`a9D^L!S#UkfMy;fItSBW;$mQ{xEY@c6 zS{AQo!6?J7CB+C{A6@og79VHviQpdztnZaER4pj}4{pn1dlsK%(faA)PJd+>nlC73 z-W|fv=*}#5W$}F$KV-3+{;H+MjfiilLs7_A0>2jcjX+lQhgZ~5+IRE`Eww!~_?8-f z7(MWu2Bi;`|Cq&ITFBMaKT$1}nF(VQzK=a6d5`(3nBli9Uy(-J80}*Gk;R``G>*|E z#$W6pD^oWHV*JfsFslEducK?C<_A{KYN^$Ul}kL31z!v)68zMORmHJ-O`~)B$`VRj zU3&QAHG8I1bKWeCQ7=X&#@)ZFeUp-RNwVLV!lp4Q zVziFYCPrn9mLsbfn#ZV$!H2$Tfz1StTwg>AQ(KTtD3shP#+jZnm3Cgy(94Rp3@sr; z`xqT!XfY0n(J@9%44$l=@of40mfDQv6_0nxY;36=8sji&*D*0V#p)k$N5(iR#^J1F z|KcNJ+&Zg%=NMgLY`Cj>tzR_gm14q*Ep_*_)VfN>qooe?rQIZYNGt7FLAu8{F2?bK z_lS}2S-k0v`m1MDopxhY?|GS%Vw@cF$0&F21T^op@8#_|}wW1JRa z1Zx%Jbe0mUwe-*!ePZ;DF*wGM7#Ch&m*LD9{bHOIqrVh4Fvi*J(;G4j14zHTh{!pT zL}X-Ad~S?EG0ux|J|)Dsh<&uEn1QJmNXGevYDO=XEJUbSQZA9`s7|VLdkkpD$}n6i zwYn_E<$??oIBQb%6)}bjP98=_#kewt9mAoJ7^A7-Lb(-VOpLKHrn7^lDQV+kTpMFz zjH_Z?E!nS$F`-t@ctOJXH4JI#lVVH};^bPMpB7eK7h|eKrwL>(63Kskj2mLih;bvk zHO6hUhZytu@^6e;R7ERoW~>fVcpNZ0#w|i&DyJvD8b&(d?J@3%F(-x|W5Hv^ya;z^ ztd0+uL}jJjTxp>pvIc`4~^ccrwOQF`kaGD8^#$|FBce zE${wb)xsFxw$g5^sf-ttKP!1lT5FkMY9w}StsVbktMUu$y%6K27%#^l{-VGoG-h!H zpMPGnVSVYiLgg!xcPZ(uwO6SMJ#*98hAU#Mq+g=WOB<|;u{y@*F}{egCdS$r+hcqd z@V=INX z)`*irgkgVcZQ9jE^oo1}IvKE_^}bc`Q_jg%i_q-^`xYeM`j#xH{WTFWzXWpTP7UnDE2KlO6gWJG5rU9DQjk$Oqr?kv9&lEmYiI4 zRSs9@a7_;5bC{6BbvaDUfouC~1y0Igq98{MFMj33;>kHo$$>~3C7hPS^c-#w9_C7u zu9qnB8MSnB&dlNF99-&CDljXDTWEMW%;xOeMti-DcGQqE-az0M>uovQP9D*fo`XR< zOls~FIEVH;Mn!3OCN*EBW=SgtTbTRJM8kWF9l?KSqxm@mIXpxo$sx=k%HggY=H-yh zAE6{o|NdLIXsqA#~F`HG(BRtaAIX{aXBAOpQ5U#WS-99nH+Ym zF0J2I+-44ob9gPm>j|FA;rSd+PjE(p7jk%!gE~P~f+ab;#F3K2Cpo;#&dOnZ4)5l0 zd|QpbM_ii2t2r#oVL9dG@H)F-M|Jx*%U96q=y_&kR&f;Pur`O)68-ASG7|s8iBREh zjZyOATK$*ol_S$`4ZDRId$hDJvt|{fdlaSnh$g8dx;x!*p$P2InagI%m+DarWxFrIqAFl45Sbz{3wTgn@e^)R8IJ54qI91^_fh9Z8>bGYs%rb96rlo zM-JcT@Iwxt=kP@iU*+&Moxs}Coiw(!rC;W-D~H{JZ|5uFYfJ0As>0F*#VZ#Sf0M&^ zl*W(L2_!OpdgV(CiubVjua;8Ck3!#@!%y^7MMY#_*q6i4Is76?B&Kx2ZktPf&*6_8 ziW1aG@TX+?Cx?G?_)7%-Em;;Gk)e_r&m?B-E!j^KIJ;kQp9Fmq+>+qd1ZO7b zm*BbtQxlw(pnrmk6AVspc7nINWEjpBWI%#*YAFK+>AtRLP=fOWKR>~Rf?QC`bL_ez z=DjEZ*@zEGa0%;{V040^2`&}3;R!AiWLRyk%M+v-nfD68nSBIxB@CkkURletcyBAR zjY%*z!Ngh#;}Tq*;F<(i)iRT3d~NErf=o!jyvI>)u)&wW*T@nUY|G-;hbuYUwu# zGMy@wqHjnrBf*UcSQBO^Cqr79nZkK{Y>3(n@SAhO+-@E6Q*q=U$RewU1z>?C?; z!sqU?ISKRxMgo)Fy{Te{cttCL&0hPih6iw0+??4szuHaUCGZmj2^O&-3Bm+Xf(H^j zm>`=VPWTEK<|W7_Xw*)-shw6xkR-?_czRw<`*vFYcFNz*Wv-}*m(X5pr`?_49@;ZU zkW+MTg82#VlZt)OPHWI!>(O2t*cZQ4P5iWQ*o)4Don54%OrBw*1@qBHE&L3>tmEnHOo0qxBR+UF}9?kM- zUMoLsENf0At#GS6TIX?i9!KQSCXcpx)a0S%(Jqhnd34C5qvTDSMzPG8_80L(@;Ee) z!}91PJfyG=OeI2?b}0Ef=W$dXUGwOY$B}tu7-V2b8*+3W-SRj_>YoZvAsM>oaaiVKnNzCJnJo@Cpq~3X) zmdELWr_AI@vk>W<$C-Kb6FE#Jg^+=w`re%BpU2sG5MdY~$XTn3&dp;`9z*iDB(Jvn zxaoafUS0n?KaUIY>UDtgmd6#$Sfll8RK_paj>uzV9;5QOGOw0lbP^fH ziXMoh^lS1MpGS6b*-wjV=7rT0@|eob3ahWpV`3f)o+zG_$CNy-%VV+_lIrNNntjI= z9U-IB@|d1i)=o3KK93vn_(mKc^OEzXJZ7@_dAyXz&3VkqBl^7lv(!T#x8&jH5#(`e z9=FjHt24v;XKv5q4%&mJIeFZf$5SoJ#oja$>Vhz zc^=DzXO+O^0?E80kClR_5>^YoM&Me3uL(S@O9L{$DL9dhoCWe&NB=LBcWdeIa2BY= zS(y#BIEkACe^221we$}J!CO@y=J8P;yYu)mkB@6pKV$O+|1^)Sd2ADWdu?i35UahT zmhw3bHIJP%525Um%6#83!wP>Tlppf=F^{ilsCj%Vls&b1zY`>t`F*W~y+Zu8mggs$ zTpmBOCS5AiB7VuE?2G1<|C{jqF7S_9{>ZETJCA?z`0ifpxflQDv7ZBK9;VL20sj2G zfL?RadoJn}P+Y*S0(KWrQb64TrW9~p0VtrffYS@y&_lffG6ft`z@Y`yFQBY|wgt2+ zpuC`*Tgw7?eA%FYh6OY#pm70J1#ItD)ue!?f>adXJyM=h2pKAcKH-PT>H?Y-(7b>a z1?)Y$m`S;fWu#LqVZ)|ntthr>S?dDY2tvG@+<(~dW5tZyGVKfKP(Vki#+tF1`+H?g zfnQ@(#oaWda`lm!!wTqBz)=NsEpT5Ni~gt>*sAQv0*)xC5Ak&_sBJ@*)un**yc!;? zm)6fzR%UqGLgLW{bSvPP0*<9}=C$ZqK=%TUE8xTePAcGdA)X+xhd^!;l8rlrgeMDy z$SDOd^`)sLDbK03^j-z@F5onYaxjvU`-*)E=v%;L1zcXhnFaJK;M@X6cgVCort+); z=G>ksugdT=q<;Zt7chX`Vb(jRfPn=(GN6QbJh+$$!yq=Nfb$EuprAg;(A3N<)wBx> z7+k=R0xl|m(TfHC^kO;jO9US(u>Spua;f0&-KFqh1$^^b1;c33^A!aQFJOe=BMZ1v zkWm8vd;9Nywb3yJj4h}Qy|Pv1@2ssE$By1udQ|~e7jO;hCedpJP7pYEeGwTLCKfPB zD3b-AbVoIbQwx|@z`_EaEns>9*B6j4pisaK1nYFSpfHSU0M-!UVtv541rbwrXVzr zS9%oN1vmxlzd&slbN7|VR!#E@hziIS5D4d>VMSpr64&OaDMr-fV&EK ztboT0m{-8v1w2qt4Z(_-bN99!KC9sPAP0}PB<|0_cF9um zp^zPdJ9F@nkX`Z8-8tAJe6QfXxcp-w96(-0Kahii(t1up>LG@s@(M579L>S899(8m zd<{oZvEX+xK}-=GgZ#PUqkZtK3dGm4iHA=cVM69GuO;1;!;&IG2M@g|O(n5Guzs zDY=+~OSWSq#)^ncpXcC<9DJFBucR~Aa_oD=R~WT~kasMvd@Y=W*}ltM*SRjrD>riR z4L!5G@^*RqnBis)zR$t$Ie5tMwbXGd2OIY#{mKQEgWGh)OvjHoxRb+IP#rht;U|&I zK9|7k&pG%-Ed)rIc1tMnzE-#Z)wyjp8aMj&hY$Q9?R!S+{4r zlyJ)TcS`KEI<>5daw^UjO(l=s&Bzw62zLECFB3hMyNQZYYwd}QN-BtzRa8+?m5m-v z>QFbanu_Y&(hBxZPbyZh-?LkJB%_v!+T7S}&ZjFV?0Fp(byd_;QC|grN7aNq6r1c) zV-*dBH;PN9Rj{X?*`_L*sc0_pMH{kPaFfT|gBiotD%z+R=EiV0+Nx-$;zt!fsc5gF zgNo%UR;cKxqLYfLDqd32Sw$BW{Z#ZnawiSR@Lu(%8K@auU{BqT($neUn{1 zn!x8VD2$aZQ&A{Sk^2=C;z|{(R9xmn?8#WIVvUNeDz>S3Tg5w^pfZjq{ZPd^6^4p{ zNODwYDm=nf6>cHaEYsWNRiUf!$0a^`)X)SLCHHX>nVL#AC<s4%4@t&w{P_a?PCefjtcmGqjc5heA{uU9wA8(gJTK+)Ab`{4|99Qw7iXAHU zsrXpMP6iVdd!)*)xV7E!y0Na(!d@w&o&72fs5mUygMx?RMX}anRgQ2q4NW+zLaC@w zenQ1b6`!iOAj+pyoKf+K@Y7tI^Xx%pIxCWM|1o%8#R#$RnFy(KQ3Z#T@#kVTHQ*lMLkD9ItUKM2aYaxSja9zj^!EfTF*MrU;JGxWJp+>KvU+*RRpgU=!^J6_}-?-hx*H8DDf!*V zbR$c60XGT?p}deA8NvruQkdmSwJtY~jdk(4GV;Q16mi?Jv8Wpr7NPXWEPhI~gc~K@ zXz4~PH%hsYZ*w+NZ8u80QAV<5-KZ+0oEzCf6jpbmqVV!=K7s6Dl}c_@7D*LBb(Jk# zemSG>HYZ6nH>!)ghF~qhnt~fEDL1#qb2hGTX?F`oeE@cQtUMVVtw5u^UY! z+tiKbas6g)I8EoJfNiRU8w>o-n!2;K8*SX^=SF|V|F~vPH`=**c!LgZbabPe$U6yk z5$qh-e7(1;s~b1&W?j)-G}~R|Jp{dzQYq;b*X%8%k6>RxcHk)?g9WKPK*&JBrv(QI zE?8t6AL7O{l6_W?lA%J*^>U4H<2g63vnQNBH%7X#*^T$y80E%jHx{|E*o_z57~{sP zZp?RMtQ+IpSh~qM>{iBjHzv68k{i?9c+riCZcK687sr?;37O2=IYEl`bEBW2GzYw~TUI5&~{moS@l`^Y3H_-MrVC9daY=Mnrg2&=h=kp^K&T zYW|8Y*NydVY;a>ESMh_4F_o1~oXRXmx5~=9Zv6a9%EHPDk#oJpjU8_6lo@|taH|{J zgnS^lU67g|3aJ`$e&oh3u0BqO+kV(!x8Qy^_6VV5uaJF24mf|76to{mI1n#ADCCeE zhlMmPmeZ<2ENnPO*O!iEDqt9ge*4Uj*;Fao3G|!hdz+HzBmZ zJr1!y&#dE;--SFBq|Hs0l}B!*Xh_xY*p0v3pyY4Hc@2r0&7X+mA2$*tyM1X<3Yqe1 zNYaoj!h9MiM_hq~S%=2&DB2c?P7P@qDr%^tAzed$4J9;`)KEY}K@Bbqg*6n?kf9+{ zL)L#PvM$?Yijg83ifSmPp?F;9e??S?rBWJ7Ybd87TSFNQW&dL#)=5?&Q8bj-P$6!a zl9(wPsjQ)jhWgU^sv4?ksHLH{hUyw>hOXsMxKKW=rf#?4n_J#6`j?vCklM7o8p&dJ3U_FCmXAD}6Qe z)9|#0K^g`h$>`5buA+>nqCBNxfQFIbY}Z%}lp+!;4AwA2!%*qlGa^4xMaffDQL8A= zY9Lalc~ylKf9vTQp<#mPJf~qyfz;<|P{Sw|jfS^1yrY3;*J;SnuvXMYR9-=W_liVj*K79v;yn#p zG;GkYk&A*0Ce0DoBTC^FVws{)por1HEh-FH&gid+&0brEZ&D2c4+v3{gG@8 zxohJYH=q39so^6HyXc}C_G$Q7!<}l%9u0dLG3qDgudaOloBfrQs@0Ve%`^9FIKc7e z*XFA${2loV)s+?1mBSj2Xjs`W?+pz{H5}9MxrQ$^9M^DyD?-Dk8cxbcp4Mv;0@ve+#EYWynFv`L)48PKvPfuzk}v548m?;iI&S<5 zonH)6VPG@cW3Nfkb-|b&3cu0tEq4JLZff{m!vhU}Pj=j*j)tE#{G#EuhHvg<{UrFK z;DwA-*F?u1;Roiqeq5bRg}WMl({NwIJq^EdJgeJ&LOHSBL;Lz6Yu%`>{4Vw%3N9I( zz_u2CoHTB!;}L_uhQBCh1oNQ22TyqMpP|o#>K^;C%mfeML6Qe~Buh!62YH3(i%Zs5 zOH1~^;Xw(J@Z%3DLNYu^^}s1SO^{Fbu{7O-{E{u;LBY7ZkjH*FF!teyOcAoJEDv15 z3&$lzJSZx>m|$_i*D9n_xuoz?f~7qu<3U*u%1O4e2iYFmctt_Q12)GhT z=t2K!cH%pLtTn`A-!>iZ!2}PU@!(kxhI%l}gXg$W9t`Ic9Cg-B&ssgC6ytl&~gajf%T zC5I?US?$3Z4_3uTfRYC_l(#*2CobWg>$M&XSe5#G|IF-1g>yVmJ#b5@#{(}t(1X%7 zl^Qjb0e3U>crBj?PuEl?)KuPiWM7{*JP2?GJyML6TZCmtMQ>#I_a%NCtr06A>?_DN2b2d6!FucmUWrtM%$GVF6M-p4uX!8s4k zd+@0Te~olq@!0>Syx_q_4=#D|nPjI`PNeWMU0Qwy@df+lLF{iAcWWwNdhitkT`h(0 z+*PQhWR}ZpUo!Qo$9|USYY(n*n%;D96%fDi;9EviFOt0Yj%)Bp#zT+&?DS0!zW3NS z(QYwNc87=UY!3nrGOWF zqt@5Mnd!By74)Kz7a3lhe&pb7SxOH4ke%g)%ZtKZ6!GFjW+q=y8eQw($na5<{Kdph zalsOTe5IO}c_*=y7rA#*-m9gQ_1aH3SMKgSQ_KEfW;rjiMMAE4Q9jQ39kxndRQ94N z|J|}Xsfrf|UUSs)qP7=Ry`Y_HUR3vjud6(+rPPoPvxhZ>@I}-*UhsAaC5^qP>qR{; z>U-@sdK!As$jgs_**xb?7LkdPMICL7u~%0 zz>Do(boZi%7rGZdFM4{>%Zu?|Ob~;;y%@-C&yo1=wGZn0deP5|{$4yK3In|MTk3Ux z&N^3H;ZN$H)K;GMVi0GluWPUu&r!#VAznP=Mdz=IKkLOX_F4E)K|Xpnf@bw>H6fF~ zq9|QQsawb1E+Rkz3cFGtpniWfZL68b#y%dn(oEM*Aip=WhtHK#VbN) zc`@6IIl`$h*NdHXlo4)c^_8wVZYL$LO3{2THj9PVy;$hQ8ZX}FJbJO%i)CIc7o9ig z25~!V?oBV=^4hOblC$noDY{ulq0JRutdi_XQJ{o6)Lb2Jh1qw!P`z-A+FCEx#VzLu zDO*?3q%LcD;m=yz7O*xh_>Y;6>1jkj$wi81^C}Br0eMemFK? zi3|2oYpxgTz1ZNjAH`>OBUkP*TYlk+eN?%b>q7Lmda=c8-!yz*vb-(mc-z+B^pTUd zVz+tm%~OTz)m3=&@k6fS`9)87v4ex`#o1KHM^a^%7ko#U_W^g)4!bQaveErs>=XWR zT=Hz6!Uq_Lyf`G1<8k?6AxFG8>cz2m+Pyi8Mp%V-k}I7a%eg+6aE`IUi!;J`=kyaU z?G=u*g1o`{sgO%vTo!Uc@G~zi3gO*V-c+U9=U#l_weK0RE^U4(rC*7p>jnGf?AKmg z<3iTaO2>6CZZH_?D68WeFTSP2d+{5C+xyP%y!hUWTVCAc3Jp8^)wP$#4-BEpQ|}7i z_TopH75=l}9YH>$LY-fPlROxYdvRWHg8eCy`(8Zq;;|PGxWwKn{kz~p!5W*h|M22Z z;Vj~Xh`+q}n}J&Aiz;~H#Xk%ngEAdD5_IIzk)+!pI#EXvk1L<>ygHaDq=W=g#B8z% z3rx*RP75hI`2J(6jt^@lI(58US7G?ducLsDqB@G{D5#^5j!Yd{x*e!9^#A*&7GGU) ziLfw@>;HcBi#mKEg^7gUye+PygpQKB{S9qOSf!MX(o!p?6MJ{2oNfu(Du9!Ad&*XqrI%Dv~9ss^jhY>D44lQd75|xTve6o{n0=nXN6Pj{fh{7dLre zyeFx?js`j!>h_CEO$13A32Cg`?<+Ai)zM5O&2_X8LLt?d_;ylj9c^^Hp<@YK*U?VL z(>ey}XwOa7(N{-59UUcg($QJBucNN1tEkUscG1yIM|T}fMi%KRcv%@Dm-9Fs<8?f%W2lZ{I)>}`zOM3ujuASZ(=kfNXmO9{b&M2Z z{W4bgnLx)jMd0EFy$*R=kugY|+YMIHW zPl@^dNSPx=^K=}kr_ALI`Z>sUdbujcURSjpCP?iQiySgqqm zJ!QqUly`K@8I`q${w59mBmG>fW6iGYbu_ikS-!r)H}2h>(E7?3^IcuDlUx3psc|Ce z+grrsWpnivU58JHpIfaXpd&~Nt5TV+)^;$F{Qb3!5gkz-+qpb-m^v&S?@POUN-bB% z1|1u9tdC3h>gy&Q@9KC@#}*x%$?Mzix;EtFe@h&!LWS5{u_RmRQ93@L^Qeg()kNYe zH!_L5^0Pz7ULE^bJx}INjwF{hN0LFZzOsiay}e`PtM)_n&IU@^2Fk~D^@_ zv0ujl$(HgYP{k9U%M*R5HPcS7FSn1+iA>B=A3htC1d|0vo-C2- zgVTphpS^SE#lSQl3iwdahjgF)p&Lr_`|OK^VEEmhhpZ4PKZ`_SHp4nF%+ z8@+t!$SvC9?B+vvA3FKa*@rGZbd_Q3eD!#w-3B1&9Uku zW7Su%pCBiiEj}gf4iFqD_%ywugu)^!4EAA&56}4Utj|6q;67-$4?~4BJIwd*+t7TB zb_D0BrsFvl`7qMQ18-NEp7uisFI>xf!DnCDe%pt4d>G@ySRcmuFy4omKD_M11RwY( zrk7-sU-V%jeL(EVw}0!w0ty8aHQY0zbRNc{|`;$!-?p#PQ^Ai}3daxB9S6 z$bw@DIimle4?7rS{7CiN6TQ=iAAI(4)JHz-@?p0RdwlrJhl?`)dpXGTNqV3UAN#Q1 zhXXzw@!_Zs2U*L9!=g5SPe!>)iN+#3kuV*jV|RCUZm48Vbqw5+%}2pciYA@mybq^* zIPJq3k(~3{UswCYhqIC;XQEn6@~H?f2*wn6gn7w_8#2q6efXTjhcA7&;=@%RemWfQ#G##${U+sbeMGlf|u z%G>(U&W}NU4ECeFA07PY>qkF7I{MMckM4f-@T0RIUHs_kM>oIy!gcJD-T&UFj$OX% z=|?X=di&AG|L+IGX`e;0cdldD-)~;(j zhWRmEEDwzfDIdXA&&`k53Qn;HifxgwlxAP>V~ih@4kXR=W2_(Jgin(Z!ywmqKPLF` zq8}6enC!*5$u5ruuPWf7VNW{Mu0A1?1^sYGPvM3|3FH z4_#gs$t!|vk;h~N))Libz3O`6v z`K$NUnX9>o{P6kV_v39p-tmL)1Zh+dq6)4P%n__M$3X@6ePN6?RuNW%ZojKuZl?{?C%=?BpgWOEz**yzVTKR#xPIyd>T*^l>xzsqjdRVZZI z;>QPmY!~_aT)9Fh-^LN>X@4{1!?@%lKX%0VP9Zz^I*A{<{n#Vfz46j<4M~ z`*DCPn(O^N`@nm~co*MyJLrd|B^>hOiO+RdM)-)}3q>7c8Y#!c2cBP%z*kg$quSS5_hvdC`0+a%bkuLB)Qs1At&-(??IIkZ^-XU@)$@okk>#y11Sbl4ZyJPStkpUBnjcoWk*~RyV2}4 z@V4A>PWz8Mzkvb` zq?jP12Q^CwU;d`eOB*O-pt50qz>rx+&awu|8ORn%1wj@m2Fi1D8Y|>w8!Ht>-l?%t z$-vVhtRj-C2C50EZlG$>%$f#j7-tp^Jg82I?88Z=ivJh6Y+0 zXl13d@f#>#TSFM=oTc7o0Uv@VG-3>lz;~K`XJ(I z8R%)C7d1b0_BPO0NFPB;_@YO@IHx~6Y^)40Fv!4Q1LOk*pXN9y3bR8b`>bKF1!kX# z6K01>5y^1F{;cTZqs|dDD+)YW=ARcv85nIK$AD_!1p{L^?;j`8$={sk7;9hxH_*U1 z1LF<*3hl+xseE~aua-njFk8CYw8?>EghFvq}~oKpjH8T<__Ht>dlR}IWJ@S1_w4U}%8EHJ3~Vv*zVUx&l&l`J^8uah zNaFVY6vZ0a$*D20-@pL_yA13$u-CvoX>N~HiCLgB)5ju-amq;!iowIut3!h9ZLH{+ zf#U|w8aQX*gcO|?JSoV!r{dPmh~yK&*cP$$yn&0-jZf*Zam~;Ee;qdTxq&Yz48Re< zmj=FKd^T{$z!d{m4csvBjr5Razcz49s$Y*=V=I(@Yv4Nrw+#Fsa!PI*_+Dyp%ws3) zx1}QWe~fn^wv9g<_{G2j1HUu=8@OlSS4N@#=+GK1+>f_N&WaBW{9)iPMqmSf$~HbS z@HpNgTcJ+O{u43vPrP+nV`)MFc>=bdBnE7+$SX*aF8~Nnic5IqBqe~<07?f?CIDvu zX#r#ekQqRF!1jj%0Tc`%f53Ja8jN8fG5)_kWCh>~pjZIKrApxdiUd$pnxGD=5ZO9O zi2zClP)e%Dti_DPO3MaNE`TZlR27Bn04fAfF#sii@?!0OeTb1t0aT8+5^JJb0M!Gi zMWOVhMgTSc)ALv>bwpA(fO?|CZp7-cw7yuQe>MuBaR9vo=o3Jb0GbBSJ%AnoFmN>s zpmhLk0`|R<<^i-2(o&F;Rzg}gRoVv7E?|G9p^IR9!A^o51Um}yAg8mC*ryx13h(wG z3A;zLJp&ki*x4&!pLUIq2-7!!eiR1mdr$oXcq)KrIQ|lI1_aP~O={*!*FetZcIVRp z3<_Xy0AHNQ9ulyx9WgGEGw~wNt&82z=m1^_z-X%Qt74xvRrs;iaRH1E;F}P>4Pin6FLD!tcr}QL z0Za;DZvguO_)+vHvlWg~051jL4nPZFS^$4FRpzov0Ck%w(*u|hz{~(%mh5c7R|IDX zvj0?@^B>8p0nF!ot#rH-z=8l?3t(vg%K~^kfZO-7-Uwhx01E?HB-xe2?Mu6hxn2BV z*S#!e-wfa_$^K7H;qm}h1h6`QHBz)vaFrnI#;U*lpIR{q`>8TpEXm0LP6-|Ob`VMsm4c`cM0vrAQp%!Z z%@n3si&vW|mE-aO>s-}>s2;??Af67QMi4cFXd6VkAZi6sJBS9?5}O54Cy2U1+!|E4 zQ4sZ5dM&X*5MK@|%oSQci08MYyfD@lHWW^I;~<&@(Ue2lTw$VwNaf~1v|JrSyq!^`fB(U3WP92XSYw^Qj=n7q54c4-g482LxP_AO?Npr10Ii zq{kXtXG;(t1hGAc_k-9fMO{xNY!lLQr>*~C5IeXDYZA$4ZnTl9q97AofajUl2?uKC~?y2;yK6hegh8-Mk5h;vCY%5y|p-xnn^b7k)zUBt1b|jNzFe zJ_+LO7Ru*AoDJe!5Etpmyg?vHav_LMg}*-3KCof>EC?=Pl1p)&%M3DG>{8kxeig(O z2B;8W^9uY>p_h(Ck47R2=+ZU*r^UFA%|%ze%qL3neW-$)4hHi++J>fhp9)iQ&( zg7|@}EQp`!inQ56`H|CfCV@+mv-wjH^dBlS`%4gagSa2W1F>+At}f))xGy~vgR$)I zToJ=u4`no1mz)FmD2T^FB!}P#;jbY6W^51H!TCwtLV{%fVGKEJx1L9`iGs6sIw{E~ z9D>Xy38~i7_TH2b3WiW9gwzn6A*6+n9zp?8$S*iv)P@Mo)Dp^E&zliKW(bAj*0O}S zq#_MY$!qtahzMKfvw86lN`&kc-7$ocA(RTCUI_I=C>=r>k=F{LYzXB-s2oC-5VAw4 zo9iqeLIoj;AgfmtQc0>XOP#uY``Dvu2-QSbBZTVl(iKOOt{$}GLrsy)Y-z{0+VRpl zLh6Pvb*YQ;1|c*QN$U_Ah0r*JmXd7}LemhMhtNW@%|eJB^RNmJd;Z7S!&ahD`K*0( z)Fyg^<|I*;$aJONc-GO>`Vh>K;Om5Y~l|6GG1rdWA48 zgy|vlra}ngLKu2DiN~3JLwG8L0U`90ai*j{b$HS8K+?bvo(^Gn2qQxL54&Sf2+xSl zV98Q4gpxZ&srf9eg)mG?SBd8=lUaUFBvg1Igy-XYWC)|;e6$dH(HJ3P1-T1mmGL|U z2;oK9Y7WIqAxsQml4K`yw1rFwq4wDXZY&i@h)fO7CCmt6W(Y5b@Ja}3OM8d=+FDod z8Ln9&%no5m2ycdPprtY=gjYkDFMMtY^Q3jk**epLkiFkr9Kt($oUaMKF1Rp+MM5a2 z!j+cF8zKDJ(q5!*g|IXPlGVh+Nz26GiV&6yVLzk8Tm`=^wvsF5+hVIkNJ7muA-qkS zT$o3b){1;^E4v$2TPbP?ZuT&QgCS@ketsMqL)avn?`02#=ppz*@C)YwwkgC2At2;M zZ&ombPzYfT;5=6(gs2emmOGqGBuiTVW^onMAVGHuG!YrCQrNh-)ES58;N$`wX#n9Q?@ncOl#i;ny&J3*-9` zZiTQajMZWMK${`-4WnNeKZfuV<5(Ew!uG)4;nEHxZx}y^@Jk4HL%0`0f)xGAAqwG% zG;u$K2lPYX16wP|P6roeV+lUbDh* zg;6++B2ue_V9_v&3!$}QLMli9B_$64rth7v~OFq&|{4=0rmqgEKT z!>ABO#W0Sock)QPQW%xP;I{;;gi$q&YGKSBlJHk+rFs}O!XV+8)Ql5msX$4cFzSZw z1OA3#)DuYq$+D=vWMgVnU}_{q^s(gF6N6(@b9 zi==g2(nbi)whN=Z@D5?HtuA7-qqNm2jLt$j@3SuvxUMDg(4|`#-NU@)WcRkWROuAuzi5^981G^DvSYP3=HGxu)T8`9>yT4)wYfDOc;ZOGXe~e zv7#NypXIi+QHBZ*6J+?}hKvwp8W}0%r7)(2F)C~yb&L+3D!+1GtA1%xa+i~obFlL7_ zCyZH=gzXFARSeMi@M5qLF}%NhpkP*giK5vhza| zX0}lx)PLR;4Z~`qtZZYSGaeo0GMNn{HwY1uFiwYYCXBOToTIai#V4{5*pph)+Xi8rkEfXMGqG?{kjfM?kz9`R&qbfYz(U7Y zVf?}=<4%e`5XRSGTw^5X{L0$APEU}tct(I5oZocEH(`7$Mc)Zhev^BFIKLG}nX#@| z#P~6cJ8}6>VGL<&Uol|%nM1esU!A*Q+zZv$5k)9G((pTAQ`O!p-2YpXPh;PbXh6IzJahjx?@n?}$qg615nQ%U8d z^*`DwX_8#YT$-c?q6|yjbMG-6({ze2# zgiwvfH~E}A{aG5pvIy4FD_^V2u92;6EsswIPD-5q|Q>xiNxGocCbXyMkLI*c`!o z5p0QX_4^`^jVjf)MexD@U&vvAWzg@m|xI> zjM$wBz7q0H1m8w*C4#FFd@Yh2g4ZIrF2r**iHR-7t{r_B!A(XFDf(XU7NbxElcZN1 z5Nh6z;72L?DT1c)d8r=B{yBnQBDfpDJx2Hl9!BtMd=?%s#LaU2CfWOf>)P9kD8C#s z{Sm>R4E_M!TOoWA^ z$cQ3ScvcjJqbL%EE3W?sf1nlxk;&fm98D@7Md>KYL{TD&l2PRDP2y$hufo}-q8QV` zp4l3Eon@o;UBawSQp-_utjpU$;bpz@QB;V+a|zx{sK`D`B?qWCL{zoV!dMZGBAk78>S^`mGI zMW?9!DdUEMByFN-6h&jnHi@EnT;4Q_W^q2WZ9)s-E#s0_bhbDTcP-sE&f7)NKF&Kt z(J{`~&(7O9iY`%f70J_442qy2k^J14D26#YfsGm2hO^p2vBWIvmomp$wo#i$Z? zpZke0_NC>ggi|;mih;r}O-||5IDK#wL!$hQHdaLOOcc*XF*}MmQ4Eb@SQIaC3ZfVu z#R%GrTX>ER5a<38$s?m6a+7JCX|!ZX#zrwNiiuH766NtxOo-w|wt|EodL{R2ZR@{Z zE;UwbGCgp8QSvEK%ovbDGF5856vZ?l(*13{RUS66%vPk<5)^UKDRc zu_TIDrS!G9&U_&YxOMT~z8=Lw5iSy39M?R2%=IR#Urc-}ilriqRf%Xmm&^eLISEQRGDNP84gS_D65FEloMs!M=yiPJaJKx*COBG>Z?kxA&K> z1-wz{A~B-iAp3-~#gSXm{84Ocoxna6DPYfRNQ$CSm{Ej}9NAVt4 zQxxl?*dV3vN;ftNr`o0{C?R2D$7p;DXIw4E2|BVQnZj+H=mN<<34Rd8c7}*3c0_TK ziztenBHtUuz9>EtPUT%fc1N)%E_u*_50~0@jtcIN;((BYQ5+F+D2l^E(mN_l)TD&u zm8N}r5)xXt9L48R zT#4dp6kmw^%P7A3Ppz0T>wX=@HHOW&wd+D|aEcElpWKp6q_tP8^ZzpWzKi0flzz`Z zC*+pk4^c2BS52cP(~puRxf8|DqVNm1OUPY87Tpu_YZSl5CHIANl+OPi#Y4&d5yjqp z$$tue6vbl()q7t!9*StIVMySi6-)z7+_+ciF_ttqMC{7CX!4f zn!_?Ak^uCiaMldh6yGgJIrerCQfx!3Jd1p$81~M*UdhikhhqL;wH+O$Tm^JL`f5+Oq4b; zESOIHCmj`HzSU{OGE#TnmuY295LsO@QQkyV6UVBjRWMPJofMr}v+PHUS*4O>$*a(2 zC%YTO`kic>HB8hr(auDB6SYj#HqppLV-s~ud%srSMC(1Sx+d?sCNo=4gyapV-$`L= zD1=3W2Bb7G(ZWPa6HQGt7e$%b4K`O_u_nRvy- zEE9uG3^6g*#5fbrn0VI2a1$d;3^lR3MgHW1u3;wX_jTmfN#C$4`RC5cbF^b(G{?M) za`%coL?cZ&yC_Vfghc8%UZ6jGlFl?nNYgILcoP#$OfoUq#EW#fvW|(;pA&tPKbe`f zdwkmFUCC3pAzhT0OiVK|)x?-CO0`GnrLMZBi{{F?X){gC5FRXPdmtq*n;?GwQu=KA zo{6O3Yz{DaGi^a%mCSEtO(8Sp;|Bh9R zl$>7l4HHXbj@~r!mJm)8C$3&^2XVQH6(-&`@eW((TpUZQ`l#F*6RX7RYQbZJlPB~} zebPl)H>&Vj6YETHOB;1nGP>GrHJ^}DZeX&TQ)c3-iLXs~On6OfGx325oeRgrMiZM% z_)QolEEBmV0w#hcA||3H9=w>|%wO{QlA)Q;*p8RCT^Jc z#>CGielhW_iSJC@Ht{3l*ad)Mlg+fB~?h3QpB-Qh$WLa=oC}E+bg~Aqg{g__FLQxCa=yVS6l~+^p z_E3shc%h@?rj=gY!qlFr`)fIPOvuGj%0g*Y@1b;@Y6tu>7Rp*EXW1dTP7j5Nq`ZX+ z7N%R6Vd409X%#KhwNTGOB@3UONv~|7is)Ch&}>s$O$$#I$Y0Gubs;qbAIwXqu$CxL zr?!PU!fBk@`W6~k=w+d|g@zUyS!iRSt%b%Gno!L`bIV@WO)ZR({(M#@eQ*zDcpJy~ z0_iO*w6xI5LYcSHwz`V!>0GY0g^b5pFHW=lxt)df7P?#L!QMWT+`&Q@3tcUAw9tto zDb_k$@CbQOD*vt?N;eDY{Nx8MY~F5n+ThWpds_Iahmy9)>8YOfRh#^MEcE5}S{P}e zpN0Mw23r_nflm08g#i`@T6ow)=~pYgP*0`K_Ht#rIG&dA86;S{r}B(t@1cfS7%q}$ zEey5nop|SHIbxTd%9Bp{M_71HQiT)cn7A#YER41=!NQ9cw)akX!NOPz<2WXi_f*C$ zOQ~8tjT619r!wBchdmW0)|zPH#;lad7N%I3B+dQNHjU9{&$RTZ^t$0`t}PiaS(wJ2 zUrH)5x9G*5%FjKOnHFBQu*Jgr7GAM1i@wBBvM}4i91Cw+c+0|E3-c^2w6Ms+s}|;4 zc%1{=OZoC)`T}XFOfTg%3(O{oFi=yhM42wUhN5^;aa+%k^nYL_9;krkQ zMS3Yg3*PDJAq!y(BktL=5Rrxw9QG@mmW5mk?^@W*S?I2;x3ED<_x4iG^-}1f8!c?2 zd-SmR-Cjz*-byKl<2?>zy|jeoX+?S~TPE$uV*)513vzGcv}aM{8aoP7(Qb3-<#mwzrlcgOTk?is(b zaD{G3?5$k2aC3~~8aKSR^0hRr^|t-?IwQamJ5K)Dq+H%Uw&Xi%TDW83XHM4o^zSYF zXyGRdw=Dd?wLHjvsQ8P2vTn28f3oPzTzZsne9H8(9pD!Wcj?tXCpYM$4D6%K@1xwa z@T-O2=-6VP$|S#A_^VvrE4jFui-%mN7XGyGh@B~tJTDiIS!$taE}G@yZw7xJ_UEE} zF8*Qg&qaY;6wF1QTqNegk&BdESf8fl%|*UkAQyp(IbCH#c zqPckY@3i}U6jv?^vnVBfcYk|tRk*KGBp22CDkRmPNh_9%;*whTwa2qmE=uR3TrRS6 zQFBe&h`JMC5cfR}G`|iAXmdPZUc$}Ay5*{3DE$nP9^zD%N ziz})4Raa>b%6RB&MJPuZy1HmX=snEof$|DP(gU+RmQ2j!tYHftt9@O!mrw6?}sOv#J z588Ur&V%|MH1MFA2VZ!QVRc+X4;p*W#Dhj2On#O~?*azaN+EK0b==^!aZUM%-P;Jw zJ!s)UOAlI6SPAF6sQl8`d2iL)gEn+7a?Y7;oWA;Pk(+pX4?1|zm8*C3ppyq(n3JnB zlhjO3l~qOJT{)d`?-o9g2R%F(bSLM+8Lk~|1Xtfoy-D|Av$0;^SqAJA(KBk3vF|5%ZZD%&2~2Vb(}4^Y2ro? zNZjJVR#rAKZe|SU+2+9xTAm(k=RAKm{O?S6d9a6--PHc9&P1&{(AoB1E{xt!OWT7Z z9(?10#{;hiK@T(!L=Su(jA-l32S2S!4-^kn4`dIvjBwgqq)+tiM)CDHU|qK8nQ^fJ z59oavxpWTcn_A3XTUgB#Rx53YOgBW*`bow4||ozSeE z(V#A_&T;~Z3`xF2tIUg5UflKIXAgey;2!OzUc`9us|WXKH}>F-2M;{> zje35p>n{&}_h5KCA<#~E>cK+~9(nMXGe2Q$Ki^qje=y(3N2kbVG=->PdGh?}!5ywk zmkN~ag$FM=?ca>A82@P}kn1gHpj022{KNRpgZE70i#t6)L z6}+_dA%_>Acu~lUoL(e*kFp3VTt+i_g3$=0#D~KV_^l*6D|gZ5=G`MF}rTdr^j6 zB^gV3vAeynMR8x@JY`v=;BrhJ?M-`#6f!G%@wpfEyr}O*C3aQ!qJ|fhy{N)wRWGVB zIo&XR{5|JH3a@e3^rDs*by+8+wik7n@66@A4pMpDUTCqxIim(%G-THoUNrKeG4p0# zG+|QqK}=KXigf1}rc|qR>+CV4U0 zi}qf0@M54BgS_a-wdi`Xj~AW1=CHL_eZ8RT(tgwxEi(4^Vq%70CvYM4OUL5Zr(CghT&c7}k zb}&QfX|Wr<*u>^`FE%sTN=q+i>`#rNws>*jWny$kXOy?G>&11~4li9^VwV?mIk7vE z=VG69in&lWai16az0kbSy*S{7#|y~|*$b~1A_x1txZTs)c?3@Dk7Q`n$GLt}ya=+Q zdJ$k!gTprMcP77km@~T!FYHJylXem>T9=HyKi%olkQWEpRd_Zp&k50o**xmSw_beB zoGyKjc<~MM5fh^0uV*+$okMfARn!SuvqhY-?w#UHs*@aZ%IjQBQ8`W1JHpR0IkzkI zJav&5YelRRanXzKY2J$HF5;3Gm%Yd%qVenaD_&fseVemU+8?~QMV;WqH7~A5j`$-d zB=1igcEgLCk@(xwa*<9AyAx4}|LnytUfiS2--}mXy!PV07tfoy9((bG$pbHb^Wt|} zdQ#4ZjE@-SKZ{xXEQTV_Wy2p{JfmPQh(D!Ko0~%VpI-dM3UN|iaJIi0Uo!UYC{Up) zZ@hTxMFtTr(K+-#UVQZ8Uyga_#d|M4(AvM~9E-4GGgp*|XpW2%5yOOBu_8KiOgM}X z?7H+UCSF8>i0mSAh{z}+lZebBvar`JA}Nv~Q3NHQ{4s^jiw=~PI{#TrwuratjhJnh zoi%{`NEDuNfD()9J}DWN25|&gq}5uPO2Qo zR1;BMM0w^F=wz9EE}}(KR}~SJL{#P;2sfUvDhDhb?ks^CB5I0g!wsk<(!Z{wv4|!j z>WHYzVnY%2MAT>AfN@Q1%GI|qRDNmd@*R$%1~+1zGB*{`Ohii&twemmVhcu!X-=cl zA(;r3dYNNeM|4WQ&lNkeS!`Po?L@R^y`zXuB04aq1BGjK7STmSR}nua#eQt+4B0foWHYn1^h!`tkf(U;{ zVI1RlMl$JE{OnUMB2>boHc7-}5mQ7=6){c3bWTXFMSYXcM`F}2sk21PX4g^?b41Lg zxgE^5n3Z{q3q;IkLgV`-f5fm*#3B)|I7$9a&f%8OuyzuqTr3vCN0%K5P`Ri6*cQg?-p8VvC5|BJPOTDnjfe91`)B zh;1Uai`XGzCwUviYc!EoITAODFW zFO_3#9%nqk*e@>eG!yckV{%5sStj9H-!VV`KgvZB-?Mp1#8o+?h7U_ zMT`>S$@_}U*AXvO`A5V%5!rmm?!$W#A4FvE!R5n85&w#a^*Jr162&COhvJ2RlcJXC={xBp(ud$ml~RAKWZb{M|Xp;hg0^<{*;UhpdqdS(s1&HJDsE*i2^3 z$r#pCm{R~{qp6t7hupLZ3diU1A+Hbld`R=5fDh?D+%FWL--nZpqKTC59~!V&(}&tV)L~wWaaCubZX~{*4~@QaF5##II|~h2Z|p-8AINOP=J(vHram~#?0Oll5uF6T0d&QA%tvodN%^zEcHx|Z(cLvJ4j_%M)kcJ=k4A1RH{ zZ%!QDhxt-Z>(4sXP3+=qGJ|{=LL=hCVCubqyG9p*aF>`m%!lC|nJbI)j;13A)4+}L zVT=!BeHhJ!6!MN^K0T6oypMhdiivDa@?nY(Q<+a@tUWrGst`_Nlk$)`!-ttP=+t{Y zEbw8W4|7#&@nNqITUg)j z!ww&|GT+8XVP79{x?*QU+~vb=AHw3XE&`E#KI|uNX4e59XfwYPbed}Hh^kI+-!i*I zAACNXrI|T2&F^zw!BrmuK1iICha%=1Y8dUAKG3B;>BsUq$tjHRTOW@3aEg*NaH<@q z?WL=5f-6$|$w=mMEnKIW&$*QA42{~QToinc&*D2qI-T=OE-+s7p>kJ&#LGTh@gcJx zS^T)_!w)_@_Th;S*L=9{!#y8<_2EY!exi+Hddgkygd2>v7;iG3NX2a?cNmQi&N`*| zpSjjAj2*f<^ZdRK4}AEIx~Q---xAlvQTg46hpasEflP7{lJ^fEp3+|J!v`Op`S9F_ z*FL=Q;ZHuw3m;xG`HOK&lc>LmWOmW}pp|^ASFBI$Dvbzx6B$M+L>ELq zi=;y~j zYcdXG-k)&*W2l=j$d7Z=6X<5<)301Z{TSxQK0o&RF`RnXkJ*0A@nfVPqx_(^4^#XY z?Z+5u)u7}Fe%$FMjO7-N_hXzNo142xdD~5(v&hw5nCQnOj-=1yQadJ1_JeTh&{)bd z)sJa@O!s334QqE{7Iph%*GxaYyx=D9$eQjK>!W^J7d4m9Wwjq`{Fvv*d^Q*O=|79H zl=(tG7WuK5Ch%eBWzoURu4R5K_hSWZ_>_>t$km~{(^m`HI-d--?d2@!8#*FT7KAmoTZWVBShJD#(v|+Q9lmS>G++` zU%v9AbFQSX{W$E$EBfjq-D>V3kaC1G5c!r#-IR4$ex#lWz#G6%e%$cmrHsF2WayTB(~kub7D~9~$8DN{e%z%! zt+;!vgrEKR#gBp#1PS;2_|=a;X~p?*b9UT)KN9D=AJGu^5FYsP8q(5h342^$5O`?rgLM91+Qy=;fBOzA8Yd_xj@!pRQ ze!S%lp;LQDtB;GpXL|j?e|IxJ`Vl2LbA!si9DKir5Y0-)p8xep9Gfl)h(u4@2w_uQ45gGo*a z$r3hw=G^z*d(7EzaWe(d50mCjEEGm0$YrB{f|_Eh(x1VNcsJi^!T zNs(DvLKzk-N+>I#oP-K&mXAbwdJ6Z3rxQ}4BoshcSwa;phu4hcsm0`QPob`adJ-D2Szp41o&uE~6`Zt0=wn<=h-)mNiG-FCT5(uY z3C$#Y!TjHzLURc%m=osj_1|bVX40DVHWI!{M|!%Gv#sQOGG(k!?;xS0gaHx;O6Vk^ zvxFWJdUE`SK5<^}yf5lIipJUNkh+&vdmP4q)s{3HhL78T+#s zN-B70PQoAwgV`L#I7Gs5CPO6*W0GZ{djr=RAz`Eh<)NEC>GmATWcLzAOBf?zXW7_u zy@c>|8Yf{q4P|ln1PQa4Oq4K*$z%!Bn2>jhgsIHw;~_GqNAwvIW->3nCXw{n%;zx9 zjl|4jGM_P%>|P{cF-;5^Wo0apuvCI2!KS&o&Am**Mw-kLmb3Y#gcVFyN?0XfHFGhK z6S;=@dI@VKtot85kOv#sq!^0aEMbcTzXXZJtrGS~*ehY1gzXY`u(*qH=l|5Ay1Ut= z4EvaPBi{W?4oL7slmgRJ#R&H?@o@`f3Bic2Fi|B0m?#{eNzf(a{liU%qhd%fBk|=P z#)KpslyH}}M+t{$%1Ox5Tlk5VEf4V-31=mIP18?8uU_%rNcdL5F$qU$Cs~<53eB$L z5>7}sDd99%A##cfxwbELQz1ekk#ihyRiX#N<2woGY2mQ)y@X2=F4D;!%G69wpuLN# zT$b>tmvDsxh=j#!v|t;?wrUtl0oNt`NQLq*D-ILJSi+L;|yf> z?=9qJC9jNpO!CN(*_$RKzl;Jh&P;PEc9@<1X@9rXIq~V;3EajOj8ymr+SZGZ|mVsLa)C%cvuxij1l<(t5^MW3i@;>N0A`pbt-}&>L#X zPo)+qeWT(JC*JNY)RoalMq?TEWRO{3MgtiQStLCiPdXLiO;~BlUQ#HmISqu2elq&Y zXepzWj1Dq7%4p4zaeah#GTO*!D`Qp#=k=7z15VYR10Ih`>?EVJj9xN&%jhDbtBf8p zddi>x@^+KaT}GKc0&%L_qK`mk_197PPq}uTa8v0cgYIDTrJgSqPlU?kKEePQ17(br zF;2!H8G~gEmoY*HxrWFX%7hm^@EIrj>(JJRimM6 zHqC7rb7jnv@t}{ekoEa87O+W|j&!L{I+aE2a`zRMFroZQnJiJn`CTd*Jj4*eT6Md()v1s-m|Z; zjZNZH`U*Q`?2>UnhDXM38SR$3_sZBOV-Iyg!1+9)S|caz~%#s%sh8AoM&E8{$;>fJTEY(L?cjN>v+(1Hr3P&vco zB;zR=rJ`y6thkdbA@Oeu>1~I^n$6yH7(9 zQ69+njd?iup^Qh741bR0`#+J$KV>{+{!GU6NKDtC{=0hriUoDySeo^8yOenPhI9I-0Wy3O-R#p;1&J)(bPzcP*&aoB~OoD)@}N3Mwin#;%eI zN+~GLoMK8S*uZ&8D=4F&oPzS~DoeG}oIa=W_EqAcA zplT%BpKY9}wWC68H3iibTyEf8+sygXIlEd4YAdK4iL9d_*C;3F`B8kgt)w#w^%XQw z&`?3{1MZFrIw@$Rps|7`3YsctrJ%KfX6$Xw_yr>ccZiK8Y@wi~0;|73oUl#A+m1rFAwr8b-f{Ps7SwR;CqZEu*(3NJ0f_@76E9lN)Jr(p~(nEoZt_Badsq|LRmqk+g zD0rQo64vvyPaB|Mpn{8 z6--euj>U1O>~Q(QiiFlOjs^1g9#Pu3!d>(;{uAMpEQV##xd0)>G2wDwwBW zwSqMY<||mBV6B>SrGkY_h%Z;LNWo$SOIQ()xJg_}hi3Cli=^Q36jG>s$;t`^CCbKD zEE~Hjl7aYI1?v=?Q}CUF^)%%aND5>H8x?F)uwTIe1)CLUhcawcu#G3l7RHK=uwB6p z1$)>We9qY!b~4|kU^kOn(TP+@-^(VEeF~nyd6(^pD1HTA=Ar_hLT}2P7YpJzFXGwKH`s1vZOUdc{yVq~I$B z$7xY3IIQ4n1&8W5JHQbI-zfN&BMYBNIjZ29;aXiKJ#~Okg_9qnf%w)%!6!L}s+?wW zig9uYoS`Mak!KamW^$e;o|N{Zf}a#zpvlaUI|m5gE4W0fPr(&dt|_?6zttAhI+`7`4$v=Mz8{kpuf-tW<{ za(jqBVDIlV#B1YzWBy=(@Q^kZz9Ex5P-Q0B!ypwr`-|eA<%k{Q2fb z+W#YUZ#8fx3H{S(jEYzlnN?&_5vKwwGO5lS$e_Z-Btb+(MR26wt{C%lMPU_{Ra8+? zL`6{*rBwQN1ANNWiwzR!Bb(1u6l1eEWB*C9C78T;=PId!kPgwMRZ1BZiv|h7LCz_c zRZ&hwc@C?f;&T<1R8(ZM0S8bF5mH7B5~`}GMlKb7Ra93|Lq#hUtyR=iQA&b&yb3rGIO6*Jr(+igDf2=)Ob)71zeNs8I68>}sas3l#(YayL=YlojIS zC2ZM0vAK%fW85uNv}D)YLBiV$88QzR+Nfx&qKk^ID%z=_k9#_(=%}JSb27c9W2tmv zv$G1~lryY%Q_-FEUMhMp>B&ej6cCQ-%?ec^v7d_mD(0z}PwiAOP{m{wQ&bF6F<8YI z6=PKlQ8AP{O2tSO!&D5X(TQ_*hBK|=msE33r_o@i&qwiDj8;M7i#g6k$lqf!jbm|w ziis-5GatgilT^Gb>rCCGo32cw65L3es$v=k%u+F($qYscps<-VM(v%`TsByktzr(l z=Bfz)Xd-!!GdUNiSg2yXiVZXqIAFPoFI6n2CaGvv!P$YAs#vCC>tN@DOO0Eyf+JU{ zSj}W5<4Ja{QRy`W>r^~ov*>>30+N0WLAX)HCKWqW>{PLtt8AgPs&idLUMkyI+^(W= zQRiBs%p%wDJMLX9lDV6D@|x40J*?1;h@Arx_NzFc;x%0&s_@XT(r%{WwhB>&Pen+@ zK^1-#5*@c+lBGgcp{Ou;G*!+MP!VL(|Gm?UvdIaW3Z2&75a;_9RET758EbMCA~r3z zAp&LVFhn?{;wu$rRh(0CSjE>WzEyFIvmH_Kjf$f*2VOvobEJ zusL!{x72V~UuEy$lF>I=zpmm(6*pLq5&**`QZU_E*XGEN`J*3fRLi`CGMa5G#!|~5l{Ke*T6@M~m zr=?J#U@C|6;U$ZIGm`R(2_<~1g5IUZ1swc`)`E)ntdJSS;s-WAGXATgcAWEpNHn`* z7-Jceh6<#Ed4>R70mL&WF;f5u5uP!CLL5oDJAg#iU(Ze_GfMzj1DF!P)Bv&tkUfBg z0W_k30CEOUIe;nwBnOZZz^4Ix7Jxr@d@AkX0elibt^jfekSBn=0Tc)zJ%D@xq;X7s z#=OyK6kqe}L@Lb_+{Nxj6%2roVn`tul|md@m~o>JUxW$iMFUX3OD9r{l~MteW>P$W z5|NmaOlGE}mSIvpfC>T7fyxF@jtTKc7k#4&Za4TRyNhe=g-)nu&3SUrFm zOwJUGrpQ_W)Mm2|W4!?CG9g#meK%o!HX8&my@GSfjRR;BK>GkX1TcA|yJ-Nw98F7U z5#KC;FQ{Pwvis}L#AGgT?6PAKzHU>t3;FDgLzNJpIC{R727+2J^}P)v3~#qnDk?; zJyaOTWDp}|z-2f65|+r&0EPuHHlhz_GAe)(Oh!iZ5*;&9@aO=>M3fI{nZ^Y$K7a|V zObY9aFAHR&U@DW@>@`%FMjaTy+5pxCFe8AO0W1h$VZixco>>9RXEK{{4kPJvnapEs z`JIatdIA99B370Mus9OAgvnCIWsLNJ@|R3j1h6u!Fs=z;HIoTLokw|4$@w&DeE=H* z*v|UK05&n%7QkjE6tk7dmH=waaFhAqNfhBdm(!RX0qkV&t^oEi*&V61hsoXmeVN=j z(0(=#FrLX5O^O(RFMz!|_UZ5kAW?n|wKd2AD6~$4$QgthKp^0JPV_v0U;tVGmjbvP zfF6Jmz)8+#GE%~$0ayXp0fbojDuBaG4hC>260?4G!q?1?Fv=O6A2U+2GILgr%6Mi zdyI6wO;zp(@F0NS0(379Pg#G+NUkSL9x*;<%v;|X&_9@88Y(=CG-J%us8Tyze+KYZ z051Y~8NlBG#07yMUIp-)W{#ROI*2#4#%Tf4r@8_B6Tmy>9|L&L z5P5@W6GYn}@&%C=q`yYO=RxETqCgOz2Ju-C=|ODj9$h4eqD%?~Ap}9cG5jQmLP2b- z9Zj4{VHU~U+uc!!oJo!@7DRE@OEH$<3?-S9ckz0E{O81P?9~} zqbo#$$*dGa5IdIr&p`-=L6IzQat-qbt} zqevqCg6JQ_q#z~-F(8P6L5vGxJa^-lwW9|GF*t}JK@1II6d$7J#MEI-hEx8Dsgz^{ zn`4F53u1l{CxSQ`#DX9e2C*-Q{Xs0ET0v|LVp|YPf>;{Fx**mEv5eDF z7p)3nc_j0fEUpM*C6jPR(NR_hu_mIdjgSpY$V+Fmk@=>GvYE-2NZTleQf&`n2kSej z0o|i_{f~Ed5PO2y`#%cB9|*z|gdIdE2yYM~*9|aI5BQi+Wc8R zG|7KpLc!OVP+w7pQ28l{8$sOUcCI>|NDaFc#BGkb6U47f?ndhV9K4q^S6;0I+ypfMbloYA+LsyLHtWwdf!aR8lp5rYsjb}lZF@#H~&hB(*Vu!#!_T{ zN1>8|m3TrX1?t990F?x;LZ+K_QnE8iWK7bKnMoGLtc(AQ z%oXwG)<6#mpo;l4q-iLlp{$1d8VYF63r%Sa=^6@Z_)J4FRs;=&G!)kG37fA+JMSEe zXei3&ryAamjth%K{+}1uP=W&}c>hA@Za_&kOKE6oB{X^I&Oauu!uyzV8p>;^9*L}= zp$hYg8a`)IiLtVVt(>IH`xvTKmBnfrhV+en9pxmi!Aea=GU-Rzbu`q~kgOv`M?DSo zH7wPzOhW?=4K)ncFhWBk4UIK)(a=>x6Ka@-4xFKxhA%X<)X<8}<{DZsp|mF|BxZ>G z;=8qmwyd{dq~nsSord;ohQp}A9og)}*f|nOsk$-mO{k$e^Bx*{GFe;S8H-*T!lbW; zeyk7C&|kv<4TIREn1M{fKSC!Q%x3t|LzxeYM3Q%;hEW>kvoc!47!6Z3Ok;Dbh6zl@ zF^*>pr=6%_l7`8w&=IF-2^Nc5^Cw?FCK6)8*JFk24gv84l zuCREOTF$@Spt?tf3)eOLsNt1{*BXA(a6`i*4UcJ;({M|}uNv-axUJ!ihMzV3LW4Ul z<}U394WsE!(dxlY^KQ0^I@l`e9w$FI-u>%v;Q{mC8GmD>uoryF4>e>R;dBL+C)DQ} z{?zaXO*ReBII`u-sC=EGnzVF={;x>gml|GBM@@CM5v@(y-^3p}H^C~55Z=)6(QMb@ z((#XmceKOnh}Q9*>wcguow_c!({*uf2mfWgPIl))-&BT2`e%KtsbpxX!`E5~Hlk%LJ#9Sb<} z&$7s=BOCuPywp}_LZ<4-rDLFuLha&n>&T;{8CS`xWBUl9td4Rz^65y^kzYpvb`{r= zuA`uiB07rdI9M)r<(U*g$0y7S>3B3kD6E6Tvm*rJnVZCa$`wD;QA~%qIGPF_`ri@4 zu<6lMO6Vx5qZG%K(NSwqdTHiFD2&R9WR%xYftoi`sKZ!MM-?4ab$rey>6LU;W?pZk zKxQ=^)pgXQY&vS_c)U7}O7nRsx7#=$$JEwQdbVSdxVmc!5vo#`UIld2*U^CUG}O^Z zcfPtzuEsi==xECN2+mL9vXR2^xHKYP=nzK=&2_Y(5z)~~M`s;f_!L^}XwQTW+D1oP z9qrh>GE$&#+&$?K-$6%59i4Q17%5N*pD&TFI=boTO~D-BT}RJIo*qn6M+roF=^#S2 z`s(!f7xw__$@q-@boA$#N}~iS|3 z3iGKtrqSHiF+;~p9kX=o7$vlC=?v@t6XK-I)iF=UdL0{d%;&nxbS$TNt7D-~PdLG1 z9ZOk1#z!Y*37aoQ2~>!Gsbd8z>vWuNnYvQP8XaqOtkSWXO8G<*snFpF9fgC*Odl<5 z)Uk*?HXS=7k=toe&?&H4W3)hp;=|@{7OB=AChbNG`*j@9 zanHc720S{vv~mq38aUadop#GFjJhk01Xi{G6kf03L0jgDhF zj&rS}I=*Exc93)X{e+H_Y<{QX6cZB9GC8f|&1m5anZG# zj>|e;>3FT3FK6183O0&pFlv=6~sUNy{WBUQlndvU`m1H}&=%=i?rGjPORsTiWmq#2C(I{tqo= zI2us&=DKIjbr&=s7$`)|HXu!mCH)fv58g!`nB!hJ++D;#Q3E7?YJil@ zT#Jy(jk)gP21*zxW1uX@lr&I^31y~QrK!Qg-P8c8NSVtSC~u&GfzZ3C>+hnznHYQR zT@+;wO^mH%pt6Am1{xZuVxX#lS_WzxsAizLff@#Ca;n4cqQX_)Mk-SEItJ<*s7IY? z;QMz`l>8!l3B!e&+Q>j-11$`+G|Vf&4fHb5+rZ+9 zu|2qZdm5n5r#y5}%G1X{UjuZ4;k4BAL@1!YfdK~SxD-j9N#i)!zz_qY42(7~)W9$U zBY8}RbHhf^q31dYDJ>PMMV&zA7z1ND$pi!A42;@JZ zSY%)gn~NEj8~BpR5(7(_EDM`soqPK$n6F}-k~exKEi1kSy_)(nvy-#Y)2Ouu))`oD zU;~G3HL#Hh-GJR}U=#DTW1RcmRJIuO(C=JCwy{oRJCpiDTsxW2LkURS!~9zV#|-Q> zu+PAL>Qw`l0h{)JTI>ciju9Cp12PjIqo48Z>6{7^N*G|GGSbsZNeMDfG@TO_}QPx+bI(3g5IAP!? z12^b(%D^cDmua|#_|pc?aM(oyXCrye8#u?D-fn!yWS8Z>5b=hU@7cU$fK2&G6s5Yt z39r(`GjNUhb;chJT&m)HDoSPSE%(hxp1THaMfhz4cOv}mSmEag|Am(SAI=92_i2F` zcw^wLf!_=~wsSr)oZo(u>vs-*Xy6f($Bes%B#`S51FyykPifOL@SL|?+G$@J_>=0g z`GSV8c}Dt5IXx_$zM}AVB<2;9*NnNw3I8zZWTLZ)cLv@Y_+a28ZIUKFG4U^ZGnsIk zh%ymvIFU_ffJ3Hqwos>#tu)YP0DuzQ?94=zYyerBAI+e97{ z`Arlsk(b2GuCz#=d`upW6B;x_*;Dz_>2$^k<;Od1pi+>%^f1XnCJLLVWumr;A|{HO zC~KmeiBIXzUrZD?QGz4ej2DWT_^Y{V=6HJYr*p|s(xgX}B$Q@vDHA)#3pY7=8CD8+ zPbzPsf{AJ-s+-QQQ!ARNWTG;AKR5AeypU&t)0iqIs#50d&MSDO3G{e#=bI!{HdS@r z9M$0XnvCrx2z5-)Hl({L}L?ECkXv}#5UkCs@0H5y;|u_m^3r-ZIbiL z?xv>mJY@P&xJqjp;vd{?7>xz zn;69bV;Dy>QkO~#(#JBVJk@UGnn1HI)yX{3L@Q1{Yj4_siNX}>Koc`f%rY^J<7Y%_ zO*gT*Ng^$9s+E_&em~p9920XX{+^q@ACjS6radj(-7NP!uJX#Aw9v#Nnhz#+nOIDn zY+}8M4JMYFSVl9!#A*}EO?+uW=o`1v#0suhxIuc=^wh}{-78P#&Rw8j%e+`)VlBJq zL6q6O?#0~TbtXI$g^Lq~jV3mk*luD6=h@7WTN$^QpiT08zxZuz(kE_#+3DeL?9&k` z)ov4eOo%3YCia@xXTr;o`xy_=A(-rWoA{Ow8a+waT0Wl2s)SfSyA%^D6UhW+mQ56# zrTY(0!^hjE3fn3#A7lMdkr6W3@@2;s93uABJL#BUaUxA2pR8#JI6 z)>ybnojFM;ZlQ#QTPALsxMSkVB;lEf=O*r&_}RoSChqYmKQi$vPa#@aznQpi;sNV~ z|8j5qPF*@#pz@Fjz0f~4@q}Yuu1fgBq%SXJqVkkiG?72)#A&0pkZ9qBiI=opTZpmn zH*Gbvx0`rx;x$*NVR}pRaB}n;6E!D0qxMfk-_z3dfq9hWER&Da7&iM&7M4sFqGma_ zcj$%;VXTD=7F-+_#|XyCm!0h^o_R*b1jg%A(=#z4@9xP$l7-9`@>s}gA&Z5q7X1?+ za$3k1iOFu^Xa#4Jp_{IR$*iYZ$VFYWxP6BC}ug& zHlgPQQC%u;2gaAQP|Cu13ll7qww%X+RJKsXLK)6bma&|L@)jyssK{m|3x7=(KDR(6 zoQKTYgJS6S(N!%}v(VW>7Yo%b)UeRZ!WR~5TBv2Ap@l{kYFnto73(wBwNQ^q(iCR| z={tVIVp1EhvapFW1dW-~Pv)C4X+nL%k>sLpEH}5%!a{2cZP?qAv6Y4JV+ZJF*Z2=n zZ7sC3(2-s389Ojuz3${sQUAMh+lj@-Q-rP-x>@LNVE`-LE%da|%R&z}2h?vok%GPZ8+b)I`Qv&W&RK6z9<;6D{X^3o|XuVlv6XWD8T6Pqi?e z2?b1JQhjye3?_;7qe-MP+rko7=2)0ZvyS;f#`%mCvw+E!DZ(NqizE88DbAyJms(h6 zVY!7bBl=1vE9e}vq=t{O%0kAePVia_>nwz5nG8=^Z()N4k%KqVWM;CDakGW(OoVee zw=mgiVH=aNC7hP;U|xNyu+zdW3%l9eV}Z)vh>N`8qwig z4GXdb#ez!XK2^{nkpU(_M$)P191zZLTCmt%sc(z7q*O*_c6MNmlk9>$l&Ev^+gI)q?=eKa% z!UH~qI~ML*_{G9K8u48J&7YqwRdl z4MHkp#@WbhBa02#$Y8_8F&S-SViM1oz^F`hwkfxbBsPgB+6aq8sARQ~ja?~>*%@=% z$YCR#fiU@h>ZUT!#Yis7kk`h!OiA<>;4>TfSWmN&-v&JkqJRy-#wRSM+bGC|+Hi5I zP>97MHi|MSY=cB{QTf!y`q8P)cg4O8E16xzIHtIb5;p3bc9&!`&orSF4aYR6R#_Y6 zY%FEHyp0Mr2G|&AqoR$^Z8Wmc*hVEAm2K3tQOiaZj--m!Y*dZ#mpM?KIXz^r29tin zQft!@Z8Wga&_-Prt2a%oZ=+tMRxK?XDef_`gh^v!YaMcS!X`GF+GuT~jg4j;xu8aD z3npJstLnx!XI^%WGZR`eZ$(Yzb7^a%osAwgdfI4jql1kuHo9_5M;o1NbY|XcnsDH9 zV!vs^&E08D$GE$(IJjnXcN_omFNuogNTUG{cQ9mZe#j1VgEJvAL&UK3pig_ z-Z@PmZ+{y^$Q)#2u#KrUrr8)`W2lX>Hpba#+dF<3ry6NvxQ!9a&1u5!m{_Vc%EoA# zpDecH$LW)JX__#el}U`GOt3MLX6$O`rGdUZJK4sd!A|ul9PpYOFx|#18?$Z9U~wiR z^%#XwnPX#~jrlg_vc9FIqc5T#+No$ zu(-y?S{uRB?v*xH*`SXgS2H&KE*J52G!<=Zf^)5kjf3#V)&wN=#3X7P#*!jx7{dkE>Kagf$sdd83q&4$k0V6+%b z8!c1NHU&1D%~G7;gEkJa`IU_$Hojqg*v8jPDB!^3oJW}-WBitpL~>C%ZaeRKh@7%< z+NOWs#v>bNY@DUG*|iXTDfMAasIiI z%Bd-_S8QD6$Qw3(uyM`CPi*F1;<|2Q(UjO9ZF*jPYUitogj9tTa_ztQUxwQ@ez9?n ztK6ZcGNHdZ{h4d&P2+#HVNVx+XZ^m72b}Xa8x%m^AEyi9mQdRs+jwH*t&M+Z|F`kf z#&g>6ZG4D$HgPMly?rFe};V zkYXVer=@fdDF;y^gpwh=58*=yr9vnj!Z#rt4WUd3Wkcv6!hjIUg-||(b|L2#vqA_J zL#Po#%@95hp;E}Xpsf;e?jBSQIX5cla~a~zW;j>5RYRyo0sZ5vQ|BLckd?n6nS%N5<=4uT87Xngl4QaXZ(VZnm28R z&?1Dnd68$c^EqSd5ZZ)LVQ_rg5VrLCZ?9WBL+IWqic0$sI)u$YsD3eIR6jq9Vr!z2w zK_SczVNM8xxuZsfFgk=GTxDno!$KHN{lCdIl9dt6$!u0P_1;9M&8u2u923H%5GIE( zHiU6BXR%yK4wLLzo}J0!kRd>JS!ktCobYG=xPVEDkxp zTB5g{v^za5j%DnnMt&K>a^{1ZI5+xMgs_rLdK6glOo5a&G^}*25H^Oej$P{+!#{zf z0D3CdrVuuVu$}cSj9Ww47D98*Krt`0)F}~ObVl5+5O#;)4?zlHPY8QMI1qv-gne9> z;`fvC)Ok6se%5)X>}A~-@rvY)WUDnlP7Xl{!3x0+K@A~5D>?)t!0;a&*8hHyOO+&jG(!uKJZ2;n4~r~Z$s?|_n`_`cqB*#&0FEFcn=1_jBIbC#Sl zl0`r=N(RX}=bSNvfGDU;?4H!q(<2BdQ9wW>BcKvQ`Ci|#e}BJo>fCed)~i>!W~QgR zniwTUWMRIXW{^)EoM0YB>?potR5Bim+mud-l(xp`#8I3)ii;Fa9mNkvai07~+x`s6 z>7!UN*s_;!mdZI|qgl!Y+wv!paWuPh6qgzOnRvyvS@Ly(UykCsM33UpQT%!oU9vcC z9K}uP(rJY{&Qfk2{r4XGJ8b)H;NmVC3cR?1VE3`?vp{LhZ!FBuEwy*o?!M|3_L1*b(` z97O_&@I)t)Y@SS#;>3nut*4o?IFaf^n$tRsIfoNDNwPYTjYP!kPB?6yPI91grs%nx z__}IxZhDibggi{m>qI`1{C2L~vz3BQ6mp`m3r$>j$%(>F_?%Fkc-e^}P7HHmxD!R4 zDCR^5CptP&+=)ylYC2KNi4smIPLy?`oD(ITDCI;MCtefhPOJA`b)vKr6=y5+f3dy~ zuRf6f=5UL|kMHQnyP?WEQNf8SPE-|3Cn`Bn*@@Sk=rvoJINR#^&BSI09P+ICr?Zu6 z^elRHC(h4S-X54*!-+pD^ba3ce>QDcoY}^SwiMeD z+sh}~>CD&WDDr0HwY{=;a-y@PV~`VFoapMrON$fxInm9D?$Sml-gKge6COTj+0%)i zOJpk{yKZV)qd8XFdpoUvI{HX|{+hr09Hp<*x>)z5bejC0?JqrcFV6reeP+&qEc)r$ z)QNMHx1AX5#LS7w;q>$&QvZutBn)+8j*=AT?@(MiM;YP7NGG;CvBQZ`PKt;J4{OKG;TDt6yEF=1+&vT;wTxIBx zR8iz2)j}s0Ik86CE@S7!5+_!&l%>SwG7VN+lWG~G1LrF89?TVzWvp&r^0f zvCD}sr7N7+?Zh4@4mfepi4UCk(20Gr=$u&IEyqVreB#8X%>FU4t~kt@`Wg9N!JMfT zo?10;%YydH=<|hf@u$DPpxGfOCN)Vu`EsI|WjCy?=CBh-oN&vWku^@6Z=Cp6=55S6 zGF`$^CtOaf$S6_pc&5`SU$-&`(EsL1DLwcsvzNJK3hh7Z(46o)@xqA&7XnTMow(@4 zB^rdBh&l0{6JaNGDiJ5%pQl8f2rY9M#3nBiOzGQ-Nf$3<-YA!L%!%VNnoj)a#P`gy zY@TwGicjWS(+f_M(1PlYg71 z{NzN#3yv3gkZZnjSvtyzhfX|l;))Yjow)799j6?^nQ_gD8_fQT6W3*5%9mb#Mar*E z`O2Ltyy$#uKyT9E7O@JIyW(v}>Tgu;IdNZ>=V+_kp7WIl6lJfFdHB1`mUStQop>V4 zVZQQ*^i_+rKV^WbTI4A$N1jiAPV&r&znsW&1k2|uBkL6Xo8muCNH{mZa-Qfyk_#nW zDCI)33n?z7yO6_$Z{{m-S!*QCg{O@&vbd1yg8O)y@a#|1ugq7nx*(X%h3qakTzEcT zshUuhQNLNT+A%f@XL4xq2E);X2xC@ysR9|3qqlES(C0wYzCsQFxl86$0#f4X0s3yiP zly;$vOHR%y`2FCt*IX#;LPZxUxloSfmUp3o3-RON;#gYFNS9Yx70X`Pg(@yobwT*+ zM0q2dka!TW20hdz)?@{03A#{+N*v>rtVgB33k^sby3mMZq}>)FO-0F>`i=|3TxjOP z8!j|=p@jKJH=zPADrHcz) zr9-AGeO&0~LU$K>x$ve7k&^{_xX_d2YK>%R`_DwtqD%CTW=dZd`nk|9p+tWd zW-U;}+l~d+@3?_dJr@SKP;-i-#G>qPyU@68+F%!k$cX37G1LWl*Jplt8ED=d^Y1x^ zyD-9qaq%8-;nWZL-zAPBjwX&FO43*t?kbkedoFypKoKG+l^oCP6I_@`B8n`NDK1Qv zcDeDU8`E5P--Z1y9B^T}H2HLv1uiUfVFtNGXOhfvVK&JeTc1lZk2v3ju^BnUc#+Ic zDmz?QLbA$*)g((@SVpp(D8?&XSZVVTPZQSIe6tH{ZNAQh_2e6f8(r8$^0ih}f;f?| zh00c0k0hdOCwbH_b0^6z7j~2Eap7az<^vZ#wE0J}ila$!Z=X>7)P>Jn*z3YR+val@ z9%d;Jw|THYIq1R{F5GtEjthre_`PQ4F&B=z@TE&mCBk7Bj>uGzzP;l3n&^`Kf#e$( zzI7q@LPf$+7o0X1OOFd)+Jq?jT=2_=?}AEEEHx6zD8@lMDqNDnc9PD#Vrfv3)Tj$4 zd5riSab|~9N&4P}6E0lm{69&QS$aVxl?y*G`lAbHNKV_SOIjzNB|k?zFC8^CS-#Rp z#-CicNbwT!stcD%ekNWaR$ORVULzOs3$qLP)mCnh+;rgA4GkyYP<-FJ#|yqmmm5 zZX~+#k{gBHNOB|DjofbJaU;bIxaCYjWOE~n``=$5X>O#Fk6vgkI=P2gE}3R`!{J6Q zH{^7MbT@L4qb60*|$*1??#3j1>7h|<;_A!e#g32Fm$FP z{?~9JdfT{AdD)Gg*BvF?P~0fuMp5eWR?}i`6ldN{Hv+7cWEWD>jq^PUzUoG4W-R5# zD{fSsnS7r%W!!kpjq=P`){Sy*$Sq#Ex+O>vLd3(ZN15Whf*U7K6_CnTcH?z7-f*M2 z8&$-Q8+F{M>qa#S7>uK#9f z;zm=qJj7~ssp#<}L8({^H(I*U&W-l0d@FixO)gz0_HD@9veiT0cXV*0qZ`AE<>>B4 zCpS8~(bbJ^ZgioUIJ{m7ITl%?xx%zQYU8DdeGlg9NwboRl-_Rik-_qyfCqiu=;wyd z4b_eQZVYf^og3@j7%0YWEO29?8-v_<+im^2oZ-e`H-@+|!HtP-45c{2jgfA=Lq3c+ zocP)?>#z$6quh9p%4j#nkc=h1D}@%aPWA{-w=Bm|98Z*}r+kh{eCEbp8Fx1}GwDM& zwvcRfW1AZ{zDpHL3EL^|c4G&LC_71ZxiOwC+QaAvcB-61@{!FycHS9$J{vXMwn5Z7;(dJBT6ndF`1uB zQ%yHwi~c=T<2yI9cd~A_{N9bpuUh9SoOR=bENVAS*||=;@q^8Ol-0zOD9%uc-{5+V z{Jd;vBtN-vNv3)e$3;6=^WGVksf_#HA^KJ7cZt{B_{ELuLDN ziV&&W9XC8LC)Rm6QQqew(R;KMa-T%5r95=wk?g=8ql)iB<)oYjMD z9^|GjVs;O5kvoX##2mz&M6uc5)XLs`v69DD@{;89$g_}E1ti=)nrGX{0tG!7?!gET z3VHC72ZcTOq(@o_4-}G@iA6jpN+LmPm69Hm@}P?cT|IckgI7JM>p?va zN_%j2Z_$b#RPvyV2d{Zh)?U+?@gLV`fdeF#&mL9b7 zps@!{C^q+?sRzwGc*A2IQ&9F;x~sTD-kLpNMEdk58Alf@Ej*B-ckzsL@!8q~QQF9? zSeO_ng|>7e`o+acdk;D=+R=kfBoltlB7YNiCYMj}?(NdL+4ciH=bk#lPPZYRg?@9t@)RHgTv2gGr=TLr9)Cw(h!o zhkO`u1P>8p02zn5b zHR8di9(?A(UJqOzxINhC!RIpBJov_ghXXVBd+>$aC)qVq_yH;h<)dFNi4V*?-?Br*{-_5MbrOZhGWW>fe(K0sKhf`jSLSVM zs*fl{^+2=vsBh8(bW(1KwI0JB=pN+oBBvJ-4-Bc52ai06dSH5RS-Qf5mYhUs2|~orC0d>zmHpb1lq()w_28P=EK%eo*S~mhovC*{_|=0O zY^8t={-w}r*2@I^%e242TweBO7WQoe|hAX9mqZQk|ZHcax7I|c#z;lsuyXTDv4esdyzt( zM3lGti9N`(5UaB2Zp5rq9A0Ge;=QFxcA^l;vT~`C?uDRmc@`s=7X@gX+Y51P6{yZ1z^#9|O~hdQr@aQC{m; zd~q)_z1Tg&F~ExwUMODF_M(m#C0SwxFDiOb%8OULc-4#2UX-O?#*5dy|GsnWzwc!$ z=S6wyBF6PfUR3s?I&-~Fltxu0sX`R9YF@~DXC%l=+-i7Hle+L)wt-}+>qR{;T6xjh zi~3$Up3YjHExl;yMI$eoc+u3(B^eug|1G_l7jJmc+=~{rD=98skYpDge{Gy#8!y^= z(cOz4UbOR~y%(Ll=TmF!OvuZ-Y8$>PNzFW&az9WRD?VJ=k?vpNQQadnWj?uO9kP~x4XO0ALU z&z2MzE?x1+F~Wi1BDI#&Dp=632V-F3EdDnE>O&;M@E?s#ud@0>z2M zNnT7QnPOWG-RGF*#rs}Nmx<@Ku9YqGVkXIa;w<89qNL6tnd`+oTPb)ieF6DGTUq4A zVw*4VVyVq*EmM}0uaJd6vdW9~cIs*`){w7_EBDgZ3AvXpg-X~!aU*e)7n@1mTxMNQ z*yhD{FGlz<(uW;h?3DTJLpj<1WeLa(_sQ{P1@?IHf%Lg785!dJ`9JjHb1(Ljf8@o- zUVP%kr;JMKUXste`0R9&ME5c34_o|z7YDsiz0kb)!iz&*eB;HpUQFGe|4ZT#;#b7O zvPRmZO48SimTzX69reP=sF&#S!YxxpmKamRdGPy;6nT-f5FZVMOOoG<0HYCN(2FpM zI1G_U^>h-+E}{g(izpR&k-9kf&WmHRoB5F9!*MUZ_u`HhcfB~_#Yr!&dGU)Er@Z*V ziwj=-w4sHMZzQFD`rW zvlo}7Z>tvlwrZN-qGiezndJ1am3hy0$`C`<7caa>@FCG>)kMx+-_P0#zqU+~#>!t{;!UFPA&U<$`%uJ( zR3FlO$n8TOAF}$8&4(P!p4|tB59#DJna^->LfLYMV4D%a%%eU{QAGA z8eXVt9kf`NsV#k|=RS(H!jCbagU4Rf{ip`8!y$vZc3bchpTM`9-*Ci3XW5qw0k2L`jOLuA;u$hc!N|wR5fW zA#Sst%EIM}7;lv6&FE%3bqk|$hudZI_rd3b>cdXi{C)VuhfjUjEtR>S^sx`J2k!CV z10O#0;UkKoNLX?{sZVVyHIAS8u-At}K77e6`+V5%!vP;YXEc02N#}NY(1$O4h;OZe zA1+tK!&g2W_QC0c%ZG5k0-_x8;cI66#)qRM-^#jZlUm^)EA`eBYiD*-7vdqA-9+9~ z%=(1#i>2m+--jP;n}83x4-p@NK5Utk5h8|V;@wY@sG#9Pl;UxsN&L=-7;VHLZh4IQ ziTg?4`*4E%B#Ss@>v6Lm<V6 zzh$GAB53xftQsF4_|Ud$(T6@flI_lCz4l$gAF`QbIE2VDX+1IHi4RYi<+&{95$Vs! z{~|`0Tjw{*PkvcVSC=ab(khCp$W)=ID5;_Z zeaeTOT;e#@uRFrC%(PD+tD_$A7 z{-a_#d1V!^tEi@;x{4~yC{C)X*x4aDHq-i;lLM4$P_M0`j*6NpYN_}x=8)cAT|IpR zok(MYU6i^ij;yc-qJfHrDq5*%t)db0Hc`=3MPu9l?G;Kh6>B?YZLXq)iYxD=y}_jH zd=!BMx$}wX3)AF}b(U#Fp#C9q=kVxIylg!prJCevTp(1uB??NnC$-0NXn~Lr# zdZ_5BVz`PCs`XNGvFxSdO%=UqIY`CZD*CACtD>KZ{wfBFu3~_SV=ofoL9z_(9n=VvGtQ;R@Dwl6O_S zr(&Fn@hYaMn5treiis*Ft4Lj`Od`g)7>go7$TaHj%YfQuVkseRIZMTC6(JR26?0U~ zRdGngmn!C|n6F}kij683us%yv{Ls|;6|+#qA}YcclgRsam#SE%V!4VHGH|MOci&2x zv@5L#uU4yAB}Js8E2E;UQRThr=|a}2I9IvodfMxU^NW8uo_CXq9WudGY^L)qDz>WF zM!uamea^q%uckgr+NEN*iqBN+Rk26K2P!@hZ10fpp^A@Ge9Y*?4e6rv&w)NUASe9_ z|5Qekd>;)C5I?u`?w5{bmV+w3peV+YOYkcdFEXvcb*nfmQ(8KzZMLsf9A(`^|3<~P zo_0i=_Y96psooxle`PPE}QCs`bT8vYaWJD0g23R0L&#yR8GtyNQ$>u*G2(Z`cRBi!_qZKBNn-gYIYsG}(!w}{u}Q-I`#ikl>Tij|NcW)g0z zxI^(S@g7n1j8w-16%S<#(ojXiBNe|(W3%UghCfvNsan5eU(oomti%p!ALmPaqT;E{ zw=P-xwsbsGQN!){i}+l{-zxqg7x7ml3Q7^;AwjeJBx*<^5uU6e#pd$gcNPt)8qzdm z6;VSW%^Lk|8U}`wa%#w~!J%P@mNi|oF7D-s^Ho`eS2G>CH00KhM?+r8H9tK=L!D`k zLhaJ>iSav1ehqTFpeW+7fQG?;6%d%71xl-a*Gg)5{nUk z%a<+&B{V3E#?MkKN&cdyH4v|Acy=NEH4SAol%_6X84dBdU^5+L=iPk zp-LJm+qwQ)sZ`ZaO~VKcBQ;dlpbkmc@Jd=u4K+0M>TWe8d6iO2Lv3lPwC-4z#u}Pv zs7qc?LwyYmG&E#X4&=W(J?kfJ6W`8`MjGT;ez9+=p_zu>8v1B>Lql^7(_rZ>G_+){ zUK(0yXsw|uqir;_)zDExCq~;5J7{Q6A{ht0mHI#4nPL|^HLiEl(4Be@V$c6S^-YTL z_XYGNA1J*+(vR4mIDjZE8l>TEYYt$j3@F7ytE?B$NC;j`Uo|QFI~s;*7%l_4N@=bZ z6TQwVr59~R$*hohuHknLV>FD_a8Sb+8s63Lo`y9V)@m51VZ4T!8fIyjpkbnhsnSIp zph+4gYnYmzTShV>eDYuKYVH0z0*04nyTf%CE+}E3 z2lD4MI6yqwJz>9w7genG#*Y^}q~S{qCp4VY@Rf$c8vGgp8jfiAT7z4IN5ePqyc(Pu zz9pAu+1j_Z8Y?$^x~K?WJlJ~Cr&kt^t@vd2?y}0#Y$fY-t9n5Vx`v2`5cM$eA=_(c zh-&yw!!Zpe^;kS_&eW0DELWw!w#q%O;rqBQx5SsRuGp{cmi3f|A2eLk@Qa2YnR;Hs z1r4V)oY8QWO4DjMry<{JMNVO@vf3KopEO+5O{v9PTFU)1qU7)+ryqs!sPlO3ljL4IXOC~WIR{CL^say_T0AH^7zD?i0a{;6f%Yoz#5(vP}+ z)bpd1AFudP)sJd^yy{13Kg#=2!H+Vuf6b4w(r*hBrP__wDAJsA)P;zjihfk`W9b^@ zb&8e!))glyYb2Xrg&E~KRnxtW>NKcD6q_0(HT}F{slN41rZ$y2etgQj_5El-rKKMY z{b=MzGe6#-(wNwUC}qiM3{Cyk)iAj$sX4_KejK`Jjo18DDRS$MkXC-Q_M;6`-D{M# zeu#d5WwLNd?chg8KZ1UQ{OBY$Ia3GtF_5IQA6-bg`q9mg?&M<7o1}--pQM+qzv;)` zIu0@DL!~dVAF)4C9*dCFxBM97$2LE<`|-9Pa>;aB0LeRk++QOH2^N$f zWQ2%*%=OF5{xHgq(SGa8^ZR~`@nfubTa`M+k9SGN`!T_f_sGW)5A{zK0|^uTm_#M} zTI*0F36uS}kWr!-qf`Bu##GS{7fzVYBBYcVe$4b^mLIciWsV;YKPW0m63VVs=KHb0 zj}?Bb^kbn+R9>ZDO0tN!n7D-48`j;n%gC4eA-54qbQPoP{8;bDYH|_R__3C}bL%vT zZm{*uerzP)WGk!2T92J>VRS1|PBz=&$4)=IjP4S*e`kK|$0vU5mg)U@y8Okt$Bz&E z$l5nm!iRo*WOL`R9G}WEXIFgX$FGYVd;Qqw$LHj2)+)mXr0)0QpdVlO@qLYi12VYI zEJ6ei`SB%1iAsnP5BqUMHU~O%6Tk7}TR)EaA^q&4;v`BmJ}x6UA|8q#I1+tqg-Vo` zY9xL?0wnQgRKtGgvP=SK9zetoLpHGhk^+eOVft~^k86I!{P@m~b23#Pryld;ILTS5 zFv$;ov>Taug8U@$6mjiZ>w@i%>|duDBkwtjx5P#RzY|DxJU6f;(gi5 zcv|4m29Bir)-yg;W?E*C{CFapJZ*mW;}4QQWk({BL*(M8$vtEAA3Dj_Ed4J(p8Fx> zZ(@(N1%!*Y7c@%7udr+7QLR>{ev_@(AN0ptxp&IT+*F<$@$NW?OK02wxyGs&l1ODz~c#}^5Y zH#%MlpfHnO4xp%QQ-q`zZ`LXnK(<;|x0J9`OOq(Xk^z(=c_n~XNe+xHD#r726%;H( z<+T9Hl891Hn#|)3E80pGl1c$oCV8Fsgl()EK(zp>2T&t`x&hQ9Gga zWqcVU!TJF-px%_&FaWvrt1)?_0M^#c6dMUms8pS8-Hz3a{K&n876G&jV5~#~){Tg* z0%#vVhX7hLDoPuYwgI%WmAWIcb_}3X0DS`JOR;kRJ?zvj0dytr7C`p^niRM0;*&6n zH#+tVpchl$wC#HbF!B3>V$d&u{uBoXFo5JO;y~N--MScL^S1-I0jt780vH;=I{^#} zU=&k_+cqNu7(t$=;Jaq?aOGXt0vz_)NU_D2G62H*03JH&a@_h~K*Frwl1jxgX8x9>1>g^0>N+J5K*%m7DD%*^3{%uu z+lbVV*Wt|oVgXzW;Fkct3*cA)=K?s-;>7v!0KR9g69N2S`#c%IDVxhx{T~B3&1iww zaE9b8amT*=;^BgAc{zZe$S)Ev*}7EkXPaLM;3|2%&ev`IS6OT86lvOx0B%yeMZ8PA zO}s;lXS^4{eMaNG^e})&0sI}nKLPws{W0;60RCi;Nj*PkoGkc+x{#*T3!!WX=|SWO z;!qG@29Yy}TtRdQqGJ%bgUBN`L6i+5ukEu?5c$aS6J;W01g)7_Ac%stA{Bdyyl@aN z2T>%5qCu1lqEryYf+!wDW)LML8q1K3(zk-ry@C=HsRr96lkk-wUbTISL1`9LhKe*t zlycKGb`&OXIVpFBNes(E&jW3}RRi!)0fqJ~)UWK@1Aw z?I7ZRBZ{R|QgA2@-eH~N^IW=dL=Yo`7|WzlL5vP!47oH)nkjduNJb&jz3&F`UJ&DC zbedS5wk6e?@VRRhls=SkoD{@lW}F$slpv;(PYYWAQN|}md}n)~`t%@XkcbB1|yQ>x0-3#72rW(vquJv;H>SB=bt@R=wa>>f1PPWo}EKOLJtJ z3E3IMCqaA~#I7KAv!(I*zbA+fg7}abKMLYw63JCYx@Dab@2=0tWrNxq#J(Utr;U_* zFo^v@9AH%JhY;7sqs}N`jsHA2Jt9}--EbDn_EHLCix|Z>mZV0c_z8bMg2vtM>e)ovavFg-o*gk89P|N1EN#YH!7eez8T7*!a zVuKJGk~9jTDT(xIWA=FyqHKN5sJ}ssJCQoKWHerMtB|##TZhnwq701~v=5;}2xCKd zH-wHMbPAylQ#%uT5W5h&61x$*6XX3aPI}7NQF)Wtn;4(@eM9IMLjMp3gfKFMQ6Zc+ zGX{n*D1^5|c#Ba{b~jEQ9Kw(ghJ`RZ1o?h4l=u!^NoxEXi&&0e7Kz3cDP72Dio(Z) zAjV?$9y5yaehA}27$36s_6ZcHl1~g_QV5en|Mwkriaq+%X!gI>O%GuPm6^8BSs~0O zmmNvAnt37258;at4u!BFgoPn&4`Bxl7KN}Xgw-J|4q-_MOGDNd5?MjZSeE3K5m_F> z3L38@%IuY}CWN&itP5d1EoB7bvvdPzxQv}tZzJtDg|In19b;x@v+lxZJ=F9bD&!!-LQgl|JQ62jM^f4}gHnRvFo|A*iWS>L{#A*(-Kw09Hb zw}yw~CG8de(p_2z{t$v8ghEzF73Z!MpmDqcl120|UFp;#L?eVKNqlvD7s4^wPju^D zHpfHwUKTWGx2SHe!@B{J35Kf11CWNygoRf)1(P{;QeE7=8 zlkkfnTngcK2zNrb9Kz2b+>-uhXI`;;{%Q!WWhcU;cwZK z!^j!NKeG9UkR^=NFcQL6^OK1}62nNcdAu`I!T^={s!t=&PRvToMwC0U^+Xc)!9s7CC1rNU6iOa3R9=&vyPDzP+C?$;_y@_HCm!YCI;`7kO_sYH}^RkZ6V9xB_ps*=&bdLf$C+?^sKgreQRrD04uf zacmJrON#BnXcb25FxrIC*3R``%Q$aOZ92!~cGl7#GI)Fm{BoGmHsgObla57)!&L z6vpH*W`r@5ex?wog)x;R?&tk5riZOH_`hDA6~^o^=7+H$j5%SU@ShDQ6iO)!j579L}9kM9O+MrKpZ#Oe#(+ zuOm}O2^|WfVp&>8N%B&}S8V-N5;JUhE2HBzTQ94l9Jv%BNfmTd)KN*de&*ECQCCN0 zUEVcgMXM02>!?a1N;Td3?JuN;j+#1ZQLjyu4v9~7`RPUdkX9?Kf3W0a1;I)*ShlsKID4sn={PuD48If79k zo^{G-9bvXKw@v)9ibZpSEQO7nWZPKw>{xV?3EmR~|t@X-Qn`f?9w(HoTW2cT? zI(F;W!=%(Q$yv)J3yS>*IzH6#5%rmLwQ#+1aJ?cZsh?7R=_hLye6wEJ%kJH$<8zYB zX(+d>=zDWh4(j-VmcPij>-bW~IUVP9e5K>CjvttGM90@UqB=|+-{|;Ohfjy9br3w5^}fahAN_ zMk{sVMrGSZPF>`j{DMY85OU8Zue_BUui*nK4|P1!@jH3zh&6&O zB1w;RJkilMf_4!+)$vSrzX(c2tjFj7(vcDY$e+uOSI+Ubj(>E#AWw)OiAka-lKfK9 zkxbI=W`c-WB1nxOPXu`*)&YQN5oC=ZTLhCUSoeEmk07&AhQ2E`N5uNHazv0G!MUpi zd_476l$;UdiXeC7-~JS(>?W&A^F>fJf?^Tmk02w00?b}0f|nvFNG>--iJ64L5xg8h zkqBy6`uASG_zRDAy+|k?v7S9wB4{$xx+O1@8B5SIZd~no32DMB5mXY(2wsh#G@Dk2 zSXPka*a?T2$^9PXA}CL#0#U?@5qvY(I&I+f2&zQTFoH%ARE?k-4eAlA6KhK)A1Bm^ zpeCcWh>|f^$#lUwjMkNEthKz=w^JLCL~kTCww0FBoCumS+AM;rHxinYzd`)@MnVhQ zQnA{ZCJc#5J=iC{tm6B(T(Gt<`N zcbkZT1ktB4@B75*M42-)BG!B8WERbeV0HxZj`%qdER0}L1aoDIzLzpDg830Fh(PWM zmms%@i;a-Q5iF5*MX(}*r4cNX3T#pi)Uh6~nA!|mnpw+1+mpI7f>jaRx|txMe)mKP zLe@sGE`lE;I326%QuAxZuS0!*5+S=r7CNNSKuU|5nK zK_mh*f>;EG?IB7c2k@3UYt`qw2>u?Ld?JFA5gcRE@d&<;;IQpY$SLaUOvexGCAl$4 zCV+e;I3wFs1iwY_KsK=m&PQ-9f?p!IK>ME}xG4IId{WA@yN*k;h}v5>sa}rYXW8XS zreC4iRdUfwpHBUJWY+5xB`Qyd{2IZH2yV)Jh~QEm$`;$Hfb#8^~#3@vh7q1|%%JY4uMo1Gx?B{lan>z8qgEB%gu&20BL3DT)jO z1q>WD;51OsKp_Kj49qp~l7Yeo+8gL#;AI0v3^X#(nDr@Y;8g>q4UF3CC}yCzflLD> zq|OFP85p_6no)uhN;2w9O?!nIg=9aHTE@U@2C5pUW}vKrat10hwY-4}1}YjDusB&B zn3}j36ZYcs9!e#{x;s~V3V)rJRfy|YP;~<}4Ae1D*Fa6f+DvL0sBKtpVUrp4efDG_ zl2@=Ea|v%?pgzMvdT3}sg6I-$VxXykb_Oo2PARk^vzdX`OnSpWa|11G4=q_GV~f(t zR)qJB|i)V>Eu}=L&MsS28u8 zcQwT|GJ^lHTu;7%C}wigqq$YtY+$E>T?V!o*eWaNa_Tk%+gU@IPM34!PZ^!ILndun zHX*yEyA13#u+P8;w2>x!Lh>Q;BjU%z&K0fiOP`8QMuk_F!=erBH*i>%`I#&d4jA~t zz#$nITd6T8;Y;$bh!Txk#>o)_U(2ju(v>+0-`csZY*kza+y*WgxNN|~5)A`U1FNbP z^cwIPPz`8yO~MBJuzv$%CmEWWxB;g`8vbJTYg9Y$E=| zq>Hk9Y*Qrqvwvj5vQe;W9MTwb&!29L>izmY@uQv=T!{mZ~} z5;+D?^uNjfA>QbeEFm$9q$ny!@p=@=QKUpsB#NR@Ac`zeq(_k>iqxpJezOtNqL|qr zJu9)R^gx63?9?4m>-pb|*4C54Vw^LId{N|&B3Bf-X>jmDQl2RCMp3d!hUAKMwahZ2 zC=f-VC|;tCJSQt+!6I%0)4p&AHG!N4(sMQB;ar zcm7Llr82JJ))$N_QPhf}b`(|Vq*@f!qu5=_>Yo}^Y7)h*D0QN!8%6UdT0~JViuzGB ziK40WZHvqXQ8XeE-cYiPPZ!eIRwUXiiZ|#=>My;ze48>Oi}f|EC9BjXindX-A{Vi> ze3G_Km#Ru=7sXFwQra^~o+FUTcVHJ)s#vsh6kVeDD~jh)bd9206nYeqD7s6Bi%k@> zqUae#uP8=EF*=IRqN#62(JzYr-!R#pJMDbx1A4M@Yig{6aQ!Q3TF+Yk0 zQ7npLF~=f)B=|z|C)<=IBuk}N=cdS8bW0s{WaTK3K@nsZWMe(WCaBI3Ah+?nI#tO;)E@}It z*hg{NcIERZ1jS(2Kbel?q6eveA?0>c4v|YzyR44GQh_KuQFxCF^J+=~>qQLY zMikK~ZbWf23R5x!2KgDq2VF3|^2%e#GmKe9Zz>HU9WyyRazZA8yTqcj_`uRV8u2R1i#V;h+qxe-e z*k(oJ-Ud8O&s!X~qWCR}2eLKM<__^L@gDI$QL+R(D-Uh{EQ&`q|DEIy;-AFFQ9Q9z zpOUQDp@@gX<(Yp=^<mkCHnEFdA9 zi7X~kO{7uDYU_2LCP}J1&Y#_cgJQaghGQ~vkc*zvgrF#5mfJ)g6M5-8AIp+by3S7) z%x|K@{A4M;fQf=83YmDxL}3#zQx}7{r5F@3QPh;@H?5-y`pi!*MnBz{SCkSaYM7{L zLNQU&L@5)mn5bZ)qKQ{clr~Y0_GO4=iFcnQykL~Xf39(Bk!x;iH6O6!hisYm>LhjpS?L*{B_ zqP2-eCK{V)Vxp;u<|bO0XlCLK8VC{Rt@{*}5U-~wEltSp3sK~!Ya0`7O>{QV#Y8(A zcOZ}7-Zs2(>g#> zLT?j&O!PI;&sO@In6p!nqybb066L8PQQkH&*u)kSTTKixG1SCV6Vpt*V`7+zcUcpu z(r^Sz;VOpG;AY_aw9tGxE8V;z*+k}SWY-!n1J#CRG{G%<-}f{8Yr ztsk>Br>9Idt)FaDs9#-beQF1GD({<^ZeqEK6*7fP%rr6I!~zquOw5*6n3zlZ))TDa zYou-@&&Q|tidYpMO5+U_H<@_yMZ!iC8z^q3C^o)b$~F_*O*l=s zOzbeRlSyBg*kxk3iBC;@W@3-jnfk{jJ|y{wc$MD7&%<4cT$KAnb^t1SP3$vqfHt2K z#b!Ur^FLGN0&n~s90z67$gmD!IAr2W6JMD)Y~pJZ-_SCCTKf?bf90^gp?yp7sO_!H zZsqDEN4b(|ZWA680TV$JUOQDY;j_7FqSpHk`8gv_{1pGmZ_WIW3Ef15O4!81car4s zYJ*YJM2sX#th`(K&crbj#~CeOHNEd{W#(>cEF^rgTRCasl!@WTFya_~F!7^_>ffQp zcQ|e0j4YxU+Qo3z#5vhIVt6$sceUYyiEJ@skKrd17fswVao@xx6PINU%c;dCekS>q zc*Vq3l5524#9w4DO35L{2l!mr4T?93x1{+!3rUdFJ5+Ymcibf@!iT?pGx4X1$FkT3 zXIKw9Jv8yi#P24i?8y3uY%)BPS-2!UVa69G5@L92;+c$yiRTpmF%fN@82vn5!r!tJ z)^`Zm!}>_Z#28XyKnzJSt5L~BAzN=avc#-%(}<}=iSGL>H7ohIw^JqRh#@_Oj2H^U zki*WKCx)Ccyzzgn}^?iJ>UN%-PVJ9azu937^=lkCx*H)RA*{!+onbgHOXt)O8ME2cqQw_ zP(OzFV|N7`IvT{#gfOqvkGL@^%fkPok)?Df9>3rvk+S`4#dm>t9WF-(tPCheEMZEf;1$b&<(zhD-5 z@z$Ie=2Dzb99JLnNW{45b;kmmx7^}b9K#YuH^s0thGj9Vj$us<%PFpmVO0#9t6_z# zi#`9=_Cfc=iSw;;{~uM~0WCH0fB)L$JzyUl9vvP5L_k2gh!p9)i8Mh$>0Jat5JWms z1w`q+_ue~7+s!7s+0Ax9X;KwM1(pBJXU*??|L4rP=gytad}cB;nN6~j%wn>O$te9Mlj^55O=GAEWhvBC*XdMi0HU;g*M*z4<+HBPK`;)oMR#mPD+ zwmPxRiScfuUC#aaomYZPF!~4 zgcB#7IOoK9Cr*h0bDeeKv=e98N_P7kUax#KD>+`u1t%_YFpDw&*_`%c_oTRCypiF;1` z=)_M>+_q~{eS^Z&`Ibb>Rj{sF@9-yPgEbxwe4fH=Nyp-%O z1plG`)v13w!R&OxEQ2;E2`(hM@N%cs4wFV$ev(|6B-LBHL4gZdTvk#x!BiL0T*&G| ztFG1vJh?&1eZXoo-VtYa!QsNgZRzPQj4PWq{F)=O!FmTjmkYUFDC@#2F640`uM0(8 zDCR;w7xIhG!Y&kuli7(GE@aziwM;=53c0`=O!DsA(~Ey#JtivR0{>qaRW7Z#3ng60 zbfJ_BB_;3E1GxQ~^{l(;$5s}_h0-pRaiP*irNwwIo zp#p7$GpV8rueorynq}5csxecrvKUkmTp&tS7pl2X-Gv%<-sEOhx$8D6wOx3_g{3Zh z>p~qD-gIGt%lec-T^HVRVSw;@F4TA7Jr{bq(7=U;B6fA*Z5JB3(AtGIqBM4)sSC}7 zH*ule{RH}HE>V(}LRtuZ`lj{Ibt@M}4YvNxVQA|@2Nyarml(7cjJ9?3ZJE|d_&Y9i z7BV0sk@oMp&_%+Tjn>D?7#4+7yNN+}K`K3j%#v#K68@p!`!0N7+w>OF$Av!^SWXx| z5~Z&T{cM~5LI&4#40K^ooVzgGg%K_cv2BLBFwEw|rNoggjCNs+h#&Jv?bJ_%m{RRe zg@5M4SUYu`kZoPFj<=ODKPPoQ6{_ar3+sO=SSFB;VCXmbz!y(U%4>N&NV~G zbXMSJs}~q%iZV-ZT0-I+AqxbVI#UD#od9t9rc+iDIE<``fN=}jCunR|AILclSSH$l&DJNVw>4MV* zmkXy{I87%m{J`UNS+{8y?9$J=aL$GE61}iVVW7i{5}jPbI>9fwa9N^P1i3+Hp3Mp$ zUR{+a4Xz2{!y;9P#|5toZWlD3t(z@xy6C>BHG>&0_*^jUynYt~pE&prRQ&ccAbKas z73SpcLV}7!6;T&rF8spAapAfPH(dDHh5IhtbYbLXMST@5RO|P>fwau2 zLwOnrX(;%%AbY2=iY9DB70pyMSK--d9f+|rnM-lV8AzybFKJ@nQc`ObZB#_ITG6&D z+No&IQdGRJ;sds@icTuJspu~L-%;_diY_WT3t<*)voe<6rjT@1t=mA79xCRaaP(wH zj7)!z9_nOIYLnSyoAptwUMhMB>8+xVioPoP(K8DwXbqT;*xJKW?mxDM%9Ub?{Z$N5 zF-VH$`jCNa;Weo>nkNuB253V*RK+kAdEChB#&8uQR9shaLj_OCkt)`ySkGFi7^UJ9 z6{A(mQ88Dwwssn$V!Vn8!ao%pD>zQ@GnF64bkOW`6%$37sbZ3lse)gqm@MQ=6;p)J z_@k>u7)ThVshF-}h9vFko0Wm$EQ!t*{7P`{HYIL9PsO(?zGKs=SfFB|q%Ibu!PhDl z2_M+Xs?`z|->6tBO8$X4;vSA3wTf7#VwLF2?Yt|5tYn*<$WDXR5?v#>Rxsxg%V+Q2 zX&Y3WRB=khM%CK4ag&P8Dz@-^QL&$+QN=bD;dzc-Dt5DdRP2!GP8BcaIS&4lux6V= zvPZ*u)hkU6ZJb z6O^4do}{XX6P;&}B!vXMDts#Z!VTNMsUjds&{pU$~7$s#<}jWi)y1!*78l3k(>!F0hKf;k0q3Fa1bj4P1Ojr?vjb)%UZ z1>DGRqoy0R+a|fZOtcrGQdEkxEm$hDC0(1H%hv}?b67`i1$?1w4rFtfkjBJy3zEigRCG*qr75a4JRX57Jk*!V|l?rZDbfbzJ zuerD#Y4uyy3=M zZq#$5j+={Y9rFe_-js@6dg7?-hI^aBLaVe(tM5hwH=2kaDh=geN!}LYMxr+s{O6!` z_zXODE^lZq;%YZqxY5#$R&KO*<5M@ry3xjswr+gnMqfADxpAmO@ps(l>_&S=lao8R z(b0`gRvn7BO->GGW^CD5{J1CoyKZ!GqqiG<-012?H#gpMqow_8;jidPNGa&?8Xu|zHwW}!tCDd%2GGJmDH#4mgK)tJCuzhQW@Qa6&Zk%%Cv>RvKaJiwf=(7dS3SM&KoEzuexFAvL-wV0u#-DjDGlm~{ z?l&mF=w&yqNa|HVr{J~!vHT-1+#-4fnOAc|7w)l@xLZS_K8|)N#guvmL=3tS5)yVJ zX6K5y5tTrn>vkyDMZY1)D8(Q76X3=zH*RwzD`~H3xZ}oMUf5{Jr{SI(KXV@D{NToY zHy%iF&)j(E#v`7{k5ZqC@>uW}H=gi}ZjgLNTK?e<2Uw`oM z-S|s%Mqdbd?nc#}R|Pq#>(@0xi;$HKb_Pgp;ZP8o0)u zJd1{r;-Thu*5zE9hS?Hbw^PX`xv~pptCLO-IV5{74Y@Vs6wWN&N?JoPkB0naW)<1# zY*7aCGna-}Gz|MPoe$_TG!)lRLPJ3fg)|h_{#%DuR7epGExd)|>&=R3IJ;9JFR9^Y zGrg1sMGDFkJXR-1v)bvUH4w{am{l=xTE#?SSq=O8ras-Nl+$o-mDOCYYACOvf`*D3 z<`*qVrQj~Bp&BmCT1i7?4OQ4*N?HvKHHEycp{kH-g4G3SaAQW+S{e@LwEpz0tzqEY zRFXF&wT^A`re^JXPQ9Ln`Wh~2xU8XphK8E;HSc*E-qz4aLq`prH2mz*L(ua+&;Uf)wHEi2u_0F|j%9CBnzTuxV4Z}5z&@e~?cZeR$ zB7~Iem@rfb#bH9ScTDi)NMw{@q=wNN#%TCh!zc}L{SytPIwtJwU_BnB&8L!UtnF>h zS61Hf8YXC%s$rUj&oylDXPKw;2;POwvHY@P&p)*Rzl?=}R$~!uCu{WOTZQ z-)lQM>{e!Lm?3Ok z3a)1hYgnS;8x2b}tkAGh!?zl~6Px9N%WRyz+ZvYf=qe4XHLT&eX{W~ZxB>Y((V1m~ zhK(9FY1ph`yM`SawrJQYsoMnS*G%r***X!3@m0z@HSCt8U4qnqxmRRms`Zz|J`MYM z;)s4g!$A$lS&iKaZ4Plbb#@%(DWKtqaJ8YO5Rch@Sndf8CpDZB<&5BIK{}!Tvl{*{ zdR}yj7c^WH{yhh)H zoGo=^({WwH4GqsU{Gs8dh95Z{X}GW9Ck?kW+|{gAptl9@2r|l5o#pmfI>S8?ujRu7 z4G)F?#&M|Ov4$raei4PnG@$XXwuh%0xE3+)VXxC##{au*`KN}zG$iXt(eYfv3(oEO ze`Wox;a?7E4gYAM2j;qeE1jO>&J)C};{a=e=_KKC9Xe7an#K0R>}mgFkX?sEM`0aB zbfoLZp(C%3d^&Q9O>R3^F5N1ZKJ$pe3dHM>Uq?aPrht$P!L19j7P9rYQdCDNQHtp( zuA_wTl7eg^9!sWhW{kItqNB8qGCInN{)*tu-PRKrhDVb!U)51wM+F@fb#&74j*i!K zYYf!VQCmkP9hG%d5rtw^9j^<&f5Q4ftfr&7L~H1%DdfA!>3Q}jmG)R8`3)U)bTre^ zT*sR_>gs5y<82*p>8K~hyeh7*qXCs>i44rra*v{ZYMqJi^hs-^qp^-Ay7dKYD!i&} zxX?NQn@ZmF9tB(IXsM&UZf)_B(;r>cF*&*)veuUn1#HZBma1*RR=Mk z*ip!)JxXUC@9OwO$7mg0bad4*K*vBG-E?$k={nxmvAhg=i2Zvy{u*voqbK`UF3zv+ zQ9jVoo2fcJ((%h4h1cF~`{(GRgH1t8hQ2!b>FCd~u~&J%I2#x5y|GuCXs^P`57IG2 z$51xrsD!~%3hya~=@_nKq>hh88DSUKVXspDgkx>*v{7u^dr92wXuP-@qvKN@lXZNl zgW^~n<8@3BK2FDH;)FHf#XRwI9g}o?A>u^#X@a#Q5|=CUlAh=umo!DkR7st!W15f| zI%cw$8zoQI@tu?yzha*ysl1YpuXg@QqH_c%?{du7u|UT`4-R>-P{-G7Y7e@2ut>*Z z9jA4i(Q)BG{v|p#>e!^?8y!n^e9I!l!x|mS*!VhDOLT=G>;KG^&ahIVt8`3kWvvG$ zA+8l%C%9ga;szbGC)uoHi;jId_UqWn;l0N3Nv-tDLmk_6Y}c`aX9rv3QX%KMth;pV z*0Go4e{4bC=J505%)Un)?j33ks`Go513F%LFZGy?RUc3!ZLN7&I|kdak(M2woil zi5fb5I{Z3JiSov+?^)|MaQZw)P`W$FTbp6llB9@^sE(g>+|m&f3FQ;g^s^< zJmG1j<9BwVj$d{3fps8HN#rvAHx8a3t=r7i{TzSj_*0xe=Xt7QTpnx0GSL3@%=E8Y zr*V}2BL**ZBzW*Ir@L>ge}T)tpLlPtQs%=Pi5`47+p#Mnu}ex`>M0(idXPquPli3n z;<2`-Vz@tF$?8Ei4{~^r(}V0Z$eHT!fKKj~_^+MQX|T__o6hAyZV&Q!kXH=oih<3- zKlDj*=$ZNGN6)OVPs#A0pa)ewsOCW-kJW&R2c_HI^ih5AYgDpv=GCe3RRVpc1 z!h;XyrsPbr&VrTs9L!b9V|78deG0LR2W36@a-UK`#8)KCtHR3(vL@v{*grRg^9Gj} zR`lRC4=PC(=BnaBWii{ePx)z|^125^>cr|E)bOCC2dzA)=|L?I8hFsqgW4Xv;Xz#w z-tvGi7u50KO%Fc*xHuoS@CgiGjxhJ6SFMVAQj=xdiq{vCd%wc^zwJRI51Nb8*n=h> zG!xFgZt4NMIK6Y$D*KhTNu_#E*%uY<~}Wi}ImhA3L?l6Mg`^z=Hh>v9E~zJm@cEfZ#SsV(MTIhI=r= zgCU|16{J2)$kqMINDn?1{+Zw?4?Y$0iQs4t#&~dByb;q6SS5~?q;Z0!4=Ce>Oc4BB zkTyLIC|`Im*@NXCtYD{mFvWwfJeb2qdzi@wyi=vErg<=(qhgI?Uw6k04`zBW%Y)ex zC^B#}dIl1<;atx49(*ks=Xo%CmNH-X0uOfgO5TvovB-nP9=uqY-fT?z5|(?{vDAZa zg?z(dpEr@pcM@GDI9rrBu4IFo>C+AH@9|)- z5N*2NB`aqaMUOxbDFXQGT-Z zn;!gV^XD}kw}jIhvoPHC;Hd|{aX$3mXA$oUJ{Ei+_>jK>LSD!rKN0?m2fqq={>*x( zzF$)M?;bo8o`E9*GoCpp+s1)*|uop$VDC$KeFDiRc%xnD^mG$BkFN%9nLZT(TDCLFX zMW#e)Fy`yj(!$HwO6-)Ck?%DV2RW0nrVn*}c*~1= zUX1o)j2HF2Xy8SAFFJVfQphkbh6@?tg}Kdow~^u1G3g(RI7;vn!Rk`sPrVq+gEH{0fpK1Z z=EW~w{OZMcFD7`g(2K9V_?%YzhPmqV65Uz7!cDGMD_?G9z)$A!~5vOw6&$ zi_?b`Zjimki?v>?lL5)3_3^QKNSS}tx)RGb`Fjz5H}#-oXRd~0l9LWw zwK^;cZ>fqMR(dQrbq^~S zytv3Byoh-5y%#@7F25I-ytwRz+Y8N$DiAW`QSTVf_co7sOWb1s7lBs+{GwMZ5#0Oqn=ltNs zEiZ11a?^{SZ2KR*)>E46Qwo&aYaQ1eFYbErvz>a6)8=MtQfk@8x;wis`lV$Sf9S;{ zi9VHTKNkLkGwKoL)g#JNFMi`(XP}gU-@SN7KL$4n$FWesKfHM9MS_7p*;yPL)$yD^ z$9=Q^EgoL5>+@UDf4umYXKwEt$p%skz(7_5*$iYckZK^! zux<}$9#K{vQO+Gv%p=NbC1XOqQVl;#UHDM~@lmhDbOSjI6gDunOLm5w2J#rlE74pA ze036Y3-{DX%x56KfkL)r0U-qqWZ25gg#7ei)Je>eJ&~k{=tT__6H?qjN!zl7kdIXd z&FEP%P};zo2I?9pW8m2lrM!U(2Fetd;n=oH^F zP|rY91Iddh6dgiPO-6pM#6hYC7T#vpw1{)z&1C~PNFRgv^3DlKx+eS z4a_^LwD})olv$`Sv^UT}vUC*eBpCmq#XAP}iDef9T@CzW;9mpX40Jc}y@4ML^f2(A zfprGf8|Z1Emw_(~Og8Yofe#FfFfh_UZv%Y{3@|W|o(+6tz&|3TpMkzKuAffMmyxd> zRro?Td4Fb6th>=c1_m1#W?;C1AyTFLN0p%lF22ZQ&B=+JBA&8x$O!D&1|dS(UY7}n)? zfn&;iF<5BeYXb{}voej3DJR~vx{~%ZUSi-I1IrDpFtF6Xw`_{u>C43UJ3&rXG+y7! zdWKNkbgVS6N^I5`VANkAakZE+m9Ksi*RpN*~wh=D@} zI##s~>aZw%t6RC=Z;^16lahhj_WQg%mJ>AD1Gfy^HgLtjRRb{t*9}}V;4}~-c208{Pz`ttzW)NZ zc-93q!4t=yjn=aV0GNBZAbU2KYe$ zmUu(P;o9#U{%uzDreyq4#Giy`YwDp*-Iu_myrSgu zfg+U*7U#pOK9u*NkPn4@DB(j%ABu?EqJr@~or?))iN%FHdM`QChf+SgB2h)KjBQg| zNTbZ;vO*5Wk_vyDQO*|Wu!0X2eW+#Izve?_AF4>Sk|1}Ee%*(v!fOat^P#$s|JyB^ zD=2D;Lc&m6IBWQZkUD~C6%*g`p`H)L{V3r_eIFY5u-b<;J~Z^f@cO?+tTLq{Jv`OwUV=03C$eRn78mAV$fTl&z-hl>vqa@}#bizc?F&w7sUA0)Ju z)OJ3!XGVFEkXbtT@M*C`l6NGvn;_pu>+Hk3!kN@XNLRtUZ#lZ#`t#P=-V@%_hh9S7 z=W*GoANbH)IF~T>@mY(qK09u`EBBEPeSPTX!)z&+w~bs2I?#tfK1}psk`IG@7~;bi zR?LT?;$fuibC?gqZ9ak{?e2d&qkZhdC?7uY!6QCd%4nbU-Y5yfSjjR@km6@T#@l`- z`0zPfet=cCZJ#J#_%PXrMLsO{;Y+cZ;loTJQ+$|e=b9#Dy5P6Rm07kv&xdWtmDxUg z<-;8I)JtoVK8CqskTR$Ed>N^uxvHB(ue!Ul~q1uoUjgLtq<#b2>TH6VZ9Fi_X>Ih`E~=% z4B;frPbfThc1R1GJ_Kw%=tD?&HEExy4>2Ep^Wk?Nu5;#;q{lwo^x;Pz9!c~kA8xVT zY!A16xa-3`AHHksxFa|yCw{h5?{oarb?_bG2ck@fx86dlXWN{y=7A@o|6<$!>cdl; zPkfN@j4i{d+mCF1{Aue6e*ERbb01##kTA@Vz+Jd zlKe>aTP2$NkVQy}9}q%u-w7pEcT>} zKlsvdK@sx_77)zu$2A#a8MghXM+t@eC@l6x{3s@bd5a2(zr0Ld(vM6(I{W#A1f~4e z&(N!Wloz6~VnQgE@uRHGUlCGHu+@k}USU@7qlOUS7tNGD*yS3eLb-#6qOESA&S}o4%el+ldytW^2_)*7?Hzit6ka}G|-m-ZpF>Ozu zM2Zdlc-xPrel+u=>iEP)`6g>y63Ha2PNw{~u&5)ZWOaXg`eA05S@li)joG+-)?yZEv1m9$}g4ELj}AKm=u z?zfiK_hCZ`>EXwFe)JUH%a0F)yf1kENkZ$TN!GG+Rz}E2qEqQ7q^}?O&SYV1KF5|E_^F7DR>+smC*}?D;U-$%#9BYr@mz=?GlKPgu5m)qAc_UC(T`1j zs3zPdHv6%~kMn+9pxd0OTm3jDWSbw`{n#OVzaUe0`msy+Zd=(SWG@Gaka29QoT&$d zSDcr2(2qm5aBYpA~(+tTzS@c*ZV{rK6B`+h|Hi24!ph0%Bg9{BOtk0*XSwDm{q7pdDXe*7xpUxH8l_}!0Z!hiE)T0^*oWTnGD zIRA@h`lQG}@?6Yb2*wZpU*UyK6fyDAj|3BmCX!5KGm+i2vLu^)Olpx76A+R`FjX*K zrJ@fVS^p>MFp+K|uZesna+t{ZKS{YvxIL&bSf6R(ItF_SmHmRLei5iBW~DOk$Hn`emtVqMC`WCc2rZZlZ>XwkFz{sA-~>$(JDVH#bq+ z#2Y3Wm}qFCj)^x-yk(-EiMpn>sXfE75*ftdnHf~-ORnQrlH%gqV$;Y(V>_vdC{0Z? z6H;w(L6#CX<}XeQ6D>`&5+|+2V9@m>2KsL!(eJt!pnZE2@0jRpqJxMX1!>cX1#P#g zM6-=Ze%D0Ya~Hd~?k0Me7%2AdndoVvAKSr1FHt@)(c9$Tk=D;84}^Xg`k460=CouI z#l9xuwMw02+4L8K0fIa(7Cp$sV2QG}REC-uW@5N$y?i=KaD?DULF<}LNZq$AgHMEy zHZev>q?RR)Gp$?HuT0D_@tKM7CMKBpT*T=nCJLEs;!6{ggnuCz-)Ec|rv@(*(ndih z?KU%T%Ce!i&Ej*5AeU%vH?hOSNfW0`>@=~|=+XQucC~ol;1MJQ3o! z-xd#=IAr3mi6bVCvNCLh8tF8q0gaEFI3eW!vVSg4PK$Wn#04Q|Oq?}wPWb#&3Ip?A zH1WNOD<-a*);HOHFmXu;`M9nH7%rP2GJ4H~lXHa$Dl{X;N!&&=p|c|bSQdcCgqLF= zfJp%uCVVC;1yDHvzX{VsMgRo^2$%?(NC+S?fRKr>iAN?Ln~0c*nz+reR5qdb<DdC)23m4H;Jh~iOns+5^Clh6L(GAld*c=!~+g{;T?Nh z_7B;HPZRh_s5q_}p8bi5UrhXE;yKMsJT>vViDxE8mQBc68^4)Iu8pmiQV(8EO{$H_ zv7|pt{3)eB>g;IYvwXfV@wW;3{Fl?(n$&;T*H5jNE{POhiWo03DS+ev(gMgD0JHND zQUX8#e_TpsG)n-xPbs&(si^_$6ywOr7C`m@_qI;WBj^Yqrw}UXLUIVYPAR#B1jtrEcN0kjODm53YrB~%TdS^(7ps1ZPe02&71>{5Uqi>?_!tpI8V@J0aj1J=N( z6Tq7RycIw_DTqbX4S>jS_muUGbQT>i_v3L2?cWwxO#_$_OQO$40W_A5Aa5c`OSou6 zNb>+%1aPXBRdgI%2hb*f59vREwgI#Ypi2NPbd-l2GB2n zApr~xpnm`ZB=u~T#DTUMGY%3ySddX>92UUv06t|wa`+ahj{h2x;fX_u=|Ew^h{3H8|0KN`j-ruQ{1Nbt4 zDFI9kV1B^bZf05l(}jG+))PYU;)IA`lW z2st0X1tAx0{rdpas@7H-43`49Z0lD7sIxvZu9xT500FopN#zVL#4V@=pmYAWb9seu ztq3y~Y@g}lPe1^sof;Gp5UjY^Dl`js_45;29^z0ImmcLu?)k-VETbkRJtq z61*kIjJJi{5$tqYxfj6C!tV<<+?z<72LU{k=p#WYJhUe=82Ht`U)bgWJeBBg0Wkc| z)8w@ETWN&`Rz3d=;AH>_LHuQVcpktD;eQMMBlxeKnlip%V$eFS96{s^A}NSuiKYaR z7DUz{Aki#>seOTS3$d zLJ6XD5M_cW8^r5DRF%|Mf~X*bmgR)JDp)><>T|69rx+@V@>&p;Y|F|)RIz#2E9up2 z{)Uk1LDUdZ)7EPRQCs+;)0WRVw*F=ib!|Q?pLOon4_X_pO$nkw5DkNPJBUU>bPu9O z5RHRqBB`B%Xc|PbAlgf`c@QmvXd49gOm7(kcL{G5MC%}a$_{QCUM(%TjqqE4S=)7$ zyOGh34&6x<8SNn0QIJvY@byj*ohACNVAmjiZ-Fj?G+^i^IyZ2CFNmH&d>F(>LG-dc zd?4igptT=a+`hLceFQ1?4WeHV!-5zdME@WL1TomoJ5b0VLDrD_i*YZrAwdic{kvUR5JwY7o$H8Al3!3K8Tq? z%#z|(1u>hw5X9mjmIN^;h`FLK2;!zE=~^Dl3u1l{kG6sQz|@Sw4U-oJ@wM12;%IMZ zZChVzh_wyhH$f~FePs~e2Ju}GD6~t~K zpGtB2gfsP!ko`d%5HfL6!Gl7$Pd!r)2XVx7 z$dw?j+RC=J*_fBn-~3sOHrd=kXhHnQTtVnTc!CHA5eZuNQ(m6+w;g`rMi4$B)GriG zFj+}{P$h_95TPJmo>my*b8MVM#h}O;CB`A~X4>^2ZUn8ryvuja&Tx~J>71SVEivP> z{o6t8&&29dfu56REcAom5?G7o}yDEyJ&V_Prjb^OW`?L)^OLHtRP zZvhDYCipuCd8pts;mbn>{|e%H5II7~8N!}NnJ(+Q5JI95@+2X&NeKbMvxJZ}glr+CN;FN7d1=g$U83nBID}A%Cvm&CTp{ERpmgJPp+E>3Ayf#VVh9C8C=`McLg|pT?5%JJE%&2%2p_+b zwMYm>MJy)xUBg5gl;BT52$`ZVS}KGq1uQ*|WkM($0^g{L8^035t062nqm;AlX;xnN z#$Hyg*Fu=zFtJhym4#5LBB?Z^lU-*ND%C=$9zsLWYlKiUg!;m3g|PI4#>9fDGmSM2C#vwEbp+g8A#kgq*twLxmyqRG05L(!N zTH3X3V=HY#*dRyLP7c4ltLwU5R!P>?+tzkoDo#5;S{{ohu5P zqGt%b?9}&#d=Nr!A$@H9jiv>e_oEQ{+6qe_5W+wnbqLEs7!<!v#l#Fj9_%PU!Yho3u|t7!$&$k~%sBF0`Z0Pve;&fb z5axt1H-t$cd=bLb5T=DNIfO5z4W~$!&W|1RKS0SKl1~@$E5R8d#QSJw2(xVev+YsG zvSz56^XMvsC6cJGuZf;$Cwg|J%)J?s$@A1(Vr*dM|HQ4R_ovQy&*tO>I)#1G-Pq@E7p zgb-Hmq%`9xyI;Q7{ZW1WyQ0L-;KOZwN*RH$u1>f-eMrh~Jya5(~i$As{>)LQqIZ zuzME=4H(8xN{_Hd?po0(oktV6-uwFhSpF!SsXvGC69@L9>ea34ncc^twMTk*V+jm7;c9qNXc)%ZVN?v`wJ_ccqe+LfN?}yyafMMcj4ENg9!9k=s)zAibL)q)YS_ZZi>x0| zzHY|V%hMkwF)&&yjM`zmAqE%9SZ{3A38Pp4WG236)EC0f z>?G8*JU0qs{^yQtXO%(w(;J7a#f0Z-=b+LwjAmgp52HmGM%A=;!)O_{K6l(MjP_x) z3Zr!xZA57+$fUYMvJ&Sy9mEb{yc0&}Fgk|ODUA2aT5rrzpZ;4W@xrr&jl-?w&0Is< zC2XzF>?+88Z`rCn!k8S!mtnjYMo%6Qvxm_yjQ(MK5JvAXR*X)+)jq8c4>7WRywN;2xB07oHYz%5SuGk>aZ{-^{}=$87%EEL~tmp zde&;;0s|}@8OFz9j1S{RscihKYg8Dc!x$6BCt^&4S34(s8pdGBGET@?Ns23zrRLsyf8l&hWjg^(p3Gbv69V`>8pwT|uIC;R#^jvlavQ?rSQ8^hRtR@r3Nki%?i7~8_QAI5_)wuiBUBZ^Jb z$2zo~VH{_YwB#zt~VG=n5Eg4RP zaWafkVVn*_<>bua9md%(E`@QKhqf^FTo@OHke?TFLGZxOso&fB4?_4YQ`%e+el3iv zLJTvVB7>9Dkto)VX$w;|;Uv0{riQ~K#4E@PekS?C@P}bar~eqnPhkYY2(s5ii3zf& z!eK;&M+HltvzA0&w^MHjxf#Z~Bi4z-aEr5zoq9WrJGKFn?%Dd!9B=2XS&l9CkWH5} zH6?;aVLT4w2}k}Psegp=XBfW-|22%KVf-eXNzcOgU3iwp|E+%;`Y7SAFrJH;6v2xy z{^rae>xgLokLWK2|K+Hg`CqPt2ofV!Sxx5_CngIo-N)Lq01;$~AT@%t2=YddFM_NQ zYx%k(f^;F-1hYrbcTNWN91-LcB~JvoBFHUzv3r>`U@AkKOfbZG{s;<3P$Yr^5oCx# z!3YXPK;yVgJXcXkin}c)ytrTq!2wIs>8(@*N(2XDI2c3e2+Bm@iNYI2*$7^VAQVA3 zf^reO8o{&(rbkddf(j8dj-W{d6(e{pf;S_m8?kPYDhXDNpt2AuRfN3GW~pl#REwZ` z1T{o_!?vjzK`r4O$|Tli5t#*PSx1z5<*aqZZwcovZ1v-!;I6Le4TR93VFYj6yio*q zVU^W1f@Tp6j9^d%%_C?LLAMCHi&@JE+6ieTcrJ^hHQOzMwh@qTjU_OUw2z=e1Rceu zvtTDdI)5jESRd;XBJW1fC4#P^e_AGy3d7cG89gF+k3DGH_Y~4Qf?h)2xAhMqICa|k zct{^nKD70Zgbe&SwVx1Hrhfzj?CLQ(ID#P&d>X;n2!@Ky$AZHIhYQl}hzLg7d}>Fl zpivQgBFbo69}~fnQdXNYjEms22*%s}MP)(+Ux?-Bw*5pQlLVWcv)+1}9Kn|nOc5nZ z$;7Eb8dR|QZbk$%BltFg?;@BL`R|%!o{-ssUkT2MV6L6|h&81%tc_rm@YRBA1o;6~CavQV zAc^vQb}9^;BG??k;RudIuqA@65$uatA4H|`wg`67xJf#Hv$jXDgU1`Owkl>46>e3$ zn?s_9vPW>Q;N&wIRJgy-ex7R)kQ@{|B*+JzRE|b)ECT1)bdS{Jcmx+C_&$OY5uD^W ziQqH`Km_L_I1@qtOOCT*mOdhtoPp$mD6B@DQ2Zf+OY|9mD}u`rXt&d@L~vEe(BjG0 zY(kwO@5rob1a1*E!MMS=;>k?aIggFZnscD_l~iv8Mg+bH$o+zW2uvZRXJ(}s6i%|b zcWNYpD4REm4N=4*xP37D%Lo#pxE{fc2yRC3V+4Oi@H~Q_BDfX7?-4ws8CxcTClS2g zAn|Sl_aa!+G2277a|HJzcpy^X&mZCL1Ku@};w{M^Ui5&R?kUsmadLjH=@ zRbOHhNl}cBVoVgtQKUriW)yX!KonV`D8nfQU5;qE-~IPj%FY;^7pB_9CHn6mN)`|3yL_AqcyC>ll4L_%Z9%Qied)nVk%K_?{fBWfN+ z>nPep(ISeLQLy!>w-S36!GhXG(JqRPQFMxe)nID-C^|%~ITNJ&dzbpeWdrz>3cwl!>?la64+b=q^U_*rNL3K-G)RlRD4ooFS8T|9?pm;Mn*9zicg~W zSe&!v&yG!ApOC@g80e5ul24-;8^yvXKQNAQQG6D~v?!)Wtu;vFqnIRQg5c+Z69sv# zMT0M*m>k8IqA)r|Na7hQ@6;$JoKr{`W{5sFikVT&5^>Etg>@4 z%CJVFYok~vB=koCX5SdarYH_XaWIO_Je8u@$15Tu|JEpu?#@rLD~fHRY!{@mL&(l3 zZZ#;*=vPMm-BIijaj$LjP{DrTPdZyRhoU$f#rY^ML~(?kIUb@oO+HXOzz(pxQPXXNIVCA5B+f|4h(Dr!k`jhg=lfW7e;#KMIqlK+e=fF$AIr z@_dY;Q4FCd!aU2OcpgP0if9y1qWFdLKhNUKy!`m&L(czE+=$|46hE?q7N*{f;wK^G zx7m_5|Lf08DtDr&li#{exfca@!ur`xy&uH`n|D61Y-s0r#2=b=j>m#8Gx2NGx*B{M z#c!N3j;0PhZ*A4_JL}BXBrB&qlVhavhmb#cXlt`F`XY+IIZ?-uOAhlNPW3S)$M7$w zWhL#UAW1^ZiYCVJ<#}r_zmymdLk=E(v$QNRq{fgQvzGnrUzeU1L$(;Qi?^&X@XL^_ z0MQWx!~aDo?mn-W=dJtq+%e>dp;8Q$W5~;bVkjO%i5T+7P#}gPF{^hNGGZuX^MWzl zkpnC&%8+T+mr05WFJ{}kT`#j_44J&zkD-jzC))+3O)4F_e#?LJVDaKKiV%=z_w)dJ-9BDs33ZS!k6QYQ#`8hSy`L8pDMQYr~XkF&G1t z>Qa*<7nBNrIcmjFJBGJns29T#SqzN%ti`JJ4y2Q{mhL2+C8$&m?>V)(@Y_T$F-DBtx!+SCGjN$g( zEFTE=is5}B|6IsQk>TI^S$m7pShJ!ZvXSRm&wP4ZRQkoxKgKmM7#_p&-i`q=3>Gp_ zaF8JNkrx%>kQj#A%BqXX2&wkRF)sVTNRFR%nVZUjAx=JtVRQ^*#D?PfvQ`5gyr_(e z;jkd|b# z>=d#q_Wzi=4lt>y@4L%#*j;uOkhXMKhTeOxBE9#Hfb=F^Kok*>DuRk2SSZpFDI#5} z^xpeUrX`bUnWZD>|Ktw&{r$f8o$uUp@4I#e zX*lA*Q3v*=VL!(K2a+8)kcNXCK+^Ca4TsWjI1R_sa3T$VvTu~L9T6ls=E`tX_%Tc2 zgD%uhrr}Z=E{ph=;Hfm6PQw}DXVY*&$T`9Df(cKOSdryo)FqF&T;ZWA=G8P@6LMWJ zx|AEj`6Lo+-4cFV@D6_kgxnLPcS>IKL6nDS@UWkY_=pFu<#h;A1f7B|_6i|0Pni?% zsAoxYkvY!-COAo@g3k@<%=N zk3up}F$aoUIZHTDQus&BQs`nS<3M>)$~w?|f%(E+IS2Ue8%YHRDmqZfVZKgV*~&1M zF9JJI)q!fFv@Br0OUv@jDYI@(2bwz2%z;`C)OMhbRjZK$b%paSym}7Q7v8{uhC;TV zvM0ATueq@_7Uf+BnmDjyM{cggd!mpxcc6s>JsjvMN=pY?JJ7~~R${U)KLFZRco%7N zI|tf}*+H86*mm4-qn0@X{%J&K$97_Sj(#40rIQ0CPK! z5*#T=^T`JViKE4Qv?+BgN0Oz9^M~7aIxvo+0}~vW=rAWf-Qd6^2PQkP$bl~%_{d@Y zUH`;^PaT-zz*GmOF?d{|>1@@(OdkuXr{4Y+^B>d<2d~4&f9}962R;+;Ou?L|&6wE^ z%yD3z1M?mDLdsmhHX93NDq-Hrxwy)_TE4)6g>1m{n3|{UoH~GoBAc<;ffa0zH0dkB zC2X^huLT+NjRW5bUuG%aIj~$f@0>DVrNev#;ui;QrsP>A{0G4w1?l=p$j^eS1=k3! z6G4s3JaR|lql^mhAf7o9UjaBhJI z1yVQ*=ne<+kGCCaf?W>mcHno1`HOi#kYtaLKe$98`z(FG12ayW|0fTMa>&vTJMgFQ z*-c{UJ?6l19wQ3sDLCQ4Ne3bhq&x7J1E(Btv2FPhPCIbMfm;sTcHpc7=eSu!r|Y}} zR~+W&0xyViQSg%Gz06;wUgmUFS0#pF*BrPm{D!5hv6}(BFndR8)$_*ObKtI(Az#th z`@$bM@X&!r!X1KXg8sth6+%V0Q;_Duy(w-7JPwSNS*pAasN&LOzzhoaIiL&i3-Wtd z0f+g8ELIP3n`E+u1xXACw#&8L#|}K<9{e#6PgR~uZ;4S5tKgXf&&7PP$?fL9K4*Y9Ha@L3p3gQ%`Dk!QTqXH<%ry#$AObX%^WL1z&L4pEDYG#%s zA&G*S6*SzMi=s_IvM5>pgLJ(kW-bM}6=YYCLqX2}1ROtYXWbM9c|^>s;K+V#^5-I+ z*l#YbeF_SQtB@d-f(j^-uoPBMMD#AA*cB90P*s%T3Q8y_r=Yxok_t*GC~alv*~`Y# zAqB)TB9>LKy0h65mI?|gi&#;xl3=Okg`(anVzO>E1=SVQP*77rZ4qytw%4+}3}%z+ zh)K@)`U)B-IL=PaEvA^~Q_U1KSIhybk%GoT$lq1aMEHAxO$9l91YIo@v{W!y!4L(l z6tq^*Q$a5UZ4|VXur7k_1Um}0SI|KSKjgs-ES<#c%)Kc&yNcOOL3bfN{u3On(py1a z1^qjx3cgn`T)_wh^AyZi zFjB!N1ydAERWMq?7zN`MOi;|JX+BgiR>3%S!t>}XbDQ`NnABTt1>SP6z z6mw1+>PH>PuO1|SBn#C}+ovh`SixKc|D3i@XMb*y`iX)@=S}kNd3-7g`3xbSDVS*~ zpDUOpe74{mOaDR$2VTy#Qu>U2fr5n!zE!YH0q5>sB>0u!mx7DglP}olTB2a7fJgAS1RUPbz2l{Rj`U1gj-(0PYTv6c-cJR zXLeTwYZRu`B4U*eVkKpUcm(g7ZsEVXSkx^lGP6{E8ruD%od&a zkq;YORm?{Yt|_P^&mQn$(VGg^&9U*&zNO%{f;&?8zJdn|?kc#afSef;`^A$G$ypwX z_{ef83Y^?o3jCtDc(6Q3?msiht-vEnk(LQw1uA*gcuj#%2tUwiX3H8+5>OE28c8s} zoe@$H;rPI<^mC!G0)zV{L$0~EQi+f0dX)ExM6&wbGv?bjoXhJO^RF^@B_D))so)g{ zB`0b*@wbB43JN+=$cZ;R7C4eSkRiYJ8LJ&A_`6Ncbv%XL@pvTzQ>n*e79ZgDiQR_*%w|e4^)fqJR_q&YJ&Eu9Z$$pOW~+S$kn8 ziaKF;q6k-ESPqs{A-ig4C`Peco>ESfmg>d1?yqu|aAN&gdr46^TW=XB$~sZOiHc5? z6S2G?PYk(~OfWyAS;>jYPE>WGnz-&)&QisR6KCxXY01;G_Uca5aAM+Mb4bj1&c6JZ zdC{Y`6aU(ZHgV#;sTt}xF??!rT_@@}QQwLCLv4)(8*ojXXe68%C5xseyekUBZp^d2 z=R{K{n#rP@Gv^62d5Lr8Mrh$go9}I%`X{y~apJLxCo0-H(awouZX9=`y%Qar_|=8& zE_8IF6Bp+~BNsY5(ZvbFiHH+jo#^JoY$xV8(cOt2PJHOZShn+dOiw2UI5E(PUQYCO z;^@HSK29|5Z|l!g=j?sCFNC}=NQF&eDbqg72TlxfVzkqo<7KeZJog+fI7E=vs_Y0cM>;V|2w#n%$ZTU|#Ze{0I48zCF+;o)th&><*@aJXVzQ8roR}hnkAL&f zo+_M#**64gHy9z6^GO!!Pe27m6vEQ>SX3n%6}%}*$*PRw&+z7u~sam0xQ zPAqg{lM|brSmeZ)(%RKdEOz26CssJ|y%S5ESn9+wadC~lcH$c+zU7+UOr<$qwp-k5 zb7jACV!6|NdXo=dRm~H>W=rx)CssM}v(){;i64dh#9ekfQ}<^nEF`W$=G1V(7iN!L zvt#iFv&Ul(|yVON(CQy+v~(Wu47lTqi&d& zM1}beIB}2zjuVGvaa5|=GV)tdBuCj@ow(t|O(#MXY{#8A>%=)8VoscN;?_C)UrwBn zHk@+ev=f2<^|V8_A6uKfjz7oeow(@4C8v41bU~0GXt>Oc>BKcBu1oc+f(<$K{i(cp z&zluF&p-b^)J@IBa*GF@6AzpqzwN{wC+-Tr=R~IQ=D!!}+|M{>)0s-H64+gM%<4`&<@V%Y?!r4RJa^)S6B%8A3on^dI`D4; z64;;rcH$q79!|Wrdi5KoI&U6jEHN%*aGA$xtl;qJ<{`-vC+70=_Dn9syO8WMZ*8z7 z2+1s%C|JF!=}HoAb75rXJT$Y2nN^UcFDW*=3q8wZ$l*dx7xoP@8KgWXRaQTGfioz>dN@W-L=|;M$ic(Fmy5+6mGXK)k zTg!#oF4Pgdp6l(WOY2&sz6%Y+75ywJv9Sy9x-j2`1uisk;XM~VbYZLuOxnwVn;E1xzLF}0WNg0yxoO# z73?NB+@7n4ke-69d-A-!x9~oKeJ#D8ke4ORlivX@40U0cC<6sQaAA;;!Gc2s8Ts_Q zeYnL(2;l=rBQ0f=3!^PQM#xXAVJOE=;y+x#AP1x-iX! z*_QIL3o|S}UC1YbpSn=_Tk~A|Gcjihel9pmkgkRE?Q?{GVJUN6m}l{($CDSju*ij< zU0ChHm#()X?RP>J3x4Io5*L=b@U`V#=E65Fd@CmZ!A2)yjXu4@@nN|OD_r>Ag_TzP zk1nhd{)1qX`fr!=lMA`(gC-B9H7;xtFZo(Ia@V==iwgziTKakyHi$^?Mj`uV$8Was zZ*gI(#kUFRRRO=bu!CL2jV^BNbYU0utnp3U*zLmaE=1VXUD)HoA1*jtP+Zu{gW83Q zE?nYa`;%?I3&&kJ;lcqI4!Us2g~OsBb>UATj5)&P$|NvRq;kylcE+2NE^tcW(=MEG z;V+gzw6appYZ7Wx~P@!RQP^k6n1;LaZAZ+<3~a)flhE`;0#U zF1!#Pe+Pf_S3vkHL2fiIE}G$uDE|olD;VQ8y?;ndoEsTwx{==vh@M$6lN<3uxU&+3 zuu7u)?fyz~!{$b^8(G}Q=|(O$vbvGYjqGmZaAR7dEbq9%!Ybs%D34-pH&Wcl<3?U9 z=D*%3FW^Q&H_EtC){R1LZ0Z|d)D63k!h%KINEO09KyNWwRtYys3Mp=7=Aui9Qu;p% zn^ew?@@~|2qmCOD+^Fa_J6J6@D!EZvcuhCPH%1lV>}*wqFk3arR$Z`$AiXTC9_^EL z-KghABXQN2S`FN2$i@99hM5`P*o}8Zr;E*F^7q_m>P9m+n!C}Ft1rLHE!=1;yrrAx z#kN+$TMM=k+%ndDk({L+&jLgt?;wQ#W;$A zqn8`Q-5B9UZ;2lu*hjFhm7$-I_XYb4zK$$ZQ`8nc_At@6(*-#>b*e z7n~{hi5s5^nIZU@;HVtA7|-?!{2EjU1K4$gIBo*Nt7*yzT5Hx{_D(v4MaER-15 zS|(%>cd;9b-S|q(uLYL~E)}dX_wE0#Z`}A+6xNM?zT`VGmvbG3d~bQ9(+>O~=4v;7 zbmJ%CKfBRa?)otUZ~v_kajhHcg#6;h`pDaN@Yi!k%UW#WHhdocyBmAl*eraD8(Vo4 z3*W(^-i=>{Z+DwF;28Xy8+;puBsx1N$u0@lEto4s?gzPXmBNXoMQ3dG>aQ& zIG%Wr!-KPKoO9!u8_y-fc{da{oNiojz<194q( zdIeQMjbn?F$S~avzbFAW3?USQZiL);`EE=tTaK_B#Awcl8|iL5cH@Z@icj6BvdzrH zvZl3pit&Quwg;I!cic`D?2_Ey|lXnCYJxCTpC9{wuL7NA4ubQ8c$|7b~D<+$eALKQMe4A`J zJ;>$3QV+iNAh!o89yIabJ;r#D*Mo8%l=mQ?2l+j)dr-_{{^2R$L8=Eug%|XokOzf5 z*f=jPdO5m?2MsQmr*)B)MTq2sF4*tqjw|j#DGy3}P{M;#4GWc&>UlDnmq}@6Di>Qu z6q;p)EVy8=;6X(XYI{(}gGwG$_Mo~4H9W9A%2UO|=PL8u>{GO=nAJSkBp1WEP-d&1 zKcS{1sm1M|l){`N2gTJD-cXuaPrUVIMatO=HSoakXDaJv&Y#f8gT@}b>%p?7Z!fU( z+Iv$Ent3qPgJB*t_n-xr?m=e{T6*4|i?#KjmBm|o&_?*mVhPc6qIMp%x4a#MbQIi^ zKcr!GryY zp9`PKZ8*g|du`tI?KYg_!8{MRQeRj(=Xwx*V~An%MPxIU9!Xy4!6Fa7^k6X;D*6&Z zx01olg4A5j(WZezieJx`)ax7JB zG`C2GZ65sU!B*kX$n75d=D`jt1Ly63BHtm6&Y8cu!Cnvc$)fYF zGB5rx6&FD~AOY(hm>)+tc7N=Yj6Q^9p9EC~sc|JqUU5%7ecpEbPG(51x8pcn}dK-Gj$M zScRD(O>c){l?t&(G__u=D!m2hFxfK{6C_Qm@(eBt&Q^{qZf8B zig^JqGI{Zi7umh$fD`XUk`VF)A&G*S1^>yLZ1W;ncospUMr>BEdFeQtn9-+Ob9j+c z%z|Fz@*=nJ{9dF8$t#%0YaU{(7(Ht8d68w1$qR^=X~_!-FYHATA*q5zy_k8?94=}P zG!M7pUX<{no)`7KDCtEhFRFV{!;8{hl<}gX7nP(|Sue_aak+Swa$c<5Z4N9uB}oPG zY8UO5g;W)!w~80@2AE;hM2YE@l=5$KP0L%`i(10_ejdx5b%dYU9aGnfX+zAlXy8Rd zFIsxhN?eV+c-M<2!W#>6_22WNsTVE0=$^SKt2FbXxwyi4%?!CNnd{hTcg#x}>RWr! z&WrXE&_=MW;MqBe9fUBrqmY;X#BA=Jw6J?}7w&Gh$BU1>=*FdZF~*Azz3AaZPcQm= zF~DnH%j)GtUm?8(`v_7m5Eo1AC+7QJ+^%ZQ(KpbG4@4OuI7o1);9$Waf(3}F z2F&?Y3dr^6QJeNz{BMP~h+~WJZ*l+OzUh`{H3^?S) zVK4ra?Z!=a!iyuqj|v{M^y5NG|CD@E$X}LzO2}!!K`FVG4No}7F2^r+d2yaU0bX3> z;P1sXFBbMnsG8k&nf>I0EE{jzu6Qx(lAX#`FNoyVy|}^sST^A%d#@L#^5T}56Gz8V zWVz!-Vy4);BJMtHyDtlRAjl;?6!OT6G)v+4qn%#3yy&OmeHCtwFk>_3QIS`L#|y6) zsuvo^PZc&5J|1Yj?HN@-h3K36ix*zrWxzj@{G}Ivd+}QMD?!FEVYEau{Od)mYPN(WMm4jMWKa<& zBAdZNCHxt0e57Pj(Re}f)LyoD6$vUx5(P;zbCvJJlO(Hee=&0i$)X~wrDRj_j>WSJ zN$}*(DI}L*Zp)jZA{vlSMSc}G7sobJQ9wmO)jZr9swku)cLiH56}43qR#8Mns*0j2 z%Bd)?!mgs}1r%3NLPaqZt@{>Y>2$$tSVCG&iNUdES|TI4-e+i6x1 zvzm&EDk`a{tfGpFsw$#YHcG{-m+Um7yt;}SDr%~DEiQgCjF~GPNUqQ^v5tzmD(a~i zv(i@QvYj8Bt1nA$AXxme*@i~4YFxXpm6W%D_@<|GA?m+jQMiMd304;B9o z$kS8B;;H6}^iuJnWo&F0^M73*6@9sFKQ{T$fqD9?7@%UciZv<*vL#vLM=&9YYMv?% z5*#c@bBKze!iNbCxAfHWwoxiZt5`1UGDgLRD!x#W_G`*m72{OQ5I$bT1Qj0(pQvJz zir8(KBIaZj9|?J~)vQIGI8_vqX+l=b&O4oZP-;=+ZPrg!BuV6FDrTzq+=`zqWR~S+ z@ElQ?cCLzfD(0(LpyF#4-*BU;SfpYJ+i6c=dEwz2cnO#W5HZz^^$r5~NW9%Qt_=WfD8k^;c zonlBuSVg*u8Zv4~(U3<2 zCm_hAAz4Ef&3x)0UPERf34&A-g_OEtPIQ^1app$5O^{|*4cWw-OYj}R9D><3jFBn~ z%c)_8#dEV6d15H$)vzmjOaToAB|e{Ee!*G=V+si=tf7dIomcFs8j5Oo-7A50?IMyC z({NZaZ@!iH^%eW50SP5El+;j4Lun1?Iwq9UP+mhB4P`aFm}IMP)-3%x$5zl#QA1@B z8Ah=ZSA0))5+a}QA=y*GR!u`K4Yf5?*Kl=6LJbWyg_OE#XQ5I@LtPD>xj{74(@u!bQT zhHBV8*L>)OI84KEY0?M{BZW}^ssva_#%TDEX*Dd+Fjm7j3HVIIcnuRYe5_%*hKU*` zX_zXm$r?TqGDYx@@8Z@r%rn1F+{Qj}%r;F#Gk>4BPlSIeSg*QyYJ6y9#u*y6JU6%7 zObwrFm?hpXtXi`*%n_b%hIw&yuJC!5m*ViN_JtaLziR%Dvn&$Vml_sp_)7Q^4NI-~ zC0Fe%yny_zhGiNG_)yS??=&peu$xIVtkCeihLsvtvCnjl&$Zut*Nk5=`$5Bxl4OI1 zpEUfe!M-)uh!Gk2y3K0Me0_4AhBZRS*J`+R)qFYh7g5#=zHXI=%0>;FG;HQ7YuKjY zSIN0mLxq3eUP*XaCc}0Ozlpv}!wwDFRr^j2EDvLo$yuUny5`@QJsSSd;MU;Luvf!A z4Hq?B(y(8{0S$j?IHlpBhC`C=7>`FGM+E;AWU7r@_~P zc8Sc_%!QuTaF$0dcatx}8L3jgdF**1-W0gTq+Za#CubP>^SR{98m?%#r{O-2N)6Yz zP1qqN_&SdiAvXjW|N96te~*&5Bg$RDj+f0|QL1@tm)T}ld7vRpgF{>o1s@5Py=GUq zT#lb&GII2wIAZ%P=vdcmyjO#&;cpI5+?X1C8p0Y34Z0N{5aQ>dI^A3lOHf0Io%}+E z9?O6Tr>D>{8Jta63MzR#Pw1zEgSY8z$356M2{ z^dXlIS$xPUuIxT!vtr)y;h@#R?duYA_^{#vhE6dzdu|_6e8?w}c?9!XweDWCw_juq z8Z7xmtllAWAs-40Z{$M}AN(^@OZZSyNU9G-h1dn@D&|9R;m+)NXqNJ!v=23WsOdu) zAIkdBCR1`HAIeF>@`4O2IzOp`4;9&}A7Y|~4XErx6(0sq%2PGk5+ADhIDM9l3XuWJ z>L%9mp*A<>b$fju>iAIChk6psmuRAEakNh!l3j!28~D(oYeGXG?v05bR1n3l+Z#(H zz3&QXBKV$QQy&K0HV=muKD6}V8y~*)p_LDK{BLkAx^3U4dePO!b;^F&)G zA3FQ+z7PF<=;A}E85z6!z*%D6tc;)YI(Ii8y8F<>hn_xM{yepx551&fA0PVq(3@+z z!|W9!wr7uWBFof*W*OkaKp)2XFpgDx805ofA3k&02Kz8Xl8o>{pOJAWd)nvb#l~Si z3}@dP7fRATVS_eAZ>=vOe}Q(i~l5q-*%zC zTKF0t)(YWGnb=9T^}@Gs-wD~^!$u*S1X*jdko=z{l5Z3Kn-9NQ-t9j8u%QrLEIUNp zDY#2eyKdj(!yi6`eK363>%%@DuKIAzhy6Yr@ZqQr$9%|>CCe9WGavNfkPnBsUhQox zf3g#1G5M13G9Hl)vS3EW<3615;hYcWeOR}k&`BRo`Ec5Yzr=iF&rd^ju0ZBe3l z!H0_?UbbBM+N56M@!KZ#NiwcjBKdV6Zm>6Uq4#rL-G`e#Jn-S654U`{?ZX`(YPGT5 z6TB-J-z9;{ec|(dwvj*bA7Xn-uUNC_H2-9DyS~q;r7P(SKaV$38saSgiv(p8D|2hc`a_;yvZoECF{^jwgn=vthB8Itu7mtm7*k1$7kCF+|5u9ffri(a}&xBOR$a zis~q*qr48gj$%4W=qRb9xV0|xr2+geRue6RbI?77e(i`?;H|#Gj zXR4s1qK@i1YUrqBWvHT~vT)8QXxy-0nx9lvM>Vd+O_LLA>Zqk-_Du7_NNpW;bkx;R zkL!5z?bfDPUotchY-j1SZrU5`cvnX|9qn~A5$}6Cn(EL_7MkER2eD>4TI%K$RprLz zX|AIMS9V;UQ+I8|RytbiXrrU8j(s=nL_Q5d!a~wPM@JpKb@Y+6opf~8(M9;toA$0c zy6Nblqodv6sY?^wp8$mVE$ssE&R*-q+!tpK;jGc$WS; zs@^i!v>j362kRKbmAYj&6|TaJIF?~LhU*xwV}gzm5=PfZ-Mr>WGD_zMf9<1nj3Lp@ z3sYkSNoL-%6UT|k$kZK}sAGzbsX8V}p2=3WkA(2wDZ{4e_*};<9UtqMuHzFOpX&Hb z$4nhFbUdFIo4HLK!&q8m&O`I>F|i~RXX}`wW1*z_LU5jr`8ww6{EDu*I#FC8E@ITA zzDUQHBHoa&B|4Vs*rH>rj<0omqhphf%{so7n4j5U9@v)Y_)g5_I#%iULB|Rm-;1(R z2aA5o&cfuxAI1Dh^r(wJRjYNZVQcHz*6LU($$I{HkLwyO1om%5D3CQz_eZ{H9|EOZT{)I(F;$UB@m7NNO6#7ZCOcXT$#B z;2_HDvS9hMMxp+cpmG(pIneDS25q?<5pF*g!dQv`qGSYrr#|a&Z z4kyPM9e?S#uH%M|KbEJS()oo)`&C)oX&q;DoE3gf#|0f1g`d}PKb!e4_mY^GbzHIZ zi0E`tBwpiC6H1=5F8QX8TRb{Crj)&7zpdkrjt6wfJe+rV6zI4o@o%J&_k~krz(c`D zI?{wV1asUm=K^){pwN*n!5$r69X{?d?pDpFvL9AR&~yx&lvwMIo%7;8JCy3z5zt}i zi0G(!*cQ}LI*X02keFdX>i--wzp0(H$Q-+R-LXHG`~y?W)p^FA%tO+T5Bzw+i$5Iq z{3zkaD;n8e<*)I?O3$icS{8)Cuyf>OfA{mp_k8DzgPqZ;%4nK1GQN)i_KXOR} za{H0uN1wK~9BY&F_|2~s7Z4=L>qkC|=l5gd_IUGK#$#*+{U~JVg@tg5MJ1bEkgrvK z**LkF-@N)48J&Sx(vMPpwDzNoAEl*jRsENx$Kg#)0-j51?RP>{Yh+NG|epI&j z<_D`pm)p`0=kb_U;-Vg{($1y_(U~fN&eFXdZ(a(?fh4=Sk zfRJI=GBJR+N{NH~80^PhKlb@C#E+qVeB;Nrehl+tI9uq)3_nKrG18BTeoT^Ojq+oh zALIQP?Z+5DJ`|BlA1mbY9Xkg)mO8CaM^4Nq`1u_@v*nZh_{fisC2WcxQ-w_PBU9I; ztAov-m7I6&4ey$f)2*DJaJhHQ`zfFKG1HIvek>5z=YGugV~+4yf`>n|ec{Jk_P6ON z^F&G9Wjpu4#@CmY^i2HWu6>~&i~RW7k8|DPr&TQUr5}s^_{xt1vP8~k#N{sWW2xVq zDsyZ1*fAr_s|v^Er*;{4hacPg_|=c)eys3gy&oH7Dc}3C%8wuXSm{UNr>Wx$faOPV ztr7gmkDvYg?uogBR{Jq%M#eSY+Y-Obyw;C(e*7XaQDlH3joB#T7IuSM1vmK-+b!c} zKO&t?lQCPx%U8*^`|+C}yZqSA1EfRiMN;*t8~eK-Yx>yuP0#le z6ZWt(BqsbJIJ-vdey+YBH~hHi$3Z_1`Ek*YOFZzuw;lH5gdZpU_|uOgese56DtKJ* znBTmmMRD#e^BF>3c>hZVmb2_X)sj#7ahgZBA6q|-r%6scCjsXLFIb~chVRXPO_%*h zADmkMa?%yQ`QGJKL6U2JTo=yQEot8J<2J{@01&_(KkoVw@FVEQJ;wOq<&N{?fgcZf z#QEX!NL_G_KOS?Bh`B0gzNT7E78-qV^|>EfVKe6|KmPXPUk;A} zvjMLq{vW|Nek>_$JJZYDO2u~|Rs!M#GYGED{dSz`(mrFR0KPh8Yktq3C4l$<8f;8X z2q00y0*SGi14s(MCML5b2T-|?dBvu|SMmHWoi%`L0lX7H_5gAPkUM~T-^JtzAXA5! zoB{mPK8CMRP$8xS%r`!$=MkMGs^<@&KmbjGcrS>80Tc?La1cd;C>%hM05%4&DS*@f ziU#n00R0272T&}4Y5`OaV9zBKmxh%M;Gx{rd;k>! zsL1~Cg^i`M1XK#}+fU}6rBWq;s+RX|r}!EH)C`~z+aCZg)z%82UI6Xpm}lj+1Lo;` zodD_z8P>=Y>vJ0h&@g~zMslNLHlvPtVW(Ul+q+y%Rt%th0Ph9RG=Me%{Bh6TEPz&% z;+qH1LR!Kt^Zf~1%K(V21zU+ulZ4ndfLGsUX3pv>Y#jpV7(n*`dPqzs!7c%G4w#R} zGp0;KbY)||e8EMB&~*|m6;nAlImNaxrA0SpY_(*S0OQmlT$ z2LTKUV6d3u1DFuNkN}1TFf4%K0gMh{49$kIBLawYj~yjAlDDyX#)o7hQ~Xc@#z_Y1 zV}<0oZ)YtQE`4GEQv#S8z$9@^<}Mb(y7V$;nwaF%1Nhi-MeBZInHOso`YeDs0elg_ zOc6g9oF&M*v)QTzvHabc%MK90@&Hx@Fh76=0emYl3jYHki-O8{vBI0D!jz_tL62XG=_z8dgr0NVrjO?bv&%#Hwd z25{K)#_SUDfZ*-`eiyPQfV~0iV@DN}8GcDNCyn19K&O9Wrn${0?VqnOpY1;=0f)HD zWNxlMt@tAW92I`dQhMFDpA6tHF>eNNDuB}gTnylnC}#q=AmpqSe=dOY!auzK_DTNZ zGBMX>5w8kf34qg5u^HFIye>%dhLDf$+iwMMo8!Nj_X4;tS~nR{-t+40dVpdIInTpbPg3s)Aa;e7%D27x={t2?hk2IVfa7 zDRYm6Ie79CvCVvSB0Yd70X!A&WA1`m$fnw!iTTePvq{gb3@?P7D;WEC0I!)Lh#Wz@ z;n2!~D~L=%{2M?_5V66x?-cVDjD*{7c?J>Vg2*Uj@t{Ozjt?Rsh%7+_Lota#b9OR{ zNkL?`GH_jN!jlD`#pPl^R^i#Kn0JJ1m~JM_DLjv0t{`#?NfD%%_fPW*&lfb$2=WI} zKuAHsLP7kwz_#YTok(wL5JiKi7DV+R>_PJ>6qd3=iUm>JQc4IZ8AK^dDIG)^i?_*_ zTrP<6Vpb5W5=2GITPcXj7XMV{iLELoc@0aiFQjG=wS?5R^g2P*6<*I$INxT2p!w&A zrJ;~UK{OWfuBG=uOw%Bm1@U_jdxB^lM2jH$1kpE$mO-=%nkQ>rf@m$Iy`yG4<63k1j16KO``(>Q69h@d2T^mD8Nf18#7RLo?whliP6=Xa(46XXdl1ut_&A6) zL97j8x@7($h`C&J5TCMd4^EsB#OFcG3gWXMW{R@AyN$(Y5j#7Gch@9m>lQmF2%6-K zCz%(-{2-PGu_A~CK`ad7>ma@fVo?xZ2C*cFrCez7gvCL8C4^@~GvAM=LX0Z^bA21c zvLL>bFuI~%Mv{CV#L6Ik2;xV}OMMj^DXD%Ek;>0Pm~eFvvqxpf{J>6e9aq0-=1n{n z9@t5K31Yn{J!HcQMF!L31T6Y^^iEUe4I?a3|qn{3Y=f;$Cw1+iPUXOCm% z-uxqoy+LR}_=4C+U5>u9LF^CWKoAFm$k!#IXT^j=L4J_S&i^@wdGH2tBxpW0!SYuS zM}s&f=J6m-2C->iEcFwjoLFxoZ+69Y%8EZ7#2MkgtSj`z1N*rk&IfTJh>Jm73*tJD zj#aixL0pj*US`)V6I*^k#;FYxuCi7T{I5Q=L-LSn7y zo&@ny6ndWq@gj)lK|B+5ZZ`kOv5-(9ejSRB?1}$7h}Tl(4aa;*%b0)oE5PAYOnq}a z3q{5gH#{&ePh|`NA&f6yC{qZTLr4lCUd#l+L_vCA)v(z@n3^ZaEL&odg=Y~w`M^%` zoe;8zkRybgA#)OjX+sluFON&f6+-S13WiW91YUaO)b1%EUYdh;JNaCv_`D(H3*qTM z=0K4@gaXpe)C=(}R0@YsB!p5Slnx;^WIiip520Add_<~f$b7ac`jk}h5K4qll9BQl z6-7QkRV>YXq^b-zwZq(2`XMwBrEUm`U1Au(QcsjjeN5g^_`8CQLTD_6I)j^p@LmW_ zEv1wgk@+mxahqp8lu+>qgEJ!!*APATf{nH@a`}pS?Y>XFBsDxjD}$h4r53djlyWm z@i~l6VZ0kglQ24j!Lv5TzZXV}Fj`8jrh?7FXfA}_B}3v{S-fo+t;67_5?R^^*^wbj zJImWXj14o*6Rw6?&9-$8qe~e5!gxQ7t`gHTj9%PF!n+Ih5aj)3#`hLZ(l?Ag!lS42 zRLV6l1Nw9CSTO^_7%03}@7ObqY(F=!4GNnRXrBti3=LzLxIPYJco-wXm?Y*%!EwYe zMujmtj4`5oD9HSgy=LRbN-z4KNirdfi4yaHoF-2W9mc#c=7+H(jGbXD2xDOw z-?Kx8u_%l$!&nhEr)FYV9L6^m|0;|n7GE01*A}nWH0fL6%Pi$PCfu8{Trip^WRG1X z-i=nw4`KW${3mYMFjj}LM$GkLtPNvb7{6GN=Xb`lMDwgV8BgzqFi5Cu3S)B^Tdc@! zLbh@Pu6`T;YZ%+PQjQn~{}$#Kqs)(^?FwUe7^lNH6UOgh>A|qA7Sjbvh5YJ zkH==yB-T10=0VHLHKO=u7$-zIB6!sD9t-2R@ZyimC7u-im*qVrBQJ=1z@h0%CX$Cj$RCA~W^o65we>!WD-0j|!&CF@-Yo$hL2nqU5Y4Jp{*igh zSQpbT7ziUMBxJ?#6fzP>o^UK;r%kjylU1PdT*!+sc3n2N zKc|rWJB+$_5NF_Z*ql-J4SxcJ{2NBBVJa*!Le?XWJcD7zlN>0Vl2LRR$YdbiK!Slp z1DOpZiGJ{01{Ov}FnF*n}K%>R5HxtBD;YcLWX&{$@f@0E@+dzKd zDVCDQKwbm+#Qen`%fc|00;06$tZ_mL3l=euDx|2O-9R+Hn3$V}rm$iO10}^QC0I_d zw1F~0%1V_9h0O((H?YzXQ$h5Kf;6K`uPkO21674ktj4sH%?Z$I8mMKUxq%i2Qs$-9 zHqgjGW8rlK>l&yhgx>lF8d$ucf!kYb6yG(>-^X^3>`jF>12m}<84yL1t?t|-4UCfN;|+{9FvftlS8O!ThX%$P7-yIdj74)2 zqhx}CiBgN^B#W@t6a!N^VjGw%;xq%F82D89$AZ(X;28!!Gw`{AS=Rc_6xaXSHrv1) z%SAD&&oeMz!oD)Fz`#P`U&`8X>5HtUvcZe31x43oiI__bd@bbc@MP+I@?@ET2k9w1 zqWQ1;J8s*o@yi8Q82DZYm6bv^UAO&c;3os6AEV4;{A^&gfl29@oQ^dH)*5J*j^^oD zXPCp(83Sk8r46h%utAg~Y@30N1~wVkY+#Fl-3ER)u$6f_W!`S!Hv`+)tGV3I<5>71 z!gaMx*A5BTCAibTn!R}_vNR|gyT`yEhWRt3nmjkCrrlkOPUkui?sKJ)Wa?;Q6!r9Ke;P%!^s^Zq8qG;#5ZY))=E zdxD1@ScuDjTgahR=3JmGG*ttdh(19-M^Pd4M#BOIYB$S69yVaGVU{;yAYJ&(46)H{ zj}1&0{?v+jCgizbg~NDd;BN!pMX)@A*9P8j9EhM(1pgTL*Ff0_%0&N=Ub5rEhV}x zi^cplg0CW2A{%XK1mB4GwICbD>e2kmth$|s#joHFjo@|!cOqCB!Kw%jNAPC^KSc0j z1Un`2rwD$IV6*Vm5v++|gYf_5Su5r`!CwT|Tm6Jf+!(=o~|FxFK@2&`Ti}<_X{s{I&@CUh=%(?GBorL)hSo%RBhXk4MNCZbCI2FNZ?%W{> z$09fp!AbERw_3|dDi$m>_v~Lh=>Ew`awdYa5nPSnS~O1t7lknFypRh~J$LLSA(sWO z2u9cUy6~Hpazk267t1Y+-;Lm21X0&j$$ zWwa|+HW$YnU$WE6!<_C2JeHSRLybTaliVjnw}QD%f>vZCf{?|-LJUFHO1JdKLY_qM zR7i9my@=pt1V~4wbaM=U#o=AZ-~0)P;Eh%HU;YYMoH=78hVe|2L3o^CMnMM9#VJSP z#Y{>^f{;YP%z_MqdABK+xjbEJJI9of@SJ{=X(ks}>B(@`iLh0~GCiqDsh z+`?1Rkw-}0^#A`&VXN|6kp8P2GTIr~ij>_V#l5WnjQeAk}bW{_*k zB4(X*)D==M9re@EKse(Y3Sr&G>1ZT8Wo;gs?^=2^=X>dB`X6Omr}!4>7@2PVWons@ zR_SP+jyCD&n~r|zXq%39>FA!09_eT=F`WcE2zC@~l4?G{)0r!hj;^9~6MU3AZoiU& zNH0rI5qqbjm*tJ>eZ*vv_tVio9YfMFG#vv(Gy~Ex&DNJfEWNCJWihzcrVAd48u0xGBk6B!i+#DIbbC<+RwpaPOXC8MB{ z1SCt&Iql@>3IFyR`ybD#bI*PEy^3AkGt<*u^eS-=yxDY!Fv8xb63Nf@0 z^9nJ)5W@=bdLh0l#I!=ZQHVD=NeVHh5W@@cRw3RmbRMF3n+=F$y`wlnairoXMY<{; zac=jGX7BFzy{q`1BJV%Hn48B3LOv|SM}?Tg_Gp%|h4{D-;|noP%`W;l$|r@GQ0T0I znR%XMBKxj)u2^zL`AmbqD8yv9-p>o2r%f0zMU|RMii6@^&LaVx~1^L^3DVZHJQWg$NyVYGnFbmFAa?-G$i0t62a!0qiYw{tY})h?9lbSBU+E_@@xx zx6eMJctG)>;vvPuiVWEJL)KB{#}tpdIs;De@D(D+s&$^9VHJhA!uGpo!MQ@5FT{mH zTr9*TPSG{a%b`r$)|6qQd6id>lFmOVjko4@8tc2p<9NhhScrg@uwbe4FKW0D5mt0o z(key^Ve_)E!g0ko&J_{oRIlrtXbB$2pK_Rzg-9u%aKulOE+YUl08aoP)y=1A1>g+; znk0a%fRlYxpE5VpsC4P|Y!aG90^mv)B?I7kp1A?|)XWQ@sFHleVfPx0VY)7WVgVFa z@%jKt1kih38K#Vvq*MT<1E}_=uS@{`0PHXG%Cclt$_G#(fQrg*2;fE~j2v*Wppwfg zD=AQ1a4IW9ssvC~i>elI?whg9>S~hIP-Sa9U#$RY2QV&xj{~?lfI0!R2%sf@V%PT7 z4d8Yqm6nJ ze_SUmuqy|rMw!mayD09hp3g_wpH{t_V)p=gu)w{-NH&}JYyi&%&@+Hu0lX5xs{uS8 zzzYHAO{IQ{FDmv??5()qi1V^i-vBb?B^9Z>tmKa){@0WYRqP+YfB*&tFere*0Sr;` z$w7Hc%<}4T2bs9=(J*z9zpjMK91RcPt$=f@FyB=cC|MZ5B3H@8EKzf*;xeM^<+qpRE?*zO3gs(ZWmN#H16UKlT2+2^^>s>E z@^4C52)}M^2;lbs{>Uf+Y*O-P02`I?cLBpH_H}-AZw=tD0QLv)PXOE0yCZ@VA5dg`P|5$-4-Bgr;W@b2=~Og;m@51|@@-e=3w$DgQ~+relZqS=Bj^O1 zikV*1WJ|n3Ac*2YTpxs}mwFK;SwUpGN>1?KZ|S)~_=3)|gbZWK3nD-0d>bb(8pL%P zUraGGO4LiJSxT{F5UaG=)Jv;UMzO5oDX&#Nh#UBb%PilGihjikK~z*iy;2Yb$}21K zPZNq&lvh=(rdU0QtfPLqYN$zGD~Q@`Y8Yd}xH*VALA({h+ac5q;+7y9h0r*JTZ6bQ z2qOeDI*3-v8y)p$N^YYj zGd>bTyC4<@u_%Z~gLo{6u{=zyE{G?Bcp-=vgLpECr-JAfME4-t2c5Uhz>z? zRCBMsXutnw$JHf>u0cEuAl~Oe=dljr?I1=5F)9f5 zg5HUn%Z>@pnVG4q6qnK$Ykz?|4 z5aZdTAf^ZL2@eX-mmt1i`J6c~`6mVOsS-v%*LOJfW(5?KP%tRTKq{=MQ4uKvPNKf_qj+#r4oVxFtd zSHij$1QA-o{g<8gEDmBx5Rsts(YZ8;WkDPW;vmn{Abt*Fa}ZmC_$7$tLHruTZ$YdG zVr39(f>_H5FxFbdaYz=d=7=42UOgr!u4BJ+RX6GxaeWXQg7`g%KU7&Y!ek7+f2z4L zh)tZUt1D!J@Bb-l)(B@!;H^RY6~yi!_Gs9)Aa(@txAN^g8MCtsm-}`Gu}hWwhEA3l z^Q~%kJ8SChRdHVs`<1Y%ttxpw(qjJ!a=T=wwTFT@9K^*SE(LKUh@(NA4&qD@$280F zAWm=^Xch*a4C0jPCCd7K{l;0dZvCUav#MNBJQu`yo=v-*w`DhI`Bca+^Wq;wQ2A9w ziiJw9DRzjK2)O#V4@=V<3L>n^v0_eNqIz^MIN|h5Ovo$e?6yNg{CLu zybhcbLXi-x5WFGh`y^Lk;#YKpAiOH}%+3m-S9V@@$eB^&x0GF9SS~jNUkF7*xGv-@ z`@m z2uF0ZY38l-)l~2O^DUaSL%2DFI@;`digiP{h1dTOZd0r$Sbu9l=4>LbA3}o=ZV#bh z2zQ3KU9z9)4kbi}(Yz~!j6(D75bg<~T?mhcaBm1LBH0gx&@6-|%I{O8*ffOuUH*WQ z2Seyn!ijJ0>TNS5gqE(-N=a+QHX%H$q_jZ-ls$8=EhH1g=a!|R?Pv5&xP=klAfG7 zAv_<#3u^XZX^ou;_M)03y*cv7oTonex=KGbOqG{ac}4M6*ZZ21{)+EZ&mS1VAmxKY zc-@T|62efI4^vX}wDE?LHx-Aw-ZCeQ5h08WAsRv~gi#^9qepO|e&UY~VN3`ghMYh6 z-VNbBCGRUz`GBW}{uB362xCL|K7=1a7#G6FA?H`*mm!Q-@~I+~PePdB@`)i#a{1?b zoUJN93t=)#4&e*crz%cSe0_9z24uGM`YMEJDo$6N8Nv)DUx)Bb2wDI9`vmW|A?~5< zJTA*LD}?VfhMXt$Y!2^UVVWDl9G9~@KPsOW!u${hwDmGA2w`=XEGF_rAuJAINeD}M z7W=bzhOjJzpF;S9SC0^W4&fKoe^p%0j7k`}LdnVyRwjWF3oAovz^r zE8i2sVO|!L?+syJ2>W>j3t@UuXM6gCAskQ_dEqhtA(y9*`HzNhEQE_8Tngd1>Zd|D z9l{CaCl!mnkd>+ZjGE`z3ni<|JdVR)55Q8MCGr{rwqIf_LTM^5)Yy#+qyd5R3n52L7ZG7?Gvi{OxlnFa80tY@b_@XOGxiHFyaYGn4hEX{Te;5_Q zs2E12Fbcxl)YU)!JKy5t{&RUHPaOB(KCZw#;lJ^Oze*V6o90ywI~U=q(vF^vJphFlPmDH$icGA8)9R?R0>8zXqUDy!~Ag=|poAT}~YOnNA zd?t)%l?*%KpVPy6Ym7zp3Uk#pysW{`hw*}v7sKcsMjtJiL)}kFUwZpHw>_DrR&s8F zvG!No8ea|LH4W<@#sDP)!&u+W7^M8_Te+c#^GN^DFouQkP8g#(Pr`U3jFDlC3ggW% z*cc|pu>HfscuSkgM!v0NL>Q~z`?t*u%dE2UZW!-{@xJC|#*9u^CVd#jM`09+A~%Y$ zVT|L9jd1Tpe9U#%IbWD^mPi z$roWv`M+|)|5X^%!dM%|x-h1PF(ZtHVJr&c>oC3vV|EyG!uU3fnPGe%#^L7KOtX}H z$8&9V9?i?c3y43s-cqd`ac&s%!k8b%kE-AFypwT(^3EH}k~2|U9LAC`mWQ!IT}#9G zDU6@PSf&|SR3_uJTKL5+hvLdGR)w)93>LLI3|7sGSRh+Mg^BUMhVfe%d&1buqZ!7A zF#ZZ-TNuBG@kbb&!r06S;AY(DHjLG=Q!Ih5En#d`eM5F-CYHZFj2&U@3}ct-jQQKm z$Xsj&6^8B3;OxA8VeAj%U>Ju~;kf-1#sLm^t$!1P4~KC?z08{_fgL12#$)tIHeW|Q z9>$3T40H1XT|yhQo*`i7L{|?c;4;{KLqKIFFenIa{t|GkGEoNrjPi z6+;y>!W}dHnHVbquZmElC=u>c>3FlXG!~c>K@sJ-u2SiKD?g&2CJ|UC{Y4|r_47JK zl444VM{vCo{|ewRE*%G2*yTGDT0Cs z?vLPs2r5V5kDzhH*|?-i1XUxb6G2@yt3_~=61u8KP(yj3wzIECO;@iKL2Z}ctmKDZ zo&85{iQo=3Z;jx#2Yc;92 zQSvZbGQ@c|gsEKwkE{5o8}nEM50}fQ>j_n!bajgDBj})JN5w7?baK6&IZDHFnX9WR znRi>dEAJUWFC{$`pNZgECC@1`OSO~!=OcI_f>%^|QL(RLZ^b@}hu?O}XX+QhOA)*r z!F?y47iYRFlDrzhYZ^)3UkST8D1yNeyb-~h5e$hq>;DJmfN7}mVTu%AS7Oe^a3!N6 zct^=w5xmWY`LjnTl8odPdt)96bB)%R4b6eW{6;gv`^lU}B&5lmO* zOU17um=?ioe}2Zh#rBcRh~R7Wk_Y<~5WkIJrYf@(zf;Wl!*R`4zEp8e1ap=A7{MYX z^CFlZ!2;zA6%Vv>s$lAW(!W@hC5lugR`D%!`A-r2to#>O`DjPkl@Y9pV5cgp6@QCh zeFSUVn6(kCbNR14zLT65Zct@o1e+rG-Sz$v!Jo?GR({PkPLnoAur-3eRNSKYds%1D zwneZ*&FzY1$2)6cGyTm&aMIzsBG?_lo(T3va8zUVMX*1DL&_QO4=-!V54cLVSxyNP z|H5HcITGPskpGr^EP~^%{#Y6FR0O9ZNJWs2;Ea0>Ohj-tf^!j^=jAkluwE@MMsO*D zfbz?V*A%Zra5aL3(OiCiW-33*`TAX`uEa^__d+m&kecKrPx&JeL?ei~imfCb!O~Bh zJ2Omt^*E_5X?x1Ko5y5C;f>;_g+4Rtd?WQJl2}TDy`0+}h@#zmzeJH0b*|@cp7Li$ zk>heIz9{md7$3zaQRGKaH0tczGAxSgq9_(ctte_oQ9O$4qo@*f-u*8TMXT4GuUI!m zQ8J2BQIuAtoFZLiq9_}6&d1E&3RKFg>juSfQKLc>6{DyWb-r^JDDr=?%*%|G)$~W5 z<)P@U8pUIE^QtLUSEN}($xTtzRC0gYEQ&WrQ74L5wO@6k&fk=GL~&;nw?uKPnzu!9 zyArzUMNvPB2LDkSMlo|#4qZ%vC1vi4qEQr&NAW}yjib0bie^zXk2-g{?up|5C?1I7 z-YA-=a$gipmC*au6V6T1%w}N^s`!xNl_ieOZNFMX(K3pMqiD;~h@!Q68QI1yf%}eq zcFMV9`3Mi3ijPH+**DE8L6w1R^2sZVFrSR#sVI6y@q85Rqv#Mtwk8@|y>-i~5K6eE>?XqZf+ zqM-L3S9w>>_Y@u7Fo|O_W)vT?Qhxvck2e$Wu_`Q$!4smG7{#wq{1(NeC_as1xlY&5 zqL>`TQstjV@kJD0NAXP*Q&jm)mzjBpnQA}4p!&T-TDapuhqxe3GA2=sf zpQZSn;`4KzQ*U+@bJScI#oQ=P7_Tyk$5XI0n$YflkuEmN=qDb#? zUJzzl#>i2h$6*`qWCk4jZqwn;y9u;W z_D8WJiobb9iegU`J9#;(l)X!lq{5Fm#BuNVha?Q_-CUN)RQt65L=-1^u0?Szic@+eITywGC{9OF{(28zW;~vSP?q?p1`M zC>DFqpA$oo81h{+H-@|zsQVO2SQ>*f3dQTlV<;ZO^)ZywTqP7s#ZX#F$ru>MTufzR zD65<$FlF@euJ?hts1QTN7(O+Gw}>jmP!L1&1X?6eIR<|WtKwK4N0k_=#!whTAcm>K z%2tb^P7HNpsIF!WMd~*xsTo5pSE(Jt&C2=hodLJRaBB=}V^|l%Z86k~;e{ApjG=xE z4Ps~;!y_?VZJl*{42@&BJBEg8-l2GB40pxQe*+q+*>St));3w4MwemyJux(m;rQiB_mruoFY zlB2J9TF3Bk3|oq$jTTj_bA@uPvlzLf4BDyEK86l4JQ~AeYCayrlS-aY{I;o6?^DW2 z#vJf;jGf;*#pe{4uXkL% zVt78reS)06FmX(J$IvH+cVZYFLtl-2HHOz>=odropLi*T@%2l;9K$Oy3{91079!35 zF$~b)w_+F=!=M=6P;+n$Lt+>f!|Q6YJwtU&rVK8{<}v&KoBF03Fg)h8oMZU5DkEYT zsV(Gyk5VN|>wPzd_hR@qhM6(E&%+VJgcv5qFeZi%*+`B2D2B0G-8d~XQ`h8HSs$yn z`)PlV_I|eElbADHOp`c`WB4+LuVVNthRHE}5yKP>uDZ*^QTkl@?rkM&ZuKO0damDI zawa_nzUC>g%Nfsf1Lp{SqghB;0&z_DQnO_LPG0cx) zK@78Fm=nW~G0ao%+!%N`+WdoePy0I+ab_v`iJ0f~(b5ZJSQNwJ7*6Io2a$6l<6RQN zQqB8Gkurl?XK{M}6vNM|{1U@To{TXpk70!>>^>8RdUcGui~83n(#+^A@Yk4g6JSdW zTb2B#xITsrO6dAMhCh`5skqVAH!0c7(a=rI|B7K7N0`BZX?1^D7yB5Q#81}`mKZc_*9E;(f7!Jg6D2Br^9OO8k_GgfU#U9b@8IdN*aaB%e zFe524k(`dI2*&c7|yH75;EBtlSvn2xTHLjmjPEe-`>pIv?%Xt48&`SO}b_W zV+h6YKpYRo5so1eL#ep)Z(1~l7_YZ+=bQX}bDSma<1yGV)M)1XSDuI=8AB?DG{x>Y zxp4=LIIK9l%FQ@DN}hSqM;8;~$WlcVsl2bQY&CNfizq%9G3fOv&x<2pNl``W^cIVw zcpUuenQgmXTUbJoW=SQy0bZIUjP zj=piUj-yQ+o#W^dcW!?@9LHmEJRV2eI39_kL4|+sN3~P$qj8ix<7~Oh^n@zy<9Jd@ z_oZ1+DQQy6x%br}j*fA3QsuT6b82a>u4?v(~R^CmK@!ffta-59Ms?sZt=aoDc zM^87VY!BZH%3sX5)@5y}=rpf)9M|u~#{g9xb$c`@j=`#IDVEnExAL$!UXSCgINnzAjW~uYc~g-k?7G{RTf=F<2v-@Y zB(v@BDCI1N0i%__8^`$S26wIcAdWFSc5!?a$A{_~AIB$3K2jVT$2cX-`*9rmKFA}P zsCy+(h+|?Llj8U^j?d%xLc>0bW3rMnm7Vq&H~)Lorl>eovHuxA$AMm^X>rU}K0S^Z zaeN)eH)?(#$G2|GEG08}D!uAt`A*Fi-#GjSH--XJnW*oMV^7@C_s6kU)0C0E zeLTPVIRWIij`ID(E-b_2;$zq$HYtwNah!?cNE}DwI2p&OIF7}^VvomhB92UT%uCW~ zl<(fUzJANlZJAT)_alAFZR2bl=Xfz0<$Ft;be@xQlv7;^RvO1;UNGZG#Bn8#t8s*Q zd5_~7M>~!{96{|-g=J25c8yJ1Ya1k84m-Vw#1V@l&WpfdM75h8$7Zn&F-9%}`<{#= z6^CKNw4L}g`>t(ZA#8w0MXwFmU=@}PHi;c)3EQ=e;BTRkJkqg)Qf(viv`7qoIvEY&5dbShL@$VRzZiA&T@3EcP zvg3^ZJ{wJK+^-ok(}s7p*#;gy*8ZT4hio*noztO}jn+zMt_N=3}VFJBlQ{K#k_mt&p7^ zd^F#;@qvvo>Kzm`sALlPM>fXV7^lJEZ}P_5_*i*nXU|V;P-L25qdmHmq|3Pt%B6H2=A%36&$y~SCA8qFwBP*J(ty;+O`KcsRrWTUL8bEW2 zjit&TFO6k39x3hg;ujmsZJe`l-o^?WD{bttvDd~b8>?+>(81@2!WtV7&UbFwtmQ`l zul%b2rkGj(f4y=ZDVo3A_(O;BPh!!m&B{00*reo<@y_b{TWoAq?_V}{*!WxdHlAxY zncLa@ojzvVsp2jhyH%&cL@$x+Z0xhK-**04JIc9XJI^c5E?IJDv8)4}JdGKaiKg&XtpH@8M>Q{z2ck;Om=>;1XZB$OcpTH#> zm)Ye6+P&?+V&f`5@)F2S;F^s>eh#+GKeQSFo~kxdHqxquY(#CuIH}Z(a3Z~BGLpOR z#ckL&5;l@HGCEx(O!Q{LjD%CHCjm=|nfN!mS4|`!N*J7pXD|tmNKOL963$6fB!OHd zz66RY$y3Z%JQH z@9pd;Szhsm1a4GPA%OxVbX8PR=|9SnH%eDYplSji^zb~CK(&N(+TN#FJ%Jht+>}7g z1R5l8djho*sGYzq3EY}+)^WW#fjSA)O(3&;>kwVamHL)L|0=g7P|x*Jub%*yawTb) zz#R!RPT=kY?o8k=jcKH1vJfu%%9u=P_aty{0!`GF5m^Wc6Dw`XVex0*uSoKMk_Q#} zI9am<2L4f!OG{OHrc}!WS|zY0g{>*HPM}Q!o08a^#KQ@+O<+U|6TL1pau&*Cm0+)O=j=i3FZZ;3?&u68QA@lI@juQ0%D4yv<6MB6e2uNxxH0S1s-7 z1iC4q(mjD5E>DMy=Mw0dz>oyE!&I*X-nuvMl>}Z*;Q0hzNZ`c;8a?A(*|b!@1bQbx z(uafQiZtncNprod$n4)7^f((ep7p<$K>q{=ByeoC^Pc0_v;GYWat9_bC;^heiUU<- z)kC!b!xDHsfj1I(GlAhOP(^zAA{F`D3FnO}n)H&4O5mLYpH#<$Bt|FjF7qbwMiTEa z7ms)nC6f3cfiVf3N#JY(A13fo0^1VUp1{}y#w9Q}fgcn2IDzpAe4D^bmX^Q-j$Q(M zXNT{(OibXj#J}$!P2#XC&%7NoIf2jB{6cYR0#p9u&BT0_z_bLWtIpECNnr4pycr36 z?J5k*MAADefgfD`J0;(9wzz9h%uZmAikbL%3C!mJ^2ASIfwp#00*f_ZAseRe_$*0a zX##5!Sew8yx)NBW0j%ri{}lC$^5u#v6j!?S^2M&zZsa;8zbaB^6~8H8ugEglR1Vr7 z32av7PsNRjbZv6W+~US>Rq~gs??~Y91db$dRP~(+97^DD0=v}Qoxq+1_9mQH`~T4n z?o)lgVy5;3$`AfWq0S~{4&|`~j;rg0J3blxq>85$PyZ+HxdhIuStN-I30zDdlt7r* ze-(qgaE-}h36~SN;^w-_Pk{sq)eN|`u)*wpCODEnGyyXSPZBXVS0aJ9%WWl@gPu$v zrDodo8cAm=a^$TfyvlQufGg6)BuQkcLY}Q8Q(9(9nYY(WSN;_??~d#Bw8iWI*GfIXq3eLNj#85!jE+fkO5zn&Iw#RZN$(`ODtR`E=aP6@o7YX1 z?uu+lk0hRPIjiXTAKuI5&ntN$i5HdpzwdpL=$k}86<<+0_-8N(@|B!8DvAk&9xexz7tsefD&A16WYcvY_71tx|~Okz?J%ad4< z#HUGomc*PS<|Z*YiO-X0cd1|&2R4Z*NepRUYI+iX?8DR~zEbl`#f|$M7jc?;889P> zuhsQU65l2<^FLwqX3}>_MH?RSZ z7OYBQbrNfmSer!C`-)QkEs1rSyVUr9gP@g5{k;)p7T6kk&PsPbcqnQ}6CGKot`Tu$Ot5~q{=@oSvXn2Sj;;A|4- z)MUx$`6=LX{)*2OdnJjhDh3p!bA;*qm{rcACJ73uP&keA{b zO=yrpeu}%y`!Bc2yCH?5DO{Iweoqxkp^TE^DO{gI3FW0yD4oLSkw(cB%H39mVNA{H zm`o&PHHM^I3gumX=V9NCDO55-m!x2Mpt zm#=XOcc;)Wg=4#XOn0Pkr}DcL8@YPtbN+tk{Jpzp-IKz-DKtspz7*P~@JI?xQ@Ecc zr_elwV6UtPQg|?hhf*lkKBwAx-?iU-!_WE2TV|UrQfQe%8y);sDM+=f)+sQ6>DzP8 zp&@xV1-fXGw@cyC6xyfIA%(|Mcszxt_>+MFZ<$Y|@TBHtA&g`dZP)t-Yjv!sV+!P* zSY5W+D%@|Qq=k91>3rSJ}?sG9Gl@Lme< zD_`-f`GFfVMoIrf9`m+1m-kT$V^bKH!pA9mm%{fcjMwq`JcTb(_#}l1YEDeyGbNK! z_%y|jGv^jlq>gjiGEGjw&^248Xw0+}rYo76LahnjFH`s`qYuowur+H&3SaYBtMZK^ zOUPtT)WOUYW@%~U8Sw`;IECdYtVm%_3UgCfn!>gTMSkRHq;U0*vWrrfujMRAVcI}v zyA4*lPWYYHm^KF0Uj>YsVuzdnTxJS(eavz*cO zaIt9CpDAqQ58hkLZcbqnuLIq(nQC~<_p(afBBb#t8h4Vb=T<--XmlZFja7jtSKb&_V zuPDFD=5@?rqEe_zfR~6A_eKFr3#&p`eg$Wt(VHe#(f=4E+k9LtOQ#;jq5dU_+2L#QwcRorcp`>>n)u| z8JFKx%PgP94QW(RrG68qv>TPP1TG$1U)xiVM&&eaN~2~P{xqs+K=m}Ly5&?;!p5^1 zcQ-L>q@4w6xyUW6tCdFWG;T@bR*ktijXG)6O(WA_*2tJ{S_`w>mPWla>T6`Zc~%1@ znQ>qkyVEd@wmtkO&in63gUA!7Q5ucY=#oa)H11C0o-|rC_q9#q-ZYw|xnHxt8AmCN zrfEEscHXk*Yxu-MLJ2mXk)yG+Lz{lc`M_t(D)` zCp)7&tl7yQNuynw`|&wdKbgi;X*{N!=HqER;qs&TC8@Mmvy);6#g1uYT%FxWDo=AV z{F*l)ja5bSyQT5Yq^#~~^k9u?Jex+JH2S9TTpB&oc%F@Ce~VX7@^?^sTw2 zFZf?nv9}_(ii>3UgXtYf~HkNRl7mPUWhiizfoqrS@{ zN`89Gcj$<3U>bwc7@Wosj%SP9chVS|#xUh0(s*6Tn`sPJ@7yMKhIa|#+Y0On};)3&u zJU@*EJn>aosK<9HTV6kJQJNdk`tM)qTdd7kqL?_Hw@keZ_({pnirk`ic^WIySn0NT z4JVB9)tT%`@JGbjG}fv4tKx4Q%+3FP4)W*5?`iyz#&ModY5bYS#x(Y&u|JJXX>3kA z|JClK`Dl?XX>3j7aDIhx#q(cjoc)*bZTtvGV~6s;6)TSNGlr?iMgN@_{kzg2?pEBR zxL1+G%iW5TTxwz>0vJ(0@EG){5a zf8d=w$$L7DGa7s)jk8M7yx?LQ=aipUypYD#U4ABhg}B6Pa`S@AicL2={Q1wEe@P0{ z2=LNs$aRJUd2vgWO7Swzi-vNV;WQ%3qlz)bI6nfEBzXN-!brB0iG;~8gqUZDX^6)V z%MhE#M%w1#zI;baFrOY-%{NWu3AHr%eHWxmYRmtGNiU4 zBl5DiR124Xp-95un+=)MFqezH++xVBhTLUHBSUU8q@E!S47uHqOk{mSUehICxF6i* zzC{`ua)%*z8p1VaSO^pA;(w_OeyU?07rmj*)oJcA|SRc*YWm(wZE9jWZT)hluW3`0?N;u`bRC@g5InQ;^f04Bt(#Md#%+)== zpCK<9lH3J(E|<8vJ~I4Oj>F;#TZRlUWS}8~3>nM;Y@hw6;anJp zaCn>Ky>7@*CBqD1Vx<(B-Y|q=8I#D9u46qP-vxe~lfiIa3T7IqWRxNAxXQO(owZip zGi0nG;|w8x-;fWKkdHCsL**YS?hH6T7}wwC`> zUt!29B`Y&wA7nFTH3QUS32P0ZNkZjUt@<}bwqd;?2c9rU*stFW`Gd#8kd20H(w=Tp z+-%5JC5+j^GB5d#mN3cx;v~8F?{jY34cVbF^zwNp-bC7E$WcR%8M51uJsdHPJePV< z+^5LZ_4ga{kMaYG#V`38!xj4v8FJVV1{~qpI>$$aYx^H(b-Xy6Qp^-CiFuOM84@t$ zlp&{iyuSCHG31;f=arvje-}6_XI?PmB2Nk)6xE-yEQ*(S-FvbE3DZ?WuBnT>-X%X1 zNzjmxA%-cYDPdkE3`y{mF(j&yF+<{pun6BYq+HC{94EAWV za}+H_>Ru&K6vZsXY{h#o`HPs6tK4Two)Y$pDPMU}MV3?NzU)z}^SWK~bH%6Prd)4I z2~&>cR4!=>Ur8&Yyp$=WP5I_EA9W)2vg)nS!MMSc8%=3w${nWjZ*m1w-npq1NkvmC znNna%Wm9f5rJgB%Q>vI!+mxG4scOpNpG#LarG_chly@EJZMD5L#hXm2sR}ujTFNu7 zI?8WxmAa;60&aEVpC0UGuKK2o|F{Cnp|^qJ?TQrdH03UB=VPWcGKGKF-e*cvQyQDj zBxkzYlzWul>ncr58F0zD0^e`S1Ddz3DGw@XVM1|4TQ#!CoraWs(M^ieP z!YyUHnbO&mF3O))Nm;+21Xvz>%hMF?S6mCtzA9sT_ zo`f;{;W^Bd*Hw8#v0D=}^Bb16(EFAtZ=15ql-;I`Fl8hUu_;ST8N~@^%Evs!rf>(h zySL?zHsxIo&S~F!rf`48-|ow+cBbU}rhH(^7*opn@;~H(Hf5~x4!tZY<4l=)$xlwC z`H3m3ZgRF4`NEV5rcBgBKgpEINU@-@#OC2KDEzj&bxBWIdYJm%c1eCCJZ-<$G-YtGiNEf+Ayl*5;t z`uq}3|CcG-)ZA{$->$yHl;>KTeENlHrzu3%xW^RUHaTs|8B_L} zvd@(L9N7H4KkNEVnevY*2TVCQ)_2g9Bc>cRpRSjCk@9n)_2U56MDRkt9NPA zpzEZ|8Sqi-ymJfl&YE)0l!z%&Q_ky|*yFN4Y{~^wE~wBbuCic;ZIhNzNR!BpQxg!&)u0|f&Hpth+Blmfvu}AJGZQkvXdpxqQPWHX(%HU_? za+-SNepQ-#E)5{}^6&S( zA!@$ik)cY4xsk7XRUq&$-L$O4Zn^vEiYtoArxj~97lnaBBkM7~&+C5lT~&SB?&Sh{}F zfS(nAQCzOL!Xqn{Foug`ukpxQk3=;4I*HAxP5bjc zIU$#am9Ql|5K$f2m`CDDY(?q`k0f2*YEUV|64R36mRxU%#}dnuTuXeGv%HnpaxUOS zEP>^$zQv;^mSm}ztw?W<5-zmP0GgRKwMg<*&sQv}c%3E1l+@QreP| zT3tpgV@X*{s#;RblE;=97mza>?akWU+Ew0p)RVOVv`!5Wsdc|0p`O&1Rn-OP;pm1vjP}4~iwvTGCyW9WQZk0ExG)l zvlPsqg-##&_uLznd|=5KOWw3(xFv5fta>)nC`;aU`3Or!D!;>b{T2Pc?;T4KV{TfoHIk`kK`=r(43eTzOv4 zv}A^InqMpVM)6zAxx7=H#To0*{!WqPdnHp>V~!scU}T|DS)&&x`+dOLkbY&yxL?{B6lj zwnVcJe>Q&?FC+D`cdN;U{d&!R{F;9+hdNwv?}yHPt)DBE`NxujoF|W22iUtxWtbRA zPVW&*j#^?{lCb2MCC4oZS`xD41PA1@|B}X>wB!^?(X7*!oL54A#*(u6ZvcZ%t1b{R}8P*wasrTdK76|N=7%&gV!lv6tldN?G^r( z=kIs^im!Ralj{|qS4w%Mv{&-HlJAwGUb)UIbuWX78QbJKw}?Icvx<48xL1xpYh15b z!t0zPtqc7n)g+-=#w!y)$SdoWa#~%lLVtO$vmNJ+Ua6qu2E}z=tD;vbdBv|`1zusQ z?3Hdg&WkX^3Z1z@tfJnGS=}o&yz-(~dVA$2uhjHPBd;{}N-eMKE}3744faZdn%T9z za$|S03u=yWK0~w|eC^CFJ##)K_ev_(h?=p$0Sl4kdRg-sP2! zVS^$MG&k_N+v|L>xyLK_dZh`w%h)uVe~up%wM_TMm6tg8AdMg|d*v0cEcD7Eue|D&*SzwnS3dJff3FPi z%1Ez_^2$K34D!k_ue|ORRxwyH^8oe`+&cKLWEEPR5iOjI&S zTS$E}tMlcVe^X?Q4Exc0Hh(WBRunvs1|~#og`^-{+P6ydFYK$Uo{j=autbIpCFp zUOD8I!(KVzm6Pf^qIgX4sA8sy<8Ene$tka#Q5X4XC7ITq-`nQ`=bi4E8^q;a&VWdlbT>$Mcc+L*NeU<_ zAt7C&fOMxIBGQ6%qeyp4erwkC{J-CM_VYgPT6^tYdrzF1J;=@lk#W{AJ`5up+mM)& zJS8nPAxAXN++pP5f(p?2|Nm4wUl{rSr_PlBM`0A?RE5GQ97Yl5q^F!I+mt#K52HjF zHNwG(R!PQkVU!P}6!X%I6jdgSvQfT{-uw-tVi+H@rczX2l}TmBDvUSgX_S@{R%5X` zBPAzg%`j?(Q9Fz}VKfP&X&7}mwtg55nABrTDYPN;#*B@^*jP)V98xlG7DjW{w_$7% zMk^*Q8Of~6li;C|)?xb4RY2N?(T=02GVPf}o(kK)lRAabIgHU^j0vMl7+u5Y6UOIZ zbPESJ4=MBtqkEM1VA7M00#VJoj=`4cpR(9HjL)Ka+6BFD82!TdGOFnx#us4>VsSti z1DT}k13x%wGnB~?8r-DVLr;R;6o-W|JQ`c@yP&KQVT_DwMuqWJ7+a zPlHNQm>b5zXzaW&=7+I5L0u3=xeFO6mT(crE{@uK&xHOF_%V#7G)BN=U|AT;!^i>T z1bzx*MHr{TI332yFjj@}dl>sE+c4IIu_ugQ!&n;*&I7lHu_KIiVXO~h135_;n-`@f z{U#z|Yz<=@o8{k^Y6}fq4Uxi_jHMiHDdRW<0`pl(G2J$h|J9kB9NkPpMCav3t1s zXBa1#5O4B2RQ_os$29d!7-z!>0WrY2FwWC=bms}r!?+N}#W1diaU+aNto)1dGUFA- ztBhnXjt_1^{>|bwDv?P;H@MSC;bs^Q!gv_QtuStL)E&lqjCaFm_B2R-pG6`K&jhI+ zvG|lQs(-?yFB?B&t|f+Egz+-iH7%$%g||#z1)FCCnm1vj+-anJMBhbi-qRf9-8@nO zsexD^E;!i_>@`3K!U%o>Yh*@>5&B!iQ0w4agqlzdw!S0&)Xwfp)-muS0o&kAQ+eUZBVzH6K-}t(YIkzcScb zxd1>L26h^%76J+b9|P6M3@8dz8WSl86a(nGj6x|U#TiQgC8PR`mxBwp(m0_7k&-t7l9otBs7lR&R?&L409r=*^1(uD=4}{r z42vP-_CN>VO9cO~bp+^9sBS=aplh?(PF#V`j9o~>gi7CfBo%#&Dx5E_2hbDv1n32P zK|Wb8SY$p0J_Gsyz1hA~#o*HNbD%FU02oLGJ&W|?sQ%0;mO_g1|Dpx~gMlGH)(mmO z7>6>FC21%OkBTFJk-#XfKQ&=I@Kuz54U7iH0ApD*E~@|IS@78Q!_LYC)_fDyPXuP) z3{lh+;9H=qfN}z+0@Hv!z^}k`U{2GnfaTa~v}Je` z$U9@nj5KGPhAG_56}tsEF*|N6<2J_aj5~mBFCrAR3)l^`Nvr-sBQhuMS;pAcFCs)J zjGi607x<0loq&7-_5r^GuYotfe&7Ib3AhX#1P)Q>OcKs89tMs9$AKfD2M_}NAB^-p zFXFjgM*gGgffqOJez~8`4;1-)*1FkdqhmpQM*7s%P2J?9@BdfTG+brH;?6fZUyP-ok<~|Jy z@C8)*iuc*SA~=5K*_fFr;a@E!;W z5Cn)q&`U9lX&6&6rejIzn)CuF6kDYegpxF%CX7u(ghC@$HWtt%8asMKq`80=0u~BbB%q~$Rsx0!7$%^# zKsSN$iGW_z5CQE3bQaKs`lqtkUO-0yotSr^++Ib3FKAR2=_4a4UjQNARX}$EJp^=P zGt!V5eR-s(fRyi#(Dyay10SCX=q+HNfG-4mCZG@Xm4N=7%rNAYhb$ zuLO({Fjm0V0_aO0qXkgqDU)L>RLYi;lX9E@(vwJ8Q8kEsL+<^tMwTfpoh)FAfbRs% z6!0xA{sN{8n88V?CeyfLe_jl}%tB3|Pnl3|RQXu~W|J!lm@6RV+a(lBMU&Y)0rLec z;2fwXDU~tW=oGbB!1n?+2-qlKiGUx-dG;r)6!0T;6!YZ*mT`Bb^e}xbg-ZO1O61s- z@5N9Tt)d|iu!iffR=_&$XVOz{G&*FqUO>>*%d|}bHVgP!z%Bt>1Z)+sgYxGur)(3j zohzAAXHpWOu#9j~KB8`ZA2J#ySi-3rp3O-RlXZ)gwWfGQ4kVMELZiu)kLJ^^g z7$;)92u*}8qN#{xA`B6xh@2vFiLgZ2RF;U$A{-GeMePiy7vYKYEf0atljB9iGAA)k zMA59lUY7~1Nz0fn8oTjTuFpG!} zM9>Zv#Luh^*Da@hC?W@o*%BI<~!&dPuHdnu`Eh^Q$B&xVm$i=&Fxi6>rH zL<1Iy*Ar2n`JTH$k2Mt0NJL}SG-0HoNuPqvMYIsnS42M%EjhN0h_)hHF(apPiI^y2l8D73 zz85iB#1s*8M9dZOt%#{2W^>wUjFjz6Ces;bFn%ZE3iklT&SK4rtwBMnu7&5Zxc=0C z9yOoE1tJzQA)7@^a(7UOFJZn~#1A5V6tOgFvx3Po#^oY@ViI~C^f`rqtTil> zel3%AjO#^gV3LVbZ5FXb!~qcpMQjzZO~fxE_OQWrBJ5*3MC=stvxs>m)!*)h2zQCt z&Enp>p%e|3@++tMUBq4{zcG@2ACs25!uz9|QbzcYh{GaIlf%$DlNfVE#Gf2{l<|+K zXd#Cg_Vj>cXPagq5Y#&X>1WzkXiOT;zS z|IN)wY2ZJsxz6~{p$p6h2~uf)f7EZ+Df_3rAx~Nf{QEP>jurOSoAss85#rp;8h`OZb@eWh9i9P?=Lv zY&lj|U@R};qYN>mtjHoA87oQnI!(~$RC*N&RXJ5k>D44um+&Xs*I@gajATp)$2t<~ zN*E$xsDyeF>Pu)Xp$!`}kkFLLq1TayOd2sZme7O=9aE~Yt2AS=Ib#b6Ev4X*s#c8j zFgEeF9Mzcymq|Mb?U_&=Ixy)dp;J_o^K^1o3Efy6ETOxE9uoSo*i*tMO!`RZMMOex z37?U&lC1#BW`79-m=BaNh{^dR{R;_%WJZBF;hI_T!z2us z@U4WY624^RC<$Ll7{Q!uMl#tN^1hZZTEe8LehicG62_9#mR83x5-D>yJRxfHjf9Eh zQHe1Ft_6isn9NaA7`xsJO_MNP!dx0h2{R;oCt+4J?XGKqL(XI|u`r*UFrP#7l#k04 zJD)Y*OIW~UAtUJ*Nmv}^FUzV+nEw#f{K#Y}d6yJq`;&wf^3H!?^Sn7_*ue1 z35Qs-i}6>+-Hg95?qQ@0?Y%U)BYk6ex1b|j5lfZ+Zn#aoQ@;)GsN6w z{x2_tg=1yJ$*3Zus*HFU2{Q7_C?F%PjC3+G%g7=l zy^IVpXsSjyd7_LYCK(yG)ed|(nRzD0HsjUXd%`{^p;WUz4O;qvj2s-BmGMJH(r06m zUB->}$t32Kk&89C8S}_^&vPxWjC`z_cQ=%>7=FZJImUuA3dtzUyaXdNH5mX=YLNttMD&PlQ4~8FgjUW3d)vZ5ef#w2ccoq(1Y8j3hQ-(rByKNJe8BO``f{Oqw#% zD?-hg%;nN4RZAJIWVDvihV|_k+cLIeB%1>j)eg)%Mm4nSKIyy2_(Vo88C_Z5EgIXM zNe>x4qnhnh9P`g*^p(*&s{c$zALg5*XXgE6e8HOjQJVoW1~MP`ebBLkm=BJ|4q>vk zqcU8^mohF>x62qIW2B62GPcVYCF3g@Kgjq|#@8}Nv;7PiW1=}sk}+1sI2OkixYv#$AFJpEzb`F!d zGXCaKSP<1OX0niR5#y3!!6NXzj3pfIejCh`r81Ur>;@UjnUHd|jGv->1(TIBRxxSu zYtV0Nn6G7ACu6;gvt@$$LV;?&QU34rev^#NY_o-tVz)98-bQvX`AxFW^Q^xh<06wwjQQRM zYuZ&Af62(EAiILUWn7b?DbN-CBjdV^moomPwME8F84qPVl5vaE-eaWXx0&2wyvtbW zZR9?a2aII%HM{p?7N0Uckqc@gFR!42f}9F+DafrLkAhN4 z;0AdWcL18w_ui)8*Z~^AzlOHiD$VlaW{75UJps0cptSQD=n1`=;)aI6`m5g#~ ze(5MLqo8b*mt&IHR;Z|;l7hAh+9{~4po)S93L5gDR8>$zK}`i8M^jZ(=z-fHP&KGB zwOC)5v3As^4wLTl0)u)A>a$quaM1Y_8YyU|pt*v^tZ%~DlreF;P`YAb3+80mT0u+Z ztr*wxxRbsOb>rdxe51WWS9yUibx_bzL8oZi&e3vd>7ZB&T{)_og6>RuFdpSRdl6Sq zQbQ>Xy%l_>ptXuND*7n+T)}MxcNFwh&`-f?1#1-aS1>@qLz1XEla#kbW_=6!WhbCwBO+mqv97?yHQZTcf=AjOAF;j8ib4 z`GlzE8zyh!6DKQ}qF}Lt?-hKjV5)+J95qeBbOm!1%w=%~<17W=DVV81}+%cC|wF!@ozQU%MD;JuY}iNTfBemmx; zsLcu{D;2C_Qn7N-*tH7QDLA0upn~-ZHYoU2!CnO$*=Cc1%~WT;f+piF3U;u5E8{i= z_uodgGdAfRPkg6>pIO|c;1>mZnD34nq*#(j#=mh6lxNCK$bBsSu3$ftc6@GjNWozR zR~7uF;D~~w3Qj3F%?5uc_>;*o#^a2qxo0TP6D*!&Ou2!4M!`7+=UH<$+W!|=yv#_c zE-JVbE+ zg`@@##XY3eM!|ChkCZ@s%=m=yDI+N-zm9#u{GEdL3SKh*SHUYLuNAyy@`jP@e`_WY zo-$$xLn_j6K{1S^NkwmZMR~S&k-G09VHIGFz_?{rkX%-wsEB2a8nw4nXi=`KFrwUK z(q^n+M>S3gQQ@gbZXlf;ALJRw%J`^Ff{L`v)2V1xFZf~tVWNtRDzan|OQ}erv?>kEVwN~kEwQBtdT5=*NnqoS;eaw_VmsH@WT0V=4duA+4&kwQfkRa8_}F*;GK#LCKy z8MBHXM{TOnSZoZDan?5>GOMAYrixn8*xD*cpOPD;t*4^CipDCMsCd&S*qE0>0~HOa zR%*b>AO)MUK{FN2nWX4jsAw5YNXaR*Qn6v3+N@Qit%`Okrm2{&qP-gYMgAGN^c8ea z(NRSwmG&{v=r4)xDmpVKu?v%~D!MW0dpbG zi;&ny#pf#es_3WUOBEwj^j9%}e9uc9reYuy;)9rc!MLiLI#>nakZ9~s6?aD@kQs&H ztlS=>5g(~yjEY?IRpO&q{}tocjH4MT;aC;pRE$?KLB$jm->UdV#Y7d8$ph!A6v~HU z2q&>P^Ie2^#ZU|>>9w7yG~7%`GlRTQ#RU}?Rm@Z|OAXfNL)0xQ=BQY!VjXMdlFzGH z#C#s(d=(3rjJp%O=|*9(iWRK+Ud0j>KQLdaVi}Vk8RKS4%bAe*RcvCinUQSHzKd*Av0cS)D)y<^p<<_s z-70=j@pIH>7b!mr4nP!Q-Up@c;i$bTepQk4j&OWipp-c3_h_mEO!ljI$Dev9gM&05 zx$TEl9O2lbDvqo8Q^gh^zq_;tScbF4Yf7*klJ zf-b4JtU}eGX}F@|s)}bSp0mMUD(;XYsrXyPH5LD`l9Jq1ah>@M#un*3Qc}1@>k@17 z{`6n3-c#{7n(Dra2P&RC3O!WuNX3n{!JtrR*EYZ>DxO9ybEOSB@CB{g8q#QZsp4Ob zdZpqmb&-nKEWU}_ue~9>kMbBT@Ual%!y<{Pn4DPuUwy(XiW05=6Vv!z_CeDn?wy=7D*XdBtpi?8Zv2!XlTDXs7W^VnJgMU(2$SKvNC4ZkVC_V z(R{LLsM|Ey={+ZFa%;$=;j7!BTw1VA1nDW{)lm9&=q)=~|0Ci28VYFmNJBvl#iIEX z(ok4K5e+Tk|MTZ*uOD665IhBi9d>L^c5 z)^I|@NevY>RMIets-&T^hANc5hL#$tYWP?~V=eetb~O#vwct6f1{!K;s7Wniu@+-( zMvA4E;_EQ)^FDYstRD0FjGHS4PdYVZ-iR^9o-%Kup(&R_ycv_`jQXcSD-EqR^w%(e zYObNJh8`MvYG_A8prNCNP8vFBNO=uE2W4=(sVkV0iQ+6=;?3nuYVB`nZEY+}#$&WN@|AgCX zG0Rz8$w;OD#AJo`-|h#bS*6h(gQV3ozL^yg*J)U<;UJrB(6Es_S;KA?H)+_SVJq{^ zj4ya(w=v(rxSf&wa3>SW@Mk6|RsBW7UJbvoW>1P`wEy>M_+6ueNZ=~_qiGM&L|7Q~ z$prT2LmCciIKr{V7>_dkL0w0q#x}>JY5!zG<(|@Tn${~FnRT4ea8`q$L)39j!+8x) zG(6RCLBmD1zo+4nhRd`%X}C`7zlN(CU1`Sr&9P0ipn894SaBdN5enB>e}s#^L1V4q zwuYOmJjY7f{NWCZcNu9T2)%o-YtwxV4_Nb1!y^rkHB{>uWJrPPd_{?Q{oZ}1;kkx4 z8s4(y3tIU#{L9?VAAZGz?B8;yz1A=;-GBb`PD4mXj2^5Q?`bqI1h09f(vg}q^w2+v zX>^2j&{t@Qzj`03uppR^DLpUg!J4D%Fm%YwNmO*GIy4r~{uv%OULYkUF?D!4Vs$M2 zShYB3o6%u(8L35aI^uPt*O5U-f{wI0M(~P6IZ*eeV>8;?V()7qk$IAiWE~lqlg;P% z<1;ajL^bUiYOlv@iAGcQ60soo;tGY$fqN}jvQ3FUQ`uhK$=?!$O{V|!08*^+k9nG0E(a|(&U+zSZVG9;pGN#Pj zRytb$kJwH}dmX#zSVj+)>*%QCCmkzvbkfmT$9UFv(a}}M7di&%=%%APEBor`p`)jc z&sh9KM=v@uifV5ipE5~7(ooJ6NbJLwpEHt%qWbCRuVX+|Gf)S`k|l+dRD*R4(=nXI zA&f&A$?QvVJRM)@_?k5%xzJJnlLKWkTE`e2V|9$fQ~)oF}GrZS;N5T`S_eMTcbQ^zbFv#D2gq!^UB6(T~hDTHk1 z>sX-EW@Y$6$3h*8bS&2K{r}jLWyxD1LMnyuN1BE@mQ$^At10DD>@pT9TgsgDD|M`* zwj07$YTyuUwT|6)gaft3HRK*T*6AqKUEQE#qmK2=NsJjT5N^`3nKdc;EzB>qQ7LL0 zEdu>j3fr0NVBD$WXC{S1K1J=;@r#ZbR@po{m#GPSg6Y zuIRX`;{q$sElW*N6fWwxq~kIzDPP8rNSG4!7n}W~<8LO{bmXZi zQlQxDthu4%Cgsfeq@=ygddlPu6H?OallOJJpb14URJIl$FnP%MNXKIxPjozG@j2r& zMzU-f^2_qOmM^24f0?|}@mj|l=Cm33TPD@nGGw6W2O-0NX&}ZxDg&vFU>`q)F%3Ne zY5>edMtZG_V%t~yZwEh#McD{;)g!&iA`#7i&b)A2jYJBTfwTtF8L(OJL@iwdo`F~v z;|wG)iD&#ezQ|lP0YtWx8LBixdlKw=ducg;Bu&ICW)l}ki3~Fegk%6WLni)7yM`&zd zP|xHhRH&p^+9f3A*4o7Q&8cbBir7p``o`bMsKzb~7UAJBerp454D>M2lZr6V&OiqP z9my*U(0&(3D@C$YiJUs0JUzA1iJJ3J>ujJ46|^mRag1+dlDiuCrc-=(1KkXec$k$} zMurM6kNLzvF9UrI^fU0Of!+pf59sGh<)4f3dvr-P=WF>h1APp9ZUlQ=(>rKyV|*e> zRmA=Vz2dF!{9UEj*#=OTB6#I(kb%Jl<{MaGV2FXC1|}PrVqlno;Re1oFxtSEG@2K* zQRD^&G7eNnP}FnM8WKh3~+BFhb2?;swJ+h!F>Qx|od$k3Xxkirmq8oR_=9#vh$p4-iSIG+tAR8o!Y1|_ z_|3pg1Gfz9Gw{2C(+18M*iSBM;HZH=3>-9|O_B~77}qH_c-J`r-2jXtJSoVMz9}voisjiLgMrd)}Dvdvj)yl^$h%F;5^T}3kEK7 zKhro~GH}_TjX`|!x6Wz&D+aosPIa|i@G2sSgnv`fY5aev|I_%_I8~wXX|3V8@OZOg@Km_?i#pf;1M|kP4E*5_YM5}q5jao0}lD;NpWF+O({LDd=awHHhimPs#_`!*F9_8sOl3y24!Q%#ID5pN>F z#P504I1|+bft)|B8BBzikF-BjZ|lHdsmWj>(L`1gADYN$BFV(#t!fq%$!wX)M1;xV z{+iDuGvhTbg?5sl9O}$aKVap_0vbKem(4^D6FE&}H*xF3;JuFo_`ULpAHiSpg_O$# zVQv$1o5wf%O3G&jN|`8a2J?=>m9^T^Z7Pv+Cd!-mm^y)Kl_VZ& ztyeHn(L^N^nf}qLn5b%E4gAWCRNsF;UmVG!xTJ)H6}v#3v?tnP_05A@zxgb|xB`Xl$Z|iIygsm}qLE88ynp&y|DD zxp+vu3;(;^;-qGgDlf#y4zHC-H$TUB2hT{gdqiBAQe0_ESlvNlfedzk1+_F-*kKK0ytcT;1v z&NPX(?E92D*~Cy2!%Tc;qK}C|CI*}M+{E94*w;iq6OZb~ysM<=4T=3t{3`eZ$!SC4 z0LHn3|3L7+VDBPg4A3Uml!us5Ym0*DuPYiFZsJR-o{0%2Mwl4Melo_y{1VBdOnhx( zw27}cP*oE}pTu&aPl3d-)Lo)KjwXUhuNwrKZ_MB@I@!b&6BDU2=|huD%o2SH)w)X? zSIJvN|67_zed4E5&o>Ow87!rmL6gqJHWS-T%p`jg%T4@bVz!AnCKj9cp1hH!r|2&* zvCzakngXIfpQ{=#1?3jqpS*Rcx`;L9Srd2&4XEV*Kn)xb+{5{6Q{s;%mYP^bJt_IW zHxvjd?FthsO?vJTn|Q=mnOI8=FR8CK>B(51!Wt&4b8G8pzVs2+o7lhwt(N?glK)Eb z>BAhGO>8xB|Gc`z#Kj>}MmflN$v-$(Hq8zbJ53y-`cwWUcA3~mQ{KdG6Tg`Fjpo#O z_hZ@bDf@e<$EfRMfA9Yw{Xfa&I%=O>NIqeL0%<7KDRN*FXE>0kDLw@v=V=k6DU(IK zM7cGMrx!vmn!)0~t6eZ&tM>?HYoxwv;xAeiEu^>bw~1>sDNH;!@ej>z>IxGNOx!SW z)5IMUcgeMmCfqV{n`ZjcNUG=3u7#acGSzekJPUUlr6P3weYWrS0++fNNwRYt=NAH zukt0lH}QtL$izGDE~@+p#ou>TrMomC3$qkI#sYcjoA1zi%xkdFo3+GiomXS8$NwDyT7N6F_>Z`$vuIYMdF`8fUUu3Y5XrZiyauzaL zNV1T}LS75W7BX4*&_Xr~5evRW|D38>EM&HVXwGc^aDv1@+&?(tp|HK&DK7TSL%bd3vra7)N-fsopp&q96+1uYb!a(|1A z()V+*7u~6JX2|E9`uut=wT}!6eV$4Y-z964k(n2W4c|>g`-KHtou21pH7~u zQO82BZlQ*SV!mGepjwl9ex^3BQ#>7%tLlEOlp=J$u7!FQ8e3>$p}vI$!y*kWgtgyN} zHt|afBPh2)F{OUiD0DfTiq6tcUW)t53QlO>>HfwC!Wimd3zIBNwlL1ZcncFOd_zq* zq|&))$$RRYFVj3ywPhvsi8PJ}A~iypG8q083*TCpV__~?T9{^GriEo?^yxf6MGSw2 zg>(E3sqdm*K}tG2&7!X0(0*4iO!F+vr(U8NH!ea0y?};tgmyHyKIKgELgHDHi7d8) zvy1N;iOk&_`O(5s@*J99RH%jJ7Is+JY2haeD=ciVu+hRwnnyMDHRRY9?sbS?MbnTb zloFyp@rU|)XT#qzKwC%MX!z&r3hTL&L};3Cvar>{HVd`RCTzB_#X|0`feR7R*~oTs zfGje(?)_dd6n?g_%fjy#_FLF(;TH?PTG(r04`(=|X?*XbxOqk})+sY_jp6@hfp8z= zUc)~?ixoMlMd!EvZNuN(Mmc2RFF`+SfkNHH;6yjh^hef;9J6qoRxk@!E&OTWgoRV& zKUQ#7Q>vM^>1yO8H9xKR?u|3651)-nB^IrV;~e~Dbq z^e=OTiTp*2zlDFOw`mq=-u~|DHR{Yp+LC6ns zXWje8dE(}3DAY&@{=kXBb4X>2^Ab&OVZ3$JLr8pS`M$y+`0oW?P;{?x)VS{W_~ zZ}q@?Us(9Aj_{J)vV{J6pGIg!wAU8iTL{^7F!JA6cx&MutxhV4KGO2b zJWZ?F$aOt61=EIQBhf}i8@3I{M!by#8?Ft{My!pMg|)cm8a)Fu$MRQOejHhjQR6lR z8;7Rl4A&;hvkQv%EI*x%^fofsQ0$=VGTVMB+fTBQY$J<}4{T(z5wWqkv$)9i8{59q zNE>SVzKz>O^vsMmuFF|%d`Lwnc`tj%X0u_|QP21yosehevhp+)ezW~tHgemjWuvx@ zJT~&$C~2dVjeIup+bCkAsEqZH%$e+s0=$hS(TtqmPZx zZ49t6kcQIr``YN6SL|nF-`F(EUZmPHHn~4(;^T;njM!h;7-R=Gnv&eWe+JX|E>J0C zb^T#BhTHg>I-!;NrHv6brWTXFvN6)eDDDs z(swpy+E`-a2OG0&%(k)E#`iSEJbw6 z?dimCX%`a^nEnPn+Z+!B!?O&{!U4{#_cCfnP4~w57{_u;}lIvss>en3f-H0g4$&VHzl@E zpJdUGF(>gjlRp`ACWI!?-VszcFYt={xwT@`wKFt`54E%0#;2Zt&Ze^+-;DJy+PFk3 zvyF!~F59?b;KrGEAi~H{?| zlmcQ~=r3$M=g>AbXa#9rQf>&22yMrx`)UZIWBpEjq&GBK4r+9=pw-Its)xpOO zVjQG$@S%fj4pKWv;~?Haf`hO_y9L2?U^$?T+e8Pl1I57tE=6+CbZ=yRtbc&SKAP%) zE~s?}nu9B`J_Rb>U?u5a#`?Ac$H9f=Dqa4#4m`@Os5a*-p~QN1M(5PA4&oe~f0T|= z6>KdLN$Vh;1K&Yr2k9MTaFFOAqXW8DqIr7erVxqqlN=;Fh&V7R293=`u`L6apzvr@ zu!(o6I6r?aF^hw&PN1Z}w?3d7^|{skABHmZ*)SI}a92lR*X*&Hz`*!sR(zyaZx_2TK(*MbfzeV&F&DdGelEGX)r zn1d;$Rk}@G+(8NI%p5w+(8h6oNe6^vNr6Zi2W2U(gUSxdIcQNu9~|dbbTA|?Q+dV; zjAT5uw>lv)RTXXvUH{UJyV6h8ySeph4yrro>!6>58V+hYXy>54gIW%1J7`XMI;i8I zu7idS8aeo?f?Cf(_Wtn=nAc~V9_Q1U=f*gn{w6yc=QnoH#KEsiB2B6C@qRPr4=6T1 zsCi2Vt*Grza6a6vS@2DV#_|5P&(&F{653GpoZzo#Qr2%Lba2qoL3al|9CUKf*+Dl4 zk1i$j-kdy43r4Mr6WmPb%DAGdkV}+5iT8WbFva_yI_OP(cqaK12fet}^yNxQvL@dD z%t0U4NJo-a=L>)C;6aDv1Mxm#e+L5`jG{(480g>&2SXhUb1;bQx82c(kRQhTgUKO# z3K@%puf_YJ1b?`LFCC0<=+FtbhuUXc^0s!dbUP&}A!zU8K`~Vm{I4C1b}){{mu7+C z(Md0@_G283rKTnLbf0QVTWNv=I%0l9Eo~bt1#*ux=ZoqC6a2~45CNH}0Ew@0u-3sw2b-wvonqHf108IjCa3YX)Q_K$;7`4v z4O9Xj7*asr?BLXm@GDc^!sTYnsBNWbn=z=#4hK6O{O(}CgP$Gja`20TJ#03~}D)WKn@HZ4I3ehNNG@biobwq8H(;7=;IvUr+C!NEzYC-p{7b#Xg2-SZFys$qs% z$@?SWrJ{(m{yAEX9Q^Cx6?uz;i{zgUozmcvgUb&7c5sarz%23=2UlsKaFCSNFOW8H z6{Tnp0#S?GR#OW-xuN9oj-EnZ&!D9zc9NcrT zH?9AWN=fVACx52t+%)5~Txkf&(n#k&qWT=gfT}T1X)#Razi{x9d+(Wp=d_G>N|X3J z$aCeF0$slsOy^JND!z8`hL%T{PLS}{!8=;XU5GB~rSsp@YVV?Ul}N}%jEk=6g370I zF+80=Go5etk55DXSyK(WfE%n-vqmIPAR@VtUEFFPuergMW}1qk-$qwl5UMUp)Cfe~ z4L-B-JLhS+uwBHthX?l+FhueBj#c{|JP3OAAO%3>tY>ZKKLt~xv7}o zVspd9bS~18af|rUe33Q%)A;mUlblD?j4qN~w0F_LMY4-bF3P$n=ORMYa8bxbVHcTQ zWN}fz#YZkapyFKQbdk%&`*i+?E^@e-oK?@}BD;$W>HWg#{krLWBJ(rqv@u})Iznz2 zd0gZrvreh#X{&r(G&MgzlO3x9m%ejeE9heG7U9jQpl2xbNbeVMQPf2#7o}Ykb5Yzy zNf$$!#Z!+Js49M$-Y-Eza7wK-Ds_{C$#m!8cu~sM6o~HNfxTx!*nTzH$`Y!6bXyT%&iv}(lx==ItbQxHFq1wnrV-D1o_a_4lA^p`w z_mt>8&5RlR7A{(H543S{wX{|ygWrns%;2|nF?z62SWpQsk5b!Gl}4%U7%8icE;_k% zGK|qKI=krNVvvi$~gB^l(AP=#-7QK5_AR2A}>K=;eZN zKxzFm7j%WvpU_1gighs|gWuOhKdu;YTA6oU3NA6I+5>46e0@qM;fv@9eppT$;$o9nWC!1(W7EOAlLLm>}8xcJe<6BkdZ2`-ko_|wG+7t3AzD#Xk)N z`j{F;U7V4y#l=<^J7^kKjcj9^*@^ykT3EPU^fWbzw2tj`|69#=yZFV$5f?{Y>~Zlc zIRK5mi@oISF1985^y%1r)TNnH|4~jKvq3HTRvElPJ3#BwQ5f$eM+GQ74I1FW*zg*5uy_AcI0+t;hFIiEL-HC0a-9Lf%(dhg52-v5p+H5X@o+o89`=IbB3!QMLGoaFusp~f6c4&b zFWTTeAKwctPF6i=9x5c!0xJ=&X%X8iBG&Dvwn_4B4~~ae4{>z#s$@T{hjbotdC2V{y@w1QKJbv$L!yU_T%{}?k~}1Ppd)x@ z51BkfJosMl*E5BawS(zjDA}h#BJud=p$5r*?_~c&57|7>V=Xy7WcNU;!RTb4E(3FL zw)EE?8IRf@`5}@%kB7V-@_Q)Y1<)%R0n@~eBO=><0i zsj4-onKktcnfzKFem<{KpnH9VGWm6ALC6%Ot?!`$jlPE_9!B+u|9zF(&_g2+)j5_7 zT4wT_dT8dMCG~mj$goU)${)eaY0#^REj$c=tP*MEVL(%%wTH_8Cby`fPR-=E^U&VI zCmwov=-{EFhpryFdFatz=;WcZ7n~t)&E(JdI6~`l7Y~QI#O`E34jc(q?{~gVbEhYb zW+s1g``9z>V?XuK+rt+g26_0*Lmv+Vz2Fjw{*0SaNc-GFUl08}(8|!C>O=kiR++v+ z%NX&CMuNr?sS)vqNBqH*%EJgR_>YpVHHK0vJhWI6nH}+mu>%nKl4=<7DNw?ZUhov( z9}$0)2SU<}rcv|olZO=^#(Ee>qvm0zhw&aJc$iE>>ERm>6Fp3#I@gT+I4k4BNN`)s z8Xg%jO#7~_^xNSK-+GwpVVZ}B4VDaQGFE1oVo;#iUAe^L9{!}BX9L1h9!`6B7K`VxIOE|g zIbke%#^M}xIITIc$Qp|a9xi$iVY_QKcUi@?bx}g=ZsHyN6R%Y?DRK8C>AlXNE7@2m^u$ADT?mx?=I}KvoN#d4wGlP zCy;Z_IY`bqNzO^KWDo%f5(H5M6hT2y5R?oO6p#!80+O==Dv0Fo>AUv-d(Wx!oZr25 ztGc?ns%ECA1CkXaDd<9O?|Uwf01ufX^3OXxjsqo7H+A3(r+7z^52gc1dakJxajiYI#d3ovz1)obluT-!~!52In{*+;bgf$AjVpn%_@TpvDC3w)Q)Nd55Q}DHd=Yd?$3#2jeQdnLt(rZTQw;Wmu zPAm9D!6ptQ1wSb`px}ERUj;iA>{75r!Bz#^IZqYbZsltCZsu*AP`|nKqzu%#RYP;~ znEWoY!6Ap5a zD>$OyC`aiZuAdb=%wrzrnCzU$G_`Aner3{*NrlH1oKT?UHLK+{+thQM9Z2UtN^IYGxM6=?}fJHHE*#K6#Sv!K34_>ce&lX=AZkW zJRhE?f6_g!nKjaQt>f>Cb;aX}yyn6qDG#_u3jX8*n9rPjH)UT}*Ix>n2QkWlvJAQTom36kc@4A(X6Q-4Cuz)O;r23X`J3Aptz+pQ_?L*)&i7)7+EK{K`yEGX+Bd^ zp{t0i$jw%%@Tdr=2&(X^)|oV)gz5RsbDcB$RTS=%#KcX6RPd5ZQ$<8YSjE1sPD7Ny zPvO0_(xNJ#Nt+f^@vGBnQo;NtuM5hfBCm=9EUO})iu~-2dInGD_HL5e;IOk{ev@l{ zA#O!Q3GRyuUcp;L#T%v5imCYE$52sG)>d4#(s+4nc(?p!DHYY?+PM5?X=yD3=q#tA zyoxp|+N!9a@?QxwP|;9DB^8xb)KXDfMHLlQRqImf>MBo5THk4_skpJx8k|iUr>@!^ zs-dDLvv!A==nM==^_Y?6w)vaRL!jobOndMfIx_#wY}I=?kYsEt%KR?$>NGZn*I zWaic8qi=?qsMcFq%T`ZouA+qs{xjQJ1-4{w$&JoP88$uCiU+8G$+Z8gtoaI<{6XDL zMSB(9RCH%=sOYHj#n59v~H?RE$U6ES)gL3iWw??FJSUQCpMR{ZENF7>tYL4f*vNfXv6gLk=(=8z7o6j#g62AoN%r~dj7z=NGg8*8*uWjB zgSUxPH`Pjah|hptn;*rGb$2WrW~B( z{Du8o$RwOqaZUx#HSz2di)<@ocJCj$pyHy6-#A(Vu00D}Ghb)CQpmid;xZ$9SgXnv z6*LJnuX7S{fN_^q+*EN(#T^xQRov#tFOzoSd`ik4>%Ll^eqra|Q?0MQzpF?pZ1v0^ zD(>@0)k}Mz;-QL`g-vo9$s+%);*p9cD*k2vtaI`vmn_X4kGXe+&3`!HC2UP$^C^b} zJD=T{V!boy1!u$|*NwvFD}D+H)BH(-UrU?Ey^}dfLk11)b#%~?QA4tZdm4V%_#zpk zXc(zslm>@}R1LK?)X|VhLuL(z22%rP_qt9Frv{gXG!0oaY#!|NX~?Q!#X5g34GJq< zre)KRT|*AxoEpA%xl+qyr2o60Qzxx)sv5rh+~wAwX`rc#5)LoV;gKw_C}Vh%mi7BJ z1Y|=&(U69)hNL1Uv-kiRYD5FiKK-!7Sx7@vLrgp+Omi?n)nr7WfGp|b;--0ks!*~r7G)$ykcJU90cR2hsEUo37EFLa52r7 z0hZ2to;Vk3Sft@Y4U0MZK5*V@?_eS@eJ<&zrYTD}^}cW|)v$~`rdbOPof*5P()pyn zliIeP^HXk}Q%}R^8dhoeLc&&Zz`wT6-m|J}-K{oLzhviY7SLHUv$dFfrD3gxb)23W z4rn;2@!xi==h4)#SHlJk-)h*ZVVj1H8a8o9TBj}C=S<$`{Eow5pL4V5_oCA|!uL71 zumeY@)Zgd)Xj^Ezh8-GqYG9Gi9f`XHevshZqAQA+%v$0|WWkT#a&d{fS>Lr!!+w@3 zV*V)llPDkUPR}6?KWn(niQLxuL_4hEtcG(Mj%YZlVf$_4n1&M?PD&3P7p3!*hSM5; z(QrmQJ0|;i!#?i>`K5@p0{5Plx#iT%ziK$I;f4fU&~Q=16%AK4{HEcOI4^7XzKg>( zH8YF6EMoGd^J-D^nq*xUy|*x>P*JPG9`3Z8;_0XCOZGr@KnPy4S%uO6Pe}%gg zHJ`K1jS>=c>%~&M)9MA+%({-3qOU|>Yv}Yv209ZZCP|dR83Z!wNVYwbi<(yoI(WfY zs*bj`98n!H9hr1w*5TCQ(xK>3b)@O&cgdMUM@}7CglT5gk5sB|f2vS2{RtYT(Ra=%`ax}%sG(h=5C zx}nR^5fQ)nKO0J0?PRIAj@&w`=%}hAkB+=L3hF4Nqs{_nJ{_lzxT>vozE{_kUq{bJ z2?ccQuH*P7TS{RaMOd?rGCIC`m9waBT~>Xem`N_CqqvR|;xDPAl)$9EDa_(Ut<ZqloHXE#CV2>P6R~S5ly)|zV^$ne`+Oc@at(4mcH_*|LN90yYD;<3BP9xD~IvNYm z(?p=Dj=p8nXfid|(L$UpMQ`VG(AiolX(QTJly$aa%g3h>I_l`8Bko3SH#+NhQ^y7! z-?Gg$lDp{WrlY%#t~&S;Jf~?Yza;cv$LbibV}g!eI(lFBRpXM+dm7_4K6@IcW)y7j~=W-+~`W2lZ{I@UE$NcXI5o^W7R3e6EZM(P-) zTPJPa)-guMXyHdS6S=vC9TEv++2*YnCw>Aw6Ln0|u}sHuPQ$a9tYeyv={lz9)+N(S z?+8rQ@viMT**DV+9q;MZD?yiV!g6Hln5SdDj@cY+EgkRcn9J$V+A&ARj8=})MI5Q+ zTx(l7O0;&UMH~ybbsZn-Sgd2Ajzu~i7k1<==Q`2GajcbAa;_xft_*loO=8ltv z9Vsibvz}V59Ngk3vfZVk*(#=es^eNqWu=Z)IzHp@?qHoiS)t>__QcP1JWovw9dec~ z>ij~-8je*RU$W++mS?rV`H_j_wZh-9S9QKw*b2BXGLc!-_5TyLQO717w>g`}xiWN0 z{7%O)9mjQiuVb^0EnGUBuDv?;aa8NPk_X$xL+5TCJ9O;iakM>c{MJ{UhsCV#ML+1+ zWBd85lb-!L4(d20&L4IB#MzNM@qn0Fi(5sQe%5isE_GOdF-L9B%n_;ltUn=#`&S(& z*^^wU7Whx|$ToHG3jllR7p?&HGM&+JR>wJs%+xp&6WhQcdY+R)$3-2#>A0lhD*IXI zRYu@V(^qt?@9E^N(_2+b({H1`uHyz53JFN}FpKGy1oL0}J38*_xToWH9Zz*U<6bv) z{GsDM7k^=1aL8|Q4>=w<*z#KZr;fjL{4M4q9^Z0_H9I91EN-Uf{-fiGj(<5>`X;6# zal>{e^*LA3fvy)iUa~R2Ia{^Y+#6C}=}6+MzT9}NTd&4Ta9f%v%6=dh@2q8XqjE>5 z>PE5~aD$!{Hym!H3Rf*|(vwMe{nqT6-Eg|$a%0!J)NG<@qFF?4>j+mlH?|Zv%Zi5DIC+CZc{fV+NUh*TMfUkoov9L=BwWSzRCS}8aCO^L z!;PB4wQNsqH+Z`oi|;Mstm{TwH`=*T&yD(SG;mut0$2ao*}{#6ZZvYEu^Ua?XeNGU zE%PT0?(b~sM)UqoLUY^y)p~zRH(JRKc6w87Ezm}km#%R)+q==hjV^9{xz_0DMkhD= zF0{TCb2fEmnA-xTyTwf=!sz<0u5M&0VRjSk?&jAaE74QYbo6$kkDFJ=VP&7%UrnCRu_}+~f zZoKEl5;s2Kj<_+)jRkIe;I{5po$bb4H|7b?apQe~U3U#;G0hjVSfxaA^}LA-#r)8X z#cnKeV|!6o2g&+K{2z;^*N}6nt9Mb?Qa6^lvBu5Ym$2N8PkB%z<})`|xbe9gE5)o= zDe+YU$C`g!tK9fPJRS2Uvhu5}p>d|~`&lhn&BH3&TIJh@Z-aZRSvS<7dg;>c%!V_PDW^yW_?VPIEVQOV&;vWhwQ# zvsLF0Zm>P9icI~usB51a``!4-jRQQ;c@r7@qcpONwDX|d;6q#!UMI5@Q{~o)hut{h z#!)wpxpCZ$6C5E@CwG}OoOI)q8>j!LZ<|YPc`GHdKhL^x&drytAmYcbZk%`HtOw^j zxZuV`H|ly&&x7CGxa5ZBvHl8Sy3B=C_zK(a#x=L)zvJdLoEBUcz2U}9fm@>V-xlBl zGw%sJbmLEf-$nlrz3;{Y0me7Klkk@te~bCrjen*&9=Y+vjep&EEapGyI?YkcnenL` z&)j(7#!HTYG*>Hc8q;%5YH!-YVTtMbO0t+sPlCNKi5?``%&SZ@dXVe^#FOHIL!kVV zgj9hn9%L2BIMmZB7$tUBb*JponI-b8`sf^dOh*Ip4-$DOJpuCzEv#+`=9Y z3=d2Xykh!9{h|TUpeW0R1i~InC}Gl!co6lVyayFLh)Gs)4@!6t_aJwA5f2J^Q2ntx zuLt=&$nUYbtAGauJz%$F7?8-fe6lmiOocrt;<5U$s0YOa$mzKRZmy)%S&CbHl0cKG zw0O#hmK81ML9=F7Rz)!h)jg;rTv@b=?XN0OO>|g_vxY!T(NBh^)bgOV2X#Dnb4xPK zH$0%uF6^S#_n?6X3q1J1gN7b7@?fL~qdaKrK@$&pc+k_stAEjqWu-Q@p}7YwxkqBQ z5M?`C+qvxp+K9FlZ6}&_QfdbQ*3i*|PBwQISS5#`i*Q%bZXR^EV_G#gdI=8}?QQ$} zc+gk4p9lRt7{E4Pa+GQ39OMCYps2fo%Pg8mbBIK~WtSc5!7!VLdoaT0*hOnxjpnHE zV4??a+x{^EV@1b_ju+)zneg**4bQvB`t)Z2wjdz8BssdaQ)G#RDoEuuVK!t2)R#gm-#yZMfAl_3tG7 z;K3dbPKbZ62m1tm_F%ujkD~lc=V~iOUzRbo_X+x2lvH%Ao|#Y zhXQ|k@RtCe0`a%NBirPL{t+fT@!(%!E}=A^3nzNf>6X=RFFbhZ!7Ew5xTbO8dhJ1i z*IL%Nlu=K;k(lJQo~M_=i^&PrbBrOonb`}c7b(IH(Nxh)qI(uu$JFITnwYt~$Ra>z zR)MLF60!+o7tJA>Q#5IT$}lFyi{00f9-V>ih1-h~UX=90#l7I7k-n8uUX=EtjAShwouRB9Q(2v*hF1%ZlQ zRI)w8mZntkqN*3w#8cgiACI8f3@5dQ9aGbbS~jcB#5cUC>%|c-j(Sngi~3%y@FHPc zh6Y|V^x`cqa-MTG@}jX9J;;WGsfl&C(OS%=qRrTTJGX^EOOE;PT?}sHMO!c4v~$~e z(ZS~S0{6=%b`P z@Y`OD@nWp-crPXhjPw5g=R8mJVv=1d{pqHBdJk)uBF=ZbnCi7|1AJG^^epC17juT_ zdtS^GpnrTxbB-79d$HJykHk6Gix2GFc>?oA7l^XLg?8>Dfe&r}#{$dj+$COoV)Igg z^wuu-;#1rIneG4Fi$W`mxu zg}?D)y&W@nbM|kAH+r#&b0>e|cV2uio;>-jH<&XmENN1=h;yqK+w8L2z1ZQ!PA`TY zO0g=Jutof<&WnRy9P(n1bvXWeXU9G-#wR82=UnhwPbB-vivt3DqX)0SPJd^|&*C{O z${0G+{l~mG?!`?XZuxM+i<4e#_hE+*r@T1rMP(nV`0$GtXS~SjLpC4IdU4K+KfU>+1FhD3(_?ZqQba32zV zcGMVFFj4Bp)*P;P4^U zhm1aJHz7($7Wh(XNbzB(-*u#vnaPLDKBU<(P9I!8)X0$NQPcQDqj?t%7R=(qvV%#U z%htBC`;fzjJdF1trw_S&h)G$+2h|6k4}KpsA9NqQ;&HWY813rX( zFnkF55R#ahZBx&DlcloU@nA4&<75oM{;K0NDY zbv{#BAD)&rX_oh)f&^6bp^^{L0U_qHRZ1DFkyU-D=EE=_hWk*R{psVaRcP-+O&@Cc z(AKGgQ1j?~cDhc|qv>q7&3i}eKR`|!sFowZexIve`X$cGNXboS^KYT`pviEJZ- zs+lkkQ%ix?qOC+3&zLsck%|fAwmz_X2_1as=tFlOdPrC&(Jnr87I;&1v~01fFpG5a zVV-z;`q0aV{yq%wp|=lxeCQ`J=|{G&@L#j6>63mC2l_C`hquH(SXwf~uG8CDV_3AT zf2erAeK#}B5k8FcVZILwd>G}!Xdfo~FvW+rC1!%?7$3$8j1wL2!xm}Vg)(N=(J2$f z$*Lv^%$b(?9UrFpc$XPwiRWF>={`&ocqCSsQz5dOl4&)K~h5?A`Lid`|o3S-Jx)|}Yg;xFx*ePzwBd|2zl zMjtkbbDa<0_^{rGuk9GVQg(xFe(M8G)(~#}-w6NCht2FpAHJ9PYn7}c$h1|=ZKAV= zS;4iw%D&TwT|V#`iKl$n?ZXc~{4C}kANC6TB)U&@&CgCo?ic=1^vH7;JqLU^DCQwi zEt?f~I6c6JqXNf7kNYt0RWfr=h)FmpP_(RhnjZl^oZ;dxp36R*6G*S~S0B!cc|r7& z4;Ov-jdQcC$x0@O5~jaOzT(4GiMi&(4T0;TZEGYlfQc2}_TdiKOh2;tao2}?KD_YZ zrO&!D>UXYG1mQnK@B8pT;Gt-(F)0jV`diE=K0Fe5Ec%Zqb9qG&^aqFc5Ze*G@EnykyALA?NR(th0l-7%(6_nm~KBj0$x#{=#yzK1_Xo&L4lBH zSkw?bm@_fzN6e3N0sI<3+>hLT-u;K%0p#%`uOBP?_}q_te&qL~l^?DBDB$PYx>4Pa z8h#Y=TMvdR;zv<|!hTe|oIp=8Kf4s=#YwY-A7yPW=|?G>OZ!pA=G0tHMwatiH@6Zh zh`*v}CDF=$RPm##a5YheeLPQTQq_vDX?vRZQOl3oV%8C@FZzZbbp`5)=E|GMQVoO~ ziZ&8$ENa!v`R;Z!6|xTR$fHG0Bg1e%|;boWN*5-WC{R`^WlG&I2; z1O^c1OYQ>E5A4Xk<&rjyvfh{=mgXzumn zM={C!{Mc{v?pp~z2_FzWDEfR=D#H#7pZDW}z!5)=`f<#U<9?hF&pAI%3j88^O7yho zm2f83z;s5;v!Y`^GwAtMxQk5ui+)@a^EXlEUJ|%0dPVdqXR+Iwv)9GEAxiV6-+HOQ{eCw^%1M`BQ?O=nemSwPyBdg z$Nb9?D9leBR{qS7=VHF_I}dYK$>tC(X4_0Kfj8a)~LuX{u}}16euYjs|trjwE*-0+`^3a z2jH>UE8r9T?3y*j0>VMjkmyOn+KLf?DJD4*K-A`#K;{dsJOShlU`hb*1duO)`~h?d zpmP8P0w^dktpX?%K;Z!D1n>s;B7mX+RI=+SCQv$n;&lK+qv}u zsBd$F02&H6vOPu1Su1~&0GbBSEP&SClG1BvE&(k>TZ%T3$kqWqOw1anZAIIO(rh0< z2jPyQ@f-h*hc^T089*;_b_t-X9p5d0?!rApyUtKqN$&vqh&f!eZvcY@`iU~2e*go7 z2il%N0_g*Ci11sYLq&&)atw?JV5IP<044~qw$TB+9l)3X#@e270<~_Wj2D<+Ju}0Y zCW<*JfXQ~`$a3b?0NxGYivYe1V4CYT15Jon=nEX0`gdn0p#DYi+A}MGMhU}sl zfrad6b|wp=Wr1*iw03Fh)IpD zS^TLzvq}U}(ypOY5T%9FbIS!$K8OK93=E<|5EX-H8bmV*s1!s!fyzNt5vVF!OSD>$ z57YQ>A8QEIWT)NC#qHJ>vySK+qIHA#X_SL0z6gk)6H z-!+JCL39tIhvfDOqPIX#(dd-~wwYl}eS+v4M86=uziM@Uf4jEi^5&o*1_$v;5KDs? z62x0U%nV|d1Pl#gLJ$*!7#76vAV!GuZPAgUqeNNZXo2TPt-(Adh_Pah3u3&0zr6Ly zSkmX3B<57n$)fa65qL**XgKlRAf^dV58^$68KPyRlJu|TEHyibxk1beVvgj}^L`K= zWN4A+i}OR#1)?7WvCxiOM1J<)C&glMekA&_=#n5R@33;01+hGcZ-Q7a{!fGWB8V@A zKMP`oz~`b2UMaAOZGJ54znJSp*QCd!tJ|?Qh@OTu(!RDm>0i}0@aP1wIf!q?ztPU! zB=B93myBB9a<|z2odR1$w~1~S-65KNeabEYHi@P71hF@W8X?pSVP6pYgUB92ju3w2 z*bd@B5D$Ym5X8YCE=c^LAbt+wtngvcQ=&&iS>e$jjs<1oR|rZ7Y6w~gkr1LG=pneJ zNKn)hf=|F}*Ta`U`Go_btd=Qc=Y~TtY&Hef?zeu&#X`s}X57wgvokyWc|y1^KN<3i zzno|R(Sjiq3ZbxYaZ$z>38ARX#X^`r#u_apLVVT`N{PRWom*O<<`FBPYzV(KOv zA#@L+u9RvXLW>aUg-~D22BJ+uXlU2jNT6{DlP+4{Mw;6GW&#LWACWDE-wdHu2(3eC z6GB_@bP{bBLI(jxwilT0ads5gCudPQ+qo@dBy4=A$%Od8b*e&gq;w=O1qw=0-uJkOkla_eEHV*nH{qt#K%TiGd#{zCLi zJ7%>2uQXdL@U7@N(XU0n5nUg`h7caxvp8PC+$erlyD5b4guk~v&sX`khOkY{Qz2{* zVMhoDLpT(|PI2xD@gY~(WykLh;Rl=7CA;;jEo|K7@0^zuKP7gRHNk7sR|6!l$>b z--(yGJcjTpgx4Wl4dGe{e}?cECt#}cdWcWx!X4ooqBldhCBWQ&t|#0L;hxlXU!1>( zkPx*d;2-}J^FRU~ihdVxa=U*E|0~MiM?4n7g|8<36T%bWlZthepN8-(gy-y1>7p0* z9AwtZ5Sm}JR)B;s62pAy9HL7gppCqWKoAG!bq`Ws&}v=Q^S}Nw%VN8 z_B+FH*_;+e73tn=;!(m-1+t6g2qULJE>Tu;v{$Mo>{cUA)VeSh*0>T(AW;Bdg80`w6eF4P7$Q?%gI2y!}CycydRE(ff1o^_qAI2~P z!wnP&qhJ`{h4FnDg~BKt#?&z04WmdHMZ;(wMvE|tg;6|=s$o>4=L|}OQ6`MC!X-sZ zg;82yX$6x3<-(|!GogZb%8SyuvzD`>&6UEaEL_F*bZY3R9!8BY8ilRP%xa1f>V{EE zxONzI!npO%f7czoAI$y;Fzl{OCxV-yd17{kTnUW^E1 zr0|j_$u!>b@G?&{7#Oq zdGtSbt`?@bM&K*awPCEY{oR!e-$*2b*N3q|_*>hvF^o+%^Ut`=VQk^#GLX-})-bk( z@mCmshp|139bt@!IeraeCwnrCBVim3W4AaDi2e}9o-pUFs=#zCVENqau`tWm%&y6r{a$JRRJB;7Ob0>_u zVcZjqOif`h)2K!%6EC`lPfz(nVhUz*q`l$flh_}Gt=ASm6#bK1FO){}Q5cWIPz8WZkL*ioN6GGl*%mX5_O95jyb;5oE0)K4dF84N2&_E#rd}h;|1_~P} zV&Dz#nqgf`Skyp81C@k}87OX`gn^RWoPn|i${8pvS!Gyoo^|Enq>5&l@0@G7A@Nt= zkfDNsLlv!ezBApZXjT?Kxt4({2C9l#%|H#?U!8kb#nCmRtEPAym8`P0?c6#7t*a;3 zGf>|^3j;01)4)IzJEoz5M#7D45AP9fD%{L~^IkG5Y;NGxn(TyD;%{q5wl>g4n44g3 zI|J>->>%37Ku3WON;w<%bafVHSm8=$7wJIuVOIm)gu5H)A<$E_m+0}C88S9aW>_Bs zeV-=uHIU;_az6w84eK1m00Tn=$O8=w5*}=O#>_J4f6Ks7@vu0}5e7yY*luEniBSed z8%Q&e#l+hN#&C`pcxqs*fpG?w8CY)cJv-)j1G5awHZZ}!M8i7KH_5<-na&voCL5R{ zo_7qqYhapzsbVsQw}q0YOG-DXyo>Wa12YZlc21@Yy%OgbxQ|@(49qw1z6`LrqDqEb zdHWhI{) z_{`wLORZtN!ocSS)*4u6VE10<4-@%FTg$)7z!w5v8dxK+T9jE+E16#jFRx_X)%bO~ zKTFCtY<$eRZ+g9S3wvgRfsHQ{2pbJ-GVq;&?+siwaK*r811V#jKeAPvlEPaJY~v9T zX4Y*16NHD?Y z5tVUSW|C=Lcb&mRMpGXCZz8h*7-Pa=BGp8@wB$@CI;JJ_2`6Mec7~8{I!(AFK0Pa| ziEJhcnkZx|WXxHer~^V@P|fho6X zDNR1#F29KaVy639Bt45Ug-sMOG0DVaw$?;36Fp4yG*R3{2@{P>G&WJvL@5(h*ccO~ zO_VWF-b4ix59_8(Kc7@qpk0~dawfj{Hy52u6-`t!QCYGgr;_Mda?;XZrVQ0gR5wvy zvTB&9X`+saH^i(ZT3dA5jLfaR4zWmGF$wk9!pbIr>CkJXfr%}9lbfy0)zAdZ5_MCW zm}qLE0}r2xW+s}OeBwP?n{aOMvq%f_F{=$NO^ke{(%D8l?M$>c(U#r*FsWr_vs7`V zsf01I|G!C{Omt?o$CA3S(@b<>pG@~3*OI%M`0;^N83_?_P>Er+*-C3;?0p}>_H*&K zi!*n$$)}xTJU<0YjFB4HjIk1MH&J12OcP8@6i<5P)Xlq+rk- zohEj1Nr}J_!SpX&yG{IHVh`sp@1A>%y(adVcq!(7jv^D6O!d7ff6<@ta*dy>cqkCA-vB6W2`KH}OEiu8ZC=al^z-;aetd3#1ok z0|x9@>r2a>aY5rGJAmmyV!J z1ZBljj{Wl@fzI+`5-LQn?yO3v96^-`mPN5VimDM*i{NGiw<4$>L5&DLk6>j4H6y4M z!P^n*D{<`z>O{~yf))|$BmRvDW>!wFA3@y+>apyZWICA$4J4pp1dRk5N6=J&xlIIC zdy<<8tnpZ-T1L={Q<9H38=KNPf;JKKiJ)%;Z6jzGL3d8oMvnFobcmpH1aFGjk)7W- zf&TtI6FW&+a+e6YN^UpN%#9PuH%|Dfk%Ixu?GZswfnE{x7NCL1$%i$M6%hrxTRje-()7k$K z%!*(J`-IOt=YgwYGBpe3pgCL2Ig*vyI|Kdii-%c!KjZue7DlWm3oVdaa;Gtif zdZcXPq6j{WU~vQ=MQ~-g|I-LQj({%*{3L><5iAj=Ij)M?I%^_fSp>_)xuA;4qz_VA z>N6?3LX;*G2HPz&D~BB3Lir z*kN6L&GfC9-&HZc6WAQV7J=_YPx}(KMzAe{U1BnRI|uXXl${amustWLn1zE0b7Bd* z?IH}@8^OK^jz@4Jg8kw@7{Q?kezZ&dByb>t>s730`7-?+!BKG@wquS6WTCV1!K;Nr{Dpd{HySJ(F>x56Rd9hjVstOToS!3O7ltt zS0lJ4=Jg0}2uy#&`pU{gxE;YAj+`i3MR7NRdz?E_7*YHl!5>G)n4M=-!nvJ)MesC&XA%4z!6TNMUf?n#owl8jUu~1Hqp0#(&=Q%VVg=62W~ihQE(sC zC^U9Lt&kptI|`3*r9;V84khyylin!uG)<*R^-Da91O$RngltcN#i?c#ktnLLwquA! z5sM;k6ns@8_az?1$nK7M#r(OW))T7ph!Uz)<$D&8KZ*iT6pW%w6lJ3*6h+}EN-!ph zr_B?JL{T(~Vo|udIIg!(oZBja4{2{+AhCE9*3;VGbPVp{C>2FwtAx@~kTXialjaHK z*f#maQ89{URn78ZR)|`!s!8`(5>I7OI;%!eEsE+a`#Fp5S|)QF;HlrMC!JWOvy zQCql{PEPdJA-q zqK80FQSSbqot%8@S)VBSMXlGL^%bpIJCWR9m@q)#!UosiDArcjhDNPFDF{Qve2YDK zRHI4fuqcK{F@i@~V%`=VCCc2<0&O!o#t4iR<)dPm#Yc}$h+=vaGoqLnwSKrw5}h2y z6oGf5e1o~=XPO%Q@2AZ)+w;={>oVH+qL>@SyeMWy|NA#>Rur>so+I$SXwMI=KQZS= zu}I7XcFYF?3q^S~#fO|G!XJr#BKooD646Cf&7}gY?d9?0PowxOighu39m9$!KIgEH zp>hl>qgWNi^C(_K@kJD0MzNo}5XEXvZNu?h6yHa&hV_WKHj4EE>qHswwZJ!`JFA)- z1ip=8qrfK7tWK+{?oF(lwKqqxTbx@&w??roitWNXMH#b0;96C4m+k5FZRiK#J)(O> z_u0A6s+vD>t%%}W6u(AsQ2a-tI2y$v;h*iu!<;Pnler0|V^N%l;-q99=bU;k#WC7y z;VJQ)5j`EnFLv47E3~sVFS(O^oS;BM>8|+iiLzn83()@uhtOQBkq^c5cNC8}Lxukm-SXJ_ zCiz(SUs0O>@Uug>_v)02)y${D&+J@!UPkdMiX1WIjNx?@2{B}dA!7_P=Q|Q()+sxF z@#B0g$}DXE?!t7#uOA#*h|6mKavGbYzObDL~E~L(+)M1SXd_ zn^iN(S%tHUW)mGKe!iGHR}4xF`C`Z)gBpVtLm-A=3=hURwSm^FN%R=pF?eF|#{OGB z{Q^EwWuhY;LNSD6$SY1G22&sw!`kVIrMsj>Vu;4@^W=Mmw_!+OThOJaJ94i2iUyk89cW0(`;cU=sKVPFiCVwfDmpcn?n zFeHYzVpv|^ajcs8RZYis({Z?&V`vOxVi+64uo#BNFsmc~P{YU=Msb9H>H581;^-LO zj-jMKi6-AXc)Xiq%UNs9=iwd~vwl)dknu2H^!@3H^h^~0@cSuKVt6Np?>abUvypvV zQ)8IHEa7)Wr-@D%ja+f@1zS}rSp#Wi%zE+GEKz!LH%nk8b7Pnn!#_2&&tp8Jjs@J8 z7(R{RgP8SY;NuvU2rOi6F?=YzIEIe|SSP>KI=$WHpRTWm?PezchvLO$_T}cp1a1 z7&gT4Z4BpP_%()&F>H$AM~-3kPYmD3u#*#cs=8T}uq}oy!dq?6-D)QN+hf=vp0rcR zGZZ#PBGF$2??Q2R5c=>FIbH!xN6Ka(y#4)4}vS z27jvr0>AL{t+lUXNQlE9M<9;GIFjPl*Ka*;{r1lgM_L?N;>Z|BavTsR{h0(((#<$h z1=^RlJ~fy!i|LHRB~Y=tneNXjW=_#;aby?BA(~!8E@1{M0;;GcS}2d-9k+e~)oJMP z#NmyD;1ea37?E`UGJb+zIQOj&(O*`$LLBAn$ntT_m}1?)UeWec5*Sh4tRj$JNwqkt$5BH(b?nHR z0=43(ZF>%tv2J^RBaXVZr(WE8CJCJl<7gDe%)FSD7med+LVs?Y%8jORG>fBVZq&++ z=Ip3A)ZEZ=qh%be;#e2Q*KxFtqfMM|O2XVY+Q!i?j$v^OkE4AY9pcv6zrk^IjH6Q= zJ>%#VM`sQp@plvLBHC4SX7L1`3Sg1$V)hWFIjoP-TeyE51LEitM_)0=7W{uqeFwM` z#ryRQmwS@SO)mA)+vP?`*(94}Hw~nS^xk`ws&u6H-fW;$sfr?qbWo%#N|7c?6+u9H z7o?Z(>>Km@{?9YddCq&@cV=g2XC}#Jb~dS(kSSH{o}0!`^1crA6Q!%)C@20~p5$Ez z28d2RP{@H2NkbeM>cC_NrZ_On0Uml(B4)Ud5rQLmvT3CTer6u+z!(R{IxxUv6FRz!3+2bzp-78y(o>;3l;A$$_68_|AdN9AzafJ0195 z$TkPIJFvxptzyn!V|_TF;Ff{b9b#^}`QIK9E2`LcIq-vsKRU2m$jd6mZXQfS##r}= zvd@A2LiX~YYyZppiztU2IN-oR2e{44xhlq1DsLA^KP;|OQDci04)Zhr6zJF?^C(Aw z1HZFlIB?v7KO8vYzzGLVvIB3yX~9zt-s5fh!JN5|jGR-BYhRaLs`m4%~F$y69ZL_d_>pg{S|m;=9FW z?4EjCkXe|R{jNmbOO$h~iv58D|2klG8i#x6z#|7`tTz$>v0|5V{&wwZjRs6RA$*aKa*b+}pLUjR9$* zWIq0{{^dV3He0hfk?urJCvu55j}v*F$Sr*LP9qmnJ|{Aq$S>lgvbJZ#43X*O@XSJ- zi;keE6UCe;>_ibK-v7?pr>gz<++_aDp{uwP0Vje^lyIV?6PZrl3Nx~JoX8SV+KDnk z>`uHUWa9B`3}ABbh@y}?op@j}M7I;l{|SrVvhzCO6H#@-?=)`T#Y%@WiSq+_NQXj&i_udaH0)c!){?}>BR6#Nv#-MDT!ul(fK`rysZ=M#C*BI zaJ^e8se=<8S&kF8T3b6i(Zz{QPOPbF+&?6Cbz(~Eq;5`ZuWB!F)s}kIMsjPbjVrI- zaT;sGdOOiWNKZj3y@YV&_7T!ou%8qCg>d24;?-7$4RB&0JJJ>NAXeaZ)<`D?J2AwG z@6EQ;unpze-L(yK;_L~dorlYrju7NdYbSaa80F*(?`%h_+Q&LE&WX*;=)`y@COEOs ziA7FKbmFgFR;G`fnB>G{F{e23o{*^t?=&ZNnoSIQUz86L`iD+_CCj8f-H91ae4Nnd zQFmgdn6m`u2+kHfUDeJkbDg;Mfsyx95$8M6;84~A;j`Y#qP|%87re4gED`>h;OBx% z1&dgWS}k+pD<{^8LUXy0ubo(tP`G>fN+-T?VwEUs68dV^Ifqf1wF!mqd0+3u1~E4Z zekZtzT~tWunVIoS6_K$;lwSn5IU%`o>%=}G`vt?LEOZ@k;-C|UMCp|;g9_7OCyt2ntKd;VuBf2vm=nj@EnS%E!U-o% za=g2sx^T*g(@s2b;;9pVIB~{_drq{C6#A3B$cY=Alv9gO|$suP!lUlzRLl)p`@8H0l9nuym0?=>^sl#*HaEg`oB?{I{^X}K#%*FR3& z=d9(#?b8_?$h!m9e}&V0DC7}81%zx|Z>9LmiRYXrUB>6a3tmdimd%A^mqA{N`ARU! z1(S$t+$OqMx9l$1Tu65z#Ra(dk}UXA({s3x=7PnAR2N$GGIi`_YTe6J`{Purcw33W zFuGVmP8Tv<$nQcf7jnCd^UdQzUKjESU%A4}#Lv?=&B;s!Tqx*5QE?S=8IgsB$8%li zlvKn8ez@=}N-@!kyD)aIQ3A1~3z;sIav{qFH>-CNMP8=ZT_`P_=4%PDj0+AIs(DTE z-zH8rOCqLFB^yOWOpgm*A@NAR3jvpL)26BmK^HU^_`9P{V>AEn&|Sv*|FVK17s5iQ zM1(|Lh$WP2)$HY5cwNl$f|XpTknmO%a>ShUh6|O2zbROSZJ3(E0*Or3T&V6s4HsYh zitaAF?LsXVYBSP>W-eSGVyz?C(1p4#)N|pBlw^ub^+j*s!h0WQeP5ygl}4g8W*ttZ zG;v`_HT%43_U0~}EoyD!LR(&67h1Z|N)(E%U8w&siG->5v!r$|wC9Czp_5#W4lZ;| zT(4QBZA`pyon7eSLRS|Sd~RhL&_0=Ib&Y~_b(3I<@3_#zg%K`{bfKpUO@^BLy3o&s z?bYnP1be%{7mW6C;X*Y#UpCs`g?C+iWi5ugFu;X@E(~VnUC_HFv)Dn2Iy{mgHdJ(q zyeq=r$X|3czQ|Rok*oV#HvZ*0ifwDjnBc-_7sj|?uWlbJINpVELZ~pFNOPhDGk%f_ zlM}pgb^A0nDZ95DdE9v4g%4c#(S_YEeCWbQE`0AYZskpPVTKEzyRei)%!N-}_|%2@ zF7!T(nSyg%m?ebDY!|GDQc0NRia1a3*Rx3rT$pn#`$92!6MzAWTv#mT5*Hq9Px{OS zhQ0hFWzWZHht4K_!4r33oeS$-SmxqOb+MWa;<5}IWoy~Yy4-~oE_^N7SGw?x3wOMx z_;FWBSn8P+nv5r|abc~9A4$m@B-eL>4A|%bkGRQ&Z-tQGu3Ks|&rvGLny?YJNK2@EtDf6hd$OPU9{Yeh_6ybz?!`PcHoI!ZmhO7Rzpb&33|tlN^9|tb1M9=fZv$ zesSS|3rAh}&4q(59CG1^^Z`??tiwFkvJ@s>M4BYOifgu9*56$?=E89o4$C{y;$fVQ zuFpw1<-%zW|8v%>F8txb85hp8`*E!GxBe-3&Sku);w-Q7<0Ohqe~BJ9FS>Bah08Ad z?ZPw(AYPFGMlvQI#{XWM*EQyx8!jyAV0q=jO&4x)ZsCP+;js%(TzsQ3?n#6EEBKEK z_j#dRn0?l`Nz25=F!6OY4_$b~M)aN(th%*c3Rk{c#B zvbmA$hSiNt)$Q2@Nz6i01mOl>vPse6MyeY*L`-vo>0EU?b*2#utTs2&-N-54T;e6h zUBtX@L;^=J3LT#oQ?FMiJo@iwe0gE~$hY zCEdt!!!AmuV5x*RJT8gBOs~07+Kn=9FbmE9=_F1!TyD7CP$ZX6&?Avvw-L!1gISnS z6<1sd3XixE6`~31ZiIvwhY<3jx;-YOykJ?ua)OL`UC53=X1qR?+<3!{5pIlhqp}-s zy77)1J=hvY_<{^HbE8}hdsR28xl!GX8gA5cqrThtJgwT!FDzaH_2zE0aHFLgt=#D3MrSu#yV1st_HJ}= zqpch5+?Z3ter9M=vl{mPHSE7W%vZaft)oDo9#4yt@q!80Cq{P!GxACmOBsV6rA7)ubGiIt~j2mO!80SWV zW~T9OOmJf&8-HLnx`wSw9#X@^#EGedNY; zH-1*IN5Kp?K4$k;P*}kyZp?J!nj6>MnB~T7j+cz$>)EPq%ynal8=tX}E8FI|@u?g7 znXFoE(s|1Bg)b0XC`i{LHx>&YKgUe-b2pYsldg5+3pWOgN?z&4H*S0>;xaeB60%(I zYrz$Q*=pKrt}#BESGloT6n^lfT~AuW)@Ynmzi|?gZ%CXn+PaQIwWht+kG2hNY~;{( z<6CyZn)bil_|A>ZZX9;wh#TL#vBixa-PrBMRyVe}vD1w|x>~mj?hveaA%#jDcd>i8 zaWkhmuDmzILh_Rv`#J5f4c*w|#$GpmpKRU7+2caWm#xznz(jIDN+Ulc^xSQb7lJR{cqN2Nk^=rOR&k+?Jeve3E6AS6#qWFk`CwL%p&-9v zydA)zAXPyQ1!)Sbit%4Cr!|`bt-d*@f?NvH6=Q(Y^mIuk<`!381$h*dIGjm^m`?%I zq3y6 zp`e?B?uxN=XX3}%myEEztsr-QlQPe?Bqg0S>8YTXf&mH!D(J1CkAi**`t#JbU}a5v zUy_{0Z!Yp~4bAVew1(#5?JX=#ub*R(Vtm{)4HkXIP}2|ve{4u%$$3_qXZE)aQ!re? z2nFOL6^s%>Zm(e?Rv40PLC*qX6--nxNdfsd!SMM`6JlbykOu^?0*0P_lH!Ao- z!8Zz4N$Y*7U>OIg@QwwH@57EVrsW(6W%yRdlJKJuwB6p1sfG?V$Bt7ON4zZhu|;e?-b+r@@B#B6>Jegh41(LUr{WUX{Ump z*ntZeU2d0T|3UCa!QIlw;uR+DRj^ONW)HsiV84Q2IFLPXd2m3%LC&8FZgW0Sa9Dw@ zmi@AVBMN@y_^oNVpx`JQU$gb-opwUOZ^CK*F65ZtaRvNig<^*;){_cODLBn8q~Hvv zK?UbH2Ai4wAwt?9VMs=Q+R&S??FhN&IbPCXaYg!CihPD!9Zt zT(%4;o=jv5Tv2dUTH{)xO|A>Mq2Q*1V}BY?Y!UA;J7-Z3a(Zx2!9NNfDR|6TsFt07 zectB)DVzC#mss{g_*ck71yyU=C)Kh)QSg-Wv&R??&lKaO)h`vi67pQ|1t-S+S=5s} zhBw*6hr$eE@*ta#y|wH#nNmD3i$V?$jwE!82Tz4p)vP%@Af|a>6=D;llE1b+mj}5$ zDCt3_2YEcm>oJCKQNetI1qCw%^LtQ02xD&7u@w?tSg?o(O!G&l(p5~9;)%!-ESxI| zxjxood}S6HZdrW4!d7gz0q=%X?7a zf8N^mH$12;W&;o2BW6{>8i~kiLaKXUdya{XFQO;I#{94Deu}n1ejnbNRnjf80)Cs0YJ57$>gbiTF`MMhK1+eD)}1 zbizBvgRu#|uC{%=2NOJ)D9RKMrV5!PIN1X}Lc&T;6Z1Vmn#}%wf*-AI|Hy;syzU;X z6mfTRXS^gzsj#60rgr3bG(ceyKan-}R`M7)T4k<*J@ zUgJA}-;3N{N#tFA8{3l>774urd|&qHuy2@}kkp z{DbS*sTUDWQY_*9%4aI!MM*C*y(mS|W-CoIoIT46yO=3U3jW)NdYnPT$MZ8tL{M!Q6y{O^Ei>VL7$f>?5qTy{O|wT`#m- z+3I<5cVc!1d}Ft)sGFmq7op)creFW&d!9WQ#YUv)|w<3&#|7ThrIhz|3jmlwUgyjP#rNAO+2zJmR{=r5$~raTN7 z;Ke{M28lAniw$+`gN3hco1b2$p<+_!f~etMjF7Y7DU9@Dloz9U(3-}72Tb30%FddM zmHLe1_4>g&p6BJoL{TPrF-6FRHF+m{v1xS<22T}bn&3~3vhMIf6|VgBV!0P9y!gl~1xWJ1~<7B#dzK~-l zZH!+ie32KAdK)EtCg-)(i!V6Pgl}4GT&adjvcB|UnHOKN!4IS`Wo)-nB%$|fFIIX{ z=vA@3GOWJw;#)7ilkBU!Snb6cFN!rWuk~V`7wd%|9Aewx#YW+qyf|IQ&H$#Xb?kJJ za4g)tZ`gFW;}9kebbWG)_q>=_hRZs>!BX0zi>pDGcHdsAM)ZbXB!_JJ{s7r%M&yC}y5PYE6uJmJMjA&ln}bEgyhkA!~Ki*sJ^H{E6ShwfQ_amcq! zzv#tzF)s*GANf3`+N#vQIc!&@UJ}gT(fB2JMe<%1yynGqA+d%z=(@#G@5Ql<^b$V) z7lXTAB>RxvhkIW9bZUJ)HRl7G3E22fDZ+I$Pib43ET0lu~Ms$ z4~0c6?n4nFMSUpd!yA(K=N`s^njA0=#A2CB`oP`Njs+~4K9ur-gegmiUGOy@N(;GP zHHj{#4=x}4J_J~}4~h>e%^NB2yk6Yn!{b^OuMaaUwz&<>J~4kBW}?VDwAasM1=$p% zteOwH<Ij-pu5z8}gy7&-m>S_8HR%Q^bd;4>2*%S2O+%Co*7DE=zeID){h^5BGhj z=tCu+@gwd7o}CYseHiS+5Fg(3p^6V}eQ4)HRUfMP(A;OtA=Q1T;X`BLHGQZhq@iGK zAL{r}my@mRz*EnM`aU%9ft&WM?wQ8jewh919mR=l>)IRnFuJa>i4d`gWG89rLo>-v z&h3d>h~CnNRz9>A-bRqQ&UQ5~J7~-~?b-4^^zfml4;^{3KD?cX=_I7951kWA7a>!h zWp(qRyAKT$I|U_2Of2dhsVd3R4z^wr+0TdGLiz~y6`U*8?l1gZUIHHm3LhlM?E2SP z-%1SIe5em&eHbTKVVDoYg^ciFq>xc;1R>mGjk~LjiHE&z+`1Xh-hL9l*R@aaVS*1E zKDRMV6f((&$q8j$W7||-pnleAg6|2wFZiIYojSkme8^6I1Rwb@ot?^ukA3*Whh0AW z;KNKGX8G`y56gX+?ZX`DTA%qaSI7dNvAxVZpRp>8UG7sK=8OKn{b3gRut*eo7YkV; z$o*tK7qV24@m~n}(uZa7fTu|mSNQO?59@qb&-w%`+(2d}yP^-PB!*?K@nLm>$G4YR zD^;RvgAW^h*ec#lf|~`u75q-{e>>8A@52^Rn32cb=EHU|<0rC1_|Am#qYt}DYc=_@8%c5NI;i`~pKHL;S z?{yz;BsjC&^5M3acLeVy%Dg9Lyvzqa{L7hHMP3yTeR$+UiVCQB%xk*KYEr?SU!M4& zHMBhS;h7J&R@k2V@QRnarS*lFF9q4v>7tmV!k*JaLM5AO%wWla*#&QZVm7O=sJPh4 zl1oLZiXR*0SXslGt|EtuIl~HG-I$W5!m7fiBKOOr{nM>fh&feoccA(0ObpH~MX`jI zozn8D$WT#SMF|z3|6E9^XV0%ji1o=whVnXO8FR2>0 zt^6tiDl%1+Qjx_IQQ=bIR&l(q?KKr;gp?MfvNmdRB)C(>jlMRDOp1tJL60E4J{778 zW{Jm;1XXA%D)SJ0?XQZEoKyuBVHFV-WmS}8Ls@e~Rm4=xew4&SlWEqYB&OF@l$U`2 z=_D1UkZ+rtDhYW*u>5gjq3oL~s;H={qMC@jF4a{usAtSkOeD2b)K=m5Bj86J6?Ij7 zrDC~?dMfIx7_VXi<5e_NF-*m96^&FhR?$I4M-@#}G?f!+qoSFRmV(U%dGr=ShUPSJ z=do6*@%y5+3Ucm0)>d5Y5|QnN@FmD^spzDlzlwMH{a-~F6@A3jRYf-y@2KdZqPr+> zC-U-j+wr$2_Y|d<;ErO(>$7_c?^e%PrQA0W-;dRnw=EA4Ww7ADgm+NF%Pd1w3{B{7 zmBt7aBYEPtv(8pGR)h0&MzJT?u<&uP(JIEM#&cm~1;+`}9A3{pQN<(`GgZt|F_~8( zrlv3_6bX_ zXQzux(`Pg99~qx>K&hCkVxEdmRV4Q={%2L&d|tlSEDKdEQn7>(5USvN2IyEUwQ~ zEKy;OrtolM+L@^{hD-OCs`!Fku}spJsys3vNS(?G6<@2ktKy!Dl`6jBDXTcDVwH;3 zsd@K5QD)P-t9aktfV;0o2 zUs+@`f_quFsMw}ryNa#x?7gg9$GAhxoe5=gJ$v$E+u3^dA9zJn>{juUihU~ftN2-} z!J6z*QT>vXJqVp`iuED z6{l7Fp@RH(UMUWC6(__zC3sS>OnnmrqIa#tGb;Y%Tp{{d73Wm^t>Ti3zeHic1vXKF zcdl)^DE!SXrnhRFE(^b!@Lu7JwAsuo*F?F_v#V_!D7n7c}wjfTkL7(BYp(1hfFs=QSm~^Qx(rtw5o4>*?VHQ zJXcY1knzp!rFcn>JjyirkO=23(q4+lVKTtwg&60j(`ca0tTG{H4wEkTvga59U@*~R+yB`@t ztgi_cuWl4(b?H%s%w=QsYp;BkqHRKO!hlj(eYyXxn2Sh*u75!*h(G=Hb6gC3hNGMhOsQb3HPP{UHRAXDUw^a9|mJsq9e$*8HD&3k{J(Egp zKOEUiB>ehX*N=Ms|Na%NFQkEBi3aw^4ojQwZH@iLq|`*pZz|YKu(_b;p>cnpl^?DB z=txDxHi9=A8aGVZ`q56z_JUM8_|fHsanGTX9O!Mq&VsB@7a?5*yZO;Qp|@>dJSzB( zA3YLEPqu1)V+ZLz>==II_t8jk^gRl3{CK1 zLWT>D@Z@Lm{#`!Ux-6KcFzMj@*yHc;tEI!GP$?VTT zcejN7Wh#w#N@sS@p{MhNobU$YJvBZzh{KmtK zANw)ek2%6W5u7PFiHSh~r4eUZ0(bxtOSY z?#Exj{OkSL;Kx!wzVPEq4y6|6m25^omih6OAImw|{rFmR2B&?O$^d^a1NRL}TO~UA z8b4MG-_pQNbFCli{MgsP&MZ$v+33e6Ib7b;*}nDTJKSMsWI?(`Ef{2hkFtH;Kz@C?Dpd)KYsS(7k;-{ma)f=y?#_0YTnN}_~Gf6 z&E72=O+L_?@gkq2TQ(+!9q{9z#D8DGO7oSq6#t6-)sLfoocH5`^b=n9-~9Mp4tLCt z<7}BjR^H)9le80loa7Y@*iQNJrypniIPJ$DqMY&L?zt4YYBjWTA4`&RJX3Lz(-rsf z-q%Gx?l4%&|J#pCeq0uQ#gFTL-0BlXJx$OrPdg-E0LcHh4 zKYo}3$QHnTPX2y8_2Ze$E!DH*Uq6VPXCC_TNW{m2PXwutT9f&lLqp70oNWI!cJY0g z@W#!g0QRpm^yC1t2ap;-jsQ{uMzKr?V9&}Fjtg>g02a|3H8eg`(gMaaxg^#A%-xfR zg-tYV0i;XJ<5pR8cZpi}@E0q*#hqhJ7q0>&0V`2`CEj8mpr zIDjGnR2q}@ZbM@W{h|Ss2%u!ZSQ%AJuy_F11{e!MGQ}jB_%fAPGjGz&?v|{8@r0l~ zfKM9QUkjjg0A&Jju)z6NCZ~{7l`_fw^Q}q%o&eqqpi014ALR`o96-0(*2B$hz5vt! z`~d`{V(a%=^#Hh!L@)qNl(zef&yJ9oRA@#Rz?q?(H6~awfU*IU6aKnj`2hMqwK0IH zf+(9B8h^M~68?r@Wx+Fd%vA%Z7C;-8966Q^MO($XoxX%+8{834j~au$*pUc2C5=Eu{Fml%4_f3SdV7I|Jw)K%W4X z1dRXmIbiz+Fe-r20rX?j1@NwPA@-tyLIw!_P}(#ofWg9t1TZ`iGcSv7$V0-`*0+<-U*sqB5`=41WN<>B7iRg zSQfzg0E$hpeHFm+0Jz`LqlWgJt<5U}SQWtP0KN{uYss;a7a{z|Z`U?Va{3=O5Pmqtw!Stp_-PG_vm%+$Xr7L!*ZE z7r`rSEeAQ+_gW7L9u_x3B4RS2Xb{B` zoWJNx3b!Ye%pgh$&q^p4RuyNi*TgI>SVpk+>Qq+{?jT<08J&b8=ncXr#1s7QNdYwo ze-K}D*;xG?fgplGlnuhs)128jSqmb>u%Pj2rSn9*#-~6ei1{H)G>BLb-zQ~EXk>gb z8+F3EOh`G&JEOFTC6o`MLJ$*kq*n~0suWTwh&O`9Fsv+CMet3*t&Qx|m-fh3Er{wt z)Cl5OBYUkNY740;$OBQV69i4BxXFgCC(Zj|rnO-Zje-~##P}c@2hk*mzCrX0qG=G# zg6JAFmSr{%qD2rLh0|;qM7soU6+~;{ZGvbUM5ksp1~A=dWV|q?y|_9A@nIoTTz`u( zB6b$+B1jj9e76Me9>m*0yd!3hAbJMTOL*X(v2$;4;e7;eeqzhr*f>ysF-Hi#8^nMh z1_~c4$bdmX3>H2_&}26D`C%F+=5WC&Hys#+Sf2&K8B@+#u%BwZZ&p5DS7>D15#kgBJ;*mx_^h zgZZ-{J`ZAf5G#UM8bq~T*~Znhd>O=NH7#ER5vZR;a~X5>$^1(2(_1qx zk7D|kO_X>lYIA~bkz88^w+Z%viJfysZOcy1EqAOx1ySCbzAK39n{7V`{uspWAiDH6 zQ5oFW&X}Kr*dxK@dxO{~{Nu*<&5i8`f;h-AsG)#{LqQx4;$;x8f;bYyuQJ~61#vWp z-&k@GH-h+`LneqngE$++@t|>M?6e@s2_YvL)7XAWkm4UAo)OHQVWM&_$lqB;#w&v7 z1^*VjAb3&meq;M3A&k5%Bu5iF7l&LGeogSNd`5vcgSeZBycNW4;dc^B+kolPIoW|E zi2Ff22;yHkujfHL6!KW`k>EwMg_GVB;UrIkcoqbAnIN|}F>a;42qGStq`{;aXOT-V zn+CH6i-u$|sb|-alHkz57rIeoN)^#6m_sm4Ff=VYy*Ac(7T1 zM&=WqA^2TOTS1K{Nw5NTq6O+#r7Wi&W6od3e+5^Nr|I)&6}Vkf7Ut^rN#iUw{`;?dw` zUs{ug$)`cp@L?O1;wH0YYqfe+L-g*4+kf0zdqLLLPe~^0nN=h>g&3QTzydFUd4J|d)2%%;Otu(Y|ZFN-C(MCgC4L3C0)X+{tdkyn6 ze9HAdygFXXL>8-|qlULMbkfjS!$1v#G<4C7&-b1hdTHpYp&QRal(#j!qk&)A>1Enk z+SEhCFJdlhWa%w2{WSE~&__dG4Gf4!GRwQ-9U%C>5}19kC?hqDVpq{HRKqY)m~nWb z1jdihP_s!I-$6!wv;>UPFh;}JM1k>Rjn^I7g8BTn$gV7)v+jYgnM+ znuhBd7HU|eVFyn~!(t6fG_2FGUc+Y^KG*nN#rToFRPaj;%QSo;yhh1v)S150uw0Zo zO^n~~dCXX$A#64HN)6wLYn9*{!PSC8&lFm#;efm+=-w^kNBsuTw`$m^VUzH0HGHRG zv+$eQjsNt&*RVyySlk?@S}#^8h(K~h>e@t&uh5A$w$LwQ7#JpEx0GE zfI7%%cBU&Dcc@OkD*BUphSGF+>Z<0pxjxGj)y4&=w>XeBheH=jl8%2loH-|Jc&_1*hQ}OwTkwP3G&5 zwXlvNI!fy(qob&fVmeCc$kOro30rX;C3KY3v9Ps?W~PWFH=CQTp0JTH*>$|8gRVQx zO&fp8ibuwS9XgykTsqu36dfMP&anTLbKr!H$*Y6NEUb*G!!NZ82)28aL~+o#;<}EI zj<61Lu55|u*x1u}#I>AmZ0a5rj0u(%9Ghj^w9NXtT;lRN=1n&4mRHj8hK?&buIi|) z<4qllcnNe=(NR^$SP8DCbHSvwu8w*-s_Ur1UePJ7reGbxS~_YAq5ktW6EU-*slIMJ z($YsqUmXo}G}O^ZM`ICN=xCy&sqp4Hwl%dk6aHF16FGB{5Sd!)XeF-JQj<11+UjVh zqrHx9qIVGNEXeqdLf#VWB)BzSdY6Q^D=RN0cc&uaJ34wMygh_emVjP5dW$(FUpkBJ zr=!1)Av%V#S^8Pu6&xfuK*vBK)L(TdI9Pb`lQx>ebPQ*|8fP7&V}y>8I!5Uj&6+<; zqF8sRi78HqagjJq$9NqRbWGIofsPM#1y#%$zj$=;$H~z2bjp z7QAfSvfi)bZpfI!59&Ci-a;*1zym9aYje+rfD<#na}I^Q^#2y=S2BSkS@=A22GGK8EV+|Y4T#}ge-b)5g*dabFAf3@G@G+Wzp zn{yXWO~;Z6=6gEs>v$miAHliXO#kY5sN=DW%84zqJrY73^ddj&z(oE`$8+6ypPe;? z7dl?*KnUg#UhzT~wqy$#$dn|+6oO-&afg;EIfU#YrU({lZoDYj5;FGnWl9s08ZwTO zBZQmfQYh9<%g*nC`>I)NqH_Uut`KsEP(5VakjxW8-Vl@!JR#%@AtQuxRST5~p-ST% z`9mlaLSf+r1Pg|cKF63Fi-eFg(_A8ik|7igp;!o&n%hS>ZErWX7Y~8Ek&JC_&kUhd z2=)+O3n5DmebQ^WIXGM1zNud|x0AeP$zD2yJ|7qbQh8C#>ImUf!yL{KrW7dP3Snz= zyPFwvny0ue-Vl5tlx6ioP(#Ktq>!LLgn*D>2)YnWkO9Y<+qoEtBpgCS#He6Q@I7(G z16~)Ul3;nk3L#V!vUGu&CA<+rWwtFFA!N)s@w`&H-s)B zV`pQg?n1hT&`rp;Y1u24#@ivhBW8~fdWO(TICa~$6lUoyCeM_-A5UkHZ2)_t-O^w9 zyMhB_Ch7x27{tCY)I3;lh=e_=mqg|Ctfb)~j0j;-2#Z4)88VhSd>q0jA&d%PbO>WY z7%Sq3A&d)QJbOh5Q$v^_B7-M|Fj07@ow2Jb(_}FpJvGc}A-tc6d@qD0W3ng~%x(Q3 z1O^OiVLW&6Q3%r|W`^KQ5oacH%@Z<9aCQiD68c*;A$%Uf(h$~!uvU~WLRij7;a>_a3*jpvea>gGgMBUh8$p^YLl}JBxcRm!p{y2i zdxd#jLfI6;`UKw~WTW7>EsPJQZ-svsLN=Sxfxi!73&&Ro+d|kM!Y?6g4`D|LKZWpf zypRxn6tXLXA40}w&5@SIEj!|F(T_GT%(_Jj-Y;a@6T;pQo>nqyxKF%mhZ}e54uo(p z9vs4<5Dp7}al;5ZBK+47cnUO`T9zn4{7rQ9D0n=C6Pyymu!M1v(?SUMLwFFv=@9-1 z;YtWsLpa&Oeuh2yE8CwToL^|I*go|v2gue`rgK965A%u$w@83c$g>X5cto=Rp zn#`!&Q0_XXl>F)AEan@WLPNO4O0p~R-(;CE?}Wg_ne#~tW32-9d*b~^FmFryzaczi zYlQHOJuQUCAw1b_hCQzLxeEY^Br18niSX zd3(hPHVjkPc#myO@-h{c_#%RT zmhcUjsnyqAevR-OoB_-t#{)O03pVtG1@Kf*X0 zHuk+_IwR!IFz98Nsiq;)B&cuZiVq6jDN#OYHht8#yug$T3hdgaW}!~`X`M02_>#S6fa$mglu|{ME!9XPr`T_ zM&(xa+P!V`wr*vA5yne)n~s*$2wpKbf|Ljlfhhw13(u4+B%5IQYUb<_FpnbIU`Ua@I;U+g4_|j7D4F<9-Kg)2=YddkKS38!t zX5piAFHTrXMnFVPQ>h4F#+sfLft~efXXZa~Ct4ZH3-i~om5Jc9QC3F;vrAjJ<*%zr znll1d1jD-~yCe8(g7M-EBENxnBZ$(aSbY(w5%?nrM4*d8F(^c1%n0N6EZ@@|S3;tP zBZwp-Pt`ZagqKYym%CZYM^GVxol)$HqGAMV{l#902sR5yYe5!4j3mS7#h+Jf;-qT*ODg8CvdSA&GNaRf~w#;m*S zXhzcrno0FKN6?%%|An^|Y$@0}f>uK6T8)>FGqs5z&f7)MK7tP7eM_*TAY<;gvUd{B z4ZCQbuW0Kv&)O}5?h$N>U~2?#NAOO>c(`d<1U(|?8NnFf}cjPL0`C+fg2vD+fp#r{^^yq)9y2zCgP>=d$MSn>}M{20M* z83lVI*cZW1!heon54*$>M)17gpMqy2I46YO zzant7{_jnc7b3Wr(EpC$l5kbLSA}1T;JOfQQq8h zjJJQzgqSCayit^lB9j@XoAX6cIEo^|Gor{JMS&;^idjf-ll*P8W2o_8Pf<~d3(_nm zWMh#e@)E*%1F%#SSy8A__@l5#@mdt_C=~IQj-pHyjwqgIH!Tbsw+fw6xT1V%vSn6l zPPvvBU(h!Ac`;3 zZ4FtsCQy;QjA<@C&qmQnu4ZDF-rN#$D$ zwu!>r#!j(4JA>@H)-{R_3Eq)cJc>?Yb{6a+Saz_nIKT6T;-9s%b(3DvUGQx|@2jMq zQS^#pLKG93s@r-;@h&SYyiXK;g;4JoMgIg>+t>$2F(`^rQH+jaa1=v$Wv`};U^_H2 zwQgh@8pW`v@uuAtjZDL%;0vrHZR`ba+eY##@3T@Qj)`*3p>wi4j_BGJ`;XS8QGCIx8O5?FHnPG^)4qygc@*D7u_}rc9CRHmOkWEb zakUir$|&Mwbrfr&*bwEzk46}AT@>p%hz_U5bCEDHm^#U(C`v8Q^Q|DscS3r!u|KYt zz9q`#6L!8eAmumf)~K;t#Wun1f;%`5JkF%}Lli&qs>RSQhTT#8#1dl2is9!d_C#@+ z9WRQ#QS6K24>lUFX%xRiaf+=G#epae^3wcaI~m2HC=N$adZ+belI=(ozee#}6u(DN zIVJt5Ae)+;`Y~zY<58RtLWL>rV$ACstar!d*O0!hjh!oM`gF7M8`Pg1H79Uh@T}lD zb{iqo<6E^~h~i>G`8$eB!WWs77;u#{2FFeemKcWAuw7>hMDaL^8$6w+=9^L6isE(@ zcf@=kcvtX#6!)U|M|i8TsZ5NgLS*_^$U~lZ8+*^E`M7Px6FH-oQ9NZ+T*;vFjI$p* zMi~p!3x4qZU?o}I+V(1nq!>&wWQ!p=hLo7m6)Qd{kUfTf+ZZ!jrTUpfCL~;`G31D$ zn3!oXScT+^!4^Y$49~|F&lAI|dO30m<`QJtXqH4-s3h1@nL z)sCT#@VYTHjG<8s^~9_%*g$YPhhAq}|* zPoR~MvUv<|8{sYMncK(EfoE41wacO-+dqcuG2Dou6MHzP`WU*zj2lNgtJ=E8&@F~# zF?>}6m8Neh@jcSj6}D5&7hbWhGRAc%@e&N(VcB#MGal8g$HgCIc#lnf#{ zDToO~Kg>B`MEP&urak`W)Vb%@tyizAUWMuI>75-Q5^U|gY}2Lx{nV|sxAE0h>A+$P zD#n+~FX=-MUOrUD!-S6tN4CE7+anK^EHOgLm|{F$%=fM_su-iC&=nmnmgQI}t}n*R#aPRMD|>Yt z?`>@^#qgD4yeg3$yZOP=wU$~xII~g8reeItquX2l{o|K29SvH)_p+rJ+l#TI7+ZM= z6oWGoYvW~N5!23M?B=nr>brz(RkVlae=+tJqwOFoR!kr4Dc$C&G9(9zaj+Qg6yp>l zS&YM~^|tUxF^-EIEygjC$K>ts!YXem%VlGGJE81J4!o1)^W9>+SBy`J@jvPB7vsZX zoEHB;IK7ScOffzx#@S+gT#VU2mh0Nxsz@xHe5r>AR@b0%t{9&cybLI^sG>x2 zTV!b!AFBFL=tGeY1wK^s;aVT=YwNAhthwz>iTet57+rn+Xw!?*XxBh32zYIDD2eM z%hEbN+^p>JRyCNd=fkZ&+~q^D54ZVH--kP$u{7}Eb|3EWVN6?V>`XI6mQ^a*(1%9s zlCn#Mo7#GP9G4FvAN)QTKA4PKVcCEW7u$MIxAi8w7aiMY{TG|C4-p>{J|umJ`VjLW z?n9+;`77Fa?`Y?3+|Fw2!;z&Yw)3WZ`1I-0CBH}7hqdjz{EE}_Y3cp#ygAO!yJ+b{ zE0M-NH1XkX@utH2eQ4&xJ>si-m1!=*D))-qC;Ysfw}qoW;KPFsf5?Y%-K-0Erq(`m z@}aX2ZB*J;*iP8qvG3qRNAYDvSJ}0?DBH`2u8vJNAG(Y85cU*SY;QfU>+Rz&+@i0P zhkbZNq@S?AaDeb=^xA1hdDl!SX%I`56_9r^>eOTqg9v|NHVYLr0`LI*HTEnH~!zLeI^I;tqQZ4t( zKD^??dU0mw&CVyjs_X`#t!!i@8yCDc+5Ni2Ek0}&*(|(mc>XpYwsSAEb``gF(F4g2 z6_Lk(D%`~(6uOyqi@f2(!5uDU_cHhs+;s-K5Bso>A$p=}?-T_;8YQ+M>$ebE{0=R{0&SvC-~RKD_J0 zd-C?74|R51yZe0~K9ExH6YCN2;or)f_E|V`Yvr>(e9Xhp504+8`0zg;{_x>XAI@=y za&_@A_u(^k_)+)QKKwnm^ylJV2q}Ik@)gg7_FiV!q3k!@Q|-O~RCa&w!;yMLzxZ(8 zhf-?_e-QpC{KSyMOcHotkBbwD^#^y43{NgwjcmK{*hJ$qDHmmekk$Wt2s37BGk7c%Un{MK~j`vH;CLMj!j zdCU0m*10lcw&Bhp1>q|0a(-0yqlzEp{a}`RP&>{AC2;>*YIQD<7KH|?#C5Ut`yE~?`5LF)v8rfSW8IbYy7zGytR*t{P6lQ z#gC~}{HX26V}1&%D`BC4G27cTwv7zt|KkgLyY+?b;n6ee!MCy0>QS67$@jwIHr|Cz)kBs!7A0a;y zj!jr3DvbDXw2RdTrkIqtAASERw3VbEDT!&J-Dp;v204+&e%w3VvTy1~Ge250=F;!+ zqlF(2_|aV1d)3f=PTl+c{Poc?to5LywDRL2hqv@&!?;Vm;uzcd(aw*4e)RXFJ?FxY z?tb*}qa$&vhfccs(aDd_e!Th7<;=35T{!l!R*1UE=k-f!k~8&GwvVuvus09eIhUf^ z*N+3^t#${fXrS<6;Uhv8o%yZuAU_5xJH(HnempA9o-~=1&qSMHe$b3$go>Wv!S2UM z@lk$^_T%ODUY0VA@#AsnV}(>gFM7s_Pjr;=emv#pH;>jTdfHhD<x%n)aGrpPQmW{b>m^tOjxEWNy~^>eS!`SH9T^Zc0a zw-hG3=mljLaK<;~z0;!PVn3Eh+3m+tKbCQ;PI7JYW4RwI{8-OnY9p`o<0U_?^tfMi z_Vp@1Ry+Jid+!=<=MG+`wIb_;?8Ym8yvl*hFTACLcY_}r{dmof*ZtVUEkDYAbWXvs zVeaJmJo3$cZ1H2ObY{~MS!9=PXIp;kbapX2ze}8ituVde#~yl~;dxWIv8?;|9{KyZ z82lJuSRc~|8E0-N13?3a{W#)BEd!B^=cpgY{QO;acbJwM)8H$L!VNC)e>i%8KXXZ-lcDYZqKvFH;&{wMN< zALsn|)Q`{n_*~vtYTMZM|7IzE&E?_8FMgc&<6A$z^Wz6Uev}_$MAh%PCVww;;MTk@ zz1=_g@joSwQ1h3oRnsH6`JM!$rV`5{hJ@Z`|$?@dyAX@ zVrw@GCKRSguVsLFo~ zsu`%RtX(K&|TOH*#!!n?9yOf5)JDk!xMQnpc z2JUinDmQHK_zV#JLPKZ@myF5pKEWL_kTj4o@aF(`mTc4YV_`qenK~T~D_@exfV^p7uYp4<-DhCGfdd8(%7zC2cIjV!*uathUwTaIgdY~iMcxv= zZQukqi+ID1UUC|oGVrc}_ZUXT*2Gd19~k)1Km`+*nK;dbv;*H8_<@JsTb0ik_{hLn z10Ngs#K5-(R&B@s44gCYxq&a}KkMOz^rohsPZ^x1p3j8Cms*?gOAY5Mp*hS7!q?*8 z@Z5OZ-L0edm5k>*1NZhXJE5cZM*}|@_|3rY27YFEmw1@Y8~8=M<=i}GfBg^tLz|a- z*<<2Q1Ai%dfxE**o{7H={3GR}_O;8zgE|U`tWwfMDHCNl-cjy+6EIQQgj+ULm}q9B zP0Gr$xx{kjrE8M%Cc3W6qqmB-V&V#sO2Wz}syLQaO%#}@rfhY&s$pI_m+byrY2qpq z_fRx(wTYT0ZZ~m!;58%TqwwsZ6i-~&5-fE)02<>k(!O~wkdTG!=BKe(m zEfXOV4NWvMahHi=6NU*k%33}d_!-!Bc~ zA7x^UiN{Th{*S>}6Hk~JCuLSwYu26=XLFpgvO}xS9FjM|#M35bo0wx_qKQc+rkR*7 zv&kl=n3yWg_&=jiuxbBe?y+GHoy;&X)5I(p&^ZTqVQt=lZu#`g@y<2ztcm$1U!}lv zCZ1<-WXW#Rj4`1l-Lm2W6AMjnRV?CkNU>MiVrR9mtz{;boA}+tA0}3qSZU%b6JMKn z(ZnhfZ<^R^Vzr5vOl;@IF|o$PS`!<&6rXXgGf}swh$r4FCf19;ESxwqpZfCN?pNu& zw|j$d-6U6)H?YaXYbIVdvDpM~`k1zgY!ULdj>(w_j=!?6;(&>RCf+kqv5xzYiNn%QnBeEs5fjIhWzkU)ipNd7 zW#Z#qE{bo{W#V1g(~MQ9Ful)D0f`?vK3R0e#78F1a({L5o-^?& zJ=2K{{--Y4)rp_6Z~fip`@6po`CRz%8W)u>O%QJzo%fB2JJ)-9OfDF+-6G$b_|C-l z5`W;#nh0DhL;Xh+KS}&qXp84f{Ayyr)coH}*gE-;sri4J_=`t(0A&K8=L=ln+fg!r zzq!pP7yKh6xoE;A1M(69Sel$){L008aoF1E>_h zn#~^nCwb)pC?BvQRzb>T0rc(Uovv}Q)VHFra=^MHE09f<0IG^i>13T|)dHvMLGXlih1GpoAI|Jb88U}Dz0L1|;>Evw`z_Xh@6nzQ>N9~sl37a<5G=oeJ$2VK^ z&Yc(zAQHf^03Hh<8bB<7`vSP1(cX%90F47^62Q0#u0+6kbdU@n6+k)w_p*YFkZ#Gd z0pye=KitX7x_1ZAEP#9Hvui=q0DkP`W%Z&hC@597xm?{V?A*=O;ElW%0Xz`EkN}2q zrUH0~BMqQW04)P(6+o8&x(3ji`c|~l5ZZ_{+g9Z5wXXKm1Lzn)C-$(jx3kO^w06}NN7_`>c&KAoUGq_ekY0KEd%!wP0&6J5N7=&K0up0r;8{R0@F-f{?oL>>;{ zkpKpYzc$mu#G=8=T~p4t2=}{g}VaSEy8ZUA+jfc1vM@` z>DsG`ygNR?eYf6oD1gHO9F%819irzW0UQnBw*Y<*;8+0119&fh_qnJPC0;G?Bl2xd zW#H0h<;eiv3E-4U-*rU$Vu_X?1n^-1UkC6_0H*^u6X3tzc7H1TNcc$rXGJ~^z&Pq+ z={Hl{|C4e~_>Q<+I%nlXWSLt~k++LIr|p8@<8u%1s|;MpFu z$ln3{6Tn4@C8SVviTJiuu}Mi~O9^LBw;r4#h|)ppY%dsFwpu8-yo_9YO32 zqFfN=gQy+E^+7y)-d!PxDnV2gzf4#$h)SwX50ynu9?B~SqFNAzLF5*Dx^(eY55m{p zIv#5Tad{9|1aV~$1GiMJ6~t9RTpdJBWvP5tJCFE32d@d@+93YTk`x88`!Kxh-uArf zg4VZb{348_xFLuegLsw3yKqwwb%J;-h~Yup97Nq9ng?-j5Vr(TFNmycZVlqLApAiX zLDUbTK@fKa(J+YHRZ1tWrTN|V;*KDQ%r*+*t{{qosCdL>4s}y!qV5y!J>nuag9ro> z4+_5yZ?OM#{D{23KZ3u3wxD@JKn5VM1L zQAKltm>a~xAQo}&1o522dBW#~wEx%hd?_yo7dWMhgIE&8vLKdASt?`|dpcGqYsX=w zQ-zUP6~yWwUJ7DO5bLC`bt>A%M5gup6mUGe;uvfY*(lr;#A`vkF1}5;IfyMmOb!*< z9=39dcUcp$ojZDe-i`AtzKeS{h#Nw_F^oVXx9p`Rf31+hPf(~SQf z90=l|oWH|kDu}~Dyshk!AdUucJcze~I2PoWIC(^-4&%zQ6{4LbKOy^*!dXkKKAZ~T z-5}lz;(du93Quh;$)XR$^A_bZF?&XRU^hMzIV=1)2=`vhe4yZ*vR?=BjmW3M&w}_| zgtfj9`7(&F9Oe89&$mH*7sT&D{1L?WLHwYipM^gL@snfOY`<&FK^L9;62y6l-%l_2 zHHhED-!A7K^*{kjnf{dG3gIuO?u8)!cKAO*Ty*#>Ur~vWRV7bIQZj^6;`xrk5V=Dr z6T-D26oybX1WyPxLbyDHav_utp;8EyL#Pn47RhBoMx$Rz>(HyH>`O*bl@O|OPP=%k zh4_uhrS(vt()nGy)T^tszEN~V2v>#>A5?Hn2v>!0bqF#2*=mtv8y+SP*;P! z(8bI2#tP4^A>0M{bN=dj|(;;L+xF>|>A!KFK z#IekYG`5CpS<>g-AvASLo5=~qd!@8+^!q}%U)=7M-IIqxXeqI82(3bB9YUuNI!kF2 zLI;tyLfW?rp}iWlJ#=(*JKH6M9#XnGdN+~oPJeoa&?|&|efH5??-2UPzz$%)5c-EO zz^VI)$ix3J7$`nSIN0&|Xb8hXm>a^gAv~s{Q6Y>L86HB#3hoghj8xWcWlRWE*j60GFv!DX!q*55S|ZVc?c^)m>0tQ5Eh59L zV)t;V_%fm07LjccSB9`g`isI!iQ0u zj^ectUS|L!m>9w45VnMHER5q}Yz<)>*FYFO!`L3eju5JcQ6r3p-`6+~-L-@rR%Xt}4 zXLG-W@OubAd?onbT#qgEK#gmFt4^}@I|jKZ+BPiqT{gkB+o zz}depY)vZ-t`FmeFm6=Q&BB|6b%Zq7GsikD>ngiP>*3ZgZV%&*Fm97r-?3~EwgOIL zChjJiHwxn}8N|XU4#OuN4Z|OXAs!Z*VT8igNfHPnDDv-Wp&zD*%xs@LfOhh@qn->Cju1X394;KGOR16KqlBZm_MWj;>Ep_d6+R(+ zQpgK1mOd56gfP~J@p2eXhcPjX=fZeCj7eck));4mF(r(t;?srCgfUHo0Xd-s$#_<< z?+S;yXNEB=jM-t#aco#L*Wu4PYj|Fm*FRV#{RQEYFqVd~AdH2|E)v=^wOF;tmxZxB zjFl?#?#^QeR{Y28MVZ-qWVQ5{!dMf=T5%fN-qtx)UJ2vXFy3S>DI3Dr9L5&$jbUu! zM2Np0=3hLy{yl!_XRGv`VQk|^fL8AgXAScX`oRkBU198&P0Q7JZ-}tg9_~oaE zBKyNQAaYO*(ejY8c5jb_aa375!f%D~b{KUdxFupOyc1!RjG$BmC&PFrj8kE}8^)Jh zbz!`xS|5gSTI78$v;VkdD`&#^RLVzToDJh+aq6F_pH}ORa!$k!>}TSiv#Tsry|R--q!757=(j2NTnePOQj(4qI0*Z0pxBep8i;!r#OA)A8_! zrj^EjIm(4F{tn}xfBUIE(7+Y3{Fe~sMJ`P@qm&=PWf4@204kzQX%Tk>WgMlfh$n(_ zBIO;uLIhntwr-ucSt>8M)gq`KLG1{xkDx{bmq$=5f@>nU zB7!R;s2M?{ZeFIVM6QllcUZPU!Yui<5fnyHq#}y6q|W4x;5v!cZrx*5WV#`OnOlxMi7o5qHM?!snfu&9*-aq!QBxwjUX98 zDuTv}a5{pF!r139Uz01!O3XzpZpVCVYZr@}uxVYyRy=okvk00;aIchmgm-QC+$Se3 zRQ>+QrJHo#sy`U8{5%vv%ZPOpKM_Hz2wF!lFoHo5w27dts`QGWT?Fkp*AaA;(m~i+ z*fD}mB6MZ%0%A8QJsiEe$f*73=_s#GFX+wgDcd)Kha-3-f_@RpLw~lrtY82`vE5@I zECsu*(~OCq!h<6i62b5YMyT%42!@F~Dzwjm$HZyO2Xw48GJ?@k$VZ8=l`$fZt3~Q# z9i4G_QqdU472CRCJY#aE>QfQ?(kgF41l{*o*-4BcS4$MJD5gX(HG&FJTo%PM5loBV zJeN=e(<7J>!ER1g1T!O;6~W2~UW{ON1al%-pyuXkjL${zd<4%*VNdLnZC(WPBX~jk zlnT?oXY9fV7Rh*V1j{2>5y28=mpUGniLi=&3t&53C2?H@>qS;a@RDP{Mr5sXCcGTM zD-mpsV4L(;BiId8x@}3^}Y!PRKw~OqIU{?e?#Pi>@ zDl)N@$m^Cp(%+8YLif!iQuycK9As31n;Wo6XAOid>Fy$2;Nur1EC$UGZB0g!C5K)_IBE` zf{&%xp8w~Ro>Nagb)rZ6FCzFZg6|{vk_#zy;>^*ql%5lq?RVj{P(MD$YROGT0A z@RCt9*6E$^C=lu8D=H&W-qFj7c%mrhD0%a(Wl;L5k`<$<6vdTMTotwc1g3J-I`poH zqDmB1qbP_XSjtsRwO-$gT9fmtM^Qsre(=%5yUZBptVvabDZkK&Ff?u?>g6g&G=^{rT31*F90(7sdS&n+xxa;-!67NLx6T4~TsF zLLQ5#GqsGOt#~Wp%x>P+QM7S54cdwG1D(91c&{jWN6|^Va}-^o=qlb_*iHD^Udwq8 z@t&OA`JP8tn#<#iH?1oY{@1 zqL>gx^`(}5fpB6JlcJc+!#|4YsuJ$%n#%J(ilL`#{OfsI6t~LHj3{QxY?g4g&~9Rm z_}nO-jiS%Oe5Qd5^XEk|KZ;{f9FO9KC>BKVaulybu`r57QLKn!rFPKbD3&rHQ7loG z1Ak$q=axYQ%a#3mU;+6(+dMBuu_}sn5?6B>aEW#(_+yf_f9pM)x3`;jO%%knLW;bo zSkHL2wr2U&C^kf~D~jDwY}9h)wbNFSO?(Oz#p{efdG}^6(RF3Eh?7`pGqy#sorl$4 z?BEXKZd#mA&SlSgH5dX8AmqlmydVY?g zsJoXJqWp7)U!pj#<^8L$!ftC`{;;Pwihp?ii*w@s61gDcR~Q!^JwIlhw5}LR#E=(5 z$rwsWvCnWsF=%QYKPDiNmZe49F_aN0>*$^s$~m0DzbuA|F9Kx5MC*~Du$~?Y6@9eD~4;t|2|>ORLRMC zMKO3|xK7?UakXO@)utfT-MWXmK871&xG{!C-Mvj8a&0Vj-6XR*F)&eNXKsn1UJSir z=pDnYG29ljR_XmQ)Q_P-451jpG29-*9WnkXO_4ul9V2(faF+;qLy<#rf?O%zewO&o3gw%b1gQj-jiHy2Pw3 z(`H{0Yq3fXRix5WMHI=2ePZYv!>|}0i=kf({bLxUS?012)+xs{Aclt-x;o_^5e^hG zTV;ISU|9|k4i$1?JSr02?HV4#h#02E@JtLNxi-}9_?UH4jgH|7Wyf&o4lkhcxUyqa z%8os$EDw`$B3$QBG2k&gP5X`o6JwYpJ#sd0vc}5+vep!dJdU`!rqNXl&&Mz?h8fO& zc{YZbG0ci#{gV9IG0c%}pSp87d@WrYpNsJY&Z4fdqWLmj=y-TRWI@dOF#SQ7D2v2- zeYG@(Wn9v6+#1JnuCy3_iQ#+F4MhtIC z*%JfPEjrmI{CEWoYA!C=8?%sne+&m=I4H}*!b6Uqbvr%eN7(0`)+he)7~bL(#Q0kZ zcsqs@F}$ZDmY$5^9qj^gF8)*E?+Tj>-W_H%$MCuM$2|N+_O>bb zADej7N}ozOCuH_Bhj2$QeG$W#Qoa&W;gSAL4BsmIT?{|O@M8?$EBmXifob!TvOn`9 zW|Q??#l~M__>Jdh+;aOnmj}<`xV7v5RR8~u;UAH|Vz|IQzhZ@scrgZ79MN)acN`_+ z$cqE2#fl~4==EIH{5VQE3bRZsDlLUY*r^j(#fY8b`M{dc@H)j_!6v-Z+R5 zd&SXPypN+$v`hO+skh(LKaK%$JRHX(QU-FJEXlX}sSYp{Ohe)r8pmiEJQ~NaIEIVU z>@g9ZA$HJ4#4(b;|G-Xe^4No-4LNa49FKF6u(t2XYr;~6P@V}Xf9O#F!C?cR(yh|Kb$ zm(?3C&Yu&HcbDmL>523!aIgTyjTjSUv!X~zfY-fiz zT0PvUY?0ohdqZc!LE#?Zn{n*rsN>kL?14CH_OOl`CXymux*SpwmBS)Ogh#nCW%(9| zCglsw!ihM}#PLxaC*ycWeK-}z`*D0A{;u#nA>+&*ekguA4qK!`!nV%F@u|qiaeTrd zaO!vC91jZJ-0^D4CZEaXbD@3T$7_-=*&>G!$JZj{--uK^>H0p7AL4jEg?TCb7{^a> zY)oKN0zb#`OB^i{cp!oEas0}IE`b{o_$`j#c^W6+Nnl1Z&mVCM%Ovn;9Di{y$8qx{ zcd3Mhf5-7p92cdOkm3@uD1E|}=kSsuUkuNuo-Ynz=>*&&bC0`NGHfH^^-5=@1gfZGBhMC8PGH!f%58dB7u&|0o@xnHPoP!; z*CbFQfy)!PDuJsLxFUfo6ZmxtrafL``9(Kf(SF8(%8&N&9^2!onZSvQ)lXHkM5b#K zC`!PaK-)c@!UR_L@UGg9>k?K`L4murNa1^h!+*A}!EQ|8CJrHix(Vw~_ShxHs*X5& zeoF%NID`Z;3EY~%Z3#pZh$T>8qxL1>PoO~pw6gNbJ-pcj zatSm^;BFa*|0*+}TYlpNdN!{%XN!LBCID}mk#3`$^d z0(}&R0Zugfiu4oqXFnB82IpZZk0dZq#Ev}mAqhMt<(n$*p(2lR)rr_q9WGAG5h5cM zZO#INGdh7W2|UhuA87p!$+5ETu?akpK*OG1CMx3-cq)PC5_mp=2?;!%z^nvjb4C)F zl)!Ywb8^BO?=uNZOJE9Dvd2ADdP*MXq*G5XW5NYIBY~OR+P_#Ulgsa;`c-z$%bSzn z|K7@bHi5aS#a%XeP{D`WD|0sIB``mMmuQf{3kfVpU~vLVH17)&SS0&k+`Vyvn?IOC zpGy;1mcVk&4%a_h9R6(8%D)z_NMNPL{v!8_6OC0O&yUErBgsCjO<*0Tqq2KsPw!T5 z(fR})Z0UMAfmbBH$_>)W#ZsmX4u6fSf=59T)sof;usMOl2^>jaO9ESUCU9YFOJI8f zI}+H*6{XJaN`P%K{`(Tx%}5S%zmdS?iS9i@k~b6B>+o4W7w*>t9l5s}m+`>_4sjNK zE?m;nyXo$NYf~kUCU7i)UwB9+a6Eyx5;&8za*DDu^R*7LUsd?%4B^WRo}8cCR3y}X_z$|bE6pijY-nbS95B#L7ujNn&5O0{(n)#SPV~CUH$KFS}Pgi5f{fltRlCE>Gf$ zB+ex9Q4&`s!M`;KB@s^IswA#XqGl4clBh5Jnk23jsVgi@!kff(;zh#b)2`Y{TrYl8 z()v@u8-zCs`PX?=h;@>?+w|CUo9FcW%lG#rK`0q5petmoz^2sM3Wev#E2wf zNyL-rp0w`l5;RDnMG_Arkz%NmXqrSb6=j4?lE{kCI49CLiA&!`@%_)F^|cza_o(PT zVROg+UJ={){{Pf^kc%OSb}D^H*izUkiPj=)tBnYqw-@Q;=p7iDq3(`c47z*m?C4!Y zx+c+0#BQ`l5%_PbTq{$T;D6$A*5` zs|m_JEo3W`lbDjk0>@@*5;K#SmBcfSGA)Ve;xiO*+sW)C<|OfgV>362=QXHjr93CJ zBR0>mnJ)u&z}86?s%VjLaS}^JmI`f~6-lg2;$RYol6WzRRY`0~VrvqslXxkKSCV)& zi8ZocufDAnUnl&xp_i3qw>KoQQG9a}n?&pxe@*;#$BY%3XunO$8%gXD*)H6X#Lgsk z{b%j%cE+_# zPf7fo#4kzA+v{S{sa{^9)rxF>6aJorQN1ihw)j^P7t|1W+mbHg-^%{O-K}hi6!KEm zJ1y*I$rMVZP&x&7%9^kI6rbE$cZf`o!fcro%BE0GS?V4UzINj6Q1HW~yz)*q%NK`I zsFcF(Dcq4l{SYOy61^cVvJ5y+wLQ11;02J3PEK< z!Y_5iQIDh$b?jpzabZH36t0|MJr+x||0!gpHQ#kiXLH`s6Fy<+= zPoYB!|12xhh08{yqp(v7oka#TD0yFllHJ66rqD~IdkQ^7Sj4(?*jsM<(A#Fqf8P}P zrBME1>zhF$OZi&_rE9n!=5pGC<~<7@NnxOj2cx79hq&{K#S@n>&Y|o{z=S*I?W*$16pTY|qbryrNSdhZP6y8qb zL>h}ySe(MEDQrk#NeW9-)}`;76qcp1JO%#J6lZV+r?sy8r4$;?yo_XJ3cGjX#S~Vh zusUV^^|AHW*7Nd7yo21=?DecoVOXhU?>BbZ`aa*NvQyQ-^ z$egb?=JD5s}@n& zlfs)R97|b$=eswBeJLCk-%p2Ciw>r6NaTQ!HZ~#h2M~^=aMUS%YQKx6Ovf1wc_8O6 zB%Dm)9j>$#K270N3h%1u;}qUY;r$doQuc!sK1|^ZBiXXbX*x75!n#EMZh+01J*y(R zWz(Oi;{Sv!qWD<~U#IX*3ZJL&MG9Z4h;_dbVHNuq8@^TcJ0AZ3srv(;|D^DfV`(>G z<9RM)9>r-ZKEI{#dkQ7Rnf)V$3n~1qT7L@v5)OJS{~wWyDY(*?elLRdB~&pleQ9*; z55-bxjPHV`&U<8~1$chI53YxnjxO5-kNi_`Fn_=NUV1nmt5$N5etm_|&cAt6h{B9Szr zj>4;*cp8Z`l2X!+o)WR$?!U{GQ?^+e_lPtWHc8`dk)}fWr+xD@?oHz%N4YPJ2ONHX z8ZE@nF0(!_m>x`DdL^%=bh|lTMYQ3n;1xyMx^f7dw5}^w>~wWVqhlI#(|9(GPHA*b zV^|uGad!5gOB#JRcWHD@qgxu?)98^#FBP%$&mFFwY5cy!#l$RA@3bY_yk8oFW!XQC z0Wy0yjYrZL=-3SUkDn&rm0_(RQii7Ss0iKC8`JPKMx-&GVj3fzT2G`gN_=!0V?-WL zW2{qJe}#w1?#YvBjFV1>%Xec!8c!=bGmVL9OiE*F8qY|XoW>N#gWWnkOmmd!8U>XZ zQl{_p*q0Nt(wLpboHR=Dmn9Sj_W8Lqo=;pvag>#5tVv_7vM&l(rLkJ%B_aQ+)b7K&G}cRD))rq@_V(!o zuR8h$5&m(+YiYcm#;!DWOW7>kp2il(a%&pf($;q+^wvY2+@YeKLVh{&MjCt4IGo0j zG~VR$OXHx5_6hf=aX{p5eKpLleva$nklqe)FY7xX@}sgjE<7gW#UAyyxXo4ZWE$@< zuo=wD;8Ys#@{q}(W(M!2@qQYgrSW+hAEfbN8lR?-8tguu#u;vbwDsxvQ5rALEcjUb ztT=z@hRP>AH|AF%v9ss6;5&JlWx8RO=ZiGHOamE|&fu#wzUJrS*2-f?yT3`}+cbXT zl1Sq_?)0rz`Z0~~#eWdmKP>qZ&#^Rq(K&fOjb9mOmy3y|OguJ;e{fTzQ8HsW`74bJ zX2@pb49a9sDTB%xl+D0n)$%+xyllA) z%4e(t{NS0q3K{F&>|0M3F7NHVOuV9y;^5xi_Ep^j_qnQMP?et7dI~bQLZn&-)ibCe zez{!H?BRW`8>d-=x>7prugYN5K9^Oo&|NEo+cUT$gKILlHe>xRM`6bLwdz|kD9XT_ z!F9^sB&1$j#A%s9CWEZ>WCp1W(vFR7X&V!nav3z1LvohVZPN^zW$;i2Ei9vM8G!6O;;R5W^L&?kdlPUl&-ZwCD`=%2xW|KG#^uF`=S z49Z|=29L_gVBrv_b-UeR^7)vG=++jABe|S1n2^EK8H~2f|pMYbQ?KbO#~3}$OB z%@Ibp|g<&+1PyS-LKRjTvmpV0{KJGvM1j zugKt4aT+jfkaFE7&ub!^g|7=)YTsOMQI>o=w~zSo40bXa85~r0w{TAeZ)Wg@W6bJ% zGuX#n!0&(mBht?S4!Mu@F-JU6q%?xF|1~MJkIHa!x&+MdK`*s5B$YW|0%Im(bnfv}`WYG>c{;_c(g) zbY+&_tL%MQ-0$ck`g*^8-nt8WNZn{BWZznfw92BjNE=~Wr}RaB3&2@Zwqq8(L^@^B zS)@xA-9@?z>8)E9EBjhcmU>9(>FDvr);8&_Y@aOpiuB8(KPS|&c{mGuPto!biQD>m z2WK%Pi_=-0$zo_0k7hA9i)XVKmbD)HJf6kaEFKf*vy0(bjL2SkjxjQ8J?a^i#b^=o zF(P|L=RJ|dlQNr@#W=3aEtrtS(^-s{_>|DK*K>c%f{9s7%3^Ak|9;W>j%;!kQ`nil z)>b{*si5u&>w8kRYi0|G{AQ4@rfZSU$YQ1lznq=Ad5v=EY4z~vJ3lGjr6nHT_U%61M-)0yY=%f%VK#JD;RcV zS7-5}$SNTX_-#HDiLI>3Vr>@d3&^^lLDn)R-7MEvM~`h1LsRo42p@vSW0k^Z(S zo)DfCex?^)PG#|~vhN8$$l`qw&XoPi!H3*^dMo3jEY4<8GlyC^e4NE6S$vtrS6S<) zHUF2jelzoPHoDn!E{jjOP_x!=LUKCd4_m(*`9;?H=}21gKH}>vzRBW`EdI>m+bq7z zqWn(qPJssBYwmu};)g7LRF$8yI4|;Z7QcvW-{N7S@vqAM=9E(D+0V;ckH50Gz%ya7 zr%Dd(_@5uMD49d49RA7Tj_Zq09Ph?{US{(pmdT;42!y4D?i|j^ z#-l8aE96j4yu72(;IbSlDqAUsqkYQKjH$8|W}9uTTr~$`fv{Q*)pMwk!{s?#k;9ca z>-=Y`(ccQ)+eVeEa=1EY5h_e1*W_?*4)t=lHD_(`!W^#4p*Clvth-3)&4Dj1u=@2m z+#scnkY82bn8Qutd~JYhiTm;99O|mkTXNQm8S9_R_x1OpT-DohsGmb9hj0!Ja@Gmp z&%wy?&tBZOGmFU(XzvJL?$XLJa|o#2ppcu0X9d5e|M*Q0 zUo{za++}~iA7Lo=xuUX(saLhnT#?Knl|x~36g5XWhfEHqo8nAUWOK;nurr5UIW*3p zNe)YLSenD#IW*0oM-Dw1;T-Ofw~mTcbM{ALxi^RVa+lrm1rB+g8|K*iOg|(m}+2fq}#6ltbqnx~TQ8!frY1Wg))M z(me;h)52+D>Xk$993IVKm^#)chXLwp-yHho!0BMXIkWva*naMpp7%T~SC8Z{Fo!`o z>-7WnlXK149Gt@t^b6B7%<8m0E!>k-;=kQd{dU0av|1otH;8s-O_Hco9&%Fokr7qnZ8l+2* zPUW8NIWu!akWf^*8w5mBK)So6JEXfoP?3^UP*RbQx8^_2d++=9x4!kS{qH?{c1`V> zNynsgj7i7WEM$kAV_DntGLKKkxODtBFwHhCGsOw%h?B=hb9|GI$?3?RV40eZ@AhJf za1sVvf`vNCbXLMy3)f6o34Iq8_2j(H+-Mq*%X6WPb&wY?x63)$6M z+nAhHu}JnV*xI&~`?Uw#x%=N6BW0QF&hm7uNXN=_tV+k~bZkn;=5(xK!HBbMYbEV> zc}k>g$#eNcE-LHT3KB)WAsriqGdG&t*4lz4wxshE!nQTtSai2dl5?4gCnYC;$g(5d z_;CGB!Civ81^1-mdm-`f*zZrrfpp|_A(smW({U&rR~-1ofy3!Il8&Jc40GUUI*xG@ z4&-*=csfp`8z-5G4xCKKsdW6Fjt6W_HX`>i9XHc)HXY~E@l!f}=Ip_SJBW+v_(8}8 z!T3kmE(yOZ7+;C~BWIy*R(_f7iip<)e@VwxR;FAp#4l=?;dS;{^IqAn;&xZ?mf-Dl z+!6AD*LJUiv4r?uI_|TFa8BkDcUiVg@-Q8Lq~o=C{weq*9Z%EoNciJ;4sr|YnQ-Rw zPdc7+)9LtIlox^>x*8Wme0lRJZ>yS~uhNYbv((>+@^3ocro-Yu1_$6U>LkH|j1n@5 zIkc;tfqG^!;}?eXp<;C)$$?~taax;A&?ZPTivwAOrwFDxQ1>KwhRmq!rcVwBa+*As zgTIY7?lb3cAg_b}a70+5@;Ok|focxqcc6d+1sy2lKuHHmIZ#*}iaJnCND+tel?>*< zP~3qM4%kJHFGAp*b1q$GRA~pwI8aHV$_kcqpuFS%zPwbyVXRkK)zvs1ttbxf2=aD! zWg%4@#(k~0Lv5V0Y9 zxUA1`j&H@N|U$B)RbBpKyftal&AByqM%eYJ*uLEwAdrTjn zD1O0!85VWFNXAXSsfaZWseX6aK12G}wA35-$@HVCrsF#y^TL;>S z^0BG67t+CjjzVsCH7?v3K5^hvQ97HR9S`H51Y-r}7Y^ezpo?Hv!EtTVW{*$kE@kWC zKu-sH2_GQXTd=iO_}XE-j5gMR@j}SQIlzxGlJM(-#I0Lwe2smQ zj3BNX|HgsLvKpLo*Hqd190$I2{C6K4lhRfQUn#gsaJ3n`Mu?@Gowo(nIdE=a z<`WLAcVL498y(o>z&;1|JFwY-E#kRHaI4@h2evt|-GLoqvLqad#GPWYcX4>`cJQAj z#@dqa9oQ>6ABu4dGU|W>2OW5$ryX@(hmTD->A)!m zPCIbMVXU0FEKz42xFCf7=h!a7D|9mk`$Y$SFcq4Y%%~qF`A>pB3o^Hc-RxH#xW<9t z#1~Fnci;x+94G8f++;!r@;H&#iCYfb=3MGTCMWJVaMyw7>^u(KlU?}Tfd@kFJMfzj zPX6&{6Aw9?Iq=AVKSXEaGU~AdPaJqAO5E+KaK2*6W5@q~LG*7C-w3{N;2$9`1z!m= zx7Q8?x*4%3XeKL!ff|@FO2qSQ zE(*;SCSlFIFZJVa;sdh|TRV|1+$wK^JB7Qclc9dN|Qj`oJ6~ zdO6YCiSbTMaH5YBeVrKP#Aqk_IniHyMmRCRiGfZGa$+$3XIOY2lCQ_I=L`{t;eta2 zhY2!@cko{HNGAExR7MIJ(@ky(3jf-PF+%<~!?9wHV+|ZJI`Bj%CW$iBiEo5Vabl_y zlZD62@U8G^PE2Ot?+RRzZI1KTdWyvD1lNPV9CXbMgUpY$yL2XYl<_>=i=3Pe_5e zHU=K!;_Dl!9~AwN;9=nuOYw`+L!IMrozD)MYD!^|#7l0yjBiln)a+l60T zxavY47xKE$&4unR`e#BuapBW= zl;C^j`l!#v{6escU{}G`bu2wx=;^|I7Z$kC%Z1)940mCK#PUSFj|+WW=x5gXAR+yw z?+tKappa4fYF!Vqy7YWfcoa_ghCFI^ZZbvV_9Q7()YK2h*1!Lfp4T=-hZ z|DKPHb78zF69k9VHJWLX@NWcZP8Kr71uo^K`K_4KT$nCoh6}S@nB&4sF=q+VjjtpV z=ZZPc^`9AE)3VToMJ{Y|VY3U1r7GBVD_vM3e5v3v!R2P`3hrrl<4ky!D60k6n6cjp zSu42Ch4rSsLC8k-Px-9t78kaPa>0ddE^OzFA?6O#|ELQ)UDze&ZWj&<+2g|ZLiP$C zbYY(m7G}Q-2ZZy}^fV8dI?W>{=h~rTCO_`N36p=j-*!s)X;V2PPC|Ac#*v z-KZd>j9^(e$_a_D#;oYZJ8skxg*jJpqngPp3#lSlRggPgT}TZ<`qy;-cNncLN*y=e zb)&8sTTcj!{hq1R7k}o%`KOT^E!}A4HjZ?S1)B&qb)%V(=7KE*3-!-QH-`7!aEbDP zAeGia(%o_)_m-fr}9LvbVO#%FGP z?uP0%4pkouYHsL4Vs5k*@}VFd+PLwN$%{8OCcSoU#6O|XUi1!TY)2uT1V3@(Q&aCO zgcqt`m`Zmyx|qDHkZx=&S;g1G)O)(oOE^Ct$Bp)Nqn{g--I(G=e>VoWjd$(GyD`v> zL2l!MZmb)F-5BD=mu`#{WvJjVHwtz)?n(_8lVpS&JsXxF8Rdrm2)=S-j2ojRP^5C< zjIqYxYtx^Xc;kf6lq*M`0!@&uPjq9FkZ%N89^PA?>c+QjEOld<8`IpF?#3e4|0>%I z!Fg`XcVnh-inH99Eqsot%ypyox+F#|5M`m;_@p+?6^AXZ-Nx%eUQBYc}roZ@Li^|TgV{bsIk-{Kt)#ZsUQ@GdG^Q z@fYWRHh~+RyCm>&GnbySmiRse@s-* z51LL-OZ8w@cRQa%XY(Mt2RT?*-R-#qa|+U=Gciq4#myt*)AD(c-vhe`B|Z3gr>%eo zbv>x(!FwLm_rU3aixuA1Uhq~@0}mQ{(8zYf6#-#|I5TkD`wbZY>t^k#ni-K70yk>x2VhJ=+nl7mE{unZ|Dwm;~w!} zOFPikgLabYV?iqIJ^%gQk-Vb^ojk^02tN`0)Pv3>!YO|4!NLm`lA93=Lst*Fd7ycr zd(qv49v=Md!3z(1deF;*Jsy1TL2nQGc<_}6V?5|9`F!cYNDumX(BFdrX3j%}4D?`- z2QRx>2YWC?l=$X|!%WZN9*i*gWhn+LXOz?c$!K%mzxH6P2kSl9z`p9icn@ZKFvo)l z9_)K%Wti^4L=Ps3`HhDUjxkmEWWm`TE&2t^w;oIrlYGQ$>!=GBCY&M4Ou<=#<<})p zpDTO?>)eBR9?bV(0jo>IWgaZz7!kfya7jnY5+Q%Rvc_|s)6ufr1M1usb6X{`B;R@P z#Rbc1W_#GSMv&%OiCt&A^0EivOCEn3sRL{61kXbN1kt2e&=g@4*4-AwPR?(1SzLZGPf7-H*c_T=3wc z@FN}^6>?1QxZnvvdY<&)l*vyEIU{&h@SNaz=C;eo_6K$YR}TK1l;yu9{IUl>3SsQz z#R-f(H_r0;K6K8Od_~Ihiw9TPSFSTO{=_)By+Q6fI_;7=j(e|N^qHaM2{*n=lh_@{zYSi&~1tbegE z)f4!OReeMP&41XdIa_*B$ctB;_BknejSG`E9{kI4?nAPeZ#~E)go?$B3?@$yl2I@l z|HowN5Rxcp6-@G?mihH{nMTF7imIrdy!8_9zmwc zD`b}3e8?}nfFPF(7WSfu7Y)2<=rzuPi+WMUi?YItc~M*l^%6qtf+Yn@36}O^)mGzt zn4z2~HM}VAMFrs%1uF}_BUnjr4g2|FRPmy!nANj}Oq zSXVIRDBcrNUyuo3cSvjGMPn~odGWr8O$1wd(bV*5CZxGw3&A6sGcqmjp?%;*YcC>R zC|;zKtg?9p9bP!Sa0#z=z_{3CaC_kqg}hjoWS`0XUIe@ddJz&OZ0bB$q~}~-s4lie zy->Zz-(FsJx4Xt$d6GF}pDpIahwM2%B>2$Ai;uiG=*1x~+IrE>ixFOY>BYxhw3oK) z?=_yEcJQL37oEJ|2X&d-C*J>_t$Z%zQ^C$&d}iwP_@GUA7caV!2=6P{U9g8>Pr+V- zJQeTlMIYhAQ*`#>@m@^yVv?8>1bMCZjTe)>m|^-%@nRYW z%PGrLQ~B2PWDe84C^;_|2_2YrmKU=nc8(Wwy_o0yzw2vWSI+nTw-6%!yO2d*Ec0Ty z7mLlDmk3#E=D)(!*Lty%gTjl|W)#12yhiwU<|erHb)rOPC#?4(dfb>s7&dybN%YNL zZ1G~N7u&qpE(*&N_lXncu#5G^*U%HFHU%k3xShf)I4j6UnVf&8QBU)$`3-$ z3ZC=gys2Lha#1jE59686CE=F^e`MUxI&g7|NB-OEH=Jl@J!=wW;K6Xk3;5E9P54i|@ay>5M*Od00N5@!EJMpRv|4 zvk&kg(Fdy!YrM9cJ|y{&>@(KLak-t%hb%s1^ZmE(F{_YNA5w&HO4<&v0I*74Bl=7jp554{9<3|}E%KGq) z50iZ;=R@LedyA~c&<@h zJXu{egycPg+CJ2gBDs8c*N3{2ys;1Ue0YzwH`~_0hx$@=T=dA*j9E6@`1OE>%>SUR zkst{dST^yYsSnM3;0j5ulWgrnbD!~{gBCut^r00i(1#Dq`s7-{c;I41E_A%m+LkU+ z4ne2yzt2^%Cb`_v%Y1z3=|e9c{5}MH=;%WyAA&xFd}!-KJ0HS6M10VFIKM7Q@nO#T zq^J+757l2;#|*X5Bx*ibW7QTf7(@ zEn_=cx(nYuGJ$Rk!#Y}e`_RXS0X_`mK5j_r>q9^BA?K#+Y)I;loBBHu*5u2mb8-^c352ALjWm--iV(o)3#z5)R&R#y{T|`HZVD{wY3w zI=a+{WunlGJ1}a64=a6G<-=+p*7~rHy_CIceZqHwE!QWUo}NaNmv!rX*ubva-|Ex|y<{Nci4|y=?si z%bl~9rXA9Ft;f^yeXMZ4sol+b(1%0p7(QI^;jj-!m;)>7rS&NLNjK{mAI|!4Op3%( z9rxjc4<~&%Mg4KE(}L=X1abzFr#9>7J?s-+7+vL=mhg0D!bP8P=KnKC8K(kX2uS5z z^5L@RKMK;}Cn|C|P;G|o7axc>1+V&WO$e3i9Q7vubx#77UwybG%5A|rKHL>@PcZIt z--qACr2p?i9tb`Z{KJPog*+1E)e7C7`tZz$27Wa3c?L`{O!XFAO7LV zm>(Jacquhg-)8;S2j>jiD<579A%Ek8eXoV&ttb}1;gCU)gk>98E`eWG$>cZY;mm$x zD-ce?i;*NhlKm*;M`1r~eq`|@rysfeMrX_F2m55IIH&l*d}j5qXY(7?%aGlV9KuUju)BMOS37M8{n#Yg4e&q8TeW`#S1^r;h$S>yqUNe$VEaFE|KdSms&5vS|Lvh(C zuVGp85`NhIC@D%Ai7n+vX+OSy$C`DhWk!XJ7jh(*6}_BbdBF;TEJ;N_-Z6P4KPn5a zA~jG2vZ5>iSX7Z+xkScMRSWlGwpg zUy^fPqGux}_v3RvzVM@oA5HxT_!0D@nIFylNcY3xH^yBHKU#7Z{0TX?*fRFCw~`## zE8h1TSF#`Y(OL-k(VfQZ;q=4hhg(E${qDFlk00|tw#T{GZzw)Nzhp%-s%bkoaF(VG_G7N>=@37LazlO$_hY;t z6Z{zA$CrM5?Z;TDfsulv{TRhoUTfSCc<^h|SAL8Uot%MPdX?ym9mhSLk-$BjC`~ZQ zk8k`&5-OAZn8Fs{hgpJC{g~#*bm8AhVQQ60m?4DSW2PT8C)PE#NTf2`k2xZeQ<=wR z^<#k_3nhn5eq)d>@?)(Z>-;!1IbpFBV2Q*o6ue-^xA z#{MGYs^B$0@=r3((iv{}antnqRR|wZ-Qf`P=nV z0J4cs?f~)#$sRxsGl!f3b=o3TZN6bPW8kV1lm&Di+Q?u&|9 zEP&#s{!v!rWBB#}N}5V3A#9PdLMjQCGh@pOsUTQU@EyVUC0OMEssvC~lxhLg44{_q z>H*Xc!fnMpYX?y0|0(=g)w==I4WM2C?*%|J?nbO1K!bphDy}pRph*Co0{A3=rU5hy zz#V`mfaU?T2*445lY5uT%4^}40kmRm3^J}k-VYc9ke?j?KuGHV(gS$0-w=uXoh84_ z;|hRHLxpQ%y#e?F=om2G_4Wr42tW@Y7CcnYIl}BD}4sWISv6Sa^F==^$iDPdoP_|89I5Fm4Tf9>5m? zbPgEz4Y-e=1yHn%F|xV@&^2J(+8WMO0dxq-FL;dGjMGhhegHFs z&lH?x>azowBYdu@%;VVHV%!pBSP;NMQ(qLoV&O{!mzw(Vp7s?1tPB_ndanhrN_y6pl0JfMtd7Y4rg6jo02*&@Hw@LWsz<>7;*koG+*e2q3!5xA-1sU5} zZcywA;8+011Nc6Gy%M!g@L&M@g&Z*bxgwpZ4h3-7RE`Ka8bFbbX`Ikbh@`sRnJ?)Q#JQj@i)n@@b58!nGk560v3gB;v;$wa0^CEzkVlw}K0>&mN zz7j%CG4A#@080=b1kpN(3_&CWjh@poh>SsG;ysffN(YfS2n3D6m=;8$kgS4KtU)9R zPZs3uM_UkCg!4up9a4m+29Zrj_8@W!$stIG_yV3>LGTSAnz@6>6GYx1@&!>`eDViT zp&-{a^7{oh4R1&3={5rF85LLuHlVZ(sGvE9aYu6NOHBp#h^&o1Pyrz&^g0+MH ztp%!U#x@XAPw+j#`hu*khCwt6qOq7w1)B)+HtexFmS#btu9}O&Ew&JogzeQTi1(%8 z_#l90dJv8vx&_fa2xri^vlBZ!_sd>O>Z zAbJJSJBYzS3<;u75PfB5`3pJT;qMp305SUqjXVGGzxxdoZruM5qJ{kLkG}%sSY{Os z4PuzY4mW*9u>V}JG(KV*6~yQuz6xRttDT>`yJ+Me|BWCC(~^%1Vtf#PhwvhV2|-L` ze-5EU2$O>NhI<#p??FrsVoDGvf;bt()F8eMVq*}Sf|wS>bZL(DLCgqZW)RE8oE60E zAQlUsW471)Am$36C)j?X@js&l!WWu8i-IWM%NSovL|H1hOpw2?ivLz=MGz}RSrx=; zA!~wID})KZ6H@L*#&xDrS2ElX#1?an?&cs4nz37g*c!yPAhrjwBZ&Q`zEj9P!CgV@ zHuXJ0d~fo-Y$o|AE?@8BTU`f4Ct)!d4slGGo=1W>YVu=295;FJy%MK_I2|_y&j|h^ zcs7W0L7W$ULGW@A7lr&FcuA1kTH4Y6qse~~@^cVZOvNEJa8=A}L0mWW8$sMO`HVW2 zTPD9Pp2-!u+Vd^=BKKc z5SocnL9l8F)k3Hk!aHJC608zJWg*;)>hcU|@I_1Y5Nd=_FNF6(sA#h45YJCZ^I<$m>j&H?o_}O}&MXmLaq|3<-t>Yg{)@N~0ls6hd23)DScw zx*%g?LOv916T-VU^HFRU!pEZY3ZZ=n9YW|PW=FwKL+BhrC*hxjj6Xp$3Ez17EQHTP z=ps6mFUaL9<#7ipT}|iircaL$dYU}$)?3Uzf_+2iC#1h158upWPzZxV*c-yWkTJIm z31NN+3qlwg!mtpAhcF_9iJY`U_%ei%A&eEbwnr022^kZ@Xd%WA^+LuE_1Yax_*xX^ z#!qdJGx>NS6GDi`ek0~A!O4PC1et1T2;Z7~S_spH&oGslLN4vH%{G-eAqy zPpo#0x*b%IP% zd0yH^;adea32ruHx3Hn*jBcAK+XbESC-I%8&n_Xm1^0wdYC-1jL%1sI{P%}&AcV6a zoRiptAsjbT9TIXlgd;+fQ<2XKW@p z4AFef8OHRa|34wTWDSIII*eB#ybhst80lfW3E^MPdtsCh8-4yQXYVkwg<%mhLl_BR zWDFxy7)hegCvzB9lS4?N;PGB|20A2*X)}GY2+1m#B3NO6LUuE@fRG$vCCLkE381g~BK-W=TQ%6bYkf7{$UU9yWemZ8!B2La4-lW?jnE zONUV=jIv_BmLU-LtPn<>Fy0ltVi@lTsT4+KAyvYt9!8BYs)|`nFrNJCLCdMFwwj{U z3S(K%wA#WcvUqjFs24_aQE0v=q){04O{Ia5hG9IKVf2m0rrtzIQ^96o%vx?MebBhD zY9UI?Fj@(DKa5U%`Ae|k-wEW7Fq~lw4r53dt}xtT=wZad#=Cf)FuY;opM&IFHQ@`x zA2u#v17SqM#;GrPFpQ9hVZmSIvR4rv6;uW3sR`kmTpxzfCXD`J3}7ZA^3tPw7;VF7 zC+5dtd>TgQFxrRFL6nXxu#or~e&+Uxm>+GkeI|rT7a^Yuei25c?Zyg##@%v$c#+op=#EYx5SlishcN_v|ENjEYx|+pZt=#kmcA+q~hOtpRxrt3- zZ00ZwCNoryBrrMq(!Qa_4cHxFBa`ph3PN^@*jU5%D2&IF1GoErZ({-5p#H{z=BW&Sntz4C4?+AL#tZSMLh~O;$G|NQmINyw8#;g3J*hg2V_4M^J>-6)|qZW{n_4NRnW3 z1hxpWM8M^OY>xP%!PE${MUXp!JP~9Uw_Jib1er<^zTOpG(2PP>hXpf+nsTUVgLXfw-N=8shcxq@VCwG+;RRZ2Q%R4Y$(;Yn z;1V$sfja_E1YR)%f<8gNU|n;aTTsl9U|5hZF|inm@Tj0F$RzBCm%g=)7;240@S#*@ z8$s6XM-jA*pj`wXN6YRJOH2J6q_>+Z^f^-{g>by%ybBvf@3yu{WC&=wij9`+~ zzzV@{BA61v)CeX=uwRA%@!JTdMKC{t1rbaax0!;Bnqj)JqGpLWJAyev<_c1uCxj0> z77AG^xX6rM9KjOPfzAxe#9SUhr{2cjqZn3-vP!Vfs)X+%SR29j5$u({SQo(#A?qX9 z5Wz;_TLd==vIaH_iQk^x8o@R(x0|u7$(_P?3GNo$W5zPozKHQTpo0+{5^;Y72SjM!Y>Q*P)qUW2(EBiP!Ln_O9WRr6Dla8;2I~%2%bdnG=duu+>GG9q%sN?!5!hZ zOyzb2vojedZ+A`Q9;ZjSX8BE&-y?V+FoA{alLi1vc(cZUuQH zHm`z$3JNL6CuV-Z0)oteo);T|Z=J_^Q3b^mG*Qr09EvL_r=Yxo5(?}JN}8!kD<~yA zx;lZIW7;wb$|}aPYCg*B-65@lf{F@iDyXI49mV*(c4Y-s6jTzIip73{x;%LE&~N(hegOe91zn4(}^Z+qEXNe{LsO;zx%f`e;q zuf`f{o~Lm`uQ6SaWQKy#KV%@8tzeFV)e6=q`1_=-(}U!>3g#)8uV8_Kf8G>bpL$kRl#lrdpPz}5^MIczj|1Bn}Y2Mu4YVR*r8yj z@LdYlPO?%VPD@GpeO5}aKx(U-1@$|`^@M^m3eGAx$u6znw1{zJZ0+0G&nY-B;w8Zg3N9-6LBZ#J>?``% z-E)i5?ewD*;$?9lxzfk}Gh1^}!D<<#Y zJ!dEkx5SKdig(46<~>uV1HZu3iqt5wMUg#<5>eQr$Pq=(s4;$vMlrXq zJ(pl%!8F0#f_b9ID z7~(#qC6;FDzZuI$v1oJAa-xt_jN+XrDo0U;q-AQQC>}`8m7ZA7^tHFL+VWZwtFl_| zq*RNddK6W&B-V)H(MOiIeeE@ca1(`XmO4?q8%573dPPw;ih5CuzH9p;iuaoEA6pf>}@dNyg(^^E)M0nFEnh9ynjizN}ECY+tGKyAFydO23 z89oqFsX-3%*23-m>|Mi!_fNOZ@@98N;flf?g(nJc6u~G$Oy1A#i(=?)t6w;a9f-p6 zNh(9F#reZg{^J{J6j~Gto9{`+Jr5COnHwf%TA7vn=r`FY4oFMXrRqo+)rLHZPEmZq zF7ziH4O81PZS%BtQG6Ul`zWqwOk(I5MF-(ub+W{jFFRQVtt_gZwtX7KAC@egCC|^I z_?!v*87+JKim~XiOB7wB#w6J-itbVLh~mqADY^5dUfWmj+WFLqmoccHy>}FSqL>-Q ztSI_M(JzXrQG6Rk|0o7TF@i~=*k8pqFp9xZSbt3Eu*5njinFeQBoq7Dhp%#T*F z|540~VpkNqIm&*u&W~b26bprCc#^Uxip5dvh=TpLUbx7TDAuqahKn#PjbfSb<)*Si z$jT^InaXM*S5Ic5|98UIMzJo6^-*jPbBo|c!A*kn+$_7C^nxc5>r!IW2d4xP0u6NGlJ*Y%0kWwQXksienI#}!DapJBaT|x{VqrGOB8?g zx4+nG{V@vSPf`3Vg!~G*L|u*I8oQY{`}HVV46u_hlpJ9HHHuqNOj7ZUirZ1#;Y^~U zl8U=g+>7GhDBebKKZ@U?_?vk~@jE9OP90G^=GYlve@Op7FnfUg4{qqb?N33^HG`L~ zYkR_3!kapEW6G|3)~8WCV+XireJ)7y7su@M0wn)%cDjj|QM}@WT+TN9NJ_p7cpXKX z3)YnKNrS#mc@qVZ{mr5xgNhs~a;ivBkx@k^6`57^X_9m_yKP(H!t^=NG57PQSX{U; zRQOsXCaSQiNK%ok!lois<)0l=7hSSuQISb-!H88;b zc7T0zxdM3x+HSyuz?MN|}3kxw-SLVh|3DX5~b z5Q>F_Ou17uPKv20uA;1JOb%ZyPc5OMlnN3CyO5HCC#xov7E(sVlB*WR_A6=S99~XE zc@-5@;|Nlb<^RZ-ZK_368C6+D6&0!qO+{4|)l@W4(NINo6*W}6r=q@!nyS%hn+&wa zUMAO4QCrM9D(VVh)Vo4H8<(M;sgQq^ns}~o;pllJmriV?qOpo}6%G{@w_D4cPHLi} zsfuPQ-Z`JzO2x|59Lc2DEPAp`AHNIqBbg^GF!iHthh!n$Rky_<^eD(KcnMGqA{RrFHPoBd&+ zoesp^zZPY3rX^=4eO2`1zBf+1Jj2RVzYeqykn#)^ocBit?q{M}dZGr7#?hw4z**FKwG047) zTO4FBS0T&yD)y@QNyX3H$)FpAatl~!@ z9KRH=upRH)eo=9iRd)`PAK9KKq+a6?c$vKFp^c4uoioD>>kSn*h5RZ=CH5ry9Zr3m zGc_b>xW~Fx@k+&O6~C$YUBxpM&pB5Nvak53$O9G8LH3872Oi)L6@PLr5>E4pipM4| zd)fBXq1}eliD*jcGsG&wV>%+YT z-~T%Gt+b0pLk0~AnlS+~WY&;TcqWY!1! zK3;48WFaZ2p^%1B8cJ)JHpqUlZ0eskk_&72=d87ehN41>X(%qFgy5k;cE;K@loXTv z`mqe1#;2aXY|M(h?k=aHyoM?|s_Lkqp`wQ68dhj{M?)nI?KO1JP?-)IT4{J+!|Ert zsv4?ksIH;T$<&=$6KZIvso^~h^)=MeFfm8!y|PKe6OwAvLE~#&sqbp2C#0@m#=&-q zk<%H8-5cAU??`Q+p`nIGOj|RtdF{kz8j1|IH`dTZNK?T>e^@Cpwz-BD8c13SlAL@| z^aBm8HAFS28qzg5G(a|p#kf30I?f7mI zMTR(`5*9ZSitV=**mg9vOS1yKY>Ao%T|+w!A8WW|PYR#27J7*oZ;a$h`cSY98&^nM zLF&0S<=-^5FiXNIf(QDJ8alCMHU4c7pJ@10!!QlQHFVbSnT8=6hHCg+(hkX;)L+9F z8oFpW^vc#%Lk|r-g?H1?T?qBf%Tsy@?_c1sOoHH_0RUc&?p>j&EpG)SFr&f1}oaU`8cpFg2JvaPWtPSWs= zhRGVHXrMV&@La7Faw;U#HO$bkK*K@}KMuCf)QrpXTlo@a$*7sFVUC8m!siRlVeOeZ!Mi)C3o+f<;h_CA`OehXNe$VmugrheDE)Y^H0mOQo||@e`nxR+H_RHQ$Uq-DY$%cXS5o3_4R<)PoKL+gNODieeYRugRGJT%gN8pe<1UK7g7s46 zq}4AlX>idKLyXz-v4$raa_GpZ*$gHDBp;ViW zEIN4l1i?fdRvk&glLd#J$iUcEL+vZ~rexKTs$rT=Ryp~EhOyrhukKV>STqpS`dvTF>r zmDBOlP)$NJm&lM2Dh-Bc-j5s18-f zhhl1ix?nL&4m!kyk8YJp-bVOGf;9J6&el%H$6~e@?5LxIkb=XEVc5y^WLBMZe5T_o z9bN6jaRTqAqmPchI=Ztbyt4Js(Njk+;k^YZ)){6@ z^{;+T?Wd!^j^R2+=op}5ppL=ZaUC7G<0f*5#m%8QhUs|nsRgHuS%@Nu=Ni6byIYrJFqn(d-vj*hu3xhH#@Dv9HCjMp(i$3!-Yj%nQbF#9CIDT3b! zP8KZs2vdd7C$3BvbC%!?!I?VfMhAx3I^u36c~ZH|I*+Y0sK|UBo5vPrSfFFyF#AFs zi*zg&ktPG9mg!ioV~>vSb*$iU)3H-}xSHwjVfL}lQN3m2UKUu# zSsmxt8FU=baggn(qskeaO|)%0kMJ43s(|1f+X<=p^IzGH=s2o__VYR}=(wok2Tnl^lNRPpefv&QrL@%Z=Ws~}XD6j=>iiS7 z%Q}d|f5Xo@uIMNeL)jR9(Q#GBUpoHQaZSf{?uCx~I&SF5^^5h6j=MT;>c)xUuR8Mg zNVz3Qa+_zE!|fy=XRtLKZXc1uRxTy!HyyvTZ=Az(9W$F*A8-!rp8AK5ha7req_mk) z;MZJ9!Qu8lSt{=PaQkC+KOs*Ap9!)bGHUd2`{A60ij6M#LdQRxw_`vIFLk`q@ml9^ zbigMp6LKUbugq4jZsNbx3nir|rfzJM`>hU33>jibh#_Ol=+#TQ75po=ahVp!OfmeO zI}^pk7_2eOxt~%bhNKv>2ATx~NycolQZFR2g$2)B zY;C)x7LB1;48>z85ySUWtR-V8CBz=%xs8QN=@@>VVqIG?jhuvHxtKBIRgR%b4CP~} z5X0(enJUImDP}xU`C+*IofuwcNnB}5;7v2$f2$fpwHRu}P&0az+sN)Ibz`U(!+SCOl{s7e7#hUzcDTLN^VFNk z*(xv3L;lVP<5=JJuL8wwd78%1EQVj(;8q(nkD)~j3qHic579D)Rx#X);dTt~$M8W6 zy<_MTL+cpQV^CshHV~EAjA%>1pjZ^9r_%MbY z9a7qGiz9M;6hm9Kj&Pdog?ubn@QyW3_=KVpH!;F~X@vcg|6%Gqz?`Vw@9|w&PLd5I z%OX;CfdvNXRTQLyB49&N>?N5@+9WfXRiua@2-17+z4zWxKt(`0NKuN?J4jIk#Q&Lh zzxn)s&+|U#IrrRm?%cU8Gk5OXNVemGh7TrdGbJZ{dsSbql+)D!aWG?4QoA4)+&6boF7S5379m(uZz74D?};58ZwE%7;Fz z^at)8Pn7Dx%4+JKv(eMjhp&C8c-h&@hi`=R7NoLSOCfI5Qj~+vzCQGmT=n;1fDc!t z)|`Fpx*P1n5FZx!zJ`D3=xDO+I80o_(A4aqB6!&6IY5}n^tPA#? z;@)vSJo%i1;-7o-Gf1P)L{?uPWvUO;giI2g%$_KOQLXwY)7d z+lN_6-l2~|-?akYqDk zLM=DRcjB|fhpD{AK1zp&_}+&fe7Mp_Ipo8SK5Sw-9Vwb<4PIAX*-#tFy_~vlj_2C}J6Amm59klx#tCPIQ%+!C9JY#0+Lk?v= z{L4z`PlF#0KmPL}#gCOsQuF)qWGio~U_QZ6|1!V#vL9O0{3swwps!NBm6vWbrzq)u zxWwp2@yv!)Vj({~eiWsHAAIA``7m1LcYFQl+*ir)qp%;DeiY$2)>onOfJH4)dnH&* z4tdItihdL)_oJjAS$^dBQPz*KlbqRplomo>%8$AGy(DFlN?x#>ABrCp{20D7wY(pr zpLDccm4xEk9~Y zY#l$I7E+fP>+4_?t$wMLdVbXRqlF*O`|+F~4gBa9@izC{uOuq9a5Q95?{qiv+rO}l z{b=GxQ{fCY^Z(!b&Age1NxvigP}U26wDjXeKU(?0hrx*-lwx`A?wr+{SJzKDobB!~ zCFAp^t~P!UU-IK+A+HF2zSkDp`tiCSUHtgMk2m~i=SRqoupe*w@s=Md&+bQizy0j< zOW}-OYn^ZV@s1zw`thD0pRl1`!~1@GAmn2|J`{4zoAQy6w*3?uee!glAAZppqz`qC z!8uuxe#(Mrp1B=jvC;BUmFK3PLW1=6E{Akl(8Od(4!8wYp)Q>TK%zh)Ic7e>X zevA`7-j4}F-s`Vif3Gl&4oqz_v)W(zX`m49quUu zl;8az{vmiqkiWU-{kY&qAr&4K7uh5H_{Wb2eq83@@5i5h`_AwxyA0h1D7V*puS?!; z`f-abGnvn$zou;TW^K5NA;UBFE-c0gncIGQ+VGAacm25M$6pe>FG&4w*21)cBze<` z5B+%L$G?6&_QSaCoYBH@Lvb8^oc^C5eP%dQRHUk?9L;{z+>w8vl1~LxI8>15SCJ;9 zfZ%}xE{aYSE){MS1yyvNSu9<}C)Z2lTUK=4(p0|ZUFuGm=T2Gsk$2P!Zm)_A6*X1V zQc+k%riuzGo>K8qrYnBa-J?c!5fx9UD5~N~6~$DPW3u;46jxC~MQIgfRFqVar6OBJ zDW)(`S-r_g{OO*}xdeqqLd#K6R>hzTY2>U{>g*lmB{fDVsvV^G_BnS&6;oa)Tt!92 zfl4J_wb;GecCe~yuRN(HSY1U873&@OuIDq5>(qoTcvw^h8P;$;=D zsCZSimj`fOolnXoj=0$1U!yokId}qL;zQOQ^Ki+wkA*Ob#@tq4;>$Ok3U-T^=P@$=a zsEDcvvfNgshE#-kz31KQ_hhs^3r8sPQZ?t2_Fi2@OvM*$NGjqgrVmp1UWrRA3>Bt| zgbIsAr=p{jZLW$>ReYwROL2F}`GuRcFGE7>Aj*nCN+%VaRs4M~wTmeG1}Ti4JjZrx z`l!rvRlQ%T_=YFC>F%bYyNa(=d+z9K!5)GP_Ed3skUeqKOO)P8edB2Fjj*SWioR?i zVGph3;M4&s2C7)0VkMiOiovXU4z?pB*L1eP;;tEjGgZtIQY$@^;#?K;*wR!iXA^R|`&27+=2ZH86$?}>RI!K+ z`?`m=RK;T9OIT%t6IYs? zDc9z~igFY`GKYhe?d-@xcBt4TgyK#ili$huIY}t)Rk2USFDj0x*sr2_0ms3?N{2RH zJ`x^KaggoJ;XWjISdc-!Ox#*0^C&yoVKh4HKBnThieK5SRGe1vyNVMknzi=QPO8|k zD|PyrH1bm-ZtHF9f2cSkLB=w;NASFg3o6bBa3O$;DlVybFM#(0xUAxeifRE=58x`V zRE0ADR{+=9x>TeDkQ%^E6}MD8R`H*TKRNiE!5tNMnaE(}whDcnt6J}rdo1why!Tc7 zBjhg@tdOk>Q>p*`U-|TJB*HtJ04@s2_z7zBY zP_ zV5tDIlb$8dcQg#dmp>*kMa)c~FnUQv)@B_Wjss|aRQ zEV}76SCw|&8UfS{;Kcx11yGAu5kT_*S_DuhfTsg^Hh_8od^|*{%fi{@+MZJInE?L% z14|c|B-RhuH~j1)oN{?CfCd5ky-7pCCIK`OLZxv4orWkRw59=mwrso61`JW258#CW zmJG;g$&D)HNexcSnfHncV7C_qoUJBsl0A2~;)c}Sy_Z}Of+#90s zSD@HXW$0m8J&K#9O1&Py8v(o%z`Fso3)nwWLymZdg}p3+H|46|3ZQ)eZ?h`>85GHh zTxxi&sTP-U7ZXEr6h$^lr&~tc5Qf&PV{!0KN#IYXEwHAM)gn1rQHlcuNNxp%H)?z^4Ix z7C?gSB;m~s;PZr+#0p^jr8JUzrXB1Mzyn!L+KCRrI|_0sDfQ06yCi)mei^`|8)-cP z=qdT>7C`p^zDiocKY%d- zj16Ew00RRU830$s@I?k!$P5Z#Z~&`|Wej0y4^@WIIm0_tkm7JjaD*UZSr_@LW{qNb z4pl}AQW+P(_y8sZFfo8BRwi#d=VyDr8LCVQU@}h>z%-WCP{q3Iox&`oxX+HU_W+z8 zzzlX*c8Cp0M-StLDFHCesknoKi0XPL*G!v zCS#o&S%YJp4AOryyU9qKZwa8uRr@x0PXJp3*cQO|>}bQ3?E(B0zz-Z)xROwi;{78| z;tp~6Ie?u3>`F#ar{{yWGj_Am-_B^aF>5co#xRApFMzpIi<2A-;1C$~U*%{|4|lfI=EP8vbMHm2m096{lv;V5DeB6+)g*NPfXI!2%i}#38u-rkidq z4Za30TDlOoU_lLChbt6wZl`xHp|FO@wKMzg$e$^sh+v-bq-HNSt*oJn zhGH6uYbc?iq=pqovK5Ul3kqjx=vg4GwD4@fQi4Sbl)g#zBKTi%NrWH&GPWZn-|!QC(^JjJ^d{yx6~2#RWsRj z_fUO=y(;fL4ex8{py6{3A87bc!^avv(ZF>+!>)QiVsY*BaD7)s!LmLLT(_T5-xbv0 zXWbpLO%)Ol)HLKP>!cXc5Y`aUF!i)EuEEd{)u2o8Ov!u{V;WjVTqHD8L#{+6G+07r z|6GXr?N^+ivg$RwJVMFyR8Bj8n4H>?txm(28aip1^QW8H>nxe@B-~hpaf`bGZ zJ6OXn8(bvAGz`~pQo|_?BQ%U;tJbhm!zfmhhVdFEXc(i}Z#lZl-4_;@oTy=vhM5{>X}HteJz2BYQJhL~O_92rs$rUt=^ADT89XzMR~rAN?1(c3 zW^1U~zZj2Nz+%ztnJC&^4fB$GzL4SP-Gw@M7HU|eVX=lK8kTCHvRp&@&{UFT5@fRE zRA{R-tk&?WW-pgoqhYOv?=}3O*$+q4UvRBs3qOqY8a8Oys9_WPg@&yfHjhxAS<9Cx z_*TPr5~M;0TO6U}DdgKkq5dPwQ^Rfzdo=tcSGPmMkrU}BrN!en zFN3SI*{flnhW#vC4To7B8VVe79b_MubZYfasnb7&$cs9{UZ&xghU5QF6m=SX zXe7UBIH7?L)U`({KeTjmEIqB^cMa|!3I_3qhBF!-F&i4rYB;Cio`%0Poab0nAm<7P zdCh*$dqKlR4IK}AE(wxc7Q(1&9Q-xh)$oepy`kYI+j9ly9Sx^%dT$B;lQnoMg-ca$ zOOQGpxMr0a~<0 z+Kp5=@in|cdTJ2)g2*34S`dyPoIw-_+Jyi?lKH_DS{`u)@sKZ!f+;i-ZKT3RTPO%m z5LrRHJ$r-52%6BtwHD`dEgh*`9I504Q8tJd!)O&oxgg3j+ab6@P=crs z#PA?S1o2c56@z#;i1&i16h!49>Id;$5LJSxDuuvLQK|(o>`Kwva-}5IC0HYfZSKM~ z1#1OyJl)rSb2unz=;HQFTua}`i2jL{22hlOfI|=C=L>D1n2)5psL$@!KMk06(M^kwTk>8vn6wSN!;g7$;?nXBmo zgZ5$)+Mpl?3m+mlRB+h;Vn-<>gBTUWh9EWuF*=AbL97X4Eys`}7#qZ*AQlHPE{O3# zObFU<&}cJ+Ocb0H#N;5R1Tj^D(}I}J3L24`=b1-{Gns#Jm>p!d{l9eP2$?H5Pw;fz ztOd!~g+Ww%C5!1S31TUa%J$A5WzWWNoxrjn{_E*kF1SK)rQoU{RtsTkr_qPFP6~}b zwd>hbGF>fixU-9THwCddh$}%{4dPp={jKa)L3|gq*VS(c;-6Wic*vfup6`SBK^)Gp zDF(4UXnzEBip?*G9Wv$|65JWYULm`J_*uyAAod917{w7O5BCMJU&I5_wGSp8^2V{l zLHrWLksyu+@oNyj1#wIqc=++8XWsaBLV_ogu@v)CVBSs#@w;S_{Er~c2tUhVYLr5w z$VPr%uING#7llx{B;>MSw|!}uD0q!U!Ey-Vx`;OfZwlTD;?E#%3%@6LNARv7Q#(1z z9)AA{;_syLaFoIh`#{>NBZP;nQ_Wkjk@ry${|51xwH8E52x%ev@hvrEe=3qMg#1D( zA5Y~sBm5YI--Zwihz|s}&hpToJ!P8Dn;wEYggGJ14WVENg+ll&gbpEiLhy#rHiXwh z$Oxfu2xUUZ2_Z9t3XL5_Lg4Jsm`SPRPlQl3WZ#xNDVQZ#Ot5$eC4?}xq>zCX?2rq=tQi82Qcu@$Cy>hcer(`;<^TgZkmxR15 z_)1dDJJ)LxWIAtz&@O~v2%(UDAMz%vfEVs@k-rr}dlBCjr1DM(?+WKfY7D*~!UrLH z@b{had>FzODgCGawy!zrj_?y+Z%@wQ_GE zCD)|(388NY{dlfJ7#70t5c-EOK!O897%YTQgM`eQlsZJnP{F|Yw6_j=MkIYk3mGXm zDul%+(|F(*362e6TnOVs*t;ZcLI@K@WNHl3hlDueXE$#xrm#byAZ=<0(}YhKoRQRL zhA=D1XXiPLR_28;KZMh~s1O!}urP$pA$%LcqL4jIt!2YIfTtbq#q3HB_mU8n3L#$> z!txMSNN{BctA(se#uiH}OP@6oj6@2r3t@c-8$$Md;KmR(g^;?~UQo?o*-QuVL$CWg z_MM~nDTEy%`vz%C2wOw;3J2OYA>RxBz*r&M1vigY=&+N+R0w-mO04eZ9Y2Tg%PuEh zBJ2*qJmIB6+{ZSV-+dxvKZ)!YejtQ{AsiBZB!r_v4)a(c2S+RAo0jGw$3pm36!PO7 zyT&M;$0+2#i8y17ax!H1h2R$NDQTi4oNoOignVJ-56k^P$i}lFoD1Q62p2-Q7{bjE zZplz{DTJ#+IN)3saz*fykL|@I*MwgW;f9cvDK3hChHyKCe?oX5;++uw62hpvLhgky zvSLvN|CZq0qqr|*TUXaZA^(Q(SjeLge#lOtC+&tK<-ZV8!ub5x)YP!8kPx+iBQ1;q zVU!A^bQlQRZ^oYtqju#CM;Oj9Tw!~Hv4~*0pj(h)!7vI5_aqf>7#YF~3uX%LZsnl! z6T*uMp87JAO0lp#q|l0oQ9^i0!K|d7EoAE$rA*jvv6aH8EF>q4vO>xUmJdS-qk?d{ zRSe@P;rtMZK^lWx4qYW|uavGOysBU|!RmrF1Z#%z>ll0OG(BsFQ74S2S<7MmJtdll z(L!RM4db~m8iY|VjQU}Fh~pu&rel?cVKfS(aTra)U~rZgNmCZ%IE6;HW?|&%3_dT1 zGliCt@(U7`H|{Y5t;1-;D~+IB1TTg0au|PxaXXAx!gw`|WnnB2BaC)ob)@D590&j zA0>13p^y?^dp}MpANBJ3g+~OB9e1iEVQ3Nzh7k%Q%&u|V{pxrnI9};FUKurBSupUhGB-0kl>N=N{tE1OB0kYCn)14C@Ur?^kF%C7Dk6KdWP|}q`!B9 z^4AABpNG*gj80*64&%!2?yn@OOBi2-(UtWcMz=7!hxwMaSgDLsPft|do~U%1XwQ1J zx|K6zqSAxMZb;*S#9m?a4&&L~rKg1PO&EQ`7%Hjt4Wl0$e+$<@2_BlL^cONfkXOyr z28A&=j53pyA>#Se!W44q!@?LI#)vRRhA}RT@nMV#V{{l}!WhfCo1`okw=05Qtn6Z1q*he0= zAHetXz%UMlaX5^FVSApL>6CoY!8hQ8+IfEo<472%Io2J*Q9+UuLXHU@XCD;uo8YA> z3LR)CC3uQuE9Cbu{s`lY@C$uS^KKsQ16pG-VFdi`dh@Iv`Is8At zM}q$fJ{F|I;1iw{@gz@;AYYQ_7m^kM9T-JJ1P&3Mf-b>yL3acNBUn?&&LNG2ZH%iH z`O9vvkDB4k5Vyh+dw%%Q6y=Esibhb3!HAvbCnNl~R(qmy`W_cQtt}Bj$%uVF#wGE* z1a1tBOMZl;gf+P)uG>o8;kj6}*r-@v=e+Y0vbg| zwU6NK2;Pa{T~R(rIxzM<;qNCi{GkM?^K_p?;ESLKt1kk71Zo7GBIq1JAYxA)gd>PV zps}1UrU!|&9lcTeqd#}FD42ctKa7fCG+QjoQ;yx!D{G99 z-j0kB>$As4Fd>4e5lo9Tar|D^OxD7!w8K}kYQCQ}TMBs&yTAnJTtSj~bP&EkaNYb=ii;yy62Wf~oQPm) z1j`~g#LP>tSsnpbm#vCm1xX{vN?uo{m#aj0=CRrRoNfG0pSPPv!*JO>*c&RRT(%{;eiXLDx8AgEFZtn`6Xh%8#*F* zRPa~?$A$bVIOtR=9Zs@ZBe)sCEw*GC(6}SVjR<~cDHX{1BVykbpAkGOcuw%VAfqmD zs7dlmLM{tl;k76AYY|)*{{He*9>VX}xWwYm2yRQa;-lZ42<~!(iK0Oi_t^Y6R7Q~% z#orO!=O7$Kp(y@|;6VhBBls_ZhipPEoiuMszDE)K%gSAz%3uLAg_sgWY81{WTv6nU zB7YPGqCgaBQTr$!lIOg6s**<>QBY*m^1&Wry12Qc|9_f!Zk{L#N0FJAh+qa&Htlx@ zMWT2@lqUs?3YI-*pN{u?yiZ(dk2;R}>ASXcWcEl1}5OJy0B8ulFkvt!k0FBNqqj*t#S_!rhY%S%8LOR}$;)5tQNAYcxJ5l4KC~~9t zG>VU-_Ix-W3E7E0iQ4laz9{@rsJyx;3{kWwf-FYibO=QeN%F9eP3ucVg-ktf&uq|Q zQN%^zEJxl%hbh5C6qXQ9p>P`HGoGF0`HpvG6rYPeFp5D@bc~`?6rH2!5=Dw6 zg53nW3Vs{VrUe@q8J;+xG084F(Qi5QH+UVWEAC_xkp8DbV>%-GL24mSB-gF_4GC` z>QXLc{1eV7Ib9ha#ROIyn^_dkI2>JnOKmt^$#*P^Uwqe^?3{78%*ib!rbaO>iUmw{-r^+gh zHV2%mqgW$^d~Fo#gs&I;xIn%QQEW`cZW8igfqdUZaj0cWV^e zqW0{oZ9;yC;>V=2J&K=_yzmUWGwzCFk0?JgwS(9#NWxEd_eQZViv3X>kS=g3ii3=e z;#3r;qc|+$@hEl2_m(0(zRkG<% zdr8XEzQ*OL`E+nAJUdw((BabUAd4ZOt=s#bD1xPQm(vct*#w zI+}}8Pe*+njdV1Y;B$fv1se#a+$(gsggx`tM1oBPhi9g=$VzD@oKaohaI_Hqd{Sv# zGKEW^U(~_HRD4C)N=IwmzNs$yw7b%HXYI<_FY9G?+8+%^ZPnJkl-icM&&~Zek91? z$3mEnFRA#2sJi`h#zbDwJ$xSL10bK`Lps7bxRKz#n`vyH5gk$8{xziOLSj1NNyXsh zFR^!KvvlO@IKT|(_*BPdI=1TArlW(7&vksKV~dWCIy&iCtYe9ehPTjJM=u?{b(BhE zcG2;Lj;=Z!B{E)`>HJbhHyzz|%riW^KmS_CS2}v==&7UWuNg$1k%Y+Gb>7c^qoWV6 zMaMYZo=om5I7G0Yj{ZUh=oqMDknq8R^n5r&Au2PKp*n`?7%uv#Wb6nXBZW7cX}i%z z>lh=-m!gc*Zz;E_W zDYQAF%oUucW4@3Df(r%dvq%W%^Ox#arel?kS@m4YSp^RF3LPui?9bqdZdv@IjY{rS zCl|}D*0Dy%S~mVYZrTPN>x8do`#F-Lh}i8+!Hq2ZGX*#4*erznTOmAz+o^Gup6{5J zuS)w~#}7L8%Za#F^G6+#gV?Uy(>{$a+ZFVaj&FZT-NC`cm9mpV!8z>G@w1NII`-(; zt7D%;(I?O7KtklCD7(fX9fx&X({WwLFFKCsII80q+sr&CA4NG+!RtD%<5!mC&+aR_ z{k6+)x;>F{PR9w|UMYG~$0?3H!WlfH<9FeI2=as9?c-C$o6^Toj~o zNyp_Rcg;$>s$=O)<;(vtad`0?I&N~i~p#ZX-c z9cl=v8H0A;J@kaVSf!3A&&BYxkh+4;2r~9rA@yRYFXZM+_Cme}F*KB5Bf(}dG#0|B zCPJFV@ZSl$kMOk%{%rO+8lJYiP^pKr5G-M?tM9i z@GRw(7+#HG>~oISVrUn`n=uTXrL>LV^%&j|zH633qe!D0?JeVA%)a&dEQWr`)H+Jk7cq1a z(pj*JAXA_-u`7#Ilx{I}7xI-LV|m}g+36%B8CAm3}mUs>^H@OVi+955aD_ITK{i%Ym#B2^D_i`j*MYc4C7;%5X0yg#<1jL z7{~M_md<&`uNbJ1PmEzw43m>7P|1tR^Pd{Sv>2wxFe8T5>{Bt!jA2#`%VJm_!|WL5 z#IPWSh0Lv_LPF|3baLk!==uqB3#F>H!qa}3`mukn9}=cUYKdH7aIc3aXXFX~4Q zK{4!#;pZ5BieX0#JCmoQ1CQddd3oENEcyTGdt>${jr(HQAH$T{3im)h5W~Tk{h`ev z)^ZF-g&&UL7a@6@m>rAZxCBoL{wjDv@HY;9h3#ErX(vTlFlN> z-8i0!<9rMkV)#3T`!QUM;S#&>0bFH=<=Go&@)w7j@N;qg6_(E>Czpa>W6>SL^%%HU z&y5&vvcJc`y^(E;;ZNbW1@9#F9kUh2-izU{q_S{PD(5h{1NJ{G(ik4b@F>Qw!cih_ z|Azj{pA{jGIqbxc5=Uwr&Ny5m=8L0%koplAha;(Y*A=9a9!H@#JR-W| zD42{LG}z%y@{FWjSd`LX`<}3f@F$W!MTI;WN3o>xY7cM8II`mQlvqbY+2-7i*lXzQIc@)mJCAIArAd>F?IakPx% z2$MJR?ZAE`0j&?#`7Yxr) z-V}0ub?RF}CJy(OA6JG+y(2-A_u_b0c=@O7v%D|7>l}Lv=#PY}aRlP{IO+dM9KJaG zag3XzjJfOXT;G1e(vq=ZAwj{A;GX&Rb6F&gs00_xv7g=Iar?%yLmc^vxDD3PB`>F= z&A2^foe;F*$Q456(>Oj$^6%y-pR=IWx%eWZT0VE@IJ(4fCXTale8DtZJJ`#H#O?W| zu7Y32(M?Eq!LQ=zA*5#<-^9@;j<4hB701+l_93+1tdYO%8LGZ<^owJVI5XHkjse0s zo0K<6{j>U02j*)SUiepn8o8uTA$Cx-4#<3`l zu`IwiX2&rnj`49!h+|qD(^=HqL3ggwzHr9GI3_XKIL>u1%$w3F%p{xETxHT_d#k!G zbCo5(d1i?JuZ=Qq?#h@M$1FDcT^Y2YXG+hFV_qEd<5j%Lf*ZaB}L8v1IUGIyS`d7e^sz8%~z`8gnXQ1IFL$}d8Wu;St<`XEO; z;G|vR=V=F=i!b2UIDU)c_c;ED<3t=M<2V(^={Pd~F3~ZkjB&yH)_kRE+svP5W<1_l zrv9T6snv>Zyi?-O2^qEiDZxqma~%KUxDdB*H4k3G#kf6ddMl1URyO{*L2*9N|y-=gasfjt6Y63G`3kA%`gr zi6$zT_&1KnY-0xI82FDvoPm}GUNn$uAfJJ31Emb)H;`r^!$4sJ1q{G|(}2ss-ceqD zk?k<-h04D<96xF)_aC^Qu8@^(;Jx?D9CDX&8z^X?kO7ZjH`?Cwm2NK-^$PFQA&UyX zaLF`K)WDMljy>lpVj%uIo)GjONqKEdCKm)2Gwk)i#SJW&uapoZDJdjNkYB!(Hc-Yu zQv=NmW00UgJPigepECt;Z#ZmQJxY$=2S{0iK;AEMUb9V zg`60ZuZDq|1{xS>XrPvX+6JC6@GP(EM0ydMzN|P&i)v#|T zUNg|vz(29f*A2WWg!~Ny?S%75pF!GN2HK1Aw%|L0?+P-OZfv@2Y#$i-=I`{y58WRc zAbuqHvEV0y>$xuk>)JrjK!{o0Wv{Z(4D>vSiWgJueLIUdc5HEm4MYq?4d@0Q%vU-Z zh_L|}$Tje(0mHy&CA|p)mH|^Zn++8rgL%l{X9hYL_&n)Dg|T^tgEANz_`<-~26`Fj zYT!!)OBSZ~WZnvTyBXXuCO-?dJDbyP5A7=b>Og1pZz;pj) z^)WESuqUD4UAx4>+P9f zV5EUj2F4i}FUn{GW0*2iTcFTk{TE&$ZHffftV?AqZS4YOqJc>U_AO9WJSa)GsRs5u zDmjyFpuTGw&uC!4GS3VHuaC87^JomtGVu3N&(cfj#JL7%z3?k9-@trcvVm;|zBjPY zz#;=H46I~5vY^&TN#!HwjYtmNmE+-x=5216IUBIr|wguX~&EUmtY=R_p$FXH?~3is*7K5$od z{(dzv(bPnH6K}J$+c=t;_+ydM(nNC;KP^&dElfNw`~^Y&SsTR{O|&x6+C&=@?M(Ud z*Tl;v+M0OX#49FV74bC_%3_5d0^iTgB+}kmtgK#}N_>NtFxDm%-xO!hGS6GAwPm&& z*K(BLl9gue_+sTf6YrbQOax7QVB$j)ADQ^r#Mg@zzOUg%AKU?eyT^QD;>|nWAq}&A ztaq=&FQ^JK7+`&E_4YnrG-M)d!Z2Z)xLrMqk50=LD-jl5aaWY(CWJg@BA(>mFIF18 z=-|dgH(J@>u;-filtpS{poz~+bTHAy#1|$$H__2VClj4bOm6Mvt^U=;%EbZMT$ea# zzK0*HWcxiMN(0 zjo-={ZeoOqV;j691;?8hC1kYV7{RfE>rSMO6T+QXCJ31*$YUo7nJhSky)UWLpS^X4 ziNz+Cn3!o|mWkOW=J4`QxfYmMHy~xMiFqdG3#Uk1H6SG}xX{ER6KnGqpiyMhQWMKq z!b_CptiC16x!+tDHo1=Pa8Y?>RoW^Ot4*w71{yl}6+ib6AcSndhXqDM=XoR$@uEn%HKdSpv-y_};`1>~{&2NZ>~k+c`ibkS~FsOzbf6 zn~4)9cAECa8hcID{lnh2beD;rO`Fhmo7j`&uRSWg&%}Nc2TU9^ag=4np^Qy#gX=IW zn)&aY^411d9+Dg}F}z1{654Ur+6LFJ?4j#Y^AwVkCQg|czeKrZ;Y@*93a^gkP-dUIA3I{q9*GydJaN5+d%A1mhH%ySz?pz6f!lMOX>WQ9Bv9_%OeDaq(i{of zxM3Q3dIIi*Jt15qfr3K3f`tSpl$-sB#@op>pWCUpi%-ovR$Q_rG))kQzl{8CM`!u*@RuE4ElGv$|pcn5~v`A z{HX*yo9!qbSUF)oBk(4tN&;0A_-lz$ErHqz)JdRv0yRXbDOgKRL;!yeh%h5@?&$%Sde9rOF!#v`gU41X?du-b%)j)9CZ%QstcldLMKzU8=k*m;9dK z`+^?`j#+A#z{d%El7Nq;n!u)K+;=8sY)>h;eW}8A=G-ET`_S^A3iB_!k<12L zcmksm7@fcv)_%g?{ic08Z>MDn|2B7O?@Z1K^KpJ0tGh$N@q!FaN?>vVGZUD_wpYl_ zC5uzoVc+qx=T1#v8r!h+;^{(Wu+>#6c&V&1JAn@dduALdv!SDRP6Bfin3u5cofamr zD1rIH8C)P_%ra$h0!tEDp1=xGmI^KtT(iu+xq9Xv@`8D|n%#{fa{@aOSewAQ1omuC z`;IARdk-#C)+g)_r8ltf`4t$ON&=gOGx%)+{Pd56MsZ65e>QY)O<)_xe-=pdqO>0q z_#w$dck)x&F2Tb6vUVo0D}ntifdqa|*h@J6XyMqusN`~; zQ&N{J<9B%vC-4h@RxISVa3q1F3H*`3nFNlpLK8Th!0!qC%JFBpQnp-~)>}NkCI0Wb zgA)my6n-kH)LgC{v&ytuuDo%;&6+x!z&Q?;93K)mpTGq+>GH0-(uyu7c(03V30z9x zaspRGJejX736YKMI-3?pUD0o{kJG=u=TE_n!&AxECXvo}#ErU^k*}kf$@O^L#l2HB z>+b~aC-6@KP4{O%NZ{WD9&;9mT}BihNMjU(|B0Al*-><$o@(KP7nD_~jjVE&O$xi;!MA?kSc;zEmRXyU9g5AeU>a& z_}^rwmfK$<)V5H^Lb>wpr!91^WY1@kKWm|$h0iT?v{2u|a~9sSI8dX3g@zVdSa{w- zBg@`?r?G`5mc5|j&8kK3v79aYkCL15qWF)Ti%W7XL37JqV8DH-Ua-*8LR-uJG?L#b zyl5e%n*E;`i@(Se`sGXM~rR%w)OGo^By#;WG;z zEc9Ms?}it*Fm{DvFcD7pSV&l~EaY1FRFro{Ip3V_AueB`kkIG7EC>HkjQ#7UQm#%G zI$PYh8{;i>vG4`cWOZBUYT-)@Ut8$KDzHG$x?vgD3T5N* zVplWmzjEMUyL(u7wvxV>3%~yNAweX#VEh28Uu+8EhsbtcD z)_J8ulg+DEvv2fPHIbP#pZ;dUU%NERA?(>2dEL;?F zNsxMx=Gj+Rzr#|mvT0dZP|9)LLhbvdcb9hEuy9jqZHcQSjqUBWg*z7RaZqIm-}T(J zaA>7HDD@87Z)CW5>2HqY9AG_;`*PsLmC8RB9`K|qm4|}WkGsepuT=iE@K}8Q6HLjq zdmMFQ{#>NxA}bf!xhRm!H#>0T!kLSrtCSzEpxZfnEuSmb-u0_UF8HV0>A7&{qM)SU z$%R))pm{`q8jnOuAIMNTeSty0Pgl9UrtUNGZQ20!{!S1G(h;C^?N za#1-KU2^e7E~@0BYAzbG`f^c?*OH4Gxu}_IkI%7}yvG|k`qy#Q%C*03Nq>O)%zrNG zuJGf1?%SG86nIeqw3`%ca=i2Ej_L5LC1~|2a5ufJ6YYdB zfL`jfH-u1GwuJ_r}kJDHJz06A7dc0qO6NV^2>Y2sd?zjH zv_2PTSx$@;zIwUBFk7tMLy@qHcS4>i7zN_OZ!qVXG#)znPq8Hn9+%EoFJbn_;k5K zK23P`Wof)u&(G5tPR!(#s8w_pr_+&?*}~Zgb0j&}iFuq+Clct2;e7TI*SLzpD*sQ1 zg-+ac;+_+WoLJ0V&WSTlEOBC~6T6+*sf0oH*jd z&rWn%p&aJoJ(vDd-CReVIOfDJP8=77VSDT5@gA|SSz+yd-m~fTn&kS`iQk+!>BK21 z>UWuV#m-qSmT+iI+Rk(7XSwq@@wXHIIB}kH@=3~HPITLne8Gu}PW-_k;MU>9HSV9K z(=R)5g&SRsl+U*(5@Uq?PbaQRz<&zG8_cyrx#`3$CvMB3S+S2UC*BcG7n7CN6y{0A zu7hY&F8RI_5BM>pBAbebPCRlVK}Dj9$K2d*TTj+)HY5RAxt?&(bmEy4&!wCf+zQTu zI!mLG@S$Y<%7a(9*7pc1a;V6wBA*JVu&Ll<{gxC-x2vdGB_&0LLrAiUoI)tRHa+e6 z3MEzLdxexdD$-P>3(ut@w-D;ppBAE#&?si8;5}!aX1t^#zly*1r_eH06cB#yyF?~W zZZ23*MU%;Pk|HXKs_3Mmvx;IWimRxuqK1kRDoUy-r=q-SJ=E^l{*+Rxb!&p{QdFyT zrB##>va(ciSrtTz6;$i*20WLmEUt=zl~f#?Wu2hD&qn~M7FH3gs-l_@z6FwEO%;KC zi5*mQR8dPsZ54G?)K$?`MKcxkRMc0|P(>pZpDs&Wcp;^M3Sx}EqT*E*joGNU_dgc{ zVll6&Xs)82iZ@j2iT5p3v{KPpcuT>ImCEZX+6ZsU0#{m(yZ=D2P0kYJ?Nw-J>~Bgy zzwL=shD=DL!n-bf@6}J&Qa)X&bWzb&MPC*DRCH7EmWtjg`ba;#&7rwv-?>uh&T{6b z^$_eS$Yd`Si&k3ibmI?iYLv^xFW|1NRQfZciUBI#Wp6Ld;9C;-&jp?b*2~DnCql1T zS$rTnBr|Eoft11QN%nvXOEC+EKxobq-&&**sDoKv7&GC6H`t_dyEzm?=n71M>x5TuI%e;vtAoTFkc=edeiD(0#9PDO)N$}-jZa`t=G zdTRP274s#zK#=+mLKdpXTxC70YO#bda*2?oDt;7leqAw&KdGoNzi_$l3olo(BF?F- zW`}cVn%k;wwDY~yYvs87X_n1yTgN4-qV%LRa{jtzlZwqM_NzFcVvCBcD)y?_$2zFk z&Y9mZnb*rZ_zCs0wHW)SChU}Hxl3@jiajbmyO&7s(-ziQCBNw5ZJ#z@r14h=2UQ$W zaazS06^B(E;p(`QvVTTefy4M&#R+aNhb=qGl^*B6s5l!C{J((UH5HdsTvl;~b1YxdRS`)TK#Y+; zMZ7KneWQ6QElsB~QyEBwa97mVO{NlBYhRnr@RWfXRf@^ur`Wt)WgVz75I=z!# zNke4~H8j-J@UjNZqAKi@MtS%mKTjY}Rn0m{tENGHV53zRvaVBlEs44Dm%XWm+T6iD zC{#y7UA9O=eGN^dPa0@wsNq!&jWsmV@Jbvnt+GDHX(Y7&bjDEJej#ysx%B25T4>m$ zVKYZZLn{p-4PgzfHN382kcPn;+GuF2;VlhsYiOrgkLG(*v+hN(m)_9Op59NDGbhrC z2}SK4G<4L^Nwa>7(pj*phAu*=Y+Ie!O*nsc!X)2Ty!yDky9Qq4_h81e=&7NXhTa6$fZr)c1N)2#Qt@u04>uLbk3Rw}PnrfQhRu`XmI|29teOPCoNBGs~!%+fGh z!yFBBH7wS!g!AnhU+RhlLdd@p@;w)CL)(1eb6*tvA?{r$WD#fVYQC@xOEvtcVV!2Z zfomCOmyp#OmTOp{VcBZyJzOhATqVe4M8tdDijuF-9TBFH(<6KtPQ*1{y9Mf=8!zm5FXgIFnR}H^u;1h=bTCJRrNyvv<*w!e# zJiIkJJ@@a{PxXFhm)1$<%(=)pqv4E(vzm3Q_JZI!!SjN#`?q}mBgr3JHBD`_OF}Md zxWX0{%SGj?DCE~U5ZrKFSiK&2`=l8{P|qqY)o_^ z$z}adFq;c-!6rPrU=Ek{EOff;E+mVR?m|u>se&mkIE0j1qtLc*NK2C>v%IxN$t66u zV4k?1*M+?gtbZo%U1-m6A-@aXbS_NGbn!jN7Jo^Q%bdKB3x!=M;sXC7#}29HvYyjY z)P-U$6nCM73ng7B=R$cGO1Yr8P{xI_E|hjzZ|%9cI5GB89(9fK*W$!GPf}tp=&2yy ziY`=gfjUKoRTeQ8|1zukB&CXARTpZmOJuUT3pL1HsO7>dF6*ywwOO&NIcfET)Df&J zSlORe--QOkIsF>C(8y(N@6>4|uSy9lqY1rcm}&S zCU$c1yG3+!@d7iwvkP5Z$hR|X*xj7|5qVl3!&@%&bfK3EZ@a8_uXGpe;X)dJktMHR z>Fq)vm-S8PV3+kXu)ge&0=5Cd`w8|Jd`EEB8s%LV2DvwAM*E_fu#o&Vv& zVnl-zGAW6VF!j3N*7)>Mp!GsTlj@OEzaj;jaXz2!1VHM{%meFl?F&-^TfLA<1$nB zC#3Pyod3*DTrZqDla+qUy~zbCG0t+fx-ckD`c4;ixvOK{-`^{dud`U$Qe$x{Ec z{iqAaxC#p9A^*h%;&DMsIf`G&kK#AMlY*x>zQYqJ@&-HKUYGx+^fNA;b>W-~=UvvX z*8dQ^AjsrJuAq|%B(zH|T#oA$uetE23wK=j+lA{~Zbz-Zeck5VV8f@_Z@8>ivc9%f zx#j={J9G+L}XqjlibMWMzY%~D$0R&18&&d7SG|vx^l^bW>}B? zxxG1&NxK_N@}<~0C7xM|yql2fw*D^7%TNC5JIxJ+Kf+INqzlOZZ!;SoI zOmt(C8<}ntaHG8&Z@Tf48wK4c>qa>@3b|33G0km7+~7qVe`Lb9vGaZc-wspMjWuhP zVp4(PZj^ANq#LE;^(oB*31gu+hsMEuZ2J4h= zf^P}FE!f=+_BmaQ>B%zP=q>Sm-00`VhtFT?E6Lu|iZh_UaFQ?ADep?RywAzz#=v-w zy~mj&d~jTuy-pdz$$TY+Hr$P&!iRA(?8sa)Ke2qPLS2Vv(xtkgaW=Y#W(uJ9wYCG0u(gZi~;5n|>4A_>^;7I59>( zb7L|G(T(G7eD1~unT^ z1W6VOsoFoGY5#=9!k5IA7weQ|Zv5oNayQ6t-Ai5}gnYG-m2RwxE9?{MYb3eW4F*%0 zeKci*8{6EN*Tl9_Mt_qVxz{VS&2DTFzEzNC;1n6QU4nNAPD@SN?ZzHA_PVjpZGG}a z@1&THbpGOw&x+)!5pQ?zcjJH?2i-Wt<-A^Lx?Uk3cB97qlp}8Z?8Z?s>c_a&)>~so zBRS#5uWmecU zX&2qNAhTj|%^iKN2d7_P08 z%#(AzjE~#?Z8z?4xS!&0H~w+suJ8wf_XO#>@5ZI+c}QpvMSLW9aJ}->jc44PkJ*!T zJa=2SdS1A#(;i;i4rov;LAPF)oTwv7w|>u=O-BwL5T0F-f6TY(u*W%jj0*oaPt2*K z$qn#_d_#NXPt|d|t!e4hF={j=h$gN|h*V6Oo$g3l4B4Q$+jtm|73}hI{uOm~( zb`N%VP(a5^Ix2Zk*<)oXsKc)#preqE!a9oRD5|54jt!8PbX3(*O$S}E zEDR%IAtap-C)Lo={cuw4wl?zGI_j_!bTrjbS4TY^jdZ-CqrQ#?QeZ-}5iq+&* zaWxi<)gk6>CQ5T1EhN`#f^@ai(MrebQtbsNl3MHF(OEs_-CCjm1E{pq@rI58I^NaM zUdNlPq>dgsI_T)gVs&)Yv1XT*rIU`%(z;j!S*30|-qP`Q{BTt0idB`Qr;c7a`snDZ zqqoGw4jrpAv7e6qI^K!9{>w<$KppStaOzNX4AL=J$50)^biA+Q18MA#|J%^Bl4IXgXXvJUR@~-8yt3{~eL7Gj({SOrK!P^6*KvTeQAb3_ zQXN0)i0a7V4A(JL$4DI?>iAU0M7BuBM>;;yF;2&59b;IgjR6@odswW~v09Wh@$9jTJnniO8+2^^pV|Ijl^C;G^euw1BW~BRLy~)R?3B`W zNivpecRVr{yjRCQQDTQXsN;~1r#hbLIIQD{j^A~h*736}nZMR6zv?)uLJ2Qn!#@;4nPb)4d2Ic$wGmpt)|j}XP&$7;gM&ogLpyZYK+e=Dhc(7)3j(n2r zos>Vn2Ql91d1e6-V@V#dkOw6^DCt3A4~mGZs0YP7C@y@{!zA{=ijz5FW5gqt@}P_d zWj#DISo2Bl_2I zkuGw2zx80c2eUW?9?TGB=Kqwyj0~G23i(_qin(ItfA7J3PDl@yNx%XR7J0DPgCAJu zcot@7M#eAkU};>8Da4;VSnk0p4_14yLcA-bhX3Va%o-2Yda%xe_3@%&*;(e14ax?| zMLvCD#^yNR>cKmYGPVeE2c~zMhp$RZqDa2egX12Y@L-q3?-tx6xL0tW2m3uZ;K4x; ze)iy~2Zu!GJUrsTVc{(2!=(JNUE-K5w_oBqr%-I7GUitg&U$dpgZmql-#j=eF{cE7 z7d$O^MlieGT1sEFv7PteiU(IYplxgyJh&)?{0|Q<32*f<<1$zA!wiboB=1cRZgDLL zzb^Qf;0-|*dyKoT2Y0wd8%Q$nw+H`t@YsVVoEt{|yAt-mgL|y1@ZYvu%ltjz4+S4_ z&)jJ3dru`v@|-({@SkN%e<7S16AWv_n{8CG2}w4PQ%H6LISjynO_GeU8`x~*AG}ea zF_|KIE(5s@I1Hp3NHdTwNbkB&t@+G_K&0g{z~knXENmTHLCkL;)4+!YMj0qz;3Wh7 z4ZLHZpn*aL#`ez79xH61h~(;Sps0aj2AUXXYM{7*5{C7$QrAF91Ema9GEmuoVxY8v z@{)y1zKoEvhP79)8s!X(d}Q?%Kffx7tD=Dk(j4N;2C5jSVW1{k{XDa(focY-$BuqD zsoW1%#@IenOGGAX8|ahEnhAB{3O{b@8K`fdL0oyoKtth;1iN*}$#~kU1{%j>R%}$7 z8FG|<^Vmw2l?82F@Fj*b#J zcS(s(1};ysMu*1cbT!aTTyIJI+w9d^`D35^u_e>PKu-ziCD@xyHqcjiKS7ogTe)1e zq?Fwnqz2KdoT8*X4woDVkezVHtW3^6cN_%OjbN%Y#y;fv^Nb3}hMB=WWe&kT$g&fp0`J~c2guG}AM zb^BxkUm2Jp;^zjw5b~wqpAW4LqdlPUJft@1<+F)R#fkg%u8(3ms zsev^H)*ATHz%m0X46HQplYt{+Qh&M|%tu9K1(z`Cs$ z&W`{lX`2je6J@i3Ekd>$_+6GEy;Qav*kNENt8HMffqk;E?54gjV-M@RLE*8;*<`kT zzw`hza#pjkhYTDxaNocKR+Y=SiSnC)lTt^7zfiniq8aQv@f`N0Ag~5zuE*2i+7Y+OoFM&F}v?~VwG;m$?t0G>L zW6|}OBySN7+%RxclK)lX4mW=T{}{L%k7pKs^xTu8V&!)~UxH^l4-GsrkYd7N;<14z zQYD*-rv{!0&t~GeffrJKqKO34sxwPt_E?U%UfN6C|tUj?|yDWrc!JOiy zo@ye^L}3#}Or)F0Wg^o=0Ta1R#C}dhE@Uc}{)I>28C8dz!=D!n$7lxbzB_tz9zm#c>xMEsUCA6eO zX%j^9vL?!zC~u;IiGe2GGf~k*B@<0dG&QX|DwR#tG*L_V%OqiDN3$2mpOuj0lu^qZP~Xb-iVjOL&Pe{0Fn+SI+}Q!og)FAOms2PRd{FV zu~@CTnRrXYSoTrzW|b0X@g7* zmU48#_e~6sAMpbdLnPzSxH8PNHWM~sgeXoEDkq5vmkGBhEH+lv|B%FE!Vs@%!fV23 z!fzrd3bzgx7%;&th(;a~ot#@%)I=5s+KU=;yKm=_Y2Fm}z2`iB%?6o0u)$?@WAe zVvg{+oH_g;kaZnf)bmX&FtNnMQWHN&%p$>sf~*7M7solX{AgmCWM3{tG2kch#rHGhvC+gP6Ri|%j?cZZr>t>ImrZFK*Q|+s zCia`yVPdC=T_$#$;5jNUtQf;DxMHwW- z?whUa4u-KD+A$Nqm^j7V!{ifRt^N6giC=~ABa+GAgrEGsEBCaCGbS#WxMGoIp4l!;!hJLyeR3#bqP!LBF&4xOx!SW)5I+k zkGO%;B@^$S;2lBEfxm_PBY2nVG0B=L_a*s2@Sz|@dY=gIQ!9UVFP@rs#{FMrSEAS2 z?q2XCz>9V}a*)$VlDxX^eD8vO&VX*Z%3U zjxt5eva|y(r{GVXt-7z#cB*MNx4Tk1G_5 z#kqC4B)e-Vi7D@eBBZnzWxOaWyqq8>5+h^CJ02ChsOUu{FDi?dt}0%Qt&YkE=3i!q|q_M(muuNQT_s3*Li7xlep;6+z2x_Qyii$-3&;YE8dUh(2pFJAYe zjTeo*XyQdnFIsug)Qe_bG>`YmYhJWqfwl5e;i($Ci=D>JfeW96o!{CEb~}5U*j93J z$l7_W&l=_;CwWsU)6t7gUUU%7(qdajXCYlgWF(Enz9mVvw}%&R3+EQs-D_=hyfsR_ zr-;40C}*HIE9OOCPK@W7OcFWC`}5l$F9vw=t`}|z9_Yn;LY#uU`7_9i!Ct)Y#Rpyt z^J2KvnS~FLfT3OlWaV;O9^tjtY;4&Qxr9|O92KnPrb)0%kljK>_rfDdL(mlDOvqYKg#T+l@dNI$7wW2WKJ1-Us|6Xvu7Yn@j!Hb1nEb?N+qa3{a z;T+&tb0~S&i`NLuwZx01Ui|3AGMQtXhpWB#N%->kTwNh#r5CG&+}y0N9NHRL@|<$( zyjbtW2088?!Ht5O1UCzA@nWkN+q~HB#V%1;!VXyxoXnikJ7qa=w(k}%ldQ~M;hfU6 z{azgK;-Dz^1P=)w7Ca*Ovmo1b)Qe-nfAQkD7bm>H(N0PJs=EX@bE_iX#i&I|w zE@9`qI4$Ii7iYcyext|RQ?Z*=v1{J*62K|j$q>^`LVkS?wqdHua{7=eN=jUJ2>G(VHD~T-Wd??4pPbFQahl7AJU-<0A$L4-_`{@pah~C`zA0c> zexJ3=#Wu8;d?+XZiVuZ+DC|RVNfr?-=EJuphD%fEyVC4Ja9@!xwIr6jnw zbWUmEWdvgv*StC???VM2D*C`B#zN}&P|1hNKD_Kh6^X3jLscKLwkR~#u$m9mMd!k# zF$=|-5?srN+ENY`2D8ArKGc(7ChPmqz=wuX6kS}rjUO(UhI*Rg| z56y+V;X?}_S_*&NXPwCL5VTf4v=)(^CtYoPXzN2epLI3&-$iKbWURe}z3D>-A+Zw7 zy4Duj#fPpw%>Ds$en2-L-eM2TM&;Rf+lTHxT>c7IzCsTldiwC|82mN{y?p5H!^0>Z zMbXEHzCI*|kQ72cANq5M1AH?G-tl3852hbpKi>6Wpb!7}aMy?Td>G`zG9P~OVXzPH z`|yzuqkZ_mhao=reaKhJP8%vj6&&Wna3LdnaKTF;D4>!wE?;`%xjsxYw1ny5bif zj*F826KjaqXIWMK)ra5W@lX4uQ90$q?{Vd{kWyQfb8+PlAI=NE5LYe=NiwYpUlM-V zhbuxZ_OuRhP57TaTo>|};B6mn2)XIQEgxpKutuELVykjTbn?H2Y;0${$Mx>RYkoBM z;{g{YcS}DC`|-$!$K0{~u=%Yadm{0P!k-F%=EHLzUT|MJl7j&W;v%UXPU-Z#RFWUr z;!1WQIsAO_*}wDO?uWyVR6mma$mzEhCNri;*hIr>Y?|;4Kl1yL?nf?3<`&H7=ij%G zSNPzq3Y)ys71aa$GgvZ9xdmsU>5g?kAVgj5v#e5*C0f((A#BC(cK^|uXHTk7~xS6ub{Xb_L7@5d4;xuGZ(x>_rp_NpJv z;xUc=XcFg5g+wd=+qW(JXz9m5Ki>1>GJpTi&Yzju&5zc8yzWOEKiZ1k$&YqI-V}U8 zu)Sdae0FB+AiSgC?>{)G&^r6kMHKR`LK4XgGn(N?i*5h@u8+j$ho80bF`3?N%9K)e+NyH)b=#CL{P@z3 zul$(eN7>V*SUB-(;ayKyd}dF_G(VOWPnzq;x16PYQm6Yd!;hJM%<^N7*zErySK|FZ z^7nLG-CVZs{P^CF`K*#3Kl!oTk01P4=*Kd4&IL!_R*8%JD7RhdywI`qJQj1_@^F6q zNXu=b(ye>ydu8k-&yG8qpG#fg$4WnT`LUb*zdm)99~=DG=*Mb5nr>It__0>VIzQG6 zq4?fR+xSM-@NM$rkKTz}{n+NmW71QYN?iv6FrHb^`eh>GNI#>`bZ) zvaPL~IWH}Bj~{=f+xD_!xe(m8-R2#0g#)M=K&=3Z1W+`9@&Qx`pjZH-I@@VV0L6uuh$|%nC?&k| z^r8$XExb(JTUJQ90HX8q&|5KpN&(aepj^J9lgirtEmJE8@Nxh@t#?!jpqdc!ssXIX zkw`+T9>7Id{MWOoqlYk~^D|KazgBcr3_9g)|71B)bH9>l>ZdY0c&?lEqj z9zc({(o;xG?=8IZ0gM&G>@1cxJ^*g%p9L@>Uc#pVOcXvTuEc^T zOY(EUF9ccJuQ*0h)RX|ej>mr!z|;Vy1@LWLnIU9)yk~ganW8Z7>;UEn@8!qbcsxI{ zzvt59EaJisU_k&saC&pGA9XC`*sa5o0G0-@NO;B$WpMyR>OXRUylG!1dJJ!VZ+-SL z<8sNqLhzSHiK{p>AD37iz?uNo2Cy!GO#%K{59`@u?MrP4V51P`WwL%p>n~j-^peoE zMF>AG8!U2c58!9+Dgo>WV5juwt^f|Q!h0OM1K1;xdj$^!urGl9Tm|nGU^&D^2OU%% zy_YScw{j?e!)!=zg?2>ZNw`fN3!w21Wx?PAW#}W`~l$S&1hBJPqJk0M9v6L94f4NU@1QBn6Sc;K@06ep~d^ zprV($*|G)ECudsrAZ9(uEdPCK_YyhZcw~d*vISx6P#D>Fpl$s(j+{X_f=CUbX)Ak5 z5D%L=rminh{zu!FYJs#M(u2qqL~icwK@TWHAc_R}UUKV+zV37s3gU;Ljk{%0sR^+d73n1gkdzFfRM0xB zd?kpKPaF!5Rmxs3h|)on30nW^DjP(VAgTsYE{O6$R0yJ?=r0FRNeE*qv#PH+UgSt4 z#*)NpK~xW-w#3vBtSQJ~dTR;xd^eT6P7rm2a2>Jo(il)*s==Bx5YkYvQ4rNS=d>;X zf@mDHKI^~f=V-!i45C>OuLaSD4T+>y>6g}=b?%qeO0Y!`ErlH4p-`l?4&rrD$S>_s zln*l72KnyG%yvQC$(xPc@@5bntbW77AUX!oDTqiA(I7ep(Ip6W^@t#H?o_&R#DnM? zM7JQ`3gYdcb=pJgxKkl^52A-CJ%i{aq_<$@ol4D=L0DBjvS<@+FrAu_Tz9$Ks5)1At&poPN) zsW^jBgSgf;Rb%-4c2oEPGE8ip08-$PJelFFN0;%|e2m}!d zBFz4|pWrKP?{^|GDBjHj98{R3NS+nM$RK71F(-)Kl^h=iF*b-#f*2LVMZ-bmqaa2H zF(!zQgSfX-p|NhnOQr4Of*2pfxvcyQo4{%Z@pTa21ktdQZ6ZgRGdze%lAPWtks|H$ zAifCV%OGZo@|AdrQ-l=Rr8KFP8jGA7#J53A7kyehfUX%_ry?@T%ph9-S&Ab0Wsl?a z70Gis)dxBz4z~EbAifLo)m{0&mxj*|Vu6tAyA&Fei-K4j#8q~35KDqs8pO6Bwg>Se z!_sYQf>;~GGT}e593d-$SS4hoV4=!ZByDvNPpT!7tP`DNlaTd-8-myxp9tbtA(_&aQ^HRRvP!?l>qdS?#IqcW1r8=J#A7ZAxhVLD#K#VL znM*)KCRyP>gSZ~V;b`iMApVkV;qM^+5ppAln?i00-WI$g*k_k@kK!)p9ye`Hrvlc^ zgwkE?pG{1?AH)L=*<8m%!AF8j=D%F(i9|B^X%Nri{5fa!F2yS0H%CGUIjSe|iXdAE z*+cj?jOk(I2mv8n2;pLgrLwGfW#v!DH;0U2?2<1XZ4S^q~c|*u2 zBuy|~FqdHN5K25u$P>cyUDii%MhN*sC=^0r@n#AZ455IKmjoGhaAT?O?&TmU5<*cC z%Y;x&NQn?ihEP0&or9B8(?DZbsSuP9N{8^la(3dy=Ll_vsdm;3f00s{b@{VBaxbJedNK5G*B>MY;gF}e5;)4)| zh%)qlBKQ4hJzIDLb*Y0>0{$yU3&9nFTSPqsQ;0{<5MR;TAxsQm|0kus4q;LVV;eeXUkLdugvmla z7yPDOshIc65Wb2>P7$*2VX1vyN8-++)3{!)*l4r3LWNHkoFO<<@aQgu0kegZ%n4y` z2=gRK{3AV;;`|U6gm55)gCYFDCWNqqD~N69li5O89KsSV3e(1usHGwN7=p7?iM1gt z3*p5sWkm=pL-8t+pNVTENy6m15Y~sVA%u+~Yz|=yXW(vS zQwT95XV}(|W!pm7E*XdKRwnLNR*8|cIq=dh&XzHb-Qumf#(H4>o)B*AR`v?+6WlLI z*P##&hcNSbiSr>G3E^k%1|ggb;b;iQWO|(KY2CZ{C4>|4dL9>Y_EC;sh0MBK>i0+1 zvYHOLQZpr#7YR^oDjxr-<(S9(l0G_VsgEqsegoUiG3JGr7$kD+98w*Tc@U1 zL%0^gqYxg4@Mj3uLwFdnZY#C=w$xwjjaCkxRNtV&L7D5g#oZ%>yCK|`K`=3lBq8IIaxx%C7ziU(6dUUwMsgTA!`4eQ=%pPvnIlEKWH^)JZ85qTYcdT!e|&qqqyE!$SZ=c3O;ftvxFvLG>ymj_9)H6 zXc0!IFgk}ZWslM_jK;q^+J<4P;Aj;_>oaIA_<9&^!q~b;p+amIMy-*lv^T>$`tu>6N9GzN4D^U<1#J;Ue~M%OUXkstg^xb?RQosYhk#;aEGCXv0+XDZx|jSh=;JhcPycPs4m^l(p}D!fDgnF(Hg`95vN3K8%ig70+HJ!*ooQV^vt=n6p=z zB=h{UFeZobc^F?<6)QD0j4#9ZO87S%>o9&*?6j{%iE)O}=ps&&7?K%b%;YSM;xmp2748rKu)P*FTPLt{w@3J zFxG~#E{ru?zw`5O)2nqV-+ER%jP0!6A66l=hUVNDM)Q5jW|wVK7@Nb`!ZJCTzj171 z(q*HO(@1uNv6B^Mze!CFhOtM;-Z1us(KDKz1@7lO*=G&t0dY;*r_h)@B+0|% z%F!^6h4Bxo&D|+%-6A*@#_vLo3!Y%-3!&>bAt%EqRWyUi)0~8&Tn*!_kV}H+!ZdRMne@K!U_wTb#+AnkFhz%@~$>g;#{tV+fw?PTJEqExq{YDr!h2IK;UwSf< zR;{sB!ksYwj+Z&;LF&CQ?sFrJAT@#qVLaq^9r-u@5qJA|$ag))lcHgCl4l z{1rjQHx$w+g4m&7m1N_%mtxZhnnlp3apHy=sjmrX9{0A0pkb|ry9oM4 z&_9AVB4{5$_Xv83_ss}8M9?vUzS3CMp;H7GYNU3KfQQITEYKxhW>+EIB6v&4+i{)c z_l%$yE5kx)GFZLEtF6n!0-JQVMugU`apF6ozZb!v2nIy(ZUh4(;K=$aCb}yoK5uXT zphhZ>J2-;(C6YbK0zZg=UY5W?92UXw2!4*>Xapl7a7Ms43LS_*jX;ZFI&($fVtfSS zA{ZZm9)Tx<4BZx$h z#avwy%Z#-}Blr&)Gctm5)$FvaWcx=E?Ck6Km~*(VgJd)Zy0>FY1WQKSNGOgK*C&D< zW;!NB@M#1S`#8Sjs7-cEjNmi&NiWAFNfsPyqc}N&&m(wT)!wy6;uk{5qx+SwBA61v z*AaXZ!L$hGR_qk(j1nVN$!G4Qiy>!>c2sR1XAjkpQ9Kn_d!hIdv zBiI_j=zb3JZQN3v$t1Mwxl)NY5)yYw82R1^w(nPVN3chf{reS)`(iwT>yxcq|Lj)| zM$ox&>LJ0yf=2{>36_2=f?v4mqo@?c@d!>ta5sW`5%3$pUn95@!PN+Ui{PXvr#P1) zI4k^j!PA08(v@=&oEQFw;Drb-3Sl|94k*M@2b4<@TxQ=EN^LF5aKUR4{1w5C2>z7# z>+xJ;#d}kdcLZ-ma9haN;`&?oKY}d(rvu7;ZvGLx6h*-(9!Bse0$UXJC?0e2Otd|Z z;6(&agg=eonUFmPlq&}mdK02Zj3P(WicE?kn~>~+MpNi7*gDG|NzrjC;mN=uSD z!^#Sli=uoK6@RC2E= z!6dD56iuQaX(~ukXr!%q6fL4y62;Oej!w?sG72LKGm2JGw2tESDBAE?Q4ENpZ4}K4 zJKl_t-QD7tfXOilRDdPUKj{merjQu;*EHwyibwW*dlq--deMv=+>;+-Y>yDTk=(x)7r zDBg==P!yHBrtk8cCAh(ce0R^Noo|D z#N<1f*&0#n+sH zQB38pZF8o5EBZ9SaQ#Ha*Ey_E&lsFElVPf3PL!{0N}VN~$=U2}ey^lD=0-6uitog` zK=Au0=5uZwRv1r<3i&}?(+(?(quAQpe)yv_`=%e7O)t@#r72ssqx&2y^)dj%sVIJrE4ecg&kDc9RV?J3;Q1&n2)QW8Tz_zX zC~6gcC5o#QMZYF^L-0>Q23!~Nm*A99i8tf=ttf5_zaz-g0|x&i{BAtvo{;;34+MWc ztUQk5Nfd94LiPT!KiRV$g;9SkZ)hr}rAu$X6vd}*ZNm-auQIUZ4rxw#j;e+ z!pm8x`MSMJ7OG^SY8F;jPHmlqYFVhBh1aq$$(~w+0a<9oJ}G0Xm4(_u8VJ@Ate=It zS*R!c_J!n$i;@}Hd|4`y){srEX(xH*|1otH&{9?JcLsQS=E0pu!viHA?-J4-0!m1C zcPS+;At6Xi+>AX%rL$L{P*cRl*>Y?(RmAM!^5R-#EYZU+b*B_P4+9p1S9pxpUKr zH=Sr8VT}YSHWbphj~Ut6$ve|zTM?TkW10zRF38MVI?>9B;lPAWYwDP5iD#>NiF(cOt2PW;h6drv2NJJCmY zFTv&OEO+Nv`a03iiT+NEXrG-XBdI6w9VZ4l@vRfzIWfqI!A>l2^0k~8;>1uVbSJz{ zyz9g;C*F5rq7&mfW*;s%nz;#~GE&GW=F?lDImU_ioEV$*jwf+~UVXnx?}VhjV81%a ziOFKRotWap2Tn|PVulk_IlQ|$7(7k9^Qv1v6f&!-qgy_+h?!0}6N+FB{z*M;#=FFP z&?SxBBV6Oy=xL?NL_i32285glJ25w@M4X5xdDMwmlK&}9n9UI`3g=xS z=Xso-Wv%lmiau|yV-fd7bNeceA16L`VqHe|d;8VJPAqZa6DK~EQN6;6rA{n!V!0Ea ziE@6Rg@lR6FzNwwB3u|~St+j11)GW3Xq@c}CssSL#)&Uwnt#nAocPL#wPODM!otMq z-|2*--YmyAP96xEgy#27{NThsC-ytBp1mcTCewR$LmrdKrMvb=acx2uxK(dE} z(}~yJsl0-jcZ>2T*PJcNUUSY`PprzyL}GNYA8_Kh6DOQF=)@r>R(z2D+EDvpPUmlx zBZ3t#DMz^oTvCn+Qa|a$DGuEk$`vP0J8{N|3r;i|s+^VHJI9r?qjgpRFx~H~oOhZ? zeo2?s9Q< zA&U$5ocP;`f1DV-7x$fb;KUQ*57{TN988bJe8eFa%d!8Ag<)f=6sl3y{?rNLGx7d; z#`2u|NW3qcco8Wo=ge7XE!CQ3)w_;xRBxkw@P)Hr7&l>U~|FlGJ~meDMg1L1*!hwH_6y(7kuY;6yf!Ads z2h=hyyyij!7aF>-^RiNwWx4RW3*}rW??MF^D!Ne3h3YQwZjeeYR1vcFJSw~3ZEL?Z z-d@#(!SgM5MrLn*l9(5e`T&7uH z@C`wlZ@RGgfO(C$kqeDoXyZa#7v6HA=2S;>7h1UZtrn9v6>KJ0y`Gf{kMLW%uxz~T zSe`WUR^0qmrL`cB_S?C@Lba0`g@J=pt7BZh_v2JEEbrEyl0rm5& zY297;J7oS}>)}FA7j7L;dkOXyv>a6XxUjBALFydI{aqN~!h9DNxbU_M?{H_iFu{d^ zE(~&E)o$B+>@Fe0To^87h~QAccN4ffg^?p%7$qk8NFiBrTSp5SlhmouJC=PbO66K+ z5%0S&k&SgB=E5WwCcEGh?-cGk7iPKObYZFs(?p!%!iUM+rVAO=+RQV7GdbO)2r4cY zGzoAEdXih&532O)VtNI4ew68VA>cwV850s>u%3g>%$dTXLd?U!PuZ64=Omx(@ z!oL&z-i3J3k*LE4Q8o*16x<}(s=alK5QhCIggw7CsZ^1AZsPzuW#;pX3%{~HZhYm& zZ!Y}qLP+b-M@@|WOU z!RePA47l&Y17_<+x*HE&c*N$rk?O`{&h&%oOBeoi;R%b|gr_b%bKxHsp1bfu6pG|T zMlz8wS=`9xHVKneNEX4YZu549VF%R|H;@RJXl0B|_^7&8UW?4`#`=Nw9Bz#NE>E^V zQN<018)YTw>IPGJ)!yw^YI<5)Q8$XYQQVDH$+l!jJ``JAckpIW)ouPX z91(A6H_Es%!i|w`yyiw(H@dpf&5d%*(2Y879z2-;Wh%H)RS0=SH!3B0Ww&{9vWgp< zH|D2{shS(r-KZe}HQlH!q?X{zgXX!c`rl+F)^($v8*SZaC$9Q#G<2hp@HYhCbfbX~ z`;QLBHx}NUO>pBaH=2mq)Qx6BY<_!(c$?0P1?nYlxdI(bK=|(T%z1`@;zREN^s-s{( zH~NcffE$B^yq(xR#bF>bu)#w0f;%dSkFtc-P|#}#Esb7dSyof{+*+<4!OiL7=Dg^3Ci$rLv}aHC~c zhwetOy<@5yAG$G})hK13CTQ{7JOG{sVQI^(l783$KqeBwr}<b50O9RjeatA4m9$A=ZjvA!g@!QxCTW9vKv?2 z_|}c@-1wbKu^ZoWHkDU?c4Mm>KX5@1bAuaOglrUKz$VU}B;U5w_G6O&#C`qzzdPBs zah(@^J3Ap0JB0s|jQrJ&l*8tcQrGMM#qVpO7QD z(zq?t0XGhcawr)Yk2#LIag5W%jk9hXcjJUq;3PXg(`;R}+9sZo_|t+bhZIcYcFv7U z$$ZWWxgdB^@M-gmQc~xuVm@@^k&tU#(A>De#Zb)KZrpL>mT*2-*tL?Cng8X+-=dJ; zb>p7!)?cO4yf6Gg(p%%W^4N_hZe;bC^?WM&zk<&M|8e6v$B*!rf(-lYp4p9crFs_G z(CR@JA=KHZY)PKt0fgHG*(e4C*DKjQ$n-$~8}A-M#p z4E7P9+dDPc*c=1i6uQK<-wZ5_Ie(a7D8UrgEAhx#)f!M&V$NHy}Sn%g;x-K z^fF~vIVUXzamT!W#-U^5Fjd6b3i(ps5EfJZLF;Gr{H_G?H@5tV?0htwdyS z8xL9wpC#3x@?w8Vdk;FWTXbaV=;%Qw?q3aAHFWl%3um+k-+0i~gKi$Y&Hne8KbLyd z^zCZ)?jH2;pr;4DMC2v20Uq@BppOTAWl!}N>?asIY#vMeB$)1090f`Y^k9$&x(8kl z2755XgK-{=_h6_8?|LxGgV`N(WS7T(hIw%GusYm>Pg@in;lW7Bko>`fY{bzX^GSp; zg6|2A6{NT~VB?>l2_CpSs5Dl2--C%Paed|_4?gfH53Bi(sM9?7(1V#C z%o2UN;0(d$M^q-Zf+7<|r|2abD-UZcZVx;jXdDU5m>hr+w!6FYn@*u#0 z$3}TD#{ zzC>gt8T=0b8uo~uu zr-fhk;ED%lJUB~Jlna9A1sS%(W@WnQ!6i}JZ!?>4)q`uC*P>icM&9<|hVYw$w*=F( z*%^PwgTFkun~c0CBvF~ag|jOj2zltiBM%;X@Wg``9=sIsso+0?&pcQ=CzE+HJr{*% z$^I2W#j2Tm%_8{PF*QN5X-Lr!)ezGF4K@u;G&I#<*O00~)lgDHb`3c+@Wf)sdD@Lw*efG!)cOL_<+# zyDK$a!z&v8ylyF^Vcap5sjv`cVmp}SRmtu5D(3HaF%21-`FmGf@YqYsiI?UtS_uuA zqI}`bq*+QsX$@60RMpHWQ$|B&4c|qT*EIay)>c+SISu=-*vku66s#b~+ETA1d{BGa zur$Zm&Z*TjRM${fLp=@QV`>czbu^s6vntltHSh+K&yK0vj;WJ- zDrcW5^)i_Db$(zTFo5BNIr}or(wK?DH=Y|FhRrn8YXF&oGgX8P1MW}8!?hOuv{uEXsU*3 z8a~u8U4wBuB_T3^WQJ_Z>ai47&#A$s!K=ZiVNEl;n;X8ZTs@|GI0&a(H4VCu$q5MF^L4{M10KRvEtwuU_#{?IT-!(0vDa!hKNr{UjY>Sx^b z8s-aMpkbkgMH)WR@QH>`HGHgLv4$lYULH#MvAX%|@Kg1a_0>~ouFRjZloNJPj%9)* zbWtZ^wktS2HLTUJQp4vORwZNBX!t_-YC%Rap6N?5xj7#h_?pA@sIoVfJ=EX6PQy3S z-jAB5&}^|k|Mwbx)bNu`x*s&G*RVmuMsAXlUb3_~mMR@rH)+_cVGGCkaW(Hb^Glak zvZep5VXKB;HT8(b@zzuRt^3oP<8W2`@0xi< zW2fl51b2(VIs2!Ey&5b!tUC5_@@nQ^t@|1dXgH|hqJ~Qv4rw^7p=EpfSq(=t9OdN7 zhLakOv7aNhG{BxCn?y^Ma6V$JNUk zu4wp+yYHHERm2;~m}?rYCpn*mys6=qn71|D5i;Tj^BgR1ta5Bs?n(~#xLyg-@>-dp zFR%3hYu-8ap@v5q9&31_;f02ZJC&yzo@sb4oaR4568L0-QubO(o<+(_jxKI8LFwJe z+M|<|VeGmrI+`TsT>qUtEAqk$ISM>l^XDhgK9QAx-5x$Kq2tRhHnRUOycnKuhDRo77?sn^s|E6IzWFz<$aUB??b z-W0K}j(SONeI09I-UHkqsWjHnQ1}}mTO%P2&)VJ+(nPSb&%F7zxsDb(#_AZSqos~k zI^NMSP)BPWZFF?k(L+aD9qo9uucMQWGtKQ2ZD_BfgO0<2}i$Kr6=>9sAcPtVSY| z+cL6fx1!_O*elBON45z%-q$fv$0Qwx+B!beF`3=62_NW~s$+_zW+%*JdnTHUnI-`w zOn2h8nL1|a2iB0ss!uSe z!!LwNfL-+1LSl%L;1L~B9ZPjA(-C8RPN;Kr%;PwGQXsBlwvJ2PZF8hbcY0XK=j&LY zqevIql>zCk=PL_!e5B)J?&bN)BEdobS{Cadej+CIB|=W@FZ8L9ej6MMPpC`X%4a&( z=qQji|8gBGxFZ%jR_a(KWs!fbqx!8Z6>nwvLX>SM)YUqO?5OVtqV_)31!oX(RbvHrXlIx|R6@fs^WP z9eZ^Ap`&W6v_Ez1<>D`V(`L(vnbzzFZQWa?kss8}W00oS zT+{KFnAf=rK6BjEaZASyQS_54v$`$(jv!6O5LcX3?Kn&n9nU!GxR0dHRGxB)_{MC-;L>T&b-dK^uZ|Zws2}*V5OorZ*PItt!Hnzj zOx#KJHvTgOs~ z44_!viwa&;@uI316&dVBWiNV-vQC|=Ff0*CJW|Wdu$mXuC5ObeO;gk8s^vv(FY0*l zx))E~*>C1DTQPI6`DTN7S)aBQF|zG17}s zUcBW+6R&wbxw98dy=dk&Pl!ElWN+>@f1Zw=Qrie=;YCX!tpr;OGT`S^YFjVbdBMns zr&Lb|M|&?ictOI{QAj7jqNmj^UUc=E@1W?$H+*{0mo*f#hhR^^UV@D2EhOF{mAoID z;Ke{u`U?(VwI&dGVY zVuu$;Pb#G=+c$afqZdDUQFx`YnTv*I-NIUZ=rC$H?zPSSvlrWBL%tMiD=T)+mZ4^^ zds^M@MZeRk^R)Vl7r%P(sAKlu1b2GzyL19)7R75v9lN|BlK*>XHFJ3vLKH<-0mmKq!+HQDp(~DbP+-7m7)qhW`cf9yZ8u-wQ zyI$P$;=UITMERQwi2OHah35>+v9Fu?`^!ZAkpxhA>_x}k=Hm0zi)T{SxbITG8=ap1 zQsJC^;YC&-viZ#U{?dzG9qj)KT6`wA3T6?kc1BI{0Y2pPA(szNcQ|Z5h7ZQ46p-z0ohXbE0MSLjg!_eH;SA7_HNonA>7W1LF5B+jmGkh44+sc8& z!~iNIb6Zs(O8W4o4-I@M4}02M%lORO>^F=vUmcn1c9ip(Jz3d@Dn5P^ z)KT7t3PLIhRuZJ%?2KB~$FtUHHGHV)L!UEhHNonFtI~_|wJNoIC|^-|-DkdHrM6%l z!3vv{x<1qsZ+#!$5W>hQXH;VKotX`Nxc;?cWL5K~%|<>n_Teobn)uMnhk0kzramzJ zGtI{H>I`Tbur>Fgg%2%#XyrpY>G`kEsI7fy<3n2?@6J+bX6DZH)X2Pd#ypm5pNt{z zogeHi4!U>|z;%!h56`uosRcrU@;NxhGdzJmP(NBv`A z`~cx^vp69G1*>;3vl=3tWVn!_g6|3rW0zh`p=*SgBLzqKFj~mr3f3_`es<8xfHChV z<9rzJgU<)Q4-+KdLm#Gd9QrWPhe2Jfe$}eOE42A<~dp_Ji~{X zK6p4h2AldUiF67k0$jq~f_ySv6T(Q{2d{8tasiqF;ZdLYC{xe}!-tS4%r-1_U`#|5 zdndCXrkI##Xj@NdhVwAJ}mO#BOey{u+WEtX;yy+`=dejCLQdRme@Y# zaOz|Wr78!vJMx@Wm-z6B&pgKX)Q8V}ST20256gr!sj1Mlf>U^?c~}1r6Ky0befV4y z@>M=mKdX|g@!?A!8u`)KkFR`K>%)B?9{BLJ59@q5;loMp2o7l<_WH2ThwoU!i0x+| zw)*fryI0KhK5Q1UL2#oFn|!eJ%(3o_8Qkrxx<&LKefUYp)U)O(lpe*iZ1Z8eD0{fb z2-zw4ix0mF`AzV5!8vEuuVlkrV(u1XKAX>~e+d6mFkPPU+0VIOUO6I2azMyI!9zYA z7Q&aK(sfk$F+rNgh49rer+hf=!!52t1C=vAoaM4GM(Hs^;SH1LxZ3-0*@yF751Tlc zF8FXU$-Bo3Uh(0o4>x=mKEPZmuW_<-lGd`&++EAUM8b4aLlPBb zAE|yQemKON-H#kXm{s>NRt9tvO!Fg`AGyVq(~s+t33H&Ak<2`wANl=w#gAA0=C~~& zSV*v-AL&9~d6`02;s3{r_)*l43_nV+K7R9egsHe6i60C8h%jaPp^B@NU`anHCVom< zjZ;WUCzY~(l=I_FKN|Q^-jAjamGs$}RfJR!tmsE2A#_z1;y9;P^`n{})%~d9M;$+2 z_oJpCciUTQ`BB@Cd+n|NY;+XuZ>PdUUe}L$e$@Bl4OU)sBEu4q3?S)YOY62ZwV@w; zhs>v)?ZmhIXyQjNKYIJk^PElnXyZp)KbnczT#$MTAuauAl~h^_srMouz3qf|@uPjx z+rf{H!aE6ePU^Rt6=i%^F}wNEJ*oE)($kNV56y?*`uNe;kKuld@S~r&1}7u?`!T?e zw>f@98JN_UzG4|9ymk=_a~P7;hYERDaG2nj0+x|}jPhf;A2a+I?Z+5DCi*dn`!TuI z1R-PnaNbkK`7vGy{~*(3=I@L5#(rgTGX4WUrX+c*Ln%{}e3~C03LiQwgB#BDW0oI2 z4h&|PjPdy4N^-Z5Q3b4;5Iw1T{rr+|4(1RLCFDogk6_Yk__3pa*=nW;BSnu2#srr= zGJAElA9KW<>&LQJ%=iL@@)H;Mv5-9wz@z{c`SFn-*#msBAwKqFu^)Rl&HY&7$0vS# z?Z-MlKJ{a%A7A*fn)%2?{@jmMLO%0jxsVlptQ1oHoXW(>&Q&gNx3o`(r^dg}^VbZ8 zFL2=9Q)~R@+eNRGw|;E(W1HW6vhO=THu$m8kMCKZ$&MfV zSno$S$(fmxY~nPJ6x~<1=#PGE7EW`Ekd2kHo*3o$$&a7?|2=c?*~eRc}w8jsaZPyXr0UM>RLm3w~d^Yd$! zxa`LjKb~w>4*1Rg9Vh%a=*J;Hdh}Ng`*DmhgYD!;{5UEi`Mh)Lanb4O`zP4%(x+VQ}C7`f5oV$cTc<_XMQ~N zqjLp?>5-7ff=~ST>6}WD1^vUS4pOoN@Z66VT>t&}S32Ah;106$6~t6XtYYr(YrdW_ zYXI2-NC^M|*aJunz!m^+xnv?ac}`7`|0zlUjsU6!P(6UO0CEP*(-av2)TIG^}LC zGZhQq-f@#;shz^$5&>jN>1qJwgs>(h11J?h=>Ww9nukeyqg8<$Nph>{|LYAHV>~nfz@ABzXsC(ZK->VR26_;{sTEEeAIo8o;{&3}cBOC?f+H zC1kkZhyZy10QJ!Uj0xbq05<=q^lfeF1Zyu?$;YyiunvEckDN!*;{)bjl?eg7FN80$9lw1@K`23j*db_VfT|1Q6iP3SedcM>{%Z1>ocW>uVmQ zF-^=@z$Gnp2jB@nqw9j|4ZtTv7i1U-lb=g;OY_1OV~hYo0mL{gn^-s!zV|9&j^u&L zo>v`_0Eki6?N||#cmT5l*tRxLwF~N;0Okg;Y@jkPfcczjk1R~g{}sW7%s+sSnC-BP zPX#{~Tr9Xm@DoA4YmPBXg_A4`;IkxOE~NbhwMQlU=j_-3wgj+>gEN5D-0zj_8v@`{ zmTQF5{8GqQ0jy0bUk9)*$-fEUTjAd&mG1-iA<5SZ;Y+ajk?oBfnKs)d!3Qhy{20Jb z0bB^+VgNq}ur&bVwL+)a4*_fs;LiZ|atsIX3m1U^b_MV&cThjuZ`^Af61@4LpN&`W z6ZZ!23jS{H;*$0~0sJ8(aoYgz8DJ!1_64v%fFs<$0UQY6U;u{#ILrYlUdC|S#N7pn zTLO*+aGdK~0H>rZ-Z{XsPRN>*2;(M+bcR!APA1b?A?F0ov$#I#6#0g2XG^Rj37z`&2{o7f7XLgg18mH?Evls@K*p&0(dIx%-sMU z2)QT7_`ikR=Q7*Uyaf4B%tuM@;{f*cF!g5v{KM5-ig?cHF99iHz6`(`M3x}_4Zsq_ z-V5fk7M}3mHO;INlT9%6s^hG98Gs;cLA+kV{3J~RQ-jDZVN~eiXmkO4&v1yiUd(Tf5BIR{PlMb z$vGp622m`CtxK~~EG{CEUb+~N8H5@{&mejQQ8I{9K~xQ*S`ej!C=)c_d|oAp*MdB? zlF3vdh_b@V36>Y^eNjz#D~eeuh{{4nk1;ptI=UeLPw{gk)q`kCJ%}1X)C{6l5VeDN zBZxPHs1q~~`CbpAE=4)+E&S9{Pk4QCeRxq_eo-CT(e`4ztw9itgLo^5hU@`p1x2P# z(`+<Ale4ePI!Ak zJ}yC>+iq=X5~hwp^I0~MF04!t-Gk`y|Khs^&G-A!%S>7i&qBfs3+e@Xvu;5Q45E*i zeS_#Hq<;_tgfJ%Wp_I3U*ZnT@*V5)zgTx#nI5>!e$YZdfLGwuLUBO|3!-M$i^`aC< z1u;5^z9IArVN4M3v6BrnH!wDcaf}J#ZV=;xm=MImAQlDjeh?Fba0THGVp8zGyZ1i~ zVsesC5%NJ0Q-w@R>NS6|O&2~Rsmv5IOVBC!$3@i>gcd|J8KVmcun&d!1pR`wTPyqt z2nsg@LxSNTB0}z7RP)|9?`>d;1^KiTW{W;2i1|XO&lNH+h@!R3yCawua2UuP7as-j zaS%TS@lz0sgIE&8=RqDr;*%gg4Pr$QD}&%+aN$ep(jcbnRF<)0xv(@#F2#DO3V22pQJ`tBh9OVm|=Nb~kOEzkto!$5^Gwf{7YM5vdB(WOEB7CN$1kG$oJw*rv zPhC<|4P-aWH(u5@ki&ptAj3cj0}cae28tNSmIXNt5cC}W@^xtOmBmJ=*1xO=IiynzY^{@$3M@kVV2k*TtH zs~GsEyfvXD;-6kpYZzEr!CKScXFe1rx5a9EW~pWH%NGisS?U;g-9TLf^$avM%sXR0 z9-CU zz`F*98R%}H@@2KJfqn*h80cxBmx0~}zAkO;Be<@#^-5WLi}DU8^8Or<2Hr6+(7@Y< z`S!)cYZy6_$%%su3=y4tFe5ji$z}81j6;R@xU8<&;23UTw1F`O$VUi{G%(7*&+V-v zCEz_S{syKP_`tw81LF-$G%(3Pi*8n?2?pLbz^9oCW>1@4GP6M;g{ieIg^xr{Hjof& z|B^A)z%&CSZ&Wt#nPeiLVPK|#Sq7XOFm3ESMX<}B#=mAR&b4Fk8Soo$8*p7#J>*aF z@iL8OKsVqu@WqpSRI2@uhZr!-yCC?CxnUqEP2-l4Et9 z<$sBrFyLzg>o|S#6%B99@r{Ac4Tb4Dj<*3R-?GAOtTew*>J<6+Y6EA1flVBum(>Ex z9GeYnF|fx#m9Lc_4g6%_R|CIs7aQ1WV7q}G26*xM-eq;0^d33CIrWQ(RLIRwP?fU% zZeXW@T?Qy7BDu-EPS)LwX=Nd2*dGS|G_cpeJ_9LN)B^_g3t`vMWJ(ZN? z+Y5}TVq1`A{&Bk~VxcSQ!f#Wr7`SHOx`C_Qr{AVBRllO%FmThrEm68&Q72zfzmQ;h zcU@8cGH}~YG)A@+Nc)qMjGxE|(C{hRY$t^)HX>>+o3@hpksgmd|_KIRfv$^OK^ zQ^R~t_L+g_LjDn?GPR+F_(IH=-&!moSVORdU=JZn$h=1dA#-YE6;3mokQBj9&n?{z zvuUXzOg@mwEA`n!7}ZdC>KKc5Xeh~P?{u!*QAYQMWjCNs>;N6RS2PC2-QNU9zvz0 zw@L_=h5N3m3?^0$f$=0YLZ}%+oe*9Rp;idYkYa7|CL$R&1Ex+dNxcy2hwuj5yHep= z(Kv)RLuepo!w?z?p{rZgtnaK%A$cogzP5s?iIAotd~#K#*&<|~!QhFG9wD?0p;ZX2 zLukWRhw%KW+BRffXjt`SW(R3zJHhsX8?UMzL+BJjXYPwHGnu*wIeS$lXAg9f9J&iK zD|&l|%o8lV1W9^_&?m`x;j(`S1DJCd1H*WmB!qn->tgjpdt zLl_#uyCIAZVL}MQLKx26nmcx6cZ>*OWC-o9nYVk53Zcp(Wn2gi7b&Cp7eL5+A&eE0 zaZROOQ}B4h4DxN|9PfuPF@#AW^NlXmzD%7Qg7!vMF5n-sO1&IYLiiwrslpfaa!eCK zeXu*nbn;DDWMs_Xekq0tQ z5Edlr7Q#nD7KVTi&7)spf)f|EbSw^GiI7hOseCHLbxr*&gi@vK^;)Q_LRiku3E}NK znJYu)qx7G17F1H|j8gc`R_6Id2&+R_6T+7v{20PdA$%3W+7NySVLiLzGIfSht z>80{v?7H_oqe*WY3A(^?udC;@Gl9VivjdDjASEWx*x(L2_SzUnhF1 zNu3JKXCb@@;bjQ_B=zSU!243@`Zoki*o?^<26JZq)-bY!&1$e#iI{9*q=W(X*oqWZ zhQag_Q^Uv}Mu9L2hLIx-C5&8Qv_6 zycR~YFq(%EZ0IN(MvX9PhEXnz@?mo>R|vz?CVQ!J_C=pMDuz)h43f%%BvrzwD!iIt zb-|-Wvd~p4jM|bz!!YWwR@c?~Ve=+|X7|!xXNmXH>xNNJNZwiLG+EXg691-P0|v{d z=o*F5IE>k^+TRMJNf>;1oP6sLOH<)A-^-Q1MHnr^=oUuzu=%OSR$+7vo0k|`htVdC zwqdjj<5|}nodw&6(NPGM4no)`orIiOW~0c|MNEo?`Z@Ub|E{w@k1+a#(U+Y$(b_YN zUP5?ozqb(Pz!$lfc$(UeV_x3B)L+N|!MDTce4X#F$Dl9P0uKa7cCOyU5Z;V4$$R3?XUytXyrW!Tg(riBp;BObYFJ64yrKz z{6jIqh=kFljx`iUSd=G!DAcJ$#U!E0&&TkHXm%KL!dQA;og2o+Q5kbf*?+xm9*ryr zV__I;!uXQIER2uBSjmQ~_K(B(uA;)URLJ5mmI(PIsedZu#C3IoLvCj53S&1{p$G~_Q0s=eCyWDO91Nr9_KZK+$s8~P?R!Z^q%!RjvR{zrtPX{7 zm@8WZwg`@daWss-!?@4pbJ&D&C5)@=r7%v0aW0JWVVnx%H22X_#~H!Dx?9OB*1*{? zZgscrIqKjIs28~ShjEF6nbW_9sej!2zc2e#yKQ z1~X(Bc_N;fFx$If+>2Vp!6;~x$}aXk`z8ph)=o=EA8Nd!MjR))%pFkXi7 zZy1({nF#|DXpJCC1lb};iI^oOipUzlEQgIIW7v>HTkH`OdB>g>LCy#stx!@U$R0tC z2u@VDD-j;7nxx8*EW~$srm?!cQ%0KaJM-5qR|L5u$P+PVO5Of2f1YII%9zlx;+C9l?PS3}Q=1DoleT7$V%-DU;@~2!=;6I)X6~ zjNn!`)RF9m4)z-zO8nTz_GwG|C^mdl7LxapJu^0fhjY#6S(r#BMDTtDS_FCo6C-%_ zwDLj3Ji{<4Vt!$SX|j+hY)JhSno}c~7BTM~`Y-~Qkm(W3h+rm%I!#gBH_W?<77CKM z-m$qw_Xtwictagu%i)cf3!|S6ujTLw?k#T(L=cR?h#(X}lmjM$k=-p{4Ym`*5kw*& zXU%tScMR=riAOLyV!n-&oPTENBF>9oegtbG=CA642o^^0S;YLe$h+AWu@&sZK4V5`8k6=Z_d|qZHr`~?$bIzcM`MJO^B3LaX z@x{Q$H&lvWvbNkQtMaUk;6TK@QvY=X>mv9jf^Q?(8o{;*zKh`d2sTHsC4wI!SRcX0 z2sTBqL2AegwZA^I@Rdy~``E^%TA9cb_+tb=vD^EZr^pz?^m7FC@}p7PBiIqat_XH> z#ps^;O9a2Mt2tBb)?XvwS$%HO`eh1F;FIi(U|7qvb~}_k5&RLseku3Q2=+#>F9OCe z2YQ*l(##Y7+?@IFY=6Thj)M{SMkt2_4+|0xuYZT`qI3K}Xmc?Be!9}ho#qGBuxD>%Bwm%;C0}cLe{6p!Q9b;@=V6=hTbfSp*NnMe#9bgz!g6<=2e- z)Srm?Re9?_LS70!PsY69?z@-Cuzw@4ME@()8Z|3lbU-RGTNEi`7K#E<*rLcQrag+( zDAI&y7i6#!MUEurgNIZcQM9?KzB4>W&M0z4kz2fZk}*yCnayeJx8)Nhe-s6T6pSKW zNW6|2FyW>;^QKxjidUj|HHsqQDj`@jiVPveq9`t;W6yNUY}@=98J@KYx6Krhgq>V6 zic(P=dCyUrVie`0C?h77*Phz>LwgorUuKm?YQSqoyad`bG-Vjnp@O8nug7pN0mC|NhR2n=e_-6FKGdvBV zXefNcq%1tc^Hvm1qIf5Yfl+gvX&OblDB4HSOw8tj)LTT+Qh2Ku8*C@Ir#4M(Z0Tg*39r5+b*4|O{iRg5%ki8|E!HFRq$bT_;8{ zDT*0U%oOkBD5gd+Es7~(ejv!OtLx0*55=so+1z}36w?Q$&HW^ke3s}gK_}aL)ADks zSq--+9>Fy?Rc{o&D8gd;1sM~FA|%hY2a}3HMR>(Q4hAqq#EeEUu7X*O*-^}iVs#X2 zqL>@SyeO6@x1ArwM^Stn#R5?lMseY9%c7)r$4&Fn@M1BSMzKW5CsBMFMgBj{hU9CO zp1qE;O!UtLw?8&ZWLhESO73VOt2h{;MDb&kFHynw;@TL+4?-Bg$M)Apu_4NjqnTH_?`$#iWZD$PW{IgkGe<)CDT-~$ zt$r4=HHv3alkHLL5M^%>g^BUMaa423jU!teJEPbY#j+Sai(z*Zd${Xkm>k0&QT)l8 zl(CPEVQ&=sq9_?dsTlT0aez5T@lO;7qc{}BX$dq&ki ziknH!oSANm$@sfMs5}&MFN(jTxE}>w6d#C~sL!KhK*nCJM5PnLUQom|2ZPO>&5+BqJR{*vwop zB-Ft#s2G=S7Rs=L(v$DNukV#i9KIj zB1xEShVT-}+%kozf~;ie7|O)ZE{66oycR>*7@EY;G=_39l#ii)3~$6xA%==EREwdy zY*i_S%E`@{e-+^*Rg+>3A$4NBb=*-?crC%&f{B*CF5bG*_Ijcxx{=;D#e6G<1~D}J zf38L`G*0HgnlI>UwvMS;3@wv-b0IAR8~u^Lm5|m+vrP1IydA?kB6bq& z!YT<#^j_B(y2a2vh8{8WNp9OShTg(^C6#4;t%&9_K#se(wk^n0td!0M)W~3 z431$)3`1jJTi93ciatDs5kiK={+m-H#T+G=7+0f(9~)DE4S7#E2{Rcde0)-wAmn|) zi84YMHYH~MXXMw|T`_zR!_*k2#mqA&yu)*P3?B-oIjx74?~$0nk#I|$DL6~eDY&O} zPInBR7_=Dl7-q*XCuW`!TsFYrWu9#vz8L&51Y!ur5Q!lgL!(=&5kn}(_nDhNpyLel z4@R>W{MhHEjbjNx-OJcjStIWc?@ z!}$Hmw}Pt$*T%3$$d`ijeig&<@>UY2uSHxZ_>CZ4pH;TsovQp0!+Ng3Ea;ZHA%>08 zy5C~B`&*$+F>H%rdkmXn*b>8!G5i$6&oOM3m}}pq&xhcWZmX<>2Y23NTlZpCn$yR5jvbWg|~!M_CWa{aum z()G8P_XQsaQe6L*`iL{Pj^l9*Phxl)!!y?ExsoMr;y=PIaXgRV1=oKu{}o(TMPUF_ z&D*L~g2@x&C+}yb#DO@<#PM1jwzzp9nifaSIPAhx1u15aBZqKB&>@&s!u$|$t~heX zQ7mr0f{D-gx4h`!Mf^N*ikSMs!fq@cM@Aea;^sMg-X2NJj6;p1WZZmXNvSyax{}g@G#|9E&TVfg8%Mb~ zrp57L9OdJv5J%5Adc{#Oj!JPfkE2B#mE))qN253f-&U)}Q7w*cZS8NyQ9X_tal9T! zU7r7mqgEWXgagHVoWWJH~NnU9L_^lbjiLiJOUDa&Fj7Ht#OjBaSa_s}y_3 z(I<`}Y(gA;KXXqNAT=)jy5_Lf(#JU>t+UesanKCSn;c<+Jo9C=X#xYjND8bQ!)W^i}UXnN6ltE=mgEWV(Oo-$CIIb2^ z)!_vn<;^;g<;HO<)jBzj58{{_#}p2X-3k+5tVEqv%D&tDhd4cs8F4I+V?`V@xFAjekkvO94_S~_K8~BWH7@2{h~pF4@R=0UMIJ4gu;u@l`VJ^3s_*|~Sw2ZN*<@LounS8` zkRnn<1*D4KnFqJp4;Qrwi8OeQmv&_P86DT=5F2#RzN1f+vX@BROo zyZ`;3-#PDm&gb5D-<$XDyYEfOn~5_e#2vn?rY6nseaR?VDbg2N@?6vEba1so!0QKUrr4zeljA5PJ)8CXBOT{8fm3h3FPW_b~Ps z;y@vC!zdlb--S3>h!SCBQlIZT#MmpuDOr~e7ve}EjuzsWEK0}OfFhFcon)w#bq6bF z{9A~BgmX_$k%olJ=IKIQC`4*^_SaR)p5f3`DSNgM=VVSv3JK1O-u5R2Zg3HsVQ(%aj?}7;-B6P0P9a8aDCr2p83sjWU8hE~H-Th? zZBLSy3}fy}ACoT(6myplcNiWaSz&m?c;$5PgVRA`k$tvg`2_=lIfA9aSS1yf38QQn zHNv<%jB;U=52JDz1z{vV;!C)w6h_7IRe8RsKoYh;Ad@FZk{?FmbdcoYv)P;@4VG4| z5=PZ9YWqER-za}`a@A_Ws|yCh_~vvlB;DB~<6AR~S`-7W_B05iP8j!x@jw{&gzY`I z^~3nBo3m~h=9p}zd&8&~M(zR^zth5pJPo8^!!Yg>A~#^bX_MFrEwJ z=;Q7e!svX>@q8G4*qx8E$@#P@bBdEU=?#0hUJQfylHki>l**`1v47a!WBdwx5k~cK zuIw|xp~rmuaNK|}rg!%b4CA#h{@7i8P#A;5cs|3)f0BJYjOJ(T`8XtuH`vrOL0->~ zhp%xYFf5GWVSEtA_%Pl&oIN6p!%w)!g)uS9|5g}phw)ArBf}UK#ux^681IHLTJUBh zn~8NYkx!dzZXyvKUp&wihcnUFnWX!e9KJ`CG`r!s>zhcSs2j`Dpb0q{{6ABXV? zdso-VKq_A{I5~_@8N(%mX9Acad${2a!b zFrs0^!uWyV!B7uF<($_NRo*?#Y z&x)}9KXFukC-r|X$OEksa{5g0(R}}poNL2;Kk;yJd&zqA#q5`sR{bT6wP9=tV{6#{ zXWn&TYz*7i%%F4P%4w>319yS@5?oeh*_4BT8JiS&;g>>p|CS<$ z1P_Xar4Dn9L_-6LM=ADoFr5(Pzk(;j_=nYw%%njP{wMlVVVn-*g|k6dUoVll=fXH2 zM#~6VMeN0ppLV|x#>Fr$g>jkj7QtN+TnXc97`MZ?!x`#wP4D5k7RL23QmeBax%T^^ zH#oUE`fdu|;&|1w-w$;}?4RngBk)Jyj36U|5)ouZkQIS9f|3y+0(XQz>r@{lEpZj| zaJQ>yLE?BFKr@bFEB-f76*=N-$S&)l3gHrFoP= z*(9_n8$mfSCa>_Cqe27~BM3!MBZ9mLo@|g^5JBVJ)hi$M)8JAzrJt6zS0oe1t><0EJo zLGD}Gbp`81aIcVd$6Zv`7f!+}xBDV!6v2bVn)@SQdO*aDXM?BD25H9BIAUMskvtT! z-%7aojN4Rv&3IgXMpBS}-r7R4CUx+)j-X8hqat`Wf`=n$8{w;kcrIe!a6J-1=LjAX z-i|)`JG*@Z9U|x`{K?)=dnFxI6>;5B{H+KM%=W!4_)Y{Pg;2x&9-|`|6T$2V z=0q@7oHH$g=@E>J;5`QX{OtE5_$Y#pBlsYK@pQ|%-~_>mf*%Uf50i=s4L*rras;2U zZ7(?gm!^og?p*d~5lk)4+I}vZ1~Ve~JOVQUD}urZ!Vzc@^k|wLi6F{(&8QgUib>mw zu=Qa3=TTMk%!&)?z6ptl{a9WXOh#Y`dH-CH%I5p3ry`ip&BYJs<&1WvrM8)z#XY@D zvm(%CH0MSzFM{tQSjEN!vgb#z<=5=57-l_O3j`Mmei6Z!LcSj0W7Z;0iWAH$T ztJO(1Mes)iE2H=>ip}gAXF(KCM6or3ZJe!9JP^h92zGGIjNobnJ0sW?!O;kgMX)=9 zKO^?`=_3*QzZmv#E_~7>kr-Yng+*U4e_NM#n!jh*WSUSkf zT&CA6mmo4LE6>f(39`-$5nPPmQUqW0a!l&uX1dJr5`Ha$>s&db$dBR%o58g`ii{|3 zaeDg8@&7D1vu+E&BS@tqihIuoNlHYK8AWy!{wPXDfhe+~_A<`oio#vYd;VL38jpxa zZ&mb0;S*li!M=fg;CwI;MNSlDq9_}+KVMKvuyho;LM{!pzcNw8%SpkzqNor>`6vpX zvm>MkD;A5??C`q6&AgSOs1`-_C@M=m1%g!ss|vDOR?fG0f>G3rqE-~oo)3nis8QVV zyM<86I%`L9PZV{ds3Xd!PuqvSS9tv>8bnb~_=xkt)cIgT;rB(+NXVA+!8_-JbuR>a zUyv1&9;@eT5k*TOjRl)T(NqYt9um?lisr?d(p7w|qG%n(%DvfLqG%JfKf%{2iq26y z97S6Z9}(;z*e;6pLTI+KjlW|te^kiF7lLCB`5t3p~iiMIjFN*n5>}={RDqDoCiWL?eaoDTwucBDQ_SbWBxwf~*N3l4H zZ=zTd#WL2@-n}%6OTYTQjoPn`^CEwZ?D^pqpyi^caz)hEXWZ-lK8jTw^cV)k@Iw@< zx#q-BFNPnZ_=%GuhCmEIN3kXfXABuJ{1U}luHjK^iQ1bn)}j+5CD-qw+$8vi;HOSMv$jUDjY~unCpaUb*b&A4C=Ntnbj#Wq#V#S_OqImA_l92GdqUN7)r+M^#L)sWAF%f#qd)NCzV+udIc#?8JF!V z=5^a;Z@UomUJT~MP%4JIVyF;9ZVaVk_Pi?}!^!ZsC+S4HHK<29hY`4#S|7lRMRFtWO*F_rXZ3~$UU{bv{V%?@sEHD5K~(VR_< zfuDMNIA)&{2MzYMjMR97Lx7iF*@vBjXuPsGqIhVC)+U=g+?hNoia#R({t z|Bp~4f4W#t@yP=JvoZANLAm)ShUa7G!`{8>>nr#|3@^s8|E7bQmv~T7?z$LcqNbmS zB-Gz|Bm0#YUX_Lo5WIOYI4}kx8~J(+gJYP(qr@+;;rkd?F}h+{5W~V4zKG!)y1j>+FUx!x!=jk|)(_KHLii~~ z@~>l9{C~tH^mz>5#_Z29E{|b_WG#!?-(95f%HkTnE7nlStRG@n&6tVd0K<$+N(`H0 z*b+mn`uI79wK1%VVNJ~5w#W1fThhcyvOb1i8S^px9>WI7-6%!uy?pg;W14L$F7<~H zYW|hntubt>;oHW^+s*y;r6BqC7t+XVlLVV@{n z2eYYUx-OOc%{6V5?;wkh%3eLxbmY6v&9xXlnHylb#g0FRS^FI?oj~*q ze)-DlP@q2;__U^{gn~>3*$Vs$N-F5+_GSq}ky`)-tuF`Nf+QXx!}hzoT@HE`_!P`c z2WDIj5(5fy6qHj?UcunA-so18k{WUaODia&psesFUuSaie(|^cVqm>8`G4&8H@$&Q zj|3_z$W!ouf(I4kE2yO4ZUr?JR8~-+poW4v|G4jcqM+NNZ!74b zpr?Wt6}+UNmx3o1^j7e!f~OQbdOLsemEg?h^PX1lbWQIwf;=4gOZ)Jgg69={nCqQ+ z#a^*DTnYA3@Pc@WoSK&v^i|MLL4SJwO3-!HRwGa!K~LsLqhQl1#fcn8|DmGP*JKHD#xOJm=G$NJ3?%lTn)aXU?iKTU?L~T zP5&qb?2RJV1a_!9FD8OO80nu z*Mb+W2InZ4%f;lX&F3lHG3Y0GVt?S9Zh>R&{Dle*J?QyD!IuiYlEy3&{93`f1@?ee zz7`}|qF||lUlgoW@U4Pn3YIHaq2Rk;^SXcS-@iNX;OW3hgueR~ouk9zA|_r7s0xI@8C1)EiDQL#(G zZq8X152^T5!5*%DDxhMog1;1;r>_+3Q?OsbF$KpJ9H2iLX8+-kf=Snc_rD%sj}CH- zuG#*nv%dUc1xMJsBVMMXLi+saIHBOAf`1hJ%jNwJraw|;@wH&;e(#!V!NG_9|M9rj zf~ORm=E|?&tb%h27B#QJv}||g(%qT=;}^O3E4Z!T4n3dDysY4+f?GTbuIMA!A;sJi)7;wt(b!|dBxA5Y75sF>Fx;8Zbnpg(ZTJG5pXLq+&k|NU3; zN~j=a3VvSNhz(OwMMYH=qh0QLDypgYtw*4YH&E($R&^CY6(JQhRMb)V%PH<=^HkJQ zQCmfy>p@uXUiqAMGDtfDUR>iw?vWn+adsTc<#Y-xlS1}>O(?`V%LL4hftm;yN znwM4dRWU@x8!Gy#=&xd+iq}-UqT*E*1LRme%X%9A9T>ZyB1ysD_QcuytACJ+*HsMW zjQiDpw=|}~EH};mSnhvQ#ZVP*(cvnFsTi(e1jl`rgITPh$gI&x(xP#mLTEQ2KG{#eC074NC|P{r4Oc;8p?fr{}eo~Y!hINuqssg<$k1sHq?K@&K|MTWFb=oKV@)k@lZKU#dH-jRD4cn-U#kp;a^Pm z=D9w9G_ca)`pj2l&;@sdBc)=YiZ4{eR48<^3PXj;L#UWDAyZfFTLVqS`WwN&!u~;b zDkfAA%jM@C5J#CREENk>`$BHXO!v4I?i6E2#Y`2G`{&M6!R2?BirFI0Q88Bt{m|w{ z77a+|i%s=2nY8?HkN@V4;Fl`CQn6aak17_?OZ2CTZy36*T#UeqO+7#FckgPRyF^9Z zo5AHOmU0Pgp8KsJ$uh1FH-jWARIF67zjWSrDpm<0|DF+kGf47-XnG6(NyX19HmUeS z#Txd7JQOf zHBiN66=zj^TRCv+AgrAQ=Tw|maet0tJ?l`jI@W$bZuw`o!@<9QVXgH;%{R=n}`hany^WSscyds2@jzI39@O zK^{8b;k6T=5;TnC)UDusaWoP_e!mdM?O@|Ls@)DYWu3Q!P2zAZaJRf|_xIeMyociG zcG`b5?rsrB%Q!m5@hDprN3xykkvK}a0>f_yTgTBRj)$eo6x$XP*3gbV--h;rBprls z6JYBV?oPaIe9gb$lz06)f9E)e({Bg6#_@O@z2bP1ZsDQh=pIK8mRjj|SIs?ssDNfY z+40)mi8Wm}+t?q0nRz?-R2)yo@k|`OlaSVy0UmX48cqNWk#W?4V?TSb51hq%X4xs1n z1hejT4UFS8$<+osw_eX16vyi#lJhfeZ^ZFt9B;+(cAOVWuAy<<-Wgcy@R1J_&2YgH zf-~*}8`Ljbt68Ae5pS)Ao>6hU8^?q=K8#~@9Ant>IL5~@Hjba~1phjmwep0wLuL24 zIEe2Fz8}YnjXe}|xB1Iv(R?09Xs(ks5fKXo!-B(p&!j$DY@o!Uias8P z7Dplu8kE`RE-GGxv`@xih?yCOB{ozt(KsE)Ov#!R$9y5P1?R*uH;#G2X<1Yi?H9zc zFpe)ozew=QVw7~#Ty6{K>5kd1=B3H~0(ra1l( z{?lw{5)PWp-+`?x?(&|GV;dK!ICjLbGmgD+{1wM8&Xf+Wn8URvj@@zm$+hL@05#`s z+c;r|lbU^T?2qH`I1a{ffCd#koA_cvY1g1C_V0$nHwF&HaV(DGaU7=QO@D67oFj1@ z<-*u9hlw^P;y4+{zkJ{mN6iwhf8rQ*#Qq;fra{M@r`W1PfzxrEVW0*a@4_|nbNgEQ zESGCG@<>*P`kw9o<~@DWe<6-ivmNZqMb7R_pCjP8A`gy~1k?ns#&Io<>s@q6q9)$`pao3uYu(HG$*m5hCB@+4K+06YpA55vW5Z;Yv#MTjF&6#I<~N4 z70tfItEz!F>|NzpB-KQ$t|2Idn)KAb-5P3YxK~3x4THpTLd0E5Lv0P$YkTTwxJSq* zV|^6sYA7Pt>y6_DDLkA5{X!cciv!@F>YN)@;-ATiv9NbE-N|jy2&Ke%m&_%MC+f~T;6M5v1 zYbYY!G^{=C?k-5ugCyb{pKv~@;VBKzYv`llX${Y4=&j*d4XPv5>wFhIj74ex3gsNppYZ)zCI5z+9vhQU1IHW>f8dE@h2<-i3;=zzD<5Djl=$aaPr zIzz-^8cGlJ57#h)Wy|GonBHOy@d7>yd+=(-2X+SD=Fsd6ydyYLkP$dq!x#-8Y4}*f zSPkPe9Pgg{p2Xhv!*;Ku6KZ8af@%nke|8AjN6U&?Mn0XNck_8YYYL z&9)xid=0ss^`+l6e4hU^4O2B(8d4gj(GMCFx>3Un4WDa>aY7CD|6Rf}eng;ztXTs!`B)XYdG|9pm9cM);TXv+y~FNztM2umnyv7=>Bq` zTBH1LH7w&KO`viD%QdXfa9+a&4J#SI8n$WJuHkzPtJqo%e`xqY!)nf^Z13+He$?<2 z<50so4M)#-pWEx`l@a=xQzj#{M#C>c$l1c_q1-Ed1M9goY1p7)BUhFCyuZ=0Yn-l7 zfIPg$S%foR^*{QTe=}#_Veb|VTNy1Gq3IbR{yg{X-|l~F*GZ9>778jL;$RBnjI|&0!6m z5;i}kVf|Wv&MY^(c3i^=4RuR|P8PXc!#^Ad(a@5KS*JCe(QsD7ISq6E_CH)AG+uZ2 z91`eWJ!j1$Zk~)5H}zc9a7lwV0bc@_xr}fbPauOUzlLiX?r>pG;JStzJamarr;&jw zHM|q`EibOQMa%=^t>CV{e2s$v4+Fa6~bxQk`~$|5f>n$o{ID+r;6JWq_vWZM4hdo!!! zg{*=EswD7g0s|7Lnn1M#+9%K`hnbN9Id_b0ILxSLn?jun+2NZ`Q)8Z$S6 zhZ1~4#D1*t<9sJcQ)xU&Gtn1iF%DZM&?KwiD)~Y@&@q8W6L>y>J_&S6pmPE}6X=z|V+s4oUXKLyH*&iq&^3X_6WEX$ z>Lz7Lo+u{WiwPUar_)AL&xYSU|7M1s6#Y{PJk8K58G0sxXA}IaiobUPOw`nwnnm$B zQMUDYhOYF#kid%xyhO(?aPyw7!DjsD_q;6i^ksVzs9!Ra=xBSRe*)CJk^n_22PW`Z z0`Dd;I)On6yq>_&1coIrn4y)x8wtFbuva#oab9SjV?SA1iE522^e-7wONNFgFd~8H zay_FG_D@uA(UXT!d8MBxskgcQG;_TpI8u;1$3{2InOHS2CV{aDOiAF=1jZ%sUIKqy z@aOtnpH%e>?3Mq10v{wWK7k1de9Z17@L>WI6Zj~Bb2q#bUc%ZNUZzPbb-onIGbJ*J z-;@k}zsEZ{fn^^ADtr(iewM)01fq<8R@K%uErA(yQCZh?RyfSQeW<|C5+v-G-3kT6 z2}BrIJIYYgJ?tTFSm5S)t>4T_2iv&f31|s;bY$rWHFqTvNGC9p{&#ux1d@#HLv}Jm zV+vXcq!RXJA#HfLSqaQe;8#XM0v88i4kus&^EpXpJLZZ#l?yoE8wI{jU~vKqg;V?@ zfiH!BCAdg%>s%+ZzDZyS`?wXqh;pg$?-Tfzeh|&_1Xc>6@rvSt-w9zUR`Gv_X!aKC{}i%^bFFuPMVS8LlrPTxyJpUT z|M3J47V|?w4l}9|Vv(Z>982K1DE~>|Um+(1PjXHzaMI>K5zjKx5;!INv>>z22>G%> z0r`23U;>v!b0L8-t23!&x-6Qj30x5}QI1RfH4)eCEV!9Ktumexx{bGlliU_^N6;Zz zPQeTv7vB!hAX7w=k~&b#T|(SCXvQqB4xesEqdSRg9ey1j>X@h_pd&{|ZynF-D5WD; z$AdZ=>nN?GjE*Wgs_H1KqnwV)Itp}Tc69NPRCyg69w~d5jtV-yLa3sSJRSKu4j@Fa zNK;7%_2g8h+IS}(c6X1v`Qt@39o2Q*uj2t7K~5H?jsAiOc{Oz0t)rff`Z{W|%{uPU zQCCN89c@c`>IhCQ=^>1jH_fM}k&YsgaVdZ3 zZt#L__ziCp9Zhv~)bXf}hjcX4G4gJA2OZ6IT=uvYP0nkrBNEJMp`#_Ma)nyyXyLL? zZS6~V+vs>$$Dlv_ZFM}Nqn*w>Qzu1Ysf{*i&pvMUllX7uUCa-3($Sf%(($+st$LNm zbWCpIaXIn_xI$fY5KUKT@R5Q)U7@;vxu4L{O-FYfXI!BkI(q4NQg~0ns_k7*33*z_ zGaR7yF8*T(FW_lR{CTARIUUdI7^3419es4XprfCT{yJXN@sf_0b@bKoWp(f7efe4L zP*r!xvnc;bcj*34{d_L{ijG&=9vuVOJ9miBlz5R}{+IHv>8NqmTjQ&;OWdKwF4rJ7 zX+X~Ff`bJw<>kMrW2lbNI>zW2rrYP-;W|c;oOPdcha7*FZL`~b=U&fS^z;1kZ|iu6 zM8_x*-xZ|(%jzyBlCe6*=@_qLf{yoe>^Or{N3$4yB=6HdZ#X_+pzd{0tk}-QABNsN z>17~I((#dwO*;P2@v)9ibfk66q_=fU;b`iJ>ilwo|5F{G>6l9K3|8+(h9^|Z6Pl)j z8xN-In4$BUs({P*=Q;{?ghix=q=hF$64RmRFgRHXyecc%ikCg1@8;yhIk-9!qMA0@r6#d5KF5tMzX>vCIi@pA+>OZ67EZwN%yp9VxE^!Uv z`mE#NE=P+!HeQ()VEck6D$nLe&}sZs@qFqeK#!Ni=s-E!a3aa+e7 zuIk6!jwJYij3hF)6fr|MN&HCG_Is){$_ll;U9lvUNj#MmdNV8JO4@@+;z=U04OxOD z-XwfH1&HVuER{r{I5$VgKn+Wg z5Sbnj{ex19SxtmA6?{mLHqE3SlKX4Bc{kTGiB?IpPNGc`-Poz$ybmXF^JHfGBswI~ zRy2A1x&4IH8y$QlX+On%m19~qFd&J6NxYWiwifpry#hm$7?ea+M=r(JlNc;| zHg$Z&`9>1FKQ$SCNeoS5SQ6ySA}4t(iMQE21J4_HCy9}CU=p{I7?s4kNvud>WfG&4 z7?VU{65%AqCNVCF&ytv$#CvQ{5|ikbBz_+jICdzoC@b_q660CJAN~nRe8^VG$#-Is zkA*|@2v`>*w_0Rd7KIxyMw{k_2h$b;7iMdI{l2AA)lF-?Uy;~iyZt*}_s8iF zHs&)Y`D>p!r)_m7lSn1evPI6r59S(45KTc#(Cg)UkAZX&#F zB$g$yJc*0PD=bLjt0We2M7*JeNqiyX%Otk;t-?g**Ahib1PyO!aT4DYb9VMeZ)j=K z#%~3w={GBHzt0q2JSLY!9b3IQU=NyC~qLwz?Qo_>=%E(JKzhIHb5*RSXPi@ z$I89gA^yyIFxOMjK%Rko1C+X*%>a3Ufht0(3eIco zp|ZMxpn;HK?}NHqu!i9ByIj;1ZHTIEppJoN2AUhV$3R^JjSSpx;7+0<`*N>=wP(Eb z4AeL5mGhOO?gj?F^?Lf>U#TIRR4?;B1OB6aiVqlg&_GiI4;i@EEO_XAR{OdB#!{+@ zV16?5wO0Z)TUO%3(xX*eEey0Y(B41?1Fa0SHt>jnb{vlEP-04;4QtEG&8g#lnBJ@7 zZfoGsPYx1ZpayCO_~XmocXK-$_Lka54RkWF4uMB*`s>uat4(&Ovw_D9bYZ%Pu7({~ zJ+ecuWQQIX{)B;ULb@AxN{DS>pr`O&#hNFDFy5H^w1H|LDutPlod9|JEKm|);T z1AON5qJf3yy_{$-vCD>i_1o9L+gy+h^fS<3G_ME_Ht?zt+6*u-Q21*cVgn2IIH_cM zU6ggd4Gb~xhVVBH3^OpCM;GzE>`;;A2oc{hp#E5anxyDQ8W>e%Cit#_u|jAt+Q67% zK4(FInsLR)ec!+b2F4fX7PTR7jdP-b<=gn38Fz+>Nd`VL@UekU4D2@Wr-8`^rWlyd zN(_8z;4=dW1G<5!2BsMZ8;BT~ZeWIi&kYnBxN^$LJs!^)&K1iu&#ZM0Gn~Y-D>9=7 zVg?j;L}G@@mD!%a}3Ors^$v*bEklZpxJ%%oC^(nVc;hNKO6Ycz*h`- z1Ir97GVry5ZwxGvB8z$4tA1AQ^M?lC46rO~Sjss*&)HD1w^c7Uu)@F(Tow$hH1M5) z?+vVyvTt6ozff_hg1y6}dIP^2IBGcg)QdGVnp?oKzljrmH*j)!=4v@aJ->Y}*vvJ@z%~Qh4Q!PLuoN3i zeCn#71F^%vP6NB7=9-uMW#-x5V0w2>!5#y94V*G?+Q451_8B;09~b*M#M51e1P|EW zwnazZ62yZ%%Dw;z(_zsYUgt3b#|``=BA)}C5OR`EKI@=J%Q2HPi2oW`lkfOXaWk=Gr+2f^fyI++rX{= zV{k_}%Q{S~eb(bN?Y@jWTC)Es`$wXZCioxZjV&~>;4dD`c-FOYJ?jrmxt#T=iB6_nPiGU439+Ns zADZqDburPEl?$(bBdeQ$P)~Zy#7o-(PYSXI@-6AS zXH4`q@vMmz{?MKM?!Ep{xhAgD{?NX>+&(5=;Cg7{BNH#Ol!;*`hO+@C(&KY`<_3nE z=xd^%iT);DF)>)$_Ns}EZ56a@0tIU#qaSRj<`QFG1bI0`k#~Nn7h!#3=^LV|L{8}HP6qn6G>Q< zLl4T{|C^X?A{+=Y z%{2L)6FWSZiZmqDP(P1OGqK3T*Q~Z;?gA6r0-;VjJPYZK1Ng$kuI>2J#8;eg((Be= zxv!S@B&+1{+GDYatK)L{qyObVXem8u;=G9qCYCXDP3&eP88aqUnpkh*R}sk;I{n)u1Y&nCEwl4&j1lhJ`SCVmkOIa|I? z`m%MIea6|qSYlJR*uSCw#sI$H-E3luiQnmvnx5I`{F~^9bN)XBsoBa7@`xt*w1kgG zwsX98Id-sN@)V`$`N=NHrJgo>Ozbsr!o*1vf0@`vdlQFEEFNp`)@X1fZ$I01IO~Am z-zE+Up=QJhuv164&Xn=+hyJ4`j!Cl{=Y)=%U?O4rdC&WgiGNM}$544GaCk%D6eny> z==^qn-sias{>VRV;*5#2Cdil9$Uj$1Ue5_#WNe$ru~5pwWfNCSWLPL+;i`#iCaS%c z>$I?czkgy*=(>p;CT?=Ex`f>=Jhz41;(8KrFx}x`weT=GEdE&RCfQXd@BG%hObaC~ z%&e3fu<%OC4GWXzyHDnXTo&9GJQlJn_$*{w@LD+Zg`cT}>YSew`Y9(=#IHo0ehWKt zLW|Ub(>($_P2^fAZK0Nh+7`-KC~KjTg~}FgmvWV}(EU)LO{q|M3wJTMRH%Z5Jj)K+ ziXxIw$&_C#7Feia;hj>UV`T$XEmX7YowqeDRJRbc?6dIQ7D7@(4H2nfB}^nt%qnpD zBKsYaN`sxrdzPEveb)`Z%xuHfD zo=H3SQby6M8D~#qJs<@i6l{?jVkJ#2JjBNALJJFLFL;{?Hn%Xu?WXw9S#(ykOx)I@z*s+_=l@C5Fe0ynkco{=3@~*vGD8HL29O0_|(E@e1<83cQiLtM7HMI^L>Ve z&n*;M_J}m8VxO3fIs<$@AGV+!3`8t^d$)%vDkLU&_epo0xfXt7H!URC7YmCld~G3V z!LTsP!fXqs1&j8z12Z}3b@R`*@r-&QH)SFGi$5(bA&H#lcDRajEX-xhaB7$L%wv$u z&THm$eQ9C7g#{KayqhsF=vhclN~t!z%Te64-+q5&>fIi`>$JCi?qUnySoqPxPZpL~ zSZd)13#%B&V^OlRx&lV2+>HNjQS_^9|)U4y>^O?FAv5tW^)8DV0XKaCIJsr;2w(PClOdGj& zRj>&Ym76U5!AdOrZDF&8Ef)T?u!oBP=ZG(JmxbLHwsC4N&$*Tx+HQfkLvW{s@})x* zJCzP`+YCRGvbMZuuZ6!X?BjCECjIB`Q#$l^>Cn+8l|DLMq2p3N-vt=cyWBypffkNf zIBLP!#KYHf4qIRrf6m~`U&j~~H9h~ZzwFUA|8ZVU@9>-uJjwC8kjYf*g!?~6UFncj zI&_MQkA*Xw{`;I~Ei|v5!_;PAz0rSh#877MI@?%A|1H!X2*RDP*PKNMYV~JCzjT6wDATA()x6_i)kxB9gd-xKlU{ z2SsnOK9GV>cy_VIUu=^jno@$fDf_yDX%8G_Qz(~0)fB3wP@V@$p-RfuJH4(7DdeY6 zDTRtsikiF>4$BdF(8?)LL&8)bMOY#EZaAu^5KN(F3bo`w)P#!LQ$xtz#q}_&s8nsK zp-##!&LiHNLcJ8m&cV1jsGmZE6yN>Cl$mIl!hI>k(ooW9l*0WftWV+B6dp+7!4&$Y z&@Y9?DKtr8{3`THVc}Ls_3zL$g@;mTmO}Fs9+RvVDNx@wg-23oDV$=f6j~SaHbNd2 zy!C@!NxKv}h}d2*yw+ASbrkVY!A>c377{DY?UF**6do7l6Df2Pa(#eYx@mvbebGV~kCWoAGY3&FB=y6!Wn{#tFVB*m||y;1AeZX)yT& z(SMkNcdKL3n;GoIq!d09<;N*}!q`Y*N(%E+SdhY}DSVc~%oOVUjHxM1OF>N`p2GAL zKWmv$m_k?z&Pd^NAuCFUc!&sxN%h9)fdP)FSW?L>Me1P|YtvFlNRf03dJ4%D%oMB? z3{lel><^AxHC-gBl%4*kFH$mhRtmFIm?OuUo8rFx3^s|CGtDbL=)x4fNa2SRR;Tc# z)Vw%_Z&LV5_@WfP7DC_lA7DFbNeW9-Sdqd?(SMu5vJ{r5?8Y#csoxZv{QO47cPV@? zHmd~J6=wAQo*$sjU{;akkD~uY@F&5a1=k3+`N^(rt?+e48Y^Q%3LCk4q){!6-%|LU zD_aV8QrN^P`L*|t6gG1>{`TB>#<3-Ztto6zVMhu(D`%Zbczca^Z%f%%gCsk-P^54< z1@}7aPT|iKj;3&oYl3M07ThcNm*76Z{elMsS#VeB(7|GUh%1cnBgGo`@Zj-cekO$z zDV$8!v6w)w_`-(M< zgxoLqfZ&sz(O5_mK_07V8mnX+o2Sttjpx(oBUvre=qjXD8m)!25qwneVZpX(JR*ek zv`eGC@D9bAjzStQ@-VlP@Xl#GR-D@<4F(3Y9#7*5QFar2Qm}g(J&G-R3h719|KO$l zQzAYs_>5q0L1sOh#&g2kUdyG(^g(s;GlX0zW8 z*8w74^t%V8@p>9lL>!#PkTgCN{ze*arZFasv1tqy&4@JKN@E!HB^;a`!`a8VcAMW$ z;~g;=orbm9o;4#y93}X!AeD7mR420FIMKYH#s@;)OWR6jF^w0^|0C-=prk0;Xoo>A zvn(jGyF?RVC5WPeN)9R@h=QP!Q4l4FO2&YQAS#j(5JB=z=$W3>lNKZg$w^QY6#+3J zDx#tY%Da8X_Wkd?bL!l4>waH-Rb5?O)1kWOHAl(nuNUDB4qYeCTSb^E&SqpwO;eM| zXB1(kOtXqG*YTe%GDmnJU6O8Zi_a6zF9JKku6jM*DZ;hA?P+sS5f&FA&ub6<_lmHj z2wRGRIwqbyn>t>E6Gb>F$P_`(>c!4;=gjhaOBJLuOeLJ{8@xQl>L(tRF?i1r2MeO4t1#rmzDin_|N~C zXmxo}LXqjrRMLwpyeQ?=o8tu>UfK(f?dWt7cz#Bz@3l_FOO%X@LPqgU|$dxntj zMS&L;y{P2H7%#?pQQ3(Un%wC-D}7_-*70J+Q?=@PQO}E;yr}O5Pe_<<_VQ7< zeR9IIVXgaCuYHnmyO77`Z6deK@-!5wnQvd$-|59&UgU4Ya4#Br(Zq|Vz4m!UQ!kpy z?I|ysd(ncTvMs%6LQ4v|=NHb&FYN5apnC3Teqk5sd(~h*P-f(AQXcl=5fLiw z=alL0MGr4}deMub7gJB7w-`D6+|m&5lxMWvQ*=+l22maWU=iVy72J9G_iY91`E{ z#U3yAda=)o1CDjS7oG31Yhl{EqSQg@AA0fK@B%7XJS_1eFFqC-9&yw3iTI~p9QEQe z@ngczg^(96;5??PW6`YHRA505$e6C#fb`wIsM`|Ps!>_8u$ zRF>Qby9YUZu*eV}Ol{*Zc9fJ?h0h9K^5HojhKrBzVXO$_jPzlY!$*sZ5gy&iC4Y9M z&kJ7=GW#Nf&$kbGrtuPA_F;m^E5eDwP2FvWN#Z1veRxfLitu$uf5V3n+UcC(r~2@g z57T^@?!ycp7W$AgqYQ68%;Z=q$|ZTxmpekE8%M`WIGz7Gpr z_AlVfg2FIgmpqAr8lHE3SmeWE#f%6U{5>C*_^{N6Wj-wTA?WBUd?@n4tL#eQDj!-E z)MODRpOk>mFEk1Y4G~&TcPtxnxG54A9{jOJ)Q6Z4ab;6Jq=W)69`NCy$cMsn z1%-5D+ARN%efV5Dl_Mgb`0%L@&ssT0g`cshOWhOY+|bIoYpMH7ACCL*jSt_-|AY@G zIYNB=XARe(c+M#f*F?@zE9a{>+ygFpzV?AgQ6h)dAEcaN zkT=}fw!N$BewKdLhhI3kRkWLZ&WB%p_)U5issG`_pPbhGxXF(TKK$jwKR#Ucfu|*P zCVMXW>|0@%gntW}oj$@{@ugBOKd$%l+#|PyA8tQN`f-IHSNd_4AEo@*v$aN!A8$QS zKmtEXOYsP)q=%O(BWtdZZe>Nv36CAE&?e?C??+W-ulA#YA9;S{`%%en9|Z+YsfvEk zlf@~LRF<`hFe_G*=QWQ1wSHXZ@Tt#x*!Ua#sP0D%KWb`QsN5)0%a1}ow&vMBt=@3g z7O&$db^V}7Ykfa%_MF08BPYXYI zL#%Z>PeFmFm7nJi1EuUyKkoCR16wl1 z^H{~g-)DFxEY9bBut6_)I{Ihi=U+XRM%YI4`eh3AF2&} zTF53nKiKswTkA*0k77TD`!T|gcm4KlnUQ{s@?*LmGyE9s#~6uk2*>*Ik{{#!7^m#> z!WV=r_#)dmt$>8-Wj|i=W1>tGgs#=@S4CbEP7+RbOe``*oaA*s55?NHyzNNgcVxeEzfMb0`x4eSNhJ>acuS<+N zJ_(VSFfOz>_>a38kSQr8B}@y)_rPin8$UkvaMOC#8Jl z$0^72Yd^jb|JG5a4Xt(Bj~_Va1kfgcGk*NYi7|kJ0Dki0XFvbH%zhQ_tRKJlanX-U zeqJ-$D+bT`@v9%dadIfiXFBi4@0|0u*x4-pA=9723&OvIyrD6Ai0f~^eP`pUfPLNi zj~|!)a0O5zfPQOHPDtVwDH*^OBBg{7mKJ)1Il?l++yKgo99{<|2Dwt%XI!oo^GmVD z@&UWvs{^PYk|(6ne7dV*0F?r`Ie=RNs2o6*0B&R_tjVn!z@e_F89=Q7?w{$Y7Qi(D zTpO@|INHu|T^GRh0o)Kk^#E#Ub0~77n6l)+5yxFpss4K zr&^wAWZ&(%N&LYz?)m{_Zxc1(!`}c}De`Rr+#bLk0o)nje;(yF4B+0u1tg6E=sVc; z?F{?O?XG}bMZK-|K5DE+HVL3<0L=nu9ze?gHs0d7SkK);rbYEjb~uLCYf)6cBvZo; z?&Y&xcL#7!07C<+-fKK8M2p@Fx z&LUj`c*s$@igXh`Fu?t20Nn!^5CCt3u%mi#qa5B-UDr$4Ti8dq@+GcawEZ6wk~|(j ze{q_aeZtWPiaaTN%JJb(!{7j>PVfv7e!ii?tEt>!0T9Or@C=>BKRlK5TmZuZ7!d&Z zDB(!q(TassMh7rP*|EYGgyV$I3wJNfc~RsgVWvZAmU>xy&TJPse_JQAAA+bD#H#^J z3Se>ouLV%gz)c3G1n_zQ9|iDn0B;2FW&p_mQfza;eq3b)cwSNFtpKJ4Fg<`70W1n& zaR4&|m=(bM02Tx=n;o0)8N0(ZFMv7XbA=S&<{sJMBFQ=|%J&#i_dBvK)F5H0cST0; zaE;vIdM|*L0hEg6(tnBEmIkmafaM&|Z@aT`R)}*1t_q+?WxW9eL@4@1{6Yq&LgXd{ zwILztrZ6mw2%`bS0*D7Nac!<8B_Yn@EK5uWkO^RyhHEhokN`%W$k`ddngHIHNS~Ky z7OV|ma{yZcHeVOOdJ*ysJT#oyV3R~1k6A+NR++X*|3J81xI;P}SQm%WZdJ4=fV~0i z6X&sWIDq})2OQ-fcfG?8iSYl_c=M2V5sw7$NdPATI2k~%n?0Wfu>D033GXN#IR?rY$Te`4f$|2*8YpLAO=I_!LOR#& z=O(gvmRzj}6@*miNmGG=ic+pOP{}}L1Jw*%Bc+Ogsv`eIV5w`RFzj{4zhN1NS*9Bd zRClcOtZCT0fT@;&ft_;;g*O_gEmB8VS4e9x=BjVtW&`UCtT%9rfd&R<8<=C@Rs**g zXl0b0ik>wM+)WMp z+?&qC7Hpw`e&s!UI9@iLyJJYfxr&8*zpBy3z}*J;Fny|ldkoymiVXX-zpa6G1_l^- z!a#ci_ZfJ^z@r8_&}!g81Dy@rZ=jO_-$B;{+)X+5t@y6b<~6z^|NXIf6)F{WG4POq zZU!DU?5Fm{59W0>xDqU{V4MAGIIv3|j~za~pUXd0G|+=>Gw_&!o(6gu=wqNSH)ltF zhi$pN4XkQf`9f!VuN{5Cv-MEk=@U7qlK;4Y{@igpT-SGUcfB&N<+EjYiG;HG0}VWB zV5EUj2A(o7$iOfI&lnhNV2FXC2A)>`Jo!Lgd}QA8Xdc79v^Dpt$MY{%%72zUW?;C1 z5eE3UKXWASff4q0G0nQ1mwCQyi@N!v4U94HqJftTj5RRM!1D%PVCVc@VREP3yvr3X zl<_PdkjD!RUaYa;cmppRm|)-)!(N$CE!T5PrNVRN@}C@#SJ|C^qG$d@1Fy25`A%_j z+kdiw*9`k|Z;FA}4ZQJXNnYi3u2i`H$$~f7uu6q*YPa&j=Pkp&Aev@ix&ijd3?=@i z0vBm;Z}Q5^Fu?T^#Rh`x5RN?qVFO7<=H?iP8b}zRb4+2URw^vp!xIw?Tj-vj~l`Z=N$%i@<a@U4OG4190kM*}~x|I2tz8~DM%8IGB89?zFGI0O7tsnAoIue}s-_Tc{NIn6VW zGrxgzJi3D@9kjdRR|A*TC%+k7{9xZw;0Qc#;17*$w(U;?7dT%{@wE6L_toDj{Kc{T zTZM}TF7enm@Q<=ovSiKsTvcgbt(OSG9Yjg-D}pE$1n*J2T%{(ropE>=vU#4M-RufM z+iqFfMH($pST1#!4jF4yO!4_nK;@LC}6AT|0<6BDI1j6uD7I(@%|Ebsc_75cM2>QxNqXesd7nb%PCp zxK-k9K{Rr#w+GQsJiES;G4D|J&LFrnj;ToyO@n9~L_6utf@tNGZ5~96puNzsrSN29 z7de+5ww6PiAnq2qM|iKWofajsmi9qB5X6H)+$X(*u%qyPA$>ZrQu%idqKibfhx$X} z-Gp6*tolQl9#yti5WR!wE>8a*B0Ytj6|hebPta$b-MxK9`UUZr2*t-m`U?jHF=M!W zRW(rACxdt@h(Y3`f*2jdVDTYBx(yY1I*4J8@=OrVia+Nl!$n32M+z%%ca3qZ&x?!| zjuWy0FF4j09p&X9CInF&#Ofek31VUp%Y#_KGkPZbL6{=+^akM*_XiOO z!U&@1R8COJig|AGkmJb}n_=;8TDlnvA|6C1mpz2IR?`Y1A?wh;JdX`=CB;+1v@j#g zHg8SPem>6hvBdX-SSzwFi1k5i2x4Op2c&EYVsj8Xg4h|vmLR;_a<>KXfyh?j#)B@3 z+vU7joVZJ-JwfaZV)y^J(Q{uA`{hhd&uo!{Qa%jgkem+-KVsERKyKraAU+A=Qyzw! z?NwO625~fq&w}_oh%bUTqb)k-Y}fZed?|ihc*4<72Jw~nDdE?S{*B1DL44;ZT?6*d z=xH8Vd?$jF+YA@G>qljO68;>-*&u!i;+(8>V|wAKT1+Ht@Ne8fBiz4h)6NV32;xr> zTDfSMziymenJxwKcM$(*QssjcrprMz51~Z}t`JIu;0~c=2$eUZPKf`AZQp>Z7(%5G zN`-(BN{8SHAwPtI5OP8&6SDVgxe#(gC>ye;g)XyPylL~zK^GHy@5&Ia3fXt1%7;)P zq}wt@`B#U~I_9RBC*}7oZf3b5v;Xw)jtWav4%v4Vt_|V35UPaucN?e{vN!pfknO`e zEt|i|X`Ww`p4W%$`z?hb+!(?QidJ1^YlKiUWZ%QtI@47vWZxO%T^(j?RkrVV*A8Lo z=mNHuwbTuvo{HQQ!tEh6455AqH-~Ub$i81hhg(G&gzTGCRBn?qbrxr~k+OG%aEGJc zDZ;ij7HQ(>O+}i8aALii#ao8#&hHaK-w;}{Lqcf7_Dg&ygnQV}+wIg*?+6z<`nw@45?|~n?}e~LyzVOd4*W9l<-!$?&q@v|-NW~W;0s|-5_^;IhY$#1 zc^oU^_DPpP9>IzTf+2)LFhdCQ7>~dcK_rAIkM1yD3nLanoX1xf)x)qtNYKr+pOPm- zNb$foQO-mdaA$$q1&5I*6gC*{)+j*5IPWK0(SOvvEb?3W=N=k5;Srw~Rh z$UPzaI)sxVUkOhMY29VHzX{=6Wxo@i4&i&py2Nt-5W*Q{4TApeUq_CY)B-%?7O@R;}~gv-jh zO#IptFzr$$Ot?kJOPaXC;iXKlkrbI&U5=yYnkXY)QSoVQ&>2^nxXQ#t6R(;mZ{lhb z514q+L#csS$|kCqsA{5`31+`&QS+^B z*wL&e6UlWZt~YUmiRvb%^mEaH;*?#eLFa9#X`+@&k#nGyZ*CVUbd)+K>YAu;;$|uJ zROBXMHVzLQ#=ONu0~5D8?YWI)Y{Bg&MhvZGhaFqMM1F^fJ5AhU;$9PXnP_aHrHNK@ zYht3AiRR)>oq}8UxteUqZK1Fv48_#iL>o1Ltu43MP33NrpDijRX=|dLiTmZ>KHJD` z=wRYL6WKl?vb7y$x_NyrQz!KaLv=RM#l%n(Pn&qiL{}4iO!PI;&BVhddYI^`Qp@hH z`G|=}O_1DGY_E6fuIg47)nMu+-rM9_?iw^Pv6uRpc+A8=6Hl6W+(ds9157L&SBovl zI&AD=dp@DE)R~?#F+|xxCI-uST$`FqS$`HBX5twWqfLxqUzKz{Yht*X_ne6z2G<&N zw~ZrAj8t|MP1@-c8DXr6aqKY@FFM=)yvk;Szhq*(i3uiNk@)iejG1}mJXxQ@d+d4s zLd%+yOw2Yh$HZh4uhG-Q>n3KH*xem(sQqu6m};W+69pG$y6rZYNZya>CZ@3s+M%N# zE6DZ(BhOSjXPMaAye5~l%{B2hcgom;fQfk~=9^eyVx@@%Cf+fz*u;A#y0@sg(8MA& zwfcmDcR9!>6mTSPz%$?y6H7&wnFx$6cyMJYnpoX(6Q64b5t&x0xX(n9iCJxGQt>(t zeiJ!Q+nvV78zzGC44E($meIJhDciRZ6HyZ}6LHQDCVn$vnMj!U$i&CoY7;5$%C

    rJdNaq_W(_npYT#|qY}LnyKV?Zy>s;3gZnn@nsJp~41i zHc@lC4rD(3HSq!WT|8%}$^V_iGn@gqm-o2NF0v03F6kuhQcMQi&0WyOKG^q~*k@wD zi327+)CMNT)tbG^c0Q=a92#2dkaUv6CWtg0G4Y9s(;Q$XJ~eUF#4!_Jn)pmbKId+V z*p+5??iU(Gljav3H*vzm_rjknP@s= z;zx;Rg{Sx6Cyu>f?#~L#EbIM6CQfwc7=M@DMcnG&Ib(-WGK}*k{xI>U{4aBc=Xf^p zmx+s42>5uDkuam>|LiSG$nHq(0M;JB3s1-(` zlv{*13Tq1)t&T|DFzSiiB&;vIIgDwo?5T;^K+3Jc+l16_52K;OpDHeSXBc;d@mLs- zhtW8UCNlL3qiGn;!sz07HW#@sj20p-!)PVaI*fZo+6eC!mRnWoo-l~4j;U=J?WB{p z7x_*rayx|4F^v1e=p^w0$LH`q*Mko497ekGzbktmlGrtjZecte#v_i;qhVy%qcVQ? zFnTz8PwpxGDD-xeJ|ca?=qJ)nE4^8&e;DJ!cs`5)VLTDWz%ZT+<5~GUB^)XoB&7df zks)Dlod&Z^PfHmV=89Q6%hXBR_*@vn9c4rqBON{}jL{As6UJEaM@QL{8`BHQP6*>g z$LA%H@xqtG$S%5m#j#Elc~v-xrL@{}N*J$)u`!HIVZ0H>n_(0={!_!49mX7G-x5v> zW4g!;;Y{JIFnI8?J#AN(nk!{N81IDfw)i~Zd?A0z>9$aOaTxE3yc@S5(;) z2M@0T#N&>qC6WjuDY9HEco`uR#`}&>vB+xSnlQ4%l|E~wtP`#mZV+-VrFC-{Cz%an zi^Q#AY!mq)jQwF85Z^A`5ys9ic7^TPdv_Rn!`K(bo-m)#6;L5^x<2(p!Ev36F!I4L zJ__SwmHm*rHJE!SjKd=2%l5gBgz-rjUxaZij8EnEnUL0_a(n4SNyhnHVrTI$#ZL&2 zXL;p9{x;F=l(HAYxD>|MVSE$Dx9kMY($eYheHdpPep=)Q;p`@^AH(=5jGvV~Cp;_U z>B=u*WKUXt4dXY7zw-#yx@E@vdZa!0{|MtxnaD4Q{N;F3`CGhX1phcbm&0&H?2%AH z=oVJfp?8INDdC2@Ya#+7J#!-V)6c3AR1+x^L2d+PBPbWamBeYDF0<_0`&UI!A%eUJ z%17)cCY`rcx;ldUezzZg=SOgMBl>pCo&91dk^*HbMo=k&y06@^Ww z8^JKOApZ`)1TzkDy)zH_4L@^&QWfMfS~e(}8$v1h+-dJc1Sx+#W&0h<&H)jtK6mW8b!F zq~dfVzmsAFjU)E0p*hW5O=QZtHI1N|bXLThW-VoE!)8R#DuRzjd0MMdHjfVX$df_Z zs;+w@s4=z_P3)SA5%EWb-Gx1bljqupWbX+2C_6ZUz9LTuY3e8PSOkwdO8*E3h?f{)mmTQn zPl`Mx927zJ@S(#HDMN)%3;BccOa#xe6CxNM!HfuIMld3Rk+Qxj92LRyB8)IvWQ=gE zaGbE?HrERgycoet%F^?d2*!)QES%uzzwg3Chx0stlEWv9ye6C?d|mj4@XZLOiZJq9 zBGV$6F49l0qEMd|;Yp+2;Y_n5nB(xd5xnj2c_Q;8a4)mx4W@S@SQx>(5iE*ev8+pl z??rG-FAC9TiInX0zRck(BUlx|pHW^sSQTQV8N3c7BJrM*V_A6;jn<6m8 zgTj!|j36u$i6AXP&u9d(2;vb~5hNl=Mv#i2^_)`k?CQw@ z9KmW%3lXf3fTs5&SSzwF0{T$-&!5>15p3jWoatsoS$(tW-6GuTv|*db2g2>b9m1Uv z>=G$!<}$)w9wVFqqPQ`N{SkY$#(@Y9YDOaGGsh1(9YyU&sE0Tk@X(9k;|Ts>r$uli zf=?ni6~WgLld4{!b81XK9O%C_?BW5*VzcZi-0GtKk#^u;Ct@qakY2`ewvfmK>HTx zkG%iJFF!=^GuyEE-xanml=Ebox_Y&$`AY=nw6A}S;CB&sMdLhu=WcP{1rh? z)E-V3Be)bni74Dr{4F0kxT5$+?Y!)iq9+qC3V0%2GKx}BAd1QTTvtTxZK)o2l~y!Q z)ZRL_htAwUo`;u-A~$MZrIwB2swm1wQ7(!rrJQVDlPRwau8!JQofQ;;1=ccHQ^`qdTl$)a%w6tKv2+yr- zQWW<@ac|WA3A;Ut#!>r$d&4NWB7#bzC?2R@=8h;l?ep%8;x480de*?_+D)Qp8bz}x znn#hh74?3!UzlwXMaw99ZgRDXqD>TcN6}i=dv3|0&zZ%!B(#$A(R^FBCyJ+{XctBM zDDI1*Llloh@n{qsqqskc&QWxUq7$1D#e?k68Xl&<7P)2)&im(^9P;aj}`QO{vDNf zSbo1K9%BT$MR8|E&*M?_SCQvju32l*ue*D4B!8exd^>;+S9h`Z#h|FYtb%ED6oaD} zq9Q{jJ{QH)Q4EvvjPO|wDz_`U=z=&riV@OBMlni7{y{`!)=u0S#kMFuh}uu_cF9DtUD+MNokBkA-yOvs@x44eqc|AF zK4td{`C%ni^r85nC=PQnEa_sXkED<=LRR6EZjKW=e;UP!C{C)S{KM22#;yV#~elK!b$S-}Jar7TWeiHs11wVyBXQp4G z_LmdRMe(alzX^Yj;(Qd@s{fEubEob9R}>ec7#YK;7%p-0=WG+h-7)+V#pNif#85Q` zR}3X$C>uk$7~C=R=;g|d*$;M0#&AWV++w!0kYv~zdzoC0vSniSlWS%} z_3RI1?V9PjGKQ;Ts37ZAF_c#XI?#<%?yAGCyqG=r<_imi6@`_AG*uQk*~?WehHGM| zAH&TtT&p-WVyG!{T@2T&iW{6(Rd-s#X4KLjhTW)*%2rKesvSce$G@&fy%=s1`D>JC zk2d5MWgEuO!126QuhVHTd zJLPh=N@C`A)gFKWxA9HaKSE5aCdcy@k2V4r7oHa`|KZ40~R`;LpV{Jcbbp&eOK+Ssa6p zj$sTtKaM-&7#qX57;@rxZ6ltK;e{CX#jrny7h`xShUGD=P~VP^VO@34{1{%2VL}YA zNSqwQYa$b4cvWPQu+#$knr=!Aug5SWhM6(EA$@8LZ^f{zw);(G->dB=pBBS(WmzP5 zfqOx1yX>qOX2(DW@;Ncgjp6MW=EbnFkBdH8WG&gmA`8?!w(y-87IKHiuqcMbF)Wq- z9{0`y_Y!fEwd*U`MQXe0zbuAqc4Z8!V%QwRmKcg+@W$Ya!LK6O&0(d17z`<^V+h6& ziXo}28AF)6IEI*7NdHI-|CNfzV8xJ-!XVtDEV6czR1E1DGAdXsA8s|9l(nvj;eED{ zwZyQ2J~6C!`ifomU#LwIvkHrERjYOiw+R{TgBZ3ue1|%OBGWF3yJOhnSoezLv~lq* z*8?#eiQ$tN4st&p&tdv7hC||qg&zq&=0SIp=h$8s@zWTN#_&fBf5z}x44=pFeGI30 z_?Wq0a45!bQv8_kOW|?usqHR0e5LF++zWec|5M6-Eu_P@BHyvA<;-W_Kg4h*hF_)s zC}gR#B0t6Ov!i66S^uK2=VJCl^K69QV))(hIWNLmF2t~FtfzF`zPIofXU-C3E(%F5 z#qhVo|B2zUxGQe^ln}awC505Ph@+G^9EJBHJaPNSh&LjLW#Y(&B9u76vojYj$7lnF^<}C+!ROs zY#d=-CuThne3fID6~9HuEGx>!B)=_=hK_!_2u+O~LWjHJXdK7ual8>nlQ^2jQM$6{ zMPaiz9*m8OObGw2h;cvQ%2f(MJ4kN4ZCY@9DR5l#U|pfH9!HNjdd1N@4qwNT zg>RN->dBp6r7+9ie#AanY3dipV{tsLIRAsZJ0 z`8Zy1^lYe?;us&t%W?aaI$l*xP`{DC5{Getw7RQu0CTr_fpULm_ zxO-&xGPQQw7j9h7|7ILhX{z5&wu8!?0U?IW2VR~A(h#2 z%yBqBC`9FLcETvnjrZBTx`10+rSQEt-id=p&_dz6LS`4mu~_`ir%N%rgq?XJXQ^J*7!(-WJ^&8{Z6vsbtT#jRN99!c2mpyzD$JRKu#c?o>593&SBIg6)o;bG0u_KP1 zaqNm?cN`0***`|aZByJ?WOi>H`{chrjsx0{v{KI^qaBLlV;-Sp%O7^EA33DYf&3$J zd=kf}aU50pOt`R$y?T&|ZOXH@EV9ACw8DvlG%o)jKfT8hqJ$HABMzlr19 zIIMA=7QOPmi{tw^PR9|yxhB)##ifXY7TeC`KgRJ>9Dl_z!a6vZl)}u=lMAPki!KYUw${0Kb0j}(7jAnA-@>MB}f08=Uz5ODdPJ>}_;gC@DgIg~$yt*O}2CSoU3-(iZrtLZ(V#j`m;~VXm;Okh`^ zV)~ENwNTGOR>_JtTe!u-Z5D2~&_D&*1GmbDgee=Rp@l|HSc=)OcUfp`p{)ge>!XQ< zru4b!X>Qry{b(kfHpIp6fiT;G0WGwW1AXomX>Fm6Wq)sk3coZ$yhr-ILVm7fRopIn zpM?$8>nE zH~Bm)q{t)mQ48HI^sq4RK$(A*yL!shOW1pcy@a^0Wxu@k+N#_E7C3VHarb>z;W6$( z3m4pFnEHz}8DHuN3j-}YY1yw9a`El67M>Dkc94a^;zNW(g-<)yVIt31_-=QFY}w~5 z45zpr&p%s09A#m&g&k~wg)tV!T3Bgem4$H@p0_aF!VC*9Sa^{|EWBpnB@5#%OtA0@ zhtoQ|Y+iP?$DzG`8T1u9t+brPm27GAe7)xukHd&9z;A~bQoXMISfsf)5A zgUqxr%fh=B7Fn2WVGbi(c*nwA3vaV;EzEcPvu$8?SwduDz=di|HoMrudlr^jSf=(b zk?DVnkT18eLe~G{6j|_ESZiUO1)l}Kg_wo7g@6TvBg8`3LeN6UDaFQTt0rNA{LsQd zWf`1t4p}(t)Ro<2#y?`=Q`P&4Fso}Ma96ZTaD$+i3yNZ3~yRfW}r%wChgHhov0KG!91eF8VAV0Gb*!WzPw!dk*YAs2hs z7Gc>sB6WrJ5;)e({#r==1a3~?mIN9kaIZ|a3Y#X-EP>m^Z%?41NTUSqOyDl@JB0PM zB)f3}O_b$QQZ8l8ex|s&6jsq%q(uTP9i>&`-__b}9OZ72dlH!3#qN`~3AE$xNZ`H% zx+U;%0v+VgDS-zP=;)NXUvaVvzaLDXa{^tQ$PdY5nGRU8IMw zr{kP;>zzQK1o|e>FM-Eo`t?=!`Gxi)Dh4Dc8Ni*Ju%9BWNnl_CPbM%kfmsPWmB63` zMkg>v*1^JO6Br^gRLD|KiwsNP8Ii_O`+4Ydj&-=mhy+H8jB<3B&t4)mHi3zbGA@DV z6L=wk7p1%`d`UQ7I7{nQCWy1_D+#QeYS;B@0+ZP1(%%xk=J-rW;B|+;k-(ecQ-xzr zR$*DDX$ef1GQ;tlw9`F1fjJ3;5-=ss6)sHRZIOA7=X@Sb4u6OKT2=LK0*ew@oWOfB ztx8~t$a2SXsmQVfxZH~kSfT7n;bLuLk+?SjpNL;*2m{0__NuU;vXiuQBrHxbnLtE5 z>L{@U;tsbGNI1OjxLPTPrxVDC7dy)81b*secMjA039L|SJ>z)KQB(PE0O$lrl z+3Z-iB(T-t+eAJP*5BgZ;pjUP*d@N(QQF*VFHqT=z&=OWpTGg}gO0+XbvS{K5~!23 zuTVZt;0PzNB+4c6NrGQv!>^9#QIV4geC8;hi+sTuL*z^0ap4IeYhU_q?pFz%O5kfp z`9b8H1ilsdPWZj>wD57i{c!n=ILVLfH}Rhx<*djr!gK62eIfI=1b$E8yu?yTyOaM& z;7`u~3H+5nNhued2(Bb9iFaF{`*#BWh+pQEvOYJvim!zH8N{8m*W7Xq*cDQGYji=p zwBzFu$q|+j<_i1HFSwFDIn8rb5}PmD>#KP`jih`M^)7j?PND)Y0g}j1q9BRtNz_Q9 zqCBf5aZM7HlBk?S6)7xLHHj&gJiZ|=^2ZL_c&(J{lVJ8b$4Y)f5_F?;O^Jnyz-%qY zhx|tI+Ky6}O-kaXBQuYpWz$i%gs3YU7yflm8^{ zO`>g*7h*a0C+&-fc5-W<E;XHHo*9=*P}a zVp7unb$&dF{z;4%XLdjm&nEF)5>F&CFo`FVcq)mfWgR3O;&={DBKui#mKvJ;zh5jL zmc%pi$y$deF(QfQrHpjSju9D^#Arv!I*(O$oG|+d^cTcm6u#ut^0KlMgs%uE3fYoZ z9Ut<^NxUX~itu&E=M9lJlgR!x&opIMB(XAy=}F8;VrCMvBrZ&1w#WkEoFwKZ@wWIp zVYZR;#aSb_;+_A|-%VnXveXwR@m>;39M5GOD&qX?41+K&SAUYMl5QjsOrl8KEA$Ed z!hkUQFgGL~6Pm)XknM?xM4c_oww8J#iPfArWlaiG!n80WEKZ`-M%Up5x$i5>_l0*S zu{McyNvxOhfpCLxV-lN^_S59eNo*C_BFsKt=2Piy%93oCKijZFWT$Xf^4}-dtc4ew z`;yqtIiwg>i*X={gGqdt#-TJm&_FT#>TpK&G#g z_$G;OllU%)?~}Nkge!&9++~`JE+%n?122i+lK4G|pOW}FiE}b>);gQSFAnEKM}-sJ zubKd}+4Hhq5dM+GpCa_hTK`g(ZD95iccrrbs5nDqqm@Y6(`=R#-6@p(AElJG0x3Lo z$x~YB5#|WX2x-a{8LV0Q$`s0{aJ33vCA=x_t{{>x%oDOzZDMYF^9OSrcfPq|h>jCgK#ErqImc%|)`yAzF#IO`)|&8^`Bvk$Z&qrtqAzDx+Nr?HwOZ zJ{`roI?DYborDjh@SsR%$J#~YA>n&LbQ5_vg-23&)bZ(^LU-{V!k)rj!vFr!sZR=h zrSubW>mG9)2Bh#r3I%CYOk-dQPjU#Q@H+Qk3WHL3K4qVu3>FR-4iOF&J}n$3q}wwo zJS$%GM8R_@5Gjt3GEz87I9f>4m=wl3d|V0>=KQ;s@`V&$bo7@}7@xw+%1#izDttva zQTWt0*Cdh2DZD1KVxOy&R=d5C!ka0iQ^=$+Ri@b~%t_%bakgPv3ez1vLu6(OvmE7; z-#s^lw^J}u2uhqMT+Y#(!h#guQT9E@f1${`!bK@8cJwiwuta>Rqbw5{@uGdMwIYR; zDXfxGB=n`=75T(jrSDH6Af>0i=N}S}2~A;G7!gK=+3S(GIBT&|NH{zxk`nTxoy94v zPGN5f`%+lr_-s$%eety^tP@!;+$`LX!bXuzLdKuzt+B=7TSc~|aBgI+4}^5sA#ta0 zm*crxWRH;R68Cc&5igm>!4y8^e4D}#DIAh`EQK#qIGn;qDSVv5krY0Y&fuSo|W(QuxMEPNs0m;a`b-v(){yL$VRRP2oE!-wWT@pAno% z;l~vINa0V3KM8+L;b)PvLKgppJ>c+`#ks#Z{CAP_DcqoQ^$U*vcM5-rUld*v{;uo3 ze;l97DY(-1rZJTeaSPw^=3bFTDRHEcn?~6*N~hsT<9J(Ksfu!BEhEehs&Z*uoksb6 zt}7*8C1m9CB1XpU#tPzjY2-WBr(4#nlt$$=dZp1jjVjU`q;YE+Rnw@Z>@~u=!fVsG zPK42}7r7yg>S@$Sqo%S4bwyuGyijsn#rF9x@9Da8iv-HvsJ?~AUt@L(|wS5}vWbNQ69n-j9ypzyV)xNHOFpbV>bdmCi z@F8JWVK*V&9!?|s#>%6P(p{uS8a+jJkE`YBi9TucO=E5vZ>P~OjmOe>C2ijod_0Z* zX*`$4@H7TE5uT<=d|(<+iaeFZ5XU-5WU#R8$tpudZtIRROQO1cpFMJ`57ajd2k@3Qpg%dc6+G!Un`)V4K(wHnhL-?9-itu$I zYkWiG%`~Pu%3Enn6QAxVJGWt`_$)`6oyMI1@tK#lzh|;Ajd#<>D)Z6jzF@5*7))LSGtw z5&8tuFvNq7!gU?tG$Lulq(mJ(OSlpvE`@}}lWC-s%?N2q|BrvM_-Y}Gv&dQw+BEj0 zF{)ERosC#8vNeqjA{*1#l*VT9EkbjWo1R(Rmc|EZZ0BLSkp>o6RSPK|PUE9A9?YO~1|O$!B#l4P_%r?Q3P#=(`Xr4{ z(>R*OXK8$%#*Z8u{PG@3>-#Vqf)8X^I@O1W2n(wC1896*Y-~ChC{ufK8pGD3Je-WNbxDOD>>CLGUY}-AOX7VQ6pGv_yfK5?8Pv(3 zZU($+zCD9_8QhdXgA8t!L;VbH&fpetUU4&JFRqD9x2aTCBsNsGQ3iLY>i<0N%Aj!u zO)_YjLF)|K$gNohEiz~+-aKPp=Ci3R(n@97z1i&D8Qi1V+d2BZ8MJlk%~nn4_KLvb zGk9KvamI*@&0w6Pu(}t-Uv!k0G8iwO zjq^$d6Ek>M%BvYn%3!YJIXQ!=8N8+JYZ**&^w&k+$ly&!$zB6a%V371OwZWYgKQGh zOo_8HnC)2Sh-9z+-p*j2vhy=oAo5NI8@J`sx=@61m}Q(r87y`pyeCqAgnL;A%f1^%Tm$FG3#3z{uF2s6Fq_3vvKdEu2%e z(B$AL$_;ZrzHh(g6JaN8Lo|b!2zgw@5+;QFW_~(@Oa{MkX4sD63|5Qm6Ryc%QwE#G z-_KyJ$T}gN*NbcrZWI<*wLh=4C4-%g&sLFb!ViSoGuR=*_Y>*7OPpkP274U7SA>59 zx<7*h863>u!wkO3;M)uiWpFryFEThLpN}&5MC4=6+@)%rApqvD?lKj#sxuPSAq zh_S{mrGJ&dagh_klS1Clr^6|6lCMQr@H>&89sT41RKSdS+|+udcHh z{37eQ41N{)&*yii)OnFVGWgR`E{OakyqLiy5&i=*zXSG92A4B%6{AG4y)492Y@d+u z<pAgoVNzg|&rsgms1W zgf|K63vU+QB5WYMRd}25_F^;?;rS91YvJOzJB!hoZ7a6l4!)}xjnzd>iqW(f&73}L zU5w_%_HTL%Av>@oP2#&cfT>L}?k>hX@^4>^`$X<7Mq80~Lhg&NH&!5aCaHT2ycmp4_8JpRFf74ff}~!v#5I_-2b6ca5p5D9f-gD3S&UeCdmA-5C-BI6tQ170dzWb!Udqv+} zX8bR?=Str_VV^(Az4YBD+J{fsD+hA`?|Jibd*#pfd+x)Z+;{y~-?MLv8}{8UZ~Bge z$y(pN=A-X>^Y1*T-gkTU?ZeM~n19Fs{|@@D(RWw-?yo-dzEAjuk9gjP-gC&r{^GOW z^idDA`tF+_zyEXk?sNMt>bv8AP3=-52#8eU)F;cVFChQzs9;cI$!9d&k{$MgGK3x#vrnhrW9)V)@*MKk+Lb zID78H<-dCN6YqN;opryW@4m9{zOnD#*jFaiSM}Z3_T3xU6n*zK?2*sA?{)V2U+wkd zUw_yBrMq8m@4q_pz}NNNJErdW`o11m`OF?N&ncF_{{}IycfZ(ozhs~Mvc3MAz5Yty{i?n3SuVeB?|;KyeI5>H`0c*?o#Yt) z4rsw=K`}5D)nD4rmlf1L< z-qm;i)OY{4@BWgl(RY7u2mH0Ya=_pA-QOfR&K9{7NP`@rNqhfTfV?r(eLU9YxqDxp=L zhW6mVeaOHabLqc+)_cF@-VYtPNxK9=&ktiH-+S+e58QJGip)OOULV2)p!o;xc?0)i z`y?2+=MUUR+xw3ixEBoE!vpuoz+HaB-7g%t&wAxuulU@%IWt%Pe!K45UwK#mm3Lhj zxEFDrH{4BZ_s~A)5-%CJivu??P{5breXV`|sEudJUZ)3cX5ePI*1&BKTzTNK12;Et zs{>aYxcPxw7`XhvEf3t{z<#U1NZR*_X+1mm5%2>4-~y+0J(u%IzOs{ zoq?}b?9C;6C64T$G547LxnZwFpVtO%-QF|F{A6?BO7`d0z&$>2+z$876XpEfRR(Tn z;Hm>xV^jloW#C>maGyAEPuNeMv{z>4wf}t2Q}&*iIKsebUp{c3JaD0X_(}Hq3VUU- z{2lGGaBsO6f#H?o>jSqxa0dgoXNUQR=rsoJ>cF+^lf!{)4&2ee`Jc01Kc1|JKXWv2 zzw*kvkQNeXpSGX0O<+0$*B!Xtz@6Bih|s4G+_izbK5(b@$yxIG+n@XJr`Y>XwbxIx zS3cw?pJDGm(_TNzUSDai{+Q1lxX&B7cMjaU2JZ8bE{bFa?mGtV3kFI`|H6T4@cjv)Y zSxS4)pKq`?9Lf7{u=j7Y*Kf4*@FD;F`)@%8UZxx&4*uZl_gsJK!8b9~ryl$^8|}9v z#=mkG!~V{J`>uienSuM+fqUqW?)~n8d;7rs^uWEDjr>{ne9yprFZ=GD&w9(ieIM&( zSK-ee7`PuCI8fzJ4qShrn#8xU5hm{)4BT+wZZKB^_hSS1v`Tc3r&P5)f{9JTtt_Nx1SV&MKKi~Fkkc+3s2AM`Kx z(qo@1{*+z!7k@<$%f9mT-J4I}-T%S+e{SG@o=H2o=QjrKe+}F(AV2mepIm&|UB5VR zzhr;@`qOvw$uAGwqc6LQH@`Y?zcz5cK6WGraN6G-xZko5f7_0H$H4tgatsIjuD$;~ zd;NWT{e$G&KeRW0WUv3*UjKOD{>0w=sl9U1KeIP~K5+lX-uy-KdG&2~{pG;@6%#mg zH-_%72kvi>fuZ}_q5Io``#bj3&>akgKi`cO8cH(%e&GIL;Qn#o{%PQzJ9G~X-Txi9 ze;&B^8@l%&x@z^oe_>+|-G8$8|2lC0HgNxs6|6pZ*U*@M`<(VZcMs+CAu7D*-}?;R zJ@yIj-O#=7F#epw@N4e1*ZYRGf(8C{U=l>9UPoGIX`LLn;aQpK)Lq~57PRMC_^9A`Ae8kXw^w3=xx{n;X z=M5d71orb64AoZR`S$uz_R3FQICKx&x1aq(_w(s<^4&6m2;f9;ASKdt88;<{t*GUp)zyHB$`((ymXYDmJbh{6!SLfW&%@5te z&@B$#E4cR`b{{izAIrVlVIMbiA3t>KL$@(>pTMmRU18`h4c$wJ?kk^nPk!i@hc0LD zm+Y0x@j35#^TMa^=Kadhtq$E|L&t}F!sq-eChynmbARyW(3OU6XXq~5skZF3Jamr_ z-S*fe{Anw82F`!QuJwey@~8jy$>jVmv(GvICl1}q?LEWzBzwb=RG)n^^ZEPthW5J4 z=k}&%ul1qZV{-oT{e7L<7eDlHW9Y69-50VnL-z|e?mry5r-!aRq^Mjsb!4wCdyVY% z*j~fWe!m}m^Rqfb*X3q^)P0`4_U!eQ_IfgO*X+%8dp)(+Gkg6Md;L^<{WN?1bbI{_ zd;Ls%{VaQZ)A!xY$@%x$L-#pD_qp8Wf%=*AkD@kSKi>}f0+!Ee+`ee&UNv-I!Nd;T z$9&j5Uu>^mYOh~nudg1u_j&nU`yY1CYliN%L-%F&AxD0>z4_XYy^Ht$^{ecYud&y! zwpV`0x39DJ|1~+!8-`>U-VI0n9YgnZL-+MV_YFh$jYIcML-)-?_eN6-Z@O?d%7OM% zG?Mz3q5D?*@V^b+n}%vm#d83E>CJcHtA5*19_zOcsfSgEb9t{9?naq>=g>X>>HEHG zC?e>)hwjZo_dP@RUSE9A_p)<`?n{UFzh&rnaNhR~-Ix6ChyU0^4}bpiz8J9|XF%;okp-`&&~`A7DD_18=zLm+7>eAN%_( z`|tsKeYU+mXs>Mi54qt!)ZTxXy?%J|`E%(1le~ZEhWiM6|B?3kZ;wk8a^}B!`tIl3 zn~$>B7u;}M@rCyK@D29}Z6EBtAIXK}J->a49Y2A#w-a8x;XE+loR8X9Q^_aOH{1+X zAQ{QW(Esg*%hLJH|L|q1r{Lc_&wr%(L-H%m!)*9_r?lbYC?ca|jJ6MigzWeo9(jDj zE!}Vx`;$7mJZ*n&xJx(W&M)6^eDbx=yYF9W53byBulvJ$UwZoNRWv`9m^a+o4Yx(7 zsT*$nhTFK|{^(EdE!}XN_U0w8xr;y9%e?;R>+gE~Ywp^nH1Z$reevhq&1>1-|4vN| z$z9)~_!N8g@(n#^@e0qd<0+6g+>l)=Wxy!=gQLy)0s?AXw}>MjWEbZ zM@PL@qZ)P_QLA&Y*s4z6l`CiGW~OF?m2SORuSQ1`xt(%lJGWlU@zwO~>})p3H=|x{ zuNk)M0YBm6ne6mpklU^lwu`x7v);WHwGTU-y?q?D?c6$Mc5!YosFW(fR&Tf2sOsX! zVe2$lZyYtc^%{pP&d<)@`H0N)Y$n)@CTFKFKGtYWw4>I3Q0}(t^{yY>VrC&&E^V${ z;{QQ$GasxMH;R?QvaX+*&Q1sUgGMW4)ZKc!RqrNa<%7NG$VM9E>-tisTbRns1vHR4Oj# zgGwR4x>;H;tvoq4uFU*QHYi7X-KDT~7;Hqljb`1ZPN!$S7qi*mO4M%FCe|Aq;D>HQ z4VxS>H@lEo44z~yTETjF#3zf{h1sCo*c+eO%tB^9zV~!_>`W7d>(zs>wO{9lnfZl< zpt7M!xj34la=m@hsMdq6c68FH+04u?%x1E|+Ge3*vl6vzRxT{n8!XEHi!?tMpDqk9_U_Uo*xhbxZzjE%g`K+C= zj`*35>TuH8g_*gz;Br(8_gJN%(CLJ2yRD1KQKLZy6T#)M*{cV+TCH9SViDI_GHm)_ zqfu=~$IbfnV5`Dbt$6h@JI|~|UEM{ss<}9K-@(>;UOP6Eonrg36|S-ske+(IefpFJ zRIZ}sss|?5%r=M4XXZ0()Yd+C5tNR*y-u)&0QoPc7cwZ}%7NDfu^J8bqIPfz4c4ma z?2l+u9z|WfAE_rB#Oy-6-3zszSMNdCss-EiPCaZhidYMbwB2F`yRa%nx8}8-P3&mO zI$D{^_|h!SO=V34mP>4u5-MZUW&jmEKgZ>@i?sCRM)g3;d@KdhLX$8lt^Har*vM@L z$exS^W9Da>>4l)Yn#*lIQB054H}jbp_Ftj+SP^BqQdr%|1^Ha%a=_WIl(yG`d}-1z z604Wo_YP()I!YJ9w3jX(-?*K2aW0b{u-ph+6G-GlMYo?!PdclOy4HL0VzN;d(aZX+ z6kf2>i>^0X0h*iFSR}_5WNgWqnPd~k$7vulGt>H6r`rz4Bw%)a5eazmXk-z_jp_VM zCcvg#jF&k++xU8&H@{gc<|r>3}zTYoj5 zokxM*O66kxZ}Sc3lh(cEkLG7)gGQ%bKRmzN&h3=h>6t~g%AJtK^z8gpb~adR_tOlX|-&ySEy3jvHu4ooi}(Za!GeZC)-`f~DN%8lPpdv-5L& zw!WTQEv+xJlgm1CVHPE_RVwF8K`~$9lWcZwb~ZTfwQ8V};A*`SqAUVzYQ2r-Js4eN zac%*HmD{|siZ)<`laC6-C8#1nEw#pp3G+OY%ocCnBu1&ynq8Qloe3VxF|5MQ=E_!S zBA;7YFHA^*O`_Ns*&?nUXGxLTaYs}V_ z=&0W6j7=Ix%!9Ur)%>O%bTyPFT%462TpN?8d=y)SY&OfvR8|X8fXrhtFPw6@uw5=< zsY;iEwbFJW7nDJr<>H1Pz;qT!yz^9Pv#?a;RTr284VLRsuNiFAyO_GD$;!2Ym59Y` zF-C2GMbLP##Ch%B1u{!}djf*dUeLuX9k=Tp@Ss0-0cZ`L*uUBf(7Gcn6ol<=C&0ys zrG)cJdt}h!TV)vnFbIMj?zf^t&KI?HWkg_VCOF)!hHaTiu-d{@VDLI9wWOL8gfTt8 zz!;aq`n4$Hehh%!tf*&Zv-69$y4m<{N_#gOyVjb$`F%9R}ts{>c>Lb*eo*5~K7- z@gXz8+LK7`N)eBVJ@{ln&Qs~qrDDDy*)A;aAoWEPVO)?!q$s{tP0PneD(2zTfIza}y`}@h3ED5t%(H28o8{7_%9sktAhyYnlG~TgDfg~L zt=kSPgO`x}YJxl2(uKPrCNG|;^V5`>nobWNzetWX)`)L6y_xB03Bo=QWwdPd1RcgJ zu$Z1&BYCnOvB zG>*_)p=#JMFC!lr0_F%d;KE{XDYsGDDF;H~g>62Sww(($m$vNv;_OsV+?vQoE!6*h zJ$5WjiHTq^FL7~x9_4;3>^Ggwa8KLyCdeGK<2^`W`VnC?JA-j6p_z@pn4Zza3x%-* zW~LT1Q$g-9JOcBbqfUaQ$;*=(>!Z{1pNkn93 zG3FX_fLpGX&h$L2W1-pTghA=_s?7?hmZkE{rjd)eB|cx6N1bfv%WR45Wx>wb8IVJA zv$tHtnR&c(kD-y*Hufc%c#!Rt1{gmE;$WLGR^Q zD^5={4R^ZY>BA2JUUUKBlFJ0sJ#1w;hg-@NuQA+<2SfRLisYCyclnL48wW~b&6|8$Q1P)EBX zlUd|~xBWVcX8#Y|5HJi)w;gr5o@`=DG8h`bQ)6}|;et%ga6=($*Q)q&!DD6H?lX9Q z-WQ2F!LrC4KXcWHxhw=50LO;lU6=^i+&nT|s=&~rh`h|rWTz1Ha@ebl97xV%^6f8! zrD8h9rW|JmtyT$}hx)%3e`XP_!VRE=TSuWWF6emNfWy;ZXYHKIoQL*~mw6-w@c#Y; z@s8(S3LSBR-jL9iB{g@*^@Q#S()E}~S;-;F1yZtT># z?XRiQEpoD%Y3@Hc|7IjplG8veS+&qdbUHnoDla+2>%+u(r z@^RQ`@q=j=Y3i9D&(6Z6F4ueAP8CF~%Ok%*ZpD7FfNmQ{`>7I9bigmo1zaaN-r0p2 zaW%SQouqosKS~bXdQ3NzS(whIJ8-ncbfq>HxZSJbZ<-LrGlL3`r{?@=`OCxu*xsoh z$;V3BH?Abfgr=OHvT%cUsTj!E1(RW2*lIUU!ft)sGU}dYG0s?vw&eDJ@6E5aD|+@a zJ2!_Gr~o_&F6fZm@DK|0AZ$1GVnQ`D0}Cud5;thfJUoK-LQTS<#N(XKpp>@i-9~sA zluy}&vch7y7ssHJ{F5?jl8cFdS%TbU(e$?ln^^?tY(aVLg9BQKyi)xTB@wDjBnQ5G$?GPNx>q#9ttz73mV)Axwh7-lB zJ+_B5=u|RSj&@f$)AWpZg~G&E6aLr2KYKm6sr1_gNa9N@{Mi(|kyHyb}T?p&~5KVgk#bz7J-Fr0yrnfW=aMPU=0F1pqLhQW&rs|QM{JW}x^ z62BAwWO_l$Fg$KRo7-yKtpBHPcda4*g1c2IJ=M}&~!R#VN!Ij85Q3I81uK|JXkhC%P3-fS@y z$L;V0OwnTHd&kxK#UPyQ7;eaD=N%DN*bCdc4ajH22w~gkyueTnLKbRz)and2Lh7PS0W8SHh#CFx}eRcnv{LCK(D95_O$GPsb)-6Ql1F zX9Hpn1lD9tPuq5mTOmVaB7^oQ9#?@q<}-QTrz1Jjx=a(LG}~I(PH!o`5MLut5MDC9 zxBMFM0Q%ncYXZeYuFFxiQD@IzYjh8SrjO6_-%t?_KHdoT*Ue1?!xBoo?a5}QK%6L@ z(l&wO*rV|Za%KvEy#V`IQ{-C~L5n+s6p9RQH)@UEQ6d1zhM$_B;wO2aV55s`iyRq= ze+!?DQ!P%hOKv+bQTx+({CWX0_;yp6oyy``-S%sp{0@_nMNFse@avhm_jK($EIy}3 zquq9BSrRPnFtnMByyew;_e_Ai)FPafZZ9A&+#q%sm9pDwi@3Zghob2-BBW@rM9YoZ zzQO?@s7_;_+yo1G&MZ!$?jP@k9ax|wPb6LaDKLpXmf8YI#v2=1nL-h*ughw1S<#xH z7tC*^-RndrL9uyCAby|Sa&lTd;9HQ*lrB6p7VCvlLv5X=x06^g)F=9}as{oK zc<@s3xN0}XpnJ}4n(F5mZ4NCq4W2vwx#U+Gi-~M z+;%xta1+V95jX^;0Q>jriW9`+<$Mc7ZQ!3mXhRK!v*|+uo4QC2*RLHze7?z=k-meW z%x{swY|eBZ>DjGQ)d1H$3v$; zq;FKp2`-%__+YpU3s?^byq$+BaD_5uqj12OgW$JknO zvEr43UVR^!f${FfCOFv~*?Ew7KxD86Ky1r=OMb)FS#rP}I&~^2u%&>*BL1MQrZ(wAsX zutmMJEJCd;6*1Dm3ih+v#P13*4tqVD9do}Vg@;DT2eH*BfQZ4xSYwysB$JYl#W4|y z-6dNE3~)JW?~}?uZbpk3BXn!-tPYelbw4h%V{mVFnsb%I?g~3kl5V~p(k*(_5DpGl0^`2dIb}b<51oBLF%4xvsLhbjw=*R%egx zjQURa{^=>OA{%KJ`LP5MQ3(^}_HoC2tzC2b>cLSP&Niq`M*Po)l$j%?rQIM4Eg-|r zwu9eaawp=MKnXxE=3r286vpQ?_3yk4vpDmdZmoVgk?hP=2&NZdGK;PK$>1?O)3u2F z6Rr>U420T@S`$^aZ@pbr81vXOwVi{;F<+fToyKmX-8mGsv`0Q1o0o$Qh@I3=gKD$4 z3-2byY$P&79Zvmbfm8)jDlS6Swf&u9e4rWJ@?6Bvi=J4wXI^mwfOEub6=Fm@siH5BL8!s>pF=ITuw!g?r zG#rKp|IL3ny*QtRyUXV{%LFG57*`iPS7_}wkLuF?^~p7@)+`C39Q7EHJ5OvRyMh#z zm>A`9OP81A3D1!U6I60wJpw!%$}+W>b~(6^+aP~BpL>xK>2y|7XHgREh}6h5{s3c+ zm04FG#YvqRo_M*mhH}_p@6acushozzjlljA-@5Bu$19(EApF)Yb`3* zpn?u&UnkN<5(WUJQrsw9DJ&&gV{U2|!8mHvl&4fb*yFbgbF*{g@;#v`O~fk^P}EKa zV!Ebe(}}f<2{dHUQN4!;Xw|C$JO)&Fmx&KW2O@>ZR?~{w1%O())?r9`+)k28f>*)O zg6YlPevhNzpdrE2IECDkeT6J;soRq)h-3^d6kuv6mUkpPOd5{kYSa}h0fNRpj@)^2 zUko#u4#N79DS^~5*khe!1?&v)7dP# zy4-86K%0s(h31L5f&@bZ7j~4`Yi<*|6S3g7$v!YNRgET69yTaQ-j5p9i6)@82{2-h zhpe+A0rDyEp3zrz<#*zVfO#!4onQr0lw)3%H266v>hStRkyzAqQ#noBu1tuJ?RA8x zZ5c)FFGrCsLH?OmYy@$n0xinsIkQw2$f%mUT-+kNssxaYj<3q)VuYaEAUm}Rd^__d z;izHSF&P;gB{80v<=m5YX-;vS!exB&uz3J}VTe7DVNL7pk4q+yxwiNm z3LQsJ$XQz3rVvgIzob}!H%_@slq-jy|13+n3Fa@vwxYcCU*qA4r^>Kv7u<9wf==TQ zbXml8bZihOzLY#L<^yLMt8gi76Jgi~!E)-G&XpXG@Nzs+G#P9X4fVO`#&{uxHj4nccP3d*iZybk#Pp>Z44BE=EcO^2a`vFm*qAq6G>&t znc&WL{n!`r#H@4%>Sz`jX+xJ*E(^FPVmmW6591@d7{uOC0zDQMV2Opgl3g$^(aGFg z5Ev~@u2>*VyeHh_X`BYDJ$u}=ERyLtVi`f{@@j1RNI}Q)mbS27Iint-SI}>UADL5# z;_ad#)CAPR`Oa!?B@+hVV#S}r+l6_|HpMcE?T#mO5ZzOei3)%~y!>=GcE%QAIfCxV zVer(|@S3m@A%nABXjMTP(_3e5W3u?=oH?;L{;EN$Uk^EHJT34~+@=!zc3QaOjrvKriwWBZt2nzO zzb;;(S;AopL3ps+P9hcw7c9v^&p}_@At*gF4aqCO1}7v>fQT`!TcdLn>8%eQGcL}B zB~h|Dc0)sb1O<3VB*HV~?2C~o5ki`0$6Y^(nrLo5H)Vw1J4=efwx!}$u*vot`Iekm z$)?)~H!%&PBbjF|qC>`HU9%4>Po}wEDO90If)ST>4xDI3bp#YZ#}UEQiSkJ!M71k* zh2&BMZ>iZhJCo@%(Ao_fmPDHnk8Elbt^&6!P#L7@ovX}3>6@)Z;-N=UWi*9E2bZWR zYqX?~uCRUa2pLmCCL(yaiz|iY!lj~g6B(Y(ps-_WFYy8lZ8T~yqsffOTaRyjY^P0l z?MPr8`F?q=)t(_~4R523`WiU+Z3KkA1t8DRzLVSDoGYi{KSWrvq*xKMA8NX!#31xYRH?wZ%Vd4unh){W zM#LHMiS7`Z3~P-@(s6u%xM^KT*C*N%?Xy)d*6hY*|A4Ay<4YVP%93wqMqO+^e9KxkAC zjT1B5PGJ`yycX??;!bSXqAFoPD2-6OoCgZL8E4xV7W0EwaQ>%QAyoE;Pwuk(>c@a# zaen8L?|NPg|@$yvqea z2k&cXAjM;a(QW!l^5bw58)x<=3Ur|eWOD&)8u%Z zqrt=Dy*f6otw=UmGNO55U^c^61VrUCjS8PP2ED1~lPMOVW0k&Q;yp6Q*_y-hs*sPs zm^=~4GZLb(n%ALn#}F$fJpDC=58nF(sYvC<%r(NJC>4sI98ItivDR9Mg;E$nKsWNm zCEVNy5^(dZlvjNu|Ko*SCX-^kRA?6CNcJ-@JyZ=)<$&E+OCt$NLV`4-zH;9xF~?Dr9E7d${ftI!4JYC&y3#B0K|=0Xe)2Dgsz8JQ44B%GVaqJE$o1(PL;q zgVt~qAlzb0RECGG2uM}+$OP^?Oexae6HqW0N>OKcutJLnnhBEEq#i_&WQvcCo`OdP zgRJ3dcqu%L$4@r{b+64{r zOlL9B< zw*sGz53v|S0PB<+EiN1pN`k^=6$Hj39KVbw8;B#a#*%W8q$FY`+s3X=<^`EtYhrWu z#u%DYBdjTVr5^emJt-d#qQ?qR87GN_B+QCHHDwzscxuRIwDcC~hhaRD%|Jc!15<1p zWL9vmqZyqu`aHKks(b?;a6!DWLfLTEyN>sxGUyt?=j z%@Mgp$#k@$ z$(i^#V{@Q|f#&$dSc&CS>5RJ`cs;E%At?G7g{dIj984 z<3mX*)QT5tM1x7WlS^=Vv@6@@C5Eg!tI#~9UJ>c$PBV+7@_1Whpp_9qcYwETj<(OC zLuyh)RpJ(rrc?%!b>VEFRGJ)Ip&Z-4pQwmnK=H#ups=NvQi73W0pzu`ncGS(KTAP% zx@|Dj<>Se-AP$DG@qqekh0D1WQ&IB!Qxigaj7+dI$-+@6gUKI_oH#&Z` z{7g+3TzblK7A&lP(@w&{SN^s1Pr~n~vz%C#g?Vj#bPsz*UcB^@1c;ra6nAtBlq_IH z*_r`-`bDe|=&Msmt+w4MS!3890YXX4n(qt+#U{UAV? z=39M}foq-O{G|Vp+)--p3!ucxG@gBAD~p?4tf;(g%r@Xx69J(3vD@fc!XRk^j0aY0 z#KRkO74^|Zd*q<>bStn{%FeOqRZavHur!&eDbfnyeM+TZDvNg2B!RarOC_FFjmkDE zGD)3z1W^oxO%fpS_7$Gj8m;67`P$NUvtGd#DyFb4$V#vnOO3h-b|+X7O#!aFn%^|` z$5Qy>i*edHGzD}nD(i?q>51YYV22f847?i1tOiYQ`9&zKMQ*TI-U^nB*4`pM30nd+ zzY+>NOc2(=ZS<6rRrzkQLnhWL8oF*zh+GR@TtOf^<^@=L30+-OK1DaQ&LJIv*ku}! zQ*sVjt_Ap%X8j~shP7-rP60PCNw{>$9FR(;#8sw$YzV+*zjX9DP~HjwB_OK*h|Vf- z{*j76qzl;K!DxpQpj1>WvF8nfB`ATEZbn}T%M>TOg!f_1g3BR72wKb$2%uLC8V9~c z-B_siZq#}ZIGQK?N-Aj3uUwGWlf2)U5I9%jrL|zjfS1^xGJ<>nnrt<63OomS*Z-bV zpzf(kp{T)Fz%(5KD4bxOc=;&wWwRx29QPSVO3)Z)Q8$R5Om52+!sOxQZnlpTtuE2w zb7D+nqCWF;GCP^Yb-eC6+2V+h)h>u`N%bZBoOE&~3tS17M|&r!!=Yd)8&M1!0uMwZ z9|-#!ouQA|@i7v_J45N?%aLb>r=IFz;xZ~+q*{q%sa~=EQsya9EsSGA)OV{?+{D2s zY+t6Jx17iY^F}wApfFMPok{39z(8iQ)OPq%WFMB07Tl_)=axffK}0KhTTRjSDll`(ekBA6oyG9~E> z4T^cv-L{~>t3>z2hh0cn!*3I>T1N5+c;LugOb%C;VG>c;GrbrK{TL)j4@Py9V6}0X zmQ1uEh*74(x zpbvl%N@>1~mcuV$QX$07=C!!MiGdWcB=lPRqU!+Jqra`$h8IZ(Bm~keDIu3$}TRYnf#l$7PMKBjN zWH@|vhM4+&xJ7nLDN+6>E_60JTCotgu{ zFR?@KNHa|aMpLGeKmc`a2=jry@KsjSx&asyJd{WkXQx69y^TF0 zvlb6xyRb63y@LS8$Wu|qmCgJ_u8I2?Cyye(izJWw$lH3``F^WkA z54((R4Ynq?CRZoHgqMruo!t5akYFn~+Hb?woK0#s(>w`EjbP`g1!J@)0UE^$D#(0H z0NXXzm4ujj_3Th&vhuyS-Ib-y$*uL9ZPz^hZvZ*DoLeu@IP58PJtEeg+s;2lWgWMi zP@n6Rpq8I3R|*?Meo<7#%}b^2ja=o){8O6+u0jR_8mrLRv#P0BF^oxnBFf{*E{mux z^cnsG)DPAeG20EzoAy{#=}5`%k}R9CTrsXngBsRqrwXd}Q%sGr(lY^AmC^>|wELeI z?OR+cza$Y`q7P{321`r`-6treQV<(A198*y@>gM8Qk%#52tq?B5F6?wY36<>6S9xp zfR6a12_tiLJh_bMa$2xabIAUWF$HFu?P>;3i7Tk}q_Q|c%qUy1`;y#WJV4Y!i4HrK zuFJs+cPE?3k}sx3->+s8srCwXLG|3D-aZyaA%f<^O=gOc{g$1@Tql!lwG&~DVg-X? z$baV;R}hNSRC03IQlTtGgXtzC@G1P4B!$L%YIF1G!p-pHyz0XGnAu|6vvCRhwd+Uh z6(s}43*0_}Hv08^|*{CJ@kQ85A*4KrkLAjuL}Y z1xiezk6FOPTC#T3C@yb4;T3_9W-MBg2@E`gfxeb=5fdt)002yy1(YK<2a27X#ALn` z+@;JPP6A>_inou?;cs|yfy`~OT@gY<=*gh3uo3_?4!Y8AKqSp-sa(;(V#}bABW`gH znx)n_#r|ycI!y?I$I$*rAiaTTrq`;~J8d6AKOBc?c2_W^wBdN>Y4LDCrz)}%Lzx<` zL}$g<$Kez_AjE&r-Nh6n;^Y?;$AOt3d4?@JZdfJ#EEQT1Xa^S<#6e^-98jp8UcDMT z`Y5GyWaK9|N&*s$?Byo6Nh)ABI)t6)c3F-jShhfFId=!QMfOds%{Xy+$1X-$C!L>` zx9y(su(LG5(n9$d#gsbx#En94r3l9p%%@2SBJ-(%gVX$<3_ua%8pA@WkS z9<~zV9&w&V^T%HW@po}~f-XF*>hWd6D9TIGxuqA*ZBs$SCFB;#Fq2QZn5ODHUkTTS z-m!xCPHcu_6+QAQiRqH^Q(U4Y##Tao0+P8}>ktiyZ7^wCKsJN?Mj08WaT68x%<-6i zt1h$U9)Sw`-Ax;TKa+qrpb{T;R70;~YZ9DltYV7t2oY(G;Y$gPv#+XGNn(u7uBmZO z>VXTZ>EH{Adyw&6qBLUtWOd@_Z0&uRBmt+j1ofu z42*y-r;e12mh62MX)_ZPIbR*v3GWnNvi+iNb$1`%gxn-+&=iK3l z9wcE3QZL`wLwaE^mK&sicd6%&vSmh{vopwj?{_T%pI}tR<-s zhzCqe+=V0FPuLJ8+3vJ*%E1~5i2}(?Y-MsKgbqz}E=W1!f_a5Y1j+Lugo2S25<8Ob z*kE}jV~n{hs8TP@af6tk_UP`Tq4_{(@Ucl_Rh@vbKn##O)unrf?`V=mw;@=hRY7Wx zQXGA<8JdN}EDFA`@HZ8jqRG*{CHem>aH4dfxY_1Mr|X21F>TP1I6xJ@_QY?&KAYr5 z0Iv$-Fp@NuL{E~osGM|W(vsa%d&lp@vd|wS9fiJ2i3Jl>nrh*tzK4TQHr%Wo81W5r0oB%BKW#Ds1eC%Tt^xH2WJ`qp+*C;_ z&1Hs}vR)KPKO*&DDRdhLIHdfCxJO9EWEfn1X5x%)6bOlwko?b0*<5=qMG68id%P$h zUW;3JFYz7VtWC*TqxWFvfDW;T0ZptU60lB$xXyEpM59>UBn6RjICi#ybMg+gKQ;?b zU=ot$^w}3l!B6TPs=fvpq<1g)iEVANpKQ)Vvq4#sCFD(BhG&Y*V~FZXljWBSW#76 z|Iy!Nt@~_Y4{y&;zsOuP$1%a@JgwCaE%G{+lz{xFI#_V#ykz)uaF^mCR)7}T{dOnH zH8Zh-?nbFc&1)f*1LxJ-Nb{orfi3EZcdT9(D3NQ*pgC7`h2g_fSgj-pTN~!Iat(U_ zqKLQQK6Q;)dJ>KRj%uDrgaQe5bxOv%c;G@YH5#p$2ZKny2~v!~sWGEOK|T9ol+knB zdzi^Gmo(Nb#7YDNVQr~LcRAx5*)j=nSxl@kQax`IHg5=SSBTQQOv|<F^P=r=$hXNSmHbd5G#Bnu*RR3l%D zk8kw2gc>rNV@l3vlSsIIGy{*jvo=C*F#$$lhUIB!36tyuX*1Xyf`P3#mot^EDom)- z*sDHahCjt#T1Ew$S3)VEMQvetNCuT zC4x}8(2gdLK@{U*4iyordziVweliHKN$lALUY}|paNqEs;~x=KV#dyW1oaV@xfMHy z?NI#?5~>EL83!KQ(_uq^csQqgHTdA|UI+bW<=$4tIvHHDZndzBG2|Az5sn|CACpPK zCfl0Wpe!NIH=qeKJvuQTu<=}-H7EUln4h0*>ce-Y$e^->VK zxoj~ARJdq72$MKddka!}Xt9tbX8eLbI1U9Xhe|_JkgT}D>vbC92zAH(`4}zEOgc~LaXPMXB_iqc@z{y&{?nGI6B0u#%Ner6_>bEw#~ccs zQA$&$Ru@_lx4c;CT&*jt?@QW*Z%BfOpGLr72vZ>DQFAhYVfGb;(z0xgJ0FCGk&hT1 zofu^$>GxUcqp;2byNJ-U`hf?zWP|wOjbmG4)DZ8u--^*Bpcvc^s=5y02i1bfpRg8AWM|WQ%@o)JvT%9SZ3DESwm#SsremoRtW!K4QiF*lOu@@Yy4e-vRFcZ~ zgpEgC^Ugv``%c^+D!(WyYKPSx-6c@BV#VvNs}^~_s3y)pKr^EVB57B0+Ce!dp?H1# zGD!w`f+h78lO9cTI&@{aY$?s%Tt)fOcoWG+9|6G*vzOjFTF_<%#}l)g0FRi;jK7ot z#4)NQveUa>KiZAdgCvpPQPyFcAxX0mRA_ienU4zXG<9>M;jk9IR87_$Adlq-{&m8HL-Jq8%`q z1-|Ux!znU@F+HL`FEyiUwvL<)&`)r*fZn(%Xm2gJ*75OiL6X&p9Z}|Fv?gF=J_O4>iwOSRu5oMFT9XY^~5uW~P*~1j``(7H>R>3U{zf zajdj9=T0t4(ky8Wt52n*8-vkIQ9?~y`kOz7S;>Obp7FU#=7|%FvaWJNvCb0c9Bn~- zAvni%^fA-2Le-X`ae@@|LFGUzx8uq@k%zECc+etkX(aiE6G=ZOAh@;pxahyQeVo}A zlRUI0sgbr<_E3aeBpyb}laZOB<;TCLP>Nd^oTq^v-+128D;K8ZIpqTP{J(gK8##H`}fd7yeO#{9=FONMf zUZ!HLG|A8z}bpyMrnP7w&OymYxQ0 z$za=6e3CO zGpWwZdD1E;wHc@Kh=_v9&u3X6xUZB&3dWsqrWd3JPwAwUYIq;o!y|%3_KEm>1vZU? zj1&zrOUH`RZj&xxaZ07>D;lY;a)=G_X=8QS*Somvb>Nk$_683rNcKByw+v#Vi6Unc ztL_PPV?u!vCRW;snkS4iz5O^qIj01F+U_U;$^v*JGCZTIP!Tu527Fn~itv?{96^P` zEu5inEbkJPNJbp z^rS)yvwH<@%{9?DN5?kPNtc`W4tP)v0I^4q3MgIQgD$XVDHsloR|Qg7Aihn`ZQM(Y zghhdKoE62FX+J;uL*FQ!)NZRmAtXuGifqOd6zQQTK=c(PVp{w$qMH2`;a34v`6dov zV(8>mbZJ1S$OOlA8r zZ+}GoG&&tSC+UNa=8j*g@f!kA#;ljqls8DLNh)IePQPC{pL2;-tqgA5C^JZjZ(W6?7otMYd#)QM1Gnu}cyAmC1T9TNVUkODvalJKZv^dgEA1})H$Iv-f8$2H@ zUAhzxzo0gaTVy>D0r9y5ZH7vWRhTYMwj%keglDQ%rD9r! z37(y&FqL$J6=&Xa$9sBqlpJaUUMh3a%CoEDiYJQ&;!3j-bGUBZ9(N2uN77k0=@^YG z+Ki|%v2Gi_43HQgP!=m*Js{4eR(>gbfNp{b7RLuV@iA;YSS{Ak;3jKMMh9~S)UIRF zO(|$16B|TY3O0ywLr~I&QS^n^tw&f@45(5zlDao+LAkz<$_8#}y(}A^bhbI_Id(O5 z=}8GY2I~b9uq*(TY-=BPm0tv(u3lnyI)pM6JlH!O0f?a3512#ZNTi2SC0kGxE|`zx zNr>Bc0H6v&v2lEFYyx2-Nr^#4)liIbfm8N9@A*W9%rtqSCOCNrUh0D)I!reeXq^_1 z%u$Oa5V+CEsRw1fPzjjuMGSsGmQZN+6eOexlripcC%+?|k<9QoJvF7-$M6Wr>jV%Q zmayuL?E=jxiGL}x*BVdx&7-HOtw2NLUh6R>U8x0&$dLSrW_!H13##?deyeHJ0U}G|g~qw1l?ouCU9b4M1MS?BNpG87x$e{Bi2wEMapuxBw*{mo{Ol^3wC;nosaO z(cm~VaY7M6JhuH3nePXPzIHL4*GPb~t;fDiimLLYUtulL07TJ|A{NZxwa%Y79x2_ife*=68ezIEWjtmROh~sowfAw5YP#{RYC2 z=sA{J*W~KSEz5YZ;VZ@bTEMeMK!no%mSoT!iL>|yG>c#wMk6`NMV|gpQ8zB#ycB9c zCOOTUeE&*u0U)^)6O7U=uu^#F<*;!~7DHGg)~WA&m=bseo`@$4K21hYfCwbc8pgdy z)0?nfU@wv{r`fhyQs8@=$MbP~gIghzf--)@V@wjZW6el)47dpN$NliL46HEfp62c} z2dZ-q>OfW?Q(zZ-C~`qfi)6la2~szeZEgWnn=VXWcVdqeh@gon(=4mFEbd-|M*w{G z$yxC}NrunLir¥6bLt0Lx2nPpk2gMSbRtU)acPZPGW)%MOoA!=>E}_YV-|+%+bP z#&3J{sY^r@8zvFeU~;g1oY`A{pAiSt6R#c~d0u@C4kRTi-YxbM-}a`?D#}Ah1#O8A z)=JZx+>o{FkxsK6XIst+1HCMsF{dnaJoYJtU+tzTJ)qje%YgNEvpErwykY6FIePee zw+|sBwF$A_motZ)g>B_aCTTqA0TMIpcDL)K*3ycUW%hz0Y^N&x8dblP&0@QgHOg!K z!CdODlRP+}0(p0n1o%yRyT>G`vB4dhZIfX}Zk1S;Tej-vYaHv_eoah{`?~GdYI%x- zcH5H^F}~B+sLwleiq4R%b%(D(KCm#izc#dkXP0hs-{ke&;n!2@taICwlez;2xb4@( znaM4>{ntDaf#1Ksm%(V&UCRvY|FGS%y<8_6-&J9SFZ-i$(>=$lJso6Q} zo{~BU{l_=juaw)6%c`OvHW}MXO^|#%l2+V=RPCGicN{N@Q6vTG1Kbyb7C2aQaVXCG#LmioML;zBgxG{Yw%16+*2+=HIk?`{|DF8V{POepFl%ghPA>K zO`~|KprgDm*y~i6gO~N&F9|N<~3DwvK#?7|2 zb1_AE0RkgQS|53PG#i-@N|L5EE=U+gdBg|=woyJ<+@>WVKQwdbbW)|meWUi0OU(cx zp1=c93Ip_goVKajD)MC$AS=^O(tr|Td>qB@FYe&GF7Jw>vvs8udItu;nj#s`6<`^BwkuO%C>O)6n#75!F@wsW z6A2ubaPnj!e5J6_vh3zG@7wBtD(cVL~~I@x7)%SjTvHZ?tmjf2J@!&V@y8aYL>$roo6P;7+(t)LbGAGfPH2;CP>Jr z!I=R-ZAQHlN<0+@;Tm$-U{1Mb5puKCP7~-UZ>eaGYzbXU+*iB^Da~#PN4dl5=~W|{ zN#P)0io#;-nL3lD9u(Cv^t;j1&CPGHzIc?6i5$R*smBl07&(I4kDzU9ew8HP@k{TD zM3`F!gp~m*K7rQ>@gJ`s!=GHA+~He0!wjQf2U)?O-IrSU!i@mkn!!ub{So`6AYYJ? z1$=JaIh0+&DqYTPRwl%eivGNPL`{=L*AwmybtI&1+;Rr0h6Y#4Kiu1|LLWdf^8 z*4-iD^gs#|!Vp$=qg>fc^2e2eOw8JvfyM-OlRB+yEw;~y$ktCOj~BG?5m3bwh_!ma zB0m*ixw&2ji|FxKC`PhlY?q;;^^AsccXDFvVGHJbl+cQFHbKbnX)K@tw2>cX9bM3n zqTga^$Gw3*yVW=bGb*f7bWB?G`jK&RwUxbY`Epup(HBd-Tj<$^Kc>ddC} z4n95J>?`6GcWRi+nn{Od~QIoNj*PP%d`8*O*ko;_585MSf zDOD^b{)`YDzIB1VwiD$_Zd=b{5MYLKz;;|wOtkDD92C!mqSkY_?6*l;A#?!|k+tZE zR;ZS5!I?<(h9qD=!ltI12V9~2AUV4Xs8)YTu%7oIQIFUiOH84K0I8X3scy{z$7I+( z+zlI7dDJ|u@YLDQmttXfL@3#%DPS?6ZVfb&y)p9T8J1yA9ZO086Co>s$ErB6*{E9{ zD^3HkBF+@}KvPl|A`_lwbAcl?2No-#3==_*TP~P6_S=ST49M;ppJ>hrLGgfg{iIcY zBGEGxJb+m?NMZ>C7Z}8uKiBIMLigVnlrIyrLZ$9Kv7o&<^%Ns zq)2op*=)oB<%7x0Ye$=!rH2Fqg zN~NjcG*WkE$EK8@Bsaz{SXxU29UHp@FHKLtO4H`4(-7qGOQj-IKR`G-Fn42ic@ib6 zoyxVKvJpHAKEXU+mL@Id)?|!7(sFUy(Hf_2w>F~Ahmj^L{AN)Y9fom*xB=X< zzmHWOB3I3OUo0)Vjc^&zF0XLiMES58)s&St-q(k#AWk$eVpj2pcR7*f$lopTB;TGD zJ`x**pT(EBTe?LOl$bpB{MrF&Of~}Cw8zR@oRP(Y)F&Q&6rCw5@<^(dt`NM_@D0TX z>dLiC_zz4S(pV6Lq5lvX7a>b(%7VV;|7K>?R07u_LZ~hZh9AS(MBM9o&7w)@b1IKwNT79y zwIo@k8M1k$Aq(ZziNZu-yHZ%9?|6k|q>bDXm8vR?<%!Bn<})9GCUOatCn|vcaNL*h z2)w2qBYhd^I>CkaTpADKl)D!0_gG~PHgw=^Ik_0H+%fenne-vm7~N27Erk!j@(O3# z9?zo(o-+5jw85LMi=rdHerq#P88zt-v%#^BM-kzqn1gO445SH}d{$;HaWO{7<`Vx- zl6ut9^IS$qhlgcA{Nw!B=pRIBb-Lv&r^eI^Dhg1JQEn^w{d_JAKm#8R_}tnHtH4H{ zMdG_q<6e-kCXG=cChqH_Y~0EB*hpV%OP>+8UXRa36awnDj$3X5v#Z+MDABXNCi zijL!STc};0aiZ>u^wqf-i@_{xq%YIf6E;-Bo)(!Yvj!UIgd#yRnyhDYvL{Olv%t#m zthQ!H(US}5WSk}$2$nuHZu6L%bLpBmXo%m~5#S~qzOfJJs>9A5`+)H$sp7p}z(KUMFFzQ7uL4NE1r8n|BP z8ZhK(`6P-LmN9>-E`|2wqA}9f4&svNE(Kk=N~||5g(>-h#DgABnQGf)#lR%lS6FsZ zy>AcxJ+mv7!)CV=61peOEu*vBYu2jll(8-p0->nx21f!!=~iJ7wcMm|*GDy`IzS=;^yDtUMUp+;LN?+Hv&p??vYrU#5ZPo6SQqj@+q=;qj z!Y0q3FjcSGU)oC4o<@tKk4fX-Df0{iZ6HA~D5z*T)$X?hj6CHz5GhO2rvjZZfeTMVJB1u1D+qpV@fZqvF4J5{MUWlDs%l1qAG5fEExo3BF5=SwS!3Z^m)w(MkkI%5HBAo z7O5}&JzGceTGZP=7~K(>T-1|aAzh@nLa)stttZQs4cbqZN26r^HMMhkM3-_zr3A-O zy`4=H2RmcWBe|x8@AJp-HBG`nw@*dY1NNCtNFF8*88?B^Qti!g(@0O^5Uk+Z`iOdC z`t5l72jO4&6iI9!-t9H;_ULBF(1$NCV^7;-51YZ}fa?IkXW5T0sFRQ`!-h&Zf= zyC!!0lqVv>BrWCWQ<7h0dZC@Hxf->&;B0AEa}NA7h5UFHuwfgg-rJj`&vJSRNGWx7 z8ztqKj|ZR|OQ9vPocTikVgGP#ZkCd1Yuictc#xiNd}`Ok3&oXwA}8$PyAmhVOf1FN zJQyY91)g zv2IAu70B%&1_C_^8DPIKfhG+-xLjH<=1crZ8%6m5G%aIKbYqUoyj9q@lyFg#YCL8* zF_K37b|zLuMR0-6mfC>lQ-maXs$)eZa|ya7p>(W5czTMz!DK8p`d@vbmK)(dMW^U% zZ5=wQ%0o%-4)2vDctu4)iq>~BQcOG1RrCVFn3a#!hcfL(t9x9e{R59Epb%rrYK1L5 zh|_vWM%wU+SGIEnzC*{XMA1HxT|cDxMW{y{Xd)f)#P}_Mq{Kh92aPgy7{{18MGL*yGDyy! zT_a;7bQ^mzWq1Hk%w*lrAI4^e=U>B`OEO?v6w}+ITC)~hSiyKblBT$NbxUReWmfhO zKLIhiYT-#i2$HAS2r3lN*3AmDKkd(@ZWT{LQ!27R8Vq59U zjBCz&ddYT3yi$-`p%mrQdw}MLt0avw4#c_&t1pKfcN+IMN)PwR4v5=% z^0YIaG1#nAxP$|rZdrNIqrei1Mb1CXTX4Z|Nhqx;SBiqbwLctU_%RAe-P1I&Wc9bp!mDNIU#rIu8 z_><%u^BFhTrTZk5B;%v;RA$~LNu{OQ=Lvt5-XA_sg7uUAkNo6M3E7t9B$;9dsfnK; z6HWxaC6}qbVU%aZlX~zSVyPpIM7^SP^W*zrme4j8?0Sfbjn8fqvxsS@+gOF{@sbP# zcRKc5x#Ui;vFcIMgOknG;9VsduN9pLqo>#3{K%RFz9)Wh_Q4ChHHch5}$W;;pEKsaF!oW+T8D z5MA?$Q)5Yc$?foC_NYa_61=AjHve-y`ouS+w`8EvDv2eKE?_75V#PRYp7^?wC%&il zR+NmM6@?7kEWtW~8Y>66@*|IpZNbqrEK+-hRj8`&3O*%FV%(T%^vY71c#C;l^x}XF zDwgCg*|UwHaha>mXwk?LMX`6KMz`(hVeEL$=~K7tnQHMJ>-n%?0|gK*@D*o(C(}g% zAjry}p0mZcqG~H^+l`w-jMQNPZqzyuX&%@mGLq!6>KUE!{scy)XO9h$z#FiS!j4M_>T#}g>t1#>%cBXk0}1TZ4i_?Q&2pF=ar6w!> z#pFm;lM|3z#$DbJw@x_(I<-u_0#h}v@q7j(U71l|#U<*=lEjUhGmtq6kC9-?)zra@ zzF%n?h6?=|1w$8km>$}I`pV1k3&rBgIpDGj`R$@6o3Jcaqrp>lzznPxpMl(wZ}a>h zkJJ01TpmDQc?3ID^7bc>pF*SG<>E@QLT}7+!23dA#QWe}?1&{`(;q7K8ST2NJT)02Hh^u= z)LHp)tgWC8RY*SAdhT;u@BXk7fzB?;Amg=D!ng?98o1J+l9hruu)!)LF4H+<(>5k`CeK& z9;T*e0+Mmk?w|_N!DZo~_0TVBfsd&&9ov@l#=xei{;G-(p7@iulTqmcD5mH%!hzg~ zaOXg4Y*C$NgH!TVPtFz1yN?Mk3>? z8%0A>cSB$y(u`@o6ADw7-+P6^?zga2z)p;F+>Fdn>gd$a1SBtS;`DC#=Ppb5MEoW4 zMqxJlrBp6#h8uFD_oWGX*^lLV_=#9w0N*Fvqaht&l$|~AozWsX`~O}GT{0f zaRx^~>nRZgEUVI&a8kCmwu?afSQ|kgYzw!SJvRz&EiYq39Ofv za_dlvk{0PhITgSJzyKCZr+UONTr!hvFLU{x*eYF2K$4y$;LM(Z^b<+@8@VVv#K=HHZyVj&Ex0OlIP- zN=x#9NIXiz=pGvi#ezRj?0R4jlOTsTmNN{4n56BJ)TG}R8B8x5sY#++jA!FzWeUl3 z4YqLL66RR9L$ji}+wf~Rx!|KpX?;Cd+AiUUIhip@^oXeE15e zb^12rf?;XX-~s1gt&rIYO~=|bp3ye$GM*n#Dny`m5TChRK)+=A5eIC*QsXMENK(;e z9e5si>Kn0J(z9T=78Z4VemE24uEYDK*CzD{o23>M$=RU?Im#ee9Yx2;P+bB-2Go28 z2`59wY_jlO$iA&j<_X%w7J-NSEs~N`J*-ADh8#SLMnO(1Oa5Mx#Yrwn)s6sjP5ylX z{%;-@W|`};d{}QeRb9ne?H0!g3+fG&fQJSqUzevhN!wj&5O>xf$nwHcRYI8&s?NKh zdlivBBB57(r4(KK=t8xEN&0*+#U5XHd&iTV5z0CS+V}KCnb>rw&&M*gUmp!*r|p1X z4XH$>+OxVDbYatnbXBmld5qK64<1FKmCii1!j^ePPX zfU9KM$i~B`3s3PbEgWFhe6)Q~bZTLT7VCzpF2XOi*cK)wr1D@)^Tl#(J&|{TZuq{+ zw$p8q>^UWq-UWuk6s9r-A}}}gobyQ!S>YbOaQUI%aBkel(iAhEINSv$kW9v28s+9-eUSL!&rj zOTE24AU79=5}+=$I8oqP%$T~dO_=NmO$h)DS+EB?jHwa84|>D+BAv;~x7O9dxmJ_` z9Czh_e#9m!(P5WH?&*pt4-IE9(#A~Y7~4;-T8KIJL^qp`{AQ&k^K^8L1@M&uH{5irf}>RBHD}FW+mXh!Q4D6fFc&mfR`k4rx?lF@^UdY z8|WT`OA|;C3JDGC$zq6IN_e?sAJPp6lb1$ygJqud16j(Q$9RnlQIfNXdl;_= zpLD+1PZIz_$D(2g&q>A2S0czFrCZvt5EMS zNjJSY1vXh0We;fZqPqA6b2DPN)2YP!WM{8q0%#D;fulhtKD*KCdSIz>!I#eUSW4yr z5GWt9^n`HsmC`n?y$hQwq=S<2fU=pDHdIkN`PyL;U_=f~1RaKeQm4wXvhX@ZJjvsf| zxtj^w6Zv6c^me(No%{-xM58Uhb!+Ez>m_2C;bD{z6x%#9#G{hW+AJdsZ zm!qq}4dpG^%M6QVluybquBglji|i$k9ij% z58$WgGbtu7@z8*2>s6zmu?;4p)WX`P@wNxgyZ7PySicJYc`J%cv#+N1LS7=j!K0`tZk)6 z7505P(S0nS@hAE$lnTX2AOFZ=^iLPSk}+eS*A><=`@uU3QtghomSmK&zg~zVb1GPB zC5inx)kh$4B(QI+NBWObnfugSlBCab>8?1rSlvZSa@Rv7a85>d%svoIhF{Pu?tH;z z65qiN>aKR?Gy9fddo636!%%~-Ua>6sriwftdHvcpqdODJ_KfZ(!@q@SvHU@zdxE^9 zrOY~bsPi5B_hr`EjG4-Fr?FdN&10R=)t>FkH9)qB&8e({`zwZcH6O%O5_!TBI|s&e zjZalKYm19jVmV!6c@FKjm>k4o^ZdOSl@~C`+98jyV#2~7ER?O?{mr#0&v3;UwoZzW zC#cFpA>Vw@IZ8XFyD7@{RYq0pd>DD|tzxH@iO}x0unUUR@%lk z|AkZ>q+@MkBGw1h1DthU+kLKnXzP>baFwF{gB2&g3G^<}LT~@jNvM+u4n2pylJ0qn z&NhP7{`F^;jW{m@>&rQBlam|_BdXbsvccs%aF8e4-%r2a|9-WF#C$nE4Pktxma!#3 zs&NXf9`>M2EgC#Y3vAJ&K1D(f-8 z>O56DIL4iL!NEP!m6lyH!5#573XyI3_?{Ck_WVSM0|+m421Sph(?_e2vjkU7fB|Gg zPAN&u^2KH{`b8EfID(L{d-GBN-yW;OSKjmD-oGx=9M> zvEZu?(KWS}qV(7apkJKZ%4q7$RZ+O*>KQmC*Rr|u%r4hCmfc$A*ASrc-aOR1GHu`) zoM~-uKL?F*hwZW*E-LkD^)q?C@q@yL21sZiYk<5c2qsoUuGQy~z?p zc!O|!93y4X6*wb{QLZjz6W;COobJdfj*e+}2QnRd6o*BF0kdg~`A$3Om4!epqdvR! z4-mF~j7gccLA|V{9pdxZ3>2P;054P_-G!nBpgC86 zD3o!d(mAIy57CRZ&;F@zesfV?BY(3evgs?wAN6C6|B*Ck|BfN$7o#rx&itG)QK7vE zUl*Q(LU1y$9aAozVxcp|Lg#$_Ef*i;Tu8{tO5mMI8r@|iJWE~2i-gOnzPmc9u8yhN zFTH~F^q^EJ+*w?-o5ksQ@wr^5yrBlz!9JkvocG>HjyOo2&3^EN2{>5ap6s1!(Ver| z-?KXlle1F3&eNifnUfDPcDV`IldG_Je;v;C9O^TLXR?I-+c>No4;j4Bs|&vgN7XVz zb&$*0Lr3?nZ4i_IL3ZPfu3UV`&LoQGNI`s;gRpMRG;`onVC$eB7uUKAWb%bvK%Q3| zvp?HWfxNl8&#Nt-fsFdWEVYolJaO+ctz6JlB$uJk+eKLZ(u|`nW!9ikO;}i zt&l{MyYg=7tltTTdD&;Bug98QX$rRAcWz+l0R5f2@Y-{fZcAgA^8KmSQhfTWDpF5` ztuNru`-QSMMDk61fHSn)`Ji zo-bat`ltRt@8tzBe^Z|NTHD5D_G*)1^XY75ccs>d2_l=6?w-(Q(a`FqMnXI0eJSEZ zvVY2}+nPqRx>JZ{K~OR7%6662i;;*1*MNf-5$IdO>Ym1<`0PIBQXu&d7T&0JxE@p( zqPffc+nNP?I7^s2xxC*Jr)iZMPn3GK=0s4DZ%p*BSNH$fR{v<>EG+wriSb}DB&q{Z zsv|_sxKt&+>s8!X(fd5}(|E>lz$d$?0sr7Aj!u`NRH(P~f6$oO4gq;Nve?ZdWEuF4 zv$dxYu`;B!TBBaw^}Xes@{icTwaEJ^|!qt zu&Wp67YG{noy)C@SMiH%06&>x`!pK&$L^SpS!+!;sBLy+} z4~H7Y1o=gXJlq~q3-C`0D3m{f0@JXt^F4?BB)dIN^_Wfm z9O;eIPE|)XBlZtFgEwaC&8}k8y z9cb2~U^vAfERSFjn$)n!v~`AkwuFIfzH0raMk##iJwlt=yIPfGF#wcIus{i1m2#yD zu4T=l1q9V{FvXr9mB4@OaNS)4@V&MKJDX2mjxukJ-BB{fE-3#Z)iA9-WK~^Nnu6J( zChifF-|61m8?EeN>Bbu&|Gd?=@d!YSU-War_9^h)4ZAN(^HV+%`YCjhFD|Y|Q1b zNgWYS1_xmz0^YX(ZAU;-4DpjVmTl}J|6Ev79$^_L@7*bDuPs4Xqw6wJ+T@ipC$7z{ zWj!U+MR}Z34B&-{No^B3m*M9X2{$ID1>413q+XiX%3Mb?K0AJY$?SdR6f`e`GhvIj zZ@Yd@Ndm27-x6|f~nbB}^jMa~M3r9TqZ zT7Esg%{#tzGe23d;3y#94B!qUK6r05`ggbb5>7`nQXmu#^0FyP3jg0rt zk-);y31s>{ZD%V{u~2wNVMuwV!s7jWnNAr!5fmu__Y3$edLb4R9jfkQOGl!I9;Dj zrkneB{Wystj`k{+PIFN7B|Fb9Q%HreE%S9*d6z}dWQ2RpULGWWj4gzuZY?Ach_gS7 zac%_a#Tg8maHZm)Xw0ac(m}}2?4^g>zPZl>KQbmtVAqAa<;(4Xs@s~~C_Se0d~mN0 z2o^JhZ(LOW;804<3&N*JeALKfV|Qzf5e5`C7)C0WFO99GB4%D1^#Jb+oL}FuOx{fF z^I5heD<{wOuS0al&8@qB18wp{1(;IPoAQuk=Gu7}NmmmTJCw?oP^y;=5y(a$$-9CP zuI>`uMiP&G^a;Yb4N-6{=?=z;cw_*qiMbF}tOWm!XXZhxGHL`q zm% zDD~{4oK{SEc`ThSBr-2Pv_D|GNciq{tdGW`D2DR)2Je45QBn^1`9 z`2t!zaBAXhg8`>dupz~sA`TAYZ1Y}{H##!)&&y|aepk0UZXdG}Smu?Cb{i&lXV(c_ zDW60#Ayk93KTh^yetZ32x0frzo*LGp-IrUEzeVs>mhqK)O zQ2``>ITai+LfIk+9G>;@d8Se_?lrjKp+)V$qBsb@@9xf@bq87IP>i^}IQn?qc@jl4 z_6O~w-?{bA^ytp*Q|LqAh3R((E^H<#l1c6b{7wNX3a zUfYY)0GK+0FX^2ATf`~+zb-@w9>Tp|T^L0y0>uG>!6neK_zQGFbZ~fsU`G#d zs*<4@FTpNmei1`+I$+z zIMgLpE6!)3eMQ$|i5!O202BHMrOAAO06i^(gMG0%UH!h?ZCc6+V!C{$c@pN{|7QGj z5XxVJ4>T(FccH@=J=4%G8_6lPQEwdye=SGR6LvaxZ~#Pc5)E-ZlE{Fn-aWUSy)%p> zPJLfR{b@$hP5JJVwGFLEqWvCesO+R4?E81oLV9CJIsR^a*R-|*HE$heM$UZLK*UQ; zd5je}Zj9%ZTh=Qs3q^c~VhyvFgUiJDPPe;_qrm1dcW)Bukh0wR=XAK+e0{voQYQlC z5D&LRy5|ZnB$d0%M0J&2l0)J&%+?ghtj&|KDer_%WL^2yS6dM8{3)5(B{Q8gXiDR>OVbW+5l4BY;(IG=Yhj=hfV>S zpw?<;I{sksE7Gg8;NF$4arLS5LxrWUlX~Ma8lLwXo=W|C`DLZ?*B8a_gfGrMq`zx3 z^j&}DB-T~R<1P-HReuEPkWJrUd2T4`t}eP0_pa^@15dPZhgIyN!ReN%#=>C^mZowP zMP|cwPT1hRB;zRr1;IuJm=DJKz4+9bOj{Nd3CZ`wex<-D-*G&+2G!usyJTV&QBkJl z0d%ARKuR&YU1tUrc(pQbhv4RzLLaGb2oDd@MvVSeY+1v_@Ga5(k52Aw!E$dc%{^-p z_Wzg_Q63Icl4f7oPI6PN5Rq>F=<9+qF`iKrAwL!C89GJ{2Ujkr)b@T{6CA8Wtkx~j zhY_}9+oz5ha7cJ{FnucV>v2mO)n(Hmv;d#RMo~d`Lg9o7IFg;UDCH2#zKe^CV)%Ur z_hA8ls#%c#IPTxCfJfEcR~BTWQ!JIVCQnq~6I^vq+rluH%3N%K^bNOb;1IIr4E6C! zt60hF#9MW{S7#+ZqJGByr%oNsp;E--B&TCvdAxw!c#PKqjW6UF+=3K7w>QzkQ8iI3 zqNiKFw1A>ul{Lb%|4r!Cw%UDLoYY0h(dTy>?|RL>1WIM_^&lJRYxQvQyquC$nzd0U zg6vMokR34tW@f_Efm`ab)+HP>mZGfSmmEl*8-GRC72`OjGvb7Q%BxtW>r4!g7=!>| zlUklczWIOEQu&!Pje2l(Y)H;Io(bC4!K8q6*`r6v)8}9K^1mv8DM4yj^CP`7J`}00 zQlWeSi0YledF6-_Hx`VVl}*2L#iWCMw?8 z&-{<05XtU(4bAkbvd@VFLJc0ImO(J3)za-!@!#%YU{~c>Jeol38>38Yl=_#C6=JS; zIyeE47C>lzigums!i&Y(`|I?@Xa=R!HgB#am^%9ymO_z>tO}5TbKUWh_I6*WaS4fj zGCkD5hi_7rPMuX%<;V9PKJE@5sFob0oTt=tAgQ#HsYLHVrn@hu`2F(@Y$7u$wc6iZ zotLvvy-Q}oIa576Bnv$TQS!c%b?GE0d#O;&bsSE6z>6zxX0>~R^jk-Hi;LH^Yw8j> z9^HWt8ADfqQ~3VK9FNe8hFqy5b~IkBREm!$D|i-Hf<=4!+uE83WU7dI;p0>~$>0a{ zH52(-nxi=EwVp)@b?rIXFHqg8wax1)14v}{YXbReM!_7 zDngk%)vs8$H1;Gk52IvX*U7K_ZUo#-oYVxTq=i}VLZBFLLKR+!gKvY~QNR#cI-j}M ztePFRhCeD*-&p?h;>EWOA~flpxu?Ivh|}M^|Ne;_Bk!{|eVGc8`5`v+=I;I{G6rX@ z*=fnsSBt%fyLQ`aIBTiY8FY|e7}Mn~7Q{?YL$ zm<^JmTNvO8QE^G;!%K5?3^o{Ggxs3?Vw6V^h{p_DZ+X4r#szIDY_)i&toPhtp7}$! zg@}TI)_2#TiR}@IgPY-jopB|psmlu$AZZQ`71FbRB$Y|OBX zbZ#dt88}_~0&iPlSPF@MR{r65B4{marzs!#6O zQDWD5YSkrFsgWABkM^m8SnjDjLdy+iWM_AEcp3iBFY%nvK_>e%O(E7BDZld+6T>rp z!~4tp$EJaVpC7m^URCt;$MVk7$6r%w&{d? z0YjcB9GA`+Qc%l2kRGUt#kX|^vydItXZ*s>k%9$7jTYCX+`9*72QoEjbcf&?K$Zd6 zOLB*!k401p55{#hwlVY|P4gztrwZ4tS;M$(g@;{^TvCRRbUP)gUT~<-pq{<@#zJSv z;@k}E?o8s%;E#(}aMBW?iVv&>2b90e0e$_8{}Pow5tC{e(P_|r??ksKpe8v5TUl}% z1^tg7XIazjt^Bz9u}j!se?ed52trM|XlwOiVJEv_B9Fw|Ge=1}4y&pI)~Y!#wiA3= z+(P3VVAs`<9|U#4@WjCw%AOH9eR^8N7WksC=fNNyeR{{Os}KGwOns@FF4j74antiSWP?CZwyc{Hyg zW3N@$3GnX+*-^Cx@N%B?=bdO@<8W_mZcSy3{L^sL#11J6D)&uqodl!P06e_PqSAZ< zQL(kghQ2!qzoD^bmQ|wzEQAJ&EN*VE!~3kT0%|7-!;ca(8T560 z1Rl$y;F=0bNlnU?2B*JQ=Y;T+ldhZ|1>s+F)p-m}caL1HG`mhZ-6IWG@Ax|J zk=eANdUb6uM0PJtu%#cv(5|C%depH~^azj9Hv`7fT%5s- zQF#SlKN8KC{&dwZF65@(Vat;#9j9U4Z~Fa4n7`5FlOuciQ)9J>P0zNAP#hhceP={vh?&D zDVjzBou!_pU9(1$F3LEWAE;7EfR_deJQak^KdGd*cHyrQ@AlV;hbs5GdgTXE{ONR3 z-knt;qkkZwR1r;M=+!&_1>BfIok_BUyCAk zHN>8Gor}F!wTkWvqGh%M^g?>u&mFx-4?R?x6o}hyjIbSxL+=yw`0@ZULhj}uY6l5y zP4Yao>g{6MQ?juqNb@K0Sxf)eo06{gjge#TLQb!s<=H*LP=PR}$!~M!5?NQ~rGn4n ze@AfmnGS)XeiwmMjF?mdNE5%0*592z!zkRD{JOjPZ1!@px^=kHuR$udFrg2nGx$_n zo7-`#`cDOYoIa*T&k*G0KF1P$Rmg^S#MN<#j-Kuxiq@tp;p{T0MF6DAflbr5i$89= z_KBQMuh8l;YEn9a>gA*)@X0DanL+xXI8fHS-PGsqlYSl1zbsPNrDHdU?f>cLd<)eC zpB~Yj?r6pGMWT}4)A&8wPqD_iH4UkC83=6gNJ=vm0WK6|>LQtRW!En*g%_fF8L-j# z1s#&2wi)J|k

    Hf&mIkW|I{m;@Z5A7E1TRQ{-_5xyXK$^pJJXZP!A)h|#UA0@iWv zB=~B4(F_pnp_iL1Mkg#V<+ny|U&UhqInyEYnf45}%O9{r$Q3Xq?OFV{cYF}HB~uiu z@6|a{y6YzvQy!SUk!XlRGZqKT2L}QsmE|VkT#MRp~%M*`1LV zGxZaZ1(9;nr;S)XI)~W46mWm!W}BRw=?&ZN-tF z>Hoz7#v!N3J~3Kp$U>J)r@fJ@@6GZ$!!}wKRNnTh^3zsjhFD)Qf$ndXnvd4;deZ=`rvqS3I z{)nlrJ}2`sCCtfAw*%1|FJKr)aFp^L*}>(7BlpFh8|1RYI?qu!~$!HL33~= zWL`Nv`dEwF#!sm!fi#|SN)555tE+g2#c*}5f&w1tjuo95a`eSvwKG=MFm^B^h)(N4 z-zD?bb?@PlbUG&A(6=qD#1cJ+%#-BWSc=m@@6lvSMwWe2bZAr(lRC0?m} zP_Flw-mK=cFWwmBbhz}epZcFT<(*v}V2ygsgqz|R&c-T*=CGEq10_0WURNgA8sPWa z&=M47&8vUAbNbE%(KtJfYZ((2L)%}_TRLPbX<2cSBnBA&M4rNd?ok#j6Sq;k)v49Q zF-i(jkbj_gFQe~=Mfq3<{Bqf!86&`1t3uM>Oxnvw9S1D$r`<`?ka@nb#SAa+?Zuz} zOg+(!ij=aYl6iFRUP5~wMgD#Lz`tv(9z=0}2IhS}>*$I^WoP$!L4F5#7=_7KLrMyV zUpRQ1CN5vpB~7e3`2Q7#njO<>bB5rJCbJ}l%FkP zxH|qQgtn8Pu=ZPGEaOW@F3{e|M@^-&{Y_$*p0QR&xp1;5rL)BAxZv}}(TN)3tBc#g z%xm^o`ks}R0F9i{Va?6n|H#%Ub+OACVT(FM1>Myd%4+3l-3tR7DCy*CCa7l@=yy1C zHicOdaFtARE$^h2C9ezQR&OWR=7Mjpm|Q~ha&K1;=8+op(WSH|-I}Vnn$)LReiZrh zi}&}BDr?WF_3NY6D*y~7JlMXDRg`NSDv%oEZ;qd3STKCD|LatpO{eEqRrXd5D52s@T` zPE*qHcgH?=Nykh!N#6MdH@K9P6{c%h%$Ov2lx%s4 z;3O;YqSNcVWmmF(dHNsH&r;L6?3oUjH3S_glu*9(tCNVX+oMvp(h zlt^2_jP$$YSVECbQtkT5`Ji)Jk~bJ(wMFyY!~NCSN~uW86PV}Wy_&PV&)CoxI2gx1Qbf)(lbvwv~!JwaW1jHIVtL}#40f19!h~zg+8?SPo zHaQ_(PmQCke0hd5bcnHJRV=2{n}p*D`NHI$?9cWNSIo5-GMopS2c_A=Cxo_)HQ!q; z&5cuWiI%#zHJpmPgY4sv{wWJ2rHhbq3hJ$c27ihvBMz@`BMg1Z<8FxtZLi(4h?+0; zXQqC$x&4HTiV(>Q5`opV7oFP;?FEURAZ(%~Ex&YsoF0|BwCI#)+b`~DE!k|Ij$p7!s_B@m zPGzQJ2eJU4eOWO-WHo>tl7wj-S3THH+sWJsOIBqKQhV7k2xF@IE#L@pJW={IO59nN z{@%pVdXI|c-@6K(!8 zBzGMC9f+BMOZqJo*-vOZj5S|*@0Rytkah1U)d<~^3A3ZYLrn`eK0PGet~iFVEtb=C zU-1Jv1&zM7zH%_2lo-M+Y=3f>Y<%3W(f;8#r}F#`5GR&)?Dk9JuZs(viZUj_L($7D z9`g%mAtiJXui z^7OQi8-43bEI7w7T)L}~hDsEPKb5=zIVd9AO1R+%wWZhc0oUkOP*IuecSO9~c;u3j z<)W5EwFNHtY*CNoj#b~@+zOOoblOb5c4NA>1%ljOUESJ!>DglM#A=)S!HFq`{mrLO zC&d=cHxdNZNlQAM#KL_%LaGnLsGvc9Ew%5^aNpj52c0?+S|!37^h&fBiR_=SJtuv4 zU)lgoK3c4r;{ID27yj}?uB}R)Z+ZLr^+^&f2Y=nNFQ;@WMtOJQA#1)fd!0V)N~hKb$x!UE{nc|Bl|YKRPqw00WT0QH z<0u1IkK%a|&P7R%0`>4&u3jT4@Ply&X(A38mPh|qLJ+HiZ$f{5=FGse@x_YX$Qh4s zbf?Eje{X1mtT<3FO8f< zYT^IjMh=L-t5+X}wc~XiZ12vyeiDHq^R^mH7NJzyRa$OA9u_LB(-4ukbpn?BFLgY} z!F0^8OW(*PCCPbg4bq7n|%pg{cnl&@CF@-92+3Y_j2 z(AaR%x+7K|11#P=P^*%pV8t(cA<9qDYAixhnek~lL*;G{v9?KN;N8IZ@ z@~QGy?JU(NUO9QaOM0)o>-{1Z_b1zL-`^B;k~8vH3*F7NO$`X=!l|t-5YIoWobW)! zRP7wf@2U5)*n{7L956RTqz}kP{1}-jZK7D|Q+DNu4jNVM*jYn+x z#i+NJS-lSX(>weTBT`5T>1pMR9W@oE?2aQ@d{psALu#8A&RT*~vzB<2fgQf!XiA}^ zMyGgCLwM025-~e;v(oB2N)^lAA{h}l5$#>!{#UW}oVNp#S|-U<0TLHvs+bb~Uk$5h z%FVzfaa6frVcvH_SFV+nk^2t8wqRivWqg7YXwZys1Lng&WM}+usiT|0c8nXdrTflM zW7;iiBpGl8g&An6By~~GVJ`t3NT+v2;}^-Yx8+}KR=2BR5rpHf`C3ATUkiz`1R=RV z7jupI^t7J{FL+-Qn9MD0l?w9rGT%Li1EHHNJUhSm^DHid^k?c3()5uo?w43eS`KbK zWc-dr246;QO3yxC%5trnY`t`KpCWTgkKddYXSAHS8A@M#=WJ+m6Z$(b-+bw0jDi<- zlaR?C+=*vh+PRJsCS1d0W;WNR^Sv#AK=Zc58Z^+#+HOrpRX<1te6;N67=cptIXe9! z&%98TyWp@0BDL_QiuKq5iRkkT9q(NCYhk~yG1GtRYwan&bv1D7-?(W~E#LZDDGC1{ zzJ6E^|Kp`AbEwMW-SvsC>&m7G=37rMDZ|>&=Mvgwus8!8Kbm`g(;qR6djTcYJLzge z3jWv^&A1ysio(!h`S|QA+3BvihmT|dxTi9(=l9l5Kghn{$z%qh;WX~gw)ggDl`EIW zPv7I`r&lG{QgTI3N-C5G(xPB6O$0)e=G1m!LDBLqka7i*RVQiY2{A^<=^8*PAs0WU ztCOF!G|n zQWD)=Ep0`REf$4C5#N}s z>Lg%aZ2(ft`=0NxQ$cG@r{IK{Xj&bsqj(5+<5wP_%I5t!H>J_%ma|E z>`wRB!kKuHRKg_5$C6se%6Y%NjyAs36b50N-*$c-{@AchP5wnb^0S@x@gxIiJiLK^ z7gXEv>ml3PA5#>h%xjOYlQz8dUxy<04teQt?B0>`#K{I#$P^rRy>*(tHU;_G(EU!p;{4k2S!wiffTrf3R-vlsk=yx0DnX2?lFU4q zpwlXP*hXyMo&hL>pKa{UOF6@2iUPB`*;TTUOE+5eM{8X0(~^;GFQ2_jefCd9Khpq+ zagIu9IaGTNHDIA%d!474G?=c`xNizf*M_JuxZSINH_A}_XMcY_M>5t}D5-hsg}h&}KzIcrN%-G5JDcwpsle#;Lw90R z^Bn=Cb#%Zwx!|Ec<@Kj+LEQQNmYf`~{Hqg5homs!ADxG>G$apW+!>g0X9)0k%3ruF zNsCHC#xo9u@p|&zQgh4U{dh1xJ}OI;K9JKsfGBmJS4TCMV#OkSw$5_YFRf#~ah8N& zCGiQq07HVK=3b*Rsm$wmJUKDOqN~~CQX~reoOchoa!w9-UVoNxgu^=L(V)0a-|3>r zO8-#}{hGnl7VNPDs@CD-^*se@<~gW@s$0YP_i(%aF+W)th{~{Cf6Rh%TRzoFQEI_q zL~U6LT~NdC=(mPOE}_Kn)kP@`ZQ=D`|I=Dl=cPNaww zMZiUqnr%d{bf)e>7&ymOX$~vcEk^e>dq)X?WH9{CQtH4*VmG#@t2|NjCK_5hS=FxC zNvV-<=km#B!{Emgo{JRfMiWiaJZRU%FyuQY6nGoltM{3DI*U}9f<)GsS1Sx?HRN5> zzW)35QZ#W;=Ayx%s!7u-H7b|yL;ta)=wVVj>$b@fpO^!eO%x#SzyXhl6#$~iT7Qld zENHT@y1SYiiw1xZE%FK@w;3lC_TjZ>k-iq7CfA$Q?vWZHiZXVP5hWT^afiXCMT@R)HZ#S< zh3L>7b43Tq6_r*c3geiia;Ml$Secgd0*gwzIds~TqrJN)`QWgMy6wqoti zG~Eg1oA)9&$;)juwTm2>rV%UufT+v+_4i7*6un_{yak%{(i*TPQxg6$+5cGbTbNn) ze{}^v#vc)MLb*N+CoZ zo?pz0?!A!!DeUf8lLwE$fB6NLR@jsK%TiaCvV0F42v(iK7%izL+va*VvFOfS45q9` zspDxDZ1UYx+AQ_dUBd3-{QIs<{6F0l+$YWN`peD5n^VM`a@S4 zdBMQG*6W(PUtZ_QP!a*%LD1)?u-9NoQc?P4g#5IQK`}gx)NteDTR1xdg zUxK0(P3`RJ?x8+tce*ABMipoJl?>oB*n)FiB*p3d2tM|ZURtqt>$B7i6I)u0$m)GW;r_t z`wUau(XwuVY3A=wVc_vBc2c~6SKXOhEf$hjQ#BbSq1KN2TamSSG0WWG5o*#uJ^3lu zP5bn%#T%@&bO#-reQ&?iPcO}RgommbKVMo4XMp^L^02#~CxI`dD#sk=t&Ejdycmkg z-p0$hSxUm}AtXvqSi{tsq0i&1Bl}T9>5muD$_9tLzR4h0Jy2N6=bQTnhrV4%o>L4~ zT=D869t+KD=vvt(P9}B+%5gjg;_USO#qrOgevOy1x$-SG~?2~%@C|5@0d;%T5qMp z;i?f^x`-b%d*bIMDEK)HGEQx08m*7&CNy_C=KPWwFa3w=$}^P(NFyttp1 zyhWRg3KJN^bYXYlO$8!L_E zHGyi99t}*8Cbbw6+2y%9-paP%VIWntzr*uB-{u~C#0J+w{DE#HkWG|ElBsjfRy(G za+cIlN!PWN6Rr&1CfFn#;;_3-m)8j_#TFE_2Uh9&cF~rX;^&i<(rSR3rU?UV)qB4E zdM279%qc(l^tpEN z<*t^y6CdFTnd-w>?|6l(RtP%P1Na4*W-`0HK0PZg0DYanO!0qRd{KBHkuLGwHF0+N z7>$|}8?N5JEGr){Ob7V)tm<(8raXR5jLb9O>Q)+07^{@W&Fjbxf)|5|AM;jHRV`_A z6O`A(uFg%@4rj*M=^V2==S$;9-UoLu7)td35>Pr%&7zdTaOw!y``>-96sfBU4NbXD zM$z#_Q$U#D%RG2yXgS(Ji0w76X7__-8YXo4yC}_8Z;J>PYTI@-OehDs1?<2o^;$;- z{Hu>X0E4OGmB$U6gTvQtFpvZUw)^gEp^@0aS?_YscQ%^74l8jXj5`}96?!0}jcB|| zv*R%>iwFEcsG|DleDOZEw7;te=waSQbA0GgM#?(L)>{}QnC<0&gZcPzR)fF5Z($1# z*j4%qRON)vT8(J{ z8NiKG!e-JBW*mw zhx?0RZ_tQIWrB6nq&bO8LQ;h}mNF(lSDGZnRuQh6lmjZdY**{0+tBJ3-g(Fz5-B?x zBe60ep!)^P|6y5p^wO}TT zkRl$b*~WCY4B%E79sMjei*;&tt^(eXfYPUUWya4IXzUq`;JPhlmhg=ATa0{s-5rHk zbL|y2>g-NTrCB!yEQ=1^d03p*GDWyagkxe!qfI;64%lo7*7nP>$hnq;Pp&@getqdP z@frsKa`dl@t3NITuI26XdcXW4pwBqYf@(2_pHxD%NUnrNfWO)XJKE>y6jaxOW&j%8vi*ax`LtRmFtLv)b%^%A#P-C(_w%4tM{! zWX^kbXpjj8uigAlUizpiRlpgVtc@?(+XP#zQnW+vql*p`wY!WpB%Eg(4JPzM^>&%%Q z&V$IiI^V5r*VgPe89>bma|gv~nrqp4j=(T~QbVQ-7fYMCd9O^Tn>hwQdk=)>1_N(j2bEg2p9W$kUW&dRY#w7Oh7>p{dS{rs?rW6iF zfgB4w^Mc@*yHfeCapT1;4q$L5#!om~HA~TZ9Jth%oE}Lt>k(S^Y~aG82K%%NFIl&K zp*ROWhM&Wq1F0UExm2j(uKu=q*+3t?6^{bIg_8hwo$k&3hxJL+D3XAWg-LyrFxr5( z#L;{ASMyY;Bb05K2THcX7fzCWUK(%YdJt3YOQi_5C}gBl<0E;7(R@_yj=*Q*qYwCF zk(JM$c34%SfZ1=e-J$hoeH>wuS7=@m7xmYUm<{UAmJ%M0N3($nG{m%+BT~krl{a{GvVXYq`^F432pRsQ z{`E)F(GfTu$ad&r<5a6J%zeB*>DZrnJsZMlK0Uu0rS-vS_7zVDOjRj9FMX8*3zTnN z>YZ7y(S>yVVg!tzJiE{aGd@|iQ*6O$-kPmXS6?4{NK0erL4G z2Y(hp1K-8VuM-pw8phWj{E(*+Z3NcGCc<@+Fa4XHOn40`@;C<1)=vJQr04P|@u??M zo~}?imlqi(3ekXf^gs5sC#^<}?9nH>GeAVgKyoNba>%(Pevq76T00u*b*R#>UR_Qy6Ne766 za8nRj3bI`CCNez_OQ@ytE18ViB*8SVK95zEH}8DZ$r~^Zg4%llwal>6cAn|l+p8v}WjX7uI2JVHa(AT? zTV)%U2Zkps3h`1l`vw3~j)ruZQ@=mEH%pGMwkt0M1JYXJ=y!wgq}SUn1QS*LQoTVD zp`V^4!-|x$xt)n@P<|NgCXR|pRF)wP&1HHnE=2&nX6fi1o+cgo0@R0Fz8sP#H_5ly z-FvCWtoF{UTeGS5T^X-akl1XRMPYNx&+l!O@?4=Phj9#4LhiyJD`S*D?XVCECt5;D z2=|)uu`v&&yPHV$g!^%GBVki}hkVg%rM;xf8t41X#nEkxMZcmwu`?{V7PnZ$g<#Wdw?z=yNDD;sZgVP25BToWkYa_`KHcAa31;sa z#1|9G=M=Z60bsgzh80&E0d^)~ImyY!(?Srci}wK7ihK6!79Lm5M+s7zRAvRnITPVI z`!o%;L~g2<@kKf$=luELH@dm>bsO34KBDkFArvopKiy#YHz@_sVE3#u(E`|@85i$6 zcw}&LkWv`g0Ph8%V8CO?ICDVo+GaJylDkETNRa6?eCY!SZWJmowT~(oMao z%7p5I=d>q@R_9G+}CDHP4)nZXs5r*jFDBNUVN-(?4IyGcxcytbB1;d1mIReE8 z?r)@TPLi%EXyPutoE@ar8?!2%6|3(NzJ!fQ;fakaM$exjOve|Q$k9K>^lb5J@ji4h z-s-~uJ8tbY@~HEpBwpegMFhJ`YdXd22QyrpCeze~ek~kMmvGuDdmWkG(4g*m0z#n! zTwt#}HKa+41&nV^cv83?psHtm$HYTNwx!~`Lag4bsi72jo|+g`wx`ePb&r-4XLAKB zIf$KD<(@pGLO0cYvId)dYl7}PCU8t&=c}87l#Y4^u~}+S2CX@9a_Tw>mE-%#Ycs#s zMOh0{%GT&hP|TFdLlJg>jU>FM+uKOl`+glq9>;9*;{IgiaK15$uktnJl2l2uP+O_*>+Y6g%{N9{-#pNm zsZSQ)(=6klaEPAd#fwF6#;T{*7cCCY_(4qc)(o-wG&-!i-V~2F6I?eMr?lU9u9}oU z6h!T-UEICmCzMyjm5EcIvPe6?TwRWkG*Or%&>~0;RDw3l_hwSHTbuKPxeKKEdOD1K zrjj8aWt{fsKJwYas!X@jS0j|1y;~b|5kg1Y!}J|y4hf$8*x(#3G`$NhF+_)&w4TtpX^}W5MJ6@mOrdBw;qG+R|%5xo(Z#ddiXY5rUQFhw3tnVXE zPcr4Z;=;X*K1(lp{$8)LP$C6*>e)Qk^0772>ur6&KN7C-KsTxw@m#4PjKJNT{ab)3~h2 zPF)*zhjx3bT|tP;cAjtFhR;?HJYQ3;Lo!l4wkVF@C*MdRcAQIx2?9B?shXt#Wsd*r z_CnEW(;BV_+mn_o>rxQ^FYXOQ!HHj%NzHVqm^**O`~LYCS5A>0&DnWG9p=`_Gq+6O z5j|e!whf9Cuc~Xo>?%9~$cIMN1P%j7pisfvt`SU^S(F$SR#e)1-KhhPR!&_X4`an2 z985z8q%IPou!}M@&!+2%K3+h&XY=V+mFaW~O|GW+j2<#U=}q-Wy-+BGy_hGmVDG~# z2x1~L%xNf{B)jI^YBo4-*SWEP7~c=fV5dVe_?(zvIncp&Z;@}zZ*hB*#i>QJ5MQhs z?pk2)-czh0mK#W-Nd##`zjKI!+#~tL$?0W{&^zo-LiqxFXA zYw5_}DlQxQ0!a2QN3c3xRKSze)2lPcb71-^HA%pnb@Mbd7ZKPw{&2$q*G%^6V)6Qw z_s*7wp2)ka7>~sY09^l`u_q-ox}xgp=_~4|EMqZiq6%1fhbwNFcGVJ&NNE}$HcX=| z2UgSPGAdN5@Sh}e70QsPF*^Ws<-<%PE#i1_RwooUL&2?eO4zwnmLzY<9VZi??<~f5 z<7!qk13hP!r1wVbiJx369Wz;6w@3DjV)trxwm0OpV$h5uAr;0@A{xZp9Lya5yipn5R- z4Q>$Zpv?4YGt7IbXYM312%4s!v-QK2;C+?^@!$vOy50@%ljUDidil07HX;_;6QQAI z5Zb4!na*s6tiT}*m(eE(=fxeK6>@vhG4!2WN;ASXqJs< zt8=i=9`~n}<7T_v(y9o3h+_e!jLdS=m@CUwJ@Jq}BM@Y3?h5E#O(a zU0g3T+N-E*OnPZ$mM6=DtCacDga0TjHTUbo$G0WT-Y06zx{~}qgTB2_*7CF7Rxp%O zm9tj742L{VWC>G!MTs?Viq-u6Km7%Dw|v7uv6TD;VL46P`~L60aPI{?8KJm_)X7}=jrRTlk-aqK6(PQP87!6V>JE{FlMz~+iKBC=wZuYA=f>jovn}(cju5G;3 zC;VV3ai#%4SD0@oxEu$6>h_d)D~$COKAC65;aYvCNOp=j2 z{Fl)~VhdmzCxy+XzLSb$$lP2w?_`?dboTG#*WU3y{JAq-x+q}{eN;sH_U&o+;=H!W zTaACy*SWOqG982L&G@D!geIczW}rDZAR z@`A8ZGq*etWmCfYWggR7uQ#kvKk0V@V5{KEsR>tC7W0{4|})oK1No0cYWzAS|@Weo@rV*El<`~ zfe0+#97k%|rW_*U+PF(QThdOy9{>B+Uy$pwTN|@q4@;NXX=e2e%uSY4Mc3NG6q`83 zsE1&RHD#40N+*Y1iGy*&%koHC=J%UBIXwM$gu@zq zesd!WIC7l?z4YZO3mST*Z1T?YsNYVucULw`TWEET(Kub|Uz(H} zmC)~XwVx7i{s$LIrG7L&3tzSWYxG&!_k9Tosy*N23laC()^8HV?I3hdIo8+`qCZS# zcKq@ZvezLgu_bH?0Ozn#b%F}6PJXtwg z{Dn%LqD}wXt7B!EfZXE`N!cHDVm(d}wJ-PKr*mVU(=VbZ$CZ`-5GF#>m6`uOS^bB~ zp$9*Fuhi*S8JfJO^s>LeiBz%QYHFGIY9B-Hg|OyiQJfQ~up>}XNG*UEI}%=mr4ne( zLZ!zO`4z>_d7Wi3$_Sjvv-{7g50h?pyRVdwe?*Zg&53)7OpS8<9oD`xr9Z~HZQko3 zz;1c^-5ObUDpk(rtKTi=nWH7pNeRPBX`pfcpG_$271l(Woo+4Oze>EV-*C`s-O3U- zp|~Fxk#0Ge?%qk>l&It6H1Xd9^)`wB68;@ezT+44u1l;0+&U_=&ksjE{xo@`0sZ+v zuHkygYqI-vQd4K+edptZ57zIyQRAH5sOo3=pFZU5m#e)Y&FcOe&%XQ(>@%(8&K5}k zz3+aGo83D%E@3TZZ;Izy6Hb|*s4$x6*Wqy$?D z%I=#c(e>-ldY5~?vv-gukE~b?ZtuateCwV&E@{E zHy;XF0en_eu@I5>Gxlpv=ta1ykMd-Qv(<;PBOrO%Cx zP-?%{Q4e3ySD${ag9FulaJmSmeKC2JN_K@3liMhJt_k5eeJ4oT+X)|&XR4@Bw4f9; zszU3dW{8w;XeS4I#u`->(y3QBjH?LKt$o4nlF77$&^p(%KXc8iyt&oHh zLnOZZTMWJM`}5n@ho%#@k=>NrDn!kd`_H4W(Q?1~IH(s&dB6BNq0)Wz_kl>i{ByaB zuPxRiWt;5O7w=xWDswLKdXvLvBS}%b#}d{bvdeWBX16IVn#}J{@6Yq@h>ecs-EXbG zf3@L53Hz_zI)eDWNj=dqUwJPD?g0JS3&{=2C;14t;h@l>V*^&_9rUvD)vqj(X_`g; zzQ#%_+?g+5M6wQ|_~p+tJ(K_b-xEBlBPHp9jvEQFq*u$Ia$dSpk79?v)4J#UEhqFp zy-TnAmBaF5v`n!ODBjSP@deczF0MzcIQ1Jh#?^y@iZ*QFPdVjEYSMDyGt_d9&PuAWK^xth^dByJI=;g?xXRk%T&>c($@KeqwiT(G zzs41^yyJx%`L?0^mlZr(U=H=X*OBMl!~2>^SjCI?-~Oi70UYCF@LX?< zN+(^BtEfp2CH7V7vHAKqX8Y{S{1;tMdW82O^TAx< z4aYTB0##-&1bZ2te((rJuYMQY4Xv*9UFDZ5>u_UIoGdTDlYe#ZsjcwO$#lNsGxKF1 zeA-OG*x*Nk@=kDy++2sy4C$0n$=PtO7^H7~$3%70m0KOK_ZnvsWm8$auWgd)6^zfi zp^Q6gyYWk5uSqnl?dm$-JPmKs+2-!WebL#HP&$2oEaWa(#VULKTGf+k&E+&c^8`Y8 zK;5J+5&lI&*y439x`caksjN(MGutLVQM?dTAS;|dO#s=e)j=?b*0EeKOJCoGr)7E; zb(4v?grP>$avxz$P(d{ZI?gW?Uwv)*Y*m(Jd!>|O}q#U6O< zS7L=pe`Qxa5k$zt|D7{v>O@h<-#o0sG05F262$Ji69aNdQ1olC;u+-UhU*$e8s6v0 z={;mgn$v^GDQJj#f)93inUKHaBvT<&RwQp&C&ov|)+#RcD_s1q9C)?Va$^4riVH^~ zl=p(d{Wh(eJLCQ&tWDGX{fojR_DtioUzNVc0BDvubAI@{$^h?tt$offR@M4u zi-X)T-tPm|t+;^0A!|XRn2tuD{(cBF9J=jtqk_fPN#?l%RN~>J%(|A`?ijZ|5Rn8< z9N&${lpJ8nvd^PfFrhfg>)X5celMx0!!rM-l}Dxt=?jF_EK!;8+0|vV1Fd0*utxS& zSHWwFbUF7E9$u~MI?ABpX0C~ji~xFXxgf0MS|Z&I7{hVd7EIharY<=}S6%uuE(TIG zk7;c?{~megF72*;671ze-A)9a68C6(1^pULtrxe;+HTC!_*WrC4U9^)a=C2!`;!vy z)t+0Wv}5(Zk!ZfANBy542~X?^a0(W$-!Lj3Q~L+Plt#4rxrmrM&D?g!vHo%Ln-&hA zsjKUbNHX+zgyN7(^WVF30n=p(hSRs=@))&cmtM=tM9q#>^8fSy@&)K$&xF3rLH;{h zE&8uGZr@aE>N*vSDfD_nb53@C?;sTEP~x|`YSdvFIozKzbs4nus`g%=Kll*1@KQUa z|0{NDdXOAZCL!Lb@-YSc5I( z*;c3j*Z-}bxztX?4I*9qScd6@D|bgO;}GU=a%+oQOqTuPtv*4o%c$~hoSBD;T^sHE zBZDl1%h>6grv%7%XchTUeVs${ z7h2}J%a?cWub1rkFOP$(0_Wbps$OJkURk&`tD%+e zsBsvOoKW z^3EMsBxrFniR{%62z75IRCN)ngs!Hyv?oH_GHUy-oVCxKQd$3j?=KL~ly{77e+fj^W%qp1h z`NfBOZ4>8KzH?5^cZzTK|ba5{5hqMEtjbVOD78|3fCci15>F z_a`}exTzfEix_M~jg@`7>o^raNglIA7cXQdG9I1E!xBSHC+(BU*kxS<7YPnXCg#}w|9+XU5GNz>h$YTZz&HjL+4g^dH;eGe%i*%i8 zh3uG-GI)E}ACFG{>Q?hQ3#P}O&kYe)ogJ$!Z+{iR3j~kf%@=?C@o{i$dowSkZbzSPYV_^^s*bqJ zPm+ej8c{Q|zqxWqz1_|6bTlc1*(l;KwNr#5dbm0}y(opFTC!X=KuFI=zB-Q9=%38E zKji^10L-dx-5#YWP)#A|k0vADe_Ol@PTuidgn5^$eHl=(sWX2SiSbVky6fmi!Ec&h zn!@{LxvzUYUO~1w2MhF#*O8*S!YC%G?D3G0p(QJvx8MZ+GC^_wC83qpchfa=v7K7K zN`ei!zW5L>+(ilhhX>atHKWu@4&t(tog(iA9$FSj1z!%s-~BdO?RyoTDIinH2t^ys z?sPek%iq16LRDh-cfZXoPK7C8(`qFp+LTNRC~HNMj5QbRYu`u>rby>2*Dw|)bce5e zLx80gE+ebB;4)6lv;Tq4_edYY=jwyhan)hsqQ_yKt(86_vK;`L&DYIp)>R-H%`UP@ z{`?Wk$lmOAQ;+Et*fz+S`adSkrz4(O9Gg0cbZ!MLff*SMVtw zaFXW54NR)JwBvL?iRzzZw=OdOCy!8bz@5w^p2x+0DHiNUAgSm??N3Vvj@pq5`l=Gs z8J3?CCl(g_iKzQkI>V-orIIdvLnz3c080u6I?*}3t4PUT0m53HoS=&$(cHOMdA1lC z&HseKo9Crsrl+l@Zh(Z8AES^vJ>zmo*D4A0lr?fS*HT#)3-Csyb#rxlbR$6SmvLAH z)#}MwE!4~LN;1|t5?NJfD1`23&S?+SW?dDE(H5zU=FCt@qoPP1xdc`^xxBgLGxd0d ztG2ZiaE6z0eREg>Z{!BvPlsrJvb1uJnZfvcw!(8bm|S;2#N-km=B%P^rmiCnVt=$^G>0N-u)t<*})en|_Z3#rJm8*zZAm%3A99jjfwOjnBv&2%S2pM{5- zHf>G$H?7TZ6q#SE?BajsW&S)pe|?=F)cZm}qTRDV*8a{W_j}OY;O8G9UrNkRD$S@h z1e%-ctKuNH(Lt0CaU{FUGdliUKL&efo>zj;G9PEOfeD=pk^G2*)mzm6x@AM!GKr)@ zQ!-*}I3%3_Xe9*4+uw~h+G%f(6Z-kd1-Isos_4ZgOz&)J@p+n}YXT5nf*B_3tHs3O zuou5T0SUw~``w;Sr4}&b z&qYpdZ7Z~FL1I-M`Ap-xU&d)i7nNNsB`wbuXHpP<;pWg&arq<}G0ta~CzPkT+DB`s zV%UXu+8enqPFY4ZT;F`WTIRg^ z`j1|BErVj#^ffAqjU^DY?!0)u`{vmQh1Iz8&CoXWoY$D{}lfqEhXq^ zl0a`JO35FeUzm20$No{BjPh%9vc^MloF}y!i_4o&>U|CQU}v~`x@$cP+E|_lN~Z^9 zt00-%dxb1Ft*S^7YMNH05rN3%CVk2(Iiv-Hwl0;_2e(Hla4H?Sm(`NZkPj)~V%pI5 z`Je1L56!vNiP40v&c1hF@lSM>QX%bvabfG~{U}+ms`dHuVd?-W>!_Y12X|27H5HOT zr8B#^l0K_YvhYz>Q(;M1%JmWL^*7m^&j%U67f;W~bkEL|hl(o?AKN&NrlQ=$Vf|~= zhfU>eR*y+-n^|uC3xl(L`ukGN8Vn^*r2-71;=r^gQ=BWm=FHfw0)B^-Yi^KC(A+0mzZd2bj4CTIn zNa;rr*5`Tmx^4MX)5JWTda?71Xrp#NKTRRtM$X^ZP08EeyZD@Nh_hI!R8M(@{>7OV z$E(c!Dh+(N<>!%8VHFln!d_+3rZvMJGv!17&$&azrI&)VKWDOM3IA^}QrOrL$6uJdV$Cj{N4HNN%#Vat6;!4k1 zVqFRBUPuVVisK;0_TAa#&d~9;c_)sWR);gXO=9e*x6joLd=?@VF0^4$X1 z#Dw9y?^;~n?SOdAerZ(S{j&GX2oC3VYWDBc-LbPfHFoz&i<4B;{?9_L(@T(MubC`w zb`EzHNCn*VFctzc+(y7_9_q> zC9}*%$BnD^_FxI9t@7jAqNzAm8f7}pv)6CsRMTwLxdGJpMRTuymblhNATeSb5$AIG zt-EE_r;;I1fL)&%W>R9v?$+V>(-n}+^oD;Lq>H)*5VQ&2%NG@A>kHR*ySszu&pvE% zR{A62GCFc9vK0L&L{==>+Xym6ki{1$;nt`Rv_?=ww_XamcmUfMNAzqSObg94^Lza| z?na-HTXI!PAR@xrJ(%z99_(oyJ91cS@j>_8>XNWNR^s+&wnkDvWH1l6^wM8$0KxF8 zw4atbbFD*%PEo77t!35o8R@72e|FiWcV>G=1EmL~+i9)AXzZMx|9kN{g|D#pq2ib~ zZ-O70K?0UE zc)1r`nI+c&LXtEr5lD}HDVQ|}3L5) z_TufOVy0fREN|RD{iu~!c_`ZSdHMqtk}h{E6uQ_z3=Yu_eO6CkFGhW;B>DSin>zqN z-wtNOd)k#QvU>jDh|$TDAMmr1xmmftdcX73fN@!_s}D4Z)X|;x#!aY1!IISecsxoh0HvyWExuP4{qJw@zrg)Rf&St-TX57 z*MYD9vy&AlV|Mo23^8N7#AN$Z6{gM0lvtR({dgHY74AO1gF#{KvoWBaH=PtxM_E*j z!Ajl;x(XNYVOCl%45sjadcI`^w8l3}k4W<)VPa_< z{d}+QKdtRc`l%Y^v$oo4jVv554M#Y9wU<`x>NaPj!xix1uHLnskTA1~f?mb6wX_&f3CTU}#fSAs(yMGnqqpnXq$+h(E>#+-uU}k9f3!%T9Yfow1a$pk zjW6-B@_4&vO<$oEU{}sc54Clt7fiyDeYr8;FG)Cw9MOR&al+%M6&n3I!Mg3WW{A^g zR>IS6mke<6!YzRUkHEaIk1zPded?JWJx(A&B9yI7)_&6|;NbcgyLIv`**eL->cII9 zr_>^*Pl0Y}xx=`%Lu`^o53%Tso8OO%7)O)=Se;`0fzlJ_Ugu5j86|T4@$3)tmZ}!M z%Tp65Me*4MapZ_U)fI^LK97JepmE&1LQAS9yka2TMXR}D`$;PX-R%d$x)@r6^y|rw z9lp^es^>Ra42-6&qgr|}m@lKTY#F=qkSgNCRrN#(=KuL2I05(rL2KGBkojbb(}?CP zA3K`N?0mKg-(U03u?ow8DZ%Z@MLJM|h%SrpM`hwe@dS8$YG2v7rr*bGyzjL4f3%Bt&9 z)1A#yGzQm|@Ve^LH>1ahmx~{~e*sn63YzQ%I%a)$4GAX2VSTGSBz)1kS6h8GAb z-=e(=2Et?c*4LoZCE$8&3 zh<1DJLu(;2McXd}W&Kwq@7S`g>gvyQi|ERGs@6 zP$EpNCi~qJ-|eOt2jw&0LP+Qrf}wSa_V!mTUX^h_xVp^wB7RRM|LTEZ5lD-v3rzNz z4**nfu7BO09=)r;O(zd7WWTJadOZ2vP^p2bpXWDPTlgTeasKM|?DbKCj8hV$rRZNsK%55$tpEu)IT^$7 zD%r)h%E&w%z-TZyJ&&1Xt}_cOidZurZjv0KCJoy=0GYc4gS^qh9|Tk{Z;y_uiQ-P> zubRw9)J!P6lYFf8 zg1CIfPZn+v<>7UUu=FZCyn3y|Q)?Mwd%=~?#HasOCf38BiM5=za)j79DH;1e3Y zI^gs*KLc03H2mv?JJgA=%N(OOr-9_6MoaWfXBWhW<|SO)&(x0UcC;g=>68hsIlN^f z$Z)2Ny&EN=KD|sxgJe_%F6(+{H@b(>yXl9=-c@BUr)YI?b-W#%x4W2r6-^!C`}|P8 zr<2@L^|#mV_pM0ymwL@nX>e*Wy1-~-zg?YSJu$%&Si<)mdEpM zFr`c3R(aF4dB>wHS5K47tujbuNe)uUH|o6G3eCa9@*lbv{KcZV%d|%9Bf}a#2;a%n z$0+LZ65X~4h3R<1D6Mr=aHFct^;D@=ZIZ4ys)2taKx*Z`=0+cn^DvY&1lKr9aL zvxl)0eE3uf<(?rcU7fxno`iM!UUAlGL)}ut0uUr#3bB_?W%mX&0JA>Lz_=Uj6MD2K z3z>1_zneNxgd)kJkmQt7^?!1aO3cw$nw8hd7mN_Efgmm4E)NV2dK_M0!W{*vMyB=; z@gOvTF`~trK1(fUIc)i{Aegs&{66`Jv37}|`J5{*C07h^t61)QQy*s7O7OKHge!{^ z>FVg6Oql_pFB1MOU$Zwy9+_OX*#@5^qI+*Am>d=+$Kf+eqw!zxk~$y3HOf=my6&Q@{LG}tm8~g)bKUHh*#_y&0JYb!xv~le&xaq&29N+1 zEdlN*BJsn)^O)$|SaVEacbTWO6^y#it#mG^Z%k$zX8$-Neip2!(F`S*7-CElZ2;SC zTN+!q!}xuT2qqHAZ@)qni?{f7x|ysGOy~GK=QJLDzgjkh)Af~WXWPF1e8Q4&B)@VE zaUUP^Yu{k&09jxA2HXFQceGB_!q=`r(FrZT_6?d|Wcbx@h*!S8VssEt`)k+8H@9xVOC*>AdM^vchll<}9%}JG;-L^yj91AG{nLByo_`PdeEH2P&Wy3QP}3^_Sy7#cSX{6}P`Y{KMgC z=N4$jN|X~>wM*>eHj7piP;$SWn$DceU&;wLI3|AEj*} zzvuD9e3?^o>Z6QuF}X+HE}(*;x18ef)N0hnb7#H=Z-GJi zW*v={QNm_OJ=m~UwAIRTkMRQ5%Fqr&#d*0E2^i98@l4>i(hsu6mk5|Lv7r#7O^>

    0ZmIm%|$x#YAg?l{hRl2P7W2!+uvbOj!yPNU-T9Zf zj6qeJnV_De?|TgBcL52yeUvh%amCx^;?@B-uZ{Lw2ce@HMTc%3&C&IqAl(wRhIy1m zY2R&Js(tj2e97RO<;Gy!66lrSvZrpviu}Nr0GQvsk{t05eCbE7lq3D!+tHEV{}NUH z{V$`hhR~$P#4Kz;~Ys0Qdu6f)IT7O5E%3 zf2kPp@2xmj>HAkgFZh8k{fIoJ)B`~K}HwjcP?k1PR* z;QLo93H|SFFks{duJj{&C(i!zH9TTP#9AI2Ku3(|#beSO{eY3WY__m$aG$BhUl;EFjZco>w zcsTv})9)dz-@agnwETbn&;L7`uIss!%FAF~(7n!6_$h(I>;KBTs{Kv>h5zJjCFjCX zm--!ZTXo&RAY5GG{uQLCX>+Yn>tk`$e{>^x$Y4$PfBSiqsd4t=FN1Ol+dT^cpnw*5 ziu{L4s`^C1JX)`)@%sbTtQV?B`8RNiTJ-8*DuI`BE3fk19}>RKUDd%y`Sy!vu)!B2 zEh(hIgHwdPU(l+!#+{GcZjvwH6NwEL9&8ZwDEf$~gjh{7zuiu$faZ^gY7iL+R)J)8 z#((@{OKvZ1<{HP_J#Zr76QPRZ7Btd3`blS-yQOhNuB2C^kg-Gggmv2W7QeZmW944|^wX`{DDCOB&qn9Tkt9Q6JriQr@9`1-e0Tjte|-O~ua=*sU0eIE zKb2rT((W}m)()L=V?ChD*-KWJw~ykPrKx4?UGohYt-wWB7ub;+O3to@u0%)9Ld09! zoWSZMF{v{bLlpilkhV;OO{_75_wGGXcP4cLb@I{p=KAOz8f|+*D`ea*ahAX^KSF%G ze1D^3Od|(*$R_0=)VkX~h4uk}f!za&;|0QOnqu@-n5(H?io*lvtG>87*6#}~3BR<0 zCIO?#R6cb$=E}uNRP-o4P)J0{OSO?)vjR{d!n1d97q|(%P0zDt@e_;`cuG?mknmlV zH^^>t^r`XDhp<7fI+}rN@V)-sH>81i`~UJA%>jl`@hHCcEv+}~#Owx*u_)i7q^)qc zj!qrXNb4yCIkkmR==nZUX7@LE@w{Zc>QWTZ0xFX`a<4;-glZ!M`LW{%dq@{9E$qVh z-Jh4<#jDt)B)*X6`T9XpuY?NJ_-wAAuESpZ*;8}${MqW=vQ4QGDv_yVg+?f&>1?Cd zIMH?~wCaHsc@jw5n}zOa%hR^KVP~rB=gJWp4bBk2pA&^K%sP0z%mo-v~6@o?b6en*CiYl&=iGuMi&U zy@T#&{+e>^R4lEO+LfnLCj&7t>m&6njs713OrATG$SB|r>!`02s?b!YYHf5T5s52u z8z`f016PEGmN`JUO}(*4YmSA_Rq@hmXJ3-fNu6rnVNU*bS0mYKeTZ43Sp%E2U960B zwa3qwX4v&$Q;t2Sque`n4&%M`+31zVBs6bY`1!zKak|Zfn+eftk7&_V`4Dy+bl2SJ zn7*O&vM1AAjUO5RogFuAAU&!ZG&L~Mw^fwO;)l`;TkG3efIY?4go+nEYyOQ@pT0&( z8SUUh?T>gfV|`ZEx1L}s4o8F}`;Xpd0Etp+OHv}gw?^G?kr zElkg0kF$Td9BG}A+<5wOo<=xsEp=UH8Tg`q@9Y3?S8^BRM(FYMdVcxtdQ>p-zcnH| zJST=$a-^QO2c*32FTk>A^2<`iEB=BHX;y5p*^^l3G`$u_Sd!NYDikZu2+wvr6~nks8t%@fu;siK+bGj>qFnu`M9UhK}$ zg5F#xNUqsuN zrXWjKQY{obbsYiZ36zdEIf&=N6kj_Ex9g_7LKOh{AIIa{SKgVQpx#s0?$=ED%(Iw1 z5U^1d1{1Y?a~AAdx*d+*i)ejjy-Bt*4Iu(cC#4a>dTB9S^GD@)rZctkd3@=ZZ!a?o z`_AaTbEw8@Y2M$1jF!p~Ly49eteZw^>kIB@W^vP2r#lI~wCHoed)-Mgw|>8n`E5$` zlc8kAE$Et%_b<}xn@%Z)-G}Br>p!|}(DIE(VuODa({*Ihb9r{eU&;Qn1^jh>_3rwE z#B!%FB#0jTlI?$>JpPxF0t)(~v7%lBlVC3#S&Q7{8S0U)4>kHn_vuiHw}*xw5@S}D zzoz8E%ZcyjhCFiTyseqsH5_7PBS(Adb;h0)P?4&$Ic^16YJbr!`|U+YlQzegFk>sd zzXYf6%&*zgpP8u-*YD+F-z#(Q1ll-qHhK{}Ajui;#5WeZy^EVBwI*=o2&F+p5)q3OrHBO}?6CnybzYDEx(v&~ zVqG=_T(@yRld(tDQKKkeW)*qDNvuFMoKS^72j@R??fvKd8 z?QRoyWRNl4I}oZ_UlFMlLc>b?R%Ez~OHrx|(8jh`aU-{*F*Qeuak5A{ACjtn)7>{g zg?v9%0{plTQZ>e+R(3RA!0$NfH2{#C(h6B#i`H9R3V~G09GC4nbOBuk@UtGz@Agl=S%#u+S}rB`uNNQ zls08_DBaPsW;@zAisZHDW8IWhR zrBkj$-vB_4cXHdYDGW=>Xi!#bc-%W^k5e#zFh4%Ic2M2KO6$*3UKyEm{W)e|X!Dx| zSvB=uYPSZ!BKbq7w~*8H##S@5H@J75-6!aOb1k}Tfw-0E-<=r9>jI5@;~S%&p6|Y> z*i?!GXY+R-ZkB?Xm1}U@({irSL5&kZyQE4#mLh-2A@E`W8&t0XjGlX>;(HAp)dT<- z{WodEIx{{s8FK`RxU>!Z$txl6Ekdc%gc)xsZo7+*POl>8ksvK4ZjS!~@vT0kv015> zUe2;iE6*>aO^#z;eugTPCTerMy#%k*mdQEJFvYtX^CKE>UhJ)Q3DIq`MbINEuZ=pGwmh#|(=ri>XlnrHiGOO==f76WaMrNBEgm0H-k+__q)f`=w>2@}Xh3fw zg>E)aw#Ntm*xw1PFdp4|(%hLpxPPoZJMxZB=dc|7LmQ9li-ZQz}x?JKE*+;ctBJ28a=ht?9J2mKd%$k{OmkIPdP<9sN0ezO`=!XYyXV zqbvOI43NG$K7Di4GI{M=_NWZlh~+O`ZFq5q$LDxbD{xx|OJ}Y{Ons$}`XN}2TH%Fm zYr;TldBHMu)nJEyP=N2TXpey}O^cW(;UXcKABnEs6?=%U%ci3=8&6uPQmJ0ZIQF#e zk|eTK-7zvE3#ka`90%aKPpsW)EMInZ^wVpGfbzjI6$eLmqFCFb4qpVItS$SExoPVT zR)z9`$tPm!gWd6yO{!o0Ua9`obJ4}T_>wV^_Em0((Aagf#-UtPvag*m*tzA^b@ltHYerei1#3cWZFCGbd&BVJq0 zh3x8J)J+a3xB1n1-CZzxovvu5Tl4o(N59q#(E`a#X(iGtbNC2yw?GZMjng{_phV25 zUE|Pw4>AfOLnvGEYJDa5&oCU=ARozs51h5Tu9XtPRNY>D)a6Wi_~kSM^TbZfO}7uO zQM#|FmEN{eDovCx++O;XuZvt^j@2JHRun`IQ#%pz9k+CoEBdHLYvA zMRFLe>1Ins*Gx_Z9$Mzp(>)Evx6)JZ^MRXFib`_jF_CWKl~H{2=zUJy8onqHSBQP*0u3}!g;^-iaflisx_ z;Ne`%v$!LUpiGO5U_8&$V|<|W98#$-ae;wCb}ICeX=?Xcxc%o`(NFjkNnG?% z!WF3JjR@*+blj$V%UX94i$=?`aHXu4Mh}F)a-usglt}+freoGrM+%r5A?&Q{Pu=1E zui-o#*3Tsv~m*VM|Lat;-@f zT~m|Qta7s8_aX&y+%;TWdC%`i4tuFyQ&qv@^1}#`1_}L^lx6RKmtozUt@&55A5jzb z6sZxdFe$6*NAyY7%f>}n#?NX!TQW)CZ@k(l(7)1du~pFTw?V(#g}qFx%P&GJ4f*q0 zz{{jI_Fv|;GlI!1r|m6jyPN9RXkD#-n!sdO?byU@dU0^4*IFHzfkqDuG-{5c`*6!S zWi_zr91e=2G~%tE5oK0hHOB$`YWHd!tIS~^8%l(|HdV^z(~J&ru_+@`F8v$kcD?j0 z&>m^Mh^q!YQlYl7RRgQv?+I5;Oe~y(-foxgi3RGtHaX|3`~M)LN9x7*q1p22RdEE9 zU6sL7tDd45xL9Zx$&^@-VXSUL*5=3WFHs)`u7gKNAn8cYKlljjz*Fqg>_U7`@Orv7 zW#jY@>MrR421-zTYaS*~Q?;;y`Et?Bq%b7s-~CQeqXzk(Qw4$~3i+ac4+Q%WSN2^0iv#Pw@R_H#{KdHdbOy$$b2 zzu{YvII+mBvxS_*SFn5{qt#p{cDf40M14-Z3f~luYSAvgZw-s7#M$nrznq8evCfr~ zo$F;_dfKEM9@7tbSyZoR-cKcmd0PN{Tdw_1+`CoLfcuC%zEbY3p=rn5INEel8y+Xu z^?c>=2HwN)2zu%UXl5pda9R@{$1U&bdmOomBk~S~PxaCuU!6^mfYg*{~J#OSrr98~>-lxlIb}|7?DWEQ;lPhc869?N`Fy%mq zXHtd65%WS<)**`ioCi)iri7=Jr!iv$v<@DxjbOtp$+P`!yy`@rysLZt%2fK z-d%gD>l@;(H<{Mt*#;ueZ7F?Fo0Bz5l4hqGI*FJT=W(LCJ2!$-g3adQ5Bcz~*5cZc z9h-0KE?36Z*ztj%RKl@GD){(fXD8oKrPK!3WH4tbJ*d#S(!Hk~d#`Mi^ zInC%r2m7gt*A;A5lJv17ZZO?nH~A~LdNg2lBlxdSHY!V4*R4sZ`0Jo3_f~3pZ*-#% z#mOaKVMWmR1rjFHD@Q%9k=w6rvVyPRv;XqfFNf{E)ZxVYJ9!- z8i({i$CNeQy#8P;VyC@g16myzq}QC-3USw7Vk;&~uRfGvdhm#VqYi&euj!JHuV_sa zCI0z1Q^dS<45q>LMZGox=dXcORfJBa&$Kq$r1-TXt3dIi%-!BuzCT~CnklA8T7~-y z@;teYpYpz-QrXi-nam^5xgtV9?cy-Do=GdxIkgEoweLGmc77d(K#5}l{SQ|6+kX;Xt=;KI0`cn~YYKq@aB887dUtOo3AoG7+BbD1*u zXmlMPw>(5x408XOIXDwbw!yd4S~Gzm;WXk`zpr;d{+3gJScKE_Cu}R>>1oLU&|aXO z${%tpUTojLcXxeSe*T*W(t@)pYk#3D9EIl_8(Y+rh6Sw?H^@|PCak%qFKMFx#r@-*`}w#;TGFE6ma1C@9^k46^f;ZH>vw8{=@1TW zTJL)exD}nJX+?no&$a%YSznoK34liD4S(7j#cYhnA)bJf6DDd^50!oUMWRqMtQQmA zcMGebfCkO*+9o1zzQ{v7k?w6S62;jwltJLN6^&`W+6|d;t4*h~FtnEbv+-0k!3P=@ zXaYS?=DBAH^jgf7@ILjEL5wgtqo_~~HN$BrNKbReGJI`zElu2fr&S+ijRL*T#$Ij3 z-(_)$%sj1RaHGzT?=DIWFCth9YfjIpySjGF+3x;UB-PRAG7c6s;n?En@=n1xSFf$8 zQ*d7>!Ue+WEexEnG>AQ3P*83l>o0YsCqtt2o|oF5UaEk*HB%^px;@$5`Xj+eXWwyz z4R0?anbEkt-TKMm$1HHS`KDG&;qF`gc!a$}Dnoy_U+1t>Q z(;DQL$bBex%^v2*mREBT4$TK?>LAF&?{N##ZXp_=ami&JE0CfA+pnXA{DsvX<_DUs zwjN%gb6;8o()p(rj8$pCrSsK~_DKuZ8nAz>BvJXjp3z3kV%ZLIb%4AUhCWTm%;9MrAUYG!l?XFa<^ zX;*KeVe|B7l*z8H#A0Xu`Iba9u0hD>RMpenBpDPh^_r?9*cAH8O&{O7sylD(ISIGR z>A@T%(BTY`^x`}_Z@$!uhaR6OPG?bez7W?7V|RD`DJQEhVhHnce<#DF8t7?nT*%H; zo@~K0uH)%k?)_-lkLv1!xZ!qmo^I}C(8vf|W_hv*7w3KIxgDCgsN4feXU>2XN_YEa z?OB0W-h1HNX<{i0j_{z_6A&M_ymY>yhmj@5r`URLL{!84L^&q?kw*iAcrDC|I9-fV z-`+)skHeqr9ye>GO-y>CON$X4N&7-4-E(s|;5bulJ`Cv|ytCz(0DPr!hyx=9m@^d= ztiF#I(By<=ofr_5ZtpbmII!A7&kuf#=KZ)FLBFiSF{h6E|6W-Bm&_5UYP2zpvA2k@ zl+pf^$v^hDYb^Kks6OYH`JqYX2622TxiSS}sYv*NZ%U`j!-s(QydL!TMWq`AAWM#l zv-#o8)AIDcQON5zYIx);nzh#^iSFGaJa=Elfxd4YmD81$Xf)0EA2E)46q4;HD#AF9 z|EJL|94m{lX~48DEYctSUi=DX44OKf#Z`2|nx05$4ZOZLOQx#RnkA}9H-`FvDI7XL zI(k;>6E%*ptMU_8bXAFs=J|nk2k8X-^2PqB54U*d z9l`jihL_9w_q-n9rOa_N{k?w+h^z_+EjdzplQIVI=bNP90#^U6Ydt~3z~epv5?o0a z1ozwFk){0cdRU%j;~%F{u;!I~^X>6a^L9uGyHh;Is=sxSvKRG3bqyObDn+Ue=Z8yq zqsbt(EYUsA_T3Yi-5-5;cNwB+CHa*jCTj~b4W?d6XA^079r&9~mq_M8Z9Q3c2+O3< zpVnROc=Ue$=J@nHIkiR_ z!KaV8NTzp4sHEB=u6~Gv0b7RD%%4 zF>9CcUL4VqXKgM7ep-%| zm)7Cb25wWbI>`^4kY(A1tE1EjP_lfRwkaK;Ywa!Gso0(aJbj0f$ zhsxHEy{YYUJcfQwJw=2YgL-natiR>=*GuDOqilcm4~qoS$xEQRY+J3 zfCAw(#nW2)>Y6&?np`-jNlqteKlyB$5EQmn+g8>OLTUMNq3Ap*4??VM^Mv6KEk{d4 z6}_eFTeTUUv*bHnm)fcxNeF6>!Yz1ssmbGuXrtfKlDZa^2Cbyy>QG-!M^kJj;64`i>`@=MhqE1;;Wr-gX|Y9{T1*8ZAZdiL=$|HtFPE z<5km?@pH*&mnY3gn#NU<$)_|_X@?EnkVt-sZ25Od44{EU_{~&OdG)5ovcUv9C_0rx zAMTtZnDiG2x~v>&sZ7Gq4UPh15DG}W124p?CLkxdnL7BTCXtLWUNvDHr6aC@?O^DE=;bYv>^Xe-c`HKJN7Jx|Ktg zzv{OTX(;gHSI^zw#5eQMuvq?H|JdD20wXWqy+=lVzp#GgLj6;hm3|DUold9n4knhA zO|Kh3(z7KM>lFc3JkQPuR-!~orwW&^6-0*7@`A3u}Ru=l-JqV<_4^x}h)F|PJ(;Z~sajXCH6oUwoB^!RuIoB6P7k^x0eG-o4$(<_boXqkTCIGy<%!6H)gj*ahvw(T$C7PsxV~}F_w0=+< zQ%+>03$$OO!@Q6fgGCtVwOelz=F`8|5~V5Uo%Oj^7+}odJEe|2_mIb6J9GbvpPeNW z6316R=)=WL&fl*&(xWH)vqYisTK&z4FJy)ao7^co&=j91g5c=of(IX$U3tBqn8N%m zU484F{{8!ml`wwmq*z5BQc+*er_ZBdRfemm8ckuZ2Rosh$Xs!1HOu3VFF9!0O{g1@ z$sss^C@eqTEK-r^20DTkI)&v?wCRXM^&!GVpR}$3KdrQ@ziHDJxgfwsgLu|KN9nXB z-Cafzy;bs9JzdG7oT}DaElsblLW;ce4YxMRr;+F8XvUYNs=1wel$xC2rAE8aa`o>{ z*7)L08O_y=AMU;M4*L1kex`MI>3->-d5_{|wXVS5w+`;SG&wTn&+X)pccvQyyRHO? z*r)91PILKAoV77dI#G=GOzDu%uhJ2ry>Q`(HnzoZSnq*a8k$u3au$B@m* zjMNyYN(JFb;Y?&k(Q6D*`S+~K2b5HvapmjYQ*jzFYf+TWqD-G|KVyBx`fsjH#JXJa zvFG9MWe8I$tzm70Qm$sC4_gr3vVVMD+dBF0+5EjS44inGmBqZ6zYL9jNmrg7e^F-h z^~-1m3J-24sr-klcI!st6LZ6_%X^qU8Kdt^oz3rbXCbMLyj{Atm$pR_!QmX>Zgn#1 zjg6gBZVueQtFyrGmPct0T$+9yRy&zP$w@iAF~i3FrFT_BD``LeoQ~>0N1H?p4OJ;a zu2%19A^)9QXzXSq;(OI8LF_J%btfKXAd0%(lx)18DA~STNL4+^Aeep|m{4yXEhlE@ zkAbaKA&4xLA6qivNRMvR)~RJxl_XXFj$4`Tq|G3lxQpyaC2kMzg^9(EwXCYnk?NgN zcySe`fx>sE7$9ab^&#i;ekO=#1ij`NpO2M|K3SLz)8{0!z-bIMJQ9}nvJ43>6!UoH zosZ84XaVD#o=dA4S>RlI{UpsVM;s$dw?Ek)@9(<0QP(bC3=$Yf*CMrpEBaQC6{leS1mbjRPi zJ?Q1J#|iEiC>ZSx@);rTiMjgSRODU@FDh^^l-`%i0IFx;o7M@=W8BBa&6;mnFQClq z?s>(Gd9XI)`Q}qV?DAA+bUO6-=u3^D!7}1_D|T!K)=BZXLIf$?Gs8%v(yfg?3H|MbkOIMB@>t`+Yo6%4{~Cc>?!A;CNxGyr z&!2N;xdbxL!gKuc?uaCbiQAq(8UShuQa*jGGEgL*#3*YETFYWW?`0|V7L$7giOnd)5OGfYgK6;HCPoiAl^0EKMnJ6;*R?qX zhHbU!q?8_&S{fK!B&s=`*QrGNLNjqXIvM+gh7ge|R_kz*pEga9bc+6~y`qR#EoeFE z?{3apBra)~ib~G^F5M(>WTLA)d_h1wAKV1U_F%L>+00ZqR>Dv(83Fwu6BA-rTeE@| zJ8+lFqXj&XjC$63!VP74WEzE$S=fz@o@s;)<_{-2NSs|x@a*nIJ=(%QYp_L3qTFT` zt26iSAw5FtBrV2%tzgof+X@F@l%8L(QslcWtDrfvwFbd7of6I@pX=)vdbC%3Xo(ur z?%Btuh~VR+1#lZ8T*V?GP?)WS>ed{jhEG*8mZFKY!ITk8YP)+Ie@-d!bp2qr)f<@E zNpZ?~{4#ng5fj}bW;#9toYVwoF+uGP5=p54^!=MVQQtX}Q;xk0n51?;Y1oVRi!Z{= z#)7nIJ}8`}u;@`sSIf8Fs^lH@h^Nt(?=-Buyd$rYR*ZYs@3OF?X_n)G#LxW%EVef_ z`;BNCmUVCR&)qdjS4!9T#bi4H41NLr;##g92hOH+?}WcwVB37AK3alQr%q(#^D^FGx0qf3BB%`olkb+J2(elV~EKkpWs<8#V5Y) zFh|VkEh1Tt3~j(+-*uzHyoxjjP;KgR+;%H`Z%B=512D^I+eE7nmo!n1CiZ0&UV1`fAYNNulqiqxz z8N zs7VRgRVuI|^C6gZ?O9Y@VdhQaMjZr-EKX$v+Xpbsf=0Et#GSfPlyH4<4-n3DL3@$i^;ju3C5mI<24_Me!5Ph_2QOyU(Ho(aJiV5G==|Z1)7L0Fo|NPI@4usiAWvkG z{&e6_vRf{$ir%?o4UaFrR73OLjBB~(KC_=^NIT(-Yb@!wWR<#IEp& zM=|)7;r&KlOoPeav}XQvS(~6l1s0Ub&@fFA&<+koSk*U^IpT!06KU?DFYArIJNv&@ z*guVEw5l}9i93b8w&pl>*;GE3%~@Yc{u=!fC>^n4wB8VwvL2@;)i2F7nvz}N^`){>1o#^YP`Dzl$wNs`3g`F#guOt*gbwTsz z_a>aEV%zpQYFjS)pulAf1)(BdSudC1z#t`dKH2m6#a{`&M@X4U_Vm11EZ)DLYY_Y% za8O({=21BF;L*?4bWXH+J|Owat7s=L?^q94i9-E#^iN4OM&IGica$0O4K+uM=0P(n zTLygxEPhfHeVVF8>PnzeQn6*_{LXAI$@ww0T0FxF1)}>?TnFD06j?ce-_!BS_(C-> zrhwU<6n=<@J${qGPH)%l=+<2#5^)d5M_(3itUSye-H`7&n!R71|0PM)CW&hgtQ@U& zI<0u~!S8ubDSkfx9%ms(1Y1zB^YMhQ`&Ybr8A?2Xkfkd4vR9Vjel$dJ0;rzmtrn`Ir3hUfvoFQ4mn;1e`{+UfwOA7m{1KCbyNIQeEC+jtav!ow3CkVF;CBn zcKI7eB)|%9hAt{mkJk3q%>ChNbo<68{a2?})c{r9Qy??ZTkQ~2fb7a-9g^TQrkA*n zH#=5yiW+ifbGDPKDv3yHL$Ah!!mSk&OravmE1cg1FFivxILP!#2vOrM)f$3qClz{j z`I2c|zHeT|b&+s>W2E!!IdH1F+Y-25_rOMq5pMG(7^!KM* zcS33VJDZ972dR;CofpOKeL_}?OGD5KJs_G=eY+Pe8Np!7mDqIO0LvBc+;I?IJ_m1{ zg_`&t#8IFRQDUnRZVq|SL~@!I3P0$R*|3_C2{XlW5HBl{#&%u#lOhx0 z;!92M+qWJ1H59)$F6K7=K|`zUB~FKA9+_Zq)$#Bqk|P4KeRN>E+%VCydQa1xRp za~}6!K<<4KYb%+;t*DloC8shoRcgI71gb_M<_d88<2` zC$3NpTeq+VId;{y{t??(w2>MH&d>Nl29KK!ur3?Z6;IXYYJU1#viCEGQT<;h$7Qt< zIF*8enfJ%L)>NC2#4lXTLwLb$h#U_M*GA)*9BU;n*@XM4e%VYfnT!AP44t>wprV{Q zCa>76a}>Dke%WT48ke28fsyB>s=pxS*oK|GqM2Eb_4!}(4>(=8jba8z`q>5z2-%}D$ehTTIZt((EIuI+twH>+@j02{@Dd8S>|8x7)A%X zB&NEDl!-qCA3B*68GjEtG6=U@&8$UKrpXH{56ih|At94f=)m}f_C|aiJOBwko9m(_ z&TF-MJjpcITKO)dCmNSWo`YD$1~rjeo~f_zsj|zrDG95jMaI=RvX`8G%>!(~E?!B= z$XfqGZpnX+aJNe%R~c@-YF_M4it$&^P0Z8gz29Y#CxfizLMwEY@d*&+_ixOv511>x zalDlPB2@h2D|tc}Z-W;GJ)rrKY?=SzHOMsaa+{SLDl67KaKd|Ge9PIEq`8ER8lMpn^>Mp7{Q+n7(P2yL~ z!|0RNaDRhafOv-_PO%?*B~>l$9zqzIduvsj|8Cl)iqs7LCca0}TG}#a^=D zz|N*P$Ka`UAn7gSvddnNUUBlbbI|2%ykBSoO`sRvpB$oNBI0-2N~uK#Yut@Sd#D`+ z*2VRwxeQ1-JWT-UYx($Inr7^537?uXsf14;JPhApv2@ zD>tUP{OPsc26mi_?kmzm*1EM44N@e^cK@XMPlJ6pzrwDF-Upu$S7pcxz|@EuUs!LDCoJ$-$D-Fa_^4M6-0(><-(#-yVVA+ zKlBR(&;JRiCn0Sh;_>xWsgB8x#!9sqOQB}BMDOBCG>nVYWwZV1R2~;BnC4#eQLv2? zJcQ|*XqZQOotl^uBo&!?5VJE|e9+V(`L#w-ecc;<@Cz+2M>{q~!q?=pMhCU31b;UP z;j=?MxaQUK>9rp9P)2CE{}|KfO>0T}iuR$JPLRRD!R(bDV(U24ldC!AX%h3og)`v( z{H=N{KRSqAu>{E^{7;ua4{~C1bc5j?f3BQFqxaf3=FGz*O8k%rCBEGH&ABSa=9NXa zS;KKafuiqf%lpp7X-p~Sjq>||)`Ncehi|tfCuIgug7O_>xh%*tVw5<`^ zeQ8=nabKMTp85ETWLB^k^h{t6IPT~;tI>s*aoCvAW1X7Mj$&pCt}9@%KlDoGFZZCP zKbKCbK|F-;Wn4g`C>>wMv_DeIgt3%p=Fllh z=6zn&HV+=ZGJkLEqJ5~@MJ;lFx#xXg@efV>IK;Q^jbqAzq$T)8+?m!PZ_zFy%5buD zPQgnO3UopD!kDQ3&tPQPuXG=&mhJPgLX}SroAB_`@l8B>2!A zZS|#Ki*Isa!NwesY#~@g`>4B{cc+bCwssz<=BTMifypagh1;&ak(p0YHYBp&-UVE(v3y3{( zaug6;uoE^(RP$mumr_je(4(3@pu@7EVh9gfA!Wny%!^Juj_uXd-K)&FQefudPYu*t zn_}wLO&3#MsK(@Ke;l2!+U-?mUPKb;&k;`$qNkJka+1&5iQ0^p+1t&l<&I9_H@%rENw}*S5kW5?iPg zJeU1Sn3avCchv^9j+>>2A^azMS5oe;C)?{&;H_4xdzrUNLU#7XyRSWtdd%cW0S;%~ znmTS!MSHia*K>L3&*US$2cHq5zwB;&M4 z4?(QZ8frUkdM6fXV9@v-&E|Di#s(roI#+W)61DY-2v>WkgD397;#5LLo?m+P?a5si z&C#hTbZ}!-G#5AAEx7xYz{*|AO-rabOXR<=_>g%`n3yA=)id|{7|<5wSj}vgzfe`v zZglsQB6UI3|MW-DI|*uW;nS_{Z5)9YYuj5hvqzKaPqX}VsQ>I~hg~_4Y=ns8AUFD6 zZ!)4JyHtIXq{`^H$1q9@eepuli2#@Ak>ufHibT_u!rQbx_N&Hy=Lhqe5X}kbE}MEf zXPsjJstOAik#~mK;JgMU;4_IuUxmOZojCpb?(yQZJV`l-zChlf$5r@y^+)7bxwiRo z0YiM3wZtLl8kDo6!7)mfy*@!NCbt*F7K8mtW3iOqqz)m6usc`}k~n!aKSk+C9p?J7 ztZttDsYdZvOk_i)mk_8b*svrlF;P^;X5LzU)4Sjbi<5BntjMMEp{rZpiHz$otT{cl zIZd^Gah*b7u9E^CP13woaRPH5cq;a4pI`dHP>hxoJ;NT9lJGe|8q=pllPiR0sx$Vy z-{Z~)Z>)$yB5C~M1NQ-c-kjUYhxpq1{HW2qCmII^c*0ZCr3$k-YI>8K(=>UFk zqMA=2$CS*LdIe_~X43lpRVG$MDn4OY$B4HDgGvd3wy z)Sf0-*I{|Lu3GM6$kz~Eq3mpN@Ee`^R$B0nv{=x7d6)nDCGstD#awQ~^GS94sCj)7hz zrqn!4UNVfebHxM9UNNr&U5fh)sjxK6yX_z8ItYdX#>f4xzDSXpXwK?FJy3HY^xJ>I zt%aUtmg>yf*ZWAPvcRcxmgB6hUwfHuf5LVQl=c}12@S9)ql9!pHpWG-z)aYd_mb}X z&{%lyghWCb7bq>o^tN(rF5^S~+&_5UP0PpbKDtnfVzh%%xFEF-yV}{@!4xc%b4C7; z-#uNr$Ls4E{+yiL?sR*)`P#dLxmToRoIXAE)$YNH1yl2|Mh6!9ci~w0wwM)`%Y$lE z!HG^OWx~x{2S!h)2eO?`W$c-zkdm8+P>}eRdDHgFNsh$}b%2uAiP@8HsSPMK=_qbm zORm3l3(gF`Vtsp(foz5$xC*bpBWaH|FW%=K*gC@t_VsqGUDsOugK72Pm;696p|E&= z`f5k_sD4FZ6R63T7juei%o8-Vm2a52a_b=y))a%FA10$gsB#1D+@1+BX-SpnO!i6! ze6sJ;8BBRMycuh83F|wn;E#6v(YMx8fW_Bqw8MkoQ4|diD6^N;w=hq_+P)<&gi#g5 z$e6+o{i)I4Zb?D`aFXMp^shqK=B%|^k133!Q2(={0B!f;7_s|hNYhJOtnT-U*!E12 zd@7WGF#5w}f)YTqWC+ zC8!KR+sQ8O9O{?!Wl^;M?|3cf$LF5Ev>R#nf-&>Vl(~een{+HmR;>4PvT`}G56Xg> zl0vB$23O5Hv=0}{V8I$iqq##dk?r0#%K<@4pN!K?QRQkZj;`9DgQ5O2)k@Ae6#JCW zQK)^rqsJ%a!EWwvJ$bTq@N~32UYqV~YPD}Fo;PELpyeC$WQYPANNjs(-q$Ob{05mTIAU<%`Dqf+VR+;}!=-Ogv$^_l${(|I%GY z68I=O|9!nU@7nhD+8<>pL5oA{8g@pI zINsl+xSmeN+g57Wc|H9*){F=U`Lj$-fgh`P-m0~%CbdK$pwi_yQ zXP6Z6`1h`l=xLV)BvU*Gv|b9_${$j=&hC|72A2bmJ=--u>&QHmT59GgF|I|cj z0t{o+p1)`s2K-T3a>-4dlY$vlM=wC?`at{$|j{zlvlSC?Jmpmd6H2TTR?BAN85 z+Z%#i+TekG(+kAY_$i}Xy!$f!DO9k zs5_)61vpH@fpXt<57wO}Sw%knbn^}u!*ez6tq2DZI*>qZ)StLLE^Il$_%29UQkPsM zYPS$LZ}PZGT^{70Jj2KS$@vxOZ7i=YIcv#ll)p(I=UKJT2d}r$TZ2%pw(ZV>fShw_ zo`J)=etnVVI-k3ZNH`Um=jq2eQEAmfXYhGiTZ{IISVLSNf1VR{__*tR8s6^xf(H!P8BTFs3kO)9$`3zQAxts^}U;T=j3U z*M0L~j$;_*cH$%3*F+Cr<9}j|Sn40t&yB-XxaJl)dv7v2vuSQxv77gKbjpP0hwtZ~ z=AZe9S>MAIIq!~Xw@_X_#YT%G0ruC)!v1UQ1FtAuH%kMhp*P-t>2aApa4=rm+Ro#t zjEKn+7KJNQy^RDOAFicx`wU*7w)^>>2EjCU=CZrd`(C4KM^_3nlTa=&9jn+Zb|;4h zE@8~wn1V>{H^TYgzQ#1S;Q87@q70z6brIHX#@9WqQhDy7MVE3|FC%>^4ASqEr+T{EL{yzeO-W;(I(?Bwj)pS3&mAne86sUna%#Tio8 zAU^;NQGabjYLeKI+Mf2;?p2Er;rQx3=J7}StbQjNoz8(A^W1|Sb)unZ5Bz5BRQZhr~7Lx5|{ zNzO0t#*}B2i`S{EmApyte7XOmZw5vwst zgg`3}i==?_g#z(efL4cS`Xv7n1z$Rj^+pzy6_SIx*OLkUOak$5`1|v;W;uidrCy}uCgQ*+QsAqoMUa#zjY_%=|H>N?dRU+9 zKu#q!*e;y@3XWt`Zc54_J@K`gRYf9xEodU_Z~j#tNtTQ}J?rO@dIOef$AFaHh60r!&|4C6tfiYZrE4Cjx^V&YtNrBB3{V zsZzg@!A?Tkrwvn8{J2;`uUl1$gol$g4maXNbxV7U`%US895BcT9DorSD%yNi?^HDb z8ABH{|4|bN4oZ8$#wv7zD~+F5hVUb>UL1dT1NQ>7G~i`>GEgegvpHR!OOMhf(%_#9 zSf2uEAp`9?lr>0~H{vA&TV~Mc&}^aGZ*;Fhkv$xZ|G7VE2C#7@cFls{nWW=!DFu2E z8sUEs`H=y8t}WL1HYC|;DzdB$Bu*Ry9TIR%*uq+1# zJ%#FnTHP*9%Nj{k#JMQ*_*9D|TlNpyzmT1q4Hfh6wTBUKMzfeplCS71+Y^CGo%C%RjZ$!OMH+KF)f=4qgRc z`NU_;UFw^@vA6Mz(7@-SNn? z@$2o$%suM_i*lHF?$D}rs`%QWXi$PCSSw?Xl3=^A9IKx>gIxag`RQEEQYUxKQtEj? zICsW=vx=5~d#-Znwg#xC!_f>t zFq!Uea?DE(TOX>)TIWt_PL-zaQnGfqZ};9E3-6F_21%@p!_-;`VcRxcgF-*iJfEdQ z1>1rgTXZX6@I??DUwZzz@bUnRos(%%A$-L=I`H6E0h`L=T@eP& zNyN?RG0Ik|@nQiT`3g8ltuh3wn?015K<14x%kKVWv;b@%f%q7Bpu!~zYwkdi?SAr0Yq7T9&LlK>84wtnNvdo zGURh>Hf!GUo=z_k>Q5*8lLNlO%ZV{eJ6S+HxX1aYmhh=>8hG!DMLh6F4vNn~Lr(tj zouqe`FwLq|@Y>7vYVEG_J>ZE#OyBlW_b9KH^)o)xYptGu#_{xs;_BB+F?D>$l0Uhx z|HT8RGNT5fXIsh`!~{F7VKvNI?A)OUd6~PIP`z7DmM z!vw{?npZrsyFUc>>p#^4#yW*ordJS?QwPmGUuK zNJ&4wN4LL9uX#3fZCShal5Ce(N_Hxfy>le zrl}3LvyeV+L$P@Pxzf}hoGyt<9~ZUswycN}Pn=CG6x!0h2Z_wos9G*5p<+}P6qGf5F6**2Cl_Ua1@HgW+kj*}c3%!&vvyftZ< zuZzJgaF25A@|THOh@XJ~?8{>+xX9+-t00vG1Z|SZo8G(27YJs5qnEh8%?An1J0^{S zm}fViAMpaBGD>7Yn;y1qap;eLv{`R4T2g*z^Kh9O-`h=Wi6@c)V3-M4oVd7=j(g@x zV0?;+Aq&90+AJ;)D<;C4oT}z#Y>&y&8TRQ(?xbbeeiyI+sbSqah`PW%T0P_pRlut1 z01+WPKK)5XB=2)LOYyurXSSTIY+<4%^v1E?CWFJ>Pn6BoBUP{m_*IhUx-crDxir>#wR`wO zh=xq*wY}(xwKf$FXmCujasLw>#Z?U`|M=N+V8Gzg6;aUDj*p!kN^JS`nq?TidB5NS zOVlpbo1y@nv5l4v7^Da1pJN7EasFe$W1Dd!3oZ8c4F^UWt)#QnAVoFs%G^~%GIw22 zKTZz!5HfLZ2&9%b(Nm;4Yg82ZhozsQ(|3NKODc%7UU2!WY2r22tcoi1=B|Q#2z`ky zD&7&R{UNOjlOzZKwtHvG#_dJ|bY-#7j$Hp==b!1aFzaPyfKmG2mwEm3V`gbhC2-6A zZ2a`i#ssb9Xfsv+GRu|aA_VUh`Fsdfd#yCI)Hn4qm4KoVQJ_J+60vg zDXJPQVry-cA?h3yT1|PD5=o5QwPu`lT8fGciY#m_>*ZKFtahTTEChZU({5sl!%}$C z1q*8$vmYPv!o!0@U^EP5ZToNw|LJYUDa}C4m@{&?%i{>!X|g)$w?i;t2XaxW&$_9w zY_aY8-A&C{X4B1i&0)Lacc6`7hCR#D$0LKW9zavZi2nYk!pN z(?7B04ov-|Q2$hnFA?B(Pbk;HwSr%mn%OTO(Oy zeQQ=Aa+VQclTx5L$ir4M8>FAThKj1#b&Y*18|5mbt&ov64)#e0O;}3Q!7EdDO&sr~ ze!m5;1SB83u+VZzPmMdKhDEk2y%9>Sk9vCA2)nq9C&F6Uc)7N;L;Rf}wcA$m6s%IP zs4S{VRWXubF(KynNe)A2WySJFSPd*kR@m+NZ5Ad;iW|$Z`2{6i^DO};&f{9=Kn~ce z@UYz#ajg9!(VSQJ*0%ox(_v?S7s{B}LXKW>8=xb$h!#3qKK*kTg*P}>ZUIt)MkkFb z*93gop_=14{2+vJ8BE)2JE`+dE5)6kKW67wsgXSVG{g!Z%ITMj zu%@?8zLBcY?kLW_Q;g)N3AEOXsgsSq+N^pO2lR!0YB8edZm)NPP3rCG`4GbKMEVm)$;L5%d66~<)m6z0SSr{H zHgTm`5+gz*RzpJ1Bjm;ug|uaJFk~ss>!l%>Rsk?UMX{8Y4zf$ zrW&?|a@1xtRpZ38U5KSftZgC_twL8AWhemqyK5nwlIi;>vV4m21W`@yx&`7$@tNGF z4x+TIx&k->F@ztby1v?5b69Yc_S)dEmCD}Nr>P>SwyX)f!}_spGrh=%B8ByYfS?(= z>(%}121lEW6X*-ha3GM)5xNlm=@-HF}o9-inQ+0#>36iUn)5 z;Q@xAm0l&~?J0IM0&^ZxQ3kY92+qnoWK2EjlSv9_shN!u@V~Q-zQsWyf5iN*PmapN zvO+o)lmwdHtJ_*hnW0?L6pQvB-wE&|J6`Xwab8c2oS;_0s zjsv1(Wa$HHUJ?=!xVQ4kr(;6@82|K?LLZOe;rJ+)@%7@U?@-nyui+ZOMD{nA)_&U+ zUER-*oLXHm-z$jh+f$5D(QRu@qQ(+R#I5S}u5qWF8I8f;R=*E8#i80K~PR||%*i@CJC57CXpY#+k z-=~|)YgX{+U>3-vsxk8N`A6h{>{(d8L!&zlvc%P zIVt;Hgbn9}JHjpoh_MtxrO8QvjH$h$xz)*~afta)u`5X=z!##O3TCWCfoD{V1#T0B z{2v#WO35BZ-Bc$DR3&FcxTugd82V(RMHx(TQeMxdd5XTS%s+o&I2BwfI-tX1FuoKc z6`{7|F#$VyJF0N++l~M#iT$yd{PW0`B$Db9}=Bmb6Vi@M6?R)T5gFyO1 zGmtHG=>_2AU-ule!TKDRFD;VaLA`1z+{lmJnkRA z{lGlQNPbFsG%hN`OZ7^|VU<9=LS{C$o;QR7GD^z;R+^Lx&Q*LqgeHWoPZ<1*nI-LOVP`u)szat|`JgV__(KRf%rLh359~tc~H)xF!!`D5GqcgBv z60YzF78K)t;?I4b8|jFfMX^kd*ikVkzsj<60b^*&tl}l@Z;KJUBlCYS`aGTrfWf&I zr=OSp^Kk#ahBcw8V`O^}!c~ye!OQN}^bQ%^^iMORl+e*(ZL7!@G5VA` zx%?e`8?-3be)O#PRS9A{AISg*rpWa5AL}}HGbAef2!Cf0mDpNY+M3HV#en-gf9!<* zm=SO#iJG^~Y3;L3uvA|i7{uP%(%bmo3#mBl*B}$yYmnFd*P{glgc4(QqQ8bvxOwyb zy^Pm!wMtwFgB&3zk&U((fsxsV=aDpN;d~~FmNTG3Idi-)S=Wiy(_}ri$UUQj2ojLT zP36*ref#AkSsd|yyEw`-3d44Gf?ZC2PS7&;hP1-fmBzihbJJ09Fl<)ejEeQPQLjop zj`F@1Ug@_om?$mqk5|KNr7nV?iVc#H*zw2ySJOJ*8?)2v0OHsUKcshKDasfxL2U9U zcnmh!s14y8_F1qDUor0ZLSj^QX2uF-f0pemn34_@<-qCqU{tA)ka%7RKaItRhdyu_ z=+ozoO`WP+oIU|#bvTCA4Mcg(Hc$avc$*~QCG!E){}}c(geO zK%>i2BxJi**TIAmuQb@$;4FWs86C469veg^xie?wK=m%;!^d1CxPH>tikq-?xOuQq zpu<7X$kT`kI6ou4L+vR)_0CxNxY#T$a}RZ4S1JD*4pgKw0{l0u61iiWZMP>BVSG|0 z&@^}7f0fZA55(cRo_{v;V*+!iYnxN}VoBk=Xr0NRg`XicG=c_084H{>O`#?Ns3NH~ zCehD4r4afdp{;goHHh;1g5)d%z?R=F<$vOjA5!>nrS>g|_8&1v8oQbD)K#yRlO^w) zOt6jy8d`5p`Eu#T0gJ}-b#%n|PvTNU@IiCE%b_%YNk9p}OR^NMeuS)?Vmm(#1?GD? z3R9x%pmAD?EAFn%O4-W-Bw%l;ZnE>%8QI+-%O*#rxX*F+K)uEkw4sok zx+@pST~QS7A@Fo1-({r(DhoSXzNlivJDV=l+CL6Ab_+SHAw=ULbT&GyHI%`mT~egF z^g$kaw%rvVd=D|uo%54zYIs`2x-28cp85?Qp?c9mk+*R%Q_rV}@W=@X&PYxBxg8A* zzyhRD(?EWAe&Z3){WOa!fN4cqS9Sg>Xl;MyQw>v>ew{53>TZ}O+9dM9{#Qok*SWi0 zwykE5D9aHW@L5tM-(wUbmdtF;x8ITvMa#@;>bg$x3wZE`K225#XXLEDy zRq!DaRj6ZYWpxKDZ$01*EN-v7Cxy!Y5-bMdA~w#$`Jnp_hNUFrNT8Q*0%Fvy4&yr2 zl4FAMm{ZJk3X(Q#`8jMSIfk1h%WVRqKw4amp!|!R4~dk{7e9+XuxO;wACJDh80NIQ5ut-<6(Q%x{k63er z+fZwX#Kanxp6{9HmgvDP@Y9;fLI4Uj17EOz| zl@&W)z~Zn+z$dFXl7g#T$bbHmSvs6A2Sdh{fW-jLW^pFcNFo@=OsK0F+-26~5T?)I z0qJn{sGhX=<52~$5f0bZ^5)KOgO!0kQmpT1XoJ!~F3wZqqYpzg1*(^Kw!Q@a%4B3~ zg(%bxyR-w=bS+dk><1&lfeO2@rRWdbbLUU6=`ctVQmO9Q_n7gMt2 zq-494o0Hk)-Y@OXHo|+b8=?C+`8?aCaCK5&K*&X7jjL&`5&W);m0M$lixP#`4SC!m z(k`w(A-MG5T~;w;7S#c(xZh+E@;^Q7uaXgrX9lkb8GMQasZT{gl*UL$#j38%)U%75 z6x|zED@QJ_Nfy>!k1MmexgolCu#|G>sc!2(HpSDKkA79hf|ZC{1^ozB<{<}{5ku_I zORZpfVWY~lFG9-eh%iw2M)HmqqUapCpO&uAu6~$~Q37uODxsY1S1|pZ?d`RdjHgQi zp<5`@#cd?$mbT89Q?s?Wj&RAF4@xAcR_J^`Tq+E|NtaAFF$Z@q*?jJ}sVk4-&qPG$AOrdtahDReJAj=*SOxY+pA#A&Yza4l* zd;q?4zkWW(4F*KaHu;!|lhr`uy?BQ@?jib@f+i-tNuC`iB3+R; zFr-0;4=^qhOg(v3aUR+ZUwJeUPZMtiv(q|KPRgC~A;a$_HIPgLM1JSui@p_8sTt_0 zE(RuMhQZzoEIoX`lo*p!9TPivb?>@U$iFYoZjYGczC1C4FHX2Rl9+IUY2j4`ST%7NT?0;SUKyjxSLV~V*L zHNBQgJtq#T&Zz(GVBD!Ui5@p3c6niO0tOKFQ3mVBlM9~0m=CLOH&OhPnVJJwd9 z;@w;&KF{K%CCecH`rpbwd+vD@vYvH@ko@ZUW{>fi{VA?)8rLSJ~ zG!Jbc80N~?9DW%VE4e2L44;2Ey=2}De=m7z7_?$JX^F{z=zY5~h@MOS?`MSz!H#)< z3GEx>)x%rtDWo?@?I^0+oWm^1T%D*Z6--8kfprKESK+fKSRz|NApn_nyx!~whLn{n zdDzub>abSq(lWORRUr-{3Ped{;Ef|8_c zYe=#i@{EForHV z)=GSMA&g;i4I;LnjmPsB4mKVW_3h4FwBlHOiAp`KhVI?F9m7hB3jq@U>U343a_8do z7R7Y%Cg^Gwjrq~V`2(ANXVFlenT4>AME5aP67}FEc#c~~-Yg}6wLk#Xoeuc=Mzz-J zhu=G)&|S=*L7!wfSiNeyR=MZ7&pGmMPmWPF)EKUnF{iu`3dz>UyWZN>iee|UOnd@N z8S?Gw_Uh3Fc6<2K?Ri{~N(Cz^qa(G)OgpaVovB2=Zx89ddYiLUoEk~`-%<o<(}V8+SSnBXPo6{2Uw6D-+I zMTX{Ake-Bt&cA)T88kTH#UFRBzRr0EbvpH(e0cASpZXmh8$x<)u)n<>P8XtzsQ3Pj zvNzI*&?^cQ)J|LF(Do%wf=Jjg7?~`Cw=-Fn5tMD{4rBmYCOR@4(ynRqE}o1_+%Sz2rFCeXq5g1!(e7D!;L_w!GxRoq;w2w=S9 znP+lQOS@{t%HushiTCSm2pdM5Yg4L)wWNVs=I_!8ZJ1leRSGf<-}EYcu2OF$aQEH1 zVkPpl^I6cgABujgLxwOvDICqf8HgBdf1W4PukzU)7R?@By6r=PZqtt$5NC|{^YFpt z>sDIEQL&_^%23TKxFMHkmqmV3Iw=feGc**Kq$+-IbZGLl`93NA5Epa$9J{VsJT6~L+1`Tom8!qN9w*|}v(i%+YIhXe z(Zs_&iWsXE72I>8r$^rg#6L?3s)=O(8qz`dLkYO!$&|IbVb!LjpoA{|Q#S35NYr3R z`vm?Mh&CL*Xs>av2E?{29fIuLdUk%g2u`lb6bF~5+3xkdyPuX~Q?2|;g#NHuQWhed zilsjNz#8eH@!%&yEb9H00)@k40Ey6jg_u$ae(;vtVWdS99Vum24lt(9CYC&d*tpm1 zLJ=Xqx#yKAq+B1_KIA2*8^PA0?2A#$cF?Nmorp&@{o_F}0FYT2w2KQQj7yB|?5WnO zxX{ubdrb-1cS~dWvGxdgY1kNc@j?o4H7Htb(}4r)o31?4(XLduFIQewr0b9yf6u*z z1F`Fa7hR>|=n!hU>Vaf@LTl8@K5n3J1-ctU*c_f8|5B_imDA8(z68g16v80#j-ii> zCGwz6#nn+wB>eb)*PqmN5$~aicFim4I7KXPzw3oF=}vpJc_K%-oRiWQEXbr#+u=5f zf05!Xcvyp6`(3Y@R?7SSF$O|NKlRk3z>>lz>5W?0k}&Ll#xIsn6AC%FO_~2+fpCRx z-hDW^DKbv9aL%O1P*V_?#UAopw$r+ep>1DecVzXXoNCaImE zH|KPPYX&7fSvtPqw*~Jk&zFxweKmHnrAj~neu2;nAw0R^<<=he4q)M3mP_Lt4@P!1 zo`(CoXg(GTgegs4P=KX|{GiNJdPru^Y(;(XvD9>iUQ#YrFW!e`H#IjQSS9RK{IeYP z2Bro)D*05S>FBCei|It~nO?Ya0!pQno|H@VAU*vVcxoiId2d@3LvOe2>wbrg31P?4B zasJ0-VK(DYRRQ*TC*@az&nSa1O}>=6p8uTRrs(VW@mJM|6PXW-@Mj8*G4+-2uwchg zT&a1nMh+Z|dtWOFyWt|oqFh>B#O|6d$plNS=dc3xiTF<>R|VQUMmyVd2uncXb>h>p zmWZt;wYZRBc!bw|@7F$KEDhP&CB3iIWk^_dO4f7936&N0_MMSNlVlaJ(JAlS2+K-z zDZv!$>qE>}e#-93VcI>*^A`7w>aR*$uqT=4sxYxAatwHSe29bD-sUJh3xZxQnF@nH zR^pA^|JOVCTg6Pi(=>)o;hl*GuXHu6PzN~yh)+$QgJgc+`(6L4Qss%&)C|Sg3>7Tx zAG>kJ+q~4(6N-IE_lCq00WjZaSVE>yCx!!*l47G6&kAplLFX6r4UDH)h4V)%!Y5zm z3Q1*ASuTli^|}WsWjdyh8qdH_&^wIk3Y#kC!YC)Qo@)3xgQ1CjG?}s;DNj}mx$@WQ zY&is1k2X&dxypBxa#Xp>OpSR_~6}g2sFSOx8pEKX#6-(o#=u86;X}%fD8x zR7^I~rg%YvrInsReDcfWpkho7g}QGO0IOlPU`x`mQn|N_2Ccu+B=yd%=hQOOi!1yg z{X3`HN@dYY$77N%%*Ez_Z83Q-(y#HmP8K}SEZLw@O83K7<|nA{GOwJO#(V#lP;Vb7 zDvglSbwaeCROwH;+JNiQ?T`^$yoly_Ad)<=`TXMO)1zIZh7BQzI!Zvxq74!T|7kb~ zi`z%?#L+$dd^6a!6S>~B?=U`Q>XW6@L{COm$nc>R`g!Tkph(%oUs8@(*7eyRCmXx{ z-enG*u6;)cH7`a6V}hRxl63mEaZ>?J_!ISpx9X{*64Nc-y#66MenSf3#`YVj*M-%m zTPsIIg~wVxauD5_q5vk2M=fx;IOP6F z<&U4f@KukYhhVieL2>kF*qfX;3{N)jtGA?v&|8eWUy zl_%o{fnh@1x=zMZ=7zD(rmbAPet+8WZp5Baa5(j*WoqdPeVU`ygiY=Hq)S2px6wQC zzF`Yh8uCrUML0e=Qp5K!MX`#`;`@1{udD@@AtwuvRE3d7v)Q|33^1)q5_4O@rN{4o za0gwXV#GfUp7l}$fru}6HuqIH>&TKd_2-N@v?G0r(NS`W7SC-x-~#4>4@x5}HC&>1 z+T{=PwZ{NXuD9phaM@iWYC_yHeGDBb*`~=(E;_Ba6p;}~I@UX?NGA!mUu~`$m8O_DxAERq` zFUdG_ark@Hqo8X{_j>Mj@7$Q2IQ9zX%P~=pbAk|dO<&Id&ypn)E4*H)b~=h30zYI< z=m=Au24z`VUVDA#MgBSH0$;OmMLd0(|G)o_PT{3K-VqNa1PeFr|5mH$f)rZ$VaY3X zz~lySbJo}?S@xe3x;vPQ|G|#tDG`=iI*@A@R!?>+k1X7;;{V-Ux_X*Y+v2I_Qu~=f zsm!7Wo<0uEtP)92)q=cQ!JHa{XtDRnw8|hB>}5YF)q5E1e_SZew)k@Y9BTQBqP&q) zqsNqMR=x4IsYz8+G!M@F9-pX&Nh>H+HzsVUKwsBKe4h5>K|~FgLNS4*<(2bl^WZGA zf*{igVK1(Y+$>-xqx#P-c^LuFsopHKQj&^ zGh|KySwq?Gvw~tN#`5nfB*+7!=XOzb;JDooxF?ZguP_g}YJ>GYlH($zyOxdkR4a>p z*a7BYr7D2K;OlExo=F-n&E9VGzm*q(2VKXNgC?{b9j@2L$J9!*7|XSywqFxlt5!&i+h^*~U=pgeOK@GVI<5Rte-bsM^GS$}wBuMk{nBj5GUkaw=Gw zWyEBLqrbtTmpq?8fQVguo*>VUwcmF-@nb>J9D3_ovs}cyai6M~M;C=|16&WIc7m z4f6Sza}~VoLJRV5OWSh+YTqliaOw-jfs`e;>VI`l-Rt-fQdGqG>>%jU=3{93s`{uF&wmfo{?#$u7T0o;lAAYRYq8l{6qHcCMA>o_UqI)6aFZ#)a zBsJ3g6`NFTa&1$GGU@3%+rs;W2qDSG8I~`VB;PK-+UW&x^K%}mtMG)jd5*aHsieI= zlnur!RQKzl--@dNFCP3TC81@2Ui`s1DmLUjQT5_Etn7fV_-Z7p4QB(US`FZwn_>OL zOA(|C%2G|0;aq(0pgTm+M}Ga445ApNpjL(i5h_#dF7A~5lOmjurmdHe8B?QBU%C*0 zS(5z8IC_P4@SV#A?FrU0m)bw)hPLAlxq1AfH(AV|-LOma$qn{#}YQU@}FBBh#5n*-Xye4bzzWsA&3i4kFukq`B9+vv@wuVw_ zm|Z><)8*zIPj8ozRP=s4%94}#aGx7qEKi7J#ze+p>U3OHX7v_Y$HR%TI|b zP>|KM4dj=&!7!W@-2}|MdRqp%V8;&MLF*vZY*`$2so*2_9uZth?nuP*JC zA_`NWGXMs5$D1_|uf~}ic=CF|WgnBBg&8M(LoFz+!D(0&+r9SH16KsSgL5k>mdo3d zQSQ`G5=>1v^KJ3HtEGXDLRRZ~6UT?Q35{{7V>8M%E~J{Ivv;|IKEp1L8U79go=s0e zEj@7gp_*i|#hZ#LOX@4>uJa@hPwvm+> zRvqV#2y*7*bp@~|E&EC5fbb~xZ-8AD<;^$I#~3DSh2)~%3$_+N?DUV}H|ioN3cT>Q z7&9q+rpiXR|KQR{ilkQ0xps~!t^%dV8f^pxr= z*mINCcHd6F+1Xf87It%gtxItdgWe^sKb)}2SsfE3t2&Z#ebE{|Sq|5Bp*V1N0mE+K zD8}mRFl3H~VJ8t)obZNOtrabFq)fO=VB1^374TiSXVYziayx`SKYNriFtvroee1sG z24}TplhPR9uuDqBmrvdNES*YTJj)6y8>0E5;*lrUU(V(e>bqrkOlAFqnAXR}MfXBr zZE_cb-l2V0n zc95>e8)Ff|&iSY(jwlV(J-hr2nhW)hrl3ovl_w;>Kc0L+Y9=zoz+4#3Pobi~vlPp9 zzXZk9&S*l&uyZH;P)yANP!X;Sr+la`k|50GX>8L83f2$@tX`J%KW-e8KVferf;Oxr zhR8GLI;Dt&*b-<6pgmsVdi7FBQyu7=^WRS~ZT^;s(y^-QQ!-`FS1Se}`Pe zi57%j>~@;6buX-sB#WZ7q*f*me$kcdrcIMMLJ5i!#cdA!_vWD(UVr*il!GN++3l*c zG8Gb|$omm=v-I1_u)7pl#a4vOosq4hRiz9Q!x_SSd^-lTX#`Cj_qJ<5ByhIDDq^Z8 z@59b!`ag$h_TAs1IIuelnh-YgDQIr;PRY=TAUa-yhuht=>;)2K0sfsD!eb&0+e(OO zg!Z?bHgAO}+qYQJJ)>RoxB0OPLG@e{mREij%stHh7p~8V!iKp%{}fmymr8l3!fd@b z&$R1T)4=HMX+dS$BnPjQ1&~@uK}xb`tJXPII+mxTAQ2+Wo=W}Y(Hk!Xar#jtBLH;E&Qkw|PujjRe%Eh~LyBrQ=sT4qTyvr6 z&H2?E9Nnv&=XRu$pHF3Xd!x1y=nC|gm;tMC_(sLt*FJ5&;?hepYcVrMgShT2rO>(& zW%tUyl&&a2H^=H2tw^Sbnt_x91@eeBf-%3k_OTt`G23l0mQMY;d~BE zUzEUF5>M(P2;;&D+O09w0@$>ru+Ge&+2H|)PzlGak+Ue$z#9l1R6WYP*&2`M?D80gFT}~TdpIV)ul7$9PO~U+9 z(liGy5hzAfS@j1P&w)H^g5Tiosv1@qr&)_xAa-(zI4Fb2)xn%X(P&p@$|$1h)}kpqVfE z?`3h&6hIr<=g^zJugpLlX(p0v?d#T`F(L0oV=zyYDd}q^9zNQkUFarRyW!+b8`MES z2clc}eRCx)M^k_C`8}04lM%abuvYk6TY;iJn*&fu-!0}kWxVb8}EK8U-3G|&3 zAA3}Cv&Q)FEXGPLbJDI&q%^-8vW7B>XShJ(gWA5_B3GORv>wH%OZ1H6K4VUlwC<~M zUVdwfnGxFAT|?N*lNrSQqJxYWcqchH!;J(&QIvAXnN}$PTC};IoS$wcsr*bd)Y7*b z2P^BIb+GD1nwD7f;@A!XX(Gvf<_^AD^QKfmT?r1Kd;^Ua2W%&xGQ*?9*-I*!ho(7` zNcVQ3=cqZDE~@MU{E^nAo^|rYQaK^+Hf!ZSHx!snT|TvepPGTtSQ&)B$f+Z`-uND} zIHSS92OgzBPttz>6|Yg?&E+k$u2TA?kO0a*nGMNWV{gsQ=I`g9bF~!v6Y@vCK1vX; z8K1*);LkB}%c=P~r)BORZ(M$7n9qH6U32xD#;HM9FTfTETT+Q>?B0n?8>1h?+c0-n zCb~MXqwVv(O5GM&{BLVV^K7^Rx=)9HbQy4y(cylZN^uZh=yr;63%FI&bitx3nsFFs z5W5#k|4jXodius_cw*d$^B1>s+{kwR(4we^-JN}nO7>p&zcPb3?0fUzpLgR2-8o8i z4PaC8)^d?}y~EC{Y5p^LnrOOKkCAkNx2$l)-)uiMqnCE})?S%RoB2%G)G7XwEU}$sxtdp0U9U-Hvar{V&G3R0Sr4%cwe3H(G_Q! zlMCyQAlYxbOFjA?zK+$$bRDb{Lslrt_4#N=?jG|%-rr|CW`R{cP1?brb zmTB#*1m`P5cX&8FI>=`6*&;7ZB#$WJXgrKk$pEcSXlmzj&iuT)sK|1qhaeEO>>I-& znw57P`cF+pg%`rSBTc?n@L4K~b5T@Jb&aFv9bgU18yt|#7$N%ON3Ar}RNXD059l$_ zwGhHu_dBCuxih|Yi8%r7MNuvfDPYA{{iKuLVg*@N_AJm;t#9?M~tcl+I}9bFQ+-P&lbXP>Z$Ylr{TkNc9>L2-vG#rwu@7>}NMz zMB!w9^T0{STiabI{LLf*7E)WqVy}fL`#OUs!eyv7#hAbu0Ku3h6*}5MnI@hTA4bEN z@09rveu#HP-6SU+*^@l!3td<~R*6r2lzJX@2g(DJ(>B2eq7%@cYJ$TreADeWcI{jD zSCd%nulW#5LZs%6^?~sk)qvtH9Uc)>6;V3kas}&4DtW2!rlhHJjNB zY5%x-T?xIzBT>a&Ul2bNbGtQ5Pm!YWhe)w-=znhPCSKagqmvKuCloZxwI~J590OcR zs8`cV|JDsl;ex;JhKWx(VSmYoe3n3Om=RZn%2V!q_9ERmk+$Y+_|lGbRFYutiC{`y z^S?X^X`Uvr8|IBy@a=40X#rW-Ybk%$&L%K`7!t$}0Nwbbbg10}VD34+#Ze5D47Y42f0&bqha1M&{`8p@*Szx# zmuqXS#249*LHm0R>WNL+JW_?Kkc=4oIx@M!;kY^d)$@0OosgZc07x$D?=i-l-l^Tu z^Mccja6{C(s@w33IaP?i;(ig{B>{NpNdfnfno2-6^>h$e-Kvu-LykK@8t$)Xsnjd= z)j$6X@MKk31)=$>Xfj2Br2=6Ww9h0O!KAeyTeov{RoKWh$KUP?9>3-(lAtuf>AY8u zVOo=zpKi`Se)?L0YE{aDbTfTeGG)d<(UU}<4;a9b{1`s6cUVYzmgJVt)1iMhSmmq?>r~s z-&R&5Vn1z`g`F&BF=e7U#40k*fDgV-B^iC4o{cXRRC)F#r=TyTq0q$1(z@6PMOhb$MERAmol z)ly1o5-<3r&^2h4&{^{=vBe6Q0O;XU%7sPF5DtFT!$iWutl89%n4gs%%f%%kB%1L9 zooyX^@gh@H=}Hu)iu0O^!HBPkvc;y$kVb2aL#jb^*nEKMZV&aZQG;ID$Nhnsp~tqMT-$hc$`{zvz6^GdDQeE2G_QC-h?#Mq()-4fZI4ig>qhFzCr+#Xk((X)ZTuQxJKMH zNuj)s<(&XTCqqr2ROm>mX?S~uPu$nHIUfI+ry!LLdlLU!>5&rSXx$UcsX2+at#4+ z+Su&|X|&5P$#~xR{cIj`bRT_byEj;{fNKZxQ^~$;F=1S_cFGIIcIS&=NCTVNq0HFi zgfo$A?~u|La~ZWGJ$PVg=t^B_XB1-lv{NBK9=|PVPmw?czC#w6n1vJ1dYo4v#f=Nf zsWO7b)0a_{2BB&kyHJa#nM5YT0fd(qUtoK{p)u{ZT-%{K2PPehWo?!qO@ew*x6{;X zNRQ>A*kD&dSf@dc3M{vyR%(7Dvdnl~=Q0)>c56#3pfNf=>DL4_-kxm*Lri_nnogdE z!T-5yZ9dO67iuSI^q4V zsn3V9adt*)-KCs4aKjZeNyrEn`#U8jz~UL4;PhR^6~u%{@Bw+Ux|3D35i zfO0CNolAu%xxKX>t+YV+bO5Zn0RUj|Ni9FOFwxvQc1X}RE8+#j#$--o_-urpvmHPd z%*m50YPCcZx-=Swgl0k6l{Dw~MO<|#fUO#_(JGZv)3w>;kV;MU80oh7McJW*k~a-b z!7l%1!LZIXe|z7i*_y?l6jNWetH|)m76W`#NiixNfUVPn4o>quv2%BNKSez0$zjCy zI)yn8@Z(~D4(cX!E&6KwViLGX%$2R#k}jYcP!*b0oZyU584FB~vY>Xiv84h$Msmni zBL3dwz@WI_b9|bgW5|i;5$KB1MX-jD(svTgo(eCB5vh_g8wo)nu>*V8;o<8$o2$9+ z6CoMWT0JJEN;-Nzvn+&^5c!As#|+^67Xbo)Awqzu4-r)PrvszWN$ z22|O)xcdD9c}o-Jwd0es_^gPir-?n}Cof`*uQ(GmRnVW5*`Z_(B+8ZOe9h+WZ%O;M z*?(Dt>J#a~$@L($*1mPA;4(4aXFK~xDHvZiCd=zmFc5bCQGPn!sg$L_%iK^r0?e|u zYpPLMBPG>#L(O#hTmND02g@|A_>5ok{6!`qbC?B#V0>0tcFhEz-sQ5BzDuk^UxRI2XW(cuxfGI{FPM%|Fr)63aL$9kmVMXXs3)ohqGi% z{EhR%c43#CW3R0Q6Zg>MjcmNyZwD-Y1NW7X(B;_$ie0Mu+N!y&+rAKaDItJQmlv#B z1~qv&zm9O*ZDB$*1xeGW@n3ah*4Bu@AsD`Z!C;k;f0ZBpdM?N_oN6|=`0(qvK*QhU zk&r5DN3v$G!4Heay-tDS%_>g*e%YvsKj530+0LhsGf9)Hu@c#W3|9?J1DwI=&-jp+7p;0)0sEO7AWJ+@KA@ad)<|@e*aFh@CMUBP>ZJwcU=JJ&&IK zbgSzkVO9=Y6_ZaGO%U?1H=4dCifYWX-0d>d9P*crT0eGd#NSJegRs2v4Fx-i!q*#n zdW|h!>QopmT9(1hAzF~O<(E(VxGJDxB5Wxy1U4Olu8Ca7g_gmW6m#y6!c1SHQb&_O zj14SFg*YeNqAp)uZgPb2@dxD3l(8=v>+tijs|*jr=ig3S4V`=@1@|zmN`N zBWv}GPoeQO$EfIU0*Ve;(gQ+&z^mx-;m#Ox$>s@m5F})JF%#~}bS#vjIqAeb-7l^y z%XWKtrTIVeM1>qM68DUGrqYgueoS#k85Ai)8U>&WLnALBjw5_XUDh3|UC~?O>m$Mt1IFYkBt)tRYzxhY_ z^vkHG+prt5G|F4hlH`@$d+|l9E4czJu6o8ZYFIkbm9hja^*I5X!e}Y2w+g7TZWA{`srR$523;cp09m)^- z`w$N!5W}AQOs}U$Nz*b3qA%hB&TB{8y9glPSX6b($V98y`4_IvU$I11dic@#v z*B>E8Y91;BRVyxbgKrq~^W+&l{EZ&D0JL<_?|Kfr>o(d)CI-egqo?D zeR{$ANRQ17H|3PYCLg_@Cq<@*th=sNE~M5YDOrCb9GXH>30}_CpbvXw`l`N!gdy;g z;^dxAF~PyL9)?VEBwi*=k{Cpcmf@rD?4=v;e#^f6(1-I;tJL{I<$TO_-JF!!4}m9(lTB-TyU4;Q`b z5Gg`5Y>=c?rY*_WyzI93Ea~FzYCOV{DuQ}o%I~-=qy&xIgu}RBTrkpXb0=+fn@g#; zYH|{;VV|g%pE@c4{{+@2XX?0MFw-+sHX>_)uu)S}zeYuOeRFrHv3Hg#kzuCnO#p5` zuFVijuzMIL7^BY&sDs}>L5zqt=6>wH#LZcdDTh|n z1fwMIguf)=#a^7MVo*Z4C*n$%CC?DiCDqPabiclnnv8t6Ag=KJ$ZEMj> z3$Ap2#d_mw+p}M-W;V@K>*;ni#=!bd>76H-XLxp?H7F5)y;% zBrjC#pq>AR8(tGbVA(VX`+V^}Ox#j%z;lZ|#ur?C0mwp_zFMt=RkSDld1>vc+=)S( zmyOh4{yWI3`zGer$L4(~=2z$0yuj8zXeGYZXYcgF%gt20W*_!G-I~Jzo2!*+WS4R~eTAwGLPul*%=j>aQ06?kchXN$YFKZqX)F`~;JYwd886 zX!U3Y?y`7!(4AwC^X1aAwK0`p&e`W_WFgMAfWP7xUHyJq0s9BmVK_TorjgHVnx${IUfu*5F-u}^-n@Tb*7AhZ7jHU# zs4BDf!d;kqyM-YNK#fqH3deF(^0gmRwS5#d6UQ}B-0}_NCWa|FB}}HfyN;I&{9Qk1 zkc;qM>4>%{|B^xF+Rl$plrKB2Q4~N3m~r!mJ?Q5B0mViXab`V889Ui`7{uU3$wo(o z?E=W`Z5)S2Bh2f&{eXUqxm0s4A|2;Cs?Wb>CJ2Y|{;mnnE2BFS+G8 zt@Q2KEyW2cy{B(%=Mr$4nTleb#5uHQ(OPQ4h!4T53Sjm1r1IUpL9z`N(EVDCqtY8^ zi%gw(h0L^Tz|Cn%1`u?UMNFN1ziO^rNQ-ok42#rMSzPEW0h<6D=ZF13%$qy?vIbaY z!LRJouVtYK>K77Fpy#_KHKBhIg%8znWq=%T=2Eo_8=(T zu|!K|e=wgxd_(n_r@3lx7?d2l9R(4NiW+h<$;6#+x5xaVzb_q@I{j=scIaEo`%9?l zv>X~C?1)IseY7Kwz?|J+M|+J5k*GhIF?qDr1HP_Na3_xBh+%m|(C2%9hwbvi%wqVEIW-%$l6nm?Xs+bO)lhL^VKXOk5qPRiB zgn(?U=r3PD@e#}2>Ni};aJ2Rs zro-u-S#$df6T&%&do(%UWlQlCA7{Ei^I*llqd@&W3K3>HA)Li#V3PM$nkbWEj6KzG0~q>brJ_afq4qKs=dh`WJ+ z(jHRZ7%B*ETd!JPH12}HwT3My2ni~5)eeqi-oe3OjJt3(kfaLX!-mLR!-}+60hg5UC_|dt5vif+XyX;rb7C9`bmm zvszZO%2UxwASrVD88|e+d*=dc59$xe6s}e(;cJ)DDgq9t$+p_1&6zZm&878?SL?~@ zSRm<_E_#`*C5sjFV2wCw`ExTcS2A`)U(3#C5mmIX#{sBY0ICSK zy~+h3n3G+2rQXZuTKF>aMm%<^Lgyac4=hO#%xdKjNH4`*n7HDzD?Zhkd#ip&DUw^0 z|Fr~XP4F3tl{aEb!)CZnB+c@AIk`uL#aazWs*g@BIWB7}>(uSkBT4-UaF8H;#M$D? z56h(!$_r-`QLXYE8d^~3D<4Nq!7~W0<_5!zUDzTUUAPS6^eq6~`uxnAXk(PV5ptzF zsCJhrl1}OtkOvefwuK7mrykqL8p}HQPSyiQDwl6SUT%|`@{!>#git#W%>K5Ko#kkx z8X(qY9@uIVW$2?n5i#ea5|7KLlOj{Yyx^vwa!%g}m*1PaTv8`h4r#8u9)DsLvoleK zle0&gH%UgQr>n!)LJ{ST>ZIj}luVIW`-`Vrc+&J&aiTzaiO=NGU>iYxCNV19ZJf2F z{oeg0ubCli#W65SJuEUP1+kn0gdU*#(#HGGoa{oaXxY7(;ZM9k8mZJqw_uHDjC4@g(No{GGRp5!wUWl2ibt_;0j>DMwz(_2WdiAWp(+`lKCKM7( zb~H~uglRir(T=-<>O~=an#a;!Jl_2onEGB_&-Cf}H?NB{2b-+i_{HcJ-JKnK$w7t& z%9x#f%L0E#g7Q(Hrbf4gv|7zRyh-1f|LgxVD&TNVMq7ZHc83u zQn7w%Wwxiy>GI*mrbuZQqHGCSmh=Cm#<#MZAJZOy^m{)qrGUXD&vQ@|c?46{0|;EW zy9eVwDWMjVG0D-5Xjys^md=J(8g8^z5V;Kuf2pprZ(qs2ZbcMw{a!4+gZoIWn9vk6 z2Btqp45>KX2P=7kYx=YV>zJa<;SlB)v_PU!3?+ImcmY%OE|D7@m=*BPeNlw9J<}Kn zL)2+u^#3XpGTgago@v)ZB+V{=$DR;ctU2=v{iRmOXZz$bRi4Wzpgz08qkALVeP7$Q7~c7uH$zII-~Tu8rGo5(7>6UbsSTDDDKSE;&^OtxtA2;q~< z92#V5hV;qVM=V>XZ_G08_M)y9jF!tnfE&Pp-L}16wOhjUGeX2bkQ|8qi z=+P>8R~6x+4aRHc$T4=+Z%sQ=u`T;kmZT5q9}?OTDG6!ClFv`*!X*ZocrG*P8!jgCtLjG2&LBR^_{vOl=bm&KKrOd1Us=CviJiuUPe&&E82kqRQ3; zyr`qXhRah*<5{gmds=_j|9OO>j?6cZIptN%#`;UuiC|>E(WGD9AMd;W>kJ~xCelNq z(>JMK(VPA>Vs7pPNQ903it$*;76Ko=TuP(uvji5es!UV_-g5QESm2bAl7YJ>Kl@+E z4C9vw|5yle@?8_djUPJP7;b$O!bk33A9Fa(;7%@dt*JB64!VBPo=NnofLwza(ZAbv z91z2U-bWc&yy)#?p!hG*a|wX=gEojtj$v~RIPBpKW$A}c5v%yLTdJ245(QMS)C=A_ zmNdNcBCWmxFy|`S`v1tal_qgjcoBD$D#w8#*olM%pwI)3-qpA_i{S8&+5)C6srst<2$sxS7O z^U|9*d11wn?S{lpaeRi{f|3VRZwJ?_v&&+xObsS>C>y`Pkyo|ucLx)4L(;Ze=zjj? zODw6eUj_%o-OusnPdH8SK>BF1$dlRyPadc0t)k{vARg!STId=^QhKfuJ@u|7^oC|u zQ$?PJi}VT~5a+dc&&|FZ@y9&j;>(BurLaVFM+lL_-VG}oY#O>dp4DvpE*LV(H}Zhs zeZ2IJJ+1CysYz0~3*9yarQt5V>Rh~JOBm5x7>3{PFsZjaX-%zCFf9D7C%>R3D zFo!f9`RhZ{N)ame-}^!O%KY^=m~`sX{`DW2!+-Aw-tgaBB|rG@?KHc9w8ZqDBnwH*$=01=GpP=lA- zs0D#{Vg>NKrYhKtj!6^8DP9;j0@wd~9ZU4IwE%6&2_!ycb}d7H4i^$Y?f$=kxc~MFs0H$Fik-UBOx@T=M ziVQsTNqiNk59fqbEEaThd^1=|k+g+f!7<^k?raVisC?EK_b0`( z?c3ZU&WUe+tytL)M;FN#zy{7WCU;$3~R~ITnv|FCiZh0au!qUm=%|ESB?}Qi$mN#Wpm_dp;|1h z6{TUoUyBLTCB3x3@%wk5hUvj^>`%M*DGEx+ELWd&txzZ>PQe#mfzfcrVmjQwHHSF| zOlBbMy#Xh8&-~zBfyjr#lpul7gCs3%-KK|+(f^z_PVB$*zx2%gn=8lwUlh?tIQh7k zoxUbZgZENQ7iVhaBA%zutk3reze4+JLF*Vq7H7(uI5d%`cizOQbM8H zD?1ovJhgm~l3@~M1klSP;=dMIL1;0Kql^uu$Y|2%Xv$f5T{MS)89`% zg-qXnP~;C-fIY7QXw~N5x!{VS@J1?`BXQ4+E>tis=ll8P|9MAjfPp>p;g1lvgd!jM z6|=$x>4KTLY^nAbK^NF?UQkk=UJdQybE``gF4b$9a1TCFG9f>*d1HdQu%&9sWR}&u zlC@(TIJ!F-<3!f9i{d+P9&iU4vN4UTCjv7D4k;$+#5) z>a7BOBe8c@=6*g)S@1=333mYKUn(BOC+<;YE8G66-eUxD_xJquA$jvNiRy-;MlPd0 z6-&D@$x-;-kDmg(;8_qxHD#zv(Wn`YA&}!kTDbS+&rpn=%P!I)4FPjJ#EWs>P!Ebi zag{_*r<%#H5S6&GNnuK5)V}td@3LOc_+lBUop;&B!49)mh%AweKsXAxCfEsZ?Iiv@ zf`2a3uik#ayaM~*hrE>Z^i^?j`ZjMXzDR|VEy3p^dVCm0W%|%K{+l(h7Dx5WBO`Ks zm}d2rAoHy$2;c+Ds>gl;HYb~SprRJsux+F#J2ESBN#mnJrit^Gs8aVxzEADsgN_W` zmq8m#=DcO6)P%_4Ch!EG1!xvdb;siYVG=|_Y1#ahnC=^q^=P*!6G(@fpO<*xh6w(w z?<+YOulJ;f9&|ugP&IAQb7!S-u=m>;P)DCzAAjtUJhUkVV9%VZk2Z`C3jxNE9>BPS zWwxb$bXnol<9mA|Q`9Bdy!qBDP4E5?qK5oeN-Zk4u&TGEH>Koh>D^Rh4d?3}t>&wc zJ_5UCCkZ}gQMZd^F`R~}idhFFc&owQkP+2R*_d$0nJ{u>zl{PyM=K&HZMH2V~u3DP2)$e<&#VCBV!7z#zH)=mf&y zOOj2#7EABLMJeIGZ~}(4B_$%)<)D61;pk|r14@SzAYzQR=7Cb~RMb^RsZ^0Pa z*@PcDo3o>Dr!9aw&d3D=Y;Q@H2=S+4c;n3vhnK7o;<=K5R-)+=@638PE2XW9RPfV} zF@7fF877i`>!>Dyo+Iv6wB5cr`9tk3nBcLxCF(@vk1IdCiM>O1Gd*YL*V5!_tf8*w zqpNU*{#Pb#nkaTXO4TyS-Y>0eIHxFSWyYSg(XN4wa} zn8GrTr*h|n`r9`9p{AU542h`3M( zZ)ei;zPoAuR^(pf_e^WI6A(=TdvrC?y_@v;^W%6`vAGw=J4)(CjZKQ|ERYL7=#zjL zJu}AH(a4@c7(dSwtJLZ>Huaelbg0k|b@TkOdO6cSh67SVUJ&O(m#FPCJJ>aDsw}5W1xn-$`=b083bEQI@6u2CU`>sS{r$ByYuI97g&)_C#BkO|`AcZbKM&!9 zaG~VYYzm@PFDC$?1!y{ z80B*%EanP|sK6X`e(PWB+CoOWN1R07SL@qzS+*|k#!C@%)h%@(*jtMjyTiJ16;pEH z`jZnitkUBr313Bs))Foy12yr{s`mQ@aXllduYbU&5H-RASoENNO!1&tLc6o+(^2y% z#ebC8#DYHz2*l)k=mT*ta!5q1Am^#m9zoP&5+RFVnI!96tf3Mim>~mgvFJX*L5S7L zTn)lfS+&@YztE&4kcAIrB>)w!wX537u$X>@jU-O8i{hgNwvO_u#;OC&AwW;D8m5JBh4Z0)e>c>PGf~J&duP)M9DQ&CsWJMp)FFSL9)ERq zyPBNHtFm-?7?FhWgm53dKAwn@Hhs9i@;|ivC|^qhgI8(}q%7&%lQYi1-_+i~8Npa7 z7C$DQ3%tLvwnzTJBv*A)O|kBSVVAh6j=*Y4(y1aR#2fx$`?U~!xM@G^s3R&A%!Ji* zEVW4Ua)wb&%Ujo1h7r0WfN_5MXR&hn1u|h15jEDVU^ATo_YY=!J+-0V_7FqCL#5W? zTVB8@F2F7Hhbp=U&?Tj`H znNcQQc^Y4Qil;gHPh1(sq||hj$g806L&cLW{Oi#He1J(_I)o!PB>S#sm^A1Oe_eny zz$DO^0!JS)gPQ`uxfh>intUYkMnF?M3=MCU%k89Axf&~W;=h84xJQHSwe)hfr=s%y z($?X@p>wbSTwk!%jEsj)YrF(>c&Hwb_-MC9co$`dLK($Seaa>)#*`c;6m!(!KF4xt zq^L|5H^AlRx{(GYxv;aB@=S(ZTs_$xE|$wv#p`1BnU&~9W6sFI-fw+r!X0E=#j9Yk zEZ=<4d8elODQMn>!-)NN)jTY%y;OW=Y58DH1C=K84GNFQyNhCA*UU>2)}|4LPoxQzHB3FI6pP;_Zr7r)Ud|*o*gHM>1Fj`!S{e0tG+^0fZfjmi+9&EFWOf!TQGDs`f5x+lOnGrx6Wr-W_p}6z7kOslGtbQj;c8Tq!Ab{W5LB3hKF}yOEfQ%=_<1 zj5XR`-eyGtORjlvh}xo;tRKA)Q4;cQFTI|ZWGJW^r(BYJrS;W~v?y9zTBedq6EA)Q zqg|E;FiffJOgs+qz&Pm_is2N)t{UZuSY+qP@-f(yE*|L|aJWf(zFLazFH05OUmL(s zybgGaWCodaX{&YBtd5@GV+psmF5J>VLVLvZan467DlE;mtbg8huy?p}kP7!r=m8_} zavof!SBi@PPKc3G%XBQu$ZDi_PWHZaU&U+i)su=9RYt+}Rz<^^;pS3}iYnboC_pcs ztNu53&q`&p++lY;EUGvXco zrdIOOtI|Mksvt=AU&vAzX+Zk^a$nE#H8$782F6{wOuM7hDf!fy4iLM}AB$X+~W~nnZjMJ?>fQyx>e!oVlG<14$O-zxYOA zh61-KCs@T%@xA-P%dQm%TX7bZ$e!|-vH&cVQK=+5h1vapPVm)|uPl@n_Wc-dt6LJH zb7%$has!$A%aKh|4CY^qzRWMMu$o@h~p7;>4*tYg>6WGZcyO$Pj|f`7OTU*>v^EX z?zprkaC$?%Uy-S&4Pl{0hujOI4oN|M)PoU5b#=2VgbJDH7IYZ0j&2f}F5eO&5wVia zxu=?NO2xv(vPtpJ5br37LLT^5%=hmTMJ&~m#3@tQnj56TzMh{PgNh`)NC%4@uwb%T zrm{6dfLGBSiZ2(rqp1vwzH3`c>~UZa-k-F|f|f)_rLb|;>v<=o4-$U&k_2n(C4+@^ z){URq4xqKy%^wwfEo%hlDu&(Xi}SAumVTNtn)Y-W4axYjI9n(JiKuJ0bMR(qYxQsh z&9YD^rY|@UFdY}D*Csj151EO9mP?R{)SOsQXyl~KC@i)sPCcGJm|)VNlMQx8nR1#wQ)+G zhN!XzARA7}cp3Y*xbBWC03fC52k6q-ow7BUbDTCHe|cJm$XE!AZR`nK$Kyc z8#dn3etd`ZAZSB@lZ38P2rzCmOyg6ntIebd=}neG;3OilOl^;kRb*{NG#r3I!IUTG z`?4eiT4WWBYK2r?(%~Cn`&h1Kk$G-_#>WBt;^h^s`&<61 z9xqwHxwfU`+wfybCN*GP`of~fb!dL(V2jnZ@Z_yiu|L1z;wtj?(WNSoh!DGa#~)I^ zDy~>L969YbQxatWbB@86Z=8cfCPp?)pKrD`OCl@WaMsj;6?iILV&S|)j9uRtpF&O4 z>fYj&E^|b(qqEI7&@A}2a?q3S;|qyE#ff~iH&g9bw1Ur?*yM^f2SJEzL50||KkTCB zM&K}jevmiRORyw&#o(fi;~9X=5a*z9^Ba{cR~nQwD2htI@KiD9!fhhH3ha32$>dNk zzDg7Yn*wSD1)1$_{Bx(Y?iCKH*p_7Neq#wk zc5PABvGdByG8lllvO7V7^5+t{S|-5s?OTxpL}`b@a9`AeiagFYxwfUzSPS82xDqx} zV68y4s~2zvyW0&1&e*f1(i!#cDTUvXpa-#z!B>nz0|;5JYl)^uq&bF%mO|XPzNGLS zU)6mj^+^c|y$5#}io01&PK2$4-4Z<4f6DooW3-j3AXyPi0u-woEzdX()t}3a>yH2A z^2W+1bko7r18Z;gHc^R!B8yu(m%(?My~or}vU`C9X}~{D5=@pG^<$wRV2eTgoPkuu zxN8(Io_SM9N^PP>b0$$F=<>r0Ur8T$}!UCjGFw&q`I63N8-z09pG>LNtPjg&z#z{3EQtYO9u*hmYV41Cev` z2~*s{oMyYi6-;(&vm3e_J-pl@LO$Bl%cmv5B~vbkU@W_mlHKRZ!@w-4CLI1vF^n z$A=(L{ho7saSejQ=b60axWuEX9*K*5c~Tl-7fl@VqWglxqicYj!-ad2W* zgE$Ug8PFW1H$lot=?hC;Z=S`WFT5X_#OW0C>axA~S}mP=?b7N1MMN z*0$d@4p`!`Meh!Q6o2ITYdu)0=74y^%3*cEvf{(3$x?tOBcniwt`LlF_RlQL zP^CQ|p+t&7+1?SiYoZV_oslwQs9!~h)>Qs3nyd*Bt)TUl7bt?P5}m?12k(@NWM%A% z0c{S4!X=?QFV2#vx1Nh)UmWM@V`>XaAd|N;BH&bMOECz;yX92mJL3WU^hm(v(Mu_F z?#BY2h48^fD;{Q5D}8Mt0Lh9-6|ho!xE|50#j_Lx-JT^d9;7=}e(hQD)k)`?y!Qcq zoSzlWd<&P1rFTPJ&Yifr!o#{_ydznNPtShX&e2VTVv<}z?a)aR0WJXX@rH~yEM>>o zkj1cX@ZtSU80H32XVnVuH|H14s@=H$m7k2_xjXD=7J93HQ_Snk#zG4l4k-|oS_e75 zT@%Mhf3Wo#e%xk%PCTbz5YXiLQK6Vl&DY^EpbFP<>*(!#Li-bHdiL1VlKYSnl!OF% z*i4a$5!{ZC*fJmP)m|9CV^aC#?A)Crjr}~V{c5W)h4yL161=ICjBGxT0>4x`=hd+m z6AwZreDfB1d)hsQE?ybgxqUaHcUL9$QhsI0* zpLzqkn}_?u$V9!3Y;$`r!;&9j7xHW~0g9C>!NTl+W@4)9hR}C;BoUtzTAKz{bQTH7 zHyo4r@M*gJ;L$HG72O%j2FC)%xxfFnm4yKh!%|)!sDE-@wr6Sg`h@4-d^I*vdMQdK zuC=uKyNX6!dZiO{4-BN-#TJX|BN<4B#oHNP0A>A=dGTug@gkY_{)5SKIka?_w*PrtOBiZC89XSHSQbm_@xuJA+Hr6mA9s0#(elMU-`QQQ{U7n@~L^b)2=+seD z4G$7Y=Jqwf0`#@BwX>{DFxlP6Bc2$IN;GcH-jwjGg=TEQC%$~PNqPCoP3Tmk6-8j__|lH4xGaE+Sp^BsX(7#RC3HNH3|Fx` z_q=x4JYWk+8zWU^v`EpSHR9GR7`GJ$WY3E=I*=L2`R!L%Yj_<&n|O<==WBr{%X>0`-GQ)k5G4!%N%aZ;AQ;ESUs0A zQ+JN7z1{Q_pp3Kg@s`AL>xa|jdlK?et#_mF2i@~WN^I?KWba9A7R>DMm3>KA>D6p2 zk>E)%Iv!QgwTff#kO`Bp-Mac1?Gz6aIRlISJ106s!RI9>>N?fIKuF=GjmaO0J>t<{ z9J!rnL-&tCmX?+Yi-jS2eA>5yNgNl+tsd676Pwu}!kQDJ z5_8b4T~oZ~;+84i9g-@xO`Kn6ftyvm?ZmLLhv5EBDjzpd6$XuS1H`#4VtHY59nc!C zUV$5yrA-{{Y%aao*n73Hy)j!t7ue+NwyT?1-qsH*F}tbMc6@{rn7tc`P(HLi^@2W& zG8V=lp#oTSL6@3@9##TPBPul92?jd?;IAjwXg&R6Juxkzu&<}m%Zg7DK&D(JTk%7G zGDGJ@2^T67R#IV3<&_O^etA|oXEQjqaUZIiGDaBuy3@;&bt5K2GJ;qP7`+pc7|_V@Z<7;Xa$FhDdr#vpXI=e~y7!YGtJGg=+ed98K)T@tI`G4g;Wb zZK69zT6CP})9II`)n$P$ic+%sa13*q@z$R!Vo612nVzP=;Ec@cxg$-#C6iVm**EAj zCzr)>i+#~z_mAvwiV7#MxhN z&a~&OrEbx$1{j#Xo`Zl?$Fjz!2Q+)}HR(K+~^r14PvnV_%rzN&M&^ zpIFKizvXnGm#unzr%ZPWF3&ZcigQ zBd4H2uPNhR+)URnJ1J`^I#ST+&CYL3rv->qS72=gL(Ko$dHLN87-gE0Yn;(pLTcQ_ zMWnZw{S)Rai;H<&D}Id9Wtt^$5o8#kK)??YEZhJpVM%T{k&DlDxC*%7tOlqkQc%ReQJ3oj+uM*ZTvELkE zFO0t%Xa!BTp3A!iV+LX=@JK$({--ZrRgF0idwahQk zx>qX@oXTGMANlW^i0NZenbP4@em*I9+u-J-$EP>Quo&1A1dB}M(+{$Y2VviHE!#g-Cq#)8pEzsC@k$)Z2`yaWygi_cmt7(nSFm3+16j4X=UK|yFWBJp#7AE{zz z6)m6wf{z_;EhpWx*)AXv$iRw*dZXD~uBu0J=pe28uiw=U^DS3EVu7o{RQ=>UI{J0Z zJ)+zA!_EFVaGQ{B7|WC{?~qAD*x&C0_wJPCypz6sfvZswf2wq! za^FrXjSYqMN3Rm^@+t|b2RqAHg=+^3z2MbrWMn&&h5nd`q(BHY6=vM%!DYynjlNcv zpS}(>epgA?{R~*v8nPFAdMIm=k?6k6bN6t(skbNZ`yt6k2uHa%^NP|=OvfDkQUS1) zECE=Im`Ac#@%~PKpEx$QGRS(Ot1=y8M4I?Bk!}s4#D!-i57DezwFNHP{ZTS zs>?;EDrPDa|3S?yOuk&StPny3Kl<&)OT3`j=efzGGLJGd!0?xOwpC z?T}jy$|7vY?9<~?zhn@F3VM@4U+1T%cSA(zamD2JL@LP{D#=QVyHH-|8mBEn$&k3) zg4Ttsk%}OBkZqy+R_&n)yyEJ9j>BLU0fOqDQuywI4p5U6c%Kk7F{P4Dn5yVUAg6my zFbth_et13qG-32K$uA+4lWwS=MD$0q_*rTaZ>%1e+*HmXOL!JmZWg=40NQKG z2p&H@Z~Z$qJheMF9)*t3cGh+q`#^W^FjWMMRWpi^_c^cWIS{yP|Mq;I^0)o9_B2%O zFXCYSR#obquBs5mS6z zz`s9w96eGCB9z-dq}IF}Zz5F%451kkLG8z}{5blp(h~amFD{TT5kAEvP4*6#ZM!gr zAckbxeg82vvg9+$Q7|z-w#VULoKg>#|3SxW*aN{58~%>ha`E+d^^HbPIlC57*p+8M z?HBqI=|j3W-0=$`7yk29`Gn#AMYfbeH-oY5R6Y?pJV4C*$c(&qXRjVU;>1~KkYXapWGM#Ejhl6|B%Y9i?hx8@?B%;CWCCh7}^t;cj0h#T@nWyaD!XKjB00Lm`lzC zC+`2}?B2Gcx{_{Dze?_#TJ^VPC@{u{yPc8}kkP4>0&L$Uk_=i1iKT;qdguKP`|IN{ z=S+cJ-g~vxe#*+sc^D%`9D4MK&^<7Ga-ZJ0BVD;!tp2x=MHQyg!yZ|A1oD{ez0lyX zpJK<{3;en|(eC66w=MV6En8+D1ScoCGk>lqVi4g}hn1MeVpRvr#Y9kD6|~&ax=ysK z;m7`VYsLOEEV7JNVp=Ks=BBg>B#y>+W$_oEj!R>Rp0JA1%ZfwKOIQ(Y1%c*3#78-+ zdza!cAmiOt8l$1?@$BSZum5F8X^Xo%WRTs{q?l97^*LUtZ5ruWfaJ_mScTi4HF{*4 zp0&PO-FyAnF}lm<((ECa4I}}>{h!s9`k&#|Q66~$`eiLp_~rOr5am+_4znx)cvlGC zVrp9+XKv`T(~s%deeVEmBubb7HlIX}&}IMpb0$Q`;XnWRcj=ui4-J5=8N!X1dDA4b zzx=BaMrwzo!t^!s*kRpHh>G3@+?lSE1mk#kpDb{i^yaccnF+ewn03IDB~;{th$P?P zf4R3>-~oZdl|9;%h3RS~eatT(mwCnP-~@A5Grw*j5Q z8J1_L@4GG}zLg-DY`;7Euv1Kb4~3E%sX96e;;yWbvUePtEKZD&Ymp1p+|49=lBY>P1{NO@C z&3EJ;O?Hr<^!L7qJaK?Umz$^mjT6WF_>_q9xA7)Lzga2ZypXiz=bb17OL#78LDDIX_k?Qqa7~4YF(?PEKt6|7ZKPoks0!HEXG_r7y7t{QM&g+A0QU z#|9aiCdu`Q55YpoPs!YtI?Z*GA7Vt@ujk7NU{}^47Q9XH?M`>%U*-#Z@?lu~Za^N( zf3)_L%>MH2<;Sis@=n+nsd_!Vszk7|KmH!zIHmLRCyNTn9USf-ETk6Mr!jBT<(9>^ zOCVAf@7gAwmEy!2V*SKm=va4FBCMYMXi7C;?z|?z@@6SB;7NtqOU$WX@brM3I06AP zd#z~9ZHx7rHZM03#>0#srkBo4GU32DuH;8)?a)hU$C%$@ePNU?W^}+edwDt?(4eI%Gd$=-F9dPg)c^s|8!8csE;v}(8Sbc znCciotvy(Sv}7m)I1ZI*EGKDTF04m=@kE1_+VLfGQ(nDAG*Evk&bg};o4XjNHNa|y zHvK8i%)AR8ZYA`_!RLQ^J>?&Go9{k9I~&8%x&(o!c2@6S$DC!TDg(lQI@6%8soBCH zso#}vhY6=PnZVw)Qp3^E+ZBo%jA3=9ZN@prb&9Qx3ej+A9&`A~L{EDK|$pK~Jb|hzdgjakimV{#N-scFhg0Z@znadTNS9-31Y@T~py9 zvyq}^l2=MH^x<%|52w0K#-cwoJcR4l8Un3NcNTlsOWCQg>=$y~!Pd)7)&8d&&8OoM z95kOc9RX1GHeTF6J-Mx4ujXh zUC*v#32uxj`#%o$?BrHi)~RmMvwsrJe}}#j>0*J<>f$Lj^s=y10EYUbrI91ffb-I8 z`LjSdF#63VU|=9XhXrz1-e;$(w0|rz(5Z`ZTB~MdISIj}kfFlHMAA z?ZVue=H0!N-cX2t`3F92nIzxdHMl|?J#LANe8ABPKMYrqJ@=V0^n(y7u@aukd zIGG$ann|E?eJmZ*Ux|C}y|w$OSU%In8{e7#wm6*hJIjeh%GwlF_TV>vf=M2QBlUP( zT%|hBVw?E#RZPLdO+y({oz@9IpXzZ_S|=Q?TBC{5Vj|+3R+u6E+|m{px5!;vK;U?iqxB^Qv7YvET2yplUz}8Et+(* zxan`?j9%%z{{Ake@7LIT#QVP!7R3H`RNp;TA^#K|2*zUZ1#myF6k*E7^gLxZF4+x8 zJi>&;#GlS><+fXMK`*DCxD98}<%SSd#)LesjUTG2In{#kv%U6MUODW!mrGsGpM2`J zlYG~X#s($;V-5EIHI#CC520JBphJGAWM=#C&R3ypQT7JD_}C%zSd!aX1Rc{fSJfV1W)Aldy-P9%cIxY& za9H8&;pKHg4%(cP_ynZz_9k>je5~e#RVmL`94qoW#^qOMuV1I5=~zRUhQL}~B$L#F zi0SdEcBAyoX}yqkR$-5)oySv6YW2Bw8~B@}Sr}m+v63ijg3*WRoIxM9{)~;UF>z9L zq>Lu!R(}>Mr35)Ya;QUM-^y`4!MIvi7oZKI^^ysjCXhfAiNP4~K=CmgQUb$rro2Xy z_rRMLHu}n)^6;5TN9BXt^w}>StO%l-jBFq0PPy*8-rf=BHbH7Olc{I;JA5Z6zJj< zy_YjXZV=&X!%ETJNhn*Ihc0+>`tlM`lV_hu?sTPcgWB10YyNy+Z!vZuoe|tC!_);H z#ImuAvqnvsm*zGs0@vtoK>C?>z=Qk@&|ThM>5ANp^bk4>PlWR1yuXyqZ(Wokmx*2C zw}}5e%GGOZ?P+#$__4)F#n=c0W&8Kk!(|T04#iZ4IOc+^W1_LE55f^K^^gnid!ixJ zUww`mVtE~p-{TQaHUID|Y#5JyOMjcMzpSSyo$q#57mA%v#w=0tNVV@im$t^>gBG!B+O8tp1WAl5~t zd_VNV&C49@atgjKNu}jumZEt9r9sKK9H1ZSNuz|}Pl!&u*yter7Z}6p3AG)d*;$3j zhw=Q96IehmR-lj*Xlbdg26nZM=PZ@1NIEt=+22cX_3plY&%v!<%#Y0J-kEnW3{=l^ z%hjod$?MF1QRm4MKC7CYKBHgeh8#yJMf!_0q62YHGKgrEG}gGvBmGJ$2)Fj>DS}h+ z6|%-Mc9b|@J{8H?kgP4^M`u8t->>d%+@8YgM6Se~43n%o0hJ#J^!eU9_}_CVeO_*J z|Ha&)$mpANDAgc*$ zXR_6wd~3~pRNPK@$ElT$ZVk;k0OKj7#~h*Lhiy-Gx%-IS8-Xq1@plGo&TA*vIeLY+pP@;`&?av&SIyty%| z!ELGS;Lz_rfBC?PD&$M{93>?xRc_W5&-}@{{$>s) zRTNOTD8|t+<(VCZ2Ug@G7Y#znryE4Md*3l%x-)#XL%~JneD^zMp z!)-y&+*$0s+TYi$ic&1S{b#$2T{N8KGwmkUNt3B0MKVukrJDkfO%1rGs_Dp-@mpY3 znoo0G?SS;WFydhLY=2n`aQC0gb{3j<@1sE;7;v!sRo4$3`8Qci_O}ouPgTisj)^J|A5mMN0)Ej zoY%Zey&+(7^Xw{>{Yzl}SXLqrAknFYXxP8uNwViu!s>I?d`CQsBIn(NrOyOkee-F{ zX5>b6rD8O-Ue}kHoK=!q@I77^=pcL4_H8(RLz!Qs}>Uw?fzhyp+r18i(F2D5)+BCPH!07qiU79KW7pY89ND<4)M1d!fvnJ*49ANeAXQ~=KRkV!xFCLEX*Ir31K|wgD zkf021AKqVT8E+4S@_yA#O%S%ex|$FJO0v zE=#fT?Z&s8S*N^P=_8g5{Omj)eJ94`z6u*P83cBLRZ)|2y*u`#z{GH0)hSC@I z^8v!}`_-|z=$w7T{C2xE<8#JK`OcUGYuKj&qJe-T48H%BBwb}A=0#NK;!mkQR>F&) zGYEycI|rb0>uV~}x3!yg-9vQ4u)x#!rsZh~317KuP)o>w1| z(08MF7^)a0q)!XBC*vXJt{#uXx2I<|FY@ko7@MThI6GR?Z23^{Mi=DO%@7p|&_MS} z)_q{$K<494#Rn?Gs#*f54t}Z+fPoj9VT2{szKOC(;?x^2=8NcjPu0D>3>2zHs{(Pa z&k?;Rsrx}%(i}`;?&P(jIlb24AZI@49Ry%Z4&12$VMFW)4~u@u<%XFC>tG6ChjQQE z+uD9w8gInKsO34LW{S9W)QIfGD)0%z&h|Fi3V>X@fBzmU z`f&E`cmJ|R$;FB01`%>h82mfKLpUAm?wvpKVnckm^H-d3cKpsCjgaCP^LLK)FiW$W z<>Z7!2+f|l?wa;4atBVYUX3m^m__TVL3ST^j6NHZ!FRua6)i-w=o~l=>8Ct2OA7@< z7F?Zugm4ZgpmmD!vE%J+q-}y=o{Ue}EdfpDd@p`E;=sMc1n-l;EN4aDGGw<}*xzX^ zwo#>}$|1SAd~O6Axv*(eQw^g05QWK2o-BW{ z#5)-(GF@Idu?=VTvLG@gyLt%eIbRd{0eu|AfR9X*EML7E$~dg+@U@~BgvKFYGpORa zqFM6}2LBpJ4Ip{!E95GjP?(p$UDGBWr){5V#K4GVa+YJF zuZ#vi!IRc>q;4cgi=yX=VFYa}3jLY0bnTR!L61`xSXMr+f7HbB)$M=AMWFcjb*CSx zohBX4&<|e$MnNqkNS8NP8oO45tpyOwsS-HjCXlT!R7@WIpm_KWBlWf?D_=ZPbhG## ze+GRxb(tCW7oRJ1PsU9dG^sp_70*M;eWaO}7Mn4Eg$-N$w9aX6lIilyocPeFr_V1+ z{~~|Vc&sApm*JKa^FORWT8^d3DVS_fd|ftMT#*soN2jc*Z4bmO0USfwu`6cPw%9Aq z(OEnPXM>N=?+qxr7V84~BvIr%Wjy5`u2vG6cW&FT7soz>(Qj7wcKN>R!ogFaZIj}7 zcadft{ZvAIv)h2W0NuU1r+ZCBPSP}LclG8vI=bH}T5xOi4k1c~&;8eDrC|yuRsrjk zG3O+{nXP)<9ozOxLo%%^M-442g<^!{n55ND$)(7q?cDJA z&{)quu~AVZJD>43atw@-8^0;0l&d{GN(p`#1#4>@?wn*(_Y2Z;#%}ehnhD5hK}tW) zS21Eyc>aI@5*zK z&*KnAm7c#HkQkwbf7K7XZoaDSiru(WM|iUMW$j`9P5MTEWr0-+*dE} zY+)Cfa8SwP{7{+q(b3}Gd~2>v+6WzN?uS$6on9`iel-d4@?gfYAt}&&?>vNDbXPzdTOT4w*f4XqDw)l(pA=Z{V?}ZKB2GD zRRY~VD+`vj`8HqGhJ^*r_~b9frp5+zD=`j=Vd5$;It0tZ09@lz{FosFfs%$M4VsSc zJ0+!SARK8|?cd?-<>J})rrtX9Esjs7GtB+9AgPkOKg^!LnBTARt%@~TrbHyGv-9Cb zGM@!Y3Pz~#1&@b`{ahW6vVVG_rkL=LRn%MBSoITO6{*O@1y$%zYo1E|AzoBcXm7bx zDp#$La}W7HKpgm8sG}-^N-s^@N~!ELkSLGm7owbaWrPQp_eAw=$5SRvx1!=G*Ov#) zVJ>|M`a`B)Js#4&2HcCeraXrVg44X+N$z8Z+^gqK<*IpKgPU<7(^06m*}WiQH*fD* zoM=q{TV$Pg(r{F*b?HRf)o;`5sA!ORB!EVg&ihF36J4y#u<%SbrnAPN4&NfKSV1V@ zBI#%`*$Am&XlByuh|{%+SCmA{)_*CtQV;QSD2YO+jYf#xra1`R@|6`DeS^WC7Z|M? zbEY#*OWr4KFqxX)?4qI7JrKh(Vg$k4NWgXA%$ zB=YF=-S7T>QyKUvlC9H*LI3Nv)T2iQ31pn?W9v^|#dQ#uRQ?QCb#vx;z6*3M)w59y zewy0c4DDz(N5Kk&B_^jA2^7G$ytpC(k@db(Vj;-De_XW1M8;F<5`TMk9tu%$ z7sHEf5bv%YpLKtI|j}R<1MZ)6EF#%x#n=3iYjj zn1?E_5s>-prK+9ZKi@Bn@T%9ME`Zi*ZVhN_dtd*=%$>kTGYD%ij@A#NY>QUqsnQx|N6B@HwzzeC+Eo zriH-t7JABOykKIL!G3-vIR=`f;^&I17`cBKXLxneRT~0cB#qo}b-h?}KO4P{&2@P7s2!*}0T9NFwC#+P2&ZB!{zwkh?OJ{_iN&; zH0_$lA#vY^KJf71{5Dnt52~y7z_Wh0cWL!0-BLG+UTo#q3Q}b53zfD zd8A$^`_=L&>y#3DtuR)fR&Q6wZxPG?I-gISnHClwupS)=&v15+r|XvP25^paf=%;H zR~*`#P(8(-V?oNeTz!rSS{E6mrGdYz3RQBA-ZhHK7k228);E-9xC49@FwGYezO_VG zvp3DU*zPu~uS?#<_eP|Ln+aaCXbx+orvyO73_HE5+s>y`bep>S9)*3)pY&nPKK>NG z=<51I%myJJ&Ll6x@gIA~4{4Lu8Yco#azEPM!6Vzvnmr$kVls7N^2^)fw@1mPe&J-& z6T&z*mukC9VF7sycL_|IRYyx53oRSE(d^6vK!GLZq{l3+rI`Z|f-l>9iZvkZL#v5U z)Oho{iVie?`fImpu9S`Zw)*hl@{6Y01itR)7k6tXv|BH(Xd>?S(Wk?b63=v+Q?XQf ziWRRgv2xi6XFk~G>Wt7Kw0XFm`Kb^?Hdi{llos6{^Vh#rJh3P3Iea^1i}b$!?X~`; z+~sjFOuP*#K3~pS5}qL(5#Z#9awgF&DU;U*D;7VC-zi#y#vk4*?G0m$(_eHpKfSt~ zo`gJi*o*upUGIXSq&a7GW5z4!hW40*c^C-+{^{h%a=7hBdB&tAhd8bqp~15AZ^QpO zLM6PHN-|TF4Fx?APwWWQ)3&k!Uf(o-S*39n2pn+vrlm8}Y@0y+qC3Q9k1N@1&t?W< zDoyVAA>e#^n5TUE{xy?(=RkH?#~LKxoAG)#d66z9(l?TH^EYfz15gIPqie%QSVXgn z(_i=tao(m9K0pKbfWU`RR~0YYeP(#=`5fx|v_G_&MCa*mAaht1P9@zXl5TD@ z8^^U69E73dHH*d}vZJOMr0aicIA2qk31E?Yd0UytsvFDpi`{f(DMRDbGA&H7C_a9^ zr-~Z81(P@(fY%-}@~&8mP4q$^gbZt>DVb?rVUlR++Q=kau1?BER7NS!yQ(3C2=B0O zAlsdXbhyW;za7olKlcxaS5(b+DQf&}^%;z3f%J#FdF!v#9&GfBKg$-2->ugsy>OD)mRSeQJ0heZ`dSw@3=9d4 zN~M_L(R7EctAZBkWl#C85HakO}H$sZ? ze_wMtQ&Nl8Ob_^-{B}BYsqoz zUy=1J3~(So5Jj1O1>-Ro&T8LXEQz#kIawJmU~jcOd^f5OK_q|h=xDDe+4f;wkf!{&NpKs3g_Z-@SL=^`<17f`58$_lqVQ#Eo;L*U9 zNZ$}frzy=-I=$wF5E7Zl8f)+@2+#QTb0nfv=5q!uommR&48yI#y_mei_(yRDM;pVd@1r%p{A^Y~w{$Yo41 z_**VrSQv$3GWG->jGudR%se8Q4@3r5Of)w79aC>SPYS{o1W++o`Zl)fwkHd0F)x9J&gOv~Bp0*HA(W0zkvK1T{q_d!laUh0vesq|7i*RA=i`W^jd$$UJR{d;p6 z891Ksy3;XJQG!H4x_4z|^hS!It2x7-NGe@*MwC_I9-heZHl)|G_DMS&(k(Dj|Lwyc zf6BGY_sGAh+l7L4a)Q2TYgW5126lPavitWBGJ7^VBx+_Ummf7yt4f{s&Vgk8M4R2Iauoj>L!9<~dWIfewhBl}BP{;U z?b#ot^s%mja(~5{VYMC?Wz)|}>Q7SrWKhqj=zw3sw6(&&#E*t9AlnanO={ki!N^W_>JqYtSA{6CnTg(oc7N;Z7B0&I>y zH2*DT?E3!d{?+~SqK-5{d@!Ve>&+XCw2r=|W=5=CfChRaH96i$a3=_aJI|gR;#zEH z4oqhY&L#{OJIp@6JgAXJg3?OcDBc|1!ScVo)NJC@o<@yrV>BDYbUEDqc{^%<+SWVm z7ZW>VRAy5vQ@NVr;$sFOO>EN9LT0}c#k;!gwFi%XNaAAW;MsiI1_ywFqq*1`WRp`0 zkN(gJYPOdSiYS?QU-=i9bhT%|^63RVfLnq0PK`X|{qiv7| zutmob45r?ZDIRbS)5jYZ;9`{ehW&jJ5lRDj85j?*eiC;1f?se7I>9XUC#2T zb&=aHjz3$HxOx&N|E(+t+ps9r+S+tDbnT(Cv?vIv#t*I*;L9eKdJcB2K_^NBGMFg< zAFueppl;4W&nk^Hf6cnZA$Nz==1H{{k=8rSAhu{~*=YFo?h52rJ3l5!A65~m&IV=9 z{Q{K3*SLWywJxE4j84u{18ZP>8T=WhVbYI-Ix9D1_wz4)DxS~gv+cbi)44YutIR|# zfq*fkWO&u_uh(mE5pH-)QNMM;K*H}<&m!# z$~@b|;uMWuEWGxxkD>PG7q@YkCtt}vi0Pmgy6{~9@-^Lof>ao86WRm#GK#YIrUVj-jz zu@0jniPca``8!g1)ltleudY5XjKlfwTiD4LO`SWYAou)$!wVN(zE zZdvA1Dq8|dOYtbJ>dUhIzBIJ+xg;D^-!9BC``-ls;LbyTYf<{BAV+1<50Ga}Z=RDn z=-~2GB>a*$J&rmX4%;Ih8b4sEf%;w1gawJ$+Mk6Bn;OJtlvWRMhGBl;lCjI1+n|$z z^Q0X>vk0DAxFojR+&=ns z7(DdT5`*{PN}*gA|DhfkC;P~J;{|1HpdyiYqK+NJuG8}ZC>+NDTKFX8Qp*z`R=P5w&RJ`;-NprS!FxFLt zZz2M3@DX5@tw%#nSQVH7Om-vE&9@@nrMbk-=}02ys9MbhhB^T@lzMn7{ut|(G)6tR zU0`Uez9qw1uA3fqo?0ujW0#n6zDF12opE-4qztQ>pLpo(Cj4kT+})9DNHH4Z??T5a z1^q1h`c%c4^hG{lMwjQ(NEavB)atFI7m()bHvAo{-2+pyPBPvE&~7>;3u9(8G$BN` zuYMfAMUp!NC*UHDUzS|81CZBNq@0n-3c&F zwl&wQW8JPTeWikb%3Z<15pEffQ1Y zyn?U*_}b}DJhV@Fb$X88B{5dSzzPlnc(y}ZG_C}N@jzxE=B_{h^OE3>agyN-C9UXv z$X-F09nO(?tty8s7Q2l(U%dF>l3wR0mW+>u`P5M5?yToW@h|Xg zC@%WoSdON(yBgG$Cko|&&fzA>A!wvKQMi81-|+?d>{G&kbLq+yk%G89X^1xQe5E$( zM5keyp?ZFWjk93k6(^7tzYzXQ>7{lpwK(XT@rk+?ajNsU7=)5rr+=I~xZR(M zR7$m3tw?0n7l}?bduxAh@f4|d_r=i*|7`csTX|AM-A9V029sZw$p;}9_`qD27wF+j zBkmVDMCFs@`FGfZx0$KZx2?H8{r6lwVbSd6Vl%(tM9>6J4}tNnS=#J;5&QdPqsL~3 zT(y83CX+3Sbhk3!?^JdDr6 zrwUE?m}@XcQ~F1M$H9MUTwFuJxk#Ibi!Jzw0mNmtFjA0^ zJsrerjRl)S%pDn*5Fw&@o>XP`L$#J~OUr|%a7Rvr^AXhN zPT$|BX+L@qc3-YQfriGmGAFPr(8WkK?I9Cq+IAnIA;(3lH}Y#JfIlCaD)6bOgZ$}- zw0lqymh3}hb5{G7MN?SxOhP##-TNifU2_)Hf?F9iZKusIVfJ60{YPcl5Wto}fiC1! zVZ!VH-FZY!UIlfH_wpgF*;}N8@B;M|Ac6+e4t7jI_&b>G7KODPPG8${eQI2v+eb`Q(97G+e{- zf6ofP*n3*XHojaeTh6x)qO1^KgFR`~K-nSrFPN#HqkaQ#v4H5hHfh=%yKWzNn zR{jtwk=Sx;-Op-){J(}8AXoDa(ky(J-MwGNJ2$5U&&-M4GILx-_D(Db3q+Zv<|)D% z(}bAlUh#Z1Tv939JQIf#rD*5&_3Jcv`)fL@sFUxo*nQI1U8_@!osdM<`1(~hUb|_g zV#G%jm`X!7iJsWt_Gq{Z9NJraymfkO2vxJ47n^(S9UjrM4))=T@wGDYpm%9aJ;1P^ zDG|tslhq#q1;R0DZW9%%MmpM!mH5KBX2B(c3^4=eyiJrSQmW!7^yDd|U^-@>)qkyHSHvgEFrXJA#+G;&5JS z9@!3?6QF4ypDce@DOwTI$xE=RP~7zXJ-vQMR%@BtUwW1`@z_b%g>vl;Jj_;r48m!RK8( zO3Sb6Wc4Ux^KDWAaYKsh07kg}Keq|to@$F%M~!)RxJQD#GDi6-VuYfD=NM66S+-c7W*M69I*wMzt zN~7e&eB;jtKiiGOl-Z}vo&6VEejfPd(nORM=Vjyzrc#{IJR!CZ=$PK%o!aGGvCQ2AjYiFwq*|!f@ z2lBY7Wkrq&;K!kTQ#)Z~z0*|4VH;eHu8-rCfBiF1h|ltZxa*iKS8Av(`A3tb1^_b? zj9%z@g?@>#T&IAvqMI$AWGU^Knovd{6*`^V8fUsvye9);hVuYV<*%%ik6)dXPDAHm zb5~ttUD5t{-%H8YL)@#c6J#8En~t2cw~rWl$0=!wA%2l_rzyV4o`YTt2wA#0T-n$D zl%uE-OkJ4QO*&klV6!#!nCx#qHN}hFxH9$QW1PQrsD%q1OyZP7+ntEKBne9#q0uItvxB8VmE5}77JUc?} zXv)3)QuBuIX5Veq=C$o|;sR2b2{InJE5~6KAP~Tltr%r>;(0F+en)!s?@rRgSj~H9DertXa-vt3$9kGDUVx076=pztZtoYBG`{%d3xQ~w3S&-%vAu{2`V0DiwHyMyeoSyUL$^xPP^j&fM|oIY!2_6J_p>r4 z7NMf%i4R4-9P*8$&51m>trmnQ=;C1xz}#124id_&1cE-6i+H8lIn_ToL)g&hbOZa_w~IV-$qApB&pDXD2@m;Bs^~E z>Sk${j@u6s2~!&CO9n-iKJgoupL)N&M|$=F#V_tb9M;xwAUO?p#=J{|Aw4e35TX(c zT~Bw$!*Dy30Ku=84^-crgVd}>wQSSK7XL^Hjt|ULcB}kR5d!f%`|uv^&RH2=N(fGOEuZ}=B{Qc%KBqEfya$p7 z&qRwk%c3M;c#J%{O>}A2(P_32*PNqZJjsf*x9`HmF@f$g;uKJdU8+I@G}j{0JYfEx zF+A@s{B>O+3=bpd^eiqNhvrm5vtM2(V;O*39fywVr4v)NM;NSQSp_Us<(C_2(pg_1 zU_l@(c{HU%zxD{NIX-}}4!+;rDb#stXk-7Ea$Omi!~;9O?mhS4AzXczC%IKJ)kJ6aZgtDCKU@9+Eb53aC)-5Qo0!^zI-^T_X#FOo6Xe)4J&ztQcD)BJJv z{qZG;=y=rM`aJP8e!hG?TV9;~Z=PCld$s^=P`1Uw z3J0B$I`Wcp7O?9Y6uj_%(GOzoS|sNN!H;Daf~?1`)`NXqayo<3s-h~Ek}-U_y&EEA zeURkskQP*m6Y<3MiV~V!;}I(sWAe{s(ocFpxf{x#(A349M`8$3;ii_@Jj@`|O+nGs zuzPiNAm$}sUxNK!mh8PocW=;dS+T&JF=F0&VhkomCvU9>5AuLCPuNP%*1JmjnO?Mq zD|{i__G};0u?}wUgLm{HSr$;rMcIcC@9QQeZ|odRvEO{9FfD$*uXj()HY7W-RHfFs z#({MnhbinGOm-()DfJO5Wqj7wGEjXhG%}EfIO_nn%vJeU?Dp;J)7{HAw#@l*_9z5;AGge**^W`*u;@9#<8LD8~wy@}CMA2e2Q2aEuW3OVNL&)GZcmrkm2{AZQ_b>~qyt zW9x%jzVg}ogoB|!AM-%rjE9yd#A96R{Yp1f_{q($k}{-#<#VLVuJpgD-1HVdN)s}# z9O%p6Kcutkph=}{aWcO0fz%h!ImJU)|EFAk67zFgEX~(G5)RvouYMHLAq4DJg#JDl znEJifWi@f6XazCwdsgF)jFBBhp97B)Vatz75gQd2TeC*VHZ2sc*5Cj=$B(0RZO~P5 zM*{K87Mr_UJ*egj%OA}tySN2q)J5!hh2?NUtXNOeG$k`7uSE2`5+FY|W*j5d6MB=p z=VN&hP?DQ~aGT_TIH{XjzNxp?>`rPaH+=sh zo2CJlm|>TpxLE7b$@o30MF6{cMfP_^T^69cxG>=H1W4ZD59wzU{q>+Jn@1m@$1w3 z7sY2~zv7bLUVV6L8A?^>QIh`h<^_A=IuhSlL@FFFT z%!szU!8f}_at-=Xtg=?fmVV!sC1W-BE+5uR+eZnD|F}iC2j!VE8n1yj;*FKm&|R-A zI!-iiq|WKQV0 zbg6t5i7(X$dCTE>YFSlPxiV$CsBY|OOE{XnzE;VrI@mG64syDXpQ*CEVFL5YKS?@4 zH&e48TUW^OcFv*|9Ejp; zK7d$BYUU~PBe_5B_18sLj7`Wa6aVh2&@i={b`s9h?c=f$?%|yffnXw?k~Hk5wijT% z#m;seg)zXHW|o$cs7lB1$bliRFD!W-9iAO?C*`Vk7c=L)zv!U+oJfZ%QCc*R8~!N< z#tBAosME)$V&dqQQp5r74|n`p=Y};0^m`jyWCF}Gcmcw{sF)U>K&n(E^c=pDE@Wy5-x<@$XEGihTDhJLV3YJDxW zc2}pLC@h8h1BBf5*02#ssut#HazUF~_N4(up6DAhjVA3&vxET52$Qp2jUxo&qBI37 ziA1@GDdV=NmPQod6M;RNa6u9}v^G3L6hrD_Cw-dG{XaO}baD?)__RO%Q1&PE7VY(b z%-ww(CktjISD~zP&k)!B-w|@pOSqBABisI`*{U>u?{nJ@Vw$aVwK<%ELm z&K0$J0gr5k=r^_1!>#Me%ufFG`d=n_iK)~J4x3n?o$K>=?nDFptuOLght6Wn#{s>9 zgnCbXIacay{-y>KPgI|DZ?EmLb(d}~rKKM<3}v?^a-5+;=*St{lk=(*J3>y-?~0HY zm#47thTzcaXtqNVy_AzP1)8B^YrU8EE2o%I`Vv_Y0a)#L17H65X_KOg>{o*}Yy z!7-~hGJHa?xJTV)#hIkiD`&m*rpaJyxvtVqaJpN=1-QAT*!l=72~a%`%jn7WLO8Yg zY=3`ehEbzDYxBsHr)HAT=G?x0efep)f`FDQ_)D>5)$9mOxt*_;PnHQqk}tt%r})Q8 zm9>6!Eof7o!tYEy%rungIQgTOP}{r2?=GL;m3{FUTtl9s+sqw52Z=*8u6yv2UFNg7f5YB!R02fO>21quhe zlf_!MfvI_(S|%sqhwt1wmZa8-9Tz3W_wrXUo4v*?Co4vW}G zv!2@+qyYS&SnXtI4Xqd!iQ5uIa+zAAt|~!8LPT1laK3W^V+<0MCtJ1N#w)D4n(oiH zDkW*bsG{2Q!8vt7mqT(uUm5KIyj$FHLb|V z!>g0*>M#F=%8--x&TI@-+H20Ks6^DWb!FDMZFvQBjCrf_%}FeC7B{`>i=?0M;Ky>ltYT(!U$ zN7v`6=3rt6@=Dw`5h1E{*bgl$=X$`s}DTP}te8Opk!aW|zb>s=7H2 zbEbI(R10pDmm>T^%$?P}-|lT(7Pd?io70fAM5_-p3|}47OzZNL9z=PTm1n-ACCi%p z2tnk>(4s0_u0}vj_~99TJ-wEkJdd>dcAADN;+M@Y(()IjFjhJWDx^?wcbzmtN&ac+ z3_P0)w7L6ifYIy21t?1j`z24SP13n{yynsjl0(sQG{;ky$eu}MkP$q&%sL?p1Zw`j zQuzPr%M9l-FNwZ-`g?COWvua)sR{j98bzJL{m8B%<3k5v^f zE-|(BwBYS=LphIg$B{ZHFBx;pFCNrb?%B${|AM8=u_Hz-NnFg-9i}W zLA=IcnJ!>Txd48LCc{T4Vy+4T17uC$oba@%v7m>>@_hMsELR(IZW5wo-{8ZxUunN0 z7{B@bz0QfXYU{L^1L7azMVT*DoQ39O_qP$bIcP(Ro~*Pk#-1npM2CvrJ#bOO{tI|= zn&>`E&CFXoolc^|xCjg@gv%3XJwvXk?s2Xu;RBCyTJA5@d z`BN@KW9k^=3N+QwqR4Ohg5*1rbkvy*tJh)|rhdVY518!bx2P76{?ir#uu8)pT%k+q z97^GdD5n?5>%<6PIuxpkpjC_+rk6s{vfO*L07WrY!oCvpn{LKmgl?zB~kd zU8Ixt4bs%Wpwh~)2Zs5rLTWfuy7TR5G?2^rd(EFB5Uny9L@+ z$J`_(m)C^tld$cSO^^QGpje$T+p~M@VcttB2T7)F!S@&T+)OIVT?EOzw{o& z03^W`op{NNCEdGamp8O({kU>|LGUP?Jc*?VN)K{M`ko^@hq*!evN`;dE))9#maJ~Cl zA>DF_FG1$RT?EGAc~P~gtNB7Cy(W}#D2;EVk9yt`dC(N|#4LA7x-BmDn6Y`AP+BIK z_x`3B!czXVTZt6e;)R5W7oZ19&ld}a3&?R~_rQF~pWI!3wMIWq5T;m1iR5cOjjV*} zo4Jj0CQ7Z2^Ezp{IlSKzt{{Z zIMoh0L&Lf%#)|0xDsC8?bnETwP%v#JaU}>mY2xXewS=m0GV?vo5x%u5`{18Z=Wv@T z>?f(3b_9!>%ms2{Xw1AQcgA*uc_8l}E_0630)|KBO6iU~o{_=T@Ei3`dR?^lU-P+g zO`Hhywxq}1jIAzl7j1Dt2nW`QKuUO7%MFfD4NC-EKfUh-avce1*{br?^12+DFK55| zn*Mf-bNcicMgGf6HC2luRTclnKWt@Sv7!1D0GMVw`xya(OO;*8+zs#ha`&6kq+4Hb zlz|c{wBF}W-@kt5d*XdTQ11mZ!O4ciQePp-CnC0Y8YoTw4VvaBCMBIK z@|q%+<5s~rejkg{8TqXLZ|{5DgC=}2n9)(}D2SvJ^M_vwb|B~5yPIDU&C)tDMS-Vi zX#H`u#SG=)b4r@Zmk6$lm zRsmwMhHoh8g#0?(NV3+8AyQFLHXx z3N*fXh?%6Ev?Rgmw6e-oauQ1DtzD%E2{(w+klJgLxEgFE^^VXr8 zj{ay`+>~fo%;C#zT4wMKKN-(^{U%b|-}WQT#SYv|00ZFAQRlZn#6805>N>s4lQ1Bu;*}iTb(O^ha`-mg z`T~?cTYR4Q*Z>!MR!wSQ(SjjMex+@hG`vv9w9nOrhjNkP{}sJ{ReP=1QbrG{rALxB za+OfBQ?c{_DK&{J--$Nf{A}vLm(fI=wiG;@N40<&vRMSY!yWc!SRq9e4-@fyI6K)|?$8|lNVpB) z+v@F}-CWzE>ZNrWr zt+BA)uL~ppJiXcui1qN0DV9nvPJI*f%D&PARS4n=vU@y;VB}k@XV8vb6TtU-Scnd2 zDZB}=NiQI1=dRp8TdwgPI{ElZj+nnLMfKMwv4ZuISw6}VgDLC6HUYd>D4QUSQBn1G z5G@n(b|RAW>jolU$YUcm@`@enE9!B0OL!n>v0L4}75c`L%d5^+X#R-~NW}iXd9-xSn*?`S^LCPAf=__2HX!{pX(p$z>L#_3Xe!cLVMoxxYn zE9(0h{Qsi3-`}*&P0xXE9eG8cZz@$ktNGKn;yXO&vp2UXLuvuwpb!#sLB0CmiE#1? zO7=0A2}QV1nw$ilF8gDOsuMNVegT0J{`C~k<=U3z8EQ3HUb`TU3n}_9dsPBh;K>pd zZ_{D@*j6yTzd9Gf2|BpFQtr6^ zN-U@dqd1|3mNk+oN50h{P0;-`FstoR2U*Cy)5&_a4ZS)26wr0}1zMyJAl8_th+?3m zd|M@)_dFu4y_yAdwne)$Lifbj;1tg;0hG>Z? zu`Dup40;j=c)wH6qN9BHfM` zF}NNuNG{*y@6#>e=0Pefnzk!(zR&ku)Uj16Z0+&(Iq zM;>s*^mKJyP@^?zoE(VIQ-3zwXQjT@)T_Kj?Q%UV1v!J*2uOuk+3*I@5Vzqn5@Nin zg%Kzd9b4By(lI21%+olzeSdFzciGQTz|=5YlDwU_*1{W0RE~&G`6X5QBnI>+l zf}9k77ni1Jn&COPeMl+^QLi;;S=ER+vXd$fo1tk!_h7-=?>BTH#QN5(hyN}f3- zQ3iFF)WEp2ekZHxhr8SRj!_@f*&Y|^mMJ(ep(!0IoViSeUL0kfMIIlH=lG8e#dT4^ z@xo7&1pYNojdz8c!%ssm3x?m8emsTgMW*M8hrS)c=+O)qp)eFAHtuw1q|USlSQ4d+ zH^uVgW*RK&1oj#6m4k*v)=r8!+Pursh9Yi&9txzaeul)%Tx^(ddVTu2o)vmE*8*{P zGoe41aD#(^23xcQ&X5!kk>@7h8CMFLUMFC!hZmqijOPnug9P%PQ?^vPr!+d2Zxa~mn8r^U*5F)C=U zydQTZ(@Qtz%lQipY5LwU4te<1m7wkpjE~gE_*!4{wJJMn&=@GZ&J1UNC~4fVyQ%9v zcl)%1^ss;XPCuxOjm$gXGsjv(Mei*S!*qzENvF+Y>DkLS|4*8v zlvp$$JwS9~C$8k<;*O0q6ocP3tUUZk)T?JD(8_ytX;K1^81L{XdpB{8hTrk%9HWhW zJ+5~%4~psCe6|PYc)Gn<&i=Wz_#a;_xEo?Yx>lUT`E|9Pp)*k;g!|E(^5Cg373i7< zdtM)=sZLS=25J~vJFkgZl_V9n=ZDANBiI!7WTOf7P0eax7Cp+v^;NfEWc{o00T~Jf z@=#~&7_AH3aF}dMI{~Vtb_OU-r;B20h8@(VIVt#BxT!P5f0RyjE&K>6kdJ)!PJGT&n2OM7 z#+yPb>@)6_V^gYaoY7yrZN}Hy%j+9B{otw&mODM{L%3|4neS@^^vw^BQV~$z&o70v*me=$KX zomh%N66p??kIDf(3hP!Pnhp|=-pZO-ls;(u9Zr<;;p_Ji?&MpCy)f_r7K7Q6ts7?P zbs_FH!gGf%Bns50%RLb@BlDv+$)E~qH2oL}#?bk(A8OU#BFsN~)xH|vKFIo%7MGov zkF82nzRp&C{DVY$8~*J`u1-o+*3HE5hVl1!C(|niP5B!CHAU(_u6;8E!mobQiT*bA znHSoZ4^W9O7Yr5%!r_Wqh|ly5&H7m)^X2MdU)KEU{PGgwR$!32JyK*OtvI9~xmPa= zZMmVj_@rSs>uQ_5?%Fze6{FDSM{VL5m`-gB*~Ehv{BU7GMGoGF^VIL=`&uYccSr29<*iO)19 z+Chok`+)_OF_*8l$KEjIj0IQvBviNT{W-ckr?LKz<C2jTE8bwh8TTeXOgEFX`at_gX`!dP9=(!ds@f=~ zix)R$t%kFh?qlEc7p@3_hJ&nd(?>O0DESKKF_3m59;B|rTA*{}sUN&L*c)7O{2-(YWP z9Hk?NudGH1QR?oOZAql_?;wF032#d17hmxz@ymT`?WIym%Z-YK9j^*^&v}V*X74h8 zF=V>8m*@W}p7aRij1LHgeax&zON*&oi$}%s@nQ&UPjf73zBcH`BiF%)R#P)zu0MrK}l`T zcf4-ZOKJ=?E(*DWk5UH?4SqunlCxBgbbJz4KiT;;xw$xkvo=c0r?hg~W2`P5krr2X zsq(3^1yUQ@-nEXJ!!l!VIux;M#p-+THqT-BM!4so^|Sw^jBE@^%j0lWldHM7mr{c8 z`kR6reryGWJUA2A=wz$cqmP3fLh|+i4*^1A!J9|gQX=Se+$#h@c|#H!N<`Pk zeTnk+55jF$W^{dBdigbtd|VW0!V7S-7`BwAJrB5&dB<&iiY1D^bimRW@Zjtnl5ld% zUqpk_t~OwA>qR=`E@rwR_b&0A_+g@20Mq$yI)cw#RnEhYsA!SMMVgHG8=FQIAJE;E zj6B)}fiZJdo)~uwl2`k2Du7vio)kUg3)=LBd2@Lg>;Hz|ei4ofYoRoeqAV|D3?ZDv z3kS6>YVn#QnqiOQ2-J*Pk?B-OJ2Y0ob&juO-i@p14?O+{fW$hAq~aWMI(qgE?^h?5 zyTiZjzr4i+g6ms0JcR4JB(<@t0l?Y4E$6Yy;_I9&@e{QGCm2L3b$Cn#iRJfuuOY!b zYWu_q6KLpfkA@=Z(yp1s8ZT-O>5( z%mll$8n7x`b>FzIJw9Y*+0QXfEQ4sDzRn8NyJ#HuIhnh z4=1)fyE~R~W0N6w4KaPOItBNd_z(@*lR^t|>SlF-AG zCu*4}f&&Y4uDh>36sXy&3iX_{bCC2pn694UJw=aPeqW^sHTB(;7Z;3&CNUhzFZv%- z44!lO{8uVo5Y<;9>`U&;_HV@;4$dDxb6SN}P)LitMKu!EnM1$vj~@Y7(0|2HJ4I?tme z9*#4(!vYTt+T=RYLh{_*;y9LS|K-7MNeKytvyyOV8-5Pjt=DZ&J6utpHY@GEA8yY} zp+|kW;OgJb6w@ZAu9#MW0cd>A*u%0%8Blz9Du-@PQT+D4%Avq~uT9(Mo44^5rmoF+ zTTmJefp-RNKfN;Owy>N=C&)JolJ+BvU8DL{rXdvRZ#&HQgn?B3xcboLvx`z)^R+mQ z+SV_W(hg3vcApyW@?O}O-Nn&-bAGTLR-GwX0Hjpydb3t#qAe3tIMYW(FYWG8xc1;h zeEE;mR|V+8JhVRFJ{_N_$&DE%FsRkJJYO75>ZvyEE{po3WtVbG|o5Tr4300TSijRwfZ>etNWxo37lg2w({dF=Y~$a(umPXXCU?mq(NVp@DW*nc{>` zIOaZj^ou7U4ZHtV^SxH#{sk*LYlKfocb+khIZWh~gf)pj$Vw!qG}~W*8e3^Ve{W1U ztJ`srDwWs8+5g&o06r9V)RT(dq!jLe@8h8%D%R#_xu0vH$n`n(y!fve3gefN6|l>- z$S6o>VyE--ICfBmzQI9IL^NSf2@tAozAP+@^6pt*Zl<%lq3(nEIl#hnz&!Uq_&^@b zpLAT!_p~=kzo?8urj)otarP=OW8>lEK_wsZh~Gjib4hUur--a%PiV`L-VJrkE5#CjHwD&))g7!QDt z@I{kCO(BN%ld*$GTlq8c6XG0TzS3hv#;5vAm4Rh|l&E9C>d3u_cMUiTBao&BTqA&$6fBlK8A5M1WY|4(65*a}-SQ!b%TzZtYd2?C6I! zOvsQ7juQXB&=olQyJr7vKb`M+=A=FYGf1FL^l}&c_C$i-q=GEkrAbK`dZoL4k4x48 zuCG5&CWc@efZ+aMM@HAbX|2qowAT@auhg%Ymdd5E7-phonT@mneWt*&q<02uGODNG z01>ZCZ80dG27U71R0FDfn2#Rw3mA?Fdvw}FB-L%{@FFpw5)&@od(1#!YLp$8VtM#u0XYGbnz+b!+;p8Wwg)z=jXJV`%JR_LAMrJl&lkf7je0Y!4*V>AUq>Yyj^B4# zB^a1Q+3H-db0ya2xtZ?WL_s7l;&aNE0Df&CR-!}$wJUE8e58}N|ye9LbY zAfc~k6tA6G6ODWdbLKT4mla=PC*- zD!ra%aMCn(ByTBU`JBXh(&r^tMHzd5KoY@9&fZ;iu%Mfw_yT<1?Oj!Mzb6J23NnEB zxo5wdcQu5oyHVXCs?|sp6oo19jOw9cfV6H3R&eiP0c z6=PdWP zAoiT2k`JlGjedmX204LykN}-fVY_WlSCJ$-*&q#AWq2;FWXAMBg`tTAHXD~4)Kjf8YUG42|N03kVFykmsxP1S|Wm=d{q^B*0^9bwP(OTcZ?Dv#%3gPH zs0%9HENO<~wW-{3%B^wFA_TD>-W{CbcFqlyrq*Q-$7{HhZqq@`d(ZkBG?) zG*v89r=dw;vi{aTvwf=i=$#NI$&q#$ag~ZSx-$y?OqjqrCyp94oA{Ba@?i5Ynix_d%#%D;Hw$$IrOm-anw5wCba z>((TCybzVBw}HR|hh&Af+4l^lP&w{3=UY79Gxba3FPR_y!I!YPDZ66G65S=1v1^BX z-*X1w&uCy?6*T5{FP1+?DomS0Y0G$D=aA=op5CB!dk2B%6(!9woj@{vCL^UxWcB`o z;OyS=^GTYvj>Ip5i%-G^|NF(h!K!oKF1PpBSsE*(haoq3D2(wq5dJjw{98qt)Cw6| zzS_>r@H#!Q9GB=uI4WqOa#vpvXRQm@oPrNedFrB@lWYXN-h+nN_spl^kW9l zIhk|8G%or|c3<5YlbLhUM09u&&&Hn(AhWtovbPwAR6W!?Dmy4}@z*{R3B~(ni^Vn!m~>Pt0oh2y=C|xwkV3)~mAZ3ag9`k8vu~Ut1f9nm&m4 zitqm?^tNW4XTQ8G_faWn2~A1hh^#BD_Rc8w9E`>8K?ct?&q?FQWbRi<&}V+w#BwvE z#a1CVdbzoI0LORVp)9hQAYR>=<-?=J^Vv&f|NFD$i-UumUwzC|NP7C}@_$ETf2A+x zKx!TG=rs2De1M~HQ?R``d|!l|uv6!#5Prrw&DlS7$9^rmx}I_kH7F7YkP=-pF^#&o z_l4lVfWgqqjxTSWEnmc*z$u6t^=~0Xh%g1GYKcm}tX!)#Tht;!ZnBXaaw4O0zhZ8A z$~w>;9woVoqYDx1C8#A=)1PU0`;0b|cD_iE)@0DXiHS$aFHMUW!nQ^p z?2(M9gSEf6xA^77QgVKA_%ss7b6J1mUMS(Sw8OaD@N@F9cZ#-=QpkJc<>j1JlFVt( zMI6C`x%+$OtfaeUcuAeOQC>UuH%cH`^^%9hnm10Vf0Sm5rl*BtnJ==_u4UwL4ud;} z?A7a=Ss(>Q<7N`lJzqB%!V88QGxhW#Tj}HbYTK^0=1D#{G2Za^{IFh4?Mdq4WtXPxl2ypi@;Q(wmvtq61K}0tog#2a{?QN z{_@Vz80?6&OjAMozZb`XYoO=ah4PQCWZ78+MRIj-KZOrtlI-!f1vCERw9@&kNNGSa zdMq)=F|ocj=#yZ$fqpZBaJRUv^-JFgZY|$0AL3QlKYj0rRvK6_z2mz}!Ne`QULnhN zk$A-O6^?y<7@v$OS{BWip$QkJ9G7)p!~ec3Q|6IuiO}d(j}zYo|9tl<&P9$(In|T> zooxcs$hce*X!DCFPv$%O+?mDBEJ*IrZ*8@CCSavay`sboaAEqUlb-rpI8*>6o%>I@ zRnFJt`<@H3Gp9{NZ~RDIWLEd zcJ7b*DB>uyA+fdk*e){aWxr0(0B%J|=Fg7`Xse_lm>s7N1XpY^9oyJXBW~Xmq{Kds zgPwP#q%M_!wQbiLnxqRZ|K?k!WGO)%hG{)~!vgS$fDP(SLggV+ov@k5Ncj_KOG+ZI ze|#x#mktO%OIb<^jXqe+Qd4gQMq{;(Xc@H-EYH+gg)z&UTdS;DONpta2e>yPbZA*! z=h3N9P7{vNA7w!EAEQ;}6Q)3Uk>(g;H5l-IK@r#A8(sgw?3c^er(>|*)lsT4*rD4G zV%|!V9zcioSehlEI+kjb8lrdRSXq_FsbjA9XNF|Qkb|F^%N!(?xBN<<7{{{Woz^gk zzy0^Cx77UC*ikYwKpjvZtBYZha?J@E(&LIT0+Nf7kb1JCo8QLl;lG}Eq@=C2tZ&Vf zBHyKNQXGi+g+YfZe24u83ka~9Ao3@+49B5De6^*1vUje@xjh7C$W1 z!p1}#r~J3^1vMY!C^Q{#5&30cbw>Jkl;f&D5U5^CH+rPqP zZ@uB89KL<%M>tAHFAi1RqbjMy`*rxe(yG`OBr-AZzmi@NF7pWH?^c?7ugBB-tJjJD)h_V}eJ{a6ex z{||xPRwff9TKf|K>LK(?4-J%E2anN6ITf8)D0AQ???%iuKXFB+p~+?4jq%#hnzGu#N(|#|@>Ypac`yahA(=3D zGTcm8e(-gUN^(wx z_I0o3KC|47A(8znJ{VW&fpWi>^Pe-p`~|&?sIj}f%++Zf?(DlV3oI^b{s#9~$A5ZG zCUTPRL<=%`>6ewQ>PEtka2&e!`kj>#4_4h)T$_?!9F7VOIL~VHGymZF`rZ?L$6s@p zMKjAVd63YOox8YslgxggVJW|{{;8kW98rRugxMfcBcM71TA{0*5jYQbmx5 zHR^sVd5tO$5Sc-_en-U9VqV4~#xb^}@S$qQ0)#ld-kR68mSK(|#t%>xe}49%R?m-1 zjFIJ08^S6>s6_S%K)bUgmn|47&LL1#BI0QEnG>JwKK+oCn3o$K1i}5M_vuI(mZaL*E2zOENWD+(H$@Jr^-1f>oZD(p+7od? zaoLMLBe>}WBZ4GA!)+*=2NZUh5!AxE;WOGRsXSbkI`A?=33UEpc7~C6w!U7tfxv>~ z*3-nJn}xfPOS*wmZE34~^*e5CUpUz~uIa|XayTUJl@?SE!0u5UsGGNZoTwgnSM5`g zR0q_cwf4Fa%#PiFY*gQ7j4OCz62aSEwlo=tZ;-yem4#aX&wot2&}?2_mz!D#q}Fsv zMJhnw@F4Q0mUaDa)ZtIDZDHe3`v&v8-0y1M;*433Qao`|(+z1=rC2CqW4kC0Zxg-( zhaEGLI7vtL(P23d$0KFd7P{Z|#%{ScCREunhjmyV9|#n9g=)@(xp{tWl!e;ZO!Y!- zWt~?|+Thz>S}Sy|T!=zdC^nbM_18QA z$3l|e-~~fC62%_beU*PQ>Wg&99czmGDC1;6Rb?jQWTtTSH$;D7)|DYM0dTZg(_C5q z;@au0mKktqcLbd!k5ZgjK8!Sf^~b%>$Rf`hl{E;gHUAavHd;o#A*@7;eIA;i;mf+L zZtccWJ>r)W)a|2toBRDp69UmqdfI&cv|d)DB}95wf3&BcFrOXS_pf2shi26bi~R@{ zO{r}uMar2;3|%O*^71i!Q{A5u9!{eo?(@@Jc)dU$l{<<3&&cl4RAVeHft&pdwT?{7 z6^}tYzmC?L*w(cGh3E5A&ZTrW5?y)yvB7>*kmCu12OXuh}c;xN&> zfevXKar>!g_lYormuZ678nz==s4u9XjJ13gun8dfWo}(8&BMuOhoyOJ?U(6RL@4D& z(2qYZKcgD7ZRRsk@Mep=QJ6G%SUr@^BP!DTPFMZrdHnbz_E+d^xH;>q%GMI;1p06~>{XE*o zQGCpMhb6AgE?%P{4{Bie+`Bt*1@s~~z80sbNlun0sz4$%TpcW;XVeCAwGjY?I6nFx zMPpzaX3&v*KpWAPCP#Pp^L-E9mnQ8+50j}zM|fbRSRrM*rAVq2dU=e}t@vqx+4~+a z3&{q8CyqXAm3k&s4NwlZ`-qleE41AoW=3(tB?Srwukfn9=&!hDHpyj0Ausg#pAqy zr>I*WLwT=_tp;JU|HDT1z4BJ1+u=)=P$SF5C$3tmmWNkQ6UW}Lt8`zIt{e+unnFuq zcIrJKR~NTJsFuy^F7)v9KV-BoLN^XHW8F#uJT0ridVr`4dr0=^X>bQ3M?%c2dW$ZEStf>^;9-^xjHV)8=@8p({|6z09d=NmasSA>|j?%egjz*V7u7u4{+um~jgVTxd^`6nT8UaxQqvyn*6l zg!$9;3-4iIQN}wgmRSWS_QK!#ZtiAG(}m)`FQ_niXvbILVdb6jp#8;S*h;ugIv7F} zti<)j#UJUly(=yE>`@&e^g890eL>N3h`zuz>#^=v4Qr7gz|*aifYg9Gt|@ys26lW9 zgpz05caX%q7PZ=1*_7UsHB&NN+7gMf4SI{Vu2JjpY9vHTL^-w@v`eoA1X;_c5AToR zFALKIu?AGb9W?U&;V&A{fDy6#{`i=cnWCPuJpa$X{b6%if%fcB_9r!Y!0p5N>E zr%90HDV>9qxO7{rqQJ;79TZDv4WH{xnx+q8i1(93G|ZXR9a^J(;eAyKvP{b4nNexF zTZX1lBA+u_g7;9fmZPiK9vzoOvTA$l$~4>a^J`mirUGUvI6U+MTc4G^q`}TR4}5JMZ+~ge`F^dk?1Or=jb^P!s&s+0c$3=m#@#{Vk zgJ7$LQOOC1iu?K5Jnc*SHYo6=um*D9vyImq+k5*p;k^^qCu`4NV6cNGtI(OdDL_>r z^zkn>eXH)L)O?4vg4s66E7e-D7+t!rVMRK>kNN1a*Rd~iC<;7|AC0B@Y zmxrHKLz)(8#P?a6=wxek?R-@{Nl7LevrXT6dGq#dV2Qs?4q9vP{kouVOvH%zeEcj^ z;Cu$EO+|5vaI7=bYKh?E0U+rDt%T>*W7D?v+;B1r{yZQy$sH0=B$YaS3-jYQzv^=i zzYFwR2#`o_cm8=+1geut>4Rf|w0ZXsGZyhqV8DA4R=m{vT&2OMEz)e}8^9Q+!j+0s>xh z;S&DgOj2tv!jZ-fzUX3>FMbZ$WIY~zSfV|viyYL_7S*mW@oYH3AQoalW3s0P=X z@SMI|>Ip&~g>QIN#~(A3VeqM2Y?%XGLS9c49BEs6@d%i3UykUgq|?%O%r9)r5GMIM zR>W;bNNnTzbHzK;JP&O0yIe4ApxPL5e|l}P**EgWmSTA^gGMX$KENuP=z^dONC&CC z^-W~&=@8pKvD~}!Q(LhdD&}77RD>wyeEdxIWS+v2LC2z`S3@i*#P^B07U*QH+fgCiP8QxG5;PDAvVbEq-H`Spo&HB-RIkqw9 zi4=+?TievUFhD)^Fui$)@Nr8&jA&O+cT#4FRhTINLaD_gK!H`wBap?>EQW;GKJDrB zK?%iWTfiLMS3vgQ@_IVQt7u*0iKYesRl6Inq|rHO+_Q~p^px=5Q!ue{)&t?BS^+07 zM#T{mO=}l?o^edVv!#k9)qB+Qf%xh`5wcolW=6g*iBcX`9b3)M(#IqEGYACCU~qlV z0g}cr#OGWKofe0*m7$ZOdcUvofEOnpZWrcEdkQ9X@B~sGo;cEv4NOoQ0fVe`z{rIi zxPR7i*##C^dD~+fT#J*x7efZzas0;h%A{^b^7xNNAWc~=aacj1`YNE9#nM|{o)mrV zG6G#~BbteGb&_0Q7-M|??s5Um@kta}K3#ty6U`4#6(O1R8K)FOO$M2r9FH*h`aeEgK zM9HJch^^i^AejWwOo%FT+4HSmH|o(ck94W1aV+0XWrKsbAgxoN-l8SUxe#3ajRP7< z1D1Z-@FII7hB1(K3xDSgx92%e1C4C#bngbJjbyjd>oqHE{a3B5r!UoqO;-V9?IHP7 z@8;M1%gIOBh|dHYaJr^%qsbRb#VL>AktLjv+Mf z4xvdiyJV`vAdkdVZC?lpEDQ$$4RP$&pT+6qMJ^4*Y=-pPG9y9mBxb*I^;L3 zW?`vmQbN6EDe;9Tn|p88Cey=L&p6paS4A}2o5oo_OKv(j>B3RLZUk}jJW|@;36lK6 zQ5@|n6g&c*^y>f*T#z}F(zFq~b)5op}>ztG0-W$HN0 z(Gn4@*5lwl3bMRxvJbYPEDXhnUNAnBNRDSwF70u-KLs8!+2JbAuDPlH-%=v6@4hZ! zT!)1-9+zzhjWc8?q&MKcQlQ8WKQpD@xl(7I*SnY1Ney?LI$A?R!I3)MSF;+7tX(d; z!xd2dQ`+smw2Rklc(=MklK25W#eWc9{U!jvu2RqCRbj`Wjy*kb9i6r4_nLOx_G*gL zUc_7*JwWcGkQ$>c;hp(lQEWDFnB`)1#9>M2yqkY|y|<|gR)6mjoiN^~`KJN3(OmOAi^AtJ)GuGDE z`P+njSXgr%CvW!N^irBE|C1+_Dc|bGdXDOm;!uu*FOHH7%D+Jo!apD3tYp@TRT{n>BE0W zA~qmktTt;-e#fA5=()CZ-u+b$B%P2 zUNRIsT}lYra^y3ti&j?$l_KXVR~hfxCH zEIm_{A*xHbKVCh>0dh89`9}0eh`;tt`W%W;zV?;)M4qyJ({P1eliUw=8V-18QN|rM z8ZW8!4!;2&Ry(N0Qf9|g%aXI!`l$CvA{z_+oS$HA=#RCrcCed&Y3nig0PWAX*|Yt< zQb`VF-~N8drSG(zLv&}XKnLj{^>S}|xOCYVkqt?VUtJ|D zN1LbTY1-XGF}z5%-@eZq7a0=Owo~&U>((HVWJOGfA+YY6J@+q-u>yLIk(YZwNv)6^ zd}u@MMsxlbxoY{hwv zib`4GMhbtfj!}LBRB7Yl{3P)0LqXk#QsK;~USn1lJIeg4rAa48Ox%{FSUiKkg(q_e z2mx@K=rgGX2@PYBy`kuIXT8@aWZV)P65}RmGwU4n&{c<=gvXJuPqRfpOA$?}nrL2! z>Lh&%(irbAN+tsc(2lzYll>Dzgo8V%F2k??mCsr)f(KtWatr`u5KAY&t8!S<;JV1KsFY=7eS2Mk?Au}&u&ayh<<8T zi*$-kcQ>DFOt9A4@MSyb;r}(;4nT(J>a5O;X0_jA@!Fsx>rGr$H%4Cj|B}Op7syTe zjd{Iq(u2)sgzNiOG`9%+$Mv#XIO+otB`9|hshXnBlwc`iv$=nnU!nU~6W->54X#H+ zf;}$}`=@4Uc&(0I;gmskx^{V3P=wRxOk*GE(PWPo4VLD>esf`abE+v363@A zNN%g;}N@A%;S0C4O*-@$O3%%kEv<@~*0IdR&68ZD1}{B5%EqsJ zl@CiV-Rnu~8b1Mz4rZTb7Xh!w;~#SNVmu@*tf_>?>Xd(Wvb{XJz)P%;d&YhBb%L4H z=%#1F2(WfC&Lc_&B02w*?g0nK8HjY%F!FxhF=&!{_~U)+XR_QGl!5$VAy2CN^*>G{ zW8u{>ND{IoE^?$C^1Jyw4_Tp=%2x@VzrHP;hyDNWTBS^(7GRIyK$(LJqtl>nj@U-dvH;2iVY$ zNnB0OXBR8>>1kS&hL|+6R)&Su%9Km}OlPSE;^0L%`ET+SZpqRmI$wN1 z56J7>lbVNpfFH5TIjzVw$XOxISvby!%C}e3wFioxF)U@$fc2q^&jVvn4MAf@>83HI z^(0Qxbe_^s9MPnf8l}DNH13@)U$y}5hFBE$q9Tp>cMS{7D++_Y3!L;jr#Kr>iJ2}e zLAT{-XYYkFxHpNe8R-K(CTl^07Nnye^5fPV7R zdcWEn^7F-v&)(Z6w^O?qFUHiS<^I?7Xk#P~p;3PThM1SdIp~K&ik-%I3lZ3ywsi za}~jH#bpq}l&v(wqBcLyF9z|PG&*TAZcX2X@Jce~^Rq9|;&I<75Dp%hzB=~omf1sL zav%jy*$=p*rys^2T1Hsq!WHN#{NMl|00%)$7EIvr4z|=^ZLYr_W2Ejn{2bQ`qx&kR z)NP%`Af7XNG?~eIqw@w{YMg0!88Yd%Y3YdhJ>9z|)~< z8!p1ZZvsS{CJ~%%A(+dow``;AbmHC%$+;z~=$k-SGA=sF&OR5iw458vUsi+S-52{4 z6~yCHfg)uiU!TmTv+HmBHUL1;tipat?rmVhNV7PP3qf(v#pb(fQ*9=)G9nE&YV;l355Exri|zZ=uHDJ{f%&zEDrD9-_T>`SE2~0U1$+9`Dj@q1yQL(Q zq*oiWVK%^0-^;4>+Iw~QauSY9vXXB$jdWGxyX$Y!TcSp?SLQ1jydME z-VwJ9I@GpT213?k2{VbAeDIgy1v1EOl=Q+|m3dn*E1Ik*osX?6yPs75!YtGD&oxPW^g<>T=h>FI^^85^wmQrh3jdv^mL9(=)WuT>vF`m zMVwawe$h`fxBbdG~|iTlI3E_*|LZ-Y^smK zfR63GI)FsCX8@|N-(1HBsTzbjz2)A!b<@XUTS(LP`bO-Iytd<*idO7Gm{PZ-f0`>H zn<0paw#>wuuK}*9?e<2A{*LZJ=Yx5q9>?xqMij6KQ&A*~KYDlVe2J&ILMfnFJ~*AX z)qjG5PX-SDJad!5{`wbsnNN08;5z2B24$VX(}afDFF_HO%?!7;mCB*MvEMKag6+Z4#~C8+&m!x^5Da!w-_^?`NQ-bKTB}HD9F!;Jkretk zGw@!&!}SWMC*Sb$|08RX&YbnW&Qr_nSBuKj^jeP9vXiM!M7v>+at8wm^wD6P4{01;?!yi;+4~#}3gz83=V5&8xS3SW{05s{ zm`-;lnBoocV#8|t$KtC8?L{rNi4DS33;WGBo_7QT2VPCQL5?$9ckcxWr6o&jzW6xz zSzN!RkF}o2vp&*+Vd)g}4x3lF_~ZNv^<}Kr>t1XynMLa;t-d8c7Ju}oJC5;RE|)Q> zi|6^;4Q0qAF{ZCZw<7!;C0Yy4NZP$gByDWJSbK&B*<8$G6zBo|qPa?vgG=`z`d@FV zO&5^$zkVRCHAIb<@Y-Y>+Ik4j^LT3?Mi4X(4|h0$%l+7r9p*IvExM;&Ym;Gj97w76 z_;3=^cu>!#HTYrKH6{KjCyq`Yr!+km^yuNT1Rodo#gDpsASFs=UPE7dNJB?>@>y#; z8BeP}kLC0V1i5xB$ygIp? z%vY-f&om`^*qk^vD0VkLmoXHa9&A3He3Qmr8JH+lbo2Jie>e-9PG;Mr@TF2;7|(yNa)d=-OTJ@WU)}Doo1cEGAvcwG{0xetY_$XJ5MOGs!e#kEuS8 z@ZMiRqa%Rp_cmCv%_D*fq|B73Ynq(ndM-p z(t~dD;?vugxhG}Hzu(!|c)Is*+Q0nBVma&_PKRNlItj6GOCKc2(0ON_1dTdC*NLRH zvJslNA=7@-Zd@;^M%HPsGuhbNdzMF15d7oh z>f?Xj1#!0LUrs)(a3P(yuo{k%r}#~E3{d~dZk)|bcxdbDFZoz)G5#pgJz9Pa-f;Q! z3?n%GFl=<{W%Y9PERX-lNwRFK{-10^x|R5l)0yn=xy8I}kH!Psyk42TS2^h%s}h*~ zBMQ~6c{kg$t4x%lE^T(XDyKSNLz(x&5+PQhoNe&oKF$0f{6tv-$>8=_@U_CIUhNMn zB_#$_PHzWJpCTjnNI%bOO7v=C@=7#r-Zw(zwn!mum71dLQ7k^wVb}jO1*K(gh&pXq!&(qg+C%H1N$K~nCt%7bT zGrsH=tD%T8!QiPypRBExG^=h)Jahyq)q+}<<^1HG|L7_OK?7fA<8XIx;hK+Z>xqHB z%ZJ<15>{*mYWxGyeRuV9y|(bcrx3DnN!Hu&UlAT8=APDgWMrNnKhyNRJZYi)jP6*( zWQ$KQ(zn5}#~5f3ZTBrD$NQnc(zj z`^v}o>nhA2{#w5HyR>lRX`n1C9=xd|kE@#lKe(-;C09dm)38eapT$AS} zZu&4s0oOxZ55oM)xf8>$&RKAr)2Uxd#7}L$x}%ujGe=+ z72U1;?uj(kIotj@6!g3UZwLV6#xEL&52$q&%bnrYE%e-%_K&JDSB*fWBH`njlTPl%^_N;2vy39AJ`cq{Z z*7|?6*MoZV80bnyxg3|bbrhLBf$K@;SbU-uz2|*N z5kmho`PI@K|FOE`9SmoEii|Uy0P1J5C)2)uadf$I+*(YyJ3Em69+~wRLqu>s5KXIQ zC77clb{rV zr|nHKho*X}M}Q00KH!)GeBvv$7w2;j>z$P_lB+w%;K%8Nn1gt|P3`p09ytM&nMZ&6 zV)zW9oL|J9Kvd}-T6*c~Z5kbxb{}1fVe-4ri!=@72{jP!Nm7bs(^CVMC0N!D3q$w_ zF_t=eI+b2L`yl?&>aTl)((%5D+uDVG@ssuozO)nVMP!lxSQ-DmKLM^1pn%hizen_y zo$MZF-G9!Iy6qbh9<|~VIc2R|ET&W}kD>Rx}TSw%vg zBmPpqCW(w%KinBVP_;pRaDdg5O!bFkl|`yTwp^BNoXp={%)c1@d?$aTWe2R^gY(l| zsdlLO7XUQ+sdih-)0(`AaQ8Sd2}?(v2N)9ZcW!@+>O@IIaWb#4nztea8_D z=6_fRu!rvWsm|`l*;~1dj|%Oac_n75#X<%d+uZu^I06dkc~{ILdQbEU-g@2C_)#Z} zQe;(tlr?dchT6}cus5R9eO?H^q1{waN!@HP0XHk3RGFyzI-f}V(MU87WJ2?0XYH~E z_;A&eka{QY^G?RK3A{rhHnzNODXgB-0pX^$r*Vv(k)Bw&{ycCe`zxzJ zla?5g(#6ypzlp=md?Vw#;yumRmP?hmU#wk=t2&8ge9P1*Z{H*_7h2|rdr}VTn4Y{n zxha_owAm`m!K}kBqzwFiBm&ld_|cD*JWCzJKOg5(9)?)I-d*U|uCp-KfocL?#)vDs zRzW)Q9b-(bURzASLRYtTFDn0VetPqcWcy-N$nEc{E5Y;qSMtMmv)`G;t;@UHtGjD2 zl@B6hJQjY>^ycly6RGi!GFE=Jb~gD}E_fn^KP%d(xbBVbe5PUFRaCgzGiv4e{5ai( z>4exoMLQna*4@QDKAs%6KvllWw(*Nk8TL~v*Hq_klf5O?x%V~I=?zt^POk25-=3ay zz{(N(oqxE!YGb~foKAjQ^=QZR?WNBfc-v04_;$QgbMGZ@wRS~Ef!HEo;e($BXuBro$7&Gs)B|L7BF2s&|a^$I<-EV zhlk0GUFDk&=jBVygs9zn(!&z5u=hTqb=gb@3Jz9R(;-_#Rt=)0mXb^ zq3!1xZ=l`vh=Z8ucj}{HEJz+aZs!F&BmLbV001+u=q~uO___Delp`?Zxx>c`^Xuz+ z$FzofKD#nrm58>eg@3~p=C>q#Z2--ZWup6-snaY%QRqyWO8oZiD# zx}LnhiOyBNgpvf03TjX8Xv~6ZismPB{peP;tmzyz-QW9VBc-7B^|IlzabLpPQda|~ zIsfp~D6*>|xS@EGA7aef(?a3uO_Ys^aHV1c6I1 zEMDr);!NKiBPJOGqfW>*v@_V-S^M`rk)8a;AJ-ta@{Y%+D|@GCci%?7%U;(%YsDhg zFH%a81s`A^*gr$fJj+rXo^Xm03Oh`d1TP@(I-MV9BYfrXLwmOVwxyYCsm#;b;H#^$ z5!iekLgl*?;aK_H?tyw8T=X9kgSRrIK>~h4QP{e?;Z^rff-{HRadc_Ixz~*Jwy#36 z7TEd6rAh0O*ePE-LP#6teor()0mDWOonZ)*$%mBTcjlrd?={Z z^vPS=2kDpV6&#-dYuZ-V(i;9)!kok0TR^4M%h8#=HAL8NR-_;e>TozrnBLCC#tWa&lX}NQ!v#azg5ss z40q)k&{DxCt*+hio6=3R)2_gEvZ}ZH z3?p36cGkl)v5hIHICk(?qLcDfml)y@>%Ea>q;oJpZnPJy$S7fjl%YfV0neiVHWsU316` zbb*Sj?H_VBd%;ZH%@!h!-r#q2K-)E=1j>@+Wv_CavVOu5c4~J0Vn#aKxsHYTe!N|i zxWNYh(vQB@*Sx`df2K|jx{=;bH*quxZ3#HYvg}@K7~&9quGevI{1*^`REdlMSq0a& zI6*w^k;o^}T;%7TWM*A-&F<{xbhc9Zz(qKw={a!7ooUQSm?9^j(r_+vKMkiYpYyeg zC++e2Fx^Csg(afkGM920>B%xJv;jFm=B+XDS73{QKT+uuGQIX5_+xKB`zVMFpKkU$ zqdDZ!vH)Xxtz58SP_G5Ct1(E+8M<~E#-P{+E8f0TB!TSTa8Ga4G?$bf#>M2KvF|%N zRK|U|kIi^U85a+5mzfC1PVuvxL=S3?h^jICvZ0fy9F~j6cL>F$BBRkL-I4D=B`?F@7?~M z=LAB=dcALYyn74*h9sukHP@z;eRN04a3hejamOeo7a`o#o@)Pjp^YkH6JhI ztX9V0JDn#zuvRAgcri{(TTn0wkWqIRE(xGf66cqzql9w1wyKskO>x6~`}+_wDQg#s zasFkax?=J6vOm&vvwq%N;tPK;F~Ri=1mVDsW?Q&~1KJ^N5Q{}w3-)6IJ2cNS3hBhg z`|VNT3TjCg#}26Tkq9J-7PkxJVGGL&sA*-v_R~w@P%=J8l{AkE;+w$(ZOQC9MJ*$* zbAv>PfcGq5auGf4NeD5)Yb^sj0owcm5PhaAhue0TD)FOZss#WW9wSa523!**3od)3 z4B!L+b8{mjh~aJO=UXv{>&p8p&6?#{3i`g$ovem#MTn@a#46|O@S*`k+fkc^Fb znSY+g%~+(`eh3AB?e&Yb6&1~9!gO5+FCwutl>FnnkL5^xSe5JR5ejt%Ciu&*1s74g zfB8LxHeJ7VPL3|;O)giqj*qSosH_xO@ETxLV}&IPPOet?K7)h^pGE6CbES`;#P(~+ zfROFDnYA4eM1R;aR^vkbX_G4o`Qb@?4?;VtklRVmx}<$y*@(-Vl_O`kf_LEw#f#N_ zbR4#3TUU4S+f zH6LU(f)y-CVVE+(L&yzj7(_syPEdGnye9uutCUE(2T2^8BvlH#aw?-6M1pyxT88X^ zvkX(!*=@SJv9S>A!PRXoP)*DU*E0o1`#B9=#aCms7dK}K-?r!12+a%RZ2NBqdH*BU zE%N#|hI6Z>$;7;qUvECF#IP?!UEwC3rZ)_&)?g||A+1mj=Ev`_*ADwArnoTu0C@Bm zKBN7n0QNx@j<|@xTH5s?d4|irA$ ztORy3Qs>q9jjmfNk|~coHUx;A%an^%5PJ)iBq7pS$yEf0mI8S!6sMB39J z!{qEAni$qvYs_&yjuycO%NBw51T`kZ)|$gLgn0{xgd(7ZTUURcMO!xEMcRIJ<+7p} z|L&uvP0if#E>elGnIV(o@Za^#>Ee3?%my1_a?DnMh|NzC4ud>|*&>qz9!^|ak$!4e zAw1u3L*hTc1BqR^$T^*Z>su92zs^3+=l@Sap=cVpLRNj@T8WtdDPR5H{RE@Dz1Hf% ztKnr+s%IA$UJ=t1k_dh>0G^WQ>@|qF*_tO?vu85fd+}Y9?ulv07^?WZG|%E`z(OF2 zv-x}b2+VEn%*x^G?r=!Hr+MNf+q9wui77Ht48=4`*5x5s03sE>{I7p5zNZ${h~HhA z`8C;ir3=aCi`}(k+!g704+aX0?7kk5k&lF`Sp0ea3q zmhS3Wra`B!>zss`)vVt@{mUOE&blB^1t(ATZfctnNlYE4BR07IjnA1J54{uZ)sYFU z3z~C&czTs2ZT)dN%@snqrWnAqW-GB#7+=hn+$^F<>&}~XAmaeaQU3ydZkK&k@1oCy zyafu(Nl*6I5wAoSYyO_FE+?@) zMcu0&9YFs$ooT3G+3`mVYgQa_MLs3r{g(IvD zVy}lOBKt{)vCe}_ib3%wc8`C@;900-&n~C^649jVr$MlAkkIKhr1C~hx8*;kcXMP9 zFtSRk=F;-1`K~H}uV-L}>zj8#*nz4pbR>Gy`DghN81?}DKX}c0qZC?tL*m(-RcTh2 z-C$=0^&`?a$js>J6M2nrgh5wVFwwtFc7ON!4cz-%O+P4sFt%Pr5rAc4D1tZL=jT?$ zu8R|^c7j%r&WE!P^(bjty!HnGD~?kq-G@CV_?9F;8C*i;wvL5Y$IM2H$b5)`PMm+-4 z1ylbzyDMfbsC+e`^lG%(h;@tD0xHW1kX>#YW>>SbJPLmLJ*^2^vg;*wD>&62qb^lX zk@#a@pi2)}7`alfUTWaz_IGQ4&$ni?WDQ5KQJM5L_P1Bsdyk95x}2qf)ljDI^85?l zmYjlRJJ1$Blw((GOF@B%|#j@p#G{q+Cn;ZFxlBD(#7STl+XRc_v!yd=p}?l<#oHfx8LBv zFL-*TX8<7?$hC*jlscTMwi!+xcs!6DODCg0z0q3SZHMlbKmjh+$dY&6LHQ*==}}_N`{%|4 zF)7g7lh53u%Mq(WM>KSHy1#L-1l0;zL#8}2!<1_^IH(erKgb%-&Te4?_I@DQlDg)+ z#K!_H=9S$)Ri%|CpMIpGVie*6TEm>lF~ioNRb|AJr&Qm4dD?8#p9Y&#*Hw2?enWIx z4u7~3gUxxQ5!j#B`B7jWk8P3wBGk!6RT1gwOd|`z#73Ro)Z?Jtsw!XG9vyG{1d%K> zFHxIO$MqZ{hYXnCe6eOsUhHjXJ9uwVpc#{?p)7e2u&$zI(ue#|nZ`w> z0)LWuo$jUhtZl0BmqWO(490_pbnlQa0}zj@%xAXxc9q(OwX}B-F|SSC(5nH$`e%>0 z*9lhzYsXam2Zc1z;$^R(o0y%N$a4U8HV%LDCy%H%c`w15k-Nw&+o$QHMb0ABO>SRUi674a z!v5@dDGswm{vrlI^w~)^{|oA)t@$4J@c;a0k5azOt~MOlYwHBs+&YJ}6}!}mXicPn z1-ev)^94jay-`^ozo!|lIK9IUBFmsA_C%+bqkI#OStmFml7H7t zbU32>gMy+6Ja2yIkDh0jySSEuoSgb5sz>vs1X41eskPB$PMD%?BK5})+dtU;NB3-n z{ofm}5`)!TtRcxc^30)Hspm|`nT^B$ceDa2bxDoxVLK)Zi(30%^(`Hfu#(JZ{2b0t(=c%4buqWM8gUf6uQNdMYL^^zp#~tM`FJ?+k}1 zSUkeCKbOh8eVYYb9MJmDViq~qTx3F>4d`o?z!vHFE+4-=&M^&SD!DG+f%a@+3KwYO zFeyJ%vYzbGh*Sh@0CZ}W6(U`6^yKM3&5tk`PMEE`FZ17T`eq(q-%R$dX79q=&O6J7 z7GJZ`hMeQ@NUt93d?zdB?g0Vc&%I#s$Q_=!z&VN zzVzF4!aACTdGMjieH!h=p9;2y5Rfy-b+ky@rM9~Hew}CYbDuMI7s;75XDz8iEZ7bH zDw_|~$|PvUvly)-U(URO);W+{DtIgHx^e(}xaXTH%|?|`AX3DL?(q$c3%>(G>G5`C zsCJ8SmkO5_sGfD;71_YG-%qYiE73f;{zoPrwAo95j?Ow5TGP~C$WFxcOJwvxR!Kw}i-*scMs;v$_B&n+yD7vdx>pf`b??z8%6~sLj1}pZHNgBJ43z z^~7V0-9i&CTRh{6ml4yZu|OXoc~uih={n&PR*h~% zu8U^j?=o7Usohvw^}$@-r+QH>N-ZQ8IY1jXHj*CiWL^m`&TK&?bm8oZ#b!L4sb?2@`@* zGlZ_vZGZp!76y`Y{CWQOzYiqRucTbu7S0^->3a5_SiRH2leHUr$5r#|ERay~yU91R z|N4(aN^ugeCT9yMQE><$e%)6~p09Et_F#A8O_`#ty`4W}Xiq|bIy{Ulk6DY1Fr|$L z5MFEzffcXFD4)je8n&Q>LE)>MAy-((X9OI z#z(%pxs(AahH|=+z7IY5GROW-w~gOkAN=R!iG#~PJ^3Lg(__#^zoqKG!ui2I0!ln@ zRIT;}=0kBKGOMo0ssMja5k85mSKN@zypEALBKMCvL^MTfy}A`9 z3od#1x$F{N|7Gq15~(r81UHj#u1~Us*~+$-VHR#`Nt@yQ~$-OE0VL z^^w;J*Pdtq!So+a%E@{ndp4Oqx2W+T36$7GN=adAzfNlNcs{;F{s9u|<5qq{C3VJs zaj01?Hp#ZB8wz^UC_~=Qg!nT|9*5yDTG|u_@^_kI0-%IXzXAaQz3ypkT2aP-Ck*>g zBPM5OEx1YK0W?XSbf1{pBBc~EJc?4Nr(J-PycJHuuWstJH68Qnyla^(zqfpZKn4-F zmRyU4c<24~BpGIDM=LB=I9J2psb?xy*jBkZ&$8506+cON^aqn8kg%e{xdexeu*M>V z-rCFfPY94g=#R&`KeoU59u=$cwmM}+jgmNXDO(fMjXy4CV3iP<{m)T1%Dn1e8IxGY zXRCXwiT9IULXE1>VGNS#-wF#pRZ;G^JOgC%q`c z-d=jJJOq2K?Y02_2*ImfMx2Jf4)zXBxG0 zqUetqN&To85_aYOuPF#44Bj%m7I|i*E#KeX<4E>gUhdERPXZ?ORv|mzR$&(g%ZZn{ zK8C-eBn?fq^1x*H`)~@rxGmldQ$4Je1}9b5h3=v7vfsqN$QDd6+AnI0F? za9n7xO_5Z0y@l{rXOh+zV%FEi>a%E=)LvZ(zpXIjK6qzBK}`>03Q0I;fT0 z%MfaGGcEiBhaUG{GwT$BMFRA2z%i!-Jsm%b`$(0@9E?KK&rHOYfR1!X?D?77mgO&A3IaMlF zKS^t;`_@lOGi3g~$ps?lQOR7;(R%-;;lja4l~QA~G#-6iZXn6l{^;D?mR?_Cyp)|( zNx!e;_uf0i5l$)~arA1+ZP9e12$$F=dl$15s#ag0da<8sEZ@fA{@!*kI^DliYFpo_ zlY}8{ztVMUc*uYt)I89A?e?9X`$?cLtK>nuBGqMg-W`jxkXd_u6@sH9ca2jIRC;zV zxGdb9XGs;Tt2D@vOEq|`;!W2>}U!qNOQcp}&J)8WZC>CO`SB;;4 zJ~^F#_6s0?Ug7#WKs+fLBgx?X&8>DhlMW|4 z(`o+!FDKzYbtQthQC_NJ3pFa;n=CmeTPk$NxW!v8P}3naV9HcuP%h8?`m-=rP2Tx@ zrT82lc?;_Iz}ULp(1RU93V}McLk{s^OBUguyEomMwuFs$kmK3zmjnQ(>rm9yR9ha| znS1Jpw4l7-gBUZdsxNPjYwmjPGui)aK1I7wO63Fe@f}rAGBJ&d6*_r&rgh6j48y1V zadI5wljXS1(6)9NkH~dAFm=|F+>_z~+z7HuURk;8L1{#8dRPgPu!c3*`(r4 zN)Z~r*EvIF2z_zh3~spySoC1TyLZ*!Vdb!-6nC^GRQy3nWXTBq`rzs8XV`v#bA_^> z8n{t0^SzD8ugvw}!oYh9a2ve=mhTZW`TjVASKo03he8FRaa`MD)P768`K-C8@K#zi z4J@vUeb?iFY%vG@tz);MoOkv~Fg&f7GwU4^ry%QMTxybMuv7TK{nlI)zk<7lL9-`f#Wul8OpLGj_5%x(SsO&LSrvA9rwSWRoxlAhmx z5f}L>t23-Zo|G|1R}p%cS3NLAS#qG?gAWsW3l$n^liInoxA@pmQ^Bi?AZD9dbUfzz z26@`=f#gr}8HSS{U*$Cxv_R#t&d>bQDc&>vxu(#S1GFei%7=@h^ohn8PKMb!#q5){mSlQ-ar_arGh)FRzj9(Y_9TtdvR=1GVk!|ik}W%`(3B$zIa|Y-!x~*E z_#}6+Zk|;snsz4^=&CIcs- ztq*GONjf|%d)V6fGOHd46(Y)LDw;3UjkRSJ=AbGFc|h>K{SR@CR#>98t92Tpgdhn_m`gi?Z}X zV3d{kb6M2!9BHY@h(CR?9`{ai_p%}^z9-)0$sZB@j--?f3|WP0H&VSWx_nDRFb68i zW)YCKx01^smM#%XE(}2IPxBG7%0h?44kOx%STmd=Dfs*XW#v0J5z*8>E_=k1H6moL zzp)2PZ^soQOIl{Go(nQsO+T)TLy%pt5@otd6J04vNhzSZcI#j2DvE(l)~f6>9j+|F zqxh1?`+K_!dcS-tB276SN%aOINe)(AbMoQ+eBO+4q^2)bYR~vqF)b^b{~jO82@^jo zH3J3Y7$aJ&19EVWru<^hWKk_<*Ee2Irq?G$iUsepoJ9?gya zks_}SQvDa8gCuTym1i|V9$eE}T9LN>`-`s`L;I);j(uNw(+Fu)nH762^HWt+!{$Of z4c^oZ6xjjEU7b-W0Ew1_?KO&e?b12VnVS3ZY11u^?n7Rt_l9Bq;+4tau!=&qkO!6( zRsd$U`ksx%$)@hl-Z~A1iegO6BElSi@Q645n1Qw?&p84kSR#&p zA-m|{Q~cD0;>p;{1#ucyqUFL3ojS;un9LnsrGsLw)^4FCIdi$WVu~S#;aHMh1(c$F zJF_*-hvgvGGS-M5|2Gg$3(l zvkL?R)bhReXpvP{jCy&aQsxk^1gmIQ6f?pcE_7MydV(9`S1)Hb*DD7M*Puvq7x)!# z7LvNTtD<7yb=eGG{u2bkU)Dza8ccY6_8~faHwc%`RD1~g$%&3uhAJ%1yzWi){IVIz zo@?{qx|%Tzn7jAoAvSseBN4jvp2m3elRv|AhvPlxL2vSw;F4-RtK;;$+fS^ZI-N!uq_ka!D^iMPO2Zr#pMps0*b`;bl1e(3OQEJi6N*8Y{ zD&smVM7j}mBJ|+eIXYbox{p;Y>Gmu>oO_Us!5(-JHo`tOx_^AXkYQF7P&NrYvBeCETHAhoeH;XUS^7q(d}IfkOF zEsI)(Wr0owUYoIPxZvS+JUy97KjNa?72u;s)SV=Btkn)E(TDLT1I(lmMvL?}n1vKF z=fj^6m&(V@GdMs#1HYnhf#}7(BX7Zh$`qpQqlTnFIgxX7S+pyD%g*J8f=M@xD7`Aq z_wpM+>77yQ@j+xT{V4w{e&;CS>tod~N2OB#Z z|K?mQ;cDUu2LI(PB8G!Mf>uAtu?J_j5x;of^j?u_`F2@a-aOMPWN&Bx6~wIxgr;@0 z`4_AZcAv#eA+aVJ3!&|$T!dRC!h>6CU*I&?Z(Duxy~mVic4$+#yc#JQs^5R+0^KvB z!uFtEmRJYlrFP^#_tR%oTZ80o)nu}@EJ~-nXp`k%rWLCHaYFJMN@cP%!z~|Mz@a|TNUDy$;nGhyiqrWdv*AkUo=2i zO&OAzc0%>>3r&gJ;A!LS!XPNs?d;*v#VEv@FMids`2KYa@1px2Q?c4aKWBK#J{?~ zcW}6}R;vWlckXBPbO;5Z*u_k7fXUeIiRd?VM%ajjHvTgd&V!AoYY%l{CGnGrU|TdS z{xJEM;-%~(!fwlQc!9xO($U08;b?ts>SJy{nB~o~O`WUU-N>lB04ir`Gs(j_*6}ZqtqAp7GkAeK7_Jhg+^F zC$G5~WLvUzhm?AB+uBizh1Qoxe2`ZCsieSE#ps#cM4MqVAbx5JMv!ncRY)VJ;%?KV z7ZOn%|B`ppUU=y9GtR=YQ@0f3m5Pn0BZSIP9_)2{SYO1OI=@J83cE{OGbs8oULBpB zPWCZZd68ewDmiG&7H+VQu61O&c`mdue@Tf#dJuHHAhi?wTPfahq|;Hk$a`Ni@7_^$?w* z_f&>?0bDl^uWo}!!mCGFicV*uPB?4c`o-+}I78oEH{M*xoE%=<6Y6N#lf0y}D|C7t z3c<3@(M|bh#gwUw4b>OhvP-mhhd;A^`(E$S+hRULO@vVJOWY z3LRQB#Y7Rb*?Xwz%-Qv$+_-`*U5qID*Klb&z(@||1|PfOl}`D2a$*_52yZ`E!Ylbu z#J$zSRgK~#?K9P}yk62;2ega+aL7fs^kA`hhSeTSg?&Oinu7c_ApTfLhg_OxE&p5B z;2icLeY@}PH>VA)M=u& zbXJDDS5V7w=y9IdrHaWgyUs;(?XY@0DD%cO>0CNc_9@VCJ7DI-@d$791;)d{vX1@B z`N6=eb>YQMKJ+f{{xCiCPqyMfxrCn+u=fRPG|bMjE`rVrtk44&c$1|ZBQZ<40m_) z+TE*Qwh4d5Yv2*+W?p*u@TcUiafh#G`dX;F&+??3Ld8Vk=ataKz5_sD0;@HLE#9>fS(=lN)H7%z_kR8q+C+6F}VFf%}kqs7G zC`hD)UT-gA{eoUVSpu?$Z9*_!sBTRGv`$*cML++lPihDlG5fZwkM#Zt{x4s0ay9?F z^6N^^F~k#@U9V{5zG%--XP2En6__jrCI2VX!p{#%b0vF-S+ zSQkO#+2I3KhiOPrZG=e*NFVk!+!r#qzxSf3Ex*j~j*U$_xj3yjIMoi>rmz!*C3p(s z5DAbh_d7TXaFT*#!W`Jk583QA&4w-N?h~DO%stITdUm0j87FCL)v9|X*#I1mD9mHpkT;MaQ91^Sc3W#?K%Is7|5Yj66}Q81Vbcz=Hd z(t!Ilc)%_2gQj}Q>3$0s?OE~{VrVz$X(NF;X#ZHI^g`oZPxo|w71U!ad*KWbp&j-s zO|E)xwN?{n;1W8ATMlYTCpua@O`k{&)z+@0rHNN=}R!F?NeHG*+ZFc;UJE+33? zsU8KJZf*K13(z`Ss3dvNl^5X4R!tR%FePWLZv(p_Gra&-D?{7zlA}F?f{lQzP6t+J zEi6?YOP+g7o!Q9VPOiuigUEP6)-cS1#nb_`j&Rjp;Zb@^cK1_Mifj9DuyccQuMPc_ ztW$ns&NpK7%QZt|^;^o}O?Vv~xb7Wk&}==tlyetDjgwi=Gc4q zo(KrdB=q;?iyUk|-`lOfsn)GGzhms&RFjsJ!v!Pai&6R*Kaz>3uFd z#w*yCozf&h%XvzssOZ^vfX8<4Whls+ZyIx(4{gvAjC2g55N}6v8 zK&+KC9M}kClV-xjxsUp7I=WMKdiKr2$frz~8s~Kub4ec5ixKm(3cCnn5kGh=$==Sc zac{e}2NtGB5iPz5pgCh>q$YilbjHrfA0Bgv(9Bs0a(l~3Z+$;f!mM|*nOzn51sMhT z{66E$ZdF(0b{H&H@^T+$ZS7mGYPpd8vF33Y7pW5ino#p}4i{)rafOKn&q`WQ3&2s+if(%P_Ozlzv}aW$P|(ZwOTqlA+j^%S*c zL_|#BQKkH4A~R`ve)g&95|74l$fE`QX}|7 z22GGH?&&#@v29qX*NkD{UY*T^CQT$Mf7bzrU+v)!HU~tg({AAuKSw4nV5^KTGn8*+ zbyXzE8jMcQy%Q60RT@3}wCXlf^QYB{Z68~Q!0*^)$3{CFhopFUXNKnq%gnP=8d5U9 zJ_WsR9B7oeF`D~yxV+K=8j~O+3x{)|n;9J(4ID;Z_pG77R{8M#a@)r7FjGu)e7Mfd zsf*l}?POCjtaq4Xk?8y{88czwaFd1r>uLCOgIoVo?Ci_g2_!=fcq#ho#Sy9K=L{gG z@rLJZ3({ob$H`jbgV1wh~AU%oq<`!HX7eJ_>Rp*6E zQ$d}E?p}?Lmp!d`Sb^wOIVbV?MspHU*q**Plbuxu-Jpq2DY!evc&{77I=nM|k_E(y@ zr`4l)h4-=OB)7sP>x6^u_gOq?M^~1BCjGOkWAn7S;$kisUUpwrrnRLWg!TLMw|W_h zVm#$e!atgPbAIw4!!usQlTV^ld(*-C)cVnsu2wt=-`nm*{sUh;XEll}-~sQMA?dAw z{X`J3@p!GSdDae$B$PHDR>Qf~Z2W1B)=(XJUKBvgNz}Eh5Y;mELnlJDjxDF$R7DPZ_O>GwkRFsV-nOUP3=G2Bnx|P9;azI;52r)FoLFQ(!!NHR-+}`- zf-#ZXch_wk(AF7O=luN*<p88!)*Wh#NISk|@l9%~VV(S&@1gaUg#d3e?|p6Ez)yx#_vj}J{4va*lU zsI{tS`qm7|i$tkAJI`{#mToMM8STue942C=ZvP5LuJ+jjQOo}dypn#114|vB1NMT4 z`=JsX&vn_Fag@r%%Qik1R$0w)*});aRQzXP{%VRT`%54hLF&VV8++f^^W!SyFw8!u z5G-*$9mWY-5*9~J#Di2d8=WeCQOmci&o1$^FBj^*g_#!RG4cAmV|rbWkJ7aI83}CB zC4V0nBbxocWFn#&xJ*!^{~v#7c_V$}$yo~(Qid9^#;uBnoWQ!PACs66@2LHSK{jau zlk9Ns_2lVu6u5LZ92`@?CO5As{Eaw|s)K?Z42#5&Ww`oAOBJHlCMQL4byYY?%cB?2 zi3-W`oQ#tRZl^PzbO4r--hkRcdS3FcdAT`i&dn9uUamvQqrc`j{|1PQNZdPC?bW?& zFVhb^OxRL_+j~8Qf|bU%-T-DfFAuugW%=zf|Jg4f=Hb+9+q;o3I@7Zx5WTui6Uv!^+AFe|8zgkE_d%(QKIf+(~6+Sy&k+39g8i` zqgRzQi;FXS@x+dQNXlzfwz`E8OiXY{4YNh*99?3%0KQXJ(R;K;QB(`JglNCK9yUHh zAObR87rC!XL#Su8Z3?nFvK#(?`%-PaL}gF6^%y;NU~%@4JJlxrk(PozW!I`kGSMhm z@K$#_Bx_6ID8CJwDqUE|4#Xyo`7lG&6jdBg;Mlr6+)hr=Dy=S{D2{`X09nw{&Sd^n zQhxfln&T;o9JT*&benW>O9D=d&CG)wq0p{*l|?1s`L|jvZ{KXexQ0;wkn1n68_m0~ zh$&zAY}ldmN?)fDspd-vHS;KmHO!-PglZ?U3oinbxYMqC_!wN^zdAzgmd{ zx6%>{e#a4lZ+`oC0-kx8;K%q4ab8c2?%=;mv95F|EL-CqfgCpu zH`iC5?~k_#V1yy}LbNk}_B}%t?iZiz-4Bm*YJ}KM&ED>>0@RI(j0G2?C_RFL`naEz zDg(PvWLWT2{!+R?*17VZuVYLv-_8{;oi`Xo@p6nN(n2BOKZd)Sg*~U2-)zSr%Ha@X z?d?qt%oEoXOFPfoc!{D@PSl*eQ4)5J7dGnEg&G0+N)W;_lY(06UNN9sWe9%=`}e=W z7J~FY9M_=4J3S|3^msYNP3#bW=e4)##2b|E15cD&lA6a1)h*+e`o%myNA`#IaKC$7 zmDXp5;WnBqe*{Ra$`#t=$d_HG6bGRPjLd$Qc0w&T5-iPefO8u+KTdMtH z3l5%$Lf)SLr>H}g>JFJ~2@)D&;x4q(S#oVXRSz%)-=w!_Kbzl+-h-oF;jUz|-~ir! z(>dh-(b8wgK8|-P>%%#S`aCOZi*J+~QJcIDR6V;uzUY0hn*_*@END1u9T3) zdH2;p^8qozt**1ItTB(B0Ix8*JY1J6240TP85$eFrvm_zz}k8V za~uva%>Lo4X&z2{?Re)Eq%Qd^cB6VwFZ~74$5kP{b)7XbSud9|C;E)cW7b#nHoRbP zNU#ql<#MvWJ{{Bt;Rvd8lBRLq2Fhy8{X8NCsE61r1s*Tc;UesR!`4OyhR*MpTqn4Z zN2vyGc-cr+Sr`kFEELg&qE*PAR~t(^H!T&!2A4$;5>gP zdv(zo8&^4tF!Rbp&%l#|7R&_j$rr6}j_|V8XC8k$Sv#G*gF_yr);;?95>VEy*!Asc zW!l9-@)A$iyLa%-t1Tc~9Z~!fc-0}_i$qSQTj|OP@8=h+A)ueqs`Z7uK$C-1H1+=TBCYXJP*ji!%q9#EW;(mNDX}xUlhgXI z*Hn6g^F(Z_D3+l#?QK(#f3P!M!Gvd##*Bvibl~*QT;id#f3E=1>IVkU;N+|F=ejNx zs8WWz)7`OwLjNNDY(d~Jwii+2(gsNl$bnWTnH3?;%=|BuxIaxi0VyBir&NM+J(PX8 z$3+XthYhU?k{;mQ6j!%DW+~B{SZ??o&seWbFPIQ>EG7HY|^d^&hY<2FX z^@t-WmGZfvFK94UeCKbOXxg&2PEd8;1C;VZlkHI_)t!A({ZHves>T%Hdf@4id0_4M zM}&3bp@G$aI+Z19P@n-jii*u^u3}1#pE)P09MJOZ!kga3g7%o?= z!U>P3KRmR9^7+KA{*;FthAESk7z2+Ur8v?J$MB@TP3BfX?C;*)B(_QlaJ&Mm!9s67 z+uR;&A>c8=%#oDYrCQkGXedx9{V-WGv9o%@&Rp+Go0;Pew#Rq*H%)4Z2cfVRk1=-3 z{>X<3w(%guZslqB6tF7JGIqMf7f#icfmfQ2q!0d+Yy7Ift}hs>2)Vc~0r1--Hz_s) zFL5c;2T92@m+UBjz*7;w^c7utHJ87Lm@w0I+#E#KwqIJ;2%?)B$*a3K=)G}vtMTT! za#q$9PZxh__!|MF$N9xvzH5i$+3eF>=tmz?i?U`Qi0Fruj;_>DGOl7geRZ0K@~6XM zhabD{j1b|=Me= zTjQS&PmbTem5dpD7zuOO|C_^(EJJjy(mRbZPFLYtrqf7trw{i__y}U)G9oi@M7T*$ z;$JJggs|kt>+^Ow6_wZr&s7kO#?(HIPR0l^hrOIy<_$P+3W;GnDJ{ZNQAcJ{ zoN`Y1fo9QGQB%q)=wvOpj$?;FU^T$2B(K}07c|zAp_30pK7BLU+Tis))l)&Z{H^M@ zfM7p;OG)1Rml$Ft?PlC>>*h-``AIwZu6zi-LH~4rvWJ5A$3*w7N4~|bzn%yy>@OMB zwc$6@Xw!N#$7=9cx>S^P32pfe?`*q;Q*!?4kMV!_8(29f*k~~}XGjHwnAAb?C6+_U zoPkk;RCW_pNA8~qQPrS9L_OW4zyksrj^=O2e_&@$S7$hNeygDYi}YrD1;jFlP=1Ne zvexQsEtyFfZ-q-KsZExI4NDO#cacbUu@m-$$+*Tg&Z}q9khYT91t+|Cux3j^g$DLA z3CYd8tr_$KQv4k+5*_UXP&4UFB)0}wNDZE;d_l$jFnpmDg-4d2Uk&6ReNj+snY6U^ z^3sFXjwV_S;vv4D8q(m@2z|f*0ph0R(+C(O4S-y>_7Y&-!Wvni?;tf7s=x#4v|I&b zE+y~xKFpxOe@+fepAnK-DbDqcrrNQd3;k1O)^_mn6OUTpBxlrB6XY4X!O??tOE}ne zq59bHK(&SVs8>LP6k?$m@F`n(nX#0PCQ3^oQ28?5V@$I;CI>v}YN&3li}Y zp-xS6N)1_^jWxg1h};qB_SLWbWBh}RNaLVvzqUf1{3LyM0)lM5 z-mH9FUe?`A#T+5Z0~YTDr@CPtQ1B-|_z{0u3aY}=0f_9Nh`!kEqQeoaHT%6?SrJ(E zU`VIVenAoy&kXt#fCZM7K?ruIcy5A`cvMv`%*~61u_arlrDvV_+1_q`KV zqd)7U6J8wW)|}DZ&2{wUv~amA#nf)YVvzBZb3CB)l_A6&EQPGWPZI)PzGwqPE0QU& z+P$dj*T)+E7!rs<)T|A>?K7R&V2N;J{Env~mvWssrzDysUk%T@jj#q!0^cV-Z+14Hb{uzbjnKv`CW_w;FGx{_tJb&iW$>b+T&!)YE)hgeipw8=(Y%Ty!P2Yh5U?Uh` zW2cY5d}(8-1hvVe?LOZ-*f4N%5M_lQa&FxCUv55K44;C_1nPS@+4TfnNx0RcgoIyZ z3|7@>e#ji=nYb*S`roFl4}mvE*gsuBV~UF`W+AVdWL1_|ETA=l%_~%dI{zJ`ud9RA=DgC+~j%M*)#>h$4~B^6|C4Ft(mFqcis;&4>s19z(2 z!io&OfTyD;(^|_ci*sXe4%P-dKdIiW&t5%1Z#hZeJs1XLI%aEj(y|(t*(Ffk72W}sVlQj z^kNR?->TZXi}V8%$_7dVLu9d`=|=AQ9fw6y$%kXLs7ZYK1B8;CYdg7*iP`jU@?anw zPQG-{Z?{KwX_-ztsL8x!4f+_S!8AiJBBH-mLd&Sbi2RS_MucPby-O+9hVCgKE)ph$=ou_V)R6^bX>m z8(C1k?yb?Z29H#=DKjk|IP|RLpXF+p9@N}AmEH(5M2;fPDUtoEY7Y=P6?|V<1g?)- zWB3|oRx}gIE1NZh!5S2JA%U|IyJVo}tQZh(*(IRl1NrCdnD|z7s_wPsu}QtxJJuf) z?(s)k#DSQ_x8Nk==GO5W?;aLmKW9 z73RFZezwPse_}$#-tu6{d{LP^Jb-MZH z*B6C7(!1tjA79aD3v-g{=)#m_^$&MDE}m^sUGn2(>#3|HTFW4tF3P*lQLH_*zkZ6A zApZ1>YAu}6i`Bca5JR(jCpkV;*Ogr==<=)?W9D^sO{tWC=!w`aa|SGcE;KRpX61s2 z$=ZG|!k{MdT=7RBda=lSA@0q%b9>bM283E1)I=w;ic)#KamzXIc8E0@95Mamsk2W# zb{D}_lw+?=tDnO3ayze_peg&XyT4x?>)>(S=UT{xAEsq2&9GJ*0L%(~O~}+B2a1jl zwWU3LVZCE`*N?KH2Eu{!-$YauPk%cNiRMIwZdVgg}8x)2ZQDAFG zJI)GlwVlp9N<;O;-f%5YDs*zu;()4}w4?x44s6?;Zf-4qKPo4rkYBYwP{V)5O61Tn+h=U||u=bl~}JQ=TGdd1VU z{|hc)ctqQjJG~iKkL>X*=0$WN&PoncVP4x}O#%Yye>n-4?F1XN^E@R7{`{$Y2~TDH z=55szjyZ#fg;%8mS(iW}UD3gPB)qZh&Rn8hAOTgR`a*5l zpbR1cuuRQ8J>Lnu&qHRr#_Ssm%L6ks8Umj$B}-#aku8N9mA%m>qmb+v$4)az;*Od7=Om3W zrz(5@oZxQbM5uL+(w0^2S>ndU6Lyg5Eq&Z19~LSscUS<%?qMHlwDA0Q2^;ChH~zvX zs*(*Fdgw|w{ncd1N^V398KQyf+d9?D%W!RWB*O(Ju9~Sp2>AbX{@PwkutjawvmZ(Vj7bQooQQ0m>0#7eK?~;!`6_d&a38S+VLte zs7UIb!;GU8e&c2ZCDq*hlOs$o4Nf0mB|D=8EzL;MuUg2d!fos0%;tfWUi!cM;W+jb zhZCq&H-YTC`Jm_X_xNlIfbe_(6Yc%ld6p*saq{tcjQ{QQPyE@P>1O>Z>6Hb#RR4LJ z!%kU*SGo80ca?{YDE~C&#t@9L5U^)}7=a*Ele>AG4dd0o$Q!SW6$!=VWPUBX@C75N z1Q2^5Id45GXJ-r*-0)1#>Mxn<*friSvoGgSP2qs(Y?D%=ZRG_gM|UWi$-s-evc(=y zX?BjKx*aqWKSe3HrS%@ zxwsKny!lf~)c#f9pl(0qUgDZ!2#;tHa3-lqTIE{C=qU0x)D&(cE7#~h^-{B&(=HZ+ zJ^n69lYDnl;bQ+7gUvPRAiY~YkJ;{`K@{)gxPs3_a`846hRjB1^z)-hC6N1qBLk#H z)36r4@zdjv$vFNk7-V%{i=Ye(QI2YXC~s%C)+p7uHSm*pi(~xT?1I^V3CI@BPOD8G zlZbGfw3`-qE7ZWENnhIK!#b;f$skVX4xOI-^f=8h$|n(SAy)p+zvH_ArRJxtbf6R1 zfv*TT4>}j5$%R!AJXAQ?cCa(0e@vI6{eL_!5yxmm&OJTJbKq{1+$OF>p{!K&bM##t zGl}kUkv_=L*pr}w3O|^zgee&T!TD!7dl7}=Mt|DU>2$IH@mZ0@(|{(+*NADbB8u+w zzgro@=%exA4v;o@qYG0!uw+|qMmAf}>9)3MP$p^DJKmoYR*4KfAxamNEA?&UtI#L; zA(?OWMeiOf>0jJs^vDO{5i;tEZ zW!aS;?`3_lG9POg3WT~Q@IFZ=FS_FBblyVxCG-YbH+g}L)^jo!HC7IcCjfvB?d+Gk6yE1{QI6T>@>t*&vUIqmLC!@F-4#qMtJBpZVqN9EssnAyTsyJa{| zRXHmb4Ssox1zsntNgH);A;xmZ~Z(bV9j{m|Z;b{Q%j4ipyH(_u(_+YGig{D@+9 z?T<}YQ}khTW7QRT84^EFJEqMuU9Yd4BC+URIyY9oJ}JVq<@4FlnQu+Iymt5CHOK#T zK2I(4aMF>g;G1QUx3)G{o@NB4B-d|dUbRL(%Htr0g+^}aRmwt{v6kyq^O(cep+$F5 z`cVQ!$`dkw{Q+y9&eA5}^$ftHParGuIgJ4_;jrw)%^k3n^8uLHdU@!IoHp6W2R4v> zS!lg}5WijYPJ0yBBcWKgqY{2haZJjBku8mcvGLn%4v+Xy8spYXiRWs5@*c2NS(Mj@ z{~iUjopb%y_+9E@;*$=$<{%HyiCmhkxc9VALIujPs|?0)z9cf~b$xB7&yBe6pMupL zCKQxpdC6tGJ7(y0EkiozeiHlsv5HR6lpCTzT=$!rp*@`Y%0MiCl$K7C5_6MO7V&oL zwZPFGbUTQF6P-2M8K)iMC2}_4&&Vr%mA%PP1jnPwp~KN;m;4H#Q`2)S)j3+^2a8i5 zTty|00e_pXzTUu=v{Q5OEsjBd{o*q`!-Z+)w}BkQ24LqGT^1nO@A>_ZrlLP3G!ilZ zaw(HS_L-l8r2Sso8mW4`wD5J7ij_QjVDdkGPS&g^{#BJ3| zIwQ2>*O!08HD$3&`YweA4Qt4XrT6alldCV2A)WcR=(;6`@P7G6!$ZI!0_^O{=JT4F z5`s-#>^t)5bKcObc=xfozDO&-a4|AgHo0!;IGKI~fRerqfmP@A4)2yBps4g9%bSa; zqV8ooT3TBo-Ga{PMP7=O9o^)L+^QsCO;Aj~_Bhic96d0>7KBYBFdI_3%e9%crU>mC zA!!$eJO8xZ;y7+2nsV!)O==b^qXd67K?jf8A2mH#tXA@OqF)Vi)`{(b1RaOsYA}7F zc?8VOckv5mXSaAMadVS~lo@OVo8zekD9RV!JGFl3qnFd|4sG2>jOE0`-nrV85N}sa zZ-8DK5!#&`NfG=i3tnl0dv8>5O9_Sc1^mUcm4uT#&yRG=*$VG59Np{58xhf&IC3Dw z2lQ*Fk1ICWs^JNP6Y;Zs;btONzPj)%!=F&BG1bdq0^1qu4v!5U#on0znX85@^4;X> zhY<`C@{4*u++JL>ea=vV9vzhjm%aW(8^u94bXz`17PFPR?5zE3d-MMz?cTcLx|VEF z|CKy1_S)?%C|j~+dq15NAQ^KlK$7j#&O-{2gh8Z=i!Au{=j$=XoSDd4uC@1Wt!f$N zW#*h?#E46e9ufaJ8JfMclbnPX!S1@Dnz;T&(`uecyn54-u6|0Dq$##pt#$sxiCyYV z@~=Mjxa$20+WDUY_}jiu{AnQ-X3pwIp39}C@p8SnwGUy&bqydh2u0jHmg^o>k7wX- z`k>whV&$%mKz3gIw;{0@6lDgR3u;EwloTgm7$eMNF5exp&(SIyB0QYJG6DCXgG&!tijq`Yfo z>j1Q!9iKm}vgj;3x&`Izem(43SH4LTKo@b<>>-RVgoYTm;M zT%w6+jt>GTclq?H8ZFh@5k5$H6sQb!hL#00YXp#D!=X-S7k+uN3ifV17Nv$y0F^hd z1t)p1t|V(PR%!T8f#iphkpAwsVI3~sWg7c5mFNqP!H0&7!4p9UTtxGejdkijs@o=Kd*ERD+{z;6O20XzHyZs)c*hDv2V?O*1GY zLLn@lz&^&TTLFH86Mb~{7CF$XUP;U#L9?^h&#dpSvyY4ZS__aiP&}-dYI()k>zT(*#>P#-q}OYXa$BhH_*N#% zExlqhlf8dBRh~6yUk#`%#EYlfi(}}FHsb4o6=Vd?H%TIX_hP9oU4{aYz`VWpZpWax zmZ4k3N%;vV-C3Dc9x3jgHj-P5Rcrkzozu&=|MY4~ow1EGYfZ&QP^=Sh{0Ynbvnkd> zx0D0Le&m8WY(F-pEJVlC+E6q4$i>nN?wJ#Odeaj|UHJo?pxm$T#4sAxX4>oSEHkm? z>TAerCL0a@zDj8wD^i<0Qivt@tb~kWuZ;9whuCyaiB;>t`(yKcIfrT&xsb<_KqCup zp%N7fa`dOb?or81Hi<3|zaP->P=ezWEn`h)Ql*hO6~E4|K9Lq-z_L*eD6|lvZ_~*5 zDCp1v2pn&Y_ny#Hrncvl>9mvRH0~@@(cJA+W?L#r1|=)O0n5My(O6`LyA)9*^y@?R zPoW+|$;?0O+riOxR|G6aJbuvEBPfByOBYVglX{UK79u=De9t4g%3(eneT9x9xpnCb+gK6H>=XbK?pUUppS>|%Zu=aHg_NJ zcG9oH;j!dRW0sv6NrDv! zP_pDfTMNJj=VeESl%^y5@x$8TVvX4Da=*BZ1-84WbwlvFA7!JR;2*J;A;zt_;doNp zY7^N|w;Z=)(^1@pyq2xFIQ}rXOtw4khm`$RcoUbX^Aq)*r$H65_ZM^jhH5GjOjXwB zKG8B)g?ZviJ;$sqMYDf(kM2q`&*V1gkj5G{;!uuo?M&_8r8LXK4ps>cTLZNZ+vvmQvJ*wtTLXA`gg2R@ko&=G$y3~%oW4n;HST>Owcm@b zHL%`%wz0pq%)j=s^S`l^QjW1Y9F@{uIm^{+-!lABP7|tf^xE#^=RKs7-RG0(heJQ< z(t_XU>^C)gj@yA}H9Y$3`TYF-ETv5rU^y@m-P_k~E(9&UY%t>z^HRpDYKX*LucvN_ zx;AP@&qFEEA~*A@969G&!weH0{14BkjaY5`{JOg=Qq5qcoT7^f**h)ggZYR(E3@J* zWu3N6n0{C7Y6MT9wqLXt+Bnz;ujnj!`udAiT&+GkC$BEH@Un72K}oe6pw@z<>>M50 zcBxm|whMmhwVsrceIO?3=+o?9J5}~YsBCQQ;hpKpV7%4M?2OEmh*LLnFvuXA{g|U@ zDd7EW=JX_yrC;vwlL7v{H6*_WIqb}YL{ZCJj4_C?c%y=0j#b>GlE_T}5ZUwA1PaY_ z$OC9I0AYBxw-0P$5G_v|G3ac}E;1ErN>m_>XCEs)OG^vAci43fPjv&V{4TI8WF9Jv zo>^+-zkW5p55AU#G05!tgYOvcjPTY5jez(GNdmN)obmNLZ6ZfUXK@01IR@R?oS&eR zlJL{=?J7wtH%oelCe#N)C;4Oj0r@raKjo0?7VLud+-h?gfd`k9ire47>6c)YlVaju zo}H)Oclcx89$GByD2xun^-7yg-5vq2!@Yp}Q44PtK80TdJM~35&8ob(wv4CxSG{%& z&*v4PH0el*X>Uh$%1N-+C;DOWSc8yPHU!H-)VO){RNL}ZQT`;MkMs-7W~(6DehP>X9lI}L zCS~16dy;ItTr?qR&@oY{9xpe-_I=3Hu+{h#;E=sFRVPEN{OwQfabv4Z{Tp6|0@9nf z0(T$u^Pco_Jq%z~^vkb>(7;4)ynlUl_FwH|rgk(i{@}=QdB1w_qIMy<>)N5UGlPt3 z2wF^7g$)MjFp|I9w;G0aq>|LRt-)vL-HX1Rel3}s7jJd;|N7nhzCYEs68}k3eN+g! zkpWLA^FXqn+?Jl?pF2Q3|sp}W5k~MxbIefLbZ=<}b(HV_(C``NY&T%vXi+43&X*`g&6+T1& zrs74x!opM2f)N4=-+pmO;Nt+p;dzPb@M@ug4^tgNwIgISPqsKN^=Xqr#EIKV>ZVdO z`LtK!Zg2idr2NzSRKWh}?b}mL6_n1a*uPw6$aJ3C_wqr5@NCAJYO?%Z{4Y zdhQM?#W@^4xHdy1%2suLaxK|p! zEj~3yN%>o#CFB<7g&Q@M6M24;k zgtCL44sxDR1P!olMGi!TlwG`cO2xQ(IyZS~5a#H1E0Eq;9H8x!+G~WmB=czgXTJ{o zlzxUSgTOAk&gg}k9Z!&fRTW!Spmhb}=*`}u^Q=s`wXec9YYs+ z>^eI4*MtwjUK1pqp-znxwl}8hZGXw|RO;;cUQ&CPp=hN>tc8qeQS@Cg#=%Bs*DE&{ zD?fdguO-T+*YD2%@agji{~dI)5ZILWLG-WH>;dGfSvIw$ebs3t*ni9rjDPj6Tp4+M zd3QYz2zfKKiv&gXsQWLJUpFI3z=pt0QD<`>15@V*Yo3LbXcy~ou?m^2hfWf{=E?^P zxJ-dxgUA7YgUz%*?Ll4pDGyM{_%A<%%)>DIh!)r|k`@mDqCNgwqpL{R;_a9J(7}wdNLyepHPIWQuIE#<{v9Sdr2!i8ExI`WFPJ#5iPog!Rz7BL( zII=sTM+>wFF|%U)e@^y4R>L~-8Dee)nYg&Ub6kHEPAE3aPHS;=CqW{;FuUNJv*Phiw*K+(v~9h zpB<|iG^m&2B%K-U=gO48;l>nWWMDl>nv!SrSm_W}nv1-ORhv+9=tKU59YFe(c_C^T zuA_$m;fEy0v226<5E$?`Aw)Cn#fLf@r-TQ{zq&}5h2UV+4XGxxE)h%(2|Vuk~*^gA>uRlE$rdmqPyHGKD1l z^o%7m1%(5x8Q`tnte2Vkou8BLYeeeSuf>8Kg<>W?&HRz}WgFj1GrYr1fhgpSLj??J zH0MPf>h$$}^?PaYP{CWdnBp(uQIaz%ohYCM8qUN2`&!m?s=aRbOTSWyaEAnQKbiw` zJiDrGKbG#rpMi$;O!yd-otg|S<=na1kI~-JNQs?-7udm8n^{8P=BNhj!&_Mj>j0Aq=EVVQL4)2Kv9#c}VbEMHrftK@jw z7W*QW@Dp3Y-H$iTrFJ#uJf!~FT=UD{qvqtgJ`mC}-G$H1aREr)Ua%T>%_jt-gHB@1tkdVQw)*Gtj~E z1i+CsA;?01?lU=dF>(y;<;QMKpKfdiE{q<1x%vCX!+{AuNg;5nPG%p%+}FcgE3vVL z+&Lc{Itx%Eu&T0bWt%!=0k2hI4bKc2O&6uOg2PKxAw8*S6<>5zvXPrnF&Y|T5yrgb z8KgI5&61tZrAGd+qfb4EBI6&zvQ%AVIgf?_GUN%!=fw;%%)J?X!;5y;x+(B$%D_8( zi z>eEDQa1aAeb8_U)z^^Sb|IC{9HKjc9xyw*x#7WbrEKB+h?q)h%d_P|u5V|yg2*{;r z%NQgA#6o4P)+tS&Dpcr9{@n3Kl?S9bxp65u+cUFoRGHrrGQUtNIyp|J*6q#k)q*km36+eh>#fk)s*iWG`_%J%&*roTy5jsP#iNKxRG^+gj!;o? z!gZ#Pr+&Qf$taak7rK(@zvSjdvMb2zxVmV0#Kj$b{)R9i{>*k17oT`++%D}GH?8*w z6CnQ721S%<>v0)RmPX!qwUM00aO71ZhGcPEH5!C2#{elQHgcw^-5X&PYlu2YCsZEV zDveaAio58$3dDcJA(%|VS=z-Xe6jo79OOZ3@F`8C(3X-ViaMQXrufb{`1!qv{tWs0 z>P8;$Hc8&wbCqUdmg{?&&^xa1_3V1~)?Eqfg}ozJE88`4+!qzr@*m;|`!Wuj7ypyw zgG~gf0yuhLDP(pqawq3~bOoeP`tR_NYVR~iqZZM5ut3(1CLb~8-ZUi6bm!|xkt2q>jQXHuPMrVKx{<{yMYG_0-Q}P>} zwcn}Jii7rmw<-!pyg9OoqqnnpDZ4VubkOdaxsWM-C}vunvb6QT@p_)`!v$#Nxl5RYMvH zj`KgYF!SHjm|juzqlln}LkHZH`2{0+eD~)Wx6r%!RnF4p%Z**2#8ZMYzrL3OItDoo zUw-U_1Jkz-rmxmEUTvC_Bfn9ki~P*=`SkbSv~rj}J@{?ycRl}U5TQl8c4ko@?Cs+F zZ+Zm%DR9sXMZ=gvQggdcGKwYblcc`->bpm!?vr2Nh66a1 zt2W;q1eM1bFI{LNd=x4q9os5lZ_Z z{az%bzjO;WDPOIqu0c30rw&E|$(FbNF;eJ2_1x&FhC=z2<(^%x{7J`eu9kw!8sPJO z=fB@;`&@&+`a)n03+SZwxSAq)#h1wwq7b-p>M#%O%l#dH2q1|t(6%7sG@kAKx&mTf zOcdAG*SmCf{O%w*e!utw^W?gikECH?xM8k>=AwM7fUBt{EwX#ys{2O&#Zp)V=$0eagLAQa~@LidJ#N% zhf8sf@pR^=vI=%VbXsi4-E;&mm$bg(n~O2PvNhcNzk1>fWc3$MT*)xKYi(sX#S0$) zXsjk*Z$aL9qhir==@%LKuX8KX$prw57RK*z_W##@Vk)aHH2w1Rg{MQSng8}t{ywT0 z!iDSlp@g9Gl?@NUQwj6pa0bn=^7U@!5wz}UiwD-Y=lS$S=wNBr``!QX%I>!jeP4KN zW*F3*La;{6=&pQrYYhB5BLjL=AN+jv+$G8+7ykdW6OU#ndPDbzT@J%Kp*A?#0`_FT zHI3n{E-hP}p9Mla`pFe1;mtZx6^5qo0J^;x z;>OE6ZuDsCr~N9}vpy&Pr_j4~H)}zJv+$jY_0yBve5^$=i0MMNmU13mQ#=lioNoXA z^u+=4&vV1CubP6$d;^~9xta6JHP%7UTHiW%Ez8)33%^V>d7is*_jyXQgTNkpfMUaq zUSHkmN|2ls<;x$<2PBt-6E95wJ-t|~?}V7cHN0az{4V$-^X3U_asiSnTP90Y(m$+A~V)6v* zn+F>2waxfI$3jf(5AkwlA0TR?(;*{0EKy%WCBNX8zyFX;4BP8)m{(~80-$91 z1+DV%LNS8mw8SfuXTSGb<1q-Rj@-iK!qFMA*sto)J3h-8b>GA&30>ls{B+f4yuDxc zIT=id^#1Fd{zaL(1DIGJsRBZFv&8TPCI_s1Gv8N3SGTc%U>5b4no)C?m2@=>Rw>qZ zle1Uc{f4VawbGQ!FFe9q;$?}X#35rmz5FPH%>83u_I+bJrt2|uluRY7K5SUR$2t}~ zAIeHvLw%KVW%_9L{Gvj`Z^AP@Y@#S|`q|@^*8BE*{2mV%sY-k1kY1K5&lVy}g-Y=O zN`r)=>A@M{Lhf++hFe(>A-0ekpO%^#FG6I5P*CY1Sby;Sx)q>Rd8N}6>3vf8u3|P+ zRQl)PYdX>=XG&WC2;SBH(C~&o1;SjdLyry2z$+IpmG>sr>l|hATmZ)!)u*a<8ir3G z_O4EDLn;HZf>-7IwrN=Pt7D&0|p{elJp&Yh%Lc(TIF zWXI(;Bz3#OhMxulcWuC;=`Jkw9s%x+^d~Q&pMzDG^YT*$@xJ4kYD+l380RgcN+E(j z)Aog}C(7C{N$sb=LU~WJWZ71W9Ubd{5Vwlb*+8M*{g$9XS0@C z73;X8{v<)FCVS{>{Y?8>QamD!Fo;h(aG{n9pYWaV1 z4jTeG3MIk@cx9Yww3IYm)SC<%Ns@veKY#E49vqCG>mDVYP6L1+)%ZsCc(IC9KJB`D zdcsD1u=FG1RBD7ceLE3it~#LoCzYM)yxpeT@aQy+Nym|)nXR(XF~$e*!!r(Yf=_}= z4Hp0c{`J*Z4G=5IDz^2g;`!@0$*ws(Q8H@J-bMUkk90pFf|XLyTCJ(Q%r0(aAW5P$ z3(B`&U9Yz(2g=ONWY$CH_@v7EXsTP)u4<^Xd7@sib6vcm_650(#I}_7&e4G?b5$1E zSvfu6$?T&Txw-c3UX%L2JD#ywGSyLBuZzhdul`_x(pTU=Z;cw0)@0}h7pC-#?h#b) z?CK*_tOKLh<_$SVi?!r%i#sk&g8Eb_`jP@J!a^g>Lyn@jvV^>0u)b-$ay$>H` zQcc=8bQgNQVVZ61KHuzA0Ol8X`OaZV$|d*07W50NgapG()5ylDYki;w)dh$amMbsJ zIb0QMEDn=in5^gYh6Avq)rxC{w_lV#CwNiE@7$D%hbM_H;>k`;HILttOr)ERTLttk zqTRxi#I(%`I{QR<4l9xR$%^{yUGFLtgT)IdmX<#&?3fbsR1jVcg$;g$OP3xer+&(-E#E?dC&ijy@OZVZf88R)Ca;+0P zttSgUog_=+6|97u)SX`E)ede{rWg*rrK=eTaI$Ygr(>oJDK!GNBaI1(A4Y7)n!$2n z-~HL2BybB#hP}cvJa2HXMNU}CLF8jAh<0cafPvVo^%<-Yiy6UoQ; zdGBB~S6spzhc72`wSOB&M?X7A4ZBt!Ki)4dMWsTfau~lF9ByRvG<7QG{D#HQfs08C zrPqJcU@eWv&jy5}8+}18JvBYp!YuE4Q|zUCfP2S9K5DUH-wsSDyRi%bu%)6&eQ16@ zd!FOs$tp3%p?%}Pb@sD^ENWPnZ0@;7Mw$|Ny7y~owg-#q(Rc*S;I@|BP5UR752h=@ zx6-Dj4D)GdF;#{e><+8{?o@L9E)%>o$zkGrU(;$`->!O~`7 zS1+A^+ zd0{EB^Ga2%RK?Kz&-qFboYDsJ>vbaxzgB2}Is1dlsdr^vN&bvm@kVhlKpyxgScrC9 z?s#JA8cUc`b?w!_ldX*V32Jh)7-^Wbw4M5%{3O=WqHIZ>H@C6l0{u7Y_Y*4~$`;j} z_8wM~fAl8l{Z>n#>TI7)`&(ID%5T_JmEn6icGg1-U^M3?8(xECM^7ywMfe|IdM}D7 z#jIcW8tsl!m)}}qEe$_gN$vKtq^aG|#qImoB&aKl_GYqtlq$HeJipVERadCD!aUtb z+HQ2jC_nG~h)SF_x}FD)Yv=A!W@~KCZUy`|BRUXD6JQg{ZJavgeBCaql;nVYZCWcY zMYorYDW}Mcu?uaZ1&pn0ViC@T=@p{Sue;+1is6r@gbNh=&p~Mcd_#TRpYVGw;!?Z4 z`q8v8e?EJQT6-F>Y9!9WWl!691|uPLE(yZPxgFJsq&#p*Jf4cd#4~TMVl!`RxCvgg zRN+X~2F?Plihy<+Pd>01Pd4R&PIEgWsZwQ4CBhj6HaW!WOf~pwGJUqUIoVs?=#Da_ zB&mD-I)m|CLgvll%v2LpWhLfAd6WWJFxl*?=A>0`jf#9ty}zHV-QV5M&i^@D(#g&h z=Q?&XE5iQB=j}aZP?pVQfL_jqv0t|F;aiGOdde=F@9iQD9Nu0n75y}yURVYebXXGs zzOQbTSq9N{TdN^b`p}Tw+M@Jod+bq+fpe%zrNaE#sh>}`&x$z{sqN@J$37-?p#o}; zbsC5q*#3opr-?)GSv59>8}R@f1RrL-&1;?PozLzDZ)p&rbWTDp+*~n(qXs2u;DJ#3ZiE;5T6BT+>9;kHQ1y@8+x zbJfNL{A$2dt##T*4-R3aHVvBT6}=%{TADP*U8F0MU6d-UUcQs<)lFI6I80}gS2@rk z%H(EfB;xqKYRI~?$&5MmRNd#U`q=MFrbPhy5-6z_tZ8~*NvmM_lO9?0&IpcW^MSvM zKr96@ujWkuf~dlD$^pRe_g*W$sxla$v4$|3v4l@Hzx_})wH@WE;QjJD3}O_WJl~Rb zse!V}un+0&x3q_KGqZ=G0o;-HRTV+Rg z&hgHSNz9oq*RC=p5(#$(gkGF?^#MO>8Wn9{0KkrA2f-;!T2TDHtE(cWWwM z_Iq)`VjlYP>kq^oAMl3{@`tPIx3cqfX!cis2??P8eK5ONwU`=nh9)?&4HRR`V5l5T zRW;vsRI2soR`x6`EyqA8!i{_2*z%(mfQu%VmDO?eW=njPwc~+E-F)(dPQ*Q;rP)$p zoR(Epy9Fiq-?=hPSbdrPcfJelByPPc3{Qc5jXw~w%R=o%`%1w4>Qe60czGkh;Z_Cf+cMq}b@} z)q+q?uoTqAlspfAzl!4q6W9}QOO=+n8>Z*SiB80{vywd1c#dmyLL(9v(gG8fRk=_( zZe@o$GW1)qC3fP1gxlN@(41aTV#@bKYoS`kAMa|J0&*;^ZmyX{=44>6-@n&+i>>%8 z?a)$iRi+Pt!9mCClVtvxLM&WGgrr1z*+Pf8xj8@NA^TPisoM~Qg^DquM`H>!+(w?u ziw(Qt*r*)qH}1oj*eDg!R?ghztSOAjiSabsr{Y{T^o4Tv>gU2!ioNWqeMOX;-!TzC zCo~TYm)qd=tSrou`I}v=pdlhnX8|P= zd96%#!+8iEcoCZvgETJU-ZhkwyWGE?KwWK2$7qQ0!R(JAgn%NpW3@`90*S}+J}1&Z zivM-dbA z!me{ZQbKgIESua6xtDU$PjfAH&4rTBBNXsE3Z>?o z{-|%`v_lO)`?kC;4P4_~c1%%8czcgd*rrur_wBBT~J9-P*k_)tGtFbg4E>qoze=hUI7%+BWQSEdYC%!6ZyeR{zt623xJ%AilPfx-NVJYP%&<)AA*=Pp zUiAWE-h>7z9AvbF->`;8)XozGHVb-@euYA|yRiDk_w%bx7ryzuMcy_S&+s4*p zAIER{d*$ACH#QE!RNxW(Lu6g_75&p&Np5Q{ov>$cBf1UK(MdM?L7)IkpziO@^SPlQ z5~Wp*_DZYl>Xy(W;wq|x96lGX?F+TsJ{R_{#~VNSudnEnKS@P4+F`K{ndEg5on{1K zm5z$01K)pRxkqfgo%-Ya+a0u>3Ag0mxEcsV7st7*4{p6@hNzYem6udCJ&iwSrSmcA@fdIu^0DYSo?-#FB%iasn0pC^ivP zWL-`f@fQQwD@9WQ$#S%j+9PYr!)o5@?N`ZYdH{p zBQ9&2B)HA;??QECpfPiQUVQ;s*!d;D`-=?ds=T5D^ULbKlAGq8xrD@`uJgEe}pcA>!OWt75?7M}b19T|zNc^gE0@cebPmZjV<@~IM^YKC~5n4t$LptYp7u2 z4ri&+F*D7SZE@}Eo|PIDCQHJf3nSwm%5lt92US(Qm7e4vFX=!;W z+bUgodXMwwfSx9h(TG6wzDOwAjoihp<62>Wdt0KFdiT&w-g3X8TM^)er|L~*TZN)k zW7brH)_K3n9&cWq!(Ne(7WvG67IV>|uJwVEcYFN6tU&vbVVuLib9d@FALa2Llhi>; zH68Rf^)i27$MV4?j?9cZH zOOx{uwgUh=?dGVC{1SdI+Dq`z_f?zu^!cRMH$O~uj%Y|!k69SjeA?N*T5+nSU zWtX6|nYOxF*Y5q7AFxDXFsnogXzg(4aJYF1WPaPL(=257Oe>fjqTH`#;31_6PENa%m}scP@P6^Q)=1g2R5tk7>CU2p*ckhKWv*XR0Db+-o7y{Dr7`Mm~p4# zqb>i2?lC;NS7$5GaRBld>!tl|Qh$;VyNVrqG@NSAwB%tuj^F)xdIp@5q{-3dSoc&h z9EqcS#xm&xFr-NenF*km>5_Gj4dRQgHJnSMbPXR_Ebt*koik_y6&DW`16c-MlxpRx zHl?PugA8;ZPcUv6@_o`+jt%5S3vp03JO($~Sj!Pg@jre@X&#j-{ z>pIi^R#3iqnG+Z^8XM2cx~F)Wjx9aW8=PvHXt-r=wc;rxqG1QAlT>@;g}P7B;y0vZ zIE&fGk>bA8wez2O6l>uKFFpz~$`L5(#YO+Ibx}LoNMTdQ6`ll?+1gp3w31wvnv~wr z%AC#|CM^OMdhT189!yms&o3DmzHh8 zTI2pEgl-*n<4hr9`kapFLp+MT4QZIc87?)#GYHS>DJWzm z`SH)+O!e?{Ah^VBa^$7N#rz?+F*A!#6Q-@^glY;OVY>Q2^cIwbwRfn?$F0~r3;}}z z=kjZWdPr6LkU`{!d(Yg({!|Hg3wKOVjzQ@177mnreUev&*J~e4?yg%O z3rP19!TkTu@5qQ@?@a^k4rbQXV!$^(N(RRPe&}9J1KU|8l|qjNWNi=ZYWm2$+A=6b zAA!j(ZBZ42JT_^lwBp7<#!;fvQuz4>DWZNrL>#@;Dkmqc%*A%vuW+tBYEm-^CQ-^;|&He^!dsP;&>(c|%eG?NS6h1& z6fU=;af9|$FZ?T$10LbC&oYubTCtOa5YJh6bd8{81D#@M`1}21iV8Km%xQQ}O^X9= zXwqJ}l=qzCtYq3APfotx&|W`=UQY4r(FC`7r@0Xz!gq1(svk?2F6uUeG5l=vw$s%OZV2tUwU1ETgh*|23XMI>uhMaonLMH{7`Tcby26X%yg2J!%`290I)0rC$FN2PWqWFdIK-8((W9x zMdd9rOwa&lEpXonue}T|ttRXr(jpJh8OwgEg1;tL)#!BCJb>{Pu4A5UasMu2|JD$# z23Mw5KMm{8{^zqaKI`o2!G@sxiKGZS%iZ-N#{ufPwtM)SOm%lxGCNzU^Cp@ycioW+ zQ=ej!-nKq09vX;ZNzoI7PE>F>lVJb^3aAYM~ImZ}Lb#W<~OMZi-RK3R+ zKOhpJm=2-Q{Lw&@u?4C)rj{_`hSWAg*ynZ!qA3p75Y=_kjhriB`tLuaOe+~1NW|=o zP6uyk|BH|4umgFQpita`B%biHxM!?YbEi<^0M$C2Pi8XfSRGZ78V~`L$0`|XdddrL zbxw(KI)fi42rRTj%g9*GbX|iZjI4^K^!t9+O0h#Be(ER#J%}_?Mcf(`I39gaxU70m zGr$SmwmY9x2b;s=>I2je@`QJ}LnJt&s0rlhCw8S)LL z{}Wh$bik(3jm`OP8SO^~v9`y!p?_MNwPIVS9;mj)Ek-ZKMJEb~>i`^w#{%JrewAO$le^TcC=Na(hDvZzn(JP#+5`)xdV@Br- zT6cxgIF=9fq58>s(6sNEt{;SV%qDah^gDd9o!JNV4=f$#AOEMtfT~ZE1$X32$#&~r z`NOrEb|@b_ggMA2p-F+ox@sAYsZt2shJ%g$k$tcn^nnokvv;8;=OsCxf#+?hky!!$1zCgju8PdDi-KoSQVFug7>O_wU7-*P#XFX(+M zSU7T}tHjskx8|F}xzMviTJTaIh1Y|#$Ebo$Tjr=}adu@Be^dQ2aJuJV)H}iSJQS*mUCmWSSEsM1 z9+&QJ=V?|G;;dX^D9Vyw=DK6hRPswLbi+s0YRTBNI@@70dl{Doqv%{td>rcf`TiZa zQxdoA0X@ML@f%eDg&;!6kMc?lP5>wj8oKYBl`Y}?0iz|q786fjRsh=-;b&qnB$ki? zLRW#6B>Zf-+;*Sp0K?0dQk~hmyx-YDz~#~twGLH}#SyQN1e=hbK?#Vwnz9@(IfbWb z-*OEawxf<iwCKR=r0)&MYCczy6t*CD^ybe5;h-VF@kkE1x9qnRjdWpdnYOi zFvj=qWwayf9wP2IMLufT2S{2O8IKd;C)*)m*|8Kdz$cFBPkLu3OY?WL^Te)6lPoozH!D=!G?i4GmjS?B;7@E;aPe$?V5o>aN+o*tX zlnm18kBkzZ;kr)5@cB4LM5lj%3Z=ybbEB8H2O>uS+EUa}+Jv8KZ{b54J=)b4dSi8@W|Qt%9hIM-z)V-erY;-bWz=d7aM zyLAxi=G>cWw+KU{@CBjK6Prg`9osXj?QXd2kFm~c&R7x4`l&Z6kk>Ov3=JlW&ZL%>zJ8+JwY<4INkqIH76;)GN@+%yHJYkev3kkBbUCyzypTrs)VPcyT9RRr6JI$CwuHHjLnQxqu>#MtCdQps}0GOtd+u8-ohpw;p59# z+NM^YUedlxvnAxKpa+;y3Acx&UzlcN>7x_8XctUcl1)^xS-&Abl!p6wb`?1q!yPP! zLmjJ92>n1IIz^_0%|A5KLJCjHKmPF%)Au=>IYYtasVreHqs$Ail*J3-IAK@5QuZTOFHd&ndM3J{S6O-og#PHGX)qX{Q&h3HOzV zUiCYv`-X-6_t*b#+8@@4F+8G;{zX_;6msfE)t@;RF z>5McL!Rt<(Qv+MNZsC6?mJKEv|GZM!>(F3F6)ak@5^uGGnvz9~Ay+b4wib{SLPUkx z$Mh(c0LeOz>vK2s2S7-ZQeBjFk!QU2#LDts(pas`An53V2^P;k>pMQ;;ucK_n%(;~ z&j|A~99A*J>|>PmMXBEE2c*&a$(`f4SeclI4=`VkR%Lv}`a^sh$R;fiDdNPEIjA#} zrWUDT>&noj(0~qhk*>ws(_x9@kba?|9)kN6gaXo&^RSwDkwFU;f zhS?hBEsFEa6cov3X_Z@%Q~pSi`;kR~9}l6mh;g9JBDis6w&A3?$XK_G3kNp}$83Sz z;PF;=P`$ws24Q{;s__V%cYP#yGI%h#ZOm-0_>mTlJ4%{~QZl-lr#hoCT&8jez5kRLT2_Tc8~UKH)_rvp;KJU!x^ZV#e%>TI+&g_o$T$FlaadR)yegw6Iqhr6*TLPIlGAE6iKEo>|FS| z1g8He0^CVtOX>V$1Vn)kqkw?X(p%-%Y19C}H#u{-)X)%zj|QcebAj>Pkj5cv#?$>_ z@}CK8jXZsDH8H-}j?29Mb+UQIrHT}$8zTGe@RkmA)ZDcNI!-KDI3a+@-HeMpWpl%Q z3PV4zA3!3HF$!Mg%av6)DUx4fM7OvZZLvYNmoky^X}hg@5=cgBepY(2H`Z$EFJ35D zhNX7}MWcHL-RzDyBi17rQ&=E?_iBP zJC9PNQ?X7vDReQ-H`#f5nB$c-9JFdRDtNiMy*+(ibE*34KwqsecbTz2^v89v;m9#1 zk0u8*w5qeKrPsrLWBWHJ4Z%sB)^H`N9S`V;J~L%|rT#bVwEW|&T&HlfCFw;!pLLMb zxCGiEw;H4CJ#6fzM#G|uXR5G93{n}Sx7Ssc)cJKbC7@Z;R&qnby@bml>GxiGy4j`S z4H=cVSzEuQ)zQ-z+ikolbe5||0&ORV@d+}R)$M@$$Ln+Hdvrdk7p21M6 zO#kRA9n%6qpXq4-j5+-QqHk-Wd$Q|jF1Rh$?9i}=aZp3@LK}Kj|3^Fv8MY+(qOsHSjVzU2yrtH{ zN?`u}w)7YR<4f%D-_;(|Dik=sXmZVeFyGwo$^ay{N3GhkbbaVT$oGKF?ywlBX8mS- z95pJTG5i)=O)SyhSyo>0TE3fTk${nNQB%ZftE;~VA!Tu&?QX0LEv@}ryR41axHwl; zYFg3@FG+BJBUo>I*52?b6RIYAm}{2?vH%$``%Dbx`iY*NdY?*1Mr-YxjEO;xvy{-8 z+*Pr@NNC7N*6WlP^yX)g*XrlfY8|I?KR$DHTIv&I z!BoDay-TGT4SX-6i_f!AEvLnop;5w;DRlm@Rc-O6xPE_m6_3q2e*Rf;PUG1;xPn(3 zDd)kfZu(2VCbRd~>$-<8T=zR2+yC-eoDKx4k3kJ_CldnE{Hiwbpeh#UIjpZ<0?=mh% z=E(2doo57I`_J9{<6Y~Z#+U5u>wxt`p>u93{~n#u@0l2OJ+-l03XdNceN9@?f73W{ z;mAKsn=M>~)F^9ruo5|HZe{Qvo2{eBC6&6MF+kdRI5gSG`uPOd7j>w=GGq!7A5qhbORD(j!vEOhGhn42plG9-$imlSODn7fm?nx*fzSswR zY42Was_nI5tDEn)`6zZZo@oTsYet9%yeo7 zKzl9zlJ)@44>>l9ZQsuuVmzx}?%fJKP~~{8>3aCiTw}q|@GP3l2z{+j3y#NVOcz~u zlJry?(>P?2Tl&OEmmemNp0Y13y%C{Jn_Z0{Hx8GsRi92wE81(5>WANL4~!TW_g>EE zW0ewIiWf%5m~Kl+lTgjU(z{PorJxBiln6<$f2UYYnlO;Om(rEND8=Y8ldkbCLceX@D|p+7bh zJfX%lQk@Wh_{P58%5HK1BmxjwxOxurV5}FJxQxYQiS&5iT#sg8K|GwKDLVn+YL6^# zrn-&jREz8UIzuFrI1eJdWY=p9(k@n<*Fqx!B@Eaq{pUyHf7R`Tw1lTuFQeoJjp%6?3(F{$8-KH4g|Q&KexOtC|F~ zGkbd?StgEqb>}-`^p%KEh6G(_NRrxohP_Jv1TMeCmof4)&1>e}Cp1TRvZk<>RB(PS zD|U?Uw(Rh69pG;3v-j~CpX-`>PC@N~=lPUg7-R1y+l)+o(rL%C+TAt*YR%0(LxrV$QZr!qD`^n)1;; zIh2ZV#sK-Xk32{0gv9T?KZT16b+odj4R z9l&(o^Xd_9oJ^pBzpG3JzycHNf?pA-+2=;9S*h00E5Q3?L+f4q04i{Ke+BJvEqV_H zq3z_w>(l!WHX6Ld6_?!w$f7cv~7 zeQ)r8THiM&$l2;$qX*6O`z^joHHW7E90A!O5u`o;oWlIFjBr?rg**D*qT|5i-q(i(sS2;SRXY2p62Kd{VeG~Fy+-Fi8xhhTu~ zA=+~1A-D_TD&;;JG(MkY%b5E}m{CDU-HGK5B=QvpoC`|yQ3#F3MQ$PCFIt>Z^rd*;fWdt{$ zZcwJb4weFOJRu|aWQwd{NFvWRRFq?iyk{ZOW^l5x{c`hgeQT-15z8c2ceX8o6FM`X zJU7lAw)l3=*Uhxb)%shSzKX5(H+G%!&E1z9hetd9KAdcC?&x~Fu2%iNU7=bF*&a>> zh0^XGJIFR|?$U2w$mj68tkCo*u*KoVf!kZW1!tjmwr7?cz&#>&y`%_h3^tkyBCW2_ zOzeT95uc`+t~y?M|LJ`GK4qZU+s7G}yPTCD^Uz6B4|)9jy*(77s>7f#be262C!#$^ zf@sR6S&PvrQw)_SO1l7N`^&eTIN5^l*8#2cOn4h{76xy5GeQX4f*a)SpJzhGa4$JQ zM$P`m)JwPL*RwN?QcsUDkTuzw-P|r7Ux$*im2WRW-nq>rs@nZ&zCaRkXc5V- z`FfEXfr^s0nPJX!Q#Cx%W0yqjsq&*0wk&MR584#)hUhe(?41IlD>dd(Z~ybEbF;B^ zlo1i#T6#j*_UK+NB2lfc?Aw1@kyNZo#FWES&8tUJ!9T~KJ|>wih&`lJmRK6u3d60r zP3=8>D_5ir6!XXf3W_ZeA+(?3*U!F0tupzC@Zaa=6eVNsjn!I|Q zd6i9=`QCh|!*|JUwUX#TKlL*jejyzp2`j)A3Y~SrN>(wi?#%d%!$BHG`Zz*Kf|t{4 z*VEr4yw=uN?6VJrwd_ctY{DNESAh8+paEzWqKu>{r%XZvq`Vm9dFf8WP#R zgw)G<=NIs^LxYuT2Edymk2VYr((gDmamHg zfKPnE2Kb$z`VYSRy;U^3qhq^7PW{8pYe6Pi6UkW#*`Msro9osIZDB{UG{>j?2EbqyH6 z6#tG>v$i@}|3l@Ci2dj*p4q?&#HxT5Z%Fa#ouE?b^A%BcNz{LyUA=v0Ke;91p5a;5 z^Fc8H+HCpX^sL1h5WZzSTUVzkn4KQFhZgw2i|L z4EvvywwpdvWZ&N+%Y~Of+#}xkMT}E;LT$13A~4NuqUpA3e9%Hf+XpDfpN4F}XlR>w zuo2Lt+p~)r#HR*4ZBRa!ab6;X&q2?cT*r8{t;Jhy8YOKWhA%C4B9viWO71Ra=>+rz z;Q|p`OqRtc@ZrF*Ecl>*3Yq@0bLdDaQmx5{`nh@lkN}8I2==cCrjJ#IQ7^FF6O{QC zXR+S04>SBi)ut6dgN$Pa) zKWcNO8?m8%UnVg5&7_Ts;+g2W?NjyWH1%xQqx|lWmuywh%u zvXsWlkiO$kgcOPK;G@s)}Lf5&r~cC)AUs#hjLBF zyrD*A#ye#u_tru9mlt%Bb`t!INoEwjp528N8uY?9Tek=|m$izgO+=Db*a#P{=gX>X zH$IXIp?bB2g}`BH#YD&_UkZ_1S~}}x)$8FOQ?!NCw}&rh&O!6`GR)_nJ;G+oL#0eM zY2EDYyA;x02O`Mb{-hjXawaI|#Egsi)o_3Y?XhrQp;AJl*(HlVXvpTUWnP`!#>G6z ziS*g56!jM~6@E7(UV)DQ-r1j6%WARC-+`g}Ei64!0UDtofA)A0k}o1KBh5e_lR|*- z2my~)4qQ_wrv+6+_AnOX!J7TeMe|9>TD;4DtZg1u<1#L45;t3X@D)WpG%DO_dcyW@ zDauyB`eC((z6)HJ>l^<$dibb9|ElisaWV=N#q8vU&HQtwshe=#WXjXa*ZP4+5RjRK zML4?S6r~CrutaE9UT)vcPaN%@I3DRMYL+=!GQ2RN6D2w4#XwB)`WAhYz)x*%+)SK6 znr(_P5d5t|;qIVIlaX5_jTwSLZuBZ|BzlHu^b+jj`TJF1eiINOXy&5P>Y)8LU2xkW zTgz8?Qi7d*!<#vRI|=WP<{$G0M3NizVrPB2rs;@&y+dAt3d>J{?XA-0c7}8HV9of$ zM<@Wa14N;Dk?fHL8CUx{qeEzqzqBJ@~CgS{>@Q72N`fHNNx~wDJ@MXNuqU60W5>y_|Ao+^_xOAwF3t;?xDlh ze3b#^PBmGWYe6WY;D-mXu<15|$UY0I8V9;xEoCfECc7boKJ1~LZnvK3{0eG0+!gd@ zJP4Naht&SzxnC>v9agg~hkiXCYoj+Jff-C7FZ~xaZw_Vt^hVI7C-nfA#OswzvAIQ& z$@Z%K*7NAX-`xUq(2}(Mr zA=s$j^F*1uoPMvpdzDQY_>;t`Y?8a;9shr|5Gjy%mXbFpH zF-}-glYazF7)nP0L@sMF;}{Q5%OJ#Crm52k$E#Tzw`z`%y<|h$E8pps=VK~*8!*>H z{{FUdxaQ{n%Z#EBffM=cHgWo5n+1&-*J4rWfP|ELa?4w}0}&q<^4@l`+f3zRJRu?* zwX?o5NE%<6xN1K3Azn&+tqQ2@2tT%GkG@s1;b*9uR)yZB!eB)^`j=M&1^(q#YBbFb zkG1e1|0T@B64D6a*d*JMdcTUswlv_lV!|lid6ag77;OoP7zJSQ9EF94Z_$y#jGPJs-RwQ7@wJEp0jp6NxKT!W(0>V6d z?c<(j<{u>_z77JL5S`bM}^Ksys|0^ZMBs=5>RE+Kx2g4rlYj zDf`(*X#1SIW1J)#-K`7JH|zn@(qIYx@SW=bu=|n2bOS6j;R(A{_BO_h zupdX6k7tGbPQ64X!u3|G-)TNBB9>z}8cMyabuIKH+hCn258%WG1*%F8xzX>!aYshk za@?~d*HuBLc11ud@_{NX&$=4&Z$2cp9czPD5(M{JTJ*A^cxVAYFjx13IqSBEw-+?; zGz|*IB@TzC+A~NSG`?E4ww~@0^R+2-&yIQ${&m5eEPeEk-|UMq2%z)7{Dl1{5YU;R zjhEBi-}fe`D^@j*)3{}vFOgcc)i`YrUuSdq+zZ%{Wmj)juca@~^50dyf({GkalIjS z0=icXnu<}IQp{Mz@}zz9<~RyIp>wNy#k}dP!WlQ}ruQxYHF(HV zA07%@odIiANiun%*7=GTSagEXD<(*Zm(LRhlB?ne0;fwQzIyo`L&0f|2aOQQs~|F z5-1%qR29WHe88MAjAyArzY4dePE)nCVUp!lpck^#G@$(FxUh1(f&hfR?5^K;(oo3 zK4ko2LMqB|s~5VF52}A^qs2w+vu}rA}Pa#kunq5zi+VbEy19xm8h}cxhHL z-57_>N5^r4zuZcETv%v|&dddWsG^8<5xl!{k=} zpFt9c|8w%PG)X`!e8ZVgPDQ-*sIK5td zzxsOh=iH5An8&HVKf7KzoT`#_(63LG8Jv7Q3w^9-(&m@7f96MjGx<%JF#o?&G&G{# zi&dnWxJ!Tg5fJbrT)Dsf4BA;TfPk~FPv2?Kb0d1cN!Wt3)&f~OHQE2;+HFZ(r<^0{ ziRr~nY~fn|9@7&XrljP~t3#mui~@wqQGi^6Do`4D>HSSvOQ&Ia^`M*H;{6>d%#{MdEwkt8IdI9BQ}C(}u^64D{; zb{Wzjgv|ZRGt+<4Ver*`&-<!`36DRdl~DfR>H7(1Q8%dbTp?Lu1_J_*xLv&+eeKc>H!7mUwb$yL%Yq^RjvQHj!~L4#U8Jyl^lt{)kyD zEoac82sRBXg+s?QU^3228&5PjC1xr#?@CgfvN*jsU$~9!;>5=hc`zK_?@Q-5xaX^V5y}fx<#i@xZTDN4bnSlfqy~)$0_8*WaazihFBscRm|qk zbBOn~wE+EUZ22_T(-x3sNNdV5a)9Dg0UE;+*K<%ci?flA&=9`UgR}p<#YSpZ@*Dij z=@Ec5^IsQWm7E==0-sGT#1i~8?50Wvq5t6?-Wz^bLY)eFYvkkx^L6v7-y;GkB|4Ql zT(}J>L*PbAcqCi0=)^ZJR?7Qkc6xKYVn8=NB+m_b&km$?zo7U+ z771lxjhHa}@80RG6^?h&WNidIZs@pJb0x#vH|(5*i5r}yuJ#w2)Z5_A-}zlcuD>1a zH0!lx!vqYmrXSsVx|hwF9Q_9-+0)D3^d1hR$m(MDfti1Pr<{_{H9MbO%Ng+5t_XnC z*vHeG^HZkBv&Z-Gqc7+8AE=No|LS%uAzNqVs*-PR`3ezj-%p!aB`$L+kMLSD>X*Vj_OjUk4yExO_ zP?6o$xHJH zG}(b9LIS1Md13__vV*gG0K-X*#*&*tJ0WaW*KWAi|&h(%R2gYbbrWm~f=sCUS z&%%W*YQSEKbao~9N(+E;s=u=i&}i6EihzgUZqTC662m(!LS4+-SwmqQFvjBN888Xk z>MQAnkD1R{e&%jq9 zzuetG?MCceCWJ6elTt4ug)vNk4z+3GAc;GJlO%gfz^f6ao&T`t;lGS#v}MUi#&3V} zCGK-N4IMr=jO=Ru2j#Yeu==y+pp$oddY6E*zCuuwm;wNo%c6ua!wGK$Un>)ue_iMJ zBOip@vW;;KB3?b%XD$H5V&X8les$i&lzbR7fW?{6tZZ^R1q`|C7G4F40O{PA0`<`y^UrwU;ir!0Ua(X(bS2@mDgxH(} z{YZj^x)+^J1<0ZAF-($V`)V@ISDn^Qx(q=$--F9sEZoU{5E#xMjPCet__UaTMY^~X zP7WHqJ3z5ydCz=@H&w#)bhYxC-_y}J=(9US1iTlrrqkl_yA><8a+iE@G{x)OTw+xcgukEAbA&qrycC0J7jfwp)1wXUxwSie?gb};g}2(D>HSC z#qX8c7#@>tYtGFV<_Ich;bK!sRA)edl~)f)Ok-%+jnX5n<;#eim81^`fhX*FU!Ia}ZccybfsV;` zD+kF}k9qTF8jp3F8Q!rso(TsQ8Hqsy4`v$=$xT*AkVQ1#f(Kb$fzc~-CCgRp;;l#y zKkG_v=S`~)=4#OoJ@rCtGV&5Y~%)?z~nU8G?ES z`=bmZ5>JZz+{Hi$9RMQlIFL#s50dZ2>Zfv!W>U!a>?LgzDxq_#OU;870gb#%EV4_<*gh-A<+mPBRmD6*wcX^{TJ$=cqYlox12{J-R8Kp%n zg7Cq>UMZxzYBIKF&YGHAkVZ`)kVSXT%EzT_PNOpm%o}|G4BwDZ1Tf~e_g7t$P0V&G z<_d5-sQSgqYkgcFNS2G=*zA5G{LS7C<3L{RPfQ#*+Ss8+lP)zSjd5YoW@yNZAJjot zO$+KIov^}Ddpx=?ilc!X(&&zq+sh?XG)wDVNr8WyPtBdWATBQ)|N`J{c%cYh&crvyH)(Ios>r2ME-JVJ= zfwtCY9R#yI?G1|R2|Z=^243A~pNL;TKm6TClxO=y8eTlRvN7bX`E-6W%YXW2W)z%r zf5V=Sz60n;95#J@yYl><`0xVg-NZ;bJ54EB53P1?lA-c2bQ)Izd~uD?dNcW*o2X9; zt=IA}+%zsJXF&juPw4Eo{Z<4QZNbo=c1UGmc1B8j%$0~|HY1kIqxf?vc? zhFuW$NT|^#rUnozodlt0jK9SF<(XTkL)R?4Nz9I%ii9qdkBwPnFy9ceRW#f z5Bsa@_PF$y+xON!7j8i(pQ-fdEfv#r<{%FYMU#lS!OR~JJXChKxCsBu6>4xPh7aIj zEm#c!)e+|~L5aSAgwY7B=p)J6B8+LdV}H_a-W_PFU7ypc*;=2Ld^$P|5*^}245l}s1^8uD2sEsMa;Fe^y~Jwi&IYw+cMhD7Y(UEhhHf8RI) zyR}{7Y1pQJt@SZz!~vaOY)Tl1e?yAslm}UIo+ptn|Ld!Pqxdz}iUYioF^%HT2HmBB zvCPE!=JU;?>Gov07QcE)4a-9$j^>l_YdeD?zavYGu+ips*oV9XmSr30T>+l+Gb|Q2 z>WYR$&dxUFgT~A=ZpGe=SU*%VZt_ELf|=@OvRcpdMCdg%EXy~p%WZ7My7hrHAeTEl zo)Zi)irxx=Ittx&cm)2(tlg(9Q)l}t10mZk<+!nC5&B4+6gm~eb}95P6|iW5;2|ry zG?an_`8OhjFjX4Sua-zqQTT?F>7%irrX;jsjf*p_#6GzINuQOcv`BaK()*4#y?c7| zUN7#{w=4_za0gAJsE`7#L!Xs0`$GSDF;YM@3Zy#3BpPY=C8nj7V5E^#`mHq+DBc0T zGyKn+yL7ajJY_Pz5+v5s@NwA!O*YfY;=$d3YTGBI)$m5bypiaaq6(Y2E~`w3C{C|l zCxQGj(>(iEsNyX0>FlC0m)w0>uYL;BR*$#Ra%xEk>sm6_?P1nJB!1i5T~Gd_-#&0> z@+*OEjLYH9;rbLwBCcE{qhY~A51qaCQLzB0W^?~zvw9WxlJ>3!Gp0*xq7TN?0Ab+paw=?~MA<9#OW>R#U~8ondA9add1ql)ZVUgB3=PjHmW!N(0OMx+xf`EG ziVGCByLi3dYM~7LeXw_%6jPg?8X9Xd(}}-V=CvJ{W+>^ko!rd6J82*O61o;4UD}Cu zU-J6d?2d)}i%|fX3EHP}*7VY}vFTNG+p;}quyanCN()pt=TL_VQTOb|-x>(yRHNJ2 zDHi-5Fv6!?JZ3%4ceEJ}BJ5z=?>Z3|A07BU2jVY=HzGR3`KijOQEclu?Rx^dxk+7D zRm&h8K9{x~_a$!Aqb`3|V(-G>kL1AG%3*Q}(N14ykrrvO_9mH!EI+8pEHN%LxGy8- zJQc~HMzIf7R@0%keh%CCcjZignbZO6@s{pu1y4vY3(!6B-&5$By8wW z2J?Nsj^aaEs@<<%$BjAUdv)1Mt2vC=8{ST?H@m)#(uOk&^^Ww&X7Xf>>d|XI5YOdX z*Js?_gRgk$^&&I(b9yK`?^TzVf{$V8;_x~j)1{hSFPUS|UTSImg&#{1+BXaNCjDbE zco(%^c}t!bj|?tRqidvRiZ}yuZ7VJ_1$Jl;EJFd~JKWA`g3S^~qj2ew z=d%lDorC2K1A1-$+MP{#pEX(dX2S||2cv0kzB*>2RPHbC95YE!e0ckDe!r-vt6to` z+x_4S`JU{rrIhvL&l$bi&kkUjixRpFpx4c}Xn0g@gzwvky1qVl^kOgk9I9uXeL!%* zI3<8J(D?Grtu5$|IY*1TA``r_+4SSXY}W8GG&CO3j#Qm>6&x=cBR3$;yLWLcQT0%O zNOf9~FT5pniCXZ=TU;3VRnBI#G#zSN^lN zy|*=awXwY(+WxB`m|AcC8GLeHIX%dZGTxezj81UWw=*hMu6*O@+2;26QcBvS?mZR_ zo{u&MP?*@tE7TXm=!_+gSd^e7g7h#_n|TYVVh$wcn>(%fM_U`j7Sw zQl}KXq+ZkUN}*KqP5UAZ08v}MIEu9SQTia{X2ydg_=|BjSNiSjy~OMoO#LXW#togy zMa*;!Ur1tY6O5J#8cK&Lxnfest7waDN;{|0&O4pUMzp{Ch?BmzeYE!TCd49VQ53*& zd*Ns{9Z;_!cEeoa6Ly8Ps10zRCL`zZk?L}~8P(h4h((tpR2QL;1ZtmG)rBkL9KwnE zT!6aZWO8|yv9jQO<&wIHOT-$SeKPuQct(XEA+U0^+)O97r0cNK$Ko3P<*`l2q!9i) z-+@jTeTSo4-l#T+rX-#64LqHeh*>Suy~3TnoWCw-yj#4%$K^UZqwy~aH0r^c(qsUs z9Tk=fcZpw78?yPc&7V<4j7Lh*&_P3gYq{9|X;@YO`NS0tM(Gve=J$$1f6qJkwLLXOD z(u7U1DpP3g5LLHZiFXA6mn)~Yg6_%wn_1f&5ghi?u1vvr&M>kD5^O?Kwp`A>`4`g{ zz7?9IBeU~j`)Kn>Mo7$ieNXqi6IL#w^qtwwoz6G+$M<(q6Rl!0-MD>oUkqh4q*!0w z-KYKMp=QqR^7q-FA$-mze@=F#G=gw3UU0?fhj-d_5$7dAtq_#K=Xu!L_p>@t3%l6Q z7HBZMp|k4$)U{5>HHNTKKATpmyumWds>?`|F94Hy$Fs|&Syw4qBBW~HGKnzv&?2ot zZO}7^(8 z+9=(FLT%sTOx3+204H6>L+@sNxf1F_GXZ-N9U;77v zIK1g>KZRoJfHPlhjBENhij9o-{{PJ@E)h(aLlvV}kDmMD^o{Br)AlDr3a%Nw+tdaM zp}O-V9Z2eqLth>?y}iR-O>2_v(+`wCY5XuCc+muHw5l6Id5J17EuhUD5AN`23b^VC)aD#n(au;4q)E?IxN+T_<5(!RaNt#3$G|o&Y?lNnpy2Cy1h0#ab#0&7?iTuw30?a zqkpP>YC9Y@tbNr|IpEb+G){Pb_=+5yI-2eH-A%uwf?Q(5H=XY99c&DE%Fc^jOpZ=2 zs3u|>=6O6qKr&8FjXrJL*DHyJJ*rM^8wbCwd4V$STLRtZ%v&4~?#V(AEGer+Kq?(W z-u0enKE>LslJy;2YGP5*BG=N;07yu$^M-xp>qdOnvR z#&q9iweawq@5-B^Sw<>jos*da0HIBq0!RNRSP`zP>)@jL1ax+O6uGcJ{IjNk+ts zIme}sKKcmk6E>5Q$rI20Ehc$W;)p5+A*1jwhiiMg>M}3fIHKn0Mf}tqg^z7T=Y3X% zoZ1(wNf*I%tdsk!xB3%!Vo|gqge%h!(219g>3XLx>-E{gaW>@C_77wEtm=!?ICKra zY|3t^+aDB#QZx|&!zyzF^$v!C3g5BU+=stU0nQQ&QsF{Mc=^wn>=a_LvQ7FR=Q-Bs zDflWHARp4rkOASh%)h^KIfe5J#pb?VO#2 zYRX?S=hMJaAoH{|uTlO?Rubjsp0bMz>JwrRA6O;wVyR~xR3dK{G&36fF`9#U`W>1kb-cFaaNR1TsN#H_r&if)I>0~W z(-azJ(R^R}F<1Hr?_WC_n$?X6Tcy9~GbKgKm#^i*$6;>3RYtq0gLc+jkTP`OyI!%Z zlXePP^??XC&)@`1dYkIy)ubPG4;3N^X}|AI7-R}Eq^y)djfoLd{u{k1<_T%zLRCei zqUC0;h17?QVV=(t$I!5i27Gd?V4uakIvVY$pn@G$m%&a;^TVT}OS8ji-$)U}YTI+6 za^(GUV$y+~`|FR8=aB;#Q)<_!Ow2B0hwFo-BwUGc-?M6wW=MUW^B27uX%!oRd}MxT zq20eaxv->GW|=mg5fu&rcXsul7?=)2G*SqlZ4pl9>@z6WK7G`G^p(tk8Sx*pZ%->^ zE)+V)qv8#&O2LZ)IIXX=6Nx-b&hXOZx@SYmetzc}?8HY*l`J+y|LNo{bL(a<>|c5D zhZ}L}$aKRZkz7)snUxKBYtqujYFI7#YYZn@x9>l*q{dkkoV$fJnfTjHZ}V54WkHx z7BNs+X>iUVvCB?@BhuM1qaTr7)SC>8u;v<&6h(*)8P3M<`x^&G3hM_OCIPe0i^y_` zG44;Cj*#lN_rzF4OKxUJQqXlqjD}Ro6k~|HygSforQ8Ac(DaXlgU-El@@9sD&P+9D z;@cw<0=F~M?!TL_r!t0)b@VzOBWFCHsnkTTS2QyRo|T`6vP)8gpDk&J^V_-=E8dy2 zTB?MG_+P1WCE($?zX)wbD)kAV0PAmP@6P_p;p;!9Z-)zFE+`=+0vrM8Q3jx$#e_X- z3IBJYok(kqIp9VC%SQ+66`Y!*XA<@a=b1gywV^vr_@%K(Vt2 z(-U*^_upV4xi$sh4rBb1lJo1co$+Q{1Iq72g*JH6)rUL3z<5eY4oqp*mRTXpH`vBzr^OMP|(5+p|(0 zXu<{FpHq_KQKY5#`5}?Z_KVxwI|{Q-B8@zBNGEG102vR|xHC0PP7aLep?mk$U5*y~ z-q-LV&tmxuRIhuf=D0Qd9Kk@H*iLj5f1HP;EROoX;b%t2@50?FcTMoMp;B5gQB$St zYgg&!*GcqObtw(Nfs?N^^^X_uZrV#1|19b#xhqSI_rAa0=*7t>I=wM`_`)@7o14mu zKt%K9^0NLa2!EOw4|t-#>L*cSaB%h92a3^segtiA8!i(jr=P{XgL9ZSn53E(wh;RF zyYbQ%@zdnkUY(<0JhCD4$%oJHY8jQP^=CQrs@GrPiNmd@4D-f(76z#fCX#ww~h*!rW?^Ur($;x`oNZ{ zu))l}D=p9R;+w14$#HU;rEK!;>y5YT(_DwJN)Potg7OB(S(nccxSih@W~>k-#S{;> zxnDcaData0<>W}{9}~z_hmlH76t!4J*t5$b2lenG-~2S(*h}!5C}pL^qJ#Byc03-- z_1;(Y4bePc{!p9dPj;QL0Il;ppQVJi1GD_`hKx#$Vw;v=_R6H~$C(x*Ga^>prn4pZ+71R5gy*bh$52AF}g# zhm42T{Bsh&H|2q^E;N3|%petMO@Xijr>?%V4<{~2ZuWUaZWr7kKQ?%x?=BX3Zc^*b z9cQvwMg%=pTEANPbbpcT8kWh)3fd&o7sE~!tFh~cGQZ(LYq;aVn{_fUdx!f8B$=9V zGN}%QD#7;}ychX$^Y@KhftCsd(F}2G)K|G6ECUQ;L_i8H#fRlbqPYUtYa_z45%6no zK5zzu@|7=(YqfVvc_`RA4d;zvtQd1tR;Kqjh!^s() zO;K-jP;3?Gh}X;^=FesqQR&IwDhvQmqZT9$6#hb)vAVv? zqxS0w%vr6%isI-hxkf@E9H$q97A+czz@?iTbddg*(2U)(Kw-k8sk-mt?< zwWGw!16LI+C%y3TgRl-ORIkgX+u#LTm2YUL#~H%|-&@~2tW#PNlON9mKRm%qm^=(~ zUoyHRI7abE1OE9wwu!ZOrjO4p{9sYUt39aqNKq_lL#dqM9@h-JSR*uZn_%JK^!;re z%#~&re78_ZMe4=o?sRu;^EX42xT%f&>$IhU^^qSqH!Z}>r8#NYGe?I@7gySDv9uHG z5Otyim~F^ej|=7N=4&ZtZugId2XV`cy%Z7xqW_<_W$x&V+D0NkGQIlZ{gTN1b8=Wq z7#+kn65i%O3En_Y67?pwo_!h(S~u5iWgLh`9FMWageN~pd6fw+?V6( zzi(Ie^{?H`-`(A`FF=rt&?LLsu0f*l_T$PRi!xlxy%m2yPZxz&VafdCP*TC>($us0 z#i{ZNWN)XFcX9cml5|u26?(!|OTO$aAn&L$v$noF96~-UG3=UIMGivuu^<8Q_nsKy zLrg3Bf$F_9%V^C!eG1*z z)XIVy4YVjtHZ?yjK+;iS1C}W7X&#hFh-v!zL2k^0HUe>pj9RQglbtxO5GZp(9FTG55eNL@yFJRlz1xyvt`erUURe;2L9AlXm0 z!M1-rfiOje9F$PQ#pugEoq-mMKl)M0@czRLs<_ljfGKm=Nj`3-KT7mq(wv(LqSR$9 zs{eLtlkIv`q*C5A2~3Z}eN_k#TbnPcg>EnsSSwGn!Uo9XA1NT}>M7hoxRv-{G*p@v zstWBU{yclAxzu`e306#6Rq1&!3PW8pS*NvRiAr5Bu*1t0)ZT%nb#{7Q1~KnL{T){P zaOFM9B>Uw%nnc4sdDurYNL!b#N9+`!N2jG{8G85gycIJj&MxDrSU-$H+qQbVp@Oh| zp&}c*HjMl1u;)){uiS#E&vivM@fS!-#y7q?B>QC1+_rW3PW^P_0D!S1L0!vE`yI*V zGR;2wW2D=#Nk`zHy`bCzBkJ!P+;QO|Vhiv;rd{ z*~HkcX5P@Edr`dEmt5Tr3+iFO&kg_B`JPOfeoz& z-58L?6_Y-5j^hhB00kKB_>1p|WY#ZB6^7zh`8^IqLt+Hr1e~;>nq_!)G?^iuEP&#W zY{hG>?Cqal1BSatu(Y;`qNdRq5Tj6PTUNQsqgbF;Gc%I^|9sqe$g#>0fzc*TTXOI- zy;pKFH?z|_FM#2*g;a+Y+Qfl!AT);?|CdXC$OGy{PQ_By+W#PYdqD72Q-knnj!Ncz zKc`Bi$tvwJPuQwq9oqee5}1*uEk^>6E=4#a*ww>ck#Xo2x^a-LA7&YGZj)hyZmyN5 z!&H;tjhT2o1K+cC_vh@a!W`%xPE)4uC}T(bYBq6b6trhIlrGdF6+;RVzM9-y^z641 zQPQ@4aeDP_rViI#3(^X~ZwcE!Y&mx-_*$PuK}!X*1)d2>6BGbClM3gM9c!$&VHRe9 z)k}@>)*1LCr>YLpW8t#E!Tw(E3X=AE^lIAAJ=uXgA>$UTNMzI{3Z|-V&^__%@|M=> zRY*<}qTCDc*Lz5?$*0|&vxtdyJ&C}$H?}=G+Vdgx6vq4jNqDcp?J`kW3#oZDalzJ1 z9I-&CBUb=J$m5|H?HOGRhovH-nQZ_zn>o#2%hg{Wz+5=cK?KO7rT+&6`wx*zN?=xERGiOF@&}3df&t6B5}3F!vW9m2 zo_Y>eus&(JRC4M_e7AuKu6do^ybreTf4hYMgXbJAU+epmpe+(DE`ef z$Sc*TbJ;@`1h9PwUae}=%IzFqeOm#E>qU!@?YXP*ro~69gbK>hwVT_6MOv-4a zc*qw2^6Khc-GRsYt}}|xKG>5|^?`I%1?9o{<#w9*M)i<hQzx3w}P{n3L6cTB`sHSP663)d2D42io2VKyZ0+kzhC)snq9^Z!%?$J>5b0T13>8`e2bAg0Ott{krnPcGPHcOmzpWp1hc>d6j>Y8lMn&WU3C#V< zm;8o@wBs`}rX2KgH!aTI#I-L1~hY|QZ6K40-y>KK=2 z?>Xc+EURPLxHD<|mH&$)a(0C`YnayoY7g@hH0JNJkQ^O0f&W!+{2d%Mw6TaY#T*+? zl(ghu!%scZQ{S|;1F!LDgv?>Kv@r&W1r`^WJRdlkZ4T1!&lWp4r!XVTZ=sdY6i z9N}WGnnuK2|HqNL9NWr&#RG_rPvTMZAEco^y{Z`Wkg!T3Ko8I2!Pq~-KgCr;G3jud5u-&)Te7^1NWUn!e|A&K#J42L?-$dP6!R>@-$5=`Mlp%k}d942Ybwp$ZWL|8)$91 zkERbT&Z#Ux-6YIIehSs?v;pmz?iJooVUJ1It5nGlPg+V14M25P4oUV?Mhc}WL2dsb z6Y?*cugX0BDD)_DF<0F0ab615J0V%n*F;CP6!Or~eUruaO>y!AoRPo5IF+kzZ)7%n zr17SMcV?CT<>@vfL%DWCnX59+p(*Q!2$4-=altsW)>a;EzZc!mvT3fk?}HJjA@ zBb^yL4njV=bjEv$KH(_G`g(JJn3J$l!}Jj72j}7rpwH~2(&B)6J{L2E=(m&~RtTW` z6w_e~%_DO;21h|3UY2+)4Qf(o!b&IZh?=L@+}n+p>io2=8d^;}4TN*43}TVA@w2*= zv{T?O-!W}IhM?f&<;D?~M_|PYeq(kG@o|%HXV){L;44d{^17{gIoOn8*jPDN536{X zeBB;3X)o~LXu7`l@|7~1uRqiq`s?P~osFaIje|{{afj2_n+MzE5;qV1erIECGyie) z>cEGBAslIhFr^{Lf!hIN3F}jwycpgGdRN1aFRprae<&3rz13O7Ff8#a^yH-N(RVq? z{at=fGmSg_fbscZC4lkpi_BmEIfCrMdLNv$`nR5Wo3d9BM9ras9nwN-BC}S7Q`a4zuWagkY-gPA_i13@%d=oJy5J?_#6(HR(k2R;=WO&5`(lU7c(g_m`s~ zXMs~gVbS?5|)QQew@R0wcM;cz(L)y9-`KE zuu(;iDKts!PmR?%4T5qF(wLM7M%});zBUrZ{_&I&XoVHlsG4oF#Yv$Qf^mw;>8->! z`~Rz__Ytg%v*g-w_tAzhoNRe!hOMn@@gNvg+Ubcp-_7tKKWZGl0V@xi_Zx<}GL{s3Rh<0| z$>Q1M^9_YdX7~E;onvUn+`Nm{;mTyXbFdM=g10JJJ`GO*&F|5ELGus}=e}fdh)Rst z&}W&rqDmCgoB2xH;l4}WEnoYa^YGSrt}yOzCcizIY*EQ(_m1zsoviy;KbRdmzh?FN z3SOGgDFsa_i62Cf3rPBAy7G3z^o2EToePum=yn-iW%9|diX1~+sFtMT#0k5)Tl%9R zL~gw{I3rJ`IuQ$O5CuNrljAZ|Pqq7n6dn?A&SpI#P;;`uWjdLUE*}b&>c%XkDW>~x zKv~Es0=sme1@x|-zPtd3UE9gm%`6ef{d znoC4U747W4cFnkI!7pn{UfSzl2F*GXC?5&F^gnzg9K5e7E&t#c773!WHjE;Txk)Uc zVQpUTA~VOXKlG}IpAgxAAmfBgQwQqO00D#ZyXPrxGc$>D=gz60MZ}m7=wP4#68(R7 zquU}yHo=|ViDdQNJdxgt4oz1q%3-(GOB#%ti|whYna;3x9-;pouolX-j#S|G8^)Fv zW%+@I8&lhoj14Hb#vlOsA*YatJyHK3dZ1INI6D`Q3>6B8_m|15xLjdK>8cK4+#hE$_Tf-7VYc`moj{il&PcCGWO^ zjDbg%W{LCrPPpjrP@~xMPMb-av+4^JR;qSMDW;@`&#da+lAt75&otI-xSB}qb+qgo z)Lvuno`K!4GW_u@N`1o%OnFX5ajLn8V~~!v8QL+Dw&P)@^Bs#07ozSWLsPut(w1Vy z`pH>6t1^5d6x;Ocy%GbP4BB;uG)=-B^w$HfBS;UM?Rf@j9TBp){}=e9w7QvL~?4WdUkmF_p3$*6$wnRl4H(Y{28z}pI+inv= zc82V^)?G`WeL4yx=?H0423K|9#dKOU>3@W;^>^8%^K&aLO{BgT-s3b7Y5m|$hy(2p zk{Q0;IDEVJ<|{7-8u?iWLqUI$uGgsg<%6;u3{T*XRz12;Bf}@On+V6IJiKI8hlP%` z_vG-sGG#t87O27s*9QyVm@kK|Av8iLuq(<~x}2y^9T7%25@-GAF{AdNTimi2WViI; z+&T&WJbK=P9>duO6t6J&9=+tGS9~jvzmJ|%3l)ZM9Y<_AI}gbB2_UWf9-e`^Rq8({gjp&g&ml zU@yz-gAC8^PH%3brsS=4<0X3w8-D)<{0f`h4#lb9T<@4&?EmI0qE?*j_W+z)3)XH7 zNlN88XnZDFJXs3-Os_+wKWY`oI*S=PV2I7FN6jAtiJ(2R3+U=m+7bG5!HJ$Dqpfdc z)=C-bUHW7%|6rkIP%=K`o}2qDsUu!Dk+Rz1{_lKW3j<^1I!~#4sfD{9QJ~Rnh$Ysq zE{WmH+rE9Y54%}i+?$3TG?tm}$cF}iar;r4)OL0G4t?fG4q;<8g{~5{$v(+#nh^_>BU|Jq-dpFFO9}z(MQo*MQQM}kY2!FK( zJ1W~pHgJ`^u1)oA{w(>~{_IcOo~BFzIFl85O1paUP4jL4nQwG0zf&Ne{*@l&z02(s z+&V4WEe7I@D1)&}_u&v|s`}EI_f*{LRixWuqSp=2=Z3$F+3bb>iyo)J7+v5N#R8an zw9;^&-qj!_h=grwMZ**3vI6U!mtmO?VSYMC_V$5ZeA~)o_0=|N93ZnV3U4poIJ`Zd zz$^|K`DZ`<;L*&r=b^XGPQQp6Mzl(;Z*T^Wis^eKp}7I!l6W*^$g7k4&yu?|8nitp zf6y%npL?~_@QF3OZ&A%#`$$4NBY5g_;jeCA85&wAxB1gwytm2Ay;qah`+EW$7?|6Q zT@(vK$%|RCsVyiEEc6=iG2BY3WPT);;03?3O=2a; z!P<69?3*!DV)FJcvGGxqbBNGiWFB2C#&0FVOqHUwhBlT-YvAwoFXJa9pE-d4Vi8|t zibFep|H}F*WvYbk{C5RDk{S-7T~#0}U`3FdJ2+o@cgbPUfcv{xE>yOhlKFL{f;Sd` z&H_(c@)fX5DQ!M_6A|Hjx*PGjhiF7?N|6M+9{lnQQ)q*_^Qmskw$lJHowiGTARH@d z=#>*VfSIXTFoa>d=PJ2pA9ehFsFCD~dG&#hcyHcSifs0J4i18-EXgz|oR~qpuNZK9 z2@Brqu<82>EYj?B3CC!TBLwPeB3zA&)3yyPz18@;p?n0x+DtzrrnvWHnoC>PhalEF z`TD1_jTAcVew4IyWG=0s_ax4krRO92>IR!_H>#w9F=6K0(*lmN!FS z@YJY}LAHgbISic1aIjoR{hu5-6;XDI&V3WJnvyz=#me`snEzEb@#$J7FF{&_w2h6vyh{PHqCrVyg75h zHwFzno_q?|N>kvn+*4yx+Jq=}e<@*Y6MNs=%0<49g_y!cHP$}4zIYs@TQuo)_V1&J zC_m8o&LUSN;#1u9lo10#qeh(_yZi{p)nUvWF|POH6BXBLW^rkgvcz+{`!BqDj&$75 zlwp$C4V-(gDHJBp+ieC%>}=6a*l#-y!W2W?omD)DwA1xS3>7>%1z>uL&V~V!O!^_W2fsrlRd`} z=j)zNl=(i7>bfD-VifTuyQgs!Wh44W#Vef8oN1a}Ue81{$uUnB7;^shSuC1ecBZXi zh)p@L5|e8A#PD{)*W38)&{~I6hj&m=?={w;HY`so_q*PLj2zcaUT!YfMYCCTut~;W zyTb;jswsard8e-_Ca#390);#B2U~)Nv-c}L+XHyvF(0+uS&s z9&H4YpRVtiL58=kKuUq-g?R+ZrrUc5RZeezpd06PKHgAdUs!__lycPCK-p!Wo%g88?xPMeXXjHGX%> zSa+RGBk%Cc#NJ)=1@oOwrBe(I1Od@rC<1=r@CZ?%Ym| zK3o+)_(-|X_c}I#uL8!gIiKW2pC=ppInKp^Oa2*^?=ya~*AK%}xPm$)Fn^Lv#kYj9 ze)^|bPq!B6SZja{hBLA_CM*?PYJ+-sP_({VMrpoK%ms%hGQIzY-RRXNS@d1o@HFmf zKh;Zsncq|2`~?9Fu(b%!@Bp*x2$0Zxzp zV{Lfj7_We$!@V~vi};&t4Q{K_=XemuXIKtcD#F<|DjJ?zZ&)v=-HRnLKhqNTxC|J> z$4=f|FNuVNZJTN`n(90z5S)5>A~cJ2kZ|TMw!)u_5=001vi`*(9{bz&##xn%Hn(qf z_I}++^+#>8F|iYxtP3IFG;Qz-J`350l-H;myL*0uN(Ik^JU;e z(j?81pUDku?5k@m*Se`FQgk;`Cbuac1tlz#dvuzywkiq&jn=eOwCMipmG5(7X{xUq z%ka$$mGWWPa{=_Br11KRFDbKx^b#_^h)~DG!N$uc2d};zoyv28dl~;>>x}`=b1ut& zcnU*Lr(gW}m2%Y=_Pic2=yL8ZTXP5oLrqB)vQEIGtsH@?aGDZ%_n3h3=9sgXLHq@k z?R2)!eA}zkgwdpiWg#|Rye#1PU0nJG7*+oYXI=;g#o7m*N$MQ80tgN$qo}+A{5`vW9M>u~hBVe;wWxm8xv(Nf=THWI;d;CeADBh$%)^ zlaclTaf)~NO7t|?*NB~LygDe@yf3!NnhY4fKAwuj(206f_*uFSYsb##E3ft2%swnk zdB*8ZGs+AHb?D~)#S2`=v9LXQ`AD4ta4~r`B_OcV&3F`jGIjcn1sFE$R!c-`w8zJw zJETdDKYm1L^E{cX0gGxi++zO>x2I_Y!S)4ly4l0X`d|3 zYFS#@zM^ab+qL?VzwY0FPw-QcaBQG>z};DnbBR5{J^)jH9zU2693==i=x?(>d*}Ca z_V_g|fnKceT)s%$z-UO>dKLAF)P8uCQvE^(#klu_ZR@LqJ#7!k3Zb>a))r-tD;TwD zbx5`2&!ulQ#HpFAb71h@;sQ#YCAqdZ?Od{tm)$?BYGb`6>^-5-Ux7e*vW6k55vgTw zhv)EBTU~~mhzqhfL%QAObV`>%cPa%Z1*VSoQDY4n0>0GGl()BdA7iiy%>u~lc7p=KyqN1R(hE1 zrSq#Vh4uqcca|-uSOZPGl0Q&GIO3f3z^9HZ8wEH6+J+kPGmdNWcKyZV?VlL0f`)Z+ zCJDBPiZGha5OMW&9+aQoGP?Qc7gRAH5ad#MieXFE>I>L)h2g=mD#NZS#Y5dx`ql%c~1r!g%y+i)vT*nOl;66_R%nhqSLk3AWU=GHy1strd zZQ3jWNIjOSQXz`UBdFtYswr*@{J67uFr*6gkik5&>b`ccl%$G0E^s|s8I!A%YjeX- zBbajm8C50Ka=#VFBqy>5_s%2a^m@2S@xQdd@w+i3JItVNqmt?!enfyL{bWgEFjuz5 zKO%MG=pStzY#yNjDw86JfLj3sX$Nknz&DGY2EwW_p~3r>4O70YJyRkj2w@z>aCwe0 zXiK4HOZHR?fRq3Dd(^wC=tA|C*$)yvy?8%cNo3^f6X7Wq;49WPBV2)7d<*g&3q3F| zG4t7ZT6nIPBIcC+A7wvZ0Zs>R4*9a(LQw9d{Lr^I3 zXIj)N(x*-8%nI{*jo-QnSSl`K)K7;Wi-_5hZ9SCch|I0XywMf?`>O}Syy7U?9|Lu9 zhb9XoiCz8_G}9~m-q~LBWdgIF!eM+HcpO2?_p_zyTXjto3rn43JacU|UGj8BN5fZA zyYbRhn*S8!02iYX7x9f|Rzp3%qfCGe_vdLPVx%^qEdMN0=nTi)AB7=-KKJXD&RSZo zh*6{Ddb)??aoN$W52z=SS+;tUSl^S?y^ZNhQCmc*-OBc1#D}G+g4v?3!%=B;BM{`TXRjQY|e9vJX8!m)%u7`ioF& zqi&rn@L}?1CX0}EwZb!v6Hb&21)Ccb5DHg`zi3I2ej`IvaURb>s8<}})**pSd{s|< zp1zVqB%c(~rn^sGZ=}maP}8JWw9R4liZF-qivo@GkT-q*u@G9T9yy|H+U(O7zcp`M zzl=1}yfyyR&~|ENYU3FQTxz@wYH6Z)7i!ucd0%=iBATmZQDEyVrwrEI+FzJtYdM@-FMRRM9biu_Cu(oU-;-okAH&1x39mxwLEq({yvC>F34Us}!rnu=8Bb;y zuv=tEWEX?buy8rQW4(c1?PeLsod$E<240^-ESL`EG**|E)s@zRlTW9&pNt_Kb=H5B zod1n1cDk}}y3mP(-oH35!zyH$hRhrk*2?{3${@x4z6FOVJ6@&ry@eEt6{V304A?$< z2vEO_xGf#NjF&TN=f5Z0n}@qJgCFg-Aiq^0)iH5>F%x~I-q&`FMDf|=Er1!A>LJgn zq_F)-LD8;?OQ!D!Y+HW~UE?+Nv$|1oVc{4BcwkB~LJmN#k(5nC@;jAeay}>bix}^@ z%?|qw3=8c2`sRejlO5`4O9!_7g z^T#%}7x9;Dr8X=#EzC$~OGnT~_^iQ|#)q__&IO16@4EySBlz80I#t9sS9iwE&edP~ zesOqgtql_-fYC!U`!GO<^{05>>2j@MX6idRitN631zL_75i_}xeJ^2;=C z)JA2fWfI>9xEZn6!joZm83Bw2bw2-7EP46puF4ZTfeo0{K1Na*SU(-e0JT$}3$$WA z-E+o&MGRj6JrFuY-CXvbrqn;4h!O?blhRIYe`*)(+--sP?2gb{GOT7UcgYBw*OR>jta2nu0vDf9p%!s;NSxW)(Mw$E++{V~6 z069h;p&{h;uh5^UWNq5XwXENql460||EF}k8^BQS@b2o@yk1>H0Lauw=vk^NMF2BT|~A$&K-4ReLVc%)$Ejl41H3?9ZNg*dmbwZs>m|CFhcpXfdsz^tH>+G;MI;j|ELf1>WdHQ zopDaM2x6r7ImH>3Q!TRtFQn2%+mS2u=hyX#bdzgi!jKCR0i&?VZf54qepR-2xxh4u7?psN{Gs-nBqLXDyvGe8K zH3-uGpI^PB*I68MS*BP%qQ~7cJ$7zpL@;VAz}E8tD8U&Cz%N7^*X~i@#=q7$l@#)p zH^YWDjZ0dV|H_*IT(N6$r5F0&tLiya0adGk0in@evQMD9VKMa;4>m5QJ1UPrQkaSRIu5CCE-eI3tB^U+Au)uYf_N=|vJ zdGC)F8Iltb@4uy*tjLhKI_`2nZnixPM|CLgipi`)hANs8Mj1d;j4A;u6Koo zG%rqwu^8NO)AA`{3%`BNfG+PgJ3y*m*}#Uk*;h%qFPK-jwfwVqDtCd!q%Cw=4Q~iX z6=sr$!ly6pJ$SmWug|VeSE3*nJJM~EFG)pB4O|y|RgNFMTo*vr|2v_f!kg%7r61ys z6HlVKvsLwYQimPPTFROdUrat+zndJ)C*MFE%bbeW1pTL~tKP#HKDNWjGdpHU_1ur=n zPN6W9Vnlesp=qY6a?hJEr$^A^nOr z!zA`2CWyC5CQ#_2a$l=}= zhuOQL2zKGt1z*05$kd}KqeyWc;TmE3bnRe`UYRNS)rkyGpCk4M$aH^jS6qc0?l2rI6%rf7{@_ z%9dJnZ&;I1_Ll9%B6DBx=UoZEl--)5Ek$+z>l%B%6_oH)!}kPKCDZmGDw(5Iem;Gq z5o~`)G9uKXac0Foo>zNb7I@a7%~q_`9RS%B2i+D~xl;bg5M8DQJH;wOfbB_gs2>%6 zwGC^2kM&I&!yFbJ+5ki_j~IrAhIlOhB9OrJOzJ!y_P{OyBYbU(XZK#!Gl%gzJyF=U zlf9PfyRY9`2r=4eQ=s}aS!LxWTp}D*kWvwQ3;T>?WX@UuB!f<(cX0La=M^=smLSKe zH)h=PP|8@y@DGRS#N-~`n?MLArCW@}oV~jeBc4xQ4IElUsA3}`LB7?5F#Aw@J=dkf z3q@%2I+tC2XuHwzF!k$bLymfX@u!uGsE_Vln0<2-`d2|x)%WN?6a>NvSL}J-R-GW4 zJa=o!LQo&q^tE9_Jbl!r*%^!-05L6|t7|Oe*LrlSSrDJ;yLraTw^-<#{RX;M#c}$=ENX}Qv)Ggw zKeU4#-P#GL*09tMHsvD!*YEM8zTF$n>F6I!f8?vUck_h|6Sz~fwG=r59DLZSHD z#LMkrY>C+KiWha6u+Xi({TzgG-@I=IzOw{XS@^oJ;1~D;BOD9072LPz{i}k>H@EKj z&%28jht$L$DtrlHLbjAKr(Ecs_!K0L4HsOomW!`e=zx|Uoht3mSw)o|AI2y270uE= zYLINIIxoPwe@$K=<&!E)OOX5!uGE7iDjwc$Mqp`b+&EYgCeX*gJiUFpx!Bh^OE8Pe zGsUa<{jCkAbaA5jH$2bV)AtTNC}-XTp!#V>Eysgjh(8C$OldBb%R5OeI!TuxgB^>} zrzDb;{%-!hKvn`iIp(7a$*`UfC|*lXm(mj(f=k=eHI)Bbd|cu^Ia*&^>149WU`l_o zb=O#v&%i3zoos>xUECOS7xx-)t0!yIzCdQN@eVKVZr$qu`JkyVA3hm>cYA-JboeBi z8SqdLsIS8G5a&CyR6iDRR|cadW>U=E3oSzmHG2Sx3?;Bd56ntR5sNOE|D5d7i}B8O zufC)OsU6GbJObmPD11M|U8&9oarX!W4hFl>+u1BNx*u`0aBMXj zD-Hlq2xx|U(`6CeP_$vi-^oN2>{!vxWVsyT zK0#?%%JI3yS7PdOC0a?~f!XKExDVG4hhkMWsYkPcL7Y9pK#Ns@?6ff1tmB&?P3@I(MK^S^sI(m`Im zB&oOp)phMEQ-nK_0}YD1SNZ3dGU2jB4>%X0*7kILo!;U>V79@8km4DP`hsWBfBEdW zY-6vqL|Y$e=K@7iAbnAS*nzhSVj@_Vhj{iJ5p7>>;(WeBw5V-XB>N!h7bR45{I@`@ z%)8HE_iT6`mPQIB-haen4h;rq9*S~ZC;X2kqQO!}=n^4eN87*EI|+v(ucaI9%w_u?a~;Z zsgw^Q4P^}%QG3p~+W(`!6ep$M_RDN&2^_Wt1j=%?mc>Q|cx2cn8LzI7G0|LqA2|#( z+FJ4B@Vb?q>fL@18E-ktagS7cq|h52q$wF|^>X&ELitF2m=g=&T{2g{vN5*!)k@8A z4JMlvI{hmbH*AJgDz@c<4?T_Lkissr_5UI9SI<%aWW%z2ob^QuomkJszJ2yp{9e7bM?BVNdBLOm;ItDE?2ZNWG6b{4Dnh~d;GGJI*URqeqa(znWTFV< z%oQZq|I20@OhnBh+&KDvjoE7LDC{s`O_}-Ta;57V_;9^xfF5Ot&Qq%~c4@P%kR`u2 zi^iX>&Tj8dzj(dv62izt0sBw(pS*fvNK1t@McLbVvU79waC-hNqxB}q4}2*}d-g}>jF!$U zLj^x43qXM!clA^D*Wq*OVFn4$DE#I!feIMLFv$=SQ* z>9!nfDY)9AkG9lA%VoQaBcp^Vm#X?N;Q~)GLcYgp)n{r~;OI)-%Ccx`@CTT_f z8c0xVa2y`fF8@EUE+b3yBYT_|4TV=jZ=lt1uHj1_?kHPbUXk(&#?*WDbqYaJ;PeG= z9c~VrCFcZ^{$hLIO&Dz0WL2g@yU!xQh)?!jotV=ERM#_R&E?(=Gq?tLMGv6xFJ7gU z=Xynilv8F;hTPP6zHqm4IAPh?Kk`_0gLZFjtAuvjU(UWrVHZbCx53X` z|45h^j9;44VRvsUajL)qz2+wdu?N{@6%6F69t?h9K{E*#gkqQZ~CpWHkvcL5r zV-i10$A^PV!VRn*xJ7Q?`X*omPf-c4k65kYV>+z4cm-Ry>iDxC0Z$v-)8GGCFkuGT zU-J0@NgZL@Ck>}%dhE}w>D%cON|PF_o76iP%dL0`kyGVL7T5WSwFlrA9eRl!5Zj!aeww@GFD5DW(l+o*~k_! z4tQ)g#d>>#O*kD^X?)d@hSD&dy2MapY23s@^K7Rv@qQZdR!L>mkQYxQU`WI7aL#wK zAZ;<=*x6xq^ZoOwYr;;Bl*EkzdQ>nj>oy>`G8vYyED#g)5uN|m@dPz!jNp`tQ^eMb z?_;OkeC;)tB{2zEs}S9m%o>9t6ciTAp8*Q1o_5^C8WNZsulxO3V-EMG@t5lG0484= za)G@PjjaD*b6Cudt+lqOiYHo$-71V%s^+lYny*<{hA;%W>sVCj11W`RWJevH&1Wkq z@VGA8DjWZGTEWF-+$VoJTY;R8*MljFhBc_z{Q*@Lzzk$%h(z<;rE7Z^aaA_2h2?71 zvZh6(y$T@!FV}l~?wr0rC1G4f{(X2b0i~wk5q(0!&4C%7<6ymo1NFz|-%X}+Z3g1o zCin7hh?_{{R-g((dWD7>n`YW)vUYzRYDfFVgi?|s1R-z2zG^=WUuGXP(h1ke?GJ1N zCK5Ac&}Bx1Ug$Enzhk`}huWjNEN$PXIJnZ*76JVO(KLvUFz<5M_3f*8`oxh78~04g zBs8_e*YZTj;&F@M(qcQknH_(eW7rHq&%)vj&m?Ov`;;Zk#@Z<{1sJ0wzx#_Eu$$u1 ze;~LKC^pRcW~DSDg?)CDB2v20le2u=5sio@!rGkMRR3#=M)jGjpPhbwjmt~jVyIC) z^Zy7V&?5NVzF%<0n)7XgH~<@NF~~!NQ1$v-oRfCBLigK=!>e#S$o_O1BASs!IqK+&|)L-Pv9u> zZ0rpPB&OjY$yN;?d7-oza{IY^=?GEeMik)UYmYoPMJ`FsN;(^l%Y3wt3Y>Rs{+Kvh z2YM+PRtPu*vgsvibpQ!i1~|kxBw0smiEyGO_LlI66`WgWb34_)C73f)zCNj!ozJk5 z5j5^0oLgr%_ZN54ki*|xJLqf*FRNE$jeY*e4AMXNZnFOAj4LI#OWJgJ5fXK+Ge&bA zu4E^($-|1_Y&AxOSI>|j6;=!Zq849=RKMuy3S3+Ov_ie2N6aHVloV`NWu#5pM7X2` zv~{?#T}@VB-yR$2mD~`bkQ{_n5iu@&zV!TeJ|ma`$qh*YBO&Cq(+2qmk^HWX%fEyu z(%Qe`2uF2+qxA}1YdXok?x1t_VR%FvHhAQTu=RsUE*RoFv$M-*1|a5q&;$ytF)ZuGROpk z<;^T+em4nNU`d|XPOVtsI&K&2E{s=qGI2Y$^q=fb7v3KN?=A-Q&z0xGuuwOc^#Z1q{*o(zZ zFeM_9$QfE;=7k5wR>OUFZ~t7nH{s;b6)BtH{)5Fzug@V5XN3=z8pZl+WyStZq{C11 z?+-E=a*Tw7^xonC(9I@Aq>bH9|HBdllGT| zO1!@!0+Eb(afj)(hqT@1=;!ARPKAA_LfsW|^u&dp;Cv0I*r?IT)LqwZ&`5#u*<6c# zejqS$J+uDQ0oJEG)7_&*Y$Y&yHU=WRdds)^`o`A5 zw4H$9OkIlu4ANrBm4n3tDfv!bh)G;v`G>>68FswFek{!4*Qspr7OSgoxTA!!OKI<- zvaea?>rONziB!}a*`R)(qT7`Xx&s8$)NLIEcIlq5wsR$fk@aDlDlcxnX>{i0vq-1S z7V~Y)8=qY#0xTQ&CWQEzwp9IUN+qpDs@Qqe#-6SA%j9j{d`S~HcZ+c`gVWp{;CLT(EakG^taXxP0BP20izxRR=Ga}<$e$Bi9+2*5wz+@nd`W%0V!>$ z!v$#yI8GaX(ba2vMHm%9DR+hfaa-kpu@VJ>`$akLb^ZEAV0bl}&p&1tx8;kCM*4p8 zFX!b^F2B9EwzaoXrNnP~5Lz%?FS0pCLFoRoIh{zlr!+O?UmAc42uYGt+}H#^3Mi@F z^%7nQ_WIF(ddeg=KDjev=Y8T$>S^gqd$J_TFWzKhhGaMBcbQ;IUruZN^L-q;;NtEb zAMtSj=dOTrV-O`#!{J?+9*Q4Iu<7q_FA^G-kT?)iw+|8@t=$jz3V=T@!MK?j$GeY`x`6)D*VSY71hE1 z2#irLfGdgVeiOnr6AmVn;J%Q--(uEW507GGAh)r%zehR0I+@xQ7L39asz{J%JhFiu zbsOSrZcw(L`t1Ddx{Qc`__KgIvq0aURrp?eD=T1dmiLCa>a=BbBogqjaXq;lIA>)R z@$SR5kf7rDd0dGzn@s!W?7E7aE#{2!;qkqfFx=BqJ;hbBy*WLNPJR7xDABvK`KO}D zAD*3Siu=f;5>n;VLbr&Vv%B|otGn~>zob_cdzl`{5W04qmJuQqCn zd3up+Ln;<~qOD(4M(j{3C-PbnKm&N%w`m9ulD{W9=ATrgp@{ITOzuiciiW3Pd?HwI zIJ?H{y0}Yyps47Jx>y)}*m=oH;472WdkvRloMI0ndWI~r{o5cm;U%sicsD(yJ5f$= zW16Z}#Dv6Q2>KmR1ym8L<4#k^p;+91=tJ>tL(O~G+g>6t*LtCv0USE?(_d1F1nkKJ z1q`RLYE9SWK=h~q6g&Gt)L|o?#%W5dO|29sUM>E>eF+sobW80XhsPiB-yc$cc-%r| z=LTBa-x(Iso~@#GGDVHoAVpxn`e8_Zl9;E-4G|Rzqk2v_*Q6= zbN`au_z*h(Z5)05UGP;SGC0JY^$`>>Kap zYuluB#E1I$@VoH{Fv`dPFE&><3@hB-`Z|rU>xa|2b}vgGk7{T;ke_H|%Y_-yKKHkb&Q?K{mAIE%UTO8Sylv&}t zl1l_H>-g`966ucCb>9YYYHkElr*Kw6*SK&j=_B6CzzOQBnJdyvCzko&hm*>8M&di{ zP&PAmB3lHIsMzcnXHpfb_qz0jKsmDF%~N~@?TV%Y;PUPceyQ#K`oFUs#_%pUWOvP? z$)NydrK)}yBewMFYl(hNzAgnPZpE}~?e^11Z>kXv&o}nT^_0F?An&doUpTxxLU@(l z-B>i$Y=m*p-p%rhOMJWTI%>QsSOaanZsd9Rosu5xN!=Wuqmuo#&YCARyQi$u^YBF^ z=v{TEMp580NOWo`+0o1-{MBkZi7C9eLmN zXOSn_PZjUv#t4WlEPqgOe)G$BkRyF>CI8UE!~)r@!1KxZ&C2ohNkXZP%ddS5{!$_+b!$K#)<7A^yi#)b?IaHcg)$v=PrqRGJpIA1^@v?H#};(f zkWHlz<1a1-ubpn5hzGxwhF3n|&mErBfgp59HT@(E7Djl;nPOaQge)SJf~cS(!4h{!S_fAVt+X)BSBbcXK-Q=5-A57pDD4FdT<8htzb=b=BpE zy`!Zv=g4bZTpj2hp8n)D6`@9I(K?#kTnvS0v3aS5aTaoOG;s$h0~${xogSNKDt`dB zw==_UG%<3C%d{1*yYQ7;9!m?sgCS^@{5e>1i*3UfRxFdk@X@fBbtB939Hp1npKD-2 zURRA!BgTwd$}>qXtlWvSUCLAHjrmn*OjlL8Fy2?PMv61MvXZbDOwd-y`@#)|QMHZ% zJPX`{n|hwHhrqR%w_%RTdSiSi8R>@8@4ep*K#CW0`A##vzQqr6>fr-G*qDumV77|v z5b`&mBO|W0cBUE5U(H#mQ#I?858{!VDCHt33y-3ZdNvC31I-5ijYRP_pj>~x@S}AEn)`j0U+Fgwvx5OaWjuNPxfK; zvUvRAw<{Qp$SLi`q@Ue+uIO`c0WbI9P|c2eoghGxQvAdaezZRX{wb2x*z)~~9_q(% z@`lW78yPui$t@Xmtd23W{JEy-{G%|wH^d|RgK9UY?|CmE?UjYa-=}Zo_s!k)%`ws$ zf4?=hC4H))H-#;pUJ!={Pjdbjxpq&60;~xI<-ISY%EFg@rET! zx_QkarOjQ^l5*vO$$bEx*WqRS<+9qB1cV4{hoJH0Gw%_eZ(@6aUQNVY&WEr58Pep zHq2ebmt*7DBxjdTrTM*^4yQ<1TGf>8>E>Xp!b=em72$7iFqLB!04VFis;ze!c1|j0 z-1^l$tz0@ZW09`KLn4O-@Ppwjmxz5!6t+B{C=8t;r^)K;@e5ig7=eGEv^JZ;UUqJG z1TDeP*a}&umVz|Y#%`h96feg4oWV72u~?_ntg{BCZ32t%TKD}gsHf38ha{+5t2`dC zTm_@2z{8GeIE`du8AlDM4=S(VVk94gk&2Mdq93Etk8fXEYWo3VQm1R%--R^Mir}bW zIHWfapUbEL)sA?cfqwgE80Z5nlSo%Z0Ou^g$I|su1J-%<_X71u_Y(lLIDB<``f~4( ziP-yNy1ThikNFb}*nEfJqpWcYalqb=_J+f8CKD-oD;XQlgYJ~|9v=sTaRD?Vsr)?o z^Yq<$9he1j5#o1I(E`Av)2C}~a(5?%+T3e&%RADS;09NlNH;0(jT%WrmKW%A}y z99BWUX)*I_3g2hAE_3q9xlI~8qHpn5`ZoK~L6y-cWjMP}(xj@6kF#v;5n>n(!cT70 zlvpW4+n`AN3ZO6c1s}Y9!z0?uR(yceAFfOJ#Gn}grjg=f3bK#)oAQMU!$Lcv$PJ-z zB5i*j45xS)E;_xXzII09HegnR9|LuHAu;rYM2pPrxHcE{K^1#C_+hHNc|1*G&7>Q zEM2D46O~xIJ0YBsM=$omAba2s%upLLPS`hCy6+cm@oYlmy) zH^t@cXOQ0*|DD-ffg0qdFTC|EK-oV+(T1=J4~|Ft_4kD$oF#uYiA?Ea?}f4P`&giZ z9Ucr-x5wX3b{(&fs8@hWdb(vZvxx?L)~j}t+E#d+W(P(L<)il$Sr$e%FX(YUj2Ipv zFQ)(4i?nqT4BLVIQvIQf#LXCW8aCK3r^&QXs2bT&;v64^Do}3cPI2O6RuQ_d_DNs9sOC78|!Le

    |Eg;L> ziPxe<@$ZnyLQ;EFA zp9w{$O3y=!m@dDc@*;2VrQ)-chT5v8C{nhWP2YU7`Gmy_?*YKS#H7rbiFo+D@*eAx z*fyfUJZbGTufGFu#@3fn{U&1Eg8b7* z?&_u%>F5430gQ3F$30A)$`_}se*27_*}F8(`g+^j176cUBH}xq`RWfVN?KjG7pxlw z((Q^?k-(F~dBO^wtWuxd+}-mvbY9k`MNfbhxg)ktlh5cRlCONRjxn z&#n7vkMB&QqAuMYw8WnZ8QVsT$9#>yb~zL1j}d!c^QW?78}{&Ey0Hz3I5;}QrFp%v zy|+(`kvJxQI6XYv@MG=T#HRk}*4_x-#5*TKLdaC+U8fV|k@Fn+CHP($fm(L;zOq!9 zu2qix(1|8gn*7oH(Lyu;As@2m?y*K;Y{3`l zS|<@%u-@w6Lu5bdMTj;5;KdDH#@fJn2)B9qorA-zLPHYU?pND&C~Iv9-)_^V=7 z_gL^txYp{6-Y!t45h&@{SlWtd&}DjHKUF=dCK=sSJ0CUSh3^@TRJ7fx(b=8;zIQkrim<{h^C+1B^f$AbS}??4hMHU^x^@QQnXoF@IJr1RW3N|S(9D(5 zTLF4(Gb5C2J@vQg7bpo(VK=Gm&G3))v*SCwmE*e>#fJJ*B_$DZ`?_=t84;YiT?!iz zvnqKnM-JP#Diu~5M*RzSI6XM3m$m=^J)yoOH>70!QCb`REdho2mM;}i31KMW-(6s1 zM*%p21;5cIIY3^kUJ@E1H`W;#_aU6k%utZF#(`0lxEO9)Yu#jb@AWj3D2H?rg+@7Q zZHMZRF36mhuk40WbaO<9CU#N$kjH zprMzZ5C!XwFoJFSrzkBs45KqRMs!pA`ryr8(8uwo^a^DH7pGRIpQRy3wl$K{vbZq& zB)>gO0KmX8wvRSoI-Q#bG<{ZpOu9)=CwgX1wX7a53sGZJNa&Z^)&ud~H6i1TEV%O~ zw_1L+<8pVVaP5hwb}<@68ju{oh77>L%q%dynlj4&ASt2g*c~{z2F)wNHUrYb0}xE1 zvR$wAaZl@4D9lq~K#nq_SQ;EkWs;T({O>;N<7UX-co{;E+mpKIV9N37;coVrrbfby z5#7R$96Z@>yZI@?oqG%Zl*;?Zo}%dFiw94WP|IitgC16kTVjr_SarXK z_$-Dk_zG64G>sGItr@kGV7+Qk*)jP+QN1e==>-Kf3At4m`a|lR8^w?oTyCzhIagnf zyDG@gJ71A?Sl4_Og6WB_JaV}MtBA3OrV_>41-9AnJD#0X~nR^k~B6!t%bdd z2--UFA4qFbuh&;0FnZ`!hhSNRxV}E~9O{vec8?Z(|(SYTqZj^C8K3XYa3It+7hiSd{C%fPo-9EhsooV2Udek zYbLd|HVMD+#vn26vo1yE)27 zOW_BWn^5&muv>O>#9lMrcuG$pHY$HFOSbF zh^?BuXTF_%DOOWadf(}{$f%bA9+Jp%6;m?}AydP!fiw;`2uoh;Q3w(Y^`S?BssYZt z;mg&=-u@ft5_Y7MzCPXEnZDedOs@;V@s-~x(SJa)TCOGxE`*ZRWG!F@6B^N@L993l zQ^iDMlnr#<+7FRFZyj4>C|wQb9^E@FK>y4T`q?z1@-7>@>wsI=nwdqa+3f5?BIP4?IDlgwEIiOoX;s%ba==Xkb~g}gE`l`(z{KD9Mf zh7FZ40GSn!*#@D&$cNHr3S;>Rx=mu%jM!M(w+zkq6Lh2FTV3TXF!El1kk2Ba7R#`g zb~OaHPP@;ujA|GX#SC}0#~tVHeY~&~rLj`HWXHbHfS)tMeUq+ku|C{e@{D>3B}>Og zj?k7MmNOK-&SMV`pY%Wip*W0QpfeO~biE67x>aXz!PRjRQB-B9tbO!9)=IA;Kkul< zaI@VX`f~hEA?wL$K?-D1YGU7zkW`ocJ{rT}_TKA_-Ob;o-;P5{l4%oSG|E~?G0rTh zhl~DBx$3WgxJSNYfJSB)qpgTs-BBNBYldM9kAM6wO!rF4x5YSp5Imh%96I`KTdT|T1cJS6EP8wt^Qy} zeqwl1mK7hj*U-3YRgI<5sk)$NZLvNw>DKmr}bmm0BW`O@l7>UZ|up zREa)q{6d48t!sOTU)wYCr9A7mHN?Ts6)Yw9{t~bn9!*r<7Z8&U6my(&{5rpGj6O3# zxrRoch@<7R4y4jNYhT*3f8}!M)=xDvX&s!03fW$&G zUfK946FU9~%x8Dd%xc{-3MUcF2~$#!FhFTgBBh?n45Tvut6XJERm}5l>Xe~_E=wFf z&jgCWWQ^gKXgcR`DENGbXt+N6aP?Uqe9vhH%oedr)ns>*a!2)_CK_K#tJ3KkWPH7L zRAp41Sd_u#i~W^=7Cjyc0VKVU63M}fbShZnX>gdI zT~wR?g4Cn9gDNmoc16%UIttEa;(iO4FVOhy1P>b+tzc53kHV+H893tsay(8VoU#SO z&dVc?zv>x=mo_ujOkW~IxI?nVgp?9B*)pFX2qm^_f0~6s0-^zNo*DMt*A#1Vn5|wsd*OCj14qhGrwVs^~YauzrQ#dW!K6|aUtyYv(x3x9=z2LpQBl%#xDv(vg$ zk13Pyy;-qBy*^DiA7Is<*{#=tn={@3q7P z+@CkrVBHpJiLz-I^N7?fz9DU%5Y+0^?GMaGw!VE*0?IclH3MOxRj&_I6i`8Yq5bpW zt=DZnjY!%HHH|{4^Xw6{8q7puZ!!R|3pbZECSh9h=o`hVNioyT+fbOIc|AGZsY*lK z;ozYQ0Q^ZyF3eiH(#G5da~XImtZyf&D7D{~h01wc&8~U4EO8F64tgpKv$NtOhd z72SE{GBTxYG2}YWh4V*ug`YPP#^c!Zm73^)!e$cbp=sz+oe>;uF|TK^OirgLz94&Q}i@mZK(lw06G2q4Y%>T)ig=n zlsjI#nmN@k?~-6nRamhDSG4Ld$0fh1Hy;-Kt3J+3Qt``f82*AMb1Zy?FRo=tm;y7G`qsvc3wlYyvojg!b3Ts{hM^ zjY^?k{_EF_0WXmblJ z$JB*kXOdX!;V|ndPtykI*1k+5OdZS-Eg3dX+ML;eW4xI}mBGON34Ll8RXstqIWsX} zj!$_?iBf%e2y?=Xs)WBjkT8AbuX4Jfo%X17eTX^wLH!wmn5QUxtR?=WZY!ney`5LY zUKXbU+|8Bm08Nh1uFn9OtKrcFVdyuf+iG_6@$7SAm%+J(m$6D-MtD{;<%fz-dUbVq z=bnRYR3I>)*BXkdtMAx23{!((YHF8WDL*)w-p>M7_1ot$pE;bLGpnwXW-5L1tgXHd z3+efmRft%|-<3rV6Q;33i-^y(Nrmb+UJ@I{NTm*9)Cg0t>RCTrRr@^yFxGIfr|iLX z=@28+z=B#3%x9J{{c6`?2ltVd0q;uV`uHJ-FgFG@Hz~5IX4Xz0q1Ew>5xASYdb_#% z!c17_zd~K<$ZdLhHgY(s*5&(v^^9*pZD~LsmWuM&_mg+@>e=bBCq$Eg*d>dTBwX)R2aJwEyO0KogGHLfD%&9#+ zA9LlEt4Lcd9mrv`5YC|3D;p{LU43EzGKY_(n@FHCJ^b(b_Vl2z~vF$@$yqO4u3KCW~7EV-F}XBT?veK-e_S^0HiedERCvQE{dD%SHA~D>X|H z?GBZmr$0u?)oF+e*^$e37`*#Cv(VP=ul0x)99+&H|4RW-rVa`yOMWoEWJgOpy!~|T zsO}RvoPuX6noaek-8}QA{dfQ7?vp?)4KIHIp>FaoX|52!0YzeCP8OeRj{fwCMqDS(S#zGPAEhv4tu}jQ=cX;O;Wq0 z(=3HD5GN`5-Iv*gVFI5L3!AoAg5JIuT-~e8OQ$D*ZW-npqMWyiCu12C2G!ul0q#Ey zCRcq4(uCqpd_KLdJw8ym$(X^QcVF(ko#rgI9Ta;0nw^`0U#;qHo#yR#;SUu0mOv?% zxeaJ}d6#x+J!+ZueBwZk2aF@oQFV@W@?pL*iO?L1bu5JB$l0%P0Zm%w zpNa+zX4A`tZm_wZxTD8lzPZVlB#%{n%8bO?)hwQ9>E=pk&;te^<)SuTY-bDjOnj^L z-Mu@%IE{dKl0@3A^{-o+ZcXbQxLnd0v2fyb+YZmRMc76LdvLu*o73d4^J2VLwS<;D zfMSDT9*i&R|- z)5(cHS4-lT{xcI(MYsAxsOe&%mV`!6jP55#Xjw&4%-q$H_1 zG(%diBU?Bl;cD@Ps3RrTS37n4&qCVJXkh$2V=}VTen~AFe3Cdvj(VK-;9VM5SAX7< zzVzmDI5c(3PUyw#zHpBoUz$=Y z4u|Q;bxgdfY;u{Y)M@;N_T;v|Km~hGNRBbW0+H*wy}GpIegqkU@KIK0e~7H+A-?J@#9?D)dYQ8sbiG}ZvOWUq*A?n zi(#aYn(rQ`2eAZK6B(q05x(8OD%9?l(1^;1psSoA-eMZRqgX-w58&fpkx7xoUGjmO zWQ)aRx2S4o^3cuQwRP=e2U+kuy^u*a;N3}0!|GNd;_-)f2qp7d5n4&l5annzjTX4G zf67KF3k8E2b2VQWvi!-_^>qs4L>|`rzm_=IXraV1t{^`?)%YGiJ@}ZwLe`RhF9i-> zuisrHPwo4S&U;$ih*C+o-YgBik{$Ugs8Kc)+wjX|NTEhx}S zxcdI;3VPOUZ_iuoHxY**Po0k|Z|D)R?a%K5B-&vvZDFZM`o)-6KXQeSyR&dxG%rCy>K09&s>WJtEJ)fRQ;F>X#jwGci; z>y$uS176mtWv&Oa3lto`xIASEi$n&`lakB|GrKQ3Tm(`Ebi1Y*gBUlrCT%A7e@tFX z4}VQ$mRw0Zy3}3b96NMJD}$E)_%KpaAx1LKYOb3PAb@2e`VzrGFAHI|KjqaJS+H_m}~UMsk>_nZ1m$wOPVjFS;e$PsA>v=&O!JOCc15E^Km2`$xGPW z>fMUC8D~r&-BCuUU%D|zSYzJ-cB?= zo)9V?De>~azwgTu62^;Pc@RM6JPCG=hK@R5*gkH@|4Z84b;WUQS%dy7c~$4sc#X=k zWZ9?hQh*TVvq*$&_2`QfAPEV9iVw-~>-(8&?}$ufpSQb5j~X?O1xZH4j=k5%TyxD8 zC~i|><9Re-(tQjq-<(FZR_5HE)lL~0IN8*hl$hKGG2;w{fJQ2V-YQUHXP^ddCk`eF z4Hx|jOXi=iw*FI~+X6Z!E~WHlq|};ZB>$Mce}7(zf>mmAXj6juqWz-H8)EH(-M4XB z*3xSfe~cdG@lU$#3x6uJBRYn$-71{9hz^eT*|XK2d)UQhGgk7|+tYiZX2<$?ox91K zJN)SeM%MQ~JX3lq9nZgs$;NvS7urbVHBnJ3!AiEa)Jc-suW&?MmG#vsAm%!~#2|Fl zahpd>Yum7~l!jUzKqEzPdy~y>ZsDDuC>-BrBZ1>c(mv4ZTi|JuV`dwX?z zYA9U)<}47zK#uxpR2xRO=V;btFLzSf=qe9<8vFrFCHd(gU-x2f2~|8RTO28 zMzIwJqI8}tRmiP_KXxkW?wQHcAR7Cg*QhSB+g%7zxgQM$obcY7jx0HTzEa;TSFj}* z_Jca33R%J?%KD+mU5-<&MCTeYbj)7W7`vLvsxQ=6=+Lwz#2I71hv4gH(u+C!`1Psn zxBJ31@MbgrAzFmPPoILv=)KgEVpiE4u`zipOL@6+q{fg@C-0r}R`AdvDI7eS+6H6x zG!kkfUbZOD9@=^O3tBcJ`2_)$_>)^x58;`I!bvMMrS3c;20dJdwe%teBE58MB{=p? zp4(CR)!vm)9ecY8;SY~$v*q49V*2=hJ@!%Z8p0UzwX>c)9E%Ksb14?}>Ip$MZZLJOe_O%`33sXKJP^aV!OGV zCGJ}kY{W#1du*=)2O_C+6DlZ$oXP8Jn?JdJ)=Si-1xXMT^=tzI7BKVDH&q~{cq-B{ zz41DX__8ZauC_I6dtCe0@&)x8^W9%Kh6O2ovibJ%&+^CZ(og~qH2KHj^PPY6n|acO z-gUc3L2KvsU#UH3aW_7HI#!wKA6M+b^U3KfihnbiKjSoodZ$N=|LAU}u&%@*ZC$d2 z%+AHx|0o3h8=o*n5kc68BuH#vrRdr&W`iGWy&TMJxQ#yiNAEFz5HJq$q!wL4b#lD~ z^z8uF+;xhrd0>zBvzl9afj~$4U(U;<{P;AYTrnTxx7z$;v98;B(U6o|B$ap6twFR3 zO}!D(H3=%UfJ%c$|5BV{k((S8z&(G9pJAjc{x>SC@e5s;A6r?e#+0q-5I8 zb$%583ZgMEu$z_xdnJdRX-K3t`#g>IkAD^?PM%L^#s?4G2;-p|JXI<&aM;b6K9>RQ z8U3ToBGjWjdCANdlB*YXl8L@JkHDWQ%?Djpxl#sKVWfP4o8_F2T}c87!`0E+_t@op z1tyZaoSvLiU){C>+2ZU``b~6C0=&Xy>pI|_{*b*A4lXOR)v)R=Lv<-^Op*e9K&)W4 zbn$-^bTx1#st}o!+1_OdhNN8~68JvC%VhOr0UOn+P7*_}@A6)(S*q<#7<$pUM=EZK(O(qAdDxe`7>$_;1lb#RPkV8NV? zA5c%jCFp}l8^Mh&*mSlVUz|%o!{p7VJ~jTAVTE*Bz*;R zoSD1+2Z-CxKp(d6g>_d%IZNAQ@-q}w<(k6?9mvkdjgQ*~9u~Yo^pm7-T#vDY>LmIZ6o?X)U&{wM)g6bx=wMmk*kQ*d%d3>?x+Sbuc*XyS-AWkQexBUQ^% z1EowMuYsTNtzR1S%k*)902M@7x*2VHq2-#S|eag zz;1%bH)FmLXGJJA)bMn|4yA>!){3N2uV^&Nc>S;#RT`#yF@IU#2zI0(p!l*nT5UpA zlhtr7Z$D8HxL+wI%VpjVN#Sar3~P-W%0-uTRVw-LIe9DUp;zuNS;*=>F_s%%!J2(i zWF0T1S(x#%&$Li}_@thrb_q71WoIl1`exldo!NZo=~U!Yi4%iOg$r+MIQ%6I9@1Kkf;Qd zS8Ruq)%Q%OBK@I87=pQ}k9~zit1=9?xPE@i?su*pkcET#dlg9Ir5qxZ!7Zm|*vgnLBg1tx zBPbu)fD+E75cE5%M8C}4$_5om$AK}$or+M*x4PxbRl*~md*a~o@v+mCzgj(_aXcCs zs(VUl81pL2Z3MI)XxVbtBOyavPHIFW#jv+lefIH@BLY8j{Ny>dk7fwmL3xbQmQu@ zY!R>|3MYdix2QSxFw5qSV79~kge(?64yDgh53g4upaE}_aY`Q0)+Wy>t>2>6rV(Y} zL62W#21DB>&T^%ZM?_FpYCGkopZyfM%A>RMLkDB=g>b~Nt*QT5Fm7*^=)uvPAJ6=t zVM+5l?|eV^HB@P0I8hq*YEJm`^ZC7({1T5Us{)Xfk>joN8!HDgK>(?XSA_GkfkWK^ zJW?h_`k(l1Focf8V}_*kXbWZVgTAwt`pU}3SPSNy z84_0~*=L1s4)Z&<$JO z*5`z~QEfXApU;vz)^DWs)H4W!S&Bj>zVxSnyx3*8S2xvF{9qc8<}(rab}Bhsb@Bo~ z@jl~8cHlCCQ-}Q2*P$1E%3Jk&mmdm7qOzfDy(*>c1CDFvS*)y052G=#pukMt-8u(q zyo>od=hhOEoyv^*M0zoNLJyamtclsga;D~Bu=U3J!SX1PA0uZYM2*KCy9TSekN%ll zyV{bR)5~Jio<%S+4hEeMSY@onjmke?-BX=|ca5*lK zl>Tw@JRYE(A8!H8w7PNPfU3O@ih|ZBV{nfkmWrZ5D)sk(3&h?v@-83V8ff17>AStD z1+JLO%6IG3-Xqsf&?bpSlJ(|eY_i83eLrfb8}Gu=k@0cr@7`(3>6=7wxOq&{MW@48 zgs+9VV572TuPR$q{CGja%_ghBRQ(WMaIlI=v>P5nQp>w6?3k#w70zm?g;T+> zTU)KO^4)la;jMbrUBjlVia^XsLE%=Do4*ePHm2`v?D_mg>5-E^SF%=jcz+w>w77kq z@{r33_WBVxw*=o*`9q;vNZ5#PsD6+FT!c7co_y;Vuo{_U=Y-#MKL2ycu0@=DowaKx zf1Sv#kvl&yN!xjoxi$t|#1NBGT;I>J^-8_-HMYaI%ai*w9q-KVLrlr+QkCEp8~2Np zWiHT$7M-I0$1y8=r?8_7?p;lZ&d_28D8`ghm zi`JOAi;u+=yW)1#GQZO8@Sk5Vv41WmHwx++_~_ub62lJw-EjN*3t1{gv~yRWa%2IR zO6T0tqk#4dGrY!Ek_fM2HTlccA}a+<3oZM!BVdUdfi|rl^2(Z;r6ulL|A#TaoF0P# z9%xv)tDo@FQ9^mFv$=Y9pn}4gT8F>a3cdDP@g7cF6@zQt`=eet?C>WVK`-;HCuHJ> z!c(l3!X(@N6hSz)vRkTd27=ou-Ex%r3Fc#NOJfbBjpD+(l+LkWY2P3bwJ;#VUS6LaUVb^l{WDuF z8wrC%#5QHjaY!$(-k~vTpyP8Ab1q}4t6^LT;`tBrbHR1%9sL=@{Jb9Xu z?1tbhWlT2R)45gYCEC@yZ?r{GFEV)2@tdE7G*f|pCK-%>*zZ*u#q!<+gvm1GRtJLZ zzA~;TM^z5u`pDK_1S!Hi{aFb&z1`uSHLH5Hc$Eh$-t{a_z*c2vmI%c9T$tl^x50Kq ziMuj9sZCj&(*Yq++_Ex>Y!;HmE!!`yB8 zo{lE|b7zj%vs_rI#nQg=|LSv~$<0lH3cj{Dci|Zyhcmp}wb1tL=Lf?chI*>EqQH}4 z_62U`-_j$RLCZa*q8NtQ;$*%#g>hB~75{p372vp*Dt+g>T_dU|m_JOaqGSm~3vJ(? zdaHx+JL?3f)Zc=2eE^zUJ?`jT`cTS1j-U6)WT)%0c{^muzKzl&G zNtScX5Xc-`s5|VhUfD){0iLYxjs>A4d9@D7A4uJp!*=^Qu=39BHFkA`!D1b*hmWP; z8LubGm8V(*Zb<=kCbKI&`Hi&~li92FH{DRxM;iB;?+lBd7GE?u%CJlZB|;gn_**wJ+&AbPB30`KOsnIMpaKQa#&gZblk0)ATe1`jLN-TYDCtVKhFioI_nV-X5gD_4(|CjQjlbgU-@I zp?w!zf0EkER-0mtfQbN^xAo%_b<_Rqm?Zu}zo=TY{LHt@sonwy6Qx}?eTThs#gNIC z&eV$9@)^YXeIw}!Md=aF8_Ex(7)I(&)SM+=5bgagIUfQt;Ik_j=twn@0`KhlN#FO`WhG@oZz*qq{IT|YmHnW|iFj2c zcCT2V#TjAb+2(p_u|mE8ULOxu>?wfI z;$-DE?4p*1D|A48w1h~hyQS=!*wenzQ1# zFxHZ9xOr+N;{Bf>%!4rp|FA15@DCoI<4BqF^y|C|2Ho%HG3W;vkj08$EFIvHsp#_J zh!>}S9=AOXB2uZ<0KKF!7nmN&QT$|j-N%UCeP)g{Q3niDITt*p8Svv0A*}+We*~I2 zI@n87+dq8NwNlBO6XRUrMHyvDT#prBUx^tLkBf@Vtj{;p!D%zW>`ZHen#7h~F9FU)e*$RPRMnl^TKZxCJ6wd-$tsm^ao+zY1#M5x_w?so zR(}-o<%sc3I1%eoUgtHbBr{&ujEW#%0AJ;tD(wr4g%fY+H$s*0`S1`w2?ZySf!~hl z*L33{z@d6&1y9eTnY%D^^`A{L;7NL%*35Rit|)CxV%>#Jyk(!YggOM<6wfQ2PK-MF zXCk)$tXqES?eDA~tWFR24pvq-CTl{Z{mTk1k2Zb6wyMq>A;S~kcwGJa zN}#K?8A_(IH+b1OK;vF+3O+2Qls9uAXt0!TR)#@)f7>n(U1%;Rd!x{!82eCmGR}NT zM(90F=&pUp6o}Q7ObnX(Fs9CnlsVwBc#)G5!b+P5yBDYNSpDmaFo0O;@Z~F}`JkRo z5ktZd=*X#=tGB_g|+uM$IYUHt(cYWN)&Enlkw(NC<{nrFW{n717`I4;w@Xcre~55z(v*g2a!>PwM~$NJxi2D`r0 zZJ=z%GCQWrx}UajcBnjG5XA!Dvlq4gI)i~^$-TiJW5Yq>2L`FjUk zP2D9b+Rap27@#&$n292_Sb_d568?P8wJf^MWe4A^Y9@} zQZ~EBBtofT16`~=v%msZ_VfIkO|Y=8R?(I7M)o$gR-X1}RcV|$YRI^898EJo%2+A< zy+*ZRNv!nBZ12T`D8n~C4Ff-rS!VD+ydei)!lq*r{A}5dS=b+Onci5QMr5|@BtWK) z_wy!Uu)Q>zfLBuPx{D36mg{RrE6Q<-*;GUc^LStx5v`i2fs**Sy>j)}zb+7WMQ9g6m_m^HzR@jnThZ-6x2 zkpq;L59C)VzkcT7Avk$epqF>Ln^O*ybf?W@fMfcT`VatMX)45IP!Py(6tB7~sv|Sd zH2p>m!xm$*MrESDC1sBI-Wk-4VrjhhP<}%D6%$|Mbu8Ej-orEDe)UZ%@||7*ZAK?A z0>MC9y_3*g_gz2UbGD}7_;Ah#cs<4YJeo`T|8d#}feUb+On%>{O4W;L3?`2OjRD!P zB95-8+N@?{faXodXF!O6N9dG_w!B8$`wbHf>f~J<^m-^<#@QtJUmB*2WYzFh?3#{{ zsJQh!{KIF?{`?21H7}xvkMh_gd0T&z6VgvV)g;sd0`YTtJpX3Uk+3^qE^%sF~MU{PjnWc4$)@+j|rn-mJb6XYIX?932rYMH|PexFa4HPA`u1CfiX= zH@WXX)$yLzPGv8ZjkNqOeOw!g!SSNQMqgN9nE+hKo{#WGy`sSr4omWK?_jpl``G$9 z!^;r6xlqxN+GR?|aX-ld#_+|2@|2YC=K0_w7NEOl0X;mDerNaUF9oGGtDHq zu9(-!y2(bC!EtP{YAyu<|6S$s@baSvl7?E#dS}0chVn3SU8b-1!Qx3eGzcWBD170Y zH9$_6%h#9aZ*Wwn)aX`1k2%<#Mjm9ky(mh`j^L(KMRcCBSD+u$Vc^X^fE4DRR@Ry3 zVP&iUd%St^UfhT;MQQ6I%KWvAQA`bkbIbalmo#Q{27y+N`vP={mU{pzTuVDI*Ctub@Q zGbphD33O5SGUjgzpE)ujt12q`got|#GvoeWOuu{kiNa(qhqHlopahaW(pKIAMcOiT z6K?n_<28rH1Y?9V-7TsA)vsZ#vu#@KI*|nVskC_1J*h%Sb;$NJVdICGksW5nH zLX+aY!aKabq@p2SZrtS40M93}G?v!Zrtp3`>zobX3IRi5DEp_RO{-leyBmlsLbeW+}Cro;M3 zuV8wjx;_r1ifd&ChH%||3Muqc4-F|952TVbI{tFf<@=kYKkXvtd#Dp8Gx?Inf3L~I zIYuqpfeYeX3@AJDf^S;57W7i3Mr*I^a|Z*-dTrIaRR6UqEsyZ-Zx=CqrRc8bfp=c5 zzMKjfzu8hdj3thV&2r3<)xY$FXBC~nd>3!YK-lnut6aKE#kj`9NpOwhpHLiDm1<&A%21T3||9|)*J?`nTyjT%=y^C&|UX2Un;6lTGqiuhw zwf<2}HP_SXI2z}~91MKQ!=wI1@|47}c{btvkVDvLQj0@}4hp^$I)o3a~d`;9f)4{tSK8YG zvgCqFhxT1E-5szj490Km=VWnHlZ{6slDFOLhxKejcF2n>&K5)1@WwwD9|egnETVJc zEu2&-Z}Dzq=|&KsSY9JffW1`M)aTozgAonPx!5PQ!~(>1K)R0$-(JpU9R-QflvE4| zY{{-gXKQg2zX-FB`ly@PdM!YR>`8Fahf{9OPqX15iMmmMrfYvO`#`dnm+zUmKUZEv zx8!OpkvtKsyqfJ;!;!4iMBtXZzT%zKkYr2jO79bGFD#c;uX;g8rr!O7bln4@LcL6$ zQwMe^tuDfe{JD~|5ajvLf;LFS*iCi(_sbmS>GVcOp!eIbvFjc?HSWBoVK(5it3YB{ zZjYEo$btOVONSjIHUwIPdo}-3NpfAqpV>3tHyA#S^6ic^_S9hTl-K}XAn0rqQa7wzJ#~?s47$_W{xZ{KDOo^syTg zDUA-9;gO$jo1Y>4Pnzz?bQ$~Bbk2J7Gl{=vYINr-RU2)*&b|x7?fIZiFYT<(h;F>n z1XFswLDAI**|FREiBy13PG9Hz;!y-4QLwo0<3|JCES9F!MwmE8UqN#g2_3l$EOLGN z!}4;a$j{IDh6Gf}u7EdA|A?$8SN}SBy(y&_SWcN%@M8Y<>Mn8eID69XI}hIFIVM9` zf)#UPEc`;MM@NQ~HZ>ukfXR=em092&HtpfobIUxIIrc$BUJ0#5yS^$Nr4g`u__7(b z2QM}J4~It>eZangwAA4sZTeMyV48|zoXM->teuBj0zkDh-A8b3cbCcoIDENmgi^U| zzS_79&uk@UNL|U9s|#-QYk3{gP`r*C+4kwh$`6z0XCGDZGHQ*n{B#4-<)6*hl1VvY z=CXWR`ghr{^u+#l31x}tzgl^9@eYi+LLXe1>0$QDPh*h`1epv(E3nA+u=O<#EVl>j z7)B0+I{Uh`jZ*|{NyV}Q=}v%k-L5o~^~vz1Rt#Kz{bhJUu{%*hAl^{*sRY1&R*efO zu-oCs6PQst7!=Amxc1Zd-u9U3z$k(pM>h0Y^yOUrVAo%W5Ena9WKP)vG~w*1(v4tx zTC?5a)$l~$+jbS_$!u-9@L?n0H&SHV#MJHCjdn+leH!9xGL8Kj?s>meAZ)Bze%Sbn z-MA$LSt2qhLQBlZ45c!+2{`bdHJf<0xqYOX`JK+ak4F|$+;zOXuOnz}8m@u0wg0?R zF4`hh7}F>YN)GI?@H(;vsWfY{fYnjUUjg|#iDxUH=I3)t6UfhE{UVRZHQBCrefhmw zfWK=r^Y*ilMapz;IZi*Mv&YRTeDh=Dr8i4WG(UIdza$j+Ve)DoO+!BegTCfK#k#R5 z4}Dl@L@H#*yw1peUp#O~+uZoh{7S7C^%jK^k=3HS2ZSUk_KRrmkXk)Fwh zK;-ON;*OjaHhlNChdmEsvvLC$Wo_fQ+gxs!P3LjsS}JEuqNtZtI>DcvCVHn&FL<9> zmUl*kya&9DuSQsq9Z}LC3!Y|+I(%`OjPq)%;jz=*YM|)cmPt&x^oD$#LHo;5M1(Er z-SG$#nTmMW^~EIu^EE}yYbnrY|IhIjPLh>Jq2b_e#?!dCBe_muyYWjro_bu4GFJe?-Ml{^NvBlj$4l(`$8|a(D2|t{l zf0+wg$ABa=6Zm_vty^lQgw~5i8)VCCz*FxvBhhW=ZZAOfM;vGa5&tCw+MmBa4LjR* zc(7v&iLuOLOiS^6ef_vwkb(X4RE!^Ump|-f&uppWO8-Cta_9=v>A9t}VKwEn#wheg zoOK13^8`1c$bV-B#gM+E;H}uPmo=2SY5Kb-O&o`!kH7Acu!H7zw+oWu5EL(Vp-gQb zE9vU&J7AF@mg6+)^e;hN1gltffyldeib*_iIj}b(jp#r4cZR~?`-)rdg%4u8u{8}G zDdQ6JZJ5AzdhyW*744^!PWlZXnSdXkvA83{Dxl?Ni$S{8j42`hErz}GC<4lwM#j{l zwk5IVlvvLp+;*UG2vE+1fZ^VDrIDA^KYT)cqy>Wx*(2NVtmA87mZ>A8TZOX}6m@hZ zIbCsXys#E9croLajQx_)1u5`Wk-6^XD^qO0zKa3QTbs<2`4?IblVwARBFX-i4|(5i zJX8bxj9LEm>{oWc{a&Oz1?J2Tja0E7zfE7E-XBg@Um{{0hJr6`8lb%;fQUu$m1#Ig05lIWnG%;{F;KGYD8OnUj2z_+1oj4 zE0o4I{SgWH-reNuwA3jxKvp-x*u77|2ym>QTnL*+s3Fr7i78m+w_K!oDz7)UR$g#n z|J-=K-0b1@fXUiwCz9PpSe|Sc{dcfCWAx_=Zqv=3Jyc~;C*`|VpS(_yxk!do3%M5_52eMJJ>S{7e zNFn&ZZls3Vi#BRx!cS&%pEMb6M&~pD%v(R36_?ZJ9d!UkB9Pb28whbcO&u4R7v|zM z{%vM|_XWaSNP|`FKVO?4=N;CK|1_EYK3x`POwRUdQ()ML1)wi|KRc@_E5OcIu18&~ zkualvG8qQC_xX@ROzbqIVn`Dt z6zNKc=qH`7Ltq@Wy*FV*EouMKBs%f@sjmcHBny)KBK}vEp|yVC&_*BnP?__7^5$yj zGL4=?x)aVWoZ2$KK{N9`t|AY^hFHm~2sl}Z*yOic<((*26_?tXiOlofOoTeWk`MFr zXO#B}-$2?Hb%&UW@%14sz?Fq8vPy^6Rz1C+U_rHe7ar=dh+{w4p};`w;+0vA6=TDX@ zkwc6jj>9a=@VN*Lxs*NgB#%wH!v4#6`tNLBdl);p?y+K`|4^G6gBU5N;${HfMfUD* zxGe#6^{5q6nAX+4P2F1@tYArq2W~0ar>h3C$qFOV?^Thz8VT_TlWymjTu>re(4-MN-)4h1k+`a0TUn+ep8DguF;I6{M3hfR!_meX7oSHS( z&JqBu-p`7jB&)jgO#_uIHZ;5+-ZRJIAbyo?Sdy*m7S!9LSej;!-HplX4{-mP3)YeM zD;biC%9fvAUk*06pYSJKVC6Il3eI)Q$W5M%1Zi)8DaSB0!)%IA$0VV3!ZfHnul#Ma zl)l^dKMXmgF3iBac(rpzHhXp8P)6kTe`cSw!Zl3nfmbP!rYw_?J!+?TV#?C9&dHcW-ZxwIFv3|Jbw+bh7EysRdgc6GJ`(SKsi!z48$ZLv9*pb>$i% zE(zHC)fdrzLil>Qdy$Q)GZj%0SCE|*Ii|wA_6r=RXyL@##nQrMZkiDo&X<`7lNZ>G;tdDPLI)cuSIhoH49DIyQCi)sF;IBwoHsp@H;YWF-SLmlLPX;e zaJJl>drkz3U3)RM0k#0;I@e!D0hbPh7;IZ2B~K`dXRlw|B(k)%OSGHQNZF3T9}~C* z@BH}Py{JU}EOL>+N1!ZQ`aZe>4(<@UWZ!vfotAg>W$~4u>9w`|$={rqG4JtYN<0A~ zUeb+H-)w}8=a=tK76zuSk;2xO(1nf@Ep&?9GJbP?1MeIH@%czJD)+twCnOsD2|?nC z^}U1>f6^3D23ZsVlY6y4*|l?btvpFC5vxqL=P$830FUcY%PFQ-P2fFkMUux=;(HQF z)b3)2Z5=i237+>KMeykF2t3b5O#iI5G87}uJ)vJ-_G44FYe{xgZ!rlcYrU`6sP9D9 zW&D=Rk3(DL#}*YrjUjKq2liV}HPwuZ>W<;8hM3-k1a9E+wNx`Ehjxl9X<3O9x1%-qaFM5 zZ#0sQ1oowt6tbz<0sl#eR9ns5#z!0ZUS}U@+*}XBM5u#^T^DC`or-soI>PVH`L(vE&_UpwkYu{?C$}fi|o^0WMIaT)G_UlXp(3mZa{gq-v##UeM z>-D|@pbbW_-`-drC@po{n^#}x=@9QvMxW0YuKe?IOfGrg=W+vsBtMAD<~SU^-b80pRV^&M{D-Svk| zZq>f1r*JqvMuQJ_+<9l@P_(4;-J{fl2**H^~6(94&tfB`l|> z8nXfn*Ig9>;5PJ>dPl=nQd1ZrO0{s%P2(oEW&4%(DOS%zK&Q@s;-HGEVC`e-ZiXpGmx%^x-Db$YZCcS1n>JxK+k%RPD$B$ zwQ0_vImJdWixKefNbUhJ^{6a$0!FMk<2a=EqJit`(E91IZ5{Grizl^G*7UC2qg)1p zV$9J6+4WZ-XeqV-Q{>;Bf6_Uv>txZI^)u9e{r!7sK@+x3+}DREjY4q24Ak%Cc0Fto zB1Nc&BgiK zEkx9cdb~5uj~w`MYiUBRn5^Rm>_H=~XR+0`5CZ1!;m5%@CQ_oxOvV7D7US7yHG(+6 zoH!sXhRTnh1uma`o8LrP*-jk)QegQrmQ^Qn4OO6lFy9_cv{fIuv>y$FZk;$91KgT1 zrvlkseJ!!74>lh|4O5v^zAHRT+~3z7`Ar`Rj1E+G=&d*1^|k1Zh%DMGY8eHk$j;c9Crc@3P zg*a^K6L%j5`x@D|3;$%WZm%+~&M2~K&-OfeUZR#zMPIOrp`H?uk0sxe(86Gde&X*ZAp=C3k|)j?PcWDQ+dp;0q~ zXh__&xw~HEuD|2A`z|1@{KwPJ@zOvj#ZYmJKe`<^ZiLy{1m0`p?$@&q=}fx3nY=x_ zyQW=$Rrculqak_9--KFjy|_f>BLoI#GH2z%4q+{x0F|R|8Oc|N^Y+Thz6Cb+#R0#k z#Y5h@HbftmOnso}VShH=ewkWFrrEmB6(qlH(6bu}S828#LL`=f6~Q@AMIT z=-AywEUrk~+iL;~Yxml+c*Q$_@8?UZWuG5iFDOh%6Nqy8eJA@qawZ^`X(Z|+MvBW5wvUd>h4Rx zSSdik%CVqo9h>cy^{u7mmxR6Zo)L_$W6*uGd_d{BDnidf>#Hh=p6gs><$*)6hP-T= zE^g*02tS`C6Atm~_02c=)w3vrzaUt1c5=-ysj@U2JL(o?DFgep&gQ|uwzu-cIo{P% zKa6`^*x#B#k^X+|(%_916ESXBoVb#J&u_GF4oG_VLUrpIbHwxq$x4%I?u>SnobYHG zwMS1>!Cp)CCxmJqeSY*-`&7G^G>soJsJWNP(aClHDWISC?m6P()uk~%(FkgDX7_}l z(*GjB()R2iX@E%XFV=^zRpDAsjstNj9I(1&2-Xk1GT!jd(f|WEW=_p8 zu9(B!ya+iYRE_RAmy9+E@ux^rr9vCq9P1$vv5&Lo z27y+n;*-hI4Q{?RQv4kCq2u~i6pGTP3+QUAXz7@rpOjd@JxA30R<*8!GvBBJ#FY&o z+vwAjr0sLX`>TtTB#1nc%7N?;)v0G`t1okU_9a4tJZ*kt1w%&dolU4hkCGgjYbn=M36uxSQ}22%o3xUH?W^B?MkJE1kl{a!}S z`^-N7Ip;}X5(Fev^{?-6ZMy!W-w9K(7V zNUUb`M>nvTP6M?F0uiHb8@b9q(Kj-%B$X+DZJM``WVX3haN`eul{wAV^QgNr{du~W zTc1${^ltofG8#w|{gh!MiMJ;CS;GjXdvJ4yR_Y~bjPo##MVC{Axj&r{foqC6tszt2 z?c>SL_U7*1;ri@wa!*J%__PGRm8JplL$%Z;z@%c1m84h=nh8?rfm~h@EcAx2O0XnU zR%gFevGN&dmrm%g(+9`>pbW)X0?iureE{XTrS`Syx|FIL>JtHo@ijlI#$WsQM8#_< zqm|6PuY#rff$7<67a7(818BJS(VTle(=;X=4qn&aq|^#NJZcET>&a_BN=izW$Y;d8 z_%LbbPmc-HG-ec9^TbJih49m0^XXVpbs4Q|!F&9+K?w{?Q|}5Ox3?=HxH}Ig%Cl+5 znr94M$vIj#uux5C|2(OIzHMtg;Ut4qvkb9o9c+4*8LFBVAjhS%Tw!z2gz}0k0Ln$t zO8qP>ubO*4Ur@W`8z$~Zx|XH^Wy40Vc6|H6W9kb{{eYbo@zhZs6<^W{wz0muvbk6t zwvU-^t+1S?+Dh7vR`wm@^ZO6{#KOcs^H}SLnXph&e{5wv#M0FXGR-mnSB_;k8Rb=E zn(wJ1*yOzI>gD@%7*QG+6}Co8)=f_qQd{muUVL~zL&TJx7@ZBEFltp02nCD$#e>3@ z*0xS-$GI!Sx$s&_VKz={?dssBwst9i{0VN*J$!;s5p~~rtlGwEI@^{3Hs2pQeITQY z;?#~-FnDa4OX;WA8kIctuH>ecIvP0-UVp#h_i48fJUrP4>3H85N1&YxYL|Np|JI)8)pO^iwhw*wm=L(~?@LOAlb9SWufp)1WBgR$N+9O(sutUW8Raa<(l? zUV%xO;Y05nzJV&xosd`EL_wf8%1f&11$G?`+jz*Keebq0fZ-mn1+DgzFBIOAtx+=? z#;*S>z4p_`grs+mSnSQ!&EFK@C$IJorbpYqO?Q7=AJ42|S(P>E3QJyRQcusjGFWtX z)&F;`+97a#xGQY2<{Bg5=armYtnfU_V(hqGIR6HZ6as!bQ{nY?U}WM_Z?sbPR!eU7 zJUWYWzBDAdh?r^EC`aEY#r`xeF(A{!3Q*sZ-|>CZIJwxKPk&8;B~g?(&8y%T^$jI1 zrjX?9<$faEH53GLv7ZtjJr}@~s0Wy=NM>x{uTIeOvvgUBhdIGK0=$e=r z#@>Z2d`7g{a;(3X{Exc=#*WTzD7185urCN_9P={6T`LYD$AE&Ujq`~|Ark11_x9?B zqF0}_TVoD5LCI%K@8v^5n|u-;#f*aH8*{qOBkEgiWQKsMnQEa2V+_pHWkyZ}bLkAO`G{{vN1r#pkBBJhaL$;DhN#IB4;tU=7M^wILnO|8y)o8et*v{aT`ec;{Bo^G%Nhiqrpo zMS6y;%y;p5q12A280*r}9*YV7tRzZ%ioBjO$xxf0eY*V;uAPe1A;=Q$m5W19;Q`jp z6moF9Fm4bk_gzFRYPmjFFg?V+;C<~q>yGU^Ry-BKO2K))_oD>4_Z6ml`k4cu<{jrP zvJ-#XxU54BLaxKlmN`0X?^|d~wcu0bH;WqDgRA5gg++T?9X=Y%SrHm~G5u{f0pz$i zxhHVd&B|F3IpQN+slFqOSOI}~VCBEvZ)cv+Jx3s$-(Xv;BN);_>rbLx)BgHw>ur4i z{vvaUKZNla5;EwnOicHEkwyOXM|YWR{`oT8If3!z9g{5rsYiV(7kmTY7Y*h%k_L34 z09kT=f+&#`N%v`6Yl`HTm8E+mhb@*{DBUY|0R2H{4r-tP=x-lXCxcZ8P;XCJFpBCO z_Fil}9obf1&bFxdcLX3JtZB{@8eAu1i`jMy(OW#Zdrv+$H`~+*V(LR!XEN(UX}@Zu z39wBR`88>zZSds$>|2zFd?;@sbnw#?yIKrBD)S^&v`Lq&wz|fGPn(0?It=_(H|DF0 zHszsbgX%;ojjZ3AA?T69YlH&Tz!aK9>iuQ>IPn5bl7$u5Nmvo%YI~gCt;`m?Ca3oB z>=W&UbUz8BI4k<23q~xrYP}N8tN$$=tEUkaKUsH*1A;H6CiNPCrtjiw(;udKil^vuJ9W4RgU|l z4NX1RrV@4rQGtwJBqN65JDE>y^YBPSgUPc_7pd_u_mtsJ@lVe2S=wt zE#2hleP~V5&*FAoTpEoRhqz{_#Pic?R>;FVru~rO@8(g^0YA~#XO-iivQ@3)XuF$8 z#QLH&NG8MT{*59A0PQ!7=+@tWR#=vYEA^n@qNP5%bcvE2@g? z>|D-u26$LPV>yEf zPV_&V#`U8lKOW~N+g!f#H5aLRy?@XoOrdA@(QjSq=vl^<6k~=nIWB$AY#4vKzo%7X z_CwLynGPE=mP3QNK*c^v3;4ns>KU**b!xr?2z9}}{t{27q?lArDT$JJB@fziXUmUEj zKi_O|RfKkTUTq(4zI;_WzEfrg__if#xUaX!{3V++Ka&$x>xh6p3t+FET=AI!orfij z@0W?+F&tKBB+dE)EE&-bz4qol+Ecp6GR)N45;m4ljY(UX4K*|s^7KZ-udSwPv$np~ zqpg7K;+$OtlO&jx^RooZqekOJ{PnT?Ggbe$7|BnD)bP zPL_KKhVp^-2g5QZ@kQ&ns@b^g$3wclr3$fjeWG9Y_U&ZzN>0$1=xoTRc>7p-``5`9 zagE!Yr(!=}Ot%TU?uG%?cq2WGb8|UPYJ*95PER&NWf~j(hu@0*{{FXy3V6-IM>Jsf zJ~KgRna+il9eXu41}z=*f5_+@+<&-=(e9}m&26W7KU4z&v$34qWN81jqb7=Qn9>OhiI_2}Cw2@YZS0)C%7bt3TJ7e1t zP!6uJ)iHHH8FyAxu1EG}LWzYPcSBFXD+%cD289VPw*fBK3&e+34&!#EZnNwL^2khf z$OLAGuf}M4L|gt$+j=(+8Bd$;kfZ%sVN$kZ`xpnZb~Ia=skpRE!nfH*;y;SuDBEHR zWEBt7>WrR%na>;*rT6yM&1q77n^8GFyaLUpBvs4T{qtW?k>xl#b4shiNHx`dUinC+ z>pC}PG?GYQt?~5I0AeiG^?e9kli6=R@C@@9$zmLYwO~BGj+gF{&2kB28y)QvN1zy4aV{_xxX1!C>4Ovb&7)ZOa+1=JYevA#~eijfq~B{qb2~I%*0l zVCwra$&3|fsgvQK30Eesr@POS_O;3)&zRgDkI5TdJgQ9sx7!SbV|hFMtN;!iIir$! zwUn$Hg>DOd;xgVAtbTQU%W)o~fr+dtP{NOv$!Sc#{xqAtYEP3Cr}N6{EG?>2zo=km zo#c`icc4U((%Il~-5I|<3o4H{-%@oys+vAHW+|xBu$EpyLfmO!&-Zab{ZF2ht=K@- zh}Y|1!#Lm!@@-6HC_2s)=z5vnS2u37vGUOT&erE_{xtmZK~%3WQkNxK%gi3O=g$_9 zU`_d@yyvArEi?#r{gi_rT7Cxf*rO_V@8}s;Q^etZM?@vbGbf!!)ED!vBx&9PaXsj^Pzr&<@f*o$|XvCBT? z$bC?dMJ05)0iUpU+bxUqjF48)UfGHUA7v_tvcZLZ<#y%ZTe^4U1>Q@(1t6hi(+)iG zze7OaWhEeJdnLPPcW-U)=O3{$kP@6QlQOQT2m1>L0z)Drwweew`#dSBt|Xb22-bCf z1=_c?zVk}Is|59%(;oBf@=#GqC@=S}WTlC@tJ_6jXZNpqW3|{%3UgimG-nQ>%bHmg z4W00hIq@vKt*Ia04;+6_)&?S54oI@aZ^QvRDJQny3IMdd@{5~CSGUV=R^;*Dw|3{B z_Vq~98O}M(E6jComC)-d&6~>Tgh=jzq3bKEZ18uYsAZE|p=k)oo+}TBRIt2(#>vA} zxBzcd-_K6&J~d|vuV`t(B2;Q^XzwD_^;f7SYN&2@6%%bWW4Q*$ghyiczn{m!oR1E# zpO^+6;r_0ju9I-RZJypI6L zm@j14b|N&OWcl|CM(6>akA#&)XGtEs`rN-a;ZCnkNuVV3T-li4b58Z&-QjlBSiBfT zhl(zJOF5+PlUL-de*qQVo@b5vE6KehuI*n*-AL-4oFV@z9K{xYRhx>0Lr%Hi`lA*X zvcToH2mmwm`+En2k)iL*$o%)_RB3diJ^Vu0zq8#Fx`HOoahmQV?elZ}xU#BV5s&Uv zp4NL21~e$L=wUvyV8e^}7>uJ=7;ekfHh+cqxFN$)kzc^A-f#Oq#}b}k=X1WCB-mX_i%&A9=M_k;nJ(gCz_dC!2mL-P@MHbZRm z7On&~@rWHX*7k&?1Ub4{`D{@JCT{Zv^}geZuRdQkBW6@aCg4gD7_fTXol%-a=#SW65TU^JzxvNY~S#-*n1S6*v|)r+%DXy&onY+P=CT*gRwOsy|vHw%m`l zG7$j>xjmRWOrhg{l}4gUkDGmmhB*BpOYv+E*w&`HRzPpc}-WF+c%X3q_mIs^HYiQl7l) zp=TC^rd-f_)~aWvN>nXh8IqwGi9VGeuh3mmS8a!^L2;((;`Td~J7-X>Yqi7nl5AJ+ z((~1J@>u$3E<~;+H}V9(0_S+ij3ptc@7JuWrIPgL>S?GsX%dR=jjhJyk(}{3Z)>nr zx<$uxo?XiR3$^r+i=yT$8`Zcxp#6Xyz|?d^?~mun)mVkjT~Jdqv*F;)AG0@ydoLK6 z*PE*pO{k3^0Ud0ljmH}QKH2)&E&%|eJsz_M@4lG>?z+hfGAAd>g|`S-X!EZVN$(4 zuQji?+Ne75znD5kOBEIR@ELN{gN_Y&x>D2IJhV6!U52l`e&isYG+JpYX_si=i|9X9 zzUZE8C~J&y>MzPe*{>iuueRo?>ew(u?KF}~(T%(if}ROn`<3Vv0zod{_YnXqs6@2j z&KJg3*i|+1trQpRzxumh1$e8EKDt95{pjKhvgPN9F@W0?qE{FnHod1E(mLx=nhN6U zj-9=ne=KIhlYgc6Cq{RH$8}+lyfxa9GaDqF_I5&g4#z){glS#qollhb`V^C+hW>fj z0K?Yn;L&!c%={YC<@DgtSffd#{X^{jEkLJvMzH1v*6_-tiSo0=BNlugKH3&bK3$o% zcRPqURcyZgHS)w+Sc)>2I8IlIEBs9!K=w90*pRFa1ixP)C(yg!ri*0XB%&&&RI#Y8 z6;1Egvf69<-^P`h{c%ZL9cA;@+w0XJgxd1D8k-vQW#=&Dk%R8GV1i!R;x<8be+KMA zHyV;(e};(GrA-D)r*S>H@A(BVSuolFNt6>x0dP#6s_Eh-T3=;G4JYA)Yxl=}EIl+b z*GoFb|6wsu*&Xn~q14r~P@0loAUvD7SEd9Gbc{!PO)(IQCBLH`E~27m z8CDOQOqM!Yv7dj8OawJ7g=n2ias&u*t-`P1iS*mF8ub4R6nZ)v_sW52@wV@WM`l2vjFe_9nkZ5kbnm&`&rbsZDiC^K6e}Tz57bUkz zVa868XRBFhVg0^|Z$wzLcyWFoPC*)|r}}#ZzZjlaMz3S>`3$Lsn5%E(Y@EhWZu$U# zZbMQsB^|lHEs$hob?rr#^C3Lb%ccuBJ?Zl^X}Ov-Mfms%=k)eVWBH&k4y^~H<APwvJg>!N&%~a|!|!)D%>i0+ z%l&;KjO^|H@w<`-BGhT}&G&!plzkRG#iNyNXXR@6VxfNq8t$E+WNR-#vejEDN{H&Y z)f(FUQq@}H_6J*Azog*pA_I2YDyBVoaQ)yxNuA_Zalwac|=?lSl6vT zg_;8W8qUE>=x#d3vj|gQ$xgt{)<5%KUjoHo>WCq2oiX6<<-~|NZqvHM7EUa4a7jB5 z-jW>c*xt-!;y8y^HJzWwe!B-^LX)OA6A`6_od7MUH{LoXDYZ|=!R7wjD;bpu6Xq=f zyCI88KDrDp^hHtIP^5Tk=Ou0K{=jU|Ag=RX7GQ{Bu?}cV+j$$Y>)rXx#%J!td+~&3 z#MUT4t&m#rr?01w3W7PC)5G9{N{t+C@mLI7eOTKj+*yO+=DiuNEF1IvrN&wnuK`-I zYH(hCQS<}WtzRIRh#r8bFO@e2wnt@z=Dt(GpXuphV0UJ_ zVawF}Z<0PGj&^wTzx>qr4v2;kcLK-1;_>OOnNcT*zSaW}w^KNNMY`Hi`)T+=5doHJ z@xVnSg{2phtY+jJr|7>YX6^DtVlk}b^*(JW_lp78MD1Wut=d^V20QwA0qJmsgWC_N zQE!o99k+`{!rpE9oxq zzwbr)I03qhMh(L0g_?;SewGg0vO;RjKL(0DySY|a9?w8C1zCAKz1jYA?1#ngdSI4c z*^as%HFX(aI}RKfYz|)w)q#V1K`KVz^i9#gqGKaMP17$-+)c%~WrrB&{`LR*G03%^ zg3O_QnaP&t(fFSNylJD|HP!J0<7i>X|4%aic@St-ZK|JkMt!wo!ijLs&NV8uMnk0l zV|P_|&0fY&HV5_qYe|7V+0>j0$zU^e|}vfqbaKT(}oR*m|BF_zQVaM{s_fh<>J)8FM zW~q`~sF5)E`G~VHKIO0IG&}PzU2SSO0~*hqyXi?Bhs0%Jwg;R*11V3XwwcI>FHauKJ;A-aEDrQXwq8zBFjo$lzrs?JXvgKO)_m~}pj~<7o z`$&U$9`aelpcwX*)em!;ATyKA=PMn!Sc$PeO=4pbTq4GQCoW2UYj2kR%&nK%?+;s2 z{J9~bjC9=T>3J#ZAi((Xv!5a|waI?28=rQrzK@plm*f4U_*TiYRI)OnX+U^qWBmgr z2;+snwH&-Oh6Xm7>qyIZ)!8HAbc%HrGk@t9IR;+iTk9KQ!*J-Osk&%`Xq;-!Z!K-& zITps4aDNu-=qzY-THH$q54#qt(gi=ax8p4=O=D6*vkaJ}_){KZ@ag>%`C?~WEVQ3S z0(SLQN|-hI-&sG8Ab~#$FN#W5cmK`wJyBu8!FW0OZEw1}yAI+ECu`6KoivfhEP-^T zaFrlXQ;;2zuJFx+US;d|17{uxx-!ny*){quoecSG7PM$x7H|6YcCz+Cj**3pZ04rD z6X0#MhF((iSf*>6K=+FpLA^6SPdjZu^XGGQq_zlwdUm%KDbhc2lehsU`hNcYKZj{L z%s%KyAH}_!ijM#A{<0=2TEDM|kve=ylebs?tZW=R@=wT~!w0PVzjWtqzk0qwp76n8 zLwI!7Qv%%eQig+EvZ^u0>COO`hBf87j8$I}?zWJ$c7}4DdN#L)O@!4m&-l~iSbiLw zUE;d==!Kt9raQX)GpBH9dt~DT z1E-*ytCb_nBG_R+;60_#$8m9-z`?=;Lo{@3PY?PxVnM>YEWrxxk!qI8=kU)Nf_c<& zg%^Y5ZrvNjA2r&~-?8I-F(~T#3+XChZhMJIt9$wko9KjLOq@0|iNQYa`Wmk2t5wJo z39Ea1-QwB26K`9-x~GMz(bc?C?+)okhM)+SqzOGmklBQwwBrt91B^}~lDB!c{!IO@ zs`QTkaufR!&scAUIL|vil}LV>uAw--3`ow0-7}{TPd8EPV3N#n*R2^7HwJsKjjFg2KU6#Q_-9 z$uMoxz-S{U&|Q3U_mNyIX!CQzm!*Jc82h&6fo@hdH?z`OVl=`+c5WNoxi0}Jvnihi zTu>aXl($9-X_^eGwElYX$KJu#M0Ln0j9KPNO`pG-ti7B*-xO*u{#!Mv^m`jKVdd4Z zXBBJY-(JlkO|Ip8N(Px8cy(JOsqIWWCozbybse4XFx=S;tft+4W9s38@0G}73>1ff zW@ETog$i$DF{52N{P!c;t)uoFIqh|W+WR|lw<+*F7sh{55v(k{doOd`s?5D4;mD)} zk&Z2r;ySbhCG2xMNvK&l(RaabQi>Y-K=!rn-b0F%9-!zj>H{Rk9;|clF&lZoURxN^ zealM&cHm!466-K0*fT>2|0dY1SDdmf_(9;#e1$t{@(^5Bc{?sja z82UvV6yMZ&h@lX$>PDS_U_r6RDDwH|$QMh5!J));HxdnFxI8L8@35Eo>MC3qsjEIb zH0BuMkAC*0n_DjKh<5yq+~yOG^6lhWP<9G>eH+uEUGv)QeY*ZEV5A675kURq#1_ei zt12Sae^TM}Ykl`fGbt#vXa6aX`1;}H#cb=3Xrkzu+?;Mr_BZzq3-R-p<#b8;h_b6T zr;r)nJXcQY=!&S4muGzzw4Hy!^$BnB3WGvYA7tB`JAieMv<}B3lSsrC3UKXNc?kaRs+C( zjpXJqr>$YHt?Jf9Jf1y{^z!OVY@@gszR7uijV62kJq0CU(sxwfiWTE+FIRq>n{g4h z`*50c0U8XD6tq-vF29Y;>hvR1jnZ3l=V!Vf^4}!}AwNfbIM7h1e0W(#mlZ=NbQT&Rm z+NRWMKiPOaHBIl(8%z;tYhE%mn7xa5G-7$y*o}lWDfVmLq&MTDV~unteo(jk$I#GA zLjUjSPh0DM)PlDr7_ZlE+S=nU7a4V}Gb>I{E%V(eL;T0;<$S5W3Acc2g|^2J)o8v} zPxFkACI@%42&+wuEczoHk*f1>;g4PuPt4+=P|1ObVehPae4S8-mT?s48DF+?W751= zYnyu$^GSw!P2HVzHoYHPGC;t~eq?$DdR_RnHG)Np47p^a{V1YH`8%QXuN@|Z77m%J znUI!b3hq>sDE>$XdK4dc{w zX$=18zkS%-Pgip>4@fJXtziw#>GPwZa_5$sLA?AF*Z=(N5|swE9iE6NK=7w=>)odE z2d7rwbNY!4$^x;?Xz0dqYFA<~^1ZwB1S11d(zPi(D*T4uNK~1JCpSk(W=qSF#x=A?Nt2E58!I%TQ!EINL1ZyLx!IhB!5b~R@LKY z_jjKKg321=Hy#v{m*==^j6YU=53SJtUJ-sJ@bMwK@UhIYX z&rjWh8=C&_+0C(jX6;>6b=pvIGw~i3HL=_4Tm(U{G25OCSzBd4@>m49GIzVqe(VVT zhXc}Y47#y#m{;JYK8|7b#{6UPt~^hdyVHGu?ba8VP)zqVUh>T;_I4GA`eP4%;^!I@ zn|F^%BIF@}z-gZ(WT8Hn$ zV|sB(ICRlpgZjv`8A=mH$(txCsV z712!eN@d)x@VSA7Gh#rtErVbuEbU_fOEUD74)VG4IY*lElXfwa@4Nrga zzbaS0>8F=xUj}EUDnti!Y!Xg1|55?@o`YCzjy{lphRLgpovtFHg^f1MM(Dn+w-W-_ z;+y=+8LE7ITi=D|2zg0UMt%NhrIlF*(G~94gYK=Nq@_h#uxExB;DXdk3%36&L6j-8W`7x^W4) z-bFsSXsH3O-AHJlr93_D8z+w^63Ly|J*QWdnB_=TS*i&)nN6dH+*I9V^rL~|W`L=% zV+;$vfi0m2)2<^KSzX(0Qb*$x^Tz9Rwe<45A4@vV&1D%(#YRTFAdPeJx4Lf#EJ>x$ zZ$I)}U$i6oX6hxyr!LVC338QC7EWqAU}=F&dablu+)*EXn_iWW$LK z_+}weTE^Jqr3XPYD&l>bzQ~8$UE#t(YyV?3Z--@Q; zf`427N1~;4<<1d(R2goPc`evvSxc$HGLqFOU>L`z-;nF*l6;#SFh%s{8p2Bq5_o)6 z<22*`b!P|>J zO%k2oLYsHjf6v?PT`K>IL7ey|PqNx}sDxe=MzKuLiIbM|)_M_sxG^<3fK z_E3d|UyK6qzycNfFlD|IO#Mt4l<|80 zvBF3#>yIbDpIvFu8!GGS{-Upl7&OP4R(?nf3k15Fp>S5Q9Tb8PhpPp-95-@mAYT~T z;rvbx(OZ^Chk#W=2D|8eK#k>K$?%H$o6poZF$J4jd8(c-VLmY$rsMg;F^~S;#{Q0V zRx=!(O9F(f5C_33xBjicEJlAa<;|zh&+eC^*7iQ&C)|)~2WQ3HUBw83Uc^hV==rBt z(1+2{N$(~HvuP<5CK?li7zN;BQ3mjLmRp#kY6fZQWntP0sV5Aq~=0szgL8^LqXH;rcXUPRA&} zz^<^clb~M60ke9QeNY?~NdfoOlgoIMm3#zAU##?ImPITO6`KP4e9!#rnaa&MoW*{b`g4-7vg`fR&jua7K6_Vv zynY-WJ>XUnu{w|Pf>Aw$QpLWMnPv{sfGQEmg`xYH3&4k77MRsAB%zDdJ`jS?rF|a% z9p!?)A(9g+Tx_l$>=AO^LQF^+YgJlbLVqq)JWFBMSx#Zm%Hc-;g}@=H#_sghV0&}V zcweg7TN4!f)tUgP|D-KtEfSD(@68)|*g(x%Xu;(79Ken{yv+Iti=St%TkrLBv!r|x z*%oBlI=F@XG5*JL(@ig zw7O+H5`u(kjj0hIhMBhspz97BJ45mj$_&>dBO9!t%^ieMI4)dYhc|K?pwRp3S(0+J zxsdLg!@GcE58;R<2~AW_*Zr5dF(bqKalH(?P+0$lxKf9*#9Vg6#}rBF>hJ!7{7-}D z&1x82EeCR;cV^)Xf07dHyk6PZdF`|gP3ig1SZ^VkeOKo0cpfs$@ZEW6nQlt&^Xo?+ zZU^E{e$EOj;#{1T9#UHfPGQX$E5reNjGJU3W`(GfzXCSE2TUrj3 zr=zNu)pj%kN)9%=G-^Ae+*CMh?OME+sil*mVG6B=Uaa%j)|T0o6&gPIQ-ZJ@H%Gb0 z5kGO>uMTFjX-K{x=LoXh0Oos?TMVMP9s_b~EC`ETrnl96_o5%>71B6Y@^4a=F^Geg36?!pr}k z+p{kvA*^+(N-O<|d0?=JlHUf5dTALV@*gwUd#Kos7KbK<>_xtxu^CaK&pv65_5wO2 zXnnZ!kiuS81TuJ}In=7(j%fJw&x)uoZ@vyig=p$+?!MS7jl}hUgIVd+qgb;b zLYLI|3)6cqCVxXjR5BjB z*on0!ILVglT+H}kXc+AmtUBP2B0P9!lnx&3h``t31AIrhm-Ki_Mj!gqzn*gEMy+g> za7YHRmWP*jm-h9}B_yjS^gb>65N&R$xlhM}4M~R_`C}a{H%&Nl5tsz?>*?asatwKG z4nj;5t8HmPP{VAkB9)EcK|XR28=6F`iN)kr41pRbsU_|?~ zaOj@{{?f(jUDSbH#7j9$_Kn_l#r!36=B6VTbJm*FOJpoR2trrA2BWbn8=s*BFbJu0 zLC?d+`!%Ub%=jY##-$B^QAWAr9P;G131AR7 z)ucLlkmHzEstc{VBU0(+pm#5ZYR1O88E4Q3BM80jfb))8u8j)pUC-9m^hH~NG111- zcC>bXk16gjVqX|Rl5KU&TP-lj2&Fk2?ya&PDQnE~GAOdKzPdHcccAj#I%T#Eq&f)p zo+WS)=U4w@FWtcQP%H&+khvbRD3r*CHhR?8ik8l;lJm&ySlUaXnYU;SrED%-&c{v=ed4Vaoc4Cgrn%3&bK&3) zJX3Xf*<3u4uv8p+>AdOlAlAA5l?P&s7Ap5GU3>!hd_2i4gYGfgJFoBNIG9bNN{>~q>&4{DquqJPa5xxB3ytYzVjHXmEA9@t}D_z2G z`?HBFA0T_*agwHzCBhW1dL=1?bU3B6c`i6^llC;gdU40^7F2B9UE1WIn+antPX2S) z=Jd-F6EZV{L_of3Xj#(iZEx;w?F|YUKa813a93ojVFU%Mu;@cIOb))3RA5;71=KpA ztelwRkv^SXy0~|+Zd9!e361)|V7eEj)QoFba_fuBVWT6}*)g;Ems{vY&x^4b22NS{ zCVC3Pm`nEi|L{!5S2AkG{sr>x&srX^ks_HK+;>{Pg0iKYJ7s;En z_+l=X5G7rIQEIultqk%kJ0x;Ltsq23^EVxf@7R(-G|_HJ;{0+OOL+|XvjO1&!pMVH zFO~!Ely<=*F^_qswAqBNiVm`Mxbl-f%e*OAQ%cpT>1=?aHCHtEVU7F516DEBj)fqN zZth%DA30Y7k6W2}y})W)s|CiG1C!UnDsI^@cA&tQFEYL+Z~IeRMsTxitM0ujYkP{T zSGls02A5x}C#8R(>W|$pwUd+M4NcJfQtad3X(3H7-lzUPBy{I@5l7aJ9M)f}PSO8r zZ>eVSXn^SMdZ=|v^I#8}$G)hhe$MTGS<5q^8r<$`6$ zH|x;kSwxBnm$tkF`fF#wd$XO!lXqW&TBsz&-P5C*v!SG5Z|fK^;zp!|`4u9EH#|SN zP;aO(A^}1+Y6iDD>zN?M*Ia(o*X1R^=1*>I!H_F$wCjF8B9NI>Wep4Q*wZ#DxTd3Y z*PW>9S)3Rx+U&!7%_1e$iFn9xS zJm%Yw_A35#B!ydw61tgYz?NpkWODYeC^S6{b^KbO{?u@Qr&6CUdGx-CTr%CH3Ba~X zc1+o?!PB`Jcmal~ulnSy#K2VT%p;EAbIqhVJ(;S5+>Dbr+<*$K&fQJ%=bMFl&W$~r ztP^$EKqJg7=<$w2wUV?}bJL<26-<&>?y}7aEDXnf%U~dyB38>in9IRPx(Gw^LK$ut zah;#=bD>YG6V!q%R9B2;0EHO8RSbhW(BuD1oa${3bKllYcwOH_IZdrHfMRbBq%LDy9pXV~TMCsqu)4bDY?gEOG2=rLqCUmzV&B`{s$v)GIg`9Gc^0ynW-S zwDYZOjo0x~n%K&m&R+c@>*_6493NZJdaJde-@nghGJ7xP)il`o%?<*AGTP9Ae-2&7byF4yh#bw90+hGZ zK`PtIn2JuWbA#NZTHz}EYuF0>&@u+&sJkN>+g)&>DjC**!3PWQ)8uNOR>bgZAYB1x zR8`*W^of#4uo5;pT$A5t<9;=T^ViAm-_ODBxROkPd7l$cI9ah9LA{HG;EY8-2A~qy zHeEE&fe+ZsXT9I`ie)w4FFdNbJi$+DZQvDqRT|tl*n`7fF9$0bilqHWxz$4lL}64& z2s`GPzjGnIFx0VqQ6y{E!w?oI4UlVnzY}no7Q7Ho|0a!(s?G>?hyO2AyBpSj=`lm_ zD#oWv^gW`wk$DRJ*mA&E(LLxzNzQtRaUylp-=l7g*2ys|2Y!m5C!8L+uH_cV~Zdx8_t94`*PN3)xsb}1X(r8PH1F5SbUtSqRx^HAl!kPB$19!d@O^~mS=cIv$vsGILZZXvZaI~;= zdHS?>CoUP!p=3zR8~#>o)(F~TMXgk#T z!QxYHJp%+FXdgsmf62wh6V>mmu3D+{D+TEFl;HeGAIfC9$(T1=(yK9v25UbPlUr8Fp!BO45J~rLG{P0r*>>A$?sX5Xg zr!*Y7l0k!x(289AetXOU_GYYyS8PH-gu>5#<@5U{yhKs3(D zke|{L9hIJBX~G*3O>WN6Fsq`-`eu0Pb}$D<@h86)U~CWNmzCYT{#^D{v2I;aZwTv| z_GXufftuA6%$-dL&Q`ZL6ER{nCT-Y+0Zje}S9%sXJe$X!#%K%*re{Be}pQmlT}MSb8v!U4c)EIZ)j9UiTUpq&}hGm;XKhXR4`u41`G& z0CRNyE!6JJk$Qs2>Li*#0tZ)R;zfXbA5HiC7PC3A={n(DyN&nIhC7|3POfENDcviBiG zZg=0XZ%SRk-D6B(1Fhjx6*398qf@lz`*qm6&6FMGDBkkLu}7IxH?aj^U6bU_ZXeR9NL1Qe=iec!ac!%!ZGSnSoBJy^<%-hN`D_I8IQe|idp zih*C`{_TgQO4Oh1Ps_$hcgk%Ny4E}FhbYYB)E^79lqa69CtLz?AuQT~>i8~bcH=3*I%f4nLMrwHA*cMq| z>(|O#row?J*QI}IHF7x23w*L` zRibM$R;Ez$0OX3qqwXs!G--i!2<3Ab)dsqNt}GfE;Ni1i5*JQhK`{3fVU10bIt$m6 zpQf|z>0ZfgaDNfkgE3bK3YaR9L4cd$bjg!|n%fNdLg;_Wv`XY*++#V*-)EQ&d$J_q z6vn}D8Z}6ryxDt|YC*NW+dbi=SPJH1g7WO{?vM_Vg@oH9)$6Y7FE~F-8!pBE1faA} znFfTHJI1%-FOd($24EP(!(KU+RTI1Au8=xow2gk7xRR1Flj-4F;=-B#9;qsn#!)m! zS0a(E0(iQNf~`K}euMT4HL}JgF+=9c51dUjG(g&#r*=mJr)|SfFMHfH&csdnCD+iZ z$BXa?)P~Ew7%go~g%o2`o`!V|Nv_qU6BpQ2cY&cB-5MiR5KsTAZa#S0`tH`M6y>#r zO$;5aHo?lgBzrKCO0HF%0J@KKC!GjGx>OvEiVEnF1Q$k)t8(fX^J5)`R?m!?@HthF zF~{%Oe(eGE{vaIH*eKQY1nC$>Skl7RK5&VOk$snal)36^)qE! zh{H#jk?C86cScehC`&9&PijC*HtA}-l=rtE7+mFadKavo|AslRde}l?b_Y9?Qn(R( z>DHqU1$o{euw0-om!eB;)1aC?eP$5hqXC7kgbU9lbv=Cf^)6K=$DEi z-jE~p_3It4Q>J$OO3;nQ=*4TGak!yX3Y#FQehLY`KUFNfl_2JS2aWpaKBWDxzq5&P z9K(`NMnmZLthSb$qzJ9CVC{~j3@DkE3^XgLe&wvBjg?qU9<)&D*9m+mpF*-__ zX}{+Nik015!UQ^t9=j^bFM5?dHAb&$(keu(Z{_q68btILE|1X{5rN)FmA%^9jP+YS zc?=^DY2-)qlpp&8mTyO>Ks!(Uw1Z?HtUs8&+1}mST$4!M|4R3_a{uyR6~W%`%4sr7 z&Q_kvV5{-ffN?w+qOu)P8A%`yVOgR5{<~4S&=X~eAW$VmU#g-chjAwXGefRW`0W2` zlc6&%Grfd)n@IGcg+?i7O;|Z7dFb4`$Dfn4S6n$wBFt|eDvO{))Xh1O-7>mH&G4=n zEkEs(pl+&vfs=F9#HF`g7t#zq#4_{;el|PDl|NTY|H(Q41*uVV5$a{Yqvz#o5wJMgbk7ncH5LKF zvk%Nr=sE29mai)|RkC5K#WWX>lqTxC|nEb=90%2ztrRF z70+g>@=&>T@}2_+3fQcM*67-#yK8wjOosCyPmVUP{%-Qm5*%!wUdOaf|4|r#I<-e? zV15s^LZ>|a(dwtgT6RxZH7eq)ZpTBZtRZbA*f8nk6qKQX?aE+0V)xH&1Gqz+vSJ$c zphYH&vW$c^F^9!#D;EqGmo7O>_oGw5)@`w+%_~E5siZe&3d{~i!}y#C!ESFJ*I!E7{R}qN(+OYn|koFpFxm8=;%kRsEn!B%V{OYlF?ih4}cf0U-Q;c zADLLZod~;vqrbhi?WAi!_~z)&?KkqM8oB5r7pQ$mgZ;|McsUoEg-0{aR`Vhc8H&@7 zgcmJ3Tqzu(kg5~rXvE8R*8S`4qLMQ2JyprrOMnLIb;apIOS2l0g_bdOa@?ox@csaw z^CnUQZc`d@TKwiX*YlAIP)>)^vko4>3hTB9{PlV*`NfnkA>4v-$RDZ`6sLhG|D?o@ zxxAM!v8())AsCM-$no30wd-gL%m3!&j7{_YS|Ip*E-0ha?joH*!c4Gf_JxEhbhtPs zKuhrIETbhwP|igG6*O{&O4-*T#^Pa*{CHzGfJ)aHk0Vb@?Z8ZJ^)gI`+U91^zy}wz zGibfuZ@Z+5!6W=LL%%CQ2}GO0;5%vn&l1c3MSLU5pTxfqnby2ea6m zw*?;fRoMy?1SI8=4KJ~<70eiX7f-}4yS_aib{XeIOxOyQBmPEFVC_3X)M8DQbeudC z75q1c=aZ4t`N@Ni=iiJI^`ZZGd|DxA6dagj`f`~OigKjUfWCohzju9O)ZA+|lFO8l zp~-d_Fcuud(F%NnHB8jiqLVrTf`hiCe+d|zh^4B-vtO(Z4Xy}U6)Ll}+R%l0*D#AO zlBid*zq3XmT-}lCUxxlD>O~dWDDk{4#kXwcUT@4meE3A_?C_;95rB$HXKR&j*T^C>s~w5Kh!`-XJgrV z^4J9UH}<|fQ_kl7a1Vww0kHFj1ieQoTo6lBFTP>k8aX?YSk8A>m)(Py5X!FtEDs6o4l(Qq%36~0t%<-&ENzO-XMmnc?ne+pUfA{j=KiT-hEOgIVI~P z8_A4mrcnz1WH}3&nfpLD)zqiHZQ5P|%BqTZj+u77$k1`j19`$X@jswn`t{8n;0u2# z*^UdM(g>T^2`5kx6Dr3h{d{?>RIFS}NANhZNUEaTq|3%4KRY4~qx;^=$4q~@O3p^w zrs&Q;vjXh7#N@}R5G9#xjZu}@TzVy%7%0`r*xhWm|7`+rzy7S# z%F>azd_j>HFx5vH+1@T!VE#Ux4y#!w`885q9h{;?i*izT*7AHr7o3-y+`|#eJA%); zrCVM}5Pq>T?GPJc`u22x0WLaUhdrpt$E&hW*GtGCc2a2W#dYZZ9Ne|*nm?&E1}ik2X)K7m^n%rvkGr_+s|u!~%=J}gzL+rg{Ac=M~8She9t*J z_H7ZaDP9&A99rET#+YZJl%r5Vw0sT;a85y4GtQB3vysLLG}t|(2FKWcSg6`Q}fdEBxgc+`}teNys&bjoEFbT{0peu z0WN1@Ht zlUCMz3NI%+?}^25Co|k4aE~vGBaDhtA=j7l#YiFKCY88kfoxvhT+dOWV~zhMl3NlN zd*Cm+4O36+Eu!lBny_-zY9E3D94pA6w&dgr%APTi%dM<%|o<79A%>uGQfw6m`$6r&QJQM64KQ-%N2yG~P z$i#|I@olbOobq566+9roC1d8|?0rbl6wdM0sek6ZEDaC=G<9UCi&UR!0cY-x7P411 z16dQfiI4o;gDvg7-Agwaigxz;_2ji`Zw{!4+PF^7ZMVI>{e=xnvQ3riqP*yyrVNV! zdBRw(L?KXM@i1&NX$1Q?qr2u=$M`8bbqEA+)yXK?G}D`zz+b96S_^TW5> z@I_Rtao+Y0MA{QNicA)T_gYk6I#1RmR^3Ip#2MtKIitS;!-Y#z@p-htf8)x$W&?eV zIxkHl|6w9ab;5BOm5Q58acDkWzU{)tOwvZ(M*7j!Y&Lj6fPP3QpyXAg{OypyXoa^z z_$9v?W9;tYgt$3)wz%4tI-hU{}wA+MuAQs$}7XpRy3$n8`XJ8y_R(u9|$=*xV zq;kgsw~i)ldF?1D+~Tt)A(m90CNOT_TBgYm-!6lz=GN@%i5;+Y_O52})~QY{+A3iZ zalX~?>8L02C z8`b9BIca)5ELeR|GI^w1zD-S>%)uyY7+rdrIREz&n~md%Y1DB-Kdba$`TV&D>oROu zadEzj!r?I#kZ|y!#hd46!D3o2v)zF#7OHaM0A2GrU!5pKvYN>zVsx=6kG61n#XtLAX>{~K9B*)-o7howb~e`CT2NNc^q;u zKSgEd!xYw+C%Z9Sne0#hl*aT@G$sFBN=fm5sbt!e%bW&!h06}vN0uEc0!yZa$KBY{f%xdIAAnrHY z70LbPb}1zV7CuK2Iiv*Af?(lOn<`g-xqr1py=OsI1PuSr@t6N|T`7ubxyXP;nZCHL z&_enA84xk|K0dK&ggeTI841XL_Kz((_2TRu%`-mrIW|CaX{32I8v5`#z?zjaFW6Yv zuKiv0FK{kua-*Zc2RPUuhPF&ApBXfwunXBYK|p5O$0(MzVnMeV58+q4wibBKk}_BJ zc81{X!^e=F7<^7>i6Qo-5}))b{1JE5(CIsmK2=CZo4(hC%cO`hhx?RAh*m!VF&~ zmA^Og_*w^c*W&QbzaT3o(9yOsKv#P~IgHYs3Q*QngPC7SbkFN0PBPFr0$J?7)raEN z@Jo4z@FL?1d=k;Poourlm7UDFF74IJ^gP2RXPY;NkkAcGym5XPgFSJhip_!N^+qp& zPnKE$-CG0zChq_dJWu^Q8Fu!Xp4LCqw{zoPus78wQljv0m7*CF0W2b~_5~r|nlC4{ zPBppodTKbytIak^m<2rGgm{4vc5u5=somkker2@}V` z883yrEGW2$&tq0=+B3zT5b^d~qfH?c>!RW!ICb>`@KsJoj!hl+6BR5H9imr07S7Hr zJfSWSpW@`{wzQvYqv12{Ajuo548U&gn@pyt-m(OlF%i!RxCp4zuLC za&^iV#bL{tRe~#?O|}bAdFAx;Y>?+cRA=Y|dssaV?*k;KHKmf9A!l+9|Ba5N5 zC>!6depT+rw&$Q;iUTNR+*+CXiO8r!d~hOHy6zCRpRKxoSz5DXP}B;bgt>d?JqIQs zoXUc1Y{w37nN`XtAr!XpJ5z;*l5=Y}T9C2ofVX2^s;N~XW+lh*mWpaH;`3mv(S~`r zHCp7uJbLK%lJ83d?r**=9XU&VijFO$D^I6REC5(-(y%X0XMA(iU67&RhwXXxt;8kJ z%S#_86JReb5anZ^;{Wq5t8xMWPkqkT>Yx|K{G~6wr(kMo|z*=nzWxBzTi&d zINJ>~A+#l2pmWW}tNt&FC1^eG?AL3RObW@-Z=auoFg?`Z2c&M!l3;W7Re>ay?V$_BWKvhAXVz zp0}w!R2tbz7j1iS;95A0mApykiHTpr0w_2@7jh8);#`2hUP?WN*VuH?rFjvS$M#g# z{?hi^>PE>5uUW$K{Ep6w>qq(~`*kg%icDuy;4Yo%SeueOhIrr9E%zjb*y7uB>>HM7 z6KEpgPdeXxb%(7pNCJ>lE-HmRi#AnqvBrO;oo72t6Ph*2^T;Q8ABpAkvsx=tgjCFJ z(F#|d2ANv{w`e4ZX_7FD(Nt6qa`EQ;1A5NST~F_&bTTE@9Drw}{p@u9Pj@_9+Qvor zoXY63?BR5E($bXfGQ9i!H!q`0CGV4%8v_3xoFxv!yqeN!VG9ARHYp~ELZ8;8Ft0wB zGLnJlO2C}FRgRkddwBMdBJcFX%qL|rm8Z})deu_ur;#GC^UYm6lCB2~=E>t^d6hm& z2UB~h&N6T?4TlK_ePfmubjCBMG;@Cl;J|cEH3j0PVm&BSwdpV!x^TdHxs2b!Vc(yB zDw?U4zwD3W;EED`!9eIHiM2?95;Y=bvn4H^q}(uY>?bc9;SeQv`SnLPh()nI|G={0 zYOqM!2};Y(reesRh_Fs{DvcH{jvDf)7O(R|+Sb9~pf2aJn>A zcw%E`wJ==^Ou;xKhj&D;=~LE0iO7($F>#g=_19HZF3)PZ|1-oQ>!;7iq+N{Fl0*D z9Sl@p8--j^XQcOV(Fz-eL6~tMt?Ml=97do!qE1IlkZ% zgQ?_|{ex-$xX>A_om%oKx9P40XaD};4sd*sb%Zq{3YX=&?~5l-p7DOR4`$sGmMGJr z6YWR^N6C@K+GE{vpuiQhdfkd{92$gaR2S~#t-F3M_197(HYhGmX8CP6AFEU2Ub$>C zNexvF8JM?6^H@YC+0%}T#r~Q+w2q^Fl=4^vTyljqa!vsShLQ*FRqB-6`MN`vRy20* zVB*Aq(NEi0xc}5Cz&u6Z(Gb=Wn>nk{*JEX|iMjK4^JMBd&~@yrT)Dp&x;bas+h-8W zbXXsepXPuV2b)$8Kb~eWDDM&WI7$*ROHIkyy#V;ZUFsS8ANi6|;$8+C)Iklt)V1vJ z2m>vo+u0GAGYi`cSG0X>%z@Uv{NPLElS+8tq1jg@qW|+&usQOFu8ASU`l3hPhh+TV zNN)ykNU^8XIU}h93_?Xuo5Nh=6{Z1Z$jHwf}n(%sEBE=!SOS|HjiJG+Okwu@(&Q1wD@fZvkcyu7hR+pJH( zX0HyYo_-usnbZ8ziktH#245j(co50LVb640^cc@Mhwc1&AA)UG`pQmuNrjaNYNs`X z@L63)ahDj^1oy%@@hkgidi7@hAHaI4$#MZv(32P-q4(n zs&Q$C0sNg?U}oXk`*bu~q$=&d1c5g~+9 zS!Ty-;6%kV;F{)0N~%Z+dW`Z?RDARFG8KK>vGIL0B@2*KmflTe%Ie-1d1TY3u1XIh zZEx%|YW;?bWI5lU=e?PKoPVl*L-y`xMMX+C+2(ulTa|)xfXwn>JlET^!5<2yt;vM^ z7%{W??j~Ef08e7Z?D0ZkRLVfPfN!85Bq&_tM5eSQ0&dT~U7o+6>yaxZVEl0sU3YAl z;S=mNtB{!HJ0NOB>=x`oQltG9`(<};w(uc=t9waC$orXJ zY&cdeGA#i}Lz43O$;BtWQ~Snog}XMhw8r=a$N~ff6*#U&s*8w-wZBeshxS5r>2(=o z*!0`;j|!{nrk5fd-|5SK(w``67VGZnq{2XLvU4i%Tn-ux?w=TiE6N)%IT=*wNx5H+ zW0@z7WMJ6>3-67xt;Ar-Qnn~M^W#ExZol|V(J1FPwa1M;`^^C_9EQT}bJNEXl!2;r z0>@$ZRbEQH;ol~&rppe=`HkN}__{+MHd=XcWj72oE_ZP@t^0c) zx&T_%IQ-k|n=Vd)rpjL_bzl9)uz!iEFEm!cyfKL5TUpii#>UP6xvse-dAcIv4?SdS z_tk27<|C(~#Ckq}aXxdQ8;{4Av8$yXtbTcWP9@!2oQ79Ij}+m+l{x!M+3rKXv45$$ zt}cI!@DZ;OBrc0rabW*M)n$>2#Y?6;zfAV2la^KpuBG#xvM?uK?&8$!Ob(M5zp+7N zIgBi#!N8#;v=+Be*0s2s+oNwrg2+e0r-+K$T>cb{dpBatAB3jr23LeyG+^vFNg@x&=rpnCU_YTV)IXObRUNwb;>V;@J% z$*kfQy)QNTU0cjM!9S~$`T#p#-TL%nib=sC++1Nu71WEbY<|4~T3PHc>14N*B`VV- z#m&tN6hYK`y0NLd`>U;kKT+j&R@U|gG&R#nai&FeUU2w%lMAweq&@7U*cM(dLB)Om z0~3c8eq!d7v>rtR9H!ZEFx(hgtyv*Sp{3M`AY2+d)f8Ch(31>|2N82CaAV$b`j!`U zRVoko7Qz8W)A&bJ?7T=R9|~!OJ%+*@+vCB{?SQa_8`QHej#vzC7DNfB*p}N*X>d)`0Smj5God7<|qOcjP07FOL(aeu_M%);mt`XTJTbn6LxwHUU zv_{=2h<-zz7$sdgq6QNF&h*v^%+c{!%C0GwE2v+ghhpplp) zZCwLQaX%EGDkpGF8=>6PoFUXYRYPLseU->#Wi>?kuBmi&A``ONk$%hwigx__FTJPi z$q5XO!*{-P_9+C8Zx2G<8PcapF<45++^MrE*Gl3A?mhDxd*vN(Wbj_(W;6Sxsay4s za2nrxWE7X-Jd@*Ufj=7PDgNnl>bT|dEPnnnn_oO=g$Evtu>uyh^Dl&Em0|)G@5}w< z6Uos8BN(`yKJ$@tXZ4EY`+D|GjclxY3^;$LB^+gsGE>fqaAEJ$uu=>DeTzs$9pzj1phFy##Bohv zF^z`Z8iHZMBxw#3&dM%CH0LXt;UA;$>}DeoD*z_2cNCFvHjF8g#xXLWVb0({MCQ() z`dX^dS03R=?Y>+$pj38Ve?S zOlsF00jz$=_zsBjgb-R#P@FLCz_wP75FNtL(p^ao`66xKDNwaEK0v}c zRN2BT5mL#X4|E=5DnFs=9;?%V;f8zew6O%D8HCqvh}w43(uJ!UV^M$SRRKNsFqS;9 zaPT#2Gd^c5I&RJvZ`rA}`z{GtxKm~^o)$Z>8J5gVUMI>Ilr@y68-|3xdy^`N{rxx% z|1M5clDMyb0aO?StQw_G@2(@fv>!PV_^zKY0JCo&(Zza|3tl)~_2uh31W4Z8+g^9Q z4$aq`v{g@uPi_;=wzs#(gNv9eVzHshzGJI|`n`>iD!RMxKb`R?!V|li$C|hFCU-}C zt7yYrHRr<9?}-BSl2n;mpX*?MH_V6M+0zF^P|d!sn}hKU!s<7R3!BcV0bLeWyp|}h z&oSe?rXg zYTl`(D(g2;Y7ho;I9Pj%7|XZ4pi6sG05@u9UyTNy@>J!)lj?^mRrP#wvMhO`O9$;0 z5{Q)1?&U_;?X_G&Hcurr!i@z<^6C>;|A4%|Np_rCqE-|`^~G}dp*u-f8WUSZA% z|B8q~%kToJF4pNzHT@|oQv&sxolw8g?+gBAmnB>nh#4N3$+Ew~d1&iWt7k3ZfO1At zIIo&dw#bDdB;T5CY%=+zlx0h5CQJ}6^v~ZXZX*Tw! z+q;4>m*)=_kx4uR8Fi?P<}E!larJ1>xc?M zAH_rp&G?;gL3?@CgADMs>a8jyyk^DWS;b5o*Au^OiJw}dpLN4C)(Y6r_ZYubBzeuJ z@kJx^mg1#1;ZBRCFUx=VHJdI;&5A`?E472}?YF!pqu2>7(06Q$BB?JTCCdRR6A@wv z5bw#P&H^WhU8x~ol@o2Nv$2Y9e^rRO zT8bI~O3NZ$4+YNH!~x2_QxY_+SS@6?`*QVN2I7{qB=6`gA0$FQiP!5~tO8;LD_mgG zjhK0!S~DL->EHYH3x+g=w+y7N=-_Z z&wf9sJG(&GNja+GPWDg?9#_Iu7!(q> z<7>>>5}lH0TCv7~#hmQf?GIvX1XZwpP$@KTEya2lJ}(6!gu$=Ec&l@RFu})? z8<5@|_aKL{s%g2>_Gb$ucd7I#Vuj&mR!g$v)~&@83-QvNm1!iI(g{H`3ziuxZv}5X zZNO=YR?Cq1e0wQCL9$M3(~GmS?0toEm|1KXfT)XGA#45E)>f0oh zU)XBp>Q0ogEZss79pl+>_E;iyKiBe+Pm#kn0rbC(In->y^a-G%Zc!ZVgY)G$Zqj+et7`Z(BlSa=f#40 z&5toE<50BnYSZIS>5X)g90m7CV-`&@8D(>sLD#u3|40HVn*!mfeXv;FO%hEj+2Q<= zAJIjg-^L?Bl^I7krGd|ID7y@fHB`L$aw_buAo%4ZCpRU(iYIb0)a%(N%7RRQ92a7~ z2y>sU?O7`_UQgs55BZZrE;?3DR4nZjAxm{l>FuSXX99g<$?bO@T~yD(tAi4VKG0b` zt4Hh}<=47<*z#-V=6js%=<7NG8D~uctqY&_1PGAE|5yTYr>Ch;!@SLGQUCYHQlfTcbX zHcaxTRLwAROCY)OOrNocBbNg@}Anu)%$#Bi-xTRx=QQQOS+e&(RIQaZd@1LM1NnCh7Zu$Sa~TjwKJW}HeRo7E^TkDZN3s^o$+-(OI7-I zcB0~;=s#P>r@020#@%0C%ZtbeWM3R^E=Bq}zr&LKn!3mGR9IjUFT>~0^-cYo&rN3f zvmJys#KAwkiuJ;>XGI5gQkCcZoJbb38YLnuHmTD-E*4bV)0||m$(g=Dna1hI(mo-8ye zj1d4mlws`5aB%gFS#F%YE#;;on8(#4k~p^aT={c(t(359S^t}JWhzQLt!jH?TMl|=J$XOMK}aG z)M0Z&iK@*z25=}L>ET_{VvF-v!Zp=kYW!QKbo_JBuNF;X1DpYGh!rsJ<%-HIuohGJ zF0cFuGE%C`MHMs$V&z=+TYCi|9QNO*uq~T+G0t#(qhB3Nd^gb+4a1~_SYc@!NEFw` zOA8b?Lj^}m_wOQm+nqxo18LIT--RWo5*X_+`yigF_({ci$Q)rYDs}PYy8YmF9_jcJ z`*Su{G-^`*VXE;h-+oJ71obM<%B=SL6Y;!0_g|CtT53j7JdFBb6ZB9uU(ONQ*jd{0 zWfkLsxx~)0JkJ*KsT1qi5?W4uA}Pdl4BW%D{g*pyhr3(9&o(!dn`ld5Un}y38h1R( z2nA^T96)XJ_EYM*GRQXqIIQ8sa%`O&|4@r4MW^oy<*&@Q%vTcN;K3RUMe1aa+S z6dyg!qEI>Elc-w$dVD+9HRMw<%zocg$0TLWO9jL>P5DX@g~nEIFZdmZSR_)x8q9=g zB$M?f^b))L2^d(<0pKJly2QKEW^Q&LQTJjJw_fHiSQyQDxv*_wqj-iN1iQz`E8?h;?U z@*Rd}>M9`(`(r&EyUdC*(@#j@Ld99V#fZMRoy^vV`W#z>zkF>ng?&Hf;}3cGEXEm;<_ z;Xa7gi_{247Zu(ILynVg`?3A9n*#rjZ0J-6ah|R~IFhRCRxl)n>U2+oiNfJ(dp$+s zcDGmiZA-uCzY)=!=seR`2fMYQdmAD$7Lj$%sJ97+muO#x0W2bxgpN}AeE@(NIB)=Z z%P9hGw#z{;-1XIs?UFQ*XlVQ5scawXezw;?An2U@S2lY81SCnx#$;MHmX89k7-;-8 zRu~tjAVYeWgBPniB>q214ME$dBq80IWiN4~K~fWYOEr$}gx4SnHDs(gXU-nm$z|s! zyXKp3*#}{NT96bmGH_S=x3hxeOMzAT_=2U#1BJ$J-JV_lul5M0SyNmJJxXs{WvY;o zilcR}KH|aobM{wG)n6`SSh%H_u4yf+T78asJ9~_YQ#Se7u;XE}V5E4Ywsn7Qqysk& ztcyVvk@J_;3B0tpW4#nRd=^F2hMT4bUFP1~90;a#PZp&lLsb2pc|jl%b;_$NcxSDK z_fE-Qr%TP2yEr1H*PslaAL;Q)b6Zcf-%(4IsC1nnj#J`$snJm-gk?nFS*+<{41zh} ziDb!){={Q&IF_)j_lo^n+miL+W!R6~iuG;@ZRCPO4AOF{QYgH?4{Jwp*+dR>pvs0> zm~7IBPlg}2689p;bv~hQYLl-UB&v@^N~CIkOJHa;y1Ont{6Y)?RvDGqq6>BBp$a&c z_^}MFuK6EDQL}$*;pZj*$@zd*Ux7(+k?)TYahtYWbMwoK|JC2h#$}kbVidvr`u!0| zZNI}4T@VPn%HiQa)om1sS_}Z{AJUU}dJ06hnTi|4#GcIsTAW{t77kvjEdrp&w`C0x zqAZ@#P0q<4V?$uJ`^UX+SS(X}FP6>iM?)Z2KmCm{ zi2YQ_km6$1L~lsgcL17C(dfKRQngcC#|pEEb3o7DUca*?`pY{eEYTOQ_H5a!+Mf_9 zo4B#V!}vA<&Axj?{T-Hyy4I>sUDaxez*@U&)6F9o=e*+mTxYBZMAZK*1db~G2VIhZ zK^nj*LD){pl3wGq`8@ITn9w$32<^?3YP+O-p91sK^P~CA$@!9oN_1+9KD)dX3POavJ^wgY;EqQ8L$d-_Ywm}+n9>JREPMYHDzPZj3q&3SgkS{eLD#F_ z*|NPJP@-WbHY8E(gF>+$ViuqeRxS0!7I}9jleBoogd$uqLQzgQM)u%LR!m#(_h)`X z05Wn~92x|XQ1v4`@;CM(P0~e!UqNOTAJSWnj>&WbRCG(}vZDhOSx`+%-VRYPy)54vg!YhJF z*Tl5}YMsnwI78CwWGGOXwJO|uHFH#PtjD{m5ba#|HyqNPm6hOo0{j$-e+NIbw@Q~G zH1+VUrhZ59cHv=SlK@$K)|(@tuR*Cq4iGk7K0zhYxihCreUJ71S9=~r=2_@%AvBII zFL0~GsENC@-U%S~sCl8wkq+zR%>JRx$Pv()7$N8A70wld}(@H~sEEf0@??N-v&qR37rX{0Intw2D`ZJm}=Yw zqTOGC2{y0%VfaV?+_}6#V0llN32A91*o}PzxW@1h@`*3d7#r?djSUU|-e+)Gig#!2 zg(J=ctA~kyXN?vMBrZg=7LK;IOd!Zd1D!B})mE)6EQys4EcAfiaDgfKrW&Sw+!7xU zbicy9(;ZPmJX)9m`vDObDR3_gh-2m3%NiJ@9QlN01;{8QwXsW~P+oTGU3 z2*=6qV*EB~rP_UekTf_7J^>w+Qa6|k1CW1LkxFOWS= zmAa~4v!AGTf2;zdnWfO^Uo961i6Y}uyX?v*!&8-2*>B6Te1dn?r z;m+g2BQ><3N^Np^jYih|l)`WEqYg|b{Q+uXHO>;ni&W_&r8Rhh@i36Yc#JcKN1a!b zK2rj6Zc#2w!Wk2xn46gg%*D_}_>>Pg0E5(^cLRmku4BeP5gutRfwYw&5v?puOO;6u zosGABD?N`9^i!*F`ma8^pj*{TzYjpC;$1grdyuTg<~ZG6G-^B*plGV{E~@gzKzwqf z6!{Q#3jA)%Z9xn|i)?X(BQ zp#MT12g!s6R{XjW5^fWHQch|2B5x_T9B_tPbhkAamWKUYLVuM3?NI$bN`U@0hXIcV%7Sk_?a z{1~JUEn!9Uv(CRl1DTm5|*6?n##i28qd?4nPa2QJb+p+{I_qNi&jkDv$q__i|o z8#2keFS{^!lePfF|4s5nndB#2lYqHEE_aOZ<5WAlHNk?ANqjWx)dWIYV5@_w{~gEO zFOyuc(+go*gHq`A7USWnON}rXBWEYS2j!#+<+oTnfYp)XPPAlLGKIuuZtl(%&8mA? z?8)=I<`O^7b$yZ3ZcfxH3rSZAPjjAhVHqwS0p1UhvWJrzV6I$$dE3-!0`y_qG;S zW!P#d<%s{VSbxW;lEa&3qUWVK_O3oE%RCgWG*>d@50d zyM-PBqS!+;F7%AI)WE=<`R&kdUduXX7|Y}GqQFN@pJbvT?W>>byqsL$UKN2YoWiPI z`S<$9P~g8VKSCFe!qu+K*%}xzhp%S4MjSmU?0h=M?auZsc>^V4dD5s55}Vjf%NI9} zVYA{6?Vz4~Gv?|Hf@Czx!;T=dlXFOi6-LfbfT`6x;Hze1y}z}y;EFc50Bv6UGi`C1 z?Oqw@%5ODlPrFe+Y_ra=CsiuJB@2N?CWR@q)}{MQpiTTwcKY$nNSP0>L9VOaUz;OD zQWXO3b!FT19q%+W6d8+0fAqS~7fgosHG3ooSyp*pOU}3$w3^;LlQpdGY*9g>`x{vc zy{8yK_f;Vs$KLmWC3zTB{<$_MWU z82#;a=MeQ>F3MFcK-(fQ;@Cw+txQF$t}pLylUvT?N!rgm(B)qZ8cwDhH%ZR|J#_!* z!WD~&$Wn08W~0XdH}_dt!X!9`nj6}yJK%%Vwx3^rnQQd>wz_apMd>@#>mbFzDMW5U zn$R*Gd;F?Xa2+{9f|R;jIm?gno5*XaGR?2660^I~(&m{W4T|9B=0K0Og(9<^Ato00 z;1Kwu(3u$J<>wDAZA6KWVk*x;KlO;Gu zE__~6KUGbKkR>lF;6pF8_xN$iAW-j?z+YgN4Py=p+)q^A7r^LbZ@iq9ndshfNr0%D z4hz9z;9dzv#sFwmYY8#m%+D&D`$xPFDpe_57bd9|k#P2ogZh?^57b?fzz%Gt1=?iO zngW2x`*M{|K0P@9(zlAde32arS=*BYQONL;fG9A=Mkf{j)B>4r*`T9Q4ub30y8CS3 znLJN(S^a#)RwT&j9Mi4lar-%x>o0d_2X;oc4w(w(wk**8v`m(zFBA9+J407=d1Om5 zZpsp+|7Q_mVWy`A0VuJg;2nG+ea`DOpdK)f+k9^F1KX$)j+mk`CW76?$%w1HH$S%1 z^F!x5nDhKw`kf>OBfSqYGZd=vx;CjFe@N}i!QK+7yYBSi7?ay4-@eV&6=_@hY0~{| z`r@;;gc}=uadS71`#HOHVthpe!FyEtiklbXl~9V zXJ?rAda;eofeOchU|QP6Sv#ux_`{Eiq)Z^c(?VDy5rdv$~tX26Vg?f}92IuJ;8YccumBIoN+vsCLiM$#0KFXDMKZ)BImTmBi}tO9%Ai z%55b*E?E0N;+pp^&KXx|De&aQnb=10+p>S^_(ZmL_cyea**4LNrrz(h?Z@1W-HTX3 z5l@NJm)E>j$p5H1e_57H#hze=;`aAm|JP)}lwN1_> z%UCwSdiCMoD<@#m&J?I-QJj@6l0cwsT>`3__$@4c;b8ez_$|eL;)u^qKgXa$SLM_( z3%o|x{xJu+S7-0#=3Nkv@bPiam?#DDmhX^_ydyh+*;z*sZI%7BW6ALE=GxP~mr;p#`^H_R$#on{dy z<|CO3vF%{vLrpDDd>mJJa`o{xctLmIu>72S?%06R7+6U0>$JcPE8v4o?Jr!>^ZD)j zGVotC+Cukwmol$O)XzJr*7I137odi`Kl=;o1S38kLLmD7Fadu@`SZWY=7v(=Y;T2DN~KOdarGH0VjA(kQz7@)?>-a5V~1{?kRMm+nnVs}le7MQ zA%r0Rao6gsKEd2p^;p;4y|w-6!S4R#^=x+E14Bmw z-<6|!%us0aq1Y#+aT>k)C61`PYE?K?lUlB$gHsWkFQVE;*hhpOLueIa)k^$Wpl;6r~LI`v-KV+DChH%q+Eu%=mWgJUF@20|Lb$&F^E1{93P)>zA52K#Qr zWxM1s>EL{Lv&+T<|6GXX@6FDb+4DuSN#QMrMF`57?+EwTDaf%d&Doeg?>koph~@z3U_7!GPH z*<1%FcZ<0k>Cd4*WQ>6A=^w_CrHOs%mzJ>aKh|NYHk_Y4*nib0B<^1zRA#$cckfsY zC9N4}#oDdBT0T1nCFRH6M?zzo$2H6&?wG_5fnix_lBQ`qsKEf(j@=41`PdKq^n$q=c2NES_2f5>8V44MzWC6*>F)1(! zw$JJdZh6BsYM%0Axdk3{Q9Fc8dd0hEA&Ai1MxEQ1IuflU1vDeULoqK>?yb8wW1BT$ zap3%#3tlzZWd33AQQ>{*+X_RhB(W5W?JT|8O4Yf4gd+1bHs4TsRD_FoO^|r9TY!iF z{52Z-ONhveYI>_mj_%=Z?$KoH#ghdE##!lb>_6-ByT za`6vi1t&1$4NRDJVmC1S>V`Z9$}yj}*Vd<%^v8r76o2(WBT~Sww+jAC3vBDUxyedQl9u)z*d>>fiA%gd71@z9O=tq*q z&kExHoF`XEU-7hRJh}e%(LPGGo!555*E@|+%4Ct>U1Tz0?SvF4K$0SK84cky zLtK?q$@RMYOdbz(vfsp7^3&w84ML=Q*X=Ha4t=n8aFD)Og@xv9MF((H*wBD$C5cPB z6J|*Plx1Sl-ZlYY*%SKJA!ay|MKye<+Xf{ z$iuZxv7Y^c@(pfs!Bnk9j%62$by!WNiSBfhc`OXDQEl~|WAmyRcq(4Ae4-AyplJ$R)&&iy z52Y1gAB}cD17}`=ytg)Ze{VEuMT4F*c0ZpNHAbiLjm%PMr&lKc(h#=;HMAtL8 zVPS11b#{2Py*<>jm?tQ+rWNI)&F=$=H>0NZAeL<&bmRn1UnKM_mMX-UncUt;sR;xcDsF2!?tmtq z(gl`=Ww+}{)%ZC}H+9+SOPH2vYLFG&puAWK25lVA|8q3?nhp%~M%TSMJb1Og$%FZp zf<+F6Jf+(?&zIvSsutA#e2!T7Cwgru?WJW#sq)n+UW!|#_dy(ba`y)CcgP}&2E8hS zN*=)GKMp(}T4g`%=2&@nd~|_~E-u$MPdCdKPceEhntOeHS0eA0X0ZIH7-Ti6^!lo# z)pHR_!OWP$+{eP#0B@5(T`rX8rHHDSP%O1HCKQ3Q=SKU|+_f%v zfP>E`i!f549)*WYe3S{iFQ6P-u9V1IWHn2xj^Gd)!%Xa_Iz`0pe-?>}gui$h1CXt` zCN*Fl{4o1kZc#!e?e#|)P(#QO0)_SP6M%kYY4ug*bA-EFoV26SBU3f&*?(C&-$tp0 zg}0I9kASJwb{Hl*VbGJ9bqnkvX&XMBY0~l2I#b&UrqpBBk$=d}Z&*BRU}TJ}s40@}*Y+ma53XDFno9>pi%(ANO%l z>h@XgWuBaHCu;`oC-d31uc{PfY% z(54e7Q&L6uZFb4sf>biRLyq+p9Id)j%7C}c}?TlSca6P%>5{p@F{Esh1 zDv5h>l5XF6=N8hhRD!N?4(`5)y-HvWf?L~Z$SNln(tXOje&#qGr61!>HdpEzkt!<*15OK_t3UmAUv-tJp`Q7L9=!>I4 zbEZ(7EzPr3BJjBOB~!z-_zsxl{N_c`o9@6Yo_P^P;HvCPT?!rJw|7j_3(6r;WV-mH zFh>4XO6ar$o!oih$TXV|lpao%O+fFSeM%k0pU(y--CZ zHxuyW!*z-8#9d?*Hy8K1@d0?JdwXpq@>-xv7V>A7>9rMn|LJY`f0m7OkgVm+7znTC zZ+)mn2#`K9FahTKgfqklQkfP@rm{kOl3lF{ZIBQ0TgDdS4<~Bx9YS-&1#Mqg*X<4E&)e^hzKqBFX4#%;Hlz_!L-tJuP#GE$NaC=#H-7C zcONs*W{FqAP-Fom%jcEO54Tj8;IR<*^nI`!u6LBmW$adC4?Fb5gVP7MNDOh*_Ravz zli$*$Dxu8E?Ks|uR}C|8{dALCtP0oVHcidySciU zNrrgGSun3XZ?qF-5E2pFG}BE66Fal+Iy52r^@oq0z2_ok-(PJ2f@2#Y*Oj7 z&q~c}uO1YEoipZ*A$}YSg)rw+4gN}c<>h&Agpyp=r;~lW-xj24uoIA*v3wxJQ-x_B z660+xjE>8zyNk;b0*5x2use-NKMbJ+@m;6;wVFSZ6#$Z+KdPJ*%K;iE|91E2Oze9! zK~kFQ01YE?%4x(@Nb{9%v^>c}j&Q zSj^{T=OlU@DOBR9rEx@4h~eRhV4Q?teI!pYWVYelCXKh`k*^;154FrOLE+7hyFj80 zj|PlccAfYRm^j>B2k|CKmT&a>z$&(dXcIrTRt;93izW)BJDX2 z4YMIyg`YWUl%^?Dql8vXPOx*(_07g!1%HQ&Bysg(A(a!=t{k61TjB(S*4>SV#T_#o zLd7*o-I>8E*%yfzD#IlNcX;y6;`bLui%A5c6^pBpu*Ie-?K+?U4QrKO0JEahuCuMF zaIk#~A~HGJ#VYES4te{GIrFHmps5K#L4Gtlu$G1?2^~B0L^aqUZPPGW$K*^ALt{%P zUv!jyZ{in(O)hWx#29?AuKxeq7lvq`DJFR`=UQNJO_X;{bw zVKQ8x7Gcqcl_K7^qW7I%pT?Nytyf`!&KtYesiGRMZU#M;OV2;eNv{e-Y$esnm?PUt zq3r%BQLsFU-F)Horj=6=3xZv!)XiMo6MW{okD9|`G?c)TJT`FPmH=?$P0s9-lO$o@ zaD2vS&m&%>DAYGE~I<@P;pwsSN<4q@tR zS4-)XMwGG#s)x~st?P+b8_?Tv1CNqjRSE)|wP4Vbz0E!V{2*4yPQh(n*>+dOJmWYj zJ5ee|lqgf#3xbnzU1XQ5EME@b-v^nLm8bvP;D3ugaoV6;JvFQzC2^r-mQcCNAhThb zL_E}BoNQibDmB|5RghS45d?clBr2i(46|{RB_FFv zv`CZ~Jw+I{TlVcOsZTXG= z)ZSwNOoL)9$UK7xsrQ^!e{vL9>03&_m&<99#$Q?596V2a2}GfdgVOV45PosgA6MJp z&HS@m=k(ycS8c`>+>wogB_Q>N61K8oN#C25j@qHBMoq zSN)VW0l4!O&MKypGbe`e&OGYg6hQf$@a5>;+%g^bioqzs#wtZmO7*G9^8W60bp_Pf zEqxBQTdr&?J+RJCo#qD+19lmCSC^;UL!UCxRtGwpOVuTHQ)04*m=&8u?7K4J>{ZG+ zhS2M|%+;1)_E@}ea=5xsrf_Q|mp+bBGf~NwTCGfzZ-Y|j`)+^A+vwhHAoTA?n^5B) z=vwR6r5sZ*)of0!I&#MC7QaxFi9L}z6rc@_E7-r~b8~6>3frIpl%*RN$u4LY!Tl)- zXoga|xGR%FE8d$F!Em}E25;d!I6Pt}2{>0o!K2wF;Hfpjh#&R+ zIx(NDd(~;>a`fnE32>_>0Ge2_CWRr=$S2ZINa`VuwVX0K!{rbls3oBSU&!I)TxLs#rD+|yf!=02 zI)Gv6b$Vc!D;Z$7;VNL+0yS6Wp5=?BQ(ITUI>}r_z^jhs$O7maanXgV<8l&OBHRO> zWSfr1dM?1DzMXx#y;<7tl2ct!OSOEaBVSnQ<#D=N_~=sl$Z#@CMejyq*HB)J+{=nV z3~||zvIcliQi*@!PtM<05tf#1gj>}8UvWh@eX*PIKLD#k6d+_6(f>kL#cp>e5(y7PN9 zD1ud@gcP%#mAwTM00Nt&v^6sl=`VTpX7c*-+eL|Ut2TkEKpfx4cWF<8Iv@)J()Fxm z_bX7O6q8XH)h&=E!SgjiCgwB+9>(d+7wpZKYjB*})!gQ%O{INHOAG8*e~nbMx*?f( zwzYdWRYquG!#+zA+~%rQX3ckOtEjjot#IqC#)BDM;v9~xa)?M4L>1MVf2zB$2(bD2 zVmzDRfcTc83bU^Y7+kb83W-zU$FW`Pf~u%OV-%fI<^R7(G~8X+Kx}`hC1B>g3b_wO z?4_RC3l#``rPv>%iW5Drh?t})U30WIC>k#{+>%5Vd7IrF82>y2A({n97a=Q3WmrF?(m~|+ zC%(3vWkJ(l?CIoxZ)8mte$h502W=p_lAdhO;;C1&!Tj|tl8w)-$pvU+{!?sMu*X90 zfW>#D2ulV~;Js*;*eY2;w7RF0KbQvR`C^c7b$2S(!6rGB+9wEeQ;;FQVdGOsKYSX4 z&9r=)zc1{)Ie`3teksup$OTFM=4@VR6iL?Dt*FhTnC zqzE%LwMZKEoH$a`*v?1xo zuIJD4qK_3pGFX5B)9e7_9Em8FLVG5~_=phXpkE8eXQ)w5a+#TRgPRVOXdwtBtD6xs z&V8}}O6uQDK&s|Ml~URy;xITt1KLFIg!4;7EW5lHnPV1+^SaKAg{*u&+)D?+Oyb#Bli3yx z7Z&xuy<@3hRYD6*bhAx)A`O3FFqE|2`o^J*LfPcFqdqDqn-=Sp+Ma{Dm}n2oi#Ee( zfTsM^@ZG;joDCa@R(~FimUORCm*vd^#mFj+*9goP-5X(Yt3`y5{EbF(zaot+}ZwoV^^hvb;|Mk-tX+-V6Urm3WE8J8@ zEWsyJyYy!5V5-nr|I{p+!Bg=SlO^-E5bBsSK>Y2gOrwLBtL5iGS6?_Rpzgxu`!yBP z?t9tl+&r25TgtKrvU9FVL;ad$U8Q5L<5w+W#5RR$}7$^?

    2SNJ1du=c^-oXSD@d-wK@}d3N;bN}_2%CDT z;kHBp;(=0VH8@p!Z5dg76gy7r z&G~u3k+V{05hcbo{c=NLeJBMwguIzytm3!mZcPp@yqljTxa*+Z{?$j=MOgAl5-5q2 z)>ieYpww?_f1N4;!m*QY*!MG}Y76W! zmLKUtSG7trIh(v(+d{4{_s$s&Ovh2;4kdk`{k+1eVopVTSm$1K}jh7{P9Hp~Ax-%4;k;k+3$_Yg(2}9%t?74M&gH)H7vtunQ zIEGmXRP5A#pB8SNbe=@#6b>2L*D4`%KuE}!y9X+!w42awS~&}fEmZ`ruJcm`g*eii z!yM&}{enWlV9cJ0buofG_cxExyKXXjwYjo3GlG=|{)XK(SZ>}uFX3(vnbIro z2k4ECjY{(PNONJ-t1jgGl*`!0hoeMKSxt=f?gZ{(*2IcJ+~r*G#)ecz6=b9jZCnJ7 zEp_;Ycuzq;pJ1sfA|%|S=j}&-xnNO47Tjy#$rutcj(szka$Hi=reR*?A-;X$xKsee zAOaQj$CdYF%+`d+cgZskkb*mWa&=oAlfuzJrxkCh4Qt9SYnDq?kp`)mlE-NkvLhIT zT5#@!HGiS$E*G}UO*cxxyMxySno$+`rbx8W671RyCn%QJ|NZb`xRs@m2{-6xu@1aS z2&mx^JSTlIifOK?zx{52$@O%3+D3C7C(t+kU@u+ zi#T^GhdgKXks64_HO}W7SE~LwOctXycqnx>i1`pPQi!5MU;>SSwEJcqhbnSs55xmQ zau3fof#be|$-WdTHIay{1bVIOna9OY;N`(6=1G8JwabDe6%$e9GhW^0FXx zYPgYX;+k2|F;lZcxWf<_1*Fv1ledp9b#!4UcW{d+3E^gChbf;H^Y#Lw^+TlSE|Wd;kuOiw)M)Ve7Lej3u!akxo=|#Eh}jMk_&fmxqd0p zhpz4$fLebx+1W>n_eqiM;f+Ng#kCEuJ3+EyOs2cig7EQu;B%O@#X6wQ3D>jJa0e!$`v7+<>o0e93sSJ^LupX&HmbSOW~7Qo}3|)M!#7`?m2Kf!lZ*^eWB&=b4c7p zEPnqlxB%;ly6Q`f$5hghZTr8HZI;9OSTt42!+DharmX!_0&>sEt`$TqR}8h`{%VDg z{cBa0EiQJMLB*dLhwtZ*x0PHOHt_$Xh@&%d9mmyg#&fospK}{Tfo<^|LIFL-SpK2Y~+A9N3M0sS@5fS$NoKc~m z<(1IwFsXeX(nQYpfe=>+%LykA>WDQ(pYH4iMONHvUmn7Y=GZT`o-C6XDruO z8OB7qmyCyZPsWT=f<-IgX>(^|{iV3nuCqNEjH9OR6&o$BwLa6JZ3}VYcuVtlN-vnG zAwpCpkzH22%T!{hr5MUCyB?2aTaSk(55OETvHN1OGTqZRDS3k zSfBMo`x&Pi3*?2os23Y+TdR{0Dp08>E3|P*q^3|3i{GBb4?9>}c{!Y9Qz;@L#_ple zR1i-R1pmRW8!ln@Qt~iGhhcOc?wvnlP_0gcVSTzUIrqPkwt?!r-50^nMqBQ8X=}t< zNfC7#oMYD~tJI*fTq!MDu?rYp#4tn|rWZd(!-~E>CGYSo&UWUf;Ge^nOguY(F#ZOk zr<-^Y4`3VNntF`#TFzf37DdGj!;N%{S!9i9pr zbM@3EOWdgt>-&>^txGCLbga`u1~j%o+qS@h5H(8=tTJ>zq6|}&ZC-7*jlBXL$|Ewp z^ty9hlp-0|?orCYA#Wsx2!+p-4a9>w%}$*~-q50RoUMl?W|C|b!N^U##+&+H`ucsEDz(~qnN4P#K2xo{j z1WI6Al|K{HZ(z|lpRQD{%4EG@R`$w0bw?SRu)$Uwi$y!~(PN_M$B)C>`kRj(Mljuv zmovL)mEiRb`KUn4)KyI{nI@UUDk^j*vb4{dt!)&soozy!hn;GhS%)^xzP1mUy9%AM zb8SNQ7YA@$Mt0XjH+bd++n-NjxiXQTlfni4+gtu4pFlkv`>T%yEckIJW)#0_nBXjc zf6UWjB(hGUfD}qVL-1IjE7KJQDjBjoO)0UT1#gRI&o8o}XGfPeH`h7_W9{BYg_bX2 z>}8N7k&UK?#r!inD~jbuE!qVuDe{=Dea4gC60nsy&yp^{YXNoG##XJ@PsK(|IV0+E zn5sBzarN!CZQKQ&Enp@RKv$5LE&?CN@1xAUJ9{WaQ#!fg{(~H}1RRUIO~`hDp$l6# zQg@wco6S7CyEq!ea2`?X!FCZ7)DJF~6sORTT$sGuNlFgU$b{{gP+!P?}f1K%c21?_W= z{s3(crSN?O@7nx&Ca{>{jOQ*!7Y~8N(9p8x90~8<;lLUAU@tWdIxu?uNDu))5guMi zR@&eR*0l!DTc`p!T>TT~T&r}m1%jTH$CZZHzsGeDqm2AmzWl2n7n}wgK|+nwG9|RI ziul~boTL_dc-RjKCSrMS?5}U^s0{adZ8`B5H6IT))~J;_6r0Y${Nu=ijc1#oS?*Go zfeo~~y;F~J|Cu}6BdZ(xjH$!nLsd>uNI*gCBJ)GX{^b^YPL4oKc*NX(U+Mf%mGwE( z|7;vFKubB&?>-dO5n_QvSr!&XntS3P`o{p576jB3a8BMI2gkto zGR-_?_#{{)zvyP7KNoMSBHipYR^#TWRAg^jC`L`nx61~ygz9KdCLd5rKHT1~iz5<{ zbeehLRCTmt^kQ1_mP~v}A{5fijS4?xdaFm?*hCYjxLh&aD{rP+McxV__U8$6JKGlI zO(3eL}}+84lC^ z^OyDT)0D0@$CH&i;b_W&uS7o1OT{Y-AP|uSz}g9>UtgrHgUQTxqizba$H0$`k0dvfwSh>MPlf4qiC^u?Z@RAg_J8z(!#{*VCL+s zqIE5v48O_?6pVXe*goc9fwj{1(7RXZ`{3vEwiQE?HzON6m{y!QsH{3RNheIz@E9{E z7w?a612T3NUhXJ4VIsUtd}jBm1`OUSvLS<4nvIb&)A;2>igAs0!~#&y!nHFGA$`Ta zUX;PvyJZf@4J)?&=ltL3eYmC2Uw$JMkaqye#-5vZ-0cUlnPWlqZPOH})CcXj$A z*y$83wLje=9{0GA?N+@e#X`x47O)q^wfDRYetn#b#ZG=&VZ5K112(6!Rw6~{#Dz%_ z*Kl0K?6{}y0O5me9-dsi9RYG4U6U^55hUcVlb3&z*gLzcvQiKJBrNJQV0GFG`=2H% zlGp@bqjRrJ^7hg3a=1j{MAT&TS}I{dW|kqSr8d07zt2wZElb-J3tLRHDS(i@j$K3| zc)iIRk&X9XPn@e(_BE35Ntc37XOJI>&MF5-Dj=pX|KVDO zssK5MTk62Y`}b$r3~z6>&kj@c<_rIQ+yRO6K!!KxH>aPNp||5~MRe$i0IneBX0NuD zU7Kv$rkk@34_n=hWxCDK*(@w!5`4TbfN@d1^l6LcTt;y$A4fsg^4$ooKsKT^hgbKf^^oIQXOFUfuTO zl-@};5ib6A`B=k>>o^w6n}KWU>h2J$g;8B$`p^<-9hKd<4n6&E%>Uvao9?6x+ z%bRIPHplIPZA9Y>IzbprmG73yO(%o`ZT?vB4q@BC7!`|>7OLyM6mcRZNY_5^QQ@lu+wMw&JGbAF@YR;)~m*2j2(V~8XLo6{(_VA zIXgbZ!d;*>7dN=Zfbq9liJL7CpcdDjWWnVV~=jHl{|ijdrdiz`V@P~ z;q%hm?d0-vT#*M>D zV=Bs+5En+qda(;ZkoOkKJLeA?V*G z?kvs0o8}R4NtESfLHfDR8J%d?MBZL)<6}7|=FMl7ox3VXXSxO2hS97VlLpcRnce&| zF>>p0znxEowO7;0RY8*^@80|3v-;v)bZ(exf?`8V3KcQiV=%L+BU8H4vLkq0|I1J7 z&7q-<4Tw!2SoH~*kxZ$At8~e79C%W{bkLRSM6MH0Up}^T^@Emh87c3FTP6&Ff{Ki} zetEU;wkdt6ZAI5$`0SPg!X!`e7Zx?K?v5~Q=wrJ#ARL-@S4+|mm` z+ab6bW08@x(Znn=;85F)F@H3=2vIIsV%(k%3&IufUv#m_XfnLY2NOI_IKb_}khEq` z-$wW_$me;hf5mLToNPWTxzVm6RHVUV)!7r!P?vl*fEf=DfJDbJo_v{{A@Uvj=BU}l z6z~WXk^glZ)q<`O+*4@cn&`v-a%mO!0o9<5v&NTvIO*~)WbV-0WBXZiCfG8DR*-)8 zV_?||j9{aFs(0f|jWJOU?#*n6GDlUx+duYDvJ4qV0L79eB= z7ZpMuAE4HkXr#1+^1eW#!5&5<^s{Q%c&<;6TWqd(Ad`|!CJJAi4k_=AR!>0G{5ozB zJ;caV|IE*rDLgpT?{d4y^^FI5NY6#X&=?tKj}MHif?lVAAsfWounOUIs~aR+Uj>W= zqiNKD4#hxrI)EZTsQLtapZ`3f{8!!}aqR?I zk>*k>WGm6tr$N?;2>m>9UCTAV6ux;0-=|w+>eUAjpO7qResEn*4rXe3B0LqhX#3wN zjz@tucK3H%@7UQn=by0hKEBVt*s@4|$7HM)L*R@MPXTdMZtSTbHg-ZNnkYW;+EYYi zqd#EQLv`HG1r^9HM?1$#gC9dvQ2kJ&7X(W?ZQ4e8oNOO$gk_&wHk2d6mtl1%6Ubvk zABZ&Gi&^FH&&Sz5zCgFQ`EO{_q?Fm6snHwkOLCBl`FfQ?Dp7v)2|RcBY6cKQi8Q%a zYCtdHiS@?Z_5%z}KuA|2!Kk2XmwDu2N;Z%*r3%LK_WTbPNjVJ&y_eBb zRYHh0!b?h?^ft7SdxfH-*)M}7^iF92f%800}sdk&xiX@^q1@an@0)u&_ z7BaY%h@;yt7@h?DkJ=-HdEyx+!ld5>e;5tBC>?6A_$J05Z_f{BR+~`9pSWvaSsaiS zZn4|fY^VMnD)m?6W}sAGZVkTWE#0kPo+lQZ`9tV4z&Y)ZT8o^{XU~c?S-ynJA#MH^ zN`2s|T?jvwO3mRYG3nqOlXI=MO4R*4@th+%J+b>adHPHqUN#^Za0=dl-{*le@IeeB z-AKredTpnN(>QSXYAmaBD6j3!{kE&P>jq;Iiyy}zP!`*#a;xY`SYK{s!zMzX zP;gpWAjGn4QB{l*9~Bf50$Sxvn)+9@PR+XUL z1=~FY?vMcIB|8iXS#1IELorZ??~e)IaLp(fDj+c8WFg(ehW1UDHO5V%nqGJ=rA4mO zNW@=Y`JmD|i(m8sa&d#K9cDy3=9PdZoGPTS^k;(LMo%8#51Dr!2rS<_evX`nIwi>` zVQOdbp9HApBP}dToNh#DKZ~Y z?Xt%>ll&Xfggp4bmg_+tn`+8Rbi`p%q<_C4C8K~c>@G;C58q3KO@;^J9~n>baAp9_ zC$J{XKVlt{e)A;LxPq1lJWQ*A4NJ*{i?A>kYF7ko%r?MZGP9w(9N7G}0P^>wdvzg! zgaQtNz7LKLks7|Su_&;!6vRwRQySkcktx=MyquAnA+Y6#&HVVCCIf-zCk(rz+nq!P z7C>od3ER?;BPLzQHaVuRceTH2d1m6He%MW0jI#lK(%06RLCD;fh5Y!PsY7z@Uf zn>%XcT{O4c9QpR#k9~+2t-;rD`FuV_E)Ys+msrL=rh?G&6#M*Eq;+h!Sv;5Uw4RNB z(j7A1N8)GpF26&4@o$x>ljVoBD491Lg=wd_u2MJsqOs9Ec;w_8##wE^5INAjb`BGK z*uDTPt2(>lF+j(LMW>lTUfp<=rEm?zna&reUC!Tet(^xQg(bcszs}WwDIkaPOFrr` zXw%Z&_?yBP`8!AqMkF6L&azggUo&!MLpgBOid)S4OkJ z%36{pmZf$D)|FQNq#3DdC?a5ldGVu5$~m}=U@Fqyu8oO17)1bOJPpPqoCH;yIC*re zBa9_l5|q6Kb=C2+j-k4YY`Co|mXc*ipN7sORP^MLGh8-)&aR~Ii!Ie-wUg&~vGrvZ1pi0{%_B;)=f!(}oH}-Rc(==>u}bQJ z7gR1b-U)Q(`tCXeO_j5uxH%i0lO6KHftNB~Q2xid)lxxB#&4KHdG34sZwuIYJdQ_( z8nq^_#IqI~`dlds7FKm`Js!x4pnvl_%yYJLF0Ovwl6On8m^d+kJ7bax1)(g}xWT7T zi^_OTMhy}Iz3lwlvb9u2e$Ms}gM0aoy0U5Zb+)d0l`N6iuT>k2{KM#bieE?A1DB=q zN^cEcJfpO^cc3@DI1i1wRD->jU5hWpwROoVeUQ|D)b4-@pMK?Pxa>XG!5E*U{%EX5 z57I{l20CX@nni|5_u-CWd`#_LhGPkZ%8h@eowpLf6zy_<3?G@j>}8F6JPO+&oW+dr zj}LSgIMH+ja#cqs2mDz}p$_Zd!~0WCRkd90_PcCYXT(4VrkIF=0}524!5J~0L-E(# z<3*qJq=2|hWo!x%PujT*CCfMVAV?X}%4gy7@^QI>)H{^osS~%=0x5_xViPlsIGx|& z&(igXytZwC(`gCk!F^4$uu)fk$F#Vcz~Y~YK5R^`)bSIG>98w>$OI|4H%xV~Rt2tD z#tT3S-GH2f=IWZ7h6IJ)*BYPnF{VxW)xIE(0ACvR>E>hnT6C*OHJ?B!aGu zDajG!z$N&slk2b>#e9k@v*&&?5H7L!&x;TuN@esxz=TbWI3CQs#BPaNAr`SJ5iYA?;;$c^=U-?=m5u z=)|YG9_h#Pk(`hEnf1lL%0{3#H7oYkRe>}&`Ehb^a7tG;eG^ec zNp%TeeA^yp6@w*Y8>D6guM&3c(ns42oEl7uCh*M0$r7lS1?biT0%;+U%nB?~{>wLR z((I%%ugd}rZ z;W2XBJk_x`A@-sNTxl>Ke(Z9woRh_a$BIVecNn|_m^$ii z_(Z8xAYmeAgE6hNrMI*h*A-NE4+EU&8o|N$nG#3}@*gU2r1pK}f>(lD)@qM?*-rPb zidV#;V+R~pvUD}{-HLlA9ZaH41Ecy72CPfA!88pKR;V~G zuGP}$iPf<2I1-8!U|IhqrNXKu%>jUD+R2pSOam6cCGt#adM0`=a~ESfb^65H*R|=2 zrqI((=k*Nes0haNwBg8NN^%}WwgMd&Vh^`(%KT`IHvDupiu|@Aj}pO(D`ZiKYmSKv zsQ%Q55BNh=c8YgYjjdrD7_`%$$aU4B5NJhb#`9k}fF4F$k(t=bYxohaniqXbqgHD)&bMh_ zK=uYeM7<3J1`$O7Oiu;=5(J)L9oPbkp_G5AXila?K#;y{H|l(tesN%+quzgTa_y1O z^NAX1l!Lyg$UHakP`?GC8viotaK1#>5scpjXP8>JvQQU53{(ev!8pY1WdzhP$K-U! zupDf+SbhvEh?jfyVK{=+A$8to5bE+k^)QvLKC-FWQ-{z*BrT-cC1M0ziv=0Jica*R z1}=)d?$&)f9VdUu+~u3fT8qSa-_2ZgH%(tEAE(K^ZD4pD4hluD zYPb~~cT`6BBX+LnEig}pzlSUgf3?YCcFv;_{|TT>xC41~_T)O($Av(h*$kLfE(#>E z(k~`%Nk!!FsZO$Pe?(jZ{bb{gQqTN+kK17T<(B#prZ63c&n7jmTv0V$Sm1DCzT}tk zzaYJy*=Kq5CuR|zwqZlUr&Qccsu~7bWW-Wo=dJ!0nCg%Y|I)%B2D_)jX0t(-T+A~3 zfrziap11h6i|ap+1%<4emKjHNz$6Z>*L*c1^d>11;eA#0VL+I@1pINz zbQSut=Y}=<^+VVV<@Vq!!?s;qdc+@-;a@4ZSUwl=6GH4KH`Nl_|IA`N?YSdhj2bIUi1GU!^t<QhZ;r*XwA4P`z7 z^z)M>WpHSZgM&^y=aoWs_?iDeHBz1i$m4wS+`b{+p}m*218?BoJt~MA;Y&Zk`g4dk zJS$0!%OnR4BygJ&EBb}Vfe2Pwd<>6gmKK*Z06(U5F?~|=F^xFJb_;85E5`;j0pO-8 zdDO4Bn*r}(f}4(IoH3IG@3Av(k7!xYMl;tY?G8#E0>-G>9Q?zhnIMMkSlo!3;P7mP zGswQ$5`b&`Pvm_&B zUY@-o2!k+>#7RwUEvRas;m$IU=@H5eAX^0ia##0I%f*UdZ(^bBh(?~$au^P^NTw|7 z*ttn44l-7n*sJXS2uGvETMgE)gcL4`ubrUv7dMWmjP6f}Ia)C=FDnbRr?aoGp*OO2 zL~kI40ka<9!O{|zI|Pv?Rd?AQ51E9G5~5?jAhVK^gs`hDnPg0&aTzkIi!KC&L1<{j z(q`$`d52!RvwL__mlHkzp&rYDAtAOT2`d%47y?)2*n-|3F(DLtYn8j9^f?=tIDJ?0wnG`v0z}L5~@ojSdO^jnQC^RC0**bZDqcoUzQ$nd0Za*M#G^xo0%8 zFiJ2^FZz7RbSn5E{N5q0V1W!ZzKPhmg!Cgcr{i|i6a(BGKCfuOU^v@(3QbKOM$@0O zpQ5{_poglX8uTN(-}R27SrhN<0(28FxV$yNh(ZHw0uSY89BEY)IZe}y9j?k;fM;wN zWebpvww#BzRi!IUqfLO6MM@VU&qGVSnaF>9iGi?;m(jW z{7;|I+EJoi>SxL5BnksxhM0Bcs{>NCQtmxp)+ENSp!WcGe-JH)i8Rodc|9LP?#6Qf zmmarIBU_H=9DrAIi@%^&BlJi$RRxJo)nI1q$i>+!bB7aeU%pd)P`x82t)|kYO4(J)B@X^$Ob0BbcEZQ zJWA)Y*@dwspmKN+Kjol5K#&awC|*7C`Zzh0k-{0c9$<2%wo@}Y`uSF)2|_m5^ImP8 z7S!KLSl6+-BYa)iVy-NR<4fiSahR2H;H3nxOaqkysL#(>_CqEi7q~cYK%K?PTB!AUkF)n0$p1G9y(^S@- zD`tva=LqV3zWZ@^AI(R|fbZ>Cjhq>pjQR%uKY&l4{taF=!!uxsD0gurxm4sK%=Nli z&X~-K$q5!%`b$B>o3yXOa;61qgfUm!Ls6m3nmb=!Fx!ixkBC~#0rtvZ36y3MlcEuZ zW$V=MW_8b8UA4OXCTxNbXAD3nB8=V{BW|}L0F<5>~YUY}%_|0p&0` z$I?j<0OIYv3U^ng43fLzZCIu=D{nWMCFo?0R_&`FM%)$h(dkXIiNFNk9UQznKye!( zFKiG7RZh;`p%WaB!TXAw8uPMFHULAb#py9jNFr>m*) zY^S^!o@u>s!1OQs!}GA4VIRPb!5KoSi%UJLr#HMi1CAZ34L1+Dh07#XpDP4HYOUP! z`G$cu1aR@!*&n1I1{b;JB=AebgY}DHLY3*`!uzek8;y7C?X4n2Q#MoSw;iid{ENpM z35|E5NC-bb#h%T)yGIF*3sSUGzz}rDYdU*hp5IQ=_p8?vcHtU0AW<59Cd8LDSea*K?k>Pl&M&d#No*&OHp{ zX|7?m9|da%1A+=QR|G1Tl`3}=8NwlOcTBv14JGF5))JB83%HM6d~EKs52r5@`M?SR z_1N@_5%)8v01!t%GJS11V#V-dI8$?fDhLl8mkHYFLOC(JKV?v$Xq9W$nL_HO!}$61 zdiI@Usk|~gv0E849BA~!dyBH2uSWJuJu@i6W9z51hYUtg80J>70*jB?U`v>-! zFoGuX=}Rr2r8sna0JKgb2h+tf5JDvaA@N821KN-gpDHn91${wXvBOAZ@#_f%?HUB| zOtw*FTjYl0nb=mqDkFI{YW5mAXhqI;B$Q{q1W5|+< z_~_7o=9qa59MN?__`KZZCeYq_51oX513{sv?^bC)SH39m5d6nSWf8*`Qbs`m0|{fG za3T;ohS}BisXda7ilqlMLk!S@-x+^;s=^WT009WwUAkbUDyPwxeE5!PN)$)}DW-vw zRq|2zHT~%#F5jS#Qy>Q(w9988hW5`w&7%Z0Z9$pn!c59qtHGk}40^57_g9PcI$cFd z)%A`Bv`Ev_^mW&R?NDkmX!KgF(>fjufOzbxz2Ei433mzB>rde0)GvXJHXAs@CFgiT> z6m&VAfNx^V1Nm_(BoHNGB^5Wid`~qJrS2ymUR-f^dL!^2Z1YH7T@VM{tuYzIXaY-h zsNEF7wb=p1%*O5RWSH$xx{#ld3UBm0t-?Nal5vg@8x2-amqKCexAtNbq2cq_`M5^^ zS>ZyN-skucP(i4;c8HgO<>YG1ZDA@iUW7oD(3Z2h z{}K>wt`-3h71G*Wf^rgyGxTN1>?9A>F0v#@($<&Tb070cdLSw|h7r4lOuGB-1%oH! z4LDYNus7T@hs92TryqGRX8(kcWcuqDx-k$74AwhVC8zzOOmKL8C+&pd=)w90Qoy{= z$=HqDAmTs;N6gvyV-|nt?Wx8AD9XPy37H{o;qK{1#;gxA0E!W+#?;e2r(Y3_0Qirb zM)W%Izwqm@3k<4;L4uPD+KxA-^oXXoWCStz@Ilx4WwQWah>wDUmoLPT!DY491KMj4 z-GOW-NkM@lcu3S^Sf3<+zjb=lP(#(Bnx3e;yi@jdk}eDJ%hrT)j%vskz;fb3n)13* zNJ3c+G%qcr!e_KgG-!tYNfN_RK*!UHsNvtR!Qy{mE>G9!$PyAh#FsrfI%j64dP}~O zi+VrX9WL$}S!B=xkGG`~aIMu2(E7rcuL01f0>}{w)Zf_z_CVZng}^8Bve_6mzEr>% zgpwypS0?&^X?|$nv3a=%Oh=F&af*H;`>yJl6AS7e%WuPM%!@Y8saA>ohZm@ffSWAf z7JtMomaj)G9!zrJQQ9pkhB@mSQjH#qU0SsL7+0_a8se2MoIQush#52Iw0N+Mtt@ds zIaQ9G#|vZW6=4U*pO_sn=1;wh z%W=t+wnMa?zu>+k!IW9L%RsFW429CKUo3vEm6hdFTq?UrCew3dU!L8;hBX z9y57kyF13dx_~OAL{)mwI4{T-&}MkqXxubLFXF@Y?CDbHhW$$fZPX;9Wj zs$1MY6py6R@;e>RQ13+H8izcDH0GFT>JQ6Z#%c?@)+>Q={{wFd-kRE4Y(Z_b5-yuo zLK?!QDiZYCp21tUs7F-(~vn zoxDY3Fm$J=HvnLTn85BH%yA-b3(l;Q;w0Rv%;p4{<<7%E(fLpxCEQG^aa2K0pK z$&z6w{U`8IN8`(?dsL++5W<6Th&v>!Zh9(N0LxO&f%LxlCFNgqYXFO)>p{A^y_%yj zeOst*u_jg{`G7=1bEQg-2rJu}P|{%kG}Cbaw(@xXo8B?1nTS-Te`VWC&G^j#AG<0G z=eSN*mggX-e$ej|eDiQw_Qat#q4dt#by|vxn*?S_=d<6M7O(D2Dn6LP(MFV$`<7nA zid!M!rH=6#=Ae@Fa-hm$RNE&oBx^9n%^(@r;7w6?i0lJ^5jxiXB|cs_cDp;$8!!p& zBop$MQOH6?Yd6(2!7o%(7}CunwR?-Tnf9|rm>WIwHo#AEWXreV=>$Y5;PwEpaQIeb zIRE(*D&v1q^u_%ZmVH{NoV0XsScLAId0Q9{e%|DZV1dD1tN>d1CtL;{inKFX$hbgL z)oi4KJFm|xdJ+~zwzPzvOxJoN6crSRvWizcmNv0~6CRr2;Sx{FF zcs~#u?+oK8zC5zNde(GOR9d++q}=d5+UE3M6APtBsttx3S)=F{rW#A2+Tlf)ZRH*i zT@cP5+rXfV)jg(+-wGE@Vu_PRcrb2-%b;*uK^9?B9Ubhi$SOPEJNKx}CyZik`bsD0 zG7jl<2KGI$O*+RhNS2g73g4%0!rfw&1oVOM*AT^rTdtjBurMPVhP9v&%)at<|I_Sj z*3L1Mm-6O_KPYgc2t)?M{X9L3=?!#|4ezJ3C#UNb6auBlJasH6xK){jK!2*78vfX#+LJg{*usZXAEhp`s|H9kENb<6tdOm*P0(^os<;Ebci=_X&0JyXaa<-<_Dw&t>?d5(NMj zY50Hs81pTU_!wz;AyqdUuqWyRDtVrrwKoW%Wx)dt+aTJK$I+g6fkydn5hbjOLbj&CTj>RwDa?BiW@((HBpFx#cSgZp<{m}j5f;|oADCT_5LPW~bXk<0W9f|S+K zDo~P^;kJe^(#4wY5CCJPBpUTL{GGhUXe?2>Rqr3pOF}|iN{VMN!S06yk5s5|*v;IT zAtVAf08s_^+J$SkTk@o@s`~q&=IiXut@zD0RS-kmjbZ|Mo3*xD#)m0#d)mH zUt!=tb|aPP)_sK5WQT#J%GWBrZ`E-^%(2RseO%UJwO+D1by$q)Zhht;+j;uS%58#G zUlAc!tHoQrQ`%((#FTKruBk|nHcMS49jGgVTdnxZ*2llGYC*8}ZwN0}*n8I%H&mrp z|Jx4=5uB^H-g?R116Izu@3P|$`|l~UO4y$wN?DbkPq=WSXoXyoLXZEI9nmx8jPAiO zGUbnphI5lwVu*UwJZj;=iDQtL@V>_G^{BD1D+|WdIlrEsg&fAED?% zCO+B=kwJMW;Qu+(V?~g^#%fzX5+_cQP5DsSA%s-K$)2o)AOB<^Kq$_WyJRnm*QGyt zB}G&ls$gPhNzjM~C%`b#lHQK$<)0JK!|fj$`;u}e{)4!HDSC+a6B!2Nrh~J-VU*Ng zr3rUu_rs^a>utKnz@4rS2fO~6Wc;jY);_zZ2IO@-UfS|c)ir4JVjp7SYSzWxhGqoO z&EyReFcm$M?+fN(9w@iS%ND1Dn&1Cia*rL0vTnKf25SqLqc}$UN1(tR<`r3PLXu~1 z3r2^v!oDd@D86E8B`ClFRD`aIq_CJtI=)`y@{y{LL+ICZ2piy2>2pLH}_SGh?Co3Iib8@yiz zCu3^;C9q$>j*$eMzOL+?IAmAU#y^u?9<~RaCe1kWt29Hmr4)yce?X3ZYG%2(H>d!& zeiCA~BNlAJtl%<%X#>CTXQq}No4SPF+qmKY5>Qz)y@QAl{|658J z)!I38`|@+z)7y6~BchB0B`Rv+3i-U4SrH$Jc_l~X9Sn?SQQ zs6f}s$Z_P>U{#Ta<|4*-J4D9nUwK9#REFFgiy;kzyQcEvh1zYfRab?j_3rZ2AB72(&mcVUB-<%6wCxo~RTko@Bad>q+3NlrX8+ zRdTzT*n_P=wd>wSt(f{28c~(cm0H6J6Slp}qW)vlIAd=;l!Uonx?1ETeChu;-yl3u zW#D-6Or?i4T}pocSp9yKdcebHF2NnEknSR*nq*TM8)c@Q?Rbd7Lhmk;H&{6AJ#ZuV zYXTZB3{5xIs8$_`jfNe1=#Ct1zmGKbP6? zHyS)?d_$QHL%ubhL7r^!Xp5|P1X9f45a<(=AD0)KyZcNRL!|Be%9??u@rloKLOhVm zSU``8&Uj+fB6LE4z%;G!2Ik>(s1$v2xEL?*#K3h2Aq?@zZ4ztJCxx8cf9^shB+H6q z*f?`3_S|ueUV-7Q?uj^IDUHcy)3apKKFi+Io1F_Cn3b>&IdP^g(;RBtEFEwWxIHuR zP@Wao!VL`-6H(_K4&Be8#jXt?LXR~Hf-*StZE>l1Ps|)TV$cE?6ycGIN!aA)w3*0y z6S8ICpE)1o#6AFWQS3@k3Md;4c6xX8FbXd*xsLr9_TSzPGCK`Q*xyt|ymCg5Ko^*5 zS92uE|3v)rn`GcJ8y1=sU=WM4Pu_C~ezty&W}(sd<OHQnVTo3uaw^}w#U_4orQCozKo2FuNJ=1P z2B-%$b)H?Q_)Ecu=(}{hU?ZL512(7EpM6_DtZU@`^K&18tBRY%+YHWmsUe~#Q8_;+ z8S3#et~GEdtTT0Kp9tnT0HRiS@3i`m;e9Bc$!JKo+JKA^TLeW&dP60GWv^I~Hop-7}Fw@ZO+xEx6l05Eyam z3&=rJh-(ll4pd`gLV=L0|}bCsU_+4hQp z2p^%@3IO0ymp4=nx;+Z?H}HF8rvqgs`BA+k_K(C}t=Z&?dsHR4>(ypwC+?^7+hWZ@ zAYehAx}O%ZV(cZ-gqi5IRSQ6AE;sx;p(oSMf}8lvFQDo7v=qSY>fNg3(8!0fW#<^k z?;@I3+MUUGh+Rx)FW3iSmu$hHC~gvi9UHEjR*H`Vi;gFs-pkO?>zk(4jJUyqlfQv5 zKq^L*3B0?Z=TR}W*RtrwE-MWvAR3-$08TFH+--R%wH&n0f|5|TQJUq;1{6TU8|z?7 z5~3YK?sAPd<~u^Q5AGVeSo!@e_%6=PM_O6rggoj2rw%LO?4$ZP z=c>{v6%^F_@LWbb3V0+?SLsy@OvQgOk!$8`!+WA8axT}F$S50~u(?8KafNVq$Si_R znDTM~i3egNXrDjeZn=p;$UGprIo*-ZzUjmYq;MF6Nhu>QfR)xaX(^JO>(Rch(tk#3 zVe;V;Gdjs8{-UfldrQ*35e|!W9A$8s3!H4AY}_2$H;O7k$VZ+RD_MhvNaG8}1xTx+ z?krr{BOv*%Kc7=Lq(7im=zoV;-%^5CGHlArUP`ik6fHFqfpO`%)h|JnNIwy&slyU2 zN)trc(v)wwrhNRw0WM=8Kf25b-cI-|jLbSZ0ztQyC@3u#q1wk*!ApHsjbTs|+;un@ z1Hy;o@@P?9?+Z^VibojYqipA*{q--l0r&w$*nN#s=sFWf+g3put(z!C8$Dv9)yWq^ z0V%R%Lm6OLaR$7RYtfdRxMVIkm+M8e+iB)Q`lQt97q_R(^`AOS@M+Kq>-m+}>q=wG zN7FY-n*L{%!j~4z-zI;;csL_g+?kv=X+=?;$(-%@W~U<7|AnjCt9yk+^!ewnB_9N0 z=U#RQ^D%D290J^=KAsE(M&VzJGn4%Ina0nbWh1J+;Z`Xes15Vs6+PMcUpflzAp#jv zDNIJa6Uyqj{P6^1d|5($;a$}V?iMO0>b$H%3^IeCrR2^VdDIreaRjD-!MXMg$)Zyx z_o37%STT%&Qc2jd7%53I*k?%w9jUn&@+r{~DaKhoaHrF#TOq1_O?a|en#m=1kd46< z?u}G0mZn0!;9DwI;G0wzFgl7sVjG03kE+j`fs)4kDld(H^?6*lUR_<#mSx%4jU}ZL z-D2SZPxJ8|OVu_8#1n+1TdW9XFo_;eM08q12t$~qDvd}d%nzzuIye^hi|6V-YH%#% zc?H)Yw)F2yl7(5$WG>^k{egPZ zP3#a7PZ)8*WHqH*YUGUZ{YJzD8%3;9TGSf?01GXK8lhlnoi)BM9&Wz}Ng<530mf!r zEzk`hfX!&v=wOx+FEFA}VeH~R-7jvkAGkw{Y;FPZu7bd9tbRzWmKcZYs}9|&hp3~| z)yJ)jcI;-z-m(nhCEqgF?I$9a)d5A*IaDQ!Pv689A#{c=F0T^@ln{&wW{|W?G+%9V znuMdZ_CK~~Wi^HvQ^<6EmsU>Pak*fQpbtZph;_E)HL6;tb0lC&h^J3HQb)jVrN+!v z7A#+5Sg^yakN(hIyd&DmWKBT#P|n|`_VmjQ9}&-l47S<`alPTylfK4;2p3?JtxKUXnDGU{3F{DJR?pUu$$K|xcCp+x;1l8m zNsSu2YvZgs5%Eo`IoK3{#Xh70S?OrlA_B#7=|%OCtg0`GA00K`GcM2-6H?M8Tvz{z zLnkTzf>TXc=toRstk-ftdNt+y_h?`BKSFE!WN1@rxt-H&v9v3BgiX`T>2n(4&=iWv zmW?LUTd7+4lB>*=Gzma$n>TUUZPH$*7wYdKg(jS#hosec4$ex<&_@BV&@DnpL7zcP zzGZlUSIA1&TL|!MzY^mGQvr|`<(Jr~vl|>B-{~W5rUeiwSX|6R9%PYO8ANVe$sHO~ zKTTis%R1W=BPw_s^DgVv28gGd8-r82M-k>dIsWAgtlA8eeug-iQ>b^cZWmaUw&Adw z0j14Hm2^>n04-SEcS={wB_??nH`quSFBbN!u#3qoPG#Ax0UDsYlB!}HWKChJ)VCq> z^>(+0D<*6rlu~QXZ|cuEJYz&VYXskT`}U$LD>1?dn#j8+$CB z^gdVGzQf+9TKY^v`*t>%k-j*am1MJXiIuJ=DgUujOwErg9%v^rKJk z0a*tUte6OFb@7Wz+t6j696FJJy#fw^oGt`=FL@_l-WcvfF=`2W!9iYK156VJtI1NG<{@x;`r!%o@6g%#Jwxv@@ zVT7%Qyh(ZkK@5P2EgH6G*YYVfwZ>5p2&P+KVp-AS#W!_N)8W>N1#132Te)nhd^oP3 zfCfGTPlw!xsn*Bh7fW=BBf#vBnNs1M;`Vu7+)z+NLnQ*P`(k>%_HLo_r|JzLLISe{ zqWYr;F_%ip7jA^|xT%N|CN`r0f$E^HqZ6F|py<8j>_IM<4e$1kLtg8m9`anaAo;xB@AUV?4=Me1 zGA^V`+@B1)M6l$Io8nylP^D^6cD69K(=pdYy9_kUd}N>@Zo&4cNg7^A&tV$5>+O(M zev*LKjh`p>p^D1?7j7^tGlZQC9N>VjzKB=c?Ue>dr49?t(kP)2dB!dASofuX&5Tpu zDr{`FqHQ+2Ystc}eVMJ*DI^F4=NaoVtfT5# zzxU;e@Xy-!xETkPSkMH8kbz#m7tLYA*2$D(IN_L&^$N0w?sLWQfH=`m?2@@>b!>k3w)U2N?XTk)Z<^?S)iJ|`l>*CHGlN;FI z9rt%3KJx-yYVhFO#d=}#df-n(q*i-|90im{lTF|=GO>+%A{2fBpTpDfXv;*lF@S3c zUV!nR+Ezqk?$D~PN>wTptxF{a*baye>mh|e2Qs)P<#*9#q z_2hFl*oEF7HVLKjw77kgHV_6&hvrzJQ%VYYN&x8PDK7rVj4u2{?X?{YMeb0~-9H6j z{?M8+U3l=wkNrj!2r`VK1M>b^Jyu95!S&>3mM*eb@tENMta$hc*0M~)`y@tMfW(Y!1^8HpH1ZMhau{^EY%=CmlmSCb;@yS1l1P^_L6=c7z3TSX!@>t4cyzE>aj zn|m7YLymC;ctr4w7Nu5)4z!ev4|57ysqwEX>PFAds4yG3_6r_}vVUYs85zcqj5pYY zfp3Be?E0bQ-%do^-={pMPO320m~5K->Iol+CUZXMwrnMI>E!y2GRC;eB|!t{&^f1z z42FCIcFUqX5Et4WLUYS<+F=>G6hIP5k?(lGcH`DE39hgdj4j-&Al{J{wIuf2^>a}h zE*WfCHtKV-=&Ax>5*%gI)mrq#YBw3qp2zzE&hWZnyI9p;qO$_VBqvE;tQ-m^>u1<+zf%`|xe7 zS}1d$P$)rUP%5ZZ_Wa|;x8NeBD@GWMSc5a7CFPBz&%u%+;SJEykF%;MffHasTaPxp zY;?stl6{3u(4i?5!bq0#k0y*!>q|KK8pIz=a*p$eO%P2ET@$m#i2w&vtf%2^%|uy;R{@um$sJMG z6W8Y$@4owYLCTPaI|nNx1HHOeZ3oGL1b^F_e$4P7xsQ~wiBlOkD5b=WJyYaqP3 zC0r#NqI=3!_^~LrQv*R5XLvsa)+ntME*6zB2&Gj$b}gQZDE{gn`CK9@^rB38j>NXJ7& zURweae`YBLX?Y=&&B1S^uIrTPQ2sgTZBGQwzcxN!YYx(w44H}`0}DvRQYDg>QIMO1 z51`m$m3X}Tog0(l%`)X;zH+Dh|1$T8JhJGTGz2B9El3ex9_WdK6a&;Zfhwg-Xb&+O zGc4P@lGmidIFbU)n6;F@CsAXIo)#!^r;p-<0!bn!g4hxjMzwKB3$O_Oq=F{CX^~6* zw5E0pQuBK5c`Zk(iM=ZB7mMBCOvz>$1q>zc#ZV`aqz>WXaWlNx(8jreyJfP&8KPq< zZ1`y!(dS+Dnlg42oLSaImmvN)?&ETF0hufPMSW4cZJ~PqQm(&N(2Yz_MpSXTLE(1dZD$!3ud3)=KVdC=}v-UD{1xD;pY z))~W-sxFX<_x_>G6qX#}Su`hAi8;goYlPfaiEDDU;U^C%0?c|>Fw(MB!K1|a%=%}} zL7|;JktgMAfT}fUTySSnv7v}g=nfA347+zNKKtBYGc+MzR7lfQxRPUtmqZdB)`q`T!K({2A4z`HJsZPPYW(41#&3AWZY|wxzOz) zR2aEQ_iEvM$8%j@8s1p$-ySy})`Y+Vja<^KUtccme&zs+LV2HfhoM1T70QpwhkfF< ziqc67ZguC}CiHyh1al|l{EI@7AY{q4Fv~{)))g=8+c+{e*m;gIAfg2oh#^*(Wn(m^ zyZ@*HkrnF*m?)k6CFzE(77~d*Mh7Up zFDyIhx)UjLz-hSdu!ZW55-;AfUHk1&K4j<1{eJ4{Wq1;qlD{ zS%KSB1yAWWFex_Z#;CT02ayuV+pv52d^cYf-#9zVGeYFid8T@o21w%D!HVVSytEM5 z$_I$$dCsV3pdOCC-ke6?M_@huT5}gva@UA|`ggi)!5`8D5$8`!f2cf$+@F}4ph4wN zv)g#V(6qkv>6=F$G7LoZL@n%c=l}{(Mo(p&C^bPeussN>+g}MPO2-;^dTwOex+->% zPjnA^eay`pHd;|Xl27n9tU#mZV zf~};=rrtbtFCm;^d`}gM;yx?x^8IL>)1i(mr=5KKen^@nJAj^rI>jmV6LB&QM3lFD z(t>~{+KyQj5)ba_CnpFNULemdk3dygA2TKZyvs;IsxyvjH=uw24C`F1d1_qJ9g1&h z+@o+CHU5Q*P@DahDQKxjaT1hEMTQI%SL=luY?TO_-~7&7Eq)TVK2CmUQx|`zk^rq7 zf|6a(hiMGqMqnC(6!i@0QNX1kH!T#tI7d*wgh7`mMY4IhB_b~%7x`q|@AfUGjg1`5 z@v3@FsuN@s51~ouKwd_FytQg0TAZhGn>@}RB-fcm2=qrdX@~(Uio8R7AzU}!jMfnN zJ=~q7FG=dJYDDRD*D{G|%``v#$znJhYb&i{x65uomdT2|LtJoN4IGaaia56Z-SV!2 zW<#xH5}8OXB#Pcin^I0h3{?5xYoU} z!Jp#Y^57gK4q~CUb?ZA&#NtV{8lHnF)SJpDx>-*dD<^y7H3qt|%usMM9z7_g?&`9; zn+}n`MWB5sJnQ!vaW4^z0%k@@^#KL<1QE2~gsK0+2msUDW3Yi0`h}Q`ajmG6B$cms z1KXmRmH22@^S8@*PS;9@KN(qIbwk=~Q$3Zw6r5VYls$F19I;q-M9vMI#2Xc;(vxOG zKtxI-vysp!bKN8%9-AShdv_&0U9v7%V;{uB*j8q_2`YLXvZ>|5C|%?hd_fkTxZY}L zv*bqm%zo8Jq?0(@!7vcfiC{jdpKp-f*e-QLvRU6HYbY){^dRCAkpi+l1D0))H{j~d zcLu3E;+uXzx9ZJx>Y-0fe96tD(xh1v)bh7EOpm%iszOfTN&qJgwdWBDQ#Xjq{DNI- zHbW|JRGB%!OfZfFe{At%MN?W_y8@lTJyPLHs-bX6ahp4AwriJG8}!4DnqUP#4F?6; zG5LFtw|ooKbmw|8lnRARp>a#bt^bTBg8zCtF}`;yz3d zE{}y_FNGRrh4X(KLqRm+Xqh)wbqixz0+<&x4P3i7H+1uyG=~A3bei{C6zHSdM(6y$ zu9=bOI8LfnKdAaI2nVu^)Gu$vX?S(@kv1qy$`5ydv$gmXdjdJi8Ua*7D2^gVI`(yC z64?cJ$IK=fb(U;;0G6;!IJ{I%Z+dBD`R!%SaQ0*sdcipbXu=J+I%nifkcNt*qOvqT z4F0?|<)FzSX_^O{v;GDTZY}@UYBO2MEhKO@OR?RtyLG*O-4H;sIw&=Zb!<18U4o-a z6ib@rtTZMe1DHxXtya-^zv!tyH?-TI2EO))PMuFELNxiKnE9#X(=8DuGwo|h!D7eP6k3nHlzTase~?*iejkO|5`s^D3gD^P*+w8e4KlkQBMCLE_7evf~vyK%5lu zQLT`)lCF>U&DM{TB@+e7!e_2Z#h_n>y3p*m&gl4&_uACOck)Xpm33b!!%Xt*Ebk7+ zNPeS#*&D&Z2I<*wI8f?eneNBWp=gZOs9HDznz2S}xFMR4ZZl7avY5cFd418YS9+V5 z{EqBeWSnzTA^nti1G|j}^@TuWHifNwdB0$0rgG&ytT5m{ zx4c|53L9Vzv6E3EIQOEc_6f{(XcE~s|7q_IK+Mwj;5><DkbDu}uICHFt?6$@ z!@9~;G|wj#d>CIqFXJZ)*Pc==RmusJ$DKRr0BlY)rh$z@B5Lp5++PUHFZ=cI3ei^0 zDGd|TTnbw~X%|QXH2;d=2kcu+A5fHZ$%Y3b@9-}tXwom-0E?y;>QHSVt?W@bl*4`j z*5H2j{q`}tj&-M;sROv5vBYti8Y@k?S-XqTZJ%=qMEojC3HU)4RvRFzj%LS3DDP0_ z^+bmN3|9|KvO6|IJe-igFVeg8@zX@D7$J!|NU;cQ>G@x7waP?WW^+$hA}qAjYO3Nj zohC!iucV+MzIDXSc^WBwn$py@hmMHs9~TV11kX_MF(UxlcpniHy1{a<$Z+_dk;6>*bN@pI<;`eX`;n8Z^ZG>DHqKJu%q372d!c%9!=7}~ zE=7m#OjF706!q+MJchvo_k?PRVp;;amc5>oxO#N+P)DS)f-RLR6ep#5O<+Ow3 z4~Sz%luZ0^35OYtUbVig`yg8}gosT85TFhjyr|55RaAqjp4mN$UOmOqayb5Y2mw1> zk~!h7(^ozRrbu^m89s#L^cK~D(FkEyotgk{f!e}{;jN(3hFaDdKF0JJBc>}C{(b^K z8XFugwjxDrq_H7`l85nixOcq2ck*fP!~25+zR6cuDB&cX2?%s~91QD@qpd*kVeFXo zf{smO$Xm(TwSp@+aN1oD&VL{r{%T$VbzcU_rh*MjPhf)Pnl8VIt?3s{dTHGMnrY;H zLh>pB+|OEqiI6FNV{yjZxP%-KO@N^>>;x^mTGxIw)K*#w~HU)F5Y$Ht^1Iruk` zhHO52KYjU4Vom%+pa=J%&1ese124CUd&NL_$O;K-3T)y?2NyYH_@CoOwu20N{3fW} zXc>J%M{@`|H;+&L)OL&2?o2zSQX?+2a;PEK9$Ful>;;WHLmc@LLul2-IhMn}%U)~> zpLUFDnJ(2WvuF2$sX=KyUaNY~G=p(YOuya0qp+pJ68Bbs%n{`nYPy7T0;CY-th9n^ zY0q*j(}Hpck%eiQm#OE_s^NHw1I2LgHQ;e(Q<~2UV@<;=5m0d2hFCqyvvcvMWP#~x z@PG;R8yv`YW$xd7jJSf|;?kR68H{KtD>{6d?NQV9MAB3)9M7h>zzouo1|Gx;wjull zGk~Jt{qi|UGbty81^+B!WPFCrX4a$AtBS26nI_yue{q!Vn(&j>Fw4IKAVO&u?L3S! z~sGS?Af+<>_VKNSl`xJuI--EgT94Q-mqUC`Jo<(j0a0Zz^O4pgH z3Kt1AYmR{Wf^Bv{%~!@*zemz?8>E9!VzP)F@2+Qb*U&cf|%ibL9>M^HmnXVOjW1x6_8SCF_UZhR)>OKDIweFpNm@4 z!CrqOA|j*(?MVDYU3(S+TLMSss+SK&P1cc&RzTVSuxIF}@@2If(3Vd^qtNUMH-Mm( zK4E4WNJ0!L^^4U(x`OztBkaQ?{Of1L%i}G=%(=d`#fnaoVcXo5ugtQJ(^tm)IvSg+)S1Csd?n=yZm%B0hlJjE1YMgu|1JNfU^sm-Olaf z7uBh{aMY!W|6w1%#{zI-JS|ZG2^73ocL){|Bwxq z#@DJGUsKMw9PhvgsdSB!X2aOfS?I^I_?~#caebxHk%U4w=*-B_%)c>D*_4T&@fx;E zN#}yYk$p+oBgxBgF{rwn{I#>P#6W_eE4TcxZ zA5iX5;UOd*(!+KH9Y^a^&QQ$3m{H*eW3h$ZSc-3{&nF(=WakEv=3@G`|7?d?tT^cB z@NaWf%E!|zWkd=a0Ks(XCE1Xyz5Rvd9bl)yPK=|1p!uEw=m957aOrU$XkEgAzRitn z@eoxdfadU@8iU(OcymjR)7%v<+Ex5H&`f5oYoXwdt|wPq=iI=h?%4YeVc$r)3LYm66=2ZHmtYQMz=T+L^X;jA4T zqgR2`(xIcp2H&6(CqSGS7ylv=mWKC4jNkXqf zV#EJ0^Ot3I<+XrfDJ7|}#~q08Awig62g_E{S+01tOc2nj<7I5Qbe}QTWCv9^aoX=U zw!qq)n>u9t#NA{-q@AtD{Cx1w=r5|m{8To7^r=k`Ml6^ZB0PrusU`Cnu$Ryqw5E6`<9o;PY?RV@8|gBlFJ-fA;msuZZ|Q9%7-{7u1l7PTx1NNqc|4RqF0p8w)yfb}yvX%~3OlnbBsO++@VtkG>CP29s?VnF}+51KTxW2})J>BDI z+^@6VJyA7XlIU?BeowRl-z5Dy;y>zhj4KY$caaFdo2x=#{+Sr%@3pAw{wSH7g&vf0 zW**R%Zy1fc0UY)K=164s#oE!Mwvz6$W4?SBAWp($^=~R3i#-J+L4O8=3g80%2`P#8 zpToC7B*Ktzbhd~oVIyY3)ZGIc?i!;ELLe))x9@bQnm_uYfR_jP#PL#_BD5qPs$9Zv zpg7r-;jhn+)5n+K|8p|v@NR)k{$)NDamuyqlq`vI?_(HwYVmP_%?5`>W?VxFZK2CI zRely6>O*$k>h$bkHmS$*Ly3b1asiIaxHK42sV?M4u_z!$IB&Ppo8nga^XOT-t@Tv| z1aL&t3{WA4@OrB7;>TUek%gD=z`b4S>zSl<6T0#X(3V{tQjA=1f=VoGEcvCi&%y(0MYU@v-f=B zhfdncHD5DW``5+>BN40h(-NO>#%08;CxuM1mE?1JH>v=y^W)ZCC~l)a3b~|SL{)ee zleS(0-RXZ21ZN#4Hr+Z4j!QxNgf+p3B1@rwGx}}*IH?A)+J09wzIA(Xni4Dl*BY|^ z&Dy0}s$FP#J&i%iFY-?RZ%%wNtg9%tQuwn&L$FppfDro^E@cyS8HtZds^pKPnmRKG zwL~yzS@~B9S&RnXCsqa+R7P~U-|7pbm26aw9{QvLCYc2 z0*j9g3k9jg!gzjvf`oAsI(a`EG=|z50iWCqaxm;{64(3cLFL&c+Jw$HN}c+MnJH)I z)Vru`LTzb5bBou3^F%FZPAytI>>XO;l2R&Wf5njAU6=zVEHe*dVJTSt_K4DdV@T-m zgHlc7NgL(xDv^7cz0mc@R;YR7|HFrLaK!4a&=!y+86vCqVbm6oK7^$jC12bO3fTOPYZv*A5dmy(d)Ea162so5+v{U|D z{Y6rJNpUGo3yehz!K)(1RUgsa}D4__YSj6K~*LP$C(&KHy zFX)`1ocD-N(~Ybg_L2IISg@@(!d8_&GRaK<@nQw)U7GShZGd=ypI$IgaPh+X>GqfA z+1`<5OT|)_?Sj`>O%Uyw5A{@Wezks@eN)fj1Qv1~(i3kP7nWd5o?86eE3JRfFzgdO zP52AUO7~Q1NnGX!B4$1u;Q_Tr?F`E^8AHlqZB(5p=Z3Cq$v3M!1pvUNGs`a8?xT&s zaNA=hr*{ZBtmAOXs!wkwyRHd{;^i?*B^aXgg3(@6w4pr$Vrb9O#FsyO+xla2l8!IggBP$Q0j=M33T$QFEl5A_>PN)OiMqHN zJ|3%vs9P`~%D`pY43iV_o?sPdA~Nnt2}FQEndL`XkBWf@Qr5!Lt zNFBNyC+d}8x8J1)j(CQreTBqZ0!Wr+Wj|ozD}p0WDY~#MG`~eN4y;iF6n+FLuL&LXB%hvgx5PGGT4rh9WtcJC-fFr7#^KY7TU|%VU<2QHDq0rsPPYxU zv6Fp4?VeEr(`h${yjE0)cuWZ^fWed5b3}v_N^oB)dyeln|Ghe#*O~cgbhZ?7Y}A zgO+QM`KxZfJ5EjXQTc@W>>JW!M#%n#dlf+-ois(!>J?e}E$Q9F;A!%n&S(8l%pvJN z2o-S8BCi6xt(Qc=*@)P8OEAo2MRt}ygNJAO?=HPYjDTt_TVe62y6S97U%nMaesgqn zbO^+*B^S`*dc9fYmZP`fk>qC3ZbUFBI0Jzbos^m!mOzmreRI(uG=iz;V_p2vMu$gf zDm6xi^PxEEMvX>2gsNndlmApCyd+^a2j3!{u->%>kl$MFtWW)gb zOx7`y7UMO*|3OZCdj)cPhgtrwJZntOb2QQxq27iT@H*VpW-IHr8km~WH0daai|M4i z+qvpdW*6Lz*Tnv6eV`zc15M{)8ysadQX+UWPm>6;VT2WDuJbvdzfwI)PT1ecJ*t`F zt?R>YLd-Stu`ALjmnBgoS|g50zc;&L>Cr3TpVeK^O0}?o?xxxExdLD#zz~T-i#~9o z!4NLz?_hyS8|q%+0EjzvxC;F&81MrM#V!j4?#o>%yo-UE9GweE5Jd& zex5bI*3a+>nh9ftPIp`#Mk^QJMYwc~VEZnEhxz%sf|Ar}_v#}NL@2Hwd4*puXAC7M z1rfiK+uK?H(j6Cc+%xFdi?K)e=%vSJNP4?Mn;e*~1pBwWwuTi#x4Rl;Z-Z4+blwq?Y&eX7za3_? z=Yz+oQF}!?uk4?CyEK$^PSjWUMCG9IRObOX-(JL0VX&spzGqg&lBP@qdj1nh zLgoyIGSRHr^TVp8e6EH(TMH?FO;JI$Bgn9skfd`emL$`@=@>oBaS=4Do z*1+%NUASJhG^(3;kA*IQqqh6*M@+IV)150CJw&# z702)=j8sN|q#j1VSPXa2>SEZfiOM119;Ge%u2QfMJA z29DAT9!x2uEIjolHT#A;V2*(Upe&=~B1;}c@TR!-i9S{LQ&E_F*hXMhD!uA%hzxL9 z02ER9=$vUQz5u+7o(5zMB|ZN)qmHp9=6K?e$cosoApC?rFV{7nAn3T{@#;H=aghR0 z7+W^$#gk87ejf?MYanRxnX#D6dVAriQ~p2=pYpbk4tPLjmo9!yEFS@!0t6LIG^XEd zO2@e}L?%*@pFUIJ3piQfq5IBkcDW4K71-1~K->=@vf z^=Uy$O1>;pOLH%H#K+lHew8x-HLK;+>}3PSF0>o8eClQAjI$lf(Qfwg+GLpRT-65W zLI^km$eHya#Mp@0l!g|96nYd#1k9p>jgNHU)CrWwmYR@{<9WHFO-Qg{7AzbJtY5Oxh#NOz47lap-K^>%waGprvkzxmZ8 zWDr4O8G}^JQFhU7WzLmWgB8xq{APbYc!WN6oDFHtjW6JabNHee>%J943!{-=b^1dL zeb3EyQ^y`xnp%l6l^b&9_Wre9PM!(&gkU1hvALyuR_u*hq4bI$uj|CWh}{UP3FZppgGl!a268Ta4GqcuTnncUCP?Apz^tJ zOhh`jVR}ph0`+(3rX2Y}SBX&YdI|vkp5y}p$T5MFk6U1!IT921UmbGUoKlqdmh^vl zZk4m;Z%15*;^!2o9@a&Pc9H1MatA+>m4k9J$uFDitCl%(qGfZUNm0QOxrJ3&{zTMk z%xy7*hFk?*MC09LP02`Ru1$)(#vK#p{g&#@O*+WLAK_Tb$k-Ny3M5Fp{h`F73a66L zMBNL?B8Y+$-6SN62&D$Ci}bAKl~C>%QCNy#3H0GY7@I4K5CvPLzvycQYBs~}?zH=m z(c}B7fTP#Epa~ks<29te-Wembz>dxuKBp_9qxJr>f~+LaO6B?B1BQVEqmMI=eO2Fo zglJ@)sPO7tFuUOmCVmCP4oe2Yxq>hv9Hk#by)#IS8dh*}}2>l4fCpGf|PV!dM;HD8@BA_1O-DWmPlu&X;o9Qd#_UP`sjZpB8 zsh}eibnS>sL8lVO^+?==WLf{EFi!87iA`LD0Sh1l^twVrJ=;8;$b`Yv(cu$QQreIh zp;v{1wg6vMcp#e)dN+rp){eROoXocH*~Y{})EiA-7-Luxg-7d$1qEr}7h!ABlQg#_ zg<_mnbZwI14AOq^0m$LBKk323kVWxTNWm9NRS?`Mkc&x&j;}4UWKI4bVkY(J|clc?_{+Fg%V*` zx$$_T6eVMd6IO*&r#y+4>sTeiB>MbwGj0gZ-@G{OcK2$@&Ttw*qu^uICWE{TIen3M zMe_o35t>sly;5?}<g&K)5 zy{}E4HEK;~V@>4w@>?CM3L=MwT5a-Wvu2}e_?c7nA8ad)FL@&b`e!kRrLavcG4q=d zAS^X?1vYB(vY zgLm$N9{Uzq88JLoiO*2lWs^VrT8ImZuKZK5?kYSMMHO=A`=W9oz-;J;@Rk}B1g zuh_l=;v!5NeG?n?MEU_PC5KcDxHn=YijJri@-{neXH`9GW4V8&=j7w4x6~Z6JjdD- zKN5#Qe^eBaEhi;5PfApnvY1btX+U`#*p8g&)F}#h5$qKs-SRxEI-a|Mf1v&rK>?;$ zgV_gIQdEi)!cr>S@j>>t$chUY&ekz6t<6)n=ExTy?*JUm1W6rKr|?v>Hh9UjigBDs`mHT;Xk~@RELU}^Mi>f9nfe;8+z%hYYmjFjeFa`8-gxoM7TNRY)Urs(y zKYTfxYXTyj5@2%ESU7@9j1-g>D}7PTEnsixHCUltz4Z~%#7D4iFN^!x?Rp8qd;bWU z3Ffp^Mr8LCyHVSTAobeGe zOb>6e@_-PP9`TIifJAwi4eGj8t1VLm(OBXT{`d#gz> zI5>tsUi4|rLH@|d*``kdAnK&oG<+4saRFC6!Q3kheUeY)?*ika`h;kovYk=4zU$QokwfzCm_<;8 z!Iu$S8tw%4{9(HMUKCHPoJbbe;hFv@1iP=Rup;%>!bR}!A5?kO4B$u5bklG@KjkEJ zSFU106q19^y*#;VBMVb~&Vj}mkfTE3-uUniXNvnz`*Od4m|KWO`bh0qd7{Xk(zJ2U zYZvZ3h|rBV&BX@VMcc0g4ibl@wEcgX?y6*O@Xm5$kd}95OW3ttc?x(!d8e>%P|TeXR-PK0?-_*=~iS?*jr#}571+{U-A8N4BT6(JXXR71MUWT zhJ^SV?~f1#%=u9h%y-E@zJaG0aTe1N)J{zB3iB4Bh~HAOEI|}X-@s+1Q{}*77_AN` z7NFVg=+AlDnMeXdWG{rcUzj)g%{WaA=o}5 zpKayucM=#1arOBEHj?kL8@7B;~HcqN&n-j%ie~P zvcn^Ax6x&L3}JeF5jNhORsXLg%wUa@VAa&1D4CiE7)(SDa&9|~K(Oyoj4ob)u_f^>V z;LPx7RZR$vN5qLX3z@iR+CLL24jvN&R9XE;vgM9dBxgbU++T8aX1~pvlXi8NnmP#0 zG!RcAD#JhD8>ZSpwq%;m;?a(!dczZ#8f7HXl>lbBa_BhMj@&jcs~b zP-|N1Ngf9C3z4|vQ4QKs68;2ak2-y-&kR^|>eZ$Ir#k^vw>qvdGztMO0~cM|1vuei zGCf|K;Iox)DNpoQMY|E@iXu z*ix<^UMi#4V9}F#!2rcwuEvVM6?%1`NK4hDs)A@>2oSEpDC&GG3sjwv(~;q*j4|O{ z*bb?5zbgrrliCrwhf$>g>0iBm*tuBh5MQ<2OTbrZ{~CL8ahG(ix@BXD;FMdCV@WNg zLv2+j?JbCx5+vz#4SDq|y<>j;A-bcnQ|K%Lw=8i{_ybYSY>v6q2Bm&?swm*>FoF7J zF6mpWe3?c19O5jPddt~!?CDX7^3+%=8`Q;ZuvH&?guP4GP3@t3oc%Lx+;QH_VZvD6 z@cu**d`1q8eSmr)B;0`%)qAruhN)rHPZz^Uh=hr$<<4iwdDHl?YC&T$oS?>gO%saQdt+@@i*X>LGeQV&e_^x_(6)Xp8+ZL*xVnN-rgy zYce%dL-~V0{Ac{1*|mgB$|I-@fJ^)k6e1wmEwQw=gU?VdHRw?gi!@<77%EVRWNh0G zP4_tadQ{6AjRg?lQoVMy|2d74;oumz$l(YG0Y2nR4mH$;Q~JbhEL?4y_8#`Qv#SO9 z@x<>#z@P+*MQN{X_JS+C`59_rM3}U@{~sjZ1eU0bKFL$YyH<1o-uf2x4tGkwUyvY4 z;sk&DZ51)(QyJ2MZ<33pq)G_^6CDYj?>o#of{sSHQzJ#Dz^$FDLq9n@Lu;YwSr~s{ z)SP@E-je{6!n(W1L4+Wp`WfHondcz6;nn{S7mEv7k&YAPG8pLOir&gUDGWdf-_O|M z+U!a7INzwOB?JlvnQhu2@!_m1W5H^ouxc}Pe%3_I-zB=F;;;L@HeJH=8PqI7=%3T& zyUh4J3%$qLf(!!X2k-cQ*YtC{Uy~6WLykV9m)}{@TR34<9VP-BW?{wt5FzL^i4{N5 z)&;+af(P=1fz?7da1OuHM31eVqPt5L#bRMkVJFNZabR`0sxAs{*RKVh$HI zd^w4N^WHz@Ch&I*Jqf@|j{bV)lh&&IG8a{`QK`>SHG!J=eqNdg;x6Ci^MkZ3@5;a@+`o9iy*I%iJD>8?W3zO0oiFK@n?X^g5^ zW|Av@LKFBLwwt~LAg;K3m|ZsSYz#C6mNa~&Sn!7Dq>CLGhs73bNQM@3oH%N!5Q%H( z4qCH>_UC?!ofxpETk_R{Xi*kP|Kv!5e;Va{NKwNYAs$x;652+6pmP}rQl~CiII#8L zqj^U+b0kZ#RX4>NnnWyRE40Hd@x}p!#^*^SD-y23hr$*YKZ&PQFT{#+ivF5Ru?@?)GcQOyYK&N+|TrzvYgdDD=6Y`tS zscfPeXmH7QfN$wXtrtcwsK5-jUxZP!zC2SlHW@?eT9|QEVs!y?vKd*n_=~fksNGWy z3vPw&2Cc8Ar-UOx5t!+9_ zV^BlZNSvp5Db{rb-H9R;(iv}8^IwaPcq|^%5Oh5dll*Re13JdJi+u=Fu%pR~-P1h7 zY->ssHvUCFUB=@@U(_Gh{I_PNV7yGo<32MgOqP!P1Zh;tgPhmGYo!5%4T`M*bCdN@ zi8QXP4UjZ1BD!eH(y#G9!~3VyPbrIRP9I#YKEg--W=a!nP1Ugj{8L>!-&MZOiNix$`fy!+kM?v~f5z@P zV|BW9t8)qMfShW7&_C?^C&2#JPeeK|s_e@*#b3!C+q1zrMYSW?`AF$OyQ+tt^W(o| z71Xi;aJQ=7lq3#E%lZ25J{ox1qC#4^JO{$$nj&sKa!yBov6?J?%amnqE_T7Nar$s* zwFyeOs`<7dvrb3>gB)$GLGcfxc!$grYL1|A3;8ba4Vx%EWuTt+oeG)5G;$t#C582<&W?oR%JeZB*7$NnVcz#*jN-}y)$x_txFaHkg7p!`ws ze-cktKKpg$ItftQNw14fVM2RsndQ2A^oLDHPC!~Y@DJD1;C2;;Lm=7d;+nETJYQ{x z|J1D;FM|=1&&p%Chg01uZ$AO0R2MZ9Qcp6gZ^u*eDEx_b$rRGqP$s>PthrQ`Pug0B06A;L>P7uVKD&k05hS7P$~lhlf^LygO#YVG$*2X>DwPj#euu6IHCCCr4U zS>dmPbFwF*3S2Xb_BHw!`FUIUL!NP)d`hm+`4fOwzjsKVd)L1!Fh=#q6aHU#_tKlf zo#?1XyRW)gsqPt<4lZt^?MTd+k!H7+d~CLNU$Mb||Fw1C55)d**y*OM$I@ewrWX<4 zX}aKGn%wQ|5eN>aj{quWq;0iJ&jsoo^QYS8%t2YrJ%h91pYEb|EhrGw8J{wM_B4pb zFsuZT#|3nMPr>Gr+?D^-Oga++(DW%^jj(NwU!iGmCw)Mk_I8aY)+0s1h1Eb>w~J%^ zAT%9W$g~#M#(Q_ZSh4SzEp!e~isEK#Ta%y2Ah~ekec%a_fl&iQcO2INfP`f7WE>D? zrVxngOwDIMnH)>`1^wc1v@^%mT^O~BGksjcJv$^7bzae4jr6HeD`BHq5>@xthOE)M z?95gjDKJn+oD+Y4_ywtwN7~L8YKD*D0#VPs0>>7pMhhz#+Q~Kq?Gt`X{Y+w26%^mF zy?m22v6#9fmhecS01EwLGKq>%8lDLmz{1hB$;?NsQKulj?Q3jm`9e8aD{ho? z)7V2m;u{?FYgvhm)s?=;!lAT%!#H_8#1rjj>B$DR%p^7b}OQ=VVmCLUB71DTXCSs47?9iiy?Z52@S&oGYtizio-U$xdX(JY4i(A(Me6OkugmNbjZle zW>pZSGT^ZxmAgd?zI*oN+=<>=Cpm$3vC6gINyi4}ATkMAU#EutP#G>G-~=&*{z1_} z;8cL1kgZ)F7{8H)o3JT+jynR(*HK^WPHKLXvak zS0kDRq3A!fX#ECd{Iouz`bOwEFD{06?#wv94aW;8OmGU#_vjH7zKdpkyDC{Cg+`&y zRn7jvk5D&uy5qkTPp*l`(L?0AZYn76~(_#)pH?TrGFO8G&uJy)_1Z5lUzIa1?1?;&kCuJ_zn{ESjD(d#9KH(ZL!9QBAzbC|&RI1Pec#aY%% zs2p4HgDl!2R816DRT%>{VxaCy>c^Zuoe8iV4h$lx^A4^hf$cDzzqS9Ui{cI#Y8TOa zFPN%6zD5@lS`?^Co{ew@jb(C)B}{%;SyY<9Y8^7{J-Wv}Vi1H{u=6rS9;$BeGXQKH zVhHhnO~=2~K>N1(x3!pB6r1r@%Kg8&PMJ5-5K;KQR`b?VUTDbm7pB^cZ z(7F;_Khw|25l^759D=ks?f7#t`9Bw|T}taPs|{!GePVwXrE5ppCYCE_F3E^*EP_?H zh0}w=1C8*6Yr$dNe-EpJ-a)>&YMx7vc7U#tfb=HwN+o2=J;QPoEXrM;!`XvlRzJ`$ zMzWVV7Auy8QZ>vbn@qmbt=?~zZx8GP@EE^H=}Bw*l-c=QTt7oGt zMx()buYXKk3g@atd6&DB1{UU)OmTsAkAtD^zM%;VhPeV;#BUn2HEzipRI2k)u*i|L zgIF2WYt>o9_(O=J0@Rs%?s_-opBrQ7>2}}kefa-q_W2XNB@>8ZpK%DNFn|F8^+MC8 zdJw9Xduv&J8;D3WMbV08Cy$&4Z~1*?qsk0&;p0ThbIC?F+4k-U;AK-p0;2q5X#h) zeCTT7S!jv}(62D}bT0WvP4f$2VNm|z%D63)8=xMq2Hl_4tGRjFp$FPo-RvB&4>5k< zz$3dP`xm%wqip{tGszri>%LpN9n@5Y1+Y8WUS z8wgFPOx?{dD>x6OK#)e!2idVqI!B=mYEi;`(EqBzJFbz2;Y}u_=RRk-3j$F!4y8K| zI+O;7GU}o9PudrC6+0kb{zS)R=e=l@gOqbtR#0#QagvB>)TiIEn|WeC@ixlJswLT_ z@qkM+ri`&~#7bQlJApzYLt-i6eD78FSa;~9yZQxoAo)~n1|GQ_4bxgW{nI{!(F;Iv z4}?ec85Z^AiZ&_{fIvN-^Kz3RUG2{KZ6qxCHkpC&r~o*o!LzLfx7(nxF7u~mmAdNw zuZ^8g8(So+G0&5~-JWmas-IMis+YS55UKF=$x-B{#bx3@#C;(>8ogS<8N_Zwn7w#T z7h`BLS9e#m+{fa}YV{0AkZr{MWJp7OO<3_5uoE@rgExpaco(xFrUD^+voh4Zh2Gi= za^)0!tK^;3MaG>ah~?Rz-jqxNE+Y{P0QQVZOzN02B^NNJ>Ceg$_>A8@G$oN=1-sw- zNRloC(w?$1k0cg;NR3dF;+GI8){o~f7_j?B+7Wj2EjP8B5r$RJwb5+uIpI#VL>>eQ%4E)$JOT=rTa22lUh8@lIJ_bG*2kN z#vSnOXc82(B2CLXU^y7VMOl7pm_2OTQPbz^g@dP=YCu^u-3D^9d(+$kY}XJLI6M?! zTOGwmN-z|Q!|8E&OLl-b&S6v@C*W`@0IFB-{u)1^#!3%%HQsAaN2(m2^%Q4^3Ofkd{*iG?N8G^;`G z!GlND;K*cI%F~ z+wy5i8I^zmZW}3-#q&a5gbq+OVC-5<$1TLE2W;;>J1MVgd*x)5?uy}U{V1|lhccXe6cV3TsL1qy$M5zD|Lbk#XqtyO024$4Kbt9FEg-9yVB4 zyzeY$fSX4?f}TO-9cZp-ty&6`mi%2LB?PYsxLk0} z{mbLDbZ-b>=Xa229=s8d?4FE&G7qSHFLF5~i$U&}yb)}d(voS@^eL9%{>_*_?_-hZ#O0@)>x0Y$+`UGg zd*inWPSwBFWXPD|a$cRt`ZdEzmWB12Q^M*{EB7%)1!Q;`ApwXgF?y$pm6A}>V62kB zxN%Owl|eL)(SSy}WQttzn03U9&LL*-&mnpwlt(1D2$Z4QcYGp-h4jCmACLM&i0M63 zOX|7PPqSKCwjD<>T3*}iij;G#XlDXOyHi2X55iTPmvV2^LK^huCoQd_WjBBOz2Hik z1in90X8foSMw&bTgC$^qigOF6&k2$WqemxugLiATLgZ5q>`Ge}_6WOqaDIyL(cBbJ zt(zUu0-$5u@wP>VeY@u|^@;AN)kC&2&bT~`J%n&uvLR2i^n1m?~-`WT4 zo6LUk{~X>42`7V-E zAXK%#Gj`jVyHsGgygC|*It|;LaY!Gvux!bdj3o{&bJ14X!nBL=cEDb6L zD*sJKos)LsoW6Vh(CD4Uci$I(nXy&fs+15JYlvfo7E)gq(+8dfNS>crP8u*{SHi2! z@Xt3hrf;S`RB_~9ZkOS~?kzR$Mw}lu(z$1UygSr1Xk?3x`owP_ff8bVQPWNGMi23T zCudO|#Hjdgn*{i< z_KpU_LLJ%Nw;f9-#Gv(*uryaZOCnHmL$;7EKI%GS9T&~(if8X1ez_^<2BUg2wOXVV zYL9dq-lvw@X)If5&3-Zcn)Tb_DYmNy#gxQ7nz!hB_sDTxn)AunE`2Jzr)_)P3c>=^h!y&zJ2P&qQ60W#}5?ngtr!aIduUV&Y$PhJ>}FSS$PsA zIN0Ts^2YoxG|nwQaCg~c+YZJ=@0`#iaZ)8X!2W1%ax{m6ZJx(8RK#)xTHz~RAyDrE zPUgrSnD zw7OTzQXI^TEJ=X7&4pj-RC|3NU2rHF-SL}sU=p6X^- zq|izS_xtP3xnc0h-te_K%{$fO}O~d(M@(L)T+p7{)vtNU7tSPcLtpipblCv7{^3XKw>5Lx-wE z#OkXMO&fZNgMZo*CCxZDQ7i0=)jSf?OmJT~z@wn>ZcgQzsAze27cYrLAix%Ko&@YBv0kyVb(H z93gXtWC4-N`Iby zOsN@flX8BQpAqnpiRMr&uu!wRkNB*QS0w3t%6gj<(gf*w_}~1`1Lb_PsZ5}m>@D*W zZTJi-?NvlCQQgg_wC@1K!XunQzTky8szsQkA$#aBf^z{IVm}V0XaQuR>eLV*18+Xz zhT71tor6F*zkqlK(`2xE^t;)C;AVpZe8K)PaG(uR zFYZE$k=`W%o9UEffDQ#_A!YTTBpj8>AU zb}aF;<^0vIYJ?k0U_M@3l`9Z0F0MZ{a`w=1c>cIii8% zh$^wD{1DG^gy?wY7YC99e1iqiRZutOaa9*qWnhWugW9yWMrUmhpSaOxRGaa<6f5&{ zTyE>n;wD76&ZcB6yce;KNl-=^sb@?dSyAJkLhQs>5+gOzJJ+qUeXZ)WXiUh=C|~)D zK`%HT){Tj14VYa7e~+5J2PjCf5d3m%4l9klom$lZ~kcw>s zHNuaVaA5psl!vW#@L>ak10P*3IB5Um8T?vq!{lKBC235G+Q*pcYpt&|PA(+5G9#If zu1UcztdD|^wuao}f30RbHX_?Xj8XtS*x}?3 zP+cPci(dm*)DFf}8-SlaiEYtV%YwYge z#}NTMjZ-6@3}Q>(wWz%N)hRUNYs|)dUca}g3Tnd1+L8;a!8Q79_!IR{-;x81ViDda z{X5o#l9;q{8={sIz8L;!`sqd0Z%OOnM-+jxdJy&(N`WP>%Uxz0bj-Ev9MErd$WS-4 zV}2KS3L=R%9LDV0AILO99~e*n#ZgU^A&8;)ljC0qsJpbEUp=cienlns!9tRZ{Ej~Wymiga(3KaJXS3(^NS{S& zYSPl<1)k?ip+?~m2WCKYxs*}(6wfgr33d?V?GG6S{lh!2SUW3XxivRSLHviK`s`GE zl{Gu3%MW80XtvGhqyyFsXiD zJstIqjttvAL$C}Ypce5ZIfq48q#1&&>#Kb>zJLAZBwchdkj+Fv;| zw5EcU;Ljk*vcod6p)CIW8xwlcQ-lNS@iZaYVrtS)0zEvWZ3knu&!PJQU=$TY8v8Ef z%Z37uRm1jjhw$1`Z7H>^gjr3FS7w0FmPT1XSvU02dNUN`a7<5b%722N=hk>%q%2F- zR8+&^xiJVOC8KF4$xYimOfi-i98Nx_+#Q16hU~LfJ^{8@OBdoE*~e)7T`=OUZ~P*n zMW?ERiKa&@YUjO@uYrT&c0xN>ouWzK?VGeS@yuX6on1lni!qIE`x1Pfl|S2%s#4C0 zyf10-`Rp&%d}K}p#Xf8&>i)pdtkHD-;>re5n@h_H>B_+WV2%8<@WoXNw?jlR zKzb%w-*p{A5;HF_6PC1!R~UZhAkE;Kz7UQ%RTowz9&j~Kz#Rs+nK^?srzpiDfbyAl z41#!B-0&#GHM&1%T^SZ0-pS?;=&{9vdL$S1o+82iL(#}kTdj86Y9TZz35isRp#vL2 z49F=Y+0VEd#2*ea{_8bRO1Q{&_3aI!Yxq|lyap8kmWQqO`U-Yzlmna(xznFo4*dcyHS#!KTz>eOmW|L~Qi8sGIYM_DZ03;G#9 zhdiP@sTZ>(UzsVy5@5!lNxx8wr~E@M=7M$3=JcwTQ3POl#g#-nvq#!Ma{TLau(^YE z9iPw?EdLg27ngLTj(B0W9oG|m>37;frpBfg#cxKlPXUXwJx1O$VywW^pADU&~Rp#qOD$D;9$^I zU5~!JTS-$ zF+rBX&eF-}{A@NiF`#KV56cEnO!uM9o<+w zF^fKHqH@$6&N45JXNPyE8&OWALJm)ud*^#<;#Kair08Qg`%J^Ys)H1=s%fG8Mgti& zWfY|+3RPTc4QeECC+}JEY@5UWhD*sqQUfRO&_LUAAAu_I_J1ccU7RtJ`DVujo$>SH zAk#dy>fQc+#tdc|q5yh{6TX_Im#GZ8(P90jvsd^R4&h<3MOI%aYZ@5WxuFeNa2LY6 z;KFdU&kXpDt09}?_2MccNFQjU`x#ae1R>YU*bUSfoiRw?xLmJSIN`3Cj=Ra*QpphZ zobjP^)Dw}ZDqwvYFPnoQj`V-`9eE6bCwuV<#U@ZUuSOHJP%sjkv#|DD(D0D`=c#zr zrT7FR1x$b1?zH;vlG3^7K_>xV8Ij`*EDjEF`4A-L&Mlz~h2BaHnLP0}5sJF>Jy_W1 zU8WbwV`La3m|Kg7)m#>cR?lFMnEB_YJN#5->iNAOvFz`D#UW$RQ;s?{vT9JW4n|)z z>ag&bG(~;TZZ)7mSDOD7iCgXx8#o<8mnfOHnOn3^@2MK2vy7$DR!g~}S4F+3H_grX zjZ7lI!|BZpo=cqR6nvs(b*sL`T@^B8WW8XN@fc;#N&iTLI}ERkD&Sg6<${u+8DmB! z9xA!TR*zc)ScEGeivrhEGmZ^hKrMvLeBzXl@fRB<-L|5$>etfUo}033k;H;M*L;FVh>c%_eJtx8e&&RGXM% zx1z%S`uYE$_13D5?T?k_bv4FpP>VZ}b+}t78f@vmX|qTtM$oVcO&BdbWc$AXi-~_A zA1?!8bJD#2jSwXeXjQ*W-p0?^by&I)t)<3GO9AYbPPNuU38`G%sokZ_j@Nu%sO>e3 zmFcxkqNez|PAmkbuxX*r{Tx4FTK&1)g?@*COi$z_O4w=P1{3N4oSF2hZDfku)L@ybH^wyUvG$!)<1H%- zOKp!E_OSI?jo<>P#X-3 zJZG}ra__y}Jq$U~!IVbGLlUBjfKct`NU6qKdd@Dmp>XI39up%0!yOchy^c?ywmT;| z_qg}$>3^uYeA)VMAb@$_-XV@Tfx_yJz4R(qRz!sJXJR#*(v|7yOU)MfDOZYPz3j~F zZEd?&dO_bsl^EWD;v{-NQD@e(FP$pGY9VWgfM4G-2#70Yh;{k!???9z}Ggx=* zAW|sUSanEIp{fiTQ@t>=u;w4koQ4!Jivk7skVxf)yQI0EB5#61 zosKEvD4n@P^uD+3#vwHvkjSoym=^5-QGdEJrftPRKu2-=%jtK)JHtju8Ph- z2KJ)n69c$hHv~P*5}kmlUA!jC@s+g0t<%M`VE0RU<{qvQ7g#*anRWMra!`-BZK!-q z)|J#Fbda{#?-h-IL>u>y0$$<^;g(`IA~y zpx=uXT{5K_1qxjM6EFxyteVM&Ho!}IMooChX^E)=gkTAbsM+kPH}=taT|6oZUA*(3 z@ZAJjX{-hfVik9GiA7L@jX}T06@g@vlp?ClQLm_C&ROhg)Ge=Bqet9YeFilEbW_TY zYnGz{QIF1%X=t`?qcdoErA4gyX^K6d?phiT{PWWj%vJh}_k`)`LrX zcG{xphk2iHQSW#tx~`Co$6F9LP71>vcVD~*aO8qaS&_e)%keNl@!GraOmy&~fIcEM zS^v;?kKnU{U6>@xL|VQgMR1_L(uqF^2zb;$SjkO`UgA{#+6~2@ z^Pf->Zh_rJ)vZ39o*XV^3HE@8TO`M7h9LNm9GbyuJ}2f5a7Zw0p)F6)9*!Y30fItP zx;NY-bZ&t1Vt}uNf5uFK3f;@bVzugAbQ;Nnw+V>>MeQffTxo8G;c1?ySnI$DP!Y+ghA}*DYnj_C!%r(%*W0a4=o^ zxKxwmyX$;*XZ{Luw4!}xYz%heXaKZF=e_z^?)gFg3x$%an$3cFa6ap1eICwU**kZr zKj%;oZ!1xz`h5Nj{tQg^O5dCK6|{4NLGPgiWx z1OWxD5!fsj_uF`b{rrM=NDh^%4y$$!8(s(mymJQa0}_15@#@=;j4n$a5`T2Bk-9(IID=6@#YR7%y2>S9>Uwe zDqL#JzHl*Dk$9n2cVW0U{xh*%VG^9*Wd1gNzR?UcSE~|zMfye)t~_H&5Ii4^Wy~fR z_nOZTG6~*^upMP4F~Gpe5SdF6@e5ce;;qu{2pxW_&i9w= zEU4JpQ}k1>jn=Gz-pBY3m;r@cYt@JXg*(z}FJK;Bw6I8!hFrM^)*wQ_eeVQkP9h!H zIB2LRrIM?s#a};4o65q(5{+wLW#$tBq&~Sd+Y9%QXq41vPNj19-6c5g{*b^V4|K@` z#K|s@yQ1OnkhVZJSvpP4b!c z&t0q-FgyR;BTxa>@nE~=2uK^U8Npht2)x)dwV{HG$iYa<;u9NDb3tv|t&VXO0OnB2 z98}eT5I0KH9_J>z#B93N``(G}HB~R0e{SWdUj8znP|t2kPM)Us#+Lgue)%-@dRlWc zdQIq#=u{H$(JSQonkD20XQ2^L3-jkOy5#-Uky16ZT6KB2>{-K~4nB%zDaJ+303Kb0 zbdd~V7uH`)_FOXIMhBybY z&l!j>%;AA(YnC4ZC+-{Bsa{QKLmM9D0dthAFEzDkAqV3@xFAV>oiO-}N@zDTvE5+G z9}lHXmP4MU4Pm*^XX*&Ddh|DtK#;3@9J7^ni(kMHRPNyigdt17J8kRnn5e0M5>}PJ zjNn!|NCxvt1c}?IIipeMak!tN<4CnVThcglA&JwWAA_0p2k2vpT-*w1rjBF6Sa|Jc zEuD_9ICq>qkFxFKv!+wZ{SE)gjL~3nyLhl4*e>}d+8-LDLDOZiplVvlzNq+aA@nlN zAGarAnv%4Nyhu8sT^D{GMZi1unS3+x;o|}<3&k|S`y&}~7ND=ZYm<}CWpsx^3dbS-z5WY?)ILcra;)+u?$@I1WO-CTE9(4!_NKGpxjlBs6@yw@bogN&+wJ)u_MzlIeZ>HB?e zpVjxsmvWxeC|tXZ{CCq0R#Y8DCg&Nr?clKWg2jFBir%WM37&e74BkC*`B9PRWpl08sK^sOazrV-rfEQPbdIYQXPH=yrb;wrV3r^eL5C;@jZso9!;B@jNe;>C zX{(phT|64WY_s|4pxv|74B|tIisgBPeDsfzlJX7Z1;PVHnh9uvu6|!^h{3R{$1_)4Kmj zd#CC{@7od!Sk-f9ePOnAEC)2dy`OkOo7_Bf>X0h=39QrU{FNa$+@CrsM7O4?6PuVk zOO@D#S~}BXmO4~%Pf`<03$?RFP;oN-IW?Apy&4x+0)+XKw8Trlj82O1v-b|-mgsUv zi*aL~|D;4jlG@&eC#lHkZaI;{#WS#oUbqCss~XtpJ*pj~ol1}ms0btfM%-jbCaOopAcOR%VAo&H z?iMjWtbDah1SXw=LUY1Dv@d$YGlF;@zq#ioDmSm%jTVU2F=jRy;}kHBePx5-S4-mo z0Ou>TyH8PrvGWjfA8LUw5rI69L4>6u(Zxwb^qpWD*03vgFp|KeU$jV2Mr}BudJUfU19!HwzWn+q{dZ(@J z*?GwE)p8-uG z^0)X+N5MSASD8x@*RNy|jm*d3~p&@wz%L%1bl8y_#&oZ4u zN*WMl@r>u8?`GdB)27V)MsrF@-pA!A#B@(QVX}-rcv&VW=vu23C(~S^mD`#ndn(xy4q1zxDNDZFcW{SuI56>21 zMlpMEE2TYXyo~w7G98nPgy~LV+xRIBfO1eNV0lGTb_^SrlmXX_|&%}jMAz)OBD7)-#_L(9L&c96W3=3e? zTmLi&*|5&(I=l-AyPIG<DOJCHf!164Ub zDSPC^xO5aSVD6>O@hCNoOnEZB^o-CkQ3`AMIKS5pXziF{qcZ-NHPU;8d!ywtefR~O zt~8~4WEc-N^QxN64+UqjD3yT~E_>j1npX$6p|m=wuk45w3JXOKl>jguct?_j>zW@j zf)4ySoz>C&Db%j#&Ww~ESWmrHujv4q8bdtc z6PW?QlTU=BXTbobJ)eKiaC!ftSg)@)L4Ua26#?Eh``_NW4{3vqWD;f^_a8GUaYq|>nC^#><_DOopK<~d?=>(;X z$aNg*7(0ss41K2jE@>CaMc(}k8p4U}lBP4sR1X+IKR|T2;WRq*zL2_)AAVBmPK7T2 zl=0<~GV)+_q-CASb$+Nt(l!FB!08C1@Yp2e&}Ycylc@q?@`IJ~jpenmGEd@F8uQ7J z!}Qw3+$tp>&q%zaGZXn9pQ>)R^VL=s-ZK{>29Ujprz;(OKoA8?KzqZH`rY`v$?y_i z?~?SarZv-iHRVs3q{h4|%I1G^_*rA^<%h`=8{{+(crPLu(;&!2L<=cNB|*byK#10s zKhFwaiD1Ey#C!~*SV%f6P0R*T`eOa%PVN>jAbrFlpK!*+-?UVi>u!NEds}LeQ^G1Z)34Y0$i4FOkgGv z%#YJb>&kI$s`1jAY_ zqi+NKGLO*>&s}y~Pb}~*}sGO|6Enq5WY5kvASxA#K%n677C3FwSEhvZI z^U@}vzeWvML8l{HseqyIKOczC>0^ar6};!2An|*oopDnk)WEEPHE^z8p5cM`7$@or z+4YrMu!Ci;`iga}hk_cf8bvV2IW*BZzB;Et-fJj-8j?LDl<+Nd2y<~X7?(O5-}BBS zq5c{(vF0^7lnyuJdzuz8ry9k3T}lZ1oc_i(aQRuY`6Z9mJ~SpwaGc!+7$Jlz;v?z( z(X(Vi;Z>2L1|9`2k#(h-hWKP-d*jmvP(^nPB?N*4K+uAYQDFO|$zavErBbJ*!H;JZ zaDrMO9r-b*j$pmIT);B*w%6HFN}=(Io>54IjU537%Iuk4UZrr~eV z?e;ct=Yr!cfWcb2GelJMP&poo9t{CL)jcy!=-y?M=<$rS?3Bev82vLZISY6dsH9Kc zruWxKM}`Ifd)p9;ToN^7Hut_Ihgt)Hjv1+--syI{GsFUsvgM`}`MuM!QVRDraE^G& z{rSwa$Pv$;;~@4{96{uQz1Dmpxg#PzX{(1BLxvGq)kXJcjOEOa7w`JHI$4aTZ}bGp zA%g7at8OG>WuLL5x)*Y}05x${g&e?Qa?%E#j)jfb(u}7)u@qRH^S1Ly({B+z9UNmI z8G36L9IWv9cGW!VRyO^@l|5Md>iCG@4;KH(iA&-Xe7Ue<(hfm^*n3Y!Jx0U&pmcBD zhSI51EbAX#)+j3BVRlfyGtLjNG+ZjAFk3kMAM}%KkAW)W8h)?xnc9VDKF|MVgG$LQ zn%0~^mPr@pBc@4>fq3Z z3J$YSh;Osn6db;ijgU(4JCcm8Qhh4%P6>pQXbr)iE=Eqk(VtW}M+n3euVB#e$=O0i1M zuc4~Xf5aj%2}Bz~(hlG;Ae@qL-=zTy<_n&zZ>Sake+g-V`}H`#0UnwW()wmD;+x{s@u)<4 zSjl&%vM?$9K5OZq$~ufCc#Ykjr0kZ+tTQkjMsBMGT=0nBJq4^TMul$Te`Dd(6iSqQucQ+4k(iy`9nHL+0UB4nVAGTD^i4S*C6C#7Kp$6|e z3GjHPnt9Qj5LVa#i9KF-YOmxOM)WC@R4A5 z0wsiXY4c0lLqEH!Ng>%V=_on7>GcVC&@Q}>%`U=DVj`ECsN&VTvZQ=|w_gj9&3i+d zub%^bA2O$gCaD6m;4E|EE2ezWnTB2(=7DG%a8XpCVyXT}gG48V6pUJ;fq#rNB?;z^ z&fx3(37>g+tC{YR$yAg}JO=}7{91zW1dmd))=7szC8C1PiKBTYXf9_e1U}*G zhGW`JKMEosJK((=AL*I|aaH=IyMzJ>^HPW2PR#Tm!*6?WE6VbZ8I^v!B z^o+^?+!ma^)Bc&~_K*q6d|pcI9lM!aY>L*sSz8h}x2W243NJuCkpceEy1Iw^ljb@i z<&^7wYXJWzPo=WQHe=!F#cNP(=sfFxtDK#t-W}9XK0o+uq};!Mv6Z22TppJoIuN)S zr|!Xy-}M-Uuv(Wwd^5kIJ-#)Jz*TX$J8qy4@pPxchzl9qH38qq&gWdN$gj+*gGm| zLiNn9^GxKsXD24pvkyCmoZeN>+ncjgK=~|1!D88ncd@Qr4Nn9ty9t_AnAX)>>iXfJzRPZQIRLPY4;+A=vC`YZP z93dix6zNey;u6Iv>@{pow(QGDKj{*DL}dU0Tj5BCpLh*|^=J4&>^kvYe-a71#;Zru zo98*lh^3Lw)`w_0^Z&l8#EnEOKv1m|r0F`7V(5>86P?EN0;u^OhB}bDDeQp|2T!`( z+ZI3IZKmd^S(N171%j-kjw^f1l1E^0r(i)dw&AJa@1R`-r=20ioHjwlRY0O!c^u$PxCfS+^^WJT^HIX@*8u30F#uWv|B}mRWs7eF z*E3e`L?4!_9aZsQ1w@Eu8cC$p3_A6Bc(HB8X(#fqJVd7U_6$wKYNd#i1JY1iNZgrr8_eaH`pWNPt8RZESy+GT)aNHI7Hn4&bbP$}L{z2@+&eB5T? zH4EnQ8pKmRjN4NEEQeqUgr_bV^t}*pg!&o7tkTNa-L|lL)zMn@g$#bDd8FKvGSGwm zIW4j>Ck0J{lhPSNw$OpBPEN@_^xS)E2GC$mD@1eEy?|z=W3)P<6;%)N*kA}L7GJr; zL|gaU4PK_N>CEbB@ec)_c&+=@CD8(5Iz&t=Z!UQ0k2b@@u0-C^&`Hv|L&{54+DAE) zZ%TtC(7n|)ry*xV0qv83lN+TjK5c8^sVMRiz=u5cgCm0TCMcd% z;zpv4H-e)Y8y4{m#QEJf&~<4VGfZZ6^J8@Eqq@APFvjsh{nq*QhCDlBY1DDUxPzv- z(OfTlPIdLp2LHSDnHIQcxxc5Wd>vj8stH!in;p4yJhN>7p6bk7()8^l$4k;cpm(Z5 zAT&zCH`3~2PSqXfLa)H>rcY0tLqj!3zTI4~2Bi&Qg-VSSF|sop1h-B5BoG-CeRT)B zD(Gsxw(iMCzPypFQ1}~u7}ydI(q<*q8!VWj@CDEoaGK~-d+&Ce0435WT1cX%qB5Fi z;$2y_aVOj1JrZ{ta`P~>Ca=F%AV^E{yo1kp0#?q7+^9u<8JVhSv5KvnA zkh=PshS-cvPGeQ|lP&c-2{hpq3z%aaJ9yuCOG1QfA>%#-XQW&PTA$$)Ou)bZrD#E6 za-6{o+Zsb?$IRjA;T`21LCld6oe){QT1^~CoBGP5-67e)RC8c{RyAkq$0dnAAQaF5 zNqrG*a&_`z@L?D_9k?K>31VC!fduO5&Ug+^TwpBnt>)qyxDcC%_8dX9#iUJVpGX?| zev&;u@`UrsOH%uU@+p*k^RF>4-<0p8SLI$rn-fyVr~nBGgt2PZt9lx>EzRhx%% zX%vvKe7^)ij1B_lE_jRvew3&O;|559YZwP}aOKLt+BPyg_s3Oak6MI2I412DKpjzs zK%q6d-Z0$?e^p8?a(d%#hG*Zd4k5q$mcoQq^rTZP;H3sV49n(D=|pB&kjxMjR2S@` zG^0M)+b3x-n7<)Tl6lw$djGYmzt&jm{~!Aso*x{^;TgB(ZBP;yQ;lj2N3L8MHE={V zY@bWs;VRI^^sNk}h@UY(r*!k|(RrZVtGaz!S78ZaRf+ct^d6E^Y)rd*cG|zRSx|%i zMW>}|w}W$PO!|XEB2?x;QI6ujE^^xV`F0+)TcNwS9MB0%JN}z2r&oY0(35R?nJWqJ z!rfU#ApQFc7 zTJPOrijaR!Ro&^YfiFQV=i}I#RfkHLJPER`*@;7yE6f&n$BemBmR4+suLL$|(C7w) zD}qI8q75}TPh`oIP!26)Wm&0{>NjcH+`s63(l3Bujbvb1rgAytZXAuDp6JBScR15{a5M8_N>6ZG1k#hEnlZjC1f8%kj1ZuHUJ0cc zh};|m)K-?ziq<%ybmMC~2f*@6PH%8zspUB99tJ>!Ga%+}Y-YGBVk}Z#@UqT*Q)NT~ zN)DQp!?b*m63VsB~ zcmo`8J9)G-ELy;C(}T+=1^;0p8EiQ@Sf%FN#Xi?GI*Be3{pmdqZv`2 zTdjo9>#^nxt}w0;`$FzQEriFy%F#issjg{>UtZvzx7BbcPq^VoDO>>Uiy->Yt6Ux5Q=b!9|DBe|GE5b^M{u zXg0Bqr8A(wiV{I|u zGM(^S3>sjlTn)b)tCz_rwo_y_wv7Fd{#K7P@C92FF5>Co!cIw&%9j_ZGL87-l;?(B zg*8yJ%r)>^!;}6zIE0SEZb$;oXBGV||aQT-AIR%rI72@2i7zw4mWwb^f?`bni?496nAX+X3-S zkYME3eS_I4WF44dv*foeMbMftt!%na;JiC*&KE~k+*LoLD1ua4FYE*31n2&2)DB@7f(O^hwNJLU zl61SsA}of=3m^{6ZV4*x)1HSIy_?-n$ft?oxy-BarPU9OU5cxxNuXj zTYPfrFxdeISHsg zfwDvVwlWj$m{_}mCg_JR7O4(cu>?YlU zm%VaUTSmdqVcMx+nbCL4E2E^x=n>4ET>2Uy2$8#jw)<*C`so`kkAD@yUJ8#$ zx)2{VdS{BZXxXl=dw4Hl!bon*c<#OGE3VMQG78d}z9VF!LGc}S!J9ET(bizbiv<}5 zVE*CHDN`jNY?V*9ju4D4O*Av|#P(+xvYjsJX|?Y+qaJp~UV~hYa!Ym4N-`$q4*5@U zI)>~x@t9w#Qs5b7zp1%N^k(s&M{(f-T5w`L5hOW}u!AH{*@|FRL;+S%OxFY|U?-fJ zaBgyilI14s0i(GS)jezRV&|5!KvfeG*Qo)Iph01eMDQAp9bOuHkIEdgy5I_btB4$g zFnhEu76#|)pTEO6?avj_U3g?E)5LfMp29A!V$*l)L%K=y+_UWC!yJu!bFdS*{*%;$?WeF{tq&&N-y>A@R)R87-?|qb{DOAEg zm;*?IMKj{`u7V>DUgOGD73W=rf{d34W(9`KL*_tI9VGx9NoetdcV$|9OyW$Fr=R?w zIG4)~HrV+I1Q5HN$|oO0oUEO=zw>J{p08BhD@~aDw|oNjI-aTeD?)Z;&ez3nBkP9; zncMLltA?Va84|_oFQ=mQ6*ka{|4Xn7swHM-gnkdE0|+~dVfNi{fiqLsev3dukL{d> zKhkmqQ}K?9HlR2HsLDbga-8POdMDOhNmYvCM)c~6HZzi(Ou^Huf_y5I8KMd;cb^$s za+rw^3TG)r(9Bn|2-003bSVw%5T1a%6%lC!g@R?u9)torww)>M&@}G;g2w4ct~BgH zipj98LO_fH!`Rp4nPdo?_Kr(3e7W~&ppH>$17**{--T3@@p_h%X*Rv&2=fhuett6z zm@rBxeffNooY&-rg-l2TEzu*iDG>okQa~uTDYhJlc3S&Eaua_6GB#K7 zJzDbKaDt!wBH}Czf6{R(z10$a!`)y%bh0x2+!tk76lF6^F_cRX*YFahTh;+!rnV4Y zR2y9?)rjn_L~8U_n2Y+FIrPj+^8LMX=Y!{f4jN76*?dlR_=7)UWs^#r%$@4nS)U-V zI_Z1XC(FyLwlC`7L*Qd%N15C6akFk!2egHz?tx4#od;CvaKe9agN!f;C5C4q2%M-` zI}ub$S>9#gc;)8!{+WR!0@^WKxNf)&&n|1n>Y?TU>xeDOccoGoVk=c;3ZAlvKf|3r z#Kl;8`(3jB+_yWuA-ER!Xb9N^2`FPMX@;kvlLLlkv8Ie(5>@-{rnDU8`Xi;~ z-Q`$eAS(V9w#8%6n|73w%E3!uMS($#&CjblpzS3{Y%bDV56_a3XqxHi%@LQ={Ue0Bt^ z9u|wTKEPm*&?RM=4lJymEsXl`wEtBhhFd9R-ts5Pb9Z3m#6^QS_^S?X@F(nt91m4e zRL3kSsYmfeeFjpbzc2%sGs5+CH=VXzAa`h>%l=G8bfsh6qAt*}!X^*Se2&T8OrwUi zF{>-#_yyfs##e&OmC=q*8uf2*OB6(ig_Y!`y!95rvO42-sn7&^;0292BJdlICq{>iYZR^lh5{8`38(M#s&ztJZ&2`1QqLtYtP}$4 z2>m6ZW%yZHz!$2;T{Gn8`FGMU1Gryx*H^XB-;PL7jxVtonLV;_jk!t_JYgks3poPl z35drh7UlYld+!8ma2m2CC_?F3B?s(S;zig)ass&yeg+ue3=MiqcjIVLw$yq6SXK{`wlernwpHV zox$!V{qfv6JD5SoI4FG9x z-R-b?rCP_3h{LRM%(xXJ6K6(A&qO{RB_@iZN~rgq;K=_3#12@y7Gl)}5jf|uwWw+C zfR`FeTh_-OYlrSQwo$o+$7y{Zm8{By{bh9Ah;WHIDNB}D`ZlO`8L>aO39 zQT1B=ZaW-n|By;-66sKYQs1CL_;pf8kkc_k?Hlx;;+2<)8-cR3A%#Q(86xQA#2BAJ z5bK2?KwMSke+hIWU-3uF)h zT(PlPw(sb|-V|(1*nG^j370cWd3j+$l_0>59h#YchabiTz4) zhqJg8CDP$yL=q5wel?)0m-Dpbr35!Aq*c7Sl-VPpiZ*GCB@Jn3vt6~nhwc`*=l9GK z2eKpi;@8GHEL;)>WVQ){F=_GH^w#Gu<%zKqnHr{H`8xjF%gy*d{q9${sjzS`iQOqi zBUyv)_&yXFLhRq>Hxx``%Y;(<(!Ufl6bnL?8x;s@jq;NmT{^U!c}Au<^$puZ%T$8u zkc{ETjm}Q1lV*eejv6I14O~P8N0Qx|!Iv0MF!5NY3`yyg1dPvk*>?%P)rAT2qo-Bp ztHI%>VTf9?yjm;xWiKt+H_QOgqpAc!QQ4cCu2&DRR*SNHaFLCQp|&@7mYkRS@Tx%a z$pu~B-4Sd3NcyhP|4IaWK+=?nB_P7}8Pl)Cr)>xQN*6wiCUf3Mhetc@m;HnPyV+FX zt|n~)M1`FF%g#CPw^L0Cu){$%*E$CCe5?R(_7?|p`SRsAceW66g%7jW1-#m9=xC+~ zR|T(d$ao=ABGSi=#XV*8vyW-e>jtM(g>B202$BiS31>HSE<#0)84p8x!~jPt4@50x zQoRYJ!8tyiFWBV^*rUoV;k;9|uW_E9-U7juS5Vs7Qp{@tgCfOPwugu#6hHD^#&(Sr zm-PROszE4BWtP@2Aw@hG-`I*N9pvFc5&pCDy6E~vOEOh~6Sysv3;U=_tjnP`@#TtF zE6&V@Lb$O;6c=ovc=(b$Gd2*{bTHK{*w9hiive-$fCoC{mE?qpQ=1!wm43&Lc(ygD z12Jd%c7{6GwRbj2dFxu}YU7!B%1S~M(gW&10%rV4%b!cFt+y`u#XrOx*1tH60{5fx z0*~PJz=yDm6h;0%&8g6{bX0j#T3Yh!28nAD=dK@6ppY&33M%(dzwuuGqF;Szv^&R~ zO?w)L1<4*ja2nf^k;3jCzdg`6-}hh~Sv{<)i-)QNBY`z@A5Q!=FN$LDvk5 z8GnL$g-d0Zq#Z))N#-Y44x3o9`V87jzlv>D$xX2O5L|>Bzk(lj(Rz&MQuC(^exB zbS*bw+@A}O14e!EhCVgEWXd;`Nwj-Nea4MX3$7w;EYhIegR~Drrq>t3W)vNHPej7W zI#P{D@^B7h>|FQlT~a|q<}(7G2q5p1MM^{0F|7NdbGmK(DK4%mnqDFVg%%8nzHLEJD>i!74&})OMJS~d~tm@$M6<< zO^=a1CrSxZ^u+39l3tw8El8P%><4qI!pKm0{hRy6W%Z<=H?gSHFJA(;I9{*dVEX2? zzgRof^MQ_u7by?ZnnKfSfEz*}?h=_P^Cn_*<~3#!fGx?c5*7dRuVZn62D+}XLh%I4 z!=RKhBFa3eo;X9kaTmYF;X693D8Yd+P9)n=GjUBFUGe}VK44oqSxG?3-6DGI{E((| zO(^pKRlOd}@xiv-;s_(`Ml+c@KA{$g)Y_N%6RAq4DMPGK?icwft5kk-{=;v#AApGX z2|t$7YY=gVzc`88QXXjXr23clUG0ch(Lf`<@PPD^SLSH~VAuf_$4Q?&&z&=g4+zk} z`%q#LwGH=>DzR9rHJM%EC(Rbr>8b)KBT(vvN&hf0oZ5K)rvahDAO#G3bh^aUJy;Nl z2IvfwV*c#oOv&kiI^C6P;NEc)c&zh@xWq4Jp$^}&G5NEPYcy2_`boZaDJd4B23)*|7S3vNz-ruYZN6L7v#Lf0J8?blOBa}bWd-}1K zTmfK5#0_DdL-5e<**W2)a@SmZV{c22i_oU_ zsNEl!uO(u1t9?ex7_}eci_|HzhBegv`uhvOgZr&I@nHgM%aZsuFY^0RaP40vybClD z{5m>~2o8pyV?EQ-M!4sApC6!Sq|7Js!9Z>9Zc8DLCoWp@DBxmA(O|Jc^T1;CLv&)< zDAe}&<+VcDWmqBmG7`tL(?9aHGIyacG$kAymVAGl|dd%|t+*wWJ zP1=6mL0~aX5T>eT+>MpR zzI~~pgN|sW4PPQ3z^x_MaL~@;9JgQ^bJpz-=uguii@rp_rVG<5vBq`4NvFZ0rDjUw zs-El28fZ@?hW!7R{@}!)SygXCk)&+2ER5nNWynXFTlJ+aMv^_F*q3Jag0BM;0UTTb z{4-*UEx8)sc#Xn=cTRwJ;f#^?WD`u{Mz5kD5Mu#Y379o1+Ysjt4l~tV6JbU|%$*M- z?Jn4xm&V-=Qs$PDOfhUdC0~l8SsE-AE$Vdm=hOAjqkb>I1qMGd4>&$@QWX0dhXw2S zesP~pV-$YUZgT=RYsj4%h9vEwgk}9Vg!xQ$NI_A;muaPUXO+nwM3*B%I@X1q_xZ`> zz1AX95}RriHsAOFA^%f-?mgLUIrsJHN&B<~Pq`j}(0nm3Dg3kl5FJk|32OX$hkij( z5Nrt@Y{fxs60Z`e2EFUQ0>X9HKBdu02xYBEsp?$tIqHaL@(OhPt`t(W1Iju_sa-m= z1R;$Kxl~|ZGHL~u=aEn zGmO$=AY+{t;ce1ks|zM!WMjX*fAS4h_N_dV>woCsopZ++tIXarDz5Q+d6UrQg%#teRiunv1mwL3z*_bhigvv8jKIt5HyFZI zHTn$1Ax~sDGAJcMm+v{7!Y2AmQKm{F1n%)#cfyJJ@d~HQ+}|BoPVB1DwJKU@IC)pv z6~hHg3ESAH0=R{~YFJ&b@SWWFK}9>6EjIw&_U+NElRhLkM>4}X&eA?M{AhILn1Wa;+tcBgN5>4SM?S5h`^_sMbMDZf94x7 zg2=$%dPoxliFD?i-oFR*7o;Oil&Zr1@}N{Uc3P&zhNO9t4$lW{68^@CXHI*LEz z3dD#dkPP9os8A^qmSUIwF#Dc!)cKJ;F(o)#WX^3U6~4+9Ql-+7lLwmNyReRKkh|3c zuS{j5MT4G*7pOcPF@2!O%MzOvh3{ByRO4XsNb*=o&+p&ejwsc5I=`d(<0|gVs>qqg zLV_PSGP4{|%0UVqostU99wddd@c{Ccf^-D32@B4{xO-EHCz|GL9J=pjzF85QaAg=+ zXjy8D0A%9+(nW`$MaEE3KLw+Udosyn@?Iz(EzZ2k;glB{0Vrl zr1cgz%#d*+!>CjeS>)3=nY4nG-yA$dcY}2lM++6Ir0h?8)ATk`n`iMBK@p@<*Ha=l zaSeKXjTe|V$I{PVR*o9Of5_W|6S$N-cP0fXw2c_4nGZBa2vE%zUFQ*0@lVSz@67EUgN?LN2G|6v)9Gr18@$acFu_`waF8FlTHuexa!r z8uRXPK4*|385%u0@k`^pIZ{zN#%v3bIi(4ID6uTGHYP_wcJ?-yINWn={!whE+W8Vq*{4s=+3akpG~Fl%AZ5NS(zXZ~lP3l}JT<}{$`v7#0o z^O^ePZN?mwy8tJhpE}_p9Y=Y{fx13ypKrTISmhbM^t9`aCeX1Rg15 z9B{f`u3gVs;YIRs4B%AwMZwI5TsT!{Hydms*#q4DO@{I#qQaQK88@R-~z)8KnqqloP zXxe`}H59@VawVK(n>K}!>wGCXkm+>k#oW?vkuX8_XpHKc0#L4v6wLy zOR8y=`)Z_Iw?4{jxo*&XwUjtIKLPj|bZl3*aHZ-8%?dNFeNwkt7IS*zi!~lolyUvJ)$&^qm1C6k}h0M7AX$^0dLSh z`jg-3kXb59eGG^UIfm&x`+$a*0ge7`cLXgAZfK=2T9jyk`t?F_=IK;bRZ0mom0ftCrpb z3QA4*luQB{Xe=<`)AW`9GVC_Bi``JvAMD*F4FeZy+*_I^aXiEOK<#TYG51J{hjTM> zCOcUO^d`nb1BgqIOtS84`m_>U4(Z{9NKk9CKFFBIp5xv9L1GmR*y=L3XiTKx%b<`= zbwB%?{@%bv8He;&}O39jFcIt#`!5^Idqul?*`FFAju5!=4=vnSamD( zouL;ydD<(DjfA!RE`kY;0Q*OW2-Ii454#E%CXx&`*8y7pT#O%h03y90iR+k_<-e{A zL8zavbvAn=yx?Kew}rLKn@RU6oxqIic@PV?LXc|g8)^S^tsGg>;=Tyl?;LvNEOZx7KK0+k($h*r`1in^2Q#>fOeGr-QIMSLAikE?);Wk z+~K0yhM_kQp`{|R;6EPmrue5cm$ z2F!)=XCjYfGI-~NnR zeE(-O8!_8j4^Fm92;*9se>1U;i^T4%+{-oC1(aSchJ7c$22ZA;VOnmkMA588AuLyY zvP^3rKZJLqW?aiin0+Bq_8b2!Tr`3pcAU(3AEQbffv{?hpF}owH;35clUJia(CAlFV>$Gy+loe}ASGV6P>+^{=V+(3B1b zn95ryPd9~iLNw2TcE^kfOa8Dc4P7LZ#=ifzEBIaD%xq$k+g+c#=? z9DqrvT78>vyk@d}Ob8_+#)jNZ{NqxaL=5dQ%LH<;GmztcsCN?U{vez|Rystj+Hd6` zJGS_i9In2|3~_F`FduJH248PcQLnl$+&*O_-X$b;7lLXvav}+SuXrhWlI}X<+O_|4 zr{~C%$BrVWxGrv?XzgOW|QQ?6_KO4Wy?@+Qf z$yv2}fGr(*IA>g{Vg;}+z}FXGW!90_R*S!Z7N3bK@6n)b$g4`8(2;;mc1vpH`SH9G z!XnmrFo=ArXZlQr@DCOE1zdy`)kmN+yF!*A-K|x7d!IHwRvYP*(!dXwOwxA1QKiw( z>qkrwV#iV_#qMscnRF_!yW@rBAeloE0xz8td_2CfxSGB!&}KB*l_L>TG9U3g#a$wQ z{Sl|>Rg)lY79Y9olW9G5|57UFnhw1-voYTW5_Ev6o*DyO!VvZx)}z7{bl=?Dnvn@I zq3PEkr_$v(>_=}P6=RqR?uB*mQ*3JlwXjOdk$QN&E|*lJ>*&>qrmo|y#443;k2$iyoh)3(NUi5 zK64n2RiOp;fC3NU!=90T3ihV60&FP2a6(9SbFRjKA_qISR=KH&r2T-iqk@CHFq~CqvH6; z*`NY|kIT{uZpTxPP8r{+Bv^zDjNpnuMK@B7iTjjwP!H zefmfVwD+ZEj+cAXR{@|Q%98nA8hqJViaP5pI~7`OGU)UNql{h1xbXP6x#{HLpPr7L z5`T$xJMjeO7u?&keC+T{Wdpol<}|P{G)ZUC(1QBpRT=a%-x=GU1n3FC=6`ZzK&D(DL=nS;OmGX+M#N!*2i6H_ZeoHeK!~@R~=zt^bu;K?$x&;ICjP zG-juF24yt9s&3AzT6ZgU-*&e!&Do(6%Sbe#k)j! zH*M8&s=PV)ZYA>F0U)9l&k3{?^_yc3FT47`=g$ z?JMoI*&gxXNBioveL{&is2~J8Gi8wXZDrMV?oS-57B(1Vb^DdronK-LSsqBg+3KEsW}FJ7w1dk{Umh5ArJkx+SR=oI2&O5P1kc?-%x z)&M*Y-U=(E>~Y!21mI#N_Sn(pXn8lm zZN!HoH_p-shXq4HSsPYFZU(2pkO(qD^j+ui_SA!Yhzsx*mBfc8ya$?pjf45bl9k^G zyC359tB`sKyx45VVkQE1$si#HB6{to>pe2*Bp{ zMDLRcb5Pj8F$h~Orc4)rH}wY&@Xhpkthz=y)>@qq2?ksVh93=KKNh#Z#$fy0AftYC zk5N$A;FpZHq}k|K=2m? zEaVZdX2GX@H1`F(SE?~?DeJ%}57y_#Vsl=XrYEv9#4&_HBxqu43am;A{j0bL;pJ_~ z70oDXf|atOO{cQfNkf{C`2R?I)1@}HZCm$M^2Uvr+bhB_4aQ*huago2WK>P10ONmY zA%l#N*eYzpJKg8FPjKJoeyxupM*?1Ru5;oPYZ_%SaumI2z4hLKfSsL?o|D}j3=9|~ zl*`D5EoetWYI|qJ5h*dJM}8*w1VKx!<>ngFLv7{kl%}_VLV!XU+&%&_ z1X~)Mm(xAISJ$ETvnh}%tJKz8NqpOUnn^^9#}_E@zN6EDQ;({D>%CNVr%I4uB%lcu z+cV$Q_N+QO+3rlhj|JkFZOC5aATkDQaZNR+$GeOs&s6D3E16CdyoM?@7JHR$i^)pk z#3DU|%rwT$4K_bdb9wsABq_k)H!Mc+c&$xW$hV>262x%6NTj#1wsk1(9ynGUK6a3b zQpn%r70YXs;itlHyj{F^feF$Km|3nidk9F?a0NCQMOQ;|C5}9x@B(}18qBKlQ*jM< z2!bJ#t-^%}x=8F0ZjP3r+Zj81d)dcdALGGd+7B4*i&7=Z8=c~7NLslvC?Rp42Lhv& zbIlK78&N&jE)5~=4j-i}HG+JHJ!X5jP|p=j98!)0Y!eslW^W=rlFbesM6q#TQFQJ} z-T+PUTLT}5A>!eU7c*GHkrW3;2r4&O(y;GQ?pcaKVA-kP!bk;S+2!y-FfZlh&e5Q$ zaRQXf!|@1m66*A$2aY8HR#OIq@P>CLsE}>!!x)bBsL|qm5h^J};|jL2nGx1>{zYCI zp9U`>Z}#c%>b1rySxG&ORQTi1aZ7_C_|8^z=LI$|>43m4Z{x{FktH^u)VJzhNWFK^ z_`W$)o+|WVW+?c^OU>F=C?=(HKV`sFe6d{}SW=7>-PbT+$&7KBMF| z5Hm`scfg$gdW;>hRa?WR3IkjIJXmM5b=85aFbHkA2rwY4j!1ul*v+Q*09neNqc8Ao zM&EaOUe!)9oLB8`OX#{FnWI+5o25~r7(1TI|CGRg241T8UNKcrur%{09*S!A=wrE$ zwGej|p_QbMDYFiLXK;GnNG6zvCgwp`fLElC=>!skR^Z5_l6Hz#A zzINWTxr<4zli?>2gzFS1244cQ;*^xSnoyRl3(&yC&?kVD|x)KzNSDS z;on4YEQl<*Sp_&ejBMGizS$Hq5F|v1lU%YW6wu}vgducNm|u`0L;~z2_&D?{OeWbY zhs0HgRuD(V%?bvi|71eYL9Dm7*oBI1X~C#8PI4eRbwmrc>~k*h8*B^1H0wiqWJWP_9Lup)pXak8-OR4ve~GajXjlGZEi2A{fA zDolBgSh1*IV< zL{gSyq(d^?6d;67Hq$5a+TBB4oJ&kFSD-_2LT@@rNd#uO7im1qhmmO{7IbG$%$uD& z=M$;@+I5s<78;He>zvj$W{SWHqVX62sMK*pPU7P0prB+OA<;Ik`%*0HOlDw++ z5kVgTe^+#CG;>%V`{6*f5XdGskXJ*Oa8!6CEP5OJUs1w&S=oSa-MXl5$*G{$b(@Y4&q9_w9VzvK;Ek@JI4UVfgF~_QN?|kl8AHj{cA zIy}+~(4Ap})X9i7*-?iGV_N{Ptnf?xo30E<+==m}nRX8(Fwr~oM>3Er7zoHXrWE?fK zaSj0`PWN~>+hlMAog>5QjiNz`3zW?ApZM1 zd$w@okigM2X!(@Hc&*w72Dq8{B;a@dRWq7EAaGK!W8f|m2lsZ2iY#&;>bdeSwJW7B z1A7{NE_$vcs30_LMb?XCQAzn6=`^;nz>Or3v(=eCcz&&nLe=mZ5Ibe28l6DMGTxXT@n&)u~g;!DV~Mb}x!7Abzjn1Um?j_}ybeY5Zst|(gzBM$`<;GeJnFj8R8FBIE1+akB|@ZubB)qxISr;lNI2XJ zCjulg0uGn}oa@}+=y3GYiC3j$$7ID@V>gqsW_d3;aF)xrrfQ5OdkAuM-ycctY(w3aDj1q^qbK_1 z2l7nNLkdgJRf`$V%As9Quv2x}A!0Iki!#7JSymI&K2Jnx$=0OV6AO~#)vL!lCl;UF z$738ZVOB|k4`L)J4tiG3$+6VkG*hR|^?mv4S5Q2BqhAoR3$Vm!PAtzdH+MAYG+U*x z;Va@TN;$@?7KA^@mcZi`|G|sEb+IZ!(s|Xs7I8)nlPDhC&viSXN7O+ZbQff^Sl9u8 zFsJgEeiJ=fPWKwhNdbU-L&uK_uTe$S_u28EpDSe^4ID70%1EqjC$Z*eIw+JRD^v{* zv8PqGJ`Bdz_dB;%sSF;NX5k4 zpIi}*2wGJ;F~CMKsiRbAN)l(ywi1V_ya9YO(x7+%>G^CO<|urbpF#cRP)ZIVjXB9t z{Be(|EL5^GR@8ylIBDyQ9?;hGgU@z(Z76u152b>Y z&2g<%IQv8HDwIhv7m~xRLWqai7yeRTjhALOrin-h6$i1lda`?>#7ks~UJPTVv7Fqa zBeZ?0%bpD$!{F0QRfyG)8S)4o;2OM>R7w#u-kW&f6A=&hq8?sTxGcDku@92l0ND4J za5Pm5JUQWq5V=f(>e!6S>&d<4xXK>{?I>L4j4Vo2q-tukznE)Z$iXm}jHT!`6|;>f z0jd<97s`8lOCU&xS@XG*k(@^vA#=IrtuSAJ|)zq<0rk$E*en@--Zas2L-06vq%(dBDMnhC9V^gfN<DRgmSIH)Fk%0P`B zIgj8$5o($&e^L!aC*PNg_8B%}L{xH*1FoQKlRZNHY8hn$^Ayojb#mBliG#M4sgSaQ zBgr2vL&C*U{6lOP@Kh;-H8gMjO_Mk_sjt?_zpOE3`?ZEP%d|c}T(=KHZbVFfTA&2F=bEX(3QbV~3_5Wbc&_Spx-?uBuPuM#-xA`U&NlwF7;PtP>7&UvjEabHxgQTe9O>@qowN%^ z3*gB8(IMgasy&{^O1(?Z(XQs$wy=11!t*it0)+L_^h@ud2DgDn;}?aHQP{CA^<%FRE@Nc=f`6_#)bZ~pLa>)Vq`IIb$_;QVgzlKr40#`>eifDT~ zd5WOwllhal_NNxrHdnWXxfcC7Q5*rNvUE!I5qmF-@#VJpLSobOyE2GEZJ{x4h)~IIHM4$yPgq(8(n;w)( z19U>5S=jSJO};2}*y^g_lVt-lWTq#WeW5^rtb{FQ2Vc87;;@J?_zi_b>&;~PLEO_p zOlLrP8pi|ounTwfyl7S47miLKaRC7GR&|;Mg;LvClJMoLI#MQ*at{WOD5sc&lresG z7J@ArZ7G`Gi)3ovPj*byb_hMg)%Jd_AWf3&sAW)2hTgn{s{ud7)`fZ?2ibYEm$|C1 z7}(<2#{z5a8UP2%T~cNLjBYLpyv2QNn~#~UZ*6eivvY-k-R)3}phL>^y;B2|mvsR3 z>DeG3oU=mxb|+(2hVUXBfVQWmVA>O6HbgD=yCOi;oxrzy1nfs8y1Qf^M!Dj)6}1H1wH^S`1W*o9#7(8tsp*NpI}4YVCtI zcdNXEsnNydujblhcw$4p-@(cm46rDyZ?Qk;$w|_g)-R3@rH%;QB-~SAIMmye1D?D~(~sQx)Gmgq_$})_E)8T-2ou8P z1bHN+lH?k@Ux`SZhcQaqr2$md8K(`8Xm{rV89rHWSCdahkz_TM&rP^jXO;P=TyZdE zx9yPR+11htss~e?l>z)K=d}5i`66??S`_ZmG-A4qvf*hX>r;i)b1js58Zj(;I#0s7 zWE_}LoRaJ5gkbM2&xJ^V>P8;-DL_!KKBA&)yL*2Ed78(=X%DuXIS;(i7@eOd4?0xP_Cxp( zBr|FU3=HotNlLS`@Vm)G<7v4mZTb_E-fpcS$KqZSrt$%;bCrtsO^ zd3^wY@K1Wr<#d2Av{QURA_NyOhT)nzLO%rAXgoBiq#bPgtUE^nCjY&sGCM z$A4^T50zs}k&0?lk0AGx@bi$q;gK9K@s#XLuEMThyL(~*D5JMUy=9Kr404ON)llBSNdkC?g7nEyoBcS~fO4GEHN^vtLicE{H zNX|jcFtQso5Bt=+=FI)}cXAhzQ@{V6Fp^mH_#L$^W?#zVk@83)#08i!D`!HvfhfJM zXdQdd0I3Mr`RpwjR{8_qc>3tbuMwwkckoQM6Q&gOKjL_J(W?CsNfN9MS72K+C{nzp z-vIZ670(YUfPsnyrN@_MZpUIzx`p0XgO!Sev@l zqoxo8I!)UOSf+#y=aI+OBdqh+KJ zCt}7H*5%=Cb6l$ji}sjP8~41ZJ~#Xdrhqp_LkO5ZtBfmrQGM@VL-YSgZRv7f+?RDgK*AvcgeiSK0{mKJ&DPr!%l!3=wZ+zsZ`8rX9(kZsusBi zvZUX_M9?}xHpPV2N}9X;x}1{ld5p@CNO^08nZoBP9L=srj5||L2VD%mH%*ZGYx=-5 zY~*%`6;Tm@k*Hj`&%QJek0FvaKa}1JfwpVKu> z(M)5W+T#J3v-&s025S`74vt9)vx+qf()^ zO^J2UKPUeEqg>9b65I#UEj&eDmR2T3X^5i^pNYN6Jp9CTz+@V`2v{C61E2t-@;zhX z_|YP;{zSyNwO4wD&auZ)SWtEa-3wY4=KUj-9OL3~npinPWY_WZfobRhXs#^>X;=8na&XkBQ3qsDkJUfFST+s?Mh!_-jK2T5Vb({=f<*8J`t zASZ?QyEqTPL=_9%{i*Sq!2w@9#=j-4$0;MMCFaFS#q1OhfbQUX6Ix+2k%gcWEV9KHM7{EM(JoER#D1k3R~bs5czNa2x;^E9Ezm(m0;&wco%`B7 z!0C=yo49`xM2O+j5?EGQ0hH~xHhNB>p|F*xfK$N6Ry%?q%-IOrW`R;S0L!Z4awvbE6B<9!;^{(&NIG!|p(~ zy!w;w5~Z0cGZyi%>aE({VQw^}!;hFZP}e21Qn_fScJMZaw64E9x3JNBD+#w=pcpw^fK*uBrBB-P+G z?TaO$6SooK=?v5H9$QNmt?bby=GaOM1R18`0yZCE?-R5b2KNr1vB$qBc0TGOIfqWUKf5nDkZI9a$GQE(k5b|dRCe`;52J-AdsXFl;Qe>+C zh6KjSTw~Ap@$67;nQaeD`1q3wOBGi*jALg{iKs7v7XEN(ZE^0Yc|1HmB{A)ENCg1; z-j29^yR+T2PsY4ggm-4O3m!@`!;sdmZ$qBPv1RJcA5#GzeIn2lC3p!q{f113vWiRGkPfBwuw^lX$=bHVXCLkZubYamUr znyAHqm&Mqt%_QNA$**#y>EwZIR7@Z*g8Gak*)L(5A*bmK;*k=(=#o)E?`O;nCx+2A zm?*J85(Q*1&AP+zbBLOUXMyaJ+JPXd2QtHoaaP#@$K|7np} zP*&kO<}?L_M2WR_+{Q1bD1D#$8?>%q|1^afsVuwc&oSmxD&E5mVoSoiJ}F(r7Sw>+ z#tK4DhYU6l@P;p_zXF`$dcCj2}cl+GQ zn#zK*hbDnf@=>exxe2Cn z((+^FI}fmBA&uAyINo}EHp{6plR5E;wHXcYv{YGrBVQ2Z;x|oly`kh6G|20-eTNim z;Qh#VLK!WfPRck?OOe)2zHt}jrr6i6goT>rXdC%-V7Eo~0fCfYtBps5 zLr*RTjFkC*83biQgfXw+snFTcn>H#DG{UBhIyr1h7D3$fbD+gIl{-*#&AeQUH?SPi zO%`!h)E{s`pR%)%l*8uRW8;D~gB0dXvdh^ORY%cUejTrJhlj^tkOIzrovbuPntGBa znVnmsox)tW$7P_X!?;A+xzDD+1}D06j8p=wozkUMEP;^M%?{)#$UscaOC+wFkjfyA zUye8nr{a})8cvW=H3s^l9d>F$*}XpA?UBmp-LRJwKEM!B zeD)RG267b@l}IPGiUsbBp+beFxPYUrIuiy6jwSg!{D;$mDRv5g>+#$35d})!auDm~ zphn-Qe@nWbpA1jtN(2yPf|TM-*}GmwvJP;8=(l|aK$#CbZPNh|w&O(j{? z_DI)N0O9!|bBz|{CPW}JVsOSy%*JL9*!sGBmSYqz?U2i{$*KSv#6yqpjwM@_JBj2` zaRpcCVT1OhTFU$;J|4{_B8o~9q3ov=I<1sfv_mv@h(XdJv&9b)5Z#P%OmGs&yT#&n zg|fI3U)&=VM9xLfuC|-hkeB!|VGyo|n4nIVgRf&UT^u#R;9MaMGxVZr+}~%Dz@(xy z{7M>-nZdTST7g@Rk7H%|m(WWqQ&yutRH-P9{#+>l_|gdMbfee2+-gzwL69*jp^eFj zt_n!UnbAZ10&<#>HY^8{t8E>LWIM|%Z z%R;RmO-K46db=qunj|j@i*^z#Ac(p|N9cYKKbej@gicz`9{)|(P;5(Ur$WV;_!wqS zK|Y;Nrkmb8cxG-EYiI!GDn3F^fJ#_`cZPz3)H5jbi{@VlclMSE4j(VfMd+v^J=HP8 z%n*`gMfJj7LW1%Z4`eH~*rtxW2Mp57z7h)*f+7tX;d6(iMOep;4%GBcr;#wX%$Kl* ztBt1<*&J-4MfIG0F(pP5NYP+M6leB2Kh6uT7b7%r$W97yI(I6G17?D6H{XIFaZ^VM zOow4MKgfXr-B6r8$5Ix#5lu#=(EkrmCNpo7~d3P>;k zoLIqY3mFWqLPH!Z3m~WmR|w}4&FKWFBEZ%DE^1YCv2zh97mG)b6~4W~IrN1VB0Fvp z26H-|d8L=-pj(?HF2rGHxoB0cthDqYabUQI?5?3!D+ln1mK`mjtve>Fu8;`?2>SYQ z+C`stHe>NVDyF}IMaT=1vc$;@ODtTDTn#1Nev^ERdmunUe)ExN= zmYc;FXk**J8^Qd0_m06r@GJRBzw@gPB!bJV$DK z5BPxt9fr&~XU|G+$|b|rjt@rWAgzv?Tij$*y)VGZs?$K}%ELe+UW())J?Ml$|J~iA zE#e-2Rr3P&OOG;LNyvwzj7D%fNMbaa!r_CFJs$wA*3$!v)2^*Pbez?=30Vwu)%YZ#Uuvx zHLp0@U^gIYJu;zzfSi_rx{eUpUhsc-;|^k7JR1-cb?7-CUQyGnsaW(CpX=<>9Ri-n z56bMchFAS_f2ze?#0z!XPFgYSNi7?wp9HJ%ZX7Kk{>tg$%$H;3{$+1V%(E_xGT;y<_M%c0L}Q8bV>1oH zK>-SuptiZGri%sDTu>v?ipsG8WP#JGLVH#J!W-##du@WnXo4b3S`^o#?^uGEFr)me zwFN1VNmEW&bJV_QWumBD=EGK;VNMhRyqJI*5~$+QV`vPC zERAOegO|aL3P4uMt|5y(>S@D9d9uO#y&mpgi(a69Ib~x2kE>heIk70GBS4jL0EUz6 zuTx?>b(6tgLN^2vr%*AUHuq%XCGf0v62>)#DHX6%WW?zp{mfg5AfNulJG)KLy5p)h z2&F;2ZV9$A>d{-9Z@NPZcO59--gN9_wsl;t`s)Pi~Nnv@U05-a|Jv305H2r!&9q%QcOvIV$(fX-6ohaDxrRJz0q1H&C_5U zku!%N{b{Fw3QA1Ww}s};lo_+Q%{sZju8a%hw45_`X=e&X&GkqMWpD}o*u%aff&=<9 zp|xT>6M*{fg!P1gFwT=Hg&ne-h$^w?p@suy9b5jtms%JNhwpeMqV>ZE_rFjp;0z!p zIIj#~C=D-jG@ATerq;>WG&q3+Qt=rG8{u~HEq(*PqpsP4rFtu29COU5Hl%dE$B1uL zBL@jnWh-=~gzhs$g96Cd@$J!8vq$hNNLwNvgp5e!V2Wb+CK&D?sF4gdeoI6`hlHD0 zQYF+>!F4_Yfriz{hJwk65fvy;URB3e@i1Q18nkJi@uQAb)1n1?v45|o5<$a@Z$Y{g zBHR?F=2YpcO83R6Qps}%SlaV7l~#$dJDm}$Aa~$({4{(vW-i{-c6Lg#Ao~`4MhUm! zxI*1vRZgG~%-knO2Aw8`#n7H|uOyIkwq?#v{9La|`J#%IUO(M-D;YE{&tvO?nFWs% zW*H}I_h6TU*6aW#JtKEH^^2vBO#h6%I8lt<1TXg>UyqlMATcRI8GdG!JmQ4FKpjgy zJDwWLTSYc_G-ypu1!nqY0G46`hPk$Z%VI<3U9XunEI~3YA&tF3uEA{cuaYkb<7iCG zXU1T{UPD{~p-rDI@B->HqDy!<*}%wp;-4#8$a_oA{lavha7KTKYvIL8kX+nHv{1#w zO7;uJjGiJrT(yAb60@(Qql~w?4P{%Z1 zrsB{HiLyY8AR2V)EKF$V%lku6I;u6afT1WP?>mKuO$H>*(KfqyE2>F^rY)sxE@^bq zG)bisP?~zWnkfaRM?YaMXieUI#3Y5}r`#~0D+-ELPS!4gCd?^>3uh}R5D7gXtqRe4 zCx3j*_J)Oirms69zhUPBVynyD?0h5B1Cv{(8cbN6RQrE;}n<){D3re6I_K@?z^4UE(n0$q5qfPl7 zM6qQO@g0rndd!+z4}_g}xNn5W%Q@1rK67!0qE|7cq*)EnuU!=dD^rU*&YrcV3k)R4 zR85ez`unIdZ{245*=ynx-21ZYKfnG-$d);OVlhJx1Rl@*L^c2S?5JwkKH<4%9rK2i|U97l8_LK<*~O6JJG#3@T!xqDIKXWBF&vc)x90Lz8cB(QsQA*{R# zuY_@7b_o`d-aG0Q=tqaTpzzSL!Z*q6d&5M z!)Hp`)ylEbFN#ylk z0HOm9DqCVm@zhja1*i)(%d`wjGQh)4yA>K?Ea6@qXC{iCPHm5=>JPMZs=aab<%eW(X%jbgZ0hc2{$9FC|%=&6omGY)dMqw%p!3D#!lrN9-tX=&^{{wx(q~F~*hX^hx&~ z2uf-Ra3{_d8cl1%x=H;7tF}G@MZ!OT+9(I~^%Y`_SmwvLc0@F6MKsIMuvI)C2t+mk zl~J+c4CSKa$Bv*mG=&i-u5l6AJMQqwPQW-M1U*Al#|?#fATDmX{HaE)!L_W#HrN0n zge1VMk&R4N1ps)W6%py0b(3yzAX<1_qTkIcqkb6X(8b~!#zcLF98g616zJ@cGRP@F zv;DAL>bv)?=L;onnX~)yX)9-LAL+|=)X=05^rRZWasd@|K^x&gByyMP;JB8PZy_M~TdWzGMV9<62dJUmS(PPzHL z=?|2kL6@MteUrk#Se{}GDUrT`+so~li86>%L}5XpL^Q&CS)f_n@U6-K&ZuRt^%eM9 zZxr-m%=qAgJpB_sdwxgtc$*1D z(uhCMCkb8^vxDhMyE!VDF18{f&NPr%tAu^vT-0T@qF4at+9do_#XFw(af$%L;gh%f zQM4(h@rPxzJ1akUH=c?}Xh>X+HOZl3Lb{W|H)6a2e$pPoMT?_Yb@37wl}0C-y0Q`p z;85A(89GFPIf32|<4MJ_n^efcjEQ4E1*UNb>={ys%OTNxp%H}-f$}YHvvPZ7yOApC@FZzufQuiy*!<`50ufuF- z7spmvlcC=v-OPY0OX}S(=%I<-6${Rrg+Vzc9N`<#YUnnQNT3Qpf|bKc#`l>-2_KDV z)PK0djr0?zKZ!Mb59%2mDT8vD4J~_OVTF4zNdz^xip?f1q&+ageYb!xo|uX>EP?z449FsJ*&*Wfa83~8%E%3 zLWi4JqK?1DkT{X*A5azqvpKEQboA6<&ju&KMj*}aFF?{MlFY_tp-e@+Xn4XUrsda@ ztuSXbA%(@AgA@-6n%Rs1)L<)p zsI20r+kS_5O~i2^g{0CN$VYuK>BJeyGMY@$_g9&nbqZDzUC1v!XU!)mwdLeNQR1;% zC+?%^93h~l&W_Ca8wOl{r{MTG%;Ecos zTkXp>h{DZjNBx3Xg_>FNRiIP;Ig-{?Pyk!HzIBnC?Fam>^k*Gl(6h#o1#U)Ho#L!* zf(h&6J6@y!W2mp#Rn)IxAI)k?)e`Jf+)1&&?13WuvUl7qn8Uv{@Uj9V^oa>}WQs?< zg_9{XYta6j59xM}q*M*sB3O6G4ZIZU6-O;L`q&k<>SVR5}?tcE~USfj?O|Eax;WBtDg?wRloidE!yPfu}kJS1O9|p2NCNB zA45M&D{o1v*i`IcDuEgx{={4`I7xnmc5aX@Vb0!R*!GBeRr_wWGB^;G?NUHEZmgCH zGw`i%vmV&eV7pLq2)YlHqcH*GXO`HZnBqG38ihU#ovkVcG7@5N!0*K>nOzDWY9#e0 zF*?e-tc5SbpCC$Of4T-e)y8(uh2#J_jgdkA4$~sx7vBi*$;q%b-M6kXFx!{(Rsz%> zN`?=ELFnunc91h5TK)bJZxvdg{LP!PSU*zo!`l`7f~Mk^PhdYVhAGdPoxw8Y@4zCQ zCYfu+^daLldI|(ak$zN#g?}Q2$;HVAM60ERr;9b^(Uwoh2AUa|2(pYo_4{Lny<#BA z5pIBu68EI~K5~KtA^?-JlF2Okm1nWQi;V6w#<2rGoZquv~;A+lv{eAJn8AaT~-bI157Y|-nGP%eQiICPXs&wxXaXH`Vauv^ zdR99MV24RRpFMs>f-ymxo2k549RZ4ztE^tJHBg@@r8>r)=LXWkJ+l&BIEdySs^J{O zC7sp$D}{xD8x<#)DdWL64_KIW8K=wKRLg|zU%=e+hKp)jbdTCuw?)xHWKNSRQ`-%+ z4hojBwztV*Ts=MNA6iT_gYsekd)Yi;?|eWdlS^Z4Gso}Z%)JokN^%>q!8uUdmy7RX zYPo#cKHIFo)0R(IN{0NQG`Nn1khM9-WpJ@0dBgU4^$Bew#r$wnr6GNTp^B(uf~RWP z$*~~DXCY+$*@slS$h@ap>Oh%dutGrS5>3Mf4ms7iXBq2h&LY@LQ#%!G>I>-L1SjSNILXe218HCyr&dmlZIE4-R*Zlv(NXLBIB z8S{t)VVNmS$S=}HjGqCx-;j1~6A)gMaXEe+ue_rNQdHBXFUWva{U%cX{5a&DhGT>O zA6=6J#B+D?M2{Q3M5oRoQSqkgP0SDN(gCW%iWEN{QI@g=Y;>wpJ!s(>8cFpUWA%r+ zP{_bVt7O9x{vRtaR^1>90D%1t5OCMnH(yDxTQOO-bU44P!d*Fj{0=>0J(=A|0N|3a z7imGmU!7JyRLktqblff16GGrT6iuzPx4{6=g14eWwZQhnAqJfD;_;B&gfD&ug{Egd zVlwxwd&6V)1=#qfrHkVFh*{CiPwJ~zq7j}ZY=kGFbl8fITIOBR+(~^!!&24(ABjoS zw{li7MLAono%;)PC^U8p5>j;I^eP0z@sL8+Xn?7?)X2ZcQvqGVVEVo3Vl7$b!O{S& zzUX^^iq$q@@7!7E-BVkboXj3YdxUKOGqx}SuwrDmd_dnbwJriq)N!z3=d*$y+}WqY zY&QB|V>4)##1?HKNdW?|wj+C2Yv%oJx8tNe_sNL zOftAT=dIGuZ|ncG5U{uONo)z$3%oxg{>g~q82f#?uS(Jd&L2=SV*w%sqy-}5--WXv zL09o%*jpXSEN6uWbcBqV$ig=CRt5GXyHjO{$Y(v%do>{hD~Q2kGfl=EuK0JBoKS7v z;2WuRC{R>c22X2PPN8}Btg-U=qm|;M**r@k7x3k z^+?_8_o|;^q!<4;>u&4#7o+o|R_{#m0T>3~i-Dt}NRH?OHO?g#?GfSO%%luVrg%jh zhl?Tf;ONLmg`+a920>&jYrxJ#Lt;Fr7V~_fvj-P}kj%wu@@+~^&^we8GZoD_2Uv@PD5H-WTuGRWdbFtFeuujw3cLJhEUcJr6%1jE5fD%aOX zxdCF|3-6PwwqzDpIv_L6FV>ydt5_Zn1aGMYmWDn3HCR8yV~@a?O^m8c2Rl`?7-rc- zp*@O)RFNPSm=m}RPLh0Dwz~p29D5U+=G)-{DZ|5u6NSP)O$B@d)Wc{)c`6;2?<-|d zBNanDU)!E}y=YTwf!xmvkh=g1GER(Ix^|Xp2q|yQ&#YP$AIT4(GOZ0JlH_O<#y)X? zUkU3HVR=wC0uqnCCjWwPr|9@t{Q8Mr2UYVU@<^Ff?P-T&3^ruu)J#82UqoF4pFwu9 z)4p7iYd92Y#rz-y>Kq*-cEfyHV~1h+T(b3^NUNb%x}rDr$C7n}Tj{8#-4IkA z`(C;FZic+W)3GV^@74XI@V8s1iD{5PT-U6gQbs(QFqth51>)lp=8<+uxh?IeSyvQFf7IuiJB+Vc)}}qk4=f~GCGv&w z$;+qf>AmDZTv+WPwj4W)c!9#*&we5|kCo6FUYRb}_4vUQulFE0!8Vh3sCewPf+9h5 zJcwTWd*th9!#7%P7*LeXE|9jw_yf$2DMeUTuNY0N@`d?Pvb~W`xbY1cFm9q$^Z2B3 zj!hJ7E&12gt_zCO-gUqxp=OrZw|+qA4qCMQZxT-g53zXUcRYs4z=l9s%@A0y59>RT zSS=^U`SP;~l%2v%A%cB`TpuAHmiO2%>qQ1XMnP&&8_JqvAd#nhC#E=^8~L&k?5jTMej9>CX)6L#O{9lL$v43L~Y6;!}=_+7}D_b zMVyE8J70_+8AL#4ROQDo0;=!F#FGGsF~jeWW+NS?nAmIyG6|J_Je$8ofh~UzAPuDWbpIkTSa-}F0zeklWJWx zKY^Gdh|~i3WLY8vydu!NuoVxoyID~7}6QZ}6Z+W18 zT(Ji*_;HWu&0}-_9`FDz3D%JHm_l$#2eRK;)8ATn*|4|e@G|!$!r=aci~o}+!Fx{@H`!0;x91?@Z&`#BqcXNdNR&g%$qUwKO`y*ZODIepLRA zs+Bc}Yqc6e+*S?GG%NE~GvJ z^IQ$Vo~O2tNISusw#`OZTd|!f!bL}(zj~RgGH3nn$u`D*JntfJsn|NMiA9ag7t)pm z|3_gCn$63A^7TRt%XFS=v?`g4iGY=2O3cLxFyWBz_DAdjWdYUIa4=M1=12E?o!F0pWaBX%YE3dUvjW-ZXJXbZrx!*i#qXoB$$bv-kJ zh|8Q;GZ?;R#;V*!kTQ%5#Uk959TCu9?;q@e7wjiH#UK)B5q^;5GGiZ;X%hcHQh*cA z`aCbr&4WYE`{5$M4me#np);}FDYzEzK2TX6lCrA-+TfWA20x;Z?NY7_tL#O$S(-q@ zyA5P183*x6AE=ALbwAlOLB3}Fb6dW5qP+7Mj3|FON`}alqL>tPlu_7H10Cq*^T`I( znyi;4&hPPpMzr<>%FP_wH$i9vM_aLj`8pRtSjCaSmQn=aC+7*=$9*E_Lyp5WG=(@B z_!x?jxXpr6fcB#&TI-y!SidpG7Tn`z(N34^`Sf}xqSXun&Cxp0~HKs zo=NAfh6Wi?SKFsyO`OpWh4sQaweM3{=V&n}btNTwYaT0YWZx+-gWZV#e*DKdrHB-p z;8VPhZ{cNHXJAG#p;A^BU*;Y{%NU&9Mn?OnlL8L9RYRiol0s4Z4iO(iOMx&62QSt% zH1?@-%4Kx1OmKnJ_$h)hbe00l6aS!c1B8S;ACa2AooHwH@~W?}k8BVJxTk82B}%KF zp_N=?E2%Xu7cfmgx4vS0cD0#v+_X3KmDLC^2}v69tId|sNxRTSt4wWppam%twU#6J zkE$ZqEblPvlJ_!zrCtsL9uuYDl9AgI>C)8C9aoDJz30Np3DMe*Ro|*IuDexd%GeYT zabo4q6*tX$WFyC}g*Zv%we=cX?S;$=vLnzys^$BOwy$`J7ItIuota+SJ2oSJGpb6< z$H4M#6(n4ZisvZ_{-w+kP2;Mf7md82qDw5KWr)ll8FdjE4z@Scnf}>X-UeAASgVGf zX^qqPVan+7{8CJ2^;b1eC`@bkjZ_{aHxyPt+iTRIDqPnZ5d=7}w*4$XLE`~i%Ym3? z&Ll+88YXNLMHD)pdpIUWnIy$A--;qV%4koH1kI|^fqo^W8Aoc|NtB02 z!`p#Gk&&$ig5lrHLRbvJ*k*>TNkvn;1)G`DxOS!AQ9(q3#NnWg*o;U_U6j5a004^` znm|dJ!`eZ$n5()M>(jH+Kt*MsO0y^)fgv)VfU*wbTR-PtKYf>k&H2+j=WV*)TgM&2Qkmenw(z6(ByM!k)YVVJaK#G^gf`zkq1@_;n6LvBn&UxKhj zilDR3XlX~}>jdM6lMpj(DxBucz_2iq%^dY4SX~CU35B8q6N~xT3U8=k&WoIzqxnAgh^)+MlraE0km9ZC+9TB25j+d(QSE8C z-E1!ZU92zeLYt}{QX8K+=4==wq^o&8PDioI5^vT%NJz{v+Rq!{4nvhr0vj+5pynck zb?BFXp)gj>uKG~KD)ROV2GXV4Dq|}|hd=pJ;>ql_mU`_;7aE$>@0_a=b%BmN1D#}tTMjCsVJr} zT9{xNiB{`&5^CMPIck6Y7gg83Qms=9%?LorKP_(HUzw(1f%!AO1e6r(@rh8KmjuE& zQC-kfXrKH=Qkkw}yL|Ngj$5{3G2OiAx%#_?>3lNo1HtvE_|>1iz0U z&iSA`mGlOr=dMQVrY+qSB$0$1K}De9Myk#F}ov^HTB^Z^yz!_pRht*&ejtTh`L2Mz-46 zn%D6MWSg3l*n$f2e}0Cn=ZgLML%D6-ff7TY?;?e$>9$y2lqmUfb-N^%oJ8HJP!H9T&e_&JpLxdv&F+TH5o4|x-ndut6{RT8IYv;`kt)0)-gq}0s{wfMxy zsh{S$V1X-zEsEj+;wO<=?Ma_sUcEmGB(=YjJi?@Q_M&}@l3K~Q&nar|Cd4tTo`Msi zN*&IQfd09(zj}XH`d@Q_ZSsF`KPi0w2lwM9uof4i=4Gd`#dzp+DyN02)mz1gBl+Cg zh~ASI(%g?)pjcww#x9Tb&eWN}ACmWb;w`wT0oFup!_j2v>DmbGXOO5EX$+X?tGU@* zrxPl{&u_jHwYf>nU$&!6DXYy$`4**x84ZWY6?4j!8jq_NMSxQ*QSz|Ev1TOkOxn_} z6ROG)>g66IoOwV~5TQEJDZ-u&oP69=VnK*UEBbM&FCglPP0hxJh?E(2MfEHo^af{} zXdeIb6H&UAwJBlW#zCoyhS*!=N}p~7l6#)2`zumNjsMs?*iqh_W%2^O;1sIGLIP{& zqlye1<*k!*m9SKQENVj84-|NXNJA1n^?G?YUX1rKDUO2TQ|mUtNuM5MKgj_P^q;fs zGwD5MKuMA0JYe#z;ai=lwNOEI$FBrYbpg2`goYbPsg>(WZFd>>gSrZh^WG71G-GFU zRLj_Yq*P=`e4JyC=wz(?&CYq^Dg`D0HV3EFw;BwD2_Cgnk_HZ{iD2Be4lLOdiQ=Jr zISxD#rcWo{mDJ{N$mK+Oi`9Un(rhC%5Hk_Bb^V`l<}n_Q$nj_8Lt=*mZy2O2+{w0A z+49#b!t-cq9I8^53Lf?7LmB&6e;{MiWW5@TW4dJrAKnuAFR!x?e}cIlAz$f%NLY2~ z|A}|06cEiANj|JCyPudgs-D#yP4B_7z_`F+aN)R!GMo-#K&!C@GCL!>ncOivN>a*Y zn(>3mOcB*ynxlwGPJWLw-&uylPz-vcG7*s-Iw><+=MY_I%?Kx%`FyjHMX!d5-%C>& z$Pmxl;3OCzs+2^Y-71U$jrbs`K5<<1dab}%bL70+f zhS!EQB}2@1kgwUv=^jzOAKt345BDVtn?Ju4s9imtFNQv2Rr?Yn6!l8Qu6}V1(emt z!4+`eo$1z`I(Bp|5JG~mbcPUCIbMY3EC4R@lQ|AfACdaQ<5Uy`EPcjmyG!Gg1YZW} zUnvOw5&SU2blgK26DOhQeooZtZl)xvBNdQx#~N?gqRBh<5wPvuW0gHaj5!>yxWw3+ zLO#u(#s%Xh9ShhxrFi?`63U!WC6zddj-cirQ1#vN=9N7_mUgpuu0RK3m#J-@p7)4& zp8HN1BAdIrJe*dgXNzB^4kjufDL4dbf=k5AWL{eeSoe`$K z!Hla@**J(;m#XZed)U4#h)ZuUsMotl4N|?oBJ1=a2a1;#<TmcqctN2uP$LnG^TW-5^t2^3j^S7 z68P{X_IWJP8}Oi0st>_bl6Ry1MXoQcGUbhg;}(~@wuw}Z=~bQ2F%VO;oXQx9&p6?m zNRhOc97wR-GN04~WJg#O!JhJ>O77t=bM2U~Vi*|L~xE6X+q>o!kJ#RYe?+SEMHh`3RFq7&Qc@<_! za}B#yb{iW;I*Zzd=&V9hAaR$SUdgbn%?9-;$i9Tl!{zW#II++(O?nW^y?*AuXoKn{ zR@X3OqHcvIgw744X9b0!F)^(eW3!)uI>gut8-mxt&!69Xxy6JyY3DtI-)mg20)z9564zD?x(y=}J2SG~!Pjm6IE)+oc5;s{lw0b?^$fE7-&N6H*=WQ;=+a zfq+Iv7hHs4A)~q9Kps%7OGL{Ax=%3nunlc)%-zpFlPKviHaK^Fkbw07_%d0URw|T- zTBJ#%Os0p-kyF}G{4CSLF>>Fkb<|Y^`dtYrX&=GV+kqU4D+BrwByuS3;i3D~&eZl* z)S7Q4!b||lNuJvLov13FLk5^05A0(snw7|VlannPMSwzk;}zVB*F@PTl4=$@2L zQ%$nOZnY(c@!9*583IEs5FD%qwKvJ9?TTs|_N|vyutk6oQHio3&twxNYT!+Ac6Kgo zPK}))>*wvoocr|$JayU6xWm7~BTWc;s~v?SR^SaB*jcclsuReSbSjuWJg}o9!a$TB z+c0&NEP8}0qWw#HgT9{vhA5@(04T}cQZW=>c`{dX&SBiPdUV61YSBgTVR;n(G%BE5 zBIASAVlS{jC_XG_%4d;ZdIG3`>Y3XO@bq^k;i z+o0qU<4PzQde}lbURp5({WT!VwZGzH^&po8V^bM(lDxDu1~vXP0b7>q)UmqNz) zLTpQ_c1#|;ubhx9parSc)=YqG*otQ5f@tk!c)}qX>@@>lXlM}+#Z6QRYkVy(+1kVNWti&i!)R?_0^0aD~}Q#b6~&$t-=I z1{?!C(Zzo!D?njDl4Q0zf~SDih*J1-%Xu3T7R0ZWlV9~QQG*ad%J{nElLC_YXeHlz zuWqaIk9(6}=$KzNa`m+^Z=zfgv81&@x#l~FD21u9tBB&cp%5NN*~w#abzoHy;5psf zaeLf-nDO=rx(_cLIpDZJ^k~Cl3}zG^4y8TE_&fgafgy#B7+i|V6SGIFLRY8NI%~JK zT0Q=P<7uJsDG4U?uv05h6j6LPQ2ik9w7TfQ6C1`yNs9#=O&H}b%$hqa&uGutF2bmS!7j(WLjP65;F37(Dd}GE zuNcP4La^M|_CTM>02HY*Qi%P5NkIHrTV1NZ-XWo5bO>jO5bmi{r3uUr4yeL*HOmM6 ziML>6p<`6kt$rK5D9G4^EI;7iV8yrTLOE(`wwQff@Ufs!q1YJk z_Qyk{tPIqVRHl!e*X(PUA}E4#lLqg_8rrM8&1csqXDpdMFj-{2ls+Y9<{Msyp{;h> z8U~?KRf|=Wy5THF91T$U(bblNSqmI1^Ti}mlvwx6oeR;BZygt3kq>*eOM$f<_QXL4nA$>Q=StK zp=}m-NOij4E|J!hpegPQNc`bA&@P4FV#XEKDD9}x+|N)@K1jCE^cV6a-9x0PfWvSW zEG9%c;5>tHoPhFjvUUmns9fW~0^zbXVUuWh7Knn%-Z8nAR6d-{i{{9Av?2jp8mo_L} z7*5G4P}N9}mOK}2Z+(8aE+8eI)AQCZx~;JC(Uj(G+%)9A|H6o>M&gSU`Uk9FIZ@l0 zyF55(?YZ?Bx!1Tcl-}?5KDF>`I`R^1#)2D&J;$9WS)VhD|Oz127c9*mt?oqXn>t z(Bw&Z{Xc}Uou2`n7PIHI>rxZZ+H13wa2Q^@G@^X2Y_Eo8L->f7^4j$gc;_mTI@!QW zqDkcVyf~{i-6UdF>Wge^FP`JnS9=yOPw3wB@q1_Zaw|QLy5iOx!io;y!K+LtkjKXUtluh zwcZ)6(q5?p!bgCaI91d$>xCm#z3Ta6V7cx9yA$(3 zHY12fts0#^BKo45^?h1CR6uNpqKp)`^}RiGA=1Lf%efez)4{z_VtE-ZN&i7-UePuG zw+~Cz)F+zI8QJc`NPhBAccg;a0p$~~h=RS4m>7I{PfSJVjr132#!h@%9q?+}31b&NsI zEGX0%Wbq!ylZdmDkFA`P^q*_(675VuGz63ZZ-sgWEzE>6{Y{%26v}@x^<05M$7R-T#ty^DzUExk#3zvzDz+=HGWk0| z9{yfk7ba&Xs61>5WSTkPt+QPI+)1b30Js6uLPnnD3;-L6Bis6gICxxRiG;0%wYH75 zrkw@1LUpZA=+mpV)9f9W=7p7wV=4lSf(Fr02v0~iY+Q3znO*wgp1F6irpYEB8z`5( zx#(d%Yof9Dn9UdW{@eGlal|Gz8=ia`p*qwisw!~UV*&l}m?vbr`DdjD8I%#^2eF8T z*>QytecvL?AIN#-c9~?*%C|0D6TUDF{DRO%NRXnrUIMd)VZw>${A3;h6Lh5oI=Y>h zOCYL<3cytS4*Csx@9Ov0Fb4dcya6xqxbNvVgNu>K2I4dY0pl2})?(BR50qp8x17dO z2F)LefX@dkOJ}p9bz|HB@Pl}o+dmRk5`63-UuK&ZX{Vqh*l|82Gc7wV8JtaQ1^n^+Q^-& z@^-Pnc*of1@)YEdWiK&I6f}o362N6Uhy|=C-0EJ7ay)#6E~VTO9squas?C6y#67_y zxI~B~!P27V*aPIU(1R#?5#%~39Ppc8Ik>n0xv&*{{OU`gJtKmHWu7(UtKn@cA(`B6 z3&#ldw7=5CEXYa=BT;#4f`-5oiuMdEAI&NnY)HN4X-ZzHS6?BCja2vah!NH^@ z#D8AU5jG&%faMxB<|~aY0KrxdIBOQ%E*`Jv6Eg~VmWy(^(;_{?(5r>gJW)l^C!Yah z#3j@(h}3^Ts>Wd0%S=|V5Gs^?TuztY)Ob`SF0oV41j*mB;>ZCaDoP%Eosyy{NyQSd z*ICI0svk7g_GqLL($Ac_v?Q4KXqh@{o%PgetWA31kg7H~M4lET8VJWgzASO#`^kT! zDK`@xezf_=K+zBAdMZy5C2r~Xp64ei;AK2U#0p#n1Dx#(D7(S5Iu1+@3Ns{&NKzcY zh8`r$DMG;5!NGuKrf{({vp&@#k3DWPh?j{K56V993?ku*cH9*cRIst5|2U%l3U!yA zAosSm2{$Alld4$uTc=SNEn9~}-vy^M{se>9VS$ZG?K|eIiX`aT_pCtW1sJ^M2haEG z3pqWxB}2M-0Hr=&$Oz1ao9QP!O+Gq_!JE}kIlx$67}GqWGyNuvBoH? z(Vhk^2S3Wwc$Gr$(J-eTox-9KCvuaCOvaxcE$Hrn#nNdK6Z|bwa6W?`__gF{!mp$K z#tk8Tx%A8yOtcW!JAwOkx)D1o$n&_-DiH;1mw6T=dlT0+AJKc7~iY4l6`s za?glw-k9M`kl+5-4S;lZ8-PfmVU-EzQK|$QY%16LCa1Mr6n8)j9Z~kN@8esAz$xMm zSPWc%k|ho~81`k$$PNjSXtLgL5YFNOso^&28M9)=Qguv)F|Klr|S}m%7mI)lc;zqFDYU)`Z!4YtgA|=&nC!F z{)E%EkA>cCcCtTVOPi z=cr+4YC27Mgm85Z6R*$%{(WOb#ziKX@<3d)CO^8!dri`?1G}jp%d7W=SVJT;fxap& zpf^F?N{(|J^fme`xX>$q1?qYER{=n;{FSikD}R0cx$s0@UW*&`+Fym?yc{n|_~l=r z47~Q&SD#DqhiBIkRY6w@$GX zagY>2l6U8c9JGAp4_W}&4;bR-*lqrLm1@Amh2$$(MeH@Q+^p&^CQ~_AqrSYJ{Vf^~ zUUKmhO9TFaETLhkMiUVsbiD{THbBt@g(S%mwK#L7mfvQSNMgW2Ft>hN;rMI#W?-t3b*awE7~r`wTShb0M= z1^s`i`btG&zDW;<^suK2WBIU^Io1XGN4~PjQtB>K6Ss&hv8!(b{V1t7heJBlzN_Z}t_Qdi~BV%=Jz1|rpX%si82WQz}* zC(LMt16DeeOIQIw&C4lrE^EM6PK-|j0=)iWJEJBifg){y;E=5pB5#uPhz+B zL33qP`#*`VX30myMuP zMOVaW3e%y9X-rEEAoKI?Y2QXFOFhcy7q*{Hh$OC`DDGg#vTYolopRprlL!5R1mbgu zUFZA`L4!!-Jo}6P2FyVC(tUen7=eovJ3X!{p6D0U_ss^^zrOL&qS(IRxO~cbVIe2R zSRqBwNU+EqdE8^L#h!qS2j|OQ4HVH$$WUkmal)xxF_k{}t zFmm*Lr`j$2SK&HdW&+5Q9A$D---Hd%){=O)Tq2)UUx^VsE~dBx`k}@b-r6m2Z=R=w z+IEE3|DNatstW_M{a0=8gmRhC>6tK&_z!|B(Jb4+|IRUnAazp$j1xz$QGJ#`u=+?%Hc$H)lA2*Sv2mbTf zdUiCY3f<>aQYu~e`n?FEH2h{m|5^n`cjcH%{79!2C9RyI#~o;L06l{Hz(b&Tr5me~ zb(rHg0j}Dx%d2-)r`SH0w@AtdE?vtPX~I@eCQS3xV4f=*{vPI?q91p3_;5Nc=k+_-go4r>rhLp9*F0BMFD&y2jKaf~ZT0$C4MpcpWz@R5V|j3Z))%FQICSjXM< z)u@I5F%0I9+9R9^3a6hKt0DaH6nifmODDi7FhPjYXcU9|stX2ALjj3; z`j{E$6|j6UwdK!7a1!<#gD5zUzPyOy!1%#`_fcF#T&7RCWTd1`oH{W+%k_nsj5U(C z#Fwl^#yMMxm)@0BE+fO>+~AJM5Vx(8ac1@>=Uv0K_!OB zKjm}22EUde>!;)v$)Wft7U^7=wqPI5km@m+DJl`3=2bXTRe^3IjP5cOXGB|jS%xss zaitty?O0bfu1HKhT66qYK^=n56$r|3*d}AE*E$C%=s3sH`Ujhz0wGF-Of~!Ad%hBa zj@U?m4s6&V<@vM?^ekLK_Mp%nepQl#s0o<=k{5xN(^GWDuoQu8R|?k%O?*8iEEJ2N+D{Tc&t@L}=dTJM@HB8MS}fg_kLXD4 z{BNq}jV}cqHY91-(8<(d0Mzbe&}71fZ;fjMn+XjwSzJz^Qi069Oa$zoE1Vr%+VAC8 zYF(vAC)%l8%AR0vLAgW2a-?u`Z|-VVOZKJ!O(Ph0^It55q&>$6G%%xU!&X#nv_z15 zz>%tJ>IA#9Z&FG6Xv;o_^*!G#xhK(ND%B=Dmt{$v(^pHFy&*trddZ5PsoDkB1!c_E zco*6$Sl<*$@jYvNxbCfm6br!YG1!S}@=GMp*97z8Z`fP1f#@a_^7~+y48+VbPmy1B;eDRYOHf#sqgb7ImIo>C3nE#bL0T25&Ms{4h zhx|SxO_}ZqCRZYC2+%{wzGCy;K+;2MSVJBk$oIY>Bc>iMuCJzn)AXiyRkZ%Q)gAsz zLb}XutX-FOy5G~-tnw?sLz_re*%SoVH|iWib{KjPb?C^pl=Y+BuY0hQMh@|QUPY55A zDm^}u;YVAY*{CM8*MglxFA-7&JC&PrFUF)9((?(qsjyO% zkDTvhBA&tER(iyW=*ZW>UGrptt5)HGME=g4HcXrG9FzZ)P{THwQr%2*{7tzL;allV zBLkb1+eTkTZ+3;jX;mtk*lj1+zZk)k`Q!hQyTcXd*%c)$KI_jXc%)g;)*6utlASe2 zNBReW4Utg&$mG*=e12PIh~OP4CJg3eU$EnGo_#b~wg)UO6~V{$OSF6{XM-N(_1Fc3 z9WGTFs3$v};E90HVht{F&ZynNa}a4*EdE@b-xC zG-PLq(4*f`Y3$<&!X<@S^JcSE6cCE2AbWY*8p^EWV&I`vk1e&<26Nu9r{0%NdAf3nPh!2P!0Z zD*>={03X}WnRYye=#$LAg$^)fo$v_Mc{6chbq$>b(2Eg5!=w5RzEyiua(Kei^=|r^6Ji+T7drOzZ&IbHn+H+$GQUD=yNR(SITXBu-ZnfRy&1qWNb({p zz&?~sQhuATKm0@^Ol)|vGHraaG}3+bQMZgf19?hP@-=+D7BFs5?_~Gk#~tb+`}2D|{kpV*5phI1 zME=8w7ZRX{mxs^WRmX(M6R`l+L=Bdh9Iy`y65?d@FXb&*#sC#IqP-Rk@JHg|M?E34yyEn8LTU{~SQ{w_Ev??~cchIwpj z=OpHDm)^sVQe@y4n5wSwF~X*1wG#+Y<|4%jH+)7F&%nv}3Z*LuB%VU74^My8`_h)E zi$x`vX?ulwcK+SMsRXmgr)xF!PKSZ>O3I!pn+)LIKtN(PUzm6pnz9nz`wo>&CcFuy z($el{Pu5PB>Bwz~rI{b$2R>Cq8|PHQ+d+~bw}Ty_uRzzSl-uk<`x`Exx_P=TU{s=I z&ry)>2qp8xSvb<2#;%fZaNTRwh4wJJA|587r@YrgLVsGCYtY{3#{v+QQQU)c^Jwee z#9g9o`q+RI^6Ik_2Ifcb?hpZ}K01V+flI5qResPF^_ANbug17^?w1vdaKqp$KA^Ll zZN)zRL2u4A(Cb_u4@ZW?XCfvi<=5%;qnLp_;SQaknLs!Ez_a5*+F0(hp9bXKD)Qlv znwlDX$nGD1ig3ab1AqzoA*DEUEjfU|q1*QXQ*cIw4KyZ8ng|j_kH?KrzjB$q9#Ww; z7FiwWGz=Cvc!vAgaI?O_TB|%{X)X-Jh%U`EIgo`VL&PX4=@-rbkr{@bencar4H+J++)F+sB|Tu_}m z9HGj<#2mwh0@*<>DH6kt3B1>G6we`rI7(IGuoLRqoVc?ln=tN4zO5MF&aCzU(jqY^ z?Ud^W?|0Hj24ixv5703(`bP)S7}hJvpT4iAe-q|z_H;`x774rM#?ZD*T|3tQvp2gT-AKGgeae)s@ojJt|>k>G4Q8 zOu{R5`KeyR4+vUpM*Y^E{DR~wUB||*U8AnpM4bmy>VHtTIVW!q=7vlhon(%QQ0kTI ztHJiiCvGlSF-m~)v-j$)L#FM1o+i27`ZZDd-^tgZeLc6K?Xn{ZTb$qoC@d1KD-Vd9 zrdB3KhhEA}9V9&p!|Xr34PqaL+GudWz*i5d2cacg;TYEYm(q$DCB)W-@?5(-U}&2CB7ClU&QNY zT>*&&H{(>oDb&2tGo&&c$07B>^g8m$h;?7}tbXAoWiTmA-RyTdtrJ0RM9X21HR$|4 zr*w~u?u7c1_>uImgP7FsA9dk$`o2>^l!2A)}b`-YuQ5=l9vDQ1N-@4#eu zHV5o{HvB?|N@Q*J0Heco&)O@BNN8ACcF8?X)q$oXhNH4m!^7BUGeuWj)t}AS@-mYH zt{sjc3uxjJb$Hqe|3S-6q8?TQW{W!G1{;5uqL5V&NMZwOo{mo@jisZb!eiUR4Yw$criWIW=2Ygg&-O{}wXtYhs9_c24#HgD2TTsXf+=rh1)zz`gjy z!9eOf&;nVLU-MTWu~+&d#37Fv!nLgwPY@I{QwGIzg}b9SLK|w(N!@&{%`cJHEL4Iso1@34zD-k8?L*h7@a54D` z3F5f|JQJ~Fd}k=>y913 zb{cSq8A7uX&0Nh$eYe32au2I+l`tG(Z9#mQAaJ_W1tN2wjYk29=Ysc?l6TXowlxI| zRhq{gB^_3(=>K#D?W;#~A*e6`k0zRcBUCYmZLSDb1CS`NYA8g0T`~=exfz9e|L!45 zVrY&mI*!Eb7^9s!QU#ATm&Ph42k?;^^9nnI73gUw2Qg5ck^?X{EeX90Z|+M;lqRZ5 zUP!7f0whoeP>o}{n#Yu;)R20w`u)_xKs?&g3x8nb8nkspZ7v=#r6q%}Cl3?;Kk6yr zQ~;Gq!&6vjEH8zi6UZLZr9ycoU+@Bj>2MkPpR_9tN+nJKQxS`s`#3e?KXoRsR&VQ@ zfJ!<vi5oL2jepT{dG{r#g(QC{PW$Wu2YRA10eJH3VHRc_R6j( z++@?kuwwdOnsA`DiUU-8Mca_)VPvSwhx4-de7K`H9qT(o_+>)zxm^)F$k)J-7W<%#1yGYz(y-wOSyPYhFdUbsYhUX-=6QCk6-Jo|sTGL&>Bvu7Cw!oqyGU z1J`L&i&g0_q4p}D{rpv;Pc*Ym3qZ1Zg20G;ILO7#c6Y>wBdUtLq0Uq8lzDs;n>5><%BZ|XrRdc}TV_k^nBU6bQT#-d~oaM_U?ZvFf8Vl{m!eY^MXHYPn z-lucI_W-pfPqj4fsMygSbd;R=FUDtcsji(W7C}(2{w}M-Q}ml{O{nF6FeCjYTYzOd zXC4U-_wo}6N`wY`=PX+LuXCGvHpa<0269+v#A*A)CQU|eVYDXy*8Knd|9Ek-$hddi z))mVn?h_YpepZYe8KY{Nv&z-TkJ4c(?*)srY0|v@-;2`vTHl|wP^AHeWu^o z;!vYo@bAMmWTRXv2^Cg8wadkNq?B*=|FiZc&242_p66G2D=$wgC*8$C zlCRnxCK42;z(7jcJyH+}7f3KMX!=g|A<}Y@){9zn=Pp+r9gDDNvsh)vy zJkFO_WV9D?>H*gjUw3g3sR)~L$d*zaJ!jH{G^u;g+~EwHkRWl*xm>Vc~aiu0I>+(y9Z!@=G+d{^g{r zL&$|<=+lBW(mxlR`yS>;EU(|h#4rs1V=2{HGqc4^f&n)s<9n$H{dd$UhmLiAgm`P;2zFi~b1y zAV!n@Si6K;MKxA=1^xx4L_%PR&2j5ppj-Dyzv=m_f{H^xOP=K8Sy96R%b(^AT74O44$vTtwfUIDfkQFR@Z2vjyHpRLm6vF1y+60#^{k-1iSw0%+nuzQqE=gPH zAky@=?qI0gy*6AcSrll#+(RU(aCFPLk}dKb)vO#|dGo{U3Sc-~vr`Igqg3P3RZ<{E z(SmP|nj}4j5=Q=r{GisS?3s{=YK-BrD%R8aL1%O0-SaQCFIC-4Df8sl%nnlJj~W-x z#9TOgx+7yH2*@AJz>3jx`U;79vABDXujvs@b}Il#d~@4ma|$Qdh|FA{7Oim+G6pY?Lip?qI*A^YouVusDw~lP&7VP(vuzN zgh5E3Qn=z9j8MJJ%9rUo>IlLY_I`JCq-H+l;~I2S;Bcg76wPiPwDRDF1yi{q+!|-# z?8T5<$CK)y1>|<0&sop*-c4+#fQ>wEn)Py6e04>gmKj8f1IMDSJV$PT3Pv_MmqRml zB+x(x;j$z@KpX1$zL4ng0pL*lyPDYwdh;`qSE<#V)$d0uRmfv1{k$Mj{93zJM zX1w^8bqYhe$J8N;gB;!d!ge?~(g}&JzF;b8&%{lv0xpgx2Ho7_SLAcqT%$d7rEwS= zx6=}z><=)<8YL|?831r9;5`FEdr0eH~1V_G=SXt^AXa6+0MNwUlN zYPrGV_cXCnE^B8m`XnmcfzMzdvMP!4-xYH)neC=D}Tjwr^Py|1k~^%&a*mm??aa$O}JG##78lU@*Fi5=$j^jY2y80(E;T*4l+l zqih@nr-nHav)iBa#yLRY(&tU{b(9o2q_uayvpdJq6PX^oD1dY2SEV&vvKPD)zJ&m2 zET>;_R98*{gBxgy#jdu32V5(7fQ6>;=|2@TCeKr4{uK`08kpoDE~so6dRU>YgTf zd(rPsln64avWZwbMI9&LD#q$*@^?F(S>Zy9rq9Q{2&53*werdmuXHD#Yack&SaV}`3E9=or@vGoOs|2Me zXb{GrFg~ggk5T8yf<`e`#GNH8Th#N3UI5?kr__?=lO%8y5ZR*{@SgRI*;z4;#&okb zIw%9$cu+Bt#&u1_p-`NLw$3FvA+l$D-#bK* z+P&gRLff;omO3HTib!z^3>_rIO?nT0hQG15GYX>luR=6IyG#vcV4hTa2mOws$XnOT zjWVsK`j%QTZaVqsXE3fP>L`}Zm#8xO$Q?>p3c=@`e|BzIV$Z2XuavJm>AjN}qf{G_ z796b$mnMg<`1@KL8`mvXE65P70$<|q+<1I4iu+TK>0zVR5lxI2b-M$nghIEaO(u|UR)Q#_my5%$iQDT4S=hb zZ7*iHdoSpz_IUSSwuX^cG>%)q(nfTIS<|FT{$P3-;^q)MF*?@6C6-Gug`Iob#kqC) z=@C`RUu^w0zK71^F`yK6rX%2xQQMfY00Wl=|(UYF9-7i%^ds_?NwOrP`b?^H*7ex&kMM z=XOl>WMbzsOaSsIU@dpEFbltK|D<@&gH4!X$JY}F}_F|Gw zw!uQ}4=5zOnY!t;jbi7kgE)t|Uv5~elTG3mrEW*j5%PET{g}t{r4&}D1inD6b2%SR zJlqsccV+XXde-(nx(Nkrp>CkTM)CdcMAO`(yuN`-WJR2hUXp;iZ<5;jV?~1|`2H4P z_P_Ye3oj~{Tn=JP@gDk#izz`}w6EGW zjonl3X7Em`jz04QE{d)FaJ?{WAkEq;;R$F2|AB;)hc&(hectDT13*=jgVRSx#91iY z(VL9M2mGCIH>SvB*pjhh$ula2nhYaS^^tYG?-iaNnqaPwt$SXms^zdf6kIl}+)I8) zv;@bpJbg|GRP}zy1O27^fnHiCGzdD2yQXPUx`m5ZVu_?!>T^N5_J;4U+@Y7fUx5W@ zu)SXaXTi;}_bc^40b)U&&dH++*xIbvjsGY&0AB!7tbw4QLz93#&I)BX!(%|dw76W6 zlvZwsUIqN%SBEy7O70<1E8kNTKwYRJdsS*fS7FgoU>Fc2T$m_=OdKal4z{U6r=Jj= zXi#V{V3(Q?t535zeqiZt*tEIYPzWV~6BzRd(;BoV-VQz`6^1=2r>2wCu{D)oZ|Dvj zvlLj&&U^gA2gq2=mb8E%bP)C=w5EZr9#Sq3H8{pHLx(|2eb%GR!HEfIKAl}Z%)TEC zA(iRFcLX1{v$m2#9&C<4<=lxVMyZ}bL@#Ty90NE;?+v-WroB*rLp5cl*Zk_1+tSGh zmHDR`7H}rY;r6d#6%;iew(Ix+d-%?2hv-Zf!c1K%hMcKZpesTr2eZ1d^L!X3QQp(M zp*UwDxluaf^RBMEs)CmG3E}-y;7H+k(qck;jih#*!4E{4tK!BxA}J|MPskmH0T^3!vjrD#ckg<;@Ffnv4sk_XZ2Cjbm0M)FPFXpI?K%VL9b{o{0b0O%0a4{NR<<%C-BFqx@}@e4b^e_$!M@;!ba z4@8~{9@IBeXRG3kAGpamu%d7D!sQ{kRI}bVa@~01%A6BUp09+G z(WBJQb|wfE5MxGFdZj8E_GfVKgt$`m88`r-Z*L09>neWhZI&_tUq-u!G~RVY(CCD(C~+P|dxtzj-&HN~6yvWWrtqf?Zr*L{5Uiwv<0>A^KXl93 zr!67m00>Y4fw#fP+2;{j7=KZh<7e|N=ue0*eO`QBj7S^3d&3fBEl~oC?A@J@@tPu+ zftkxQo#0%fE68yNa9n~%>`5nrITCdWr(6M;BH~j~ZW1|U1;j0kbRmr(K5l{tpAL&3 z_D2N6DM&r3j|up-6)W%eSP=!O!T;pf*VG#*o&G)xz&eA+NWcu%j=0Cm!e#{T5lO`= zo3g|aP?p1q3I}<7C<46Z1q|A2Gh}lX>pLr0!B~(RR;0N*RIm1r=G{;tgP@Hm<*fLs z&4qqkADTM-0pmPPBcLPOwlQ2Hzce+PDIaSm)KH3cRO_u4@3dloSV`!cQ&B(YEowDG zC0eSvSn^n+WO_w=@+8uA6XCv(z6m2)QyF)^MWC*7LsoukHFYJ!SJ zYvtxs$JpNMLCMbM8!dz#u3B2uS%X8Bn=RT1+&ETX(Jx_1IHQ1>#7h*9`4z6F>=-OV z+!y34KK@<1H~)k)kJ0qjZ7F0tY~>a7BZ0kY%?`i-9)~jbvIDZENsqX}6hX&G7NPm7 zC;Op_cgagON3l^;)QAv!yH*Xf`svjy(6S8|Z6o%|Q!(>>b; zTnj6Q72Xt&-1PhFb98;api7Pq>J-|{5 z?+Kj#HQXt74hPL;@rYKINf01MVy&K+R1KDfMu9j*1%nu6e!<&bK1*>2YE)3!Xmk)t zG98rPvTD)+nb7?L9=1I6xh>!>I6F|rNv zPi|Y8)5%>xA9H?U0#hY9+H)$SMpzq1;2N=y5cXa@SJD{8lKt{IWvJKc{&c@%o6`LS zQ~X8tK+x*$<7_%7E?KBf2Ui$Vco$S~q;4?)e-X;_*>7q)YyCe^jJ*o!_zm?RN$RNt z5Ye)U#`G?ljoaxVCmJ^f>rRCfJ@?T~6Gv*!XWt7-=*g8pv>LL-wY8!(JP+EvckwIj zUA%fcD#!Nr#T~CUpElQ~%0W2$9Dd&CtaU4qsp53u7!yx|-i57dafa&p1TcH*Y5{-U zF}-p60z$TFfr$c#FwOx*8T^ReWdKC7J(VAz8CXPi!T`e zWcd6>YR-r6YdWP57W6RULm!`3f?+~7CgGO&51idjpbI{WHn-BhaHx)qg4kdnUSo8QPK|gV`S+aUeIdC`Jw$xcD2?1ZAm3sU zIJt<(q5=rC#CVJ4cktt84KaqxX!AbTQ)1ZVAx8!-^BL|BnfTb8otmnAM90m+IjrXH zM!j=_QzaVR1jmm#C^!zPH`}yNY%2c-S2>CFy}svRe1r#-sw=30YO?KCLpqE~I7qRV zj#p~EYA8RXrxN?{iTJ~zWFYB}2&hY7=>WDTUw2wVdS2a%!jn(TG+o+`>Kc9#1B67JB97A`p~{14>Go+>+hNY2!1 z@#&#B$QHNR9b|^Lh3z00O5$mi-F=jm|LPYE3-c?X%X3PBdB^)sQ8)!6M)`oJDG*2I z1%J*)(zRiC`xKU()DABKUxMh_m7rGz^~)@g6t5|6oxMc}yzI?MAVmQo!Mu8b375$$34D@bepy7R@Y+czG8 z7m+72aWFsJ=U@q{&EfTofIpbepq7%0Y~y3abkwrDA{H=^j*)y1pXgfjKv|4ZGm5xd@@7fCYF_<;W*!t0DOq)_0_s4vi3kQE;m;Qbs6Q83e7J_vq!Za%*S z=mH$ci>8O$p!xB=e8Io>y=6!$jM<>cDL~d>lO7WJ^2IBnfB@2cQ`r>nn;FoPV#}oCW2R1W z>B?nx051zTOZPg|)lfD_@ap>f?@ALfsI^*0EZA8!P2^$j4)Sg=qWY~*1hEf^^4OM8 zi_Rxg{`D_{OUp@OGV!lMQ#I3n{!&_enQ{=EYnL5&0C!1=Qpk$Hi!K&GrCU zG)&h*#VLL=AI3-$56~dUm!a<6is530g3)YTDTCf@oW=21#(~(vDTG(ElgY$G<;6*>)vdXzrl#nHqH5Ux7>BN^ z7xz|3P--gsQ?6W@t`Jc7e>cmGqtM1`4!CuQ%tTOs38YT$izh(#?-kcxv})*j1J2tI zj1K*N+EyVZ0XcZa(FM}g!GzZ|#g6LElmViS4^~qpy!3ZA>3=#^iV9gOJtvY4>vHYV zAQ##!guU=bVm%hn53dT8R_l>`uK+E-G}_S;apEYgr`xaFZ~emYQPw$E60<7o%cpjf zOQuRgmQxu4FC9fl{Z;dvBVJ4a#P9z`>`F8Mj0lDB18!CoDnTKnc*bGCV~IBX;5sjH zJCq=k5;B(cwNdT|l$G6#l<-2uqI=5i=_mosvTFJhAor1j%k0GQ*0Nk9qiE$M>6l|q zMCH6-MueR}OXBUBjKm4m#BQWd`rVp!l+|>xxaU*Mss|>?pU657mrLJr?ca^87@6l&fIb7z~H=s>? zOi8{ppNY>aP#`#R?Tefye1OlSUh`=vUI6;@qG$r1i^d`3fHqC{tbgfS>eBwj`g@?b z()r}Jiq^@KU7f+a0@Gc_I2bG z;a;G1yQS9!?)(am5a+0{u_rHglW??I2Dp^+paOfJpxE5#XZUfv>hc+E=0pdKAYh3; zeb}f!vNh_XVc{>=ph-)zaTi2H0G)$=uuQZu?eZQF)l_@2yfhcFlkS*~cuHbAK7;n~ zjE3KWB@E9I+6C4$Fdhe3*s`$tK!m>+&aX=nl?JA{H(L;}qwiY!9 z)-^E=BN|p!;fr#1-mkrLuXU6dbO#$l-j&vb>;u|F%4FJ3B9E)_)&SKAV!mQ^;chq> z_@m`~hy`$qjKQO6)BWMVSUj?T2u{{kOF@|`@DgVi5m+|?&Lj06`EV--gWw zN^_(Nu3}23=`Ao_HzYSOpAt(i;`bBAl&(dw&S#jg+yzVDADj1$ONSJt`unHs7<(Yz zpm43&|G6Ysc`FD(E3*Tu(9cZ6s)z_)Cwv!j>&7FMVd8&@_J&k$6yI(Z;rpM^vvbY# zh>A3F{~Op`8YyNbd9;Xc|A1ymOoXm*(e5n;J1#gmRHzE7SdjSgpJQ^g+XfWs=IqR>6o2s`+^qA+`Z@4Y_ypxhQ(AY#EIo* zvSW$sO+({ZMQr<$Zd@OITbTx%s|Ij1bmkl7>D%vpEfCpK zdEe{yF9J4TQAIeT;2!QH4s0qV{%S*V0A+Q)! z2tn+DFp!G{#l;yZCG*`CFUddH470}B^yj$#fdGN6ivW;3TWVIs(%_HkD4G~cNR z1>AK6oymsO4bU>2L9<5w?LBr0-=^KL0!bw zqP&BJ738lmu@RkcrDq`d5#iy+rx{@p-2xLOQh<3wkO-P2`~hu_tqLBfu#~|4^aRtx zMZMW~;~e{gEntVsr$l9q@Jnnt?A+lG!~JS#$?dT@5Tb)V$&;O@pG{VVW9}-u%z#Fc znk#+6B(<(R?k@`4;7e$RKj<~(Pt{+ey)MXmk>fGC$QVM5T+cb>550`#RLY6;vA++q zf&H7ZkcjkJzXQmaT~sX!xkhLZlZtk!pxR?n+97r`YLRNeDRa1oe=!FqJOw)Asr*TBMmNT= zpBjn$L)mYUJ{$5 z(h8Fp2iSDEF3`;cTLY2?;p~Ccqn~rPYVJOzjNX;ifNVBKTPPs7BnEgdi8G^Y__X<8 zSIdR$e9@KdGIJ`*eU%7lCczC}O7UQ&{{UH8%SY2~z=ErVD2?ry4()xV{0i=(7NYoG zX%6tz!NW)hm$DParXu$%k4ws+EIkT;xI^=fC_OsHQW!aEi~Q88h*Kd8dQb@{w`GW% ztLgRQoCET^X)GaFgTScHjJbz;7w-0+Jy(a1+LEk9jfzfo~BJ#TS`MenYiF=%o@l z;07UKx&%&Ch8YDm31f`vT^r6>Lp%wDOJbNy1&;+0gq|!1hOO1D30O~!%J=8}R*Nu` zE16R65FxMb@-Tb%z@-T{)~U;|I=Ql)NYR`qPBFB7+?M;i=U5$_09=Ci&05MKHl-z7 zP6deoO@g9)P5NfPJ(gz?6RE7}cQIn+)Ku9k@h;=F zJO@Tc&Y+OQrCs63v#EE$VzE&tA1H8{1Tf_8YxgYh>Ny|JqC?}73DKqyT0qZY>doCN zzeT|a*xSVi9UZq^wz9n)r~te14aYnO8ilHx7y;JojJ%Xyc3}oP3jSDCh(-zfrbJbJ zm=9r%TfER-7& zpVj&Uhg0mf{2ly$!1VMc8S|7BVqYDPVUfBMkPmg?t)pvTW9}OaWIR7@7!7W|F-3ul zKGLv>;-$D*T5sW(X==8H#X#CB zaa-WPrvyeGZz=4&EyCySD&nS+BO$LDKi%eQ`W6N}1Vys>E1bRmfU*b&3EbaVX7N&! zvIC51I{!?o_h%|G;zKaK_dGdJ4hj4*1;(!OVUq)sPOLw=-3E(Ddn|}svDA1*C0*|@ zWSA(C6{^gtXat4b1e(UjL!>qEAzL2yh0tJsag0;sAK7ji;oRc(uy&nYtJFMFn!+=q zgBv&Bh=g6>%N?I-MfP6QMw$~hd*_Ox4d5|n)Rl6S>2xwlPn_687$^P$!FA>z7jSa* zDqaQWq*DAxgC?18K}uHcS)h59|10CKwxL3jnSa?Tz#x!52k#fv0Z8uvw1=4p+u^jM zvg+J>Sm=c8Ax7I~)G&rLGY9RSx8~(b;({XEQXkHue2g^<9=&@u6@r-KY zXot3a1Hx-C&AQ|aW@q8LS0#2Lnc&iNK~j6FH%x%N?(7zN z4%gloxGBK?_Hb2+cgOW6V%nyOZX*wQgF88dCB{075g|L->gBnfHrNLaP87-z z^_r!EA)!N*W@W<%ewbVAo(}Q|bv^atIDVk`fe{_P!_D_iSWmbIS_X%JHbCR40d2Fl zH$A{Vs89yiY7E=pUc31i%Q8PZBQD^zFDO?+e1_zv*|t24@%UPMN7+Pt%a@M zg{yFil{1j+lP^J#Aa{uzEJs{P<&yAwLpHJtSRbxD{8LnE%`g6`^vG%_!s1~d&01h_ ze8{qKqmKqhUV^%J+YO~t3OcxTtc)N*VIwP=0u_RAbH14ZA*gy&6!L|{QNUr8O0jTR zz9heHXM=N_Lsunmkg!@+!QP7|ql53SS_lmZu&A~nY9-*E_N0JGzkbCl+g(scWJ~g3 zwqrk()77FYEaz2ecn(XRm;$gIC= zgRik?PcS@TMeflaY}$RS%w!-tA^lccN~Jrq;DCGl0DGN1*wVm|S5f8ETf;&X>|Rc> zSP-q;N`5AaIerUHhGWV=>P?N|s9rHY4I}a(=7W!H)SrxUNg@7v-uLFL?iTo7>S$E;)@b*0 zft`oh1|v>FRmSi_zT2ba*}d{_=fX|izmEk$`4pQQ6{|KYzCRVVb1^0$g2=jFvyYr? z7?#N(ZZOtx!7<~;*a{NiXs_k2-y2ZL;(CeJgRMfC3y(Vg-sX3rD45Sn6>$>7;HXNg zK75C!EwEI{n+9GH--CtvA)};Lx((?4DhUiUhNQ}V@4zfBac=&P|H*dI zpiORO=A>{tNNPpa#R8pBW;M)P8f_E9c&@$54BHe^1vyD|jnKw3 zZ7qncPs7}yO76(1>JlrqU*TF|cVUqP_*+tjyVMP0z{X7(G&6mN9XhXiZDQ=MycbM= zc(Xo1bK`vAV>42$ z^e#*5fttwAQ0ri$SVzq;P14)&`6|^4M1jLYF@>norejjdAg^K9^6nO3U+jHI>Ksk9 zXT~k+C(9Y)#$U)ZExlmkIexvUNLLucYL|V{rwm1hs@P@*g&O6kKeke90UbjMUhj;u z8-KduoY+_^S1=GRgc92Abme4l)nRoL(kq0+-4;@E^bEPL(K0r86S(^C~iq&QLyTkvumuo zg^L*2%p@WQ|Y>ZpkOK#tIbF(4TK!rairgYz^ht=>vR_!7U8y(v*`d3ehdi>!QAX_*o*q*aSsO#yJBV6SJ`LJNQ)F{A1VO_HRf76!cWYWTY{40xU@GEd69(>Rnw=epo3Ca&& zWOGog#+`i#l~oyQwzLpK3-JSsLRvvSZZE!JV<;_gw>*1i_AR^)24dxhtQEneY(+rS z8h68)a%?eAIv9&7z9Q|}7-e-!85f>e2L6etOc!L$HyR5<015(HdDi0y)#@<0IbXOvpF zuw4{NGGH?luJeK4f81AiU0SUJh{6Cl(XGUN6P{gr+$s>v)WM`%n_+hRZ#nmp&=J<; ztvc*GwkF{emt?C7iAT^D+uMk)So9fM8FU9&k;#gk55$@yHDHZ!NF~Yyy*$cD_U%^~ zW#FN3lAFk3J{@=il`z51KV;Z_YpR*keIk!yId`&3+o zvm1i0$z~Ev#Rw4Plh2TM`9ngfRf&=_tL+Lbk7pQ(jq*4RK-V7b(oBN8kg z7Amix<`&woU44m?qUf$P(fSo5Y&6J5V)3{cC5j#F98#uXOo_+~8zy;60~}qIQm^qF z@GnjSE!PjGj30m)u2fQV zBql8bIxs_X6!}zYD*kv#7-Lafk3J#X9_eF3!m|TNr8PNZ?|-MPYt(inwpYS47Y%G*XIQ^Hs)Py)Ve?$H!7vZBSY>;JtcK z(w(d$_esMm6?1=c}VOn z=VRA3jE+~QtTe5}o-953r{{08yaC`J?B39;70Jc5TN%loqC(*8E$JXyh>0j+w-fp7 zZgl)D?rs6=`-H|CE)r~~0o=wUWY+pKg|maB!)y_k-pYn)lLBjC3dC>0cG1lX*g`7t z9rGZ;UL`eV4{H!2et+P0exv1_#2JqL)e(h)W;* zG3peB1QLfwcA@)(*HGZfmIV<7S?2hEK+t;+h0;wg7S}2ZgFGY(2w+Pi_LTE1JYceJ zu@uS228!B(VK1|SzUbF7Ry28p(vW7|nv$0|{tH+R&9IhK|M?csGR|14O08q145|Ri zi1hFgW<0keLd0>vAb(ruk!eQ72X=)Q12v<0Ven6gAbJcMP77jgglfc@$BBqbQqi{1Isr+ObD5!Gb{ zYFi^TL9lq1O2=1fC>404gbya&Xpjej;+VwTx&So1Wmc7%fha&Uo9kF@;V#J~mY0FV zrgl^+^ijAUk>hE0*uCVwR1Pz83|f)#0{l`yZ3Pr7q-kvLe3$}|AhZg-rv;{kj0V!^ zp+5&Hk2_4V3K{z$CToEE0E+dT!I?+o_hGaaxHoit@pj+~#41VKxB2|^3M|J@2Bk=j z*Wu-!H6I;Azd2nUzLor>=?qEpPU_6i_*^R61AN$+zPCP8N{kU8J1nA9&^qNLjEZ&X zk>S+-oT;g)-SHSPRwfRiWaVei!h|_MxL?Cxk_zlm6H?w+V!;`kTK?aZklzXP7t23~ zG4UW%e;8{;fZHk;L2HsKrc79OxBPE}sYdM*4m%|Olq$0wB7q(Pp%?I`))P3|lF8wy zY&Ke`n)No)u&#D!^_-|n9WMZ%1b%{yCb6iID^L=AV*OMjsL;NIXqYXb!ah{J^L={5 zbe!~Cw;bC@N);k@4s)0yzS2KY;-Wo{5in;T`o!PB3j##RYlyTYA-2`4524f)Ms%!1 zgBD()Sy@pit)UldIpQj_$L7VgnZZ=;c*zQ1oT^Y`^vds#Y3d=w*n;}nPXs>EHAb$D zFA7{z(-V{*Uif@{S6mmAluA@b-c3>n`lRiv8GamMT0VuFabP%l@Ke{PWa#w9I^@-`g%8* zi7-~Sb-G4Bn&DTZ&YAbw5m5$)wp<`u0V2jW%Q^#=TpykBDvEp(DHiH!`AAhvSTJS1 zU18THy`aQe1OU*aaCwqZ+|AF3N*73$8yu+!m${pao&dc^s-c=Dt+I1slT$7+QDNU{ zf+}BOYM{zc&3CFjR!R?2wDpv*kuBbpfsOjJT5P-lJ;6rc%35{(!%tTE!ULIZb zw4cnIN)vV79oQ-cy%Y>D%YOfMmCB~_!=(A=1Y@x)^=o3BauHbvsA$}B({X@GT}Kj| z=fNqPPNW=xzm&3BKeUW~7ld>AsBv(T)X}qNk4^|jw-IM#0ijfC;vFZ{-RTS76!~PL z_6W0QZ*hF)&!(mrxp1BjAuCyD26uv;)(6&zHuV@pVckTOAyiW(=LH4)u+_n^e0S>V z{dR>$3d!QM=q91JRBqdg!T7OR^c<)2m*l!%W}?_u)GFfpNO*--i-oq<@cu!L2mK0F z0mopEF2EdlmuMRKEQh?f)~ zI#Psx2KkV&Us|)3+HivBd5jlNcms8-jEb2m$2sSVflng~4}db8A1!dG!bm6(s=+vE z&%yFmPi{-a7QG-ZuzU^ZUlE}shjdhhQoKp`+c(&CFH$KNG`L{)vOX;cnWH5!Cp?mF zZ2+bGF9_l)bXa`{S^4WVc=>Yt?M#rUo!Bt&K~>Ou)Ir1a?2vVkUJD6H)q0kO0+iF1 zLL|P*!#-S2)FZtD1W!*kfe^w}Uu7gKAx|ps(&)X%ii4RkgSnHqB7S(FlGLStdZysV zB7i*JEUy=qMjTYc@E*!ODZwJy6SNXRjBDuvbFzaEYrdjN zItLriGQ)zN5Yz7!O)yLe-z9F>azThTU}M%!s7?U6_z)`bC z%`Xf&s)HF`#T>;hoF92FF)oxWMcK5o+VR=eHW}|E7DlXQRBSMK=^-cm7Svgh(byGg zh?*YH^p~WEPSNGjS-wYqT9xbA)aluD>fq(hk5&e6-evg!0Hd*mxG84i_{{PY;Apn z@dZyMp&j=&8k4SD0EEU}sL>M`M!VZCi;$KT&sO4_#|zX|ZeoeELhl3p12K0fqWNX9 zpg=O}C8m%WPWcUC;Cs}YT-W2rPS;^P1fZzZ1W6+Im=Kfu^ASBPAt7p;ktamGM7kyyEMrf=M$<7Io1-$ESKen5~DUWF%w@Q7p3wp#m~Xb zuyQ>`eIqv3lGs$pSE>p|;sP(7R`ODPLgN@y034qSg%Rk`#d5nhXY_(Dzqf-jkWTWG z4;!`3xVBP>ii2=Hl)GX1=GLxh2@uJ+l6fP8a?0&jziJC3;h5K z0E&ZKSu{|!7mzSyts>$qNhjFsgrhWTWr~+ql`VaZr*t^|zIX&CgTc~}_&KIst6)S) zg9ZAux=&(Rr{s$B69R>ZYW+l~?u$EuiC zdEHA~55(w;*%D=g_5%%il#)|}Q$6mhwi@3*Tk!NHN3#sigIwUIgz9{*EU@u;ax-93SWu z8SQ2~1lewHAR83P))0)+=Mks!)of)z0Z#3zJmP=N?XpB=pdl7<2_e>hbR67s7yj z3xDI0u+fT8H)$|3ieoz+FseIVs|D7{rV#I>oIzezdEHncSPNTWJ=nHkvj39RzOAQU zh_LZ`_Xws_nqODyrm8urV7{yW)$WPe>SW-~R&C7EG=t)qDy4uU&%i(`REtWkgAKow zN>xIi@(xuxaUWpdE2!=t!nv+0NnS9oN{;E{KhfYn0deFi2zY4E$b~-27o;>rVhWxI zhq{xwXj*$@719RPrqv1%PgevVtb>&;mu;mKMyEevmHbGfTS1e_J*^Os zlnd_OsG4)iNeNm(T?Q*S8*T+d5@#lU>Db%Ba(eUa2F2x8_u1Y@`=}$zH!Ggt0}8>l z;jg?j7xJKRrF09qg>_gkeeX!9Sl8k3(H_AvuV&^I&=cVT+K{>y6!?%u{l_{#7@P%`n_L(vV5jBRM!?tfN>S1Q_E3g$<2 z+z~g3^d3hfC~~^h(WfHx^pKKcwtRbUSgAG!p_F$9=OPdS(xQ+jj?R{X5W_N@eS@Oq<)GM&Y#{xY-s$R7LlPaq6;>X7 zTeSX#Wi|Vk?Ov%Fh}8;e#__4s9$ciLXGGBW)~1Zp{}HDcWqa`Jo)w=q*kP3i=;uX( z(YMX&Zd3gNd?NnMi-O<~ncW1pZcuxIj%Q%0Cle?cQ#DZ_9(3W~h`cgEvOY;=h_+fe z2bLYJ9KOF*hk){1`z3Zyc9oBsNW|@L(D%xZWZ)13%!c1KpIDKon##Q>{AwL~Kc!E> z*5YXj_5$wvj?K9x#XcE|-wL1!Xq$fUY38UVgl^8Ucc-)8w!YDxks*sU^1YySPB}9- z9Nq?(v0HwjDf@l2>Au8@*!uQv_IhAj0)|^OZWn@My`@O>NU;eZ;<(}-x^aOTsbX&2(zUocNt*njCe1!>(IX2(GwyD;N~V6q zadt5pj54aaxmFn9g4RXF&+v39^ULTvoUaJm{pP@8I+}aBI=lU}7oc znWl$0>>>^C+zUPm8BP?pbm`#Cu5OkRH=NqfD$uoqonEfIat%iQ%(r$1i<<<-=YITC z^G-=e<1Y9kF7-b@(s6f=lTFHIYL(4+-==CV&D*b zi+)^OlIo-&8C)B#h2lO^<9V;pM;5u_#Q=KKzN4h{fiE%OX(}EBsazu9O+# zHJfX4)&WDdgN0Epi$&aMRk&9eSoWnPqQd?Djq93aOjrG;%QbNTe6KUZMHj{>H_Ho6-7~ z?sf%^wb9+;AHk&H_~aiyQ@MU-lEeV1AkF{iuTFuQ01epO%%{X$F9*1L7aLl8#Eyta zKEky1jf%fiZrV0)5bOJ&GPNFBXeVhhgsb-rQAVy4t+Hm>_u?}y-Qx3l@yT>9q}SqeR=*g@d5cpJ zwIIvCPf6;qpo>2IMO_No9}0q*`)7XgO1&FKEDwy%%Bgv-s)n(Ayq5uS9--srOpXrs zq>h*uL%dg%1ICB~L7>gN8{6-T>&_hcmX|Lm>2j5Vx5Go{Veu$3XvtSNCtW`{ZhL~+ zv0DU5bq2hT{RfGUAMj>bxZ=CMH=<)el6-Oc+7`O7ig)0%MdntI9XJsj+ilq%|2s}y zBw=?}fDMa_FcNt2lG*0BA5mBV-*XCC&k|x_o1teiX~H;L^3Sk?=x*iC`WrNrwN78s zr<*692)o@RJ%@BqEfZf8yY{ za#dIz1339Zp?Rs5>KkGoZQDP({Xv?FBa~8^O}2{$@N-mrbj^ry#A7#7A-^QQ{XjZK zl}hwPz1|L!48TA`-TIh3mRV@{Xzy3 ztOV|Uu4OYKpMo5Om3E7-67&x@pAODg>U>Tk^y1?>`@TUXTaZ1tq|+Y`fhGQ<6*UFj z*8mHrE>WAUw&WyM<54h9;Fx>}@|t*u($J&@2PwvGOGr?ikU~zH$q6#29A}s(kwGoLR6MMjVTXm>D+T?DD?>m5#-%eTR^K2w7gv>a ziX28_P|u=s;Qn~0_))4^M5!Nu+Tj#yK3kviAZR|DyJeL+Yv{=?PO9Fu@fG~>Km3Z9 z>ZbXu>?J`@7BP}t?Lgyw_@?_$#fXnI*rkoEBe-8sKoX%gPzMBd;}xN-BsBL*MI~{O zAhi($E}s=ltDp$Ph%=n;y$$+~eu**;EOpp^)9n2?xcjz>f!aE4-R&=t=pvIfIOY+F zjoXur^^+D~j9tSO6=naUCldp_NATGou2hFg5P_t#CQPn?mAinPXn|Zql=NcB9uoRZ zc90+lZtpcbk;gEcRPB;0uz2`Fbd+#n4ehYl7^4LuOiCSvmL*3qG*O3Cq}lqv+ZE7e zS@HK;K_wH$2^yAxnGf;}n|}%36>$r7jxJ5#5t;;Iq2tYxSiWP31=t9yPcdJW`vkHI%O_ zAtJvJ%b}L^x4;c5m)-?ivmbjvgG8pMgolAlzO8d!F77bE+koYz{rUwhryLlt!E52> zsgT8us5R?v6bG#L0h2a|EU9MzEkf1M+EO(V(X+q`EA}0_!hkV==_(O(^8qQ1O|{_ zi;pNO@8yX0PNhrAy*no1j1bg(LjvkYL924I8AM04BT zb1lsxG>hB6j?;W!AL%rYPf?)oM*JRhh1Q%h>^|eegEE}yO_OP`RiAN?mgI%3&kRB1 zA5vMWXCG4kC-m#xk>nCnOIhWpX75oGG+W#{q!>&WkMk+bu~A2K`(Ja8S?3JnKBno) zD0QvjPpH*lQd`o_`?yO#5CGc3_neld;wMhua6)nt^?%?;Sxx2u*n2XDG35ILVAGl^ zvJhwQ!0Phr(g)4K$?KpO*^?j#*{9jV3WyUd^bGx>+*SNBVLyL8{Y55aV{k6xh~6p6 z6{G0La`u7V!#qV3c(mp62NVFLSG?M;TA2`EAC}4*{fRTLi1u-ppM2nm3r#>{x`16X zEL$p#^w?t95c6_DdI>WiMb7zt+`5&}KEA>y*UZnz04DE?m@J7+T>kuwf>*t9I33w{ z+=~urhFEl*rWWD01VjP>v))-RJMj1%czW|I{UhdPx?|S&reDLhnxRzDWx!iut1e)t zKSXDl`6^s}87u=cLRV{JkrF0LuA^gPFKim*Ccv5Gu;5@{!p%mq3@BI> z&xTJ?+v+3!iK{qytyF@D=Xz9B1?|y~f`cOW&FX{fTS+z`aU@BjHfoQ{p^=@}`Vg#K z8aY~rVshTzMEwk`ghkLSliy%2lJttbArM7byy$1cD5Yf2vlPQ&GV_}PAH#wFQB_fQ zb_`k6f;v9`;0t{FR9nY#;1FcNC2A_d2{h5pSE=`gJq8DRwpiQ>2X!OFYPitg13<%5 zogO^|ioxodKZHx^$?He0@v<4ka4rUwo-*z({DkT=?3tRNKg0!fYWhHvvmP8)x? zpo<}Cr?r<7NJka)89bWovpd=sM+&`eLHwS4n7nO_qMQ=VXS6I{n*Gmv@u2dFoLWqd zdO@$T2yWO%b)>H2-v`P)58_&9{p&INHCiujKHV);pa(O+{`GfE%B|>N$jhOyka3Rww!y=sNB^H9E5z&N8!ff_`{HRaG#knsQ~47}J4%C;%FP4%Nx8Xt1S5#L{21PI?EG?S_LZ7G1YX_v_JBjE z>UMy4NuCD3Z{oUsLCG+;cne5&XW00+#lufoqgy)w4iwyZR36)W{8#|YcY9juy~k>X z*r6=jk|}pL)@3me0lEq_Op*Tw3_tMt<+Mdx@rLW*xTJp|pX|jcfy`&sC!YF4W8ppf z17or6&pvf}Vm`k~4|lk;2(-Zdqb#kp5#|X}No8YAWH=L8BAq=ew-Q7s{Fqj5U0U?w zWJlRF;-Deg4k@RXGYr9J<(|rh$mbu?Q5l0%2AY7*lwE9G2p6>vf^aFFiKL*D0-&%F zVB!muSHy{7b|Y6IKSUTuDxdEC`VBT$5Tg*^6zlE3F4?v2`9j9z<8th;J9 zn@&QlLG7^`l{{sf1M(xN?wyCOGEC5qps^6CdqKV+M*+rTjt6K?_!RLNhzv4_KyH~R z&+;uSJZ5xNtnPeVCM=OEI zu4Z#;7-~^_pCP;}2m9?Ux)RCD?6_>8M=%%CMMIwgyN|#{vh%Tu2p{%`0+F6tsf?>0 z=~|W1b)sas!yMY9H|=-*iNTEq=OE`W?z=Pxd8fk@J~`|5sUtv5KI{NN-6{{U66XPc z#E9~g8)f`{y(a3eSCMdzYLkist}l#Yt>y5*F)=1J_93nR;r0U>+>TfUT}8SO*)07G>^rjHaHC1$d9w~+WRpJE8OJkgK2E7B7yo<@Gf+G8|yTg&|^D?^P6 z9Mp-!$ObhQMDsHkARiHlz?FkizO{B0R)F!&mY?kE{Q#J5P8FguxQSWu#JBjpIOr$7 z#9N32ZY`(i6)qao>%WOwtBN)#t#=70lKFr`8r!k8`AxvHco5FiOeG_?u06 zX$dKbs4m9rSPKU7>7$6>6U+(RP1!SR$y7E{{;(tP5Fj>U#3&G(S81zao|~3PdXn$9 zwaOgR&OnHgG0#e7qS}AJ(&4G&=f|S-(yyo59_8;hiJ_s1Qp_=2nJop@;?u_E&6_w~ zR0WJ_Oh|iRJ?~H-abPhrt_YHGNF{riJskLrUmdtj6uKI9ee*zO>@<5{5Jz2vUR4e) z9J7&?E;wu>2 z%>n-x{UNBGRX|@jAQyne0ffxvsL3!%VDkp84k&i)Ae;}&*(W)qFv>~5zg~pQ4P1a( z`^q^xpjql!SZ89|XtqT+v|eX_a>a?ogFaI}dg+kq#^l!SO))*5S5XXUFd$onB1aUY zjd*8*RljCXIWP+|tRIuXW&xTxFEQ=}TEGW^U%Hwdv}QIHRt_lL6%jyNFAGU!SbfY*FP9!v$!4i@$ zpfreDS6ju#MnBi(A2ywobUEPvELzu#9mw1S7#HsXJxYdF8aV7qvJ})tpwipP9NfXY zL63^JEU20m<nSRMO-*qL!Ewb#*IEJp#ffd*Qzy+nA9lcQ%TNL!j zW~3qqv6ADFL|P!=LfnrzaqB@w)=B81CT>_-Lv}<=t;^3R6*5O)T^1Msp$&r?~%fnopw=J=EYM{oabA?2cQVvL04Nb>)&}ed{Bvg6fp| z8}@0lsZUks6s+$ce;;=TmJM6K>IK5EFXBc3AGWJ(&CpWPsn)zEUHO>XM^e#9QI)ev zn^xJzm;45iU8**lt-dboLO3Ku~@q{V0OSEQnXc{ZWAYPtxYe51a+ zM7?AoI1aLRC~}?9AQf+O#c|mgtmX!oTT_vA5iyxtP@c7g3GzWN4?T$Dnei~EK{C)= zI|8>ZIn1cKq*^rm-(`OKgsNliIg!7~fRcZrOgI9NmGTi;! zShaj!To)uq3A8dZkH%dgqz#=>Rgwd)cC#4V$&SU1A!mgzmIqXy6MO1wt8s*#|ADAN zKt;iiE#;rVNfE`49RqmeI_YHqL=+z(co;62KK&Js$B8N)2#z3EnHE^W9=wm@r>(=J zW(8c3-e3LS&M11kk zMRD_ql5jXG5FzH^R>Ts=@;zqIjZ-AJ#VB3vG-udt1w}P8YTAsO2ib7!yr{5;)2!Bn z8Bm!`DYstFW`o3k;8LB5)VBZ=*N0>?Y<-9~mbx8O>!M1#=VV)ZhpcdQdDe2vAmo!t zqY{#xtx|o4@|UitIJ8%c=t@sc5Q-%&Ncx?~VQfWlCw&?rIy2lZ+GPal0{h zq*5`kwpGybZ?u;Y*SCl`N#RBi7LyGo==hSCs@%BPR0CpC8GXtm1pOCZ8+Yy_7EQX8 zsLgQ*GH0<X7Un7*S-LQs$tU42I#BQ$7^-KESY=TwS*f*RlwKB}vEIElTwGbSx{ zjSQWY&`@Y!P`()dK>Lui*X$y1{Im2_T_bL*l^_IU0hbLq?pl1v9^X3A6QOD+Fn?Dh zDf}V~hqVcb?o;{VZ7d7mhKpbmu`ccqH(srs%iwGH#w*DraDJ=h!2TVK1HYz7O?GB7 z$MsxrgCi%CQiKKhnz z3wC6ElY-WH>5LH%J z(^ZRTs6>PTRgYc~aLtCJJ`4BH64OijlIO!3+3e$R(_g<1izO7+?BHlj7ql(*)K3*3 zILuIOF(Gp?WP@3|DT>mr7fJ7J6vppKa zkJVHS%aj!mion%4P!ZTDgA>As@kf21nja>~t+F2p$cm&`_MW;#v4qO{-Ay&7=lH+T zJuk$fwE{>uv2aNl$`*3(P`zlKs!gb*fTR{UBXOnaD&9qbv^Mv%B<{2RMMb($E_?lk z^9F>15+v~v;;SO&&Qi$t%b&~g?cH!iGp0%hYjuPkYy^|R~!~rv3^&ng>`e@1SwL6^h)m(V5 z1??BY%v0V1Ua&Ubd{BZsztNM0kU!Sep@GYW@Jisugl7WwPo-qW3;NP&Q!jB`+wRu> z4v+w;kD5!+SwD7bc0nNy%KC)u2)4lKjuZg9lE&!uK9M;%do@@%4}_Y`9q_iu>nrM0 z<~+von_3v_tK6mr(JjU0FDzBPsM@`Q+OU6xQz`OldWrN#G7C`>_wj97j~ugmj=Q4S z2)%f{nQ0ezUuByR<1a}j>;f88DdxO8;GU&?yL#nx{XKUC(vMa|g*?^YB4te)?#=A6 zFq1uM!r&bMR5hE{)?^=<`Ri_)7VTlU6Ky)B?`|J{U|0W|kb`19#RDBYoI_<<^{7zF zN};7OZm?3gvTnOfoG|e$(4~?+6wU&=7w#*GMI?KwwsX7Dk*314s-FWw8pHyR2Ps%8 zj#&LhGB5yCmgVM={%n-^Cwv(Ta&Z=*!`n1r-XWw|(%Ow-*#2E6uR61yaF5feh9XfY`V>j-P@qNrGQD>~m*zx<3)2o1?~aoqQ`O5n+JV5Q z-r^Il?Vd7=AQVU4Y3ge#F-BK0%$ zGeyk^+-Vmd0krI%%G~h}dz{V2WcA8VJa%fe&<3SBMB~Jxo*JYT>69Ft4Mx5Qu~2_D z{z*su<)s(uze&vq4j^zpBMzpnu#=602Jzl(=pgM7K){_$Ox&QOHc2@lLZqA?s9s)z z&AL!=X~%!vFh_{)CSDB1MuF&tn!v=0qf|0~C*ene=25+mp%TEK1= zLI~-4=9rp%XLJv`jMcA3ujVDS%q2K@* zK)70SaX7S0Fi%Yz04=9l6hidL|M6esfiXy`;?VlUBT~>@4H@BZ0i>7$+T7MFC?c7B zWPxn%8z>5a;8dr?x}*||g97pPJWx1vUkq1eCqbRV;2)bvs5LmQP8u?nto{yc5l%O(a_C?#;teMLaWRj2urgv z4~zE@r1#Fx8ZGUjgU~bAOvN{EYeI>r#ad+UCm3*QO+ke)MSn~^b=qmVOwAzWh4_9a z(E(rXjXf4rBAQ-!qsNV^7JOBGOpZybAC8zpqven7YPcu*S!}BCb&BbLfu?|Rg0Dj< z)|GZVlRMp<|IM%rDl&*e2Ptlyw*Yyri`&JI7t}kl>@RHyDh}5T7Fr2LM-fgzK4qD-~lq^c)gleFoV0v%ZNoqi3M z+Ljhp9tO|`Of)(!cF0Q^rnmPUQur&^Z|~ZnCKT3d$jXV!Cb55Nojj= z{C?>04fBVQda)(%1gihM>duQYjnob-v`U!c61I+6Rduaml40JSVJ*_L66t5*408fF zQ5H82%WCJ8*vT7mLc^3admIddg3w@iSc{^nt8(72AAEMQ7S;XRS5h^c4xqmW4-U=} zd~Ry1X*9Ek9_?-6yl^?@_l3hEeI)v0zzwH{2YFl0j_f#O&wy!UKaQrG(yB_F%0V9@ zgsS4Al+g(e6*HwuuBUq*{R((D%R^&VN@lC;=TzwAXi(pNdr&tziKibj1<2+Qp{qX1 z!75fde>j8L9871V`d{LEU41P7eSosMGaKLnNvP`zZXIl8MrjGx&jC=SM;$ z~6Bi3qn-ATNJ&aevl%kBuw^g?2Ux)#5H3HEw?4J>OG}pJd zJ&Z49Se1O39gI;mftRK#A}V0XER0O{R@XJtL-N#(!o|0$Mb;6!*jx?CtS$Ta}3ihucOy9AOS8LU`<`1l%lqPBve~A+pM+>Pcd<*8pZE2`>#eG zVIMOpCc&dS`S2{TKbRU;YqFz$uT{-J1!|jYw<~X3GIh!jwB(|vY)5olhl9q5M`19R zcF7SW%1iF7{53jt1d=X^w$>iD35!>5f|wju?U_SWAu|2^0Nd!aBIB#DPdsZ#fGH`i zU&EOO-vr>R7U~xZPQ{41<&Ypif;w%z0ka#=45$$u6DA^Fn$e+iP$I&aPuU7JOo*yH z1e`obC;CI1;%IJ({(_}tP$`tsnq}F^Aqw@spM}oP56?t3E!|zS_8lM5^M@~CaS(WK;-bn?A7H_F&N8w@tA>&vw zjw?WprgWpZx8^OgGHhsc;;uGkJsk9Asfg^Tz?ky`dmXk^yNm<8yKH+-0s~9bWBEer zLF*1&dRv7l?+*GT$xph{jUjBz$3yT^nmCE#UmEf#ADAkJotK^iH-b1OsW`K_vHopc z4t9()Ngmla%VS`*d^o=^R$FI*%LxCHRpek!hj$O*1c1A+D`6`eyPIBm1<*F2MmS49 z%O_`;rjP{}2~z}Dl-id}hU1hhKn*!Uq||FkV--UnT!!GHw^^a7pgXfI^i|;kiw%1w zeL|v!Oj-j9c}jbVN?`fj*;nty2+vkGAMam)Z-fJ7LasjZmWkrGi$HO+xYeodWz+}0 z(GCrDF{UJWN$u&wTm_GkN8@c}e@>aZ549(%Qg{_t6a$y;rQ4@3LE|>+HLr1Cl^Q-K z5=&xeHI+)O z%ao`R4r>-8ny8Xy8ck(p=z@TJg3$@yCQ0;M>8g z{{P^u!Q;7?a>|DZcc?b9wXaOs0hWi*Sktc-f$^Z)l*_%gBtPKsQeH>vDfKW=QKgZx zU*u)NUlmOQe1K|7fptP&wrjrZblA0O_)kekA`^if_YrHtdtM=`J+NDm90D~rQ#oJx zF*yUSA{wfb+6}d-;s$cm=r6EFSt~xIprRHK%-Z6+Ra#9}3VE7J~ zkK5J1;_28znEv&Da1|r3#-Tl(2j`qN3nr>o6NU@EenTY za|fJ5AbS4ontFCYGcOd*2>tS$nd`;kYed@MSvOQNVHJ3BQJXF97?ez06Sq;uEY|^Z z?~FB}HjEk#@v3Mbq~2KI#w4~>BT|RtB7%nvNj1}^_1*;ZiD^lf6=0^SODZ zGL%9!*$6Q*BLyh>3l0zC>Oq@j+Z2m_ImT~VEbfl^o6eSuW79-B-@O-Tv*_1~kVVvK2fH32$A zNTpcrTau|u0qf74Z4P({yfSDq1b<4)s`b-s&+Ni(n^G*auI%v+@njFuM7o3GOLsIM4h29wZbh{$py9;SJ_UWeft5nU@wK`vJMweqdr@ zBM5%V^<|G}YtDzcNF~fc_N0@pGG1Vg2qJ$12lnOgJj$zfaDf4RK4L=nd|MV5-1Z}h@-BQZ} zS0ne&qwb~XegDDxdqJZ`IXbuZvO&g`Tr^fb6EjV8xSBC0Od#yVR2k$-$0T>gb9}j} z@HI3T(Gu~)vsHJGqivaI*e~NPYKj6umZ-mpr&1fwu-BbOk)=~yn>?%8r%x1$57^gV zj?~C&#H5k$b=-P29weGU=p-AT)2X1{?2Nb;NJ?ezWdLw5sN_Q?rBy8w9v zylwZcn$BX8A$SPrH&K}3v3SaD%1($G6ogj^RtO)`@dgQ!edE=k5Q;`;heY9MaQG37 z)HPxR&EM|D+Y%?6m_DzRs>Jt?cLfEGAJt?)aDSCM_NgOW zxM>-ai@#zGuLw33gw-k>DNIGfV%y-$#(-*p=q^D83d%?5F7fi2l-pO51#i_3e zCsV{l7<9Gl)R9Nqe$SwG%V64gH({&}&IFq^CH;^==Gve6>4kNbr zk~ekw-5Og^VWZ)-@`rf17Ow_Z;JpCRr%24p3jlw>$fzNB&(=;p zBHcV5I_Q%Q`@5fa@hn0K`IF;|T+*D^QOo&)azf!I;T2YrJuq65RWO~=dJkk08TJf1 zG=!^k1o||d06SDD^!^&A<;qW~Ng47@NMGM)yi`6^7jd?r9$o#jnOZ(0vob3PKO^mN!tW2f*TK4x2HYaCA41tH2o(2BZ(3Rq5z`L!riL? zmS(RK(+o^$Q>mm=X*0d&E+7_4t%T@32meXp@}SL07LTa1Zh4eOku*~vP_7GPYLI`r zI)3UnJkBWINJ*oLZkH;E>4ISDOwi)MVE}vya{9IKU1JWXmoC~pVVex)ErZVMuhMj) zjMr=2#8vdJMW`$+TRxgCbJ{&9`KY1>q$Ewl;;I7M-4U!a?s&V`>l0JtsMCE2M}^Lg zPnoO9PMTK6D*Vs6Yhhj9q7*-ncqxS)oL&HW z2?E*G+B+N!ATLT{+GjyMCoZ1y`#c+EyB;LQyH(*zO6=A8# zu9Robo;b(cTENO30u2@+3Wd)g2pq?{#>jCbgconx{jCnOd>V5L_yt8H1eAYc=nSAs zawUP6B1?*upX*!#X?fo6`5XI$Idgvv(_$AtD3b?{lhY*=6`xo*+~;RU&ak(Wa-&ZV zxf{$QunIH_H&H=64Q8a|{0Pt@8w1Uv-2?RGRpxDfGre+%zyZWlLdY(qH^Zrg#28JA zQBhO-_W-rh4X%c4SRrsgMb3;Iv=x!tl`eoF@Wl18Pvz%=ZH18~+kECiWpuC58322Xk*#pQzf1H{-z}`#ml-F@ZIoA>#lpf>DD~h-+^Q+(k>^S5E5s^-h*on0$Mk6D#rUD# zquRLTfIsB#giX{@gW(w5w^EgUt<7n6IW7J@!0T-iE;&5=v?-hks^VFSH!A&_qObG1G>c6ad`;h6(dmQmZ{a7u-g zcj3I~k1WKUYLW4#C7L&eNpV1alQ7-b36BNoiqV3Ad#IO<&Vkeq6|M`rosg?rh)Oh! zrq_Z^;8s$d4^Vldk#iM;lXsW|E+cljt5sgvCp1eYPuC-!qhOH+{u(-xs zwGa!zTjcKAU(}8>ZBCkS1oj8a3w~Rb;M?+x$DKKT%}gnD&-+uZ;V9$3g}^Hvt+8C% zb>aced!D++pB|hB2N=W>BCz!bsy9cfG47onC0`7ot?Uf6tgi5xgIf8_R3hRB)x-Bn- z5RXm@3CvK+BjhxHuX-Jr&WQ|&hZPBS#u-9#pr(pp)))=QN2ySGJo%uy$V&i6F+DIP zB(W~P7x-xED8bG^k{daJcIri^845o@HPKDNT9VzwkzpHd_olR-SO9VeZ_->vNL6a) z2Gpk6LRN0Xzn{`W<3`IABoc3yo)@y=m_bhT}2LMy~Rh&pBu&oYAC9M zIy)&5hry6|BaB~=a`TFEjxd*_kZs$1-C;NU7@IiD0-~VYX{l;pW=WRK)#rRkqHehAa0F41k>qQC013Ujfw}&k=7_Spa|vv z8Qd$dC3$PhU%;fTdeUk!&kiBs!=b9%A2w;o`*_$?$4D8YY=5e!@pf`I-u3d~I|ds# zV#Yh*f`t^u62vvW;}ui~8wQf5%!kNL%cY>i51TEdRm!#MX5jmiF^DZdC%C;Q+sb@s zy93K5LkI;YEjzPC3N{$78dZK-JX$oqk7>EWt5izd!T%(aBrKQ+6q*2(THxezb5TN{ zSkwUQv+1E>irnN>JGPI>y5mGhF$Xno^{bb~<~Q`n#GMo7A}4js&jIlV92b!VXyD{f-+Jke!6EPv|5R<_N+^iRd|CTF#Z}mH zDFwM{YWfi_AgCmsE=DxVncbMi5wm>lzS_Jf}&A??;@-o>2UWfn>Xi7;i3Y zJ#SC2jr7yXiV+e*MJT-#^e{w2B&ViUj8r;eC^_FS0|!UYaD}GRwQl)A#4G$PKt{Bq z(<-4I_Qoq;0qf%R25}dF!4O5F&dNa=o;N!-8o}XMj%7!mU4=a;&AGsMUZ3I~>@Kc7 zM{vaEcPttLf#MLdD4=L{XYGOY!VdSuX?1%q2%bXFjZ%uLE_P>Zkupxm2jv_YszV>* zyo6pZ!(mZzfvz30nN#2+YI?%Hw~Y_`E$NWn*CiVCjK;oEYfv`rZ~#ULVimSCybUBG zbx~4HI6X~~NHlDeyW#5Wc`zFHiVksqmxp6WmFds3Kg;pqJDvC!;NugJIFe-8SFuOj z!Vpr{6CP*CIm(C#H7Uxs62cg9E5g2)b4@4esUVoM%HP|obA|hY5sqUPQR?sw5KFvY zB9mxOGD-4$nl+UPqhgGwJcA;Jp`?XLeYKiO!JF&6yyrxaYm<;O$BrO35ag^TIB!$4 zV~3K-@j1%!_OR1#RT;`<8x<_okdIEe<7oI5rwJg7Ci!_?;kHQ6c7_M^j4uao*IYmp zWCevy(041)9rQ)`=!5q&lIKAPp8qMCl{JtckL+tU&YCCGfJ-v9U50^z!Q-JtVjPF@ zgh0X_>3&>^^UC#&{OhGq2_(e84KW1rY%&67i5ttz89e>EB>FnDdRtDL90g86!1MjN zx;prmxyo{_e&;+d35NkH*ENtBK6-?x!G0(c#Ni}Vcz_>CS0?;Wf~b4yRx!WlhWN>VW9;>Q&gpJB0GTdHZ}kQRm_>@U9N2$ zm3kM92?ngaqV(4sP=hbO>Y-Vdw@`L~W$*@!%lrWv>WC*3l34&ksPhH>Xn@iTF&F2zXBe7N>`+z3f>1;OoR~^M@f4u}2a0lO)iw7 zM*fooyuq5YcTTLh_-KntaBeFDv&X=5B|P6%cGBu=Iw2>n$IjIMoy?r2XvC>?=C^d0 z!OoA$@YK8L2t%nO2_h01jmqcbxt#@SaBk2l(FT2=)K*|H2474YEbWjZ8QPT7UR6<~ zwfz_Q>9#NK9%p+&)~RFCG0D!h*efnH&OFIhkLqagg~nyUt>j*y0(7H7k0#ta_@=NG##O78^Q1|R8Z}X{pjY5%@bAUloKdVng^Kg zU;E(O1!QDbTbWf7lFNPjKCHvP*7{d?CYuFSXlTLjDB8ry;9OC`Nrzgh$z2PaaCdt+ z_k(9j`?;jHy>}Jmj9qK>Jyu;I!z4^qVeacRhZKDP5&XT;@*`^#pbtrm7z7R5Sa&vZ zYWf*k{;O7p4|UX(6Y6R`w6BZ9R>NzmbR3gt#6~c0d1S#2$}eDDBXygo0C2wvHj1f8 z(K50|d#)O$sDh@rcM`GD732sLKvbz2Wj%gmlI55?AKR2t&mBZ=9K1$!-$v7L_wkqu}NbA?nH^`l=IgAcU01~^% z;hbbGPn*Sy2<8Sk(o&a3W4v`?f6?8INX&y2wdLen;9DnHizj}z!~|g?4#si zbmKd~;b^{EcctYl2N%LG@Ww3BEA^;p5v9yN3_vB1&u8bWv6?by05UO531vCGlLg zo7yQ&diK4T-C#;^9Srg(RoiUqOAsc_ZU^Xtr^wLCo*p+K>xs^wis*z8k-2B~PIP*L zA0M+Laqrk$-ZI&z2hWS$6<%&lWxT%Oh<(bWBmg6zv7Ct*(kK|>wk9Cl*iH66vAn~2 z1BD0Kl0Rb(QixDelrY|oh|Vp9GDnq*Ho1-6&PMpL<{Ih0iJWnfrUJd&&<*@!5i!j# zR&DN29iOXlIq?s0Yo7zw6h8+Wri0f9@b`i0nGjB z_}^!C5y5W=N~piAu*rPdNYFtY$YODX91;R^1$wAOk1N}?0OJEaECKo{+ z=kT`A@ftnVC_@XHT&CF>&b#PxK{wcQo*mi`p2Q2T;9R4j-H~&%5zS{mr+_ZK1~56T z{1k`DegT2|1VG0yU2?Vy)*@I)Dwq(+y~qhn>6AtVK|-sSS94M>jJn}9AC-87wXk5} z8!Ppm*A2qi7b~7r4ArTPM(rHi3}(OzfBIp9rye$4X^xA3cpo&Z712o)3)um+$~h1~ z48w>LRiKpu@h4H2~bV z#tB4*6iUlNl)$ojPU;QT1ZMaypIfZl9RCu2u6#lAF^SO%*$ErgaQjkPK1B$s7uF7O zMsBoK%07`^40%8ljW*Y;g@PJ|4PBc~ay*z<{WU^5m%#KTp%A8tGeG0$F-#j%W+WIm z&MERHPTUNnj}j}d9a5xtF3}u4mL&24k<~%gmWm?!U=v%)u?~9z)TMwr3L&x22~XjX zzzvd@B3>2BdmJ#r*zw1vxFK=J0cWABX;!!(R(tO%Tn3~o=mNd85e(Crg>cJS7aw9@ zKnKVhBUmQE25KEWAVz-qxq2^YmcEbgSBtDAc>}hMlTMF={{JEBbs-BQs6E<;aDn z#kP1_xRwENeVzc{Xnt5!hK z-M$aLY#5=q)TD87fZ`h!XPUUEnFKd0T6?m9Dhk479A)|N-b^+l09K0BBo0Z9#z@~j z#F>x*%#_3<WLbRrj&N zHvZ1&KiF&}Ra%09X$mLi!`4#F7??ZEG+icFhN*@Dijm_8|4DK@| zDU=Sv<+v^~OJ~r!V8Kt}BsqNma#osv1BmYI@>0^6Uugi`k7QVV^fxqXBMh7aZ>gze z>zf#9Spqw#(@?TPWYa9o5)oX3Ls@D-yks4qmu68EQ$m6~PmDt@idiIn6!;-NH@;Ir zF2c?h-gbTWA7IXO>Ypr6t5B%2dF)mY4RUyCN+T%{UXdIZ%S(E)J?hENZG7SJ#5V=K z6*r8T-7#3ZeZZU`-z8IZ45ASi#aGCl*Sds916-50el=0%K}lK^a_ayeLaq6ns3_T! zs_P7Q!`Il$&JN|>^YGIanc63HrxKdAPmBv2BwD|q4M_6JFn?I0;qIK46)#>ojDHWs ztA7*rEzuz%Cq>4dNTL(vrK^GjUUQn`53ob=PiS=n7n2{oUe(ocj=X~B(cuA{v;&2u zT^X9?>69;Wg8+1-IbuFQl02y_oZ~izmN56ZAKZiR8$C{PGw{NL%V&ZxQ)@H3*u<|% ztbR!1q~SS?)<{vk*GMB7O&1f?ogm2y`ZE2lR5FC z=NpvriZ|wCr~n(ISz<_NOTaNm_HpG5-Cgf}2Fhuj@iFB90Ev}FPEWV9oUSd}G|o0p zLJM4|7VIQr*v{Ufq6QRweVzVpH8@aS;&;vCoGZ1DDX$ztqs9yHm1T07sOEwCFXk%B;I{iZ&g|@-NCC`zIT>hDAAbM>XwhgS4CVlndQ6^e;s&sJ_oK&xNbD}#A zwjEFQwq%`R1Ei;@8wiw;^BGO>yru+bW1&@`=xUSJf?zrtnD&j?&Di)&f*~$3pyvf; zLd#&EBpyzjn}-9D_pxuI=~A`~wAH|T0EH4B7U!fYVGs9%*aF4BF8K}@F&bp@|2RfX zQCk3{l`JNuGC|xU7yB&8P`@mk1WTi~oQqzcNd`Lcc0P0zU|pS@T8I1pH?`>^^9foG zN2W}0Z8_)j0gA+%UsQ0CC|H(8sUkrT@&0J=Zz)oB03eJtrJCk2x_C#;x5#y!UoP7* zT;k`GZ6Sh2cSYJ2bV)i&=`hd}kx5~Odgwk+d z&FN#oh!>aKF>(9wUJ1PRI=I<~O%2$qGygfRR`W)})Qc7yQ8YP3jxPJ{{5;!;7D@>M z3Acx+9dU}=L78NiSX*$oOJ@OyM374IhW2wd3Z78q9EaH(=|0@# kOs$@v{W#;|Z_rMf`DNY*EhL72K zTTM>@VhD*eFi+5Q1%h+{0y$8n5^F|ei-c6INq8b@Glaqhz$%*GXnU}wi)WDH;tMP^ zuJvjMQ)$WLh_0O0PXy|^@;xPt8KnNI{o=<#NUlj;ARJ;^0N&!%+mA(b5pWB|H6A`K zq`u3NBX~a?7DtMs#se6$1s;sOj&FrkppF<{sE5CU)cy|g<|d5`f&{kAh=73@XlK|H zP$ohXvgLUWBNJ1LlnpE_NIgGsmaJCHEOwqREpXre)fI7-3~A00QmNJ>Y@y_cnDe_M zdfa1dM3try^f*D#Hyr7|fN0AxUqm2KG$4a{IK!qS3yQu?Az1cnF@2 zQV}j^^T|+Z^3K_h{1C%{FQEi=Up|tmTBI;g-2(FUKeIrL5Wlhhkp&SSe9r8%%h}{w zK+}lw%hg~q!lLj6`1H{$nTF_<&BuGllNO=Z5c&Q;tdK4&&c%EDb4cPTmje(~F?uh)4wy zn2_^MFN_VNUZcd(P;&M9?w@CW!*SL%_dkrzQS@AEd4NZOelCR zu_~ko-KgcHcmG-(B7TX@+;O2FCx?J*4S09TM+-vc3@2?o;Dx~u@uTD>`6$AHYH~1A z?i?l_Ofp@9hA+2?uzRWC1#d!Z*llMI847;5bMc7pi*+5!>8i zJgAk+Qa|#0i70@J_%nEg1npybDj)>JV~-^GSL!GbQw{oP@Y0r)?0#!4u0(!K#$ByK zWB?Yrx`5#ObOTOz%I+@d?Q9`Jk0)fRV1x%p zR;gk9GcxSLcFk}w9fNLX{i1qzuygt-32A{ba~c%iUr`8>k>m#BGyGkU&c4Lx57<3N zKJH=QhRnR4RZe-omDy64%q>|@ICil>GeFxQ9z_o_*69O>Uzr8h`2dB+-WLHrsU!x? zhcw(#*cU<9YE3|3w@o8KpJy7WJP`+=_~2rk8RmysYT~M(hzo%L=;|s;ID&UPc}g`p zRy7WOLI;9nXM3fzA;DZL{a)L6MK#eDM|wHYe&Z;&E$B_y1VJC7EpPy^*sUDa`-u$} zHjS{$&lpqeUc#~KrVSWbO^;UPW@?qWXC6>JDP0e;N}w%Fp8pQatV#gr6E1GpWN!dv zR4X6nlTlMrHAp4L2a8&_yFv0mf;Ii)m#HZS@{7~{%CJD!NHC|UDGA!gGaQDFb*g-v z&P>2SDnx=DlM+YBTXGl&L385huo+OnLYv;FQCvx0Ka0*v$}-j&|$!OyE$atr#}L1Fn`e7wR*B2D&V?h zSg-@^Jg-;jiv6bcF~$wTueKDiriBUb1Hpv|SpBVE88FCKcAlMVhmDY_T_J)nsf~b% z4)4=v;2O`#LdOz;Zaw5BBxuZecEaPKC1*o7b2(htC-+z69|u#OZ79HqZR8B*kQBQ` z0Xh2&W-Dw=Qjl9RL%G+1DoD>~I19_{a0a0unu4OH34i4z%Yknps`v-_rPDhe2#wSA zlHTZ=g?Dh0lPU2J{djAe`fpkHBa}K}c?aLgs^{&{*WJ39w>%(516A-8OJq)8RM3Z6 z2Xni}DwHL^&fH?Yiq2PXkDBoTC-$(^-W~)|_7=F=taf{{zHS z#9}oid3HL=C!i%JgjoxHZ=T)ZO1wTd#@ZjcR1lQoHI7N+fz{%XIFW8_cice;!f6NX zT|b8LG(NmsjJw|V+4r>-%No{m6+ z!W<$8hoi}iMJ&IgY!K20jzr8NxdvrvPbE7DK=)k8*a^QZtFn3)#?_-7T6|F0_T41ECHV8YRnIo);w!3O7pF!OVLt>D@m?`%yOpN zThclsK1U7#Ti%*HOOE;}(ka&=ATACk66Mb~+8WBR2lrrQr}(bsh04*4C%5qZ_RLfI z;dQ$tdBbb?!|S$C^dy_w>7WlOY)YI%wV;!(_q-{>wdM8J3|kM-@u7Vdy}1|7G%Y)E0##}x~J28 zj%8}BEhL&R7buue$Dsa?F1(iYmk@e$s={&Nj+@z*EUPT)^2rv6j1soy zd<-$5sD?^I0+&Y-S%uh`1ZRKxgV?pjvwHwDAkc|dY~Z0dLjsOTRhzg3>hqe3DyK+@ z0{yVE0Gbf+*t6ARj+89V1ItI!0c>x6fwhbG}Z^*387 z3!*y9!4@W7K`}QZIb)695;y0iZ$PcF^l>34cWj;VixG$CztpJ& z#&-CVTvg2NSc+(j`|+nZY;=k(#&?2|ESw%y(b?DNVJfra#x84D!` zRB*ruI!l%LJlDS51ET-oF4@Ii`SDfiVD-aWk0Y-F}SsFFjMGfbx-jM;*iiGxW#jz$y0t2oyD8VKnEjjd)l zgdfql!3KB6%E19CRmEFUq(iAZ)^K@VAhkk97MF3*R9;dNE&xQlc)X^&nr5H#!io7#6Rq-s)+moR76<>N-OEVF7yi_z^*Xguh>ZvaXZ~kbUG?)toXqV1e>O>8VI; z@pZw4Ok?t!%Wg$t4BQ%3R=kTIf(Inv}z zSOLfSG}Z8y#pnCT4{wYW&8?=&gdj{!!%`4PvM&XT(b?Qc9vo+g^j&eMbs( z2Y+B`riWevlY(zZvBcJEAWi1UEAs{VRLFSXw=Q-R$@`7b7?zphpuMAmG$)qRIE1^9 z2~lUmAvaNXXJr}Q-_NFx&g%$gx*`I$9DU4Xh%16K)-Y_c(R>oeRu>!X>PkQL6^eql z9afGSh=x=g!xnbgo0GVWdE~PNh#C`mDK9RphKOcBX3fWkJ#;o#0mMEC4VI?2H&`*f z@nl8wKr;ntIkrU&NPvEgVYik{J!@%iMj+6Zat`>JbtnDd(r#Pd!}565nXo7GS^JFm z1#>Tng_k>fxP4k+o72{FvKkMwqbD*H%rD8W0BpojF(-<_f?7i?0jnGp9Zu0cpIV-xUF`&Y=(7 zH9k7Zp$j5#`#3|2X`<0%%sz?5n}l?v&tjg7?>DK7ux03ckE!O}JO&yr>pDYv;Uo|3 zmnIWN&%xCik?bU^d!vIq5}iKagB0@e%P%~@njZqhY%Lw?B+*l5}Dm%5@2 z{5-vX#DwlNL1*~1i}?y4ll@MlZn;`!*DL;&2z%~GXK)l|WpRgDB!a**+-^cDQ+s=R zsdp%)?7*947u?>p%D!p(MQRly9M;t8hcnhh)cF@}9U zzZx-Sb^^E_<51l$Cz3Y-HzCHu4jx_8?t?TsCUMFp9NfBGF!r)^BUHaOy)`D zHA54(o9<(m>`51>+UPGJ zDiIwL#smOaFaJ7*DNE1AJM$AQPX3c$SdVQ`vroj%*A;uS;hiA5qJi% zupJrZNxofcBiSi#ocpLl4XIN{1gP-IKHe5Sr2XUbMsVt6?Z`ieI0Pc%R;6tZ2gE19rjhll>fM06A(Ypt zovG}*SWvoGfh(ME_z<1nblUxF07;jRJW;dz~|4w{@lcr0NsT{7GjinQJ?rM&u zzN-@N;5ZDNB=8=5dwzutps%_naxfl>pxt5}T5N)#YUVxjqTMQu!(YVhVWF|8mmycy0~MLPzIpTlrO{_0?P zK~BY?tHuVn6W`B^&xy7mgOxI%V4oi*C=tXVE3#r4rr!*@^53_GFpD-evoK_)xCNm1R(Ac zXSEl;l}17nV{#G1h(y}m#$gT5s^6^yuvuX?VnLrB2O6KZ8A!R9(Eu>Ld z;vIEwy})$I7n_qM z7;P@jB@AqA1Jufhng{%9u%L!+L~cGxzm41=JhAZhghI30P1$gB#{V=%PzGuH%5iq} z&1hQqrNpZu?SN3KWF+{mdK*y%_c>=%#b>tPDfgqP#5LI5HuKGe?uNNeso15!ODx<| z`9EzaTd+jkY313v3T#8BqC!1WZ18Xz$b$pWZ-RqT0j+~nIF87q1T{)vJ450n)?9$C z^6-GYX%Ev8mVpBl;_<@nH|(@K^7kc&Y1_CHzDPV?z9I0cJ|EP6r4aX6p8YP1}6 z5Ye3JzQR--f8|LtbCcK<)6H+T(ZMSqc<7uk2aaYcWtWm0`$HIIZ;SYQv*|XX_DE+T%@Q0CEOd+h}Qt#s-op^^u#R4EO||Ka}h6;UFJ}0dgF|U zfGxM)L@9}gr*0Lg9@@d#$6z>EO*yum{d0GlR4hXpNpPC2)<8Wp8&?rGAY&b>NDvCS7}Cy*<&(kT29+#ra9*Bh?8tu*teJk`0+n8$5Dh0M>ZI|x z)gn3M0(&a%^X(7fkDYoCae#*?H@FCg#EI5eFd3`LaII1^MQVaJ8=IVd+ek5aC9nPt zHUJ%UJLU}~9H26gUYHd&5o{q?T(aiIyPb_~bj0CA*EHR{ZgHePV`>(Q6{IKA$8HUg zTd#-1+0v51TVe+pu?L1#J?4hMoS2T45CF&8yvDjH&TMyL-pp3I2f!WMDka5Y!X@83L3N7a&ulq_Gx-F9>Jylvlp6h8I{) z8&JJe`M+PVa}S6*T6!6O6Cle@>FiZMBf+wDqSl1$ifOO{yba`)QAQlqC#G!?R#&l& zbcaj*+amu5ENtx~Wa}Y`1(O_b+fcfP$$I@TXb!3sZ2PkymiZy6RhHZ# z25yT=9x0)>K7HeYWoR(oXoy~xH7y1+>T|^qzBD(Rg{&b?$tSjdN}!UhdCx#l%=D*s$*1Mnt-qQjlzeS@NVI!M|R%9h8o(yI)Z&7zl zS%m^)&~JWB^E#BVg`i1_*&JxV6jUOPATxu#jiydm&(@GA=w`4UkRoaa?ncW=epMV3 zhRpVcnHKUD)PvylvQa>FEIvYfD~k-to3LJjJF0MPQa7-+=7nh>0hJAZyZQ~jXdkx= zZkwi=vI$a-npA#Dhx1CxJ(W`y?hwS{2Q^bgV~!qFmk#bx^HhqKH1vcx#i_&kMBd8+ z#Vf|rGM>v8|0ME`A`|)>Kw}FPbS;!m^mRBlX9*)mfhDv5MmoEMaVURRj)Yn&+RlK1 znUj8jrRF2KiL*n^JFt*_7uxR-%wt(}wePC(L0+bPP&i5KUu?<{Oj5}lOdW!x^o0%s zdASlh$rs2r)c4CT1eoi*%l_ggvTJTeFzZZ&yr?H0^x!#KP1GH0q7G0Cj~iH)#3=%g zk=RlNhGv_SE~1;T9~Afot1GX%z9W&Ba<8dk+WWCm)kw0oHstd8k=<>jd zus9lnvpL2-ljpVIP!zk5XOMl!_q7S_P!?v``18}X%&~=cbvZCcc(0cB`#(%&aNtP( zDQ=}lH-Pf5cwb9UA~}Jg5*1G%vuDhYJCaf5Z|w+V?>#PPO17^J%>8R<`4PFs{U;re1LY1avg^1&0I?y27*j^3U` zY*K<$-E&MJU@V-TC7!J!?a>Gf#*sIjuug>&C^U+({=~j1wg^vqziUYv!LkZjry;yx zQX(391_)RlUJZF>HPXw%2+S6u*B*~JecX6U;897~$Za{CuciRzR^&uSNG0z=l`NT@ zMgzm%3)Uafja<6gke7YSEBNN?JEcvu-bU&07I3h zsX17A2tlz}+A`|qQ;+0+B?P-XeA)DRG>*UtI#Ri|f?{al0B+&#x z#4{(qU?0_YO4S>0%U#JZWuG37F_`o|#oWi=Amw@@qlMh$c5<2x zW|g%)j=*chNBG|u!`#|*coa?m#mO~NxzU7xw2xa zfoP0rEP+o4(uqK;N__Y5dkmDuMPzkUtR+^|n(BK}l8f#~68~`S!crpM{Y3V_SjnwJ zu*ta!eSI0aGyrfzj!jP#nPj+}XfTyoW`G6Lf$L!JMhA5s31JkGn8IY~XcpeVdd_Bn zM@Fj9trsfCfEre%qNGikk;M+?S9`*?!|+_&X69LXUQeZ4Iq(9O2s+WpWSj-=NuyFgr_gh2cJ6THY;66^cwuH<%#B)u)WDahn&un6K0L&6mZhRKM|)zLSS%KrWNGp6}BpYZ9e!TeZMdxn)^4l1(a68$_>OTW3%BHv$yXj^C(jT+_WY0l0M$wo zPZZvqS%q@@oEjpE(2djr3jwj`R9G+!3*!P^%5i#aM4U5@kYnG)G`or^pHz1fJjke! zhj#2Io=RN`-CVL*5=mjr@72MBpQ$oTKz?MgQ}50ai5(}77w5u56{uA**FurnAu&<& zvrb;(%?*-PfjR(nHHx8>QFIboVrgLQC2T5Ohtf!h zWzmg*lE>2CFfIXq#6;4G=&5z9eP}{m0i603(G|k}#m=v{p)ary3)f=3qE~wL9>tHM z({vFVYaLM`x2*LS$`Pv;1=YoPb{ru_O9V)FV!HW{b{|300ECd3?&whO#e<4_gAk-A zwYbFnC9pehAGj%!iOT|qYRb}ksR&pT!j;q*feIcrzGyR)m)I3DuN@ASk|Uer5Q&SX zGp1dKuY;uDcG}Hf2oAi(}|3ze2&CTr1>D^7ay6IGk3T>SxG579DVINQljgIT+*@$)yXd z?KyU%fQb8X;JFGTMut*Lt0MI5ynS?DKcS2jrU-;%yL(m-r=3^Z$r_ws!kC$nZF|9% z9bjibcZu%2BgU`WHP`j@b0fPidjU2G+=6dGZ+;qP8Na5-Mw%K9aKP zl+T(p2{ME|!tE~F?7#M*L@AvD+ah3QUu$cGiQ-I5{!`{^I8ZBbMZMPkRZ=!C8BrNu z=U)k9_BUoDdVw5>09hmo#$538c(X|rcTfWKL18Miwlu|R^pe}}x~?oK<6+b)#eMNF zAUB|V8{5`(|MKfInbiS1sRRuhZk8u5IMMAKx!8IgDpP^0p%xnQUVAFw^$UR$ew)p+s|+`eq&uEa zu%!WzP=(4Xc|sq~C#LC%-GdG7NY&itrW2qS4LTf1u?nn^UTAy09QHXrwo)*|x5c^x zHAAdsGl2gjBS}prs}+SP?8pJc*7o+|W)1q@et|Jb5Dxrv`=u|p zL~!#)egJRsW)40`7n$X+MPKok!S*rUfq;mkVB4OOP>7Vr@|qcX`NTwmBqw!^LXydx zwQ>@~A;4yL#lm8|0$N~15;dD;mJCgW4I(_ef;BJnt+6ubOV5$&+z0$r|01@jCEHeX z?l>nQ8Eg1$%l!k15L636)so+}y;9nA#;ztQ71vu^Lgj^Te21)f;~V^mHYi@g(tJ$dj% z1@bv`WfSsy1KBm-lNE@V4R)}YtuUo=+tef~IsziQITMggb(W19x` z*uEmChz64Pm{JSL+qM*qqsc!L-(@an$TrC5IRxE|6ZS|YA2ciU*Ta4YW@6b_k3qS^3Jn%1D+_;~}MLg2tyL08w0wymVJ^-q?YxI@n9=diCb`>HNH`V6M zcd1MFBg*6>-ldBqMYeacwMCRtn z&fyD!GN32-SCsg17E@DU4@ON)w;9w?2vAm0h`T&gpFkCjG_enH9@@%GCBdGN&T$cS zZ{$8`vN&f@H@tgc0wC9hsM%2A&&40!VY-sbtPFhlc*M3wbF3I0OQO*PrYxqnupAmp z#o^Cms}-@)Smn{xRvz zxUEHq4qQA>Ob<_lnm?<2p*Kmf55=9}aA=O9WD>6mDYsvI;JiPB;a+wA`)F+ zN$~3G`M(^g(;k;|u=r1ds?rLmZ+hDCJNQWLM=9#$t%!`ALbGI30d~vABA^7-s}&8U zGTb(NJiMd{aK?ZNIYyoe@1=D@%%n-XYlK0;$mSljuOfJuxQPUG3*pPaLzJP5G}4^& z5$88zNb2x`^)Xt0&9UpCpm%bJ-5NwJEnmp)^Rz>M6JG!!>1R?l7tFJ^5uM}gzmc|) zy#e(GEP;{)65Z&0S`C1bp7rV=L1FMR>gKO~%B#73PFslU@@=Ix^*vfM8` z047EN88|oMQ`s`iE*O3thsHSGYe#PCl=KN^+dpUfltf`%Ws-vMO2-y!tg4tmH4aL1 zg)R=yD^3-84rrsztl#@mw~7gj0^Ni?9uQ5!I}~58mQ?McJe%kM;_%@Pxa620O~vVg zJ}3}@*nxnvlo;|b=h`1HwKfz2WPlU( zASiye@8N*fjWOUkG*f}ap4fsnl;IraJ_TLMOLtSkB}Kr-z`i@ygk zce$z5xX&$N_ca@p^{|JFCjX>g`D`v&NpL3N0qqUzD4zi4uR2=b3qsWn>Kbf(xlDwdU#=^*k%NM{cDbC;D(dHJ^b3~2DSK2Dbe7AZA5mSeavrirAJXFe54~0U*`>4U*A!N^#q~V+uL_-p~ zavqZn2Xth!3pJNcPWtNu%tPotvRdB@dDrzhw1FG!z?bc@&MM;2c3{mreePK#DE?p9a2s!?8p_)|oi>^Y;V9K4W^672P zp(-RoqQv2dP%NVcXQx@1(Stzll>8?|4$Z46$-!z?xR1KgFmJ`XOrrWybzyU}%(85j zuJ(7Bf9{FE*pz_#Qit_elD!VkuC7VC5OdjkMVIOg@T&&yHTpC}x}4}i4|4_NA35BV zII)F%CVfE6jHk5@bY|v%v^dK296{C7h^n*#@}=&?N!>^=7nMp6H>@_uEj&H z)9^y-gNzc!W}!Ey@cS)`zadX?9)P|Q3!YyJtwR9{6*5pLJ*QrMq)>ZyPL{oO4P8tG#&hTL?oW-6C1V(g?NgBSpT4uR{6IkN$lm5 z6~uZp3OFXYPk_0snT5s zC-6y%YTiq4S}xe22{NGj8}0tl`&R!D&cA3_a}y#2W2kttvpJ=^D0&9#rK4Xha+MI( zOuq}jzl0F%v0r<#+wmQQEUnon7303S;R zk)6A4V`*o;R|Zl2TfPKZa7IjOg9Tjz+4U~2AN?hY6A+}zpP1gStmnG765dIDE#=#% zu6<$WzkErsvV16F{8Sq9^58VMVNKR$4MyZaT2&;8KV>y~rOBlXj-m&!yTY;G+EaN?V58x=Z z(BeW?*3X3dGQ}g_>r8#xwG&i(#p^V%9#n0F$1Z~eb_DW;tX(Spp(@u19gQ*qPiiMK z0V==CDt9C)Q~gn}MeBAdihCmxCaOpVDPu;6Mb^JV9M&D_Bo2MxLBl%5>tQ^Yi4$y8 zE;e4Vw#o-B6FIU;X{0oQqA2YMx^p(ES>~7YFay~N+lkc#tHHrG%R)0QC)o_U z$$ab!y9TRyo7|yKB@2d=Cxo&9HY^v1niCujLO~LA&Qj;y*&m+-Ef^5_MvI_eV=~n^ zMq}l*L(?6ExiiI!by8MFz9Jc{`=2;`Gjd=hI1&Ch+8DJsY|VUfi+`^_J5)d$sT5c~Q#jY-gX_)CQD=`+6wI%_dtEgPrsWkUJdh zXvjGeqVVUTg+R&O0>Qy_Ucdo<{YXFtd1Z$N1>ih3=hl@P%`rO6)T%gcBl?Odlxmei z6~(~Z9-6Sj>BX#`+F1&Fhf#q~>RwIwTm-W?a5um#&IOC77d>h7jkp;XYa2B#gCjKD z347MOP=oJW$+tOS2; zH^o6hCk?io(`p)CR(p5|!-4$0kHB4v9}uLamTg|ns6$8+I9H*tyLsU^q;6MmAt8Ov!T7+91bUPOI3SQwDwobzSwew(g)NjImgazifOi` zC{=hx${Ju2qP)`i+&&l)4`W;~`ZVLWQY;=;r$7p1UY}s<3%KxO2U;M0+V6Z~fr~16 zo=Lj7qA#SY;o4zF5`+iaDOm;K#BwGP^FEo91ZnEW$(B1}xxr2a6>*>t6EDGUc0U?Ypm|@P4aKhgd5xuy733qmge^hQ6$vNJ0yGC%Ej@-rMe6`14kb)XV7@Yom%tIR zC&s2#hdl{p(A7FXP(uVmwv1RP9ud225@Qb2#JG3j8&@YEmp-N}>SjC2`e55l4rd`?CvZl;^NG01WU*t zhvQ3aT(MLMTZXJeVun<@ibgpd9Uu+>8heBJD242B13DwR+dW}KIr;$z2LW2+X6Fp` zuQiNTq+$=J^opgjlJZ=i5tMXj(4JPVldl5|ECz9C7AV9#;Z~4>;F`jfwoqTV zC13|zj_2Lo!R5n{I3i#19_weaqd&+5?I@w&Zviqgi@8>B7)~);R8B-(0r=e54kA9E zLtoMntTGuvEmn?B7#p2y7ch9))Q00>I!CooX)oGTSMefN>#kcsLxWY`8(&|GLk3x*Rq--G-AOpGl0PB|=`M+MCrsBw zbX3_Yw&JXYz+sP}!Yz25jQuy#n3cXYyIFC;oyZ;Ix72(1)_AxdWM61{CAh+6!aRyLd`AVER`Y$*{UFG4Dmh4(S!crI2P5Q&K@5o^d| z(zoC;3o4l>az!-V5URlOk|rM*7gWpuP4BGh=@GAbw{PRMgUiEMw^zO(ds|VE7eCmc ztvSIaeNldVG14xu8_xs=BMlD+S)MbQ699uvrC-7WBU8`{zsNlRhL#YJwP8t-LGUW$ z;e2HvScb^b5qnklWu)Q|E!xf|xa)#YAHB6);xu?bj6h1aICG=74 z7#+G1WFJD0E3il46KX+_>#iih+C#!^{=rEQhZaUWn0bp0i4|nL+1^}(o#CBOaMG4V zJK(gFQ;N{R8Ve!uQz`Z16-UPmC{8-`ef|arP&P4+(I=u9!4GjJPb8?0BvOE2dRTsU z%UPsZ6RP+|+EpxarrEsI)5exrv4g}UlO4jw1qK6LAwO}z=fg+GDh~Go=!nh_1&X(1 zTi+Fii`cAOW^NR7c3@*-H+Sdv#F5J1w?_VTkpX9_xVMf35V&BM5tMFK>JsZ{#VrZpqZ+W;K%rz5qv%vgyrl)g2v9L7(iI+&7MV&kcohV6Ze2nyx)R$ z5;;fH0JRp9l(G=iZGE%1S=(%Fwl_&ZDa)P!G99$H;eo@OKD zwoe`vXETJIYag@VNi`4T;kFW$dnI5Eb1T$`t`P^!)s#!SKXR3r2fvI*tkEqkzE~%i z#@Tk~qsezYcJ)BfwlQKrNC^q;WP$g^Pl^`?7b5cuR+t;neuuY;5;kr~h3l%WV3!BC0eoL2T_X;;dtFLNj_@}5%v))Ls?_ku(3N@2ALsng1(|loup#kg! zU$T1mP2Yj*Yn*HEPr57Hw~I${YbJ8E29d$W z4a5{ewWWpPE-;O&mGZ?T$5}!Eh?N8}kQ+t$!^8M%v6uvli98>Z6&07AkEl6IKic0z z)`^_<0lrBPHTBKZ@&v8 zpa_iR>z^M_(G)fXDwSUU1mJf48riy zzqkG6I{&GF+pGfhTJ$TD-yfR(d0A$f6yL&D4lQv zHZPi_@Cet0BT?!)3^tjt*Kv&g>p$BgB@7imQ>Lt2EsnHEE#yGq&l}h1MzrBV{pkTa z0~)hL@!&->5abWj+os7nHb~?=O(ibE1%sDO1M{l*aU>J{U7-kOG>|ir0^PlR(2MaA z0c@#yBt4?SdR{K1VzG}Wxt39 z0ud>7LSzA%NlEQ;v~kMrQ6Sp13hmx`mC>;F-R)3`)D*Ign~*useU#bwR+v=k)_EBq zHx+!&JDmXDNoE~AGV%G90)xq0Zk7aU`n2tZTat zuSaaH4eW2?Bi4O7zDU<^O9T<+Bg~$GXP80idU%FiJ-bOeIOq#D;JAk{Ak4$`CL@ij z0tFZ1q`e@dc&HlgifvHZIdI%xMwm5GSndeI2NpO0S|y3>3dv zty_=>jtO6?TF5{!{_FffdjQN`C}~1Q^VRB(n3khBBBZKXF5QQ+i1K}u(<8B9&NR~5uL6#nkzWEO z<7Cw73r8X(EVyi-K+WZ6K6oEo$!;%Q*})w2=mhZ`%w2{k_BT699GUzZ3(>w>a3@6e zT;~GDF81SDo4CiBfz<8uGt;@G4hr3{@SaXU34>(siM0yga|~0o6Me;G@2f|gnOQ8H zdpG`Kd%^7f8enM!{h~C}azl{Hd}9NbNz0e_7ox4Ucrf z*pxm^D2O6<>z_ch5pj`h%vm4@@0d<~>3$J*hA&4UNdV|$HOwJd!@@>QLQKyVsol`; zbYy-5Ih2HnCu8<;@rD#*U@fTFfbt9q6%I*`JGW`Woi}?lX7=u0<7kqgyAbZLC#H&<)thc-v6PW~@$Bd)xi89q};TJY{NJP-} zZ=Awg^gTwXe?|Oz8Qf!(u}ljxmXNIG?}T~vswPugU}M@8ONfVp!OfJHuCpaNNzEXV zX71v5*rgnalQC3#i2LwB3kvd9t7n#KG5f}O2YrE?$h~}gE5autc_dH(oJH>;H%GfSIyhUQ#oUa2hCeP&7?3H+ z+*CtYjLlArT$0oAy%!JR4R)vkJD_#T{p5*zLqIpX5pi#uM6~cEB}JkyaWU`+oQ(13 zGTsD3$9i5sEcvuKU&YUH%<<+#M0~$Kb>hL57LXhaw`&8cXzun&u*+I!XW>5ZS135p zZEg4np(g;{L4zq6#y!j%Cbt1in?w3{^=%4w*@4^ zqmBcLFbAXhAo>TveHMWc7YxhlPlmM#h@|4xJhT)9oa9Z`zu;kJPFkYmnLJG&Zh(h| z2ayc3W8pwNOX7De44>}igH?t=#-&Q5CVjOjRdv;)jhZiFuyDPDy$Bs`W4F^f6fwyH z5U?%GB^+Y{Tb|kB?*xv}nqIa0?SkDx3NDr(llV6^3u08{U894r0#~4L*Yr~=^|*Up z%?bU1MA6ob_u)U7NH^ll9m*+JRM5KlWg`c2smg+2AvPs`_*5<{BpB7c-d;Q}B)|6{ z#p>{C?FRXi`W%IUct?UN@P)Sw)94!wXkVRmS#hvOi}Wy8dS-!!n80~WCk$NshPU9P%78{IXQn2&-?PF=*ZL*r*@xDsL?UU-~x01-*c{G)U zc+waH6)pu6lCP-Kp^g1N{rfYKdx$2c?=GKkrV|-C7T=WLL7)-2utf#6tkI~5F2kIg zMPscI0_0;1Z8eshR4{al7Q!c7yCR7sf2vdM%PD~~o*-}FRdV6-;KV!s39LmcNJr`k zuOUh5Y~?7_1>S3j_A$nW?+dkysl`@NyN=Ni)o&?kLz%U^JK}|D(E&1^emWf^8cH7t zGE>}3Y|dTq6V!_{$g%az)^`DK@Oxh13^0UYyy(ILIIZ9mJriLWwv}gAOaA&MPoX;P=w-4rCg-G+wO*o@=k z0!V|m6<;t>Ax#IlSbQFTKq(0O_?0h+G9rG8{ioQf>~5DW;aS}61-_q)6f#mZ-vKpZdjs)tl6Ey^= z768PUGyrE{lrbtLPlHs;izXT(R5k<&13~@$0VY*gS zO^7E?a@c*=(geb!tD*$${V?Y#HVi`z=DaJA|BC*|Nj96RE7%d~A+v|CCS_>?K)1ow z^^&yUMO->YdrdHxrn#;qlD9-%)Kr6{)`XFV&dM`LtiCDc_71;#WiN5pQO zHLCEC6Ijk7gR9D3#5}UYIfiXkgU|ZGz#f8$N!uY=+1S5owzL`$zCT9PhBUM0YPmvk zqTw9>0QbcFBFh)QXUXi8w=$R|HrMIwninjL6H}CE6P=`#WJyvfic<}iLyd(S(i#gn z$9E)!v3Qq+9I|r}W`$*mVuOS=yc309Wu@Qi6o*iWECB0|*t;kqk(wP6A(6mGsfP+E$kS20hNa<;nzy^$jpa~ zz+b#pEBE%rTgs#PVW6C={y;b#_+179?vD-{jdudj9^WXKPdYYi#9b3>$LBRc(QbG1 zg*HBhEC<4iGY}0Z@3?@%3(TNPawiSxBiCry*jO*%A%Mhkf)*aer;quxQ|+ zZz9^*?ZB`tYQEY3Ws&Pb%vd(0U!+NjcqW`~cr z5(X>OfZhb%iVHWUGC(trW9r(9TI5!`TQu(u{zsCMXGAZ@G3U};tB`ty>kghbyH@N@ zufg4D8Eg3Z!wBbQLgHkSO#;HIR*{w-qt5fB+PTtAF}pcD%&C4%AI!>lW9)HERje0W zlys+&Pln%&$duKn#WJIeq6EO9_B5v{kL%?W{1N(Gy$3n17PFZZI4s$}#Llxz%1w<% z)n<__Csi3RLuAIHTRZSQn8y_C(e)S5l@PrVhBkDG2&kHLO2j&Q`P~NtPghfd3PZ+W zDOKiXkeTKi(`rYMi)A1)fD$^own>#oOaKT9C&ZyX&_z)*c}E7HwJIKf)L-Z7vc>6h zC*T=$8S7(()Sm%Z4_6G-x-ZpdL|3)m3~69{B?fG`WPcCzH2NvB+lx)@bc)LoOAnW5 z{n5xFoqS!&a@Y5Q_|MrX*facd8zZBT2=+94Qu*vwFq2&mOM(FwF_Uf7$X7HPz%o{1 z^#FIs+m5ts!95t6mP~{IPlGswkk29MK69*S&Z!{^X>z@;$f&fFA#4nVbN~X+&kfk)-NYu>1vu}8^yJ2;}XXFyO%(ks36DURzHh6k?17; z0)!Hb97t~m=N;?6`yj_yTaq`w()mu(AthzYax0!0hyJQNszMDO=&KO>d4i3CJJKhN z9tSUyQh_1{`HkcRc7~`5>sUkxtKy-e`;@CWAKgMa>g8dve)=V8aBO{bpuT-JRuMUCQx<2lvXt= z4@&kkSC*|GfG#DH=fi)p3ivs~E9w)%;LMH#Ts))ztvg+{@=^x7jRWcRWjJ5KP6IIU zKnH{|VVn`^WSPq;!y^Bh<#$L^w5k3cf}4Efzci3Bvx34|4$%=N8u(So*RYVpqF zvNygb(~F$-7v?EyR0uXksJlkb@Zcq7LqrRRF)Z$%s4L)Pql|b9ftvVIfJ~+h6dns4 zM{!8>SI5NZX@UxA=i9q-3jrxakWn-igi%*!15glw-9pjnLTZ0#WjGzR)Fnn7RNi&w zJK;>!TdIA#9XT|31T%@Mph??mT8~(wnIgg%v=J^46Un;sp4ccsQK7K=fy*WL)b^No#8{0O{?AkTA7`D=03^fPb}EXG4Bppq{n z{o}MLNC-AZFz$z!K`(@lS0jNrAm9>?>fBHjvJ_sQh(6Z+;^f= zK~8IpuU(D!nD zqZ4&Jeg-BU6KBFwr)lsrS?RLsaK;rV166#?S9c=}Z#g-I36f|yHa_wg2sg;uvRGD& zK8{;xH@)^ERP}=pg)fgr*O)Rc!^?p?5+rUGgro&y5r-Iib+kN&EhShs^mFHIbdmqb z^K}6I6YZs7uE5op4}NCipS~BUf%}rWlB}-ue2GE_J&+wJJcb=*=q-3BiQg6ARd0`z zz=DldV{aMuCo=$JMO*n)1Ca=3$3=0<_iFW`9-TMBSoBgxi@>FYW1)H-EM>MjrX4oJ z_>I0oYw@bywV*yh67fP|lHLbMHJG@os(HfRVZ*B}Vspd1GAIF4vMNZdx@=GOt1HL_08Cubk_}r)AED6g96MFuZmv|0p*BNv{J2sctIF$i zVCeuMaRNPvE2Kfh?NM zyI>Jx8W|va_N3#XNVZ;*=77o|DLqZ=0TSO>eaA~RBf#w(-dyP>;`bPaevA>Q(5m1L zAN^bzqVWkVD!aw`r^&d$+i29qsyU_-n`PFX4!0;LoNqDLqj~%<$jLz0U5rSM;v=Dl zaxkL-fFKglN^efTI^a8BzT>kz5pCv)lc~rx9fXi6tF^Rt^=$$kYfLc27fyXHS3Mi3N_Q~z?`OBm!^ zr-}W8peU~y+~COMDzB-XSD%tA;2hI9416UZ8YH%y*E-dY-jD{P9YYfju4{Ej_APV$ zL?IJLW0*e5S^#OL@?GJecHIi#|6msX|-aD7Qq z;r3c?bg=Vf@)X+!A&wg52!K_ks*rdg`5y4kniwD!$JVYipd*A+xvf4;^!BO*z?*ot z7^)$SZ{Fuld9!Qq0pTXq7r%&k1kQc>oPa| zR2`8RL5>Dmbg^^+YvzQI4A4fGqF4^N{O9s z)3;Ai-5&WT9z0kZB&m$qpC1(~D}OPDU9CrJx*NZeJ z?1RI5mOqdb6X8jYpG(=KG?>h>Uai~ymCklm%{z$(1?_}S)rHLx{5JoZ&-I{fQr=Q- za%Y~h2=VX*eM$o1d*wzdPW7vf1+b~YgqAzwvU51ZJ5dl*Y47AEf_27wyHp_!iiwc& z!!<@v%w+w;?;+lgSpaA)E5tQP_yrQlrn2kV>I7pvg+>X?B^fl9QrqNh@5O>4i z<`~)yo#zUBj)r0kP||enAJbwO?0jAgmG1!`yFlW>LAIhi)LVd?$lq#(R*W6G*mdhI zW8JQ|F6dYREf75YEs~O8!m1yup}}W}ZJ_&Zv`_S}uu5o`q9nn;+TW>^G@Sag8sh%d z9=T8XNY<@E5Z|MMlMLHh#tuxmnYcd`IbG{c+T}}HXAsk}QD}#vBif9HxR-v*KRq9e zUGO=p>AlDc0hwv5*DIvq8nBU~rB4Cc(W4dirNISa^0ietV&jg&=JSynh_Ue4 zQ|Z-AGzNw%1kH#M750?OlI7o7^Hqsj?KaJdkQeBJmPd5t<{KFO=IMY+4t8-!dbLU*dq~!M&b+|XukY-=1G31sN&5Qh3>g5bJ8a#!Y2;(Jp;fp7@-_k3oI$_ zXo~6CP9nN#c13L|2-pyKvRLJh3U}F0Rc@O*^>pN>eB$OA0X8tDr3(FJLPn^hvKn&CUWWIWs z1#LW{umQhvAO~4{cwfO&Ck$~khI-!1fxPv;{8;dv+Rgk!KgJyWhkuMA@elqOwt3Q{ z@zJ`=6PYwE`BoAnz`^0g*@0* z(zS!xJbF2#^WYnu=T9ie6z9Yqz}ms45!-;XcAeKnofC;CtDJ&qsgGNy#@H3VV5npE zDYCTqQ%EoTpaLh(igs}se}y~&5dMGXvxHhI}xg<<^ zD_BzvWw7Ri$%~N*uA2Vd|Ks z@%{naDu#^_wuc3Bx+0J!TPfkkl9sUbjFx6jhTDMmQHN4<`tV9X*}xQ6-;r6$RCK=!fQaS& zf@a|KJSB_(I)n5p1+hKh+U83M93$2VdEJgKFijq>MeG7pI@_l(+H~ck{Hf_;bcnzZG;TYn2SgMK<FYC=IilU;+<#m2&}-^Z@wAjtOzWJlKW{bxd>BPy8q zGcv8w*Mc{hsCIylUkagO1<<=}Xi5sNMr>GDY)#qhI=G#4X~?bHs4}>g?xY)ACz7 zngVlu5g$i!FgQ%QEqjQgHi18o5d}fwoLj~4+03tg2j4LM$s1onc?D$f`VU1EjNS6a zm!fm1I1ih_aP(20%82t!FPf}9<&VhWmy7Chne{Qny}SrjH_OrFSK9{HOu4oU!Z9jG zX(Ycuq`1)=Ud2WO0)9A)e)o@vXF)51G10f;WZGgb>f~t{|WLZTC4t!0N*@IawMu?H; z6{M&Y9q`1UL7BVM+!EpTTw`O^HhW9#;g;<`QnxC0ZIRc*0-A7FQZKWK8A2)vty%qU zmYTwwKZM2`L`Bg)K>#ES$G}w7X8ldXMV$}!oJ1WEE+2bDOtK6_IXuW-OfXRd9 z=o)*%N3w!yBWWYnNX`J&g5J@o;rAfl>KaL9#AR4BIQwj=iGyqor27KkKtcw^BqZRX zbmOP*DU2d4zxJt;qF;VWI)w!8+O>4tR$zbaQ%-^+TWg=R~ec^I+rLM3xv5^N>>QYAN`4^Wf@AY%{C8ze#$ov*0r>}#E&!iSs5z(@ zFU2#_%i=l0h@H$_1~z`Ah1z9%GgDXtjNM?ikRG|GT9oe7boQ`7e)>g#zYzcS#iw|J zN`iwYD7R>@zZyduQQrlTxE|4jhlGaF?X^AdgUY{kyoDtIl2| z4$DWm+!ExLLQwvCEn5jMP$WG0gc-$pi~I!$yK=kb_dD29&HklKF#jL#zl(>?t*@rz z9U-jjvfiMhL=#SPUPJ(CNUZKj5yRcfYj!nbOb>zlk{nkleO!r%p(uMfZ* zEP#ux=<@q;9kC=-AX2B^+}ugF@jeiHQDRQYKY=Gw8#vO8Oif8XWcNr=vHfI-;AdhC zlz$YDM+6-yJf$&OSdFt&eaoy6$ayW4tx^QZMRs^JlN8vJ;lT?P;OU* zz#>Ry%U?7L3qXaC#hjy?u5ps;u zis(;1b(y5{R4Om4cI%~crGHX39* zI|B!uZyZwPM;49!PQ+mZ>_n8-g)J0I%iBsM1)?ZqQ#zh=D+u)d@jl*ac6`*}m~2+R z{94opK{jEg(DSR{2e~kq=sg%HVemNvDuaA(j<8j%_?0drcuP3kaeIeAgKb*RM_i(s z2oX@}o3bBBs2n~a%g4glR!}4c7s(F-k&wi9#JA46)?SSI3tb_N%hK(UwvqLqfVf-P z>JbRU&sGYJ_0lNL4NG2B^`YTdnK4oCTM-_2Z&#q(B^kO)54ar+Q)1Ai&x!E~n`zNg zBH2S`2=hu5R^EYeam(UIdO1H2IuKADY-hxj5$Rq%!C6bf@yDFRBU#;e)U14IYTus5 zJxlolD(cs>vsU}EQ9Gg&DDg9zvz_BKws~hV32l5ItX2yW{G-fTkn8#FbK)7Om?MTJ z$AEy@NwdB2MH!3I$Ye*5brvj9sY2b*gJEQ}@xpJMsV&@fa)adJ9+AL-%E8FyDe4`{ ziiyQ!&A^MgCZ1lWkw}r3r5M->qV*y1Mr0HuNqWoXyWd#LpX`(Etxd}E>=TcA^`OOXl%qA->ZgC^ zS|!Sn^)okPI2Q3_o!;l*gX@M+5{SZQ3N2$;VC;=TDG@h<2P!TXK`cTNK1YZ@Q4I*6 zD)2EW+?pWLE0JFvW{Uu_nY#rT99yLthB;&{K}OrQ_ZXk z_QbOshUG4pKraL;!?y&1Nd+o@%S_C3h$RhRj1T;&j+e}^`JkWwUh ziw2bMui^!G3rFKrSZ)cn7<-idTU6-+TgL(<9!1q0g`KYW4!p-v zGDM*sMIKiYmmw+B(ctTZE3-lQ_0eu+SEwuo$}+YK^H7n!D)dhii3N=*lPh(D2qflD zDv!C~gOYq8vkM!PC@`yBSXORdWy9aDexsJz@AzO`=mCx{PcMn>y(Y#STmtT9<&dSm z6sN0+z&5}`CBTy)caO+_Wv`MfNlFEzFZl$&UB6&9=$J+h*IMeZNK`q*zkF(^3Aw1eJW83TU3oYVnN$>g-tbM09}3hrBf}V|{aQvSJ=j zI!BRt>7%o*p<>}qK0BKnqi;dvgTG+s%%uv^{xxT zReNz#(YZJ;TD67JFX<|&YeRty@gZbo$Z9&JEWx5qio!Y7rT0}D2?}Ly2H{T`iHbwv zx~>3I@|e3|HCq`JM#`NUBs(ZxHXEnI2kMHq<~O9{Bg9I-Ih-lgke`q)fSff+PuU3$ zdalDEl$G%L4b;x8b5YJEP8%)IVo3p?MgvzQr5=PS*+J0Z3KS$c!s0?txW?2oK;?xr zi|}|dA>`$#P=9!XmNddN?=`TA1q{cTS`E42*Q|XzHrY=?F-Xezdc^LPhBJqUSz+oc zhlp_!lF+>}v}GMaD3wnr#veg`5y09(S+Yo7bF2Y=uJiAVPw7=51mNaY(}N9waZRo% z-hAV*5gtscEuK%eLMLz9Z@c0|Y*=TbI`mp-8NS%hu+PG0{=}we;`u4rUx|#{P-pF0 zo(3iedPX-cdA+iv*z5@`*U6P8Z!${oG|33~(2?hv%raDo&ziG|;+DQ_CT>;cSY03$ zJL7CKKOjFtCm!^!w9Mfno++Ffap=uajg7B`{;>yd=|TNmo=Wl~^lV=&>}_Fk-|@t& z)yoiz1QZ5ctxN?_s$Nm|HNo@j08c#0~=SO3mi zC>ZI@eZXblWg<*MWBg}ggU1HHtZy_cp9BzuFSrGMWrONNhSWjP*26cXU1Fwi8$4AT zEM~O6XL^BwSwBs9$JdXJ8NnX()Rs4WZj0l zF)E)3=RGJtxWmG;qB2OLrZdis4@=R0L3ww!EQlnFR6BwWBjNxQ5+_9Mp6UaT<%iAe zIq>3>WQkQP5_+cEDk&(Zl5i<*D8!{ng&Wg?lef$+iQ&l{02jsd9GzC0OiALo!x)Gh zK0-nuh;C_lW#osW??z30YG2D0hk9LRF&tA5K#!R>z@6l$l7G+i(WJPnT>-CQ@C?BJ+5R{<(I-|MtJE9HIT0>N^js4<7ri4^Co3F65UePD?|H9fS zRE#9$+OLp=0z^rEbgVQdC=PqXSm?IZ(6-KP4z)>mc}U_pl*Ct8$rCjJa)WSLEOS21BBwr^19URUzt0SlI+GgW2e{yrSHAd| z;1C&qAcZ5Beag7HD^XM`z@Q!;L=y8c@22o62z#=Kv@&)8rY68$r1U>}hnWqdQ+e2| z>CuR0lm*$iA*mQ;Ko~NLWeD6=T7h$x1@0BhUcDs~#>pCm!jSGIACmt_W0BdBP!C~C zY_-C$jW&g7+KMVw00Sj-Mq`RFw&DwEGzH-F#j+x(odKc8iZ~x?y?WJ4ER{8u zP26iq&;P>Z@ah3J{o%WV{FAI*&X~?B9nzvd@m{CH284xm{PV>5r#SuHY>O1<`!%t6XIo;R$5SZz!f3N_gy+*U0! zl25c(A_k+U${KPN24&#mWl)AAzaFWp&g43hPdS%XB7+i=MUPNa$OAAEk_wjIz;?3& z8!x{uQI>EQ_<0FblNE~y6$}Q40Cr4evq=pEpRwtKX{$;(#D3Q{Io1?qoo35Bk?GoT z2?rs>!r68lzRxx&Jq8|UYEaMv${PWlXhIn(#x!Nd_2&e{gP%wggS-&CDar*?$y>fu z@+hLM!$v&W(NUYZWEZ{6SpyEV^2Ya+$6<%ORXIb~PzqegcRv1CmDG@>P$xsdYaxR0 zSZx9N^aoH8jR4TFxXv<_weg28q%|T%oBs_L9|9k8EdLuf*w*3r1Mfrv15kL4a+(pu zTtFFKS+BHyKCsQF)zy{N1~~tlX4Qy%lHHq!B&)xcM=s9PTGxzXWcqfHDk{yya3;gT z&n@fB5!Id{4VQ)?R2DoftrCj_zvQqR?fMVp<9qsGvR(cDLraknNK{I%)#7#LIU5iI z-z+Ska0T!Yb~5%{wjRU>ScmFv-6(GnKw!LdOBYty$dExYy#biDr~b|M)ZuxhTW@Gn z@ls@1{oc0}&2Y%Za1=nH5U2pdoD{CTkRI&JKX9F;)fSpdX|gKlaCzY5b!{^y90kO& zGOL3VP$(;E8bRS^vn7@5lZ~TMh1^?7h5t|6y)4IZZE1pjm1s+|Q#xh}9#OnVnswkp z5F~B~0g$35Z9xDcA%Xx37m?sQ)kBo^AV)pyNzck^kk*47mDRkze{bI&9snsa&8n@k zj)({k_wD<#F8})1TEUp-Iy^(^k7vjh#Wyt{!w_(!;TrVl@*N`hXXBmm6DHH=S$jpq zMq6(n0h3d0ZU&1Vi8R21UCS-RQTm#SOrzEqy6Mdpv#CWRnX^_9`#SU^EW8-yEJ0W&huUDGias4{zE{4ekN zY{8~^kRFj86#qFOgm?1;eGf6Y378;$eG>zoM?FnTe^DAXqE|wC;%G+37Uw+DwyGANWEx{Hycfz=pdfsJ;3b?(I zy4pQ?1#~G#J`-|yRU_`}u$>c@TDt|yiyxgiDQvo@CLVuaQcFeax(Z$0ot^xiybb0od4e9bqSAd0joPxQZ}hB28flWKkGsr!$+ebNSP7ya_Nbg zQpi{J#EqkCK3zAtp&21XtnTk_|T%?+V|({`T#mnQeKcCv*ce5ETr73)UoB&#J1(|ww8!KPP+Ap zCIo}yssanGu{C`e{BS^PSttaj$5%;4<)WspeF2~;3L}02l9ph=IhXDzfBVJJzn7%p zIFGZ4e>rEwSG}xe#&rfx<<0hjF`+rW#7f|DRh)-s`1|hXLz{Ar)zyen?g*->g8`~c8{ND2nE~hf-eMCu2qw4%Cz4Rz9DX4X{Qp-@rP!Ef5cBQU% ztU)#D`8JZnHpc5KtHohQ_e@^Q(M*j0=u=L!iv+DL^;IFlNIxhv8varz?^`^gw|XR0 zlYpXCNxUe9V!9`Hd%O%;3h@KL|H0TLzHT7EW1Pdp?M}`<=IYzesL%^RXWOEb9Y)HH z>xTeT`h2whn@qT!30`-nUxDdK+Alc)}^$O^dH5h zes%q3T-iDeQJ^0~I9}B~n?AS+Il4&K9!p~~aNJ(a-ePsufcc_G=N^GG_O@S)HiTyj zxMI-)ubuyyv!7^09fRB;N?~#u33onPS=NW`bulXBj0UHf5#8csje^`x$0shsT=;@7v3O!rnNsXD*_rPUP%{YWjq+Ckg&WyR<)Z ze}=qpA5-e!tQ=^`6TN^}B`+K;Urv$mo7iX2Gm(0eL6Hf2cTTHkgro;1`M9#_{ycX+ z)Y|&S-e_%idtd*G3P|d?VZRi-XI?3zZV0aocS|t#>>QOz3#=18?@l`SE{VYIxI(9& z%t{l!?d(@QhnOJ+7(amVfb{))3DGVKJQ;llikf8vCky+ z6PnK5%bUA9ma}65^RJ)^z)U~y7MUhXWsIq6-q%;3yx-!fNi?dO(-Kac?a8GYmgaA0 zd3XAr6NoY5-WO-{wt-AO@7s8Gr7hyR@|2^cvwrC_$!w+(sFYQIJxd0 z5PAQb!V8m(uRc|gUtapgdSHbo+q>ORcus&}3ud0i^+f<=yB}5$^Ff$0-z3!qe%;w!olfB#?OD;x zzY3XjZll;#LRAtr~97Ip8Oe35TUHX!t3s& zne#NUP#xCV*SCldxu3ws$#kzQYTQa{eLVf={$zJ`rCmip>;*2*EpjxrHzynGks&` zJy(?t+2;9+@`D68=I_H_o4>hrnjEB82rneiV6Vx;{5nXeB+8Yey8heh-unD^EYZo6 z-E{#76FJ!`6?e-787&fHgh8)=+F6Sga2bdr7c%7c!4{inP-DkpznoE@vw_!__eLwP zwkDgLkMGo19cC$&p8_DaH8`GTRgzro1a+u7e6i>^MdbLuw~)>iFLkqddvFVtqEy}XXR(mYaGLGd@$%D2w;@v`Wb)f& zbG*5#7g)R0XS>VhrvqR)jP0B3oJ*vxad&oZpVq|THc5_dFqhr$D6Ngj%B$(-`rgxi zv)i}MwXkBhqkpFNmxO4qyV-90AQ1ylWRz(Q`%ZpOVYhng)DkPzSjLGgwRP&AOW69U z%)(2OrLeKP@qpEqcDE-h;jsG%y6!k{pN@BDibHkG;@*;yBE{~pWyWI1y_!e@O5W1` z>uzepEGvf4os1$Im)7^5Y_tuX=s`+65>Vq7CaXUc=>b)NXO6~mb0LeyVV|m%aB@7} zj>6ZyhGdPu+a}g&_h!`m8%A-rCjHC%v6H$yUQ%7BfWc|=LTuqFE=@K%<&liC=}tWw zwv)3l*(-0PrNBJRzIsP%ir2UOlmJ6lYurBHelq@TeRFBD^s<*h;P#si9i@wvy z#RH)i0=+dPN=L#t3liq>%eT;T zFw6j+!lhAZ!Uo&kkopl8)!G z)~Dhq(`-&<{vCfY;A4^+?m^)-7EFpJQ54htcKeR_%j?Ba0NRatG8bktB|Y6rqAXaY zr(^e&qM&T=2HOdP9eutIMZE|4dYiW~m%+&G~G#=Oyfdv;gGalP~`g%|#Kuo`L zGcs8Q7hwb1 zZC|-40nx9%A1IthAM4`cg9P`515bvsJhPGEBlf2CyE>|blWe#Ak}~*@|55@r4b%Uy zd&COFi`XW7vNM40{kXHZ9ta-K`=ht$!)B zNWNPYUFpKa@}eQDkV!Ideh;wt0eJKL;?vFLrz?k2!D-)}CPPUBzpE4dJJcB`L|X%% zosz;eR?hEb*Jech$+uUcg?oOW#9E}iBAfWxOo10-Dp7f=^=lpe7bV@>im6>nv$WNeKqEa2A(+Ib8ZE2d zW|Wt}_zU^0sRRXhOYP7-3(r_1T|bbq%ivihR_f3mrE2c#yEDd~{j}=)Fr)>PPiEsb zu9#WwloBF%ZN*hXEjhco@WzTwmQqXN)Is>t5pZk$`RFoysMaepqp2e`3Z$W&R0^uJ13DHdg1wQb;Bk_{ z%lb+c(aq||e(%SEKklrln*$AEBXx4d{Kqz9G}j#ljbZn0I{~J=V#D2%P2L^c{Lw9% z$HaQgKnhAuIBjG@VOJXEr*O|9pE__}%|v%QToIHEYeM%Kw9D8| zI#}0HqwB(BIt3{Hs_6y*j5nmVtdsg7W(o>eT={Ecr9)1NH^A28l`7zdw1_?D|AZi*BTSjJW@uZTv&gfdnzr% zalU;|!dues=ROzF`P}CgOCD#&(1y0gLS*UjJVui#$|CJB>!?S-UV?pY@FwfhSXdhI z$Qm7I^>3Y+kG{wFlugLI!x_KKtXAN-YU9V7U1KG8#<>OjBUZe2Felh|kl zMPLlawHU-2>MOzHct@Z8l9(0L{QQ@wavY@Of7orqeG>cDrX)tt5RZ#+e8A25B~QcW z|B^+cChHf?C%^lP?-Tng;i?xC1DMWkWDD#-TEm5@a&U^%| z$s{fs#4?8SHrPSf(+Fw4O~jf^GM3kdX{CFoTcC!X

    6KF( zrw)iD0H&}Io4}D*qi;ChVqlNxPF%d3G7Q_jp_jf!7Dk?-n}f3FQP>Iq%`O zc1Pi})s*PO1sFJ_8DbKGlnt$*U5ym@6!<=oWPb1#5O;WdHh&7lAinz5+xN76X-nDz zBDtGDxn}^v;`^XlG!$)q18WB=pyYiC-#hx)eMO3q66;G9dQVfqVVl#Ab6m3#?s}zh zs@gtA%mYOfP*%8Ca4cE}_jz`O=1akqmLcGpuH(ntNY`g5axCfovs8zQwU+83t)Frp z5VO3-=v%R+?M8v9ZAx~4h>3}-{pQKLy64+H1d(3sSE{h&?}DD z*gF;WY=K%WcM@^#DmSk4{fGH=iV_?1{+?2*)8{n73J1OPH~s^$MgBs@F2%!{es5PEb6W6VX^Wj0!cw=&lfgz#h2%65?l z(g9$9Q-QE#G0szI(`MOQz{t*uTq%EdaF!L8NZ>wX;%P{EC4#%U0s`uWU>p4 zD>}460`3A`f_cL=JScVxLoChfK1r$~cGojryri(x(BLekAW_7k2``_}DA(^e{8|#< z+y)1vvT$1Oy}fsxj5NzU=9?AVBhwLGa>F_=ZXDMfG%TfHb!+re(d=$bo{_Fzp_>Jq z(_d)x_2PQZ0i)+;M} zJ29)k1~uW3+!O+vjm{3wGkb@hhzAO!W}UMsN^%Ahz6J~D;T$_2UQ{-tW|-_$fXAC0 z+?u%)qu+T(5xZije;+}M-RYC!V&3cA&!fOqU5*SQ%`dp$!+uf5MiP3)HZUuk(?01iuJy4qAAX=-YBD#UCW!=Pv z7&*GBmA5iF!h86m0?RIpZh9jROnPn^p0q##uxfVMdt430q7XP69z56Jy~4_p$gNd$f3=vw2N!mW&Pj znNMMRw?9>$%%|bW*0Uy2)dG7iFo!7l{1<_2@BTtaCpfH@4y`f~@QEe6ypuf>=3`i% za=f9OVha}<%+==f^KFyoDh3>;XiNlD!sbpl#H%JVxsH|VCBL4)5i_4Fvk{!LI#mHH zNqGFr(rAeqdQ8V`uI_EDKM~QUJl;o zCd)UKetJ-J0rQoy7mXT~SbBK=c5mDN^K*RcpSkl#CHOnuJlH(jWz2U|=Cred(x!^V zBj9lresTn13aFMsJY7sC_KODypK#e!axDJiPHj+^!a<`+;D}-Hm`P%Jl-ORGEKjWe zR_n^KJ$*UZP%wCTcmFrzBS^XSZAG5j$n4RZ!C}v8q?un^$JD>s0x!4vI!o6_lxcX; zMb+5@PVe$fh47|H>tF(3C+Rtp$?hrrvX5EeOxUhU`AL~6c3${LJd2Z37q+wi6#QoC z97dS$`sfJC_$WTkG3s9m008!?f|Qr=W(fSH{e=Gpmmv4v-Wit4<;wj~t_FBv$yyIdd$OBX)TGhRiBL-Yh-@?~L_R8lQ*9XzU z`IJz=`R)KMCa4ouf;JMNV87GYiG7R361v0<&aCJAAW_$^ulpq~VLag`)6msuThq&% z;nMa%x!^HkpMG-goC@Y+_ew`QTkaW4eOqbH+l9)0f>vz@C{_bPjAOJNTM8cpKz4Mx zuE3u^`Bp{K3`#v%AKRY0PpXs>zb<3$B~I0|GoXbj(VM?NV>Q_gpZ$hE3!T6F8$$WB z_p&vVS(rc7-=%wKM z!?O(bU(C63yhtF(F2oN*(2aVt?}_YDguJvG4qw8X$JNqB{;i;S(R&fAw4h0%W+9Xnp| z!tiiXJYhLuHESqq_Oo9}Os8t@-aNyK&pH@~MivNlXHrHM&C8AoukZ!G>;1ja?u@iY z2%25+e)5A81b6p?L@`l-g7OH2;7J`OF6%5VIv(j&usXXBgt`Hx&kOn!mV0X^vv)LG^Ci$>qoR zDxa}7yW5*BX3-|)`k5a~+WPA!V~NYN|HADDNk&0ng;Gmr1rr>9oKgy{YgZj~)pTEN z?{BRQc!LO4>noF|+gS>zBHrm04V3J?4$c}SGrcSodJly9B~r^hfmV@+zhS^!DqPOw zn!|_q{?6XyTxc;`cX8>|lq@mYNcR4xIVU+>@|D8_ObmDN`!1F!wF~=3XF-7*#sLOH zElO3TJDIllG{RkOAxfe+18!7nT)`5Ahs_R-UJG&bM~SV;wAnbj;Q~j2+`KP^Cl-Ws z5VBNU0j;HW*tc<4nsMxT)mWMP zuJ#Hy2~l~vJV7a|;SV~{?soq;%kx9VX(^H@zIDD~_zny1Dewe!DQ+n1fkV>|8Bu!S zi>v@W@C7mt%vOBl^YkE{x4uX?k`KeRDD@^sg&J4<-BjGH)r=C|s^P8YG*S^C*$b=* zGr-f`(uMMgu4DdFat&7VWx-s)h8HK|RD!z;yNuK-Lg!LdHxz;u8w&u+K!MoXJz z;)&93-J<)v_}x~KoJRhGozMJ}9dvN>9e&Hsq`3bn(e;GoSA+Iofy8u-Qgs||@pIK( zxI86TFy9ssXsTKTFTqbcBNUo7j9bJ^L5ciUtJXQHUBQ+P&<=ol2hvV)WPV!q(Cj)g znWzT_`RDwMlsw!s++z2q+yzy>{dzVYLt#nzn4ty{za`S|e5x6F;y$;oEiKA#e+oNE z%FSo4jSFz+4g|*SPoX)FY4zJ5Gn!~3Nh9kMSPb>GyY|X^W9e9}t=+W_;_7!m-hG zQ^H`pWcbQM3lul9sx|)g{hhC_FPTd1`mC*pnVKqmznn%MLX_9p#T(98-G=imk>RWU zCDxdXT&}?#x&{*=&_gn``CYvmTNrhI&Fo{Ym3m?hh{$A&k*Y2fFt|@Pu2~vf-vBnV z^hfZc#Nxa7I497*H2OfHFszP|t_e@rM9lC7%O*b+9ea?sQ5W(Wo}`B|NfjM^{=Ae zexd)CaUv-L+EebjwjD~8J6uP!-DvhD_I&QwA9e<-YTXyJ8k%pC1sp9 zGm2EHKv-38(PjKXTaqWG$O?NQBxYOpEQ%RTC6zbqtgZ_kR(UM_*(r$Y<#hWMXXOvK zVEHk0KmWN|zH>d4O;mk$eR?)ZfV#Fr`@_Sp8#|xlnXwVV2%!VaXaK@CtHx#at>DuX zW9q5y1Ci*T+q_5zYW|(X9&j*kOIZb90^>rPl2_Z6ioQb?rOheN&70k$^J)`x6Hl(N zhvu_;E8aUU9UWuNqvu4$?!|&`erc&VUTW4#J!g_I+-qwK*Yh_$@S87B2PmP#Z@oLN zG`iHcU#~c*^-Nws&{4BAPoLa9t1+Lw4mnCRwW>Fl*I zZt7Fc&zzqkRxQ9QHsS1wA)pS>4$-Rm4>FwVINXq$YnqnoT%?1H9zM(9*n@V*s#dCL zG_Qr-SoNf!$^cLeaj2sVmv>8uTu|%>EzrmP@Bn=IVWo- z&j?*%;k81DVLVKCBu0*=uNVNE(|>HRqBiK4%1ldP`cMR&jXeH5Gi-MjNc8k_cD#7Q z5*#6T-awkV5*SO@hi_nZec?yt^u&Wpp*~FPckPf>^%4 z45PI_aJVv=G7YRqlkL4_BdaYr+K*BzXC8}Xu2|7hgcMm;XsOGGY~WL-fr}y-DW&?T z08qVt6;Ng9(hZb@i`mKf?7|oeP4+PeVRy2!zCC_2-Tz1Z*XDFT)Z^q_b{-nDRajBvP77V9 z8AfL4S}-s?wtroHF#%~zed3JxWMVnG-P^;^_BKiInQv5b4&POX5Y@Ex_~8%J>``C* z|008yXP02t;-B187JRGPujxg_^r0M(@Ot8i>2A`vPGTX!7hLY4${3*SJ^fGju}#qf z%02=ulWK7*yIeAL^I95N^#6{JiQ<#4tCTd<(SCme~i%3pI$(UTz zDhwH6ro<#+TY9EIXu@gNTp}Wl>Lx8jH}|Jmj(J?NKTA&b184N<4YvZOzTvT*8qEy3 zMG!r~r(OT_?x~SGdmVO4f2<3Rn$o*mBBkR{1+LGX0{#zj&Ph7Dr1{LH0;uVNW@*W8 zFRd*wOAravzCKosp~TA5Lus`6@@ZGyp%)|o3Nkid^q@%iwg#Th7GjC~j#LPm>Py3; z6O_>H^i1UYlCYUPS)K-P;VV!i(~ZnYiO07CVJ_1v^EC{m30wu@5)0^ynJ?giTa|3q zj}wd{JiY6Hr-;RPPXqX7c-D$hK`-Y(A5I93TDE!Wq%Yh$d!;)GMog32`>k2sZYYBF zcaf2hl^BgN!oPAGP#gi&1Tt~q@J=q?Avy=rkr6?jB==b0C4)V6m__dj$ zj)x%>t%t>q7s?e?8rPA1cc<{WflFV1FnYGrxo^uDt2J<1%m-g?cqO_YJJ0ZS`K@6QfQWzFw;OEexIH2QD)owpw%MxJYpQbdv=Drz0xvgLoWVRT}g z5gY_F)aH`G=PP<+j+B9*Mg6*b@p93*sMN(k_y7D0fSF~^r^}ky_HPO#V%C6Zudh9- zK<07@Y4bd)JtdFK?n$oDWU3Ott0V^?Tc+lPFXEPyHMI@s;Mu=sE#9Q9Z!`N~n1UHiT*Oe)rhsN%V%SSc&U~kGaHWYZ z>dvieyAGLj;2eQgfA}T8`5|tV_4~7S^y@>G@R-rs{pn<{Va8-Ueb86Vm>1J1l%6(9 z6elx^{dju3sqp)ntnKhpTI5w642tt>q2b1m?i*}Z9z$oriK20>=2vy)g?h#8XRVUd z+@kOv%)_#T&y<>h$t@|7*NKHH@JlD`7hNLxqI?+csX!35$xBQhlZ50?(^p_H5vHc0 z1_w;7yck(CK1;WZ#r`WnpkN$VjPYny+(SoItaU0OhYD`-h0X#>1SQBkhvcoYd2$1i za6NdAFxp%VY+v93W`II6rEi?5#Pz!)1|hQkB@9K-sy7WQ=8_?3Fsep%3{lV@ZQ55# zTu^fAizgG~T-7$aES5BMxapG?2M4*Zo&NHgpvak;a9}S{MB7f0x+1NOZ|iU3qq3}= zjLUl`e-dyR3K11zOs zehSyuS1A$BJ4|hpxOU~S$cyG=7iqs6TUujO`9G2l|wJdB`Lb48P4(f984R{Nc)C`ONgI6Gs*;em$6epb6{d_67Yk z;Z``Ix4$0#9+&pcWDLHS>fvDAdj9vdJYlw&nt690KlpukKX+GZaDjDBHJdw6=v4>( ztiST&1kB&BkZbOIJ4~j8%OzZO=bG*Tur(2&JKy#xLwQLSAG7x>*Kp$Qyhi!4*!rCX zA}kN?l?tiPP5W_D=M`=DL0KmB{|nFreZ zvIu4$QtG8yBIWata=QD?FBkju{y#o~fU9`mS?suwFy4*wQ3{r%pfSyTK&+N8+{>=h zY~b$A)YN1q3AGoXXrNd-YpR>`1b!YU=K1=?F{`sJgk(?1_N`CZXKcAUpAxhpam!N_ zBmt5CMC!JvUOf|E1VpNaD$G9_O4 zk^1XQr{D~kUfrUN^WvZsydOGp{Ts670NfPbIRquhepL64IyI>a#Lr2T4jNY6s<<+R zIyfjTd2h1Z0+s`nU`ZhC_aFS@Ng+gv|DC@1o=I>~%1$NXVpaEMz}B$v+*!>C!cLu*JZFzH;|Lt7$_%L(UkD;HZ%O~NMl6UP^?vDM}va_reh#Q-TK zy1TVQSz^`!yjT0=z|_BduJrF>iORv(=C_nXE43pV{}cc``3Nr}FheD^CDK!SeQ)pA zRzNRS5S?Avht9KhU%JpI*Z~bn-x+PG6r}Zj?h(ltWF)tt^0wZerORL&Lm~Q=sY~i7 z%dW%>Cw;9vP=z9P2PelL$IEe|xjab&dnx2F7jZsJnYPK!F$nYQS{a5W`;3thwxm*T z2Y7V@r#d(Hr&FoV;m{?A#Evx;%aecoztOW-OJ&Q^W{K5j+*(-8Zem*8$|O!WbaiF3 zy^W}C$@r^d3oEDTg1%3sm8tS9pf8s*3X0W zWJH;H8%x~g&!a<{#j&VhH4P)v53x7sgA!pk?RMs#z01#&uy>d;a*0cIcVe^c?~J;f zaRpj4Axo)Rdt8llSd3cW8zO{Wb)m3#a`vDaMn9Yx^^8epToV(3E zoBm+-Z~xQq?ATJyJHO$}ti!90SRy6%Lf8F7M5>0plNnN+=Y=d%X|&czpDdwpm1Cx( zQ0ecDcJ`NSvs9Me*W~Igj&dr{q^5Qm?^S} zwnv-l^pIzx-N~k>J+n8qcSq`bOK5XaAOGkXW))RB=!NWThaalfJz20~QyN&euiA%F z`c<15Y`D75hQmlU@AADJP6eJyo0R#y%{M?AN2TFKS+2~{>WcA|ndmR#LO2xZ=^O%n zcWo;&f}a!O{piJLs?dSJY|d;Eo>{cbsNSp&hTjVj=z^h?rPHadI;8)N`y+xeSV=g+ z>*MphUz-kk2nCDLgy>Rln5_4mjfsnvRrP${rl=gf;Q_cWV!`{OjjztGLHgAO%ZyVL z6VAOt^$_uT@KVH?)K-KB+VVNBIAfGp-(x?~FioQrO~6+Kt5-np7UczHj^>)4QU5Um zO0Mf_*7<67d|J$mNtg9o>r1n~9zDog0=r4)iy0WrFBf2vux01ZuRwg_x0-5xpQi2~ z_1!6uuO<_T|1xIiu9&I~jVo46Zw95Lpm>(lo@J}_G!P}cA%rZfX$2ghsVdSSo}Pkm zglfLfpj}BgzUJmjmJdLGaQEpU$nb3pIQ277hqg?+Vg-?F50z?6QgHu)rUNWBA=?jZ ztiO(lsH$nBi_9-icE{@_312!7P<_VQVt;@Ya6@7#4#rYBex9rtwPMnjYG}QNbL<_x zOKGouR%O+?COi>F{HEN$eNsM&w|Jo?S9NtauOq-4Ao@CK*8(S@Lwz?DC%HWOyO6Id zlIUb>EM8KPL4BfPZVrE2zL2A2A1;0|R^>3yOT&tVZ}Op_V9?aX8xbagLGv?I)UwKF zzc>)LuPrx8Q;}O=nA*|q)9tVed!Oz09lgZu8+O{WF2mB=j)v}ydypB?TlLOx8wGAu zhRK0Rp1a!7BIlhF)}ki4#zOvy@YKl-atV9edN$f#kGSTy2>ek>vy|#Vy9EE$GuFZ1 z_4cgT^eJ8=?sg?pBN0-kPm4Z%Rhh4^GR_BuSn<`X>_Lqjzk07lt}stvtL*=@iTf%b zDWwQDU7Fu9e{(AKR3RvVmqI)l~ZM7OSgb-GJ)MM@-S8bY08;vc3ta!lJlK!Sz4v-fJmQ8 zF{-?rTb`@_s^0AR5rc?3bbw4fMh7@N8ux_|`itu=ORfLoH%KBU;|Z}8wGgSEmDt!; z;8zSGAK9EX&CzR_<0K%9q4M%GV&S#P@;{fi$Md}2?%oill{3{;54=yQ(d5qDh*V-< zUFMi{<{VCX;G&eCr@rPd!Nq;Cty;V-rG}2G&!YGJx535scBLAxC&-o?gW$Fe?qGfi zdAJvCMWhWr$$~@1%rF9vktgz?ft@Sl_V+0bK0;%&g z2pl%}4OhwYPOZ~F^^K@;aGQjdsm^LsJKyPoSfgHP;`;?6yLQQselWV=U0juOsA$L- zg@2IPL29q1URp26U z$SK-Cp4`@GnPrGBp}3sV`@4Fm=6ri}^81)re$;IT@bC5Mac(>=6{lM{pZayGopp!Q&UfQ^ zDUmJ0d+t zKQ#YAEUDP%_x0LSSX&nDv)I&A)-IAt?^e)?quuRXF!A51v*^l_O0Ygf;O#BTl(WJM zxWx8)b6SJT_eRy`FD%yMvYF-#qt!|9v813VJwBmjLM3d_Lp*sWMZ#b##`SGQS_m{IfpYGm#7oTT*|7mygO**|% zU9!&&uNd=Xj8?&mZoJCyx)yu#`w|ht5^8f}`y`$DUoGLH-(i~A=v^ylCMO1I9L{4q zWSL&*N#>AN+x^LZkksF4|=%Dppztkx& z@~ZCH<-B+69hnS}2?AuW$Khj|$f-ArcH6#qeUn7(I!}Qv)JKro4=q{jI|=lZ`IgDk z_ot=eN#tX9Xz6||S`X7JUGUCNN^BwZmFDEK`{AWH=fM=3@ize_Lu+dhm@ePR$S6;S zNn(?n)uQ*Qxvu*T?p&c1#~ z;UuCW*k!Ye*M!Rg!PeNk^Hi+is?r`hpS^7oRVlJh-yeMxq9;zeWsNwl+lU3hHdsG( zhfCbA)*P$vsE#Wskd#z_DP6s>`YK2K`7~>yhi3Z6+3zN-lxQoUncRyxt()1$iP@YT%&v1IvEk7gB(A{%Nk;7I3}!fd zJ*L32;s_l`J^GaxHFg z>Ji5KX(lOw)uI03S`-()#J0L9B2PFQXL5ZZJajkU1;8cm8ohd6VHBzG>J1vEjXVU7 z5C_>sY7~T|QP!l`)5VeOq-aQ>IGLGcU>6uM#;gBnM6w1EjrFcg z7iNeU=Zy-tuT?^Ik0PKm&9M6ib0M;SH7hl6bsHM;F)lM7e_$HY5a|u;G<-(pJ8up1fR=;O3nD zc6Ds#-c<|Dwn_z)qEpq}p^E4Aqh82J{7rf4t;zRI7sj%NlAgX+vfiTX97}C0l*n$I z2;&z7=iF{?k;l7vpztapqSSt2POq-4NkTuXbAFNDPD5i0)We<51APJe) zmHHYK`OHg}PKi5P%e}e;z_BdnA1F{16R0pMRgScnMa6Z(I5<1!pEn|Rn=}eam}pJe z{!${CGjkhZva+eS8YG#?@xl=C%>$6Lz>Rvhyv%YS1&hOa`NB<80gQpN_{4r&f`oK` z$=5}ecE@q?7|7NnY?BotqDiYHg; zuX*+E%pCxox>ISJwV8}4+D2^kcEy=r2&joT0ivtlF+36u%x3J&NTTOzmJ+IR z{zbB3&{zOHa84eY>h`fVj_v_@k&(bTW4;#7-|?9^@e7$(pRU#0&r^gV5*1emGWnh4 zCCVEara#cxiSLnD_=GQyz`$70BF7g+Ak=xF(y+UQ!VAngAi&+Czis!7!Pw7pC_8=yOZ0&O^W1xp9}1iOy0gN6t%$VMnKE zk*n4s&vj!oS>F}8TAkVnt=Kr}VbugyzrVq;!!9j{{N?Ia<$8>7(;Q%#s*&?r4@#QXQ9$ zDO0<+n<_zMo~j)en?tSH2z1=TY=}+{JPVN#Lo%U)@53%hKaGq~PHLcyYmhdNdE@N; z>+)MvlzfX)WE?N}Ms7SPtyuo~M{H(cRMMP_9V7kCyXz~of*zf$!HT{#--aFt7qi!r zF8q)zVTnxMDnn6Hb|?4xIc3B<9!0@T-=3Y9%1RyPltFPc)lZnhIb!Y3)Y&P8T@&h+ zViC7orQEYa!DaWT-LEo`x=49xSg)zsfs2Y5^gBp#HvU=-&z#!nbV(SVu4hao_WNYb z$vVI@Po9*@fva4$QqL-sBp~;hzQZ@CA3dnb!?=$cD4XaL$q*!_HCmfd3k=Ke&^ex_ zMcqit#MSBFhMpHs!}d&E=05rM=*uaZN<=BymrdV=p?dCgW=4srQj(}=G8Z0I&R4!$~X6R1!of^uoor77Z>7`tdiW2#Q{y(7`wZJ zYkFk3-y*KkFiQuk+sycKhqN$QxIst$o}SP9hLCn_nn9Tpk}|@#Z5cOmfT#|ayaNvF ze?AvlsC4OE%hNi#C>OFQ=d!LR49)HARzH~kC&skYC7)J-ksGiX=rJ=w>^C-3XNCD1 z5eip!3XzY)(=X_PrIbC{?L5Vk;4aT5+Q_tz!dnh|3%{Ws-Q{81jpmk zdaiILZ!ex=;jeX+_+ns*o7XhY7C`Zt3#65%7qu=^c#~nUkWY3QL!8aO}=pEnD&jg7&q7u-%Tz(#>5Am>CMv=E}Ye zb}6kTQJY&775VUm<%D}oNmn5h-~&#BDI+nVt4{Hv@(9aQOUvf%t?ixVZ7)$ZpHuXc zeYd%~3##4SvG+@7qyfL|p_5*-;oP;~u3@AZA`MjNY^q8EDKu@N1?Fc&7zvd~Y9RQo z_e^PNOCnfh=*Wz>Am`D)h;AA!{|%j^)at-tT2dlH9?D#ry8>19r;y}3^%l`~EU~9} zJH94DP+{t)4gXl&?pPS{(cjGu6&3iNS#<8L73oc3h0P;wp^5!lrtf{n@={djhlg%0 z0_wR4izzf_{2ykoU0CYVHNh`3Meg%1i`C}19nOy?pDg7QYbI$sH_f@utK&r`W*!@) zrDiUU+@hruL$T4j*Izx%{M1Ym1qQL=!&f}4tJ5r52^@GcOrsdE%^Myr4R&$z<1pVK zEyInTRB%N!l4Yduc(H)m$djyM)XC9en(6HwTzqH{}lui5db5c@~>WH#BQM}0vYN=&5w>w;jDSF?a6I}eCSTNaS+HIk_CwV@hEYTUo@PABacu+{HSL&q zJL*th-JJdYdob1D0Kp*&q6(%08(lC;io7jv@E{O! zjeA;yPFhQ8ej&mFyQC_5ewK-h7sfipckFuH_G9-g>HwGL`u%I;>SI}TfNpCM0B*X5 z;IC#}CDvGno43d$ayrQL^_8L=Q|CPjpPtyL&Cvx~Xs*fNrEE%)tdJ--gO1o2gN^dz zNV)u<#_B`{!8>}b?!|F?5DxWdcX^%gpLb&?SlLFV{j`vog0~;U?Y8=5i4{nfvYAwA zEaj3HHLLzskn4Vz=q72Jns|?Yfne4RE|dQt1eVB^^q4q*%jvj-=!927ORXsWqqA0< z>aqm9?Yz}5u8wndYg7g&*Y88wQK^&W`QYjV3 z`rZhHdwXku9oGMxom`iFSGRq-V(ra7KAnA-*UEFBK<%~{TOKmO8qnri-f*WDJW83& zc&D{zVs9AMFTzYfUVEdas-4kIZrw+r5K-%ur?V$~)$i|Yh4PN|JqQ}e;lVqh?O`@_ zH&Y1kblLiQGxg~c-=^L?XILQO)~CRLWL4~``QKvGwJ;s22f6Dv`s&p|+sCYLYIIVQ z9oq7>hbZy|?_-$<6hEJZ*WQhaSIwiHzP(lhOF=f5bieV|$V*Gt6kK=g7p*E_w&Tx^ zN$tpr-4$$vu2Mx#AmE~y#FS`?CtlX-gQcj-tqJt!xJ49H3G8hjmJg}0wQ2@ZQziwC zS2s5H)7!4rdjND2!@F3x)Ibqh16+!tz2fvUCaetAPv0m!`vm=vpT( z=**vO_>TB>Ef%f~=2fDHC3#}a@uYdei`46v9KKCntF5GDEMih7GG*>?#`ow%atQBl? zQWY38Z(AH9F@V6Zl(hKO7M+JSNU+hGlxGWOTE`x6;Y7`e}q_GQ1c`Zl4Y1aPvnxH^{dNF zk5st*@qN1!Co;T&CU!D4rR1tpP>vxNNW9|L@yZ16q`5OsZtcyDujf#;@q{Lj8O_oFEM+` z*x7b~TG-k4w34O24=T8_FXX?rt3R1mvZKv)RGqqN_Odr+`kH3{D(8zK$^Cwg44m*~ zzW{vHyxODe^X$@V&+X?0(u-j!%lkAu+Q(wQ$#uoxinq~5+M57sVnP~L=V^rS1|>;~ zb?n~#GM5p}6Q$hNE}K-iuQ&U8Q_a^XVXFzb+?tYX&(!bqI(0)-MV0%p69I^-B~^Kl zM-~DM->#E z-)n#u#rJTRq-7L&7c9Fs83JaBoK%lScG_FeF-es?HUH>-03ACTodYXI@rsX51p)FS z7L?=aUglNNTWILF-amUyBcQlR|NjjuqXPP7(r1^QIn<8YBUmL{TihUIx0i~++Q0WU zprC$*+CUvDI&`J6Ypjp}Ua;iD+!9)>`_#3phwQo}Cg22~vRq-)S{lG9rouvfP~w zuAPD3^{1)H`j9sQCcP!ZiVhOfirvAZ3w>Y~f^GIl!XDfd4Gsqbvya7hnOXIy_LCsJ zusbf%2Yi&TT*Sc==7?+2Sz}%c>Jn4#_XHg-RbG&+`mTd;{j^;N4(0pJv= zma?Qh$ja*6`Xg~mu7;pqR`BspDF82ccyJt?Y59x>Tzq?;1%bHrYJKn5OrTP3DosgG zUMBgg|l~z`Vj$_53QdG%X^XhodsVe->Og`$*g0 z6xG!pgQJ#^QuV+!v+35#$l~uT$?NTdGV=|=cWEbm`#=D-znRi6;_L~-KSjXlFw41g zRI`c%CDoFS)gHxpqzv~@KcL=36370HOz=LKc$b}~RU+_cBc(y>eoG@|ecexV&Q0N3 zESB4{v%LtU@hA0=DkM-iN(Y%01}`(a*aAxH9nXT}4dvbs^fL_*VoiNwHq1lSwN7iF zoHiL;>t9B%B+2S>e#%274ccr-#7~UjLAHt1!CywdJ^E?>2q3J@{4v>G^}#M<;gawh znghVl${2=h3f3Ond|-8))X|AGkAV zi#O=QxhVSWFx3^}ltqLW>QZ5-4A%h|#t3{G&ikUAd!SU-&rS?+ly$FIVG{&x!JteK z!lgvd)lcR@?=4@y7X0pXRIe4B)Tl3YUquM>2E?ptI7e^H_sioaQJ!om{#OYhHcS<( z3ZSsHx-DlaS4hBD6 z`sj@P)yXa}1vzUM%i1_Q^{&(0k1*eh;#Bp+_gZ%T(g~7*1&ZFd?UtMKP-yIaVcWGD zpoaf-B+yLum%j`bQNQ+CS}l{=HC4Vlk7=vux5wwZvqRxRuVUw$;^x5MC2Wq8-rc`K zY774Y=Hz7*rB!)z`DI{+Wby1}2MJw1tdXhN$xWCL)WVf4SYI(>(h+BUy5r6grB;I+ zC~ZG+m}nRIrg;g)gE>4T zco$;Hu617>t*vhFt`+|eL^V$t^bU<0pJ_&R-+Se)ws%EBFy-u{e5`W9YF;v1j6qss zKvgo~&lFRfo=trhc9qgC9~z!vqxOd0=)3*tvc2pq&Zgbbsdr*EpV)%>%SzcK$-VnF=2IB%wf#nM`Rk-vMSrrhYA&3rJ@9P% z>6V!v>ndA_khOlp&Qla02`Nbqv7L7(JAq&~C2zelL@N?kStKx?b}ZAji`)6dwM>gh zeL=i;d90uD*+9Pac=FqPa$l<@f^##XsN41YE^)jgjp3_p;VQ&AiIYz?<%t3*@Jp=q zwmZ@-d7HXJUlK~WiV2Wg|D0@!<(E5Ce-Om{f_ZGV*D-yS^VEnI5yRns9nj#;qQp#d zo`Ts2eVFg3tv=T<<|UCA4Fg7f8}#hu%=IPA+Vs6^@+c?f1eKxWjJD}X(?R7F9F>)8 z6m43364N|o2kWb<{cE;zLB~1F8};%Fo4I70Xnn0@aAi7IeSEtC5nI62{Q6Weih5(H zF(m?NIzP_@pK^?w^<(Y>s_yLWlNispwwFdzjAC%z?)LKYY1tiRuXu@0mvG$x7KgaW zQYN5X{nGNA7@X7NkE2RbjO?msIm?BL2Dm#`%2{9zyEzmLhoI-?4UfD17hmJsE@m+? z8cGMA*n&6CdGqKzmsTMun4ZUiq;2;S`rHpr#^OF0yh)76o!RMl(&%`%g8z#ig7Qcu zjU%sH>ind&8;JEP3YDYO>%R<0se^+01-WQj!UG()M%5kuba`d_iD8btLuM=*RVc-$QRYcXx&0DxV&VNpXc*!%>k%Aq z4O@0U`Y!UXR$EEx*R)H-HIBCLL$NDzu&VZsX-4Ba)qB!>khFCr1;$;c$_QYA@+&{j zb9BEEXgDA+6P~dVeW+TF;P^DJP+m9hKyquWJKB5nzi*(dPsGPIsPKA>dGA20#&^Ee zf1xb`geWE<=Fe4I-^=go@9i@3MU{iRsn^}z5e4k>+*n8Kuje*J9NoG6YjVPG`Rp&1 z2z!yV`dhQx4?k8M7Rc8w3*RGP)Wz?omTz&T2KP#ZUbwfA&FQZ76A3u(A+j5T3+5r)w^(>Sa}*k+lhg z2H|82UD;QQZku0A9z~*tE?z&;Hod9|xVB2Wjk?xHWc4<{-yyS`)NQ6v*=fA20EeABSzho#65rNC1nGTDGDfH&(3tXV zZ|{|jS;tT;3W~eL@dhqpP6Yn`Ec|^2Gn9oT^!CdBKWRIXf&P;>+n<(71#`Quy*R9w zi&o%>1T_t2aSHoIGYvm9(e)%=V2)sU70K@&{O)GAl(1X;dB2~6vpH_(X9~~@YAFit ze=Arvu%QOwi*8+1wZSL3z5vA<-|3s{X#U>9sHEYPt}YE}UYvHcnJyh!$j$s~$ZLm%!?glWv_G&+6IlT)n8yPjf{eAS;u z|5Vv7X8rn>OxV3rbVP0r3vh2e4uK5lt+g`!nY{#R)u#YjJp0UixPT{=@bP44o%z1I zOQ>}-b3d_h`Uz~4QUt~E79@Dr1kZfxRmPzGOGS=bt2@70cyS5_!fuZH86=d<{qm+g zDX>%SXF$jo2`w`|Q-%l_q7L-gdC6rGCs^ze#&2Y*?zjB9c4tv{M5k@JH~k=KSQyIk z3{G*mI$6)msGfX(B-QkQW^Sw_lYu<&?Ci#|$>bzO0o_O*Sdcwd%{99@UnudN(-4zD zX!4f$=uQ<9?=LC{9q4lOoUKj)3s*7Gy5?Zrn!6j$9j?>n8vE>a-1z6XPs=Rh}(l4_7fz>2FC}wcK_;^+`st9OPjd%yw*-`~VgE;oXn3Ve$0tTuw-V zyz_f-l~c-2XHLA8I_J2BSfr?Zkr%(HluG~~pO);$P6+g)f1J4N%eR7^9kHni0*YP{ zAA+niqKyy-$x+1FlaCn2pLGD><_jfTGjoV$zizez5vP%D$fAjs?I<6ePpbfOQnPiK zlURIp0bFm(W?Svg1q2hxF$da@UeY4f1nFEa91F2C(wfzs8z=|k zfxndnq4S~3D32mMz1Pv1I7yI7DZR;-i?L%5=PXq`do89$FXKr*neZX@#)JVC%)UGv zz1O1lcx*4H;@^3Ve>o^6G>_T*A&sRX?#f{Fuxig(Zh^M3R!sC0*;0wx<-)`r<2lK8 zNmYw^N3_xMt}x($T#(JL_N3PW;odUN1(x+yG`U$Ig!o01ySVMHY{ zCO}ypEW=S@+DPkPB`WT&zexHbsjVPP7#uDU!)X<*ZEVP#llufh%Pi{@N#}tTtsLw{ z;ggziHCS7)#@zjK*Pp|#Sz!^WKfBj%bU85o1uGc`E3=DbILukC@b$C)qo^+LQ(dGc zH}tA(p2NVC0m1I=NfpJFS+qMD9B#0;m)CMtbE8Y#YzUXeG6)qz%>O8-h!@45e9nh@ zGy9NdcaCzTq3`oLb?fJ)MblYIlM_G};iOs)hePDUzd&aP zSF=N*)NR?hE@gQz=S!0Ff)D7>TjuBcn?XyNjHLVI*8~mcj<`+9!Y4bP4;J5^6JDG? ze=?eawxE!;&Z?x3z7FPSof%l^R>?cmYfafO`zfRAI;Qcw5KAq97iH7RSwF>3bcJnHhkCPSdtp07p_a9{FO{xgf|EWwJ_^*nNvO_qS z4ie`>Kj^@nL={f@rdS=rpn?SZP4`7`3@__AEf$UHhkhdIAI zER~u|n5*JXD$6A@Rrg(%PcTTWvjc*+oXED7Av}jNa62Uv^#kjU9&GE9?~Cqr131P( zkpkEiY?19PRq6bKee2KXH<_!aM@RinuWs@sV2S15HMuG6sEhw^NF@l-EG$}67|ahG zWJ8~#3U$@HLakp}-BO@syq-dr<(ePZksIr&tMp1`u_qaZ8U3+p*8|eMCpZo^j~cEy zl4Y7cr%-I?=Rn}?@`ONcMOT06ZduT8zMqr=;;EJa1SW@K*$}Aa{got{&S#+egk9D^ z6_@y;VQsBO%WCX>*%_K;seS_15{7{vXVHDSbR4iMj6bbYQ#kRQr`^)%Yo6ejdN4VA zj?mc~KE$mRWZZ>UUz<3WOxhD$E8CRfEWN&`M{gv4W~>U0NH?NT27pRbQp=ttlj4#tP0Lz1oQnwTyz_eXnMd*jt#chsSaP(zk- zq)Ri@fBWyHdt*W@nU!+l!1tH`UL{Z{9vv2auKq!lMclWlpnVC$43X>;X++W-rAS8Y zvXzy^p)l0<~+XVI3cS=LV{R^eFW<_qPNL=`SRI70p(tA^iVGWD+c>K$3QM%mb@4w=j?NO0k~^ZzF>d8QCXRf*IeYC>k4`~tHQT=FTIgO0kl461X!x0OAu$z&O6`|2Zui#;D%lz2QY{7BzsC?~ zT-dZp*HIT+lG^Fv<(*Og%l$|0%HT&dNW#MH3-U^-4K+A%*&YbI<3Z=d%sUNnlp+Lk zH>L*1F5E(98+2g>f>FBywoUL0GPXT^X^ZqLGnZO^sFxlw3t~Dx&=tIARNq#-Tj5?v ze<+zTtt40G-mLTv!$fHNAlpJHw%~bRz0jnDk`11~AB?Njbi0s{c=Mgl;c;_<_MzHR7Y6!$lwkw8(R(-WOj+ zF`7nrZmV3r6UIGxe>{5r`&Eo3E(b!y=hcF2HSv$7E!-6Pq@Z-I=pAx6J3W^3hlu7H zF{?nc^U%DJI?x0T5c%MZ5T58s-AhRPvovjAnY}A5rHk&FA3+zX`jE)fRB@5Fv+*#} z=o{|wXlMInsY>5nOEPY5FQpvdFv}!&2@Q6(GTuwF0F1k@ew$OU#*v%p5^?MPfe>G= zPo9L4)9z0KtqQ=`Ka=qU8D3xATOEgi!RYtomHgj})s5|)9hE+qL4Enef9`ibOzSFC zLKW+X^)?nAc)8KzC&(N~AbG-1SWzR10Y#tYC72F{Y5LZ&=|%))n@q zvU5TuPiW)=YDAgH`J*YVuBzHN(sjIq=W;CgTx{OQYA8QwMa@5sE^{Ed9u<~7&t+?N zJt|IGnNk+D*O_qfwnl|Nf=04myGW!MYTwSID>PclH1F-MFYViVqcqLPCLGBSR6R?9 z>!&JxO-A=0Pwtg3C)@S~PIyB4Zk*DlyOaHAu1>>?zv@{b+={=l$HGf6Vj3!0cPnrO zdHu(cz-61y`Fq()v+6k;DP&5n>s+<8?yqYJFBZogPNsfWUca3a4jvu1#Cl>qH~!Ie(R^rxb`X@rMYcI?_dt&K@0 zdHG&x*p+>?UIc^e0g1oe3lERY{N*($>DI577wl-CSqupRPrPl)l`E#S(WW1Ox_oc+ zbhN1i$8QslUtZUA$~?DIAj}hs8atzVnJ9^vs$K6EVvDmh`G2^7qwTF!N&9S3;)PeC z11C!!TGM31hfp3*uan?bTHI^~ zn@xlF`D;aeD(4L?8%>uto1j?TiDLuq3rkQ%g16An{>>S0wQL$!rOEWnMq5@f#?j_z z$Ny&z5N^8yw6Z8iPx`+XU(PY)DBFsWKHHt@_(|~NzW3&ePD>7Mmk zR)GAoQ{9aw(c9f69jU5-FLN`0eIBlYFNxd!ErHs@nKy0kS+?szijKFXZjzVbwo55@ zcf6xIh8yQ6T}tv2OY3w-cV!z{$_MFo-5;lR!~A~Stq`i9!lmoB$(>`823Eb0@XvJ7 z8gw@@t0qY+rs4QXzpdQA8v|hL?AIzdyDt*$w2XvuN@fmsjCDcITtnAZRKBUq za^Ly3N)A(6N>$>f6S1`GpJnb9Fmt-7oBhpg1)^W9zgVXOyYc*_7~H%JCYfpTqWQj-^<2(nvO+ipaSm@8fgl)g@z+3Cjr@nAloUP}O?c)&I>(w#k8hn|V`GL|A7LH!A~< z2a-eqh9U8=M`ZSuLn0R|o4hHQ@75U2u?^6Pe|;f=V)gHK;k}(K8|D(L@cHq35Z=kn zI27~L@)$ZxNvi-IZmm?^3H|L4x+C1xaCNJnQuq_T++j`e$T50{p>%uXr;v^VAI|tm ze#8@l@{Fc0C%>(atB>D(N{2n0pDp{cEL+%HLU>E!pK4TWT%dPkx0a`WU5&tg~&# zmu+a{cM-5=PLVe@BJXb-7_qx*^|y0G$~WSkpFSLq)cr`@j98j`zPh?`{ynuuTCjK1 z1Lr2OxPWd;XBa-&4Q)RlFQEbdbANq@QevFQ3|ZY|OEqIt&x9WpMUBNaw0{Gcxn;ZR zaVCo`&j+Iy=Y^kB$#kS4P_`a{0pp@Z&~A8|UG2~<()wa1BH@ZhB}0yBzl$Zewmnsk zuLHhH{qKvLQ$ec_k;B+6Z!%9#o_G{G#Ay9;CTlvc*h%TkRkHG6+C@Gkl0=uuGp&LB zyT{DsX$8^)tsBRXTndX4EV7FrbW;HZVbfrWrQ~mawQ$vm?hLL-@-t_tMVY$M<~I0H zhsTMs7nJpJ2-w>@|Hqoc`h0bjnL*QQ5v*}+PEtjO{ij5sBAdO!X^9=A@wsLuw^lxb z(_rk;XkyYA&$PtK5^M=aEs9m_QckF?Up@l-N#2s1 zklm|>7}RchaB+MNu&iNOAE%i+pR?wv^<0wSijch6T6ZsS;>}m~Maj{3FVRZcb?_QZ z`7hi~?Uk=xgZ+wtl1SdICC`fNs2q+2GIPEw|08el08gk+&BxC@6l6i-gmQNJ;q1(Y z+j;3%*o$PzHb|;Y$8cD_wzqB7GQ<{mjW%=--oOXP3)3mnkK29sXb1D=h=huZY4h!R&}k`zYHd<0Iz120@`!d`cd zzJo)>l2;qftiHN_|Gy=GD5})|5Qj9ophPQ=Xa9H#6_|4x=2tOzWAX!5g;w%do{AV6qiYUwoxrN@ZXoJ*MhVm`mSOTjuVTe9Q#S=&OI0lN%jkvr| z>h9iGrit8DAgX4Q4^Cz-!3e$`CLY@NKPqkW!|2tKEpR$}zj%89xe#t~-aC@uV=7z} zFDK05Jaz&U%{a=AcxYokuBC-~oS@aa8LXoDw~D28@kLyLii%ensaQ*5QxXQ~w9ow3 zK{cn+$GXD3-Er>jVhknA?w|3iss&<6`A}`Q)!=oFg}4}rLbX3`T-P)k>*tk^)uGg| z>DP$edMuhV?}c4iKn@Fxt!YbJ1`C}UzWP0CoF zsf}>imZ|?4W-mB#I}9-q>k{rO%h(3QV+6&@3oE5XO103Zc-FV%ZZg3_`P9ee*aVeS z306eoNcB%6RzoVhJ@(`cd22ZUOsvCWugPwIY&BknYbNYh5|VPlYS|Sh3_OkkUfMV7l-iXQa*MedYR< zdpuTdEe#fia$w=|&O`d{g}_846#{_qii#$P9+5a8?>5I3SqWsFFKU=ivkedKHAu`~ zTTFGV`N(eCo+|_Fyo+*vb2SB4E^o!AZ>^Xu$b3p#cPzK~;C(X2&MeI4e#%hR)0E~k z8IN7w#_-LnapNsv+2M#Jmo{4L`asf=j}c`a{FF&(MkG~fEQJNi2`${u;r;rVjP<5V z3R`h{V|-W2f(?p1iVr6)sD8AxkZi|t!yfg>xf$j#vr!ce6h*$vO8Ze~orIbtnI|VO z_bJ0I(sA)~11QF-@8zgjufjvEE5^eZ@?TkZMfqKq^3Z)s_V7*nnNtGiXVPGKLw5hu zR}iVK$y$kqb~ebciH4>(KpwBnWML@|Q8;f#ynG$BPMl5s6+>7r z`X>RI)H~=%nf^2|1;uzSC&z!<+hgvCLLoZ&5nESN=-0u4bzpEIYmEArCE*w4r-{*{bpl{NKlqdnzZr1b|ln! zyC1Gg8rA==aod$n2tQzZliS~%B1%%lsL4t{LfD&d>>~0Z^ z1$wl2hlkGn?T_NNf8nM@^Isw-GWu#6qLPfea8JcEcq@w^{eUpJ_>uZGQ2B+c9!Pb$ z^+T+t;K9R}<^$Xwa*FQL1;eXk@QLj&e1stpJ-KidNP^W@V2~h_AC!y(bPNRMK$Ihj zS;d9lW6H+)8s0L+r*A!&xqka4q@oZ-3qK6&_RhUfM;EV3VUovpK2jfP;a=>?MD>T` z@~LP4r}amks@y z#0Mk5zx$|m@g-dyPZr2&#}Bm?Q;=}ZiFz|6O5HMjrF0Q!+GC1KGW7~%EsKQCJi9j% zzWCvXoC^P-6}kfl5M+-Op9FIyX&*viYQW&(U!1M~n(GPwA4f0PVI2Xd9&>}4oA`5u z)L)eoto$;K+>)4j=bSYa0KEBn8{tAY#*J!byF2C3;CNB`21LPFw4os*au?sO7Tute9K!h zwg0Re6LGP26(N*%l|W&W?FI?Mxy zDgH3?@%s0evlltUw<;6NXEZ->V!r(c5^$2r{_Q{TvJ&y)$DUox*EuP1@kdnMyJ1Jo z({}pl6C>b;66Z0f@xX7AhG)JV=u}~u$r=M#_qNLdmy5v|_^W7a(_D<3g$rcKM_0{K zf+ZWQGh28b6ia(p=PymtjO@>&90c89Bq`1Q3^|Vpa2u&j4?r94W0G@b#d?bb*?lGy zaDx$rxw)sv*@4xbFF>|5CD&pYoDX%hk|#Ug^h5+ipuoIt%gUO0?at#{Jb8v_eUg}X z@8vyggb*M?=>U^>T^sF#lBbN-qMKNAG0qm{ zN%l5;&rESJDBSH2>cBx;&b_J{#fXEB%jQfW9&}raI!D1R^x5@!^Ar8Lner+o_;gJbxnNUF4I^mj6^szQOTRlj{?pj%t zt%A5ahY}S7aWdS_1~6^NJT|%N_@?j8>{C*8`e_B`S>*clcyjUP24o!Qzm}|AxU7V1 z-Q_EnDceyV_La-pnEv`Qy7pV{X3D?mvgER5BEIs_2j6xX58+$xmSTP1@X&8tg+#Ev z}N z_NZIm!F}1QuQXN#xo*mI+#L=Rs{~OXj2UH3i?&M{Fb|Pd*iiv`0mlLt%xc}1skSpg zXIiNXGu(PEDevv4*QY#gVl^R?xkwdRb6~#krKA}+=B_b_3swoj{`}^?m7ByqHi)CbdZ+Je@9Gb8kJxK zi{Y_Bq^%dJWP3SgVR2w59uUaT7?}Vf=K_}%V>~AX%gdN z<`*INRMRu;lwx$;nyC9JfVGq_m#zc!@aWoB@D{R2RQ?yZOl@8FO!O(e#msnr-Tfa@ zUg{|ib2u>r7S64;ksZLzOA6CvY8Nk#M}`r>KmYbSiBzYvzt@2^a#ez3Q`z|8&vXuR znTl$_{g8lK2kp1c28|n3Os4uK751FJ#eI`pOs_Rz-Wz*>4aPnAn+`p%@n?*ncb?P3 zzUIZjmdk-GXGi}t(nyOc@wMXZqkuRZJ3_k)5>0g(COVUUSffAnuQt=7)+ySb;_&o% zTbv^2X|`Jq(6TRbLUE3P+u$S@GmhAuFR4hs%|94iAq1M@<2FZ%Zy$#z@E} z%9+>>eSMM1!R+w=b;+zGf*l={Jeq%(1|S>l6HDK{9Y9e%Ls4;xo#{BL|MBv(yxciE z`N#B~esUsDF<3+*zG*ksO|w=o?JiTw+S1e2-Po))HOK1c8z6}gIB z7bWsk%c#{?%8E|WzOZf;C~&iFq>g@aa;3CECBUw;M@RfCK6TRHnDNJf(=#&`GlOdr z&y%{xd!g_yE+o8~7Y=;(EEyBoRY<;-guC_S8R?eCPt^6p$9=vx+385||216I`Lvam zBU`KCsmlUToGsn#8zH_fGID~nUujtzeF{h=mWMMur~lp$1Ao66 zs3SR-N&i<&CoHAU&RAl?e4;V{Xe${LqNpC4?MpQ?oc_yvM*$et zF0RkdMlY8)174M%2qrmDaw!V)Y>!=9{(*6=52>`NrOB(!2^84B+asWy$#gZRy=*uH z8*zf)*VCY6Id@(gp3&9^01fD}rhrsCtM=3IWe8>O8BH3*)^nuYE&26AVd0QHvjS$v zM#-L8$ZY6^XcG%6Q#?ZFmMk`1U6R-#yJ{qDjMSUp^X=+&fgCoF64l!3IOwatig+cO zo0A%y5hC9DuWi$}FDNL2qVf9%$A<&?QYy;u;FRL@sZrS_x6SE(yx$`kN?JcZ+9_xEy5&5!gQbMK#6_dbTXORLo~I~E zVkRlFNJ`2~7%-+Nro>80)FH*ZJ<jn&$4=d}F&BVxpi zNhxb>pUbK$k(`%^5##!ge~A5@@@A{-w#pNF%Z7dW8EJeQspi1uQF@_fusGuYYsn=8 z+EUzoIY^B6U84@;Td~ry_w#wZ9DXY$)%m^E?VkhSwl>L@b>zeMNy7cO`+;<^Hs9Jw z?I(Lw59Hu2Op_B%;zo4Ij0O#5)cCDxs;&h5?=Mpkyh$I)Bb4HaLQl>e$MpTyfX<=K zUEqb_#~b!9XgwlGrbT7giB4Nw23)(h?c-yHgX4~!c1EMK^4vhGQLum|(E%{M64g)g zDZ}xxD=@`7FqVQSLEG3u)V(Mj07y!IUU7k#jWlNHT(26HKP{u4>mdYQsw#k4KG$95e_nk75-r)nV#FT z5mhJdfurHwxN@@w(ZE3!==a5Kr~OF>J@@Faq2X{?7hn$&2L*ma^G>!g^!oJB?Z|_D zw?kKG^h=-+W2OXZ+-%tqeLw!1J0h|**FsHZV8SxibQkJ9u&aVX zVf|4*eYzI`*=m3k-e+mmTPPI;E0&P9DZbngC77gcBcpvPw5urXGybhh*8YNogGjgS z%De%-^oK39s7Yvi30zrL`G{@94C7=)S@8EZ>W2P^V~G31h9w6kTV4?~(qM?FZTVu< z8hFds#eE8{sOJ7|7%`9p(tYQA1u0Vo?X7G3LTbD6FA>O&+v;@XA8sG~-Ci*JZ$A4b z&6DdzYdf5$AOjF6e%*T+k?a~9hmkThZCuA|x^q@*MO3O$$`PrnJ6U24SpvJj@uDwJ zkCx70yVsQY_@qn*wxk90#e_Jy!ezN=i@v*JcLP@lh3oYnc&{pTTC=HKY)Y%x>XQzD zsDjgZimO}z+@~|mvWn|2k~ zI$F`B)JH;F>-ZQbfyv^tM}3~0v}%Fpq}uIFGtFyn0ThEMJ4n6JZG_hyeD+}fv)v(P z_vQ9m`u)flQSclSo0pxTUKqb1n6c<*`xoVl<9tfGMFfD`>LDF64VeeR?_Z@iUP_7H zMCrF$TSb8<1ZP7c^p7(}C5n(i>DsW=STCZCj|}xRkxZr&TplU0W6on-o9*C%2OAV` zPKMIr*@npQgt;RT*cvw4Q4u$M0~0qB<0Nl7vYE~ghbK8;$_|n4;7dJx5O&-yo01{I zn3{g#{^>Hwk@087(j5B}+F{Rr&(>|#8qU8}YlkO?nLco`HqCgzbrDA4mAos0)Z{1I zrT#f7kN9SImZYJ2A(8WB@iK)kw-@uO9{E^c5*pzezh|K6PAgRq^30>cKAJ%R1$l*56sg7f_=O*(At@$0jJwfG1 z;t#F@4N)Z$JiE*nrCB*y;X?jKZ@hsp9bx+fqIvA(2lc8q&9W^jFF-z{9HSzGOxGT! z-X=PunkRLnq+d-yl6t)T_O!7ogC!aFkX{m)=OkhvTB{ur{g6X5I+}|&2&`&gG%bZGHzd2<-r%;S{?uINlyrRPIoQR+BrU!qWw28z#vpp3SU zbYVKsL_=qJr(C%MjNH|hhR%9s6t_#-t?^!IPM6<7N`X%$p(MecWwG zV?1{(2=8>!H>Wz6@E|Vf5McSqLI~Yyq&M~~%tazHRxc*LKt}M9sgycp(ZV^8_oQ9{ zzpJJgGZQmnK+aPmGnW?VAH!b>DiLJQU@!sVEVFL-eE=;OV5%(<7*&5P?5N65@2a`l zqYO3`@zJTO0~0*HZ23rrOm&sbu|n$4Q_cFGVpqIELX|gqZNSu#9B)Fjp8Y1}3B0Fc zrqaQv`KQ+eX+|~{oH~5p8rkt@_ZOj_SO5iaY9hc{CILj1?5MtH%k<2vQV>CF-hg}p z8D0z{YUcr*JQo48$2y_Nm9f!o5gjkDQ-MU&(S6Jj1c7&+g`{s8X+!Z%**}ns?7E7d)>M;T8*DM3Qp4Rz zZC8r6Q>G~tL};U^Li%%WpCB_#_YNR@UY!r;(n9H5=mglD>TjJ<;I-8v>50iX3__$EBt7xNT#U7?96Fw4~!ORe~)S?ejvn6gjrU- zX#o;c{?<0v>NxxdB7APS@=E`UfFY+22S0f1=3nC@va?IUo4@2bf6rx&4} z4{*gL*@`jC(Rx=7kG4jqc?HPdERtO!rjJk zQz~@gBxIe)2%zwed|UAZt3+N#6y~+5X1Doe?R>N~!$J*E_5)yL-SWd>|NRpMUaNRo zDu4|@lqF^S51cldo6LRn?`36(pZF}vV?gS~^h+sZ%^OKdKT*JX#QtV=5_@j^2NK11 z4=Um|LqGH?)q=7|6pU}KaHLLXCKq2}TI`NDZ$GTX9;amt3x-v$)1hjFUlfHtmgQh` z85Cf|^(0S527?S0D`oyrZYK%8?kL?_0mhuXbeD;x94Nx7eBSYSaX5Q1z~Jf}HjKA; z47s-5joDoqj&R3JFI=-H_Eky5~EioBOP{@h}^d8)-J?amLB}WZO+sJ5zNa!UA zNo8)QkNB?yy9NX>mr0G#52k_m&uH?gdJAVIM5e=y&8I1TWuneQ`jczgSYWYn#3E0F z=V8PHlESiB_@vMHPU=m)b|)+iL#HSOwzefIUX0>j&iHn}4%{^TOnh(uQ?DfOK_}v! zK*$E4(#8TZdcJsj)>wn|9ym;7@ybqDd0JAU+r-_9&!Z4wjwyrsIN#^f#dVGb;W$og zLGe|{d=Dx-RusaYQD$+tXk0&|^b~6W!;r9`5dc57*5Jula8{Enb6)vRvm6q?U^=9; zf({B5sQ5h8Pamg~E6^#ASpa12;hZ<&#l0S?CcR#$K<93vVTaBiNLSwhlw-8Q&B)$b%zOjC1N?NKJ)`XBxVrBC4 zZ}NCb#~MMdYQ35H(kl%FSseZ>Z^ThU109VEvCJ*J)s-o&Kf1f`w+&ElWU5* zTsw($>FLx!UV8T7uV-&5a2y%-1Kbqw8YUR1e^)M!c{HzH|FUp z(R}hLAfwQ;{6GF~9sV2*vd#30a|39mFk3Y2+&$P-k4C&A38u0SxWxspHs!VA&;)PI z7Qdd=HEvE}Ob|W|&mqza7N95n(#Rw{FKV@>!wQ|WsUfM9bWQ|{UWC|!@R0No_UcJO zoHiy}QJ89!XKL;6aQsrjg1nCEzGT+HF!1DknnVq~^2Dy0zo4WdbqqM&tlA+v6iP`v zjn112MJ?qoId*iEVv#BOkf#}(AF|K(NBf$hYghsGCFys~79<-i9ys>JmY!+%{d4Yg zCUBD#tK4^JDs~EhI)ipfsWybwbvM8+X04Ajob<{Qcv88A>dL~lS~-ijAd>nPXJcI{i1deSWgz-w9dvCd zSb50iJA#WK_ITp|m_EYZv98<>dn%D|Qa@}4Y$^{y?W3B|#bIgp2>LrmVudANV!IQx zB-`Meqnmdpl)SvWEI({(UEP6^$QeS7^(0RcZtW(MEyS0g5ZHOI-To)lbI)@MvhkoPCq@UuWDT#x#6CTM{@+UW;sB<{|p`mu_@gw4K&8FpH zzys&O3RfJ4-~d_n>Az8=6_+`GWx^!}PkvC!r0}x4xP-9i6YJp?ej~5xc`jCh@N7C>*I?KqsZ|*X57je_u?e+VcEL8v{LaV~f{|B@9PMmY%+^6>&1JOX?h?3{5Hu|* zh$kmK(_H>V#-8l}Qg+=I{oTg)(Y3f;^zED<4s|@AEt(~v=6W--gTo4jraG_5dX);W z7yfuJi^I;DDC_7w^S@EdBuJM?CJ`hH*M4iq2npzkjSYQ~M>6^?z+WMZDQeWo40JIn zA6V2Cq!00YQ*r-~u z3CPGJcq()1@!^BejE&D^V`hkV&GnHy7Xk8BBKVW9F#n63a*G5Q4ucp$gvExP3^!g3 z8ul21ET3_v2V{)onMHIlcc&0I2L4@!1RE0iObaPI9;ht#jwxY6(?Qk|OSOSwK0PfH zVO}UzbXPI4hnQSEbWvV>dnZ;+VHpr~VmABps#qB}1B$bOQL*uB4hst8rVf^@}jK1S499|W>ji?^UJHV8u7Req&CJV-5IaeL-cXc;-^R<4;gB+RD=D&2ot#g^yYt%YWF|6RgX4TCs%Tx{97_3Em#)p1 zC>CG>9rll*_phBC`(C^Tm;%OG;I+mlNLLBPQ`|J}!VwWPqVZyGbyWlj&JbB!%iUyk zm2!ZKj7tzVaWt!j{ot*e}N{c)nP}*)mxlBna408uG&KB!++#l+{^v5>e zCvC>*3PVtkWTGfG`+NmCvD_*Cz1>8v@fXYsp_tWxTY4%KW5dM))k2s8%nArVUmW7^ zMZ(`X>&M3<;vO;0MOhZq=}fg{uKISmTD$Q_jkde@QzR&4J@iAcs~pJKF0X?wnUvZ? zpit_gQWuF}LnILplCWrAV?_)VbjZIoM=7ksKP4=$uN*Rp+yx<44)B;k)F#A1=%Wi_PGA%FEBReerb_Qcx8C9ig^`Mt8W@LM{vpyE*08=1gyFr! zu*%)9eI+k*cJh+R8VntGaU%ELYr-8^AAuHtipq#^rh}*xAZh^6C1B#jqvaB(HlB01 z%WeB};RwMV;uCNo{|8D%>dzkzLLKsA=qX>Z80sjhl6}#6eO{HueF_?f$^_o*fN>)n z7|u!wSeNy{mj_7#XjN%#GRM*Pm8zx4rN^XspjLBnFF@sm68=3mPXfY=Y^D&kG+UnF zBep4S7IflOYB_k;(baviW(KFB3<8C=R&Fx|H@a5me#byA&sM8xL<&wdiqEu-E05%Zr5gT1l*9v8zlne6AC}N+9 z3K7V7@t{qO&sz(HuIqwDPA3HvRL>En?2NjE zbYW6Wz#1+`=iD;&6-d0}lT!8ydD^1SFikwUiTY*(zD|oua$7Jk1`k9PkRSN?5afd` z?+tCJD*CL9m*1v^YP55|9nqlhe>95d))AY*H{B8aAtL_|993zOFcl+O3c zL(6ypF*)bAmY1SyjMS^jCE?rqN@Sj7-c^z&hR*kgc*Rn>%J&KF&JuAM!}`+IKt@H` zF_Xn3vOy>r+mJfVxTlp+&%j7`$h3GUU5y0pi*+&ksXY@js)*z6nF&3vAR~%@L!(}H zaM5xfP>EPJMfJn*6DVMSTp!`S#9~G+hE`Xs z#YTZU{Zs9jmCKBk-jigculpY1y4EDvhTuR!TT5b>dB*H?Tu2v382gHG@7oEn zv4v?q3Zs~K_4)K06YnWJF%)Nk*B3Rgup8X-okbd!)`@ojn*X~^J@Qtzm>!gqR0|g4 zB#XD*#*-#X|8y^@1W^IyNUPbP9MI3B9)e0?lRBfmlIp;Uu6`@>;uA zg!C27k(_@+3y=QV%7lBLr2Zx9KdfAqehsdzW$v}&aV^MOorc-Nkny-S&M&9T$n>kF zAkS%q{ciy%0RReD5D6reDrZxr&;X0s43>hiM*$Gq%ga+`71kX8Yk~EK5s8M}9048u2~8gNP7tcgxI>%@YjdJ)Csd~2 zA`ktcy*fz}VxW*F=P`&v?XCS<7@i5qF$UQe;3uxs1U&OR2gVO;2Lc4+GJOz*Bmo`` zMADpNot=1DZBbH?cHrvBD%%2dF1>ohvqyq9itsJJkzQIOAk;@$Y=wL>%p*dKbG7VD zTfQ=bU1z>Q3KXy|K%*!=u@%o8%Pc^)QA6`;t)P@P=zESA@_`C2VNg;s;$mjCrA$v^ z>rdC!S2(IuaOwgTLR~ZOn838gcs^ux%)Cp>Th(f&9HXBsD^$?%|)P@mzmLO0IYAGtc#sVd+Y(Epf3EvGs z)3CF{5`yyKc?->@-qIo=LiY(YVY&|qk6aCrWmkhsz=U#g4(1SV1Kvid9g&-o7AU^pLV|;l*zeZHuX-|+vqIe+XXSLs%1jWuMUw9>SgTz7EbZhN<3?5@Z zVn=KPCW%8dWS|IIMJ-HLzxQhhM4;vSpojFQ(Zi+?O(VTV?e4pN{W3OaD)a-^r#M~_ z`5RZtoht}Z^0SWAlDDZ^CW-le`>ZR^$VASLXlSI>NmR}f|A%o-@yOSgF*;daY$77U zN9~O@9nj8`IU!Ahh@KV7;)-ZUE=}Mm!$z}cs4)aTRy?R2g20njdq zKPGdiMo{6&Cwquy=D5-mSjs|4R=uQ?KTMz<<{P$ByL)i<99Fl4AuN?H6^_1*EIlbD z%EAL8KXGA69uNrGV9a_axV{oI)*#4Wv5r!@-UO)p{7oR?cez*z>SO?WHV4vzd2CG( z3X<+dP4>pIrbgG-qIv~rAArIMXO^Nb>O+jnZUXT!n3|n#PrQVbMg7jW>v}j05C8OV$=`r6GxX)_Zn?5*zW+;2x#L|Z z&rxywNPLna4((;#gPI!S|T&a(jYb ziGQ$Sx=1rao4&&>snl{DadYaFQ^eA2%_T_Pc>P8z`Jqub+RA;La!99m_`9S_h`KFW{0HC2< zZ--wOzgzMc=p#{mCffjbJmS`U+-AmyA=fKDGBOUz8&Dg3{8x%AB)zKw0v$5$3B`wq zkbXK>Qm@O?avem{y}r<-?J~paK^;I(Z%r8!T-?TU?H98hBHW}k*|^-%mDiOJgz$`$ zbrZl302a;!fhZ=~Z3Ip*89gmGg%v7h=!f*m*_M(*l8~asTkkeJWm~$&5yI3&J&X_Z zGA;($8HgQFoDRT@4=;1J`Ruln43i`+p?te(HGa9_ErApn^jS&(MREb;rUxewE9eTy z^Sbrw?Q4FqX$5VDFFX8E`%IN%CfQl20+VFm?g+e|&$$jnsHW7xFdT-sJ|yz-qP23C zaY(Bs9#Re%NF#j~SIFMM1c+3x^TD`#E?Ofh#Ab8d&7oITy-Rm1X5Lz*5vHdofSjh9 zq(<|#$juqMu;O~A!`%OvP3^15A2I+OKTLu3jYe>U=A z`A*cE-2AX!U}kHY0n>+Gj`n4{NZ=rbJeP9bOssH}z<;c1P@Oji>TroUkzNU8R z#`Ot3Dd@cmW#uP+E`o{b&vqs*Dw(NMvU(Pv7~U$^bS_sZ-cQN`u?oPY&^q^9bOIuF z$s(d2tlNY!{YiBP2TL#l4FR6)<5n9=BApPDL-89;b^etpjw3%7g5b#o>hWptMmK~GDui@X+^_Wc+!Ac4# zUKwq-$oA z?TE(2eu+B@szgf@BA67m<0VNW9V1Ay+A~m5gNWh=G@Jq7uPOqd6*vNSZ!C<5Sr2_Q z-a4lE5_KM4M!mBH6hvoCs-}$GI!y~+Z%bMg-~}vr5TyJGBkKhID%Q6L8{c5IzGD`a zltz87*gRI%QYVK+R~^Dxgd6X%E9^9-7~Gws^Q_{5$)lRs%Lo<_S_?#=Fe3@z;WsmE z+?aXYJ=Ze1P_|`D4ObjC?Et+-KcM;0={ReJaSS2fIYK(94I@~zZ2^=9{1~>3xmX0f z=L30E^wfl!V>$_T7gtlB8{)W_{Z-bIRkN9(7mufTu9K9>zR4m z(Id%o;K%|tQ`+X3GD47qcrjKKRA}Z5CLK=<696%0j8p2;f*(K^t7707Ux zXmPlhJ+6rv>NTO`Xw9$)9g3Bm=ap?5z?f_Puqpk7Dm3meVVJa$RtAqTNFF95Ksa(` zVaG3JN3)wAP${O4f6YMJm@C#ISTuth%+cA{II{7P_AMhtpki*1m)-?w=vbker>eD1 zwwi>w=0XhmDH^XAn=R!w)b5p$(!bEpB(r&C)$5o{%ZB|Q!nt{tik zwg}?%rj=*AI0Zlj?%}@fB$93{L{QTR>+M(%;j5Mdd@sP144z7cUR zmU;%}u_DkQFc+V%E5*^csPyu{S*DUZ*jrr%?vmZ&-Mab=gp#tzHO?I|xE5%sOMunj z2rl{iqr8r^B`j-(ShlC2O<%@<(esf0UEfb_nc!oj1V8*Pbrnble$$OmI{1V$xs-j6^KbO*M^mr^lQ3B0Q&oWXBN+h%*A(QI z*9BhVF}^%;zoz^MBm}dVn^#@h)hyoB2|m;qzB02@Y@ZC661lxLMc77~tPHnH8kHwV ztMYFP-+6Gl>IqgluOMNp#FVpRA%AgzoXn4%BdS z0cs{#1l7U#C#oM<*&5oBCz^t`O?!#D0jDQ0NX%;2Z;Zgcq4XW8Gzsq#M8fmH{4Ltw z5OUS(4p)ahA&PRmXXZ5NKWf7-V-c3;HLlDVt&wJpV$mS$h~o%+xXbTjfb?koiS1& ze;$dF=URv}DDPFDDxClEdQL8{w|F!w(}Dp#q+R$+R6MlL|kkTNIC+Q`1nUYX~YIQcd6;`Y)7xur^!m zaI)UuyA0pzMw?-q30GR3Hvo*v*&M4M($R~$+12XYam8uT#oddh0wo*!ilpH%@$kba z6PhV)OKIP)@qLZW>`usbdW5#SbVG-G6A%+-0bD1z$EaowZE!IZM)vXc|B10({z~Lr zl|0m2d2)-7%&vAFK967I}6<+yi@sR6Ty4 ze99$wk|5DU<3YvK{mT5mW=Cqtv*1!WIRUmy3<|IKe_-a-EUNs#*BY6NO` zjSo*5|D+;OhAGlaVgNVQ4;;WNJ>?N&OD5)3M_2F-g>VTI1}QHsaatQDz4`X=s&MA% z`ZVo&;tPq3fj7{CA(WR?(O!tIfOpAVFh8v-xC!8jVvwU8egQM68bjRDTRTRk)d0}| zo<<~m_5Q@^Ve}ut;g{u;B9RxkXgyY$Mcm!bW-Ahc#WngHurr9aH3=t&0RyB2DkGM~ zhfmti*%#3bo>}2eB*3qx+5)#PpzSxGMdO~IJ4-CjcA(1AR z0GIi2jt7{pZuWbsM2|{`S}ethUt74!L(VeIKaXbxC23YXfZ$xLYZ zwk`q$%!cGNuyU&E2N}q=k!+eViMHD3nZO_5q}sAhXyca4Yj&LBm(uEDBsNXPs-dSR zcoR8ycAy$86M^>WdUlUp855(j~vV_XfJujIX@tf4J!m*7%zs_c!4BYDN6xd7+lvVy>RKG3_RteBR>FJ zhX07TJzRws#id3bnioZMSJMe)A0oZ}Cz!@8yn_gplol@3Wbp}ra4I*w0W}sg(?p}o zHF{|o)GWPr)!s-Cpj9~c2i&J z6q9KnX0d=fB}DUJ^ogk?WyIQZb zGV<0|q)e+vhLOx;$VAtz!LV3(?4B`-_~CtWcl@hk;ePQl@!pPv>`(-q3e%aoY6=8} zh@#uR)IB_7PsxBz=fSC({c`orl8>l)g=8KJO2p0=^IkM*7SX5}p#V%JgvPZ>KEPKd zum=j=Pq$*k1`vq>jk1jv4bLO^>!xM&Z6q^_8jqe0`l&f4fve{3V5Ux_@dUi99<#87 zok;MCWZCMoW^_UXUT|8&@nf$Rk3x7XL!$g9c?$w4Q!v#rZNm|+*~?*LPs4?@9y9rZ^T!na1jxRMq~2 zYUrcH=@mr*N!ZkYsFWS{bR8n;Do}yKaV(Wf4V-$5 z%}8_2giBQwHP@&53kgT8<+#bLc>w=|UE<6>4bFvM1%Az5`JoIJfr0KQ!#o*{ih zPls*A2;;&mc-5S4hb z!UNOJg<9Pk5wmB1qXe3q#sJiSocWR4kW>TGMtP%A2w{D20NIQ30`Xa{f2;$* zQHwSn`pV}I3DTig8RBbh9DXFeXnr)-k$S>}YDe@=v8W+^7$_$y(kMi+lhCHZ@9OKm zd`-lviUDM*jbE`dhEexbdU-%Nmn#i9bz#RPH% zEQN#W)8O^~FxX0Pp{rAWQkZE=wNK}H$(#tQLcy9O22`*J|A~joNpAKyWvm}9L8zqD zt+;z~ZTaLidh>n%Y%3IFM*NYe3lY(9l-Z5dgs9rxlYdPwr?9MjeKWO@v*hTg*lEx7 zJmIUpVt~-)!hTaSE`&7l@9PbKI9uy4{vg$ZT7586MkPdpAy$%SAq@eQQQK%k;&H{L zf>O^MbLR3g%zzCu#^AUkh*b8K19A7hrK<`08Oofzh&`{1BZG%f6eFM$ete_s0^FhO zqYt{()k;f+i^}dl^HpkhgnRbENC=AH5NRQGt~W)!x?d3?JShO~0xY7VXZac5&>s%m z9AOb#Mw)?y9gYPR4*Zk;85alaMZQ>b+D;bNqR57igUknoKIniDPp>R8?}n?K8LWw2 zDxn9vuhtYgMAqX!dcy32!ls@l^MJqGDKjrz!o-qYcJSu5-hH%3*})ZyoGes_R}U50 z>ab?WE$RZv_|8iykrbaJ=`V<_bsPw}KBB+$=Gt|tMAURSHzfM3zQF%l)E9y>)n6N| z=oC+}BJ1Upc5OZjRp6rh^r-@-l`+_a5AvTX_QZPj%I*pOGj1Pk9R|exn*#(7R-doJ zieYPm2ne=5u5Ou;yUBk}CVabqom^W3V>B9@0xt%NC(q9!s1;tV?9r}v3t&EMB15F<@sG_|*r zmJqb=DXEcvf=NC~4}uSP(vQCp2~3E%I-@O}u&t60yQ;?Mt{irX zq^JJVcu|>hML_NDR)_?T4JN-;+FcJ+C9}AIFU9K!AFgn*d7&Mp?gqSN_bC3BCq|8Q zr>m{ubY9I?TT$pPYfk;L>>BJ%33gi3sIi9$UnqSKc(Ro4D1$#nImXOTWs#pmTEQS5E~dJ%)f7yw|0F~d<$|PVtVVT zU=j>&^dI;Qz;j+pBL+0RDnq2;9H<~vU1O`&jSf+6_^prZl#r)l_^`u4ZZDh%lsZ1k*5L7by|aQ|$8ck7 zUz^5H)ZEggx1)1pEcWqE>?`awOo=7Kji|Ox&nV5GbgZ-unKt?GOIEZNYem?dp0!1A z?z-h=#~)cnQoCnlk$W)ia(w5D^)Xn|CaRmwCEVYDdUzMF zNq(F!?5{|QqsL9*ak-Ka)EjqERd2fb{J3~<&9Rj{eZMbzcG%hiR1#0@YZ4QOosSp& zju=05aiY8+1pWK1BYYg=OH`)DDw-;9PiD~J>FH9fTTu|XK*8`8?hk?A8LEq)y+T}# zU6af*p|LEwe_D5w^A6?MvisQOe1l=z=gLn~3FIl38)DlROwz4a+ zm3jXSS{@T+U1gp;%j-e@NC(B_J99X!y3a|n!1VtSB5ztJLFc3~>bj78u0YK{{3ph& zDktHslX}pYNlY*l&n%-Bsjz`E#5EMIVsgv&OclavX*dto@8&hVltxW(pGKPc6`?e; zXbAllRbgTqzmTRr9*Hq`IPita^ImW8Xd_2*ppH^Co90^;KmIvBedu@c2YmEG*x4pX8&o; zc>tS0W{!R6J6Cypd04W^!4b^`|Ef;j88z*Q{y*}3tvW>=zZXt2_584cFVUjyw<$@i zS?Y*f#NhKXNE<Df$SmBkm72_J=aY~tyV9;EVccHQg z5Q`9sYU_HXX=AG_Y1UpZv3x~@*^+J$=lCI6O#pwuPpfO^aANy1iPHjF!Xo?(gOcO{aKvpJhOneM_vu80iMttS++n!7SbOW0fswR0*J*1 zl=t^*jZo0Tb!VT*d)AYaXch6~u8xK&VEv2ul~_1+B!g{jXCqehVv*$YIUDPO&N$V3xbP5 zijGd~GTx!+tQgqFU@r}c9I^-c)W&UD+tzZWY=a_bMo5H_@gc{kmwO>l__6#i7@KjT zdTXnU@B@0>Zk6O&sh@z9O}%1NA4KE%ANl6N3v`zjll2HblkNl#gTWV?QLDIt4e@a$ zFT~nne@}jqB09Crz0%Vn!?;9%3BVljh|Eg6UwtP*9h^{FfHjOk&5HUF`WKHc{+AdV zlz=8yqIkX%j$c}+-i)mKPVVKy3;s z*%bUb(<-t}1fvqMqsEC zo;@G3S+&|D{W!%tpo>6YAzU9@QtrTIhy+=;Z^W{E%EEgZS5hDd0o;zt(&uB(1{P}Z zIeMg3k-=3dDCMD5{=~0Ze53YZ1ns&B-nJ*+#eS~i8*Z-#1)L7%Y`{81M=O1@6m5CF zv(`35f&}XJJup@1HnPw7l&yDA(3WT6_d*Z#*d{5Fiwd@^8%yTGAG9xEDhG@haqmW^E(HNNPB5aTlQ z_i;2sa3o%uJaFKfbRbS2F$>63a;8m>a?wfXqH|}FZ}oThG27K&@`&(DYSwlOiqaN@tn zJ+SeBPrcb1>#x;%1J?*GoK&0g2l4yCs|t_8W*r^xku65~su8VQ-K_8VC)`JqAK&kP z?Uk)z|CDJr5FiHRDSc~%T%qB;KcvNe4E_}U4OUbF<@efkm8ZGq;iu?_0fj7(9yHvCsTzSkkP@*8~+454DB+R(% zYyr$otDlYyOG!_8`xr(-O@Dev#lNQn!mv*!(Vm6#C%>GU)BG_b(i{CXd<=B}Y!h*g zh)zI0H53xqb2(5%YOkd)t^HTRp9kkcLUlQi#?+#|@=l-JW?WxWvqp6>qFp)DBCloe z49k3#y_t)RY{KeouP01UJgYlX*}gWyo{|__o3?X=6qc zlVu<)NClX#2FnhG;HoEoLc1l`{a-bk27m3dL?Fsu-2GZwuS-|-FU18%3kN=H z{iqpzJ?>O7|DtV^j)EMVMO_f`Bbg*p%0b}*;OB__6g6lMZ0<3G5SrSzPG;26Ey@qW z-NaQz<%hJek&dQHT2Pa=(rhl{S{ZbJOo!FP*+8=Nj6V@-{8DJ(rt_;MM>B^JmVeUR z_Wy=$5FiS~JByXeiFW4|`%7l&r~?l(9uhPknkkj+0U9*$W1zP#)PzXhB})vNO&LKSwE!8he0_1;wN#0LrwV4|~raP*B^-oLZb{Ab*K?^t4b$n4*F zt>xdkfLa96(Rtup-(yL zF88#Cf7qyn3 z4YQ$MWF5cnx_-39{>FF}O8*l9h%tp2r+8mMDX=WcALRQ;kRsU#w(mchpRhp$8Jv6^ z60xDNx|u|&LHzi9#9HKgon!h$&u%AdWqSww>h6I&0=@jkB!o40Z;_q@QfwbJ>lDFg zpVR52Zr8K+0B@AKQX21y15dWw$kSsH+3#L2iq3x1?eeuJbqJ8>6R^2?alT~oNVU02 z$Y25*Cn1hYNa^^D=&@>OI2Ww?U0At;VyvYi8ECaZAR@^w@(7VrSR$fBU=1zDos26I zRurr*^FzzCQ{0vi%u4L^lO8i~x{0cEKpa#NDZTI0huYq511_g*A=h_5vgJ`$OQ^7|c z$`Q35e!4C7v4If|=D#_<6)He9#fnH{{*OwoK@jmCQQbr`1WeZUKnhDRKmt4-z6XDi z`WFUs9ye|nW=q^l=080-I!{inaXJW?&}6Pkem$c|S?CxP`7t>Vi-N@MsTgjaO;(QR z_xunq+-*~R6`~jo=9#)Ch;M+GN0Z>0cc77nVas%C>ZN1T@%}TF>p$hW2q#yp3&0OE zTFSqmK)Gu==BzvM7YTRHIE5G9kU$^DC+sAjf~$zC%ZSW-1qEH<-!lqq@=#<~M26>X z6kRW98g|7%A95o}rI77}&Tqs5A~5!l{5c>rDMK1|He}`M8Bqriv*UUp%~?>O-990_ zCo4(Y2ML_DzcGjR1Abbz7QxYpuBNa0rbj@nT&G1ANfeULecSIqHw?Ty$J>bsJZPHW z)Fn%}w=b7Q^AWOzn3Ibn$;*y*(eoFTiIyh*eFA~s zP-`~)-f{JZ>TM}Okr^2rlv5|z#2M=2)iMGHKUb?^Y`yh~Bsj1{WZhV2OSmT@Gb^_S z9E~I=KsG{r>Bj}3Cr?a4vuTELs>Z|Gm*HLF=axZ9v@i8z5K)d=J*mYsLey{ZQsV}3 zeFK%Om?3EDr;R^YY4fd|BpNjZkPLE`J61jnH_$q!KsGiP*-?i)61#1l`%iK^m>F&? zr~~2~86}c-|K%^5qNM&xTQ7th`mr`e544LSHB1(t88a=E{dgDMHayTr7fCCCc_CqS z#t)JKHg~>m4`#!4+iq5yGr8<$vwm{ zBNnkIHgKXE-pMC*u&6cbdrod4{DW{u}^0{af9zHDVn z5EfIQ9+BRfbMP;$r>jzQu*^%@I`1Uw67*bB-}u6(kQ{EfMlMW>)T$f?Gc-*kBL<zs7RLz`V=VZI0X$CIw($${Nha;_FD8VonzzD&NnaUljLM;uKR~FJ)n8ad9xFf z?+DLG*|Hj_xcZIF?R<}=iq^^I;Ksm>cPH!p7;ueQbkuwy4RqkUdAOZ2(or!0#d@k?YXU zSNipi6sWN;#M4-B0&;*}5dXtj`#o<~Bt8 zfHU!w#6S5Z3}-D`;waA5sGmzl(opyxpd#ot@Hb%9fmHT>fBwKzzeSik_tMs3peIt( z&}xEww8si&S^lO*;+IZ$QjcWOq+Qg`B7a9xwPj0iH8ZI}ab^35g98eIhB@ZDFw`|( zbdAzFTdO%M`zrk?nxm)*+P)u~`4@BBJu^vw(G|2)p@W)#vs24vYhH+zZ4fZ3OJUf3 z>s&=kNh@TAhftKk=+-vg6*|_`O9$$#u|h&^N^&{_F-4%83{j3}?3V#^N7#Eu$o1F3 zYQ`&B&L+WP<+qKE@7#X_-Rwq&*^m z-*ws!(p#%%%H9Ykoct$JGx%?$0s0RUh+N~@=dbX@0IDockg>B9f%beKWX(b)!e8Wo z+9Siz1d^DoCh7;pdzllcN#=&7b`RWQ#FR?qB zN=&kO_#~i&HRV4|brIL=-^sf|=vUq>r#C?Oel3xi(M2Si+dUvQ9dW~_rz*q{yHdqU zUfis){|KctaX53RKzd5Yr&Rl#R3+D#Ndx~IbX!VB+=ZdKK_U^b{bCRFPPc!a*~pMm zMq4!8388*P%0hJBt0PN;4vd$>l_)a2^=f@(c;ofd&uY`xDZ`qMuL2 zb)(Yet_&w+fZpFZ{$@-TWg(!h~=~K)IOkbuxYTxqK5ST zdi*3!!A)|Z(!m7IamVL6IYs13dZk|*62~O)Bc`+bmxGu1LuIltep*TF%+hrDbK0`Hli&9GRC_Ku-UTW zR+fVED@$GCaLLU!sCAUbwEvt{pzD+BDyfIe%DGKqvq+sY7dE6*a%CL>%y!xTxmI@^ zDEwaHIW4CP`_Hu0E|GzwiwM2sa|2`13HN^SBQBycP-o>gWXHhE1Vuez5Z_ zl4a52qOjZ8=VrZZ10P^nNNpH%JI??S1WO&W6&h%9x<$7OnomV2w7zk&<5aeV^y_?7 zy*) z^*wL;?B(3q1qrtoBURuK(m$@_EH%nq?T@5J$QH75d3YWiF5AZ4 zm*n!$4NMCP2U6dQS%EvKA1^*tSMREu#vpEf%S2JLMUtQAnlO!>~#Q z>AKMH%ePkXD@e|0JaiM>qka*@K*YP$Os)2$O8lyL!w?p_$YHMEk5@Dlt>h&{y+pzz znIkXNYic8-x07v2>xYsvRh+4A?ka=Zqb)%!DU?l`QkEj#TyF>-IUs6YJjk0AGZTBOVJ!?sLz(zBUMXF?RD4KyY0)7xWGcoAp5 zdHSS~NDGoyQu{mc91|aN&xdNe4nPlw3Y_ETqQfa1Y4-;4i-qdGoXmc7URm2FN5P zxH>?_Jxj@5J`9sKXR)t7r;{@!8KLYBiOT-

    $C6urp;yF_#8K8DfwSXRW^zNncT6?VoIsLD={E=yRexw( z=y2kaT?ohJ$+^X0a{&>MH`C%}MuNQ|2V`AtL=mOteVme7&uFm|4UY;K_8h>o#kSIk zYBXXb!En^)o{BrN)EQ{9)yBA2ZMwhCUP!;|nV1w7(7yS-lkU!KA^>AlMqWy4M+&}5 ze)PR8LbqD;kNdcqcm}64>V>Ag;>q<#V4OdvD7f zl9%Y@pjyZ|Q&Axssa7D$w%b@BR|^FFdI6|X5uup?S6#{ACDuIcc2$U4oRbW@3s zgv1T48Zc;)qD`GTNIyw^dLjjP(1p&ISHS&`0OZUU56S`QUIZuDDfrE4t%`7W@2n#4 z|5AzO$6KzTinxR%IQJkw8HlY zLkZ~n+Zl8^YD5|6g?DJ)DpEHAGZIx1d0_l2A5x=MXxe5X*CH)P>i(f4Om-MVd|Z!4 z>rn|&iS-|?$PMP5N6gUWD0WGBfh(X8%>WJKLkg?ST}Agngec&0{}}ah)B$#Dk9t7l zbV@Hvyx*CxYy{YA^c)(i{sMoWtZpkMyW*092v$r3D+#2!#8OY1Zertw;rO-i*5xwP zO3|r6GQSwkCb!mrmKw3V(}eG^T>G@yRH4DhO4{W3r+Ro=SlDvfyzhAGiE;Q!9Y3pw*M z*;t}SOcL(HE$RYA($s9q`P3|mp1Q!L5DOypYWa4`4#0)!9n&-V2?Fd z){ZyPp%pRUxga>sJZqMNzJ^yYXbG@Hwy=Y@WB}~~s=uM2%y0w@u^b~3c%;}!nnc>t zQwp?U4R+rc5e*R%b}{T

    zDj--r!K{xMe8L-@EZ3w>SfEwJ_2R3AH+n%uj0&pxlBq44C4(KvtkbG`+!XtD|t4QJ_kA<=~P&tp*4%Q0MKh;D^ccgBm2K!e5vLPP@tLiicah$ zz%gTu;I|FO#EfE(u*q>rbB+bNGn*RAjk|xIGm*saF>3 zy~Y{x_EL)Yi_m$G9|pvb3BD^Z$Wxoc)yJbXCuJ2oI>|qg-WpXi+{;)PsxKv{wAtLs zt?|JWCos+&{R)k7e>5-|B>x-=weY#|HBwCg$&LuO-p$}gq&d=`FkIuM+Wzgfa-^Zz z^pBJ0K`%Pa%gJ&ECpbQ7Z1oOca@qOigZU3Ms^Y%+uM2#r^tLqgnyW+8F8*8Sb;o4| zkXS%L4jqA*UbUJ#>IPEF&}5NruU<HE1ZB&@) zPcsbi22FeMmp8At7#);UqnPM$#}ppg0~)+}R9SIO<=HSKj!=kT175zji(8u)$B0eB z1jQ0u2P~ULb`dko7hj{tsnCE!&H@L?8xz``wclf6^jSr0<7-N%OV{x=U5 z7Mm)4`o2gh3YbGQ46ge0xO!Nwr=Qlez288qIiH8Wa_=1$2p1KQoM9Al;zQVxsEKI< zPeT)alT~9!>8leppXo9XL*Tmo^+Zh??Dh?ndMnkFE6~TdFUSJV5P3%8?oNU_;Tzmc z#AhHBEZY-mqs0kz#DU@_>=M;YxXoByy1)4W=Y{+K|M-DOhlL5#QKSt(rzk||t!f1U zwh3C$3XoZH%KjtYq@appq9qy;&<^OB%zhSviCH$caOVwSJK=nKh91WO57Emg2VN* zr|7Q#_*W?kQQ_6Jn;WwR31-O|(3)d6rp=h8{@Ddv>+gCx!c!tE9HN8^s=GyTFY$OZ z^4q?M=Kbl_WD~mU$aF@b<>&WRmmND6-dLG~pFH4P=j1;!H<7NUpIrk)#vf~oW$F0^ zmQ3$hFvw7h@Jg5{=4k3ZUr7QK12PMD)r9epWO3#-n*{871S_6~t|@AgzT;A$0+o}A zsp_A62ew?ZZ$NTL5_}&c%p&ZA=D+_^T6~Kus=*ox!MsOtBOzUUmYfl*pJ~l>kQw7X#$0yOP{{c@EMl zcfnD%18Qmxa7mB=DlH)jq%RxZ0-H)>Gwzg*qp5-i46oA|3!F}rZjCeb06n|F9gP=D z@w`(|*#p(Z1e^uqD@So>pcNJHViTqnUg8VlDU^3M`SYZLI*>rH!pvS%;cfdjgjt}T z&G;Y?vTA^|qA;OK;wH#a+$e$pqsV12>cW}D4cV6fP~mZqpIsI2M0RzI?uQ8&)oii!`Wdk|;>QPPSKs1DfdTeW=e029=Qp zhEPm+DVhf+0lPQmErjg8K30qumAO1Xm%j4Z{5mJy1&j1#dG`Laf6iJpvk;)04tpsz zVX97b4Ad{3KI_dxzca+V>XG#Z7y=dX{gPoUD zmE!>3c&R6cibF@6X~-=25ADzpE{~M6Z>$Jf4CjMib6{_8M_8&eY}`KRQRtX z5Y?j2kMNF0%7A#mKa=kT>k{&2N`Y9N%>G6CCq%!;cmv`Cg#UsNnW7lwpZvk`b_esn zt1Fyz`M+zl4n`A;9QYKuF%bno53pE`q>K^~&!s(ZAVGyO6OhNygzaDCPFM_D=UZND zP6voT0@`v}eXoA4wZf2*dptv6!2l-!zxrhzi)T0FW%CR{4O@<~CNtwjLz|`*!&a0G zI=cpFD|v!wYj~9A0_I|);;LP3?=I`G;k*9m~YhIjC?U$rw&ic*SULWh#4# z)R~qSK@UJY;K3br>z~Co$@oTUWnZlRMu=@(5QcYzijp~^2>|WiBtLhK-Wmf=@?DGB zGjc2W%6U4e)_l}*m?VuqCPDlg+EE;e>0JH9#Q1$72Bi`xgCTPghTNe+$%#`Tc3lW< zKfsRJ1gDpLz4WsE9M}aau07=cp?8b7{oxV+U~J6DKE~{-E%+D}s4QSZ)#iffw4?Ew z6w;2$^8rdTEyT$=lSQJUhntMVB^1Q%|D~_JRl?E_hcIG*%sHV1n$fPO|783Kx}KuJOi+KusH`1 zh3B{96OtQw3j(>Z11?nYD?q}bX35n(>&6SOaa9M@bQd;X94DRZ$glEpdxH<#>_yN4 z99M%#oT9))z*Rps5p8R}zOpuuursE>;OYZX3dLP@F|3`g$v!iA1&0=bAfj3w%-F}1mJf_ zdu2b_N2$bkTcYLzqJV*6XyHf({}feLEE?!xHoe%e;7XPziyKNZnm8??jDqC>P~W-SAbWj*g`ZQHJRR5`&AR7XVM?6!NtzdKr9itTFQcy9i^hP`_z5{4 zy#{)VE?)mOYYQ6e9LEJ8XaH4!Tc~H{j7|4kz7?p22~@n5dtZFO>5E(#Y59{jMdBNv zCn$}C_n!c<<&5GL3BgEUq?m;eDL$udCG*_0wDHLrvcvkS7vNm3U^EQ=z1neZ7Cd-P zXU?I%7N1JFZ`RoD@&R8WU2t_J>ehxA8+;es>V}fT47ylR`X*;u+5j~Qc=BQcV2#9~ z%EiMj2h<{{(6yi4lDI}SVgvb?AKREnw=nVI&?JWF<9haKO;cZ0gSvQNx(Mz#1->Z? zh;2TFxh&hYyAq5ej%m>IEFqK(r~*;5V&PZG?M}qU`MRJI-!AaS2jtlwX9NILB2bTu zmFp3%N6`F5;z94?;uG_Q?(tPx7fazqD^WfWL!BLAU+yxivirn@I@Xr*M4 zj09eSzF^!j_cXI~;ub5y(@0tKP(aLP%f%1OfTG&uzf$O+6lsPJzwkqe^hd1g9v-JK zO597&o*dTP^W-+rq~e$UB;a@5Ez~WTJ{@wMTUi*U5t{B9y5a1-DPvPD3eXX z@HXx!?#ob&K0F}6cM9kP0-|V2-(-CiBpDB~nLbbBjm`FzM-U$ggc_fCpX@m7Ri`?J zbVYD(>_z2MDg%llSFt}B(bPc0N@nWQy!fZCrd9+!t%s?B6#UXO?QgafM1wT@Yy&T_ zo5&jTg;Tu|+)(L32x*z#35><6mbfLPUXy>59dYqfQ!@pLsmtVg)WUc1>%5Kc7q?4Y zd1FbN|952jk+wrK9hPDX^1WgN2}$ZYqXSCpbDt_GPTQD?M6(fNnPwnEv_>{zY?YTav*H^nGp&`s2?v|1 zG%DxE{SzCatXHXC-lXq+ZKx8^80Cw#%d98cTCH^#uZad42+uwmWTM+S+@^@%-BzwR z;IPv&a&s^n#Dnz2yA3z5fXKMh`!7_F?W<_B5ZI{bStM$Z04>P80(&}WltAruPDm2^ zP-9*Z!?gYh;zCYwIx^e=OSlbYGdch&`kNeu!;pWI+Fj@5u%J;R+!$1&Q6d3r%^cWp z8bW-VJ!`!Nl#%h>7V9r?*jjWOl3}=PXbZKIpad0-x>4h8Flu5oln})oA#^oiKQx%b z6M5He*EWH3{+8Z)wv)EHkH5m&4Fj`P95fIhw>lkY{#&&@{NL5R0-tRXSOMP?Qt*_r$4 z4<*dN9)uFJ3>4MucV_B0EH(NcOVQEvJ$dA4mfnZA_4)%pB8Qbb*_)YNNSgQe2iYPS{`J&mNJsCNrn9SZk$!;`Bf=n3vJdm-% zm}6v9xhos&#a_dm%d?W( zD<3MRS_-O+hf`8T)4$dyUHFN&#bN)HuCMem!R(~yv;Ou=R;Pp<#^2h~jM-Dgm-l!^ z#TYK0!Dl!C$rL=RdG>D(o)ZP*n1G<7ndgE{;}DP{t(lkRuUH~RFUGi zF2t?5%=yDh8qz!JH%YgM*tP|W6<>%2hI$Ez5{kEnaVxS^LH*9;BKTDg7RRE0W@<1# zX4q1(Rv&lE(P=FX>Ljz4qW&PgK(8kzI#{uHl;-fJJ1XCEK}?sb$v#A{)CO+VY)v_`bjVH7e=!_2Vp#{x-% z`DFXoOR^B=u4>+8&}(eee(`woWm$ZkUZKoBdw6PYGLK@2EIdsxnVedT@mZVnS%iEV zn-oTsCn7-JM%mQ+s?An%DiaD3gj%;vY=_O2)5bZ>7U3nakcd7r2ca$vO=AE@)#D;-BD0}{!)if zbmgiW5zra_SUVq-qj#y>gME?$DZ|8sUPZX3t${5=}=OA zrY4IYjX{S+BADceo^6<*xPhcGF8cjLKl=7phW4^Pu)YAgOZmxq$9P9}{e+qzQXkES zt$lswRBe_&5drIZih31Z@V3us7->bj|K4lC6a_QJ;Y}zOEC(FSh=gKO9RKh+KM?H` zsSv}y<0jxJD}Jlfd_;Dnj^|f)h?*nJZSC9$p->DV(;@Yf9{vT%gOP-q!3oWh3!6?fPdjwuoFxCq zZ9IArJwFV_O;*mj(tL4&Y)_yb{@i#foA6@Ik0B)n*Q?Whsukc8=S)scBtDNzQO7hc z)OL#FjVJ_;G2_(!KE~pe%2r{4T}a{JC!GrovyPm^0?cII`zT0W-jb=q_UYfP^;yr! znuQFkux@~)?arXF`4QBxL~GoR5igAY?GwXc?1pg*B#R$?N8_)EdPrkw(&CUrg!>FE z%u6JhFd)=3ER95L{;QeCF1B_QOI+}j2!AYA7wiNL&$Vh%do`}yMPSY_o)vamC|`c8NI^-P;j>pqNGrx=p`ghgMs6Xlz%uB zWkPsiUPA91-)ZYZq&0#&8Ep&5T+_0i+;1BVxqY?N;xPu5sseFUMP!u%z95!-F1k2A z_by=8Hj%;D(yMh0P{{lmpRTaMOv-{Lty`ympM6&{5QL*jyI_z)4*#-!3VV-UM+Q4s z7EMYx>ibra&t`gwIt1vTF!2B%!~z5|fmn+g#bBB)2hI%F3VOVD0)8G^kyYXrV}pcc zx!&Ca%Ba@5H##N1+R(`C8k{?4@2wr4+eHd7Cgv5(>QhCsW4Dq(;^N_l8$XAjJBFoO?1oQS2hNK94rK%8W z>lb{K5c4J;+#0F#R5RZV?y~KkrT8u`xWg6~`v^}q1&Zo>h zxLyipDP9Rgih%{F>_CK11}lr2a}AYZ-eSw1gNvge2&o zDb?O(r3p6*P&sZ~zP3bw>6Dgq zY^dulX8#x|tZZe{vaRWyr!!RIA&>Tju*JU${)Z&1q(sV_QyS)yk)Y;U`tR7uZAoYV zTM;S*Qhv^9XS(s6tkjV*RPwk~PXVie@SRmc6KP>GP+EFkSxVbQ%4g4eFp$$wVSw4D zxj)wZ3P*6ThlB9GP|+brkRItM=JMlG84^*?92BAHsSI0#!2gg3dwRHiJ%7fS&AIW^K=kcNJ}CpJ()C{fMtZ zo-S6GU+&-+jW|FnfAIu*tG~3%5KEZdkfEO*q}u)9ictR+b1`nwLI7M06EL5pe99{< zJmC6Ae1V6V-IR7(MUphrsK?2hYIhX5`?+N@7FE<4t1eI`37KtF7GsP}>x&o8e3OlH z%1T=Hms*bg_e2oaH5yPT#F{NE&`wq=gZ;}?r3=?am{I5xvM4>^GH=3%bl_Z-)2#I- zC%qI5#%BjT%D@^fjKp;>sQBW4*S~;smHGoiaL*xI#;UubQ?ANC7jRp=e;LZ;F`JRkg-6#+g2dCPaAEmC~ z*5wrc>}w}eS}g9r`@~>co;ZG*GkpJfKKtV{2_CHfFnAn7B~9)gGx>CG>Ew2UhfW%1BJyvOfe(jL>Xjq zYwRNldf;?kyh|Ksyo1LEQSlvst4HZ$-CvEV6kj>b%L)bnB8msS4m@q^mA=DQXmJu9 z{NZ%|x!S_Fm9~GJtIO10vm51%(N3qy8W(Vfs0ln=* z4#SMv2?%uP&A(gr_~91aUf{zh6b}!j{>wR3vuZCyv}wj-x+v!+JRWprYIeeZ13FJr zgg@m$F`fTleW4mL8fjuvN<+m*6b!%rVKfkoK*h~>0t*yA9xdl%ZuKIlLLRoF3`E1P z4llCm$AHu{8kOXrT1u~H7(Ehd1rQZ>2}h5V<|DK)6h#%0k@+MnDsh%+xoq7+S@e1F z1;B$pDOs!5thqi6GL_b1E9A{VD#>>R=0*5O8ZL>;M9~(!CSC$R?PNXw6#hI|lZ%J> zQ(PjqVH&RAiI{piXJ5G)9m5sVsQNccrk72iwk8dE{jm5-JLnIpw)bpHVAEih0dRq> z(5FUU-D0l&ZS1Bd$-Y4HrVp(}6cqglqX;AmL$CCD@SOB#5QJj3ZQV{0<<;l!e1U_Y zEP@T`F=`uqkL2bOXNbOnKeX*zP`I+~E|tLrwT z$FJ}JgftX;)s1+L#B&+~rOc{m( z;_JWS=9LyzGph(kD@fL-%>8xNakN63edXT-=hijw|I%EnZ=j8h!2@l@b*ak zPalEXoN^lQ_|y&fOSD-Su!&ugyU_QHf-E7iLTsBlP7f`qzbH)|?T9Nt-?*`H*X+C{ zuWhlJ?TkM)gRJeV6iani!J_rm=0s~mHUuZ_LxowvsKY>nw+X*IM86g>`Kxm+&GV%l z^RB`|q-DdCu{ape9o6Cb84@3zreKFv6I+1>!hikDo39@I&pIpU@Q|MOnRKmfk^V?I=~&Hq#R(Sqn>0Dy=?L}Va`Ba50_Fu* z%;{PjEKb3DfJ93K=t|lzUGOD+)|@EV3>b;{HGE@IX-wixcD`PieOb;R6=>{P{uLCz zafhT;lx}7_dzijQ@-E;6yhU8A!*K`)84KV_GCi@qJ-)!zOb!C~yvCODKXQ(mNOuzl zYtPD8lys1o{}$JVhrbGAHTdKFzpIuQ&E<6Kfd+*rN+foEU!$S?0H&t^nnYR^qq?}x zmCXyXs$;pM>$~jzcSz_1+Ej9ZR9PDyYH?c$B^S~dYU>SB1=RzHl5XdiVFWD^(DAmE z--;t*;0ed3cXVFwRQPyD0LW^#loE{xAw4Bd^*$1Ry!a-A#A;WuB|m0=xB@92YFz#I zDAwn{z!PYkUzZLJj?qTLRzT-8HnT;ta{@S+7AvL*cLw`3mQW&*W9W zp@N;~cc=`EL=x-hjwTOmUAgn;%prGa#p;!G2rh_9YV z3VBEl01uzJKDNSZIX;T)>}Zk~e^tB#{ueaAFA>9lR3}zk;;C5+h{~r2Q1R7Qq_;4SI999HvyW?yBoQ$fWY$T7MGs-yXE= zNhHY#W64ewUa%E`XYk3|!yw3$jlPF>Riz>~-a#L*6C{34F-@OnU~lNxqMXT#cvJ{? zi@R@I_mat4FN(9nR$M{D{gI->4$-Q#kc$+wz_pnq)8z3i@4k7Zj((;^V1lcw3LxH? z*qq;8;TrJt3W(Di!hOLTIvr(q{pmAq!+83w(wbu%$=dpdCx*y*!~|*m0Ho6~1ZhAJ z7G$K4d@LR+jNv561AYYGL<$LhssHdmX=yMBQAyZspjJV-t(RNp^;gXGi8lI`#L}Ls zD1QNBr2}&BaZ@d1daeVclODp!tvP8D6g>k(BeWR}hoh~r(b*h`@e=ep8ArJUIxt+n zHr%#I{16`*FNE^y`1BH7M8UuU@T+|ijVaTXbU$B*(g`hmD00ZJq7o`6)%EmFiU^9Z zy&e7YKsee9tf8Wrc;^<`3gbX(=pc?~6#UA)n>D;F>HqabW%L;F z5q2nf>~Rl{JZkuCAvtSfJ8MER{5;Ni3BO}t97skIIQcQ-TVbC?ASOhz>;uA`-i~8H z5A5l8YIKiNm>&o&xiHipG0I{lG?Md zzgL(bJb%8(b^Dex|3%5$<^M<9n>4qvW@(y##m&m><_$9e!AYXjJI6p0BtRfAkdk&z z5F#Oh00ILg^55mEtQNiMs!i|0Vv&|@R;%pZviX zhb9*y{jd&Kr}us0D3L}Y^Cbz|lY(j~cQ~Re6A|^aQ)#3pcFUSp3!bdJ2y2z+BB6@u z3~VE+OzvT=f@zp{t3rJ5-m+acef zinSMa!fseObW~z!+Z%mK823<-IQRPK3<8kZQ>_PH*5FZM+ zz(?;PUg$<3XdZ|6VP+fDXEO@~u3rQ&yRQjt*f zW^GX<=(~H6jfFW&4xC!z6Z|78pyJ9t1};yf$qmcH7-lsO^XTii>Ta4EqE!ob0ap&>0sJrN%X!T{GM3YGK<*vId%3(pN??98g}T@mk8wM_?%@Gv6FHTZ1VJqlb(zQq zK)a$oWW63hP$#aQLeM=VmwEiU8q6mWB->ap(m`Z;&~-&y#|(tr6jubVH7mSCIDl<{ zuBoyXsKgHH1m}zF7;SHkodX5W6+5$jh4`Ox3BDn}^4-yLko^ouO3;byGCe=V%|@}c z03;Zkw+`R1oc6b518uF*9W^@2&D>RKXq`o1TuWzKOGDiGMsx|+u`4(4+Xv-DD$ka1 zuwA!|DYT^N&Ps~J55`-tf+C0Sy(ia#j^VW6Q`alnO6Dys`H~aRc$avCnq0TMm+*Ur z!)a3_Y3nuX;d@;ECRoTcoGLY9+)$7BJgC0)mcazi`4R<*&m~l$FU8iaN1JN_@ zWxfC)=_$37@WvogHGzvw_G^nxc4^^72W_xGk3DYvDk$~ooNb&!|_ZSikk=LZOR_0xhw!%FsRRWu~ zk9Z)kjAnv)Lgzo{RKjYw=1{#Rtg-jpzm6x4<0~K5nRALf2oC;D5->U9FT+vEHj_>xeg+8wQd&4jLbPZGdgnNPm4>Tm zM6*$wHj?o&(I|C{Rhq7xHg#lt*R>=(q_aQKM@yU@%dw&Hyt!A1KBRbZH6bO3&IsUW z2$lK7sNVejAe_qdXet@=hz0bU!jV1SdfPl-Baj`DXlz+($V?7+Ipyg_=Zn4|yZ6jB zRCK0k5&qm~ECQyutVGbFo{khrPDhjLc8cVcLBM^ZAQ)O@sL6#+PsA_alXp65Rc z3;KkV9j>O!AGo*i&lsYlfm;APtyAOKw120626+bcCSP+jfzhTy?#b#!`qQTgeo~}J z?NEulz!pAE!}TeSpfe*W48uo2o0_ox76nFpJMvl$eXgEg zZ@gVJGKH_{HC>53xQpUIG29WD@PZmWZ*JiyGSvh)-9l>_jB=lWi$YRH0R#l3(v@1eydZUD}H;wBR+Z*zjrC}f7_3~N)j@4RZ zXchxr+ke6m|pQh(Y>2C3h(Oa}a3?uZ&~WHHtS$4-o_TJ!2DK+bEQM zKgnrW=%14RSlxUs5ISg}D1&K^YGM27chTwKetW(>M^+Uug;M+t=h+eg#txkG4x@sb zjD@g<)%+9zOCg((YcX#~qdU@}1D>aQ$WfI;cMMT130w^DA;S zGcsDX;7r4imS?|{i!dM;jV665m-3q~g*pH>6Kx1eM<@aRG5t=SBAroegPXt*f$&6ERhGu2sKUkMD59k*-uCJU5RZA zjglUM@FxY!YKT>{ahf*HnfA`K63Z(<8bHF#|LtI;GnyT_OKR1HWddJNZ1Il8^Dde= z19vfN5a+DY>gXT*>heN1#RVz$_AG2CpaZYMb_{OYnWk;ow-eW!!gW=nSd31e)P>u7 zP#&bB&hKuOEemqM)qGcQKfujRKCoBtZ3YHXIz8<2uZ;ddWL&^^97J40Kby|Po+b3! z8T~YcB<@wCB+=m~s7xO7o-jKRVm*di3cX7UcdEZ`$O6!JNh3G{k|G_kK(@yid=U7Y z+`U5QUfJ|~0vHEc9=DLwvH3lqOn1r|GLk(GEw-%=EfV~zFG8GHSZ=_|!8<&2Tp#hd zn1!G`utsl)#B$zEE@~y21ZWm`kubW}F2@-!82GcH=;8DMH`-_b=2EN$=L!f>Sei*U zU+C}E8*gMa9fI#16g>b@@xS+?j3A#D)Y=~|R)9W^@D=9$e5`Y#1_84bE?X=f3Ma%T zqC$e%GSYhO(EvGp1-NLek=tynipfOer0D?2@(1+5x=Sd5Z6@f$Sv6TFE0>9cQK!go zYxY=CrleK8j82o^)mB>#wQnZt@jXL7=MNiY%I%{GvEoT+{`|$~S*pN;xkHxb+?-o7 zA^?(0QFp0^uu9@;83ytpQGw{06HcZSWA|BL_6FwvEpD(6s4pNaN0%g&u?aU`55m%9 z41g42f;lym8%oM2nWMl4YrzJ5+;nsS(t{_FZKa3n zUz2q;9>}rA+B9eD?L9drT#v+mq!ne8lr-AffIN|sON_~}>GvOm2%x|e6(^{USiQg? zd6;0!t=1&o5F&(1v+AjY9!3#z7;QLRy8;+@cPJE3_!v+@=_uA9FJe#)=SkjNw~O+q zxB#5LDK$r!Y(#_cr^D>&Vex{yGEMNE1}}@*T{gp3SR@xGl5!mXC!m1z>KRo}ii zMYC&c!p7omOBxhm7>))n<3X0pl=>~aBYIFJX#5%{zNT>CZ2Iz;q*ZA^9;=3zL(Cj( zl!0ZOll;x|N`KPjWB9d(5H{A=eZGVMl)8{Tt?I$Id)t}aPgJG)IkY%aMk$B&7u zwTUyh{IQRqhe_+kM+7Z>Y-H*NON$(Au0|RpCJjOtW&6M%ssO_3l$nTA)F5$U`!fuC zBpb!I4e}?4g}-p0Q^`OeW0gHlXb$SP|49R=d^}EK8G5v; zi)~NVFBAICP9CzEW4upzI>~Z;L&`!jTF>{r+W6Oap(AB0g+IBd&vtPCvSEhNEtBTP)Sj{`+24-xq= z-%c4EDmm&_dO}EVk!_Y|$z&;b0GsN3a?AJQ-vNlR7{A=2;>7qfkpX4`w)sVqPM*K) zosC=##vWhi^gA#%5`j0Qe>6)^6MS(okLZ?{yj0iKWp$xvgONbi0hjW7VRe89JrbM& z7*?NpJ>bwz1aP)JP+en;mLzD{#tTnu#5dm;78&oyF1p|;+YrPZ# zRBsv7j1kdn^0Oj};1g;CahN)Ix2WN-5Hm5v`Ng^c4#$afq(E@qY-%=Ie8 zNTO^flXZnCp`&wAy0>G%-v`XJ ziK9o#Vd+XoTLdU^4%eeOMZ${s5=>(e>sj`sCh9`1_&`%}dCZFG6a~HO-Yd)lVNSWu zU`qc2r86U?Cl8Rp?JEDburCOnn8A?Fb;GOQ3`&#%VTR|w&?)O*+}2q%ffGvn3Wf+B znMewx2^>YLJBQ5^ksB##a!;6=cfcXH9Nn!7bi!dGTyZKlvr4mZWyb@kA^CM7PGRgI zLr|4JfRz45_O&|?I18DSq(Au~gw8r4pK(UVX2p}7x$)sZl~v~*<-fl(8E4Nk5Mr=J z0Q}7Nz^GPk2pvR3hINu5wtf-%wXnQ!5;KV>VYkpe3DJS>(aB@4!&Usp?R;U)F+C3w zAH*2yWlyAQ%`+#ej1Kq!9Bd>hDY}6g+^P-#2v?@!c}|RA_ryktHlMJyp~84^@w&){ zQuO!bo+(s|*~>lUPtklTJeb{E!l6SZ{TksJ#t}Nwej?uw>)kIYkTNHHj3QMk9Q|04 zZZ(zxI}e-^qDuqLXy`u~XEu2Bh_Opdd{}>jiHeSuf(W_x6g|l=PI{GL<-+p{AOm^X zoDRpDmo}hxCNKADgcS}F>&c{C#@yHK8U!wT!A9`AW0cu@4h*b4WW;jxP-04f%3zRC zHh0l2+&wKAh)0kx0DDHNrscNeTw_qVa_8fpO==c0Of-EDEmI!=ZL7+5ipYo}!b~33 z5oQt&DeU$#`3^@@cHxW^lAHkQWbTk5b)xbxodydbxtXSc4z|q~qvy$9MB0+|Kbfgt zdj~I=$C0>;LDXJ6h*;Nf_%*<{RR!4JC*W}N#Sf?3kI1O*E@)LkDaWH@24zh2dP!66 zg|#KrBCr77yt|MA<&)~oq3{!(ydt+!U_!+SI-_5uxPd6(yX2yJ zHd%s|s`#}%`Ho+N`^vxlKtQQHg)j4;Qw;2P$$7O80g{Y2eaB0f)kN*u3Dw|Wlt^hz zEONA_CLBpTAz`v0u$kjS;74B`Y$i)~N~35945qrAJ}fXNf-vHk30Dw99DG3(RD12R zIHOz+i(m+4DkKdmg+(Ac#As5*t8~wB9b!fgE0mnce{X;g#ZBs8sJC~yl+M6|rxq9m z(h+(!=Z?@k1!7-jf0jZAk&uZ4o_|JmukCS4x5#EnrL59FjRy*S5=wN^Eh|41>KeFw6*Ol`7dJHte09#`50U_1; zkC?M-qLELe%B~cR;1WAiok%zgCH&(}_D-+^Plm2bcH9=ewCXX(4;2iO2Lq7^6U#cj zlNpxp|CsBN$+pRP5NE}upZ1cA?fRYo94Za6znd~UrA$Yx0bqG}HHusx)I_{&|{r^1TwyORg+it z4NC(1Ksf7F6~>=;JI>Bt(=d1A3>N7JB*vPx`xg+rz|%-qcZHjFd<%!WY^Wzu^%$nPH0IC zNGgWjxYSTtg-y96&MFkP!07odTg#1akd8{c_P&iVzP%+JDjY<#A5W69X~{ zZeJdz?rV@|e^4tNJwL_ywxQEHX*T1($RB~W$sb894|)*xNozIOYH*PbD=tyT?_ZH! zw0%931vSm2TL#Ni5BsFrqT2RB%kv&4f0EV{He7%}+~N7J07a=y-A|m6W#S6qN%0^g z)+6+iD^)|gxj|nCEIaDD-FACGgNO^2RZ(Ddl^{?N!9;B}8A1S&{t^Tb_b+YGQ-RK7 zAfkA|pS-DpT>zv)S{W&oW?8DMR^Ug1ytsks9hR%nV<=|e(S!$hpDP+^lS8Ip&~vmo zYvcs85nH;P8o{FaLn4p0PY?-V{{!LjKvjWdKlhCe(fLgdwpbFO3tq?B3akG=Twz46y5? zu!Z&%Cr9MWR7T!qx4RfP+V#puWMag5f!2szsFDe@HB)DuQ`rId?yMSboPX53z;C#~ z6)QZ9#t~f-u-n+8fHkT)7jrUE&7x%;AX}KfG~&l6VI#>^_0psj&6$bn5rECthQtS2 z8eUa|{KXkIWU9%j5LCj`^%EsAV|OFV0)tY)%kW6rpMrQxZrrP` z;ZEO&KVd`DtB#rV0=SJJ3w@~5z{cb+k*7^GijrK0b@A|mP~h-Y=18aysOcOt59dI3 zzp#6vS^^WK34TmXqaegsKlfxQ2#)a!CAE4OEa$CP&rI~0VU^)9m05U?nRgpjN3NnA zXJLzLFBP1W#hHaY)shfE92*d0{ayGGW)C3%HFTrPw$9i6MDK^hv6wdxnQqPe*I~oa z%BMZ0w{DfBh4Z zi&jFF^hZ^kr^M*v>3%%KRJ<4(fw_$wD@Z=YsX|Bir~|6Q&WfH7t^^5R2YXt@~f`)auM0_Z^mS7L}iQoxI%=*~453uP#!Euq1(+;m2A0zDX*sSS|- z3Mn`kJnF_z#SJ<@{#c-yWFSU5LOvf+*nU5~6+8w^PG+uHTK`2c*UNp(f~BrZmLY=W z1|T|64E0fnIXN=51%k?Kr}p+nZo&3Gd#2HlWfAfo5REc}PS+R_2=Z zD<;Kt5SUEPM^g6*rmG}hu&rT1uhjjc58)655u>#l+Z%*Cn#ac#7%-&r20u;M7c;Nn zcdBY8uCO=UbctQD7_`q7SmA1GnR29TFdKHU^avMGZ`9ZSFOL?(1N&HAuUTG!pNW!a z0JQV(z6xV(|rvFk*3h`uyia3&&8s1WKA7W z&!#*wizR0P25ptB0D?NF8TcP0LlN0M3V*cPe!oEncsx#VV-P-8PIFmW3#c_uG|33( z5!Zp|Jzt?LF!51)E`=K}_1nY&+ei<^Z`4wsPxiBsSh{!Gk`fg-#P```q#rK$3(z8RX)YalUet97pWU0jU4y{W~z#x#hj2MjI zjbPh#hUc`D?w%1OcSns}5)HK~>m??PKYpS=V#umYYImWia`MeIJgg!cI|iY6E=*4% z47N7k_2;Xqv;ne|jN=XFo;_8~_{xV0wQ&noG7DbYz>3oYLC8z8*s~=S6l9fA838aX z5=LL&6Y^wL1r{asW=x^SEoJ6F5AopP10*dj!rkPk@U+4)(GXY$YG?8?nFIa^)@7EI zfc2Dg38Ec2AoOVu*TZZ63LOrk8AakBK4zbO&}85gR)t4t(aB&CN9H8?6a^wN!T+w9 zj5&8l2IQww&v|Yv5pF{%IX7)MdAJAJR&y(&l1cZ5h$i7TtOM+`lgnN|yc)(qNhKHk zuU`gVhot&+Mi=eob&He%GHY;$Dwtm{G=ABLxVH}qmW(BM^h3N3?&opxxfAJ{UQ5qQ zGDj>S#C=WmJgS{XuQ|8+mjCnxO=g>_&qk_26~L`Z?P@XXWEQMWyfdI)PX$d}&<*iPBFUMRaNNvi16rnV^hBU_x zOJ1@JoKwUjyt}YaNPRH9d&H)bbm0S?|Gt2?j#7L26Ep#Rh{Ah={2@9b;Y}1gGqMo4 znoKIRjoIGvuX@Ob4>)4xMUzAkUdeJ124XkX@^BZu4IamAW^po^nsfkKk8hG5P#zCb z>x*cQ(AA1$#jqO1YWhCJMUnvgN?IRbiH$NM@(Xm0(g>cT4Nu|0Q(RvNp?n{1>wJm3 z_p+ROKv+Yj=D6@O*>d{EF&gxaoPi4CL%-3nO)VsWpXKxTuYgS;84bIMwm0J*$p2HG zE>{7Bqcm+KhyM*q04vi35y^b+R7{edc5T%7Jy&iAz!;Z4{AZf zT(KkXSJt|S*IA*t=XaBE*8mqMn3GOY$4O9w&-OA9ddwzS2^d8+2j@{xJMnb|DDTk!5+v(hieaX zDj)CS}49kMgbgS~}g4G=;tZW|-y#9J~%p27lBfBZaJZs+-eDRM3OA zItm&g;Qu3~=;(uCfLOH=*^XEFi#pJS?}1&Aok|^C>$4nH{=ZAdvpF_}4w&{M92R~@ zLr;lY)DTX+9;yI}W#4IqkAG3ON6p%3{?v$@jaY@IqiPP`SC_dd%J$#>TAo*xYEIoE zQ5GpeO{?aVkmY)v{TADfB1xF6(u>Fe&hG<8mvnd_W?!#ZB)KvD1j-P(lT%yf_{pF710RbdpnvFCfS_#SV7PUxSVz_ecorlgW?Uz#y zB&E|13q_-=53W4lmA_1VY;M0c0$`8~ELqIIinfyFVd>Pwkc#LU?$=mO2hXWA5RTUT z47)f}Q^N-Mh}-Ua^nGKfA_mV&P*IGg=cna~S3AMLpdmLs4>juOD{Zl35sP@129Wx3!l3CdjdlLmQ;Gze#wcbhF=d6~Bn zuT&r+-V9xSCCmJ#IU%&$)s)nN4YeH8pBX&mzg*?ecZG|SJ#@pNRmziq+hpyloM@zw zAL%R?QQ>vwUdgM>b*XlB-AJr%j%NaX_v{b5$Xb@QCFc-u= zI6|2zG>D$uR<#TrxkiUzgGrN6c|#$&6AT*RIMyD_&+zOJFZ=%yKpyvTjBLQ$Cm1&B z!~TBMitqE}$T$!ky--LVaHhaOm_=zX`L*K8^s5ch-hn77P{Ub$nJS-aht5UBAnJ=5 z0Ll6V^l|H&H5(qpII?BQnIc=)58+l~6l*-*Gn+IzE_vh8l?daGIQMo=t zSxgDj#s!uPF9c66hH^jaUi6wWVSlFV2cIG{1{Q#e`;_tjWg zUvxCWaiH16({zF0K)e~Ems+7iPAn?w;6&2Tl}?vnG>x!wNl!|V|LGLN@QNev6Qe4z zx6)mCstle?0HPUAHkcQ_kiYeB3n&Dk=O1KeA+Co^uG25^q5s#qYW)#C$hMJXtV+O`&UDN~>vek-dy|_XW7p{EfsH zqWfEWo0ulFFbU^}gG3W`L1E#D9cP)^(3j$M05o=5^?sLbV{9}ZUQxJQ;sKqs$9x@b z^mIf*0==#KX=@-8*{=zJh>=gDj_KZbUV(fI1fVU-$Af2t8{|mXc$3jx2aP0BawRBKmQhl1k zSL5}tzz7tjJxZ?CciwZ2Cqd~$jN3u|ob$zOfcL6iaPh8^!0;l7D3#Hp2=Nk`r7JLX z@{#@(h|DX>zQRrUJG7S^CammpKE~(`qZnO97>U{2gKpkbpDoGkV~f-|g3g`{PS8N5 zVSZ6)tCSbHSnDQaniUSpnayFP^sAzGqHXDW9yY{g= zL0OT|O%-<$qSu%7cb3WdK>7N^$$zKcjao9`{q!pZupu!!U5n@lh8$92x|9`Qf*EDFiWQ3u=<a+jr z2g2W6W(yGft>ZSF!IdcsRN;(7S{+ad#3eSQ{tI@-TX1}=!7Ly=fm79G!pfVAhkl@t zqqADAo;euUafeig%Q>LO_F1ms-_kQCD~T;(wsiX~&MfjTSM0YVm&V>690hf3KWm+y zp~Q49`DdsiLgzGCUsW;tt4>NOD6*YnZ}C5aUIhW$p#K!nhbY=9?i1fpN(WF`@E3wy zKujs4JXLEhbqXW4L6#yn7fmIC{mGSCYQeTJ29BqgKM7@tIXhr}p_3kN^}%C68xW6d zw9y*WK?S(QZpafy!4imXKSTg%aR}aE)j5J>-30D1-d2QMFn=(k0eYf@M-vmY0wr2} zGl4C(vNM)Bil@o%Xhx9JLf8c#W0Q+|-}PC76Ls<=Heh%&?Gf<6dbzbcm-E ze*?Bxq|$OSxs}Z=dMN%%R*QQja4W|_l>tyM3=>#CKLscbET+w%t)NWY{HHhuHxRqb zq>st>N6Ta7c%utDVcrG|t49K#BwoSDARTU*m4u}COLHs2`#hm~u370~xM8<3R;4Rh zV^ej`S_2j52{AdPbk|$z{)glTwT2_`ILcl6m=lO{e&;PMFV&$YQ1+JI8rxJCj?Xb6 zUs7~{c4V6F5iZKT1(QOfn2<1TPParz(B{yar)41tx{J73DEJ|>D!dKe568pPxFzOh zfZyW=OKzv6a;`W3mr#Dpg0?X(x_D7oAh=?6QmA^7$b+P{Ugxld2gfG1$Wp!fXQD4d0@E;C{ zT-4kF+1M7;m0}3&AFvKDjz}T*C2(Zw$j-53mt0nAssMaOrV|2kNM-ju?vAo6ZHDgX~o`;oBNV&*po=>M20mCp781#t>?vPc7w2PhNs9 zGf0bzai>k76TlN1BnbGGvO~%Y+=`UpTq8(b_o(QpUY}rS7m}2 zMN|@F_TWAwH%98%+Vb%Xo z9dZ#UJ^BCD*P~mRC$mofv zvlGiC5Jhnt#hg24{1F!igY8-I>1obakcE#o6jT+8RGnk1*cRl7Ap3^dpSKx7dqkr; zF)4ZzEeLE-o1vuDkf|U$)s+_D#({sQuF-5TG^wBf^ce`BNreu?+3d1fSxlWKMf}-t z7;vx(VYgPp9<9n-2`u{hk@^z}NoIIoIcyj-8v_OHSSa1wW4VtC#FA66%C_GZIDwh^ zV^dYIkV}NHRkY#~3DX{a36v4;L<)hH7Lrv@BIf)|odSSG*e|eJhq8sVpkSS1F|#p{ zp?#N-0pk-jbKc~B;KyJc`DH^hD2EmrA}ojxv=-EdMkDQrTD>9s5&J@^$Sbm%$mA|4Myut2RxHcr_I3usv zx5_aqhY?)u8RX_{X=d7L!U@xLg)#>aL{Fm9mnoC#L_CEyNyMPHsgg*!1x=E)2Rl?R z(iw$s$%)#gic$5nH%--#@O*zj7({K}4EnFPu3FK*GZ9SJVL*?y>=SwHMjg4pB97mG zBoIoLZ9xtemQe;Wch6JY$|X*IZeIsd!*LU6X|_SFz#G1@HY_UwgQx^^?qKXlV*GoP zjFw*N0U&x@YEeFgHpfqzmVE?S350T<0jG>#hm6r|wV(~0@lcY$`M2?yX7t%{A@-fE zMlv9#y(exg<%rOU3LD4)_)K-$t zqcS?xw_^8NkJhXkAY?ieqWH?J#?5D%m-<75`yuCnKFk)(>esoe)>pH)c&PV4yGm}cJTw`{bwPb2M!nc?p3*;33KG{RBp0dzg})0VAN^h z9*19&GJv_{;(MwV2<&7ROOJZZqor{5FV+KC`NX@q8K}D>q>Zk)H-*KuYYm^ST)-=Z1K4PbG!J&}J0J7B8% zN8I{4`{ESpWIuW@HWvxRYN2?O&k;^=8wxI*$$q$mB9_Oy2 zbr0Wm2`2tZHkqW)^UB@cm{$>2>e9z@lF@`%Bq{L;#%!%D9QjcVLI+z_&Xg>Asa??i zSvjXhmM{4P-AhY9@~ZFeTD+K^?3p zy+XzR8d5?rCYGzK@k!}})P1aemeTQbi?y1sbD|eM<0iz?7D*o(b3)rB($) zjuDG7`BkbhkG$KH*|nq7oR$aKl6K$9%yTe|rwH^qE?--t8N5{zX>-S)DM>>eFN8q< zSIw?m`BYS6n8fulicmRV5{{7P=o_YH{#GV|I@8rbD3oiReLVd{_40`!&9J>x&cZ7@J2S%`-Vwi+hyPny9|TDCdt}`mg1hE znqx&piCtS&o9nw08H&QpWKz|SN(t((k}JH3LcMnB4WSejE-J7|Jwx|W4F8jx(KWDPX199aF+dmQ>#+!_`otp_}a_N4d+ z_>1WXA=j~^SO2n5$o*D>8cFf}+PuW(YxXhkL&gV{AQTLzeUjIdO5Z@VX(Qoattg2( zP8vsN3saQo+{NPFB_}CQ1bLLqsplb+%D~=At4#pS%R!Sd5PCEaoRH8<;zaF`Y@vNo z_FC_zoh}_1`rY_Fs>1SJ`4dog5C)xQw{-1d8UbAImbcn*m_}GiYYB;!|RN&KCpb+IH?>r z{{Sk%zi*vMHtT3##ojQ&#Q6fp{EF-?$jM=y21uPQ7ao8#M;i@`E1CUDuBiRoRY0*0 zNp3QsJTNSaswh`>ZQfuo>Wv6gu8~I&lORX@pL2$-Vlf?-uneQ;hR}fG<*3DPfXGHW zcyBLLVWU3wRx#~W$%xrkU)yy>S@s zkHS!eQ`(dOhl_}T7TWIS>Q0KGg!bnJmj1FSW-2cmn89ZuQFf87{^Gxf5z)c#Rc|a; z+lF0{{^3nLX z^Z=8AAfq^DFqzBmE4u@Bg=!psS}Tirzd|Ns;F8KvK?P!cIJ*E(nzS!<#zr(aBs8G( zIz@jCsGbzNgdgUtDXK@wkVDi%z_o!~S{fK1N7k0kHe_M?V^HkV{H%hg0q2()0diD68mxCJbu7#8msC+)1|};>mCW8+;hC!k zjB-o?qkc}tTj3oXNxBV%J$^mZ1)Z*Nuvozl{H|{v4JVtd&reZF#Uu-F2tnU~;=m{y z5mgx+Xwm|=>#e?}?==hBhq;JF-8pzYRaxG#?wxfSyua$n#vWPcyOi3CNG zOv_=7aD*f?HBl9P%azHKKY;Wu2dTv;U^b6?lynT_U2n=+eI4|R>wHf{hSoTX($OI) zJZNq_<$evi7a69K!#ia6rRG-vLAd^zE~j2UU*L_@H7ct5d)&^j;v66JkdYF z*wcbr=oY20MLD3V6IW;=EJYAXG*d9!2yc;w%Rl%()u1$*x)>@xHP{VJ1@vus9S&~* z+6!s|9fP9Sl802$x5!se#*6mJ95F_{txS7+6C2An(2_7yt<4>^2{FRV%y+zQolsX$ zaAQp*^E@J^h`urNxuf`VvNP0G`Y$TDPmA19w4w7eV2V+4KBOuHNkjd(q)d!A`tT=7 zoZxc*6o$^lgK4{%tYnd5O(BCyVrd)}$dHI0xHxtkr{R)}IYyn4R9sQst4EcZQX?hY z7j{$N6hBjrNTjc0Q0LZe?HFPn7bu-5zlOWJRB&E$tw@1>|0olNN|iE|7)yectWK8b z%tjMZiJVxtLR~psG?j}9`KY4CO?Uo4M@|G`+5@o;iJT>>HY)I#pXfkIwE4Bjt+V6< zAEL_&5_AHV^$#Zg-Axyyjh=}hFNi;9Mr|C@0Uq*NB zw`_%%U&%J0u8AX|D9oXV9xY;ZD$)k_aUCuLA(si&twS@CyF?FIUA#Vi|1r64ke68$ z&iEz%jpdj+ot_eP>h0!`zd6;hY}FCmF}7DP(t{2By-u(q^`P)?TkI2CI%>_(1MhKTtg@ z+o0;HxgaN^Y3%o6{hqCisAwS+Q_>8$A}R5^jcHyCqx z14bVz*SVg6Zj{qFape?wQIzD?j$Q(f3zPk}7|*7EW&|L%2-(Lr`W8ul{A3clmV9h6C8!+pvJ6( zJW~?TjZlCBE=>$ltK{Vi2m@IdXL_VbtfS<}Z2v)*6nlCLIYtc)U=V3^+s1&kXjnM% zKy1(h_U#GzN?iOjx4<}!;^jzai#!W*4{3|J4E$D-8X+R+)}{u2Kwocv#a|Z-P{iM5 zyK`F{C3DtEpU8!>#!xela7Em!GwFLEjE~6%xnTx5-E9Czm1;(0aZA*fg%EmzNc8zJ8&?#NMdZZq@Vj7-tMH<}Z)`#jG?$ z5N3``=;P836hOF}8vUAn!E&o+_t=Vfh#`*L{Ml)K^2M8uxtGoOX{RsAK~)& zJ440TVY;*S8$^_IGB%Og(~&=2@=|(JBA)#35A}ZZ-v@uMD%{6vHLoS}f$;Dn=?}Ud z;`k42VkvG`ECq|GpjxTysbBHY+;ar{nd#S22TP@p=X1`Ljz#X@6v1ET)us$ZSAeQK#f^2{cFri6z zllkV)0!0oc&TQV84gjs*X3!J{ReyRzAY}o3M&h!hNUZD=UBSxjqGhVLgV=GvbGdqf8^m#=c6hV*xyY#}|`+`<(~0<})l z5E1aenC_;s5Wg$=frgOy{=V-RA7feIR}fsGVu&Jpg(lwMRu%#5cX~oDZ4fb@V08Q# z*Cq8I=tMn9%QXc8-!W9(Z`GLDdD)mN-VZGvq01_d`d_lbv#C5f zsx)9{(8AlqcR~`Ag_&XZJ?)nZu-= zoOUn2ru3S@6Ox@0<6s575WE4hUhwawQ^@Q<%8m2u@OHLkSop1on2F0nzrdTZ4BC^7 z^_$9xQ$Nvli<)piFEdxcI8X(TcUfazSNT`|M+meFTA`9`@P23@t%DIQy8RY1C>==xd z;}Yc@A8X_kwnYpuWC*=!A-s3yfzMoHfCY>DMehE|;zbnFBIW(xw)T9!j;#XAtSsJD zr!(>64W>sy7HGyYk*3tHut*zFr!iE3bkuyv+we5_^(^qO4q^%dKIgz3Sb@0>gz=VW z!EyvlO5DJyXD%(6J09Lq#(-h4f&ZXP*oL~MQ;cC{-Oi^ZF1j1cX(77Y>KA=Y+hjTe z1n$Vc^`B5q4#%vgS?qL2NC+-KUb4Se^nfuPOWCQ@9y%${wJE584^XR zFA+K=Eyle6Kn{K*WNc8vz&*ac?w}A*6&jL=b>$0-7B>gh@2x34ne&EbZh&DCagB!5HC!3S~7 zqL{wjC?UiI4FPOnwS9@4Pz-J__Vid17G2kH+8zZX!~n@s4pekAjC=Jv@(u1bOsyyq zkyn%Y7|e1p#;kGS2!z;hip+tQHd3QQ%g_LG&PJG`@uYN}>m{F=U`4 z;7+jVNd~#>c4PxM)P?&~VxTXD6ze-zNEs%w4ZPEf;o>?~xr0-qjT#(uK3Q+qf8?x3 z)?r)^qY|hK3}x3P>`8=B&cdMD@sQQgVGNDPN^qc?mn5oQ`HXVmq%2XOeba+pmN#!t zN9K+I{hd98SYFekPfL#BI3>#TpJq7Jt<#g~LST!rcm3e?7Upb2K6UUW0TNau<1IlxtI}gIq<;38wnYcjHL9blh(j;kZ24#{Mx~TEobxT zNO3T!08#|%1lzO;MFml=Mx_LLu$-o2D&_+_U^5`$YWV+oY`aKKD(M3Zqg^j?ZZ6up zc>#+kEfiDdtGmzL6Z9v7>wPu&96Y3W2rdnj#nY*!(ZfY9BtArm;LHyOZ3wmExUaL> z<}sVkwE_p8X&RM9pOwlEPRU~b9fXdPx=<6mX-j1%jvu92QuX)9#2xXME`k$ z@c3T0(Wgj$LGc4?Gn0jxqVKqo2~ zN#khS+Ex~+D(>7p1-A;^3QW#jSqVSjQ9!t)$TFz{6iUhL5$%a<3v@w~OyH>Y7s0$b zZgVi>SpilN3DyVl97_t(`wBv&iB)OK<2*GYKTW;I7uw1A2J|71{)u9Iu|obHjoXbG zM5AI7T$m<{(VW)m5Xk6+f7)^JK*WT|S=kj)5J&|ULBSYlMzw`Ee*Az?#+EAd)G4po zzW^d+z27rre>o^7Ew6*dpTJYHeyy*rD=O3?Mfw%UFD7s9%?_Sa@1<9+eW=b1t;HTy zJ%DAqW2D&<)F`$42&t)+{3}k(w~WuE#3H^DO*mbT<0UpigqMw^ZAS8_-*H(zx&wiY zbNXg>$vse-MbPb@qdr3|(jC|^it82{El9H5_Xx*8Ix-67%``-ej^tDpeYp~nBgeWH zV*~1g>k^#F59M80x3$ENvX=jHCq;I&uq&{^ZzU)5^{E9@{sZ=4!=|6%xp|}S*EXL& zC02f>0?J*>Bpf#tHiRe#G(vz2te1|nUJW!dTo&D@FXyh3+_@0ei{g!_^UgH|@t~N+ zby5p}!YkTzqAgr1wcLbbg1RZvZRv*uG6OXMKq~jFo0?^(OaqfpiV}pYHEus^HTo$% zr)X$wwR+(t&TW;d^hCq85-xnTogztL`Ja3S^g@&V_FtG1o~Y2lIT^qG7lyGBPqCL5 z9!cC|aN&cq9=Y39{86%oyQ3?BVcX@N4XpG{HWu7{eNvJ>gqu`RU$=AsTI z{ehauiBXQQ*B>GPBU^#aKH<)Znp(3)90OO$7v5qq3$D4(80vyIO(2$*E5Z~ugk(*5 zalEp98VZCE(ZmGK;}7o8yd`jOi0#pR&ai!J47wyR=>rO^M4qUm-IYbl!j0;_3r7y^ zUss#e3&8bV+ALfq0QK4Q&N{E&d&QEw{^2I%5z({EoY_|@4#CJM0kknK>V<~wGMhU& zWL~ZR*2e|C{Q>v7cS^p@-}6`FQ4+w+We#|0QQx@tqR-B{Cnw&1kN>)JRx-*hky1)b zG=#f{XKz{U%|E?yg27zlCd?_<&VZWKs8F)Wpo!gs@Pfq0o`sxUPG*{AQ9}{)+wsCJ znX7HB9{-Bha7ug$!ihB}*8aa5gcp>g`W|5dOVS~gTehQ7{Qb%AfkQ6}#H~uEsC-2A zcXYRq;RlsD^TMqKXE;J`_}5mHr*FNHNCai$zMR!?y8e@|dec;;;VDgfX%+z**{9G- zLn@K7c<$K-AC00#I~eyqh4cw0QY3{lrB0^J(N}p@1f(KgkWr5tC(s_ZCLY0`Xrmj>=nPp8rBlot#5(4nuSfn zRQymyu&_XkgaaL_+ogDLjqP^@8G;lOk;-#S56Ku#8IX%dimduYimAe8+T)7ODI0AR z)@D{13ld!yy_p`DImVzR5yr9%7==9fj`Oxp2tWeP# z{Sb-;Bbc(C$!w{kb(iuR=E4#lfpGEyi%1e5RDrDd0zqQGGUyLMp=!YHuMB|zO2A5# z)_1QlWzyl_mq0q4gG0hoYBvcP8z@?QdPJY>7|v>B*zqNhX9(n1Cf-H~hd z=vB9zj$n>?bb~@a35^}mOVvy{x)xqrNjl(CT;C&FT=Bi5D<|C*#8mUd*yGAC6VItJ zVRm8^<3;hT$QG@;&A~Gl`fn)~N{p}#In2-qtf;1V8{&d9>C<^DUpmAWuTa~Favq@N z@;5?ixy*ylI+s%+#!l?Vi66>8Uyt5R0$VXrtL_XG{ z{%NT&BrQ3!0W9z>ki?%E$;?;mvr_s}$(kWoFSzbkUEw8{B;b0ZLFE+8J;=UIRNnc9 zAdb~HdL7|-5>3g(R&F?^hVSB|@U9XaFc$peDkrBt60K#l97)IiQ&CH$NC-OSU=Glw zlg8t$3~f&~R}-Nn&NWijz1;CuP&aNV@4RU@d92cI2G4u!_bmZNqzH>;ve5%=UcfH1 z*kR(C|*S-HAP26++9`zyj~77Q~D`o${e20jlxn(Lr|_r&K>=b%Gp za#YA{pbwQrZm|WWVv_dgtG`D@8pG8$`*zxjH=Jd+((Zn}Zkb2ec|Zf<#!J>N)bs&1 zQZiqGkDOQQoK>|bz|BS%T3X8Pb@=5d`;96JU^P37H&e@l<{&t8GE$)_=B^p$(3ohK zTFrv9P30E01%B5z@U!Cim-2E|D8S_R#W!bCcvXb9?4Yr&K! zoL8daLeJpirt>v$Cb^E*vY!1$U;GYh^+jFC;^SczRu=nu|bThJp=g-sm=`Q&!?>1c!N5qvL4`_?UkGt_h`FeGFKfY{>!7k3p|4@~X<~}tf}qHa z3W&=n{y^0cufND%wi!KT&T!uRscWoB?>b;8C68hcr3;6hp3|v3Mje$pRnv* zlG$&>(lOs>OkZXBZ`h9p58C!5lp?Kh|LN=g#Ew?X`a?BY)B32Fn>G+EnqHq!%|@R( zk|OjQRvbd&+RsOMc#X+7jq!vOUaizqJrn2YJ4t+(^hvD$;V-YpOjCUD%D9;kAp-2OPm{e_~( z8c2@Q{}$tEUr>+C;gn_Oq^si(V@6@y$C6d%O;Z~*d_@@uGIAy9J;CMkHz7QxmpCXPo@>t2??F3k2j|6 zXf}^s0M@US7P=MDh%$&D$&_EHG}2C7^1n*_O7|KAPj;s^rGSIPVUhpjrm#lw4x-+v zwyGV?vulDn?pmR?Jf=nB^=8V;Gb!)yC45HbY*~9sZ0^4^6`~|A%mE&zOyJxuCt^Y> zfQGtLaudxVi6_<&$$(2Ds-qx)_@GF!wzIba%}OTmOaDw=rGh8+`n(t^JSV&bumS(L zuW+rwMF_<|asOiDp6#zIX@4(yb^jfCk(&@smYJw)PVF8qe9v3Uyh z40m~W1))hl&S@4MB>mxm#mi3H-I{EVaKLt_8nk-Z>J^K$%kQ#p5gjv6u6TkDLJs2A z4#Nuy)yFlz(G4x~oqd{fG+7)p0A7$zQj~Z>mhncs5T0T71xZ}i^;_1?`ZXWVa-k@I zo+?R-G&Av2nY4&h*z?ya^Yb4iSPWJnRXF!OVp!zn;&Td;#U(!-wFt45JH{|V2>UgT zCG++^gOS-WldlVTnUvov^2&PZ)U3Z#D;LB6GZ zi_jT8O!z~&a$eN(T)@iKb%DX$Z5!S5DFnt)^Ii284j~Y!o_(17xLt=FCak4R?pNY; zPECJip-SRCvh@%F|MreuU;x~gOdbyn?>M}#sazt3Jn$wRI18Jx@0Hv}pmjG$z2Kwr=PHEFwRMdP&X7JPxwmsfigwV z0@->edk@ZA^pE#Z;XJ8ef9SLX0crh95bU%$|k+8GLXhD#!)5 zx*~sR;RO`FeoX$f%hsfGkO%|#M80~6if;ZQhz-x%5*9&xsl~OnY=lNHTm4J71DuJ_ z^24-|1sSyQ7*V1HA<*6Q0pw1qn@m#5SBeTWBwV~#3Z81{-_kJA9%1kez(1t$h|~+j z?@mC09nhV!7Ax2*P7(w}?2y)jcD<$Rlse;Sup%jzu|DAg{u z%Vaps{Uc`!xv!8_a6rpAltQ5SP;AGLZB|T7os9%{)(1UU`!r{dqkwK4KsGq5oI@c-Q+Tj>NeS! zkDbAaH5ur`-HF|xtuTfLa^{Bb!KaQMB6C?|{NumNYb-3y?=> zt%5hGRl|+AMqsW~c&e44+D@77eI4Wq>VsXTjaO;O(cIKH2ttvdYgjU`%)6-2{P(R_ za6`c+YBEaoCGJd*Fs{@!(7V`q#FkhO>`$E&x~WJUY*=TL3aMF_Qcz>`gD=Q5P(x%? zAaxT3T(g8Tge9=y8Dn6|rtp*tli$!{R? zDwT@Btay27k|@>4J9M}&{W7d|b=e!?g<)R;keKhty68f>wv#11#QEY6!9S5Q)Nfod zcuIG7{0rFxwq0j3L>dml+R|HyI8*rJMl3~bHrBhTx#hv!Hf>M9V;x(1}4%aBwU9*C)Q+B+aDo zPBU__$WEmyUagrh99B=@QkJNMk~oIMuPB))-BJ|e?(G^IZ8Q2*Qzp;7;`)Xe1P)ZcRi(o)!$m{1aR>(G_%mbc5!8@!4Hc%sx19HzE0klkBA<+B6A6^) z1IK90I9t1i0x%;gt~tzCdYCU@GpL>mh)iAZUE22B89Xy5g<);}AF8Zv3ebx__aywf zi^=TinL8(~JjMy%C|Qjnoe9AJ2j|Sh!R^=NV1L;{cp&Lf|D+`{jR_7`l@2~2F3IUa zEhAknob`V|=0vQS&E#?M2`V@F{iH>n<{$j&sMD##M}r2+Z3Mj_s1KFK)TWgkdjMAz zdq7fQ#z>zi6D(-^T99(qr0Gl_y`vECsu1CK%-{%K5B~&lukod=Em-i5Oz@bM<}ZbB zV&q)6Dq`wLHQ^{RpS{s2TfrCk#%~pBRo#&sY2p^m4+ATpiU`2vhkeM?$i#Nkq{dkJ zF+m)MMA=>Hj#v6`T3m&v5t86i;yW2JwYetHG`y`i1Rbl{!{lteD^&>waq9?;#h`S_8o-=q9QVMQZZ zI`#GL5J1RDM#s=11F5X(W^k!RnOcuaRM=1cCy)#Ac$%)NF{-RiicYbny~^@^g^F9( zuVgO?<#icB5^{mSv{tVbnK8#%m?_V_(;`F}vV^TKjRhzp_}^6#;ib+O!E7>Pw4XYm za$OO1oG$G^CgN-YdZ{mi-}!04FCS})co{c5}X zdi90BnAx6jf)bD*ow4v ztT9210-{SjCQ|1=o~CNazRw^|04Y@cx5>kXitzO^c}c2^s)gkCK4{!&x_SVe->zS% zgaRW>E*4Z@&)0;_)c8*GggEH*0qoP4k3D-=CfhuZ$xyM^d^|$Soqxr>g>zpLUZADR z2$N=bT#^!v)#JLHvZzCHReOu?*~{&7GI)8$xx-6m@IX>~zP($lU&de~?#ontLk*pE zMNR-UJY;mzuwlE#vU_>9VE7&lyQGdWE7w$0xO6v4NQn?`o?Si=Y|m;akOK5-K3R&M zI(;xab5VK8mYF_%PmdQy#9k3kl)bOlt*a}yk0W}MGq#Bdjxs^k%f+mktP}qsh$Fzn z&|K(S9W4itadvn3y7O%^O}6XV_D;ui#J*KIyTz5jfOGhETZr_;RBRRn@X zn;@fjcApv%o;L?L98MlINaXu80b{I9sb^q_G{M&FnKtzx$}85LVu9*aN7dXoQIxJia-8AWw^(GK=!Oe z@CBs7JIJijFk&J2H_w1BgOv!7)(05b4RRE+>5IvDk*6J#|CFq@&DuuNxNtai`#I1k>Rz^56K+62af`qAwl|dA zQ3^YqZz_Y$V*DT*^ZkKlP}UhCt8b>u<%}qQD8BR-H~t#If#vL393~dgasEzt>nUTc zI}c>y8e%V9YxbG`L57h=fIF3A2dQ>+ZE6-z7Asny#HLt$cKAsXl+s(lkZH}ftQL25 zO#vHI|2X)e{D1cm^D{uYQ$^3MOVu|9?U22(9rNDI6pbm@gFUQEp6S1rZa0givJKaC zwPPP{UA$@k6Re2|!HZs8&&p0lan$OC>U)cPVyUWX2YL09wGa?QuHzfr+mxVZ89zqk zM+)orGrR{&&UJtLKpd3DtIFT_foO(r$5g+C`O36$kt;-<(}t2R76g0@68-<-2Z%zb zUt?fGl9(Q7Zu>?}wxC>d8qJSpBrtr4gY#oScaO<{rt>+=z(|@nclErUN^#{M@Cprw zK}2$S%w}FYX<>D)XNx;48)X}a77&+g#=DtEVnUo`N=nbSy{TN_i*Fkp$@{%eSisi+ zge~G3S}SgL&6#O>6HaB1&B#TEBvsk>712LlY-hJ7{o8R2bdZul5eJ|CrEd{I5ov=^(>G?SD-fEMcra4OdIK+f*?aEvx%hr z4B0Kbh~xy+53^OdSxs;6P$JbQt$6g#9i)!#sdwi%b>qCRQGFT=)xOX7%w~6+XsC?Le7z=R4gO8?5}&r_z=8- zJnl6>jm8fQL2oaB2<#h2G-=!8_-0@Yd`)a(ONW!OwB1YzOUk6)BUyY)HsnIW;OJM( z4W&i7@4QRSt=9Vp+d?L?A|;p=c8CamnlM1Aq{QFd$Fw`HmN>5tiq>J4RrtmiF6;gz zKOz8>q3ii1nMg1kd{l6uHoaR)TjT^K5WX`UBt5sN_j~V2*>#Ew63wP z!M|s4ypGr?jZ7X67)h{!NYh(v8br5VDxOGb82(C~%#ulr$UC4{ z39{H9Mzb;yf$D0X%~;V1M_N82S>kkIS*Dm|cN!Svtu)gYSI%ognBk~AWNZB9qB?nH zuE8C9%1f<{fF22TLYp@k@FN6`;K(d%7m0{wRuee9@rCZ4>p9`)}D2m7ZKYDov&q+?la>_M#xMK7+2|X(y;KC8sbU^;Xq9hl|Cs9<)c!ZWqd@rb z*OIQDj)2I_`n|#WWu-^-!+Y=EyJbCUA*FbdlM1uN9p0V0@U^~7TKlKu&|)xdPfXTC zl)b$^ zC*z~h%Pxnj9Q~45L>{s3i~Xt}ncdVLLKbDUfuKFH+fm}9ksTQFoX2K=AcLJCz{Dji zy}AuNfF~}I`>a|h+VIMD+)oNeF~-+sZHd1 zAy1}v@Q|F}CG|_F8uw6JtGPB|rPyt_fqbEKI$9Ugl8O7O2qST#!uzmvrUixYz76Ed z;Cqu<(#_fGx%k$>^4`)n4ZzvoJ37=32$Qh`7LM<|Lg42-k3_X6$N}){u9;*6KgZD% z#n+gHOq*`GVuXigKeA^Yc}Sv;ydvU3V@|GqKY7H1VJQvl_Ss@-R;kzc0vIq>Rj1?S zR}iDv3M8{QXAN^7)k5Q6@5}v|GEr*gZ;>)o?>V1lw00U;@tr@heKS#X41rmS=P_ck zi1`t+2)+Hn5BFi6WN=TY{6*=_&w#YfF9tpmwgRapw^%4_=3S^Kq!)apA4UHK1kg(kCTthN>{ZbVxl^(+S4l(rqJLe7!+7& zc;Gl8mHKQ;9gSHMAL#diM?rGD92x%@mVo0x?nS0HtUoK8ryMlk-R%k1&(A=&5poPQWOwIh$bRW{QcS_b3PCtviS5y$H4`K``btU93>3~ZX@2! zT9@&WRo7-WaR%hMZ7SI}^{}CKa-L*=G)Z=R#CAF+3}EDF>|()?Lxk!%QC}2C`$tDg z_`5U-f?jIPHSWcTU%Fk4ZgNLfIayqjipYluF5c``?lo_jTEc`J7mORLZJi1pt8+Eq zr0Etvs3I`HZnRpzY-hOE;ZL#xm@LM1H7Lvy!coHK^in{t_V#9rf`TlkGz0|@z{Z&I zh+DyO;Rj%Pq8xfZKx;)`5oWesc9x!ikZi{*V%X?)ki8GLI~eWT+f9$$LnAZEC(f#J!l`tGG`04!WqcN zin5W}HC^A^kQ8s50A8WCHx+EvZ=TvwU>H}Yg!6$FNYD+;!YbsQ_o~TRH5pZfsa7sP zePqo;<7y}+yvU9iZlF!|;CW6AJNVyVvjKjFCX$D0B{NRmR}c3KN^>Y1+C0s%9mw2e z<_X;AmQJ4;puN@06$XJD>QF>~V?Jt;rD|qg4%A?#LtBciL(p%nd z?b?qC3O8pzIVL6$iQuj0@$l)02UY}D5-dphwK9g?qw13bxpXLWB{nf1PprLsYz!^ zcqPfh!Es4?9X+6$VRemLFkjp?stYeUR-+*@q%O&A8Vm!6YH1($QFm{C@<9r|{vBmN zpmCm6Om$0o3#m3Y$221b#DnfBxn7U&L9lWP(&P7-b)D4I_Wg>s>BBz%1nIkIC9Yxt zB-?}Za>6A_9+B<1?78d^@t<=K10|{(6HDq6h=}S2t*;4N*Ng9DXCoP~=x%Yu12KKX z#S8s!i&;kwaLjsVd^NG$9uOhI|b<|(+eA($LMPNNz8qX48Z zgqO$?^j0`;3~h1<(bo5O*=CZ$rliVYN8M?5=cSouWCE&`_sa>;^+exR*-;GY9D42OW&yxGdrqQ?Us z8`O{t|9F9@LEdK=C3+|hADvwL>1T`ogs>23IZ_Nnf!iCHzv5j=K2T%j>0O2`54z>8 z;60^+q)-U5z{wpDJD6AoKSysDL@xv+{2)U>XXXP*LaxkUVIlHP#J>fwNcd`NSfK-E zPP%qFL_#pbvN@QByJ|*#LZnwXKtiH}gYRU?9`dnQJ*y&fJKYPAchJy=UyX0;EpQ zt6Cc!+JsucZWTr`r0j@5AM30sr6XLL0jT0^!W8q0F)hN&-yad7eR6?n!y>+^6a9cO z2dYQnM&Q2yN7KoURZf2j&^HB%_J+6^(uH{$EgcS@Ma}f6eTanHIU@^YP4aB=d&)p= zFd>A#DkY7l{*d$t$~l_i`?5~|;qPOKVGn7Cbc_HK$2t7!dR6X0oWMZ>PMyQ@E-v{4 z@>qrD--sOvpTgb1^mxM=8>r%BGyR5SXb zO+L@x+s^Jg{^s*9LyVVS)mBD?NB9RGg@6PDN(G((UT$AdkFUS+1sS6-fcWe71v^f` z&kn@$0&z|men7eS0~X^7tDtht@y-`(Xq~?g+TClqYqc)zKtF1l-YH^H!8mn5B|2{+ z5LA;Wp8LbDIm9nXWFpZ&eL*-q+^;cWpR&p%N$;QVLUBLAYYf^hp#^`??=XFFb04r( zCRjWS*Akmc5hA264w7smC}fOm_CfXcv;zZ{Udby@Cima`x3Lt+4V1LZzqzNdv*dW> z&B#S2OMnn?@g`4;`Cwz?0ZMX#S|&`TI?awycSJ)%bY-7}HxW3-uOe+xT(S^AX>M^e zdtL*QxDUL|&4_bFcL45OA70d|UpNW4J)E@{f3?A5Wt%htK<;7R<7K-cm}GeXh9UsE z92P|4g_DkCFZZ;3*bmb3F=z$75e(Y15)BM@{em8uZD4H|qvsKlt7dZ>4jZH#y|FQ) zYA`4fPUo5cdQiQfa|IfLtG>SQYV!YoJ%Fw*jKq82Vzq2tn}+@WJ1)oI$umO9* zEQ?Sh?$LGi47yGksbVJ#>gtmcaMRfVhT6TEMwjCH88%0Zn{GGB(*iA7n@k81BA8Dn zv+eX&+b5Pvt>aJhhhkphRSl3YgabaQFt4wWEtZEndb2TiVSk^rq2K^gQF$8y@+%~6 zU`8D!k2eo7B$!hUC~?w09kdc3{nM7UtL&Ef^u#_eBFLd4cK@LDyXYki0w~O&a$G9x z_t6DDo%ugU`-&;2_@!b)gRxqFb~*gf;|9QlAg-q;(|s6MRzcEQ|8LmuNtVrS+b2J97WdBJAJ_vKh1Q3nZ)) zCHm7oEIeI?veM|R+tzbKKkK))YObjlxM<`MPbRu55GxO_q zA**_!b}sg$<2~Fwq!c1jYpE<%DM6JABXe5(uu=Lt_e}-OHFmBp7;XehyU&0dFz#;p zJnx9)R%Gam##(YKnm7Ye7u^w`5$z?4;g|>el4Wz0E>c~Sc~A3gIf|GBhT}GW3LG>j z4{Z&ptj&sCgU@+{li$!lLK$>a^eIo<0iXPtQ)X9Z&Clr&N1=F<I;11wkXPUQWoNilzV^_puPnEx3FBg zDI@yLZ&dBhcCG9XVTRhuhmTl$76~y}RG%#Gm0?nkXggTZKCzffQi>SY(>;ND1E>mi zqf9=Ac2e2NpG9c=4STTV(=~{<%fp$u!s7ESm@!2U>*Se)EL<5fqexmae7%}3Adoz1P{W8IH?dO#fJZp z0}-@4(NIi$Jr16&4yJd^xjnEZ5=0`Pl`EI#XwS7L!S09bg6!v^%1zKp37#)i?LYz6 zIUp|8TvObvBY*-mQ$HUysJi2{m4{53e)p>m9hpGrCUHHS8`KO@HKgH9?n?L+1czv% zb#aJ$WwT+gmq63*F(BzI<%AO@ark$&s}C)M^*1t>M^-fHUv27(r^~cq)K!c2dZ{oj zp2dB!XiJq&Xaj)~%}<%K8ptMp_P}l>ZKs`4ovx}@gF-PAeU!*#R)VtoYQ6P;$lB9( z;3OuzomEY?ks3`Nf)ZU+UX;+3I7WblP%lw|ynfXsV+zJa}vcuBWL*T95dwj1)WoL)Xq>gVSZF$`L93~87r=0CylTu zB<&@vYlnxAmS7WNw0$5mTMnv>p zYLAenn+Z|maUq3vr4!IwD|cg@bYa{qgp?eE(vOW7(TaL%k$h?WUKie6Q70$u-{Cwd z*e<;u|DW>4B~k7oV2$TH&(j0)#JcytlIN0NySe4VRzk@WgkTn~R9H7YGtH32!|A8c z4$9*G0@8RzX%+X0=IyIn^bM6A6>}O$&8mf27mMD_SE1?TDnEz#bdWi!F-L>=3Gqiq zAMZkjtWAtvC?e+k(b~(+ri9x2l88~h)pW!`KluN`_w+A5MK_QOR=+R-yO(^=q-sTG z0_HbP3ot$Ag3PQdFvwZ2QXC<+pD#kKGFC7uR9B4yD?skr2~p+UDl67tyHd!0jU?zAq&#DB~Hbo)JJU` zZtBIJRb0L-hJ+Kd+~!_SqIB@~k7(<3HRB_uMc-b1j-Q|M8lj2zp5Xr+>eyZIfu^R@ck#E|&F@P{U30hQMWj_#)8&q5*edC+y;ocUeqlMKx*?Y{ zV@(4U4f8Rz8P=`FlC&aG<^3F?t%DQRy*3i@?77X;kv=kUt{q9EVn78wzBRCAuf$ zf78N9FsXDHIONYGN{<{}JZ-y%j zws&d!+Ab>zS6Q0(s0AepIa~U!)onM!)_%Elk`qu|-uUlD&}%iHp<9FQEa!Dm8lRGt zJmI~bJFG53Bzi<#x^x(fu3jp%RQBq28BMu&?=&kdrmJHOk4uy3`+LKus-B(!I@rej zjPN($C4uJqUVirtIka5M>#&SQuSA^1wzLyCZ1qB`P&f8xYdu;tOR||ztL)QXN}N+s zne)Vk|MgVgf0pGnNHE87E^oVNsPreH8MIvHsy;K8{g5TnEUdV@eG=Co`kADzX-vK3 zJ+T&KM*CFvpl)H;xsSPyy$92>3QT7V(4xuGnT~K@R@)j3CWmr;a9>?MQ+}KQZzF5X0 zCwfkta?$~_#LTH~uZ_!R7oXcX@TYyj%(T6JEY|@ua>xl9ZuO_lZHu8?s<+EbLHqT+ zM?euS?KLu6VNbs>K?E0TtFJP{^V|N>|CJl1$<3N+Ii;(we~%&C@83g*H_>=+DdjkaLt+eoZ^3f^z&OH183y zQW;|xb$XqjhkHeGqAuIx(`?H}kL7cj)+nGi;d+QC=#-skiFg0Cy1ce)l{y)%M5~6a z%3z_NqIu$PdYP=nvaNi=%$2QaIl($Bw_g=}wDr5?-03&>f%!@nUJoLF?|&{!z3h~w zo1hfIOE#dvn)#*7Ygl_X7&>x*~!QrEX`BWMyk zwTR}v-{(&CwVyn!|73YyeXdi_3s~RZqb&{>(^Nsi^Or6kiM__(l3%$8)#l;4KM$W7 zuMci=-RQEW+@_yLJmVdLpXATRf`c*J_0`qHrT0K1upu-P9Y5L7dFSnpw~V z8e$$e>E+&!VAe1}&Z7^0dWf&+x8vg%no;5TZn_T`;<5?_aPI);O zgOVv+A=&63iKl__AoR_S!qO1&!U^ z8SmFWBer{*FB7C&*ZD(Mg!$aq(<`(bX-5&DE*%5lx9#DY{-bD zmzs$zZ75lh0#kaD9!kZ*TCh|B3KjV<`yyOF^nLN&*TCxYI5k>A6|$oFX)fU=MlNo5~1y(Z=;nD(K*I?POJSj5NNk z#bxTAm2F4shr-G~%Q&(Rqw&#Rgv4nQejkV1A2(GR4PL`Av4V};k zvyJoziiT;hfArHYBe=iSQV;uKq@^t6=)XUBwDKT$xX*2WhE^9}>;4|zbYc?mhhk7L z>n2-_xhcH(ttb`RC$Q`|0BNSA$YdtmQR6iF0dM;Qal8C5q^dnj!Pw`8nvB8owq$gN zd}CxW{UF{Yu@FF^>A}GRq);mL-mP^L;hVl5zu4dZZ=le?B=B&X$!IS zv8W0?8$@{g(j5v9*B<5o9z3@lu6#J9@8Fp8qVbkxE?MGN3P`d#$t;36781$mklA>S zutgiOJqF2VcZ^`QEHy?h8hN~vleM|ZXy##m38)+GAZ6T-jM;b_jtDB$LvYN$H|+jt+7UP9U0j)#@7k69iWRzv=`JZjp(m4O9amu|Y z$zS=0TIosdZk8kvdV;9TphDs1fAP2AQ2Srf;pg7L0P6J0$ZKnYQ6!1=h$JBJVE$&O z%Qna$K)0ti^Scseh#I;>4tqI7c}j$e ztoz5iI$Nb@#c&=Z%4p0!#&Y0UKzIae`#0D)!>JMcIZ6n#@uv1bJ!-yg7Y$U>*i{{a zY|BWERFH`U3?gb&M>Bpoe$(_YRb!;xSPzH=Qs_%4s_6r%JDvXl&yNR4p+W&YW_IP; z%b)i8RlpOD_~jy~E6Y_=DjlP9EAM5Ib1PF5OBo?n=k zGoVh9g3+P=eRhO>qEyXsQsq*X*ERHlA03VUnU6UYOFz`^HlA6qF>P#{BB(MtTpS5r zCFP!U2TQecl04@+f*-U8%Cmm5_hQJxs4thJQ-{01m$_E=!uRjA&BH(hMK8@^O`zCe z9zB1t-DDf19Vm~IhwCSfSwImS>se|@1C9fc*8eo1_z_Zs|J7k24~@zJxb zc#u-83bRK?>jUah7fOMXXWu_4Y=>aC-A_~AkBuB4-QV&mcFKC zdYNi32t#pL_1%Gel4NB>A{1d!fFPor<9ks45=6Y%T|dzS^B_7xBbRk&nia^HatGgK- zw;b93Yh=z<8N;6o=$nnpff$gp-om>-t*LdCb|8=@b^WFfMqlEDU4BTz3+EUyG!hRp zAo25}hl-mJ-5<=U{EjG5VXMBkt{$eJkHyC-P?Fzu6_XyZNZlaqD#@OV z(n*&p+}aTm?iLT4#4uPUaof0)-(jxblkq@Q{c(h2(!9%7Z~(As4ydRkfb+#_RMv3x zas-Bl@mjpUqxIb)DmC%dU*IpGSh--DXP)e!`gprT;aZWiG_gDZ?QXV*6M+yDdKl^T zTU*%>&*r>8|2Qv+*@8%xA3%q+Bwz3t`YX~3nkwFVp6@K^(?@a(iHI?%QaJuEb0Ul9 z6Kp&`96!tPXbaeGnKm90Oo#iWC~0NT*G`)%!jmLfL&u;Ea;gkTXulH)|4yQA?-kQHEafKYd|lWh z3q6&R(8fb6UU5m16rJfP%}d*JW6khCAnNOTFr-KP^GPfEL?@O zEZs*$%nZDm7Z?>JJ)FGu6hc$X)o3Rx{(b@%Kv=uRZFF4KUk?wTI zuZ7_y@B{;9jzJjz-Cyt)x>zKHT1uhQ!;=I#30Am#Mvu8YixQ3i0DcWxxbth{DS zLmz+ND=5^Kf$IF7N`+QkKK*tpvFnE8c+-BBc#f@q_J0?T`JSWfQ(@w+{+Y>mES9^S zb|3S?_N{z^XFWM@%Ucz?+{0fe!3?3C7xW;4pW8tvulD*W~ zn#U9&xaa%X(V6|QECu~^iSXii*8lzICqE{NXV5>KAyG}}r-?42nsD=G_F!a6e-F+k zxysg7y*1cANBtF^&AHY-I`x4!{K}_Bj(L@INhvP&VBC@s6ssh;y=)a;du%1 z;erbk4^q_NJgWjY8>UH!?>j_ltiq8eB zqW=oid>@rgLk(`TR8Q3f7C$huz*UQg#Vp?Y#1r=AYouCdYA6Fwnrl z`S?Ma%862e7>V5fRdlK4RMu&s-JY^g@zkj@H59|Md_ zyOsh!K}X(CL4nIlqjMm2%F*Hkrnep#(X}>!eP7Q0^jw9HR8C-0D5-|QYD?(*Ve+Y9 z$eDtNiqL$%kg-Jmr9V~&_bnp~e8@u#0I{`6QyEy}?(`z{ftS@SY}{Vk69ECy#$E#phlK5lW6!3z?z_`Z$+D!MDb5;rC`*dYtUz0v z*B2*;p?aSjK2P2ar#OD6qgaXq@I;-OXD7dHJ=@yZ1!Z5}z6X2*ok{jdWBz5?HM2=C z>f7t9v%C3Ql1v`cIWetTiMotsNP!nbJ%>w@Vo$N2YnR_@79fQ(AqDTfyh8A{j14yI zj9NEI-}@u*#ja*Gf1i7^u%&4mD?Oz@db=EX7O2(a;@@wzZ0K6KsOo+#>_52$fDy#1 zwV+U!gWE#pOEmhZ%Z& zimX0WN!-@JQVDfah8}J7>Ku~!sVugZ>X}cfDC_1=58ywquOi|W`XRzUJL`o8e7huV zP#ZuoQEq;|ukNIqDnC=-%*=lb^W&HVwFd#-aIM5}!lCeC4kmY5!?-?9JjBZqTlzchMQRrm~!U zZN&CpaLisDitEc9szYOz3^#TK$C1T&b?`e~$Nt?7i(@qfb6e^QImVFclXZZ>QC|_q z!b@#TKF-`-D};fp*p?RV6;1%HEU{_5J56I)QZ%Qy>(`T{aCx@**Qyd1PmsMX>1GGd zx)=1YXFnDX@-w0h_&K&k#C~)31=S}j=lPZ7`HvL1_O?|nzE@Vx<2x5+(9W{qDK{_6 z!guJM&IWlH?ayN2ADOfkYKF~-tnE$HA_3&zjm**+=y|9-kPb|2Q!PcEUav;;T;+T! zw|RoJPBH>f-%MA0LUzB^O2wh*Pt_JrP;sRkql{xzB?LSi^JaFI(_qcrEUOejk>X4x zdrDT98u>j2a+?41oA6dG^z6$>V(+fh;8pqdc5(LVGpZXa<1&v7AUR~KrzzXJxxW20 zf1A)v-o9g~WLCVt3GXkES!x_zf;GT-`zHvv2(se6>21!v?@B!%>t+3#h%dDgt_}Yl z|EjQzZW>y^9DTc)z9)Cqymw&#&ZqLZLD@Qi(tUCvm66lCNr1jmNN4@R71}~hmUGgL zBBgD<>hGD|Jx(#jq<)~;UiqLHleN3IK~~1s)I}+lFTWkW5=Xv>A_!Waj=3gGhqbxd zC`~ZpN~JrVfP8$B4owX+I6ePkPSX#q5&uwo+3Wm;6#8+ER1GnL&jqBllAyaGWa}4x z(93B${4IhCON+^*Q;{ObphZU$%42%w$ZEe%({xulwdNjC)})MseqY8W)jVpCRF;a@ z>*Hr!l{rtEP*LH}R0-CsZQhGnh9G~`LRf+N?u6#^&kQTjQLSl&gW6&UR&_P{VSlp# zi>lh`6wf)msl5}5wp4RE%W?N zzTBE6KzpZmbB+9t)ve$310qAWrRUm?_sb8O((??DI3fEwuzco%tOAmgimO}wQ;nvJ$cLMP_aOl{Za?>=+_*SvKb|51oVxQ96MWnDdG+vwE^aY{PO>x+Nq(=*7HO`#m%TwGo_*CewTf!rHTA~a>?5I= z{>HYb=zd+`TDeQ&c`uqzYJu!CC+=O@dCyET)9XC07IuO_r!sHi3=15soD8eeFWxy# z?)tcCRhtwZh0k$IlKt6~4S+=M=PxSbG;qlZTHSH5d7BavKw0*$RKh|B(XgDX!x^px zA*^3b8^-PN>+yE$s@zYnz6!i(Ej0SM=zETKKp(e@Dyv2tETa}q8{0!8z>C$xTUTe- zIa8V6Y-eSTA$++ix`IKvMbdHVVLY;M?b=vi6 zZTM%$0zv$3m(sd^JDnu;eXGJ;KY>wcdL!-m(RrR;I={8dXr(Uz4?hhek`S%W2(3mo z-<|z23%X^kKDPr~`eM&k6jeJ3;+M2AfjJFslBP&0Y~+$o%3xu4P@)@`KgNbS@JMU> zzn4EFgn`uZ=N$H`+aVv#!iR9WLzxju4t|W^sRKH|0TBlK91c$Rj1puoc~`C9e*IpM zh<^$Wild`PKx2+L-eB%s@v1`+%F8}&-*hL{FPhec`m z8~Qhg>6spjNmzD7YOp|0(BR5`>1sh1lT;m961YG|xExL1dSjX_0*UVEX2*2=(k`RO%2o+Ls`;tymWz+h1AS94sX4r^^our?g_+SGC=XCixgI)TbfGx z4iKR1eQh0i^FO=`Pp32v-s4s%8Cr&5mfN~`=ESWpW>@c_VWl}>QKEsR=hL$f1V#rY z7>jNU&wxAM(nwL`5blQ7kBKuPI4P!Zc658ANc%tt@lEwh_oiQOXyA*#*Kfy#^q)@n zXzjN3Pwx9O==8M0;N_3GGc#8V%;G(@E_ik^Ep13fb#w(L24_DS{|GaxO!~++0GD2j zj|$`PzMX#rYY{@O%&QSxT4tHDYFbJZT*;LS!HXhgs_w*iiTmfKHQX+H0&DoR=hq8M zvha56le2hT$^E5ugM${wEymG1YHBc+UtC+=9L>+J`T@q1+5z5SX_AfWi>P-sB6RBh zYz7!QMHEWh@JnF+qd#u@&GNO<~I?oh|9nA-4#~~w$f6V z9B?8ourGGt@&fG561EV&ZnjRM%bykj(6fMES=0I-9x0@*=Dj;ii{n@%m)4wp zxIEYPF$D8P%hlmF`m`^8!X4MRXSDw*3Ig3RAgdpCJMU5Tg;Mzv_^CGGLL05^&8?6p zO`N8Cr;t)OS2?gcC;-V?PxbWY9yp|fpi=!_xSzw%2KE1*0)ZR3I51$FGu5* z)-SwWsR$eA_H@b$-xsy6-4x`?JbhT%YVCc<2AK6V1Zc2?C#Le${^?cZIF^F{|MV;D zV_HNUOvG$)of=`*=BG=E9Vt)7a%(3Qq2{%eZ9)gp675WZh9tz)EU%Q3QdL5L(=%9{ zJj%8{p!+Oul`!Fh19WjN8g0IrqiO%9QMFg2_Lk|&esH1p>gc3u>xZgVMn~ItML+gG z*?3lOgD>P%)IQVM1EM{TH=KM(9-7BPeYGwGc?h&fi$6BnETL1EtZge+0;%$x)X%-~ z2|20hLcW<8Ks_)CuZ&^~#AQyM#RC5s7_@E=b}97504pWFuypr?E42lhOUbe@PDMV$ z6w6mjU6X(BF^IebzhJCMyV>o3QdjHC*$J`sfVkm-Ea|I*f(hE|82uLE4Np}*%Zfqh zDTvG3yB%1ZmicZ_c-0}9_a1@wf{UFp5yr=}LJ@SGWM-@zXj)YW=UQql#TQ{4+OLVq zW5!Y@z?M*$Nk9=~tWrw-^4v2!i3AF<3z%5qZvmYI05S`La|9rGr`c)J`NpGFQ+b`3%EBu%mkvnc8 z_^=zsI;ku);v))rO#F?T0(L?PaK$c0TL_k=!($D{;+VBwbmb3jlItZ!CjAJ#t@lV7 z4^rFT_ur+DUduT&R{w9)+pkI6%tC$nu^l3+o#~ZG0|bBklV~iYO{aN>VQ*qU-l0P? zNvrL@-Sgl3E-#}#b#$92rM`a&?2zCxRNc|}M`6!o4m`CS6E2v@AKX+1^&Jxlu5gKt+4B-8W$~q)LkfRirdGTVvYTHv=M(>Be#~&~g*TP! zJM|;i&UMM~d0xOZDbF-jH7$>IV*&Hzg8QeVFO=1adWAT*g;mrBmid`UU*u|&?iWk^ZdmrMG5 zz)kzsC5OD?25fzGsBXF-I!I4gyjQ8Q5M8J#cMX#tCY9}wa~Q|pyQAla`zHsj;&yzUaG(1Ba$ZIZaHhVM8JF>@ zwp~#=orNOu_mS|Jg_2?pj_nLKB_aUk^O)o5k^a_wl`uwH^29k~42prY)_K(6J>feq zGd+H@DeYzK#>*M!;~tJG`c7e!HZiR<>}co2_r;bDf&6mN#1ycYVG&lgj}kjM+O?yB zoq1#fD4xEWtgv%>xK|T$;O=si^Y-LH1}Xj;cF$DiRm*dS{o>DpT=tfXH1%0Li>wj3 z!AMM7?RgiQaDpRsw>;~}?sr1N>heU_1<_04ZT3>aHnq6NT1I11#K<=Ihh^^O-EF zULL3TI&Ho2M0B;YwF`a*#Ahkgl3!c!1p@B1a4Qb*_+n*u68$DE=U)v8{4%+oWJUrJ zOLxyza33GWI0&0^8)0J&_gAOI^&#mf&!1vccROs=ULflu+%8F#&f#1sV{+lgSIxPnjQ) zj|-KjxI$`b$xNxYTm++k24%9KPxyaZrD~!+wc{2jRlVYDMWI0BJQXb@$mK1*nqd3? z8Q>>jImWplB>QOd)#l-Atc=%dlD1m%OA{<5%N*c5>@UCY^kmr@5aylW;y#c^z`Pv4 z72w_8ET_LxZJ-(__~FarHSaBD_Cp&XloSpDr@_kS?XSs-9L#Qzl5=buqU<71K`&+Y zt5eLCuu`M974dv5qb=7ScY&Zboh=+p`7qxbRp&#Ijx0f6Fw@8$H~?W>B%c1u868}P zq!%$7&rgFwU5X)%5*_IYP@X+AKDG^(>HEfj+$8dmd(-=T6x5aX|1PY!Gc4-gp(swr*8_<0v^VYJyH|NJJmkRX~?Bjj> zoXs34!P^LaKxs14LnKb7LuS2;-)grK{=)tQWu5M{IPW|I#0%@B&e{5=>D zsr(%tFk#TUB3lX=M8cMfAN^Vp?u90@9MS5gZ%IlJU&>>lHi)0s&T5hr1Y zWhjr%r&|JNv6x7{ol2VQvP@A*u}`pUFaKCGy|t}w=74eEi)?7Vp%D>Q$|C1dG)Mawcy)BV^al`u zi5bUP^lGKjlpB|oHz1==g@zy$K$Hb}|F!!~|^eiaq2F|jYmNZs~PEE#6Q)27agniIdKkU6hXCA@^ zJ0=OZg<8ycSoTPrsnWi(tn^c&{0>tmC~kov{VaaUev!?XAcKV~j`4pGNM}j@v@u)B;FobrKq5Ly#8vu z*H`O_1jOj*=QJ#X>SVZD_wNleDv6bqDd@`Pj|NR;{EvtN3+2O<#tx*?j5BC z%-Os?gP?t$n_A&yRkOG9a{5QXH$As~d~OBzQ?W6;b9vccGYvdB&ZRJ^%tI&@VoPsG zZCiHaprl#eLg!XqASB11Ek`AQZRxO4Hn|sRCp9E3Ub+7qzsQpvpy)jaSE0YCbCGPZ z9h;=4u4iENAfgrpK%Y5DjncsL4Ilp~S?A>Goa^|{i8Xh!e~=h4>h@Zw@O=`(GGL-j zfO6ZC+fZYh9(>bOW*x<+EpPG&(yG;dp})pxEKO7z8szl5nk93jN##G-PX&ONm$x_H zY*QDQTrNBA&EBV@Xcg18g?SIgy*PMtB#)(~cB)YZ3X?HfEA}xoT2fUs{&0+zU(3B7 zkxs4Aj}rO}QIEf8I6$dILEpHlm+hKoS$Bukzxj1C7kmFHwegU>DNNk^0Him_r0=au z*&L7GZEj$IIxBo^iW^{G!z zB7dJJrc2f-V~!2awRqj{Z!gQZReG{X`9ha@sOIoi?^PfWNbl-;rn+fyxE071sV`@w zdl_Yx{a^l^EpsTn^ve9^&Ss1`hdjTkl@U&It&M*cxrpCnRR@#BE8Q%(#HzI#uq-PL zVT$3n@0&m1GjN&zFni+Gn+=ZtA{K3)SUCE}2%M80>)Xwyh3&e;)`b_Z89=oApkNDQ zZkEEPYX2>%H4k!B`=1O7ya~@k6lyW$&Wi7Eq!`>ICyN)!AHG{B6bB^lv+i0Ae^=%I z)~*(P9i>0LJl2l0zX_{%?@z2*=&?qDz89JdcNtEpYv@HS$9PL`L8z`ryQlxW^}3Td z!{vDC%@<{KlODkne~hAg=)bQgce)Ip4S`_3EHvLv>k>--DvqJ7n@HBNNN&-^Gcj>` zF~3Ka__X@gWU+cI(tC01;HVn{VL8d-|0l0|&mc z%q6!_jB}$6^Q|(};DC-YCJCQ7X84bUiPZWZ-Md0`;eth3Q3FigV4;w)EDUx4--K&< znu_CTfzlDG8jtRtQ_%HXhH`a5t&*LRZU)98bUIF(aM0ySXvl$YoJ%R`d%jco?{;px zz|PAyG4-SE16_?5fN(#u5ep9ca45_rHJO-~h0CnD*&Ov~Igk(2;_7Os4!H+baSJJ+ z&6VS4{PPwKNP9ifNi}1mwmy=D{ye&x7eY*)sD-`wn&boO7kk&X23t-P`*xZR&i${X z3pr|Z@Zv;Y!-JiZqosMSztMhWvSvgu-QPA|If-BMEy~^zILp4&gRb5iHA|jB2nd$Uuj-L*8$QUh0l%Nz*Xi2 zoK+LpZe$)h>-^Wh^920;nM7b_Z0GRDq13CXc2}=G?8*sAf}t>b;yrWdm#L*}K_>VK zh3d=Y8pE;ZYBUJD(ju)@ca#jiFhg(u)t}KZ<=(%SHLwVI|-PF3st+4B28)7 z6w4>#iR;sV#(2u578kkzvHbLFe%wu_-JnQ8d5Z0OrOINngtua{>~~Z{b7zql|Ly3Y z#P<>0`nhWc*fI4K{fow2T;DCNe6jzlR~Jhe%ueWdZaM8+Y%~OlR)b z|JF~PB&PO%=coKw_HQb&9~U$;8k*l%=C`qnW--L$%22rOX=Zz1v8y9)v@{{NB1$-5 ze5hQL%tHmSRc2{n4Yp&-PjF2AX3ICUo3BX&$5;-kLgfm@P;KH&anda9(&F{)?hAhK zTg($5EW@c5g@&Q&ewy6{_x*??P+C@bUWVHy))O*1EInVA_03@a13_Do^q*Yg=X?y< z+_oCKaTy)5 zLHF$cAKRPCbK7$3cKfqjg6iPYtuI+ zjtqLIc0%VZm?iKZ!!VPL&&^n8IrraP1*|lqQ!}~D;H-}IFVyN5H^A!ikcI>D3$>#P z9h_`A($$_1jjCTlt90G9M7kgpG$f-XI0*9h>lc=xtKFx<$FcI_j6Pk2Klc>p;wT$y zG8%tzi{>@U_gJ0wZme@DKkAC0gFh%05MIl|Ke)Y;r${D2G)Li9i=bWz_E9`Mf41Y} zi+NGB-F9#UU!`!RKq@`yw?fB|*Gu=fVqN1)k2$h2;Z%Y4AIK%cQ)qt~6u3YE`F#%+O zf!C@sZbw0;M{iS5d^)Kl(!*)D?xwj;MnAlsd=vpsYL@dUBlaxbR#Bc!OAQ*Jpn;{K zLoVjLEDtio0O0<_GlVOXB(CxXG13B>;V?2QGxG@kM!OkO6RuArH^7 z*!(JP{P?w7?0>~EBGJqD(~tA>P!yy;y%Zm`5wjNQP`s5%XJg$bW3_DfBGE+WDEz?g z7UD|04d?TzP%t^6gY9Sh)J%7c1(lMl&m<;)?x8c-dbEKCx?k0iNxkKJ`Ex&$ZO1ao zMrMphx`(2ctmvsU;_ck^5V!<`1@PL?c0-TruBa{3D$Uk_DqQ3S?-<+c1|3~icpklk zRf-X6aCf4k`AR9`^M@}J)tLTpKR|z*?h9T%h&4y{zS^jybjmo?2W4;B)0Mo_usq?I zXF)>d{5Xkk)3v3-m%rNZ~PBwdD=y|Xzd^y_w!{7+BK^Hf* zokx(1`P;CZy2!)V|Es?cwvS_GqPn-=-(;6$;<0UD9n)!a8xmFXvrA{h3JEWab@0>= zx8TB=oaxZXV)TO^r}fa75n-2RMG~mg?(MYBm> zzC<4t<6hv-zU6z{0PK6x#H7A34Zb?d0|#sRest0m(jy@xDC?(B=iiorR~jN!FTYJn z9puzrLHZitp+&yZCexaVA6yH>^}rWMF(Omdv4hAr0STNz3A0zFtB1;$h5S+KDIMIO zd=zIP$CY3qN3H{ERbm2ITY7yRecfNxrl-_^+m9+(xP`t^l_x~1UHlO(yXGbT$3vG*^;Pl@scu!CVjL4BiD}2dw0eP zRa1m-GSODs{qg`jtxya1XLl10L34xTG8(xlHXxIc%SJy8NifQb2-GGIb=TTCwIL}G z+5(N}qnnK2P!vH(Lj8NLL5bey*Qeji$_?*jNXOlHj;xVH*P9(QGVwe=sVl@r&h}8Q^-=+2HVv)d0WCI~g57T8gGDR@sc?C#|xlV`6jK~$EG*Eslw{(bzGdnl4AZz`^a zE8*tf7u-|=nIxn$SxGtGCSGNnYP*xsyT8Zsr1el1x*fY{Wc|g){Ii>T8NZn1viXO% zco7S58#}aRN%PR+fQvs=S)HH76nB0=U!ldeImEwGZU^`g7o#`llvP_Y{DCi1?1OW3 zjtZHDV0nDT7a%sG-6dc^YpUV_rsgs{ft9R#LgnyC1BBIj8T{;|=m%#k{nIdT#w%sR zO1xZ44a!DT=(8+&Sy~}h_!r4&(5Pi6*eT-E6Tze3P)=%V7u|l4L_^h~`$RVdvncL7 zXkW?5Srxw|aCbDzk|ef{O>NM2X&ZVS22~*qEr~c@_ zT~6rYWfPrGu0CY-!sfr=OB4l)KvJD6VJ!*ts7?R0k45iRsS zU*P`q>e7X)Ovl|#kGSqxYT(8**?OMY@K{`nBWYeBdP)DFbX4%f)$A0i`|#P~M@BAj zGS2r53Er_;%c5|3>9UqFJ~G2w;kxP)@ORjs zXFB8eI@zDX4cR*79M0JNy3~f}{wn^zy1J_d54^TmVQ*j9IV`Z}aVXTK7yq3|Y^(j>B&kb-X_- zUZp4g)9=V3%J+qqRCi?vh|@bE+5G~4G_^6LeC8y18_BTBB}b{4I(Cb$$M_0PB!%AzT!C|cG(Cn@0e&s$@zqtaVqD#d)k!wRrbvKZ}UsN?SH%h%>yf8<$& z&^^ zM=?@x$rb^LuiCSRP4r5Oz)=bB9hNgZR6v=7+Tif9W1j;oXnJG5jC_j=s} zH7vVRRxfqJrKLrq@Z85y8tIeI4*KrRMebkpq6U4&L$eRZ$u~sT4yuY`-4~p9;TG

    3N{`r36|_u%-b! z_Ql)LJDh{i<7|!M5Wgk|022R$(;9b$Z9BRZXZI7C0SO=4B{nr=t7qb zpuqa-R`sM@lVyAPXgXJu_JxLNh9O;Pfd&04t&<~+3I!lkta?W|R*XoA{7E$VLTLwV zApa&DzqtK$#ihKv7tSi@O=pMUxm+xEt(-pak1ux|DpSp0kC#ek9+wiNo!#;8_wNT5 z-dc&`95DD4!fHpWcRcJjuK&<cEhd0YB@fHIUye&+)nJ_vAnMLt?y9X)niOQ4P0w}{pJ(x#Q$!gJ=b*M~F-P5Hu5 zgr4(X?5Uf^4bUrDLq~PKiI?L*YHGv_`pcio!zaX>jNlPT>NJ%R^IsAXCKaED|M2#1 z1WL9*KFAC3BGMXR=yecZuc|dd^%$vR@A-Z@f-O9U6cb^LK6|rLrS}(;YSLJO_6Xir zuWP5@+joUNS@#7hy1fvjmi-V*a! z%P7r64e7)9byV>*MwpXZAXE9m1=d%?d<=4R;6i)`ZE*rNN;s4f2O)aIvocR&uRbmZlb&H;4qf&^ETFvX)9)ym^(pP+C&zjTCHvqIfTPms!-|FC_(e( zMEkQu1-SWZ`(Lzse|oRG$p;HLiUe!=$LfKb`x9Gd3|bJc!p`G&W+buuxg{9(uFAGx0`;*GViPu zU~_O$vf7`$FM<(=?&w$qc~F9L!=)4vOyJ{VCDoshJST-t%i$%O0_RTJ1ykMkrKYs* zRkG<_Cq%U_HR~vOrGL^WvE;dRiiVA&X9E0hLh|#lpvB~)&Dy2SLU0~)mvk@O{0j$h z{((EyE@qR*3Vmt`#(jcC?nTA!>rX$ocm@78SPV3;gwKTs7p3Wlz#IbSuVDLxYKi5` zCB#d}Y}y$QhNbTg5IF|mV7#?mRT*zPK+^pM%8NdipvNm}9>UhA(tR-k|F;AlcC5gH zOEQ-`mpY2KXl7!9)0Xh`)X-*+Mlybtn8Z|a44cLciLrX8y0lk&zHRkVY@ZZWexite z9ir}wgLu1D(p<+<1>Dshl&5#>B8e4p#1erAu)<$(AXCYvv^#-nx8`+kcqYEFH}$ix z{7ordD2T~He^&sWWf=fyP zdU7<#%nW356u+bz;pFXk@wn~>2+ieFSD}Ue^#ounv`b{Jlbh9(Y45Z1%tjKqr9oM&~Dg0~$MKRts`>enu9Pjrx z#jzb+ds4N#)--M>f6y_8Id|@d;+5C2wh^g!>w_r`f^*E&K)v!`cN_fU4=#s|Uwr%|fZBxHZXT1HP*X(X;3_ zUbhlt>LjzvYUEM)2N*hmyE{=w)vD*!sb#4I zoc}htyT{dOwYKFF8V-prKLw}$R5W~*Bq%VJ{pjuO<-d0|T)u9E+JwW)*tPUFL}F+5 zG1bJ{4J`8DNpNH9`P;$l9S2z_k3X77q`z6(K|6^?dZlR4LW66yEVxuP^R)|?)qusR#ld-#F1OM9U^=BfOR_Fe>ut|vHd(z?!_z?&QT_h_kwP)wSvCnRN3SE zmTrKeO!XNeAuav@t{X26xjaw1hlH()(uo&?9$urP!NT^-r|VrOI#USybI!WdSHJXK zuNTqktyE0a^skb%u-0u%8=7A5^G{))9Qc_+xM=4F^L?X~itrEv@k@#Cm)B?8K6x=AL^e_Q~nWg`j3 zWPX<*tWT9C(|Scz(u!gq!?=KSR!r`0uwt$By0w~b?2+cm#WuLK$v`~zJ26O$%7aQp zrAG~h-7e5tQt*i~|4o9#un~tm?4jB1`-)Z8g{T;05Si**mZulGpG{|1bFwm2IyB}d z@94ouQ@M9b{<1lWyz1MzUdh#?K|0q`l8D0shU@s+;m#E>M8y0mf^-ARd5dUld41p&Yqk7 z!p*5rp!Q#-1$#nekyxU$*P`AFP6vrMEI@+Z3<9{CmiUR<(pV_#u~eE`iWW)_cet+b zy+;#na(Bn`aFQ3Vo#|`;OW(y* zB*$BONguaGhnJy1PiTOasw@b52@l#aPs5SJ@y6z|&8rHLHdr!yU3MxVwTij!`nw1l z@mP1?T~V+5!4@pO9_2EnS09|h0yS0KRdP>O?-PE4OZN_k-D#?1f|^Pzalk8OmkhL3 z8=|19o3K5_;-lB;tKRYbF6Q_*-uFu4{yD#3kOw&$RzS+<-Q*h*U2kan4IQE>JiY#4 zYx|dRak6Q3{T!&wf-;;JQNoO?YSD-18NBl(E;;WvVU4+U4dE)L4o`czqWi=kn6BvHX=G++4-tQJFZE`=r^vcW=s=l#{z+CJk% zv7C--Q(e(C<0myyB(9(k<%MMd&)-AkDs=S-+g)ToMR-GEjDS{TJZI2JgQaYab`L5{ zQqLvn8h@JHQF4WSln{c9wBQz)BtDHnK6xLLUw#s{XQMVOU6{Txfp}H9& zFCCg%xEPg1FM_mnIW&=Tdo-(T$6N@Ed~~q2`FwLn+mg~ozGX(nw;#A!9xP8=-Ip3^ zS}oq=cyfKlCh~{?{^_9EL? z6L`X(TB*7thtcD~O~R}nZB{$Gwbk$~AE!C6sZN*gVyZheC4UFt9tmX%F<|}8(9J3D zF3xxfY`!I6&O!o=^4G_sljr+OI-bC#7f;ju@Hz6|0BU%p)AaUsv~k8cX(pf>EoUPE zet9^DN`P-W>!6WQ)i>pKAt!zE=%oa)7vjcDI#FQiP@eCp{N%8^y+!1O!32V#Bx(t+ z@$KW|c3TJGMTSm&Sm7KkPzy+A-X@1}IQVo03wIJu_U*gXX_fy>Z#bmj)9PYzE<9VN zUlu4XLDpbkH1?4G+S|xF2#XJ=g4a(YXZw3DLuvCDwZjoRkGnxkD$ho_w#@J6mJQDG zk)QRu%fh^ne(Pysa+m{n6VyVYrL;L|dCd$!Xi5SvejXQRa1>gyw>@>FS*I_J>!~%Q zm41jxW~OkB)hkBRdA@v8p65kBTivjh2MpEX0w*cG^SBtXJZg!UxXsI`F3g$ZzG?MR zV4?&5{slsZ{QK5AgmfrBZE7iLIk@0h58t$ys%GCm`<6F3bGJSzTdTiu^7g-M*# zycycs(f&Xo!>P93{hiveSRB#*2PwofG8dH(5On(7{ma=0*|4AmU-^z_tYWuvDXBvy zP+F1J40Cy8$>}K*adG>u(rWTcSKbpS`^)I<^qcY^9@vflFs>xV+dv?~xuKGwcPd{B zJ{rQ7+65W<|MWXx%^-)zoQ})s&FYys*579IxxzR!2bERs6+jljVIqn2S-S>(L%VeR zwiCt5WMa5|J}oZf;q&;j`OuRM#A>+>4cN?eMrc9P71%zo>mA&YSHM|XAx52E|p6dz84 zgx=(O<=u?*M9?Pl)P%B`s;thx!3Qd!%v!P&5V&Rq7L}hCC`g=1Lm2aRdrK0kp~4$=z=k!k6a+SeL} zE_{(D3V!|zL-t?%jU#F^cQOxXDA`(U&*14g%FNUup2Z}|+4p>H>9~YSWlhr&c1ev$ z8@2HQ)6oy+z^N4KNeXXlQ)U!1-ovnkE}xWhOI<~9tE0S}tsAyAUB+dHG-o;Qaae?iNNg&s4Bcmpt z0Jgbus=fdgpC+pFo^SIe0L1eMI)u zc}yU{(#7Ialvq0It2Up}PMx?@e;@ttgd^qb=RDp=Sf>2-h@4(DbXJUMRGSsJQ5*z$|}Xe+qUo=v4J3-OMd<4Vrh$u z|E#(7M@VM@O7)Rs($$?ln|wOgD6}`2%-@PIJJ=7KEn~_Cc61S$hk4_xEYM)%oB6sY zKabOy?L>(uYGz7ie(Md5`rA>9RCV1>wdzXCR0H9x&^-Lu~5a#@Xq%KUd^Mt?igDJCHAH zPx?L8?)y8krT5($80Qk zuoYRwA6r_6BvxYEecphfJS3~>WSpkEepl5*mQf!}X(epU%H1(qg+03h+T)EpO_|~r z?{LDAIvBJex3Of&>J>e+P%>vZk>iI6lxz!xpW`-M20R@nXaYN(k>;x#uT|Pxso+Xt z7v!W?d3EzIUV9DC@et8lUc6TYSvdMZitD!h#Dh$+!#dtCl7k3VMA8=^ZR{VFK?}!k zYXhYEQkHTzotx9mcz0safFQ%%SHPM0@xr`Kk(Z8p3cb$awJv9@mj29b{UfobFHcub z>QiyXoDA4ob(R-SK~<8LRXB5STx;HX2+~M&fB~BS=zxrZfKp;J)M(_BloCAtZ#@zO z&PI)H9qp!~O1PNEh**_*_Ug_1#j_dB%ipiKZ0d=5hgp!q@!!As2-z3Ftv778NoRB- z5xu7`HMYxs&jk-vU3#G`{LneTA-$UYLHWxr9f+O{Ir*<(<8{Zj;o_*TYDSn#ah}nMDCsDO4epc>bY1pY1x6m zv!`bdqmu@UL6TFPw0SWTcfmjgom=X+y89a-{ZP}flH;g!rKrV8HlO|lY3-K23FlnW zJJHLw#sMtTEu;g9#sM8>ZI!22=y9G#pLf+AhI`;BBzVY^l}N}oCrZ>C{NwCxFiI|U zJI;@_7m)D0h2LurCXSlxAYCz%Kqy8hm8oG82=H9a@%#>+d#hvgDs4BBC_oHBDpB0R zAA2Q;{05IGagS-P7IEupUJ75j@&FVtxYkDa$M2s_E(-2%SGdG3w_Zw*9KqAx9Z1_j z4|pP%w!68ZL(*~xRo-8+2(BBBbTs+pdmMYxQSJMq#}4qugtt|bcz{@T8kRl}Z>$=K zvg*{aZTp0EG`I@sk=q{vYDh|OHl(lKL5wOzA)_ViF@JEdO8pdulV>>#c>^S!mg9eL z4#r(g(lV0^p$(Ds*SGI9VEK0bZ2_96GUyRL4&Ig_Ray-Iy6&H-y_(2QJx@bO}H@#O|XxvnD@C$*?jj4ce4pLmEp zcErye9cnJN-Z-L`#Mur~oal;Xggt*eo%yYwqc(5O4Ujidselrug)HEvy z*k=Go&&O}9|2T)j>RX5m$E6XV%I*5a#zX{Sj{=h_P4J#Q=*uS{h3ETaL~=2M>JVfh zj#hs&ftLxJvYVHe^~pk8Ijmjs0&VS1&;LNh^O+Q*q=vKF)j%c=SKrIoVUl$aQIh?Q z_F@QXI}Goc=M|+EfI*t51=8MxV2r6H2QWjmO23x!BI2C*+5nLG(P|SPfz~N8y+=>ZDtp;~=B8e3>RTz`BW6s(Mu#aL1PffGFT!q##z{0S%49(M+py( z5T%`JT;A@B4_Ib*+m#E_Y_4eis>Pd+8rM{;E$jZf!K0L{ zD}p~B*BN(fYKJKE;Z9m%;8bOr&2%0LMTWWko(&1d>!Tb{n%WG_hCxq3G502l)-k+i z@In>j&0$kv^RmJp>ywL##B#}IfSHz>Z7c!Q@#%mIHqm2d&*7_Vrgl8=x|-+8UuD2b z)`_iHPP=cBC1#$Crb`#CP%2Q$%9e1n1*4uMcCxi> z-yk17i~BeP-tT@Qga5O;tNdsV-~yiM+*^W-!2p~E4h?|Za7NPDN-=ueWWN8v=64)9 zv<3zQ-)(YQRJMhNajo-utX5eRUsb^(BDm9`sh%-!oIZ+iTZ(fMW4q`>V~A);50<=F zU8xSh@tADw$LY$ks_0^;dNF;&ZU^d+TRdSRe#4+D+c2E^bi9hmG&UyIZuo%*r{C9Z zzsV=g=Orih>`h@4#I1>%m0i-ohG~%Y;}V`kke50|$pg%zvyto`w$TqyIAKW<2t;!fY5GO#;G01_R7HTlKEIoGUj`JHH^iZk( zNMSF;Za>peSXA+o(?|KGR{r)KmiceWIMVlOo3C~KZ5qa>HPBd%S2)Z~<5yaIscc0u zib3}E_pUWME46N?oXm5lwk{u@#^`YKSSZ=NG^k&mP7X=%vHW;W{8P|Q!ZhdS05>mF zFP6^HfKqBaCfRbdQN)&)xv_X@6FzX{x4|mz+`cA&#zU!o(Z1_;BMbu~dsSh0a_yCo*qb(BQV_ z;_)o`kBX%-JJnhce|TAjl+K|^=l?4H5wVBwOCmT57scjdRp*y;TeO+zGgXxF+Rv(e zDf4%CFVEi(L)~}?!X$0rM=uZdRqQe{d})d&l_fCO+v}ib@1~#Pf^fRL?)rh|E&F@x zN){4D%uZJcdLNWp9JVCOt_wa8RkEbvT>u9Enpc&XA0@3dkMF)a)i^F^FLhAN!(ZaF zU!JDbvndN-2Rc2milWmjQR0kCxhz{)J*~R{rtCLaB~!mXj7qolYx{Y9`;ipi^?kT0 zvjRiskEqhAn)z$fBUzqSEx%}`7;Xzz8utdH;z;^?oBGRTeR{x4J!Rd z_-@rG##1YlVSAe-?Bv2(nk*uDIdX<@XZA9XWeGycQwS&0Y)5$qCm3y04!o~docD^4 zmzmGy&)_gP!HGOYDT|ChRD9?trGaGX!s!G8SGjzlLA8oz7add(-Q@kwRgT0>?%9r# z3as&*#>oDpj!K3#c+(cT%{p& zk9%^xCQdYe8GY-dL1ckVO9+Ull{)2L-F`fqeMY#v8*NbV-OfMCw&fuj-}}!fr@=2& z)9exy8>n)CBA=uc=*!9NSGu7T4HXEec0kG2gc7HAVW?|Zr*pkVM(cBa zz886OT^h*p4AZ+-Ptm)#v#*Ow-;H*8Qe6yylw3uj`#coiN;PJ862s-?c~>c>xrh7_ z^qTZ}73l9z$6)~xYOBR(sS2F4IUMUWDL*=2oo1R6(e6eo(|Sz%8-2PO9nE{jjxsr* zuo<`{gSyS^hxHfXXUf_(9K*%sMHKw)Orq^`)Z?8OuFJfuDL4WD1&GARinPu%XZM|B zpik_u>U!poI;GMKWa-%jLCBG+HnfNM8)<>YC7xZ^ zid}hv2cwM)EottBie9*V@Xe`A`vv55nSqZ4Q;w~gRfRxm@vjA@j$J9uS#Hu9e0VJD znx3bXp%-4rp#Xa}vYHvfK|cSOUYE-~OnY{nFdVqelcT{`EuMhXf(i?kQgpdeBZ;vj zz`NoQCgWPNhNJ}gUbBfYB^*eOO{{RafvhWMS-<{NNY%yjixB&!ke2et!K65mX@Z(T zJMy+*#Ob$?(%#_OcHfqYUeX8mv@xLUidb-R27!o@zbyQ4k}Fti9D!GeF?&3tw~*e5GIxqQT`> zGr}ObZ;n$+z)M!=!)%XqEUP!VmLa{8QuwX39GLnF?^ z&CSf)H2;QOe0cwFBq+A-78MGg?YaJQs)^bg6_Sen>8 zjPU;MdUVvFtlDjt&V`r%{5x0Ni5bo<^~Q8jg9&PfCe70LQgg=!nz3cwAeT{#d9xce z1@(_qfsEMfbAh%l?;=!9RW8;a5w`S0gJ5M+LptE_nZ+13Ij%2)Wm{YuvCaXB*}7+g z^0dvx`6XMe_+3U@CDJEh4(@3E4Co6({@!Ou_9C$Fe&h(NR2iN+xutk2@0hLi$?4=H z_t|Fu!7QJGEJlxiUU~eeJ#82Y(xTG5RgWuC6Ql1RZBZgG0m)7ou1n?*tTile$pLuG zw;6+{@6)=H&KsmT~kG6fjiZ#)P204SptayDE(lYKe8!cutNJj?VSYk@j-)cCi@9 zD#*vX2GcSm*1T3?80E7w}vl|M;WZt`hSoSyepXQ4-s zw1$fPIaS~C-L!BzpdTZA*34!F%;&AL(Bie@^fagm?6OEjI(x@6EqOG)eDcjr#ZsTW zQzw*Ez_!01^&vsh{1tUMrh91lz681JOY^Aky2PV{aI2SF1lv4J2G-+z!35hub zp17c-g&boHcx-{QSC|G(ohjYqD`d*nVYs5De<+qx`}AQcNYVEs#Fl84PITB%ifPRY z`=ot0{1lABG9sn%`OdNP&Od~P@CWp5LwVkGhB6Uf&6mrx8yZux>|XOJ;oTBCm-Pvp zQXl_QDG?oxW`a1fl^ojA4pMXJsKlzV8uzh;-peZhbkrveBebD`WV<{^d$1%*XYbP6 zWe#+064&t!39`pt=H+;AeRHF&{nTk%e51t7LlU|c zO=L~thil0*WhLv@@8Ji#eQ& z1O!(9J-HvmB$M{`kR2GK##pXHwc0{hrHDA-Gg34-)b5Edu({#&n+bau3dG)<<)YJv zrqKU1diYcNNe*(;4M7SW*1r~(=W;U)ndm65ap^FeV03hNG8`=!g0=gnD;|H|9`w^Sq4j+1G;S%Y7o5sy1~pwEpWBdk^_84Sh8O;>jy)V|9b|?a=~JOz z$)dmKb#U|VKdV<`1@=Yn`xO>+hb`M6(bfqOO2$R8uMNVuTvF&%v;#kQIm>0Vi^wEc z%}>S2x8r5DYCYQaRPVviE9&Gh@Ro7am;hQ3f>tOb_lI zqF;dvXnCi}G(nsfgrZ?Lt7}6VxF|=JNi(D@mO#RYO9&trKl}fElK^~SBXha#6_7kT zE}{p86CNfaD-a;uQM?VicHYkktfu&`(;I`iL~uH-hG_ORKHyw7O^9BF7y``iqq`QWv#8$6f&2ox zE$>^Mw=wuVGA7DgtX!bdDPH`!NSwF1oJe#Uv4#&JRS;-S}SjluFp zf;$fy!>nglF^o93??@3=e$Mf|=6S^pj~*SOC)>q`RQL2A>Ne{jPV~YMH9ul_ALPMm zJ`jKb6z-ekN;@q)c<6xa-If8-#m#EJXs;iAM~LBr=>>u8FOIKGj;4z|D|~hSvF+UI z^md_y{5oSE481Po3GIk2ldjX5NS#(cnrlEV<`56{i9?w8?NYy=VoJ{O zKljsWKDAY)HIU?F3o)Ni*V{Y4kH%Vf)mpcOTdS=@?~u?=V%AO(ivR=7XlY~Wed?^& z(kL}gPc!U@nQZ&=H$&iF!oTnTa`ngRgycSdZfN+1nJqK32Kc@`5>gn~Y@-Qwraz z7Pog>xa69Flw`6$VUbre>Hd+_Sdq-Xsx6PQDbT;0WjaSGdP!f<{#o{WDfLx^v5?~EGSwWh`6Z8Z@055-BLta1K|vsUYmHuIuUT6RH8Y|( zjCx^amXeUL+TABSEToOTf}lCsEKS&ouO@!^)8=Ji<$c?^)`$gdotCqDOV$yN&B3WJ zI3z>T-H!UhMx$Zv;3H1j;NqvWZ|g;J!)8yVF~2Wl#1u)REC-o-LO2gD=#8wUR#`32 z_?SE$?XQmyYbXj^;hr_*(Nxj8n(*5c z^vh=^vP$!U_=yBhV4d7boDW{X_R(-!Q3pn1*5i0>c?P>CIX4xFADzwWJcuH&?PGpr zilJW!@Ju#UUvhB#T2GNiDD*_wztv(x;7lSE9(&o0_htzlknLRaYr-XcXu+Z)T-SByN}3}xLG zDJ9=4$gRvTu=-x>xF;z=Nn+&a9ai5&L=ewXRU_d3WEWhs*ld1I%X|#B?`X5VoIq^j z@@)}wu}2FfBsLe4?58wU*L}ljR5FJE+{OL7U-I-~fCnQr-a|e#fBX4Qe?!s+dJVVW z`QD0xz{@2EofY|9gYbvxr?YM_n^rVc7cMfc4J)ay6=3Xt<$F&8JH@$qE7PAT^@S1V zzbP1bI~7ym6ZWNIoW>^``&&nwqv!a3huVAoScSB7-hTIYu2N;M^GjNYkwJ-_`c^lv z;qb#k^1Nuh?>Ewgut+FYpGJ-oJ(4S0PrHSrm|txjj@L_T^&yS_$e<~2Us$?}{oZQN z^CZ0tE(KKb9p~l;blhlI{q|f&4$A`{U1&^s8Bea)RB+=H^p7d=i~C*;^dVIB*o5I? zL&O%+XK6_2#B1AyLjk(3JBZ6;^PpO$mV*{L){c z75_xx92>ug`dNH&OD0B^9(sOwqNaIk?|AcYYrKjC(`odr8i^jwcf~r?!q(*%sOmju zJqu5Lr9Ac08`Urs&LWi6$RSHWQ%COL+pa%fC9YHkKIG=_tc$y8EY zs$2IDsjQjQPs88h)0YScKM130b7dhI1WwdfBITz)!7aj`82u5_QR{|ip9*@i7rS%m z4bw){o%*2#m_r8T2!}7uKIdp_l<{$N8n8+V|p>Z8UM(w<+1P8urP7j2%~Z~+bp z6e+DY>Q}`F^>lHPHWJ=8k8Qs+Fdr~Xv|$=GITl8;Cw|;Q>aILfLX(cId54{gD~tFu z`i6)%=e^t`ljciM>4(lQ#Bid-xa>-!q>=L$dj7l zUnss9x<|hl1w2}ReqqA^A_f0zlATur>a6p4GPfPBM=S>|q5$B<6nV&u>7;#`u?3#s zp(}znq?H~;jK5yVCf5t-k&gOP&{|YfgISV%;6980c3$!k{=`yy%qiPV*J&hEz(JY% zM?(ZF-g>s{&hO>cEgA>AG@9|*1G?v5e1_`@&XbvS;}*|53=4ZXPoZ+G=y`|0rRKSa zw_m59-a-LCOlLgYB)98Bdz0u+yWb$U!M}K%vX9N9FiPr_+Clvf;bjJ!ADtXNTigHr zcZlrD(f-cK@z(y{(Zbs`KnR|M(U#*BKE^Kvkon?H&bl7}-425e06*yNS*o-H64g)E0UY))N$u9v$ zHW(QG0rwwlOF&bJA4zSrN~E#3;Vs21#3jr3MLXsqq=C+oo&$#jL8s5?L@?etNWcDv z(>#o|4x~5^Ra}Bb5xaDA<($7{Z1avqj``O=GkEE^Rve73xi}e#atpK<$?H&I`H^(e zLwQsEHqI|%5!Sc5^vUZ`z8^o%R%Y|t+xf@abidiozv+olMk?f`fB_*0F|{o-`Mr={ zvl(6^Qsn(N=WM9xFc5*FtFU8};V_%KH$8qk4?AU%C}@_Eok=+<;_BoAJgI>=CtZal z#fi?$poFf%iyKvtll)ZMV@73paRmv&?i9cSHvfOp{ z`!3Z0vf5G#u(|P%e`v5h3z^g;yz8;R(5;uwbpFL9COT?_7pqH z?yfIpaQg2Oj=Y_#MQ=;}@p&c}myQUOw2U-0O_bDbpiZ)2rzan6?JFE&sQvrO**AqJ z@V+o)tne0Nlmgx@0?JAvgPzmVHSHnP+WhKju0Ko=l@`!?xleFLI4Qs2NL&}Ck4Y~< z>X4kg+<&n#U7s!gCQ_TOIubi#*0LX3v!N@93JUSoG^A>rUi7C9@7dpfa56MFS>Isi zETsxV**<$O>&5&G06)~J_tpWaNG?b`SpDsl2)5>IoXim8=dL-~&le|Of7|X@QZ7U~ z@axNiX$MF=OVNi@Q>+9D1e>$&t9)sq8E2x74{&iJGh|Yukk`LJoh{su{AZNvflgD` zGK|f1J?&XPj+%A}+}JVJoeBOLdCkF_5DEn&;r@I8FOBN3L%6ZLGnc`iZ#fcvU+7f2 z#D&6=1W|m8uwvj*|8M4{ER_4^qkfxT{o(IRr(O4FDJe`(6Yoi!a_~#^>_b5U-0!i= z6~_)SYOWyBHz84$l)CZ-8@i}0!^hx*tj7thNakQ17C>9dT570Mu~~VJi;tUK~h%D#y~zBCNis{cCfcYE-o)RK$_D*M_w$&?fhAGXJBb zER{iLE~{@&^}o0oz*H*MSsC<>3|FDPFgaLUmKm=}%M5^|6Qoqfrvn{Jn(&Q|W!cZ1 zLVAmboiY}>W$IH|+ui*4(CzUU_P0ND$umIdgt?Yzgxz~?>Sr?Y*tx%Ho3~S~gL??= z(k5%6XG)`{|HW}NEV(cMoIy$O3~kxkx}D-4^Oox#?3ELum&U_EP%DCZrE9#1=1i^| z|1Mpqv!f4)EU7!L&Tos123g0fFe{bHQjvP8&2`GGOkva0ip0Bfl4@{2nsw@CZxg1F zJozc4i^uXcqD5!$84#PVWicBdkS=OP;zmX zyd9Slk%HR!CL>X7FQNVwZt3j+c?byth8XhODo!9dick|AKw~_ZaIH^Y-8+Ph!bAekdi;;k~Z1h$;dZ z(?9*)_hqKTpI?Zw9#d=BB+pSefc+~I8MII|D7oTIe}%zqB|-tX3J4;GM`=JnGY~9l z3p*zJt2k%%WEo=p;{+$wYJUL!Ts;s94i%79!NaiKt2*U44;_Vh9(?(kN8$YfF9x0N z@>lSOF5u5dw^qOJ8wkoN z%rLY6@VZ7aWIskLFvZ0H{p>I&K@iqz{EB<@1JdaGc^Jn13HT%IU~9UwaX4-7w8UbC zf5QamELv!Q)f2$0KuE%6&e{U*+T2dfP8or)$a8*8;<@9CaY}v2!&kf`%mpBQ+{^ zvwlX&k}51ocE{|ydo{Y0f@^*#omo9TBMHIbsepBtP%$6pCgq3}z>^ZqPTor(&>q|G z3+j|n6t8jU#4iOvZ-Sh;1BQ7cZT521$?jXdE|)7Gee&pEEu@seN>vUl(i2ykk|qElw@eGoj4m? zr*m>&&*hD?ktqr5SLBKEw|k+W(gc!4tqD8QuJc-MPjaGCR8I3C^|3h;IOg%&0fw4} zcf3?E1L)d|)Cuj=y=%$H&Angn7~Be_xpEc5^BzokMER#zN5p63V9g}z3ub6Es&eG< zbp?UDzDNJSB1U3=PV#q?SjX_VDsFPuhY#1#PxGsA-J8L%xp9+a&4ZgX zv5H&_JG?$W144^aH4)neweRcaMBV#Z9i&!?Rkm&IM3_?lQhF%WDAA3=RSr8%MjLSo z>mE?Yhd=)e3g^}fgfh5R85MVCOU~1pQ7p3SL&XGr0P;m6ON6B^gVg#0yC-)6w34zO z7GB1BLM$2W;i@s*!&U`;yC0;32d_5qN{a&2T;LNhM{s`<-$D}mBo5!J>BO}Kdol7Toq~1_oOuVmJ z=7T$Pk^501NbQtk-$m*Uy9YRfh86I#}?~W^LNU(0WKF8 z&H0TJ;p&dm8<1A6Z_m?N3KSSEX7`|;39*FCn@;Xye+3?jBJs!$GvSc<^BO^*p~=Hu z&59u$_JpMYYB=ofD6U~igcsVgYS&RzDkTznj)IIo>V4$^uR%0YR)f_QT)&;s%K|l| zXu*0$H>g1TePf59y&tE3+NM(GmlN0A+cAVifbIL!eKsQ}0{_rLr2f0yo_UbSNDn6_ zu<9_eF3;Z{_#?-cgF=xy2p^Yue*SxF z{#9<8IHP_mD0>Rvw1u->BQP-#{x!Fj>W~(L^gaxJ1P1D7b_sX9%DhL2QQdY@T6ERv z-eh{1=r$57K*mG|dx!faIw*f7{id7i^x~6o10$R&aM1KsEza~Oyu6kuvD-xjKezWh zn)Y3s)UT%ViDAOe^G9fi-JkbvO;?Q*E`Lh9#{L|HWnV$mu5@_I&dWXbYkH`N@ZiP# z7^Sn08NTjLIg1$+m1SoUs^LK$4VG8hUOCwc^$3VVcwF2V+LYnJ%P=mQOgmZ7%Tn*o zvV2?HVGuHv91_Y$Cgv#e9Sx)^l>OPtd@?k8d$Sl_y}K}Pu0Oz7Z6&cMr54e6!{MI% zs&kEQ@a{iRysr;2kOzm&| z)q~z%Rbz}tN_WbSw`vxytC_gC(Ac0WW4kA8Fk|6+L{X6)d%nAb3CmYIm3Nn)@<{p~ zo#tfU%g)-WC=+t}8ZeKok9oXEBFJ!KisWlkFaNQ|zD0ghkw}8pb=D|7`a8ZeDXn+XBK# zMqa({L_I>x2zQd~5zdx+o>LmRcEaXxgAoAwBZcDslmTQl{w_hF+QomAs{gCa*sE-M z^)hHJ4KNp85kr7GcKgZm()u>w0Oh@pC;KYz&gE{`Sf1_gDQghQfi1ctu$Qo`A#;{oOZaHKo0453DX7 zWJb7O^XZ~eFc|t)ghifbl=HZg$}#Fg(>tt(`&c<#nY~!CEA290`I9`RP`%$_N_qPw z6t~td#SI}(9eHD##zi`sS5%v)r|Mx-1d|#T{21}Q@qLyveFdT16`@De!x zwDNTxbX#5TE!CnLi?V$D*s}x@)vH%YnjU1U$_$$B?ZN`#P#T`@OgH*po+wAYn>!7Y z7@Z99JZgA2C)3~bcybtXLzE}5cWNiCx|5<-&Gi7KLNB<8oEkNz&{eduq{Y<50Z|j6 zO`h9iA8ddgmUQdY92y%fd_@TG)?ySnK}R<6gPoQbrjw0^{rK%S&~1E@&+ftv$7c;t z!v)Q57J`>^54!At015pby?A?j8R>f`UuWQLt!h_@+A?H(!m4L5x}dt6`qcp^Hl`a) zyJdJy#b-t4r7t*JSS~9*FiSYTG@_yDoHTf0}&w$HmgRME)1{_Wq(b84rop zBj0qehEfRMZvCM@{LDNQmf>uFs+mFHNX%{a>Eg1@W$-IMO%R6`y6c9Jo46R@OZz|l z15`8-?E6~Z(xU{w2m27W|tKuie04pUpT}?)p;JB~Zo8 zz6cY(*1sfJ_W2F0T?(23Q2iEud`0pPMZj!N;r>yGA^+M7NyfAjXDRl5MyftNjF)GdCWy$ z^NfPUDshXVNY#l{+XweL_Lr*2CUEK_Y3MG#m&9^^nzp+kXHE-2o>;VZ-oxOZubi#C zT}cQ*5yGzDnr?4ScSpKZDPpNaJOegy|5txXu3M7x1HFv^w(RJ!5M-+aLf!YJoMUFH zSL5_GhgFwdK|Ps+-pJItHy9ASflCq261T#qr7vI+$}ZzM#uj4;{HJY`{GT@f~P%HY3u z29g-=%;{W}Fq>)aC>y|r6ASy@SF%pq^A8uNXVuO~^3o@NsBv&GA>ihXkmF?G>udk_&UABkWb$M1o~^-6 zJakV#YVC~svV0(_Utd{Wk*(QUq}p!o5wE|q^L}1ddx`gjLUT#KZw~IWsHAFgujC7% zd87R>z~ggw)PFU1fcP$TO-#mOV&9zppKeg&F@K!AQ9QZ*a5}mJd{M;(s;NlWOK$NK z8(3o|op(-5boUh&*s3h`zeH*g;+cyy(L6TK(K&GYxU-aJUxv3b03(o>tyz07XU zZ;z<$_h@IS@aNdTNV~Y7j|xQggM0pWolZ=X*h+)$-UXfLhm2|eA?_&FYjAXa`ANdz zfPx_U%IvrgCxypO^-<(;yh4SOhc2b7#~cn}Hu-Vc#VhC4 zA3jR0WNo(Ie`)!E`cw5}NE0&BMi0kA))3i<&z~kgJ~C81_Ip?Y-E4BUi%XYtpK1&> zwXFoB33LyNVorgG-4n;oTX@XRXK=(m^ah*vuR2_tftHc@x^6m3p&gg7*el5m8hX){ zSt_S?X6F*m`~mOXV~a>T_ke<#z5~5-W&HN`zUvAS>WKeL=W5vM%~LDM#Xmim{~8wobhQ`gKYB_%7k%Ny#X(uYq7CKXJ0y`ZC>U_{hVjVTo-AEJwN_KXJr5 zH%7JvmN?Xb7JZ{Mmn(<;N zr>pmcI4#9PQArtdMZ2Uzm3i=ToUM%)lZDt(!+4myb&Coj5EIjG7eIpcgUbw-Hmy&B zS4GDzQ$ufn|5H|igc@e+$09U6>_+A7LfI;}(dTFTFadI{mmehYco5yXj^n=KyY?Rl zqyD*UOcalSl~<>~DVvukpkiQ`E0)^n#r8I8e74xKPBiQj_6}l{+`R0P1o=bIDEyC( za`tVV_*d37Lp?e(NZyyusFiMZv@zTAVNk0lje2xlIt!DLT=%YGX@aygXgoKL9yT5w zG`@Qohj}q`asT>7lV$PXnsZwGR_iAbJN(*OW*P^;`}BI9Eb<1=x0RMSn49GdPxeAM zq*)YCaz(79g0GuvFF@C=Rs-LRFzyYUAv?VG!UM4i`z>W6erzZ%S`0<^!@<(W_=VSc zzX)p6Bf;F_5E%qyFmF%yY{ulr&oq^Wm?%I9Ex4^R9?kUZ6F)R87`&bNxi5VDBXqMN zA25mt>~P=e?&lv*Obn&B9!^#xhN5aVEH?2xRNhs+=gSlxNmvb7xCiNorX7aVQ$J$K z9&}6W&)@=W_Hmhc?C&V9LuIh;6L65D98EcB4JmTbdX)%ucW&Qf9PTh z4^+_G*xi?z4~7{?Km_R`aCJ`Nc0Gv-L%$fZdVW!7)C?N{|3*3B2rUKd#fD5O2{+f6 zVvvX!Y&6yv?vJ{pd`F*zNRqNmrN{K$6pN)c0d3wVnUd&e)Y)cMNaFd3QJ<6^=lqJ$ zB1|y5D(7Ixqj@l??m2bsxd%Of^QcijQX)|c8$IPj5|#f~kt6A@%c^MG0N6_LevzL{ zg<8rVOIV?FENj4jFu!^5!SsPqlWBKjgO&DPrM;>r;%bYf?$;q`XJ&ug+W5V43o@DU zQFnFKCVO;hu*uD%Y~Ce$XoR6t@V)O&;H%BB%SRp+&|-D-4YlWrS}}mSCiDj>z`UklJWBl>`Z*rj>faq zlO)K(At}kLIfabRzNxgAYca6BL$}RRaWAc`(GAb?@&q8!BcC~BOZ@QqDuJ8&pvRVk zin+QXLR}v~K9N$q!q!zS$ltUWovYYHHuX|wZi%cQONmAwlh804Xzr+}ITi2vimNXL z#e@*vf-Dxk4_E2rw*KzF;k1*mNUXl?=5As^mP-(UkD-A{Z8F7Dyd~5vWAEyZaI8(A zOz6jpEUxoFy=K2BgPTUuhso+83q zFbEDgn(+yq5kCH8YSh@7nOIX>=5GGUqO5~7)gHqztalPTsERX&vHXpS)uXiT|3$x_ zyj0Qs)mm(McQij}GeQ&(wd5!XQzg3mrT--V3BhBkZv%S|>Bl`cBX`#CnldWP=BBCe z6JAJz^n3g0h9eo9VJ3LokT*=H!=!<#{wj9FYWl2LdP|S!bBZTfac1C8B0&<+Cve5)%O?DNm5zlYv$+TsApzg$KL=CS=W znQm^ip1ZL~7P&b)A5_8aWtO4z*Qt6EQ1qv*w@4LlKhd%y5ef*1%FSLyUY z4JoEa;ZIxm_2t#=fo{%OB$}ZlG1a<2 z2X!&d_R2mV?rg}YTZoJf;H=MH^i-i$g8JrnS8{`uH>H=;wTDUWSW#NDN@dbYR{iYG z)B2KN=j+|axiP#zD(}LYv0q4#wLMa5F>U+!9fkR_@>vd%Yx*PQSvB%H?Y+4@%=#g% z9IJ45b2pm4oiqN!aR1#NkAkAHY4%>LbNF(dE{l8H*j@X5@~Lx^0fB4?7jKUYR!^?u zKBzJ_-cQ6#Cu^{xh9Z__$56Kr&fPr_gC3sU@=Wq3SFNXad@aJOl<3t(liJm<`{r~H zwLC>y%X4{QR9f~XcpI;>@7bKYAAox8l#q2_@YgWZNyFX|O+1z!r+aOe+D*+XSkVU_xCi>D>HLcC-h)jT7kbyGz?qhiIVH=6{eH+&5KA$rXKFIT zN`x-Vn-pm4FxE29y&WQ9z3?u${$j=WfdszbjVHXFhkf_u!-4@&q5`P$C~by#OMqggtH@=>pP{h!)NTBXWA@2=v2h%g_q=nMGBo!>#vmF?TyJ=&u;`) z!FC$bLjL+Hq@ycSsceb<&%f?q^otOiDXH-@UW`-qJ#Xj#Jh_jEfry0DyY@jIZ@Hto zKK>)Od7b*wZCG6Y3iy5sXE>E z=+NFKJIW+ABG38fg_8n=n=mqV4IenlVuS^f^Cbd|(C@JkcW|?6Kk=-D9DZ?_S`28{Z;c|JUv7A7$#58cu0lY}!f{)54rYecP1 zU7F-1fv*)>J_#Ip>SLuM9^n^%ml2_dHXwaGeOT12RxIi|o1B zzdpHJO4~voxn~_Ip9PvjlwIr`AD)f+(lfexSqriHT>2!@iuD9M=qd6qQ$ zF5o7xvU0!RXG#lhlLu!}pIzM<>!cDo%I$K*{`)plm2Lv?b6`ptwsdLiP}q}c@7izg z>th)XVXu=sjlLEA^|?to1te*s)WtO6v|~!7FD7OqS)a!ks{*#21)FM6wq_am)*p6O z+x+F7KZ>jl)YBf^doRQ>`LDjp=@*uWasDvAn@3(@4a$wAEj+F;{Ezt%%q{O=)w{@p zb5Y$N-wP^>v}O4sppBYoCakGm{LOoy9%;TU{*xcb`lbe0O`lcA9o%`5l2+e}QBH!B zl<5qL{Ws#B%w?0tE@;0yACvNkv7B0YVzObGE(?BDvpp|~=cj`LY-d8c$c(zt&{U)w zgu2$ojp(WZCcgN`tj*D#Pjb+QByq4^VjH53VihheSKB(eL$&2+6ywXp*|O11uFJF- z`WGh`|4&MZ|G&YNEblXvo9*rWWYdD$@PHCn8`ih=raWG=L$d@Qr7(fww?546xkPzK zV;r9PiD#1AD%7#=QwqXWGZDf3anLsrG(@5OuV)Phl)|Ao+Nx2CA`6=_Dmg`H-Nh00?-*}J-+pjYL2eahArbdM)w5i<**+}Jq z*4k(ZdP-HPBm9OEa%Bd0Z|rD{TYIsL2VF_H7tf$`$XA2M;H3W2#tqr#lb~Zk7eZ_` zL7JznjSn`71h+6lbpNDxo~md&;G@-e!V>MBhvOZ0hgz5B-Pv|oP6VSCFCX2^A6S?H zYlbM=Y!W#wH@3jq-08nPw|l|Pc?e3&_*&=%Cpd0vw`U*lsO}Obd^-+7P6-4^V0v>K z0fUtR#>H5vT1Kvw2{++cev1^GVqTktQ;F4tzsKQpxfxq+EmU7pKC>MY2h@ z_rDS7dj5qEJ)Ipg0QHQd6|rQ+yy|{x>&{BFddxOkH>)c~Otw4XnYxe5D~QPJ#TVxL z>g#z=1+g_yTyJISUjP70YxP~DNh6aCNeo*a9^?P|-9H3lRNx5XLA|5Ya_9gvMpw6A zO9^Q2*>CNJ6kACwR5}tOW2>OsbI2rnyOXvd6FIclU?@D=D9lf01{o2%2=v@EoSKCc z9dY@YbrrLqhuYC29Yo<4{}Mi=oiVybX=wX8dGjSx7&-+*EkTi=sAf{G!h3YYz}d>- z0Lm}yn6e5CNObzgGDGEf5c^-R4^!6rQK1OKK}=tmFE^rpBa0N>b)o#+`kb7rS-xM^ z=|UcBPebTX`>qq+GN@HVB@d7S0m&ZGWx7R1hN&n%3%gU>2A~Ys)la~ZVjrTTofFpx zf$CvQ=qp-Tqb98%qM$h2+<##mn(Gx$wR{-5uhuM$$pOg&?v(^$1o3farTkF;sB1R` z_x{dazQXqS1X`KJ?w~D58>No@`#o;jYIo;F{ADSwSEA*zb#xku4F1y_67&B38#MJW zUz@+JrhT@Z@^5V%g1&nJM2zJo?sq0cibaj!bF>3)dL8$U1u6)yUK(SuF`2I?1f@nt zN`3(dS)G@*xa~S+31hJ5i_7vY!j^87`Foa)BO4$9oln5nQVlAl{3KaRYGV?K)bWOO zC$e2p+D2@sKB9!4qM8ndVciDqpMSQqZM*V?OF#hJuHw@8v}DJ>^F!$(>z3AXcG+r!jP~OesB04*HU}>kCwI zs#nkKP-VrMVm*xLWKjU>$*?jiM|+YG@p`VP*hA3h!0$|d%k^E4FU&)V8qKe(&mS-# zRpDbaQj-dWKM(x3H63bNSi?`(TzB~Lz|u!8`RU(If?%E<{eSE$_nC*54L5=imiq)` zoxZ)e{+!Hy*^g{J@`TSdL1owVoB8EQ*=)60c#d%k$wsrO*-5cDh`N#uk#?cP_Zp7B zLXa0<&*x{!5P>)$G#n*#o{xsWWS&_J#r2KBjt}0Kprm|jksnHIW%qYrd|yOe4Ix}V z451#KJLOFszgyjIjwua?>4Pqmw1O0Fxv{Zmlv=m~a*Yits+=${euKJ%)F5Fvew>tS zC_OB>rfaR$Wx7```cZTZrq8C6*~i;YzUF%VDF@#_x}tR6CU=9)i{vW41(sP_cdz6S zttHDJWk{Zexe9XW#WhBQP`p(Ax&OiKtC}h6a!5@;rsldB<@nV%;1m zvt8)||J|zs1o%tg!eK%}TL?@(S21w#v;v!5TZFj_B>PK*N7h8j(dS(*F!{fXO)+_} z3VzYdWAs1Fzkq{#ajhILbPOgjYqs<^v2iN<>3VC^rgGvJ1f0*!SU`I(toN4!-iy!e zF^i_KMrhFh`8o(cwpMsNl8^NVTgx2QZio_1l5UAY?f=tpl^iGa)i`DM329nzM-a6_ zKZ10*u`IIevyaJh4d6sO);z#t@^VOpZ=m;9b#Y@RMe5>ZoG0Nqvy8J0(Ry6wKFBIU z-b)#+m)0+6gW3@YN$uX?8fkOd-u^vR@2yRU+3))=x3~6Q=Ra1rr?WR}Z-lgQU?0o5 zOS1=#+g}uPLSE6|ClqbF_U90R4zEs1k97lRlYPU}{_^t<^cqGpSZN3su>#WsgnA|A zvq8qUR*=t%3I0vWJR`di%vYVUG^#Bz(w|ei+*Esnb!K3>rz3N=1Kt*`+sgiA`*T*{ zsuZ>IXxBHNZ%%e=qO1)s-w-b)|J%OI1N}LkmE`X!{nN-epn=rN>M~^cx3u}Hyf3!|Wnkk!g3^wdngyS6 zRE0O7{|_n3l@D3L^eO$mi}-szzmdnJD*->Y?upQqcJqx>5oRd(-G}fOe_3cO=GoQ` zcGfIH!c9jzsbt6eJWLE6^3tVAq{(cH$(V}g2U`y|8Y$wr=Q(#UggmKthVbD(2LBU5 z+<$|lv&oPPqeU~s)@VO+)w8psrd0q`33P3J2KO;}fA;o6Zqpu4^#&=aK(8&oD;vDX z8?65S5q!*#k2hH242TAz|CiGT>uYU~({}(2lpwp=1|wO==(Vb#ieO4xZ?cr@tas`pY^P~vPu$W6Ds9{`G!+If zXWNtp_07Y>Z?=R6EMUjHpHS~&ATRDN9Jy5up0J4Cc-}>F-Ek}DwLQ7Cfy!HT*FJGd zHeqkRWo#Ig3qgachkL`FPWnLg$J|^j-Jz4>Q#-<=638&mm`yZJI9tyC@M%u+ zQ9-);Ez4C{RPsBau<6j1>EDX|tv0AAo6p=p z>Ur5}G|00l1U;Xhe6*eV#kZG4>5qLK3W>MR6bP!gg!ENV{`ut7`Qm29w4sKJ<4%gf zPTmSgQt#{48oL~vrA_Mg9NDX$2of=B&T-C3pX&nG{-JeYihllEO%4}d2HYybIRw-8 z`nhzYu54lM3h{!L%fJP;UuOGDvFhRJy8-%ea$HIpylW|sY{>5p4hiheCI@?%)&2`D zVT4Yu?X7R@#OJ`cm|zKmL_f~;XbcHGw6|yG5^)csSl>@b2v7}&#*0{2j<6_uec`iW|JYsUP>0VNBkOKyrD0RWXZCSHWn_+~a!=A#;Y1{9>JVAjc z#TYmz9(plpCkp8OeJQ6Nr3!F!b?X-Zn^(DXhUBG*7U`e?_mnS?j|TrJPgEq(8-t4T z4v^b3S4IbH%nCXV(oEq=o#PRX5dXBX_VQq3Z`W5!YMh6yt6L+IS)t9-A`A;26F*c} zG2TlEHGW>2i#y%CIb9;?zGa^z`ZIkB$TaPz*e<2>5ab6uY!!;e!aMQ zn`d|55gPxjq`=*6Fxb>_3N@yDN0!FYGHMdmz<+r-)rR=c!^xDHi9~BBKNPa^v*ZVD z_NHNvk0!r?$_GwEzS2Wrhqr0@0)$9aEv*$h9PXgos(soV(h#-@`C7F;B918lCL1e) zWaL8vx>ZJvW3ELoJi=l36mYfqSu`iAO9#@J;*>gc)m?;*fCrf}bU=?bJ7>7V)CLeA z7n8ha9Lx^pTob#5oDk4pulDwWZs>22R~*3H{$jc1)j@lXRI?-^mkA>X-gp#$_W}1P zg%e<{ze%0Nl)Ucx72Q7H)O4afY6;@O;*Pjc-)iGQ)94_~)6TxfppRFxW`@ zofy`@Yniigp1UA1$mvaWa1ATlI$B`nP#DuFc`${#dmCf9Ed7z`GE$+*<_qgoa@MH|%gD9w z)Q5K4@apjF_b$plr=)=_cQQY_;8e=lY!UG2L2Ht-8#kXn+xyKKD^D`&9=;3PBLD2>a98BDc7aN zi^$-I$(GPEbHoTqLS{APMQ`i;t(TZf0)z_`279S)R1Q^lkJZ@-Q}P4 zVGG|CQBa2UE#!Z3CkzyeeM9durl?+K$fLjStaa;=wyo(~{DAJS62rusw?LPh`@OI5 zP+eY(`1@M@wp0uQQ`N&Z$3K0-eYE3F45JyvuKyZFp=InL$@UWoOtQCQqF^*b# zxfn;8des4$UID;L`sCrN(9QJxeYlb&zx_Hv!_Z}SmiB_o3}zV5yJcH6W-iN6dqJO& zy>bzoyL#G0VM1G57T4o$@}1QWwk3~EOYt$_Ok4s}M_?Kynps?Cj&uK1iWwcWHb!&u z0)xw5iwP@ltEKeIR8mC@Oq>o@RH^3E=kS<9N3L%dixfu`D(_9S_RF7BZ|}ihYiE6I zFoc@*$vf3Z_5Agd>&wMWsFq?@n=qc?tn#BklRqS|{`y7d=8#~EzEo-s7RIbw3j0QW ze+r6f)cbUM4jUr3-fVVzPOeIS957`HhU+MLIler@(nJ2pS7Uu7v9j+SH`C_|4@VuC zPo0tz0eC5smAecR*mb@y2w(T8Vf6mWIEzh*iBcl^rh#IZ&uu{j2J@rfJ#q{|O92-w zTA_GaiXT0P&E2f_U_H4Vg)mkN`z2za!I}bY4ITjC0}?sCj+$VtlsgAQXow;j)+7ky z#GD+);%ZJP1GA?4=_p|6>05k3{IW(^9c8saxdLa*kiFw^ysOK!ZFzVyqJ|Kn|KH$h{j@6f7PZK|9|mrH41NfZ(r>!drN z?|ufL9i6}`Lw??5N^}HdyfZDLcTMO#%%AN1>W&T5n+L3Nhi?*^jS;#VG1f^U(p zTiHAUx)~JYe``10lB*hQp2nRc_3Z;}gqCE^b<*KIL73tQ1fm8&kbM7gar{+asdKWZ zF%|kn==1Tvi5!^I3V%Q)QxT;0f_uyuO)uxvjnhp%4Cr&!Kf*4_pbRqFRaW*IW8RC8 zehCK^Y!TJ%A@-745=oIEq{FI1pj^h|$$@QqMcn1!g0G>rWv6(;TJWo}RMUS76Al3 zZo$PB^a7HOhTmJdJ!x5b%X$CPMU|TWHui2=L-x8L0#AgNU7~D10*Fb}xLO}A1_g(G zpi^O2t$>#hJ3)RX<9~W{9nb~XwV@5(U z#YesJ43=g}Gev*`;Rt9~Xi`ceWcC`(e!1Bq%i4)D&C0SF9CUl6%$Ay9TLdBNbo+33 zPg!j!Z#gfb7TZe2;Ig|4vzwiT43ECPaH#)Jt`rX zC<}mdW%>+bRW4gz2%KD8XJ7)Uhl}InG`J)nuI*caK3jhJPKj#CSZojYaY*KQ@6$-q zDu~wIlob__$DRK_HedoTD7s zlTkjiE>^+NT_kVG`mig9^F&vf2(a7*PNfuVy8qi?O@;&bB*iot%VN(Sd`2LkpeRK2 ziZq675|CTC3WX7WjtQ0nGeBd@0A+Zj( zn+_%Mfq*f=6tG1 z!Af}Phsp1RPWl-#2`^b2d|#9s@_VtV)mW2(=9cib`R!|E#VYB$JRSL^q{E&PnfOb6 zcio0{xWgOZ3@0b2cS`0x`%#w>^IF4_CDp^Nk+aamQ}io(OPw9&Hz+(!rr7k$qM?Bea! zvURRJD>xB5UgadR4+CIk*vz{X4wbg{vGJ}ghj-a`);SR6BB4F;DTLGiTkYi*w0{YihliWV&aTWys&VQ9|_qy!~idSg2Gz_elqX9p; zy7+pWQd4G5r7@yZ-jMljK2Pf0UH6ZCQ)5&b%Pr$Ypp-7&#~u!QmAw@i8|z?mJCLY2 z!cnl{-<~MLHw;-~k0*G<%9y#MrTXN&6;N^9MLz$1p?>Cpgr5&0tY<3MBRKUHZ1Bx= zb9TNcshG1C8~aj}f3J2FsR!r%>Q2c+lbhtUWvr-uk5Z()OBQ*uSlZF{dd6xLZg@o# zOT4YFuj+@Ie0jP!jFje(yBZZvs;n5s(fn0Eo}W<4otfC&5EzNP&W%#;2u3s+O7 zEe3ACtZQUvDKsRsx&NT2CyDjjd&DYmhs9Dps=*rQsV)emR_$R!3F1TP+qsujS05vH zODwb8*JP*U&ea|)FR=eyfRNIhnW(z$h747KPj0SLIDelkZZIZVI0Q@^2NBSz>n9mQ z9AKX(ZUm>_WxfY0c z6m8el^f9647)6wo{xpH!&jA8kg5FbUev*|EtmbZVic{*kpz&eBB1~1>vVe7Et396Z z8t0iaa50i~!`z3s6n8!r+ZeE-w1B!#*I4*{wH`DKnx}R3tY?Ces`;S|2w5jp6hVVz zI^AOlrx?vFEUNwaq)eV}tEOi9YHjBK*{0?Evf;ssZs3V6`Q5mvIJUD(S>*3tv7Y9< zr$hi*(olbA_{44m>)(BqTjxL2fzBu2dDmP{)DTYB%^Po>E}{)P>hwac!voz|UEg@M zxw-3FMOz}+^^M8PPsLKXjgIF@O@td!y7~^KX7jg}lBCLhqE0!I;F3Ng^b2l+<_{n5 z=Rhpa6u(Jp6>Ge<{Sw>e;QPsOYg)-gJVYLLhh--4s<@Kqehn*aClKNtlvA*l=bx#D zzs|o1QUjf(#pI>pdMVZCFUZcTZ1>4+S7y-3VRN0%KPsL0myvR@;VHm~sP!((eeF1! zktstE74{0Z16E;(@3?~bzuMap+M3dMu2xej&3+-VV{Nu;?4}-%{hVQu|GT$_2~+$3 z%E4~P>pwWdq90m9{93HTY)FA>5mxBVv_1|GA#pn5_^&k1V`_uQ6t(9FeI^b|bjU{!_uNWwHag|=8(j6i|M)qzeh?CRk864RFOQuDxeUu(3 zd7IGm1*;AS|8;K5W?AQ1q&xvzNCZBWX2c>@gLMMs+8FKhuFUpRFtLPxJ{RHTUj(Q~ zn@glscaCDApJ(EzLbMd@ytba z9wwQ_!7|pv)+y?!H%Po{KI#c~Os-g>8-~zbNl;#EH!rgP*;37%Pv5&d+ziX~e4E)9 z6?X)^n(}t+EZkfw8WK^N%N=3YRUBP5uZFcpyRqyvA!hh z`l-9g==BFmgHYC|Wt4CNW}DfhjdRQy0~tvhoY>3?cE@*Tcd54(=aM$6&@48!o=u_`sOkm(|ULt?XGW_+YQmy{Wmwv8lYDD`IWZi3}o&H&E;n7pyW7l{9 zg1Wd6NPZ0&Y5A2-n5%jCD2=eUj8!u>XY*YBZtwO6&!2xwxD<4?xoG}HT}@7&tYrH{ zhT8Fr!L-QwY&B^2J5zgyTB3w+32D5`e8L*uovJfHVi>tzh1`-2nHz*hA+JnK5u%lW0&vOfj8Aunuer1VH)@$!hoOE^uvQSq2xy5xU9fB# z7kzg2AoEEn)0C$1CYRwzDZU2OcqbE0oKQC-uqPs(@>3NIo;VdMX~Z)0S1<}3R(iX) z4UBW@Ekq2PToYuxei)0gzPQorG{B7L6~bT;;=!AZUnj3OXS^Af^!Bw*Doxub1<;{^+hO`{c#%DXlaJ-TQJ=(hp<;zn&=$N5(u#lO--e zT-l&Z4=X<0&j%*cl#;h!l*H4_ciBqqZ0p9qMd6juCJr(y};7J?0;9l?+^Qrn@g2?`1zE^WA=czB>Ii|1#a4?rhp9wE+DyNWybE zN+!>1MBB5?Zf&( zH=W|b9~>PSKX0mM!s5tDv`c4PW4=pSHl68%-DM~c42{GX2vFHHmZB#VS!RcQjUL<$ zO_>njT7h6_^inI8#;nt{X~WXNs>X%-c?YTtRw;Xh?@`5F+Q(t32PoO2L%da}fDJd? zsj6Z!W{*WI+ToUs>h#WkvNz|S@lXcH@qTl+pG|my5|mh>mJkd8kus~4Q?gE|kioKQ z$g>>0pVIEUQ{ckdVfjJ{o|_AoF>oDh3)q=Dg><3YcNXR#G(a1yUmAf=1QDF;YMp^` zcJJ2jhX?cp?m=4>mn)8}(QuGyA5P#<+pz58VlACn4nk^;CScoV?9_vlnk8zZlyU#X zOC;~<&c;@G#1Ef>QPYbgEqCDS&iB)WQuSA)l9;N=e+`e{_Q_kzcWJOBi4iNlE7SZe zQqC8g6hfDKz8>sQIn{QOVj{ow1vCz!1AnWt;6Bvpvx7az_Q=ueog6jN2vuR_`5p^cV$lJL#48(QXlhAbu*M?BAYNc9rJ@cn|~~pa$&jX4rTtA|6xW-ICv^ zA9uTiQ3|$c=wPojTPzKzoxe;8l-;RI6E9&;R8#OsDmBzi^jOZDw%X}aZK3|xb(9Y;n#MHhYjyXw)c}dROtg`Un?JJGOO$C=tR&*%G<3vCk*Xn# zuY+&;_Nt%<|6~*C>ri&8HpX@35|<2{nhvjaobnchK|%+hiIU4xPGwxCp>`+Om(G`4j8KZw z{t5+(mAKN<&)4*hmnVFL!Wa}DZ_#wIRddm^?kUrU&LvZ!`&D;$dKAtN zOglg%1XqK>Kg3#Q`wYz`IiQawZ}9qxGFmOgb_dzcjBZR}Vo#(tG^ft5RoKT~Y&zRK zh}_BRJz6MrWiwuEH|0>z;$?O6@}nRD&W&>`{cx75qi@}1kMwT>%+BT?Vk$Ztiv$DjG*sj5=z123j^HxXOCjt&&^F`?6^ee)j!S(@LelwF2})ra z9@68&Ffw&jBx&EM4vZ9f<>EUGw zd*rZuh-&v$r1IIFrC$nF{#U*Nfn7?LZ{Tz!sI6hkkWg##yiboWW`vy+Nj(!s*+R@& zvo1EFf`N+G-ph6C{bFN!ct7B1u2IbZ5~X3SusxS=xnsOaACDmsg2%%sW+Aad=@zn-23gAy28g;_}!eWo5a2o9Hm)EiB@^v3ttIZUhP zVz6p0-A~Z#t;1J2_5&cBvj)0oiC+cDJc1t8;4zm+|M?<~Z2Ntl{YX#=xTCW08I*BPK}TQJ>7mlg;}z}#lq)flW#uk=4?8Uiz9JT zuiFObr;Vy{s-CxLL@VfQioPse`U?MC;w)Ju3E~=7a_m2rW9>R}E%(c^NO&^VJkPSc zZTI0b7RE11=*>VpulF=c+=hU@Kw00HMRW=$`**4)c5Q)vb1>8NBFT0W1YZ6$EQm9M zNnXuE!`ibn*yUcH|6^lbDkZ?=^9XXbWhc^)PbJ4p|H0xlk)tUab_ilxOq5a;l=H- zz&G?nm!>Uv&%r;|V-8A$J+3GE^1u#jkCOzvCOmvSY82WMm>004Wa}Ac zog!?BTa>v_;JNvYZ8Jhg$Fp~BRBMun(h)!LEgIC0(ub~)R$xr~!xkDWT65(>El!_@ zXrv>RXN*toIZwURokr;gvXf2%ERD83J#!~@R7}4A^rNFN4eTND^OVYLOzMVWxJ>d4 z;9f@fv`b2xxhmiedJ-VOJ!WKSxhrkoYQRN0Tl!E1!YWj-bfe*g)FBND#rTv*&9aDv z>XV6pp1@Vra^lX`bk4|i2p9rl--CJ>n<_M-An}JW_Vl&h*AIp;SPM^Fc_|T{_A8c3 zNF~MW?UXilU}5EZ~3~xR+O<@_DA?TJ} zo><45a+C*^j))JhZ5(XAi4}QSR-&*aERb(Zo^Zf6>|v8NCU zJ4XIYU_W*tvs!c0g#5phVI9>vW;Wc|HK|c18t}v>ZF*JTb7_{+-fTr_zb>UCZ zcT0kBKEKTJ4QHiD2F~g{=yiP1rfT(*NdV9XZ}!+$OGSG|7H|3f|AIl{FeFvejhQVtddpi_{~QVS}} zR+->g*2bS`MXfDn?E7pb7JzqSp`StZ&H*33lCuRw$1Sr;-7ou_#Z~6u& z=)!YKR&XKdI4%FP+wdMSne_|2-hS=hBl_@ovcB7R;0!_F$jdSSZpciQ8*12#kvy8x zmPv&e98jECNL{wInD}6k8As!pm_s{|0T^oV=jMz7+dCTxn+eeQV&&4KxS!WNEEKgc z91^c)k%!=nHE9+`Kv6<~!6q!9vfIN;srw|~FeodHs1U7kFFplR1@) zZ`7lmKAlx$`o{D4n`b9Dw6+A($K}9GkZr}a{rMNyjlby~_v+aj^Xt-Vl0ByV2E8mw zgSa@=U37Q9%vg+F$a*^QLzEYm@d2U6EBwsiEU=DqQRY(|Lh%lAO5f(PJ88SqgThh|j;eS)Q zrG~FI*N0}4vdbRl!tEDP@UjGlDm@``gW5bKiud?BWi1|t&V_(f27;EF<@WsT;`m-+ ze1GM|%FC6t-&d6@pC9ZUCOIfS8=>A1y4H7RgA*=_WDu{|&+Fz!M#dYbT1!$Z6|!Pm zMS(}2;DGEMYvEYbFOR%rVT{&VNVnxGIPUfK?S(yq6(6u*QUf92cE0!)_+x*B|66Tf zbYO;Bnm54=i02G@^RJpCz01g!%Nsx8vVt8X-lPTuYmC$d?T zYwxO_3<0)Dkv_CxZ=9bpfYnG35$5|qd6}#Begd_6kkU}a;zQAcOwCz;p-WaXiIoMl!GaYW!7xGv* z4~EZX1bad|Id(s!@!6Pr0Ub()6P>iob4eaY51~CNAkxfoe2H#YkFOrWa5A1IebM|% z{snj&*4oJavSkzn%K2MKXuz8uZk8{V{R&nG-!u-udU}MLg9FIqovP;@`QKNd!NXTE zi`xmi;3@!*<|t5*!2@-sLA%J{E{`VDH?JN*xfaJCpu;$rikcUT10PrGa|@ad3J%^> z(R--MwI+FDg zzR}crS;uPjUFXur9v~kGvli!PWn=2#Tx#{dYy^c+U-w_VlNqd7kY#Heg<6hGNNz21 zup%=w@*vreN!0cROj@}5kO1`Ihd_6ggn7nOUGhGTwJI9*tvks4c=I36a!#gLr z;o%{YwqYCb4^)im?#>Z-Zf6B&yP-Y+%>7e$aVOhFxWgg)ruA%far#~pY}rJQw4{23 zS0`TuC$l5V)gz|9D_(DJ=bhBNc^2h;$E-q{qhKh492cK2u20^YKk%u}J3IfYKUE%g z1UzaiU6#J8;MU7A+Saak$JIC*UHq;yRx^ETvUh!U@s&f!I~qeowihFyqe1f+Q&j83 zqpcz|-8eZzaJj^hC+Qmd zpT6$dSKoxvXAyseq2iGW->24$lJ$3-yd9ayP%F2b9bf3@`0n=8{Yc)0Xk@s|9J4Xa zcetGzHKOlj0E>~_f&xI6oz)**Q51b|T=Hn^GQZN58jgMQ#r^xdfl1HaO9j)8st0GN zv6*}#K%Rqo+4NE7;ZO*N_z9=eOCw{tHTfeDO9w|Fpsl%sj_;a5(uL zB`m*_vTbpcTNnk_IpBVu@A^~$X~c1Wl0*O?Gr7(ui(v-P5Sa^I3U72p?Db94372=c zjCE>;XFjsb2?M|*4BRt9mRgv@UL@&Pglc8I!II>uis;HT3cofm*+vP?GVV2xz`-yb zEs%Mc6WI2i)}nBz-B4|VoNT;odY`4idv_}0x`)}^#d)uj*Gq|Jjp<~J*>pIWguS&% zrd3M7yEFd?^UhQ=DmUZH+W*)(swfe|Dr7`X=4r`t>mo%Gk(E5>Y+1*V`OHnj8GlV@ zTQ5w%ntuh}e@)j;Il?N!(S1_BS^GefHkCeRv)I&$(hIkri3 zJLsE#h?fu3ysGvry;;DggbD+4x?dvawE&0!a~Z-(T*1=CCmlcPfKbB(OK;pdRe%yB zvuXp0kq?`ds3Z)Mu)yx{Vc*=A$*85L$IoP!fUC+bNg`rx_UET@kk@dkvRlf#%mtQT zo}3!I_U=Gs&Y*{$%+m6gP8-McQEzD`N)^wiQVobqAJZopTtPN#{vI4Sf}ShkdIS!E zJ?7Ed_?MXiaqrXu7ER)b1zF}Y6c(i6r}Rmv-rjP-pNPx*jtc(g5#2NG;HYJHbhYv( zp29Ro8&9DdYB&Nj%w+pU0P%&?Ao3almg(DAZYjY zC_|yfE_-KV|3gwCzvWRQ$L9>E&Xc9L^;a**Z(}wHuNwZ0`m#%aL??}_8e`Dq3744sgws?&W0gn2RQ~48^@*l_vP~iR8Kae+(VC~`Q74?% zihgr1Ch3;>;ZqEgACdoNuacc1b8u*jfnui;J^9Un%>_47?RPJ?x~@Ws(H;YcI0HmV zu)aJ&k-MzzKV!#SfA=v>%g}mK#&XD8(UXn$@Yai7c4x#Ru z>uqT)#9TpnSkm0MaCY|6h{fIMK8SE$hT8UI+HVO>4(C(>PVIDP)tpw1uJSfMM}3HW zk70^kD!-^AXB}AI^m1$vQz}GhA3Q#(m-J)CFmGHHs~dNGeIIm|kp}1ea+aj#OC0C& zV$6?`7Cpy|Uv09VE)cjIi8iO{>*Pyal4#;d&&4Az_O{o3Vlvy`Tu-mT@LRritHlAV z&SQ?=#*KFwfU%CaNo|C_nn8%7>m^wATRp_`C6fYl2v#G|bRc~#hid@Jf3&;}m*K77BT|-W@(rAN{L_#0lRQES~= zE`->Xf_{Jy$X#IgG|bTG4&9>B2Z6F#wDcJbrT@Aq9VF_wOk z_;Cg&CvgXKU*Qs}Ub2yFiJg-|&byZOq*0)di|Ue0c3;c_%;JZXkpA$B?`@}3VcZO| zg2@!Zc<*Q>!WJ3-KKps+;=Mkwx`i}Alnq00>u5iFcsU3jSG`M3P0=of&_piBx;YE(@B)|iIW~MKS;)4xKxs&Uh;WyaG_}^mzoEQ zcLqkF;!$+ymhT2w3DQh=3emM6y&B`AHGpz>F*O&Cr=mr~34(QLfR+N$LdR8zsT&Glsn%Z8Xj9ArcmQ06*BdxXWC=#51cmwTFp6 z&_gR_y$j(Z9^)VV7R4>aA)w`HJJ_DTkKTdpVx{rjCap)J*8#LK_`QhJa4hvAh+xDf zDB+Dm{NVzBaDf_%ba8109z@V-=|Me|R^<%YQ$o_dVbh_w`qBV`jhX+c4FuiFHvWaV zF%N|TK~MU}Xz)IgKZz&9N9kzTbBffEig8Hu>&08^yFS}q3Z;nwospB(FbnYD)(uTnE{7^xUOt}2;N4V8OZFjEq)#25J0YVGT!7#`NTszS5brh+)!_i8ho7vp;bKi#^tb{b!bv6*3@F{=yTRF z%=a@Yl9P+Owxh+%K%i`-6LgD?s?Sbu%j@_D+3}T;SU{8^X>hqqJLs`6zC&6xJ+i*2 zQ2y4j%<0z!_Vmfe3V&oQdiwvvoEPw8y!knjFroiB=OAbZve~PQU@Mm5(d44hk|LG4*-pGeD-xZ*eS3wr435|RF>P$z+;h4st*G#3IE>{R7J=lUD`+Xdb4<>^M(_x}toVweW^<4+>U)3@cZ*lNe$^V7>t6}dML zLru)Q;)5ZUECGPL{D*|CENBJH!>CO5b0EpRDDI&$>FeVRVPR+UFn89GKkPfZGXR*+ z-708?hCVrp6U%=S>K4sO7~aog#*w3VH6H-(KrP2gNh?a_pp zjJ-OR)p)+AWqYxVBWlLY-Q|Lo&g#qO#UQhE8Dfe&SBfM95Rv~q6C!~%-I*^xg5SK^^8Sw z%3zr4&F72#{#YZ-{VO&@!uU8y0FJ$WWzTu44U8 z0A3o%Z_Nro${e;wi!sO>6QJ;5Y#|0U&|Hh~RI?BjbyJjTRGelN2z&U{p`XeuT~B}H z1+*GhV*U|lR)(YH#Ec`~>+azri#j{HqA@8D>?zazkgNh~%kckk=;8ZYyOIX}=~K;= zJ{5nec)2|H{Lb`w1S)2wo=!JFKu9?i)UynKJ_7BBJd^-Y4d680adKK&N;gf(0wSSr z>9kfAk-5sM8J=TTp~z5@8jOEDd4DZGs?YH!UH+&;FrIqSmDS?hiimK5kscSO!4CIW zQNkJl`fxwI3Ip=p!@U_^8)`8me`d0C*>$0n78v?0GsI+4MUi@b{xP9Z5mXo!^B3{d zPKNxPzQ09%3>mr}sAYEL$Yo~M8+FoaX+mlge#KuYs89BG_nsN`TGz+IkLX0nhz{qt zVw$v8)Z{`f(km4gRxv^xkCWkUxS6I*X1bziDr&g@XxV5u$cl;ldc!uS@*^%cJf?an z8F(_iDJCfGDZ|!?xe$x2&jrdhTr+W~o@u6gae!FfXX#QyR?DYwR`fRn7YH83CBE%g zHA@eIC)X?lVZRHueOePVVX3*3?~FfT{rvuNm7pUwF$X76%3=rj7+swyD32$Py;5Ga zb8pREQ#cZVj@uug9tvH5%-^F(A`o;3nlA4b^V@fe2iuE3%5`V6ha1$(|MV}CSxt|n zjoRfzoL?8B9r0x67aSf;cW1M$?P>EH5eFzv;j75>+1C^k5|UxDm8NwzegFguY@p8? zq83WTX+N%&TKfIckp6=BGFI~%4oOEIJle_)I|LH>i9D)rj&b`;KhCa53bcI(MrcN& zJrzVTo^OBg@w5Bw*!1p&I42m)VA~@Gzskcjf>P}b)mX$EY&_V>EZ?3pOOH8Rl$*fH z!xxy>`^)4ya;c3QY-PdyC8VnTY)ariso>^@VkDEu6^rCKEltwTV1cPoaZCGKqBU*x zsWqapep$SA?&^+9y)DZj)5(&4=jaX}=S$ z)5fpK2-n_>GeQ%?oXA`7MS04@5dmfju!?2@BG%o1xHXSOJc9^1rakm#;h(M6tNEvs zFmJw*WAFTLMh*tBy8HV6WjPK5r!Be10Nt7Pluptz?|V0Vx!B1xmT+&1bO|q0bVRTB z1jz$5E-dnp>%_XeIB71!;{)Ar=_V1yMSt7{q zz6NzS&FPDq2kQ?C3uS4bN(0tt#h8-KbLacRC3H>qbjd4`JZKloF2?hDBs;?%V0YAz)Ty5(T9D zI@*IQQJ+OKSm$z*@4H{ZSdV}UdK+B)-yz<{V1nq&ELPc{I*Nj47OUEOECqqbl6^gE zx>18|Q+?PCS)iGH3sb5Kc9iohr}!f}jy2A~>8$vfP7>#+1*7Osg`0gf&qa0~P?{6= zj>_X3aDTkc_mj(-z2owUTlTirH*=56 zm@YoIpTYq$qau_}cpT}nPmM3=!8toKyd5?IDO{aTK6H8E?}BC$Je1K1Y_5vDFK;O z7UyF^qksL1T&0F&HuT2lXuOgpm}@2;G{I~GaCD7F8J4z_esOAc4xd#O_?G&&m&^;0 ztz29xTY8WRw{Iptto+b@6pZNk>HPZL{Ms+BBK}H7{xTAkvZPhD+~;yD#ZH2JHeT(m z26GtfynuZ;WP;wt6O;%`+CJRUwZ9Q?yq?FF2F5BGLFBPMSRqkzg5cWX><6OyHOnUo zB3%OgM69I*mBPXO5>(bidFVMXN1%LyujUg{0^xrtRF;K)n!*XxvtqG3)~+G6GGVOD zh@RKv8Cz2F(TPd#&)$Bh`|7Ehz|_341@Z8aHGL}Cg614<{I+yjr9FD+!v2+ALnF>d zOHy`kKZ>n_1^NF)Q?Uhjp(vI)uB!un%p{} z^v!#Qst;`gmSJ$ikm_RzuclY!>&ZL(+-(vJJdC#1O->TjN-gU?uXwP_+mnyu<7J5C zgFVoagWR5)unYABLC$d$V`Bcr=T;zQdFFbC3#(x~caB7b9x{&rGVdntNwTkvTPFlc zVzZDhzW!kM7AHc&Pu9}%<(E;5VcALsSEIS0^@VM74xPLjx}!?9xLv8BbMIxT3=T1M zx1{wQRGJz{8K9=17p@Sm201Vj`y^{pH7^|$JqAiDHxCYOulmeVbXYAM3HR~v_+f^Ooj?Y){D?yc_~_~$4Q-1FMZhwGP{9x!?SurLT5uWw@Y z=&VjnEtbpIC$bFKo(ipYgd-TyIqRNGNqWkc{*8gI)WeVn8|7~`Q`NX4{P4Gis)~4qca0=wtGS%@`Ha_ z;-KaVn^$EQ55X~!r}jx-8mFXjO21b@BnIn9Ge4j~At1Y%^%J4Onhc^Swzpr7ptJg( zE}8B7B0ljbp`*&0Ryn442rHM{hZJ(=3-k3p1ZkP<1f8uNtJx_L-8m|4ocG;R7(nWP zLdkI+VdC)Q^=r`Rf~Zqu(3bJ{eC2ufjy6i@w_N8a(@Tr<7D7TZVM7k~B(dJ+zN2%q z9EQ?OwuLSrtVQH{;)_W>h?zTf3beJ4TbtwR9XPRn;0aOuRM0X#?5?1<-wr82lukuO zrXc^?qSf8)x7PkFS>asoa>!AvEd>W!pKqEKbp4^sFvU-mu2#VLs z3|sqy=N6*kWY1y#ha{*FOA93Wov%yw$sL{a&dVAA+DgtkQ*0Lp-kbkddp3#M*U+u) zFO?n)?dKWQVza%N8=jC><$oX(5@q!>DV2P%1K!qj&s<9!q%EQg&XZaRtaM1ao`l=D z-p9A@!&+ip>a82kA?lmHkKEwJq}5xM0a*AKn?$p<&AzQEwE~Dgf<%`^k{UQhU>ibq z^2ddFrps+k7>fxm3KTQ@r2M3~x>}QVUKN-zMKW(;u>9>3GTwLcVuy#(j;o$6O)OHB zCG-jcesY;8duWOY_WtL;0xR(=zkTnMr+zn)gj#p1VuRCZH);>ch!Y`{&~(sD%Wo^; zoCvL#X?@YLT`0Kw<9?{}l^&sAT@=e?PTorhP8Sz}x~pN3=^)106TNOx*xJKtX(>Vd z*C1iJhd)Ywe-0NTpVBsVm$tF%PWqCUX@tyVKN9p4dNvowf|=q$>T~9@(c?v{x$@yV z)#BOUt<4$lUKo@c`XEYxVmBm{cG@p)^*)=0Y8&ZVYB!-yg{kgH!G0v^D(AZ>B3@ok% zQE3BMCh2QaA!7sQ)sCK)Ul3^L%MNu*obxEfR|(IaxBXT)@9#3V>%%v?x845uf&ewU zWCl(rA8y~j1tT2asznz9gYGw5eJL5c%2&TliPD2@otuq?XiR~QuP8?@pEr)Xl4RIF zSN)O-e}t}ckig5z88(cE<)rR~KQ@b<%cG2{Dvc7cTp1Da&Cf-=2vB(Y&cF;HbqEfe zzT(n#hD+M41N@mS><-rOQKQtT!jKlSWUuG>6_2>~e*uL?G9Er7uH>u%K^u3A+DR~6 zujKGik}NK{P#!0M+qWy$uRnB0@VCA7^_k<4z?OX~pwsxOG;5_#9U$c#)hGGg{>@#d zx$7%s-e$iWhq$v$+)|MxqW%G%SGP-nxK?@Mr98p^OWK_*$8~LKf_@brMd+Gc@QR(9 z9F+rbf*{ddH~>nVIRTJ_2m%Z=l*qR$t3g=Ks~#XL2VqfWIZCTZj_Uh&bNqm$A|kUa z^M)jc`)T%Gdo}<1*IM-%(s?n=8m%l8>3y_gEzc9=0EN4nj*1fUOe|*63AYQh)ydku zS52DJLtiS7Y~9rvGNehw+a647JUHqOA zDSB6@g-|;$CJH}F0DrZB+gJMSom!j++Qb(O-PxSc46>#8Qq22@BZM#xl)*yWh%2p|IRugFxK2K$wnB1vFD4#Z6L&9=0hsJef1Uo)=%i^u{7@oy zabbi&nrb(8vZrxTMbuH^H=YdI$(g2hNG|9Umfb;{Jzs6 zrw(JpS0U8N1X;>=OOuj5rl#B(-iWGB-ijl5^C|D8=>d#JG-Oud*mdMmF!9ejxYlT|`1!0%#6za> z{*R@Q`Nr^|4}tsx6?|FL12n-=o=rEZ+RNO5rtA&eL9oFi`yw+Wro~FWbwKl^eUE7f zEVw`s?qAGC2uI!~VZzaB4G?|^zst-rpDi8NazDO)G%%zH6mJF^AAVSV@Ull)fAV6u znP=vd*D$*?J^_u*bbx^%5`pqd1GZ{ypmpufpfjdd;|kF{jodxi#pLBxDaXvhm8=__ z?#*>z6kg-HYGTh-5P{-L>%lNcCow3U3&MJ{ON&Wq@H1rl928BT3KKGWc4%`F+BiV9 z%^cs%@;4OOBgqaR|D67=3NsP)IEMDqbnH>7pFzZ*Yus$v0=NAMOh*$|F%jX&3f%kc z-q}6FwpVBly#vte)X`HdH=pUgwDVl9$4ttfm$2~N0hSy7?k%+nmUu)0RCx-|tj|U^ z_ACOc8HcUIEX65J-=H5QLjIVXM#OA5<-5somicWc2Ud*+BVrb3r=j_ud?gK0V~8Ef zVUGio>KV*oWEfe#!D(1alN9)g0{h` z*`3!T&4(}bLDaxVaZDO$L>orKP=4!VR?B6aFWIdCb(CGBhp)^aB`kovYL` z2nAEzsV-G}wM?K+#77=ombhr;5QSFYaP8^nj^172?D|Ud-kq?r5v2ArcX)HeLbg3x za4lY)hB8!63gsY@-Dc)aNVWHy7S1;Vupc&JsflgRH1y_n_4|@%`(8G+9POEt9b`6! zxHKuEo5jfu@aJ+mlKA>QXsx>(`jT4t(e5rfMQfITcb3eI0cW#*_ z@wv-5AW!fOC=_Z91I*~0w!2)l(h2Ns=^Qz%tQlRq<(hVlR#0$2VWM!3SgOm1WDuKG zcU~J{Q*90faa`GNKk_NT(i+sK*qu!QYkf{P`G^BeA^kOoB|plSxB0crk8PO^*9i7A zc>xUL7m9SNTj>RP?0YI_!}8h(`NXmJe90rw0un^Bd^gtvHiJi*w5}~OW?p9NcU#(D z9Uiefu`N@Wy>$FnPd{INSX`_40&_IQoTf76gO^F9)x$>Fx$Kk^lu};MM7`JjG>&_| zPsLxKz8k%6t`1+V{T@&l@>b16q#5zX-fBMtq^IiOct!#cFls?VkF-UcQx3F;53Eor`jn0S2`kI_&_P>}dy2W;E_$<9IpAmmW0n z1JV)lV>Y2WVuKb+Qe-Qbl|6pfL?!$1Wgcwr=peyMl^ysTk7=QsC_XsBx&A;s-cb;p z=4^TEdnl!{&j%@RSKeR(M(t=gqC_6>)@of2vD<9_ zRUJI!4coMn_JsKgX8i5j%Xi6eFDLAJM!v+`^nU!KYX!?7J}O84s&~Lk3EiorFT|1r zjM6G;vH!(K4&fO5$-3HVr*l#}Z18WdFvZ$?O};y)uNo3uE4xp$a~vGTbZu@yuta{? zT7L)ycr!Kgb?1vkQcZGzDv0$<3Z^<8eB}q;i0!yKU5Ta`P!qEkc@-a{+lN?*wq{p- zbX`h$-G1)MxJc~d3vJ$@n~KVhRq8j&(J0m*ee4|mrhGHTq_uI0#SmLG23cQ#YK1hJ zb9tQxxgYNb>lvm&IaU$KWso%}lQc_M@|HF~NG_AN)vMb#9GZG?zi0Kn-I7%pZlz8x z<7GBKY5!E1($5<;^B@`P#RNltk2#~)%OLOs>^jkF*%1&;mi=S)d8t7FdOOKlWcax)pCWQIayEf2(&+!(ED)yK;~bPN&HhvRC7i20>>% z1kQZ8sUcaP7bpI$!7-+37(#RJKRTw*O+>UOuELkki!3!^lJ&!bFReu~iR+-I=HEm1 z=5Me$7J$@^cvG#_oeKkRfk*-JqNhstKmTQ2PWZT=5`;T07Y-QRUymK=Iz7^>ai;phCY7Jp(3|5RZe?b7S_)9x( zXk((d-HXq+L$F~EBE$%PK2hWDDe@@gqT4JKBXL4Gcm-x#34oJQFQ0Ac-8@Ec&3Kz7Jy17x zE|DqEziJGVzlMuH-3jlgQ~H0%NWfyF&(EOe(}kQ{S#n=iJic-Vs)^%}9N+n;*OjVQ z-CLY+OR45=BLvWf6ghHH<8`LusBBP*OOF>dIniak=EuZMk%x&(Apuh4^f4nFO+&=$Rzw+Vl;^bo*r-dWZ7a|g0XOZGbz)cl{~8n z%l@TGb5={(U#QZytC-EsdaM#8{NUp5?7ooCT{=-^4}x6vqY4XZfdncFA8B>Igugz- zABb-b<6XO4qzZI;{ef&0KjD55$s?1t6Q)MVKWpvr?6OjhZ~p;G^6pde`>jt^o+o;YT^2-HwzN-aT(CI5msj5nJnAYx zN_5WlwyO32QL5K4T{GHod4;U_a49~b9uFRPGW2q=IAA84ja5vY;l@tooR zB4rT)zemMTi|5P6AmRMe?HSWQk~9A?6QU+I$?{NqZdWXY=tEt{@Xn9ztGVx+QR(#{ z1k|mzV=<~BD+#RajD!{Sf7eqDOMplw`XQa1>VO(P5|g?fda6v;U_1X*6CO%*z1kA< zhCs(8LOQKM)j52l(tm*8lXt2(UcFd|rBhv=u0`riyHa3{5+Z|PiDW@M#PEVCj_b(S z`p(F8v3BX1vGwVL+~pt|<TpIjkZ#rYhef|xO%#yVSV z44huwvR{MS)P$H_3!K?dHf*@#j%ho3izsy7-{pE9?C!}LZEbB%wx@^tyY8S|%>vZ+ zf=h;5>r;()L*g&Q^D9Dx;ki@Ir4eP=IJ%o@RB1ZjxR!DHW#gl~29Ky#Uvpp5`DUsM zaT$pOq%CB&sYChdL)VW(GpRpA#$y9c}bBXJk9uWqld)Hhj4?Uoy{Cthsp%o+w5o8*w*%KL_&U|S7=|ZFDE2xrG;P;cq57txBB+8Ay9-X;7cNsUPaC2)mt2!X70@P~s-p(ci zgb%>ckzuA3!)QNJa~B465q)bH(#R+W?=}=@yxbD)3{TeC92leZ z(3F@XN$czhiA^9Uy~+g{Lbi_!-Y(4~>_*AC!~ZH<*U)DbMFrUf~%J3PRlVu2hf^^@|U) z=Du1-0E9&3tWJBbmQxhwtY$4zXXht{Cr=#TtAOFJGdF)Y@0hNW_3gDpv$+_&0kj2z z@_&#~O2<|M@wB(C+Dng&LM09I%u`L%ujO~f$ukMA&i|c!H{H_>WPk53{l`Ct3CLM= zuY?n2KvVpYs-&A0in)G5=mWP@*_&@QgZ(pSV()KHqG(F9vi9(40%JH^fbu);b@NSl zM2}=Q!s#76Xe~m4-$hri357@EZ8Zd=lTG__c6;nelNcN}6*H15)Jq0aMSkm#{scUP z^GnY=n4z*mKTh7f`?w7D-r+%&aNwt4=_BX1XS0VohH}}5KeMgMh(tc^kOUgX%_7ts zpBhc(of`khEfeAk@Mpj7?yPeo7x&^)`1~gtzg#E5PL{?);d?l3XSye`u-Fc7&Tc-(K6JqT>GY7ro?>gyZEa zeyEpk=z&(E$nzk5%61%Agfa5;N-HWO@1x%(;Rs`Tzod_MdcTC*H^AYH=GJNO7OHX? zeal0eBMTEuGr-f9X5vK3^bUP|vpK92b$^v`xj`zzoiXv`gip(v_M{mGm>bVp@ z{k|*S)wAn&w;#R;r|aOF0^q$(b9_tTCt>RY^gudB@mv`RS*zIn5%*6R^7r+xiY9)P zjQVABNBP$9jDsEhiKjO-#agPZl*;l^_NHh?EjK9o|2cjsR|4amPv#((mg?E+NM9-J z@f=wdj@WE*{Yea03b~3_70wsTRJWqCs7*WNQX7j@>XjxW((v-$W&~C@%-SyJskDm& z7q++N(QeD_a>^=nuDqSCKw;ALdC4Q}PVD&HR^ZJ$-<-4yEAIHEG65`gDEZ58MWXjq_2qF+4)(&wZ!t`eDTMp zn%n9}F{BwRhIEy<^SaB24hwc$+0$idCyRWC*LvrSZDEB)6x}EdSM^UaXelRnh(4dr z*Ox;C_1l!v#Om47cXjGVDh$NONgq)PuTB=?HjCZQpqW8be$Lm?rA+86G_m?dBDcgF zug`AEq3sb`GQV4AD+OYhoqW`MxI zy#CGqv4Z8Hel(|LK%{}&=cL~cX^LESNQ62BKloxNW_J?OQpxH|Ed~A&!ubhwAv+V@ za&IY(SjuueGiP&meVN<;s z69z7C4YxPg;Oon~dT&_>l0DF;qxLn}wL9rRg_LHq{iNJN`~U@-ZLQC>W*ED{>2h_T z)&^z9SdB6-r%%$1et?P{XvUg^N+n5y4O0T@0|t{ZZ(o{`;nG{YZ+7W#>yRH9~fW^SpMxu=(W$ zY2!Mrr~NMNNl4A^d>z^N=;e!Y3weF4wYBG~4%+BF^vF}=n1Wx#>mqr#OQqjjubiA3 zrhoSVeeJsC{>Wy?1UFm^dmC#;O-C&ZFC{1O+*oO}>cM>ET?2E+Ns~z;5;$KHt84X0 z!8e6>I*XMg7UvzIxSNlZU&nA*;tqvKcxXrnC~m7*$;Op1r927FSUR!+Cx@NO^7-2O z+3AB5ini_T>Cc%O>R)f5t}aAPo@v#no=O^&_x8k?D(`P< zzk&J9sXlOt^`un8Q9KrB08gta#bLmOO0tm0Sr$#7I?>{TM(1uyNnF4yiS8LCry8lU zy?0RI{`{}Vai-pXS=w0!-p_w&U+fUja&-m#^G__mSjzQWdXOo1n}5HvfEgE?YN|$L z9*$^emqY%i8Gy&OJAJb})750h&Q>#`&!=!_8imK-u_XO?JfxEHuC+U%x>mJtLe+~F z0HxB>p6M=Dz{8?q%%S+1M4`0?XREFA>-Yoay8in%U3Ds`sZcht~d{OBza8 z#}Cn&A)P1GHqv2&Rz*qNM=n^E(11*dBpTv4gqj}eesY6LO59c+Pgf2cIdj9*jHx8- zkxrC{V0Hfh=xb0ssV;_*BO&lp%ocFYu^Z!=D7A>$mKNx0Zq#ea@2YTvVr#Dj7z`)-0V#b~8 zbUhZbX$+A9ax4CEA&EPF)hAPFXBk9|cg}n0)zQ4wtK3IVD{Ky#FQ>f*8%x5+vVdEl zruyiFF4Dzdy6w&yhotOY(2f~!Tx4cQkEP4$)P%pQH{PHfrmiV%Z7I8S5}B&djAI#? zoN=evj1fCnn1*7EQx3*iV&C$@A|nX#HtNEa&27e#vTlW0ybVINxjpTY?oZ?0lM7J| ze{gU9w1F$l1y8AgBIT?Fq1lwr_f$>Zd37bCZZyl@Nz&^>LjX^&qM=hw^m|x9V+l`+ zZ+8A!bj{E_)2GXU-_fZ_fURfn$VD$}L^9PCl$+|xt#|U~JV{5xJA-Z=-0B-we%K!C zhfGM%NuDDqFj8fV?IG9elbC4Q*s7pYLBUCgQ#L%m-^NUIs%5rhkG8|J& zR;qXh$g#1u0KKDw)d@u9yPBGv{FVaMmajOju1d^yxvvPvN~}1pO~}~-rLyzWbJSj@ zwmEP5#(qDM@pyOd>b8BBpL32jZEiDk%^>?j_(p4ISH|KjRS8I^ku{P2+U=Ro&1|83 z<9>k{?~Ee}y8Vv%OQmd6vP~N)RGJ)~+wA^v-<)>cxbiCTLx8kLOOLG`jP46GG5&f- zUB*Zl5v0D*#bk2uf>G(9jB=K3ezB)W&Jy`-TIW8nKaTXWVS6k*kDt5 z8}IPqmK3w%zgM7WB)(6|+~E4R>k7YE*p$`pgfTpC$k%}6b^Df@pM%-%{&cCL@P{3m zz0F@z_C7PqWO}fI3Gjn+4=htwT0 zN~u|F?FxeLYb}-wcvE$Ep1#|#@X{$D=eaakbJdzG!DW^G;504m(Eu8zLyJ*}A7c8q zE@j_}$*UyZR;lBOg!uTmNq7SQn1NKP#EN69Vg7EM3NXXCE3jd)m$e^IQ+R-B>?>>w zO1wu{k6}|gVR>f>I&tn=bE8oO`45lj#I=J^0J_Tn-+6lWPHJioPxSrb7zzY)cw= zZ%l|@nTEQECptfvJt6trh^19XKfEWh!F;aP+mZZmRK5zDVqTMSx)KDa(c3jDL1xg{ zwbPW1pQY#RtYxVDnf`U_d-HlqlEBe+=pQE2$@A&X?qOQ!Z|sfVDV=$RdCcj?UPRq& zTdl&4L*Yy*p>t$M3lJ%0T`zG3qlvOV!nqo)mXpt)KJ}Ak5z61iq$SFMGdH~3@F2ED z{W5p=M7x(e;IG}9@!Z!opWoYS$KjED$Fl{fnojNchw|Uj4`rLp95K2VgDWlZIdI7qsb5L<2ZiM zCjst~S;d=p5|p#$-;DcnMMrQeI&_O3Wr#JLmn zo0!=J7P`R5y6bWE0-MoK7sr?9jMmtc%k@vR<=%fj*&p|C{vpk;I6*fCcc(5a%h3rO z6yY@dXZP6D)4sC?GV{Ka?;+dtT~4nmEjmsvUNx$UcX$^H*l(JaRDCnjKJCF|j>FW> zdCYXSimo;1q8W;|1YtOoj)5Fs?ys83v4$xPT7>{v;B1DrT=ysYySuD50~qA2q^$NU zxT#EBkyaaSgpIrku}%->C;BF+9BJO9qhq!aR=@CM1Shmu6%q;SDp%hMO{wR-3~~`A z{)SdOrKf}jORH`MkHtC@Aq5utAZ<5P>+5&QDGkAI@OX15F}tr&@vJ}O>JA&JN` zgZ&ogH?<4KP8%m^3ZkPoU|r>B#eWzao4S-42De5W2M%wc^hKgL^mJubDim$eP#8|I z{Gn!oyBXj4Mk>Jb+zEFE-zBvQdxG6RKJbIG-b#t?>jwT{)lUXcvgZ{aJ`%gnpX=ZI z>Fi_t`Rn+jIi_k$Loio&eZ4}@l}u_?mFdVvBRsP+Dm!#0E75RXfK{1kHIHdjNJ%7m za-iv#j)7r6wby5U^A3JJ#vuCsl||HY6+d}`qtwoVP@BTvF7pT9#v6=F4EGt7vkI$3 zs40eb{>0KFEOwk{q0C!YmYx+(T@c72X);iz{8 zL>vmStvo>!FJAdUhV6De;akTsjhN5i`gg#=X;LcDv!4w zKL;c^n`@Beo#8f2g*>Ix-&FLl^0|f#+4ce>a-C2EMo&NTLPi?jUI$U~&2*aOzOGM4 zC{*anTCx;QX+uq261cOvQ58;)LHzzFxK_n)pTw$)DQ4EzY-=?i3w)=~U4pqe+xMO? zu0Nxhjpgb|IEkA(Pj(|so{8y#4;`tXN1>5`)b*!r0e@;L8F+PU3`;T)@r&q!VBb1-0h8pV z$ZDNxFi2wt6~i-6u3wi?$9H@f%A{QCwmOkX>Bhj12@kC#POCEU@x~XUdPbAmmY!ak zZDcvCf61yuG<~RRa?aGLsC;5umtP?;%iXt zy4G47QVRS?p2ELe``5d^(!trWw0`fd^Mgqt`e~T5(aZfb9g6cIBiAoA=iwTMO8xpR z2<=8bohs*@4GvZYHS6rhGn5@-iQ(0V2{D4IPa07AIK#X(jTBWRH*UQLu|54_b8mMAUaqCCCb*w3{w= zB}!^)>G6-inxmbg>a;{n@v=n7s9zScba`=O^zSciLMdOnxLh%IxqDKX-m`<6!A2&6 zT&e!!F=_XvdaPOG4dHl6a}O)%mZ9b=gEi_Hfu8Y0dmjZP`XDyuqwTv$eXQ-?YJ*-% zx6A2`jT@{*E+`K-J$#OjKDrGmJpJ`>ZKNN3HK$q&i!}Of944cm9!&JV?T2CsP?-z% z$W+tCMFDNoC=?WQGmhISVAm?XK$`NG#{W0i@WBUsxUx z=@dbF);}$)8jKb9x4Uf4&%AgPNW9)Op0Y(5Vl3L+YOTsE7a+MKob~sQ4UYvV6q0*; zel73q=;qwY_Y@eR%e*1$Dn0~AcWGPd`{J>b{z^HU6`Z$JDm%k#Q016{7#>@FhUK%1 z?qf8Q(&N1sFHGUINAi`)?A>*07xPjdy;P(WlFw_C7%3;Ty=u+kBWM0lV$}g8EUEc^ zT54{&Z9gP)&IY2GBufczkHflr^5mLIDS!HiGf{b%kMIQ5_Aa2FzOerE@HL@yv=Mad z?!~9H#LiT$$@Zs^hT1m}K&$qdBZ@dp1R0^~~!NLSD3yv?-ETS!H z9Kl&FZ{Bnk&We)0EtGJ_#ZTJXvDEbFv(&d1rdIMoBC*?k)6AEk;$FkR+wQAd|HskF z3MV><`Tz>bEoabUwQ4N(z=;q%U^h2Cwp>+nW+q#ot`~qvO<_Kd%#Z1G$?OsS5lJ<= z$Xw|+%j)ca>wBk{uKjw9RIod=;r!`60?-cOU;oOl;&uFQk+|||D%e%bFU~KIk1r{! z4`|`O-p2Jw_MCI*fqvz?YOH?@=T*a`cSNbnxIS$)8M3C$|KeSeSG(%C$&D~ZCs57u z`zktcvG z9!&IB1oCR3VOhH&%VthPIn0D%`NUBGssd8-(%*vJDWgBHPwB*WcG*}neS?DUE}J+v z9|y$5MbkL`?TtveluPVlekS`Fc&YnZ-|NUFC^S9#)8w$}GF6hrk-F!!4$-4wI_$;S z75J#|d-M2=1xeq!eFdq-`jozn;Iy!_CqeY}oUAMCv3lKLMZTT=_t2j+4^Q299jDq7 zA-pu`Yce>FuOw2_;!gy(Xc5;M-^SK^Oi9hQpd>B#s)!n~46UgxAs$Oqm;Uxe+;kIt z-{7oFr)ubIdKEFUebHg)%$!EZ?9$~8*XYt?{ML$3mF$!OzNyXVLwj~lG?z+lN!imN z3{2GpbR9hVM@4N~?kO4r)iIv=tCN^Qd5|jyU`1Pzw5WaMLh}%%dU(L+_Y(NeHbS99#o}O7R*sI z?aQ%Ip59yKaka^!^WCk(WOK`tsjy`VQ+0h@Uq7rmuU9AGQa9B-@1V*9=p70%?b$e( zX<^(Qmo%K5-@dxGolD2=PT#{EO~!5Y+|em%?|F(wswfzm0=B;NmqEEyv4@X_)F;r! zS`VdinU)$iJM-Y~Kl{LYtIr%4B3#B^6Zim#`zJLeX>L6|miTh4E=X)pv%8_$(l;pT zMLlro2BRlZvP2mRSRS_fk1B*A5AOBOWVF-M8UOj#HlEgo{6gTu-x)%)deB1noEpN2;bjJjU zjbCdE>2mXW*u(8SV!)s7Zmn588Mbvox$S6}x8EI3XMY(oM3yTZ;Wi+K5{0b3 z8dN~#ofEs>KWk8HvM_^hK!4Q*eE?Unt!-r2%iB+#P?^&yl}ZCI*-S)+jX{LZQg+&0 zIefe`i1r~Yr9*ztU$@4g$O?}|pr0;lkK105*tX7l#BL$3R=08)#U(dd6ka0{b%mJY zp-NkY1*vP2;X^9Y>XSD zBe7^i!>f%1AodP65qXazU*Z|BQXM-#lP+96Cko=FK4>t*FDJjKGg%Js9Ub>@Whpu? zzu}Y$M@|+7oG+gjI!ZVfukvIS4^aIhdsUzWk-FIiw`~zQ(l3=baK~x_w8ZQ%odQaI z1o3C83Nb35r$7(yc5OcVx5(Wt3EL7J4-%gSU`IyIyxbjf(f398({n8+#-$V{e;M;U z;~i_eA!R0qfAopFbBezAadO1n%aEQDlv<^r2qgk5puVM@$ppk|Z84)2QmKrSZ6uxaOC=#G$lj-Tow%sN2rph0k}Y zsOE3~Nw<>=HM6j~B2BzodG8Cw+KiDX96gNpa;^a)|1;ggZ5btA*@D+mvLHgwd+@$% znrznDLjRpmBj!mM!9HbYW=A^>C9#5)2G$nLU%g2wn)z>P_XGrhsTajvN34Tw6*(xHGnS>?vKXb{5NP^Pq*fiES z^;4qVfi9jVW6IBI;lY1Mmx3PBsvdZZ+84w<%sTO-N-wAA%(EKvc;>JaM zfQ#EuyjzkaloXB8gw?N?O1zA@E!7-=)Lk1l#5Oq3+E|^wj;`*p$=%$@CR~hB1xkCDxF0KU$NOZNEP9p?ms^`++Qxg45-EAMYOuzCEsgY zM&Sm+kwl;RD=P%qHexIts7t*e@}1+!%NOA;ZD%>g4D!z8hx>jmoG3e8>RCxt+wN*% z56c&{RB`w}U1(-=S#2zDfTWE`Z@WlG{dLq3r-Kh=z|j*u?(F5T@cI-tOTXkkVY%AUPFjCQj9SBC!p47H?lSrUVWUQ`bm9@#~5LR>tbw$2~sM zAZ>8e@v{p@Dn74OTxL^fFZl2?1eUn)0o{st5#H0w;P+*b^=Sx?*yt+yEmAT>tAi`_ zI32|BC!tsemvJp(Gveh7kZV`6rTF~Z$>K1^I1ep)#C?#V2Eq}LxYI4U?-D9-nFQ+U zuG=Qx?j}ld>&Nui4x73s-lu@Z2Dp+YV?sJ!_XW~ z9L^<;4OYg_tPRx8Z8ki#l~8BW5?|qz7?fe(-_|PMz&r4(EA9ebd|A4mqSy-l(|&;i6x-ofE*^9JP0iFnEP zr1^!phrt$)su=zx^b-&SgQi{-Z*&oMpszmEKn8*D5d@H?s{Ir^q;8Ls9d5ntQeWC5 z2_#XxhHZTzN6E1AN)IK^p!!#7VK}UUsMT}t?jJ$BIu~RKD2!rqMp(QlVvP{i5Np}y zXLdCErM(N|w_aYQ@I~aphT~Z4g=7^S8K*9p%JvxCHxc=+uyLlCwIu|N(vnaQq*Vgy z&37%#P75eiM)KU}V(?z~@7wo9LWr3qdAoEj9zW#Xty}pttepc8Ex>$MA2yv%p3p28 z4rg{*_JH5@Zc(N|K`FX4e-ZO`)J{?s3nB#~pdt)_ol{Ec(d6af0aE*r zl2((QI;sr*%6kq)sR5V>3NL@*3~s1e{Y|q@_ulKP!v)@4DMKx)x{Eq?F6iMEx&*4w zRg~I?5_JIQ`^7k zz}J!j8wqXv`AFnz5R({5g7+eGjHTTIZMJAVU3WmBuY{>AKM|}+ow$b${V=*}^7vT- z8P~d|Rqr*+SNc3|{gU6+AC_RVUs>H#9P%3!Y^XaTtPwqd?b%#6`7C{^;^D*P?}8e| zF6WBdYSfinkJdx5cs|%s_9X*a`+*w{8IsMtMzIM!XWsM)<30l=%ryB^ ztFfnYWWPM$7u-sLg&y|JaQVSEDRbdf$g1rQ&!MHmUQJh zqP7L6cjaN}OW+|m7R%_l5*@y(CT))oPZKnPQw5~&c(|3zM)p9H$cJe^SE|b6-1O4j z?m~BWZm&$6X%~cP9^3-Fj`7Hukd|Q>%;GGd-96W~nBOwHY38z_PhcsdSq3t!23~9A&y*(J@??spT5F7y%q@Z7B5aT z%}O5k{PxY|@9e|wR^tfr*|EWbZaJjs1G0>@3MnGx^Y=+4Oh5IwM6*Oz%Us9fG?}&e*j@tI)+$9=49Pp7& zwbUxmiNp$o>E$pM%nUBvhSKm1B|uIMgB5?p5jj5lKzN6SZhX_9Ak#CoM;4~{t?z*v zw^C@dIJ0N0D!e3-ryTd?M?>3czsLJYY-}HLOB29L4~2Fs4SC&;OnQAm2Nyi)x1Acr zH>ka))CzLpUvNihH4d(FP1EMwrgxJu8pMd6x=K2@7E0fShRR_DFCBt()>zl5)BgQ~ zLt>0M{~B@$YR{TXLqhMW73{q|+nDwps+Z32LTWAD7x_SgPdcayuNda{h9Z?R;B)2> z3xm59FEu4*t$3M}UbD0fTM-^UfWE!azG8hLcv^^~!%xmYk#95@Z9;*X_9xUR?FEF5 zYKRH@DC&+q*FQQ>R(fxa@*SmOqFy(Xp<;9fFcBOjG;T`0?~H?%UPC)G<%hh8GK=$5EGsOXDSGpw9vcsQk-ZafXX=ZXAwHUV2h?+zHXPj z?<2YKSLu=4lOAIYK3zH_6g8QQEXjhT2^EQMu{lvh&ISgfobbu%$9vIx=OaZH(N4~m z*TJ>;MqJue#2D-IqZp;Li&Sw^MH<^h7Y$n0q7wKE?y?LY`onjZX{WzU(7^CL}A$96UimcK5x>b@)0cSUkOJ z@&Kv)6$)^QfCq7VcNurbQOvE%tjOcz^dzmZ`so+lNr`lWsJoSiqNgRnYan`rqvef( z=Q%1~>)EXYPyQteZi9bF)<$06(e1SZ+J{<1#lUb?REsdZaqczRS%`c-&G4_vr|lD} zc%%ID^YhX<0Hjw}4kKB>YM0-h!93m?zraPPE1GdbuB4=4m==|LLo5<-zxM>S#4V}Q zhNLb}oE8~X4g7=eB|)+D$d^I%&!M+bqo-$Y^nQrCs0|LxP)-T?(*5s;zFCg?e8}EZ z(Ajxq84Qt;B*&1DRu?ZKo;q$Bc{O}x;89GD_Mmk&G{_^?78_52n#^@M79c1=P>P(> z)?ggiHDRRhdD#TBysq^ca&n@iOb=DbYub%1`oh2R=TXt$#^QHQtsdx-+>M;#EtNn) zV5T3;V5FU^^k)w!d1rlP4WzjIG?iqvJ1Qx9qB_*c1JLkKlH6IEbNqO2-@zrL9aQ9t zmnv#HU&)j)!9AN-rnc8L=k-huwQ{LyshkIRjT;{*rXi1aFUHL)KhwBSR{D|yq8061 zS^Sc-DoCA5USjDPgTzGV*EbmX8Ol>(Tg`9|r*=sI5q~bVKw2|AJ)5Z>Sc;+^%c8q; zAm8AjbY_Pue_!_QIZy7TXZ1K?7HD%6a%|~^#TsB9i~W~a;X zP;N6mPg^o6v}e;bAl!?s>H4qpt?7%&^TP%tkB>Q#uf<(O9El}o``3OztF=UGp{qRRb@iA(~X!ATYHa++v$&;BT#AN<_R|kd%l=>Z zS>BLD!pX?cN`Jzk_)VeQjb(*J+6(nyCxR!Pi) z4pQm|+CkA9A?4wV->%Q@R7rWH6zI}`3pDA%Rb? zAC}TA8R?6&U+(zdX|JTGCbP`#0H{jJAp_mwksoE!Efpn%@~Vl(f z2La3@F*?t#il>E>46{h3AY)@-R{r)dqGvLls+|M^wMr6~+Y2w0zVBZRV;yvLk zlq0+1FY#+jlA(1kphp?QC@#RnLHIf;K?8=DQr_t~0JPb9c(DuXhkMN#>S@3SsrK~c z+pA^D1Ne>Qd}-5e@G8qc%sbMsW8@D+{0?9}Sq-DB%k=e7o$*myGxBVjlakCrrgZsU zR>%2Vdj)VkP7q;vvNw$|{`irzgCSSCOD@hXUg=`K4A1=7K^DtVKGz|b2x%|R!P?ml zBAKY_^25s6#YzCddfJ!}wqpGiuX70>ffZsD_cU#|`Xp-MKC>im&OVhz54vCLVDkI| z;0>_}N8`NvcX7oujNte7EQ|U9#7XmEcZwIcjFBjh4u&e0IFVyDsjO~e<`so-K;TMS zqA}Dwz!y$u4il|=!iIMh_ZS1zn&H~D%wXv=2!KxM0#5;nL;o|7olV43EiNI;(&BKtfam7AzhxqM62tvWNC>xTix4ibrGD7 z)*AwhLxIYIW62bKz$NdFGX_19`Hcy_-HGqNN---clAgfIE=N5>9_dOAuJM8fd6N6y zFN@qqCz&!@Hnf5LdFY|3oz1iO?}?cCIqfJth8`tdhFmo~ZU|32Srn^UI#OwSW;4b) z(jKNTP6zhM`oO>~49%te_C%9sn=hu_e`nvi_}{mw^UvUqk*OZkp9mD(xOZ;`wvr#Z zNC;3g+45|O_nHXNxB(k4W7rm@oYz4Ns+ShiCf9tX%93hL|1hBKZ}~6jAR$6&7jw3> zxlyhoLDb#Amxh)R;!GMj`OW9(h3Ztg46_8{btOc%ultgM%3qvaoP2tt@1?#Do#0+n zfo$sH`t65;Zw4s2VH}KnIUt#JhQrd^(|4HXG@a1?z{_ZBP(^+1m}JDO761Du7c`ud zri;`sZf`zisAo?fJ}$uv0_3F>(%ruFcWE9Hy_|T8-EiF$y(Q*RJAn>fm{^ISYjEBJ@HkH|XdG6|UlvGCUr-zJ} zuXAi?WiZefSxNhyfr`KWk1AiVyLq`I%OY=E;JLb9Ih#<-a~!hkDAula_uE{<@|i4T z`SuSnLx&ryWSdSwQzr>z~r3_Q{qorlyyh9F3&AZ!11J%~k!- z{uxsu%PR?uK9V|=+4f8&%HGYVrEafH&8b1^U)Z_pAu`vvPf)C@MNpE- z5Gz0A@}xuNi?eHSLlv^oNqh_pOk@{D*Tn{J$}Gn1zQuQ1NTL-uy6?=9rh9lT(e^>m z>d{s)Dsf_3RR6}-K{pPfKda*Dzfw=#emo*Kh$EA&ZglF>YA;TE;?{xWM~tD9Q$x_? z?f+BXn=EVE0;jERK-RY~WQ8&EI}Z6EJv!Ss=d(YE%CZe+yaHgr`gH4#AErwTMf8*^ zeebN@d>nlD2uQx!-mD4Qy#}4DyL}y>68enJ(ibUah@@G!Nvu@$uj~az%;gO zV{u+{QTZFrlgw{O*<~A&?6AaHOvj6~I9YxY5Dsmm1h@Cw3urJGAW|({`+akgK?B-gKTpeA<@rj-bO(0WwD3G z(E-3t%jnM2E-Bf3bYE((8)n2@Pb0%Us4S_*Xfl!#+bh|!1YGecZSC*umsgfPFT}}1 zh43}kl8g7TT(H^H5nWtpUYK`_hXFjudgR!Rm7jqn^vSdrhpe2UTeQak<5}zN1!+lk zd9sY99;ISG9j2BMlnn%l1uw05lGOL|z$K=tX9R?n^3UhRn=EOzK@WK7hm-mA1qQOA zcI)L@qd=!DNaGI=rc|A^)rG9S4g}fY_(9xJe|gWXQgdP>7oCCkh+a54{e1+ilNo}j zEbC6IOBneh>9#8kFj)E;Ch>e=0~BsP5j3{V1RJo1YtCNkOHdX9hIP>yy(BlJ7H(gs zWqb$C{ZlAdIxZjI*+?&-g)aU>FG;Rq{D>Pww9`gF?l$b?b}vAWx(%WxK<93L2PVBf z{!31dwAb0562S>?{YOn5jpUHkC89BI7$G z?0&Bv^RwOoWqCby^^)v!@ssrTZX(S19&H}&V%Tx=*HYozt0E0AZ#7EdRj?xd&m}9g zkXAkI^WyZpomA}O(;Y7}?O5#3adSrGa-)&S3z1lV`gF;Q$?`E}YOf8QXUk8)p(UMo z-K_RQNwxwVitFf3yLzj=)XUhzYUnr}C~l<+%RuR2D1u$N?`vUysNq1WGd6DV7V~j> zkMoyiToxs|x~Vv)Df`!!b%|dOVdO*hRBIf&oQ|Krp8?AXBD0)e_xNGj_6e0XcK7yo zpUs{h_^+UYi+d;cCabgEjs0ozFe2z+D?ItN&6dYEpizt}_pqIjqjhV-cS#2uMUEvt zO=xL1b+W^M_Z|cLqIFO#lKA7~I0?&?OfA)2D0;X7Z*O?vvDT${_l^W>?B}F@QDXRz zfg!QSr-qQHsvYK7F=%d*ih~7M#i?=jwWJ>dV0SE=rV6#DNlyr4LYXn=U>uO75tQDC z@^XdEk(6{OUENJwzQvEU@cbVRYWgcc4cwjTs2EbQDVm6+bK-&FFp1X1wBLBw2Tp7H zp31Ws5`1=HDLqs#=5fSyP`;=;fcrK%*xa5aDbuwPJ+OT|4S!@KbvERuJz;j0>AZK7 z&ECQQJ}q?+ZH6C(6%I(Ujr$sM^eT#``0wZw-8C8Z-uogIILkRrv5unt!n6oZQ>?`2 zY9$g>Fdt2LL~c(V*7Gm%$5I+|hVWFReL$)2Dzxwp0pll58nLJexRPN|2Tk+-^ao;R zuQkadb@E5CfJODGE09;=aaZFzYBAB->$(5#dwzeOa0w=r$Jfh-=e9VZ^Ajr<->Pj1 zz~<{eDCqNfPSpOB&2lV#8*ezwk;}`Qt#CP#X;_L?^JGKKp)P;*rMKRKDM0TE0yY>d zsQ=)wr0OVNx@HF_4<{#=0{z=pY9|VlKIe~mOQ%CN2%!G)V`uFl3R?-JD;QnIy?@Ya zjj1m}H|0f^N?-bDQu@)A3*nyEtaamk7E^Cb%m5mxCz?D{A+@rfy!R?5Z&Yl4D?ED1 ze}LUEsnOF7??^R?d63qCGcYCLQlE!v%e7aRSl0=?YU0xPvGWhJmFh zA%Pq>7;f!O#jsOZ!THj&P7i_Jq9mF~*5%Ij>V88HzDeoSWcS$HEr0p|hFMebX~ivT zV<8u+j`&=y*a#e2h!)EB7VqHI{;=P1My*ZC5Uksh`L1CM7@0~rT3gSi1`!)hLt7~^ zu`|oSj{K4;?y(mA?DmcHy<$&-cDZjP5R*J7<%BeCfg75p;Pfz$wP8X(U&FG2OE5x` z!yhGaN73>FK}B&IOZeO1;hz%==&%7er~69JK)2`p@pU$@C$ClYi$Ey52zZr}w659w z5Sgo$?xTeUz6neRiD;DXC2QGRII-g;?mr3$kAVm3eUR5ytV-c+Nr zdFLoYqAuS@4=k_Efu(swmKjD?7BNSZ3E7p=Zfxt?`CLPW^3ql+K6^Ze_Q-kl?+sIB zu9HUXCcR3nza;r5#jNkfSxqaJIdr0^6q6(3PH+$Zzy-F2C&M$<)UKN>k(6`AF3SdE+$ci)jjs ze*1u-?N0xV?LTx+ptYz!teBD#}>1YN&gl6aOge#5Bg- z-Q_`zs$unxSI2Kg-(o2?VOV*DAT7&-RM=Y!nnZ4njvY`c@5n@)EPhv_InwymgXxc_ znYE?boF0`QIwOEm79BZnG;bhv%%#g$$*sL@ej6{hY~LukMUfD?AWKgSZOTz7yR9QP zzV0pf3QqJ~pmyr7(+b&Pwg1GWH}5UMX)pn`9>CnYB|7`Zet*_%K68bFb7+|mR$YWtLo z3@!~L9fcs^)9tT4cJy`MoT4XC*V;e7)$m%sw9F`jA#$L9ud$<^2|9jOZM51-=oRs0RAps z0Fz#pD%_NBIS&?5b>;N@{Vm5VW*$LI$!dFc3b$kMWImvRROiU{E>BlUPM-#-XDd3C z*8`RM1j*3+n@8t9$98(9cS##1=k<#+?fnll9RWs8f8i9TLCH8$67i@YLHsHFkC?~v zd+i-CHlY~@NYaH!yTl2WE=@x->MtHC2w)d2LTSmlEhg({g7MFISf@yi3R%8Uhzj9c zsFu`0{Oo$f3iC3}9O^F|B-mB)i#!Q8yLfwh_MOoUZ}cjB z^Owm@An}CLpE~MTB0E7fP;ksrR-vcR;sQRZ7a#nSd+9 z`xq!$H_ehusynhAov>5XGx)Fbe;j>tu$JakOBe4R?$0L%)l7e#O*SQ?>RuZSm2erk zf?FENnEiof#3EJ=?-5k(|1bR1T5{}Ed*^|Ud7>FosP=Kc#oFn|$Up|msEX7Ns9Np* zxE~8xr3OsS0`7E!J4^F^$9Ead48N1@74ItzIYS2>2)X@5hKNQqDCA#%S}IcqlGc5o z|EBcl=(;@-65`IcG)v^4jn_ z-?gU*WBZ4a7WXt|RLcfeB|SgBxFRauE%!4BlJz(r!$+g8^0bHHbrYPs>uZUD!T+RE zlKg6H0Qgb&?Uv30Zl*?v9evNQ`R(HUt78v(qi)7;Mv)k;dC30End+I zdgt#KMK>W_J_5FtJpIk@rE#c)@gG%h37NhbG37;|0l-d~z^M+y{0KXQ^>jTkONV#Y zwYG?ii^+}96Y&N|)^+t)6qLWe=L}yr@wf4C;a=u*xbdA)dZmret5XcIs|6<0P17vj zi+UP=i_GYfx(eCPERXS;*Pa8_hbV6%)t*AM`Ioqo5e3P1YAD6)xJjuVPxK4Vb&ROh zizTPR6yE;v8rpzm(Ka%p$zww+W#ZYfP^fN8g8uKjFh+L`gdP(OdYjh0Qx+v^h)P1w zBSd#(?0cZM*hzKk6|c*oru9CQ8dnqGMm4UN->Pv~En20-$k$k$0M+ii46L+B{I-F}RqNaN(jIo(U3wvmf@-cd5 zzAMF9oPO!-P;-;#R;KXz{kZC}Z40AwR>Z-*=;YPS4uyNNFomuzSI9^yUidKf*-EOv zRApa&{w#OVLDS*Jfb=~D@?Cc|Z>z}|w3VB?iW}$AYO!9k`yQDx$gkd`8`vG#{MGqN zV@ZFX2vk5qE!IxJ-6ph{C4^d>3pI4F&SQ7$)9CFb6l9L~Z%-~hy?cv=lVsMXR=m*( zPsX`uiQLPcW~E8Jtc%sjl z&I@>bg;jwtV4Pu()cIG|oP)##7}TrdM=&8Z$$T~WOOSN;d~wm@#ge>XoNk0H^-AD4%nXR+mjej+@ zw$l}W-U9M^{4-!;s@oScUCI|cXi&2;;am9*B)_{BCbN{OAyTc?(2TU)NI4#B?_ z?XH=T2AV9LRhu&MRcRZUruEJa`Lm}?70H@xW7ys`7n4Z~q%W-fFQ6W#4^Kf3F)g19 zrMJDDVoi2sQ{U0E+hpGgue6(Hze3bpj$_+>%}t2OD7G}SIn%Gy5Nt2v)Jb}G51J3u zKMJ_QFDwCx6hN6PlE!H~uCvccy91PK=!exgoCL^jx%_8g#AV(PSIe#$b7)ON_! zXxMU-Y&(zQse%!OKgZwL@pRn4AIB{bx}TJ?RWP9m^BPlDIyjQMU7zCMy4&uPz3hWd zL!_*?o50~8dbp;a$^PQ{1M>XUr=R%Dz6V-%0(3Ua$d{{^bW=SA_*z+LZH z{SQE+vXCa)i=}l+YEiQX6mSdq%4}B$&$y%}P)(V8QZdxp<{SV##H?vG+u}VJq+&%B z6=^LgV85}IPtJ=I46ze-H5-KXm|TuNhW}6uXZOo^1#(jV?lg&5fwa~=wgMkKZRMC7 zUA8!XziiZ*Z$Z8a`LB@yBaQ#&5U6rx((Gg{G0d`L<_EhYVC|F1l>pF$)mb%j%`gBDmXb5cXPI7z`xh_)5w8{x#X zdy+f}@xG0Qy3)`wt2j>zg95fXqr-oQtY^Lzx)T zm)n0DAn~M z1I09+JWIk+$&XmLYvg{;+qy#|@oV=!KFT>R>a(Q*fWJQ_m7P#qyeWH5z=!pwdVf8f zXbTqHxwLM|3Oas2rFp5W=jFwvcf}TefB6}k&Ra{06n=LNFS!}XKvmpfN-(J4!i1Hz z8V(DOcIy?%k?xHH(`{j$m(!Wi8*S8c@IURnm64)FfLb|DC_)_RJxI{J4-%~>VB>u}F7$XeQEV!qtml}a4T&Gz)5r$k+t6;p9VR2s|P(2V5R z&)xx*T0%o3Pwu=eHr<-KTM~kBd>;twLW?}VzA^sr`t00(O<>L1P9>|7Clhe-iO}oW z&nE`XyVpwT1lgAMuam8lMczQ1%NX4=Df?bo!b~YiTR0mt&aVwi{$mX?zJQ8|S!sJf z4+?+d`$ljhUj*2Tu|wmF;Z9j)#4JGP+A*flMer@y8j!-)R|!xN``<8uw&QfayM>&w}2YSIrR zf&CX{wb&o(v6h8jh6;6>P_Q8FqD&8r4r?9XG0K0Ug#IY2+Xh;Bjt7&inR2g#{n>Q8 zx7`$vVlD3I*tx4c&+hu(?u*TtCZ6gP^cDDe@<95HD`$@;C{Pxhpr}mQ@ka76$KW{(NDA@lon99j+WGR)TlhdfQOJK zB((6S-(M|EAGmv}$>!D8O`1fB#KhWwif$84R0Ji?a%e z%Q6T1K(hQO^Kl6hJGf@KuVG8W0*B@}*EkPf?Ywl~GVnkeM04GX($HW4rUDrAuMU)F~zsoRrh;2H#|Xw643{47^! zk9TJD{nmp~h0QX`5}Ggh^ZVMAWVt4@0Y_;d!|`+Rzvj$D78tVlj-!{c8}-%{aj z7=ZXuc=YW_dsP}kz<*wxDCLxipPiiF?l6#(STT+C=B&G)#SKvO+g$PA@Ad$7Sw!EY zqe}fb9h#K4{BmiKUx5XE*pAQs`-QafsC|Annx=Acw^4>p$_Uj4?7D2GuR^&?EopVS zg1kTD|B>Zpan<*;0fDu-|9Y8jU{$m4pYyVM?2E9|?vkj8DH80O$R*nGr+pUmGx`1Kj4;)~26B#8$UvDjMb{OlSDxa`iNb&9dCSf3?&s*8+9awxX4E!ONLQ zs{j!c*Qu0-V9j4gxjlx*<18w}f=J{ahX>QOR7?b$C%(*N?zLZe3AU4xon!Yb)#&m` z9)>hCUe?jVS=i+6L~j86Ac@v4Dbihyd>y>0kZ!Vd_;T{=y6_>0%TmHnuf_g*;)Tf%g&tTa_@qtTW!!*oN{!HoGd`~rwU;S`D zAoz5Bdvj-#8JMmU!`$`B?#_DM!@b$g+(9#RocAT@;WINZwSCeDN74V#^{; zw|Dm~&+-;@&wd6kcWt&xr%8`mZiA(M%z3YDt#Tp@Z4SP%*6z=gNFhlC-LMgUlBE>B zP;HR6dUgvWu_zgs9~0bFao$A|$SvR#S`S*^)l=uAOUUT)6tza??%C$u)qB5=j_lsy zYFA}c_~hB)bbpq1QYeMe+B1ZOv`9xqRBX*{Y^!5YF$K49D|w=ek=nimX}&2g@P@%PY!aM_Bf2C++kCcEka{{R4omG09bVGh@)bngc@NuTNQ+ zb~StUV`zrS=G&y8rys#HS5XjM+ZDMeuks*+WmSC1{#WMuFjWC1yMo>SCE|g}K|5sE zJS|Uf4;b*g`^49i%Ez=v1tj{H|JQ3r^y)2s5Jk&@{x0=aj-;VM_*mH6Smi682XC)=|; zn%?2xPhQMcL1YJ{z=USHItP9xg}P^AGZ1M$tgG5+Qvq)wFD0j2k~-xM$LaZy#cl3t z!u0m?NE@7o6-A8#qPQFV?Us(kuYA$`;;z^^_&IOr;ov zRQ3y&$1S;lj~AqRq}T$TY`i!aguB0+!4~l>MrJp+Dt~<#LeI~mg9`4U}{&{z$2-|&+ zSsLp`zQ2~`@%zvp2dg={cO+`i6?k^q)F4eI3m8MY9j&j_35^Eh>Z6-x|ocG0RLB=S$X(Vui5J~kM75eRrqm9sa z>^0d2zn=deyEgc6Yq#w;Ss#w@==s{7+duBdfB3BH2J4~s5hh4s5yO~lBEQr=gD|Pk zU_-VxHx9oz*URJD)D32f!@n9Vc)q!@Lq@ug{j--DEnztm^+%#KNU4KnoR^`u(s2Ke z)NwDyD<2I{Vh~jJ=#cr^?ZAjGs;q;Vq zGFg9;qiybAJ2nT2I{I?kbl;2T_%X0=zsXWN09?1%cB4wV#VMzZM~ZQ=_!pAde>7Th zPf;}=^^(LOtYUFKpANR6ib7~7`->AV=M1$wcOgN#IOe&t%1lmG-0Imk`*SOYViN3% zXWQQ!wx=v*f3=6^apqhd&GzT!@^>opKQ&3>1wd*lr9<` zOJ8x?13jD7IQt0E{f3dwXe75|D7wImpNMJ{j-%D6I_OaTY9-~s0)(YWdCW%L1z4T!_A`s>{8~x0K%f&B3LQn z&zI}7q>qf)#2v@0TSVdOQ&G%Aw z(cg0zMov|GY&VR!Z%?C~15*OM=mpJpPTWstBm-Q^N93v(3p86DFG61S5a)y&M+=NR zo_ee1?QTLVHk$-AGzoF2JPWy!O_Q0Z0u3<2or5u0*x_=!Qk~&pHhmXZNovH}x0c1j z=(54k32XB9RhRznV_lkOrb*TgqHo)D@=XV7-89&G(gy<|Uj@-CrZ$hlPrb8#!_BOA z`NNG+Ypm;=CtF@4+a*e|42*5FMP!K&bF_K)D0H0^5nevZk0^zQ^X9}h~lVs(uFr=*%_{&`eSP{?I>AyI=h&|4(~&}jd#|q2&2oVj(*;KOg=UD{$f>Tr+HE4D!G*)p zd=ZdPerumMwNJUcoNiQ4#soeZV#aZ;9!FfAk(7?NYlyS@6Qj))WyA6fKOc!;V(IB7 zgA_ATgPoD5G}GpcSN;ua9ti|OPq)EV#v6uPTJVnWED(EWzwOs#YK4v zH#XvpR|hs53f$RJA%-|`IV{ik)K@FfWj(EP0VWWbKlJ~%eZ%ny#v5wlH}|5;0Capa z!vrmsk0Le?Cx5@Bx(A1ca12#o<<|AJ<@_wpa3EI1-Za4~39-;FOf zflF`mHl{~pYIEnv0tpH3M7F|6J|;y^#pNGm-a#>_vrG+%6z`p0<9=Q*>f5CULYO=S z0ll*`HPY5Cu{sg`jg(J>&3rWYA#yF|p9cc1;Ze3nHeh=5-_9j4uxz4!@(=!q+jnQc zy0^u2MwC_r6^;Z7t7kh$Zcty1E%Am%zLAOCvZd~fj`fDIE?96Ks9(TVuS&qxsr;zMP`AK1b{)RWMbt>%yr6Qy&&aAH! zCB?nE-OLdH0R zXqf8JY-c_5RF;usg^7Q7@KXrWb3Ka+v{iB$%e4qi^@o{~_CK3?8*pmRhR| zc&Ci%pY2h=fzUL#2LtL$PS8{m=s|$;5U!9&-f$LN9ILiSwmtoseh@9} zPxp8KI(a%Z&1(KKv5QlkH|y8U?mI8*5TWE1R|*pL&ycVs%yh?j639DU7@OgCc8h6-w9DoD?6zyw*jo&PDqePhA7cuRb=yY#6or<)xyl zOZOzey=B5Iy$7n6Mh6*0E_t(Hm+uNm zwf%UYPSM7byJ&ILLd7zd+u1?gh_h&1d=LKf8vWcuWo6V}aHff0_1FGY(N}zj=DvOb^0iaRjmgfgK}*%a zeR*bV#@Ycq>zhs~4;?LcK?YL^Q4oWQKSw&`@;F>C)`wWRT>M_M?CBuDO1=LU6x*~u zuZf?are%LKuwh@f1YX|=_az6|m&^C5$tT%K=J2Iz(xgW_x<82D&)#KfPWkg!zGqnz zH^#Q#pB_Hj4YW15>T$F|E(!n3I(0uaGxlDnmWyf0w~JR@j!gO55Na7g1s6mu8kVyl z2gySx*_ny6b@}Tr$T~D}8%Cd}n1i)uBJT3;1tqV5MgAU>UOdYB_*$-&_fN*KCFipB z-GiJ^qLov#ARB<6nto`%rNC)mm zr$KmW&=7mIuQ5#WzQg0^YkBGxn*OAM@%g={$)1)hq>bN<5o&6+-Umc7dB!}<X)7vd`2b|9JwE?u@9d&Bd=~}D90@8sNFQgHXC2&?G@6oaQDTxV zwDk&bpUIoaZxdlk-qMG08y-!bYg$uWp|2w{5>|45H6n?8cU>4FOQ}moAgPwJE6l2> z+Vbb2inR%#$Jjf$1e-jM;Rk3sr!;Sk z&1&v+JD2szy)h8`_FVnS;yU*3Paiw$Bkh4ywzCl!nySvxFR1N-7T-ui$qR%S9#@9> zcvBhx)}bm1i@vgxL&MdQ8al5GzEt9JZFkrAH#cBXyZakYH(kC+*mNZG?LH39(dPa^ z@bY^9$x{re&7F<0pjG6l{=yi($+Nq7c2*>>_aM`z!3$H^waG!v3iQJPY^ECzblJJR zAW2KYnDD>nz8nw1DJt0_LY7}BE;5EVLrN0NWUHrdZlkMa*KaQC2dfK%h3nU0D$tMB zm8D?R48BOx7Se5yb(g5lTcYCOJfw_t@5LR{Hi}iJqi_C9#>IKc;i?v{e&deNhU&d@ zbkn72M=G4XlCLj}{V)EGPQ1F7u;FWgyd%>Q;JhILf_7kj#HZ%pRXaO!tZY7)C>4H! z!R|1(;2;BZ@4A161x}u zzdX?ro)>`3!Tjdg^LBPST*Yslpz>FcQEhL(EevAM+jW-mmBwjDn}y850?&fa&gRdD zbW&E23)4%lL`$hhYshiA`Og}0{eBmO4Gal3JgwxmZ~6!dpdPA|{8Sj0?V;-HWELaj z`JLPt3({RLffKQ7x>fTYw6NL1d~YT*yj;Bd!t_A_m4c~w=si2v-&w{etg>J^31f>Z za0jjScXbd#@+X_|UY_ooj^?Y=!voPj-V55*UDVnS+xy&cH0uia!l-Z*7FH&VjM|2jNz zgBEHO5 zw|nN*3n3LYYM;A3(uajXDXq`^mwEke@PGQjdy~h~|Lo78pWL(r$_}j<*qZXf z;5dtm{}L%{_-Q+2k5ZYxwgoKc(u(|q=)0@0dbj)?t#-;VPv6tIMUy2}UtmfJtz}Tv zW9uxdpj=vK;{eTb1SS6S|7jD3wPi>4Dex!U(fJ$;!B+j}!g(4Zx?#VHVpuL3GAT2C zP|(J~g=nt@U=AzQg(bzt&Rpaze-t-DeU{Ggpi2PHfQ}a)BahO+!2bM8)#O_YU?~h7 z+^;V$*YBm{&Xh}A6IXr5;bof#LnL@NK&m3CmNl+$Te{)a@Bm!5o>C%P&ZYcmwT%>b ziacLVr!R*eE*G+9Q@qwUZkLYc8;6@urrTd&QG@L1?vVTbRwjx}<;edfpi^R}234~X z?a6f}OF5Y}|JAHv_!5PPt0h^oQ5)OtNU8o4qPZF!zw#aEGfZ9#@8k{WvF7)V0I6aYv{+BrdxL=Xg+7$i~OsXs(nEz){X zi(1sCcG+Vgi`u9KQ-s=vMii}QcOS60-0&u^>8UJTeYHVYa5YKoC6wlhK zl(F=pAPc8}?1qHY)x8q-4VJ%ln7nlL+T)M`ha6Vq@G&lx1KCy?q_9a~#WwQGj*>#F zAV*E4{@D`Xp*}^gBB6@XCisoZ3Dh@J_125O_dAnXN%UXQ%$Tr&8)Q1j3;gIm07$0{ zgY{w|BaC`vJDYcCw*X@*s_bC6=X+^HGT%GiFcxCTc=9MXpmTJIP`mHkVGzq?9!I_~ zb?W|-y;w64>9Fu*o2sLzFIF^sfLNmf_HcW7mtaf^Gv-yg)9cB9nHJYrVK2VbI5H5I zzO52(N_0Y^ltt~`6xTMRy#8v9|Tb)Lr10CX8!kk{WFZCm(V)>7B;1hSCxjm zsd^hvMW*N(DkQGKOk@JxQO{s>wRR(C6X~HK8Fe?C(zvX`9^2BivUW1fKoSVZRWcF$ zf~f>+U~tskJgS;s+i7~1K7EA85?n@kExj}9rV@p_eiRE4V4sX_%pKGR)gFN`DXzhP zf|*iqM>q_i5E2Iq3Z#oKN;m9c4(V6VN2r`9sJo1g3SHE`pBZxVNF&@$o zmbAL-iSC#zE5%GS&Wm->5ga&B%#9W;H+v=7g)Abh*2JjmOD6j^rKX z1u9M~u59~8?-Gqkz`N{2{**Bx5+T6aDR?SKvwh*fg7CE5L8B6`Amof%obDLUt&b=l zo(;Bx3rQ2195ct9{C`LK^iq;*`k1@V!4z>i6uZzIS!|nUYf2}pcoh`*m6&E??VkZ# zPFr$@yZ<(xO&r23vmy&liTi}l@J}g=3tuM@54LHxe-5y*6VTR>IHJy&DydtW66DlZ z(UvLqjTxu|;gZFWFUrL#k&{;K=!fj!NW2wteMkNl(aB*8O`2pu7uSE(G??q_KYlWRJrxJuzZ7_7Y+|4$OGO8)0>k<8KWrKpf^&+PM;?n2=ZO#H7Z z9`gTKVZy>R1%^%e1YoMfe|m*b0TwgEoR$=-d=m}P?j6J0&)Hkluze=UL!;(FQGhC& z=;hG`=XQkx&WH|`T)hN(8&GKo)5rUU>3-wS0`<|ZZvY}u8OwIl$-<86J@uiSoinX-LyEoI1Ym&-zPHjCW{O2)jqd51XBU8QTzX>m>0l;Z*%msK9qo`Yxdj00;9aDr_DieS&A z(Im2SvZTyGcd^ueuXyMLpXG+m9VYW`@p-bIlmN&FADUVF8iNwEiP>tTqR}p5LILq3 zeX)2fxipM8qadA3ycJ#vAxNdlsk=0Udq+k9>2cn^jh+x1RDV9b3#TJW)-z~518}fp z=o^Q`zvICPLCTy>FmY1g2p4LWgk_C;sY zaf7}a)XA&GuZfKt%50`8E?+C3R9^$^X88oSL$@tNN}6~_u?{O6urKgkh{kLxZGi#I zM8&ae=qM_~B$JS~Zhj0w)VLb{5kA)9`Dtt{!;cki0k35bUsO}z*aLrm`yNcK{GnH$ zR7PP-Rx6d8yQ0@;7fWwJe0PF`F8|v<{e!0g&|^H=q$au#aTX6D_3cnzR#F!vgZegX zCI)GZ8t=Z=gczozDQZcVJ5_J!_o6eV_Snz`TCs_ylnv}4y|YMIRJ>|r7R*-MTXs@gdx_hltW1 zj5N5iwsYlckRwX`K!>Qfq+cOTpJ_Kq^CjF}21avW)_?Mn)_mD5Ny>`{6wT&NTsh!tTf= zAumId|FHfn@`oR+%R6M~4lSlU8oFLEsfYZ)J0OY&QV@U5>VK@p;lUt3dhlrRxIp3R zTlN8C-tns!L1M%P-;^I>V_i()vlDt~m6Fe^6r2(~lT5AI>8sUjp8`jyqvkd4uR6Cq z8NQ7~p)XWMNd?zzjT0lCfU?k&l%`iWa2N!0YYQd9KvR6|b$9Du%1&-H(IACUJmu$o zCqZ^do(z^C=;6GebE=6+5Ed(?#~DWjVc*~xoN$$qzkFp zqCIBP=nR+$Z)B2F@kmeG7HQg}2H&RmQxd@oAbf!NmVCh9T-`HAgXhTfqVd_iwYjBu z5d@#VOAm~TD^0?ro&0c2e<+D-{yUfbaC*y2xMvMNr7_+8^h!uwd>!BF-!g1uoSxal zgTB?T|D6~7N^3oY5QLAISVyq|960ULdwA}H3PmsqB=Z+oWENVz(i$BVcR&4u4(giI zxjVczNF7Q&F}hW#tbK3RAi4 z;b}nvN{pgq`vB8Mkn8C++yVL0X~fR0DGP{fGZLdC=gIK3Wc)SBPs-uu;8?qwc;!kS zMEcSyv2Zq3Kg9ZiUUtBerOCkZ$>=v_h;Ct~Wx95nt@Df1UYFu%dbxCVk8?UXlF_i* zwd;aGG|EX$@Nl_@J<_ei@RcvcABBr+{6AcoUhk+y`5aav=Lr;zu+RF(avqOH7qn}k zrIJl6$?wLGf0)>V6qGMZD{tW1Z1`EZ36&WOm{6EYC)0IjVx}i@S_I!D!G{sV6KZu$)!ER$*{6wBdza70f$Wz1|$qy9S^m_L5V?zT_R-?55{ z==MRA6|3r@p&MP>Q9cZ+wZ60YlFsOg%47I>=qken3mQsas*38|rSrW4T8xIlDv?0$ z&2_K*>5%Cd)F4=K_f^G=cNWqQ2*CoE4(G)s{gxwVsptQBamCEp(?>>wxP#blI@ze} zPbWXKa6L4M0-stm!enzfdJjv+zE6)w^m3b%-Wh&_bbm)w*@ zydK|NT{9YGp1taf>dn6)RNK4iLwbm#gu+-B_$}mBVsBad6+S`2l2$n^t|vRxM&Ip9 zJZPHWm6Dg%kAeNn>-$nHvM!Na-@=bVopaaj0eSPL3kW2r+^DJ4B^Tv(O2>hMDe;;; z!1M>a^;Pjm&r|cJTh@$$vNQ#l)X`1}vu0G{46wuxDl%e@G))kZI2bIid@9l3ybUoU zQgNOExdc81F5@6^55C+^sZ2Gm09*^r6%B*n$Gm^1u$QMgSNI`~@G$FhAD$vitsLxv zgN86PgxsH?o}5y7$q_=qMP(}30$ya%m>6zV@^u^lp$IFQW#Y%#rPFVjmKOQ(;H)1X z3#JJr5(~Pu_Ck@=4xj??yi))RHO&u{pzEc-yGyd!Y8=l1w1F=7*%8{a`DKUDEb0nm z<_DGrlOJuqCJRC}!xyB$74w}Iy=Cxgt);8|ns9}rqqZH|___dp%V46{Sx=3Jbgny7 zhfa6{vhGK)!hDtqBl|G;Y;?gGBJ&688${atO-!ZPSI}@_Mo6;NXuyI|*e@P8^b6LU zBWP$d+pIPi9@Z@TVE+)@<#P_uKtH!zd8n8oKDm_^Cg>dr7ERNYLSkSarbM){X+!s* z44Msxm`0%FJYj`6vIAArP97RQo!XEgF@3eDWdP^oyA6R(V1ow~4`&d1^r_Pz*owcP zG5PUTvyE`{Uajbl|F?3^2f>5^S7H#DO?0`H=@sn8@IGl86 z1(9feB?eRC4&mTm)5MU?lLJtp?Zlr-J+w#Ai%1Q+?&0>zGk&oxrZv1}6a|!r))(HVB%)dS#)6n7Zu9D2CJ$eQM!;3CU*?U5r0JNbsptlQs2l&T2r?_8~x00%a5you+ zk$@Ukt_{X(JYsFhe}Ei?4x{N+Utx}fzY`FW{gYfM3s6Eb-4HP^yJK`J?mpefEPq`= z^{uaIDKQZd(TVf-`vy@nB_T~l4l9O8)Hd)V2rg$&EhgXjZjsH^Si@2KGml~AxTc3-ph{3| zX)a}TNE#jS*%fQ9r~|FjWRfp!e_voEm6~Q$`>rg0lJr5TVT@C7C2-YX_u=H;$}sIW zjK|<4YGNpTD?RKM&YPAE`J#q1kWJ^R3e*9fUV%L?tNA3aec zi+bV#4kx_PHpGYYN0dy_VoD)sA0jW&AvuGirrDU>HUpeRfAT>h#p%6xUF;o@=$3Yf zWl&h6pz04))S{lk4OJ!7lfkQWcS4%8Fycg!Ju9lK&$EM>Mj?Ps6O>)wwkxnux|`e* zMmm}UrHb0OhQ*2!6-3e_w-Y{A3Ly@%W&-H0{?0|nbSm=|E!&{E6KZ-n=L1GNwQ1?n z+={?x`Ou~mstD@1n2o~+~!L-ZshPWxK zif1Sz>t9L`_)CXb|NhIN&;x@I0VRH}!q&QuL`g2}Qs zeQEj1(B|`8x_F0b!jnTgm_M+8(AuI#4-KKho>wwjZK4;L)t!~>p1$iXUS-SA$Y-}c zD0qhe4Z~c7t5c!h4DAId=rggvV4?VWxH^1Ey5WL&m@tkq`!?JUmxtVKD_Z~@dMiC4 zC09_uNS62%`Y9!$by?-dAa4zTgJ4$pDg6&>3ar4lZ0_ra3Ntz;ZaMLw%k}>QTbKVu z%mFlq9>W9?|4{dEw43xiFToSPzRZWkAmQ@j${mBDpA7|W)_d(< zr-u1$X+QbD{C9c_z;XWxx4+j8YsTLt_EfTjC@od(DW9u%3Y#i5My!Yf)NKeNRfQ65 z38=mG$~vQcY@bLe`-rewPid!`MBv$zWP8S2BSGyjtJUf0vUMlnJk;8jyz{5I9N|-S zW$c+EjTz}Cd)TDD0HlVHs6AG<6q7g<5@$4-erxM}xljhYn~*=(TuB)>kX zbN3}ty`iZu@wi&G+jy2>ql8uH zNuY+#TfeYW-*kXT-I%o=e@Ye-`p^2lhBB({>=;}A9`c`rs*iNbQlp$utDPR9UV}7S zvSP_+$w%8=1JS5&WjGV@6e|gJid_fc+@KJZ2%czFlP>~d`;?&No|9l!=6~3MBt5hT z3=!xs7Iy|Q1dxwiNW$lfS$kB^f&MgF$JUgtlBS~#yVy~;J*{S#M@3;=W}OPTNIx{p zJ(KT$fD@Oh6Hb4+k5W8Bnn2Emfe@gx<{_1n0J|ElL7j2Ws*kX@mgj|U#TC-zO(s!| zZqGn|=v$1tXU+A>8$=gT5%xm!Sbo`N(7*s;;k&{Vj#Zz0RyiHiM_@;lf57*&3moJ- zO-e#srQn1Z{Xt3IYe)_3c?SPht3L16@uIp{8>&RX$VNHn2r5`zrJ2dxQ3K$bU1CTQxf5M`3(Ob}iN4$21Dt{RjFIAJp9eDV*hPb{)@ z|4NxTZeb9N&h5o0v1FJb++g)iUaJieV1}qW`&?UvgwE+9K8buY^kH}M{kwpD%+tuH z(IDrg=32`%LV-3Zi$O_N1!gJxOU_}Y2;`Yc6Riw!s~&+s*kQ7Uq*Vi{$Hdau3f`_> zpQoLxCxE)v=@u(Dw{3(zeb)yXWDOcURS7`pQ8%e1mNwgxh&W_vLW*W|=_Hx*h+0Ta-iLW!+O z{9dS<6e}B2>jT!tr5`}cKEe>cS^@B!G%Fh3!!0pO5Osln6tHHcHRGKK>(Wvy)fpc4_5gG`V}O&olxRLk5TBS( za)Q{gL{VvD5k(^>TFD54*r?Tolex=dGdO3U+$x2L562V6Rji+mS~VbqU@2)16Vuw3 zWaN3ihQ_mC@q(By@EA1{gAx-?hZ!i43$4fL8a=RQwn8c<{R?niqDxHFrV#yLe6bQn zbusG(tklhZp0h^)g8Glo1kgiDc3dA+OAe7c0p5L&ijGQT5Zg+<=_dbY#g+nghCv6I zQBg2yB2{y!>jXa~Y~4X-+j7ehU;r`1Gpl0>fc~xlOD&(zf@36ZfOLmMZ}u@zy2uJT zO>$CIAFSM;YOni%Av65k&HHi$%L}*cBO37m?Qv5E5ym0nM4|9V`m#sUExmioEuE(c zUv^FJ-YfN(SXAzgmvffvhe1KZ`QHr6*3ev#QKl6Ln)b8<7(>v6>O5{47#o^+f@foS z*JyV)Y#uYz$dq&(D`ZzKlGb1zo1a!0?aPE#6;YOhpd`D4!yGzBjwXMYn=4u4qCf$) zG|cK{Nkc>SDCzYZCPZ;C)|EWoo}KVJvLrC-AY$1Q>Bs=bKQzyjdGMu0il|ST8Y)`stK@w0S(dO%Ds#8bnqcGdBfV=cAIB(kfpaLAv4FCZEhA4 zzE~o?q?{voZGK*V!yHXvE0vs65u<1LT{RbDUDD zt)KH_G&bCtXNy>g@kjsxhey*e{rt)Ex z8^HqEoW`#)j*UPHbVYTLr83=+1!pwEm6TEp0SXC1wD$x={j16N35#PEClQ$|@iz7$ zQiSn}CYFdQajtNxjK}b0UW*fU#uPgo1bQTqer=&5AW%PBb;JC$qa%+B4jKzZc}+tF z=tf}u>eKNTo*QB6g+bKCvLKXb6F=!ws}77BA%Gxr4Tn_hxJr}SAn0Pc%(9~AhcVtJpA$tiU)s#P^Z}6v3TKP2L?&kGk4!$q zchO(MRYiqNmjouW48`f?q{d(eQ0rm`vj_U3vO}(mo4Ogjuc9fKCC6I23P3!IROOB)Zz{ zBlnAgXcw1fuMo47@4+vVyyReHs;LQ@!aPFgp+Qi@x;0xUuZq-A2Yl^o+m<6gB5{gj z3^K(A6iQeIr0oQGQba1VqEm$`EB+}LrobGyd{#| z9C!7?y9o=E&>(UH=@d4uJPNC~G`TpJP&D^$o#cH?ng`%DbuX(^$^W^}joWM~Ib z>SI+$;zt6(AcSTLl6Fq|R+JWeIj9i1iK-;CtM}YkahVdKvH>i{4Y+Bi)@j{|I~(!( z_Lb=%eEC{Kq{&LLEVQJ8MZ>mh0-AJw#naSULS_m2Aersu!YC%ef^3{KuYd|oNJv1U zT#9h+w%^zVlZH_=Ry^Jn`A{laDW?OlisT3cq%%qoI>|{;E3K%pmH5&Y6s016iG07~ z=a2xug|f`?t+d)pcko_~o{n31QXJrmLw!w9A#5zvs6b*Fr{Nz`bP|gd`-tds;zFC! zVdqIEAqX6);*3vKk4kxBj5&DO0d+>94G^xXJg_TJKpB(>VqCi>gaN$;ON75+)ys$@ z13+m8)*}Xj(2DsJ!^}-4n(2gXg22@-_yVMX@jkb+Fmd@_Vac?1#V&EeRoJ_e9g|Ez zA+5=CeDlF{@rQeEjNHR(B}<07JH#bwk0NTcg%_8Z$0!KE7S1V1Y{&$LS^$K5)qUOPEz+-*$f2pRCC_ZJ)PnTd+?F} zB_P7?UiHuFosNliI@923nyEoeuTzsY!HTF<=k9C|GiA=E+);I)|G6a@eO2x0odz9k z8`_@LVMdQAk4(o}{?$xvqfn*mKV82?cZ-+L*lNnyd!_KeoH6s)?vul#sw>b`);=!l1Q4 z|5_?-^3WL4(^>5}iD=cCSEl>LPJ}eoLSzxj16=!A4SkgA5Hw5sDNo?;kz!Yxza(O7 zs2o|SBq*dCRppcleuMZz-&Ic4XQdOion$J%6-DbBcC&}dK<#tV+KTLm+5~b(CDO3K zz^-!=Kq!=`r1XWedZ+oM^c{9%-fmg(pfc#-Bq%D z*aOS98S0uOMA!Emrb1I9Q*6fHkanhV6uGI;1S|1VequX-FBG1`p~_{QnFnUC*hlAc z#et8*pUjU~J#r2Y?^S8!D z^;a&S6l1~G+~&jF7$PY$q%zKwk2BsOJjK38p~Zu{BVgyGX<_u}g0TdX7_1sXNu|+9 zljgA9FFo?BXjOHbx3RH&T~MfDF6IEZRFw0GrzGu1@e} zAmHPT;B`Fp)|rN$dxd62h2hp3V(9Q}W#v&<(ZL>2(dJ#kQS_gHH9tp8!^*2Ib(yP-NF3C6B#HCpmUx#I%#UPl$>GD| zNnjZgAGwlDtzSXKsQOiJtB)H>7>+QU5HCTRtKQ}0cVO};P)M)jd8}`Y5dfs}SO7uI z(&s?yv=AXTl{LtPM;}-=(U|e6K!n-{?Ex_Z{D3-ey3p5Xelg&VOi=Uz8Xc=mtRwhf zhQ_FT33bFAG;kJiB`HA?5@dLUgE&yX>d6&m3b;b~WI#QawmdVZwjAdgBXh~S#k_xCa2MEYz7~%iaD#NevLpw=pv)k7LdpPTgc=2)LJ{znNqV2S-))+ z$C;?YHF@F_LFkp3C##soniTjx&|er~$Iqy4X%SwCwq0s-6FQXf4V-F%oAF{m5OGv% zp~%gT?H~EvP<=o-hge3c`)dXARV|y-m)8 zHChO(ZmAPHkhnJzgFvi7w~#Xp)ZpJKL@OfoqufJg^*75019Fwxj*S!Is!cijQ~#QH zxj~n3T9JpOl;?gBs|7sAs%CheCFN9YIX*mKXzIFHAm6XeJyIWmtL@b>t`5 zJJ#zcH88S?SCvGbbb0hb6Mft0pDGQ9ECoqP3&E=qR2W9ey(xW^Zn~l{i3Sn9{h+Er z;1PO2iK|e2E5H_^UN)tEyS3+5K8t<>(OH06*&o%D-=V%vfouLQsS(Crh6BN6Jzsp6 zm5HfYDmWge?tMqS;YqKrwLVW}EQtp7j{qcEgA={=47BvAS`*~VhcI4?0!TI$(OAYv z^iQy?c82v%@(0-pdDd1NEa>Fv;f8gi&a4}z#HbH#@JI_(M-0Qsk1`jxQ1nPyBTT9o z(Xu_Oj0`4(T~{Mk!X1nqw9J;$CXMg1WI@j>U`gI}n`#@W=K#vM(AiGn;;krigqf5g z0oxIp5Rf^3qKRW!Pq$I zR=Q&jL$gDXG{|DV4!gFf^4(({J8HlsBxMpN66FbKbzrE3u0r-%d) zTXqZoPZXg4*ZgX7DEvyv)>skP0~7~{-NN4$^HR#*s7GOTFu62F8az|5%*T*!CF%_- zk1}$6d+TNtV;j|n1=$l< zi4DC4byS}#%gHCkLF`)xQn>}p?9cKI8-l-?R>1!-bZLO_>{U#MeW5CkSg9tioWz}C z^r(0}q9Z#EVz-UYbrvd1B(__ zWrM^gs0pd+pJy6Vl>YW@I4n7=geVocr04zuQ>%J==7k|Jz9RjT;IAAMA;%j3_p*(1 zfXdq*b4P}ATm85Ha{gntrFK*(oH&6aCuQqKNZv25gE?J6}rQ4 zX>Xup%xE?M9l{lD6W5Ro!`nusLpH9)CPz47X;@ zcHJXZi78WS7}J^HJ5OY)?n@=bF*mzJ^G+4vLPyxb|fYa9T?^#6oWORK4$|V*R51N zl)~T;nnV_A-M~MaR#KJ7K>KxQ1`ngP2%cC2N(--7t-(^5=!&|Ga%twLx)T!#lD2f4 z^W#^AQr~i25`|l-XR0(nGU)%@f8- zb~n>yF^({L`V{LS;DA4w3})siA7NxFs}cy_S7+1B9*vG-wN-mbQL+jb%)=gmgi~AYKUQ zp!=c%qG}Sad;$swcB@gtz)%!O?M-?3)P1ak%X?#XvALWw#p%^wVP!U=oFk*6w6Nr@zd^{|BbCBl~L}W zJEa#9yNb>dRvU}-qr$F#QXG_pL5RE_kVd9tCF8it$tiicVmp}7lvP)8g01|g^3G~O z#anWD_5(9w)us@yDR(cE>5-66j%kI058yhb4pz+^Kb}3%P(r;7t9(WeC4JKVE$iD5 zbcCUT#H#oae^mDY{5wQ^)lZ^h{DdtN?EvXf;-qw|B<@OHJD`$*1`XDeqIf8%`X}E$ z8{;Py^IKSO!7C%4q{e}rRvk96%<30UItIPzGDzFE6B50!h+Z_gXzCEpfXkL;2!g0# zEq+i+jWi|07VQz?b@3QON1Tm=Qi;4_35`{_Uc|xBr9r5sgXc_lHuEh}OnDS)!9+mF zKd;2X(D9Y4RqG%Fd^Hy%ilOrAXx5U|M-ao-at|>z0wk)0UV7fVz`1HuL|;D|p%Njb z&cHjfEqpF%wt6l^#2N9lP)7#kN+g8;5SzQZ_yet0#d5R@uMo#VR)?zwrshVray)AcR@LtacOe@Ll(1Hs16=v6_jQ~cLk zHSLc70)GW709-r7rl_4#K1Ak5OQKx<6>5BhM9?qb(1L}7t8Skov}BCC6`y3{UFh|6Dre=4Adse zj=&ii6tuUIj`0X3DLmL&jV|r~tsjsq!~vD=*sMD2*UB6kG92L2y4}V@wV$hLA6SkK z6ZoGTrsJbu;|gd3LK1*huzH}TTW>4BPB0UYw`OCZ=b@FOT1nDA0XSR7qd}=um*C~y z17s@@$|L9@43_VSUG`tt!Z&u9A1Em0{dBWhKaz6Qx-aNZqv=^=9X0I+4uqY-j7-l= zC%gal&|y z%Qh&4Vx0sUa8s5~_P+lChlNO)$byzqCv1wP>RGi(F}BW?g@_O2AvJ0c{Cz($-@GiNDRoc)=5Q#d-PU>xtdPUDw;AW|A2bvz& zZ}*7)_5RmvUxqaKQuIirwYvWM%ddPugqCM;F$DUCkL>Py>ZVhAHf(QSsil)CEj-65 zw;`P-Gd5%#ekbzn^IwgDIEZBVauW36!QDmx>V4#?07#9794o;FOZ{J($6az9U)$r3 zA>+wcy4yb3Gp(nRy;n~`tz#-;L#n2Ls8j6pl+50WIFU zCQeFPfcGI)3pesBtQ9C(sX$rhgpBDjNIcG)YRPE^1$lI<%unmk+_@7ymg_m873bPW z>dglsgT?aBSjqp6R3cLh@01v{3m_c>-KP-F-&D|ArJi^Y%Ds?Lw^+#uMP=HIXjQ2T zl_3~pW#Tpm+U*1|R%T$DeBTrQ%!O4O)W{+X{ko?k^ z9E60N%4WAoC=s8l-8^pcI}jWAvt4|{`sVaVQn|zRctnYdJ``RrVs}x#eFzkHJj!8a zX+>rD!hG5`?S~)=J5a?VXUqy8wHp~tp~whqjdto?dAed=C9Wc)Z-Y=0zG=MA$-Na~ zB(1=GmKV+MXqmzDhXsgO*cBP&)GaL+paqe_loWq59DUOF5omy?K}N{2V66)g5o4+M zY1TErQIRM&bVnSLR?jDk8~RVPBrOsRh=v*-i^`pk68quw;1Hp`$S>t!#9-uJV^#rt z-kKIQ#1_Bg>jEWy!Nci2!FU;XqKso|9jJvmBw*u+y|X;xx}bwD%xR9VaW8h&KBc8J z8b~HY^;0>d^go(h$)1g(eQY=9ePwwQ<6t?u@h$VRIKCU6UrHNH0|Xi$7L)7i$?~6+ z2q|dL1VH3*?NPFx;{bjiF%yZua7g$;r7{UD5r{%ehyXX6cf1jK(%ll=j23SAk@OQe z8rt6o>{EEqZ4u{mScM2ujebTC~7!U^h)odE07qusQ+HNw$rX|F{PtKV;vj}Th0 z0-U?RKSW>t^g|#}DJbl!2}vfTt7+urSPLO<6**K=wvOq7Mli0x_`<<^sqOrpp>U#u z^@RM)`vR7nu4o!gR;NPmD`YHxhlceFd{in)ketKua{BO45zP_$6Z6y01+6n!(Bpu3 zfkLs8C#K!$0twrB&%1bi&Qf%Fk*cCuIrfpN1o;oWQ!`v&`a8fLKFtVlQH)n^tg>T% zZ3-OHK>^c+P`0t14d;zddD?28vw6m@Y4hHIbQMr@dC8o8&q*W%i_C zCQZcZyyyUHVpvR7Wxz;H@~bNp%QZZcquKuJeSS$;TZul!?503HU^3h))$|3Si!ujx zj#4;&p|)VmxbC(~BNEJ3UyIs8H5;8+lPA%E>#YuBI;}o*f((f=O+Uu-_>6!JdnI=p zLMQr!vt|}Pz^s@^cq*-IDXQ;vONvL#I#txr=u7E>=?oi5?^MI)KKTvzg-k0eyyE@j zfyfw4d*Pd0zafaElo3qqkPdg!k^`Z0h2|)UStu`T%j)w~O?(I?Gm!ziBrQv~24TgU zq^+auFx6&q0YOR-;ZhDJC0=U4J%QTkQoYKUpzJR^MEoRij#8#impqeB@wkxGDph}y zvRENW|32!`wECoVe(^YF=$Df|83U>~@h*Gzbj!b@P(FTxU@DU1YC(VnXKQPxaXZ+A zJh#@;U69p@_1}IR7x$!A!!n8sCN@(>q4jErMrWXWOnrhK{o4hA7WG`Rdub6D#k?)W zr5MZQW3%EVUvClAX0tLk2$$`6x<1)lrmrJ3RsDFu_~b3$0mq3d?g7~&vUu@ROv|UA z?Z178yCm=RR!bRA9@ef&w1fllBuNIqD#uWne77Ue-^ooh>khxaJam`9CSyoRfgIbY z4;5}lAA%o3O2QNJ<9akFL{BD`#Jnn2z$luP55-uEzGC1D<8qRzEMe!X;C+&#r8oAN zNJ0Fv-?9VHGWn`v9ozD^VnR|87tJ62o_46pJ_kEmh=7RHpyzMpQcxmbmLZ}cS|R!Z zok>XBiFT9C%FWK`)<`{#NuF2+3xHu+Q^EkNZXG!rY`NCE=zzj`>JJ(xiaP3xvK}VY zpxHmG5lX@u7m$zpPpqHJInYccdy#ivx6v;;7(9u5NtgeeD4Q-in*S*lwB$C{IuVl% zx(*r;c0OBL%$ch@yLg%=(?y{Ek!KTsGBH545yE#wB@otL8paZD4|I%);j}?Q0?K`j zuI3@l>rjDqaAYk|Pf05w9UjF(NCk<)bb{no-ARlF-LG$1Qe5z1F#LINL@(kL1HPqU zBaQBGr5 zp$29aUq4{{#PbD^QD+{?*MgBXx7k2mtTHmq|J2O`*`1T}s8j1q3hhV6h+{}t;kds; zrIl)97<&Rfaf}{R5z3#R5oq>mc+_cGp#yS?L=h_o$WEsiM-#ed1ffAAe(Z|{Ha&*_ zRaK0->l8GQ2D!ra)Aed|Ne^=yxMclFQDEsXvX0;MMGA@H#%xRsC9pJBo z{4gh3eBrKBS_#ek5PM796d7JD#<*L+)QI+|M(u&MuxL@sG`pNEeBbvNYQ6sZdVuNJ{6Y}Db@Z7fp5xM} z_$VBNpa_aLCXbUPPS-|gNGVj{GgWr{7QOM<^wSLF(O0!1?=pERoV1`vVYay{T4@7uf>n%wN-I}Yftu-+N-YsBNm$* z87EInS0_jr)a~6<%4B2uF?M8H3x&AcEa7-GC0A0TyNUWV(4WrzI&Plb*QWHa2DV!x z<(8c4DZl_0sp!o=@y_q$7E38|CYOt=%6<>uVG3M6!M`@qA(oM z;9_=PxjYuKkB^6{VwQYQvml>X3K?D9k*+jq^cCpanB9N<+t#AwuRR;239csDk9iUz zkInik(Fw``ZXit)Rd<{Y(%9501Ux#!`n7{0;R2cZSC>Uz52(;-53o>k`>;l$d9E9V zIQBU#*m)%xeG8y+|45s%8~$rD=NpG_p^ra5a8VspTiYxd=mYbIZVbA2D%zf$ekUyJo(M{N=~vgqbYo(KJZ zK;jqpYqQ;_1)o;*PRRyK64>eb1G2(F`qdf+9Bn8KYJg938M1=;c(u*xa@A%N*yS~lu{NU1izHxtD4_Yfd-3-=p;f#?@^2`+Q9?}sHxz$774_El`8dq zHRUa5Ng0Tq3)Em!)Q$GZpJU+zRjtXU3gd7>d&sUdKqO-udvf zMaXF|I!U3b5>cgp#v!QLn2BMfK#LcV2ncBdzYv1NE!HL#Sdh)81%X=;lsN9&TE<%k zm3|KmLvY#PmPrO#%Yry?CwziZ0!@>qV!@;&gwZjP(BQ`hwrX&mZl8&L)Il}dUsUDT z9Q5fEVMS|TGwM+=Uol|JP3h9rlD)u5ut6k8eaXzF3Y&3kTeihpx{)Vv3Fa2)$BUsD z^x`?>^zQ|YxJOmE3;|_fHcFgOn;|fRgXR$;J&lozu7&NW@pE>K8zlt^1;LhFvgV~(22Euj_KvoDNw=qfOz&1&<$j(m0|!H4y>z1 zuy2w1lcN#141(akAu9Ge)F+D_Nx8WOq@t*0ev>Yo10(3tJ0hbQFGe8AVs^zBBBaB^ zbYTqLa_=^_yDHImnWij}nKQg%wIZC0fxHH-VTw+sx5(; z4 z8!d^_*EFFr2IzcGK2QZBkSwkxgx{2bq`Hf zwQ2|SF%+~;PXN>yYYv=fcskjh18H>>s9qZ5iMn%NOq+(Q-__OGMEeg`SPo;r*h zNJgT-x?(VARnh=EeKT{uI@%Ctn30G+uQ*8JShbMlrk9)qR;qoO^KiD(Y2i69fkABw zrymp>07}A!RZ5^z4m!{$u|A>oAiHvK0u04BiFkA1AxjD(#3jBl`<%%^U=_8NYG#4$ zoGK_m2OcJ{xW$i8CLo`z(U?$%rB0M&tv^2bLM2#N#$ z?^^MeXA~rf)^jg1a`Lhlp7l)%CEK&>|1B4Hw|&U*h3B2xWW9XyHZ031S<}^F>Pe=+OFXbIEt9 z7)Js^50^kz0=$U>pCsYQWW8B(g9Oe}zcmF$ zVBlYyMsL#QC9tAr?(dN%NHp`FlUI%K^d934g#=pcLyAd=OG2H&tEgs)i3q~BTb!@r0kx?aqLKp{fX`gpavQ7`uJ89DFYd9nYqjyGQ+Viv4 zh@ox-N-xiiM{*Ir2GaD?ImFF8>X0cG@)45=!e)~V63&!D%fbxpx9_lE zhYVr)xWQGZ_{&L)Rjg>X@)jtgH5`Tv(vb0}zmpo*&yQ$!-^e;vQr*sC9zk50B(oyz zG#|KuroOQsZv|pm68H_|qim(14Q--ggQijUeaR=9bP-=D*&G`)aTe{ZP~Jy!=!(>X4r234M@u6Rf79mZd~ zuRt6PQ{t$9md~*ZkuN2LXyiwN+Tovwp*@YE`MH!5rSSz28?fP;g)^c{A`(GTAjL+* zozJ)HN65No5g~vV#hGwl<#2}cmc9$tk~tL>Ax&ux{Q`L&t+=dPKlxx$=9&So>LfL$ z`Gz^OoHDfU$v*jKh^!Dbr7p8gi>*Ps*E>z7BoP;cizia%zjP{>&TA?BR}@b1T7BRt zy04YT`d8dRv<7N>$}ng!$R~V?4nT4!_pW83+LLCEsr!^l-@i9ng7uT`**dl;ES?z9 zx*J%)B1g0feIbXyn1}9&0gVq+^5meEerS0QiOBF7ImMIWR!ZoE;17PIW8lP%NGpPk zKnAXu%gXT4ZHi0JK>o0{Sglh7*n&5tN>c(LX^uQAmM0z$$cI(o=(o&_8ROG%uxWE*9bvsK&;twLl1T%w~7etgBB4)!f*rh51~oh z2TNjXB_izT=*T@Caz|DnzToSHUe5&K_yw9GN&f_&GHaEj7^NPTwrqU3u7_G2dYnm# zrI9Me$2J!3a5rYvxgU$MBP(H?<*rueyS`t<@Je2|4@7pRNP)?OoUd-jc z>ThIUO6L)51h%V23ZtE*wE>~!1UT1#pBOl#i_;WF5I{w{;lzQaP?5f51h+1Nbd}O{ zCRK?X7BSKFG*JfqVR1K6ZOTm?Y1ish-c!^sP?_Eh{^97+QNbkoaKYSv<(OV$Kyt2k z1Ww7MNzW&T2O)Uf`rkEZJ8qgG83y8?p+CCq0J`jfD;m4u#!9?6U1wJ6~F#y^N0KfuJB3dYnAy->1>29fMa9uNwDvqi3**$ zdI}RC>-2v=qjL;R#Q7V!+(ceF&DPHGaFF1)#KDARXhY1J7qf@k9bmBqOZ-V7n_*kx z8bA}F8ZAsUrgnqmV&)G>7!jnV%}8JYx)Y2yr#tN`ieSX{&(v*@YLnz9pr1vC>W<>%5b5ykin8?shfU(@n?2Gev<&;i;5CyZN z4xwIpn1ZmbLzdiA8hPo;V@m$=6Vw zb3pW~<>DK2K3R^CIyfc{FTmppg3lFqJa#Z)+4c=J4RqbF3u_QVC9-ecTSBXY8?6LN z5H?TYg_A=Pa6)H2neFfUqEV0=4RG%kv}UuT4`ojl^?!l}dNK6LZlF6n2V+ z5Yj7!0>P0{LPmp3^p?KEhzoEvW}YK0pD|l7xb_(Hgu7MRQaaDX|A{9xWi>nR5sbpM z467u|0ysfZ@*`M@)I4m&8Ii=}?FS&dcZ81mzyZn|jwT*rU)G!A(O7==cO5*;ZM+@%{a#SScL743e0SHe0*#wIA z#k^t%@tD1Ln&%cRD*Z<&Y20Jpf%*f13oCWRyheiV&_eR0){c}v-d|lmuBNgENS?$B zKH@f1DH9cF`0;DZ)V=Hz_5)-T63%-9cbU1%&DHdK@H*l%r%kfHNB$>Bg`N@1$t8v6 zrzQvWJt`^@TBAo9&lAbP6=h%X8Ia2Mx)FwoXSF`z;*UTMEyx@mZvq6m6d0N(2~etNBzsSG~+&`0#J3d z|K4Bo4#$Y9NV1A}dGwvO@Z3n<5Zqhe4W3&5pcyHPb9f(!G>RpQyT@>svR&v|FdQ~8 zM}jU!NqbQB44B7SC?XSF#v*TsF_2{n8I(3TFGTd>f({lIqz{WBoB|%?y&uMlH8=)W z>yeo<>csl0?xzyZZTJB%=oI7TH!gPTMc8J_F(O!0fnH!Ic2RyWs=*-Be0>O=K0wm_ z!&Ev-ZvBVs^XGc&lg5jVN;o0X$(H79I%_$6mg+g73CA*cBZL7 zW1fg()B*7`o~2+$A*4ZfV&!Vcyt0gE{TzNJ{CEq`iy&$3nhHZYOx9l;A}BUSOAIGB=yjt=*fK`N=aj&7PXjdiZGN1;|B-`+`U!* zTyHl^c?=f|98z#fMgKgSm>yo|XRs$Qe$5lS0nG!nME=gQ-qa5g6^uqIAVBgpUI{Jle$!tQW0t)nr--F_b>vE2D4bw=0*Ejc=Z#Q-ux&YuVoZ2(4|9+B# zF@eCO$FN0(uH=NZ)$mw}G`XTd)A%HkXVdAYlR&pEqyvDBp{E7Gp3~tb2A#UY}JCNOOLK& z^mU{&Nq4i&AV!zTq7dz?ze-)*y6J<%tE*2M-hdqs5y`%+M13%!E{KLC%) z4!ZxX5#{p0~5sUD-%!ytCYFs2O4A}Kjqkoca9XC zzbJ65I3N+2BBJWVu2DQ*a&~tJp*cw{jKPVn z4J@N#_m7JolWPo})sOKHYUioyAkwoe{C;Vb<-PzVnZB!Bw3jqN3Ki=KjndNs{V{~PBJ@96|QjpBs_32eDP zi%iOFeq;Bgs0iIm>GLMSR#qrzVxWeg_ATK|g=+YNwT^b9w7cSKdA(I*GoZe&y4>L3 zbo3-^5p<;qg~RaH zUsvR*tQikdM(d9Bbt`>?HxXV)xDhtX(%$nlbnQQM;m8*dEzoDa8pC0T{$P$^!AU_n zukbCXLclVZNO5bVkQhq1t4CEoP=f;7UoDU~FH>|t>P6Mq{t0br)z9?gQVS{rop2hN zsMekd?x*XGO2d_$oT#5b7f%`9frYqKJ{E2g7Ax`FXq#LYWbWP`S_y5vODkd_e2Pf&5SCsIIK?RSJDkX*z)s1;9%BgQNo`1RQr(~c+_ zXEDrfSf{Pf8=`a#x|^}q!g&N+blWSSCJ9u7MVO94$9bC@4dHBnopYI;1y=vJU$eo6 z-b{+6k`+YKnib|zFh^iB>56!(jyjFc^FQbd@VYZJ664z>4 z(u^?Kt~nkU$bF<_exmk06sThh;ac!_tCcSsjqwdqn&q%wflTu`oK&rEXM1Wq>a6CK zBy?Ice<1}1T#!wtmOqqtDc`~03!@V1RR~JS$Q#O| z6&K_mz^3X(v-bwA_UW`8Eod+i&I#Mq?0QdAA(De6q7nTlSjHSC;6<|#emh6JeB&~{ ztNlB>5^9g>uk%0?Vj?$r6+@mUk8@J`zp_<|sWBAz$E=`Qz`{^~j*{Oo`d*vK$W0+P zR4)WV^I6*7X64*ICmxwurYxwDNkRaqmAi;_H!VgvarNqU6|7RiOE9R{hneKHd>IYC z?DvMPPdoXM`qQxoiEMo77*dt?4FWE>O*%p>A=;aIKU@3l@ElA@jPVu$r@ji@k3SDp>8!Q14_D|x=k~xf&r~tg3Ca;%y_!j zDU!lUb_<+x6_mjxkd6XhDZ3s^h=7HHV%-TbWv{=+Oxp$@2%SO5goywsl1=|C>PCzY zZhPNAI+RI9k#aaEnb8U!gYKF&Nx|9_@6@t+4aKt-nz|OMAf8&4(73vdA!lh#OUU7I zF31H?Tq9!#;8M|N_igMjie*0Fleehy$$7{JyK5FYf>i>#LS@R=XEAfkVZbuugC1E zF%^jy=h=R4ALTukOovL;T}Xvgvj_H6*bKTEd`QT6HW6Hm>xre^Q1`7T3838Az2vVQ zlj06haOpT(z}<@?q^%=U!e*G|28q?x|4(QRGh&#n8QKFQPk56AmeOGApjj$sL9pw@ zO*E#*P)Us6S$$ud$gePHz9I+cor0TCLaSr5#@?!{6WW|4eoZ*CjClUpP#b-}t576k z9jBR4qdxa^*w_A*aXdmqi{0Zglu=*x8p$352ndxhFSu=yVEjh4ns?c8>li@4!x)Y% zOkIlSK-sRaGfEnGAtS*74K;3WCgcJ`STC25wj@@K=+;W~_0YPJaZkSndI7R5(WwqGG5S6BRc%3*h7=cU|1_HjG{*hrBP?ts3s)sbYp>6y`TM zco-#7?a8ULUXhOWqnp$tZR05ctO(6X`Ug^91M)_w*5~Q8;QFWxP9NN29%#fz6`QGg z?)Yy~yU;c+M|1v_#^6@M#?hpVqF{7R+>D|UjYe9^gjC8~Zq)z@jgMNI@&r`mlyYa- z@);N*PXP$UXs+X4D+Aa4p~F0BV1 zNpd_3rAs6~>K_H2G84a;IF)Fas~~IYn=5IrpqVjGlo<;sX@yq(nvg#T=AFVs0N7Xl z7otWK8moKW*5*itla^L>5-%?^oXcE?@H8%<#}(o!-`J%mav)bmmc5|`MuRMh=cqqv zJZ^~qNVaq`MID5FS)n5A80k;&aV{LQi8ZjM*lUw)u23r*50cOUICb8o0+c@)u5^IS zfe|&Cez&&b4M-1x#54zT2Q{{AlmsHC%~iyuoS#jho#Q#j%k|_DGueG4o?WQq+|)&7(bG(I_1N zi8IKG+sW*b0nKI8m(&7{@6bzD#d<6CFQr{1$ph#cgW&ZBKv&VCjyE!(#6hxX9E~bV zzGdg4&CmM^`_lUE;0^zaO#)7!R={g@=qN)v737tyP)tuGwDlUxU2AFqua$G$o~X+e zUP2|)TgwBILhE!kx1@tuvPc=-6XPQ7$fFR+>q+m`HV@_|pINNshn0wof(=wo{dP(E za0r1{iqsTGqGU@XgAW8>7>C#(I9ZTJ0m)e2 zauYkoDj&;7@)k*Za^w?Mq(pL;n&~_!?obr2c$lEngE0Ic&t_aK{clxfP6Q$7BVcc$ zEMyF{%#r`OAX7A7SpzXLoO*O99sq7K`L@~-{U{|})dg$YZY+rfl*h|xOw?d2czc#q zw8o5Ac$eaSxve>&CEGhO3o;#CjYvgD8xpaoolJJB9zfK8! zua+A&7fn}dx1FxQ*R%hg$DI~5)q*f$PKAf5!)@Y?^RxkZQ`Z~Vj#wtqD-x1naJXqh z>eZm8d@4$f@Y3t#)_Z!Q?}ygO`~jGghPP`xq>{c&gxyl#C3+@?2Pt~u$f$HWJ<}qT zQDv*$<*tQ)NK}@+_q=5S%!@+%4>jEp-~R`HDrrVx>YF!+yp(j4-w+cDmU&hG7!_E! z1xCDl+!+?%sKu*rCDITPH!QA*SYN6i@iwr-?@>x}pGTj9aDvsa`-_+p7@V+*X`uz; zW449#0qWgS<|%JB%7G8G@sUlQ7uL5prqpunN*S3FF+W~h^1oSQ6|!5j1lMulo4H*4^+B_G>gYHuI z%EYzce@a5ePPnbB7k}CXA?8+h7{w(;Di~tP2rzYxYFV-HOp+`@h!Ne=Lb-l4t8^Oo zzrmWYHb@nt$iMUfCF%7qfM5LS4S};aWmQ|m^Ux$!jRrMh-iGQ2j>+tPLvPqYcsp@# z&zo&ezG2(beqw=R<`M#&h?|U=W;y23ICOk+*h4|@klQ4if`8tVo9D_@9%p0Gh(y4d zm4;)&^FVLGPmX$kq? zCP+jonsV}E^3SYG$ZsW9D1^VWxQ4lsZetB}tid+>%-X2stdc^~c``d@wq8Zk@rkfv z!9v)hbGOq>6bq!i0fqRMLq5w&=ogdL9dagxfZ{y7MFbXt$upp73`}+dkUdgkD?%Fg zPETiQautk(6~d1whrurFOi6B>X;0e;eC4;^@zW8*fSx3q@sm{HUt&$~m7Suhrm>JB zk|d~i!fFR8;`?Gv24z4WodS2{>kb7&Q)EbJ%pyzZmZT%LrYa@zuIEqlY!{QQ&HiX(*dhNP8r8+BqQ4 zPB^v6`Ul32rgzBne830>4+#6koRCEd>OJLEeuh{`$}h*>pUYS_LPQ8*?~zv5)wI?o zqMnj?#wsq ztxgD%#D{yFY#6y>-UY3ZG#N z&UZxX`PKR%Budf;#$JHGOyNJuBKy5Yv|)zpi|x+|O6?KuBS=isjp?nZqo&|{xu{ftq`_J!3NdQ~q?J_c66YlwY0 z>*PJU6oT(ifRa^GrBxA!EP*m@DJs;WSRdXE)92r@!o-&>^-4o5xt;p|cf%t(ck3c zm$@y1TJ!+={=Q}E-)vXX0D<#O!!9D<@&!siEIXfx4b%iFno9)Rtu)2LRm!ly)WP;l zpb=&g)Ijp|l&R#VlC%=8P2K_^KF-1mAW%t@q&DoK(u(yZ)6N33GzU&;N>Eo7 zyjIyNwU7X@1|XFvUX7>}mMJ2dS-&B}L#uCX`W`(d$EI~SH5sPF{ zr2P|+4Gd7l3y^h*7FHdzC(FUU!=yUC$h*592gUV&hihx?pM_IL<^dT(a+5uaRT=|H zcsF>=f9b1))4^!Sgjeh12wvKLP#f_)Nt<{p6b^Ho&Ql+VJMLJv3{$->>3lzR_ND{7 zyFA<&R2oZK*l)!`s}Q=nM4`0u8kt@6uYTHpMecgIP(K3eXaS<@5*YeZbSlb8@!N* zby9dThRMe+g=2*VRE5wwJ#*mvhzK}st95*5Xz;aqfR{OK)G3kbjJ()>3G9L7qqYdE zRv>V&P$74ocgUiMOg8$ZLza~#{Mrm)({OVyrE89&j6iRd0vT`Rw-ZgshOzE>Ys_PjHuargcz6RdGNZ<~Zw}&Zh=@rxWx6FwFGRFoz<*ViOg7_0@%@aSw+Ooi*A^A`0t6Y%3~Q74fP{HN+mC+{+*0J)&TK@*&s&(%}E61SkLy(gAqtf29AsNrk9NZS?m<>^p z`hOSDzUgsUHLtVoS(s5`Sy66-rVs}|B@qm~bd2eco+kZdQVBLdTyhOUX{+%Q3=_-? z-7`StYyOw^_R8bqMs$y&aJ;E&;y@me$`F49t}Js0B%cfMRLu(%w;DB<3?rgYmT<-V zn0yCxOnXAe;WvIQs4gpMlV2gsU*o?b91yzO#h0BhaYDceHt6sgn(Zs)z+{ zai^9+;}Hz=7KslPRX}PjK>X5?0Fv);5QY@0X??Z`dUY%G;AnkaG41EA6^N4H1J*Xz z*O+XWK-hlLb7n;axf6nO{zy?b8*vCa?(7+ezmEU~*}a>Y(lp+X@}p(uR7)egg=G)_ zuc>qLY@gD5P-bY8P9&)?M?>DKe~=&oOA9S`?S3W6wrgEvuI+0&3lfHi1#ynWqw;kH zLR|AF2+518^fX+ni-m>{3emFkH`*BqR@}pjgYPJbsVD;dT@|gEkyY^;&Igba-5|LZ zkMS6nM>cCrm(>?Z2{ZYRMhe$Ox-7czY)-O+VMO*V<(G0yFa-e}FoR?#m$*$;A!skk z-zH76-wq>u>^amNW7=TM!ak*};_JXL6+}*~!a@-YG(VB-ijqaI%WsN(hs$BR-n;+m*GZsK@x^~H@rNp(!k_%)r1$Oz^aJix_!N4^1e=Hwfn z?twG`amyL;K6feOs>;U6XfEX+joEP(Y0N@C5=B&`n58TU8pvac{%rU%dN^YOvH{Z$;(7~3#B3(`XO|}`KOytAqy#!Z zz1i2<+3MI`8Fkf{sqPQKQ)LN5rD`aJT};T?Y&fe-iYV?^_wdZr zz%s>Hy=TzswiSyYROj@ZTnKyzD8_(IQ{|Cvz^jM%o26RHdZcO173Lnhl`O=;MUfs) z7E85#h`W^hvA!@s`?<=!e%Y4UEE<+sXY<($U0Dp;UJ?s`MD;G)bm=K z3c7QaqNX&&3y%L6XpeuQ;_;M$S3xZR$Q=@gy9!||9`}^aYi|JOITntnWK#H&$MX}UuvTYp-)OX(nY`JYsgOe*ij18 zWPT?-BPoLNBqQe2(1n2nOWEn++mcR$-U$sNl?iKe%k6P={fiF-CdxG)Qf_WopR?`X zSqcWr(>2E@lUdapjL5!hqP_W84Nv>Z5VA&L6`T?5(pkFz>ihPgdOl*-wtG5iHKP*@GmQ!+STBh9U& z<}IBTVIzNUy6Ie%|`T)2WDK zwjTfQ?YsD0P?Y9~sqB1j`*g4oE{I?8N8i=IuorgtXD`MkJKoL6CG0jx2IIBER-44a z>QC%yE1QDkS^z2WJI^)^8hl#or?q8Gx<$2HWVj@{fO8aF(M@qQr?6Y^yxCyRHj7Pn z`21(+lEx8RGw9_x1u0qP*v>~6UQ zaD4fK*K|{kMC_MCg%h;ZHXB(W$>}v*Yl%lBf^Vi6vOzvMbM@&rdYXmK(_lr8`? zz3rGD8sAJ=dbb@fKHh`b0EtlIbD167QojY$Iq{EBF@qKOWBkDF2M!~$Y_spC6*mHA zDaR90vLf*nnZy6GQ4-lfpy3~BK-o}|Z7O#X-NY9WyB-0sOuwrm050;^$rXSJT$glO zm0LI|a#kKX*CM_a5}&P9i-rv-hE=eMVhDUD}%mws!ReXaF8Moce>id$cd5_cOIfb|i>VzvyuyiR-i9?ep)KR7d(Fq{f!X1}#EM*pzaml||^RF5V( z)`+I1OUPG#TF;FipK3OC@eU2h4I%K4sae6;Z8C_N>I&^?*gN}@Xa8GN(4^^*v(g;V z@vvXjcVSP!9gRjCLRWj0aFvM#c@t0_9Q6BHlS+m*rAs=oL6cOokAzl{_)-_xSHtpk zScs^JbMFP26pI5YXM1nrQM#*-Xii z{EXKB6yf2Im^%=>lFG}0fX`7!f<>bA!MRmStui~C2=JQJPKy@=v<51S9o=n=L_6QX z48p7AWT_J0%i5Fg$o0D*tPHG&nFDwQum+|<`kc}kM9>u^J7yOpd|^+y`=_m=v+Pxw z)o;%txG%>a-NVf5#e-pq9#fZ|VeA1Kk>0|L2oIedJq0;@1~U*Jru~qFtNPX`A%?Yp ziCMlB4RB<=3m^ffAb?3gS}F%Pguop6Fd)`~ILQg{3Fij&0SW-wsTBCQuw-Mc(B1Tj zkPvk?*lPAyB0dxfkvRq~3Q|cqp@~5&E#QoraCZOyCGFm};<~bRLBC2|WqP$`ls;R& z3<)G*K(GKwY2EA=f{=tc1e=3oc+Gl(x~$83gZlnH#+(tz&Xud}s7A*NAIsk&$({wBnSWs^}MPOHQ2m4qH?t*|{}Cw$Zmb zBkW-+wWYdyR;gm_XJ70RH;yfB2bnUybMrzD0DpE716S)|@24Y~3*I)WgzNn6AGilE zdD4sr;+9N{lX&HUe-qkKTfFV`R1!R&AvOI8r}hYi3$EZEAV;@s~|hwas0Va0Yqf2>dmC&NMOb(x~tu=yCw}=H~*N|7KP=NJ?{Xo}#7u z=TLOODWvMhoy;#)!Rlx`g)tQwrvCLx`F`VQp;uK|X?ig`qa0dzV>(V!s;?P2J~q?> zbMeZW8yCmh8IUqudHxJ)%tYf8m8*8@yVl}Lb=TX%J^;o?jtE+J9(Bn)0Y?`WGMG74 zEp6C%s~X*6T|#oH=LBI-4GQWyi`~1rtiNWVfVMY+XL0VTc91k(i^&OAvKprM{+LOt zL-Ar5JMj>$McoN8>hs(ge_~^^QLA?!MO4h5V<_*kk`VN96oo-{JPEAm$#=SSgn*m3 zCNbzyy_~)->3|igf*qJi8aj{CHA4cI4eLAD?(~_B^^9mp6ZvEiQ)%~6UZqoT8(ogP zsv=&4WJ3o>8fBfc1*`z!D8~22O#61@CUqWVv-|xg=>eyVprNKFK#_Y@WEtS-TK9@Q zQsDdYU8`5Z{Hb4#k?6`g{`ffH8C8qm_T84%zI*Jnj@#gWDDF|a%JCf&8`Y1o_kVZ> zwNcCpQ1Zb7GvTA8;_9z-HggbFUJREEJaszL=jkMb5Uk9q>s)w{IRcnw)eYK956&4eY80bD~zsA?+sI-QyVbevA zJNCGSo`wi8n3-|Y=(f}okbVZoO;L4lvUpXt_s!&W>O&Fxp>#6~aNbM02Y1I7Vr;9)3soiHxH~Zp!l*yDVLL56%03BNy1dU&mq>1dp zJi>>&Ng$c%uQX?ykRcLy#caxSHtUXBboCaGWyeH%R?81UR7G`rGxIk7m`o3n|GSTG zWr=%+PR))KQwQpM4v7q)-oe1gV~4i(Hj|`^^1Xv6Z(_>GTsr}__^VYl6z#Np&KnrD z5q*?f4hB)Pgj{9c7^!ezTkyVMcQ5DB1SBlwrhi?--+5ZbZGPpi=>xX7TXXG)2)z8x z{M<%aMn(F(LZ=ta7ENh+ExF?D#qs@e`LZxq1>Z{Ot#6u+Q0yjM;zgufiLHWG#ZY}82NFTZ@_i!=jON9KyoPT0S;)sPi+9dZj|*`wFX z|95xYE+kWtHh%5K!r^~-7io6cnf>t@Q6|s&{RzuFc$ekLQI5swCprMR*cSv#yI#R8 zmce(M={bbSl_U!1)<=T7>4xe2JGnUUd3s7eDDHQu~Sh7%e9HNWWN1M%?_TnQl4WX~3+0jBb_D-qp4hZRP2r8CQ7aLv} z?0+kLvo?7gtj@%{DjZOjBf9f8Fry%5arS;(dD6FvMd82>6E%ayqAW$KX!)dS>llv0 zaL7<*M=W3ezJ}$)K?F$uWDh@V6+7B@7fF%pI1ixQny$48m6ARZcsAjc3U~5t`K0RNwqXp&39p{)Z$5)(7FImshCu}mpC7EfBnb1A z^ zw07zMR52>tPFct71_}5T+xm5q(b@6s{rySSI+T%AK7IL*kH3`#RjF>1a8z`#!4vsV?t#Z0#z=d1D{f@GA6m?g+3VRKeE(gHslVGj2YXNBM#~jN zBZ$HF&|exKn=;H2HiN3M0QFUtJPjQoL&4DNZ~3Mnn7Tb%W_iBKqrp|1UCr0l=l7o$ zrk<(!=(IaoDH*Q;xi?u>WIRN~Y~)1VO4}G1Pi~J-7n60wf8s=YvrlINkRrqWP(bOX znIw^UnEVzzWR3VU{^Wio zES-F{HGTCTPSU#ZCj$7(9QmT5WYgK0}d+qH?>P$LY^FsS=CF+!n`{ zeg5QC*>q3wUtNFblwO-+y@{_P*5uRLQ>|E@Xhg$quM_s#R8WtTyZX~`F}#M*;BfbK zPq4$;u3wM(MbMM;n4Dx=S0}gE%BU>S;`8-sZJVD;v6PpH3>Lb=`MgeZHmU6p!H-wh zXSW|t@{H@mWnvdpXF<^Lvp?P+Qys{gp%_r(Jt3hX8b=QIOH3oqK+1iJr8p?&=Or~4=n_HCdT`UV0 z$2VBbB-ePRlHx3kq$_etU+M~%VXN0MnRCHk=ngLpA1<+=<*(n+ejp8M|MK;iSLEKz zU{*C2c9?hn=bRhSCOq-1rG%{;)eZ6AD0!TjOS{q3yqYJYysmd<{`L9d-HG0p9i`V+_keC_Vz1gg4=*l45J5}+!#9}3fyS<^k}Tlj+UV4-SX<4UQ0Ndd9}J74ukSof z4!!w+&Q!ZhPSvB0I~gUC4ycx#<%q~@HH_^fqbmIc!(@U@XR^bbhIY?!ChR|ldUE}7 zfVHnPXgw3WIF7sJTVr56Hrn$-=>|6V5x|KHWxwo**qybQFMkKN1Dz`M{=z-&&#o_T z-Nac)Oh?iN4=^6EGs9>8>uI>1f?Q|ES7pK#4&v@&F=53BR(po^AncF!OR|UE-CdrQ zn{j9&2)H)AyspZb{wkUcx98%HkAjV7T3JCL#tUpcSHd$0sG_|`c_!)w4%!~#9{N{+ znxyU!gWA0-gta1J6Zgzhi$osmCfJZMrWti8tlt(68kq`|YzAyx5?@VKn|XumW+32|f8xoZi1!*`jAV4?7T5E4G>ZHxJ$;q7+jlyF zSHC8Hzc3yi?bEzmsMalCeRiw0r0bkz=}IBPT?TaQgBbl;v04VP_3FjTJk~}RPN)7s z{?qUD7U7zvb-1y!7eX0^!yrb}Uymx-V}TQOlrKU0pp`(Hg&R@F{$h%ms-Rt%RP?o3 z&~-k(C_{ep-7nnu*6#t0l13$nXFd3(I}ux+w+g9VtilDhAZnOjqG>97g}hNULv zP?JPSd@_BpS?5z(6Ra07v9hOfBM&f^#1lVGeqFD;8++PHGmeHi#KGW!8p@oQE zmpjUFf3>&A_MKKQ8cr0A2lZ<3WjsCjF44qyqR2!%QT+mF4zTuHexUcoc4(Au1;{2_XFVcTMF1LHt7Aw-e z{lKd)Ydu4OLr5~dmp6(>F{vs!*LblFq0NRHatrbskxRHrrDUsCVA<4^XM^ME&c-gm zKNm>-WOZ%wJj{J!$4{QrjVG|A-?)H6KTQ)CUH`_N%wa#qZu`1uv84>c{4rUvZKXx# zFCJa;p%3qeu2J;`0n-DFmGGb~I=xp2Wn7L@V_eCK+t&(owy)0D9ICYvE&{&yk`J9Fg|#4H1(`b)qFbEk<)gG>aNd-F7bf@jAm17F*G zD8cz1HoIgt{`IG1geq_VuxkDFnQyCxxboBVs>_P6Ts^7t2UiCQ1sJYguT2R>&Lybl z2G(_vM~qKt!X3>DQMRJ-hpQ!H81Q$$P>DteC6~GSLeW;_n?3P-WB1wS+uu}ZwhRD4NBOc)6NT}p z{{(Ni_nk5uhj1nBVtYPZ$X)dO9ZL@qVwub2Q`?K9v$do^4pjcAJG2c)D8Pb=c2;X_ z;c(&tOos)vul;57@D-vaGyiDvbh?l6_$v29Tlu>RewW5W`?TA58dhja?pCtM@d&Z2 z04Y#zigMOF@8M(1*Bu(p=5vTawkSGTwn|&v=1L<&*AT^SfVMTOzKP zCzpv{Sa*+wDeBWZ^3s>8`K?Bn%c-hSg?ddGV0ugqqqsp?x1FTM+O@0pkVW8=bLv9Z zN||^F?^&y<c1Sq{?}J55wyNg1pBX`5_ApeDl{cXHnW|XR6b}w7Qi=L1GR4V^ z=__go>=_=_g3y!uc;Zfr%63b*+pZ_Yc=*b@xr*gHb*0gZvK@(t;OOolyONLc7lKgTAdp%}o1V>ZtB3ITc8`PgDaf{nRt)%lwhWvoCP(9UlxTcGRMkTLGfk7>*NVe-T4MIzmX;3H%zF$JL_4#X}!+zR8KiNO#_9f-<7 zZ~uzV1wcrpy~b?b#AA#J>Y-70&-$J#3%8^!MB$N~D1#13MEYL zsuYDQj6Y)Qq>-|X4st7N12Y5odSO-Vo;jhd;E=0zyj*)^`v8v@1`nMznsy-;b>nJz zLg?H30F|zw^iaBmdyrOFdJ4H_&Tb3~8ZRp$TS%&YcL?P>Y@V;DpIcK~t|dfckee62 z!J!OF^MLxh4LELwAhkJgbL-N9EIw@l>xKZb5g`dvvS*3ij4~w)#WN41#}VSlO&0(6GwYs%**rt{IV}@@@4x?$<+_nF?J-T1*dl?9k?>#d5#M)w|tYw)N(NFV&K8&50WCPEj zdEI^(kzsyH@RHL$6h|H=ZIP6ZDD=O6haFRucR11E;%*5E2#k^+*}vfW1kA%Ptn4+Y zMur)ke0x zCPRx50peO_R_o#EP*>t|!!vjz4_!%`ceS&-6>IC>*Ugt7Q;v ztJ`X%eHv!gG2Imgcoa~jPvv6Ys5#4Ks&&SKsF}is?iF;EF{{WdYR^0`v{0GguDGH< z(onyZhzQq6f|mucF(X#w?xC5lQW2&OHBT}8zL+$Ec`J(_byike5<5gOs;TY_vGDTjyF$WAL5^A?w z8L*&)qX%!Ymvb4EGWrJa=fCCgI4CA1#)z#AHvXw;L6KQDC4T!_AjuCl2-F z>zmx)(G-emY<4~BMK*^xCknC!2E%ti4Z{sF;~=N{)4z~o0$E=K)YJxc}3Px zT9TqKgmEgPo=J?i`;mF2&Rq{KEAqV*uiQn(k)GxOjaNPz+D1ytjfB4KH$ul1=C7m+ zUytsluA5dMQ~Fn89FZNE?opkIAch;-c>aIso=-vTkF@9THNcd z7UM}8?O#Mdsx!#!5!)7oa?%B`c)gPO39TV=;}>nx2ySb5p$na@$qffGhaM+94WY0J=T6UNQ9)SVrx>oDzsu)Uo8<88yN8crOZ)+O z8cJDwtL0aL4;iT40bLN5;PPdHbLwx+q;`j$%l}3bspRPB=D?X9Pf>Ra%P)muDITBL z&5Ed8HK295(jFefx^jvf>Q^_jkGVL62;1riw-`_8XnStJ=@9zZLGq;i_>ojJiIbUjia$D}~>$)(>75KZ7+DR0YxuC=f_&D9(-xB?54+ zcaHF(KCiuiXD^#O@&HYT^qh(JtKeOzX!iAZoW{qcn&8GC6!8jL8p4I)?2yD%({I^| zv};KR%_beNo;uLd2wiFCX(cVyw)6j|BpvdFG+-qD_(?u;dm*{%J^GJ>5DhV0#zKn6 zrydYu$>zJ+|2q!^%L;o0zeRbuKmR;&Dw`MAcW0kK$qCj0B%~H5n5EZkUg(2-MS_o1 zx6(c{?z+LPFm#<{?aM@3pqQPL!?ZDvBL>E$164_h!MUDGs`V=<)R-IBB}wd&Yj&QF zDQCXTF53H)fqBj05`18kuM8v{mf@x$nql-Nwg)jSP9^=RG8~kDnAY z)I+I$oemr>oiiAM)q0DVqMxE$C%d7C&DAtQQ$_oKg7-v}5BhVK=P2yj-O|bVs$rG? z;YY{Vd-AHqtE!v)f^zSy7AU$A{VRS_yTqJ`?qD3p3k%zubM%47tcu8cw`BhW(u&04 zV0LshOM02s*?~^EFd2S;suQ+ndsr>42or)eGkcoxNZ#00eHvWr zgr^zx0_W-T68l>TyWEx_eMx-@kLhM@ z(m5rLdVPL<1gW(oL-<}^&FdiQAwoOAs!b4Pp?A6dO^SMYw}{f| z`~l{XNE{Go&c|R*b1w>uY;p~2=MlqQ;3CGum1Ak^a!Mp%=uQl=cSLWSBfVvM+;D*~ zYYY%h;jH?imKhi<$3xIk0C1s(pvd{)`?U;2v@OCwPKE${wdIjlj zn_{Uw_%SYbH4exWO5vJ~&<1?>_1`?6eM|r(d9v%uQ!y*O1SW`)8x(S)|0#2#2Q*f# z%SQCJBbH!XEjt4NczCp~_@!Yq$MHLU9M|TNfdbXqxh4l^J_9K2B@s>p$j=?}BTOEiHe&DBHgbYhn z5N2VNBOiSG@O9rS8;~Haq3!)at@wA}Mb6pfKi~aLlmbHqIn*!0;x1X)DkxV`^K7Gx|#SY;cN{gY3j=kv-Lnlsk{H*n%*j?{BB zQ=eeqMVr6)yghV~OpvadyrI+*5<5Z=(;>zh8xQLZqP+RLr&qI)-(P=q#`e^ZXYU~G zmjsMw%THC7+53x^mZ4a<8!@`A4pY%ZYfz|%FDOTekUe*C`6!A$Kdl_rC03sse<#oW)$nR%&+hlZ!kv?=>tV-*%u< z;Ow3n5*a#hdyyMf8@QQ0+P_^cLvZRaY7b|B995y2Og<{{XapJG8JqKNe!cc&adtNg z9TRKMG2T;VC=By4@5=3Bd{c(}<@oCM-jW|{vGGOBpL?)Z-*tk! zCpDX#q-Jvy@6b8&yoX+tE9Ct5G~#+=-0+iX`U&q)Sl`}?4$=egmM_G?@BHVIg5D*7 zVttAct-`^1o6eWqc=DBh-KeGH_l!xbwbhYiV{V*ZulYU|F2(e$_%Fh5hlux3Mi6x; zGOb!4;wk(WushorID702-@4=&dvaESi}&|w)cdpv$GJ* zr-@;yot&IHw!;ZUxV4}8?Hhqcv32XwFpt9cw==b2^IN9(`ZDzFDEcE^Ek2*vp2_u& zU|#LIIE)BtL(;K^R3{E}^hlVT-#0T8Njx;;&~355xK@dd=dj4_=3Anv92QA&qf0lg zG1P65+!=RHy=OGSKXbT~^|cpkhXS_)Z0CcOk*&XEt)@lExKE{3f}Ci;d;yy?y&-GQ z1z=`t!97{%x^cx2AdwivsG-^UEM`Yk$QnF(iTM@8)rRxGZ4L%((u2_H)gJX%?MD>c z48pDZajb++ZS24_<5^9^v(xKZye;UX#}oZ#&Nf0)F+zj-pc)8s|zou#nPDx?^1*G-Rq2Y zB1g>0S$Z^GY96U~o5TkT^~hHze@~|0dG&iYoWj@hwu4@pbcHl%#Q_hk)?9A_cjbwA zUNaV1Mjgcs|0{I_wv|-TP8y^-RQpQkAbc*Y{T-L{Y^?y>n4w#eBc1;d15xHqV5R6%95Of-MKVu?U_h? z+oh*@7@7V8r!)FC-F5j2Yti<%Rrc5#8u3m-Sl`wwH?5BaZK#&Vrx@?Ilq28z!NvXj z{90|tcNa07NUX4g;{a4i{Iz|Eqo1UDzjb1p{lQ_ z*L>>|%#$bcWs4T^zfEI*MPoP-P`5{ibn%=y)v6(9c!*^+OUv|fUE4gtf9ixEZcH4O z3C}~w($2UT^400pOshejpx@3!PhFVrowl*n&)EK=24(!;}I^5aQ{@Hh*fh7r; zzoVU&Ac`fpo?KrgU$;9X4GoZ36)76RlpH7*^Frr=4Jwjf^54g|2R}Fpxwj(ReWOZ0 z8%{HX+jRp0)Y6ljBbhGg9+v za7;E%uOSl7#L@4LML#TtM&XF;>CxZVPEVI#J*wS@1462SU#e{a(*yxqb~1$Va!D1! z8TimWlT|-Y+;wc5(g0BSW%-sqN>Gv{>_jZe7W~n^BbyUOcPN3g@h%_TKbjax>HqaC zR(rSD{Z6Qu{pA;3>CRJ;>->sms!v3gC%w|A?UK{@GmOe))^9H}v}Z6?(4+7SnA{V6 zm?|sLaLNgv-(ERdi7uUNNe{18zZc%0|4usZ30hpXuxBp5i@j1tBA|ARBPP0w{dA4W z=~EH$P4crI1N~wu$z<=*i$|}Vd7; zGyUIZlY@<&s0gp)zwGY2%ij(*87#*q(ARjtryT$M{6SAt-jnm*t`9Dig!juBGS1%{ zzC#^VdD-X14wvWqLW6#{_bM|DoTk!eqL0?cRl@LKPQj?@Of7?0*CMc;$4$@7{E~n- zps*#c`F9T+a*4)BqcjLbXK7Mfi7mB~k+U{3OEq`M>}6PT5<_C|*4{7F2hS?YGY6TA zfhat^({8hte*4_JFKC)KsQ`-fDA?8(xjd^1G83FR#Ghrwj>^!@JcKz4rHorZyfi*v zEasEb**$E+KkW9a`Ta*Au!Qo11kX`>x%jlWJ`s{8fO@gGhXZg7{r#8p{?bz1%^n>3I9zaU-P` zn$E8(el0n_K`CBa=#Ps}j+LV_8}?!IJ1jB#lC5~?kk?NM$oeCAa(iZQa?-uQ(BI@Y z^jOFuja>Y6x004A7b3Y>UjfdFQx$y3yteb@*Qb>+C1Gc-JgBudBBC2qYI)EH$MM;M z-gU zJYkfxd578&?RtDoE(sswT$gu`KlyPXpsvD6WVXL>4v(dF9{8Q5u^II_R|qt#(`no2 zjja>}OBW=yPW=k~o;z!Pp{h*@4JD`7mshv%SLF<%n+6;{QSYEAtbjWV>}J(OKK&~aacbpHA0Hi_{=}C>(Tq7$T z`j((Y^W-%@Oub05~UrOHwMeZ!2FmdwL-_bG3f z?z}x1j+$bzEwMY*fig&CR6Z2pxfMf_w^1|~A~k>U7d4pNFAmE$w!4tS&#&c-4Dn%% zckLC~&8w~aInfG8SmwV%2hQlfK}aS514lf4{+wWbzwM|qvVObUuXjgB7nN{vpxizf z2uYmH>kO$^^LZs5P7n&mIx(Q?lJ2gQ%lOG!72Q{u?+s{MEz?iZdtiP$C%a+~_BqY_TyxzLT9Cme8?Pt( zAC*Q5p+8x>)~4CN0SE!LleQ%uiydeNM(o2lYM-JTaQ$Hw`)tu-ssMgv??$x{b{iSq4zvuBpQRI@(M9HFDT-&>EKyZu4HGqg_^G6Hy% zC4!YVoV2htrg`9|1_iXcE;j+k$aRmXLtZ;LJ^4I;chume0e$`vvxV;vBK)W7y=IFq z&QB^=tLi`>(x-hbN%wWaYE^e)e>dFt0;^ z2;RSZ^eKOT9Bl}kmJ2klxBG>1LqFLeIe?hC%d~unV&y++W`aQ zQ2F@Blw(fLK0?s1zc&0QPgUd@ApS_I+GKoMSWlhTV>tLPQzN@E_(sjOOij%2HA zq6TEsq{UY~W!$g5rlSfi<~dl8KNNU8Fd~8$3nY&^xwz>@7w**5wE=XzQmj=-G=qGV zK&!wI(%7m3ayCii77fyi+MJo8_GWfx_jjK&M9?6wSKh(tq#S{`aS~&StEhN0KfPw+ zuabN(j_=OzqQFtUROjDgq=i>|c-|c5l6D~U6%%gY*PcaZ!h`ApVk|PueR^;}M@oQR zo@R*jpq+uxch%tE(NFnw-7F)&s^BhWiG17jxx+bnIH!B`rOJ-KOfDtOx&qG`TaWfZ zHLfu5jnn}la!{=7xTsoAI&h*^*!HT20VUJWj)1>?cCYuZ02voex{9ZzEF>eRAXDZIa{XGsC zx2vi%IEchUE9+3UDZJUrdWYT+bnQWvSKuAN?Zek= z;p@NLNG*mGw;esbn!OwCOS8J|xDB6=B_na-jI2L95Pr521k%OrhtZS|_wqe-NP$fM zJN`hKl94rFBqA{onsx`fuj3=U70L)qy}fz#=n+Np8wq<>>_8!{VyPs(-sph-2(GR; z>S%r`?>rpt8f>UBK(pjp9q_9D9L7PT0YoT$K}Z+1y|-b`_a;*Yp3zcFyW`v zcYt?2dcw(yRb_4=X2p2!NNassMYg%0^YNUx|mesRG;< z+Rf?&BbcVGKC#poAp>LC{nP8uGmGDj>%%BoR|6xLoz2_~gZY+p$Ir zGB&rll6D7vZn98?L>HRcLV;2eIxywnq#&l12&F)wRRn{_xCzB11ua)8B`C?SgZ<6n zX3Nzz0HOP=(9h6GPq6mM`6iIZ9BW|&SEy$pX}y^ZSR%U=EdHv&J$WGe)M91}S!+Si5X{fuyC%jBIAJAUu?>!Wt5uK^U5O(}W82QFtv zbJHG&DC3Y4rtnhEBJ9Xg* z%ihfViO6(o~_g1!nt)n`Umv)9XgP zIJPZ^ybRwTLjP#}5yn5`B42g7Wkh&RxbMqn7IL>{D`GRpUlgP&KSDMIrH2`Wla z-PR8&5U;BeS+Ay!5d7jnthi#1Li7~e57uxc$c&#A5dL1xojB8hY1scx@9@SPp=MDK zE?m%Oq@koaeHXeqntH+~vV9)y@<cE}AUfoy1%WzMZ)5ca!NIFkzM5HXPRBgXw(Unq6O7$>Ec9 zJ|)wMq95W#P@kJC9QTD@X1`xc#!T6E@WwDwA6}DYU6tMgD^d1Yvg34YUaqCO>FKn} zAe3DD)wkpz3zdRI?D0vR4W! z5q0G&1Efz54yL)y{CBAyB+`ANjM?U8<_G9^Jb67aT6pVl-_+x+$@85jU8=jPrXj84 zB_7uO#-zLTzT{pKs!0bE0&uVgAJ6V8tD{hl4iV&;>)JId(+Y5QWk2%oC$W_uD%XGu z3jOzBl6?KA8eWi)?vzi=>jnl#v}>rG3?nOyjT;A6xC++s;G|6$=*;@bizl@P<_E|K z?^5&}u3BIsGTDh8y2*X@L#(Mz0Icej#kU)x-*_LM=Pcm(+OBH(;vII|I?o-Hx&NVl zB{}Hofa@!D;_X1^JH%#1R*mXgA*{2(4uU(<3BvlkpCzJ43`OZ<`-kZY5*@cA4UIeFJPU7L|nLe_!`Np4i_DVAL_@( zd9c$%O?lobv=Du5m7!T+_k~53aJx?r>qe;DQ+u~vDqtzltO*`cb!jCTrWGTADV<+r zXl4+*5B+r8SM)8c?}ea+VI64jdsld(cSczNHqL!E6h_q0>bWLHFob~#XZY;Dm^)F6 zFa5&)m6?;<8Iv8DLDJUzvbB98ld_q6Rs$B;-Ax@CCLtTB(;a|neEA`i=PLvT>RIn1 zy(U5xL_f^Af21hOEzFb|ADrGtZ8ib-u|m@itmCpGYdVcSME2#tPx#`8@pYu~&PW?J z@Q_NT+hDAx#(hJ96phisW1RypykbvYciAj{#s35L@wX*?r1?V|m7% z*3+Eq``5tOV7_K&!&|(ZdyeK1D{Je@}_Kf}Yob6>C ztU$|yFo4IFo}3mOZOZ1XUZSME1{MH5L?n%tvIq6b@YoMnGy^W0()VZ?Vvv7ed>9Or z0R@9q!{1T)o^^YeE7Hr|QIz-bqy?GmOZJ|y|cg6#U&y= z^AM$^lwSPs7y2Ip)vT5;3oH(uv_79AXWye8Ek^zqU%yyDSbN6OT7#Z=E5_;kV^y|i z6im0yf}6be%=0iJxRE20Y4fs0&CEq68HS(_b&5K>(S!zCX)_Y&>bvJ;?4WeWV_1eZ zWbgFbfjJ={C$!vqdHA;dP@D}oVDUleTu}2`8o0kKp~In+3aJ|^rncD z?cKlWC)@g6(+KKUX8M7Q^LmCDE;ku4aGePjtfp#8n0l0^F{yWojHt*+3Vu$ z4uFA9MBIc66h%=$^SjF<_Y-+RNch>Ec`aJXzp!6c%IOuYp$Cf=D m>J++ur=_I; zq6dhNOy}-I>2x;va3aSc_O}MQodw=GxnmR*J{3Do?t~FN!W9pqFnTs_`m8fxzLf>k zwl(O*4zHN*!7tZNNqZ2@XgCN@f_eXLe#SNpFl`QJv9B7EQ|&qmnFr4Xe#+=ws=cIQ zP(-J1CL@?z{j80b(|*t9PKT!qYG^vi-(}vt-)vbmNd;+4<5uWk?N%ze`>GMbnhWfo zJZdI2u8_2HM26UUZ54H9Zss2&DZ%(SD<>askQub6qBe45uuE+CaW?+94yyW)ru;Jk`iRJ;3XKWQb+%H}gN19nlrF;kdzI z8bIy(fH|#>oNJvk-1xTu(`spI(=7-t0p1k}QTc=-!_WI3k?~WtgpEhp-d??z*4D0I zXxykG95{0!7S79$CbLN|Rx$}mH=RYYV+x!Bf6`-PJ8nJc0eVVTu&=?JdPg3KY4`Ip zFwMch56VLLI(f>|y(eQg!Q`v{s7A+5T}bl3zPWDn!DxQQ9o&uDFN~UU=p~+}N{j}k zG2R^OthvnU2|I3NgW8G(cJk5ER?ztDMzYoE7aa#xA6mZDto6+Z$3bZtPOlDDRG7vd z@i;2dL^~uUrBWyIv7q^L?ND91VGi{S@^6EUT!{;Mj^&bh^jzrRYg@&@ofz^ZR=Nx_ zT3;&GvNtx=Dl!p9>mX*$^{S8Q3#B*7-jWDzU)?!J{qg-c;f8dE5hz+v;=yyt2%(JO ziWBS~)wl?Bd>+We5g1#Ot589pj~aa3j)ZIS)vK)scr2j#=gP5Jh9Hw|ec)Qm%CHXq zdsv1gsNYKpeVxWf-WNA{)OkI``ooVkx2yj9E!=bww#Az#TjQR$l;p7xZq^rP_&2Sv zj7i{@(o8rqP^u_^aqo(&?t(60jubO-eR@|Lye*kJw^-91pSo@h9(|2)e<4~;Y8g;u zMNuZ4rI9{-nVq4iW5U&B^T|$;AIAtVT~iEd2;hm9pqz^ua^NHUECXF+l$FfE@oW|J z>8Im)E)mXlM6)eq#iKCWJ-uK?dCr*Rw%uyj_`FD+i#xQ(8}*QdAvpEEL_cr#Uk+iV z&jEY357J|Cs1xP>_Eb`@b^T3f;8GFE|K+3K>pY9OSAgk_)pnBYliTC-J0H~0u@gE> zzpI}l2NTR70ub*{&PuCxJ8dDP4f*USTNh=ioha}z-dHpPs${J8-@*wv2nad);774s z1F{TJdq5o?9o%8nbbk0A!65~Pr26i~|2&`F(@3Y?XhcK*lXM^S;cvxq-~B6=`%gG2 zszXcC_w+KA7rY#|8z(I*aJw$Y>imWG8y@4o1cQ@cdeic3niXml zZ6xvgCHvVlNE%Ke&u5|zJ5K@yy8aA&fYgRiyfS4`)ZiG!@D9cxJt|2_H8{|xdzkq> z@c5!u*=y)fLCDi!IuZ%cj9`d04iWW$iGQZvSb=-1(|JrHkn5`%yWa=X51Xkwkwj@| ze)@3#{!AqBaenjnEVvGlq-$qKQjC#)l|$wgr$Xn=2PJlsfJ($d_vUT&=*W+;*~Ta* zUn3qkPjKybS6>h**q8354EtnXvbA`)hX(^Ab$Z;2ma)&}@7i_9hj?Qn+pOzA_3FH2 zyq@n|zO?b;L*(9i8uUFd6=rsS`!VrMu~t({d6mBZ-o@vVMLz*e)z9ulMZFm+^Px#^ zn2j)V%~LJZj1*(yn#O+*@mq3=r`(|9y^Npg0Dxxd@$nib1tNT}Ge}M1dhPu?nSU{; zx?}L&%Va%j3NJ-iy}!3s$cl>w80ITi+IHM{L2v^d75BhQWH;8rCc9 z1Ii!HHDpT5gs*JOMz8rzCv*cK$|d!a<=P@}bfwH#jqn~`Q@*n;f`biKwqLjF!pD0F zK5J2<|4vCiA72{Jo*sLR(|u_^Xf>{7OZQob1Awpzcbt*!1+3&B22w$@uN{dI?Htl<}m z1}gBjc)2Wmg)Yxg>Z4ucLdfn8A;%<+CbNIUp)u8b)tfS`)#sLtwv1#@jz8XV#Ja;; ze~Sgk`a@C5#?&USlswUJGWSw#^lW$(M%3d@*_v`ID`pd7EP;HkHNNJ@!Tb`$p%-zOJFh<9S21Y_ki)MDf>DL@mWX+O@wZmXfxTB zPNK1NqLRg|mMFv2t7)`f(qJl49Q0_X%oRv;j66<{Yq+nGY5$w(~ajF z`}IUrEx$sggS=*(q~J6_bt#Xcp+3?kE%`0A{Dmz-!{_lW(G6^dJW z@SiGJ%U8c~1XunOV72m}il?dVY&<>O*yX%xwx8L`z1*MmAd?eOg|tm%`mPC9Z0A+% zRUk!MyL}2C&^X%i40@5Ul=F;aapK=F=Q_nlsK}SX0+KpsJk51#=e*?xJs+`5Zb#@3 z+v*o1<^16IDN@>%FK5~&MY#5E3oZv_Wdk<7Lc;gXPx+=yd&*NxgWeE^*F@rC`uc1A zoQi>TdvW={^!i@RuKyR~IJ@{?>A1&<;oFv!Q?fZZfszv|(b#U=ejuBB&`0R&Cs&f4;j<%H?_I01wxKBDW@}$Z60aNvC988CFuyMjzBY)zVj#jEjqFV^E=`ee* zhWL!elS4eP#U3Q(2On?Jn?G$e{MRR^5~86DBJv72avU|V4o{2J?flojZXARx&^hWE zcEp=?DD%my1I?Hv?!u5EaoTo8di0FMmn}|6DnHt6vk<^Zm{H z*+&~&Q|p8tBAJBQ{NmIxW~7U~pM9W^$>#2@Pu9In@Ue69QKxu47G=vzi9+5*ishHd z!QY;6-GFj51O7_PmJDIJM=1NGx`v=`3t@Q;IpMcjL%TIzd%E|6Pj78GluuCMTqg4y zx>xV)d4{oZ^O5-Cq|SC`-pl%QX^w8{uO6lwafz>7P_k;boB4RH&LN#qtyPWNy;f@0 zxnH-~Zg|*#bTwS0;mjZ3=>@YygB$9Hi7D4VAR`~EZQTW3TONgJ;7Do~8zMjRsCMb~ zmZ*ieRA*%Hwfx`r8QVI<^S>l3z;>H2#VA=D{p0_p^NhH@1oq247L%vwBZNd~(U2&} zN;ApY&c?cqvj^Fj^iFKClggp(7W0X`r?CE%xcb`}Q3W-X(Y|>pWZs#yai$|Fm2t`v zSCi?+>z&w<>}Pq}xZU21Q^XhWndk%n|x zmQ;=bLFgHYKc64pRpUTLfteEDja}$t<2M=2kHVBD;Br!uX6fm? zPS2VT*$zH54H;nR`TAmu$;>INhPdmt8k7FO!;Jk6_hV3QVDfYE1UJ8D^PfH{f3KJ> zIxSXNq~YT45RfY06=8HQy8;sqYZ{2<2_z-4k<;#DidWeZ7ZI{PCGdKhGLocsevLKj zNcpSHHKqS45c7V?`eV^}j?}hxqOw8Yg>3xRJ{3>YbEI5{K>4I-r%6TWMsC&3{2T{J zLb6FoK5UVLs`vr;{H5OX9v;X({l95$KF!=v5C!niPGHUtLK|<$BG!s&#vks zwU1Z9jan%l%V~QdSe>8A^%M2O@QzM}_e29QfV&@4vksq|X}%zU@T9~_hKrRv31fE% zn-&@4zNLf$;OjJ)4PPO`18=UI;xpdX^!*iMx3;YX*Sm7-Z56r%3xsVlyTTP)Q0=F0 z3)C6W42{Kth^%sU=wGdm$9~=dp&>)E7Cl(x zyyasZgs|ZEZOZ*@StR3hVI{E{cFgidI{H{q>a$ry>x7uICWTkn0`iS`3e)B!>{#DU zh*C7VOa1K_Kd_H;UXXXW|Gdz|8+$xZ-u7qjLEth~^R?f~uT89NWvR5`IM{$F5MU^lLwUld(Rpk#N;jIuPcrWPe){(nv{+soYO- z;s^tS z%6>Y#1azGZqO#d^LX3{CtlvuUO$Vz0ld?{R%CxPW%Dl9dI>{*cA^5-z4Gn3A?wcw)A4Hus z3O*}blO5Q>hnC&0VCa~7h^^0`3}u6rVnsbyy8kS=(L5~-L8%g67Wnk~u#I=E>-k2= z@-hdP=oGeq+GMED#@_xav8r&PFjf9)@o_RzhooGRN$E~(6U<5igO z`eIf+>pZES!V#AV?(KL?;Wc6#NLWQfF2Wb5Tc5(v?ETsNk9O(Kh{~SKHHprj87%F` zAOGxeCc?GOA7*Ro7i1Vm;L`ViBgD6ht9MT6DH(}D6-nbmK*Za3d_8%h(_yDDpTjZ# zNexKL=KPpO-sc?GKZl1P6EXLm%<@_knKm_BYiLd*p)?qG{bJ0Hh%vo)g9vbOiwlsq z0*vO%o0|%6vkVG@gJ3?(F2J3hpD5KxA8s0`F@|~LGhleYa;mx?l|0r0z=y!Jc2?Uy zR_n2FxGa-IE#Ocuvm}li%Xag%NZzy(UjFLW2FvOq!7M?r-Rj`s3($@gY3I=yk1Q=! zGX=t{Q;pE?Q;`iM8iS-r)ld4S zY|N3cq<>|I+HxyAEP3K9?qB)sSOax`IT-Az%ll0Lq~75vU(glv)8f1Gz6ajOKP4hV zR*vl(ll>Tj0L!~iFr<(Xokujpq)%wD*)Shw&Scdk+?-JAud#WVFc15eXT3KpCAvzJ z2X1OwvQa)84%u3Z~$>o7cEu3aTRT_a4GQ^(xm;?qb5 zgsF-<(Qka;zl(pNGBkN#%Wi#95lBrn<_HghRKB>{BFn&`uWAvvcKBv%CQGT-T!R!S z3yQd48YQi9c0xQzaeX&T@CS}uJj&~&8KYG~T9o4J1SCVkSj6<9=vZ%?CZGPEHy2+- zBT(@75>&R(*;Kpxx>_u}N5`%JkY+orX%;r)0}~usKbw6@!IlTu_~f2#oG!R0mEfo^cF=9}Pr=U$#yQK6mfc@z||H;*t!+=Ebay+U0VX%f#6YYWkYo63lUYTCT z>iAJ1dpgr+Lh)$S*dv8p`roMqbBQbQ!uKB9w%W!gNH*v`e(uDXSKUql3WHUhR_k=D z@B*zkugXh?aWrewgTwk&`C>havrf)|EfzV)^#qMuDT^=3$+1S0C)1Z(lc&%nx3d0n zV{hNr<@v`0w$!3zaDu0<#FRZ<2)v#Kp`qrRg&oUGL6m}!B?*YV5#PvCveH&nmT~BD zF8Boex1oclUuUbV-Pf~TzHL;nttXk!v^O*yq`o%wvX?q7MAAbye7Rz*FX`Ih^esMv zc`pWWlrWwDfE3T)sVlbRIU0eP$PyT>@{i_+jWB?>?CtHhEns<~p^}(j*)5-qvL(?uU`O)2u?q+aK&4tBh_06is zqRJi~T|@vWLZm|wRp7l}@sH4Pv&)9!ZV?=JgcW z^RIZ_4$H>HUP|^#4!cHcDPA%kbux470)_8exr()TPRvqcQFfLQDnCDT^lK6ek;sZE z9~Lv{WKVwb(+%}`FhrtTxO}nh6ItW@t~RuNax_Sk{lw>cU%Gj#;R=_E$xW~C{P+Gr z#e~Hz8Xa7CI5MXIu_5Rjk03=U)-y~-)U*2=#aPSWsA5_RVXaVHnh`aHNV_6o*c&{g z8U*nL54T9He7zeRRN`}@c)(ZT?@71+LVOOp?{{)_v&24H_ku9^6`ub^z&dSmlbKkB zCF4KFU{<%i6Td7^@94=;Hcw3-@jNqLj+^C!tB;&l$c-k{A*k~^u`HqoB$z8B5(Zll zSlbm?;VppXoeiL}aurZCfFdqxr{+;O~+1vf6 zt>kXhQZ|o764w_wBx3Y$)jg4aZNo==>v@-!)zZrut%i9oXSdFsO6HrF%}yG8#`pY} zyQ~PHZVohjODS0yFY=;^v~PG;;k~V)7T53Y6xT!&ZQ&fvohck87`*KhB)VvZg=z+sexr0y#e;N%Wo$IEa%gbf zu(PZWK=s}oTla&qwjq$a1x<$%KW(Ms{cO1TAI*vtlGxPjso|2ITeD{xwm`Ns$^ftUNd;^ zpbKv1vQvKZ5rz#)AyL(~jL}i>;b$BB`y2YdcWj;UQAcVkmxXP@YrfbM!=vv?-l~7| zgDn+$2H}F0g-`QcLQa)2kx9n{>)sF;IZ@DMwnfV|S~M{fdAnE3FyhJn4IXaiLv+{3 z3yiT?9l23~`@n79NIMfkglN=$PATy!-Z z0kDsHW}g9+WXc6w(3Os&>_o-k5HDWo76(y``Al2ZdV{Ks87O1DST=4LUR@G*4euYVWv<8a z?JuNP;s|~(fM{zxSm8h5zp*_Mm)32)XJ*3L?==;{^0SjWb|H*G7fq!U;|VX=;&Fhj zJvgJbe?kPKdodQSH`q^BWOHNTaB>C_Xy2cRZ+6!`!i0i6A`?(>9-N7sS)FeTY?zR3SmQ2g^ja>-GjMWH4p_DZUjF1lawfNDu5<0R zE%2dWA0&*%Ul<;yxP-r{Z~p10$Nra_V|++GKvb$Wx!g2eS+wAV(=0Ufr$pZ7SDBBv z40~4BI+5Hrkfu`V9u4o$ykO`iv}itFFrl)w+2prJJMCMI{|i^0J?SkmUGhvXoo9+ zT2)(Rq~Q7X?sI#(Rw|Uw4CT-xJtQ$dSMt6%zm62r7@z+v+em1g27v?C>7qYkHn0XD zf&(1l4K3G`yZOEG-e&{RDUUWFVO6%3Sz9cbEi{hD37KL>la*DL4Z{B%X#xf!%f?g8 zd|#pJ#&dwzp|!iZN2WnNT0Mep`R&~bwZqTKJ`U|u?q;HhM}LQ!cop+5+FGz#TN&O6 zsvHME3Oxg{XZNLt|KsfQyC7-ZOO3!;URNr7GQT@r5LdF>j%l>ij08U{zu7O%BzpM? zi?u1G_8+9g1fHJpq~5=Ul+sV(*NCS5hf^G+BXcmGd*2A;5ER4(J`C)B=3$a)@2?-4 zy1747LX6HCzIrL29kzDg4@e9e@>@;o9QPdYW7>`^JU4=En zA6GP8g#&S|b*ntvPJ6t2lmbT&{n)|kIXI)iD>j$pBk4B`d+}&S5v|*$#{!RdHa4d( zm<#_#lWZtksnK*{V5ABS@C(^#qt@9*p3r9e;tt3O$yQfpLn8Yo|> z&*nI;oV}$xwUx^JI-41JsRE$4AlfBzIIN{4h5|W(X=$GD&)}m(sb@8v;A>x6c_1)K zk5s(AX#4j1W4Mi>u?L9KOZ5PWVwV3NL!T&lWUB0J9Zp_vJfHr3<+=r?W8J26P*|$G z!Sj&bSaoKr(77j68;oZ*(s+I}?^#BO_7My<_h*n)Y#$ByVjHG5lQ5~0Z#ng#4$=q8 ze3Qyg3u@;pBaQsxh-0&2e>Ku*d^-blE(>a3vWKDYK>(_h)+&Rw`9jYw_-mC;n6{9? zXXjScd&$p?ZRskO_1O%G-~6wYX&4D=#dk;TiHcT=H;Zr(9l0|>`XZkb8MI)Pce!56 z$Ne?iJKfFa;xXwp&%@D zd>X%c_;h>s)w&0L6yGY;3;Oy_7!NAJ$TspPB&-43&zQoPN&7xEl^&D$VAhBqPXJfW zIGrFnP7KMaOhXVV?`}~N+V4Ld1%H^rc*@l=BS_h00hjwcl1h8Bj4B^FG2yQrwF1>o z_G$WZ@Rzu1gXI)dzW%{91RZ#fUU>YpMo0-Q7eh%;yx{+ z#7(=x`VMDxCiv*|eS@w<{HFhSWuZn zTyi#))7^s7SMZkU?R$Ux*rpa2Sh~YDTF`nG8lwgE?EOqnRbevM6#rygIvX9SMLiBqT`hRS z&d`R#J5^4yxV|jGoo-`Mv2C=2ZCkPzDF&=%c*@99!nwERZ90`J7QXp6s4?@IzVzJy z!T>0B-u6}Xq@|lIA$V|RQHo6VU{TK>y))9UEeYRpu(i8BolIXH?hcxsnRII4oKnuN zfyLek$l;i@dLP3mKWnjGIqw_Cf+hgo`p#xeYskC`>3KM9dK#FFk3+15lR?mPtGjQLeOVqLb*$0u~GPabr?A8Eh35g=? z%!?(ja_}_4PxSlYV6BHD1-fS2iNY`}Pn{ExUZJUtwL+FNk--;#HYY>?_2AEu!~vHs z_iU|eIR7sKvnd8NIRMt-QyPYEvSA=s79u2f{ukf#ygsBX+>i5pej{GHs^tf?DfB?0 ztEI`c|3?J}xIqA%&7Jj8tl1iFc8}8!59e^7SsOV#>x zUH=H2_&2fMr?g7L2AW;KZ*b+3co|TED+i^NKiCA-TF>GE?Yf0(1GLwSn z+muY_my@?@@*d!Q>ie@@w2~_ems`wdUGZ`TM;&t0qcWNSKvF2SLH zFi2Wif}{7K?$ZJ{II{6JYhC?>8gfn6NbYlXOESM^$=CL2asWGJJ!a|t?Atd=oG`lG zN6$ANZ32VG;U3i@e0aMRMod<*<*mC-opuZP`ZC{}&c463Wr1n# z;i!!3>I2I4Di0-#FbFPw)gYz+c$n-^k%`#jE9CFsg6N=;V#y@WO!(kTa;dV& zc9#O>%}bP@fLClmzxAJN!9NOeJ*$X1ee3czfCL9n1?BcUuCY71rCu&OxGei}{>jC5 zz4CUZe^AGcNsYYGktuM4@zPWF48OveoFYH#=~}&*`0Ei5Dtp3ZTUBn^#X@Q!HdBj( z8Z>~bJ;&1E2yKY3)GITn*ab%HmpsOGTE^I*?O$I#+5UC<^1xGhvb+Cw3MxF7XRl(M zoN-Fr?=jjVWjXHe9~}H}519CP3~|`dy!X%>SHPtt!4J6=Hyq%K1gjEFn(mxxHY&{G z(V(T8JjiK%-6lR|Z?ZF7Hr5VQvvFqi;7#`4zN#oLs9H6t9cj24FA_Vm4%ml=3eJR0 z*e4ApvjjqXB@nsN5+Y5DD6`YM36476H)TF6%93P24cu(F7~R;$C$UT;M`93{!^bs$ z;nUd(K=b0%E^pYpU<0f1pKGYn<5Nos_Nhg&S$hUHep@$Un%f*U*t<4=q6fnr>Zl-X zpz5sJRe92q?siZc+w9g{XTppG3?--JN8oX7mjguEMj9l_awnd$J1!fL536#fZ!7mE z;(m2@{*RaQ+cp0?sG6k7QGFj^89mzl`?;A6?vu#`H~pyHk9-JO8G)Skk&sY<7VJg~BSk(n7(1#A8#Oq! z4nnifLO!9ulztebd9qQ8R+@~$8h1qR06ltwO!|!=}bK@ zRkiV1W(u!J49++vg5zUW3+tdvhs_GMAAu3y4%Cx)fhgT|E=p3$5b?lMWRld?Ca(j> zd#4(JU$71Rn1rJJMn;H4WJIH8D(q+I*^R823m5vCT`ijnBf4VYhk*ECN`LrC=znl~ z?jDBAZ0M0M;e-CA^i-Ct*T%|VBA8tzih#d|6?G~Y3ynj>_a`Yz->kAFDnztPrt!Cw zO+xe@+-f>dTcdDINIXX~r$->m?F!Opmcf^w9E4eB_`r-CcgO00_3BNbk-}Eg#Ov z&uppM6NN2_S1BGW`JO3k$XW60{O-1xqF1B+oXydN+j>uXa*);b>>o1D7DeXtmR=&^ z^A7}C>XxHIFN5YfapFr|j z|6)*)VMs@8*V+s4g9z&8E(Ny9<~i^dxz}U@y~+w|XLfN&Ig>Ye@`Bmh_8^d3xDim@ zpe1&C-GlGxKgz2plK(WhJY72}zrr<+6fBOOKdB?w!oXgiF(s2@7)?5G*%Wrn=(~n0al5}f$12ZP zMv*vlsRrRQOZq`CO1Do5tb!nVRj9FQM-DdHMK~HS_4pnwP0`=GCAl_Tpgc!N1Xb?A zZdwj~pB){+m{YxJ+U4}cQvNOa(LVWv8eqjw$}SZ*Chs##?`Zx>m2n7-D{gZY)OGCr zl&!FWmEKnfDXaJO)pT?7KZZ>th)?~p_<4zwE+bBJRx@-{;TWtSQftyJ8#F2m5wr4N z4MBv7=zI9|$sfkGi+)&Z8?0#-nRnqgMny3XXEgaah=(S~HhgwGjhQ+a$`N|~>V9fQ zL{cdRe!FSf@c2dk7OQ%G$*tEP>pzOX9V|elV2Ku5EAj}oYWiJz?kK8@=s&Zp4D@n- zpU~js+`rp4Xr5jpO#G9PUu`T=vmHN@MPvO>K77PEJUclaULDWl;3PR4JNn6CE^Ret z-ZWt$sN2%u=z31mk?(&r+1+}vdl14Y#!d9W>Y~G+kZH3~RXLH_Wn6ix zj~YA+c*%XNSVF&o&7pd_^Uu1}qfrFSr3wrVt2w9Y7VW$am$9-IzQE~Qe^xO|oNHTl z1@v^*J|zOOtl=zko#hvN|DDtO{So{3zD;ta^rv~1w=R>p+$bwFlm_NLCWx(Hq+_+? z20tx$=>ZGWp{n`00CVO@gb>7JbN_)(VlNWS-WuEKFqak>um3T3~ulQ$nc0Z7X6uqMr zW+NvFn`S|Xp@_?CX3z`-$~+&Oq@OuNL@#SbiQ2%y-sJ7>+c|2+5=EU5q`veEeAE zKdo`P;pJ$}GYkN$|VeAWpgE=+Ha(NAc6VmT z1Ai6Khf$tDfUPS6qfQc>WU79ll`Gwz8}_~E$JL2mrwMhS@kQU(yw zk^Tr^8-ND~TsO!IByLj;5?V`VtX2~6a0IR$uz}H66f%)y0H}3MN3#zf-`%m8^vFB~ zlY|<<(&@M6i<6;-aPsKtHm}8wL2M#iQFWI#3S!t&@y`7XqTYY~244}6W9Q$ zA58ded^kOna-EPRHQGtZN0w%7!iFj|-e)f3&ssb$+)3c7icjkI=)t5GEOVa0a(!`- zwl2=3=~i-=oGjW2NA0}+g|YCMbZ`W6*l7$?R3`m988SJrdh=DW8Sk=lna3xYW)cYb z$+n)HM|;~YhWuIp|GnA~@s5MID$GayM+-VAbF>wNO8^TAkIIZ}mCClV$!(cTKc^PC zKM9?&$9lNR@$Yzs4JKHMAgIJc2NA-T%{~Jv@h-vA^aJj-!sSsZQD)hw!k{A$>cwjP z7e^nzZdYSAj7aCYT@?U0SXz-~9z<3T{@;y#(Q=OSA4VOL2U&TE3&+l@y+trgh zTI{cf72p=R>1?%>hSSx`W-NV(zy0;kR_04W;-fs0I6vp16nY=ShC!us&@SJ+jGx5V zz`op1A4C;<1AEJMH?*`>DQouVHm68vtFV#)zDk4jGL$Kb7U9vTKrML*Xq6ho)=fCq zF_L(Xjf2Bd9U7G)j2m)# zY{O?47+={&g9^R8SOK1bX=psTHG?04a$)b^e7Y|Fw$DlgHx3azwua+TSK;2~S(H*p zRtmeUo6hxN+|N*cFFu4M^k-6jMi&Qh%Y%tBpOYss9 zhv@7-|ADI;XA0+-u{nq5SWd8bmqZuy->HjR6TzW1QS|;4E-QkBBa9!{{zrR$(?(>Q z@gSK_z|;FH&G+_&2qOLMAdFdjS_`AS zJ`?3HS}DZen(_9=#8yo!mMaXw@j#==XP}Apo13em7e|+Pl!R0zsD(2?5;~|96zrs~ zbEy~N(sbQCd-T!vbiwGG`$#}x18{`*K^H9~t+Eu377_MZsm3(FkUQXY44S(E%nV)T zWByYwyKZQl=RV#`RNQ+|7lX_#$Dr=aI|+7 ziyV205pFSOyAG&e$Pt~F*x{DMEqU+gY_sjPf5G7+G?fz{vSWI7r%3w8tjocV9+D!`+RyD4Yc8Fobmi_fy!fS(<*|l zKuHEzw&H_X+`LbIxCi@w$12y<-;Nw!~3lmJN>1Z*yn(WgJZk#nw9h1~A5&xz>hh_p+(bCv0RvF9bUV(2}a{qi8;%P{h zeE{cV%P;J8qw}L!JzD}zb#U@Ge#7Q3n}@&l755Rv&EvCr6WtH+8D4F!tuM@gZt&(h z5xgPD%iAiRLA!5Z6~y57FA?9%xW-`neoIM>QMD!5P5YTPPHXY{{3)YxR6Kh8Q()s z`$=cr>pA;P;Mdx|R(6z8xFb)-6^ig0j}M@$8PrB1rg`$2_yY}{zTqY&-Y{(<$(@tv zE{jQ|1yA+(>iYiV!_DnSVD!31Jg+tz+@&m1B{(ila)Y2rfs`_PK7BTY0JerSq?t1t zY)pSqJbEIpHfij*%!{gSbDQeMTosHBBuTnv5*R_AWRum~uWyu6l-Os+_s-Kl%)p++~3eaH@F z<;(!TC$xhYg&X@F*gy8|hnv&S=?RjIgVQ|W*EIR^PmJ=Z21>d3+i2(Ab;$|Ea_uot z<%6ukUnmn!iMI29_3cwF)ab_MoYOuh+5JVyqgdYdXM4+Ug|*5a=xIpxZIwd)*8936 z7&Py9P^8=arPQhKLyGN)n^6P3M8Dvbiw2mv0sBi`7EZjQV`fkPxDPsc*ne{zc4}@MOqEJkrOdgG_I4FNH*+vh%(v>&VHIDat>HD1Q+2WNX^<)r|DDntsf< z4l*fm7(cMAlNgT$VfSqH)IVfh;15gWG?zCZwH>*%|Kus90Nny*^pn z+jcVHby>2YII>D9H3F%&M_10ozwx3JJibWV! z_{yw*9MU-N`*jhZr(&0q$R{eZjl)XF#3{{r`ly+n3VU&l-4Lk6>N`Bp@A_P)n2*EL zxouHD%^iBMa~1>qNue0{Y>r*lZrlhNjZyAz?T^|yq5LjW$H06Xa=5mha0%HDA#t+H z&Pep|VHa`$TN&;b1mrqp|x^0CFE-bh+6o#AI4;f6R z`Ky)q!a{bB;GgD2%th}4qSFRJ_6QitXk!$gm%PlS;Vnv1@0T|h>` z_QH9-V*$K6nQLvUD)!!Gfh`KkvOITRZ_d^SD}Y2vSm7PWGy3*XuO&cj@Nc_I0b%28 z<$P!TovQ?gO4LgK;*dm8F+I%u`X6yM5;P|X+SXvPF3R`ka7z)ojop<(!%XK55MzGt zALqzlS1S@lI65w1gR|q}f~lhhscZ_E<%=K?hGR_If^gLcO6GF9TcIO)ILlsYSYv*Z zHAuZfQ`e`d{c$J*>f~^8IAad>FHjb#Nk2(7&&amCt}$@q!|ix|c`5CocpnQdY7mfh z_FQX8VOe9Sbowzh%}vTeRpp{@pYRN1B7&Tjj8MN77buAj3*S#kk?4jEXV$dwj`sM-x z8Hl6@r*f27o)By1Z51I6u9w(d^)n46v@juqyW3ik$UPl?e{wKv( z43PHvKK6am2=;|f5EB4C1{cnrWXb?8-QDmuLP)2OArq3~8@12NV{gnqO;3PO0PS!& zhYMgY4+w~I(;EfkBF5Md8W&Nnaivrxd!#C|CKmL}zi)1ba>X~xITUGDJxRw^@tszb z_-Sf!nQl}q<_vK+%(?gFc28SreJT6b$1APU=9zr=q*nxy@%1Mr&rPY$oUui^#$?Qf zf#Z`4J18B0FqNE%k7WyH6Uno=JkzRVL24)$4)4f0dZuJ=!WFe4M?~Lua40*Lj7Y)Q zt~r^OJiEzi>x4ZLNmbQ&IyuSchb57Ng960%Jp6U>QEF3Il$3{!)p_@aQ~>b363Ej` zF+O7adAMVfnDZuJjKrc53p%EA2L>BAI#hnf7OCBKLAp9{zbO)XPgFc1qXN}z-ESOM z0b`ig2mk$D0Lv!yOrkc)brcpaEn%?ml20yb!Gl{)P0dD}qxeA-_qR|ET%!|bbvXC^ z8N#4^7EAm8(mvWKzoWrlc#LxQOK~DWOK-Guf1}Yx8%4YGlYnKDf37MVyEVLzpoQ&x z$JNE^ox@(UU$;D7-v7eF?gzVFs(GUD&x^a`RIm{`9UmoMlXE;*pw6Bf0$cw1ug@Nt#q_jE zujk)IcodUS_X_(tZHCV8Z>0eK-ybV3eE)w-MnW7FK&$uzPaqDB(AXnhu2tz%40EpEPzQ2@p!!4Xr&)SOSBZBrt8wYbVWe`7UkNev`O`T2w`0 zjFlxN?pY*EN@?$Qp2F(?>%a?=ljzP=KZ0h66Z*p*9lUJ?7X(E&cNYz;%bHAY>?LeM zizJw&!V4nJkFU-jeo1(xr%VtO{>nIsd~=&L{)<#aviRtv6`UOG3=2fD*m?mHDG8l! zn52hfPT-6Hx#B{1NAK%8uv+>vzTBRz9KISPb+(Pt($fvai)7OMdcbObFDK&;_}|uv zCl@U@D9g0StjZ0-TJuV3baSQxf<*THkuq)Fi|=w@J1UtIcc13m&Czh{5k+=bEc0Ha z9y-p&Ygg{UKKfUaueYFVYmfi#K|0i@>?^Go9+akk*Jkv(Vu5gk^n3ym+A|`zw8#y> zqRaz0Q-vj3Ac!dr?48rPL#=c4YmksoR}v`>O<2nEoR$YG#{ZryoFxzQdP0O$H7)bI ze*OlFiz#Ag85vMKs_OU_V9fUDyrw6RAZX6~{Nr4)$x?=e7y>037DeM(ur}M-NM)$| z0m=ysDTYw3NNj$3wxQ&ITfVkz+GR%+zYdNt-QL(6S7WI`nK6N>qpG{zymH$lL#<>b zioV*c3PN3rF3YmM>C^DZ8<5RG6nkpJut^7Nojt-}w4)rrqr_pJlbj}7h1aWY z!vFqfh?-IVd!H^G+^V#q&=Paw<7MjBq=P6?bVqb41X63aOyc0#%ahT8V6uK-N#cpO zSA*A7d{`8H5g+!-(3k@`PAlf0`qj7Om_X})M@5h8rEzvc^YoLvmX+C4m& zrk?W`L+KWuoT<>E@$@t<}lS`le^XS9zY}pNXkBzI2q18ppK#%~i@9P2#2c z4tKnRVymMB z$A%`Nl8?BGN_9ss~JrVOIwBZ6>;` zxf=eJ`h`Owf#?x0RDrAwlCM)8g**w(^R zdLKB@B2S^~7B`F+d#B{tci=mxc~L``?hQ_vt8gEV_!d^1%^cN&gQNVa&So zSa@7^WpVP5KU&|xl==2(BYblZw%wp!dvK@E~1i}C?(8TsBY zw8A)2NE@8TH@<~2^}Um1jt9^|x>l?ALf6bDuT01KuMX1Q^w}E9;bgYA{W9^hS>NjV zx0$qqyW`KOnH)4R+c=Je{-#drLMZ25zW)|9(&T0mNTPR|cu}~WFkJ8w_ioRwb+Re< zjNyTrd}2d64B-HMOsxm>F!E}kem9lJElhcc78agfz=;4hCBB%2gp8_g5D7(c-$Uk1 z(OslQ#syYL)U;RrdLa^c!-z`v)t0zW>yXUdBxPq#OS2#KJ;l7QJhd%VLF;Zw%~A2x zT(KLv+=3uku>5}5iY0A{joP-l24moyUbkKhe`D_E;6JcA9`Q`}+ek>96mN9e0jHx` zk{Q9)u`&U+%^s^pvPD`tH6?p=~?A3W4w z(dgeBpYmgb{_f`b!OOK5I$x!2(4XLXW8ih`8o)$Cx@Px{QG54bRY>-`Oo9A*sG1La z#6~nACL&4H9FJ$aIQ@nG`Yon+ahF;N;)i9wm%0VHQXLg*lw8o}eUGX7t?o(QrE*%>^}=Zav8k(2bzP-E@*y)UO#6Z)jCaXFNC-FUQO<85^2}*g8WY6p zG!vjrWKO4Sz?CqpDz*TTz+am7bEW=>;T*O2Z10 zJzB~YjxVkpJL&!DM<+N;nju2Eb#M?It$Kvj#TwkChKe)zUp|K(_D>mx;U6DtZcM+} zYu&PHkD}$*-{Jy>sqnyFOO*-gj_%$)Aq!e-HU{0I-T9MhXd9a9tCXF%Ol16rmfQ5K zK{~yBNlPJCY(RzO_xGt#p;Z<@-t_4nO^4mwdM-%cWtgqA+>HjP`a)pz`jDF`x41I&SqKv0m@HIO=4xW)2EZzQ0^*lTK zf;`ww6w{|6cjyvI>`HI%0-ttC6z^c~<^IGqt-oqmX-fb09y&s_c|HKhPgS5n6N2( zywWYB;D^_V_a3$oD}@wEg?I0`P;{*g(}D-!)`Bb8FkK$x&{TEZkB~irif2jx3J^OY5s|3qRZ3e!RLd znN{)iWQ^NM+-BUmAUDfl?XY{Rj&H=&P-MYB!|7;08CjkS1i3wk9r@zr7S_<}%YzMq z_wDV~TLj1Vw<|9*UmA0&YLpxoGzZT8q$)+F*L0&su8QzxT9@zui35)}9_O5{UB2-U zrG_m1_UYRg8X{;UUFISBrKzI~#F2$mUS2>%uRmCY0>s)XtDDGfq1S1$4|B{XH7b@} z1)OT-K3)lDdrZB zuaL6NbGElQnh)ja^EqdIpC5lr#aF;sLuz*A{`SiaVO)hhYDMI#K`5SYmh74BFX1Ul zHt{mHLc`^gVKjt3*NINu<^1*s7``JF2B}VOk7=19*)4%fX5t#k!cCOg((!2`K7F-g z7Y!FQQXme3THLnw{mJ#$%@2)}2_!$A|9ziiXeTDc%S6)j!m~J07_hGJ8#ksqldoSs z-g>-DG?O1pAN-77w0e?GuE(LyHVr$!h-)H5p0MIvT(mJThYNitV#WD^ok+d_CR&>JVCoc-F)8#Jj@Q+0J zim?5&iHv$_(ec2Zlv)tj-Gf>C!`|C@i6~-G*l($-&^{+Zshnz7Ix6#S8LDPxK^gA1 z^HN(4h;ie96oMriYrnXM*7Kr=)1yC5skThzaLDqV)ZxUOwf6uLz0Ffo!Dg~l0mW4i zHrUlKvx4-(IE&5grz{C6o;=R(#OCB}*gK9?%Sr!S(y|5kl9AO+B&tcEJLmeY^IVG9 z#bQ{`edT?A$0JvLr>U1_1*?N6A{4W$8of8w@!%;lEM&jOD#Hq&Ztrgj<#am$7G#Y! z=ImnoOB^jF6^P9fmqYl%Q~3VV)k1$zvI=*jW$+M)UX`2>$6g3(!eRC z7NIl{gF5vr~Gx2zZ(iefpnZu5!a#!&7mQf`}o z8-y~ycWmM(bU0A?mQX&{w~^}mR&U(coB10wzuiU}VN%9f-ZjE*%vKYD1QOPBbaQ?L zCq!pz+SwM{TGiiSH`O<(yfq{yj_RaQ@_$M$=Hf+Tp=YA&jFPCy}zTPbM7A?}G4`5K;Uok^7}uFA1<_@_}_lLK-Jv;pk)- z!jRSMK&9K$aJ63FzfnN&b40AKZM+6*Pj?qWai}+ia7O|^K6*?K6RU%{&IAC``QrNV zd7V}+8dK#^L75Kwbz$P^q`=uHp^MuUvN(SEuotRuDSs}VY1U)%wOC*`iUQirL?osJ z8G9|VmOvB$*hu#N@1vnLd8W$XqrBn8@9i35eji6TMO<6*XiFaMyYi>(n3Tt(V{G+q z&Zlw8{+u@_A~&RI2v0HcpX;=OAJ`Hhdj9uM)S8BGw2WXr?CO&3#tf@<=suvnq1SuGO3rqYqwM{5b~)WdZ*3t=fZ6UI zY&vhP+#ULNz@&vC>_ub8hi&)IX}d@uDc8gmY%U*8FW+EA!dmdJL2P&L&~KQM&S;CW zR}^OS92Y}kFEwJGN+?S*Bhj`>3wkSi!pT|`0aO88$q9<7+rV^&(|f4icW~xut-8-B zx)xal&k_4-G$~!N-VmNtTxpJXGM!Rsb)Z=jeWigHDFU`CPnkp$It*7Ksnlc9mhC+z zd5`}&>EHKx8I~!q!Sq@j@Tg$Ssd!HNYmE30S4Kqh4=45i6~%mz`@?u6XksHCBouBG zuHJ7n!LRvgy5_uXI@t$#8(d$YpJPSN?TYw1L- zV#g}yJPBicg4NQH4)zDO1#4{iNN49Iu2+Z#pr^sY4x~kYq0#{c-!&<8OmU)se_wF_~+{iD~>BazzixJ8d$Bvu$ULqaoFpcl;QxV&(bM>g- z#_T(n^fr2D#gmQIgTu;bElfTUxe=y~l+aw1y_!$yL zk@X=ZJ|Emit!pndmbD33hb-y5@%Oi`6V4qQ%f32IhvfxNFQsFb`vGP*=H&S=5mkDj zj#l^=B*d?GpWpj7A7!3YmbYzy)hk@#2<)Hj$e(?UZ~a+z=Ih6se8^Ay+@k_afvjvj z3lm%R&nCsNiY^n5QW`ySu+Eg2lh<#m(P!X?Kk2JR+@P-3Owd+tI_m-mWEg9m-7rKAt>jsPT%bt`c zbg;KG`*qgm9Ff~}%lTgeLR*icyRoPHdE@etkbBTvR|6A6%`iM=thRDY>?h_}v z89L3usXn-Fu4apy=ab!i(I_+A8$yPS(F~%oYY|)iwA*S?nO3MbIU29XXF`C?T-PqW z`;s54;j?(mJe>u^-Mv8!fXz<@a((y2;SPnIrJNqqYKUI(7)3ZAloyQ7h%vcH$y)id z?NPu(FO9*uPl<-i00>9;9h%W>Tc5C&LjU}aKJ|O`5x)BmKSQ*|tL=!q@iEzi)Y9eb zlgq0iayz@@A;wtn_9W!t<<*hf z!nG>(ynNdRL-#wUt)F1|&D~^ebH?3h@M2XoDyL%Fie$N()Z~C>#y%85EyFW!^-a3S zlvsG2QU-%=^i}ALPFS~U{r8JdgO?xZD}(9e4c^_U5z$(sw%hYw#;srBvX*a{<2n2+ zb|6qW)rZc~q;cNgg+73G7prC_|DP}6dr?tl2e5PARU z10$VG4W|F_dk7ba!Tx83i?TugX#u7_2n^vr`yR==aQc5!6lAki6fUEp9~L`(CrIb% z6+yDdSpoCj`*&-XuyUisloC8Tx};K#6R2GG1IbDEfu&v;otmV*Rc zP!v3W303Z+@er-DJR~CFV7HVgK5xVkC4GE%RtiD5f>fi@&jg~PB_IdmqAq_bwmvQ*2f4v@KO{{ytGKhdG186e?eix3 zNMc<7i#4{2PuLgv>espYv+c;6vg7;=b0eZr!ZrKxW?}se-i=?Yky*d)z{Kt3o9}Cs zPf~E8QP@O2nwUGeIJr}gjAJP15ifk6s>8dd$;vxvISH&^A=?`1Tokbd6K(!+Q{rH# zTU}QS-ebb14u=8Sy@Q9r75vG*?i+ncj;8N%m~#EN$RKUy>mkh+2ELPC*{5x$Q;sWR zQJR;l67`hF3o0F6{?WYm9&WT730zc?8-5^*)$`gc#6}C9V@GsD`G=eQb1v|83rf^9 zteAJ+nPO5a2RwYec$xYRX$^TMtuG;r;H9LNjm)2zfz-7UwJMTdpL_Q4K)0`NbSsqq znhd`MWKoBE7_|x(fq+CjsH2-n3waVDPx%eg&1XyC%Bxz9f*$<{N%~p^0LeNJZU@;y zDw&^?7?Uvc@_)zdg4X9OJqv~7?jVOMOV6+Q1lqtrvHNR~HVFE9^sqcOLL?6)weF>Q zsueP>s?ZTGxdH+bHdY02Q%g-w9n`VD3TUMKYyaMr^X%M)vn(ZSf&Y}?Pu^+8CWC5< z;d8!&D?AdU5zkK{2SrcLR>W|8YE~&<+Wg?V}3E>^Cw3KV0BwGdTws73hh$;Y^DlCVQQQn0<6qo*$wl+y&cPFW>j?Y!(eRY_`Yj%UFQDM37$RP zu4zWZwP<_WNfQMIAIf|l5c@HhRBftCol7GW4-sgB*|jc~_#Wn|S&DqO(#eeswwDdqN) z78r>jMEnX6>I(4>oyl`R*(C(=J}VctZ^#|X;p{k?6f?(@lq`{Y+nwok4^3R2s~Pn=4(Sa6?ti798% z1!v>j-H+QVDfuRFIW+Fb*@)AFU#cQ>$9p4GX7KIX+Xg+hkAM2noH^+{hzNHchjyRAyD2-=`21&dJ(CvxFjFGGtFNXMUentvJ zlF5$Sdo`VO7HmB*g=dGYZ8DaW@xVE3+L$6toKnoYsg;lt2X^P;WFqZRYbt2WQ9_zl z7T!pexa`xOD$DYq9O9%(nsHSi>%kFB9R_)ev)N|KvbD2cIB~A7&8J;M<6c~yAc>ro zYDpfv{8I?oJGFdmyITOCKgZCI4-pny$N)A*>WOfrn zehJtfWRS2GGqHTf`R7#k?J7LCM8kSQl0V;kwmGXugngIwT8u7SBE5Zop zHg&XY-B>~ylNZE&*p)5waq{xb$!EozaGNeBuRqU!KlyOc>WJqjCY>r)UJa48%!Zeb z-<;~tw({mwVX#M&1AqF*@Bq+%cez=*C@}#;tYXDr)lXm=g=V1`3~+t1TK(5z&$jWu zDxAA?FqX=zt9t>SDOfb&7TzQvmqS@$4~wVTcALoHl(t7+jB# zweTE`_7RD4s|Z$6-Tu~Jh=2fhxLMk2faDSI?lF4W17wCsz7Fn@P;=-83sEE~m&H>3 ztYsb0e+5^4rG9!u=X|s)%AJ=6La5~EB&VtYVX1|<90sKQh7F$K5a{1f$dW5=*&u5& zRUMX!?zB_cGW2>zT0j~KN3?b8UJZ6O@UzRKYCpbY#}6E|X1uX~=*z>$&mQlf0+&aG z`(9Y-E>H63t!(zOR(?tYeml()my@+L4@xA7S!{7=n&589Ny3Bp17CcKRvu2p!%G>K zV$n1g?*{yFM3yEcgejx?@XI%y5yj_E1>i5xK*xzfVY0+s&_eLM%|qH)Osh*)OwTsk zhJM7eRG#gkgPph6(NJ@I1abu)0|wu4#|4gXC(P`Z4nuGFo`zSYMkK7{tDLw z6R$L^cQmU?3-hVA5=PGt)yyOR?gwdCc4^XLc)O)jv)*wJaQmVW3h`D2AG^jpa~cV-F83LGVk1e6%@$rku8KpSM@kiY!u8ke=T$oK zkVK{M>A9g}x=Tb=`ztaIL#dOH;Xb9^?vbkqPRnT_Bou zu{I}U+T#LXSCA+gs-NNS!dzazG1u8|XO(;=M+{dmvg^+F*Ta@sy*PRCI=Fn&gOBU* z=1>eMNlRNDvC9$;^SrFmjs)b4(b)Pjj%Gh{t`fi3CEX$n#H+(=iu>wkjDZvpH2}?k zhkO^l3V-z>gf!>CC$qD6Co=ZRv2NfKd*2wxX{-?0_WYKZ$h=@vO{ULPKAwC{cc-yN z1+Eu$p0DJGO>8w;=EWr%#~$iX)l;uuL=`Ji%NODBJzms5rft9R4r{+X_KZi9&vJ~f zT4sU+uWINZ3GtU`q@$z5?PrSbs~o<`m08<8a9a(|m`%&0^FB0DUX!A=J^ihnCts2L z&z3hw_-)VmV(o3hfmz?p9(I(&e||VdBLQagk(^vh9&6hp%}<=CCW)4e$HU7rJqkqz zm)e%)DyXPO&^x$_|DS&*9+$%l^x0YgC)JIVN>blxx_dZ1AfG3nFO&2jP{HIpoNX{3 zipk83U`mc4nR; zy?wUzI4Ac8UArEwf>h1MP8!}s_WKm+I^4jI&80ukx$gSoU|d6G`9#%f`!T>uCb?kq z#pl!+&|hBS!eG)bgu@nz|M`yp#O4d|CYOm#{qx@rm?}X{`6|V@XapbrN$B9off&^L zP;)*Zik@U+xH(roVLiUsJ5YOexAW>;B=EeqYTY!8(Go3QFHA#fa0&#zn_r;pql`#MxzZ352uj zdHh=%N-yzHzW6OC{qauEx+X#r%DL6@4wzsYJLMI?fbGfbcHF@mvbzBWgU!NiM_`W_ zyIeWCwk6tJ2s_M9F-6~ffP=}7s85Y|vLzT2A&f)<{f9fjwpcu5QLzaS&r`UD z&f`Cv4Iq=ZrGiwl$r(wSmv*NQJOPKDpD@{YbA%5Ro?7L}`iL)kgfiYtmiD@wn*ELS zp6)g}avouJ4(3PirH9IW{1U)<_)^ljs+Q=aHO~5!2}<0iJpsR%kzL6H-D89*d?;sR z^DV+mqbM3PFgY2%fvc8yqYAbFxIbKQUjgl7x;eE^Rfi7o$FP$lUU#Rjs-#(x85-O9 z83x7m{hPb$EVD2u+nOdbe5MFcay}H`oexbLTFnX6A8C~~t>>QH-hIqAnIFHY*OJB& z_0`^ZaD^WT-_7Sx(TMjfGTmJ*WQQCbpP|r&;QjpaQd+x>wyaCWO~);XtgQ6-SYAS6 zw>M4)a0>EZ_8KBk)fF0cEPx9l%US4^2BiI_s8=-@VpODK>}cKo12Mi+48>n*tlpy1 zzs3+ubbo2A_9~%C-YJE3Cx`di%2pYOfkmnc&`*=;FAeomuwUt09>1mNQk7=+{Vh|1 zUC`ENNC8sgHzmW?e%&COmX+Ah$y+&W#?oIm@_;b#N2j!{3{53fsf<32is&-Pm2Yuw zTVCtGz)|c!bKN@{_t*L>M|c{C$4j7-p`-vA}4hK!y)z*UKx_DV0ovy%#&?fW#vZ+EBr2b+tgSbz`= z9vSGTscaT++$(=p&+z)QP!rUAp;Qven*Sk?(ihK`j7{|2+R`bbe3+ea_e>u8E%(fk zV}hP>fThf>4>W%XJ;ye4xd6PCmC1B#eZMx$_bk%@FtoK<4c6VC_rs6T9P7#6JH4(r zuPr_1-FE-$=@UVx(1v$Ne)Z(m4<0sALlvZ7h=v<5i$b5rX$7X%)b(vQ`5Sv25UO(7 zsj}AhgALSqx=()!6ZZ9VS52f|YR1J?f;;T6rqsIx4bk_TFxix>znE-ES6Z4Xu|Md` zVSzKt3&M>tgRIPWaC6qk`p9zV^AnW+qvWTLr#)*UAlnZ3=JWe901PLT&tnAFwvR*^ zjbo|O0E?XfQzRvoxrg~BQ4`ZCct3NUSXPbODzxIl^w4?=uVSKrkH+slhjafe&?z#mi<{i%GRPFWugyySDxX)v%d zi;hYar8t&Yl(Oy+Hr8QAi+d0O$j{pcSyrmD7v2+)|k8 zSt2QJ2paJs);0+!wD~iIV;w}OP>&I@@`Hf7k#iUqN}5Pl>=M*^vd@ zwkEDH>wIglF>K@Xn&`Hw0D;Clx!EoCl!MyW%jI<)m)W~X}7TK1m})ig)LE^ zy);!z(U}-telLRbDE)TMAIDiwxH)RfFP#pXaC(lys=F<-q28}sRLg41wGLoB?CHLc z%<9YSjp+e+puaJ1o*q@Lyk4;b!$wI?{%^*7efs%5W1I^VU1L+#dKIN(;dUFPxhDZ53zmUxZ=G%5Fc2Ln z+Un{~z$F!X8NmwC1Fx9g5SnNV@)-b(S1VcJ=7vi|YcOC|7clg+kfE=Hpq+>z4>*veT3VLgt6!0N6nE5FcG<&~!F-5l z)+vJ38H=j+`)OjYZ{I@l3K#g-wiWEjAqe4Oq^$Jal0I}#-0Af8$JBbqmuPTIMKo(e ze2>pZ>QaG8@Zmz?f3!InbeAg{eIrhtv)5jiZrVB3z!UD?R~)>p{D`0_6P@GnAPahk zpt3OnC?<_?L=ze9O(MvM5Ju?+pP0UPI#uH)QOo8^$r$8^FG{1aZaTs6!4^c_uEX(l zG+2-vwk1UvMz=-)Z+qZ`qn^s6YmQI4%SKBwDZW!RR@v%c%m5GOI84g!AiC2)eDFG zS^XsawWfzVgMOB(1n%6uYb@s>3?$}9&^NOxCIdlklRcUcLcgEf{(dsig0YDsF3suh zs2_Fh>5=)3Ir;ANcPQ~-RI6ekN|^vx90F+PY3evtz{MD8$6ke6u927D42NTk)VJ5P z&M%*3AXrDumiks1*ofb|cLKSmhSnzB;oyU>Z|xNtdblndZ2ePO#0aG%suk&J0e++c zQ>sBfoX)51JB26mlp4B{tH^?9>l9tf#w-Q+M5i8@`ugs#)0OGw!RzU-Gxw8tX7M-P zU$RV>Ttk&6lLeL%N6%X0vE$2Y4OiNe_>(NP)w{~PtXI-ejiGc9AMe9m>+LZqkqlL) z*?W|?ANN1mCCQvqUu+#m=wR(&s@n1T?#8Avu$e%PNBB|J_&~6}dt2G>D!3?f_0v810=$%<EYF`mrx??wjz6o7*&w9^(3XOJgRBUzl4P4r_b0RUysdOZ@-;OV zg?7u0vPBp=z0K|zPi+1J-UM6W#mk-T2IE~fTqPNnz=QprjZqh2w&j$5_m3pG9@>I{ zJ|`+S;k?(N@KjEUx+ux|WC=2b22{$xy3Qf7Rr| zMis7y@_3a51iB|4B{$$cO42z4JpR+sLlaii;d%nl3-%aPNJ+b4$Oqy7;mOeF!}iBNUBLM@{FHW(^Kjg+$LN zASXLTZeVj^H!WP8n|AkvlNjnJ+w+f>>){;+#+!U30dsbXsSo@0z1`%_GDPjWXVdMA zmffQWI9G1Y&0nVXsXl0{9V(n1+oYd#gUWB)<9s}7#zwRth{?O3AHRGH^2212C-D7#Gg&K_GZ6^#*z-+747M*I9h?Ee&FzsQaypK$T4AH zC(NH%^arpc5R%BvXNU&^rM??lxtA*;7nro0nn0D=xLNryCEFwg9e%Mi4ZafA#b#+D zsFFkhbgcj+-y)sCuJ4%I;j@X0SK{vR$>)!k>4K=RL??jIbxf<2*WMTS_bYvZ_Ig>$ z@gMYZ5v_7@%m&CTebm!S+lls-ML0~K5T*53Zh<@%sZ~J}(yqE!DyCGD=8c^;Rx-kd z`OFuxjT6bMDn?*?^RWGumaUVj33GQXul>e|=R*+|NSggW{U5b)Y@Y$-N=w-mIy7C) z!|Qy5DA6baqB9Z9*oeb$vFw$G>!{n<*_BBc}`ztZks@avDruAU! z0(Ny$f++Ejv1-w>`e0x#b?Ot(wC_lnuh-U}t()waP3F>bH;turPN`-oqYEGtF56g- zknfz{qm--E74VC%Q@r5`pYt3Yg^x&=eQ`mKL84N3X|;E@@HvPMCVULSF*fLFOf47h z%>OW}Ae14~FGLFsgLe?fBCVhCDZG4|ZXC5%YhFa;Cw=7$PK#xxtZD+Q@+jY5UJbY6 ze+V?iGA&P~`n-f!pxf8LG-%8+=f8%Njz`mX4uAZb+D`6`ue8OYQhIx*^dB*%ohq%4>Qqq>?<%P<17?io%ppr8$!?cUFz%mK3hPDh zwbBI0zMDsC`i}#>LCTXVopHp~XO>}G9;_Uuy!I>+?Ei-YOS;r5xF;&z<0apw zO8*}67W$nb1$L$k{ySEYU}wVBhtD%Ja0r~rL`8>^K%Flky|b4H-QVK?8^bpL`KDqS zaRuzxU;-GIUlv$hZcXMeA2d>GXujg{JF|iZ|LomF5C;BzB)rN|UlbaOOg}09?Qq_z3pN$xWi_Re{5UgiTn|A?p|nc2)XlrM=z) zPb=L}v6kM5uCO_VXjtqmZ!-0_KF|AV@y6LETk39F;7N;Z5>0K<9x_ET^=XEj0f?ko zn${#@z^dWMuQ~gEFpY=+9>?4H zA1gyu({_w=VUi;r)Lr^(W~y7GYQ=A@B>0u}w+2tcij9icbvH_7#c$R53`UvNa1!jZ z$^04sE2dun{N!fXlwARfgyJw9zj?nj|Ab5P5KI(Up#r%#7>xXR{Q%VcdJxi`ogrXH z-UpcZ>_~nJk?!bo)gEQ^rXPpJTVZMN)+*9BRCfD8CDR{R*S~|))<38gwKjde9*(Qg z$Kn(ud>KRRn&lq{G}l|{MK7d7R=S-wXrbt;S_Y357>QR$8>f8z=%k0E&=0G-W#5oy zA2pnNqdmGu2r_DPz9nJ%2u!If68a zyZ*Wcr|T0hOOZlNST|Gm_7*cRmB`1+>JQDu{v(j91t|g#=>fV{=lyVVcp-1CtyE?|?k4mejg>5NB(XL3DpOsR~Qpi{(cf@M2O~5-2R}krS9;PdA@Ju9XgeY@7m< zZCeY=HI!|5Ck_Uocy>>LIM7WdvVbU%piN~|GEPDb9a_X|Z^Py}(n2-ndkgj}j@xUZ zQhgD4^K<#I&&Or9!)sNrUdf@A>$NuAzf>EW{VDNvyWn_+ssq6Uzd z#a-G>Xv(wsMksTB=N~MgEYfIS+#3L{qcG+4Sl*xBjf2nga3|~YS-SkEfN0P6UnDaG zJT-EzR&_9kkHnLeUxbO5;SC((HeE?A-`52pHQfrGmh9BOiC?w87OUjpsdcBGySUPF z7tPuO5Ni!o1%}RgyA`q=ba48HzE3>a`1a$-#CuCW6$*n9a%AG0ZO}~--wCfw5z3%~QdSh}he@lg|o&&spzwF^dtP@mY=@P3NlYX2uGxmP??~pFxm7FAJ zK<2{y9ei*QPOt5}!Q}DZP6hT3nC2o0y;MRPXAG84w~zQ)DId9VxEnLVR)tPEsfa2u z-PCGIAWX}bcB?8@cAohsQ|Gml)AcNneH<$=S$lEF6-_nTC~EOKUpZr`#b3it`=mNV z?Z#$F5wDAzbXHw9#(S89;gbE5ij-0Qi&URwe4~nq4W$@eQ(iO>mtXf=GMSok8cv`l z_nj?J(fC27J0+Yf$Wk=xl>(AT$vtzj>s zb?r)_6rX9FqqB;ENBN5ee}h{$9Z0| zd7+e0vfxtbKBMKXuc{S!eB^lX zhw^p;1F)zNpCR)}q!|a&{kn7kCHb712UTV>k%DHEs!qG)=Vz0wE9!spz6z>&QTd96 z01O(+X4crsMp}6!1fiyERfhW{%!W}rRu*1Kg?6g=AunyX2jd8t!wM1;4DSr>G{Ja; zk^7Y)zU6!xhv{QDIyM+@LbqCOQY}yTYhKTamhWp@2{lnlgZ2dwd`1Bm|9gg zm#g*8h+18LDc#D>4eH0icsrL<(n_W;lYqEpl#O0)4%e_lfN$_Bv{x>iG69* z@oz-h8kWhr0Bl}7nzZK678+N}_Ov=7szyRP1Z*L$IAzoGEjJdqwyHw3CpI=^B&fWbO`llB5lL3?;!&5AKYSI`9pP{+lJW zdt~GNtGWQi?X?ZXlNEkFK5&!SV74#J{QC+DQ1@| zy8o1I_*t+*#@eMue}=?MrBO>PMJG372!qlFB)!!EEZR7oEn;gd9g|?q+ET&7w9+fg zW<;=t{4PRyjLJ>}_9F24Y%CGv-;2_o5NY*#%218bWv?!9%wb4BTF${^66Tfi2xr} z9^?BA;$J<ymJ>%B#_HI?QoTQ$Y)YGHzdybF z*prgfdk{nKZuj0_xZP>CgYTCRZ8+g_o3jD6Y=Ch!N|t_9Us4`jBEQNWT7MJOHXwf| zibr3dD){Bil?UHe??WZqaRS!*wVbvSEXcI+6xUsOjnRliN5M|M@SCm zCLw_Ir9a9Oy!Wu>!uhPD5emlO^pvb!J5kjx{1at%=faiOcSjdmM3^lKe_<;8a937Ie9UF|pC1@;{{#*XtUl|I!X%?I%*VSa?h%h`@D1W||lZ!`Tj z>o3Z8(jkAfC&bw1*Vp%-SOOS8jmg;9vnhg;!_4ALI%X2DlA-wK`n@PU}3{9uWWz2@6 zCX!zx>g8x!9W3NjV>Rw@n_R>-NE9NJDa1T^BsW;Ncp5st^_~N9j9uu#P~Nro>HD*) zL@~*7```14@cV- zR(H1Q!|)Q)mU0w`5y+6vm$QI9_S27y#$>{9iF;O|7j04E25%W62^L!L`R^?A`J_dP z{Q4)Q1PRk?0TwR%tKGrNss}$6_I{?cT|IAzX15oTMZj$qv*8dn&e}LZPYH*exjsUS zzK2^bnSjH6KLxD9nwVVPUJXJeGXwI2G&8dzOKpta#dZ7{i=iE- zgvnXV#arHTR&Cg2E|ke&B3rKyq^po;p^^na>Y!+rSV(RkwDb@5Ps>IIAd&`a?AdKK z0tMR=B|A^n8a>_<|5R|t&bYi5OrxU=@C_3RTyuB|?&l5-VN>ZiW!kWi=Sl`*9Y2Gg zbE-$%q=Cu`nPz1!e1YF$BP2@p+}(yA7Ym~{~bs(nq;oZp~r zyjwCwo=9nH7S;;NXOl}Z1>i;OI*~zb18SpT2Tfk-_E;NjfRN)*x7=RW;3WVYmuXVn zd>O7@DW_*N%^ms?x8&u^6Y8C}j938U1+|)t&{pJgfUrXi0)XAVr|Kn!ua>CA9u#gk zz{2Sbej2F-#KqdayS_J1c5(b8?V0L>mJ{#_m&AP}{yq#PR;GZ2--JLyW0L8wiDfo) zZglcX>L_smT98{TTSgZr5f+lca@X@mtcOl=(@RJ=WGiVh(VAaqN-1IH-x;uvJ_Y63 z!j`eyF#4JHHLnUu^0{6>x2ui~4`WocX^Umo+hHNC#U)`!jpaYmznFC;f$N$@ia7A* z1}!$|0xNAlNYQxyN#=(%v|9Cq+ShiJ<=BJ7$}xf+eQ{6|L=3OxfC8hMYrKl<2nF%y zyaVmulNQ)Mc^y^PeXAlpVOVjLo~TO~I-CALpRzT|Ac%+iBmhdAef#&g?@$SSJkcAiV^{6XGbai2`|2>2K zCY9ROP1F?(=)8#*CR#A)^6HbUft#TJ8zYV$uISOQ>#(2+kkxgu^Yq+W&?LTarZFH1 zyB$fwENK5-UoIK%6kjYLvU~k&w`! zzXB)CRICUPma2&oE7lKp_ns||@{mi9OYCcZ0M306|3~gKzDd2U8yr(?m$sZ9oleI>2#CHMk)#o<$g0j|S75J6Vv!?H9 zPbV4!WWn9N8MX!Y0i*W4g=*Hr{&^vt_NFrtsHz2T_7K6Wjw6u)DFRC;9ve0j8NM|+3M_{G%>X{^F zyTD@-pClE}HQ=k1xYASs={bA*_PM&1I`Z;I24MrTO9!p#mr>g!Z-o6!KjQy3lOn!L zx8{A+?~vphhvMuW_7lw}?rZ>%xJnd-yRrJb*}Q66ca2aAvn`Vf9Z=^#x^j!}Xub?M z9I&+jd0oAlk{0sM%UE#LfnH20%KP)2$K`4r^7v~!Mmm~CZpRjOGP|≀-d7xNwL< z0&_|b*2aeb>LB2KHm^6zHw`IHVidu_B#~TDEHJx-1*m`4;=#*j!4w&*>1?ML`1mVc zlAz}66ILNAYM-n?11e8k!n=wN(j0mfT)12b*Ig*`@_{*NPL^79|Cp%w&e0YajE)+` zlz%V$`ZT|+yCwUhRb`e`-^f%siW%|u1&(LCEbQU_D~_cA{x-tVxk>NXg+~pw#g>23 zxt@c{kvs;*(#C+W9nR_#R1QH?MPHjOleI2#>JU_z1x<`%jb+!y#!Rp5-Z2MgWMJ;> zZJT6Q>B8))+2${$;5E9S-DN&FM`aaJ8=g8_U7amWOnpPj$7fOKj{%UZE>h9`Qq0hK zk=c!HP!~#^KoVVNIxG8!783)CTbgS_8Ba_URMhXOS;hZaT*ocaT=e83nD>ihJDuBU zc_$s`<9{xBzusz)RN2J6A{@=f87{ZzOXA~*Rktm`Z3aL!2WtLD2>cx`Z(qy!AW44# zS(O{zKFo@7&!nMVRy1m1%ClZ@tYSLBBQ`nD?`zRS9Lv7}ZJLIMz+m}7T}nU5)Wg-!C{6^qz7h+;^~#|op5k6raW+YkK={86tTeC$su8z%2eCLv(*_13d0V-->* zvTZ9Cv|q)b4`VtuN?*4F*xa^Kdx@|bJ4(=aTI_LQp|TN_^kf?s)6#*9AW}q!uM6()h5WoJ)HmkZ0;WrB7LgNvG61r80mDU;7=&oUz(xnq=-n5 zbMR%*ZP!_0O2sA1)n8dcE@>VN2hrkVRm|^wn8>yH{+hf*=n|u@85dFYa;^gec_1 zE!-;2SN=SncKTW&WE+bu7BFKy)`*>qdR~ljpXFJ{XhdvzNFPr|$-raE)_NYR5uhMaDiaC{`%hlB+}e_%8%RhQw5Dm_lD%!pv$V}>i#dB%tlMA~jD2~fE!1#P z2RS_O&+`mMBYR$3RNL<*P&oy{tE5C(S|=+@Z3NmPT*l^+o`oV&3y&UW${McTmM-5v zB~kg6FhdAbYbRU6B~6+Q(T2IcTRF03WkO+V+h+TaB=D3?J8YT-st|cGQ0D5?Gc_ig zm+5`C-`khqNd-oT>UwZ|mzVxupH`LS>^=G}#%D>`a7~t);BwlTy_3Czjjb1(I}r$+ zW4thr8ZKNihO_@f57ko4jIKP8J?4hgL}eg&<{~Q}`Ekb*>#?wo`8VRp-X8;#d`62ueX7HQ(FDxV#@0g+_0Ein+d$OSja*E%N zSi9}`Ok4Lb3pxt9S=B-GB53=XSV_n{8?f9?PKreCG!gBPOuZK56%*;@))a9RI-QW= zi^Ky$7ub}gs#rr~#ffAyt0lp`PK{^$y3bFp^B;8_sGA!jLG(Ce)T|U4G}J*U|4+A2djgeeYOJ|elt0I4tYB+AZ{rQXldz-Md^(vq?gDJ;U%N?dVUqyp93rIYn3(5GW;@$M{n!OL@WEH94!U8Lh~6Se~YSB3TM-5z=C*_0Ftd*eG@JbnUyX|XxL!Ts+1C-3-T zp5}$H@3cwzlVRuhvBb;Ao_xJTNnUVM<<1eH@k;;)H**YuXVeMhd3?Kq4%G8t6YZ{6 zXK#{Waq~W3PrjyZvk4Q|l%scf^jW-U-1=WssW8|?o$^B_=}z>8TsV02UvrrQo z>Lr486F@D^YbWZ2E)27%AS->_0H-}$qTITVhk&hp)!{8R=V#n$%4` zQ=l)C$CX&}5yqGO+}!Dy#S5cAw9m)ZBd%=OC&s#93p|Q&S^OzZHQtUQ>taO3Ksh@P zNUwjzH)62-`<5z$Mt3-G7b$Kv^8u;XUz#XXX;asx`Ul=+VpAuOKz2n9S1Aw$F~{QB z9OO`v8soJ2EH`Z`s`jlR#TZJ`PnF;>g$}1V;cX}fa_HIaAPf=_YwtR)JY_mYsx7xlOR z46P`{bo-D_xVVdc9vu8U*9C=MS&+-$`5MInxVs8BBb$aOb3V4k?(GkS_hLneAB=c# z`adbMpuflZyU6b)hkP&59WajF4CA&Y*F;=y8Gdj1)ZcxdMu1;8qpq3B!9+_Gvl?6^ zND>@4#`(qN{mC8v$g(NI@?~af`6qYg6^B&<^Zh({ZN=E%Ew}2t7jy>;5q)~^wM1j| z=1g1T8cjDQdjO)P-pVG*8U^p@1q>KD&Iu)&EbzHwXC=JH^#@Y*vs#ygTS9T65?tgx z|M3lDQnQxSS;~5zwb0oT0ohgft^(zotG{$v*8nRHO@WW)GCWfV@bb+aEMUpw3r#SM zbV+ENb^rad@vrh-o8u{cyf*9L70&FXTj zKZ9t{*?!ARNNo!$^eFbj@|qx*@~jfI(%aiHoXOjaRE`Uhr>dVJ7PY>y zt(ZtuT3(0d4G&FB;^GE0Pz-(Ulx^UZ)g2R6uhEAW@OrxcWH=)*iio{=t84R2HxvE@ ztS#Hn5wuZbZHtH;oeR{~hk?jdOrUDG+y9;6DZ|1riZ4$g>4aeKZS732RfTLnVC5!- z{>18cFqp9D%8^YL_qh&Amvm^tH|W19=1{G@1?EPIFtisRi|KiIaB^r~x9hx-#Vv*& z(5Vzad6ixud>_e!mz3-D)ogrgU$DFZXa#SUPHqvI%m+q_6uAdtxbAt~$T)3ggyObe zZtZPu4*{W}yh)bl`esL<59!h-FJ|66iHuMTeAA9DU+U_XpULi|eN_U-# z(`%}Sv(Q*7G0Kjeoi5DmTl~8gB(1q`GEPajNUPJ^4`N9Oo!N(}l--3wDj7F4{N#pA zxKa!$7Ud8^f26AL{}sG}xkC=d&N%Lc*TTELI9B7Lg1SiWl<*5Ce#ML*ep$T)Hr~P; za$q=YL^4ZUhk*60ZHHz66rY%i+P5oJ5NXun?yy6Fd9=PZvSHkW6G!T3&K~N$MxLZ; zmRkznwdn_|2oi4HUCnP-cxI;`R@TmK?#S>ozzFkzJ$7-^N}x43*iKQbXLX1BJ7yJ* zbESsxWNo(3qdIyVzNqS3?v;Yup-o7)Ax19=@vF(^A5Quq28*cndYGXC$7IPEkZe%( zTKo#uwgoCnN#NxElW1q;q8mBEH8sSE>jY9b+=KZ%^HQMCZZ79=Klwgs5_?DT0YeFE zTtT0~lQ&M^&DW&*j2ic+)K)`d@Th@7(KcG#C!%utdUJP}R-6jv+~01OXjZODFi;|P zVq_>Kw)HUOsWlw93&eo;ej~SPl@cm_!f{Y5_B}(RGa-casfo?srg6(22;rFF-%oy3 zQ@A^3i;_~Eby3V>xa76!q+hE}T;!8nX7ga5)qE^*wv4&$F zRqNAX7^#nTj+PKUa+{;by~dhkXrJCe^CoYJqe~8w^hcfwE^;zau47f2JTpbnvL7lk z`8b5`q0Y}!kjy?cVG%^m$Lu#xFjMiyGtG<7LmRL?RXgg@n&-deK)F1&M&#|Q!_|o^ zzP@S(UjcYM@sFa5Hf~@=LVgdVsy^6E|l6UfU^ngQ>yvPM*s&%Ed!*hCmNn zt3^I~r zVNsSYEJ2Vh&Rr`gtvgJ*b0EBJDM<72@;x`>=Bt#lEO;y{P0l(ef9mAkeU}he{_0B> zg({fE?uhWec=SqXx5;?1dO|hGPmQChA8;WOLx0y2-ehiyClEuKlOPpUeRdurk3RKiWM}?lHqjusUDj;V=a`>ie0kI z8H1UKI+qNp7fJMIS+&cp@rU>qYB5xO$M$J;O}bO*4)!a>>7@LVT9=Gi)Dy;!Q(8>S zB~_3e-f#P~(oHK)b`#e9KW7gom`aI6CJ#xsvV3qtS)9io_<=$cb%-a;8dF6b4Y*RI zjMRqg^>NM|3y*`2QG$^lAnGGQ`^a{OIoda-wEX`g@^2&zj!!7EIL*^}3`J zj5zbKwdFd(EKb!02Hq6^-rZ5REAa^<1Nu@DZz_T6^t_U1#rWKCmi)gJ#w12T>BVnT zQy#Yd8AGFl1f2RJLGC5V3O;gCQ^J^hr11a}eIX_L@G6ug&FKEjd@W0!^?A8Z12dwf ztUr+)`-BBpy`@f)i?h3T@a*A^%^a#P4qM%)JUAtNrIUJsLr~nEuB=@O_znKqDq?^h zFOCy&87Gl0ZCwwNGD^cnG=56u9LI!L;mReYqOxgdhORkkF?at+>5g&l(?)1?wg!1D z@*FoXLon9(J#Nj(1d}9YKc0Km5Lb1qlxgeVC630dTX~6pyqHFOCq8CQaQ8BsnKxpe znHObQrBp(L=f`2fFF)j_3otZ(?gHV8i$w(cJQm3+{Fx^%}*z1Ekq-R9%pFX zTogo|^5wfi(dRDV++56+CQh8n-4NSo_aWqVX;(1^gXUxBn08W0B30aD9B<_>4Mk;Q z^2R?mA78cMBod-Q>vgdN3r1LMS@-Ajy-qr)@3+qH;&1<{cys7=h*W*Do3sc7R{^N9 z&9EANQY17iy@accz|8cWm`>=9(9&SeFW}cR97Tpwcck~VVlt9AZ6MH+e{ps3z%~R>y zR{6(``Dxm~y9EKeaC9ftW}ult6++o%Kb7(-RZxzy@Sok+@L;Lf4UZtUSsxoGiYuR8 z?x@=HD&AI}BMX~6U~!QFW~Q4t`qU0kkYtn3FinSzuklXvw8S}WJo?- zDTBSY>VXq+h3^w?+@J`Wjl0kZ2W>D;Nn<+U`BC-zo?KR{)StM2yx7mglIlA>&F$Wu z;)&d+#e+Q1(Fhe3((zY-=H`=O*dP@y_*d30s*m6pr|RmxVW+V3+oyo-zXUW{jYSTV)80F@(0&JlgkZ#&&;;BfL1P z=su@F_r5r(%>3CgiX5dS#IidYvdYNU2&7uAvkQ{T^2QJIk!cL(^5szP-QU(=a zi|bxD&`E=i(7X07{b^f>OI^qSBULFOMo@eQM=}=k&0FmrKk-h53?+Ncqa&33gR+qz zp%=A^vy+U@7)ao8zr#06KE^k(7na8G6W_1^$1(-VgYW)p(x7 zme^uom(Wlff)+j3!hPSS*vt9{qPNd3uB;b$X4;*-230hH*(P5ID(t;ajLEAMjm<7b zk;S?*g~8u2kEr;|d$gdoXp1mVvUPSg52mv{)sY_}QDSU_kHpjDymJgltfA=7!tht> z=<4+7v9WrnD5r@D20u$ECwqH-;qy@YRRp`t%QoC#alYI&{D_$51F3qn2mFr7Nyr_g zU}xs1ZibDGPu1I2_xTv1P?qbs-G^u*zwJRK9xi9%8{=tMVSr)MJ~$11=dX#9p0meV z;#YeY0A1NSz?=2PdRPfPB^0QEG}IPGq8ev~XnlEca_g|<=e8UBZYv?;h|4lKZU$q% zDKlLr(SxP5ob;Eg*12pa@d7oCMZy`*3z->ex>lVJ7SA39i%$?P11^B;6tDYD9ZF=E z03fl$leNJ{ z@ZsjX-nTd$?U75SWA;AaAP_ z-JcEc7&CV`^%e5|8_|WzQAOoShgU#~vAF&0Fl&jS-0by#f!wQp8A}+%#+8$waQVqh zYhQ6Jky-q6e#ATNy}a9oayO#JOrTOm5uqn~hMpM0X9qt2bW=@UhNId!aneMp@5kJa zcmtz*uv}yE<(9l1zc-b|KQ=|@>=yloYiSoqfB|*%~{Cb{k5K^ ziMwi50d(r|7LH??Ju#)8o%o9(0V;EaB=byTl-k=&9M-}5F?I7i*5lH4XiXfJoH~xp zKU97_QhShQ^oxDgC(TDA)a#`l3`^y&+!QdW?SDHtm;=g&cT@-&Au8Fhac+90!cfVR zUMLLFH9<0vMRm*}V=i?Y4(4i{nAf8Fr)5IJw&p7{(X;D|gp-O4+70IKDru_$v9n)i zhwEy%j(%h!8Jo{{1|b<=bNG(^#zuv!Z+bM6n${&Z-(&fYSsq#V*2G`{qNQUVFt-L|MJCX;-bAZ5`!lmo?>})e zzM87JL{J&IxERT(1@km?#MhK}TP?8;6sIw0dpHOj$ix<|*H6(Fmg|A7o7#*IgMX zR~t3FL{nPAu!MOW-AD++UAe{JymJ=(u>Vw%AsaXeP8}LVmwl8T7(e#Q^gQ559+*s` zTvPa~~VoEZ(gjs*FgRo8Nk#@jzVzLLI<(+B{#OQEO_T%j}W8UOjZ zXz2QkiK)3@-ouS41+br5(1GCW?XG0pR^sd05R>c%V$xV)BPp8CRN*J;WUQXfP+!^P zvnZ;HF$MNT&0sGX5;l$gVtdLTinSg>(2IFWpe82J69{|kl7c`zYI|pXzUxri2yLdI zrOR}XY?R*VuoS^UxF7+D|Fc9jS|?Q z35|xpaKRU?Hq8ldBU^jrpB3!ND%Xzb-IQYF4;#|99+UvX&yM`tu+5kESGRy$$Z(dE znukCS<�|0Y`l!`4pEjQ0dADHUx`}?Ur&18w? z?*Ui{mHA4Vw6G0^3cHR|ekbZ|o0Kg^`u`)NLgRh8Wtco}Vn~L@oqX6VD~H@pNL9Zu zce3Kc(NO(|^#OQKJ(@Q`o8r1rrcrzrl#Bg(bDw<6+tcG1Lpd-z#~((yi^iz!iSl}X z>QsU{8ZU94Z5`aFYPBzdLu2ZD^5e_*(?-X0k|tn#^AR+lyOw`t)5R#mc?`9v+<#6U z^Ee}1XMAy`DF2Yb&BHedY-vwSLo zVKfJ;`k$3y^SwHssgk~au%=>Jmy$MHN*-zLvpc2Yr`ri8DOEiTWfZ3@2iG|@A?A!) zWnrso;deg2rLH~~23RH=2ZgyjWl`UHw{~vA$+vY1222H(=-HK_R=O>7aQXS2RJH(n zx)Hu+w(CcDdbiRPa{qhfPi=ts_@Q#F-mJVyxNzlqEXr=7%;Ic%ICiFe;6)`}G^wlG zhnqXB%Drtg>pjtmn`K1YS^w4s`seqxNLNKVw}pjd`P$Ry zcHcX}q4poydH<^)4%d-+PVT*~jQw5#Nmox5JTQA;hRV1B)reuftqcHb zn{KIzB8|8As7Hw-Q%h;3u6)qBxTM2YqeS^!N-aBL>p0f`d^w#>4+ecZq)53Qs3x+o z{)=MGv)Rh4yKOq zlbyYm(9xk1o0oT2zLb^YbxIg1Eg)T@sHEK%l%&PDT|d`tN_ck2=umg8m!B!4<2TXq zcvSYi1dwKkjIPY{V!8yT7!*aPzdk^_0xSmJH1@J1##~uz=jba7)1ah_Z@?ua%YJwU zkNEOK&)Mtw&Bgr+uMqfRt}=yqhXx*Uc=vj^lAUQ~S_7_Gc+F}7kK#Y4%P z=p(tdDo`BXb&wiH##*+5tYLXE&s5WrrARDlcc1hNw!& zmg}>_(om()AIcCB1e&3f(Fe^^Mr-Z2%HeFN!y{twWAOEnyN+Z+la{ex?mk!oHRN4t zG9<)fbqm?7<{DQ}2{iN+#XC8bc25bb*r5}ZwwmC=B;B=e9Sf*2N(?_%2ff{#{`j&z zO2~pz)hwWQY z(v{t2X8Z$cmKAyjSh>mW>koDyu% zZL>4pP;KYpHo1(^P+pE2Fn`YVJGi{T#D^Tu&uscK^4VCHqDJ%V`E)JPGNTF1cA;(V zOHFa~}YQpe3al%WJ1~I&HnY_Svgnr@!s){W=Lz$u0HFgYEgTR!yt?-S*ub088^31Rc4tk7yo!p7#=`9?ktAtTtl z9gk>S^vcX-ZQ7aPus%L>>ierF=K1eZ=^YPMb!&{@#{m4>)_)Bfl_8P(aCxH*VsgOY z>)PN%VVY^h*}@&SY*-SazI;lpH|yrWDM=9<2tlj3HH=EyA9MbuCu`R#C10tL<~P*M zs=lRpW7$w>yji@poI?kBU%;;$#v$?Ep5C>`#!Am%_Y!87E-JV?4oVekhfdu2svJY^ zUppvVo__ZZ@h^Uo<~Ol4=G4j@p&833eewvV3OxnYbx4wr(|rLYDc?diQk*>ErWqZv zPnJ*K!oEDI=#t{v?D%Mtf3?SkGj^~@8jjoBoEp=;@bg9m|CP*qWe0{ubUAWI?frw_ zR-T&C&{7#BfHzjfuuWQtO#rxup_$h>%ZW&DcFGIRCc>t_Vvnk-L4mjtN!W?OuIbENjAHF*lLx- zrJPbakC<#O&9Ht0#b0fCZn!O$)JS?ZzBh~d`|n*043{=EEy?4*i!ZBPWx_8Z1H& zfGW8vvKRoZ`|RH0?=_$|EAm?k&>(O(!GImbI4Bx!(hwye4~msHYo1 zC07gFb_Ck}tXd+V{ClxxcVGFm%%94mvp2HnB`0NG2g#BTBP~~>ZvZ3ez0hFd`+ieD zW9rajVDzzy-Jj0}nZRy!P@-~nH+(n47197Tr*q&}d30)g{dj&@zE>`lVQK@Ow)*($ zu(s>8RBgAU=_!C`nhCM5rujv!(8P;Ig>(j@1C<5DtJI$swn?Lp_mB2w`3f~2T1!)m zDQxLji~T8(V!gkRip=R{)@~)wzTG)24tE$aap$jvi}yFR3_8}qNN>*m*QhZ>_)Rjz z2%A(<5B8PmY|*hzlnB^3>aqaeV<*$O;OcriP#=~t>VZ^&C0eTxUGwW#&*t-bnc=?m zrDFrxpf1NP0FHBj1orFxO3MPVRa<(v#hZPavGqf=94&cGx^f1W9W+sZZVUEcGHhDs zr0=jas_E}wME*5+sggDZ0XNaTDtyCB-`NdS=!7-SxY)19D>u1`7VFSE2bbxv!2p3_|^En)-d7DjF(2P2&=?k_Xc$OcA4+hdJbt*VBEJByF7Zm7C=sOtqOxkQ?Z$eMl@eAwPIj z5z+jB1j@903R|&EgOUcra+BWx>T(-Te~q@DoNIC0slHwp@RRhv5U7uG#tfj|uLnvokpT=V?c5sWg^OKi%C%!R9** zOlv_nLsROPKP%7(9YkaQ3_wp!dJ(C|2~Hb&(A)bq8Ug{U$5_ZIWxv{JbAgJQoSt~jPwf+ z!ByuH0ck%|F=>4cD$<=xZ@cZB2C{X0G7GPcoAmEYdVM>k2K$?GQ;Rn@PeyyyS%O?3 zFT`L9HPGn`vDt+%f}uJG2DE5*IwBolmjise2!3kEWls}_Kl!dXMZG9KRx48DpubbC_YKToe4i zwff?o@WxUZ5=tQh^!9cUqv5lSo|FcZpRX3@trJg{+ccuoDVWpdBwsQ~6q-h9k#ZBc zHnvZECK-2uv;DZ0qHkN^H8!xQT)czk=3BA8e6qfkmh$z^S!On=3Yf1|&-}){E}-VY z*S-L=4M>6sW3TswlRlYWMN#oeSmQB1Kesokf!_wTf*IdA4=JN@A`oS|uHI*rBeu|; zf59o@5r0Y*SM*ukY9%&yXPqHXa&$}k_Xpp z-OwMauAP83eG~DO?~!fh#;Fk*y}GH}klT<3+Cfj)?A94ZOCQunJ)dHmaw@bm*V1DC z+5%w|y1RhkFM;8oZm*;tTb5e0H5Rs?rj6l&i9auXt4HkOB=Y`rP}<=`%AK z%CKh5RuihrYE;a7Wn#@u?m9ERejF`lhK+{gSwi(=s;bM+tCPJ-OqHwJNFJm*Rdtcl z|GBVP=EG^9?jgN|CpI-Qi@>DJu%+CphxFdY#w){xV;Xa(%c z&q=AAr9lMFM*gKRFUfY@BxI0!U6@`S0l0;MPVE1mR|JS9@VdS~UCmQkt~QqS=snVA zG}mB;PU$-G0XG}LU>&(w!DyRZKzsE1q(}EXjGsn^d5O%mEMHxBkFSj5u#~uiPe%ZV zoXd}nzr7Azr^=T$bKZ6BNUTl7eil<-cw)JNI8~#L&|Cv z=HaRY99OW=XJ;ElTj=hE@^5PN={^BL-*ar%Bit!?37h%mLt!DomvpJs2PRyRH5<16 ztsK$>KCo46jT`VzF_`=aFwrzErD)prEOJ~`F2G9Hnue79NY9^?{%~{d9=_|&Y0o)^ zstF8$6a{00o*krqwyJ;-VQ|F_Tbp$K(y#pz>g{?llpB?3wm^Y_b4dmvxKFKv5Drb6 zVY+(9*Wv^e-^@&#$^r(7TaP?lO7NL2Hqj+TD60CQHf-UOy?#)8yzxvHS#gbD?v#$%*^}r#n9eY$3M6j16CV*ub@*m)4F$M7gDY50PdFR^g0!jsjT~Rxs@_}0 z)*&_()Y#fhx?tC3;h?8}cD{B#h#$W09nF(M0sY5(WqF z-G&Ymc?!b`iu7FfhO6uRis@~M@)xI{@Jl2?(nEdNFeU(q7~{O>(erW5+i5;0m17*1 zl%UaOrbcBwF#Y!E=p<>?pg2F_jOvF7ISz;FF?YJBcHwNIo*kuMOm5u1*OxN|zWn37 zh?T@c=+)}MJO@beBJ^Qr8v;??p&R)cIVJ?W)R43xp%t1!-_&`Id!mE@U9(Zv?e;y) zy0$p>w<$D-r!t^%U^5X3NkvPk-7*)K;NUCBZUN8&1?Y zx~BdcR}n>5E7*xfxwsK*J1OVVQ0}bj=>{5wQ;rTc=cBH(jBFBo;pmvHuZn9|QHa1a z)Y3#5cX5}wD8L|jzR#{_s=7&B9Ow?`l-`z1f5%PiIVsHtbSWC|)ftk;rz-=>dODQP zBRqTRi8{;p+eK{l+mJ{;>7lgBLpW=_&<}HQ+#1N8)3kJWQZ8AU5sJO+jT#`VUp`&# zIY>D^K5VRWkn(8SLH-gjOOU&@i)HP1(wYxiI zth&T7qIjdZ|KVuHxD+Fz)%?nQk=^MZ;?C{_)*vZ^Nvj_0rXfY;Zhvu+tREK&y+u9w z;$e{*u?h2fgG0O}Z-E!s*OF_qEM*lkg&0%57JZqsjp#X=FF&0x#XPJ;X9xd6uYnME zy~;|uVAGPoM^&2JQU`GaS0dE-C!+*=q$4o)TW(IeWyj|fy>^X8n?BHW3O*h&y{+D` zwXSKCx4Q`Es24s1kewd$swP!$3sEnfAj6b8f=eUOa7MafDnMDpiAj=s8P0HN?>3!x zkd@pFAEl0Y`(c=%M84;t!GP$8sh6iAx}$BzgZ5W@eHNkVeU{Lz5&8k=4)&F&M>@f0 zZmm*6EQ9)oh!CmH+w4V4H5h6uuT;KJeJvE`vYYXjg%Y=Ct#SC{zC*V6eB9%+(|4yj_kLvLc4wqHkoJc*Mih49!N&k{LcUHmArj)~+;;yf*J|3%8# zRAec(vj`NyY?93c_qEcA-Ym6`At3N-bW^V`Wxglfuy?lnoYsh`Hx&N&o{oMVENYy% za!}M{U&d8bk!O0Igi$ll^-w>gCNY8cv>^9c3J|*`)gv)rz|E<0q?RwNWBf%jw#%41 zVjEX?e=`B2Z`&fT1=V!yXVNE0|MbUn`UwKATTd#8I^6y0 zjWZw5)c~F33QM~Bz!O=1;0$F1-Ze_zMU|4(AXLz&>JjApR>1{-HMPP@VN;QC9vyQPm;$gnjVKHfj|zY&J)CKl8$ zqd)I1{x4o4F$lp(4BO6CBVpk(w;O`wi@mA3+q1uFjBv7;@i3f@cE{4sO1Gq%3e-dxvDQ97mzhEUrPhRRewAP#|II zFxi4}lMj&kd9}Q_81vcA$6KgAFyOn6#-V|oV z|3@K74OHuVpweo*t`Jgv#TV~?v<_widx#Z(l*(;nRpfe$*MI= z4PDt^P~3?kPg_(j1d$#o?on|+S{sPMhPX+?^0ZuQ$Ki>;g#7-qO={_#x-uGpkoGPl zr{)A)bk`o@{Q7}3$Kn;ccq~Z&1C1P1;YBBoxqBH{M^6@;KUzTO_QuJ}qh-viFfSc2 z4>q1RTIz}O zTib@Id{bPzPkN~u8V)ZK=w7|~$d|F%-&8SEp4s>|mr~#9q%1yEY0Ae)H*$lJbOyta zn)R~bxq&n+e5UEv@yz)JA!jOIvnSo_o`muFw+yec*(b-7z1dDO_!23c(d`rc)5La@ z{eJGMr|X=w_G^k*M5k4128_7;(gXj|-A;kaZ~6IMJM*;ieyK}^yK81}uqS<4vC19w zc}H@M0)#|q&Dm<6ry@5FPigAc(!xnLj$UoBzFi_k7YwUCdl8eejt~tq%+`_!p3~*x z4GjS2%}~}Ju1=puU$dEm(-;WE>({a1Ka0k=momC4R5T(jTBx0ZF*Hx>;m!T+>N(o) zQeVZ}uO@lO675yMfp(B@|F`}zY;8&WL2qya^}g+^9{X@V2Vj6mj6w+CHswj5)(IUI z@&_}9Rb&=KHGo@N9#Cr2?d+vYfA}N&qv~WG7(2A~E0YllaO}Fz*Xy97Y|&6{(vzwM zerwexuds`59&WWkbWGvxSN-4prnxaRubJ9eD*n-Kdq=3SeIoUG=>M*-ZcsA03$^ft zw$7W7uRTktqxEfi6y(9PQn z(d1L`wmvxODwt9;zVGwV6k;6zQ$vRU;AgR_`Bk3D)Wo@IgXwR|Q!Bce=0W=5-oytjo1FU3wd7aKfSL4@j7VjN5@anmj>6~g3T|Wdy<0%Th+$3?x?LXSX zS^!FGp{o#!tLL052(!^f4Ts8&InCzVZ}0H3)tyS%CkpgRotIVFiJ+*S8gW zLBMYi$2%MbCQh@LuN~%;b(*v`O?)v>Yv0^B-%JbPxanaX;^esG{6sIdj7)1!)M0fU zPAV7&=A7Ip30#%3wN?PHL}?1EoWh5@3Q){`5|!^Aam2HP)dBJ4;^v;;u{bBlQrKP4 z>alfQ2<$b8XdgQ8;E*&n7Q}aAfqQ@1VT@Oxja63m{o8_uUFKKu&&rSwVQc@jwsfh2 zqYntejrI+_lCg#V0!Xf9Nn6=+Ku*DHwba6^uD^n2JMl?|P}WoHDkjuoqKgw|oEWpT zu~0$Ybd5vb4VhZw`So{L@hL6V`EDArKNhGxn5BpmfUv>a{tS#8R&txVq zm?cm9jyxCIOeL8-)@dHf8;P=1t8Zp@Ni)gydd>~Cw0t}6;pMj3=va*jghIqq=^^jg+?L#_7NjqP}lgh+R?)=`5cFt1{%ZPMZlBXfJ9 zb9!z^MkgkxjoSoZ^R}wmdzxmYZx$agpR7-QU&1v9WAE$^RysU!=dJLb@Sd)jh5wih z*~`Y1sc&^1<@pixLKhq%F)QVHLt7Sa+MF3!^v>21bnY^cI2eO(AU02XgOp_{=Q1Me z64<~+v$t+c#uZ4Z#`=cAt>Pg#Gc{hv?un==MED^Of+7SMh9M=00YLBJY1ZC2pYWI%Pgl9mA-&dXgU;6k zc7d8wmdO=wLf;FV&XM1b?#6G<^~^7X8ZJa7^c?A-5m@WU!mRT8I>p()r=U9 zDHNBV69Mi{_I5Uo+e_*6_H{3Va%r5=Jjl~ftTwp~1gW)?Ch{Rd&QK%AYsJ9^gn&RV z@k82k)Vf|fUe|Y@B7C!OxUPqu-yTmWxv@RkkW_`dsSI@1K7TQzNlzfqP<1LWkhSaP zGo%nP3|K?YsC=)jaIf;Ws^y^g&8jxR^jS*{t6))bQcml8)NMaihu@#ofG*u#(~gAY zfPl9cS#|`&VX}M><=n}^1pQ9m#m?TVV37Y}0AoT@kF%~hJ%O*jsn5SeIq0R_4FMe( zA4fRT*7i3LUDh5=K3WL34YsJE>Oo3N

    Ap_twa12E9Iy6k-}B9*lG;d^>gAnKA9G zt7z})#kP;s800i=Zrd{uwY0>JX1iX71W1v^Q|3Ik)SlyxuNXXPGJl?DcA=*#eu%`s zpCP)b78fLP+HsrCf|~v+4Z_!1GWYM22k}zadpx4Ee=OJH-u-^1g>KZ03Zprs)#tj) zxXLBB1Z?j~Xp76Ak7%!mNG%XKROg&uf>wV&THJh!4A)um6}$4B(6x=3&?S|B2bkq@Zd&e%#85TmfnWV1DHauT~mn=p~$1zLM#!lbR6L zBUPfdb0qM{MIvoJN$#+h;&!gP}t}CS6y*kg( zmb66W2i>&!qt&?o68i{3Ir}qie38a=-6Ge$ij{LVcF6bB@Em- zOQgbJtz^u$W&B=W-PizM$b&EVCAP>SUqo)(*#Ru2kIrnK+UIfZ1==CWo|_jWaO1ru zfEIE_7{i%mzZbu@9tBs!k&?e-p9^TA0tY#`nK4lsf(&*Aw8mD%BA6%tp4**@|; zk*N+zM~BB2VI2yf;z5LivFQ6tbSVAd+B_8Z>G!x^FQ~H~xa&KEb)M_Lg{<3`?b@8d zd$(k)9oKan{LR&srtfm-eJOvh56GImd&RG76&XVyN}aTLqIQ^1$gHU+mtkwUCMoeD z7BT`W`Tygc?Y+s%??$i9`TI+!n@n_jSZI3#1v(e4AvpBTLVA+6)Jk$+f9V|&5}@5i zM7}-i#%|F8+LUCoS(5xJqv}be;PE&#d!4nT?*Vvt(UhFu{#+U4Cu8wNVBAa9jL)IY zzr<(__*-%7N8cvxQ=}A((^kXlumQ+4dk}?%0^|aTBl*^SSz7vdG~72`J@yti1t7IE z<$mZ(oUn_Vi@WfmQ$^G@9yK044qdvZ??$m_il=TU`nYTz%)axv@~3H6cd{pfPdMFn ztCux>qkIpDmza_DY{VrVrAC+=XUeLpi@dpzJdn7^Z*qW+%vSWRr|Aa``O-7&Pv=Z2 zypJFwoMVVd59Lm~X+!9Ib`8PYV)^zqyF%H9gU}BR zD=2mEqtw?&zyF=&c#5p+RnD;*rb;{+!^SyGO;F`UTq5q}!=1LnkA019Dkf8q1}w{e z7JWZ;>uTJY!dUpwHVt0|$TYjIjrQ*pUm&TA<{sTYEKWZPynO>=a%u2s{ye_QK@iHf zhY(z57XpX96E;U6>y0$k??S=TYPCEZ#;BJEFk@|abPqe2Lr?sB=`OME&DT21uikh) zIqVh?(h8gTt|3(%aTgf|8l-K@X_bWWQdaJCLW>^7By7&S*tx2Kk|IvHWoLwmFAn#% zb`H2YHIZVrJ4HjD?#^YPB>M)n;j^h-b@u!55R4nk=`vzon036AR1y=DR^rs@j5};AIbI}?xt5>6=eS!!u+82I`AidS7~fvrRjf?LPoXUvi@C++QlOn z7g9}KQX}M(LM-{$!*+Wu8g6o_S1|wDTV2cxDNjCQod~%?gD6y$lZ)#zy^8p_H?ynv z3g<(Y>V@Zf4dlagzh#tVb?W9bUt{=fB)~|MQV653G4zDsdrof{0I(JRA+DOoIPU#5 z^+!ogVe$DL1>IZRL0s8ZafefpUkuj~G4y{nr!i@p7j-t#*<{vRMH5dU{YcNx6CuL1 zdIk$0f>}CV!1hvAmH(#o#W^7Ra(wt6ouf^;miMQl_kSjS*Sa}9xMLX7RmaGNV^eGz zj)`$_6-Qf#THs8#U+f(0j3x)$)4jtGk}ooxCORH5T+`!4RoQq#x!e7ngBORI!N38i zqD568T2#3l9=E8?%89l+Nhkq3l?)h7t1!bQJX|6L%gfrWwK1S-0&@=#+^|uEWX)&j z1Y`r{`cpMOr`R(-je--Ii~ByFE<5UTQCgRV=e)ItZ|W?5i5lo)B@BaynXb?=8|dQp z^dv%l`Czhh+_Dm)sI`XNZBStse>ZQuPI1hn!V3mZ`_)C^FfTxp=i`w@cz*WLk$*tm zZhXAa!F}a%?TMA0P!r(Y9$if(XQ6W2%grMP8!?3PS*UZU|s$dRUG(>g@=U36%M&HN- zj;J8#?wwILmqfC^f6mfZAiI>kBlvv#&m-^<`0sWRAu5Jq-NVlc+-i*CaC%pgm0;P^ z)b{ZB7=ipty`xo~uVL4COsRbOf4 zp&uMul(fbWmU+2#`#(`y*?Z8EnbiAe)*qHWO=VVaIb+&2#?;_mNol?G)EDsjWhev5 ziNsrKE)qx==&*e}dmKS{89PZ3c9z)1Vd%?ErvJ3TrfXihp;Bx}M=&06ybkURi)dzo z#K9B#7O>a>0sV>hky1XzxicKZ48X+Kcg(^X$@d>=DLNZ)O#-S_Q5PjvU;kU zH}*Z=RW4K53!hqS`xihcwGFG-scWM7Eb-h1&YAdEXfc~MfTP^tgr<;3zC`U4K&iOT zJ)HKeI=8(%pj$4v&y~dwI#St{80vP0KoUQzvI>5YfQT#6gU+28bO#zQ)E&RL+a8X% zS917{(pUQNan1u)j|F=4wA_=9F&|z>3K`xR-S;NwVe@V^ng;P4eb8|~Rd%DMHq?9ZJqR)8goAF0*Jd7MWik}){81QTw~%sg*PzO#-~^- zm{k(P9nzj$L+ds2|2z?<|G%X}+eUY6OU6Zx(NfP|5`PKnMbwhJ(e#8^u|)s$r;r^t z_VFx;K6Tl{Wp0WWzWHH!_NaN&IQ!N$N-BLcq|Q-Wht&Ba#Zbv|h#ViTo)O$~3xN)u zqk>PsA;m*^hF3y4M2a{Z;*1Q9hH5zD!RDKA%AD*V-XlowdeFK8?=&t5wRqj=2#nBzAPD<>NC6JV!!KyL@woPslS_ zKpphP2sXYeU`?hq+nsBnw+BCF05x6GRL$DgiCXes;!0prr%F~p<m(dZ1E;AbE?${9Vm+%j8#b6b4y-tLKw5YNYKp9HthUZ`LiEZ;K)3h_ESKV=P)f z^L-K?tM4HXKMM)XXH~N*ch?zGv~(^xj?3BQ%9{^LUNGv)8b7uwX~{XCat6y`&W+RB zNjMj6Cpgmc?ak52bXHFczOL%eB3z~uKxc$X798yr-ka6Q=*n=a#TwUVa__NX0T${~ zNt+$cf;3KNhhxQdN&H2`+_GpvTheoZxV&e^26c)!rkpfg8$oAxKPK3$u(E_%kL}QEK-Me=HyEe%1X}hsjR96R<)ostcv+*nXK2 z8le*s?c|sr@xfG?o8ApZ#Re3~FRSdPmd{7uzS^yUUG7{u!_i)xJ3CYZZz{x@$~m$@ z!q{r_CZoyQc<2N&Hc{P8`s@m@zhLfoPf|(x^?JC9pP25=Y;Yw{dx3Km&S74BucF}d zs6-Seid}ti_P5dJx6IS&r(_8FiZ!lT8?sJT!$|TQ~T_b3I1Fl8H%m6J1L;3wW5s*n#R!@b;Sl zdCOZ#RaLC{+xKkH&R>hmt8v8O(-K8S#q#rnQ@uL(8M#5!InUcwEO!2b8 zyQ_Uo-|0w%c{iGPvNanPW z^v9`Vb`~@#rKA#^%>n%TW|XF|1v`2}u!OOrA77TKe1s;Iup)1Dnk09d>!?=a>OVJ> zYItXmz^r{aHO;3HyHZ_?H^?uiqzR5W7KO*GG)3~#%}Md+s;(*LbhfeK7JY_NZwc0N zDl-CE!VZ=BvFUF`4plbcSJ%9m=_*7>|L1v7xdf7_!@D5SYb#vd=$ET268yKoi1?#n zsC^WW`si+r@+2Tr;>G8<16vMJ7?~*Wk9C>$^ld{j&?U{@x zjS;~Ig!DLSDwhOKU+2wdAN-O+DkiA-HK7G^%ZbTA#MZw@l4y&>y-m{^v{4a|qITX) z;Uc1%A;KtjehyZztqR4B9Rt8ejXMWul1TL_FA z>Q;E1VVsd@m>=J#Zz9tKu8q5iff{;K_2C_ z#ff6vM?Pa8b|RNRzad6{rB*_Q~7Dh4AR{;^Sb*L~+A9cRZ%A z?9}9aEZNmX)90Q_T2!tvEm^emc9jKl5>pNo`gS^-R9?bPqFWu#_U>LZ@%k>E?w5VM za7uCCg^`z%&0Bq{xk z;OcZ5>*CDK1y&{d?9UboB+m0kS0`JWA2M#F`9K@0t;)H287MAT=>6o4cmjug__(^I z9Pb&f>W6o-#+6*NUk$)OYe*9J;LPzE!nl8<_?k2C`HEwBe)btUg_O`J5LjlD7pYpc@AieI>#w1k!AcoG6Q#pHg|;Mf!D9>u zj#7Gmsi1$Lb^k|if^OHqlT`?7gc^kA!j(s^~u0*cFT$yY>Ka9>z1_Pjlxra30 z6x|RWh1o7?ws105uaO={P+)p~Wd?d5Nu|G@LxnZcyPw@#Y0KKml)h0&4ksC`$v63R zNlXg8#hK**bqVKQ1belyO4nvFN>y!@+cKOOFLIfjZOvNam}}100kC@5smEmThZ5_+ zKL|H}#Fnt&NO!Y#_IT*l$@wvhWq{k-3R=-R126BH3mWcB zBpv2w?BXv!MjN3KwqAA7^S!2%9LNBqOakA`hmQI)k_WIFYMoOh0ku~#XxaP*n3Hx_lpba=eCVC{wdJx?>evZ zyOWMjh}I;JOGp!xl&w$)?6e;U0<=F~s zj?PR;+Pvyxr))M3TIsEdNOOSom!F75f(mq*eej?#?toT3%7CB!1@-n($Arb_^Sgp& zOlYtL6Dm4!J)MdW&<;3VPi|avjtnEB^dvUbyLh1Dw=`=0qy* zrx$1Hj?YqNn=*hRQFD6D3rk;BE=vc|;4$3-vXwWd zpF1_?H8z}*L8row4g<9ytKkR^w-ctkD&$BYF~Vhmn%4_-i3~%FSvvjx>?a}oWd}~6VEQp*^h=T%Xe%vFqgz2Iuzk=!hvDX~zdo1DRu&yIR&+e?wh}3in|qN^ zw7HEvzqxZ@o|^Xq`1y=j6HX1^;q2i`L;t2GZD|Hip%6HHAY0E35Y>kwH15MUeP$vr zdmTQbQaI=|DlKmYM3E-k8$e*wgDi7DY=CEB?VPFU^X;N{$%)5*>OIJE(8JuI>-6#t zK@jKOAxxTvO#yY}G}^{)(jy$kW3GrDGsTbL`taeIKG?F`ZU#EtX;fg5<<^t4d zsco%4pbEeZY(lp^ARnvyYo{dOJNMd3?Bdtsf!EE!*nrK)y(Xt9e;u7Xp`jE9b9sCE zb^ENWih^4Au*2o++!6E=CVsU}EvHIFC&j@-VMs9uwcA+w8W4P>m=i#RX;4kHaua&~i{v(4u z@8Dfqc?>2*o=2m@Gy!(H+YXjO7SJp4v;9(05be3H(iS@w5(DP4U&5}XIXxpG*F z(cjbrW0AH|D=#o{yH)LL;nqhwP4*A!hJ=o$KeUR20Z(-ymVN8$X1)m1hDh?|IS7(2Kf)7Y=6o6|K!jJw5d z%U6W0Q?z!LH;R4x>{2+Rr=iSnl1r5_r_O!s;p+VTLIws^A4~Pzf7LEMcN6HsH)rql zs-S%qQ0lfy4#n1WHRCB0C9)RV@}*OqdhwayF-#?T;%4ch|6POI1_D8GqU**|W$eCy z0-c%erASTNuYIR_E_vg$>ooP#=wyEA#&}@`J@}f4*9;z59 zW71M59ShT7F}&!5g$_S*pP3UE6d1HHgs6s{j5a2sUWTehaIVP$y99HuIN7)Q6z~vE zt-Cc{3clTrr%JQR+9uv`(Sg<+t!5anQA0wvd(sQE;Jbv z6E4mlAR=iTv6?p5KZA9Yg@Z2+yOlv1v&m75Ms{xSP|nxhl(<^cKIPJJi&MD5aZB^R zI+N|DBquA&d>i!B54HtQNE{=RP^LVpfvnISu=0+RhTGz~l!9eV9H`}E=V{_6Uh(YISkP~UtCJRz#5QthDe9BaTr1~$MzuC7K0vLk{b58FZu z^Dsz)u31|_t%kS?f){FJ_9&!;J~8w|IxFoi&toPYYqjn)@I8Klj%*!IUYf&G_=n9N z83g(9?DpfpC>{+|&bsGx?@rMVXGb20GpJvm)xKfm7^#7ORa$#8nJ0CHw#F;95i0t?&6#a$i>XN0{q@j<0hp`R9H+IdOA5RAM?~+qwZF_*Emv%ZwCWV zl6}Htw^|spicICku zR2!=M{O{%E-wWcuGdprI4rEOM42!ePggHR)XR6bca-II(|B)@tJ+%Q3Ez~zy z{6XUj-GHMCGNNnJlguv%`Q?R_QhuH>s*_>5Q(U=VEh_F?uR&U;>rryQLYWd5Eq!sV%1+(@@(uBC%?K7!^N#65gx~P27@n~E0U``$HWci@=gD(Vj;^IuUCNaS~ zw+l^Dyv$9^B7OCGW#x}V8gB`s&FmXCbm*D{>Te@~>CQo?ajiAX?zs*yO^GgvZvUlk zThg`xo3px?`0#FJ9Ie&%+f79%|3wgosQ#os_PQKNGKSb$;ks)*)oF^+yT8ont0B#u zm;%#hb~u{99PPfV=FJL~nX>~Uo6kc}oj!j)`Lmi85erX9e7cvMEB7@} zKzrmsQbn|7?Y#=V&_*(Z0X!@j$Iu`btpkEuLMQL|c+-NP)-+FZK1j4iF_(l&Y-fDnQ$c_HMsawK_xn zyS{t`*W*5HzoCP4!s53d1rE%w44Y{ZN8^1(SDjhb%QJ4JD{_gzeG|#5e=)z>ld$c_ z8$#|5_-{odZZVrwhYLa_W7`!&`AH*(uL0ddkxgzc>G1RMD}Jr;;qmPFylrlysCxNi zv=i&vdp@N8hid7aX&f0*vsM#W4)Izd6@{F1ZOwKYVARnO#D>&E)LLXAzUw3^QG>!( z8UH7EF}%Ya|7kh0R#grdZ4!A$$}qprnp(;6!Bnmeh4N()rC0FLQ-sGA);5p zm=ylq*rYd4UgTOjfGOK&gSM8MVFe`X+PSXB_rIpK{Or$NO`ZX6NFkLMbHti1bdjV` z%7szfmr+}976H_ysAjjqwl`Af6*0O)FjX+4(c!KioxDrSNq}(~73KD6^^)-f9{*8- zioe8&ZQ*8FQMAeTYA{^J6UY&NUrmV!N2!9mrVRo$nF&&NgeCC9&P5=rI6?!DwIvG~ zZWov-+xdq_{AIrrQ0z0|k)*=b&L4la*5rPGZu>D!C~pz7rrU-H&!;bDnR@8GU*u7- z;S!WDk=NDt1@!Wb^y;npA0|hD7^fluxxJjcd8>Xv&zuiu7>&PEy2Zqkd1%P5z(D7e zMDjfxCVG^kIDE2ga!EfTKtQXKl*T!E;V^&G@Bm3#GtR#Xm%3E2y|L^ z=Y%=$i%SR&+Wsx>stU2}!S6X}^6Ag`FEj8869a=LCk0y{8eZZOpvf?LK{xexP6AF2 z0P3Fw<2oEy4(-bH62XMkZ{+I&4$hd(UoNQ zQcjdi*?f0i)?XO~BHA(??+M89>aV3<1XWk})I!kMKMIgnKHAi{?axIiZlRVBk<(y8 zTbIeej9;qaVjJ%BVBVCWf4;aLPs;>%(01D@Z;FYJr)sF{hE_ooI;QPmcRl@!w+%@7#9u;l?husF_SFfVkg4_K9s*VR^Pq+V=&$yBUQ0bTcmw5~ zzRquzXnI{qt0cqCn7vXQmSrnVXZz#b`lj_;_ii+OK0{!aBwmlIk`MXG`!5IES?z|@?*O~AF57vR#Tk@*c!63wc$jPfy)&~kpe8ed-~LFrGh#k;@0e{+`t zNdU>YKd-)2=RPd{l1##^xmW=JYZsF;e&NI!xSotv1t|(astWY>B}3(x+llkT(Hdu# znw12zt)(nF5eXlP_Ijnuw&@A_BPCnI39l;6#puPKTgM9R_8-fj>k8-9Y_R>A0$6yA z2)X$s-M-{Qv=4WJx|uI-0w;zXxpUbs>@r-x4#x)XKu2R4cC_|$2$zAETtlX;^FhKN zxYm5hHM)m3TP&cR`&i~Qy0qQC>^;c?ZMg=wv=NzeNmj)#@yf%@UlCGZ8#$)cJ#&aF zu@m{INhUq4j>FfdD1C{-#5+GH$d3;z#3is1N_by$)2lWF=y2S{L|nt!;q&=Oulf;x z^U(#&nzqzh#H0sbxS7fF z`&td5Z_pYLaTxZWrpKIrk=uJ>mwb{pATme-ajDhlOBus=5{3g_G+)G08R{3(hhCF5 z|Gk0q4Yq`@-$p=YMjX2r|QwW~wK^mwwu-}1G` z<*!`*a8)&5Nnc~70}~Aq+7Iw1qWPkB-Xs*a3oxmI#m(U&<8$Ak52C|p!aLPF(xYNvI%N1p3+f0rK3YG-pbqt z3N2ag-;0`VKf>duD{pYsTtUphE`saZg*t>$5$F%$S>O(p@;;hRd$vZ*1;@(BdY6~q zrMv=ZEz}qEEeaGoT;JiI_gaTe54f~=xThc*+;CqzpPu`VB^IkO>A)K;0&rq6<5i4) zZFX=Fzo5l|0}!l?KUu9?Tbj0T_26l&bjZP_Ag-^fjd^B$O1|yv?N5*ft$=8FmV`e} zP*5f2)r7P6g0kfk7NV{a`s2ZZf=vcLc-5WaQ>_}z8EEUPAy#RKbWwP8q`F7%86k2J z&i#zFK*+mT@8Q*~@6Te6uGw|(wtfDh3y{vq1h^OWvvE4rNKAejOT!^rG(Vh!oH0b3 z)7OLhM@hWy%B-UU1h8UyRUjPBWL#Tcwblwa1rPRU^!o5HkI$8a0mp&cV`T1Qtw^uH zA-2c|xQ#!TpX1VBu6%P?scr zrbl!FD16ZKZ>YY2a@9XJC0j>VZ*iFA-O`*AB#H}I&0G+AD23gtn~ST|7$>4zIcu~> zM?QL%2I3xiVYXSFgnr%PasD{^<8$iPJFlQmT7w^q%Q$z!`pjS#KIA*t&N01H31kfq(l1b}O%huUDbj)&ug@?370H1ev z=~C({m93EqX-=Uka#J(9h!2?X!)R}Nw5gJ@F+799`6*)Ifn z(YHs>k1NlDwaf>m^H=?g?Ay?A2A?e9akOY$o>MuSJQkw_<75fW%C396p4Q8fE!X$P zY&&oL+W2%#j^gD{V1SkX-qbV{Clv?JPhO0EKhbvqY@S@>t~nQ7fQO)@voh_T_uFF!@8@KPW6Zsv}hyg7S7{W&#lb?{}hKV;F(8Rm9*Ut? z^t+Oj=v_v1u^QAsXA4myMy1JWLVeXeCz>MqjXBjx-_PRX@JMBD>Adm=o)%i1wo_+i z20Q1<%R;u}!}*Kp@eAF7+rk7Ol5|7LiRYY)136L==Q&1|nFhjBZaO-eoxaH?V6?=()b9)~m?Wjf*F7HN?PYa3SlZy9^m?{;E5nQGpOK|+?&B)*MAXA3 ztg^bEO3e~JTw@;9%ia}!`6**qQpsE3Z-8pylhMOD$|7SlS( zkSOxKroIgyY^_Up3}oF9kZVN#RqXN~x{!rJ+DCHfs5bdyXX0G$WXKT%8+^ArxA^oz zYt8_(n}(x9>F@L)bWc_$O;W>;>j+<2thFqk50KgaLgHzyS-YQ2=TyPSKfx(%318!S z?GZ9Su|0z<17BZ&Q=T2Q)n_D{u2G{?BdBOoTpt??{Hab2Peab?yuOZYfbaV{?6pc| zr0y~S+A=VaV~hw9H-Q#DDC=UWC792z8bHBvph1QS>V8t+xwY}+*dW*LVRZQ7`ENI# zZ3cArC@nWMWX8T?+m{K|OA~S86E%mdf38)|B2L-4K}ypmz*3Lz8H>=R3!zh2>bKsDbhRDf znI$Fc5M}3Rx7YAbyrxrBi1FEd-}IWuVCSL*WYJ)!SNz*frZUV(g|8GtW}$wjS{oll zOP)$SU{>dhbT6xB2@m}DS?Ii(c2WJ9c}6JbG|b4IBr5l-EJ=_9DAC2jmR)=;QFXc^ zw{DQ%1GbgaS=?NGUfx_@Ij-kd2(`(Va~vvPzS1iJL)8y#Rl#A=JJ-W0lt!e=wb^hs zQFCLcxqqxskO6-Fk5#_AJDDS0*ALuT5;df8k`Oq$Cj}e{X!?VLvLxi!o_SyCsUo(U zPxqr2=gT)KqzF07CBm|9x*UJ4sBkWOG*o|wM!d?aT_P)3RrdqEwcsDc(;0WyGulOaM%SEUAHJ@`}3k&uxY(a;_Vb z@w`)W)Uhb7&_%v{s#uy6Qook|^tPcgb7Oo36Ej!q4ahK$&!NsyjSZ_T2)8Z%$K>Gk znq$yC`;R}R`eE`uyt-f$(KXNvCL(k%e+)~0AL3G)dQ5f_O2&4DdbPOFXSjFWDZQ18 zfDfYapG>{A}Qw>TT6-a~XuqtHA(#o_T2IgKk}+sCwc-2ZRdQ{eDeX@(Cfg*j@kALst*N(Cmw8gjvU}}gSs)w zu#2S5Vd|G>AK-u8cC)(4nU=L2PsCxo>72ueLfljxQPadFXjs2@DP3iK;;66mJpOHuty%JOgeP%TAQ%3GA_AK8?7IDU`oO{ebmx)bo!rXI z6+}@3K>Iuemp<$*m52=#>jl%jGu%Bo@hS0r_)QE&YmV?`>>ZAtsM;i(7OjRB(QDZ? z7phm4kV7%xnu>{K=?f<{DdvqI&S*j{6lU|2t(~h^qgS)d7l&KM9laRs?5k&(9AkU! zPL7Xua_kV|9MhcToy)(0_xGpwABE~VB-AF}LA@d69HPmmyc29fgy0b+n66t*a6WNP zB37RuEH1j8!WawP!3oN?dXJ2QT;jNH7BQl2Zmnlj{TIG1hKJ_Rh~*qy=c`IaM=xeu zLbi=;nkl4=74bg1c$|Z3QIGVR=Bp8Oq(s;o^gE10OYwGQ74VR-;n1$y>$E!(kqRTd09po;?~*HRx)E znip>KAwdkoeVIqHGJ zffBW{elm{ylBhWF-@4^4buZ5@j@}YcVc!P5Z`8FsKt~Jig=P2U`X6!V*EQuzPbz1aO(!qO$=2avCTb3a z07yezV`CbWAFh#xa$9D7=2VbSlyoYm%N9=_%;%_5iTvC;b!pro_rKTp zWXw(xjyo=*us>aaSN_wgwxU4kD5@4xu0a~&xu4n_ruTZlFD7!4dH@p@uNe`yZ&0vM z=0FRdm5pKAqF|Ws+OtLD6zy>SlEtr@kAh8F;cXa+>xqfYLQa*C)`zyt)ZYAXiwj!eM$-`5G~?El{H8qemI{_oAJJ{ej~|90Muj{YNkMEZs% zwQ$sX*aL^NF*)NU>g5%aAD_G;(bfUgTw_#>Bjtqg(n>w@PlO7TYsZ5kweONpYUpRP zr8zhduPBTDV~5V1mWCqfCSl)=l2*HNa!7gmI>m2$562N6ZW z^-EunP{bW60JTH(x}5;p@&m$lp1i#h-*ru*#eK=eq3^~IY3(6=RJLQ1{!>L6X)&c& zL7XqnZUy$O7KATo`i8ACk7n5g>CBK$x%XWtRR>R(6&aPYTm2vuf=3dD%-eK-I#~k< z^TS4Aq}S{<>2H2$l|f6o0r*3L)nerfqm`zqLioysjt3d^so{rGU(vaxxsY}uFq?OQ z*;XeRtSCj4Ts;UHxl^0&su=BBlkq^Eu8{9tAs~MIFAK48eszVlR4$IjW`4ENdmG_k z^zF{Z{4m&Pz6Jbf^-po^3Q}mnbF)#=okUr?r`r!nmOfW}*&HQtdqxIdi}vnO})$F-*m*WW+i_66gU#qifR~Lt;4a18=9rt%e8&gfTj`gag0g61}_QDI9R9eev*r7X#dx=h zmb_|qZu{#^XLz*3~Ci~3$XmpnP-I5@P8% z)q3Ii%f6mjjzYKGaaIW|BMH<~b|c>X8%pL&?;TOtzvq~a! zB}{^{H*TMaeThEz(&;qycC4?Nn}8bykuF`5M)|IXhT;-n@w5 zUzfiWw0yRygLUvGck|WcAY`ilW0_SVO54rcE#xX&V2i)-StgMqn_lAU1g?lt~)^ckpYr@QM$}oh$Lk^gLM1hboS@05+>&{^_d#p>Pk3A#FlCqJhCA^fK0CJD)Vb% z-}!AVs*sj*=lC+lEAO|SCmp359(TDiW1LvW4o{|=zy7UmDbeHt(o`t!8mIh6Z<7%o z?EePB@8y$HpKX|py`ga?1=c!dZwsFrZZ)a%S36tNm7TgzVpCu6xD$=(W0d+p!uTB= zWWbv;476x@?n@*SQL~n+s)EwN{uG(ROE1q5J1|75z&0Hudv2Q?|D z=dIu{5rs&Tc^kK5N*K7fe$6nF^4;cVS1{~$9UHgv8o#!DiDtkf<9QUptA2MH=D%Qo zV9MDNWT~FwvXBDo3pZeH4xlVnxAeWuZEKGr7UkB2Y_qA(@+Uec0gF-jOAPAVLwn?E z+@aR!$C&=|1I|8uunM%&r{Y)O8_};XHAAX=eV4Q>GZLx-Gnn-QKjnSiJ_2+b-4g!* zyYFx|+dUlb_5!F@QHnS>(5PNx6PfumiTk8!yOsN<(W`pt`ljB@T(_*6{7ZkautGhK zwVnyGZnGl$i+{3q!d9#OyO1q%Zbj2NtrcE=d&=`EkBt$ulD?fBt;nwZ3`8%xbfTI5 z=q6*pbD)G9c4+&^tnuyihpa{nK+I&Ry`4%tZqB1>FhBZLF<7sIRv_fqlC^=&LX_$t z)kes7Jwq7tC>S zNG{f^&xR#cuj4$ext0(6cD6k^sa4W4q^)sOhKwA%&pLO?z|Z^)Q)yjqCU1|^-_L8I zn(KdTnBgFvWtusI@htKXYe@U!s)P>nbrtiNowSJ8H^=iP1fe?ptNvR>HIj+xqBmD> ziy41CMxxE|9-!Wq>w_U76xE>le$IWKr>0v+EavOyE=1|(iXNEu(YjUnw1@YFy2);R zXwklJbG@(ru@iU|my4U5wfF5?kJNfp>aUbz_0jvHFzuj!u(s}brq3O%HZFMN0|9{l zUx&THGDF319NM+aYVJy#2=IJ!TK#una!_C3nJEhcK)3Au2J0CAw-GAqxk}6TKv3Jl zsDXD&EQ#|z0hC(8dMb&Ce^qeTwH)9+RUHw8Tiuty;~}A4R<$i*iee%(X#2tb^N`+P zQ8K?YA@6e$Q)|v=OtXOI-^s|M(#-xty|5I6X-zIYO^}l2)G_qwJPby-u|7+r0&a2V zXN#ugr6Q;oi~CQwJ|bw|YO$Wzw)lJDNmG||biq_=aXM|Z8i@8Z@ojRI<9Ri?ajrxR zd7=5je&y`%pui>DN8^AZGhn^2;|xQ5d~%c~NPq(0X`1Nl2J7`JXLa^ejDC z3)VUwS2t!$luUP;S<_Q28EeQbgMciwz{&!Guv6uJIHnmp5d$A{*(a$e`#bK~<(s?n z>`4lc=-e~>pyVDL*4QMzJ{M~LB-ulsNL5*-jZ+yS1=Z{97Vz?(Bz*d#rh2qHYNs7e zi%oj|K44b{qcvocoeu0S*3mcU6 zZrOrVy2z|9GCoQ~WnAZ1jh9+iDrGQa=EVXT<_6f~AKK=vu0h(q9!8a?RsUSGJW1dn z8BbYJXwp=jVXscPx2S&{0C0!W%%CWLxhaF7yN_suoshBjM;vNBwc#=lvC}{s7a=o? zWzq!t!@oHD8Or(q6@_+CppkSF4pNj#8@1Dsn+?SD`^mx1;2S~!`G(un#%#PlJ>ESz zE|ht_!UeYH>?XPD8deR^>|<(2`F+n^hHt>Y52&2R!p+t}e?EyIhIbHUG^8UP_L~ul6a@G&w(y zMM~ViAy?!l&kb4puuw60ba;H+#iOctzi&a-=nz~@6;^q`r0XUiFa`{8b8!$BMzM(3 zve@7m!yl@nz+~XM6DWtDQ8EcBc{_hY0T`>h-0bbL{ARfTL=x_HM>Enc`~7$|z2qM^ z2=^Wx0QG;XM@im#@(EooHF&-Ds{t&p7njP9`@{&1&e3{60tdt`sPMO!a-IJ5$`HSY zK)cZv(T&o|)=jFmpqWGtveA=s25o5Ikc4d1@4ydj2lGrewyLRD*_Nlm z56U;8VR{CA1Y&fGxo%ocyj=K_SrDJ-V1e@|gowM? zGi2(dYKv0Tz=gHYt4yJ!SI8|5a?7eq(*7!q)cCnw zTuGxC5y>;sWF_e&zX@C9pz_9fJq~sQ)4G4QEJGeZ1V%pkiP;BF2rf3TX?-XP*s zcj}~rk^{qAj0A7rshUZL$o0Y5mpmDSsAWHE*B#oK&LfYF@WoX|*xfzV%HCq~Fo-tLOb)8N zLM0}ayz}&jC}S<6Y*A;z`u0mO&G@48#b0o~a$VAXK&4&YPt=Cgd35yRgn%EwSVeXE zlQ~>A^&z~kb`>9*o!y5{^B0lt+sp9i&@4YkdzyjuR-g8v!ZAaAwt5N=QXluC3~x)z zYHWa^Au?O9N%~?8LefpL{Z%nKjTayW!S?$GCGs^Rc^EB(r_bh^`Hbw!8k)X62Sm8 zj}~bI^7e`_C-pB#YY)aE;EC)*u+Q$Vg)Z?+tGC3BZbo*ddseZGnO}{z#0luSiA=QB z(r=o5ImSfo|J_{~{_6qO7&47jvyuM4kDHrhT>u#I_u}pq+jB>YlNW+R3O|d16vLA& za(GBnr|SkFGHpeK;)Fi+ziSPtWUkUFrhg2H9AKFmcYa0bC~Oc1oWe}=^K~z=L$UKd znnev)4Ie1OX8nKMNT)wTMx(EPt1;ySxf$ zhwKxIh=>NWmGU(0^1a&4+^`XLNSTJDoLvu$fh?mp)YkZlp2r>N9N7z!szjU2y*j&o zcN^uuotN}XG{F6A`R(o9jRbh3%y-dDT+9FkF3Et}6!6N_&MRo_UX?qDR@r}hQTnD{ zeVQYsqu=D^b~;j6d`Pwhp-lApjF%_|Q83?mG0G`s~hrS+|N zlMH!AW0|qneq9{C!v%sStYuT&tNg)!nsZM)Oi3wA)F8TXR0V# z1SvVv4zC^`0atR5CB1$5#Nd}TbB#gayLGO4$WBAOoY`SC@}?xI=7B3C-b}A|m9!O~ za&}sMFVcdev&(6?YuVGMdR`HkCUgoX7*It3l+wFa09KKlo>EqX6W}*WIAdfxOjzz| zm1hr|xgJFj4?ldX8qxgW3gD^cm1qGqo96xUFEX+gNlQplox^jaMRLzS=^E~4u%|ww z8NbwpP<}M^dh}t>l2X9*6ZU|V5HWbgi9ObR-XhEl6-^rzO9L9tShG^MY~E?%VIlIo zoD%cn`ULvG=m4;kLW2&Q;K*?7j}|;wYL*LDj%f9E!b~8RUv#}eMDsISPY(S*xB>g8 zcg9WHN(<`T|MGzsaryD?JO2j9O6H%mK^9}%_EwiA1~K>I7nlNJEXgp)zT5S@9Q-R> zbj_+bR+`P|`xGSUYcel{p2ptn5QJt?T!Gfz-Z_?{8JtruI!)1!t*4+&RFi<_yMh$S zJ|%y>AR%3#XL2|o5)O5CEhzH)O}t3DyxM4Qa`4A=HtRntP3Zh75)5D$u?u0`L8?9! z1s+9sIkS#wwU@WIcF2o*jizJF#*A*ixqW+fcU$CFxFhnaQSVIfb+@V@du=MwZ>^8?U$cf)pq0Sv9 z>6=%hZ+9m?E6p!4QK2jPC5>FeW`HEitgU7-_^DqLeHQVe}Ra-VNU50*(BtBmJ?MI=<8z0U4PtEs&pIp8fZ6j_`js#}aJ(gYyBq7iOEMu#%9b41(xj zmdZVSxH`=|s=I0+9sDpgUYT#02c=(rrEzdhSFXd)Im$|J?ydR|Ebrc3-(B3v74Meo zhDY#2T>G{!d^a@JVs9n4=ni5LWkV=IE{KD&!D7WW-la`*=Nv;T<8!CV3LPa(nV!9^ z6hcGw7Xu)|jdmV)6=AeChWIX5h;-1A`k80$*L?Dj?LMuLxtgbOG(CPEk4$w-Uvk(G zzRnmFs(1I-;$yJBlE@E$sgC*mF~8Q)mfb8jYf~BaQS*XZdKM_u94_y>i_i%&F!WPo zheC3DtZXtkJwKTJ8>Bk#$~q+(9O6~%&G|ZuJurzB{{D1ZOdx^Pp#$QwH2%5%bi!XN zUYBY)iFq-D0XUQ6o$YCxTZdOdtM5c<@Mu!TT-xJdnIno0bj8w4bQC+!ZYjXz=txVG zTSyy*eva{bnCa2=0}_C~YUv5MJ$XIuQc3-j`=Ye>TKo+X8E-x$tqW=4dJ6)tB23Nu z0tMRL!&8B6R*9{Nz0WN`a?{~r^Tm_Rb1-?7V;7?hzMw{m{Bu4YdI;3vT#7jMxdCp~ z8OuckmsxL63$ROYu>+IA%WuQhFb{bNyR$7|M2j|!NixNO_HVaf$tEe~rL%`>?89*A z`o`~mfv=x?7bSqWKZ#3KwuOmGM^uFnI-DorjrJzM(-Vi*x~M%<)AB01_&CSUr~i4p zN6lWIKKX9c(k~B-({!d%GF$yp_`t{ov2h*I(KrXRajw=QfWO(VTva{FIej6EPP<)x z%wXFpzuvyLB^n4{{{4(A%xx4geD zjBYV*{cLA`e5fF6Rtq1Y8T`L`l>F=;)4jdPFae;up&x%?U7%qnpNqidUh{dcinLTx zFlOCOn3o)09PwB8tP`i}UlN$m31j%2Gz=li7uQehB>a=5*S_n6vk3a{Hj$ByVU#~b& zcBXRUyUY8(TGqW%^l7C$EdMv&tob3|_|DIj2!DQfJU8rZ-YXZO66m<2B-NQ7&nlS} z=`FrU;^o6z4UA}%HLJ5$tkiB%R;JnX%F#7%r%NH#Jkz1y`&ufmz8Sk!au68+{ykh@ zJ$#VmSjIWbGzQ++=KN%`H`;kJe-c^F5@?npm?0>sk$KCSciWmTq!;+RtBiEakPlc^ zGBHh=N}b2=>3l>-rHkegHQK7w=)}bjyewFZ#kX)dwpiiPv1&}w*o&~+^xGW zAmqcK#3W*h`SlrJ;PP#AM%RFX@g&gSdHsM>sLM@1LzSKacXAK(Bzk+67=;Td80qoz zrh6an6FFz`9n&3U?1A%Pp`4xOJ;it=lc4_)RN+VveVyhbogb^WhDxN^^R#R`O*KoE zRqx%Gkl}nyH{_(uWxT;@~dBjmR-Oy{W=!6;}?k1 z*~+k|Iim-M^I-!rCioFWgau5M;Ot)V2sU?`${RS z`D}Az>RrI3zcx2CNSl8rX8(AX37_=(1}BY5%e|S;h9J;OQ0anzfQjTRcb_`beo_*n zTcp>M@$Uy4<5o6hrsh*7b2dk}&;L#~HwBfsu$6@wZU1>x?MYu99@hh?7Z4pk-_Gql z3++DU@QMXtOYEOu=bwPh`z_fS*CBsyb`1%B3Gp5K1?w<}bLGqqx~s>9atEphlGi+G zN&n>6+>qji{I<09FQYSLkF=a!1ma!=N`Pd6<<3FD4v_#pkA>Wt$vL(15mBsjdVQvG z%GrDEit=mbVe)VKwwQ;a;3B^E$GgsvJymA$dh&c{<2XBn`^aw10@mEs2cDU8J$k-z zkY9C+V)CsQ2jh+HBg-8$z55Pns&b!+bi%|b&fa9>KeGbEh*` z+Bw#Hw>CQBn^v)>XI-UvYHiNiD*UQ&b|4DWL8pdHZW%gI)I|-648(kSzZffHydAfm zV&kqZV%(X2DNJ42Sy7*W0~9y5ewRu&9(v9uXG<51&n=n z`(dJZx!|2_jeP8EJL2LG!TiQ%)+!2u4omuEgP#$d#soNqzwaFUQGcZW*XHUEd)WUG zv^z&Nw7pzY%2~U^&32SCW$HNHGdPsG{lWg2k+bXk98X^8yL0S-9ZcqWF4u5vTgZD% zi}vS~cRcqS8`V=XbD0~{qSpjFGHO#^O*b~i&oyrDTPM0Ls=S?53)4MCFqGr1jURe> z2|lyE_P=i{@2OQ{Lfy^QAgq!rTW!GssCIxY4QulJH1Sc z_&5n@de%l)P2gEO7}g;zytc85Hk)>^8|Y^@Te5> zn1%SW_CF8J7CzrxNu`>AB*NdEhT^kQu-#>nc|9uf#WNAOvv9#mF4jI5aJVmQo`8;4 z`&x^Y=;n{pG=8+)e3D2fn+mZ|W4N zTqrX+HV;*SZO+H-D~Zk%f*v@41}Hqw~}5k_f~i`pNu7 z`#TL#jt~EQd|}ZlE4Q~bez`MqM7vL>MuDCrmYenEr_UniJAaU}{v$NdF-GP*Ayh|u zjz-aVn2&l>!}YpDO@R*5Nr^V6gyQO+JXnvdG>RDHs`AG)6ZvwMm3MkGX6!mc^{Xe{ z8OOQYUl&*|t`v569wO2prOCl~GPjemVqfed(V@jB)1BS~;6qm7+1Wqi(%M-7els?g zDqyHm+zI|^^L+|@?0ll~L-ZC>PPhCh%abpv<6ulTlfv`wXAt1|*y=XbgkjIOkE2oA zv@4C}wTY2`zxse5nbB?C?(sOP+vlUou6SK*nw|kUSZaQj^4{hj_g#Gbel@RuJ=u(; z|De1JyaQpB$-aH0TQR)c<@Ss5OvW1$kzBKb z*@-2oAJtP%U2nS?Vo1jt*K*=h*1}0@)ejHF0%}usgV;iC9ac))d6sz zkkmZRc>a2GdfYTVh7ElYzkFO^Q@^Sa+pP0=;t z4KN}$8B3{}C-(0?C34k4^nKk+f53l5-(nEnFIErR87A*=pU!TfP2){x+pb)%zQs}5 zzB_+6Zt{Kk#WgMA!2+_YGWiTi@Qo)|gFRP4a*3 z1-kszlvC1&SWjVM8;A2*Oh@~~)9<_gHu375>!-nMXPXrwKFi>vEmaoWNc}qHXy3hS z-?1k1qwbd+RL*#N-3dK_z?QGFa|~bEZ2l1dW3?I{FsJ??-XKP8^MdioN5ha6&gk?3d%m&WF&(0&H%!N6UcsAroWD_>PaK zTVvxKT0p1xkXAW9>TWc(Mf+C|iwca}{SnL5f)~e{1xx-*QN?WXQorsNkc7^CGAZv5 zfrO(t@!Sb+asg%AP_JtQWHo?{djBY3{?V(+)^xldB{ufJTb-Mc-ssOa_M0tt3F;=) z66e2p6~(pYe(V)?2)WDVAMI>yjT6jn)>cSAC?iQnEH|G2>qAuzE0H3@d7{a|_TgUJ zy0E>r=35kQTP{<3MlUCOCm{8$wk>Avq?6aFa?sQ9;wI0AaSiC5bXOp&2M0%OSAVo` z8%nJi-tqID1K|8l^X~Oa<0x&M@cLarK_)U^4Ivqpi_C5AysXl`>^Nb#S^o1mKNsum zcoqIOqBGKOY`XgeUTU>1e3jX)7B&V2MwEC|EclDSjY%EHLsh^O zav^$_eo<%_S_2s?SUtEZ36X>V$D`04U^W7Mc@B2m4Qwx@25}WGm;WSyuAO6He(OT- zWB%IZoyX}-e*a)T^W&(>J5h`mZ^`@H?kyUfA=uwsJ2M#%P>qHe!Le4e&0%$kG_E;6 zU(7WdT3r}sxna$#%iQ?KvC-FS?_ohqw`^>Lpp7t7Z^&NJ z%e(85s*7U)0A@zew7#As9Ui!xtt!MHbuHc!ua|Q=p6F^Ym{rFQe~pFVvp2`4J-Dfa zjs#!ruojxL%SaCA7aNduZx&X76F-n5o2%LRLy*{Qgj2SpkDB?gYro`mI$u@P-a!CC zf6(5{RT=Ux)iO3`!DvDuu8zHL{-%1ruUCGc z;kO+yvrgK+r!P(qXHE|O+=N`V50b~>b@d+sm5xRAprD`Y1F2Bj=-m>r=W7`8{6!P2 z`aou!&0ZyhJ6ZU`P{)9n-1wSA1P+}s#V7IN<^IMX2XsSn>xI63;Vkz@gr~0Y{Kn?sN46`e>Z@N)#zZu5t#H<#d?dKW znAR3t?d~>TqEM`j&fi1j9Bpq*PUeO0#RukmgAop2bq@1Wsv)E&Rwjz4)Uq z1L)V9ZQ+_9gzs5y%AloS9lLuw|200pUFpa)XwzJH6&v*E`08p7&+gNnmomKkBT($s zkld|xT+fgGlp+zktj`HLCAnotpOFP`hLJq5?)u-b?2Bi zOFC|u(il$ZkqJRsLx6{?hdsTIQV)h`2g=838$}k&^Th|z&COtHYwqXa^XFnomAnPF z$j-$hoT*lN@PGI$H*XV$RqyrTZtvO09#YEX(L{8C-qu2BtM?L~rRiTejpCh7e0g-6 zSLqJbg+!SqnQZs%;thYHiM%NBcVp*XdRy?s=N<8R~_UTFnB{&fEK< zpv^(402gPUfmOq&e{$Re@`eB$4oDA7#Tnk^EETNZE|Yeh5FO%ixL=cU_@=HVK-KOT zwX}CwrSXl2+MhI6r3N6iShKl{{85{>)lLkk9vt{cHu-c)lXkj_OXvV306UW?oxabF zus;z(9ka#6y=sEFL;5QDa5#H0*=#69lGgi&FInxTQBwf1z0;xQPZ5l$)8HR_%`(({ zEpBTEuZn|ahx`3^5v6!Msh+OYz+vJ-@9q2%hk?x1cRV2>(5N zh8lsx57(s&cjo)!t>dP?GGZm&E^fvfSGPB)!i)BMB7<_uyS;G!4_=U>HK64YVIc@7 zF6j2v=Af=pImMTpjW-G$)4(5oJQZVZ*W+_<qG8>~vyx19lvck0IdXX;Yg~Ric29nan~~X_5>R0Y$lq41S4q!R zE*PQ$=}E`E8#fx<+wxgqIezxDuf9pi$Y($L=F7CsfSfwYVI@7zGx6sk2qlXiMh;IY z1vhs26>b84Lz7I9aGJi_-WSy?E?kU~oD^L-Ph96~0~_z|{W^!J=JwYaC}|ZnI}U0b ze_6h(5KcF*A^2rqJP-DT!}u(H?p}M!zd$c_p05v)4D@$MT4x`x2N5EC&g9uSaFp!n>S@<|KMmVB?0;G4b1^|c4y0f zD-M`0ddP|T)M1|&zU#O(c?f|3;$R)Y<(Q2hMvzLneoYbaGlt{2hN6MZ5Cf6LcmFc5XmayUv32RPUU^srRjgy27cG265--f@MWkF@5@9~Z~DDO(~Qt}h6 zv4r>GI#FrQ7v&I|00XzPG#LZ5FC07KOCJ@Qhzlh~wug9rR&{_{9~?y@^tA}HaTqk% zOs$wso!Vfm{_}qsE}+*O>QM-q^}J!nIr!?el;k;Vg%JMyI;~9GiTv6aKFub0UK<8$ zR%Lp+x`__wHnL>L?|1-btNY*Vz}wO|py-ZMcNx;(F5(pIpKL0^**MwRl}>+dBy&oi zmOLb04=F#=v!JBLUD^+b%VKURX3yqFi!T39^|N(mgRBgA$iZ)d%(MJRBYuejxJv67 zCU>RzttKGv^}8ofg`+ZTPwo+Zg9tI?xef^opF7J?Zavj@ug6Vm@=VEyR2F5lnj_}}F-w>)>;mml-Y|7$hrTy_g+k^RZLTgaaC0AQtnh&v z-6;p(1bZ&gp6W8`u1kB83Ro$#(lxPx7G-+^DeYaqTm7oqi0q2VyXfWg`^rW3eNUMj?>Fzf!WEA4@Re=9>mf&qBoLPBx`necXVJ&{~>jw{w}7Fngpa(;#d{wSgQ z;kr6~b&-=o{Ko>^Ip2x9{v{9t9+Y~w?esE^vYhsn^A$I;k-`8B;d?~~RV|O=);$(u zx{+`MAzEPSXhGo)%L>G&tbwST%O#dFuRO)r0(5YKo}yhH#h!{vREN+;<;dQ3NztFa z+cX>rj#<^xX^ooRlpd3?i)05i<=ZLy(h_b00>hShC3~lU!Mk@9UQ1K@dowa=~z_$JvB5QUwgC-x!xu)YG8?lx0e4FnsK9nWcx_`5g{E5HtToCS6pW3lcLSV38l<@FV}y`0#1 zhuv2nd`tA;FXRWyR6@>xYXpAw++p2Q&8Y)7#9?9(riv$s*)C4CJuaNcAfz1FO+c}J zzqyJ;1iHyeEzXBH$%ntd#~V{ub|#ca42VllmUjhx_H6!a{}3a!;Ce1YzPUh(btRz; z@YvrvSt7lWmhsd>V;F^H0!G4ifp_nB@P{&92Ch4n#NvfY1 zG`Mr3A{u$u@*v+)z!Gk+KRWm0<6~{&JLdWCrwcktk;6(GP!cr8!84c->}2cU$Jq}H z^{JxrgZ<}6sj2b#GGCah#HvX{rd=#_kZP3@9px!>AP*Tyv+JK(vwL+E(>I+OK+VVH zE%Ul_T5*t=()_{C71QK$^r(o*a^UV1?@3y%YeM1=*Ays(1xsDtzrg`xX}I0vqJF7* z8Q|(RN2_1slHc|Z`(7Upf`|!Q;w-WgpWh-XSQZZOwkgA@=PYZk{f1pcv>NYz=Dk7_w}|GCr3_%Gn(1 zKr1vV47bfJ(BE6Z)ntR4#z#ovB5X4^lyV(2Hk>PtlL2>G-^D~i1EhyK99e~RK& zCO;}}qbvs&I_XNsGX8=}gqUC&JBsSX$y`1)8&@s716o{LA8Vu$4E9YbwdCOT0ykg8 z7GRN!Q?%U3ev}p`^CaQMh3RT5GM)2GYWd0CsoGWIS-si%dyCa*ZR@fQA`-R5G(8#O z%)TJ8H}rJQN$HwPjPrP_v@3DOYkg6|qVFNJe>o;yH^8DtaK&YwM>7tvVkk|1Qy8U?dVRhE^iO_>m-REb%vv4Kby{;yP2L};wK|)`5#S`<7Cbn(( zl1-qqwlfL%^FD~uIhHu^z;7Ixdf#~|6kc^_Ol7HHn$OOn6=6G~Aeb!~15!Tw>y`jD zxmapd{J*__yy0D^actZuF>(rO`a69JnWQG4(C?qC!^8nE^8Hmfw)?AJKK{{hw}3o( z)Ny@XuFi_1Rmyw1@ROFtLD*frSD#U85y!>(UfnapabG7H{eepH^uf{^dS`fz&XB6P z&cpqIFK`7$Fj6J^89CNj z_=%|c@Mvebm^C_=uz-_ta(H~O1*;$4fZR#mNHoVgjGaEMfnaebv}eXoYkH{rWco2B zjhBUChlD&o)=q@OB|%pXm}s>$77w^sbxW+*S5klQ>c#eco>RCNrvK?VNl-FY`s<(H zk4SRv!ACT(uy=w!G=Lq3OMo%+eQfc1(}gzuK|=i}&fe%8k9T1H&~`e8Cwu=0BCy zFFw=DoulVUs{+pDT*tA$I#b{Fv)wH2eEG3Y*(y(GCd=VUyXf}1Or)HevLJALv|Br0 zKJ|-Ye1w)(To4+hdGb5SY1#v#GO@;kXBtPoTmbhzP)Li9J7Ss2^Y#D`BN}SQ@SL4O z5PWbzEt-ek-%xiN;x;`{k%7Dq+2+6TzTorW@D`!T2ecmVV|9DB`j6p09F4dn5B>E5A`nuH`;?QyZ+AQfVj z9qjER_Q~1C_sTttf-eZku?|5sa8lbZFGN#Jt{N9Nk1RkBb$fxkipUhti^U%d;54*P zbCuz27vC##2o`lyCqNi-a2s_;N+&1>wK}{>x&%I*?QY?oJBAE*-0C4Rg>!QYo9@^- zTfNhX+N;`yxy}vD8I{_26@)ZPTp?dxC9X9#WciPC?IPlfPTgyLAyq29 zn7x|*eRy1`1%*{?4kxOVa}rv-^p97D6$G=kzU_L2F%~Ua`je~&Uz1eBlWzhiN3@H& z8D~&U>l!=jL$z4aZUyawI~2b%E7ryn{4#2fr==G0NF*;OW$I-q)*mCph)JQFHP4=j zCwi0HkL`a+GGt)LJ z%<5L6QSyDnRpiiXvh*1eTT~Bt0l|xx^_&?G`pspDAYuOGM9H+OvTd%^3{ZeH|(eU=;!YhCddkl!H*S$6m7dV?5bj zK~0%=dK~=F`{vB%2&%8}I|~0ch~e;}>9c}bd3ZeB;>)ja3gUu@olK6Y;~nD{ep56JWSQI-;ZbJezAI2Z+WDmd0mG}JJc~tmsx21 z)75MI`{9yeISRZJ`2iR@%xCY~8;F~og1R>jumaq3sD#Ai0?Rq=)3ZyZ<@0bw$C|!2 z7Pv=xAVT5;{q9lHL=DV>jSO|f)eGR+Ob%p@$XD39@+i`1gIA6C9C*WBi{3?HW%R2z zJ05_V8h~jQ@Xa7YIO6Iy*ku}ora05pHPGdTE@YgR6V)3tQnJ&&0S96dcMF6rvRVt` za{*mI-TdryWB1_4$uek-42W29Rc&<46KdrYV)9d~YnRh1y4L@ok7tp5f_PdY%hxMK z{oT>4(RIOM>BP&k=c~KCS=5B2ijD!}0F=g2k~c&>+?wsERFRt*0m5|9_=2(f8I+zU zdlrAX_+P^tI zMtn)aXsOODMeKeh-v=ytasClJ8mpMmr~Vun1R6^W;v<8)mi2G;WOI9G@r(#`1hj}l zlmzVADVtx$5gj0e_RM%93=1nz631lu`1D}q8B)La=lbwiJ2>oz-eJ|S}LU_^9ilTqP4Am@{cRi z+J?iz2Xm49ss%ag5>H3)Ub>J(X_l=0C|${4e7@`UP|Gy3xKAw>}%ysUGtLc~QipI`b6HC6{@~3=W`U3j-9e)D1*#af;I7s=vwR%JSz$ zIKQ^0>XeFTIC02UHX!JKVNhpDU=KlN(*v>kb1s&@kgQxqN}Pq&SrgDZQEyYD5r+*a zwO}3vbMrfBh`-GfUY8_sH%k*#EK=~Hs2hC=o8@EVWWi3{zGM5j?~{0q3)EDI}1*OF6Ym>0CFsyMw_`mu<0~?q^e8Rd<(a znpav36#8O*e7xA7?VT{w`_%k$v9F%X;Yn^GZ^$-LI-b2KhW~;_BdT01y~<+WFZraF z^Y~>Z*mT_?Ogg%&bpgX3g?sW92BS(RVLjoyDJNh^)NEW+CApqvxiF0Dn_pH~OzmiE zy7I)27)UO}wn*5?X?(i!o$RYucmgF(X)m`S$F62UcXezC!qD`&-H5BwKm8Dj5H|Y)RV+FH5 z27;W{9Q+t_l#4@MN)@Fp;|hR-q=%6uhG={Kg}!oxdWyw#zpY0(-kNc_W5aU098%@8 z5Q#)W3-xH@3ky=^;1rl?S;Ud8NJc{NqVv`xf%0lNpn!s%y%#4u;#T<1Wq*EjaB}Ff z)%W4fIWv6fkZNGgakTOzYLRON(#ONnsBn-e$rCcQg>|mKbDFf*Z8Jy5F3(?c*Bae% zf)qtyovH4dp@LkAFOScEE5)LU59zE)gw^&}bKLU`knC&*51d=z zn}F5)`0jO>mHpGc9hew`gageu=H(=f^i=9nH?+@we1(?AGx2dC$p5Mpj z_0u9b6-!bW1(U~IM>JWNZ=V*CO{lW7^<#hb2MZz8R@GNR89POZrXgX82umN_VsYaI z9KBOtnX$U@0K#Dj7-!?pq2URzr0&vM8tdc9qhu*x>~P6vdvo=QJ`JkR#Gn7F-`d?H z>-BS7u<>o3Z0VBDv4n(|)m}Tk-KUgfBzDYHYj##8K_Gf~0|Vv<6)b01aWJ}Q4;eP<)$C$u+*oWR!%JdMmtVdDGT!q{;GO;5~V0mbUEOr)p^8lH_W|{a!>DI{0K~ z{^53o@X(hl8jHu5y*u8S9P4j_(8N>dP3YEkuc^nUIMvuyYyE6K(*d(sMyWwmqd;NA z&q27;g4#pL`UBlgjHfAezFCug+#PBGhd1R6C~7J$0)@ z)dVgAcvNcExajHHS;`A=9-1D{TR^tIn+a1*gUF6y5-4=2IyLSfvprkJ5e{{=FOMgs zg&Qc{&T{ejB9rakQ3Hl*gvd}}H-`o-WwB!S=9jC_(|c10#7$e7r*q?5_gFg)Z<{!i z65vV2%H!R~#c`3lm)WkJ!xJF&5@#9Bx-!EGL`6!8rLNeGc*sM@uz#**FYRu#w4*hI zrt{tw|40hnkFbG-+k7CIvcX{-u8!5fG3N|(-)qIo#ziusB{bwWg^lCcsKu<&5abyF z>5%>WQ95RL;@0js)5OBnZK*7yAfZ2Rr*?PqIy(qTEQI=@XsJ--qSXR?e5#C5=R+-h zKKGpWH?F|Bi?X~BocPHaTJ~T?Xk7vg9u@%jAzvd6pAsaVI?Me9gFI^w7^tAU{@#i> z!VqpTS0rHf$}cm~;Fv1;t-3)~6S8*#hSAo@YZri~Kstjy6Fb&q)8VSvCS{KTh4Qk^ zO<=oxg@9_T`?w$^2_%QE%pO2Qz=c1aKPU46)w*cg@)X>RzRh3aU+M|%UDl-o#f{)~ zD3nnhTt7r-;o;{M{7Ndec#O*bbFfN`dA^8HV0hQ0O3jEw_ZxLE97;K^ug% zXNf?yJ*X=yhWp1wx*4ruL9reQL7eFSxW|)-aI$)3Y2)cqR=91uI;v~iy#A`f7`|Vp zSU2U-&X-?eMOn*H)HOO?TaDOp3adV+Q?ZhAK=1PEkEa$F{t<^3PvX=^Wt;P8vZRo>`4Mg!RkeSxVI0^d z*3sfQcFMuQi)HDYv@DMcL5cgRyY9UPwwZu3N=rhL=e&>K#$5aCuV>orM%_jnjMG@T zbNxjj6ot4C|I1jg5sL?Fb+2MHtD|ybW3#(Lio>q#3@s&_4&_|Vqpfc@77uQpNeT>P(>SJ^5O_@O+-My z98=T^O<{;u`WLg|X<#wa(LgqOVADNY7>gy@^#Ixu3=!v@=vti}ieAqZ;-*;q$B2FpLkvm1F)y`Ux-7cm}H2i zA#nkH`0dVp*}ygDhar4^eJ`#$Tzy(V7EXjP=#|>22m`{R&CwGhqt68=bsU79A2;wT zH6$u>e*2JB8nyvP16FWw^ZMfM_rbywE%9OpLw0a3%RlOBdy&5%le@8?%ijU^NlOyM zQe0ACdVf{|=QM)_u7753LWQm3I0-fI2r@K{uGnsya$(+@NH0Z$-rH-|>&-HF`cb>8K2S@j#%n$<26HV)5B|30sCuqxO<`iljwEqW#kWgums{q^~`FMITcr7q*S{oni|X z0(@F1mr{WZ*Wk$wV<5UMv=YF2df6FQSo)G@-?#>>O@NY~u{F$iws*W7mS1y@Kt{Kk zZ)8uq3d>e+@vSmdyF4pDP7gRF89foK`d?SL|fg zYAb6bUW&)3E!yH}Yrf4jg~cS2O(j+pIFL|a{J@iO#rT_!r}{% ztij#-nki%0h5N51d*Tv(PBgy>TO~Qtp~|%{x>l;jxSdP9dhZVK-Q=1B+Cb~woo zbT!m0F=XPV7Rh8$Ew}@{eGZw`t~Qv+bd{pKXnn5wpgYOVcib@{a0X*eoL^F#Xzr9s zTSeX6@F003r=vHR12A%0ydVQM(5DA5wLX<`qeW+x`vgn4qv!VwgMkj_scynH%mumA zjbZUj*5l3UH-BfhkO0c7+)5EfOV=cF)fE#3-*=Hy#dBYt7y-A#AunuQQBm6AIuH}_ zOmhQcI~0MAEHbh>^sW{fI+VvH`b7AkdFaX@ zk~koTFSibkT{9&ig8rL(lF~LQTBC(2Et>%eX~_`32&QX#{9^aVp;|r+9CcZyYUwO~ z6HDuRxr~tO?3bGIjbjp{-`+Q2P(k{9liwkzOEZEzLF7QQsV8xm*_rZm7iN#;sMmw-L`L0FHMO=N!h*!I+$A(b6yUBi1SP^6cpL)bJ z9#|K@#s-n!QXwbpR`O2mX-5exw|GKNK>Mho2O^{AiJjR^<^?jpE>6z624d}T|0u|J zA~R2;c$l$lmmeqSSwR|ZJOSUWumBwuUd3^coLjoy!_E6x5crGArp#IUnxu zNrmhnTXG)pG%#T-$PimV-e9?<^@tf-vMr}0pCK;N_)zL?kRj?50y~@)El<&sKj&O1 zq_M;sCtIbLA=W^=fX%}ISVhpEO7=V{F9FN+zlvVL)Q9P*s8^xJy}4?Od94Q0$g{aI zeaD~Gd5knbW-k!A?9bK8+{?9iALe#SDjKySwTx<#X64yp+mGm44~>mmz87xn^^7 z6kBYVZIC==%_Jg<`T6v`#059$2IXT@|9l;g%a7pH=_B@}SrXIN0!qH2_}~r$aOrQ{EiQ;e9$dp6iDd2jJ0&6}q_MeSB(P z@pZi3_0`Sw`Ru>xw|3Bma-?oEYkahN4Y=d?ml~j9w=%ABcJ$nPbOULwDbm*TFN)?s zGRWb?)nj(4Qe+_}+{V!d_Lz-)7@bEGB&JAoEX<_0 zf{NaXsjNkpXSBdnb6iT7(k{abmhQr?_SR#-e30)-jO9ug6L{%jt6HMoHEoBHLlQjf zjD`&E=((Dfv#bZC!3(@~r?NPOs@`ixX7E`06D9-`ntkN@2e({FMkY3@+e;kSnI0@{ z+ZV`9Mh`pWZJC*dah*mT$bRJnRpY2;z2G8_tE0M;$13QynFX( z3oGYx1vTy(vfMve@=REG$-?;R^h326j^b|E75|b$JZ?Syrg>NA@xlwcO~4@}@r3?e zr70DuvQwYo13gN3(!TA;$mbDpPdg6~wLmXe3T?RmBxrYqaPKX51NZ9u5`X;8KRq{lJ7$|u8Sjo0e)WcR`L zT%3h+V`o=E-b?$H;7SE@V(GQ&)WpA{R-VY!N~G2U^TIsJ-XTtWG5dR(RjAfpTTDvS zk`&ObHZdvHTk;wNsxBLsC-A>C0mwzlV3n%xYe?dhv6cs>RjbE+y!oo?n?WeCMx67o zXsE@M4SkxV&ac@`#IH(A9}UYKzyEYxbwC=-Xe4Fiq?aPf$%1R6?jPu zO5sqfuK;v}bAjk`R&;!=u$kO_1j-?mT{l2L=mwx~%vI=gHR)Uk3Q*Kitd~4gfUAi~ zvP|@0rX?M7R!}O2>!m4m^9mf*d8MZ1Q=V1NUH2HY=hw5dB`wTtC87^@Rw|OOQ=7Zi z_ph|s^|$AjNT=+W%6wTKm&GUdq4#60Y z!MGs#^TifWL;Zc(?=*kmyWX8Eev&}v^eJZ$+JD+(m`e9>{AE$u&3)R5{TKXXNp~^C zBKX8zVJ(2Z)q2TDHlyAxaMUg*A#lPjET#Y1>JvHj@vAo%!7(=o&a57m)`374Q>?B(ioRmwm8kioM8^CZePuZu*+ zgG{w6NS5 z^I4Yp{Fjepg4-I#fAPGY+L9dfp(*W3QRwtS-Gdt3!rbw@4j|F%VdWMBQG=5al$tDh znnoc;d#9MQh$3TE!e(>?jl5Ub4~zG&xhkpiZ5FQ#kT7O%6>1PDEKQV$1j}gGgu>jk zLOQ7Zw~mSi9>0)MVkH%;kW~ifeq5@$EwHn;jXgJ?B@BgbrIh%?y8__CP9+|W&woDl z$YtXkH>VAQ$m%cefK%7Soh<`VT+ckZEX@$zezKSpNFw=CZ0QxHY!CTMZ~1Xc4O6aua7tbOq0X&?@dh+1MHTH2@3Jd1ZBTokQB+vWXA7Ex*%6^;pX( zS%ICiI z2l5X?Mxu-|{2M+2SL1z=T1}v=n4n;u$4R0U1a)PDPitv({)*4Rk2dw|T@N}R;(44I z6$rD<&C);%eV5JA4>5?(c(fk&aZ~##sZ;WJ(~SiD*b%O*fGY8l!U~T)73b7koV@>l zF7ACl&73I$5jQ#o6inKKr29$>V+!0|j~8M^C{03TcL7~zPE6_z>N)S{#Or6a1J~;& zV2;lNot%~oSv$!(hmeIqQ6eI)ZvvC_U9dFOO37gaePE7~jNvDt;;Fh0d_)>k$KmN7g6{GXEX1Q}=xlYhAG92|@u33i3`1iRYdv8_j z?I$OU_@>(~&G&O=kWS+;dipy-Mb{9)S3<3EZNahAvb6`j0J&TyNjS36+-g9YzQJIF z5&XVV(89eBIiLWLZX>toO1V8PWSXgQk6ryIbogfWqr&IkCJD=Gf(K!+W=y}L`%JfJ z`ny1fji8VvF_kP7heF+H%n@;1!Z1&x_Eed-FmrSTSnnc$N&*GFAw9>(jOm$|yj{(& zl?IB*L!~g-^q&*sG-u zh1mlqs@SC7Dm2*-+Y|S-&;&x`BxS8b`uZW{v6Mq-siWigV96ry51IMZ>stjO_ps?y z6ab#JM{vlqe#T!01yR$B8Zq$-BgjO^ejQ4L9y#U!AS);)vMo@e09XX%{HAZ|U*n$!UUk!((ZknPXgWHFfnRmZn_gdy!C> zHmG9R@N0<_*1bPB9$3naTFu9!m<uuUBQEqN=+N*W5x|iB;4G(~Li`MSEwLe_p*6 zx0OzzK8v&KjNFICF|ktmE^>K4`Kx}BpZ*p1N-3Q2luX&ATU(y!8%E`i8%h{mAmvU( zLWXDF>pOfYal?(h;uuW{Xc2M8ki>3Yzx_0yDp$+cFE7qA!J#piD+uxzG4OSA;y6w* zy_Lb(rVouqb~I(0=s(F({Jn_F*vJ2YmM%|Qm}_E(_*B_PAzhu76prj#8?ScYhiu3| zCMwq{Q<3g(e(~_S;eX(7X9kcx>9neDRGbEidY6?Ixwa-8>SJu-_NJIWRJ8t8=uy&h zHy1%(R2mOpQ~5&H(`e;j|L3R9i?dY&lqQbhL1wMNMZpq`C>lECb(^nYi0uevF@P5i zk%0SsQo)JmKXa56aKbl=uC5a^oYbq^B)^M=8gy!1Sth@Hekz_3c@?~^on9B>hg*aj zG+~KJJ`?G!7=CenrVgQyZz$Qm;izsZwL z%a~e#$Ty^-K3hFRPtir?BN_us1b?Iz7MZaS-#wV)!P{v+NH1fUB?`twjLH(4@O8eHfSYhIM*2yI=Qo)JN_FTk>w>6W%YJ&^zy zyoKiMORqY`pVgVkg|$PHRCP{cXsJE5RcS=R9}j=J8b&Du$@MOXk9$MPJ zbT`a9i5_cH#BO~jCnN_!^NpH><-|p;epUhUOZQZ+v;w1Ur!*$#Gj2nDA-cuZc+RQ+ zrvCT)r*0yw$4b#SCJmR?WGo-bIA~n6d$O2q>dUj7>9SG(xztflHtRrFy@Nu$;smtn zn>ds68)Fr3x%R2G=nZy1ZHdae3Bb{l0!MlYF}8^~SFMb__{Q4VCw0&(8LB4tcuWp9 z^V|@sox={9$mI*M?r-0f8nWrKloizxc{cw!rSNT9P$6=v=FO+V0TOv1e#%7i`$S?S zlaaU1^Hh4p2XZR7#_l~kF<^GSmf0?N!>f;DUx)!m8q|XY>iT3JI3O?SU2ND!iO|& z7c@s&{IIhua!`3?SrtrAGLQ+x>WD1&nPxf&ycu{op881hi9d#;t0mpEq=+-_%%U*?vz0E8OXaypDDN5i3{G!dCg**O> zJI{ao38l)}o@6(Ieb7%?sMqI?^n{mQj(46$5q9m6(!$#wgvL;n_LS@!j+xHUaR~eZ zG6z74S=&3mQeN_kOuTE6HsFEr6wh9sKWcfso)zw5isz+QmDcl0$$<_cuLrNC#R!4B z-s&c5ZBGY@)0`|0#5^Tk$&Mv{y4OS}NbagJ(@U(IB#FjK4LttjphKTTYA-V-wrdcs zva0hV3w!^e|1d%X`f+A=%dkE5`vauia5vw8EO9fA?^VGuT-{~Jqt4Q?{K(9v*1eub zXsh;*kDZ6+1C{c}9whLOhHNAt;nA)OmNyNm_Hw?=xWoYC{nw-X;MzM2|HU^FDYl@c zlEzkRrFM>TMr%`F5aM;s3CYhe@g&@P+*{1VX>AjxHZgWB{v6qf)Pi#U#v0uyb+3?) zW~<{j`Ue~VVBFdlWsWJN-NiyUDrP>|+>s4hcH1v!mz07$>KXTNzyxwvy8=ruNB&z$ z?$!!;EVk^9{n{xhaY$(zY>ADjIoS+rt zEDtTYWclD3g_CQ5_LpC}KtM3b+hef@hkoepTiL_egFF{P+@#JmlOWe;N=Rh}h%%w< z>gv$~zyIgJ;zJg0kdT0bf%_iUj=JsG*MO%yi;iVtkR!m;h`0HGSjfwW``&6J()C$i zPoFcHG|6`2=Nl_Op$-FP{ZQj?MUfp<`3!+(jZfk;T4;krhFc`HuZWME?G5A zlEE!DBb=5Ij6E5!fE3Cr__N>q>d$@C-T&k@eN%yTF`@tDIejzChuFJ+{>?D(|J*mf z|FhqOnf%FX(iMN|n>+vqj-L9tkGOBYD-qUY^n=!i0Fc8{O~D(b&uRmodY6aa=J(d#)YRC@fG^>mj1 z+%*$!95MRjKqvGZFtuV3S-y&bOR6c)-kvo9yH*QzEqtA~n^%8R1Y z%e)=2hg?N3>}HhwHfyT%3s9QF5dF+0-aIbKH>gWNiz=r*^VR>U-zJEaYyD^5U3{{C z`XwL}Z}*>F3LJ*MHJiVYa1fT&B9(+S_N#S$ZYFRI#aW9Ozn4P%r#DIr#ND5cUJYR@ zOoj`hP(4U_87Zv=pXD-6D)Ff6odBcMlzfy4Z>yaS^x6t{=K5M_(=tZg6#ms@q$Noh zJMm4wo$G1c63*FQ4|d9As${iwDLdGe#=IMIQ=AO@+p`Dd(I@o~WKw3Nm!~JaH2{0$ zVY*`JMIfp`Bs9o7Gg}Y0%LL?uX3=##^J;&;zkcb^LR))EV#(zjpV0@+fhqw`5=9liO8vDy?gG|l3$Rsn12ov7oyc;fqx)&7!p;_Wtq}h zC(cPJM^yC0?K;rWQrTMfY5I>bpSe6+Ar{`835Ax5ai@?=KY2;K9%LBHNTkCHPAzD_ zn*wTfL6BhuDedqIe&@^v(d^(AXh@btE2%p~vh_Ho{}|j(Z7gXrGl*cwJv#VgVE~QJ z#Id^HVd=Ah)tP+?Dd4?dT&C7~gsI;)5KUFIN{{8WK5Jt z%`-QW-_wxM{^(Ph)JgcGPm@Rf4)dHl88T%(JfYP~cAWnl?_<=s;k5u3F4911e9}St zDnH`~&))zH&RT+|J6T;EAGG%po72~Zh~Jhj9(A@@-pVUy_EQTR&I@$e$x)tb1cKUD zk4{U*KzCv)nS*obYMio|Xxq}!Ac6M5TVpR8jbM0wq2p2WG79W z9q=D(5)PPVib6_}x%TI!B~gH!@i>(?NNclWWc)P7TNkjt&X*5Y`@1Jp39K~aFy&e|vy{TvfczO*I*Be>4>SNd*2h#uSIAI8QOxnqqx`LH z7*-NI<#1IyMht3lq#O*JL%*U^?<}8>%Cwy0{&;DwZNL7o>cr}<)B0U$J9~L@dw!!>;4)PI z8diRXn(vAZ$*Md@Y9F5|uz2^O zF}fPeTH6RW+h3-PaVSBpxQZDhcrtBE5FE^_K{S&Y9Gwn&PJ(4eX-jBx1(?hMhY*%v z(EXuhLV^8r+2iADE%^~XTxM{dP#j|B`2e!{!;VdA8~-Tf+Vnu`c|-9FjSmH7EfCGy zGnP^ffAleXSiIHutBb491Wn*r_{VPKHyoT7^0}7DhLEM`CU+OX}SQAOJcPML#$p4yX$u|znRsNyp6b3BD!AV z#w}?~{aB4^wj_OFXraVQ3iT3>$HSr@?f)1?Ro6Nnlz!$rd7n~4KnB;O2ALs;Kh1UT zGF89>e5MBgq0h6?N9Ycgif(poUY`9w|M?>SaM<}Td+;O5Xz^-U`@{Pn)k;cFHxJ`a z7Fi!%1y_(O-91>!^E~ISE~$tR3XpXcKWe7pkFKE918T5;9oEJb@59|GlrniQ^Z)@{ znJ%(?r^<40>%6F+l3xS{iQ51dAB#_L`Y`7dhop3sPd}2rb%jr!N7j1D#Ba|vNCXriMpR0FvZ(0<^7l$1HYXN)7d z?#`_RY4rAjh?y5Ly3TEWYSUuMD^jElU;inhS(JNBgL4Hs!M{Ts#_+o_Xn-aj*xwxY zuup#e81r5|)WN3qjU{9yvPDCqx)(PR>1Co@vE=p+ni%d?i(r@Z9seIdLi{t!_;KuXJkK-0hE16n55w_nA%mqc-yr#2$0&{*7GX z#nqz>r}1VniflwBQlx!xEt@E8kUWO+lP|w2FiYA9Oi!JLj4w1~9EMbBK89Gb{D_2h zcV691Uf%rB2$spNIil$;yphCAw81w|{YN;Dn`}SR7xe?^^B0G$<^?z=hBe$~mFw9nJ@dw8&%+pw$@f@Y^hUwW zgb8wb7~Mtc`w(K;_%#0+cCH`ka;dMaS@*1V0~@mcs9br~GRVB>^Xm^B?qaKop73D; zP}~NrfSZc~&;Mn%@e%5uqS1Mg3VVq526<`vrz>F2T#`@Amjj;QleAuP)y#28TyphJ zOB~)s&)83xYV1O)cqN#Jz@WWs8eY?vr!OE}mZBboyobau8j*~&plTGwY7PW&{GJ7B zTFU)P$FbS?l4M@sz)MFJ=li4J^+z0?5j>lBbA?!=(`(ZTZ`zTp&E9d!>D9!K5 zRY-%%8qDDgN2ez&*td8Wo7ayH68nj`JnYfCkH4pIYGM_vI{5G(AEiVF)u390Utj;$ zw?N2S+P~iaHX#5Mi{HM%FPB)PU2wgQmxB&@>dfe?bAEFzmsZE)4xcgjfD7Y}Jb!wG zh3pgzN)FSa>@4>ON$^LZGV@D~ivcZ8^2t|^ zN|xgK9;4DjPi=dI#Zw|$z!EKCYqQY>W_V(S<`0G^^eXQ(|6Ht%RcIrU44L};2VZh` zKF_d0^pS%6JTFJ((I0&jR$XY#l*ZX3UcIySz5q0VAvzzxoA>&2BV~7!3fwn_%__0O zj&HF-43aelD0h^h9;t7`VR&(!#$U0!X~7}$vV>H{sEodFTEKeBcjs^44l75@`P?rg zOZUp9JMUzK8(fh=#4>)$0(2*05Wk$(L9hF39vItGZ2XbGk_UF$LPo3Pu>nP8Lq$rL z7pW9k_8sGC^8H2Aa|m+Od8pL!qcL*EB#{ar?AEHSHBb zVNPju3S_a@Cf9G*8=eK8M`jLXoICZx%PIx5yW5M6gq`|F4yasZgbS3Z`#s9_CTReU zcWcRA_9<*}ESyAGFIOP(A(&3DZjFtf&lh0>b7e|)JTromrYoKWV<8W?;5?*4t-{g8 z70*faA$iPov-*Qxnf?}A@Z&Ef67^-q`S37o6~{H`D^t3+*fZgL>H`N{+cV7rr#>)~ zjSU<8Z*6kqH|b7Kxn+n#Fj0Q^C%^oYd}yd2to82pBEG zm>no8PLzdddpeHZrE0&BY1~Lgzw2q4c+u}h>IF9LZApO<1K>yP_(7<}%k#^hFG^Ws z@#uX3AQ4R#{w9~X@|nMLow*kEr`P$Vw%mXfvGm9CAP-q6~7EF8j)AD$+7oFUzX}%yVzr=eO5-g(Jx3V6vO8@-Ic1#1X7=pNrV)oZ7$w+m>VyQa+5VWjaxKU#uo7` zBKU>jFHxad0CTXQ&py{4$0z5n*Y1mQ&$4M5pSqYH*7|z1e4V2Vw2Tk%8Lv*9@-R(!8#MP7brH>%9v8{nsCP~ z6xxm>kEE_;)ppq4q6SXKSMkPjmK9usRgAL%wGa$G#0Q}b2Y6LY}eK*Kspx~}}K zcb;1@YANbs08;^yslMql07roW|Mq|1>-ZfdR7uqfUA zYVK(H0zXvep9t#G-sGTE{6&mGJr~-XKjgA@rrg z!CTxjLFnSl*}D!>pU{^ul;Zf!EJHXOwd18vDN9Fo{viz%({nWO-v9>mYsRWXPWJZZr8!OQQzOq)+Sn;N;m$}azmZ)j zyMX4G***HzeUb+3atE?zW7+#SRDneiM%%vv^2nBfy0|^Net+yr>wDGDj*jF$kI7J#h+<6{Q%Lf7u*8wrS8Gke00{dSz@?d$>4&&6gg8!VZUk+FeP! z>@y*M6Ah#Q?M8FrO8)1<2;cTrHqIwUsZMaZF8E5%JUyaO6QNVTu|(7~;JiWow~v-V zL5t2)aY}-Frb|@hhzN`QB(^ApyJez9oK_fa3p?{E*OuOQqE64lF-;(VRE!&2uTymrJ>E>)z&XaR~&A>35<4ph)2QhJ$r1mQdYe zm8Ilmy`G-!zU$Z`X>eA$AM+=xb}x5D&_YfDVlw$Czp;(_4|uCGh(`V!9$f@jE@A1P zr7tRTrgv$g3y87{^tn{zb1h=e{^UJ$W&tZ{rIL2E4Zj{lxVs)*$w6nMBON*Gy*h>T z)~o0*l=KvlxJhfo2gM)#*SG}67B8Mva+;e0EIXd0uy9Q3auAKp>w}VoNHIQ(+o|3Z&=@Xh`eP(5hkN^4>(BEdz+5Al z$VV^JqG3P5QL`;Nd}0Lc_}78I9k)or*)NlOe@#}tb0LNWPv?7)VzNjX`#hemJUJv@ z$1r$`C}KsSjZ3|z|HMpOYD3ldxFO61FQ|`{o-q zJY5#?sLzR#Ps27nNCme#oaUQ(Jf4lPVIE&RiFGETAM~tKyh?Xk-DWi1u(a%T^g?<= zzq-)%0v)0rb%on07hCm~@Rs%R{9PfpPF4ggmHC-QL zeICQvsY%y~TbsDlSLo0fZTrFK3lM*;k?m0M*6qJ3S=5tSb`@A>BeAt6qg+7Nn#v9k zR+13aea_z%E9l(8ewSK)i_9OL&d{SOtcB-j2x;zdmI}CGxj072+R8<4XF%Aeg%jc_ zy6mf0i;bdQXkA`!4eZLfi{miZ)`#FJS&rkscYGisTB}0$099akM?9KM^)R{22$J=i z#6>TJ6h-NcZI7q~xM=+;x~NskiL7DV(ugbHp?1sfARR7gikkzW!_s3Vs zoUea!6}Yoq?Gt`t=Lg>;VV9J2u-No&^5z3 z3HtJ}w)NbX=4HUcuE1qlER`xtpQlTLyuqeSVF!h~X&go1n}DM~oWFU4UE4^%RrI3w z6dM6WFP?-*vmVHjS#{2YDY(c4@uls#1T6lpQ0^YSdQ*@{NOsq3=;OsE4^PLG;v=;a;Ypoc>VN&$Zmn3^>i0%^ zHRS2%h|+M;G@M64+S*?>^;iI$IpF(FQht5aKvFhf`(t%wy0XkFcZ}+j$S)1iM6-q* z+OW2d^fhhNQ@6A9ZiUZjxwNl4Ph7wDS~h~Eb#5dk+4NHxjla&TcX|7-ld7x6R=4qX z{+T%ZHd&={&h;QbK|Bzo7AHqq@$0toV_AxVmau=k-IDL}m<@Q+w>n2M!(}t=AnWNQ ze-)h}{ls~zMF0xzD*LY;;*I-@ON^00p1uqk#A4O?0K2PS$J}d~%Np0m`X5e6Ed~<<@yq|Fuc6vKS;|-Nl%pyd$c|G z8CPTI0JkF!xw=k((}!zyUEyJTS46&3@~hp{r20WD>jtzGwpw2)_vDY8l z1$6)bb-rZ2uZjk&a5rYWX#D>5>gGNNF1(mFy}tg0Uf#O?^{QyRwh!oO=+t`gGBk$S zplwe||8!WGXXaTGpa+tzC%B~gPejqmWW`fiKl!&TpUm&VGX~ieIbJ2({h%gS6Tv@G zlFRG;69pjP+CNcDp(Y!hnvcCo5c=Sq%s#V(2WL<{iTyWv2WePg81jdBUfwb3eV*~5 zLkB@X3MwNKyXPuw46831!@ zEABxO=sIz7qag;JVVl<~j)qc>#JMG=|4jC?%{3{vM4G9PDSSxtt7>*c4e9-|d<8ZL zRjsQ`&rzi|M=gx&8*PjpzezYw-#7&Y$|~f$>M=CoN^dqE%pZ{T9SUgH`fSSZ09}>W z#5@)|v~zs>!RbKjiZ-mc<+!%pYY(Aa$JO8H)RJ24I(YQeP`PNF4Ym{``))QYSU;}r z3UF(Ah7}zmD(xWwOZ9E*x7Ki$(bXDFEnRBy2KyLN^RR&-^M*>tQvrOJn4x@@yVC54 zJDWn(;;N+)Ubq6QUmx*Ailf~_`0Edk2Vrv9BxNDq1hv#6Gu^pv+_nMTg$a|$KWOZC z@Sx9XAm70o!k4@WQ0@Uqg)RuZsMY%mx1V}qlzIXbUlNWG?sP-HaHM+k4k2mH!~rvT ze1H7099$uB-Rk|(Bq9-pgEYZc;F=C+I|ZGLTc#xf>iB#TOd|qN@Xl#lb%p8k;~yWM z_owL@;ALYvFs6vcLjz7snXjy2iN&Id!#eWL*i8=6@VG-I)MrRi>7@tF`(eZVCw_W- z#1L&z$b;r4&(x@pc5(FJoc*H{HHV1``Pu3xV7fk!yVSg;M|;`Uu}cGm*>d=xwO zzK=FCSK@M&=vs%8fTUOF_iwU`aKY%tH`nzXik-kz$Dq4EoPG#<&*=9*$ET9+;MMP9 zk_I9J+@QU*E;Jqy5q$R?*R-VK8W8zlzoHlTE7Z@0v2lH&6GpLjrT!p@I^yhPRnRgd zTho8)Vm#1%&x^kUGEa&N7k5TgMIk}~?p_xbMg9glD)xW+H~p-8F?4^(Ub_&bJ7PP- zGsK@0__fY?WqpUv;hizl{h}aH(5d@hE^1g_p6nYh{nN?bqCRF2&Wo!;mnZR8kG7yR z)0~ooG1$F2eKEXMDNGj2WiWjLHLNa;uv_{!!^TZLySsgSewN5wz|WX&?zM7>{H63U zS{nZdGAWUNfZu%ZMP@{AUB3k<|C=mkVzR_6DWmbREfcQj5FB<^P0f##BZrG>eI{m@ zdRH|7NRO#LT|FZiT}!ylEsP1>6aK7D-{}&U6B`juA7x5QG?$wq;z6J?GvMkiHTLM) z>Z5ORK2kIhNs$RRBEg9(o$=~VfZavko=(qbCpGo+NKnbdTw`Sk<4`jl)ns=v`y=nm zJ^fbW;M40=yrye){0BE1nL~qI@CYDCg9~Zau?`cb{f6DPB}K<5CtRQ$lH|OK92Xay z29hoLshN)C!Km58`R+k_LmmtcN_jo=+~IN;Z!aJ;w`r|aMJ~NH9K4G+ccrGZX&uH) zGU$1+#@gVrHHENMu_Q||u>$=$IVmz^vJ}arq(dh0>WP!;^b;!j+o;f2Mjqwirp~5k z#9cvVc>qhhe8{Nnh<^EXmKYO9>bX$jTMca4bR{VOHbZJ|OV{%7GkMpOB%YY^J7Lb% zX>m#w@TGg=S|FV6wtK5nC5p6Y4d`!a=I$Y>2c+^1(m3J%HILbLwxS@X? z0&N*;2YcAM=PzAjC^X0 zJ4{o=%e4_JZJV;WA>`4+uC?;T2DFoBv!HV8Ir$Cntou=Fh$9TOWt0beDG)10{Y!F|Lf-OH=+RSY#lGzLAqy*5jF6agzBj{bo&&@)H{`4`D@ zIL~)KUP*hlvAzX3Y2c7L_S5To+QO5-x9w;~Ofb=DpN&x_QJ~I*^9ogW;mpKV?E*v%! zXxF`sDJ%#cnw|aI>wjAng8uJxO797fSCsXOvpgNeU81ES^Q+2GG+C9B2`jyUej}|6 zg1~_gY<=GGpte^|$hCo2ZmGCS&SAZP`l(`v&(L zEP#DxxbDY?dO0tPD$Uk03EWl86xZ#gA-QlCNr3WI=(w+~`XpP+J7@W@ZBKtrp;*}t zDprR8*8KJZg&r-MXU+na#tu9OX!(`2T5>inV5dTn$Nfy2dRR3)b$-Pjz*g(*JObQ8 zU;AK)8tD#S;~;@wL}y`zhW<3YU)K2OaBr5ZeMx!_Fj!sHbjXnMT%Fyj0ZE~r2st1Q zEP|=~Ko6I^iSt$cmOMtO*qYDhNswgZM~Pd9$MKH*-umq#_XqcP#lmOXnk+TDl#3}T zkg-fRUEU`kS}F1x4($}gfL;d!K6{ies_Ibq+WRlG!kJ!3K;XYPkc%{mG|cqD4*p14F#-KYDrafWSo>a zVL`Qf)+GK?qB)-T>MX7pOUPf}Kt#V0I31Th=EM34BQPII@6?*}8@vjo$Fsk0u$>K) z9DagW>?i*u)R2f~;JJTkelF>_7UZxV$vm`WX4l3~6CLy!@17lu!J*zzKl2hdCrHeY z6-w4${vH2#qe%9bFdHt~t7pTOLhA)Chv>x7UZ>T+4o(l!MSDi^&K)XX)7-=7g3E!n z(v|`Nfg$?#5r)Dq=M_hfMxltpZ}==l4kzBOEO(YCgHu18@a{C=rT_-dkD>HfSnCE- zrcAKAwK+LRAr99B(YH}K+fTNuP?3o;_%vF>CE2^uN$vIZ+2Ee2x5i@KzSfh=nWM|v zNS>-{k|!#&Um($Oz&%QFxhJ`iGSO#ms~?p~Nm0-eM_zqH*NAxr@$-kMwE}pqyB$rt zDwYw5oL}CZ>sdUkbHIx)AL%fhxkG%10$1>QvpVP4VAD1v2v!uNbh?}Yjk>=)+0`ar zseK#S-Mz5*0I;jlR(UvP|BlQI_M=)}m( z+2P5??#||9I*5WUI+Y+$yz!+6lk{L$8BQA2yPWAk`2a4$vJ5OTEJnU7@pcN-wZ9YS z0Hf*K*+ryIZ^Gg0C>FfkB&!vw?i~UJH@Ei>b`PHaG~3QM^(r~M+4OoU(pduTzq%!a|9FSeF}elAMrYlGA;*iwu5ja!o7zqf zPP340r_^DF2|~#g@G_t0-iRU`6@zWIX5$p=(Ej92uio4jW?Z@ov}fV}!~vk6h>-|*hu`}XUVjhhw&~b5O9?;xtB0^K^Q)l4C4xf$Xy8W z(}Oa6$D{_tbs5VQ!A$rVe@dp&o4WoFOU ziXjv(NR)Tip)d02=eoP&#W3D;lCw~s#k%!g`EqupAJ8S|sS1N11_%_@E2Vvr;m%!K z`UD~+R=J459C!{@J|+6SjA1M<)!+)Nm(3yxU+JU`GY>#Z!}EF%W-umsN2>1zMttkh zn;-bicc8wPJ2*A_>4$oBFjrziG`o4o7)ee67j05@+QcLCoN7tbFC5b%MiN?HW&ion z+@OW|{(LLL016NxT9l7k{^cl}p_T8~vt#OUm`KdY;)u-uW$hi*%}Ygm|msRh4dcQWzIkj$$4p+p}aVcrETiYVoDZqLtWs~fV7e*l))+}YqO#IU!JJL*R5ZiqmC z;v#CH{@@yj!QAVC8QzqByiwWO`07QP-HbQJiY}rWuM3VjL|&G-FwBtdPOsm;9^_+? zXTMHdU=i(hj#%_v54>W z^hq928yck-g~lqH`>mYj#(-#yN;9&*J&h@Xca7>V;eanMEcE5XT z;U8Pb`~B$NAgy56L4Go-dts9S0abpjQoI!SB>; zv-neLwCFM*QWK+xvv3@m!UcpmdzNAgI9O#aWExh)7jJA#LYpK=f&X*0V!Y9NZHxe? z^j1{$a+l@Kww0hgEji+8>;tS%as&&d5my_0H1Du^xsL*$_50+_r2Ub;==M3ZrPr;F z3j~3cA)apl2)7S*w|I{=Ha|Ej9Nn^R#rvG^KA&&9eXr81nSgfI`$=d#4QcH9`C~O>v%8Qe{TDTkp$MKvWruH#};6=YWVpK1EdokP}xr zoU^jwhV-Qqw0I1U{JA`m20Lbtoj*Fef3&J!D3;NG-R%C+OK17#6wtSahS^jG2q zQ=ckf#wH56%!8@9*L7r&W03WzcMfkuP<^gBn!)k(prBu5&^^EWQ2o~g6V2nO$( zZ4jj1h3+tE(bCR9JE@Yh*cM4kB>ozOF#Wep@yHad#B+l0)jd*{CaO%k>t_ZOkZHLY zXX#0q0(T^EO!^c$Jcgi>9Mt2+W%#bov4BTJrgysMxIdnK`CWNtupWDsdYv-*>l3n{ z$^;&SSLWpaceK`Ox8fM|A`w^1#oUo_Ev54C zYk9t}zw}LAFS*SjWVdWK_oEaw9ocl@_eyds-CC9b#Ns&*=+oNMJuQ!?O_|u^I(jps z(T1B&UZZ|da}-3y8_BpNogumzk>@7E$d%M&J`r)QRIYv;FC<}aLY1iko;)LaGbLd= zX01TC{)l!a`O&d~BzUz)DCf4eU!ke!bYM$YDV+YNoPM)29t2X(Ag^$)J(4)R$mq=n zH{f3Kr-$0{pwDucJLeNB~vX1{m z`!)`A@qBwxi2CWQjxf3NOcBZtCtEw((eJjoW?JF;a+&U_IVx|*9MZIgkW>`cg9J(( z?ar()4|;j8F_(OTpohX19lbX<@$G~WajY^k4~jX$R6Iv!c79Ajd7Du2@nJ!qo<@ka zSJF}SK!=3U*(Y6PB9+hvf7mOCQphZv812tCmxMq_S$^^Issj^tH4Vkt7JC~LYptu~_29dGK`6`!m;5ww zkO2;XcHoZUoDKKJqY0p8# zj#h8(if&rBmfeSVk`DH@;bS``oEXoU8+@IXe@7&@C&sD|LHxx64yLNMaC2ffYfpiu zsRMeJB89%DkWV`}r2eK!m}#&(n=|WLHU3rZWd5&t0@xjAfpSd?hb18D6tDaK)amMr z&74m9AL471$cwkZP8;{qW!P4mtUx#ASNJ6==SmRU%)L`jiK`zr$v&Bavh02aBtd7CTu9v6n&!(0$7G@i13=j{Eaan__>DTMvv$;x~D>`>hI z?ZhbaftQzQAaUxTO9o`R0sS4ldCp^+oCVYi#Uy_b(K@2r(QYz>DVwVpdK>bUC3ALy zp}vkz8e+K?sU!z70z2KD11kOGAFAF;A+d`HA-D+!A2oq2$xg0dcglHZ0st!Q^!jqZ zkVmCdec|C0SSe1dPP8|tSA~)qRh2B312yKFG`FY~&(ps>kv$#&!Bm?-XdWbwnr*9` z;ab-u7!sW+l_`Eq$5gym5Ny=2qlGRByYm-7jndWQ(~cf#4>>QpR6+8Z58usL(k2Pz z?aEU1?i2F#mlQ$DKKBIdAGv1qkF1$*u{E3!c%`Z1tDR2RTVD+e z9kTZR`EPgLeVVPE8l5THn7eD!!0N_8hFnqpV~i^wXrV!GNmX%Tlig+t3*y*5N(T|3 zLCNj>PEXZl6JLK3)}VQ5@w|=d?2(?^Th7qWYuJ+ixj;*sxD%=Ge0GVpmM1flBqn#d z*CnVNH5JtVJf8RGRW#=k*qmOO@gyfbNIeMK_I=_8&P~gy>bEeuluF_&@G|`?^qw#L zobI!ANqABdUO-GZfD#3R83fDmfJJWZnBKb|6Pdo99R(4WS%_VSjAQX=#|awy=&|B_ z_KjCRuAQLavK&|ooSewqRJh<)!$-QI&;dI?2HZm`2vhTTB7_fCvmmm0hA1A?-lUba+&$XAZP$I5Pe)o-0 z3WLm!0{CsRWUHI>h-=sRTcqb>Hoxp*_!9?5o9hxhJPBWu@_GhmaefCI4WQ1OWT`*| zPm0IMnk1%ixQmD9God_vwvU^b{MT?vrWtUVV$E4^6;%S-Snm!Tq{xeZ)AMXX;u=;w zVrDRGZm;hu6j=sX&A_eG*loO%;>85R&>pM3ySli$Nf^{wfi}S^|2y@!Qu)$af^cg{ zUK#=1S*HsgWp!AGi;{mFDpVZl|7R_-)D>q3YCJ#?R>fH?I@v>MzkJY)!WAcf>d^*kw)lQCL=h(4aQ!oHtsnI_u84$u$ z`u*1G=el>H*@{f>)4^==s-7^0gL;lmY&M~;#JB?pzMLP7mEKq+Ax%G8P8O*ftX5mP z&%FvZBbR3$gLLwEIosRmc4>eu!%iBfJu@<`-S3I_c=%K^iO8gg+7{!HJ)*q}%&yGPo?*?&@7BI|@Zi<5IwVuT$I$N|+V)oNsuo)#Z!ag_eq`e=W835+Y* z^OwlZ6r}T!MNFrp>b47yg7vrR$=SdwlXRGu+hv5wVlTC)^V!y-6hi?7PWIKuZDQTU zonOp0PxP-_YOXu`>&}md<(~;;^(2&Mp6@Lm?fe)xs21k?Kw#{$KP-1=%YVylbY|mo z?y`sbol5LKM2eKm&c?<92lm+9i$0{#eanx&rJp6%2f8-`+9`3ptDn%?hAolhBmF*fZL2VUowzuEWyd-?nS3hRqGr`uw* zFuv$)VDGC|g^;x{0uIQub+qEV;e2SAU44 zUZDp{r>>x+^eXAAkm9dW|7n1L$|rJOD_TofmF69> zyv-MkQ!htUng6(Gs<2xV9VItsSt)zHIxSEl&YluaV_NTU;YSQVxs2F)_+xG^56C9Fy%E3*tkmPZ;==CVCl=U zx@?Qe@XYtN4mOvibs^CzFe)^FKRn;s!w(25lS49lw%FpHmZJjrBa5W2lCch!f1N+u zIV^`-y|Sd}j<062k@Rorp-3l^ z%{vF-4iE{joA~_wIqp`{bH!yjz4%b2PJ5-q9q(7Cqzk%Eo7~2t)Y|IYG8ge|xkzlh zRh->sNv?G>vn)QQr%Mh@pMgkHmbHMz%!81Q(~>PH%jh?QSO&E$;a!pU@$cWJTjM#D zu~2)u@O%#;oyweSLy`?Dw9*?$>k*hN&-(*eE1vSX}(|Rs>Q6?*hB)S48{{LDHkEQaF>`a%ZO1t;7^72G>HH)JoxIlaQ zy+e@8g&O4OD(k7ii8v*D>hWL$^;PEqpUNgazhB)+a$KUd_kC1d6&72Tg!_R-7iTMt z2n#p2?(O(N{}s}3kiCu?m5ZZZf`oENJ@jqi`Cky2I{?m`Oq=oFyAY7;tAF?Z?~3Gk zO4%X7`09=o&NG!qPfWTmP&uA0k79&Gsp!*-N4R(AalxK^`<-BCehJ!*4{O7M{-fu! zRBNw%s7$VY!r*Q?8n%1q=KL2TJt&gC65nMURyXOJP5JE?>wc)MfpKyNOKN5Fp#Ce5 zg>W@-Ko!!L05#8(CD?rYvgjJd9!tn71OX}wKmAk}gLL+!+1hEV(($n&7$_L=14;Y< zDiPh^tY+Q9>7@*!Ne4rtso0Q|LTi==GU_h~i4ftT*4+S}vdf-vn^x7GYei4iprW@Z zDdJ`t_L{V*pDX>>^2_J<9t!EEY)5HoEb6-G4;inyk~q7>Jmn7Z*w9L^XGb32Thyw< z1`*xzx8D~7aN|ssxF$5t=+ym#SK0+`Npu|@OMl7t#7W^^RrYNeZQY!lblB$jZXVdB z;0Q0v{;_?k@slK?(Eq2xp_8W0pPz7aQXsLI9SIimF49}%pw$n&>W-aH#E>GV?cGC9 z&e7P`nTT0k^H`L*%6lzwqB3dwQxVfyi_RqLp_lcA`Bq!w8OKq#4%TD7mH(b^7J>fu zJMTiEOFF9xc02r4`Lp=c`VMg`Ufd?;t^W)MP0!uOWreCs`ak|V^Ky^{obUf1WyjJI zm}dO2`o9T+%r@_Pcp!6bDAyZVoZlo)e!iZ5k~SLA6(pb}<$tdULu4M8D=<{i01i4B z>?)P#PD5E&%gT>DI6N%;zidg^Pt~8c(+Qb2{N>pRir)c0RjY}E-TC+p3KaWpvG4!p zc{QF%@%c(Zg3TgcyzewNDYgQJA7F{b_-(~ib^MGJiou!Ok{`6VTs6MFFL;dDD3@o>+?ABEhqc0=0A0z z8XkoU<)BSOU~m4D=_7G?x%fn%&r#Pbp`+O4bL@o~T)wTbSxd(b) z%zij3Y|)LKgS>y%@XOij%X{we2PO@W!=r55ddZ^9-WQ02Fp=P*SN`+5y=pb3paj}Z z-!de^iTnO&Nu~-Oh;a#1Ai8hP6^T;1a0@n#vsLBcW_7QO?sZ);#>;!9mvg+!WN`0` zUL9j3MgaKYZVXO42qy6c@Y0T|HU%vk(Vi}>?0Bm7Ws#yP4$gUEq#Ta`7;lrd7zETS zw8hLbu8PohyPEU#RNQp1N!4u?4f(wLus@s_al=QoaYw+`oxLU=SgN0i^E&2ab(x{l z5)0)8S4Hz@y=cMzGCKV7+evsxL8swXjm)Bpmj{XE>Pvos<unJ2mJO+gSuPUHK{UJxWh2HpI{#4EF~u}@MP|jKI^ZP=#s}C0%S8O_ysT#AK#o<8 z=szj91bj5*lkh8G1Sc)TANHIbNMMs(bqj0C51uO3Nf+7jEG4kaK%eVJ!_IoZ8jyLm z@$>q|8UyrmQrCQQ_1lHKgfA}dFWdEHREKcpAOSLu^Lr2jRkJeX}BnV&|% zoER&-nEiFbdhP7~YuhiwcI0a}=NogMX=@h&;mTzJ(@;A9%lF}GCh)uYWhNgZjd-37 zbc)Ixxk=Ht^fRA*TqpT_EW_u^u`Rk+VdpZq+F^w zncgizl1d@gbBkD}=^z7A9B2|zEcD(X1G(5ek?3*wcMd=yv8VnqTE#EqRVp|ql3ZN= zp8|r@Z05r^ZyOR}6ASF0Uq2URdyO}D>44bPokb5MU#p|SkH~3{FVc;dk4oRwe35_k z*+st|L^ILQ)!F}hbx}6-+mye%b7I~#f4=Ru?9qdh_&?i8+@0;sPj=gh{X#y7FImq+ zBJnD6iya1#lH`%#YIhX{&8Xl&BJ_OhU-NjQi~U7fb>`Nhqfw{CHneu|<+GG+j;?O$ z_7l0+;&hQkh8mv{-wSoX^iAu70%YWRxK)I8SQS^2N&s9x zgFF3hY*u!t`@G+N$B@l?{LzwI#qiM8M7tzHsRn0_>z+e5dW!_l@n77Y-b*vqByeUP zi)irl8+?!?)$FhTSmBYcuC5DOl1Vtpi#3Z7mt)puaE>=+kTWwa>)OG&fcb}t!!J<{VS{DMC2wTfW%;I zb9#~xAR{DgNnn$miUr7^L?B8+cH)0`;x;O(QH>k-)(_Zq8z*)}?8c4Lt5!Yl7<0}w zC9pHMBdX4JqV+M?{1_kac*htvho!Oi1hOB22cT6_?SdV%JZUZ%Sp&qaHpof<3b=u zLU9BgR{%Lf*6uWCJ^c4{qA60n$GN;La=XL`4iYdt#e()sOEMl%ALRF7FCZ%_dEp9E z=N&g&zE`t-)GZRUs-uA5Zg3oMj|KsTg{ZvrRhWR5A1H;GFzAiqpw_@{#Q8~&BNV*f zt%r}^!g4iFrq%O9S6A0Z6C+1mx4yAn#aZmP_Azb-#pw{-u5XYoFf0p@oJ*6?`7*Fu zS204Z$XoU8P0o(Cv=tTA?b+^U<5BJm(~l$^5Ugrz5#?Z(NLUK4Cf`Gy$=Z7?2b2Jl z_F= z=`~Cjf+7Aef*a`2*2fys_s}gw{^_3DE7mt4d+d4bCeHtYATGzsv0Fcn)GLIW7@a}+ z9RDCiGej;h$UwvW*8o2?Id|pcv&0C4AlZQMDSs2D20rUEXB1P;B=BR>pEO$~HIlnH zeGCT6+00#A#wTU|0B4Yka3_{Q07ZB{&;(sA8!(7xAUKGH}${gK=A^21tqz26SeaOQ&3A_|#-!#PmgzPBD^*Lt?`& zke1MO7b>+Ky=4MeWcPQmfeO68^8*4EXiU}a4%(@@lp2tdq^k~v+0KYEp+J{mdYFY% zhRifhN+yYMpb?ltF6(h3!zWhNZg(}km1FTOd?+VCXQm93P2F_UlbcPdVWfW?-N$#iegQ_ z)L=Ync&J^7Q-n`gN_{w_4;#O>jW42JkB*#KHJwTU(qaX$*gb`!c{#oR50OjRn*eQS zES|zv@x4$Os0Sq*p;ABX4~UaB!fSM>!(IWPB)7eGK48)O!`Ran-nGnIv-YfEiiXWz z1%Ic+If#ey29j@ zsIg1iXZsnfiU=p!Y}W4-gX|n8g9K9uLJ)Rq4*tppbeTaO2c#mTJ`@s{!NXdgvb)$m z`(0T?%6~-MID|{LW9%e_LWC70Rb(;OV6`)%{jp@6%pI*z0B(SZsE?A&0hv$a8w(GU zp($ZGSxi*Zu!b|vBI#g5SHoR5J+JxDTnKa^x37fnW)6TlRgPp6QGWJv5u}jtXLbw@ z1~NI`37AQc0pP`LvNgLM15@``BQ-0AzKMVSQjD|1HY%+xBj#9RBp)Qh)8YiYc}+0G zP{eBe6rl*cr0gr1F9}!S6O%_3{#yrbT|7)91CS$UkI-ANKhVLM*OMzhEU+sYWyBea z@=fbOJr}q4_>rj>d`n9i1v3H6!eq(r67|mv8Lc9cLJE7_^w6z!l402jWGw~bim(;S9q5fGWlDIXn217~jBvB)aNvry#>ueZW+i-HY+R~p z&=;J19pTVi;$HxN+s#KddAs}G_cbpe7up=p=10}jv9Oy+!AzNY@Oom$91sHD`P9n1 zY9hn~a<~cf?hXAom|%x=a+{m^K@jA)BvuNbSH2uo7}+LJ?j?5p3?queXA2048$}J? zrjtjFWtsx0#scCZ*-%_ZN-#`A?$Kwd)$h3N^ zzAZ&wK!q}ik2_RFLkIXuJ^ZMy9!x@B4D(&o zyVZScvS8Pq{9W-5wp@&-vMs`4z(vS+vmqGlKq-7EXROgD0VMWN%_MJPH9{$>G{SGb z2}^{dm~fP2o8rD=)^U=te=)4Kw-CYlv1SuNmMDHK)n6W`o0lQ@s2Pd6K{#vF{=MnL zVgmNLZ{_KwYcx!tSod_$b_cEg3Hbm~IFY}O>GpJm{0q(#nBfbtAii|j1;r&Ouc5av zGjYc3Rd`j=epIYGE;Yg(1eb0%-A?z!>{V4F3H9u3S4vFLHNjiHu{!@B`cfrjazBE4 zx7GA<>I{bZuV%Qz=s>y2gztB3Af({1f3lEba#w2C%KExo{4E5nP#_No3Mys<&v2Jb z%>e;8@?o&g_L;N$tOH~i)fRNf(l%Z+2T=WQOMT$i(!Si)6ze$uMJAC?R!fza? zUKj4)3Qb{ErawpV2IhCNN$MX|R2Wv1v+d5&|kpsUy*_u>_8~ zr+`hBHK)Y@EqM*;iDMaeIW3wL^c2!HdtgsY$lsT15mY-`cSlhX+5tdY?iA_^z=I@f z0V2yQxD7CmX=O(4EX)G9FnSGg7XzK&FbRZ9xYOshhlmh*ysm?eL}3MPp5IM*H?73N zFHqfZjOf-xG6l*<=1Mgrc{8$(PTLGhCBHMHNA>nQ-7}d&dciiX&p#oA-l>&#JeGRBPC52xz875UK zS{m>uAv`(!NQpkAGB|3rG#!wMt4K4jCnpS@k7_cnt@po`0%|q~??M|5pq0C2#0EcU zew1R%on&E5#yvKWUUtJiBdSkHXks|f6G0fe%>cGM~$zIZii z6t|~xE|R4RFPYSmh@ihD`8Qs@E;seV|0Suf(`Ht=u^J7RulQa|*uG65l~%u@!W#dR z^pY7Dk+?-#;OM%It*`wjYuE4W=zJXog= z9tlVAWV7g*Z<6m%3uqxhT6D9DWJG1tU^}id^AdQ@i4<_~??ExZ?pKkNF`AFy zwBOgS<0!zWu~p0$Y@K_g&!c1O3yY>rfg488B8;}uqT+irgor?9Jt+s0_?Y@>;nU+b z%B}Yh0sGe?GDE4CS9{piF@#2`=!`?sz^JEYq9mOiw+KD32)hN5JlTIOH5Lf6P)Cv7 zJp}~eZ8RFyN#$nO(5m6uya&7FTUPN89zP*GgRM=vQ+BvPiP2b4ILMc=VdLal~bm{3S++_&K!Z+sYmhr^w(KAYg@r7&t;a< z3>0w`SZ$UraKO;TP0*P7ZJR9%tGrWE7)@3&H!TRo*MWXuWHAX$ja_IS0Y_GKaNyFi zyXcc9&(|RQ;#{Jfl4}@5LePTRp==%y2W2~?xeb*VATO3P+7PC<=f(uTA*;m{YPAKlZF}7|nmL=eq-{H}Ck~6$m@AV(68F zeywH*5@+OBdmOGh>azbsRz(=Yp|mGqq92YeE#`=?ir3a{h79JXBab`}k+!1JB6jHN~aO{nGWe#Q<*$6Ee%>>2>BCy0n zHLTpcUfDDIrw%w{g;3<%nn}4<EABZ{pr?9Y&;(f!1lyeFt0& zl-D6H?yyfh^#Jr7jm-nfAHbHQL6ItP1c@MwNu2MyJ9d6%zY2)60!g2xR&o?aa~MPe zRAZie)@-W`6k~uG!a=u^y*yukAk;&p8OW%0{(pKYaS70X1dm6U*J1-oShRHt9*k|w zI9eE1K%a!Uj1pUOD|nsZ+r&|#7Dtew$f%CDkfj&_Dgurgyw2-H;ZUkv+l=H4HP!YW|b&M8q2&SvU_`3}-2!f#TJK{z;r9Hq(aWmgZZP+p&Q#n;@3O zU4{uOpjO=jwKgJ$Cu>en0bA{WV4Z%1@pIM`W{e6-cM!;Kwp+zU%#C2%s+XH5hm1+n zTrzybeM^x*unO!Blq~NJhLv^!LsaJ#x0LJ#=kc+F!MUm5&puM!SZIjBC(fO|YVgEH z`Ldo|LpGv+uRPLS40foSaxs?tY?<=V{b0uUGX{A;Gqoc5T3&*5r_J=jK`-{g* z*%7&F3ROojd;<&2S8lLC)6P*x`8d!mC?vJaSR%a;Kj)F`UMv%=#SLs*_uTu3n2z3! z*Qg?hL+(HSNu{fBu?ULcEr*E4Y+-prX-{!2aUxgaok};lN>}JJ?mZ5bGKQqG^Me|s zk{fDY5Yb;^w?F#gV3cVBV9Pi`u-B)S zN@NIZMCZVSwvM5|Li=B1!WwEr1ZmKT^>hl!rcsy@6$=A&4R?&ZeY7 zm9Qd)jd%;Fi(vQ3mQz-S%}`X_con(#m+%;w^ft%@cIl;{o`8}vZzH!2!$q%vGW!)P zW#xRT;D-`3_#|5ZAWf)_8xvKDd>(ga?_oYyITCFEmc-2 zci4P}gsBcMz#uUj-rjKRnY43r=*Vj9R7N^$r^RixYo|iL!v1-us$R7jIesXZ2h+=L z>{zl{FainNAO*2ZC-FWA4S<;JYB{J$&QU5AQDy0fzywPo1m}H*RTo5r*RioB=1H(# z_5nfVY7f3sC2Xv> zZ5(zzo4;vKGk_lN@Kz{I6yt^O0RUw)me5>jL{MfBBU4QUa)oA>|Tdm&Kj|^Ct zggl4Sew}DqEF0f)yhXKZyi3nY6$=mFWDFSOQPK-C$=6el7L?!P_Ks{>*gd9=PApZ?d6S^5f zAXP1q#C|3OY(Vm@ptOOK%RDFa)9ewTY9Zd5+{7`(Dxm8-#E<``T&3mEF6Rp?-@1PY zafN0Z^^1V^L+tzb7hSo{<8c;nFU}>P5UnXGJ=~|0vCLacTs%JD3@Sj4T!=`# zOhC9ElzcCpQEbYO3LqMWMrFQdF#%Quv&5AUFR6DAyMfav#3uZ3)arrtD!m;UNTiGM z)%%2cu%awWffr%)GcxFc=O_S+iB}MvJ|1Z+0u8(zL1H0)@U^moekI@CJJ{;0uwcYz zv6VCYF`t1Y$HVQRjiRAK0>-n!C6I-cCG3!=19C7VR65|{LS@M!SxPkEZ&>5tits7} zO_;*cGPH~E`Z@iem;cKG0Aeqh!-dtE-c_l<0Q8?|^uoc}X?O76IFq^sx zQZc`6psX%<6!E*<-dPUa3B>74)$LaALk-3M&Ah(|;n0rclykumU^TP z9@qe4$~X#&t}1BUE1~n)ioh(T>_e?jOfT(cPzlUWi|yK=SI4Ov=}U-5k17qbfG6;G z%X1dQNhxJb28UKN%wSwz zSW;Op@J#dp!{vI%XCV(dWC6$u^C~bvx-1 z@2_&%G)jOcY=Pea$#i_E^HY(4)FXoGqmhMe zT%BM;5ee&qn}U)={D%hQgwIqyEvgriV}02}^D}uO(udJYv!TDjVjNO@nVApCAQhg( z+9`a;7~oKm6~I6C^+x`m`4RtkaGcR7)p(fX)Qs$*6sSf|Dg_uJE@6uf=_#>_0Cbhf zq>^|+zUUM#&)Z9hW5njwb$Cv7aU&ZvYdFbDSSngk*o1P-(_!ejugR3s_wHUgM>FqLn2fZ`f1xs7*n zlFKdlIhra^d2I34P%=J0x`SUDnLML_jV`8O)@yAMD5TEE2?;HF-#c|wk_bnYVom@f zQgX#oiJ5xX}YyiM- zFf|_AnyUPq)bn(X*f{C4@}NZi_Lo9MysZ~F$R9pr49##giNYO zQ4YHk^Ss)FFHe6zv{3r&@73q1UJMzPC{@c$&{Bgi;5m(-AE~t9@2oT+&3LC$ zp2CXcsp)4v(J@)5C1h_=pbCcJj4DRv%0(unxvfOr@SJ{ZW~lE$g4U18$^5W6|sYbf$CK0}lIXq_C|5LNmbp%ra_ zKcBNtbpeE@Wo{Rl3|@3kt~R6ABA|`{j4X3BAY^!_nR7SPc|0*SH=9#E z#Q#P86jTrzJ)X^I-N6w8>go51p1P~S)(F+7$jhMc)QiVRtNiK>V)e&PE8+=*`$t3| zwN8yCC8K9m>sS?1$BvEUYYgKxzshoJbpREm+8OOU`+cFY!nFv{B5)l-e!j)7)0Lj`#zpKVKDpf_4qKe|{*#N0 znj9B6;wh*lGsrD%Yz~YMMyD58zD18V1*)0(f_ov73o8PzlAT)d=~0=R_!41;h$JEq z{E!{eJ{%;_6kmb@j1l3UKZ$3Q= zM;$}L)x;ffyn-=JMNC??N268Nj3w?@71L08z0n*rb8ZF=RWNPCMq1zZx#+x6T-wNQ zU$yN>HJ1VPjKU83q6SGzmq$htas>$ZZ?+F;2_oN&WH}s3n}nDETqC8r0~K2GHdxaj z0NPu%Gwst{3jEjqAsfdxj;4rS2?Q0190^o*riKod3*g{{av4rJI$zu5nQ0yrjvhw6 zaP=g5gp$h~&YZoRIk{%VpNv8RtXD6wT?Pv&lVD3mW2LHu1*9!68?x5wyBGhTIm3=3 zMP~0tAOOokw8SCh%OtPalwswV=5vBf;9~<=hfhU}FjUv;QohRm?ab+SfEZv2l!zHq ziC`YnZ^Hc3jM8TI0eG3IEg%05{w*NcogIGmt}te*H~uz(D3P^>u|8}awV?>&F3Q5^ zGfn^*X9`90?=aaYSVzGMRtV5m~j|sYLCNR$rU*VX5WC`X%-2n zRo(^VFvQ-$cd!Y41M7#q55M18+1>jMC0s3?gG(o4uDHk)M`GHj+`{v#p)(dtX-R1b zHP$4-bl6U@5(h~K0E}M!K*NK!?SnynSvJ|sYXHgD2w0NY6VOPZ%gp{)nJqI$8M?^4 zxom)r49I8scYGG)4BqW#Q9t^{gHZ2Op1L-_WK%qaVqN@GT|Sq;+=7g8Q(N^Cima*8 zgGAknqC#p#B98#Hs)R2%6QQD!e<9ZUzUo&RRn*Fa1yjL^o@9vNoy$72(mJ?UejA3M zTMv9nu!Q-SNI{TYF(&khUhIP+W9)npNNrAdEdQGxDA(C$)v*WuOAj2_sF@TBB~k+0 z>^ip&{cDuya7LX7N!v(q$>c1A5x$C~jQFXliIRPfL}>E0*dX}l2^LFcXl3-N^>hEw zUZir4c2328xvgr#f})j z<$yfzldA;R#q45gy>FKWix3o@?XwCe@J(c25fs;aBR!(_5I25M&WQ`;-z>F2l}D=z zW7${qbEkr2*h?60C=rW_Q~?|+9E;|Dr+Hp*Ob-FG9r<3SZkSH~MDS-{dI6O0 zKp9C2UP|S#v2?!V`-jQHKr;&!S@<4Cjg|W(KT{8*4U6aHyi@6MtOxB%?Gc^4$nIqt zaVV{Vp4K?>lS9Tu2z=%@P)`yZ%d=o8xPNd;qo;oSAempGG|Y}w2&H{zLxcjdhyI_A zevQiLzX$rL-4QtA?_R?|NV$ab;v@de;&<7a%VUOZ3D9WW;bH`5 zi3kN*Rc$x&OsL0?=UZe=s)LEFWy5G8Y*SOOjpC#F9=Q=s%UjSeE&Es>n1(BFmR>i0 zV^F~_-H11v-$nq#Qk?DJLO(Yml5;E>xF*|Pm8}vCYOg=$wLzMxDgeHrNA+IJ8&M~T zdTswbyZ78?(RPB@MW|#0LVCOG6c)j7UMidDG!L^ zD*cS5=5X;!gbx1x!2y3DsAl$VJgRzyYmi7>q~0SuA}mq|9kgL#{>@Y%;xv>sSQ0WC z3ku>$!9{GA=AmeNm~Z60S%>vvje2B#MA&(9{ z1oL!4p$p1l!a4Z;fl@0mn`U`ZRN8uBKE?zaFvBdNBJd*p}hXGX4ylHZAADRrc)&FBA_g`AV~6so&OG0x@Swrk*#rj<(DK^TZtacZSJ%{TA27% z01v+zGtb>|!cm+Pql?&rMnh@Y&sOpI6DkHKn>ZQ7muw%ixq_z+g}*oyVIn?AqIGrZ zty~Y4c$nJYPk7-$C*8`}t#<0G-LP-qP5&wyn(YQLAc}HxzFC0xl*Q$2@s<5+H56DL z{2?xckl2aF94GbVTwnQCs+rO z>HJjhN0+0u{tmqM;P_cgne$@~okDU}lH_ho$0XYlnT%qe5#4eBRcR-9HL6~~NerQY zG;^w%mQ`WJez)lGI7WxTj4na#t#FCv4j%K-;YPBLncOa5aff)N_A&-(wuI^=dkB87 zWq*c3S2M)%q3`cKErhLAOZ-Cf$kRBLx_9utu4Vmiu`Z68Cjv@s3yDU&Ld$=LzHIb= z&9_}OJe9tgj8)wehXOK*#0>TQN6Ju-pc}$Q_(iv)%=b;dWA$#Ie4MnKs^7qw z+Ka`*(w6lPT5-V`pc>(MIofJ{LNe(~A`Z2Oe}+0;RWG(*tTMT~uG1oIIxv-s#m&=_ zzDoY>}aHjYKx`zv5Q3N!8k9w&Zp~up-Ep zP)=Wp^pbY~KD4l$(DWt>-k=IpLLdY`eH)*MhrnJVK>a~WJLsPN$|QH&XQ(e<8q6-4 zm6Qj51kSRMl9U86L9Fci!py-ef^lb|>LT@-N!DYoC$Kx<#(o-KAU$)TV=LH%*h_N= z7wKqTwFC_gG(mR88%-m*gZw9|%f3g2{QnBQ_?B@7Sx!RFro3J48(FvV$=Pw#!Z`q< zErws7XK_e9ak!~V$V{d)&d0xSv=L7kZj`i=>a>I*tcnmHC?aROAGcQoGPY^?YkxcV zf2A%Gf*aWD810xYzX6^o025@CWhp*e3E9lsMeTP|Rmj=1k~6wyS<@4Qmt^{ORz4d< zq&^yamsDcJEK)pz|4Dm3ED%Yqu)Wi1SrX4`+DhQy5Ubj2Nvt>!^e_c>AUa>;xB;~u zH#>D@w4fm{f}51oRSTc^BFc&o*T6;=m=L!_viqvb*tuQ$(7dp6 z(-4Pc9P0RkF6VE>)KkPpC5Dx(O(97@UYU{>zp5q%WAeYKB!OXH&rVbjn;Hui+F*c% zmbP{nBeK9~vciyg5Ac2V9{zC3|BEw6@CtNZ!)eu#9_~02l2bgyGP8$f|5m>+1zW|W zxGAoMpVGPl_>SpF!0DYzf0>@$@Iq7?DDBip9I-sLXcQP_&>4eqYDw@tHnrgcA+-w~4(gY^+^4S$I1?!aCQjKg{d5A_PD3R&623N$=|?_;`fYm$n*~v#A!g!aMeS zlUf~FT8Nzl3)eJ1aMYWbspdO0xD+9p*Zh;m`VBzs$ zX(_Q5;@zwFp{;5MN}t0E2yqz;#jCD<@C0>U#obH?P31K|=H|{u^(MSxc9F&QqmicJ zL1(nxWM91W*_<7P=OQ~dY%CPiamP%qUaNCN#LI`jDpatpJ`_D|K=Z`1F{;S&`?xYL zj??&YDNgF0jePQLTB-}&HPZ^=o1N6KF4M`9u8l}`6=Ag{fQN>o)fj?RsrKUPm{*m; zE^Z`km`x-u9X&Ma(i52b{8@prXTi8IU8>JP79vqGF_H-dYhY5K8!aYk$jhYQw1@C z0J~O+Qu&48 z3Cl$&F1;$Lp!(Q(#XjjkgCzSLrp;;%39v7iEADw3z!E?Mw|)FRtQ8g(_)Nk@ryn%m zJSP5Xz$Y1-M#>X!OXU>3C|~sm$}1yEeEeeV8bkzora~}eStx+8^dVi$S0>$&UQHJl zDgJFScY!~qs%WXIe{*=eTt=K4kXEXe`tIBy-2UQ*i%U&D2upWDu~@A|Oc%72-2qi} zC>^rN4-A0|u`UhPwN}KI6G0&3yj#4l5lhaBX>cjKM>&-JvtW5xL71>D^s|HkrFsWK zYrCgC<`wHl`1OE{aNP24e?ZAfwz)FEb%RBaAuVO|qRmK$Bx*|k;)a0ow$wXrIW{T)a)f_0Hmq-kv9HqusEAEL8F*d!spKoHHQijFz-0j94g3i`mzjJZj&9Kn{dY}_LjSMS z9Ef+Lh!+%gw0WfH0J>bhEG~g1&udULKjf6o)nPg>GD>XD^2}&K%}WW3!~Xb-Zo_L9 zQ@|EzWGhR|oijLth6m53OYG;2{y9Yl7o_{?)BI*S8x?i0f(oyr>Lw{dN<%exXBr*d z)08CzNr^Jpp>(rSN@J2{jhd^#pTMY{MtgIL zelno+g!*D^X?S)W5OBf!n%5ZM@EMM&v43|_-rkm$Ck|DV+A_6ajl)+^pBGP?4hgLu zdqgqCv@>*x#*SzO&70oINRK9u3v-0BRgvKk;LHsQ$~`cBI!)yL3j$Q}m~Y&(CW6Gz zai;AAzTN^GgAosJjFg|HW!O`0L=7e_dtBrbgcF9WDz%==+yEWf=dF7RzU`OOqY>ve ztg+IB5gYq;C`c;xvqqBjb#cu9NiXM4HVQ=Q9TK#k1T+gSMvxA9xK#$?XQB+dzZ@Vq z#zpNWNNT&092*eJ%f-B~Vn*zT-si_+Vse38HFnQx)dTwA#_#3{RBge?@N3uw6z<`V zkO_@oNqI)-#F}+#)3XRc-tb)fhHVXKxVXRmP+G_O7$eX2!Yf7xeAHHf-D3L{Pi8(K z9~XUcj)8yZ9SX$H8ilIAGpH1Fg+L*V)Tg;Wy}ad2JdppXZ-wlPiF)^NgD3;0ZM5uY z6+NmUxE!S71|Ut`%mr);*#X6`G&R@1wEz;S-oCCnWQ=JGW!C)Nz=Z1WObsB?a6vh& zMchXA38Z=RT|FU}+U14tToj3R4u_3rQl$fc6hUyK zh5U(LU$>)AROKYn3-8GX{c4B4g>Q<%A%y)XDY%uYgDASt7oL{5BZ^S*XB0JQ@?rPW z8vFryM8U*DB7$RQ?|g$SKc0&1ZlN2%cPd4%$1wrWV4c0Q=_UPwuQI1W zBC=RzjzS6I`~iCkF(61f-AyWw^%YS(1YC)x2(ro86R)1sdu$zqhZU1lsu>+0#p$LX|c4C+cS-Lq-P z)T61>oC+TcdK`}dUYKAS**uo~qr(rTO4jPNbBd-zdHn%}d_mS$vnr}=lo3gUkh7-?N_3e4-mp?HuyK9Rtc28vX zB(*^tZ=@6uHeX54RQ*X-6MmT7hwg#Q3Mvx=2}e~y$yurgUlBevn_H)vKn+`hE1@ay z-G?-0tWSS0;3M)klWf$OeGse~zM|4Il_*7n5Z68eKV(yY2nZ5r?gx*^6hKv9fWiT? zh5D4oLgZ8`K`YJ1LU$CkL8pK}z{k!nF=D4U0+Oq;Rixj7FbeWc#WIIfR=A;|^0K`Y zOp`rT9{o_e$F54olfI2VQ$K51(5m^iBsu)pkV*bIj;6%vBQ7nMBCyf78?;Or6&DKj zgkWEbYSUxpg^on3;r;gKR!^tNh+UbDDNL&P!hQ}{UV!^CR6<1P-Cc? zOT{6!(2K!*a&yP#-gHS&IT(Iyf9ieRU%NW$bgkj4HIF^(b>?AHVO}LY#VulIG3a8K zvx*klUr=I#7uEOzYTk@6E2A8L^-dp7#cATGL(!n_2pQzkxENlTalb2&clVe5T^#CG zuhAtWiEUZyAFmg$IPw(y8h|A!w1xcO(qr1Rzycdm%7Crn4PmNXplhg~1tHNKfSw9f zzgIe4fhq1Go@9Ro?*i$#O+{K16^D4JT1}X8n&S1sE2K@S%z48{_f4adN+C1^Q;(&{ zrk(fV#B}dR4;ZK2d+8(Fb?BzF>)h`Q0~*8u1u>1@U=S4c!;^~3nrjxOAK!MreLz`I z_admUyIH)^ptT`%T#3z4K4$!&>?H{0cq?~fc6_udqOzl>Am&2V!pfQ;yR7hTaRo3AJ;E%%XJH2O_FB zDr)s*z8>~EM<0WOGrxZdK0vAs79cVG>g@Y@Z?`3-(GfWC1I%P}QJ{Vr5%!SIpch1!*xiDVVo(f#%(zN>AC{P(NP7QLu);i>9 z(}>y)wJ1&fgJ5?Z4=sKU69^2{VW1bSUZoEr;xbcR`<29@cBei@I8fOFqC3oQkA3|H0-3#F6Iv^fl zjwK)r_}#akM{Q;a086HllcNOX#pSKJ8FJ_^#}f^ISNuMPhwWT={}i5S3^0Ug`VtI_ z+9RWS&){ImUq3NSddunobQD22LSw@wIVXs$QpSYD$ZF+RTw}b2!Q%F2`gnt>G{jdz z9o;~ocoYqBb+TA%7jwjW0oZ_&SvZ*Kg+&!j17eb4!3Xv40}wfhKwC%o+-<0lhuB!j zGo_m*HT)zhrSNYTkGKopm^D&@W{)>=!me+pl8{1dFxLk_Zhdy2{C($VgT~@wKPrP) zd^@5S#50T#!!9}(C!M<~Gmg;w#=G=8PMr#STt1Gz)Ck8~i5+oPU8}R@Nbr_DT|?^z zd{F(9d1Bblmu_h4PgiI-&Y%X3kig&>4l(s$t|HRU$%Q{WrL-)EJ!x~UB+?Ok~Bu zfhr7TXDK>kFb8O8hYo_REb&=lw_`d$U^cXpK>sf4f|`X$IVzP)_w8vSVeD*k1|PZd zGeX}cfnp3rpGwk?L7*e6F&HTTS6T%n!~=lIi#8sVQdL;>cDShg$rFr<8!E6t>k#C5 zqkbu9UL+;|TjCq&jk{L+o2O$^>Zq3J;~@MsM3NO=$+?v+)1?M{rQ0Q0x3MV}Y&~E( zKAJk#rrS-0T0OKmqB}t%)H}GphNg34->EK=7*Uv%Q(4f_<8sf)u27J-V>TeNWS{QR zDvVhp?Ra!2L!T3jY``YoLYpCY%BLxv=yVd+wMd|Je2snLTjdJYu0BhaUKJNt(RJhLPuTRV$%e`?q<4RY=5O29oNuXK}Cw{uppBj zOx3i~Y;fU@5hL0N2J#6ohk_NaM<9Qo!6AA~?nTA5s+dOdk+3SkOjrSqKOdJ#KMe-p zhAmc-4Oq@fK|Ymmw4X)Ir<*u0THG%GWaZDf6Qw=Leqld`Vd>onXp~yJ+iVq!q`V6@ zi}5no^~19pI7)bmv_!$X8W;TIxANi!xmrD7<(BPtd|)30*)IF`$B^XvMugw;7RBA+ zYx$paTha;oY*08bmgox@-ZPy%v z?9-O*9Iz6!if<_!IBkK!Q0_0-ww)-VmgWV{8$dk<3JFDg^vf3kD=JJry`>3Vxr7ke!@!bdnP1;9kA20#++pS?!3?h}qdo5I=KW`SmQK_nvk>YP{5i@AQzp5*D-TDb+s>~%nbl+Yj{pd&s1kox(1$DQ_>3KVZ~9yWctwN3 z`@lTpo7@Kv$$=ysbLH$&X2ZG(x5~NE3`*Qp0E!%Gb&;y22Fixm_}YeX8Jhy5$tr~b zS3>VMQ5nZVNMEJvxBYUAFy)Y0C0g^Q)EmQi<{wv#V}i<@H{?dOd9NKx>RZd`A`GUqc#|$tMwf6^E4zAy#4Y{R>w^# zMY$voAbj9Oe0&h0Bf%H;wQ3Ub;@{0J2}oGPI~35z=%W^$+zA82cru7in#k{82|o3w zu6#||9t_PkB>)SKHwPLwHh?xB_0ZOYvy8ekBoTXE3cWJw7#0x1cV6Zn4^;G>YnDEe zqNNcS{LV-2DYgTkiqcErEgsU|%CKgf62$ z46Up%0!d1Akpe4^CF?a{IS3M4G<_a51Sk_&UiW~|b8|?&HBv?Kmh04R_v3XU=B>fU zDf+>T;rN`Cm+)Y5Acj zjP|$k21nGENU<-hsZXL4Su~|~DZ`B4L@I!Q01<%VRHpMlP|+xZ8ChoP=;~(<+4-bx zD?E9T>^JS=XwB>26@mbOAg~HoFrm5`q-Pt1m+z2UrtSsho$kbbio4MD`&^qf99MmI zI3`(K&puA|b#Mqq#oGROM74-RLK)+VLBKUs%I5GLvUJIzVj9+Eg;0H)eT@%|xW%(u zd;mGK7SsQdnUgeuTc27G+GKy*e76K!gb;G^~nMueoTx~xc1&2uard^ZNsIN ztxOdz1wlrCCHjbYjuHV$cj)6?rDTrodu!zS8h%1GOKCAM7KHI;hSFQrTuQ%twejMD z@DtYmh(ll=7lWZzjF>SIF(fPoxWT^i_zR(Rm@SGB`(|Ng(H6fFN_co+2V}>UM{zcw zSq-`eL-E>d>UD6X3vm1i_g<;2GTa)HyWr)y%ltA8L!JkKT@``#jS;QW${r;0h{O5^ z*R7i|<Bu(%IAZaO1g8C0-RW%zbBf4E+51ITrh7I~T&_S} zd@2u6w-9+6kPXN8pWs{)OY=%)I?udy*e1rvuO`mmP8(J<^DRL#OnNn&PD-hG7_r*- zqKYW^w-cKK)6o_6LhbTGWQY?QD%DyWt$m|n5L>4fhgq9KsU*BOm^#mj`38J%dFI$7 z1aZQQ1Z%WT`;04X!hu>3noW*ofJW5?n#O`g%F;isS^%WvP{Y(grSc_VBJjO+t_CXL zL4AU_>&3rpzuwq-%VqF6q5pn5(MfjRsbp!Fc)#lVRyd_k z6V{4}P{y8n1D#(tND@QL-1}?eIfV2p?FxklW*19T$r2n#m3nX04)X``5=0DM9m8ig z|8BOAD_vX^xE<7-@uSE75ck7vp06gW{?$Fh%jxo)*fw~O%|TxemkXSt+77%R)bKbE znY38DGo1=8m|z&kTHnljklAQz09#h%TcH-*8BiJb6^L@Avx8gU^-=wC>;{ZlNesSD z$w|_?yoS>%V$m|M1|mfIgAT9Up}=q97U5)U21*FG1AQyu_P#CZATXoPoH={?E|CQjP;s`TyB*m!8COFtOz)?6PbQM=zaDN-XqR?8 zEXbt^C7S*Pk&5qfsMnOYkCLj44qDqg0DLG{Q=-=j6Qo}@ji3+4g zV3$}pc^d(-xBJU0*fso*JXa(RzMQQn1$v32CG$3IUalezf(s%et+e3D(E?VWJFw*I zet54-=ui13lu|RF0CNh4yh&CL9I*tqh?y($?cI|$v0xve5;1Keu@K);fS^~&mKWx~ z1&8d_2GxPy*Hn>jc-krYwO?x@^0T@Gi3jK)Hu0slsmU;ZC={r-NXX;%d!3;N3WsT+ zL@g{96u6-r08U_}b#Q*M10tVR(z$U10r`?6Kv8)av6ID2{pO7aZpBs+#M-Mwl&Wb!_Vf|+4+4WJM)MEFhg(5`FrOh7VE`KQZq{UKYRHEI_#srANSU zd?pW&dm_ql`&RCo!a{z#9Pp%KW!ND!=dI|lWVeB(~A2&^@15O-AkAxbS?@C1SmmK@M%2|6>7lX{IEmD}8eKa}i( zL_#`DzxW<~gIjN2Hv~jz4P>2k$UP}IIKg-;ZWz4g3j1sP88eU#=Jno52c!l;DC9oq zaSszowg_S<+Ii_ASu~z=fqmKdg+vaZ+3D|Ce`x20dai3KR(vty>!|y>VxFA^+4hR? zWb&CesvjdBE8Be3Kv7iKAiq%+gsQ1lP>YIIOjL&c$*y#-mDesUG#&@1p0MIPCi z;;30`50C6I^wMV8vJwtuvbF`J%#ZnK;8T!$^r%XY}N`L_zMI;yuN>Q4LIr3S@MV z0VWYSWrBtfk4?Ia1J5>&n)I8*R;nt0HDwYCCwYqrO+V&hdhr`5p&91FkF<3I()Ce- zUhiZzSdK9^j>y!>JQK1Q`VYFuyeaZ1QUW8ty>X5h*!-u zc%E$u+Y1ilav{5$s6~CYxG8b}*6KeOgDb$H8@EW_N-;o{1r~73Un7ugvR6>Ph_r7p zHjHQIuZ25KknrU4b_$?GOx_}MY#5|lj}B7iZM=H*mRKBKhX2>Q@HDoRC|a6@K!wvP z@gp9F^7JTVL`|chY-Q2c$aFD^y9Zk0jAdArU&z9+2CBS0WAf8du;W9I0TB{V9j zm?rRmAjjw}fYgvGrg;B6oIgmED35?dmBfOw-7O`}?|V9lMz@r+Vy3rm**Fj;^yt{o zN7GhXMHD~I;*CK>TC%tewuu8VQV*dHw^JH7ARf%vv=okv|2Dz(N$OcbKC@Qu?7R~e_ZDLKl zy_M!Re721%z8AQIPdsJ&gewpcm1f;qD@E|&}u{YrS~X2ypz*qg zWl0)iDWp}R@Fk3ZW33YBGaO-Iv5;$<^w}DoP`S3o`kS$cF@(Y)V2ncOYAsql{=`-; z11rmF&GIrmPX@C-)9sf8naU}^BI;Ob9z&HQhIn86Hh!Eh0#o&Il)wx$8SA_Hvjz%X zs@rh9ymi8Z0KxF5lvVMS|6la%gssG{8B`1eN9kvGzC|XVk(F=12Ho=M?+Nr@yDf|iAOyDzTyhL?;+sn%^79*t zT!!52R)@;sLkP1nZMF!HJwi@R=9j8@_3A|u7#(p4!wCK|C+sWssaw!CH z1+-rvxg_IRCM1272sd51P!wiZACt~`WgcA&1=>_seyYBQm@WRn%|a2w%uL;k8)=(% z(wM~9vuubZqdlsXYG#u#d8@tLkg@`)>h zu&lN>W;%XyZ!qkH_%ENPm2*ylq6jF`N=GLvjp>2~fM4B{MNqYU^^?92&yz)=UauIc zA&W!3lg^94X)b=!5J@2hg+O#Nw0ow=okDnCKnmtV+NW-VE1lp4;R!I7T(+Twlwke~ zHPxxUct8HVvd6P;)K#i%#j2t&+(36lv4kpe8KMK);??|dL8dUSU^wo200#%m_X?xl zGQ6^JEWZiEg9N=V1l?AmmOO+oqBqwd^$BnN1Fa=n%EU6TkX?pEQaYk?xa#=RGju1= zO?eD4>I1kD{}$v;i;d#dI$sI`3#zNEP~*8{$b1DaT;N-eO$X zaGpXcd&Eey20BJ0Yy1ZbgnJ`AKpJ}%(3J_4~N z6rJXS_>*Q@s-8;sWKC^?PJfPuaZv$`oF0_fs7?|Hu5@9E+X`Wf!hwPu!GzN(Mg|i` z)Q&)-&n0Z58M{9OSg|Nw7ZoMhvjBn$i_R_8r}&pw+=%=~HXlI0O$r6km8l0oQ*|&n z_|NFtds&`{BMJX7(`GO!T|y8!Gj3}G8bz3Ne9b(2RBoY`&j!(DK|5%wd}pSV(K-*OFQarXA~zi=`D zI?5TFO3Kb>FPU0W2W%L2ChvSvk^?Be)1DVKTJZU&>HgC_sij&({twbaYa;!1B6yUT zQrzOYiCkgXmX|jhd^^~elNzEl!fKTr)BRxdtd^{JwiAAWsaQR?_UT&8W?8uf1{yL8 z5caC%k2AYi66QM>LxCwJu7D-g(~E%f1-{a%ngEay*?&&?W0)WueuAlSx-zv5K}Mb) zmh+9xgG&Spa|NY^W+yL)_(w%xSn@TK9(57FEkp)QOsN*iH5?032Lz!jvGp2ObREVG zK#>ioY8WxVzTKZKZV_oNKbl&F2eAdUpHRFMbevw5biB`lMe?>mU9}AGIt+=_sy%~s zZC>A?L(V8DFv5|7dUEt6IEeVMA4#>I`aKU%;1NNJJdJhzMM*i!us9)hkm5h< z#44ol%1#^WmaI)dkks0Tpz@nhPfLQ`?eQn$VF&bDs?yjG0ak(tCVhXk05I(mts)X6 z6HbT1rJRI)Kv?JetmZo|6PSq~~!{}#* z68(L+qDU3g5uF`0gmcPeE+iOZ;C)h3&pKsJ1`2?<695%C$h{ zefM(Y+g$t^0KhRJv1yo2H1&6HTaWjl3@;Yd0PU53uoUrDG|yx@2B%D)XLl!Nx~%W# z3(1sRFDP-JZi2Qz#*+-}8L?dWL<^8zB}j`Yh^*s_xPVQQR9rl|(fHA+wW~x&;6d*1 zDJ*9~5?!Dxv=yiKz>aan^*mmsT+8S-A_O=o-m9xRfBaSEk#;h|7497cju=0KlW38& z8KSTV_~m9^w&x{e{g}$)!1+c<{-)f`9&cxqj9r<2YTGO~JBF?QQu_-RS}>T2-9nNa z;CqbJuSHU)oCs8`3U2TS+$zOSQPE%U1||Ir-PJGTf_qV&o%Imr)MvA)F|ZgudDAuu zk!sV%0YAbZ1@dsW zMa13oAdpcs1}F4$iJAB~!MLC5K*W1_kT5Njf7r#DftSGg;JI=ktn5Qr?vOiii_;c= z;wiXIB-2Z101LVYhxGBl#C#P$2oxBsbym7pPRd2miC?^=R6V+^F9Gc%%;3jwhwMrm z(uo+Z3%oQZpq+@!4a$LGLcu0(!CJ>Z>UK684Uel-JC}#;xha8e3hsOgj)r;Rjc@i$ z)zj(<#hunav$RmUuk_i0Raooc&trOUatZmhYjwJ)F%V1-G|(Sh#On|nJV9%!inF$? z+^rv|BQ$-YL4zzs+pAa zEfy(21i{CbojKBT5#_#?irl~`$M2~DrRip=0~5*oqK{Nv?`|DT=%7p287tvc@hWry zE4dI_4h#vXrN_=pxVnpK$Ou`!NLAPhM%vUDBdu^99;w%*UUKrQT#z8|kgkW*xrL%u z066U^m9}W`)rc>oI*;O%Mgg9wD+Y!g|EA(k88t>t0E#ZMnRVFTc(ubP?!6`UW4(J4 zkxo@nt$e2y9DrTII`^ng0wjfDJ(}H=c5b1k5kK2J*%bG|bDx-Z5~(q{O{?0}5*33A zV=PgQW`l0k8(dB3NArY(n>&2aP!R=?0KhLn#$JYZg0vDGrk#KxL$OwuLHOkhUaFrI zWr1aAjKA8&)i^L4^}*W|Lc)U(4VYESY{IlR*${~7#sU2ph>X~0u+HYJqLHg`=L#$t z#0nrBUtyl1SEEUG^jbQ@cm|ofq^u(L@eJp526D?`zsd}EifLJ?jZ62LOs;b7Ih67P zzAYSp)i^6h#B#8NMYf+!uD+14&si4nm@uOr^;#?!YD^r;uRJV_PG9L*uog~v49&zG ziY$mNNikSFDBPOuK1^$-pbi~`L0fR(bW$poD7aN?faGN_7}t^i1$Y43XNc)QSDASHt{DPW&9RbT>^J<`$5$KWmbAf@Id8TT*J#X z_PmzP#FsWi5+~@+OViBTo12x4(-K?>g(EtjO$IV6|)#*z9#MH||1+l~v6fK~ZlCPu$i3?P?Gh{lLqEeU; z(9!CH*^U)ahQ_G}EA-=P%SxCk;z@uFqXy07!RkTn*em@~Sp=Jv{&{x76g!8r(TAI7 z>?iKimm$R76~|8t&noydl~8H~1j^A12tUXczyd0HFmW*5@DMYBhDu=vTMs40%GDd9 zc}yW{aSTI|{Rpv>I*8Ow70Y?CF@fDCf%ISuf9n4WDVVAX8B-tbE?h=p>V)Yq}Z61^;_3+1p_TWMcl;=)u1O%O?q>gHV z@fgI6e+fUuujRwFmrj7VfrCVyPNqPW)NFSN7#N?9Cx_b_3=LHsaP$yoxJSD+lk7y+dtL@WYIofgQoz$4wk1uZZ>5OhPwP zh8*bp7&D)&pxVBG0c!|rMVh2sl4GNp@rbMoeT0bynPLy>i0y7+~B;!S001TW-cmyDh9Krlo9?7;Oi|(xBN${+4 z#)wN%3cVWagr*N3onmM!!r>=~$-0Uz(XL46?Ek2O)7A-i>pO*Uj~Z<~P?0tY(#b9CVNCVBz@SO5nPh9cZGf7g-lau@9SAi$8a1Rw=W5&en@-)ZWhhEukV z4zQi>2`mgqo*(3SdNuK96*Lh|(!^}y7R4&%o3^3EGZKD~(PV)YDnzj3D1z~*Q0LO; zBJcq&+RIZVHDb*_jzKTf`*HuYR>y`I1c-tF4bewQhQ@ey>4s1e=FC!+Q3y*2F9aE3UDS~!`|0552d5iL2!U1ht zF^^m{+LTnWHA{(VVKrq88TZCa;p5Q=H+Shm-lV#W+Z@10aV9@J5k*#-v%f(0Iboz; zwL7_i!zUYB!!+IHHAP7q0Z!!a@c#Oe4Bdc&Ynh|Ib z@SAqMta5Fden}$;ozQDau}NHwzbJBVLm~8s%nGsHN?uz_3PvgpMHZC6-z_18a*RBO zxL7+KoS3S`Kmt_~Py~ry9m$UhkRhAdcSI?_RZSY9`AX&RClA2;`yxgwoE*hQc5?Q% zF)3bc=;y>5$)JRViLJ2H0V%dxF&mb|~HZ zixNXL_47cmi2{c2tccTqZgsiR$gj%9b(Jf%O$c12^hU?>o6*a(iWmQp`Q5p zb5$D0$nYqjuL7wXMjEK(q+qS>;_MQijrB&?%0rj-;qWW(Z|QFj74d`EJwYx-3S`~c zQ6fCCWIHB!LOH4cp_Zs5UtWos7N84eAbJw@QQm{HR8}I>53+2BCBjBw1KV7yVTL`0 zb#VR^>L~`Z*Nd`n!~b$pV(DFg+EE)37LQ%3f${$E9E=HbdDB~>&HzFzCla?#`@h3| ztn?5*qH@4Lw0?!SgxAKys~@rX*flM(u8~JIJl0FwA!Mc^$ZfhPfTKXR95QT3FSz1E z+LL6ArchizH%$q`%kfbJ6r1w?_C{(n>`0I3C-+vL$TFIq^}S~|3j8xuZKFwG8#$Wa zo;3H`u-WQt|4i*obAkO%sY8(m{^Xs5Lz`ae1$xeryFubNP+(Sx9zC-hj8u`Z?1b0L z49Y&ttkUJpRS9N6*Rtc>>*|S<30(F?9$(BA#JFZs>D!0sbP(s+^rRUU%w|Qw?Xkj` zPaEcZ;Mfodc;=z=q)Q!tGS+~ICR5tTBTLwQD#d8ED62FDE`#p#=1*M4%h27u_C9eU zM{^y`jH?>*x6>PHvh%^Plr=Y5Tohw{X)ZT7=O83-L`aKWnaN5RFi&W5{BhV$#0fI9 zu-9no8z~iwkx{g}AH_5OMpl<*gA)LtCa=Xp+1Opm2>8Yg#oD0J2pO4F86!p}$jc9K zj1q!>;MT~4YneBhje92 z^gFpnbPWSQW)Y>Jwjl5Z+j$a@lWDRqK!f^TjPy8=s$`l{q28D4z)Gp2Z+lN&V?xRfhMs>4wTAdlIc_Go!q$ zm~K_%1?DxgPt>$~+$x&;r$|(95f*9ao?nDU!ZRS;hR}`2gpXO@oR}hq{;LLU_jPPl{@ac2|A^U(PZ;}(rI^%CUMxHzB((4U*7K|e%8ofOn zjg_jm67fR~;z6p;veJZtN}}fkhEt|I_*~2@A^~&SY$@;fc{r0Wne2j;de6Csi^yim z%J}jruW*7zSx&B&Zb<{(0bap9*xzqi^_F&7rOfcv-b6$KVW*(4EBRdA=xYx+YZ0Lp zfTasa`q~H7io&Yjq&;z;YRK%zPzqUHelShTuOd*sV22?upgiNvk-w!1RCbK-B{Z@O zA*?#!M=Z|y2*y@*J^^rOp~cz|&t-B$S|;aM(JT=}w9zM@R9VM=zCf*L@+AmEYN4Y~4=(5F<{pEn&=@$y306O-epK9GY+t{2G3kt!9_ z9Rz1tju6xcFOH8m2Q)~F3JcORzVY9P1)EJ1WABocc)UM#6DArRBh~9P+Zke!9K$Fz z!j6T-K4(kBzj1^?-~6mb*x4t3x|`n%!Fk2=r|5H#P@E z{Z0NypH6C{iQGHTF*J^ffTYu$?O*7V8k8bopv;*#WL;2;P?Uaginz28i+L&Qo3OhG zqs|tP+oFSRs=_WJ1*E z6Z4BuF4q2POUkZN4u7mNs+p)HaX7*LwHt)vlf)&7T2vo{k%FBc*E09*fMY$;!36Hf z6anJR2Z^MRd@{D~^?U-H8C+}jJmS5&pQ0nLRjiSwKj0m}EEbB+mKR4t#2taTC*w;J zD#9@){Vo1;e;ji7sMUJ`>WnznSE;szym6as%Ma3G%gW6blVo?o!Ge~Hu^9Jn42U7G zS6$lzFG3F>!xg;XTcs{Zs-ytg=+=Ph+*4b!sbLy(dj2_N5XSf(gmY#7jq$~pTt?-< zRa*D#b5KnHa_{?x>s5b*XsD#105C>ZygMq)G$A@;tyM$`<#$-UhNbP&W5(ph6GqWpn2RKuN4o=>x9B?_0CLRUCJ+qA{ycSoi zs)I|O3$4K}41D7UwFyIjKf+=?hIB1M~Zm99lwMPy|S>H{7_Gu(H@`~9FpK8*EUlDDYv znWYRRkX1Yr(OQ2O;+6^W>34i>k|?@E@O# zSM!bRLxah&lkxO=!U@hzjt?X*O1F{NEmay?&4h_9k(LbtX|+T&hpKSay=M-1 zc;TiB!EF}ibw$$pfS==>Ay8?86XL8&&NJH4?~j;((lp<#A;Ar}{6g=cWMM%0nkK3k zKPwRd--|?2J1IEx>KTw{RQ>tJknrnUJ(>g0b7*0k;im#Ad4CUQDIQd}NwcvD%o| za5WS+82(bjZlMVaeVC=Rnd5sMvC0Y*YcwRbS?QAxql-8i!opZPzK?KXKs^nm8?^)g z5*%gHzNxg?l}wsos^TLJbuvlCy?7gV&OxtW#^OL;}XC60y&mDs$_D1F|+11hR-t^5H&fs$LE1ZMoXkAvZ1;Y z!-9oMleYv45-!q}iMWFMD85}~ERpn~mLyg7CuJJo45=B28B%TBWO?1U*(L~6P7_kg zS){;0GiNldowXW27moyrWJEK2{5RRxaBr*_f+RIz`n}>K`4M-c&CBWCCM@nuOj%|z zb0+G~v+Bx~I!NwuV)r2jlC+2by0e#XZmq3{Vgswf3>~ZV!_=!t0_NFkZCfa!_}7+r z*&G|9lVpKlbW_Hb!$T4@?h=WW*MNw&Y^sqqgy9wUDm<&Z692Zv>Hvx;9%ejUdosLUWM=5aT$%H+R-U`ITuIYlj++oFtFe%_FMN?ERYHB#^yyKq-S6k0t(rx$*gbwPA@KeAOM8i!5T-8KUy{$uCtz3o4J`%W4oQtLbWn7MkKzFG6e+^YP`$3nm@{KrATEQZfkF*lgwkve=ku!=vmQq?Czn2=Gh`zcfoSCZeCKB;Y0Q zS>hgXw(M1Uv3>Wxr0Qza0%PdBNBuM0IGt2SFO;&dwW2nZzHTIqpn3&~a~L)p(KpJ) z01zUJkbJ()xsxim+*#jjQ;wx`+#>kjhD*@jq%d##Z)upm*aLy;7aby*>)3`tQ=`-0L?^jt$!(V-TK&PZBjcxhV4tTCu@Z$R z=iU19w1;C0?}*i6GLdi!;tpDUMN<{aM}nop;My@-lAaAG7CCfe0=&&*>OjPNxq81z z7CxxHvx+>^$*I&e9u>y1d7&I}t4Wm7sxZsmk}iB~fUhr= z8XADEKzt%k1P@nA5yEYUKFcI|DM!CQGO7?TO`XcRq;$;3e1OahF@mF?&?%sk7opE` zw?S*=b6o{o0LuqNhgnUMa9Jg59px8akT0&OXAkjNI-35kD0P##^0&XkhpitrvM=YD zg6(5{T#?;mv7IJo^5)Je+YO&&Eo6oODU_l9gZ&h_)hT;87#z&6-nTIs(nnQ zoQ-~yvWi*265TFa(147JZSEi@a1k0EX{e1aGZmwGxwBD-GpV3dL4M4_#zEsO_N}*0 zwFgOF(Z+5*SFNLpg7pyGET)I*;Oq7d0B++p!nKnlku{3OC6yZ>5~`*TzYMQr;Q}59 z5=%InNDK_TnfE0`Vh_8C~LwN205tn#?tJT)H0Qi~$hL@t;V#b;(6zjI*LocINcw_1 z%M8vq?iO`O4CEy{BPcvduK-|jvaCIt51T`2CrQV+ho_^q(~;j6!G^%ifg*ubN^Up1 zlD);CX~OYf8rK&H+6#`f1~L@2)MTJ-uYHL1+J}3pqkMcYlp7=ox?51zb90?rro<3G zgTV*eyjZ8c$o)C_?E}k%$L=40DDSzA6OGMZSDR?wQy*V@EKR37KN<`LmuO6PSK0f{ z7lqR#Y~E4uN@OYGdLP8-KWq>Xj zyKE8&{zv1D-b4VlI2;)WqURzrNLS#->xoJ}sTP4Gvisb{tKDA?isoUPzk8BDKrvOx zXna$uFcpkAwgHd9=)``2oQ~{bt0ban8YLz<*6v`c7BoR*$F(Ligue;#;X(L(z?HQ& z+$6tOQ};5sj!lPP1|#s>0IS=C@_Qw5q+r1?lOdm7D^*Py2PNXX8clpdGzaxOq7e!g zG@JY0tUQW&w>ML8S|L|Z+X2sbR)Q^IP5wNEkjUfda%uWSGKDY328^8NEK^sqDr(p4 zp6ok-afR*DnIR@tuKc(MF$Ra8rH|$lw;;g|2*(gf2Dy>|3bC<3xo62zJ@ha&nzD3)}PVi{P+;YO z!d`G#6Hn9~dqbZD<_&$P1V2-ylJA)?2wzASM5$nNrdZVm&)^5n-fk6~XwwFGuKeL` zeia89G$s;{tn0jh)J)Q-nF`^Kpz`yKkCAu$O{Jxk%xWQ_o0toR#OhQKZ3 zO}NR+R|=O-uGM$n4#4s!ujG_Go4G%j1=Txpu;{xBNjL{-?|Cz|4h?$@r@#j$Hv8Sd z)fSiZ1;3YdhPlJ>e>T8Bx3q+!{$RqgHz`(x%=@udX_#++@Ln);4AAdRNbi1nL#o~A zUc4GrIrxJevldMJbvMqm&*ihl#n{K{t9eU1J&$H*#@q$6z-#qRcgaHKn1s8r$Seh_ zT1w)z$`DXUVWRpZoKYn@*?CRhlg<{8k!?!V#l`@Vn%e}V$vpChE!U6GI}E8Xp^5Y6 zeXqcB3B=WrXdb0ZkFFpAj4M63uCkYxMhMCh2Lk_e$s(Z$kK=XF=21puMYi^nQFKTL zo?v%HFD@F`SejMIdz7T$kNjR{oOlZ5&x!208JVz;rCUi#Q9^HwLsJ-lNZ^>B?+)Z= z3K#223jigHx#@Rn`y^)W7asts+d$RWUn>B6VjStN9l*;S-g8gP^e$S(EPbQI(GRDb z>rgi2w3l;8xfP7VZ530SDymquifD;8Vu`N43<=r|&Xmy43_+981sZ@MR<;q^3e^`p#1Y#J3*PmxaCICG3S4Q*X{0yD zSmnQX7%%{284N*U9HJeshRgsZg1Vw^6!SDV-T*nxR9{A|&~#Gwg;Oy6X&6#4j*s=% zw_+f{+MND2=Jg^H*sE2m9ZC}#6ufw&VtY}w6k99CxAHyka`+R&6e=M(eXUC`ikx{B z{3a1c$zaTFv$k#9u}TNj`_kY@k)wt`^D+lydQ#7NbLfN=S@~9;McF;V zop#98Ry~_iS-!i)9ya_>#j7p;=aZW0X?n!G!c+GgE-^Iu8+E>*xLE3@-m2Xs8%7*j z0(A_r%ZaK9A6kpwNzrhwj2M(UnhcPe7~q*@XqUu?5#IuoR%{~9bBwXme<-7sV%){X zz)|+Bg{D_|(@SXsU?41}BuFFuq{;|RQfp}>=x*g}SO7ga?mUizL4*cV@-)h$fHP`_ z2=+iG>cZ_K_pORyKosG~<+d!~%f%wpkJXWCeRjl2PF!q8Vh>bWYHuidA?`T^Kq^6| zm*F!K*n+u@ze=QwJ&5-js_taQKS+CSA+={5`uza z70289Ig~*zP@vWHu4n?y7&TqFC+|p|roxz3*?9N>-)p$LyMOK$y!OvlYLi!?bcrne zsW-JK>R^L=BXj0Y-Eypc1&^Z#yN#-|fAURzFMfVIosa#E+rotZ)Eftj&n4u%3-!UF z`#DB|mWVx&?E|LQ!r#)37E@b77Yb4dbxK9HHr=6`&fLAgwE*Uh7It*Mxl*hqt9vVF z+mE4wPr^^?H5LuhrkbhKNXzRMk1% z)@Q4TjEsy}%a;$o|LzWVnE$>RVVZzxa!LvF3t4n`5B(e~EL+c`VowkLM**YTZ0i{~ z=cC~iCEuzCWlxCZynr)*JRqWp( z?O(e3KbVZdHSO?v`?l1x^n5^AC{d^HFE8SHOhV4I-~ijm99`*Gnu;F@$d-Yu7No2O zbu6K9u(GNm6g$5;lkFofOWLsf-h^FK6EWq%0pDN$QZibyZ9g3Ra904Qo<%eX>j!U$ z_)qv+)6)ro5-q&t9u;loI7e@FFWc?&kSW?tufw<=&4T8W?>mp-XTtH!VAkLzP1>h8 z-SnX(NXX>>wQ45a=2n-;AL7on(IpiC`M>k4vNlks)Ccu=q(4_(9=6@?$=nxuU$}k8 zO$DBYs8JaQKa0CwtnBXq20uueoTO;Dy@R`;1z4jJt;CE9C2HGvW6pn`G}bJ+)4P~l zfBNsVj=(FU|q z8}6`49`J65(BZyvK8VV6v7Bsy3kh;Qj7xsw*g)6GV*M&nayEiD=yB^l)oBNjHXY_)J zQK?m_>1b2)Klj5g&3xY9*xVbC?%=D19bvepK;vBr0|E=(F9fH}oiz6gGMzob^DSY! zCMsKL#AiKTzFOZuC?A)8wL4{!=DpeDY8p8kFWQGc&0fuQ+?mPzAW%&#Il~C*_j|f7 zrr^5de#@7P?Joa)bU*2CPL8AEfVJwJK<&+KaFrm7>t}W`_*g3b;IZ5 zjYeO_sMWgO7RfO8XcA9IVr^g70GQA24#>HYiYd?V5Ug#e>fTbs^@ul6$0c)Ow$2=( z>om@|!ra}9OC;{lj_Y}Wqcv>Q{D2h`g64niub0N%&tpGoV~_HM3=SSVxgHL66vq`3 z2JnP`ov*mJ#WGx6ergY&)Lw7L`$R`T25TIUFiBbvy;*p-kZY^koQ#lv+aD+2a%cLJ zPt%ofPp;&vZRw)xpEx3k;TfeuboM3Ycy&4qxZEmZv$i&WJK9wBe(3iY)k)O#i>RZu zasFO>%K(&upsJ7rGI4WXhoE#rgLv8WFU|oiZYxXB9x?_*K{T%^9o3V*`1W{Z5Bj6h zp^J}KCWPpv96IgUUnQ2+i{WNL4n2h`2={hdE`?|OMr>BGc*o&RL2W0@6u&UJ^>N5{ zQDf7o9?gMpQl2nFWiD5LEkB>S4L0a7Se$529H&^cct~gl8FPLyWc=fW{8&MPGE!74 zqT_e?OO~md9G2K6opJH>cJ@ydbZ@`;b`xMgju8=fe|Jx>a9z_zOCl;wTPvsIMEyi> zG8(z!XuLi}@_rL>0c16OS7!2fRv6#5$RWx+gY%>w%W74hJZ>mJX3=dSk;_XLeLf*XAIyU}NUw$vboWzX)Odn&nbdN$c5TAt z55x!PplE;MQ04`1;`)D;^2JBasMr2W`RbqwYU^jK)Ez!crm7}>)25J zmT$1t2Uyj-=4h&AL(>-i`+!=d_Nfw0tN+OZnr$1LexME2NiWs4XzL)JZ8sElk95xQF$cef0O2gowtVI$ zst?jmhe=X%*Gtx{2*_|@nGl=Hg|RnU~O}k2RaMyIa=dy zz;Gvk`!`OgMm|3}`F#0Sa0)NVqa-sQs>iy7cr#Z@lV|W?H-4d;P12z;(z-ASE`cR) zKg(0*(J{@6sj=Qe~kI(&LVR_sG1>=G~%B3Bl6h(NM;u zpqHN7qKjSD7N`H^Ghdk)=dUMkJPo&q$Maq>`CDE(ysFev)Eq&ihC{Jvl`7+JMZN7A zt#aW8b_^l{?zo*Yji(O5!Od+r+g`8{xrT(be3}g@dse)LshLys2%iZ7b;OmIpI~XV zO@5V?H%4uJcX_#m(IA^=r=tG_`1T$=cCvRP>wbDSQ;js^+udE;-rX;AHx5+ByZMr| zvxOZ2r;dr_#o|M7k*vv&EVRtzy8lg-kiG;JifVRVZ2wS(Tw654x>~rBR#}iySK*~| zeMSBBL3_*S8uv%o-uHK048MY>!8|@i;NZM`DHaf%SEsgkrx=t{FqR$aQt{oWxsw}u zsE(&SQI1%tyDc8Z_>*I^2-jzcf1IsutncnTeRedGct^3%5ajUv+MIjqlPa-OPI^zI zM1No7o1R`}&3;CkpX)`0H;atbL;1X?x^#Nw_Tt?qRajTzsN+RBA}*RD3^~9Q$-(NA zq=zjxIa4Z<22EXGmA@xW56kgaP3MM|3X^#kU(tndKm^-FddYe3UFc1gJNjn7HBJ zQ8r&=*%h~{pneBT$Lq_Gsd}}d(3t^_6`JY|&nh=%S3=*ReJhsjsVAZrH$fO*9Q3>! zd*HN{f4XqU?M+5wPxiw>5gtpRm*{jkfBGvE9CxbEp$F^LV>y{6h!QqwFwrQ)HX+w; zYEo~0R{hSB`rXIME~5zZ^*V#WnS_{2i-gLL3-s}wn+xU557lXBR~F7<#p> zmE=@zug1Hr)6zS42g7>~07SIQuc>&_asCVQMeCyb6>Cs4ttBTues{EJ^{oWu0lA(7 zzuyv-9xN1BjHCh@Zr>Nv{!*I|)WPwUeczVhcCUE|YJ0qMmb`CP=zqf&`HBS)^8EXP z#swPIg<6k2A3%q>!lC1=hLb5st#7>-O2PCb4TjQHptE5~x;J4`PQfyoskZ3K)`#4#7aehV% zWzMnYa{3v#hI8{kVoSd`C6TlseiZ*HFKABjq!CJyHv!;)*40?Nd zD_-OHnt)g72SLnO)Te&WM|IbIOP@#5x^jwDA)>g7_aweJc5UfHl`F6#8H$&iPmDkE zR7KVE`tp&4l5F$gY6GPGNr}B^V(;)NI!XDJuKm;@l)juDi5xsfnwz%^5j2hgY{1&q z66k`UxFaHlAMr2PZ*@o$CGn{R7#n+*?lOoazD_ER7srXDOi36*G`*;eMr~fI09h=5 z7$yb1#~o=M_qSq;AL$kbap=7rGi@h-O-qz7{wk@-t4STme%w+L)Uti$8^0#o6X-|i zP>7U6&_BGj=go*#s^R$Zp8nKzw_u|>Ox`Qzu)b90&pb86s+=SGuKo3=*~1_IlPwZ> zrA7X5Ta7Y-kZYn%R)`S%?!4vY^EHkHM$5jei`(@Y^&I2?$Y&Q9xFvBBUH2pV_X24= zL2F++fBqR!ey#!fZK9uk3%lz7&M+&gW=^$+}EH(jI};g(1N0Cah|x3{^s&Mn$n z&G~=$2r^)Cy!_AvAm_cGzR+mYw$~5?5Te$77ddIR?Z_Zq=gc_oZMw{;0(zJ<(VT#| z(!|wl?1@E;ueq^4-%{AFDX08f8F>~;e0=9X`8_!Zh7k}d@zjJSJ-4Io^;JBDwNO_8 z-q0DXFH&tVAQL$g#OO|%zBgmuxtDx7rXFYqV<<_T0lNK)R6gQKxd1!9Tze7Mpg7)4 zOmZ}S0#D;IJJ)18r>LDS`S2uzGt;N;8nkii^!4IG%(qhlWToX)luR<1y?sB2na-e@ z>sj0`jbF;_u(EOa_~8SFdG~`^;{99wBg(pf zlCxA(a19R{gi4na39nMN*G17=PW^R(s|bH}@loVnAFMF@1wT(LA;O47Ho5o39Hy;f}LkSwlG z7XLjgB4w3ghuRPe)x7} zn5J1|+2e>oRzpdKpzro1gDPI6_sC}&x^}A1$L5=O)b;^}$R}WDvVwU*-im>28JF8O zx*rvlrxsL-Yw>A8y*71GB&Qf$lFTbAaw43^o8zzm%3av2-0mu5UboP#B9h00aqfa+ z>C!^zR7-Y`k9_FlC4~0(WRt)6`-AfE`wyRvcdASY;HIP7Rvyd=NBi1SKk_)ruIYfJ zG{TZiD~c)*WpIbXN-wp0+LmY{<>XQS<+9-u%0{1wjiA>XyL)hv?Xo9HAU~h~p5xN` zhOKAO)r31|Pk2EagZ+7wg2oq$98+3ZRuDaW5E|)j5fw-0^zEQKA7Cf^JUiRjT^%lq z75l}Wlr5MN2)bz9r~Fz<%1N=Q7Zh843(P1qy%*r#dxIUVpFkSff~S`cZ%)snF#C2v zqup)37a9q=Q@i-*_1_ayaAi(o_>sSvDlLS+8 zZPxOAvN?Sz`vUPa94#rZkM9`4t&s6_Fyyp-r=bv)Z97!Fvn?;+?&H_9cMoL+-KKVW zq#{Rc((_AKgxudx!w)Ak}f{>g)YTEn=A`;qb$jSkL?LoH&aaGy6@hQZZP&EP=h7<^X4 zUe7oHm1{hTw~6N>Cp$@BbZa*aPTTkXG1N}o&!CXspP`ODDY$Ksa zo@VpXfUhNe^E0Id?CR;s)#ZnK2TJ+6v@i)wVmd%no(vBis20BWpaA-U2IJLU8SP(-jABSsmtmXIzv|&^zPbwLZoyZ7 zHl_Z=XG{8{T2HY6Uv_r#AE;&R8Edza^TKp+Zq)DQSO2uqQ(w$a#8uvSYCDG#h)5Le z+I7*x^h20)82*a!stPKLE4!n~y%p4socB~*6dnXiIKcv{D_0lHr9TT8Xpk&wX|OT8 z>;t`Vg;F&mp-8nE)30Opx_7zD)2;1(#+|SJw7e(|_x|aLGs#)4zn_P+2u4*!=f$#? z{tBZ3;SXa~TTPpXh1NZR=-q@0b;sPryl&?zP*hKLS8?^cJv0!6I&=u%$vu<<5n%aU zC`mdS4KGZ?hE~-3vKj2 zCn~?}w{Pp9MCH%7<&7)knGQO80LXQw>EJLl$8Dgq;^)ns12vdJsU-P)GocPu6~8<4 z=LJNiv?2$gL>dAit(gK#?u z`3=~xHJ`!NW){?@jvXlJOHBd;DX#sEa`K+x2L8*77*+Rr=16$9WOTL`2k}scZT<1* zUy_@9w?Kv6TYSzs)u@xQ(br<)f<2&xfR@s!IIm`Fq?<^X2~`e<8=7(_xx`%xiLt0H z?FLRq*_2Y|I@RG6wdb_mYq&za$?W7mU;pQ#T~bbd|NLTdCL=w1R;j&h1K&DMJpHXl z>BfA(m6YUJT)oC6vEL=|9wVEf3?gGo#2L45H3>0Y6kQ=kG$SHnrYqz(zNSXcC0@Jz z@LI4_%Y#4Vc#o&mQh=ydwVXQ7*5-*(1A*MX=|j|xRf-Z>f&iZmhZ3rz!({t_I#Bxg zla*8-(SgGGq8NnESEsjsB1xrdcS{=t6%5;DyVV;awMRPW5Cwyu6II zpl)*rWtM!pvUN0cY&$w2d%H7%xsPE~*oh|bAXKZ&Tc58vyuD?aE3J zP#Q^z+r;e|oL|4iFxiLg`R~84D@&X1K}A(wJ|p5-tQ@^+mKNS+Y*Z#G?eyFih$;Zx0k0n34 zQ{g+|tqRB8{jD`aIQm~7+)s1vz1z2W`N(ivXHO$+WG3fxBb3u}uyg}2(lES7P7fUC zq@ba^zrp@KD2d~Ph2e`qX`;y}qC|KV#7%$DJ724wlvqM|RQourQ4(_NxmkQx1;}_BnMEouRaAT$2be3{H7u(-hoCXIJc&l<>*K?<+eQ za6B$WdK6ZXT$P2%Ix3*$MG0-Hc%&n0zM+|2prM}N*gt#2o9_c~D6TjW%?!ERrZFuq zKVKHtd0C+jPnga^XwPSVr66wntM#A~HlM7kAB8du1M8cZKva^}7*FHQ;v;Lfd60)! z1DnF}`@as_*-oG}oxaftDEJcKz@)0KT{`Q|+l6Y9E_N}TjzDe(iUB+d3l^`3r;`-7 zszh#YZyJaARcaHyx!NeiT4La7Ve0zAo*$yX)lp zOeTLYk)vgL`R?>otIs1`5ttAUsEI3>sRD*v9`+U z3Dm7OnFu}4A784(?mDcek zOl|-RKxY|f+K9MJ&Ok2b3;bAaoc>O_<>vgfqts$kpHkv+QHR2(9G+K+#1OH_` zxZEa>Y^_Pg9t=H9lf~J!<2uK$?jG$F<{XEIa+}NK+VAD2kHfAq71YI(fYrnzLB@Kv zF?ofFgX!1BFZ%~OE0(JCE%X=C(4&&4s7DtNfjHa;d0b$k{n~)Z@LOYt1`9v@vO5U0 zRv=W(ooo1oZ;K>F?KO?4oVy#(=}lUd0%RG?wQ}{@IbM8{@hmfYMrS6==G2?>GrR9L$E`Liro2_vZTJa*bMP+98XWxksC z6fn_(-bsT{jt}5JF@tv;sEFA5^|46~q_-+hw+0TR*nrdEW9Rst_UIS>4&EYFPL4GY zs(ebgzAUao0Fb*#atgh3c`1EjbcCEEK0qVJ5cykHuvGx&#V|QEORQ}!1Kv!}ouLZy zsa#AIb;;7#?u$!Xz^=c1m*}=N>bh%Z_9(AB9=`dghI)H4>$l_x(0{xel1DN?7R&d_ zUG9fUdmwCWu5Gikyg=2#lg&uF{rG(VgGmzWewt|K%Vjo|+W}R$Yr#D76#fw4#0xJz zV@Z7djfH+Z*yo=RqSG58FOb)Jpxpv{NQw$kr##7VO`&JKr&xLgh|IkZ@0eVsQOv0Y zz6uDUA7Z;7hXM-T@YVLN91qP(Mu zf{L8NQr=MB^K^I6O=7)NQ=Ffs#qezBWnCg{4Nb#aS(jVquTWt%J0H?3wRj^-C!fxt zGfp7=5$MI$XAJg};cf0fok{%*9$_^fUZ*5^LM`}7)JC`x>z7xqHn{8h(*#`3Dx7U# zP)zmrT@X?`aBjQK-O!w(CYDkv$k-tDSFoPmNUdq1oKBcgcDBNAqqh%$p@7g#Y+}5F z(PG%3se34+2XjlV>vPqZgXhBSrNz$|A5M!VFJb+7W~b+y)5D1xJuZj*VxaG zf!fUvkQUlM)j_3uh^Za^|fA_utmGlz@w6hwN8pLq9ws0eVwfoXAFAXrq3 zehzz7JnVKnQpe#*5OfZk>O)g1swH1JUDVNHgj16D^yY^Ii{)Tk+=&{E$iRCLN>d}A zCeK*f$HcUQI@_cF93pXq^SK)nJ6FoLc+MJs4X3#wmz8F^!ELsxv`e^~Q2>t|=(LfPWAF9M$6;VGEgN@8J2%<}9YfYefI9-+3DM41g8>hhZ5=Wv9E`4 zB;G?#Ly5p4B+SY`IjVq`{`MFVfWz(8ZSBRts-hj|?Pzar>(vwrF!mhl#~z>RjC@C1 z=oBC@nKM(X3n4@+_s)uObg_bNK4rAeAZ5deWb}t!asuwBM^&zLmkcz%^LB6yO7D4k zcJuzXF2QM;+8Hf2YM)43QT>9OG^4!IE?9)nlT7{NpV=&s&<`(v*!N=_1n?p3O?G zCu)j>FK;FHn-&Xh&Oe~H`E#vZUC-Q?mGj#gK{#&a1u3kL=QgO3;idbP!UL{LueojB zQnAK;d4}D{&nM^HYb{2pu1b{&8CZ=wB;uriT*h@U4QJ;GZG*y%-yd#F*y1aEJijeY ztq6x!dAYH!Fl^r$&49m*FsL9t4kR0T_!I^0i#$(XL~Ir9tHush-3iRG{4ttFGw9eP zfra#8ML|-B^`}~EN-+~~nC?NlmIW=nbEtr)=&U0aMEvAjw=Sc>4)=l8gg~xOeRUrLALKul0{-*T-e9+`Nn# zkM0#;TiLJs(p&P!gBuN*6pF80EzWY3hD^YCBKsSP?fKhVf|G)DFR8T$p{=E)?&k8N zlR9)6Z;uL9Y+@j%xcH^#7@ZC^P9!`@KNvUcGl|E3t20RIV#o|71-(Yxvc^&~w^R$W;&tDpmdDVAH2$u{!A! z78yILoblNL$(QIbK5xA>?R0Rg&b2=pkD238&z?UA_3HN*nSwDAI={I5)BD$;o2`Qi zn#q(NAA^tksLVj4xh|CF+n$i5MyZhk6rZ^`)X~1-+m2^U>_ubH+P=w!roUmh6Q8%AOD;FQYs;Gs5?H*UNS|$^uweK*tbG_-C>F<*)q6+29JXDW%^o$Btb0r(b~q@o&@j7Od%%(_iJLP@1x>zske&#pwv_J3 z5%}VOO)Xs`iu|KodT+IM3D&weEgsXh(y^Sz17Iy7#Omt77%+b2J<#GFlHs!pmBuH9 zk|SSfIA}3Og_OXMDY)0x^7ieuGoa6OR~X>7bwm(0yXD+VX8IS_{G_km>v97 z;U`mFYpUTANlB*6DW zGq^D!u0#{Emc(J;#Ha1k3k#~m0&S9mtijJ{=_c~ziT|AoLu7vJ1QdUmqAqEfCiS*y zgeg&W_)TmaU?Ou?{4XiHWG^ay0|d>CfLr}lMs;#0%bWhH!CFe-mR3ro9qAWF3Fjw6 z?e%GSO977sCl6?`;8hpW!wZ3Y(EGmu2vFwOwuz@y5-U*|D_8tx>o>YeTEwEP1eZZ< zqgF9y`ed=Tbu?4-%El{2c=t@NI^5r7vc~jJh`5xK^(Y&j(C98ci~3whEPpMubWJ85 zj$=NN2QoFW`j>Wskr8FKK<=JqQtbhFwFRjNEv15LoSLQvzb=ERMB(s%N*}7B^NYp- z2PHFeA5Dv;%S2@l{TawWTAX!b zTnv}CG*E;v$cD@-^H_a^H4P^^SIj;8Ti7V(emuufL?283e7r_xO`hXWgu-14yPaxW zw~;qqv~6;65~xX0-p9+gVu-*^$0K8z3QcSzXLy*Azf}{^$^6$Ix3911w$&hBBOBD1 z)J`-7u4v#0@@wb`N|f~bSm4^8%&xmV)rF`4tlCzjB_p@XKF&Xz1sX}<64d;9Jd{Eq z@6Btti-Z*&^rldsS_FS^`>}L3>4#boLc*8K6`hrN7o(S^mk4L(#aRK(2e7vcw!LEI z_WZmRtX4ZNFo$AEj<072N{n2^wWJxNhq51+7k0O3?M@Y}YQTlg&g0ay%ppO{biq=@ zz4izyS#i>~qqV*{yCVTECDPqr!d%&F$SZGe`*~#fHZQ|~Zg0`;>QsPBRMDL1uifQm zo_eUsu+-Cdi_;*noOy(=!YTd00;>9Qol1 zF!259#Rt~Ad+A?u&7}@3%8(VPL+diIYBcM!p{@;G#o0<5G=p`5Mojm?F+wB-tmxpL zr1Bf&i`a_z%gu_GN6b1Xfi7W$(sK)ItERsYACzqxWF>6k98eLTD*~pZa6LRX~FcUhD zV3|hn2uu(sb#K8Bxg$){6cNkYYZJ)c*Py2aP$kAYEJJyUlT+IjCh@^c{C@WFcrpIA zNS^9@{(qVa+M={OKl1QC-pQIKI)$+Ze9Iea0`QM%ir=K3l3?7au@h0}>g*8-qbN*O@y745TvF zq*u-i+XxnrnBU%A(`ISc7~cKOrGc=T_AKDRN6zMO zD{eHzU|aRr{_aa9O@&01eRufF1bQWJ`}f(NnH2U3*(WdyPe%?5B*n1>-`e&f{vxBs8WEW;)<`jXY?ijscuF^*Ct}qT))i-Qi(MLx>OWDp7{mf~bpITVMXI z3ARKXcLFmm7LaU|ntGo9L=7E73`G}=&WG2fs^m-D>!&|X|{%2$S@~&#ZT72#HM%eN?1fC7%LwHzLxn2ma9d%lQpzIxpogI1JxOnVt2Fo_!u`v6JUvoi^)k88Vv~;pVm)Gz+c-$S;%(Q74lqS?A zX0Cy$g9kU8Z>%OtRcqz=G_Q988)Zjtc+^2^k;DO)iqTRtSCV0z)%bL5IMpA$l3oSE zu;JK2bbJs$e#fR?{nez{4-;$+ zmrAj>!X7@+diKNPakHj9hx2lJN_x}lYkdWZm*$upds-h+3~ZZzx5i3vb5g!=bd!u( z$XZ#BvqH?TE96}7;v4XhJDXChJOz!U#01+pA4e*aV?pv0HL1HZKUkapHfcZ3ca1UQ z5%42BYCSlR`J$r%+UhY!IT{7sn<9}-Q@LE{WXf~@_T&;t5si_A`zuppZC<8&f70im zoh~xZRIZu2u}UKaAl}*C+I{+Jc9(Wr=nm=*QVA89f$-mya_(?~Ueby0(n`8Ka|skh zuYzTudpVR}Bmo`)%_2B>bX>N?x_@`I?vZrw#)2A?-kPmsoc0|>htnhhq$Yh-{euk3 zzhb96;)bu$0gb(|Xf_p3I!W-e^G^#kMT2TzLJLBYq@$ASavJ!)G)Jfgq7SrTg}&z} z2OpCex}&_f><}99=+@!{yXg7{3amVp?*hn#7 zF0#kmVI>7zUw3T8LwRQ?)T(aBt%hV+0btP=^YD5-#KHX&Yq{xEE*i)0 zJzRz*{GnGBJK(r{NTH3`( zhl~erdCEqN2dzHlo)bgY790Fqs?wM_A>8J6Xd;UAsVcK?A>fbp9^_J3Wu*@TQC+GTj%ekP8 zj#aukF$?9cL-GV5F3jIu-8#tYrRNs?yr#0R9@@vhh>0qDv{Ui!7?y}0!?^w8sILS^ ziUaXVtNX<_izGQ2*-v)At<9h%_*h8|WCF&>!x-cMyWHc>PpJ4eIYAt$1x8QuC@I}D zo(0`;0FoMijo*gZRt%0~6Ovbfm1>)7iCF?!qRU`n+l$gGijqGtU&TnVCJ{_TjHh&v_ zI$;D~w4M5(T@+t-3r9VC?DB81EZ#wDAT&cD+;mx z;A}*dbGOFFK;sY{M9D?ms+!eIXbQ_|t$@MnQ29JCXrWQ|cf}VH=?}kH1@s%8AK)zFl zC^);C?*nK}hSx6XK$r~If9uJVd%zq^lppLyEee63uZ_6uUplGmB~N~zbf&TA>b|?K z7xgXsG0f%(yw#7<5Kej&W6V;(wK)IJG8AIT@L%Uqp)NItHdlsnc2Z!XzELRKAa(?! zW1F#dws?DyHZCxOCOG^jPZ z?`b213=~eMlbohJ{+69ig=eC_(HOTp#z;f&md7`cp&EG0YbB%SftQrCarX8W=TcIg z+gKOKBpP4-1lWgd@CAx252rKt({HwPWx%sTebownuGCWz-*+s;MQ+`_BYR&jPuvO_luVQU;8ZY|2;Ek7s|Boz=K(}q~?0W zvbFdW%G!qsr5AOQRjMGE-g#pvb-?Ynh zl-JjNmkv*(!32*Gfl<|oL&0KT&yWwOc@9_I+{803u#J%Ri3hG z{kD%U#W-K*Le2hB>*tE;7Z?6-d?{&`@-oxv>-ZmF<{piJ!_MXEic2rQF@8c!Z?0e8 zUcF8KJYpoUg& zR7C&4(YcdD=fX}@$;Oeuk_eYAGM+CL#eJ`b#}q(uOE-{lODoOp(W?h54i0yo58KK# zhA-)^MRf~;!@?%u*OVrFwbtc_%Kps{0TtF)w8RbJSf&} z6r535To)AOUtX82uny);mZt(W1ma^K84(P3e!g~C9foDu>Q8Pz#85fhp=x;RRI6P} zbqe3@(VZ8CDlxmfPN;}9Qg`O`mkOr5C`^ip04jE{Z`9Uo|5Zj?)zoYxlY@)&|D94N z=#+J+ro}<$y-d=c-E>Y5MJXo?hg^f*#o5)H#h)aRZgpD+llR9P3%P?ITG5XIgviE& zC*?AUG_X39ib-;CIp*pK_d0z#ClyjGo49?rzr7Xf+P0n>qfFe{vV8SBvQz~ZLMKxr z_;SY!O>K6RJ+EZ_FlKtzVW&L3kflJ&!L9l#j`2HEF=z~#IXTZtEi9d@{b!BR*m#YL!~5 zLpQm8qu;NMDQ{Mlx26s>e%GeFtKz};3aV7dWt7Dq+6Qg_kmL$Z+FxQ`B{DZ~fN}9k z9)iCpJla3~EN^#GIXuHZMpI1brLWAtcPV0hjiY^@fv2@o5-1C3ut_pO)d8uRZ z_0chvvzX@Ye`t+#Ua&)dS+rj1SN6uJi3ALb!i-zGM>`0qw)&AEy+PFuX4y5!6vfdo zHW4uo`S`M~WbW+%!KLO08#6tq?^%4sMnfRs;xQ}Q;U?{C((5vZJS>T-w{6J%P-aH6 z{I^63Ips&Q-+E2KbWz$8cT-3|mVAzJW$~|4t=hEWa6;f0l0v?BRz{Pi3W-~Ou$ly) zmH>frJFB2{3#$IWA-N-o+<_jq%a=xOuf0vcCg<^g1d{&EooI0CG(FR^P2D-2vo zKyEcIzs20oLr%rso5k~>7n8UzinT9pu|IWO`&ZYwZ13Ua=X5MOyf&Nh@(ZslN1`;I z{i29ff=-4chyHN&Wk(0P9R`*?2-oD@mF9Z=kAPN1)P*fsfR6x1V=f_E{0n0ms{Uuu z!kxW%oR+gMu^Tkty(lnKJ(+22m`o2*|5<~oaB+^=k@XKB&oAxh^?&rm7*-$)mMZ(1 zX)G8AoBFNPX4#uN#yH_L7$lX4fl>z)6k9VoFX;kNZ)~ga1GhSI`5zGYLgC4VjJYcP z2_$(}pG;K8vRLsgeu^ZAO{|W76PG5S*b85#^ zXj~^j=!t#&?zYrZEM0J4(r31|4~D#Qjz@Ms;FFtkaC-8#^cnbCcrZ$`EUi|yYui8C z&}jtOwl~Ux5UvIwEe%O(wQ*K5&8*-F_>7K-W{5^srm|sB9X~_+Bm%#$` zsvh^1kOwn@Hi8zgPxcpZ_qJT+W2q#{Pb^tF!{G@2*ODtBr;P@ciFAXpO4Jgtk$*+S zORR1edYitOUo%SOVoVivdnqyk&HFzd(DP<>=QTbbc7vBIMbHxnIR?_{={gs*t?_Ip zroEn22P!RTTNJsGu48Es^u2{@g`O!KRD(=Y`+EhRt8yD1Ht+Yo7R7zQiENm->2*L zcUPakG~3n?cQxs)3)%}GtL8%$L)CvDAZ-%C%vOFV!%et0E~q41K~F-OtULy<5CgGA zXJsa#Faa zZS9X%nF}{aR;l%N86ilg$hkE0=j*^(MSB(Uf?hcsH8LRT?pcdF%9S&xYED?6E`ov5 zk8sttX6{pYSL!LoqKd9glVn@=NruPcbAd2YvAcA14d%dFzC2mH z;Wo{7eou-zF>yFy48%fTSAHQ3!rq*~W`Ii>K#-qenMb;VNlb#<#BxFTxS zA$m9q+vx|8{leOjnGaoYSp3O5a^7MeU#?E{=>UumFNvU^Kz{#eI~KzSTqI{@#Rs*^ z=J0`rU%->CgDt0&S8*Nwf8IaNV%XjO`UeI21ocUU9AauaAdkp$GR37?kpDqyobkVL zrS&vwt^r3Yw43Hl*smXkr(wfvwknyo3tD*VR5u05;1&Cx5iAW5(b|F5ezr(gpnXpu znHijB*%cVe;*t>spQUd8*6HsjG=G-HiaXp0AzvgZiqSI7g6jV35}@H-u{%9@m$sr?+ly(fiz zyRy(z0&UDRPx^OQJs3r4q?KlOm0+GuXf@a1qKfZ`a{-`nUE`@Tiop z(=|U&$Gl)+g``;gq^p}kdmg*C>onxb;DJoy5{#W~lf-xIwRw66y6g;+rcwd%?ap-_ z2e@dmr_%_)O>)LQBZ=$yPW5NP9C08UMe&X-&;X@>|FRWK<>F($ z{w>4KmFkb^!6>Gms1}y+(*il5y<=ag?68^w?1AP(kGJqqf+;VhFfX-kF(1`OhHsQnkcgwf`?Q*y{=PJOhM*I&|-L!GYiY#+}$jwvW#yarhKQP>14QTX=VdFysY zf9;e&L1$>aT*}W&5p`*eP#Z8;us_fNGffLVKf8Kg8kKzQ++ndMvRKsW$IVN#SHHMy zkjea>w>13(W_Hv1hb=qeg9<@Cz@vzoZoL@VsraHgTlm3=jYLp&{S7AYNzBUQ(%CSh zkC$VFiQsTN^eU;gK8Vpp{LW_!tQ3A>scE0tI0P6aMF(z)Mky3KSl3cQ9|LplLwg+0 z_A8fw9|V_AXq!u1!ve+tq&N$VbE&lc8aXBKwv3^Wd2?<8Va{v0RfH02?>w}UAtI|c zrL+pRdG#?S*Rkz!ab1NxEM6xMkvXL1M9^;0N+O%0O4a6%-N?C+5EjN~zN^mnIH zTnE4Kjiy6R!#B-DKXDPZ`{%lod0HiagkF)mGWIDrJU^JdD2_qav3!|Ap7H;m?H;V} zZ450wedLKa9Em`fXeok%BKF!ppQq)9h`xm^_9!gSoWfodT>VA>3jhTmQb^#%FDoA) zQW0(5OX&$P3XVIQ;~|ISpd(zro5)mo-mpWq18MpH)0>)gEeQ>}t^fh)0}6>$f!SRT zDPUk0G8Dq4YL+_+Fi$)f!&EMKrzfSwb{0Cao7o+;+Q8N=0GXZH%s(Dai=3ILQ74_- zli5EF9KMbpb+DlnvZ(bmh7y0ZfbydXMjhnVDheuKxD8xXbD^Md<~b3 zuUTyjQ9C=m_d;)L^8qfhdWk89Cs(w!Q2q$!2*H?>(H#VuHJlrVkOQ)};8Nb(2;D^S zQuK%on|dkGh?2_VIpAtC3Kn}DbOWn}K^)EZ`sTZ98VlbZXCUC{$<5Q)vSz%gKifjW z|Bwm4S~#HJB?YN`d`vUDOUk0+r(AEVPXtBuQyCv>>ffaQ8aW!*$NSXvIbn@6mgM5z z$?d)U%fM$42*%|3;v(t9@+HRbxa{?i5P(jD9uSXnCNAzhxioTX6c21=99i0s=K8ZM zB`aE^0lg5SdNLQN5h7u!qNL1&Y>1l;N<#%2Z7GiCPr-|y#4KG9yYUA@rog$;=6dC5 z^*MZdZMH?qh}zED?yPqxti_uckPtCTt1anWc2MaEP>x?D1vk4Mk#u+ts1O`Jx$BVL zuVhJDB)Ymtt!Z&w`vC#^5s4Md48Kw2B`$lnV_9T<0c2E8-)X^`P_>-w6v^R))LQaB zE1D9_%-C8a(raPM9oXo4CtLAsZEk*5`)0KQgBpPoIvqXnUD|3ZX6@C7?FfZ`54>&J z@o!v2mDzwgX<(@mueBMiD;$@MK7|lzSF^u*qz8YN(;>lOIDNl3e_eoy!sahvYu>_# zMi=j`ral%R8l_}f-27>%SKrN^ukY-vue}mb&Z9k3jR=fM*RHOE=ud{cY{FFXiHw{> zq9F^tIM&wZcyi(fliNM}RC+ypkR$BDLhr$3&a=aQGT=*H>>o>`2J!)I`;`w=S#$jU zsd01H_$sZqZ^pr1@j%|Z(ORoXa69t%vjU}i%3%Nc^JRf#2|EvREbqu-z`Pi}2aoUl zdjD57(hq;}H{Ln-eBQ8Tdbw7kbo4jhlCzarP+Y_3Eh?5n&*K6<9N+LSJ$7V$nLaIU z6L|Hi=nd^XoilJ)X~iLI-HC&wIv|YAd)qY?cQmCWo6aU$xm%*wQJn=W+qkj<(VOKQ9lEB*&$iz`J%g8VkQ?d%X9W zu1ql0;TVC||9|H4e}vF@!a_e^}y2%pUx7n9bW}8|4UP zi5x=GlWrwb7*W%i?^Iva$oLR#9 z#1we+?=LK!T_vGl760Ov=5oYH{~K49S&-6x$E4$Le_dI;1YtrW^%IA?auFaZFG?;% z=sUMUth4mWs~d()E}B}DfnkHDo|wz2WQF;dOck?mCTlbb$X#bfgcjfPjWW_dySN14=e?-7sm;yAui0v8GV5+?cAG!mFS zc;r?bBKqN#*AH)byi10G78F3uMk{(|5XzdTr|ZV5bK|~Ojd&L#P+*+Sl|dF@Pi_N{cG64mz3vSu75jAVUB9A;Gb&_-Z*-LQ7kFi-=pQaHv&u;7FY%Gebt9ww+ejp@!m zd(rn;NpJL(sJ-;R)6DeEhmusN`WOQQJN5Z$Mn(0g&oo%Cd++Vl!g!BKe*pd<3S}|6 zb<{$<3NS6*UN8nJM{qzPgKyuOD_Cu2R!EmJQU0NlVngoh9qiJep7V1R&T=svlz8S> zm>%Iq7V|vp(NPC0mrLHsL&%2oo#`(S4qs{ldPlgSPfqhvElTGKs0Wg4)K2t6s@;ZQ zzopkbOH?D;*y$BN;dngmF=uCOxv09BgX^*j1^Uf6ZPeM&A& z6x(QPAzH}5oVE@vlF2{8KqcU@&+u*<{AR)O^*Z}Ir;_=vsl@~>*_Rf)c#V+G(&q6- z2t2w?{TO7A%vy#Pbnfes@KH1nh6U96b&>N-hw{8F_VwF0r+;O`0&dSXU&J$yo06au z>?2J#F`%Vg^>Ir~Xamq8pR_){x7FyE^tPHb_1dTQwR!*z*G^>CVlxRe+?6kqR3%(W z`DL@!**#kWY9VtRlJoJkhe*2ZgMdLD*Qw$3c{Qggb+V(hk>1pM7KW3XT>;9w^WsO; z+I#3j%`68aJ_?uvLj!8sw|Woq7>~&}=%DnYdd9IzYQR4=xU;2c=|D!2JjS@Ho-0IM zuKlU3)-dt2?BSA{{2vb=yIb1zWp%C=nz?LDUd9oPC$91VSYYb{!VhJe2+yzwFP}e_ zwz*_4KH&FmrG%+GCIcnC2k|&8^Um(ApX*>5#dbFjEdmz49vB+T{8wIr8zcuOMwNuu zpDe}NPuRfG<*g|;ny%Ptu0O@LvG{OSa%2sAZIz|~VXxU#)Cz720*pM2V*; zkeGBh+NlS?AM!et2^vqyP2;k@at8US--I8 zW)NmeFo$E}YB8^OsKvbL|0P3^VO0m&@t}aZiT#VKuy9iIi~!dKApFu|NrmQg&%vT7 zWD7c3gdY5jk1pWPkEIB}NTJfLOsCosy@6&Q&o(w+&gZX|pzBU^FMD5PRBW9AWL`9H z(v)3^fbuaeycSkCJpYkol*iQ6Z86{l<2cQ*L%e(T;87UG zrI^3dEscn8cCD-V@`AaTm8Xf1wzm_(-0>E*$sg7U(^;sS>B@S;9WP2&1$2}FfuD|b zOT1$putPYn5=Bk%q}qm2=C=$C^7v50KSt}5E307{KK#a&e2=uP|95VhOWk#!h0oDR zkr4gHIu9y;I1cFrv~ze^O@hB#B>8SGKz^rX^5aUzN(D!xrb>&N>Qt}@{>}}9pwCYn z_tT*z;i$5k+DVXRZfl*C)1BY^94(y!NrnDA#^r_Og!wFCkq=7X+$-P*M2?`_oN<;A@hAPG}CrtBS=iLWJ0B}hyUtW;00BAVx>UcN46y-oJI zMzpEke|0`gVr*w~)H@zUJ>{7#_^J)}>VB*>q8t$f;BVoy_oIha;7F8PM8Mm27E38B zb9;VUmf#oLU0Rc$ee~R8IYMDhyTa3=hOPfuNA(sR%)4^m8bgGQnVxP-=?ZQ*@f-&! zaM+hC0Myl`B@r*7^(*W?;0Vr-2UcBzZQ5oQL6bdQKHGlt_6HA<2jccK9Zf&;cr0`e zyIhfuMqxqK4Hw+Z6=g_A>a#YiICe>VN^o}1kqtqWuR&XUt!7)BfI=j`MhGFSj_XDi z$1J2`E(ZnB!-@bDFQROd{ip!)QuAs#wW8bmK=4xOY`#`X)B8Bdyfw!}R%!)AKH%il z7j70i51vX3nmxATZ*t~*LPXYVBalA%y7=u=7+h?0qD7a;rq1@sJb%P zV#M!~rEN#5#It*nRE)jF86d+rqY{fK+fWQ$XZ&REdHc1jt^_PdXzw(mr*qi8F}=i? zg2xZbgDPYcTGe>0$06Shxy_y)=m&;9Op)!sdwKE|dM937@*p#Mv>mXe{zCB5aQ6zy zahL%$FzyjR6dWJuZL+n#&VAh9Gm$YF@Up!>xjPNknm?btdBfDjpE)iaIg1xriU#t; zJ+k^075{(rOEUKNvs{^0@AYZPP%BCUSu#&TY5>k7fq>yzkm( zvW8h@waO-4jw-na#d&YF!F*!fl55ZG<1kZe%PQK0UhfO4jZH`$+!8)jepH+qs#0Mf z;0%leOhQI#pRPUOnVtUC)8k86m^ZC3t)>OV#deES&lL8W=^6SQVwrNE*!Y03H-$Az%NPg*z)5re2HYy2=$$48K|FlJ(D} zP_}!rW8Ji?rOx4i%eGJSR2WL%L=t>21G%(NJui>%&|3erGyIxwDEp-@QC(U1%BfLm z%T96)qJWo`#6n#*H)tM1R;{UZ?=0GRzQ4P%vtA@CTZ&2YOU;wS^`sS14C0my@qN6C zv{EVNE#HWehL0M(ofQ~qO>(;roxe|MAhnUPbcnr8?>kbp(zvV?5smegQL1zTRPy9H zoY-Xo2GEd`vvXU0u_9tA&cxyT_)&BT=p1B9d?=43zP1Xf0QJ(7v){36gpLO14fZL* z@$p?qSj$97urq8uXhq_Q745EWVlT%ZOw-bm@hZTWA6$~x`#+V=Z#QQ&P3CE3Ur|2J zkwfS2k3auc(OA+Of`!RJsh&^AM#@tEiqDmZt~BOIzwho)tICHM%9ioKuZO?JBW71W zfB5aTn9AA>sh`jL>7+`?6wGg>khFU&8M0XB+p%b|8?dh9xoS*S)p9Diy=uc~KncgU>a(T<%5L zC4noUbSmbNn>Z!}4YIZU+Gj<__?foxjdPg3xJGR;a%JdM%fE)&`rMFs%uSqh%3%43 z2<^mfI*()lWQ(Zr4jvwT2-~mApSoO+6Sr=owxTzoOZ0|}n?!-0i1}V{er}PZW zaVcZ9?!12;38;lE+n8*a`#&n*f*3w5H6SV-VF_Nooax+9omp)e@Un#T#Ts-jW?r)0HRq(#V4uP4T;{)B4j8WKp-zP@Mzao#{lX| z$s6T*n?h+Xe9^+gLAqo-?mLO6f2JsC{Hvz=6(y6W;kmq3r~gros%}kNthC;z%2qcc z3t~t|XLj@v=X3Ox$YuIGSgX=q@}RVAZ|(g0nx}hDRhC}U98fi1MVPW8EMSGaWG|Ed z@TnlN@AUAvj0;qv0P-92eO=yX+w0rA`?c%)!QSSfih+^(IINFGC%zOI4Bk9@c6(79 zw91&rSF5lf*AF5I*DLRsMMwE)4CmE%3jkAEI8`T0_0i9&8(Y=()UbHK^i?Yq_Amii zSnnD1Wa9d`1Z>?M(u&9`F-u;`I^v@=Cx0%#b{<Z~B^ud?2`lfsms)`fnN zVIMsqgU(%iEFD5(UP$rZ=f<^)+flwKGp=JG zTfhdXmAG{JRGmjC#|hl^gp{P}ui>lVKWwE(^=xxLeafWQ~)qf{L?^H^yvA?Ck+yYS4$Je!q-gYz&CkxsNQ7yV8{9M8nP0L z(h5*_bcy|~qxC2H6Uy9?8%Sf#l$B53i*i1CM7VqjOuTzHf3e2Uu*o&o?_xVYO;Bnd8sVAfBo6 z(o(TArD;(oV$}k_iH&T+L{}O}4IRhxH3qxa>{F8hk3K zV3c@YK|HqC_gNQBD@U5e?2Akk8T~ai9=k{A7{+AlO@YvPaCo#9x=Y~|E<;eT9=K`* zf~LA1`dix~Danq{>9>H`TU!Ecl;*N=7xM5t;GclNn&%Hbp)}lre^%1kt?3(M40}v3 z1)T%Luam3C++4R5X$yLPc6yK6=zsDsp0UslF6G*BZ#4V%^LkHsO5;BnPES;vt{&BN zE#S9)TTs@yTuOwrv&KBwJN{wwiypAyf75I@!vcj%pD#jqjiLQo2(4f`vFSPL&uMUJ zzt!>SE*tPEKn;>|jRfkC158qYcmAfho{=_zlhR5^HYmGxC@JmE!*P_ZxI15IIMW1= z3_O8XIvTUh>w?Ti3)fgGdsj^vb7NX#<*|Mv%p=A4Iq-BT=)WMl@h~SIMsKv&WZpsG z1G#{EUiAKPYnh(k1K~$B*AM5}3kNL`(#PA^sl_X5^SjDiD$-b4B)ob6vUKJ48JyiS zF+7%GO(nK~vh&pxjpag(pMtWTo!1F(Q%yO1C+M)NPF`;w=x$oijN}%pZOwxBP`uo+ zcHY23vG#xdmRg|6J!;ixOLg=m{uT}*2MV{5?78Y);$w{rVanq}yw$DG< zZH!;Hk9i=+d%J7cKRL%AQMtw{Mx7fGqt@?j?i}>h)7MI5JuLQT&lK=!+Mzw3Cy5cH z-~*LH4v{+yY*tJvE%XP)FpYL?tf#|5XHQ)(ygC+(zf|Wd$(_+x0#|CV8>J} zOBdUeTef9C!wV`YOsrnRH-j@A;yj%OU{$r3&OpPu)c8fVh^~BY4qkAU+c)9+C9WD) z0+W^F@#MStx1@<5M`sXL4)a~aO@W355HWP>2lkaTQ%KTR4kxt413D(w@4-EbbuU;k z&n}Ox^bokdHQV3Z?X9YYEIy`(6?=Ymb1g@67v)PIaS@pyAQiJ2#gjEdJVy~-M{-=y z;R3qx*eW_{Z7a1@o-MB9CQ#%4mi8xRlQcij(cVAwmxI~%)9phSB|j-OS9Mq6uI-VDvGVd>?=I zzA}$ffFMF*BT!Qq_~_6pCoHxq}XRbW~si*F}Y#KX0A6wSKm!H#3+WY2@A zofTpfRZZ8Vet<-BBE4*_op0D{HDZDT>zsZri#)pE{`BJB{Pra9N-E|0+n`Fepm)fj z3N$p1ZNAc!!P#8bEBYp97fA?sx;T|!=s7TaT(Q#T?qOnHAz*)XDwq08%e%Ad-lL;q z1?-HrFTCovRLA*wuwr=*)>VDM4id+qBKHtl4t$V0GbA(Q%&T#MON7)NXVl2Q``oE? zAO>)Mo))elIaT=TINhpQ{-oEzfIY8EQCbfZ?bBSOZpYbQ<-!qLb9S;N*awV00I6Lpat7#B!v0O{tm0m^f6{EJR*EP*YTxqV0#+_W3gbZYyEL zCr|W$aIk9_zCP@SKL9b*%gEAZ0zpOR?M_`wtjGw9b$OXY)Eo@ z|45TA&(?2A_%o?Td3BIRe=b*ZXL+YvqVj*{<=wlzyo!Pp`JY&r0<yJ3NLym8?bAQcsP8-P zB-+B|!7DpPlmgz@P;-JD$1l-Iu1A6JhT=JQP-YNQN{;P$zU~a~JpF$ANH;Y9V}?@m ze7?Q+{T{0QRtaf;%H;Tep1~-JZi+aN5N=pep)E6F1+52G3WG7PWW=E@V>8n}hoth= z{!I!ji!7@s^PMr+Nr9f93Dnxni#c{jj&jhpmkX<0twIlAvpxFS{G9*FiHUPk)=-?F z0a2S+$sSqY<%@>bPf`jrVmF}vR0YPp1)8L^wi|&?kE(h-6hlhKT6sX;9TANmIgL&w zHMpGr<{G5@x>__e;x}$LxGx|b+pu-{x=H255^Pe58mxol=#uS~U3R5(&(Qx>L8aiK z`ylYngcOCOn^X1~<~+EX=t zOQ>K22AhiB2TXYDp&i%>{B@I1AgCe=6`h zO$p{X(X-j)^%YZIx64=jQH(~cp3Ppuk4uwy)Gtu`<5=l6sh@E?<2y%j30rn_Z9dnk15+sS~)a-rThih3&^^xwC%Y#^Os38A0NY0nD=n26C2tAX9< z+>2wt0xexvu-p9=%JeVeiRn;L|E!PQaBF$?B>a3C4c)S(tNr z_C6IMPzV>~GhK1iuIQm6t93qPfyzh7Q6ZeZK0RMKtC`N+Efigl@7+HqH_yW9a}xAPsFL@^RMo&_GiujvheUPQLs6M%MtrTFgQE2!?W|c zLR^Jqj1D*{)i>zVM1D~QTQ4T zAV12h5}x6g)F#d}z$uoUUbQ!0q2cjBM5;h41o!LR)C~>#AsJGAZqgygR@R{qLp*gy zBdHYlakjO){_=|z2-m9mL%Km-nKe>#yG0U0AKG2r6%BaP@hJ8s3J&~}YGxg&NyNb5 z10FfQa*0i{RYS62dtC6eRU!LWknzjB@aa{N)u44l_^g+-@zz&fv!4u(D1wpt=t)|> zITg|~tMt% zuCN$_=8z4`bCuoCe|DC{$0gsYX31&DrE+SOUi~(y{4I=%!*HIomoCeUz48CW*;z z7x1+)FEY}u^3(ErzY53%87A*=jh652W0s!HS|!9H;`8x1P1o_x!u(oLs+`opuh)|G zj~K4+g4(n1qK;yT1OYv#4Ge*cn2J5Mbi)=xpb!HK(%4e9)~0wEW$f^LXOBr94!GDc zDgoYu%a#8)HH9U6gLo&QQr|0Re0ppY`c4!0L3C=9m)XN|=>zfKTr0)W1h!^9{hdcb zFV9mUZg)l6T?#ie!k>9Sty>>80#@`9&|s)cLIBz3t9#&mV_@KqW>AFS>k9v)~Q zlXg`CSCuw%wf1P=wAHr)QqdS${+|g4j~C}9BQ$PIN|81`14j?npWhWn{RnL{q*KD4 zf%0^NMe*BUufx;#$E7=R?w1!Sx!?KqaeSM^RQ*^3l`#_5=TEoR%el9uR4t`GzxZsW zf4C^=(QwJ)#Qt%)748$E8hwzaDh;G+9Tf6&WkSZkf4zqm0QB0G=AaC(BtT1T_xkUf z8U}9etQ{F-plfprBykBtg(BzIpPTmM#HK>>?2rDIoc3RYRGOQ>IdM8hP<~Kuaj^bl zKThW7+Ig$C7-+KY0l5rGm?VU%yu!)zf%^i?zES2i(Ga5%@pal@B8v4e_0!&dBuyl_ zE1$1FoEEPc9~K|w^=ngfhu^{mq+pj*vjGLhTG;QcMJc@Y*Q9;c&J47&C$f=D&RVJ@ zaPc^b^9vQxRZBmAI{bh~994=RyC>l6 z;`E=+eLEr^AkAn31b*=W6c6_E;VB;`m*LSWywi-5zg?!tcC`*{v?p84+x43>6xxQC z`T~GpW3IC$YpD$?vdtdW~`VFzn>a8 zPh?jLy||nZZ`lajdB9(I|1x9Pe|x)I>;6JM>Gs350}YpTX4u`%RREU^!lE&8Vz5vu z2dns^!vnLHZWT3ziB}VSO2{yQ<|~8C?c&zKL>2IZ+0M$UG@wNkw&$ls&w>Sh$Cklm zi}zp8Kq0rVuO;ih`0z0%plL3PGe!xFg}{C7^rJL>X?*42Y+Qb*;@_*1%j-sX8l9;r zMj?%kN6@?w{x|nt49zB8@4hJjoc}W;w8qzwm5`#`PCxxSjhTzKiv02mat+{JSK6i= z9A9TgCwBDecEF?a3N%mzx`Kti4J)TDTe+e<_vqM<8}Q5H2%ElEd*PDz)0HoiZ=ZZI z#0xOM33(-u8E&GgjG`?7)lCUCR?dQ|MRs{9sQ#0tEge%BzKp->RFpa@{_kMKhDp9Z zfncbq^Aq!Vn9$*STElt1uYMu`{rY!2Xv+4B%P4(<;YNstmmY2{h_>o$n@#i)%JhlCBwOa+G521Kk(5`_X=eLv*gRDLZX20%erc>;Y~yv|xV6g6;2Q&Z5B zUJH(NC+?RY!pLeXar>G(kkYC41Jql5vYwJVxc%$){aMX#SoW#2?@5pO>w&)Kc3qWTEBPty&oLlZ zqEcmJf;onWyiMONMyy8q?9N{qkp|#Y1iPQCuI)1M}5Hmgi{GNon4)GOY#bgP+nGz0`yT zoe)(Hx7AfKdGPYtb^R=RSq!{-;VjA9!bJ84#{P`oQ|(DKnWTFe^5K~NFxV1E0su5I zROrUd8no2qa07f?kAH}hT!xHQZJXBut65yjyKya_qUyMGO3 z|9;P^bIc-jMcY5rbzw+m*kc&(7mrqz3n-Z%{!~-;B5h;jQ=ZN|Zp$rSP_qF;Q!dD* z{KFA5J#GSMu=2{fiyUpP5(dFI>l1vvDJ(R2ILX2K>d}5;o%P?2HuqYC%aX^D|76Se z+uak$j4H-<<;k?aXS$B+FZLfqJE3X5Jp^$x)U$tkR3g(%f5^Y3^F&XbHfsVE;HMZz z6%Sxu`Q1fImBr5X=TDyKKlF;DSIfMxK%TE39=HH}n3Vbef}s%HQ(iWBx=b?9Wcy$( z%ILCGEaCY1V$x24={?pP zQv!>5$XLGo4VrM$wVYe49wZze8RWX^wB}M?kNe6%sMpWw-^GWI0LW`5V|UCPG2dg z5jn&~*gKLMob{ge>k%wQo#jT3&r;Mj0|v23Z(Uv(Nu241x#*V^(t^5Qm$q%@KVYWj z*q5Bmu=0?ta5|*-DYTAP51#@sM047YT)&U6Rluuq?~2_9O^r%5`KvsaW=C&lxFat_xn0r=a14P9fWsZK!1LhTcykn@V54fvD@ zfR+ee#mOnILcva|4uL2Do1itopVA0tEMm9h0b;)T5imr&_w|nypOEVJN+HMP(n*BP zF$W+`H+5lqcX}bFQvIq++K1PnSkUd{bMN%#;DdN!@=a}x38w@qXP8&=#blxMG)8w* zE|dw&-5X@D&6_(d$kf^8a64y|k*;;se?pM*!)_1*ouc7u2*%lkNzu|8`q{QMP7KTa z`Kk^C$J@coC4YO3Pcc5Y{A3bur={?y$AtMg-n1d7yZ0~-;p@AMc|XX6ikO6Lb`}<9 z3-Ma+qEX3iq6eW)mLF)3F~dH$(AQYQBv?wH+3|%HK-#HPOIX*jO`Ba8cdY2Uc||q~ zu5r)%Hgy~KuW_Es)}-`qd-WOrytwDn1S8#%THrGQ7fE4P|{9s?3jN|tFQc&U3MbUbLnH?4uECCCx1fZUZtCEsOW8s|0&EJnULh>x$P(VnBGqxsI zJSt;}{^p9{{j%qsp2biu3k#Lcz58G6*~Rg(X4?RZ5cP_QCgS5uWxREKB0*G%h3*La zgDkjJ4is~KuME|K#WE@UP=Vdmy+d4ylc{D(Q`2&MGrR9jv6}ti54T9O`;mjA)0|im zsr}Ju<`VV|YO%An<_{eUACPB>7;r1Kv1f7RKw(@f>0bl_Dcq@#HHQiP65V^j&)8Wd zxmP3!{pitbb0gKk{pOjMu|MbLtrh7Bd3N+wBOc0w3hdbUj=7JbT*j>a<{Cu37WfZu zRE-n=Iw@L^XGL8i3`)&WUg(z(X$HmrqnZpM%gmw`eJHfFzxL2W(zMvU*4No@`vnq=!h)G`{?5G)gTbHcsC}IgcY;?0p^ZoJTHK8L@BL`;J*elJG=l|HbG}Q3iaLG}QZV_p`i$gZ>3hWia>63mWD&E_6pTyG0)b zKW6>##nTQ-WH*c~*M#r%^Th`qNE6~guELht2}!`okEEqHFg(9R31uGk#%}BBF_GA0 z@x*?K4>Cpj@Kt^WCeLY*Ap}%)Vp0{>+rB^!b}}+D2h9^IIh6?r{k{lCs-Vy4yv=o4^IFX;r86$6k>7{yS;Ecrahln!Oj78Fs8N zpi~FF`&9q1_0#ANF`}iqY^!9!34{Jt+6qMTvdq?nN5d{s0oc3`qe8q}`srjGt z50WQe9%4<4q=!B)-d(;8a#dX6uQ|fA6Qf?bPpnB$lPzbBK-_Y&HHNTg=2pxSCPkP+)DF>7$H zXLYzkSNPs!ioFUgt?Lbgzx^Y9#5fGH-VE*Pv(CB`N!0(zq65Po&Fwjh2(@{ z=D$6{-+hyQg*2_A+UnF6IQbA?u~h!qmZ~7TSaj)%W=%otzu?roND;Vapch%95YA@k zB&Cr9PU5v$v!##Lu+1DK=4WF?AzTyKtUZ89aa-;LPs6BRe3XnVy|+m2_zcU78hik* zdb9XY0=VIZ05s}=YWwf9c%A~>EVW`{4zvlm$|a5#4Z1XEd( z7S$RI3@_?Q!<-ij3@%5B%6TD76f)SkJA}|uuIM4Yl^TU8(nKpj@=FR_C+nsI4aV2YluB%?F-y-TpN4ZL1ij#)Rz(5ef z5J&__inIRmeom?M8|Yz9cq&y!-St`s7k%j?)Mr*rhhuIjG&J8lcBk>G=P4I5=w_j5qhK9V9`Rg-t&-K2fwvX=Y((bjG zMZxs8_NSBV451m4_$`%quJ%q_c*)*0*_?y{9Xq?_ExhGq#F1@@-U(k*-Z@?75HfOl z+*OtOs##};d3Vc^I*8# z)tR3jE?LI41nl+OdOYDzPyscXX!U}A^`~EZPNI1SiBj%$+m2^p&GSwpA4!m2^G~J3EDtadr!nXi13u^zz%Kvn5Rc^hbWD z$j_qQ$_u0r^V!WGNh&BhfOSvYb@4!^z)VOBUB$z^Fei3+zPmuk_mna!EYx zco5(8@l#-fS_8_7?v^{l@|GqVu|_TA7iEJTHEQv8{5AKB6Q}% zt|FRPLY&6N4?1-g{iJP2*h#_`ok8vRzGSF-`8;Dy^m0Z@!dzj^vU7&=<3Tb9EeTId120eyy zbb8+8^?WFyYOwBh5uF*NQdT=rMCEaRL{i`OwT0($$ILnxqlqlJ50dBK&%_31AkASM zaCZEieQ5*9l2Q^vK<%4_nHwG=7B3bJ6Wk!3<|5p_&8{w5%0g@)8;qZm*z4&^XS@#A z^=9z!7y+)lxV*`hfs{P2gi6#`RG|=tI**#iHP1^q&pW3_Mamtcxc%86*w^B3Nq!|Z zMw7Rv6=`k5t(pQ|5_|5dRuf^sdwNHjUse&jH6hA0b!dbA8c;#X7vK-<&cC1m&K=7Zb+bo9s+B0gl75PB@uUJHsC4 z@U^Z&T#h*FRY$sSRyc3LGc0o4f?(l`)n1nQPaPp=f#q4ep0D{EnJReoqoy$i>9st! z%UeN6nVoQOB2|ix%vvoxsDFKoH;&mj0hKRMb(LuB(!G~!`@5M)t=TRAg$C$K)Ax^B zWCSQn^8IKsdzUUwwsq@sHFqugM=C55%&Zs({K`86^JimwWA-cX``34KnOWI5Ses~T zn{k?TJ1Pu1KuXmh@PBK4!v>|*65@KXm4kQs>XjrjyQAtm=Eq5xG-t;lnP#gHiAP_U zlIhr?LeZ&;L!skj#P{mS@lP%IF(nUhQ=BvefKd2#X*@g8-@{dSJ}g?rwC5?V1q%*@0FGdp1*1z#w9dpyK7jj>o+;3R-GhVN2@GN|(e^0661V+v zl5c)4vEFKprz$8esdrxqff0F%z=p)_+W{--Va%8Z$|ofKarV);3Oh^H$zI@#6-q%$ zrRQU1YTm~?t>5|`1`@la(u2j=)s5@*25=%S%!061SJ6Vw(i?Zs_I>!Hdy>6m$}4SW z_2SbV!?H7ml&%7hHWl-P$9C~4C07lvN^P{dPsp0wv<{r4idJuQ`)$guDtz7M1`LIi z>-Q4EtRCA*lBK6+G8d3JZaf-VZ#j)q?J{{79M++TZYG?hNJ51qji|w|ot(1BWZ5p< zZ9!6xQ%xkWc{!pn`XyY}Q$<<1a~U(eNi(E^a8Y_#p6BzDX_2dsbjt>CcbGTtwlz!s zmTdgTe3K_9>(S_6&vcL8K_nd-hV~1h!`uVO$_79^v^N{s8v3r-Xm;el(g=S7QjxWC{%W%A_a)G4Xcq`Ll53!x- zXlu~+RsUnv+L^fnf|0Z|vA)(L$tu`}Gr_zw>Nnl3*ai6VLW;4s$Q{AMCJgSxH9IRe z7l8>YzCi7QRn&Bw8y+ldf!-&MYK=1TVbh+p9La@StZ!YA9DMN!WaVx&DXr=T5 zJyqgSu4WNwaRyt+r$=O(q3<@Cv!8&c42Zi&rbQ|wWK%`z>YkqSi}l8Qm&euLc2`b- z6nbto=#F7wK-X{m!&&-fwDAh=l7HtS*>4!8VA$^M=U8CB1R|UW2v1FGF*7JXq~{zG zoF0c{W9FZ(mAZRzf}Y6W1MI;Y-ocd9%9dh#seg3XrlYxg4mFv4H#4 z06J%@qV!M=`eFLC@ViDZvw7~eynmzFZcYt7>Mbt{#3y=jdgfx ztG6m|{bAuP-TMX4r(KPMTyR=5gtq=Q3_DRnC-mZdQU6<+gs+=t9F|8+=~cNDDJ`<> z4%@|nLqZ4pwMfgu160AMI$zu#NzluoF3LD{b*_?Zmt)UVcr3UetQw zm~&k0p751;(u!{^z@ThZDp2SosW)xY=A20TcTP%Zw5o>#pywLpR;qGLl!8)naY)M) zP063XENHFPn+WB_`hY(!3WBBpJmN=~-d|o6%Z|Y9+5B-l1; zOMKc?K`J*6JSL7%!$6v%WXgO)-t<-62kX7f4fV@+9{;+=^h7XSaD&{6JhWF|NRwRI zK0UFUF7sia10oh1qEu+{WIG~$&*B?4BMgHVySu(ofiNZjg23+4Ci|poP40$XxyqCY z$t-QcVd7|Ps1C43w)ItsjRGm7p5>W426(`!6W>lZIzRtAX7H+}+%x`4tFK_H@&i4i zGzD_PrTi_`N8sbc*(bhI=csj_<7+RA7OyS>F$oGZ-f7(Xq`=Gi{4;il!eowP9LD2R zY~&GqrRH%sgkg+RZLi@T;q)z{Zha0E@gy#Es_)Gg53@E#!h#@)-z;qt3nq`(= zUS&9lN`;96K?|}p*A2rl;9{`d)PqvdFi~&#asn1J5gAQRh@1mm1iiM99-*D_3oJ62 zxS8U~M{wk_GOulF!>l4RLA>k3&d~9r=sn8$=GEma?}@Bf)WFkOJnarL9frgeP3&~0 zmYiuAK1OSfm8E#!X!T_%{&nAQQ=1Z~__saOmn&h`h2lMX2ak%-Y+ANcf{eq;U%F)+ z(i(4YodRg#R;E{G#%SjRSKth`sME4GAPU(7F9l@Vnz~>6>%Y$hpM9MhAy88s*H<@b z1Jw*)-8O>19aV^QkurfzKoX~@U>|gz?A2?=r=H$sfEzh~ANY+O#xYn&we6(9^C3Q* z{wISDUr~gol00=8k=Z97W|>#u)*NPG`PDUcw#BKIHftBq_4sM6dM2Zk^`ySQ#f@E9 z6M0j+X^ut$Ahq5k9g<*D*eE#$U7)STOOC5-TC{c&t&iv5wK|%Be8?eX zSfnd(s|Da~8m(r&u@`G!;;?$PLLCH>(Ve3|FYjm>^dTdFOqP$g1V)*iBqot-WeM)i z0fpX_(jD*-N!0^3gI4RTk45*Cm5qU$RvzB->CLPDU2{s!@WUhsh$*TFxt5fIraLA7 zSawyVQq*GLm3Lg0Rzb?ops{Q*ux9f8mbWRg9jETMlx^IA=Uy&773$3EQatX<^!MS= zJ*f7OFB0&wJpv&$c`U3T56iB2!%x%sEme}<-Zk8_!apXz(zgBZK0AY+1z8TP$j z%Fh=kCqYl&WMOL@575swempt5XRPzLXBe5<&Hd5l0peh{EEem>q~mU(7&FHymc&gvu>-k^10oXcN25W>VwxIu{CNIf6 z4r=GTaK5~UNTSNAL#9z%NJcx5<4MAJVijHIKX<2tqC_|Lp8JEp!DHBEP9^yHKdMr} zHKNsEI3$%~^_Qt?v{IL+QoyS<$k?XZl?{+jq6zFuIc1^f#HCOL3_A(ED@B3e z{UmT_t|16X`_?R`3s5ZL*lx}~W&dejodnG5jwQowlDc*>J2LHqGVWzoe&jraHkpnN zi9Knq^X^>rbj$lHwsIBvZJ>kP7Ap10&Dl{B6vpRB&j|$73cC|Eo}2{5$*Tm^0%yL< zjO?dJ_=Gv4tSHU-rT-KMwI}=cD~1~L!^2G9_eu9I%v7b;4xn4!czGpJzn=z8$&{5Y z`1IoXmy1_dnG`o|Ns>eri6Rdsxaz-G1kNwSLVnZQQ)ZXwR}{87bK;=SFH|Iga4(BN zP906K3zN<_iLh2Xq$Nodc3qmcSKf=oVXXxh4?F|}WXGMyPs7b>+Mu64vY;viEx4=w zJh5^DSPvCfJHCF)9;o?~8&{x82w_$z)u!5<^a?;z1>3Qr-E(dGV`|L}x~3%w)Upqz zK&Ini0`Z7SEAfKbxz984JgR2=!w17>P)_nDSqjNNVhTB{MbR;%kAC(eLJre zTmZsoGeECF0;W|~u6eNYlQKL(NWi{-QPnkpaiPjOUU#Cy0J6l{8Iqkgp;%ACg>FUh zik!PT`;g89-4);2_M@>_h=d0ui-4W5-|p7~z=u|5gpzhFewDpox5_BB({*~JrVxX6cA>w6GJA*kTOr=(q1A2w{gOMIWc;FH%Yzv(D-9$d{vN!s{S z)wlLnWl%T$Q!jCoj&n#R1Lx6b2Q-Qe;*e|*k>VIkBfIB!5reA)BL;5Jd?TrYARfN) zY#Tg2CJ}dD?(RRG?2bpN%)N0K4#<}m48@riw zqsJsyVo9mfwbIw0ocm&~aKs3r{h$yP@?0d&M@RFp9l|6o;Olm+7v>?#+&~L1M$E~_ zm>o+R!IwhNWtqkc8`fuO*W$gg-Os|P*-&KpO%~5~jLg^#qhb~>t^nk8};oj*zJzv9zrUmtV7Cz*EZ}M+$pY_6%CKm5=d~O;`YPtRrWFtJR zw89ECxz`s92U-GxEnL|m?Weu4kC^D(Fk{Cg=UG|frWzJ$J%VYBk6mS87BRCg;CHSp zXnuVYAF4_A;YDfaEKhm>r1IPV0d|p6($zbt@AIiO9-0SGQ;73P3(&Ga5>PAN7|qFC z***Q^bZ((W`m(de6NR{t3woJM-d0)rgDC{^@Zi~+oVZQaRVBR|V6#xA9AmBMKX8MB zdFg*&au;eDLK)1VFAXt29}lrQkkQ1)DlpU`HrWu>U27;F)G=%lGP$^9t=3Lc{a!&L zr>+kg3vleTl-nejdF#csKz9K>_MpiIF)_Ppvd50>NkM*dB@1e>&|=JSFQzBn?7Wn@ zay+8!Q{@Heuc`gNvy%n|2VAvmZ-qluwpK$`5n?t9qFwSsuo|s)ICUAL{W?tQrkA_xSZ43BVVYsV6 zn}*S5F|i%YlJta_$2^zO!{p6TzJFd(81_l=3g-bQnvYwv9{~od!cw_CS|GB4JfkZ? z6vKuNT2F{ZF)l7zqFJ2Y8y^pVLLaCa4oUhQNE(|VbE{8vlPs8~$vP9rDKYw31rwl_ zNVE%D*0gin_dcw-5MIPT4XY=|{^Szl3L4$jV_(>{%yLfMHlz6)!A$bzUU6ed;dhoylLln!V;sbSACr5S)rwFpO(GtQfn^ zcR=gHHDM0|r-Zu}L;i{i32+^z0(hyVu5!k**w1E4hQ(9HJ!7b6sLnfOgjV&3R?IUcmRg#5Nr@Vz_Joy>hb~TgTv^kbpaQY)Tj`pv4EWMQ z_O1p)1TkBw>JWo2u6T|8?yjC(U;T!46B5u+-DPrfEw_<$9QFtNIsDW8MFrnIkvik> z#ZH+WD=qlS4(q-F3o%0mw5&9I_f`CtKxN3A9Ob>)2QWst71=0AL<;n^S?On~CI;Rk zva+Z0@+ioX0Lf_RQigyJpY2sk&-bUZ+LVS4&EsQB-HyDT(oOv+u`)n7Q_Uw{g;Nq@ zRsBS{b6Og6Q2nlnoV+Ao%qcDU9&pS4>|3`a7@i7MqZ@S5<<4JUmaTm6@4v5k(ARDl zJ$KJOOIDa@2!D3EH{Rca8&2=>YHY0zm;&nYhGjBs9He{1`e;p_6Z2s@TtZPI^|9RK zRawsN)Gph;sznyE7eeJ-(?^hl@rF~I&0&r@n6`(6`*l|2N5hIr|5(_QCYX2QB@*O& zFgjUsV1aizyHOW=r^~=ivi0Ig$25J5B1c;gOT+dgLUYgB3vofo*GqLq+Ahbiqx#ox z(ou;1cqO(u|0OIbk*Z|cl4awk!HzTxrSq!}#B$zCu3`)*A>}H|V0pSC3EalCZH*&T z7{YMY1w7pASAmUY#b<{t`tnXn5+3Q;&hxCnq$JbwXKCf2U>KCXFW)&lA}~KYDfxUP z^~V-~?ssyGJTAlPp?*u2s{fcY@tcEZ_J+=m`~@m8yQPnASDb`p^K*GyPC9o*5>8eA zSe*4cZ%b_2ytG!8>7KY zRBwC=f`m#RKhE|yXPg^k#x5F$w_GmM{1#>69VUUT7dCvU(c%ZOq(Br4m!uZu_kkS4 z*lA|r9kA7Ng@8n^O4pP#<5fSTR8!}PXJm-tP_op=S?F-u@}$CtpobEL>RtD4e0~*T zmOe;1qkVye+%9hl*u;m|mHUfs@mEL*^Rw*xmKQ!mwH2vjjlY1<308FEsXN(Qwv6Tx zBT=FgWja;(7*fw^H3Mc0IDFT4l_DI%5z^J=eL78a8qKBHl7NQfB{&0VjoTw_iJ@%6MS4#)Sc};GsCbI{-#S58J7+wOd zrhq0?9^nI}nx5+@SFgFXQ(R%S&#}Ok-i}9;cQ05=^cPFy7BAb0T*J~aiHBHR%y{TZ0+%y=;+i0;?!P8&j?t9 ziU@2z$(4l5exokB%)`DCI6*Sxefa7K*t9sCARLn?eojzJ9M-%{(4 zzu&{7ZGt0%1?hehijHALiPbbTH_%OJ$fQ~JJ$dH^ahSMd!*I-7p05YIsZMx5hBUaZ zhsb<0xNlIou4EzAteXC&bvi$}?vC4iwj2>3T&d_?-KOgg&9FUOhueVCDf2lb6d>O(34A+dAC+HA|S}uLY5za57E=s3ruUQ2abT3(~EJqZ3^36(mMhHt?tvE%w)5_UAS>T}z3x@UOJqF}CL}Kmj%`pt|jlmF@s!ptGPsnoa zbf}N9r_l!15cA07*-;M5f&i%tQU*>Xwau4{nBj25Tw%TfnoTfL|;i(%(w zk+x)|EuoAoE%%yk6Kbtbi*o=9GOL@f9BEj=&xLQU%E z+k^G-Kk9O@;ON1lt5e$O^#$d1HafbvH##d(RedqGad@JthrQLd+rq9&?{lRBic{ZK z;BdX}t%}qOfMG2UP zcQm|#d(KXNFB#U;=?Ibm4(HN7mQaC+iiX*us#+&-+tE_DT9xFpz~x_ zEeis22raGa=}@zj%hIV(sss7B|0!upYTXdi<6oY2@^KNg&VpqIq=s$curRqia1jrR zd&)+0o(>8Bd*2PqBGtU|J%*8gvo!ASDDe!_X7KE{=V!B5gQ#(8e%38j38Ux}SNR|% zY^}2BX`t7TS+k)#+wj}%)oJ!hw!E6geksr}NXfi|usY*utPpS}#}t^UcE1)8DMC#Y z?L5TM5atD#>&h=Pt=&*eY>Qi&}+h7@ZnAo zER$zDCUy%xwKiFq6weHpC3S%qy@e7dz%t*ulTpO^;d)>VYTC|BlhecJ;~g?)L9{&5 zVq!Ge+kVOYh~zmOZ|zl$&w+B8=Pi~~6K{tVD0kzK7`Xp^*PDMSfE-|pceS(?d(Y3L zMO{YHYn8`Z2*{F`>R*^(sce) zL=u1)*4*N;cOgTm7wx+++pQ-Xw2s_qL*qoDC(EUtJRSWq-p}eUot^tX1%YZrw}aCP zpDt+bZZ<^H_#(Zc>EfVs477WrOoYgULsznJxU6`kwEZ1Sk%afRl(B0M2SZQOhYz}hK ztM63@qLoR;p*+2cc!_b?n-_h%(BA(4_9&D5RnA8W zfmq}rtrbYT;K9U2ivy7H;G_nNn8gHrB0wysaO zpKPK}w)*ck3)(3G<5}xGHb``m>GC5ouwOl{Zrp7LB-;rh5v5KdF6`*of8B;$+=Th9 ze!Y{)_AYBJ%~0LYn(!)K9`1EFCqKdev}%7O`x9ZmEr$czKJ>HfQ)TlHHZ~l*g9#TW zuV_zCHErJ0EVYxDd76GTk4NurFFswIzq^rtTO&xS(c#4{n%%t2%W!u}IwhfD+`UlQ z_}KB$ZH8BZVhMg1JSD3V;VgQKF6Ik_SUxB_a5Go*&%RB{4J>~9x7`>$(XJ6JVXzB! z?9Mi4FT=L=(U1CQTi2s^f|A|dox|h398K9|SGCXt=<{{&A$`YE(6z$o+=~AdALdjx zP#qUq7Ip_{A3})>ibe>J2?a&ZzRG_>#lgfuH)-*(PC4|4r{v<}$lQHi@Y;+{0!8T(>J1&8@!WK_@{^%2Zw6z3J_~y*G&|#jucXJ9)8k z7!n&=Lx0PKQ_vikOw^)W1e=TcZJU$H3+lQNp??(Gv~^Y8$8>+XvAGq%i>V2|j(I>I zjaK*eK`#VFe8De7Z}T-Wl+=?e&kPR zQjNBf6|e|T$sYP)bh4>Vg?r|0)E+-Q=J5I8$WocC z$BaP%wGbIP7-jWBGQjzp!<&oYI4*42wTs?mRVgO4jiFjG$MA<}K0yQt_#RbPAw@_h)8x>prVA5`B-nQj24T^%4^Jeoa zsq#BNr^9Hd-J%B&={-UYSG6zFBQZ=URyYPk_6j|JxOJ#jyK7@&B-u(BanUi9@PfDBRatf!K48M7 zqGJXA`b79Z2&9)&zf>i%>2=bDd%gDT-Q}Cv)yLc8i&r;xw+YJgRF_65NV_;9y6p-P z*KExSV|4bhz-EW-_3F`YReZ2p@wm@sZ$__ic$`Rqv7qVvuf)yr?74EEGqaTOgRe{I z{TN-nVb`6=)jY=}AHAdy-=Ex`2x-{qv$NA%fXN#M`^WQ)SJrhbgC0=sj${sE|C;0f zyqR4kj?|sZpW7d zFtWv56VSQ*PiHp~&FFrq|9}We0{MRf@hN~Q*_9t>M+G0`B4?)oL^-3Q z62p*i>oI%x)g^P48s~LUbQd)p`s}?|tZo zO;|cKJ2&s%+XcIc627;HGgj5T(dW^{z39P5;i%85g3mohyR z_4r{FQZT!Rp<=fZPsZ<)iV)riDTA{YE7E~$L*DY$TWCVGuPPj4c+ zEt1NqjXgU4k3sDn%|_ocU$dzc&iQ_HEotncC@Y5lIR~8#>KT{td5n~Qdx?53vQl~% zErx<~8LgTl{Q6XR?XBIzl@8jUOiIHb-0L}#OxA+cxDKy)vi&)zjEGE*Hx(NHg|)dnoSo>NNfpPM&gL^`UsRuHt9!A~+rUcK=FLG=I7FzEXu6;hbD^ zjyZvgM^eaMCk>RypvgleAgOi|<`(siE=m$jUK}P6*+rTXC0h6m9;+PH!|D8x^aNeK zm46zIslkmygLx!0MtEjkGpR|i#2W{w$mc!1wcR(hMY=vwhf5K1l_qA_uLKM7M?b@Y z@L_d|X${@_@u?jP}RTvMcKzc{b_Ip=4=!4Pmld_iWC*0X4gYZRg^(GUu1Kp_MCEssL+6M(7 zJfw;P&-O!9vA!tO(sU+8Ye<8$B`iitVzz}2HzVx!)U1$ot8(1Af_#I>_3|9a7I)4g zI;zvvy~}$wAmQ6bqw#NIEqj@pL8rP$ic-p{cw8nQDa9p`#D)- z8}>&@v3F(kkTiHM&`Fu~NTmV^QS&A*&4m}OM~?}5-^-TKEA!4$E75)*eYPV5mKCsU z*zH^#f6gddYH-Q(95s_i;v51c!s}gr)^MJG%3)mJpY}UQ))_6cdUHmU+h7$4a3ec) zV^9A^Z4ibzWeu_B)*|Vb1NwI#)?Unruv&CCM3K67_%&6XU0=ljUOoM6N07wD$>FmR zi_bm-kuKN@vv)$KC!<$nwfSaFPn6r7=4MjBu~?LPVaj#$nWUX%{pmtAKB$p-x3MkJ zgOpaOI7M3l+3*6k(|g&`ywLl0B$fRx5ZXJExiu(qj2Nn0$0tY5Pd{HirTa>#7bOujx2Sse(-&)u>F-{#kTXuLKgy3 z9_@3~8;Ngfj((5nUwFsS?e9M9go~yEaJ0X9F#;Xv<+t%9e$e~OiLh4C8O^i?b8`G4 z3(0-t`1?>(*3*x@Sbc=YZ3-*;cX^W0fOBbbgPWGG$(u;AS$|MSXn7?aRi!ZDUZok! z^FlyLGAxAL)2we+&?YBSF0CQX%d>-B%`mSB5RV`e6Wt8(eLe+H5)yXFdVdNJ}*fS);&#gk270I zWxcd+?{<_rov=riz{Nd$-nJBvt*e}vh~ilzH;&N9Oc5O>qwKfY`wzad-d881t6Ds; zhxM>?$^9%(s(w2H^~m`;e*0{DF>-{O<(MhzK^z~GNI~7Z60rjo@a>jr?@SlJYxcnd zvRno+J4J(UkIGQP3ZHxWgYSl{GCq91vcL1JWR<$hKe5&U!{-tNKKIk3+9BIv15W-5 zeQC3t#~>BZsk|{|4o8qb#k^TiKqbu^SF78cEv1ybOCm-~s{L8g1XqQNPY9q^H`Co- zHm@6fN?@LXrI$pd_l{-`#5gZTbITV#BXG~J)GhmPrlunZqy8Md|FPM2sFGsK=`U$dON*V|^q zFd(+J#u)tzmN+-qzRZ?94mh*qgR4kFc8{M-c2+zxjzM`ikosi2HpQcSyYTkW=_S02 zDLhzLV1TRQzAl(0mS(iJ`YY2u(Y#ke=%>Ap+-nO_E4J9i+Yn(>Mz*tfz`YT|Xu0(^ zr%uD#XV#qZbHs2tGxQn|g2TF=yq}l%*teZdMm5H&s6H?#KE#pr*LVoQnm|6gFKBS&jFmj zOIe{VW|i@q=qdn3*?Gi8gBbm^@+MPYZ16q?`H1d*a!Y)iFLO&#|h`9+NL;g6D;1Weh*3(c|XyP~LVz zw25gCrqNeS&HO|OBY>gPt`6APN$#XNNAk1k?ubNGMaK;|f8W7)RP{_Hra66Q} z%zXdX~M zN~pM3pkc--Qd}p_CDDQwnK%|Hx_B<N+~pmsu}}n?d5EVf8XjLO`qizx_O`NAE1_VG1z}CP>}0wMzi?Q@;Vd@B7P|;T z`uJq+!lCTlZL&p%h*{EkhtNuo}@iU2~6O%kJ%xjIBV=#Jp^-6{93a;D*%dxlP zsxkyu0gG3FbR1^XtC{2cj{1g?2a!9S1MX}J=GX0MzC5H+6b$XfjV(pl9Ln#7>4;;6 z;3~>?hPVi@Ia9$dN<`F)+PFEsxjeghb7PRuKO)TYU(GK3=kvSt4BfuD{v$?6()~$Z zlYLSsMl+hCULPx9!{?zlwr8J(iY#_q+x#Y#q@_{o=30cRSw~=RxV2F_e$$<;q?J)U zu%_`A?;g$*xz-F;Ghd)l8Qs>AW4>0RDwZAgjRy#StEURlEbb?wC55nhaeJ(vOh=dKVP8~Q zPL-;U;W71&6QP&<$h4TSHAgYIXkgTh%k-Db`T0oNq@d}m*$tevFgKfAWJ2~WwJL!4 z{@$y5Pcye_6p>=ni_gHx_*JCR$t8pCY6Vf{!@IC}+)GUFR5#_7dYF1=kzKh+?BUKm z!DG|sfs5TZ+!C+b_o^Ir|JY6o0Ml#o@6oR);j3f9Hu&7 z?YQMNl)p?(p#O7E@epE{%Kbn65DgP6{pSDJt7J{m=(`0q2U0!7*}qy)1(NqE)5dP4 z(_Zt6%RF0PIZoaSV-JDR+LTBNk=^%p?*(a9>y{IO!vL=7`?vj9A0mDPdaHZP@zlCE z6Gu7CY>O|yl^dOU1eDO_Nvkc=OfwGF_t7&)y?RMawa#qw8#?Sa{Yn=)iG2D#!EhHN2<=Yi4by8Tq39bIKiVVs z3YfbuPnQD_x#9KQmnRb&sM6Cu&48|zQro^u7-=EQap#$9@wyZWW6+;`PKW!9@_y(g zvb@W$sATXqWh5=RPAUapCk^h+ZE3|Q0VWkE1WK+}xu|Y3k-7hu_m_YMar*I#_01OB zi%hI|0Yk?utio+=(+Hhn71wLH1gQ{~Jxm~&rkW?D&qRB@+(YE3?tvF!R!$T26w$Eq zQDsAE&hyzv4c`+awucAb(Lw3vZ0|IifVuaPhft9=z)m{6wsYJasbRg#QeG5uN{VUh zT{5pSwR)qXx1hZWPmRkzz4%!4zw9{Sr<0Gh^WJr!%V|b0_B( zxF6>NS*m}N*f}1eV^e(N%+Xb{aoV7>Z9mMz={!n1ws}}vmkQD5hstw+=zEKKFxD$( z+eH@=`K@;q6nu+9G1>tpbxOBxAzfhk1y>Zv;0SHxwpAQ)s(LUKc}d?b(bN-R?JE-)4w0vTQ!w2a zdaPJL^)(CRrny%?fc0?rQq_V*URLB|dmVz2KEKbe1~WgnwbL%dR5xsQ`->4Evw|62D##;~)jJH_ zof?vjB`_uEN46Pso{&1?ymye#wzq>T3?uH|io5~Kc3vvSfq${j2SCfyWX*urW+;k_ z&*^`sul*xWut*8ecQ?o$;8)unF}$n27H`>;Y5R73=V#gl>`O1y&gihs7X$ebXr1m1 z^Pb<3Z*@^8ta{zxKBej&!k$zO$ivHPx>UZMBR=C@DB$ziPUm$9WW^QIEdt^dSgi*K z`g<=>2oxs&$?jmA&#t0(2SQs^m_mJld>J`1S^KTuG!rg)4n;hequJ>nH0<$-BSqgUgn+;r8>7j@Lm?@gQ zw>MaBdVt=!V27u9&7AHp`aamq-HQ$I;M!6T)n$kslmZ$1Cpl2WsHra zJFj4_-9^X8ckvh2iETvGzT>5zmLAPJ5yNW0pPZ2lc2QX=#6=Ev<7=I8;;a3eD2}ER zRjm15(OXJ4F_mnWFwi=d7DP;hY2gFs5uCN~0cX<{)1nY|p;&Bd0hVlQ?m*{#mhWTVaYf zDlq*a?id7FhI?*Nwm4cSet->B0Q|spNKi}uRmTnj!%Ippq9u(>JOqewI#s1tdE7!r zxb2i+G$iYGZx!owVH1fcex7OZz;e)A!;EK7M`B@tE8w&vAl8D{e`6Q1S|h|^U6h;T zt?P*tWjb#VN+J(i=Wp%_t%)d|o*%=sz$V3)W3Dk8{aURT%eH@gGkRhBBkU<^Q%>bC zvo!vI%wAWp%yo>ZeYFF0yR=JB#gzC7K})Z&gqfjmPPp4- zx;I%#8To-D8oVXJiWvGC9gY(Nm+Y-Lcy|;8esBs~bG|UAoWp8@lj$TQu4%~Dzm+0h zbe%F?L#)_$xljS?i#I5rm#x@aocNQ3r66^bgo1~N2$whggCz@r*e)Y0-k+P)u0-7a zc;Y8fy$tj|^zTk{lK=Re@z3UpP4kxPR{FdGpwm=akEt=(x!pu}&!n<>V*6=CIY_r+ zE)K!y2%h`+A3)75DQCOWXFf3NOr%`1V(-&5*Q4=2V_hNFQ5lJ|R6m@K^;ha7+(``) z%;xPiiZ>_x_37tZ;!}Qf-4brDoz&;6&kn@rcY#3rLF6h>!_|fCR1)@-K+ewiOr+*j zMYwH&FXa2x?2|76vJPMTFC?X&z8bpF@ z_>7k@MB@Mm+=c10r_Y|uXSY@Jkb)J7hyZ643C)8y9E-cFd1B1 zJsuI!a3h*Ua*Qv5Yicw5fQ##N`l)PEqy*y#+zydqT_B)ZL!1QEcm3eHkGRwq3U%Yrf zcL2XINA%#Kn%AaltQux$S|ixlpvYRdcv|Gn28(~=C)jUqcfOx>Mbf!!V_>G^m?f?OjJx?pdMmX*=* zIPxsPo@9H7g-6KaiGJnvD!V!RW%uOG>`6;6c0?Qhz^YzQK$&h@kvS9rv_&7Zmyt}& z9y**nw;d%74i_>88njiqqoF}k&&Yy^_2~yZ916UnoaE-}(?Mx73XylM(@2*_>?Xqq z;OT8-1HRUr$RrURcRlb*&s^y_2SuU!18m#Vh=&c{<15rv#fbauh&xUeA1tLbaOs(r z6_6!;hNBT2CF%f~=lZ0pAH)3@mf2BCD5Vw3qI;xr83?#j-NOKuZqpgDX*4~0dwu<( zj>2$hFCBr74tuwj3hpkfWpo#IzB4n~ectlP&Jas@ouej?d9Zg3Si4!dl5I6$K3pN8 z_wn;?)ze?l;{L%2q$yG>x4jK*1nry7tUz;qvt+8J>5|AtG(D>*87E!rTa^&bHp`Hw z(wWV=CTlaXhYRlBov6kFhuA3P(Qz2tfpM%v?4E{)#*%l(51$2-QI$i~H?ea*!S;%(CNZ(%x)!DXOur&1 zk47hNR)o?0#b1u~dKfm*S2)a>At4ria=`31I}6j;SmN}dk#!5%qeH!gpW3WZF%WFc ze@J>b7Mgjk%XoCrpVZEtUEW-E&xi}s5{ccBqGVU!O%$Du*VQ=4bl@7n2i7)LLP8tX#%T;? zCr#MW#jKNj%www1Rb*RR!eI6TE3X2KJbQKW zS^7)RmbM4!(iEG@p1=5XtAkQ-E_7!gf@jMN%H5wy6{RmP=XVc{Z~(uO4#yB z*Z0>+hLdag-1$N~3G|kf_E9PPe01{m_2{1oHAbv=Y#K85`?3&ohFqB&*F9+m@iNZW z`x`W__cxb5Wvqf@4o;4*Zte2g(5DRk^)ML)Vy7Wmy26QWA(I!#S2cls=JBwlzYh;_ z>&&lLn##7}k{^`YF=TO!b1RsRso`E#iU8M%m3tYV1@s!%2$~eEGnt^XeR6(?O3lqX zXebY*xeZ_iJdYvCD_Wy#i18{gTJOoDA=P^X!CbZj1ZI=%2$rPv(^I>d8B%ziPxD91 zmDB~J=b=G{0i2eM3m!~w*JiMFj&De;Vm#&B4PrJ`qQg8@k%{G$r;EYhKq&@L!f?-_ z`EK+xRL27fRz3I&?$ot(u86G}H(4?Ce1<%oJA9&JER^WC~! zaOByZl1YD+@Y1WrmZ7Yxmfjq=IQ^`|Ti~tYXbu!WRYO5-qW@8Yc{>aq>o;idT6@M2 z*&OG*Dz-9w23-`)L3Iw}I=zmzYL>>_jq0_E>@ip!)^=qX_P~EUd6vWJyDIVS|0;fP z$j6JoeXjq+B`}P;NSK-tCiZEjI}Q=dW>jkl z(jrCpec1Fauiq+gCh2)#3`$b%E62@8-81ff7Au0B%T`jfhNx<~Hjh$;ix;!{%^}S>Tg`7Weq9xm%Y0MZ6z#S{6!mZHv?AxSl_&{EgA;gY`GAdcc(aI|B>K_m=~+Wmt)S zHGC-2UtgqK(%+bTcG%yzmp#FT{L68<4Dj{0F8g~!`x`gYO7d^b*x%UFR#NcbFNdG3 z-@m*_iI8Ms#1W>WdwhgoifK*^6E&DKsg(8?$1!y${>DXrW88^Y{q>zfLjUWl1pN{? zPcd=|RK~FPQM-du*3C;KHHg9=;-M8TNg#H#y0Mq0D;jk!){f54Kpvt((m18#gf_&c zH)Xj)Qt6svABtM>w-d~K_CdmPkeGSwWVl2-*AN_!))~>trGHmWHuLOUB$j_2vkgzS z#YEnptN@J|(v7ZFMMJvO4>{xaf6VyOp+^eC%k^JI;}5{a03eN`CCUq78t+X|rJf0M zR8{}F8{QKSyLGuT z3NEvQY7*1rt5w!k_OHP+kJQeCkM1Zg^Ej8H?sTaS^w?#8lWr5T_~}t~M)GP=9E$;v zzO)sKzV&i$8`q`4cd*X-|9IL1I#z7p5$1ayaPX;xu8`g?m`Eu~3+Xg;#7(ImBz|8e ze}8Tzc9iL1${6EbdXgx*#hX@7pYl+I+IWQe=3U6(a;PdC9b*dRGS2R?uxfn8R)!&O zDhSN~-c-g!+l`Z|^_UiBOs3OgpaSbGzvyPZg=fpLtq4|6g76menw_clRwl7Zi6~cj z*XvmqX<5Ec?2#P%;l1$Vh=<*y7hKBJg2mEzXTb<8;oi_4E>5*}-d6A6_ZM^rW2FoB z-T&EJ3cWmH-=TN*dEwpU*8(Leevd2mHtk0&46c4Mh3a=i+TiW?CiOfp<`QkxK^*qm z;bb!|gMZLL=ruWn6$u!kLzh zv0gdKNuzZ*SmB`c>%~Ke!eV-i2MGA&hH&X`X0QWs)Q$OzEC_zWYi*CtugBAvSaRR*$GaapT>t!H`A_-+^3(|J^ z4U-pi$lbeNXZo}koXNo(w&x4zRT%l*G)FoTNg%n7)t*a9*PLM4#{kR?YK1PS z2(!QkLp+m5>N;8dSI3fUfar-ie#^Q0hbtZ_HITxL-H-b##`4^IIhaRCoKhLY6~#XHba{E~3DFC+B(>_dAkorZ3XBwXJ+Dne*^ zjC$gMTkn2+A1KL@e0%aC?K(YtKb|Z3du*6G8)yzCG6SZ2I;lR)7Vo36pOcMwWU=)i$WMi5t+# z9O0dl*JqM{+9`-KXik)~dnmwsrVV3%@Hlr5NB`Q`|JtDp9%!->xiwph+q7wj#luDJ zrvRyL3~8kP=aM9;OaK0&^j(dNWue0thQg%%865(HF3~V5w52~2+28d$wV4-)1}Ye2 z6IWZP>RmaADQ;|^dFsaUD9R&&7LlAvQ^GyS2ChynvX(vL&^<5XpzJQ@A6 zp+cv>1AFK1o$;ZguZ_SL&vJ?X1UGS%3dtGg|K@v7QN%=4FqcTi3 z{!c{gDtFqy3h3d-lt4(<0{WEtaab$4x$O~WR8NS?A26}co#$m(MQatzpxo6mNX zWt=?I1!jM1e`6;$tEzp~|4r|DLL<{V(MQ*$>J&cS)6A)Fk0WLkD@;ivWT$EtUOR6P zbWv4fb|~w%%}TKp1%A&yQ;|95LmvelytoL;F9*tNLA(26qT(qjS)F#meSSkDuSfj1 zI3kPn2OIh}#Ih$hmyF3^k=a(^F?FX*6GA&BjIZ~npOFym9p0<`R8|dplVV|t*A0zC z5C#E6jkMj_X=wSUWl0-h80eGTjnNc@bS#vTx6*e|2|!2ssLa?Zjx!$}L3O{M1E*4@ zl$)}=%jy;0ov)tyq?RZV`Efy#y?wxhq_%UOFU~(TQ?(G=;9L-;{!I-fL`*1;`GV%9 zrBEw_5I=$*pHgPzU?klHv_`Z4(5BS zvCGP0JyN7$P@%QtRoQ1%%LIdA0IFr2j~_l{2gu91yqNnnc#S;)WVp8iJUpPXAz;M7stPoJ%)_q1*!I~y;Fo5R!??AMUl5S5c(GCxLlyEU|#O5y9j>Jok*drZ9h zEUDm%xD7A%;C{MQY@eJV)4ll)7eQFXf9Qe}*y!QK@v-fInsjc%?RSAuX}BUJ|N6?b zr-2jXduzIO(7yqW293Kq*`8~7D>|I?yg^!&+LNaUJN9^o1N6U_tKsm#(GOJ!fuK8= z-LK0*Awqqv!Q`6Q1%gk)mEFxS6iJX0aarvMkv#S>(CyN?C z1QSkFI7oNDdZ0J5uP#sD*3ohwCEs~0o7&&;0O$<#u43wCO&1i@k%poN{ z?6NR5U41IMSYMrrTBVA9^+Z^xcAHbp{q3Bv(avnCH-h33fK&A#WGD|d;PRxa zQ%)NU2IHb^q`1M$g(TdV%Su4t_v3oJIE#mqIJ?b4%5{MQj0lu^Fn=jld_!y zDbO@=u(nooNk8jF2}iNPFn|x5efv-4ZAIf$uB~ z&-4X^!@I7j;N_?3^?98CNW z#Xv3HTi3^Blk&DdogV9aOc|B3K>1y0X^|17oGq(E@DO2&)VjX9X$-Em$rjH5*U_5_ zGQE*p*MAE#1YLz{d__*l?SC z0D6-H#?X8-t42JF!?HcYUwN85h_mLw#w+gOin*2^hC=0d5vv%z=!U62)(-_JNT>DT zt`5lP_vdg2oHs=B7Y_SvH6~wp;QSiBpF~@3&OdW53#(~8U4{!{OS3>uv|A4ikma3~ zOTHHJ#PQV`K%vKGe1XLfW9_X>m=x(4m?BjuiuCX%$4$7D+9xj*U_YJiXG*is4)y8XyllnSk zkjfeZc+oTmFL$DHQoZFc?(5oQvadSF;nwqwh#tS;2|fDBfA!rJ_;kUZOZ$2+M913r z|NZ|qrlXC7r?x_851G-$sU^CjJ%(PK8|%?Y>$xLKIWR>2sr~Iv`>k&dHrCyw%EjkF zj@a%u=^xl#FIixHJlYu_Z2JF0|6F_y)~iBpDaSQjk0Y2@s#-VQ0Q0lFP9+phj#+cs z|J1VB<|MS9uM!6C%(e+j35pjdXU8duL+M3ewRNsbYpEnOW4J!US?SIa!xGY5alI}g zKWuI2WO8^HHmeP$)fj}W+eK}!gz8ILUVS)agALmiAQx+|@8nRXN+8#6e+ewec|$KH zn_Ady!j4o~K~H;Fa^Q?1xnsEJ!;o5Na7UnF#R7YYe1BmFLGUf8(-?~dh&{GPTk1ozy<8InSWiFoN zI3+-@j#wQ*qr|cu$sSsDTizj)G|Yvgs^Q&FG?xLwGcWLxbpvh8LAyHiByQIxi1@R+ z$LZzL&8E2y9c}TGazniE)_HR+OnX{Fav`tW?vGhaPo|BqQ~yTEATGjL;qUz+uL)Cx ze51-VX93utyvt?PTbs`wm?I@Pq)Xy5&(FO75c1we)gCg<7z0JEFBJ|{o@H~Q@a3?|(hm`NbQ~7%oxuUyPFsN2t6<{Zbf0s){P2Ee-O{1m zA9tE*bo|d(|Ktn#fUP*knX4T}6SA3EU?<#z&T2l%qFs~M=!#6GZ}sT;%f0|NW?#pq zyMPsjj6CR-?nlFn{GhU!Z|4E&AtK_?w8J@ED}+F{(}q;R-Iu(xicBmUD~7~w2#P0^ zm7+O(*22x=JMqNVPNgnMV7{jKnI(49kT*3b_pCHC9Q=z)nGN^lCByil2<+a;r2^{R zSyr5?LFaRELi;iHrzqpt53Otb9Sbo5B}P}8!&iN&_D^0AiI^i5)|)-Rmb<>5-xnOm z%xE<5Wm(tlSU9}X)-KTB2*FojhEMbiHRtWcFmh8MC;>)fPc!A6`p(Vl@5{I& z449=UOue)*GukI-j(bTX9ynwy6L>@nHUIf{pL~-R`E4{Jj!1@fNQdtFbZVKafn6pS-{@y%K2_I=_>=~ z9b93_Zs)R~fnmK6mk4T(&fr4L*6+lRTXRj=rd#{g8qGUcpu#OydM*8R6XPAkLXZ8_ zZU9IJps7R!_>@UMJ*wu!5rXb>-e8kN$B2WavzUW3$Jm&Iq`w^Kw^Gzj&l*6GQSf4f zl9xgzPcO3b&KYa#ifLT?U*?AUWp0#~U99W3q!}|}YK*m!fzDR;khtsU zV7$MDEw@4A?oBsFyOX`G1fVc4`@nh5P}gvFV?DD={IV<(h@!uWMV(LYCmjlblPP03 zUG=+Ov|3*fUImC8kVTZ{4kAgm|Iqq=r{5Q7_weate;mR>;TKzLdBgoYk3+$27co9b z{l6r7W;-sIuk0SLK_H1E1?HNE?YB;Q5(&`e7`3Ed-+sE8U=L%VEClRCOT6frqs#!f z>pc&2NB4YeK*_;7w>6yZCvw0eU{y{YCd9)Th9u4EiIzZjgh&K=9XS198_EC;A#Z|N z8hgxdi#(U|nm>oIXpsf7f}GT~UzpyH+zobj#Zf+&g0ZYqJO7=-&muwZd!3#Gi+0SS z@zRZ+YB{|?k5~=CB1`c@{C74S(P$uB&qfcv&&RwF3}Rk-*DP9fOP?vF2{Jq|7aH>wdWB7J@o!@YB}i4Bh>wNw80#g-{{oI>}s5~^RF#jI_9E~2)| z&GclBL_aP84_Ohb<7wJyH$4O~CaCXxCjKZfE@^ptaXq_xI-Wp|;mmgcbr)99Z^w7j z!^ztA{?p0fWVk<~y!$uzY5tRJ?2z&wJ5b}jP1u(Q}+EHO8(o68@vWu*|%+qvM`-_EqTe|9ss0$v6J^R z^_Y8UVH_^8l`1$t4@(Y4Y=bN+>^5kv4rK?sUVK6I7qtJ z*$^p(NbALxd846TO_BP*^0-uW;8J()BCRA_yeGXZhBUbpjPJxhnO?(7)bx2Upq4lY zs=KV$4h31_((2mAB3au#=xu}VqugUDwUUqBhLI5`@)W%+of1UY?JXLUPJViC{a%VP zESX`C9H#jTBdEv1=ucDIK9PU;6jS=gNn2FZbsn2ISfi^f{-E{nu&iR6~ybXnn`2E3Aa$+Yh~89rPrK{%%3EPu=~MS(umS zHVc{U7$aokh4{Y1Sdq)jy+k`f#f$gX;mCBgT%vN0igU1tnlckpPdeSTdqih=+g^__ z0#Jq2zS57d7fR|a71qk|gv8GGW}copG9#E?8L&pN=q3BTOSEf3gvf(HE;VOHHb{&_ z&bV&8E24qLZoTH;L2D>hB9-u{ei1owrnxZXxPjr@QFFH=dL`f?C_Qrb(LDg4;X9_)uv(*Z^{O!MbA?!9nujxOafmIvPZ|5bYV zAZfiFcxV`<*wymEeS53)(mDZ@lbBc^^Qf3W`2wzaDs zlt~xPl5BUN^zdRNWqesg06qdFf4sN5HA)BqYMRc=Fl-W;>kq zgA%lbC1<0s6WJ$SuW?y3OdnPkmp!a4{KnKY^AuJ&AnVyVN+2nHRzcmX{%-7r_`)}@ zUn|G+l?m)6kV?U_9+)vlXBRieon)njA37=r7vzkz(8`l&Dk}lpKc|O`Iv&%nTZShd zWaF>yj49lS-7#n8?7bY2TfJ73y$RgxJr0%S;j2azgjPZTHIGB=38-*v_NExAb8W?>iX( zHW4!IOcw7h+ZTMCi(8n<(}-j+Z0VFD>h9@TAgG?O({Yg04`r|E)oVvwyhWCvQ*ZPf zk{N$~QLb83q^UN!m>jjJWNJ&dlaa{&?rk|~MXVZLOXyJX`>%dwzd7Q&W9{NrXN-+r zvi%&&KGQX>aeV8L8R~wE2A)Gk##PLIu$&8hE#aduSp@hT`OV8D#Kz2is~lJ7PWCwC zlIk3W&bP>0UBJ#|ScUl8nt;Jz{KQiTQ){ja+cBUnnb4!d*;!TgV;Efr#~e&7A|a+qb0+(U z)-ZVN4e}T@la}qz?eL}UHw??Q>96ytstqK4O+dP1M{d|x_;KY7BUh3?Lkw#DVC#8& z(F5_AgY~KVHanW$;6zE~yuJEvI&*@)o1WZ?xL($#-A`6rXAJOuL?{Xi;O{}nDgqD= z-Y`gpoSOl$nTBGcHLRxA+g=U{Gn~{*>ZZ{{*K)>#EPfij#3!zw)J}n>=f749*R9cE zLeEOPHFf&pZ^YTeZXBMD&h{WbVp7?^V}-Bs2Vz&F3+&8TVwK!E{K7+i_#qc*!=uRc zJ{UEJU~!w1R!->Gzfz!(z@F@EO% zf(FP8{h;tqqUFd&#Jh%Fm*Epr+Ve$+IP^~vg9hNobXrS`kPd{+>&U}Q==?@l`6+dh z)1!6S?EK<&x(Iy}!yNS88+mlt!~fFNJkGy=Z@TEea5V}1U%5J27Ju(886WfkUqow% zvjyFro~B}i%GS+4WWGUtch$?h3dp~>N@kb2?42_08)qJWbzwc`yyCl7?6({HThsLr zNrlL$pHH`E*9aw@+LZ54HfyKDfo?eYk{y{Nw@}tk;Qz}MlH3`K@=?~kx-f1>I2~E% zuiTK_jJv{aa?zdlVls5*+sQLvk=W_FGHwv0Z-N`; za2CFk;kcu$jgvQTh=h<;i>cP%I0z~lqaG{^D!zMYpnpW-)6e;8Y45u&mRtHgq&Nuf z-f-?1dU55GBCRLsF_XMUeO=PsH?Aa)tg?GA2C-r)z&>@O-2Ne0-GAxEN1lQe16^8# zm03ZFW_8*n>DFs!Cqy19QlQp|%NX74XRAQ2c0X4(`P@SlwOG4|&^)=vP)rm;CfWcT{7)7|Ix_F?<7}mUs z1?R&JrPYe(qL3Zms>>gOX;qymd>IlG4}F(0ptzuIKx`aTFIH^9FH2k3-CBzcwgT6G zX{q|kEoD|sH*^f^6TS)EK&rn}O&4L^)f2{p8>t({A+JtJ637 zM}A_1BCIFF78sLMp^X5~)rm`0*TOEvY(VW@m+>~y;dM5(;c&kSKG*H>ux@B~q?uc& z%Ef<@5VCTsHKvm9U9~PHHd`Bv@!9KHpWv(PC*yDR2>M~gguFZ;DnFCA@NOxfK(*ie z;mtZDCRJu1IErb}I=-Cgq-l;*$5lMvd%+&)oz!Wt07u!P7gynL;9?s1Nl;Lib|A zziyz8tf`(8f&Pd}lHv}e0XM|Iq9sRb39SVR{KzWK5Yp$b((68)#b4=I0-l)8UwoVX zm1Cw=F)TkKa2)I@h1AxxUE_ch*SNFj>64V|b?z`)a_h<*TT+JEDhoMX?TWm!stT>m zZor2gHaa-@aFb%R`Fmc~#epDtHVYJ*eo{%l1Lb5eCMGd1A|ZY$lNxm#@3%kwc{U;o zV|QwPY42Ssu(q${xSV1unK(Stsi^m-??# zUj+l@KOC|=LG;ylXV908TKralX}_w1I=85a1I=Vh>~>PI7CrNy+Hr4U&GMPkiLNULwcJPQs+Z74f_v@! zeyA{HS1#q}(CBKX5RiRggI&z4;5T`LF%zF?;Cn@mQ`bIIB|dR0D#|dxj<#dWq4~4Ned(j9YtQOlB&WB9alh%M*W6es zIX3!s^YEL)GN08QX}9esYU_iL-Gi&cAn^y%d6o`k<)M*2OzDCpEit?=0m zu}Q1f9A4BSF=9rWr-z`-u5YU|?Wil8Y23$Tb4Me#YB5zF{9KhlejU4_s#NyHT#z%U ziC(44w7Y`7_CiQ*;pv1L|y#VHS`c4-?}SebF2Q>OlPdT?q^uM&HIe){BiX0_5*76_4#RQ;B(ql zH)0`>2nzX#A6?e!e6L25n7ReO-nl*hW6=tGfNVhLY#fgF_lLEJz~T|yB=24C1{=Lq z$P@A+rb*nc>^fbVB1pGfpe74cE$6VlO_!};&b^&jhKdGnW^%rk9F=0fs~r$hcGQ>( zGY)0=5f;E9dOmxj+S4s=W4td`WRdWNvY}Wf*PC?yuwCOSwa%cz4vudXobK&~t!dE! zOhPLAULDW=(_x%jmEB#rU4Qm1`GIHAs1=dCUsDiCnw30PJoZ1khJ_=B(G82G*cE8{ zIo+K$&cp)rJ(GjnaTC1bXS}R;WVF!XYlUn3GudrZB`|H0IOS590}LO4;wU z6RD&`mcH}k{9-lHR6J`cm(@@LiHBEam{=cQJ6JR&Xi8&c7bm(H!4|r2x!E;8X=3UJ z7)A$Nyl_}}d`#VpQz?z$-_0|&7=umOxx&?2NeH=jiTg_%Exq<1w{rx$wwhA)h=cZT;musgJdW-a z85(QW;$Z|6u0gGOl}Jb^DdtBCN)_FF^WN#blgx^wC=mTKfJhMDI~yg-lFDWCHAl0C zrvL5B(=L{2ZRdt(Q|iXN1WFss^$D7rwka*WpT7uljzRod)-8MHdhDM@AP)Tsd;E~xkoF} z_Nq%$R?Z}Wt~O$CG|f$=^QuGaN8r4^YM{asO3jVm)d_Kt2Lys(O0HyMDQK6#2;eA5 z^&a^Cv;GY|o@5m`63b3Bsb?vlt!@n%j^RgP^1#VI=2a#obpo|gINY%=Isr!$x8o7t z@r0AvY6U*5axEP=(>(4z)**A;9&Akw-p7=FB$H^43P=>u!C5mJp z59)OV2oidf1XEeusm5I{oO^n{BleXqym@F2V%P>>xhQSZaAbHG2jvX-z1g((2N2-5 zUsL03v(TiI0MFwrUra1*-h!-+fM2?SWPc^%SzDomnEIsQWYB~Kn4XVTH#<|53WYI4 z&TUKrJnFl1ytbROrTRRtH8ny~CS%?H(q^I4_EbTu>4&1h-G=D(7Q})p(aVZ15Z##= z?R90$54IRtKiswfO76;C%rYFS6yDNlq88gLk>YWt#<3=P2X8q9u#FE4&~e7ka*4#rsaCNH8Z9Iab@n1YuBBt`4Ge( ztFATBDPhD-J&hC3B0rj?5ey8u>bXATIST44?R}llSMw;Q_YOFm_0}SsCV%IGO&h9i zKgUEW$mX|o)W2?_okTPcB70sEKQ-T4YYRre@xplzSC3V`zqz-ChkJ7Q$?%}UpD&t! z?dzP1{p}~x2}M;?SdCX030>K zYH7Jv9~E2Q4YO7!e*{NN*OT5q?W=EVcPGZGSbEgBp^&0x$EQhdl~9cuNmg9P3osAH z{`5q!`}$fWN<~)$l_nhAe z?#+rD4jafQ#rMqS(urJ~p6-)s**-SOC4@ zIsJ5cownSLGFPoL@ON7hz0zgUSW}3^&OFy|s>octW~f;RfK0ViSIK_hRYc0Yt6N;% zsR!Jeb@M0$5Ese=1LYItIy+0Qbuw3;olA>Y?)}|aN7>*t&smZT=qs?Rsf1?i8|3U` zu#diyY%8Y}WG9m;H8c>(~8^99tL2aJawO6kaafcTD?}jp9Su|H-#_ z#OMkY7d5Ey{$jwVXG}%t^^u>%`wE?%-BwVCESTG54fwxPBtr%8HcvnmI(~b7l_+@~ z9P6qppyd6(>(=vOBI5|07QYkE-cNZU4(#^H%{w7TC!8XVOd*PV$zEbH@i!^U)aJbB zVC2}v@yksqNnbkJu(-vmkqfKUQ`ujTBb%mmrud-wdJ z_NM61T)Cy|@66KzNr*rB@rOQ+Sfj=`YdgiE!S_sscJKO~Hz`W1-~wZO%IBMDtyNZM zH+>IPYo-M06=z8&m^k}=`cB}@S*r$N4(_3BbTM${C9TSSnW+!)XOWo>{g&1S{OPo*9@@~~?yFXNuKpc}1&+ohnOgW4e*lNQZR2BQKoPYc6d;mcj_dIiX zj#QyT+N#?N^aB0#>{yt#ws27Vr>ili@7r7;=B;Yg(C3qYNUZ;>+2t&a*uYN=`YMPr z=P=e!18(nbY#nYKPM;-)vOGVjzx|s!@gBd#nD$6+M3mrBjL zcT%5757+$axl9A5>C?$%$IU7&cYTIN()n5eBaMFX5cc>*l63DLLZ?@ZWo>=D29%TP zn*~N6%KVYoj$m>i0TVvfAhGGs`ZD(1zn+cv4!3svrZR#gAX9PU>D~yp=D2t*uvFbW zz-3exhA=^NS)gfd@e`^hafnW<1NQl7`}X4a;)d$vErf1&uiMEPVN6H&fElp2SNAoU z{Mbta?Ky;8f5M4nq+-%+?EK>5rBfVZ;-tVe6iP?T{ojBWO9YTik4D=Bvyx~{Dx_QR z=*f7k;<+-T`0lSRa2Y<&&5RD)^qfVSI<(%A7~fVne*R51{P~-+BosS9Ufc_@-}euj z&A9ITO6??|OguE1_|;G*jv?*{x5bZBq|1DkT?P-xZ1$R<<}vufhXC3{hY!F4mSOee z^!M0J{wqiA&FJOL`Pom-zr|Nkh%UPCc5Tf0EbaD+%yMsCyU!JiGQX>pR zQ#m~CK^!oBW40VQgm)blR(gp(n$2rDU1V>`aVsdA8DTA-NQoRG3F$ADg%2km87tU1BkCG6e;4q{x7BkS|`- zoq0B^?2_3I*{7Ox9DZeZ#PIsHDc*4B-Z!PYd8FTvNA8D{=*HV8hBalK7=Eh`2{RbJ6betk?2rLqzM;?n>&k|H@<=dlw n)Ys(dAI$q~_M_O|;4NQY@y4zKpC13u|M@@v@1y_c|N8#{E)d5S diff --git a/images/nginx/rootfs/etc/nginx/geoip/GeoLiteCity.dat b/images/nginx/rootfs/etc/nginx/geoip/GeoLiteCity.dat deleted file mode 100644 index 1adb8c3c49241cf2dc55d4236918f6c67a882b71..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20539238 zcmYg(2l&)P_w`A#Np_P>S$gknhTeOxcCeseMM1@e*g&vg0YMS4f`E#O1r@~tD1uFcPM5I(hvi|{WdYK_ zJN>O0{jCh(0opNZJEjk0fd;G4a1{a|1R6eoMi1bQQQjS@gfpr?gi7D@r7fu9WgY@iHK7T5!9TcgSW<$-y?7eED|BJd0_Xt}Bc zR0ggEt^=w7Re|N2OeLpYKWvJ@bYq13wV3E`h2+}E?cf@(`TR&PzPYO zE>KTMeZdC6eo+Fz+I7rYd>j6qwa4y;t(D%D$r zZ0)#8T>Mv3;# zBDqO8!#-)18Yq%ks}$GqHsE&P0eTMHK{;?2a5r!#K=(Kz9hkRD4Ho=;mD;*W-2)5( zh63dG0{1a{S10mPtJVF$Fj`x!URQR~d71mGz%<|m;V%kK1SSD50h5`iB4Mni08=Gy+z2Pv zC`OFJSEQ8^M(;Jc0nDWTz#G7HS*f=KORiOKGN0Ef76#;PZefwn0NxYwZXv?m)+TX& zUsk;DTJ<6AuT>udp8&HMtF`JQ!8g__@=t-;z+B)nMq{m-11w#usLzRW`k!-A#2V*r zu2bamB}29VgV(DCz?Z;6@&5kOA{l1-a18{Kcw1homxUynJw$oxOHmgI`#cJwG8+N z*aU0_{soo;>wxvZ3W>}rU^V$VwNk1F)~PkJt=977S+COTlWgG-`Yz8mRn}4L|~iXc3=mv6Bxc;y|rHL26hQ&b%IDfU$6E8`{V%J&#h$OMgs?c zgTNu+FwodQ69Y$pqdd0_qzwGFUL6BY0jFtsy*e&8XMFZ;4Jso2Gx0k zx@?1j0mA^fX<+6C_3Z{VVS}QwZD9EZl{F9;a16Kx(grdHT5VLlHmZFalxKkG3%VOs zRS|{;A_FxI)G`no$Qh_)pt6A?28tTEev_(TpqPQ;23BlTB@EoYQH|cH-rT4bZB!)< zlrpe)qbkkw-#}T>aW|=Q9DS3bet82GH>u{ER8Of^H1Oai_2MQqbCddhld58%>Sk4g zXrP(_N>*-C)eRh!R)4c%QwRk%gf-l7=2rUsfB=xyL~1I-PzFwlvb2D)xhEe*6W(AGfTEvl7) z)&}m{qFC58W{Y}ri)v?}y@3t}7H(0cwyKT>R&P-!wotpP@U+ctHbfiv4wKLh2qE0#vv)eUrhyXr4U2Wagk12-G^*uW-&AEUHV zjo7YU*skt3Fw98yAUTij;RfE?uI6u7|7=e*A2P6OyL#9F|2VQWwL_KLp&m8xn1MH` zY2a}KBMnS6Fv-9u15X$j$H}f%qnWxZ)h#>JQwGK`N;}k(f<1RAa>~bYhptpli&u~C zP~#0uFz}3l$ve~wV&PfgAMa4l@gir3dS0rW!i!v~9f}1z)k_o_c-6o(15-HV)oQAN zm$_s+lVhB2aEMooTLt>7VW= z_r>m{iKXOj^%akiUFvJWZvp1=0YT0hJQTnpuW+9sd_v}_%grxQ) zHp}f%+nIqPA>UzOC-=^tWGo_=b$7lOk9X1EPY-zln{Z7WG;oO9&A?d$hb6;L8aQR3 z#~yXWz)_hC?Hm(w+`tJT%ufnW3+G=e@;)*gulNl!$=H+$(@gS*?ma1kS|)f6Ib@Hr zMS(ipO=%Mu6U9xGFyWc-rHNg#CSKd4awdwH$sP<$ghI$86R~jqtz`AfJ*ub)Vlfkc z?@_z=BoceCDrth3YNbt-F;Pl5s~oXxftM3fW^ZyuS6+CNy{eLl$|mZYXkg;}y^7cQ zRZLVham!xy*j`o5M0FE2Ow=?{+r+lcB)qX;6Tv$BR8te(_o@E-R0|U=O?+r#mWfs-TALVd;sFzFOtdx8+r;H2 z+L>r?q8q!I=wPBFW4KRsF~L9go!EDu>db}Mr=H)ZzTc--?o({-%4qLTNDmX|nCNMu zmx*&lc%g}lOq|E*Gs*X>3&{7Y2KyB`@w)wL*nTy3znZ>ZU2I~(ezkkQx=hBpgz?|6 zE)}GXeIU8&xWYsq6E~T-*+gFxSDLuaL_ZVd52&UGRL=wID#rGJy4u7wbVDT93Zd|N zM&p3mbU+O-af68$52#rORDU5qA5b@%IC(%7IjGb@HIPP33^j4TiCazFX5wxW_n5fd z#2qH?G%=XbJE(dcRD*=jJyvP(E)$O&R16d)0}rZ~4yt=i+-G8li5UkIA6y1+CyrLiKn>Aht#k`>PhMN!Xd>gH~Kct#CQ{vOuQuW2_~L1@w|y=Ogt;A zLsP#TN*3q^6Aafx6ReWFC{?Z+`G!O4)FCz5#8js1;e=1&<`Tkco5Si=6Vt^03~oK< zz+v@J z-ZwE*svmGe?N^kuQ1c@bADc*7uq}LI;!_i=O{_67+r%6bKbrW-#9R~1ka;G)F!323 zlh9Q^qPiSOfWI4ch#GxFEiys!hE(StQOk~~Z%h!s z72JD7vG4aLeh?!}49@On#*HVui9dO098E^~)x=`){5Nisqw06^qsbKd9aTe*swL9& zuZiU*mdf7wOC*1rm~b>n{$&i*QS}e2yaGR}R>%~X*sDyeG%=q;97wEji78xbVjW|} z&1>SXqiVg0ttPga*kEF#i5*lnu|=|%e6tDbm?EL&a>vwmDwx<~g6Z1mm^$~E+G%1J zH`=izfp>Fj98)aJ;k}aB%{vS1Qj5&5p9Wn9VF-7wAvBXa% z6{o-am^#Tr-hyf2l!?>Qg}Hae#J*#S<*X2X@53&vy2q7ef#KzLd;CCBbu762X2wEk z3uy}(3poo#EL1$M8Xi}kh4YUq-$K?(PB3nkz(Q!D|M6s|oNr`d*l`tGNmNOSTHq(0 ze~zn?7K&LYPWf?Fg4Xt{g~yZW&p4h$m=h^up{#|v7V23jXQ8|WWkFl0KxIl!sG1h` z9aohsR1-p8Sx6PZs)8J}x|JLzH7qzM6bmJ_tR&f}&w-kpQ0JadwJmV;Iu`n!NVYjc zQQtxX3#~1*vCz;$BMZ$f%#-eoWiCxEG!ZgXgv~6BJE5ivZ(*UOg+ETHZ6{PK3&zQ0 zClWckwieo1XwP6umB)Jr3!N-<<|rpsM?rc^C(k*lx>(6!%Q*L=g_Ekg1>(7aJuI9f zgp%>ndL9>|Ah|%ug%&Qd@Vd0}gY(4}F0t^2i|H;dwQ!k*<0+g-p|^$0Ep$wwQwmpD z=wqQqiq{yruZ1fuY`3t(!c`Wows>Ww|Fv+9g=;NLwlKxQb&QyWhb@e-aJ_{aEZk+` zZmvF4$if{K23fe#!cClrgF@)8!r_^m0ZfD$1C7-QW z<>xGZO1jg+V7h%O`H08D&oBHKNW6zDXkoa82Q1uYVF(vugBr##Zb;MypHf5F@szsX z!V{;G>aXn01fj+m^%ARRRKGK7=ovMY-Os3n78Y4}*}^Lp zUbQfdr!hlnVa6HtnuT{rxZDqby#BYa*a8)p zIpqxf8&3&C|1Q3fv@$d^t(T#>O#C?fmxW~({$a;$>Tjl~q4_EGaYMgu=-Gy55SCk5 zVPU0(RTj2c{7|4*TUcWyTZ11u)>>F+VWWjj(zM>f1|b``N2HK&zig&IvT?RBEYuMp z37gIc-)UhNkHHj5q_Eq<9t)=}oME2u_+kcHIL1@g)ccv1%M~wc4_G)zA1oZUaD;o! z)YVMgR`3c_k2N(V$3^*s;5(-N#?RiqqO~p9z)I}6DV{vKpQSUR!>jJ$md>USq;S^K6QzVHZI^`O4k*vCs<#w zfnY-6HS6_}hsByAV64 zP}J7{r0{PFT~g?pLbnvUr|@J7Po>a)APreEh2nEaFC-%rZ9?bh(caxbP8jn^#w=2?Ih6{ zo5Is6e3-(l6vm}6K82T4c!d$jtEKQ_3eTkQYzm)=o##^c&C$|gD^9N54b_x#3iax;iD8jPT}hmzDePe6h2L1ehLe?wWW1V3Uh_D zbM;oNNc}H_16>@r@+OcBtN^~3Yjp;)qjf4UxG`xOft2lQYB}Xzf)Ky zRa#&WmNVJ*tJNv2NnwTXm4d4n1XuIp8*yz4>r&V*^7Y)&LN*EV0+QV~3SZ&s&D_X` z)E2?5g4;N$eaQ!5%6SR8BZZwQ?Be;)=&e@=dG(dTo)q>;1w58=;NJhL_R2 zaZ@d$+hlZ3`W6u^DtK`w=~zN|B^#A(l(bRGMrj+o_spgWHp<#4XJbl+%Y<7q`q7N0 zKeWlQKF#QgqDD>HuVUlpjIM5@zNf3&*eu4Y**KlirMzUI8aBFmx~84n0;Z<6QQJlb z8y#)bu~FAXQya}})DxQx1?$_m+S3h$b84JOBO8rv-0f+)^rWYo*qH8VhJyB++h}E@ zwT%`MD@s~Qa6b3+pPp_bM%vkED`c0aU0=7Csc|l}+{s2~8$G493thEwu8s3-bQ7H( zBJXaaimzMyn*P)NInvb2Px$$waG^*puyKd4NBVk-uP?Ikk)K4YmyL_*n2k$qTyEnE z8<*Mm!`HoS?DUfmQHRCI>U_Xyvk&8+P2^WG4mQTvc+$o-Hm>Db*tktbyv{~{A=K|D z;kw?&4H9aGh3hrI#*H>^5}koI7>b)EK5S}~)wjq3ou5tOc{|;Posop2mdj$t%^+Q?B^&KKD4UI<8A&O1e1r$aZ!+r_^gfRM49|~8%$l2i8dxNmu$RggURrcjj2pj8#f1fvW>?B zJ;lar()|_bJB?M*eANcs;B+{|>o(qyjX6KiOGNoVpx?4VS2@JHHr|%L@7S1OBOU5W zVbY5ZyeD!d6(jtCjSp>{;=0(F#pJQE)W%;nKDP0Rjqh#zVB=F8vu(_`vB1V08!baU zFVvsgm}{d~s6S(RgnC4%U#6TZ9_lY_>1vVwlAA)hd?RX$=y0UJ=DvvZS2lV_ ziK#J>em&CP+8};MvyomJ>79}Ok-?AkuiP53E*cR7U7~P_m>n4FzilkDvE9ZF8~@n&*G8Pv8^qP+HdfhKZDR#fC{B8<P4uG)Vbc`Vec*ny#+5u_4ySW4+PFCLTdD&2w^ktBoz<15;P!^fvCGT;dF; zywk=m3ED9kXt#|6HV)d@V`DEp;daRB{Wds}XLI`PoL-pID|7ltP9L(-sfa#e<1pPW zqE!*i&@sYCMb0=dXvewDi|7+JPTCk$M2{_^-zuWd@bKp;=b*lmJl|tDDC3~41Ji-! zpooK_4pI(m2U!P!gZV|Y;~?!IPO`FGzAK9AoP#@yCf$oUc%o<$w2}^9Evkzy`E-APuePBGoJ zn6BmE+G0r})pl@SF|C{=Nwj#yamN?absW&=x(;R((~FAf1`ZlJ=;oligGLS-)4mMR z#6eS;LMsQ&oMd%ch$)WS+`+%ak~!`zrdx_NE_7@0p^e1KDXuFP*X`A~`pJav;ouwz@1+v1a~)jdBujjrgY(701>($wV!3B= z&7C!%xb8`12NyeFdR!uw=>u2fk>ZJ28o$gzZwFI~>&s=tPmAlHiYEc&w?=&(UKZji z2Uk0YUF2L`!x%dF+QBytu5-|j9UV+{aJ`eJq~Vg(BHuTk=#O?4sH~Flinzru~P+>r)3@I4aYb*$(DN69d93 z?`wa~b3-Jo&U5eu16V>&E1`*>mCy?ueCc2z&6d!Ah-4AhRH~G)%eM}`bFhm6bnv~n z^sj@`CG`&uew6A@4i-E743&8Mv*0fdeicFq7w&iAe>zwqDaf6YdbxuYJcS&razw5Afb|YG2-%pg z7EhYCi2haw+Z?nhsj1IG4|%J7JB2&d4#AxcdX&_x?vWKY-DGNex!E1;r&kV+@`w}n z*!`d=GxrWTIPBmEw_(X-eTg)3-1+aJh_en(I5^3ZVTU>;ea{F#Eh|VNhj^f*hMUCJ za1*tOC6ko4T%=ssE*ux0n`99+Dd%ILBrItc8R2tFCQZJJtcyT2sT{cog)?ti&37;2 zqNt0jTwLvd8e-7aL3JS}y8vEEh^fq=(u?ZQ*o)cIvsP z@1m*LVYPvaM$)mNo9sK5lO;7Xzp;xZEPIpZGl?wCTr?Lu+&(nbN-T79lO%8LqK%8T zF4~E(iKTR zM!Fc~;yTHkdjn$#BlUSowbV(c=`#dy)5AV>*!(6cU{bMd^37hFtp@fw|RG10|j7gJnJlCV?r zB_RV!X+FQiDl>Ulsl=9<{c;^I>m-;~ntxR~MMT^H}Uc;CfGE~=K+|CG`*T@XKXv7?m!K#*0ISuW0&(nU(^ zk2x37r2cFda~L`oCtS>>!wkNQZ7x1{G0(*s7i(R7;bOjv-(39eVu6e9rS(rPes=Mt z@P$m6(t45LSAt&)ek1s;;CF)G3;rPZqu@QIHT(V|c1URXSK%a!nVcf|Lo_M*%f+8A zmK2n!zf>goj(@vY#)*sazb=-$SRs5$X}!|LDi^DzO66HH=y#_3;Vs~Mb1JbmIlG1vw;682y7bv4CAu@nP z1?j_K7f1fjT#mXpCU){ZpLB7GXKWfJ)5*}MU6^TD!q3PkXK6MK`e}%;W|<_CsWj{~ zvS|cqIBB?P_~~S&I4&`rPCUt^;Yk;A7WQHjCrF(zjiS;NNv~KiCs;(VZJ9*5nCP%$ zaUng+=u*;JJB>PNlun~e8f8U7<(g@f6JB1hf?&l$Yb7C-1*@b{RY*0#>Vh={ua|LY zt(H_(8d}KRBCnf9y);^-(OQJ{(`b}NW8n?bXjsr>mnOoS3XYb(&4f1>Y$4NWS(x3_ zGP;e(I|#NFY?sCdWpw*A7D;#Vjv`-LMt95q6*Se@y?;9Su9e^X^Sjm?)5&+dY`RI*c>Ca%!YH?Euh@W@R<2ccpQ6n%@dybQ<@hac>$AiYC?W6Y@YBL(&+U#{E(qMnB7H zeq&5ehKqz`aM|P*2FXKdJeX9;GeypEdE3No30O5N2OY%Tq0bS#y@Gip1~U#{F}z|G}0MlGFTxUPo;4>jg`Vz39c4glg3&h>(V$V zWPKVNgltS>dm1~^*d*1>>Ey{n4zxw8TLrhJ!6ytU+$pWQ(%79wUGay)J!$Mq^E*TE z-tJz}r&{-Nnzu?1NR>MM%jrYH52tY?jibVk7g~>{lSd+H@C4JWoaU|JlhQP)oIaDr zS>bL5$iT=Tm4TgsnZZZpG|Q%Pnm_U45G+5J(`NZ3N=_zmn59B_-C87`=mZ&r8Ti7p zgsz7ID;k`T%N%d88j9B?uA~>GH9Mb3#qoupnV1%GH8`SYtFGk z62mqbw3XKU(zjz(?!~jIV+LKMsgq!5!4A@^YX)4AZX%&37pO-D=VWkh2Iq;eC(nN& z7Ybe=c!l(({zX#dK)o`!SokFwTqcBZzBGe7MYFd!Ge&ry4EknpR|a>B+LamHB;=|L zuFl|^46exA?ZWY{_4^}=ruw^=h@OuV-2>&I6UxiR@v5?;cFQ}ydl;AAO;GYbZWcb9IUYfyQndEe( zGRxl?Fg-~A&ES?wdW9gX%Y}@pq`6@!Uo9z3e_pMm*W~s0s$Ajy^_mK6F_K@+CKzUx05;Weqa)Pu&oBRt!!m)^YkwqFENogZ8k&!$uFaJ=F0q%)@Xmxi4JT zLpLGh^*r86#;28a0}l;7EUK&fx5Ex~GR!ReiBwFTrwEH6=}|>Pw`0 zUR8aWhu$78_b|Gu{;I0}x2nEEIIHhe)mM7B%0qt-13Vn8s;~CYPYC%nT;FQ?S`XKG zP}OwDYMMfp>pk31(CH(>8$H}ClA8+h`$RsFPKxAK5938Lqnf_m!yPiIK_2cEa;M;6 z!Mi-(d{5S5Q8i7x$HOWi_vM9^^$-t3h2JlDP+GZ~4|sUDu(A(&c*w)U9!7Y0#KTm| zJv{2+F=n-gr>g6?x_;clSWd9I9_e8ebBQtWFh(R4a;=FqtMeHEw5_h6D#-g(*G~%{ zCpcbkLZS5;56=p}Q-*ln!wVkXsIFi1Fww-2X%lX}U+WNwWbx^WHtcXhp^x}M^J z#E@!_8u}Fvud}0v>ucy&IguKA8ZFe&uL*uwLr?ecriUsu^*bKkk_f-e^r)s6*U(#P zXs4zoZ&g#z@X)iSzNw~uk49?h_dU$?@PUU9JuGDOJk0X&k%xJVPfh)?;A}xwKjGF8 zKDVZ3b&iL*9{#MUKlAW;L5FkMF0Ee_B=b4P0{>EoRZD;6;cE}eJ*@EXjfZbN{OsWu z58ufO{vi0hVA)zpe0~&8@)P%?NPhLOn4{Oy|9JS#!|#kwExpXcAKVDFG|LmU_zcE> ze2I{yf`2iv1^Ml@^yi}duZOL*l1Uj#uVjLG7^w6*539K-O0VTz=i><>S`c`mx&D@!|TY;iIOH zw2zFBQa(!i@O=0_VjnpllWXg&kI={F+L}D@@o8=STWyUxI`UDXj;>!v7x7WlM{!nt z6!X!ePBO}MbrLtIP|{E4GQCc6+ws0SdR!e{#z$Enm3&n8QO-wsA3N*l3O>H9quG~T zmetV}{bY7@-m0t1*40&fR1-;6A5H4&bLu96x~{IS?t==$>*`uQl#kXv+W62uYWrwR zO&@i9)D;IB_;{|at|z>{kN4~9Z^X#Ty1Jo{Mj}5blBk|m^>kAoEqpNM&1kuvZZ62! zlDG8Hv7T-vNH@sa`e^5)vyU!5+WWY&p6=+Qlf55{(s;1l8o zt1NVtS;`EkKcK1`bm4U^!H^D*AXvpz0pm@LW!3C=Sr_OeN1hbr1UF3UKQc*4fQl3RM^o_ zzs_Dhru$%$yv0r0NRzx-AdGg^MtX*icYVzE!CmC$$ zAx^xhUg%?yk0m~qvNY0P`S{VtPd>i(@r{pfeSF6(ZLELrv8R#t8|&}6wHs@ec8&F* z#(GR+{WBxbSZ`{qfAuk^vHnFg7mH-EkKdTmK2AxsbQArDk3W4-nWbS9{TDY>6TQmE zY9D_KUnWT5KR*8TvE0WBkv!ByQ@FCwI-rSO<72Iltv;GI)$4q$r&%ATo9IbR^ao8e z6*l--+(d8mu~DjQ+RVQKqEou5W_6qN-7ZKYbZ@7`WS5WKoQ03QJ`T{0rg}hA{cuyg z&&QOenq@y1I!~HvznMPd<1oYS<0zLhi_$IhF(1c$RLr7M7AJh1^butdXK{+7b6v7{ ztC>FIk@*+1X(REqJwuEp$Ucl14%r3pNqtGBwYlMHcO|=#WKA z>E1@LRTiy5)h=0d&7xBlouxWTTKPAkTNd53=pjN{ z;2A=kBCT^<=<~8TKZ|)q@I?_^ki~^rOw3|Z78hmFGs_46@NgErvbZ>lTeG+=i%Z1L zO@fzZaak6j|PYXXMW}g>)p)l5qLSApF zU&>-Kmn^^~0j6Xzm3ujhlWfi6l`K|eu{w)avzV5}$60)m#cNr-p2dtT-pwXIW_crv zx4F}^n4ZO(LMU9=GWm50e~m(XN7P6R`QgcXS-hXcOc5?=sXxf#!z@0M>MX&w@~f5( z^1BuON`<{X&0=;I-(~TA7IU(g%e|k)qAWhk;`1!NkY1Zx>fa;;^!=W$@0m0{c9GB zMc$y5?$}EImQ8+E!}2?GzSVy-rOl;T{FTMOSu7Xjzq9y9$g+aX{;f1i-YeQ)A@Y@3 zYHXda+- zfa_ap-CDP4ty=_W8Q{X!x|Ilrh>)$LTWfL>%G=3A+S5pDJz0dE0(1^=PJnX*bP3Q^ z6!I20_ikdUyC5y}5Hhp1J}&gb%5&v^y6~0(aqcF zYdC8m*9tkWjlN!#ZwSy|$W?9h03n0g=$nMxNIPwk-%gHbqbVF1;FbW-w$X33(YFSe zE9ABSw~LT+D%=@haFF~hJ{sVz0CxwN72u-)_XN0?Y5|@La9@BS0iTe^$N)nF+#lfK z03(9ri@RUj=wShd2Y4XB<~I7l01pW{(MA_(t5sXguWLHC)mOFEj|6xuz?ioB?zZ|- zn(`Cj8*TN1wt7^66>asH08a*ZBEaYX$J*++ovz(Z_h_e|3NV(DX{RSJwly@#(^4HL z$m)0@L)+!_PTd_eOvqF6UXE2_4EL526#8Xd)x)0JR`vN z_WEsZH(G12=e5^-0DFm8qx}5c@}j{zFpxWG68-F@MD0#nbiS)3h;A)zXFW! zsDF_V_35aGbkx5FsM=ApEEe)xfZq#}KLY$&;7bB572Zaa8OC=zCPVxqKCcMyZ-C{T zPRC?jC|}c2uS||a%_q+fcGPPEtPQY>2Vj780oDiD5@0Kj%}z{8T5slbZ5bp3dyyamScY!eDmN`vM#Ya4^7r zPQR1h-6?VDkgO>$Q2EHZ)mfMAoP5E>xHamW7(5o>cz_cDP6jBML#Z521vpJ35e`K- z6W}b@F~sUHd0(dy;-(NchcH7}AxeiR6CxERukm4tL)al4sk(xmU^+ympmQbQhsa7b z5R3%F5a)N+H+I%TI%}HB74(aQC>o+zh~gnih_GaVP;I;@mkN`&1F>2*M7a<>LYxz# ze25Am8ii;aqGE_jA?k*x7ou{ADk0wMtaXU0Vz7FM8bYcG(p1e5wS+5L6U#KtS0UwJ z`b1t^TI&e@(plFR(onF0Aa!UVZ=^|xrXkvdXe&+4LO#i#M69`B3&H%WGFu5}Q|k~M zj-*|P_940!Ona8&UhUg;EqyAQTl_E(uQRp6GqlD;O8Vqqoh(6Q|aY2a7 zMB&1Mor^%zf>^SC0U@}!Y>!huS?$$SBJPpBv*#GO2`}X z-bm_S8{+y9H;C{$!G5v|Y+~szk{d$|5K>cypqy`692nx35Ys}u7V`HOiDQq47#ZTW z5Vwc8BgCK(LqZGjN|{7A`G#@^FYpLOd$1BP7~Cx@x8z=g4eltat(}39*!?ig`OR|@j|V{1aJ4beZsfC%eCtPgQA#HkP)L}5pWo!p_qX<<`{ z%^|i(b*td^5Zel^6Xbns8NU2SBnJg|hu9-zui*ZWKd1WdG|uPhfkM*K{-F?urS(Wb z=ctflA&!SQA$(9*%|hkVAq7jNkC>f!YNQ#S233{?OSyP%K z`CqTn5jZI2Wh0am{qhm2M*M9QDnzIlp;Cm(5voWN)yB#+^9wqutFA8cnu0Y1=ZZqa ztd5d58?#I82z4S{7~!G_btBY^&^|(k2=ya0h|oMjiwF%PG>Xt9LQ^r)MWWg`0&|QO zSeix28rRm}bmqq-EB`zsw zUK%CuRp$P^oX$t+%ZW%6cN{JB5xzpkrAE2scL<7~%N{FGRQ{!mSY=k1#UAZ4rM2ilGtik8nqXK@skbaE}BTS0$QiN9ut&<~6E$}HqczV;w%h7*lIQgp)rbT!yN)C2bUoSNI z-SnH%Wk!T|g}fEvZK??`CCasgzZcjxpUy}BU6Pd$g;}CNvmXhekcE9ejW9dH zh6o!Y%#o(AB77b3hr0MI!smrv^O*_4zbHs}>9Qcgmr`9AC9m9EB)nud&EH0GAeL_; z{2t+t2;WBdPFlYg{8{ja2tNw>DMC$gGJiSuiwJ*>usFhR!uk4cmb}eBBP@&XkI0uq zSSo}~e?`e@{C9->QB29d(zH6l@`BC^o>382Nwr}&&62mdMkH(bS0KWA;a$6FmVE1` z2sEij!{QQ-8eZvc`X0$WahceQR+)8n;OMv9HY5Zn+P_I(M$-tG?sOt8oRWJ z(K1G>`2SnWUkbJrWYZs%v@Oli*b33D@4dk z`rbnLha>+-DnA|Kl`*c0ab1jlF|Ll2KTLG#ni%;%M&#GV$+a2(DqSDrh8Q=-xG6?| zu{J=0z|TSa8%Jaix=Ht&rIkWd7j@V{QeljVho8fls28g^spf3pC`7y9fQgw@5Xp9#)mOx#dtr)OzH9giToj>^8d(3 zF+Ps*sVLCeCqih4M)=lfB878fd=_Jo2tOC3{L2{gVtm2A5@$;0$5{=*k{ zB2)bjY2vtl3Zamk+5T6IzhkV4u{OrC82`jr6=SvN{2OCsq1W;lE4X~(9zU`%&+{8O z{}Greu}(DC3$jZ48)T0#w|ObJImVV4`(qs79*MCn#?BbKVr(zi-@$Dq#+k19D~;VT z_Qcp5C)rEM!{YEhCPNoJO!D@i^gSdvST0l!3qMk@$@D%Z{5XxoILX6bs$mYNg&4Uc z2xo+!73BZULJ3Q0=6nuT4yhdM9DI>GIk-7wa`1A=nU+65(z)c@41Tc6?+f<5nST*P zKggjqKcUE{xkx0jU`~*lMT8X1p_q{3Ig}8>7hkg^ZsbrVhi7wmE{C!?l*{2BQ7E57 z1tC3hsF*_~;q7v$EToxWl^m)Hsg^?>A=L$IkCZ=93ExzcoA4(I1^K@Jz@&_9O( zIb0<2D{|@P`B+ z7UYW1{v!pQM{{^gcz&j%a(F_j;{-?N@Kix_Ob$;9&s!KP{As~_9L5(kC*<&q@c+g9 z`5Y#Sgg@_nLCA}O{Ehac9A3&{vgFCDBAk*-etSMu@MS?>Fu#(+jBd#f(x>H;-_E}# z__`o}=l+He{y6>!we2(_aWDVWGm8 zIV|K|ry{t#2o~k=RSrQBghlXm4&UUkE{F9we4E2}IsBT#VxBo^{k`B%f&n9IE%wm-o=yMBcuK-p(D@Ll5eqIr^>~cJqAB;Y<#D=-vpcwTx}M3{*xf;QcS|EJA&sOoNF!a+ASeh( zBi$W#H@3h3x99oRI&0RP*|TS6Pn~n_-S-}Tr-0uIVe(7zb0M6klV1|zzbJ+Oea+K- zFUjvp|FaPODuh22C!O*M|1N|tUy=)o3UMO;7BX+-x;%v|Qn(<63sblxg-cVoC}q5H zu|gu`cXSHr#4l4wB!B4MqH<*lSEWoWiWilu6{%NLUM(uurTDKzcr1m-Qz(=|Duo+U zxG9Bn3YirA6oM48DdbYHQ*crkR#dDM78DhRlKAR#h20dk78Orrl1PtH%h93|rVvqS zG096IPMLqqk;0uyq>%E(vBjfcf@<+V)}!FBL?m zs3OG_7EhssA|(};Qb_auC?;i7D5r8Nrcgd*QkR)oxVX^06&M;tXc(1NNug>ABU2ca zLbVjCr_e5i_9@gzp=Jt=QfQn)Ee7jc;d%;*)K;X9!n%xjaVb|^NUxtlgB0o)mxcwL z{0sM&6>pY8^Auh!E=^KsN_E9$ZgE*vTw0{Czqqta@xQ9@MRB>XgtVsFDYQ-DffC}D zkTyDN|X@N`7h-iQs|ySj}$tl&?#kJL-1+}T~g>uC+KN|64JhebW35V^1oJq z%+%AKDfCKVU2+bXLQje{LKEJ!iE$Mrf`U&O3Mc<`4qM(zA=SOifmTM(Jd+LC@n;IY)@gg z(s!irVG27H-&MeQT6uV>BIh0@?oDBzBHx#m{fZn&;o>qz)L}Y=Ax@dU$T-S~d{g)n zrr+tp$5J?+!im&>{||glk&`K$Qsi_BXHqzuGW%r8>b45*B*~W1Z6qmtTrlgVGUn>} zsS5loh0hfs|NksEoL2cxl{`#+_;SX#`4_G{Q8ZH2=_sMbjvz2=U@Nmk1YIQt=UGh08CKM%gsVr9rEvmz9-erM!BEY&__+N@-M1 zqhFf;$cHLvR86C88tu}kmPYk7>ZMUXjT)-Gj>4L0)Kd9dDL;*qs_}=iQddWLN>?;U zqhXr=^=A^2S{kMCavDw2Xk4(;i^@q;71AP&mT5Fgqq%w`-zu6-q*WUE2%#BO{x%A8 z<;*hMr_q7SPorBJ9aUH7G`c9#DUDZE7kx#KF}27~V~D?&Mt9}utFT8JJr%j5oY{#) zo?fb=w-Wnka+1h{`bwc7?#HHGzOq?Et`KD2h%u| z#=11tr?D-K?P+XC;{&bet!ZpjEsXdkMSd(Nn+x=AQRLF{!sbBjJJR@2DNO90itJZA zcPYL*jXjF&O=F)TTnJ}b<&A%M9MF^_ayX46X`D*qw6Yyd<5(KU6)#-gOu3MKLr*#P zWC3y}&A*+*muY;J28|@!ximgXm%ht`n%iy^Tp3lI~AjsgJ42onBW)Nj?YX*fgh%-nsxPiv2z&sVm*2;rPa#O+S z%^AE|Uf2&wza;}gYLpCa%ixX-NMSycNO-&A9KBQRyeorw<%P%H8PGx^wD#T%9?jsf z4DQR|e%1Sc!iO_>FoO-{g~vk~994w;k7V$TPJBFrCzSK444zbkqxr}s6^!JkGkB(e z{wxEb#1}GnF@vfZRLkI{42ot@CWErdR!m{Z42mmKLZPFxN@YyYDYLXLkGAN%x zWu-H+6*8!pL8St={0t%gT@|E?%E_lx&!C2$Hp-x82DKD#sIYbh^%SATIvLbeoD!a@ zAoUe*ps=}`QBkdGtQ4jb*_vk1EQ2i>Y|Wr~1}!p}oxz+8T4vBHgZ>!|$e?uwuVm0O zgI*c5QB!-Ugti&9%byykcLjqGj#2tpg{0(LGCqST8BA5;gbXGsGD$6`*^@Koeul_f8BC+! zcyExw^bBSw!%St)@A+INJ1RNN^|Y+;bZ!QVGFYrU^D>yP2$e3#;Ozo@p(5qdSdzig z4Ay4wzEYNDurh;p6ko1zMFzZ$$+vk`25SnEYIO$ha^Yp=J%vQblb@FBGFYF%CY?^= z23AuVPiv}tpu~+-p?7Yyb~C3dzAc08^lHYuK72<8A7*eSgR>dz%wSgr2QxUNKHr_e zUKO%OUBTMVZ_)cQ*q^}x*6+84N#PZNSBJwH9LeA$r>OR$864NS#}qPByyBe5fXw+9 zAZGHZ3{Dq}()e>3e3ZfWq-5}MLD0X-;FAnKRRg%>&ocPDp!67sFEaR2helP9c@^Yq zwg|SG3i2(BRIk6pzf%=Ne$3#f4F1UAPZj>N%K1%w@=FHi6`_BARfL`Mcb!PT(Kb&1 zD}#SB_+JKpXG~uu=b8$#iz%nqL1yv=SzMUKZCTu&#YI_MoJB4RD{D&Qk}R&w;;Jkz z&Em4G5tyIlImWI*C_jaZMJPtho?eo5gj?*-ZU;Jw<(6IGsfyB{EM^S(7ci ze2~t$Srx@DL4G?6CyN`hxG@Vi3onZ}izEwQ=Y|S7B~Y1XRdtm8?>b0JXc9;BvdA}* z_)S^doW(85PuobjRo7KG3z|d&q`*`z_Kqy>%;Nqm9?0UZEbi8!B3b;bia7Tkr7$yz z-3u%9CH?jPes%lhw>^7Abk2$>P~8 ze#_$bES}5a`7GvSF*l1BvUo9zo>}zD;-xH#W>F`Lx>*!cX_d05oJH|0N@P(oi&9yX z+cYLi9VEZP-_ZJ)(c6@?TYym9K3MYk+oqi@T~ zt66kbgm{-Mx)$IR(p}Byku~==Jf*KFgvRvFq7R3%7@I}kEc$Uu79*Kas;++)19S>G zc?`^A2$g0rNJj^&*|ePY56yz_t|iZKMTRNNUlh9~8AfF>T4zaALv1Q7z zJd3Rwmscwa`H2rwxGIa)S**$8U1cVGFN?P-8uyZ?CLeqhUz^4ISuCq4>vWVu>s25{ zZOmd*7CW=pr4lx0%`M`GS!^Lg7TdDsMvl^UWU*awo^m;Ss%7mHl6kjI*`LLMEcPhA zH;a9Wu-quh-20W4gOpa$d=NqWkP>kqVSpboDzwAq&&2c_@`NXmc@5je4oYVO8+v8ud?_;ao$f-_19T*J4*g< z75PTxka9^S$;W?Se^c{*%;G2I`B_i-K4r3T`R5BX{;CL5{f{jE%<@m0@oWx%W$`x~ zX%2o4|77vMEH2OCiX8sU0y$ieGZ{it^OutkFU;YhoQc}S3NKN3sX`JjQ-ra*GKZ^j zNav8rnO1Xk4%g&xZO(i^@!(@}og%3mZmT5MD^7Z$9Qf$rR5B0Rq(50nvN|`HGj}o^ zvU0F&h|34G|j zQN`Y*kf&5}tFHI99C%8b3oE~<4gBCJpLk~ucjfR<4iD#WcMkXDaDUExW<`E}L_nlS z4)-dB_ni!PB;2hki;5~&Q41EsQ7eS#S7@ET{R#_f!1BT}?B8QDWHu)Ht!zkho zHaQqgEjc`C<0%_sb9j>xx6sVOxE#jkaH)mMEKJB@Vh;OrIFQ4n946=Zcj8!`!xUyw z4)b$Zz>M7bEYowCk;6>ZQDx~|S%y`XrIlq@WjRw>&R3Q>In2#r9?PeS zJXl4ZR#>Hqw5}p==ddt`WjQR*VNni?b6AqY(j3S(u!_u7&eaM@`B;$^Ijqd#9j>&B zSXHG+RU@-#RcTmN-p%2?9Jb`JHHS4htj%FV4j(WBRp7cD)-#`#e}uxhRpmfc*~ogy zp;k57tZaW&m8hCLRZTiq6XM%)*q+1g9QNd}BZm)j*qOsF<(yE>s9sV{PAEeBhiZJe zfLSc@ee`E_$*V4pR5xq~b2ya4_v{8a9M0iL4j<+4aSlgwIF`f798TqMTqmAT$SI|D zV$+m(-M~rs27-ru>-0PdWU_X0FEk zoWuDXe$C;R0^5q!l;0HpJ%>M3LT#N(IUN=Go6Voy-ok|z{->P(vV1J#nE}eMxTfr@ zDSyb? zwWV!s@htcjA`7wF6Icip8CcsGwy?G^g%S&S7H+U`qlKNd77Mpp zxJTy}wjdVnuyCh^+mv#jvT8aKk3}d>KX|TTX@7mSqtSXJZkZ!4|v|f3l<(%{wFOwrN|Q&SVVDMdD_A= z7M`{694D#-3aL|9I@Fan>dNxEa;&brXz}$BC}E+bg`yUUStxGd@_O>K^3yiPnl8Pg zo|Ljs+Cq(bQpN%)w3#*jd_8Gf&#a=ng$fpGTc~59qJ>Hps#&P6_Efe|#X?oZ2i7wS zS)g#E!WtH8TBv1#L!T%G^$m|-pKqN&JqwL2G`3LR0_8NY(2#a213km4A!jW;eOcu< zQP@!_6Y5KI3oR@hwQ$TrOAD|+FIyl;WZ2GEVQ@K$-=9u zv4e$Nb=v4P{zGS=CSuH8hs6r;V~O+QJWdN=l}YyvgQoVUmT(7RIyr zTbOA5*TLAk$iqg#Hh5;f7S1W1L#zm1N{B4Cu)@MS z7FJpKy>E z)QEkcsr+u?4+|IDxWvYv7XGpT8yDF4+rmHW{1*Pzxuu#)C!NAJ%WR*}RF*ZB3vF{b z;Bk>6$C}EIP34Maa;c5WlyaqwxS6n6F1K-o4NhbZKio`8H3@JsTUF86poR=dosT zzL|tJA{%)&Zm`W=M{FZeX7XIq-1v&f&CTUT8#mdwS%)5PZahgy$1+0-+YlQ?Y}{+( zHXFCwxYNd6HYzulJ8aXzcoFYR2`|gtHtw;(tLo0?LWhrRE{mHR`S;nl-^L?09<}iR zRoHmQ#=|x~Zf<&Peu9xLANi-bJZ9r@8`&1}gblVJu7#Xr;Bik2dD_M^bg6?Y9XxB} zIUCb#Ot9nD;jY^9DQ825Do_Z~%x{Vq(8ryi;Mok;F zY}BKRY}B?<$A-~G7qyfUEu~>g>DE%-Y$?>(K&Lmf(a6Tqmj79DNRh8vN)sDRZM3k_ zQrVg*Y_9OKR^qn$kH3{tS~EnBPje z=&V;2cBYZ7q+=@?-AXvr)kZg^Z_?A#t>m{>(!)kC8@+Axw82$h+gfgEEq!eCwb9SU z>o%TfEtU0X)mr+sHfBt2E$_6Jfi?!&7{gn48-r~Ou`%4n2peyxilH`!+1S%s=yMwX zO>4RI6*G6FjZrq=&w{FY8oeSNPTm}FzJ3K?%>f{ls!Hn)&bugLsYWcw@f z$tyC&##9^h@LM+MQc9+K|4<>j@vk4~lcS@u{X4;kQByK04+W5@I*EYVf z@wtsJY<$UJsSuXoBkiP2J89a^Jesl4IPqHwvGKi)AC#w0J40k~ag-H3QBQxi@r#ZB zvGv(FZ{t@Rf3Vft_)YWecU81pIXU-;B7d>}+xUmY(n5Y$3Sp|f5e^3zIJnfoWezTM zaFK(H9bDp|aC>>Oz0_$htdUohb7*^$d(1b^BD~ze45eS?;A#gA9W-)qje~0)JmBC# z2iG~c-a+CZkEd0nkb|s)oP(5uHSHzsAfxnC?d4aMV>z%Lcn*9AP6v6ogE$Uc2jx3R z(+<+PgAD5+frHRNql4QV-0t8e2NgQXEe>u~ zT{r6~rxbS3yrZn>D5CVC9pywv`JtoS;owdOMI7Ag;4TMuJGh6^I?2_Yj3OSi{OL{x z*6$?u=|b*z(4&)#QHDjG86X#wgDiT@jr?WJ6@Unxk z4&HRo#6eRBJstFN(2TKg(7{1R2Q3`5bnuFUHV#@jpa*D7YX`rpmr@#1P9$5yyjqP7wPPvi-WGZ%r#x)Ko|M4i&@A;U8TE9=;5G5 zR|&hygI%RQVHN4^ppS#W4u&}B>+m&F7@(XSdfmb5uF~H@=dLnMnfG^a_@b*^ z)=db>_J)I@4u(4z;b54~t<+6gbd$K7Jl0J{IvB-Ie&{Y88rjV(inHc*lil6qr*3lf zYckHkc!%!*!V(7)986@bIhd*WHi_$U@Rozg4yLFCE{cw#1Rm2IOn1P#xbro0`oe3% zK+JM5+ra_{Z#$UdV6KCC4(79FUz5JC2{Ul~YqC`NcfTeymC3o#!6MC43i(2Z&|Q`~ zSmxke2k)^kyUTJ1D;>O}_zKobcOh{VQ>(kIR>PR#&AUtA?y|7EtZ}f`!8!-)9c=C{ zXSxer_r7|P%cn~>I3VQ%CRJBqM5y<&9ENt`a}G{9I89MKD${(xz5G)F79{nfQv#dQZDjb+~D%HWyrX2T(~Z#_Li)wwp`>~tn4jY zddunF#wuIszxEay>A478gle$w8k4T?Baw@n`bg{|QOe_ej4`$QNQXW$xR2b(QQGO^ z4i`7OAn{fggnlI^mB(E? zL4kecs(x}yKY5{_)aoZsx#-kSM)#9vUA)~-o_Fzri{}*I-cP>kCoj5q$wg7hQR1bq z3)yIM{JK2&x|Dxin!PS1U6gWB*+mr>rCpR!&I&Hdx+tf3c^89UmxZtEtSYjVbE`;2 z7nNL`Q-REZe_xlXj9nk8;i9ICYA&j~u=>j#{pH2}Qop~{a#7nw9T#<#P6=K5%eekV z)RO+PzrTFhUmCb*=;E-8BQ6@bXzXH=i^(otcG1K|KNqjNXzHRFSMB0e7tLL?aM8v^ zTNf=|v~tnf#Val@9w62Lxod!w9w7AwNY?=}e1OauAnjbVXINcybg_GYd^SM-86Y5cbSY{2Db%SLT)7!*TP=#dH@lT+E>vE@qNv zh|F>^+r>LWWbY99eTW2a$P;fE74uxocd>wp!JK)+h;99b417aoz9H+B;q)7_*u@eS zCa1et>SCFTrh$cVzrBR)h(lj%9^2aaHxDe)W~1! z;(c~+7du?6bNS{wY;v)g%YQ>QxcI=uM)sm%Vh@vthe^d@!d15zCR=-5=50gKJ$%ig>y4dStpNm~g1{Zsjlj_pLg|WDExV$)AY7UqEE)KXj=;Dxz z&ckKQa1*9Q!)4oWIX7JX94>`M$Wa%^*snaKJREm%f-7}#-o;55r(AsD;!9fV;*5)r zTzpJLBjhY=hgYQ$^2`Xc#?B*T)Cl>+#iuTR9EZ>8H>K|zAzzOWj1+sMJUmjWjFhij zeC^^p7vH=1hM7N7cznxzOl7C&m!v!8L^e}&vv4@e` zJjxUreSStcFY$1x$CnA>Y7durxZJ}P9o99^)?sFoUIq}>=9HO6RJI7W7jkuS%{jUI0DARcb>aI=S7 zJlyJ`Fc&-4Ftgr+v8E~?8Y|_;N{g}5S5I&EaEHpAI@aU^1>Wu99uJRsc-%t~5BGA^ z!$ThK^RQ{G-0$&qfjBnSaGoD4*S;yYy=m}g-js(uJmTR|4^>Ija(+dTes9VX9-j2@ zoQLNH$C;{$#>vCuq{cXT!NZFlR*jSP<7D(Wqk<(< z%tLXy%SY&=golzImU>v`p_GTx9=dqw>YvK|_EXy~Dwhw>h3d3-A(DtM?!+dNeB zP)Su+_E5#cNfrLH!fVINjpL=dhZ-K<94|HLgz-joweiwhktO4$jt>1hUg{}Q*Tc^7 z^2KS5{xX-4`4={`Z$PLNL~NDB`w z)uewW2=!9qD<0Z-Xz!r|^JJp5_0V*pv||(|O8JR0YND*3C>=d?^6;vM&N_GhMEQE6 zTt3N6zju;3h;;Mt8nt^E=b^iY9v%jJ7~-L)hh83D_t4)%Zx4MuzS$7{816|@Vv@9) zBm*YNlu5F3k{p>N-|^JLMU!Qqhe1r;$@1uAsW@4hPnJHDWx`~6!^2PyBRq`sFpNQ& zEWnEU76n%EM?6V?2!IDyB&BDe}q`!_a?Zvl1wXcC-EIyeke@_+XEm`Pck%z?|mZ+#_-!hWxza`z@k~iOyWqP{Y z!wL_dd-%e`N)PXN*zI8tQ`Ez14El!yHu4tO}?;i!j$9=@M0hddl+3z{KJ zKPKK?GtBfVGvpYXzlRg*K#FQNLk7<(33=MX84n+O_(YTKtcP{6X5**o!_U})W*Q01s3&L2mma=iyY_L3kFPy^m@RW=%eB5~8l>!)Eroofd{{ng zA88*MA6XwcALnMv?;M>Yx6Lt}Ov0z;NQF7#_;7uAK71dq=+GMqxzcsNFny%m?8U%J8`2oI(qq^f7dvaOfEy&-$q5qq>jhd^}I> zKFaub!RL$BP@GNP$4fqn`Y6VD&6nl#%=8cE$;b1=oiF#yH>V|4ekq0dzItiCl=V^0 zMYeAM$%#|Jg$FNBaL)%Wql0%@Q`QYtNwRtseC0%`2yWgks_H1jcYfi%&%w0Xw@ z`D%e&__oo)qd6m`cq<>ReT?xjmO0>~jgKBadirQf*ZJt;qpOehK05e#)dz#fxg8bh zq4Ds=Xk3K&7`WWD2pf0DM zkJo+l_c8Zv+4{D8q!wPjP~wF$NCQ1s^Xh?xQevS=6{g2fAH#f%(&@u}jNsgbGSWxm zg~rr=3TY3`pu0w^yVfm~H+_urvCzjNALD&Y@G;HDbRQFaOwzzjQSZ^`lQl+%7Rm*S zWU7z1STc+L^Wj5_WCq!&(Z@U=vwY0~SuD3KHk{8ami0b1_~^7)K2WwAi%perh{uq{vf0NLA7>++i?G$l zHXltwG!3!c#||G;1H2XBLmxX?i2)u6u#0Q)fdCf-*yCfbk1u_E^s3 z98_J$d>ry|*vAncN9iIpiF)~s|E9%qYO(yQl;b{5C_lfp=01>HmdI%zXMB9@^R29S zVu_q(AM^1M%XW$MS|a0@7~@wikv&V~Qy-r(F?@XC<2R*qh}&!~Un;jP{cjt<*FL`S zao)$TKECzwo$C78$M-&d@bROMpV-!x{^yfwOU>7{ZS-{5Qu#%h=jrKhK7MB^`uLxZ zKYaY@<1Zh7``AoH)#c1mA@b+a|K_Ha89DqWmz$&hRUx-8<9mK_Q2;N1AK>Bumjoyj zAQj-!0G9>0D!|o&*&lLwfGYxA8Q_^^Qf-;pEx=7LZI;QHWpYh`YXe*t;QGMqnW0{@ zb4Ir_ag)r_Wo8xW0GR-}09Jr(06OY^{YskO+tM?304IPO;EXcwSY|de(8>Q>CV9&x z2oMIiEx_#oq5yG#n*!V%APJBc;D!J<26$+>lvysFm&@qoMjgK*CtR~!ZV7N}fWiSJ z0QWF(N6NwF!d3siT>KSg6?d$VI|AGpph$pw1Kbth?f~}$rn&KWX@!A}SC}0~-By_G zH2muMJ{{%83ByCx0h$G99^l~sj|3(O1kyZi?%|jY9!m2=HQn{H-{fR+w!(->5Og0u&EWN^K|+AiYw! z!=YpV?qA~f?{wzfE2VURG686I(UsDAr3_dpOi5Y6PempjLp|s*VXvgLzkcYNhjkJE;N<{K0yGHF zFhC=!4nU73@0fgh_8n>bjtqQ9-g?LI^ILUhU{k6NuvsZB0<;X!FTm>oS_NnwpmTsO z0bU8vCP4cD9Re`T+R|^lD+}=TJ0^S-MWmw=I|X=E<9pdENmdEn#kD`bO1cK<7NAFf zo&mVk?X>_0s!DfV3-@}pSS5W|Nv{CC1HKy?eFJd&5ckqdUnSdCnGF1NmC^F&D(N3! zK!A|}MgI51!9521W+W?OAG50IZO9Ts4?Y8k;ySZ#n0vRl&^|n-n>{+H6jn7GOH7 zHN<5hW(1fSU_X}`U{-+H0oJf21I!69H^36QD8M|`wIIOTip&qd-4QfzVSq)9wS~n2 zey6GRCH1b^_CtiD%K|J9uqxmSvaupCn|xLVct<7N{jQXISK7TRgWr`U?;7TJmHwVW z5=r4smG=Xz3$Qi7wgBq`YzVM1z@`8naB1(F4J}OdoyyETikky$(dnNkh0&yMw+Gn4 zZXaMb`+tDH-ZdKqcd|LWXH;wB{DJ%bz!a45ic z0lp7#IKYtr9|!m(z|jE50-OqPI>7M&Cs?G_#*$A1e8wyd@J)cv1AGzS%K%>mxMPjk^+$eYZ^bpzY>k2B=Ng%Z zeb&gg0j91o9p;AsKL+?az&`b1f=yf`%b*)9oj^I9pn)>zwQ zty~`BiV%;4cr?V7A+8FM7xLxixH`l&A*>K~h-*V!7a|oR9pZYGU#LJ!zqK-Nt*NYa zYb6sR8zL9t*jl5M2XmN^Dd&W6Lj)nh5MBshr}I+v{aU&5eY3&l&i5q>5i30jP1+QF zUmCtI<+$PbeIw+?5I2RmE5zN(b90EoAtb~tA#M%9eBeq)zHc(&wh*_6xFf`!Ar`zZ zTXi}+28En@U;cdGY^uB`M3E2=P*jL}L$kr}z7Y3^;9gdf7`nld2)C;}6q;1I#KOah zaMv_%8wei@@py>JA*zIUBE*v+iiRi_;;9f%hj>233u@;xA)XEK9EqG*+uVw9!&qjW zxdPJvFNS!D-l%Vk=RPQQUDjIh5G6vC4N)#c$q=PNlnzmbFCPVh&Jm?b0gcZb!NL7H_ov-c-vDoL^ZXiUWn=;YJ{kxr!_;=3Q=3}x7W#$ zb@J;vv$ck;kK38*>XNxXiaAz4M1v3wLo^D}IK<1$jrHb!fHpj^UW%_b2v@}0gJvO` zGgTsFBD4t6GQ@@uAB1QX^2PLcGsL(Muh7&GeM0o5iV*EWbP3UwV%JOi5FJBwqHkME z2ev-lCe(esyc(i2z1>E}te1CH9f{pSycVJtld7fcTQA+2^C5bM;0BB@*2@JO3^ApU z4855%8_d>=ej#2DF*L+5o!CFbzz~BJ9}wah<*Bnl28S5J+z9dN2I1+*4YER!-5X?h z2x=c0Viapi)luUo8)S5di$9PtA;vN*+M0bJcYYwxd>}PGF!=Zo6GF@lF)zeKF7pF< zE5x)AlR`|UoDXD5h)+I{sbu&-c6=ZgZ#0XY&gQQwW`&r^3fgG4W0m4wwT)74qs$I5 zCq%Q2W)o5GjWT1S%xBt%SP^1nh__j}ZDdi1#UU0dzGkD4vLwXP5X(X=4{>0le7jLD z-DD!j!&jupCV3~ssu1smSi=uhC}koiDzaB0 z@r@xig*YGL*ASaSYzc89#K{m_Lu?DNC&XUf|A*MYH8S%z%V(S9LuS`z*%_LBQ2*N` zMU=>)-OA8lv+N78Kg5v`M`?eEgCP!uI7~$?r1xf-wAt*@TCv$Iha1=kkA*nS?zBa? z|7z!E`E;}Vr97uXoDT6N6@@qx;w=3i;?of4LVToA_?R7Li#)YOs&6rJxb^6jE%I52 z&qI7crAi#IMc&#Xs}(2mb%<|5{21b=5Z{LQF2wgCe$W#8X3KvYr&C+yp{-JKt2Ekb z67uH|zc2^38Wr8Q%DS!c$yWI-#P1<4jZ89==Z_Hovb{(6GsIsZ{??%U6XJh7REV`r zp4cWew@JHgazTU(BU}{W;t2F7vw}e%xJ@pJ%zh;14+YXiRCif~%OhM7;mQctMz}6A ziG5Xst0P>as>w5Ro7pL}ew*RHK0=`gsR-OebXqASp5JDEqjAl4$wtUU=)}#VWhE& zpWING9Q{19`sprt zJwksSCC;Sc(4Yu|BMgf$TS`&2oobriZD6C6rIcchioR?n@7p@cT1n$rr}J} z0_5h><-2A4ZZpJ$nHgbDgt-xBMVK97`);$J@Z;U`=Wdx7VSa=K5#Hv-caMo9D}uA` z+#@gS`43qfVF{}v!nO!YBP@%sHp2T6mPc3-VReLeBdnwk`CEVptJDL`tC~8UqPp*q z_ZXn9vL-ScAjj{K#d}Q0-nvKDMOe?2j<7kx2F8~`Z!H^D!l^xGFDnz{=RI=eUb%6v zF=k5yN`74N?GbiFI2hqjgbyR^jIcMtJ}y7P?#S#}-NUR_PEKsOR|f1AZm-?XY+?Ub z72E>N4UH@=G8|?DiEuo^2{N>hqY+qN#~6aW!q%}#<(!OgD#GaqXS58z+AII=H5--b zcB-S_2tSJOF~gT&e1cCRe9A?|*cjt8uAPMzqf(47B7DiN6(fo9RfMnEa${T)4O zn!-OL{1pK)E{O4WgnuIZFT%gN{5AW8*GJYkdkEqFee%sdxiJ3kS>U1=EH0|!<%u4+ zG{$8yQZdpoE{}0VjH_c@6XVJP{;L$>C74q#-7nY1xGu)^F$yU?+HbB15A2r;`wfFx z#Wu;r$i{GEcrkJ@tQd9-CpM|ldcX8j&dCaC0H^pdf*4_pD8{?{|GRn~+%LZt$h_`= zz%cUWoBbjAvs!7n?hi{EfSm$*tzj zK{M;c7%#;r8lxB&bY}mqjii|VpNY&BSxbbjbqe|QHyJdQ8&hR zmHEj*sm%mCWNfGxqkfDAF&e6NW+NR!=pB;#4@t>G((sVH9HU8W?#x@pXd0tgjOH;~ z#O9`j&5)@`Io%J*C>6L^VXGKh6=@TrZH(7qbdS+4MtjDHqUiq^9aUqe7|d8oIDJUY z>lEJcc8SqdN4v#f5IM?Vr4I{l3yJq&CdB9)qhE|(F?uU!AIA5vlsaq}UOsH9o3|FP z>rnsL^i1B_c0Vjbm0?hf!7--Cm=R-0j5lJ8jqxUR#TXW2M2wL!rX7~yF|LaK+xxxl zu<0A4VvLS4CdQe=^2cFGA2B`T&Li^T5g8X_e2hskCdZhd2{th{SAQP)7kyqSro@=a z^-{Qcuig>qb;KCVW84v0cEn`P%owv`ERL}x#_Sk#Xnc$XG3M%8=4o2)q&j8(_=vn6 zV_}R%)Ej{rMN$7dBAKJY`|A8yERC@|#tMz#GS=5o!?QBRJ2BSB*bw8zqb8|Vsm;8{ zTOEV&U4`$(Sfj{Vg`~f)$hsKyj+z_7PDf?LQJJqYH^tb@N=$H9f-Ovd7=On2E5PC6mRz8L#s?2fS~#$Kl7G2y)dAICOO{!wv`8EX&3I2hv) zt1Lzlr4&DAJYQdNK4j6u$6_3haf)q_7ShT3JC~E{wEX+_*N(}V7-wUgi}4W|j+wh< zE}TD~S(UHln0X@ml+8cJ_c4B8D`4|yJ;wN&6{>e`-yD-K*-noOe*^LjuL#HGTh^v( zxvs4-l|}l>{$a~akW28t82?glf-4gs!37B}PH;(Ln*W6fb{?0D6z4UX6jtS>2`)=;d14Zn zlrN9V#V1Vi^A;#MAy*~1I>B`bu1|1{P9)E@iadJ4++^~!P=Zu~bb?HR`X>y92OUK> zb~#}luL!LKc7nVFHzaTpxCw#;VFE7!e^TTpAkP?`%a*nLgfJ*kf;d5vm|ta5;4U5g zt(AEexG}*^2?{5W1UDzRCBfY%<<6Ficb4*{B@Ggt=u_w(<2tCQHW1nQVd^W*z30_R_QiA6blY4xAd?5kv zSjfNhq)9U(MHBPet6~XuoRl*s<$z{gNfHxOO;9aC=>%mGluuA0!S5%9pPrRXP%bg` zm>=0fr=((nN(m|_sKN-gHCF+CnsMtX^Rtxv=VI!ro}fm8x(Vtfs7Y5RsGXorVmkJd zr~Z5VuX0LWJ!QJnh*MHu-PnLKZF5JLpM;A~N#g`BC+Lx&XM!dPnkHzQpk0Dy37RKp zm7sNk76}*^uCApD*>>tbQ(sZDd3|Y<;Nw%8GwRj$2|6$_5_C<_F+nG~JwfLL|DG~J ztkc2^pXr&Wg?FCJpKdDlwFKQYos1g~3KO!#X~W+uLGJ`Z6AVkxCqdr?0}>2O&@aL3 z30Rx`b$XN2MrQBRGU2qWI4y$`3{Eg4!5fLWYV#3k_i6cDdAR(4PfPBM3{Nm3!RQ2I zRKmyvqtsx2Fv3pGA4A=7M#dK8;hPNN8Dmd_Gv@wzLV}6(OdeY1VN!z0EY&<*nujR~ zrY1O$;2@JE!L$VLCU`Hw^aL{!EKIN{!Az!2f;kE1s$M?*kup00Jwy5P63kDqAi>+r z*p23)j7iw-jPL^r8b*fEXJm1LB?(p}Seam{3R#x$#mZQ4=D(k_@lj&q8DR^3C&4P_ z|5jO@m`fFt`S_Xte!ayuyC%Wf1e@8+6TF{bU4jh>K4AFtgO2qonHu@v_IQGgl#t*T zbplOdfp}+SYl3aex&*ruY-idh_>j$tY1YQ{B7O+TdvdmMO5pXH_cnVH>`kyQ!G2cj zS<`LGoi*`la@Hid(X~|$B{-bmy9D1eb_tF$yLjuK;8=p=2~H5L&l8iqUlgqLvUBElRqXs< zC+3riZGoXhWb z&S>ZHdxAd_{K-@)ps-u6I%n=+|6%h_aA6)U$}^q(U-thzT#$#;=j8l3x%Q*~B;5Lu z`3UIQkA#7^IL~}&K<3NxaCsgc$-|?0xFQc%<{>W+H{{`}JY1azI}c7CuF1o-c}V3U zorml4aD5(HeI$kQP*o)p=LKsBg?}WOJY@6mf2OVi3X7s^KXi9DZ13DHy1To(ySq_A z#6m<-Q3MPSR4hah1uQ^C6huWu?4Y~5{%4lYbN+Mo%$av~c6R2@ojdnF_s+gW4HPrL zDP#K-wjcegIdJd4nh4amN*X9-psay%21*;+C}XuUY0vK*rKGV?-arMuXy^Y7MjB<@ zTTlP1ECaTI#6U#@jse$z7zhk_2K=-IWoST^4N?N<-LIb_5kdnI2SWYd0HrsXnH6Ne zYP4VV-LEPcTI5zSP}R_wLuJ;PqPeab8#GYEK+UvG${9{BQ$Aa7f}*@)rjCKS2D%&Q zVW6IY`Ucvt5d#ejG&Io6Kyw3)3^X>-#6VNlnXD;52}6)%+I~fIY|(zj8E;{rrGZuk zS{qsd)08H+tl6(Awq?IYfcNcJ?F_Ux(8)k&&g?GL!9YjO3kA+Lb#A{l|L^P|T?}+J z&@H6~Z3kjpxesV@M9{mZfnEj%85nG!w}C!sodE{=8t7*rBewuU?DC(_8%c-2pW_y)`$jHiv2Y^UML2_n=}6eDJ>XmVHn?VBkRm3k_U5s2(!#uz>|> zWwt-xz#}BiLDl%6VtVgE^~^!_sDZZ+s_h5WKL^!g1|Cl#FtF6XG6TyEJV%~6q(?F4keZifRvuEk)*n(Yl3Na{ zBWWQke1Ay2l)jyXFB@28V0HSFxBAUf?A7f1(z(?LN@TP&+NS3s3#SZ_ETyGgz zYhay$clfLUwn=Jmuxx~nziVK9TK~OtTqGAq6dYEK59)SbfT=OouSxu-ZoQ9#)^FDF?_3yu~_vHDAPQ zyMZqa?4Zy%tX?^+OST?XI}PkI@RNbPToDF#v)cytaIqg&-=-7yT{`=$Ov-RX`wpug z4E&fja`vz)enhv={{Kudm5ybffyze|iT?{1&JlfU@)7mBfjVqKRxKvYYTs z_$G3g$Z4XaiBcwVnaFLTu!$Frsyu0$KTY$dDGT$ZnKegMf&WShnkba!ck$C_M^%wD zU(`ggG*jF}i8Qn0sM>Q>v4!7{s?sLPm~hhavT0hugkhpwnrEHzCin_wc$p@ww4ASI zx&2?AL+M>N{mDZ0UwLRk{>uj@?sS;#L}_81rYx*vqOysaCTgW6RnoNT|7*WmT2kFa zjWly-6t&YlTdQlL&VTtk<6@f)Of)nx)Wk3ojZ8E)(Zxhp6HU^ZEz`8AiDo96|MzT* z|JTl)uC_{VwKmblL|YT>Otd%A>A(6NQp$8pf1Ww2t{qjGkEzaSAt}a^ZYH{?cl)G; zWQiUodZs14Ot3!b&;IvL^LNVorg!_9=x<_xiGd~tnOcAk`ETx+ADq_bE0`xKhMO2+ z;=%O6ktRl&m|$OVh1Lgm}FwIi7Dy3rll#%c}-2L zqJYZsuiF-}VOY5`F+%$7v+9r9DWMK>J z_MP_G6K2?9rVphl`R5T63ru{a@U_CDCKj3~?V^l}$4opi1*nB@!^-ikZC)JdbYQag}&lgXs4JXxSCO#)sO?++Q3lrN-d}(5biJd3a zfs^X;NtNrAs&GnAZmm5OV|M)f*jLLOZ*SF59+Go`%6Q@mFH*v$n853tsTrzRl#5oh^ zO(L}eiYSLNt=vnpJSv_~3o>hC!s$*x>74iVror%8ZRK|0v^f^`WoN9hf%{ZqP zo>MnX+@g55kj27n6R?oMLPiTOol~37sh`fN6X#Tx^SU)&nJh3ZeO^^Rud-UmW+A(U zw&&H5^J?~awe-At>%7{2Ugffo+d?x7%`N1ykk^8;AQtjj$Zw&vg)$ZjSSV*ne!rmj zNLdTzESMH73*{|TuwbNJJ%2&>mVL`}QP~&u5Nr#M1=oUSf!$_F!;7lNMNN>27u6#d zm2ZJ5DH&J@E!4D7%R*!!woutZ6$`5`s>DJ?3zaNvy{LY>sLozgIWMVlmsIsjs;Y%* z7OGpQVWG_>HRzJM>ymmRy~UqvFRAU9RBa1&EHt#x$Uu%;8vQWudi&ZWg-p z?VK759V~RT@Y7}0&O&<<=ZZRUS!KVXs$WrUuc%HII$P*sp{s>aSJd1q>iH|`y(^0K zzrCVgee{azVWFpm{uTyU$a+=vve4H;KMTDrkj?sVLa(aoS2b&OxT;9-QCHR6t7@Qy zL1}L@UsFr2sts4wuB+$J5Ms3ll6%wDA2k#dZDaHT6+ieke_+SeR;IriED+rdgQIZeLe3EZn@N zid|R1b=By)ns{B!zpn1G@WORsnxb&&n6n(d+773v(@;uyE4CeHP|f z*kIv(3-?=iz`}DDp11Izg@-7;Ej(r6Va|?)g=9-|j)esl9<|WxhRS$D6~Ce48>&f~ zvgC0Ki!40B3Tert8;Y5iZm5kn)b1Nf@4uz4-BKS|*l1z5g>Nlvvap#9W8pIkA6oc`lYU!$ zYT;uGpKu}ERy}U3!nd`w4{vK;+QP+^mOpq~y?9%_e_MTS;R_32Ti9t~yM-?;?6B|^ zf8JLA+*Vg^t9%d_LeW$o(jBsks{ryKzGDxQkGADyD z|Br=#EgZ6Nn6qi&fQ5q@N>7XD#Hgk<-RG3+FA|Ad_3TVBw;LD;BPj8#Br!3zzxo zjIuhTY|SXwGD_Y|`nqP}x&=GUv%F>|;ih(r!rwwB8<}|>Q?QZ2Mn)T5Gs)OYLOJtL zCRv$DHe`}4HnQ5tW+S_eJ(+|IbDV{lg^RItW~q`{+GmzrHb!Tbf;I}-$ZaE!jl4GU z*~o9BfQ|by3zdQ8nT45mGt2JGawM~4%p!$t6tPj&LY>cNZzbc)XOnNT$-!(=)kd6Ms@b@eO$uh$SEuY!(?%^DZEdu( zQQJlx8!c?Kv{BbaJsb6HG$6rms8QKvPIg(AUDjon?b)TFjX$$XBO8~pOXDbI6Ds(%wb~&Z&)VB%_T^=^H!Sn3F@6 zrq??;q>Bwc^<@sBd|-orY= zDI1GzJY?fx8w+hbW@EmMM{F#x@hIQI`lr;AT(TjT?9L^Ja>=b+dO8Z{mMFJ8p1yri znm&=H9NLpZQp%pe(+W5%E$2MNFvC78VHrCl#ZR2Gdui1Fr#w#|y%Pp_kSYzXGZpo5I%HM^2n|{S|Ge*<6Rr?+xWo7fjqL_#(P|n z{kqS{Iq7>pKc>~5?KZx&vBSn!?8Z?g`J{0^>6=f!rX0wl zmoxYAJDG26?6&beg_VuT`Sh)CIrfy=3-ig#`D9Bz`N77IlzaK5On%vyPq+=8Ow*rj z?4ty8kjKFYeCspP|g;V9IR7FayrQ6@V^(ORv|q!PH~4qGOUo~b&$`2>%eo6-$4Nf zWgL`sP|!gk2gMzfa8TGm5eG#b6m$5ugTmQaR!BA!k{=2Q)yw0BBx7MIR#-|pDCMBE zgSfEf)ux4oOgp%+?sGZz&4KOkpMa!-1H*yoz;d)6NNV3xSe6$Ssx<2h%kIK*w6HjQ zZxM-$NV6j1J5UZPJE-D790U#$M+;vo2t%y{0P|ZPY2X!1&cTmGYO$W6coGl{Ri%OZIx}Vk3v~5u>{pvcX=b*lW29DHCH!w(8R$T4&HRo)Il=`6CF%)(A+@_N@E9o9JF-M%0Xub zT^zJ_(8fVK2kqIJqH?aN|mh7Z|%w; zN9*dxiwX0jGt(gshLWR-OR3^gxwy0}E+ZU_bTG!j*pvdJIJxK4Xa_@zYl_`fT%Im2 z>x#=b2jd+~aPWC?p}PJ{abboP&K8%+4yHI*;b9Nd-C!7QO4uTw%gm5|{j^egytwu3pWUqZO&YUzDd-REGQgGU@JaB#na2gsQY z9(MQ{H(@9F$b)HrC^48PNHU+(L=+-}yir0Pb+FLEW2BqIZ~NxAV?N|lmAL%2gp8BtQ^mXzmM zv!p!l-~}=&`M;#>C@FuH)Z+SLNm=ROB?qr?IvlLx>MJFy9lY#-X0=;N8kCY=rDSp` zd9;+Qaqt@Xp@h8dfFKgbvbvP+EpeoeO37Oe);c)o;E;p29jtS()4?tW?{KmleC*&8 z2kRZY=imbe8`Bxw;NX3S-vp37rQ}>Gq4CR&b(4e54nB175m#ktsasmurLLuAOlg^0 zS`(buhzfjie(fN^2$dozk+sv>Yt0Mb>r)Upn~8!Pgvn8QDQ@&m+ys zNU<^!mXUsCWO5lTIp>#=ZyfBV^mg#8gKx=`4t{j-6WP+i9*1YI0DO$meFP9HwV8v_{YJ&4*qcPr-Q#7{7tSaE6+)_TSf3yhO9IsaZ%AlB^Q-lIwEz+ zZbJ?la@&xirYKWrR#ziIT-0?@kE3=`(?x9;bzHrV*K)Op=xS;r*EeO9DRWI(cIT&y z1}+-1n#;fB))j~ay<^HQQx2H|ONfUwbS{274Ynt3EqTJyjlXJ1CyunBbaBzurMWGgU628ItD8%6Sh|xXTp}Sf z`e$VJcF~Y@27o&Jxp;9Nm*_x%V*+P(trdeS}#=02iVv>u=F2=i<;DU(9 zL{6C_1UzYMvj5!N*=Jr;Tue(xG?ip@q=%!+N2lpb7qeVE;Nn3Scd-!{b6wm=YPgu~ zVvdV@U5a|W=f2>`21f|$QmB6G=!HMe#r>L3q?OAxtJR*{judj`Ar}w3SV(x^#e5f! zxLDxgQ5SrK2L3=-?sBzSzBoD;HfMmPOTcv5Ti&>~yiq z#WOCJxLD`n9T(5KSnA>>7pq(>bFtjT^DbT>|9kSBi&~y^_N0O*G!U4+=wgM7m2BS= zS_*U1yURRnJFIr`vWwTr9xh&S@v4h8x<9(N>>;0B>&X|M{Obv!KO%To-q2{?K3^{Qnk?LXwz}Bn;!AeV#b+))ckzXb?Jn{t zq2ff9&sWk^Ngt+#h3ev0H+*R~N@zeCy&n7k{|;)5Z5L z_PF@j#Xc85klS7Sh>Xn-WJMqs(z_R3z1OpG zcKZ^gUui8xxw&6;am_^r4;ejNcX7kTZ5QycInblH$qt;=zJ^;QS0KzB3iJ+gJCH)5 zWb%;NLlzHNJ@}zE9GZk$Iqx0H#86itIF`dBLt>_fSsrqE$nBxAhbA8Kc*x7AJSY$O zJmmLK+Cv!+1w0h=P~1Za4~0BD97)q;`i=)C2Ry_(*15cp#M9p%{^r z^iYcJN76HrNs$n9F6*HjrM(A}@}FF5_?*DC#(<)-4H~Ln#5AsLlqBI zJyi41HUgN<;Y=)BVm%@vx^+GL91A@@ zSrQG4HRM2UsYV_uBtqnzb{XY)%|x1dXy&1xhyEU#duZXIi-)crT6$>Zp}mI=9$I^7 zm@zaT{Nn}eR9X)jN(AfhGB053#B^o+7l}O%-Vpo)I9=dzz z<)OES9_(;M>FI%sw^K#UepHagR@7G?j@Q#$)dLmfxr(x(qU^3H13V1$D1R{4!ypfX zJq-6S!ov^`hbqcY55qidR@|zn1rCh@BAi7l$w&`UNk(}X?SaU4vr1ab5~3mY(!Y|7 z^Dy4S6c1B9Oz<$#!z2%rNrXzmzLDC~D{0l@@k+V_?B_HO(>=`au%nW^oi;@qL_6#% z3Eek$dAOUb<>3Pl_js7?VVQ^J9_Dzs*TX^&k9nBu;XV%!kuyEa^Kie12RuATe!i$~ zSJD(HR#~L7MhF{JmL8R5zK2IVEb#CsyINUGqy?2_b!8#IP67B~Wo@cF?qQLKr#(F5 z;Rz2F;3; zdAO>U63wbg->UMOhiO%1OI6udRTfp1HC5$J4{v#R$HTiG)_Qo`!#WRahtM?b{ZmyX zb2TYdO{!Fr^<=qf@}7qcocd})x9s$4vM{|?SCfq%HhK8T!(K`o4BM%>Y z_{_uS9zOB#sfR5dwlY&qeyJv>t7)~07a5Xv$~JOxIi2}}6I4xSwtL7?T`E);4v?tS zS029h@U4gMJnZza%fmM$9hYQv=~-PSR~Pz)c|BQOSVGtH_a63m_`$=EZ26R8;TzRu z$T3}kWTAujv+DA*hkYLQdpO|X7Z1OB_={4-!*8U6hd(_0Ng8I8U#n{}o~GEdpP0Yu!kdDRvwOVvTDf3HRPunLTLJA z4WXFLR#S`LlO9faI89kWflyQG))e~3JJr;X^5~ixkepXj&U?7PPWm|L4i>slHTq(U;dmdvUp#e5X^;rmcNO86-0 zqZ|iPOG^1D?W2s3vOXTKrR(#ee)VoGy>aZUC4bkF@;)l~C{SD9^=gaZ!}P(7m8Q(t zX~yy4-YNO7oNBQ62z*rZQOQT>Bk~dZNPNwibXrlOwyrGt4QPoE^ zUyIY}wdJweLT%@j+FC@=3-C#8sp+GZkM2Ht_^9opj*pf;TKTB!qn?k(KAQNb@1p@* z@X^TErXsx>qyx;+A-ABM>8MIeYEhk@=&dgw5=lp>u5lRh{WtVLdSh; zA8mYe^wG&jTOaLwwD-}$r$bPlsw4D3y;euI)zPcqKpj1goqcri(bY#c*32(N6*#o( zb%ah0LNwfn*>X=Gy?hMwG2BOQAANib@G;OwUmyK^^!Gv6HVv_Sb;Yi$Z9p1#l-`4U z4E8a^$I!Gwox0Mgt_-g$v(gN8Ncyiw_!#M9tdDU%M)?@+V@q8b<7@B9qPp^0UExo% z2hHm7J|_5>NY1Gzzt)vAb@dKH_>sKI4o~qh)yEniulbnfW4ezgeLUr3hL4#(=J~ka z$1ERr`IzJ5ULSX}OP<{0V>WrLp4?$VzN>yc=~_>#1YFB=ecZ>9*49YT*m}aH{eX`L zeLUi0fscoLJnUn>kJa^rQ7CkCFRCX58>w_{t|yOjJ(iZo$f7goNcLwyZ?j;ybR)tvhBO4{tJd})25`}M8* z8t;1D#~VI&aM}8J)5lvrHv9OHg!1vWkM%y@^RdpyJ3ij^ai+e|5lnCIw)(QSzSfyp zvcbpuJ~sN;M1jyitOmOL1M+zT>DoZXHjo7kgn2rMKl1Uhk8M6a^YIB67w6r_R(89A zrZ(|Xaw*lJj~mF|2HKMP+{YI_w)^-pow$>1xuKM4D3uxt&1CXF74olr?DVnM$Im`? z`S`}i9v?sW*zMz6AK&@-o;^RRh$rx(w{CuZY12?U7Kb#{B>IsvMS?VxyLcT_Ya7b; zhO*DcFFyYC@t2QZef;L*cOQR{(~9b~Lrt40FDmwj8p^GP^0$wFeEjQUKNs?CRjQFB zjkMOp>1)|Y1~t-|Lp~03c`9^PIO5|d1)4$`g=3sn9~l)gDV*?ek}}-K6(6U3oc3|v z#|83mBRS*atdDb?++13NB5y2ilxkmP!)(YK^nDa+EKrcfl0kvEDCK99#?rH~jB6~J6|yK4QYfsDRUw-~ zZbfqp*%fjqs>`Ceosb6j55iF3x|UQ7EcVOli*rO?ZMB1DfcKwWLBRr9*(2pV34XHj!0L zq^v?Yh3X156v``9;1Co71w+A9a1}fSi*9WN3MEJ3qb3?y=FUZt#S+S^Jx%0D6B?CJ z3PiDpP~8z?p+clkNujbrtdJ;FRA}5(ZZ;7HCKYTdUQ_AaRHihQDoP9gstVPVjd@dAf*iL)>TdA!=|#QsdjdpXsTCh zV}&LPP1DL5o9U7g&9w2$%GH`l3x$>nZ57%nv{GoT(1zb|EiY}G$&hA3L!Pu^A6UX| ztGz-8g^mjJJ+TFDxNMDaFLRnn7lp2zLDE*Co8tfIVuHd%1^y#YPsRUr#1MsE3cVHj zD-2NRqtI7@GuV&QbX~1zCXBG+Zn&wL>}jTF_DC}ss4z%@v?9Edp}BUU4pkVYFiK%G z8BAe>!bpV{&4o5K-9{yvOVnJ)63`z#Mq#YNIEC@-06jQq^v;0hdROIJzQ3+!HJ3?> zRzLrT1otXTQJAVQQ(>0EG==F3GZe^yT$^nFspgt_*v@;+0E{T6dqD|SYe*R{R$5#Jjm7BTy8YiM5DN%GqFeu30g>_7BXKEcEAFL zeUf4=^crW#1cCaoEo4Cpp~|$fg*>jXh#W``S9n6El~T zCRBJ;VU5Bnh1Ci#E4;#Kg*?(yR<#rweIK^e+7Tl$zH6x!r`HrH50ACfDmPW@Hx=Ge z_>kRDSgY{1!g~rE6xJ!cLta%_uRtt_m1!^BZYjlD2^mSp(H&Rslci1hfaE1Bo>w&G zIEti|Y*L_^vsr;pHE$(Us6OTbSNKffb554R7KN<}+ei~?HLYY;E3L6S)=K+3USa)K z@`b{7g)bF$DE!n)*P-!syp<3Q&d^$4#ahcwg3TGA0Dg3OkPhr2p0fk=_epUEO;ctq&>hhby9}0ge z;ze4+r((}>F|da^f5q0q2+x1G606C-B;8F#b+mPB8QfavHae(qh(w@xS2#>|;tHbJ zCpWg1r&`O}*78|vp+|#yNh06+86s{^m8^nng6x7Ef~IYC^bT+JY^(K|32o(p zwz8tFkLQZ2^tDVqHDX%RR*n$cILqOD=@nf{FJGRp% z_Q-ZZAcYF8BX9*2p6|93+P`z#$&z;3WupWls4J)^2n3;^hM=Y(5>N?=1&Qb|RLYZz zf}QQ;Ks&kFj<|(ZR(VxUGgZ>GD%(#p)zg##0J=_1YAL8Ks3SZ}s6kXp5-wZDywS&9 zU(i6%gd`O-6f_cWH!j>>8`K;iQ)070duh^MnhBZ^9L1#gCHX`W4p|zK;f^Gr^t`N20#aL6iffluw zo`PP2AKOcB!J78k;-FFRNqeC{X0?8T{(>Qbp@IQ|fr3GT!J_@7bc~*Auj_E6SvpAB z4mv+fFkCP~Fp{L`pzBcT(ltikC||AT<)|7X7%P}5m?an|7%!M2m@1ecm?)Sem@FES z>e4~O5o0=NjpB}%VO|HBCfZFrog)&^uH+k+br701?{$!`I>Y4WtvD-q=xJ-*uFO9pzR>SuA*3u#Brr z@Qh%I;90>^u9Qw15)V5`>rT2p#T{9Kn;PS?o)bJTc!AT}N$%?;&v(*ee7}=08gnII zBzQ}(RZH9ty z&2pmoQd)5Lbk+m;Sn!D;4v+-+RIr6}A-F8qD%i#~BKS-28E2CcTd+s)gTkwnESIU3k7sX|-;Ae93X;r0*Mq1vYFe<(%k9AqHRd@2Y#nTMN6&1#SVH z?ymAlSAC1IRaXR8DP{u{4scCyopL)MbbuRzn}Uo1G6lHBNfaPJhJa@nHLydZl(KPO zSM91MVnbCYbAT)XvIfW&=mkQVK*z_0^wmTK3G(FZCOHG-3XnHIz5r#rN$x=Fhj{`W z&qMsDdN-}y<`2MT3j`<_pmjGH(oKV?p>BU1N0m=j@5r9#? zB?FWSaCbLZ(oNQNlP|mJz$$WD*#PANln+oL(0FOZ6ZzO&#LlRcX_kBh7-9-RSZxm zz_0+r15^%Bh1CMI4Nx^ewE&F+Gzm~WK#c%(1JnypGeE5XwFA@%u)Vwd(OvIi7rRTI z9$NZwceZ*+tsYW8K*Ioy0yGG~;C3=6L+&YNDH|C|(Xod#4bUt=ivTSHjOrotddTt~ z(mVi}e_ao06=-O^b$}f`^q$Jc`HH`LNV@>-1M~{eJ3xm39RqX==t4rL0G$JL3D7kF zgG{dUki0!LKtus$_tcmY1LS(J&poAQ@V{V4?!29P3j5Y4K;HlZ0}Kk#kDci${R0dL zFsG;73DRRI;PRe&kLIEq9AHR*p#k3ODLZ>=jc$KW9jU_BMg$lc;Qjy)u#o_x1I!38 zGr*VtV*^YIFgd`u0OJEp2voe7&@K zX)!&k$h{2AV?@C$jv~Ol0p^m60^Ac|HapA*^Xd>O;%SV(qQI};OA9L0mq@z0e3UJCGFh=)R~3b2|>GDQ9mF9&!fz;6M5C#wWl z6JTqAZ2?{j@Opp^0p1VrMu0a1yu)Q4;H>~_1H2tz9p}2Y%;>E-gr2o0dTZK}@~`!l z_2jqSa<#X-$3@y(gP%qFNZdz02(U50hveh{n*trJbZ;No9H4n0>EB12EsOie#{oW} zSAOmz zXZmR9lKc410J{Qw!zoB-fo#T;EM8yvmMip%YSvf!^%Vwh6aU$hin5;q><#ckfFD^Q zjl1LQ6M*`el8W*nz^~+xzFNVcB0+cRqkZ*TR`-=nedUh;e+IZp(Hh{d0DlKK8Q>J@ z5a8bchXWi5us^_o00#pcB4eZm{timlqZ&mg6h`^O<2FYF91Czfz=;4q_0@{UiN2Dd zpD;j?AOk}YO7@e}0nP+CAK(J#J-|5*yrxv{r&}P0Q-&}c~*D3r1WDb!f#B=@RW`NrP5NaFY775Z%zUe0!LLBNR8AD_Wb;*si zutVCh+H9Zhae|p50N88&JfhG>CL1|jv6&LIC@oRP3VAu5P3uN>aStd zsr~hiSs+Bg5N$)W3sERU;SfoPiXn=GC>p{DVTLFcqIihXA?{pC`B$vZ&%XDJq}0a9l`Dqus{Ayfzn;e>EQcp=@{ z=sZA14G+5cNXT579HN zFfpybI)uBKa%*c8qH&1kAzE-D52V{2O+z#bv2vgeVP$aa=7I9#K)pe?4AF}33ehIi z=h}F7kJbneE%LY}-8b~nbC~TzbOYlv9v?`*Kl+5|%j=xVJV<7rSEU9?Gd0=8yp^DM2L|gMunKhTZ3fPAg$IC`{KkAH(-8jh;boi zg}5uk_z)99ObIbH#6&*WQ6`0$9Afhzp+kqRB}z*gCS<~CA*P3z5n^V_lN6rc4$|dk z)0B>23evkn+!Ny75OYJ!4l##xD64}Evk%rHw8CJiH(2fqF)zgZAsz^|KGS)y)~O~9 z)=DOoA37f&94rrqm>=R&h|3`!39%r=Cm}u!@o0#Jl)WKVhj=W+;~|!Wcs2x$+(jXt z4Dl4#4ySUkHhVV>7M?^~OePQUObCK$Tszb>xQM8k&?&hz#Ilgl5m*soIhSpS=R>@} z>8>Js25T6T#yf*}>4V@S#7x-3m0Zz7Rhh4`42hsgIsIc+h!7;lsUy zUY;!>wubm6#IGT?h4?JQx9nSp&qI6>;_DDQLu?Q6Wr!UizTy~%O7Wpmai|srjI^Om zO=?hI+QsECRK5wZJH+sznjl&72;=+i8LE}W??de2NJH!mv3RKbKtACshRRz*wHKJ+ z15q+wKa=r}seNSNV~PORA49dr?Y9uWhd4sQQZj`2lQJj7{t$nK_&dZu6l>?TBaFNG zrJ;IT=N6W87{ga^kU}-YVJ_9v${42Ats29m(=aWW+2>Ki0xx z4bvAv&TJ8~N5~Z+ccdd!bFkUrk~7j8_|0M3a-rKjPlUV?@2ZxIvK}C=V zL8P4vyvvKb6*-5T$s>>qD4 zMAD6r#u3l#=zvLkgf#gt&j?ADG>_0CLd!^_Ni3mO%+unGw5&Zs+C*p@p;v_75!yv) zAE8Txt`Rz<)7mjYrwELm;^;b!(9uDiBW*j38KDiaZV`wsc8|~_!h<8^#SvOf?HPgQ z-cKWhO4P;?(kDXS2m>PwiqJ38hf@1T7!cvq2+288gPG1qZOl?#92{XtgrO0JMf#LF zw?fVi57sf3vi?XN`^_~nGQy|`ae^elXwEyw6{BU0u@S~a_%Xsy5ynTD5aGoLEBHFy zc{~zfL4?T>rbM_m!rTZ`BTVA}BitQfdW0DfW=5FBj-}2f?lN6R>PROBMpDL(8Y%aU zlzSq~jxZ-30?kz#zcjrWBE_2bMVJ@iAu>#a`y)IM;q8&~Am=)d4m;$;Ju^}(a&*ef zk3fcJ{2{f1FGdPu5g(1PFv2qtmPDX6`WR=OwNozFMp;g z^6N;sGE$hQqm~&~dzP!RjVz6@EaDd-v^KRo!gCRxCxdZWjnWKkrzxkh_9*S-?L3N3 zVZ0P!V}wl+Rz+AHVJ$l!;pGUgkcA?=!Rd~$hLpLWUQ1U59~?DG^8>?!`Jy)?ycL0m zm*YRI2O_?&OK zqP`#pR?&q-nRr@?fo*gU?}+dfWln@|BYYiUXM|m(ScF2Oh3DB>hft3{S_c*LtZ0ML z@?C`QIav{YAbXG2hfEoGY@Jlh^DOh^(K^33!p{_3G4jRO7vUGaH^RjTzee~i!l4L< zBm5rWj|hK9_=i%coBSE!FZQ#z<_Bu;^rceY_?N@s*hwE!c(jIeNDvwkyl5D{G+I6y zEk`K6xN0au$paCNM>rATB!x+$t$r?zA4kiv(L!D8j>&K)!r2JtBAkzqX^fN^qX9+& zr$jZWr!j(yknE)hmw7iv<``EZT&0AMaGUZ!!gWgih{_lbit2-SmBvV`F*?qw-x%R( z^qFG_#vyYx$q*xBj74L#PiM^-J*cf?DqhO3eG0Ma!8>4WHA~8zDC>b--62)SS z8Y{(P)ETQKQrEFMOqz(q?6JaVi+;ZSTB$# z$I7~~vSX~~?Z3wA9mI*@vgSDPV!an!94ooU38PHuJ7XP*8QzJSF>1vKV?=yWj4CnW z7)gwZF)GC%x=2;9(Krn=5((!qY6ekvA175~REtqPMvWL_#%Y(zk*@8j9wh|I347`i(wBJ#_5RVzA^g67#L$v zOc$HM?9;yo`%6KE{L?6VpQOH3SEqAFm}jB{oBzHjI}kF{Z|t5o2bIX)&nC zO^}&WX^dqto{6y}#>W%nS++1iR!vB4 z4d@k0j~MlnV|9#| zW4sdMRhBmp!f0hDO3jJVaiWZwsND)Ic|FD(oIz5Lqn@a>wG6H0#fh?UqVOl%r;5HV z#yc@K#CSi(yD`?Y4`h$(8Xoy(qU@ijJ$EEHRhkcCaEsg+V-tsVQ{9}XFH?fd39=-}nrQr%uxhR;n(K(GFu>TDqP^8Q668#fCqdo>xtKS!f}J}7k7lz4 zh8fhHBKZ>JPf#F1!33SA=(WIdVjZKW2tgaVK?!6PNl-L_k-$t)EJ5)EWfGK4P$EIe z1f>#`PCy%<9pHBo?wO*$7_efBb^)-R%~PaYg7OJt<~6F%CB|Efv1f;Wo+4HPJAt1- zC2$hB2|SKHi=3XKr-r92nPF%#V~Qj}kRVJDCE&u$GF7+03_pZL4^Ek>x};))N(stU zMEQ!SoS;gAHxj&=plX6@2_`0(l%RTo8VR~4=$3FdN38_S6SPQBJ3*ZU4HGmM{w zBtXjqtrE0P&>=zV1Z@(uP0%jU;THU+(4SNFzDAgfs0Eb@#y)lA6eQ@Jpi2Tq@sTZQ zM-wJxpbppgg{j&g?Vg}Vf}sh9CFq%;SAzZt1|;a6pihFn3Hl{Gn4_J2#9m14JkvA? zLt}vI7pFj7=~y!Kg%wi_wYp7WJE^ z4}J5TBlkN-Lyb!?KEVXCUmjh;rN@h3B%l&b&(7ooQxYsn@I->C38p2Om*D;c(-X`{ za8H8S31%jkmEf)fcPAPzVpt9d!n0;~T=3JU2`$Gt3GPiWH^F@g9-F3d31Tudr3uC4 zttc<2bsk9YV1h>yEMPzR76u3mpNPbPRO!3zmqOt3h?(+QR)SeD?K1WOXoh<-K!{apMqRi5eMPS-|Lo#_%; zvOK|a37+T5tto^$yH6MDIgFqiKV4QNSef9J1g|D|DZ#1)s}sD;-cHx&ZF!E5@GPBf zE2e9(ou|*%kadr#*Al!=o*by7>^4o;QjQT3-%ppf60A*dIKhzwZ?iKAzD}?+!8-}w zP4H=gEeY0hUJ`5~VH0df@P2|15^Ut!NjuEFm3T|G8B%tJRGlHMXUK;MJ|e{ud_s1b zA!Z4oCP2uYR`&Ph^hzYEzcs)eguOqCx+krp5TuJ|0dX<;LikqCHOnRKV;)k z+Ob8$jd3aLQh}MmQ}&E#JwRbNQw}CL#N|9wXy){sDGU+hNp>E4JeuGbWo$)ct%&0Z zP9(U(S0^}0GA1~m;6j4a3C<)qo8TOWd{j-Esk=m7g5O19&M4EBFieFYF4H_!GHW=@+jr){DuEaTl?nIUCn zW^TjG%*@Qp%*+f8Gcz>wJ$ByA{Qu03Mr+HmEXgwN9sTD~T%|TXmlYM&LST1A;a={= zis}MS=}MB*0P$P~avONKk~~vMemhbA%Svi*_KTY&pMm@aN*O3^pn!pb28tOdZlI8X z!Ul>Myyb-&m4w@moLX}Z&vB5D<8p^e>iDmOfs%&$%yxJs;Sb+&rNg<+4F+yBaEpOk z4U{o(lYyHJb#Bh@EcjIvV{dL(-8W;aZ!^>u3cclagPT_>mt=PsSX@cARg$|6++(1F zfsO|5HE^GSj}3fcpsa!W4Lr_z4Lo4rK?9Bf*FZS~(OmHwWG~ z@PUC34SZyPcV9`sU%=qDFcH#l_Cn-S1D_eFVxX#l&kcNG;AaEB82Hk_R|dW_@V$Yr z4SZwZTLaCisNldK%KMu#^ULwa)%^Jfw)Yo)Wrm*&^sS;&xO5`Iy-;4w{nfy42L3ki zkAdF}{9)iv1AiHqQbm2`w7!bktLI3;Q-%{drJ{jK1}al~Ri#i>d7!GKs|vr=_`0gp ztSZ$ER5#GrKofebftm*D8mMQWmVw#^>adFEgrClFxzV<&ie|hsOjzGQ0|N~WG-B0- zWmr`ePPv+xS5+O9?5oPNPHD>48E9>wje+L$SOYB$w4%MZ(5@yNiDs5m$0F+2;eJw9 z;Ci;Lfp!Mkvs>j;>1C>^bAJYHZXtFu(AmIp11o4C16>V_H89RVHv`@2R|WPM|5Q^4G5rk;pb3taA83F(Jguv#5sDw_@Ysl# zriK_8YG8zck?ep5hE$U+)nqsu`-RM_rhaVULNzH?T}BxgZD0&L`?2zj6=H1LbnEYIXJNOe@)B_HF}b46HV=#=tfM+YPKWu+G3n1DjZ|x~x|mWP^r7s_R|Q zuVu4=EtJr}R`!>#m1$;ISF1TbeC4yTy6iBp)4)Ch`wi?eu-m{MgWo@bznI6pniJKf zXbrW><{btu1V-K~2MioEaMHjjLwzT5h!LZPT1Ovd$f_YnG$e9VBgZs6uHgy#?X$ux zUJ|HKLoG9R@yFi`oHLNiL~ax34O}pA*}xS#-p%qKLpp;$`(O>#sk!dpPwQ}|!LJUl zva_4WVIrpq#(CZ#s#8PVsq0)rcr%bOkc!P?BCm-;CJLL#XCl9e0wxNY;1`QLkR4G& z&BHkgbDNjf9r>MC5fepC6f?o^bT}uUS3{9)t|2FCNZy)K(nKi}S7RWJ(k5;&an{E< zA2*sPW5RM^JGjZj%_iQo@Ro&JOx#LVCN`S5&BW~{zA*8ni91Z(Y2pPFFPgZ^#N8%B z6OoB~Ox$bYVH1y#xTf4^;sFy6nlNihSrhl`#OG_uH#Mc4#`o8hl!@{tzePpOn$oSN zjHxNhYYNjJGC`QLmON_0Fkzc;$j8J@wdBKEVzG)^@?1sOn4@i z){?`uBv)-ABDLj-+VVkdiA|(UJY%9`9m$yZv$i~D;&Bs+iN>`ht6|UDGQPGfV-XWi znkZgJcGs5wYRgk5o~HbDW46?D{q>pQ&)!8l{f0j_jToM6YrRK zSL>%_Jw>*?uKZV5J}~j2iO)>*t|uRvpj3a>lTS^4lZ#KNz z+{D^?a=M;;W#VfS-A(i`@r{XZS)+-%CcZQAy@|g~{A1z=6F-{x*~Bk&w)#@OzH0bS zx}wMG%dd1%6RYdXpC*211MABlq^vJ|8q}A5^<`>(IZ$8zqK4~8js{ZEL?sh7Of+dA zmFX=Fq>72EG*AQipn+5)w+2GIx=x|M#F6B{UPlS4fd^-Z)i(aHpg z8<5OIQxgqMG%~TifiyOetD)S|P__L?192NlGq$K9zfi_24TV{C8cGWjy&B4-hSJ(Z z8@hpsPP$ZE6YWg2*Z8J}(!s<@&4)05Be}Pcbf%Dvq>G8JG;SmLqLFknQN5AOYb4tm zNxMcetdaC2a}%>o%%S8a`j{APVvLEtCi4($DOpGFIEF(-TY%GTwOYSC$=H@06Hj%L=#+jI6VycPp zCf;r$6HQE_DVxXy6D^v^fF?4tiEM5nliAsuD4X8YRHm7jZepg1Sti`3@=8;gL9b{k z)ius0cWo+k{^?C+F1^>pG84;9%s2UcHx`>%LP;1Cn#v**sb+Grsg!OePd1Yenn|r@ zvXl`+Ck|>R)0@c(6D#S5CTca8RVI!$ld!q0(a35Od78_u&E@sx@=bGDM-4ZZvCU;Y zt7tB}n#(2=n;DK6h%9U|c`XE27`{wwHL=aaaT6y@Y&WsP#6E@#`f798X<`q1UkfSG zLUz$xOgz*=_&m`OdK|Ggd(wf)|G=T)RVKN9MjHE zi@e)XZfz+}OF3!c6wT36E|@q?RxRbMwka)jMkDoF$~hB+=h>E)%7TRdnYgG~UD7l( z0n;yQd;u>gTgYLdpoKyfa$3k`A)kf(7Phujew*7u9t)RRN?r?oD`6t>yEH-@6|lgE z++J-Zg)J1ZP|`vv3q>t_)k=z6nA=KW0j zniUJuXABFb1&>OwVCi(ax?{nKIy*aa-?s3M zg?DYdXX9N9?^)PkVW)-nEqq|1n}zNcK4e2I)Ur_9!p9aqvG9$BZ!LUk;WGR702p}B{JWGh+8|FU>4WZ7&RWg*(XR_Hwelw6xI5LI(>SEwrY7 zNNk~*n>f%A zKiENfSm)L1`oEC>1)&uN|dfM;WdYM_3rC$@+AZQ5Hti-#W=ton%T!+161mb(C8=$v6w+ zEljpB#li#&6D>6EB$KoQf7nU>?4(r96#CoL>-}XK{lAlvgwJ%HNWo@Vm~COXg%uX& zFnU;6VqvL;c^2kV`7LA-vpUG!PO`wlLON$BIp0Z2be8g+Wig$B6Q|B<9`a#l`Mt9& zv((T`MbWq`>F^ddS=el0wZ)5zSjSvOj7HM1v-IpNYbm)#Hdtzi=d;nmhR$-ev)tN6 zy>8Lz+bnFi@Grw7?cP9*^(1h+$cviha}9Tq(!$L)Zn3e)!d?qkEL^p)&%%BS$1EJT zaKOSr9b=DLsM3W;NGggRv2d8a(M9+S>LN3{sED+=i=65rCoG(_aL&Sc8k#8<&R95W z;WR^cS4GJp_jHx8t5oQ!g2@G{)WWH*a@oQ~_Ry|!iT==4YIapId`eeY-&Gj=3-V(U z8#!zgvr*hePMe$3C}5+YjodaK>?V0_USF+-Reejkmf>o9BeD_Oc*@4pHqtgSHWC|I8@+qUlwPu~mt5{8kJ)&f;@NnTI%zI6Iu&w5 zZ!vnybG_AMfRYe-#>R6tD)p9UiRi2^ddu@RNYBKMz2zkvFWY#N8n*F@jaO~FX5)2R zMSHTXpqUfl_&cn(ykTRWu7YB)y8XT7Z5!{t^26O4&%f3Hh#1*w~zc_t1*s_G`Np!?ITS2#m28Tez)<5t)^8B=6rs$ajK6L z>MMWR_{+vW+L7+=D`8*xq%VIk2Q~Ui=e|ULG@ zrv|3B{nWf}Xg_IcV^Kdf=Wk}?Xg|r{Us~E|Wn+Ymkv3Y>KW+4}(bq;>8|`d#vC-8= zdmA0-#{H!eeUEk3mk;|ZRY-q%y1#VRDXsd;!2Z(BMt2IL zf8{L~`%7;dge3+@KO6nEiiX-4U}K<-!5rcT@V9hOetRM%frmGtq5qjIlA+##9^AY>cxpo~pJnSr?gLV{El~fQ^H;ngbtVWE(8; zU^S7;KUj{?ZFHYKM&}_f>{1COyS~^7b43S(zm8bDC(e?gHjGkJ1EYS zp;E#@Ne3L1A04Vx{qj)xa;Q`vDs6|#4GwN})Yvg>s4N*OyM`*6Z+38tgF762KTK|= zoWsN!Cbv7d%>n!Pt;2+i>o;^F@jEF)E2%$B?s0IhgYpi+OI%-tqeont(a=(KI z96abKolG63no!Qcx?yrf<3v&p9&+%g1Fj-V4VQ-17`h2&h4eiNX3Ek?TQZijg%=PrIMp| zjfk&e6B?)qc~uA198{+o>nUOiLs&ysbnUgagE|g+Iq2=6F7@M}jf1uh>N{xQpoxQ~ z)RKcn4(=Q!jdiOTpbm|cyrWb_&M0Z-pt*xqR8C)caTE`*(9%KeQEJEL+fmB@Ik>cT z)FOo@;KH+=gZ2(OJLsahb#TzpK_|jdO1zPyWd11GI!extlER~bF^?IZ9iIu zj+VKE4u&}x;b5eLEu&>PJNOv2C^$V@h}=tjj2h-fIe24?d^bkM(w!Wz>?G=BjEr|M z!NEj!z0s-{vr`kYy}icBWCv52HAa??kpp97sslpSJHx?Dc7F#K9n5kt+rc&m+a1ht zFxSCac2WoP9L#sH)WI?b3mhzTu*kt;2V89x7^|wF3*9wVg0X5UzC`P=!dO}EV1ox`I~^Qxc!31F=!)ZHFAYRV*!7wybMJBR);P7o z;x^8Hw%x%&b`!nHN&OshaF`z0QY}15!{W?3=HRDsa>~JJ2geqKd9Vb-O{IPLzK^J*&yn4Ol;4-7JixMubIJnB7>LQPeEI-?J zk;6q!SGAOspNyAWE~<=|PUDqwIF9FakC7tTg5QL5$;PEC7g;4;lyY&Gi@RNvc5#D?TV34d;zk!`T-@a1W? zgJmZuv%Wn+O#*Lm@xuh=HgzV*?Jn+cai@#k6O^bl9OrLDrcMy1+(Yqn)#Y5QnIQMM zc+gd==CUsCch!E&u?g~ki~JLX&s`IRA(5-v@-9S^aZ2D%l$5LD7?DR@JnEu{i=HkF z7p9BvTzv1sa(SZpF@C)uO_Os4`Gdo61zydYI(x7 zN&AU1Y@*DcsF19S$6P$?;yD+OyLiIIQ!bu%ab%+8nIuoLy_3Y9ByUZUpC<`t`_H&& zFiALv?>{R zc*Dh#$?}eiH(k8t;D&BZk!?? zx%k+{=d8=cLsR4vvYjHIQtTRqVR~LV~_(wPAHy3}n_|wJju3DgNm?9UZ z2z6C*s{G~tZ|%(WT}2nEscN-b*~ODnr4j`u!BnZD1!yu=dQFw;E^4@_>!O~EnnVUj zZ5MT1)MAqdsNI;^Q)Tm11sMrXO_lo8Jk2^*8oR1f7n-JGenS_Hw9DNyP5B`Y8oX)J z%tdn-?Oe2X(Siz}Cao!(iWSPCV-?&aIxRT0T+E-^mQ@Y#T*y?T=aJ_ z#>H3{16&MrG1SE{7lT}!t|vpZTMpJZU%8n;{Y;uB)EgJk!(EJUF_Kj@mr*W8YlQY9 z8GVxUYo^IK7vo(_aWU1!1Q!!sOmZ<)74f0IS~5O)p~ZCiy1CvvL8+7 zbvtFaucxcMN>20YPnTIP2)U~~*Tp;+>s+jNF`u?`vBJel7Yki1qBpu&>Z03pS?uD_ zbhQUEZn~_Rt}5b!eVL2p*SiB-#KcuDR=ZfMt1C1^9-JZB8M1~kaE4mEzcWL5(FT{7 z39-Y)P8XY8Y^K+_*y>^nd(ALa1-+Mk#odW*^vM~@;kRp~)eIRqL)OlaT?`;D_PE&V z;^+*?J5y3K<(ZlC$xO9vvQKN93jBMf9HiKcs~(DYILt23$n4@OOSw4a;;f5vE{?l6 zLDRT6Z!Ywk%3($PFUm zmuIP_F{_M+n>^g?sog627-b;Bh6l6dwb^o;hub~e;o(jX_jsVg+~wi>*}N}}`Lm_v zY#BIP1*@&I<=kww0aez+{S?MWaUTzOc+f+C4+A`u^HAQyHy*zA_#bjed3e^ta~>Y@ z@UVx-L+s%Z507$I@4;uKHO25?da&4{IZ}R(*dCskBaVj;=BTqXE-PFQf6h?{WQ5J; zNZ=v#)Uop5Icil%gbT*Bhm40OJv`+h@sRcKIQe*Z%)^X1YDslsj%=JG#BZFdUS+O4 zH&>qa@QjCMI)x`hpUhQfwH4>e^B!LC@RoAOYiRR0j^Ci!G zxpTg%h}^!T?L5@?(183s{OF;ohiWY1;b#wjdHCDIFCKpN@SBIJs?cz)h4RQkRkoFf)*jk;czU6H$HcaZXYGa3VWG75(7{6w z4?R6}^w7ye7Y|)^)jX(W+0N{twPg50>E@w3d($F$V3EvSD4Q3`nT2ZE-pj+wi=?lI zeja*z=tCnek{XMo?IIbmNO4%ONVrk3W04H>Fo?a(?(A3lpm^R^Bz7xB5UbLx_Ggrvcbbf4_m08r6NoDp$9gz7c7-0mMY0BEtOVFg<1bn zcqZ1C?X)$Ed${0Xr-xm1b={WT9`<-R;NhT$y&m?_lb0!m8W+;Y`t$?fzqDX?5J%jK+x zb9Bh%^6_%1xLn3Bm*valKMxlf(tYIiafyL$sa&O>`?&1k3Z+`Etj1Q*KskKm^zrZt z)uOA*rOXO-WrZ-0kGwt#`Y7as_e}Ency@&p@R8qFmLfgH_+*7tS|Npf6!B5i2USEG z@}!~&$-mVKDdD3evwT$cQOZYYAJ6-E!N(1}{Nv+MABK-IK5p`HKLfR|mK8VqxYNg7 zK5p@GtB>1!-0rK%{2e-%S46l1;+%&oCMMqP;~pRP`nb=>z!k#Nx0x$s+X}g`LM^e& z`ryvV=WW#5>?qBvsv3wdHYNEzj>?rJBZvr&rvnO|Oz?sC*yKQF|lRH4<`ubCrUW zSwSB!`S{YuS3X|$@rsWR$;Zd5J}UTli^BML&Bsrxre(d8DAD_`KHRV$ut5!*l)pGl4 z*|$m!VW0c>LT6pONs?t&P5GJv`1sk!H$J}g@tu$FX;V%1gNDE8;-q|MwJ@d8YWc;- zuR7~*4S)0ThmSw0^VRaZPT|dsahmyG`gMuM|Is-4RP?c9wHhm{_^9e*63yhJnvd!} zy7}ntqlS-~K3e!_>7$m9+CCbxUR}J7k9t1p^NQMPsY|sll)`J&0MUSr<$|}S@M0BP z*VtDBO%oqYeUx3JXqwSO)<|<-U7O(r1B&tX8u?|7wDQr~M|&R~e6;b=)<-)Z3)iS_ z(qN6!?J$jRT_YWRbYhQKD_wlGW7%2D!?Ewe8pW-vueL5ZmOZ>ydQcTUhWZ#r?_Dds zd<;QHKANmmDT945mk6IB6i*LT!+nhKG0w+$ zt?iLMM*A2;e65UPx-PhQt-3Kb|dfLXk{K(VLznCfGrk4-+N z`IzowsgGqoX84%tV*&NxW0sHEKIZzE=OfQLxnrHoVgFhueCU~kFRl}AZqL^``F@=& z^0C;*5^`H74c93*7`RSNR#_?M8_RvH@YUeEmJTyVR?=!dR%?GI!P<3lah=lq8iuCz z!dcupAM4qJ+R6qtnbCEu+cA5{WW4S)bS0%QUt0dfY&72v)AWdr06kSD;60m=l( z8}O%xP&7cX0QmzH2v8_M;Q(Vd2ydw^-XH}vTV8wPZVWeFi4+M`3_rF(iU%kWpmcy6 z0+b~GhEhrsb5A(;Mn%bmEgx>Iam$6W-4x*F0JjIYBfu>IZVhl-0B*#wA{HSfH*d-0 z){Sy!z`saPXN&g)xLYGU?&m8h$@X5ILVDu&2kP+g;Q)^Wcp$)o0m=n%Hi`sD1>nwA zc}+m%g^g;T^CA7pApGq{c{G3#APNu%FauZt`~U$@)<3h+XJ z7Xv&U;F$o=1$aJCi!v_U)@_t$0}ygqbaJDV*`%J#Cbe98DZtB=xwm}2Nh<57)h4MB z;I#m62Y4sI>jB;f@MeIw0=1$Xxk*-TQU}fZH_2u4*(}axwG!v+y8+%K*=G59vv9NJ z{Q&hgORvrHQGkyF{1D(rHb20p0lp0IRe;X|kkuCfW^7ihJ`X_1y|2xiGLfumMX^TqvDZtMG{toaD4H4kiKy73#-y**S_&va% z0sac`M}WFpr0*8B9_MPBIM@EHi?5TmNW}n@zfyq80oXulj28g*Zjl`S%1!@DwE)!v z^b62GKn+?gK+6EF0@MmrhpHE#et_Bm>I8W7U)B3w`B&;v5{)zn&@ezVw)9_VL`T(^ zgqsFv9N?ROl>;}??%m*D>He>b|5us^IQ*})2vBgV+`3hr61EP|CP3!^T>`WX&@SLV zaiGptX-}WrDjfoJq`%EqLF|RCDsq0YRhu zV(%C(!vYKsFhb+ywn=uInvD~_vrR?^7!#-&{#f1Qirb{kHq~(6z#OtoCIpzXO(q4H z9AF|1w@uFK+~V8C*e=g)SCrENOb@Uqz+$>efSCd22UrkbR)E<7<^}kEyUfvWu7-T& zY_|4xHSZEDaDgm*tF0-0I=)tp#{^hdi@GsM{5^ z7yHp-b@_9ZCi`xOz6cs%E&EY`^^8{mE(X}ZXhV|)I1*q}fXxB+1lSv33)>Q4dw?D6 zg8`cCQ0CZ1jqQ*XJJkA)uN;zgl0!4uO|jR>E)7rZP)6q~SDpI;90+ibA#SJaXMf)* zyf^;tPBno)L_gmtd^kEBWpD^^CcxPM$8}#m5#VHiMmweZPT@sXF8WThqyDuT_O5}=o{kh5ch=mi~@(aH^hA*o(%C+h_WH>4-te2Lp%`T!4Qvx zcr--05GQs?`4B=Tz0_V-ibyMYD8$2|+MD7Q8TU2|>{g*eU6Ki5hOk38A*R(+iB_mK zE$`l~F1ouRyxoe4PYv`GPs0kkRV<<(zQ%78LL{Mz6>*4kh;Mf*3vxb_(TN=5vmqV} z!KvfplyIRup>fjl;ZDNSA)X2GMu;~q=#6>Z?0AEY*k+(v;9pc>(@3D=0zMu?gra_m#zS=_u&s)yjh@aeWvD^#~uI8qz?l<#r!P&Y)q z5bZ;B2vI*ogAmO^{s|EphG-O`Nr5dA~!3b8xHfDi*i zEDo_G#Gnv^Lre)VHN=n*Lqm)SF*d}o5W_=^qGI&~egw0O4h2Vndzx^_S{q%q&2ma?IpB#|MAu1hE1zR1EX(6Ul10m+HNNbr9 zVy5m00}luz51ne3e&tkrZismy7KT_9V%7om-2rpwhgd*09*|21gs{XxzJA!Qto*@n%RQJQ#|1vqm+z|Uiu=WEQ5;>?lCXpk$;at-GuIKhgSx~RDSo}CcmgaL(L#D9F zXF{B1Y>AMKa4y7oM$`y5NBr9?{Krljp+JO-ocz;L5pqSi9IEROS3+D3@#!ITt%7Ib zwfIxi5pqQ6bx0;1l2wOPB10}CSnddUB6YTyH$t()k}m@NbN?ZE=rDh7P6|dS6rp&; z->pUA2wxwTq7is1Q6xg$!_xJzIy5g9fgk2fJgh#?DH)+ugwhdih*Yp$byyA^mb^#g z#t7v3&Jn42L>@XKWg5$=s}M}#{g^gSYXMQVcG{D`^( zOyurJUCQOr`Q#&VUxcy|crIKn!u=5*i1>G4IC4Y@zm|~G-9xIo5tff25%M2Z3kN>z zFAqm}B!V5m(QSV;f*HYzVCYvCp+b1r9rjflO68A=8^MeC!_g9JdHe`LgfIewz~e_H ziq!SF%15R5Q6cjAQAtP0M3{0^@mX_J$?#Z&$0Ppp6h39!BRm=5)d&?LJQd;T2ror= znZh5HXCgco;d!p?c(o={w;FikrNA-%)eByv4;)jUmfU+x-aRH&kE#3Tl#mw@Uy0D} znDCV3wFs|AcqhWU5#G>DsI)gV!a(s>gtxV*Lysv3ps3W(dl5d2@R6o@Kf=;u@`1)# z#qMKjZ|Y;Mb1If`@3RP>NBBL$9}&KY@MVM_BK#QPEBZ!+?;^EWqvQ;XybSP71j27M z4C>p^drGf5q>7y2;Gm%FLagT@+;MHTxF5N*T<#$ahY~p-OK$m!e0?8MW`I9 zJN$oZ+5XY)#3odXuu+#HtU~{9C{@|^W6CZ0F&$6Gs%e7~sTrYGgxWFc#HbyiPK0W) zS}E6!P>;S5qd<)M5gJ68#V!z`VT48zdPnFJp>c#J5jsTZ7@=u|W)WJ^^bwjzXu;lb zLRq1u7L2=g=Z~v1U*3q|Sks1fiNM=CZRu$z)Zy<7C!~FZUr(r(@^&IW4D1x43!4_9 zGp*A^>YtFIC!`xSL%p%XYJcO-WRD0dPNF;( zN0<@e>`A%tl+0wWIVF5vKP7V_%#E-k!p;cuBFvAlI>MR=3nDCx)D`p<5f(*QOdYn8 zW%L1#!tCii)OvQQeq{=?meUDOsf8g|rYj??qLoicr&DUB%o`4CBdm+CCBnayHo}Go zn<8wc+pwjYX74Grx?FZjb)WpFRfoOvv}}#kRn=_~wnyp!{jt+3`0!9zU70v7yQp49 z;|S*??1`{9!eMsa2>a-k42BVZ`VW7fmX@bwAPdfvnWyDY1m2uKby_x^RcT689B?aa7HzX&p&760?icRY6Qf%7~vB6 zFp{5@4rgTA8QFJ6t+KD^vbUcV=dAD)K1YmPF>=Sq8LLSwr!>@Fo>&F3yfN~{s-pMK zs*_*NRjQs<7yApwC=}z#7*EA09HU5#2V<0rQ8Y%e7`Ml`BS!HUC1R9`aZ`-WXQgC} z(lKs`QHqqy)!51rlcVS8vvOmsW~X6u;YWGP&dSX(Zi$iOoa{d<9IS7Raa*iD;^RV? zE6Ur>$(=Foig8bjdt){Gy*oyQbL!}U2N2#lxi3c97@Xxk5Q8TX-<*^CHNt5C510tK z@+u!gVt6t97^xT!#V}%+i~#54;TVsy_%eAUMyGQ!>YNZRKc_^sV%Sv3dHy!664;5= z)Z*AVbv!&C|%l7k1)Td)S6XVMmU&VMf#&a=Vi}8Al=VLVx@YLYt7%#+lF;*AG zUW&o1U%Uax{VU$yd?m)KvD*Hspow{1?ZSB}aY5dQ@n(#VSYwR0V!R#Wy%_JuD&)SS zDc@zpJ0X1Kr&2TZmq#DO_>fk+pt?Lm89Q%sK|YE315NlW#^+>pf!~-*#|!G_*cUN| zUyvOa!7uVZ`@~TnXwDM&B5X=_jl`Mw?hIbt!Gr7|midr%`rEi&(9^t{s9@xF{{@gt|p^ zLcX?*(T@EhMwb|WUX=DRcz)4A6L5{(k-kSh7uDG@w|AJ;HAc4>y|q(y*RUtYrsdK@ z<8&47HgE%>7bP65Bw@Vb=0m?2{bP)ZF*?S87z1MrjWI07pcwrw%HSA7ba8I!@Ur^! zi?Z>eoVchyEgv3ZM2wMI9`3Fe=bwlSkq0iRqlz&s!nRye{fKkLadf9kGM+wvNxlAj zNo@j5iZPkZkFhq!lo(TE%#ATG#tpPQv6D10HpbW*V_S?(F*dU=)K#64|DLjiosNH*GerK? zWr?#mVcE-)zAW2g5WaU=e!nccV(f{rH^y$Q*d~`%+}Nk_0~+#H|NdC5^eGax+V`>? zig7r`kr+o~oQrXuy*S447$;(!jMZ0f9Ac(kR$u3__nnGyS|_f$EQc@483u=;>Pr0C zSbcTQ3GfAq&DeNFt}y;nuvO|Cic2iTk55;rj}0#~&RaXzE=FsG_K{|qiMQoZuh2fpMEW?;R71ppT@N+9@MYoQ%)n~lS<>EG$_f7 zX*`_9BWYyQcr1-a(=gKT((uzTHL;zBlZJJ@ASEFmHw`}IbL}-qBTOSsBdy6OUZjz0 zHIkA@Mnlpk8o8!~$J2N^jc3w$B8?~0cuHrnE^;OTiJ#R?crK0Sb&cfwf~Fx)=JL75 z=cP2J(!N*Z)if%k@l_gMr}0`EuWRBD(|AK86yu#V-n@>#rIEKaB*S;FrEB=UhRd$V z2Wb$pqL0$}SSNm>;pb_5s*%q$Bxknk3yptyJ%y(KCXH{?_&JSVbfdo0@J9--5nAU5 zP0T8O(ka(!{56f=(x{w9l{9|WX8Jpgf719vDT&c@F5xbGrdt7jnmkY#=mJa zNuy~RKpMKg&PO!sX z<@Yhb8`!_v5>x{+y&N@GkKW3^zTubbwYTaphE8jf&68WYo4 zlg8RKCZ#bsjYVlJPGbrkGL6}3%+d8uOJjPPfBmeAu#Gb{Lb3TeOG8RXADf%TJpH;* zmzuBf1seZA<19SK_Lunk=2#Xx~e|+P(PCS*yiR-y1HA2&zzHUUC`&=658KpDGpTUJR z{$ohbD1Bbkl3z~aN*b50w}QsHng%lei&{A}CG~G!6+To^t_*VP#5@`0Jb5$9Tj&FX z)O>*q3TAL)24ylRltJMPN@Vyy-6)bl(F}^|BDY=ddh{+bES^yvhccJSpfpQel^b-* zHE(1VQ)v2|GPpT|TQayc17K(j)UQu!f#1}SOzzF#z6|DP zupoo78Qh4Ij$jL5-BlpnL|B!S7e4?^T&_RZ<$~YvZf(u%>w=gQZvH zQ4NV~y(*SYucD!yfkPc;;AQY(1|MbMXAorYTn5i)5M~f%@K^?qvn^MJ0>l}lGsx(& zNe0;r@*>4_J|wtB<4@>ZraYa&lh^U5G{Rr1X8JQ3JWHNPkq?W%kim-?yp_S*8N8Ii z%Ne|;(_hg=DqOGP)ePRaUe}jMy{^;W(6BmEZ(c{<$)KYqdsi19h7?=$*AKLQ zC0~sA2KBTD}%qU*K)0jikfF74J&7` z6DihPHG^s_n?a2X24^rNgPIxC%Af<=oSWL&gO(Z8&7fWeO?1`uHRr}!fCd>f z)US;+q#>@^lrj)$dR>NQ8fmWK1*BSCPj8<=Yb{b64clr+!P>D~!t3S=}Q!l)WZqFi97jnZe`? zrfB{YfLT*D@pLWZG>y~rGqiJ(fG#>qXU*1GOqru!=VmaET`7m6Wa7dM7O`CnN}6o3 zhD$PdJxA)R9I1bDq?+bPEze*@23K{~$_!Rza7E**GgyOYO-&Z!)Lk&VJ%)+r=r=VEhi%$Y)h90_uA z@}Ho1f)WXGC&-f^UxNIJ@@>{d`n<{iYAlc_D-=plSR(}!kPlOeXr!1xVago| z?o4o3g1Zy+OVB^TJqhkj@J@nv6Wo{Jt(+-8L6D$qg8LIZkl=@$sZ@f85roBO1cpWy@N$AUK{~->2_C0Db*Zd|37e2hF=Qz>SL(%FsV5RVsk2_x@F@+SP4KjC(K8yd zX)N+wg6FRne<8tVxl(+X&gY+8saF!bN@88SLW0*c^16o2G#RUVL%)*#O^x))m3sSn z%8Xp8_Y%CHpm~D#@}xdU@L_@<6a185U9Qwe2|iEoMS_nLe3IbP1V>prwVgYaCwJ-| z{Sf~$!B=ER#pX`EnmhG14VvJ)1m93Lo$^iYRNdUE?=?@-vmlvYOZhp$FA1tAsFC2; z1ivMyn4nUE-xG|=a)G)&MaLG1)}64XmjpIw0BX-Y~RKddnV?mI)(JW#=uFk+NwrDPHbJ`tH8r31x}uH=I%qksL6VUn z8`vd5SIUz&)i*)MJgII8dM4`BD|~sj8XvZ9WBSYq%)E;soTzELPDYUuubld|jr? zl9Kq!1gq$xjBoiXLQ1CWPOvAzemYo!y)2?R?Bi>`6gd-; z_+WxV2@dP3FXT_%SRnOa0hRSkfz%OA$&_OnIiBD|f|DAj7^LBIO22+wAay3e*#zej zoKJ8i!PNv8*jWmsE+-gUAVuWA1Q&G*@k?|$ow%Yv>R^(=B^Q7nt%S>((jR~7}c zD3nF+Eb?TLKZ^ocLl0`O)R2C0q;b!4w@o*N8WMQ$2EFR6m$l}XFsal0nxeKLCrWZ;* zUnq4;p%j^SER-5sDCK0aqEPBUp%kH?MUX{0i%b?_7FP?UVpdl;RiBmJ<&t*}mNb314UdWs^qC!H1$>%V~eKV)+vjNs*2vr;{7Z>&f=3SKFH$3EN&>4 zdZd`j+F3Mpp=j!(EC|`C$BU)jEvDe7S^TMyFQ~LE8f4Khi?6cyn(0~mmBlw%e4E8j zS^S*EcUgR&1(o?j7A-Z~p~X`3ilu(kY?)5xgui6*TNb}(@oN?obz3o&c&=FL54v1& zh4W!^{?6i`ENWy?GmDDU4~es=mPO?(s%TGO+53y99@o#u#ZwiFt5#PhvBqhUT3OW2 zqP`Z1s;iSly)5PxPt~P(#Z!ZdrwIAFy|~iAx#FotSv1a~LlzygXp%+KELzhXSv1R{ zc@`~LDhtXZ{u7I@8nBGt<-4BfIZiyi|sl%Ru97sxQx%;e|51ScY5b>khKD&(#;= zSIWRHyvji|&9*-7OMq-_Ivy$nMPc&iL=m*I;td|8Hf%J6O(J}SeJzYHIg z;X~s*;~QuTuWBF{G?3dG=w>|AKt3tMr)Bu844)G;kZle0V6pZp4W(T}8P-t7HI%Oy ze9G`c8GbbG@l6@NEyH)F!Ib=-&e>3x;%s8_tcG$!L;0x;zn0-Q8l<88Z0Ij+VMAf^ z_cH8hs3oP55Y%ZTTg&i=(Y(Hq?t8J3p1d;~$@VhrD8tS&{K?p5p{s>mGUKp@N0OEmX2_1aV{Cmx>lzHr8cnsJ@M*vV|%ZXgcDgvCL|$%~;*S@r|XXg<2MB zSh&2gZaL*^TX?jw9Nt7)G?6+M-f1j+wltRd78+P+Wudi&h87xGXl|i}g~k?|SbCtF zS)c*?G?Av3b_^PU+Gv)niL|sZw~6p!lSq$iB5f?RWwf`@(Ly^57dMe_n@D>LcQlcg zn#i6e(x9pCFV%Lk(Ah%IrV=-mxlQHxrc$t=EDX0W!h%@nW}&}@0T#Mj=wYFkh29n} zX)5KIGMq6#gfX$zekZ(#!4V8gL7(ZVDPA6odx!ek3mXa|mkg{c;%Sy*e~NDI>~%wQia zEU_@t!YmGrg?Thu3rSnZYzuQNy;jl)q--$jns4c7ztGa_@&eN;f<+dVwa~ewONlKk zx3I#(87<_77JBGu+m)uNkGGK37FL*1YDp`vT!mD%el}}CmA`Lx0F6D zC2c9Evtbs_vv9tJO%~3yaE^s@>9H2hHhz0qOYN3ii|4kKV_Ceq+}BdxZm9?H0t*+? z=Ud4|Y(Ne9rKKEbsTa+Q>3glD*h-J!Wo(s&$Jj3mS6H~x!fh6Aw{Vq(t1aAU;U){$ zaOjOCucO&p30Lint#r$;H|~99E4hIMTgd~h2{No%RnMkil1 z#(Bw%RGT(3xQ*U-jcOyWvN7~$MiL9JTX=)Ps-C=MVQCvVyN&Mto5rzeaISr%@6udt zH-D{-7Zyj65cIMVIoEzHdwXdO#Moil1W}~r7r^T}@L9Hk1v!z21bAIjy~LZqlmVZS=4)$i`rsKaz-Ew1bVlwhrURw3kcT zOK+RM&8j8)*?6P93}9|!Jxu*=9oZO3=vo5}{;s_Yu`$%fa2q3R9dC!(dPUyf{(mMa zv%w859mX<%cB|h(9~N92o{dLsJZ7V4!?$sqjpJBwex(DQmm2N`c;f{n>GrZE27`VcY6 z1|t}~dVL4EqJuC-O|>!2#tbte4|b60wqBq)o2Z{j9z$l*ARTmaj*YoCR@+!(W1fxq z93UG@Z2a6oxFcO)W1)=$9b}P>`Wpt)ACo7H6%d(=_5cCWO- zjUw0Ipreqp*2a-Gj$u1(tYeQl%F#B~8*r4N91AXR8#?O2V)4s53j4Le#se&F;_V4G zHrlw%#^p9nv~iM+vuvDg<76ABn5xgPaVp2RmYi0jYGx>g}$91EPo6Nx7V(Y`j%?3{} zI!Wmj+~VGD;|^+|8=HpRY2$7i_t?10)(aDD#S_ZC2CwX-cjo0o{D6%IZ9Hs)K73Xu zy=QpH#?76C57)9ssI!hd)k%-e<2IhKvDwBJ8&BGJ%ErewKC$t%jc3>@8?V~NSsSfYXRVWz)_%>#>o(r8@h&}$Q_03#rk!jy zx2$Xu!P|#813SxmHr_W5{}JVD>Q(*&8y}i^F`={W>6*@ZbHai6lufenosI8pd~V~+ z&hnLwujvwXYJU1Yb7KRKbg z$SxayF{`$m-9>KhA`f)YXJKx4H+PXLUF9Dedu{Avz&AGJ*_MZwe~k~c?<#}3%IL1L zq^lgT!I3?!tH8lw4r)56<)DIt!yQy{P}M<22iJ9#N)C>2Ku6`ez^y(57f%h99X#4q zW3D6B98`Bu!@>Jqh2fEY$U6;&02cCnaN_+<&7ooGWsx$crLhiHvhFo?URTTcln$DRh&G z4kkI6%*J$+CEa9-gQ*Vcb(iklb@5ZX$utMIc9Yk-$)0X9)4?nUN3r7$W;>YUV3~vE z4(2+T=U|b8#SZ2>Sm0ox!=L|_xVy~lE*rbc)!pTb?y|qTH0&Y0ddL!1*F*R$W!WCO z{VN=-bg}23PAToqNhUnzyIS=_%_S9OLk3v*c6< z$2!>H;6w)}Is5@fInDt)b%KNAjX`eiDbMwkjU1_-QmL1acIqW3J75D&arm2SGN+fE z*h{zPGzX_sgDL)AFWKbq2f4I;&UE-IUBYKeFFD7-xeo4k@PLE!9GuTFqVqVoz`=zM zu5fUrspujHm(Y!SOQqg&v8jvTQU{kgAYj)9_Lj>Hp4MBgVnD9l4!e*GJYFe21xhKp(lP zkKFC>ztGFQ4(@UII|A}vAFcmB2lOKHEB2KK9X#aVO$TpLfZccSf`bK_~Ie3G1?k5}i$?L4KpLV1x4c*;O$bZ|xI}Sc~@P&hSDe2%t z2OlvynGVun2KLv3^?}2GIH|$M4nA@4sd0N6oIWtNzpU#opEEI6szc~2S;XjO$EyVrh zHwV8v*zBO%0O>S9*bBN)*#KEIKyDf!uME)jeltL}Irw*gYWRobEkP4>7HJ?Lc{Qpd4^;&;eW==JJ1W z$gY9%pYeb4nWP0OxH#NJ%|RM7_;eYh=@Bj}yJ+L0t&1uys=BD-qOOZ-E~-=5MJ-p) z0?xh~WcHMFkkA9!jM^^$h+dENfq-Geo+%=X?_ z$zV3g#UN6pElJK$mwx~yXAhD4 zh6n)z=?E7L!euTj7cULbdTbXz4$*VdF$K%L*>b#GREcaG|9IHbD9&6cQL`m z0v8KiOms2H#cUUITugQ`#l>_NGh7@PDpOs4lq=I*FlaML+;5o7G_|tVmdy zI$V~!Sm9!&%b)p{RRqIj%y1n#2x!<%!)2|@e`P7_TpUR-Ts|8vq&tVpQFP7`I+7gY z;#e2+JuL9B!NqYdYIvyW;dmD(xOmOQ>$HrE6J6Zy;tm%l(P>>=;Nn6Tr?@!P#aZly zi>@Q&G#974ID?}zLb4G;&L$UUnk?cOhO@@db6lKf_$Q2zb6x!Mdw~MP=Nl%I7rD6D z#WgOjb#aM{OAY@@7nixX+{G0xD0#sMq2%p`5E0HkGr^=HgxfTiw9lYOPytM zzY9M1(Y?!LWSNjIDATQa$i>6-G|HFB(Pi?8%QqAnFzd`Rd7(@`GIc%S;#n8Zxx5CK zCru-ta`Ci_XI$(v0<|sOr1q9P&spH&Wh3(fC$c3k8r*7-vpBd&? zhJJ47m-IseE;FTAq#S&0nB`gDx%kP&&n~{_5tBXHe>~^uoNN#hn!^KX6w=*ml@TZ}FndDQJ>~eXlrY*yVYX5fekBfsw zX0MBXIYSL*1NPCkjU+vgfX@Mw^{yq<{GY)D6+9g7p^As99x8g;K71+}@S`P17*N^6 zKP+YOqDkmi9GYsLcBkqdnB?f!w567Z+8$C5nTI+a>U!wqp|^*69_o8&>!F>81|AxE zXhm#GBM*%|H1~Mw7bcr{XzHPv$LkkKY~DF&CIOXGpoI}@X$msQr?rPR9#8Qali%J$ z2M;|wo^Yk3hfW>}9+Zd9rbrj|!T@T!#As$g>gOXKx|=NGZl-uS|0!E~nj{r|YD*sv zeLdJ791s0G^!G5t!%zg@DC7DHq!;DOshvBBK5r-PX zEDBh(n4^K~!Sis9Be91fd*n#qA!IF%_$E2hk;vmtTkG892*FV-=;2<6n>Rh7at|dB z6Fp4wFw)}=Ow=0?eiU$)=GrJWMfz zLe5kV(+=5cx&akkndxDc!LvQgGhmK~xgJ4e#{4_&P_Hc>;tm0Gys9~L}NAq+K zXL#5|YLey6INQTH9xn56xrcL&`~@B^G~hf>YdGIy^wz~MI;8Cq11>gt$~9kVI8^(9 zD_3~9$|SEev|Qk7I>sSpd8@AXaD#^zILaPw^l+1h2RuB;DQU#+GV~S?w;FJpp?4U1 zyT_oa+r#Hhn%#iAJ={Y_G6Lk^XFz%2y5C?HdC0@V9-i>)~zMnLC*>z4E^2;e8|dp@$DV4Dw{H$5|<P9s8U4LA`UO2Vi89aX%MMoX#b*?XR=*UDi^^dF=@3TsuxkSsM}Vf z_`e1HYBMFdxRc4XfCcLq0q#I(B5o4u7tx@I0lX?HqG1t@iYOGJifCL!lOkFb(YlDH zMKmkwsok;&4iG_elWbuqlbjmmeQ8rf+afv@(Yc6rCbxs3?G2@=%U!x-5wYn7waqNb z+M;x!fRUj#CZ&jOMf577cM;u-=ut$^A|5EprlMR`lyX2O0p#45rrVt5fFShlGBp{$54Ml-2X)IqqeFRlRx zi_*cDe!locuqCWLDk3N%@+CBMvMqydy%>dR-4q*IbQW2AjsOF=(k10h=E#ieDUMyl-5z~vfxQI)Nm{FuXabywe zikMZz>>?HwvABo}e3?_k0t1NW8ZfVj`3BtN3z>Wtn&czCEHPk35i1Q?YUnaUmmB)J zFRKh#W9Vu_%ZpRbT9f?Jm!pa}x`>TMoLIzq!({GpMI3VoA6vwRLwKt%#}~oIoM7ld zU)Yk9ia5E5GmAK@h*OF<)d-(n#A%00)edxZEOo{q&ZZ)$ie=9(;+!JRC*Ne9Tf}(= zFqh3}8wkOLhEr|_GA}BE1C6>)bF_iGQw#6a%h zv2(>B(~=G|wy%(}{x2X6)VC(dvHsqGA9Qfg{!a}*8}NG(n+^D-h+hq0?r#QgD7Vmgiuk*Te~S2{ zh;4???rbk&M-jVCa_6B^yNdYp5PsY=>8~RGUrY8BQO>0Py+!<21bqC<$Xvw!A`TS6 z3BoKs2N_on>7l~Id{ppJ+1JhHbGQLV_^9ZklEJKkrYO%XH)$2auWBecHGI_c@s*FS zebn+%+s8;BqkPoyQP)RLAH96M9Y{SNO?))#>jdZk+F+Q&Maf6Ss zKF0Yt*2e}P<9$r`d?3}D%jsD@ z&h~MR56Y0q=Uii=^GpX>FReti7y7u!$CVrr9~b+$gd>~E<@Enlt7WN6O{vRhqEr{T z!U(W9#n}FdR=s~Co7y1|?&)c=^Ng{FAY$5TF@_3@ms!_z*V@o`qB`?A`|v)9klZH&>#qy=uv zTa$p@xY9~w*z><+7A*^e0~Gi`rrU>82~@wrh;fiHZ9P1Mh&d#*i!z59m6eXIzu zGQf8}zW321K+ga_`1p}AGeD&PKl%9C$4(!A`uN4iuRb>W*y7_i6Jh*ZemDAA7duWz z-D(_cn~&{2{y5Y@X6-1S(TQ#H)Uo+J;q2+E;4@+#aA#pxv7fYbUL1lJx@AH=sd)h5;HG z-1LxSV*{EP%E{a8|4X*y$NvFZ2WZ2mq+3g~P^N8wAthN}l6C>cl%yQfH#!Djbn4-w zOMp%RPA=)@bq@4OM9?)rA%F@X0lEd~Zo0!P`Z<+cRnmRuLr$*%y{S3C*Z_S3^bKGI zumki9&_BRn)*fI$0Q&8~0D}xDAK8aX+N!LJ$)Uzd!zt-wn8EbD5dq2qJ@+Z_UP*S8 z#0lUAhyx@6yg-L6KR^(mNVA)$QhB6=rg&r;+-~Im>@aMkqye%3d4Q4`KI)t@@_)lR z($q3Kz}k^A%1~OSe7cPbFh0Pn0J8&32)O;j&nz`6jZ1UNOoQ2~w)a9n`n1FR2l zOn?mm8jO--4JGJ4O1L5ukotz6K(&#a6kub3nWN-HL&+f~J=x?QGfGYiaC(5V1DwNp zN68rhHU&7-;5$djSpmo)U=|-PXD^PDa|2vpic{5j0nRs?%hi5klwTa+k^nacxFx`) z0WJ%0b%1LE{4+`}4{)VvJn0l(k(eU0qzcPyHRrFXu0DMxRYiat-DOh=bixf1-RcZ?>&_DfYC;yop1DW z$MP^kM}W8Vgu2D6Xkyb_>%$X*NZy5YQGD7*7!fYC;h^qm0j2KbC-86)qR zHh&o4qX6#*_<%lX#HfurKMwE--DZsLGOhQi=_vspay}361v@oHJ{Y4d^JRdq7~)KE z3Vh4p&zL_JKaR!s1RRSJZYtqN27mT9!3zm~4)6<$MA#bP*8sl-cqzooA$||AnbRS} zq7YjGY-Rij(LKZ;0k$#NhNu!^dw?AQ_5}EwHteHz25@StzXJS8o?gJ%kA zHwU+odZ?!QC%~k3>Og>l0rm#?H^4r2bAfuRz1kn(!#3(SS6z0PBImyV2yu9biXs0q zj5;htg%BUjRG028tPV9Lt`zDbM}%N;GAoW17Qg;zRW(Gl5Dh~#3Q;{ojS%m&QguVr z46!j&wL@HXgsNpIL5s1%+&U(!ufg>~)DO`h#IyZXv%czq-wO|9s&R-WA=-s#AEIf< z;{aNPXdNQiQ)nKdMTnLmhWuT)qne7wO5Rr8v|D55{<^o&CPdp1GsX&;6*p^shY%e@ zbPZ7m(J4gdkbg9-x`bfX^Ys+*x??qj#C?Ve^sVnCx;-kk(j}SdWgdw63y+ZU3 zF*L-m5Pd?NH&*(G7!aaw2sXYSP1iuJE~qDltFvpXfgwl-hj?wi8WiH=KMMpy4DE6<)lvPp9v}m zL3&JQ71Kl^riGXuA`Ov+7$0Inh&)6o#F!9cLyY7Qv+-qWbcn}x6fSP7cI+q&*;zPa zq^hLUxDXHhQ{c0GtcKY@F1nrYJLaoRH2Bu^`0yas1Ocb>28x9AZg`%R^id zVrhtFAx;T#YKY|_R?x_M3mZeM46!Q2(JU3>`Q7wStPOFb!D~WvYpE_gPLaRPaE=P` zert94!9sqp@cn#sOo(Gc9M4+*E>LEJkw4BzQihT&enJRJGPgk|b)u>CB#vyRP7cwd zfuawy8K;FfJ;Wu(Th0h^`#9MY;<<5>)l|f1hBzz4XSLPYhIz5U=NNh}9mat34ZXln zN?sV^qCb$y5%=pMDyH6eD6 z<5?Kj8Bk@sF!x3ps-C(f#I43rZwhfU?fGAU%G)kix3T4>gLknCY{jhPW@p{ge#xWQeCiJjl@x@hBaM;p?Bm!y)>Qmq+Mq%~b30GJ3o$9xu17 zRgbf&mDCdtEtr!FS>ldrk6RBlG738FGxO)k|kpohU4IAjE$m5aEGl z>LBCoL}Bh>5h_GDJkoml_E#_VRg_${vp}5$M?|O`p=zX!StSB(ML?sG4w)#V#0-(iO`Mxaul;V?$!b`4iqT4 zWVz}Yp;v@H5&A~Flu(Nns@@T*by3$(^e}G+fh9>QRdH8lLu_{IQdZJ_z@(7#SsXY_rwYKW^orRi{WMqVG zJr#31Op-AX#zvSBVIob+CQXv@5k|IF<0#fz-MOW(v9+2MVRD2i5gu%F2jtF-~m>FSKgp)ZC5oSl26Jbq+wGrkw!j?;;jO zSP)@hgfAuulRGELqV{UeIJG#!@$*#G$+9d0m*y1_Rz_g%a*pO?Ey?1mBJKl0-0CR3 z58=Lr1&@rdF2av1)$tLIGT@j9$3{4sLl$8}NA=>?!ko;EZ*pSK6)K{lQI4!~z5w47IdW16~oFCx=nwJ)vEN4eJ zC&HN#&WdnVFSTH@Tv}b7G+EA#_|MS zxHJN$$gh+frm8g3GNk83>hg&1+SE~#6$@TvJngy&*GITI!Zjwja-a6MYa_jU(O^Zshx6nUYVdO5-? z4EWm$@BULbdx|jYbtCy^gtsW!U%e6Gn_W79FkHMH;lD0gm<5@9FT(o~exp}Rkq;t# z$k{>R2p@62vn&T9!Y6FQ_QIzTK4X}2RXj@FK1FK(Q8;URftxgDeaTXL3SZITw--L@ zqsV+^TjARX-%)LZpCWv3H2h#Fi+Aa)p0A)@oFWwaIl?d8{L?+Q7g(IyIvuHtQ{nGy zn6Ea|*`^4=?CRV^@T~xE#bdBIeyM_HbH7 zI2hq?&cw|HKL1Ae$Kbt&TAkF^4r399~7q2zxI`|F8W?8n7E`jN zXOh}yW~zoUn#5=tqfv~;F&><+E21jWW=5=e42rRA)Bk)i~%wK zjT*Ye=ozDzDc(KC%~Pd^!SAnA5BE|`_KwjfM&B6yVl+EYAg6I3bQiYFLcHF^0q#8tYLe=cCo?g{eYG7GZLDj1e5@ChD81!e{!w1v`clV|0u$ zG29p)8@8*E8d{7I#0X>fCi%RrF7#Doa2z9v@qw#$Pn9bxX?~4q(&3Ln79)>QiZL?A zC?h$qzWSq$BApWIhswvs7#CwkjF~aU$CwafN{p#7-f5sF#+VdiGP5eEj??%j#_Fi; zh00A-*)*BPJ|3=!r^gsOO|G1vmJZiR%FK!}C&rQ%YPM0bc$%>I+!$y6QD{9{ojOex z#8?>Pt{8X6SQKM%jMHMA<0E#yC30`WVY%ERV4^#*r~r#9(ydvx*?bSAP|btf2>Y zb&NGJu3oM&IgRS7bw-kl@=>vl2BS^HJFu&8OpIe=oEYOIc6MiBLyY6u@0vraB?UMi!r`o*AO|6`MkJvdKNg6j|9-N2gN_W|8Zs$r&*=#kfA!tN)oX&Wdqy zj7wsi9pjuB=f}7p#vloi!<5rqRhX{# zftSX(j6I5RO^nN9ToL2Sm~UdW7z){UNW?O z3w7sod2_vb#Uv>}&g(JWjPX{C4{ND6IBS+Gg12L=8=~G}Yp2U?xfWycYpJx6`Xa`cF|q`Cg0EtH9iw)FItjkv)UL07 zjPX;9r~WN`8{^i03*W`~K1S6U@`Iu6X9%O#&+KE2e`D;6@hjs%j2#T-9EBJIXULYA zFO{%4=I<}4@iX*3{0|1$HEJ7!Kc~YCSvgQoQtrU{oH|4PWbiiy|Bmq&gFiiRhU}qD z2I?Jtn?ZW(enCBR3W%{c)@KB2V-~mi`)U6el@c70;2^!dg+hYE68vW{lRS`CNN{+9 ziV1k6eQ|~~uC2)DdGL!FvVDeBPEaL5^#nB%R83GV!CB3<0JBJ0gn-9b(wYfsB_LqI zsxvjSZi0FV`ce6gLj42{60}XwE}(OL|-EDtlc!xmq<-ak^|AqB$>r3 zS{f#s)Y^bn3EIrmmrHF-vivHkeFCoCT@w@%bV$%K;lKV`YM!Btg#vy%OBHz0fT|_XIsCdAJ%jM=cFBrNSjMrFVip3HloSXU&u+W+}?tHdCt1 zRu^?v{SypGFpvckI0@VYgA)u%Fd{)&f}sh9CHP{d3{UXvOyP!&7cbLx6!_34R)TYv zDcjhGSv#Ak9W#X-FF`Rum>^2vCm^4>L4t|%RrOiYdq;sXaRMqy622$Zd7C`RF5JE?c}7v?1( zCY^6Illj_G)#hMfQG&$@RwP)NUp=re1a1boWvQuR-KUOV7@T{k9gc0pPb;71ZO1Jl;G3^rzJR@qiL=mc`d_}3vXt6 z&DGbBXL2GW`j+yj zmRy|R(gc?!I)+@5V8>{+U|Zqx1Xm=un%=uWZ-lN)a20Vi{??neFu{GZgjsLQlIs#& zPxB_YH^B`FZlsFvgncP6;YfIH}ZYjvox zXUqOY>TXWYw%W)PzAxb$a6Fda@dOVfcrekMu}A16v*n=#4<}eQTdrHD;*RR04(i_Z z>d^!Qi#sVYc}@L9f~OKZZJ1Beq_c%G&u|JPc#dseuO&&ZnJrYvg4~zBnBb)Z_hq<0 z!^<=slPO+K@oIwCI0Pw%rg%NU8w^J&s-}F~j<*v0$o?jHn{gn)hpaBayT*F&)1)KR zdxmx>Q(yO1wA%;l%fZ6W?bOE!K4EN6@HMU7SbfSFYQSd+KBr?$P+=2w|7`hsy!z7c zDMQXThw%3azD@95g7+FLW*uKeai2r*LxR_5>x+?}6a123cY-|$eogS3DY%24mSA&& zKN4&+oGl5q8o;`ocIx}tGHRmQZa4(z{#&4L>>jUnCipYKF2iRne=%gOP|cet=2GVG z1phFeC;TP>dlUR?eDVN?-T=Dme$I$Jg?siCcA87_gB*I3+&fziOHm;O@6{`(I6Otg z6qQmOk!r85Ge^425f*vM)few&bF}A^&!cy>6xCC7O3^t*jTALgG)~bZMXeO}zCxW8 zbyL(fn8~H9RlOATQ+;9HD8=|W(!gXjOtEZ^FiDw-TMB2)k>?w!rYT>EqIHTkDXyO* z%~P~Y(JDoY6nm;DK4d;MM?RY)w+~f2=SbTW?NYQ)(IEx-5(ma@w!Mx-c9 z5!1*itQ3ppik~7#wJ+HzoD^;fFV#-SAugskb*@}JSMHxHZ_O3nk%kChN?3a{WAELE_~pR;0K(#Wg8brdXBY>=fs) zc`4SUI3~rhDb}WVe4eaJaa4*UQ@lSRDm^*T%nmb?4O>tg|i&9*i;(RuEzFd&%b&z*=8}}A2q|Nsi+V&Bn2i(ee(OmIZ$LG%ZLi+N2xg!Nnc6X+@i(PA?H#t1wF^ea) z&*#g%Deg=0aH%w(@DwNV0vWVGMlKNYpEC~6X!e51eV!xUSW);z#-F`~`3t1gzlB#A z{OO+=CS-Vx!Jm;KLz@h5F!-m~&8eN@trTyk_%X##Y;cNqQ+%G{3o55q(En3>OfTA3 z_#nmLF6u)j9ewwE>;iePf%+uHrzt+;NG*^P7b+fw2p(RpD6_7w`ZC2=DZWkdU8;8o zU(;6&pf(DS^5*&bL!2MzUFK45;=Tfv|D58N6n~`Hmg3hGzopnhH}0=^<@kGw&75(Q zd;?ER2=&|h-Z(muEA!wH=_!rHxK)x~0 z-Uae^ihoj6$xt=J-W2~bhG&?wtFSM{{uIb?SfbG>P%#6UgSx7hkI*NzTOvh1RUMI`vQfhG9hucKRL{^bL!%5eGStjaCqvx~ zr!H4*yQo?jYG;_TR^9NYz7nsqQ0ir zw8%ha(+tNglxA$q<^s?7moF5amGS71v^}zgIR; zy)yL9&_C18*(XEaOo!!u8JNXVlA<`flM7UUX*|lYz_PvyK{-ft=A9e+o)3ro>~} zfJHJc!}LY6evwSfFe$_78P3QsnS+>NWrkH5re>IyVNr&~l*}-L3NwA#H8aC3I$MUh zCdn(!*%`l$QM}z6(O%7CXWOd@oz#3z;ZFMQi}d_OvXGwBLtlF?UZZ$Zw;rI;eG8{z>1+^i=(HYif zI3~lfG*NRE$Ewx|`UM$j)dAYE2|igQ#~FEkR&hecBPUMG&~3gtDFfTq{WwLne0D4n z)^!TK+EiL?v7E+nEYs(#P3&Wa%QIY&@qoVNEtHAv;lQ+!Inxi}_V2UgG9I17F-QFp~ajE542)el5f6oVgj^XZ+7_V4iwA!#f$?%+4ohKD@>KAj5|lK4H}vK4M^5A|G?6n{fT!NX0ubc6`lReJb}> zsn0kg0@Z4Xd`Syu*q&iWhOZfXGW^16oAGN>e3#)zR@zH_Zz#bJj5!VUs?m3eF!@u4 zpEF$0S0zhi{t_YhjWuR^5#O3&GbjG;0=IBm7*CeSRZFCvr(dA_kzpInxJ0k=d=Gf0 zr*?9%=-%54`!ejx^fl)040{ati$Qo>q3dwu6j=l6K1oa@7B zwH(!RRLOND43JU-rBWkD%^XiIl{z_Uy#?QwIkNv~L{n8T-SPf$UQZT-~f*{b7mVKUB<*3R#M~FDe~7W zmr1$)*oM#Koc~l!@e3J#W^?{>nQHWKEuNO^rJV1|XXcodd@Lb&$vYEiED@QZWoovc1RM!m3HmgQKUMVBQ>_&@KVL1E^jNhv2R||?wp2&uIGSThYYbHDIZ`=}rGwQ{ z4=++T)=_^iml`Xi))9&y&pa6_?!->W^?~%H9K2~9)l_ZFaiZbWZmw@WPtI`)Te7Wi zYL3%5Kr5u<3aQpu@mW?^ZOU;bM~AJ-aaNAAb6lC@svPI!I5)?|IWEa@UXJr~Oj;oq z(bZ?l1-ZWDyfD`vB!J z!d%_1&T(Ci>*=2x)HOM-HQ?D5;-%__95?2;g;O#IFFJ0@adVE3R_M#XPkX4}R_KKc zD|s=F+vy=?s_9B0?Xyy%m2y{(yXnsy@f`Q$xHrec4D2};td#q5+)tb2;OATXrfcI$ zd64m+&fHe<9Ll5dA7$#&mGUTqKO;bnr#PTF=qjX77|+@IcYz;Y-Mvzt&hd=#nP-g) zaRnq- z81b7q=t#8(>dk6POTA4a=Xf{AXJgfSbZoY~rkXWI?OrLf8z?^Hf0W~6PJt38mGDW9 zPZ^F%XjH;yIX=(vcaDE@e39eJ96#pxDaTigUA5FVIlj&D!j{6<#@ngqyBy!=_`x^{ z-HA&rS8y`dPF1D)>gOE4u{Fowgy?F7dvq)7dVeKlZUP6r$E?Ombt&)mk^>LNYORMxJJ+(`y zS3>;~>XcBoq}QoYbCm1ok9jKoTVV2=RnnjYV!ropTtbr)29z+cgr+4lD?ybYB{VOg zMF|~B=vYF_5?YnewuE*iy|rjv0^bO?F_`N_}y1aakX4NNl{=>34=?>OI#q-kP?QL;FRE&Fsy{(CD z^cYbxAAgo$mB6@Zf4WakcPW zz-6n28x=m}BqiM1Mx`ZWwCCmmKeu>iwQw)-gQ2AoMwT$DgwZ98FJVH7e9(ikxa4U5bhqZ(gO4wM!diqQ? zwV{OLN;sy3pVmmFG3wZozP2LZUDoj>Y?-O|hur5g*>Y>)#1c*|;WT>M*1}08{=o=N zDdFz9dSA-t+i{A!)6+}XL@yno&M1LNKL4(fx@-AkL+WfgWC@p-a778{mcWJSLbjxZ zI*%7B*}C6sT@iTNo4*Px3^xR~>@tAgF+dg8ok3({WJ|6cD7l zySux)y9^ABzl9wrwy3BeDk0yy`}=sF^UO16&+P8(?9A+*y?5sH68oOemT)#NX9k%X zA%6~7#=oH7pe9*5qMr9x529Xkc9))^kF2OwzF-4;!iBI_}W1 ziI$#+Kl1P=?IjOesi=8)HxJwLussh)sLzyn9(LwoPagKNgdy7Myh~DC`f}?tiMZLwY-r~L9;)OiCn1|Q% z@J1e9%EQq-ypo4k^YCMDak;m6nVz|i5Pif0eZ*^dU=qu5eZ(;iypQPKM=b6m(^|es zW6uK_c$>WS5&!EWP7>zfTpw{=Us1QOXx&%5mxuTB@KqkZ&cpFMe2|CF^Y8`zKl#tY zCwcgk{yz__*srgw-d@$>7$^4?pDCW#_7z9^iZ3amUg88zvak4{ui!vV_Z21kiIe>E ze;$6OQc>CR@Le8$;1Kfgy`sFQpD_A~n*AgvY?JUOnomD5sGpeLPyCXHU-R%=9!_&Q z`iZ0c1m*TwKk;WjImX}VJo`&=ae!y?aF+9^qoR(#I6yjT9aro4I}iWl;lDgw&cnZS znEk~CI($xLKXG2cX8pw_)gz~%dw-GbFDNMJD4K4 zi{t%85gkQ!T%)73j$%5BlYW3GspFUaqJ)kH1LXX&nPwQx;<4zrp4p+xrIvVR}&4H6)9rx&X zKt~H5O>{KX(VU&?xK~Fr9aNZY1Eu^&4V20=f1tQu$NvV3{|3sr{&Ao*pO!jW>3C3= zmQ{X`ph}Pvs{L()1WVfJcv#0{I`VWpqNA;j-h;%WI@&3E60{s7uW*oV*$~l#BT@)&dn?MmI{N6Kh0;-U z86x^o)I%gPe~1{UW020E28`D+SjP|@BXo?^F;q3k_J`{jrtn=u1aIkWSc~nCQiWs4 z@DMRt$H^gr-Hp{j$m{$NQD&&5pTL<_%+whwChM4@<2@bk>zJxznvNYhcIud}Go%hH zbgWbgJX6O!9rJa}(lJ}d9Ex~Vs|=T)bSGMSI1r*2kB3Si+$9AVdAG@f^ff% z13Fd>6GznT`@_T`9fvthil+5&@q&&D!^QJlfQAbq)p|=Fj_P<>5xlN5U=S>PO~)}+ z@~VQdqU<$X5Sct&yrJVw_A*?&MN`u8Hu)JY-W)F8(ebXLXA69qPfX;vjt_MFsN*Lc zAJQmve4~RV@Xc`Xv5qfwoY3)!j!%`p`b5#n1)SjYFu!O|*!psJ6Ms}&({f7WqI2MiQ2@QaRL>CbhX)A5^*)0E^0 z@dsI=#*PrnM+idtNy0yMoY6tMKC5Vc86oKLj*k$3Q}QFlc`~NsABFSwUxic}De8_C z7j^un!&CSrx+aCtKrSmYA@NlP3K}SGpoD=QBSj$tR~sl|ps*pm)5MX2g+&bzDaI|t zNWnrnVIo|JOByI;;97&RmUv;LxW+&k17!`AR<|tqbfhR};LJ!-eUua$k&>fC(^2Aj zML?vy0YYBJC{f8kWdn;1EHQ9{fg24(24Vv@8MxViW^Ns^3}$){hdrDE~T!bTXWdjDZ(NN%N^|;5Gxz*`|Sd z25vWSmx0D)Y=o$9pn-vgirYIBs~prvqvU>|5l1>q{5DG5sSxVe-3AJcmb-$c2JWFK z2FfL=iGfO^Wq0=)Xl5Xz2nbt@7WW%?z`*j+!ZpysKrmXgG|_CH$zmeN4eT1G+*C1C~NaU@C-mVH?O&ZoQ?2 z67mt{Lxw#Az9CnZz>v#OXnYebT-h%z~cs;<#$OyTl(pz$e(23Jz;M8cj8F)q!bI;S&z_aYvKp!gP7}3o@cLUEU zPIy~sjOd~8o|Gr?!E*iTrQ~zR7|~Zf8em|cfyc&(eg?R|>dzMXh$qGfRv%=5%kE$` zcHVM{XA8p&3^y>vz*GYx42(1|-oOM>8W?S094&ODpb=4>28r zn;18ol*~i}lN2#2Ict*@87odRFx|jx19McrGn7HiGBDGSn^;ynGDcpsueoHkzgS>k zp@De{pRbIOh50tPh`g!I56zHuml{}R;41@PQ-2Jspng)B4XiY<%D^TAn+>d1I=_}S zYhaCfzf!__(9WPp_%O5Y!uw;;| zLO zDHoIi3eu*Cvq~Wog-y8(kvJb-ZDRa*d0WgxaT66xR5Ve-#FFu%w23k%N}4ET;u;fF z{{7VQIkV+WPzm21FTNiyt~Wso;>*$H@zQWOca==sVB$uy z)Js%0rRSjoyvfAPCT=nR{~eGPU4DX~N|3&aiQ6X#dVp#ss+)MsLY{>hCTg;-iT6#^ zGEv*a6DFQCQO88aL~9cdnT${8*U-_JZJMZS;x@KpN(u8K+x5s~FY(|6d0XFm$1sf@Nr-{21LObH4drUOpC?<*rOf)rduZcqw#C;~3nP_f;>(QzSA~!+w zoglampFBa_Z{qj_@yi5JV4`SYGMpdWL9v7ctxVLPC>|uk6Xk6i6Azp4Oz8k0G0|3a zYMW?h;!zWZ3DZP8Q9NcMkD{I^UnF}>l$$G^vo>71U%rA_rhL=9VSvPm&_!o?N-#(` zCg`hO)dGFBZz3=enuypwUkX@mA~8YFnKO}^a)F==rB;v`zMrzZy?V-bTRvJoQFJiz z6qUrpQWG6bbTTo4(`w>r6VH%y69Y|jW)&09ndqT}+|@)k6WvWbs}z8~Ztp}nxm*n? zc`i~tP4qI+kCWJ!q59}Ul{4k8kNe?wCkpO|f1D_IdO*tliiQg`@j)gAn;2nYq=`!t z#SjxiO$<{LT5ggUuKME6pTns$N!&L{j50Br0yL#7kehQ8V@+6-1h1}>#E409k3C+M z#!?G7f9sDr^e>HO}-LxiP_9TZaIdE?)GkwQ zHaHMMz87%5h|mqbXyPRkFPnJ9l*QZVlTUv#@w17)P5fixl!;&Ha7_GR;#W?}U`fV#`Ar%1X$7hI^q+sy zeENwq)MuqXZ1${)zZ3y+s@6GEu7*VZHF4g=RhIN87ff8Fwww5mqZ=e&Z0*U?n^FHe zPZpQy{4Er)z%JM+d833M?=9UEnH`zgoTn8 zUY#t;SSV%T8cQC|Y@94LXZB>leRXL|?yfUj$0v)j7Wk-~qUWpb^%lxoxY@!j7Ajb% zXyNP0;zkRVEO1f2!IBzS+4}!wnyWJlDV&=W8P$(C&rGUV;Nn}=!e5i+?X4E7sS+;A zBw($Y7HV0z)52XAYFnsdp`L}?Eo9g`&lMFUqFE?CMV=|uRVBAss5wPC0m6Hxi29ba z--Z;F1>QDLkjG-g^(mr}y6recG`4WJg$FFOV2LFch=>c*Mek7Ft_)$O7LqU!5WezL+8r-nOyi$=e@O zL|e|zRMAfL!gAt|D!l4c*_Up?u<)3TJez4!U|HB^VY>yJg0e8w!Y~UC`LytyB`w{v z;9KZyp^JsULTKSh3mq)EYDWq_u3&5-Q3%UZ3ps_izf!`vdqUwH4hg84PjNWoL?;U! z6+!~uKCN&f&nSeH2S!W;{H5twUXo91H)m~RBCWU+-s3Sl9Ssrd@9#FBQ+ zewSOI{;#&M#=;6^L43N>!Ya;eA4y5FwHDUV1}$u|uwI$T24zjG$g$8d5^lDz#llvl zy_2TOlj;=;5;-tc?69!Y!X@@)VV8y77CyJ|g@rv9Q{~_d3vXK3XJJ33O2fDC_Ehoh zRB?b)Y2lEC!(`r)>)nN^qU4!!C5;+hiTy~-Is-5E&N7(u<(a!kYwkl ziPH+_&Yy1iPYY-0W~a*+a4y6|xB{ND@He?7v4wvub#lwiXFqxIJobVrxu|IP3j*oc z4w1_iV57Q?8a4{pxXQ-$Hp<&5XrqvgQZ}x!QP{@SHj3IPW}}ELTkep5GOXT)s!tci zZIrN4(nhoCBAhOGrbPAT%Of}QrEQe4!7crDHp(iboQ-Q0LNXHY=&Ap7iBL1Cq7`gZ zv~i0qEv}M{$~JChvqQuUHn?WpXyYa}I8;oXF4jyJFH9H2KT-&v{xMxtu~F5=t+sTz z)l?N89T%A)?V_fQT5Q(FJvM6FsAHpnjfOTdHZ&XcZ2si{!bV*iw=tE|V0mJE%M95I zTOiVChNy4LBxZlQ$GvrC~tQlgX;+FWy8KR|)R%CUke8h{tj}VgJAscNtikae3 zoADZW#70|krMlx;^glBMtFS4;Yi7!JC>%;aw_(_rVPhu!zYWXAlQufoux(^*1U5o4 zHd8p1FrB{**OsoHzBHIA4}yGE&K*KzBev0RrpVby)J&zed_ST#(ur~6=t$dBPi*j| zIREwuTkcd@_bD44ZH%!o)=xn3AjpuB1Q5|))@vJSqBAq|w&%InX z3T>zy2zPNkZ1l9z%SLZo{y4=R=?Pg*K6wO38fthy8~tqzwlReIU}Kz7`2}Xz!wmiP(D+8P2yD%w7+w%Q%(@e?IjG1DbvW3Yurq~!y zVs$%_^D<0KQuymLcj4k6~rzm3^84%j$oV~&lvl$DJQ zHs;xwZ)3TQ6*d;wSV#jLE0(bZ8;fmugv-s<5*y#nl&4ZlZ4h2mIA6L+NoTdv#wr_Y zscGuiYBg zS<+)~x3SB{ZW}vn@OCE^SUGLN=Ci~e#pgaUHdXAU#3sqY{p!}4CAbhAvT@kPdp6#; zam2>+HjdeNo$b>KY`ntZPZ8Z`$-T`>HVBW}cv&Ibg>_ z?#=#Z<4t-n9xU_`Z`s&8OCoRc5zSw{kH4!B?(ukgoaM8`$2LB(@qvvGIrU1P|LiA! zzozPPtNE#o&upBaa?)816rWQ`28u7pZ7+HIrMe};H(YMozp~}l{c8pJBK)n5?`(XW z#V1*OZ{r7gfGk>P@uQ8OY+Sa1EPl3e%EoUtPE#g7WqwicR~t_q(RlmQ9_`x^+V50y zRes6Fp9;CCAPLSWr58)CTR6k6;0tHzhr_|S0T44 zxaF9vczYK0v$!LR28#afEbdWA!z>yp!1dXrhqj3N}^nUIj_nOd+Ja z?@G!23VA@m7FkSDoVUtir9zsn*B;8EO%{{+D2s=)cqEI?S#-&wZ5HjaXrIO7Sv;z$ zyI0zLEQ`D=xSoY^1vj&>6mDNB$tuKAFke-?Ec`1^14>fi(Up=|AxReLm6Du74$T(F z6vG_j6IuRmP-+yf4hnfHi;fEEq~OyEKBHiM*Il!CHj7EBq+1r<6>@%r_MAf4&VVd> zD7@#Dl3ohwtze%l`YNQKg8da_tuGZz1G5;UN(N^!L?J`77^je7SqxXmh%81cgtbO0 zWR!wG&lY2@l#iwTUK!(fRX8Dwi3;H(R=oZ-sWwxyn3lzBSscq^dKNRXIGDwuEM{gg zD~o-Ka&{JTvJAbEwdQ6qFN?Jb=k0ujEX!iSm6C-DS)|}%1(zteRKWss#BznKP>?OG z%wmP1H%a!s{s>-%3wyTmI3hun}beBSQE4W9& zy;dN&_Y@O=f3XYqkTK2-1{1zDZU zf11T-R7D@%e0-k87g-!|anQw=S)AaUIymOwt1Q0G;xPw#4o+tA4PByx5)OVWq#dll+vMAR``yq>;s5Wf2tM+3Sm+NXySM3ztY#FV((0*Z4UyZv83;g&Y)iP|%Sr@UQYLyxKt#2Spte zbFg}j;D70l%n|w3`NwsVeK1FqbWqAceFt|qxW++g2bCS%;Gm3yPdjPXI=Ie3SqEor zt(=1Q6wrR1Bd&K)-a#b?3XG!t7vXBT1Z**{zgW3-2IJnutEe@(V zsP3SOgQ^a0b?~$+gEjcK%qnw5{YSLMa|IJ1)NoMKK`lon0DNq&Siz7tmF};@TtPAh zXlEP<2Xz&J=3vlVL4w;H)N^pVBh%dRZhHge=_Hg=c= zQQqF=@Lv!z@d#)3ZU?*P%7mZyIN@ehrRq9W3Y^TJet{PVwqHVz(f&{okutl%H@WjlP@&Hu%? zS!LEBSzUKvI2h+(yaUsLMS(l$mZsZat=HPzJu67;vjGkvYd<+ z*S?-B7@5oK{9I9X9{-^(TFjGS8hn&00zUepnAV=XJ2H-g*Aos_mXw@4<)EX3ZVtLT z=*0P=^>xrsk&SZDUm=4W3|7bh2b<@KfeuKXS><4jgSC$Q*ZOM8 zq=c-(Yn>`#MRrGi*zZQl$H5i{n;d>bOuKHrY>n)ZtF5Xj{xhG%I~?qEu;0M}Rk({v z?qH8md%E9}zRtKLuIPTyBPLnG>QHuH@C*8rvw5Iujsz@EC?or99hqQ=Km2U4g7%s}> zpZJ=to`y4DoKSlE6%}~C%=|gyIqmimTI^uhd@*aj_(rwN2ETXkgM(ij{K|EKHq}-9 ze5Jvk6hehRrJ8EeR^|@n?Qaf#ckl;gYiOqxpZS*cr-Lr4S=tmi{L8^PI(ZjYx%gXo z?0@O-X}q^;|EOC=5?yd`QQ?;zTyp+DlkHs9jujEAWFI@<)W^O+gx1ZqO^+}UEJg{ zVoOHYm3L9WMOhc+Tp4qEtqZ1ZxZcHeuFU7a)DVS!&eU8WzK>;Mfr>6FyK?oZS8=V1E4|09E;wsdT~sR|^RiY`k0?)0O-&cITxmfW z7qwk!2z3;srpdzjqE1HBTnI&T=4{4YAeFYBi`!i^BM&a>EBb~m8oAO!?{Lw;1x=XN zbf~wSh&x?0c5%0hyIeWH?3D9(kBcTQn!32xl^T+-PTdyB46#h{%2_6IpK6e8wsvv9 ziwDSqiFxu1Pp_fe0Mf@38=H6j6Syva&a=Kmgq!yjYbmNYz zsEo!sT2brnGNMX*&c*af8pE=Bx#&%qpUDhy(T9d#U+Yipb5jj~6YLW{k7H)7p^OdVjQ6(H51D&Q($hOSnHr zAIvK?%f)OLi#atNwK*>4x>(?1Avt&P#sa2k)#kf6u|RMO#ET`HAJGDWQ#U8T#lnk2NL7D%X*+o$_)^@ts z-%s0KNZUAX<9%l1RTy2q85`_RSlXS5F#9y(gv`?ZhgnrO=v zv@@MG!l<oHU?h#$jhCye>uPOq8@JWaKXhzx@!-`JzSz;R@4f3 zxXQzS z%2-I=mhe#0Ls<{yJe2ZOaLt)aX^$BsfJLI>BAMxh8Fk8dJTca;y+ym$!*w1idUE@B zy@&E1=s+qc$jt_Y_H`g33%SRu=m&5BGa$$(B9PJw8A&7S&pK7`jMCtj}B|L)Rblq^soB z+LO6_-@TAw-b>!L@$j%3`y&dr^{{P`oGH#1cMFes$n)T;j+nku_h3>)o-}{MLkmY^ z4sAww*&ebU98c!vWmaBZ`8jG@Ud(tNd{2hQ2A(vi(8D`rWwv%&6Jr|_52=TzsSF-+ z9@?|btF@;*`4xl5Ih%^5Cp<8wjGJV}lyy)g#}-&uR(a%S-DT4xVk zJn48}s-$)G@T@02WDgJBICc-ud2%7Rut+cu2@&c!m7ECOX-`GTth{|Z^z|^-!#EH9 zJoNWu;;#`N26z}qCvzqltjF#olSTbGd@ zvy00-Y@ye#o|?G%9)?xZa^>Vjg;}Hu>z&Ok z_OP{!EMej`ChMaqE#(Y)SngqkrxM`T*H(HA)Y2YUEEuTBSJyRE9uI|mThxH!w zgyTy#=wYLWmpmNxu*t(_4|_fA^RUH(w^(fVutS;ZR%(|*_?E;MBEp>>c6(rK@2)H5 zRDeCIg!x;ZT`cx{IG`r(dHN7fx~W6zmU%=ur-!)&sN0_1L-oE+``*L13Ss$o?2)y6?FUuzBl%PbEx*#VpFK1#rSUqY z3V)#vRF)rNI89~qz?k%l9{y0Z&U*OE!=DO2qaJ;or=40Xzd&)$!#}h&4}YuHSYCLE zU?b=0|F4uVLXd^*=n|d3hs*TOzHGmsFPSOe<0@Ycq3UlL(hwoHY@v|Pa~l~NU&KdI zAB}w6>7$sB;y!NjakGySK1%wy-bZ;~+HWZzWqi38;%4j`AC;Gg(mr?~)7jU``Y5Mp zu2lrr`JBZ6&tI3H#jXPBefe@-(U&jU^_GZAKJpW8)2rOz<3{zAR?k=OTYQWwqt*6N z$43<(Rejv*qneMJzBKCU9F&UEt>L595_y0#bBNp_^HD9bx>(G*Udyl-U%u?z?nC&} zA>XE8T_4P&!W1InLZ+T7VXA5d8rS!6hmQt|d5*N9k9dj9XZT5H88Ca7kH$XQ_;}dI z-9GN|@qmvOKAQMw>dQD~R=L+lGavUW4x9VZE!?Ld-38ypn74;-H_U!UCR_S)i}j!{ zQ@a-`r?v9s%FCPst$mqI`XNfPs78dTq#yCo)<;BUe6;hW+cbQboJt>$`N;FZm||VQ z-b=*!tE3t;6}jcZ_Tl?7vODX;@!|ULe9-N4Az%VemNWMV51{gwgTP0qh`D5JyIMwh zCq7ai9es2nET-jrJnrKOAMJg)lVLb8V|#fr_N0#vKA!SH$Ie4eLY{*WdMz}5rsQdg zqBc7Fa+P_;N7u`l8~@F8Awq_kmt%>bbK9^)bocQbr5fU%5IubKXEGx>K}*DkOZc0hHrkgtb9Qx*DG0_Xnh8F}s|HEQb|zkFki=7bO!fH=g84qC z`IxRA&G9iq(a%!1Y-gqq=HU8OwLjYjJ7OWL&-G=l58}KE-Kj0`v5<=AW3ew^V3+$? zqL8INmQl@0Yb@l&yaCL0K)Aw}ZseVk^2lg4jn2mrAJ6+(OXp8r;vD%{PgVRYv&F|& zD!Gr1O4&9kxLHBwm}Sx}ekX`FvP~Jn4$c&XpVhcqF0xeYRD~_;$*iP%eC(wi710jT zt5neT`PlEvog`l(sJ90c&Jz-ru+u}T>%(*)OXY#~3mgjxe7s6MQ7(cez)op0N7e1i zzFaFAKmMAJV?N&It&i8$BQ6|oDwBM}2Uk)i?0So~PZM}t?uRdUa&dXr$9q0Lpm=>W zTq@pIqdQImSt|IEqsNzueq}EkH3BV zH6VXe9&rX2F4%4p1tP zdd2IS0O!>FmI>sWQP}|H0&KloW?WzPxO^?TK0x^Z^#a@;ph6(iHB=37Yk-OYDg~$< zNVjlffSUr8TqbS^;NPIpMcf=n-+oJgDgjoU%@A+dMys|=Fv*fc0)8$8LJf+ECTawz z9iUEtngMDBa`(&EUT%GxEE5^_*jm#RBywj{c@ZJ!bpza{Mqw_KnXl>xxFbNb0L=q5 z2;@r9IKbTj8U|<-;LZS5@6zs4aKJAa;)i-^d>?0C=z9XWCN>Swgd(M?oyrj2s|tDK z#Z}|JKu&S101vXe01pIc!BJP%T5?``YU>+nPcIWAmkE||v1lDg)oK&qp+Fwi@nR;= zhn19gio%bMwF~fQfDZ$F6yUJ{c>$&cm>%#mB`^YX4A3cn8Ndn<1&9OK0kR~!R`UZm zYP=p9xLR`+Zr`ZQUnXeL-0TJHWtj*$<9}xOYFw;~mIU&6@Nv#NCs)l#EfP6I8rGREz-m8u)EfjY&v|4+}6nz=Qx31B?hTGQgMsW7X7*QgC#@gMDpv6KzsS zO)spC3*@$8yn;liRBeCB@bdwE&SxeC@@QoW>8T!tFPafL#G* z1(+RRJ;xYePJp?TQh=oa<^}v@3>F1oc2F+g3j(=_FAVT@O_?5q>DqXRv6xy^MK05F z$qukQz^VYNDgQveEAd)MIsf_p?@CO|Uv{}z6JRaJPD5BO?q4qWW1O>G@aU=gajcoB{R**caf1 z051mEAK(C;$?usXfqYFk7~oKV!-33E!&@E&%%~v|eua&W@p;PRpUjKRwU?AW(<8kc z;Hbjq-mEQME?%Lts-Q80H{r1WuLpRKBfUp^Bfy(vmBOJRtB%+On_bNBp8TERyV5%W z-c>wPZFVjfJU-=t>iYqXQ~!GjzS;4cbRPurZIRoOkLe=l!9rXU;?n@11vnGnEOmfB zFu*CcO#dIq*U4`<5b9)rugDDL$*hk7P6ps%b-rOT`y!?EU4S0~{HPfCK9E^xPS)0b zqMo15e6w8q9LVo$@G}{_m`wFos?Aw>M)7+f4`+T0a9Yg*&u8f6{-8=!(Ee23JSQtxH<%LPZbE|D|x{XSA|llOc=-{Bs>Nw6r$z|!AC_x`F>O^MDY+s70%N?p8J&u z|KHn}RLGMxP=ewjAQxQ2I}1P%N*I>q0r?>lMx<^A$o= z3{fdW(^TWZW@T0%qV@eV!?cYoxhcfWpM9 zL=%pMqKHs7!o4Ayg;*V8O^D_p?hDZ+L|4i!!~-F+A)F8`LbMF=Sctq3twQHud9@4WE5M^62KAH~eQTf25b|p;R4N`I z>miH~W(X^U9m+FgLY_18B$-cn>xS^C4-|3;KSaRRp3>3~A!o3t7OUPPh4X}pC5hsS zxsRH98W)IMi1wj$__R~55l@EF9G(v42}y?#PpRQ_4ADs;6)wn+rj775ex2%>P;P6v zaqS#}yH+C4hUgYzWQb8Ax`%j<+=l3*bc~K`*=<^n5IsZr>e?%m>C`wtPG8>;{Xz`n z@I&+u!PBq-RM$XmJ3Bkzr!#x<{3pZ^&exgD@DM{odG^i*hwu&EGpLyQeEjv5VA!dY_ z8Dct>xwyuk8u@b-eVMOc-KEh%F(uhSZ4m z8&3|Gtq^-uNp)A_Q6Y~g_lGzb%1nLKq5~nSw8icf;!udgA&yXW4ej|*9>~*R>EGxQ zxw^d+;%JEDAwCH4a)?(#yiJt|@hVkOsneSwj?t48(q0eoMkx2p%>Kk%eyC!1T?yZ! zR#2qpGVRV}m}rryboslBHj;X8uRBfmpgNoGT-Buq1*$UTp{?Y!B^z1s`hmVUR|!%n5FRB5Z{F; z5aFr_-;>D@e}*^{;zw$Jh|@~Q%oF}|h+ji_0Dg+PL_skdTO)Y}bzy}_LhZLu{>nx- z^1HH*Kd90ra05;_na_LR_RD=%xJ=@`GYHuW+ugFZ`9EC%kyG z_E`<>T%LAG`8^`M_?pK3(q;OwUowcmJq(e85eh}PIzo|1YC_>izSHp(mx85`i$>CL zc$JD!EJE=JB_er-P*Oo23-EA&8xkVdMABoFR?sM_K9UvjTt)tmWpRY-B3vKAiQq;k zAE82oh7lS?s2HJAggOy2kz7_PN4Ob?ag9u$#3T{;RLPr>P*6yTCB0L=7kqC_=+#TUQ_7dTq z2u&h1Qxa<$$yAy5M)D+|*>3qm=jR!jfxNkT%Fk_7xm$Z6LW>9wMrh40?$cUEXcfud z(fA8m_4~Bye`NkwSbHdvKR~yk#7b-YzXbpLarEa5e~f6W#PV2#yhyH(?IJv?kP$0I z@M~r?G(CbD!HVRoiV=Y&mAYyCE0-O~e|BXf6s)T83nu(q7j@o?;71q|VQ7RPLKvY_ zgr_4!5#k6PBDoVtBBbmhlJ8=<2<<641^F{yKF|4(1DU^4JV{+zDMrQGQ*30O=orb9 z0sbaVfA~y<&J<3BJ{)y~t`t$k546d-epbP5oR@mqYb(WxF7ktM{F6YB2t6aFSd<4% zU#%4Xt`zdP={Bv*D$zGWzX;wcF(^X+NG8G^5Mf{hW``@;RXWc)tHk}Q2*V-_k1&zriZCL=NSf`%4FAV9ih_zTmKqhw?@RJUV@!m04{F`mehqoDF+Rcs zimstFB_7am0V;kjGdaSP2(u&1iR90?QzJ}^Fg?QMni@S16LrprFf+oe2;3yB7$83- zz+|38_|c`g+$2z95f((4r*PgfZ|6eJNH;-8v4|XYmmeV5ag#QBl~@vCX@q4FmPdFw zk`81=gq4&`ggp_zVTWQu+Yn)6gw+w&L|7Zi{nEM!>mzWfqGw=c*F~#Dja%hG!6sU9 zgdLIGoouw;SuP*RpQ-Mf;j&w@K#&-!Izy8cG2!)!Czo`v`Dx&0zbHO zD8k_g`y%X*V6gCBmx_UW;%n!aK^kU#EB@`3nDbgvzVMo5ZP&G{Z+^B3VL8gOJ}B z)6_fuyPWO_@2k4il$YQ)(dZvOjPMbCPDf-q;^PRPL>TlW20w{UBYYO&$;Z**aeN-( z3)*Ii)+xS>aDul9zD)2{gs;g)j5lMPq>@ngV)!w>jqn|fG)Bc3-$(d?vmXI5eq`?v z&O|sH;pYgaBK#WRw@Aj_FoNtCa;4&-CJqp%RpIXu{-8e@C_}Ru=kg~_tgj#q;}oX% z6MscG7vWz{WrV*uiZL>%{GSL6^k4`BV__KWa>r^JZ*n2R#YhJEUW)J^g*-@xDbISR+PI>y7RMUhy>KCl*X#zzzGNN>hGQ0+g^0CZuQ8q@o7}v&ffJ{boT`c3gSOpfYk7eitZy8*}TZR`^ zicvX6(-`;0xFN=kF+_~IF>Z=+b4-0h%^0`Ds1nP_-)gFtssfqmdueQ7c9!mMNHO$6)9gDeEYDcCE!SG?f)O3%A9n7o$;(J7e4)qkfDAifz(U z!X&;UmeDj!qrs@dhB5MyyJ8theRqs|l$08)mN`vqvq=obpT00s;_X+9W-*$xyBKX_ z+!y2i7%gM8it&JwNsAcF=0s6&)&{PYJsun<9*ogC#zV0T0H**M_tYkq(N7P@G7O&x zW2^|<#dtJ^74x%7w2$!=*^BYGnusR}8UL$F_^~W=@`!_!7`|mTrr%MaZKe0iLR>a=g4i0XJd3z((X2fD3Ft%YK59 zUz1}@i7_q4^cYhqhe0yhizZ3r_0@8iGzvzy&7ja!mV?a_3uZpo!DKN#w2qvlx zW1QE-SgUHWK_+BaN9Gj|8)IyWae(8Bu~|*Z_82>2Y>BZo#hJIb5} z`vM2MMw-b>${vr#GPJqY8X39#s_OArjMrnlrttjfW?Cc;EnmEE(cY=938DmV$9RYC zH$kNY@5Xp9#$Pec#dx3E72_MaXgV&srWl{c_#(zf>?_76F+QdK^p}y&Y}OkoXPJR) z6!K@(?cS1;FJqjD!Bh`lQ|4==SQw`L6=zT-96PCa;}DoM<~ut77{A8&EyfRY{xMFm zab+Ms#rRn{SZ3j%NAlOmj_Bd3W9;_{3#ViJP8*LQb$+_c>OgJb(?4lDG0v)TdILV? zyc7N%;~zTe1Vs}38{>S8|6*K@aUsS|6B-@;6%sk9s}dAUq(d%{ z$nbM&J8^1D_cfwWg2IW+BSbR7q6vy6D3#!v1jQ4XsH8-Kl8H1BIupjKbCx-F!qN%K zB)BfY^@^Zuf^rG2O{6(cGE_fS;Yz{iQTA0nk$PA`wZmR03bs%=!3_zTC1{@D#soJd zd~3t)32shsOM;pSY9*+W$W@O#S4&Vek!gb1+O3K708~^iE7cR!P($M?Kqp)~L7fCz z0+Aq-$ebjkpP&?s2o1BYD!eU`!Ih+^lo&Q%KfxVrB*8ri8YF0#;LZehsqPvjGE$Y! zgv8{TBVrW}sa=P0ja;>?ipX`y1(Bd9R&^D1Vo177rFyQpD1bGRp1a<aZLMdkwXA?N8+~cU3M54EF6Y1Y5Ktex3kVwDHzG!jOv^YVMU`2wJ z3DN|)1S1oSO3Q^I!IKF(vtoh{37$&OF+nHFcBJ%UT$ITt_5A5X#>PIA zVCfpE51dDK+BLzmiFC`)CFrI`DpiqesKijTcg`}0-$O~hr-HP~J_-6J7?5C~8cRPl zmi`H-+hm?A3+HiAg277Dh9z&o)=3-Cm54pR)X0H z#M^8^zTOiD1lpBxV5NtZs6I!wLkC77RpvAqivWEJA%d~t#$N;0g=RhuP5sDxDD zRln+aY?@M?l%w81gr zH3dmrV69B}z>?RM2Vjqs|62+EM+Y@l8XY-jVgU-A%JVKwHNnRTK1uLC6^5HMF6hdB zk0L<5(G&$!6iRV*Dmkyx0>jpdS!+e%R3hwgqvD}hio`RD-4wT_sF#ARu?1eYr?P7zTh(oY6b(7>b>hwxjZ$1#D<~Px z6nP`7ccsV|I~lkqMUxcwr+6Sm(-ilnxP6^yu6ns~ooJ@mCaWAi%kNX7U<)l2SxePB zd#v9Atx|CK#M$OUDcYp?u|0ljkB3t{l448_V{>SmqFsvbQ~Z$P(G-uRSdn67io6th zioq#{q%g=^ijFBdrLa=iDUuXvifjreg_pu7tLucjPV^v5F>jsNu}-|bP6R2U6fqlL zC&CmgDYahIS}z|FAqXZT&r%^bh;Au(+g;&&bn^z$c!TJnD0?dS%m%?)eNyyI zF(Adj6#ZzG>qY+*b2o^g8^rHFWq3<``v%F||2Bw06v%q<9iLLMQ%s_?Qw&$Fji!V* ziV^H?qZp|mkx>e1uu+UjF*ZeRqZpTBe2NK*xbH^6Dzi3@S5my1 zVoi#*DfXv0kYZhm^(h8z5xY`sP*U2IVsna_o5jWyY-h`6u_eXU6gy}OTg0{$pKcZv zw}|aZZhveREF@PCZxK6HNp6eSonjAL*do?%5qnd-yhZF&@QW>i_(4VX%vSMyibJ%T zE#h#Bnp?#Yg%i=YiWgG6m}1mc@luL6w~C`2>{hXBt9UuZw_63Ti(AEODUQ*QQyfI@m7j=RWJXeil*qXO^n|r-ccplZIb!M+hl9+sghOOB>x|z_%Ov6Jkm+= zQHqaK)ZH#VP4P*JBilsr?ULq;ZQ{%}@mY!ow~NmeL88h}aN?*HJH)s2|0zzg)^>4v zyXd=Jd_(bW7e}^>sp_`c4)I-zW;>)}|H%1D(IAJ0IsBaBRElCb6wl$86u+i8&q2`= zcZlC8@Ezi8iqo8q6g_u{Kd7ZU#2JPEsUUe%o#NjV|Ik70 z6u0h_{O9cyop*|hYSdTdP%wu}DgINpmnq?$qCgJF$yp}xh@Im3o#LaNqEHTnb5cW! z5xHgCD zawwYvr+(2cLCC9I4nq}weGcVwsE|X&9JcS07E04*^-4Lsy-QS9kbTkZ5VGXP9ByL! zIefQEmQ>y?uv^fXRL$X57H$x?N#X`&?w~HqDBt2a;UBFnhJ7Ibriy<-flri zA#@|YLrmB$L=JUxSg~91I=oxd%i;DM>Z`^J?vWnjjvS8f7N>SgaW%@}&Kw@k;fWmX z%As)%kLK`Lj$fI_Jvp?=;bF=xho(8S$f0Ep_vTP@k7%C5eK|Da?H*z65zp@7f6p*_ zk9Z)5<$DAXw!BZ3x1t30h)a7!>l_};;d}LnqGQQJoX0()(q3`Ena_5cI7Z7hpC)U>QWBVa+sdO%p7JB9+0X#BZo}~#Bqhs&S6dt^K)2`!`vMHJs=t! z6!R2P=Ad+^G_-{|EXrYN4$G)x2gPDmIVhIo@Z>=;?4WEgA8tD+UOgzjJ}6e^uqubG ziuu(!tjS@04jXc~a8RtxVO>rx?zFY*4vD)D3E~{rMq2A8v6+miVdfnY9S?~u3g^?2 zhs44|VjJx=haJ2QNv>W$B)&N$cIU7shhsUsp2OZ8_T}(A#h%0d91i4ggm$q(9L%B6 zVR49xdRW|e`2T3S4yY??rv1=+@4dHo6FQ0liU?vsP*em2_1$*2?_R*(#a^)sc5I*6 zdk3US?_GNDy|@2K{5>aU&SW;pCX<=TBztd0beSk7YKk>ckbd7p)fsYrN+D(xVrC(x z7AgZitq{}6%x?tE@+%X?go)yBip@l^VxrhTQ4pCjQOqgCT+V(WmK9z1 zF~1O{CW!?!7n4MnNuu8*v6yuyi6!LZ58^%&^{a`GnIx7MVr3y#PZFO^5-ZsGNosVf zNGZgjNy^BSn=G157HbQ!t`H?nlrpit5E}|{gyyjj8w;_i5PKTDr)kQI}~cB=4X@#JLj{$z2xMpjK0q#v3rcGKqkCH54e^j}IO`u-(u`%COA#D3b? zLL4l_;X*9@OB|v^{iXaFzJ=*?4LSA43URy;=L&JY5GN=$g*Zdwz?u47oYGd}v{oEu zsiC(QV*6i8&MQn29j6GGC}OG=r?`otCi+bg^lFNk%7>v#LnaWG&;?k=o+3({C}X0I ziMl4rnkZ+YvWY4tMo$stb+L*jD(EaJZ%q;3O%at${5?fk*QzECOc6Cq)MVYMqMC{7 zCYnzb^xrrNdV1GP6}3zyq7=*8eEO$wr;2(e>a)tXqLqmTCK{S(Vxp;uMkXGbswxsT zHZgXpLcW=Vf+bvBP(?qXnf{&_CQ&zFHiNVvvh-tzwAxu1O z;t3PdL|YR#^O1>mCfb|0%tS8}9ZYmIm1o<{L?;tZPZOO@bTRSXH1W$cv2dEWz(iLQ z7n!(_p7}IUY`QR}i;G!(x*7{dG<>=$*4;!86PK76IbB?8;+^TrTYGA{=&336;(nhl zE;rHJ#I+{+o9JVL%(-ZWxZ1=OCi1^R%@F-e z+&4qe+zl{sorxPw++48cS*yK;u$`f_B3s5w&@GsPeigETV4 z#84BdiOj?;CWe{Fnea>uClgGVCM*;AnPSXLahr+TP5eAl6jB)eR+M!!#gUo9HsP3X z`O?2db4~A|k>qdjl+OAl=Kn1s69LC);zLbmPuN0ig2fVYQWFXDCPtXJmqR0?OpG#d zm!4b}zJsHiDeg3J{%=upmLOy!VwSku#62d+UUHT2eiILvc*Mk`+&9e<4^ntcJWM!2 zM6<+Wv&37o#CNmAyjhBwqsiyl;xS4x_Xx8@)7hfiZ1JRtr%e1|;!g^IiDyiFWa4Am ze-qD{c-_PsCZ0F(f{B+*ylmn{69Z?9&t?n4Y_=Gqv#-ups`rYCSE*vAT1_U-R<7yl z*-CT|&K7S{k||dv-ZwFh1-=k(Q%+3fa=b;YnIoFd5m(I-&Kz<79PzI1A(0PEjMq3D zXQK1)A$5&EBivcQRqqoMpPKmA#CInCXW}yxUzzyY!~_$coA^>Abc#4wrZ31S?FzCT zX1`%S=O~05na}4a|M`0p)8~jEO#G*ZsLTVxP2xLnmDBK{e+ysd4g&3 zJaJePkFxMQaYW;s<#qE!qxs?(?azFLoHTKYmf2D=aN5Kf6U8l*uyEGIIjaABQPje< z^HulGn~3HMSPF8xRK&vL^ToUKMKKGr=8FyU1z|}Gr7Tp?WlCE(I$v~NAj(-Nqw%sD z)?Fa}rI)wBrvnyuV`SQp@l{kCM*zh7Km*N1Qsgip|S1;d)ri(Y^GtS zg@UzOT4-fKSdbQ4TWDi}11zv`-9q6l6zt*Xg~HH8a)6JhGHoq2U+pcl(+JBj`}RW7 z!9qt1M84M*yI8ou!n2E%{9I^Z_CnF!LeoW}tA&d!Tx?)y=y6 zU=4?8IMf3D7QS>iCt|TeZq+4;Fx{qcZa+;6T^9?>LT<6RZn0V!ZH+Vg=wdN`vB+`O zEPQUkv*23@EQA)GvhXxHU?H|}pN0D^BoxHC`evS|YArqMqK%ZfN8I3lCa&#KNQOGheqvJgi%O zd5M^?L`+>G{#hbMTX^ih#viwEW{EJCiYIij>Py9COU08G25ICOPQ8WqEWB^wISbEQ zc!yGC;ROpXS{P^HEem5Pmb#y>S$K(~UMgPJ@D)veWT|*nXIbWTO?iV1*Y6suA?g2S z-?s4DQn7NW8uI5$#gwID&r&tCV#`GRW#R)1<1Kt-;bRLQ>UOSLriRmDnJQo|6QAhT zKGly{>wo0)GFAOEO=p=eEPP23a?~AkUs?E?!eC>#jc+V`YhkN}Z5F%ub>3Pf;$-Gz(KLbx6o6^bhHQFJ2~QSeR+yZyF+fl*g9&lvZ?(7Eu~r zo(9a-&Ca7aU8WkGPuX6skVO`M=!MM|wpdtVpn&`c0DmLc6J|H+X4fnin=~?+wSG}& z9qjF)<*Lkf3p;4yY}B!_)50zb^HzuoHg>bO7EW0>ZDB7h!>{6ig@YQ|XJNlaNHn<< z(fCmd$24+S!z1MUuWGw}oaSYPIAN)iSn|2m3UQM5WQE`oNqB}TutF5GQQXE^3+F71 zULnqFSj1LUV5`NH#-XSUrhhBGw?dS#QOZVX8^lX$_|pne##Uz+OyzBq)p$7@{~oFR zOXoRBMH^dIh)Omp+o)ors*ReqGO8?4O;@RIgC}XHSBM&#&PQAp`Lq@buT(v$Yonfx zem1VPQQt-b8(nQ&WTT;tMm7u^!bW2oZC8pGHd@+fVxy^zW;U)~Dc)Qun%l70j>c(7 zTiNPZwY7~lHu&`4*A>|KVWsK-ACV&2nx=HI(auJD8y#(QvN30+I)Lq9gC*HX;!K@& zNj62CL^gGSjSKZym}RpU+vrA4+URYgJGrq^^ssS>tsE*kcu2QdVvTsz#%RtC6~V@1WT1_gC{&BZ z6MWsb;sr|G8u6r!r))f}DI`8;;~CDyO7ZM}lz;j8yq;y^++n?FV+=X-tLU~yaO&B} z%X<1=vGJ;{4mZ?!*90+qjkt4-c*Dl?8hO*kSR3Qm^94$sKUpK*;&j*`LX$!x`JRpU zZJe-i(#8ii#@m=pLACLrjgL4?3MW;PG%jHa@d4X^og*EBj1@ z8zLUU(0``ucyNv2xW2OSHI2U>6g`k{spkKP@2Fh=2qG-s{U34DKjKFlKd~trlWqKL z;};vh+xWxAugr2sU}M5RBKb!=^N;!xH02+${vYut4Z>P6(ZuOnow#+KT5Gth ztg^A%#(EnYY^<^IkBxO4;}2rwI~#`+U2D zst(TCIB%nvgW`@l`GJF?4ti`5%{Pc54hZQ{^Ya14tb~J-4$3+x=b)6MURuUc-^EHh zus4VYHwZ#z-`F5{VpiTkMF*7}RB-Us1~FrU;I4%HS-U};-XJPFAmr<+IjHWSo`d=h zYB;F2QPgx$%TXsh1sg?e2bXUYqc(~<4sO|~dct+5t^@j$V>gNhj*?h@rE26TWo+mu zGx+;P(O4rKJLjSqhv47>2NybM;h?31whr1kXyu@_gEkHd95taVymX@)qrnkdd!n5?vhim8#Juaor|G?CRhm z2R$8J=HO!1b#RG;OC2RV-N|GJk8D!=+1w`eQR$6MO0cPS-)~ZkBD;Dy=;PoDGQj~= zthb{U3tDEvz7DQ*aE*h0nxy?b9F$UB8&BAoBbF;W~i?AqWTSS{J!e;+JF@`;5I1XI)_BG?L zBL<=GAaIa(Fv7v0Eh2P~I>;PEM7D^Sv-zdLlsI^Ni@K}4V4v~M7V+H{ar?8zNC%@F z+~weI2X~O$Q;pqQ#GMX`J#8%5BE~;$@XqjcQ;mDrPri`?@R-V0-6~pd757sHwu%87 zf5^eZ4*z-sH-|?YJnG=Eiz6;ZJ9vz2aWTxr;|`u6-N6wDPda$Y!3+m89X##e83&&_ z_@9Gk9Xv-FaPY2!=N-JjAv<`TEpHVsIvC^NB{sfQyt!4p%<{a~eXDrI!H-+T;;rIU z>fkofY?~l_!@-;6s)MoHMAvPi|28q!0THHg4*YH6p>5))ZQ^ZRV9qx2o`Y@M#D`?; zcJaQ04;-A`CTeUK<0+Qg1=E1-;v)wiv$xyDCk}qyF8EU7?{62MIhf$!7ZM$O?%)dt z-#Ylt!I#ur2VXmAutO}_t~$1RyC|_kF#8P^YKORfhxp#X4-S6bA%3J#?GO*@^v(|P zlP3PGAxkdZA%1i4yMu`iCOO!@L;T^O*G^UbPm0G*(PpP0ob2E)2h$y#+9{?um`e8U z6w@e~JH;J4#fv+|XFCNcTX%|TyM(bz{Ow?tgN+V0IhgHWj)VCQ7C7j=OAOs5M(h%E z9n5p^;x6&UE-_=5Sm;j?Hb=kR__w`>=8StDHMi1g7UCSO9heN_lUg?_BlA<;2=51z1SYHYmdNQ zL4$}B>tgkOadf|^d_XjC(a=Q`7q1==@_=aM zqVRyY_kd{Zf}FYXfZ|V67hfI_GY^PnF34&kEnT#7ahZ!=E?T>2 zpdjq3U)s$@cNZ7A*mqDcU95`{>EYrM7ni!|sjHMeB$^yjwYnb?Hy;w2hL^kO?czEY z*SqNB;tChnxajBNxkI9_iz{7hI3&J2B>p}muHr}!3C`Wsx_u(24vA}B3}D5>qCa_l zSct=daM)on@~{}_;szH(II~B@bBEQe-RR;b7atxLgIwI~Vz9=kM86*v%MOb@hZQoE zyxJki2g2blZgug8tL)fqE^c@6yo(n&3oc9-cewmRF)SChi-28n(d>wDT(~ZBF1j5N zw;WLd@3G1e;p;|591+CF9}$s@*u_XqOkAWc@-9ZW`0I%H=ZMHO{gAF+>8NUisnt<& z=}|Gt#n7XI#qM%(w~L2eJfaKVIj)}{TiMx*p;?ExwpB)oVxp>;e^kd=~4WD)K&oOcG zn0QWSYaJJS^rDL~E9Z<-x?C(TwHQW z3_d01xX4b4KTe6cE}l9i-a93hpAz$2?AHi~ut2v~_Ow{+Vu_1Yv?ne&iA!B9bFrMp z^R&41v{*qEI4zh~QuZ`L{K?Z|4f%Xp3D`dx`Qx-$r?cy+i7s}z*iBpEViSe`jM(8~ zGtKX5vDL*k7h5#WY^5`z;EdQ#n{!4C)p+kSV$2z_lgvLOW}XpyT%V!kj-D4_|L#1;H zDV;-^94h4S!Z}ekht}uBE$76DbE2Ha%WFtt&vT+;4xgM8l{B1uP7tq}L$w@g=TIky z73ajkbE0|TReyi(hSIZ$pX z1Jv0G=LK<=Y?8xenh8yFXqH3s99raXK@Jz@&@zWsITYkzHBJ zf^8lVA_tj6#~eE4(3bs#Y@Z{aWV;*$B-1tOx$Ka`0~#3%`4i+4$j&+JgzQ3=7Li1{ z=5SFCPZW`t(yKf!F3zC`yHP~eFCx2fEJb8@4XMIp+9f#*C?caGvS$wCi^$)K$Q4Co zuN*GVp?3~_au}4u%{g3=LtmE6;kq2I%;751i^_gE>?zn>MA*XzOFki)v7l6o;Pr?g{QQOWF$Io!nRMP;>ODmyrbAvxTV z!!S-|F*!7cq?mlRnCwwZ4lX7?DJF;KVCG=uaBB{?@#zV1dk!0l$uq@dq0W->S25KS z+DuzdG^eS0ahc1(%VAy)^EueX!Y3zlcu?a(4q*;a4zbRT$YEp-9g53D!&Jje!@P#9 z&NNCF?q6IIzaxh`b@na|@7C}h4e!4G>12H7)#O0 z;jtW^%i;MP9?xNDarv}{PiXig_Y1}4QyTKU#GldhXEh{+g=mIjLG4i;*#lQ zO?gQ}W?%V_&K6kZHBEnA!#6Z!Q{!@YOLzEv4d2#mc`t`|boO0#PY;CfUnYD&dJZ4v z@KFxm=|(=L_Wjr9r#ZZ#-}OITo%m<^5#K%`htL1RzsTWBjeqqY`HRPiOIV_|B^pvnI%3*O1M{+ot z!xCL(Qx2PRSenDK9F}X!TK$R@Ij{v*S(#&e2dvik8V&!+0VV$by?os|U4FfOv>}I$ z|CTH+|LrGR*h0&Y!!AwVn!~mn%9oJaHRRJBnoi1YjgWF6hdos15^}GG`>3Qkk;13{ z!h?De4{3Nz?PJJXOAk zhoYKSeKoz9CbB?rP5ifTDG#MRl<{yw2{lb+^&?Ieipp{aFxef+GLZl z#<^3*)gG?#aB8$Mw4{9EC1Yx5T&tVvui*dMG`v|uhE?J~ zhG=}K2XC#xG^(T==3%&pTREp5Z2k0|FI23h+daHcQWkpnu%t9SSRU95A za6K$5DRUl9mXt&oe=YD3dbrugV4s)pAog(B!x0aOht$Iq4^us4oM;c9a#B2u@G#QD z>mJ_lFv`On9-bu+OUXMu+~wgR4-b2|+rvE`?q}gr@?OeeDM>%}J`XKQNtUFaFtn6> zz{7(co+%~YE+u~|CFhlrk9c_0!{Z*F@G#oLV;;JdmIF)6ouy=n(y~cuRqRO*PkC5W zT0Z09X%D1~D=mL0E&bARbZJRncUNiooQLPh3J))Oc-g}%9NUMA9=_?}>oW2q4`a0`k}}T2TmRv2dw56V?`rs-hVN_m zfrjHX{7}O;%cus~+Q*!%GV&7-d&)>6pLv+z;d>81kVR$X=N`WF@Ri2D@X)%fytJ(R z+QXo-^69ej8#1%3B>t_3cgxD}IQFt~L0P%Ito+f#nX>XX51*8iKY93>dRFr$-BzQ7s|=sJ^bO}PY)A4TvlHGzS~uv?E}hKHFRHdClP{Ow_uhqWHod6?~Cj)x^4mU@`$;koj1fro_}ndf1? z$G}7KkMeS9dAUdvSzs|aP+k_RARAPW%r5h=+{0=QYdoyr3mE<>-UsVegN zDzc=HCROBxRn#NDiY()!td9ylD*7nrQP<;beC zMOE3es;ugxnvY+r$@)GfR+ZI#)bvry$MUMOhK75q%Gy5a_`KpqzFSR}t|sgHsOO_w zHQ7jK2UU}CHMy{w+(C*Sb!#7Od^BeFe4x5)>Z65^>#EDT)nzjuU8>9G8d6GI`p8w6 ztu!P;kMyDHsvY)+(C{IANFQx|T;UldnpR6hSvbCD>otl!_ zt9@MK;|3ptYN>2LADe5+0Y0wv@qJC%Usst|Q}RsgIv>|_mTSn9HRV9gS}obSmh4$e z-pDewB&*+~8yQ5->+BFtoR8`OY6Q5&$1oq0ef;HPxQ|+74JX!?BYlkWv9Go)TSvC2BQL2VqdM}*I`VEG z_xO0!$7mn-`nb=>gJeiuIlhkkwT@g~N8az_0UyWe$eMMftSjBR@*$S5D<9VI5e?am z$9z2Q<5?fi`MgM3KH=jjA1CU{pX&+dvZefc+KKEC$x1N-me z8wxhf#UU}Tq3qgFe#hQ6l)p5TLmJBOIZX}a^9|+ZhVmyLzw_0NojE!=Y@0BNHSGxEEiCh8_OjWn8tFUk3Nm%B1&>& zxmd%IjpYlChffkxk?#3P2ONS;PM|k=r=rCbDW%B{R#L$n8FkH<6_5^0C`T zi2x-7?D4UeboQT8?PI@>!;~Caq^9x!*;rQ|()d9Q`!-cdeOps`l(x62JmzCTQ~7pN z`Eygbqp2*_OrG>{iuN!-kpPXG$Q0n|I4eXN;$x0x&& z;5WkNvRHtH&E)Q8vUmVy>o=DdG?%3UlnzjZj&TcFCP3K$l>$@_P%glY&E@FkvO<9J z0pjM8%0)`W0B<*!-!+$n^P9`<&E@&#vPKJeeG6GNK(zo-3(53&3t2NjtpGyY1ll#q85s{r-dxmQZ{HQJGPW|OW8WW11;s7Eu|6Qo0hUI#}z;XnAuWF4T(@M z+6P$QQgN(ffDVCLyqJ!)l%3e0ma;-CmAxRqg#mg5xFkSV_P>?9I6$`m7wPgHTFI+g zNosWW0DQ00N^&t`mK84z&@;eg0Um87$F`Ex({EbIUI8u-(3`z#C3m-yeF7|QrRc21 z?3Dqo3UFP3>jPXJ;F4KDA6v_t z0t^apgXZ?^*7C+cxp13X%bNpmI9=Pw!2!y&kxkktd`JKqTh_fLz%ahFjT|1})&Os` zkzO15P#gJ88%bk$dw{|KW&kU|ju<;**Z~~QT7(7>T=s;#4Ix8#0sH_f0;~)W1PB9s z65vw`10^TGGXb6rkOW8r+|LOLkOjz-OQCUhfDr*ka=L37ce2W9dY5vW_=Ck`-v zsAVt~!(F;Sr`pCvp1Kk4o&fg-xG%upZKR4y@Rpc#x$$6thXOoFrsWM19}X}&z+(X( z;Y0-d`3gVc3&M?UB;WP8e#;Y-x>M@DZl>dHz+fE4D`X1;By}|^7f9oBbvylQfx2jsw{SDC&Km*V z3^1158zjaB>OxvxE7yOJAVLbS_OmkI~rSZC*j{UMa!_YagMP3Ps1C9X4mqOMWe1N=-CsHGxj83i)#V2o^y-#F2O)g{vG#-9|Y z0J8(k2{0+ZWKPYlf|&vS(zT`rn8r3g5L0xPk-4S^VEjAYH8+E^f2N>)W8<;{$=jR% z4pc;*SsD@2B8atpT=aWQ&Hpu77)g;e)Y*{oy6XIl((rd7ml+gzcvB4{(t5lLdPNbuZ$6 z&6a%{XEt9T$)y7UJ{+m889x-@uoj^s0gh^fH)_tzi}&&dLmr$6a5BKz0OvTl4DLqt zIbBeX7m8B33gnqUMc}=}G8RHzq0D<(&uj5Uh$111hA0-Qc!I@4@ZN7W%P6|1&J{e) ztEX!lr9zYrQ6ogn5M@HL5#>UZ55b#wDQvu{j~DS(2vIRq!mPp;Tx?VdQ6)sx5S2r9 zDRGNijNeS78mm}F^$_nBNQMCTZIlWGkPH#ELevgXKSYC2-Tc}8E~8GUg6q`{l|0we zkO)Kf@)pE~A)16}%08bdXcVHcMu`7ZAe)6~9->u<)}dl%ix4d}!l-}DE+~-gdmC*+ z6ofEBb-N}ns0>aP)T?T2FOc){M)RIV+Ys&8y%6t*Xdj|Oh$KWBqGO0oA+8H?eTdE> zx`eb#xGcm4AubHjgYdArdbcYJG%_v@aZ!k~1+rB?6*RM3i0&bHF)U4)SHh?;R9r&N zlveQ&FAcHiE`{(a-CiO3gt&qwcNJW&VQ&q;&l!E$Th301YeQTW;_49BgzD<-RcDog z5VFenGX>O_{vmIjG6sa;U5gt&;twfRV9jcV92nw;5VwRF7UITG-QhWyGoCkY3c)}L zgF@UKf|0_0>|l)VYD`YV5Wf0a3=Q%9wcuUl*PJRC9^%#zZirln+d|wP!V1CL8Vhv` zyxiUl@$!WR;|VgtLK{QcA)FA;_E9(V@{(9amhm{JAtKUw=_NTIA`J0jVvM*$@RrM7 zh9n-d{RfOs8OkIlGIlA%;~}01F(Sms5ch<*H^eB)URfo>RE;}A+!?B1I(KP!cgU~0 zhHDC5z|MOk?+bCimdQuRx|+rVd>Se(c#y(&sNm~{#-S$a{^y4^kvhT#9}O`&#A6}u zxY>B-DkYyJJ{jVv5Mx5T6yoU+&xFc$QBa?yBA6=5^9v!KBUeLpkNwh2Ft!Mh7ejU9 zF`ph!1uxfqImGKB-p~^MN{ClOycXieeg|NIwJ_Y8RD%FZ-*EgVjS7UE2GJ% zKrKDIF7=%d?{WqWNu1$S7zdUim_GC3KAlZ-!Ml0)7gV@Y-F7}V z{Qr2D^C(vXjbV2f3#nWoR&toS!Nnm1K4Mv@Vt6glgPm*0<#bER7*v)OWYj3J#gMlJ zD(WIHeqYT7L#z!|5c4&mx)A;=Pps4IqUx;=v8TDZ9Yzwh7#I6wAXPTf=R&Iy$mN26$jVi77ts2C|W7LQOWLg@%4BBfjD>P46&C9B6N??GD52eZ6mac&^kh!NQDLUk zA^W#6N=tcBgo`6}>-*R;Dm=Pf!{`y=k_cCkdl4>;&@)nz7ufh^5qd?qB0}E?mq+Lw zp--f&E~7&5Cf*L2@x-lSeszOLu}DRhxiV7mUKtsonUvQ=YTaQ_gZ_FH{UThekqa&~ z7@>&+84#g|l-EUI*stBSj2j}{7{QC+N4SX`h;Unk+xhBSj4K)#H%Ay8VMwGFpj#pg zi!d|-1B3FmZBl4*hesT>vb{`<3`@umv4xRZO*j@iQdb9?99IOc7sT0fC*lw0g&QHq zHJAcj@zs&K5&FJJ1uwoQ!o3>dbi66$_LBu)OSJ{KpYkwDP~RVl z@Gxcj6Y*rE0v0?H;n4`AIq+dBY|Ud49*^(@8CAyU6^Os3WW;LP1SW>hpd>%VK~azf zD=}uso9D=Z2s0`F5niAeNBAPbml4K9cqzgM5yn#zBD@me%?M+)M7&(<+uQ8103|VPd2rlKd5cj_9NalPNH5B^Td;MT{vCrbd_+VLB!D zOu-CldUNBKGX;z}b$46Iuu~+?iZGitD#F?bbJ(#6%c!1|oKnU-3dYWY#WXSz7O?$D z-2>0Gh$Z(HjBP82++*C;*;o=OlfG0#TJ?%0l^W8EUZL5wGQuitrdDgXh7vMBtya|s z80R_|>msa=a45pz2pb}7jIe`miLfcc<_MK~7~5zPj}~mva4RR>kYBZxj|6IQq^fS$ z3j6$_f?W}IN7xr(KiQ?TX`T-(IF2;xL?O)WB|t+t_t{gB*IZW z-c#fx8FjFL(|sbsaSp$(!9WiT`fyTPYzE-?a-29F;Y@_H5za+8&z_%ESM<{*qw_}h zjE))cqA`la7!hM+jN&m$#ONNQM~sp&O2ud%qeYC;G0McK6{B{HvN6iVs2rn8td`^Q zu`>P@V^oOwXK;hdG_#dr5Mi1xjjFLSq}5~8&`7lycipMNRn&|@7lKj386v!0X`@yr zqYf#$Oyd~!V$_dS_^?K?GDHnxWttjlNTbyHBf*uI;g#upHi^+R27@d&)8(t)qH3+I zYP5{eD#nE|y2fZ7qfLy?u`>7tF^m}PVziGT_?E-mvZ8H_BX<~#mqcM8g=uYD$=K^1 zVswnrDOORa7@ClMU?3`{84nv>;{T6;b3qJ-6*#Yht?+Jt#=N*FR;%8{F}m?oq_T0W ztz`C+7?;Kv8snB2Jy|zK{}=;e^ontLjAe%ku3_QR1-)Zj5ua2*z(9jyJksCbCbWAyIXK1;cB!2*dOhnId^(JEV|bkC7`MjCJt&M}#<-0` zzTdbxF>a5s`a;8NCoOXFPys{5IXnfTkkm4GvO$$}W8`8y+)h$|-_pjcr?c7Sj88h zEBIK9e~*m1jS^49xaMLN2J}fSdyL}rOpIq^ycOf^7|&6Vsv9rIcqPX3F?@~T*GCt%a>RIOQ{(~6rYncW_%vw3-&O^tQcSNrBvP+zsLAGW{6?@9ILp!-^OZ5{XWJI z)c5xCyBLkM@&8fJ-A@|Q#L>PH(xaxD{}SU@J-^M{%gS$wKVtkDV|t7o#f^zECdHT< ztJpx3$tZTX4W?+F?bTimZ~ypwIjFmA~ zQ9NSI)7@C6HEw>4g`DCT3n(NsjDrlW(Tn-USe+j()sVqkOP(wUh8X(>7=+ZXPGiOImSc?8R(5(@g)f^O;iY^)6K!KM~qz7E5YTYBGs}eAv6}RM9Ckk#WY4BW&#`fAotsU2~ONm-2 znFb^%Y;3gaAUUVkCu)5enBccdRIrkp5)4Xs{DLtFZcZ>b!Kegxkn;(KCh*9a1h*s@ zmcUA2b6STQ!xP*_h9qDFv|HI*$KZhv6~8cnN#5$XpA4SfEikwg@=V@IP^7PsOW=}q zwT#{!B+u%(oVB_dL4r_oHP5jmh!f=xX9G4+?U`%isJc#`xC4jj0Y060@C15P7JOu zTn8UY)Yh2JFq`56{b+*66194ADn}<^+&#vuVfOJv#a<-B*gEtao=Wg^f@cyu%j#OH zpG!a|guchWE(aq^GWzNZ97_io+-|&-;N=8ACip4AD+yjr@L__F61G2@JXoL~YaA;Bl?XM+FnrQCEU>iYsWZj8*!9bAh{e39VG1m7h1Ho;ekI>2Q5 zniY2!jP4*A@{)&^-zE4y!4DioTZ4y+T(hXT&-XUCMdIn=&k24>FrCtv;MYV27XKr` zpOiGJ`AKC@ekV7o7!xmC4_2~;_4KuXgz3cQdCQ^hW3!QH^JcqYbl}$ zcIgqVr@U1&HYM1s<#t1YjT)hpGQ9W}$^#kR*x12A)iAc{S=&zTU1u=F+ZPWhxRY9T zrhp+n8D)ESf<4;s?xp=tus^}+RGnWP&^mSSKh65}E~RTcDm;?lXoAuy%A`1!;CO=b z36SDMf|Ci(YEyYCQC{)s1ZRkJkUZC==o0d5mdH6>W?U(QUU!icMN?&>OQvXgpHVDD z@f0OeKysxKy0bTe)3LRkSj) zh!Lpiu~bfZ>5Wk(Ro=_~4zhZR8Yw!a=#-)+Yo%zMqDhL{De9!kMm0>;GE_Ik!H13d zDe9%Tv%CtxTDGG)p>2?Y$ICpuq0`kU1$RkAnx<%$qBS3-%9(GTs^E7mHQpk{^pZx4 zj*@}!T5)u{3OJ~O6h?}+DcYqFDSCF4GF4N?BlIC1B_W-?_9;4~O5ke@R_6u{9VPY@ z{>~}7a6~CCO>qHPmx5=}-BWyD-RPR)Vm-`@QnezGLL1U8MU^6I;N0+XL)U}j;yG0v zqi3p?@5@v4)@-~iMK6sorZ%}sOWr3%-&E~Zh+mN^+fJ2d_DW6U_n>Q1^h@z%il!+%|FKShw@t`v8t2vbC4`>BGFDdH3f-<~Q%nx8#+p`sr<_3gS}62Pwv<_&CKU zDLzc`5rwL*K}GI*yP(<6@+%14?hr6!Rd&1rSNNbzNgU&+`MU#0k( z2H{M>&#BtJeZ$t+b1kUfvNN@e0hLv2Kcx7PqLt$Jj*=~mj>Pqz;C7h2QvSbg;a(jo zmrKd-dW!!@@n?#OS|F)Ylc+ch(#li)K57M-l45F#7c#tdnw8PY)vsc#her?C?_fAlB;En#VMAMEz~>eV~T|-xb0fRIqE36d*XPRW%}d| zu{2e&IBAQPQT%Sk+A_v+YUp?s4VlMKt0+0z{%oZE*8^G0dDO^1x*`WSZCAni6f|xd zQnbHGSvi`!f^p&r&)7tpbFr~G#qN%h$Jg6ZY^RN)%4;6(Ae|0BRf%$5$JoW*HZ*v! zLm!fgwpZKXeOdlMGEWw8>DAp;@MkNy`jl1{lprzmM*Xf?Nxz1$0GPWoVr# zt4nW$o*~y$BZJ5wGyFPKxhQQjw1Uw-Lx&9fQqwL|pKR!2bj;8xL+1=#GCb6Yzu7i^ zdt03hzuHOJ9R6aY=WRyU3>RfcGNc(U&d@Exbs4VD&^<$s41F?OktxUik_^2vbw+w= zhMr9I3?4OKmMLq-!xjoE`FXkKWbX|8sNLaE!RMW1-waoC;FtHe=uJf>WaecWQoyAXBkT<4m1SgyhfdM#PaeHE7%jms1ReVB&p7mLboQ86KtN zWEh!YRE9e;btu8ZUQRR*mI?37a8HJNGu);7dAEjpJINmdB zbZ7Yx8`Pl;A0|tOi3?h&b)Ua5p*W4s@KlDU+1jas$1?Si{c&nRh9|TC|2ayd&XUm& z|NY3tr_W?~HUke)pUdz(`Ow+;wwb{|s6100li?-mR~|+4csau>oc#>5GQ67MH41iy zFEYHI;f)OMvT?0nGyU%u@SG8=q!y2jhR4I&S4p4(RwXh%>h>6EbkO z%imypnc=Gp6EjT8@O6f7s1X@{%kVAv$=S*9bB6CT++EZ7A;XUvu{+DMJ&gmGs>H(( z4tdB>{6ZaUY|yzSPkz^P@h26zxbgf=#vd7POftCVVwOL-p#hw%3rx+x@40_vm_ioq zS8=O{J!DMFFg;U-dWPoAOd6B1LYbg({5C3PXPA>=E7c*x+zj(FEYGllMof$DBFcFs zV?n0&qzl!17%dnmz*IAwzY`oD~GRE|#44X4-(e{T2O5E*!T*>hE6@1-U64{<%M~0)+ zajIm7T^aUgI6yI|ZS2mlH^bD`*insq(&V%nBg#o+05vBwQ-2H z`a-2CM>v+o#w+iOhTVz|Fc@)p1LmnOTD3M3WJZk4rCy!Ejl+L4S9@X+FlUGYag*+4kmAtaFOqKI=@0DR;>LHBkdC;KI2cWvu$fIT+ zwesqOq{R?*Lb9&2EG%l&&7)o(>rHNBz87dU({_B##DpG|Zz>UhVIAFxXflSQo4F z0m3dVz|9d?sCId@&#R^CSZ7I9>Xb+4Jo@HwWgcDfxFC;<^XQgW2gvj`FU%`>qxJ5Z z2ZM26lt-m5a_Tik_q;kMzbubldGyHRk~}WWO2OK6^3z59{u?CJZ&$o&8r>m0Nq<6{dJbx zTTXEU?Gg;kt6koWdF3A5kOxB;Tkng}7a2F@!C>WlbaNhq^JIJV8id- zZ+t${SjK_8%wY1&rQ)xbl)uIsD|vgG7-g+t_r z_kzf`drJ!Yg2wNQVLyBAs&T%gkbfYCgE7#aLopoTD30M;Nja=OCzCBr{A@INE$aOf zF`T4i3^!vq6~k!;XAEDnQ(|~KhL2+SIEHs(c$Y!A#`u8qQVjQ&lCv?KQ*cJ<`%3x8 zN&ahc^x)_kGs9r=!x)|}75$a+lNip&@I?$?a=N1#F<|@u34a~~5ftoyJFnnw7Dr#NVOv-7=LrH$MBGe{3ia5;Xh7&Chj!>6KANz#O)?-G4a)MgKfOk zjLiGKl-yw=mx((~+-2g$S<#GF~+Cl8OE%-Z1g9iC0WiFj3LOt0rEfP7|d~ z{CV0aK~*NUj5j8|WeonqXg<`aU0TYRC~KlqX(>-rRg3};ziW`PNKjhlmX=B;Dw}9+ zqKy`>Vxq2zdM5UkmZ~PInW%1}20P^sqn3%CL9y435zzD725>=LCpV3lkyt6-0)1qO$-@oBu)4xIv+6t6A9K{ zR{ke8FWVShR<0Z|QYO+`Ji~zh+-Seb2vt6I(O{{;RAOSBiSZ_eGG|gY7_0QwLB<3vILpLr6BA8LGBKHBWSBA4 z#55CAOzfO&oKy>^tKOzdKum^h$Aem4Wy#6A;yG%33c&I8R$q0rQ52v6T+95ivrL|9&&!A6_q z#$g@HM;O@UqkoIPUOt+0j+;1P;%yV}Xh)nhvA(>VHqmUQaZ2T9mY26U3MLxl6g^|S zYvMf<@0+-wN{*D5mD7wfZ1^;z+ezcBHnZ#!gTIjb(8Nb3zBh5n#K$H+G4X|oFHM{` z@u`W=Onk2T^H-40mkgtVT;PS{yqkZ^ z$@Wt5@7V8ij3E`|vWXu|{AS`ReYMi~k^OGs3Zwms@so+46%hZT^%C4aJ5s{B9)1;b zD#$exztg-q#`X&GP6fHHZK0#CR*)MkqIKP8;iiedP2{#ful~cypHsbsJ1qRC^0!*} z;!gt>Zn1E0Md6*O^d#fxo5pQcG^f=n9gQ-&J(q>ME!<<_P78Ng(X>xK@8E?i3YTH` zT9FvR>E#j4qjlxAkk10=d1kR{()%quVBtXv4_PQ+;b9B;Eo@yL>E|MWpzzm`&POa1 zA8r)1qI(dNYz}iDV-*(aSg32^2@6kJC}E+bg{LeOro08i!qXO>vGAN0{9;R__E`%> zEc700@QzTiq7=1&l9AfyRi>EI<`t#JEF;T;Sa?M(e?hH!(ZWkAFux?`|7yIfZ5&h< zpD#B0RFqd$lI?m;y+Oc1UCKgP3*{`7R^c+%{{;r;94=tWTc}Ni)f89H;nYx2Q)w*=*%hN@8-szgo`w1r+FEF5p@D^ll;QBP(8xk#wT+R} z#6nZnKFl~(QJPt3ZlR@xRu)=V*f}zKiNsw$8+|tGFsvxGh8V3atgR>%<_+bhgmJ!s5wBN2LUvEc{tf2)bC9yx8c4jTY-#06;<7~*r9&m*e8T%XG5K)|zJ-7~$Nb;A#jYeN3uz03RY`{0W<~Q%wuO-O zZZ&wZfrBiN8ToLzF~q`93sa^=$zkfu_lFx)IMTu>i~q;LVhf`!jIl7@!UPS8v78>K zMvJa-S_=zOexij*7N%R6!4NHt$<%3Ks=8}TrD&*$X6o3PWkrh< zCTDAsV2*;hO6Mt^uXKThg$foarR2w|d5MK}7S>x>YGIj$G|sr6E9NS`S;N-8(=OS>E6-`iEI7WCEP|Us{XPX5E zOwDCR&&t9jC=J+YVV8xUEc|R?w}m|xE^xN7u-C#q3R^gBVZVg~7LMzPJ80pMg~Jw( zu$$DLA~TG?XBvxV7)LEks~oM(h>y|jGmLiAj1$_qCv)ZyP9Setc-z7U7CyA_j)iwE zyw9OD!N@h$c#i=;#yCS)R2FiwHyQUY=Ls0jS@?LXalEozs4O>@8y~6Ic?+MCZ{ZUQ z70wu!Cq#`R_)N#k=N9IUHJE&VMHDc9RhBO;T(t0=h3_?ZzM}Ume8X`u%gA3v+Dtdr zTrrF)@~s8F3zuNyL}S%r~$g+^}%P!fzI? zS@@kHT}6IcVK8*BGMrSB0mh~Nb&a1t*xgm+nDYPP6!I2XN7fuh^ctn-tw^6`G zr=!N~(Z;nZ^019w<0DYe2A7dsO_4rENmgA|tkU4J>i7iX2^*wOveL6g&DF+Js*2zl z8_(K!*~Tk2ir9Q;i()p4YwiXS2Fn^+^$Ru@tukmsmL|nU>8ipc znJ?OSNpp!CR+U%nXt7a>0(LaLzoxW=jT>i;l1h74l`=Le4K>Qy*!sRvR#mY^Doj+B zc~zw%b8Xz};x-qRZB()GiH-9%s@kY#BW}aDQQbxj8!c?Kv{BPWEgOw(G_g_J#-^%L z&&Cf`rH+lWRfShw8*9%-%Z!t!jrul78`x;5fVh#3$`_)nrmVD@G`I0WHECv}U^V&v zy0LVvak5mzX=S6ejV?UKvC+nk?*1KYbhOdd#y6*otkXt28|@V{S@9i%i~mkEvYK?Z z@z!dC8X8?TxQXayqq~iMHu~G>VPoYuqc=e{p~9XvejH@H&i=K*dN*Bf+dNZP;2hYk#b|kd~}29z*e6 zgP1h1k+8Ac#tIur8z~#3Y>c*%wvn+h%*JpVp^a=CgKP}8qe0CQ*2D-7#VD=UlHx54_B8NHfGwGXJbBnJ1eSsmW|mqc%Cpv zCFd$8pKrQm?F+P)g^W)H**6T{cHgAyh8s(iE@pI9myf3yOKmK(akaYKQ$v`0a;dS> z#wr{8Z5*(%+Qu3-*2Yf8l8wE?jIB1d*;r>|y^RevZfAel*ldGK<&B&TYDn1{!XqiJ z_qNcz^P^KB%5W{co#WI5k0$PzVsOo{%f@cnTtfydH}=@ky`xDD*{5KyQa0q!YasKW zjYBrxw(*XQ!#0j^fZI4>^PmEQZ=H5B5y9!YRE~32iFo~jnk@!Gb-Kk zx0Fx+yldk<8z0#Gdqw2uGaNFUyQUiN+u&N4_mNyHjj2nGbL@zv1`Ym5#VGkPLt?~jc;kv+z5YXgH9v3%s8(hKiX)t&-g*{nHoY4lRw$`+2)TcqJvN-FV&D=X@D;N zuhK0OjT^L+dTjh|_&! zfP>r)@;K3EujgyQLY}Ya)%Yis} z!9l%R!sLtW=!wQl4qkSmv(uVo(5;rd;^0*WuQ^E766Q{?B|JFYR4ZDImvm4{U02#c z8TzwUbfo!Kt*B|l%WM&ljPCTr4ugFVvH0S~uZDQ&H^jf1ud$ZzMMeGcxRfKBVH zP423if1hM@VO-Ug0(ByXaKqlHj?7$W^mOpLgUR&2gI??u2T3~6K_3Tw9mE`%PBhK- zbMS_P0S+8aj}E%7h(;gh8?DfIJziHh)sJ>C*1y0@|325GY z2MZi5aj?|ELI;Z+yy-+6Ro+}?-iQwR=4>?1T%P=YyC?c;m4nqz zbUWMXpmJSV<6y0Wbq*fdV6Y?BJJGgrqk~NjTGf>en(SX!hS!zN4z@Va_GE6|=svhz z={5)3>CcVE4hK6O>~cWYaRYU(uIyG}9&}Uq*SfOL!G6x44!(47z`;QWryQK-SaWdL z!4U@!))P9a#L}o!=(nQ|j&bU6aKgb!8Z*Yoswe$M8WiLCHrMm@>&aUV-ga=t!TS#0 z;Sif)yvNR(8imcfn%w=f!PPi}>a2rv9BU3PIOtX{+JXi3PvLBgKr#s>)<=(FfhL7B)|nc z4>#(`p*_YA4t{j-vx8q8{N&)zUybkT3D2*hYr28@@+-&M;^-q9)n-R=^_zpM4*#Qs z-yQtt04~0o7HvbWJNSbJOf&ve=Wx$L<_%V=N#dId{#N=A$EkwPH%4MS1YkgRUSizh zMh5~^a=VK=T)gI?goj)%?sPH1#Y7i(xwzX!GZ)QW+~eY27caPY(M4_-d0af<;z<{I zUF37|h>Lq>kE(aSg?$X@-8Z9b!A;i8s{+S;6&F6bGa3>R$>nODa}T^FMpNCOx3 zT;xA))Ms@ojj9czQ{OfX#B3l9UA(DDx?=DNqp^!7s;a5B(V83?*}_Fj8s;K!(aJ?@ z7yVtl;i8R;w)DJ<-Y(j?Xz!wni>@xXee2+&vx1H;I=R@}K<+pe?dd*lAb&NGLJfru z?B=2;UDQyzyXc{nvJ1Es;ua~k%6MHlw3!>CK5n!{>g%F@Lt&D*pK`b_=vEp7RMK%V z&_&FJsYzR@r9RxY+UVX;7QP>;qFY>c>xYKtV%sVs?t)olCR`-7NLp#Cp`=`J2g-{v zlW`Hc$aXQv#c&rRw3`OIXn4{X>SBl%ncq;TaF~nD4dsOD9LacdF~-GM7oRs2zL;P% zcXN$|0l=H`IQsK1V?53H%y_I(^z?xtQKFGdaxvM(&n|v(F~!AH7pGmktY`3Z6x#AM~%d3Bs_NJCho>XgHLJ}Hj+mM zMSxFF7Q0yDVzrAkE|$7j=3*sBYhzjNVn-uc;etE3Pa4V9MnaG^&RFH*>Bdo#bgheZ z>|z%i=;U$6lnX}L#==v|jT{1FqvR$xdMriozvNc7)Wrc82VHD;(V?;Ibg|0?H*Pyz z#2ZJCfw*1W&1iA4&yBXOd)V0V#`wmvpYzOk<3eNMK5=Pd+1FSOxj5|NsEcEqTdD~+ ziTnOEj;Q>9^IA_zZzq+{M;wcY>J^be4s*Bq_+~MIG z{ovwn7yr1p?&1#)*nc9O`Q9@Abn%yqoAkgby{?+Nt1|PYZC30|78z)xYfgd zIi7?EKD%UAo~BZysr35HxXp{4T(_y@@^Ghzi%liJhr2x7?cqKT_j|a=)nJZo3wyd!CD?x z@QBia9v)RtC@1$Z1&@1pB8T&&0yg|<56^fg>ft#L&w5~Vy*4Ep4n;gvI~|>J-1oQf zycY#tmNu=J;^H0*+Np;OYz0jf4=;Fl(Zfp~UZ#;A&`b(6i_RSA5MD1dlUFIzO!)R= z(vluZdD!J)w};Xm%6RZS1RlzIDCeQQhYlXfd#K={riWTyv}CI2p{f@x7b|(F?4gPm z?TfoLlMc(GTYSxCQq2ROm`9g_8g%$O*M;05L|w6f!AEiwouwqDOIru7aMInv{T`>N~caS zrZMi8E8udayN4bgdU|->i%!vdd05{p zS}Pt`O3-Yt!EJb7Ey%?uPc_MW!@~d%mIvF5*5m`}92L0SELwG!xMG+dZf_o8$BTZk z5ci_xx~rH>Plab~i%tosE#V>QVX22@9#S6C>}wA*JY+nC9!9aOhirD!2xE|k!3qjB zmmwa8dKm6ugf?f{bmNw##xM`BHJ9SwMu*QMJ&?m=YJTs`nr)2nFqWPlWlZxhjNXcr9vx3+rJJHv>l6=D8K1g>WfuKLB{MzD@-R;u!WPZ; zFvp9|lpZS`_3T{5T(Xig-{apCqTj15RN*&0EMklH8eN)4r%a1IEb)*~U$Nli=CWMH zwzKvv#tIKBJ*@JungfA@sJX21u$Cj2R8)hdng88Qt8EaFDi$?&ill9QSa-!$}XP8Gg#Fsq~Z= zts%Kga$3lhDaMIo#ycL)czEB#yDV}n;=IQmZy^g?$XOLW=Yi|Pf?Ow`H9k;Iv|yNO z9BLsSb5MU^eCgp6&Xa?T^Bz9+@EMEOmkV@PS@~S$xrkzsFO)+jbD6xzP}JhYUwb&O z=6&bkdk?>RxX$q2XbWaAGHe`=9CiA9L?zbI2y*$D2~Q)G@&P- zlRj-^h{`mLgBmughBFX)6WW%BeQeN(Jbj)^U8*M%pMPXse)I9PJf! zP}(skm-cjtqiY;q9Pv21#nC;E0dWkBqemP)S~Y%xD|=oMy-3FypY|Sl>2E+A2xl#^ETYFbmRYC)-B8^5aOx zk%}WwRSAs^%ClZx={PR7l}tSPA|8`r9NBUF)mH9n7v)lHNE}1sm=TZONjof#;c-mT zS{O(p;usyrm^el%XH*=l_jxTiHjZ)HgA>@H?V<+KtK+G;Rn!Y?>_m3G8aX+RDRFdY zCsS#EJDH}csAOzAna-GL7s=0553{Fcscrk(MKAN88^;#4YMxSZ=Et!>@j^C7!JBcc z&dFV@V2RSDaV+~EU+D^^EC0v2RD6{JHh)bHXKfto6t7phA&0+F!6v1f)pDA#HI8j@ zZ0D$HCp+WVrTiUA`EuahaqQu!WQewxy>w9=hdEx_%YKzV7{@d1SYm#ND;Xxk{`N;31fR879Jn7?MKXMnp7x0*mN2uAyqsl3ylv$NJ3BB67Q`Cyb zeNYem{FINvs`gnQPy2{tQNc%DAN71xq_B?~K5F`??4yd0sy?b|jeR;x*jeUumMu!F`*^Rj zTvpArp_a>_=9^z}i&7fLgint$ygZ}=F% zhWj|#T#185j8P=_9Bs0{ni+4@Mo%Xs>aMTKYFn? z4dWy>lLFetSw3d_nB!xvk1Z7QG0(?*A1i#U^s&IlLWI~{9PrP%->zM`PlAbpO5{F?Yy$X$4(!+w8j^@%WejLciF>1q`6c={iM9Q zcb5aI_K=UmJ`QpKc9&H5NZ^PzfytvPK+eqW!q1=_S0yKWob+*ulRt;N3Q*fyK7Q&h zH0*8Ktiq?d3&FeUgj_x3eIIA(r~vl`IOpR7&Tm0<*Z9!KM?Svx@eN~%%S9g-e0;%v z^l{$Dr?jMpeCFeG4&)xf#Y3AOGO$N<-yhvWmh_M>>2~tjno1*mT+-xaA3tys>nRm`MjxGN*HeDxxJx~Dcfc>@$vpw?4Uk)N z^9Go&O7aAeRgA8!nxuR0*CG!D(JS^HPhXdZ0^|=+K=IYrg`a22(@P2lIDV-( zujdnZG(aI59N_T)-v;)?=fK~yX4)9EX*8-FX@N9r00kQ%} zfT97v-X+fmC>G$k0JVEbr(XPMloSv6wI5K13Giyb zZ{k)(lnziPK*a!+0+bE- z9TR?=L&^pGP>8TONg)Kbu|kJJuOCqTUb^#j!9b#K;?KC-Bf%zh$kUGA(sedKH(i51OSd0$qe0F47Q z(}KTHbHEo+OH+1eUn$&ITISDc)mNGaXc6$e$}+C6EbS`?`%3EoZ34st_yO7mXcyr1 z0KEdV56~e%mjGQ=VMlr_K<9v;A&^h{3XNnHfAp2S{iIs};vNBd()0bKdw{-=W?gwO zt7^ZfUb>6Iyn2(*&lPXY1aei8&o1Q;4%7`rB4R+5hGFJXXGfOLQiefV%zf&P-! zUkLu{C)oi8u~GdaO9nHxS-iinyB9x@)%by|;Q>Z4U;>O|;Psc00Vd|l8qJ1569>PJnj}Fekv90dhT^HJ7e21FgVn_)IUmMUlT0HG81 z1=!DqKbH070NGL~>&O7<_hi;>#j_3tI81{BoCt6vz){ixQmRnaG1{3s>y?30XQ131 zz_$d*$pEJUBp=Uun**>=R_B3oTEoU2C~pP$xo{T2q=CY|W5B!@;3750Evp9J`TPN24d@?n7Mk7T{}K-M<{<)eWArIm+ca-Oq6Og>`|a*m>gN3!a~B&$Hy zg#cd!_%h%h{iI_oib*#nONwT#hzU8Y=qs)6>j2*b{2y7=`(%C};8K8x64Cs2IlvDA zZUp!%z>fib;`C+8b&Z*y1N;_%5%r5E>GNL|TnX@dOzt(KV7saU*OdOQ!A#~KoP13A zQz=0^Q*H+MTitSB0{;Z~mosGEta}sqF8~s_Gr>PQh-=C%3EY;z?FrnP;2%{Y&I(iR zNbtWKQPXlMAd^?!+*x-eaCahd#TCuHCjl~oTbS){U;8CT868sUhP{R`mJek0=TGvwv z{*qaqN#Lj@g%v+dWA4o=_+-|5#j-xPe?g*Mb-8x!cCz#9qvNKfh|&?JGT3DnmlISmvv zRN5$k#tIJG@|i8nZI(dC1Ue;2vlAGUz~BUiBrq~ZW@rM# z6%WhdeDBDJ9L(-u?V}PHt(-AA{IMKOZj?2FqbY%J6ZnqNo4{noRRSjxn3BNM1ePVR zJb`IiYEA-k6PTW(VMYQo70=4y%x2iD&UwmtGlxH4!2+cV6IhhPFRQ|f6IhbNS*oC` zD=Rqq64;W!)&y25bA67?Y7U|tyjHD6jQ_KoW082m*5lF$X5q6c`!%vnlcY3a6~yr6F8N@|A+Gm42f%RQc}{xWrjEiMx`~$i1AvuL)d9;0Ki<=f?zo zQv7oc=NAPFJo!z*9|`=a;HuJV3H+{rWv?sP?a2)V|0M8l0)OS?-b~`?{9o%Hj7Q*(Bywq1mL~5`;+`a)N}_NQ_bUJXBpy(ZJBd6BSSqiA zd`aA=pt_bN|G^|4Nur=KA4(#Bj(mY69#-5@B_GYlN+nTR#rBLunIy_4F=j;6#pRMHpTs9aaDE6XBvFy_8Jx|aQWBL_ z{=CvEO1mdfRRIfDOQL!bHIk^QoF+*$RZuI5+6w9@t(!zW1@)6?q=01`B+)Pj{}PwR zIhf35irXq}uC#^HmP%VGrH0l?v{B6BOtw?pUTKFUIwsL6iOxxM&5{3KbzL<1zk=QV zKO1@^(KCtHljxO1?<5W;aVUvCN%T!(X%fql=$AzQB*rB%K8ZJy7?8w>Bt|ANFo{?a znIys_%p|NNf+Rll#ZJOW@_0x5B<}X*Szlbb#TQR0L0mysU*`I<%NG_&P+rTXlwS2E zt>D2xB#`VR1}8Bji9s|wkO6^=4rFK&!;%=D1o7&CtIA07av-@9TuyK$Afu8bez zOG@RWOiyBlN>aE>Qf4JFJBc|-%uQlm67!QdpOl+Pc__t?B1r9&^iIj3lq^Zf(UdGo z;_0+3PU6iZzDfzNThp>cndQ^MtmR3pNMchGJuRy|vi*h<%BWLwlU>`G#L5<6%^Mh<4=(~R8A z$ZnPF7|Na`9uK8@D8ze{*vD8>ykEfq`cspK=}%Ao%Z_62ND@cc@KBB=aVm+^NgUVY z38g1lX(;DH`6HCKl6WXvmS)RGNxYrJtJ%^pTi!|HT}D^7yqClojy}c1vxS_qiq9$i zKq;9YsuF^a8JyYjiPD4F@}(N{X%e3$@p%##lK6scOk;5xUnX%eiSJXml)_g@e9g9` z&?$v)lK3`>aw(Kg;X4X&woD;6#ge$3#D7U3g&&f5bdda!#GmZ+B!1$QGDv<-V$>k{ zokM<*{F2143W%>L_)Y0m_C*eVz#yUgb(*T+MiPHk-h5J%?JcTDxxIcvlQYe^0p`r3%3KNFNi6QcE3J)n} zGQWZXO4kjMuZGAY^yCovXNWw?QYn-fD$R$=V<`+AD&vL<>FS~KWD3uu@N5diPbn>| z^yw6is=!x6rAP|phDnQIQdG;b;ByL|XOoA?Q^Uj_CPoU9!V4*6r7(7wEFUI^hRGMh zg@+44$rMVZuwb~9PNDK}={{UYGsC5fGRvm0XSkdn zE)=McLd6ssq|h*hN~vf!Q6q(#ER{l)6mATcswq@Up?V4hM#yU;r11#pH$ujYkfkG} zRtmLKXf;ymrBEk@{UfAq3V)4=#@A;fyWjglgxq#3IoB`s2DnL^u9(p;0yD48%yNL!`QI)#;^^EA*jh6l?3`pU}(eg$LD@F^ilcQxI18jhPBw$jrl63W0$tX^xkXDdqtP~q7EEv-Gv631qgHsri z!sHaDq%bsvVJVDEVN?pU$I9>&ej6)!#>t2jwvUx_V}*2d3S&|j&(KZb`EfFq)s2%G z<76DWa-4J-CuB}cVe>fob)4KYUI-?oaCTe-rlv40h2?B%3e!`Vk;1$b=BF?-h3Cf0 zT&1&EwSwy7h0Hnhvw}h6WdW~Lw8mJ*7#kl=l?zi?q?|XEE>=qZ5(P^+Jat{i*#2a^ zTpcefQ&`0z!=XAsj0sYEg7lgogD1$E6i63Mi0*ppQ`norz7#g3urY;AYzqT8kliV4 zNntC;P9Qs|B#>=%ODeio^4d2cq90F?YZGK=3cFGuxPM}l+>?SaQR+{W{u570qYui;nwtS`ZYo*^P{Z{FBO6N_MJ(J}!C;t?x zrco`8A2~=F&uQG1#?N%fWcee7KU4T6gqaH10{`5%qmv`V9O8nb4} z)>+afjdQc4t?Nj((I^s*EG6ORT|l8bWfuPdn%218a>l^ zJ&iXQLTNObExpp{oyO|f(toy$nJsK|Y4lh8&1_-vwmC8|4J(bdbL5FR z5@U4D5mRaTITFkfn;uAmz*Ra+nLgV)M^fzBxe_QoJ4X^}{5nUHn#?;_(sadK$tbNo zSBMAE)VVStjfrUtPGd+KL(>?>AvsURvr%(pIO8OZ9dl)bCdnC@#;6=TI*l^R(^xkzx}i)*2`Pugm71_LjY$@7Gq z)AM9j8ne^U&E-2y&f`#>FU{u5f^@X%m``uamooEZVH#xeTBLxtrzL4DWvpgUI)i0t zEKlS8G|r~6B8`=dYC3kItfIHm*tkFrq_HNAwP|dji)a`}6BoDhWfMDYzHDGi=L=WV z8#T$WA(OeA)7U#-KASIp%$IEp*9EdWjqPbLdH(|0kp}5bcEkeNrMTt-*`s2V+?z&n zf$Y=dex)-O$iXxYrEz+J98RO+LOGhoW}%SNYM~rY<3t)`7s^RWrtub= zxlm4}v45d_x={XFC~s@i-b>>h&S_~BTqLh7ium;wN$*8+h9hW^%vmJo()b{a{23I; z;KMXNO5+y>37M{ZoW}VyK4n`L$tP)?StP$Ll6-Hb$ zQ+iS9S4zKD`i)Wwe9M{V&FD7$eGcc6g3D?Aki+>g9o<_g!@KIwX*76K>^J2KCuGi+ zoHWw7%7L#l=gl;JPvbggcm~g#!s`zOR}}x5#tj<(rkvAc?#1%lVyU)R{^qQ;Sp3EE zAER-x+?I(fU%Ob4!7Uk_UM#m}@Z)0Pb@vjvJ%c+k$d$pJ8DuY!hcdWJ<@07xb&1@q z_#UPAD$T8w3iD)8WJ%PDe9E~`>HRsm4`lG5;;t$~&2yH>!x=o1LE#LZX4VoZm_eZo zexbk;c~m*)mdIlnJf6W58RS_iHJ1u=pH$4`QyCabh2WVCo+Zv8D}(M!`4t{Km*FNC znWa)RgSktEpcoY{mAuQOcm`*d%Fj!MTgVrdiDb}pnY^6AD;d0yfw@dx%wWPYc}Xe3 z>Sgk3ChDLPN?%jTx(iPG)gT@(fgYffmX`)itE68B{WEwYg8`c4 zUW_v2uU#cE_DBYnR_bKnDzKG)ze;kgmZw$=?Wwd{{0xE&7G$t6gG2_&48~8jh=I=GpLSjM&6Em2V!E81sgUQ5mWLgGOGI(^Y zG+is^S|OO4K}iMERe&-xX!BZ`smYaVWljc1*UJ11x~-GB8O+Pz@>nZe==meAoDY{+0~2K(0uuQhB@2Fo*8p`4XD{PXK%RR-7B$?6== z{p)3I4qlf5x8yAT(t6pL!B&o)3^rxJ8+85kvN?l3>tzeQv|b1nu9xkM_PO%+dfB^P zK3y-nGT5ELNp^Y$dotL|hGcLogMHMW!66#CK_1;8WjDwHM(+lRZ{RWsQ#T0l;SAo{ zAV-uET;3qZGq`(WwA-z+QBEi>vQfzCuu3Gqr8>Ds*UnCOJ#6;qmc9CMtN7W z-cx#p6WXSTe=dU$GVli>7=#Zq_=r|zV}CY2&fpV9U^WJ3<9sx5P&ylBvhi64pHn_W z5aL1xUyvW7Oo%TtxR}9hA#M-xRR&*Ya3zD^=%NgYZj$daxRk-Sioa7@Ws|huB$qSz zfm2)t)i+D9Nq)@Wrwo41VA>{Gw@KdKBtLAD+?(aO&C+qR{K}BtEK@ei)eP2dmTMXO zuHe{axt_rv8T^+4Lj0M*jST+E;3iGlEdOklf?K4_7Wtc|j+B3u{=@#=PYBE*v+ns1kA%AGHM2LrWM*Np|M(2>E+^v@l zQ7%No5RF2V55d7wIYbqLol=2Tg{Tyw_s(b$J9wuo+$mKUqI-y@ zA)1BYVNpjqEkuhD?HH~@q$TN4Y0a+RB^!20E5`HW2($@td6%?Rde?3t<^!_!Aqwx7 z4k0S8%f{XEgC=`~=o!LhzwDLQL-Y#KCq&;6ckGeE zd!#o#ut(bN5qppHWAC#G^JQR&F?(c%UT=gT7!cyHCSxHk?h#(50xQHnd*qS5;)HNR zcx>HXnXp&lA(g`7U?-Md7hnNy#QHT%s%hV9lLd;{S{W6^azh7o6C77XLW{6pgwEfWzg3LJ~ z=7wmzKf=9~vfz9zz97Ux1#|YxuKhygZ-!VL;@W;$qIHpz?|{ewSsr3*h;8(3h?OB$ zg;*V8Q;5wWY9Ej_A=ZXi7oyVvNgR;%?9c+axTONA-)fBi7pE9QHU=X{OnndjziI!-jfGj>>hRQ!`t zMn1>muOY5*ZplXeZ2T7DY6xWGmTX)L@p}l~2mc8%?yy|v%pc+gyE5SXgLQ}Hox}21 zh?^n)*6D)$?+(kIN95TfQsYQ;tk>;`{L7gkA^*`=N22Few`SwEY~;yC-fY~SjXSbY z;Hc!zMy_luI3jmtM?mP8>wSbBpW-9 z$%n^e_Ax1{9Ii~B&qlFqMj>`+#Sbkhy%*M&%Lhwp9 zzCA9jPe`e3K3c-9C*(ESa6(EbzogQ#CxkLw_Bbb^&@G#dy4k3gjdIy2pN$IY4f3mJ z_-+ir4(N6sLKi7X0c1r;PJvN_G}%q$>+pa`Nw5hE(1q9T%W z&N=5Cznc4g^FQA?bL!NszTJI0?(EF$Y=#$>__Xn&t*f^a(%y>>LY9a_CoejC(M6PQ zf?Wk!&VS-Sv!@rmL>%tL6JGQdKFo{L|EWG+4De#0C{KFP*NdmTcv{S71)mXQY5nEy z?Q>%G6YS4vu+C`+k3pgg6&&ov5Fyl`_x|rrG5HH3z9?8zGIm*~Uh?8)QC{)lbuZrF z#E`l4nux>2ji2ny{-&4r>6{5Of^$i}DU*}Dtj}@)TE@DrA}$yVj|X1nD-ziUkiRCxJtP!{EUi>SB&KtZ~EBrrKStn$@pl`j}C}fl1WA|s z+g#-n32BEHJ4M;$>bt$zBYdSe?Dyh;7gxFcig?hAqh1{2NUc|gyf`f45kX$t;T4|a z!cPgF5M=EqgXMuHvXCC4`!=ZS z-2Ay)`kX$zDM=5xuX=IIi`!n@5#@p4T|v6t<8l+8Irmry#mAx)_MwOmkkYaUX7wSP z57~w17R(`-Q!tkxvwyZhsd(1$_=Whkg|fsd?@Zi3D>8T z4<%jBa!R|rj1O0(v~r@97c9EbiNB%`m3*k|LlqzDi(XZ*whwiDs3x3l)rHg$tm#87 zA$6sMG~wxj^z6D(d4wxh(LU4_Ue8rtmW&O2Xy_`9gf#Z?uDvrNJemq&6)k*d=|eXk zy8F<|ht{HZ@F7D;J0Iq5RBeQ}6=dGnM%CWsyi?XucqhTmuHMCmuEIIhnWcvhJ$-mp zlwN|*`0%WdCw%DbLmwZW6qC;UT1V_F=2L=C`~J6kKj%X~9|rj_SoHoJM`Gyy^0{ zd>A2oq^rE```^y_t|+5ieYBAG1jqO=R>(Lvwf!ciy%T*{>BDb6yf69(K1}lALmwvl zFvo|_een9=^C9KK6dzvPr2IY@J|uhy_z?6Vjfm}j>r^6XnxrLAfUGp5utTh(?S zwhE`YjSF+DB6)kO+QEV2<3m2|60%!xPo_9o?e$@w%l8X8z`3#2dEDr*4@Z1B>vK*! zkNWWSRz72cQ{0pmt7D9Ct2!?H1RJ=_xzu^uhof5+zgCMA>Mo8obeS%h5J=6wCUYfkxx%F*V zx5d2U!(AUbZC5;=->%-@u4Zgk4}5s&b8dV6uw6a!@j)PL*{hSNKV0Ae&>rS-SYa8&+lw{8+WPveiZPdt{?SSnjeMy@c2=9r>eI@751Z| zAC>&*xkDB4uRciWC%a7V(*6}0F)i+8B#|7{1P|6RrQ)xe**s0#!sp30T zeLv>!RE_;;;zt8Fs)l|v68^_dXJPW1c2hqx{AlAxGe4U9v45w!wbQv?(ZY|G?2TQj zm0)W>^e#n{w7b(kmo&W-Foe)MM7O;%@jDPqpus>*KF*AG74 zz~d<)Py6vqrXu*9V82WyrTY6Zz~uwk_9;%rA$~mX$IE`a;>S=wUhu#f&|Qe54<5`{DJ&=f^vKyvyEL#b?zp%8${0{ToF@I^)#;|B?kZF|&M zKQ8Q1<6LDtixoam@O{A#+|)^a=Mh0>oa{&2y{i9S=Q@wykANR@{g~%R(2tOxZ%ub5 zdDxGLA9?qwIetX_h>3V^FaQ1th9ArKsu`jr{FovnDaec_`^V+BkQ8Iy>&)k=u0G9= zkAzQmm5=>Mi4RMjDdm6S$1EXKX8ZA}@XrJ{?^P6Q?o;jesbTw^lD}ZT?NbZ_`bv;@OcqKi9TxeqSojh@_^oZJtAFjsGU4C2%5ouh_o?sw_`#3u z96>H3#_Y$xeynB3`tdV|*za7V{l$-8{aD38oUKakS1bK^bHDnHvuMBSvtLE`t1tGe z-x-V_tM@zi%KsG4)q;Ns9ub{I{o}_PKcBc(MGq)_z`1n)pC2C{P+R?2$L{@Bt@mSt zkd1z9;U;rHZ4z^{ARW3Ka5g|bAF@p{GVdn`)J{Kk`EgSEd^dwXp!WN5z>htC?Db3>w1et6yX&Aj#5sIW#Sf~(ejH(Y52~Yr#{_Beak9k+`L-*^ z`QL-;lpm-4IOE4zKQ2p+ye@Ihk8Fq3B|pyl`R)|O2~Q=#aYR z$8|2f0EPx|!_S8^Q8&ORHgSvV%a7s#lnCICA9wx89YCG{UloP%hg9|eas(W5-;b$> z)B}#`A@xx3ksptRAmE5u1hWd#%of19LyF|&A(bdh^M_TgBdS;c)sLvQ zM^woGN(E3pfC>SW4q(U;HR*^dE2K=odG3@-xd3J#QT$2E&qq|n04fDgHGpaXR1RP} zi#n>FJ*uu9QB?vUZ*WwNI;yG%P&44{;p8;}AR0&2f}^Td0JTMDQXL^_g6RQxTwMv# z0jxf%=vF^~qeoS<0GbETAb^GeJU*%#1<)jbmdBhOzHz|0G+p7CYAQ-vlcV5H064&a>ts+{2a*3^I# zYLw{joltxrbIJ+zUI1U8P-6o4Ps$k|0Ph-44B&mX<%F6LK<<;yIUB#Ueh|RmlPVOz zBz9>4R3-=D6GHA~8&9gXCmm0}hylT%AivnYe^P}5_~@isep1B(hzBr@W&lP2>rbjF zoR+6lf~z0^Qxsd!5~Kq+>eDAxDuA4)6iqr$l`MR;W_kc02QWW?FQpr21n@}!vjUjO znR80@JEcaQQprT*vP;Nrj@=o>j0?`Fy{z<%bBFyv00#q@7seN1917rY0FA=VzITK>LjWg3I2Cft zV*y+Z;97vU)o_A(0H*>tAHanGPRp>K3E(V~&N#hsE&v{xI!%ff1Gp5x6%lD(c2hHb z=uEfk+yvOSLHrZMO>X{NM?t(9#BHt!?k7RC4dO00e{Qxx6bs^h09nrRL3%t2;DPW; zXBCyl0U(G1K@*ZtCK*>c6w9P!NTKsC`bIKC5z_QzS)#;PVwE#e*mjMD-wQ1W_^wK4e=yhzdcJ z3ZirnozJPE=M*2TEfYjpDpMR@E(ks}OHwiDJmvfSIaMi$56-EX=Tzk&X!58ML{;I{ zTxHWaRWr!{kj2dNss)1yqD~Mk&#Oj3qy>>4M8hChmnR55yL;xG%6eWY;aae+U_HV5 zf^=&TbiP!QFk|`iilsG{GMfa^G>B);t7c+07i8-A^XhxL1<^{BP3KkXAcz@3oI9^b z+6B=*i2gwg2%`Ty5=7S^x&=X=c0qNg!v*KA`iu+e zg$ruZ1@+wpwe^B}B8c8WzReZS1kopmCxd8rQS}Yt!UdJ*qN;Y$dDLg{MfFq=<1ea@ zFRGs|s%L}PeNpub;<+Gb^434``bFnQIs=0k6vVI~hI6)DQiIuDLH^aa8p7VYq&i+w z&j<0sCB-C)F9h+Tq<$(Ue~t1|5HAPuN)SI^Qu{8c+n3ap{FGr0`|MPxd;O zRrky4tsq7OF(rtpL5yT1vM4^}^br0|5bx6AvKke{`yBcpMh6kTtlkS^&Sf=*Ra{nM z1;+`F7o<2r$iyJFT~;)YUUpXBBrc81s^k^b@QRuogf|FZ5Pq(mD=NZ{NN^foRrRm(hbriORhdCpLTtg5AoW+T zs%b%d6vWaXz7Aq~5FZDzfa~I#@?TXmf|wV?7cBp(ni<3=LS_kmdR5KNB!Zs_&I#gk zA@rXc#IIMKLgojZdvIR{oo9nd_Fq+B38#7Ms#+MtBB^dM=h!v%>NRK6Tf$yitr}cY z%YyhO=F*ERJMCnPT>1o2}KpD}DXe!Hetu)~A+C5S`U z)UVtGuB$uO6giKTT*ac3uL|OKm;Vt2Z_H6#9Yp=>>Mxc#%effRrcZC?3a!oDe)Ic#7HG)H6Znxq7;tlQPc-k@cpkcvCgKsV+*3 zE(LKph*3Ayl_0LN2W~3srdoPaT?^v6m^TD(3ZA&B=x~cW`7MXs4e}qjP$q=3A>3!j za+eMvUkDG`iU|txQN<6|N8EvLsmFqCZmBGyXBEsQ$YqjUNDjfAA>9R@_$GZ>wv! zRTVaHn)A?I)ex$MP+iO#A#}gvh&A2Rx_4CV5bA{R@*R~Hf+qweJYCRtM}2lj=@2@E zP~xtt8$!Jh>W9!k0%#pVLm|xs**}d!Xe_*mt28CK_$Gajvk?6{*c zT&0bWwrsVlv=8B~lu-Y!>Ty?f4xvj3<3pGb!s~Zc*ARw;@O%i}*t8I$^a-I)2v3I4 zGlX6td~sJj5kl_}4%}7bf8JH}xpP*mPgux-)yysk>DRo~pxUYtW@InY`A!ojkyd>t!g0F<|s*u+Nd4-t{yjsgs#NPMSTOqu1U%eN?h!94G@V1!m zhVbis6~3?D3E}hmiVieKi8wlhy<+lFoNMA-K`h{a zK2+a6RGS~F#Y|nLmWJ@PkR>6Uf2eXiQdJ+R){oS(5T1RcMm|!;BlRs;aR{qJ_$!3( zL->I)gs>un1&`E^A>gqp_gJlaq)t9kKZo#32!Ap*KK~iQ$`Joh%yIjT3*oUE^H}lu zK#~EE)$gJ+=?@{+W3}|L`tPy&JA{8YvLWmXVND4Ca+rA0l>2`O|AnwAgv}wW3pv*h zvqD#ZUN4;H1|b^-Pd`@8p|^yvof96Kd}|2XLLkYpz)9L6I+Jz^8Nr9XN2}c-?BVp_ z$cnk24S_xu!f_!7IPM`F3gNJrM+NC{gv$;34m5d@EcygDmMnT=7X48c-6@M6nnj-u z;Y#<;?GNwEsTpHT#}K!6~bj9S3|fa5m**CeKda6wBwrY{vg-V9Y5^ey!zd)AuwW6vqJqT)iwm;k5@EE@ z>a>nWX%TA(mIUPztXpW!4g$omJNn z!Wz@UNDsp!rV?xzh89xS^{E#|ec=sUg^z{&D#bPqqe&P|!)O-9b7Axgqj?xD!srl2 z$1qxkoo{(X#u&JilryVmo$%o0|EJuTvPE!{{AGpD?oVe|^4 zo49okqlc96e_sz-R3?8ybT%zhc~boQhVfL`Iiq9kPluiJy38<0o)Pm|xAy*F3VHhumF*uANVZ0c|urQvNqK1a?f*S)%%Pcdq3UVI9rR2=0UJ2ukFy0K~ zRjKGTK?eD{5I$1!maB{sG9rwTuJU#m?+AZaaF_J_XgBpeA!EWAD`cFj^NFU3VZ0y4 zj4)=3_(2$nFp^J+kSQVg3pp|Amn?yIvK>?_sPBgP#I? zfbF$x`j0T;+4Q1p`p+;{hr!3^{u2CK@E<{nYlQqO$gc)#v+0xB^tv!AWY^8I>!-3i z!E6X)V;Gyl*c`@|Fdl~SD2%OPYzyNoCu$hmIjJV7-C^trV@DV}!x)ua^R}s#UGHK) zWY;8n!{EL>Fo!-A#=bE2vqlD=U02Pa+vd>xvH3xkmR)Dhp$~^KE{8rs{~Y?L;4#7D zf)q~(IVpHb@N^hw+|*?`^!YF@gmF8JJFFsyz8J>!Fm8l#DU8dU103QUIwPmP8b+3! zx@t~+jRTZZ_s^+6$fO z%cXNikS78@N_sSxp8u1|8^PmTx=L={Dz`2WL6Hb{=GKFA>w*y!ih!hW1QT-W8M*a} z+?q*`bL(PKWAO+|M8J1zl#HOfD5b>Y@9|4VP=-eyT~@H1AWfbaSBRjZIP>0jB_Wjs zs|Yf}su5HZUOj>u5!8&JRs`v8YV8Q>M35$C<2<@=9!=!&wqT~NBG3`kji8>mHHe^L z1oed%yWw;~qX-&D@M;9FMbIRIrV%_F!E+Hbi=cS~og(NQK{StU5y7!My0!3@5iH81 zTSf3s9?hhT2p;9pZ6YY0SGN^xC)i$)VuuJi3U8cO)9jm9cZuNXh;#bgHG*ytbdTVz zyt-Eef9KWlyt+pOJtH7lC?>@xBIq5#@w_@qKHVpRCnF%~EBKTkeW*MWalRB(%%|Jr z(?jyMWQ zXui)0%yt#fJ~p9%o)p342)yKC@+&`Y6F76bfaWhQN&FE6#6K9}D-Crtf=~qE2o4m` zk%)6mfJNOepi30gF>&B~2I4~c7Sss|BN>4iffa$xsS-t#sPhFd#g!GoEOD3;!BipB z1ey9#1k+vqaRf7j&lG&KptEvkNARhb$0GR5_53`7IWFfb5#|b?C-_AK^CS3D_@7)^ zLcWS%0eh0OF@nVr{4C-U!S4iF(b5RMcKNahzH#|-A>Xn$B%bfZ{J~BAF_Q?c5Tqwd z`z3;3g{&0(O_2Jk2!40@AM6cz42k+*5$qBDZ!Q)gYXmn5{u{wsA^!=k6J)OSLN-LO z(N!`F+#JCcSJ@iDHsRYN*ul9We7E2(*C(@SjC`-F>=UwI@IZvWpm7>?Nbs=W5y7K^ zOqx?rACKTf1Scan6+zx8@*@R?|B8RKw6p|~7+^&)*>Rf`RbN(m_L{T}4Dp3@a)Iw1d zj^cGGwn!93qbMCknJ9`y5fZUf6vc&?5d6H5E-B;>N#!S6*(eSb(tISNd=%xPxLru| zC{fr^Dny;9K`IJXilTvt45Mlk-xt;mqo@`|bqS+J6f+C!`oe2QQAEe6FAoU;b8D-z=<~x@EQ$(u{9` z6VgJkP!XqlTSd`2ii{}QMDalslcH!VslB3jB8qlVw2z`g6!nVeE>U!iI`=d?Mx8yj zlVE4To>Ek|D0)a<7TaA2AL}CT$@b22Nbe~6MA1Kr0a3hCL_ZnDQ&G$>qJu?r-zazk zmzR<0_O#@ECW>c;JSW&skg0zb(F3Cx#IY-?--%*y)cK@1T0}n|#SqtrKQta1#S2kT ze=!RF4D;0}hKV_xKJ(Q}f+R0965;pRg!#@7HeVC}*Q0nt$eV(12{Ls=6eC^!cGS7A zO_A3v-;H8a)VZ-ZT9D*Dx(OdEI8Jc9-~>VXOce6IV1uIi!zd<4@lh1h*&9*#qDVzC zB?^BOfhhQk$m2!zQ$_X2qB;ww=0-73_!olnUHwbWhhk1c7DTa-wG`8KF})~?#ltuQB;+TzjCSz z8CYEN@(zEvv`V7--Hq*!DE<__+ExCF;%}G#6U7>r|0`sz;D3Va1lLEgLC8kIO@f;R zw+L<(Wb?O0VHJ1!VJGKv6bDz}&@fdD#Z;T>m47p;s6UE&q9!G%~?nSY- zxV|4n-V%CSaecnHu3SPth~lB>j|Az^yo7$Tgw7IkoU_I7MhTrY27d`nLM3|)IV6dE zRtcRuhCDG8jUm0H&Ktw>5;}hj1%%{_VOBOhFUSyj-g!)?PI7DLs|^2W5{4b zV$R>jozm%7&Zc={P%-Ej>c-F_h9xC6|In>o3=Lv1gx8Nbe*j1ShA}>Pna-n842^|1 z5p3$}&4e_M;i*NA8;fcgLn|qh{I8OFPf6V-hPE+W6i&=vN>?kTJH*g2h8{8WjG7ObpM(&`*+{j^UXYo{eGRxioraEuK!STf)J!h11uMb4Y*j96--fn&x0JhYAjf z;hpg~bE=C8k8_d;Nw_}A7*b^%2b&~@h1?<}X-W)V2$>qg zv=}}T{z(k8giIIwIEEQQW(u+pju&yZ;9S8^WBANXog?J)82&8j)HqK}Lq=`B>+@v{ zUkP6zczdLWo{MAn^nTiR%$U{5xFm+9uK(9DEEE2X;Br_0Hin}E9cLc>JEZ>@!%s16 zj$um-D`NOLhQDI`ohCjmrGF9pJ%(RnSSkFs7&eyDt77=Bl%~UF!9OJF&lv8CxmwKP zrM0KD{)d}S4F7R0l-6swpOn)7a+FIu8P|#VacR9l{MU0Pmv+jevXM$@y(xyTsg%}R zW7rnMi5O1CuswzyF&vXDJ6UpReK>|AG3*jfbGMK^f_r1wCuF~ydLV{_!VkI1snYtW zR9&HrQ#)hGRz@G^wopd*ETe~)(UZ#P8D;dT7*2B|Dx=TDa8_z3-&024DWeOQ)fc!A za08DccN~}4t{4X7@MMiUc!j$z$5h0y1gkUC{G51Q1e+>7D9 z=)8AA@qzG1f)527i}PddibAr88}nusn=Ov)ac8T~5eN6`oN;7s+Qd9@4IHuxFrZ{>V=wqO69QEQ@7svWI z>c`O_j?rfCT=$+zd5l2hm8F93dgZ{1K zC{W(ny~Eu+G~2|{HjZ|2w2z}h93A7RQC_zyub(Kdhn3f3%j>D-^^)?MpEz{xETwf3 zWl{4-fLU2uar*Byuv2Pqt#W5s~=i_)fj%VT+%m`KNkm09{q&$XR$&C3J!8p@0Qo}Nw1)X#?iTgeld<=EUkimA&zhb zCrPbz{w2248K>}<<9LOmUs1mk2TucDWyf~+ycWmj6`Zqz*W-92jyL0YD~|0I^xJWa zh+{P{8)po)6L-a7o~9}~wnap!zsY#ig_7$3)k zIA)1Labg@H1}5hFf*-^&$xZz*j>#_f3h~9^ca?yUpy23=IwB+`7!`~O#sv*Q)|iMR zDclsaT-_FusHmq1nd<7(gnT48UGQVU8F9=M!ZJUJV^KxtJZH8jpT_Z-kU5zS>`&Ko zZXEMm{zV+~g?}mdm8&z7g)Uzd$6}W+iDRkDzZSBLYe&fPIKGYJJK?KbpYP-NLHLiZ z@)L*8<0}6OSu6M-&%-7A z2JSp@)G?gXp-pjY=0*|6jX1V&6NrQ7OW$%#^4$FZODr;^?i$6jt$m2_Gq-MNz9$4OpEzgS66sic=y()TLqLvb97<9Hm0S!QK@ zgu7E^eU!_;vhG`1kE*Os#Bnl?i`>lPNL1FR;y4?}xj0V8afTDPiu$s${=Kr^TUlSP ztk1{!!dv98;tVd$s#SFBDtd4geL0S69F8jbN*q_YGYnJwYqPOcbgGJ8TSXtNqHo4= zD~?hIN*lP%(K(y;I1U)N6UW^+ZkEBlIO@uIUDJMP_qjp!OM4KO2PW8pvlLzkz;L_1jgQ z$eBtkU?6(hGq0-tsjP}s)rAcdF;K!lNdx~>)kO^yGf>>X;i~$+_!qC{ z^$j%OrvRICKdqjDS=BXsBt1{xX8R@2--V*^bLG&OLfx?WRVZ#wQFo;jaRvzdtJ zs_Pa8PMu9_DM-@FKx^R{f^7ub3bqq$FG$Z0Lhe=9Icw<72D%u|&di;hv2``j%|Nvp zy1T)*<)rs8aQ%yP|Lydi26`EIf~%m0^O5le9cpOuCk^yvpED!_PZ@aHz;XlM8hFOQ zvj!#^_|V`#M5CX9w+*~wpud3u28J7W$>6J%ofEks2A&r(h{IP}4;G|8)Igwye!;+t z20p7HXJ0()tD%R9GaY!I_OgLj47_3BO%Y!eydci68F*dHonpQvd?cGz((e~7j1HT&hQTR`SD-7(d zt(o+*m{)4++;yB2-IWZWj{eO+hM23kQU)9m;4g6k5)0v#eW21rHb@V0!m&M%54rE9M_8HhN8TSb8FtF1A z-Iyg;n%>2IFHP?jGc)7=CG9tGKuS9(ct~>5hexF}ebm4)Zc_$}_)({Iu{kv6f&>LHa~Iy0*)|@aXge zh;(?h+9$9`IY|^dCHTsEC%m2s{H63h zrMo21H35=t3G_&yn%3PDxT-Xdyjo{yJwWSTlI18H3Je9!H z2?P@eCGboF&nBF2F|Q}^oRAk1crk%~3G`23fGA8Il)ymYJP)Tim`OPtG9-cLS(nx; zwH_*j-vpU7EP>(TL%vfxUqD_;;AJV{6~R{pUlU~NZLQx(;LQZyl4C>yBPEI1-%j8i z4psv1C-AO_f0k&113< zI`|U!ysq|(LqL$?Uv+gjfk*=XC9p1mXacbWcqQ}a1mX!83CvF5Q;uK)$pr4z)iV+> z6WCK%e~;slm3-~{F-@MQvDB`~U7jm+> ze7iU-P2igZmM8Fa0?XJsHy6!s6Zno(uD<>$f$!a1KM1*4PygsDIqGZrtPqogz4S{0 zzb3FUf!{d!>+3%f_)~gsRRX^Yp$~Q9YBB#7{7bM;ef>`YYa}C`|4m@6a5@jG@8p`h z&9gp%vk9Ez_L9KH1U7M2)Yr%B>yrs=PGCy{TNBupaL(C|a%Y2Qdjf}9&gC@n9bCmC zlJ63-o1HIYFBh7S{hS-{91?zjcL9WaSYI{Q52_OmnDdF`5?kDgdfg1_jns{6I9l^VT_XK(B$kc}k zJWAk+272&D55Fi;=_t9fB#||VQPogH%FmVrFWTozBDdc z>>QXjx`8gAbiS=r5VRZU1r2oNq_Y=QNusI{4)Ll6dTj&Euj=U0Ru70hdZszjlLRuujjLg!SUDrtO&#qcD(p4Jij3nA5!3#m; z#P&)4V+abKOB<6!$0Rx>F^rKn(Vdg%lEgDfJex$!yDcv4E)Va>3rV~vNd=ndYEAU; zBwkA5WoBnja)KrCY7(y{@m3Nel6XCdH%L@yFDGKsgP`R^pL zO7u*JolW$GCOUUhJvxa-P4#<8RA}mC?A25cZ>lFW)nk(&juRYDY@$<5_4`SDki@|x z4ka-ui4T+bFNt+YOisd^bS@hFm4q(|e-fW3F*k`o62T;lBoax4l337GN0Nvp@mo_J zPGUz>eYUBNF=HdmBdwW^bFnmYZo!mlrjtpSoXnEivYED$n3BZQBy3K_W;!KE(z}_S zCVWN`Gn4oziRtX0W|~PKGpc5q2TP;*iMY+8TQj{_l-c6Xq|c<5IZ`_V_`8{&m&6xI zEJ|W=67xAZo9QpPx|{2(46l(c(_DWgSr#Nwuen|**uJ@5lEl&^en{fSB)(2!SrXqR zv9`JXhEuVW4mQ`{Cb3-j)6Ml;&Gl?1HP_#Z4;|?FQxYqZSjjF*;%D}AbIs!yAvc=q zUpezzXdabY=vC63Ka%)U$nSzpTIilFG>hV~nzKmw-wd^s(*yq`v4-=fh5na=(n6E0 z6_ZJHSf9kkBsPij1}Tl=W-)hg>qugY@U2N~OJY_Fr$8Rt*b@j)wb1(o4+zqS%HbrAB;m23EF4YZ7-Kdu%*62|PHVon8;!xtBK|BRkYH5 zS~-<6R~Zv!P1HBhz(hF{X=9~p-t2kpLA)FM}lE&N=%Y}TIqTc`H|P0K4IaE zu%U@YCR&?d6^%_aG0}{{n`kNlFc|tAl&D&mxY0_p2U-fr*IKtSQLVLZ(b|cbW`-2b zhPO4*&P00?9ZWoB;%O5dISMA8FwxsYXVW=p>29Kji7qC(nkbpov*K|&#crH(t)26b zp5oI>a6)VSG@R3tjgQmwwsG?I;cS$oFEY@VT!%e(o;%^iGn0VR5D<%@`e0GtE z*G!BzF~P*^Cf+ddj)`|oylLVs6C+Igkb#F8PQ9-^PXD~M9w~*Bzb!2#8O5H@z-SZi zNfJ55F($^b>#{hx#7o@8QwYfb0LoC)yo z81*>aZz5nKWFl;W4GEgK)LJtt2E+c0n24H)v6)f}d*(_Or+*AFSroHm$#BXvO<0_w zCKj5oO{7fBH1UavDJG_JLYnwkvJ}tI(@cCM{l@Z{v3iE?l!1y_JWVq63~6K63_Z)l zY!mZLd|~2K6Q7y*+{9cHLo)OniIY9XNQmrz4$!+9ntZ-g@ujpboS_-pSK_=Pi)Utr zUSwjiiSJB&Z(<1-f|R-3#Md%ImYMj5M}}UL;Y={j7M9$ezmmz&-%3=wGxQH8el)St z8%@L#D(A6Pq|=O>E@WBr}00 z?OP6Q4u9!G#;+TmuY&iFS6DLfZG;zwr$TpfqvETgCmeW!TIm6=st;^y$ zXW}9!m<-B!spW#;%r;Jt&ic*bS<22aam~aXc8iJY(%73OZb^%7uru2@>;1Nb$Jkh4 zX7e+r)2=p}$^&lx+;1(EwD5?VKR*I2SGn9P+q$(h8cDqGIv z%*X&|S2g-rsBNK+g&G!WT40}WwX(yRg-0z5&DuIVP2%a30WO^0ZFRbZp=~vZwounX zI}7bC)U!~Z{uTy2N^jEI!3M$`3N{j?*w{i7mp8RgTs)hL(!xSZ3$27_SZHIRwS`Wt z!Ka}z3v6p)f%wy8#t!1y%fb^DI?~fZXSd{TLb_P!>MEHfbhprh{nHvf1sM-{Zwq}a zjJGhs!jl&IT6o>U8ypJ@Pg@vn;Ux>tSa{aLU<*T}z~_i;h{V>9&X3ajTPP(a`9Sd* zBv`DqVZs>+kC!dHDj8p4sBU9l6D8C6P0k++?{cuD2_qzo zkrofW)ys!5n@w1u%2##wkzQW@bGx5muAr4Or~XyJVeG0qSRA6S@VAz&fM z=`B^TsL5`pdEHuk7XSUwsilq7MG~?QbyLF@B2p1+Vfl5$$FPvFkg_nvLQ*_U3l=A# zTY@bj{WBVv zEzGlUZ5pmm!xt9jTexK7vW+h-e8rx$(a6RE3kxkAvT)eKA`6QxY~c`>)JrTZweYuv ze=K}$VVQ+rEc|NW8w<-V{9xfniR4?s?<8i1$A)|_qyL_C#ZMC03ODsaz2QBQhFuJXC#d0sFM_awi!ko5xx8NSZ zpW5nb<Y4 zg@@d_EnK(wPnx)E;T}t~aLeK!>v-;1FhZWc$9ryDsN7CBY3I~3-|InUnu z$(J5-mX;jnDPg0ejWRaM+L-pGrDmJRxsA;2?jcPWk+o&OhFo5-wom}N6da8}_+?nF3Ejo*;V}mVa z(tV$2K|AfSp={K%QC~vUHtMon<0OEIPD56;(?chEE==$=utD^U_3Uh?8{24N;}sjP z+GuK{nT-q^ZEU=o=DE;LH@DHkMoTeUv6%}zJeU+n^RyPRVh6Of(av_hDn4(cy^Rhw z`q}7jqoa*ZHhS53!bWEfPgww3pUUzqSPa8d4-l)CKcuGhg z)*^%=eV(@Q3^#=K`dJ%8SyX#HM({ZiX-;pizi#iGgbc7T&~`3q4ze-WcJ4v1Ztpx8 zJjBM{_BwATMI3751sgBg&eN*HIU*hOo%VW|4Pwy_dMzK*WeI!`NU(JW{hE!}ZTxBT zJx+MT#+x?g*!bMWTQ)}6h}$r1jN|~>_|V2=8}G2YY>c-t!Nw>Xqiu|_G1f-k4*ESC z!47&(2mMwD=PK(s8!J0#B9mwmC)(K2LBG$*EaJruI#)-{ER#5AI_lOPHPLIsXCq=G zYQt|MU?U{CnEhEgGpdf72MY{KF6!Zq`g2j3J?2)Iu#vPe-Nwf@OdFPsDK@4`s?DzJ zs8cq6?x>mlyu>igMz&7+BXOWuv6F7r$w_5+Gi=PZ@u`iOHa@YzuxD{7C6&!#Bt$mz zGs(*sm}{<$c{YBq@uQ6|Y|OW@)W+A`|80C_W07R1C-W|_u~1A##k#2QSj@F4A~`Es zX5$+h-*HiN_l)SIS>19Q-%7WHI_Y_x^r}w!d#Qb2Cw-@r{>jD)8^5yuMf_Qc`h^=p zXD2WFoFny{h`)=&D&d(m{vrLqiWtmaHvYD8(8kTqI=!?0$Hqn*n{2GH@h|6(jjo;b zdcpq$X|5CUQfIxvReYWGW*b{%LhfNNb=F%s-#R-F!Y%Bqx3T%1^>(&Jl6DI25~SyD z?tbUeNcP&;$0d``vtQ=zK4uqlYgrG)LpJ|h*!dyY5q`*)(x8-*Y}dEMhZ1ksFy+`o^R%HiZvTn3QtLZF~v zrLZK0r76ry;R}gvVG0+z>G@o7-St<(zZA^gT`x$XVRzl5yCx3nt{0`Sn0?jV34037 z?)vK#mU9Q_p;vd;%To9z1(Lnp^_A}W+Z4V_p+XP+Jx8{O{vm}HJ@ivO^yD7;qaJ!i z3O}cCFoi=Y{F1`2DQrk#V+t!%_$`GsDZV%nt2h-?_$!6KQ}`o=Ke_OG>eVSM>!H{7 z(8qh|M?JLesk`-b%%MH?2R-#aDUeV9e^k8%*c9dW|NmCOKvYBo!9odTpXC^U9iWs* zcXxMpcgM54voo_Zvl9;;7Pg|;iegKcCvWGFDmE6)wI=7O&#dxzA`--ujEo>!k72};^yjzU7 zIghQxZzYemlJ{t7CGQvGgJOKIMhA1Sc`?2!#@EI8g7LGB94^L}jC*b5);7|kjZAG5 z4>iyDO)-uX<68#vHgc46-9`?!iHChh8+nnQ&81vhInE{(<2MHLV*F5y6O8u7_=QCn z`r67*+(&Jtep_kZR_3;qbX)ng7(3d^zP9pnTiM-K*z!M$@n1aP3eRQmdAfR zv(hM&#+fOcmBPFf=BH3Dg|ky=nnJS_%BOHn3PmX-Q}IW%=cZ6Og_g$>=V`Kn>iH>D zOyL4$`cz6`YK_?W!h(gD-6|S!O z3bj+9&z0&^BZZm@bUWTou2LTsPoz+$yURc#t?c?u=)=fcDxFv;KQ@BQR z>!naXg=>}Rc3q0kz>nL^gC}ZG$_2{}3bZr#Ce@o&dD7byXm6Op?QFosqkcl+u{gj80)pflI3z zr%8?{b0@0KN?}q8lT(;dsBk*hm1a#-Mn8K4O zJe9(t6c(p&pXRcLB`K^+p*V%51~abDQqq95Ov^hOGMHLJn8qIue#w>9~G3LhxEqx!Dudnx49hqJ#= zEesB9!+zxhx+9qUD20zx_$GxTYX2mK!wM|*X$qgE_?M~in*2P4FBCW(Og2e@2jR;U zzEU86t-yjuQ}{N8UsCurg<~mvr}iIGI9~8%Q2M^WZ25@-|ETbj>d%F>!J2` zKaFG>b<;R2jdE#Rmd532oSjDbG%6KpI46zsmCr3$&P$_$a_I`JSg>D^j)OT*cVQZp z)mSBsY6=$>e5xvxw(8<^9QiL{DQ#ZqG_iPf^{JJ{6@^k)rcpz=X2HT)s9oTz(zrT} zI+{$RQB<(AF{SO1G_FabMH=^}acvscrEy0ZccyWD8uik+IgMMiNPTLdYy*WGR9VSQ z>G(3lw*7o>5tSXkH68yt<2H4;y-@0DU1<%|xGRmj)!3*o@{J2V%@mrbHcjJWEz-O& zboUfa)KVQfr_m*iR%x`>WScZPD6~~&liKMRwpT43z>b>LNtG?{nnt$*v*q2>=h zsy)-_rO><3PWtpoqi-7h)c$l)k_U}E2B>AA>LAr$+RM;1hNV%G#`-jdr!gXpC21^8 zV`Lhm(wL!cqtoE_nUu!lG{&ScHjQy=pQy@4j#rqV`gggyrO{?e8dKFm;Mw{6^l1v@ z>FGEQv->mCn3cxtH0Eg5Le;rx%u8dw4k-i3|BKZN3VmEusAsW4=^|N{Mm7yIjpb>q zNMmIht28&Qx|&^3Sfk1|OyjkKi>-3J?~2n%slD`EnSzg@P`XVlWlz;s&86Weum(2` z-V6}(YVlQrG(sIZUS%S+@M{M2*^tJ@H1?$NdK#P3*qp}wX*`g|7WLVox>c3V+tN6v zgKRG>Fk0?Q|1UH>n8rhCJd?(=>bx_J$I^IQ`C-*Z(s)#%Mu)gs z%-yB)LfD0nr3F5!(d_NwvoG~P_( ztuzj#aWIXy(|9M1{e_y}Rd}yZoMqon;{#3ZQ!TAOjyAfBKTPA3G(Od=kGKaFSgJIa zw@ja@<fuM0ky^w={k)aA^zwOyjRK{!Zf`wIhR5GWfUP^IsY* z3-fhqCf+-zW&ZzNP$q-2YAn5wG55?2F3g~E24`hZE`zf*w|oZYDDbO*^f@S3_51eI)gTucx$xHfOqokl+WxJ zb9=Qgs}m>WJ~Wh;ZMf~iV-X~S$y=2T1Xh1?80P3Bd7)zSqJ@x$K?wq~#`gY{}>JsTA^ zXy17!xv5~^tgxjpCfhUEk-_5`JfZgcGI%h9hcdWdlMkqtF3z3GtoadzhgI3%M-@10 zkMTW(qw(vVCkvjt6rRf9X@$~V&l;Z5C<$ z@Uem4Gx#Hel?GNB_%nmQ7-tMLH1KzZ&&Ee30~Z?jH-rBex(%FdpmisKfzu3>F>s23 z$sZ?AHSpUTNy0tblVuH@Zo~m$eJ5c|IK#lKPI9J!$KOs4?j&zMoIJ|_m7irvbuqfI!o0qa;1SQl>h21 zwA3&_BagaW;x{yE8MwQP)YiUSrFyk$9Rmr4BGsfS{p%|9>LS+~xX!@sY++Zq-atJA zHyGI8MW%F-%l9Vh8(7;#9_%6w3{b7jNoL*1maEUrs<)`#s(PF1zg>iGb-T(P?8x3E zYi?xVE(84y3}8DAG&a!IKsy6X3^X-xkAW5jnlaf``gWD(2H2^;o=SdyAj#yt2Bvh4 z``FSzaaY;gRa$Xc4YVor<)G&7?i$Zmdjq`;^fu7JKt}^Vc9l-*R=ZnVLuUhLb(1az zx~j38YWG4tJq+|LFfR>FyUDO_(#Jqw0}H!JKLa&BikHE2yOK-}G%$#(#lUO>gAEK} zBMnS7Fx0@b?a5&VhAVKT<-5tF-DHG;kp|evQ5=Co$uR~-Ym%0|pC)M;tM+lK;|)wu zpnal&Ny?K8mIohBPBZY9_UP+wLYQt~hFWH-(!y0V$G}_zW_MX;U>;BRN_-((Vqm_3 z1>6hW<&y4Fue&TXu*g8m?y^{waL$(GQg*6)JYuuD%Y)rzxq*ofC07`DrMnPT8(3pt zmw{)vJPfQeu+_je&W?eUfxH2qr)Zu`8!!xHl{2cv&62d61}p=%T8?*@Q+r5G*)>3R zlnFdMwXjHFAXNKC)yM$dN(|6}x$9Lo7^u`kc+j%Rz-9wmxQTj51GUgd%XR}h3_Pm- z_o+T;;30+k4LqPgPqubvfge_2wT~#URs8ADV+;|6vp-?rNo~(l1q*9-1=rGc-E_+#|xJ>+YyfgbVohS7Gm^#q7r-yuR;DiCf51LCTwf|_~C$%5es(xj}Ho&K!ot4G!2L52s&f*MS8k)+V z+@AZ3PRrsiUIGmK!{BcKS)7uMuS);)kpCD=uB>}ePr0tA+}l$I^^{YynAKCPo^pRr zDU(InYiMb_Rq1m<7L^KIwi&8qx7MCboTFAXDi^~hl zwREL&B8wu08d=oLqLy-P)vL3(N@0J~xRE^Su!GHFPO80uDwB1ykSwmr;###_r^@X~ z=j)a06+G)_ajaQf)eRgdHQtoPty$cb#mxnuTNFx~C2!AydWR;dWF9QrD2uzY=%Mzz zvuLc)A&VvobhtN*rdc%0qItnm+U$EY*`m;kmRYpQqO}^^skTvVtIB#`ee~Ji+%XdrPQ+vzGELLZ+ zCJXW^uI=7JSepfpt9#3>nxrw6MLLTxi-^O*$?7du7Iqd!7FiBOZ!xoYthemzElYY! z)LU{{I9cSg@Uw6^XdT4kF!qt3dP})J@m=mseWZOKp`G`=0moCBParADVnY@i8KY{- z`YiZuu7!PsZ$R^kiZXGJiEUYI&!U2f^G)o?;=U|CWx*`&&*FhBUdZA_ zLLYfBi$}8YFD`i(`Vhw?8{gzVtjZ@Sk{@N`v+;vg9?#<0EOuw{1iR12N7R%jvv?|t zr?WBdQhi4CwLZdwMppY=7SC(_WInit%18ISl#PD{_Ieg?Wbtw~{*KuzS-hIXYgruZ zBRo#;D|?iG)a2eQ-pt~IEcS61*O0e3?|tR%EUNXD`hDdc4SnybzNh-W>d3zF_c`}x zF}bgN$l%#m2nRHIki)LYkFxkUi%-~#zH+Rul<6n?6b@zaIq$=>_$`Ysw6%w`_%aJV zDTv=x{3?sDv-pLR-cPFclW(#(n#H$VIa%D$Pp0jTZ~I&KlM(&o7>#En7xt6yxCQ#j z@hrYq_(AoA>W`{Fss60GK#OeaC%Y;oe`jRQ;w%&8O#I2PpT(j6@>hR(sh|AKm1*KM z6aQrKZx;V$ar}zpDJK5niLOY(jFX@BlPdkis*)^YqAXVh3-*`OO`Kt3T7Nmy#P$89 zS%2x%Uy_xRJW~DRmqKToILAb#Gm6Ta@k^&c`smJcO`OL{2FS$&q`?5WcYsthae;|? zX1snXnYhrz)h6ngsBEH&2|mcHriqJ83>qLc%y^bp43MfOs+sYn>SEPPRGGZg#AOA( zT%o#&D+-n?O>7wu&nDZ(dZ@M7{ti;xjGqK`l`1zv!bFi4;k+bG)HQJ(JE*4?6R!-A zYn882Wx>w|NNjA8{B=P5MKboHzKI4VZZL79iQ7!vZle4^xk>wStBIRU+`?Az!JY$! zOuclV)Eg*wn7C8V%cq|;G||XJV-rnG+-2h4fpWKM`n4pv-$0=@H8FFbJUmdEnQ#Y6 zDZevNTF}#kWx_Vm(nKp0gG~%E(b_~C6Wut@Cfb_#W}tL5kr*WHOtd#~>L8(|1IK@m z@ZgUbJDKQgqKk>HY;gV9*l3V+Q5`o(dZ@9ti9RNJn(;4KdzqL&NYaC3;~?p4qMwOc zgJqzJ#|BA%uDU@oz{Hz_6p8CI-CZ6SL87jNA=EFmUZqy3H zBr!~$*Hd&H7XK*tB@-{3_`t+I?n)D{a&?(_%fxFY_Gs_kV9*#QubY@UES??C7q1t4 zHEYE%@znUXiFZvrJWSqEJAIhN*nCz?2B;ybPI2q)Uax61V4sInf` zKt0Z@@bI`JKWOpq86IyE`ji@fGVwEGxPyNk{9@u)hI$8QJNS*xoKPD(Z2ZB2HL=#h zItzc9_}c`3hjxvHe@y(#$Z4VM2>H(hESzVdf`wBooND0=3ujt5%|fl=Qr5!qd5JR0 zf6q_sUX-|HxSVdG*P=w%;c}LRau&|9aIS@Z^Al%V7&~0bv#Ny&Ch0?{IWKW!X?!dk zF6UdQXrYRQi!5AVp^}B`7bRHjg%&DnDJJR0>tKGkTsAk(s%qh43zt}^X5s1K^6qe9 zg_jnbJI#xIz8fwVkC4kPRJU-2g)3QPgw#~6Vd1(Fac;8_QcEqhRcX0O;cC@7stF54 z3Q1M^)V07@H-u|hkA=SMCfjVGo`secT3M)Xp@D_Q7MfVN!NQFe8dI6;g(U-b(Hi{=xw2o1(qE>N*0Wgl2P)^ zsJKXf3j-`HvS8YYfffc?m|$U|g~1kvSQutuxP_G^iJ|K7=P04u{!v0;?g%xGR2`+t z+|lfm^4Nl9oWgjmkPee9Otvu9!ZZ%GW>p+5JO!1xgy|M$SeR+y>d|uVXqlxzX6|eY z14j#wITq$B&r_YRx}cD|P=WsRTx?-U!M;>s8MleT3e}aWt5jF3veX&{)>CXD#pPt< zdK+mjFbm&UIAX!DkhSo*g(uhr3zmiL7Is*$Ib{~|7JQ3;;2VGR?^^II%o;75S0r+y z<&n|y!RUCA2NpsLk%bZqe~*?6$4Jo_X*x!Fjgcw65(~%3dOD1e4Hh;kY*O8kRXI8NTP z@IE&h_sBS5gK6a1ZyzT-#*dQ&?52gU7!}9MhZa8K;IlE~WYxI1o14Z-=5XQ@wb1yf z!e3I3s0`(UQzbgEu`nxLae^~glz*ntL z{9_>)FaL5t#tY%G@$$`h`Fp&aV&haBWo?{p<1`y=TNxX5C&WWhd4dp{PLMNfoN41M z8|7^Dnh*~K+cs{3ESVtBtWK<-Al=NwIX2F35{&rRp7gAG*;$$nN@z0)SM*EY&5sgb5gv= zIf+Fp5|bv$y*66fXk~-_T02Qv^B!Q5w6W2ajWiQnt4wmrI5_W4k`6XHat7HQ8=Y)) zw$aT-cN<-7{4hzXZccRNGMFsYC&!zM!_|YQ(}A5hIo_dMgm+GsUX!JdjlMPp*cfPI z#bgO4OFtX^={f#?8|snCGKgzwvJAE{#0Ia|Y{n0hg`aJ)okO|arpPeW;i@B4N7@*r zz}(R`#*{itPB1y%#snLyZLF~|(Z(bji)}2iG1Et-BIFrrnW;L<#%zT-s?43MFi-uNT&QEXhzoCY-0c2+6SJoXd8v(M?5~ZLI!ep! zI4r+9McgT}bBY|EBCEKaJ4xB8@qjS7*2X#;k&P0rJsT+-dCn>0zm1FykIQCkJY@#E zGbz4uk+U{0pdeVP1lvZgz>b2e%6-J}%dN+u4s3)r?)x%PXR6#aRS4au%6c0cY;3Wy z)y76HLc&DZ%(JKCFvx=wJ$q`rf4A9SCA_R`ohof|i4<$FaX;5~4()Szz{Z0%{C@$18}Hfp zz{WmK$MiUAvF!Vtj>U=X)8l&f+c?0`G&i=tFb~F-*YD_9Op`yA+$U>Bi>W*&X8j>;@w4Ws-XUT;*yf7-UZkAk>L)9Fv$l=Nys^xHT z4wvR|Sq__L$%H6zNe)yVEfytGvl5r*P(6oTv!oH9J3UQ$97()4OKPxfIdH(Q%Ar;+ zzPQxRq4sP!K1<5Y7Q*QxcM&!JupM`p|X*<#O@`)A9Gv*Un33mulZi5qjcDTmu~xSf5RBRA)8OAfc@;+V{U zP<@WvF(UODvE`pJEA=&RgMwZG~B)q$#mRQa(HormP`;@mhO49$Ue7f0sGh#W@hD9y`Z z6i<3MzSEwP!+&#SbPi(_#;VdXPGP+2gd8R+Oe*9~W*5c@-Pq2lIZV^#I$f2P845F1 zXQ|Fsos+{{g{t%7g4fTJ`JC=~vLJ_r3X4=1t1eMx?ox$iIV@LLq1tSoFl%)VYdBmv zY|CM74(r&d9E==_^(-kS=gL5yWuBy!3AC8=B%4E!1Hn|aRP9pBJjp3IIk*Ljr;u0m zb(&Z<)MTVuqDtd>g$+4uELb)vY|dee!XrHCJlU=@#c6sphaJlI6)gAjDxmye!Say8 zPSuBVctoLet{=;R)6L`Y9QMzXCvtc)hwtXeQ>uigxowr7QGHf*w`#@tLWdW$whwdo zhzmyfr5s+);T7FA+%NCs@M?iyQ`n>WdJb@DQJsqmKS+p6p!Yj`(@_cZywDlH!< z>{H#J!vTeZs-*=#&fybI*_gyHs-Na?RDqVyayX>?x#|}M`{5kEEbvzfU+3_R!jXcV z8-X=^o5Qh!<+~h?D}P_G{J=d@;2#x!QvF%=+WGRU!f&d-=kSNZpQ@)iahv~A{yT?% z6#iAE{XYe$&nc?>G7{~lIVhvavZ}P4?%)jNGYgipoOnAki%+X7@1T)`yBwV3;9Lji zIjG>^DhF3PINt#sUhImh4k|imI$thu;_pK98x)lsTPRH3t_v z@h?3GRhCN}KBq!1b#R%3%Noi8<=_`wA{ zYAHN1Uufi?oz-!WaL~ZP4Qz%JKl+15eFsSgbsdO;G6k!eZl8C1zPGA zptNkY1#+WFo zBL}X7CLAjV)0yj_nSqMOx>_Rs60BTv7-Yzlv-X}AYB}E^?hbl6@jn;PfnVqD;ovhZ z-m?HTo5WT1b&_4rV);<6wz{r4Ht*alV5E3iDLY*Oo6-UgUs-L(5`K^6c#Rp~hI| zV5NgqYFzH%=v~Pbs&rVb#x<%uJKH&~w091Q)tGW%ILJCkb02B_EXCtQ<5*4gu^m_n z>}hFkPLunZBs~Xt2X8po>%eyqIC#XtqugQ+A_vZpR(-xPHaOU*+^bPM z&YK)8S}3LSyT!p)ooh?mxx>MI4jy#ykoy0uZM)yW1G=1872C7Z!RCc>xJk?ps~fAj zp;7WN2ah}0<=`1LKB4-g>eeQB%E8kPo-EAco`v$PgWcSl4qjEC=N!DG@H{77;rwPv z9xp1_Xq3FDaq?vc)Y38Or!)1MgFOX@*SVG&B{^kpI(W;$*WAAj-gfYggO411tZwf* z_`tzF<@Z$IcW`r)WZ8yswfh|$;OeEbwv%)Bd!rRI zN{*@jzp9lM#p{{l`K4z4eOJt1DHD!xsW|waQH~*~QSw{0A6Gu6`duk6lv_&|hJzm+ z{K_}^9sK0rX9wKTzi26L>diW#>~-mE{_fyU2Y)&ELmg^qOW2q-jq$ewvr%$Uqhy0c z@}C2^Sm&YG!znIKb#b+aIv!4QQO3oaF5Yrc*2U>Au40ypGhCeMqLz!=F3xgM&cy{T zD!Dk@MR^zJxiA;WIWG8hzTS&u(jqxmx!EG2g&)OMa6vs^wW8|QMez^eFLY7G)%fqm zFWz~-`pk~RMJ}qkXxgBtnu|+aT;}3p7nitragprnSv0*xQT1v?<*qEc+(mU(Rk>(y zkK`wd&5no_cF5-UzQh#40d}>pr#j)0Lk#Mn=-FH#sBI#n1i^(qP zx)2xjT-0}Q&0@L6MZ?8%y^CvIT<6A5>ETDoJa{eZzBvBNvj#41aM964Cl@!mxXH!s zF79w~vx{3?-0I>sH-50vW0~Yr%aT7%OZJ)_Ke=evtYovP$va(~vM|}gjUTLpj%cXR z$i-bQ?pAK>qL~66ns79fJ$(>UbLD#qx!wE3mE7y1rHfW-Y^~bH#kj@sHxSxtvR%Qy zy+Q{U!xzQv>C6V#Np^A3)y1sELhk0GyNmQ0E`EOoJr zt7x$-bg`HXTOx-R%OWoRC35`|8L~u{&}WI1ERprq>n?Y((#0wlD_lIeMBZE?)Nhu^ zYA%4Kvc|<}OXbp~(s8MbS}MgZQZDXuaX-h_MaD(oB6MN6$hvS`xGw) z<=LfjaH-_n_&=)3Et3;Vh5t@fYnga1d@kT+l6U!E($a02OkO7UEt8j*$?;_px!A~k z;iAOFdKVj9{u8UTSuSi0p}}(5>|*<+b+@|M=39{@ID*0HGhh2Q);=n5TRP{5}L#m&vexXVSuB$J#2rK!@#n;N;s2)*0>hjtC!d(85 z*)fLG)ly@%P`}q8`2(Zz(ZsYebs2Li%uJr3v+mZb=OwvMe{u1vi{D-R;evnf%YQxC zdNlEy3o8HA^-mXnF@}3M-NWB5{^4$7sQ2(M$Er{KdB=Z@TKv>wb^I1V*VS^W7bnZ8 zj$SRNd3;EFoV8f>3=d~|D6hF^d5Bg^Ib}M$#s+(QxVrqhnooh2T5IA`jn~L|9x8gc zz(WO(PY;&KYvg7lNN79Q^PAReyq(9nasR<8AMoyW)1$!#94 z_fU@mxK3{NP+xN!cznK}JhE2aTq`#y->7<%YH8LjT7;!;RiHDE+dbUj@tKNpr)s@* zv9XbdyEJ*Xho&ByDK}Pa!c(skwx_v==Ii7hJv)og!h_J#Ln{y6I3^xiYmv4d+NpCJ zs#@sQ-a|(Zoji0XSo*D#DeI)Ohb{#RlU)nEcAfO__~M|QrENzP8e@S5R2_7HYBFBoQRW+ID@yR^$M6pa}Rh4Cm zhp8T>>Dri~mg&@#+?9$?H`C*TGGs_fW~F3~hq)eBtIs@-k7AHj%JY?(T%fQ}b&={~ z4@(r5sxDKd=W-7#3cS+8wv^ELf}U}W*11;oEw!XPq&+mq%sJJ zzlR4rSRQN-B_7s$$a!!)_#Og}PYDp0{q^_*bMZVrk3}v^3$;yJXbHJ1J=~X;*U~a1 zEpyV6Rr>~RA`e^HFb`j(WfLcq4amr5k3R?%S}x5<%Zv=j2$S1A?C|hpMwVwJ%EZ;) zr>CRCgB~98u-n6P9(Hx7J9!S&wBhtlDulj^B!LC@G_T*hZjA5b6#HJ#>vK=BC}QG zS3R)Q9uKd3sLCu&UXzu3vhs$9Wm)mFGCCXA{FaBeJskJ&y@z+a_!jgl4`1^t;Nd+F z?{gvPQaR*dpNIWk{4M4?i)O=W#|JKXXHQ_|wB*42&Lr^Y8~3k}3U6nPy6{DZg_qDKzU>m$xE+ zbFMx7=K*>A%Mmc8k|kov-zL96TlbVazsDk{=5bmc3y0Jtm&wQf3s5$X#a4WG(c6;C z``2YvXXbHM9_Qy#F^_V2oSnxxd7PU^`8?JSs{5=ZA6xO0_SakTnXW1mGk@vRVw9ip`M7wZg%`s{3W(j$>X9tKi89=FRts^a&aD)Y*Ip0(xjJgVp88@$U@pS`{4iaf5&qgEcZ^ZZyRep~5BTWWB`Y^li>=7g}MUEQnl zNap#@wp^V@ojh91D_ZnQQ9_}1PKp%n$jP*vjD0VDyNRLZntXf_xi*jM^0=NGHYfG- z*qoDk%1rXvO+22<$&Gp3#NmptB*M*k+>*z%D1OOsYaX}dF)YIH2)E~PM;;UMn3%_% zd2AhyA$bfX98EOLqfs7r<#BgD{$KTu`S`j|Xw0d}qiG(^)J{vwJen8y9)%XF_vZ0_ zF8&|(R(Z6}qm3HdskSXRFqcPrO?FUa5uT`19-Z^(l1JA(y5-Sd&rW;yJbEklQ0=MO ztB_k-woe{?)zYtEZ>ax@J|K^Q1Xq=SC3mq(r>pT~4+2U*M6-;$j4Yn>T+ z%*VF8z%BmAx9!aNr7yoc&6=7Ln1exeSOJO~`0 z`#-9)TuZIUV`Uzz@>re6nnFFyE&ai!ajXujWdvB4kH3LjteVOr%~hmqatN*-7ExYEa~dAyd# zPYi>3?BROIRdQs2#Eg(L6f`My~^#bhdZ zUmpAO_>lWOj{{szm&ieeCe0<&hx~CKZ#wcxo^Srd7BZE5D38zc_%@GY%*x|%9$)A2 zO&(w7`Hqcz#rbk$PcoH!gz?Iiql_48C(};;E|25d@)LP{pXY0N`5})1dUi5>$Uo-M zPnr5l9=|dO`zY_@w>*B&;}jpK`uHP{KlAv9p+1klxa?i|o6Ay5ky#J4q_WSu*4RR(lB@ct#v(p0^Kr3{37%Zy^L?r~ zmrNyJ?qicD)qUPh#1=A@T*F6AAMJd!_fgA7Z6CM#xXs5^KCbq0osa8%)bWvEV|<8@ zBA@pFlJxPN)<9-G~&t6`q-=% zGVSDhe6;Y<%13J-_xgA;FD-q%skvnOklXm&5z^M@3W+UbD!GG?jy{I@81AE!kIp{& z_~`4Si;u28didz+qnpn~CEeqZj7yQJt@(>>@eHrQ_R12B*QXb)BtnTrVK1TT%?c-rz#&GSa51F3iaX!X#G5Gk>mx(@p zS38-x7t4LD@G)KMobO|Sj~PB@YI2s3xeBv=%u%=?kShbB&f|(Y5{KMU zUFc&GXN1!f#HZk~#K$r%vXld*Mk)h7F9a*qzD|{%t9-0hUgKk}!k|ES%nPJglPMo* z9~tHbV))3ak<7ADAddt>wSDBciGn!#IX+w;2Yej#;rYmO(tSMT!}k&R*zRLTJg|s- zY-BIAwh|xfeQfam7yV9-dz*c1@v+s%Hr9DktUEcr-RI-}cp~tKj|Y4_=;I+DJ306# z#kBtu$9z2I<8j6l|Nq3U(s)%Gg`W1Y%f}ucuXEe_c$N{~$4fqT`*_aB^FChiQ5vaE zj!tDY3cc*(6-Is^ulYD#BhpzXMWORG!o1;Qua9?qyvOapj{A7q$2&eMYUH_4qs_%9 z#gq5B_kHa1vERq#C&iPZlVZY$K0fmCr;opUeC*>BAK&^o=HpZDuXriqD<6k^e9k8M zIPBw^lj25$lj6hIKECmB#K%z|H=h(An&=+CS9kGuK92kNiT&aj`uM@e2_HZDXsNrq zt?uP+C+*E&Xo)uh{_xRD_vUXLTU|xe-nvf*=zjd$$3G0|0nQ5WuaEzHoED%=00cNC zz^S^%2I`(2@_+Yf*#M^pI3xH!yK;i=!E#!vyz1Gi6LnXf6X4tc=c#30VNY?3ogbiL zfC~at3Q$XPFAPvQz-0k04^Sn*MFB1jaEWGB4RAP+zXPcjpqU--K5EraxEbq*a;f^X z3Z;60D+1IAP&2@lLHwd%ZYcRshK9nu`OvYtPlhu8VBM$J)U6%hssL99s1qO&peVq; zP<{+$Z5iRd<918(L{Yo}>$3fkBqO0-8{oPC^+PlWaeaV#0geUuj+Ouo0;~?OCcq5= zZVb>rz<>ZZ1-Lmt%K)tc+!El{0CxqrTU&cufI9-*8Q}H+gY-nyh5_b9(kMVmEo3%; z+&Dm!0L=s36QF5;Es-<}@TBIF=|gT2;EhP`4e+^I$h4DN2WS(ZYk+P6+6HJBpkshe z0on)nBa#jQ%9q5RWGcBcXQa1u;Vh_~Onbc&=^il3p?82j0eW(9N~Bj1e^$=i9_mT% z8(>t4^b4?1EoA1B2eOX=rUsZ6U~qsT0mcRx7hq_BVF5<6RDj_DtP&X!;65!yW?Ay+ z0MC`km;eXWLZ+QOUWajFfJp%+1o&R<)X7}Q>t#xS>g!`qGL<|%zzjAlz@h*%1I!9A zm!lnEHs@=-%;E5=Cz<}_`RwL;SrA~NTFA7M7YA4pU^)99U@3XMEDK<2E}1^$m7JsX zvMRt+Y9Z53UK?OtfTsiO3Q){h4zMY}<^bscnE+mZd;lXrHh>)<$7%z-xn8UQhqMMV z>mfSP}r)9~kf&6fQM*=(^;0aC*d%8g$ z{Mi^=$W-$F00+3C0(`;c7vRGHp9J_cz()aUZ}SA|H1 zs2k$y5OqQ%LKKBKwk7`75T5}5-xjH~RW92qw``Srw~B&#=oq;HpG~% za$Sf!?ubW^{~b1Ws}ygQ&0B@Z8$#R|;?WR~g}5oi%^{|Sm=@xe5VwZt7NUEI+c*dz z?g`O?m4vu6#N8npv(&`84MQ{vaTgu*y3p{XD?*bHO+z#b(VTG7RiMR5k^f$HJVg5t z9YVAU(KDYldQo)p!4gyI)oS% zVl;<3#MlsXG(MjklNo!*g>m@ZwN)l^)rFWGVoHe8Xnb-6E{&qoL(B+ahOk1+3^6Oj z@(?RR%x2{w7KT_9Vs40eA?AlzKsSxLCr8@Sh`N|34Y8Cb3Q-zePmZXi(Q;*oRUwK) zq(ZC?u_naY5bHwxpU8PqgiMFXgfK#6!#F%LDwamblOvuTA{Sy~h)p4!5N?PdL>R&g zkq_aAU|3@$Waul6gr%`A3Q-bbeTWSqPL6UXN3hKywuHDZ#Qh<*hS(Njdx#w&PL5_L zN391!JQ(7k5IaMh9JL+}mlBx zJ;WQ_Uz=nvSFGle>GR4~d0Ru=JDg>;Fx=5jem}$qAwFftL*5Nye~1r5d=%mUr*e}V zX! zICIHV@`Vu?&nrh@NT-ENC0C75EkctBO(R?!;gSf~MYuk~r4cTRa8-n>BU~P#dW0Gg zYDTys0H(zqqAflMXWiok0`?I^x9&_bq?>qJOIs2f2d6h+`wBN>4g4(5`n8}LVdoIAK{J&4I zdl#Wigtie{Mc}opH9MuVLuNs8JC55{Y0q|UjV)vE1P_Ln=DY^ zjUqpB-oH)y?@#=;E&hCJX@q4FvJuP(%elh0%R2Te!V0dI2&?p5d^>1Ogw+x1Y!@E& zw#Q$GSj!dCHNkIsry`^yWVm|ojz8o6w-01f@{YbR*nmXxe*JqmD}v4K7GZmYTm&aV z7$IWgSHO+nYug4!MP583MS0bCjwFWvo(Q;Qw#Ognl+d{|=5Cjb5e96R^$|8GjM^?t zZsIINd{K$qcHsxXTe-j5%R}2`&vyA@yZpIbF5Dq?cF3JO8BRmwr z+5&qEc1C!Z`+5s1Zowm556s$tog45Nog-Yc9@nnN6Ab9DW^bOr2e9LH{ z{zoJ5U_l;q_^!Y-jvN!0rTvEpyAnn0&WQ*=YMnntVAjvvu>T~&9}~;8>~9f%XU9u$ zS_xm~qg<8vp{D;u_%p&^5&q^l|C0D8!oLciTv1f1cF~qvMFiS+*DOK_sHc?Rz&~-a zObN=C;NY;L=ZlI?FToil*fX{0%o6#31QT}re>{B!_!QOm{tHNmAkv|< z2<+L<1xX1d43t#58%0vWR!|U7L6K5K?48}6o!nWvySqDVMY==$zjwYr|IahedCuIu zbK}%K=iEE9>ev`57DMqEO2zPC46%GtB8HMNe0n9apsn=ogek5f{!k31V<;EHlsgfA zXsApK{qB>pF~nWPTVA{^A47#07Tt;9VPQ4GN-;bVL**E%#Bl6N^ss=G!=q~R+B#+1N1nGG; zGHYOzuu%+eHIqxOY8u0nG3=-yFU0Wezmcb6bj$H<3{S_jC_WRzAI-$*5hZ*shUPJ} zilKE3V{2x$pnmm_wu~WI4i=VlieYk9`M!6Qbm$sGw-^plBx2|uLys6{#xN^}o-y=_;dM3} zL+=>+#4s#|;W6}$>7DBVF}z4wDkS|v*gu4|JoQox17jE*)5m%#u`kCkC{u`%3JNLqJ{&TA$_-j87% zD_@U{k1?Hv2_bDsNtS%&skEntj*<^!%(g|R#PCTBAI0!-3|$|TjgRQW<7A5cgVHG~ zpT;mXB*pYl)IW=1S`7S}8Fk^E{IcCsjk*d6H6w=dRb#N z?4i)$L-;zzJTvuYa8UqYuGjNSVx=iDSTQOXZ;YLg^qh%ESd_XRiklU1{zan?TIo^rk zAF6P5x%X~_*M|4x%gd2}X%KwHDQ7pdrsOn`%RuIq3!yt9hF*Wm z-H2ovh=$kruG(CDQa}_ZQa}bjAdecTVc?vB^9E`fsAXV=ftdzs8>nNTkAc3Nh=Iop zJa6Cy1N98lH}H&sW(FD{DlDhnc-qh_>3Cl~Yv8$%5nPv>8{jG5mIhiGXkoyrnZ<>;-Sx<;J*2gP zfu*F4p}n1#N=nOG!rQh6+8O9%pffA~6&ZOklBb)rH!yh^IuoRx%M%zOGElA#`b8H89UtWIAP)g(IT!hJiN?6gV5%?5npzWM@}-*T5J9 z6AdPjFqYkMs3nBb!XDo@FwVeu3Y*fNC$A3-OkiJC^zC2gBODmvhXy_}@L5Rtk2(H( zWD13ZG&JyUmY5x*4_B4XdPP6wZ3UUinzgktAx=dj&8HcdZh-E=&%Ua5B{Ivv=LYr~ z*k|AigL?{CVqmF(FAdBwU>k7Qg@L&S3FXnc-x+Wp&FWJ~ zX8jY%QBGL$W7tKEl37UD3%jFRn+OY2VPTR4Cr#4IA1Z?%5fqi}EyXhMNLn>YE7yP* zR-PYL_6-Cy2nNyyZfBDgm2~BKVFk9|Ev?uokp%`88en&e3@i?7vhnB2>8?4vWd@cT z*i0ogu)@GfYQ$LCU|>~PbB%$uWUiszZ(bzMI_lBDC`Z0N?1)W8dPLa^?fFIu29>Cy z9B3~W21U0T*k)i?C@u5{wj0<%b!e;ogdqckUeHbhW!q_FH`@%OfIT6Sr4)|>^!xyq;?j~#c2b- z8u%?VCO?JnX9K^4NYN{iyjA4o7vy&Xe;LSmIr4`AYR#Xa`cP|re?-pESdsp(3C-zQ zN>^p+&@+0bxLh!B(LkFxo{!^_fy<xx?u{dF9CdF-W|ffHxgZB zpF;|;B!^`06(!vAa;kRovujpN}sD#cMOj^c4V6i4Z}w%8@&bONI#<2qE~ zZK*gOjO#bK=BCxW8<9O1BE1_(nK-w)P(F@dJELq|TP+q=U?ZWis>osI6|NC)6qA}G zqP6~xJQ7FMI3jU8T|_F!Q6&zp^1Qg*-+w+LaZR)=4)uH_8b`DHgjQ6Ah0)uQ!abso z#!(}V$K!Y+&doK{ilcTMb>bNIuQnZYO}S*(W&C?1q8G#y?#kI)MfoTv& z!#Hkz6-{==sJe3a??|IK8pqL`y~NQZj;8E4j=kk{Q%{m01?1^Cx9z~&pp?)Y}T(UpZ4bePE?g&{3P zy+>Tb{{^1CL%eSs{lZ83gtt?NN&mPGY}v?w@Nw2BUgJV!U|3-YSscg9aSRG?2a~)P zB3zCcAhWMwaSV@RL>!~ycqK$ehK(@V<*&Th6tCaXYIGd0#&x*O+dsqh--zSQIJYS= zHjcOA2zpAZV)D<6@^&2W#KBR$8}`VFWJX2#$a|zx85ti36@jbs`;_g1GA<4-zFdMo zh+{$=6XU4-pw1Xf3Xy^L%E~8&@Z&fp$MJO>-^4K`j!)v;0L64t?@6JKe;Rhg&~<8D z2eY5W^_n~SX_*nnrkCXNIKGHuW*lqB%B;8!1{nbEe^O@0@nxuAU$OCFdQs*zCysy9 zipb+pnH$IdRPWn3zKg?*BSj`&jC@b^>?iR!eu(48I5$jDpsVB?B?h(lT!i=sxrN@8 z)RaUV$v7BUSIR5Dag91BS8B*rGW4S_{*Y)oKN0*k4Vq(cH-6IdF@GFp!W@+7c4juq6|IDU&` zWgM$0@Nw*mV|5&BNCa|$1R?R+4yhE!dMaIGdGovIhBz+ti53eKMT=Tis$+C>9FtmO zOB}?jXP0Q8jRPxhk7Fl|4B1K*2y`ke*G+$+(V*7}_xAV#!aT zg8v-HFBIB7^7kupxQ?`JBGh{NX1~YrM;zB_qA3{EjyTS9QXFRmITP2Jgmbihah#2# z{&4B{jxfNPb}h1zL*<{p(D>7mjF79e0E6T*?LP_FTH~evj?}5E9X9$H*GT7gw6j6+ zyGi>=vEh*7xE+ewojCqscXX}-MR}tEq3j`nYzgE{;6_-OJ%Jnv?u=`J>|#Vmzam6< zxm6@rLdz-@jhTUa6UduD-2@&>;JyU%B~USehZD%3!2JmnPM}BvZ6B8c2^36#fz<=y zEe#h73nlPdJ;_~0K6z4#Cb<8O3JEmr94($ei3G|eP(Fb(g=JQL*>f>cGJ#SF5aIP; z0uTL%mrkI}e|Xu1w(6|FEE)SM`HV#7L@C}B^-2lu+CwE!ErH4jR7pS*h$c`qfd@0H z%>xoiU_gE$!m-uJsOK_TV6qZA3Bc8XuzCWICQvJZ+6mN1pl?RiOki9_abf!BOZ^q} zNrk0O;{QS|(w1H#$51c9a{_3QK+6OgB+xK{#tAe@U``i2o&b{=jS_ewp$!7vEkc)` zTX|`kz>^6yOW@fAp5mm!3eT{e`a0s{N<_$u^`A>%|D{Otgif>6FRVkJ+1aF2EoqhD zX#^~JLOLbTCV}S@XrDlb1YRKh6KF>Q)|XMw$-rt^kCoSukF%s>Lg$yx435spt=BT* zofF7jL|W&U*%{R>f$j->p1>Cg^hls*0 z)Tn5G5;lPs6M7w_`&VPAb{*+JzQmFQK6@qVXLMk~m2rDB8Jxf?ob`pskOYP%bgVZl zf#D&-po6y+hf1=bj7VT)0;5Rn+d7pxnx-bBX#9zHc}ZSR@RS86CGcSaZzk|o0^<|N z6p^i<46{7sd}d}I+gT3IUClznNhRemE;ilAb|;q z|I3|DB(<+bt_{%n(vK4OIH8kW(-N4R(8;$?68JPkrcjs%MVW=87c`ZVJs0^bp?#hg zI!msbkv`dFdIB>j4})c92xoB?<)!#M^}poR>;%3{z)v7eX-VL#1k40d3Ctx&?nJ&# z;JXCAPGEaa`6etOQY4>zPl-*yNFW{-{usho2$_(qexIHruS8gqf-j)TyvhMY>^GzH*Fgvs-7&+7a+jU+W_!H-d@*l!8^p1`F9E+_B@rI+TY zsGJYsUm-k8iHlFY2twBkA1ZzImf3S)K>cYdFny}7fJSzP=s_>SosPIuSTwh za=v(;x)vgIByJ{fD}e$@Jdng~vL=DtN#sf5p9JpGyeC1c#WeE2H2z5*Xu*jdQ6zPG znYy1NsqGSD$r0UjI7WnunKP-?Ggk;1`%on*{P!l2H>ox2z9jM|adengnS4nd16F!Z z?oVnTHUITUg^|&MNfb)r!6Y7HcXuL%lPHoz(Il9esnS1MEUA645=pcvuM?!jlXxt@ z?474dCQ&MhzvrpN*CSUeYtvUci84u4Oyc1r$|ljjs5HGDDW62S5Pv40u%tp#Cu2{Y zi(D$N#lBJ!^olDd@krS9fu2zoR!M4~C)a%acD5uDO`>BGos!5(ax)H(C-DSlkwo<* z>Lhjg>(Qj9e61uHO3)hDNTOy^n`K@(5{;8+nM5nnFbQrDJd;GTB$_7iWD-v$aio|$9YR{mwI!v@e3iSN zUg)1q@{j|#zP0>2@*G=eqC=P#9NTLQ)&d_DL))Cv8L6 zj)R}C_Vv-rF=2mtJ7Jw%jihrDU6Ob?i9tzpO`=;8y^`o1(vSvW+s#OK(&}QQM+kdT z``(c31Efz9eUo7J^2H?jg>>$p)DimslJk_10Z9z6DQ}jOmy+l+Ut9ix99VVX)CMOp zB#AeZcq@saNeoNk)g(TtBg2z;eZCrz#KU=diL{7z` z-}jF`U_>9f6nTx0B=JTPWIb$y1_`|P8k_;J(5hqOk!mctCC2u(66n>P`|axql<#Q!M+) z(MsZlGre#j!WI1MF37OLKaqKqle&_wDBOs-`Bx<8Ff63lydX;`U`Z?rIk-54WMy!V zj>48Du{;#BF@r&;Wd&7cIGAhg@}>;v7+sy@p&D#SVoefjlVHiZa8etRSWi21Ey9b1 z8V=bi957DhjY)fKS61$VwPPHv6J3?zfghq8IZOeVq8QNG*@J!^-a3u6F**k~S zuZS40$=^wwrI~t7*3DOhhvqAa&4nZ`QqGgO9-5#_G$Wy{pgFosUHdM&@0I9Pj-hvy zshdml)s3Xiy59=vu<~N$W_Vj*fw~=*&`ly)?otT39GJM*)NUS3gZd13+i-~%+{9<9rYvMk(KznW?pNae?O1GDSChj*;z|;Zt z118?SrkASN)kyx=?eiQx_yV3FMM)EtO;j;a%EW^v z%9U8rv)QJJVT}^ZSGidsDJdu1?sIq(dSGs z%iY`r6XQ&Pk18$q)|E=bqpeJ|HnG^m5)*AqJa1yGiT6w%4?|m%hi~z+iFPL1o9JVr zuZa#OI-2Ol`I_itYDMNAL>ChzT4xhY&qSiNrK_noDfSH(CPsRg+P?KNb-dHlM86i= z?!CJ}@wPYV)#MKee;T-3=$WRl*OueAcb0%kBF?Du=*T7a7Wn#36cS31=)x>Ki-ZXiVO*<_- zzwx?>Hz?2Lq}<&Iy%!eJ6N_>em?Fe;3$JR&jBd%hCdQB&jf6N?f%j?rO?*x{q_ms( zz{C`?fD%$&CYaz>%SR@D$uAR4OfvByVOnvEVe4BuU;44BU1eUAO`Lv7ZVwkGTRx@a zGuv-sYB=)GLO64QvKOf7CT5tJN$TAvYZjAY;eB%I=toH4W)~>-%?qg7W$}{7N{SnhSwuMnwU3OuL3cuKr6{NGP+=P zG+`oXA~2CLVVX#pJkAG)bffa-m21!Il&{YE782KlXTmp;Hu3N<;Vxm5MMOo)BoPw!7{HnGLTc4{Bh z>S|ViKMr zbl%i{-~|rJ#3dRclB=9tG4a%kQEqqAv~pgwu`|AlUN>>WM4lAxP4PG-Zka#|*-}~# zZ<}DQo|1pZ#6O{Vzia9Q;J+rA0Hn8V z3OsAantV!9h^Ejgh1Mx#rS!X;^-|dLXGEn?Ed^(xs-8lP6l$jMXn4z#bqn>UA&xCn z*A}W;Db!AZ2(LPvc!)n1!v9sMpF)Ea8m91g3Qwo-ObSn=&?to_DKt&t#5DPIsj$1o zDKxL7|CR4al5~-Jij^0sTjQnbBK7Ex(tD9=mcp~FlR}FW7TQc2%X4gMhVWXFl9nmF zwn#PoBFabDPU-ihO$t2h*FB|=|2-eV7ed%Jge+{ALi_*l4k>gD@lGM^9KtRk>>9#u zA>>n^EK)sE_;!)%8A2kxLZo*Jef}%y8zTKuJXou14hZ3kA$%!>14GE4(u>rf6b7d- zB&ENz@p_7uI;R+Cb= z9#$^8SbdzrN-fpq7L0Q}`i; ztroUf_%Vf83bicMwqT?XPhlH-NguWOQaF{uX$ofw$EmF; zoTS>GiHsU7Wv@lXwbkkITBRhFS8CRmZf7Guk=jet&m`ay#kA+he)7u_^;-(Rr*JWa zODX)3!k;OeP2pT9tAC|%CdHHC_-Bdg);U^msj9S8wRl4sFICZMQmc-fPvHXfbg5#N zj4R8h4dikPS7_l$lN7Gf&QKszxIt1cRa~mZEmgGJ$Fs85{S#R?GD-*db_#dcehPPK zoi0au-HI@7Wt|#LWX@8>7@4`sY!h_h=nW*%0guel=G?!6BZg-c+$dC78+YK9Cfo+PyiDDGQwQCNYO=YW^t8~+LT|Eux#F=m$`yCg zcbAn(oud6L^tbSag*Pn>u<)XVp%#W&dQ0Uc3olz3WMN=$4Y%-$g^?CUSvq9qxf*)lBPgHch3U%C7GAaRnuXUbjE_Z!F4t%Im~#2z zX5{2o(Fx1dx69RA7T&fn(ZVDP?^t-(!uuA+Sr|h}eqF{|d`|)Mx=QgP(z`>HfiO=s zl&dEPDr3Bb4=hZe%$E?RA}MBzmaDr1qRgy*XyGFZlPydk!5azB7k$iO*Aec|QtWyD z=M$OH#DqW8-%4VEJ zhxwiriZW1og^GnO8zDTCL)c5w;`0lPr{fg(Vi2h9%1^ zEVr>n#F=ZDWk`ma!{SRRqpA*AjTUuR)GxszYESlB>AlwWvlB-smUWRr!> zNeibe?5C=h zlOq<6S~x)aK*g*mhp6e~%L-MjnlO*eoc2@I#9g6iIe8tUMq4;RiM^$>+_y$XQ(dFS zYshH}e^~g_!cP`{w(yIEUoHGb%2ORWO34w?gVlr$GGONkpMg1L+&%IaRlA#hmtkjL zS+_!+u|UY%a~959fQ@W6E?Br|;WnF6a>>GF3)d~&uyBRuj+uW8*FshOZnW?^xd%ZSee6^_9xG9LZzjsg;U!fQ<)i zG_cXoMnM~eY*e;U#YSNpMQoI|QN~758^vstv{A}NaU0D?L`&GI+w7hSF6z9UECTl#M-4h}d8#&CM+0QClAxoVHR`vr*kfZ5wrLJZhtcjhZ%U z**ITEH^LJ~%wUj@L{ckNJ1U5c$86NIQQyX@mFmGla$uzzn@6v16ME{5*@czraT`zA z=wPFxjYc*a+h}E@wT&h=n%Zb)<5`>UJ>e-EPuqCL)~5#_8XV>MpYJQk!Ek3k|0=~` z>N(QNMhhD)Iki=)T|eQ)pD0viR2K8k)4zs3o1r_af3I#A#Q%+vs7VuZ?~-dfMn^qqmJd zHr`*Q#ccK}bvL&@=Mbz?+gB-iNBwR5zDf%P9xX@jEKR;%B;MPIft z$i_As+ieWCF~r6bDv}L8x>|A9@8q0ltJP}2YW1Owk8I4aG1JD!HYVGc zN;Xkn=p@_t#KxyAub^9dd$m4GFnhIfSF34Zr_(vjemaxCwy3rz#An&~oI=Zy+xWu9 zlD;yVkKZp_!e>vfR$TGFvN6}j*EZTz%et~!z1>6_43xra)ZG`P#v1jVjqhzNva#64 z4>o?ZVcD?5j$)jJ&DY%cpHPU0@?ZK@nLkLMgfwkjEF>w4*%~#ts=U=T`dU8exkfoQ zTvEnH#)fCZw~-D<&NImj1Zc#lee6BbN#@y@Z)1VYP*lHmvGi%Vr=g50pnU-9MUgi8 zMT{jjmfGMB{(2kBY%I62+Qu3iD{QO`DYlAYa3hkxYxIpZie3sG#mP1GD! z(fHf=!^WS~bQ^nZ9Jg`8#y%VSZ5*<3*anZ~KXi{AuyK$hEGCpCx`qGNkRvvZ+PFSE zdW>f94ZZ0(zMgP9W7LCsSv+aul#QQl{1P(mw2hx=97apd_Hz5{C|5V`VE)R!%FA!m z1seliiqaqczK<+lqxP;*RMNj}oUw7)#uXcX+c?YKAC?Ot!71D4*c!#DfxIzB&aP3+ z-dwbC$wscfBW>{5g)(Z4p}ptyq)4zfAO?jWy&`yAwO^e}Qd$mQT3hkpjDna+*)+zu$T zc^us9Xfft~C54kT>Cr~$h~{&U-$5Y-7yDfyAr9bw_+$i%u3~jiV zU1zN-;^;7{sDomTw#;qTDzA)CY;ioRCS z=Y%gi*LKjzL1Rb11YO5LT?daj_`6xOURYA!!MxA)PYuG`h9Ttb<0N=D^+b3}qzMP( zV1k2*4xV)I6sPIn6$ei{e4P{Li>sF%G;{DQd9+Rqbnu*`vn4GYv~+M}t!nPz@>)ft zm4ns}1~_=pK^xNT9+^2Z+Mj&POvbHKLmVco@YXu@>^jwZof_s~bQv{somx>tjc_p1!P^eragbW4M)4;H zuR2(_PW`z~@!8iLyzbx)l4zY`;hX;|y(d~=gSxsW z%EB)wz#H@{!(Td>q3Th(9GqqT$H8|FHaXbL{Evel9L#sHz`>6W zVr9WDWMh8ca3a`&UmMspp@|L>bU>hmyV4s8i4t6-$>0p@Mn(Jpt-&riOj>PJ2We_9=;0kAe}B-(nvLp6NFpM~9h`9R ztApPhoOICsiLBEOehPm*6~c1UyP9vm-drQtyzfquEEmc}9T#<7RC7_?MNJpA zTs-RH+0Cl&W;JHBs^Q|=6yZg}QWuzqXZEnR%Xm%rGCuS9kGZJlqCUrbNM>(V4LFkK zSq)uu`9iCbzgZRhOm=PN%k^mN;!PKCxoF~|sf+F|dXP#ko^tVmi?%MFcJYjh7G#sF z`A9iw#*w&q&ecqB?&9~&s!LLGd?XFNl)IZ%sV%CNi`FjMxcuV}sl7$LutkyD?D2UQ zFK9NG)o-gB>1w+{pGCPY)%qz&1rvOxY%@uV^dxImx(MW{3SwDW<-ltS;1) z`I5*st(%Rvsk!8o3)_X`;u{y=x_t8;2^U?rsqb9;z!6g8NV*xq>z!??@m`5h23-8P zP>2)G*rx1lD(S+cx^bGDRLaG=ZF)H%F^_Ch#7|ptpCPUb&&2{43tjjw($q>9^Fon( zZ?Oa}E^kwLw`*$5rz|~@MHP!|S47zU@T6F^vldZ|x2wgJgzYN$CHnkyS>|FnZAE~5 z0amzJ>0*tKwLagS$7&aWhm40cF4nqe?(vmytaGuRR>eaB4;x%;bn!EpP7C8=vx`G6 z4!hXmVylatE_Q_yvdzWza6F{#hjp`dxS(DPoub8Hw~IY4_PN+kV>L8S z=chSxz{P~^>Y$6c+cmX`&)crZ`Xermx;WwDqzj7uu}~3?hxpf@$YYCT%XW3j#c3+S zM>4KH56;OiVGBRGcy*$%&aWGG_XF0GxBdkeyhSjFZ z<++lrPL{b;&bjz!yP}cg?M3Q>iz_a!hGV!)ow_EZYWB&(N3OZJ?&5~lYbmiqv83fp znK@V9|6110l-n-uxX9%pw}*dd{3*a5a(I}uQvRiu9hK@k6mfXS78c&WR4*lL>K;#z zC#MH4YTKJ-z5KN_+oAG!xYt8o5BGWC*l6y0vhWApQ9e&=bbb$w7s#^{<<%W($`18_ zhk_omJSY!^JQViupofP%zS@i;9!hv9>7l5HVl45{p?=oV9coQ|c$?*i9a;fPdD@J# z^4qhtV3+n##=|2XDtjo)fqAIlp`wTKVYSOU)LmEj>|u8OtMD8C4|~YBQ}Mw{9(ena zB~?6B^$_tO9=`=DthTs5djBcqcPc)ZdJIv{dV)0Asj7LX?%@d!jXXT+p@xTg9_o7- zG7{Z)s+t~Zd8qB7j)xz1s%1OX=$-1x@lw~rM?2MHobPElv|Wg={8Sovc%0;_hlU;w z?^IQHN|8^c>Pg{Z)YwB44^Mk|#shtTrXKdz$CDvGf1F(3sh;xiz%DiSl+3G#W*(mP z@SL84Zeih0sj^Gm+9K`9aSyFLjP~%Vht?k2c+QvPc;8YpmVWfvqo|bdU+aJ4Bp53a#Znb)@)Z49I^YFTd86IYO zc*Db+WPyi|IV2Bndl=_oyoYx@yzAjT5ATyEyVV#EV?B_<)OX$v+^zWCA@)8xR~833 z{*-*+VFJ~G{Q5-R+pQ*gUrC2JXn9sIGOGt`yRz|l4zEP(}n1?Ss%=Yk&hi^T6>0yqCP6uT! zY5S*^(yu%$Z;-`}{_NxQIKQUi>`@E$%Xc0fEyOsrx>{3y2)X>(Br2h@Dnw0y~tSB&tOFhn(vs}eHix%_42byn50;ES;VB;BMlG$X(1*%kas zR!@<0Y-GHi+IbJW<#i!MKAR$!JzSw8P+96`)t)9-J-wD)qZoW8T!4t*m?Jl6C?@LF zjqtXIJ09-wk<-UN6k`wndVr6?d({IUXfl4bS7q~&-3Qmo96pkJReeKN?Nvwis>pA8 z0nOzjw~u>$@$y>-bFJBf0mf3wu?mIdZ>`0zS(5DDUF|9|e7s z@KMr7A)o&t$j@$|n2*9fiuephq})E$aG&aTPS#JC;$ekfR_jHOi%TgV5BezWql~Zp zNqRM0ZXWWrAJu-JD(mC&?=oqhwhx2$Df+Gzd{p#N)knm~!#*ncsO+PPuO<8uUn@J= z`prH?Zj!T^eOmC=Zx-fTKQVl=01eSYWz?R|8h&aTwrLC1rJx7dEw z(buc_)#=h;zqYPje023Oh(h9{8wcZ~kB`1Sdidzc_9-pnq~dF6w_gq2udX!F`qG=6 zdS71IEB$=*_wkaCfj$PXSxa8@5p0l2`xS%Yl40D`Z;McIUiQ&@vi!JTE!(e#Q2cz1 z@-f=SFkdf)!+ntEd-p4@lCSs};bUZ2lKX~U`?#9$*Nt1{RiB#(@;YT~oV>=NeyZ&% ztt$)P^6|Ehm=D9pJ3ij^F~i49^1{bhA0PSn*vET5-uLl=j|o1%awg+^jQ2sGkod0I zvMeoi=8BV%i9ROz_>e8M&*JU5{i?tLtsOUa$z&f>d`$K6nU9H2Wqsn~Qy;I6mnsJo z8=-#D5KZ$j-Pch7)#Pl*Q;Gq9nnhvu`4J4v_3?#|uSeiZA9MWhgb$_Yfa-Wa(UBu- zzNybIS;^NvzVY#`kMBY*Q#=^(GQ|7d#}8x*_0iW%r>jp7kQ{%jcGiSvv*JDylz%dv z+U>*i;rZ}=q^KG`93L&u2z?%#bKk7xlL|uBa9M4${7+fP*)*BxBg0-MOZy2jJX*8BJ}jX7y-@UfBVnMU1>;s<>k z^7V3a*hlq)>WGi$!aC&FG1|bVwGJNlal*&Ru)E32gioFFaegGG%;v`{@QaTt)KF7? z_3>NS)LD``Cckr<;q4zGY_L&!AJh@YU;K5ZoT1o<BRvRNNY3xFRgl-pKuYb zr%3B5XGTr02=1I;pa)l+i)5w#?rw0{(O@uIS8uz7SfOZGp9lxA&ljpy$uvr(Q6Y_r zX*`(5LunN5sFk90S{s?NX_Pypk4lzFquX{ZvAiu87M2eo>rj#(4xb`kDa{X?pmO*u zZzYW?Y28}YG^%ZuNQg()>2~;QG>xpVruwfw4^=*zMvXLvr}^Cs)J&sR8tv2QkVfq^ z>ZH*$jVIHnn?{2}+J9)0#$##JOQU{R@^}dOQ-cs`7(%82p9qmg|NYuH?2gr_CY*cWVmqL7C2v;0ZEazwkr7<|HKO}@KAq9q| zK~fN>AsUg!$TU8o;H5DtjnSb9eMqqhk@2B0zm~@9X>1JSjWpg&W64K4H0I-Ph4|ZP zypzU}L+ah|_PsR5gvi(s(vx9*Cb8eA@H3WAYp;wY)R7Ou#wUbuVwxxaAx*Lv9rLG; zLb?4o90R3ya)?Z!?znR3lBUDdG-jkRGmX!}c})x9^pFl*lsUFpAysFmQLH0A4}axT zUxXEIhU6`DSbdeo+%yiRaVU+i)A%NhWoax=>UA0x342(Ln5GNgnJZIH3*oO@ zrLZS{8uQ4DG}6>xGLD-2sa}Gu!`fnha#$^(fE`wgNy#)8rgf;kDC~%HId@p)I-)*q znYEM(ctr7H;fgd?rm;DVEorPuV|5zq(pVopvLbJGxWigny@THjT?^ zTuI|x8s|yyadMHI-7gnH$cYp>s%w65LM~AV59w(7Y8uzlxJkiFBYIR_Pvb@!jON-L zRWYVskE$nj>NNH3u+z(@b$7hIo95?4kSD;s0TAH*qbf&$djez&^b(Lg0O`OGk2A^{ zAXk9f4YK%`i0R3aJJ77BkdVc!b7z|54e&)nT{vlvWNniC0q$o>fY|{G1b868M}fAq z1p^cc_&E-=2~e1g1b8$+jQ~Xh6bn!xK*a#X1C$6*CP3K$B?E96r2;${;Nm)+(jgrl z3Q#)G1etSG5iU5Y=v9(^%oWp&_^{bmpkaeoQ?api+QnfUE$I1Uh)H8Xyv& za)2t~EyHIP@^L~5OAg-_iUe;N@s+kj1*jIFdVq(Hsag%Si%UHstQnwIfTjVS3{X2j zod693JRX3`Qa3<-PVJat#PL{IQZIz;g(Pag@xL$4kEtgD{JuvT1!&C5KWe5N-XXn@ zDZ(Zp@rgVY;OPL(1GEV6On|`$#2fNukQ7hr9GbyNxpe}HtrZ`a_*0I>jOfK-60CzKH& z5g-{L9^SS*p^9CWcWd*r64LjCc0R2Db^w<|3v>j;<TP1Y%`5&37x9h$Yt8o4-A?o!caNb^%FTL#%P$dy6v402>} zPexm+oEfnF-lr5hqQtU<@qV80r+YJ6Vq5N)59(ymb0(fIgZvqkV0i|NzVFYVPzHrF zu(wHp3?9g!Uq0p&7yi2Y_zCWEpW%sr)(-c*yXuE_%vq<-k;oxd*SGpLZ!Y1nnARK<)=3s9km zKaxS^42Ea$N(NOjsG32W44%&*l7VEyIiiM3& zD?a!{2AxjpblE$nRg(;wW_YF=%`~mwr&X&AT4&HQqr=`Ii*!KB2bpak%>9#kA%nIV^vj?>xsyTr40>kJ zD}xRhbj+Yz2HiQB3_54fyF=FhBkMb$rY63(AA0Y-_xA2?h7KY{kS0n8MWqQSHc$kl z2}+f!^rjRQM2dB@n`BEin_cV$5XCOid++uCZInR0K&Ye3mckWEGNjBkK z0B%YpzxL9j?DN;Y$LRbYy)0wk_vQgc;GiIWc_>irfHpLUCnO|>aR>*zd+3arL9I~X zWiN!D4C1LEo(|%fAV!K>;k`bd>vm{`f4=m{vq3x;#PjUT0d2+sZB)>^vdW61Dct5` z;62sBJMxYR;-w%~1hF!Ru|bRr;&sju=Q@a&gLpNF*MgW3#Ka&b2Qek+?JbjnSbISG z_<(mJ#51TmFCc-=QGh@A(tV=V%_yh-OAI-uP?piK|*olck)#Oxqu%Dh)Os7>19 zd5_lr|g=GJ-+ztJu*FNpa;yb;8k^xHz;f*=+Kv51{t>wD~=#;Zo3e&%CH zj6J9=IH)ZSVrdY|WGa^k^2frCgW6XIwSxz>mI+_)L*8{lIw$;rPY;5d9&aETL6}@YIvVM)xOH%^3*vYX(I8?$ z>l}!U-bH=?Eejgd0Takd~4l*|^8ITjB2ihA2j}w{f)wwfnNo^P3f@qyXiis&dL3arS(=p%plhX3X(s-u_=?Wm{LQLvtK>6m=nH}$AiQAZ^mm336nz1@KEz}dgN&%>%Zy2vq+yqfOqMI<$K)Y6fq z!>6ORjygK(>8P(`+jri9pswzn81wXg)ln@MpJzL&HPG?pQSW?=xb!=ppS{(=r!oTU z-p4*l4$Sf?9s7@Jyw*W^V;xO&OwsX*j;1=A>3CSjBRZPvXrZI4jt6wK)NzlF);ikg zXr)7~^<6!x-OFBm>f1eN`gO2-YYN2;EtlcrK)_m__ zxwkq7b_RXZgTBX)X`OZNT3Htz&@gAV#Q610f zcuvP-Y>xAyV}y=@ItJ-@LdP&2SB`0ebqvull*+5T^R%MJHEyl71vyeal){1h^_lNU z9Z%_aMjHBTiEpHir)3t}9@ic|u8lpeJ-*WS3?K4&-S@nXQ99qXg_m@U*1fBUFL2_H zYYg%Q$GxXzUew_n*M4Cw9pk8=<7KXz9I#%mgqvKT_ujzPG$6_7Rbup8{xm!n?u5-!*UO-u)3)1=@Z@(SVhh4zSmA@YjwOu<2ttMcw5IhhNX^ob*$I1 zLB~cNJ5FdT*yy+3xe%|bx9a6BpZ9cZ(y>Ly2RhEY;oD4iAdk<6bT!^=`ndPmM zD$9N86WUfCf1S{HduxY|4|N1}=?gI!Ed!>^Z;Qs>N#LX(e1m!gqB>&i_8$K?CgR*rbo^xCX9EdNC|6Ag z4}_4^;c_nuA$JHV9cdju>)5Abr;g8ce68afuB?;Vk6V2`PHJCp*>XcTseL6l`=qw+ zq<0?mEjxcw`$;heAp>3}3PeGEubo`y+Ts{mio?0KsSU$)#EBvsaZ>1MJ$8;R$3ewTz zly-vMo9@ebN;{+DWG2Q=2|2CfyOY|{liFDwR5&MiUhsk-g%@>P%J9pqbxLb?O1rA# znvUySr>C@=I&N|43Fn0%N^VO}CiV&-gge5Q?(*H`>YnNS7|#*H^ix_+!4_A2Z=cfg zgpfCc1|ejHkT2xzpQS=59YX#P3WQKlBqc-M>L?_d7~Jn$wGMf|r#gwSjbPgl+6lQ&kZSFPbP&8hgpNY4p7O4u zaOHLmp-aenB87>MBX$e%HE#Gags(z)D1`1IEDT{$2t7jR8Ny2;j18ez2)#pmC z&?khQg91zs3+XG^FNFRXd9l;lBOwf+Lr!athA=3E!67^r!s8)yKCKNstqqi-$)`0c z3<+TZNpj3I;*|LfDhqR z;lS>*-b4PBoI0!d&UyddniazA5axu??3^|?(2&;(|wT9jNe2d6(nmwnj5L_u( zshgjrYeINCgmt31ma8M={a=9H%l>{J-(JGB^PKj=0&EQ7U8W~A)_OY&ZlX1e1%Uo4@3FEh@wkjD&FIoHyQB2=Nf?5E9(yLr62U7Qx~EAA%b~ zt@9ecC|#|Gzs&~k`>pHm_wNkh^ANs}K?Tlh{2UuU$9&&;jW0Ig*AKrA;Tw)IjK9M8 zHiYju%rHI(yV1up(@&TFT|=B72C zLEaA~?mDj#&xdd!g!AXMi=uEz_A8zmvFNf$u1G(by&l4i5GsXHIgFbj+>+A5Vch1n z&jlDpo-po)fUq}SUJuL>#%s+yo>L@+E@-)gP*UrHmN$%iVH6MvZ=+MllwY!~FK7kB zC?tHuZcpCtf>tDqqG1#Zqj(tQ!>ABOi7-lrQ8r_%Z-9G>P?38QKle$lBGM)fd0yP#!-`5JIvjWBA5QAY++Qxs~2y(fiOw{95q z!e}7E`WgFgNxL&IXjG$)FZ}NlQ@rsP2tx})h0!pKCSf!Uqmk&$KICsK9R7 z3tBUgT#S1S-MOH(4C9_K28A&=j8=Q;ZKS7?TvkLwENEnZE`CQZngz=~p zaS9%jiaGxLx2=I9zi?3-62{Olo(|&~kvtK`Q$mJ?F3WH%} zm@nV+__I>Es`crJ`zo8f^=-T+63F@pMGj0t1I2fi0%9@&$ZgmjL1b;n9wk{Oq@ z@v@>{7MvhBQE*ZibmL^vY?=Y}zleS6mXm)86+7KE{oI|=z^PqIij z$s1w3DSWKRmxi${jP&VXVsV)nTj=zE<$9jQnjO-b*!)d;hK5 z7zW>SvgxvSw0b9_^Df6Id{aiUS;+egxocjntzm2n!ww@6#`Z9Fgz<40pM-Iamkz>s zvaELgvi4CJ@yi<1-pksjTxelL=qolChR$uatj`Q1#5I0JGXzP(LVQ=Wj#spSS2Ro1 z_-EnH&3xmoXtS?q>~oA}Y3+Cx--JeV!bpa(H;kXcd=DN{VSL5q97Z~fonf56>-${r zWLuA$cYP#Zgz;q<>!XxR&A9!?=;*o33cL!??o@s)4_N zfxBVAKwblbXZUj%$Y~&tfn)u=-sUnq%xz%UME~~_{KH@NdNOdThg8ldRq`7cI>pP< zT0sMa49{#~L6RZ{w$1j6iW?|lKpALgprnCP25K3oZJ@M)G6t#|sAiz7fpP{a8mJ`g zmKUrb$WhZXo2UCL8)!Y-U&X-0IbOEQ3_nSZS^ffZ{nZWBFi=x^OP$yi?fiH@$(Z^6 zItJ<*$THwFP|rYYrq|&H2A})#tTEkK;z{nG@Aq@=`a+Zb2Mm6e#lP=$uL%}Wp^<^c z2JSP^-ar!rO%1d#(9%FsI?&8OXo8j? z9_ZusA-dR4;oh14$xHnm4BT&^i-E3&H>VHvK}Q3f3~ZU|4YRX>587*eCi(xF=C9sf zd%(bhoUes`4yv0Fx`n)fu#nP8R%u8w}Ej6#vABkpf6|5z!L`g8R*Y>q${TT zA2#rafyWFyZeW0TX4znTzsUb6f2Ys$ymV-}pK1dQd^iMyq%C8bf8Tg7Hin1=PIS&G z{$U1&8+g{ha|T8jc+$W~15b;Wo-(k0us7awS2SW^zW*5mXZxXX9~8W*v6bfyj56?| zficp7(K1IbaLTS|oJUR*YrSM(Y-SQ`UG?m=U*d0bReRaM1Oqb-%wl*Lm}Fq8foTRN z)8~dakXIyPZ!Y$eb2gbsUX`Nh1`dh*H9F*~Mmf_AnJgNgZD0=P!oVUaecixZ1M{SG z^i^%XSm1~lhqJC~3)lg%@P+}-*P8|w8+^aI7ZU5PYLrB-YD)|-uE>`gSYaT_;TTwH zU=`Pkf$auX8(2eM8Q363)(WmO@Rq@M9%921FXkBoj7%Egylgb^j)Bbv-WSX78hFpZ zCI-@cFMz2`PEA(a!uT<;)c`w|-5DzEy{Zw}!yTMl13?42fsYJ)Y~VAQ*-s37D*7A< zH3PFeWg0(yRii&c2Eug01i!^qJk@V7dMEl#?kd+b3aQE1ju>EgSGlGU;|6R4UmN&_ z*MAH+23!Lv1G!}JGU}2Bmb~ugYDyc}Y2XV9wj=ZXpBvac-?O}EvA@YR?Mnk+NtM@^ z_}L;y*LJD@TlU1j57M9SxZy1D_Mbu1{JRY7G4LZT$b3i){CmY?>?bFhUEOEk z7y94C8WX>AAlEcrvnplcHv_*L_`|@T25uO*Y2Ys@-Op{GtLd8dw}F?gdB6S+aPv2C z+Q1nGmEry9IL`UKrX4nLgi&-&>->Utlq2F~UDLW1@-y)Wc*4L*_VAi^{F;{Ix^{{# zYOIyJuASw49nU&%;DUj3+;9eDF*UrdT{Lis4!o{iH*lGI#dU4gb-sKOL$7NSuWMHg zTr;p%cu|=L)^-R>4D&&-O zY6G9i(+D&%(bPo1ghp?eXk?;!8z|AtHkfU#ai$g8r@R@}Otds{kBJsil-+K2TiF#` znYdS4&lc{#<7>;TiM}TKnYhnHdlTJEJZPeWiTh1-G11jTN3qt4Qy_$20EiROxA=SEm2jJ;}B}-bXZPt-pzfO+0R5phzAu@u-Q%ObqzX zSh5|(TC6_E#9$LcO*|nAlnjxI**e){A7)~BMwl&s%EU+$(@o4U@ib$=rU{|7S53So23d>Mvj<2%)5I(jZd!Z^ zz{En4EXo+9{p>C+7Ws0Sh$SYL3Sq5f8A2l~OsvdgSN&%!YfZdm;&T&UaK&}?zilEd zWS!u8lkZl=MicLt2$=|*c-Q2uWb82Up@~f8s0Hgbcbdr41*bZD?@{^E#8)zwuSNJvXU{X^1vxbC zNZ*?HP6+w;CVt59T|#yX?h*Xa#9kpk3H~g&Pmpzg5%Med|BU2!A%6(Y9f`k9>^Jf8 z9(=L~|Cl&nV%1kz{S^+HIK-K9u+za|6Gu3?ajc5tsEK1H>RG67;kbzt+`BCAirh&P zr%V*LP{P7#6K721wvfldSrg|>+~kIA;=G9qCN7(}!u{cO#3?UH0EVfHG$ zD&z)tfG4zTCa%--H#KsWGW~K>yL?l-ZQ`y8Sh&Lt`Ie?`c||!abh)MFv^=vU#9YEj zM%>c!TF7UisD)w{@>^c5!ctm5u%KX}j6RzvB7FKSZT&4RddutQFSj&yrlf^Z7Ajkq zb6YEIp^Sx!7AlGIp~Z-PO7?mhNg3P%Is0 zVYr2fP)ngYLvi3kps4(mg^?C&d>My8gEj%Zs&s!KJq;(EO zWv0G4)C(4F9M5{u!WauLSr}{ac|T0IFwVkw3zIEOvGB5m32fKGB$~>hcye;8PJm}t z5B2rFt@cGD@2c`E7N%O5X5m!}rwRmUlQ+D0MVi;l&-C^#_#9s0pJ8F9g}D~yS(s&E zHUrhd>*P7qtK0lf^wq+R{BM`hIyTns@2cI~Qk!pKfrW(@Xq?&ITfJj3jng1I@FoN4 z*9PBM_}0Q=3riSO7M59vTd-;TiniRsCJUP_tYCok(N+qs5?n1v;Tj=p1>dspwuN;T z)?3(M;av;wiF_lcps)6ha1tg~Wcr`{ea41`80WOM_JM`1mUrnXBDl?h#jw1XwVhLA z;X@Gy1*!9qg^x4*6APba_-B@P{f7#AMiR0R7H(uDCPzKQdks{>4!#C;y%&B)InweT zVK-VX^sX``IF=mha|;glpYcAXqy;y_Qx?*~cV;B~hU^!N-r2q{E$rzO_{zf9k|n1w zokM+R;d=}JaE(~_!NM*JKUw(M!r>fhw}l@q>}5p@S97T1ITeN3gh+m)nzoNiz`~zg z$QFL(E?wNWxtQ-aI`%=|?-pw0R80K*=)Ni5*#ENdH%EQfyPmc`GwOEm9kg(W%P@k@ z5qx<(>#&8(7OrsfEa5+5;i!dUv~1yog>x3pTR3TXYNsunVPpz7#sw(J<|Jn=?;T$x z7c5+~a7lFjTbj+UTDWGRY6R6HxXx8$p-=>cBe-ed7P}Wgo(OJBT||&0;%0A6`nuB_mg|I@?{jV^{G%Wf@~v2A}AU`nFz{8P%MJt5tNLel+>bH z38|Q^`MFP(Ff+5md_PSI9KPy8qL!EW#=gZ)c`ksz*>Gg2oXviJ)c#wIayk zmL5Uv2&0V%{TmQd(XeT=DBj_Nt?#ncHzmSfC|LZ6F+$Dk; zwY9EnE2mmmTdThi4@A%{g70(t9*m%S#Ji^IZF&*!b1f^M@%6|^dPdMoIOSC68$rJa zUW#CB1pOm;IO3f(jgH`v2nIwjFoHo5JQ~4c5xgo5HErQtTmIm9*5eWM%&A6l2}Cd? zf~O)F8NvFTDw$L9y8uHY*q2j15y7wshDUHNry3!WCpim!w7j_#C6#iirz89%hxTm5 zyKnvs$1)(R{c-Py?Q;=4AHj(I{>Hf!(9t%&S@06qnI4QlnCMx*b%%E;mhi=CW5sQOp|tJMKD{) ztAeiyP8XaJ!Av3SSe0d%L*o%Fj$nxh=SDDJ$h`mPEQnxX1dIM7Vcj<(cvB>|3I>>E zS{lI$kt`EjF33sAE?p_vRf4Ozj+S};c`JgqBM3)eM6iwyk9eQa`B-!|M6fx6_aoRS z*>?or6?{){6DQ($*2A^_y?U^P&J_6vf;7H0g38j$c9HB5{4i7c5yK->_Y)C*D)?Ch zK_R+eNHAN|6dn<@1lh{Z(nK_Zm`J!B{#uSi1Wp7eA~+dAG6I(&5y6iUq#{U1@QrBh z6#Ob<=ko}@5dLLGlI^0eB|B~f-@T9TxFRy86Kmmz4BsVWHzOgJVwd(t@KXeTN3cJF zpBbo9`n%vSg4vdT<@yyDF%0NQR{TRs|BT=-A-~GdDE}vdgCaQ~_}+5Q=Z7LV9KjKh z922DQs1Q~>o{^juBd0i75u6v{=?KnbO3yN+Md3mO7bCbM@=Jo(1uqL;k-5Gq{F)%! zT9!-Q$ncv&Zt*CP3Cr!`in}656gi^*#!1d7I9^uI6Gh%AIz`brihNPzkD_`MHAJmI z6eXf4DZF45g`y}NMUjk!;!zaM@M0Njg;sbrONqR)VCg8z2q_yyg^YeVA>}i*SfyeV zl|+~wtCUoUqH0FJnh?%)%_wR`(IkqdQE#$pN6{dPEGexMMcs^kJ+WM0ve~oji$Y1( zFBlNi1ZkGdF*THIqbM2+p@f}j7De+Y+D6eXTPWB{u%+NVg4xczS9oi|HiA5>q@DYO zcZ{OF5K1}-xu4F-L>Hr_OB7wB7#zhADSaS{9#Qm+qFWRXisT`BNj%&=V<)@aUXpz@ zir!K5iK1_&^kE_WqUbNAj?`uAk3_MfvNk}3zbNgoD5lrKm zif5yEg1c@X?*`~FDIG32B8n%4JSE7|kx@LI;oVzk&qeWk6w{)3HHuMDjE-WGl)ezf zi&2b?Vw_~hWSV{{Q#ac=S}>4?y1vp@r`BzsculwkJg&IqUeSs~{H&&$q64_}JnGI#74a>j5aimOrF6@_b2 zoLr6@nY!17bgB`!Ddd*mZNWQ&w0}95Ld;tTY&W?AxnjsI*&;FI5t3Js3dM4(d>NiU zh62L5)(XbF6<0{Gupr;uOZ}pvP%MVxLP})na#JlGLzx&F#n3p0vN4p4K}l)(7%Ie2 zH->sKRE(ig3^hbvS+J^L6+zn1_F=Ucs%IqLQ9yXDjHGr9b%fvBN8>@EehdvH>lb7^ zWX0f%q3DT!&%v^{(14U`EGql&Hqww?lFhA23{7Kb9YdQKnu%Hq!RFa~Ko%Qn8N)p> zwECYU_V4kO9j24pX5{w^X(xD}V0*z1F=QWiI!ZQsq+Md@8pF&OW{L2D82ZQXaEza= z`S%F*ppb`R=q{v(V9!ixuNZn~cpo8sW9TO&_q>0{{)lA9#4sR+M`L&_hR0+4*bRoo zFffKeF$~FA7%YT)4*SM)xuF^PV%aE$OZHj85ivZ;h>{mUKNZ8s41Ze4Gcl}_M^k9$ zInjSU<{i67362(gA%+))^jY!mIoM00IaY974CDC|fW6J*pCC9@aH8NO!O1a95kj3; zV)(Ony43_&VTZFUTEV$kAHal9VG+!zkVa43d(G0czQqZmGp@gJsG z7{kUG-icvR3~$7+G=^m{ycxsd7?wyU>7q8`s|m~hJ(pV^!-|-9Fnv3Qm7=pokbYPt zWHlE^=IFmxByS1Q!|O7d>xFC(%w7xc#;{qk?+I=a%sxkbKZY%m{UC-Nv46XlAyH{EIkIt%?rr)V6-BwI_c zcpPQoC@Z`~+*`sWg_nw>w2ts2%7TzX~wnA#H_8i_`_yciti=#sv z_e-{;U?;)8a;Dl@co)I0ab&M+R)0_=z2kT&j_$&H2xjlkJ%#s*duxi$?;}~(>KjKt z;r#`(XJJ4bkH#@Ej!E=k9FI%UQ-TBIctXe^!NG#GGepQx!R&Y#CVaTy2*D@gSRfuA z8OPIcJQK&Wag2%MB`JL_j?qG%7o^Qmad6KhVR|8s7e$`E2FGS}Cd4r=!^g+*vhdB) z3ImeLljE2Y$D%mih~t$wrg9I@=uZ*W#F-DW#)kX85c)W@q>uA*V-po8;U$ z=EX5T?)~IhAoA>!)Z@5T|yt+vMTo{;wiDcKaq z<_zDRTWt~kK}NzanQn_?dmKAN@=+X>^QaHwIFnnkZk{}fS&~oV_$-c}7(#Ib=@5^?XVsdJ@> zgql=y<4DJ`Gmey0|2dDM!r45EMq2VCjE44Q90l^K@8bAAj<4eQIu4e86ZeWph~G-Z zT6xtEaqNm?PaHpT&E{2)=JiTU7+@4?8BG^6q%v)Xv3mDUQo=oR53AL@x-ETogiu zE24i@aK6;qB6uT?n{=0rf;Mi&y*tP`Y~-|YJB~Y|?Br8-g}?@@@NVg!`BW|&m!*1M z8@X-dvAr&_v}Asz@+;nl&1a)iewE+$I!SpU8-;C@wo%4L5gRm8+(ro-MMa^Q;E?>@ zSXj5D4Pq$~R+L-4%(6;Z8x?I-5_vhn@-`~in4DiRt;p}SUfD(!8(W2QuvLY-`BgRP z{NMRiO&hgryv9D*sBNQ;jovo;*r;oxo{f8Lw6;;-Mgtp-Y&5o!W#ffje!q=?jcfUp zkE1A{NHiPOd-=&53Q;1bgvt#Is3uaYxs4V!Qa$`l1)GTlDzuc+dx!-Tvpoe{iEu#y z)y76!8=Y-*vC+=PeKy+L=pdzRj@DS^ejCTT`#W-U1r*8Jp8ih4(_*TtjR$OWx6wm- zMI+s8JSY|ph{8j{hdt5*#H4$J=<> z#uS^M0t7ou%?UOp+L$DKLm@TU#$2fz6`acE3aV)~E)-I~iljhc^{Ob7%&;-j#(Oq4 z*_dTxwv81wzXOOlHeR=}*v5BV{c~;16S7EfzKsQRRAE)8uxeLWkt~!fHOCiLZ_q`e zwxqBM7FJ7aEVZ#rB;OTQ%WY6dO(s@fWn;CCbvD-9I96D#;r`FiEu!)jQM-Ei-(tWN zQEvSu_3Mz8z0!%VdF!owbe$l zh@vLbHj!+nj!5Xnk8FG@Zu!{8CpLaBqUc^Ci|9IHsFz>25wQ_vko5A01j9BAA*SG! zBFf4x?d2~~RK;w>ZP+&aMOEjbDq+Ln+Ohf3LnLiHAwrjPS5#$lu9ux$EF%A0$SUF6 zimI<{d~M^O1P&zdjg4<@;Pw=NZ~BY;lH0VV`2^H;!HEK3z=F!e2K2W=MDU z{=P@t&z{&gAd(ry6eS039Hw)GAL5(}p?r5Sb&RXq##L??Hcr?$Y2%!Y^EOU#QJ2-u z*f?wBv~Xri&POu}iz%kO#nlBH7i}~vt}e04WsL@jwTr9ElD#4w$QE9=af2gbEEQMX znaXN6Z9FgJ7B_^9=A7axTwL9?frO_?YdI3gDg685o)hvUkT-!o3G_`MUjq3PD3?I_ z1PUZjFo7}&lr5nOB~UnlqQVaqSA4dIeJGOf{BygwYEeQJOQ5)9OC(S-0d|3~b#DT#g-j`_+9c3cbb2JvE`j?J z=#)Tbk+e^sLjvEHRI5s=4@;{1MaZ@~3VD67)mG%^QuS{w01e%JxUjqFTcs7COI1vdvlE9Dzh9)o|;eDO_(F7h#pkpb;@0c_D zcmjhGm{dv)q?!nc%nlae%2Miy1coIrB7rA4U;X_2xcP9={IHbzwv>8Ggij}UgI*iS zZi@xtty1cl1S*vFT6sQ!Q3-xG(+iu?3A~WNssvUi@L~dE5}295tOQ<4U~B@fBrsLf z#w9R5ftRyqr?hIzO^@#F;h&tqL?M&tE0NRY6p;*-EEmEw>C*HBUQOUN88U@TQ%ZYd zoRPo^>DBB6<|OcD0*e#;UIykSysybGN?=~XTTP#oR`bOU`GN!%Ch%oxPsnt*w4&x4 zqR&w;Nq`G#x!}?SxJ;OqNtR@V5Gt%p;7(~pvL=DG34EGB&ob(*1l~^Ig9NrRRAy-F z5_l(pcezL*~I?e)+piXW_mw?Eg4P9wNjV8IODPU5v+shZ20FI1J$?cLqy~2)6_oEm0w? zMYqJIB0FFUNn~e>t7HOh0x7QC1okHIlLYO~1ooFvKP2$EWWS)3g?z=GpX-HzQAT}D zUk&jV!go?+m-%;He4oI3!f9cb*x8-H9toHq1u182F#Vjs9|`=Kz`g{2N#NH6u9Q)~ z3;rg^EO${Nvm}3UJ1VRG7GAWh+AoCLHH!{%eiL}WK{r1CnZOY?O2QhR$WTqasrXE>Oum$%c_gQ zNvL@xf$Q9y%c-jgTq>(_ms8g=gr$wksau>u?%NIuI=GX-UGDP^ayjT)P7N)m;9zPw z#gxOrav`}Lt>8Up(ol*%lqxGLcy${)Xd-G&9UQ2jC}cxlS5Pe++^nGP zbFI83}`DTX7%C4+_tE{Fu;P6SNJDA~Mo`d-gW;(c9S%d|MOB{q8 zgdHs9+&OsH!Fya#4punW;9y-9wNh}6gS8G;Ian=O#-33{?XIHUlI+_=2Pdj1>NAn# zt*X{@AyoCqM$vgkuys{WVUvT+4nB79iG%kYY~d6zs2qGi&s0@g1xcQ(suopM?^RVh z99UJ=hYmh+KnaUTy!h|tC;ya-h0CoAbO%3FRYC4%RaMSviv0Bl{H?oyXgDw(q^Ma< zSq>r&90${@si=br)l~0lD()aAoY_Xz)HBtT?SLd9$ZS&dT}DVX#fodHsc)(&#>3|h zzF;JOfk9v3ORjWIRthsy_}alY4*pJJe-ht1_>Q|!5@nM3o}FY59UOD8%fW8WGSwXH ztEToi-gBqFI{4ASUXlDnbda~Y`q{zRYHHt5jcUJ$q-u3VIsfYWn}gpS{6Qi7e+q7D z%V(awzXR{-=RM=P-@!lJ4ICVl06xrltf)1uu84=Y`l>5(4&;cGa_2nGsdR9IYu~|1 z2d5nGak$G4PCGcm$UmNSjgtLwLT}K{f6GCkBx-i>-{v8}!Ch{l?fiL? z9zu{LM-n-O=Mu~fb zYN)nJv`gY<4b_?iNciMq8^pClfwrAF8C zEZkR1^^>C6wG@jUp%cn#kFf(u3=sLF(n;#GCj&X&J^n#SY^F@bOcEoLFlwnIwbboeisbuR>e(co;|$hTQNxUa~RT8U(Y!F-{__pBMB;FE| zZD*ZuT3eqHZWQuPM*eQ5#Z5_U7UBCzY!$L4qw|3f_Gep0vOOdDFo}^{4$AbBj0fIPvS=gKUa5m|91?<+G-b%0+Rhfuv=~Q%|m|5cT4FW#%FCs<)7&P z+UoZtSo(7k`#9v<>X#&bO@cb))cLx$`b~_G9ICDUNaD{V{$i-tR;)`qtou(A2a?$C zVuy=^T&-ODE*@}kIEf=kly*_Z#ZhikTu@2eO5%7DCz807#N{MTGWe5NQAb_iK5)W+ zI*Bt$oaJ(^8@N+jonz?MQT$WMc_A(9sNQwd*gEPW&7Su+Kk7H?s9kl`l_ainSFEe9 z(sCU|;Wf@z9hI}Lx{*ZvYJvOes{VD=?Ii9bk=I2&7k4=*7r9;JagoEtvvpNY!8vQR znbiWhT)bLWEw8JHw8Mrd++J7ZcTvDaQ5VHr6m(I@MPV03T)1`BA9dB`x~f<`k1(56 zPj#rL2G&!>T`Z}mO1dcF;$*GB#CnQY%Eh4*{txOYVp$jETr_pj%td(@6MlQFud2F8)bmDN&Bd?v)cy;8a+1RJ)!t+NS}tn4sORGOk%2m_ zTVK@`&TOmtiixDYiv}WGec0bmBz_kG7mZz*bpoU6E6s&+(a^=4_0^90s*#ISeO0i5 zs^38USzleMubQ~%&_FR&s2XVQqJ@jLF50Ee+Fs+Eg-UEJehQUkTPf!fkQwRT}Q zP;Fc=k^I^~Wl!Jv2I@W+_q*swXJ)DPE^1||4y>D{n5E}Cx#;Yoi;JFF-YksFQq!~4 znk=>Bguk1M2VK18V!DfmTy%Hww2Nn4^q{hf0WKbO5zJD(T=a3#*F|s1ex0QbW~qKI zZe*#4UCi*Q%0AVf{r9P%KJ|!;RX$}@4D9f!$6P$_Vwj8JE(W?7b zq1wu|RyDx1jlthgb!ezQbny{acM8Q)_}IlK+`%|57oWQL%*A&uzGn!z&|Rcm>~s-w z5vG4!#9bJi{i*@eg+*7_4Ge6kA{@fdz=Vb>>SDqZfz3k#iyNvf4VBIH>%w91uuG)_ zc0=`ZLv^~La=9-xQV%s!DK7R#s(B+dtdS~y&i}cKFI;@XscEEwWdmQj_=-(5QcTQ# zEu4heZ(T5v>}aHZaIuT~0|V8?ZWnu8{7hFjR?|-Ve{`{zzPjiq|Gbgrv06DS za8QCUUlVmmBJgx$)wxiBp?K8AF&DR8+;MT-#R+a@F0OD(baBeXoF?iV_qrzPG#76Z zb=Jih7wgIenm18>&-h0*Q52qcae>p_M7>@vaM8sj?j$t=?Bu;=1MA8LidGI>r9V03 zCh8hXD+PL<_Fre8n<(;|E^fIv*F=r1A1K&Vk=%8G6bhwqyQ#{NLe3QOrjRd%>P=Oy z6u8yoNg;O%oQ`Hqy;a8j>cOUJL{pVNg|C{bf+-Y8VQN#gvZ?y0sd}rAcDSi3oWg^{ z0!&4ObUo)UoZMRRg)%8rV{<8#O`%*0l~SmjLiuK@dBT zV*L~v&}IsaQpifdm%^yp0WAfmnVMfyX`zq(Kwepv%OipN+8}`{n%XfOQC-Xk8uiy1s+b}krW=4z73G- z>=^q)YqY~t2pV}jg@Gvy68*un)BIlrj**%}Q+OhUW6jmD6rQI`Qy4DU5rR(&J|#F( zkeW{mc_xKtGm__0$kjrzXmkoMq%d8E{~`mUg|~mcn!=bAUJ~Kh6ebCwf5xRSUiixy z$%GUp3UAuN3!BNpr({ZBVbEsyv=n$)p$_f8#*ow0ix<2s1AbNtvpL?K7`zj6Qh1%K zV<+uOEI-;f)mDOd*s)n1PqVk`z{@usVgM zDJ)B&w%@lhh2<>0o5g?Rt)Ri1-v9ER9O>sWQuMJPC7+~F=T#{cNl;Md=&pGBdJ&(If|ob+k}0?%N%?#!A!)&>E!0jS%UY=Ca(jLFQnDmp@hT8| z-a?W8mEZSW3g4&jQwl$e!ViLbQ`nWl?iBV&_6t#_{*Nh)&GM|}EbZYwZg(fLR@CtQ z!q}_q3$ON*|C$1E&fTm(xGkhmB#okJ{FTDrV(L~3`&0ObOD~0!Ddf4Bbs&X*APT@`pcT+$b zxzfm;MvgRcrtwHi&yCwpdOc*~A4~J3kvHuHVIjd@rF{8>WQ#^M)Q~cK3^LCG+s$#Y8rtwv^4HdqhlH>jfQEoO5@%%8p*g?T+eErMq}Yk(rB8- zyCZxH#A(e$xU_<=MH(&BxQ7F|;q~p~sy@#6`z=-LG}_R~7qU8}y*O!`#(gr7c9Nxp zA=f?)UlSiwt5Uuv=X-ANlt$+?o=oGZG`ghGHI2S$^h@J`G`gj|H}}>U?z#HGG#-); z%+K=ijR&;{_`0XjLnJKiDWq2#y)%+NX(XiE{nL0jjVIC=CY^aCjmOjc@HYme@n{;4 ziI6XEoOsq73m562GzO>HBCOT&F6f3#G@Q&+Qy!_&CTY#QsXWp(f8BX5|{ z*w2w^Je|fER!QTTG@ec41+nv78qd?u^?jqV`ze1_ezJ&fbQfud3xBVZXK)UE9@AbI3A100^vx4KKaB<4|1wG{~8fWqq5{*qnxuhMC6uvYG#GeoM8c4;q=z=cER9GS zQOR~sY8-4#1|Cm?tBF}hifAX9M*n+M?&3c8|EPKoXeo;4d;F3VC1(Uwf`Yu+w@na~ zoO8}O=bUrSIcEe#Q4mx>$%-KIc4udIW_M--2#ATGfJjCWg#Vp-pZ%Th|C~Pe+^(*! z?yj!x2|F{JhNnF>rZdzO&JOsqYC0D}LGQCPJWoR)4MrM*X$WyQPQ%Y>FwpSIExX>f!`(-2ETJdMBAy3_i-YAFrQtHow%7hj!<95#O~Xymyq1RF)4+JJ zvunj3r~E-XkKMo^UQfdf$qvlt7X2yu)V#%6tLAo(yB2#wayJe4)9@e-_tFr4P1~2j z-B>7pn1;Wl)+50=E!|rG2q$@*hJTa%iIAs)|D|DT6;~5J@M9(!e8}j-~l^Z za`_OiqH+tOs>&lIuV6kwmi|#i74)Hy4{LgRS+TGWulP{hhjmp|5gM$jiuv%W58kS( zs1Hr5s(w|~Yoa{0s(M}8B4I_!nWd4>tEy5yyy-(}AHJ=s-tf8KS|J%#&|Ag_yQ&K0 z_rB!=vrJ`um?FgEL#hvr*#z6-hiQCx+lNX%_v14^R#oMED9^gBJ$yipzv)!);b~P> z(TCTnx!KA-yyHUy9~#m#)f7Ly!Y|Lf>q8YEs`@})&4=nf)bOExHPxw_8d^>9RWhcU zKKGrnT0YbkLS9EmT~10;Qs0N!qR;2aH&j!NeE9v7l%W&d2jiRi@I^KE6t{~HXR4`Y zY|DohY^aTAU~^APA6og)+J`@@sduWY*Q%>F!rS`L&WH9sbnv0GNT|@!hfcz?R9DPW znaD(8tLmz&58Zs|?sLDn!I-%mPbKN)LvJ5`@Zr4AJyiAaVHUgULth{I`Ou$JBl3wp z4D?};@X`XzPX0T`uL;Xg| zHXpY8FxQ89KFnv>h;VW#Ec9WK4;y^$k93RKNgtN_u#DrXu1eHQozWn5c6D{KawqSVuwYu6Ud{a`g*@rDjzSW2Kgzu`ZsQkVU zA27CkIO)RUtRGNl%;cf$UkQ+`LLhCQ$uC1q4xQZm0$7A?ID(^q1x3@2k5<_sV4`gPRQjs z=;NW;bIgZBJ{+e1b9s&k9_8fLP_t_&O3J}Y=Y5JQ;n$UntHpCXK_t6 zuD0961s^W@(8G_Oe*EaeC9ZKl8v5~*4?lB5@Vke+Uwo+ZFy*-q@Z(qEzi}h=;ffDe zeRw9(c#UgTivIE846VuBnKp^J*{qke&qJ!o0=-SAI5f1 zPQe`X*n<>idEoB%XG$JF^7>K4kD`9$^MlP5_G3cbxTSd8$Uf z{)qSf1Gk_2{?coHyzYnQhd#!0y{0PeM`=IG_))@-l73J^x0Dj{hTxlm94w0__SIs= zwYU5@Fk352`ID3sKUQ{fn<$o9^N7tfaWu?MEd) zD*N${AMg56%a4M!R24slch#!-QQeQKEP9-hH>)=Iuats0wHoy2o9<8cHT@tytEq^* zh-ObX7j^uo%PF{*!V}$ke$=PODr@2L8nKZdjs582cXz5Lel+!?6DOsxd&1w$kG6jI z)9%gv_#v0pLORw`u$5qIL29;7WuK*k9C~i3fd9|TM2CiXJHqXvTx5*zRjsE6X9~1R+g^xyN9+qTRp4% zSnYRr38poEtQF3R%&zAu@MEJNoBY^H*ZHy8j}hbC@JOwtwy+!JQ^~pFw)xRRxl8Xu zKeqevz8{HR9u|Ed&Fv6eKftZ{ksmxWuby^7V(G9SM}-`rg;{PiGLqT) zF+Yxr{ACKmLE|+Vt#}fR3o(rgRPy$2;thX{cyw-JyZJ|FZJV+ zJ?{q>V1g^|X$q(QtRLr+E&d?EK+OvxxhVJ}-I!IoB%G^~rF7}fe*D7C-;dv9X>)b| z>BnX9_7y*_3b`hD-H+deu+|@pidGs4(+v^c6r}K$5N>q5U315eyMDCMQLMOjk4K_f zs-%umI)5Wbz3;~ZKOXw=$dAAM$e|;rj(_}k?8kFIpyOXZE)>+Bio2e0YntHUFd38o z`N3_FBuZRi{J}_s|so?%Bs83`;v|}uWK(S^|R^7 zF8p){4|Q_s$gQI&d#)po4&G#ADx@QClIPRi1(IKPS8D+s1w~FywZb}bb=6)G33ZBy zCgrc{yrHeVuDeIx*MxsPMWbYFEmd5{<`=XQI=Ylkvqst0P5+ro*E{=_scoRd?48ulPQyr8q#Z?k;c=rt*CD>~=~8smP13D>>Z5 z@zh4z+ajr?qcWdQ%dWj6*>?r22=Z7-&1yRKznxlLM-5Kj2(6}$hB_M2;n}oWI%-o> zM_qQWjJ6_|cBGc#3aY20z9=^k1eK_z=ISHwuNZ66r>I% zt#tPo$JAN~g>7}T)6rf>xR&aW)TBRI)KRjX1Uu7{$B6>`YHf#0KIke z(eb_Rex)4>9Kf~{J?@%4XbPUijP_lz`4AwD3`0uq8Q}JD1su73l7{PeE zk+M?9NFAeeEYPt~$7mg6bj;E*TgO;VsQeG(I3crs(8lYSpktzBrzT4$>6k2h%T8^I zkicqfnvUthXXuzIWUTxzd^GC*ooMr$+8iBQE^G63%+)bZcmGk8e^p%fH@AoiEP7l^ z9X{Y$q`OZjEv74UEY-10$8yG@^gK^(wIipubZu3)wwn7v&&y zXK8eYjt`{|AL+1bt6e&F(r>lZ$Mj)s^$DxjR($s9P;JH1-J`jX2{$38}^jsxt{0`JZIUShU7ig-{YhXk4B!&Jn>I*!mYI*N-C)tz%ss)x+|{bT~Rt*UJ>; zNb4w)I8D`2zt&O2bDVS?7j#_Ys;r~Vb2e9%2 zoh$d0XK$LfKt1)Rj$1kw)l;{1{KZYFp6Xgpjj5;V)>Gtr>Zv;%V_lcrX9(%Y6hP(x z9_o0cT=D8TKmiry8eunSG|?xsD708K11J z;9>wj22ehL3IPm}qKW~$9YCW18VB6ZL{|!+W&pJUs2spMB6(M^nqU>dssS8t?77&; zL;dOj)DYo@jc)bY!b$20sS`lmq@-d)MR|S6HVB}hkPqc6=uHA>8bHSYIt9=yfaU?T zP1b55q_tp6!Bzp>lUlUaMkJ3KqMZ;*+6VAnLv)aAqlT(8=QM!60rV3|*8sY65`}jQ z{O=p=Jp<^)onM55#B#d*J|dybPes^2T_J!0N%_D4*fd=+SR`zh%0mMf7QpZTMg;i( z=GY#<$N)wKFgJjC0gMh{OaM~?m>R&?fV)eK4`4z7o3dtP)(!rNj@7ORaSQtPdc)Is2|gJ3R1h3Scwm zg3;C6yCs0F(&)f7?vNAGNq*OwoTcwGCiy#E0G|i&K>*hqsvQA*7yz%eKMLT}0QPX5 z2JmqJ_ZzB4-Ly|=>UIi$SK1|Hx8UQd+Jb(by<8F1v_xa=$xaWmUj(o(fG-31D!~81 z()P2H2ektM203VwRxHrTO2XK-rI)Ec|*Dmd-;4#7Df)su& zUUl!Uz9KmP+u>j%$B)BgHaE`MhRanbzr0z6QKXB{;d~sWQp|NY~ zg47}@(pX&z;HLn(8t7)==Ky};u4o{ufnNjojjir*n=+(i8yz&`;z4&YxNAPkgvOXEMDKMCMj0M7$>8o+;y z=O!wbrR@+Tfq{$$G8xEV;8YWJux@IiiDF{W?I!BQrYehpm%nn4gD)8HHdQ1qQDUH; zf%*or8OUxR#eilYhk=|1iWzv-KrREh4HPs`$Uq(gc@5+@P{2UPW!|PuRqv)MpMj}O zRi6Jm8=9*3OQjxYsuE3AVFRxiC}N zQz`kSnR?Pp6=<%?H&-6^{N+?-pqznJ163D$ne`fI-dy#gf`JMY8mMNVqJg&!ylbF} zfl3A{8+gY6o0!pDZEUVs>!6_3+->w!aqsWV-BDCGP=ieysBNGoUEP8&9;$a*s8!3o zMOJw07--!>)itoSg&N#K&1s>Iv~a68FwoFIE0!8)#Bmw!8FF(2O$<0KR8s@Z3|woW zGPHC*iuFoMRj#FK)l#)EFsh|$X<$i9^+8K@tfgA=t`={p+8AhSpq+vC2D%vNG0IzL zgtr6x-#MkDfjcb~v$~AX}@61|}KqMdf4zQ^Z$) zRnn#!m}X$QWa+)RLS_igG%zbEpKV}{@Hbm4sxftWN1Jb8fq{hv78%%JV58w~yo)&& zMt%kF5^e%pJWB=n08H^B+HwOc46HP;%D_4UOLJ=NMrngy(N-JalK@O>gsc^u+g78( zdINl-gZD9p?e|u#;C`Zze-GFn?4t(9Wb!Rz+U0|8P%=TXY|h?cNRVu z;TM9;?i0cy>M;8yeQThF@CBJu57IfAQz<_pYR3gBIV$pF2B^T&uLZvmWVUB(b&~sx zfq(%+gx@iKGN<|soHp>iNcid#HP0AGOV%o%In{4qXltblvXne%AY{1jNl{3NX}}UP zM#d86pjs;?7CB-(W+1&N%2klX?Rh+DpOSOjD>%!IJ^vXvZ{Pwqu7chN1}<{axylUu zE|N=JzvaEZ8u*FxE|OC#T+LrN@2%C`M&94}7cio8g)=CG`jiuQv{uyoLu%bIaNWQS zy0o>rDQdR`{}jnB!M_AqQI{r2?i#pf;66RmS}{v&XIra>Qt^?2zlHo`;E6Qx*g(m( z_*aD2MgOVDS&@ByCWGbq8;6`Bh>St34PsponS#h1MDHN_1d%0(7lJ4mM5!QN3?gd~ zF9q>(5RY4{{B2Z98&$WB$`*8AcFPk)-XO9I&k;mUT4>|`HkwN$B)Nl_E0TOcAfp38HBbZwGO*t*RbGjUXxsuPpeE;JboV1f3$@szFpsa@MLDM6DoN6!q2(qIM8< zf}jpxv}95FqF$z7+Nye@P+zctU_(LHY81r%BHqT5WyNMeG!LR}5beZH3&ECxrIw+U zkk*221T(f%tkph<4ngz~Nk_phL39nGlkm=hZ-{2MAl4N1vP#2ts=IKSrKG3m^b%xe zsL(fvenHIPL)5dF+7M-L4489owX4` zjFi%ulHDLkxv!lX8^o1%YGM$Rf*2RXf9(|0_#h?-uiwtY?BpP(1Tiy+_U+ZwAb8Z9 zE;ucSzl(aA3bj`=lDuMjH7ke_?bX8eYBqONA@hQmAH>2S7STnosblRG|B!tFjkH(y z+p7#sJd5f7_G&pheAK%n2$n7tTqc;YgIWmAhT zAkrmiLHL5W7{rg<5Q5Ny2nP`fA|R1w$ZC4tK`{=4!b5_lpe0yMV$~M?vx1IbR4^tO z7c9|HCAh^cb7T0NkRL>TJ_x>md_j;!jLz_x3CyybuC6{1-!bIfOr(dC0Sd z@RA70DajVXluj;L)k)x69Qc8R!1Y!}XNWxGr7IK%vt0BB5gfahm$lYNwbXFxpC>6qN3v(>I5yG2n+QKUq zN{3J;grX*jnRqLNvLU<|!nP1nLeN6!9YUWFJRzip&_09?A$UVjA=C_^RtV)nC?CRf z)B7&FcU-Fw!rLKK3SmaW)QTZ~^F%A&Syc{UP{UOI*Zeyn4B4(NJE0L-R7EPXZq*Q~ zC3*D_Y6z!3i>h~4wL@qcLbDL+gitqxdLh&gp-BimJF5mE@ZIggVXyg_)-Z&O%d|#< zB#lGveoq(3YiZwKMCrdmm^d z?IinNXVo#}UdVSBBcbyf5Jw&0WV6SAY;d`~dA@mDjTnOVs z=pVw>&T23n62buC%nqcZlDx}r8rvEg!iW$?hIkWI8z!cPv;P;}>-|xZ9TP&QbFSuS zx?+J#n8t?iZM9UA2_Z}jVMz!}MR`&PlNpC0%$ehAP7PriXDWo5QhKt5TV=ZN=bhE8 z5DIot^Fvs`m|>L=N}kjxnJe;ng3MmrrY)2ziv?+6k&uziU2Az4YRf`c9>Tg1)`zfy zvolv)8Nw>jNlDXICu^+{a`_K!ErY6ys_EB=ABDXeLf9Mv$wonvO+t=FHS#SXY)#4w z?Z}qVO5RyNmi<_!ok#RrV+Efe^k7;RGEX!htU8s}Q~p;Ts9d zgCQK^^y%Kif+RdOAEorMY_l3RlBM-UDc?rYGGIP?ItY{f)PS6gir`SuvS-PiXS2& z*g~uj!a|nK)94?E&JQ6G!ddPlAzr9@w>;K*F4W@OkgsXX4%??~@2bv)aAlsxD&+sp z)6R?K;&(LK|1pG1A-rhf@G9-65PlBfK?n~+_=TYx!cFdqA^aA?W$q8_wd=IQI1k}> z+7IE>KiV~!{Zkjbjjwr`z1meRzNA&Sq0w6Ir`iqfIrUPzZ}Qxtow?ebklV^%!kN7- zByiUIw5z(ybsYl9eL<2vVeL@}e~0jl`=Mz5!`TVpNeGW6%ZBLor(*NJ5ST5|O?|lE z6~4M&gNY0#GMk|Nj3zv$_Eo*qOeX%h;jY2hI#(@=>Gq0Udcj1yRa(t%DyxZ?OuTF& zn~B0EUNMo~L=F=LOmH|kP2@6>PdKx=P2@@P>Ge`6$!nr!#2t8k6WzNh5*jZkI)wz& z-BLun9h~o$&g`a$ubOy`LK8YFHK;tdm(OjI`Uris!f zDp0soE5ps-9UxLolr@oJf>W%S?tRV;-Q375x<(uHPHL^kn%9IfQBD-7)Apct;!ACB zH#a28oA}|nmt?{`t)hvy+1vRVW2Qz_d&k7PCTehKCaRdIYU0^AbYHAhGu@!dzFDho zqTvQDYB*3M0=;ZYQQQcx|rx{qLGQl zCR&?lW1@+PrY4%3XhA<$aR*Xjlh(|{oW~k19BZ1|(!{{psjW=3>aN%pQ^|Ky+j9C$ zbTZM|M0*n*OeC77b~G_!xi+}F`gpTD*GwE5^=n`D*59b@-lTQo9GU2AqMwN#CVFy~ z-*vaXUM6~*=tD29(#l-$a-XE|V&&8(JGGhJReuv)VgpSa>aGTu7$0%NX=`^i$b{8h zUF)v6{D+ztW@3?v#U_Tc8zv^0m}p|8iHtqeXz~9j;mmU58e?KCW9d_E91XHdhL;;f zu^y`XW{n=0WMZ<3*>r-5DV&QQYMRLdw@ao9uKQS>j>sfiCv>@cy+#BviGO>8o;!o*4w zYfY>(vC71y9_q?(-qj`^_E5YH-gu$5MuLH4z4U*Bi7yVi`wyd{a8IRrs?GG9iT7FB zHg!O~)UBp_Xy)2{j{)$jwoPz5gV55L?bK6oVcu_*`k{%BOzbnU-^8?@YNv_M=>(tl zv1BRv#Kf*7-)-X4B;R9Vukg?|MJWl3KEt3arttnfRSCVB(Rz1+oB&_bxDt6a#!zalAOp{Rwi zmb(OsS$Ne#M+==Syk_Bb3zaRrW1+Z(5*8}4bdFZi!iVo^Z&@g7p%gCx*bNI8H)&-o zTtBK6>a9xC@;t5bHjP;hC&hv$RmxlN$S9U<(YzK?h4W;C%E|(TOyz`7Qo%w+3-v0v zHo1`B7UgoiRr7#%%Q(Dip^AmNRItEvo2nLSTG&xFwVGtBvjeNN8iMcEO)axPt0kqi z1$i=G$8t~6sbAkh0}Ff3x(ltLg+}6p))pFDXkwwcg%*~3lF-ybGa=j!(hr*SRZ9!I zfAI3>n^saZ{)N=Wy%qOKo)xzdJ8cEqS!ge$gP>cnZfa-xuRB! zxVJmQ>2IyK#ozQ@Z}+so`0vG8IIBH=A+>*R)yKk&-m0(Eq9%Vx8erjhM6*8EhFTbC z;pWfYjlI<%3nzQ4!4`&C`2C^wOK&%-hgo>oTMf4`!h%|+jkGY@!WhdvogQW3>vh_G zL(APqbzkWs4UUsOkGC+v!bCbGp;hdordya~xku#5f+SNcOil7>jFUC)*&sD%a1#5d znHFXVAun-7n`>d7g{Kz&W0YE0VBt3lmn|%`u!t_T@TrBx3Z=a-RYxs^`>JEy zL-KkGW%pd|tDg0Be}(_rLa}=(nJa7eN@yo6e9QIKPn~4vH+sM0CcuF2rv~?Pf54(- zZa?=MVrMKQsMcSlS@2o#b35YZV7WiOR5`2#EEpDobZI|zsGlBEg4Br$i3!F9^Y?dO+c|5wf5d!F@COU$EnE10 zf>i&@Le&B4#R01L07cSafVykpo`pvi{@&r!2#+a{WCyO@(-IE zph^u?|MDoncovC}Ho-vF}VdM=XUl^Ig z$P&iOVPp&Ag)m+WBdh3i80b1`_&_yppyEGGzr^3C2C5?iRb-&b9!AbEa)ps2jNb<; z3{u40VH6&unhjEU!YDULrSpD+)U-h=e;5VBC=^D4Fg6ZSo7Q{x4N^Ypgi$1nzXz!d zo4l`taY;zgu-ku@<{7MB4dboBZZ~QVR>i|85ym@VycJDU8iwR12ee7+u5Y7DkOQYKGA; zj7DM93Zr%yb;GDf7cF&vPOTGmk!eA;l=?~DAng92xnZ#4e~a^bl8wV?5=Of)+K16p zbee_HJnY_)POsY{jFw@vl3M(yUDjpA)*RX%ZyP$cx3{g}rn2rY;2pv+tEY4dqjMOi zAEtEVsI#R|=erUqkIJTW5hJv4V6bbvdl-Yl7#v2AFnUVUy##xQ!DpfM!Rqp0)hCR; zBJ3A-pOfq_I6#p9fjck^BJB?eV`vz2!WtEv>%o1-LnvB^(=5R#} zQS9M-x+09_VXO#aq10U@NN*Gz;=cE~m_ay1EeT_(kY!;U&zDNcns(lmVXP9@mDSyj zt(HdDhp|R1u&uR1)`d}eoBIvA4aq)i6hg_CFt&=$Ij*lTw$WM`2gBGN#`|IH4dXK@ z{eX)ij1PrxFQl>JN7C*tX>n&5A4}0EVwPT_0{gR@!Z7xPK{+K%9B(ms-~971z7XZg z8&a9}g|R=3vHMaFgz;q<>^YU$N#da}4u=s8BNWDwu=~{XNv>kH8^$rZB8(Qjy(hw8 z+x1*HB~k>5QZTVa`v2w?V4d& zVMImVcZdp06tSNXafmH)M{xEKH<)9>YsZ2}dLfe7b<8)O^lRk04V7nIo<~6*5F{cZg!jC?xk#*I6~He^$3bbP;1!#?3a)t8li;Br6l`C1nFkWa0n4ph@fHwWg|$5Kt+(Tinr?9UM&J| z1nUQQJrOX=l$tE+JWS2ojB*i-8m5@a3t2c!y&XZN2x>=ACxXfmY#gSlvbhM}iQwG` z_6<{2BG8Aa8^aXwhhgg9VX8V?9Ik3cKwg7R814$0YKf%Ia8);gdJ!~;pkV~{rSr5i zYPjk&+#OD%2$l|4tVLv^qzQXl$lEl6W)U=xphX1jB4{7MCo9o1f;JJ%9pG&xBWfMN zAN}2N5!*(vbGSM(TxA^K?GQo72)abjm9s1@c8=iDa1|J?E)G{D)bAF-n*+Vw1q%%D zlK0^3k5IHm>>WX$2u?)sZ3KNI=oi5@hEoLnBN!0Dm=9~|WGP|Aog-9Wgc=v&-6U*` zU{eGWBKVbR5%>&kV#GZtPZFFgI7N`csS!*|^63%G5I!?0nI+`=y52eLDqWGqGcV$P z`gmCc^Ci1Lkn)8QEE2w0aEaj3Wa)?%Zms1JtdQy}1y>2Kj$lm$YlW{Dq~gNR|GI2ML>?!IKf3Vw~G(XydyGPIIM15Qu=UMSLGY8iTo=`-;RFk??g1 zpGf?IHAX6y8W98|C}ZO-8=(ly2!4v-=LoC_!VH)QVxk<0z>Z+>NYzeikvNi_F;ej* zzBuQd?)}=Eh~R7l=Oj3P5Tv)imM7_VbzW=Yp_ZNd`fZ zj5Z3*b?aufk;R5JQZ1Y5`F?>bxx3br)dt!lkBygXlefRBcF}@HVPz5i`pnCyiih7*v2cuiwNG6krosFs*Tr#ye{~Ljp8;+*eEI4 zQi6HrxV>c}c~c}TEiGi(98XyrDK=``sAEI3;jvN02H&gVds3-3D%tLG^V(4C^OKZv zHY(VtXrsJjDdFp)#7v_UKj`tc2;ZEoRkp!*qTi9a?+Vh$g&|s18`W&I&FWtNQc_)t zY6#Y}Q7ft0;drZ$?{ zXm6u~jpjC5*l5FsM6IQbfumGw8@Z2pTM1^}tx?itjmG;_7o5I;Jkb+oZ% zlsbM$>twsXJN&Uz>ulp#CAT^L3eZ(rJT}TbYwBU6rwzwJ)Il#By=|+NG> znGo{6Hu~APn6&tO_+qgAay);HmvN74lJR9>F z4`b968#8Rov@w;FZlmfL)pm>;F-A>iyJOV+F>02L**50bm}}$xF|LKaGyjT1ILv9Zg>SL}w3-JC}o zpV|1_#vY!6F89#pUM_^`p3@UNE0=jln7**FUo7vV8|!$P*xUgdU)o?>jhA~aPVtPJ z<~d~JFm2B89Af}4^sx0KV(O@5KUwBVj@$TJI>sv0JU7Aft&Nj5(rox_oZ{xsz?k9r zUYa{?gJ!A5KCqRCD?Mjquq0X=_+?Y&a%P|VPWBk$sB1QUw-Mwaz=p|f%Er$&ez6g@ z5wUU3#t$}ZhAVq+Bf)h+2QKxzwAd4~VXX0xA710>GT+@L;`2Or9(m7l3D0-Qc^emO z{AlBnjlxIKeTL_vcr5=o#VYK;Ptt*Qz0mZi>&aiGtJ8ORuJH7Jt>-rz)VVBt#cI#s zDW0pM-+z(k4{jG6i-Q~vZrHfVS+?=a#-9vh8xL(fvhkOV+cxgnxM!pK0uOicJ6ttK z(Ql&XtvR0iB77h%=2+{Yko~9H-!}fS@vn_1qVQNS_jFI&1#ao5b-YixV=wm9TsfmIe67UNe87^eUj%j2bqqdgoD=|6nET%7pu@Y_2#<{ znX=yVh685bbWqyClhtk!4VH1-d8u|33ubvZ#uNvdgPz>V9C#e0I;iWQo&&FgSpzlY zpd1y(xo0os9aM1ej)UIgR7D4GJMLYe%8vUyd?os4tGB^8_q7NT%6V${uH$ZrRRl?@ z3aLgXCnYt6)D*1cptgfL!gm~Z_l*yaqrT%lj@aBm3kMAxG;}a!oN6T4)InnhYsM+2 zCJy$DQ>Vu%mNs+n!#KrSE!nYgs*{7x4q7>A?Vyc=whr1m=-{9oXMDV>IbM0jtHOdE zsX1OXc;7opki3h7MdMX>!LEYc1S#A$UL6>(dN>G-S3i$ey&d#nk%Ptbt%H6JCbN?c z`a2llV2p#Y4)(S74s0q;iEe=*WSnXh)gY}#&`h1dF>p)FX7n^%u znWP#`Qp641{2gp!-ASt3BsEclOD3sh$+Unpv2k$$eCeyEz)HVm(xk4wa*C)Gn zDos|pSo_eyM-Dz^pB?OEcuZCwJNSfCBWjZ-t6dIuJNRs}S}hV1wzZcM`rpBR2cJu= zFC3(I?|ZRKJLe~>1JVKZht07Y2OS)8;B(-2aM-~S2j4h2;ozu)V-CJ{z%CsZYc%!O zWW~f<90dpUt%H*ezISlO!6^sdIXKPrJ4I!fqKMU|sMeB5+BNg0(T%OVv!JJCk9o*&$<^C`7Key%`VB1hD9OU@{AN0CPqatRKcs`5sWPdLXoUB>mOpIfV76osPhX>GMA z3P3v;_HcWM&jxHW`{{xQl zl2Me3;*BT{O;zbgLIoC;mWpMfcq@vsQN*SyK8t>Ds{2@}CyG?DRw)W^6f|BwiWbvU z?rBOzQBEW@qNb?|QB)Mo;nQ5RZwqJBm7{nkig%+}HceHDqNPAs7iuzGBiK1x~4WeimMWZMhN3nOBy7On*MW1-j zOjBp4slG*0UfkxrGfg#%qB*-7Ma!uBF3jJbduwj<@?Fs!)7ALbyeZS&i-^`yaIV`# zF=vN6JDUr6+eOh{TJIn|=^RBz$<~{$Ig;KgcibYW@j$%y|Yelkz^Bcu-;Y$VCd8YJ%tcYTz z2-)H)_AtroW_AZi{dFQqSEgixWYg_zj`D3L?2KYd6kDTsFN$qaxx&~xi74o7h$ihBv%Pq-hlI2y(2D8A=niQ;(Fm3%GuT@>F$af0FWOgmTu z-$rqgTR{y>c&1V3l;{+aPhnK9fiqF0F_sdTn1C+|e-wif7@U9}MS$Ii;b06#6hSVx z&MEa`E{3>!NAW`xrU)sqq6iC*Bqeqfj__zw5{n`(JRx{iFvngGtDleJLKOL9C=kO% zZfH?tiQ$D9E=BQE6!)We5XH|?{32Cu3jP|!)hMn-@tb5X3)0jTAstKM_oRe7?H|Ig z3*HdyJ>9*=XZlmJx1#t<$ZbK&?+Cdocu$ZI20RqZSCcofColKn^UF}u3nbpT;iVW}7S5vVF=P|Y zk0mn8lp}_m$KtU45MRc8bdRw)hmYPF|?qc zW9Sq^OA)pcq_tK;TF1~PDQO$Se2F*ut-T04NXK}4iu#>n=$_Q<5<^$v-I5aapE^Ba z=qVC9klEfb^pR{|!9g+f6VhLBKnw#V2B^uz_#Z6tAu$Y%VVLj{f-D^#!*)4ljTFgO z($6u;(&;gbjbU62yTuWF*W_)>ZoK?+I=Z+$wlQTHGd_cE(E(z8}K}NeR3CQ4Bj{_*5k6!~a+lck*Q$I_ESF&t*+m8>hWjym9m6*a3Y3pW3a@|$rw%v3B>T7kkc`IpKSL`3~4d= zV(^QvxcRJJ=Xx?7N%R;_R`Bw)gxug^5QHkr-?tjvzIstV3M*FERWY zLn4N=F`N_0`4}z;`9Y9wyeNdVeirhh;3ckZNtDmn?@8bHev9FA;qLi2BzsfvPeBSf*uP@9E!jKCo#bw^l)>;IhKJmNF|qj zWR>hof(!|&Wsf6A9EIX297j%(=Ml^$NQK-&DxW~!q$FP)`IEeWkb;7|W%`PclF8B{ zaTJZCm}Fm# zM~diF6V&4H#E~kzTpZ&Ed#UpF;~qhTDa;%F@u8^zHgj`Uz_ERrUIP2*@L zgpD@m&}5ogCMDa~p-miZCEGKOc0xMD(J_wpard%|Lu18GadeKOTO8d*f$r@hq-!!u zo%E)Ah=f^AeJ`1a-f{OA6H59d=cRuf1LBx3ngin)BxGV7gX0(y$LKi5h-7FSql63- z94284E3Q6vVMf`{SgPlJP<&2y)d-qJM->iDPOU(}eSQIz5gVam*81+#|GgWeCr&t4KII@5k|;@NI(Ivj1 z9CjQ|9OvTrK{TUrB!t8SK8K0LWdqt2ouL@y&{t?IZIR29C4Z%MJZwgYAPmvLCal4b@+)m2x#Bo=6`gz5J zI37|bfmaiF6vy8@5G0U2fq&w797mP}UP$0y(SI7pe?p!Jrf-SQ;>eJ2-S}LDBuIdV zMG~fr31mtjvnZq=2!2}c7QL9jOCluCDui+Sa#F$$=MY{aW-x}#(QrA1Oo@C`xQ zc{A}pf0jw$t;GMXXv!u_(CH{BvUm<~tBBbTFg>Yu8 zwRLZjyqiFk1bT_EY68^~XqrH?1ga-cLxhb4YbH=TfjSA)k}U1e0Si=<}D1X?A~TC!~f+Y7c$@X>v@xz5sP2jR?iWOb2r zNuX;2-9_F_FnwOAlkTe?BJ9cV6aC(j?IXxdps$dA3G^4jS_2XoD17V~_q1(D0z(rR z$GKRJVF~ai!)U?b35-Z!WWv3_MB%6e&d*TfR7;nP5w)=*r^0x#z@lI;@1z7KGiYz5 z9AqRXFg1aX64;r*v;?LnuquJo3H&)j%}8KD0t*wEnZPWO%uZmQkU4^L1)tAQ`DQBW z&rhJtOvUUXAyAu&W6yO@IniTQ2eyf-4iKI#acn>3&UUjYu{ouqlDH!q*9| z7u+D&d#0KpEpC?V`|R*cwIzYA3A`tgZ3%1_!nRn%MEws$vP1C01U{aretJ8VjegAG zM?Jd|*v+E=w}R^_JYi-}PRvx%nd;L7_9U=3fzJ~7Qk=%;=RZ$iUjq9R_#y#5RDW}( z`)Ga3rCOF*>Oca;XQ|4w-0W9ecLlxK`+JFp5;&Z|kpzw=a4vx#67K25u>?*ga4Lc0 z34EQvHwm2Jz-Os%6Yjmomb28LS!(tybq{L)EcIOirxUO^>F3M-z`tFk5#==#I3t8S zO^8p>&$~cE0?ATCNKh~&*lV{porDvJBw#1tBoI#^kwBE4S>$~*OA!OJR4f7FkF!+H z*=olV&soWqp6!;NPvAlV*Auvrz(saDf!`9ioWP|7eoEly1b#`lH>J<@^e*b@B_aNr z0I_&JMdaP%E0QJuohyB|x|+bXq(ax(YV2(F2V*9WOL!>1nZRuZQjyd@6S&2_WsP^` zZ1oqTceWxwMja`=D`?GDS7xgR{~ufL9W^!eeGhMGN|7Q(KzbFJc@8Rwf;6RzG^GoI zs5BL@(53g@d+)u2^xk_-Cdp(b$xJeIK}A8@dvc!7eAn-fcdfhj+IQb`&+T_IsWUYAdM2C{b4052FFYX!0wF*RM1|*R|?umM$YxxaKE0#hEoSoK9XoB1>Y$6R>5~X6NXdw;WSG0 z`NRFvJ1gKzw0lJ9rtqUl_({Rf3cgqHgMyw(&)fs*aQaa}4+Zy!6Nl7#_7Z~(Bj^_e zzbfdhppSw=BZxm;#5JiXq_2X0V)l0vU+gcu(Fnh)zbP1`V2#2L)?qM@vVvI(W-Az~ zV3>k&JWmu1S1>}sXa!>wjFh}{ByX1yG>Us>1PvcS8%EGr?*B$9Pe;({5fmLk6BJD3 z>7-yPPll!``A5GR3rfs3xvIAxlG>56~#nWHm!Av8$gX3kXb-^LW?G}0gUISS?~ zSfpUFf_XfDM$&u*3%Dm0bQtMh^IgbeA?+G4()Y7O!BPb)6s(kjrjMj$3YH7sEC#1W zQgkHEoS*V&B&|}gTET0hsOTtST&G~Yf?W!JSFnNSXT6lo3bybp9Yq@zY!apUD8J{o z3g02PO_0UyLbzj@?-bs16pa~0yA|x=)iKH+!BwODO72y#Pr5ZW{Pna?O!$E_`P(r~?1-E(niNgOYe|;zA7Ej}MQf7{!I|}Yf;8YIh z#?XBQf5^7{K*2)=e+o~15#L|JA1nA<2yfkwg#4r6Um^F$_;0;?l1%+i$WsN+ggj5` zYz7stsCcU3nT9kf(yG|2VV{O{D$=Vs9Kw+hGN^c!%|b{M!fPrrs#v6Av5HJ8GOK8- z;!71-RJ^X@eHE2dWL1$(MM)Ke}gMNSoYRJ^HzPnuP=0=b0b7M!y_ zz~YRvffr*auL?#E`BXGG<0}PJ6jV_}MNt*`#uATp`LR@pYaR*|7Ua_@#Z-PsGf-Sb zyRlSfEY%&E5;_?up`x(ipKK|u;%yZH6+sncRFq}ou~d$YFZeU3-&mS5mJW@jS{DK- zDoDk6%!+YiYh9Mqr&3|mjjK&-~$yOs`ykzLlu=( zR8dh=#m6c>Qc+b!H5Jv_b6VPSCGdw9=(HzLgZph=;9MxM?qFcu?m+EG;1ddb&R_eH^VDN1v%^q@sn&@617C z6-`t$Q}MZq+vBLI%C8TiH^);Z-G7zq7t-+GPX(H@!|~K$JTYf)gQ9^}DyEI6)+#!V zr+(vU%Xn&|;?#Izv7L(cDu$^TuHq{d9aQvG(Tgore66CZif$@8@o?-9e52x9>AG`H z;5!waRdi8dji+8MQn;@e`TgO=!+|H`>5U20*$H%4@x6*4q(wX;JyiTCytnDsiWTns zpH%#;qOXd6Dt=M%s|xO}mJ_HqkL(1hIf42J;nJCNul83lK*eAcL%5O?XrRh3s1N)m zIAH<}Qn7sk@x++z1h_JPn}MM!E=?eB0==9-BUFs!AyzR-Md^t&O2t?e<9H}1(r6Vt zc4Jh2v40?PD$rRCj8`#1MURQpaw2USmBK#Pg#(k>K*bCdGgVCGYOD)P<2B_3-UtQq zL;}-Q{COzAQLg7K6|+^$Q!$_IC(;}h>nHjZE1?JGs^AV}!pZ^_3uQU*@bQf0b#Y}P zEm5&l#YL{Uie)O6tJtk#kBSv4R;t*jVv~whJk@#rs93AwuZhH~ti$n?@fQN?RO|@( zlYax3$X$BDUnZM31u{?a-{QVm#TGVDu~WrX?$}ARU0ShCMSM$uqctY^A4Dk7CZ*LR z`f(DCoJ700Z@EOv_nGcsV6TdODo&_4$xWL?`*}Z6aYV%d6$eE*B)D@DMK1XLaB&hH zRgsuP$5ell=Mg{76K{Wj!^=r@O2ujJ4Hf5AoZ+47M1VW+tjw|eld1Y-`u9TMf@EY@ z-6vDa$^3%cz-1LzRNPTF3WGhUP*sFfXguPRY38{=rn)KH zCez%t0d=y!)!d&QgKtoE$Kk+3Z6f_#eEfzRXpK2rs9E$zg6&rZ=~pT__3O5}}H#Y{6lyngq$H{ z3}L|(dOd`!A?%q#nL@}M^3Nw^38Bh>lxtJ`GoRT){*NI4r|4CzT=o!hgm8NbrJYKJ zruvvGgxn$2388KXc|v%TGluX{2zf)u7eet6N`(AdDD#I*=`D#C5M;ez2!)co zu#h6`VXA+wwU|Wv2`?E!sSw^3W%^Vq9YVQeuD3%dljLQEte;AO5Q4%}Qj~t} z%~HS`UgTj6s#OVRE!@_rK;kpI(OYPswTYjG^&yG zUsK4(A$*clYK2f+INyKHt*aM8{SaD*&_=`tg3UtsG=zpBd=^3@PMzlW1Bb?vT74Qd z5z*h;Y1G-?~dmm#zd;VV(vg|Kv*e=|JWkDum01KuHo z?&KnNCB*Y+wk3cy9CKz!JSBy)>Ac zpVogagFha$^ozjI5Qc^LR3R~E92vr>5Jpe;*XC%R;nQhs2;)K+69Ruug+t@%G@jSa zt+EpYdH?Jt#sgkSnH<8D5VnS}Erh8&Ug-lIHiR%O4q;0O-gJ67ofz}ZpzR^-4*Bng49?)K3AJX> zPQhJ*zYDgTL3={j8$$0Hv@e7MAsh^0e+Wey1~{-dWd^OALC0s%A<6&Q{YS{j5KakU@pK4hgr5!ZjTZh1jmNc9E{JkX@S@QP zgkMc6oQ1>n5N?E^@Oqp{Y6zO-Vm&0J)J)QoiV;G!nSMbLUe3HxXh_ju$+$!F=YTET z5sZZp55eVr3*n_G3BlWfYTf*DV{NI!NcS5)u!o3jghww)T&m{Fh2oJf!A^aP{ zpFBVz{2jt0-fdT0N`;X}=T7QU*6YMTG~ zu*w>$X#V>UK9XFi50Y2cP(wp)QEEzREe$Vc(#N8FBFHyzrnZZ{)zJ_e5nL+|mDktM zKtp2P? zlEg0o;PLIPp}&R!nt!)y9}Rsash@aAZOcFny=T!74MR2jCi)=3!J7XjgtV3ZH-Cm{ z7%qBhi6fFWT<9p_qXowZj^$x>Q^pDB0UFPpEH6)(B+6DnZq8&4Q#4GK=rj#WG%VFH zUBe6wGkKn9n6F`hhS?hCNM$(7TruXlF`p;MZ>3`lWu4XeZh8?4c=S~$OYf}^Sa*Nd`A!)6T|qq4F@#X8XOG=H5}4#Uc&_qZPEn~YdEgq zgzzI8j`9Gd53+tt6y_({SYGLWR`X9&pVDwz!+rVmz!_1(l6p?~s#$bV!zJOGhRYhR zX#S0|H+YXqAG|6$N3UtvHH)rGly!Ei@X|;h{3?A=<>{S17!qVf7aK!EScu6Zl`a_7 z5D~%|S9kUmOT%AMjTkp!7TwlxN9^MoTn(Ovgoa}2gSSLva#LFOM`vGTC!FQ3=HI{l zP{TbT_XS!1L&Jk4XM;bvAk9Bx|F?#JH2f>xpd?f z@f{s`biApf99L;J<<*f-M{yk`bmZ6ZmX7ZW2a4(_prfFUB04^uO`Wm^3h7`htYcZR z0F#!v0`JbI*;xWy|6<&z+5X3%`Rmmsxnerr)=@@BX&p_w1-S`~XY%-1R>zRpbbdC) zXVaY7v|}~}bX3S124V+q%5)uL}jZqq`DH(5E`?&LIxm6^(Q> zmZWAnh8OlfpWTGpE(+&;ZLa@Bz?J-g&vksEqwMQ}N^b=iTk2?~<7*j|);ikg=pfB+ zoh{H-M>`$W=F*osI9hZrF}7zeuD%k_RZICkJMu{754a@)ox~3p^o@>h#eg|y?4qNq zjvsXYs}tP>yK_Hq<>fmRp*l!k*Z(LO-dH1#`93e zAZ}y5KyMxWboAG;Y8LwF=qqB+xx`5WbPUw7V3uz-bS|ZmMYAxNM_qK-*CX$=%GFj>bG?gSlYbWGJT zO~-m28+1(9F@x))VJ_ck^jG&;0q+a6au2 z=j^}#eEMC-ZXNq{?B~grJ7o{IF?Y&dL3TBLK5=y2d|Eav<@$d2`z=&_)b985fajUf&X1C zO~;4@v{<+<`fHT~pQZ#%;ZdHn!9YYfJJ};udk@N^`^lI=qa z=-~p&v5?9wq{a*Bc2Z|2T^G_liE`0h2&3;m|C@D6fHhhQIOhzjA)^ zh!4H^X{I@g=+RaGnsq?~K?5lU3K@K2A4LolHT)Y$N*gG~yaP&d|M1sr4U{l2b4_5! zBI0N37)u#Ayol6A#5WJWZQ$M_DkIh4eW@(h-#|c0f3nEm-g7M`GEm+?O#>ersJ3J~B{MNHxLg z$&fw!aML-8~9o{580j#{!#k32EH>e-M|b3oegv`FxJ3016>Vt zGcer12m{?E%TNQu4190k2LnHf@{?c>!JdL#Rxcs`!M}lDc#1EUO#HZVpESmfvFxEkELCw~R`4=G2- z^Yk+?RSYH?n8Z83fhmUn9=YR-iMxUcn=wi47RG4?IEnpmm}y|Ofi(tZ8JNvZ4F7-b zA_I#Ju;pCAc?RYSSs=*zLLvMx;1YxH!w)Vqz*Sl*ZaK=%my5#U3Ii*JuSzQXzih44 zmi??Zu+HFDK=^O8uu(jxwvlyS3tKp&fxQN{a@`DUH~h!#cNvH-rX2vY0-M48mU(d`&Q8GBr~enUg$A7%i6)XUQr)*=;r<*~7>Y z#v8(O3g#Eg6-Mqb@`Ukb7IK3mnB?V`2MbHvx%owe z6csEMMsXn}lBp%bD3#=;!+2YGnWR!SjB-gH5E2X{MF=JJtNi}YFy0G8zYXIyDuhun z>>u^rxrO(`s1(M^TUd1qAB6FtWJ!MumBXkK#)F%3<|mA*VSE<%c{T26z4j7Sc=br~k*#FQWV!MsIP#*}3$-Ve}Kdzu>?y z1_tMpTf{kGYzSjx7<0pz7sh-M zSB9}Fj0IsVl<1-`mWHt`jKyIr3FFvOzi#$YdbX67^Ez7QM_2H4T}GwT_}f}jQC5dB zav7})V-0T+|D~)ISDe~y8Lbz-Sj;vF-V7)Qc5D*SL5Lk|TDj=?cr;A3!H zL@tXtW0vK9i%x}cTJ*9KJtO?n<#aZTb76E_PUm?=ET`ei=>m7oa$j<%V z!bo=Z5ECUH2B)U_^upjM^P6GZ3gfnLj@}WHnz70Xx-WJ6Ly%kD=!U;|AB6ERj6cKp zOZ3!kNyUG{_?LG)6D3SM4&#X!xo_Y6r* zXW|thX#~>>a%%3i!Sp6Fn0VF1YbG)$^;2_#8BJ{88O$Weq}K|Xu!7c!=hsbS70Yab z*-hjy@rLl6COQoWo?1bFPYJp!=%v`_Hj&4~n9+-@uY4N||VA;xiMaO}s4zl}(f}QPxCxiIz*|A`=1OLBSM3 zo|EjSigZ4frlPROgKA}DkeS>URAKVU^T&h zSA#W#)a0K46LZDGC!%oPS|(}>uOnDDsn-)yU$BATrzZAF-bN-GoA{dh*+df)O--~h z(N=7l3AQxxxrr}?H#gBj2$#hqb)mHqrFBwIon~K}XrENtnMfb?dxpbTB6cv*QAqhM zzW9yst|qz(`Bv~d6P<;yK^GHeq_*8f`N_o3LcTZggNYwa^f1xWL@yCzE2+*B-|chB zl6QLW7Zbml7%Hi~P4p2`bWO1DzrnsHhDeloKOO}W157X|#q36HH7rG0((& z$vDZxOd*p^OffN4_zb~mg3|@LtTgFTj;x~aDw@Tu{v$YB^f`ia1=|nttF*wxLKCY@ ztTwSo^u;EY@T`{YeW@tRQ}y$~WhQ@{#?Q4v6ecT8@N#3qVU3BkCf1pFBCT65HroX^ znAj*}lZnl|Bv(^~tp3l(786@}!mp-ng56hBBTicFch?RRJ7qGAljv>}d&I*fo{c8< znK&!a{U#2WI4%63i9;q%nmA?Ru!$okj+;0kNk_Tgy3jGT?4J}~hxnUS;nZQ>E{#t~$R;2#tJ^8Ot0 z8^YnSiKk*Ye+@n1UjgB*JU{7~iRUJEub~$rz7&3a4MFn062Tv9C`|+z*AkPo5u}Tt z_*zOYdeya*A%d2Y^jZYH))KcgV+5HZn7EeKt);fPQeKZBtGLP;K{g?8MEqHuJ%W>K zDTgS|T1vCdZ#C(F;USFoHLQ=M~H+n4b@l#r`dcHWOY*c<~4d3n?PV-ik*2 zqljV={3K?ql#ry75tNEx@;WM=w0v+dSXTHi5&RlKxd;Lg1S3d^pmhXoBA^J$M^Gn% zx)Hn+@h4uD2tJD7UCH%c1QjBv7{U8o?J=kj>-Vg9z5IqmL574~3jvN3&JG zu~j4d>B(SqZczmM3s_B}taGR-9zKcSV`(0Ek!nZi0s_?dg^(6H(!TJ$2h~U!* zhClE|5eS>K>P@xU1?MZNj$;4%|pPBG?(h zE{X1qU>_5y>TXf?@MPA5vo;cA>LCP|yI+zHa4vCpID#X*#B9{FaghbC;29tpRCo>2%bgoTy`7YcG&(!1g}JqCW@Cy4~Y7G z&c&sTB3%@(M)6t{Yizw{W{e_J6xt@@kXgtRvB?@mo+#do zB3l&MC4039atL`NikwlX8B%gZkz15Po2klX-&=#tlvk9~Ia3M<$rnX_A#VwG7BjXi z7)2pbm=_jOL~!J0Djr3ND7HtjBZ`tyl#1f3C^|$@I*PZWs2@dxD9VU&#VFp7qO9<8 zQ3Rq0Mv)Q)MNvMArBc>GL3J~|!`0qG6}aY`>D?&a6T?8%$bA(&a7GI*K+?d?``Z+j1XX^9`a>XgjV<6i>EL`@TWG>x}h|QG6Z6 zk5Tl9qEi&#MA4N8cPo7x1s_6p7C+w!4wqfDi|`NO=j|3n_b9$kmi0r_|2<_r)v{+4 zy`oqssXs;Wa}<4}=oiH=N&DVW{F>zHt_1redHJn=SM-l!U=+VaF+lXjTj|HG{EPzz zNBPrcektR(Qnuy6A;S5WYiJb1q8J{#yEC^l@Rvs;Oy6D4($;AFuPCxV|X4^9<6O>jD|vTd}Xe{iOhUUD1FieffT+HJ&P zj*z*6^P=E?%JZXGkW95-O<5$l7Dus!XUjHP8pTRcmT~Jcr*zy#%cEEk1(T~sgN&=9 zSj{UsIiog2u~zuHsDG@oKB-q#{n@yYdu$tR5^=NOmMFF+ZMH@6Z?+UR+sV^AinJEe z@s1tE?kLVhabBvyKk<8_*eiTr6i1^tCVYPshxY~#L~&3E^FvI8A4w`Rw$X7hJ{iR+ z-v5R3U~SswFP76>;&wX21#P3-+x$^J%Rdv_X<_D+3sGE*LgBS3SuP1)jpB0B!xdhJ z+o{EN`e{2|i{iTIH=>xhomOop#t?5}Jno|Fg5fC4?PMf99NSK&C=tP^pe1MvI)X7l z&KMWsa*uJw?Uab(W)!!?+n-6Fx1;=NJbyOc6}%^SKbiW6kOxsb6p~{HmEGaD`mZSd z7UfYC{|Nb)_j4hSd3g%?FN$YEo(d|mvYtorf_rHU_*8JJ0{OvxMKFzEs-E6L1`BUk z$Z6qK(Yf4g7GASZOX`r(LM98DEo8Cqx`nJ3j_jaLJ7~xbTD60iCxmdW>=tr}htwmk zTo!U$C}5$Whf5@UexvJAG2iLTw8(*9FV$A~vYKi|R=hZc%+99d^;+ zU48=_O0=02Q~B@36; z#X>hxn0FPzTYYy6-&^=WqPEOZP8}?x+0()h(R*3=$--js^RtCtEc|Mrw}k-~26Bsj zr#=??i)CMl_7e>KPJc<3Y`f_>*frUj$55{gF1E0Qr((vGr4|b9AtoI7 zuK_o0xrGn*&sKa=Eb4(H{i>d_a7K)opBB<_FAd&H zXDyuLUfN5$_7WqfUX;`;7A^_7EXY6foOE?BU6m*kj^3~kwP0CLET|Sj7BmZ{80dmw zLBqnmy~M|0jGQaOK8lE5cV2Mf(x5H8#6CZ%;a)t+sjaO`BvGKZ%H1_}ILk1yfZKM;DKB>R5 zpI)``nvIO2@L$@@HZln>w%>329XThQ)kZcOxkS%yqpBq3u+i{(kdO1<5Iv`0J4qTK z_@<4#Hp<#4CrSBi6coaTk@;=BC4AO?Dqv%~*cY-<*hUc>MQxOkP|U`~{Z!iaS4VLh zC2ZW?Pni$+LsruEhp&_%AGE(M-uO`+t}}IpF)RES5|<9H6Sg ztJ|m{q?(O2wx74AL~GfoZR2C%p9pf&+yhicxFX*63D&pKz{Vv9mmPe{9m~_q!J7^~ zv(d=LEE}_JG`7*iMqeBKY&5me%*NL?I@#d8=yMxw57Mb=!7pqyx6#5zOWQx6-_b@Z z8?9}0u>EtPZ3NqM=O3g;2dJ%$FKsa4&`y$=u-R9_d7U!<@Sxx1b|${D@vV*SQuFU@ z3_3_%k}c{iWWhn|Dx{l@9g>UjdmBI4_|eAPyTM*IezI}pAoZ}()5iUSl<5$aJVZa+ z_{BzVQEDEdUxl!J$3w)}N3sk)L~{;Ne;WgAjI}Y&#=vChgN6LYRTA=0_JkoehT0fr zV>nO3!?fdQaDn`w!u+8EV+J&R{qBSSpDG}FOz(ljS1p& zqK!#5CiBcWOid5dRPO)7G=-aXm_~}S^e|1AEHlJ@reJo(cQuC#vT@MHAsh2-%(t=0 z#%3D}Y%H{~QY;qdGDuJidH8^>&1mek{dr)-?IaYFb>L3Y062%WKUR-)&* zZb#^xjT_>PPgkOgE6F5SbcxOB6D@}|bU*EYRS*|Ails-x~Y$!JVwDFe>)ket1 z0~-%*Xf|}-D|l*&v0)=Fgs%gJZJ4}KtfYuwRFI>V5Zi_$B$m`aK1wdH%Kkx5Fd=wT zki}a=A=B4veFe)V%90&Owyyf5v2hAN6a8S^}dk!i%DCD59gK`c64vIJ^ z>YyY${4H2aD#mpy;h=buXFTrrWQpTcN|aBIQ)vfpJ7Ci4IF)fw)&Ua^KZs>e%*s1R z5ki9ecpW==M>vyr9Tc1G&-027-gi*b!N-zR$w3tdA369yq8~aKb(}a<7P9&{RdsOe zxPKbFhJ$LtIa=L8>^L!DhkPXbiGx}W>N%+Ipmwsvx!+P~H>1aRc7`9W<7t zhP?SZm_N)PnneSHjYMpG!vA+u@dP!IXj2ExxUn~bynXTi=+A{SY2l!ygYO)47PD3k z+VijqZ|$IsgSHO7lxRD_QUm<9bKr9q9YkT?$w5cqUki4T8h#`ETftGHbP?XyK|di~ z9dr}YUGRHB_V$B=ABFc2?CGGFgP(-|nzZ@Z!7mcne&q@3?Vyh&rHYLGB|4O+7SCP> z10Daz>o*639h_U|pXC_j;NS^TPtd~?G=wMcNuLaNFv7tE2NNBP6c1w@jCIiaW^j~) z(L(sI8AnT|myYSq@m4;$XUi84jjObl6Fn=3u!PbL!EP zWS%6BJ{Qb?irza#a~;fcu+PDM9#aPk9ISS*Mk=$=!Ab|KgfDWiSjZ9wOC2n8(C`#3 zchKT!@Y_=~<`gkmA<-_`Q&O{VU-2=_TFJHE!3H7g9GsWS>%55g5O<@4O%66Y*y3Q9 z81Qf3RtMW0YUmiRpA;E;pE+|Q@!xPuc8jyO2#VC`w*11%Ph@d7#Rlape9%E4*gmrm2u z({x4@_I8eUA-)#CQ#4n~n`it>kbEI>|DoUoUYKX-B5xgM=$A8e#lcl}9>cL1t~t2Q zt1pJ?G2C#Va4TZS7=!8{#BFi#hXc)l?jY*G;u58-h=abZkI9sI>RszllC-wyr}{wS%mJxl*O_?2DV4o*HxPaOQ`;HjiOOWG8i z=GT@F_Fg!6=>Rdj5<|Ke(#QO*BTWoxg)p!AYRcNPe*H6u@@i7&&F~~wYyf47A#)4` zV<;4Zcb2k9z#~)*<#2M!y7SVPv(8)9KCgpa>kH5hF<3=R}3GVqZT6OiDBY7 zT6>O8oTI!kzOy2jFNXY*(PD!b3dF$2+q`*lm7bmRD^@s$;xUvEn<6n3jbWMGAe{KK2JG>Yv-x{1!Ch$+?E)2U!W>6u=rsNm17ukfxf*!9A$%f z7wDrHs*2|;7wG;4KVyv;YR1qbhMqBe9K$CuG>qZ17;42(n_G9$uV)>pGm{1})QzED z4E06HEUBz-J|6ruY4c)Qun`v#L#r5Ci&*m_HHo3A@MbZ5A*9_!`aFi-7isE6YA#BP z7+S{o^WSv(BE>J#3vu2ihOc7i5JTG-zD&(1*j_N-C8~JIuVF`tc8j6AkgsFtB;*^x zZw0>->@3(tkTZ7Ws>=1XW|!#u7=DQ1#~2nbOPMe~c=2|y;mKh3DZw8uQLh+&ilI*o zePjFuUivwPUy>d;`fHN+j$yUbr(X>HV>l%GQBelOU|phtG5p4DJVS$GSR-UGk5LRm zV;CmUr7;YTVTABmF^m*4UT_o_9m5#mZ(jD7>R91S#>Mypuf8&Y=Wq;@M4v7=nJ2A~ zsWD6wGG|SYEjd)YOpPzo3=wC>_{j)gpB=*-QRc?5Pza0jgv=LQz_Ue4UnJ4RNt-1x zOctH(mx;JMh84-wl`*VJ^3_bla;+%qVpuO^LkwF|ZBp?JZ4$CM#vi8iE4(#^Z82<* zVMh%6k~TYq?2chqQu#dwSM2vBmAx^%OxA6G3K_LaM&|w*=BQgF!9;IIQIUd7_ z7_!9idK@QXI2A)8hMQcI7|z6SF@{T$<@EgESs~{H&kHuaLKlQ|zv55M%e>FWpu})R z#H)hW1UdD33>)SLM_eH_hLDJHUcWKuJYgid{0bRD%oxJ_3v!qaUm^1fMPlH8e^EjH zHDqqb;KUH)$#8{IFZh-`7UVM$T#Cy(ByW0Gi7%nPf0b^;^&P7i|_I`y@xUU$?N4R{T0Kb82;g1i1&@FH2x|vZn#SSa$By_WA3i2 z{-(;Dlb-UF=DUOB&huyD^LY&RReHgL5(DBs=a62=D}reR(+Z}GbDTezLXECb);O}o@g|FLWETUz%9A^e9Kzoa%qf^lu=6$FVIJXQgy)MR ze;mc)C?3aKq8An{AXrdv^))IK2P5a@P$Z6`q8}Hfgz&fHC=*9X;iUvi3&zE!Y#im{ zs1f(i7qN#x927_SID&Dch*|pUl=_46jzp`*vEB^6EBrk{&Q&3fio)NIqf#6nB=ssn zJ`}7h$T#7Cl#H@cO}w$g>Ouzm6Ra7>$8mfT=dT;kgET3%;{G*#=C$MeX#lDa7 zKI>bT^&!D}aok@MtS`Jl9G?ndyO4V@nsy{q~`4ezlq~pE=BlPadZ&U z@4DZI9pjjDoxT?A6vx0pL5_YG$975W8prkP)H#kWLhfIu>^JD%SbzAs$MJm}KXA|A z@csM}$B*Kc&xQ7gqbE1y2K5qT@>3i?3;*c`jk`gOp9VWW4fctnFV|nLFZYY1e;h;O z;HwVHW)0!z5Su265hzag35I^WzvD z#~9(W21am09zCifGI2OgRSoqR7mc_9|I2)8#Xn7nf;`}00S{cWtc(AEt?5WTy zZnEP4+#gYBE!QCqxOm0I`ZzYk;l|;`vC+?hV{sghV{;r^#O=X2w#Knd_+G*7g1dPx z4Wu1$?2KbqoL`vf|Ec7A4u6k>@wq~K;{3u!zuHw*+84)u$#o#k@9rbM9@kouIQ5X| zhvPUB$I&>yE|0cJ(j}EnNYa%!t_nFB$Ei3@$N7D3bS92-ah#7MSBTE?$_>$HA-WL9 zcOkkM=Qk$Nun;l7B>b{qs(4LYh2qe762@^O&hI87B@UH0D2+lP`YS|C0vhRY7+jo2 z@i@Yg%Zwu;Waj>0G!BcWgho!B-{M02^Z{S-w0Wg0r_LI!(J01?OCvTot&ycsB95DJ zyyQ0W?W1wrj^i)hd3e3A2;LE&e8hVLq3x*~2px{$co(n!p<)Xjf-PQ1&aNtu|X|5LgpA$Po7H1>mr|v{4U;d`N2af=%SE|0>UpC zbkpGH)TpqFBBB%s6N{Au*?(~tCBz$F@=O(^q1`Kf#D=5e!W3{3 zbP;nA=X$yz7r(gp)kS$1@3?5_;xjRR*F^;v6#60PFmBOzfa{c)Ibn^fIJ4G}-)QcQotuPMaggUwS#>H1II=JZQ@=cq>;cJ&~ zm86xz4@T%)7vH(~(M1o*(%D597hPT45F2)KKSGS%Tx5(=cOJDUeb27M_@k(w#G$8) zUM|>@l@?Lz9i^Wn`m>;~xai|zyNewz`nu@nVyugCF8aF|;9{f;o)6rXfr7(a{N`ei ziz!hWEXojW^@QN2DDg4OP}e__;bWNLlEfErM!5d<9VVk(eEqur12Njg7)d=7^}A@i ziwQ1fx|k*6M8WAUCJC9$1qqod_##TvT-Z_nnIlHdKEuW4h(Fx3UA`BBmb+LXWDd_C zi{`qR=YsFEnlHFOkfRG-EE2w0aEXhhE|$4`$)4B=KPAy^dXUXlx>)66t;^TNf~&b3 zSI`=%2ES&COXSeUB2HQ-2I~bkxY#I!^-V%H3vS_smejYom@XN2y4dC7tc!Cl`1Tt< zwfMV>-7fY>Df?X<;MQ5R*Tp_j&RKrB2VESJ=o!JoE=~*Kq$5I(y6`MICj7YI3Bi+s zrv&-7%vWvSTXCB&tI>HE7hGJIq>C;txqJzXu1NHy9ws5WASW3v!bxtrhzO4+6-&rvo1CPg+vIXXcmwh9u7`w+n=W#B z$nD{li`)F;>miMYJ1*|J_*?4pk4^EL!Fw*4aJVnz55Wg69=fPgu-u=5O#Tw`hC`21 z^YWS%@|gDx=YQk-#KnI+U9Zto!DoWc1z!j%{{>$Pf#;hA9ZKsVorg>wGJF22NgqXe z4;h5N>LH_$*95ytDXBMwW)UU3;Ol}}J!BKY2MO$lPe|sF=o=n#dVGqN_}n1t%fv|@ z55+tb_wc5NykeHmLt!ELJ-p@lM{5N<6cVMNL|Hi@d0mH!h+b4MZR~$-FX5q_hk%EY zqL=be+Cz~Ty)9VA!-ry7R-&x8k!VniQ#h5MDvA+Fw7lnY4l`o(o`(t^8hL2!p`wTP z#o!YUl{|bPysF^tJ;4u!RQ6EC!$-ooz22RH9dSR3ZLLQF9uD< z1Z#Py?V*n7^*y|L+h4PFJ^u4Z^>{4eeoGs8_*4uUdicx(pY>v~Oq}Y+`AD0ZcxdY3 zM-M&t_}|0l9=dtx?%@j$%{{dB@TKH!;h~j>*1}tQe9-IP#Mnj@KFQAxS4vs!#DJq+ zJhb=lm4^mB>0UW+kflfJK>!L*U0m>d~K_%$A^4=E37zu&mHCZ{0Fgl z9;bW~?a7_*p|6Kt+&T|GOX{zJZ2XImJy}zFCzZ1=g8e-7_b|lcEzx&4z{5aET{|t< z+@;?<43a4CkUd-)>|wM^Oooa*XW<{35gtZzeQx5Tn;69g9;PKQJ%KSE#(F4_K*0pY zc^L2EjEA!xCU}_WVZDb9;(3zbEDw`~Oz|+)!(Nv(m!^4`F5*L%W_XzC@z;ujt(_o0 zwUou9*&gP2nCnkkTION7hj||6`;&wgcv$FRk%zB6>hIBFzm2q1l9nVzwqZ*)nC;OD z534<_;l<*Cqa0Rw*e>L{;8qXYJZurpJy|V5 z+dc5pYCApb^031L@4c)Ky6#Vsd5j)*d)VWlWrFteU?qsjUJv_3Vb1?^4~TwH@Q@&z z9rkd9E3XBQdN?NHal!QonwX&7|N8z z9wNL0+@z=ni#LIr#GC`4V_Vqy^Y&^4Jf@+KwNrx@JykZN#C%s9*9n{?O1J*mJ; z5BL2+!QUPpiNOO8e;O_Zk|o{0@N z@V+Q7B%1LSA%RyCNRvR?1hOZPBY|`YfAfDef#w#{ClDJM%#gr4w}=-S^VcNx%^AUr z2{2|7%q*Bi@O8ngg4q%nbU(;uZzPbDl?3u8kSl>tZ&98EhTWpv34C{pm@K?SJ8t=> z-18-H;TGjjfX~3+yhUkl(_6gaZu?2^-=;zd6y_`mbWWg10!0(3kwDD^iX~7yfp-&l zFM$$L!_o=7oj^(9r3ATAEpJnq1j;5rqLfRZ_iYL!5KLgkZQ693PTi)I1pd2CdGGk# zx=rO1c>fN)lki_O%Ks3X+@T5yRFv!=agvY^x!)A3l)wiGbid=zA`T<(P-W4pB(U-h zJ>S8%4+X0xP))K_PoSlo{Wv1_A1Clh0<98goj|PwYA5go_kRL)5-{&jGs#kyD|UzK zaW~$j`UzCHOAWXu6KI(5PtrC@;OD#andqF<;x087y@@DIlX~0qDW8isb~5d*U)2@~ zoD$Mf^bNw>B+xd24heJ=@k_z>g6$G;#fI~K#TEF=Z|sY^^feFeJ>o5>lMv?LB=BvL z^M=D_T@v_JoODf~n~?5;KM8)Hzz+%hm_UyNdNSUlUfjd?sM$ULRsp_eV62dz#hAVQ zB4qhJ>YYHJ1o|e>Pn0PM^iNcv+k-)$NeoJ6*0#EPJpal44)W|(z%yKAr@E#3G zAoqRZq@iLkj5{hd%BO%5=z5)05B``aIqX`^KU`_&a6WEc!PBEUBz`6w1C-DC< zbrwKUT<_ODxVyVM!!+)$AxN;`5+G>M;BE;J+}+)sAMWmM!6EFp`wZ~CeU|&xziR5K z=broC+cMp~yR$PrYvQmr4(sCdo4D>|*ZMeYkWmhOmu_UTNs3dH*-UOBw~}ui#%*!f zPM3lmad6Eyi0tC10B6`s-xr7dl@hTO86U+VsmoZxW$fuPO7m$Pp2fi_J0uRz;HR(SH@{q|)NN++06Ox;d z!i1D2q+*`VglZmRYI<4|(y%E>JC9L*N0rxCWrmR+V@8wyI&c;fvQjdckeRa5W0X9b z3E53(>DJGVQgO&(LQa$XD2H5u3} zLQfOgn9$aQb|(C4LU-1;H$mQr)yag;CV7t#IhI3V>@#*Tp{q&1Aa|2J;L}5S z$OTy*&3wiloZ&OyTF{H$N3BC|%I_x3;olK`P3UKm-;4BvN*?j@a-rc569$+c%FxrIia#;F}V;GJ#;k3`V-lu;=eVhr8 zeMSdIO<>JL6AJr{lSq*|e&bY`)`YbjJDpr^!V1a^6aJDv0Zf=_LKnaBAK4J*vrL#x z8R<7>Jz;nGxnr``1%x0>+UZ;bej z^7qAd7H16@cT#qlu-k+^^dsb66UqjR`%EZ$#IT<{KuYtV35V#1RWfy*p=m&0+v76U zgnwm0CY&(I@1MA7!YxjC%7kl_(Xq>#YeWVFj57kp z9RcGNCRfQTT*^oCx(PQ-KmJK1ii^870hUV#ZHqlr*E18THs(+6;pk z){wEL8D*GMC5>iiX8FSh<;z+rCG&{@gd{tkg*!` z>g4}I#u{ck;A+=mQk$$3-z)FAq9hON+f|?5z>J2JMyjTC0 zYcrbDTaYcuUsP`^GwO$p-NVK)Gq8Otd$+h3Hw$(d%%qRb}$F=LJybIq7%#v(HoGn{Y60y7qxf4oC=gnFy0 z$PzP_nz4*!|2L2K70g$XtH{;l8gi`}>nQ8Z*i6}A#zxAf|3kTF%N8@Xnh_t$`ityf z!7DTVHOuY#vCE9zX6!NJF>|TeYsP*0K5{>Kz>I@t9HL(!50gj8qvSDCW;h-%qDuWpjJ$lI#-j#*wh z(0lKxB!2P-W;|r_h-{^fv?pvnHRBoOIr)N=NnV;Ex496J$7?e_Gk>Fc-%{R@@5vA3 zNAeRXx3843|IxpYaiqx%GevqWX2f_KBAXd@GaP0(%@}CG9~QaADBNZ=wxEdx9y7dh z?psjWqHmzjj2sld839fel&FuV#Ex{+$8~5^!unG7*_r&6dQ1 zq{@>~`f&%QuplLysmRo18d8>$mXeN4PiC+nBPA1=nUu;b7G$MoBeSbqzRp8>bF!Js zg4~omWL{O1&w~8)0%Sq5km@aLK@oaUl@zm}xbhN|k`~B8C<~H@!GiK~dr#(NNTUUs zsxM0^M^29zD_T&=f_iLLwxEgywN+(RN)56aS>1wl+-Wu0tVPNaFEFfQL0u+Yc_h?V zy$vjANN+@bR>$p67PL_{O)dCYc{2-|ThM~dmSigneo?*huHe?n5jD28pq&N3GU;qV z7Yo|cJCGg8PGs(=ein4KpqmB1Gm&O@N>8$f1;0_Mv$B_}>1{!0CViOnwV*J#d0f=EiM~xGn=RNv z->Q;?G2?dSJ1p2qFBsFG)7|tv&1+x>1R~ZJ!U*7C!GZsm|Q0>T5!pN%k- z$`QghwA{Afjs91RpKp$tO$Y4bY zCK*+p!-`B+WVRv;6L}3h{vM}U*~~^}C*=;VIVriU$W6&Z7P2BQB_Aov$}elEyr30% zc-KV93tROU+lyFHl)c4NO>rx_a&t;DDP=`ziouGqlrpN)NYThK98%7T@@!Thmot=Q zRkq@1E1FqR#fqv{9QtakW<`A~8nCRo6*VYQS(8$WtZhXdN?p}kPgaI^+PU}D*wBh3 z-}JrO$O>u7qcNok`4iccG=DWVx1xm=U1Za&Xvx{ylfS5$TUpWCiZ*PvC4aS|o$4*l z1xd4mN;*$AD;DlB{ANW@hP}xCR`jO)PWB=DlCnAdteD8L z1DFgX{~!mcn!#4cM;oMgs1<9!8HZUh+=@ThJC+E#5ZI7hfHT% zvD}IkR{Ued98NfwTtd#XV!jm*zZn;>xsY5$%DOGK!pdzIU&?S9DW}g$D^^)?#)`96 zthQo}75il;$mUzI&WfEZTW`e%IcC1=N5w`aTS;kdvSKrRi%ODxH*TYESIG`53URE| z@3LYy^F8EVavxcNd+(qe#%%u2iq2}(VJnU>JW3vmFOc8=tr)aO-{&WooFq??r&Wz? z`#JheD{fhFUga08xM;;CD=w?#niW@+U$tTsmwsI(H>_By*5|ey|0=&jxl11UZoIGZ z2b70aJW|PHEADWHXI4D7BB>3@Y9gXk74NKg&)NQyUCQ1MR(xdgNiF5G74pV88Tf@YaiocqA!aLTLW>`3;}DM(c8Y^^ zs(D;ixasY=Aeqq1rjPVn5m1#u$|z_NN+KH;a!AyQm=#~G_{LoRWhRq+r$c_$$m>6( zNJ5HS9uuo1i4Em8>syiBh7>mBXP(lA{m=?0(05BJ8&cbl#)h;uJ8DaF+K|hJ+&1K4Zz3)+ud2*vgNc;|m=sib zAsY(Qi>Rb1r5IVejkU(3` z;=1grXG488>REZ(Uhvm`wjpIgP2?vVnlcf0CeV`-3AN@nw6LM2 ztad`}7aLk}V4s9qYa80o*C*84QreU4$Y054w+ynB4sroZsC8r_B1sn;y4vu&4Sj5o z&-Qk+p}P$|Y&e-vljd(W^t7QjyQDd7v!NIL5ql+ZCe->$V#5#{hT72Ih5Fua2rN&ePm^pC({13;ZP#&P9p8UMEdHD zWY;Jg5+v4}WBHsOAjjD--i8S_{hsH4+c1;iL>ngAFxiGFZ2m>c!7$Z^Y09U|PN3&Z ztRLZnd8W)_vf73|K+5oia*%Ky@x^kE@Qhf>-eu%+ z8&*(OlB>wp95OJmww6s9yVZtu^z}Auplq~ZGi8&i`7%jA-L|kPzRia1^d00La;FWu zC{nrGCf^vSZ{uE-?2}Vl`380!lpU^;!;~X79Hksn`MJc}2{|Ne_{ol@cAT=|v<)9^ z_{4%UHe9vg8vQJJ&W7`9>;=k28!oBjGUW>SDzSE*^3I0$Hr$Z2gUwquJfYl{%LV1G z4WYzZt|Zz$Ht&-U$cLnC<|E2u8{`hX(tK*eGbYc;m-16URm$FbMgLbNuWfikf2$HX zFh0<0?$l>%ze(q3o4i2+Iqk@0*Pn|oEJ$ESoLsErNJyfYZLr#4v%z9R+a%iEafV?@ zGwA!vh}?jgOTkCb}94f1wDkr0!wDi7Nbp+{8`lcQ8Etf_89{6n3O!l8Q{Ndgbd=($dq}k=~9B zD$i_3M&+68h`*I+7L{bBWV6eANc5d1j~sSfk8RXn7u{FqGU0$I9Y;}Q6=qg^PTPD20N?5$x(O-e1Yz8$qGb;!D8JyKs2`A4ww zhLlERV>_Bqx*pb7>1R8d+0oH~P7XA;qlF!vQ)r*;XlchUc1*Klx*e_TXw4yG?Px>k zVaIQFw57Krf3>4MrGp)vWD=Rv{^MWUa?9l|?2^UF2j08VyQ!qR)T=G+X~zINlC3cG zVsCHqcU9TPj=uDMD(P>>WR4xEl0WPiL?3LIH~;8|!B9K?qzqFv!|hndQ6uaa$#9e% zqwN?Y*BrGbPm^js`ZzUeyd4wln8@vtX(!2|*)_$EsTA2>$&7#aE|FL5ZWiC07lu71OeoChGPNprgW3e4eWVU45ZZ2Xed)JW5 z>{zZwt*~RI@>O=MR(>OywpKRWj`b?pLfJrWBsbZynev{C*lNc%JGL{C_1R^|4&^)T zh_Pn3O7_Tkmt5cW{dOF%^Nx0Av-SFF^^q`?Kmkr*^VO|)&G>?DCHP=Tu6~g zPEaay)M@%fJI<)yvv!BCcMl9zVC;6POes%L zPj+>2psT9sM(OU*KWo#&A%7SeM0znC?!cc8^mgEP2l_CXJk#)p1AXcJ$o}L2QdVQ2 z1AlOdgB+NdN*k>5A(WxyFmgKY@-c!w-hq*n&8f6el+olE2gXul=5Y?3mLUeQ|34@mom?R`D&Dx zLl!u&P$i4xEJ&^Ib9pRrU@7xuKX^uvSuB*Ue#}KpaJVQ zG1*LRQN3F!+Z=eaL0{-j2X;Ad$%)HO>~>&}1BsnT;>2DD_Bn9Of#VMBci?~nhaEWL zK)2M|LC$cubXJzT^ zJx87=W!ei4T%@N=qwk-~4qS2Is_MN>xh7`^Zs;lMleyK)7i+*dUZ^q_esgKI+4SPoKAV0vEIzCYPO}-aygOPiF!`dcOs7yd7Y^0)L;6$oL0-{ zL{TS-u{ggI1t=GIKwsJyKc z^O*n2q&?Yz?5JuwQTDT}3%#oo-BfRPN)PfkC*(s+vbbJOd`YLtBXN2yPkOBnd*$m$ z`l?a=oaj#<;KV>D{!n?{^x7chgPn+9=rAXSJMl7ucF~DHofzRn*9_V|mdOb<(kX8y z$7mCe2NoOl~1GO;5(XTIPn*o zf2-b^l& zwG(SpzCq4M`Z|@Ym;J-ajZ8MFe6tfbnagZjo!G{FJGq10sVa9l@mW>MLX&6E_R0yB zL93rZ+wa5yCl0dmuoFiphscQ;^i4Y|o65 zUYPez{3k~{yFQQ~$xpIxDRSef_?hFJ^63Np`et&%%r1))RwryuRLH3BQo9olCw67j z60yw58lMv`iktM1Ua~Dm`JD)`86>}wAt%C=2pJ`15ivP~IO-dd?)sMIcGp{H>ntqbW?E;mU?uRH@KqYIf- zlG%j}ne=VXs*-G!>@MV>!rKp9}e2D4=?axloW^h%8JNQN2Z7 zXvSp~cgf!ZD5>%?E|gMUnqqLFFDs2I*IX#8Tt4Sj!G(%0(;3w7vqU6`Gs%ycfdz6%Xp`gg~C zPgbTOdmE|x#x68bz9y5_)P=K|w4Y_uTxjk>3m1m5x1|fexbTNdZjGq5QuRGuXzfB9 zHrtY&TxjRQuP(G_)6J!KQ1u-t&oXJ9DP3IX>Owbq4^`7$4u;J7Gx(cIq}j`b-Y)#E zk^z)HWM3Ehsl2}ng*jG+4`f&)vo?q_m>fb5CC94D#hJAcOh&sf#)XkC?8&TM&8&@L zn8{~&pIMX74v%GXoD1V!nBc-h7p5?gWi@aZCb@ttnmi^`a%9mrpuabYb*)^nXKk;NNa*yzG0=3B_ks^(88wkqG|!gl35T-d36 zCnwqC!d)hNUD)Tseisg~dB=r=E*zpCci}K4*LVF&D8I@cap9;-|J30z<`Q0$+2|)+ zIO)PE7f!oyP4%9U16BFQEZR92&a-*Jh0BzSs`rvSBU$yQtXiB4 zUX_?AX3|1hNt+9H7aT4)*_0)^U2rK+$Y0kzF2sw^1-}ac_I`7rOg4R|1ziX+36l{r zN=k2x@>QG7xSgaO*Q9B%5c`#FMy@)Qy>L%yJ`{8_C@;NUvMJVOk0|GP;q; zjfdk6DcwlLog?$7rlfJp=hyVzl}_d9-N>N)<55FqH?puj;s#_zH>$f)!;MO8Rwk>ERY{q@nj2fxvT8D{ zN7izqHl>cLtn1eQER`Ykndm=u`8!ENHXFIoSXDN0<0s`!-8il0Z{|jGH(Ic(r5kNk z%`cQzZnRcO8%ijf){gS4%G*;qxREWpzVyy+ba7*x8{^&R>P9y={&Zu68{OUL;l>|o z)NgL|bfcH-F}|wSTjl-S_?_NIC4JqHg~o4Je})6dfo@dh5(l|4n8^@wM0RZ`MTQJ> zW4Q9REFP(fN2z?Y8)N8WRU%7VlwCWNU7O&>M23^xm`a&UPEnN)vTM_nPp8aq<1dx` z?S_pDo$bayZai}1u^V&TnCr%IIVo~zsdH%a+*s?zIydIKv48^?lFMZsD2vr>OWath ze3{Jl;>WSN!i|;8SCOk#%^EjK=Fs=sdN($>vCEC!ZfsP&+bNse*sPK*ZfsS)&5b4; zyMxJ2mG{b_?Qvr-n+M5#ZtRy$VDTjKfEy<$hgfi!JVG8NWtEP(@tigPlVUecx^aqK z*T~c4IXBKw&XO5&{x}BCyK#ZZMe>pxmnm1=xJr@vOXbv>u>QImH{7_X@_TOFqTg1@ z9m-uf>eT%AnLLmym8y|xpU^WL)c5&QH=fD*tKNSpFWh*kl2>j_<7}^0^2Uv~^i9k^ zxbacWH4oZ(@X3wOZlv}gjR*h9rsdQEZUo)2qm`JcusQcS~Xq z%H-0T=F*a|OOm9NWF90}NeT~ADo^Esyjw%c(t6M@mo5em(s_{HgAA<6DOJd-s<#@Y zI_b}))$*XW2hCM)9S<6L&{*~!lX_%*vVp2;NXd{}Yoe0Z{LbH>*lg;-&nj=`L8;vO z&TpZTmXu#SXhmtQ@;353p3$G^Up;8gu&W0hJZO?z>&#|HdMC1HZY}-;>0LY+&-uG~ z(A|R`9xP|GCx`sz!SUSMliXS_HhYu5d*I5g^&$I`{mA~LbPb@S&Z7!J=o{L z5D$iWFw=us9t`6=e|j)Nj-{O1aCs8*Xz>@2!?Q5bqrU(?N_Jx&ZL|ktJQ&M**|aGh zjH8cN$pjB3(kH28vIhrd{J8c`^EsOZFID-sM}NPTOgr0ye;DraU=C%T2lG9c z>w%mvQqUuhw!njh9&GpEULI|c2a7#el}B6S!4lT5mKDpREu}9bmy;{Vm88tGO7_h0 zAFm$7zf!u^gLUj(@4*HSHqy6xu#K|GgUxE}77vc*(N{(u-Od;$FV)4GN87=IogTcxfgYWqE?l~?=V!AIFM9vt-GkOzl7c;LZ9500q$ugm-%9Fu39$ypE1 z#dnb>$dlwL4^GE-$@l-tF~$X*XL6CeKtA2}<5{@m!DS{_$g8BR+ckM+Iad6J2RE7D zQoXl5xTE~8>~`h%DNFKdk0_5lctSZSTl(4X)PrXpJeL#jtKm*w?FGBuk+PJRlvm`x z9=xW!QN3?Hh*RtH-h;&X^d0!ggU>8TAt#YxJvE)S}5evb!UhCUA>6h9dtgJg)5QDHf?IV#E|Mt)Vj-zeWnxgC81 zuG_qPnyjIW{Wn#a#9rJTX-MKlQZJHuAXnqMRKp)9sw!6`tg%i{biAg&D36` ziO)$X_?cfZoWYCiD#=L6k zMFB5nd-0DK1-&TbMQbnGcu|=3CA=urg|~Wi*{c8>P34mvK7!ed(p*<3I((d zUUc-LlNYTDXp#>spv@?tb@if~7k$0x=S6of))&y^kdS|K_fYfy=0#6>FS0lJyXx&j zIaxsK@5KPG{yL+ub?)|i@#K_d@s!3^qFK! zR?aG@N!c7P=6Z3#i;G^&lP8@8TgU}oEcRlF7Yo^3uiv!9JdJ+G%l82cb@#3f#$LOcYgfqLM@M=w6H@}U=xym;)zphDUcFW$&yf%#MNnHSF~FXTBbq`joS zBL5|2w%3&1g|sV$w0HF0GxhCyPygVBe3_s$`?(FD<+|ZRSs(uM;)@q?UYNYda$WVp=7rshkQZUu&+PS*GL_Q{7u~HAj~DL>>Bp*%iJuIp-XKNZzZ9W- zS9w%+9sR3HzIhShJm8K>Kqe$*@t;Rl4m`Vk^OUTgbMpSgG)AL{xbQjZiV z#yK1K&`^zS!?-c%(&%M2VMleh4pl@G0bXvyAReCWb1`KNgsAKLn`$%oCd z^L_Z$hnYUi@}a#C9en8T!vG&Ta@22RCpCX(A4V0?y0F>Rhi;Vas<(#^i`3G4GVJ9; zZ`J#|4}Iu;RnkwMbk+}KGSr7*KKwx+L=Gm0kaELA*(iAo_hGCL;~4(w!wAYqauhk5 zl*%za+~NG=nM_sr1jXIN`%ZA1?XO zqL_Blr~eH;i}j~`ayusdQhbIyOP(XolhSp;hkh*n_nQ9gx?78B=Zk4qeYoa>%Llg) z*L}F*gGrtyA8z_^OHLDxy-nU#^W334=T!H6xX)&}jAb79AbjY3-pEnC)bQ4acRq|Su8GUL zW#0QBpLzM9*5M=N6Zu)L|0@6DLmYisaeX&hd^kw4%N0h|*eJJ)YYvq-efq8Eq~7C$ z*N23DeNXy)@cR&DO@Ivg5R#uJoG{EJqGm{5LMv24Ut-LMuReT}Yu7CO%`lS4<2%d1 zX%qO-mERPW$dAN+B=IAu9~u3~0?unDall1YErt=_>oq5IzJZj zfANxM@S_&jB(on`Sdh(+tbTMUq3tiB-7cYxEuk$fp=D=R4nK1Gk&9kH&6b;z$B(=! z$>&FY`jxZ#<`kqCA`6p6Na-r-#}_WWgdZjSaD?Fuqm&<|{b&VDLq)FfNTe(eB0x^~naLOw!P=f7y_TJen~4NuHpR`ut7V{F!W~ z>YMxZFMpR_`L@11CAC&6Z%b({+pCfqCAD_+UsclHj}CrxWU~|5!;j9Yw+p2!*^TV( zM|-Y`EbccsVBYD+MsGiUXYWL^j~^ra80kk}Hv5rM*58i-ehl>E50wn}V-S5XIfNXl zdWZS3Ji(98di?3fI4*aTAEW&kFNbI;ZFNa)jO2biEvd=d{KoomiXu%%No|6fr$8xf zk{^@(n4*$teoUp;Dy8pLc}!<>h98|uX@B|gH=8rbS>z~I&hcZeA1*)K4Cnc=*N=UE z%x80f9Q=MPqHpzMn;(nmOZ-^smwUwN`)Z9JYh}CWE6A0kbglAZwesbqv~~2&RNwJsGcB^EMU+%5_;~3lTmmAjMh|K24K^9D# zsCONbr}esiTpjh}m>+ljxaY@lDe&VC%TD-lk`n)+^;7gqew_B>j2~y&l;LtPpQE2A zFR1*YA2sYVR+S#>y&GxeAAW;zoF`H`f*G7Z9h_#)}OnE3ChTKeBbxufgke9 z(nmiY`tit*SFDsz&=)SPJyxTh$e}`iMm{HBsNR=yVsg%ZnY_^m(7%L-weCODAq`b-DEAu1){lNPsy=;mjfCLN^l8H#k69RtGB=rr%uC9G@&)wo!xE84fdC3JFGLnrHAMm#tG1#T z!{Pyypp*>!cyp}0MYePRh5%No$};j(K+T|0GP_WYQa*qRl!^h=3!px|5?MKbD)L;= z<370aOp52Aj1>SP+xK*IpK1(2?czVjQgt2Nm;fF=R_ zL~j~E3(C)AGg9iCQ{)B)AUmfcXJz zWxjw1zl>cHz(OXA$i-y*{l1n4uq=S(OjZW4in4+{$q84}Hw3VTBD1XxV4d>y0X$@x zNhc}L}U<&5KSskzVa zf$S^FBUSU5(n-@6YuW)8KbPeO@H&7Oatz-#+}E_10lW&pqG`#>YSNV1-pF}cR{Ipd zTe;Mf)!wPu-cvpV@KGf>H{ml~-UBah8;c9TB-ghfvIk+7IoTDH!@jK6<{hj7*aENz z;9wpJz^UeOQ(STdE32=7JUmRiq%Q!!stg1Wq=!@zmaCZ>6=is&toAj4ZvlJ{06}C4 z>KC5`K_mX3EGda9;=5Dn-JRnjPkLU#QCXcELvK{REay}Z7jKL^o_&E{l_AmVR7C|xas z_=RCBvNb7rW%+V}Abt(vY6#atXdgs}Af|^fBZQ7YbPD2e5Kn^W97LBOCI&Gnh^pna zu0f3A4Bdk0PU#WEkRXQ29t)yp5WUp=e+1Dxh~L@lLk=MOlKq0{Pmwi|Po4?~$_j8> z2C00oOv_|pd2LsDZCDUD%4@^f`=_cIK^ZCA%gWJgj#0g1gBYiLd=L}p2`lJ(Y;q7& zf;bSw!62pvF)fHi?EN&+Fr6|#h#6|^UqSp$pD71b5VPt3kVQG$9Qs^RCZ88X9p>T- zf>@~XZWXk}K`aSkX%Nd8ZVh5|1#M{sZFvwYf>^04*9WnRzM5P^u2sG3g7|VsKixJk z*+_0uy_r)qWvv5UT&+@tcnK|J87{Y-4UmBb`9@$+Dwpq5lbP=ZagWJ;@&Wl!)jSH~_Az}0o(A!ZVW|+FQzAh`gLo0d z%OG9_@h?ML5U(Z7rB$z}eU|GL!?)x+@_i5~D{3F;A4!?~6Qy89{b2h~o-a1zRIf>X z3eYVovC4_YV!LcOLnrByGmg1C2oDo)5Fs_nNAU*{P)RU|zI=0tEH^C29>C(DR-Pt=hpb5# zLVAW7LdZ?Y7(ymW<`A+|vXEIxnLk?yX)EbFO&&QI<_sYh#lSodJujJ$%umLT6&4Jk zPzX&cX@!{=A&Zj5$l|0_mI$FFy*Fnr9fBc*G9eg47#_l(A!s3#4WTn@%7suqgxVpT zVsQnA)kCOAsYF&LW#%d&R8?Lrgz0LFYJ^aec`b4y^Ex5a4WV8L^+RYALfa4;gwT)$ zEkbCd=4l#2V|o*n{1n0~HS^CQG*fx=5F*T5GWmsUrFvV3khAiSJ={*N_RN1J+mjts zW&CdM#AemXTI9A(J|XlCp(mTY$lm1dr0kPnTxdTw{|KQ! zWq|4(7{WreR)ZK04q*u8AoF3W@>XT-OJ!|D2qRUJxQaF^gwbq{At#40mNHJ&jHgTp zVWLVVg;1o*kNq$ugsCc@7J~c~kQM$bgug>r7sC1wW`-~;g!!sQzRYEI2=axP|1gRlbeB+j;$$y)k`5H^Nz zhRLQ7HdFSJTSC|x!Z!NVcQ{c++fLsR!c&gj$)+rK7iBlOhxAp^_Jxq4s=izHGdU1K zsjAvR@=yqeLpVY|8o~*R^d6%emwL*aID>>IRqv?~PSYDz)g+gh&xUZ0lb0k&9{qkuZnTc>5A^3z z9uH;PnLi>Wc^twM#0B3BgPElRi~>c?tr`gYwk#=#7LB4Ix`tzpBUNvL8aaFw%$dO;sie<2xO!NkB?* z!Z6nJX-XVM5{5~`ND)TLFp{a7td|~7dBNv;w$vmXYkT;AB)qb46Mepl#76_vtdkd+W!juZt zv|?ct594w*tsxV6<4TDzN`}$4nid#sC>2KOFbrXo38O+76ROKKnl!txY(N+T!{{1Dx3K=d=I&wiVBW5}Ce7c%=*ecUFn*`>CWlu4 z@f`IDqc4+wq^xcKFy^uM44r53dLsg|rGK@Z){8Qy4DBG%Qqr(^z z#@}JgWHL4^UuU2nY2(6p%|+BpSY|>P6T_Iqd*bi_C>gkk;Z|}pxrK~BhPQ>Woy{HO zPI4D1V|RzqLd`R%hPF?(tA-|T{@)+QfiMoT>=1c8jKh>8%I)OW>YHm}5w4dWW+Iw`$3 z5JJ zKlKM|YL9DbZ<)Uj<3kwlRE_*cUJC3rwU1$ZV)&W-FN|{h#i(O&3YU;g76Md>KMhk*#DM=&FT1Q8^R;HLk~@Mtlti_ETvhT#kYCjlh@c?7kV*p_+pd7>UWaS7dP%5g*N)dEmWfdk> zRbDNEsTcG`)QsqFHLt_G7Fk=>$lGY^((6S~pVA8*7PO2M$j#S?rK!82ztJXe~>b2 zPy|(3IfThja+vCEUq>4e!ALeIM=&aaIdwF-tKlRjqazqY8LR5YMKGQ|K_wF-7{Ysc z$g;NA(Wa<;DrK7NnI!tQ{}sXC5xkG!Lj*G;m=(d32%bhTJA!{AI2pkyS#$&+Kk0|i znh54bFfW4noMd4Hiy~M+zpVDgVm4QhOUR`WEThN_%OiNl%9Scv6~Sud9lv00M7}}- z>m%3@!G1ZGBG?$gCKl|9U^8VqxrN+H%FNp$KwW){b}-qga=8Vigu5fy!(^|@_eD^E z^#_?8BM*^>$s?qUJu24$>7I9^2X?Va%*dtXNIO4a{Mc}>2F;H}F0y@9-?YEfP7V+5ZV=8fWW z1pmnuFM^mnQ+2g35!h9I9K{rYnPMTWq>YrdmEYlojtHC)xEQ+0Km;CDF#e^~!ZBv};6qe#I# zEt!%`MW!aDEDhy$T`gS{>7&S?^30TsQDmYxc;rZZmMG#kIUDorWDYVXnTyO#N`0Ov zeqF1-44CHBaKoik78_=Ad5%!zxCwKmL=JgUTGSlC=-P< z3Re`yD6}YsNAYJAWuqt;MYAZHM^QeC3Q;tSqEQs`Edv#!sKgmk*VBsD(<(<%C5oy{ zYO9&6MNwUO4NA=@YEkOf`|(q(P84;S)QitaS*r#VxzmMwlb|#kN6{pT?)9_@9Qacd zO;zR3QLJLv>AkT)6dtb0h$u$N_C~RqU8ACy9K{rwEs8Yt^<6q9im~h(r^b$t zVgh}lN+v~7ip5i9uh!S5MKL{!-u1P~^|cwSnIl^o#b2ua?5HORqIwro&Mp2l# z{0r|w6qjVtQT?BK7sopWGxEH+4A<1y?i_fN&4*FkisCl?4tYO{yQ=b@ zTzqo+59C|&9Vv6Z zk0Q)h-9IwWE5)XAdlW0UKJtk|DU*jgiefPokHHg# zHws@Aez_FKkRpbFTs%4On;Z!Zv_}oJkeVkPMMQZtiWvQ?O5`pg-|2`UK}=sz!Wa@! zX8o-<6VsEBNl6Kl#o*?;rEaLDj3HwTnPN!A-qfllO$=%2>B#gd&k#e&hWay-nMr;! z3z;>BY%ye~=O%NIIY}9kOSZJYk7qMa40%zz@SYsgNM*0;gWk@5b#ZZ(T^2#g3Fp+agUWsAl7^+aJs+!de zwd(X^4Ye9E2y4c0zo8~lCx*H)w2YxpBhArJs~1C4HL5WkD-I|jw0KCT$eh> z&_(54Dc#8KG1TEY^pxEj!{8W(#L$~v{mI`+nYm94eU1p7}H3b9m6%Q|3A#<#IUH5HaCWO zl=(3%rYs;Al2WiJhCRYY+7c#9|4+UmCSPuaFlSp8!|E8;$FPCTH8HHE$ohP4q^+Zi zNONNhn__qt!}Az6$FN0?s~8@{u$47OVmKPZwivd@u!G4yawoZq+)eHwWx~Dk^lj3A z3hZZcK;;KxI7C0Jl5bprV=c-5r9vySpa1g+OqZz!!G{K@$ih zxVt+6X6FCqF7-SAbLQOhsrz2Ns_w4t-JPB3R+ql0M_-h!g0Y2tWg-%~&6oR4x=GUwA5_4$kXLf;aOE$Oh%iF{E}vZ5~` zgq10*%xw1ISN57zFsxx^qjTj#Y#-Xg%E6|S>Y|G8CU~gw1xbHc1;VOoSXHkWn`$tu za)(uXSj90RQCKAot0ZBSG^|3pLNY>zuu4uy5mqU~DwU3=53AIg(}Y!8&FR8wFt=15 z5hVl3D`QxF6IPj+keQmDnkB5V60%VxQ=Xe3nuE=p)Lh}OPyLw9nsPS-Nif1HPgvy* zt9)TqGOS94ReoKeU|1E_oYDHMB46FXEAn&-&Aq)tsfnhaBR!CS439DIQHCwL# zVYydcXi7MCpOax>HJq6}$EguvH8QL&nsSel`O}o4M~BrI@>uPR3oH3{l7uGEnMj?a zqmv1DcteS)7C+ZBU6qy-T@?Bs7d8MdiH25QQ>}htK;N9s3)|4QkKNK z*q%HcmM7(@v)cbVto|hbMLnne^MpNv)CKKalw+a!->|x*`Ew=XYFJ$hD_2ChBkH=$ zEv&+f-VCc-gi)1^+dBV^T<9trci6leR`~eMBXSsKgPKgieZxy22t!*-REu$q9RDri`c^Q)0796;Y`pDh)$vBVRvL_g`fr zaTO!kN0oto#)$f^%Ga$(_>@lOh{_gG*&`}TM7647WR0kiRg5K73{k0>gT3-lb5e6f zREUt98c#K-l7H@8C~riasA4>0_W}`BFrtn{)bWTa6j9$sRP~6e5mALBsz^jt*1d{G zR0Yk&2*o3+L`0P&m!f`8EiLmW$XI0vuBx$lmL->qsPg}x8LDbjjHs$rjY>4vCd%Ep zs!>H8Hmgyk@8qgR&4{WMQBxvnYDCqJs5%kVG@_bCR9)uOr`FT?@Zmh2 zM^q=x$Eq4#$X%)3wBKFMJN`w`lTI&cZ)zWEU#g5NfAaJv4~VFN5j7~H2D4ePnlXeh ziaL}k`NJY=xaJYEJjl1X;iJi8B5EvQTtrPIjHgQ92@&;$nUl0LnUJ(v?5ItXvm>IG z(3u`lKStC~5jBI&IT1BCqGsw|vm$CXS#C8Z9p$&jgb#bqi>UeZ7wF7|5w(c?vvw9o zRKnMCmqygDG*?B`GQvuovpk|!Xs%t&*mgfQ%Ib((6H#j;YF$L_j;K8mwLYRYFl|Rf zZ6qXoFh-I$Mbu_GTOw*J;kSs|PLSxfhhtG$E+I%i)*?bj@~ zsh2tj**p|chqZr%aFqJH%wd1*3jc?kgL0xpRn4f{b1HN)q8>)nqlh{cQKuv743p1M z&qmargs#<$zX;Q+8J_*I>&f|u`a7a7MASw44%_hetE(Kj$4sjDXJp_BaTH1CWF)rzXx zQT0PqwWCufs_GJ!v6N)ii>kvljQTViL{&pVqo_RiHMUfmP+LY-Q$jOpbE-sJMAc1Q zr&Uz7rr$7W=GY4s2UiRheX7tJt(RMN7b~blK=A#iK?NpO6d=yj?{IAN7V?; zg;{VEo1>{?qH3&;j+6bygbCW27*&%rPmZc7nx{t9f4n)&bUHs$f1=Ky_GO)^RGI1= zn)9M+E+OIH%Hq#wa{+Z>R4pQi|1)7R^%v?AIj2}{SyU~To$N+GH&#T|%BVVF#z`|) zMb&CK3xMpvny6YU>p`KN!n&whA60)x)rF|q5LFwa>S$E`9#xy7YI9Vze;wM*`dg^~ zi>j>&Apid*Y>TSxgwq^-2YF{y?UJjO-a2nBV~-47%h=24zNp$CRR^M~Y^~VgOSqlI z!KgaK=wYh(M+iSK=NS2PR2`4X(^u6AIb^krQ&F|JmLYJGP3e-rXPA68s{V|s3D;vQ z;jgGV7gf7!8JB7q=cDRlEh9;7L-b-){S#Go1&6}FQFSS*UdV+vsxGrax7x9#uz}{EE&S?Z1wyTfx}7ns4d6i>mig^@046+V^q%_1eaNauHzjGZpe4KS4T% z2@yFfwWAcm9LuC231+H=Dov|`O>^2hhEu_%P+6ghf?N9~6+8-F1)qXn;g32-euWZs zjDSKqh4czRg*b&o%uk_vB_<@HCZ#5$CRb=sC$_6ovYATC%Ki4qX{ZuPtI&%%!Wk5D zDCAVgsPK(KCY_UAA+zQz3RyL0Q}}Ot>~bwH`7D`eE{5_dgmg}Bg?O@|ojeLt^oaRr zuBl@bP$;Nyw~k@08=G(;g>MxKGg?F;nS8L}YV6m5q6)=m7T48EC?x$oHi1$Kr4_zY zD8o=i>i1N622fc-Icj;Tbg4kdSl1|C*Qmr<$x|1rDpZsGrqEEKIulydH3ru;YLIK{ zzO@LosdcDz73vY{Q>DIqa-)$#V}%xUnkY0?Xr|CyHf?ceUR|TYfYATAz31y1MIObr zq9rq1QCm~nP}?dbJd^rWU8B812ZcEba}_!&bW-?Knf*004hL%$0=Ko?!Xc-e~);Ctr7jq?HmBMPm8ttzobYZm(3U?IF)i*XO zY?8StY+>}4!d8Xf6#ijzo5FU&F;RllKcuijVW+|_I{UQ0TVappy$aJgkmT=IIH3K5 zatiYa@`vdh(f(0|-!=bvQyrJfi^2(olL~(;Twv&w!k;?lv@8tGX9?r~7y65EPW$I& zyYw6`(oFa~QobFbf7!f5y{z-EC|p&z#^!Z}8w9yqj(jfbrp~E0Fmzk<%JreU+=urR zUeq@{4UGFd7TFsZj}#s&yo=p&0Z(-PGli$*9$XT#XP&e9g8GvBiuziiLIdNC!do_l zC0Sk{*h~a`l#5&JL!J0c#|?au%RAW#LRZs*_#gT^xnKfGgE7?Z1Yu^F1 z;xmLEPOSmd1ZwGMeL`)Z z4xz60>j67BRs-!c1R7~}zgA7jE#=Sy&l(ubfaZX+q0xf+O+(|mhDK|k4KM&02()E> z!@;T(@B_IWwLMk#MhBoHxk73p`cXAKy^aOfoe*Qr9A@`*YY-scY z`s--cJ8BRx7#IVL1%?2x_*ucxz)+ntj4+%!f;tiyrK5)jtLc2svP^Fr&AGsMU;;1^ zm<0T!GbaokQ5#(3l6zCoiBb0v76=d_0AJ zW^*y{i}shu$tau8FEQ=-5Lynbkh95zbSA6>RsoM?B{O+7uo2iqUIVPv71jY~8XD_? z4FuuG4UNr=o}+F7wgSHa+km6G*LGPsz)qmD++l;Jy;1Cd?gI9+xf{sb$k;>POWjA6 zoGs7Q0nG=2L*&ESIU?u6D9q<@cki+WpU-U05C`*B3+b)U@# zz(bw$2$-#-Pl2#poEdrsJO^ILuKqjzrCb3T86Rco>RzvbH{`d}chvVf`aycJ=6~Ax z1bilcp?=UKM%lEOkhHO(OaQ?|HB*hohJ>sp*i0xlFJw2xeqJOs!C`{a1Q(m)1Wa&~ zJ=*aSd?xq_RT_W&2^C~Bj+)4X#0063#DoF7vw?6j6Oz+UK~1T1Qkjria~cym>6+)FyW&K15FrY!g&+^W|zSx3^!o}d58%^3B#xfzl4u8VU!8WOjvHhXcNYm z@GGM-%2*SoY92=zPn{qOO#72en5=n<2^*Tk_Te-Wrkn61{W&JgHQ^`n4C+kkEUF~W zmZAASj(OVo*@XGz1=NMwUu42b)?ZBL7wQrnU24JuMpyEaJS*hlZ^8*iSDCPyu!p+F zgv};wF=4IlyNc8o!!)g$Aa%Q zVV?>6=^UUQHQ^vZ_QN3)4r@Ll=Z>!Py9vkWAJ@@8OsL1`Njj&fr>SSCXQ_Wu|DsC$ zbF$UUCcL8m$b?f(jpruZ;bVCp(|lsWQ^GUqJ@$IRoR`#SQzKO~qewI3 zH51-Y-p-*EG5XJhPjY=W!)?ZAM#FLqPix4{{J)r>C8xP#<*riz>MT( zq%b3BhCGZuj(rnR6YDxj%t%U3rk!PXRZ7jN%#cSj$Z+yXZAKdHr!`{H8(r|tbX>JrU<6AQdvsu)PVrE?VU#N%~^7TM@ zhqE~S64aK>ziv@UGfJ6Jn&x-Z3e+-Yd`~D#Ek~8DD=$Oqz7@@=M8C3*Rv}b1V-9nw zvsuH8nuJ($>X~Eb?CIu4Lo*sNp|u(EA=SoaG+|TtAW|&&UwyupCZO!<>jCN*pHKQ97+MCfuXLcZTlvSji&Sv?w zC)PLN3zglq-^Yv|fCXOXt`qJztKLvDjfEjX2WC;y6V~D)_O@AnLgw7de z#&B}E7KU|IY>kaHW0V=A%@||GSTp7`I?jyoX4vnB=9w`;_nl_OMDir+Wa<Vl#drFVW6Y z+5atLTfL0Va_R~lU1>&EMkQgj8NWV@Ut`8vGuD~0o;lmhNVu)s1~WG5UYpF=Ox{A> zs{P*xa$BnH0^}WL>@#D(89UkBMcqx^LzQv&%G%}}4$wJDJxD!7JxrC%BZQVr{+)cx zjN>}`hgshDi*4yCGftav!iJMJoH66996l??Sn;Q9i>!GI8dz}7jPr7)Tad_tzsYzHQ1ud~6ZVNnYdZ|9D__ zumwd3Ni0ZeK{5-HTadznoEGGwpVER<7NoY|S}WsoDIY6 z{x=q6(ww4oY=&7Z$Vx{ZDJV^OWoI)7Ro)Q_5%N$anwt<$H7v-_B6-=&N6k+yKrKiu zM3uhZT5yH``zvZe_0~oi3%<9Ym<7cx=)yWBbY@9HDQam8z9anK_ZBC#Hp*I1&Vuq5 zRIs3q1$8Z`Xh9_lZp{iEXl+#1b*d7oQ1|hRlhw%8EvTV$YFbcBb8QQjaVGWXq-qn} zC%0M~(bh&o3mVbvWkq8Pnpm*Nf}bsDYC$s#&a^RxThQEs78dldpr-{bEofyyCw6JA z>(^~#v>~^p{y=RS#AYcNwUSAx~@VWkGK`1F3ze)7uz* z3H_*2vp-<~RqhKd&LHw&>JSTt5{6MXbK6H)Fw%li7L2xFtOes_-C7_|WR|}6w#K72 zhVb}=?rmcQCs;6%%}EwawP2bBli8d?&BUDPI@5J5=t|3HhGQ(a|!b- zSU`|o^9dOqh87Z9Fn_THzsM1>qL~#-ELdtmdMh$m@v9tG3$9ym!-C~>N-f_)aO zv|tsxZ?a&uuDsELHRQF_b=37by1|0^982aPUo6^e!4?a)>gWy&ej{(AZrA?*EZD|g zJL&AA?$*&g7My2vzXb;@_=o;M3l0(fq8_&3xCMWZk63V&@HvEZo%547{pf=8MkTTqqNp3!+leNKI$ zb6#4|jybRCywUz!S+w-uYv%*uqXqwI=aZbj%n579Y(<0|r7A1`1fa_1o2=N)e2aFh zR@lgP?KrHs#2mL39-3*WUMmvm93R1NMSu|0ew-B_**7trBvvG~A{jX)HM!1AVMScK z*bzykozzz3p(AEmn(3^lN++Wg-&j%EiYiuQvLdq;S*^%sMHVaCwKIlE&a>EEspS`s z?Ckih6@{(HVMR_hb4g_@@{&W;+|+ogVZ|bjl8?iVAcpYQGXe z9#~)1ifZI0)aq8$(>XP)sHwS@6}8EAv{P4(rrxXdt!SYAhJ;4c##Zd$KYFUR$o+xI z&FS~BqJW|MB42x>pB4SBNVv!K04oMEVUVsc*oqRNSWpm^|iF3$vwIl!Q6n}vg8?D%6#X>9gw>K79 z@v{|+buD4=?_HSHQ zo2}Sl#UECjuwttfzcF;kifvYGw_;C1rq16j>x8_Mx=Z`#pDMYPy%gU|XCHMx^?=Sf zXvHheR?-ezaYXw^t@xdMOgqQrlG`D+22RpBB_}(Z^0wr@qw&JIHpQQ@LiDWs6+rll zdX9RY`Zx6gRWdJH@ejEYyI;2A3X6|p<*Q^Ve$9&OR@|`S)A-PBnm4I3nOkzf(RUlT zW5r$i_jI&<2jig?kJwCPi(PUbliyLFSn-tb%!*z7O5<}jUs&;y@QV7H`i3eM-deGS z(|d2l2f41w#l#A~4FT5wWQ8I~=4UIuSP^E&gg2HWRz!83;~fmxV6wr?d<(S<-ypKu zV6(wa$4zxmom8ppvf%;e;GyHyzE28vj2)xY)SwMx}wf584ke0k}Q|z*t!G?@BbhV+I4d2+1$%gDUS@Hhkvfi__0T&1*wG8}i#wfX%{G znMOey3X#91rtB2k_98l3lu%6ez>(OTOK86&p%k^W4c`&U*zi4}tPSM|(xp%*LtX+E zY^c@AsHpu)gzWNpT^p*|(9VXoOLAAYp@t3hY^X2W)yb%7!}?B!cWS7X?p2#mhgz5V zQzxSV!Q44EN<$kO+0dAdG+Wxxgxpj+&1`6{xrGfUIJZ`GT5G?JOh)q$Hauib+RjFM z8#-veBcYQGowd`&hN7H9cN==xu+@g&80u-mSR2NXd&zd$(8q>`osFKIjlMSYvtepy zV^wFPzYPOy7|68Yy5=Ao25TN-!%)q`2noMtjId#(_D9(;TJsnij&VM+AI96T)P`Se zm|(+18z$K>nQ8NFm?9G(&!kSH{zRQ_!;ge|hhj&6206BqpQ%~o+0;4IxjH(JP=S}t z1vV_y{vsQGCNI{`FN7sFB<8&zrSdWxtX+&X^p{gtP*>WpiXb_w2@kkwYi(Gk{q;6% zAaA5@qHfmFEjGx_E~NW58`5<#cG$4fhV6`Yk-J#faDHc~bQfcn4ZCH((cfdkUcx@A z+)+@vhy1a>t@hJ7V8cPeA*%R?Z8$Edk z%j=O1kF~$4i}6gRJuvjJi{Z87xeYI5K6^qhZTMirM;l(*@S4eQYB^tG13x5ZL9VX_RsSZ0V1S{1>m3+G$$GO{uop!kB zyLHrKN5YL|eA2zE@l97lHb*jpb|hs^95s<0i3#Pp8cF1cq%!2ezM?I=8p-G3wY zB_S16>ZG7pl|HRWJd=(I@*!hjx2Umv7@RTS(%yFj(m1xBWI`P z&=qppk;{&d9l7cJ-)D{D?J#ss9>T(|Mt(aAkjvUp(2hdnqIP_%GYi}Ceq8Lg9eEX@ zxtr4~MlNng2|G%XOW7eOl%$om<2yUb=nCHx5^ltipyli+Z$}0C744|3Gb<5fxPSOR z>uPM))6wd7)F9WiqZXmI9d&iIjve8vv3V|B6q{;&I~v&0kkOXZMmn=Gp$WAqwHdW} z?1;zaFRx)MLaj8nCbY4mt#*E}qn+mVcKpj7(#Z~axLy}Kx-!(+j=OV1?-}Z5M^8I? z(eF;}VMlV_QmnTfee9TN$1FSg+R@LBADPhKjsb)*)PdAtvNi~VsY9qksWRuze4BK* z9V6(Bq>j?j(RRqg(-XFCtR3U*7;nb}9i3vwMDiriaw;h}9xY^CvqWf;O<2O6D z+3}^DadT{_@Xh$`cG%~8FlQ=_|aOfDUE>?QA`?x!B09;6 z9qqyU6E<_8xdSa|wsfGa13x&>ip|#4Hafp8A1d08&Gyt`rraF}9d%A82ljEcT^;zB z(9?l#2ZlN@j69q=f||2uZ0S~{j*@*#Q=Bn`u?~zQjMx4ILff9kWCy0mYImZb z6H^_S=D>RgJ~%Mlf#E%kl@6?O;7133a$tr7Gui7G2WIIy^BtJ2d5!~f$@8@H<%L>6 zUPxU;{aHsBJFt)wmU%9rxzvGQ3CncOa>5D+wlj0J18W?3;J`x%);h3G&M*13*@5*A zY+&Xw2R1se$$_1^!e$4yk+)E{YX3I}F0khI1V{Tj9QZ_kmjk;U*h7E60|y+~t8?}_ z;NorD4?1wjfuq_#?7$InD?ax&JN0)RmF98sAJh}nlRA1z7IUxIK|JfgpAKAc;3`9Z zQ7_6*0m6Ce-&9GyAjgiqg#VGnM*otIUX~vjj9#O2n|hskgL;!HeQ!C?nVEO!+@;>r z(fbaJVe}E57u3hpCpzb;1JB6MwIlzPkjgI|c%_}!gf|Yn)y_Kyma_6k2mX`mm=p4- zyH5^$b|91U>+fb?n4HFmumcftR4(#PSe;PJfzC8JVJ07BO`8*TCz8`~IN@}{??k`} z7afliUV__++sv2Q`kY93eWnw1BF>4#P9$Nbgv3uo7LaCACz7#?^iA5^ke5ITCZu#C z6+;Q7Qqwe;kk*NGY)W!^Co+&TYUdj#sxVEWnQ3OBW_2PPAv-k(RdRAV(VqDs?c^rJ zJ7Ey=Q1eprQKeUYXY8K~0)^;QmO-8P)``M$A>v)~ia1e}p<>jEP84^dgcBv%lokHH z6Q#(dsZ#1YC(4k=>G_v+qMVMFccKD$1*4U;pKfiasuR_mcsexp`+RjLYB+Jdx6#mv zn&J-(HDG2fYHi)C4xz3S^$7K~f4H~N;bE+f@*AOnp(ai=b>deimO0VPiRMfjN^Rjp zTPJ>SqNVQJ%8AzGHrkPQIoiqYbz&f$4o-A*qNfw`^;o%ebL*p_PV_rdyHLAQWdhxt z=&rd3;n4p=y|mNYi9Y1M)PB_dIy%6KOz&gA8w{c|m^y^|Meo~TP7J3r!ikYijB;YM z6Ti@rj$@pd?!=EyjCEoh&GAl5*3k)0Ow>F{uKfBvqA9}KpXS7e^syE4lM^$XSg8G( zgt^pNPWfou*Yk9aoDO|r`Sa+^*Zu-0^3Y#I=V$6-9nHgU(=2gfDIK|lN(Ff>cj7lE zwmGrFiIq;Qa-uqmtaW0w9ECo{8tQ~TM%HDad1;Jw?7rTK4Z8A1CpM8cQ@3b;t5jpD z?Q%)^Ep*(8KP2SDF`7G^*y+SBCw4n=vyX9*z4nmzQpMco#D2{O2%q~HhnzU<#1TD8 z!k^(so%mfl$K*=VH@1IHIC0X6%SS_JoH*q~zP`q3=G5$KbYjAozQ*Fd##tx+l<4_* zxj~ThI`72aPE2!Qx(gSaxah?9E|hh}cGo{ne3Uim#J^5llFE9-hfZ8^VsBsLs&=l) zndQU{nKPZc)LYcsI_FM;$(h`9;=cADIDvk#`OE8(6OWyEBIhil@~yqsglA4XC%mA( zq`sm`uk`Hx#)-Fd-cjG{=m)vBFyRv&mkVweK0EP64ig=d3yqi%VKYiq+ykJd;=6NZ z7c6Ybh*lSDWINTNeWwe3S<2&r*M%G|X$0H3n|!4=|WoVr*a{+<}`%q{fu;k^xB`u=lFah^{<8g;H z(ISMm{fuIS;x3dRBz(xHqzk3kEKQXP-x1`=m4W_7+hL({E|hm+Jk1I&RCJ+*3oTu! zbX$gg(@yobzyTjzAn>}ybe{<)v6O}xKL9&wOpvJxsGgO|JZ7j2X^N=9^ZgP zD$r@joJQ2f)F!%DQx}?PZtjx*;l}~Sr0DsbD<5Ro#o7W8fvREe;~ATp*^7k zwWE%9a-kE)?czdLn%!LJLFle?ula|;W6Q+3%6Xjt#j_XaEE+XJNI0W&+$sx z2Xr24{}DlM|01C$06YK%x;z8(_cn z+_1V~qvN64sSc`>D!p6;w;S;+@H^-}{>$qc$tg*l1cNaDtKZj^B&sT;}M_{NP) zZX|c3_Tt!KP0ubV+(@bWrg9@SISnf&VV=Fwn^0Mn*RToRC6&mjxenRos!g2I$GL|+l+qiMp-x7y77Y><=iOmMjJQk3^FRXQIW|_-Ka#U z;YLkDWoi{_RX3^;WLv81U0RDyZK*>@*!;TWhHlg&)Tc_X25zW9U(d=$ZZy_@6E{+6 zzZuQu)E3m1ZnV;wt!1Y%Q}X3&O^x|Ga632JGob^uyBi&KekV6Nle=iAs~g=k_Z(#O z_&;`|7r8gJkM?CH^mk)`8@J+cI}QWg7$nEek3xP7c4LUJ7lphS>c%i>dN9<3;ckp@ zBbNsu4@SB%%8j{h%yVP38)IaJxG~9%v2M)dhK%PxXa3eE6Gc(y8`_J7} zhNh6E*_+=roBg_*W!hOzSRrQ|@BAjCuX1BG%{A1uI&;;V*e}WJ-Pj_qwr@u#37|=j({NcubZhUg%gc~Q_cqrGg!Nw^!PP=i*jmvJFVc+xAv%1co zZu~_)rycnY!r$Zz+PO&h$Blmp_w+iyA}dNxOqy5SxJI~6mD%2K!1V1%E4N~K%QeVDfl2~&R50Yw5MmT>nl+uG#9%S$!qX(%6 z8>#81Ar~2Jr1c=-zB=jXr}v=I;Mh!_uZutSF7%BDnLOxEC$p}cg^<;QY=rFE&q2uP z!F1;5_8{JaA3SJBU+!ulWm|iY$Ai2cIW8Uy@Sr38-X8QJbn@W+t@zI5E*^9xbfb2s z%FKIs&{K0SLP-wPm)y^Trfd$OE}{1CtkKFGk44--8t% ztn^@%2cuc-R}ZcXF~)c>&V%vfvDC;AV*(R?qCWl-Khc9pWSQY)52lc(Qm0X;>*$Xj zq#YXDGc)MS^k5cYwg(G6SVW#fo$J9o!hGris&p*G?mx5Hbf~eI@C$W`&RHtw0?*22 zbe3zs?@(iv2dh2!*Mmzm*T@x>a9~Mjtq1EoSkLAL4|Wqada%hO_a=&+0`l7K!4~pX z>TlZLCL6+u#nNc*@L;Eo?jmd)YV7e~FL|E_hY9X#qkCPE#pA&>>FdD_nop@W<-{S}(wVnCxI@0HoqHabhkZRG9(eGO{v+yRo%2N2 zhR%6L^SK8v2rsFxbmnWh;4t&82k+#p5#1mENltctVCe(XK2rblAmI+KpV|CE4O3;? zBOXM_%KP>B!YjWT#rC|#3#%7yFFaoS_FUP#=swJt$U*H)c6i|=xTv)l@_OO(A~hX9 zRZ7JX0$v0O@<`M9^FxWqiK$7vNJ>aXP2ojyLc--;Dx~xx6`i#lC5;zpy-4RpdM^sl z&)~($VMdOpp7tY`i)Y7;M-dNIa}v0gOuqPZ7Cyr?lEw#hBL z={Q=ejvBgj(ohcgXWHePF~#RSY5T>&x>y4?q2lpq9?fz zwU-yY3DMz(ykr`E*%U}Q!st&PKpjXOq@#nqD9C9`=1^Jf+8-`I1;`_*qqINTi>}Nc z=f!xMzj`sji-}&$XLFLyoax16FQ#}gmCkhPH0l&R;*VbZr1NKZv0D4HyqHaY4s|Yd z9`y)w7LXTuv54@q7fT6?sj@A<5SGY3)HS1oW%QSOu|j9292whPtL41*Vw)Fhw7=Gi zb(+_Ev4Ol%JDUibz1X6it%M>YjqQX|_dN;dmoVMzG^g3Q50m_Ev|63(%XO-Jnn8O2F(QQcGz)k~E+J|8-tiv5`!@FD0! zoDYe7NT#ESeMsU%QVEUzx@STJxrak?=A_V>DSb#qPOY69a{bqw&4={l4BE-)!#Cti z)XdZ@I-1o7xlNhOD!UIke8}lTE`~}_Lq2><$n8Ts!SEqJArCb#Rl4W%p*$yCKsyC} zC`4{Yzp(a;_)wHwOgqI1BbZi_T*`;igzuJRDZidb8Pw+SiAE1o6FNi~&9j^g*7RImm}0J`D9?upIF* zMwKx}#~Ja%IP@4jpW!}?&^(eb%7@X~seDgu+8i3|!#E$t`!K-=Y07Jg4-?6gv@_X< z`V(Ryc}?|Un)avrFd$@z`I8Sbe3Kq^D`Y=zAyU>UE7b>O{G>`tX|%+vsnXJzUsWk2F8_VHro1Sv~dP8U5!v`a+H%AH4O-hu3nx^Fi}( z7=259M}4pJKM>CK5B*2@MEy)XuraoHB0far3h75Cf9z-~KjQpIOrQza#u~0@@Gy@s>}wNlYiDAE^jQ{76bjMomtY zaZ~s)Bkk8UpW2TM^wUt&Qq$?o^nP69sUf{G()=*S$m~ZJKmPbD6dD^Vl9hfQKe7?B z`;mi?lbYL)Tm;Ds5sqJqU4`PwhU_I4$*Xhn`H`PoKs#q&t8e`%?8k}#Rt8YSkD{{Q z0Mgdiqg{earb#fyGPv@tq%K{P>>!<>#^EC9kq>)Ff2(qZ&c_R`;Vdi`SylfLdEe>k#VtQBOPd{TRV~ z>D$ncM%r&oXhLo3$E}sIog=RnblUjQlF*9Unkvzzd*a*r@q-`jwA0y-_L@8R(NS|J zKNfP_E_Aw5yXk0mKlbQZ_41>?9|QcDa3$2+k3Kr5FQFgx%2;C{VIp;q{0qPz``dPi zA0z3=+=hyyc{pJNb={cID8gtR9plGX@;K^v>I5ClupxeuACvu<;>T1!HuuPiSc(1o~KFy!~SU^}vU8FPH@&j6n z{rH8>674S~B-}`OIeCq&NgZA3$12UM{ix56f2^gmj=G+@LFa7r;}{?JyoJtw>Q+B~ zBW$B?r>6BA|MO!9d8ZsN!Y-=p?cK7r55?BZUhVAjBiXpviFrUfGSFc^j`(rMkGp;x zrT@E3fMAR>j?3vxzUapZ!f8Lw_;HeaiYhmXmzwfA%jS9NpVYtnI7g7^Rd4K#j=$Nw zAZHL~@{b??`fl&<`S=377B z>F9eonww)A{!tcN9z$OL`SFSTnfiqq*3k%|+J%q`#I^+im;zWb&e-5L_KY*k0a)lu z$QnQ=e)r!IfKxbt&H=ara0gH*fNz=R2_SO-Spx6|;0wS{Gg$!10|=0Vx>{TSiO7km zNvKJ6)OTN{2q4wI*iuOoKuY?lbToC~>z$t^nl^xR^waBTh5#~>ztK*n050l1mNkG- z0I%81#)RzD90BAcWb9phf^SX_g6~T0q{-!}kG{4WL{AM zM3zCXzgAVqRkb5O^oKAoN|!bP^kHA&9|CAczdf~s z&gmGy4CZtRpsTDv`rQIpKfxFm!1w^V)9DdF&j5M_&^v%(0X&~z^r1gk*Xc{>7eIf) z0O~*;9Ym0?Iu6m!&;ZWqxecc|B7l*EQ95UI0Anhym{z*GC0?4DQ&7wJ*Iwyd+I%l4&3g#@}SPQ9(s6We|nP@B~ z|3Y0l(UAEp4Pfs?<5yN#MqN(5G|~7t(O4D0>Hr*ZaK>Rx0BZwi5k$)%*2&%u;7kB# z1F^djZIG2P$>=l5*eFXSfXxAUgTmMnz}5g#PcnpmW6fOw><(aC0P?&ud2JU{^A5sJ zSy$#*Xb#Hs8`PUr$-E`M`0-&M!gm9>ul;+3b(4$-gooOHM0gxP!VSBg25^!alJFz! zgc;^7(>a(N+c{s@bOsR)AVQ8( zEkXVj5CjM&s^pu4NX3p;IyUXw2@YxjCb)vJYqC2C4^1!CN0mC?ja9)Q;({m@MCl+B z1(7(296{s^B1sTQgZPG-$#i}iLh>L|5K>Z8>1gU8s&mk^bkb4NQ#0tCj51s}c9Le& zPG&+DnI|Ee_Ol1knbmRy5elLR{oFd5KZtnEMi6<(d9{;|knoks0_1{06e4`9a|#DB zhV^AKMQIkJ7N?d7qNL7r%V#slm4c`oL>cXWA4FMlIcjmW`AaXN@LL9`8G=@jE&5I+RbE{I>5-#&;AK@16EXb>HP=oCb+AS{1{u1q!(e(CKT zL>FdurFNrsr}m)Ae0m1)kt6n|(}&uZ+K<{lhyjFwK@1}N`XROsQpDjRAKSObbg^Op)S=q=bxx$ zK`akqMGz~4kjDcZ2x3(btAp4X#I7LL1hF=V--6i2F6*cpsq2H-KuCC+$tLn<>K3YO z*H$@qIEU@p*^vOU59v$J=I3g+j_xJwp&sTVPWF-a%R1~AJ6q+I@HnSK2|3gw)T7kj zsmFpiPWXd*f+~Ga24gp~6*v>b!70X@Al?RXHi$oi_$!EWOnV)~d0C}{Lbrmr9mL;3 zTnOSKLszN)=xYB4afy6cJ6E`166Sd=82gsZ^&oCAdQ;~tzoz6HH(3US?$Eg##680O zAf6E(P#;ns1@V~hM5+;_xO~?}G~2Myb2=}mFLm@)5LdZx|D(R6ui}8X*fsop5Fg~! zkapLAhzg*XHV+2fES4#7CY#UW7~cJbZaRB=d5 zPC`veO-4;lO+l69lmvMQos6D34ryebESoM4nF#5r8K@bllKD*>#&SPo)=ri# zu3$809CF2>KpYCjAryzhH1AS#$044X1~m^gFEt-kM#&$C)~~+46H)0( z66HItl36qk#TY71EkPB(WE{S5xYFABE)HeL-&4y{%jszOIHZ~uJH8d;P$>?Twcj)j zRWw(PL$x?mk3$VQ4X8D#wc=1a4t2=&s8XtK9P+VdeeKkmW;7%>qBhoklQ`5o5Zm4! z(~M?uXs-PhghedUIu70A&?D~u@pKkYQXFj;-b-+2++DC`8<$|gfp+koo^+%RAd^K%BAr|gxNp#l5p2gu_F z9HhwnhYUDOKSCZ=`7z4UG1>{0oHXDR{WN(-D8T8}Pyas}VLMUK;Sq zfCNVTV#I3$-Wc%FfKT#@9;>w;t0gR;y*1#S0V48vPx(N0l%HJ5$zT3aFzWv(eBma1 zCBKp1$sgoTQp#eC7{cw6|M$svX%ZTd$cUsyBr_s0=aHHuMl2eu#qrBgd&g?YnWr`) zjS(s6Dall1jJnI%-LYC)Ch16-$3QU}VWOB-ZZRUkxc`noyAd^*JB)A|f0?%sexjv1Ari6KBMq zYOS&wkEb%5fxZafGkE9G@_6!m+s|N_Oo#P7^Y8c~XJ!>^U5lq1WKGODcXqR@ZqP~Q08@8~NU@dpbkk=2Z- zOsPUvC1q?yei^K~5u3Q&nnu(zqP7urjCeav>tMu%aayOJadnNTXGDG3Ek^uhL`x$Y zaE7L8o`yy=qBmAa6L~IpNorY2GltELXrX#9@T0|6Y_>I`HRW%zjjEA1@c+=;k?mD3 z*UU^aUh8N?CpiwsYw})2*wu(`Mr=1?hY{V4=wZZ$@!A?AdK%Hoh>=E&G9trxO@5o! z+X(qqTOZEW*NA>b^j9+vF=7CHAUR0ogN-OV{=YpuREDd3xDg}h&DcBIh%szV9j}e0 z%rs&aWtL^frgOf_PX^2tU_q4!lwnP$Xv)jPwee=H_Ls(cw`IeBan&;RsQ z1$i+LDUhoJ>18a~Ol~2!lG}_p#Vy)t#4b59jW}S$ZX@=vcb`%Jy~&I5+Fm14PSE5> zK+y^MY=tIh2aPzynqCvM!$usTpCP~G(rb>=j~Q{Ca)LZbo+72@v>dUV@GO&aSB$u7#7|iz6RsI?-H1=}VsvUZjJRpUBQ@&x@3FUxxXtDrS-MC2 zmwwlXd$MV7V(zo~fP6^GnjCx+Go5R)af0^Ph$r$-fDzBw`-Xf@z93(cuSgmDT3$!V z^-X@u}U=|9Lyr~Z5I3KO!J^mA+i6Miuvp$UoD zw2_HTNM%B56Oyo*luSk@CsU9zJSAo3m=YnQsxrOg9Gg)knJAe} zkb6?faCsD(sKuF}nUK|lY$p6+LM0Qjn~=kVA|@1NSx)j-6LL{OW#;KSQy$HudVy?33)S1wguj%_M~JPI%RR!{n9$aQ z5lsFup`8gsO&DfEdz1Y1KRGZUVx-WQaYt>Mw}U%8JSdXW;0@y zXE9@?s?2JJ{A5q2mB)h5vDsOZgUm_hB6E{@NU6+AIW$@O)r|aR6ks#|41JPcZpIcg z;~X#6D$U=_sAoofGm5aLs2Rm5#m%TnDM9{jMoCI3GfGor?48M488gb7QI5$UWO>zF zL3Syc)@9%l5U^ip|mGrmvMXX|T5KQsC>pL{27 z^2gW#^nt2!kQvoE{}3~VnlX&|a9Ib2b4Kfvj4)#)^HJnzGX5*~W2a~15nwGagLQWg5pWC8wJ)gEEtxZ^kUjY*LmxhccI( zXO^2u>w9kjn+wTBZN^PAZke&ijJ;;; zGh@FQXUsUu-UDQfsoFuxA@Z;pM<_>S?@^AC$4Obe6K3S)I-Fv1TIJQ{R-se1b7ovJ z>zC7%%Jb~HKwdN>^-%paep%IDG2^Q8YjOsV=WD8VLnU&@uG?m8o~pfJa)-Pti_Wdj ze9w&g@>DW>XvR}Bp2?>`Y(63%lT!Ia)`x5RTqUpNlt_Q6l2@|FSYw!`PyW`7ckIeK zO?xj#PA<**I#wuMpO}9$Ze<0mD?g2qYofw1W3e|aRJ z{9-{ul_attvGODoxkYSp3sP7RwIIC(DJ@84!A;Kp`as;!X=}EXYmILrR#}f_(H}$^2xF>6&!aovz7{!WR5y!J6q>F$?-n z*NTv7teSXH`nc)ZvFY0N_i?{lP|||E7VP6Hm9n6-1zjvCZ9y3e%34s)g7y}4u;78r zY(aes{ssyq^> z@UozR1r04|BnJ|gRd|M0V}>Rl-8W&G%+SVyrWQ0~vpM;f1uZCxHtXk;mh@I+Yf{3$ zE$G4d+cNn_*QJ?a!BiHECns1ikur&#OzLaGYyMBOU=EY%DxX1_NzSrh zHYN8=eQ(UQV4el@nJgwHTp%w!<%=wk`%O!@gvnBsx8y}3R#>o+$w~`WS+H95u9xGJ zzLs34^0xeLzy>zu?tz;`=$pwM7HpwxC1s)8DBCTl%e9qcCzD;|ZgP+8rIz}(?6=^6 z1zD}gX2n4{Iapw}!eZ4=P=_rzWx;6+j&R6P3yxWE;(gq4*}ZZw%+$nB$a7jvm$5T7 zNzPbs)`BM%JhkAQ1?Mfe%ds-s1q-gxFRJ8{1()ep$g3(}HB-Azzd_z4Z;`i2neC3O zmD;*{7Tj0)0}CF~|0N%({IQ&HD(Kt$%!20@z={M`{GC*LVZkfbh`+Sp(M(O`wFPe& zz9m1A?<{yv`9R84A1N`jw9hg*{i_8(DBo1gcMIIJ^yU6kNsJXanMn8x_j7V95>g~d zL`iH#5=v5)C$plW8kNF|l+06Ek(!dm3Iiprs!wM{Yt|c8VzOeen!##?%?dla>_N?8 zh0}_>v08|U%L<+w^&yis(BJnj=#8T3evRxS{8Ocm! zW>UTanuQ`YaTLvpJ!(C(TT#`DYF6Zson}QYD{@=$n-xW@$YVwPRp9bkabuSDWNmCd zHP5eB6At?0#O8!Osc(SNOmHnva=O(b03keOuCWX$sVevryRFjb1Ca>MIV*-wW6Q${*(c7#IkZl zIc>14@N8|O6+^5T%HCn*7%PTTMvx=PQKZa2+KThMy4qMK_RJqMQdq`typ5kQWmTxWet~Ev0V8ID^@CBWyMZz`x=$3wPKy}^;T@4Uyt9D z^quk&o}+EHVv7}9RpoXowke;?D>Uw~;)~kVByJW>>Hm_K5Up8=#cGZe&Os-pTlX8QsHc5Zqa*Hl<+lo8%yDGV7#q$FCYCllP zLo3d5Lmo4EYsEV&p3t9?&&cQG3-TrTij=8dTk%GDuV=CEt@t2&(u%KEd}N+{u9kkT zzR*u>ezxKTm-x+!?@ZFz@Ph&y64>;APk&kwLn+FEztEGB(woqRM9LG}kVJV>8_w3! z7nEEjDQrkdPo9>wK*Tr6<`-_4c+Q z{wocAney@WmpluSj0d^#?W3vrgNMmq-a`^3&rhY+fa=*>GL;-mu}Cn*Wv!w^e?}hP%q|*>GRE z{7UX$`Umon4Ugqjyg)w^o-lbTyWNK8^jG8y@+H}bl~Vkg%{Sy*8{SbQe{Vw{)_i30 zN#&pAShC?On==<^-zeWz?++V(Dvz;ahg!0E-+mXVKl)CNF)26OVNt%}ON@>FZh@A1q2{#1 zWyfnf-q_)`!(&H%JN~r8YlqK{JZhAml7S4^5ws&@N0`kc@BTXyB5X$ONKcWqiY(Nh zf{b=#vLmw{v33+46&q)VM#&;vs7WF<^%iPbIVu~OoyMJb zxQrcT*_8REtAbtsDPMIv(k#*{GXF!3szj-5M-@s{l~j*3phml*VKevZ)=->}YOB3pS;!4dpMgCE3c3)~fe! zJNnMmzac4)ws!o(ydBwI)pVc~U!--Wbg`qW9a-dK>iMzVm^9=X$_(A@=%GgSr1Y|* zH>D5RSM~O@LvFS%Lk8M0$d281>|xhnI~Llp$c`a)47FpJ9mD0>v}2APBkUN-nq?DX zM^VPxF@ZALjxm(6oMgvj)jNeUmF%`in@*WQ&Lm}qS$2%)*3D%y zU*+>CtJt-`j-!;tcKo|Y+bL)1#o7`(ma=A<9c%1ZYsYdnSEw0Q+OdkhS|zc(c>X#$ z!!ud0@(p%uq;FEm|LkboP(LcRFxg6OBe$!X9Td5O$1XdP{EYK2)`WZQ*e5H=uKji# zu;YPUzgg-*I}X`#*N%JaI&8-UJ1*LBL^jQiV+>D|ve4spoS>gn$tgPuFV@%Rj7rYh zaZdSpO1;I}C6!#aBKj+Cm-HrOGnE7K+mK`qBxf^)s!ti;yF^P(NkgVpz3C|aOR+|km?&n_ zLRv|i0|B|09AEnm2b>J0>2knL_mE!FNBT*r2{=$}iT;esqqiAh2O{i>I*{3cSbBOg zg98~UnMkQ`$bnfLD9R+x0nLG|4rFtnfU3z($>Tr{N=`DD>doyy4^EPoNj~yd)tlcT z*JIJwt)NN@IZ&AXn@Wl}FpV=5V^Z9K5)S;XddoUcl3t1|t@1JsZ0D$Q4wPqD!GTJY zimK)h%EcvGWtCKM;5A3dDphx&t^@TPsKMTv4*gd3wdl3UI%-tzM5s@1;lN)G{7G-1 zdK*$2k&PW_qVlE=G*jN(0e`0do}-owTRHSU$)#MXEgc@)n#tc}8?vnf|4?K-+d0r) zc@nw*qXV7gnRO!8i7pOwb>OfAM;z$pKz9cgIj~rs5!Ux1d#bU$9O$h)<5I1!1N|K6 z@4x_t6C4;w8ScOc${=#E14Af7Nm-v^lrl^8%^67_?Z7D2+jyxqhCY@Yr}FU*#1EP1 zz$6DIJ21t8xvF=n12gH<$muGd;XqF=Xcm*%Dxc%PMCP&%^BkD3@&%NI4s24rOB`6` zz-kAUvTK<`|4Hw1hkiT1734}XQCK^>R9oY~T9)l{V4a$ClLPDN8&tAU)|S_M`JV%u z8EzrBkz2{POSSEk9pp|@);9I$nB5NSVKe?>m3tl7r+W80aDaYLC5IfaEYo-OQ3sC6 z(JO1~z;OpoIP~v5-gV%lsys(I<-lpm8S*TdlQW!m-~yW$$?FbWqFg4gkXK1r+%*T{ zFM4x>NkA?E;lM5WZB=te4!kq^Y3H5;_ZdDQpUOFz@~^6VM0xDM6O~+i81sz&oP0sP zBwvv-t^8&Gtpo2INbf`jCz>COeJ|%~ClWgGLH-GF;FGHS?!af|UmW;K|E3c8p6Uz2Zal=M~{E6D<0$v+Ll zv}8Ib465Gf#1K|moUk$skTxgW6g%l4outg^a_ZMv67ewcl0MbzcVdZJdeDgw^Dr4v zHBrj`Wm-l`Ci2cQ?b|ZBCqkBLb+s%`#5qyRiP}!oT^Fl4k=uzpPGof=o2=?`ExQvr zoM^pV%eh>uAmj|W$b$S~V_qlnIZ?ogf=>ME#Ng#xekb-X*A^|;{^Esa$HZuboVdSS z`<}$v5uc7 zh*xr=D)Y)tRBp*2f7B-*M;}j4ASImW z#4)bJ6ep%S;mHYaPE2!Rx)a4RqIgF6@;PS8Q4vJ3AZ9r++lljDT<~I!6LaNxabtiR z^PHIPL=6{ey0E~Bg-+aX;-(Xe)KWG$u~=RpPAp}zj$B4AcVY!)rEDWb*6JZwX|)q; zRI=8I_{(XoXR;-WzQ;B?ft9*!lF*6GPHd4q#)30WY;$6}69=3)$Yck(o80NdE{co8 zWrjU$?sZ}xWj`r-Oa8>*5Sz!HIIQv`l%uluR8s0w%nABQ@)UVm^_Ke-bJmG-viF!= zRrv)cF48ZNmsNg6UcYMHt}(n$%1;SyIdR*GTrT8x;f@n`op89|bm@n|J=PdqxbMUR zCmzbd>BKiDzB7O1#7ie$Iq{gyC*)J|87VV7r@WA}5SRYii8o9>kZ+xMM~T0zgw(%h zb8p|+j}%EhQ9e8IMI~RI=&H8m2g9T;{B$D51#q=x)Gw3-xdmd}M>UC8f30VXMX z=;r}>6m+4GnxU`@gE&Kdxeb{M<(L<9p|}fG7sQQOtk;*2r7$n4MwN1*G`$R2R^@A+ z#*}xVf(sRyY+j|sY}7xs`@@Aws;06FRg_nCp_=mQF3jed)N-M=3lClRmtA#S7$__0 zLR}Z?F{$suwN+Yk7ygt5jnx{c85&X=k&RtwLTO4iBV|oG$@f29_{)WsF0^u?n+x4t zXsvqNy70I1HZE-89i0DR(vECTc5tDi3!Ug)NSV2_3-7r8;$2-xxtfQQAxjSy^m3u6 z3pPWRkVg~tR-^h*`jY*~{^S4`Hec3v{$Lk|xX@#bcGrcWE(~+wpbLjw81BLd7dE=E z$%T z4EjuR7CD=gndi6=;g*WecVP+h1un$jJ$9iBi&W)e7YeJ&r7kREzFhULaG?%+S20KA%|gmHbS8Aq%b5SNod_-`V^@ z{v;)j;nf+b)zGTlQT&{rX*9Tn$(mDYqhj)q;tcda=RNw zx`{Na+~S5+xlNYH&wm_DoTQ6f!{vJEem4Sc_}n3-8=CU0Zp5t9dvmyvlVL?Nmm9yjk)NKM z%;QF0N^E1#y_g2og3}x`M&5M#*SL2ty!m?UZ=fSr*&rD#f`3RbaSISo4wrVp~lAF zuB#`T@>e+--kaWs>`V3|Q?J(sx-m$$+Jm|t40dCP9Jd~rJQ(W6FgKpN@xqPaZj504 zIX6bSF-qQtyD{I5(Qb@kK2@H$?*ILZKh}+La>%XM525jHOklx8auO-|WXcpbim_}O zo6}YA3^!)dXOXkXIjVOqrT%(tfg20mIO4`pHx{|E*o__RT0*XNV~rb2>B~r2?sCcs zH&&`-mFz&SgY>SIP#$cqW5IfIgBu$uQnSg8DJH;2H1b8kV{W|Ua*wn31bLD?MV=~3^da}@|B?^Lhop2hWWgggAG`5{@>KOcbE7{CUNU)0z9L_fZ^(1}%I-Ti-n;R^ zjgNAI^}yi4ybanXId6OPz51DzB46D2>c%%WzN-Wt{Gk6-NsI@(x!eRC`wJ;!z2Eeg zSRxM+dyvF~q|8&Q-eevmr>9WK#pf}pl&7Yo@gS{AuFC3d(99dPo{6()8#S{B77wa= zP>lsv54;}uJg|9S_rRe>c|35^T`F;VkUOaFXL*#|sQH;^B?BJ(`6Djq!9R(#5R_NkgT6zyMu$hs}M9ORhzv~B8ESp(8h@)s^kB#~gvw4u6%^V)&^Wax{P7iWX za+6Y)$Ai4|e*E=oetHQHey0@hpdh7?2ZbrWc~Fc}gp?VIdN7$wEUprHFDiLS4@!Gb zhG8kP-QbwAs-~hmkMCm2c~G871(i?u9`gsi5?NX0RXi9H{clfJ_n?-_Yj{wTzJ}{i zTjg=`%^wfyd$3CuB)i&!6C1V89(3`bf$Ufh8nN;(Ql5gw9yFmhC7Y4W$rhw+(UXl@ z;!Rph4_bN9+JnD6XyZXA*)yB;6>H0~j^sZcw4<~qJCIUSg5TEgZPH}Ov}{^e54w5K zoxQa=Nhh+02R%LL^2@L&r6$1zaNKa?^^{uQ7M zQF#sCK5rPC!#xc$2V+(5ILi3=<|b_tWx5A5D3fLBl&R!2QnvB= z=a`ww=Xo%TKAW7Q^0^+I<#OjUS)lTT9xS52WbaZBmU*z0$XTHLNl^!JGk6c!H zuv$Vjc8v$?=xbFX*N0h8-#~6u`6kL$Ug%@92V2cKIOTzdg0 z*eqqoNy-`76_isRoTkX-Ol9mjy2xb@&eJcD7gc^q4i7HniU(IcxTf+O9$Z&0H8+*t z^5FFd{X{gGqwaZdpIv4z9(eFjPMcmN_2OR-9(nMcU5`C@;=$AZX^A&$Pd#|%!6)X= zJ$T{4TQzh1*Xmw+@QTT6mA~;|6PNXl$$RpH>iy`!DfWI=$rlg4(!Y`MHwBgz{=w!? z4`RH47YV%j=|vuiz4%3WLP{bp{G0W?w}`j9+L=&G=0)wzT5>Ps=E4OxYbjWk(u-7- z)TEJ2<3(CZI#MPvc+s1)iJKVC*sNK+XmlXf>V?eqc#)A|CQ|Z$mg*;edBif2W}IvwJ*yYFDA~yD zWDYNKQtCa8k%tV-&1N1lFDap{TYfJJcu~iTx?b$stQGX45_=1IQP_*$=%rPC5ig2* zQH;&vWC^mu&zRp;O-V0GDgXE}ri}8kUX-JkCo8DDBIOS+?r_gnR(TalRk9jc-HRHO znq)0fwxYHd^^54oKs_d%z33u|7k{$ZfNbtXLrNo3iW_^;M0ry$nkkpB;kEGMFE(4s zo>zG*FIp@A+lw~J+j{YXYu-*J?I|6+=%|uTUMwoCuVGg&x_L3xi)mhT_o9avL%kU0 zMNd}tBYVj~=tUnjwl5|AvB8TOUd;4jmKU>G zwo*R-rz|1odNI$7`SeBP0#asP=tY`O`hmSzCGyq%rSxUwa+R;}q8(REidT8Dn)w=X zt*Tk)#c0-S^kS12d%V~yU8;9GWiz>j-0HH7%b$OcP9PY&kN^CyZ=?;}tejT%Bt9E>==Jw$+SJJ~SFXGLwX;|`B2`6 z3_fJ^A)gPw`jClbQjm?3*@sw47L~{OpefJl)2|gH#q!ARLk=HuvMZMlxhY;QOM3J8 zkXMbG^*JU#y{Hexd?-LKNERXslfRKNwule;)jY)+mLW@!zxz;h-GojBniK2-9dvK(DLROP_hK2)RBQu9>zp@#CBK1@|>BAZr6 z<#m0ir@X!on^jFiA6hVPqAyr3=~1hpv=vWOuR$DMNbt5O+g=66MjGVIQ)u5B*e4 ze;=B+(B~iI!(bm4seFhJQ)IXJFw}=(42P2=d?>;78Oi1-A4XHgkmGz9OOXlV-`9=z zVFHth?89m{<)Q~`C~JLK z=fip*Hn90WdFp-GNZ%Bn$k!~lYg_2M$gSiyayuz2v%`m-%HzLZz1xR9KI~<ouXh#_y^WnG;Cww@`<{ckS`EZ(k!-q4JOXOMd94TvZ z-iHgyFZvMOp+Do7nOq^SlGjwtbvZus>oxMY$?%pBw^eTu4!`TeJtp_b2joNYUsA@( zvL5^J#D}LoJd=R=%CpAsBOo@v z$PvqFzx(h*j(k5fzuxRz15kA!|C@*^>mbYv1glKPR1o{CIP zrXXd`lzyD$vQjfiqw=(V9OkP@Y7BlDRsL*;W>#+T!|I2PO}ifsl_%b*IhDI8ZqmO~ z^HO|%b22ln|NGk1$1+8}TDbPp^^;e*I2%(v^uxW|hbKkwy8J7cp7=$mU01 zKl=HR-H#l86!W9FA36Q_awaa9AGuk)ThBepK42A8950_}!0&el+sqZ3;ap=|?F)O0)70DWjAj%aY~D@_tmH$dHQi#PRPM zl~q!MQpJy|lxk#k)hi2?Q8oRjaba#tgCA3QCe~(|Ma5)n?u=b>_-#7{*C1x zel+!?8N2==oBPp{BJ;QK<1gj&Ik1%G(H+Th?Rr=7(yB9 z$1p#J(?^pd$dRP1=O{lcyY%O443n`cA4f^-(I!$B$?I{KHp!34eoXOWsviqfyD@Y8n9F1yIbZdjz8$krx%|Cju^&tPSn9_zKjOM+Q+H|0*}F;T z#|l4I`mu`1I&w9+hLmNk^eT&vJ*`V@`ax`*FH#6BmZc)8k{n(~_yBx`^+{t7Y zxm)$_@uMeu_xo|ckE{V?3*ew1hx|wzK)L`9`*FmNyMEmB#E++b zd|(*=W7ubYJon=TlQ-l`@)aqIe(lG8e(wF2$vc(5rxe_+Z_7veC-SqLpj6FQiu@G) zhaW%XtR6s;0Ad0_0KWu~FaS?0t>$hmK>+P{Yw{SgTT2wsPXg0d#jWJbavSTU0mR?Z zI%NRzgZ*RyBxg+uQi|h;qzXWaQ!`AXh8O}c2H=(j1z-xm9DpN$G3#P`Cdp!9r7Zv} z^#>3LAX5OD0|*8X3LwI+ux!^J z?UbhP7J2yhXi?_r$qZyhGA4~)6HAW^AeJ}W%o0GMJzAYTnifE^7)`?MZMEzH9 z1_3l--jHlWHdd9z-^Vmn-i*?mY!N_I_PJp<@PImbQLmp(jz5dmzS7uS!?{^WoF z22uu*gUKP}P*PTYnCu76Gm^>J0LBF{iawegqbhG@*3$0P#s@Hk$pn>83}6y{G8wm5 z->XyU)5z%o%m^Sc-^s_ni;#lZvMcs#y91cRnz;eY3t)Z#3j){}z$S(Z16V8vhl&_cLWU~I;RpHwHkNI|Ta{yapPts+$ z)W~BSMc#<+pzI`fk@6Xr6zmD00e@?`H-LQs>}S`30FF}*l2UevayWn^l%py?7QiXq z{ZML7Fgz)V>OCF68Twh3G?^NEA%KekqzNKz5SIeD9Kgc>{te(t09RRdJAi8eTo2%8 z0JoUjkmYiF$L-Zt?A0F94|UYn|BjmZF6AD1KY$06_;1WU3gB@7DTDexc@n@=b|nkq zSpd)FJiJfy?$cfb@G^j}0eoZcEAj*RntUV28|57-Q@xiJPWay|@gu`e0en`yUjmrU z`~OPicUcOTF8(8cpR9>t0+lBSLjFK61@cH3L?Y&i$t0>KX%H()=}Sx=MEnKQQn0Jm z*O*kQCUp?`_USe0n0SKl24M(7E>~4!pJoig6oi>wmLSIN)7*4x5KUrW3&PH(gLINI zl`DvLoKxzrX48B@_=CtAM7AITK?H-y9EAMIausVrYE(Fg2tBHj^g(2xXH-e1p#DXD zSww6QNA_u1n8%Tts*(G$We*}p5P6t9B z$^}tAh+09^4x&O36@#c5#Jz=ae{lX9WF@k)T4I$Tsw%G*M0L9S6hhYFboZEi`?U&u zmg@vjH;87cvR)8X_G=yYYxRSW?`izWyaCyeY(zFDn~+UOnbw5I#?fmQ(0T?jFo;1x^kUMR>_he?`;q-gS=Io`aV~Cf5Tn=}qI!o0F^oQ(9HH`& zvS~hjAC6YZ7|K}ET}T@r#DpLwvMDzpxK&!4q$(!|F@-*roTl>WLBy|yOgocd{4eq6 z1hG4aJweP3VqOsQgLurf-5$h(AQlF(D2T;UAH-&kS`x&{AXd?r2C?&y>uS)P(!WBsUS`>KSQ2X zHRpopsA?`SyhvUO;xgrms=O-CJ1egTaf9K_ARejSTS43o;!Y5EnLHrxsowiREaljT zD)~2vgG?SXc|zVkp#3G zWe(36Hxo-?EfA!P`|Ll_Z4st{7Mw@e6WLP#4zF*ehYp%B6$7(y_zX(C-Am?^Rp zO9)owHi|t2hf16w`MsOI&Tb|im3t|^5d4&Y%7Y;cW_=`tXb9Ou$Pq&N5Hf_2ErfXo zwT!AV6UEb8%S?$Sv#8#<5HxyLm84n}yX~M>p^=s|gj^vMReA0Z3MtPMLSA~l5Pl6I zKm8NeM>e5A2nAK;4Tgn7_>D;smCJ|QrbAkmL;5BcXILVH-&Jo(`B#8mS|y88qihJ} zLMVAiE6=cP2o*x87{VVRR0^Rb!^&j65bB3egH8;ZXt9Jp$GFpA@rok7WJd_3ZXZpkIMUo61vAe{u*@luxBh3t_rSW`uBqTQ^H3pAKnrl`oKeMW3&dpLb#xDqj@B;t-aE zur!2aA*@#Ua>`0_1^Hr8>?+kOmsFLtS`)%rCh^S;A;@j8ZiQe=g^eL>k}me12;pQ1 zo5ibYTSC|x!nP2$hj56!GS3cqcIZ1*vMYq$%J<0Y{jk0`dF%^eKl1~s_n^FrRqtVj zN64cg98)#N<$!0+DV1Cb;WYh>O3sFGj((oJpz@0$wBp#yA++Z`iLQijRrOvA;X3_> zN^XWQlJ&PkxD&!%Iq5ako~qt^A>3E~AcTj?|D`-4ABXUSvWoLO3*ji`IYaq1^s5kF z%YF#sKp1aAcpE~qFq(()E`;|X3Sksvz2kUX zxiAXR3y1Mr7)8|lCBrBhhP+cM#-un|LiPS0#yPe0Qel*4UWP2IYMvj_cD#;x@6;-W z@kbbynO7n+zmAcsI&_NB&fShpdQ{&nRn@3!VN?$z{tK%$!l)TWtuShbQHKQ$!>CJX zK-MGclQPMlVKkngKNs@olv8WOys_$S5=K*c3x1;BB8L>MC}qsTGj=rH8%maNiPHph|D z?8QY)2xBH?QW%p*#7<`K6jd{oA~jM!Ba9_sES35&W-*cPmdp-g$5CyLs-GLiJo|aFphRWc&ZXvhZkYI3?nWAErM5Jyq2?ZL_YxD$m)e*k6;#e*E>0` z!uS!!d-*4T!#|Rr!kC><-*2DQoL|EDs{ETAqW^#AUpcEskR*Z_;m#Q2>zxtCYwaiG=gRkG-p%FB001c%KwU>CA}3n zjBB;OpH)i10{X%T7Eu%K`bO=G;0T-hNl6aK66uFjayWtnC-t>G%H$Y%oIIgwPRe<} z^xyRZPe*Wu`C0NDd7f<7SfA&Tyx1f76v5{Ru0(J(f}3(UMQ|;m|1keLE2YeC)^0=~ zzcY=$9r^7D?nLk?g2!@-xD$Iff`8?uw^ZMXdmM6~d_X>w^JEcySvTj$`A%w2EjAB(3tD{&G#o;K9M6p(0Us3FeVs{kl|BtD+fR^I; zy1wtm-3b!h?pV*%xS|Q}E+IgW1W2$1cY+f%xCeKaKOWpAxVyW%eWy3n^Sx`$+Ur;Q zoH|`yEqCrrPd78y>-^R6SVLa>#nJw{cue3pH^}K?rLj@_o8qxq^A-WUzT4ulL;Kt1 zIOYEuJL&AA?xyb1IdUEBe)3W69Eit3&4=P~n0!P#|HVVTE|hsV7LVicIHCPh@i?jZ zBnNXk9%tyB)&4m-3@4g%cp)Aa<8dh-mu2r_^a}O1oEzhDRp(!e$92s&;&GFFOFQ=D zxU2bLJnoV2Yv(~cUT_$X;_;Z~6Y5iHL%9ot&U`MJnqS5v&C#!W&TE=);_+5T-^odG zzB&Gn@>b+_T>Mc53qCRWIUaEq^JFMD^B>vI7zdTWf`k?%q8W~Jc3Na!@>J%iN=hfK z1?enEMovzZXbKBbl2cJrQ`1nteCwT_T*!iW3o=-c(Slz%+DsOVy&sp^f^RIyVnJ35 z3Nlk_X0sqSIXm@RY7S~ns^sLdpg-&6p_7-IkD6cS6tLj^|IBrlm;Ae7vA}A9Pe*MQ z*fq-yHzdcwra^U5T~uX(n;9Ry&CqBI#_7Ie%*!+FwuDV8KT1Y?960(cC5aaOwYA zu+@TX7RYak4_jb+U~HE|z=EARf1d@r$h)a~sC#v^GcTy#&*lLO4iXOOsNDPa2y3<) zrKIvP?VlqYr=FmmwBVGEp0?nO=Cg#E$JBZ4tQ-_~$%4xke6}FYYEJbP3m#bT(1NSX zxn{w2!VT&j3vLo_Q6>Mj1^@TFjJq`NS#Y25f1j{Dvf$;vu8$TxwxGgpxM zGFuU{B5cJsR%EfF)Nxh7imX;-vm&RiliiAM$#Q#M>6JtKRZ=6D=G<1~(VW+ceB}I8 zgUc#tMIkHVtr%8adFWfLuv%f$y_{CqH9M>@G#~40F4Sd((vI7ThOFt;j*sBCBA}h1 z6@T(cAJR8MbH+jQ)Db1etSC(A%sR!aC~n15E1p?V!iw*#_`{0!R(x+oNh|7E@dJ}f zSy7cxnp(z+vV?M0R3en8R-jg-$`WhdHY#hbBHNT72#8;eW_4-}YE5b_D{2$!P$jc2 zL3NL-Z^e&RG_j&7onrFw6rmxt5%ni(W9pYNG$Tu$=2rYn{zW_T%xm#mSkcmoU#<8} z`@a)fQCm~nP}^G3jv&339anoedmXIkXvKCbc39ELiq2L{v0|zfU99M8#Q-Y?vP(DW zu-vLUp$D}mwU-sWt>{DUNBxs3OX(}c`TbFU?Z~~C2U&6TxEiLN!Bz|*|3w|D{Sm#@ za4SYwF_O+W>L}{p)X~&2R9V(onON@O!sBU9piZ=6lFpe-NN~d3C#PAl%8J!;l=WBB zt@y`^8CJ}+VwM$4b^dHC7HFPBm}|v6?aY_4@qY3P=`7OzV!{$Da&tk;*j!Fsp>tLe zYUjrq!rrsy?!8t=|7XQIE7n`FfzB4{M(QS=v)PKqAI(2f^7_|`t=iv42%k_p31_W1 zN7!Y>ZY%a!u~$wSos4}n1(x+Q_LC1-anOoGRvfnC6dkF2#EN599Jk^>I!CRLS1aDZ zK%ytCIH`SUmg42{r|F#070U9X^7B^Qvf{QC7p%C*&?PHw%FfnWUDlabWXB+1qh8nk z4W>zbNv?H5-OYyytU$;6(1RTFAL&Quv zs)P~~n)7iv$;hc~NKQyWO-W5f{c@g3Lzcd232pg9;|%0XHq1YvGLmG`#)d3x z=CL6!A*&792vQ-t4d0S;P;*jq>1b{n$BI7Hsm;|q}kAhMvVSsLt{df^X5!8 zAvdK;vzZM)YyO20I;mRP@T(2~u=$$}t!x--!!TJR8~V$0%1)}DGUk)2jSX#WXvehQ zshz2R*wCKPf!dKO%jzV_ToK_eG`mXWld78y-E~e68x}LCmkqsbICS3CM;6NHpEk&| z#`;qGQKk8@x;Zlgm@rW0kT94!geuX$Y}l`tJKTox^hek*k}yh^-qW~tQvJ>5XzCd1 zSgKSQCkL;7_ddafiS#Gw=w#Va?V8cQi&WeW zBzZmklhh41Y_wsM4Vz`-o>KC*e~S(O+OW%p-Avdj!ys&U;&y1>DLXJL@3CR8 z4ac>=&xXUA_uFuQd{8@wY*vELYu;-LYK3Iv~w&9MP=9vJF?kP*p4E0 zWVhp6h9cA))Q}xH?Z{uDV&?M=MBK z)~~FcT6R>iqpBTyX1gv7Q`NLzolt{XlPXWjt8GUeJLz`4L$<3)vs7l>+S&2h zjyMN?x8o1lMeUerM|(Ru*fGS8zu2Xt9o_8cZbv6JJKNF!k@=>yiyd8c&Btlb!;YSI z4AxFBLT{@4mO=9S*zu>1_9gVA_P1jIVW5r=;fSK^;jQ zB`ZZ3ZN~(H^cq7LYsWb4jJIRSzOSD(O|;{PUdm)Urs$lhc1+Ve-Hv}W56_5McFeY8 zuO0jB_;4+5jve#tm~Y2i=E$>k&hU>{zXN!*jl+v}2>LU>Be^D<5zOdx}K!RAXlUJ=$#F&dmzuk8?hBYXZ?^_KjO z`kwm1j*kS%`9v6ZR>6S;4zzNhwF3zqNaR3a2Z}h5*nuPtq;(*j!(3caYHDgS2a*$3 zomD9uNJ*BQR1WOtwo5~&8=M>FxY9e2!2!Di4hJ$ikja7E4&-s*#95Wufm{yQ&Z%#7 zg)9zaC1-OWy93{9KiN5zLvv0C9&;(uvE(_G*MWxfU6m)PLJs6}Aiq>DWWHoP1so`- zd!@V@7f-fOt+HG~i*qXQr+JDt9B?||rRj3u{4&Giz|3<>IdC(Dl9$_oe&Oe6EsyR@desKp%I#7ySg8H2U-xDOc z1Alm4+JOpm%4ol={1>3PyyNS)W)^KUr{&YOG47zf7E97mnuz<3z|d7=YT36rRjJlTOMniCaL z(=<_QG4VRP=6QOS=P9XP5pkIBi6 zH_eb-;B#r_^T-JlFpHmvJx2uN-(ycq3MDt5RsEa!Rv)Dg&wMr1^jRbma5~ z8eUKtr~(-YnG9ss&Nl|SUQiOs%KU7)!q^KchYZhvVZdo1m-g)ja?3624CJL#ka~H! zD<2`hfdYh5!_0}5S0OgzsTQhLKJ+3;^h=tQzH+*>v+dVnMQ>SgbfriP*m3InNg;P5n+B*FC}K6ux5ECi~QW9)^?+q zc8VJ)q4_%l-;+yfr<8#v%ghxiOQ)KF>ITZ`Xn6w_$Q89y$v|at741|tu#an3!@$)U zuDbMV>S!%OZ3A_*bNzy zH}KlP8v`v2v^22Wz#ap?8u-n?Y6ELzk228Oz*Ga%474%O)<8!CoeX5^VYD;wyMY;N zT?_ZPit$3(KUlmywS$2(Y0SN`vwR{@ZFY<;M_>0Y<)L~TVJ1PlAlE)etXJC}}|0aw! zFh)D)6Pw4*cmosuA7>(Y5_Pinrx^Gnk-4U+dB54|^#7sGFfh}=ECaI*EY?-KnFy2*oa{y|M$#8Q8#O1N#jeFmTSmc>@Ox z9AeH0ZqvHd!v>BR_|L#mhE7wDQDuq84V)mK)XpiHTXvM_8JcGe$i45RDX$B3E>f3X zR7WnFcL5Urih)-&uNt^UxNe|gBj+OnH`u&MmCRcPZX3A6=3N61w11CqU(PmsPTxcA z=YD0rQG9IR37x0fe`er0`Gs~~8o1Aq`;wbG(pv-X4pF64D0pZHF!b0WVJ z1)ON@L>ngxI#I}pl1`LjuXw8435zV+2^*U-fWJ9-yAuvN2GvP*=^W+69sc9&q2qO8 z*(K$3!tX?YPE01ji6A+odxZ%RC!&P^^eh!|;yXG;sl}+psWP4tPCU|?-_uNfS(PS~ zb)p=hj1zy|HfOKA6BV3jK(nF~m7F-7Q~l^fWjeK}Rj86&l~9dZ-H967uSv)=z^F~A zBRc@09#w9M_5-0lRqDv&CnklW9`iQY~Ob7DBnK2G#^VgUJ1C;IBleuT{Vl)Pj- z1GPWMiNWL{)W5Vpl<;DrF+zsKKS?7A9flaAbk5&SjMhBHiLsi;$-c@NkOeioth!!S z6P=iNSsfT>Zs;ja%ynWOlc!RrQKvickFGGoiJ9bC)Y;mftx`evvvRX!1PF+Ej3M-vhMP5x^qy4o`Oy|9r);qC5j#(FSxUiAYb55LhVv`e_ zo!H`pyjR~Z>cqcJY;|IruCT|6?c^QW+3CbC@^0ysrjyUljouf`1BS^BWg1nBid4hV9Do>e|UZ>gjjPzCNEH_8X4(fsv7o8}ZR3&iX zk`tGi4;QXDan*^}PP}pAnslUppL&CO%ZZzW()>8$Hu(Ya_np8 znG=u6PpD6||E1J(CtlEbsr^?@wC!)M+FR|!xy(NS@0@r~=L7X4^^?x|?8HmG*U1ly zGF~zF^Mo!Wav`w`Nm#*oMI|LjD3c4xTuAOh3OZ@EpVEa?#5(o-|& zXhs*(=zTIX&2Ok#s99aerZcmwNR}t*a#A}yU^~65^%D+bPT)XA7PwcW_}o}Xu4hSxZoxGs3EGK z8lVPU7{c+Ce`anAdCB|L^s8Ml7mB)2%!R^CD?*j%tShRx3ng5rq@8V7)ORj?&t^#% zD!B0OiYn#8#VbmlOi`MC85hbD%2CTxrP`)}svp@9nxU8wFt z4HxP&r=|~J4^@p^_{oJoTxjn?V;7px z|J8-2vcw~<4#)Y=zcG~$}CMSWp zb{(|SkudYB>ZF~{giTjfHy66Q@S_I}Jm}#u{G-rI2H-*+g}MrTT=>(4_bz;J zp|1=5TsYvuK^OYFFu;YGF3fUapbLXsn8LDyWfK!7yHIki>n|5ZvpJMHj4Hz$P8i|B zNWv)X|Lwv#uKO4|V_kTCRmp3d3*$9UaABh6NiIywYbHp|r^n4bYN`wAuc>M5KHY_X zbmbYYuOEBPrZdll`7X>M&(%4S`C35|&YyQ&&(| zQe_OQw~eCu!Fjdx}DmRm3NYN zQKkEC7xs|%Quk?pzibZXA9CTa3vXO_bxj>{;Xfw4bm6EA$6UB9r)xPm3{b~iI3>q5 z`GgB6ctCilqmNwpa=6L5KXKtH{b$tYI_HH8%io)G`-+a- zq4YJOPzm*x^B`04&V>xumHWE-=)xx#iYOFS=85sMoW>PWD8#WT4hRXT2^A7)KQSSR zLQ?G{Q}~q7ERs?ol|sDyq(C9HLK=mf3b_=1d19nh$f}S{A)W4(ULk`*Mukk;$)b>% z{Ec=Vq%g~-@T=@}lHM?`_cy*J=b--IRkFF+y!t#Y4?%k6RmexqPc1+#sH24x%3nA4 zSgV3f!LJZdXnI}QtBFD@a#Mw73O|#j{%^8ZXl}01g4|L&zY;RuFz5f} z)40|OeV>@;mNp7)8EQxUo%#n=qD?cQ1G%GiIuSZ6bkR;%g>IVV|B)UFJ=yefS-r@; z<*$IkpRyldt&LHi}6N@U{Q1S8z7=>XpCsT)0M=6ZZnIjbj z@f~3E8|rU`(F$V}#>ygYs7cHb7{}&#>I8*}gqb%~<~%CQk7A}M)V}SSs_-vIK8+nO z-%v9YX3BPSqm~=96lTj2?FQVKqcB&=v)Qp!VIGqgQs+};9TyN1+*FISvzU9SS=Yb}3v^xU8^SVUNOTowHZr5P2VUzxEF(9MmkgQ9VpPqVON# zsKN=tF`aWQ^>=d58C-CXK!+hzI1PyPbF|8p&Ma0B5ovdBe5HX+dLH~p(b}D1tF;$$=sMU zMRnk;9GDZj4=Mq;VrHVdrM^-UTbmsB~_mXWtCe%+!q3Ow{wdHuW1f zval%&&FV%r&Dq_kGTdCpoOBAhA>Xj)($U;*-G_+2KY9COh45xuM)}yU`=8M&D8%=Ey&Tb*3n<&iA?DCkLoOYDh=rpUtQnF*nM) zQNfMEZq$2h{;@9QMiDn|UNVX@vzQyj-6)}Zm2~4f^7qqDgSs+KHwL*e*o`0DsP9HE zH+sAAqZ_b6I=?lc4YjQs?X>^98{?SVUOOG!=t%D5MrT47YF9Vn_%1~%cXOjV z%^p;7db+Wkb>iQ~$;IS-wEw3YecfMg-QUlR{`3dv=s?1u+iHj#f4T9>jn{4rbz_(t z|GKf&jp1&LaAOP8M!GS|jrDG9aN}<`M!PXn=EsdOa)2;limVG^GIcz40(Bx)#yLs$ zNnWcjoHaY9YJZv=)5-s6XNDVhxJI+-EOcX${1wpAxo*rO&)3cZH?FhtVmiy+SmDMJ z9bHOTMwR!OD+z0;tEj7~GOAn&u~zf{+*n8c^6}TOa%y2YbIWd|xrw@2<{`6rZb^8@ z3~h5`yBo*cIL_$4qs9(5cDk{P&4bk4)IC(`vX`)ry5EfhgxS;0Hw=e#&S5u>kpH6| z)&AA&I6=PP#zi+yl27UAX~G#d&JxaP|GdoYRCBbK+_+5hi5pi4H{H19##Qn)oqyep z8=BufjJvJ*0pX4tcM12jf8ULzN6qoe>!BNu=s(uctb}`L$WH#2nnU|JJ;+6_&SgopydDg_qpURZd61t_fLf4Rh#F6od<)@V zE@jh>-2;aQh6heMZmNr_bk3KBdOYxINA{(F2SE?2dr-rJ5dE?ql=C1=j!>i2m|+k9&%0aV4??;=ue}HKiPvRgHXw(t}kVtoC4y2M0V@w$t20)_So0O9cWeK07Q+mH~(Su7Kl<}gh z7nj-VqX(ZnxZ=T853bR9JJ7iA!FBQt>P@PYy5+%b@*V13>OCF(Jv|Juj#y@zSYrpg!dkNAk^e~efFT;Jr(B#yymnU6;%Q+ z5_%EzBIHFPFA{t4trt1GNaDpXcKODOq+TRresV9;5~ObmLP{@E5mIYEjTe_5ng?$> zFVfS@K$Sb?ikZ=iOgb~O%;#Eji^waB7g@ER&5P`sm)=u3$+Md%j~BVT$n8ZQI)%K5 z_ad*(%;!aZasllW^vYF*=GK&#g{I+!m0+XVb*96Md(3pwaZ#0yx(NyIo29&DAJy+g zfG}u?848n&cu|xPp+>!k5hS57K~^o#eHCW4VqO&2(GrC3y!f6_l3GefOB1TzSLM7Y z@5MMT#(Po0i;7+h@?tQfmAq(5sO&|RFZo{7^`Z@zRn3d)G-V_;yr@a8MXjySe4VikEcbq#f` zj{c93=z-dxovmJMByXZ_rf#ABOHH`SJWI%HM@H=MVy72%e5mWgE-!Y=3Cf2AKJ4*g zFO%=fTzRqIi<4fQ^5OtZ>3fh6c^7wxa9GX{57ZGI{m+Y|nvW5VQ%_J`@8V8-QTTy6 z%Vy;Zac92xMbtTh)IaaV1urhjIZaMhG;et!i@V~*O*XIU%xhj;*L*{cuLocEC`pz& zw;8%ay-U4EE%Pw$ffotEho_u~@!kjRJ3K78XtVjq(Dkety`teJ1HO6o&0I!o!K z@F69eseGuH4rQL3n=-WzX=tXUrlY2(N;Cr@BQ=u`2U#bJ4_WC{_8}X=@WJUrb|1cF zGY7Sx4><|Be8}xX9)fB7(!AWu$_8@LT457+r42qS$MMfh9$qkZx}i@9Tr z^I^OX%jK|oq$c<<(TCa0nM9qg^C$Z-g*=ryP5ajL=E3`q4>Rb@q|VY&c{1Z1ALjZn zPdkfzm``3nU8w!)>9Lr+L_13f%jERSpK8idR`{?|M_2iyS9n|;{g!@uOM)Sc9AK5Qq*vUbSHC)d|A=PsJNeJGd7T-kj-?DyfU5At;5 z13Ld0;h+zPv~$>pBjo?IbJT|p{6)rbIwz;*2e~D}d+mH6EPbRt z`S4i|)eO$jsa2fc9E`l+M*__W35lp56RV`!PftkZM{++>kW>1RhLDPynkv;+XF*!c z=?KSP8yWoA_ef>*Ba3?BZuakgxil) z9zXK>F{m&G7e+om^84Y9z!yOQKMMM>EQsYn6!Ih9k8}Z~55VGw)sGH-bo9gKhux2c zel+sK;fLWz)Q^}SP8JVPU4AG(++;h{_E>pjDSim}s9kd^VY$L5KA{RSCnO_z zY;LJAn-M>DadQ{;qlh0r(k$vnF+b{%i~CW+kI|1+EkEQFt?y`dc&xtnqog0D{3z{5 zWk0I;QHCL@T#-(tT0s`UMOR`|GV4B8UoKOxs-0?t>VDMFPEDDsp5}mS`^}Hh zmONIXW?v@MqyFGWeZpSWZ=m}=daQo(qcNLps7+*6$EaWYC|h1NrPIuhpLKqV4MuZv z3)zL9s7jMnOE!P?<2RktiqM)WZ;ade(aw+Gb+kR<4?p^MGzXdQiOMiQb@HRLAItq% z;YSxgy81EBkMVwV^P{`Wtsi6j=)sP?{OIjRPqN$@EMZaAhdhKT1^@J;FS#GJKXm|g zAaxK`G6xfiJW+qiDnC&}wLi>{;hIPIF_Jt=JAV_pJW=DGsO3-8SU(OvQ3t1e{d+gT zkAM7_!JLVHO!8wgd5RympQtYvP)(&X&5!AX|GS^qOh0D(F~^Tt^ksxatZJ?wiJz)v zeoV}1PS-p?=IiJJKNgY~X=kw?OEfQ)gX^i;MLJ&jL9LVnQx0A~_WQA#IUD@gD9gGZ zx5h75daJcxI#SnB*ZaTTzgLPBeX2Im+)Ul#$G?7TCGVhaqi&~4{+mm2J2mej?Dk_1 zVK24LC-d#}0hv8NPWo|*<{>$g5Dxp15bB5=`}{)xKbl9W$Nc~Q9oSCDG01g1?Z+8E zUi$IMkF$Q9^W%XZ5B)gr#|1y`u;WGQWvVRt65&hzD}G${6t@ zQye1zr;fS;P@3I@jvWkN0H2s*F+rMrQ(9pQ&&Fr2{AvKqP=@05M&m zL;!`!MW{u!Uo3#)cd2|rRBP#Xs1 z3tw~0jRR;BK<5Cu1kf~qt+BM z&_95|%!14fc29Ya>6#*=KuFeKneEs`-mRTI0i=Cl&dh!~M+5kt%>w}()H#O&I7~jGo&N%`F-?+>$u9ju zb$g*sFnUswpDTHdd!bgmP^Vs~S1;5VhSI)N=L5JPC#4{=2XQfgOY}bna5;c00lW?1 zot%7b7*_+h6~JwoYQ4nkgd5bGROd@|M^15DjQasR2;eSRn)d>b`w0jZkcFBxh!=YN-v;4$rQ}xO@<5*)L0ouiq5JbH8y+K%lu(D~RI)kti98`lU>-ahsTx3OcQ$0FbN`@rQ{|dsdoj?#l za!5Pjp!wiVNt2tnHhHBA2T>%58bQ=#LQ(4XL3DqmiUmfLT< zK8OxMbY$NixLlSQo_l zAQFd=B!mq?Yz*Q)^BcTYn`DjFyUqr&IfyMZ{|#by5PO2y%H}recIpo5PO2VP zo#%o$FXtRN`3E5v;$98n5~Eji&gCz_H)fJ>Er{zu+|bdxLEI$YqTbg29XWP5hI`s6 z|JHaA#KRyS1@Tx;$eiIPjLL5<_rF$8$fNH`3RYL`>%o_6biu= zg8Gslf=vcYwot89xgmgqAj>ic@_ZjBVHhaS=v32wRl)~uuj=Ga$(=poQ8R>EA=IW* zhgzRnH-vfwDgFZ?#~bw{p@H@r5<+j(Pa!l8p-Bi$>HJ1*7Q!z&^XCw1zA?wyoK6ev zw+!J|&9x_(39UkCO{XpM+lBCZ2;D;HPV*0HCu)0Y2Wm&EJbbe=LF#k~p{wQ*Z&Z&E zdWJA6gug@RMZbRt148Ic?nC`k=l3P_3z?TmNGW*@q%$;xL4?87AykR}6~a=Eb{L)E z)Db#5lCYl%qeGa$rZ)~_2xCJSM;K3)Y7OQ2FXTzo$)uQLYS|40pZ3QwJ3zeAuN$qptGL3EQHlMb9o3W z$Sbw8DujvK%*Cytv-XRxqw7K_$iZx&vyr-qx>@IZb0bd1`L7%fZ|dKNB7+u!anlz2uB> zjC`Ehz-Jae$zIa&R0vnvD1kGKo(J92ms)W+CQ@6=?sCTu$F^hT-!ov_=hww&r^0(?y2rol;#e~PyC)B4Q zJk!0N6JCTMx0sgVEg@wXsR*gHpC*hf{F{-4mI*n+$W6#e%|%V~&Ybf+VaStl z^3usi%}V{D-jOOo@ zD~w1O(J+**<|cTkUaF7krv|9OFhT@bdN_;$T)J>9jN)OG2&1r$79kW3qZr}KpEJq) zE{yNPC`ohrJ5?%-(&SoUlp#n?Wf}88qih)E2*TyVs6ei$ol0S>f2Sl=Mfa*2Mm2JE z?bHaPCi#ROXKgm?P#?cjKZH>~jK(_u$1oa&k^a4EK&K(KMJ{tUlh;pStl@tIP3Y$y zXKtOJ!}ukPj$w3?S=Dvg$hIc8r2b0%O-EZ1T2tk#leUC*Vf-G3=e=1|UVqSRA4Ug) zIC61!*$R)Q~X#3S(#(>((2?m?N;@z1q&4kztGq<6ao|!}vRl(P8WiV^H!&n-|vM?ruF)@rKvJ>8ln-s>5_Ga3Oh-&RI;zb}{Y^qq4rsWiQgv6@-=YUjSjX z_Sb~5_6uugT^KESGhwN)A&iamH|gkR!WL@A4{BQ&=}s9t!Z=jb+=AP~aD7l0kGhU- zGMjSY@$N8=GkH%KdkOof$Ef?M2f{c=I7F3>hr>9c`9H$ZFv@=Ty8pY1!L9D7l@~xiHQ%bSsPty3TdNMd~H$W$KkMt`cOq*TT5VkDYI5=O!WT zE%S}^?J(}Jd6)X-3aAHRJd~4R1X&_@L_b9YDI<6s#*;9f(s>ca%P^jipHt;`D^l=P z7`;BIgpseu;Oj8ngz+|vcg&H5&tbeLf1rNU{wH>n1bM|p09Ht#>kRxHmx!ELJ4pyh zsmZ9xBgn-k%Z!|7*epmzGc{FerXi$_ARQq+H3KyxH4`;6Rq_{?Raqm*#-=NR>=Aq$ zLBR+LMUW$csUK8MSsbJ1cN?2Os0$xd?g;Wk@acn+?_Q-s-U#yPYWd|`V9oMO^YSx| z_y`;k7&I+ZE7cZ(osfnz)105XI_XHwFK;kZ1nvktG<)z`owsice*}RDcE!w@4@MA* zV0RRIq6kM2kzq#>A4N2RSOot>Fe8G(5fq8ww+LFv8hunnBWT2e#UdykL5T>yi=bIA zqhSQ!)2~V`89}KCN=Hy8g7S1^alQ=ZLd!-_PCEs7^Qa0DRHRdhT3JV{$nZXzQ&cU2 z>NIOm>r!h{Yf)=QP=_GNLzAMO<{t?4sXs>0fFN5z(&Sy7JP@JUNA*(#jU#9hLD4a$ z-&FT)M);Zf3$=L!EeI{ClKd;7{YTY0f;JKKk6=IqZ6jzGL7xczjNtbO{$Nh;2u6KW z?IY;ANp+8)Lj)b^ccO0Ky>L56(1p#e)NWK+O0zq0Jv8?u^!k#J6Xnx77jcUEM$nID zR(}2_y>j;E`~L_AMa&0*?P1#B2!=52uLwrUkRlk$rsNMJ45yBu-nnJ`t)mko7)>6d zow0;*5scT)gb1#2DN=0`&B@d$av%_<>CEX7d|>9x2xdi)CW^FC%#L7=_z`@JU~UBS zBKS9gt?V*Cf&~#QB+K8{MTBoZssBZ=ID#b+EY+1)6P87=TstcWDBsH1otdzcLaNwwle~`7-kn) zcC)>N!x0>bU>|uu^#JuC^$=Cc%EQ_Ji{L1mS0gwU!SM(#uz7-dhI*2EiYmQMM^KZa zI!ouA_RmMqp1$NRsxD^h%t2 zGVPsAc&K~5l)nOU@@I2D%RV7Lr9PuRkKhI2mLAnBHeW~ZhVYj9jw)k*A3?&;=4{LB zQv@lZNEtQHA)h0NBY-MSf+!MdP83DrD3U~xlumN(CySy;uCLV|&nx+v1q$rnWiLar!sN0E`7Df;!viJ95_CWFxEsE?>d>cg$?c|K2uwIM0 zpH&|Ed86n~vsGDhNKLl8@<&mCA-Q`)^1H5rQLN5sf+Y%T6uqM89fd6lJ99ck;fTT@ zSB=8?r6bi9g(A44C`Rx^;f=y4Q*>WNqUbPK3HYN3&=C$s5h91RGyb!Zv}hDD<_i}l z6rmQCu`!`I>&y5{MDZQ@d+n5rqLk*+Q5?}TP&SHkQQTv*d=wRQPDMhcC@K@GX#en~ zxN1>UkD^8tHKS-8MUyCM>FAG9)Q+M~6m_*zFN!bU*8QNJ`ccT&b~4BY+G!X?Bl1t$ zNgU^H8bvcUTSf7+_FEEup*D}Ah4%BtxuxK*QT#?H#%Aj%+C>T_P9arcxlEQ$ubjlKibUS^JB zbV(FTqxd_D(NT<%5k54=MKL~#vE^nJ%DTJv} z%ppvRVmjfUC}t97P-P}d-HV&0c{U*l+;a)@sPlDnK@VxR1yG1QG=e-sDgtP(@U7!F2pD2f*{X)JO$ zigSb`QT#_ZD(A5T=9MiX*x*c~%^IbW3qqr}}R1^& zTbi<E3qIexeni$f?@J7yT3EZC;eJgtipY!rAiuZIrP(M0-Nlq0*YMnEkLtVbbNJnQ& z0(W}C$e_v;L*^JPF<4{xhGyOv^2LyaoRyj_2KgaFcJjAW8BdNFa%#>MLvGD^V&*@~ zl8`@!3klq>61WQz3dGEN1&C89hWHrLB{ZkemeBovmtkXHZw$T|>|{p_Mhs4}i~8j{ zIu(QDyXi=G4?!G%41pM`#!xMWU<{!cipTJAwGn1QVQNJ8iV|YfG6~&9v|p4^ECw;9 zc!?OM{-VB%;d}ZeV<=B3MJ-L0v@$W2)m$!y7VIm21)3G9m13x@bE?Gf7jvq|P$Pz# zG1Q9T)Mi)z`{rNjP)7~hCpJ+CYVP8Ub6KYdxGwRROU#ODMoFG^Hwv1sq53yfk_>C1>QKe>ULYo-c z${5n9cG~|vhNb+hwL=UYW9S+~w-`FLl_+z!!Vg!ayed+I6Q_C zG0cxap4m4thEcLXW0)4h-!Xhxs3tLUG<6JBZk{k!_EPeA>IAARZlcUKmpfTIQ(_p- z8)Vgts_8Mzla7hp|1dg(I+Hp}=g%h0q0Wt=JF5-sV_5l4X#xEeG#AIPCWf^!ERpGr zVf+7#WicF04VGTY$E743tzs%IoJ#vI5${;mE|tDl zKhl$#klch%iTIp|FHB(4pGzDm(mR!wte;^j7m?pRQkam^gj6QTi;!7O$Yw%nR;D4- znvl+f^lI6Rlnmr=!}Wce$%M?RHw$G;W@M-2AnklXET;*%OvufoAeo2EOXefMhG~u_;hDu~*vI<$%gld%PfVuw5JRwT_(6qXl}xfT+m}e(1ef)i&AS|CO#AVlmPi#NIz4; zCLBtwmFtu6y$KQK5=JR8vZe{&QEHL3$vUJ|)-_??P5p;LJ(GT``T8a_FyRN)+suT9 z${U%`Sa}mlQ&L|4l*Q$q{K6I{bTpxp2`$;xO4YYEp$)w)*-qs@$sSPNfpTnkTxSy= zr`D(OFD9%QVf>kS7qY7f-6-A39;8(EG@+OB-X>f(aYA_{Sp&e^4fyFp)Az<+6$?CQM~>nhA4Em`k5-!VJnxQp#qTFk5-} zW86Fw=CirNgawqvRr_3DX4@zJOeJQz2<;y9ylE#%PS!Kd%6V|Y~mRx7TYhDA_ zs~Y(Wcaqn*F{w#zBL5;co3Mqlm6R>tX2N#*=~oHzWl6hC*logpCcHCYj|qECxM{*I z7VI7@HN$2`Su@I+QJr1o$%>?`v4R-}(#tKJRq&4V&Mpni^&#DmPKgW?0NH=EhmOan~$;r`ehN&2Uhhq>GeZ zH^oDGNncV|ZDSxwZKSX3U^S*>qJllXClAoP=}Cn9Jq@avnL~3>iOZ6-iuZMpFG^GnSaK z+l)PCEHz^p>$jM(+>8}wtT$tW87s|LWyV@|ttMqfYySTOu4A4wxb$vh^Do&6W^DRD zT~e@FjUc|&jBRFYXR?#r@qc<{oLy`t4ZGKjgJv9JvX9(v#sNywb2)6r5i?GkamI|J z%#WLKg4=nF&o^nDlV<#F#woQ2B$UPFA##>WT`=RK8RyJ6|9|$I6kKBOWizf&r2eWB z*;ILyUSPOx#tk{jF8uDoO*3wpvCE0wPTV%*j_gt=RyuK)bK{K}Z_T);=E;3C{x#!) z84t~PWX22TkIi^Oc}_kx;~AwduQ@Zxr2o9g%z0_XD>Gi3u_fsz7x|wV@67nojuv*j zH{*kBvlZ8@_-Mu_Gx}RFz=F?ad@&=31vxE=}a`7JP6VCGTxDTu~-mfVzt0Vv6C*+K|0BId&tJ_1$Vs7&f)wK^A>3{m5n~3p!I;SkTgfR`k{uOyg0IvNlZG zTF{R26WN~ZKuS$V3*_dsB0pQuMFweQ>}5e$)!UQO&4TVK=|S1f3;3~a`ZMay)Xg25J?v*5f1Lo66-!4eCWvVNEalP#EH!EiQ5Sgw91Z zeI_}JoJ~sCXWqtht_AZ{GM}=*f`uyi(}G3H7gL_Xc>P1%GWszKmRqnw&XIYBl@_eB zV6{xkp}Og)Fkmg56B^sC=&l)~)(M+;71Fh6l-`xo*bd{sPC zo|7*(y=3zf`O1RV7QCUqwctJFKT_8C&H{O3w#WySe3YrK?zHyVf-lVD`0PMRarMV> z$*o9XMM@^A$yBO$OEILOrzO*o=~Zw4oM@d+8=6kbWJP8xvRIMTic;*&M&4X+$Y(`% zRiDF(ob+5|ZZePR&1=QkH2U2~^IK7XVL>a3Qwph?!jvLb6r~hXxqR(l33^GDJmK4Y zOIuM!C1tHBM=wuSAPuUwd~q19(5whs5n))-3X>IPD=Mj)%2rgNcRFXNYK5?x71b%< zkl&IuNa;rxm@d_*E|BR=ni?>CFLuA^VVh$$n&iasVkK z474Isdi@$Qn8|1>##k}LilJ5vQ#CUk#^K6GSTR!hC@X$bF5kX7){5WRoJx+fVuBT? z{xpndGwFY7e=wOyP9i6hQZ|JW&yAU8#dIrXaKV}6TymBbvnjH{bFA>Pcpj7aDqlcp zkzQM5#bWw-E0)M!N{-Dkg{)X=#WLp0tyo7{LCTmbDXXklOGaw^R$Q0U%7#TY+_2)N71eC0Zo@4rZgZ$O8}3+fm;Tv`dsf_+-@~oQpVs)V6%XXX zl0o}m#Y45;my}0VJf=J$pOVkW=cGJ~7goGc`{WhF*W?@WE%~1n?ZAfWDDjSO1^b=Mdscpz^ zLjjc(v|%I1EUc0uHWXD}%%;DCS2nnW4XGy^N~*jRrL+w}zGt=lGGjR#s;b`dlnOQ& zY>1~P*ie~bB;}0}GG;|mq>^myGJP#on4IADyd=M|;aeN}+0fsH8a5=_5V0X@gUJT7 z4K~(WY>@9;wAwJ)X%xwlQ7e~G^JUZzlidb~4NektjSJF4 zDhb=roC8X4%!WobG`69p4Zmj8=4aHtv!Rv^wQZ=w`X6jqy2ntL{ykZbtWU}a4P+*C z(4TKZCdc_-$R;*4m9;QwX2W)_F6-;KI?wdintrsQ1-n|>@Ut4Hl?|C{Fw}-&vRiBzWW!*!4RW`}8;cSw{D{*KoBr9ZW&MrAZ5Uz0EE{IqFw&-f z_0kv{|gQZGlby?f{X`#}g!6 zY{L>8p4sqR4z~@*%24Ms;3oaC4Nv5!fDO0h;<-gXM)J60 z!(CN*k8?lZ)zayke9!2aZZO6A9wx}J&*jt>G z-V%0{R9?!CgZ%37dYQG(nYD7vXLZtNLV0=xI}DU~J1S8UNF%9{Qe08C^Mk(X%1o+| zRaI{_JJxCXnBUq_!;T;9XlO^G9VR=1b}Y@TnOP}M*=@(sy+(^2R<*3n4!d#(#c792 zC4&Kv9bPtlb_7)Jx1$JO)=v7ZGGs^Cj))xxx*2P+CQ8OseND=Dq`X;iligU`jyiUT z)FrtojcJ#2LryafQm|({rvbT#Ed)qP4j$iHgg=KxzvVHC7r@X%% z1C&26ib2XpPzIAj>=;TJMh+)s?M3)|%Sbjy+3}klqh*G(IgT8wDu1^_zV1*K8LyIh zALAz4G0BcqcC5BzvK>?GSjgU~muAP-c>|>{!nK_|IXb6wjs1lXa%e*^c#W zZcz0bMU-!{qb^65r@Y0Eohsi-*=EOfmF%$NXH~gNt~Si~sNTJl30brQDmf-+G5rvE zm^`9-k5blhz~gqDQ29wa{#HIW9ZuVEB#U;&F8_MNIXlkVQJderG9qpK;-Q8+S+ol* zzG%lK%4N0e6+5oduc_o8JJMv;r{YaJZpo=($6Y&0F_G}L9X9$sJMPOR+JQ_C{j&M5 z9UnNt13Mm49+Cgq@z{bph*2Q%5yuOF4SkyOEzDTugN#0biI{p4%hfjCGRQj zqWEaXCwg?U@v|LY=y4AGkyTrnRlalz$+&IF9Y{k-L8c^AkurX22YPe-v`o^G=~ZtA z2i7jvf9hps@+gnd#2>X;*p$zkWOpEk15F)h=0Hvdayd}ifie!{b|8-fMOl{Dq2GnF z5M5rP%;$hGzXJs*;sqV}E{#z{R#e!5A`Zx(Gsm)O@^zfWxKwenghRjQOi8*_mU8HC zWJ>~ z@QnlCI#7e5jZ9R_njA1Iw@|DO{L8&+SGl}^GQC*1ASK})N`N?^SY|{d&mEGkHq>8G+_RN>TO7A zleu{N=;Ab|wIM9{S&4KQe3@nhE9uD+mBHoLVkWKr=fj;!6TaA4w z{ZvhpY#69~kORLemp5~E%cc!>KsdyKp%n394h&Z=zebLdx#~a)CsH~wS|*qSCms0P zfw2z!?!Yn!mOo7x=fHRe7OIgaI55$HNpjw)WL!3FvIA4toa4Y$io8#3MK*03eY&cg z;lND#EONHW8x_M``aE(zxqwW1CGbzW?2|fkzJ1oohJbz-{)P zb>N%>=jqqU8S@Mm9Jr{Ky+pa}z!l0>@|x=XN6wTV^qDV@8*-+|Er7^dazN;_>OSRP@&Q@ADjqxVM9vWhKFEcRVX^GmTgo#Bo;&cuftPH)B9rbZ{hBUo zc_Wul-eo#5yY`<0!gmhT&#raLu6=ai6U&l0^|Su717952bV1+dKeB5gaZbGnr~Wx9 zk>pPNQotyWdtqZLCsI3Ma3bD`G)|;-qPPW+AhZE3#{nOJxox>b*DQbRy|}uobc!b2*V)mOW|A<3wH#lFy04l>B4?vLIQA zlyT%9l|`H=%I4Im#$qa8>oJz3mvW*sM!Hi2N|n6QH@D;C(KS*=--gv zk~N%2q?kxqUFY|4R^@IdY;-&6Af2k$CA+=e*E!~qr^8#?`ke?k(aMR|EDJjIyZ+X8 zA|(5n6Ef^XM2!%2B1W%Cey8$U6ccwy9VhBK@ja7zWHYk96AhgB!HI@!%9b~FqLK27 zFXNghZ<!at)#UMQ&AFwb_X)IkopWwXMu$v>ds#?aFshc9L2yeTVOHB9#lNUHS&^bz+|r z`<*!8#6c%+I&sU1Lrxra;-nLQbEzXv9G8QVOFJqPK9|-hmv&61(}o1O&MeBMosh+I zX*Y9er<^#=dbyX{87DsF(uTD$UUlLu{Tz9oyg*99MJF!NFOyePo;SC?>@_F;ky+8k zD39xu8%{J^uQzWyamR@-PQKV6Zs^Q zFt>IrxAxhIHLMYTkXuWcM+5hE>21bjE+luMcpiO(6bw_6(wsRkE{zLm+3ey%Iv3Kr z;Bvw3LIxKyx=_xA@-Ad@A+rnlT`1r}78kO*kkf@+F4UT2$mW7AkM;}V<)=(`7jn4t zA2;$SUDBAF!{$@#%Hu*_7n*W2?%y`ZH}($7qs`Bw6=cEoJX#@2VR_q?yuzP4zK9D& zT@aB+G1-3QB}C|@$kHk=Ln-Tme3_IiQo#j-3kfb5Ic&TONFSdmuXa9<_9Bm_xlqxC z8ZIQtbIhw%a^YJS+V>L>37rvpi%&SS66kmB}Fu7pn_yz5- zxa4cjjPk!=n+sODG|zW34#}(8U2wP{;v{FM&_j=`#f2YSXy}5^1-}d5$u4yvzyYH! z#9Rov5OU#z-xzjbOJ40tUQImW!i&F+bMtC7<>(AIZtrQ#nNRzeSCcQHuI)k{7h2@g z8pspOryudUF8vo6{j&qI@qH5Nxlo_d@tiT3Piwd}q51QKMlLjVp|uNbTxcR||Ig6E zg_d%#TxjOP{36C=8Mj&Whz zSc5djxiDU~ur_+u#snAskQMn5_F_6c?t-pFJKVcreX{=`O5uW4#+Q zT$m|`#*H7`nB~H3nKN$K+?eCSTsgno$mPa7+4(N~W1R~dnXe}|sG6Hee~P-WiOFB& zW^#+F+3JG)Cqf3<;lfTi`&`fp=)>-E;h?J7P1)nZUdldlzv?|87ZWaWNF|3|IHLTh z3&)fvdlGlTg_AD)&E&KTXIwZ%4{?OEs`3)$9C_Y_3o5@T6PuNnnOq^Ss@`jIdb0P1 z%xV`ty6}lzx8#g-;iU_=UAV*Kt_zPS_sIL?zvKf__P|3I=5VyfOrDTW$!DtOxeJ?F zvwErFl?(qd7k}-7@Qn*^DdXQJJm079s=XpHK5=bMdxlxf)iL6Y@>Z-U= zSuItaVWJz~P`)K=s7m=ikx99kVj<M^WOE-9!rbfb|Qqum(eMq@XcxY5at&Tcf715w}D){S=Jn-iL`zPTGeQd*EQT1z)t z(OZ*kRK7Adexl3gg5MU@+PkrvJF|lu9hqNc^Jh1@usO_)u4>u7Zgit}S4j^_PqLRA zy(zz_-ac+*DfIRD_H&~@^8w^Q@>g;YIoORMlzHValydK_KD&m~N08DS>BcDfZ{&A; zS#_-Jc{irHG2M-E%sqv)32uy6OO@wl{K4i#a*`X9DO1R)WOJ6yp#SN{BFap1mK(Dv zbI7^mJW{r5z8edaFLYx7$C3NuE|#-wh;fbl94VwNabqcKmZ{3+ZmgiMRLLqgRx5W; zHLT_0n+j<%$Obny%5}qoWFGvF8=Kttq$>Y%W2+n6+}P|!3X^e*OzCfMp4+h9jU8^B zcjJN^J6V6ojl+~(a_H3vd)(Md-$(8z52)UQZoK4ZN0^*+<8L>P(vPW{flB~JFz88^-{IY&xTwy-`uF1m5oje86)xpA3tg}h2$bK@U3uG6LdmK!&e z-*m&rK_tJ;@D3^AeK*<^)}FEXud07Qc}PBT<1yt4`P2=0$T-6aYtP+yA08@UeC2dB^%k;gkW-^;aBc6h4zkE(JG-}dv_jV~&R^FZ#4F7KC4?m-Fd7R=K=;ke-r?OiiZoAT31-{w%Cz@L)$_Etdzm8D=Cid5~GvWbq&?J)26hdyqqU zP7fNK&^K5fc^DS*Ag>3Pxf}B_$xjv_3wrR0U4_|{rR41>MLj6yL2)MKJSa~o;Xz4C zDOFk8gEI88D#=qst3Zzx(F`6`ETT_<_N37R&4bQf{OmfGgS6qwg+=O zsNz9Y52|@k-Gh!Ebn;-h+(^{}uLnL4YA!N->p=}JmFR(qVkRA=#RDtFM#`$~9t`E$ zolIP$TlIQmrR?>45b&TiS0_saWnCV8=RrtShA9y;>OoB9au2jx9@J*Dxd(MTsOv!^ zHoqqukoCy=q>SIaus#`n@Svee8u9jMjXh|>q^ZiAd64QC{ZRg>k`^Acq_=S9!`FjPRhF2lZ|m`mj=@JDWW` z=;^`S)rMYVZ&I4Suvet72mL(g&!q-?u=ulK0DU0&D=8a4$b;S7&qJ6DC5Nfr(f`G5 zobh$Wj`U!Z2Um+|^7zez(aOhA#*)8#AoWrpBTwKUGd%c%GLf9*!DPx5aw;kH(Q`Ik`$p40x%4t5-u*{>sl}K)% zDDRnF;f;MsvAvule7TUE`80yxF{$#0h{h6g)6*yX`d)w|n+1N1#A+3UeR<@-JQcjU=V zILPD>d06!x@jyQOBE9lB#_%|K!h@5lMtg$FO?OfRbSDyqFw+w24V`N;xgK~ly)`!ucyy|fo)C`G*}Mk!8~AWM=`UyAa)s8&`b z@sx62lvhawFAT~T#v?(w(F=`UQ6&jic3A~nb=frr#MKb7jmGb#_ffNiPsAsMV?5eVtSXK&43p{iX03Y)#W=7q|dBvr|(cTJH6PYe78I! zZo@t=_IvTli`Q~-@Zz8sch@BRXFk{3IQ>BU!=T$RfgUu3w(=GJ1`bvcpcV0m#%PJf2C)v}Mh zxI@3|#XXt2e8cK})%!2y0r`-8h`jOQtrwYn z$l}9)Uc8gpGS86FhxcB5U~vYYzVRQuNJ06;@H6>^jAITm87cM2DI>NUQ>rAD52@*8 zJxD`I>q9!#o8E_wQ}ua!b++McF)fqIa~0RJ(hK`ggp!TSPUi3-rw_S&$jxScG7l+3 z<@F(-^21qBfL>4~g?w1bJ1!RWp_mVqe5mY0aUV+fa3Q~ObaAbu52aXa^r5s`s+xww86Ezf2J9}JXu)tlf$O%`ZOIu+L{`o6w5rV0}iS(U6t%4pSn_=f&1SwrQC zNnu+3;$Zf{qH?PbHoBd3sNCs;^V!#{rP~LO%Dq1LeDJdwAcLfQN?k@?Qe2Dp5cOeX z7^A|7$y4y*Tma_-_|At~KA8M4`%&A6IzEi{VT=!TefZvopMB`!!-3*jJs(>6(AtOk zJ~Z&*2M*qnY)CdD8!3Fr3NMRz1@agKap+8c4XcXT6;s(juQA#TG zOK5#5{mA~LY|j8nEpFSd^g*PIFw}=(^pWIna)b}EB^^s>Tlq-`8DW$Uza^D%kg-1e zF6WCMY5W-H!+0NN`Y=nvMTQCT%D=qe@53Lm{dx7hapPs&WFMw*@fki$rA#NKcbX5i z7bG;_r=MIIhZqabKeOTkeS|8^4FxQ89KFsGLOG;?P9~&0RgD5iEGD-#BBxD7Br4OrA?}8lqQ1XQi>wJ)V0$lguh7ap~*dS-U)cA17 zhr>Q>QuVtjfBCSPvc-q3lx^frAGT9uy*qqJ!DqBfB{Q>P4}Gsn_W7`%en2G$eb~qS zEF&CYc#1qq9`oTil*+$-xXqGa_x!&l^M@(n3Vy_FM|mG4yozkW^lz~)CEK2biC zUsO$;AKlgX$ylGe26!xQtAGi7%a{G~o1+uQZe&kc0-;VVA(Z0U#JkANSIRZY;3@BFC6X2_2)B|=8Y7%7`k z(~tVs^+{V>CH4KNL$6DIPu5eth12NsrvaNkkPZE4qH_(r> z)%E08KL)As2UCWSa+{{%eppIrll_FUL5@B;KeVrfc zDYA+Uer#0!Ka@>mwv)y!ezYmAo$%wNA6xy{#(X=u-;W&>8DXa%yXd>gJ>*_;A1O7T zp2Zzdeo$tJ^22@{p&uoWsr3Q`7; zDuC1hq+ybtOiQLyHF0sspgbcbQvf&B{K*nPR)*Qg>|_p7#?Ki*p;}*$RGt9x2O#&3 z&Z~O!1-|~iT_AvhQpvmoS(q$B7A1?3GG=iK%IFigB)wDsr72|sC`&09K=}YF$abF9 z*IuBER=JEO6qiSQK;HJL?;m*>DH>UktQ0_HN)=LS+T4!YcTc~reiOjA0dx-F=KyL1 zkQhKs)|dh?2Vf7t5r8Ftjt33a0BrI*IX^&JkL&GSMjKy7lRv$k0k{M31R(Ar7vDG3 z+-~#+;16KU4t+(w0G1xmMVbMIK{7;!$p{$@AV!f&c~8D9@?8M60;nB89d28T09po6 zH-PWitQSCIN_|r58wBu!@`jW~y z0kjFAExjYzPSyVuKzrpKWRsG8ofVxJHoju)5Py~y4H{6gtN4h*0#r61X!lj_EWA|{K;CFIfomQj|ID@a+z$^ahn z-aD&RvWBuYfF9gY8v@uEz?r08@(8(!{40RX0c;6iE1UZR*hZ0&cLlJWzJuJU@|u3^ zrtcy5s(c^i>TtsW%0coFd6<+j<+qfh0c3g>cT8>G@c>S!-jkHS130CU(*cw#s~^*| zOp+$Rg#a$fNf&}Qgi8Tjme~?SzaXvza5aF>0elJIS^)n9@IHVK0bG}he*jMccp8AS ztadYie>vJMIRs_3+iG2RD0c(6N4c-^Zg-3i=nu(94HcZ#G!==smRo18dAcvL8RJf6p_mGtj`ccMv5evD4B!EqLS`Y^lNGMAaVwg zi(!r+wwKiwEivQ{B2N$rsxog7C4wj!L_Q|@RbGHnFo;4y6b_;Yo5fUbQA#{-9Z)=o zBq^nO%TP)OQFW5O!SX1}q+Af?DHTWqDZTMQ{KI`EZVW;TqGAx0*jqh_Z-S_-Dyztt z^lB=ZmqFiq-?C{5qK3*7gD@#K2ho_Xgj<=|g0KhSP`yq{3f@Z86~q^Ai8lye5DkL( zAqYPUqN+X+ME-JGFo=*!!juTveWNi(sVN&%PWz5ti>w_)ognJc>yzJ;^+mEc8 z<~_+?WN-2pQpV{+=^KasK@14uMG!B87#PH_K^&A>9mJp@1_v=Ch?zkQ3F_~H7|KNo z^VVC#f*2meh#*D=F)0YS>BlJcP9T2^Vl-t8IaY?k*WVw04`Lj{@uY0Yo<4DZ&?l-y z?p`}Nh$(DN4PrWF8Y%w>kVWJnccl={3Suqu*+I++Vy^7uAXYJv-uXc+qc0#Al79xV zh%zpZaWQ2HDfLT(IGN|`&)MY+R|K(A^&aKET^+<4CQsR17sPrwughy2WEb5xY-iU- zVGx^w_>0YL}0r$+#kelRkKH?3VokSth{s70XCEVB0DUH zKsG*zBS9Pu;+U*DUVkFTDV66KH}fs2e+O|YsDFh=JNc&UAkJ`v2jp3~jF^m9gE*(w zaz2O)^o!&r^0Ml^B6DM>ejwy=O|B0?TxZvfAnsCb25~Eh+p0dkymm)c&F;$ zQ$7UoF^Eq=d{%k#5WdjkxFARwAz28%@?U=kP7y*%=BZR~>JXZ;H*E-V1C2d}_3vTK z5JI2wTILY4gy517&V-QA+n6bYN#!+>tRZ9zAx{W-L&zS2d>uoMkp8vWm-ZRNbE=VZ zQF4cnG|BT1G2~-XD1`i!0wFAX9#>G+%g3M!hfpMhqADp7LNVpVDI3abB`KxI(qtJ@ zp6P_jC?7(F5Ue5C7#d{DDe7Zb)yWlExu4p%<#4&za^S{20P7G9N-{5kkul+Jw+HgjRCI_v+86eg&;H zy+#GCS;qKwT()BfohUz%?L+85k@_ASwsQ!*nEb5rE+KTKcO$!#JydVc5GHa#8KF1B z5hLRIhR`pB(IJds(m#X|A&d-R0Gk6t_*KrPWco=oNR2Z%gdxg@hA>R|aLVcm+F`Yp zQA~ad!H`-1(Ka@ORsD=JLzor9?`o-WA&d`U0-Jx3Q^|>Prcfr6viOt`{^iKim`o>U zs9t#=i?ft5r9qn=(*GAZhxuI9JC8D-Tp*{6%I{o_TO7iY5cY%2!F9) zc?fG%x8oXjY$=#>!{Lb%A#Io9A$FkT7aY6!PN zxXthyd4v3iye`YCS6Xf|*__IFha!6*d4J=v-iF05um_{uj?0(cTC=s zA42#@`9va&&lD;95<*;9pYu!j+>_ChlMPo^Q$s+x3R6ykf~GK7&a zj7(u?-YvZ$IIl&oa7FtV#$md&X=R~WgK=izgg^~xh3!~A4{Fbb-g;dkPSgi%zM zir2mgqgWVGe(y}VFp8_15|ol*l%kX-%c$P6lmiB>d>9qz2C@qsQiZHaR#P?A!}!9QZ<*AH*XqSvD#!4!r$3=8w`NNX6jFzjJC*bIf?q)4$R z3>V$4l9YFiUgbWDKa7A%f?-VJTEZ%cP@-gvtV!nPTN>8IYjwh?8%F0aeh%aNFzT_l zbr|)-Xb?tYHc!QCKTsNyNq2c_M1K;mH3?%SKXKfYNwYATQ+^~{kS$4hMy9w%-U(#?&yTg|R~R zY8ca5xgd;YZ4zeCXR5W&qRb9s4rMMmPxa0ZVf5LdZLzlmp z9Q!vx@~vTP3nN(s$s^bv#tu1y!nhg6&M;~T?Az! zSa8|kjNsE*W7!DGMNpn2REnTK*HR$@1Cw|%fi#jDDJ!Zdqw)U*l_RJUK~?67s<#@Y zdIaB4zEydR2&QutrU=XtSXAzySR=5h#2�R?50&_A|I5IAzq_s@FsDM&OIUA3=c4 zFc~C6q%2!5fCxRRl2`=KIdZKCYDds5g6jziL{`%BwLY5ySi-z88rRKwrAKbf}bdolx5z5&5mRz zvNQQ}1YIan*;OvB^Ys&19z7!H8-eVxo}?tbSk_x6lBWGa?-N0D4&F~@$Vfx~2nIwj zkX^qWN`#blrN27BiFT@$qI6%>Xr9ztkOx(s zbX7bY!EIigk411if-4bRm8+SmxlB1p{w=2x<#YsRWFuA0g$T|mKQD8D@7B1el1mZ& zB~#gqOXm{gUQ*YX-;$M5{vofEH^`f0=8Br3q86;E-HG5XlY8W2@_q#WQXY^GNm<1s zIb`bpk53prC957vcpkxv2wtknw-LOezb4 zbrfkRX~}eCdNKnkH5sEA#BIo;l5A0ArT_2e&9k$aBl`98Ai1N+6Gho5%0-b^Eme?` zFN*w>0_5CA#(GbUg`z0TW)ZSP6h$e;$l|1I$@A?l&a)6WVI-&Q)KYbHS|l}X#m@PXkiV0Et!Gek8 zG;&fDlPOcksiZ7*BOj*IXQ*Um6tk4e{p#mNF)xbq6*c|l&rvL3*Rm)UM)7A9OW9nc z>XUZG;wYA=MD7nSYbiQR-@@fltYE&9T%~GcYORf8T@)vy_&bXAQEXsW;WNgKl&w*0 zODZNeMe$csQ(pgxVvF)?FXFaGu|v*2COf0pML873ZpuD#4=LNTmy$QLzJ>dvIH2-_ zl%!ip$R0St=27w(d7PA`PDJs7GfmF-Q&E(uq@9i;VQ=erC(FYKa}gFe7bNtzmxrT6nCQd7{#Y3?nZGhigzryAH~12 zhp)%IW%EH4FDVa6*`!C5$5A|?JSCrz&q=9yAtwbl?3GGhNAZR}ow?Nf$L5Ag+Sy9l z`zSuB%9?)}KS%K;irg{ei6Jfq#PofeflNlGCX>gIf+D>sDXC)mzt^RihRw7wj2>l_ zN4gl&(|4TGn;E5y1y8s!ndw=`tYo$rvQuQJ95Lino{Q3Jg)uM17=so=z8LbyP=HC1 z7>ZH~#!!eNBNV1YM;eP!%Bs9Lr9=!RDW%BLs<(`6WMzF0lw(q!tUwybcv1=yCO-~FBV)!8jFPpv?{FFcp-%(_=U<@JUVM-*1C?%%ynlV(&ssB)@#iX{% z>rm>F-;?#o`Z4`01EgLa4P$5)L-QCKu}hN1lqNAWRf)f{_9ML|*&@mL8(J$>(>jJW z^tNO>@+Y!ADI<5Fd|Ykl9K+8sJd2^nBtw@Ny2h|Qh8;0ilKK5=PPT&Il?dGuQBwY^d)8dew6+(3{c6y7>4n<42ofJ3`3X?Q@ulDn6Hl7 zHp&Qgjf`Ow{)GgbQG7N5=M#`A**KVlDn}l03n1nmjyDIly z0#fkG=m!aqwjR=dMEys_JWjw9#ZL*(63~LJKTm+~YFvBr%LKeiKw2Bp+3;GXAORgM z=w!j$1iVW?DGTB)c%Og|(vSt&Eclp!PYK9i!NT&|XW0c z4PhvoNMb=!3zE@EZb51llY)?vn#zLxrmtnw&^b5Ls3)BT=~cY=-;y&@Gf^{Bvrw~A zzoRA=mm0ELklTVh7UZBWPENuP7UWXSF7`981qJEkqvlt+1yp1q3uf;$dR3TNMW{tB zC`KqwEkP|wl}HnzPHD5*0?h)q1s*!3sZA^>Lnv!OISa~LaJ9Tv-GUl4D^M#^D_KyP zAaz!;psM0(gyiqc_cxf*);8C)pcb9l7SvTSbu5q{ImoLXo%+geU_nE2BMTZ6-jvre zRrtCmG_|0a1m-IF;ifw7Y8Z zTHv$bM+@3n;I|-PK^qmbA}4|tgqUo|n!^@EEQngLyv*0N5woBb16ottFsv9Mhfm-E5{Fw~sY(W^YZvYr-n zv)~dd>~291mX*V-Q5L-{=xsqC3;J3xlzu-8H z7C5YMTCv%JEfyTM;D`lVE!bwkLB?;lU{j*fA?&qa zA7Q`p>wPfZXc|=14k>5f?D(S=9J3&k6`8F#PXCRJxdkUIIBCHt3r<^b%Yxg?I%B~V zRrag}=PWpH!38>(sDG*4ixxaxZ48CH{Ul?Wod0Uw$?iq z+_m7j^6y#jj|GpJyl=q+!b6q&$bvBE<%x2h5-N-|JyXuV7RU|!rRM+Wyr90MzEUx- zEr?Y#diYK@e+yDtF^$O&41m=r{?UR@Onz3SzE}{)tR{EAzK?%nMG`s^pOlb{nw*-# zioUEil@+P2NJBFnH7!+2$$_LNXP|yd&8Tu`KaI;`MOG`yT2ao5X06TNS&_?%+zj~M zifn}J)Ev~D)E}r)|F)#aLoRGZ5i9bN^QqkYRuoWN(27FjHSDvLEowz6I>o5PsU@f- zsS;zd;wa6ob+wX}*UV};z(R)Wi0QGsR)D=J!1$%=Yb)VHEC%^K7y)T-2K)auj% zPrr_NO(ttuQJYYQDwWr@;-Tt!11lQR-_5(UH6k~rHla3^!6Y=dBJpc1sX;D9Y)LbL zYN3j6CD^R6D@V5?X(i)`TvoWPIAq0PD?Cbtj1+HlGR>0KU~2L5D|%Ydi^)NQ&AnB8e=GWs`zoiO71dN*185GU4zfZn z_K|9bFgetUVOIQ=-WZDEs_Y0WMk<#0F;ODXJjaT;isxC;jmNUUiiI>cTCs?*T*WLV zEU{v#a+b+F@|k5T=&ZD2l@+VW>r~7dE7p?bJ74Lfyw+Q>fzH$8{7tor+(g(+-D1U7 zrj8r<_#WgFg%RH(YE?RMxd`>y%t+=50FDuq@^e)l)n|hgg zMa5htoT;SUAly>^O)H*W`Fcj*rg?{Y*NS^8=DrorS^p#Dytd*WD;`_%L^=Nvo?7vY z@UQZpTY+uH=)F+RODkR}F8Vy~jpDb2cd|zjJ}5s)T6`jZrhZX=oXuF$u%Z8LV_K8i z5O+N;xeY07So0}9nGOCMre#axQ`(SJq+wDDj!%yCHe|5jmJPRU z_|}GuHng&#wGEkU$ZSIq8;UYGiw${f7_-up)rL90nZBd>y{ac0A-fGZ2sx=gP;*hG zt=u-Gt!(TVd6kpThWxS^P8o+#z=nd#FGMJ8Lvh9z6R@Fz4HfA(sjQW-p`;Ba8%jxM zDr?&+Ypp74spp#GRSjl>W!%Yl}Q`bX@i}hQzgJ*LkUK@=(v^dkM`T><2v>`+eQzO)<%8l6&W!W}1 zw6$TK4eM?A(S~+5^su2P!+x^iR~vq_p}h@(68M?sFVqgIo{lzjB6p^CQGQn&`mp|P zHpl}eHdN8hR?)hXB{{u{*2{($RkTTr?=8VL$YuL|Z5S`jjW_j^WzVbuHVh>UR5cHh zIVBIFzA0p!Cc|tPZo>!_GscFIPw!-kpUS=8CeUzGuK$@8dxQs=AOGo_7g zFJy8Nbuo1bbt!e3oUQ7&$}8xsv|$xN%C44uK=E1|j`P-k8*JD}^KVfbHrenOlbdbW zLO5cBr;ll?4F{OqX2W(Hc95mceT1FVT{i3{>`}RU<@{3Lgzl%AuBveq2W>c{Vh-ET zsH(B5kIGpuy;A-u8%`)bDSHl|mmy)NZ8$^!EcKjq^YfMV;bsKIdz9~zK!FO!9YeNk?YT9wnhWm0Xc9gT@fejCBC}c-rJ098a zj}4z?DcbPZh9|7#tqo5JFR0I`|5Be*rN#eb@9JZ`|GuR2O8Kt|Z)~{S`|G>&I~(59 zY$KOH5I)-QiSTrxaino}z;29cIy=502qz~bu_LK+k`bilX-;zrJ5n;4ikh05hMJZt zHRQcvya}eaBZD2^+L4j|_tZ=(CNm+69a)w0ogJS)8a>ZuM|L}M*pbtYe9Zkp#pJdl zm*Q(xkVkP|=@lOWo}W$u>1kmim!if~%~XwA znktq_rJw?D)x!_I9*Y@ju$pJ9(*I)wJKMY3=M-JxuQZpsixBerC)sc61Tm>`R}x-r)i?U-c8bUS89Om%It9i6LdzuVEYhuKkGtC_jf z6xlQ~mzrwFG=lIS1bG75Ogo08FSVh%HrtL_c8sg8g##*Vdi?6hN-9qa5^ zZ^srpw%W15j?^`@pgiEu4*99iMj5Lirjb`oo9yVG+bplm1i2O7%T4jyWIfl=cG$7q z4oUu2*4!|=xn2!T%-weEvEzsxN2LZk_Std3j)QVW)X*m0GVPbysi7^qAK$)!c}5NG zkPP^z_{}vm;lpx7bK?b$*>T*CQ+AkYYA5VCUqd@7Q|vWAuc2kAsWrc2u5-kEccl5z z2J=}tZKeMU;;%`VoMkn&zwNjzXD(Tif7x+S@g>63;pQux$F4Pv8EjiqyUL`%bvtg@ zanp`lcHE(P+iu)IcuGxeZB0!;^ zw6(O?h0RZ8R8woC@5jHg;~80!|Jw0f@qdIDGK_?OYifz{ukDahkyGY(a*UVE@9p>? zZ#1>EsXa{}?f4`+ye>~9*DCEWf0nhk!yKpM3!zpmt;HY{bYtPkegA@tNx#UHOhkb)?bdSh!`fOVT^?eqwVG)fQd^VU?{v(otzGM4{z1q0I!_xqx{eCWtwfb}E9yAkGcNJj&6Rajkz;4p@mKNkl7Jda)>iQ~b=1<)no~za$C5glJSfwp!>t?7 z(3F=)W`yjc`l$hGkQ$m-xLv;+(F?>e`fF{?|X6u-vW08)2eM)6cq8jy zdML|4$1BlI@&D*}rsH3k0-3l5+T=B+C$dC!2<%|;xtyNQO`}tqU&v55(Eg(~oN1Cb z7kMz&iw4F~zuF$Z=z;mIj(4)F>xgsUz&8%0bRd;O?#8Soao}`MQwnlY2a*wzQ?o8HNq}4zAOQ&twbTw{6Henm zyN24(hT8mwMo-c^kU?sjk5u#Vtpgby_@fJ^cR?lxGCOd=i@&_c;y_mMJx1~G9QfXW z1uiUf8OdzI4lHyay8}5K$mzfj4*cdoHwSV#klTTJ4%Bxbj{|ufsKXBAb0EJ1HObo> zY6S@894P2OAqOrs)Jk+Rzig-#cA$s@MVVX7fp~(nSlodU zQ_DC|mLOvym6Ug&f&&%lWN2iJLnX36WkMAPsuHSEt5a)GCFamWb1lWS3DV)Zgc7W+ zfddU4XzRd_4m5J0u>)=gJPc^!fSu4(#;w26nPv_&rz70LftKV1szv!$2W(`Wm*wi@ z`i(RP!RdfYMLv5O=amYl8z1AtG<{S*HQ+#y5Tfqq|HdUU!eo>hbD$NWHMI@36_2aK zeN#IJes6l9YNnFu1G3ct7pvKqn^WHPSje(1pB{VZV~A^6Sg) z4)kzf5}lq7^m1SXIq_paZwLA?*_YbifqpV>{5s6S|C0=$Kae_zI@p0BgrU@7)ZtX= z;pXL~MmjLcfzfovIxx^VVu=Gw9Z2CsN+*^%u-t*&4(xGY1q-gDu5@6PtnkKKue+wz4yw*&hfIN-oR2M#$P_gs=jJ^a7ZVFsLWU~gmX2wAd@5{@}=oN$7AQstf^oR%Hn zo$(P%3Z8Y~9BVjFy+HkoD!CVB-%xy|v3A*kD>8ZxTw^^`ZpOdkFpR9e6{2>%cn)-jhE#@R3leiSeE*pUOVTM%vG0>S0PO zRbZA;Rh$!W8i()=H3>DT)A;jB%w$d^rz7mYWKQKoYA04YvC4@wPNa3BxDzFuNasX) zCw_1umlGMB#%3`r`3&PdIq{LF+bPGlu~r~K~;*_>E--zc7g$(&UA{C_2#mfLCk z0hq^$yiR`z1)T^v@v{@ZI1zRt z;zZG=T3cBy(4tPnoM=VEppdQ;WqTQbuj*CdK8|UIw4g z!HJGebeBPBs`YBBb#kJM69V$;Opt%rc6H)c@^92`)Zd$G1+$pr9>n)>qGw`pY9A+h z6Qsg^H_f7bWm3kO1O_-UQ1(WyisMa<-DZ#zgPj=S#84+DIWgIZ2TiqMGS0zLqn#Me z%=-I&XZ+u);n>~i9=3oaAG4( z*(?6%#3m=&G}AUavEPXUPHb^vs}sL9(@L>?F;!-Q>dz zlgPbJ?4u*^^^%m&^P=~dE3F@P;+*Qq5hsp1ag531)U(tRPMjp1qMoKo*)xRqe;B(& zem*nzOEc|)oMKK~WLEm-#_Y@ABbL<0tvvpA;xhd!60rUKo!s~+1g_};? zk`2U#QZC$f;*M;CE@W`wt`qlIFtrQ!2@jljC<~tTKXT$9nsDK<6HlCY%cQjUl<-``Gz0D zr4LC6NnJ=rNKQ>bO-YrQR4yzZZ0yo$Tu4hZoeMKEf8CSi*V^Bz$nRXp=t3qYGrREY zcAV>~G5%TTWObqQE2Ez8UC2f!J2k%xIb7(`T+7L%1pGkA}Eg*q%%DJ$rxmJx?iMOdN??MGtLq!)Vkt-LhIr}SLOfe!f!5gbD_I(dbn_}@YmJYlV&d$daK+s`O#N#KRJq< z#wWvpE(~&ECjF5$&4XQ-EQ`v8Auh;`_lMFSMjh_Lh{P}##t}wQM^nd8rNXhY4vT*6 z!+4q#s1se7q+$lVkDKDcR2QbxnMVDCDt|agCGu`A4~-I-LG%0q!<YwZVmrF07Tdm|X9|uMdoF$ZG|c-~U|L!Yp}G@Fo{zW;aU>`8D~s zmBegy$(75-MDK86C&P}qu#2#VDp|W-I6c`o%)NB>DSy8U2gnDhhp2~D?h(S;VR6S? zIPNk&+&*AKCtPwtt9H_bQw%t*;?EHBwA9YKaKVM=F8oL5FIg?JQM+)_g-b5{P4h1G zGW81eD)k!mx(hc5H>tN>xJ8gdDET_>4*6pWWBg^U=6G*^zDyOF_-ZyA%(jZE&Z??IXANWk}QWFcpzey998nUPI#b~kb; z&M94D&AHvkmyTx~); zBfHnYjRZF=3~T5{BSK?0nz+%FEKSQ@O`0ig?nVp6E!{ZJO6GMoTivj^k zyWYpkxzM_`xeZy8b^DoqWK27m6pOKJ8g?@Vu)P~UyYUONI=HcwJ6IzIbatbQ8^_%^ z;YL?Cer3#bH-2-Yn;YZZ*qayK-RR*)KR5czVZM#)$(Y`5xhg^H<;E3W{L)9pxsle_ z4fzkMyyT0s0d5RrDvX~>P) zlI6xGH|8*AnH$U9m`k2V{gXQ1jRk~-ZY(0Sd|?c)ycWB$gw9eGAZBge)S}75_!Vxf zq`%6I)o!dIC*Ja6EqNVvJ#_**d=J(P6}g?T zL)H=@7yky|?ZzINJ{42^vC+?cZtQpC0L_EcLvAGAFjI05yK#i(QB~@goXhOPNjFZ( zZs0*-4^F#r#*N$_t-ebve}H*S-!Q*S8$rW>~uANvx2NAX?4J?d~?F7bf;kow4te+Y6!kKLHU{vUoH z_tcGN^#7$kr~aoR$8axt#pGM+Yd78yB#A+ z8I+&RiHsg(@*p#v@06d#gRF{oWx)63Y|8nace~BuL0oe$Utc@5x0;(it%edW>KC2^8_5D1!%kP>fK@gLn^$dr*SOk{*~m zsBzLHU!6-?c^#T-HhZ9X@S6wS7*pDVsvcDHpo|A)J?Q+scGjwuW0u61_n-o~BDE5= zvdXPOcxu(EODi4(JqUSF(}P+bH20tdb8Ax@QtMFbdQgv0pDL|1@L=^CqkD~%)7XP1 zru4y!0v(0tOO4%1S{31;zyK*gY2a`sV=IUD$RL3@Siijn3k7Mn0`Rz zE-8+%tQICaQ1@3x)PtA@t(a`5B3paVhTK*;Kgx2l8T*^Oe)6C_{hw9tFEXbpx1$H0 z=y#@ep>|b~zk1MEMRxa~hX*~G)y}5%BFwRAg9yE;eLUz(=tq^-`+G2eJdiqswMnU+ zHf@NC8S23>@^Iyh@L;6kQ67wzCEdgr{6rn+!SBo+@4*DZL=Pq<0w2~k*#miYq`c&J z8d7SC2UAsT(+DS0nWuX&gFMrNc^>>pp5?)8!W`;cs(i;G-!Di#^W}5C2TMIz;K4#> zE%IP7!Su=49};z$2g^OE;zd<2R(P<|gZmyl@L-iJGY_tLaNUD79;{`-v($AS?C@Zx z2kYfb^xzJEi|80>-pJhld9aDFnYx9#mAZ{8O>g($ZdGH5cF{TM!6~WmOWbY`_R!hu z!9K!%>JjPz4-OIzQKk4{!bO{QlyHoCT;-mS6D_sT%4s@Mf1t4W3|ao{75|)^#i@*q z;=BhJ=>Mh4UL;(i{!P71z2d=DLanvNAiuC_H$1rM!7WZ=I=iuqZ_Cj!<_=XHxzhO_ zS=yC8JoMm^2XS7&i+?fUKCcGR@aJ>i&2X!|9Dp8kV|@D@}d;YcxqWM%qm9nqBOaTa#of@ zIWNk4(T5$78cOI|C9m<|fXa+%q#MV3kJous^P;*JtG!s`MGY@%dSUaz?nNyxYI~93 zg~f|HEY+M^*Nb{y)F;dSFpKv#Z{S74#G0v%sZFR&snT3CFE;T}RxP~7twLHVKk;Uj zRxfgIjz7}Km{9qBi>S_k1ztG3aC+hL!tKQ{FNS;J@xtpx2QNB$;q$`pMLPxus4;4g z8lr}&5vtT2^&-p>5N_o~Yx-@dZB@*VUi4$kPhPZ_WuW|Dyhy|E`x5UD)`|WAYG*IH z5V}&kQ-Ag1H$pe6w0P=9Tn{gLGTFKV9OcCXFD801TE&bZjP+t1VZ8DWJc_#!he=FMrpj}ifA?aF z7gJTtnf`Ip$bTqjy8Lh=o6)zoAI#_ZNYGi#noXVK#azNX75^t;z8C9wL<_x0HQanc z*A{uP*egFZ(Uve^sfu6b#d7ir>PqFWl2yv51FV&*WL+tLy%!t3@)HYfgX|9utuJpR z^*=gd%8zC@d$GlftzK;N;(!+iz1S|NQhLql&{Cf??eL;mdTpnwZI>6j74Pw4FL|GG z_IpvyVI2D*I`SRvX)g|wk5G@Q$YX@#UYsDDRQ@SBYk0$!GhQ^|4Z6>IagMp?sq%3} z>c8m4B{?zMpjI3FEt{1WW5XC1#uYEFdhslPe*?HCXSWx>`!L0a8(!R$4bz9LKHT!+ zwimCxc*6?scyZs02VUG|va>_G=f$Y$#?pF7M_`3Rdn9iGGBV}y*o*(@KcPOA<_P~% zpUY`j#pt2DB=`kQ;g?>#B9GB&Odtb$&1fke32dAhh#pZ z!Z@FNy{F(oTM z(6Km;4kzA|sw4R~AG-O_ow>t(7~w+?AA0)G%ZJ`HhxpKkFo@chDwXsj^!H(aat0FC zHZ%`bj{K{0D0!H265p6cGC9GAQH0UdG1ReCsehag;}y^29V8~ox}r0g8kfyjOH+NA z=EDR(Ci?M*57T9Z`;pI&89vPPA+;ZA{Fvp#Y#-zrkXt^?@nNnH8)PZ^FwciSeOTs` zht`?rv(7HtO@{}W7N~X?`ml(+n7V|zROQOzS?}x#q)VHg|>2Rpl=)fa{7EvGX^XTpKXomJQH{yRujKkkW6=?0sfE_2C)efe#N= z*++zbe0WTFqWq2g@bj+^Nm#>kAO2(33m@JRUQ%CCUsI)_Hw1aE^gB7@eE8tQM>_E1 z6XA=B{OmJ+NFzn$6~`v_@+iI`FMS-B)Q@C-Bxf=ORU+H4S81yu6`kPc`0`23Y5hp& z$M=3@^CLZd`3dy5eqRsBft!$PN;AJzS+;Wr+sw)R!LZG&l&ORMQeE#}si4*SuNT*r^PgnHEaROwaX zjcXeD(Tq-GY7=Tx6(e^_X|A}1A1xKvyBTNo!^ULZ6UKPj$sVdsb@<^VNUqBdx8iR9 z#Cgd+s-GI52B{LCr#K>h`F>E_oXXZTz`uBtIrgR|Du9!0&!c@ngFmJN&3W%{0}IKmC~R$255h@FTU`=UAt8msGL8_gQ;%sc(q z71dSRk`Q<82zJhB3$s}FF!6S|8GAok>%0}`9k3``3m(a^%_+Q_I7JG z{J81IE#=(t&L2Pl!VlD3)Z78&A>^e>AMypzk+UgWFo06@3k6V^P$YojDzaz* z#T1t=gc9VE$}t7xi#FrDi>G5&z7{}f#j~=bTma<*Xc$1F04fCJ>n)?mMYmRwF_oy5 z1E@l%8bHkeYLTl2P@PbNDy1?cH|C{w0QHnpCxE(&wY;cLZlIjBh0r*FCIPewpltws zPMDeoU<<&`fM(R@0kj~rq$W_M6-xkC#V_5OP7YHY0XPXRsxJUH!9(>@r3RT7QGWmd zIzi=!2>TWpA1WdNM460HTTxq6CAWMnqlO;?D00}`F@SdTf14o2JkE4H)>C6w*a~mq-+m@jeqF%3ZS?0W#0P*&_96D0gMS?Kmgx* zG?Pag6u>~nY{_ACa&Q1c0vJl?*!-{WM8lXIP8~rV8NevQy{*RKj}2fPlRE+!AHW3i z`T!;dFe!iq0W1t)S}yZs`ZMKSfG~wB#ivTH;y(hIPM$%n?=hB{yk;>uJAgTaxm5Az z1@Nch`7)t=3XJ%R0$8Q|#e^jREF~d8Ne>t{{z?)z|jDXF<`St+Z(|3V@A{a z=5zYs2hW)u1 zz@-501#qAK-vQiEk(UFwqWG%(7fA7SX+4K=EH~-gqTW`ycL;Z>$F>+p^nm=7`Y?b; zgny`ysS@)<{?VjnIki`NE<2|z!Vrdr@FIYh0n80zUJ$PWcrEKZh#o<_3E*u2ErUo1 z;#~mm14tJ{`k=9ZKLqe8fX@MZRP`72YF`3~V{S4ks2kI2-w={erEJn58u8h|$?2pB zB4rS%RBl>AYHAv4{^e#{PNUHbL3|rTxgg31kuiu&K@?{|<{+{JQR<56haj@jk*_cs zc#Q%4E{N~xWTR%Mil2j!Gl)EUjRDLRL~c5Hf+(nB@)Gg|k)KdN`LFV$5VwGzrH8H7o?$7DRUY!GIGMlDU1Zj=dP0K47ZVf3m(5EX-{6-4bIDlz8G`S=|S zsLW&)YE^1AYV{y$5Ttlb!hElGRi=ie>I6}jX1yTl6B*n+SJp$GAcig6GkRA&$_f}83I!W)E-EcFBleriAt zT(ujb6Q(Ab(I8?>whE$k5N*g(!%so9CI6_Lc0pKFJ?&}!EPbQXK~}ZH+>zReD#_tK ztxFI|c}{g@{I5a$M(C#MTz0{jnx0IK2%=XIy@Tk(WZxkA1+h@I*q`PtCI^rQQU?Vw zm@tGolqz)&BMhhRW2uorj0$3O5MyXg4PsglV^#dPAjStVA&7~}nI!8ZlQAjsnjFOM z%AXR%O-`14UwNr0{-8gdI)gfsI*U4+I)^It4Eh0o1~ET~i$PopVu2iB5Zi;;5yT={ z#($bNGIDVcOM+OcO06Xx^0YU?k}4-_2+2ZN z(axMagcKp9q@S6ZDumP_qzU1WUz1mc5Ym#CLg5gK zgis@dnjsVop;$;hgd1z7ILm4wlqQr2p(MdXEk%{E_z=wG6f7l9873=*P?k`RTAo^g zDlrv9#*gy_D$}V#txBz?Vyeq@v(8#{8d7Vk+&YB1)OytVAv93A_wUCwQrtL%Cgi5n zX4K{?H<%p0fR+$~Ed+ZAvJ5OC!?AM21oRLbA+!piHH$by@DN;7H}(JStK*fjA^1ZG z&<|7PFoT2;Rpuf>h^pKep<6&}6GB^Z_Yi&zp=in%@B- z45U9uCxmc%vFY~1xQTL%s{YA@-$R%}n5z6~QXzXaoz4v9&m_zWVK!k7b*{>t zCtYGG`NCyE2)jbq9l}E9E(&2WVMz$9Rs2%IvJjRlXGI7r6|a(WHfYSnnh@58ur7r4 zA#78*8$#Hucw-_^H_3_C(HOBUOm0;%dH5W|?IG--vs3vU%3u%q6m>6kUkLj{IG|#V zhH#L4hxyrLa8vOu!tD@Z{Hf=?5aNT{Ls{@$%>wtCd_Zj+ z)E%Lnr3 z5Iz#b`9%0*hWQIYF7b{F8{-4&H`F9yEFWpiVDd0hgwZ;THesX;BUKoIFoI#E4kJw% zCBi5fM%pmag^?+Y%q)9lu4!IsEqxdn!jPxud>cl8E}@LfO_oi|LdY9NzA&i$^5JoOKxs{)XO-NSLF6R7U6p$W1jF-p0izBasVH9FyVHID5 zP&ABU$|)YkT>cN)6h^5qy!7M4Fo)3~jD}%oVdUL!t{g_M(&o}(lwm+wYO=?1AI65D7T?1>BfI(RgZNMwVTQE|BSMI&Qc;5Zxp#qO$4oKpuWD`^#*bl)Vph8_ zej*GAqkR}ZlZ%J6U!+d6){RN&Z3pS0;!a_7R@{ZqmHI37x3GLz`a1jF!{`x4PnkGo zr44Dl74!+CZy5cU>`#?e^6;bSn>%p>l{1JiIE*1-3=LzL@<)U*T(SJPYb1FyuOO3p zMl(4^W|mijj1yrz3u!aMm=(r0R$k18*>Qd>yd8O8yXyNj?pj6HhdtPu|+=0b{z= zz~e9;k{^Zf58 zR+f(RK%NPVyVX|rjbt9-3K{Y0;Q)^IbQl*Ak5!6;(CxRqV zV|?mI(14~bf`)|V)J7_@F`-EWO_kG(kcY)vkXuHOK(MG7YXp@TV5g%i-w{F2m&OFS z>9nSLBJdJ?5%>vNOBjbNuRsJrI-v-{5k$x_YLqH5@(ocd#Rtn91-C6W{}@5L2!5vj z6SXV*Bf0IF)T7$usP+rF1GQrWod}(&U8r3nke^krW!Y{KbeC$Q_$i7Wav%}RjbL5` zy&~ux!6e4_iJ&iGEVW+*0|?S?e?sewr3OZDJgP0bY8n*5V3j*0f}!ML5e$!Dgz`s6 zFp@kY2U}D60Ncvx^;zi|w)RQClUETs%yxghy z4i`*Q$ zi{N|&ON=uMTO!yR!LkUJN6;vyZD2hsB3LhH1glyZ!77@oscWcfsnXE82of**UHrh5 z7{4(wD}qgg%_=g{Pk?2)iQKP1r--t8$m{gZh4B6EK#| zLFyrud+C+&&Et^>j?y_sJs!b{2u`Y)(-E9fyet{cC_XEtY8mVNLIi(Ba77OGRov{A z=C}><7bCb7fk3O6_BTQJvYfo{johmdT#Mj(1UDjh62a35ZnDn%)LU{OSK@E0R_;V_ zSMfc<(}VF32oI@`sQ*xLgJA+_=yKNtnmGMO%l^n?s5_gjM8@bGO?^U(*U%*xL~$Qs3W%K1KuY~<|9 zDSyUTKR+;8G>TkN^`mGIMfoTyFsynMpEDUhr>_{5t<@Nf%28B{ zVt-7l!emwIf(k~~f&FIjYebDZH`a_IGT&T_xwWYhP$!DI=yA6*k%&bThC)lMZld&jT5hSv86m7_DmGdLP(MoF{#m_Q3 zO#Tu@hbX2-F)fOYQFMx8NEAb(*qh$mnE`#H=n_TOD1KG-^d$TiMK?ls<@bo9b1P$S z>_zBJzmLk5yQ%k!qJIcfJr6U9Gd7BY^W(=cUhdgGK8gwCiPTBd$yBNN_b8^2uWvCLlGh(m%!p!U6w~Ri z<=5_~TWPbRm>0#LQOu5FP84&c+8X8-$KoH}FZ_tT>i9lxz6@hc^MWXnx7G@_ z))ujz#ndI#rBN&+ERSLfVFh(%6sriUsT-(kqF75!7@V=xsVFW)@mCbxTWhDIIHOuQOE?$B zdF4!Lt*vdXU5w%qoteGOl9USnj^Z+%D^Xk}T%*d}(XSJ3P$lwa6sK6^P83gDYY(G% z#H_nf+#}pqkq@Fs*~X~6d>Q-`#Y_5+sZUhQ(f$NE5@i%oRUvOg@Jg6{c5Ch8X&uG>T-TlZl#H z<(}e&QQyUoJBB zsYs_5wGy?mYOYEQRq0ftR;SjWO1m`)ou0?Z4Iv+HG1p~sPz-|!^*o@hQ={8i6Pe46pNv049#M2s@j^zU?sPpwp4yX3>L*{`JY%@40h${F*p<-yb|Y% z!Of(H8jQh9@KOC#>3JZAb3FDCoiH_`a-%Wa;hmjY#n3v2HuQg1xou{MLrX55|__Qr4}hO05`qkk!ezi-ONBpit0Af4keoFE*McLBl?>QSon z>i-dS7En?g@7Laoy9Rd%&al(CyK8XwFz!BsySoMn?gWP)kPzJ6-6dFX4fef#q5j`F zbDs0mt+%VIWqNmKXL^qH#=4dIPn?q~IoBJf=%>juDnHv>zkR(_%Hur43%zks^5aSedn&o#8*&J~uj?O%56MU5WAaIF zJnfBt>CbxOd2hU+7q6`!qqH`ygiRmewM?To@|lp|gtshs*BkFC{a(a>=#7tZ1vVj# z3I8$t+#6qd;}iYpC;d6~RWAO$k<6qYM0tWmPWUg<4*D1xiJ-k_nYnUd4nvJdV{(NSoBSb&Y;-Yp}Pbs;Ol{ZF(KD zuFC6CRvwIRAp4fyc8{SEr7_vWgr<~cWJ?p8Q+^>^kg~dVRrO74#b#@=jR|G*>0vt) zt^&L&|!-UH-}0(}Zu_#@;5FOqgiGBooYX_)O?$ zLVpviCfK-0UlZ&mI85jxtFUWMh8`2VCb;NsGHt0J&mEr$1?*aoq2Gi6MG~2?JVGXf znMBAaDS6C1mB0V8TEX2AeQM#!OH5cQPY@<6$mQfW^=ZMCY_2k4HAR;C!-O^T z*fst9l*c-GuGKa!d2QIJYW|{ZA~&0`<$F$UCAX2=zvuENfczStQy*=I34fcg(}Z2@ zIw+S86ZX*elY8Z$@O|m~)UvC2fDV}OhTocW$b`e}I%2{}RddvYWAx)HIbp&PE_jN` zY4VKfmA!Y~gbQ*hFr&B`7frZiLLxH~n{nBMD<-@&;gtzjO}J*lW4V|(wCg6^FySFb zc&g5sn1e^Z=2l0jQfk@MdX!C`QUSFGuoK3F1N9*8NtzpE@rgj zirSMM$c|(uQs&uNR?2&)tosx%i%8Pl3^#jwn9`QSumhT-BT~!^fIaW}Iet zMy~Uev#REt8RwN>Fk{mc{WQD8t@_A%L_X{p0hV8_sLsk+@{q(pZp|l8#JIN^b@WYV*B$Z*LlZvLKVn zGh2{Fc~%Ruy7iMPy9H(4S`G_xT98Zi=C>d>Jr9|e%%^(g?#i-Y0XBcOprFbNSzxZN zcNMXqs73#Gb1@5wv$us?i+qVMVS#*yl)-|M4C5^*BWt(7$fib?B1@Ap)b~$9m9wC- zO3G6zkQFVcMDcK2q`ry;Rhd*HC8=(~z1I3pt0lX|f+a32b)k+0buGAW#{)a+Sy11C zp;ipDqJaesE%@1rf>t!Lps@vh3j!82v7o61HVf<)G_#;N2k&LUFO+T;bhn^|1ubO* z-P&rm)=I6tHKmOOZ7J<6Xm3FW)!W&Ej>fk>!7gqb(RiA4|&Im#JjA1uK-Vq~uAgAId*0*kHj%3)aYvO`#u}wHB;n!FqBp->)wDCJX+u zU=yWD9P}U4Sge z95h~4z1J+bPM4QECS)+)vf#D_pDg&y@QwwKEqJ1z|N73nM}mmVGI5e`-1+Gd}YCFii~jMit#O%dPlw|Kad|u8Sp0FLLpxr?cwQ`z8feq@c%H0gB`atVn1@A}bOzNviTBRvhMRr6!pbcj@16DVCBo zsmRo18Zs>@^`%=Oy%ia(@_HtIVwlH@OsY4#6`AQ-$gC>QX2sbC`bj8{99HCHo=f%S zrhM^ec~z3niv08f~SR#c=^vZ4y5GTDS{k@_aD;;Jzb zuWm&RdQFwovZC<~{V$g~OzM&*wQK`vzSH+f?jriuHMXLO6(%dpRy4JunH2-QT5l_w ztI@hz@rxBL*lcMo}MMvev&H73^v)P4|oApW3&5G`9 z_8@zby-4Z()rw7gr@_=wv=|_A3U1XpYgXn|FAu9jC4FFe_OHBie2nFLhdFH zkbA7yOW8-tBKxg4!|y9U$m9@tSoLoBM}M*$wc;3)<0?Nv>6{X$D5uFY`D@A>E6Q@@_f~wcBC8GAZ1`x! ze{w~&;aN%TlNFz>NMl1<8@|YCY(;V#FaBIS5nWahX9MU7RFcq!hy3q+VwEJJB())# zN&;MU3L8?YB$W-RmEWnSuP7axnaK2H1{*R`ej=r&VpELfjlyKYSvc(}er>H^%gzF8 z%qZvK`GJO9HsrR!XoF_M;@fd~Y{+Lre%9o*VKV=_Q9zApp!{q@L6sD;p|A}_Y$&Rd zfBjl9dU2JMu;GL{$|V`b+wlEoTqzr*zO)Txn5PP8Whv!k^V=GwOE#pu4GY^ED=@D} zN?0PGRk5L}4M7`1HdM2rx(#h?Xlp|a*3`G5fekh3waD6J9kMQ2kCf4x1hj_qW;QgZ zG$I?@&_vZVwZRh5=aYPwe$oDgc?;FslG4hC)|5f4l(Kd<^s?bs8`|5@!G?}DyxOCm z?cHqX#LCWUgf2F8rO)HC-RV8Zp5*RZ`ctwuUBqvLiEfsO*3wbJXG4D* z2C#YOu0GF!^g-lcatJA1LuE_X>CeFtDj6?71(c7Hp91tTDj92&`^o61y*wuIkE01} zPPAbXWimNM)l8KiE4;1Z3>#+JaBM^TCL4ZJy~}KvMW1cM9Liid!Bp?>Hq4{XSIGh! z5(M?*zDOmDZCIjwDMj91xSX=WhLtv~qOY}K9c8r*e^AztGE{|l{O_y2m)0}cKyFmM zP5B?6%{FZLo~V4Q4cnA&x8YCavOjm&@V5;+ZP;bQV;i2>u-k?`He9pex*TyE_StZX z_4~=A+3d4HAMm{mA5`y0%75f18$PT2iw!Nf zjd6Csj#_rqwj+TZ3GFCiM^QTx*^$_epY8hGl91W#$ZkhcdNMnb+mV8vft0e8cBHZ+ zHJf(+iJFF<){b5xlY?48I|{K`IH7(qEG*l5MSptAqnI5P*j3z)5_UA= zd2XIds#Vpc~V9mz<;t-w4;(8mF=j)ye3)I zj%t+Zc5LT6QfjEBt{si4-tj+S<`vZJ9) z*p9|_G_m6sb~Ux*Nl+^v(h~8}%#P+v@`N3|cp6p>qPdj?CS3(*5SGtrf3+Yb*vmF*YtlZcm zA~fJ2JEC^D=^i`0cKGN)(oY6R8F}67xDY+85^qiY1c4l}xhB|CfK9nNujG%V9cYB{{>6nUvq`SWKB^$80<1(6fiN`F6~u|4z!_ z^W=%iwJcz=Q00q6HtHw5JeJt8ROQR;Sgw499p$*}DkiJRKUD7;JJ!FS)#^Ps#0Mc)^ZccI>9_vCDsKanz2zZ0=J_ z?WY_d5881^<%jKP&H2m7#~7ZnP4ob`*4?kQ0yWcr2Uj zz#a#l*zr`J=?-jg;9onQ$0KKa*1Sh4R&oaol@xTo$DC?(M7pxKHRnA|{Dd zJ|Gj4(vztqxdSQaDOFPGzqm9Gq;(*p1J^ltItP}9wLSFoEX&|Pe}1{oPi$r)GpiA@ zP%a$NPu=Ve6mZ~YCOI6)scLdLkei-|%uD7|z4;xGucnp73p!B9f$HxJ<=Iu3EJ+q| zpr`}I=*1m~@ABhWS;7GWLs@(;`I5{RY`pZnqP~r$7VdoZ$NM8z=Vf} zMh-Nl99bDJ&1O>Uz)S~zbKn=2b#tJ*11;z+Ng2GA1Faos<3L*`9m#fNd$I#5l|z&2 zlj-D;_X+6Ih3u+&n?|%A4)kn>paX*_eI4khdizrbkhdb*V9HR{JA~46r*Rl1E~>9Wwrd2pZlnXFD3XkJ zU<`dMIZow+7aAt0y)=NEve$uq4t#asn*;kDI3Sl12W~hpH)=TOz!3+Ia*;#iVF$*3 z)u(if%@Yosbl|ueb8J+TTdtjQ;EV%jWj(m+4o?t17=HSA)$)DYz+#1CQkb?!ava?msdc~$iz-0aU!V`$=Hq@~eC7Fs$?L-56IToJj9P1}8E)k<*ETGYo5o8h&!>Zx)jG4rO9xW-<$zmCQzFCuNN}oEXhD%Izfw z4cAYn+)lY$kv{pnPULg`|L-`?&#(abGr2sb6?USC6IYzL>O@f|iaD`Gx|}HPLMlb0^JVjQqFQ%1pqO=o@ocJ8m%E<0wR}Cl1Ie&aHM>Qtpov1*mNLC_c zgvw4-p;sl(@HPDE^z*#h*QD2SqP7!t=s$i6(Cd-)$p)m1+0cob+$W8lXyQauCz?4? zs*h%OqPeQ+>clT{u$*YgqyyQCZ0$rFN?Rw|Q`(U-a@IbYJVZJ&=|px`yFwr3 zcPDzNytflQ>AlEbRi2Np1e(}1lNKkePT1%z`e^cy(Hv|#op4dyq~8e-#Y_4~DXv@+ z_loLAKctd5PK2F^I1zOsCTB|@ZK@M}Wb;?*XUhmD`a02%#r>TaN*SP*9Y`7E#9);S zk*5Z~97mQN=EQK7+xloDofyUDXeTD9e2f!g>Ep=pD$iX?pX5X*CNY^zPEoxFQ(>AM z#9i^znaoi6Ov-Og%%aRz`Mb23>%{L)q#kCR=fq+smauC+xqw_qE+Tu!VW|_#=o_4n zmqC_0v5HNZ)e6c=GRaN-x4zZ%Kgcystfj0YrFXqk|D>>pJT@}i`}f~PU%DXiVnyX z!-*B2^n-Xv^&X`hcH)RizJC|PG3Sq;K_{7?cj5x&6nUCFL!Ncw97XkimtnE_8DtqYFQ|P~U~T{j^N7 z(gX21T*&D{W*1iW)v~yd)%D{|_%cE^7qYAI5B1e@xscn1!Y&kH_@J+r$Mxgm9(i5J z$1uODFW|z@^nzp|l_%<_6?LH)Cs2`Lak7*PB`5~6BpFW{Ntuu4LLv3-kfmKHqw=yY zl%tndNd*_~?A6cS=l>Zixlq|9Z+k;k_SRB0)m*5qyauJFRQCIEWNXX2fEd@GN5xZlUv(}iDM=r3O<%7TiU^*zvAjboyi zU9hOcO0kj0>l>XexLg?LlDEvk&2WedLtXH=;C0D+`Sg=2LW=lZ2+)IMhzzSEcg)Ni~E^KsR6MZw;y1#zL9^o7R{wGgfhTB{?>%ut~ zw!84B3xBz=gZW_>{-($x`&`&b-$m{w_o&{za?m-lRPJ}-0P}<7AyqT96^^)Y)P-YA zj=OMzQjUK{opj+0o2SUrq>LtapB7H+ubpRd+lAx(wF@p>bm0<{8{}p33VD^hM#{3+ zWk+#tH&t@Wg^K0%<1Rxz>#yCDr-KWhT=*%u$Adlx=XK9c{Dar|mF;g|1Cx4!sS z7rwcWK9zBLA}!^BAKz>aHxlnKB~+(_<52{#OGq;Mmp z8>3RBdr_h+(^x48d6r&@j+aAjBb>oh-;Mg`;GMmXwsDWGH!W$D$2RhI9}fhd6eg}72K$(#;ioC>_!zg zs?z124?VbebyZWtjhggYDyi+pVAj-AiQSF*ZZvSCp&O0du)1NB^}5l-jSg;fbfYON zTdVqJl;-3wWD7T1s@_&^%;WfN+-U1YJGcG`KAC@exBfo}k?;TY7U{%Adb-hBE!&0C z)s1eH?kex$#!ikYOZ8&-s~f#3Ceo}bEpFUp<@ayKl={FPqr(lS8!k88ZbTEJzZ)Jm zyj&#YhR=<~g%NZk(Ll{l*Oy|i1u8>+?c8S zH#cS}pG}$L#$1&g<$^hv#LstQfg1~%=NP1Kmpm59E^=du8%volS4%CExpBc2Dp~2q zD&?!)07qEs#yU5y7Q!8Nt#@O)8-Kd7K_=|RCOPc~X}4Dzx3YJ$8(Y)}|D)XD7rJe8 zqbvWc_{)tQZtQPlyyeE<8JmJPkdIJ73aGHKb^`3R(iKdTmfyt8dhU;!zq+cR0lUK;A zq!eGHOiymSA^Y~c;U<|Vk5T-#EY1%q%C_HiW{a zgWMkE@gT3N{Mmzi9^_}UfCoYKIh|dDw1TRpkVpT<4Vh9=4~luv*n=h>nAgS^_n>1s zWE`xO@W9|fNe|+=NPQ2C9%vp^_Mi%rQe-&~N>j>^Wl0&WZqk8_<_Mi^)x~jJxB{)joga#foWU~>uFr^+g^`MyttvqNg8!}kG z4m4-)FQhbEc+ism{i@rB-fXaDVR2iJyh|MI8Fr9;;z1|6>>OFPGrc?6#e=RC$-8;5 zE#Hr8P7j7X$zJliCBGxPH=8Ee)gD+puzKM3U_f%sCTElf4iB6j3?Hm5AFPE&8BTnO zcgc~hYCN{jnDn7RM1K92&#Y;$jXn?j9vt!Fs22e_#2)^$zu5nDXIr@;}s{5u@Zp z^NBo8K2rl?%*dn^M^V{^I( zGgLm)gM&OM(mR{sJP+nj=90gw%4PTUA4$va$1U_=kp~-@FZN)G2WwQ#Qp$32nLL+E z>1WFd4^}c6yEuN82fe(;)vEpv4{meqYgMw2vfhIYD#?=!n>^U;!4^pv{zYyjWwdRS z?WC;kPY=GSE!yG1-^_Qa-d!GK9ipE_GMT-y?JD0#*-swu;MzTXW94y($zk${2S+KA zAM@b2a+%>N4^DfK%ZuDzoblkS2Twit*MoB&oM+i%4=#9cQJytJv_mKK>+K~EZpags zy_d-=9$ckdBc_rkUlG2ltQkjf0qN_ghrB#rM&2*|a zwHImVX;pH%hQ9XnY-aExqso8s;`?sT?1hiJGz+`3lG(`YUgS{qIVqWQYI(fK>y>+q zqZpHML$rKeRC{R1&t?JgXR;t!h%8LXOp181f~za;#epGOP39%MFnCdtUPe{Md*#ys z`s6jTl*&uXgv;t@Y*{AdyeRKQ1$t#Ks(4XRRaT;OE^Dkxsjl*BUffe>Q4KHRhU%l$ z@}jmEby(AgtV`A->yr&gDQ@V+zN`8nkVj*NO}uDIX{KtLd$BEzepk8{UbOV0l^3nO znENPxoEL4pXzPVnHpGi|tncJSXD`~*J9yENQvIIcA`f&IFS>eRW7v(9VS7`$d(nf^ zlkBB>fAwPGkRLNNF*K7F(n>Dm4{N&@4mM>>rxz}|TO}SZa&rHaNmJ7AMa+vn>8pH%7yZ2G@5KO>4Dre*CiLSwh#ai)&8;w$K8zf$^5V%cQu!## zXmSiWmTaFI>nS^HYb{dC#}FE)CyL*<*i&~InT=4Nq~ceoh8RrxkAwtMj>n=1_Z zw*2MAY3`P%q$In%*ej>87rVVE#a|@$uzq?It#VD{e)=JKl6rsq?st%h%<3>jZiJqA zn0CyI<6e~Up{x%lyg2DaG9Qxra7tF^#eZIWlIy=0XT5mu#Z1k3&WrP0{EZhEC^x*g z>BU95%<7UCm+4nja@C7#%CA$3FE!kv-1Fi-<+c}hD0j(jyziNe_P~o5UcB_;A1@wy z@yLtEUaV=N?~o^~6#3VSr^%;pDf z<43s!Ju)tOWt2ZcKeHf-58r>^_#&srN5fYyzA=yU>0cNj4^R^LkdTr{<%xYLA2dio zQlGv$dE_6aU#wEFsriu7hg3eKW>fy@P}GMsKBV;_oe$}K$m&Bjc4hG44*%CF%VzZ9 zCx)3wNizG8gp*EYTT4>WbcwHar`LK4FR-buu9~w{^ zl8wm5WD~L}DQjuw!!fldfAOIO^Oj^QvNhR;l=`+l{KNVVO#D6seCX&yCm%X9v5{R= zeODj4`Ouxs9;C^Ko|InXucVCJ+lNHM^%F)OW`-6Ytg5%v*EqWm4j-Hh5B@2C6L|;rUQTb9zh2h!?%4#3}@L?r=6`6$JD6vLPHXridihIFuoe!IR z*g{`VZt!6vWfLi@PLGoRll}HO?w}8ceAw#4HrcnTcQ@rv@-K1+`L_={DKf$?A9Byr zPY-$Q@nJ9XedK;sbHIn1d<9!-4*PJ~hbulD@!_bP=d3xcDvwi6_;6Asrzk_Z;0)!g z59cW7eYi-uK+4F;Q{a+vx#ycCSABROPYs`Z-c4^__u&TRCVAI~Ta??R6x@+#fjZmo zF}zQvNrH!}=3mMqA0DgZ3FRqSkDK|-hv%xdYC7$u{O@MC_DUu4hQPNzyz`;2AN~Az z@52Xq2KnLg~#%pgf}=KPk`T$4k~{ z@nh``V^%-1`Q;OH$l*s(KZ^O0Q&r~kBNsh4nTO1)dNVafetH4&XR@Flg(!vnC_<5~ z_|nSQmv=KL&csNTP`w5}O48$1GN?H;dMUCrSw{7im2DiMU*9VDQPGdqezftUk{^}* zXyiv@mR0eiwjXuqRsE=@maXnb4SG$omdee|^#fFw&4zx|Q+a(#1KBg$k1MKdmsA!X zp*5j2Rh7;BXiooyY(chEy{%+!BQ)~}t*syJ{OHAeD7Rwq2(7&z9aLpUN+&-$`_YBo z)sG&OZmOocZ0sWaD%4XYsjJ{udT&2Wl+jsXrdUWTDT~{ z$KPE0P(OzGF~yImehl}c>T2UiKSr@;1bM!KakN_d4zqELA5~5m$1)j5jwdIO6Uj-W ztZuSj{#*BBw$uEW=f`|@O($oNGyV9DGK-u|&LQWLGS2UQ+~jN*_~irs`i870zmCur zQ5O5L#E+$_ezhOV=*!6!jpMA`mxE6>$&uU zwOMxZ_Zo7ms^8|vwE_A;`OA+T@^lU$X8?cuvD1$aa+&gDmmjF$4Ob~3BP`WRuOreVpx@bgPipv zZdLqcCg=P(Pr0C$y6DFx<%OH*l~-7QmApn?CvT89{n$`Nld?Np>ZxBoC8{5byW~Cc zz8?=L|Bw&KN91Et>Yw%v=^Di(wr?*OGltj8-`SHe&w|=}!csNok5`ZCqlI$%?79)!XP=azTwf<^}JmLc=&BRDbqESkbhxpOa zG69qgK>ijh$1vF_ea|17ZKxPPH71qF%A|Bvp;T4tlB9Y7HB@g+N-Yj3T?IK>y#VS5 z&?$h<0W=7pVE}CdXcs^uwN#q`8VAsX&87kU-?+0&Yt7hfu4;avv>;ms&`Ra4DRsFb zS*kso9Y`5g=Fl;KYxDFYH7gOi1kg1ATL5-;bt5eSbPu3M06p1Uu+Ctn^df&Hdy}T` z$tZ1G0^?w=(HcO~8Tzhvu*(^MD}dy@386axPXIFm*wYc-0DJ+A2w-FY_xc;}S26kn z2m}xeAQZsB00spR<_LXA888w+lpa$_e}3$!Zvg%NF9~3P@#*1Td67 zOeMnu7!}dWw3&;4nfN|{DZCufkd)Xhf5 z-{^BkY0gQ;IRVTKz%&--vG_fJc>%N;h_(YUKY#@R9E#y^3=0ETBv0fB5=5{#fF%KZ z2;yT9O9NOYyDo@PK`akoMF1BAxD>$309J7oM*>(Kz#jo@3t)QyYt$Sz%QH)!U*+__ z+1D{#Pi_ccBW3!R_)P(9<)M^0Z_z{joY_i>$n)aQ0REC|zMSNL#QQS+xWep^Dg9xX z@!qgAfL#H|?IL#vaDYpR?+M7~zV&b)DY9SYJW3M@jxio&*`WXqQ;rwV$2=Oqu>iKr zF&vlY#i+OhhxKE0B7l>uIYmlxTCRljv*bDQyz0FWz)Nn+Vy?{-r-ApO8}alrn_3 z=94$3J`dnU02)WgRbSuI*8#kd>p&0Bx%lLyg+b4wLOYKEDD zNE1ZbAd<_y-I$~cA_FD8TI%~dbu+RlQ)+w8D8-rC%tB^WmDz&Gt~^H&l}qZA$sI(V zAdD){8-%Agu4 zX;!@!StGxdTi-tn?W7|Jr>gnB+dV^o zdW`Ht%HaJevfd#<3{XBWh(XE+2Y-ATLTZLG92UfI$_Q1HyAejqp$y`2P(E{wu|bRr zVs#LIuwZ-;Qz;Y3iE61yK}@DkQAzvK#%V!J4`PN&7Exx(SsKJF`s^U)tKK=3x#aKU zJks?(ZUJQ>DKpPIMq3<2tufjXl`IWnneyd9te~${$*LgkrPZGoYnU7j;uvLZ5bJ_i zAH;?rHp*0|8xIGuiCupN@fT$?xkX6XN^T=%!0mEkjL}Elp_09nzsa3J?4s;ey?f+X zuzp`q|AlZr^8@5TRdXna{7LlR(~hVl&%bfUgE$ey*&xm_JSk7f0>(448^>s;f;j!X zk|Ur0&LA!@{3nQuYMh&tOXTGsu28O$*U0OntolX}uQ|>wmE5M>A@9omq}*4%4=Cxz z>bv4$5RX*;^-TQJApT|ZZ4l2WZ^-AW<^|;?`HFl^78|S8<$yBgJNYTVP`vY4?Y|&C z1<@glj$wS3t3(isLRcKa*C4(HQ8$EoA;g7%5aL5HhL9kHgdyY#A$LeV+Kqs5Yo`osw7Z zYssSOvxcxuZC7@NImnzLm|NWBm{sgwQU8_8~N6 z*g7Ql?lU$Dp>YUJRQ)d@G*#X#gyzcEzm035yk!Wjlpi@{oY@j>*lbIV9jA2&p(EWD zLZ=Wq)2;msT_`59E7>iC?vx&6?+|)YWJ`O6@T>CoAL8 zC!2mgq{;u|teC=lDmg8L>6GtNlCs}I_??OPEXr(h4mp>U;&~LQnNL|jE+n(I$C411 zhVU_j|3X+6!g6`ig>X596(Ot)VMhpmvvSEeZB+dcVt0s zO(k%4<>< ze-lEw@%r9-$K*ZvLG`}+689;D&mp-(2y%q+MK1nwpu>1~#Q2RhabX~gq8y6l9WsqMsk&>2%}poeGaLZqz)rZ7-{Jl$#kkReHa;(cj4-OVlz`1 znJI@8>p#Zsw%HWsZQ1)Ys&sPs=vZeo6S08U9ui2UG>8_$;mWi(n#fvDNV?# zEzq3On*4=qLAE4ioK}=)9I8ziZB^bbjP}ZxU5oD&M&~fDhH)*7E@5;H!ybl%1>MNr zVRR3p2R#FCqtP>rUUIOS>KpPa^Ar;_6Gakp7#8JLij6EZK|h6@VJr+|Q5dc;++lda z@UnMK7(O|;0}Qj{LXwHDdBv| z0`mDK<6_F1FxG~#guawqMlL5;kh1K`Fjmo5tK^R`8u4(f3u8UQGhu9?><{BW7#qXb z6vpN-wlLiJeL?b1a%&jdDBHhx$@|IqwGn@Xv4hFqDxWz#ZkL=|iL~7+*+bb&?vt~H zGdalSQB`v&jKj*0gi(K%p-cho7?b1V3GyU)ij*xqEoTcyJImx;80W*dK)+00BrlOt zzvhs>!>@$VhPObu9>xv1F0uD!7`MWBO}`z+oiLt+@s!QG_$h)+5wvD+ z<_NMxP$hz@5oC=ZTLifx$Q{Aqg!(w+I~%h{kVB1=lak;|T%HJm+u{pHP$Yu9sy81c ze*^_6Ka&MjZz0MmPOoSL#t5_sibYVId5H*0s!BryEw>rvJ?Ec(K|I656SY#Rw@d`3 z=^cO8_gmQr%0*CK^;V9c0==S2Dn)RcEB#8!BD+Q!szp#;ws(?NgJn&~ni15Bpmqdx z*la-7C1t64l=|eiBxp!!L^dX+M)Ic0n^Bra@QX@X$aX1jMQK<=YZF1+2->k(c9PaT zg7&JWLj)a_ccOGAyF}1c<=y0L$)i6_norVtL|~t!Mb7fd&jNb{z2&%DjO7c!6w&W% zZDwvEt)z{d(EyGJhEL*8fe7YPJP~*!*dM`x2z(LvBiI$ezR6lZj(!AVCTp7`2t^Q% zU`7NpBZx#0jbNCJ6G4o_reA01N9jZMjbJ-RmI?QdU;sn$fe{Q+J~)CQ%7;d9ne`)7 zGJ!HOBL54}kN)Tg-mqW{n`0vwrz*$G^JTKWITKYfi87g-BKs{)n;OA1)jM5IB-a0? zlBE&MqR)@?SP{WW_O2sW zsmj$6{6Sx%lC>1iWNp1lHc&Q3ut_Dwdg{Aki!@cTHG*x*w^RO%;4jJ!@^96PW@F-=V-A(N3wqZq+gV3M;bH7O`5qe!Ka{q2xOdDGzvuVa};l)cpF8*C<;a4j=~c~;V6nk(K3owQ521$SQHbcXpN(YRz#C2TJb1K zL}B1K6{4sZMad}QqcAclLuyf!qLhx}Houf%#SVS`@+cdXTWsmOOCIHAjXcVgqNvQU zb`(`qZ}ljuDz8S7+acDV)KqybnHxXRUq>Z%DfP(uQ8b`5RK1O&*gjBSb(1KXM$t^= zEhx>Sa{n&0Orif_CEvulYKoS+nz3~hZK5!%%C=GTh@vN(?V@NOMF;w>FL51JO{XY2 z)4Pye$!@B*dlZMb)pw?7pD4Z9^=lNpRgEbMDU)efqR2i~v#Q({g`MtDiId_Y%TJY? zmBAOqov8k=ZGRMjC{9OlCW>Gbp(v(CF)fO46cITyqZrAhqGUfZ7DXS5thz6y|6ybQ zCQy6u(6=i#|IlcR$ldo1>Pp=Em>z zc`BJtSwQ~QK`&ku#bVXFB#Nc-{EA|^N>)UXuf1NjQYEV>bH2u}iNZO_up^4UqgWfo zx+vCvuThm7qS&Z>6J>K0TT~)<$C6>Uvbl}i9>t%k_b)k8+zD?c8g@ppKZ*nF+C}ar z_e8OmvX7L}wmgYDNI#~ML-JFAeuO-#@@&`jSM83od4fDio+9NdGtNeFE-E*9!#Ymm zd=%H%b%B&+FGg`Gipx=4VRDr$kX7GTlevh<^(byc@xALN3#O#TZH_4)`jC!BdPEJcbfq3}x9{f;7ZXk`f<7 z8H$nA$Wo-NrF0A-HUHcR^&MD_UFBn_plT|{P>EhyCG%^dS`5`==o~|r7;3~&Gp2uR zym1V*VyGR%#L?-9eul}1Yp;~MGvzh?}+)Kb67Qgjn(R{1PVpNusIn@a2y2kDH#rE;nC#^8%# zSq#e=`eW!9L;n~8swODMf*vL#Dv!nxqxT{Es=Q5E44@Ar-TXGCK`{)DVMq*v)1j*DS@4AWIIA%-c+C&n;I`Q#W@ z^URsbWSYt&JuoANnKAsvWDYq?_0E0Y)CXr`I2%LaKKkm; z#c)1`YcX7p;euM@Re2`Ha4Ck%F>G9Gyu!SFYNLGis#8M!#FodGVz?2Ln=ayA4DV&_ zvHwTZSwKl~bzOTl?(Xj1Oc$OI++Bh@1b4S~_ihO8?yfKHBoH78PSD^G+#UW?d$|9{ z>h-MW?tAK%*EBQTRk%43FIahNB5qS2Pt@PPjhe3AnTWeg?vW44`{aWJFRlGYk&z!! zCQa9#sO0HHJX8LhB2QO*NqI%SCf|?=1v1Wix$;lMr-}G55zSW_!|xCuE-$Z0|@HB})>ZZeMvc`5l+ zZ+;UBC@)AU^+dm*6{Z&A7F#$*!{no^pP%}E)j zeJZpvp|uRsO6$S!XA?S6+NhegCbXlsS4js-M-vjy`2I7xvk6^PZ&x`6=-pLv@J*bI z-?xwUiwV6=xMsq26Z)9Y*95Z(78ClJ(BFg!tRG;)K*|_$5II=RP(C$AmU)N?Lm7$> zGa(u>3^!qfN=BM6O8IEneGByyQ(j|D7{`3P>Mc1#bL=-vWYa{-P*xLcCj4f??mho(}Y`V`D9AM+qNktOl5N#Ih~wA$_T0XY1L76ONm3)r5z=jep3ciCrg6$iOFd$$$^P#Gf)@$4`$Z&dGF$~zO@t7J!Qe4>9dA&!gp*@Q1lzLNj{ItDY6us{Y+WJY4; z6?nI$q-G>jiA<70c}hwuGPN0LDEqmU($UkKk-?0NW@KXXc_RI{5Si)O%*aBKBr7H1 zyvR<^LFObkZZhUEBd-}_%ouA%J~Q&0(Zh_MW)v`^pc%zjR*00*ickuhF_Q1=imLp| z46V2sCCn&kMk$8P%qVR}88ZxKlr`hS3{7r{Dc{}8JX62u#hX#Zj2~EOG(+w$R?dv_ zYP1TJCWTN@C6&ymtlXPHzLA8gY&IZ&B5RY?%&1POLDnQ?j_T=mqnoPiZblz&E*YVh8U4)|V8$1;B?EW7emoP~pUNUIq(iY$zs;xNNWaglD-8!3$Rv-Cs4FTX(N zb1)-j1k4Ds;OkLih!Q5ZoD6`F&W5${+`nEF8(&n16h`BW9nK9pt1#Bjq!V8rzHe-nyOU+nj#s*ct z+>BN96)IUNqovnR#??&Z)LUc5TKYOwv)+s*Tx%(ldf_HBHdD5cTgh$YcJhA-lwa|2 z!d+$@HsgpHyUo}m`>Qt`v$VZ3YxeGA@qY4v9A=b5YJ|@Pw4-MH#^&#G_VGU~vJAUs zX~)bsZpI>$!a^V!;XWq#38={l6OFEafjV{-&H(`5805sP#I>@H}~eyl6(w+4{cz z$BfHNu9$I+BH>jt;!^0F;<`$1Pz-IgTV~vrL&A!X6?e?IYsN(jE?IETjQeuQvdA5e z@xY9SX260(7W^kG^~(6hjJF)&5&4*WV#ZU-Gx9n4f_zE7B4sgNo6&_&$bH8o&Y~~d zd%2XE@sY__@)P-)l!7mmwbk_EZ)T+B+ZFLdUPGnXT4D~8f=ogtwICTKxdmHR8rsg* zgjqDCv>=rQsVx{-PD{gr92TUdq_ZGBB?Fnof{c_*WM)$4Sb)!u%W6S3CfQZq=yTkQ zqwzV}%thuV^H`8q)#RfbOND|K6tdu`1tYh_7q*~?1x^cG78JFhm<2;D7-~Ur3rbi} z-+~4fl(e9f1=TF5&JjwJ<;XG?Jl|t9(92p7Pcf3Rw3^I<$3}SzDln{Q!4Impk_DCN zRaEk4U;Id~O8%tsvS0N7q12FL;I47XUE`$LT1^XtwaD5Q)S*aHmr~Dyx-o+^8(PrF zf({mRw4kvCO)OZv)wpK1*3^P#9K1EzoP2Y`*n-lMY(>g^hw)3VKU>g-Nn5g=>TPd9 zuL1ghKsu?Urv;rEb|Jfx-N^2w)c3H!KHMnM%Yt7xVQ;d(1$`)e$$q51417M?06B7) z3{v@E3x4Ak9%jLChT|<5A)DQTaTa_v>PPG-3&vV-E{}0E3&yBv<+i1hkLXWrlWlTm zwl=|niR?O)NWX-d=w=Hn6f0>X?WEK=C=;(5-4=K(m}S9iCSEc|`YiBMq&{FlkRBq# zWJL8wDY97-&Cw>&CtL8VoEPP^DHcq%AYmiOIMXbcuBMt{!AyGLIr>#-jsf zIIR4LIOp=41-~;qX2Ed_{*bd+JxA;W^K;}$3r<-O`B~rNe=_-t{F^*&!5ND5o~7KJ zqn)Q*u;9xaOyM-8Me3;GvxRs{T3Ukp+)c@`Un~d}cxS z9{OSbLiN6+yt3f6O5UiNcNUc2VUQn-@7eXif{&`^lLZ&ly?4GcOku^8e8z7U#97hy zWjw6E7B@YM@er*29;#AqCk3m zF7nE3MHc2+$!uhHRhh$zob*w1^|K(46?v^FZABR?@>!AJijr2Wn5z}AB05(qPA_Pc zyObCuEM!GtD~`<7idb=Xu2z&RMoP1DQB7(}aFR21jgeHwQk+p$ufbqNSu46*(Zh;( zD~wh&wW667nib#XYPGDW&B}6Cl((V+y<)<&WF;#qQ>u_Zkh1VUS}|?4zREwTq?#4g z=`~bRQ`TrZf9+#MU4}Br=7z>x^R#-Zraq;C6%8qk$i}L-i4{N0)3;S~D_St@WW@rz zp`{hAtY~f3pB*4$$}9NE_%jRIsA=0;(T?7p?4a_FR&?N)ovj#6>B2F)TJ^txcVn6S z1n+4@FS`6C{bp(WV#Q!9hFH;CjnjwH*NT2t^tWPUcKsL_pn3;dF-UnX4MXW(E4Iwj zhFLM(D))iMNGrxMAEheG%O8U2W5}^8m;WP=w_*aD6RogXVY9-ddd(Dz6+QW|R9OtW z6)uJjRpX?Th#K4~@yMCN)%P*+t2{uFZ@Gr8h*-BL_SnF# z^|$rIawB~cxmk7%Wh*JY+pOp^UqAMCSh3TJcUHW&VwV-Wt+-^xKUVCqVlRs?d^GH{ zV!st9tT<`K0X4!=D-P1LK8-(Q#bNpp)w`;ye!%=@#qUgxk;hfG0aS6u_3FfssB!YSDf93987YOwVvq5q`Y$5kjI9+HsoVo*oGoD~5^^ai^&daREw^C>n=5TtukuwktX96phPBGq$#ui5ukr>P zHrlX>c`1G|VKaS;s(f@kZo90V)o|Q~KO|(n!-kzU>{2xcY}ifTL+&N_sowpR?hCYo zltVTgrW_%Ev*9R37G`t{{I2|%4HLQVPRM3lpq;egl$?@QL&D9Y{Y^!JSH*EOVhMP9bX@q7= z496bD-Lhc{AAE3|Wp`}2OSwlrl(U=ifRvHP@`IQE+3<+TWAX`^@NukXHautZg$*C% zh+3e%WK*VnMR{$*8_HXizoWb-+ZWc~;U7P3_-w-$8!FjR*^aL^e3Oft9hx0+cEFB; zcE~Mj64~|ZWEwlt+L4$p%_NkhWHLLFt2~7rDV3+PBQ;$HkxA0g)7z1OBDchuGuDvN zj+}P9UZ7=Sn3%IVfkj{d3WClTx3@E>G^zmop!kU*!et$hc77UxkTPJz67Ntxt4beDQ!m?HVvw#EG3>SwNNWZ@nzQMUS8Eyu%jZq zG3Q=|UfqrwcKks9QB_v8<0pDGm9%r}7nYiKw6^1CJ8Iccn_YG6sB1?(JN~d5&o497 zXV^qd)xeI1b~Lj8-(QOwvuiisX*8ubBb$>g>}W}8Me3Wb9QrTR79KUUvFl&7cURHZ zsJ&etT!JZHO!cCp9i3#o+^FP6XFIys<<9MhbD^sp-Ry8W;Buh59X;&WY?sHEpr;+Z z?DBsNEVSbnJ9^tO+m1PQ^s%EaXBx7jAH`~i&5r(d3}ADh9mDMyVaFh~Y=i9>LLW*F zQ~8g)UHM2m#;atM9i!=E$gwIPXNQmbLRM;m9TSQ<%∨^ji z>70qxjnmyaduH_P2^$6h=3*|A3|-y8B~Fy36K?dR-rFVZS4 z(hksN+Jkl+QhwNuBlM#r7U^5~m>tLMxM9b?a&|DkK%TJUq#dX1_>;|ZL^`-$mL( zJN{#M%Z}TWJLFyR9x285DG%%z%r%naksa^t_+ZClJD%9_lm)NIXXJD81u69}W%ZBh z^L?$7H+H;L{>~0RNB(HXC%L?Hr+ikuU(}j@W%7-TV~q^B^JZKk<%uat97w7XM-ilO zAf*E(9Vo>xl>?a_$l^e1Rg=bnwDfc;Nl(e(Kt`2ha-eHneUoN&VDe03P6u*1kd3|B zRZR{`zv{?MDMaQW^OE_<{A2-A1}x~nVy=5(CPm1iWHGWhDU~H0*w4z+4wP}=@*?d= z2Zp6L8XPb>ps}p11M#wKJ@q4`%M*Qrmt$VRf%23Bef71dNEfL@sq8=%mHa^I`7Cbq z7vtMSS~Ul%J21e3fezGgpeB2JIZ(@i+72{!pov3&YGmfcS{*e)T?gtZukSzu zK@R-9SR2Y@umi&vYw{XG2`$!!i8wIAfiYRinpiW^fl&^OrjH><@M9Ze>ElRQk@1uX z4osx1T&(XYGu@(UtPa@dc9l3B2sG2TgWCa*T-=hfMw> zAF19WDey%3QwN^WpOY_C{?dUVobPJ~-Z=2qfr5AREg*d7zskB_);0 zQ#qI){=~eH}-ui%tmuQ)t$l^pHCki`}mA%=V$S(EI<8E*ygbdviTq4tUim6%1?UA;a)`ezEaF5wlcHoXCyG-_I8jzrmUN;N zy);=yxqslc(IavlLD$pxB@q_BEM5#WKVv&5+B50kL`O;|C%REOlU+!eOIM0vsn(s+ zL**m+o~pr8?M`9zcA}3HeVtgbC|-X2^<&LovcIYy;KV@sAe9U{sQqI_OR{RjE?&$i?4@l}@a3!smqFiRn(vkn@E#F()QD5u}I6u$ngF zL{xdggR~|)F^$Qu

    tMs!5y%!GzmBI5CUiVkc&+-uaX{PRymuQ~3ox>|+6&3!PY` za{1cM66H%N%bZwFS)uaNCc|nc)<~1dT9t2hVjX=wxq;lMdN(=Ifw%45!elGCjohwk zvUS4_`c5ZyIq`26{Ti}c^~x{m_c^iOiL*|elk2||i60pc@!kjrojAm@!%iHN9ZEk! z9wmQs$}`dQ(c~q!{rrReCwW5UCn=|#kcUc0*1g>KD>&W~jc}vyYro3EcysMIXl>1IRpgbi1Q@z!O z;fWJZ<+|s@E9dt+PRK$&W5ILs1zEiqUaP6TIPr%5RweJ8cu)U8ek4DUpGg^W^8L7- zOSP{~G-|Eodt-nLiCj48!YP-&c@w)}aG|UVNnA+kLNXVUyHMDLzy4=T;X+Cm2COpV zWMwKcGnv|jG?cV1{S$67PC6ITGs!?^Bqh(}!uch7fxNP~kd=8h)tjA?!-Y%S!nxSY zP3BQGd0ogy&rizi3b;^E^%kPMUaA#wp{NVRTqy2B35J=L>DS~!GYs*|wBt{WC0!_` zrYcP-L%zw4co&Q=^m5@B7c_?DU8q1Q=R)QI`ZyI`sN_P6Wm+TVmC5>K6&HSR;YWH^ z7iv*{BCCI!eAGMsAQB2L+Qg* zGTem`%12TLF4IP<#Lv$Kjb(EjIbL=;A8J35O_K{|7c6uaX(er>opg}0Nu4hEc$~OZ zBJbIJF8Ezo;lfH60xkqySfF}CE=+deR~N!eA}WtkVlH_C+V`zJI5DQsXSy)Ug{kyu zs&~2zGnC8Sz+_2gvpL^|Ih48NJXIri_mY}4Rk2Vdi(FVtUqUV=m#N<6vhZB5RW7V{ zVUr7+U6{w)^2j)ATv*G>b>w<-1G$lunw|yq71_e(PI4=`&4uj=H3^j80#PROgN3{3 zyU9H+R1O*Ty0A}G?w5rL>X(8;OpcI;$%Gr)9Hsw8{_est7mm~aAoU5kQYYBl*bINl zmCA+0ZX|KzZx>Fx@W_S7>^(!Cms6$<&eG43x0Y!aT(~IL92fp^;TA&~`Ldil4YXX# z^^^Sy!>i;q7p_wp{iNM+;a^pM(}izbnAZzh!n|L6G`1j=0-_3O1Y8TjTG!E=0-|4Qn``Sja+V| zW+C?GhS>2Gy<&}++oy_6J!#ditd-}V<+-?+A z)8=s_FFl_d`6&gY-luPhf@~Hd3zHHSabw#?eP!kK`A1!fyHUao%SZj(`Sd?MFYU(R z<(kGx%8&*(%2MJy`%sqPiR7-I(A;4L54KF@_`8a-+5zjbxG)S{){TeKFLfZ2F>a zfqJqF%<=Wf24q7wavX@4u(2CW+-T}XGuC%=qdBFmECWBz(SpsEWGgpXQ+_68iZrU;Ku5d`rk|kxiOdpL);jlDu=o;O!;tGM=s|`CZkk7+KoZX$GS02R@rQn zcbMmYH3k??bi?h2#|@J#p5J8{F9F##T9f+}Ol|Epmhm)i%=;9>aZYh5qY;?UJ~0%Z=M^>~LeJ8-KWQ!i`;S z>~`aK*6)!6iSiq{&y6FL{p0~sR{S945P6tl?thuU^Yn1Ec z4LAO!+*G~t^u{|GjCb5PxyyLyq*44rLG3p?o@2RM}sl95R!GBcU5VA(v# z?m(yOZECl9L8tE;4jY-e8NWvOa;a9!=eIv&)OO~Ky!9yIr$g$E5d zRYNsxBM%zWn~+Ua-pm7^dM&y`)wwXiff1?rmah=Rtc9`mx!8?Ce1o zN=FYmQLgZf->i>@t{!yrKz^4}6k5OR#_k@R8e{0;!N-+aPgcrW^zz^rdT+9i%KLhd zZIynm`Azx{-+>+s^5D1!e|Rw1gCQPF^t>*z}VVNfT-Iz~X_GZu7uJv6BwcNy=Q3^D#+o4?Ik~ zD)&)ZuF?V?1U(3`ImM$tq(G($vl;Oqs_J7NOj17CgI|^JZf%rFn zgPF3kSg?#7wo04r!5sQr50+Bqc@SBp&8N#87f=>@u!yo)v%?!7Au+@WY9&Bf`+-hx~ zh^pV=!A|A7JlIX&qmsQI6iusduKgYy@Zg}zfA`=J{V;iiJgRzslT%=|e*DPm7{g(! zwG$qB$SJCN@sk&)Jor=2AP;VM@RtXFdvI1wJ889cntnzl<8Bzv$pN-mAMLyc7nomE zy_YEecyO6=g}kbIugUh|lKktzO%Gmq@LCSz)!MC;WpAmP+j5#Hzw5z0`h5=`P#%)c zJou0D$b-j}CmuXa5VfXHD9;(b@ZcpymN~^5?F~Jz7x}z+>%lt@-h1#tu9;r_^8V3- zPjXH6BCQvn)l`YR_(K1xl5ZZwv0f&DjKe!uC-%w%Tai@dDJaRjNUo9+_u^72Pvu2w zdXY8y-bqK#L8d1&c#+YIO!TZ|W>Si?cp+bM7s;lQ>|WI1I60Xl{4YMY>doUtu3q}u z<@ch17v-22^rDa#rBqE}iaZ!v%8GbVROQ9IC{8b-l9KXS7tX7+O3HX)P+r!Hc)C#~ z8fDZPtvsayS&^(nRwk>EKajEvKYB5lbE)P#5$Ky{PX+11}nS(a4LI%o~#}$R=b{vKiT<JF`>x%2vXswvER{8I1w2rBa zZM z-itFvO&&Zt!HbE^L!^oHcwzR!;+2P}>c@|Rw2^jF!V7KSq`Oq&mJ?y^_iK*V3mI@(M$V{i@jLl#Z@+!da=xlyo)D5d zyx2+EMeZi|kX^X$`(?$wILG9m7l$Y(y*TW}@xeIGri^)na+Lhdi{Dj#OqT7b{$FEx z{o%z4=2nh;O4a=7#a~|h?Zs)8>|CpzQGS*(XRUT#B^M|cy|_gAN9C6(S7h&Se3|1l zCXU^qsr(h?wHI$x@>Z@_>-1ywgBKs=+UP@hA3k}}e4SR@hY~(~mW#g^ zU%mL|MK&L@`w-^?eER8-flTB>G9QxD6Z?>al9ZI1Ki}(bz*6{-hDk~?mFi9H!`-F& z9!bk2oyybuQ17U|p)xW#7>7(gWTt0PHCZVG*J(L?$mv5NHgl2r$lRn1lE;U<%H=+X z`RN5zQjn7H5!}K)6k)R{SxnUgdZVPQ+G%}}G#^SauYNtQv=3!ejlqYq^mvsRDQ#OB z&7b32`VAF)sOUo#AAazmk`IOBjFnm7S*MB1$P3qLKl<>rg7N)r<4-9gAW~j*zLm}A3FKa*@rGZbd@!oX}o;YaP~vo z`uE0eK6LkCt`GBk=;1?8A4dBy#)n=qFCUyujU#>N?L(sV+8~bKhwMxCBm0vw#{oVJ zR6a8=1}h&z8S29@l??Y`gz`j%^|_4lA>Vqf=6Y?c5955W`{3|lysDWXJ7uV`%X)1h z6BB7BEu@vSk+LL1YUyWz(}$=JF&|va-9C6IULS%KAL%Cpq)as>lRj<8hcJ_f%Da4t zo8-e}Im^ar%lMndU)eRohbfe)7&h*p8`x~lXFyW!g9{{VWSV5d|2R< zUw&ed>Rsu>V&zMGSV~`}lI1?EP@eD%msLKjX0k@*YkgQpU$2r4vQ^iA{|UI6;TAIY zZo^g|Qu6`3+kDur>i_4%4j*nL!%ilHv90Ur+1U%fT{ z?ZYAZVIPk8aFi}(fB5hl{de*hd0h3zeT_Sz{3PX+4}YrUFCS)b`A_>GvzWWsARHk- zdRXv}59fWjK)>k2CCWzDCvB^rs$KcnfU7=SlkMQg1V66J+WGLohmSt|>%&dClKb$8 z6W)?*pbz(axb4G<_1YaWKAM-$JvLsJ-&(UYsBMjE8_Bb6VinWR&B z8b8v~<$JXqxGR#lV9kIc%m_;IbEUYU(ac9rMw9XnvIQqr4v#*sMfWR5gvC##L5cg))!}@S`79RsNG7)s$DK+#asg@}ssN zvdV4zsN+X~Q{75otjmIWe$tsj*gnoU6=2US0j@=0|sS_3)#Ys_E(1 zKgT5nzcA@d_93rv8T!+Q`Z3Ip0rY|7AaXD%lMnHu3cpJ=+>a4{jPheNyLPA0Myi^t zjkP5P_=DZn__<>S!}mGLtgPkJ*%h8}&7sOP@#1Cna1!ah5SI_G5`3>-<hESpkYzeH^FW4naRclfbaRqpg-7k#%%_V{s@6YgWOU*!@W^5d`{MS>_A#1TJ^ z%0Uvq@Bn`E<9E4s`SI0{V}2a>Phk4Jty_Tw#+C#vQ-<*6UfD7UieyG&j$*nH{7 zD^>ZL^2QJ2rtd!&-pMk&jhC-cOZ^8q>R9ke)qke!c^>!8kGKE|2T&vc1oY)e6F^!@ zq5u*H(7vxG-_A(FBxwN2D9K4FPC-dYrV1c6MLyy#UFiZyA3$DJnIWLxk|K8i8C8-g zfXo48VKXb4P4;p*eHpT|nS;zpN|-Bvk+t+KU~i}83E*N5O(Y+C^OFV0f@C35iam|> z0gDFEDuC7uiv>_TfD!?e44_m1bs3fppiBVO>4pHxQYw=10caE>DWlcomm(?7Koyl#4d4gmKL*g`ntoOMiAgn;%Tp0+D6bhnEqZOTj><2$Ks|bWvOxe1 z1878VrfM3?_{y6G;J)?!|HaJ%Xrc0!0mL5YhtSUfv~BFU=q#;){k0dx>RB0iWhgd8ffm}-=8gd6|?JPP1(0HXpJ9l+KAwsFicuuidG~_}0Za_Q6o8rGrT{DfSOb_Ez%(Yd0K5VC0&W%w z22z$}BSk(@aPqlvvux+G+7?p2SRp(5bxz}UDG123;IWgHR|D7;!0rH!1aLHfX4#E< zTH*c88} z^6LTIQ2uWKHv_oE=IsFPtNcy?ca`6xK~b-_$a(nVHNIL{`;1t}(I)kt2w$n>E9&_^#{XA6+x%R=tHN zd4kAG$w%fV3y?B?LCTrUT49x3-K-T0qIeLt5bPn82%=;V8A8YyLa8812XP^Yjn#~0 zf-nRzIf!3_C>un45FLW(7=)#hW(=ZX5RHP+f+!b6d5-*J5LJVypypCBh)T*U2T_Io z1NnxVLYD2PAZn|cYLx0^jUZ~OyjBoq^=YL#LDW@wy&&ox|rwj;UpsK0AMH@sPtdb!?9Js7s0EaOd9>fUB zNOBxGiX2Uj31Tdz7w07tjt^o2lZm7xU8=$?J2VKZ91IMDLD(rC(m^^&7wINt+LN8& zrTa)f8Bo353+U%gh|Mq=2_i~~shUYa%;uh*62#OX)~_)f4q}=dd%KLwSu;I|8I+mi z!XReJB=kAt-b(sh=F;bp^T`E4IMrG&VzQWALM{zr8AYa*eYzrul|igxvO(q^l+Rx3 z!>%FMlIzIzq;$z)yeYwh*ddn-`WDr@m9mZ8PR{4T?4<7_cagh;*h7&q_sURenfJ@S zW`0oh9->4y8;=BWG>G3+{wL-4AdXRvlYfvW$djaue@f14HU3{g{LTC{d4@boo+G9H zd=PI`{ly?I1@RBNE(eh`q;H=qL0k>uS`gRex~itS5yagf?gjC$N^S;mi+)=rcjRib zRX_gk2k}7W!u%omB#5U${6~MJ>L1JXhxIbavmjnFf3A98$c2c#uT=7ya_NNeE#)2g zUiHfT56_d9X-8D99y+aA!H7rX9&GQ$Pz-<5L$-NDuiqyWDlWA2tS07BZQnGlnbGJ z2#=l^bA?bSgu)@@<~VuOXn865$owG`PMcVlEyvfJx}=O& zFN8a_^^qGe8NWxLMI+VQn9?MKrj%x6bFu{~#Wn87wdM+TR>{vHvTt-c}K80QuQt^u5XahAzb6}IW~lG z>>5v6LzqCB7=kGTGu=YURByLxS-0t9$}3|gqay@o2x~%E8-gnYcL-BLm>Pm71aAnj z5GIA-Q`1H${tyBx35F1&hgA~prVk#KgPezl_+&YXILBXEBM(GQnEN!@o*^s@VLI~} z9W@NdYpa$FJ^NIxs+TM!g9(AawRF1t3p^! zKg4@stqWm&2!=4qhOr@pjUhY?;lB_zg|L}rXF}K#!dBU#A?yudTL|y=8JlyxwkM3K zM&1#^PWmo#x617Wu}>zfXZ%ei`zZ%PI7m69^1~qhmnKH`D)*V{E|NsBOAhEbp1 zfNU5>qc9rNS8mr1b7`Bf*))u16j`3;VLZO1U*hD|ieU$`HTiQGZB%7jN;|SWnI#=M zQaXjvIgBp!ZlsLXH4K@rNcS*$gwd1vFJv!OQ+y11EAJD=Ro3?pV?Y>~g+#M3FpNQA zl$?T6Q!qG;Az}O)!;~0?hA}LR`B5y0Vt5!M!uTzM-y;|q#;7ooMvyFm(P4~{`Y@)1 zF*b~GoYAB(#;ZB{!k7@o#4t=@m}TyXv>gA_7udoAH)##SMzO1@92935E|t97u6gKQ zmB@F&9wyfOVFXkX3?oDjlMymX#>l2gz8}w%y_t)a8CTD~( zGmKeb%nqa9|FlD4%n4(zZ0#^sv0xs#gq$D70?I;i5h?4qIE)q<^v~@qRmn2S@-SAY zq+21Z4r5Ii+rro$##-i^$aUm;asw$tZIn}h8*sBqwotZ)(P`}WwfkQf`&93aFm{Hq zD~#PL*-P0IMpKR>V~X!*cz`^pD$hQSJ4`jr;1oMdu} z{8RP*C8sdwcv>ZAC}+bsr;_twT%cc6$t8;1EcA*TJYjqY<6{`t7~T%!P8iqeH^_g< zo8&E0mg@cs{Rh@vIR{m8FO2)jAB6Fc{+~)7$+5vtHa-dCX&BE`{+jZfd=bV=$}82| zuovFY-;(dh_o_E8G4M=(|Mn@2&$7G!r+tytS!9^U_p4vS`1b!RBS1vokBP{{q%@OI z^3F0Qk03<^{UYceLCOeHMNl$=QtV9~L6!)zMvx|gv`o@PkU@=*o-(ncmQf{{BFL5S1nna*L{K(@dJ)u*AU*B zK(9hpBrB1XNts2fD)@o^qe`kq@Dsf=e;8F)c@0X<2x?JklXX;Y-3b0%tiP#~R|AF( zBUnD(IIVwtqX-%^X+pLno084Q<`J}@$h7-2>N~ep1g)9;Otw+IZ7K3_?G6!ijG%Kw zzrEr0Pe!?Q!X0x8QdF#?lvGo@=0SSdErPC7^@DO0&9ecu~A6tBvC5%}o= zGN|%U1jTmfKVoFTCf$gSMKCFX1#-wmFgb!%225w=ujCXp)zk>4(d9vJGOfI3usJh= zS*m7s1ap+njbNVg`En*6(JwNKn5>RqO$3W0SQ5d~2$sp7;_@t4^(!M-p*-O(G^--t zza_mkf^`w>i(r2QMfs6<`2*tm2sT8pk&|qSU|R&+BiPL57ILc^t?GaLPhteSRI($2 zoyz~Mg5C5zD%mT?@S5*O^#R$50R#5vD{_zphseX^kqC~esj{cRF*(g67!t+MDE^4x zL6Tx_HkP8u0Fp{n^$uAKQXcZcy2lgH!})tf0lo=5N^f{#pIl5fdZ2c-nR zq>w9$+$zr#MPB9kqBzR6D;PzgD9T4sfn9~8C@nMP?Q@GTDM}WLqBx}lS&}S8${bC3 zQHE|H%c?v+3L{-3%c;CU15}JczCm1%NhPv!6jh@5fnJ0Bk(BYPM)4E9no6ou-kp!H zsghch+ELU|N!=)Ja2;iY`cX89qG1$`*xNLUW|YQc6Y|Rrt$7qJqUgY8OH!t76Gba} zYnA*QMUI{N9&D?Uc2TrfE?phzomA2}ib4ErPd6s=!H=F%bf@$lhch zQo8y^(JzYrvIo_jzz0MzkiCOc&EP1ia;c<#SQHbYn8>c-QH+RUB)wBQ{XiN;A5D&l zVk~7GIi8f7q+boDD9lmJj$#f&OBB8+{87k_F|AS9D0b38I!PBPHSQ=pba{xFH;UtK zgM@)7g0kfNsFlnm#F1x25so4fMU>6SWQ?3dN@WMG+OJVeVKSARrh2E#v>tsM%4;UW zS#sp_?smz(#m$Xko~razgZz`Sg;6Y$qdJBXF)WT^NfdYG#EfET6w9L68^yjTmPfH7 zij7fhiehCHtD@Kt#jOLz)lvPa7VFiRYba~Ub!6uVilMNPFeifzib zizwd_#ZLMzl^koNFYq2VClu87M{yvEGf|w4qR3Ih!6*(zahSc^pBRr&j*@R*=o{oW z`tPJPkIBA}9|2LEVDcAvl02nq{)}QR7yEA}r&T_;IL<|JK8j0G{1e3m<`>Chtba(# zTrNj(EsE<=Tv5|rrN~z)Z&3b?;${@j(&?*qOV!+=+>WAKTRk^s)c-GbKZ*x(QHmi` z3=gCDFN&8@ykg}e^06#TZT)?R(53+aWTAO z_@4Ygek7&lQxu<-e~IEN-NsK!B-^FWS6+xAQ4EP=NWx(yNfkpp&WpA+<3hdIV?$TDdw30EDilIpi zO=Bn>Lzx(=#ZWy4LkwkETs4OH7>qIOnSdW+&=^)A+wIcIQOd`@zjvz0W+k#RStTJU zukV^4V|cwI{_hG#p)`MDSLT~>*GzFWV)(P2zV&LxP%DPo?5aab*kQA=F1?;g>c`MP zc|%I07#gc&*z34vF*J{%e+&a+Xuyk61)a&RWEb*wQ+?IC(VO4U-~08TH!Xo*D3i_^`^3EXe3v#XhT-%PF_vc#xRyLjvP=4yc%wN63%jf_xG6T$PC7^@Dbu>-DCObmiNVXzM}|m$3;|UcjOjO*kV)hf zjv=D*vc(WnJ}HLD$}8G2HHK+1G@6XYlQBJp88O%W0)7itr%{{Fh7O`a^%GDS4{pti$yW4mm^=U|7!d-F)WE;DVxj4)#P$=1-UYY zRTNp~;a}tAvEvELzn0-Tvg=T6jA4@;KT+e!7&gbSC5HVm9Ef2n3wEjzw#Ber`Tt_r zpoY`v>`CCqq3Hq`6PYkD3<(U}HDnCa#AHxO8MU`KQA@A<*+vGCCD=}Q9 zTvIjIW4NLGUs+&!$2Iz4Ag? zc_Kg1AMw9ba{Z6tIrA6fOY#-@nv{9vO@wzb4E$ht&*a%heXD+;e~jT%44>(kq;Cp& zeTm^KlW%04%9rsidZI~4tdb;?kW_iHNvN#0NysQ>}-QA13 z!~dQId*+|XJoD_e-?NXOc32!%RWlh+$S*v0~RTh*p zp}d;5f(aGrmB>F-UfG2EuYVjlf0|H}c{Q@Ss;NOa%URblp*EX!$hu@bQr4(Q8#JId zR7oQf8q@zWp$Vm_2`wniR84c)*IV>szNJc9nUI&s-zKy*VIcE%WOoyKn9!cS^GbXN zN=FkqQ96?{R2LJvD(_}O^-lWuJ(>KyMH^tkKlEN?Z&lfc($|E3D(P=RB`%3Eg*IY~ zHi&tx5r)AO*A{IUWwfdvZo&u?Mw+l^sj;lXc(J>2lnGnA8!H?$j$zGMRoVWuVS))0 zO?Y9#OA{uUFxiA-CLA|miV0Iq*k{6Y~G^HFkz+~115w`n8k7CnP8&K zCg+fIO;}X+#~Eif!6}z_<`xsI6xkFuiroZV=@$f_34WCXOb9CX z4uh?PF=E1c6Rr(5MooyBFyDj)Cahx3LRGm`mWsZZT%vOM`4Sm_nVg|aR;YZXY?<8p zUR%v%4Y`(Fr)v5?kK6FwP59S@jVd4U#IQ*=(MZE)CRgJ}~)6O0qgDKAX^StM-M-SMnPC#MOMq)F5G2>Sz$;c$CH>nvuj+30p{oeWrsmwV2 zT7PMjo?&V-jTvdxRO!rU!oO%Tn32&8!x+Q5x%y==lNp)K$ilL$X8DGZF_#(H*vwAm zP$T3t|M&^cO7+lweS993S2QE98Tr`EZ$?Q<0W%7kQHWmDjCjiLWMQ(1ECWTBp$*@T zF|t|042@EZEUs!sm)2KPzKLIoNoleSS(YqEmM5jM0wouJzM+yCf3R8Ej4G6>X4F)b zf0|K^UY)F=@p2)7z-zZ!^wtFH3zphV9MhKsxFAlZE6W)qAxsme37#^uu_$87s^qXa+HKkv zGq$qpEV<2$eP--8W4jqU%-E@>+C`a>6uVWj$BezoHxoN^oKpE|Ig*uUz8ZIq{*}+y7tOe2#(Oh9FuZKWe{#JI8m^de zmB}?TZkTbCew|GCCGHkQW^~Vt+sf}y?wWCu+faJ%oAE&PKBT04Z+K+JV>6zZF(F*^ zja*~5YftIVw`tGJcutqD7iPSqzan3&yiG2B1>bVCcXIr1*Z25GGd{_6&w^4Gd^Y2Y z8R;#^V8K_GRo$*7v*4Q{@4Nk?JjX;N zp(jW5nSxA7rXo|5X)H)a-EneAXDHEqJ+ItI4E{1!XDaET}>$uPQ58P?27V{6poHEx5)zwpC^FCs~cG zu4-ynP^+@OgKDXywgq*R*QGpr7uUdoh8Enm;En~2ENE=OVhfhYzP=Opmj(ST7+^sY z3z}Nc%!1|?bmxT0cW5mvX!+d}8WZ0!w6dVJ>>~?0=F?}|kzIe2ZOL{Pw5LdK2Mf-Z z&<`PbbYj?<>_T=WyIJs$s_DU`rzDhKWN)$$*_V{j`iVT(haG6aAPeSMV6tGa1w$;D zWWi($hFUPpf(fULa+3-v8*afkPCJ4eNsc0=ceDj#l#jKbz>XiwJYGgn`9uqnFVcsa zqLS$rOr=jFt8=Ous&}RZvy{)K%&}muN(z^PnI5ztWPyclC2bbi<>*zF9*UE6S>RTA zvo!kl_gdg%;#YaVf(PyO{@QYZVQr)HmtB*h7z=ETxaL|JHocs{O!{ia^qR8?r zPowYLQjYkOvgy9+uR>2-aEdO?Bj4iX72_EepS9qe9KiGoawe(~E?RI&`DF{PD8Fh! z+xQ)E+UB`e(1> zo>=hIf@dm8Va0O`URV$xZ+vM%oK+wBl?AU^@P_gfX}VUm(^`>^lAg>=W*{??nXFh>=*Kq9VntSl*+>~SyA^xu=;Piv0AtJN0EQNFUWmAHT2_MXZ1W2^=t3QPhgGHl(v5-U_1?eXQtf zg=R%DD;itzmlegWC}BkfD=Ko3l4Louloh2ZGHe-2S+YB4TAsf3rJ<4)e^^nE&B|nG zr&h;`D)g%4pJX+%Iw@n;pwzUYmP%?Q)6%(zPZN(fbCaL;aR!mktg)-HOX_V>Y400wZ1Fm`+S9Pm?OwP4po)so5%yQ)H z)|xsDrN`>q-(rQ;ibYn;+O65Fuv<~!pm9_ay~|;R&kDa4PBof~;2SH3~kPDZxkUnU#LO{%w4E^M)4s}w7^S$E-N6@)K5^RDQ~e-Hm?KoRx#wii_+z zXT^C{bL?i^CHg%p?ptx$iYr!Jl}oV+M)jZhYb>~K#SO|$@)miUyhF;8+?B1gN8i7ZSJ8%o$vlA(btD$fEo7;VtlEJjLY zzjpeDDsDr6HEk&y%Con$swpGurM#RCvshVyNktpvP4i0suUAH^VnaQZRJGwx8>-n* zok=aS23b?p)Xb0C%Inxrmybo9ODcZ4rh)9fb=tl?T0@pKvY|2MFR}^Ql$5#W%a0cH zPGn0PT2Wft(AI`_^fos9O_BQX+yd=w=*Xl4`OTuY z^t9n0*(Ns3X4s1yWkYXD9~=7G(2qWZl&SjLFn~T#C4+1jOvhgRSQ<(nMh+)OkkU0$ zjuzI8W-`Wxu{MmOPf<1FDHCj%NSUPa$u?}NqK`k-hARB{(=>KXCufi|ZK(C9ege+1 zVXh6%z1j*n9`pNd1i)>gxUr5T2OUi_cRqqnYQX7`3WVxJu4fL9Id-X$T zwGC@zhuU!0hPABOW5Zq>*4eP$h7C-%exFv2@UIOU>6^&SD&Hborl)?KY*Wd08+Ool zlDo*=s#osqw$FzBHk@X1zy^6T9lF_g%7%kB9AbEwJYmBTHPulYj?s^+Bn$tBJ!wN4 zii{vnYG>Gc)`oMG^EO*t|$yA}^D&*jH?jAMq5C$DVI-*HwN)a{4Wm+?HkF zUUl_1;h)5J@$t29}L9KKI;?bFIjjUChMm~KZ!J1W^R&W`ac_`{A? zcC@ymvK>{JRJEg~9ku9xlGVuScGRGJzq^_&)u-e|Yui!Bj=Ibx`HNDItWP$uqamdc zDK(AlSi{XF-h^ROJDO3NlPy$bOFNFTvW*>o+tJ;Q9(J^~%RRRZ?N}3$b|$-!GOw<7bW{FqpVrfkf9(1>GUvhLRpn`2uHm1`L%*inYf$#zU+%_LR% z{WcU+?3l{rFP6=)W2PN{0<5h=Y-?#C^mFC~|$e7P(cYryZN@*lfoZ)@&!YlH16_S@cs(9;x|Wo4kj+i@7Ab<#dY}_SmtP$v$$w z>TQx5hv+BlI7vB79+Bf#)f}T7mtDiRn`O*Xaz$l$TGgDPoF&hZ=Vkf1?ibm-WXEO7 z6+3QGWSpy%Yvgq~_9!=1@9N&#ZRK|;GT?p68#~@o9@z2Fj{oS7?07|aOglF!KJ zf{?d-?T*B8(zz@m4vtxL`@WGCcl=q~3?er6C;vD)J^qKyJ{7OprjZ*e%+}?Eh zzDVehFVvus6OEnt*?~k3EO%gq1Bo5@#esVVw22P<>Oc|)(mIfi!zOhgxdY)_8R={&1kOga@>&4is>pphLc%Z_LKYvpbN(ft(KHVlyw9oBWNG@$)!P_JF=H`IzKa z`8wW+yO0C%4j3KSWWetZ6lQM`(m)nf_4$fJbD)@v#-zB)%TP*?B^@ZG^3o18;e2J* zANYBya_lNkR&b!As;opA#NsLrG*Ed}2mW-Rngi9D)Ryfq!&rk}ldPpGKV;N*YaIvb zGO4HX`VP!f%g~Tv|D5=X(wuBUHYJ;pGLHNprm%$rEmhLWfyHW^zZv#-K)#>V)`4~o zw0EF`109+FLw0hYtD3emrHcax)Ck=i=+3YQ*;7?+;2!DaKyM~}$iAw#pKN))$v(h= zfeZ(cBgw%I3{jOs9rCIEAI}uS9T=hfNnMPhk0!^EW65#kcv9AVf^2zy+hURflO34i zz*GkoIIz%xX%0+xz~g||ff=lyN6vKUU+$hopRLB3BO(2#gZdFD50e9C2P_P&q>HqX zb_X03Cn@z~_%hWkb5!3Q_OWZe1AbK#a3Dwzkzq1IMoAeb=0IL9LuGOi^CjeB^5@$I zYjP}gz?KioWS<_?MjzDvzGhhIz$yn4I`NYes~uS5K#D{9x~%0?+Z@>Lz&iSRasw#^ z|8wA9`bKgSxtZKTO3hXWo*dK4xY zeCOKFEq2L)%j~*B-f`e6=){R3`te^}CFLn4$dXQ!qLe1fkY&ko zq)fQy7kz0fuvyWGN|Zmy%48K%YO2as`dKfo?nDhIYCBPfT{X#CWSuftnHE!q8tba5 z8aPo;d3`73L*_Dq|B%*@;k*{wUrsb}VviGhooMPrGba`}vCxU;PPA~MmlM667}`f) z$CggCa-y{pZ8&XL@^2?PQrbGP>5$frF2(Jg=s-Wqt=Ea(ne3u!YX2|(b1zBOSh4B(xH0uOo!VE51V1q>qJoX`Y3)U0xH?n zSKnnJHlOnjs}XvXj5#r%l4+a1g%>%oSazQio1Iv~T*Ci3vDArWY%X^q^RL zs3*piPONfbgU=w3)lRITuO-)!>s9XtO6EGof1TLK5zfV-{Rx9PYs zHl922!ifehG<4ymT$bf}=t5Q(UOVwdF32wAeQS8@#5;Md?$XbQ_nh_{`9Y2Ik@Crj z&y+7J|LVjgE?69=mC4~k0(wI7CzXd&AQ3&WO5PmSesv*<3rU%zA(N5G$rNNtG8HM~ zr=}!7qNSyzb0IyYKw*91Gq{jZRc4}OCUb0z&*nmQ7s|R&&V?K<WC_$0Rk}g!|n59)xhSKSXR^EjQE>vSP;l}u9YmF6EO(n`7WM#673sqI`pDs+{ znAKHM!-bmkT4Zgqjtg}u^~m}z$WM)A8Kwm}Z6g;NyU^B!cCu&l=--L{%Y`N`G-dIF zKKl99jNaUZ7A~};|4m9)D;HYR+o)u5FMZ3%{%SABVFzqJqRCIObWpt=UFbybtdcI2 zt}b*_$+%wV>B2uQ9CG2X3%y+E&922R^l_oD3oaMjF7$JuzYF8pHGmxC!eAE$s&V9B zVMFM{$)V&h)f<-yBU~8i!YGxDcKx{5*%&5c$#JUpGcduWe}rkG3zJ-!EF0g2*)Gg+ zVJd58k<(QDbQfkQpXtImZtbM%(-d>rWp!bmsxi4>R&H^jcJd!r37ZRc<_^{Clrx>9 zc~s(a!Rtb^-G*dGwJ#?Peis5R1YHQZU@B?Me^ir4SdQ?cTGWLIMO@ZJ7-Mt33kxU< zRqrAfk|)%sUE;!07nZrO+=U%04apzHt&mf!7`AZkD_vMcS?$6G${KPlxsF^<%2DzC zCGP)R_?O8>a+B)aEJyDb{ld7_g>4MClY7V=F6^Z2B6pMD$J|TbNA4#NsNRFJgZMcR zsXQWAMHk+5K{8_{l9Fc1409es&{~8zsCb=|y5UesQCu2c$aj(v4JZ6mi4gMrt?GxZygg6>#hSPE6}Y4mWagj_KS; zPs!j$MmI9iWl6G8GLu={$f|PBANq1;XH#ytmy425_2zctH|2TU$g6zxQEii1%kP%Y zEoZCBnOdF^LbR<5amPN7)Bqik~D)clB10x zN0Vd7v82ps93}cBe&hv%xr%Y38b9G z^2eZbomBZLSx)6=+&HWJoEz0S&PA16l7;-Je{M$}m)*Fc@~duKQ-0lz8}yqhY4a%V zwi|cY>@`7?+sk+2u=klfB_FtP`K;lg8~@1y%-6?%#Qd=vPblAiYw4MsX!DKoc<#mv zJjm)nP7iWN>OmJ?o#NRvk{T)F6r&XPpoB_tw?b(T%6PERgH0Zk z^`M*wb3K^nL3s}1@Rc{*)nt9Ni z%@!WCQh7@cG|sd&lX`R+`EL)}GWnjjr*|Mbl2X&j1MAWsXH6G|((LX*4-W=;FxZ2h z9{l4$KM(qQ(946~9weKnKS_00bLrzjUp1O^4N!i+0tV8@vT_K0968j3+=~pu=)=ho ziq8f7v$g`7$@2^ywTW{@+$YT4ymus z5rfGCvj>YkSmJ?2Hj4*A4?-Rs=F1qH2X+=aNdIxoNpX>GQpWLk;8pJPz^^>u!Iqmp zUN?prF7hBkiK?0yWj?upTu9#Iipyd&E`y~^mdmcGXk6yOhU1#Z3J+E?U*$o%F^0-% zi>_vK4Jk{t)`NBQ_2h={x$6DbgA?3Gn`I&8jP~G)2U|VZ=D~gs4zO%HxkJ{7f3{!x z$+(lrE)RB7_K-5Ky_9|A_a6j5NI&htA=#K79AWdM2d6yxi?pL`9`oQhMMgM5sliXV zZwngacFh;f+8GbddT`Ez^XxsI4Hqbv)KnMcs?u7&X3FDO5?uA*n!Nh;B8eB*J-ETL zw;tT|;1+%8y|~GDjA`UkWSMc>gFCWGzZma&aLuK%gNGjc$EhB9 z@PzW1l->n7@KpITIcA#ar~eBkFUeQrYgO~cgU8(3?>u<#!3PgM%0*jVw0rf1|K!2# z$%cepd{*^eC|^DJMu}q?NU2ZYg_{@ZpS<|lt4}L004i@Wh=j6fzj)E-mEp`>gRPKJ zno^(Ci!@%O<>bl8AlG3MSd?bc#+YITwaX(RUa+c37wf( znc0ghYTB%nY-Dya2bt50@Bdztsd9Vq8^b)LBzY-wlc0bXiEyr??neMDtb|g%|E=TLa9tvKcW4)!&udeKfS2tMe7^!4ZUdey~~RlUeu)5@}fRP zmaR6Wju&-RQcsRd-V3(@lZWT@gRL>WCHWWGgp{tPUNoaOS4j&mUf$5BYQ?0rY|<%O z8~Wd5TUFW4i`WOfGDkji^up?e&5KT6boQc)7hSy=u`A$W57MQ^tES!HbDrOj4E8DU-dJLYb=aX%Ul*x7J0E) zB}-&pTqEgS?!{^^)_Adky(`I8s=M<^fWcYAaTfjsXRwI+@aqk@2UL0>^m-J?vvU>FNFWeG4>!{!$&VZ$(5fq@ae1b zh5nWNM#eFht|2iTqjh_WVts{1+em$+QA14Zo^92_>ly$tcNHp2CMpC-pNW zwGU|+{_aCsAGRb#79XM~t8Sj^K@wJW`O0!vpEGy3fl=5T+vLY$VBft7u*@r4VjQ3%J4^@5m(}(Up z^zfmY57m8W?89F^)bQ!gjC0BxYf?_1)N1)qn}gKxp`jYBE~TCi^;Ob9wt)I2g+@NK z_9g6p#`NS`L_?PD6Pphq%3obJo+YW>q9#x?NxqQ)ANo#bYjvZ zncnQ8db?7(k-k>w>BB!hjPhZ$54}{)13ugK_MwjteSPTXLw|M+^I?Fh8SKMA`XH6; zsf;1?p(@FiRiE{6A4V`4sq!t=F@`?Qhn#1OW9h4V=*9AXX}FCOeVF9KY#-+MFxiJG zKK;KLvsgBj{PmPJjWV5-31?7d`tX#8O`%iTpJC%%AHIL&TVB@MP8e#Q(#$?sd|2tj zDj%$zB{rR!Q`#XP4$ISG0I35w;=@rN41N^#(o{cY zuBrUG4>y#5|J&p?n|FPQ~5EP z&oyVu7}NTZRc5y(KAoyh??(pZ87Z0k$gGkqer)NlA6l2)S~!a_hb-Y~?bt+P0Y7re z(v>#(AWBosFaXikC@v3HmA1iox$ns2LIGLP6 zPW5A&s+{h}epNY(p~a8cs&|ebbLsO)6KPhxH#woz4;vFZ=^&k|#^uKsmU)tl`N$koFBiOvVvSmt|Dcs)qbp@ zuO+`t*Do&{#Qiwn$3cew`Y~aLVIw`X*RaWt-1)W5Y;N&ms~_9wGU0ANw$pczJ5|2R z51CL3_NZj9AN!Q=r=&ll9rEL_AD8{O;>Qs`t{*WTm5aYzmlhZzN%hOcaaNx7;{@fT z8sU^5r|D-@@-i9D`ElNl3rsGN7s&(<`J^Uy!mov^ays~7n5ZQP;JP0-{CMog6PDd1 z@A+|ya+|zE-X&#u;@=zY(;tuz$^TUEBe~e7*5~!qk7o=&`|(`$zVqV+{iPqTD6jo^ zOR1Eo=o@+BJM-hYV`zT7Xa0fwNXoFE{76^-N6i;`7GVC3j0^mDW~Y}Z!%N> zRRj1lfV>>MB$+RO`~ei8#|K~xpdh_a0KW%Nn4T)DvGPJ==!{k*00R?Q;GzL+nCQz0GcytL^dY>BAbv+ zNvUiWK#`h1j*S)pv}E3jY)!UNm463NQhoofT>$L^=nz0h)!QwAPRct|x&+WwB{|>f zOVvGq9s%@Z_)h@6Rd25VE*kW8@1v5wlnVol0|FQr!1w?r1TZLo!2z^gV;CL4kN}1T zFf4$b9}MZwYVl{aZ1dxrpD{{vIKvSEjHF01iXy){F-DG)L&mYPVEc{ZWW%1-q}k`J zHZg!n0fYmHaK4jCYXDOMm`a~UE;y@A4`4Ra0ufIWcCnKefMep$S;nv*pyRp}1EL-&$CmA4;_fbt+EM9S;WXaKPQ?gnr# zfcXI|kYhN2?E!3QXIvP-29_-fU@>J0xhjCA6j`KY0W7DlP|3;wZg6Q=Gg(8fCD*B% z^#LR}^W!@CzX1MK`9{hnaAG$2C$E^JAgeD`S+1j z%42^3Cj&SYzyan512`1GVY>7llfMF#9}VCGm-)C#P6UwYoW9MqbJ}T!XTFm!O69*m z=L5J9z%5mOF@P)dODefck^f)GAXn+v$m`^d0B%z9cK>l6-45UmlkXGWr#}nec>oXS z4@nvAzW^R7e;mLQ`csw6&xsdunxE5pp3^=sd>Ozi%4_ls`IdY~%9!sdi4MhoqLF5jiHUAHjI*2quqzz(DQ)AAc{;TU!nU3}8 zgUAp>MtY_ovQeZra}ZgSXAQ#6U&6}HB!|lXttL0RG|Fhd1(7F+B0(5rMjm6{AQG?D z51V|f%&+PT1W}M)i2PmUg@cH43lwECb#Hw6AmUZ8F$gV)VnGyVQkpD5mQ*#RWK%TP z_kI~BWmR4-h+Q06x+(-wQRS6__=8@VtfKOx>G5X}o?^yoWOZ`YYJ=gH{%3M6memcS zHl+^Pdb+;Z{|D3y;wI6Dh!OOWD(P`GZgdc1 z*c=1~=V9dR6WV!mm8U(SkvQg82Sj^>7do)f=Vkx*At*6cz+g;)1p|h=oBclI35d zEoSeMAa0%4K69LV4VmeJz9Q@B>x0-pX?#KJFL@CE2C*@S zO$>Jgu``IxbeUv}tUG<1O18_!!Te+pr-C?5zo;tDP|lL)f;dmPpnB!gWtW1u z%;pt2vnW@|YvgrO=6Hh=eQCTE#BKVa3)&sZT~(7^egzH~fW;%g8)QX}*K^pgl7BnaVM2=7Bk7{X5>^bFyj5Pl9JQ3!cL$Sc?X5Pk_ESBTdc zxy?%m$wEjTLJ}rP$%hxT?;r6^5ke*=DalkJqz)lX2x&t|&!j;WeVlZ3`A4OA26{$P znw^ttnU!Y=AuBzbO0tKLgPv0*`Ts!f5Pl1x=oNj9uFNsczZ#b>g#00NQ#A!bFovM9 zSulh`D*v5Qm@E>4fl`!=CuKlaLVbaYh44oR|F$$151~W|B~@=3N~sV^Q~t^QV=I*n zp&XO)WCgM!DWg@A&5}~T|8V6Hs)SHAgg-<0D}*K?R12Xx%Nmk3$hslaRMXZ9p|a$4xezl?_F)7M2FGnmgLWqkP+ znBMh`SKh>znW|-2tj!C-6@ohi6APr?9D+r;H3S>oPC8WX454@}eQ$a~@G=aMKGILt zZLJ?*fe?ahe*d>~m>waeHyXm^qI%ha5Eh1THH2%jRYO=D!nzRFhmd=kVMz!pLRc9> z$BWw15XL?>EDK?INWXoYt!I4u=f+hbtPWvq2)>J&{NmEMi`tqHE}9G-s%wqU#c#Q& z$xUfC$Q(mB9>NJZHA2|P1=vq+B6pIT$t~noa$5-7DYB3|Lb!ZUU+Y~=c9VNl@7@sh zDPNHh2j~Y?awvqu^dsa^l^+Y?ph+L|r0md~=$u2l62hqvPP5=l2GXI)E<=9x2KGg=8|?jgc~8e4&hA*H$%9^n%l+o1LJlG&*jK`V7wE;UFOHL z;a&*$LwLZZ)I1EKRw{k8|3Y{a!ef;`4dID$`98%nVVWbb^TL^JsqzUWGAPM#tK^gWW6$=MJ3 zmA}~~EkhWY!pIy(M&|ukBhL$2!pO>`&!PN_~kiO43V_rB(j5t-fKSxllfg3JiOY6~ky5MyoL7zH^nr z_#=$UVN?mDY8VZ|XvmsB!>C26M#?zVDK)~Vsge=Avr}z0>x5C4Qcv~Pmvz6aZ)bTl zV%VH)O#T%{6G~H3YMO;HF1h|p)Iufl-ev1B+JwU!oW{JTs{Du2D~#SM=@Uj@<^3rA$pPfRFcxxzAz=&+ zn2heJVL2jQn@? zqj4geB9p?HOrJtNtf24EY4qvjj4)=(aWz_>N*=Qqrqkrp@;}b0xnax;!xV;DB?&v} zU6wGcDzQ=QVK`JG_ZD`C;Rz!c#x1UBX#XGGXWqyo2PM#p8=42RIuIT5*nJ~_V@hFVPVVskT zKp6MKc)+p?av4%VAuhTqUoO*GU=hMi_UB>x*%V$!(S23FEHvdtu0}A*AM^ zO8yHYm3(N5$B(O({@n3I&RqGC_b{G@(Q}O9Ss2g5IKDrA_4asaz6hh#DP3NL@tT9= z-ePzY#@jI7v008^Y?pD~hw(wp<)fSeeDC;67+>Y07eSGTz8K$FkR*aQHW5JrN<#A2 z2!4v-=Lkw%(HdRR5=HbwJu$m}A!P))=jVVc+MFv|QYOhFNFG6o2oer8WQrhj1Sum( z6+voMFQ1{6snSG{Rwd~u=_AOXl8g}yT%n&(St7_9LH-Duchs`6HWMNpnzA%cpON)h})$#zu> z?}#sPRgyh;%`2PKoMr_KeHKq)_s{Iu~lL#J1jZGtH#<1+|cxg7Lw@~#hDXqxX5wuZxTtc*q zpnU}92rLnFh@fKxqaqm1f=&_q6G5*CI;;9F5p-4FErRa!9%N6IALVC?dPgugf^q*d z_F>*v_4bRPKYai>Q00Rnn058XbKDSyL&;&}@CZgwMv}4x>U6=F2*yS*o5{Ec#z%1I zsx~=-PtOd?IMjp)Cd%osK7Nv#O78JEMfubSrYWBu!3_FLmCTA@F>ikL;GSVl1annB zF9MVD0{l{mRgU&++TsXo5&4&H^!1>MSjKD>4e{X&>?%JTA4n9^!BJf8L zpa;nid2Kwx6sf$;b%{n0V=`am3n&XCSVZ}vwx0an%CZQS%jqB07iL8SD zNpWN2&IoozusVV@a^!Q`V%M}yGXBfBbrGy*vVr^``7gQgdm`_{PSc0o9D)2K>y`+% zs(f1n+vz)0BHy^&9l@RmE=5r9nzlEBeX=_q#P3;R+#kV#2u?(BGJ=Du{+R4R`eE{j z%8yc(HNbI|$Zfu48BRrTmdR=IjOs19#CVQ=p1eR_RK40C=y6TEEZ3!y+N5jRwFs`W z>kWB>yc?1Gg6gx7$1S-s(C^5lk2kp6`XcUL1otC&plY5{9!BsV^3LA1R+A_$(JF`Zw|`DH9(16c@++E{-TR zb2RaUQT!Cue+~9$_MW|_C5j?3{TK3AHC2)*lG2l@q|e8=lu@LL!W@N#Vd^NdN0B3{ zf0s5*6loczQ}yYi$e=tUB~uicDOt#@syAB{FSvv`qsSFSt0-DWkvoci=NNvAA`i>f z+>gr}MZPGiMDfpcEq@egu4~1jD9+vjWWgv3$=XFxn9X=n*1AX(2IWPgh`;{h3S*2y zQ~C3*D51POrDPPPD5c3VQFI!pl~pz6DD^p1g(xbrS&96EtW3(>FZV>%DE^G1S`^h8 zHX&<7Q7ekt@+`pS$Ob=-v^r5VU{aTq5$Z)zU-{c<`cqy*HXB9JSml33A$Ja!E_pPK zq8an%WDByTs_Y)dwNJ)2Q4EY?P!xYh(Kd>9QM6~lt0#sIQFM$Vc3qPX3U-R3GxOeL zmneFuak@s)jow`))%mTxo^1XTMK6^%T#Lt5fwYGn_tx97%q^Z|dkM#;`dyidmF#QH-ZdAg4w#ks^akiej?zDbXJ{ z?Ua046w{f{P`xvw*v6%rt&%xW%%#sGO)9s2iL*vwlVdoFy8Ls)9)&9kcNC5&oGd#v z!yxY#ojPUkMB$BMZxs8Y@I~Q|Vm%82WH^dQ6hSp|h$6pH6{ReRVyWzxC{9(ud{wg` ziiPw=Dp?%G1$BfkW4JDg<&+gstc+rns$3JrYUQ~)VlBN=#~;Vx+w0nf@4a#+MzK*< zZjWM<^373fp>I{mHaRhG{5TGGM6pxlyQ0{wd=F*YXT$y|4n%Q1iW_ne{;M5~;zSfD zqd2504^xhiN254KIj(xU4A2+#R1_Cgayp7L^t0qS^1SN3KrwLfE=6%!Z=!fhc}L2h0Ez!Iyr+L4KSuG1@|pZX%9vj%ojGh=42b<$+5|Bq zr2jk`ks(a_#k-<`8FZ{CZvcVWelxWq4g@HiXn9ja~5Il zBBY5SEvK!t5b0t_AH&-DST`RTV#pXnIEF|JnPSKs!;lz;#*ih3tTB|1p-c?fV#pqY zA%>zcB4ugohTI(dH?^F3C|CH3D_;!xV^|SqETDP|#!!g< zJ6V`4qI!GeLOi|lXoD7mk-p`IHh80U{)SeJ&EheXpp+zKdzPXkl8=B=ddtR%pZOGNqtl66hmivml%eBiSI`5O76ZI*PUSxQhIyF@DIHgSv!d)VP6)@_8c5TKYD-J z)Hk&Oboptjfs{dVI6cvy;J&~2JxoT3!5>2)h7mE0jKRvXQ8A2;VNwi}V^}cP*x;r% zhPg~QHimJ^$5SSd6J^KU{Bd2H!o(88)EK74FrCeLlDT*%)>)IY#b|VNVQu=?6)f`#xDm`T>;`orpv9!{iZ_AB`cwEqxCjXYzkc zodu8-SKEd6V8MgCyA3;y2e&|QcL*Nb3GVLhfnYoCK7&JmB)9|*?(S~i+lSox|Ej5{ zo_p@wx4n0FcBcCTd6GP(YECC$ahd;{u ze$3_*QkqZY(#LfXf1ZFBDt{?wvGUgmsKA=HOx`8neF8qv`}D+D%EttJqI@R5kTPbw zo`^H)iw80hDb2(t)aj|`$xQgpgmlbXsU=BnLJC!xl9I}V)RZ)2TGji#38OewdJ~r2 z&@z~i(S%Iw&0#`LN@g+(nbm}B6q$8)6P#*}xlFi2&&}REWM1+x^8)m;WI+=OnNZk- zA|@D^6eVTMk|q?R7gtFMO2yeIrIPX~QJNmF5+g+;%a~9riN2@GnNXfd1rutRP}2nY zyg@}1DygY{pj0NSkX6ZQCRC^7PWIn_5^I^zfQbxSn^MPwx+?k6gnIP)D*4HTA>RM4 zQ4JY3GNCc0iK=O8LNn#fO^Cax*S9jEwFwDwaWJ8c32j-h+Jtr{v^Qaz3DZsJz;Lk4 z!i1y6w2mfpGNCiWE++Iap{Gf1OQIheUCC}_cT&PP{I_E-Hv5si$zM$9qiXt^lkX0e%+qw42U=9w^GC2JR9 z5eHdm!YUIMGhd>5mr|CQu$;0&<#F+Nebt!nj`7d{O%`B{32RN*YSGr2u%0#IzcFcl zQ`?}X`kk_o++@OLm2Z(s<%bKvtlT9(1xy&dLbIA+V`w))Tc{s_4mO?SM1Bh0ZGy)H zuL(ZcYYAGdbb47PtL9gu$?cm$CWK8GWX51KA|^yl$Y4fBGh!xeGvS;G=S|pd!VVMm zn{dE{ot$-RP^KgpPnj^{rgmD*rL&F3IDQ2{^5ApgexX|7;7w=*m%{1YbIP*qur(4AaBYMPPt9qA!TrRk4t!u&HLm7 z@}UWjR88^pcuN0Z!bcOHneg0%gEzIw&*EM%f2k^8nedwaMkQ}ec&GfmEFRCJPbPde zA(8{e=6gy?Gg47f zlWEAbq)b&RH_|CjPpQ2anas#+Ms+i4Fv(&@J~Q&uvy$1!>}KSk$T&I8$VJbsl00VQ zRo?MqTmds~4%JGTVKAd0^Fpe(uo*>^7d4|8y*ODy)Tc(?aXLT??84`c_+$(^4iao0cNzkrFAu<8=KwD=u7EgMo+UmIZj_Tc}>ZW-t=Eo z(nq!@w{Slu{Z*c6s$rn=jbkvxjG<=SGvmG)!^{|N#yB&^vtWc7qs-WzR2#|WujDX} zDRUfc#uz5~ZyCm#5nOH*nPA35GY*>Zrx}yXm~4jimgY6X(gIUt7nrevlT0;ZnicUolFbcftfH(Y z*N|(;b>wfP%xgVm>?Qp(y}z5W(Tq)IY-VVd)iGm>s@zIRAWgDI`1NX;%4&vF)!59i zD|g80!!M_}n7CE$p)?+6^qJwO2h8&MaKm=lwrqw}W%!$rQTZvL@@jWWavq2jrS_Uti_Fm>eb-BsKnRhVYOX^~W1Tj+k-OjALr5 zf6X{<#tAb{GC4<{QoW}s|Cn(`C1=gpulCD%h8N7ZNV%kHnpehUGp?|C)r=dIYpVA; z<|L-@?uWZI~z917>keHH$ zlu43Wkc@tNntoEtE4c+Jn50xSsVx89b3UyF-&;_`f}$3rvmm_%*(~_ThwWxyaaId5 zQZlJ&Gh2{Fd2TLbi?hb;7UW={ zD5Wikx1hM{Enz`P<)tVF3;OcUJsHPnK`m(InQIo5p_Enizr1=_(34>=vNtLDFBVkd&K2)#K|kjG zRqp@`1}Yy!8EnB2m3$x8PygX;jv!my)<#;;{tsh^4+eQ7Wt0W--t}k;2Hn;cskw}^ zV6p{MSU=tZ$8Bu_eWC@EERZ|Fwu}4key~$5m~Fuv_D&6%rl$92&qO2y@sNPsFeRk_C z*v)^7Y_Q;W3(i__&Vr2=Y+~7A3pQJ@MOI%;wUy$uAi;v0TmX{=W`-73W3|9Wx2wcq zL83eQ^`UbrxMaX31~T(jW11vgl5la!AmN}0TFS#X=l9r7-DkCfhmh4I0rHT%{0P<{kh zr4BF&9~$`3*M{V4|0X6#VfxB zUo2?3%b1dvny(flp~$px6j+gnl33+i79gn=$*lN}$>?JGjFQt+s2WF7eauu=q_*lZ zIaO(4S}VS{BApfKt>|yX0D1r4ii}p2v!c8enXJfcMHvbEB8wGStuRqn4U`0hMnp@Grib_`eV8y(}Xkf*}vRY+M zSl5awGL9A1*sM;b9IY=#4K;F2D{3jPZABgBU3u*N$Ywn&>QjDFz2DC6hE_DPqA|lJ zRy3nDwaR0a^dqp!9sN+uB+vh{qLmfh+1r}zNJ?)TE81Goj?MOD2kU>IZ2b1I`A!Tw zlU>LaV+=o2x?0hVBI86g^swU1b3;#3q!*>P6~9pWkbPBeKgu|+<3KAqEig>5Vh~4L zbw?Xa8DhmyD~8dBTQQn4f*eWyN{%9B8IqR680BLrOUE2dLqv>8^+R6fg!*~8@eg)F55(T--mI%l=rsb7v+6ySjFYjw_Kn^4ak%NVlq2&56@lw_=kG`qpHNu9GYJ^`Yqih&$!x$UJvN@g{r)mtJ<0dGd zXhV?8FvW(cHtexsuMN{|m~O)w*37VBCS`>Uvuv1c!!kMM?`d-wE+yxZ^GI2q`8F(| zFC-U{i&gIu8~))OpOW%!|8jQC->wZGNNyrGlUvBGq>PYYLk$jPVG<;*HrQ;i(> z$u56c;G>)oc8sy(lU!-#ifTt5JBCa%Ot@|MV#8M(;_QGO$?j_@?RY5r{hGe76WRHL zfJ|aXQc5!NJ2E+$f|U9zQ<2J!)OMs{;!dw+rlhswdrCSoJ(+>bNXoRC>?m+wKh))w z#g44Zv#H+flpJJEGM63IS)Z59l6I7$?mzVV>_DIk$b)&-i{h})U?BBhsLrpWFG&)jN{Xc)4*DMQ)oQ3qRJ5advp^@YylmjtO>bwIjifiFQn~W1$_3?3k=Z zSU{OVP9>+=G2MQ`V62E%bF+NB_-^^^^^EIMw;`JClueY@%!?Ws)tjr}zLJag!`Y zJEK{)Kt5znS9(}dqs5K`_cbevZKT}}hYU+U$dAOh>~OQ`A!VFFwcxiSV8}dZ$J8j2)Sx7sM z+Hp*_$yeh+JN~jG=L0S7f%Yd8{lC4_4S(D9&&3_G<1pn2DM|B}#vDnE$7MS>jVI&) zC}WhHR@F#pJSk^%O5-Uzsy)y|{;}hX9m5~!=h0ca{@%qoF57wX0y*Nfeo6e-j>~p< z9Pm2yopQyF3Jz3s;Hn+h?6}U#4|aT{+>mp}j$3xzX7dSo$Bw&p+@s$or#91vdO#O> zXvZVvkL~i*E&UIHr*=HE<2m!!s`rH*FX^vTGH9|s)El|(F?px*_i_cesQ+R3$&Sx< z6mp=j17Ga;YDZ?SNSp(3;Cp%^GPwgO97rsymJCT8I2(tg%#)Ea)OQYacI#U#rAks! zjQndNH9d_3X;tstWJpI(Pi9bgMh7w}m-le8IFOaiY-An>va8-44&KZ+7P}Y=;vFciDoapGlBGz41Ep2(_6M3#xkf2NmUW<< z%F9#EJVSL+Q3f2% zWQ@wkIxvntUL_M8n8NWVGnq|JA*ZUEX_V;>%%IFv`7BC5epPS|eXaxZRPTHT7SI=} zWD!MfZ@AQfbq}>f$BgS8Smu!T6|usBMwPW~54GEy_0xQ%1FKlPnp{J!CD)Ns^P5Ay z_o^3faNu_bHp(ehKwGq5zvOOmV6y{TOdnHT z4i4yKfy)86s$AF_J_q~`ly#z<69ET;a>Z~Wof9Dk!VWxe;Gq;d&~mZykOPMuh;rJP z1KS+fuEyCz+2O!W$}V!Z>Mf8SdmY&4z#l3(=)ivZ0hO$)fj{YgspM}5&TwxYap0%} z*BrRcu44{dP&LOLIN`ua2TrNvtOKX%|ET1Q1M-bF*$C&DoLBjO52j)B68WzKmnm0N z%~c0psU!Rb!<({q=IDpFylyeM?Z6$%UGg3&z4ztfa8|!QKXTx)1L@zyePq`Y2i~Zf zr<7+7JXgsJ2VT-&spK^`zKrvh$vc(5r+gq!zl#6lz-Rgw2a-CG%&9NrR|n!KAQO>^ zN$E}EM8-$@mibO4shvnpPeG<6Q>osDEs=(vRweO8jp?1pz-Dn7&52BO|D3pH4UCzc z$m4`OeNSeQ#fhv=WOE`r3v#OwayXGwc`hg9rc6>SuLG5lmw7%X@>2?sg~)8SN)0YC2Ji&D!LTPSjDob)8tl8P!useK`l2 zG+@$@Y@~W04mkJ&KdpGAEYHj&P%;8!MbxDO=BlZZ52HVztz}kk5rRPONoehZ8%USm(rVoZL;W zcf#ewmZOFZZ2m4w<`pjT;*@pa zzZhgjBQ6^~PI#U0IbrnaXXrL3{HzR+K{Zu~5*AXTDvwcuetqL_r=vA?Ik8*LVkbU3 zvB!zMGJYlPo)i0=_(RU4h~b(O`<*!8#Caz!aH@k&9Hsn8%4mN%@i+Ytd06E~oT$q? znMlnshR2;a;lxQNPN|wRl+#Z9L+RVr*!8h?R`s59ViNb=^d$xv>LT+?)(UX%Y$dsg1rgC9+qyNsbv@T?HArrg4C)2r* zUR7prVS_rmGc)}5b2f_$Syhev?kZzucOi%C|Naq~OZDcas5*24=$WhNy2QcsteB_Yt>w+?m`V0YP!(Sg+{Eb<-(7Y+GHKF zE-A|p7pL!wdM?yw@{`INxG?q~{lsjnl9nzsaiJ-j3(n~4-pqyOs<#Ejywuprh1M># zVY40CR@Ka(jP}Y0j?m}Z(S=Sfbe6r7Rd04ty+2cK+>Gn)LJt?#%Wh@T(}hJYEOw!n z3%yAY8-LhFp!}PKG-GynbPMXucq>hFy*akW0(uW zT^QlQNQM*0U&&FVe40Y08ciQVj&)%iMe^}3jN1O+PyC4tC%G`0GKHL~Dm8vvXSxgf zi)u4mnCZeScFlHSj;a|xJ8mw0o=WDsut51j7t%e^&xIu}EOlYET-e#QOs@8nvCa_3wvFNs>+z05iV?ZVTTJxYUq2%$A2>JbYYjO+3k{VkLvqn9~1e2 z@u`k_^A9%nyKsPVko=RB-oNC4p$Sla`##0xbxp1Q}lDhF+_OE7q>B1}azL2AZ>;77e_Q{1e za*UlYz9mK8x$vI;K_wqu*mvC^U7zK$$qB#8b>6M-lsFP(B2vP{Za6p>@xuJCO)@vW zb0fJMDcnfuMkY5hyOE0Z>B!V%8Zs>@(|%8p+XbhmWKelVH=MlPqSRzzn3K#(W+Stc zIow$KSwAFlxsjX6G8vQdL^UX_<7YRz%GN7{p>7OwqnjJu-RPm_($9^a%6n0IlfSspN9BFpNc2=+-~Mh4 zU^tNMIuwH_gUKPJl-Zuf4X001$p|+_%8IZ#iX2Cdc4G`>EGg4o$fO_SxG|T-^W?~MV;OzE8w)54 z$wlO1Qbt=M+nMXToXJWzR>@xh^xQM`#aOK>*SoQXzE&mc-1v=NnImkV|4wdHHA{K7 zRNLXkPB(VBv77lG)w_(Vw%3h)O#UGEtKJnuaL|oE z-T2Fmzuh?H#%XpPBA4?KEr;DW;>J-X$H)_I9H+>-H};&-e;nUq@`Suk zJ|G{Gk4Pzd>_&haMEt26&s6^0jTg#S@(wDm+<4984f)oMca-;Te4>0HWt@+0qGUb(wlFEbcD9OnbsyC$vPdQF%59A?b za{H`rQ>FFbd)A~=mFX!NJV^OWUy{r!&*ecD4~jn1vXa@z>|_p7x^j9@=b0vwTTPY6 zgS^VSaKHi{H1(jF2L(MSql%cuGen%^B{i)eRvZ0lLrkvXz0P1XIk3l@l9CJ$b-hJ za?Pwb$yePqHupfrZ{8W!0Y*KIKzfk&+eM#Rlt-l8YJQyf@$AfxRw7akL z<83f|Wf_K0BpFH>Mh+)OcrcQ3it`;UTf+l*k;sd&9*pzgz6TFH81KOZ5B9Tiq6d>a zSnI($4<>ss#e)^hW&Eig%<*8Z2h&tC-Gdp*XHsU7vpv{2K;OmlJb2DoFZ5tOU78C# zNRi2S@0`AQ7qNb^2TRmAOFdYoe7T$*&-JrFUMoFV#e6l{{RiV34=Oj*=khL<&fh#( z?|~(Yw!s6d2R09Wm&Nd4lN@H{VDg}6Fn%+q-9m09Wx@mxu5ko$vy7l}skeLJ@F2j% zNxD>T`sZk_U~RYkzt0w+DwjIIQab@!$yks0YV9I8HxB zo=`O>J?PDOomPowAkNUwlIO_ts`mn=nJ@ldIT)U6w>;STT)WKh^BLn653YJ3a*e!B z-XJBs>A{9c1`*i;w>ilj5ALdw@3Bm}9y0mh!AB1sd9drb_E^qYhEHW>7wD5elcP&6 ztseXuHN0b&$V(4iF%f_5!5igoJ$U#fUc&dR+;LSO;S>F{2VXppyLQW`AD5>wewFhj zS?M@0t~}R7=6t6gjfuTT;zb*;e$>e;DW$O&$-MZ^i{xIU@S>y_rMyV#MJo2@B2#G~VDvc`rUa*Gj8Ao?`Su zQ%M<0Sue^_{%ELgw+dcVWV4bNwY;e9#SdOo_M!^I>SR??imQ1M=2MMoFsZ3>d2VbS z`cGtC@<*~BDbv>XBKM2`t{V-!Xvn;g>MfZUO_VqFqL~-Xy=bA5)?Tz!-b(iSJN-?z zbItU9Jt$@AwqCSjZ+o%==hDfG&R*0Ap=JnOy!hFRX?{%iqpKI)WLx=A!H4c%^zh=4 z7l*y*=|wLu)_Aeji{4)R;>AQSCVA0E&3Bj=tzT$;z38Ws{$32A4BTILFq@o1&L!uOQZwI+;~aURS8n-hT;#=KcGX*gGu!n+ zmU*$fztrp3dGVVU+hrNNSntIK7DT=H z-HVN0c+`C3Uuv7Y*zCm?FXV3g&0cEf`{|Q!^&-Iw6U)qA*j2s73#)P)rQulp0C0HW zWYeX3-CkVcZ>`enW$5$5PYIAgRT+}w`J1ccbZ^Ay+f?FCXFOWpxRcG@UWo7VV(?4t z?9TW-UhMT^AG@w^(>ABXA8M-oUK~(<(2GCmf02KyJX#w^WI!)odGXqdW3nT>c;dxV zFHU%I(u-?eT=(LXY;8_*)r)`RI`+tL#*4F*Pj8J2UTR)`U*?<_=UH}vyhvUm|0OSz zvQ4hY0Y6#4x^CkGSVeAlaZC1c9;5s{ep9wH_v39Z-t$IPcf7c(roHFIedP}*550Iq zd93o#3ga^`o_q0v$sUe2|FV8reks@9>v6*#7?12XzVYI%T#$V*`0!5VC6`AZ^7`<> zi;r@R_5F7x|HMI(viaGIFKRAdy@*pa@F5XBu}YHoAb0+hIm#=U58p9Q?n4S6QqsRy zm8mGHeMqB{v_80l`h@9JlAe-*%;>`vu2E(-vyfRynIsz}yAL@iImukAH#eo(M}6>o zJ{0$%gb(={79b0fg~-BW5wa**jFf4;1NDtllFf%Z3@dl&1D5t7-iI;_$MOFr`#Q@1 zzaUS4(0us(Qv2`wUp|ym;}p4QsOUo_A6ELX%7-6(sO-ZKABOr+g*8pcsy ze0V$4c-?NS$^1tjT&49TspUg$HD(e7qm)w}Acygub8vH{u9henjfq!jNMi>5v_ z^WoQ6d~+XqGH>BSOG+yr?o`t{`OuopHe_3}9oe4jK+0$xeaQAoKL$FhqzmO|AG%Vy zsk}R-hinSg_wu2)55GuruAwix`p~6W=DMMunySAK1C$S>4Dw;HN{mS{%!lDVEc9WK z4BAg3c;3bR%9=^4a+D9Fm5-r}CCB+No-%=)NXqKS9XKcZ(Ds!!MI}>xm`0zj zk{LeCR6dI`n;gk$pEi^SRj(OukY`TG_=|m5!s6ci4SXqm z8M)ktK}+?T6>@&@pF694SR?0`AIbe#>%%%9Ui$FLhu>I#(T7VutoLDq55N1c(T8n5 zZ1-W4EM5=evR9hlhs{20VewWuoG1yT$p^C!7P_63`C5IjDIfJpbI_eCxlmi*-EKBL zK6oiU)$4p47oZn9UXWs^TR;ZAZFxtrWW?j`q; z+h)Y=_u+sK2YvXH$r&I1q8#<%80ByBkPn9`GM6J1<5t6Qm7Mb71pTB+mO%I>&N$Ow#$HYe#p18^ZQYNNqRpr_>s|%Onzi$ zl9SBhM^;K{{{EAVo}J7=%G{+Zm-5_{JY-%npN#POzn@bD{V1j?3;9u)UPL8DDW;c( z;(nB%mn2suLMcBCew0>~nji6Wqe?vGP=;PsC5ii^JUunPR$R%CAN*+OMo`|%T#2ILa{CEnPN zCVouzV~QV5{b=ULU_XZV(OmWj7vmQ{TKdt-j~efd@*toDS2-{x_piok^R`m zkG@>;eq?`g06CD9nn8XPjMIyU`Z3Ip6n?`P*{ZEIxyDL3oMj`(k$(KDrW)nPXyq4+ zVyyCUl<|H{puBr;nCQnO)%)~j+*CilJ%nxv4fFEc5IOoSfKmPRNFF*eFaLSLm2%CG>y+=_=vN`R@5D_%ZuxQBk2|XJsULU!xaY@xCXdJm`{iZ}Xr?8g(8 z_@?RG=b0bRnYcu)Tz>+;_4QRScf_)PyoepPu~09X0( zi9`V;4j@SYNdw3hK=uHV1>`}x_&$Ji0ewl5lPLp8L6Kzddi^XMdl754<)baJ(yfyw)`@JN@QUQ z(F+GqB!KE~w4wp*d|~LsSriLEKDZ*2lnkI$0H*`^CjdhLr3080z~lhp126_KCV;U4 zXaST7U=T+u8$h`L?4{5pfbs!U2%t#-O#`T?=36g-N&);3K;;0c1W;GyRVg(Cs79%- z@)`mB%0-fesTDwNmDdTNWy;bRr2WVw*)HR01YXPRNgoM7e{LrKy!xe zWNG=csfDU(89*y~YqE{X+fpuGH@2sAAUl$s$j+oJ=i6rZIe@Ngb|d?c-2>=B=}Agu zuK;>0|0RHr{q=LLFOz;`e{ujhkdy*>2VgLLNC3y*XhZ44$l(Eu2w+GdeRs=iq-;Ir zqew|c%UQrD35t&kU?TJJlTGCwiah`a#YwsXa8ttkn{+P!c=0mv1>mOyNExd4y|}RQUEd^tC?%%yZ2@do zzC+GIdOgtCDxMu)Bc%h|if7c=2amfGkKBA`6qU7~kbW zF?z`$N>PfFC4#uUR3E{>W;|J%eA8Udd@w0buEp zSDPT(2hkyjw(M<3wt1od2ft$woq|{##Kt7X&OvkuVsa2uf>^u4@N*EogZPETU4!UG z=}z__dy>6K8LEB;eM$NRF(`<^LG)$bkL*tlAP16C*fUc zvp?%c=_oeGlcUKoL5x*3|NvgM1dVSe)9EqPA#KO&nY0RgSGlG~Y zzyAj@JBS6Uehy_`5OY-`n1(XzM8(g7}@Xk=&$u<*mXk^b!;FJ!lHT z9K>!WmLRM_>bMgC1n@u48(0b3$RgE$t%Kg^GlCxRIGP8-0VFDHXI6~yTvYOXg*DEua8f;bz* zxggF5agS472;w5;RuGpcuTB_mQ2q_#GDT*0C5Wr^Ybv=O#5`UVZw4Wg$SdKUcALF- zRL$KWTJY<-_nABhV$5mdLo$~sUi?WAPlHGtLXr@k$vDyYH$l7&;<*~(MG!CL6mF=! z3gR`x!N0-C&t|_1LLPnoo}s)6CN9hQfz6LWe4>0NzmQ+axRAchK~><&{GCfnHf9 zcUs{3JFQv>`;O=%SC^gJNt4%?cUr9wYKKrMf*&HN6GGh(8idg>j2}a&7sA;P&V^7v zgr7qAHH1;p8$v@4+dYIvAv6x5O$cp6=-fx!`!ude2>ohmP1Ssxh0vVdB7~M9w4%2r zPxGA`6q7(9YPqn(;$zD?-W8ux-@gX*W?3)mEUVWbJ}hpWY28u8p1Cv zjd?@yLTScj)>o}Z2t7mS#j@T~5JDgNtRwnGsc#5FLm2p8pLIXx{X-Z)kz`;9gXn`* zGDMb{#nL;B;qZ{Wv8ErfBUMfP8OG5ej0s^+2zx^qD+h20>qFQO!uSv-gb){xWpYAQ z(-&`I2$MpX9Kx*kS^`I&62jCFrg5~{Ak|FbLor7*=ddQLXd4W zpUnm2!Vrot*XJd##UU(VxRjKnco!^}!{EKPg2_siuL@x`eT_=ihOkcgZy{Xc(*7R8 z#t^oJuswuLA#4u86M~mzTS73a`mK}%(nQMpT9y#3A=pBAQd*NgkY!=)bO-4qU8EGa zpZ~lUH77$j zr9AF~_7DAxO0uQF`4BFIP$G`tm*b8{(1 z`k-ykY83B!+$c3S0cAVSP>SbA%@$JPqMN2-Wi#AF5?| z6vAVA?zR72lb^BqIfUnw7a_b1;gza?AHr+;8}hBn-^s8a^i3zP4&>7QQI| zN{QowO&E^9yXo^y5=PQ6zGs+>%(LE*mhxQ~$tfwwlw>M0HJOH#LF7Ae?LTNTVLB%1 z!x-~H%MeD!FfxUaIgG-pGD{e_!^p#C)-bYBvWJm_k~554sl@(i-&QtoW8!L!Z0wb6vomITE;c{t8^IgVHm@>cgvuK zQ8tWnVU!6&?kE2=tlw3BvnO6|?OQ$!x%X^^Fx($Bc~uPK;}N6C4;-*^7*)ckO0O11 z^)QZdzvQlAbiXs!2%{#uYK2joA`7!5C+aA#D?bJ3^~n0{!@VRWN+ z2%{rKma0=2ot1Y9<7axJkNPpzoi1Mu7VkmtN%kTo>`nPahW$~mZ#vbGpA+_D-am{1 zl!4?RaxgiBlu6E1!|*Uh$O4D)%WUJwF!tUsjtOHd<<~Gqg)useeN~Kq9g7cb)TCFY z8W+ZRj!^ZZcD10MOpu+$WRe(Wc*5|iq<>NP=zf*- z8>#Q^Ae;IdwqZoW*cHZZxo&JV#AFpd8h6sSg)!liww>G&M$ZEVY08}|R({gbc8w~6!96^x?iqcC(eEXb6iHQER^pXsZ9@js-A(Zj^ z<%UsKs*P4Qf^rlsf*yyoG7%UKY3@(jrZrl5<`p9N>yvillU9)h@=Y$8s&WKXBIp-I z|0t?PP%Q#$1hxpOM^Gbz(GiS^pk@TMA{fY7*OsjsL4ybyMo^bYy$BM2)_#mYK4~V) zBM(2y|5>Xa!B4VhKWp-;{#k1z%f^qN^^2f!1Wh7n%4wy(a|F#IXwGH}vRwo%DXmmZ z>j>H?Z%gU?SwH66(>p}akIz= zhT|d_PnkeYj9?OFas)FdQzDoe!8H2x|3?{T^=D09BC{iy!!A<lc$t$fXf1qbw(7*cB1@Iets^WR26GwY73a^w+k? zLF+L*`K+yD@o(h%2sTiDCpVItNEvN&1jjz>e`LvoTO&x|2p=ct%}M(-a|D(Ml7G>5 zF4hlkdjyUMzD5uig);(I1WzM)#-ZF1oTYdo@J8U1g^XZZ1lt(~WY{lStuIHfy_d-$+-y5M{t4pjR1%3W1+FM|8ZAIOz$r9RGMCh~x} zc60R|^n^|Mt3>>H1jX}eA0v3d@FiKr6#t6yntT(%Tgp4~J^6u@5#*k|pXi?>_(GBQ zRlfae8&M>RqG=S(qDUM?k|=6MQ7ek1QPk_CrH&#^R9}W< zq3nGapO2ECEI<|{3z0I%jQoUiktm8rQH){nC=8SmWJ$6VDfRL{_tNxu(x`IB2$YFJ zp4(D3igHnuXI@$LR-jZQD@E~x%H?>FF{`jyHHvDK>Z-R!R6gIUAA8HcXtkrL8^w=N z)KR^UvKi||;r^mEilT88^`rU&kA7lr169-Tnytx+UIF^9b?qgX|m8^ydR=F3iDb1Auy zTtqG=W$~6oafr9jS;l0!%2!0O;q8CFy{{Hm`I;!!($|r{k?U2jd?HcC{5^_|D%m9G z?>NKeD7L8NbT*jio+!NRHAi7lz1ApfQP`t!FmaJi)w}9moLl*Z^zcRDXLAo3h+;b> zNQR;aQzB8sDA8}tkp|a?xNXV@KaAUDnqmnaGysM}k+Yx_0iVIPEjN(%i z7o#}2()b{Xhf!RL;@>DPM=|QFc8614iDKzj?JE768s|FY26>ab6~%4U>-wtQRempu z`^t|!Fg}Xn$Tp)qlTLQ)<0zg)@l^HR`>H*oH~3_H9)<8l6fdLle*xWJlkcKinth3$MgdUF(is16+JO2;de14QJ$2Nj4Z?7(2~cH zg3XlVw}<##tEi8bCWc{e;?gqzK8AELq^D;hr65BL8R?1Q%1ARaJqwwY%tmhJZCG-| zkTZru{IYYd7(%i5Z~qI(8$-SrcE_+MhWs%Uh@njkZDS}HL!lU&#n3#4!qOF2rdSNc zV<RTW%Pd|thH^2KXIF(7 zexOt&E2;XY^)QC@2PdFv3^ii%^>YQ<2SVci&hq|}LFwVGGG z7#cFHPyR$UAm{O;xiUy2HXFy#gd$1P82lWe1(Q}PZyAGp6|PBN`wNGp(n*XNgkb}U)g?P za|GEZhQ2ZMqYoyfpg(0m3A>JFgS#`h4laYcySux)e>(1-;4ru| zxV!#ar+I5-?X}-|w_a7sl1?X8IHB#CSjgVZao7@vMR8ahhb3`X8izWpJU?BxEDmc~ zvpfzf;;>SUHgh~y(O0WvO&p4HDw)MPhU??7fwEE6Y>GqTbH86tx61z0L3bby+v2dD z1v}!fi?WjpZ_@TOdF+nE9yP+=IP6otUp5@)crXr!7&gm|!;~ZBQSumhoRrZLq`|3p zC)a%Wyk+(_dHKxT~`aSZ#$_o|4Bl@jxy7*tV{uhVGOrFHy zDdidYl6)?EK1Ifq?|QwWzgEewK6n?0HPC-n$@@5bpnoJkk!AUPgDA2${^dXxb$Ab|l14M=1_CId1Xv>hffnaqGBUvx?Io$f)w}gLPR9$ZCMOuWl@_M3>EgJgPUl0XdZCG$0o} zw@M~_h{{XPN9HFBsNRBq<@#^37;m&SpS**vIw!ATKut<5vc3VeDRs!Y zr z4H!o`n@u;KQumB*B4v^RlMR?+z|wTOsZ1WE(|yXo^FN!@$r%RBq|72`lQPpelm?k& z=NquVfF&}H0Sg(*8@U7Zv53A{)hB%%z082+26RfGzg!qAn6H#)L`hp5t0{X8*k`~R z1J)X_j>!fCHd59b@N~`ZbND7E+sVxaY@uu=w~?}hIlo8kP`;D0%YfY~*<(Nv?jieS zWxk3!&inv*P}LkV;4u9Nc~s@cWOwDXCk!}gz$pVZY>YMNp~6GrbtrnN0iS1zXA1(sBc8TfS>`t42Uwyn`eX#cx=EE z10n{TG2juWIx8nD10K-N8*o8RYXx-m)Bgz?(z=(uKBr;;fv6!qzWHTbM5lM_lYD6-Yr6-dcwX1=pG$I9?GP%53 zrDB+xOhcw6r81pS`$vz6RAw+DBd5xwrp;_b7Ugo^D5=SAM6?m5jmTj{P9t&|k(&iY zjmV=a3sUkLk&lvJC4G=My#i-Fk+< z`DP{Q7v%5HLBUF?k)Bla6{fPR>iaSj@BNVz3->=F7= z@))_6-)=f-#3>_Q8}UX$BTgG})`)XP#IeR|gpFb_!bp*kO%yX}F(NPbD?6KBBYZ|U z=uRVCM!4xRm4`CyWmGIb>+`ETEUyCeAQ_U=(P&iXm=Pvt$Rzv){dprU7;)c-2S!{p z%0)SFlf5$jWy&=puBhZ+Bd#j%+DbbZuN!egC9@reGPN*>EP;j8&mBc3sQPQD~xkVPBg73EyT-}~fSBR(^EN4_UNkRM5z`zJYd z^S=^bn0z(jn-SmXzsMh|@+ZZ~!J|ytEI=k8i|&X{Y(f$f{xG4O2}w;zW@FR=j$?qn=okP z?4C#2}PB!?SK->b(E4Olu}7Fr8F5s zHp!*!1FPfkgq9|>Vza#o9Vo3$ zXhV^y+M3Xgo-ft!b>5N9E++g%>7*(<%hoURyQV9{ZYFeBy*()RoYB2a=wrf06E>O9 z*Mz@Km}SCj6Z)}WlnJ9v=x@RR69zIFrbZY<8EnE3l? zNiZ3kmG3cO3w;q=xG~<+1n()qq_a>Y+A=Xy-BrChMSuL)Nv*U0z}y>FUu%Y{;ipQ@%+W=0a_NN`3Fz@hcVc=fGg6z8MAalUBN;t8nSxA7 z>auE!k%lgk$&9qh(^1ls8OV%glzF8c6!OT-Bnz3|s`OL^qFF+O~3#ne~WE3@{m>IQIQrwJk%1g+nKxUL;Gun(;N@+4i)#%LVzw7r| zLN80M^0H?9q1+SJl{ce;85LDh&5TOQE1OY;UX|>_ug_Iiy)`H`$y#P~;n}qgn{`#q zpJvpf*C!j04ar8Ntg)neT~jlfnK9ms2@IQ?(antRX0$M)r5UYMWk*VDGuo)6tr_j; z?N!o2#^EpE{!&RNGde5pLg{M8U9OoPX7pt8j~Trv1IXT_EL$H+U-ECVpR85YdoqW% zdIy>@NF{^K7@~Zr8N=wqRnnPn^G294QYE7(qsnqe}-ta_bhSd?2SHquTyq_V7b+LwpR3^zj$DT$X-AT0uB z1nD=(kQtXLVKQRI88gn(WvUBioTHytiM;i?NWVmu;_)bzSJ?cQylTcZisaWRa$>xx zl3QlnR(^+am%K;bH)Hi(?GLv{s^+s9|C#Za%_rn*@+tYujOUaW|_p=kKU%e-sNI5H<^dbOXef2susxbM3l&Q*5%99l=sHpNvl*+Q|_`bTT z1=TF5u6i3;P{V?nY}O*{Sx{T`*0G>2{ZBFx?>Zs#s&7F9RnyRdm0y0pk~U`8#Db=( zw;83m1uaxEsYbFhm@)2S}>13UnP6Z(TkKXvtY6E zC6uKW?Bmr|ms_wxwi?6Ls%Di1&H2gg8kMZIU>$uuxq)1xK8xGT<^c<~Sg@78P0sU_ z?W8Q>4$4k)7nz!WXzZcymF1yG<$ep|UxLLCT5yQ@Vbyzta@2xjlmqJe8z(JrtC~|H z7Mx}?&H}5-4Hg)cn5k&n&%R>V*WSW(c5Li7@3VX_D*lN7b0 z7`?bkUe?u4BPFdUrIKhXO4FMh)aIh2$C7%o3@Ke@DSue8kMEPqTT#J^idIyzV!utB zwz3sftoUNZS1YPoQO%056%i|{TT#P`1y(GyqNWwKtmtY*H!I{0-LR3^i z=VT3XS{iq=*fPOB|j z8!Osc@s}E*ofRGE?NuUof0nY2R`l!@!&EZdihq>Le}_j}G0KY3 zOvYO=fii|1YsENKDNlJKeUeJzFWf!ZiYY3YN}2FIW`-3rt$3MGAO8#bSys$fHM1#m z$hlU`Q@LCrp)7xNLYRD-0B)sxeuS z^^JC_u`+R!HquTyNGWhy;Zk003p`eMt@y-uUp|%lDFG{jDhbJ<#AP@myJDW$2Ua|^ z;;g&`SaDuX{w%vAdm812n(C4jm#w(MX8gZI|Fz;Oo7Ys$b=hObX(x)COm3|=PMZLD-jTLX1 z#2>j*^N!8;q};^$qZNZ1#eR}aP$T9ud38y&_%|!Q%YkXb3>$t}@l(!hHpJMpyHxy= z#kZ)+%BxViB+^&6p@t1D*sN(oElMLBYOBh6 zHq@clCI3{pTu-Jxy#d)!G z2`Zmx!#~xuJz=t3)X0V@DxYe@H01?KVx|qVY}m?s+CL!Gw4qQ;M-7)YZHCY77znEj}o zORYB87}`mf4GxM^Rh}q-(M_~1B@Zvdpbb8XpA3-wc-5eg4PiDT+u84kT!+ZJ% z@}sI*lpkMg_{wGqJKiSJf3qR6UE99j8U7%DlE38SZ^tQqwh7iGAQO@@Ng_MaC;t82 zk0cC}lF7*AEq3IvBc~k`?3idrE<47ak1l6Nc{_4*{5*E#wId(BD4Cy>WiCJ| zXh$JRVX}zo9q=fsn0y7)juK3CDlchADS9+nTIDfzIpJ&jsyt%t&@(SXmQ^)>*io0y zw}KrN?dWGme>*C%x3(R1?5J!<6?t9>V&yKtRn=70?5M81h8;ESn5>Jfr4qSAkj$~J z9S!VgXvd$->#5%QcI}QfkE`n%+0odJE_QTfR};JTb-q@1G-b0H*_>=a%9t%FeG}_j z+tJ33wkq#vM>~3Zm2{v?O|1Wm(n;l=_c`ZdyqZt=tb#GZsGdbTmpUV z_?wAiskT-J*fG$KL3RwbW8E|D`$bC z!;X)v*=ffvJ6v|S?byxagdHa-d+gY&#@T1bemf4ZdC-m{DnDe$VdZVB;3)l=N{-tR z&AY?MUCB<_aay**vzY(MjIzYaW8V1KI8|w|!)S-e4zo&Z6bosUqhOu3tJ~Rhs2ZnT zu9Bo3bRIjrc09M^g&jWjUa{j}JN$M8*bLfnmJ%YvWQ3H-&)89qm$DQ;XUBQw7s!it zT%zooi_4U;+`d=sxMs&ACfC*azhlP@CO64jx8s3I9@>$txVE?d zr;^8ZJfS}&pQ(J$1jq$*Ub0!RxbBr5ukColrrdg7Mv%u_Hs9ItUQP8uHY-0{{$$5z zJHFWQRZgA`2KgYxl zBw?6TRc08db)|41Et8aFDl)aIN#nq`hQH68=@_PWAcN}7=)gE$4dzNJWM-I!%t~e> zvpbN3BJ&#cA}Y57Z9eN(C()O4Addri9mwZEeg{fAP|ASYpfRNmS(p5itmi;|N&~VXDHA4Ki6#yl zPofVe(KmHySG16@nFGyP(87VgC@mdmMQKg8BilI8mLik1=id?S9q6Evjt;zWYv-9x zOgfWY$gZj;)EnI$auW*lbfA}PSqH|mtG5FQlIjOJ&_`AFrTpzcKb7=%V1V+04*bVs zu*jL{!43>@V5kGbRPQJUhSUF1$p{BV(hDZl&dj6fW5}_pMt&n)tYz#32c|nPgW*I6 zCQ&AnQ^=|0G*X7T%@0LqI@6Cxa+_@2i7>S)&YwHRtfq2z;zC+cVL498y)a}jWTnPP2@ob zHaoDzfvsxf-41M{Zzp$Q4qR8slAO5dz%2)EtK<%4+A{2Gt)1)cvzf_> z%uYOT;GrCevP(Pg!GVtsJa*uT18?OR!+$>7aM=|n0vQT?Uav6khblOx!oG7aDs61Mdy0)&Q6Q!J}<3wF2qMazsf~ro$IH9ALcOq6z^@kIBdKs0J zbz)RIZ76w^bK*vn_TIIE>aFNRC3XaHz)TGo>d2J_BC)3Vp^5*tW zhK-%5N2#xB8c-TK(MTnw8>5L6P1$TlwsNAm>TN-3>BNqfzn3}Hi>S6vv~yyN6O)qZ zKit-}ccO# zBKBG!a^rzJ28jN zxujfCa~@^Bs#zd=kzLyv7BN|@@+D3zrGI*;y)G|z;vyGPmTHv~tDShk-Zf6Fb>fID z44dnm*zH8htGe}0Y+$m{iEWfkXmzP+35}^oKCn@F2BTa(>*G=6a~K%0Vn=-;;IutCqnEx??hPDM4Z^e z@9Umna+W-&dS~ztu?uWobmEfAFFSEXx!kGY8vV8tcbvGc@*7Uvq~B7>caC(zZ84p#9Jr6JMqJbcTT)_ z;uCv6IPuYm49S0gK2sy+_pJ%#)^eYn_@YMs>clsC65a;lrxU;ASazYa3sEk>h3YQU za3O&U30)}aLNON-xscd}3@&7JY5P(VG8LKBg=CcEWC~JhQo4}jwe~JCHIp=CS~8ug zNlzJhQJ2Yu%r3~~Uve|a;zCYUla-Rqh3qQHK`EVFKYMC)E*FFyQt0xykkc2k;Dd$3Y<`q=$oLSnjR>_6ROsbGoRc|#H`fv$rx=_o7mdtCb-i9vJ zq1RQ(pDxs+*H=jc7p8H9Mob#J(1g;|g&bS8S<9oD3(Zx13m3MszLg8DU1-DnFS0G! zj%-hMAZ3J(E|@vha9;YOiwj*{=;cCh7rME$kDI!?(1XSD5slRMlyG&lAsX#YXgkj} zPTR+YzApUjLO=HU2;s2GB3^LP;{oAQuKR8A1+KmBU>4z|o{;gbU;3^TYqe zj8wg&To_Fsqmr?d^eMChWV{O#*qlgCQZ&7@YX1FlZg^RLrU6>`i zoC~{L*zLj`7v^%ptuD-SVZIAnT)3P+b^*ghE-ZFoAwAqx_j8`M{+GD0)P-dXt3+wL z%5wTkU06k5?ZSG>8geZu_3K<{$|c;uWTVPA$;xCtos`9pYl&}jVLJ4Xa>U2wVJX7MT6L)23Jk8;|DIF%S&Fe*2>aFt6dgIHX!$|>li zcG9r9U}ud(RXQneQ|LY1ox&>jy5LjpcOgIzswCt>nv~k+jxaexo+Zzb=SeBJKq;P5 zf7yjAaw>46v>X32{Nln_Sxy(Oxp3Wu8!o(Z;k64lUAX1KU(dA5rrl=cLl<^@(YEp( z7w$5-N8TqNkkXqs86LUtp9_yw^1_8D^rz%Al|Of(E|>qMN`9@3k;Cc@n{Q<;-H4IX z<~uguvnk_$VDqC3pD3S6$$Ni``bJOfMjAK1(|?dZUHCjSOz&q-Ru>Io!yk zJhK~F=vm2ZWOmg%Ii=prH}JVslG}|u^t@y~GQa9A;Kmv*gDhJiHwrT^LKamu#VEzy zDB(s)H%hS?Pnqg}oIHkMeK&NJSW@ps8A@3&8eoMyaI#YK*3jQOSpe81KdeH-5Ph<-tTZCb_ZKjeTxRX3b(Zmbfv6KGltBl<98F zQ6tQ7W2W+1Zp@}XZ>ycg=hEkq^T`F|LUIu)Wk+sAEp=m=8*ANI$8fpqpOjju^efz0 zNnfSvSIa(GN_(cAQ|ZTW#jbZ_yXxKG#zr@;grYa8WV0Jv=v&EcDj%3o8)SzYJ5{oa zvfGV4locF&zZ(bKc=ah!63 zJV~A+|3^ywX*Wif)rlD0+S@$48xA*2oUfU*kXF)0%FH>zII&ht0j_)t+N=l@%7+?KPV8sR@T?kd0M#(m`v+<2(`k*qha^T#TALV4=O zGdG^Q@q*1)s`sUwSJV9d{CsPFyk-7{d`G^Qg>mB}y`lQ<`X@JjB-VX)qdcz){*}G5 zOpc3 z>Q9V5`XeU22Ps%A^(j3_MNdtpA=9efbRGmBYb!8=N-|P1k(o)kbnUc>(b+uOWpDpU zR64syd$G&GuACm^@*p=|2FXv!<3V1PcCJs%H_e$xHH`dlq^ ztq$ zNm7q4A~zVVue^Z=Q%}T7*w}+69A~QsO+9Gl!2~(odC=U079RBSptlDtS4~eE-mu&2D7;pF%z8Jw1s3d!Y}T zgFF~a=}Z3YK|e}=asVk~4wQAvVa12Y>a7qv-h-hY3}eA?ass+k-hCOkr32|4L+zQ`wwGPA6x0Fq1Nil$vz;F_*r^ zgS8&a^I$%k3p`k+Y8Fx!k&8W8qVlC47z=1e^l~OE$d%+ORkPZIs!xCaMLFYLlx&f8 z9;{cr8$8&ke3J*8>04BiH?@A72irZ^;lWN1PI_>PUAsKk@4*2NcC)!h)$gV3^WfY0 z-{+ZwOip-kh;mp}9-$od;FwB|Q;aEM<9`|bKQ>RR-VNKL7Nddhm|^-h&U6j~;xbd?G)Svix7<40%D@ zm%cIiu5x1!$OS@wv6;#%murrR@&aD%w4Z=X=tUw*Vlp|I#EYa9DN9Cawl6k?N>X~| ziip|>sl7%3U6#@Xz}2IU(mo5)?su!XW!^=_kV_u?Q|qdbLOUhHSM zo7_Y0CHIj{TWQbq0A1vu7l-JFRdPi3ggV+OQ9g0qeIw?C7bm^A?S-WxPDza{zZXF- zPOEw=C5|+BVWgNyGbuw^-wn z5%xkpa=gJX;>AVT6}>pa=2`L_d7hLxUhv{cZSCB6naOqX3i&U2m6U>OluuK%Nq-&v5# zhaX=2^dhkj`T4iZl4H@o*cIi|o(0GRWI{3#DP8himn8I_X_3^2Wc1`@3Nj@rl`U^X zJY?L!(L()y5&c{Vb=4;g&ONY6@UA~TaRZ5AKW-~Ij0M+V96Lk=HuvNtc8i_ER+ z^HAj8G5J)IpHksnR3RS<`{Y;Wu|<6-IY(D9jlM-1eGwmKrHQ@T93498iusT#LFwW? zl%SL(B`HOT_Mx;7L(=Hw5kpyBB{tRvy$@x4DCFBp+7&i0SP^A0I6FbbWmo?!!Mm z{OvmE+dz#%J{ozt@Pne@b{T;jSrht?^?<_ zay_}hhmERt2H$RNW^;=VTPfSf?W#t8JFwG-T|VsgVUG{{yw)g>h`D6 zhknKE_aXl3#0NOxK_3qJaF~9?hvRCrqm*OhlIKw;C?{2KO1@P%&1TStI3El?to%F1 z=tGcaHj}K(Q985i3_e&{<|b{Vopg{+Qr4}@hf7JcHR)mEC4Hn{)dYNaeoQ+#hkOY8 z5b@!R?0BVPGu+lrCTD#(uPV<`wk5y?m0YA;^5L>duK4gT{VG|`uWgqbKHQX}EPy5f z-16bJ4|V}%z8583s|hyQ$dOn*Z@k@fGx zGrCm1lxIPIp^{0Tqh8Tpt7OP$?TC2m!#gJL$q%acqdfgd+Ef1G!&e`o{D2?%=W7f3 z&4=$knC|Mf-PQf@;U_1Nx2eCBNKFDi68e$FkF0(q;!{iIM`}u9GKn8aDapv>WC}7R zDT5U4jVIjJX=ISJ+RIs5cBS(pJtc!*yKO;6dL}hhW_(xA<^F!xHg|zzYe&p~Y zrytKx#uV_QAd7R6xyd|aUO)0tWM26xU(dx9Qb`Fv3e$^_Mag2Sx40iy4r|-DB$HBP zG+A2J#87f3*2Vgv_d~vyScXY8Kg#;?hacrsWhFn#(<_h_RbI2Lwh1cxQH4oWmG>*4 z<<XzWK5Kl=I6 z-;Yjd^-YB=YvxCDKU&b+k}b(rqzv1d(uS;`9PKFW$qr;kQY!!QV?4J}XC__z=t}8E z_V%MYr3cy554p;&JbL+Y{jer|nD-@Rw7>n3x0E9C7~sc9<^%m0^>m#D4uZ7P|ZSsQH!n>+p3rSjdB zJ>*_;pI^JFpA;XES?tgqWO#{BLBb<`T=e6TA4mN-=EreAPWTb><6TPKNmg3?u*x#i z|L4bPKjP?y_+&)%RQ}l9=!c1kS>-!lM%m~GW=7vlTH5Z1!w;wG_4(nVyGf7Ay?(^< zR}Zpmeue=*f|L`y4uhQ5!fZzTIHRUI>&H3zdGdnFXT6QOEGGd!zWMRpkAIn8l@&ty zl2(7+j~nzCRqulc2wjX!s_sF|s=1bZc_�afgcZ*Kk_3}y5IjPd(7~OA5T^9 zGda;I@Ai+j?Oyuv%8%E6yixf_Ki<;ck?&RhLC%>R`4f}RuDLDhkMafOdeDee_fR(G~ zXlKX*%nJrkD1gAN=#MF53kS4MIm!f3Hh>}l6lFoN0AeV`11J$dNqRI{ij<-D6h~?0 zrn=D4V@bWr4;IHC0h9}%4wLc$R0yC3y`rkA5z~!&eeMq@EsWDk>zX19NFoN}a?nVy? zU=V#^0MeAlmUQ~TOoos{$zh}nJ6tv^-OTkil0HiHjt*c9eXL5xQRcS8ga9T6Fe!k^ z0c;OoM*vd-m>SS-ueLsbX#q@UeX^T~lJs7|)HO_9z9&&F0`&7O^fCI`$Jl7qfA105eT$bT@04LadAHc}~ zP6c2Kz%B{HcB{1Qema0QZ)4)rRE7YIbdyTV0a%n<1Ng?(;t0Sg@2&&59e|6ymjk#G zfSc|Kz#D)s0Dl1I)wF>CBJ>~`Qh7LlEa|ng))|$Y4d5JI&s=^xc_Dy{s`rxY?fjm6 zP4@n)@~f0<)C0elQ#BQGZWDS*%H{i15V${JSw zJ%As|e^SP$*CU7oLHrd&ryvprktm2if+!b6;vkX)ku`{HK^!cNq(SYdPaZ_FAmsMV zy6w@c((4D#iB7>hWe}-?NF78PHl;E{5NYX6wnwLf?2 zh+_2OWC^k)S&Ee6G5kxmG@CJ`j*KPsLEN68t%|Zi$lZeEURwW4uP@K8ia}Hg!k?&g zg&;1c*Jo~}s~p6fB4{2&iy*25Q8kEatdz;?QmT_R$eLs=vUU)4D6hHErT)(#>IG3h zhz86XlMTs6q}1FTj3)G^DrrX9emOS7I$g=lXc6O&fkfKAg>e$o{)9QuU4sVl;gWIhGu!dJi;(+yZYx z5ECW&96gEoWO52Qm7GRSCuLz~1W}huHCwi$tg#>*LCg(eUJ%=Y*e=IQpV;|9EDmA` zCs{x)Bo_s7g5M!osz%!s#Ihikv$=v?8^lV=DspvDyWE*P)&#M1jZS18b6Jx0L2OXI zQPwt>O7hJ?Y+=5Yynj>M+jj)9Gl-)>91EgmZ{5d>vAcrU&4N8a>{H|HrO4e1_6Ko5 zj&YSsB7+4N1Tj_3@i;@9Ji8!H260N&7~_RJO~#Q1S%z%dQpv-_#7tU9YY^+z z$ckw5U1IDWvI?0=ayl*Y-Mz|uQ9jB#rlJIuqHadL4rYqC}HwU z5E06SJK9Xo($A6SNeM3mA>WA=xg5lmApVPJPx;>+s`5n;FX^wy*D9AU-@cR6$RllKzNcL0%K5;8kL0HyK2yGsUrDL| z7Q~T3+U$M=@sr`(4EkR|M1_D55`>T@gtQ?f3~B2jT}J(Ir!G+li9<-jM8XsyB&8=K zldC+@0d10$Y^Dk!waVXqk6N0sboMK;@>{c`bEDITkRgPOA!G`nX$Z|i$Q(kJ5Q>FR zJcO(vWaET|$m}7M%Bb(JkIfN6&Jc1j%%?`qP015NUX@(vtt~_T5DG9UsPamaP?%ms zB}FNJ{D>+MLdg(ngiurF#jrvM6+?&)p){K@A(T~9=_s)w=v7iCga#S4^VJ_r%8}(& zZ|q=gc`C74IfMcHQEe5~TQ!7g^y(_f_aUlQ2(?3KtdcsEhGbpx&k*WS>XR~lgAn>~ z85%J;kwu%SJeq{$LN402ZXQAlcKsbf%MeBWIM7ADaCDNLsZa4XdglchRb$n z&5j}b#bzh6v#ReB!c5LxYPyBcJ%k?Y>KQ^`N-wfE*@u+MgS@1n{ClEb2>lrj2;m>f zzz_ye29v`>7($V$hK4Xq`PkapQtjcaM=%^ojtXHkWsItv(I4YOm>|m;!mJP`GM`3H zA}5nm$f=~aiMHOR(`S$gB06tI{p=9tNHc`fAERxej zW!-Z2E~YObmy*j!DY%`0Uow*OBW(*g(miN!#l-g|InvX|T!!p-s82g?W8Jg908g>aaDBn0_I@KO4)5RQj% zLe-q2oFqRl&{o~K28d(RNE*n~?R5h(=}jS+Z>+)Bz+Hi|t22gOOcRIfV( zqemND9$tn%(jP*A5+p;U)HKeHGa;OnBQ%VLVf^fjbMh3z$PmW)5H5spF$8})-IWmj z4dGG9O%KL?58+1$KiNzaM&dAj(WAn@&l?CM0X?Bg4nB)YLQhF1Re7>7k}FRU z*8Zs^3zmvWYBG)LO-o5f$`8{rhLI_Zm@srGCVsCp0fKxKNBFz)h_*Hy!)7Djc3HOM+))TGoR z<=NGyd>)Frlt0OOs<(a^gCA>0M58bohtWNZ9$_>IqbUp8h0%=CO4T1d~LiO*KG)6qb#|~H&J$mv6-?(A?$Ph7xpGOY#*d^{>PD5Y(R9+pu;ew0F$klOM>BEaJAFXNGOcz0Vij1FuGT>QECY5B4APYUKO1_Ve%C0Z`*y@+w8xZ`r(lmM zMK-7rEB;4!L{^WWGDQZg5Jc1ca{)u2j1S2CD#pV=pbOaMAV|>Psq!bh^q?J94;E_r;jl<&z zo<#68f@iYb&tS(HJdfZ-1l7-=#u>b1W!^K$cSf7`RRpgicoV_@i8>1?r>^&F&xYde z?k-`H;O=fki$kHfLveR2?k>gMf0QDnxW?TRin}}Cd-rhu-&$GEdd@!YJ=gDKA~&z@ zAjMC}VnS9EUf;o+J9v8s@9rQi%cS!C9elZiublh?`SA`uQ9hGWBOmAfCKrD;Q*y#M z@+T8ONu)+gOc`}bm&AmmCM07sx#}%g6e*O;9p+QfQjaHFTmMlk>H=%;+&Cy@mYn4oBlUfsbRAE zsbfN26Y7~z--HGx3^r*uQfO#GBNIBw_A#L`%i5|DnwZekgk~l*SIN&Nv{2sCgxtK1 zl`Kgs6I!dh4P_uVemi=5nUU)4U_wXbMeCr8@;;QVCUm28CwrLis|h{nzmYPpUM6fg zpj|QK(VOA@@7gorz9#fzv%jhwV8TG8=mciaXR2hD3A5>Q zR5B^QHrjj>mYT4P;R5mx6Bbeyk&DSCWTdq=$#S~!jkZ}RVJ)9VQUuSW)t#+ z;~$^VtznH6tTkbs^7WJrCTvv6Cd%G)hAk@DO4&wENRJ&R>@>k;g4={$49zB3OxSJ0 z9uxMOu+N0+CX~%;+;74G6E2x>*@S~895Uge3H~g`!)oL+CLEz3HQ|^E$LXiY6XZ!! zmid2_s$~p+QBJG;ZxiI>G*WO@CFdyTP56g$LFNC-dBNH_2P%ZSoFjB3E=Yl$)!wn&4p5M#{q2<&4OxEtNc+ zCX^ef?IVu~UbzmN@Z1ESYzGtWv)y_^$2G|Um5HcZ5kC1mwh*G31CRd?}+STSi zCihhC=Ifsi*nCJnGU2i6ePY5>dbt$Zyk3~_Qm#B^lr`g(T=q@KXV&sJCcKrar5QQQ zcxS?U6H=Iwl3gE6_|6eNsxd#A@R|OF{HpSAl+zP+ahwojA~O=3@e^HUl+27I%9EPq zli1oRERW<2mnKCjN=8+a+Kgvk4Qb3s%Oo9{UiD@$<3mO5nvm~fTqZLzGtWY1C9|nY z`6;6KvHF~57vtiZXGk~GO1@qeafP&#s;cp zPgY}NdQ&r+nbAb$m$Dk0n=zcm>n{lWdY-U`(hb#9m+>8-sJoMv{U)w$-&6w=O6eoT+W0V=A z%@|`weme@-G1iQ6a`ak}#ES7|OfaLP1)VIIXvQQn>}EJ*S~I33td1E|&6sA!0XCu;HnFS}7BQFiUHyluuERcWG_&9G3cD!0jAX0g)@ml^3T$Y6on438O~ z%xJd|UNd}V#LT$MN&IF6%?Qcyd^J8mzBm-W_iB7|UJ}EsiI@?k%qp%e{C{TLGvkFB zFXi;VuX}Vf{yuvj$iZyJBl=@96Tj*rlRRPbsa!=Vk~}v0&bjpW+h|6d}CJSmX$!tLu3(8th&VsBKWMf#wg6yh3 zp9MMSIW5RV$!+=nzf+dSg1oA7Sv>O73y=j>UdV#N%A+Gt)PiDc7AJLN2@6V6N|B{W z*$zz(YTKub1@TPuq(Su>Ef~%JUO(5@%H&brf(jN?w4jozdHyD@vhpgFsuomJNp%ZK z6x6m`O$%ySP}_n!7PMk-T?^`2(Aa_|7Sxx`yI9|lc>_|uNh*&<7VUGb3EwJRv_M;c zrtED-O0&5IE$A&(@-t;D5BSy=v{89mN;?bMQ+`o-2Md<4xU&UaEVy97zZP`0pqu0t zEVZD!1wAa7X2Em|ezo9Gc4JQqdU5g_*^R$Z23j!4g5DNH_(j@27W8G_kL*v%(hjg- zKzeOU4rVgag5N1a$e|VtqYNiUkW$Y*iz7-H~JtoAbvT<|T;gU0}f<^o1%}WWi$PsTyOM z1pog01XbWx;9-w$Rt8`gN4Gr2MP0p0a`5NNyrGld@Fly5U(l{f@`+ z+bsCgg6$UUkgc6f-(rup%sW}O&w^c)-D;{m7VK3%kDoc;Z@~d32gyUK_i#dZQGZMh z&RES>TdOG@I8gFsrF8fuH=k#$L;k1+R=KGIJH$RHUaWs#aU3oip8h36)$at&Wf^Dlw)4CyuOST@pQcv zMv8$hp{|!Nh(-TQF$dwWh<(v10J4E81Goj!8$dJ^2gSfs{4s z*$`KZ+V<(pq>B|@Dc!92mC~K;K}wkv_oVky$>T-nV?|#phB4_!4kY`N14x-xZU{e! zKA0Rr4pqJ1Dr30v5tNa#_bH=PJ}(u zlx0X^!gTr!awa)T_3nSKJu#lc=3Fv+8u_*C|(3?=>s_?+%$a7`ASL+g9AMB4CxfE9gxOZK~c(v5;0W z;jLJ^6%JM7q_{}86&@?Rbe|P|Ra1n^Uo)pMD7!M=AdgX*3=z3N$;Hry)HcMdxNF7i z%kht7n_CgLK`&p0kk0_zQzP8B;(_vqazb&y$1<7~Pno~A;*G2w{kf`qVZ}@OE0rwd z(fHO1*pSGEcUHWY6=&~fE52Cqk^V{5uUV>{$X~7au99z7*!X$BIGffbj|#kdOkx|7 zspKaclF*Z?q)0&|r>7uOCiG_1Mo44B_?*UEHsrP;tqtjHNN+<17Gxtc+J5{lNhUTk zlUc~Dqzp3rZCrL6%D&L$VB*__oNOlCT7P9uV;&pw+T^}Q$Zta-HPzY<+GV+b4Fy%= zo1`zSeEN12v!S>R=WIA{LkSy7+R(~|)+{JxgTV%)4W-%Csj13P;%(4V&hX~OW$E>8 zXh11vLwOr2&@0+diy})>$%e`{RI#C|N^00pO?h=n)!O=+6nU3KCaIm^s-~_D^^}|9 z(2(AQY^3tWvMKlpbD6xU4b4>EoYKOEmXx1WUb-RL*wEI7$u>-3*v^K2HuSflace_+ z8-B5&gAE;R=ww4rHC1Oy4;#8rx{}?zpx$+g1^L4b-XBB-lxrSV8!#axeu9uBt z(yp!>RkBGopz>-wgtoDH#D+g@*iPSJ!#-8Bld{W(-IP5l-)qB@v)YpHXL3O02W>c{ z{ICrVxEGGf?z7=I^S{Uws^+8!{gg`N|LD`o|E8R=;jBt-Ou#=jT(IGx4UcU2*M^HW zxY&EihRc*YWrG(>mOu+*WzQZF#c3&<&0lObpGW#RjXYu~FwF#)t6{Vmn@P z+V?hmu;G;rFEijZlQ-mB@*OFIB-{b)qYd9w@`>`navEzvyPwgmb zM=?7(*wK-b6t}}D3qUVnN55Rgl6I7`V`+Nr6ew+nj$LKQcv4RqNU0fJ6y@wFSr{#t zl((aT9Tn}UWJfJKYTHrSj^p38(d64zRp?d8YGie?1}SAV?Ko83ATlkNv5p;0Ic8lu z>QU;G4aiCISAZfTH?pI#@+Nky<8do_Gdr3ymxEK9E$Kg#t;p7-bhWXgt@3tuv{(L% zEEq@YWJhN^+|0Y!(bbO4c5Jbun;qTl7-h$3J3e35^^k2YTjPoDS2aRUJ9;U<^*4Ik z(TB~x@+##RIZgi5 zO}1l-ybHj5oa!A!d>ws>)s$4*kTQ@9J$s)?0$ND8IS!%~JJMCn;nO8xi9V&J7y-*&wZs&pG$w$j%)0?ZpR%vOm^H*l{YE3WW`ld zIWNp~J82=Us@F!5o0mE$PST}%-`9i34zH};O@q%4za0VlkLRwkMnOCNlS?%8A=cl` zWenR9QPV~#F+1+6CL_!B%7Km!Z3DirBdr7J9C&HR zD?7gDGQPIstsU>|cwO)qr)vB!c6_CO zQ^|L^V&~TW>Vfr%9Eg68OHBVsjgZ8F{d}I8j7jelhU5;UkSlEpgFI3?kcysKC21V^ zWu?}Y-hm7bly=BZg<>0!(SckJ zc^$|{$xjv~3y=lLLh@IDB2yKi9ImcilZ!b}oXrwsNmWzIfz6|}f-(-oJ5a}gx(?_a zFtDJC14dO@*@3dk%TdZZP=QiW<&`L{xY%+juB!5C4pdiO!-1OgS}Lhc8J62v&w=^5 zjg1^=%%ncqfNV(iEvfD0CbFF!IG@|t)PZIWG-sFOtsQ7VZ%O{F@>UMaUaCF&ZNsE3 z*-rJgr|igW^yD_mn4KI*R!ZMPj=em_&JJ{OpsNGf8|u3=@8;0H^Z37~y3{2M&vxtH zv~iqm3XUqm6K2qywuRSmVI&4jhZeBnKutFiMWGO!_=ib)&ib zV;mSu8ApyMCy=t@6XjUq@3l>FU@F5!4os8dbCPbJs+sQ4z8O7(&6y6&qRb}esG7MB z?JngqpgiU?T;RYTl$X7*(18woxpJ`s8&eyWFkeb8b6~jxE9eRL=#vpvI z)`4|w?k3ke@TUU{c|*SqG9bfEs(v$N3%OO!GL=7St=*z$y95357VQiih1W$L!}pVad2aSjI_IPlPcUK4aq2V4%gS>|ydsOr5Gp96lC z1ROu^a~pCX>_CM1e`J)5smi-@Rmr2R?>#2>RsK8@_lW-4f!oatkLgbwcq-?Ps(J6g za|d3q`I3C=z$*t{JMe$M8urG4EMv7Z`kk6eK7%dI4{UxUKgkh(UfYIW*!=3iHwV7c z2)mcH$=|8avU%i6l-Wb)qC|jyBRKb0V`7S)54jL<)u}ok*ufNaaLo zX#*NJ>8$?rq~ zx1Z*g^%*K?vi zy#d)!<&B(ha~+#H(aecn%$qy$nqg-)TR73uiJzTlIeo@oPtJZDkZOL{jZ%^4; zP~Sl%9i8Z;yh0{)p?4*_k=@B2%Fs1pO7+B@2V)ChwqrT&LuPVKWIay1^~#BhcqRLw~F{11JUN=7?TFtc{ukjGet za0#b6G0ll59z6A6x)U>;NaIFYH)c99%L%xU$c5QX%#p3_gvW`w zPRw&+mlM04nD4{_Cl;wO<=q*X?;lPqbYk=aUGu!g0eOv!omk?;QYV%&X^$p!LX@}jD_Bs+q8>WWIPI&qDj z@R^w#^qWrHa^g1Ksw(eLOiq|77L^Bh(`K6!b|wzesd`;bZ08)kPWYU-=fr&{{7wX% zh&T~-B5x5x(21!%^dUJa7VD*XKCdw>>zmiOv4_4*a(&E+yH5P)MEmJl^ZWsAFUaHg zZ+PIuLnl5s@zIG#PCRx(ZcrdyPt@GsI`NeL%!%ie7jjao-j`0iQvT_X;f?aLOw6SYP*okh2$<|aUrWqTi_HfWTK>W!I(_@1C)x*)GnlBWK4Uf)vb#{og~Beh$!E;L;+!tjNMxAE-(twcB)1EB)Hr!v z$Vbml7EpOX%I>?`QWbHbgbO8IDC$DR1-hrLQOt$nEEvpXI5bmN%7scyN|QPl%D50u zFH7o48OF2A-%IxzW7xr|>|8?Oa30?$q&5Mmf6Fmm-NYArUb|!DK+_$ zW9c(Pqr`@YN}_TCx^UNp|Crn-?~!fzM$ZHKL-G+R<2-iZiSi}+jnC_!SV-nr0gyS9VAyYQZsAIOj7C-O7-h5SlN{Wlk`a_hypfBc1l z8;O)BcH<{{5;CdElTjj^Fr^!**-WK+UA&p(*ZjtGZlrhPwHt5T$lyjsH{5P`+{olc zW;aH;G1`qRZe-RBur?in&qaetdDV1S!pulu~4AQs+j&0!HbIcSG-n!40DuKfBS&jj|lA ziW^nkDCb6bH!4WMD7`!?QhL6KucVU7Zj@-OuUf!Z&5i1Av~Z)PjL#A3x>1i((~Vk` z+N7*q9ZKeGs84B3HXs|4jYz31`6jN3@}_PyQ{LQ-_64--`LF`U_&$2!f&#`p1&poT zXyZm(H?H;9*S@1YUv1~cuWs~|dN+RIbO^>EuRdm2`3A5=ZW)lJ0KwP`)!c zdb#nN8$(sn+l>MAK4f3ApX%-JMu4Nqk_>cX5c9#RcZeI^Z)<1kFqI5$#0eTqt^x-pGDT_u6(+DS3f zjae$0O_}4yT*^F^-!7z8{=w!FHx{aVksFJZe=1;HN?%4USNRGzR?=6It5sen2iCf= z&W-hMY;eQu#-vYi8`*orjiYXCa$~a_TbS&0W0xCS)wJ6vf0EnD9dgnY{P7>zZZ{4v z+(XKe?{#CJ^8IqCFW0vDK_-XD!>V`vgt%jF9B1>Y8zBc{9Tu3Nz<8M`Y%8kG1 zr&S`aFq~0-){S$@&%5#Er8dWZRkFS@F48ZNmsNhnEqC(KDzB;Jx*Ip#xXI=%H||hw ztKNKH<4no}*|mLSVbkh{P33lqgLJy#Qn}nR$m@pBjh9UPa-dS4yAgCFW4~~2A-i;4#O!R2^M>jsXk;{YJ9(?9dUuDzDcBW_h z5cm0r;kz4g9%S$!BPW3eDLpWK*C%3A21)F}PaY)kAgM~?jv^U7xk^%akYb+przaJY z)GANoL0Wn`GQG-=<-(Cw`b-|=^!#|gHM0ja;Ut@1WYSv+)~h(he>`9 z3Q+Qr`8?>XGsyNY=s_V5ntIU8gTm}8|W$n}m ztthQMXhUhM^54J5wfEo`4>~aE;z3srI?_9-n$8}`Excqd-8|^-K`-V#$X``WAHL<+ z(}S-wwbS7@mG|~w;|ne6=RtplqsRds45JJr2a$uxA*4())T8}skH~N)Bgm2D@2ciw zMQ!y*doYH{Se1|SV7&4P9*pF(^hq8}_FxM0MIJ2nU@HCQUfnc#7081bY|bR-c`%DI zo18<=C1s9rKVd$70r>~HQ1$Md6t_fq%Rxd$seSV><;UaqEJ z<-uzD8geZubD5G7>y>YiElJ;`lHzgL;=xunw|THb<$rpxoxb>kesv^%r^zL?L`mHDL+s7hrHmyzbb!U2bbuV$t&bzo?qz~8LqK;oxI_}P0B6u zHYrQkI0H-`nAx;=;PSvtw|ZbxHFk=_1E)$-bkvR|51T>KOZq(UQv#&a#8zpQArHbT zsVUF=J-F+^BMqF|^5C@xL%bO3#TyUa$`#3rs$Ojw-f`rdUcC3h0VaO}yGG=Q6LRUNmFgoNPh1RFyw_wcA)pnLJv1 z(S~_jvK`r;{DqX74qkLrzDB3-;)Q&VzN;7AyjajuyBf=568B?wFM6=@S1)=}dU?^8 z@*CNk>_f^_9)8EUpBMdAGJrCW+)&6kSml2eG7j@%xEIsBnC`_0SyL}2v-fu|Mo}hu zG1`kUbh*EWj4vN#mB&~w#;I|}QznqtU&l>SxqR<+it?$HozrzQD5t#m%Zr&_%<^Kk z7jwMW<;89<=6W&Di?v={oUNNLn?lY?ZiGKL)iN)Zd$Ewdh?M17Oj$xM^}@q?$yYF0 z=|$5{m{~?!@>Oz-FdH^PJYyjV@!^dCsglA5#{phJg2?r zTG*Jk2`+i@w_K?X=*RDfKf{8v&@`44$P&KJr>QWiDYF`XwDE_-1quOD65c+HFJ zUZn9Mtq(W6xambAACea_-tywM7jM0I=fxd4R=sd|;q=0sFzjh<^IGUuHL}eMI~}Qh zoEI)H?t1Z`7j9MK@xm+HicP;4Axc2?1}V$9O~PJ8*o>;)80A=D<2_l7!bW)`;F%Zq zRqq4JL-LUqk10=7?^C%f@Za<2DtY0>OZqGFHTg#M%KzQ(>2W?hHsFI-`x5s@CZD|M zUR3{?{)PNXej~q=vT?pw0(|IsT>r4JQ7B1bAAa)vxNax$At^l>nVd|adQ_aX}79X-wvXME->|~AvPoph{ybmbM z%_I*g?=4D_-v=F=;styt=!0*Lt`L*LWDy^V`n2y37h|)eEDxmwDO1%=gi`dB{&JuM+tTkI{#+KD1;~&WG|oH1eUb4;6f<$gr*tl_*u!RFx@Jd`NgFPUcn3hw2P# zsG6ES)KXsChdT5kMYQu&9`)F)??VGhL-NM1AN!?=4^5ezUTbKxS=Wr-oRn!>_>k}= zm!ExT#jrKmM&?q)c!!@8>srLv-iKdg@A#3=j}9`44@-Pl>O&_MkMm)?51r{+LZj9@a7{9W~yT8+`N7U>Q07~{iOx-MNAX-@EABFh$%lgJt5 zWO9lRQz~s<14j*>O zVIK}EKSW75kdF9pl+9!0aqe0c7|RrX%<;X0*KH{9^yru-o&s+}pfe7Md0o)33? zFv&%LO*82vrOe`km2Ojso#K#d!d7i_x!828UXKr6<=uzDPY;kmA3{EaRd39Pi1Mfp zbu(zA-DUEh$}?Zp-={xN$wSH`xoA_KsQjr9uemE<$id^oCzZeQ;f)V(rPl}l+xYSI z4Z?S_%IyvBStFA0?DT^VADNWl_WA6?7azVdN#aLR-bdvdo8QSeCLj}$iT(JAA}i9k zsXmz>$^FRWM`k}#Fi%USBvX;8$uy))Rb#Jq{HOCHy-G6pkx{vPBR-4r?0#fbp3RSm zeAQQ`&A~7ynahvdswNL*?|fZ;KMMHqrytw>DCkEaKWh3>%a6uIjfMRv;zv<>A8v$V zoJ#giaX(7&D(w`ha4kTr$emOCiK7<@f4pY4)OCnP+UVb2Kq#wWgG0Kn8e$4P=CJV-plgY7u zj8jvM_hSNmA~{Lr^6umm=`N?8GmM~eW@(f$C+>aH0tW?Q5KUUFKlWSDIRt`=cx-!msKQ=JmsCpA# z`r9IZwV&z#DQeuxe4Fas(p100kDY#a{O~f|<%h+O$06NrKlb>s*DpUUinD&4^JAYM z`~5h;vg3Z7pd9q$5alp=ggi>h@*Jb2Pi#0z`CH}xlcR$E7kOIcJmxc3k z0zT1={TeSXr2pfWk9gr<_TC~d`ff7702Is9-kbdhdS^6THVUZ0H2#P7#j&Z2uWL(q>5#f%|8 z!hS?leZykfAET%rF(!A(|5Wci%6&f`P)f7-u^&(T_#Q!A6i?-p@#AX{--3AV#|uCH z3*cS=Fa3DsN7DeB1@PLBH-2OZAZq|`{dng`x&YD#&^9ODbJ)**eDLF=A616^c$WA{ z){eLEm1X-PE)_s& zO3nas1&}*{JZ#Fp?L`B~8$iAQ@-vYU3I$LgfYrr}1yv$0dEo$xFgeYpB*g+Ku4+n9 zN|G|HE`TxtwEq_OkNl*UeETebgj-|jRlOkqBfV?@)E#Edtmcz>WY~2JmwL3j+bHeEXw2?z4fI$Ha4xk;w_5u7NlSK8ki|9K9 z&@q5pdG%X!7&@tW^$DPJ09^v;%A_aRjqFbLAY}o54d7G?ZK--O`Hk$Yde0fOW2Ubh zMJnk}89)vsuP4Hg0EPxIF@Q+{3}ZNf98QiPM+WeF0Hf$K=GXv6)5oY}I)5p9Tma)$ za*#ibEnm!^H%kAim~k@mDdbdDGcAC!BeaE_!DMCtvncYi^K4Z!CxE%i=LImIzJUBg zT-O?7B=|Atk>Wz%}}Hm86i@|CQgO z+?JDz`_UADnTdrA2Vf1r7JyyVdjoJNcT!vdxK-kjJ;kjg^YsPbS9u_Spz=@vW6Eg@ z90?#AK#cj6T-sK;t7@cqUp7<#D}q=V#KQm{$*CGd%OD;H@FajlK_m`plRV`lp8|Lm zz;ij9HsVD9ujH~HK(b7RmjUfFa;=>DHv#Qe0Hpq{Trg|u#ouwl%`L|1d%?7 z3_g9&&DT7$MLR*qlL8J~M4aZ4KrXv$>Cn&7GTQ||BJ6YT~_Ps815LtrA8br1r zHu5*xWCVF4nmq_}abu1k z&#oe5X|iY##VEze5@boT6e;7p=&7x~j?FSb#8dR7fi#j*Q&#pJkBtgJR1D(ZrTT_J zRAO(nAgTvZnO=pgs-{X-Lc0jm2%^49YEo*EwS%Y=L|uBlAX;D07DgV0I8_7Y2}3ms zqA{D&+l10Ih-Q@LDo=X^KL^n&h{;S^2hk>o--77PW?R{VLHtT@7exCYehF%ywC@l^ zcQr!CAUe@ItE5X1U6pr}rR9PpyfinVjiD#Iie1-tD`D&vgmB>ieV-uu1~HLcHS+5F z1u;yG&_9R)$_G*gk%P%0K@3&BR~q8>DBbWNMg%dE;qO6=r;JiHqk|YjAFGmal!-qX zCQ#%@C1i8S)6Pjj?a60}v++}cm>R^iAf^YgJct6j^fQ8(8N@QykLTLWqR%Gh1Ti;= zd2|_SVG#4_3smw)5Y|~g_S&K#7BgR>dY1+vKl>#UuI9)xyUGvstAbb^#DO3V2C+uY zrXaQiv6Yjole2@ep4mE?zlI2^>yAZ{@{A`IeG5JzPh`{%_;Hka> zMZc0YQu%Aj8}ju>{X5Eg)%zickIFw$@}D+DcEx`Q%E$Zl@`0J}LBxfSFO2+QAcRCA zj0s_E2#G`ZDTHPrG!G$32uVZGg-|AhWFaIEp+pE(XBkq2kTQe}A!H08RY==$sYA%4 z(@*9eNkdOdN|=t4K7<$V4bsdMLgtWmAAWgpBMYa^5kk%oveIR!Y$0T)C%n9$i(XLm z=9baudC7cae$`umvZ5#qy=aM#>w9Fr^=&EbLTFF&9su7sB`u%pq7pm=MCm5VnQzX9$y6Iggx7P9dj~)5z(h3^Ic=5SA z1DkboL)h^wZb~J?tCGg~AuN#Nxs-M(`y+&fAuI}EF)P=Fu!ORjTpGeM%JL9CwAP+6 zu3&Q|xr&sq>mS-GtO;SQO610d>y>W^VIzGLxtZLedbi5K%q7__OBljQ<~u{!6~ZwY zFpqw>oY61h_k^&QQjf**3E_Pq>}Tgm5;5b95Q-BISGt|4=TF|Ek`zopFhNStVB}S4ru;uJRip z+@#+kZfIGR8u&zgH|x=R@) ze8A)(IqEc55XJcPEZbn+zXMF=lh|0;ynA-ti> zd_RWpmi|s9?UO<$_A{?zVx`5_6JFl`v=!gxItxx+{wMusqYd3Cv1 zpD~P_luTr1QYOg~Mpot7!pN>XM;N`;a>{dt8KsRyJi0t#H2D^nmo>=`#^;=CC=f=$ zFdl~SD2zg36b@s07&F2s5=PN5s)SKBjAE?s{W;DMM)9z`1QAyvjFMrLVjdrc{7gV; zHD6sAW$3YoKdxQ+FlIH;Hjy!mvSE}9V`FJ!g)l0ztb7=*$y#rvFrvqGf0Z^?4r{+G zBR_y5KJTNhS{T(?IW~+MVblzxc^ECih;Z#{v8y&IgVdqa4WnKd_35(i4Z>&`Mk7_z zgwmKiR#2OD(=eK`S!{)NZD|?C&tbF;qaDLmVYCV3J7?EAjPirDNu=4cy`en|ddhC1 z{1QfoFgk|OiOp_gXHq8V5=K|$k=JqE={?9_RX&rq*7+@r;Y@mm(TCEP94s3@jQ(K^ zV6%o!J7xybMFxfCiG-F6QOVFShAEfteUDH+lJYw_iX0ur7)nQuFpmDYiGF+-r{3!( zgfWrHBvNKEnKC7esg!9dKUEJiWp{^hCXBNTXNR#nj6Gq@31e;;^B67&;}1C$bLr=Y zu_1^4Tzmb(Fcz_EYZ!~eSVCVP#!|{EQs%pivOJ6xDp?tZ+*C)pi>_{I;Br zqjaV)9_Wnn*4Q1{eSP(}KN-wwG)oxPFl=FDORbG#XYL@Katc%2a?+{$ucqu|@P*-L zevb^0N3!dKln^OHh2>nPN68p@SM~lU7pQjHS(&tq@xCmcTu#dvTPzg(RnC=tPPPMbV}6cM}#<7F7HVcgvfaS?4hfXtFy^F;K-Qa=xwDOn<@m8nd^y->16key+U2y#<$ zk}~&P6uFDCc%BIIsyrVhe*^_o^89^VA$no5h{}snijiw3pkxH4BB&QZ{Rm1&po^et z1l8DECW6Y8_z3h780h6mnY%H9vdYUve*9iW1(j5cpptTV`=I`1U6lwn|D-RqR5vS! zp?U;0*qgtMG4DKGhN!-#tUi<4WF0kaU8yXiT?rdR&@h5l5wvDkjYVh_L1TIo()d}s zZZwUcnVPmar9}iSDL<=Re#z_b3PYO+x<$~PVOz3Y1nndEC4vqSbY#+ryfs?e+VW(t zGn-w=uB7B;`FYD85sWTl92&u|5%gqNuLuTHev6`V5Gpg%>%>BQ9>7{MSW zXDetkmB$b^<&!7FRON8W2y!I(djz9Y?`YYZZ?v;)Tm<7Ia7N&YU_t~FBe)sCtq3MX zFgb$l5$urjOFsM=!K?^obMmPXOp9Q81T)lVGb!cT=%3Zs#+(zu+z1YoF>Z)po~l_H z!Tbmou=z&>ODGG;MdV^qCQr8sOXF0@DG#SLdu>9_C~OeeuUgl%EBCo;2`~wN)AWR zc7nDYjxsq$9w$$znv)S+;}V{V;4g-!$+HpsO*x|~I}g4NA{(y4w-N`o%k*8cY$~QN7dJ8O(G`1fITntIBN@djt+j z3jTbvTWZ++5P_HSG=gUl_#*H}5Mc6O1fRH?!3aW3!eoSuk}*=2`L3L3FSP9@liZ8o zKBpCbKzSI!Bg$iyKamSyyip3C%Vl4#v=O|G;AI4lccW~)@!FmE!M*gaB6uyQSTDUi zHl`|5v{wAP2;N8VbG%W!)hO+k&NBAUw(v(T#-|8AQ@*IB`WnGE<#K)@ibPS|xeL=> zB#z>zD8|PyA%-MTB#j~(MJ$SBQ6!I|brfx)ND)QKC`w16iy~DNsiVjiMfNDZPt&D| zLhfUqHHx%Rq>E}hH$9m#iVRV7c&P6eZxm)?n3U!iq8mpT8bx4wGAkb0Z|NO zK8PHwYKBB{Vv)AphN)zD6eH*(%4O};o4}^LyEKt9N%c;q zOo?JDWtz%2-qg1Fj3{O@nH9zCDCW=?MzJW0xvFwr6!Yl|RPsj@R|jazERV%eEK#}K ztS0p#ZP?{ZRz$Hf`s4Fmm-gvbMX@Q0%~7mo?;3I~xsF^D$R2ibIscvKJ^vRLxP! zF*!n1GW}EB$plx)Dav0_B>ZT?nJCUiahqW?z42TWH=?*1#d$f@7wP^{Q(cJS-zYA! zc}cdU$}dN8MfvYv;;zxJt3>|pRPn{1u5Fk)On*!E<}m&JLHcbe4R@k2MPXLk$HIDR z6t*brbaxb(UB8qGzyKQqot36eh5>!$?ddc`9x#AaCaMkw=!>hDJJUlh$^Xdc78 zDDKPEFNTaUJc#0_?>MsGZj$?!=|=P16YsS?GsgYat<-&FEFia3UnBZl==wWBvN zlkTOo;-vI+F{F(#lXm|@WvzNILWH-=Sj^ykLv^Tm+xTQ>RG zTOfvlYT81S!eo({{EUuvDadvW#bPMVumo9>l&(?~d1s_d4DmAG7@EeQXK0AQNHOX4 zWn)M*SyzY6axs*Tp#r@cDdSX(p%T3^Sw-blW7wNaTZZaPYN)(s47HTkj^Q=8l9bhr zp&s-4s<%N54e5g z=*zI38mD6n?diXe9aMgpFB5f&p>qsf733$CWf&w3}fYp7)HwZvPCyswgA`k z_ZV*0*56K#UTltH*=VvsA0+!8e}gZ_jbkD|b2%}FNpi^DMVY&p9K)0toH4j!m>R>h z7*51+GKT3f%!pxuga+eGPB=G)c`?kQ&n9K@=EzCSJ9>@%WSAe*zUdsBsmqX4Kd_tr z57sP>^10 zo?QNW&hI;C&U2o*bLY;?oja3kl1;w&4y&`VMzS9XZpg-3A?pO!3$kx_8(?FaZxXUu zu&a~tiI6SX*qV)P!aoz-F1SOG7CvQ!$nUSuv$0czy9D=UV|Q9-kC1iZ`F)JBwr$o_(QtZk3xQ8FbMfME&r$}e#yoe$^I&MUhu5oZ-VCpf6vAd z8Hgzd{lBttAsg{*B(iZa8-HixS~jk;&)K*v`d72@kB}>Z9OKM=?%4m-6)&KjzT(Z! zhCdt8Y{Wz%AefLQg4r-6YYJL|AwgQOvk^}72*XuwM^au~sa$8hspD|CIb zzaKRw`uLeh*3IQdaX(5(Te!9rQ!bV7cPDhvvr{e$4Sh_e1&7$B({# z)bXP(M<;6a1RMC#(2x4UX?cTEjncf8AB}}KNlTgvX(rfQu!Uet!GU+(6S>xYw2>@% zTR+NZ$a80_BHzX z(ch18evJ2HfFA?>80E)kKNc+12l+ABk0HXVPt=Ce1CH-VdhUjak>P%fNLw2zq~U#S z41F?3e|WEXtRLpP?u&mECSq4ep z(%;{p1BDin4 zw$YDGer#Xv-7J!i)B5%5xO)`!x3ScZ@BR3}j~#w|>c>Gp4*Bt!-+iGa6?XdZxzxHj zNPGD2@?DbMEx1Q;ui!pE_6s>6$hu!J((1Tt|F9ol`f)9<%$a9(_YORs{>c?3> z?gnr#fZzN$=f}(dW(DxOALqHr1W-PJKm7QUI({78<^9W#3u5O#KQ0PcVP<6evAK@= z+mA~kxh(jPAp3bm$W_5>g4YG#C=0(I0YAFV)q;K)Tm>S3^fW9#Lc)`RwqVqcu#ku# zEmv*jdMqZ{xM0E$CtdpS<&0FC-|*vK;Wq_urRDG08Mo8?4z~z-h4?)`?)&k;kBopD z4F4v)2!P+?E)c-(d+sw%IReNjMY#lX3+55bE0|A^n)w4T5^j}(0TdEpVZjoDj|5Oe z$fJTq1*u#tfZ}Oh`-omL%}WJPT6h`3vT1p(#;6cL#Q-`6&?$gQ0aOma7l0N(l>n-W zTCD&c3!qv6tMcnL12|nnuM*TA4j%p~_NU*UWg-rrz zn&!(=-35CH_6#5^UALEz-U0MUOZu|<6K=5e4`4t5SL>*O0o<*lYM#xboj21FRaBRBt=FN=p0Za(EuScF3z~lg)qE8I( zBtd>h`{@9l31HJTowtytq-(tpz_S5Nm2A)XcuvSP!ROODIppJ^(*u|xk{1PEN|(lN zWV{@}D*>Dd;MV|N4PbTv+XL7Uz-yd(QQH#08$#vJ{Ymw)@J|G@uV*Z|p>GXf zTL4Eo>Q!EG6+R8%GcNxC_5{%6DeZIiN|YPaRXc?=mv<(gEKqx|WKRTeGJt);_XiN3 zq8}ia?7@J0J?dxxha`Jg@Jqq31lin?0EWtyy{|=bOz<1Q<7u6J*D}5h;5+&=mC>@J zcIeaE{vEEPz7OCBhToIgk7>=H0yri7XTj5H`7c83%Wkc+Tx9|L$)kV>&+!l-G@2k;<(i9t*XA|nU{p$DOY$Pq-&pxc?MK|IwLxq>Jn z+1x?ok}s#^k!;=|@&%D!c=szA1%wn7EF@T1@DV{;E58np22nJKVnGxSqC)Wht{s&K zf?tbXCLJp&%B6xRovu|Th_b@V36@XGTNTwS3a^xwR1Ts_n)6!IV?k64;&G8Y8ANp< zPXxh_#IZ9>HAGUfw;L6i!aYIM6hcWYAzs1Sf<8elh&G$u>UDys8^nMh1_n_ti2736 zF^C316uy(uFo+#8B0ix+ybrHTHI7jf! zAm$2rOOQHm3z-)LTW9uN$$k*The8$vu`q~5K`aj9_E~qaFA+J9Xyi+Scu%s+1Sxr6 z$nqdoq$Rs=xRJ9mi1k5i2x3(btAki0rRD0Wv$MP(r8Uf3~D7u+Gpc0Uc`GvS}7B|C%Y^qlLT_Xq0d^VQxH#NHtGadzrx z2SjJT@E)aH$rnK!4C0W;zY3yOF*K^D4hQjN&?QX$>Zv1X%SY)$;m6XFZ-O|U<|l-l z3?loc+xquG{1C)43-4R_k^9x(-cv#R9K=t;mo;}Kr-S%~LIbA_oRR9cgSZpKuR)v* z;xksuO5d|ywMjQXNM#De?_hWFez+V*;i zr$%wEqwjqrdv5p!1-0;B-c%6(au2Vo-(dB>yfZznus~d=q?Xsf zOTYWd*H;|Z6N9w;1_~JHSKmDY0YJIh|zT#WN zwcWmA2KLrh#RW?UGFwteDZ$bP%B1CG4b+>aQK5q2j*@@cEfK2KdQ5W~($%4>I+72AVcd0~@I4 zPG}7cG&0bIts7`;poxKY2HI1>Kr;g^478-An3~l<@xK_&4b0Yb-)G(r8mLwV2CmTC z8fa~x!pmA4L6T-0wS5g#?pwYNoS;{|)sN|&40JT`)fH{dKCQD)dwoOg&IbM}uhl!_ z>t>+4fdMpSpof8;26`Dt9rT@Ap;tcZwO`P)46M8C`?Z1UZ6Mk}^)b+wGiYGmIbVOl zl8%@Bk0U-}zJ_X$fguJKo%9Z-ZyT!hxfOA!;l9N0qaXFl-1ZHOG_cCRY6GJTj5hGP zfj10{F))_%Zs0i%xuN3cKF1jtZ{WcieS(201~xZT+oos}IjvM~s3r?OWnlSkFSAce z_8D4hsQAAmDnHAye5sSDVzs9kc*Vf02A(&-?7F z92!_=;C%xdmw5LM)VPW(^w5_ZSYhBp13zc`J}}(RvaI~e%a@%xabKTCYNg049rCes zje(C0>^E@0z*inYUk_>ILfnR56J-2Jb zEe5t4*ll2s;l7q_o59B&^_?8!S#7(49fo@>`&95VL1sT^@W?aIyF{7#<4bFMIggw5 z2i^322DTT`TMyKDosiit3>-A@y@4ML95Qg2o-uI5aK8!5R|J1)Ag|y1<8iI&5O*^_ zYT)S}`XaCXHN)m>?U=Oqjo@*?6M`oNssF8z@3QT-Qg{sz7^@tuiZ4V>kAG11AyZwAg8C~KmeiQf&J=hkN;hlxKpIs*v<4%ZQb z!GPaDz`)%tzKaGf8Mw^A&Zqy)#Z_H9(MZ+Ium5A<3R5F>`MSpJRfcqLjp>?@>jtug z+;5~P49c!$7%;gXHdar(?6o-jq?d`y_TMM9kO87?AS@&z7!`~OvNX;J+~y@oa#FY! z8mqeoZm`tAO#`>Mjy}_GR?xF-?StR+f1lJZ-}U}y;5IjbdEPs$yF<$=smSX$R$m;^ z?(rzV#b~%6&TF(n%P=vev1+kH-`!u!X(E@2A|@U+k=sNb6ZuUPFp<~9olzRM(6%GB zd?pq(R!iRW68FsV7Bo@V#3Lrcd%T5AY<^qc(pY`hSQWkFPS(1eUTu@NsEHCLN}4EU zqPPh@7=P}nm+!>8+E|sM@SgWhV^zjPY193T&aw=B>uK%5avz1|O;j+Un@}byny6$V z(}c%FWfN6QJZ|C%6Fav1s+xGrL^Tt9fQSFknfs;weg}<@OYLf)J!zu4iTX`chr8a= zP24xH=Ip80Ffn4Rc7KV!r-N40gx5rE6MdVgT7tY;e4?^8Z>d(Gt>!bK(F1K=-sWSi zj)}S^nwe;Bq8`nfXlSC5i3TQ~Yoc2G>z%Q}yP%0G{*K<5ZanB~YU0yw+K?N*CR8h; z&CR9tZ>90xSql>_O|&u5)CH(zfa`-=^t;o-ChzWOB-xrh>2Ro)kqUOi5+TUn2F&g z7F_dwzuCv{|MCL(#U^S5C&KVG9;T(5s8J?9`%nvi<{N8b97D^*vnIxym_RJ8O)~LI zMU4m0iR|Zg{rV)mcvCgm#8aH*!``Pk7fsbOCU|9uS@MoeRmB$CRJzy1G&+2R@8)^m z^Cn*4ivG=;_XBUDs@`a&Hm0eXZt_V6o#Z7GGwC-IADftE;$;)_Ow2d&iiuZEylG-C zNmDi3#Oo&BF!7pXkG9q`f7Th^a~Pu4wbk!ygCFQq7i%k zj8{tEG4U?v4*EKJ!^A=p%Nc$q4mVYcOuTPm&3)fu6D|JJmY7&7^7l;Se4s58&ZmF* z-g_z+D4<`;p;y}J`>n0^0XzAMcD|wZp^23yNLC517G!pfiI38Jt?7Pelfv~THkjDR zh{|1?XR4b_cW=MER=aZ8%j_p6wwTywV!w&4CbpT_ZDNm!?OZq}J~y$`MCZEtr<^sq ztAeH{wLhAwmEUN6z1r@Z8aIu2Q?-l3|4uu3#9OeL;^|YMskWD%yzVP_K|5gL3ocs| z$4neFamWM@2S+(Z6JK&gzwbSl@_og%*-RbbK3r2LY28ebT=?1N{t>mCp0AwxhV!+~ zds6VY;0eLeziPvpsr|cr-<$ZsL{kgRc>ZtVClj~1Bbhj5;%5`rO=O!m&CoJ&$;4$7 zXSn%uZ>K95`RlxAIo|JmzYG6O@El#;OtGl8Pw3$o(;qv)eyY1-LOk82>nyK@zdE+J$46}Fie@$>P z?%M8kOe9UDcociXdxPQEPH*(P#+SG7!VY)unL?H`>Eo4}Lg*+DWTF7A`r-cyE!1wV$a%Lbnp3Sl z<;`ayzl8!8rp)vvBi?)G^nw;BU$Vu^_dw2Hr9EPy+$FuZ1>UwUV&PE>C97yfEfllx z(@m{Qb2YBH`lGn^(=4rog}KcYQ%MVJHhM|QSSV|uhJ{QTu~6PZ6$@1@{JT)EV4;$Q z$`&eGSU5vp+gyFsT-E5MbII?jrLQ=vKW3pCi~49!T6kxjm#-#x+``4?is=apjB1kV zv_D#7+FMxjSg2{Cu7!FQYFS|a>sao;?YtbaWPKKt5KT}QWH3{cr{6^Wh=eH*{e)4jfh3752XyGLbFIeDt&I}9u!9p@!vfX-U%<_H~om1t2 zHq*kr<=*@QwSQZxS1i10;av+0#O7=Z^BF1@USppN>#s9-w&`zJDA7tW%@Oh@LsZCH zf^Vlw=W*^tjr+#HR%(^fhM)5;w6Mr>|9ANw9au;$rmO$)E@jwQ;Bn;GVejgG`kt;j zPgf3|(x|qa%gsV38=Y-@VBtdx6+);O!b%IPEF7_Llq-u%!@_44KDY3Zg|!woTG(W{ zZ`fN$KgbO`UY=dg<ucpK?VE(@AznmM4VF^3C42vb{Skd|~0Bg zZ8_<4p-i)MK#+1tw9W`DA9rj`2H!f6YqxKaF~MOrE1 zFBUq!lU&_=ohps1cU?ysbg3$ z)BI*zw|dBeEt0TcBwZS{+!vZrfyUz&=6&JiCZDvB;(jPPhkn$iXKA~?_TAuytm*yM z)ZXXQZ*sqVQRg}5Z3}lS6bhkm2zNOsZto%F3gNzm2Nv?RRv96b`qx)#yY^yX#Zv`@ zU{unWa)fYgyY}%XdhU?hy)Co!f+6Gyq0CWl%M0GTA><2zgekv}0)o|Bt1d-q^C#FN zAruLrB#qO~LG95HN`%0VYZMKk+-)yYF(Ji6=-OH_%OcKKX|{gTS3ZQd59o#GYGv5% zxmsDla_mMPS2($~VriuiDu-|+grgx;3888TGeeja!eb#+3!!}o9YT0KgeO9%6@oW} zCqsCrwaR4CN^iB{di4-$h=jtSd%T`6G*1XML)g+<)oh{@Ylq+qp-u>OL*TZfg`kI^ zLf{u&uMXC-xBGr*t$ut|`)IsYFNFFbWVcq0LhkRZ1|c*Ql6}%QY?rToF0JZWy>SRl zLTDO-(^?g5quL5-CfGcL7D8CmQb?;1TBjv#LinYedRVJn2y+)`tllw%P9aPPVPXiK zL+BF1&=7{vlk8pygG1<5MC%^H0$XG1FQf;%6hiZu#*`(bR|vh+l0G5yP4j*sL_Mw= z>kg2*0|f_#P`!T{BHfneq^>{69 zYzVQve8q}BK7?^0?AYUF;<;1HA9cRAVp0f`Lzof5q$=*uqNhUmZIJeK2y5G@!)??v zA)Ifcn5GDMHiW5Z$#X)ch48$P7t-?SA;hK1iy`nQ9@9%g{<@;S%3A?!TqohvxHt$Ld)=&X01 z;9EPrw;Jg0(nTRG31KNG+M_QFp;8fTQ3%`Gs*`Qi;t;0TT6mV1$ctvYIDDNpcY5Cs zVR;C=OAl!R>-O z1V0u0EQHU6P;+MpUnaaH?dEC3y&>$Qgu!_V`$K4(sUHmC5RHH4J-~G;q(?jT#2#O@ z1Kz_S@O^hrU(?BXIDV>~`idhx>pK(FzYgITcM==h zw;_DT$qnI;5WWxLhY)_^P9mGqkAfYZMBz@_z1;5J`*R4ti}1AIFM?+T-7QqeS;5}~ z&k3F`16~mRF{=H^=C+%jlXGgHuYKe~Y`oT9@x55&qswak=2|%$-J5EuzrCFb>lJNOvQf>(<2HVL(_7g_ zRogv>sUq3+?G=TO*?6+Gc6o;WO?wsiP`lh-Jz;}bGX8eT)I!;a1L{`|m| z^BJl;v%L*$G_ujyMnfBGR(hH0cTi1i{JGQD%*Lm4y?lv%QyWAcotfRUsOcS4I~(n7EDdWNY<$~6b+qwH-r74lsIySab`h7- z!<0Tt2ZS=Cy+r}^(!#USB`r7DcqdzD2fOq;YzUv)S zp%dN#HU`=lVq>V79b{v$4P(Fic)s z-o^wQV`$+!eVmOuziDIHs~>#Kw*1Pwy|Y%Yqnb$f?)EWF5i-ffWE&r~(kXe$#?$H2 zXM}v2&z1M?sGjbq_y+aoY)rH9JiC2ZpDsx90v$NRT_C(9HN(c&3-uQT1Jm_cHeR-Q zK*U1&&Bm)X-e!E-n9WGDF~`Q6^iopWI8A%q#v3eMtMMmZ?S1+uhIg)ww`}(Y%E-gM zJ!|!MI=a{SR~XuS8+!+7{G9amj*1)mJ2u`G35Cr~?;;zEZ7jF3f-&DwEwS+)Lt?&{ z7w(qYI5k`2%P7YEt}o+K`dxotkf(N^pY?uV<3mQcsgau<6@O8_`jfVrv1IdIulSNK zva#024#tv=j=yT_Y;3miv5oaMHn0P_wvlr>RNEv*ct>FAL7ngS$eN{pVq=Sqtz4vA zHNG1GozylP+ig_rq`D+@zN9pu(6XK>#Xgvv0JQh;CmPwozz|% z`)v0m()IXE(s(hA_(>=AgN>i) zMlN~oJgdC+SKgIb`g^7IpKV;}q+W`6$xn1rXKegx?;2E>W$b z;%VVOvOuobxN75?a4WqMuiMBL?za&T5)?ET34Af^VVE{9$TtB$?W{slWDACEL~KND z#JCBFB+j*CW}K;jM}qEC0VUh$j>ySdjn!^&GvSCL*d4)58@FtX2xDXz|Jk_B-6M>F zVcfBCm-|u}jl;Od&7b>o7)8Q(z`1xsW6BqHNk$k5BZu&uVdNG+J^ZDH`iMGw4_5A9ffxi>@3(NUD`E_ZfU;O@~~nL$xduhlRPVo zUg^?@@;+ho6-htA{(@}_xdR*|d~g^;!kGQMmlCF-VGI}furTHp^zi@YoeS0?ez3qh zDvZ%#)QZ3x!I&_{hVexh2g4W_#`rLngn037H?pyJ0L4{*E9mFp(2!WKo(dPV2lE#iV3f~HT$JG}G=j#WV&>zM4PhoJFG(|kk$P6PX%4fK2!?+g4b@A|7!3%=Fg>g>E z@6x67f`5qQPvL(FGLYEeiz253{|@7lNG=QhBl0W4uL?fYr)G8-wv_q>1A;-(F$7JK zSi(d9f8DSYMZ$=RJSG?yVM4g`Kl&VXN(Or)jDLktax;uu!v7PzEqF)pt{`>p3Ar!$ zKrkZ$MBF9GE(_fPXu`*$QMD`2+Bp=h|MopRIoq<1%(ufxE?Dk z_=re~2!B-Yp?`{roEC~lP(tJ-1xty%wD2hh@`6U$Ns18 ziL*$wNqghi%%3Xp>l7Un^g3luOJOWhxgP$z=A z5!8!dl@!&Fpg{yLM(`31M$jmN!4V9Jpm79EB4`^yy9k;_&@6(M5wwbco6p;qGMY!w zBH{+~!{8^jj)1}3CgN@a-xRCKbxkjEV{9KmhY0#b&_9BX5p;^6PXv9X^Y2geb&i18 zMY3HZ=oUeD=~Yib_PmD>+RREzdPUGXEu;b)dajG&*tszdh`3wvzz7CO-?&9kftv|8 zPg)on!LSG>MKC#n;Sr4BJ|DqYaoxxWMny1M97`WEiWmtD9#$V0!FZaDV4^fin=Iwf zsP;)yPduDSou?vrI)djSm=?h^5lo5T*$AeJE2zl} zyeU1I%gA5j9(`z&-5}13;2o|Gn!1!RU);sg1raQaU{M5%Bkp1GVIa}5bRDa(W5lHq zycfYT&Q}B<+~r z1b-)SDT!YrI7`nYurYz(A~?qYPGEQfzelhloY^~uJ~5n+;ExFYjNmWEKolFIxDdg` z2uej!I*PwVGZH~Gf=dxxj^H0EcTw@28CMyo7c#Fz+_Q)+7c#F!aGk3r0)GTX1ZD(* z2!b>V&oA&;?omE->a|Rw6+tM%3ycV}3Ou_WWUk#_JK06i1B33@EYMX^Efzss>gJE4 zVs1|&g1cN?xjjsdkfdNLf*TS1%kzK9-WI$i*eJK>KOqBhW!w?+VR^SY)4d4pb8(3< zL+s~_0zz1tLrBkD8RWTy=N8N(m^X@iLReb0t12M8U=%xYWfY2{a1@V-q^Mw#wC1Bx zup6wxR4j_(X?ck#N(yh%Rk5f{6lJ5Jua-nnE{gI|ycEUEC@N4ViYKF}9z~@ndUsWo zqo@)E-A?CMjk-=Y|H*tJipQd;7R8jV>hUNRcU9ZFs$Tg$Bz&N8`2=5$C^Dny8AVnU zo+xTYp`xf0#kXBmttdKmQ+gEMC~8M>rmHf#Dqj>2x++bubT{Serbc#CRIVFEy(l`e ziqx$iMaw91cUKLfXc$E!cDtKu5ykm#YH2ssIEp6hYB$wXu$f?U!LPe1%9$eFRI4aj zN6{vVwo#1ju4s*^Vt2REc5JS@YA;Q6h@zVmz0zHECYNq^iK1&1%e$+cl32vlJqltE zK{nBgev9H6Iwy)gQfo*QL!;;$ML)6pV|Ue`(-g(E?rLBZgM{4cuIQG*!i)D%EUMK* z4U1xA6r-XbA1*jTkR7J-=qR4=p~goshGXfWn8rpiPWTYXvUEZe3wo%DqB%)$auiPq zd0LPirrNX8&uNrIF;)0;QEctu`s7#-*FP_a|JmqYJ=Am=#f&Ik6haGBm=(p#QM?ny zyYxd8uSW5D6mLlDP7k-Yv!i%T=7O$cc1{!pda8M1_D$h)1>cI|?I_qNOPL<)>4w4l zC>r;4Yb}UkA>)mmyq0;ly=PGr8QW^Fuj)Cysdk^9ihCO6OQU!%ie*u}AH_=gGmtr~ zr&=Dxhm`kJvwEr(Q4l{!XIV=5D$!gmxJHU7{3wdGB3Tzjvp^vZm z4o6YBfv0R;&o1&7p8Zkmj$)7SyYIc^&+e=mMrM{F}UkQ2(WqeI%M)7MDXQOD|OZD%izKP;^6i@e3C!+W+itmM= zMxNhT6vdxW zoQvY43z@$Qo)@gzTT$|taFV}y6cBzB%T=Me$!0fhhlSizvGhg%L%M-YOJ@EyUz57sce>YHn{uc{u7GM3^E`Ot0+uEnf!t zoqQSbC=yb1gK<*9;|Na*&dHyV60*6sd*(Aam*-!}-i+deNNz`QhYKNwJTcsrq6ZAi z7_RnK_au9tTS0!eA;kW#^_(%}?4xqTFem1Ara~W;D+c1@IXpa>$s0p~7#j9b`9wc| zx|X+sr(g_)V(8sRJ=4eS%h7vJUilMSpFBwC* z7|O>`O0uP6C?lk-^piuLCk8hPR*0cu3@3%NmD4#r#40gVjo~q=wLhoFNS9U<$<6Yv z&XX}@#^4c2^%!ahp~qPCS1hw;4AuIo+A-9MfmyF0N#4Hhz)5;F*K!fVrWD=@yy1wS;^C^uWFXVlj*cP~|=E^;In^d2Zy)c-Uy07(VT*22}F2kD)^honq+B7ISzy#?T{w z25p`c<6UCt8bfyq*_r$q-RSe2o|664)xPRZU)3`Pj-pdPl|^|!Mc#|1`l-?V)XaXW zZw&onSP;j;IQp|cbZ;D$;usjiAa*H+Z(|r7!;lybiN}V}F#qO(bmlFc!EEc_F}ErMGGw+SYs z;-@iu7Q+`YEE}Lck6~vF2RJFc71OR5_QbH4o7(`jTZEYdRI34M=m51ZhW+&U0L5C= z+%Z6XJ3z7YpxCKd)kFDV8Sj@dd=>qpg7Y;{ea(=F;W!u6Ky`V5x-~$3!;NB~ zdR($Y2dam1YJL~P_c7d#;Z6)c#PDMbW(-ygKhf<2)!#9c9i&dh@N*2OWBA2gyxUpbweEc~3{?}FzA{}B9BkhQ3MA%=@FaH;+@Pz497`vcXb7%s=~k1R1Z z%7sR}!ktR`Kz=QT>uH`HgI{<+FeqpUKCBpu!HyvrLn?+aw~;|A7DKN=Dnf&O-Srz4 zLU}xfL<~+0PYqH`8wKAQq;AlqgVfC!Y7bWb#&Cg>L8|Cr)n%}{6~libCuiy1818Ws zj-z-S_hWd#xgM+@i6bKp#8Eiz?&?fA;>a1tYlGFgDxNWe6-ll*a*KpKPaJuL=M&5? zSU|9#U?D-;p)zsJU{xfJUk9s41&az=gB2w-ULuatag>RpWE}Sft5Sj_<%X!Tanu^3 z%EvK#h$<(%!w@xUh^iox)k75JmE))q=O2;KE{>{kJQhczxO)`iajIGzHR8yOgZy#9 zC*pWg$o?U!x{$L&lqZgwany~Y9-9!MFOJqjl{b#i5LKJ57^+CB4OLnkdK@Z_VM7%a z>Ik86CT8oi1GzklhN^*;Jq?6Y-cZO3LsetxRg*ZH#?dT}WtBax1e?dvLP$%&6GPRG zp^BxgCEG@j+3Q19`#3tpF*T0o;^-JhCw5hAc8-Hb-tKXXso){$5=U2&bc^G`P{l-H zk2re9krhX;IL5^>K91gT^oe7rX!ecs**|4h^w2`TI2sI7y@#p(aSWi^Ff~wcklsj&Q|oy zjpHpE8KK^eV_qE1M<^CKl{_TGcj&GW>Rryx2(@^GqW+>d7V{XIaHDZa982Rk7RNVn zyvI3>Pe-UVLbeKi6vx^)*2VGt z2-P)~Nj2j7I5scqp9pRdd{||hSlb@Q4k6b@s5>JRi$0HIXB_+E zI1tA!F3*u_PaNGws@=kw)kmtmBH1U%qOl{@7je8gQW-ftt46AW^sr?4JDrL0FJ;sR zN2;&lI1^s0JJads+teiY8^PePhh^ias`9~Uxz;Z{Qn7cvFxN|13WVE^($F(@Z+&4z6>zw6L zs=#PfeYDDs;~#2{QvNss!h>mv5r-+<5)292f^n%55o^&nVvNkuDlT{{j)V|O93ja# zQbKMB{wsJ>kTXIxrvKu&EfVrOaoiPtPw>9r1Hl=hylu4Nh;k;7D}hD{G)^FQ0`;nR zN+nP_fjkN1O(0(a`4cE1a_({kgcKJnm_VTfQdK;K1xX%Bpos8C1&az66Qo%xd^cM8 zN2`)jos#>bRha}%RQ8ll;9g}feGpTcruRD}d8CQvDX%A%kpP(?@$!Kw+=9itu- zUQO_E!6yWt6s#`Dp3{D20^P?bk6=x~T7q7|+JZj8@naM<^#ooYqm*DBL1yc+^TO*3 zHV|wm_|X_eg(e9!O`vT8Q^u-h2^=1yT2V4qHBX>L0xc6bKSn)1RuLm(RPM2=wUo9I zq*|Y`s$Bwak5%mxSU*;ENT6c^2dj8GC6JZCxv`48a{^sNNZvJpZo<0@_7LnTcvzHK zrB?#IrEVX=zJmP(`wI>bWOGy=B>ULl1coFK8SDPIV;Y)3jf*ZBk-*3VW+m`)0;3Wb z&0!|+Yyx9QE@VC>I5vTC35*v`;e-Ut_8yXnBAJwyPZs&Xq8TiDI)P`>@&e=3)C8WB z?2Do^P5285JTIieIK?VV(Ca_Mj>p8jNG}#v6S$MWq;c-u2i|tMo4_06)V%~I^!3EEJQ7bN@!46+riqa0sIB4Xcv4gS>Xt0KZOb6v0 zly^|UK}84E9M@5-TS+=r)j?$;RUCXN9V0&G;N>h2Qxr{n)|lw59S%Nq zuv9#=O7J}g%cP0-9ej{(cR7oMZ<3|)q41T0Be@BLGgmuUN5wQJ2>Is zq=TIfc5zub_{za<2YVbG5Y4^m`P%1zGswO%?Pt7+$G&iIP=trXSM0{&v<{VzFd!X# z^NjE1`Pso~cFY0m{vyI5O+9qQ8R0LCS5!OeVE%YDvbU#Xf6wm@&O2}%Bpv)A zUb^le+rgg>{&H}^!9@qxMElu9B`5_yv-m_(tZyN%~dy2ri(N#swu zv(Mw#Q+?cnAdj7 z-6P=~5i^tUB(XP%eM!_zqE-@vk{FzXH;LLwv`eCW622s~BpN2sD9Qg0LnTo+iF)kS z1l6mb$2URMNrG|pcTYD~>nG82f_sEzYLIl}`EKzH@>#_*8Yj^tiLBn9rb#qUqJ@+; zOM*S2u%!&JjbN)JS|^c^imdyPw3Q-ic1WUQ5(6aLDT&TWbWfs35?w?>{V@~NmA;;? zNpwp~dQMP1*>n>9Mbb;W(L0GgNgT-X%$T4&S)RU0^rJVjJWQ$L8AOHzt<9gH21>2- zCEbAxNn&UctCLuh#IPiWC-G(ybCVd6#K;^Qt=F)TCgHRj>t4y)Or=qctZ#!&lJy? zlXQ

    jLP;_W2fO=3Y3^F%&hJj309%I^p#;r_PwPXn#B7_EKj<- z2i2I~OJW)4rDO)r5O^-MLfTy^$nE8WB#0kM_TeeSD&eaqsE?9ZE0#Y^VqFsJd4|t$ z5=mJ(ncR@XMtY#HySg_C*__T&vL%VFNpSz?+F^DZ*L5kkOWTv!Ax)5TReqMl=Sl43 zl=brL;#@~E8RX=|-4gSAxI+7R82tMgNYeUI_F2eb!GlR067tZ8bjz2LCHYFo5qd-X zPs!Iw982PxB#u*$Ne&oE1GW*PP7<%lK zc$nmL62Hh?pGo4Z)MBXo`mp*0MGLIL#9975iStSPkskYBLjFvG!9axzlI8j8MTs#+ z9Xob8iR>i&GKzl$uLxchye4=(J&FKFF+tV4f%-QPOu|UQOu}M>q_8-JP!cx7AcbBj zgp-IQQ89%|DMXWqaSKhMXbN#|2ua*d;!YA5CnzV0WD=<)-!G?_Ej&@(NaAJ^w-^T3 zGXHfumPz5EYcBqm1d*xcM0Gcbd)&ZND4fE5c8?QuEfXnZP%=@mF0rjB(?X6Ea;98U zxdd|yGMgubyu$OPCHYe*kmd!2^qr_4Nuh|CWfN1SGkoHa_KT%ZJcY6;luMyRikB=h zOQjIW$S9fO^_)zw*<~tKr=@f`%1o=ebdRmyM%BOH{qN*U8p^5H;Qk7Gvl0xGY znxs%Qg~w9xrJ$uyErrKZsFec0G4MnRPo|KWf+vOQBB>$BBD0H!NIPXFDUzCEncZNE zUg5q;s&<;_DX0`0NZmSu_0o3grjWRi*-DJmPvQGc9*&C!8>Y}mbZB$nB-J#9W+}8z zp-l?SQ)rRGda3g4B-Jv7Rw=wKone-Q<87NlJGv-^uF{A0DRfMsQwkl@{rqB*>MZ>8 z8<}i^>3CjGH)*j)+IaUASCCu8wt9+?7hy2A9wog_s3CBJp5tzceDZItmNr9H}}3VS)HDffwm|HspHKub|H-MKZhj~rAKL6VB#4oO=;KtVt;0%pYo zMoi?KbIv*EoO2Fh&KWTwDk!K3NO-$Dv$Ns9Q}5gVoj!GLS65e8S5^0$?U~u-t;r4f zSehT6b@SA2Sw5C4UO|CZ49iLdtCX%*x<=_*x<$cyrIf7O!E9uR^RYP}yn(xw3-)Ql zGyg65;f(-tcyIKP4rWI_cIIPWKKAEhS3Y*}XgHcMR{M@^0yo{P4~r9rz>Nl^@=9{Xu6js)|eIPmC|`@l^?*5;@BF=HpmCe$7XP z7%Il_8|ArA#^A(oJRc`0oR3&O{@~{Jra6_5zZCqLkCO_{UWk(acRv2f$9gY%NwfVl zcda)}q?0+@(frHJu%kIcs(|=hK7XY&WS&=gA;-T+M_q`LU!jw^xs!?KBSCL)F8T2C z;pZb@)``VsmE>~n6t1t9N_!|}HN%}h7Vf~*lVy^3G6aZ0Vpx-td8d&?tuc zVz@ts+hXBKc=H(URB*e}#!8#SaEF4XN-5S%LAx&Df%aW7w20wu~1ImHjMdwcVcVhR&KtoV@}=TQZZDSbSKCloxHYi$$5Q;MHf z`b>`htOA}hw~e7)4A1BIFUIhK;%;jEOEHY<2hrdMO&IreMHd_9IYa; z!z2Y0bN0;bVkYPC6a`b2PE!wXAQn1jW(>1pm>t6$ZROAfqt8{7HZarfb{E93FoskH z=?oUdusDW98eSSpVpyuZzDZ+Q49n@RIL5`Xf_;CD?v3HStKF3`tm2B`C}*PEm9B|l zZ4B%9s61Sz^rjfr>w?-4!$t)MyO=wVMmzl!-K^CuF>K`;jD-(z@u4;DjeM-`yDnyj zYNOhnG3?6W-3s(@$8aEqgIuI>+!V)KF&v5^&M8n~4DWD1iQ#Ar@6y^B zzKY@N7~YTJgBU*JVvOO#Sa=uylNfI3YCekL;~4&7SFw3U+IsWvKMm+w{J_O9kf9g%&1QVv^xiQ!lbf6=Q9I`7qT z&yV4R_Wdn}-xW{;75)*!pRw>s$Wt+#LrW#gHEhAO9$jkL5agG5FlE z$B~I4t0P+RPy-*6phB9&0_Cvk#1V-jFOEX-&;SB9 zaV%n5#nB7LQCPy!i^Wkq9tP;LI7-CB(3Db2@0C<-^d52Pco;s0Y(rObc^p^7@m^QM zQYIdTjG$~BSI2RE9982er^1!vs1ir{IIfAKLL3#9St$+%=x2>rfo6_)ts1bTqRaHS zE;l->Y`P(i8+8Z@SBs;%V$Pa_M&oc*XN@>&($skPyb#5xgtWFc5%3|Lo8vHXJP=3A zIBwBN)r+Hk9CcNO(Wlt0aWtUM`Fv&^4dZAO$DMK96~}EfIF6=qG>eCilr)Zm4~^Ur zM-v6KgjMqSWD9ZgIHnY_$cc9~CA*mxaa8MO?umo=Zl!E$-pxGQ&5+)w!`;sSJ#Sd3 zp;a8MC7{eJakQsb<9IU;PMOnuHICQf zcwI589FbzA9pdPy8aRDw7}?Eq(%BU#>>5Y6IEKVAG>-0Z^oXOM3injnJB~ha^wPNS zSthEb2I^$#8^^+KhC%5c$ACBn#xY2{3|2nHD9l#cKsqdr;c<+NV^kcR0+}o$;@GWt zw00b$G}NE--uO5s#PMzl@1-y?j!CpIfgTA=W+=&Lp2smYj%jhMjbmLL)8m*C$NV@J zFr_2zOr>*_&Qdy?fzvl-=4y4G(pAb?7{{W5Y8;E>SfY42Epe=+aV(=-A}%r2vQ)ap zU7-Ril^*UEzF)IiF~!!z@t1PQTp!2wICf~$hB!9Hv5C7xH?vteTjSWG)fXZznUvqA z{3#K4r-Hq4>{GCdzEZG9>E=SA8GH+Ae;fz7?Q>m3+yl%*$09hy6{N2ty&cD4$9mkc z-qBv{!uQ?y1pfPs(NED^68J#DhjDxq$H#Ge5=T6aL>!;S@mU;y$MH`bpU3e<9KXi# z8@Imh=1V4Cck_K5UvZIkH(x6y_(s9EN)N~Joq{8|)|TDPukjU2eve}(hv;sIkH4{HgS$Qu0sH=ZY7o@aZ`IjpIxlXUXqw zo~r6*yBq3kSH>+})jbzS*&gPE=Q#^qZIlQiiDWzRXD`nry6kMLb6$;8IeOJdSo4~^AE@dhefCS1Z zD6f=F*CbFuam5_xsCKNZN~$Dqt%B>6Uaz#O(mqW>wbc{2F@b0TZUV6$rbJIuy{Bo` z)6_`dsh(yC)5GOrTZ*1T3`^sFTAtDY!WSqhOK>)J@>4o~B*`^%J-?fd&aY znLwKa8Ya*vff2pTJqg^F!0idNNZ{@S_?pbop5{VN(>Q@9bX_lVhtj4>n<;Is^iHJ| zxQn6eWeC2n>E7PUJkiT^>}Bpv;67^WW%l(l-}W;1CqVi@0xcD^N}zQD4=N`A(F7jK z;fE7=B!~afzKHG>=W&6WEc!{sayruv0m^6WEi$F2$S_WmxtmuunO}9AZo#Q!v~?Wxk!jTL~Oe zJg<+rU9Ej5fp=+}PMp0OwRS&9;KKwiCUA-Ak-*0Ze3!rx?e$3lpC#~lf?p~8zj*a* z<+9foT#^ZVt;{bO-v>h`%QuWv0*4cPN+(({TmgMB7X3bf9}@hP8T^^RkJ|AkW_tn* zE;}Ag;FkoBCvZZm$CPew?f$CZH>DK&T>%d^cc}+HR(djlQwf|-;NJwl+!BAQ=l@Yj zdV~2ucm1NCIitg!)uy8H&|}njE`k4Y`p+x4kU(5D=W`QFppb{c9^wfk638TwO~6aQ z=Wd@sO4BK+lz}VVH;fBCOq%9SsMRKYjpYFz91jr>;^CSYY%i2y;*ru>k<^ThI zr3Z$Cy{`69&OtcT}3Jgt(? z=RLfTlc6h?>NHES&O?|bN_{2?BOdKkUf>g}PAhkgAFOJ5KDa=5>T0g4CaID`0Kpn!8e zN?|G==3%;r86Jjv7~x^0Y98xhoQF|VuGLYCElQ42TsRROuV9jg$sQ(nn5fmh4}>u~ ze!n}#!&K!=^RQJnDBfUV6AQsi53@Y1^LQYP*&gP2Smt55hq)f+d06OSk%##lT1Q;q z;RiKx*2S>zVh>9^EcNgTZ)Yo?%n#2;^ZFZt6&_Z4Smj~0j!sFANK4izSgVxg6Tzj@okJ07UvUHYNFd8@xU*z$i? z{n+1p;Ne3L|9Uv%;Uf

    nMMF_{77f9*$}CGY_A8IO5@Z4_|or(!)30c|3fjtqjxG z9<0{xIdx0WU_q6Ozs=r0i->J287Z7!NboUj(Ygf!%y0sljSto#1Q=Afk7nZ zEh^6XR}a5=_}#;Cu1XIlwdsV;^bf^!0);7g%EMpEX|JPH8er-TFs&5-zYhw|x)!IuZJf-B}VIJP*FgaK3aenVcP` zpQ7`*)%y@184p>Nv3v|tGdNA!$-JVx?T2%8{Qsp2Rgoe_q+nD!!O-;zE``6%tO&iMl@O`B>s( zsgL?T`X7(p=HqrBxB6({qoH*G#sYN3?9?#d~-+YfJm7AU#T$NfH9X%okKz(-3Tl>BOdIjW;v8em%cc+f{dm3jys z@$smS5k5xxc+AJ+K3?(B-p3O@p7im&j~9Hj;RJm=>*G09__Pl3jE`ai!|>67Y6{x= zXs7nvF)+NN%BD60&5JpkUs4a;>EUJNbQx$S4m7X&c+E#gADw)>o|Amj#~X@Qs#@yl z;N!qRb9kWX?4yg1UOsx~{Mpq|>>mRX$exs5r>*P8_=stkLRPrR$Wg_pw1i z{Xu4e3!&Bt~hI~4EqvCGG9CYuUVzT+S>TJb&~`+a<*Vh4O2 z^zpvpx0Jr^;~gJ|6tmZoLFQc_@A;s@(}T=D)$mu=z>{EimJ(Dmkb0{9uze#8ez&F8H{poVbrmKJpdE{P4bNfx$GM zQ=lr+1h=3ehEYiR2)LmoQ9Fs0kF<}HNt8+=<0I?CPKN1ZDHWxxLIL+@27*;5iAWN8 zNfb(=coHR&U}Os?Lx-@nhzb|Y^(~gfqeK1|g@TW|6fT{_Wl3C}M7bm`PvVLsu2T6j z$#51|CPP=y?On8E0WF)v0Iil!;+iC`P2##FDrm2YN(&}iNpWSRRg}^sYP&v%Z%m>p zI}SECD5qMEUpF)Yq&Brlf`wDySS$?0Gf6y~#H#^b3-DYL zZIjr_?n$&u;`tNIw!G5CA(>r0^O7NI@kB#p{7?7y^|Q0#PB5gFR>lAwjW8ZXdKBL`{g;3S497^*S_mXnT1Vq_Atl9-*uD5iZ9li59qF-eR~ zVtf)4Sk;J(%Z->AY9{9Jq$KQNp${u6ovQrlN~h&yY7a9rl9UJ~<@Se(R?Bo-vGFo{L#&zFaVPaF+v?e@}+q)SyNUA>F~>VImRJj|@5OOx1~ z#1<7;oy3|X)+WK|EZ4qt?4e<1owlx5x*>^;No-R5!!W}_Rdi0l5Hx;!5<8Np7@$&s zok{FU;(QVplGx2KCGk@dKPRy_iG4|Yl*GqL>`&qV6EcbSRp-GZ-cmrd7lxTb+*pR2 zx0Ulwj{mNLYQs(OBtB65Ay?n<&=OkCiGPyBr%8O1#J5R&rUGB*`hK3o7ra6nZoX7X z@Rfp|!wrMZ?o@I(iSKgqlZP7y;)qtir)L!Wm}^}&+#KbyP2yA%edAk;EUG zPQP)bBypVH7#9A6*f-o1g!{;F^QUS!sg%s~!wr+1pWOdW;vZ$6<<_U*-z3f`$QxlQ zj|k_;=g>&cCGlSpHI#F=(u+x4;#M4>aDes0&p z9buS|X>R^WNB}zsS41`mD*yt}3H0hTm1HlbkQ1OYH~#>60alJM^c&OcEfx5FgeelB zXn@NDToIsHfZ_p41}GKq2hhXy&K%=HpiUakg-|-cWkI;^7z7vPovbpu=< zplSd&K#c%51gNG%M|GOj1Kdb!)j3>29K{(KDr5v}2B;O_CKV>9b^r?32|yWEDNJK- z4qyUQ92t6pl>B-D>IY~N;En*d251oAwg9*5j2Z@L6o7i_t0aXBRMCLO0fsVXMw)_6 ztZ9Je0q#`SHB$qa01Q1H!d`a;pxe1l?+I{kfM)_c8{obG_Xl_+z@q^k2+%UXg8?22 z&`P_vR(g+)`}|15*RG@8ucFHW^v*Ys&pEkXyl)J=B0T|_%l@h$7puJK)^!0jxHv-g5p;iiS2Ivsr zlK`Iv=op|=fLQ@%GyMW|2{0_caOw=uEkJ)JZGi3pdIablppTB#GYF5(d$E_!m&d9+ zwCo$8Ul1NwZd4}E+i5?KWCsQq6kv#U92|s4)&(b`1!9yLs!eZPjE)E}GQh+DlLCxV z=9mCu1B_P8^K+iijtek8zy#&+=#ss7lF0*7Ql6|%4lpIa^Z+wdfJROYFpY!uF$G85 zAB{8xN24=UpsdDaPJp=qwg=b|U|xXvTz!mPfCT{-23Q(kS%5_X?=R3Qdi%2g zp9cs6qyl^q;L8A~0{j)=s{mgI_&LDQ0N(`oHo%bp-v@j?FiZ^g{Vu@AqrzJ-$5sCi z0e%edlPV{Z0xYRf;l|E!e+h6b!0!Q$2lzDroxr;Tzj09QOUbK7n-c;42=HfslZ>4@ zv-arFb(}H}w^LbDX=r*LZu4O3{O3L6mUTINdU(xVOB zB`9#4w%(os^PzDHO%xE{q2TM$rg;i?s?6O=?@ED5-XayA>J;1$qVPTR_NC~(DR9Z$ zr(*Xj4bqWur@N^2#r0`G*52x^y%Jk#Ej1-cp-%sQ)rt)yHuE{&ogko-o{e-2gVpyUs5G6r@*_7JSpX> z=hnenKd+|nS_%WS_4O3qNTFvc+@s!1p+gFtQ|OXH$5gl@byDTr&Fzb4y!dpnaRev9)eUL(`4y14}g}0P>NNK@V{5F+nGEjyKkpIfxPvHZOnC4GV;lmU@;vSMhkiy3)e3HV+ z6i%h^X$qgE@Iwkes;bXZ_#%Zb6}K2`o*iq>`%%)bQusOr0+w$Se5>?u3g0O>l5725 zL65P9uhRUK;!lg>*A#wE;b;mxaOSPI31iJKsql1~0zCHoO@n(v>F-L9Gj%V7_c8zA zCZ@d_@%H)yF1!Dg!rzQe3TIRUwf&O{Pr6QXM)$ib#u}dgoK4|e3i&C-xXMPG|57+l zwW;vo1inObaIE=mY>yO5?UP?ntA|`0zH$ucR^ILiF+nT+$a3VT?W>Z(d7-^mU~ir2{i3jUj0aO`}s9oz;?V)HB|s$D1x{ zPd#4Era?*#-PHp<(&(vE=#|D`tF zo?&SWPh*s}j!?=e(6*5}dV#M-r%`Ky8I#6X1xLkVbzBsY2nS-O@ohCWrSW?j$J6*x zIY-m~djaGpt^UlM(U&YJ{7V|g(&4KjzbYm8O+mpc8z<5@mBwFb{GlBw|EIQ|RLbuI zf0f_(l*Ug#YflXIuw0)(RTVy0pjr6^0^xgH8Qhe?%^B3lpr(q|$)HvSwKF)TCe_O6 zxoe_nqu69{O9stV`09zKt`65MgL>*Zdar&4x8`tz3>qqKl;hl%!R?A0=QvF=xI=N% z9H-Ly+O)8v4tHk;cj;Iylnztoy&2q>!HeW%aDN65Wbjyqzrh_wv!yC|P;sjaS}UMc zvnQH|a{3?6;1R`-<~Y^MyHBWOn+%@H;7P^QwqA#OI)k>#*;3AZCWCh;nrAb3E(2C6 z!zyXJ44%*RdLe^vmHBc8uVm0AgRU90&)`)R=&ba$3_4`cQSs{;yrJMtrKhwnBb%CN zIw|M!Nv7JQa1>@{w+y-~b3g_?GU%B>?+p4VrSX=VnqG8mD;$P7m5SnN1Xn?`3aCIcEdHiKs;89It| zdmS?aogY_A#$Y7=N*D775lxfVdR%ftA2VFnOZ~+!X zd_x8sGuV{DW|e$vQncR*%`=lj z$qzDMbUxCB_My@ug)PRh>tyq>CNRNg3cktZ^XD0Sk;7jq_)6*5N|{Ta7P7b~zRTc9 z2B$OlH-qmp_#uN68T^sKj~V=w!Ed=u;AgexSO!Nk_(jux#N;sI^c%N@U$vDx7^}Z$ za9pbeOM}M$nZaKf{GGu`<)2bIXY&6xlYbZ{&GugkSq#dV49;e7DTDkB&Smgl2Ip1& zaCx_2;cu91F6f?lQ4@e8G7VxG#8u48AfbTc9-eHts1HpxzH&}ZHc9>$pc#`53&Wbp zAj=IiBGn^eWq~aIbL6}ul7*c`UrYK~;$#uYhOZFjS(2AUp)7W1u_uedSro})ZWi;h zD4IpFENW&^D~sY;l*pn|7JSF8WEQ2!tl(aqMd>Uq%c4vcS7zZ)HvE+qzI$?c7FT4$ zE7&qqOsy&52g8uhuY*u#S*3SQG3Bx-p9Nn+yhbUF;iX!IEGlOIcXju!7ppY~{|w64;6S!|hNSn4adRcQmI2d0>hrx?oLu95`JmESmv zCJNZ=4h2n>HdD&Jl)O{%T}oRhy*rD06x^G|(JAIWr36&cGK*GOOw3|Z7Ok^*FpDR% zc-?Xz%Hppn=Fu$f%tRk%-)!^|r3B7YL*`@J^tjR|vUvPNl*~3+Je9@M^hp*2vlx`c zv#RZ-EM8XdTo!F9a57pg6K%)fPBqVGc}5p~fsUGLUR0TXk4In0qJ0*7G1J<6)yRIS#H-X#!fZe z7_U>IWDnI-_(Zg)%CDMgrk{-V&f>kPrVleYi{n!balcSG2B-`t$hjA28=S>Zru2#E zz(1oyn4eS4-P!0cVqq4GvRIMD$}ARVu_OyutfgFumBV*(SqPS8!*7IGp2c0$!f!SpUBz{g z#ag;We->m7r}k5{-86GTzrmHvR#n^$S!@hVMZalg6PJ&;o0&yLtS^g%zeaJ-`6z$s zU~3lJm}XVn?KyL0aD(aQhb+Fy;@d2$OgD$K_%4ehj9?iH#$V_96x;!+mBX7O7Vr&aUsO8>~>PbQmcpsEuJ z9-VI1UW%S%h?y{)ARh$HqE8}9Kp75A`cD=er-zS&{+q>_EY4+~yos{# z;YreJwsk@I?8S4f{48SG@WXW~i#Qi)EINF;@v}%M_Ojv8>vFNkPi7G?ZKfN}f|wwk zMJ9_ZHyKMJmQX(|p(;_zrz?3Y%2rIKqhR~=(8-kK=YztQ6tSeJB`qy!Wl1qhid$0K zk~)@@u%x6VGfSFVa+f77EV|;r*68z%GSDuX2>Zj@8q)$%f${A+0hP%Hd1ITxzuOkC38DvRU zk!~V`Eg53TP{=UIP$nTW8B!cF+>#NNd}zr>mW;Gy6m76%ttF!^8Dq&TOJ-X#){=3S zOtNIMCF3orF~fA5VJ0$sGt2}!aE3Wq#GNq16fNRTv1FFeE!l3#4ofy!ve}X?mTV<+ruk^5IX2TIXBrfDw=rX9nHOf6D`uHG zv&>FQ2F^0OEZI%vv&`06q3|B=48`5!vkd!wGRy3@ zr;EGqSn{qV?_2T#lYF+hZ?<`Hws}vL_nmF{dL|8?KHIFDZ9cZ-6H888@~htIi|!M zQ*BN-kv4P8_e`)k;aC&rn4c{9*^=KZ`Q4JEmi(eRf3;+l3LInfi@I;kF+a`;4Ws_! zmYlHU4@>@}e=c(`kU!UOA}6^e&M}4Va5?BHOa8LtZ*Ep|%|Bd>bIq-DLjyW0J!8pP zW;IV=EIDV%f0kUdbd5E#)45eG&k&$Z%NFO6g@eQcZ5xxTU-&>x1?$* zH(`mVfcWTKlhmd_DP@v#L$m43tR)sC0?C5_A`lzmKi=DvBR-8|EGo|!Svtelp(;FdC zhzqF!;bN(^z_eIko?BpQLYOn0IFqMR33nHl733yJV@MOo%@6}=0BH!h1yUDMA95?C z>jE=wfmu-8tp}kiRxL1ZFEBqWF#jzGmrP`#p+FZ4ALBOC#3sAGjX9=z0lD4OvrZ@n!6$QK<*ed7MK){;2D=SY#f7JgQM{zbG8&F$gJBl;In+ z$jn+~o`h^#WZFP>6mdUTWS-%-hD6=xAZ;PfLhiUC+&z9-WZLoT93U@1UZlXHFbzs9 z4x?FZv0;^=q;Fq=w1;%#q#&*gU;B+&>wqp9;J58{@?_ z#kh2)a~7B`N|}vaHDru__r<0Mq$i|5WB{ZWq&K(m(r#bKxW%Rq!d;80zH)K6Qu;B7 zrQCNHo9l|X10jPTLm+$s`PgD}v4oqy*bIggTVkp%F?@@^dDA+>AtRVt;Zt%l5;6*M z2=X>$G-M29F=Pp3EC+(jfXsx9hfIJ>hD_mHmY9j`wZu%K!OQsHY=dlv z?1t=NZZM|H%}&TJZJoG0oDt`{VYzva-MO(WGy5R>AwMrS7nX;nmRezG^8v^~HU2FK zyKr5T`3~e=$S;s%koO?(L%xQ51Ni{*AuWV_3i*f&e1-WKLX(=TFwde@`{kpw;jlLkRy=qAwMvgv8`I#$@sk<_4YQ55oTxmG^uaMs$|3c0{euo@~oTN)3C%D9D`4aOdL%A|k zxcCZp*GfaP2R3#8g8a?sb01K9_;ZuoKPhv4GnZ-el@50naxVN1Hi<+2gPae);92s+ z-@}oM+~QW5+g6#gD^1Z=VN97h9E<6|YZv0Y8q_l*8wn$--A|gBuiiqTi6cS;A(SBwNU)3MED%^h- ztTN1pq9Vmaii?yG*|ExexympzPp%5T9Du?lMbfLxm8-*8Tqbh4NI8-6B3Fo%5xGjF ztVpfZ=Kj^@N|82~yHw63X}{VGTWziunYY?(S#7>rZLSfiAW~7JlE{VCrpOvob&cV0 z)Xct=X9`^_a-B#`Dipb1&zSL!vBNZPN{R`I`gu~DI*4=@=_0alo!PlA3~NV`PW001aML6GYF!98eXh;!bOq&Y z>0(PykzOMIh@2MbEz(D1v&a^az9RiZrix4x>CXff87VSKWT40(8dKdJ#_NBPAtFPW zhwII$bq4FhuU;X(X}!63y&2BXi=3+Fwq0)?s_wqk#2qa%Mq~mV%R$$hu_EI{#%uT3 z9q#1yX7ze=XuTnxBr;iKipYV>U0%}jih@_6{I~w&`tWLVy2uQXWg^Q(W-g*Y)+`HBV-PS5z6ltxzxm>aqba+|91uAu@|H-QP3G=RrtPLsKW*-{$-E=-uE+->ABw!kG+S>r zZ8GoE)oj{m9=p-~aFh8+nksn2V68Tx=fv9`m=FkJ} zRFdA~|M3Bv%`pxw@`uQuBEO0JE^=JtgzhBMHk-|x!~aU$zGw`$6z(}EnL;9eiTq9D zH;21D^>B0M+Tothy^Fd1FM~^;*m9FCXSsE72eze%E&qv}7fEp!<-R9!Q6w&spoclf zRpAi%YUi=dCdM4tY)Wl0?v^lzJ#JI;_^nprbDO%}CFjm9=J_oq-~!oVrfo49p7e98 zx5cr=vITbd;gnlHulad}%*$6^TQXgF1r@O+&z3^A@MB&05prSpnQrYC!|PIBR}{6S zm@Q>(x!RWEwv@1?v@Ms}a%f9kimNEy zaivSiMq3S69RGL!ThqP47EYg~hAq`>scy@SIgV>fl)bi^?pyUcmo|p9rnc5n%G|51 zVA57|vn|G!hirM+mRoG8Ys;Os++|BWTk6}=$d=n|xz(1{TTKI78rs6EXnv46wACD; zF@2^{+_cTyvn`x>Q(H!qaGTrG%ntX`=aort>y<7qUt8F6 zpDp*>ab_{n`y1p2N}C<;Xm$^ z+sq@JuPyCtdES=CY#Hv+SuWhzqQ?5wcXU*9$p^bwcR{Jg&e|` zwhVMpmzx+rcRaN{{P)*!yBW7Vysmq}mKSY#)t1+6S+(7~WXsF8ykdtRz%LYb+uQQa zcJuT0@Zy0VuE#bGBl5Z}9c|$%CVs<~H*M)a&ullvcZ530?8J!gFb#KvxGPiC7S9&n zmhQInuw{=ed%6GH(#w{`Oeb4<+tSCD;dCZvx5Mu%UD~+acXtL z)0oEf-HG+x$WF7ij9Y1^X}r@+u;q)o;cuo-v}KYllWmz|3%|r{uF|PWS)InUMzyxg z%yDKbn8gs+bt%9yM>z%6dA7{g>Vlm7LIsPMf%QW9rM4`yWh299%W_***s{i!wYIEe z#CMui%uGA{wA*2)8M!n3j6<+^r&(tU?O$)p2F|N-Xg04`DSv=-sqb!9&uq74hb>za zZ{?C{8j5YRg#~x8*xqj@WX* zmV>r@V9STLyv2Ou%5CVrt10?6(}Rn8R~RFHCgn8%)Ac=O=HhUdd!GwuR|r0`F;9bTO98slqQzOm(7TMpa84CF--FO0eO z^4gf!kWcP1y!ii~+mtPT+wzYsKicw>Eyry+!5w3T`Pr6Zw)|>`XKP25{$dM{P+0xV zmae`Thk?u>^5H)cPs1;H`T(96mg`eBm6cn?v0gdgaVX&tEOARk&=#F?#LC6lyaoB zBbPby;%-xScjz%5BedKd{+}AO+mvzSN=L48q|u|{XWMzZ4O&SI#$=2P5_SCKAUhha%M~?3{hiZokA1UJU%hNvG zZK^wRqa#sATt||-&1HMS4-TBp#o8|acx6??3B6r?PiP5)Slf|0PI&Zj6Zw10&5qo$ z$2_seyje2rQrD4s4(~z86OPn(ktP(T{f^w`$nB0arjv`iJj&py zPyA#Uyn>77dNa-@X;k`Zfhs}$I;S}R*w9)$M8Uy=S$@9l&08T^B^PAIP}9K^w@m!s3VU#!oxIf zYwq6gtcJ&TJhyq$kv5LJ=E&=gJmtvKjdU@~k7zIpMJ?_j68xM=^Kp4X+32 zrRN=af!X57tCZYpUUb6q)oy#uOIm%I9gDiJC}t~d8@o5m1fHXwyxo1nkvARb;z(Ea z+G{${&yI9*!ixo^Bo9YdSkpuC&WT+HQ_?cchmiy>-4l7@bAt%wE&e2|w&` zy@zz4DQd#AcOJh~+GqMX!p8#!F>Usl{*DY#FibhIO59GOeW)6ubxjB{ivbMjbpymBTo<*szuG{F&H!6Zi} zJ2Hiyyvl8OJlbrZp)m0@N2WV6L;KED%8qPendQiAhDMn+3RxGAhRk`6%y(pgBMX@! zIu=KH=V(|6c9#tYZM)Ababzjo=*V*IzS5C0+I@v1=gx+DR;giRQhu!?>l`_tHm`SN zgCn~*$D`4Wj%;#--~7DQkv4!esXx1P(D|CzIEgaN4|9AE6(Cr^w>UA_rK`H zedgY)-LD<_MwxH_8fDY-zef){@*NG+j^A^AIkM`X|IM*>3ztJ2_$T_aBS#(i#}OLv zizCMz`AhMyT;`{v#~nH0$ZwAPu9j~*9WA`yP?F^j6+7j~pN^bV%vSO_FUF!k=5L)H zQ{^;QmLq2zIjfS46a~(yuLue{UZ5~{>4+4H2p{jfvfTEcGpLwYL0V5L^xS8Z;VJZA}>UQ4@$AP5or;T zyCYH~A~hpYDt}%ta^P{h|&!@)=_=f_3?0`0{^e^yzTKWuXHB%(5TO35Lg zt%X&rh|;2YQY=r3D=v{Im*<7|_e}HGB?OTWr39o)y1TnWy1TnW=}zhT-t%1dxBhFL^{n51_PgWknz>V# zT!dOw`NasuE%;nHB`heZxD=tZ1!a^|)`F8M$Di}U1jPm2p>%8Zo%0_v2F|qtuurl&5j%Ej2;$mT+wa)C-pK?>hO}IHJCOX)HVHOOx;GH7zAyUISV<@$6;rIv^eD&Jw zxmosPDa{XK|K9SBO>d5~8`BP+rWHAG#TQI|d z7~*|H5SSYyFj3+7rdj{&PKm`@l{#w@#lEU?gmMT!>_mQa^cmszk} z<*twoMP8|#RTk{vXh=Ps_r%xH-)O-m3odOpdX~8YoCL4?tD{fnG z$AUCgq_yI%1@|oY*Mi3^e&2$Js-6cH7|b6Al}<>n-OK$Y5Z6OydRW5pL4lcmqnkW`y&Me+v2n>M-O21B6Y z1|x38unk7SYEG6x{g9f^iu_i5WJLih3e)-6ichR4Xhk6=``t|BESj=)Vv5us-58Ul zvT9!Pr_8#zE+(}V<@l7O7NZuYeoiexm9jFJrO2hNC}YLE4TjV#T@t^%6%}M&G-w(s z%8giY$%@NXRI=hrD>_=y$%@?@jLKFtV+~cTsA|PmnS);%m9z z)oJQj@eRXjQEOAb^yQV{yOoo_Wm0&dGw-<#M&NDIcUIK5qJb3+t>`=_Z&NG2x8esY z8e7rCinBM88d=eTlj`b1QzbqJ zw6-E+!8|RQl(05d{9;90NwRV&B3HazUdj4RT9Fa9VwFF(;iEj#Lq-R@9^1i^)rFXyA^BLgj6eYv|6!@%v!~A?;EVx zXvH2no2Xl@*hbh)-9nX~Y`0MOqDt=H$^_FoKseuRy@g_e2#p9dY&qEN^^gc|Dj%_ ziYXIu#fqy|q|wahNQ=(qz9w^R#RJ)`gL;#Ci+Y=ShkBQKPgdip+!FlI zibt|69Z6Evzij2D6~a>aV~M2mRJHz$@SOUBD*x;4l@+haZ>)GrNG&c&sYF!%r1WiCNrOj&uEDFpry+xecbVna zP{J9HY6xhEWKIOB0wF>;HA(HWJ}!}u9Pt&S&H0r}lJ9AFUqd!lm03d;4OvxB`tFMr z=x0XG>1%3s4N^l64LJ#twXl1vdDmEO`PXF{s6G>BhW!UK%9#A8WF!N4(RUl%BFe+Q%e7%-%9z(zn?uHHyV|T#NN% zLCNYb9ouO9J190#!yp-I4P!M7)-XiFa1A3^!%!JaSzS|OQrk-Dz}pnzks3y67_DL6 zy_9TkQ{*j8*&CWDQefJy(tk7n+_T zxBMVW;>xs?X|e#+&3dNB+T4!M(lA@Yd<_d^5o(w#&9Nu@+Q+gzO-Na}1!+<0S;&Hk z0dbEvS?>2$`@|9rOEv7)ut&o(4a+sG)v!*(3P!Hd%xA(<_Ad=9=?J$>AMc+&zFNZ? z4KfRIM{=j@HEfWBqDOo?2W_K(I8_eEKUFUD87vq%AX87H0&hr zVp*x=i}{H`Gh=%-?9*^U!$}SMH5|}zgmoU2>9`#~q(MeQZbZ6tm@G|*b5w4>ee9Sl zq?NJb!ZTyCX2g-PI;G(}YdFp3&S*F*CtkBe+qWsw;yJRw1;+d>OY2Qa?cZZ^cb7C= zmgCU|hYeTcb~L=!@J7Qm4cA%K6Ad>s+|+Q7$y>6{AH|1kH124)O_t=jp_EMOvHrxlgG?SZ3-S8|3cN*^u65E^-+V$r6>mS#4&AHJdp> zHo3=XDb=Q>IBjs*@V*V1Z8-B+%xy#1hKLOw8+04IY$d=tePn6WZ^Q0434ubz;z1ii zHXO_s&(+!7Ur`$}*pSI)-i5ULt__b0C1gowWDjMIj_--R$9klb(!DG;WVIn?gDhYf z$!s>{wBZ9AvfCg@xpLSbr37->u((D%w+%@)$nKD)^Vo1 zLy9zEGxwvxwq#2tq={m2S#=-UkWX&8M_e|qr*I;_4coFO1U|Om6Bz*;&e~8=f^Ar0 z!%}v;unlDh($=Rod`2!pElMqBLvg|a9!HJJ8f+Eg~|4EkN@x6APXZk{x=)i(U)Lx zI@r+BhEBXBDNTr`o^@Spm~O)i-eXrA{vb%x-E8P?Lk}Bz+R#fDk_|(-40=-sQ2W@> z*M@%N)WfYmSt^$r{AJE%LU61IyVHS8rESN=X5_LC1#4^j_N4^yS=5gU$@ zk5PAV)14rnq@JQm*^U%Dn%L3Qj<_8OJ3hCggdOsQ2WcxGRp3KA9&*j(r}L2= z1?>3PE*}Sqe`?2PcJqY!gj$eV$d1AUxmn37qUtF|C~C*8H|E$DXHrH_xTGDW?5IJf zv>jy#)$J&2M>#vbWKzP)+fj)uM^FVjDw1VnzL5S;jS0x}$<#;i%63#?ZdFzGD?6$w zmPgM~cg*Eclg`(6)UudDQCAMI#n$1irYl__IP3+hi)kImc{Ka*u8w6voYmq%+m^2*_y zF5bp&J_`4UCVpj1M_Dj-{6=nPM|-Xxsi6ZMS+~M+{cgt}c676&GyN_csIF8QG1n#| zX_L|2E?@IBXS|2qe5%uv+KVdV+1rjjWXY0l^s^&hZ}Ta1e>+46$e0jhSfs+ib_}uO ziXB(&7|J@A+p$7M$&TT6jId)Q&4qT1vSYLz^O=;@IL3}~c8q6otlfNqD*c(j@th&I zIWIoZj!AY*wwuptrpo!#J|-|l)<*AGm6_(>7t^HC#VOO7B~Kb>+A&LZ;-T1Vsja=a zr-bL&F;|k@fU?2Gk(w8+D!>#|Aq#+Obupex-R+o9x)a1+!U2%4_&JmY7erx5=(~ zYyOqAogjZY?PQFsA}P4Xj=grAr?bzF{dSzN<0O*@>^MR=$hnYtIYc;2HP=kO_)$BK zF-G_}>o=iv;uKAR(;Rl0#4~oBRV(D29nX82Gkd{~zZqHWX8a#JF51m!%cV9Mm+ZLA z5ti}nH9a98PPk^rbvtr8@PPw2?6_&iYdhY^EwlJz>TT*Bo<%b3ckQ@m$93sl4t%b1%3Z@UX1xmsZ8%J_r0P7;zxrFrQb;AI?FCyq=jXHyd)8w&In&Qyk_li#w2Tn5T{5FweUD6cRqvbI7F6n2=8iSjJsQ#zkfWwprk6(g6R7N^RMd`?Jxz%5BGTfd2P|G?{ z&SCzUR^EXMbcE&aVwvBHOv)R(_V{!KX2;9cbggcn2oP z;&h;`1H&8`F2RiN=s+i#G6zEE6S6$o$)epBYwth@f}AJvyybUB_I99;1Dze{;y_mi z{&1j|!#qDFz8iykP`gv5Y4Lk2nLUHU?gFb!+hYDYqSGn$TI$8Wu-+EsS_c8)=hL^ zk^^%XKbbnyfmserahQk0R64Q%ra3TOwphCO461-EW7!MR=xhh%nXNoclJS@1T-lN= zHQxbwq>w*^#guE21Gnfec3_DEOC4B#BzDk&Lk=txc3_1Ae>t$jft?PlbYPVO8ywi^ zz-lh|bu23@e~klc>GU{czM{3B{gLNFa#ONMHaW1>fqN(8!kc+GY@zO}VD9m44s3Ur zFEz*|kIuVTb`NWo+}#A3T-i-~9gr7H_HhvQJ8*y?2aAl!VF!*#C9*OdIO@PL2hKQf z)`8;=oN&nN;mM~RILWHyrH0*`Vy9I7GUjrc$yCZqwddrSzXN~E;BPX{JJ4@PLf{{V z`8u|&kjpG`(P6$(cu8ibulXKdeV6$H+BFBR%gOJ+O^5kJ(m~r<5<1~-rd*u5LJaFKl1CJbd&GjHt_OAmkcdH)i3gL$Mlp}994lgtmmx*X`J%u^#A@GmT&XQOLkI3;$<+?u@C8)YjK)K zpVbM?37gY=kw=maf}JWwJWoyhDopU((qp)Y$gtJ6FyvQg!!zGUTeqJR@0 zJMjTya#3?rB{zwX$BDdz7&V!iLXA@;GC?q?A3BkbkYD9~U$=NiF3> zPq(>Xf_ztY(3Yh9dV<*}%w}}%?ooGY;(TQeGv~c2QCYw9Wcba~3 zn(uQ-DfyvRQMp<=(aMR|Qt+Pn4%A$>TPJSz`4=bJvh1%;{KiY(>JndmR8X`%vpP^a zQYQ^IN33&d5!r)IbRl=8{z2_V?M_X7xkHNdWU`kNy`AVo?(4)wCoVbB&x!s{43ItI z#7-x6IWf?QK~Ai2;x8u#JIxbygcBp37$UuWn=({xWWM=&_%J7iJI&`;Ehd_;v5#_M zv=g(OnC-+EC&tPkJ2AzHaZWs3l-M;rWs(GJijQ|<0%0OmoRrxy(XDM_Q=Pc{I5y3R z6Pt`_&tt*6DdJCeVg@5;s`z`G4DshUG0%zlPRy0A?oXJJw^9}`W(l=XBYA%xi<}Tx zOcii$Hp?z`Vi{wWt2%RUHde|UEsw2rVx1GK$dX*`#2WG_Z(Ne=o!H>Sb}>JXZ**c4 zVJmerb&IV3F|n$fjR|=SiIHoYjOwYBzC&U=WTowhiPHs%-A?S0lgEknOJjRwB5cVg zsQaAQ@5BKo4mxpMoY^UJ&&3YOlx;SSInjKxaoC9?j66z}f+KSqqVeT%(F}tUC+VMZ z;5oD=6|X6GcN+P|H+Ae(wt>{*-Grp-q7zhnQH8`+TLWhbu4 zIq8Dkg@Rk-SDo_nFSsSA!PfXSC$1B2P|t2Q#Jugq9Vb4S7~9`4epl`&DgMZbf1S8T zzVE~Xx!LQnWt(G?^^oSK^zp||JaOWU6K|b(>clfAUdl>y;yJhT3n$8Ujy>OO$kwj+ zDk1uszCfCB@sU$w^`FPnxRBNbtIOQ}-ld6l&ba)V!#gg7w;1`i80qMzr&_2I_O@$G zRCD38YbgQ_m-(@c4_(OTg3|?;3vL%YE+o;{UGTb)$%Xe^@VVf3A>u;Rg@6k|7edmI zOFj`~eh5UaYFiAvO4^^ulkt&!vog<{ZD}&N@U9CPU3eSIQ|xh4qo^5K;89Yh+ez=c zklBSCF649}iwjv@$mT+J7j8c_KUtBbK%SN_lQ#MCYz#nfW3qC6FhNbi;+13&}1d*z*)>oSOboQo~4|4mXqJ*g3K_jp4!* zEsuPXB)@zsE-m*czx?JxAr}g}@G+C(d?K??ZnDMvowQG7&|E0#LhCJtTtx^) zUFghYG36I`;d62c<&4;3lu|6;FfHRUzf~$%Sr^JFF7Gm*SBN=rZ|n;fK5?U<8Txcq}dt;r?ruo{1S}xRf znV$!4=)(6d)FFRE{gzsn!S$%$QR`D1$hd7Wq@EV16F)Gr5p~Kr^E2U%$p^NWA0+Yib+mQjYj9F07mqd%VRE?r}EFZ!Yw3p{EP&Txid* z4levo=t%8E^=&myB)LTszi%Z1)93~^zo3w;>bpW2t&k6M;> z4j}(Y9Y`JI!kkgD!BqJ$p71dG(t(jK3@4AE%3X*#iaeS+hC0@T23w7B)S_2n;|UX7 z7?D2t_O#e!7pBM{xUkBFsf?fH!fe7c>U0-o5N1-lu%FV<92XYTnd`zl7v_@}QWsFA zatT{RmI)PJLS9N;MqN%_!Or|8t8uHbYO5g~TkXOc7q+^v&4slttYg?F7uFM`s_Es8 z4djhfxvx}nvkP13Y~VKtGSo}n?!s;t`p-!#0XtmS$=qGkA@R7F^4ZrtF6^bV&xQRi z9B|>F3s+sZ=E5Nt4s%(abK!^!M_o9@q^!?lE}S4A*=ih@qbVL2Q)b~L%{yDoHGJBI zGfbY9BW|0qWpaw>c^59w{F{2og?|VVe^E}qZDv8aF4Mdstt5<&S7O&)xFM&93s33a zbm5K*cU`!p%HAfF*=F1$Japj^;Xd^NHMS`hnUeA^`LPSK>f{ly30r*T!gKm*+~zKR z;ldjxgUp(Tz-QWOXB(8`6RI*mM>*-ghIj+x+yV#Kzq9k%2YF?`BP^lqBKK$>-M|2X@52^CQMv|KvnU9>GDw8XI0e0_W zI;lIlkQ;^FIJM1a=EkRPeC9?iCW}zTFC~MZxR@Ko$)8h8D8D4(S3O>uP)7M>-6%&c zPpzQ*ii9tymE8DJ`IX(MLas{vids$OR(GR@;+k%JO@6%1kWSVn*HO9OxbZEyF14QW zzjLELxq)&T627PYKyBnkW0l*4(3JWkRX&&4obVG>nr`97&x%_TT2Wh5+faXTqb)(= ze(V}Kify789lP;(~@WY!>a`liK7{XXL#uLU-rIPzAQYMfm%5HLFGI;@YiW>`FCrx!@nj6!}GpJ(9 zx20w(p5?}D@*L&Nbz>fRzH+4aLN^}0PFlp87gLu|mr|Eems6!zD+I_Zm9xr?)URl* zbz>dP`_%Pr9CG8Z8yno%=*A|R2dJB=TinR9D6y3)u#K>ty2Fi~%HQS2Zt@=LUg|#T zeyV%BA;qO{2i@|+dgdu{#EqkFTyf*78^_p|n3vr+PCntrNm&)-)6{KE@<_lL6?xW; zbL8{#Z0csx1**W`gn!()NVuf@rrFFVJbAVo*W9?yg7>I5+_+1)NxenAO_lgN1o>He z`F~rIln>46&$Wja*ME5g6j$J8foJayw4`MDb}2r>my{3TUBF`HW3YbM`N-@1{; zW5%SVrbbHg9S_oZklq7}2UZVU9=JWwJovc0Ve`Q5!H>7o%1a8e;2j<~J?6^`!f(qN zvhuw}Q#>B%9)vsyd*GF=zwJLAKJV^E+#e)sE(@KldE9sJS zRXQ)NCp<7b_|SuV9(=-f^Ly}-2L+@dChygsq!9FP+XDl z1+|g~UlJ-)t57ArD&Z>+su4EaF#9Q24G(J4`I=gbTANyj`VIA4s>IjzpdR@<<<$3} z0lA@azW3k<@?m~qQ%W^vvWW*x2|udHW*#&r|3qy;{aNL<^q`gE)`T|HUp#0__?7w_ zRa$B1L3_m=2=ak>@jH=!_n@-}UC3QM=&2(AkVgS>cjfdT{N5qfOF6v>eLUz(=tu2O z9YB><{`6p=V)>B&5D$iWu-1ch9t@*D&x84d;U0|eV5A45n4F+WjV6roU@T!Abv*U_ zLvykwk_9GtFqu3>Ia58Drg%DGh6ghVv#7IG?i|8gS@|Q(=S~ZlTuxm`T|||v#U3nC zyp*tv8s3?9MXFC-NnJ%Yg4;YhMN0N?Q zCL*+Em@jdwm<)jW#VTH<~n}T(LzVmiws`;tfQrlRXSGd zXr-gIj^R2+=xC$k7ad)6bk)&T$FDlt>*%24Hy!PC%-U{j+irZn-RQL47{1+*)HOcNmp-7)^G_FD9Xzj($4&>*%hd^A4kzj@~+YNTWN9 zo;nunFt+V5&h9WC?J(p!kA0+)orcueR~8jvfQ~So9piOO(6Mi)adD?1`fR7+ z+GS+jW!5%P$0XJxU6RgBmBqiyn5JX84!M1~_eu8E@I{G9Al#gDZ4MWO%ocf4A|) zZsRW-L%Kp zs^i#hW3!GeI&SYa-q~Yh+GCX4V{DU00p8C5OL`J#-{qVt(6W4Bcbwl_8P= z++*yQC9UJ?9%J(!qbzIZ&ju+{?xUS=djt4p(>bR-nmX3S8WvN_B?cHbG)^SJ2 zUDhTeAf|NbK6`R;pYd#;@kqzNI$r8{B`aCS6FGVI8_(r5-fukB@r(t9v+OtTLW;kT zGhx5cXulyU$=5p4c+HLQM#o!OAv7f^Q;^mRcrkjvv6PoUdM_+q_`L9YVPz?|S3W`s z%?q0sb}t-WIK6PO)UN%;ITpOX->@7ouZ#x_Rr}bSgGI|m7BH4>fUcBc;W-qdMarl67>wxjT^yHwC z^`KGYpz*bU7dgH7fVtVc$nHg}gGLT&--Cwm)PqJYFXRWQ^LUZli?s)h!v~G)2aUX5 zq&;NFB~^(^Sc(^MFN%3l+>7ChV+k)l_2M%x3@<+PBA=X2hm8Ex4r^0{KOz^PeoPhf z6GA~R3Mr?s^sRebvgAswqzJQ$dhuXtOse|aixOVc@S>&{CA}!+MHMfqdQsYoGG2V? zMP)A}tlRxqSr(B}<-90QuArQXUVNdrQfk)FxD=5asbWtS_=*))^P;*Jl1%MSY6m3X zYcFbf@r@VX%9Qb{!$>JE!4f9%b-k$P#dq{uE%>kI{|{*B#rIx3&4_0i@q-tQyl8XP zIFk{Ly=daa_7HZ2(A0|`y}0GaZ9kfM(cFv0J}mL!Cofufk;aF#KK$%OOD|S=v05h4 zi`HI@@M5GF`41Uwyy)k}Plt?OylCsiuU_+S*iK&jPWX-5j@n*Ej35CWy*SsBT_8AnI^01`~!* zhf;@8r89pXGM{+Ya;F_7Tgi(#Ud;7kj2B~NrQJ7Lc$`M9l{doQk6Tu zhWYBsau!@6s_I-xxI8SeMs}GO=e@Y##X2w6d$GfdonGjNjp}b=11}{uc(GB&>QZ78 zRbVq=ix*o7+o;=BZt`Knb~&X;r}!=}c6+hMi@jbPXLI|gN2vR$2dD?B($7PL!(LQ6 zm?BBJj(Ty7=Ihh{IVZe0>BT88PSZc5%9cHBj^|lfKXke_FjvvvUi>5Tb=Y{|#YI`$ zhYbnq|0Z_Hi_5Y$4jWfwg%gCY60T9NdvSwsQ{~FL%o1~($vf1$)O%jsS22IyjX(6_ zkr)564=<>XRS%yKo_g_&@SNJ8{d`G&MSV?`&cE^EEje`!%Ww3*hzE zfy&M0LvF>Nyqn0QI4>baO{S*!5GN$4Qs;{UDfxWJ??VM2D*Et|4+VV4a>QI7AN%l$ z4<*&T7bFz%p^$P4`|v6GGwQjX<|-;mE~a9N`|vrrgmPL8kCh^qrj}8DSs%(NE-wcr z`yds5;X`%$l~nGRgv!(^)T-34e5gi{Qj3oAjP#++ z5u>vYf66kxoYKXIu0H&sB6}0MQM>!lgV2-Oiz>Bs{VS!9;=VrgQ{100z=xf)&8;y| z`Gb5IOddiVs{CPu;XVxD+>P>K<`JV^qr@b_XzCd1Sn4<*#uFw`CsL)z)+5GbAEx-s zkGo9uVK!kJRh;QQ%plLC&QkuqhUVv3=J+sIIrDs&@52Hg7SdUy{DO015_#!}vDAlU zKD71YS3j2futIj0A0PPfmk%p_xa7lSA6EIW+J{3v9QI+2oGM3+ydN05eDV(wu+E3| z>fX2dutD)gA2yLUQ@1ET>rrDHc{_CnbtiQMPd2G}w-0-K5ZFr<*hkp!!vVrU<$r$E zXmHdxA}8CK*cn!G)Q4k)O>pr|?jMRU_hsQoV@!=-xzvaViAMTJJQ14RjQSVcwl+40I z#gBaWSMj)`##8cZ-6~H^~J+}G|!w6(3$j7eN?|60YZ=(qDo}t zD~X67Q9m-U&djRjcL^E&$V7OL`o79N*eH>OoRykQ`Pu!*q4;F~L@qya`%%h|(tafQ zk;jjGe&qKfuOH8j8lhw6u*enjBblXAsBu+8!ViP|A+^pEGx#Gv632|n8I8|q7VzU^ z75@pLAhi&+upghQ+zQ8xBIKgfV#+V>$LHh{)RM~o`FO01A7%ac+K*a(l=EZU{#X@1 zvc?kSRZImxDk}bhP|1%k36+)qBX6@RlVAB!P5IRcHK;Y^rY4y4Slf?YjBh}{4)q)A zx751SdVYLIs85xGSx&|q`tiLVKPcyCKN|Vb*pDX4X-;VB$B)Ws=En>+_mgs3{LiXu z=|?O2t*LFOzokr&Dse zk_Y=S$&bm>w`0Z-KZY`3m>U z#&-I#%a7B3obh9~AA9^b=*J;HS{yg}95?pLVs04Ur^aMI;egCkAM?Gf!%P;sD4&E$ zKH|rUaWT1$`f-eWoO(j}C;d337`tL;{WvGb`1sgWnp2J&=T$2g2!H$W58)#967@3m z3ROB#=w-?^#nB!FlDPyObHODzFd19;}gb3b0t5i?ByFUhZ{uc>dSZ>bV<=D3kI zVAdd){DUshcLGR9NU!`fFH^LD`2gXi+5)f>909lpPHLx{=Bel=3wQ$1$t$m!v*1&{ zKY)PZAR!b$SUG7<7#RY1H-P*Bd=x;&05S!zJ8a|*;627dke3h(AVEl`rckBbcmTeODFSjCG(QX=pUN$9!YB~H z#{rZKpi}^#u$3azg49CP!c=MW(*QnGy#JOtTt%5I7C>>r=hPA^rtQ6yx+jd%0f<(l zmIxI3j*0QCsMwFz|s_(nP3N>z#-M`GWR>r)#jzaioK0Co(CNhOWgP-AM7R32>} zr}FEI?N1oZ1NbR`kpYYfphW;b2e9OX@h7{~GJrn<=*A+g0%%QW6TmM4v<=|b0Dh+< zRsBZjKy62DFY)339@#qv&`Cw6F4WFUb_t-X@`s%;x|4e=r$+!i$-Ss@BhpYGmD`ul zkJ_I);D2fxNM}$0g9$^ZL#e~4Qq}MPMkt;&I5wKMyfA=80gMS?EVIT@X9qAofC&Li zWOAA+H7S6}2RRF64_*V|70M-PsHh{AMoC{!G0PAJT%t^^tFuoyx zjRE955IYvYrT{hvuqS}M0c>HNJ5(!M1K6f`yYw@?xo3AOXBS~NHTNzvYhM6|nA}f2 zKs`u3!?F@{IDjK`gpU&5dea_fXQV$T0ys%NrJU1*GqPDW$0Xo<0G0IQD*@bIZZ3lh z0sO6M`-gCmdWm|OTH;okt1|upTxTgMc$aV^fSby>B|yHToW~ndB=R1U_o)v8cu07p zVk(?8p2%TxDDh4Z6Bopv%CQ!}b2ch{dqsF5=Rcu9iaA7by=L-F0B==fnjq2!`6mEX zVm366@7@_t7ex9XEHte_I909|gpF*cI;crc%oEUwPa5(y2dOH`A{l~smyl7_kSU1w$nPts?Pl}7%0G-{4I*0* z+3DvBqDd#y&%tEQAU;s>cV8zYD>nm@sCk0OONddEsS=ZSQA+c+X(ui;>*;>d_%Mik zL3|&=4OSy!U`YDJu%4reA z&x%_H(MoaaAjY3Gf86O8I&G=HQh!r1?Skgl%q6Bn5FOd)PC;}b{7#k5cP7Y}^o6^U z|DblGb`PQlL2?^(i1iMlk0gUw8ARV8`UNpIh;c#mXUt#~IUtBX$pe)$D2TzonqxjB zh@n9Yqd$^5oH~M9_L8}SMv(nL+u~joFjg%9#_yT=KCr|E-DzK`d3d3ki#;i-TCA{8fDTSQf-`IxCbv z^lh3|L97m9TM*lWSVMm!b*+k7M_5nY5Jc>Kv)xThZdNf{2wSCo_I8JCu7k0CRDqpA z>>}@`?os~Up!p3}3D~ck13?@lA5zX?d4fGOAu-2-I4*}z2$2v@1aXorz76735T}EX z@2%gVb0&zZs#j-&I2XkEATB8965;Ql`~x8K{FLh=LB6Uid^w0K%CB=e?KQ>MgSbJy zNxenAt#ain{CCOsg18^V1M-s~o)R8X9|iF*;W1U(Y8Nm!!rg(YPgoEs)x~NU~e>6N~ zJp?bo7eas_b@~Z2Z>0$mLdt*kG9C>fLkLAeC>p}MA;|BlWeu6XM3GU&WFovL?;##e z`+f+Snan~>z0+(VWDg++op=a|5ORj_K?u1*$Q?qAzVzY5Nh67zhniRU^{Xe6$tl#2 znwjg%1DXJ`drGkojf*5+RhNQ;J%SS~`R>1SwlKgyr?jcFWVLp!|v3%LS5%3S^PzeOHCVhR^_vjBCe)(Vrq-dR?$&QZs2f5(I?{oLgzrMAPiUZg z`DUx+%8$S|3ZZcbgF_e+LdP3vnuPFU2+cw$aWQSv5Dw3XjYv+6EMPPb;inKops}Ncfq~K;NT!tdgT&_%`n zLFgKipF=Unvzzkk-bvF#anBHXDefIYAI0A+Na@E`q@n(V0n|UK149_3a@P%v4Gm#f z2#Z2k9K!GrMuadog!HpwuTB~xS>ePGLZ^&TA&e#nj|pKcc^q}T@+Zi`K4nP2q!1>D zFh%ueRtQrSPa{kZVFqEQ@~0Fx=VdmNbEp+h8S@D9sSBtQvyjl_l(8g)r6H^hVI7@r zr;KH?1~!>%czFmbQsY&rm4sCxtR}2c{)AJ;%2VdEi1lBBS2=<1sFNB3*EDB?P2nRw)2_qiH!4M9G@Fs+}vc^I< z62gTL{tn?N>#QA1?3rh7!($;Fr*k5NlY~s&SS2Ye?qtz z!c!TXQ;AC<+&X34WUjzvCa+MhQm=(@ogle4Z5FvheHg-B!ab@qabL~{ z#oMQtbN7hJe?xdoc%pKxr_JGg#^m!5UJzbVU#Xbaav*0gd!8nYvlY_%!tjTYHf;V= zb}`=x!$J^FM@S#WvFGM96Kfb69a|V~f?Y*A!f=vZ%1LaGdC0nQykRtPo9za|2!@e+ zXgqTmt-p$g!svA-9t|VRq&N{m$=k6E%#z%9!^o&OQyA}&-&fA$iSaC9WMxCyq-H{P zY7S~n>Ic+ZROv>^jfo`1c?fx_u`rUAUukYU5rz@Qk6|91+S@yTgnfgLGmBI);N%@k=%3)MdezS`4YGG6l}LPv`X-D5IsW5%%=$iz?^LP!ga*`xVO)4^_D8NC=rp1>rZ%BA4I?`j zZSydG3S&?hgTrVM#?N6`N5*=D(K3uyVf@bE)>Nsj9idGazYy9|f2ICLm6-D$^W<+I zMhE3|45O3cg?{rEIy2dY+LihTwObh72@-Se*F;ZpuP}Ot(MS3H!sx5GO6Pcg@&M|e z)PX9u*lDBxqlB#IAz=&+V^|o&!$`Uvn-#{0Fh+(kC5)*I9z`7=#%NV`3}I{-E zjk!D~gfWrMBK=hp{P)&0(yNB%PJiHDRnGtfrRy%WQEiSzuil>lJSZ zW20jC=CoVL2W7KAGw*S07~8_wPIE^XdsXDlFm{o5D`!s_WpkQG-#+E+CmfKzz4zZ* zJru@am3xG6lzNPMJd6{BEGJ^ar^HW(aVCr#Vce8MGK||(;zvG>zaAbFILG99S=(X! zP5y^^g?cfJON7f*Gyd0v=v5}Kg>hZ^^3Q;7vBkSGhR4lQ{Wg<#s29_uy%)xP@`Es* z5+vqf7>~&RQXf;FsN8hB63-MrC%g#brE*>o#+)|ZhLI+MOcA^nLD~r9pTamJa7BO! z&Mb((6G6HN{{)D@N|1If5$w3}-$-f^*y!7-4i%HDRa$oh`A;Nj^oxgRdZ;?p8-Y(n z`U!yug39Ugt9eR%yg~#O3137|l~9Q)ef~0n%8IKH(w#BBQcg8O^$2Px zC+iubRs^4&F`7isG=ka@)QR95<~E>yt0L=0P*3r95!6@w?HO}3HjLnVIzL44`x&DV zxv`2lvda7$`9~&OM9_@TocfcBc{4Eav*MN!v?5DYtqE|-ykb_z2)aekJ%UcDHBhDX&V()zbS3C#uy&K2)U!P=0M3cl35d|qaqlsBF7NMQpZup z%N}8=i4jbSV6uvwL6}0F8o@Nebd~!Ni_BzlRs^#Nb5w5Cv&Q@g7RdIG;A{j7BUlu{ z9(igV!Qu!8oi(oAh;4~rNd!wHSQf$Z2-ZZfmc>_4SEp7*T^Yfu)MT4j{x0S?f9xTM0VQJh>x#eW_}3B@G|rJ^XUoG;HCWy$4~(_>Rgg(xaU z@dcf)sFhUimr+zES5Z#YD1K&_q*v9VsIL4Pgql%|>S1o%+ELVz$S7Jy@l6!pM$saQ z+6Q8Fqv+4#jiRW>BHyVR>Ju7J8%FUx;RlsFi=`Sf*@W7Z`XjX&wRsdj5jMPU9>Uwt z8yC+Tt)gfhMdv8GL~(Uz?B#i*4PzwW7n$NHevRTc<+LZXi=rF9Co3@>=yarZisE+_ z8M$C|jbcUj_yMQ+$HE`V??&hzl^5dBGm2hJ_EEXLqZsptd0zFU(@*&yT`>NPVqg?+ zGa${o7!<|eD5_*Y)eIOC#n31&%g%~oSQNvf*c`={C`LpvGKyJI%$6~aLYokqL=_k< zt&qnmXB=UC6cdy)F^aC^V-h@BIa8vTN}i^i=~2ue&s5IvO|dyq+!-HR6~*c(=0-6u ziurVwQYC8vVIg%<6pINI&um6~#)$AM>+PYogeo#%FC5>lCjiL~15B zDrXb#MMiaN6x*UW6vg2vT3s-t9)>>1$50QqIMn^C-s;#Cy4qPWc>ccOSixJ$i9y-$_aA4Ks` z@!!0Kf0=w7#gizWM)6GLJ}2avoaTjc{*SD)fVQf5-#_=EK^hTGckgr0*@y0KknWNO zX{Ds3M5LrqKvKFvL`qOV326`!>F)0Mz5BV&cllrcwf1_}XP$ZIo!K+9_qlP-K9v?2 z+xtyETwkuGHW_#Ix3WuBZ7LIzXo7kryK(JHWEvUsaxE=29W}j4zG2faGg1ZKozvel z!FpcLZNmF(p2dW$1WA(3gzV%T)ST2@s%FjzEcHUSf6WL6)NJlEh zW`bRD{qwrZ1h)yLO(ycwQwURY6FQPVrgl=1olRKkG)_T|E+%wUev1ow4-^n6pHT-;2U2HPjJ-XWEHH%dxd}s+Gt7ih(~X#otzsig7)k#N>L}`$ zDsnX8E9w}D++v*acoQbj*^|LY^0f)`Oqg%NM0p7?VX|sF%Y-Q=Of_K|oo}eqsWVhe z-Mgv2CC^k&KVQ;p#orO;m@t=+a$eHo0v4B17n<-rVUY=oO;|#{&ZUvar6!~dayfl* zRuEQFSDCPyutwF6pA}zk!UhwLnQ+{MA57S2!aPlV0XE!3^l zZ6<6dNUQ7Dv>hhwG~pNJ{BFXp)zqRODZT(P)fEgLh$Yh4)qHZ@Mvl;K1k=Km+r{h`7#>+}Bsz6pVvMJ7P zMhdQVu!)oEGQ(|#hb&`| z#~6CaKB`~&W9KCY$ssceUDU%=fe1mPMybhW#8hqFi+aM0{AScOqn;TB%y^X?t7%5) zbgZDnm{FKH%a~D?P=s34jACXKH=_iLrKlyTGQw^b_0o#V_tVOmQJ%%>)Cy))CR9{0 zmCUHqz__u5MgucWU(`FA(a?-W zW_+aDHYT*BHZh|qp_!^}Zbl38{EPqIw_CB8^3cfEX0&0kt%`4FMtj8_%-F_Oo#=En z<6}Y>YBy?E>Jx@_C-*R;C!rTr2A^~@*4vCeW^5G4jJ{^{Gh?9{-<#3jjL*!NWroBI zFk_$@!};4Kd9P8m-J0$^f(p&!;FJw{A9*vp2!w6ep6?(RaW1O z?JWLG{gt}IjGZdx7sB6{^j(DA)IF;9Ehpr6GxjQHA7Q^42MDF9hs-!^#$_|E$nfZ# zGUG48Q8SJaWLA$8PEb#p@h2hg<$rheX)`X-`I~x%`i~iB%{WJv3>VBeulT(U+C|0k z5Y*N~|NYO`RhrMuxMs$6Gj5o1(~L(d@|GF*$hWC?sCQLu{>%D(#ShGQNS3FGO4pCc zPpD6+&!|#W`?CH*@k_!h>TB5v%707fepyel02U0gV6fc(El6WQ5etf1kk*297KAK# ze^e@Y#BO>EvRRPbf(#bpiMtu80+|SzEqITRg_>2>F3xQXHHQW3F6(X!a$1nfg4`D4 zl_H-7CP_|~Vjc@VP@I<_&jK|o$8Lc|vDE^b;_;VthhiteC8tx~_<_X3PNiQj!AJF5 z5Fi9q?SadBm<=NqXoRQ*36(RM5TnMax&_nt|19YuKb->9g49A56edXRwaa=j3yNFt zu?1Z$C_%re1dKg|`risGt- zi)E9l6KW{GrUf4=c3;u!C~jy$U2;8YeQE<$TlR|HNO5CA6AR{tj5}U)7TZ!=sF;=( zv?6~*ZB1>XYFk~=+mYK-J5W1PJ5eQVXW2P?J?d(~fGc|QD_U<0y0Nyqis?b?VLI>Y1PL9(Y_Y+BlM?=^O>Y24^&S6Q}H1dd~U%^3uaj`)Pi9a<2kyMWM!`y z+jY1F@|fQd7K~&UUsy1fFiQ3Kr3IrEe`UcK#cSAnoCV|QOrU4n=3+7mG{ffSfF>|T&sPm}{ELceRp1RnA zMFi`-fA2_3ELciM(x$qqFIT+6f|ZI_5msBUhOk!oa(moB{=@S z`V;kM3pQJ@#RB)$fA6SU>2ITMmrFqTJ1p2~!7noHtlCZ8MU@fCi{l=}P1xjj7WY#3 zS+JjQK*jhGJ!rup3l1yi1mOtvDD@cixCJSD^(2dbQl-aJ7W_p%tsHqC@)-;MvEZx) z=PZyfy}fI}c?&L(Z(4AXaFr^xmk5_FxT2gT@`(F|$=6uCZov)Z%a?cDBHyOoQNDRz zT;lJsc;A8t7Ca@y>!&Rs^jGS&?J~tgu`0{xvPtjK7^ z4;|wb4#h;rUe)DTa#e58HvXO!Sr{gfJFn`Z=UJ8Aikw#DvLc77EuJNoTl%77qnXDF zNg_=?u;SHKJug)tpA{yuSveLftcoRGTFC$$RyeJ2abO-RyjHl$QYC}*k^NQ#*ial9 zfT)aFx)_u$8n!~SA}UjqE*i07+&$wOk*P?wBK44%ZbgI5@t75H8RW3|xdSm#c@%T} znqI()f>xBXqP(=a87pK(5i5#X@w&WTm@0XSS&dh^5>}L?Q``!v5-0VoSSc&YNEf$a zrK!&v#DwK2YsImZ22_yAv7(t3&8?_pMP)1MSW(xCDppjrqNWueT2al4>Q>aS;?R%A zE#gpee0!Q$-D`UL=UVfv$$#ZeswHg~#%o(K1kwG|VlDIP`7%c9SyA7LMpiVIv*UOg zGDDAR|6Zq+&S=T!;!Uh*D$6=fllQLNO~fxu)gG^owXmY46`ig4*oszGd}Kv?D>}%z z3@sDz$R5gJmjYPuh^nhR>}SYQU`>A>H_LQ>i5(|vYLZ6NwtK z4(d*o=NH1S(l(zFCh>1h#P(S6n-#xXu~+V6%&;cahQCB z+LgmTE?4ffurKut?cN0o1(O0PfyGLkddkeMLP zdp2YtXQgISes&vjkR^kJ<+kDKG%b$}AK37|4MTTm)1PW@k0$4}A)gIteeq-)Og5Np z@Y|5*rf#vpD$Q+h+hDVy_6^-`gTn@SB44{3`p_Htj2pVshE+H89XE7QkL0|edu=#+ zLzm+!)yLwi8+yP7?WP{IA!I|jo4P#wIc!73hDJAa=}WVr+f7}Ls0||sF%BtCm9goB zZ*J-ZY$#|$z>T0Ag={D+@eYi1pok4cZTP~DQFauwp|}m3ZP;Q%2^&h<(8GqFHk7iV zv<)BI(8Y#5gS0X>l$F8Qu;He$9OZ4OU_( z8$KdPZEG9aD4z5xxt-$ngbp@zBy^&7R<#*#>0Q}ZHygUA4B(;`yQSB>r9Zu!{Kp}! zmkpoTFy4jKG=pK z?B#RnDA_OsnT=sK3@49J&PZ8J#ba(63-l$6qp4p}$Jj7d#f&4!qaMDtVWO<;*;H$7 zm}J9b8}{AO7qfPX4f05bnKn#St)|&9UGWSXzES+G4a?c-EH;^K!*_%^)CD%oCCsBr z&iMqnn+Y!@e@|UxL)@mPJV#;)lP{$%ll+7gHmoG9vSBr$DxaLNhAd}o%M)8?!?r^4 z^~%{m_(3LCIX~L4iTsmt?%&e4N-G<(+mXYL?Kb>u!(TR>wqb`2J8klfF!94Sj9zT~ z&i;#Br0Zk9vh6O}8*+7!_fvnP{!ZOX-A9#%S#IkG6#rqvLGmHxboo*{qWCD`m<`93 zbAoWvhCh{aO71+jjfMW(hBG$2w8@tvB>ls&U1rQ#>NypE-i8Z`FWPWP@w?JVSL9wN zcPbmM)4XTH4Z=;TpPwMOMZQhFL%mCt0hGC|-?!m`4G-x&RsJIz9+RIaCv$aU0-v$? z+=ds*KXNDb%7)iAyrGlMj`ViCCBLJlvLne3*p1f|InoePQ>R@{l~(yT4kTqDXQF2O zkDpobdv;_YXQgIS{;=IzPCIhhk>8F2b~L}O=eEOYhs}=nSD#)4y*O20E`r+*55Y_IsoL$g^#D0&M~D!nCQ~C+&5kHxxAyN} z+G8xn?a&Dcs?62!yzwq$w1Rdtwxfw1!iDT8Y)270iZZ5#9W~`uz>eZ}l(3_u9Tn`T z$f{CylqHm=mZ3_{*SGa@$BK^+R%}Xpy{;^EHBxiSR?Px)6No_@ys*mhw zO>U!{(Ts1$gzc#vs2%O-MCeSFF|53!cd?_Z9o_8cZpUYK46vgIYkRAho`hc1PwefM?Z3Z<+RAm&wsHv)Q&;QA8f}E^5@EtQy4}bP8~rVscH}1(Z94~wCq?1 z@;LC79b@b`Z^s2Y#@aE?j%jvGw`05=5A}Gpo$<$6;;)y*Cb0R})QQwdc1$Krp-!b* zdKx=zh8^G7vD=P4c6@8cOuKxwYkZ?@bvtG=Y>ge?5f<9!};;_<=Axb0gpqxMKIH>r_jMx#C=P$xh>M=Wx6HeH1lJKV;rwH}W8$VPRuJ!M=f7*_} z>7SwgLp@79N0s26BV*%=#V*=$+m1VST(aY`?9XkQ^nS&T5Bcfxt9D#t{B`OL>P_k` z>cY!Lzjy7pCwF59QafekWKp83a*31rA9I!g@ z;EtaAu5NRn;9cG4fS=9nR0q}RfQukwb35Q6dzDl7t{x!k4kQRcYRG}G0}%%_7GqS& z5Op9~@h5lnxZU9cVo_=V8Ir0kGb;+ljH9jK+8dw2DE zTa5A4bD+Kh9UbW8Km%3VP}c6A?k}r1a-gvTO_cwU15Fh-BQ&SBaG)ijm8uQjGsfJS z#WoJKRen1{duj(cJBD?3;A01d)9gYWdQTtVkOu~$8;jkky&dR5kjy;^y&U+2@Tu~j zWYqg8?(0B5a)0V)%5Qs5AE}?Z89_CY>^F#WMuR zQk?9-6!KK+H04isVDR>23HZi=ZylJa#x{pAi#pqZ?+7pX^pCmZdDQvT1yt#A`#pUT zd8NbnvdG2cC8~C*1Ix(EsVkJ9@{h|^EUtE74PmXSJ%3N%;J^oMbw?SlmtBlc|>l3yZRre1O2s`9Tnu>8lk1l)AsmIFDQ z$mzsw2ktnK-iZuO$UhqHI`GVa=MLOcneP)GIPlPcM-Dt@aVV!qM)kyjrz*0;eO>m? z3kT-j*Hbz1lG{m~R}Q=;zoEXRzEidGZk!~i(F9b1)J~)!r=_M-{-*o-iTiqqhVh5@ z^^8vAWhIjnnF;Svvrxs)O33C!cI6zJo1Dvu+)jj?2s`n<6HWe3_T`AXoXF$E2XgKz z(&|J$#U>}rWD9i=-+dwZZ7kZU4yw}$KmV!i7TA>Rp?axO^rZkb;6zaQa$Q86kZ;v2 z=0vLpy5>aGiDV`$OqIT3gt!yB6A35sE59J2fD>6C7#p~d@Ck`tAksNzIb zHm|O-RdX8e&XO_6QG;ep>W5C$BGguq2OsG5oT%?aKPURjBy7;+-*XL|Xy`;ECmK7^ z-iZzjZbEHEZAxwCL~}w5YD=p0nBk#u`X8~_+KD#GZ|g)m#qzJ%j^u7mbSHFjqBG%R zY8R^H=}PcE)O!#{y$GLBANNk`P3WU)`#O=b3ZKy#=EQKq04D~jm_dZW)FDoM zP8h0cOFz^{kefWzzaosJenA~2uL1-a=V&L^R5k7@V`L{k)a4lK#5nSJXV(A;=}?c7CJH2iD^#YiLqqUCDj#u|3m%8Lw$x5-#GED>SeAIGZoKrVmA3Z>Kx@y z=KRldV!m?LJ=DKcld|%Lyx-SgD+pFGyW215?gg z!a66`6E;wPP_ho4II&gnHo|r}eZG%krxU+85ph9t;aAzl zPMmb&PbYTE=6s|dcjAOx2#@qVPWK{%VBpjm3VD4{? z9U&j39#ej+NBYuqNu6D>uSXcGaLS3loXF%tW*1I7@wXGHTu5@^j1&K`$#W;pI&qHt zz=`vOTht3qTqIm_;u=8`UUuS&;;T*!;S^n`bAx(Q)q1v4ex{u79_cR>zjWf2;@3{RA-`45JHp0CdbQNiqmOjB(EY8Jnwo|x z#k4M@Bd4ckpk`FH4qR9m_*+R7{KlWI6xKQJEb{VnjA{ zp^_ST!$rHUDRiG8&BWi0G+7Q~R+73^2iD~ab2Ra><-^qo} ziibbZyD)iI7rM#TQvH77LJx9JYA@x_<7hu+u{X7k%lKG|oI-yWK67Eb3lm(}@kGCL zUf;W18{on~7X~qMunWTpL#UrqrQuK)hLQL4nU*7580o?nE{vi%&V?@tUr|R>rB&+I zNn^-km2;M3lYV72zji^EUVrxv<}b11>CfVTs&bU64=f$e5S9u*QY8 zE-X{omJ?REu#&Kfx?0tmpBk;!vAE5J^)761;RhCfqHauyq;5)K`LyFxeY4^%E^JlY z@TtCC@y~=E)Sc8{T^xC>OQKBZT?2>4;K!)aFsjikPC<99Xmmy3&Vk}7%1tuuazI>q8&RQXiS-|`aR!apkJBH=9coLtw+zu-UFQ_kNr#&^Q-nj7Ag*{v z-sPF@a3h}^(Pz4eYNlGKR;rC^r%G52wsN}RazmQCsRAB?*9{-RulzC3^pG22H-7Wt zcP}DtXl__MuzC=6BiW4|ZtQd;=0@C&uiO~phVDkfjq+|(;DGbHu~bVc?ndcc(E@Y| zQVY3Jm{5dTlv<3MiqC2rnM*I>MoBs{!=(tN-6*4+vV?Nfi$#(ux>3oEu5NUrQ`wCV z-Kgb86&9;ft5K^{Yfx)a)1EVSoh4Vawi}JyXe{TLD_VzIms-z_`h*5lsck4@I}#UY z;zm<9+AxnKY34=?a&zjYGsY%wscKuf@e#STa$2lOZtF%n7Tdegnb3jSk=ltWNtQk{ zE}4&IY3Nko^B${Ch9sUKmm8$$^Fsh?2?xG|70 zh&rRrzxT|~-55zn#xT^4VdUY|5!96Nd_f-N#-6vSz9f&PN~=*Flg7F+&W%}ac?=-N zyD`Cy>2Az$<7+nt6^T{u7i(3<_}OD3n@nTCbb&-=FEp{bKXoSmwrZHx|eq?iX7~ z{hqprx|q6zx|AwmC40nIxUrI5{3KT^VLf#~dqb8`s>pE)y;nsT&s=`MU%R z)K0ijyLWuA8~fbYuQD8V;{f>&>OtzElv>W4jOU0OM^ha6LlEJ(8y`0@cEU+F{-krt zjek_kUv8XM{5RnY6)#eqRsK1`dFln~`Zh_I2$!i>sM5t%nE{UEh8s8Cc<9C>H*U!_ z@>_DB>)QR*$+sDKhkBQKk9waf86FU}W=(qRh9?r6e=)hvcH>vACvH4dG0$XIkY6b0 zr5jiIT{&;ucy(w$DlR&W-dQTz#ge@)-C3B&q-isi|qGX+21%YOi-r%HTmp zHq1oL;X!7?dsIo7#e=NmY}D+^Z?jsH+MFKbqLZ8YJ~fYu`M_g56m0$k39wW!8x(5kDeriDv3J_%8O7J1`g*<5a z+_<3?@t~*&#Z+x+4~mmZP)kxvQQdqBcNub7YB{PTDNm?CZ7@lz?7^k)lgCWdrm>4E z^s7>@T*k#brSI^{+?588Xsir)v(!Gnj-^=_;Z=*VIx4>}XX z`PhRlu^v=7rVXNw@L(`OoFRnIsY9v5JQ%KO<;xL9lE0viQvR17j3$4j99f-l9MTjS z@FZ-02_q7KT$&;v)l`mh5Ai+~Tn8sGZ(><6${)YOk@{7FCWrMvq9h>dJcWge# zgGGe7)OjlBe8K_`7Aog^51#$=@81R&d$2_LOFdXdUQS)1eEB|$)gG+zV2=mCd9c=l zdN1_t9EqIEIuF)+uz|rp$X-&dHl~0Fn+WCklsSpt%;FXgwi33bgvqaI{N{_FS=`~l zPUZhX_|=15%GoXZlNZYu81)C>Kz2Y-7|*^4S(oblivxovu3^5U!q=RA1q!4nV8dvHO1VmzxiIBJaN zq6arrhD(IY9$X<@RsJ;(t}CARLcdAA<-u*j9qN4#?h@`%m-9hV56BOx($^yow($aa z>cQz3`dbg)$tshdQ^kDY!AtTh>TBv7RV&YskvyrqNasa*FOt0f{;dXt)YLRyq$L#T zY}^wvc#+YITy!!~vr#isCEz_m7HU>6-f)E3Rc#JJPA{zLxf8j)cwg1#@!|t=Ugb2r zklcM~-0Vf%3*8Hg7X{kJtX|l>uzTTPSeWYc!bfmX-BcNm#|y7w`G~hTeij2>1PLKk zE6+QMDAv4)l9Q=1<)3d9Pk52vi<&R>rmvC<&@bafo|k$-uRIbHg;it;FN%UvR6`Hj4&Pi{bMsQf~cw8n~?5N_s9YDQ>IZJ}yg zdeKU8qa(&CwDzJ6owmwvM`-Uw2jz5>p}sVh<6|$nc=6RFZ4|4zdhw|jy~*9E-M#2R z=t-3(y$GLpF*UuBp%04#y%eCoA$BVgMOefFq;u|l%C4WbiY%{%>rFb@B(zE3A9Opb17f|O@yPP)`Vj=l^ zsuUM_v6!6Fe3=(HvPCy}@e^UW7c0D2NnS-=@5O4u8ma`Z^A|NHsx>k;%D*><>Yx~Ea)#@{7Pq+@^^c&hkS91abA19*yn{NpYrl! zzZVC*_`-)#KK$XuLAlC&DB;5)FAmFX&4&y=9P#3)7w5b<@5M1M8ZX!W^kV-qV;zq( z?Fs5hFPi*fQYAR{O0V%sU-qkZ!HbJtT=L?w7x%q*;Kdcj z+@fAp@z=b#PQF3Csr<1=wAaudisN{I)#WOFS(|qK`W5N^aQ)=$` zzmYGzcuPlGy_AIH*VH%4pD|v0=S3d@7A79X@4O`8FCVG`7q+qzgJTpAIv^jeE5J> zd8zrRCaR2Tmpf)v?C`;+*iPvBI+as7E+5>A%l>8je&q8Z;)CXcpMF5q1_>b_!pixo zvL02O?8AybjQNbwiBolILdBfwXXG!yVnH7Y5elo?B0dx)7o#pMZ)7X!Ln$A6`_RXS z(ms^&;bR}V_)yk|ay~Tlp^*>eeW>6=EgzOwH1bzu^J>&eK2#=Dp-OF4AC_MEcipSg ztl>jVRr{fI^wyYXNmbj2I?P#@T8~o+M zGrIoBhxW>8?L!;IZGC8`xaz8;4vISxI#D}Q%OOd6?@A7COcw6uLw7Z*9zOIW_fpO$ zK72}+jUmBvKG*vC(9egTUg<*?X>(rb7k}0IGuvlA4Dewfc@T9db+8XZ2%l3^R!7cd z7>mPYe-cJg#XtT^|I&xiKAiI5FCV`0VT=zeeOTqgSRckoFE5f8`Y_&y2|nW+4Q8|9 z*FJ0-r%m%=B8!u#lc`gvl6k5RciS1$IGw=~Kf{M_6o2c(O!6${$oB|H@OM7UQ5ohE z=J_z6uz=c}-zFoG-}|sgMJ^^Rp)U1d8DY7qUE#x-UdErQR{OBVhkF}ifBNw7mA=-8 zeX{Xh>+5`2&)^L{Z1!P`4?n238wJRll=G9^5MCR%bUC*Au+xWMShdZE?S!AHJ5+qL zpt0M3_2D<=?DAnZd5>~JO!zyCdu1*7v+;f(4$%2SW?n@elve@8hvij3@%;tHR3BsU zxDO|ke^NFHpRkdwbG+Sa{j?8%%bn1VG=7}%;UC#rul2h=ob}Kl1kta^41VNzqgxn|k(!;F$&bv0_o!K@k|C=f*~kz1wjZra&PO&;&D4}J%NVR2iOml?!9jIWrPk$#TXFImUB>VA!^acxQ^g7R5hRDG zVdX~%-QVcRe#HFP;>T7$;(q9U^z!2qKN5cA_oJ~NP5da}M?pU-`B7N{-j5aX%Xihq zO8HTkMRAG{iuzHEP@GzVT9PU;@~yIsFKVSF=S8gywJfz9wY(n{2oVVuA!Woetf97mLKu~E(xpSm$%r(<)}-j=SO`)18PHRBdWw)d8;+` zqnRI_{OIgQ(R=X>qvOr}82v_X;YUj*Z{t#rGtvy`Sn+KYIJ|wI37x=;KFUKfdr|lphcG z#pQWc7vAXo{OHf%&-@rb80g36eheiKq7L?B2toRFbWYmJ=MM`H^J6&u5vq2iAF19N z!`t>y`_d27Tm8ho_-H?*_!U)Pj2~mkMgA$&vqmO7IXEdL=0-o(6E>)rA7sYz{QDEg zk2E*=@e^UQis}1S-{!}5x$Xi81@N;UJLH}d00P)4`^}H*e%$cmS3h?7ao&#uZ}r`5 zd(@9(e(dq%H$Q$?+5RBxrS6m80+fG1wggX8&g-Bbhv*+xwMYC|!P?_=PE${)+LMGo z{WwMVOZh1Y|CUz)I{zsDEa9BoDEPOv3oKq#wU_+3OujbNdΊcuaUgeM)^sm2i<*O)lPYcV{H^6CzptEq%Z(dU-T=&W@=;CHY5f0%)LH_t(y>v+`R;+{ z3}DwWeddaI%KPVCta4L5RBr%274Huqpt$inJsdzJfVKg&3qT7X8bDn+-&Bd@06u-E zCj!XN;21R?fKFIzHg4*{OJ6lw3$#{u*Xpicl@SnL`=w*b16dr^B(dr~E5*)H)<$e${wRH}sd zeI;`MgJ|{(pg-X=>Hrnlijji@7^<8hgwJIvxRZymI9%0^ARK(EeL)x%z?X#4)QJIn z6~LGP#*OurZ~(n#Z@LO2`S$ke$#a z{tfk8>dXLU5yYPzz<1<1%5g2z<_EAKfM!874`N{e-v{s}fVTlG3Se;nX9GAFz>)x# z2Cyf9-vU?`!14e#2e2i86#=Xa;NW^~LjbD?YXg{@HM%;0H7p*=hLl5M*2!qIVST`G zr1(Ps8yWK>brV$reo`PYTLah@zz*2}Y_(mrm8zfr!@n@|E;js?EO{hmw~F~afV}}6 z3*dMF`xtgGMb~Tl2?wZuP~}ZThnVEBia8R%QL>C&&Q3B*{u2S5lrZ{dROG1u{!)>r zndEPo U;k>eja0_Ov`5Ww94?lJgc05=1;6~LtcE;Hr|^%^Jhs!DjBaD%1{L&hM- z?Evo3m$WGpD|$bG2LU_};01#pGT<5cQ2>tvcoM+V|Fn{9(kf-rUNY=e0IwPFznm!n z?*d2_gf9qx5J^EGh#W!W3?g+9X@bZc#Ct)c4I*6-8H30a{CBNoZ0Uo@5Hw~lC1J{F zQ%)gE&{!-vvIhShLpJ4Prz5R$1(7=lQxN7L-e+x|AU;s>dFlKwb3WCPB?xN}4%SLv zHjYQY{-1bhhT3jY~HI6}j zT#uPkX1ie!je=-QUmS_gos^K~O;oF<1j*SVh?YU@2x4att%CR{h><~j5k%`C+63`g z5Cei}8$`PxJ_+JewrU?lryx29(LrVFNRW;`CUjMP7v*;gqC2@q5WRQ`Jz3N_DjArJ zq_=9-pU{Wem)cM5sFbrC$P7b+7#75!AO;69j?M%>1Yzz6@e{ z5G#Th9mH2bd>h2fAjSkSHi)UrFfNGkgo!~+VB4?%lObg!lNccRCkHV_v2?vHS8Q4k z)0HzLh;I~2!&yPhmb-co-v{xX%DEtjIpn!P%p=U_Ny*wtLQ(0Z0jFybQ!NQ%G2wr; zOIci|reb9ftAh9`h|NK)4q{CZ8yJu>a%r`ey{rpjJ$>mys(w(sk?h~I*^z$Oy;dk}|%IKtxIAodaV z2XTO7`$LMd)@skEWKL1(;%E@Z883W{F)62ZB8Zd9|1*eFK@;tB`$zcE~6QTn|Z#H}Ens0_CW4}!R(oV$d3)cb0#9;(_$ zgvb9${xpbZD*1E9zu*95c&~$aBRAd<-Vfnz5bxxc9zy02QiYHdLb{N#TT(`dkg*o2 zscEQEOdI<5elDCogbd2hNRWo_DJNS9S;$#cl{9(0DLFg4$PqGLM{p!)5Liiwr zsv%ShA#VuzLI{Kq48atFnPKh_ECfmA2*DbHO^wI?pFC3QWYMK+J?zvQf{%`$y-S#k zLC!bCVBr!B3x^O1LHo~CL_eNIC`3VK6MM5Y@kmQ9zD6BYN{!mfH#R$da z1oMX^tR#!2sHLf8LU^%JlYx~Dp&Xs^)C$y!)JoLK)GE~Uvy97Jj_M)QrBfq>nuHHS zsLj)mLBVe&_J>HjYDV>!r5e;OGeWWnuYLN2)~EWJY@VDI3t8_ zLTC{}%Mek!(6&@+TyA+%+-k3;AZLc0*!htPpzkiI&zsw1@%HD%+8 zc2z|gLpO5w5PGOpOBw$sA$-cJK_T=eh(CbPCxpHs^dtADenypSl3co$$bo8ah$+R- zLl_#us1UvkVHktO9Ij%7M}#m^`Cll1bO>LCFfD}XtQr%-WWv}G#)U9Ggb6IlwwDZF zhcGdONpxfwDgBBsJcXw4)c>!xC-2+ehUCesSP;TY2F#+)rhZ42wsQz`LzqWM$-gj! z??YG{!aACZs7pdvObD!sNkci7hOjJzL_ZqBu@KIOa3O@_bWTyF>O=@9$$wH$9FB?k7x}b` z`I~SigntNUspqJrGDjs|j*B5&r6YWaa5;o4Jj9vvvv!Tpdm%gw;ZX?pWq%$^maqp39uuB~@RY$)o8kya%yX6DMF=TPUWf1|goXVJxNT*`bhcTs-F&H`OWQt}EyWq={1vTL$b2!y864jAVxS!ia>Sh2akyGZ~;6R2f2H zgvs)3I>~%=L~QtdO~OQt!Guvbj3QygRlH6}Q1gdTfKZTHh+02~F|jfv8A(w(0t2=h zlU9Po($tb+lp=^fevDQojIv>r3mZ#TK8$)yB7>>G7#WOkWpd3hJ|tA3Rt=+?EK?XY z!jMTQ&V~W5QLQj)htVvI=8UW(X~U>buFJlp>jo?~r8cCB*(i*BJG91OG$9D5j6WrL zi!fS+@lhBp!;n$QnB@>?O>Lvhl;HMZbO_`3F!qMgF^o=OtO;Xn7@foTIE-0g%x0%u z!sro3Pjc5Vx)HilWpZRla`XygNEn~P zq}6~h1}c^jDTD+()(oPObKIZ7}I1|)A^P;!dTB#JE$9| zKT>}PVB5U197d@1g#t{M|_jiQLEH$uRbZaUhI8=f_ULg&S zlTUCX$qa}iQz80i7_WXb0?sETPKWV#7*8U28o`+`{t2UM1l1xq8^$>aj=&s&@%+y) z9!ppl7s9w0#-%VWhjBZMJ7HXr{H>yL+#p;H<60QkWoG6Z4-S>1XS0~-P1fEDm3bKY~0o^F{ChLC!IyRo)0<9FG*` z94!%88Bja|TLkt9l2tZGL_P`uZv;-|xCn0Q$v(y~d=UgA2+{FJ5Kxg(pDwjw7Bv|a zVeoOINtE1xk9dtm5RX7ttqMhuh#-Fi1(Z`T0{NLiTGiv23rA3dRYj@As0F8LauG>P zi3mzYP%47b^eaYCCW5l$auLW3q%60bwFH-^Um=2C%v^~@@heAAMX_w@>cSCx7(uNF z#v@TPg4dtLJNy_IO>EL?M^Gn%k0a<3!Ez+(M$kHfHWAc|pne1mBG`>Y;|Sg$A!9QXBG>jHrBms1l=Og(#N($&^>}45iFAdN6=GFKZ4N_d=Ky_%e0B5Z2Lpngk(67HnAdti)j;UB3K!L6y;bI!D_{F?rRyaE`s$D zY>=6WU{eG?Mes6hB73?-AYEc(1V3`v!ZJ~%(;5C|wvx=kTO-&O!S)D#7E?|nf*ld; zjNrIjJ`wy9!LJb<;soxZ?upWp9pTHOCWvXR0My~IUT{@a`PwK(kBX} zH_l6rn&}f~BRChqdD*=`>o1OLgVHB1$TgMT=w0-(Y?26WL~t{LtFjH!C*=4ged3zp z>$0(F-iqLM1dk(VmmzT{g1fTN5m+)LPNh%Wi$L@~^|p*EeIjj!#6!8aWJt*ING^6l z{|t$V84}Or)*+X(h6Wm5$fC$HwU5`(@Jcqb+&nedG`xx6t=y|MyrD)LiA@<3a*bTgn9wyOWM(oZ3Tw!( zp@4>h8VYGh%4Edk$&`p>N>s>{Xpt$=H&a3``IVbA2`;Lkn1Kf5Hh>%-5^8Cvt(-c9y3~5qVWr{?H8j$&CyL*qXsn@$hOAL!i=wH9W*RnX z_)$Z14J~92HGHk1rG{1-dTZ#T;Uf*LHGHh0i-tBD+G=R8p@W80nG^CWl{oFlNAGDJ z2@C($q)LuX8aiu`qB(Oyw5x`04ERJtcbOA%FAY64$WIXxFPZ|vvTx{u%}lif2xIreSKw{(*L3jk4F@#*Av2IUu}8yitdcX5UmT>P-!<%|BgK7${j%b$I>@5@tSe!19FohK&JpTS zs`%?}gietE)^J9{N#*~k;gnoN8cu7F-J7xrWfw`4m7`<-$SqF8d6~e`v9p>ykI}gA zN!10;;Uy-ysNsJzd0Fu_4cFxktl_PO8yaqEc&gzU<8NuWtKlB`wuU~wkYyOkuM5U6y~Tg zNXaQDA{#)!!mh=XBV~#tSb7(AM&XL0a1=$Na7W>hUt*%rqVTdwi0Y&Isgf-aMNo0d z;)Yq2nT$q}97Q||Jqo!oO0XQU=)bok;Y1V#RrCC8RUm5I_hiEqiW+-H5{ed$8vDFt z6s4jl#<1d1l#uh{lu9012vPaHpfqdCL{V1N%FLIexhZp^BB4eUH3^lXs7$C5MO8vI z>Pe2XI$3U0A4XA&+%$^XQPd$fjG``~K2>_J7d7rb0&+BU zXdXoink}PfEhkQvUmT_OBdSbATS9xP`0WU?SRDu{GtfDTkE8f9iqTPYiK1&1L!$UR zif&PKXIM{egC0@iHYiDCC&<$GisF+fK8>Px6oVMnCyKsNd=|w37W+lfpNBM&Vav{! zwfNsT4vZStLdxk3jzWSZOm^?kD27KdLROrcN*uWgMslCau)l~Jmy(#H7@xAYzlvf^ z6icI67RA{Aqw6i8uBf8F|L1-I>F)04-Z^J_Zqp^wT}p=t2nf;*f^;K|fFdObA|c&K zDu{%D2uO#N)PK(&@9*ck-v7JStk3$+o_+Q?XP=mR?=#Q60Za&B8U<&Ei2+PzF^Nf` zXj`7bnnrdiS3&j82w)}~7t>_R5};9=6~OEO<^(V|fJJ=iivZ^Ff?CKka6TIs1l)Tf zMW7-SoVFk$osw}$080b-lHFDW@KpfISTASNiv-WjBQ@rm09FOCBY>UkusVQs0e9CW zhcyALrS-Ve@748f0P6$Tz;2rY_&$K|xM3UF;sxAHmH@UTEL#HD%9<*o!}Hlr>msq5 zyy?1&_6;6ua@Z5V-T?M-DSFRKmM;DNU4!>%+YjIn^-jSu1&0GT5PJi zub5@iX>WNFrcsbqL6QQW0w_qPAQheRZa}+Pas??Acc#6=#*|EN9K9uwTKV5yF`a@8 z3X*e|)3YZPq}u^S%d8-af}#qFDafiIn}S>lax2KrZZkN0Iaudp{?BU7!>5H5 zZkA6$e%2JW0E>cD>8&!f#(&5VD9n~3Od6Ep3Q8!bsGyR9k_t*G2r3BiRl2X0R!~Mk zSq0@37z#`Uegy#qLV;AEaM!$4Z4CV>D*arvA@GtZ3W)Mrd)ZR zVYWxuheA(&SJzjb#K8+XE)lhM7-;G$4kwP_9&`d!e1)p${ z<_cOVXsx)nvla?kvY^+Zv?ac;-~*Z=3O-iQMnPKzow!KGu)Aj4DgWNY+bih6_KwWb zJV`n$=%S!2TgbVGf)5pRQ}7X6x--3%MN^R+=DpNSr z3O-XXj*Zlw@d`dyFhRjYD!#-|Eg@1I~nLBV%4SPIrC_%`9Wmc=>+-pg`|pHw8=mEPbYkSRq!*- zd)$A!4-N;Lc?VZR~7uBV6Ma$64w;` zsUW97E`jR`ZqNoRK%Z#eRNR*zf77^U2;{G+{-xj+ZD=*s+sr!(?3(Ib<~`9LUa@&#Tf_(wtA{pw5RE9Pq^U45hA zE$bxV`jCZ~OrX;ynO)#*4K=v{#VK1|rVx0Cv~c665^fjLvQ90KMxgCoAK9rr=>*6* zJu`zqMuAM^Mn`%rtH6&n)hx^|_e+x|dp3cQ=StI6BJHs`1c($Ww?G~NDWD4E704%0 zN}#kret`l4@752L5GW{6NT9Gl5#c72YNxVvsi;6Pfd|Qwij#j$m6}Q&p_tSW>K7d) zx&34;L+um@2q*&O1U|Uy^9$7GzL2vwKt(e`2z+wacQjmvLQ!!|K<5tD++Rna68A31ry(ZwG%OHd9c9K6_P9WK))f+#iizY@X5r7w?u5$GV$kv-cAv=eC0KD`SB zk~%BoKu0HmF6_{mxhqRqdM9pYbY~77-2{5Do%Ba6y3-i()t&+$v!xfax4?+kK62~B zrw{IwULG#fPvBF5aRTE7`m=pFbAZ4=fk6U;1%?U?6Br^e`>v0sE=8c`5$Pa{#}Sk? zfl&gZ1;z?|CNM@|`CT6!?o=yV4i%O8Js6Eu{G`u$c3_ zL|`e84$WR~TqwdaYB_tZ5LhYjjlfp|Ukl9OCQ;j{4XXrJ3w+0#3a$}YE3htcN@Gnc z>s#IpNURswz?Y~XEio?--wSLOI3#db;0J*%0teWKdc9R(pTK@T-6pV|HUWVhe7Z|u zx4_PXCsjl-_weanCM99~4L=z@AMffxzC@aQj?hG8^-m63L~z z$5I^H485@+rj$q}ky;{+bSKRJ*#E23OJtDnO9Uh`N@S8KBvDu*vqTn&ToSn@vPxu= z$RUxF<77{eCMu0JMf)F19*MjX`6UV@YNVN;Pl9F?Ig>6Z-L*g#8UnHuktixrN}{wx zF^S?5B_v8Fd_2$pvJ8clC`VOrG>Y@ztBQn>h)a~0kP@ndBN3F)By>3%mk?c zw8ha*LaF<&JtPs9h)To~o;~mSB9eZ=(A^R}?XiMHMTu$>)g}FWJt|WbHPtE-|MjUV z(c!L-`b)E-hD1#oDT!JVp8fx39f`UUgCqt^)Z?DEl4vbaU!s9TLrSJZbGA2@Xd=;6 zqS^mDS__GmiL10ss3q@9d?3+H;vJLS)z+X zSBVeh|6%{HPj`tP5`885Q3fPFmgq%E`#=5rNPHsUk!B9%gi=cR|5T#C!~ltbiL3wh z^z;y#Dj6|RVv@vAiD44MB}Pb$mH13zq{JwR(Gp|+-x0=1jF*_elauzq!*_iCjQCuF zZbR$dmZtWQo-8p%VkY}crTpCWO=mq#x-VMDpGbFs88i=tTb4@AqGc#CN22>3cb<5h zCox~*rHWT77Dz0VXs@D!ibWEOCGJVwmsldPRN^RYgA!j#ER)zq>7w>XtdQ=*EgL1i zlK5I;y~GBIl@i}btddyGSLs>kTIM7WSv_^Ma- zfW$$GLlTGCc!Wtl)E;v1#4+0ZDT2gxi4zhhB`!()E^$iYw8XCx=OlinCP|!;I4j*2 zdWRRp>z!BKZxZJvE+lI4x^t0F>6s{M9{rH$Wj?(safOAKnLp?)0QbT>CC?j)tGBqD zH@(iXkJs$mtnWzN(c*gNx zFrPE&WfeU__D`Z-(yt}nNF;G6ibj^Vv=3x<(@xKrksxC-70FfPV4oB!-cgZBMP?N# z*^-8tikX^8Md;5i#I!2Xu_Zk-L*i;i7J6o6QIVB(HWgmk|A~-Yb=y$oefL4roa{q4 z{X8o2s%W92S&DM`RODCDm@gGjQBXyB)`jTzYE*<(L{t<}QB-vwF{L1M6jNcdPjM9` zRFqUvicbZzw2Cq;yr;s-swl^&eiG^3N6P|yNjD)Ajg5Iu@ zGksX?@M(}4VtRE&RmAwzd;YCjdM&QHf3Kl~o`NG|1r-(5f1i)7q@uElD(qiXMO_vY zznY5bDr)d)P3C(l-c4MsrJ^JEqISYkN5zYE?l9F$Sn8{2z`9|=(n!UM#jZ~i6-_Da zDw?bRKD#)Dvzm$@6>h1bmFlkO*334{_f>qrf}V7xOLVm5({@aHKC`2WPAX2T_*q3~ z6_i&=;7n@GJvW3{o*x#b+u8s~DnUn2O;lhO(wVca}IO=paEo9l=%5 zjH1(#tVc0NGsiH!gp5-${y(Rmv!1{OC$gTzoXn)gQ>kexrqdoy6JEs(6*E=LQ8AYt zW~rD>gTmb;((RRgPuvF zB1AH7Q1P9LjU1UyDL74C8u!gAcBt5?;s+I5RBYvzY-du-w{Zta(D5TTuVPv3Qn6db zVHHPI>`}2-#Xcvh4CMa3D~OWEzLieFV+S8+qdITgRDxT4}JUplYiqKZqZdz-kx7H`M?o%Lna zz34RqEC21$nLF4b6EC!!*2Ak))xk=8msV12oju zP)9>D4aqg+*HA!13Jvr;R1VEeT}ln9G^Eq$ITrUcwT3hr(z1@Iu((DNbSVQHGiu1B zxx2AIvh>@4Ui70;<57oX-PYRJpFJ3rH&Py6@Dc6!d7W?DfFg)~&s zP+3D^4MjAB$U#F<4aGE+)8N-ooZ8IeUY6sOV3uT-VwToWhQ*e5+*=PFG=T$bF*UT~ zHKOpT&>&fmkE%gSXkCMm&?&htOM}f8hZ#&&6C(_% zLmQq^G^yIMpzVdOcF@p?BX?wyh30c-4PCT<=d%}(N`0uITOz_oEV^sx!J?;zk2Um4 zTpg&Pw}w7^`iX{q8a`#+SHqd}Nfe5X{%jdQeLUq_Jo_Lv4rY>ZNWy=(h7lU}Y1pq} zq=r!%mTOp{VYG%Z8s=*FLc>@MpJ|w=VG?&_9P@MLcqa90LPAhCC$pZ)q|+%Zyniy9 zreS)*K7++f<}BuH4RctG<@@+N){8VO)-Yegf<)dZ=0d*Y&G03xzho|DQhS!MAWus2 zR~o+7uz@WrnX405zhSXTgBNOzhP7;2r{P-->six(rqKTxc?Sig<2wx-6A?CP_+G(k7i6ZT(NoY8QW#jgqb zzRk*c4VlxZRNX}iOM~*-PX}3O=3L^6C<#~S!+%BynuwuU3+S>OZr=Yj*dA+`Z@kC1=MU5vw-_mMLBikVmC#n|Byu<9VK*>)R9+5 zJ{^U06xNYnr>6@<0Ufh{R&r->+wi)+D5!&OIi!o|$h^+~&I?gYr(ZYl7u7K+;zrI| zQWV$mtfTwYf~B~M(mKlMSU1xjj=9FNI{Z2UI?D0YV=G)^EspuLu*mx=N$8MNiw;eP zrNh>tvuC%kFsZYwpXGP6akspBd%kQsLpW6Xb`hj56c-Ku^nI8?3+W(|PgF-t$1okk zb;Na)*U?@_2OSl3RMgQ>MNu9QD zVMEzmM++Uzbo!bCk>a{I{-S&_19Zy%245w59n|Ms0iC zN1w5_)3Kn6^bsA1iy%WXPy}tYgeF*;B_qXQZ9c&7qS~?CCA~a5g^G(O<_WI{MPY$m)JC zQ{(ZXpAI7F0Xhci7_4K6j#C>%GpPYO#_E`)W3rBUbNrv_7_Z}V8kCxH9FxjU&@qvEG|g?pzCrTmt%69p z{$e?W8lPQG(=nAM5`P`*-FL<8jM{W+Gq+@xjw>_#bE!Bjr49bsI_Bu~&l>7+A&4)h z`R7p^T8Z@;wY;PJ^L6B$?kBNG$6_5TXgG8%(ecwG*M$pjq zId|lWjz4r)hMHuGI)QFNiN!A$=R>U(8(R@|b^U&lQi_xb7_+W%P` zpW>FKV`3WL104@_Jf_J>^JKL9Extphibpg$9R!I2KPbhriKVyX*y?VRo>ATmBs1__ z#|xToI$r8{rQ!a^`5rQ)XR zJZHN9t?e@m1abi z{)>zn=#p6*lUXaz!7ET63@py9g*W>4kMfml@2g~>GPO2^*mYf{gX*njpt^x32AUeE zVW6ggXG8sU4E&f`d)L5w9A|WAS=xLyrf!+o_Hn6&{?}(}T(!1>sWYPLi!=QdbQ_FDo_S#vrwqu<$!Mj*WL7DGi4TCoVdU6rW|$CK{MTF9M6G zlW8gGZiDw`abr%S{2Tbfz&ryhvuHC6%rY?Bz^~2ZOeXo<*(c{1IFLn~Yk+jelVaXE zH_3F+znjeG>J~7`vcM6GsXLTp6P-*fHSi^E0w$81SY}|kfu9ZhVqk@VuMF%mu-m}b zRJDOE2DTdb#=t5A8w`9$={0aAi?*S>`mKRA2G$x_XJFI&;^TILs1_0P@5=RD@5?Nj zo=@FKR}DN}>)%X9w*Sd{SMIFt-21`6w#vSBFO~W?#Wn-mX>J(UX~4*;{n$wSXkg%5 z(fWixk^}U@_1*pc_kD88Yq7_`UIRZFI7YjZf&B&!88~d|EAc+u#2(=W9Az#_;Vzcr22L0_Nh8%(zTD?#@05Ylv}V6|Z)YjW_;!sF`S^<* z&lvd2z%2u3X$TCQGw_>%O9p{knl034N2r-5W`_X^3eR)8sdBm-a&g52>>T z=6@#d8+bsAD62N1fsjeQ<736r74k9VWR%;NC$zsk^#4uUax%C3bUfvl^RsF%4E$r@ z6>S|ft7nQ*i^cM|cuAXNdGXypNpB3iHIQV&XJXhZ|H2`Xj^15G{Zyi6I^XxyI}=0- zn8L(6CZZ-{CQ_P6WumZ&A|_IsNMj<0iJT_Vnn-6NlZnhGiryFLP3#;dGn&XiL1>JM zh*hl-@5^E$tBGtTvYS|OLAmfmX*$cF_jA#?zeqOScjvf#GS`>OL~axLx$KlT zB9DplgG4?PB`S!#CVt^o1+RNXmdnlMZp>LMOi62yyFg*@SNC>!YlAroN}2hS-%6TP?lN#xie zs>OYCc8G|HkF#kTru*X@yt;`RCd!+rV4@O}lqMscGU}6D>`&GEvLKdnOu~XlSA~N3LU{E{pe5`jTbW>Y3Pn zNY1i`G(cDA}iqHOJyhmSTkzG6TgJ^By zeG?y;XhTU>Me&q@_x6jEcST#%eVIz0?M>8KDcYI%DYHD5T6ExM{Jg_mdYw&lF>%Vo zX%k&dd}v|`ZCob0nfS=WC=;VibT`q%!~hcmP4uL6ndobx9|!4WqK}DBSobzDhucPP zIw&$7In()$lonqP6Q7#sZ(4*llJd&uzx%>l zMTJ7XFFT1VDFY)+lpZ2Saup{z!Wa`{P0XapX5upw<4jDXK`}Aj#OEd^Py*MBufK8I zaCm^&_>u3xX-RLjCYzXIVg{vRqM-jln`&a3iRmV`@qT`Fn(X?Cm~l+>YANVPNv=%t z&8F^{m}}w-lU|Pc{?0Alogn=E{qs!Br#$TSFEnv+g0tStiO?uX9oa~6 znu`yb(?bUSN*hF}nA~jQ2f7($3jF$xkA5d~iwPx*yEeC*_|e1xS`;QKFBdyZ>^8B7 zlf2W!E*9jrVXc^vL)&X&KU@BKBKMhCpF>OkOsvW8X84ea!zPYWGfb?$FOJY8Kcj5B zBA!0URkXCOq&VqS{5=}IAh|hiAN?L zQ_fACBOeog(nevre`>jC;u7sbCN9wO%m7A+RbR0G!tcVy8Wf& zAKK(CtiA4g$!&X;XyI!XZ&47$t|R?klI2T3-4GsQbne;@ZMFi z(GY7|`wA_PsVr2=skP3jrL~aGLh_UT3>F6E)GBw9?LL#~SyKZRDr!cHo^y7$$}ASL zT2L)$7P48$ZlSP+A{KI3$Y~)DH=y8MnagrNOc*yn=C(jbi(O*PDv{ShJ`4FR6tGax zLLqj(GR^H{ld5iTrN5vr(@0ZE6tz&yLKzEXEflv%CJgNh9ue zb4V{s9^FkkcudLG(^t-d--2R6SZG$r7qIZbC3mJh8R1q@rMZ+AD!eNSKNM|V2s+g* z7}QP+ac+re!M5O7c$7u8=rh2P{%@B1f)>8Wsf8^>Ec98Wge(jh;}8DjZ$4H&>*b4D z2pkY}Q2g=~+(KmwRV-Ab#9G)8^li$ieUmj1FX8)Vr?Tmk?`Ahq)k1X(=hFtl*JU*e z#NJE&H)EoPg>yNzF_)BDG)5LOImqmwwuL&BC>w=s)U{C0!fFd^EY!Eqz`_Iz6D>5f z(1_Y*;S&puEi|#v#X?sLO(_W$T3Tpj;b~4Sb1tp9g>t#H78d5;PO6?ud-YJZw(ve> ziMvnDpk54oB?~X|wXx8ajqP)}ldzqqEp%Yfk=cn!S39%VdffM+g>Du;ve4ba^UuYl zm*V6Af3J;xx~=rE@Uewn7N%WRdNPMn11hP#E$rUp-!a^Gd7q%uz83mf7-nI(g-nXaz<=dvg{!B^=6u`QQ2!oo-k zV=Rod@Ov)J*G-PHFxtX}^zvCQjoxw7+ihz3XBNg=_}s!c3+a3L^is0^X*n|@a@|R4 zyhL>F1M=kth;iQF|ef-DBK2x5s zaA$^~o#eRXe)2#O%H?tMe9FRU3qN!7=+nzzXmBgL@ktYZr3l^R1q&BxOm5TZ(%$3Aweay1SF@frW<_M(k1_ zQI-n2eJ4$PLd(;_YYT5I_v6!N7XGpDl2(v~7qlEYN%|<2js1|}N@ySp@pG&98EN;*DH7&1Zv_T}FEH<**$YUd~jchiu z+sI`jw~ZV&a@xq4SIfUwcAY57W|yt6%bZUneLhd6Qf8Hx*7@?;$Zw;7jT#xmvTI7S z>q%30s)b%B(a%N~v{5RrJF-P=6t%Iy#zGs#Y!tWA&_*L0C2W+m-MeH(^0ZOfhGE0B zQN~7D8vz@NjpL`}+a_6J?dW8of8Uw@3&Z(#FMCe$9qzqyGg_X_CKtD<6pt zc{Sa}chf|p;o{LzY1y!Cgl$A@I9y%OMw{=%%Gz$uLpF{=9hq0V+eAcd#B5An?=Nqo z_7oYn@#9)$X(xOq%eqa@giMlqrj+6Cl)TeRGtF0_5lD8BMZ2ArgW!@!U zmV9pZ8rx`MW4MhGG+s8E+30EGV;jwFw6O8MjSp5l-<7 zmfwDyw4Se0*W`5nMjM-GHs;sreDCjlPcAGc=-Xhvx9NW*)y+(D+iGK*je|B0+1O4~ z-Ns%U`)us6vD3yb8@p+H{7ZDouZ_yDh1N;>uyl`&>M6y}{94OA>Z1G_?fIATyHj*O zZ9bHZoG5e09j3!Jj&Ng6P$n~KV|t6DHh!WdkXAiLE1EC;I8V^&3od>#(ehKYrk1-A zez9@J#yuPNZJf37tBv1nT()t}#&0$*(89NIo>t#$|4+Gm+kO|Tk11becSpS8N&h9< z`g)4!Dmitu?+Q&STAMchvhjzFYqUCST&E0Fld~52ir)2apWw4wxdm?|+HlTRe=DHg zqM@V&<`r2BXt!y5EZ}x?US4t6#U^q^?;lP{Tr4`Y-e$h)xjSQu2CEZ*&PgVFw{W~2RR+o zq2dm5ImqomI#4OBgS-w(J1FBIpM(4kia01rmIq1!@?R(lIqvI?g3J*Gw84i(VF&XI zXhSxOVh)NsXnjJKa!`VrdQxmDpp|q$e+46bu7K9PzMxO4sa0hilyeYp+#7`7L9$sg z-5&puoBk);m8JuH3Z=b(_RV^~aIpGUcURGAQRp6j1=FKN~$_w%dv z4mvnEcU0+EP&+k3JliBYJLuw|uY-OLx;prfI_033gKiGm&+&icpu2;cwPlG1Nj)6& z}7KBP&c2wX$ox=eY`Y&;j7(Nd_vuC>t^p$2mKukaxj=?^6z2*MNTOP zIw)Ml9hA{&WIr8!#`y=N7KN&bO#Q?#nz0TxQ78u^9E^0Z$iZR7)SPkTAO3CdUp2@*%N5Iwu*_A%t7+KS4s4dKGitI!Bhux z9em+n8YRlXEC;h4%%CPEsWTlcEvVg_C`)XXI|^!b#)&%{6&lkyb>$ofM2awvCbokG zv^rYJqOE1lkV>E2He29d$lZVb$W6!+ibM0q!5Rl&I#@=7=wPLTIA6Guh^^);d7T3DC4H%zYoOf`+!4+Bs4lX*l$BT3EaBq4@QP7+Y9N9>mhZT8bdP+GVQ*w7gSaI{@gV3$6g`J?v9MN*+|sIt zmy45M`Q>g1m)qDa$u#eFn3qlXVpn}|tU=UUi^t^{1gjPf=xK)^ieDogHp(NjM(-I0I97H6D zXb>?jLPmNbi{6RnAMZMBDXCTnqGAy3f@mK^r64K?(VRW21W`4JMnNw-57{u@(Mg-9*h|WQL5=7r1 zx&+ZRh@L@w9K?r|+aS7AOSl0a1(E8yJ2!s2B8nZ7rB?mB3brTn^`ePt%059{-z|F6 z%7VJ0h}JT>++0DF9q;QG#HW;jAch9fKZpTA45AF2Q6@eX11Y8Z{29miNK@njZ^d9r zX_DMrLhLD`t@%S47Q~{}vTsWD!EWEkAVvi-IfyAij1FQ<5aWUvPwjjz>9g*!H0Sfl z&uB{T6n_@ch&R8Np9e9C+LKI72x1~-IN;_ysi?MToum&Z)28)J4Psglvx3-h#8>aQ zGCha`S=AXqTsx+$de1kLs>qmQi%oJv>e*vh9=jTV#%tK82ry;s} zl=VsGPt0S?5? z?oRu65Kn@58$?nFPuc$;<}>DV<_o6RhL@~gF<&#^Fza(pd?9z--(iB8jG3I7g4v5b zQ?gFQ^kzbu5YmQ_jx8CP>6saruYXf0awgW9nOT@wnc0}xL-@R?Mn{eiazmk*rG7YGRraj z%mA}{OE->SEtx9Q>$?$x8N%og#)M#nV298ogr*@l+~#-)<=HtHLWo6}8DU15F=o$e zZY>o;s2IY#A=CJJwt1`XXtFx}btjY9x_a5s8%-YO4%(~2a%=*kt>0~@> zpdsr<%*ISFezOpohtNHQ9wD>{p=AgiLg*MmEB0x_Y|VV1`2o{wLtEDEnC+Qf%ucMk zGCMQ7{O9V2th+HkVtUbfhVXF+149@TLNB)WW%g$FVSd8&{QI%~l-Zv-fVq_C@L<-% znM0UEnZuY~J4dh{$sEP>B99H>vkK!Zd1-o9tOnfU|LYwgw$ zwuP`ggdamV5W>L_cJS3b%$>|#%-u{c+FsWCnERPtv_q_qF%L73Fpn~SVxH#=A7_1n zd6IdGnR~9=qhCTeLlZlUR$-hC;nxs~hEXhxb0Pc|LYlC<)1D9E0`0vaJPzSv2$w>* z8Ny#7{LXRyU|wckVP0i=?YzeNPv&*z4d!!h+b!1jn75gCn0J|82JW+dzm1CS%v?vK!0 z@I0)??XMa}wJ@sl)%Tb+m^GR2GHWrrbJ^Og>oDswy;ju^qd^!A+0vBRh}oFggz2@d z8SCcE7ECWf>oDFAV?`KWaq~V1qhA=GhS4UBwqdjjqdhr?(LIa~T&fGRBeN5;Gt-OK zmGy_rZcMNC9;|yadon*}_F{TIeOQ0O?923G_77t~7?Z=862`zV28A&yjL~5XW}jiq zA>Gg%SwXeh2L<1MbN*=y% z!dMl?YOgGF4RbAX9rIh}4sO*3*55HVGXE#?<}mhzu{Vq#!q^hVR<9Iu8*@AJN2b@# zove2;cQd_c`@+~C#tF6@U>;!}WFBH3W_tcdS^va5#yrlv$ZbB!`V{jt^Jk`4_G}ox zhVf?v*CRL=#&0yeBlsYK^I=?|y&{6L5nK%8QW(i1NFH%-4ZnwRCycvcTn^((7*{#k z4dx%rYs^2H*O~OcY_xUUWc?TO7V|cfo)Dv}_rkaz#`7>= z{gnBP>1FjF)^C|FnXj0ynQxf%cO|MZDdO(cJ|>u6al;GGCkMv#iHre~&R zreUUKreprY+0MW^BQp~-GxP8{x5jJ{WRIX=1cf5V!S+1NoXlLz+)S?}d0FRU=4TdQ zo;dE_#|yJA!7Rco$}Gk#&ZI9&CC`$qOEF6`yS6cQW19%tMzAh|ZzE_ILHh{CMKC^s4iR*WU@*72Qv{tO=oLZl2)c0D?#!;t z51HMVA2HANaA!*o);*aYGrjioVf`ud6J}p#Kc?r?pY;IdK;|Iko}e3fNCZP87{-=S z%;C%t%#lnl&S=(Sm}8lrF$L%F^9Uwz2bV=KF@i}E%#GlS2qv@74CWN(ROU41bY?w{ zFq8Ex=4|F1rrZ7E+C0{anDdznm#vy@t7#>BV0k!G;KqM(|Sv-*IPY58N5S#t1giDSK{XZf5?#+``<-{C=4`hqtr- zk-3BE#orad?g;j<98qlou zDE^AzRs_)~Vo}_V;7$aYqR1S@-3ac{%_ZvIT<%BkAcB7)cp1S%j`NiHi20cLH}eUT zexQeP@{IL!<_o4*`zzK-QFotz&H4@V?SFiHd=<=OOm9A z^Eb{wde#}38JS)ivP6+JiqcV(i6UDR*`p{BMZqX?uumRlPG&AmJOWOs|&SQS^yoN)%J0 z_=NK|lG!(keo=hNovnRU6Ap{$27hciboy_S!PVssQ^*z!4ZEb}ww zIOce!*R~0)Co(57Co{ch)1sIj#o8#=MKL3anNci>Vrdk!*k?X-HggVhF7pfKJZ5ih z^8(fjnTwcs8Fv%r)Ls{*?IJDAq^uV-!20 z*ueJ9%On^6w!3&iZn~=Qta$L~)fZed4-C~Afuvt*O4vS#y-ytSTm~|vk z1zBP-#JQI8iBc63{*_~>5<{yPTE|c|hH5d?j-d{_Rga-Y!k_-FuO{nv6P8*ryvLfF z?WLt|42@!F%#rKyrTWYUF*Hn+@;sZw(45=Tlu0dY#=^VWf}LA3DG%?*@B!)H zE$dD(wBrs^k&ZF6=i=0o4vAiq_6DwV3|$hTsG<*J=*FiXaXZPUd!h|JV(9rF&)zZg ziQ#Gtf5h-f41Hr*7Q=FO=oiC?7)HkMX$<|@G9X63sXVi?92YT?jC zw!J2K-6UuFqLooGjE-Su46|Yw!~SHS62sUSK8s;o4C7;%#P-jb6v3M(6JnT{@bC9p znasWLu1<|%S`5<@SE;%gtVvMW*)hx^XSU2u_{@vp3)cUWxA`$FNF;M%qWEIAEJ6)}7j!`>M7#qf0uD`VIe!}b{c-XB)6+Yd3Uj$sY!O);!xVfXc~k6|6_ zZ<*9iinf6!d0#&r-^H*op=aKd-?I;8X)_D*B)uhut$gaW|3}ul5}rF)>|~PvZWenI zSE;)FF&v2DByHe4QU|$%M`Jj|;xLmUA4w$SC$B8qkF$}kp5Rl8cABqVh~XmL1!DLm zhBJu>=lIfD+M|xkU%8;jgx_K~?}g&NPzz6%(5O?F5-t2ahRX?k#fy*;*JAjScD6W* z#OYriaD(>7IMT;)GlsunxF5rV7;Ysd-fcSNn0MH6Hxca~pHkx=#_%YHS24Vf;c*Oq zv%~Wko+Lb#C)$uB{=fTV?l|(W{ViuEZye)Jsrll_A4h>W3i2gtVWEVeHdA-VQZ$ZYaRlN} z;wT=c9~5x=Qkq#Zj#4bh@;Zks%}u3(W#TByRhQ$de%4+z5r>Q;7)K}$H4cp(oH%su zk;SLvX>fN;KBa&*3u+8iLh|emb zavW9SxDdz1xchyZRpV$HN3%Gp#Zf(u8f>f`M;#V5neQ@d#ql1C0wvuax2ns!A+sKn zjP>Jaz}oX9OCvsQ97mIcPpG8UJdPG|Y>Z=594+H$7019h2F1}jj`!o}8OO(Qd=SUv z>{8h$ zN+Ug%EmkRQTpZ(Be@;yzdnt`Lfi3i_0OUD2j;V1>W6KogvQpY~7DUo?kQ+U+J1dR_ zarYNgXU8#zlF7aP|Css?Xeo;4Yq(@kk{|}e0Fw9Z?rU;q|x2vnGtE;PfcY1neCJTL8 zDBoa44=_zBW~VW(%J9qj_^U$a3Vp2%(*=+}gG~s2y~vp*;0>X(%P>a(ziva}c}1D| zWmq71q0mJ_7Ylt;D23lD!`ns7%f|Q0u%rx2%dm_iK04NATbv=Wwt4hf&*hvQ{3~9D z6=hgihE-))U4{?2Hm)gMBlLqZtP`-d4DSoreyAl&*9+btl-UAvV^L<4@HY$ns3`Ms z8MYMhCuJyT*j9#p&DCdRcyxAbdl`0=MPD%4S%wqM)ou>GWXa*@xyjj67JUweFT&j` z@}CQ3#eMAB+ERiqIYtb71A`5GRfez2P))x#SyjUstxDTi$;Q|ef1UJ;8Zy`~h=|bULB$P~kNU^|dtl?5>TH$?7@

    1~l%WPT9o6L<=36LL6dThb z`jBWljqj(5O51DbprNCNPLl1a@tqqHpQ($6my2c>n&_sXd$E+tH4VB3LpTKi*5d1S zZ4HiwJ2l*;A*CU$p|6H3HMkl)4S5YcSVd}OG-NddMV(X<7I97kyHjx8k`}6`hRZZu zE~UMMQnhO2Wz-b z1KmDE!%z)(YZ#{C9u4w31M#KHZ zwjS2-04qwCJ)&U`X*gfneMG~f!so{qXf2gIu3?;p#k54j6B?eB(#aa0VgQtjLXH+b zt>GCB&uVy1!vqZzH9Rk3FK8GqfK5=6v|!bX8YT(nB?(9}3j!|-liwAk@DvSGHB8g+ ziiSBF=4yCV!)u&<8eZ2hT_hQ4GdQCUM0V19SC5a+((s0c*`k)~TfI>+YUW3K=`Q+b zo`(4v7HU`|)#-!<(li%#wpcKu5Xo<8cw58g8un>;N5i`sKGd*D!+RQ*Xjq|PrG}qT zvQ)!z0n4OC1|FGA1gkWx*6@Lbb<)-v4Qn;LFCO5Ryf|dEmNv89^&&v9K>!W@`QG?O zq13Zk!$%r+vKJaY*04pxHm+A1KGE>0hONcAG@gk{nAmGlc8yW7L*^sr!tSE-JwNr=&KMVs6HFea|ak<3vX$}8Lf6M8pq@%Kq z@;acSf{u!MWD=cF&`iqP)>U*=75*7Is_Ce%qlOO3a1t>{Xe3+boMPZ{XwIb01JUfO zt)q_AI=MP>NL@V|L4vb%)YDO4$Jsg>=+TnSiiH_RS1_^ec{Ug7N6zwq`C3-aV;yMzvVPrI43c*vVLy5s{bhHzhw)EIfEjgzOKQ8S>CtcA= zM`s;3=@_V^i;k{3JQfigi@wU&O-FYfWg=|oFa>BjbOE%7W>|t#LTw$6bfjQ8ZABvh_4;?)j5^G`vUW%0@n&1Ae8oSsbt+7^k{b9D6P{ibR(A? zevj{F9k=LsTE{awZq+eJ#|Rzw=(tTs(7$A`jv+d3*KvoAJ4GQ?-6ep-K}_R^N_Loz zMPIbIyVxj;hD%!nH27W}BXvBe;~^cRL}s*(F*@!OOc_qq`(>2b{Ri~umxyu54$^*> zKCEM`j>mO8qT^8=k4Y^`vLpOaqrf;FPw043$5RrAg}Pi(={HUdD&cexM;~gDuim#~fEwPrP@UD*cbS%@cT$)~@W2yMRU=O>`QCJ}k zU-^IRq-~sx?CcsH8->4?aU$RYq3eaN6Uy+WA2u+CtCtjh8a~vqNylc6$d33&;varM z`Rd^@3VfpDQyt&xI4EXp)v;H{=Q_6O*e*8j(6LL$ZXG*CITdp4+C!#Fex{?nj>7QK zZ!~_N$b2RA3r;H?UkX0(fBHBLk(a&}K0Ead7q?N-dib4i*hfzJ?*;#$<44AcU{0k& z#SuTE<0$_*8>nUAn3SH<@wYT_oXee#Uv&Jc<2N0@>-a+^>0$KwBo zXf*>zWEPN9!-!U)GmPjL{7fTSj+km2sAHh16xB7*tU{upC^^eOJp=UxH!yIHfwKiu z50#uts}97@GjP6WBa=hJk6cqBXTb#q8d1N2i=;|p0~Z^(#E5=98EFgycKOVa(Ko)E z7`RkqsEtK*Q8UT%=d8Jb7Dn`H@s`pAzvf9CGf-lnw-If�?}2Xa;lxNdu(@IvD6E zMan=s0TgRvM2k;bBl-|uFJYv@!O}x zGOg514qq$9Z-Y_^UsS?t$v3$8i~dCh=CIu{v3UmO8<;ChW+_R!K#CT!zpWIrOl*Cz zFp1w3z}fVUfp-OOH1M8*B?i_QSj%Z;V3~ncQncK_3Ii(zUpO~5tyT1Q@yp+0?}+Br z!Y_S3YT|vt>lm>HJ`hYMzcsU=h(DGpd}-&01~!Son+om7ymx0{|E-}&A#2y2m88~I& zZv%S`e9m>)z;Ofn418hWI|JVv*w2Y$M4u9PxuUwhwK`znYXjeK7s$XrOJYo;TB~mb zA7n3DtMRSX{MPFA%Ib^O>O^bxgMpi3>L&v=W9ml(jbrMNfo?I?Bc?{h)M2irT*Nr{ zt3=u7Vro`Q{cPYDh5^@~615_xe&tM$sdGxyj+pw*z~NW~P8w)lS^aL{4=xcU>Q9DZ ziTaDvvqTLmQDZA9GXLSSZ=jlq>L$)w8ar*Ef{BVI{xhO%ITPj0s9!LlRaDa|sM;0P z)K#UGOw24%_2Q~oTvawv#Y9yT%SzO?5_MYWp%PWY#2F^)nW)dYadoDNS|)0n=o42p zP23(=WR8uiIwnrW)mbL$n*8RqdM~c_##Oz9YQe{sO*AlZfr&;Y&M{GzQ0JLA-^Aq! zb*_m))zobXwWOMAX!5J0YEwczl2FqUiu?#zlsELV7iD`z3rY4%1 z=w_n3iRLC+m`Iu^HPO=K$23*jq-ssKBvmVupQ=>k#7vZ!h?^KuRRya{6DGg0s0Jj} z2&Sq^nP_98GfR`It;rAksrDv1nEV!`YG?BMdg^dx)zL&J>E>=x$o{So(8WYolV6=v z$0boi8J$M`CIS<>3B!bAA|=XAF~H(5m8$bg6&tdJLqIdqCOo!Vs$8K|xVox(zltI! zV(4vqJ`Yz zy23;X(Xnb&rA(>bN)0e^orxQyo3|?U zpifK(rC4i&Qn#D9!^EAeYl2nCKcFJY zqQNF=woxtHs6Qlow~1jU9y0N;iQ#k+1G23eW8xkTdK)#;#3++rF;Mq18r!IGZPctb z>OPaNc~_&wuyt+J@ivO)-EZOnMnxO-pvhOVD^@8KJ!0Zf6OWr1XW}siNn15msZg0IM$% zy2`|A6HALS%LFVJx2YCJr-JE&RJOcErR{6aSd_*TgY~ zpNSJ(Firey;ujOYa;4&YX{#n3iCwxn{$yKqY*l=ITg621yNN$c{AuDZ6WdnBN3V`o zUmd69=C+EGr%e3KMP_yUyS99>v$~+2>d;P|Hc`PsMGOC#C};7F!K%DaSQy++J=;!^ zv#_12WTCQ!surqAX%&kvvsE?Qt54dgpGB;?@M~Cnd1h3F)M>BIv{2JREeo|R)U|My zg>m=9I#!8j9V@yl`ZIa+}3w3AEZk_}Cc$@iP~$tOMI96YifXuvqv2j_4gvv!Y~W>lTJtsw=lxOC=2&lxW~f1 z!W?NuHw#$$(B2lLOy87mIoiS)DJ5l=%=7w}6iOcu{)1L@Swzkww827a8!;P?Sr|*7 zTlm?+;|y#DjD=PF|IcBvFyF!g3r|^i+QM`zx=e02A^wa7b3uF}=ZtZ1i~*R#AP;uS8hI(fPM3Wq}_hjfhg zqh7NxCl+0#@ak`dsGVuybpf+jWMQs_H!RE+wUp;YA2slTk$9ekg{`6;KVEz>yO2?5 z;aw}*%~)h%G2O^8>tFJgg|`I|vpOlS?;f35@}7ky($Ldl$x;i;7*5~BmRtM~Km?em zoRkWwf3?LgpM^f~mg-whr!EBVR(+{+k zYUz`YEo`x(t%JfIMWL-vMG3DQXNy%kEbO%KooLu)MVI7X2;NQK)=2KL@R^0ZR&*oj za|`>}qZWz^dCkHViC3V^?zixzR5@VbYX*;nuOwS&^jmT4!T-Z4@V^(%5Bv!baLB?D z3rG1Yz-cu+c38~j;RL#c!_8YQ$HX>vjotjk!mnHzY@BW5Hw!1YCflfH#M#7YQC{B0e^NwFIj$kRTe?058x;gsv{A`MWjhML zLXb4!Mu8pe81NdLJ|VNZje0g-mK~uQHqNkdrqr!zqn3@@HW-auTI<+&g!g}KoMlIM zqd5BXC!I;n3_LFQCpxMIHqNop)J8KK=ZcaGgq|n#eEWa#(@+3)HWL1YHZHRHUN2l? z<5J;pDmAvzq=?xmPBAi>h?@()Fe0?Sg^iXru3iyiY9)ZSmDq^exXZ?18wndp8=Y-* zk&2}@+Sq6-SlQ?`;eYoL+6kwV(DpVu2w-y^?Pzz1F+)7@zeHCX-K40ujqWze1ZQk$ z0xY4rP{WS)eoeuw%eidZaBQS(q;0r1JoZucvZ$Y9!7WGMMqo$V+Vm=&%wJXRXk|r1 zXd`DMZ=;8dW-l8(IgacjZ+Y-0<`2=1H#^Q+Y>U+|r<0}P6+*AK(UU{EjB)}akq_OHfGzHV`I3D5jGyO z@vt4uf^+!y?%Vz1?FVc;$bOBFVw+*fxxl(yU>~vZ zsEtWBUgG+1W2}v*Z9HS+aXY$8_@s@eY;aR+oQ)^w)ftiHwK}O#CdDYZsrRgn=WI-{ zG112JHeRqX-Uhdq>2vm%eW$NDSo~kax-W_`w1Fc?2fl1$vW*!w>VFoSVq>a}S2?Y0 zOk;mz(Zqa3`a&hF%fRLj!E{cynkBr4OXXbmX4-h&#wS*yz(R(ujdyLlXJfIAH*LIS<83J&&dqAMh05W6$ByoPvR#f2jag!2sg30} zR!9f=3$@ISZmBau=pweu^_g^~9aSM%ZDWm%wKm?j@u7`P95oy3q?HYJ^kYOBs$I{{ zR*yQkQHrRFnm2P|^3JbtKC&agQKK-$DEuk=YvZ7e?`&+dvE9agJNg^Lw8O?88=pyb zXMt&Bw*(PoCz{b}C=y{Iaw}SbT!EpUv zFf|{x@q>*YC3}b~CvSvpP5dNTc89a?NKx{rjbnmo4CCY%8^1EnhsJ6<_|3)%F0)RQ z?X)g&(#AhrRBilj;}09;{3-O5(7%KZYgj`5--6j9(`hd94k|kM&qg^1<(>a|1_CJD zxRYx7X{?fi$_}bIsP3SO6jc?hNd3wqzs4e3R9-T7js2f$3eIjE~0TGoP_C!BtEGhsN5f5bu2^dzCCzE0k(~15E-s9k2hGn&A zN>=ZxMha$jl!N<&O_}0b!E*^C7kb|CST$aYe96=6r3OA+jDEsK(goBd~ z#yWW1!G{huIT**`cCf_3QU^~uc*?;W4rV)e+QBn)tb@r8p5-Jemw4X63l5%h@b!T> zzu?1ZjKW|F> ziUZPDIaPZmUlZJEacqWU$@#)fzFw4^sZ#OEBHU9qhWb~xDSV4E1g?rfK? zwLUAcOI)$r!5#s0AU*S$gT2Kpy+k*Xav$LLrpf&dzT|kVO?>abKP$mKx&scrazIc1 zRhsykb9`Rn8=>C{W%i(h?>Otn#)w&QRO8Yg9Q^3ukOShM92|3S+`(bV9ua!f!JGHS zSo-4D#LvPZ{!PFyLVx9ObX8ftFLjBpX zffbVU(mxyvcJPxV>z?NNU({bNh05iV1|PsJLha6t-w3PB2uQn)b1cWa|f3Kykt zaSHqxRxE`}QfQn)%M{XgC7PsgX$nnKXqEy;kaL8I!`eKB7Q*3J7Y3J1f>tRU-k)eK zb^Dx(QA2K3X-NvC@e~pQl0wNT6~hS5n4M^wLVR|tdkXDRXrDp{(bJJlq;T-h1a($B z8ta?_X*Z!==qNYYHHGpk;$#w#mZk9K$+(t+o`TU$8DfSh_{6XTjj>X&h3N<-CshC` zxJ8ba!mP8CEShL0Gbx0$R)!{wi;G+R zQjTfISc0IpWG@%mCxyGqMa(Nx(Q?FeJ%>i{)hYB#p}*h(Liw$zYXn?NZ#)nQUzY-z z1X`7n8>EQ;X*m}Lrf_o#CsX)6g*gj#rZ6gnyEw$tQdrB``d5N!T?+3P@dpC9N-(XL<|yzXom`sW zQoKEdO@cQICG(>cJ{G*C$oV9NPX%ukx=rY1v1ng+2mN_tVrLXxNv2(rCI7P&_HuS} z=@Ykqp29b>cI}hw7ee=^@MQ`I1b;2`tN$~I94rp&w^EA>-N6*T6a0OV!)0)FH+3i# zeFOby3O|YS52yHSb>#LVk|j8n!f}!LIfdT@{34XKeocX2@+Dw8Axv`q;Ns84FpW#n z_=}4_*O@fxrSW$P|8V%6M3prD4luzTUZi+<}BwJA^vy}u? z7P|XXtZEw7($Q*DJ&l?Ih-(NqL+F`8Io)ars4cXP(7HnDC041Q#@XrU{o8+jo9I0u z(IAZr(tI#k5ucOBx#{R5bms{@UnsK;(_Hf-Vg3R(O5?(G^qb3n_!p&dxBSR9PNPX0 zZPRF%#-(XYKQq}hjb`cSyX0Q2lICgfeeaB@csg2ATBOlZKr5lGg~rn0u$J)e-{ClA z*o#COPw!78g%XqsP-(OgYssmzJKjEx4r$nFIB9fDN2^x%G|B{Y652V9E&^E8HH}9a zB)Tzs8-qEarJ>W*(J_AD(n$036QveaO^TU%#+7MYmByWE+?B@FY4l6u<}_|eqklTu5FU`mb!l89nAvLua1Y`7 zG;R<)FpV3Fr8lwGbBTEmM|*%2PPdLU+*&NXUBI9;ZWD0dxe4y5P~Z;6gGdq&PGeXa z!_yd2tTj}?-DwyDBVncyX^c!`R2ugbW$xv0bdNTxneG$j7@?zu@}A560{V%}Lmd4y zp5j0Y^N}hVJe$VLX-rPzxip?1c_8(ta|Tj3Vp zjx=_ru`7+;oMIxdr&#y1baZx_N|?Cc__^?TM}yh@X?)2zba9>wzS;Ny$6|e~x{I&4 zVx;j+8sDbzC+Alh2h;d2jpJ$joW@I&W8bIoV;YCj_<<2MFP_*LYg4cEr!)?yag@P) zAa;boR$f&vQ#0$79PX|v+#UOQRqPmNTzSRnzi@7T5kJAncq0C*DEuvr^B#!3aZmEn zGIf&6h!p*i#~tFCTs{SFHR1s}eg;o=~tW2?}hKn=YXuE@3UZiKb zsOe(=TXCjZ0&2UcBcN`Pf0m1Sg6kJKXA5W`^c)utFN~^3J76v@anaa~?mILTdVz~Z zv`z3uLN9jFM7D7#L(s&ywdwCZ48a z>f!P`FSyL*qfb#OWqKk4f1WD2+(jQ3x4IbQ;tCgiU0mnldKXu^xXML;7uUF;*wxZX zKhaMmJYmS$ajlDIdMBuSfbfZ_lm5BE#f`Mq#mz2g*iDSFijf#g32rI&lv{rVV{UVC zyNi2V-0R{F7k5&?#ZVV_iR55b9}}Z6+ok2ice@zoVz`SDE?&~qqsL=Mmqn^L&1Y>) zzN0D9kuF9__0ev04)#75g?5Rlht8z@1Kj*^@k9nsX7CWh&&Aaq`gwT7#iK61cku%w z&Ba(3b6m`I@wkg|E~dDc%33a-WXS2Nv#y?U`3RC?ddbDp^ofgSg)_d$e@?*jLSJzC z=nx;uU`6!?eW|)W)jSvT={;^@xLDv~Asce>sf$G} z7Q0yCVx=3MCw$Yz+b-U5@s^8Ix?k8n7vJ&)l@Y-o?BB(O+{K;_+-}c@R_N8Gu2rh>UpT|;cO3=cxddQfroRb&BFyA zT3hN|4@dpPc^-P-kbJUMg7|z7TI~ol@^GPtF*6bs4kv6&ovvH5Yi8mi4;OnNV5;?c zqKSt~smH_j*C&ULOEmS+%tLdJr&*%!-L#PE{Psht%nW*+Hs-yJK0|7^sS}D9X$|GhP2v< zSZ5DiJaqLy+|7%QxNCyDlV3xX3FeO%lkUOrU<$_)>UppQI6_lGsV6PK^>{WzG0Wr& zC-9IFkS$7vUUblx0zEwR^nj6xjuR4>dFVwCd$^pwt*ACy(a~bkJ|3>{aFvHo_s05q zxYEP0ql!wt$t02Q#_jw3< zwj$tdP*UDeC4E3-2q^Y2N7KU-9-j1g3<-~U7$>D;X@)#d^SBp1FUA{r54;vV1i?mm zz~(6rPtz?Po)zIMO8EKgNb_?XQ{Mme@B;ncGP>u>`@v?PoB(U*Z3fq7rl0};8HfU(8D4ROFb-Oba{Bw!`mL-k?J`O zZwV-P@?BPx>=I7QqW}MY69mgWtn{$T!;1e?Yqf_p9@cs&C(fa&g0=!>t#u;&k%#pj zHh9=5gS)Ay;lpBEyw2JzF5-0}4<>y~g>oe6Qx97`oaPGVVVl(Y+QT=TsvdTD*y*8F z$HZO_pL5ahu$z%-Mfa)qaDnoo;hX<82gzP1UOL2|053XkKy8I%14lg^^YABEswgP1gi{pLl-40vCdmxL!goTR+GyyABOTc(#(mxsUp@^H$--=g6k5C00_ z0P#jP4+&5Y4_cJ-QQpVdel&3KqX0P5k7BigkBUAj`Kaupnvd!}s`$}?6Gn1XKYCP( zVgLU}isuSy_&7t9ux?=}Yx=0=qqdJaqOiV?x<1bGqXQ)ML<8-o$Jmi4?xVSn7CuhJ(Aq~!AFcf8zzj#3nmG|@Ih{ji##lNsPMn~@K1zL_jEM$| zQ9(yBweh1z5&4ka`!bZQ*vYMHxbZ$eo!9W z$?RWJCLFFm3_`<)=||6Kr+ri{iN?b6VT*v{BPD=OY0)+sKKxdzJ7Edjir73=!{AsIN4=#uJmyg zOUFm2a~bOF_2(56Z1)-;*ZO$O$5ppzUX6;k8gb(^zjnA=Ho3NZ;RMuAFuhC?qiCN zsbT{UI8Box)_sLuis4lmYql~&_%nUH?&F$c(V|3Q(pf&<@G+aE8)EZ)EbuXharj~B zT%iQ>1kgVVMZ+Q=i~ZRGi|{}BKN`0A*e=<>=I1PyM64DS51sYeXT<(=~L+Z$3`=IO*ee z&c_w8zkK{5@+|t3Va(TY$Wcd;Bln+oTK;+A$ z!mJbEtN`@{*A4#nKY^-vf~$Ujvx8_BGonao1Bc^Wk>t6r^MdH7lQW$Q(FFk-1!x(d zRiU8(mj-AW;GzH*2e>3a;{Z*hh*O@!M}<_yUm5CbCj90?3ok=0<;fM z5+EL+G=K__2#}O2G@~HN{xam+2(xVvt&m*1IL+w_`k{mHI|b+*pkoldg{Dx825{Nw z5}<2<@n=LK&4rFdWdXDR*9W*EfF8gIkO`0tU`qq90sVNe6HQr-a@i&n&wX zmMQ5`UaC-%heFwL9?c4ALx9UUUIFq_+FNLk06p1R9hY&Si*NksRcwf}iFL0C&^JJT z{;?0De;rp!#j65PjESvW9iX283Nw3cfB}-dPALB&7sRNar8fq+DZrQj_Xijl;N}4L ziWs|g3j-;@-~hJ<7!=^PBL9v6w--%1u_S({@Cm4mI)?-p5#SzS4h?X(fMG(13#Ay% zqa@8>E1Zub1B?oApOo^~ykOpF2{1<20|6ckqH~o5lxL?N3h;2TkB<~}J}Q8k9}h4t zz?%WyV(?T+oU+st0iF!-RDh=gycS@3fM)_c8{j2|cYs56lFtQrfdLTUdB(i0N^MoP zDLEm)L{_xbB$0Vhif)sloUP{BYJ;sN2bdDz6$Xi;zO&U-_RCSz049c#B_{nawfXLdOX0-BJfLq-vj(1_}2ix6>FUkaFSzv zc9IqUl5AP%ne}8JwNL#lmkO^a7#h z2t8LQn?5gt^NYA)1{`!U8x=VhW^j>Uzi-69B!k8oG%1$0$ly}JO@%fq@|z3b0UlOq znL#Vbwl0>>?1)7BMA+*+FPBgHi!XXd9tzg|-t)`Sux{dMv8jF@sJSbQZprfi9p+ z23-Yo6WU!Uh08M7{KEf6#1LkxP?Uisz%EKUnds;Rt1zX7>1N;+OZ`mrl0z0{GYB)d zB7?pe(5j{t_&l^I->!5t!b zbq4*Uxm$(y&)_Bj*9g5fg8>4r6MDT+9znc801dm5!LTc`aA1*ha|X8v{&ITMsX>Bo zE0*4#!HA=g{GA!xmBC=)kI3L20YfqvD&TIR!-P_JIAhF>{CRH%BQv1HnII8D1|) zGx#Qhy%~I-!Tt=s%wS&z<=CTD+2NlNarPZ5hHKtec+YAn7 z@IwYa3jaHy-_w(6^^sJk7@3qO=MZP8@DFEjB!ir1cfSpXYh~Ue?a#`Lui#~%=FN^Y7 zAd3oFRLr7!7B#Y{lttxibV*Vzi#A^;UvL#)+)*V9(yCeBMYqVS#%Zf!tfZG-Loi@tR~dSLKk2Z=)kxsz{Jo$sQ)56t4`EN&_C?-Fop7K4hM+p@U5 zi0=?^r%<|daFIVGi=l$=7JB8p$lD`|rT1oWPZ9ILEsI8GF{;S9FN@JdJSL0#1wSD4 z!6N^mEFKp8h|nYAgt1xh2J{&@oSDPpS&Yl#i7cMX;@J?-g?K89r?Y4sA{OEqGC7Gt zRAEsT&u8&*7F)7-A&c=@yqm>)Sxm@cVis>?F*}PFvzU~{D_OkCuy3JW%3?|uQ?qzE zi^-T-<_w`Tv(XMe1(=%ENpMecRyNwf18#TwBrYeDnkEZ)rGtt{To;+bk$Si@ z(96I(oQd+(;gT$tX0a}dzt_i>aRKqvYOX5ZB$sEgLhM;7`d4M6i+XOC@uG~sFKe<` zE2Zye@j*7ap5^ssvk(c@V>E0|3Wbsutdd(UI*fcNvzs}+t(erIK+V`VdSagvWZPKzA{0aU( zi=Q|US^SXYq57!eAr7l_fj#Br_K_@(X7O_tzhrSt1h_GBoX+I#@$l%;Gj3?GYjKHM|ul)2g-*)7@5b^)l+;RnoTefUG2D`9wZm%`M6~G1LoDKg8J~8iZJWBHk#(IUzc4 zi=7+dyfE5eCuXhlLo^I=K^VO$f=n9BeKrP9v@axTFAi}@h~^<$glHT_0eq=YUcxsC zqdN{%(lkV~5U<}KIgN>+rC6T!qRz6kRR~h@OG3m$+#KST5D8Wf(IrGzQBKLy5UN2YykNX-eKNMm9uqhcPY!FDR6y=8$#SvFqN*WTXG{uoO=${qqrR?L(C>PrniO|6k@bU z-X_ju^&uf{7tS4Fw26IZh`S^PsDCh5S3g=G*i-gsXo$N*3=`quA?^(^GQ@}w_lRK( zc*YE;_9$xLizw-QxzR&!usRzW6XO054}{T9@8coHg?KQ;Lm?gx@rdXg8{*M0dR-)A z>9L}DTzTjjE(lEmJQ3na;Xf5dThKI#iQs9e{tRPJc49g7&$A1hk0JgIF+RkE5Nkuc zA7WyN7de6>$Ju?gNXep^EB9pSty0ncFL{y8O=az=+(5n>sq{MH0prylZYA?eBxt3s@1 zcua|{5#tF8*$-%Nh!aw4eTWSq_J#ODn%Ed(Q;5wBFdZKX<$E9UPqyTS9yy z+O~!GRH|$ZqgyaskZCXh!*Y8V-N-A9`>qhXMeMT>dqk2;6WvuP-5cWbFxr=9m@&4= z+#ll05C=ni7veyOuQ+P|CBBtjQ2*BgzA0we9Wp8KeTW~}Xo$m<@#24hyIEN;}X(aT*94-=YvCvC|7KAU& zp{Zo!LYw8#N&xjV7tkVymPJnC1y-#k8xvY0l<$e6d?JTr4y8G$qI}yN+7vPCwi8@X z(y_=d6VOR$XQ5qk=vpl8mP2>Jg<5Py%Rw)e8abGPts=+Hp(5j{r8>SHP7*uPT;aEudfSfA9Xf zCWmWb(IETV04;9YcLWdPg>C!=s6ZhnBFJm~7eCU_t{gq1j35=1s=tCHza=1?b@#q}J z6!HDJ=yMxnK9s}5IjpE&VP*9SkL2)Z4)ssq>=Sq_hp{=F{tbK?+T%HlW15O5m~wbB zhy5e)8ltc48TIBIk4ln1hIfsvOn4H6u9G2#=jLLf_r{?fR4zqKZmcuJKyhUhVWr5k$|ye)SjA;$XX$FGxJGb4Uwyz%`D(q;bsP?9h%Igq4vRJl z_)zF3p{soLaSmH@D3?e1JU+?c(;U9a;p-f>=CCb?eL3FxSKArtgOYo4_$-GVba)QC zgtMEg*_uS3I}$8q+V3m&f<9rF_i_m4B|jH>|MAivoi$5`lkm_&bNs=Ov#G)O&&Y z?1|*AKtN5woU<-so^)y<=F9#!(7%o%x9&EwhA zrB5F#t&!)xx~i7P=@*jKg?7)VD>90Wo|#8Yk*}3UZBa7tSe&Y;p-vv_R>qjUFQd-N zM*&tZkNWv2_Fl|Hk#ojN{8d^JtUD#uG{6rfm{+zD~Bw^YiYBbkkCP z2B_k)M8`b3<!16 zXw5{gJbLHx;8#he%k$_{#1}VBUYW;LdGyQUmf;Cj{AhII!Bg?8^SH2U1o(pD{$d-! zfIP0t4tBhNg9FoWA%88-ks0+F$i2G&LW6vgrGgc?Y?#<&Z zt#m{l2YV)%?h!zb{kSwSlEZXaf*MBWF(!}MdCZ|(@^~PR33*Ipm-BcikEio^CXa{n zc!a~9#}j!>UK8unHSuU3k5PVmVk`%RJsq2T&`VsrCq{5@mfJPz$vmFQb8$|LTA7%1 zAkleb^8MXOy5-qCp6Ae{N}r?Udy^N|N|JIcUdZF}o{8~!@VN}?c`=Vkc}&aW6|VpE z#^Z^}c}&UUW%_e>g04GzLyWO8^kjT0XU(u^q&Q4p)+*u1zM98toFl&^rspwJ{4gUA zHa&KDBE3EFx^U>6Sv0SRIRta_n3u<@JXYs1KaT~Rxp^$lgR!wNkGJ!9CyzyWEY9Oi zNpFeIX+!;;$t77uKr`ND6b;ShKNBk$D$?c8*T+`ov0`uX z*qe#(x+K=*u{Mtn^Vr1hh*d}4jIGb(1L@tm|HssqfZtHQVRIuPT9KqhL}{Fv^GaHf zB5A{K=FE2HoH=KXec$(eOABQwON%UpQVK~?A=)HKLP#kplr~Ed-#w52@B6;%daviY z-{*ba?b&9|Iq%G&#VvhXW1aM?*6Kq>9M#fVU4103ek%U_c@ef0VN(%SozOlj!sa6E z*sA~0TG8h(YNM#AFPK1hJzb=?DsOCMqPX55VBBqE)VERhwozZROA#J1@u-QNMZ5uk zW}?1{Z;G(H2*-9I2)`8J5I1sMKf)MkqYg9Y?9ryZlE{@bn%tn1|EskACiG|# zei!iKTN<1GD#F>a_5Uuyu_6q+SO4ltwKp){>~Gw0(3sF7d9n!q6yahMmzems2&b6I zO_VWlng(Ss_BKkIII*PunIe=hv7n7QKGQhMJnw^8Ji!o<66R4EggBS{LJcwalu zj61TFGtp*yqAW*vUpwE#(A9}8zb4C@s9@p(6NS|YmJ0<`G*QV!wnBY!`rm1gUL^c| zZPcYEE;CWr#0@4Yo2X*qY7^I(sA}SJ6V**zX`-4LFNy29f-7&MxGENMSZbL3sIIOu zaYftz@d>UqQPafrCU%|Dt}{_fdes(5az-9Wa*#%CRcq-|$3zzaH=1a-Qu}+oamU_d zJrif1Fm5t2wynBqZ*pE+l`x@m&6F`=m`IvFdrbPaYVk*sw3UhbOw9RAo3hRLZcE~R6D$NQ)Anf( znP@&pGfh|~TGM1);r`^YBE{CWCN4BpkqI2rZZK6Uo?WF)1SV_~jtSR9WGWUJW3r*x`TobEJ#j?v(c@tY+NJO$zf_&PhMO2e`8k+8c~bzT?|gT=@!mMM}M8;!P6=_9s|YQj@8;iR)igyd#db+QbJYHkepr;*(#r zcTKz}v%F7-F|kf2ZRo_4Qg}UmTL3v5O?+tLOB35nd}QKdx|xYXj$+t;Vq%kt&txN? z3N15NGaa>=s&>@p^z%(xUq>w?$5CHU`Af7iuG(tiWC?Yht4O~RyvxLP6JIm>L}sT@ zwo;f~n(M|l!r3j9RW^NVVjm;OLMaR1nfTtspCxq#Lof_ zm^jEVcNI(4RlgKl@NQ5o%bI<2ez5KOPAdr14+L`6@X z;1&cNW5P7SRL1m0gU;Hf{UbU#!>fRaQ#9Z2`e_sY@merfqY3JHu?)?0)fEL62{xrJ&L zuHamov~Cr24oFbjS9kg`sA1tM3)fkwW#MWISzitF)itsbF8*2zTuDs}WD=0pws5_L zx>g)qbgDWQ_Uul+I#;JNv&scf^Ytv;WZ|h4o=!otP~XBg7Is@mSkNtuwJ^?tVIgTD zZ6V-;vKAUxXkp+Kfqu+YfDtrnJ-P2MK-kNb^hd_~&W zLK6#jS-9JRQ$lYlVs~0#6NOotiTpbv%)ZS<{y;q4;2s2Vb4v`)>;JGJ@zR}o?PUo97IJ!6=xL$9g#i|NS?Fz{ zkH!1ISfwo76lp&J=Qc>)e&wq^&Gc{k>6~|XDmEx;Smdu zT9{&Cs&stJ!s8Yuam-5kj?0ZXiR5IN<-mf(6BI}!pA=eRaNIP_!gLEW>A+jHZWFbq zsKbfc41NnFVA$zI^=e6SSe+%y;~=xCRlcrG)1R~OyoHst;3{p7g%>O=w6Ms+T#IkQ z)aO~4Ukv{2t&_9B!i!Yq5RKKBq=}gP#TH(+@VbRJEWBc2$wKWl3rp$M8?_}CsDW2S zn0(5U$#Qy#u}qjN81e#^3$3tAk8Fdjao>en*|UkaWFyBX=nyx0uDJUx?L7;0+V?4Q#^9vuEo`i1d`RCD@PUO50ydtbwTuC06J!opSypVK|oChuCG*dnn>fhwysI{)``6JJ``!B|+RZDZ1-gPl!m zrxVUid~M;{g*vNi-_b~q`f8_zT~g>gbhAAc_Hwio9!lX`3;Qfwl)}X+e8=t<{-yI< z*l*zn3x8Vpi=JTN0F&Dg<5vp@E&OERuv8n~mgMX|Tlj_kd9A@JHFk&z_H2TxKEhO% zRs?MN&B9R&ze_Kg><{L>69)OD)6XVuNUOiaUjJAiJ|^_Ig%bi!3MGGe2SXbYYwWaz z|Cqf~D3`+cYQ`B0B~v(ge)24BaY!epL<(FCeG(~r^pnO?DuvR5%cO9g00tLJ*%S`G zk)S~N6e^@}VG48rM*Rh;IQA>0P*DJJ%e2})HKuD4Nm}8O6fRBSW=@pCWhqon#m~`P zlR}jgmJHFZNTIrbswrG9pqfz5#a7zAZd2n*=~6@JRYI>$#eXZnaUPhWU7JG96s}9f zJGvjtw`C_M3_xe7?oCc zN)wrP3G;5D&4soQ%BFh+v`pb%0j-4ISKP_~d>|EH4oYv;K0BLeokE)wI;YSjg|^g2 z3fUCG6wDN?6ucDt6b3EPQz^KzQ(LNZEhmMu3ldC{OvTh>nkK%uevm>&R>;U=fb?G# zztof&X~-HqmqH;0cFfZgQuun4_C*7I)2@zy)+op<4=r zQy7xMYiEq^oF#>RDfCFiIjv_3y;5<`@6Bzdz*Nt8WVR=Vn2YJ3!hjT*Bzc9R_YR~x zt;eF{@jc$6NP!WE_U$7Rw@lPsNwiK^9ifqrTAI6uOf6#K3f~lSb`uC@ilD$gCjS(Ur0{DB z-!m0V)PAHvQ`n!vG=^B(N~t%|sejq_|=WaDBRW$oA^=i4Y}U(}Ogr=| zUQ8<$k8q)lbE9!n9RCsXEHg2_X8`ZTjzGg8N9)8had=cL+%sYfOw$Y?mhOySn#$7ge5upP!H{NaI zK^qU*XiohP)mjK8xJN)sq4x@HW#c{p_Y0-W19p7jBba$QvD`LV+i`S1eXrie25DQi za#jrKM=u-EBCCmWsZIK6bV<2#V4Ym>acVh&+pGU-O2vC+py zUm9_JqK6&dJMmtcxTlR?!X)l(m#)+E{2~k&QuIzm3T@p0F{* z#!wrhZH(aps9qZ*Z18JRer0;aK;wZe#?IdQNa2hU%7f@^<+rS3ZA`H7u#Isx{|wjQ zx3c4Hgv<3e&L$?(Nm9n6)XWLv5yneevCAL78;{vw$H#?Evg5CIS#?_KPuiGb;~5*z z+L%fOB00mxOdHeq6R-$BWn+C>J#C}s+yuMuE8IcdjK6nlvur%FF#cY5Hl22a!P4}& z_MDC9ZOpYXkGfi@aSd~9a2GGwsJ>cb;UM#EEZ_ocyu|T^&lTQ#ODr&Gm`*;&S#0BF z8=Gx>ZsQdjOPE(}d}3q!Z0%JWZ`oKyo7yP!&; z$43)y+t`yF8K zjUQ;2Ks^~Kj{NQb{YM)IY#g-llZ{_&9J28<6)OUyEEk zsEv0#toHD`jX!MM?V`DhKW+SFV}^s74*s@r%tk8*_c=Ij;{?-`gPIOb+WgiIWgVRF zfPWA9uZ>a;)=$xhPcf!!{KxFgw0u}AAp!(v$$T+EQ1TqdLHC9RtG6H4N=x4|LeFzB zZHvaC{G*9-4$3>Y#KENwDs0m#IH=^{LI)Q(__S*BK%goLpZFpNf1XUTT$53hyx2jh zj2eDOyUfA!)3gSa>R;ucvfwI0s|vkbCAh%_d;b8GptszIwsH6kspn-5$y;+z96nNs(#4QdQIUu-ID8UaeChp+!96Xg# zcROg};MRYVO&#>ksG^MGd+F~K%xW_McZt$iU7AtN9b9#h(Zaz!4nD~!mX-qUb?}2! z?|1NkgFX)WI(X2*Lk`jo0tc-fwBgnqT$xpE9W*?eFrE0Ybddw<|C}K>^?zcQlmpv= zBUW>Tdeqy_BrWJmm6+zsILJEa=%AB>kYi?5&ViX#B~B$iKdj{)L=FlL4t%SzbP&+a zLD#HmFSx{xBnyY??4XN-o(_6BSaC?}N|$r6Z;Cefu-45%m4A}srfH95RSyTvcO+lR z#*5@GdOM&Oozr$d2mKw4axmJ#00#pd3={7i@qXjBzlQCUbamh;a_aJD4PXGQmOBP}P{KO>{tuJj|uOo=6=? zJmTO{X?n~-i)|W>+qY`+aj`PxIpAcOg5$H-6o!w3>0-O74t9T?Tr@>{%7GCoMg%we zw1X3SV>Ob_;;J0{?%)px&p3G2!6pZvIe3oF@8C@bD;>;n@PdOybV3Jo*SQW}bnp^O zR?QPS-@yU_9GuLB4(<;Xy>$D9Nh*QmWpy@3 z?oI3xqgTGMRB>^=i#jfJEYZhagz%ImKy}z=%Sv0a9hk|(WF{m zXhJA+UDAbeaf^#aE*iMlEU78ZNK^=uq5Ho}8@2IXPTlIFv5O`yh;MUoy8z-l1nkVI zrqterN%}VP-kpM*3B8LK`kbngkK?q3i+f!B;NnLYEnVE};&B&~T(oj=pNsY`I=Hys z#RD#U7ikwQJ~JM4!Seu?i-%macG1R-?@M{hSLEW$<$7C@nYmmy-S|F`g*TQwPLOh8 z(^xxnN2n{*6G|qB4O}c}l+3vpoiZ{mvTSOl^X@csLCRs9EHUyfA{Wa}C)!p{7F--% zuD6rvZW|Vl(2;)SVvvi$E;_sD;-Zg>zAkw4+?B5DqPL4~F1owu!QItJ{&9us>BhI~ zJQvY$puyYSmMNq8a-EdI{oMH8`{@UafiC)U%**rvLJ4@3g8%f#RSj|Z%Ni!Qc-X}- z7sFkQ;iL<-5i~(XW0Wj)q>J0~%FV0Cp412A)o2$p^NL`s8{d$#jB_zwF!#mkL>YnI zA7S^rq5`?RM_rIU=7NJ3Z67js?Ab1~n=fxJ4CS6@um z2skVOs{}7Hj$ABcIG@s9ru->wk>JHbt450aSA@SrCz*7^iyLiLJ$1XnMeqAi5 z>S+B6^;gjDE>^j)BE{1koU37^R=RkL>1d{L?qJE=F5W4wu6D7;#k*3a0H+ub#V0!6 zcd=Gh{zRnKxmfSw(d~&3Tzn{CgV2q1jK?(cA3mjhBphOLK6SB)A>-m}YKHMh4|n<7 zD?WGQvnXG<@zIejg1O*6(q${1;grU{{SGF1Amp`3eMMtMikjTvVyBC5Wk=5*N$zs- zMWpt)_=e^?l4RLk+_cw?kI?Yg3F$r;-_aIr)b}n}_6z3m5*Chsz{NoqZ9Nou_{qi3 z%v~O?^6-m`LtGxSqKm^WjxY)s_2e8${_5g4M*6!3*G#Q)VMks3?t+I{SpJOEUoI{v zsJ~qt<6asXbqngaIL1HB6$N!d2H`j-Ibak!7)SV5T;-I|SAR{OadFl~X%A&Ql<@HB zV_HcM@DLRg&+2g5oR_94<;4z0RiEdftcMC7F7U8prg6T9avrFB2IX;}I$nHCh=+)%iW@!L z^0FPJkR8=(|Kii&Y&h2bZ z+#|Gw2TsRoOAnlpbJ2}iz0bo#9_Y;Xi`WA~$$!v`&u9^}_RvPG#x1iK-Pq)QJxuj5 z%|ptA?eT|ujPT%ia6RNaI5EUCI(Rr)P#uMK63S|44_yRz722(s-`&F{?Gy!iN%!6~ zQ#-{$IMhAuRIZ)s=b^uc!5(J5pk4Q^e%<2404~0r8Ypy-bZ1qjj%8Se(l-_-h6!bL zq=!+m_{Tkr_Ati7cn=dijP)?2of=26(D0wvh-Yx>c53u#?P1!E+U}|oPh_vt+9Mv8 zNz-G(-^PV?)!A{9hshqMhsF~^pY$+=h8V4r!}4iYeY%IIJj`e8czD{w46ek(3*3%} zFJIDTd6>*2|!^<9CVMbb-SmI$%A46}iZW*d) zUP}-!Wn>N2cbr%MwLs^Xugl1+F88oP*7i1Sx6j}rS>E)pQkcYVc__V3Uq!!aA2)Fs zT-zEC?|NA0W4({}JiPCrnUA}CtR>S!c^?(nbp>==$Pg#;of*l@qQozHH9-jF`-{s+35BofP<6*aO_ITJUfUP`4 z%0j^Mormw4f}~2B{UXM5xojfkY3&yVY6ln>Z|l7e=|401dpPakKM#jI9A-Fs_{+l) zI?Rmt05DH<|0O3pUv%5U-T*k+F zKF;@1&PQ24K1<9K$fX-8d2$46ZOJa&GAkN>I|Y`V#Z z=HnJ0jeOMik?^syy}DV%bRP|TjGmy=PYfSPKlUOe^x5``xXSSa4;%BSb3-3I)y$*p zxB9rvM-w04FHAh$SijxJ9X`HnuZ9ngkNr3HK|{0f40)-hdQ%^F`Z%`C;6nkwwpVxi zXzpXAk5N8a__)VM-bdu4rH^}kqAs<{1 zarf;8PjS=L+xTefgU8W}d{{o--C>wQ$vJmSou}4$7@JQYI6hn-9+gnf@O`9Z3p|n? z`0-hEK86tb$Oz5~?NB#KevT_?t-4$j|1avQ0b0RFH@5m{=cB!k4x&cBguJt8yQ7az z#rpqazShMDpMdDY2|t4E8a^$55Xyl-8L6M)*7!7USVQXcPh_3i25pqdA?A`92m< zz{fZrGknaXclns$<4GS=d_3%9qK`?UnMZs)>fKu)QOnNN!*{p-QgD1M{ z8IyfHK_@J!FZXoPa(^YJ`gn@7`{2~md`uU>^u_8M^Yl+2(5cLP2Q|ybY#(cyBwz6P zlQ*9A@tlw6eSF01H_dS7>2&)!)Y~&U)y^0h+CkAqbGg)ITC-ioJRe0P;~;&}2hFj_ z$70SqPk%}1LLW?qtiJ5y6(7rdEcda*j~}~WSt?6^AN%-@4(a0)AD{Zz#Z=&9laJ4QY-N1;*zDtT zI+Bkse9##f9WB-xWm3BFwSIg{tpEFJsBPkJU(;~s@gM3&R=-}>0c^0&b!AowK3e&z%pzx()up5Wtv zk0aD=v*bY^KlwOJopewmj%YuN`!O^8;)7L|LzG+=0}jHc7F-qAiiKV z*8lYJmyc6EPBU*aiFHmK_i=)*I8s06sFS|4oo{yn`ZOm6HGY zKpLgeIOF522$V?2VkOf!Cq{WzOQ-R`H2u6ZGHViL(pbaeTN8A0$_j_f^J$=&Izfdr zE=Z$s8cotXyo5?=B-2o7T$sj1Y227by)+t~)GtosvNS5E<16?jXcSPS{k3;qE}7FR~eSe1<<#zNTYfhSEg~~a-9!rTqmGL8dnLpTIe-GDR6BXHH$IB zkn*+Ce362xE%f>{>IfjGZkp$&;wBab(M@cUhglNo_`xDA4L*WYpPQwZt}^sA9(+(Y zgp$u^xEiE!a~ijBYw6g;y!U8Ge4b9TvU+PeRyCiEx-AVplr(2RjBiiJPfOh)^z;e6 zX&QH?(Iy=~7}YF|ySSJ%TBY$?3H|Ogw)5eyG@7TuN6FHUYuwsBY4CxsmO@v2lO(<` zjr*ng5Up9R{sUZ|RL_Z>lWbkwivn%aC`!XjgWWkPpH?H&5`mOZ^4&B%?mdmkY4~ZR z(-@e>pfm!iB8?7dbW9^lD_1k3GztR3G;#v+Y5dqkXJI~P8gG}5FLUjw=XVo~7e1iG zOL?a>I;YVijh+-9p?686dm8lZL`T&%jc#f1VLF!kI>vud!F#7(Y4lE`e;NZs&wbM9 zn+5~9!fB0WV%F`Kj&o_8eh2B)6(3Jyq%%PcPGd+KL(_;K^*T=_3X*`+6i)p-+#uPsMo5l-i%s8R3X`1w!mBw^g4>?bz@pLhsAz)@2D=$p4X?7aV zr15MT&(U*^=+8@EVy0QHjhs2cC!U+eXB%P-%u8cF6Q(?@w?JCC$c1SvO5?3GR;95x zjhCrUdO{knq_HH8JDTdRGY{Oazsi*~)|b)`MbGEbCZF143VnkSUCQ8X%(8TRGt;i4 zdNUp0;qaofl1}npf)}Q$_2Y*b-%jJ5G~Q2Rtqii7J}^yR!!*()$>`u)0^SwQd+GQE z0wX)Bb!q+x9?NV@OAN@K@n?LZm_8Ea{L&1xDunVp2c zD~)f`{0SR-)BMn(?`Ggs&`)+$Ydfml9o4sK?Bm9n*;*OjrBS7mYS2lsm4%pvVmJSi z{2`6joz#zM^y{RibW%U1@pBq~rSUg)+e!VxjMrKHmd2qp4l`wOU!Byi42n*Qfb=Z8 zoYjts7$tvC;}5|NJF7p_ASLq{leTm`%@uZ5C(`(rX?b6g_@r?DVF;{AuzHGt)>%E) zSq00r|D?+qI%j9qb+2~n+Z##-;L(H&0#ppZm4DD#l?qTgh&Na!zh4$h#l@P!&lL1tKqOR&z4jZ7^a;;HU)sTA>%xd+n>XvhS5#u_^ye+`( z0qzLUH~@#eGeDC7J-e!=LJ3~~*?6q0B4{Q8tP(d5aQ$+vEyoGaBEUTXS_ZKxmvmJR zQY`^miNfy-@PGi?@%{kMR)`JCLhw+4U!T)j3ngeH;M1<^Kv!i3a00jitN^UOu+B&Y zu!}J{UI0HpK0p+J#!Uyv1jw@2zGM*KzpjcP48VzULTP%s0Ue2)%H0$pbPLcgKz}-6iTd3G^y04RS5hUXC)ZiaAm}ap zK0+zbS3shh8W6;9ziib_jS4VO@F1asg$@xqROm3F!-b9zI#MXRGr&g&7!zPDb=ysi z7dlQTt8|_T#rR>mXg5VBm-J|W$Hm7U3oyK!Vqxq|3NV>#tDrw2E1cOaj%CKh)Bw{0 z%nz_2!1Mr51(+)y{&avD0T@cp1(->{{YZO8stnj!0cHnr$I z_%y&KQO@T9J`2Fiwppq}*J;Geb) zb_KX_y|IJd-dz!}%QwOyB_?ODNDl0-rpd_PN-HN~miV4YubVm$V1EEsS$+ucqhMxK zR{aC|?FV!w?Vkgj2yimMF98lwApwpA_%py?j8I9K6#hNHZ-S2sbLIdnBe0=-{`KGsQ(G@uOyJt88GBe1vn#KL42C=OVxE%yYA)pkm_uJ5*d{5 zp-N_eOdQ~`l6%AfUP`KLDwDx^8I;YSYiXU?pnL}B3oa*=Oe%z#zd|OyB2b`G1{Y>9 zJA-F3xF~~*Gw6{)&kQcf;L;54%%E8Ymt{~ngBvoqF@q|Z*cmwQl^IlJHLYKsLA4C7 zpkxolQe8kOn2uc|gR3&QIs?AX_Sy_;X5ts&Uc=Eo(l+i(UY9|w43_m!but*%L)FgU zoplBWpV32IFC5~!B0w1m)XU(e43ZhBOneE@GDyhC^)s>evM_w~40tUzGI4_C9!VQy zaB~LCoVR7LsfTKqL8FY^QS?x^WN?;i?ir`_TiLNo3~m?UJA^hC%J6I=pebkU7AN7m zGPpZ~bOu2N%`<3`!F?IrpTRvDw9Ldo-M6Q@m-F^iR5-5=yeziLpiNK3*m)p>2Q#o~ zvJ4)|pmhd)_9ZR0X3#c+q72LoruO7KHWD>4}rGH91Uw%9$w400LdGl+ykmHyZ>_8)@w8N9wu>y$y~3_4`M zD*~_k9W&saQju$Pq5p`kh-sZ}Vx8_X2tDv@Pes}*!&6e2n8735Q3ic!noN9M8UJRn)8H~!{?dLRx@Q4gX(#?7)mPWl|TQj{d z%En|cmdfm z8UDk#F^yCA({5gDOc(H!3`OsqLHjN?W{S)#p{!E=*$ke`pmY{xvUom&IT`F^EBz;f zxf!g<;N1-7iTvvsyph5D3>MJV!g)D^R|LG2!9oEXaFKw;8E{foS(aq*nlN82mSOAC z{|_%?oMx~xgSY7IT@}4?MFwwXFu9kCW7aiTU6sMhy<%@+S|E6v(I=eM(uEv$d@qCd z>0L}s8LZ7!}UB6y2Vj1HIx@b5n1% zDTB{4*qXtYlIu2SuqA^pWZ9n!hg&-b&e3g>F22ryLBzcARR-IILwsVIYSO&*4 zIM73t$l?UUD#K$o@y!X%@sDiqw4~F2WzDCA!=?_s;{B+m*xw^WW(G8>Nup{26% zP^_MpMcFJ`W^r#8=Vwtai|ezflSTO~Dr9kK7MEo)s<)y)Uywz`EO<$(l#P?d#aUdK z#YI`rRc7~&9fq@Cl8sXtQz&WWEUIKtJTd~(iJ$*Gyeb;2aBl|}91Cf?ZB&EkeEZq3HGIyYuf zFB^ZZxjBoQvhfEW`e!l=O>ljoWF`dYSr`JCL&#KF@JiG`=(gU9m=4o03({MJHp*gt ziTYggZCTu&#T{8R&Z21+cV^>He@(LSeRa72yl4Kcw`!KfUF?CP|nL?NqK*p$;MYY7N&9LOiJcOjqS2% zFME&ZIRdB+MpFmsZL!h7H9BSE&u$&F@h4(dJ7?o7Y?D5U_eI_40Q?{yqFaa_S@g`} z`z-cn(JPDISv;A=lq~wtrdf>OQaM5v{j=yX#2B8%E$cO}j~bB0z%0hDGsqmo);?;m z&>=#H3MF$`7SBGX5wOc$rxT>3vS>TRn81zqQKPdMlf~3NYOFBF31)S?fbewU;VdR* zv9ynRgdW&eJ)XrUebl2_{LqJIIMI1m^1nW6k~Fb(au!b%W&F<6nsn^|n)7cW_?%;K#q-lwBhHn_-DqMy~= zcpde27VpqN{gl;Dao#o3MD4vR;60(#*ji4S#riBh$l_zs82@i{16`t@`iS{qy|z&X z|1gUt&ugqs?5Domm86D05#djTa@U))_&kf9S?m%|*pkJzEWXO(3+|<#+RFV3e;v2b zPaX1fz7m$kEwf15&I{`z?Q5YsL<6ku>lb^-H(BhKmF%JE`>AiKIswG&zE7HnzY``G z{6iK$W>G6d?U3hK;vWvg6ShXwpw|L+&CV~EnPI!`ug()}0#UcL9;#3x; zLX-}1S~O51jOYDNocWBg%Y-;DM1?Sph_YeqoGj(S*cHzg zI-$QRA7WmAMb3Nu)de9chOvWH3UQ(I`lf$u`V;-tWdqbDAubJ3EyNWeE(>Fqs~Y0+ zFb>tq9DIPP65_t&3Hsh&>kI}X=b}xkhqy9CjSyEcGYl~p;FRaQbi%7cTodBjFm_Q^ zX;!w@3}b&|xlRCQzdl5r5ch;=8KQ288$#S3;*JnEhNu@p=hQOtg9Fq}Av8`@M^VZ3 zLv$XX65QrGgRVk{Nrq4%ZleGlua9aF#(ChD5I2Wt7^2f!?OgbiHj<`Wh0;b8<6gKU zs8Xp0cd1xy&As9}!4h20yXRR}*snz{;k zq8o7%3-JIA7ou&5q7YOXBk`dSt;1L?4Bku1CEIW)nxGsXOHn5AT}Dc%C1xd)99uY! zP&dRmCKt~|1|c#bxcHA@^KCwSKYb$md)HR`1DKox~3glHF{J$1st2dWMsSh^2X z9i{r;dU;Q5 z#GSq$f|me-^&vh8aWus5AvT2A7~-1{yF+{!;-e5>gxJbhTWowB#vjHvhxkOQtkRtv%M4Lg1 zrQ4wRQ}E6ZyXaDmb8@LFyvO>=nS}uq3 z0xF!Nebfa4DhjQXi@ybBmy2__B!_A_{>@x$luL851*_!ZyTQwH@u!~3g7*!IKO$Al z;qn|#4O0Aw&CgcVbMd#kT-DVAuFRo^05Y!N3n&xn44h?g-C5Jn5@u_kiKIfV6MluM;xiyE|1hdQS#h|gw z&IL3PK(S^y+?B(9IovNYcjs_V4lOz6L8EyNEd=oC)XIYuUNi2^f#>R5ao)j-|AfNR z^*o}_NjduivW5pa=`j5vp=}4N*4*-7MNUx;W)5L4eq|HSMp`)pRHl|p0pG>M*M+SctoXL5ZaH+%VMY!!bLhe3pTp=J z#&9t?^v+=rt&>Ba9Qx+K*Yfns#joSw1LO6kXhrg(p8mogki$R$@vD0x{o+&lkQ_$k z;%CE$=D_MOp~G_+Az(o#oiE!NnTsD!X6w1lTw``bZRbs z)|*>k;e+b8UZ_8n!_&F=9Sbbi-(7N64zqJuoWsjGJd?w-IV{X!5!F6ke=dgwoa-yt}0#4`fA2SJco5Q9YKFi?;&Yr{O9KIQ>Sau5dT<8`$fPk$z zoRHQprMgY%S2=7Kz+PVq*g@YI5)ZQL9AD^ep?iex75c4EitQ8d9qle)ztEdx1g`mj zEcj>+2L+JxlYpOv{*uF?V*X)f!eabu4!;TJIgN6Ul=xlnA42~umidbzCis}p<3dm5 za59H~7_*O*_?KB!n5`O=WR+915S+>3EWJ06TKV|D0!!p^Ssnvt=_T_(9uz)y60%!pmCf>RyAK3-Y*7S}PXIR1yI;T_l`~gn8S5avPK?P6?3i@aE;Jwh1M*V-!oFH zok#sV5_w#oN1Z$d{j1f@qif}4y*zH<9-AnZ8}pd3Awh6c9y2f2%hc92ZoIZ`95X&W zqw9Gz$m8Zbj67pmPYNYadGy_@j~L3=h3O52c`H}dRNazCqhcBU$tGoP%j0$_l%#y) zJeuUuG#|V419?1{$DMh!8={)!aaSI93%*Ba^E^fjQ7!VAJw&mr9-=7LlB$zd;#LCg z%VWn7b$=fHG=oh34gEuT{4qpXdDQqW(K?Sd0*Kq@QB;i0Jf?k@ATuSxl&>(9PeQ@V zV|^YU+)vCbo_gaQ9F(M#dbU=OdhYy-oVqJjUfg zKw;7e?EZ<78>$}8W8_dp@Tll#P987h@mL;@=P@ad$$4BmOg)pw6L~zD$BaA<4OLTU z!J%qe9@F!fn#YQviq&gNBsULLPf63$LRn=KY1v_FCUrGT%@R6W=pT=3&*t&oM(w#g zZXKqc7itYt#B=kQm&bCBoX74-#{4`M=kZRRFD*93Q}kzAU`N5d4EZwP0Z(EY-BlX!~pj?k6o@D$^%JpLP| zR^{O9uu@vg|M&Ev#-Iy=6X$NR!LS6wIks>2nVHsrC9)jUoz|8oI( ze4EEU=KnlCVT{kxwlT!=*hFLHu_cd3H}mlper1{*dsA|A9tO1U{-%;kP7}&#v$kP;p*=^j^)wqALDo)eJ)d+h4bE4Fql~W z5$8NVLi5SSzj>U><8(g8|1qmaC==mK9%u6?5#i_Is$_)w|IzwYOA~)rde`P3RR7stdSM==pExY`QAK)e%NEGU#mA zM7TD>q!H@J>dA?9^uBYoTOQM{i*WB?ZP5r-JHqu5>O`m;ArV23@bL(B1FL~?V}!9Q zbXMz0^(LX@YXa&ErS}>Uk`eBT@N_9%MQ9M=4sI~Q%@G<#C_7T!8sU}*&qHq{Rf3;J zsG1`c!EM5!%!1@p9ZTe%{c5xMX>Gf#ND)A1Ok>85#D`IUv!bW zH$tljy(9FAa33udA>`f{X%9qrFv3$Kl^bEtvBX0WiXxbTTSpi^NoymtZG_B7#j3@r zCmT+Lfg{!8T1JX?nWWi5S^ez=z0P!z*nQY^pglnelb}3M|?gm#($1d10#?Qig3|rMKCnN zun3Puc$^xDFoG73FfKx=!}`bwqXmo-TH}5+yWAL4j9V@+#&hMD8xw_6enNzYi?Q)j zlAK5A%nOW1BiuMzkuxbmi%XJEQMVB$M|`jpPezzR=4dsY$`LS4C^uDV1IEk)&(X&sTvtG?0_H?`A;KTrY=pTH=0*54!lnrG zBP@vUdW1J3ycpr72(M5xLP9>Mo6C%79;r$3JXpRW0BD@`8C0BK={uYB}vKH>s?F||` zdar2ibH+OnzJJG9O{JAK2-eVzd3(Pyv9VnJ)Yf>qwGq~Fk56hJMp(~8bAFptGgs&s~NO!tH-@&1_Yr7(R69HZHokHL3Z0wdPYOFSX z5U@w+UZLL#-6!-rq2CMLFZ8BMlkCOW4@5W^fs_8kWE*ee-{HCm2qBsMWg;7Jrygqf2-tQ5&o7`d42)MA{>w4%uSRm-~@wi zMdB1AZbhQb-N}>8cy}lN5&ExCww|W)cN_nS48_hwI9rTM6ylC-MIj!rlu&}w0?HI{ zUIAqbXgW7RCJU?O3MgN|!2Mc<0;&~oMS;)Q#?^{KD;02I0T&6rw1CS5TwK5<0-T=` zl&mbcicnVHxl>gYe7Vpo#%N?#FW|}ot}UQu0W}KXJ@B8S)m4S~Ubob<+SLWHdW}$m ziepsWF{<9J`tp(gxK)nKPD!?cpS-_w% zN-N;@n~X#O^$TdT$9Q_H!RqueN-u!)jWJ3U(15x+m1rcKn}yy|Ktlnak5LpOJv>I0 zAFF<@n7qA!I|^tfT^bkAgfm{L@7!lJ<#hiVwa2P%kL%uA{mueN+2t;gylbq=j#VuR ze5M=i3+PZl%L48#pfy)jz|gU(RRQ-GuxYHiuYjksUa~0(uqDsesO0 z#!jsZr#P)$KVEe$pqp^Ib2I@Z#w!Z25cDpfWL;wby`q3V1@ND|`UF0nZjNi=kaze|DZWTYxoQBmUrO z{ka03FW`j&W?yfRGp7JD*?LZZO!k^r!2ALhP>18S|HIUEKub|HUARaT1q78SA_h?Q zz1=NLm=IJH%wW#EnN2gZyEFR?h!G{{oROS!&N=6tb5Mz*62UkIGu+xoK~*EJp7u6 zlU&qP4undy_S-$D1_#|6JbhRA?u)sn_gcT&sH**u(M$GMwvryUpijU(A4bYA)0 zt%dxl*3$4u@U7Oeeo*M9@p~lcOF=DZhP*UErF|f_={7+ zH|kan6aV2{KNX~%cCDpRk3g!m6fpcI3L1a`TCVm^!9vFW=H&(hbg$Gc;S%rrKPZYC zC}yCFfjbNoH&DVrX#-^p+-RVrftw9@p@NJJcIqYr!&}RO*23vyFG?BMt8U+7psa!0 z4BT$u>iNKh)>6*Etu)d`sL!a#X(Qzgf5*1lNCo=S#viMS2HLcdN(M%>k;(>Ew2`B2 zguJSOI}O}p;9djO46y0D4E){39~qjeZlFS2xmzV9l;3BdhI$e(P}9KRM#1|HJfMVC zn0;hjF0qz@N88HLWuY7c43Br(%8_k;_d^Ei8K`d{Y=B>n#XxNX4;pyLz*AiKFNFDp z`C$Wf4DkCi`6C91k1A%`%3}r|H}C|vg|;%LM9!0{cAZn7U&!kkc-rv4s847suko9| zjsx3$*}$^~*0q)A3^XwOuei?}Xrz)C44h~yObreEr{qPIzhq$NjA1UdkThUtg+IL>95*YJGC=&Iy%67TFD_%uK*j)Hlryfq+|(dMl5gNs zm3*eywY_|<i#elXZV z@ko2A5DeDb9HgYxitvvHS{nGLy-?DtiL^2NH{G;l40n*qN5fR$Yi>dvqyuBXz(@n5 z4BWCg*vUXo#w4fPKo{*r!BfGm2D&NlZlH$}_Uq#lVZWy>0=*4P{UbcUz(50i4D>b7 z&%m!I!u<`T_J-IU^2Qy6ILN?H28J3KW}whNp}__|>mWmvZ{HInX9tI~dIy=&K}P5l zuob3vgTc|PJ1cj*feDO2ws<_etAmWCGY0mL%q3^_Ep@;Q19{ z_Hn9#X$F2a@QZ=z24)!8!v$qvCS#SuVqi134puR+0eG5oj&hvd#TaG`@R zEih23qfZ`CTx4Le!QY+|=_q%c3KEwZSY}|kfiuGcLp#cPB`XZ9RI*BuMXQypF|bz2 zI>lBUg+&`UI2~o9B44FMzQw>+E@!R_y3|;fbQDhdHpa=&obBv*MQRCg%HpkZz4eumZxCwWXtK6KY2S~1Q z78u5y8oJ#{{x!fC8$I=Nn4DP91Wc4RQN~0e6E~Q+(L_lTg_-?_7jIEaNf8szHVsiy z-1OhRG=F`dgc7ccYn_CWN}c5AtoL%@u-Q~CLT2Lun8)#^dS@bZ_2rj*Y#HpE6O`M9M_k#M36~nRwsC2PW#9c*aB%6K`;|O+07njbJ7kD0xMZ zr`ex3@q+S(ijA`J7nQuE__B7K%1p1SgnycozplKo=^sB}_Dv3Qet`UK6K`=aSNWWW zDBe*8@^?+_?kw+VmgGYdA88d!l|MESF%eb%iHW8r@=O?7g{I6b;qm+HmSbusVIr=C zF0qN{J`VEChOK5D#iSw~V=dQ&XW}yxpX)SnNHZq#O>h`L)j{UulK}LbU-V2AUXc zVvLDFCVnz8+{6e~8>~3g#1JJk!ivK<1zm(`5PSVYaHNS*+2;Of5T4gX=*(CX<4jC3 zG1bI)6BA5KG%?8p74~+K>kdygL1lJ|+4U{`ZcZ~X-Q?3zFiV?b=?oKp(x46kHD~Mi zuu-;7&*zz#Z(^^BeI^!gE;t${wwYMO#YhV#)|*&jVyTH0tjIq88Cs^eoO4k&$n5Q1 z<-xA9iqpC=Xm^#>CSL6-xqk=Wo)cQ5d@X0Ht5CSX#70%yY+__rS=?22ca=?yz^=lI zTeOHaX>GfS9o$JC3hh#Fck0A3%U-ajyBSVe%I>hs?BjkD2TYtban8g+6NgOvV&YdF zoWmxL=%7)JL&tPfv&T#vS3=1NB|j@(?JA6)lidHcI!iehr%jyE@#MHMangS?ah^MH z1VtkFo#AStU<8Qx)4_@OQ%#lYCKpUxG;xW0X*aoS;%_D7SCm{e@t2ZoS^3edezJsx1TXv7cZ;t>S9NikKRkX8Jt9~ml1Nd$eP z=oiJ!5tNExLj)TmC>=qW2tJMAvj}d9plk&7BX}l)auM7bfkaR{g4-gvJ%XAM+#f;t zi2qjlJ0hqWK?OPxK_!*E&`l~w(7A}Pl&MMt`GutI-EwCH)gri;&a2v8iuWj1kKpbI zelG6o6PZ}OM%EgIZ`2c-eINp2Ac7nvwG`PXjpu5MA(aHRA}xfKu#^@ajNqXNo{He( zZo>4ilE))>B!Wkk*HL^dg2(FntyAaoZt{c*pHyV_dfmF3eOj@eVyABMYy{6mkQadw zL4ydMkKo-1-lIPeG>o8e1Wi=4Q3NkX@QU&mBX~*4_2yoU;5E&@uE-+F*(lS@135qudz^9a6*;OhulMbKJHzlq?x2)>WtTg|d{8fl@Naq?pX zKV*4LZ|g2?l+&Mfj1cvf`s)k%y=b2;>cl~gU_b-|Bj^%ASFQ^!>ZbZVwO`#M z=%Lx`P16mMUJ>+GLTCCY33Qi!T9=akD*3CP42s~V2u4RRCW65c4B=37O?8){iX$Rm zVs@C~aK(?h`$I$_(K4>`$(ddMm6hdt$D58o!q=?KoKgq(JMi{N|&S0cE|{hxbdPr1O0jXmWL241fG z8Nt&%%wxD2hjs-%E-_Q8bFty<}ev>DWsa zF%^@oy`)4GCws|_Q9S>=)D$VuTgvyAo1-WdMcF9IMNvBHx65>kk}`_)>Ve)u;jK~J z7KNd;8uXUEwf)4R3Q<&y;@&9ki=t8#m7}O0#obXO}Ek6fZ^bSQL*(@k|uYM)5=xPe#Eocq)ot`Ut1&-#&6nUtWuox=}pM zG4JEMS}%(F$~nl)J{LuUC|-!7VH9tK<@qRf7nS;bc@zxPuNA*in9ze=%_K-Gl~-Zr4xgM z0mF&wEu9&({pF$l(v6a0(nI5?yK-h}s!@N5^cPN0uPDCiFTGjRU;0Er`RM-AKZ*hD zT>@VuFffWibS8nP6Zk2L!Hl99evM&Bl#j>3n=!l}lZM{y>Kvr&v-=tl7~)uI^1 z^~>ptVrdj(7=-=(i>qU!INV>z$3-zdiV0CnjAD8eGoqLj^{>P-O;*A`+?=sI8nM^GFO2X8A+xqw?3s`hP+_nw8gy z;jt_)I#8a>@|R+GDu%i-JRQSlyMqVn1RKOqPdT&oV|YgSvsuY=?CC&Z(ep7-ndyZX z8fJN;7+zFKZxPO7(R;OW3|vUhCC&oa6D`IE5(SxjKRv< zk0^=85IW|!5{u#B{BS&5nuy^|_07&ooEVZ>?iDWR#^7BDbfZ_Q=EabS@g`z?%8`lT z`xsip@Of7Ms~En>@@6r7sl2)3_zQkiGkvYuZxp{({Ei0II7@$sp-l{JWB5^vS}L|u zWNB-*e$J2Nb}H$l*j}+iR;ObOoz+@rm2}CL=RS}vt$sOh^B|e54Q)}J62nv_(_)w&!;Bba#;_!Yr7E1IIA3wL z;vB`fG0amE9^`kB6S^RVg(_L3Na13}s+N*3i(z$)Hwt07mab4-nblmy5Z&WX;#!q# zR9vUHKC81K1}AH6Qw*E4^4E6w!MQbtZ85xdBD6h*9Wm^TVV5c#iD9>r1B!dHwf4ra zFU$8UX*);`DmkQhI9tkn{%DpTi}7J@{yuynEBTpIqh6hi;S|R$j-_#&j^PYfdK}Nj zaW;l?G29VH)i{3R<{v}BIEw8J{vHF*#+cg!e{hE%72-$spZo}j;i6i;mbHIL$z|$f zC0CXF#qrd3|JLk3ivKG9r${FY#Bow}5J%CUq);3;#8EhoB5{YUgD-k6_ev${3JQT;nN*+;sGLA=;)KPp)@o`1A`-GBL z`uUsTQ_Abc@wAe9S)KX}k4AnUpNpeG99`q+7RU2(RH;?)!#F;Q;|0}h7)K)|FUIj& zoKH@}OPYOI@fF2a6={l*Kx`bx8*#j;!X}CjJQjLO$-9bgE54&h{XVVzd3-O9_p_1@ z;#j1k@o^lV#L;DJh+k})#*r6?8;7TAMjVN(zNsXl7*&kL5m&NL?O1WxnspS*50<2o zlpnUu$|X0Y^Bh0$^JilevkK5-0F(l?HNO8Up~lM+@R5XZnQ9~8&oFaGzP zZLkW5#4$8mTKz;|xbhK-BNazwOU)+!PB%d6vvzQ* zW~aq5Ju9CP$C3WNC$m*jWr*L?IoZ;=O6J8eKaK@)EYvJxhB}L~I*a2dsI`{Gu{@65 zaqNj>MI0+tVND#X;#fa8z)kyT@toCMTtj5S=G=Gw3$Kl19gE`lvSzs15ZS=R@_FF> zA+j-!O>u0_+TR(+7Uf$Nw<&JVmhOmSfVRFXE8!>g-Z=KfaUqV2aqL(5`8a-$^GSXF zB03nyA&x&guG!OZ996=KKgV%QIn|EGaU#pFohtB)@?RBCX62`p%vJ}^C_k%sj-LWb z?mAe&8=Lz_96N?c*`e}h99M?OH-`h{xkKd=mj-vd1nxNnN&`e3-yHP#)Ww&Z}%#kxn{v9SCsgoZoexle^k)G!zU?lL`@vxad&TyfG zJeEK_!Mj>QnFJE-$Z&BJcw%(GO2AIQVWYgtaX9epa7i)1>Pniu=n^u9%h`8A`~}Sq z9WUW;q=Sab#X6yUweYFpJ$2=?1isWO0L@6~Z324|Xr91V2@K)|lLWp_;F|>6CeSW{ zZxfh1Tv{aXLjpU8%XbNUp8$``UK=juM#zsG%n{Ni0dkU-3A9p4Yeh;Lj}Ui+bQ~e= z6X=jY&jflU&@llXKkh^i6Bs>0R*sOvBcw|LJ!og7Z?>x%?55bAD|Cb}Wa}*Loj@OT zX+Q!pl207L^)v zIX68@7ALSIfu#wY93`Db`FGupWzi^ky=S2CXjzfKN)C97z>Wk~C9pby^$9*#0r!oT zH3>{ule;c~wMtes3_mwo?w%j|WVCEdU{eBH64=VwA1#@;LYotOJ8Fn&;Aq*F!1e^* znGy_*kvXGf&uFMFLxIx??BAbzIDumc98cf~x2zTcwsJH9YmBrWBPSC0Il(7D;#ZaMTPQE`l=6Zn z6F8OdkIJtZBW#g-!ss#b{^h`#1kNUKjteA#KN9#ef%CLHMt)~UE(Q1-tXSSVtlsD*+SVBur~xxvEf&AEjvR3FEqn^Jt7FiUx1Eq!mC6tnQ@IJwb6NhQTC zlu*)joKVh#=AzJ*&Xl(lfTg?lWNvv8~Bhjb+izl@XH zER?rU!NTpD<*h&z-Y{P787~zrG#oFn@zQ#{RJKq>vm?gK9TrxMm#T^+cPgo7;jXNt zx&(!ho!0VdeIq=>@A!kbv?W#azXp zVn{KpNM*6GaC?a4Aqx*%sAJ(VrU`t)AsSDR??(h4Wv}`A;0eLm;N=>J4{ZlYY7AY~`Ys}^3f@TP^gEIw=yjfp)2Z&+wzA#b8AnJ5P)%8wJ} zr-`zDc;M?Eqr2OnT6$+ z|IyjhLXsU}T?>XvO!jE9I2Ixnq84Hn;ub6m=O&3gNfH*ePLhGcgB>QxC?&Q9%1cg` zOJ#zmKMkcVxE6X?=xM>Tkg?Fl!sYJ*`HVUX-&*+2!e$S*xEwZ$uecK5ZiJ#Eo_)9?Jex+80cc5gN2R^;K|a-!VOcT zvzB)GAb8IdJ_It@)j~J+;$)yZr)g;}CD*D3neAnvw}mkl##-oOp|6D@7KU2rXQ97^ zK^A_pFu+2Wi=kfUgB|OKnw|~~WbFMNAbH?w?qF6do>S*!pxzXrlfx_ww=mMeC{EcF z8DXK*Yr$#@gI`XO305%nW^lk18Es+a6xlvSew!lWxLUbVEX=ns!NNof(=1HqrZ-h; zPnAg)CbLwJ15L3ol}qW9;Pq26Jj61CcDQDL56rgw6C*EAm06l4=Q)!(7UpV}Rj9** zGz;i9qk5|FZh}Qh7F$?i`3I;dWa7~m)?La7nJTSlEkCfr!YT&2#?nd#)uQm=sj|l6 z6O8efg=-epSy*r3u!SQWZ3`PY7Z!F>VNY+pY@Q}(xG1Qp{49N*CT!?8 zl~DNKG`VBC{K4Q<&;PV=!NNuL=Ms1CX|jK6sNLo;$z@fz?&MVqk4%@Br_0|KAKQ-V zHtx3ZuZ90C6t_{rMgbcIZ8W(SDrEa3MrGfKjp%g0M>p6gY=f4I*uLjQRg=S5OtX}H zGhJ@9QPRe3Hg30ZlZ~5g++w4wjZ!vxPZuheQBv9ldrb-L({ec*tjl(9Rr%!UvTC{< znl9ySRIpLS#vL{)+NflsvJLuAP3m8nE@fs2$BmMzHtw`h&Bk3eYR-^)GyJyRn<1Qw z{26|t+xOVG*T!Qu9=CCyjT$yWHp0}maleg#jT{>fXa}iZ%LXlUm?0x(2)mZ6oeipe zPBA@PI74>L5V29)#=|xqvGJhReMlW(a|O4A=^h<;)J7c}Bs55G&#OTeJz?WX8_(K! zj>Ens{FIG)O6n>;t;n9TsJ?QNXKWOiDI^VSJa40sjoiOOOfT4IXoEIy9Gp{irWD^C zWr+SqvAMq?Wz%H({_uGx6QM%+fi#+x?Y;&ja9 z<7)A?jdyIkZ{q{johk3ycuxZ(GE-Y8wVCpzjlZvjzOd2E#vyIRxfWt{HMjAV4X$V=X1}rVt&Q(=Kz^|C zqmu6xTPS`sI=AdBX~|G$*LDZ_1*~aZDY-N^cb2rZ(TE*qCdhqm52B zCfb-}qqB`JjBOkJY;?Pv+m&deyN&8rsNpP$&GI+59=89X*;BEXBD1}f^ik|MOZwXw zK!0qEzQK1vvfcT?K{kF;oxzGj6^AIE|FYmPCBqfj9L+L~(rnXKq0vgl*cfYL zobm~Z)ETd2c(WkM%*w&ZHm2B^Zexax($hmz88*v9)0C6cN`$&uL8h6kWn(t2%@Sr; zF8AfMMxA*!=G$1sX|l1v#zGs*Y%I62$i`wDOKdFV$XG#|qB1Kot(YapW=X->vV!w9 zHo&x!!81#!KtAWUz#7iAjSV(7+8B5b*4bFEj&Yp*rZ4AGlg8=KCYAdYYX-O4*k7zD|**LDVd|k(PUX9QWNADLKzv>7#nC(xBHJeY+#TgqHY+ST)*2Xz4{lms@ zHqP7lU9m?^zjc~omA2~DpLD)oaKvocJv>BmNwb$3#ytu$OSLN;=h?zHjb7t&uwghb z9sI-1pBtb9aqu5Ee+Ok8+~T01gR*Brqizcoad5775Dp4CxWT~(|Kt{?PTAn|tAd5c z2g@D_6m?L{!PRiExPy`oZgNmUvo|W1E*oai%??UAI4~%0Sr- zJ9xmseGY0km~b&raZ2F8Y^mvB*5=@#oM0^neg6ss9fTYNlrx*-AUDhT7@xJfLsKv2 zUXBKrO$gO?@F3lA@REav96apcNe53kc*Mb@^t?dmF$a96P-aG8`M6*mj{I!dbvQ)% z;|`v1u)ksG>7qGBW(Mjyc-lb&2hTgG=b*lWXW8QJ0E^0Z4NYkqc*eoCZv%bn1)p=! z>}-Io^9e{VuvXEWMv5d2m6T`_8c;p_e4)_G4qkEao`d%tyz1aJ2X8t!{G`0@fIc*K z(8TedfVAXvZsB`^!@do?L4Upt+&?UL=!U>ss`<9!JBsfrzJD>77J^f9KXCAogO44o z?GgIW!SO3WJ|yH52TdJ}E1Q$Y5w0Iz^rQ?OmRo5Ke*y=p779lkL>;tn@Ph-!Sj<7j zLB4}HXP=%pupPJ*&ImXTk`5*v3{*cGNICfTP;QzNR3^xF-v|WFZv(fE33zH`#q7|? zalua=6uy$%%)yrqK66m|i{L#4L!UeNf|D{w7#@?S1e!Z|caD7R;2Q^DDZg?x@Z}u& zmgC$v_#LOLl#sl9JXoQWeD9#&9BCE^{^+2kgFe*ZJUVFYpuK|*4%#?40%_}j&r0Gd zTLEe3;PU+`$+J0~`!=FxbHm2ZJ2Y!sxm3lY`V;={Q%Gso9|_AK_r6 zgJBL1&6WRFgoksbuLyH~FVB_Ubwi`*?Ob6hJ5R=P${b8_FqOl2PjEcfg@cI>F8&oL zRxv!u!N&Q4zDt59cLqo%JGf2`v!4N=fh6WRnD5{$Hx>sA94vIOftDRC;!d(RxYWTi2a6pnanQR+POVG9l8XX7R8wo7 zEO)SeN^lJa%E3wps~j|(C#xMq=E>Y8xx5jHWJmkZS}vT8fpwgwdBU{b!Ehy;9Bk$; z>pM6Ape>Q^ypKE3(mF=-9r% zNyT3knQi=OfOtx?ryZPea9zSnoxeFa&mAv`yOQ|b!5Jeow^aybhZ$gTxaCy5ISq_h^j zuuvXP;)x_!L{4S?QB{}K2L^dK>gl9^>6@uu5{yc9Ac^Ob zcp(XUp=?|zFDB72iLMK!ks`_Dh4NAoEMod~p}d;JYe~GB#9K+cp2Wzd;U-CZ)hxi& znEe_eBow}(LT2CQ6fcr@lW4F=NZ#RCDS1yN5#=8y`GO4p8orxE`$h6`644}LNqj>4 zi==51OBYFA5{Aai^*Aw;h$Q_(WlU=>_$|hhNN{$N;F>zL$R7tg2`7n^VlwHUpP`V6 zgek2Oo_z3<$Rxq8U0Eb$7E3-inZ?2Z{5**-lIWI1_avGn@g;pr;>X3ph1oob7D@b& z^mm4@6u(a58zq!{o5Xj@zgO&aB23}4i{(cht~LynB$#DtrKGiv8?*GSZ4&LWS#z;; zNTOpBbgWYnZb9kFX!$MNS+NU4cd;3~(6-Fj8 zN@sa=5@VAXr{g(BB^+Lk{B`_iu}tJjVT7mnrXfsDVoDO1*{LMosf1}sY-j69OiyA) z5(^l~Tx&~YW)gF`)h98Fi(*KCX||F%44Wmw?EECk-4^1%mQ9xkH+gn^Q4(J-k>yFO zP_j6QB}ynLmIuk+n(iFbv6>B=~0~*8(|*eFGyuiOorD zN&06Z;ks9gLq)qvhNZVG&o^&Lnm*R<+9RB=#h6D2c;K?BzbT zR9Nv~68n@hyFZBoSzcqQ@DwE%$dM$TUMk0ve0d6vavnbk9^>X#S9rjKTP{CberCjS zgB>8hC^nfF2p-5inZzmXFb8reXCmQe%9$k2CjG;r=M;ZaWcIw0-xdGhr+|_RiWe0x zDbfg)uO{(V61S#sTME~b_?!FZ04bINL-d~{nlF_bQuvpfe-Z^!D46n3v6kx@KnfdM z1Pi5b{`HXYScu3E*$=djg;V}{(IP1nO`+FPsqGg1 zlG2QvrBW(|wM*sbz7UI;EtA46DNG6QSAT$sq?{^K{_|3~J%#ct9hZAw3KdeQm_ngt za+hMI6sj^UlggT{qIicQ|L>sMohg5Bsg}ZH%Y=!$L3J%<(cLNBljZlaYYPJu)<~gd z3U4oy`%?&{kdwm67QqKn{ytnwIg4^r;Pw(qf&Vjdw+W`ek4|o?VUy%g%F&@kn% zAkNn_DKtp=X97Q4CeNnuoF>Y5?G5!_CeNqvLJA~IQr4(MKS1B}3;gu9$ z4Tjg0aF^y9VYHJlo_Pe33M5RFY+5F7rtnD$O;dP_!;-=~De!au!xZ?>{<|r>m%{rg z@FVQhGWj6I=X3?hi!PVy%jF}w!4I;b^08K-kS9DD##~l;jH|-|gHe}4gr+ph)g99= zvxq#d!UVg#T$puINT$#sg^nqtQb?!pSqh)0;HL2Ia(^f9em>-JOorxW6iM<^_%zG8 zi++(pvlPD9K>9L;<{Ds(jjvMvM)7URKXUVR3g4uVzuf;u#4k&om;0OKcZ}_ye9|I? zA5!=+g|W+}6(9SP!n)4=A|&7Q6w@ah2K^P?~j{BfYy)cpD3=cU&p!Qdpnz zZ+hC0^6w<#EiEHg%KVj5xR`%a$!2ztp`OBy6gIDvt?WB{T~v;*^zY!{ElYG}Cx@|z z>{9$^rIcIc`y5&&dsEn#!s!&wq_95)HhnaOV<{X+;b00|8^|FQ9_FH3CCnb-st^13 zAJG9SALq8lz~H{YmDR&)oDg2WH(kPVn_5V%bzZ426f3mhb^q>?}{_JYGakbQ1EjOf5I1Q>5RXHs)6-oO| zusRd(fhv*4jcL4=#_MU6OyeeMrtv@;H>Xi5jjCzfnMUa}%A|378s*ctC5=H}1ZXyCMs6Cl z(|9nAU>cz`!f8kvKO*RM_S1|-A*TAh{Zz1T@S!xGSi=_x;?Xo7=BjxxNO{+dxtkvj zcd~;6&xY!x@mLyDDukIHPh-c~&=YAqsgg^zLli!pM!hs%Oyj*ZQa_Dn(rBQZ+2k7e zc8xrn2JyKxdT93fG+s!fVH%^>NF&vpw??SERq-X2ysTIvB(J1Fd^L@8YvhKt(m0JK zX*5kEFO4_Se9Iv|O5@`+-b&-`H0Ey(f1vn|;(KYltE9?WVG+~&?56S$ReqNWc`5!A znq4c-TK`Wg5<|0zG^{ktG$Lt4(`cy*aV4>AcHmlH-%i6x!%f3WW5!xZru~1TQfaJP z>;HR_)<)Uxv9)q_tz*U3ClAi{%W!L$_&(rvV@tMZnG@5aK(-@J)$TXU#@l_gK z(&(DT*J*r{#y{(%9mg|`@6uSXPTHjLeHtz34+CbM#Mj9WN`6e^hjl^;(HE|hR%wv5 z)>7)U<)9tOJ+w|}grq&~?+SECqhlH?nunM=rO{b=#r4u>Uv9TF=IjdeV#u+xr^DSf z+e3LzPGurQVIR%*Ph&tDeU6xxtd~iOB$Jg) zQCv-h^+G)v70vlvjmXK32H;s7=5)LwVgAI~*EWq^6xDZp_4YDweMU1@- z^6OJUW}9u0rD-fnV{01Q(pb)MOJidio6=aB#;P<{r?G~^!d5m&g`okS8Cc7uv_a;q z3$0^pPZAcraUyqp8h>t(4T{WClLrho)2yC1*urgUqntPx*v=W>8>qigcF{;0JGn*{ z<=($hwk-7T+}WK5Q{G0Q!oD>2b02g0hDsbr;~*`kaUqREX&g?Y-$psfUZ-(1jT347 zoCX~`mIl-Dw11L;j?rNrZ}>%ve$^uCe7(^xBA!a)bQ)*UIIGtFU|*E{p2n<=Li@j^ zab6|wtOzlCYsJv^jY3XxF^x-%XKvIw0++cQ()dgHl{Eg?=%1{h57)Hmzje6SB86=F zzcdQCDB_~1i-IoTqOgnSHpz{fq>zgnT>cgiKFYH4D2L`bH@Yb4;-1oSu9W0$5v8xTxylPPV&A?qIt= z_>ER$FRBO=b%?b#%iSz;5q2Ri?sajWiw9iPa`F6Tsi9a?(bz2a(}A#jy;*u~7M2EF z)kQ5SVwJnZ5Tm2BB8OjQ0&kqs5z zB2Tz@(#2C8IyF^oi*Nk7E%LOBcecprEwX%zq_;?iE%JxoF^Gl#9`< z<>CbwpSWo1qM?gMF5Y*+=MTK-;w9?4c#WpUg8S5~>w;j3HZbr+3Y zyiElcO3W1p^z2db#Z-dzQ@Tb9i~~9#>lEw)OY3&TYV7eBZ#T|`{uyZF>a)J4CoV!Lo$#9YK(BvfL#IJ8x! zY?akp<-%5>PSQn6i#)}&3l>rCYL=Sh8RaA;wh3qIGZ$ZR*x4NyUogP7Ni!E;x@hkD z_aN8ZCQY_Ua+|c?CPTK#H!c=#6Q*x<>Pfy+vUi(&uSFz3x@hTQfQx}HTDfTLqKAu~ zF50+g>!PEJPA=MUgttkDY?bz0LB)g;8swt`I=d*aUAku5>cUCv?H4h1bJ0C3ue9Bt z_g*e~yXeCy-r_6tb@9Y@zB2WHe)1mV{>o{PrGs4jQI@a;GRxb1~ILplGn{4xupjrOQ+*b+M1Z>Ef`9Wjkf>PC36*_PZb+aB+|$+|8FX4oJ~ma>T_k7p3dT zQSL>%d`Z<^vZ0fE~}GVgIBok<@gUIsb0tT z?HUd4l7C$M%eA1K*-pEJ_@8DAco?QxKGTN6LLP4LP{cz~4~0F<-6f}XN&Qpd?Yn$y z#XNtvDdFMmQ(=DJilA0@X2nuPHL#UrsDmIEN#A9YANrb z$~kJEr+Ro;CFCLO;YF2*huR+MdU)CczxO`q;Rz29g`}S6pFnHqp^@hwgQ>6hjE85HQ1YAy9)M}U z?$Cif@`B2*ACKWdAPy-V;CE?~mpr_z-oBzp3C}OR?xC@VwjSDf;32vu9xM;Ghc`UD z>ESKTsfUP%sK=L4;_myyAA0!6!@J7gQ+(gU2bAoQ&-O^yJwlz2J$&N9@L+mq>LJfV z!M$>1kBr+R%l8O1$*b)3$-{f4@m`6s(YL{!)OnKJpANgD3`5PAME)b^wb%m*{ApW-@S)>7{SrlFOL_?d2hdrWc9T{ z>Ku7qNXB>=>tUkD7noukee*zUj^oHIVhQ{IPW_DDp2F~5OrF79Uv}L{Y8o; zZwW0?Q%gN8Q?gufm4_8dRw}Zs*KY|CS9`cFxvhk(^{|fnl7|h9@H(0x&UdotKX!g$NzGiEuYTof6;mKXax?B`<7pk4+C zxPCp9&7fQchddniaNNTQ55IC?JskCLjN?2!_}_m2i#>mF@YhGB1HxZ1{QAoDGq)EG zRDR%B4<|jG@^IQi@r*AyvgOIp6_s35yqYcji*eX1z$$zZ7_0xwO`CI?!3`M{(AJ??P>~8$zRnA)q^M$% zY$>f3`+vMd1~+C+)pi&0+XYfD7`>9g6&cMmu+AP))OUWpJ;O>WX(OQsJHqyN*=45qpGkl+>UpJINn08eDa0ZVksjc{61`jD|qneK@XO+h@ zd=2;iX8*AaMri31S;>tUfz zuMB!;(1*LqVc*nPMV9u>;JWb@hh;zp12ZUdL`G#Wh@){>hG^+e$_Fdbfzh7^htgs0 zPKRYU<1K@c%C8<4_K~${yy~MN+NpI!#%3@sgZXqO1K!g&K7%P4OwC|I1`CVG#0(}e z4vz@=WR;NcYwi0-WLgF@Ib{rn!ZJOB8A|wt5JhD+_s=6TCxanJq`lUitDM<+N@h`* z!J-V-Ww1Vj#TopYBTF+_mf;J*vF(UFz9sk9BeI-JBZJjy?Py_HnZc?I`0e-KBXZkO zdFWo@H|;eUtmPo*NV%Zo9F_VDUq3#SqH)-%-;?Wm^WDm2Xj`a4Tc`sF0Yo zWP1iXG9cNhNW$jcDI!1IAbYv_b1~-Q*?jEh=AS`{eB79igB()socSo2kHZ-p$>2-| zXEQiT4>R~VgI^dMN9A}1Cpg_<8Ftja>_1nL7ubKz;A94;xVl#h39qP=96l}&!F@%{|bEHRq{s$e`@x=V{(CWeN--H@YFG3y2Ry{z#T9PJGL)28{9GumWI9`pYrXno9g1NpciABEZF)lw+me{dEbdd3H870E}@ zd=z8qKQl+4FX`FJ27weoRuK1$`|j(k+jN9lZ&$w!5JRLsXM z`Tq4%rgHfxo9|yN-FwWxaC&Q2ep@~+9+TViQJ%`j{h~9Q0=xiQDc`?NTR9&&Dy))^ z7mxebV;7VS-kFbT`M5hD_v9mXT<*$8^?Y=Nt{N@9o=ZBPt^1fC6F!6ciJP zft|QJGrK#xqM)KgMUbE*0|KIg0g#-{ii#*X=bXPg^?v)E|2ci`xm{gdU0q$>GjI3p z46FUNYlll~$?c)e@a@|5bYQ!7V;r3rz&I9d*E%w_wuikAZ`W>$V{!$pb3A;i;TNUC zUNlaAYdpMywAi8D7sqXJ+#bgraoib47m=6Wq1_e7J;LwKOFp|kJQ4@=DA{UjY}Taeo{=c4&{s!G}8bh~rTPC!#&TRfyxEI3A{NJG4gx`S&1s({f=U z=^00_IC_gdAKv(w=#a2GTW6Qn`oz&Ujwj-HZiklMp{*^Wwdkxp701&|03D5VJQK&W zajcAE6?Nk1AIBulI*tKxJRirfINpk5U>q;Rk&Po4$BS{i6o(y$6UWPOjM<^ZIv-W25vJG7cR zLm|uCag2?JpXv-}e#S8}j!|*E!$cB=@FO6)5eMz?GaObg->JRJxb4(}o#E#;@5M1L zj`3n)g5a2)+WT?L+^H?vsZC_ie$oEisnPxiaeNrZ7jb+U56|Z*aZG2{#W9tu-&va$ z$NEm;G0wl`KVmXOw9n$0CFEnlPXs>|oEgWdPN60b-q~D{J+aRP=WybYP(C+~6Fap^ zyENigamQi2UYpx3(pYt#NFRgPK&^ z##P=G{vp6#9Cruz<~nVs;4VQ{cXP7~--LEUTlOjw(8;>L{;=A8S<5QBlVOyTkAMD(T?w*DCAb zpe*E+kW|xAUB~mgwfZ`0h|StkttqXw^zcIxs_~PMIwGfLT_N=Z`Hfz%TWcW0ku=uP zM2D@z(a}`LQ)45AI-)w7>1eK_g$};=^YL4XE)~*Ju$7M1LfQzn)lsy&@DkxvzVKiX z^)J(Lxek(cf+X#AM1&XQC7)#@MLJ?Sdg|z@b;3rWO-mc>go&O|^`*qx@<1QWd>bQ@~_fza{J^X1{7ajNL z;ZOEh`0FQj;m^>ziUM`I>HIgX7`@_euQ+-SE~1Wyq$6ATN!Noq*u+nh$RF16h#r3C zMhlM$A?N2#y>&dM<2fDu86q8hxEx}kuk?LVCQc(yNR>arqUCSH0kFvI-bpQ zDi073U)1puS6}$Ryw5L4UmD?W$6nU)^KQ-1F-S*T4}VR@Pt0^7{LL4urp%oIv~)1? zBncf!9piM2*Wv2$bd1n3Qirc2rDLd$*L9?I?A@*9IFODEGek$(JzAE+i?L37wD`qX zvpw2i9k1#bqGQ$`?KK@!dlj*a+@n3ZN3-{6>-K0%dll{3qrIWyEzu!=Q%C8&+AtmD zBya0zxmRQN;X0PjC?p@noLr-g)-i^=Pk!L}4wqZ-a>+r#fcnSQXVi z;vUSaQIp+otf0NRS9^c2#wuGWVVR}l3msqTn5|=uj?Z<>l_qMkb*?C{*{gk}gB`!t z@r{mo%x9|Y)i?@=rdjr)O?pD%0v!uE9Wk;<$L77-VjW9#d@mAKFOOiUj%89^$un)Q zwp?%pkDz^_do)t)+bWse0~NG2I@an~C)R$@@uSGslT^@X@F($&U4GUeLD7Y zP#s&CEjsF4t!-tBz82Z3W9uE!cGpC=>DaF0l6~5nLnAwM^d416!lqq1c8ks)K}tIB z(|YgI?0wn+9S3!s)p1V8AsvTxoMbe179L@uE{q%(`$u)Wy-z#FlX*@d%O|r7Ip_&4 z?mlhhKJAo_(=@wJyRc6?BYhj}*RI;n42*ogvG6=Yy|M5DlVNt@Md5U>#>5B=lrq8y zG%--xKp6uy4b(EgKkCaGsAQnBfpP}A?bpg1cy7N|L6Cp!R}{jxY*Zn!imDl?ZlJ1x z<3Z%5=c2!U6RlwYsc4BtMX&7FmQE}D@4jel15@^E^$gTEP{)8Zuc+DL zuQf2x&2jZxa9DFaImXhRNYGY)7CdWN5MTtzzuIvBXl2tUZ8x!%AH65*Q+bTn|I0e;@q$v}&5BfP}(n$C+mKk#AS&TKjm{yzi% zli^kaw;AYZpqGK$4cuX%yMg-++-cx00~ZfyT@BoA;2s0_NwtfCdkqxhz!C*iU?E|d z_HV3PUWdGg5xxTE5iW6wf(HydC`}I;pytB{s8HO6-9PECJt}G>?9$snU+Mdp;Nu4R z7-)1*lX!25Lmpf-W~YhTzzAzR7m28SS@%w>}9A99O{hZM5)=)v&B zo6ap}U@^0ovoP?nfiDbvY2XtBpBngF0y5LUXWagWwAs>~(U>Jwl82(2En?w6uCj!SUFg78 z1KSL~))PAn>@~2@z)l0Z4D2?rN7jzcQ;nX}e=Z+`P>f+H4r==iaJ@(l88~d9gc&B% z5ef~QHgLwkF)?+L8O~$YzzOk(7Pulr76zHKBROl}oPi6X&#+U0^Exl_XVOyPqKw6H zOPYX*QZiO)GYliwf)`2_UN_5`C~u;^i3TPrn5bxmSzTMOl8I_2s+*{6qKb*CBIKpH zIPH0FKvKg*O|i`U=XJT3=x|cSt#zbY*F-%b#oMQ$iAE+aGsF9e#wMDWVdh_AqN#~y zW;nYxCYqaJ`n59A+C&TCElqIgDWn1kC&)0e+SUx0fK^7|QZtN0aq7~C%T2U1!#&G^ zc%u?AQDCCbMAU>~!ZcB2B4*+N6AzluOehn#ntaS4t}t<>i5pCGG;tNX9MbsspleND zTta@0;O&RBzK669^!d}U^*SNfo8dEpSf$#HCOVtA*+eJNr{pFR{-Lnx7Ll+!ISYli zo8Z%U?ly6ci93X|dZ&rI@_gbUtqZMX!iO5&Z{l7P_nGJ_l5QMS$oxav?}tK#Je6a7p)CB4}3SrbnSf8wzA46Vu2hbVtegnTd&pAYuDiGe0w5VP)K?L`wWnHXe- zj}99=fKs)_bTwA+tpubFuAh&IGT>PYzDvia*H zZ;qW4j4 zni)Q6jn93$`KXpS8e0B{J{;9PW?~!-AN@o=)5K>c7Mb|o#4HoDO?+iyo{2doJ~zQ= ze?f(#+RCHhl;@h*a#W*`{7V_`;!$nBiLXs8FtO0YH_X6k+P5aY6Vm9I#zM)pLddD` zi15WGmY7&ADZ13eG83z~h{wX^UT$LaG3^WCD@?4EO;p_UiwK#+%CjR4@!~1`_5shx(%|C@kb_QB#%UHoNcl9Iuse*v=RSC*nRVHjjt;`%Y)rQ zDGO(hYv)XyH*vuX`Lt<;7ftAyC`$<|BqasY-J+!}l(A6WLcJ4OS;2A^7IoEF+8l|o zP)=UK!s)IWd1VV#EYz@2(?V4XSDes#ep|$#-G4%>X7Pvlc;SRLYkQ23&^WcGbnJDl znFVr^mKIuBxW>Y@7Ft_qW1+x8A!ltDwYAXB3SVY=i3M$P;iXo%b}W}!xIEA2EQvKb zskOHdv9NPn?5dL*-vAr6P-KOP5wpUVit=rqEDWh;L0RBiS!wMG3s+jW%EALDHI}O_ z*eA6SC$%{zweH=t4i>JnaGQnOEnIKm1`D@X$adH0Oh+rsw421S8!dDa^5e;{sk4Qf zEmZ3l7Um4``uee3Eii!HT17j~j^1J6J`2w0kvlEiWrZnsH(k23sEdVrq{>C4@Lmz_ zKdG^4PB*Qq6}~Grxjk~fg&r1$T6mpqTX>KQWZ^{%4_SEF!c!KW=BzC|YN4-%C)m0z z*3$w*)XNHA=gOC#_O|etg~u)QVJe=|ZaSqAFU=F`-@#uITIk0ecfRO~ZebqsEvS5b zEyMndg=a1PwH|rSLVtS52WuRO^*$AbcYsu%w=hr$CAZwKy=38KMwRomFvvpO3SSb+ zcke#Xr%1QJm$w?6MV}(RW7j>UnHDU%x-G`SYJwdP$L`)zn6;3!;9Br3ymv}t$q4ZU zQx?*BIbTE@Sol(Oh&ca=^kt3wwp{6Qppz5WY^AQ#d5qa)h%RP;}S=FBW{KHW%Wk z%;*@e0z&wbUkXpLBhPJ{k8i~p4tFG0%0_7$XSr=HoEOh8S}0+o{L(mmXg*V(w9ZrHff#tnA(y61Z)7u;f_ zqm3JFbfSghT4y^v-fyzQn*m0Nm${ooGVQEJ`K>nCh2=IIx99nav)b$dMR!rn1~=y2 zl-uaSA%xy_%nv7%K` zKO0X8;ajj-eOA<%v7F{}!r808kO6}A&S@{$c+tj7cKBv?-eAnWU+X^?;q8+V`6_@eE=#+Wc>h51!8wg7J^=-F{Izx_|C=xy0JCZbEr0QVwB$zWSEU~ear@D=` zHkNS(yG2*hs~SbiZIr({#m=+m&TBt% zeQo?^<99ifW*;j0nFF2IcAeLLvGJ>oQWv!57qsgxXn!zyy7K|l_}j(?8-GfnlXQ>B z4B?5r(GIWs#h3ekZTx3r+F(o{jLkN-(0&?=)7WZbn~f44N_yCCV+Yedft3mDw6V*^ zN(ZYP?6$FoL3Z$>gS|HPF}x0Laj@UU0UPIST(EJ_#-kUsgBP^pHoObkAsdI8P8YP_ zR>zLmI7&~ra2K>?BH4IBJ7J^DMeU@GQ%nG^!rItbZl85Ak~30mbWuCUEpSm|x$UBM zkxn{j?x2N(k`CaYii4^SdR^2?IVkO*jBx9sMoC!*6&+M^P|g8cS;{-8APQ_9aZ#%* z!eR-l6tYxvP{Tn@2h~NBIuzD&P}@Oc2Ti0}M>-aFsVkCtg7qCV5YkYP9UD0)w$M~0 z|9|vmQk{8GYw4hsgDV|e<)F2LHV&c=iX60caEXJ<9kg?Bse{WLY`CbYHL+o9V~a0p zEUdN{VZ=d!14@dU3Ps53fxKEw6s{1tR%}O*`ZP zQ`W}rc5twRHe*e!i-UWF7gz6faG!&&QYayz4#~|WRCfo&`vvLM0}dW^@Q{Ot9e)0= zdI~<`U{(n=ri6M_s)2AydO7IrfN~Zp_i?bKgzD?y2`5avKT9Yk+mjCZJ0R)j;3*+b zJ9t(|r?s(XxDe}NY-M@Q2@{pV0n+-s;6MkIuu$P82QPD)4yHO7G4D5)BhRF;FJ1J{Ag1SqK-CX&b#QXRZ5c3Vm1F{C9`#(^({JS8M8Nc|u$ z&pOBnFYfrNgV!94b1>e)5C=mYyzOAPgV#CY`q-S3Y8WF^QoZ5eO$SCvHM*ptkmW5= zxZ^sFe1wBh4n{i|>44SsqA4(?nNoA2Ng2cHU`D>#$u zE`+V0IoP*4MlxF@a|G$t=MHYv%dP zP(Fe64t{WO(!nVQKRWoy!FC5b9Q^Fy7Y95)H#_)M$RFI84$`}0zX|^Cp!hib)4^XN z`PaeUdEq7p8-@QPP1NM68}?lt`_DmfU!KpDZ*j0yG%4IB%AY{(bg+=$UUF|b*u_hL zRQCw(qZ?3r9dubAqt1R29_FQ$@qs$z;E02x#X`Yyr9$~J;m7}v{Dgz1(sbIv6{XY# z2NxZj5q?(ioZxvuo@vzCvMyF4fl>*Ou#`;Two(d$td@*RyBcY2~-zJO~D!o3@W8qs8dTMBotD)P6Bm> zyi!WB+8}|32{cQfxu`Wtph;f8u^6Ea`!-F4Da|e|@~tg}6t}iYptV#v1eH12OA^o$ zP%@oM6Sypa%M)mqK>Gv=6Nn}dk){H{g{#AWFdCe4kw`|YiN*3kIJ7=&x*~xq6X=}4 z`=!)X30$4P^$FaNz%?T2AV~MFP2lrV>ZekQYS$&OTL^i_1a1@^o^q_RbV}eRkyI!h zR&P$=mIQ9)=n32@^4k-*Lx?5{ytvSElhW$0yjfm8x+HLK0@D+ik-&WkbWPyR1coKh zErITgUIOt1?oXgc0#7CIbOH|~@L&SH6L>6vhZ1-=fu3|@W$Y0ST3WI65qva(VnRu; z1dP&(I^>Th@I(SnvNeIe(vfN`Y^ABg8 zfeB0&3tyI2Brl1=%Yrn>p(!Ei#00Vl1DWj-KPJB0ku?c*Tz=sLEm%uo#cmfj= z7|-a@^D=6bAo;`uSe+zcC!qr4Gg*X;{}dt91g8p8hpjAZ{V0Kt8Lm~auM+qqfmSPG zvlC#zKNZgE%mhBm^I1YZE~BV0hxweqTv7glD1-*t#KKjcm%#i47MD?9bB<-yLgC*e z@U4*V1lhVk$nRy;q6EGt7v-f1{v!vL2xni;k({_(BqS8BN?l1}{Vh%P%c_l1rJTZl6ZkKIZ3%2oV6!N&*A^jE*eZ5tMQbB~&*`L5(;rqnHTgxh1IFP`>1n2;LK9u*0;~q`mm{hALaXf(& zJiU`Boy4;%Vkeo637kvdR05|HIFmrHvTA5qMKY+YB0rzNg#=0@LE%M4bw!M2Qdvc$ zq+}9E;w!1H6D*TN*(53?QBmxd6D%*?i+fSIl2ofoQ)S^*1Zj}^)kI#b%=pwuqGs}c z5w4X)ZQ-0Co9ZP|KZ)&S)ul-^NTQ+eR!KBUh7n+CmPF$`Z<0h);S6SR_vT5o5Nj<( z&ZshswAMO_66I7I!L~_Ul0=tlYCGmI?eUf-us+9Ci;z{982!2>jQOMFys!t_REPqC-&kBAo3jLE9ki_#M z87N52;_f6bCGm0+sU*@#3`!!NL{fBgK{E+Uh#|K;tMztxcVwBGj`RDn*bA`}8o4yi0KZ$ulxDXVwXEUBJX zW>XE}?85G~-S9@GJ_mJC#|`i0Sgq@ZcbN60i7{#DqLGVcE}FY&EW(!(XzHR#UZ3|} zR4eY=!bM9LROpkxOKjza_a0Pe>*5j@-Q4hxg-cyr=HfaR*SomfMLQRYUb$%RB0>wR zVnuG42_yxa^@>=b2&01RPI=75YZb!9)m$)Dm<(4+>(wr<5ptDavCg$FI=EmKu@p;a zg!f1{xVX*5?JhdHxY0!?7dN@M*~P6cI?K4^w+LY`7J5PpM7C0X2czMli;H_*+$CM^ z5#_tZH|iHF7Y}-$SZ3d@qRCr0CSG?J_q*uf;sF=ET|7nyR>mIW-f{7;`@j3cM;I{| zy`-t9;Pd(WOiqFKki40EoJ;10H;w&7p|6W4gwPs;|D>!GIW>t-xnUQYde+5rF6OxS z+(myE16;gH&s|Jp_PQA4BJN_Ki@6ol3xXssa&hzgWg*9x$8_3vk#P~YFkM)*?;_>G zcHy{4x^Ug_9zNlQe-5PO=6qF!@OIr}7rDJ>Yq2Cv2l99C)XYkkoQqe4IMOs&c(EFF zhPW8&;yoART)gh$4Hu(bjB)X%i(xKCxELu(TTk#U7jL^5E`_PiXcXfp$@xbmu*7%r z(HkrBcNu^AONaU-<6XS(VycU2lH0s7p1`2Fn8YP>F@=FGqdpM)P>@x2+*l#JXQrHd zy2w9v@rjEW!avGuQteY0GhKY7kZ~BNbE~cC4ss({e@CxT16ZKg#2nD*W^8?q=Sd+JY4VL z1`*!qp_7M>|3`t=s75*QW)HW}vWEd4ZuM}Rhetj1^l-a}JGe$3dU&`~+`ikxJs$27 zZdOtZAg9npX4=)my+ZC2WCYmMO?Y?FXSFyo4|sS`#-$w!AM)_9tOY$`uSZ0gn!QAa z`Jv`>&ahZM}4}CqnUP&>wPlyG2LQYeROg|4#d3ahhpYy;)f5yYJ9*RT9Awq-K zX%j1{=RFMc@QP@@;Ne9NrUy$F;w2B8Dk<2TslgszrRSB^ zYckwW4@0C%$(@zM<$K-38`9LfvU*bpO}*`5xQA69R(lxXVWfvoJbdb5l!wtCCUB#9 z7~|m`3Elf1-t{on!+7!Sz5GgzlNF&494lT~4Xqq54JSgJrdpBUwdNsiJ=J@T-UYJEA{(_=PD^ zMcqBzM!Yv-Qdg%5;Aw%8nt;jav+XX4y;bG>s2+3{_dpsOxZoePd>tUa)*HKxQ z{T>bpIUqLvD|;^%xJ{8=@p9Je(ARrv%Rmp7wA?^r^tHSk8%@ z-7k75;p1u_*Z8RQX0)V_YCfv_fR9o>O8dC9s;c1Qma6LA@&#pl-s={W6)Y!MUJ!#L z{i>>pJ}UVjVW}*nieObge1{r^HGI_c(b`8Fj^(4ak48Qk`>5liu4p#!(RXIFo{!h6 zs`@@ECnJOE6-}zDR#a6DeGIQx^lw!~Q%!s{_0iHt{c5TiJ-?x-g^#mURdeCPFD;^k z*m+Z=sG4f!vctEMjZ(cTY#^48AB=hf6x>muLX z9(I3aX0*^p)JKtz)&CT&ucmfZQ>Cjb#^m#ZMZL-w3_KW7K5ne8uH>Yut1E;*Sv_?4 zDj$XGBFkq+uJzHu$1^^j^>Lk#>wWa_@qmvTe022D#mB>c6yE5g6NBvIRv$O{=sK8?(|V^bKz6nqO3OcqHpeq z+${?C2vU>3VZYbMeLlMS=*DROT-aSKKlVl8x%1JNj}+bS!}+3c*N#Y)^05bL*2iN$ z9;ahI9`VuBM=u}qt1CwJx9aLq&T(+$(FKJEs;k~Un(ru@(WGef=aHHGK)O(MC%nU23SOd^}x4JY|MK@mdajHZ?-9wQNYAC0CL9T|H`}Ngr7sIUg>UzNYeg_^j4Y8%q?VeB4n}jU5+F3#q@Xkn_sO z>;l1go=|hqCeN6CiMJ?5}mbz+aWWj{U(Mr)FPSIo^ANbhpV~dXu zeN6GOl3jdE^)b!Im&|hpxt5ylhwmVsP3L`lg%6S8|_UZA5>g@+|F7 zL6YBn{NZDRRQYyhN?O!bf8|@*v{8Ef<71PLe}(@i*s-?iQ(Ms>aVsat^DTwODQx$# zLyng!DeM%o%g1hRidRd}=RH35GNpZ-=B~HH=b`QM!MB9(7fn_V_&Dg}kW>%*IGL9p z@o`l6F~Q?``3Yu=M1y_*=oUT!=8TV$DgO2rA{Cy2YfgsG zzGf*U)k=b;Qz#>(tYA4o>Xa8!L9k*9`*(#iVyP^W`L$Km6so20z|WzudI~jCsF^~o z6zZf9ux1^_?N6jyK?;Q_MCo%K#nz$}Mz@PKKDRfNX#uO%x(r!wjQ!0G$?{jrjs*d6lX88UH z$~&jseDv{MDcqex_f+^>=6h1;BBUEF zZ;sxZ!j#`4kt@TutKXMG*A)1aIsVXiK^^tTxXAA)V3!7qA`hhSApK0ELmCgI@Nf#> zrtn<~kEHM@Cz!&R6ndu6D}|R+7?i?>I_gjz)jNg9Qg}RtKFpB1>KVblDfAQa1oOYH zqWsAew7RO8Kb6AM(t2lIMd7n4JSWxuDGU@cK=64%_U%(wy&(L>yyT@6EHTU0cnWR` zUJ7~&Mhe5~DpSy*4&ywoz?LfIQ|hWjo+lZTx{5+Sg>UMrAcd@uR0==WRcYaw6n58D ztmdRTB!!_VypqCTu0lQaY6`E30(EGCh2-@V-bi713L~V;n}TnN&0(UvD&}Bq5=zr$3&Tgfu-a` z3MWOGRSM6faFz*>4h^0Y%?pC(1u3M#i^54*Etv*Hxl}qFmli0bw`I~On?|`b%BN8+ zjTQA(1;I*bR7_)YeN~Jn>#NFArKF0Gs)Ec7cB!6Mu9Xfyhc6PWokpEB>ZVaIjZ4$G zERFhURBfOdrO`Nz2I(-n8m7TT=PGlTvDze!=4rH$rlx5$6GC~hPRled5lO3bnAA-qjc#dlPvgckI;GK7qQTU?DUI9GxIG=7sGZZe zSqS+pY1}GP;IT>nx!>QPJ)FiPLLL?DDM)#7o-lnzbKNI1YZ{9{;IS- z7Egy8P!}`=Sv48wx~h8v<)o2FV`Lhm(nzM^rtu2buCDUZ;pv)6V?cv&^ZJtWBJ3SN;_X9xOR8_D zQM~Vliw@_@O~+QQ#b{Xwrqld1#-#C18tP`@-# z6VrGEvTEO@v4Cd+ zGqa&uC=#X|gFsxw>Bxm_Ng7L;9szm;SSFFFkwMK2mJ45z#>zBSF{Ei6Pvb-yYtneC zq1u?nKWVH@V_h2S)A%8cKe*@()sJaxSs7#bMXEmu{+!0}hH834^{cf0md5XCeAiG> z?YD;N=!)0|QTsEEzeHhwL-n^v?p+mQ$4zPc%YD~K?N8%BPKPPVOlYK7wxqFL_*R}^ zjTFl^Zs+eKnzZgnW2dz4%Ig>F>`7xUH_NIR%RbIxL5%VPX&g-BkPO7Jj;2934)f$m zqi-X{+ZzgxQIYw8;Bqz$WTElL31@o56EJsMcQ;NNA7)ag^sX7$}~4K`Joa7&<1!d83C}9GKl{F) z!32?zPh_vgisXX~KFr`u24}fO8BERKuMGZX{4OX*U(iTX+ibDL)8WiX$6 zq_N_HvieOv|GyPN$-)d4W$;4=KW6Z~2$%7Y7qXanGPz($221n37>5+c!-kqJ-H4T66P7B_9o z;GYZ*XK*BgO&R=~!Csl&f0Qqe?Gz;0OtX2uHG^##Y?tbe3~p_rsK9^_>FO@-qb6!M zQ$iHjx`T(m*rd*WAqNBxW^gDk=LC;t!b{Jom9djTj%9FM$O+M56Lqdw9Xpl5=?q9h zzA|<$gYy}*4-g4(fvJ)~)d1B3lnBB#Dixr#kdnOSE{`Dy4 zcy%ZrgcpKxa`+of!n3_nfXdQDP6w*wId^pR05t+M4$veBkFuHpY6qwjga=wJkucNh z2B;UHkyPsoHV}NhNtlNXgD@f4mzOFcJ2nl_EWl+lO7j3M0=@+dZ3DCn!qdC8U@O5% zP1Hh0j3>67NS6for-|YviPcM~&^WvYxIFJ|y8uU;s7g&$L4d*lH%kzr0g3`#8-R(# z<2n|Acx3=hhziiUX(+#f^J=1aX}Bst@xgv|fNMmDt-P9d2yk71>jT_C(o}U0&@lkB zx|86If~@iwyh%9s8g~}s{76%EOMqJg+{T#DID^SEu&KI3M!Y+~os={RC3giNa=YCV zgjY}UE&*O`8aCY*plcA`Kah6|z$Sb)blVt_#b`UJ2ZD|#|OzX11di1cM%<+LXPJpV*U zo(k}EfKU5JUkLDiQ}s-M{s9IsogOQCR`5Am?h$46>!#|jrt0|s0|PW25REp_SV&%! z?zHeyfMZP+3GGlG51j6xgE`Im8p)6VLz$del+EJx0B;2N zF~Cm&-V87-z~_u`fVTp?9bjsJY0S3(BN%}I6N2zXkRv&IfH46^F;IJB-I^)lOU=|f z0mcS+PlWG^<}hg*$6XdLTGdQ_(oBsHK&1XeA(I1qAgz-E&<=Gz3@}A3P{Llt%50i0 zLU#N#zzk+WfRAN}oirPO$i8f){>%WMiSn!fvjfbLR?6u)u~_Z#SoDhkO9Ctn@Ff?K zsrz_zp5S)@I!}tu5Ad~ADgTDazbo>sR7ogV5MW`xby0xtMPadYWGgk71y~;7rXbqu zLea|RTB+u0g;eKPEm#>~6+N$7uv&19AggNwtP{Ro@Q1v7OYPXt0e%UvEx`5wzjCuz z2*0oYhYkezod;b-^#`|DCG~fJ4FUcP!v9_2|1j_i_rC%VslQQ#{6fD~^Y9-nHU;=M zz<&WY2jM>_@VodeJVh(3YnzAvkgzrQ-#;hpVCVvz32;_M*%e@KfPKPu2iU`-tdinC zKM?l^I1u1ufKveu1~?SpL=gT<%;5l3I4Z`E2&a8Yj){aL9_KkwIsC@}`g~XOko0S= zPIIGGR8DjCMssye=6jJFGmG=wBNw#`g1=W(~XtWx=M(QKDR`@Efqkb*1< z^OC3#zNA~rLS@l0iyO1Jf{tZzgEUl8lfzlx zlSLQKE{pzI+?&OHS@h20u`Ie~@l#u^x8-`9~a&yi@uC!i*QCyh~(&BMK6C;_@wZDf=>xj;pr@%$@6E0 zJl#SK$m01d2Dea|ECyyV=0t@2#OBc97qWOUi*f|rgXj)$r1sD3$;e$wATMcUZG=I{Kyz)@oE;Y zWicg-saXukVsZ=hUKZoB7|Kfk_f8gXa%=n$;j8M0<*khp@|NJ+g2S^Ik#8ND#rG07 zIxt#L@u`rRf}aV_5~PvYLN56+^0|7+y1Zn47C+?qg7PJQ&f=FWc4e_Ui(j+&EsH<0*dPjCOZB^K z$?+{!<%N+yML4ge`Y(&Wg#RtLQScwZO@jXla?s(M!dGi;mg*M4t%BRK*e+y;Aa!9S2_`xg=2|1j_2_Z)W+5Ko1$MXC*)g;=K z|F^Hi=`6PV5uR)%ayTP8XY-opxJQIv5WJX|fA=g(=D=THm&&1ZE(~n79Lfl(C`d_J zA?0!?pO;i9R%jI_Sfv~)=jBy|RL!CKd-DBn4mCtlQ?RaJtsH6#Vc$AAv=JlqL{dL5 zZ}A)&<5My!AnHKCQ4XHF3+J|4()S@ND~!`OF<5WIegSgMMXYb^jT%Eq8wt%hnsV_MI@bbpu)h`>ed`?%i#{O6Hra$RHhwPX@}(Q9NuZIy5`VL$UQl95pu8K zeS))EE9!L5;r<+Y=kQb;)gy-oa(I}x`Z+w9!^+mGavSwf4*#@Pr&_BPZPb-*6#1h$ z^vt1`DBRUXQH{c4@|f76smF8ZBfM{3!tVXZb6CNSIXs=iGdaAH!{8jA&EdHm2IUaX zp??k~Cusw6$Q&y?v>?*uSftih+Vjk%#f1ZNcp-;G8}*_f$xAuBEPPBG#i~xXcNQ8s zm|VM`qEl)VuxjN%JAMwfv{K>-NeCvHEz=`z4qgs#j*77L5DHQ`r0GBopSMv*?MOC< zK=}GLYIhq&VNR+Q+NxJ`crAzbbC{6BkQ_MT&>UW8Le`G;{xkXpZOU{;2oB3(xH$F} zv$U<^yx!*YXJ{nsSooDTQq(y8Q9?!wj>)0yhUhyvyqj+wo5Oo~K2FGZCP`bxjD@M;Zq6S z7dd>H!^|8$lje5S4X zHivR2BhlXMX7>cZcDkzO@a*t1yq_{5Ru*$5Cj2HP!yynD4>9-ynPRU-g{>yYjI+AK&ET zU_SQbF4l1ZeR7nU+4Qb1m0OSL~OSu%o~|rsG@i)*P(nI z&d0a;IKtK@`Zo&lP9fg>`5hMp1Mftbm!Tb{hyT)l$j6WQ{#8rI1bJ(ve=j9BE8f6% zCd4Z%i6`=LG9MT6aWNmi7E-eGkqAAjcKO1^&uU;SAcZ^z%n0s};JG(pi|UpLibv3NPe8A#cw-W8VY)ejJF6;^5)s_CJj7Hof=N{s zNtp<4ji5pV75RAKeBibS2E7=#BjR5xce`NOh=1u;epN+zIVrtU@UDn|h1A^aphXahATNTWRTZxv3`YDb8F>j96N`w< zvXsb+$W#Qp9jkW4zdVhG)rt7GuGNj8UIf`*Iyn;+8b;74f>sf}Xu? zNC(pG25vXdIf5<`ycNOQoT&)9Meuk8Pejl?f*uk7Z~B-B8dg(1BN)n}YN}TRy(8!o zLEi`lM)-!TQ2%P`+WA1g2>3HgrvCJ^a0;0nBszlyhX`(2sk7EFx*~!R5sc)VO3UeL zYE%U6O6r-J`iIpNvmKV{yQ`_O5sae;BKZ44Xp-RPYqf_Xm=FO8(?lV!T?#%T>%!*?GE3nb5xmJ& z909LfUKGLNh<^h!i{+RO6~SIEw+Jp*SM{gq2O^lWGw^i;`-PC-S;Lp}%_fH;I2^&12(Cu(Z3IUm zI32+mdLV-DBRIhzT%_}ThesL1HPnw09ODjCL;WDwh3`SEp^np;jF}qh=Lj~}P$z4s zw`wS6Pe$+y_uHE46lc7I&UPx)RP}1Avl0BtU|yvC8NqK6oa0EhXcy@J(%O09e+d6w zkVQ=7#EXKL1bfz0e?{5O7%DEMHygM` z$m`GR)TuE%RMJ2x1Emd=F~Ik>Fx@JIwf?KA%GXk54cuX1gn^L;%CX2mdjlN|+-2Zy z13|;ztnM*z`kO#S1NRyzZ}6=;+JGN|6$}uE70uhaU#n!`K?4sNxX-}-1|Bd#VPymL zYN>;Z^?Off%#v3zP}M*!gO}0iJ!+|H25K50scxW#kV&6v;4l_m4I_Cu9qw42(7qWkiW>V+_m?GSpYB z@(n}`%rVeAPrV>W@FE6nx|X?FB^Ep zK+-^pL9#jI8OR!#Yaq?36v?7I#l#|}7a1D{#ti>oqJ(@yo_f{5n~a2@nrGlO!k0F({77J+{RPPvA!XbN@?O~~bWd^FpP$P!r238n& z&&K;U-X-BkE!Y;`H}C;XHIX&(A=d?0oQeBQd~Dzo17{4J<#-LOGVrB=T?Rfiu-d?S zT4LZc`fzh-je*ZOsJlZv7qiyDI=ZN|qP)i4A>!IXTK%)yM#hhUZ3ea**etcSa77#b zCzf<|?TMiLxexlab{KrwdV!q=zL3(NU-lazGA$3P-3Im;_}0J?E+_+g4eU2?fE$Q` z-zS2fSiWX(mh#&n|9y@2je&y(4jDLXpkf)V&Ef!y#;w$Oc!Z0KcCz>H4190k7XzmZ z95rx^gPn*UID^%-0;}|sOZ+NS{*i{s)c+*-v)~EAlY)&Z_>YM=E*?-iEn|G%2@MQ{ zel_r$f&UC#H*n6tc>{kM_=^S`_=B^PE^txs0vEF34}p!)Eth2YBO)R4%Lc9(xW=uX zAuax?^>FBK?v~GJmD_04p@kDx>HkX6V(|loH<>74;tmt#Ou$4z6U9svH&Mt$VG~76 z6gB-F=Eh{*=!jV+4xH`ZY~mIZB}{)dDJ*G%t{^!dRHdXMd1(`6gx@N7o8axa(y}J@ z%FNzr;w}^AO;j*(x9LwhjlakAV}=t!<10@HRWxz0iAvH-<(%7jIEaY~516QIqNj;o zCLT2LkcrwR>X@ivqN<5J6G0QzOjI{f(?l&3bOOi7iZ!G`j;Luze|9Jdn0Wl<5XY;T z2$|4LDANzQu;`zk==)?x#-DM90TZj#HBrw*I}`0q)Hl(SpKn~ClwdYDK}(DFVCz4yLWW}{Y8Q%7IcKB=JfHqpn#V=xd^%iQy(jnCNd} zfQi8-hL{*A{SFdjUB+Hj&G+_DdV7`5G)#&}+RBWKG%?D=I1}SdjOO&27|VfZ>e}Do z)aBsPl{)Kk(Q%j$(^Q$?M@?|$QiuOaOqA9p2|mJ#&HPV#tg?5F_PB{BOiVK|-Nch7 zo-*;QiRVmAT2$a^6VI5KVuCGm9*1a(4Kga$%?!~qQ)R9>n>PY!hKZRb=9qZFuuV8(sw)^3j0sXX&UKOF zPY&@zE6IrviIrU604r%J(bNbsRmT@_R z)H^2r)YKBL_h$o31rOuTR60}~&yVn}^RKhM$!&eHkfo=G8< z2r0I_Go)6UI2BU!Hw0I4(+I1oVbwgWKIKdWLR4O3;&T&QOl&o=*2Fp!n;3PA^g_$@ z^(Ho$;J=6cSY=gkqi|-Ygw@=z+RSNM7^}k65mrBj z)fXnpF4FlTm|b+&LOnA_ze!hnxa4R1pV-UmYM+U(OJ!Jt*Zac zIKQCt)kS=h&OcmJv-N*X{3nEbiLMG*{)Se_LSYNAP|(758n3H@O7X2sMJyDxP|QMc z3lA#QM5!UO^-kXhZ?TSg35FnpAnv!b6t7E~-#iTeYaI7@X9vYWa~iw6E&o`StB^cF&$K0^Me zt@>LSVEM258f;;pg@#M?8gZp(FsQq=+u5SWVoBCJa z5evjeIm})m1{nDtbyS(U>T%Asg{Lg=pRy-7S#?#1y6R~Q&sdmZfuVlquR%64qON+o zs?N=drBf|Tlj+E}Fx|oo3$rXdPpqrBd(5=(a$WUNUG-I6HJiaRTW5N~!f$oe94?1? zs_bHY?f%dM^;E=yA?-A-r%VR$B0mQD)>Dp!C}Y^hoi<_?;ugNKaL_`+f@@)!h2<8K zj3NuKTbOUbV~|^Tg&ttoTgY;^rwxn~FErP}@lApKe{0p^ffp?tnxe&i2|iIzG25m+ zUn}5W;4sfZ^-qGYiDvfGK$G=ayq;QM;SCFmEG)M0riCx6`z#6&uhYEZaT4CW`3!5x#w(uT5{BzV6KC|!v zQ##5&lg3hsP!>>DY zXXw0z-?<*AhnPw|6S!#Ml7*`l{>bGE~||8QY(`TLm{)*2o*53DMzY zZQoIM*nTLok=CCC@3L{XjR`g;+PKF?c^fTlw6ambMnxMnZPc=HuZ>E!AAS!>_4{nx zZ{q>m_Z~e~+4jBR$M*9&=lVe#$Lp!3ZL}&js)|lE8}urptGbPT^FmBDY%p9&0ygq& zG^W9BAZSCgQO`zw8zCG2)>B~{x{b}B2VT2hQ!-cv(w`rOXi04wb;Km{y5dg~8q+{r z(a;8GfmvG8$Oes}VH|!F8%=G06*QB9G#8{pT1YLD);8L3I5q~_XltXLjjnXK4bDh= z8=Y))mJxNZ(NXMSn_ORA#Gi}=PSdJS{ixt4dg4isr8gJvk^EyXCeAoteFxp8z$;Kl#TpLLnkJ@;QGi76zjmb71w=vbmG#gLY zc+$oc8Ou{P=>Ml}f4ksTM$RSwjO{N~Zl?t%g`TzXoQ<;e6{oMm_|SCQUj^I;W{3}| z#^uIPdEUlsn~!v0iBIO(c)aw*jA8RAlg{zd&y>?(+lIrYI7ib%dG*!M zV_HmBM_f8$P$g`C=i!hUGbtOMjW^hZjkJx7jhE?s(a+j=NdjZ8WU2q6SVF>B<*Izu z#ylGfY;3$3s8ubz)C;{Pny=fKFNA+Mxc$=qT+5jyfrT~}aU$3z<9}0NF;``m&^tEv z#{+M1*4VqKy%-PB8*~mkT4rOpjTI7v^cBPMT^sy!@a>Np9mpN*0~;T5$B5#VC_b|B zF=O6AT?e1oSjo-7LFaYhRW?55|#jNSEU*#V$B9>kBzT5L3zBzJ>0Q@+RIREpk_DlTl?C^;aj!+oY`MP6dts3 zh-0^LK^i}7<2xJQ)8`G;w;WUhbwuoB_Na|xHh!^j%Ek{2HXA2woTQ&^{6w22mAWOg zuYqDZCs?GRVkxsMrOs&^XKegt6N8(611#QD~KhdsmejBL2Y+M%dK|}TA>Cjag+)({(;~JOD=@4DSM794Ilbl%x zaC{Hn9~N{_*zpHm$U*%^s%IlLd|;@EgU5x_jl~=kcW|?VTO8c) z-~k6E95{{CZ4PdCP|`su2k$gerP+QXb*qCi4tCbn+P4XBYoz{bq$n)w;0^~B98`30 zPh(Zi!JQ8760RDnyG8#V2jv~GN{_~hbvXr0Z0BAFl^op1c)QcTU5a-=kxXptw@jNW zJ1`sj^IOBggAN{YP{qNb#i42)=HP4IDIdFwwyz2aOywcF@H^ zR|mzKs3s0tI%wsfse@*;u!(B!poJ8XQ=wfGHL{6%zKLq>pq+#E4qk1d+Bj(IV715( zH&GoN*w5+>%W0h)tXvl8=%DYI&}BBhEZErrkwx7cbayb=!4L;M9Q34)gMJQrIq2;` z{T;TOs@t2YU{lq{LAR#rk)~>7EYRP<05;xK4RpXP?OE7V{jf!&WRS?$G*v?#40ABr z!59a_9UN?`Mo^j7)(x@QQ4TIQRX322tjURE9gK4@UTmX2)58uXNcPe~joC*_YwYe3 z2ah_K?O=|B#~e&{@Qi~gGP=hdJjGCHrk-%{q}bNBzs@1E*3%-d-Apw(5`Nafa}H)W zm?>sVbuirld!HuR8^+Kcx`>IL&T_yJF+DGHL1SLvOf^#$2kRi;L40yhp;Ul6H_`@HA7~ znki;aG*jdSn=4j%$>BSKamc}82d{AI9em*6LkII5yv7ja;&Sjhy;NFz!@-*l=1V)Q zyFdt=V$nh|Y>}wl-&`$r@D{sn?vI+K>~V?1_t0U5gF(&JG6$SrCQkHn_Io18;nNRK zH&^dEc+bK6+zI%!YqaB9c*y0QC!MSX%(HrS|2x8wY~^#aj@0F0SCV|SKAzHcd&;| zIiLYM9PDEH_yekn-FE+Mp*Zs#i4>tLUQuc~Eav`_<1huAMA zTvkjcXo-VgxV0h~GZMOVHGA<_dMv<|%Ypyq;GBaC4lX)4FFGvx!@=)d zI4#tMM2KpfTncIVC2mj-{*rz%w>sK1#U75TLmsz?+?qbL>yIU8Z(Sc*r%_`jp2 zs?$=Hh@xZ^GoqLoMX4xCM^Q71T2YjV;?^kcjiOQ%w?+M9W#yuLX)kV%;+cawQ&}N* zND;H$TB^IExI2n_L{9w?Emip_8n)CcL=jKv(`)JE6{DEiQn@YF+btD;#&%y6_eb$S z)c*+_Q&l0Aqj)eUd59hmz9FVjp;{E1TB_=THKKUpY^OIHjAC>YW1@KKsMeRW5XB(j{i5g}h0{t=J|K#B zTB)tA)LQ zFAb6;qew;ZSOe`vM)k3P7ez+enY1ySj`I9?pl2JE6$yV8IhQfBMCYM^m!fz%idWe3 z(}7pHrXJV$lhLK$2T0~|Wxe8)`B5xjFHw9D#T!w)$tB4-iee#~%>)*+yEbZ36g-Y$ zZ4C1lv)f+L-{Jt9>HPKPk|>sn+PhJBZPYRu;EE{D9t$jwf?nqIF|?1NZVdHeSlmJNz7VV*LxUJdM%)r^ zD1^K%-55h-$u^0hSx(+m$gTf|sna}$7Lsk5D{U1+YvFAKCrkU(jCD}w4{06f?HHbl zp<@i4V(1)0mly_9^V?8Y(cjoXHC`I5d^yl9hVC)+h@oc;%rfW;8ekBg3|@5(|%=;$e(#XAH!@Bz7)fp82%fsCu8{Ge3;~g81iF? z#9)X#DrgE?g0>(v9U&KXhGIEMJcdM$yD_YNF+{bLwCo9{1v7$K!MTF$`o$Rd#&D9C zV|XQof=#toxhnq%(BOHJrQ|j02rvIv`0K{n8#06n2~UQ!v`^Z zD4b?|EaW3Dw=KR^OrNmXP5P2pK#1HijcHoQ>gE`mLk-E`}c&{KCH%JSuoh@P`Nv zPm=vb@Ml2^PY5{~;~N|_W|>aKa5`6dhWp8e5QV>qJR zNywjqe{sD`39$5P41aSgj-yoE--WL6PevSw9;%L~>-@BL!O08mX z6cR#7VIf5Xi^j3|fIlO}bEP-OaZ8Suh@-ExQ#vQPBaSk{Zxy^v@b+A3**NYv%z^?z-4k7N2o{YI@` zar763-hzDuS=3iZzc?0L^J@*r$p^+UD8~oK@y*kI>99D4$MJj|v*Q@SjyOkgJRZlT zRl!k$;{`_xj)`Ne5SEVPru0RCgz4cpCd4sOiY5s@D)>kosgCM~&SP<`5dMS|O%r@F zj;G>yTKKbqRDMRtlsG=U}t+H?`l5S%GEi}63rFWucy&50u(MeF95(kA$b{vLqGbgcxbXpx?sUtip7>oN)+9`B%nwdC~!c#ekCnOz5wy{RdtYqir zN?#Q6QXJ=`YZ~@y9Ph{RK^*hqnA1^vEsodYm@k~!#X=Uu@kUPaW}Ihvd`+fBaj1$R zlDFb`oBO}Wm*+~C#IZETmoc`zz>Qif;&?YFe=m;HU-|M6FkT+>zsUl9BWI4Sn*&Shv@A% z&XYt#hXqf?@ogMOgn!3;;aS071zGf498)?elHcR_BaWLAD3I`X@(XcXlg;oVgEo#ogED#E{It=*9PBa(jw{}a3(hjaFSe_@fpEeVuJpkM-p5-2R4vSP6WisX3F z1pZv({|#j-F2b7=m@w4uv7}^gP2e^mr4lHet5qg}H4%UJzFj2c61Y=HS;0FJcGVsWe~u3jGBAPe_xbZa zI42(>WT@b<1QI{_r6UswOA4*l z(n_12K*@btHi1riLNgMWnZT?Bo=+f}Kukt4I{`z;9Kja^^94Dy2&;GYW6ua|?!vAFji{^@LH19m?`oD1ncKeK2!_X@JveT<6EiX<(gtNKyk#IM1F2^>n`2L@6@efB>6 zFx{2FcL{vUm0n!0b+bM!rN47RFVkB8K7pg$PYUVpcUH$}SY@4QduR1y0>|0K%{p6P z`YC~*r8V+noz*W1oJxRC;r{HbW;WALC;aDxJZyf3ao9{hD@gKd0>9-r6?QBN{+__i zE^cx0M*_EYQ5O=pn7}1&!rY%-Or5L$mB3{#y19A*7grLvn!tYv|GW6V6PR99|3~ne zAhS1z^nY{wL_z&}0)Z~7eHV3;3*x$BI$Xagrh-BW39_{!(pOQzVuI|txR8Dsy@ZRB zE*iRM|(k>oyQN`sCX>hBHdt8)vahr?VUEJw{59rFe{)13Hektdo=sf)n5kAyR z=YjO*&GaQV>vyr%ioo42*00z3D6)dP&1Ez$Xy@je&#yQu8?C&V9+ zB0kmO!yn$OGog!mkmmgr2)(0IQq@H@7n+NZi|Q_FxX5$C-}2RT`OjC7zwHbNsU>K4 zQT#15f2bLB{U4z6N1JbV@gL2FUDS3_$A#`fxhTF==cBppUj=#Qv961HF6z4&`G-EM zx=!WOZS^f()K53-4O|e9by1C7G;z`2#Q+ygT{Lsi)Exob5DM8sHy5l(LS*~I9xi&i zI4ap*(nxQ?f4ZtZF8aFYCs`u(Y1lv^LtG3M`5F*X?fMTk-&?Jf>!xapyn8n_#l^D>yu(4On|jVgx3j^8 z-PGwqdDC6YaPfkRd>1oa%yRL(i`g!!?$Cym(Dr7uEz?7DT^u6h(1!l;;3CXHFT5KHqw~ZbyK#BBi)oEND_4s6V67MbzLM~%yaRYi|Xm|C2iw|AAFFe1yqNMd@?VX$RcpCI0 z7vKM&z1dx@q?cT*aq+o}PhG5b@tKQtm2`d?x-Apn8M=aJHJs@;vW~MU7T@o-o@|S2Tp~~y7<+_Z}gs_F*|fe=<^kiGBpgnm zBnl_-)lK0dN&gna2|fKw5uKiDNl!KRV4!#sHz#px61OFBOA;lLD4oQT;&~;LsChLQ z9TF;)#Dda!e18!6PSz@(S0;&;@98AJ^i;PeG0qL3mnuuQ^i+2Ul9YWbbXO90C($^G zCQ00rMENADCQ&Vk3Q0st=RJ@_R5ac>fpL~@@r6}lL>x0kwK_`jbA*!Y7ihb=uLkmx zuzRT`y;LZPa1z^lsRl{tLh1-A!P|E6&BBw8o^t?d5Zss)GNTeVE0Rg&MQ1lC{Bh;5QsyCpzPVtd-0MAsy` zCDEt1>X`JSu1gY~BuhzWAv~bXz+ebHS2ol=i5{G$D}HOtKG|CxFBR%dwIp6k;`Jo@ zCee>BO~Oc`e-ZF))cily3<>oW$THhNiXQNsJIOL~v*l!-POgh*I%f@n^Z)+l*2iN}(dnZ&FlCMWTD5>t|RHi;*a zc#@Vp7=9*+9|meqCGj+)_nQzog-qlpUeTC+j?OO~nwrEk#;_<;I6a9OB6oYMX3AHi z&htskPU3|m@{@3NZB7!yYle${7+6wNTi#psdsXAm+6)YlY}d7yDr#mD7Gom`Cy8tl zlthz=C6P+POCp{`p?aFjY5hYhRYyw*i4@h6IYK$xNhgs>f(m>Re(n7byBM-IG&hMC z*`Tz^W?$jVGG?UHeft8GyedWWlDLtb&xOV{m_msZ-k=|n_#lZ7lUSINr6MO^#+{*;(i~Qj{HBR z-wQvQ#4#a12>vKY&ErYby4^pwcp{0DBD^VuU+5g+e+r%!{5^>?Le2{Qn#6BH&LweP z2pc)oTQQL^{gK24kzdS}UP_{PAHVdkBrYd$B`5zUiL1i@&PlFu$GGTw=3kNgmy=%? zGJS=A*J6Q`zXd_CpkN`v!h%Nq0-W)pDHKcjQ_oaf$jvF#e@SDuWD2EHD4#-w6iTQ3 zxV=4vvO>zFaBIq6DYr?seqC+8ME)Hq+@12j3@VqxohjTUoVaU7h>L>qdqhG)VZ{{g zO`&EAwNj|uM^#GU0g@CpOb*?b!u=^U>!XJCQPcaV2UB<`h3YAgS4p92iaS`iS_&`r zQFqPPm`I8}6rT28@UuRuMhf5bQ6zyB@={PK)J`Fo!XJHmLh4DLTe!`Z6or-eO3DuI;7Aeg`O#N zB%g-PDRiM*imFa2w3&thMO9bHc4PITijv>^Dw6J!En7_WqLJJ*`l&%F^hu#_3IinD zFNOZn0-IX6J6?nGp()hqr-r34JcSV{wD0E&N2Wj= zmBMHtEE+?FerjwAPxn(yRC_pu2`Rji!hwEjVhWQ|I8#(*Qg|eVN9ocOo=@=wwV0g3 zloXy#;qep(7g0~9@Kg#;5%ok0iGGS?Jn#Qc;h7XDd0QkDviIjwm@1kxQka%PY8s}e zaD6Hk6!Bl^z@~0gpGlpfemk>Mn3IB;f|bGx(pNsiMhM%df+5vO*vrZy%BGObN)cO& z(w-FD6k=Q~MO0iWuF2VxOo6Vu(IcySDWt`IR%C;ebL?61z+Ax>xmbiy{xV5nU*Xjh z=B4mj3a_WIJcSi0%qMOOFHB*PkOllJkiwfOY}pp3oKf_9Keaf8x1@9#{gdJYRV+zi zX$ma5p+jW4kuB8U7gFI}sq#?@AE)qM3hzssAEfZ1$f?Z685lP@`b31Q1Xl`H?5{q} znZcu>Yf|_;g~A?+cvzdlx)lCS;aUpoxp-4J$?Y+PjVWy6N=)Hk3Y%G%n?MS?Q`njU z%7?e7up`AM!2ZimndRG2cc#GimVUoC_yt`(Lo0Pl_)9wKpCBbH;Y0JsCKZ!r>H-rf`hg4#Q?&==&5F$F*o@ z?MMpWrEutOz5LqX*F8h;kJ9)C&mU;>`rwZ#92dgge_{yrS3ffvPX^xVugFhuX#Ex6 zzDmid6i(9sZjx(*e5vc16t4DH=TkVF!mr%iW@x{0pDd7fj$6$wVP?PYulPRD-?=ZX z3;!W_u4m}_8=;FSa0r)D_%nsSQn<|RWqs&M%71%oxdDD(*K284Q{d}FYY$Mwe`Eu{ zF1Gzkm!1qT{U@FwxyeHT4}2}`uI?HlJe2TomxsGOl=M)_!>t}}^HAEuvzg%J0ji9LN=Nk`1C%>Jy*ogCF+kn!;SLYw zJe2h?>y11Le~}_8Fngzm z2C3d2`grK)p}&W|G8eRpI!uKIE9!IN2GH|^eaBKb*uxMHqdkm~)`of*?qLKyFjx(v z4TF81ky14K+rTJs3;qA7$j5pZ=V5|}iJ~xGy!Wsmz0JgEi4RtjJl_@UnijG(dh#(3 zk9&B+!(>LTQZVZw<-rr47R-3qI#?YatfT!2H=0>L)~-xORZIIU1< zk%z^?-x8$q+YI1t8p+jrd72E%xe$ae<3cErN4_E_A%EY)2Od80K;;kVd0t;2Y9EOK zU4|%{!6H^+-IX3zi6+%p_cJ=s!(k8Kdi-V?YdPZ{zVxup!+Huad`-osH3r#)b(I>!Bht#N2y1`8F= z`_aQs+(vf!{I~~SGDI=^vj|UcAKM#Z_7~A-l~Y0jKZMSB*xx8raj2>@RQ)Qw{3gim zIHKP@{J{+{jml|U@NkhEY#OE0xa8qaZrW)ejlVox_V5qq!owBr4@1@8f>#-YL)D6* zYWq;d;{(?`{4C@@uEZ9Kr!cNFTzOPPgg2%AuZPGBrco%3;%VHRM&Y!tP&Do97fJgq zGZh}@V=>9H^p-SAq)}2dDP$LHnS{Ntv`iYerg3K)ccpP#8n>rWHjReE{1XH`igMpD zMSh1!NXn)C^C=`ucc)Q4jSAAsJzQwR{8JAV)3`T{`_i~SjY?_okO*7gIgV$Csky_{ zd&AUjLGlOFcqon5X|zeBN*YzuXuw|5sFvncIndKkY1BxgW*WgXv@~j^5s)_X(l|TJ zZ}67ks@ibXVz^>9ltwrWHp_D>v~c8bHG8;X@3qrl?{(7t*%=;}Ag@bZMUX z$L9}MjYP9C2blH`R`9$=(=?i;(ISnO?7D?&PUkfB504OwweWjyC32pK*)-fAW7{;^ zrO_jeo@umCqeB{<)98}Mcf(c3G&)K9^u~?jGt_75D#C7pSB9&*vVrcLh-`qoR~o(3 z=*K`>sP&;qGR5TVjygOiJVNG@eM~ z5&A8S$I_UbM!gZL_XtJhH*d;&dW528c7!5%GL4TU`;3sM1fLc>Aad%k$7j=cPD~=7 zD&*1#H6x9g3|EHYNHvSjNyB8Yi5augh@`=~bEK3CF9^vOWbX!T9;qmA{$aq9TC8aE zuYmBVj3}0qcO9u%nn=S1#5mSJHSjXUV*rF*Jkeb;-^bT#&{aY5cF*5o%Eyi_>^pTHp|9Kk+Tmd|{+|C+D;! zX)H~Hew#N^(W@)ccsGqzoTfD1OM@Q%keX?{pT-9=FPs_*IgpRj_#};$!r3^5H{>^v zl0hE^R;Te<8f(({JdJH>T&b+D_P!HpqW`$ZaGrg4$6n#Qg)c5@%&qDW&8dmO30N@K4O2Ee{FzE0y{ z8i&%@FTwDQ;DP@?LTOXFM`$GGa#IF-g}nbsdg=O>xv z9r+;DP!`&BC5@E(JQHlI)9cWH-X`9nG)xxm3n zc>l@GKaGMJ6w2T-eVfKj8GqDQ)A(DO`Y(-ZY5bGMztSmZgmcHPX$B*Kp>kc+DCBqx zNL>ihdo+)!a0VqaD3w8xj9;s02E{TsI8qhQphO1s&gz>{B%h|_l}IeU9gusGbkthGFy6-x-0X)mC|E^UOs~g85GC@Syas6 z-i-e^<)sWNWpG~x-7@H&!TlLLkl}Csfuefl47TugpbQ>jgKhPn_6PVftSTAQ%%E1r ze=%0o45|qsuP&s9V5))&WRRCZID=NBRFL|kRJ~FD+j}+Pp^X31ObYqjg9^H+sSJ)6 z)@x@lV3c}vl&VWVFpX06GiaJYvkV$!&@h8W88ptI3Dc{2ec`{Fv+#ADm_N#Y8CmlT zT1ZjX3|g|;4BBVVAp`2P&iF5AW0f|d(3XR`N41k8mhv@u^GEqF1LbQ6J7)aXpLNQh zGf4&2g;Q2RwW;X0zigD+I*M00p=Sn@sjx0w>7d>#gFzV#rY8^Ty#@OS_7&`xLH`Vz z7t#l0@MU5B=qNQX13Ht+Loyhe!Ke&IXD}=Sy|7+#v>G9$!!sE2vVLilDiqd7X3%D< zUS+gmtwy8Om<+~dFfM~%Ueq6B^|?C9_zWHv$%G6h3YnC_qZ#n`5^Uj-4BCoXx6z8q zhl={M`FI9TWbkALPh}9x@D6`Goxw9QsQe73WcXhvo|o)%8B7(cW@RufgXtOUYpc)9 zU`7UKi|Aj!sM8NjqerXWCwIf5?;p3eSHGa^}o%Pp*%{4XE_I|E0AtT=VF zism>?O^;RyPDBP?2IOuANg?c)*|Zpz@vG}g#YI`+n@6j;LSAIBy{sP@tzORHl?-0Z zU|t4C>6r{(%i#44mS?acgZUXO$Y6;qir+`8H!^rL0}>`K6XHTCT9m zQdr;2RhhvWk$*0@HmAQXgZ08U2yV>DH*wYM4YCEMtr_eT1GeQ#w+q=J7#^d(V3cOC zD_8opklh*V5%QJb-dyQE30gM0KZ64z{6_Fw?rcI12_6=t+R7jGBf`JSNxm1tU(5U; z&eW7LHVE{fVE!M`*3QwVkb5^_0%D>=zkA@n~>uVwI0PX4cu|1xNoYyYM! zPUrb*1+yrW#iLm~mPO$#ie%9=i)L9A&7xQq)w8IPMe!_d&f?xIDrIp?7A3N{HH+J_ zyyi%i%%YSK@+o6f=`6}*ksZVPL;Ni9_AJU~ad8Ykj^d6i%4Kn97Ce~Ald~U>QA{K} zOS^B3x;yJX#<@qZykG@E3M*#u=`#PjjQg^6bz*ZKFO^b~`dKu{qEQw+b9!m4;=$pD(mOk4*NwBhQqoVA z&ge{K#;N96w8&yW76Y?rnMJECx@OTWi`H4R$)ZCR?Z>IM(rG*Cm%X#E_JVoie3Lq6 z(TR;r40X<;OBQrOgVyQ>QrJC<9$EC2c6w&fD~mbfe5+_)?=1RcL0^q!7v;kw<&OmW ziM9Q+IC~{{X+w}WD2u^ajL2eS7DKWan#BhPgFHbzjAkDT49|jzlKJD*XX6yfp>b+d z7UQ#cIE&F)Y<(vd?t%2LY@`m6mz1dNes-)VpbN@ zbMhG?42<`~;CbP5q-eHaJCSqBB7FFhg_}h(3o{EVit*8Qx-vtT6rAD*rQT8g6S!c|am5)c&(U_jZov%4(<222D+MM)}x0YN3_oO8~w zljF`TIR_OJh=PbpR!|fL6;TvKNuu!IX}oReYPpcg#L}SBs+GXK`8H>nb*P7423ihouas9LeHRS5d8-_&JNC zS)9w_d=|g3&1P{Ti<4RWDqT39#qSdQCTZPnu?v4>!HEQ1l=ROmPGxaAi!kD3o3n~CD*nylKlW`EB~@IcVQl6qC|^Vc zSEQ$$UQ}WZA;A@wZ>cC&$SM5(DoQeu6DypDU zqADf-f=yQnFJYe~vkx2m|U5Z^Ar z9V%)Ua_*GiE)_3#7ZgsYC{U49@ugl=;p%dgg;y(srRA3$5i0Ihai1DTyRH~LlqCIcu0osoeK#T-ZH7b;Jp;9 z^idU!RJ2pkUPWV-UxV?qif2?bRq>dLCsaJC;&ByTt5h?&`W892>b%6|Ri2W}<|;O? zPcb;FZ&mvANVQPWQpIyBo>$RIMQaspR6MKVi|Pu0-+n}D_*YWe$?~Jw40T%-FGy|I z_Yky`w_a57l8QG}bY{dH9T}@)f{KYM#;F*uVp|WfuVHM}ksgAT{N?XOCP{0V-%CBjR29=ylu|KE z#dH-jSQtHHuj%GYiK(2!>w1dWDh^+*>@|y$Gf%~Q6~2l@f^K4;6c~Dg@@c&ctAdI6 zSj83<->ZBX1-7dAM8!@OyHv2%u*|lp_*BJq>E`DwV-=rC%usKy7uQ~Rd(j5Bg) zSiQSd>`}3w+2`i^BDGh=KJIbuslG)wcNN?Sr+SJH)YMn98*uv9D!x(io#fNIgDSpd zRKvK28FOZz;E)PloLIV-ILwJEer27j_)#u#RI1`yKgkODnO%rtS1Z4$I3^9Fn{;H$ zk42BG_+7<073Wp_q2h#!zf}CK;-rc{sb2+CeC{>n%HLC09Y|T#;y*7Eka=3g85L*Q znGeLZLEj0u(MbPMaY0294MjEltKvU)eny-9q*rYD77b-Il+{pKLlq6>wDm}wb>Y;`kHE`A=tCKfrd<#M9vXZ+ur)z4crJ+DWQp2qp*7g## z;SLSA$?3N<8b73W_Y$PFHQcFz2Hd5gjx_IBn|Mh52@NNE2^yeiNNKo7Lp=?g#dXsf zGIX=I5E`nr%W&ztHPqE`-H9R?ui-bTpP*T9 z!RwbL2?nI0h6gp=^h27_D1SEnh=xZswAJu}hDI71Yj{G#lQd65Qw@)4cw9s0-h%5g zk~EbD)39c8ts5RqFvs|G_;VQrKG&uN~VdRjRsmyN1l~{ zj?kFrHTb8~RNGENdkt@J7Nf1Eu2Yx@4W20BjnyJ+aDp_hhSZ^00C)6iW5XYDf*w46@$ki(uD#`hL10M6>I;jh2b zqid)7Y3Q%v3k^Fo4A3x8L!=?EVUUKw8fIvisbPqQp`5E>f`(xlhHDtDVT^_m8b)e( zzD&_kOzxTZ!@7O<_{$yv8|GLI+(hG8Gu_3e-r`X2m_M;uYN8f@jhUihs)k7#CTsC$ z90dlIN%OnMG^ud927UqKHym=<#3(RJ!)y(P29s{~6mvApXEAG-t6`poi&8mT3b&Z5 zL6bUlntg+EZ6Cq!epH_7BcA9ZEDg2>SA(a;-IC37L_Nik@)Y(p1k|q~)bLuL*kBr8 z{*M%!UW_j$`7ydc!$J)kG`yo>k%q+@)^K-dSfXL6h80Y@7Joo2)3BT}7ZUu;WustQ zBVMJ&E7Gska>X&Ur&`ABBiJ<7k)z=)8Lsv6?j290-qzwixxP>Q72LpU@RNq0HSE=} zPs7(5zR~cdhOaanpe4Phx^7d?fQ!2$rOM3IKo_fulz`l`U?K6!S7f6a&?qtui+2sr@t4IT<(~LU)d8h z9M|x>hNmCO(0%IRiu6?PEAFe5I;r7L8P&g~&Qq*^$|qCQ%s8Bxp5g}zONE@X8qTpZ z>nN$?yoP_+%ynF;;{uyMJAj5F9JUw#@yD*La#4%FOUGYPdWfctl%jeZUg+^pL$qOC z-#EXyo0MWYitD&a$JIJ$6{oYVSO)wKLp%AA{bwhol#bFmD(SdJM;RSubyUz%QAasF z-XINrC{kX>E*T$&m$kI@%A%|s>fsMum336naV_6DJUbv*K3 zGOZ({W6`Hcp@Xl+?J_s{?gxny{RD5-l>+zZs3!qACpM+;)p4JW#yXnlxL+FZppJ(m zctFyIIyn94d+CRDa8b^BM1lvVB_5S}8Wn20tzTSbO?CWuI`N#2$8V&Vu0ZbseMY zrT^?FIFaBDIqWPcJ?*BWyN($;X6opnqown~xNu~S^bqa{!Z30rO@}O5-^gf{$jceHTBQZFicmMXk0e-eq`u^cTzslN&HB z7nPijh5h4FVb(%9k$3@_I*J)6ZeWp)#X7#zaY)A!9ZPk5rsH!R%XBQKypH#DtkAJi z$3L|)sR3e@j@3Gj^%rmH__)7Vqhq}su9d@el9Eq>Hzl8-|Bs0>1H{{MxIxD|5|G1N zy>=(x*RfH@CK<*Lba06l1H^}PYIo8fAUNEtgPf13S%NJ(wo9;8$0s_vN%?J(L$OaK zm@q)pR#O~)p<{=ReL8=BkFDJ)m*%3xyL9X>v~~~s)c~o}sL&zdCF{;1<89Zw7tzjH6> zII5%0KtTgI&11b<3OKK1;q<217) z9cOaS=s3r=uj7q@;;fDd1LN$|<;QmxrG8Giz^$}9`LA5@KWPl@xhTOU9Yu`TJYGd5 zfPpI{xKh$5 zZRFf1mwV8_Lk8|Q;v#uK>St*+lvXh^j0uGwHt>jC?ok7c3^bN^o9|9GDYT)f1gzM{ zBzRoXKUOL%k0%X0WnhSjp(dIec-p|P27WW}3`1uiG!PkRX`q#Xkp@N?Xl9Z=|CXMqe|2WiU@_gm z4B9hT@L~jJ8<=BYo`Lz&q`8tlzbiw3sdM(=*b)MUPBWkza1D3{3~Gt=gU0DC0)vCYkgP4KO22E>lAd zAIVy}Ylzrt;1dI18Q5=Nn}JUa>@cv?z;**n#AgORmlLVy3$C>%Lt|(#bKPi&*kxch zqha7nQa!`S?_m=-nz>fZ>}A7IGb|FWMPX*}K?a$&8Ti4#VFTYt0}dMa*1!u=C)52M z!(xDv484A&er({D)Z`w@eO+2JQP76Y@d&QO@kF)U8MxN?pf_(hs`Oh%7YL=9$d z95?X0fusq=#2*Gu7^q;PqKT6R{xtBff&WLG$d0;aFL87GDRCQ-@6H70H` zQPV_a6ID!HZ{h|MRZU!LqM8}!i2H)VG?g`f9lKd?d@YTyE|u3Xaid(33!NJx7~Y#q z+-$~~<=ZW;85*~dS|)BaafgZ8CT=rvyBTj%)+&u8plfvDPBU(92@?e-?lQ6QXr^GO zsKepVIFH;o6r=srpE8j)@f@*5;vN(AOx$bYKDkzXNgGJY z&~ed+hQ>?ZFQfN>2}YP@!$8rJhfF+d;!zWgOgv(u-OxC#1BMEg=w)jgo0vB=-pd^J z*pqq8#N#GfnsF0rX5tAGPqE?4m^?|_xaDPAU~_m{CX~T!Vd5F{e;sM{P(f|mhKg1u zTAT4UWIy?NsAwYx7ff_9(Um5dXm8?W6R*g-FPeDCM80<%RVJ5vp~^7P z!NjX3-Z0VGL`P}H>y(ilsgsGRnXpZaF)`M}3==a=jN=m2IWjZN!~_#lOBV2& zB*8=z2TvzCoGgb^F5i{Z9wx}2ZsM(Bf^Q!9a+sK9Vz!B_3Dv|L6MW{n|J%uVCgz&h zFgC&AL06e?#!u+)nwD6S|9TMzso7!z+4|8W?=?KC1d(0le-(!I9_u#cpf-g;cRmj3cEfjP=46NC3A zFOCqz?{-M7_)fWgq&Q>Z9IN_GAxoaGm)~8ws6tJ zB@@?KxZXk$3q>uIu~60mEL>sXDhpRzxY9x~3&kz)trvXZ0N;bbHw;{^fodfRn1vD+ zN?Isofp45holk6?pP*PtUnyXYhji)DWvT%!q z-6O@#7Uqo4xlEPUH2Q^&$R zU6mE>mHwL2eRCpV;m8|Fa*`H)FOnuuEbv7Z#2E|1LQ@Nm(Nha`X@i9pZ!7m$sAu6p z3lCYSZ=r#O`z`*rC-@$cdo5&Vr0%ognrG|aE@(VTygW*b93}W3?uJ~eWC6j$79O$C zh}Wd}lns59c$BL*O!HbdO6(gYChkbG6*RHp*EpzWmB%eKv(VZ?8w*cZc+$c%w8R46 z`|)k{)KeCkTX>pAPE(jNZvSt;SN5z-wY2bNl;Dp3Ba;%FlC9{@rX(xmSx&U@l7*Ko zJa3_`g%>QevtU+CFVmE9#Zsq7iS`y+`l)@9@*;g1Er=V9&d{lHdF2%g9V~45SZUlS zv*&DrhpJ~ri%u3^v(VW_7aOm0T|Rwg;R_3IkZGX{Yrw)n3yUmtv(Vkb3=1=uvywqgFlo@yf7j`KId++u$8;d z!gk5$6x#oZRKATRG+MOyCC=$*GI5;Fi^Cljc5=VlNZHuMZeZ~sHWab3$HHC<$GNjC z?6dHtg`X`Pwc>--zOrz@!q*mfcHVv~K2GuSp^D!yN~1GBTHwiR2iYzp_)gM8l725K z@BSdcVM&iLK{uqx{7Fuy2IWE;U6fxe9OD*Cqz_%2;qje3cJNmQq(s4QG;BtK;13HY zES$IS58K_0#7PT(v6F0!&-DD0n<$?+#b1L@Oz>2=zb%}$;^XbkSUAh3Jv_yO+jyGW zIf;2F9yu4JFc0@!xj6AJH%>kApQINh<#2!XbWt0yakGtEY+PaEN*fhzRI*XbMsYi~ z;cA<2X^YK!_<+J!e0Pus-qF+&HcHyD@w`geC|!ul*eEM;xk65P2`X@*E((ROvEx%3 zskw%Y$`V(Rl+3CUTq|icNw1UidP#4Pw7R4W?~QgG5MDRgc(#0sfbUkVX`_~nTkSah z<<=(|D;`aFn+`@w|=pHeQs0ZEK^Q z9Uu6})W5)>txvK_xl_0`IG2agz9ggcved?Ud&NcvYLJCT%9873<25#aDaKPKc^)XW z@l?S#7@q_2F`Zp)bhGidjng)|+vs6qlZ_8;^t92-hGE0B(c4BJ8Q;?F&a`8GZqBi_3wb+AkUP1S7tK1TfZ zYnrbC*SQ%Fr)e;aw`|xpR@hi+qr_O@*obW88C5Q4!?$tUSdp_qgKUt>k-ae{%WGfq6WEwS0gM>e)IEbJJpd>cHx_){BOxg*vm zKe4gRj?X7$7b0avak~*yhGqG=jW29`XXB8K9kRgo+Sn(1#ZEgu%W{{E-4YP*xeU6e zzO?a`4R+3NZS1G~=*-tPzM+F}Ck{x;qeZ#>FCS-o(Ei_{#ymHZyWo2pKiK%y#&68H zjUzUWG04MGKg!iP@u-cTB>q`a);v!FCI1%|bJH|WEM+sK3&)vvMqaiN_NzbShGO?V zVdJD7zc2c7m!q5PGpAUGU6j8hIoTmg^l(G&!{7l(?DfPk?N;wC&S5SDB zm*DkrqLPDa99-|<1_zZLRN=Y~u5~bWoY=EMIT0l~-j{A)Uiq?gy6#A&ngef~xX!_* zae|<_gBlKQc5sV>8yy@PC;SSTOXI{%4vx1;1*H_yR@W*E$D}Tn&D3;218OqAf0f~W<%ryPvFB~7!NJNTka>S;-zk+g-R zEhTLwX=_O-)<%M79qe3|t{3*Ix?=JaSp~inC#%m34%30!2uOcqT}PmLG1tL72Ymzd z3oxG*;@~R}`#q=*GzU{$Om*WQlynE@xrH4V4onA@1KYtyZUhI81J}WF2P?Qc9QY2F zI9Tc+aFBDb(7_@Hq1=pl2MZj0JV8W~{y0HYc}jU{hr%2&JBwv0a?@S&WQzQ^%NISi zL0RU2wMsCsyi#`)YLl;-sO&%DBg4M>_qXt#Edg>pNWDXPNjp*4t{ZP%)v)A z*uggr4zgWrRkpAu9qeLe<&d0DB-rNQQwg>g@;`I%xx`;cx}%Ukd!kr6QN&IaFWBv1 zkAua3DSIW|Cn<+tO7NAW`z1Xf>DLanOcWIO*1>nIX9tI6og9*l?(jtMJ-3@|K`b5) zk2v_r!OsqUWb>IQZki<6I*xK{j~CpPzcft~u!sEW;5Sx_gHxRA;CBaqu)w&B%PXua z?jTlgjjt4@=A>+cS4#SqgTEb|!PTOLv@s^TwLt}F0OEKd}!i|qlqhB6mxOU2&K4- z0e2}4*Coq;nP@#plyFhfMQIn$-l-HwPAM1tCJ8E;H%WXmTv=Z=Q_e+s7nNO9aZ$lV zMHkn&7?@0ruaU0g@(77Ug&JupEb1nxVa+7LRXD8bf|RS1f1Qi#UDS4Qr;8h06j_qI z$;Hhss=KJ+;+tU!u6SU1@$07Jvth@L*wso(fnYN z{F9T!&PjsS(h{n=ORh^$H=8VQk#zBjiw-Un7bzD{x_HV(+C|321C(?jTwGgD)N@ha z#oaFIy6{dU%1;(OP9*MeaYxx0G;q=6t<1eH?xWZPsY)}HLuJMN3`IqeU6VLhq#!w2 zJm~V53~1`&G1AH6VHcyLRdB0E{MaM6;1dMne)#p=m| zQ%Vm@Ec!X|tc&Mdyy&9D6!E-^wl3PaXz!v&Ik9VUEc1ek4<1YPO^S&p5_9fIQUA%w zF@A{wpCVqS%~J&DzUrc*i(W2zyXfTdKkhPbxajQSHO6y_c-;k`jpc)rq+MJLo+5a4 zchR*FcXN@QBGyb1JtU{698!kNJ}&yY80%sji_JxU7sFkQaPjFBF~G$T7ynEV!~-Q~ z5T{E(&e17i+ZXAfE{3@v;Pt_dG=)bpq%Ov|7$xVDQ@0q;%NFF2uD?=@XE{9}Cb*dB zf(M@Nd_FUY1@KLLYU*S+e$fYC+);X};9;`UTugUyzlR4r%wQs1{ORJ9i&-vayZD$X zb1}!oTo-Ftt}b|}#5@lgDW&}3+0vx|>da;-4@ zVsh@w*y`dF%DDK_jnDSl=Hhb~U$`*aq&{`Aoek<4T@gutj)9uFRH+|1O{%TiBIN{sKI+%YoolZ#(n{O00k7qo=eQ3-yL^q8cdT}tvS zzvC`Wu-(0oA^x3szw!rL-_-b+zmt;Rc&gytzg+yye(0gPhtn?3un&7EA0dko2OY|MF8nf^xY8Z(Wj@pokYsl6i%PD?OBwO1jTZ6!TER z!gUrs5$fFD7(+wNy$n$xnN6iV1{=yFJvUlBwce5BEuMkEHcH)R%y_8b~nz-?%J? zty4O+!q6T{Lk|yn&^+iK9`f+8hc`TQ_V9>@M?JLi(Aq;I4~;#Z^etL=XyTzM*Y(ic z!($%m*oh}RJn7+ai8*X0!H&`e?|++K_+9$x@6v5{C!Y53jEC=^OO2f>I!zTT2PMXD zO5WX3d2gy{>0wEm%(qiT8!!IF&I=yed3ct~T}VI2KDJSL-a}h2{^cI;^5U?)hZj9` z^5WkJz2xC#=8^KF64Q?+U-9CfXFGU2a$0am%wMA3G(6RjHLyNOz+VTw=Hc~1F$#3? z(AC2z52HPFV-`FN^f1Un4-Y*(^!G5p!*{bxSFe zr-^dg69i*CjP)?n!z>TuJdF2vhOC(8VSCi*OxxK_f zk4Lo%J}Q#;u)vESLg8Z+ughmKD9^`Ome4g1D?F_9@X`0_+SA1{56ivy;gNlz-gEJdE z(7|^+yek9#o(IO{eUIlU3&xz7bd!e|%Vl`ZsBRx;WK3!)xPo z@!fPm&R&_d%bC4)hWOG$z1<1!hyxzJ_E0fEr2yY}I7q*IyzS##79_W)k48QYaa(yP z>!X~HA3Pjp<+Ip49P#iYJC%o%9)9xp3_E`H@SBIDY!oxZFCLD0cy5L`cT~ zrf5G?44NsH%oL4_B+q%+G*g^sG*~J%3ii(wlN%+wc zAMjDc=P4?p!7R~wmgqh!o_>YTGctJKop5G};y$kOQPM{#A6NT$bCxLKgKEE+C63M# z56vnlGFz1P`QCo<`fO3ghnOv%nk`1n7W!;a-bV!=clfC7qoR*WKC1hu;qw*c;u;@S zeO&9KvX3f0w#^oYXU8sl|7yX1vqd!@*Za7^=j)@zbw21qVh&$`%vTDF;d2CKZuD`J zk6J!%^%142Zq>qp0#*v>sHx6Kat{_PJ$k00f@}Y7@uZJu ze6;ZKl#iX43YzeO03QQ=uo$T1+{J?LR53`V<}X#0&|=NBd?>3z z6T^HAm$&Yd{MH&DE)$bAG0MkiAGQyNR{0p~W0sHEKE|>BeN6Q+&Bp{E6Mb-hO{P0D zM4-j?Op@AY9{E$G4R34lcAoBIhL4$yttNic_)JY~M*R&%s_9~mkGVcnADWMOKGM1v zt&1!Zr;GWLzNQOH%Ihp?AEpnB+f5gY0IPyQX2cl(FLZHD$E54S^RbwQ`S5)N44RJx zK7P?fjwNb{(C2?~i|Pj7cPAog?bC)>$P^f2kvf_i@_C8E$_cM|}L|<2ZMOkDq)TV?|lwXP^J-Ada%q>J<>sLhAWNdd<6J{wi@X zKl!_q|C4@M;t!wy0}!uxLf$>e>{xjq4X& z@bRyYf8=!PId6&od|dQVJU~}lTw>b~P%PjdB1J_zR(rcGiUuG>fGZ@pQc`jl2VO00 z!HHMN>12+vMackVf;fGp0#KlI05VN^t89RB0sm|y$_J<*?{;WVz+r=`1(iD$ToYj7 zu{#?DXdIw&fGPp12DmoB-I8A|z;#?Yz#Rdu4{$?(ngMDBs2-q3fSUu{65z%FH_=W< zw5gP6Q6{mS9=(?M!4_@K)v4j|*YBc*BW?|FTYz^QvD*=EQ1V=z36Ag`Q9Hn$0h9o# z0Cxqb6Ce?wAmA^`L?u_;;fjW?NCy0Uh?wGvyeoRTf;b)UM_nN}(GwYdF>u96SCsU` zW1cvEYocy|djfRuM7;oy1pF2xMtY)tz%QAifu#2axKD!nC4E3r-fbwsg8?3r;Ne2P z>4}}5cr@U57;(}QO#(Cx&@Mpx0FMQDJV5IJZ2~k4@I-*81MFH%7GKt&yf)l&Ek|ceWUdvn02W*TnzpWg;P^hh!FJ27rQh<&D zIt6$+fbNS|=(rRhel=kC5Wo6@_+wuj@WpEZUT4h&=q6>}2+&1>^SijY7#?6m05^cgAP0Q+IOYe)(o@!LfJp%+2iQ~xNagKq3h6kB#|M}o z0XY*TxcX~lN`R>WW&|jIMQXva#54&me4LmbfJ0uNeWc6`Fe~7X&&q5`=LVP~0XYM+ z{9#j>7vM5@>W7rdU@~z(q%=thngzm;*p$@b5{*;j+W{QO=@JMI{QyCL%>h0NkP8q7 zSQlV@fG9vdz;b4UCUIv4SR7ypYo=Vmq5#bwqYa9YR#u-*7GIxO8eo~c)#_}r;d!O+ zxxb0!(nfKFgRZJ%rCDsO@z)KG+gMUw?`C^a&Zv}WS!22wI zhB3gq0koaUAScy$yP`R%cWBAx7@WB+HN0k;b3fpQ3h?DWiH!j^1>lOCeoH=dRl$f+ ziNxU~jr=&kmH zWWS_4B;Cs$B*898cS}l{JuJv?;+K=`lbkOl{i^WpeRsu=2Of~auesSJI9Pc1iOEH# z1R@`ZLjk@I(5r#+Lx95pl5b{+KMX|nfbxAHeqwT$B#*LU$0UAcKkTDa`6jVxy29Zv z0iHdYd?rZ#7T`GhSPoa_@Oywi0$gAt3czEwP6Rj^;LjjFE$ifr#Hj#(1vnGnEL}d9 z_&Y$OymC4g7VVr=vAxOb#wh35`~&Y zVg0h?*jb4giBx?zanrU$(Hx4@%piv`GZS@lqD4-4dsD@7D4s)w94h8;RSplY%9PHb zOb%D)P$GwtITURzcr8k#dgVl^9H!>Pf}ALu!zVdWK8K%kg2!@|%i+YT%*0a4VjdzE zib^?Llf!j6Y&(>!8H&m|T${tliHU&)sVX^C&4GZ|;U?*7IXoJQuQn#yhhoa-%Jn(^ zvORG_4%HgE>6J@JdWQjdOTJ z;ztWPjdJn3H+iec|8pYoSRsB~f@YFFk;9V`^ph(-ox?LZw9BD=4lN4hTjnq&5>4f6 z23tvH>m1tT@T|no<$N2^mgL4 zLVougUN6LN5W0|*e*uec2;;seL%wbawALg(*hmUgjEQil?_*mw8YhlK> zaN84ld{*z;g5yde#_w} ziGP;#sHDG0dQ4Jk_?0y&S0p~pPXWpQL(=1te^TN<3*}Eq@E2=Xg3~#ik>G3&=Oie( z=zraY;6e`n=1?v~`4Imx5qlHGLmpI-xtNPzTzpB=B4Lbq6%7H2uPEePDM7Ii;~t3x zt_s0&rJYxYC=tdzkXK0wN=aH;(lU~k4RM>aq(X>_A!>%GRXDv;h-*SrmSWU!Lx?I8 zSC#ZyNvlbEourhxUV?k2!s-&&ko3k7H%V}_q?EiRL`x}lD-8%yJA}GO@YShZ7m3?L zj9Db^kTfwjL(Er3|9N$$PKZQ^2SPLqQ4k^-;+_!oLS)xxln{4^ShYx`3vtn1>H7=ujq5YT*JmCK`7wt^As!0x zaEM1}@Vd-B>oc54<?*uSZI{c&)0YSfy{V_^&^-0DK=i4aeQxFJII z2v3D*9%5ODnSP4dP~qpQi_#bBKn2s zA7X%1-gSu>8e(9GK}_Nj(RzvCii1Ob=*L51Y8bsl43omVJ2J#57Dfmy#Aq6@L`(=V zQGzic#!4_wQr;Rbfx1LY3Nbmv>=1K8ObIbH#EcL#sfUju4ieMC_#w*aVf-i}0hxSk zmXD{+V*Tun1&HT{m=|Jx7(Y742LSmX9v^?BB!}5Beu9`l4`GA|Lqs9W5LO5;gwLEV z5q1cN8SErBE)n~dh~Jh7H$>B7nPN*t5Tfc*@$6EOW1TD&k1Q4ZO4E6%$cI=EVsVHi zTr|WY25_m^v{Z~5H*&G4Q%ou)`xgAL}rgqkHV%9 z?=#>_#Rv3jnV7IlkaDa|2zGCh1N66)({qk7&fSgE~ zzRShI5Z{ORA;h;Kz6)_E#H{79<)qPa@zhnB!!#_!A0bYJ_%Xy!A%5p>S|K(p7e9yi zWx2Rwg*Y05!(SvlCMk!%O7L5Vc4dS^UE}7~s6UEDXuU%4V(+>t!qe+BP4~yDN=7IZp;ClvB9xZ1Dp1LqOqmE} zBj{@~N7rP^MfmJOs=TBpJdM`#eCVT1=G+)E!*1aur8F1@86yf0rk49(|;gJYySBf8`48gXQf}5go1a1(@pOrQ=jqq56(c_fI z+3h7DZYIGKl0GSeKqjx|Oj)7KGZ9)8;#Kb?T1RLT;q?e_M0hsBa}i#Q__GO~XJ%K4 zcD#Em)0Wk>GtIESAail#(>M|BBRnB9^>Tz)B6O0sx*yAQi14b!HP&X9?9X(RnDR$1 zq)1t zjAK}&Hh!Ltq0HJ0Kh4KSm=IxN;VRraG~>eh%xmj2=hkLe%u^yvm9;%$eLUpFO*bRL z%n0)$%#Scj&YfMTp?RNJ!yGxBD=9Z%RsyY1Mx_fEQtMa8AM0&a2{VGlJrZG61UrHg zAs=Bu1UG^gAr~Q(8_JhkFOc|^{TXgU8cFYH*xs&)B0SzL{$8;#!lDREBP^q9GAXoY zF}KFQsU;D%uFY^=a+XI}A?=||<$vSc(Y4hP)5p8o$=?~JT~X?IoIV*&m)<~jtDy=6v?A#9=js!j`;V) z)R_o-BJ7Ru9k+bMU)u9wMtmay@t0EOE7tJz#D2*U zgdZaO9^sD&ha((`a4f>F5q^yDQ-q({xFSqhB^Iv|TUH5bAik{U7paGQ4u6YqTn@R) zkA-5i_C$m~Bb<^}os^V^I{hWV-;!QhB`C)0bm8!9gmY5Wc}Xuu_$R^ziT{=KKj!Fo z;<7tkHzm3HCCR73$m5DUD&|osk1O*imPeU<9JJz+UY$pYJg&-v(cml^TrwX6UZo_U zhSK@i5&Fm_%H~lnkMj9=Im%SXg9co-fnm8OkIH%6oX0JBRLP^NT;j$&uFazwaUM4? zaenH$JZh{K53UxMO|32$sv#+vR7>St?k35ZyDfI7W*)Wj{Qu>y89&Pe?HV=`<-FZBm$0K>v zl^W{hQD1_4BxOb#kNadC7@Yg*k;L?i7V>&f290Yyl#fFRxgNgtCmyIQ=pI3@$NLED z(&Ap=LgesbfsK|LE*n2CkMVgd&0|>}6Y`jthnk0$$D}+a=P@gf*|akco{uvvkLh_# zm6${Rnr?=~GYdHb=VbU}IB(6#V{RT<27hm2ULG|YWO&Wb$A^XxkV$%CwJ5Vj=y@1< z{2x=_0W~%8y$uf?l_H2B2nq-yEN}8=5Gm3W5DSO}M6rNf0SgMEGzC3rQ;vXSWz} zk+pLS;zpjLOyu$56{h83dLEK_NaexLLy(7b9>x?kJmNwIpMC^Ij0e9nVu!suQgJT)T^GxIPf4|DUdq=qpo53@P^&KS!cQ^iXdZ+mLs8Dr&1V_qKS zvw1!Bsi&yM(EqTpC=ZLd1VvFaiY0k`fQF-aIF^THd05WjnuncvSdoX7oL@(bjd@tb z#h>fEL=&D`lZSPJ*NUVLNd|%qdAN?Luqh9l^RPv9=)kr-Y!!Sx?{>jOix}S?Hg@G< zHwTjV$>^Ru?9bZSn+G!ccmeX%*AFP-1Hv2>$r5S#uw*X2IFW~w zV(OI0b9p$Ohd=UghW#Rec4&ci7-*c?>D~oVzMO|E0xojs=HYKC@gM1?OTx3i4zvn$ zE!T{H^H3m)f>B)M1UYQ{mxpVt#Ytmbi7<7Wrx3+&C5#p&j6zYwK17$3M&W3v$<*E_ zjbc$0k0Lh;BZ?AHKDtEZD5^wpLliegQ7($|QQQ>82~U*~Nl+?^&o&sPB}zc1Y!o+3 zv=5)XY%mJ>>Xs-fMnS-61xdO!%5Qmxsno9&#ce{~<|}7f?H13Gv&aB(4Ma?Lz4^c~W?uv$W`Q>C-3s$Fg6s#jL?cWncB+AzWP*;4YCz7qr z(sRUl0$m)?B#BuV=!uG=K@_c{XcNV~Q8bL=gF;5jDDI1*Q4~~Y9!29QpOxW$sRE6# zj!nfBZL&Je1k)OM$`(=_o8^(MMk}%QKok!~!RV`p4H|D7#Y0g(B}S(x+C}lOl+uw3 z0v?N^y?{rfSlYy(105v#xJV9oGAxDmpNQhgD4vqi4QW*-@e5y_qj*M?yGFshU7~m{ zoA=phIAz!=w7`n6N0{ZsC|;t6CR&^57De|cA0}gY6fZ~d3I|dYzen+E6t6|`Q55~6 zcs+_YqIf@w-cdf^##>ROef3@xZ%5ICJ-9me9ahR$J*n@jUV>luRiCxFjE?fvyHQN? z)xB$SSNh>5{}0&gYjPPrjAFO1n7vPy=^Mov(fl}yPonrbif=d!q8JdxkSK;mF_0rU zP=llRRKTDpst1b9XW1w*L&HD~i{kSrzKUW5+ayq5MDeBQF!j|y4Hw)`l&>2Z8O5k5 zz714fpk@bZbQEKv*b*o*XDFliE{dO`_&JKPQH+aXe3XywQ81%!%_u&a`<_EFquOP{ zhhY3;VnP%@M$t{8WCmx{#3+7=f`1MC%Iq0sXVj#u^9wU-vLx|;gq;~RC5ow0T%4P; zAd0*wqEYx!1W}lrBkav6Tuu-&bM<%>Hk)Wo&I99hCyI3qa~XPA+FMFz>crD}l06lL z7ez|+NuJKAoATA@9@_RBLy(CgKZ==A%!*=K6w{-a!D*Er9?bR7y6|WzKKSA}S3Dm>b1Bj&Pm{_L1W0OxI6vn$I@*MDa;GNj?o*$ZowuUlhe+0ZTZl1(5vZ_&tSB z+(WQ}H~(BuOq4URDvH%n{1wIDQLKq#Z4^hMILhiou|A58QEZB0LlivoPSX=kKo0VJ^=7_08O5!C7(9ikQGIoaYsgTeQGbKy*qn)?zzE}F z6lZBRit|zY8O7ld+86n1@D%OIqq)WU8yDC$BO{DHe~U3SU;V>byjZ&u#lIZ1CF@^` zVnM#T%&GdS#&ckV7G#4fcnc+X?1xyq)!Bc1&PS+?4o7k7Hc(zZw z2Xl)E?lL|?rnm|FxL(!-Px~P#VWOlkH;BAZGm!>g8Rbpf zVnQ>ao2X#oRueT%+-2fu(x_=QK6@i%4{u zT0BifOnkjb+fz-;F;Sn*^0d}aqA3#%O;Epqi7M08 zebYlzEqiKD6Pt)15C2JTVxp;u?l;wMW#WDlz2|AoO|&r4OmLs+iVW6hElrG_u0Aha zpV<6Of4~I)(C5KKtCL0>6Kze5H}QjshfK6H@tTR(O}=rAM@&3r;%O6)nt04a2NQ>< ztHgB0$3DxZtM)V!(TlIp9yigE9X&(wW7AL2?HARPChnM_n#>5lI^D@cXRhIN(!?_+ zx|n#*L|6JF$L~CAh6m&D=olV@^E^jRom?Kk!n0*w5X|U{CSJ=1?q2p9>dJ=BeP$a_)@^O-wg2!^BS}em3ElNSK&t;um&@8Q!N&GVv>ciQn04T6i};*~IK`jd~@G zg4CMgvlfm7RRRv-utB<3-7uMmNa-zK6s|GIUh@g zH|MSiPcyvhQZtffc*~kHkrrmsOvNY_d=r6*3@3{yOyi{H&jBg7bKy{7rioc5E`1SM zLic2;DIeA6nAkisJn(j|iFqdGo4k9}85WsXki`oHZ~`u7+fIs9enI=t&Y_*9CYG64 zZeoRrm25yUzDguhH>@%^SV>pK1F&r>)&_r$wMhu5I6HVM0 z!%Z<9;aoTrDH;pqQ4_~Z95-=7$U-rk6u_hl>`JAdGI3g%KeGH86K4gV6L~(%|0#f3 zE(-X|#NPt`G4Y>(OCm3eydv^nku2+~ltsXB%|rq5t)NJVyskr8SfWKlUYx1IEHM<% z>Xe9~WES5L!*zvHF_ezsju`HYp-c=n&r%g)xHX2d#4(hMp?nOF&QiC;;N&QL5%JFG z`YgrwOb1+zRE*)>S?abJD#uVs@K0tAUp}o83tw)%J%*|RWd9&2yQi@DY3?CP-Pw?96NVonGzF<4Oj8ZW)h~b$Sy2NmA3=Lyw z7sJCb+!sTm7+S{AiUwP$#xXRBp($-PSB%~-Bti2Snq@IxAZ;PIcq>IUejWaSSon?j zHX7(N$3HR@cK!(;f0$T1?n75Q}x-w4P( zAE5%ncM=^dvOtjYy@2r|e-Qb(8)~vHKgIA1NAhs}=NPtEH71H2Gg}e6v(=;+D1VJ% z-ThE*}Fj=^FnG0csHw|_P#V+=gtadr#| zW{)95K89qBJ0IY249wxD_abRdmP-*H1<5;4M*SE94uhk)gXX9^3*_=RP@0++!;Bbs z0_5~qc%UfNcmQM9)7nfSXK{k`H<(JzIWhb^N3|Ihna3_*=`k$i9E@RE4Am#;i(*(D z!xFBmo3+dw#iRM&>!+U{9vM4HUmoLj2(0AHnyGD?sqrTK@%+g8If|h6a&1ivYhyUU zr8S0iG46}Tz8Ln$upx$xG3<&Id^9s^H3tvyyNIal2^SDlLCbPPOC?;PjvY2%L=&WIg0HSe_9 zR%b=O+CXDwCH*{?m$~7ocNb&$i))>QffoLbq1#;5*1|&;{)ypI43}fL!iCi0*KhG} z3|F}tSSWAdzZkA@-L`Opg?pNWcMb(C6tn;fg)9`cP|O0!esfh}0YyZT`FgIJI#*E^ zw?I%r_*rw+`nl>x3pZIPW1*~tV{=t0TAQazi)566QHClKZWg|Q;9CS&w7BgA*Hdp5 z&|#jcWZ^ao|7VKUZnsd?LaqhFLNyC_Sg2*8wuL(_Oye^jE4)RiZlQ*S&ozUOwsKw}GEo-|l)k+Vh< zR^*hyD4%)uou^utG@4mx&PMYTi(WD{Cg)s=bN8HFbf=8m;6V2m+qRixP%W4wiV9gT_XWeY!8m_S!8{KS?SZTvRM7}!Mr z*+M7rfefP;pD-p_`1z7y)Yj?PuWT_31l=x$eoo+W+Au&};` zzU`8+^RiK4zRKrhv@qSmll|~@+gvqY&EVV_W3Z;P*>@HbkD*9 zHrISLxt3Z;gCmWxeq=FQV5G6g!s;G6!4leBl*_=R3aoVFK)ku10157cF@AvVPS|Y&}Y?BM=Tt* zaDhg+Hd;7t;f#!p6BbTdc)^eSA@Y>S(_G)K8YCGA7$x99I&0yay~^DVr3+2A1jo1K0*LU2i#%N)kF6_dW3udZ_O=d~b?t8rYjc%lwQ#4$3Cf^i^@ zwsAZZN1-?h$5AhiNE}7tC>lqVIBt)lSRBRUC>zJkag>OMue4Mxm0K!~l5yN1(HrBq zNdS|szvRMqTS~|O_j*eiNot+1m5YNJihvbWkngctAi) zk*!3MzqPu0P;k`+iqZQPs5Wu1#HSXhc5yr$=axnEh~tqs9*yJWI9`e4u{hetdHg1x zWzlgw9>-I0JRL{JIG$kVejRx-j&Ut>`Fv^4ExGS6P<&1`@U-5E7NYty)S0F_3+D4K zGEM61-z`wj#nCm67vp#-4l>WjVXoHJE>JJTkzNqKBtn@<>PHu-ZX8GpRrfgb3i{Xc zv>FT5t8wr#-Rp6@!7kXOy%tB^OF8Y0F(3{; z;(I5K_v7dt$GZ|G^IkkWm%DidMt+ZD3dadsERLyhU3PB-ddzSU!;?K0j>K^yj$Mn@ zQQ?n^JjM!I8pD&vG>(=9ixm}4irOiWr{nk|jx%wbmFQn0sdJ7ilHfl@UJ!XPo4Rj% z&fi)5PaK!B__Ba2aa@ps{^R1$wa!K_8wG3>w9&*yQyZ{R$i`hZYS|nHC}QIl8x?F6 zwNcDQX&W!_A)(0HC5#&cl(13K2LH`u66K9T-ejXxmLyN*GB(QExLL^ZBFkm%P~p0T zTWwUdLFMX_RLREeHmXwDMrGltRz>n2m=?KiwwjG=Ta7z}Wa^z+n`d8Dv{S=IO<|}* z-)h_7{l9J_*T&s8>e#qPnEEz1ONU8yZPc?7vBNhz80BA_lnk1rGJ0LjkSO_k1t=R0 z1YA#TXyZOH*ht96B59M^Det%WJOq!~Xm5xA7dN-@fQ<)jw6Mc_eljg>w2~zL?aL@b zYl%K2vW<@Dc)N`Uh+*JUY7|+{yRTP+oZokB+4L(Nh zW}~}}m!(`fz@%3MbAt+_ui1Fr#v3;H+vhDC{6$0XCS7W5e7r=xZKH=63HOj34j)Rt zW8+;LM{FFm@t%$MZRFXA+UQN2Hb&5bjSp?~u`$TTU>n~pQGIRnv+=Rb54q|e+4$&D zl~}@W`0Ah7d^Zq>Ka2FYv22N&aZ;xw9+-_%^HUqcYPBL2e0 zmo~nVEE~@1Ou|w%+y;vvsJc`&U8+Xe7;W>&8vJNujE%49m5s4Bz7d1(Ee#FQjc;u{ zz4U)>jI;5*jqx_<55o^)|K&xwben~;=$~x-Y~wc@zuTB-gU zAT5kos>n}~5?S0-F?ii9Q%!cFjpa60*syHGZTK7sHf#=2*2RX)dAd4cEmhYWCu!sI zncTEkOW9btRE_MXQ+m>RwExFam9dd;W1)>jHm2E_Zesx(ypy_NnVKP$Vnv8&+Mt|e zW3~X|IX31Bo|k3jb8apRm03C~NF$4FEae30q?XuV*wRT={8d}VQTi=j>ZIB%Q!6=P zZEUx(!^UbGYiz8uv0l1+t&LfYb^6a{WSi654YXimtKf|`Hf39BGsp0DQ}9xzolj&JG*cCdhU8nhB~oxWhq2EZj+FmgLlQaF>AU4r(~~{Y{jiD zgW3-6U7l0dL8V&8-45zFxJNL3V<1^+g(6_%)DwpprG9+}ISw@XP#{+q3w5gL%^Wm#(8NJg2Q*8AEQLjst7$NLz1-%K)I#La zc^Va%^nim09dvACw58=0s13pn_|!Nz@&XI85B z*}@U+mOpYnUzBszk6ivT(q=+r&+j>X9em`VpM#G%w5~+vHZvB*wa&vMP1k6jIOy+S zfP*cwbJnIJZ$GDPzc05>0c~AhZLot+9Sn6a%)w_4hOqSxX^*zbeSf8jeXU*IqBkzB zf6f`<;J4p%zGQ1mH@@7SQ+lV)=x_%|{TzaOryC<3jB@a;gYO)Sc5rQ6&exnZFX>|( z9N!X|aw)QAR%F9)?HkVYQxWoG9gK4@K~g9A`uChK4m$1DZ{L?Q-oZ_GYb2S4%#RL! za`>tgU*O6~&x*8uPkZO2MkA9P{L1cdFwMbay5}I_z~!)aFoiwtAm(7IgORNjL)1ZD z7B_CKu4BtVTu4V!TlLTxY!2fd`t@9oeUFp>}tY?@l7W{AO=4(?o~X1}gxk$+tgzx-yXKhME@4#ETq zCc>9V7svqH>tG>AxP!%97T9YJwmMkq@TD`Xbg+tl$gWb$9jp*AEE!>R&?@!gDs@Y> z+|>>?aHu#SUL$g?gUl+m&Ow)kx$9|4)HZRXtx}u0xUCNJURb5{)vEn!wavkH&fMjZ zU1EIb`kWrC)eZ+cB|9z9>~0R))oSW$wTDiwR#e{SV84R{4qr^eUk?6uaEQ~v!D$D7 zI5@&_;@}wj+QHt{ir-SayjoRVqfR*CcNHI5qfS!c2Scq02ZJIJoTKio>_t(DP(&dI(7V z>)@(H{}VaxT}&JTdq}8oO_&=$(2+o)1X?7}GJ(Pg6iJ{)0yPsTnn1AxZcgx}ITTNz zL;^P@P%43v3EZ|;-H^bI32d9AHLI$%dqiurR{hsme|oLzTtF|K0KZFHCV`3NjA`2< z#AOr6++q-vPv92fwd&3UDkN|#O(l4|YGlwny zcNpIv(;FmE_C{@MalL5*_a@LVfu5g6?n}TP7Ad|?5jPU1aRN;Quzf1b)vB*k_p_`7 z*0$CdnhR+EX{1#G4@3gA@2vK+`2U6>|6J)1J|WCNPZMO$QJ*LfK^G z3mNKPiX1NT?>QO=|HuSJ(JL1pxEP(lm;@@isO0h$QGAoYjs$il@NEL$C9p7oMG1^e zU>wJP0{IDi&yHxWQVFCJ7@xoo3CwD)CM1yL%<889DAAu1_?h!4fnO4c3o}V%p2%Ml zm@MG81f~d}h2IkxTvaESDh%<+$vIKMW&*J+No*zXb@}?#w1sp;CPb2S1yCWUx$4zi zbv&tg2?P>+I+>ih)AGt8695-cDyBGlQ_N-a)cNdoHjrz zXbjBAqUkgD7;I03n-l)&7P`uc@8a^309+Juu_uAO37kscbOQSl*w2CzI3oH7I7v@x z2gTs0t<)hZEDrZP`I#0I={z%|V0)Hp) zPXcEXIG4bm30z5@W7exn30zL#N&^3KNpBf; z4NGAXvs|UADH@yQKhBzl`ZcjeP{2h&H)Ndkp;}=VMO>6|QPxFK7sXuM=;9_f^t`x> z5-v)*{LvTTMv)FJ)D12uSxw3&FNL6#i_*+8BCHPgsMK4jQ}bpQ#J7knCz8?fZrJ$m zwg|VfRB&-?mZz!PTvT?^+C>`|Rb1TeqOlw9C#mY9nv1$F--*T@F79-3my231s=EkU zsv2(CP(^Z-J{C2p-%>4IuP7O6ySRr%v`}}usN;r1cT-FCM1@=?smr;HMqJc)pf&hp}WWxBiDxz+l?DzuGiEczcZKhx>tN|=;A)93wxG)BNqhBMFkH2CN7$~xSv^E zv~ux)%Qvsl!VSk*OBdfv3%9i}oNgJ;FBZY>W?2uq;rJn-skZDLR?WpLF50i!NSr(M?LEhlMtTJC|sR!>qgbO!D>( z>Qxu7x!8U<=N%WXyLiJz4;MXMwA`THbiweJ3mRm9y)C^)%%omIGWB|tskHE}i}z%h zy)OpIaD;s5q7RF6vEM~s7azI!&c#?4{ak$PVwj81U3@~FiP|6+gE?Y9i1c?cz{Nlz zyKYb)Y*0-7)Wv5mCN7CwNN7XY^^a&z4T}_6tnnf{l!I_sgqNo;Tzu(b1ef;>YPgG= zuSS^hD;LA(XxA~bk90B0#k~WJ(IUTgF-E}Tc{yh*805c^=(i%t@cKK>#Y`8oTzv0h zym z7coilTv!4UBI6=$k&Z}~vhPX(S8!5fN@O~l>i01GEPm~-f=Ovf=E@gxnv3ZIW@L40 zHZC~Z#T*w)T`Y4kmy3yug)SDk;5Br9wn>L9i7b%z;pLkxwwM!tL|!l4rB#?6}n~x^xY9BCT<;*2Ov(>&1sHF1EVZko9MyfK4Jd zbM=q|-tgQ%;bCzHTpVP*l9-poAx<9`HIulD zKZ;!(b#cnYX>t3Qi{ma%NViU|q|;&6tK*iOlTvHi`NPE-X^rwpoON-|#SKZ^n8bN$ z3M%~R;_L>+X1Uy)GrJ9pU5j&Z~t|1HH&$JdM%3!Br)}m z0?fsLBnpWI;=)O+uM^g;XqG9KMDZ*xkwi(s#pmTx=O)2t3TmuZDZ!<)nq>r(P2y$& z<+6O`o&`CNZb_m-5))qv?>ui!qGA%2lDI9ab4L=D1y@Ppb^%qBs3u@#+0ZwJ>SYVw zDNJ>dWNIYQqfnSyD+#*9A073QsGY>!Nz_S#vzycQo@6+3Ui&dpmyTVH^e?E@pRGrd zsGmem5?T_^B+(@aJsIBTKbS=8Byy85l2B4g<0P6S(LnIM*>W2SxG#xD0!nTSpOY{& zO`=6s=l&#`32vTc&R;FiQgADg4`lhLa|*T*{Ad!7CDAs^Ka@l}!4GGdN0Rt&L|EVU z!u0^QxZQX(KU(Zsh`BV zNxYE6i=y_X$d{6MC2OHu65R#AoMn#O9=h>r60c>M*OPcdFn8&jPHv21!dnVCK za7}5w_mX%&i7`ohokZ^>K1gCv5`&XGa|3;n=r5XmMSh&M@KF-|1ji4DgNoskB<|@R zI>RtPk_IL*rFO`Cn#5;Ge38VLNesza7$#t767JUj<@!8{ADf4GxFn58Vx)ktlHl;W zZh4e2qm%p_B4n=X6MU1zI7uS@Hi_@Dc&q@sMyULK662HjL6`|5f6SJ6eI!pz;uqnQ zA}4XqCXtuKuM(Xsl6HO*@H=alWtwkP(JZ!;Fta!&z)B)6;Kwrcncc~zCIq-ilxh^Z zmr5d?gqKa7ndCtw2qc;jIgK)#dVM*ap2Q4cDn1;p53>Z%7CGnt)105gf+SWau_hT_ zJs0vRVs)J}bWswEg;|osasf+4E)yAEXE!Ly6%t*U#HuXM3+~z^)^VK7&e_iuEQt+C zY))cJ5*w4@&)(|ua(O8s*d)=fR!6qV3b6V`ZJU(N%gXj-cyXcIJH*wUB6lURTfm;I z|9g|zm&I&AUVINEagdh)SatPM>~B3(!4!}}p;UP7_FTQlBjk=3QR4Tg1b>s`HjA+QgwsMrNq@TDU=p#G(zRF zDd>Gd(DMQ>c)_t)g~Y3SWI;RFu3YcWY}ms!A!G+NfF;%dMQk6Ma;b z6y6nQh^wV=;a~wq?~o)`sY3Xv4*r_d;c#wp~a_+eQXDX0|Y6gBh|dX_M9*#etX^-bz{edE4OszD0F zS{e7I&@hGeo5HvF-`J%1B7c{n#(gPJ@^HB(DKt%?SqkIo83$V$1L_&~r|@dM@Gw1| z8Pz<67Acg^F3I-y`Ir01)fjEGjn*#&0gQ=mkQ6f`Gh{REC1E0z_aqm^cQ|W3Ihd@;Ym}U zrtnz`D^ggQ!jKe(rm&C$DTVuoVps}ar0^w`Wr#ZKaJQ2Q~3pHgsANTl#{3KLU^ zreI3yFDd*cU{W^MuL35gux3*@#eSFQloX~4$VBmfB zn47{pVdiIZEl8p5egC^^FHT`;3d=ZiH}eP`ep4f|+tsV-5OQY< z`%>7S!Y+yK7P&{{UXjf8&A@^O1RqV|SPBOP9};;ut8*lUuF_W2KhD)Y%byT%Qsk)= z%GM6Al?;FIDv;GV%c(lgAoZn=%lp+7{uAb!$O1x=FTbZ?A;CqmOkn~0J_@^|sNiC06wjuX zNb}{X(5oBMxG9ZlY21-UsWeK9!fk1k5l}&7*)(oWqnzMdM201%v2j*tfdOyeR^cmV zQ!Ay>Pg<<9FjYj}o=vTq<}a^s?A@70^)%|Ik&{LZNv)m6-2!T+`K`UM$_%yAVar^{ zb%d;!#y#28x&ro>%Z+52d+LR^J(@&ykx#Z!xdM!=juLSHMC0Bx8VbHIjb>>y7u+a~ z#sZp%Y$}pA?@wdQ?68+xWSIxkXqm;W1Uw*eZ*8>B@@)jPP2(W}hvVT4;yVtHr15wf z9n*L;4MramNzh(E2azuqGoDD}$uwR|c5f3 zn`!it=v!&LEm?Y|(IZXb)A%3_D~)&>AEx=qW_*>#h&1}9 z@lhI|r7?tKCXJ8N=%2;_)=L@xPB1><6qsOi9~xyYZp`?>7%tH&KZM`19GS+bG=5HFVj82_xoM0` z9^;!dzDr{)r`}q1_XOkoQsdh+wl6hy-ff)QtRDHvAU}GnF`n~ui<*$ek7@jn zM%nhN<`zYrpG2AZZO4assr*YClhVjzi;XjWO=EHzzoqeeI{dI^vn`5bmo2K-L1Ri9 zt(O^7rCi#1e~bEZi;AXUrV*p72MyL}!xrTVZ>Qm;u_BF?X(ZBc)0mmYEMA4vNTuPY z5u}lp5SD701Oi)`0kQSH^@2E&XrZriH#t!j1}bJAFt z#-cRlO6$!_V?KNEK6!6euyDH?Npoc1NY5h$N9tv+)#6KprJGQHI zYyFLddQlJ0ZC7PHl=V=|Lvar!JbbuajoBWqy$mHi+~EChjlI$1J53=jC9-suXRe#Y zPIZqbR)q@XJe2ovi-!tXohlw~6I#mCtS6Gb(cAi2oa5oYY)y3!xxyRSRBGPq zp`nLX9v<*;pNB^5z8$K$hsGX{OwpQnXzD@jP{j9p{JpF-6NRC-8Dx6zP*iS_Wm*a# z|DcC=f79D}c-TX04{c~+m)_RHLmm=4)Yu)0(PbhZ@$jgJ_8z+KRJXmW9oeCZ>{O3= zsJT-;uv2yL@VF!$enIaj;0Y;$%1=u4DUnZm=p=xAXAhf>>IBcSzdXL?gTe3XT|GSS zp{Ivl9$xV9qK8*KyyoG@Ir>W;x_fxpLpQowB$rITo&11HD2ZQ@ijbdigZ{dQH$A-N z;SCRrUU^IF-XiyH!Ho70KxW)d#ppY%Y-jbphu*Z{;XMhTT*^uARFofZ1d75(!jtUd zp|6K^I~8*=a9dhGFWj!iB<@4|#6y2C+=@293%6qpCiXDM1NUX!o!t-isTb~;qR!c! zYN&@{9_D*k;Nf!*UwHV%!z2%1dKm8E8xP-l_{zfw@nMXIQoGbhk)wqfB{H&05wP^H zJ496nxF0M}NaELbshE(z?+SN?F=^N?#r<`! zUDRw2<`wEMeyqH%?s`aakb9WMVN54IWY`xgl;^?sKuJtx%0O}v&)*fMGE8SzdYJ8D zj)$3&+S$_FWCMq&TTQ5oNcB|JUiQ{CGhs_?gJ*DsR zaJZzlh1kP(4_k#Cx?4@!t!la24i7t7i#s%8Dl;%?H%D5{FuF&SH+R(cdpO|X6c=z0 z2R$5O?|3-Ik+vvum@TkdeY{IM;)S2~-T-aHBK^3>bJB297=GsayTjV1-Rj(KHSnI? zv30aRxcGbc$HOHLXK8k}cFx0j0X_eW{K*EHt^MWUZvhuPTogbx@|17o>Xgnr?J`@k zM#x^>MS0;(oYw@J1gu`6%I|q>tT2a&HjHeSi#1EhRbxWqgzt%)Nq)Qc{7lpq!6e zeN^;O-UmD779SM^u%{TvRPy;w0nZA?=O1gFt(E<7SYF>AS;Y_M@9lm#a|tRrsJAB^ zy?6S!%SSCA)qOD9>3D$}emIG0`r-Vdox77pZ6EiL>>Q5pyM5I05rU*aS=UEBNs9R3 z5TXwKY_~^gK6D?C`gqJot`EaU3m+|gC?5@cH1^TN2M5)?K2H(`_jYm;H58`)MXiyK zSN159+{^m(@|>nVD4Y2hv`5|VV@_Fvpt&FJp*_1(P1vJa`FOy`^gXJbk6${g2Ys~h z(N=J4Hb`%sB$c^E_FO0RkPmK%rGGbb>yvnBVG1|u%AFum(!$%JvJ(=p`_qO_5KHm26 z_Z~Ire1w;(_6M|8&uf+Ts$OjKuk?OCKKAjBAKogwEAl-b@B8R2xR1yWM1CleYE6$6 z=qvc6EHkNA!B4XIOCSAx4DfljGX}By=7&G-7zX;`&+~mO z@DT}6KfppCi#Uq|)CjQH#}Xe~eQfiw`bKT3j~n-?%|4cKK+efo?qh|ImEzBOk*l)4 ztroDx$J#8jj#>8p?|yZIkQ;q$%BB|Vt6f=^vxRHIK1H=h_NnbYcKX=GLAy`w@G)$k zqQY*`|J%nuKKA(7>tmmf{XS0mI3-C3d>qNzJm}+);KNzwsQe{&RHDa39`|uVz?6NV zZ>O`G=LP)1IWFLAmOsbF5lt%p>El9{zbN1@ktOHmT;gEk>Kfpd09SncD}3nySAF~^ zxM&a#n`>P21r!ijP$YS}R7h~)EK?-FAt|?5z_Sy>yd?tMm`yDi;0D3`U^J6%%JQWG z6x<)ytBf#ZMcyp3Tvmr2N`(pmst9vymaiC~lHl92OyvO8#2WQ)7qTiD0e56|?xa^@ zux5a}0^AdzZh%^Jqpwywz}*4v->;hY)w=FitWKQ(_dc&G|CLM3T#3JO>jmh$Uya?b zQu|d-04+eP01pJv1LOv{FF>OJMgYZ(0dPR^2iJ=I>hONmAXL@~8U|<)(Qp4jyW@ar z9H2>nW&xT9I8Z?!oz|MtfdCB$>O-p-=S;2H0rhtitwn&A0r-Q9KfCw?t?L0r{9u6A z0UinPXn>Cns5Su}3iwB-);7Sm2Nc7a%|^Qb4+lscP~_MAsS!LDpnZU22h`&M&#T1h z13b|phw}eG#{k6+hU8NLo~F)BJU$bh0(1`WUp}tor;fcqu@)0B;0%Gr*k(6?f`(4^VlKdYMgkP`$#&Z>7D;7MPs# znn;4z1-x`ny%pf?03QeVBtVYBKg;nM)01sEdH z*pUeJZ!W8bW}{U2Jir&Ue^4>?%9+Ry2h~>rMg$lW;OhXto{5YMFewh0$e1L?s?GFJa1c(MOIV9LG1@vE7 z3(nmB#!mr$X8(Q~nJALr?ymZ;0oEN8> zHJMa#iN<4mVgX7WQdWR?06W0rUuk2$GUgQ42poylI;7kHNsckLLjay&KO+baemv#m zcmezXL4eo(iDc+`fHs2_G3B%X(m|B@Q_?a>GBD%jfTy$K2*-R%+Zte7fPDe>vj+q0Ab&{h=FmE%b_UqR zUOuE45+YX~QhP*!I(r4s?1xGn;5r$A;9!8QCv<|sht*+@)tGTT%7TtcamNB2=j=GF z(rwfOht;V7rvqFHa5=yqoK}a`dC7H#!}YLY^lX50!ZZ5wVfAN#3jr>QSATODw+(&! zE5OXdYS&@)PXKy&>9C@_65!teg)%6dL0^@7RlF^bL8T+=zW~>`;;CFZFsZF7m zxCx)2sxZ~E{2RCDR?nbD2G3p7>t(R{q+T-vzCln&@LeKnWl&pyF-E&PgO_(isCG{V zZ$G6o)XiYgA^n5?1}#LyPW=q}9Z@+Mq;Azm4K#8yFf!pe1`lSSsQj_sID_vCX&W!( zG+?7;&@hAhGGLUUQ3hri;}>WJ8-z@g44P(ee+JDmC^pDwl|l7EM)M3>WYAKW*>g0S zViE&$Q9dB1sKydoXV4~twi!H>36D^CB!fpYXean#k!R=Vx*n&8((l6*rz@jBXD89b0QIzFVo z%?4Dtd(KCCW$;c0A7}7M1}BfGcSYd?k?&>jeug`d465}Oz(XTH6wrsmTXa5RuVp}k zG+X4TVj%9H3D1xml)>N(2C&T+Du#g>G(H}A?}hMtqn~ClB!i(Dd`3I<`N>r93#7vY zGy0`~&olT!K((Xcxv~tyCHj@fW=GXXY2i_9;qN1(GZ@3slEF6_{FuQ{8GI}JSawYY z-wA&4tVYf61y2yk==cnN5PV&S4Ariu{+z+YY~Jgszh*F*otTf#`S>k^-`QdroXTKI z22(Rwlfl{y@-m2Ku#7g3DKmpu26Hl)n}L-uOfTQ6>HkAoaP;4z1H7fY@xE<{^Di275~>7Sa1weL)5bGq`*-#FdVz#iFo;lk1pT${9CY{a#iv%km7j zvg<3jvVE_w6iKj3z-p1Fo9C{}V7+w8{tPy7LS?W$gB=-c;%w?0*_^>2^NkwCa`^?} zEgAGWrWoCt!8Wc%Ln4gwbG=-;cd~y~?rtttF=JOITx|D`*Y?N)xMaTCo58+JcW=q z26yD+&V2s5$65A8K5orN(;3FO3>L#EoR9NtJytw}iyTP9BL(wA`Bw)2N%U`#Wd0Fw ziOneBN|ygOgR6quei3G5xF*p8`6yCLXB1+vkVr;DJ|9K%Q7j+D^HDAz`;Ms+`6!u> z()lPO(Hrt{qW~sdI>sZxL0L*9nVXL*Dv&8FlHlfiTxXbCJ|DM8Uh<4SyDz6=J}Two zwtNsz^7V>OsDmZz-@H<*oR2E`xIG_rkE`>8jj9r@#s(Q|Ftja z7AR;OjzyhKopooH0K}A7& z5m3NF*-dt{n{2YX4^R*Vl%^B~>AkoA&Bt&5=j7aT=bLXPQ@)ublPM2~FL|2~+J?|B zg!UnH4WS#8{jAy{goi_TBn0o6)-i;KMEKV+?bb1kzMaJRm|*7+9u-paxbM}48PD5< z@?^5>7{OSuro)sJ<_?+P25S|x8wMoY{YQ7i( zaR~dX3*q(7Ig>*8gzB9>$bOG6-E9Kz{E%8Gs2zn{>Sg|L#%_N2z`Hh%<)qg3r1s27Z7r+#r1pIXWw?m)q{c{yKZUR^ggqhb4Pku<8$$Rw zgkM7bd(_4dA}lvHy%1{mSEjue3=1(rFokeUCFK?^>W=Etq(g{>5D#HRU)2_LLf|VF zom5DOgoIa8f^U+5DZz9IxkBhW=A^b+6d3syA&g|J5Wf5EVw~>H*-48m+&QUAFVNje?vGzBbgESi(OU-2SfNf z1nz~!t**G)`=JoHCDcD`^-a{n!s#Sme^TS7TSr6qFNCupoD1Pt2;8T%)t7;jA#mr? z;~|{jO`lT#{4hZIDb~vu0s5X6az>C|=R>#FB(7?dBf-t=00G^7e@Xt9trz>X@M{b z3aKAPp)d-EQ7(+~VdUH!l?l@N=wq7^T7}Exbe+CBxW83p}aOiysSo zbe0L@#7Y0#q^uBr5LF1HVi*liX|=tQCCPkK|a>`Om7gzeGDGPqo*`23_XlSVKf$J zAPkjvk16zO5=OQN6~Vhg%5%gSWSKnSt2GUySs2q!Y3;&z@s!p)j8kT zjK{(t=^{wdRY;ssJy`JgfS$H zm%?~G3`$-O;}uaGCOWT%c@~3zyMB4I7=(m4TqLgvax4ERPEZ-y~KBB3&GLHVdK z-VWoFFeZnQI;Fi6##mPUdx5^$+Ph&8M+?3e#uy~U((4|HW6()+>B*79zbGjZ>IaPH^7*kn6VN4HWP8f5;m=VUO z%+ZOQF9c_X@tF`V#-Al*Q%&vju)j8+7y0Zkz7+XatgNuVHvjM`ZFNoU>oDepu_%ni zVa(6yFAQUWT#SFk%PKj^62YZ{cVk{AoL$~aND7{WR6Jgrgah*yF=%&g#D zxyO|6Rp?CfreSOm=O)3;g7ke^B4O~KMZ%~k++0`P7RGPvm-4H>hCwH^%VOkHmfksiSvvg zo%A|XM;FP>-Wdl_VJd#(fYJgj{Fv!y4YKQj&ubt7pTA zjX>QjwO}Kqk%7hrS{P_)AYh=0fgA%t1K9=?mSo8s4tj9+NS@L%q_?6PczS_K!eIx^ zKvM%8i1_f+fNuDM9%U!1%?va*F#W+C9uPw>?u~iBfmR0E7#Q+t;LK6AwSfl>fBfMA z-qZ_>{7U(Lv@+w2#^Wt`ueKB}3``xMb}-PeqV+Ohy{-LWqMcCCq>WtRiKsRwxjmPy;(!=1KG@m>!%GB>Ak(2Z> z(AU5~1J4?G(%?on{(;eykN6S&m}>+5Std7C&aof;XK;YwpOE{E;h*wMCy#t38N{r8 zuMK8V+)$qr&f{O1ayp+k{OS5k>JS=$;lEVWir{4fuP}Ee9yal+fuRO=8TiA%FayI4 zEI06tf!7SYZeXf`X$Iaf@TP%r2HrO?!oWxa?-+QORd7ao%fKiDZyR`giF)gdcF$Rj zo0M{o)1FJU(FRD~Gcbn6P`pX&vlj|yTS&e7+P;PKkxH!9du+ckKLW0|tI%s#w}yK;M?VmSyYu1x5Zn-we-b)z4`^ z8Cb_!I2PEzM1G|(em08rhQCuQ$ws!IbN*pQ9MdzHU;}XjHY={I7NI2{3s`K1tmU#A zk2K;|w0+KLF@_zjYda6WvDgTC)n<&c3L@fPCIIV_@9Ae zLdcH`;Xofh5+AA>JWWe8aKXSu17{7~KBvWN2G1Kf$ND|5@oIiv(-tW_PV16^%Lc9( z$oH{YWU+GOd9_X@l|v<0sXR4c&QY%!xX!wmqt+iCB%Yd}+%j;-KpqpfX_Hr!ep5L- zt7MtzH%ZNFBA*GEsQrmjyFe48iIU$$0TYEyY?-YTG(kxr6D!B7RPJ?ND^%K7D`KLk ziQc9!EN0?|@ydU9RANaJrA*W@aj%KeCd!zoWTLW(vL^o9lwHn5c@x9V`zL}`FfskS z#{Wtcg-qO*UE+Oh^?9v|iK-@#sX{Fi)l5`3QPafy_DbzqIWQfc} zWU=#FZ4dz)N^7I>eDDi^eA?bU`Rf)}(d z7c{oAfQf9=|1M}^`Yn+cj|NjjLZNCRC&Pm#v<%mUG&RvIBk49kZE50u6YWg2H#vfb z)+XAT*xSSZ_J6>{AzNu<;*|^9gM#->3(PQ-2^Tb0>+%a)2h(rG9Zharmd)n^zb^T3 zA%Da~CllYZoK1A*y-d7s;sX8Zj}{#Be5iOfb^k-@9p;3GNxiYs^t)>zE+-BjO6~o->p;O^h%x%Ea5IzxM(+ zXSjVq8_7Gq6L?FIn;pGF%lRmroV8WSC0}o#IfQWCs@C( zGTy|8OtXnEXsZ{s2_`0+m}2516CazH$YP%mn8cgX+9mHf7d0+Z9oSJVHC^Qn22)MU zF!8C0X*6Tg{{zJV3NHL4&Scf+Rk(xDXC`KuIQLO-OzRxtKwD*wW}EoZ#9|XmSa%n- zuS|T+=GjM`BccARr_MF8XsU8}LZI9Sfq6{QuI%|H7MT8~NecxR3DU`8S4(S4O?+cw zg$W*tw9LeE6I)Aa?I&wPMyM-ItTOSPiPfe*w*M_-yQr|5t#6@M}!0 zHL>ZUMxOn)+KGezCVnz;%*1gM>rAX?geJC`*kEF#i3IJ(M2Pie!ZHzKM?sq$p_(Ql zEXk4@k9lGOcxqCV6;#ImYj2zh#95LhG>4%IH6gK0JYPbaRZ*=!S>vHjo{6N1Tqc7p zo!8nx+QgBI8jo$_Nler%Q%2j&e#yiyk`ew%=kIkM9rZKKzJX?M&%Wn~f2!24CbqM! znK*3XHxs{`_`}4XCU%&}dr9Lr-A)s4Z3~<)lC#T%lVACALpHziYFyHGv#FZcN84zh zvxg>8C1=u;+I|zngKUGn)xU((`L~b*CMQK?)7kox*7-@T_a%)>jQ?Tq3c-Jwaudoy zMLicdYWf>k@%oS5<8+nego%@U+(b|^f>S0=vnowoH*v;9hhoY_6PFkXZHDc4do~v= zpBH1GJzQXu`5-`Y*#tKz zw9?1@y)tNr-2Gtw*#I|iKm?y%(uzhzxpf<+?! zj%O4W=PfR2^Jge~YUHqKbdD>fA}Ad}r3flV&|{WbCc-oOP$7b{5wyzV@2OQz2z!Pt zmo#o`Rx#pl^2QBVm{f0aph^T)Bd8Yf#~8;i2~>~xO`g3W$UBL5rNyDx%<5r3?YqkN4bD0o>T zVb~@SG>f2l1l(*SI|3zweDAAj1UW*2g1VptqhuV}Bb9Ij{s zu4uy}crAk0BX}c%6UCKZD=A-I(e53hz8S%KQ5YS;hzNFG(av1aMn>>f1SGshMew%p zcQTT9B|Y?dFM=)I)CygdF*L%i%2>g1v|%BXd>~{z8{<`t&W|Gan6@3kng}LFFe!p> znBS|~C%knfWr~>DWSY=bjcFrJWy!N%%Bvl(YSSZ_Aqt;HFgJp)h0ly&7F(I{&m;I! z2<`0)R(*!E7{AK!Ig(i_%oEAtjC_6s3xqGsNEQjX_akkIkfnmlGQP_rV6iiv6_WCC zSGAQ9tP!v0n zNJWs2pv(ca*fn30%ML;0L<%`on8CM1@N)#eu)#*KJ%ZmN*cS08-2N(r>tYyNpkxzD zSO~wfr)38c!4BF_1iK{T`y$vM!5^8@_%njt!uMn(d)br7n&rPlayWv2BKTYQ0l|YA z%|q;YuKBNd|7Ik|A~+)aXh!m%kl&5KaUmx%@{?@H686Pw8s|uJrBAUz%DD*6M{q6j zzq#udBL2kn%Mn}@!WrzBBHY#{IPsc4v;9g0SMMs6R=&BWU60@fZF0YMGlE+Y+-48V zskY0M3Yoe0^va3?Z1qt*6-C}C@T$T6lV;*wDdKtcl{u*1J|_M*EAv(N-~D)KH-+;Wuhn-Mfs?|LwngMa<2PA zUKOHv@w!&LSCG776x~E#g)yhHIZ3#>kg8FCOXq4)Ot`LbSLYg0)QsXDxoSmGJL)e4 z;7-vCuWLgWDkR)ix^5KpqR5UyiQ?utwSE*0qi7UGgDA$7434j&-WNsux<*3Z#>~Qg zB_NXLimOecsNYMa7Zp?{HHscl^o$}Hg%(9uCNc^=>OW{&36eC8qFIJFkD`U}mKn+Y zLSAp1)jEm?gg+R?BSP9l(Kd=d>MQM{=qQr*f*k}I^P>a($?6Y@^I^fG1$;>-;hm#+ zRLEn3ly`}87j%Dh@DD?kJ=eAFQB3Nj)G)GJl~eMJQXh}vi70wUxzl)duP7)yS5_hK z6Gh)B%2W(ehZ4%Sd4YaWJRQZ@D8@z6KZ*fS42xoT6wgF4Fp3vgaZx-Q#lgR`pNnF! zkU@fLMk#MEP`7LdtUs9jJZrFFPL0OukSJb?;^in_VGIqFIoAXIZ)N8k47?h}&?wfa z%7k%&0$J*S9ocst2rl`BZ*+J)inpQ|6~!A-yh&5Mp^czs3-#7@jRS+VS1Ti<*f%cl za>*uJZe+h5MVEn1-i=~3Yv+dc4sGVVa`wKQpBAX^MY&7v>mfscs8pZY~ev=0BJ8L=9Qg#U08O1Ike`Mr;N+KDM z*PbZ$(#E3LFTMu^|H^3o&03RN9Lz`#30ZPWMsb3rn$nI$aWsnmqW;kUf8NrL zu^et`|){FZbFd$q6YGIi0-}2~ODaqxN zGd-pK^uX&D-mvhdg%K9d*j3Nw(Tis3D_i80ucF%Pm6vNP)E{NxZ41*aZmfZKSO^xz zTlmnzXbbO&wY+a(j1XGRILluYKbD1%r9YgdQ)2H449?O&u)qQ*nPA}~3zNn9v4x2i zKC!?h8av^{P3a2u87UEetBj@S@OeD(%zY$!)TckVnX2K66!x&v(L6y9195xg^y(qxvp>o zvcMw>Ien9q7Y}Y@k7OamB3h}W*-ahNa@i+9-^32#D}~o)i)SDIkN<4p7vWn4yZ_-Y z#^HjR?Up~b`MbphbpC>xFGC6|y>nG%hlQQ&<UkrUpsTW^TxrjJ_%wI&zb)YX_3*^3}6pEp63`Jw0lS@R4(Ais?x7%0dnqms6 zTq1^&F+32%gE1b@iqbLU#1M?3OblgXxHpEnF_eq>-E0j(lJYTBh@ql5E5%S%NM*q) z8J(dw^HdXFJtHYw%YO&18N)pysU=ujuuewj;d;JKJ#jXUp}vp?g7*nF6l^3&&2tiG zAciI)$FYVmqj~z9Op}A;AckjR7#hPc=K5&%z!(n) z$MZ2f8^fR&o)cmIe7^B8AQfJS;YAuu4EN{Nhs3~7`Z%fjEdpy7+#OzjhO$oGa}}{y>NF3e)7K=!)Ky7l6Tyvz9kA1A5qEQ ziQ(NCtQeN8S4IoYjp6GUyH<>eVQdWJSON?sb@9I7$1!{m!+7C*valXMjA4Q}KN6&* z&lum9CW>=Xj6;#W4NuPaPRSSph0{g&x!{Z#J{2-kaF!r-K8s;pUf+1W5Xo%8F9pBK z=*(eK+xtTn^F(qwul{`u^J7>L!@?LAiEvd6i-jx~Tq3wsaG4;3Yp?hz|0aeNB3YS{ z-_6mtF?=VI)q-m>zH4LHE-7T#A7c2Cj{xyncUOT=0U;X%H{KPF2$UI;6&7v?nlVI# zMA_kF)?D*(&#H;V5SQBFL!8b;3~mhjWB7}GP7KKyeve^C45=8>G5j3EFEQlCaK22= zW@cZ_*~G9#R1N~~TO8n%WefYUN0c|eQ@6&jjdj5WQdQx@b4H7#JCI@XJR>vM zNkp7T!$-pfC8zH^pPY>I&a2sE5<|H@l71J+3;f+80UHM$P-6a9FN4& zDGtPuH;xu@w2UKP9Qos1$gehwqd*)5j=rl8x1TgRdmc%5hZ5$k}05i=%oRH8PT# zLY~a0-;h*kIvEMAuAXojSQ8=j<7gn{KEZ~9jRYGD^6mj4Z{*Xng(!k*963T# zp5M<0hITF3nza@q(!5XXZ;KFy~O-Ih&x z+ql1-4!6xA=S~P6;vhaO*fEZWgiyi*7ML$^4(3wbn-$AnPWMM&4U|6WaJ zk2re9@njrN#qoID-|(al)3aRR#wNYuctRw-1?RQSp>JRDefxW5%OSO298bsbOdRC& z>Mv>oGRpO<2N{HWq0o0w9M8q^dK_=W{Vg~K$MIquLxevs_=4c-eELg5UKOO~%R*j> zBb`sDb7&mH;uxOseN9NQ&lO(ueKU>`aePT(93!Q`KVxR&cq@)kaew^b?KnP;`|r>1 z#PO~ujE>_2A@2!}5gaQxPLOr?z7P&^j2H5u-~_>s1gUdoMAk&%lj8V9$YjA8f>Yv{ zDrA}<^`|pod;Ax?Pen3Qa8|~bqs07z{(@~Pzkc^?dUo6&`8=9WpF>NCV__VN;`o}; zzN5|;yf?o-FAk2?P(oY~2S;+yL0v4qOEX?e*jn@JR9Gewl1DyPR>ZNA&NzOLV^tjA z#u1Ohj^n#HR>!d}j`eYW?fjZJzGtm*IlLe@L*Pye#2@1LQ6xXb{k<3N3OA7dt%c(- z#A~BqNE8@@8An7UR@~pcA)4`}*R@1WOq}G5%84Tp$EG+ovtYwPH;$wvhTIcL`}}%} z=D{v2zh0nRlh{NxH;!@nb&@S?7jbNlV@H1d7xreOlx=KTqm;S%^{sJi$gh+9O0)b& zWk6=|LVleAcf_$XjuUa5WKUH<-xbHcIQGZ!M;w2$$6FoP9S0-d!-lXm=%;p~x;GB) z3lS)w{}spIas0z35XS+@#UUvN=H+09kRKK=md}wmj!JCD#FuINPZD4AeT5quFy`ap z%T%4Bf@D0ejWcnajpG8VIF57dp9|>B+IjJ17C1ceTmk)39GBy`8pkz}Utte(P~%>0 z%;uN^IL}j=!jh;5%Yp3+F@ms;1$8GfD&tFzkL7n6C zy={MxoC(-6TV0*k$G$e66wU2fIsbg8WEa$*w$b0l7#m}446yNxjn`;1HU`>w*2YUL zHyeX&JZIy1n;VCsdqI8Q;lNJS?%3hMbHO6BL2qxqX83hJ-e zAbHisP$5@S3XUnmYz((?tDt_Upx(8WQnirYtdRbOjW=z)ZQ~sqBW#Sc@s^EIatp>e zq)d>J7w@U?F1-usgQlpj71H0eF}PLEv_kr5W}j&;q%&c>NXFTC-^K)+ix==sA^igz zAJQ^A=Zv?pE~|-CNGCD@M+@nv8!8Nf!urQHCen0Qsx=Gi{7XC8#uOW#jik-vj4_Sz zFn2bl+n8ZvfsKVWKD9B^#%vp3+L&eIGaFw>44(@!DiZ$ACLxl4MXRvUqOkt8Aa6~{ zTpJ`5&a*LJc%Q;L|D;p6h-vPsESK08+gQS?6v;Bd*9z;C3hS+=DAZY3Tv=3DUuk0% zjn+ok#Y)>v{^MQTNWwr{-cebSX|YEONuJ%n4@fU zy&%a3AscP@zv;78!-i?Ymb#AEh}wur?I#NBtRu??>-~j#IgFfU5U24!$9X1-Bl-y& z?%jI)M4|B%DXye!q;2fC@t2KU8=GwWZexdy%{KNG*0=GdHn!OKnFdo>|HZ~ub~Tnt zPUKakh`!y%gQoJE4OS~Jt%yEot9rXcutyPnr;R^Z=2x{{jO}pX587c7o!7J?`feM0 z#A~nMK0y{cm1(7a+c;q3q>WQHRu<6@+BiZ3w!uO^WaBWiUqt_h{o4>VQc?MrQ5Dh2 z{}UrWX5%=`c#?Xdh+ed)PNQY1o{+L-sMGBHZCtc*$;MeJigPy3vj;1xw=L>7tMT=6 zF4$m|(a4FHS#hP5D>kl*kg+{oRDY|eAM-UE_&!fWxmglyJb$`GO7#J1F9ykb@gjvUl4q8oGXh(|bn!^pm z(9*&E4!9{_Q-|v)gWNx@nS?hk*lt z4?6y4n_0#DPk?p~+Bb8pR8U!Kk2@efA=t~ov{3MeAC=zXN5@s?hf>KFu?H#zKT^>=xka{KXRYatC&8}!CS?2sy*jm zFq7wCh=b=HT&SVG;DGxd^5Xavog^2M+$+qA)uRD+VVx_@#mRiG#@w zK63D}gTysI@`cRZA~EysxlMAW3a8pM2e*sqB%eB%>A-RjV@@4>#unjV zEwk_73kORbEORj1!IuseI9TZ5D~E3d7*<^GURa*rv?9em^9TN)?Z_$XzCgFVIdRZL8AeI--%mO^r+xc^4Inzpw! zNS%r${1;}D?^)>%esZwRfxo+y1ODvb$T>N84_@zJg9F2X>0l#UpMx+&w9z(b+1!!666yzq!r9uj1V9 zV3&hGg#RY^yWkE7JB6@s;fOl%PjT*duv^F;!Mz!seN0{nf7I@;jO1?z2QvI1jV;U9Hu=8}jyO0fIwu7G%jh3-a6H4kR#_*7pAtNsk-xAm>#T!w4$e#0aZT`o z;6*|9Czl*t&hRS^u4Xu=;?Ot$0`;bYTkP8t$d|xvcK!~kyrSeu_$B%OMVgiHg%Bj+ z5NrN~KQ-%M37s8R0pYz`pT1S3!Q zdk>aMpi;u`-b)LTlu4kh@N$CX1uJBHD+=L)n#vhTl?1A0c(nwo3$Kxp)J*sT$c&a( ztpsW(P$z+V#aBx}PoQoB^%AI`(a#prAc6Z5XqZ4FaRxHJjT8P4wY#x3N#Lf`wIaT% zU`|Fen82n@{!N=E&@6!t33L>%<_WY+;QjJfqo5$Xg}#K0=<%$onQRJCpLK5?Cj^e*yy%nCfDhi)RuT$g)b{Mgq?!Fem{l zfmj01B``RFB?&A|;Q0hzNZ|7XzDVH31coH=P6F>H@KOTv8~cU)3X863&dY+^O6spB zz{x*DB@M$87@ojune>bl@_GVq2zfIjAHf8S^NV+9JLRneMv46GjBo7|c^Lob1jZyV zmd2UDiIO^}0~IW#bFxsqQu;U+X40 zoCM~wFiYtZO6gzINa`!R<_Y1)9l!O6i&*AQtMg0gi<$CH{ud&@3VFw62`o?GhXj61 z;F|@^7_#sxOC$yu9#*(!%=;{>hm z6F9P38FoSaiDtlLClF?jT{LTb0vqI}Ofc`uyKiJ{m2)_$$zX8dk%T|%$tk5%hw0?J zvM5tERH?in5Kq8P;6MTg85{4*ZX|*23AhP(O!f+8O9IIRQfy@ja1u*ekX?FihLBUf zS)3$$OX)u+@C$o`J=#`@VVm%arS#IJbw>DG0>3A)JApk3>_}i|!hf>-nZPcZ>n)Af zAM6cE>l{KPC-SkvTg=|B?oHq?>HYSx#~Y;VrmIwH^;wXh()&B%Z)>l{jU*1as{DpCXO`|JMsa8+3 z|4iUQ0vDOEBI;R|A=}P%#k%SLk2s$I|8Y=_KhQrYtzSyuN&;6CxXi-rrz|S1@7tLj zFYW(*=E(mww$P?NxtYMN1XLF}E^a4qhrOta8ZPp<$Z}E9MI{$-k=I3G7e!n!NIn-= zOY4PPJ&MM~O-YJ*O1dcJqO^-LA}J?WHskwi*{t#zUO@==#a%mAt;{49QmVMXxoGU7uB4~Fiv|o;U#-X3s;boC zLUpcgX5#O2(a^;|B~@O-%IEL+L z&|Nfj@w|%{Tr_jh+(n1=$^aKFSb)O&xwzkjHPxSK(8@(HJBPfriw9gh=%S5_&MqEx zxg7X^W!2F|JK^mGJ7naoO8Niq9ununf{(c9B!q@Rug8SFr{28NX-iE0QNO@~0T*aQ`k(yXfzt%5VP64VvFF*1n5@u5azn zve4dD2D=y}&gTRvzd2oDnb6cGxfK6N3+ED$NxxlfQqd!s@1_O>q5%@Dp83a`DSp z^&{TG_1Dx>$VnZB4c5a52lp zXD+^TvD(GwF1~Ov&&7P#pE$&=UuV1c(#5yWsb9G$R92tsf_uZx5nTU;@-^FCS)Fq3 z9Ls4i3tTL5v6QWHrLxe)A{UEYjQm%*J0*!i#<|SJH!fDVSnh%cdGKmmR$uAjsj~Vi z-iQWVR-ai`CsM*GF8gZ**SJ{g`qP}kF1}|IU_ck^Tz|UVkFGygibsTS+DuKE3bo$F zMp34GgNrp~^-X2`o)F&9U8BX&6DbnaLicVW{W%ITb; zSEHQXw4C0poKE7p@K|eXl`fJlQZ9D0E?lHtb;8W;vZj!E*SO87Zf4cTu#w{!2OiWI27#&S0bR`cqAEIJ0Pni=8fZx%h+GjH!RR zs5w}@yPIy~D#6=h)Q8IJdzsEX0V@CHVxRE+F3vZ~8CYJQb29KZ&B?_(<@JLuC(mGQ zdHu8U`dy^(UuN0G1s4}x9Ch)Zi<2%+x!?!XF`D92DmUgm?xLH_pgZCElkvEv@M&i4 zf^x>iS$1OUd>!sBe9i^87e4R$`wa687vi1n{-m`_?4?~?b8(plc1YV&UcbUJDX$+Z z?;90A+4uwEI?e2k#+%+^=g)r0Lq`vH*!g?N@euTo$&u;?noK^1eKpg$JTHEs*0x!z>CSTV> zLl2ES)bmi^Ljw=@RM7A9{FnUJ6?7t)|C2FMAl|ac;AJWW$Rd1`BzfvGJxg z{owg4>h$7?3`AZ-JpWtD>N{NK$yTjAt3^=%K_QvMwe?+WS0-SszXqglCqwD&xJ{Ro}p zJdMhr zJ*@IzcrZPD>)|^OXKQN>2C1th@!u2K zOm=E(Xv{m6wQM!Z6*_-p?ReP8Hs~R-L|f-!gAnrd9_qFUk`T*PP{ZOJdCr;Dm~t3>Mts1efg%q?ome zdaj2}9?~8tqz=)ls8e&Z1f(*BKYLiWGVqIszbfjtE9xiK1=?N-Z1eD|2NGV}g*@I> z+2LU))ja&|VV8$LJnW-aBDkiH%Cipt^f-1A+|7=0UT_cFS|sqL8{F%mN3|UC{j7^f zkUN4pwswHcYJA{7c9I?rdN|~PF>qJ3!;%pu=^qdOX7~{{B{2iaS^LL5oRAxxVMn?x za8kVHM}w!>B)h9lE$uW*rk1vBrCP0$epV{?9DA5bI;-`fhfD0Plc<}-We-<86i=c= z5?4L+uB7KrqCgVY*vomi;o&ATk_7h;z2)JyhdfEYlHxCs8Jeib+(W{b@izCebMAH@C(~G)Z!HeJ~)nrjq{j;vm~vc9LJv zIh6BWIZ6CnNpB`M3MQcm(FL0dQm4w=Kyy)RA=pyzenEzvxGMNS5)ZOqlXx_VBbD?v zNiInUwohX7ciC-|XqQC54(6+@6FVf)F^Pvn;SoVxk$okUopvi?{SU6Obr ziQY+cWrABO-ICbi1zS|s$w|5=(L*HUJ(GAm$@%R;@?J?WNhE!e=$pjekCozs)F&BL zW&P=--y}(%N}``g*n!YF#|ieQrNx6J1Cw|*i9eIroy4Fdo@3gQ_&SNfEYc+RKE+!} zY@Z)|A&FNQ8*4lfd@+gU^MXT?cqxgOlVBkatE{v9S?pIA2Ztu{x>OBsJuHdgl7`m= zX;i!;Ywe9B-c0&!lh+8^(h^@dDv7t5sU*KZ@z{<4+tE8oyqm=6B;HG6JQL7W8$$z_ zqK-@A{Uq3?#)^;Mr>e3HcCg~4e_u;-tg zM6ExSDS{+Zg)FPAPnUMVrZIztQCWX-cVHGF|?Kp%B23!kAPL0*)9 zFZ^S19;~eY#L}qZ_dn~Ben+&P%9ZpDf*S=xN!+fiQ%E$Eh|sEOb!^Dg}mZI>?9nft&U2`>x+V3lJh5nX|~hDN>VtTDZe&@BoyW*u}OUUt_;xmGaGmn zeOnU0vV)2Rf8ld{NpLH>pjfb=7u=r2Z!E6wvf25xUK#j3i5;{Ab_gp2?AiDz*~K#F z&d+R*u0m(==hZ3k;2t&y_F5@aN?~6T`;)jr6HVf;B>qm~G;2SJ14$fA;wV!{^0j&> ziGPw9QAIy2&5DxVRrG%uB${(X6!@M%PE$OV#0fF2<6@IENZQ^>;k3Y0;w0g7^Q?5m zmn84!k~p8l1*YE#UKD(MxX))*(WkalE+_qSrP=RYOQKgx1u5iB;d&A`q=UVg^dD7s z_!LNj-NJ1_l4IkQ2X3i(Qoe6i3OwGL&U`84PoYE#B~yOiSRm#1frV2jD5OvdLx*9; ze7}1vl0wlG7wY;7#Z!LMCSmOpsj#MsUMhvMDSY~^S~`WTRrE4~l(W{#iJV^LQ>c*P zC9GiO6sj<)6k4QEHHB&^G)UpT6so8EroD2X+HPy01{1SW<5e?-dosM1klKQEQn*)0 z-HdO&6zU7lUJ_)$hACW_qH|gTH0-=Ow*P zSJBxna#9GUP_C-qQD`Z@OVI_J3N~X@mlX%ULohv`V3M3S&|jo5BMrJeWfN z6b7WwCWW>s^kCsLVGI5B8ob)2&_0C@DRfNvA6AbFl01~c!@?gC?39srW?5DJ--z^M zDRjxmy9((h*qt^k=SPn^Tj!pkYVlEOe1)NbWj@g0=Hb3z6SJ}<~~r5V)=!e2~bh!9F%O8L)pl2>U_tjGDm zw^&>)l?o&ML=H<~cnYtH^6P>l1>X>SGldaCsQFkYKmG#^eH@j-+Zp*gLf#b|ox*z= zd85Ty<5GA(h4CqTn8L1Sv!0l%*0~b+Koq`C24AnLPe^g86h2Skqm6efwn zv`jpoq%b+dr=&17!}}lg|0GTq=M2G51!oG*N@13i?H4J(!Omtwv;3`emHpXYrtp>M z%n@8DI5&l_g)q)}LgouDNa4T||9g2+#&@xhB`GY;NS38=`!|0`c0~#+Qz)E9ku+AN z@NEjaQ`nQjcPXq+!A-%FAZt=sPg9&9Tr1A+1%D9yQSc|hb%Km`K*g*LDQu)uBvwWq zPQl179Ta92k1hmb#0{_kwc_p;%na5#m3 zQrMruuadAsqVrb@e+xN~341UF?uX1!yq@T+^)Ht5ZwjYUI9XLclF>Pu!hgb#WhBQ_ zIFaEeQ!pd`-^|k~oJrwq3g=SDm-hRC^X#uuxRJt5QNEbMl@zX~a7mn(Gcok(l{Ide zU&7Z!ay=uD70S9LJWFDu!tE69WPJ0a!EY`Kk@3wdg!P+0BPk%HU>b!o5*BaKG>WA$ zAdP3zD4s@%G@7K5okmH~sg=fzdBIX?lon^1G^z9#WX5q>u%!ukHm2pb7+ zEEve>us>1KP}As`#zSf3q!CQ}-}rT_`30qk+JkB6X*5lvStiu|X*3t!A|q*;hP~3S z(^evBosmC~MnQ>+UTxACI00?bXeYkyGddm8{D$&V_;8wkD!E5N@Zsiar!+dJ@kAQE z(|9za*m;H)%2;fmct6K zX=zN)aK50o+7 zP8#uQI_2}yn4k8)6c(kifJS&Ohu1<14+Kc2ul2FPF#nrwNg5BX%wC$trbWS>PWG}4 zSwS2-%2Zm)458>x5T&AE48#WX{=3SLmC_TnAjHhJ`Eb%!Ztw;R{W6m$FF`A z{3(rfLO77MK0`ujgwu$yu?$lA^2yIP+JlkyU*pX*mj?Uq?NJs!>w=kLi%7#^w=f)> zCPXYV9Er5g?>dP`62W8|sWb}YqF^r4Y2>D{Cyl+#Q5u`m_$7_4w6sNmEo^<2bAC>v zVr}iQ{n=Nl>HId?md3AXj$kXhS#DwgJEWq269Y&LQhrb4q7|fJ>`Y@9Qz*WF3Q|bh zSbaN(gu^LrOJ!dg`_nj=#`!eJy zCYwRhxRb`EG%lxcgT-hEucX0&7rvEUqwxsmS0}6cdK$duJ*&{Geyzhx%Y(unzTkv|vYloJc(qHr!M<)U&f_AU$-$whg# z&BdJPg<`oVp6h=RkMM$Ja#13e6RWaI3X+t{Md=KuWtPqLnU%vZyQMqGB#M za>&@StLtpYRdP`^7j<({FBi*gjbEeHa#1}OHFA9mubGQ`aybYbB(Ih0cguBhac?ea z3-2~p;p;04pZQ|O**xp#qCqaQbD`w=pDOnWHqJ#uAsm8elnWv&B_I;&G|5HJ>N=Z% zDmT({p$o~$C| zYHH$p8y>0%QUnB%-pjsQlA-smC{k=FqBI3WK@0n7rW;bt%GoJIsh?!;sDwJJXW{!$C9y1t<-86mi<4NA#8T-_OwyfbBKj3EFM<`)P#sGq$mbivRh*$;g|7N%ymm?Oei9!@uv^kS`MDn^@lig$qnh|6iBFTT zlW>yQm&E=g4l|5%;wNz+iLYp`Rm$h=_*#Y67ZMy~)~8|e%VhX^mVm#BD0WB+Zy1Fn zhlx)0xnd-tvrhTyZ#3URHV-x;Qp$Vg6BQgZm$ z0PS-o2p?(K-&_($lQ>3~o*p@!#2Gp#W7pjHH%T0)zx^INLAxb!DjB}C;kz2XyD3o65n!w)+oHrCvhPkf0xAf5?_?`lB7T6=U$fJ&i%?2j>0~L zRb5Tu!D^!9fyggO{7RF41NR&Jmc;MmXYf!4e zTKEg%AC3;^vWET|{!5~OhNc>tX(*@x8Y*kJT|*%ag*BAXP*y_`4MjDS&~UScVj7BT zSU5S(t)6d^wKdomYuhZWw%5UENe!hmy#7P1w1#ghC7!EMFs>B5MGH5M-mq8s^}Sey z3yE^Fcm)j=HQXw3c}btICRi;?y*G|LJ+1I(q`8I`8aip{tbto(x75J0tf7^L){^sVi-K)5wAIi~LwgM! zG<1|z@sOqus)+}e#dy7py!A?ghqO{3mhGaUtA=hGx@$Z^9uH`^Q^Q>v?$&UR2HJM? zg+vco3BmZ1v7Q?4Wm~k^UL{^S{0-Yn=6?2fq_+mrK9cs8^uWvU`@f10+7a6wjX$Wt zdLaI=hKDrt(?AZ(y4Av;07K*gq(?Oj(6Ca&Dh-cmcwECY4bwFY)G$cH^BTr#7_4FI z@yKuuBP19i=}-+%NWiQoHGEt%HcTe_HHbf@;Yu}8dQ5DThLI9KEh(AL(A4D<1fw-j zfY-Ac#z_2}hO3`N$T`DpE4XEZhDjPGYj{z^I1S@9O!z%Ak;yX=f|q1+0)6|1Fu9>@ z9)Ft`Ox{%b!?tMCX^~enyh^Nr!ZYY#??z^7m_^U|B2l`! zh<>DyKU>2b4Rfi|j>xoMqvR00reU7s%$JlL*0zvSL&F>NY7HwiymucCf3uQNueLeimv=HYS<_HvRA{!>f&R1czfj& z$thAp?5E3VIIQ8}Eed;dK*JYuP>4U5;2Xe4L@o4S;KD{e&?hX>MxT1 z%9xx`->f0Xc_^X&LGP0In#?7B`(Tt=*EReloBmrv0X@`#*FPHmmCXMn9XCa}!7r!- zQl?P8B(sX@D5j&fjygJu>$pir1sxUjuooqCl+tmFj+8PxOoZEF=tRbrDs3MbhNJ@THDM?VGrl>Au zh#N6K}7hgN~LuTIpylIb^og(MIAqJyj-owaZU-)X_;t zcO7?1PG=omb##-s3x^<~vPh4bf`FxNRC1S&yLE(oc3j7&lVbmub+3+IIyxHYWT3Z> zK05lP@Nf!!b=;@J(c$X2U&jMFX6l%w<3Sw{>3CYlGnC{Q=@_JAunul^@rb04>gcbB z-&pbDUK|5-Jf`DunZ=Ed2GT>GiZ`kpA6-*$E2N1R;zM*iq2oz9(oON9I@b%uS=BK1 zaeidDjuASzjT^t8dP>K8J>x7gQV(~lm|s(r*&Sz9qjYcq+p{{xu&f>~lH`IneqaBb zj_0X{j%hmhA^cb!lXbkThqvPwbi63RI7!JFFTqQaPS7zipFc?gu4m(iPE%OCh~N$b zq)blN@rsTa9EGCdRSwo^^-xX0MQdAX3gx(Rx~3p!Hf>I|b?nqJSI28Q-qNvJ$2=YL zbu6VP=vbg*p^im57VF`P$Jcedq2o>J@NSF?9l13emswt~DY%l5s}?KP65OL~i4N{q z*n3obIgO@+{pEtd`uk%mb*$3E#f`CAqE{`!HGw=UaE*?)b!^hP-U;vMSgT{bjtx52 z>EUWmE+ZUSOK_ne0T(oKcf^hCR4u`a?QYhwMaMQB+jSH^s&cg?Wwuhco#9eCu7TX4 zhpSJi(%M>rU>EDu@wtwJIzG^`TgPWQ&Qy%=(ea^=U&_~E|?@{ zZJ*K!_s90>*sq5x3Cn&E=c>i_k$AYubb0Imh4T_@m-GuAUvgeEnCtjT@(=4cqT`Sr zE`4M{7EjVLJ7by-U4pxMtK8|4)}zifj;bc7`Tm%#hYKue1WU((T7uwsEy0DgX&o6l zRSH#8$m;MI%2Ftig0CZ>H|qFFM^4949p`mi&~Z%Gb5_SW9bZd_`6l0gj!SSt(vvz) zNpLzp_lzE%`AhfX%Ght^m{zPUuGJDuen%td_(8{Ih8GTBsc5x{=%&uIl_z z#}#>T|2p~u$C1wPGaX*XZ#sVGSjZ)*-0SjJJzSm3;%x2@-U?GFnhNK_H64HE>vNsI z0(AVXEYZ6w0PhGKEqp+>*k*wMDbf5~WihCFVx5WZqX^DVIWp6e>!5YYOEh;HE3gx=rHB zlJc92N-2<%f4k%mRACcmVg%JvsGdUe6k4QEBZZnNdRpgB0qd!tKKN zjcwf&o~G zSPJnJ5-BJtoTw6?S6f7%h;bVn?wq5h&@_ctj;rzV8(8lLEgA zB(pCKn=g641P@SQ2_DMlbH|%UQs|$;wG{qL;n5TZr0`Y>t5bL^g~wBvn8KtK2Bt75 zh0!#13WHPOJ>tm}hNUnhg`sSvq_Q@O)0#a!uk|8$W}I{P^3_T#ra9{ zN0zcVg)J#;O@TYC@^(zi@P_+KiSVvnwvw_Vh4)hUK-RO9o;g3VD+SDm@Z;#mIwjth zrMN2{`MXotLmQ5cb$BZNp_IS5eYh#>$DBtg{F(~)wEQ%MeJN-u=qc=%e#ps1SLF4X zOdd$#a|sSg`h}!lrtp;nhf+8q!C^^R>Z>);WIk?RN2F3PQt+g=@Ov)qi$yOo8OZly#n@0$0OE z&oCUVj-QwOvyz_6m-&_R||H3HubvWy}kK%7B{GLMQ<~XlEB$%)%c0Gl^7;FvPX5epzg8h-g28tN?hrvIE z|5E6ACI%y<1tcvfDU&1Xh(iA#r>GIevEl}9GEhunCK=F57`WNMEe1*(|J&iYq=8aK zxQo=RI)d9A@yVf#0e&-ntAX;AF;LC`KQ`y~O57utk3hVMtgRD1dsHyO#~a>&DjBG3 zAYni;aJzvj1|kOX4BTO$s)0HN>Kfr*M%4_|Fi_J#b=lm3I^kwVy!f0}%Rp@dN9zb~ zVf0HKvEZm$&j`N=XlS635q?=y-#`P_wk%fTj7r+r2=|!f14F60qDej`hrNi(%DI(O z%s|`-zn~|RdpB{{Ce?s2(B23?SZHdXnSquDS{dO7Ak7VMW9JqIR(}v@GEz6(F1WRU zHj>}Y00r7gOaXq4LSfQwbwvkR8^1&0^HOI6U8szKFOBeS-qpYe15X*~W}v%)I}O}r zpr3(<4g9%5>0zK3AMy>{ZQvdQkJl9odd7MhAidYX#JXacJ~{W*6BHmAVqmC&Ck#AkVB|)n=>}zFJu%F{a07NdF{hr`R!>~4Cw}Ry zj5P4HfsL}W&lnhGV4i{b21awZ4NNjH*}xbB&(WO>yxK^;xxRRw3e*=ba&Qg2Kv%3U z>dC7^eL+5D#v6Fazyt&58>tfwEUPazky&35?5QtaHZaA&OarqFoST8E2BvXPB)02| zAM1-(*pPu428dY$D<@zLq_Yit)kvLVV6FsbXW-Tb;xz+mga0*61r``s$VLq;H}JZF zHw-K?u-HI>#%gnUy-81KtTMSof~AsvHv@MxR&QjjFtF0VIs@xv)+&0Gfi-jznPl1f z8VJ(2W%3z-9wmIHm?ZFtF9YHUqol5HD;Xwi|fQ zz)tBrJMx)yq~=XjQi@TAV7Gxi2KE`)Z{S0Y8t1Qpk7aXg=!RCGu$2aa>U~PDld6&) zk;OkVaKHflVfIGlTmwPyxq*X{Q(pSXR|XDoOih$DaoE5S1J~&429gFe1E&m}HlQ0w z8OR#&=*$MjUygLki@63&0~Q_3fWxMX$9H@g>s~1S+x5uy-y#bO#L@-|H53^G^*Y9Q zRroRL8weO%8j9lvats{?zG3j$6*)$WMG{|gTHP9BJ$FA6JNjgJs_e3OtliCdi~7Y+ z7&vKQ?Ye0FPKkY^V`mJUHE@{@LoYJ$ExoHk;v(J8zy+!oiG5E8TNnM#K#z6NX#E)R zM`dG0u0<|C6z0Wn**ijZ?$l4gA3nkr%67AVzxKz+VjbCW@N)n_-{6XQH49{-yP=f&Yx~ z-6k<#dlHOT8|B+nm?&(59O6P|DA2y4_%I#eE7oEr_>S}@69?zTic8ElrF?1G|Bpxs zGkj~x_j097++w1)i9RMunH4&#Z*zWg{n2916R30bFf(o145}hzuVOu=*x2cI{ zCfb|mV1ma=HaF4AL~9c*SWq^^^JjVLC{LtqBL&(@t#~x;95cofNZV0|&-h`u+R;QO z6Wu6d;;FuBXA@nib0b0Ah32|XC0IEx(!G)3x$}3LxW`0K6L*>DVTLEs-)(~D$rA8- zX_s;@v($Jm6C)c59&`Eg)#!{yf=5{PHF2MbF(#ff!GnhHH}Qyx{w5wU@t}!^O!PCs zV{MuBuK=UV|h! z*hsL09Kk0{JSp3H*2FL~JSdrG91mx&=Z7a9^SIa%?5_!ek&-?w=`&PgKzx+Mqa~#P zPiSRv4)pUT#+sO7VycN3OuT4fqKQc+#+leZGcw-9OD1UWZyE_6n_J*x_18vXf*GFw zOM_1~@!`%m!OL**NFl{F^b zHt~*$Xk$_4tfF>T4lBwF%Xw}N?xq?`LcGDmMvhl;W#USOl-Ib!%4Rx1j|A~n_DF?w`Y za>bNxOO^N$<%o%-iLXt3V?twyFyWYRW#uVJP0lqF536BSOBxHygl*!Os?bn01sh76 z$e8d=1hS7i8;i|>nq@X{%eQe2@Kb29gsiKC2QXO%d~2d+Txp~##~Taw;`=2EUmyP5SP*P;Y7?SOb~AnD~`J$-*x&ZpMMEpZvZ6avoe;H?1gx02cORQ9wHDsv*3xzBcx6ocu z9&IAt$ts1d&^RF=gCAh&q8dYw#P|`v<3%6P*W#JYJr70sTc~4PT?H9$A zqTQ8~ic;1B{c}tcL0sNK?IlV@3lyjz`4lGqHY+p>?J&EExZOe(3$-XInRi&IW`X=Q zO+-}-dnBlCp@xN;vYu}XDXi0JBG#Qz>R702p^=5g7P41Lt3h5Z&jvv8+{yDZGHFxNs43wK+1!orgl?y=C*!owCGv2d@2 zUKZ}NaKDA#Ryf>!EcCU&%FiW~-=h4?L7~IbvAaaX0~W3}!9!B)K{nJ~Ik-H`>Sz5g zbo96Is1?rNK^6vBc+A4%7DjhQ|A?UGe?_ov((DM(-xj#aSQZ>LWe^uEk6>v1Z#UW5#lixp0n_Rg%>S6 zZ=u2>Wi0FOkzm%=<>9O$9w!xeNmepmVrEe#Hr;fkGReYZ3$tW5U$!vC!YdYDweb2f zrR!m3s)cFvv^SM)?3DCL>Of@ z&^;{7x3Iv%atkXgEM(;t-n6ht*8B#iYMx*dEK)d6EVi)3!ZO|q^1?~+$UAvUEyVN0 zmPN|j(QtZBDyFQou*$+33vXL^%L2t#Tl~Nww9E}k&wR(iTB-1Q85U^sNAkov$)Ol~ z$L2O!c-O)%3-4RlY+;Lq?G|=e*h(Ab36AVGI!y5}RML!0&d3w*(Hmu3i;5`>q?u)* z_kLhuw}rhHKIR;>@Szm=$O6L!?ZaCD?;TWZMV|OXX6=*oQwv8Hg#xr2bD2C~;d2Yu z7_2NDwD5(6qZW=?_>wWlf@>jd;SjrEA!Wf}aXHqS1)YA_SR~n(JhAF**wz?dy#Y)M zmK-M9kS=Fia4c}L^XjokvGN3GdWHePLQdM;vv4U-uxkM)U{3WV<**iriWbE~r)AdH z7QV4?k&&HyX!N z|FH181^Njwi_rLHLSc}n{B;I@3uSGTv+=iue|T%KakGtoE&NA)Y!tS`+d%<43|0kg zRE~x>agGt}(ADXLtgVQRVm6A~;9a<=0p)V7oj z3NRp)mdrAeGWYYia;uHBVty6b`W-gt z+ng!YZPc)FtAp|mYTBq}<1HJjS6BkD_kEMpGMY zY_zq}%tmt?Ep4>2(LyRoLviYn(wMDj_BWLdi^GSRX;E>{fdubg?P%2%N(US5ZSd*h zo}9Wo8U}|0i<^;Cii*1^oD3a_>V4fH z1ozlDFUP2tjovo;+PKd~A3Kbe9G$WR z+9(?nbdu2K(oiLZGQb9lkWXQP$7GT=8E9jWtbwzSnly-sp*Ehd@rsRCZ9HjXn2m8Z z#@iTfV}y-osgI4PY>cGO*cfGl;f4A!1~+-_r$jaeLmCStCQ*JvEx)NIVLL3wtTwav3J-^M~4 zuiK!XJQx!t;>rR$d}d}7Z`jy6R4r@YmiRd(5U-^PbFKCPH(_Z2W5DH=5DLPxMI}ztHWMD&>|dOXGqO zi7vM-E|PJ{;+YKqZ3uGQIoj1v#0u}bW2)0e2hvr)i7 zQ3tG~paVE4?4XE)LJn?E2;S6K>Uay~p~c~lu{f(`{ly#yII!%BCW*TFpwdOEnv2_s1l2lN5j zc4$J}&8!0n-j~M*>b(wn(asL~$d0g;i5ylDP9=^kr&V7ke2k>p4>)+x!Lts=IC#iG zKL>*y3~}%1N;6n$WI@rfK&dKHAV+Wr&;jM~(LgUl1_bZ_tJ~^Y% z&ifsRxbm5Ug>hwMB8(oi5=Z2qgD)It4s-`!%GM7#IPBmn2fiZs`~CSP$`QtgrAm^c zza&gvRRnA1ZIol0a=3~Wrqr{9Dj3@txB1S5k8O?v*TEGBR~@7sWE`AvaMnTAf#=|B z2j8#>2Z0mb#E)`9$&kg4b3)NMIrpon;ur@vFT7E*U3HOi+`$P35GVX;OqtUXoN~}q z73AEbhB5h^gKr&tM^iXB?}R^CF35iIZ3BOO^KM8}lX=m>B?mt^7`RNCc~-eB!^@Ad zj||uR3C0#VVSi$ja8STSK^MO`_|?Im4z4@+&B5;uuF+|up&h6UXXPKVk|C<#3nI4i z7sq{NSouG613KywWr7-3`|mR4U)}{AgkV|N3S1O&QOreg7jLSfu#2K@_!z_CDo`}_TQQt)a7pb1HdM+vpLBM*ZEmQ~^x@aV`h#N~lK1=1v8e%Sp zqb|r~k+@`1lA5b7gp0l|?sL(U9dvQGi+iL%a~G{#w06-#CR<9{ae7#)jf=J}y13}- zqMeKOE;_pCamYB(k7ZVphP?>wbiw9f` zb}_`o-kX#MT|DBVzl(=tvY({nKP*ACsd&`I0ExRb6^}{qxQl@H4Jm@FyzFH3N6b!?i8=`NPJ zSngu+uE;AcX1kc<;#HX>XNHTJ63=qM!+OYhtf`orpSwtc*IdlY=gfDpARjN3;B^;o zNbqJp|IvSEbIFAG-L+#R2*ohsMRnELyKepnU7Do zI4$uR7ZWv^>}UFd(@2odfZg`iG>~BxUkX39d`}my5si z`ExJE|8v2yD3Auvkou#N!tJ{Yrb7--k0LFcMv*jbN{73V+f7B$G}c{=7f*)+R4k1@ zyeJ2^PWc!qBqf+KCQR0ACb~&Z>t=#UUU$jl-D&hlV~mvPC9{a{O`}&DgVGqBM(;HGq_Oa~ z_(N&%zt_HL+)oX^kKC6I|Ac)pFK(TQJiuP3F?L&Ycr$T!ugbr1DcLWLhh-7sN7Cq@ zj~`8AfW(jGa~_vqU>fB&g$0MOkB!7|_I+|>Xc|wX;S@;l?@=lS&W*gB#*{QBq%kp#Ni^^9=;Sn3Esqe~Hc26v(M(KDV_F(B z(wLdX^fX?flhAES#s-a#RH_mG_rdrtH^+GO?GdLYvpBNN#Fjac)y+iw`{>*>UQ1(h zI-H5~(wLvdnl#={V*w4G#*z!M6=}Sl#v8<(K52YXCHAJ|FG@q795YtOhs;nGOHR6( zSeC}}G!BhbmFCJ19Lkx>Pp>LR2V*65mNIWiO8M0i6m2fp#5-xM<-BMv-c5r$W3NkN zLmC_DV_W0vB`sYpv5BtoTa?$y_OVhgs03?As^5=Qx1_N(jcsXcPviYGK1gFn8t(jPLYkiot*_NQ?8X=7% zX(ZD)%;D1$j+U6wTo8@CO#3>r2O31VrwPcZ_^tv?MG`uwYH1~2x zCXKAj`chW4QBM$%zLpHD4P@&%dO~wSHOOIw$7Hokel2s!Ji*DH#m<0<|L0TV)ia0`3%6}wsKjbyK-##4sGUKb3>sz7I0MSm&7gh; z%d5sFu8P&mKtSBtLNv&rVJ6(*J*mW=Y#~@f6IR8_Gl=qI>QymTTk~M796t)KlZa)Y zu(lQ=o(Xq=Pe{sB4~WTBWtNb1MhnrL-TxrcF@sJSw8)@k2CXt^ok0h7_K|p-On9IG zPZnsOL0gHLY?ncwX5q;N*}dVR18kQybk3lQ)UZzmT{GyGL9YyYXTWy5XTn1kdP;m} z26tu9BZIqT@}5k%k3D5tZ4c?yvWa`y_oDGg(-=F>nz{8o!6!{)v&Y8zW^kWu;(keK zjR$1c2>NC4Fo!#b5;;7QL4TUXL(IdY84O^HS@g)_u?!y1;6w%|GZ>h`pbTE6Vi^q1 zU`PfNGhsX&n!)7`i4hq*mBAAdKPl-jNry|yuSh5}GJ~f%I=$4f8B{E28O+V#wG38fu!_U< zO=MmMZ)ET$JwJm5^vMh!*&9xLQ?Ec`-rN`|uYX#Iof+)P zAeDiU!TT9}z&Vw{LD}N&3_g)yPX-@K@Dc5BYwTl*_hz`mXN204!>{!}-csoKm@;MtRt6rY z-b97Hwq=*o88{NSlCt~E;+4rD`~UI%3<8?vvXaZ->kPh;_^71Eq)C}|Tmn{33%6=1 zNKa*OI)huYD4)fd49;foTL!;pa4v&yGnm&{edti^d~&YG$$b)7WiU+>u4=Ph*v2 zva+NHda1W(Q6-BNDN1!7T3OW2qIniAvZ#|q-7Ml+)L#^w9BGH79Gji8*iUQ^~nk;F#)d|fSkD{ z@;Xb}Mbg79MYk;0z7y{*>79}eULPap?kw)f;v-rti=J8BOZhBb%c55ny|Wmd#j{xy zo2c~3;^8bF$)c}Jl5<}c_e=bMqz~rvACjP-q^}f-_s` zQf65e-~1LWmx`@qXIqKo)IW<4UW@FVsFKdQsIH=h7uC0D( z&*HNz^ej?Y9H60E$DSP#`!b6HRpOs#aZrLUB%fapGxw`34$*Z-#12cEl=KKEsvE|~#W)`GY7PbW2uB!7o#hK+wfwZKVEV2@ipIsFRvdB@r zzauBIpzu+~uFA^sERM+n-B)%@`Uks81V$5P~|7P(YP3@te z$CIbj#phN2>gQT(UcK*ADL`f+4~0Dx@le#`Hp?jPg|7?9Cx>OfZ6$8~v}+^o=jGu6j#?W*0bT_CJUmQ$N-=UC zk)Xc^3Nx1%!2rp8EMF$ADFZzWl6_>6!5)T4%zp8j(?&e$VVH+kJJ~F&@^o5t}rHO|vc5$yO*ZR%-R4hZkg#58H$m zBcG*S@-V@}kv3wQhlx^|mt~R#C&@Y|OUepQv=LKe@u`xsA(oo%;T2ixr#9l&wqmA- zSsoU7SnOdoz1qX;GIy?r*H}v8c^>9Vu)qVAWJ9c+MyA?Si8?d+h7=%vQ?}KpZP?Zl z56eBQkXcJTER#dY(Qn^2>TkX)AWn zL!MCAd)VaRT@M>%lAMha?0-Yq>|u+Ct(Wa2vdt33D2c?L@WWCMmLHe+VFF8PM1(PQwEgw~; z7gkVAImFplR4Lg`9PyC!pwWf4sTTu9m*A5;B_-8pT2DFKL9sm89()f0BSSmkcyKu! zj0{9QE*x$ED7A=d{AV)Q@?%UPNirPJHd* z#XO~NJ8{CpNe|z9xai@Ohtmu%4Dzhg3m1p;IxE5Oc7phv#QbNL3o|Y-{&RrZh5syb zc^m(s=Bl|%9LJ8z4<0TvP`J@-(NOY74_7@bZ5J*SyyAt6I{07q@=nV2j><0{e)aIA zk6}K3^YA-^iI0vx-^t?|`|G2wk3XrihXOtd`uL0E)jIaKhkrcmVABQS|FY(2{69w8 z!LdPByl3ke!IPf@J_`A$?BjMHg?$w9QOrl%tFe6#$MtrCl@#^Es#pVQaUVDNDBsB8nB`ziDEs~b@QO4(yqyLjBC&AVKRMyEN<@5O!d{oTGw@FZm3KR%ss`$9W zM|B@He6UniAJu%kv@v#0szgoDUeqMBy`YjU+lyKf*Ort_o}E|EM|~erA2A;dd^D83 zXyT)hlv(^|0an{sGTB*H7?GHVvgP@BuzhH;xa254R6pE#BjJM$Q9$@;>SMMj$aCVF z`DpH=osafDTI6?gO#ASCX-gli@_X0XM;nRT=5s3Yw5$T5d3h~pFFN^H*h#(9$6Y=; z`{?4MtB-CzD!c}+dTrH7=`Qh$fwHZAxDK|5kGp+5;-kNhdwley&MbH}dasXOKJN2j z)``W(#(MkcBk}Q?iRa42$n5Lm%l3lce#w78(i>S1`RM0^m<1p9L3+HsD0OG-Q6B?* z4E6DZkH>sG?&G^si6K4~O;ZN?7$lQ_v=>usg`B}YE=>zTt0r-Z?X#8K$vCgBwldtu z2p{u&%=ht>kC8s6_?YVBX&=w{c+tl=AESJX_VK)rzT1@}cO{;sDVnO!`A9m^F|@g& zmgyiKDU!!6zsCA_!N=}0d1Zc58g~#M{iKZdaoZ2ki9ROLRV1Du>GP2|`I9AnnTG8k zGQWnE?`f*;Yp716=`KWH^)bW8bU)m2?$XJ~D?SEy2zO?i>0_49MemWd&1mvj`La$Yo5_EC8%)x1 z_~zqxABTM$@o~b(Nshh`%}3ftMou5yhe5xUIOT)8XFO3kZuzi%I6hn&Go}uj5hvv) zhv&CM+oSjziLoG?W}V;p_}<4w zP7SFuYdiaq5^i0xBSOWfz;jXcM>gl>UYK z_$z11z=G`ExfSt0d|YF&4Nx|~pFXZLeg-HS;4eCfkN{xFgCxKK`Yt_bTiH zH}v4v9|Z#-K%oGI15k}podh+nFO5dZ{kTYr1t=b%WPnlu*qxgKln8Kh05;9ss%667 zeS9UtE;Q;SZV6C204cL*CDH*gwOoK(15^u8JwW*Y6#`TWxat5E1F(tPq%b>04Jl6r zZVyl;Kvl`VLsB+Dflt;(yLS?_FvV&Fs427R2B;OFc7UO?P)BlTRSIwe7E-^9s&?G=4K(heN1LOsW21o?_Zyul5!}tXSV*yw9g_fyb zHumu9@Mfn<#YBLnvaPH8Vnd`#Y>tYx2+%S>y8!J2v{0G$GK4#II^-}hHd&?cLwhRXAzzjX`HJ;1#IdIkJg0CxqrCjbR{ z1h_j0hn3c*Vw?iB5^LzmPK}7K>Lf^e2j~;vfdCH%=o{d^0QU!A>mPO!9KIU^MBV6M z4+ZEKV9daRyx1;fs-IBkVEqF;8envQX9Elf@K}JS0*nmscz}Vld4MMZTpe0)P=LV! zh7j+Il^zk+{MYqx10tuBcrw7S0K)@}kb2UkZ%m3_Q$x?8+g$D>o({nMNO?UIgcD@v z>4Kvq=c&C4tvV*aa{=ZDSPy`BHeY46Qm- zCW&WBFgw7Ue9l}6-jGeuNhr+M_zMHP9$-m;rSzWwZw6QtU@>P$XE98MnqF(dtz#Gj zI1pPuQkDf+9$-a)mC{={J^MEd1=#)V(QqnpwyqAahPnkf8{q9Ad|Fr+V10mhI59h^ zYb7Ofb{%CyfQ1bW~?CtFu_sS&*|Y zzcH4wy2xBh;ITMXGgk-69G;KaJz^twbhff zVQux4q~x6MBL3|n&IR~3K!F?z=5Rj1g#bSWxDw#I0N>MBOD28@a4`rsSl|w~m#9E2 z@%P$r6I$+edszxlrhHd%HNZ~+t}&zs_&ET#nf-&4_b&ApiGP*!H%Wh&lmb_g_u|P& zpDj^tetSK@znmQ>BgB6N_?!4lJ)qu~!~Hotn8QOkT;X1wWkriq z(FbxE@n_`6F0p<&Je4~h7@5NpIXuZRV%DMP@EoSrk3Tgv&cE76JxAt>6JfFkZ9A3!b#T;Ii z{Be>_kaWDHFGgwv=-QJ!aEY1o}6nw;C%0g~UU66&@S(uZB z3-!c2_IJ2)_?|MCMURA;PLx;9e-WCWg~)yNMm@1G3%reR5obhw!Bn}vSdxXMS>XHV zmt|o&HA}qVn#$}aSy(~W)fbKG3v!q!_GuPYXF!>$0$(4$Q)y zENsZaMh@;uWos5Tk<&ogl7(LmD^2f4HfQ1Hz%cQX1qJ!rvamf1J2)jPM|R47@l*pb zJGd(gyR+~akwG6gzBt4mh6B01k7zU(_@b9wlJv)+x^I15Z1)gX4 zDGNVm;RlJ={}%o+i~nVaEz`q1xp5{7=Oq7Z7VhN<4nI8oNKiDan4o7aWP#nul3w~X z3%^NlQPM6OGbs?00+fkoAx~JDv@z4j0*n60!u2eeS+J-)3&|{`vXG{qHO1!2d0cTN zb|gJmUwCpNa4z^+;OPs3OIf(gE))n~%fc0|a?Qg`S0(seQr<_$+b_w?Sx~gRr{2iI zpR^%{yfOU6;mg85S@<^#x3X}tzWAG6&cf|1jO-A;SznZBATk<=f4785n>G-4*>{Fw z43Eapzk!$`ng21y8i@N@cpw3Bju>*r0wxn;$d!#BiD8vwQsI#Xf=y&K5cy)rA4BmN zZZ!~01!5>Dagl~1+%Vu2is3QIDg2NxX;DdwNlKZf4Mhowhc*=XUJsXwp>zz>W0(=c z6ET#Dp;HWM^_)gBpW~;pJFx=I50ds>M*1U8oRd zmJ8aeF}^}ET)JqKD;rN4RbQ`g=wFYaMhtJn!1!b<KN9@y6n!Hmz8df1Vf#tzZNgR zdb%qXoHV107-Jh_;7Kq}0k*z{k<1~E;UH(|%gQ#!d<<_j;$?~0!KmJ;?2KWzw0Tzy zy<3GjkND}##gLYK9>X3fyjRlwlJ1LPc_Tp$2V|Cj*)L-FGKN#JV72^8`u121$K^mD zis5h!M`AcCvulb9dY<+(2ELBr8%`*QlQEo-Gxx+nZ~`*1Yvj{)-%?u)-^&@tj{g|L zX^DTx=2ZJQIJ3v4{!9#KIYx2JisKx;LCtZz9LM<>F2qnWj>qHpHHP0}NXB5taFN6J zZ&Zsxk0C3DhONQ}uSa6^Fnx7BG9h;c>4v${<4%M{Mhs>Q7U#PYNl1EnA{MVv9`Pbh z3@#VyIP%3&-j8@OT#n&N41Nr$7}7Cbnira1KXQoySwB)^Ui80N(Vp|7&F4mc=Mo)9 zv9k*C)fleD_&zCIm-F#<41dRPL*hTPXXsxs+?4p1q^nK@KeX>ioHHJ*B>%+lFFTbj ze_w)oG5jaN-bTUt@Ic}mQl8m|Ovr4mI3AH8x1_X+0yHmA96vV_!|z7($5DXa`Q!Yy z7T#4fTriG06GD8vjd*NpJQhdcIEuv4;AEtjqy$AJxcFnJxCE3h!4WwTVNt0#O2<(t zj>>U75l5Lgo{r<0ILgM6>wdJ8qDNh9)WE@Y$@mSmFqE=C}g8FP6shgqlaXcT# zo^K-M;&?8OP5(xZRZvM^ph^EkUy9@RMuOnQI4Vfa!)!&#&)ZlqTP2QA9N{=3ab(0% z)s8GUALc+4WX7RLPWi^7@2zOnTcIe2X>OFguG=Q6#&P*ZWJUFG)i_>>qf;E6wB@<+rmGLCJ_L*%ggW8xSa$MkqGXJ0QJ85hS}aZHJ0d>j+v zm>9>@>fy;W>_&uOlFXj39%goYV=+~Bd0HHAGer9$U*EtL1WW`o;+RPrDyZ+o@m?J7 z$MG(QduMn-V?H*noc%jm`#pRR$A_{b%+f_HogK%VI9A88CXQvv%(*O$V^JLQ;yAH6 zlWBgO|B6Ny#PP-yg|9qb9LM5;nT^USpU}47LrWxG%DNJevpkNEv+?v}p%rngjAM%# z+0|IAisMs;+1*TLnZ_hD3qGN+(Y0|9tczp4l-$6H5Xa^?HpbCDnVIrJq>r77Y>}l~ zC2jXhh#IzWykvHVq~we(k+D0D&*JE(p}&UD8CMKo4GlHyjbmRNB{e**VSgM4;d zEiMsp9E{_196!YIMI2woaXgN%<5&w z8^=#vprn9(EqaEdye{Lc%$|$m7p^whb&WVK@FO6O-?BNeI4(+@mCd06af!8Tj?Osj z^nW`5res=@CL~QtYBOv)2QprqKhJTAO9YpxIMQ*TiOA@z(qNV{r5lS@T~zjNZddgR zSG*?Tcd6m3q}Ss3Ljp=(kK=~Ke`a(3Vq_))J-6fdoAX^mJ`H!`_$Q8>8ld4{&JNDd zIPS|TZ2BITrY53e6G8eQj;5W}99rNX?(wpes%UmD4UcI2Rf|WpV1ULo5fqp&DgDU} z;XE34HW5#BiRRZ(K*M7i3Tr4R^-!{q1{Sf8^E;_OH4#NL6xC2d3)-T#Vj7BTpq^Hp z)O3@e?_@Gd;Zhn(Ysl1~P=kgt8lKZoUPD<8PimmRGa8=Kf{>u9r=>!M1YOFaXJzXg zmvZcQQ}NBU=<^z0&`?Q3WeqQCsG#8`4HY%83XNoXs;f%MSfV!4Dq0Ye>~)4z71FS+ ztIA%`PL_r>L^Qmn;dKpB+4L(Ks%cO)2n{c@`T3Za!?Y| znT<3w*3e!<2gz)rp_zu})L9QrHGHungDVW(+d`JM*3eP{a$0Hl^Fi>npQ(+8w%Po4 z5{zmpI&zE-hp1uTwM>FeGTT{07YWGes-c_2-LpA8BlmbAu!i3>T+}c`!%z)tHLTMxOv7*u3pFg#FoIs?h-jFuVU&i^8YXF&tYJq} zF-F5U4dXei+tslej+9sHY*Qy_IMGz(JP>U55=@j?3g}J6TN7sPo6HO7?PlVA4IgOuPz&~!pKT`QYxqdw zS(1`DTY@=~&XshY7Ho;Lh)-*?O7CXDzxInYEYYx1!zv9+H7sM=uCCCqT*Jqt&#RxX z`)>5DW@16JU<;i))iiQbGjXsPA7B@$W@6Dc^;5cKJyvV@ubEiGiPk*Wm|CZtp4c9f?;A+rPRB0(lISO4RVD>M@VN0>Lr69c}4Y;l0Z_eMA;-{A44qGQ* z;=3B|X(*)QF&+PDxX)X^)2h=sK#IaU_Q}wr2;sqTq>S%Z%h_s9YYR>~|1szvf39by}Jdl!= zbyU&$UKj`+AsrbyB6<+XnK~35VTnt$4nq3wR+W_LVK%CRK(rPw>!_+DtF?Gd$16Ij z>3CH~bsa5Qi{7opgw|p~>mVjKN&0nb!Kk~rNqs{{O+A?74R!q0TD+-)|2oyxQA-Dx z2&URP>SW`5ZA3jCoCsWq>g#AAF|*IK5sjph#*$K76A7A1$_}>B(Nf2J9Sd}{($QK+ zUmg9}$2Ou#8_`BbTZ!B0=%%B)j`lh_NKQu`U33g?BbYkr=q&O3GTSwq&ukAJ8`=nJ z>!qWo#K+o*SR2t>M<1!@P8(6WZ6MHJ#{hIq@&|>jMs6jt>7c5%o=UQ%27&z zGto&p7A^@hP1f;GTT!Z=ATzU_n5tu%jt_Nwq;uCO`nHbgI%eqjq>y@kDrQRNrhS?3 zFml?7W&ef8)sMWZ<2~~0N0{E%@j*5&Ju^Iu{%j}a(I@dJ!EBkGqhqcFR7E~xsH!%iH;RIUg)IMKCOH?Gt_Qr=1LuW z6lj$mJOp%ono4~4e=48E+1O63(Xmd)dIl;L9*iDsC$x5=*^J=N_YFGuV9qt}ODqj< z*7=@j?9;KIOdZ=eaddpHW4n$Xb)!3V?BbAJQg`shvL&MgyLI@5mC9Gtyngh#a*+jm zE$Q1TkFxC1u~!eCO)#Dc-)<)!Z!Zq$_#Y?Q>C8hq4$@8?U+VaZD+AARyehm8qkPus zUhZ&@d*Q2ZM3na8Fh~Dtv{8F8ep>XHj^jH1Z7+V(@wJX`xGr%_8%Iy*IH}`X`lr2U zvow@wp`2obv=>aX+6%rC>pNC#FTUp-`Cc*Fiyw6U6(0VPvwKyT&+Adc&s<(Qh)a)T zoZ;Ne%Ip-2{-Wc&j#LWi6fWraRYz$DPdNBZ$3-1U3$}$U9WfmvOpG)U*P+o%20k~S z>oB+)7>F1!by!@}3=}nxU_~AGxU}l9bvQcyhN^@!9|H~WTOm*4&rwmX|5_A z1k)u68g~$vv%!_@(yKbI>3FAu*d)`@4kF$`-0C21=qTDzRO%?|cN9H3ikmwA)^SHx zzop}LwjL^<+)@0aqsh(8yY#INw!(^}XTHf?(ox*k@jypD1NjZ)Fp$$gE(4Dk7^H?r z&I^7|!9eY0;X?mYa~pWnK&+se*FYWv`;UgFE>?1WtdM>^6$C%$QwkU;XrQoxcc2t9 zu@oI@+^O^VX7o(DjqKbjy21*zxX@JZ!2FgnCxTK{dEiLI2 z2449>rOcD8a!+Ah;-@5j+Q2hX+q06sC}}xKpOdt_q|Y08K?2tOv7;cZAhRzSs3<`t zNh?cAl*MKnavVm>}x*MoUQw=mQ(9l3N1FssW zMK>C#&RPtW=Hd+l{BH0%ecnkF?-YDbsA1qr#{lpntfqlCjo^z`g-*c-JwGq%7^urC z+tiw!f^0pO8sIlTeq8dq6KNv@jSaLm(8fR$15FLIG{6HJ{9I^ept%uzYvm_P>rSGD z#LTj&l@XjHr5KCaN`40e9SyWIP}&PVU)mcO&?!*D)QQ3dy3h=%idDKA!N(B4k@BO5 zpof8;28J0JZlISDe2MLCppOB5R@ToI?Q5VPNxW)(z@hvM zBRDt0Ca8^i-Zk(ZL)yTn2HrPz)IS%KIqQ2&Voe* z?E7j1YYc3oZ?~&!4XiV;*#N(4u75ZR&4S-Gbn*rR8zqNbyNEpo_8R!xz#RkoI4QU?7>FArlSVFF>u1bF)4Z6z}K|a z%xq_6zHep@H8W3U3x8|il*Ft{{&xnxmuhEr5vQ~Duk9j!GVn7a#K1Yu$H7XO8Oj+0 zZgG`~@1gj`za~H7>RlBiA|E7bt%in5Kl8eRDNmNQX_+ z)jtjVB?X8Z#WP87$y&D!l<6weu7dO*1OIY4GEvRMT?6-6WTLEz{|wwWP{2e%6A!o$ znRvuRZZo(PE~gpX(3r~%ZtR4K_s>VaUKU&^$7}kS9yO8I1n)-Xg>rdJH18@1D4)+n zeiOW$kk==Y7BcaeiDD*-n<#9e2=zyzyj{Gg8C)&M8|tW>_w4c3!4f7)nt0qqDHFWr zPKgR$&(2G{sk5|+CrrHERSfDH+*ir#`gvj9lO~=rQOQJQ6Hl9X#>Dd`UNG^jiE<{M zGg02ep;Li=Cf*9TqHAzBI597VebGb(6TE7*qKTJG@D6I)!0R*#*eLm-W@;4^AroN} z5fd5GT2@y~@VdWDGq@*{m*7#1S1w1%G;y)3c-ahYVE$iMAx!XYKw`cofVX;9HF3SG z$lXo6YNEP{b|%`Jc+JG?^sR{oCTf^?!$d6;wQ0}CQC6yH;!QKSwNfk(E@0>Vu60cO zQa@VH1TO@xEA{ija9%~r9-a6$+R#KJ6D>@%G||{Z6ZVdSVsd5$w9;b`mZP&Ix{3FHnjmds1{VSo@aA^jrQE?pM-%-_^f%GTL}wE{P4qI+#Y9&V z-Ob?s#%^rrXoPPi;5CLv^G0j@ruHy#k9YouqrsiMCV2m39}|5!`izh&!F9X5k(GCu zHsi(AM@{8F1XtJcnpSFH$EW0pjxsTt zV{M_lg)t_^npkLJk%@7%b8W^X6O&Dhmw1ASZuz4VCC$Ghz;BtDV&cbK(YYq3N-)F3 zOcT>+rx$%&a;8fIK+%h6U$9}%!y`VtBFrctT3_K#2OPT zO)Q?QzJ4LP%0!iJVxJ%V`$F_n#*!k|msHo9SZ8wO#3mE#P2MgTU3)&d!Ni_PD)FAl zYK{xh%_a_92>7f>u;pBIn~CivzBKU_r!XDfP3$)D8T)lEx>M3!G-;yBENgvkVz0^j z1fqLr*e}t+BLlk6M4N7cX+M=`EAX?4GbU1glroe*%XZI4%b$_{Wnf$&drHxVuHG9 zqDo1owcP}1+=NEqZsKS+!RBd_JtX}QMw{7rE_$~!YJ$#&WI-zB(g;)(=!y9M`WUZriRXtC~s#$Pva!^EE^ z{*r4lOWBu>(rL7oLqL0On>>_=yPSj4ygMe?qkm2OWAc8Iz{6uE1)ZYX|1)u)gJ>bA z1y+B+E=Yg2Ul9OUU>}E_k20tT%JK4l3y)eTZQ%(Ec`W3$P{_h#7V=3+h7gtKw|Jdk zw19=0=c7yoCE&Hdg)QFpfRYv-w@}nVF)Q#!2`dP~hY?lW3e00vlV7R3C?y4mkEMd4 zWQ0>~84FKYc$!5Po|HDT?$R-+JV|}V!qN?R)mQKlC^R~3r~ z43vn)ccw>~!m@~*s0G!6$mV~Y6?N{0De#JgYV?4G4w>qtGLcs;{9IVAVWGN(*DSnl z;og5r+7CTg7w+JPW;az>`i6xGj{0%ljJ}VlZ(68jp|*uJe}q0+sl3r$R6CMc&q93* zoh@{+(7-}N3#}})wlL+t(DX6kMiv@dXkwwMg%%cCTIk+gG_%lL0^(Ty2q`5ebQj4# zLW{bKe^Y833vDfs+0jBf3+-vJg=hWnj_zXVUcRv_^!^{AcZ;g5*oofzNS(;X5I$17 zTIgn>zl8x*ZsCXSqK}1Fdx#zudRn;DUG$Ie%XEu6Zl(rKeC%Cw(DGa+OP4>yzh$oAST_zocPz4!bEjmK*U%B~ekZh=L1JOOg$-`e|T^kzIZ@cnoHTpS>uMMz7`?g#3_?YdGjl5wXn^?PYh1RvxOZNzO?X_ zg`F05S@?{;wcwVG?6$yb^tv4iP4w0E<)eGZEFR7s3cu7Pyw`$qRAJg@VZX!&B>i7D z|Dc60vN7+*ckF!25VH`sFl}+@Hw!nfgs*T|&?V;Z z88U=SD!-Y@07zIUwK(*7sqn{(Lk_*fKuTg}5}pO0%T5CI5=dD{Tgab4fdnpDxNPAr zR|5-IxU{Z{UbFBA)3fUDTx?53t}=v9qGK%7=2hjog>`e3n->1;A#QL{?J54W@RtN< zepi{jWg*m4+-3(Y+~Gvt68gu&zZSlERUs}~PF+}5Fj3||+J9Sle`_>X0{7|gCnHB! zM;}5 zfyxOU3s+u9pl+{lg#;RGh`uQC!k%J8*)X#&NoK_aDoOA{%_x~w5(p(Q;>k!x0>2*5 zRG6(7&ZJ?_sl_LSHhdc}qY0=9)DK7AOh6>?ast&8crAgd?Cg_1MtiQlfSObvR7F zWHL)9)TfX)20^sNMKC2c2Zdr2vOdM40Ig5KHuJ_+=d_>-H#`LzBL56CVZD8Zlv21_s`n?E#x3xodejKqip#w0K{ zfsqM}N}%^ZwP}B~+N$vA1O`Zut5;yvI9YdmwuT7_Ow7iUB$zDeTlCn}U^jAF0&jD$ z5_l(pa=pa#1m2K(STuv4?5}R>8h$r{zXqu^hRodeLz{1BevrV239LHloixXIqjr+U7|MklfSS~pqOZthV zDNZ^|UP9(4~flUbjvu>^c+Lp%X30X+djx-O%)sP&_|=VGQQOO^g= z|K33rOJ)<2CMC5Ka3pXg^(3WaV=14K*)%@|viX-KxRSu{611%wjO-s=cDSe}@mLZ! z68MuVa}v3d_$z^%3EWEHwiIq!FoRv7{Nl^ezqu}zjpRrM193-|{*%DJ3EY)_Ad~4{ z0{_V(;`6y#N_8s zqJYE&vpG-HQQ6u3{nWxq6iK3}$P<4Kf~*|L&SXXzxK$i`)o zxbh%aJ($|nQJ+ro4eUW5l_Z``qFfT8Y{};&ctO(gl0Gl#^xopdBq~Vny_7^n$>fZt zl1dU+mXz5l5^#|r&X71$QciPn!V*W4h)SSJDkObbQp#kVLbW7bO`>lS{gSAj#A|eH z63vpBx+DC05_OWOn?#Ky-bkWmk_VhJYbC*OVtSKqzaJWYKU7#h|WoLkrml))jpzo5W>Jz2G zlO(0Drbxd{OX8sirb<4A-o6v zl$<3JER}Rw63essA4|X!Wf_YwbrDu2@hLe;>`7uZ-JZm@B(^7cQw`Q7u`!8FY`T-W zK8X!U@N6MZk@46V+hr4*lh~5Pk{mg=CWBLmJaXCI3|8HTk4W!GVrLS&lYHhHyOQ7m zOE${Geh-iB5%Vx1=?|UMy-Dn2s3&ode&$g26-*Vhzyk-8!C5t)zT=6$FOv8wi9<qshs_<9X0Xv}eS-sX$C5angp-7u#MeoDlf;E2eof*;5+{@RA&DQ8IF-b= zjB44|ceE{u;eEwNeZ|&m(Nq_;b>EQ z7*QV8qdm0tyqvIujp%PlTuj19!sPfS5lcc#LQf)|1a(&DvBNIviN3+p`ouiK$6jz` zEjh#-lw=Z#B>xf$di_XO)s|}M1d4e{_(|ML;=d$Pw1iVQiJM7WO5$=7*OS3+(iN@% zk?7SVu1WAayF5YV<`uUxCS3@&cm7C%+ar{@LD!v&R$GBTC1BC5ByJ~zO`Cs7CG(#o zxIJ=5s^T_?-dC^+cdICKS4whY|9%n=lE`Nxzl|I=a@xVx;-fZTBbSZbcCal&<&W5y zJTk!ZCk0zHjoigOxSj37pp0x3ljg~fA*?8KQOQPS8_(N#!NyAz=qFyZaig!O)=xC=Co0&;(@!vwU(rVYegS`G zKT$Q=Y$nhoODZMWy%r2GLzBUM!_7|kU{fi?zlb=|2>-=S{nF9zEn zIMrVavoYMpXd7cFY$M)ZjATb_{Lx-_JDc0#Twd?>f-o^x( zC8ijwkiKPOijCRys*R~OrrCIxP1|_eMnxq$g8|%(b6lNnga2quUKX8c;~jcwdGNOm zU#`TkeBZ_g4Du-7z6$=^#aH8fC~Ngx9%bEGc5wF>FX`gDmO=x>T!!KZ%%eZQi+=i6 zXub{71(Gh5bduyRv9Z*~IUBz)oNO$&vDL;l8z0;F#KuY+t8A=b2XllUmDgeMqAKD~ zZLH>izN>Dsv4)>ey_Iz~*0a_fb*-cg2Z-JS#0DExODh}M*#Y9?0ph>_@yh_Q*~S)5 zhXJDSKvC>)_@C+F?KXDUIBw%>8#`_6vT@MH7dCd=_{_#$8@dzPoJVy0Q2E@(9vk&G zg~)lcK)~6@TF0=TwTdVQIGV+yO#kD&8z>0AwDFaVBXlXlyMQ=kgL)3LNTDEv?KPD2{PP=Mx(S3f@chjg1pFez5VQjgvM`+4#=J_p%AL%k-^{-`j=r7gD+w zQK;~=4Qe|vFtFz*8$UDNY@FrdRwyWC`Y(^5*RM`(0~1cs!hq?V*CO-PWWh6@U_=0NepV^NyK zMt|v`_|l%Vjk^OyiaI}3w&V|NyWTl`h2637r;WdCT(xn{#&r&mjV=YmADl{qMDyMX z@rb;lUEZLNkwK#AAaRp3H?N@P4+n``(jfx|1*Lav{KF;AL0$*{vN^6cUn;pA+@pC6 z;Cvznk398Oc<0-F8xL%(8zc@562A=+1$HUV4+!UUKne$+){YQ7;vlyJ2FariI8qM- z=EfkA&q00%k2xspfT6{}E8w7@gJOe&NTaGk4j!s4;-IL55)MkT)B)QqE-3->3DW=F zQ6Hz0J8CHh)$#=)N_?%75*jSZI4JAjI}hJ`c+$aB6mapXi>Dnt<6x?TX%3!sP|iUU z2TdJ3=b*fUmmNNohvyx<;GnXDDh?VA7B4!e;NT?({RWHiPi9OWEEWzHrv*MzL3Dq=Q-xYCCw51sX~w&1fvm zYb5E2A%S7@hlpklnmZWaV4#B*4q7_s=%ACshnvvaL0jr^&_+6hsb(RP=B_N`>@8Z&}pOK_8kenSHYX z1^UazF?>rDTiZ}Y?m77$xTBA>5-vg ztb>UTCOH_#S`Pn7!G)oM${)5uObwGA{5e#-CDk%J#R1*ORA`uZ+re}Pzw!{EgWnHj z&Tz2M!6FAU9lYb|lw5jqC`uF^aB7*09vU zGKrT<`mv-e`ozHsiC1QGRGOpi`;Nc5gM9WMTJaG&e8i^47*a9OAt$?GDYiy=R$IV8>L0utnsl>A3rCn!Wn7e%95Ne4BF4QC0n^hio^?^q#WQZOEz@Fmn5Fys zDtAjnp39amFTwMYzTo0T2`WhXlB5+Sr8cUq;vyuoQ5P95s4DD&{7e^$%y$1NoO^^I zjYvKPo*f}n7s3s$$9$PicwTwMMOB%-S~5!JYa@c&HLJUL&BgC7uDW>LMGY5gTR zhKrgmdb{Z3;!PK|T(oh~)d9=0u_~EN1mrh#(a6Qk zSCo=PGW`2WQy0x#3|f@g(nWI@EnNI@JlHp*e2+0f#Wh7Dtr$^7GFrQsQ8}9PHg~|( zt|LS{7u{W493k4f=-{Fw2TO`|mD=7OA>3P`&Mrv1xL75#-CT^m6{4yyM~Kx&Lp@yd zbaCitsFw>`a$$@*|5m84i+(PqxR~mqzl#Ab#<&>kVjyiEA%?gZD)kR?G1$fR$(gky z3Tsi@FnVmXI?}~(7b9F8dpSJjzOvvOrQNO2C|NXGQW{UOak4Hgndo9X-CHE`?XA!R z7wjDko+LZM(#bB~%Eq*Onv1tx%yTi{#dOJ^>Eazm)T!_c7X^9e6{7FDc+bUb7js;k z${&5-#Ro1vWIT@)Y=VBiF-HA}Lv}cmX_f@+1>HE;#V69?86yR4Uf^OO<7%W>>GC8k z7Q0yHV!3QbRhgxpRW3f23Rg=?4jWzP zV!ex#G}Xlhsq=G}&xT{8i%l*zyV&Almy4~ZGaHW-TcyAb7u#HHcR`=C%hW@#(*<44 zpkkMI%OdvWGid+V z(z!UziV@`pX%C&l;rrRe85ieeG@h0GKCeW6adA!#D?@_4$TvnMWw>5&@vD^lP10dw z)r+!G7R6m??2!vkHle#PrDqIg4`*^LsMd1%_d1d?0&N%1cM3l&B5?cqr-N5f8aN6!P$xhgl=VqaN~mDByuNZ0GT?YNW{PA)f?$8I2=F zK@Z2*N52^pXNBc*K@*Y0= zOwAl6Dpikuw^M!5Lj?~nd8j{1aBHILC^3JRN<3nesO+JNhq@l>c?fyP@bH?4*F9u< zP}pA&RXv0~L_DY-gomhyucjz#Mu}si#CxN}l4;Rje-2e`q<(QddTDbsHcGtWp_+$R zJ=_^3ytA20w?$7~P)dy!)jfPtRpl+aH9QQx5_!`@Ee~(7iP55_qy*%DaWPceLmerz zhp&^k5?OdKp!Gd8@X*CWS1&m3*w8~O53MC`(NHywjSC^z#G?DtG&d1jz&6UOLml?)5GjTY)2{CP2#a0x_jv1p{L9a@G#IruZO~G zGkQzV$KwIZz+k3+9{OkF(d#iN8;_J=u!kYpoS_m7^DsP{GlJv(Szsj7D9Icx=@?0O z^a+Z_NjzTC36f6qFiC>Rl2WGSXff5pG!JV%o=eBu9;SPk?O~3G86FsB?|FFN!%T_a z@$lj!(RU?f5i#ipvS^m1A2Q4&;2zYV(SoHEp6g+rhs7S2$fEg@E|PSCRJG8X6rhGRl1V`M^&WP3*y&+|hm9UK zdDtvl+%9FdNNrm^(2R#Y+9o;oGooyc_V4nr+rwcGM?8Gy;d2iMJp9kY9xe!b)qNiJ zOR!hcno5*R;)mIT9=`B!NEUr5DNDcd@KB6+&1mtEf7Ijqsd2)?NrtYJ{F*C<)bmh) z3je=`Qy#vRG7noJpXs!RA3V4|JRd)L_=!u0kJ&zc_Hc$PiH|3I)O;m!)`RZB@Nmw< zFCNZ&xWMY0a%M5RJNm1K-#lDo?Cp*|u`a~h0}hT3{-@wy2Ba|$aSs}+j26QZ5$@{W z94$-_mWO{m-1U&~kmM@u;f4p>gX7^356||@>3Z-y_#Sw@Ew8%et;MZdD@EoK}i{#6OCamwEdzP~Z?w%9*C{N>@chrhZ0dptcJy5)fvL5GT| zya$-~$MWuI-eh~n!#^CsX2B)HY@Mn8!RS2?|8Z6Kk=w_8FSy`0hmV{-78T0*zzePs z=H-H&+`Y7R}q#txAkB_|m|Jk37wyICP;6LleBE!VBqeYQrJO)$v)olF-1!D znicFDlS$>=WBleAN^A+g?PG?InX-4&8RuKV4NHdKp-Uy_Lm%AFe9y=G(wK~~!JywM zrF`InbZ^cK3V-yl)>tve=P6bkU~K!C=VQK)^&D$@wQG2Rk0m~qO1x0gMLrfwz|vl0 zMXRpiWj;Ra8eZ*VMaAfHHs|9LVwojpm5-GYAFdi@_S0wKIY zD}Ems^BW&0Bw*2@apJde;#(izb5f5J-$@M>J1E50#|gIn zqmQ3_ocD1-_VH&QXXpoMTg&zeJ3^UrT%*Q|U$|CuP?(5+_3@hzjgy5%9h8ec;y&1m zESV)I#$GrI9Ys4Uj2F$v3&V%yBjLmJF>t(iXS|qELs>swB&GiyA2tVlyx>@nGBN9O zIby7)FpiHN`?%zzK?)61xa{K!SHcuZr0~0st3Lkqao5K+pHIc&wvWI4U{CV8k6VnT zwF>bK$@!BW-j?~7kDC$@mzWY_>5-F}4f}@gNajCMlKeB@X4d^zxyNblBVP*nQ@HQr zfe)mRD}@{>92(ER)q=BC4F{+>Y1jZYHeNiELhclJE-r5hk4iwCCxtgJM+uk+$S3vJ zL<^+wSPF$xD3}7XMFy&cQsAkoJ!eBjQYe~2u@o|Xi40pBls=?S)KMS#Q7xIm<0+^q zh!jetP&$S3DLkLT6RF_%*3&7z2n=OXD4RlsrFb$09z%L6h4=fb1WW|aO38APvWU#* zBxcb+Ssmepr24UP_0Uy6z;RFbtQ&m%76P(wxvnJI)*h@>zv zyImy}RH00idL;8{+zbg6bC=?){CiRtu^<((eQL;?VU2nIlseoWhV4hNiIZDP=gL;;1r=f%mjhx>&~GZVHu*U^m(H1TjkT zM@ve9G3?;EOoH+BSPI{yaDt*!jcqU#f~W{Oikh51TmLxPvPwp z-eWwZFg=AC>~ae4rZ6)*ZQYFOcbPxWOgy_d@sc8GP-e2Xk`kkQdpisjUAaEr|^jcD>zAa z1)Ri5Wn~TZ(-c;xur`Ht4DTB1niR+%URWU}AYGrrrW7_a0(+<%QrIZL>RKwZ^*ct{ zO7+JTdl$CJiu+SIkm7xP*pb4{6n3SsCxyK!oII=UPT{i@yqbI|t@7n8e9m@jsZ}Qm za`wr(4^>@#QziHxP1PdD7<)C9y3842-SOb1D3i!l@L#;}`IzDZR){lb zJ4An#ZvRbU_Tr*+X;unzCklF!R7*im!KVD$utDYLR64;*!ITx5rA#7)q;w9)$Udub zEGXlo;L>}N?{luz2%OKJ-mRrx;^NQ9yoR@~;R+`>*W}B1a2Z!qxJI>?(dRO6Wyf{S zqf2<|5^kjMCqp`o$!YwR!cDG|X*{3CtrTu^bxosq8h@v7hwDQcxzhM2g?}0LTa+AW z++~FT?Y%(+Sdi3>`~qCyfpCTZa`ie&SPO28_$4l5pwbH1a27A$Yl3;hnP7?DbiMnajlh*phMSc3exS+2tl@x!TMx!*E zrqL{o#xx)vYLdpTl7eYbNzpuw7HLdO2cHft(`c2(NM=il)@ihn%t4a2O{22}hn1Y| zINTC^nPUTO4Bqr1dCvL$<_v3*kTo34-K^p~`6c4ZW;8@>15d+)vd04XA_uO{wxhI*){ptruhqJP-WgLh7-;>U7iB zF67}Nx982=OL_QP$Yo9~4}S`${3<8D+f!irON4i_{|M)wmEP{F+@^uNJcRS`#jRi@ z4}9wf-)};$bDQ%3^IJh94`v>2Fm%(GZsuByig`#1k8=gvC|fv5m%joI7dj8=Jfzsv zUxDL~2Z=nXsDG7!b8jG@Zr@kU?yGL*;TFfg$X_^&+j;me4+X+N7+GO_SUT|abHUp; z11)~ft^B{BuS%d`7<2Cp6bfT&Uv#GmKhcXkmoHs2xU~FtWq&h4EDpt!^0g!g!Fv>p79Withc| zAGwe0^jG~PP@glZqXohUhS4Ale;9Qqqw>N)!!UBfn0dFF`Eu@yV?&e_?x*E-@G!NsUu=lo_#)3@*nSD5nrWwwczwjh;9!md67%jryf$-cK zJVihFkoUTf9tnS|Fdhrz@v!%n_)Z? zM%yrUUdnwXjAuD2s29U{DU9c+A4WU!@~V9pFVH^y6nQhj*97V69b^pc&0L<`{&ER}#qUlP0>{_p^p&E1VN8Pda}}*w#Q-%~G*J9%S{T#A7!=0fFouLNG>q{g9~Q=N zE<_lkY0s;H5h5HZoNh@8-%COq6UNvu#)Z8XyHL)T;57XxuvNTeLdI_=hC$^?VN4du zl#G087<`k?omw-(phGU8*JVm)37H+n93gWB=VeOghrO80x=ahhSd@`3W}Cv73NFjY zFYL$4Fjj?8pZ2V!R)?`BjO$_Kg|Rk_bzvL`<6s!;!`KkU?o6$X>?MrNl5KV^YfDD{ zKOtKMx6#@e`PgR*>=3?Fa92kDt&m^)DSpuG;bLX0y@LC~_)f@vLCU`md+!(``5}xS zrPc+(pJ>A{ehK4{WDg7S)iX!J_*ppZu)TPJV`2O%*|UPj!#FAAgy3(2)cjq#BRM6K z(;4|0I>QNXMVQWUcZmFarnLIF0vCl}61*&UC5%7AxEjV^^noz0iE!ywFHZg)hMmr> zK0nATkrI+{7?ChaM?3{4Jq$ODbQn>oNJ)(D8ipB$B@$aOo++ijCBjHb)(In(kx%_2 zmoG?S^?dF-ZpjD=OBer&LRJJfh1?RnovHO-82k`ttpb_xKuAHs-+wAlB!bXQ@9ST2 zkra)fn2@^!DId7cn@EWWN{XaZM!q2zWg;jWLAeOZM^Gbznh{ipcy9~3S9B^yP$`1D zMN&m1_hjl;782{Hs%9itzx8^#FM|6ccp!pmBCnn)J=o0qQz!kimPqPl(^jujKkUkt@0X9?Bsy)Z|34>%JggjHS^I5wwrsg$QyZP!Zn# zLaPX}z6msnph*M|NAM6QTRFtkSV*lo!A}kbn?}$)f=41~76BzprTQ!Cw2VCmjsTzAM-+f?pmCGRx{y{t3Jo!AlXmC2PuyoemMa8o_Iv$ezH< z5xf$?>a)2__4Wi_kDy}&TlNOuH)!@QL0-$0Z=iLGco$i`gsj)!`-b^; z1f3aGMhD*!BzdgAdM|?aBRCSl&k=k;+eWY`g2fSZji6fuV<&jk3i=eP*QM=&#jSrJU2GmPQCGQCqKCJLVOVs<_ON^P&4vb{ndg9=A?3|vrq_&mPD{L z;+=tTAcAEPERSGAgnzKb3h8up1RUynje{#As9!R$DuS*3)!F`vQ&!w2y3jP$qAt96>7Q&m2N9pABq6nM_j&ZZdrv58};}M+TzRL<;l41WA!MOlR7Or9NyWCgbFpAm#>YgYx2Lc5&E{X2qxXte)=*CL2SpbNhqL7tGXAWK)g8m#$dAj*3_ z5%1Uy@>m20-Tuu0)2wJNg_ab>1?>nDoMzOk$fA_26r&$K&}E!?AdrqAU&sx?TY~=z z-em7@1*p@pU;$#5jsiM<(Q!-%bQIL_rjAZJ3h5}Uqlu1(brjK2RL9*q?$J?9M`(a5 zr(^40t?dAHmyY5(NSI3KC@H*DMp9Zx8NsrGKkUdUFLf&jRurrxxbKL@HY@9>qN9Nh zzmBRp?$uF4M@=2~>9}7lh|9@GEtk6JA_)CM8`Me9)^Ed}o$s2a*9nW)hR^_(S@uH5Ggtr%bK`=5o)IrC~G=+|iI$qK7D(y2+y(YL~ zprQh^Bt#SqG5dy&J97IG^%jkwd!NV~badA7j*fvk2I+X0tE1x+9iQrWPsjT@KG5-@ zj{h!ePb_KJC#8MhXkB&8ETMhGg&3Ecx5nR1M|Y~t1o^N}b9?Cc@r}^OI(q8f8!pzr z5n6UJRNB!#W8>Mu&vo?HapkhsOXtZO+V6om8e4^m;UYMfe@<26B z$8?cQ)lscUkP1vJOe$C^t7Dsv?Q{bjyLIf*v4fj; zka~5HBJLEvOUJj8C}}0~PY0g32aUExLoYnDm};I>roEcV7*ejJ;Pwiw7%PM?y!wjvHJo9S-Am zt590UuE8or`ANUaRq%&qv``yP<(@1O>bf?U&-MMQ<0j|$UT%RXZgI3HbN|zk6~%3C zx>g}3N{$u|&EKmnC>XlYDugHsMse~?h;<7^(V6!%AQR}{sg zs1(KBQIv?HB(tk>D@0K$iqcUqIFyTGSgTN(D9Q@y^nUJJ4MUN^>fNHD@=^3I5~{G% z-{j#Cqe?|qZ=p8!!aY&Xo-C>wMWG?8auijEs47tehN!icjOpPhnnuw~ikb^P z8pR_*S_r;9)SF04;jILjeT){Cmy)-RqKycj5PUX@CxtvE__W|Nf~?gxii(E!%-C~L zJRe27jQk}b?W1@hBYBZav-tnclj#t}%NhAAQM@t4yHodi6dj}J62*IzNU8t35PxNR zGo#r_$XijoEu?cs{!SF{3h%Yjn?8?4dOwN}MDorMFZ*E>T_xKsicg~WG>Yz-x*rMY zA^5Ri&nViS^x9$iEQ&8g*h}zp!QO%_?IVP5*CPK?_*a5oNAZo2r}lV7{i7HV#a~hU z9mT*X21T(lid9hzj$%j@3!_*R#ZVe2ipf%IxF9Qz6*59_WE7)>jLwvf5z_LM7cIvL zA0Nd8Arl2B39@v+5H%%=sZmUeV!8LC&JuNzZw#r`P17rrNoy?69K_wS41 zyA0D^#C7R9eoTon27C{9FiPWW#b z&C^1DXOzoGP6^>5V61*7inAGc^hf-W;pd~ckl~$u1ukXy^(75meML2ovJb1D_q~=1%dm8KM+GTA=L$I3)T><8AB~0R35!Nr;hNt8Og1B zcrb=+$@*f*i6Ia}eaSWu^k+01#&G(OXBMVl42@!VNQyMUkYH{MDx=>q<+)$u7@CTt ziQvPT(jQ+a&@9873rX!N@MsJzWB4S7Ph)5m!(%bL8$*{E9*^Nb&Cr`Mbc&&M3~gd~ zB8DeL_^RMjF+44VcaOD-p=V-fE7@mbcu@$eKNrLE8QxAvd%+iC;Ey0wcqs6znQU9aij~;U5X<5yQtqiVamgrDdvp7DKNXX2mc&hR)RDB)8H#FK%^;HaS4^`g`RefXV7eoIT@`kEuL)C_% zifX?IVwiehm>LwrkQjOnQ;mnI!L*@}p)rgcrkIuvQzOV@m>9#P7)HggXP6or!?+km z$1o;_bHls_lY(W3tMM|72~wTIV4L-atI07;iD6m{(_<)iE{Dxd6@}KrJp~SOMhr8h zsPk~eaZ=%{;c89{b7NQ(^PbaN^g-^tnD=De!WibWo#EbzWDA6_h{rT-8?F||u!Md) zTrG`Zg^*=2ERVq*t|(+8VRq&(!PVS%Tx$dO8dw{{x)}bB;hz}R$FL!WeKC9&!^Rjk z#jrJoZ87h8S3UsDCy+M_-$I@5JRzUp-5&EERNhUmj$sEKIGt;{xjSRtGtW%B?hrv9 zBd{mtJ)FFkRYrM_Wb?V}{V{w`8^-Vl=d~qxfB`crcq)d2G5iqY>963y7v;7D55@44 zaAw!H@B-{%*+)lW_&J87!hfN+2stMBs~|Ox$FTjj7x#V>$?qBY$r$b#;Wc$ShKkJs zXJRd2r$Xns;-$39FXOL2G}Bm0Bm5b|UojN=)_Xwu zYRo$cf#kwnYJV|xjln;Lf(8m1$YUdSsdx-_3}J3V$?7r0VlZOfv(QoQ*%4kva#Knz zK?*79F+wF`NXBq8hFdZ3Id&(8{1|S;kdiDVZVZb{1k!YPU{93? zusOC$hWBha-KpcQz&+AkWdkkU+$!wF&1LWR8MxoT^9I@(c)&n41Db)5f$9co7-(o9 z$3RU3wG8+S)HhJu@Sb?DW1udlInsLoo(sWaF6tS0(D2U0_@lVWHn6;yVyZGyaRn)) zg&VMibgth(?npHtoy-3P1jHtE>7WdZBi#Hgat$a0Z45kNppk)xI9da(3^eBK3_QXv z3_NV0se$GOX!dp^RgaOLn>91M50qX1W!-tOpR=aLxIm9`E%=fqIkDt11CJZt9~0`x z1MRI1Z@)18{Ctq(eA2+v2A(nSlo*XIeDEFG7gue$7V87g8eo=cH1cy|>X9Q=djl^R z_|QOC11}nQ$-tYOi-8UXUN-PLm#?ULB{R*}SXwslsvv!vX~{^{(ZCzxEu07k#!dZ} zfwv93Yj{iM9g{LD(3vweyniBGEvo2jlyouho`Lr{Bm*j9}6Mp|18+Trv^Tg`LYqVz~#8}e~sP-zA*5mfj%+|KJ(9i zH*oseh@XP`d^8OOVE3@|W|4s4-}g+T@e)4NQxGcm-#Py-hY zT;f~|45uR**l%EjfsqCl8dzjtl!4I(rgKsT#uym4C1;|6Ne0G}8yGJV3MVkGZp!&> zSI)MfL1rf#xaV-rRJ!#4a;F&hX-)8K%|MHIV48vNHw1tF*5C42&P)Td49piNnQh>F zwV*pv%`wpJYT&|1HP--c=FFqdU-I9o79=h(u)y|L8KtPU*uWA4n+t`b~LKN+Q1bpKxMv1n+$fp1O(H__k+0vil$q|b~}GtcLI zJW5eMVwBn*3~n{B&A_(?b{kkt2?uQ8z$it&acYochk>0U*(G>kl%jBtfxUE?ir!zV z&IC1Ql=6)Y?lVwfw7U3P;CpHsIBDRNnCScn|3L#k82FL45`)bDIdsUtVFSO>$YcBm z4&@wSl|wnl1b;SgR0t)%7zm73B)^K}xagnAl(KGz>;B)lk4CHJM&LB##&-W7(#09! zX9X!dC!~S=K!2Xwkj^|>jTr51Fe1nXbpz21k1;%E_!1PbGCXd;&hUhRWQO;U7b~X>xFShs4SEMej< z6X!=OzTAgcTsVo5=Uoq$dLh{IWKJm)b}JtEjA{k79jyXoO_VcH-o&7N{t6~iqgAJA zITM5jQo;1;EXz(dng&)RxPWaDQ)nQjXcW# zs^DvauM4*RH1H+|V4{nO_e{KH;%yV{|JL5+@Dl#cCc2JO@0ebsVk{anPOTcJj@d>MJd0NUR`-L_@#-jOnhzP z8xt(O$Sx{|{_K>i9}niA3idZKz{FsNdJ_Zblhj-goom zYNClr^8%AhOg1saMB52!aj(Fz399=9RkC$px``Par-@bEYbIuKLzQT_#Kde9b4zGx8KY{HzN_<2-j zqT=TcSD9oRcbSQ(i5Pv-#10d`au=A`X<`>G!?Bt8*2He^;@Sazz|pt&nAm6HJJveu z-^(30Q9U_P?Kkngtke%CI!{yw=*bfm?R-$OlyDJgd@diycF4qG6GynX6V zvx#FSuAB-U<#2=Z2HM->_)p>W| zFB5-D3;*y#;i&+>0Cb$BuA9g+5jGJqp_|^P7|I6!iiYAv8oCSo^_v7JF*qJZDhse+ znTVTkO{5u7O-!7m5+;&D9{DdA2?nZf4>*jXCb&JbKMjOW`+w>kSUpMQo49G>mWdlC z{*?{I9rxAl;F|vhZ=3jel4AN#$jviB@+=G2C#fO#YXvP7vhZKAhD9tCoU9o93tRm8 zGEjT6A{Mn!%)(t3Zk_PIJ6V;qP~1WZ3#})s*x=mZF9%BhsEs?6Q_8}b{o3tlsH}x@ z7CyD`nT7HeDp+{V!t)j?TBu|p*YZAk?zV7`g}N5%S*UEGiiP_vJYb=!h0R@pQ#uFV zET!FRVen+NV6wVT$ll3bK)5nlRkKjtLJbR))Ur@pNKL`plf7>jzb*FHvA`k{W*@YW zZ6U`(z{0_wg6IFzd=~0k*w!@IKrG<5usfhJ;53vhZF2V%MH8X27G#xiicv_j5VE|` z7ntH@m4!wY9iT4-Y7VGAuRjI0rAD%jk@BSM-9wx6O{R2+fB^8zG9mbS9+ zn8l;O@QlSnkZ^ce&Qlg%KNe_ByFDFbwv7m%5PVWF5%ZVK4xalU(AEMuo#CZz{%2+R z9`79JuIIGlI4yLt@D?rqXYd6JuUS~oAVB`2NM5qgLCDL3l)qx(RSSRRc{+RN241&N zs%nU-qbR&#;Z2dShzdQYsJAWei{D2UI$L1&9SiST=wjhL3*AIQ;rkZ4X7~pdKFsiu zQxv}$Qh_aWr)8$7TlpHZJuG~j(dlX76X|006g9nmpqGWuIXnx0Tj)*Cw6Na71`A(U z_|n2C3!^Q3W#MZJ1L+S_)qyGM8w>sDv{O}I3vG4>ie3sBQ&fN9{02CHju#D`T$wY7 zu4Q3}g`pOPTNq(s7#DG>;!Zyl4K-NkCx30K8fh^U2e?(aVJR77VXTFP78Y3;XJNdB zDHf($m|$U|g-I4BbMRBVMn1XjXRP>bl%D~Ftxf9fpJrjYg*g`HN}DrScdDAnc}-Q+ zB%ftrwg}0$O;vY-&pc^xz93s(VBxe(bFqab7FJkTXXtTG(V^zlHC)87*w#?y#^& zhP2hf4huWEcPwn@+KH{oE%g7-0_zT)rdWNK1sayqA^(=vh=wTNYhj=C_#Gv^{R^gf z#-RcSumj#~JIvk(BGbPloY~7<_d_`(T%$iN{8Kh~RYt<>KNhah3FD{}$8`&N7H)HIS_oT+ zSg^TgE$9}ajPtUHF$?@4FfGtM>b49TjG5EDh2sS2a&hU1&XayBnB+z4KL1T>PFE9( zha3wj4%PBLp3;Kk8gY=mEyNUlu}+>#m56SCqc5J$N<%Ey5?3dT{C=~AE& zadQqo#fk_i97nRZCt=+ur>kOd+!aT0DJmI9DIp~UIen^?j-yN*W#g#SIK(UyM@wY3 zLL3!Eey?DqI4TRd`%boT=$^Q@3#iFdMTAx3-lr|I_r-C4+`Ei@AdZ{{T8%iWNwzvK z=Z6L<=Ve{ZxVJrP#qrK`Wh8UR>&8(pju+y1F^&i0$d02)91q9gi=%!VfjELP@&<7< zjKls;^UDA@5e_3qB-}ofYjK3)$c;m>!Dxt%)OWhKr??_>r>jPBJQT;j}H=d`9^HrhBG)PNu-cB7Z)PcG4z!d(q)diI?K&5XYOeo@l-t_uT2VI9`$L ztAZQ@P4Rjh9pgAPUA@7Do}m~h$m7!$ztX%#8_rN~$GxvN3`8vL%m%0BkaUUTy*M`8 z*ka@TI6jEub{zl3@nIZYN`Vy633@;kW8DQ*3VEs%}`XkGDCe%n^z0|J41aD$Cq@2I0nY?RUBW7ynh@l zqVhM=Y+pfE>=(z5><~%zEdTv8)gVzDETvoK1=BwThDi0H^rab!Ei{^`x@`!KpjqPh zZjpav9HZhG&2@P`FkWzs;8?+Nf-HJ_a)3BNvJ(X-2~LiqX3#5Y)iyXaj%ji5&d+qg z8G_!8AR)83cD(}3&W&SU9J}K9HjepmEQn)e-23jdFpjrg3ohlXmj)IIUrfVp^e++A zOEx55Mr)VXn3fA!A8uC+`ALCJ`R3YzcDfJMj4G{gJd@f zZW4TAwts6J+hhPc;@D0S$K-SV=Vz)Thx|QP1)XETV_gDt=AB%W${IfucE_B2DsZ9LM80A^PXzxDdy0ar_>~Ns-WiXM~)J<8(%H zqgR2m!p~(Se=s(d^)5Y_F2-?{4j;!QDZMOsC8POg9Q>@gqxp9nc^UaXaa_yr>#|?& z=!8WW5!5-VmEJ9sUCVNeIBvyJqeHG4hZRShQHT+kc*VcuroUJ#EkVQ13GSV#h;_Aq z6Gw`hWr}hI(}K+A3%Nn}&PZ;u_q+g$h9+|3WBpk+3fSmtqn{1fC}`se8&BFOWTUW+ zdNv-kQN%`38~50#Y@?WsyKI!VQNi|(-79XRjO`tDSi(k08>NKvq&rGV3n$?@d&IJm zEhor|6>U_qakuRqJjm4V^V|-zK;*%UJjt+%jjA?k+NfpYUfVmD@_ri+2)R#?Cj?gG zn59+?kyN+A;}faL7AUW6qmB(8&sf(66)0i4qe;xR;j_`i#=|!1+h|}T*M_p;=cM-J zm=r1U8&E`>`x$NTl9xWuCQ=_DjjfZUSK0ssJJ6w?mIdX!W6c174F_=wl zG-Gw!JN~gb2WjI`8!ctbEo|?gMIJfG>9ARnRT+856J9O zHlDWe9z&~*XKb{!@w$zUHlDTdoQ)1PUZ!U6+~)<`+h|8?mu<+y26=Sn3nFCci$Y!! z_*!a-KXEu7-=xU>zjgM^fu)T9Wd1hmGF&(XO?RMZ}8$E4&DkkE5KjDmK zdE;kCL?+sb__>WfHomaYTa3dK9l1;_`qIW%;tZ_I?AOBS8{gR8`K2WNZ7*_;w=u!S z02>2s46?y{RwD%m+ZaNxF#JO~&T(qEjbYpxH*=Wo+}au;@|B1Dqil?}QTn8JGlZIB zY>bs6@^LmU&r~E6xx_Y>*jQ>~G6!5Iz&3&@%4I##m#6w}T#=rIy=R zL06omRtl1=60%y*-5y*kn(J(=7qY>|#ygUMffmyOY-E!S-c};nYGWH6JAvj2Y^ObK zSln(lcG%cy6m<@LNyX{?l|7zp7 zjT0jIP4LCG`oWYP3Dih{oAJQ}>daO(6R4X& zJ>j(ys4ax@Ite^RoUMp=_HvbZf$Ri)3Di$u$S!}w1acB+kbpmd&a+kD*@`%QwhBlo z6@o%|BUBT@>J%zY@Mcb9Zh_gVk?@BEDP+)~ut@?BODTEN1WwOZB#$J}B7r3dEKT6i z1X?EWMFL+Y(29dh;LQX&CGdCxtrKXMK>GyRB=AH6ZE2`E>d6Fnq54z;PjjVadp9kg zNuXSl0PijE1|tctUY||ixdeEb#^1kqL-P3qsK(oIFK`7Dc%2P)3B4rvD%%;YItYJR z@Rfvj^+bh+bJS}I@16<2yiuoPM*cA9tnJ!z-I~XChErt zd?HgI?~jb!58T3&keN_bZs8|QfZb2>}{ob^=6QpijAU+1W=66l}6fCRoyV8kH* zHwjS4)Hi{C!g=$J*?|cRN?>{dGZGlgl}%uL0uvG#n!vCGMkO#hf#C^QbJWO$cQ=@J z9wB4q_^0mEcvUzifw7!m!n=jSrP;AEhj$F9$ty&DBb}JQqy(lUFqNLxBrutil2Q(m z7hJ49ErD;7IlPMJ4TKVN)yxED(S^ze7bY;9o;+90rDM!ha}r?7cWxuk6Ulr*7A+8~ zk}MKCFXj@@^)4QHzhYSe%M&<~z|RS+;5JEMcLICpLJ6!+U~>Xn5?GVKT8`m`z@`M& zC9s|``Q<@H+(02KkYwPF-wJmBKe7i z75yJseXja`u40u(3pYH(y;Hd1;RH^W(0fjdsqhCUb*D6=Lm@}Vk+^fc z-zok~c)#K?T@!MZ{wd_|1pX1i9}t@NJxNqfqID8&lBkkI)ui_&tx*#9CUKwe zY-$RrCHR0~HNonFH3Vx4?&<1PXR0mPI)ZhRs3(N-2a_1u&HK&ECzAR}G!Wt!)RJhJ z(aaGNNFtb#w6(mJLrLUjBudDF76l$kqHz*UGV&He9u{nxM6-;%c@mEZZ#K>w1Jk3D zZ7JAF@UbKw7jmVsr}IP-PbM+3P{B!s3O<#@(;WXT47-JAl4zU6tQ2Oa@N5##CDAX1 z{wX}4M7tzDPT_|Swf0H8kVH6%ND?n5@lp~elK3r&4oSS6#GWMfChitnu?-cI6J0bl1NJ`nPb z;Jbod1m6>+&im}ToksGZNV*Dk6YT!~>Ga^RljxbmCrL)C>`#;EjjUty6gkOfA|!t} zk^MP~lIWAf7fFmtVssK;Ch=7g!;%=D#MeoDLw}pEh9)uZT=vmszP?G^7T>^ z;R6K+W#ogC7?R=P7CvgS`iLZ74d!cC$u}~Iz90CU9wzm_1*O zhOGJ)$mP9VsaAYc4#b`LcUnLJYP*sg81)zMVu!5yBfZkT*@TYB(at) zBrzw6B}ptzVlJnU5kdWY$1u{0=1P}b)jOdQVUh~LT@ntOY*Y}yOY>KM~Y_eOkx*j z{b)|7g`WTPS*Rw7TJco&yoG9C65l2HWPA26N$gMJ`y_r$;-@4~A&YenBymt0`LBEy zb$$@d+zMHTgd7p1{IHP!MYDg-NRB4)Q3bEcu{)a4>|dpwi@e?ohX{cDnw@WB%++Yg98p?Nq)J)a}J(& zU~>G7cn%(L5KqERqLhQu4iYpzoimABjJk`IBbZJiCB#kQ=oszmcy`Nf8cXw&xRJ!a z+zat+X1m@hz|z}E{3puA9Ar6OBLy84a!|klBunL5ixlNdg+)?Su!w^JPy1NP#CGm- zP@Hnd>yfFX5NbAEq^MBF!HbJjMF*7}ly%U3kt!!xUa*27g@YEUd5hHD4z?{)RUO>p zpt9qQmO^3`2b>7Wy`pfRgR!Hup2(u4nuF>N8ars>poW8*4*U)p$~bE|sNw(>6v(T zt^-eDu~H63j@BAEct|AG;@K2FOj9^$!%i2grx&Yc4h}!a-H_n1jbNlGZ|~_Jo5c9X#cr%D>rd9sY!r{j`H;B(aorDSuYvBrI*`pgoP| zV4Q;&xFQa|kOg|lK?et)IQZ1zi$(B?gZCV~@8DGjuQ_IT-9LTEiKQIwO=+QceL)KDoJ zmdR2$Qv8sJv}Fz^JDB2No`d-graGAB zV79|I_GV9~ODs_{9L$vLGfUJguEi3?L{4NW)#f;uD+=W8duj_Dlz+yz(7_@h?0T_- zB@VAQvwNq!v{dAGIEBj{tf0kG*#nlSnM>44cDF>W5~OhJ61CRBUQt-*EebX`*y!L} zk!*6XS;#I2TO4c^{>u`@ira+mbg*3rCI54ENn^ z^P{Y5#Ww1Xr^<=`5#cDCW*x`RA% z?3jbFgNTC$%T&|>{rvZ?8vRxmAC3rT5q+DR#dKgfcx;)9b5k=A#j~0AIoX|-DH4Z+ zaqzE$n+{wD+?8XNskDP$%hVm7@8E_53fVsK7Nc&m0Atr}MvQp&;$`YTiELRZFV+z%L{uyPojXWedwypXJJzLcJ6oOySYxDm#TS z$g-aDQK92FWDfm;EwA>qHkI`B~;W>g7e)DIxmO?0nHYq%jLT(Bwg{CQ775zps zn8tz+39enPnxyd4a`mue+2-o*S~KCzQ+OnW792(jji+djr_eHmR#NnsAcfSwwOmzR zp+YMZv#mvwV|X%!r&4%3h0ZBF&6VO3*x9e8&^CqVR;U+Jcu~l+L|y_2Z!y*g^cCUEz9-o>-L=TY7B+I(*a2UvXFNOD0csGSEB439r7VTZ3K1kui6h2C!M+#l(PWjp01-qp@zvXAj z8xr2{e7F#q&aF^AQ}~2SDOWLHr0}JX&r;|mBP6~;k$=UhN%reZ={F1} zE4?BT;(!z?tyE(L2c|Gc$Y8-yfE=A|${ zgc`kcF3JX)%o5sF07NxM5tC_}YX)H-$DLuqRXBW#-Se}BLLOO*NDXgSJrf?{Q zRb0mucBSxb3TskWo5I!csNmbg?Yv1FT-LXNnk{{AuT&dT_-3Vgv$(H+ zN#ADf(7SwF1et9;RokAz|LDf6wbe7Uq9uGgQuyaC-%gHjs ztM1VD(NB75Uq0f~%lN)y=$NVP=PoGkdwi!hZk~3KBcG`)-=h7<#p1e`^ZhwpTQN&J zyGCo?%6B-0BXrahuBY&G3P)2opTY%NCWT|P6~hj(jIY^UzF$)~E>k#>!f%W`)3sqG ze3MqHbt}~y&3&g*c(0Q0ObTaHIL!~5mFmh$)$dVXXts7Pg+EfLK1ZuQOM7UR#sSkB zbr)zCQ}~m+K7~suT&8VTD*p_x=t>Hs7idqF^Zk{=SF^RhQ^=XFy%h3sE-d|rfpL|3 zaFxnSA)G=y1v`aE3OYS`m9kQZrZA$I&tRxbA;$QyO0ib+GQL+*@Y?y;MH;VLi@G?o zR4e9swwk?2Yrb78;i9CAvM$QG7`;l>+@zIqQQAcr7d=*LO_ytnR;l+_Xvuk6;l)~c z7ZqGobium3+O6bb>mse@a<6FjDwVrftL&nRi&`#fyQu2oUKbCzsOI867pGUL`(50> zSUbE}V@EM&w`=z;(yF_t>Ef-~8jEVMZc85to8p-3xTx!*feXKjdM+Mx;d60thIV0< zHn)W@+r@WFwYH12BCA#P)vCS=+Pv{`CN3U!v2v-m(Ct>Mhg>vfr%SZ>5{=l@#k|#8&$imuG4q)tz2*K&is*T#Y*`BkVpP`+6#CN=e zuh2B@Ef;5JYBkp=284H9yzAnei$7d+aq*sug)SDkc;CebE=IZ-<>EsZU0n=xF~~(X z7u{Wa=Asw7SfkPGA92_&K6Y_wz4lsd->YjBNlzD_xR|g;BmdMzQxSgdqPL50T=aDj zFXrpx@^uLwVfsSImuu8lLcZqUn|t!g#eMx;Y%1X!;DSM*{Vc6NmuZVObB+368DIC( zzQHcmuTeu;N^8@@*Qg6?RO|Vgy+#dpF@j^8#pNm~A zak0zAw=R}4_`BHPVxx=Y?90V!7i(PnwN|aSFvl?X3;khwIcF<@+BS&-LwCr>eKt zcF<#UeLGzYU#F_%`WCHIyIt&Y@e4PUi@h%Px%l420T;*Dsqb9uckzYhW8$Q`*Z0{C zecZeUT^x3C#KjMc3Aw%>UF_bb{UmruFwADRX+Lw7XKF{eveUK3^ECQlf%R&3ec!Ka z+{G!z4HqX|{3b&>>Ed@TLCD9UvM)AkHS+j<>s4sII^*Km_3A9Qb|W8)#x?T2yI!4l zae;v-jr-ELNY7*xb#dFpWfxc2wF}$z!u6jn{&8{5#Z}sY8>+YVH{;=4ZT)&RV7;2Q zUR`&Q=kiaEIJ91If?*diMiRd-;)0Xa1*3x8n3Nb&N`;&TK8ua7_bgdpgG#taa*bTL zvQiF>vqAAQm!8SKUfHgtUF5sC;Ucog3n~0G|5u{QO^LdkHJyjy@jn+?X_QW*Od18! zKpNj{P$kkRm`0&Ailx0#6;7i?1z*uLxJQblp>0r1OX~Pi<$O&_`|e8P*$s-RcpC2s zDVc^@(N`)BekI`NCO-korqO4Oc6S>0q`eQga%q%Lqe2=L)8Lr5m-OwO>3w0SB-u$D zROK|Pq>dT)@@KfZcrCDsEQj^gN^F`G#*H!Ng5BQQ7w(?X#~;;roHW4BaM1# zJeWq!G-{<$JB>PNyfIa)n?}p#z88ymLGQ*ijf9(hRC8Z;8V%FPN%J46*swvXpZ0=3 zgI)t6enHNf>)3j(Hf4tP@(xW)Bb3HNY3wfL%cV6M`&1g9J?r~gZ{)lGRHHOL+o=9o ztFep5Y2^0Oiuci)rqL{o$7z!^ny2wd8jo^FX{cq|$XQzR9AAqx*n-}`*D8(2(q4Sy z)_b77Z}diQ<8zO4@c}2E#yhn9CiPw#@2ByuaAv!t(Rh<0q0WaK z;U+~*W=XoT$|lt?VB=oDa_tVA%L6YJ0Vc{bM z=WkM@(ikm#jNn+oaf0Iosl$p)6VsTK#^f}nhV1 z>z;S=Nh(zGZpgEAc{AU&O=?dXB>!$wb3W9Hzpn+~*S?c0n*C{fpT+^U*2c$lIE{lD z{zDo+3cuOL_fr~&GV+p}6*Z4Y_GiJPf;-A((GGsq;Zx(J|Fkz<6Ihlq){>-R}1*gr*R>Tf77_h_@Bn5G{R{_(zu*P_vd_n3tnL) z*{uE)yec?(sP-3k>t;pr&Sv!wcNx8Xv$`(&BzZyxY*u<2(KN1aR{3ef(lF9UiKdyx ztj#Ks#+J>B#FA{BqZLBQS3|X=lsX*h5RGa?SL&t(*~>4R6$g1Ejrv_Rl3QuqW~9wW zv3&fOMpizM4{eJo@Nf3*&E7r60{Pwz$-B3Bw*m_0qfkEDZ&8Kw@zEB=R3slGgs`c* z^1bO7&&T2|Dn3{%k&iuFyuMCtQKj;+?Rj76e3Z#Y*?g4CN0oeUbCu6Wg?v=b_kK>Q zn2$>NIPgu*-4qt~(cfNqK{K}~O70PP@vZ9q!agq6eOp!4eDJgW-hBMJS|fQt*5#pm zG|or0d{oazjeOM1NBw*>kfK`osF#li^HE!}b=X%sAD6POWZ!A(%NF7jY+fjfMaLiZ z6#V&Un2%hM=Ll+of&a(UcYr-nbm8uvH=AUG1(70(G!;!0(A7}^3nD1el_n}(ET|}= zND~wbq5_HyY@lF4ETHt>d++ekd+#mDCb{n({@i=NXP)hwevb3j5BqT zQa33-jx$ronU&*Ay`=0PXIk+?At?=$!F|t0oW!I&kqqv=vX#apNqIUc&m^TO`;e3t zNvS;EbT}7pp5$GC_>+u^@xkr9qAFz3Q>yUTc+)Z|ZM5j?@utUkL*6DSZId#NGoF-o zNok*y9!cq$lxJxwDX%jXPdt~D=aceEQaUB&g{15%miTwP>6nxklR_f3g6#0(iI*5= zDp@h!G&&rAH7TzpWmWOSo)U@m$K%xL%!%F=klNQIx+LX|q`aAw+9eWiX)9e7*<8oN z@ovhyE3PV$ps-g`-cHK!r2LeW-bv|`l+Tj#c~ag<%DYMVASoX*+K4Ntwp|At|$yGDnMMD9%dCOl^XrV1F(Rq1}YQb#s$4kIU_NoO3sy6$|2= z=$;eIqNFTVZ!g!*EJ@1Jq%6}ey>KYLFBJ5j9i}Nx#0u^hs!V?}yE-XrbbxC)oNe)S z>bI}d71q)CM(#^VIjk|WIVoF`vNtLFl2VYAtx4IQlpU&nbIk;OvQ4`^YJwr(d1(k7 z;{-#O?$#{jdz7%}`;+qZw)jCti;@G{1SL$2Z6e2eBq>KZUM)JFloQ;dd1Gi>{G=LL zIl-LLp3@sl2e!t~CgmLWjkG+Jmh(xuz(`BUXDPXulw?vGr=&?rQb|d3cTGvrl=w-> zB;~S{T%M9FH-By#yd#_vD;1EKqMZtEqKP6DLyC@KSTUj)Rdf}r{tED#Oa@m&4Keu_!komZ{1SikBPyj9_5wTN=i&h z?oP?=I>tLwa+lh_BPCu+IyX#EleqU2kNRx%_6zZQQZjp@xi=+M)HwULX=31zs#@`k z8oxg!52U0YS37wA-(wq*F>>PRSGM1Y*ZYhC_ZeC9kFAl3SQ1d0*vkq~y(% zyq%KXDe0P$w^Gt0B|X(!#cZ#<0|N`E11I-M3B5XDl6gnT%w+ss z%~HbB_ZdPd`B-axn38@e>95^j^%axMM=EE>*dir#{wFE2gM&1hbg|4vVTs= zh?G=F%gt#SnUY^paxf)_SelaGQnENDOH%TCN=Bt*66Yu-f23rzPS*I8{F#!!QZhCr z|EA<`6>|FiNl9{&;g^5%F)1lLIr#q1^q(q>OG#pKa9@m)$0nNzDx9cTwunXHl$1|U-$-I=zSF#`_yah&U)LAy!9GGm_ zrA1mKQ_S^K%+i!BOUag$6r^Oi%2%aiwUQMnS*e88@10`Sq-1SM)~93xW9B8V@sz;q zItG}MjVbwPirJKs&0PDZ<2}v>TO48gpQ*t~dCsJ}Y zCFfFdQtea!G)?9CB_n4vTV!f5it{PCz|CJJY>|>A_y4>;9YsmSsV2kCKP5;@C><>P zoGRGLEybEsjiiH{w(M=|sm4)ZM3MU8bl|rhQ%zJQbPLrArRB1;T$h$oX}LTtSES|Y zv=mJTcUP}WOX0L!l@^*}^}$mO9YsQcUfXNXs>8DXx6<)S&5-X&&B-U#pUt zQw{Ilaz-e>J}srwa+Au-q@`?H%BSUqv}{rP7oLS;6X^E%h z?zG&KmPA@^P0O9>;2^;ice~cK{~aN?JuP>rj+fVD>0PQrVwAK| z<$KdoB`@ze%~Vax*V9b3wA`1Lv8r%?zVrbl57KWhdNfiaEf1$6n(6(qb~fcY~K15^3Rwb*HpEH9as$AuUkys@f!ZJuO|*@@`uCrsa*ayqT7_>A=(R zuBy;2E#1@d7FUyg8jkGm@qAH_w7fsv^h!%l)d@berJztc_cwDd{KJ89|P z&s#PuS$=FzJJ|?3o_y=b7o|qqKa?@J`G3zTIEV@~B3Q`U##p z`ZO&Av;*`o`%lSdY56=YV>tC`8Jw0c(lRtH-=_H(Z2Zf#e8t#Me$5Q?Z8wkhnZ8NO z5PGIgf{EGh*ic%2Nz1Qk`GM==RD2jc&n45*`!OAywYy`6`M6n19&A)4{ni z;=f$}eS<)qke2`G?HOjA;&_g0hGF)v8G(x?s?#QEY)@7`MRDpSXDUutoS`^Vah4*# zlg!msyeciL(=t!_e8mNd3l$eBE>>KkxKweO;&R0miYpZ_eH(Fl2YU|F8WpZpT&K8R zaf9MU#Z8Kv6}KoBC~j5UrpOCrJJYf&EsK3w;>&IZNm`ov(#)5=+$Fd*`EsK#`_pnD zE!ni>(sGc~k(P7((w>&XX*rUX6KOfg{h#rCKE7>+ImS`X2o6>qPs_$+{QL|t!w3uZ|^$E^&F?F70Twgw& z74&CIBtiUjmbpxoFZbmNU#876>t`9~-9Y~;UyArr(wA#}x!M=%7xkr>FQ>G6aX%RQ zHEeNqV6B8^PpDZocbzY#d@0R7_;S4#eUR@19aWaX*`}P@WL@&|)bHal-96jf#CU^M~_a)&=C0{E0a;w_Bjhe4|g`&Yga4}xdm&a!tr;~TPFL(Iz z!ffNI8YhVUeC-|YX#b!IwbMp9BY}x_*pv3YJnKsbm6z3? zJf}T;!I$S5Z+$!_Mm3f1nPXn^Q!lQP|6uw|)80mwvwV_N9+6eSLY)mv_|i zJ30_H^sX7SpKUo$rt#TCB%;>)j$;kiNg7+nlAs*UpH z4`0Um{7#eOZ?7t>nr9BrGeP!DoOnQ6Ip_<&C2mzy zye7}0BfcEqlBUfjFyAM}oWXb|Vr?J+s1*T|5ie;pDMvg8p8`KUP?Wn$@ zq+~{}%}Du-+>nv$GEyod_bxQ$GID)JoQ0+|Q%0zNiI>Sp*^C6jg@I$6FEovMc$_;n z)ODfxe4(k3k()DeSB76T<(7=ZGg3Jtw`U~5j%B1$Mvg2DhWyV$vv{GoEhEH=inK ziHvMtWNK&Ram|uHmXSItB(Iy1ddll7Hpt5xW~5P`Usx2}<+)<9X{;8SC{l9s;y~U! zBP~?&B%ds+o!IbxaL zGV)v|xKBhQ#OE{eLPlQ9$j+BM-WThbksgc9%NZemN%gJP-z6h&WTZQ}R(UhS|D!EC7n_BPO;^V1`yRievR1c@^woAxFE%|h(p!~#W#ny! z>k?C`uZOGBP?Rf9B+)jPz%` zWu;tJKBjU;)?{RDMn28RfQMOvUj9=?Mk@a~BkQLI zPb7`V$O*MT{tM$j8a#9KTSk7*$SBoxmYP2@vPqvsViPQ7`jZP;`9G?&Fe8gHGA1Kq zGkig7FdXXq$K|=y+_uz=%gFeQOi;}kiY%R&kx9xY=Ot4zGFACB#p#MYwUwF5XDPDo z?2OFG^SK$Br+mKR0>uZG1`cFetl5XVgCM-1vvo;A$-RnrcRjPzRL;un zS$Qlgb+S^VRN{`Tn5^8b+{?buHD=WR*di74knW|)^YF0?9 zDc+~Z?EP7JK>34tN%gEel;<^+Je-xn%M6u+Tj!+`k7!$uDl%JJ$*s#wT_p_^>t%&E zl$q*hrS7ue=5oWV6l?1-J-^I6k(I{uVOE~aN)sJ*b50+fcEWC&l{HbTnF>i-WaTO4 zZKzN>@pM*NYnJ>Om9$iBm6dmv84B6MAD5X6*CpC!rJZU{UKSjx>7e|1MP{GNN<-JW zUlK25WjPWrs=TA}mlR)Cd_}R7;;V|UDY8muC9h|ti;|)ti^8s1c`GZcIfSfq%S!jG z%u~xfveGjv!?W^JR%*2LdSzuuR)%KfZB9^D`mpm^Ikn6T$jbU<=H0Bkr-Zz(l8*Fz zUh+X!KFsreNm@m#BW*oJuADKd81U$qCdEJ^Zd`O{H6TwyyTxO-&t)_?cc0$?rvmSZkYa4 zCr>>QpOBS_S(%cR>dVdC#@?i?Ox7Z1IqB5Agj2K9wM=4KR@yE%y_TDqw4aqZS^1mR zBr!WH#IKb?C%m37M5z0%hwHfCiLjb!CWRyJp4OI8kOX+c)D zD%q2jZCTmQ^-?;qOC^Jwc{{jCYW(k1$)lwbyLBLYmYYo{;(N2QFDv#6vtP$T2{~&W zRpP&A$;t_}c`_?!vT|1WsjQr4HzZMQMc~!uE6lm9 zT*%7Bten?&yR9&{os1{5@=_>~;>4-i{AONSIkSFNGRm`gNluBC6FV2^i{jW7hTO?X zI476oZ>dBfMK;Y2a8I}*CvA}+xiTmBHt|Rb=j5tf zuw4{UB)K{#Mf1FvlHxfjk(XSPleKE2X zIjNWn_5{|gl#?1O19B;r?x4Y(+@A{~(96l4O33fZiOKW3mE6N2=OtBgQdN01Men4| zDohXLnL@?<}hE)3FX{sh@Ert zdQN&G!P8A$a`FZ{Q!Y_@m3dP;(^YX~yTCu)bJ8OxpXB6I>gS|aPTpf_PPp{m&Pnf_ z^if`Im3b#8@8)D)Q;!~gz_t43go}j>{L<$XB_F8Sk8<*%l75P8;>lH}zw(dsk}j*v zfSe4>$xk`?IVXd3?4PrtoP4Hy@Ty?Fe36qcb22<9bPJtNx6nCX<%IZkPQFnxL~*Dh z<=^JyyFCA1$qzaCF)taWWb`Vta8)o7BXTk_C%@-pR8D@$$$s@b<-h7gbLxM~PYNfO z`_&(sr5cO=%E{kc?}Ez(|Kwy$PPSXvVPR}e{>{l`3sWromy>ZEf`zXvjL*r0oE*=| ziJVN#$t3OxN8`(=sXm#NliBP>dvA))>C~J|%gOYd%*aW0m0_C6^}gENt%+m~=Q<}# za>6rm^K{>spOXb#_^VC3)rQ*$@6jyGi8ZRyo2$*DoGi`>$)~FgpKe~NwSHP{Sa*3Y zIJdbXCo6NZDkrNs3XVM&oDyG?lZ_m&^0hfx#|^D~Vtr2jTWvNd@;NW^j(>Pv=6aiR zvLz=4IoX;Mf3^AS-{9G?Wvk6Lt-f!yVRk2%WKIs|?(x01hdW_TimwSu_iro?PLg!{8sq1r{Th?XNt#oz#=O18 ze5vWS{@#`~CPP!qo{U=-F5MFm3uDg4Z4123df8e73pcGb)z=2sy&Vf-Z75>FwGguq zweY{g7^mZW*0_*`%Pd@Op_iVEcqk=TSa|zfoP8TqFVSVKxynKj8njTs!qpavS}0}V zdJDxY6t{4#1)kF=p*BaZH6<-vqkOJ}cd@Q8&+EquDp)UZ&~ zLM;mqTNt@6c!--wS5IGOHm(btS=&PUZXVALJ!T>Ofybgc>Z{|bT;DrFG24DanVTyGBd_MX?G78ai3q+6hT zU2l)_XDqa|Fm%0nrMK62eQ-R*T7uN@uvM)s`Nf*Y?2J#{zE|g-jb`UNUOx*TSr}+xkcIwq??&^ng-4!*&Ugza>`i7A7vLsy(L7zy{9%gp@mq%to~? ztGhNTJenB0$;4Dr$VS;OJSG-hZsQ6&Xy{5Ce3#B`d}YTb!)y^7SKHv5Qm(U6RE-z2 zQJj|RB>3Ky5-Pbyan~j@v7=W~IUBuJ$-Kc{DI3?@C~c$dg?L#TTYUQ<) zHz;xxETZuICR4%2%{Cse@t}=cY{YGNHtw{Muu&%!uV|x^l3Q)uri8U9zhbkgtnJ=m z<93c{vteSdDr`19Tv2_qxyy#JaW|d6Ie1?X(>*rswNb^!YbxREcRt!|hHo}iZ4j#| z-e==}C6usAbsG=asBPmh8#Tx~dXH)!9=1`_My9rt%ik!p2iJUb6ABji*^^qqU7T+J}}lTG`;cEZ9)XEvDyLo4l=!b~awL|My*@ zy^YVenCERgYomjW=WOuaN{=nUM+OP;1yvxS8nL5R{Bw(W#YQI^D|>lQX6#q#MjNkd zQH8gI{hufCI@{n5Pr_4nU2MFerQ|G~zs0;|W2%j5HoDp9&fePSY2zCkLu~Z2gWdIG zhM$eMZS=N-?+krxyl>+J8}Hb7S0#NF-?OoLi=hHj&9g!J(8m5P<|7;ZRDlwnhoPju z4L%Cd_zREEuzYG`kd4n6wm?$4=<69el+4$SWcQ(Ga@vDvBIIiC+{h;`hjUSZ^qub|tln>YJLj~q% z8zWRmKGMc745|XdQp&0MyQ*|lpvb*9m(@MqrOKQ_jw@2$V`GMmne_kW_$(W9Y|OPWTeAth zyfBZhE--bU_7>T}?mb^|fsKWlDB;6FEM0743B6iimfBcmV>u(Oz^vkm-f9*W@X0%@ zw6VRwqzX*&t>)paro~pX*2X#;=WLv}v7YVrtXx35?gI-qd^-xY@Fs0hIrp@H9I++t-(~1@8ZO52&`0o&porjVL2bcff}(_dXTwwW5r9~K-M?k(D8Y6*61 zGmof+N41GFHzqD@Gj#-Y1srcLK|MizK|2Y)OEeHP6g(w(n#8pl2^w>l+s)&GCj{>` z|KIhEtG1ga^o)R)AesrD6x7^qnrpUX*#xf!wBXoJ23KZy_2AQ&y=TRpr&(jlS5AEvAQD&T22jPHMGMF77+P+|JBjKZvVC58^Mo)VcMl3 zjCLihkHv=yz7>#sr}(`hJ4^{XL&E23htnH^5rUrt%y!bZUyc;~A{ec9epMXB_1G*J z!f%4#Rnq)9kJ&%+@(&varTn7%w|Za#-N>szf-!=zf`0|C-j^8hc;e0-!9C6Y7<)U+ zIK}ab%<@O#B*A3C47JbBOwle)*X&f~(-gVVnW!*Ri)N{CHe+UoVVa|arSk;~1nYqH zz(Tk_*Jy9HHmPVC|K#RwVY?bYl)!JHlDhKCaS1;hgazLtUH5cf>M5!K}G+N`U0R5>di zQ^Hs7oDBXY7w*|<*w*Rb9sd|rG;ye|cUHiUq}WbVYNt8J;M`%D&I>LmKc(4JaMB+x z5Ci<+q!0KP0#%i;T>Qr4r=S`l^Lj(8?n^Kp4RW8wL1tG6Jl1 zgNy&2aI@Nc61WB6>nxxC%u4{vb{gJDW#ZR~TY=kvia;gcL7+NNS=H`Q zyj_vC?f|?zzZ1AC&yAA1flWIN)tK&8NfpJaiq#bFQ@kH|K*=%He+Z}nJg$<573(P0 zRIH^)n~x}Y6sVn-Jf@_}XI|aBq#jUTd4s&9A8&O+_KAb z0GPC0^y+4dVsCK=R2h z^E$vo^@D*gfG)rrz?(o<;4`}2PVnmiJNy=cuL|9O?m!QKk74!%dMV-d`!>)U_=rvK zGJO=^SA0kDUB$kNRCo`VyUUO;eW1b*fqqK1sIb5Cj}<>rq~@ne1}F{$1}QnM`k!mx z*gf{v-EF=Eh63LLQ%kE@5B^z_)NS4c%=9ed^J-J$0X12~6E>)&RNP!ILSg zfGy|ZtASO!&B5JfEx^YsO700Bo!9_u1geHmErdMe71##s z1@_UgKb!5`D?agd0=zJ_L$NF07pg)Y2;2?q0Z6<(!QssPoW7owj{?WIHusnVz(L>; za9FdH98uC@k9lQ}VfHw1LPMoc2qziy+_5$VG$_dcd?((xVu|yrvu%&DLa;-4d9V3ouaQvj@emFLmj(EK zyif>EC}`;Ny}|49ZrE$?+iN0P8dY=^sT@<%cyI8-_OcKz4+U$G>534pR9-kQxhjMr z%CA-|nwRta_9a5NCWPxk!4Cm`)2R4F;^)1lq-L)T1>Zd=FBQV|Axzk7_}$==uuKSL zL&4TmE`$mp@RPB;W^YiW{KgP&QofX(|Gv`AA>0x|JcL9D6+@^L!mXj;JG1Ny4k6qY z!rr}x>G)n#IfUCoxGMysoxCFiFN8alm)d6zS5A2QOx=B^%|3H?2=|0=ZwOWBu6<_k zKJ&*uGiRUKzRz6PXRg>ExaGbO?hoN{Ix2(*Lc!KrJ%ooizenQ_hOqL9#7+B6jSwCV zp*COduL?Co_@YekJD1gKh46@u?oqa~-!QeL+3W08{uUQhNOY(*x zG|CHE+Bk$JA#@4hjS!lK&@6=ZAv_yG^AMg4VN@%xB}-{Pgr`H`xd?tYcq)W}`wjUs zD*0u9a51@62(3dnT{3t^bDa_2s|FsO|g3jg$|e=id1+zgx(?a3E>^pXAvcoGqDQsUCs7YG-VSX z=yVU{+)3g??hm6)zYsnOp?@g&c=}k8?mWS=4>7Y>*M zT#S3;2Njnbh?7qq?wNz;NC-z68-IJpIEwoc7nL7ZJfV1!F|Xvb;u*!WT-R$1Yn=<> zJa@J~Jn{=6?Eg6+w3Ae8DaEv+ub5HHD&`a|CurAJ6h&Hg9E2Sdc5s!0h!fl~i8(=Z zMHNY0hqpWe5Azikg;e1(#mg11aB!s(R^;17ia5M93cj7@*ZM*S@{9Mce94T1#}5X- zj!QVW#zB1t4IGqoaIFLW{J7J>bq-27sOX@Q!)rdlhEvW#c?YGP;I|t$hcXVzD(4SC zN?tr@Zg6mug9=>%!7)zjVqByMr=<3Tg1jhAq6tApF9yd}Qz zVDO`c%F_-SnyT#J4hJ7J4z8`;o^OsPm)PiC4h)Cppr(Vn9o*yKJ_q+ZxYq$St2)8& zP1dTSSrS&M#-8wAp@>OACN^)nt*4JBs}np&z*+reW>9#MSM z;kN>driOR;-&vqK4(d9=K1N|Z)uBQ|2aO!G;kf8w2TwS7%E8kP8ars>poOYke#kWC z@XIBdJ7|_4AUi|JlMZe^WJoRzoWprWtI&<)EmgUdVrv~Eo8}POIcQH;xE4FZ^DPuU z>+t$dqJx9y9Mm{un4VX{qK*z;a!@&p+rxO-!7C2VIXLg2lY>_s{N>C$xb}-PvAO}1$^ofH{ zwQ2GJDq%N1bMUzX#>^KED7;i_u!ErPA=9Y2_oaj3r4wH%vUG@pp$v?1D`tU_8NXA?|Q zRYJ?;#2F4|I+&%|OH(sjIZNj_n49PGl+0IL;9y~1zR1DiJZBTj94vRRlB=7mN&8S= zPa1OySW0iNcCgmLItOdGE}DC<>A>06dI!HAG8@&@1_%8@iSL_xS?%){2L%p}J2=7p zKi}3t2iq9-&AjdEt{uvm-Kk`kgWY+_9wmDf_bKjIJfO%{4sjE3aD+}cWR9u*qsp0O z$LKnCo_La*o`w_S>XZ@&(itUZ^YO+jAr~B6bWkje;$b8m@Kjscfv;*QC%Edx>KQie zpimf>g^_b$g%J)T5{4aygo8oR54_?N3d0EpULqkfF+_=6Q_*lReKh5UgO$Y?i-m(= zW|t_uTzOHoa77qbhJ%Ydg~KSKa;jaWgd4@xc?lKR3T@JOi7?8CaYGo_gi$h#Ys0~Y z$y8d&bzzjsORiV)QInucWx^<{*>d^Pc}=_;sj;s1U}@Vcrf%BouE6qXo}p zNg}RUl2={p);zy0jEc(HB^Ggj9Qz$%cwtNrV@4QvhH+OI&xX+<3=_uPVblwwei-+J zac>w8hfy<(Dq&O&qk0$*g;7nd-N!M8!Nak%$v$s6WF83P!7xZD;c4E%O})92V75k> zw@wnwUN~fG(I&?tiP~YF*$DWfikF?V$sY@&PB@6zqK6Gr-7tu^A2tobXcz`B;IpAd zVLZ;6;*i65A{<=Lr?5#Fjg`0152L1GG^44*LDV%@!i#&%J{88(VYCUOtqPwBqh%Pa zbh21VJFUYw7`1q)o4mbBu0LV73kO#enc6GiMZD+2cs`8J!x$XK3t_w%Mjr-77#+jl z5yWm`bPwYteguT^XsHAbNxl+BCn~QpEPYjVB2B&5!syIcZR)+Q*hTRTMGD^xqpR|_ z@)FkV5e{x`^bDhyS|(>=6HITbq_-j+mDbCZ?}pJgjQ1Et>d6mT@v!+I3?_P&iP?Ua z0xt~C4paXyzBz0@4&xIgpDI!^AdG=|J}8XO@|+#`B8)E?{9%j^fR)fD$A&mB} zHBz%f!WbIHx8dM2H4nair#>hDp0Ux``$3W9$1sNF`S37)%JZMY7?J0k@n6(Va0FD1 zk3DRDS29YGI|HZh&oKVdn3>AC2qpdwzuLnk zVJr<}f%1i6EDB?B82b(zrc1F$vWzkBTFb*=l=8|p``r74O=Lr>!dM%|I<3B1N3=$f zYU{(;5XMd|vW}RI+T~LSe>#_Wi;K(%3+q0Ehv;)VvhcguQV*80OPI9j}5|o|_ z<8;2=GfK`Xo(to=k_-9Li(zoaS%oPTMmh|B;_#4g@ae|QpF4a6;Rviqu*cdFNaTNG zhe{|6DWOA{_-GF$kqDv@xDj02+~c~AMZon=IXRL1@(8Yoph5&UM{s2Xg(J8wf>IG& z6+w{*N~*!DBf-`*wp5~c1VtktDW=%wh~Yg%W=lkHjY`NVq2+5MpnEx+*GGb=D;q(% zNbr$STCt2G<g8K!xL=calQUsMF!Q$dAjfxR`bHv=L z+1nJk-*Tn1l=`JdDqL*Tl5D1sW1U;#d?NK!L`T6z8mN0;Zdl`ul;XzOD%JnBc# zAcCV29E+e~1dSs2ZFBrU1pId=k4J)wW4}l6L@Po4RS;$ z;!j4XcYn9KuFFX-K`_|dt02@i8T}LBEgUS zXCvqkL3_^o@p#1}aUy@zKNrCZ5xf||^AYf^hLjvQVt6@%FXv1aOZZ33%PM~@g3b}} z;=n5r@KuVPBH-`JS0jv7i`myB=n}zO5p>gjzM=SL1pKMa7d&>=EW5;)WOi51%MLvv zn5eHvG^Ya@u3lX8^L!Br^9ikAC-I`!Cyzs4-v4+hGX$z z`O@J^_)Glf2u5&6Er|Es8Xu|Feu?1MNN{E2H_pPLIPJ5y#8DCaK|6M0G$%2Fe{n%ygItWdHV-Qv zQ5XQQl_Voz zEh;eijBpiZ6tjvsMP7cPf<%ER3Po{Q6rm`bC^j53v1qV|gcV)Ih+U*v4JEflQBfuINsHs=_9*U%qPi-x)QjS-D2!(BjN;Yf=Dp+Q?kMh2 z$$g6VMp0Esl_2dR<3R@^{JsvdrOcX7ncs`03RM?6gQ^KOwO4>w0vqz7ccA9OUFMT$O z4$7a)OLE7}i+TR4l8#Zll$X35#Vg7?6=d#fMS!isJ2P@Kxu%D0(Y-N0E{~N_c1CT_uysCi+G}yz_*4 zUnSfRsn#!wkD~ZkB}er40)_oG+wg?>M9HU$ln+ocFdE#!VfOPV21l_siha>wzx_h- zPu>Mk@)i3Z#Wzt5iDGyZKSeQA<<$Hkif@&F7sdBc@DMnK9Zv*r9sg0~!xVX(o^Lh( zIf@ZnGEw{<#YpZRPU2TB{Y5#eTzb_x50H;i`KrsTpF@d1l#f=VPM;IzuPFYG;-4tS zM6oD}#Zipa(g{&ajN)JA|3xvQYGR!7@f=#!paZNviDAH^C}u`6B?{V~raDuV2b~Nh zrbmNw>{On2nKesG=S71j0(hW(b`*1>pc>O$B{V)?OBY13PzfvY^gFXlqF5TmrYJT? zu`G(^YHD2+E0nBOT&cK9krltKnpl(PYZ)-=$@TQx39~`v8>3*NCM8>xk6o{r)Sw?4iU?p*K^Fygr=&NIN?_sB13 zEk46Vo{A#P{oKW6Zg7OdkHT_cyU0Y5<$~h-KiTsW!JFRs@>n91xQMDUj}3)fILi6< zyl|dSC*p#yZ6R@0ND@=BhboYw7 zD3&iR?xKY9YZOZ=UYjo+kq$b^=Z{Le!2?$0mzH&d2i7R$BUi*5nRStHajT08 zs&k7XpSZc%#YG);TqQ#;*zCq_$}1}N8)k9HG*Zb0Ur0!DhYQceLow8d;Z7HK(Rd6M zVlXc5cJZT&VJ_}*aj%PZE`Pbj`sqMFO=;pleK)N*k@U2)PpHQbDO2{8sdCD6JZ0WHWtzHZ=3>YxGv<_8 za>}r@g^QNoJn+bUG(8y7FQcu_5ManaGmOD;OOc-6(rDttxpk<+HtX+tAjPn*{`BPx8| z#cd5eO4vFZD&NQ(c-p+-;!PJ_U9k1H=nW-QW8KpYJ=*#8v}s%4>*?ZM7kypya`86x zPn+H@`nY(<#o`8DhXx+2&?alGukXF*;(Zq%x#;iW0~a6ai2AvhdD_Gp1)AG*)W0|M zK6Y{LwE4uv%6dWF%g>k!XUqd<%s@`T8N*}eLtG4Eth)Hz#bE8**Dk)$Qday@$3=s$ zo-tqP=xF~NZHU$ToiRgQeCr0s*S~Y|J)POmV|a`>V`iQ)KTz$ADL7+>yZFh)Q5VNt z{On?ci#aalx~SRE8|h-Si$57En*G(qZ#tIW)dPRH7^T?@X99oHOIMyXf4TVE#RL}< zUHs!>jEjF={HN9F8LExdD)eoM`rbGVkMS-z@SD#DMjkwCCb^ib@|kR|zBk3iG#%zt z20;D5d&KE#kn=c0i|GGZTxcq!k>+OuPtJ2O-$j9otu7Y0SmtOugE}}c-F9QB%5@a zwzx>^h&FR_&zk*b`47rXrE_K*r^CfQ7yDi8(4Opav75VAeQ&3R0eiAX=Xb9PbM?Gg z>MOQ>zy*ES>YO>GBR%Nik#mOAblAlahVD5t_#FRlHUA5Fy&A(6v0#=@x=6Z6 zxj5zGG-qv>IiuUcc^79HfiAc?uoV&_f9MV2#o(u8B! zbVkjF!xfmEokJApXOSDu;E5+7|l(*O#oWW?T*>*9skKtK*K41D$49_Wl zJ}-G8h8Od^qmqyH=*Y`4{Cz&Svh->!_^tP53|(X3Bmb|(&{+xj>q@#PzM(kfym>2z zZZUil!;l!d$Iv5&cVc)qhMqC3K5yQR;m~=*)GNkgbEfo#fcK7}PhS4l2VUP8-iu*i z41+iqjF#?RzZgD>;REGWE|?FMP_uswAIIbS0d=Fr` zhVNqdK8BxT7(sr){1C&BF$_~{Y?Ri9tEu-dnxA4|yH8#;uUs@EWB4V8Q8E0%>KDzg zG5i+8?>bo8XT@ zN%LsZJef5AF;tR)8~OPBgc!Oc%_R0p`#{S)S2;O`DKSiqVL;OSo(zV@?vc;nw#LpB z!l*)+6~k;+DTE4zFeiq&F`SR#LJad_m>eLgl2rI9NDvS(03s+DK@`k6 zW5Nt77*G@wqJS9;)Li}6V@KINe<#^=TOLWR2(oBv+KK^h)yMm+C$$ZI`Y;mcxtrLB7vzb(es zO4#}h7jj3l?Y%?&&)0?q?9-;-i}8b!{l)lE$xp@jS;+y#gNoEYM4y}rAKUw-Ao;Zz zzbQXCp(W)kfAFLfS`QcFi1NP_-3u#H;oo8$2( z{_fBrNv)FD7qv7au(WC`rWGAUSJ6}S6)WE#T2i9ChGNYKBBTF*must}P6Tz8)Kjdl z$X*SUTy>(TaRf~wD34%_N}5K{EQ03BGm6;=a!S}MA3>nJv><7Ju!yfZw2Yu<1ie() zO0k_{nW8ARj-ZW_wu&6>oTkm&EAJ3NM*oj4UG}7^#v` zilY?=tPGpRMldddxe;6&!T1O!L~vmQ7pcO;2+mbJKVv^TD>fS%OkkBpm|9Imnxs4_(-eJ+Np)sDnLI!p2D2xcq!pW>^_!$W$F@;QpE9y?k#FM|0I+**(~CzE*5q8o{y%mPc@d3RgvNV?qDs2yQCyKfVn!$qKEmWS7d#)|@E4MXRd|I@K#x zSQEk82yRo!2F2SWSjTgu{4T{i6z^2zm{T`}TXuH@_e5~73YTnZ?i>pPX`@!}D`;+t zVEeAn^P3~s!tjftYZMPg@K6N5NAO1k4@dAw1Un)SW zQapV_IP9|#ycEI9DtRt~=asym_@d&{?V;LM<*!HZhLTqzcvT6TUW?$v@uAMP2;Pj~ zy$IgdrneN|iQw&mW~U!Rf4-~LiMLnSUXXtf!4Bo$A1K=WO@$8&@{g1>tkC@92tHAM zK=IQEzE|>D1iK^nT>00E9RG_5_C)ZdR=_Hgn_Xy zf*-WHzo7GD1V1T%@Uc=VupErwkV<}5{6+CsMYjGH!GS?xzWph_`9HaT**I*|3+}MAU~#L>i!BR3X+o%oQmKyGk+8nqG5PfjB??j&*?7WegB4z zt*lKX5hYa=t14DgtR6+N66y@QH(YNtidaEnL=jh>P@K~xJey_|Rum1QXc&d9@^lm> zQ8lAcqDybDk?Sf>RUa#wFwO$nUm3*wiMo~15qAUuDqDeu& zSrkp9$V8DXNb*tS3jC={!%2fEN>ws%TewZl3#~1bw2Y#ak}sEpr;MewRy#z|rl8qY zNxLZ8EBS0$=z)%f)=o+~NAY3faJp_$bdTcRZrIQbJ)-Ct#o`>6-H&J{W#gHh5MzJc2TcQ{i#qcO@ zjN+y!Mno|(iYueIDvIXAf>BY7RnqKO*=UZVe2n7YV`Wqr7sdD}CPXnYip!$7Jc=`- zI5Ud#qnH%MS*m%SB9+fpa*pD;QCy%S%vZdipmT|m3l%R?oE*i)h1T0u`BJS;QGD`P z*>)99E$B>(VtN!av^rDq3dKKFt@wD^EE+aEpgq?`FUq_ZrJVu_OL6)9h;WLXr;3z8d@-2Gh9%}Q1l zr9-VeUiQH8vei-C%1DUf*(laTu{MfLQQRNJZBg7F#a&U{9mV|fOV>qlM-+RHm#vTD zwc}+h6yB+lzmJ#sC(7<&@KE`((&E*@hA1{Nv9AuETTxniqOA9cvirDwC(2l^JW=*Q z6q}=XEQ-gY*uvx=#iLQYyDE4niUGF-Po5}yM9IUn;Y8Vg65{(O%6>Rec2Wm;#Dqr zRdC74vV|whwnnl3WZ6?E%U+A(^(bnbD%%#t8&PaOSyu5>8S#gcAyVGzRN326yrXX1 zL4z6Fr^?D`n3DGtFJu?puf?azxMd&Efl7!wqu3S2XH0Zad>q9mQG6Q3;ZtQ7pI>^{ zt-L z_;Im^i^QlP|3-0?$GL(usUY1d2+1)X6D233IK|u;LxUJjGtw?8jm2QZP!vOj7}~kP zmj^NxV@UlGAcjgYRF3hX@f=IDez_{js}>~HlvGzNjv-QzM`M_>w1{2eF(hK(fOR<3 z!AvrSnlT*e5~N}I6ueY#;|NgNcX&$+Y!SnF-(l%j2NzqVNncc z#&A{)m&I^-3};iPqD+e6f*8(;@i!mjT)LVYR8h{4Vb12<|DMk+dL{S!fy@IH<-!;) ziQ&>1F5<8ig=KOK7Z>>P7jx7<@J4P*4EKMPOMjUAtfEZirf{4X=5p{DX2dXy!4SjD z7_QLqIXi!%`$`Jm%=rlURWa=NC`S^`&aI5$niz)c3^#SXir=%yG*YVXOl*^*ls!zx<)dTvdOuXf5UF;HQ33~b`Ox9UQuOe5E-+HH!p z&MsmX&b2Ov^)bX~|LeIsl-wD^%1?5uH|Oq&;ocY?iQ&;0l9hy#4Ll$_avNi~Psd;P zSePEq)n@)vX!kH_#t3{S@R5~VyH!!t2FRp`6z zy&MgDHU@6rb1|&hk|SYxUhUlac<#j*UeX1=97DI|rBvWbYi-HB8pCTGoDPZM^%&lW zVQ&my$FMDiH)HrPhL2)+E5`RFat2g z+*C=PaD!I4;Jr$+GlpF;d=bN*7(R~S6I$p6yJPq?#=kxb%V$g-l|#}%@$-WGV9(Mo znXkkE!dnF?Y!5yMIPr?MR3>8>J2)quZZ_&bJw zl>f^FUPa2Pgk~JAEXQ~rtAqv|kKtM+r&O(?!G~-^ozpQsdn`pp=-vv7&r}h5=Eo{h z*+3Novkm;uKve_P3=A|d$Ut=i#RhsCShFyQ7>F9k8OR%9wvQR8VW6e~!$90X!a&kM z%7AHLogMr-G+4ATXxcev8Q?W#jT;bc<&Gk&t^rTEUy!5?loa?~Mo`N@Z37JrG%`@f zKwVCEZMK1dZ1mhe1#dME`1=&oYX#{u zgQuJ4Zkdv~YItZKuSbD_QUe_fbmXK4nj2_sppAhR23i_uWuVLmF9#fi$nGrd+XP~S zDUO4Xw>8ktKzjommW9Kz{70DTI~nL~pqqj2s=yh$(Cu_-RpC(6ngvA{mi92v(?Bl+ z{M9MS|Js@3_ui8$lyYfHy99kWz8l`z_N58vd)dJTh8UP^;9>(q z4Gc4Irh&5z3^y>sz&NIK10xNLqHuUH#=vO0rK*%uQdK%t72Xn4erZ)1Yv8)7az|Am zPB8fRpK#uvs>(#=te&CdgQ{}2fpZL8$SpX(v_dsG*T8uO&Ntv!lNQxv5}j5}D8InK zxz%KLHCdz811m}|GWe*8yj@K$F>omzJ}kJ(z!W7@4NNm|nHqVyTJoP^(+$ipa3$AO zJ+x;gL!!D|Vc^?pQbi?gs>@_0Y@MY;9qn9twSj94+-Bf*ZkB<$238nYY2aD|^9)>X zV5x!myxtwmEHJQ8Qq8 z6C9{6%MB23P^?reH}OyuON(N;*+AoA0r@I!y@8$Y6!DJn)=K%+244Zr-)dmukW!L0 zT3!2}uu{Hvv8*$&p1WD0^d5uRFF(9k?l5pC9sW?jd#d{nWbQI>w*eBC)cT@(4Qw#5 z(ZGEMHXGPtV3UE5(gAPG9-x|XR-2cElF7yLpn-=BJY(Ql1B~H^c}$$(2?LL4mHbfy zkE!r+MM{onL3el_r$fj10nGw`N?w+wu0;4=en8+eC_i*Xf^1I1D~BJUb_ z&)_%S@;;AeM0!Ppe7i~xk0|}Xz=z!Hh!0)4;9*=Qy7f_}YlLv5Ns( zLdkvu#OYBvVBnyEpAGz?Y3-28?~4kv-%{;MeHQZH4gA4ju`lh zsV|Otar|xY^OXE!;9ni>lu>%rz%fSGflN9k#|@ld_{H(d8M%`h+wnLO@i53w891$y zqBttVQBj4(iu~aoDpZQ2vXUxsR8vw_aaUBr)`OYq9JatCaYVH>rpQ)9$>ZrPlUOp2 zR2*iUKa!js`fKKuOS4uS#F98{CFD*VZh?DBe8n`)I2?9isT`AVZj!YccIC62Uj$=SV z@^J)ljEG}o9HntIi=#sv9pk*$mF96soELOy5y$N@X{q>JOj^ZJrV1a%gmNmhj-!og zwvD5mHnrDk&XAKaaSh@2b&8{F9Nkz9=^RHF-BZfP7{a-_Yp?!s^ia}Mk@8+jdMox( z?5o%>&a@eJWEl|0z&Hk}{5nGhD;c7Ary)b*7#3&Vkl~6X&lxf*j?r;k5yzErl*ch9 zj!AJ`5Xaa!{=0IW5y!X!A0Nkr0-va4ry*x5IV+B{<2a|#dTyMdD;(iGl~j$(`ATZW z>m$1PEkHBj?0u>9tQ`Ze5zK@ip%uS`7$F8+AvdvY`r2b zSH&?aj+<06JC6Uwu{e$;TD>}sxp7>p{2IkMip%4|q2|T$Xu_-R|<9JP{#EM;T^utc&B`I5sdy60$yyyERtt(CVFvcPX-Uc0%rn<7Op{=Z!3J{up5C zmN@RyUYp{0AtCoGe;|%86SA3!B_ULf4G$iSjYjILPVZcrlK>aeN)eOFV{gd=|&J(%V9v7ggF2Qpv8k$)iAL(X%$ zxs?2?IATsfLR_*b_=cgiDfpiAD*29TDPbv33FZ5E_T$(e$B&G5l@NbYz91#!hvN8| znKOY{0>3a47~~05OW?OSevhL{0>+BcKNtonshq$~ru-Sl;W&=O@mCzj<2Vt=lPTGr zlD}2wpE&-F<7gbmwCbAjV@lYU<#a0i9_eHpMF~_$pwyI8%yOojR_tTSS>!3Hm_WnJ zN?DLVr37Y~VJ}u6Sry!G%2uik5B8eUe^Ti`rc_Tb@)5VBsU?v_cqd6>P?A6@0W*QF zR;ZsyV2mYKSdvVD_{7vwD}fs=`P33G0XqRFfv;~abrWbYwe)36$TwNy(;=2rvZa>OP~*D92T@spacDoKsQzHm_TQhpY7&4B{0yIm#thEPSG#?lI^)3 zLH9)Xo!d3G^hn@*TPpD@3tM_7&?|w}wvhKugpx;X>8s=POQ3&(7cUH?{}VVnfk7%C zoj|#g!3hjeGE{Mx;&8sf-m!&cTms_@d_n>fm7k$_ zrs5lSmQw8;9pvJ|$mb@QwL(9fuQ*BZ0>ujzFH)q!WF@~QTKTW!8+9q2lE7sNEJ|Q; z0+%N+HNjt?#ry=OB``gKD-*a%9kn3{W+ZTIVRoh>$rTCgwuOXuQ1s-iM0k@hTk(I2 zS1VF@O#*Y2&sDruan6@TY?j?KXv32aMXPl8t{ys6{wOkh_6ZzaIw%;EBYpZZxa~h$|YL9OW=E^0_E4avR{40>3&qQ&Xu1MIFP`> z1P-a>mjvHZ3^(g%CHzc8&cYv;`#pg_7+^^(OY$;}!wD=*;<_Y`B=A=PClWZBz~71R z!x}^V-$eK|<39;(cjZ@Cj`BokFtG|%T6V5n&~2mK}i%PQ6Y)8NwiC% zVlw<4&n8JUO`=i~m6NcNu#>2g#6(Y6VoItiR!gF~lHx*ZB#EfIcct0Ym- zNhXm}ZWbi`cHK$BP2x&V>L$al);-0NBzz@lMauvC^1Mb8HC0kev38-gj*>6z9LK4b zM138wfg&XhlW3&8aY1sECmHS1JTx-L@v~aZC6QMWC{kXkq?uy0Yf%f;XP1^qv{GJH zkcg7jift5gPOg0t9g^s&-5>O%W0IdP!|6ID!75AVB)SxM*Ce_Xcy}c|lHqqvRO^*Q z?hew*U$1^GH9U41F{<<2DTPU1#i4)iL$D+%HyzD(~Deowd|iH%7- zki_OB?n`2mw!Z2MmG5U!8>q%ETjn#5~KyspdnSe4(P zGt=^Z65EnED=lv-zNPrKB8BfLc~|khBxa_CLau9j5<7H_9~4&lp^}f1*jbS5N@9a5 zf0D!tY57zqrD30OMFswO5?>Vfo+Q3hzFY18I*D(RIF`imBz{fvQwF|E;(HyuLW%5C z&7XBS^!X1;_9yY9lAj9l14$fIen`C{*;ezA{ z(?UtuR_mSSy1R_iFKt5{F5zGBZB(kO+- zDYQ$WeF{x^vqx-LllRmFsvXSuEeMru7Z9TokDpE7jer{7?Z-- z6wXWG{1nD<$u*^aO&PDd$?+#BVXuk0z%x=fQ^{G1XDgngc6%hDHqWYCOUh~q$*5vJU!DJ~ zJijc(rw8+cYRQc$+?2wtDXgIaR}Wag}TxooDxJ z>*e3CCHp9;#ZT^7$JP{{NMU^nccgG{3L8?mGljdjQ?=!u6z)#Jsx2%%YD=!Rd^I{W zW_oSen8JN2JetB|DQu!|Ys>c9a(@aB)E4pwQaD&!ST?7yMfrmT$wNvWR(wQlrW(6& zoUmhUc`}8kQg|+f=Tmq(g=bQDRu@9ctJDdXMyypwq>j9h!iy=ql)~+GB=k%jxuA~B ztt0f<6LsX36kbi?(-b~S;k6WAPvM;u-c8|+6yB>NZ>8{d3foe6Glg&J$gw&?jMtS0 zb)`#P8BDuo(?=f$ENUG3cssw52f&P z3cqmq^~4;VUoa;BtMWY@b8P;K(fL18_>(!dz8p#6u#QP%x|D}bK2lF^)b0L<0nb!y zq7lPBg<~lgCgLWJbBYuyo2X*qWD2KJ{DpkL#OV}@%y0=6*rmR7tuGVm3uA_RG^4&$ zGI4!<*;-$YkIHk34fUm}8M?8$iDD(y6zSnT^(A5=#;O;_f7Ha``cm9L>NSuK4J2VA zX~Hw%n@E{3O*kgHRVuYi*gEgz1~R;X&;TOO5l@P1VqOEey@8}nl$fYzqP~e5CTg0f zYogkpxmqS_E2(4R`3AD9f&A7$sy7Txt=CZ6H53YmHI&H>WnM#Rz|k7YnugNYL=zKT zIlBq|6M~G1Rwl|!WKHBueh-FbCLV1lc@u#WE}2!DN^EYTg$i4mc((D5*wa zEM*#rm}qUHgNcqN+L&l-qH`l@uh>p;dLyBvT#+$wQzPj_xrr{?%JCm)B(H1Xjb(Qe zJxmNX@%Z?BPZM7@l0GK-n&@TXNF#|hmfj{BG#1MHndom~5KAo?Km!`fKojRTmZ6Qq zwbMv)HqCA|N9CI}ku9V0eVfQdCMKJ>*u)i0yH5ET2>r7P42wT^iVcvecLB3fgjPtuVript@^veicbT4DO zJbz9`HYnkw46WH2*<|8=6OS>jOgvy>vx$co01QGNVJ0XO59-0ZB_j`I^AYaiESp{H1VN{k4(H};%yV} znRs94eaFPHth{UD+pI8YFs{s;Y&WsP#0MHG%(pyEEpuUJpj&uUcWRJ-V&YTAgNcvn zkOP^%hjL6leRJ{|gEki$cC8|f|AH}K;u}uEV@Lxsve(4dCcfg<+#c@x2*d=o{pvQ$D;Jj>^lACVn#Uvx#3!9MB~&(;iep+sF@T$nnDT ztBK!C{K-VB$C=%^7r&eML(dd*BcqEq9!KbK6EpH5r!$x3 z)A<%&vT%aQ-^54@qb!_a@@KlU(A+|ig$fod3$}$OOksQsLz!a=Nnnz)D0{&w7`ogCA{~jHzvP2kcWdXTAEtn)hcfxu#mBk z<=}zj6laXflkW+n)WWeqnv{l@S6Z7al@=CSTIg+|kA+qi$}DuW(8&U=5(}*@w6Vae zPv=r;Yk|GmS!i!zjE>O3!qie>SzaoytPMyyTj*k;hsA%{z`v4!r{K@>e0L??6lpdu zqZ>=*)zUDT^s?|nX_)sY>1&~%g(0-Rp7ggcz``I49GMX~kbBxJ%#(~g8aCJp@4MV) z(xRCRwJ^-Wa0~sL38!GP9if~P?L03(+CsU7n=P!M%@)R5xSTdy7-wO;g-I4J;7Tn_ zv~aeCb1a-;;Y}X-8 z#Xl;A!dcppE1lt!PyKsmGIiPwLDLqYb?yMFqaE#9^N_7!fP$evoPPn zwB~ZX;sV8miWFX_WRZo%N|qGl%V z77ME_++pEP3%9C6ZsUGgSi=piC2Mt!%g5y(XfEq4+!x8OxA1E7@D7JQwkw15bS-&zni!jM00Cn+wS%9@rLPek1Q1>&X!15x+yS@i` zc3Q|27E<-{4_SDaVOdYww2((EJZj-Fjg!Z9n})X##t&na!#-)@DGN_qc!vAfLY}wq ztdi#}EGf>4o-;)e26T6oLCb_+Wg11-dE$%miuj)iyWA1nMU_P&LDOCezy*fLx%4?Dw# zOZdRThk7C?Wb1h?WtWAI)x6J{$1HqmVYia2TgvK|@|lJI2$8Lna3S>1mlnRV@S}zI zTgqPDmv1b5%QRx)YgK!)rLgHc3;TFZEqt$<`&-KQWAeva%6>+2E6KJBKhrV%ezI_Y z2QVuKEnL_t?AV>Hqw~L5_?7vYi?Z;Wh2JgwW#MlNe^|J#l^oGA?`S1|S~yI%w~`&L zgmR|18@&8K7XD?*vT)o2?*Ms!b+DBj<eBi9dc~AHfq?YX~VNIr!0)gv>o0l`C465CM7of#$m|uu9A0>wQRgw zCf}8X0bJY0<6Ip#-9~*I18n|L6%A}Ow9&>!TN{mRG`3M{qnV8+Hu(R>@^-k78EUqa ztc{$FV`ZV8TrZK=JAOV5?C_S-kuc>pw=us#zNL*;Hd-iWcS^XwJf~$g#18L~THD}- zo|%NanMgYu?QL|i(bYyj39ap5qoa*ZHah=@r9w3-voKS2v(eo~UmLtFq$NFU^s>?0 zMo$|w@;nJ`qh=pFjCrn?IzO5DeyUH>U&+-XgKP|@zRf=$V~CBRHpbZ)Z)2E^;p)%P zHb$uOD4X{r`H{*wDfw*@ZdtjFF*e4kml&VC_v3mQ$rEf$v~jK-US7|zai)#4ZJcAH z-I)C25}I@t-F{xUO%=xGxlP+ucz~afTFWFG7udMW#^p9Hw84ou<0UpOvN72Pj~Hja zm~p5FnVhYc+L%&UU9;9Q)yA}fNpvQ?Fgx7yWO7TQ>#d}C{Q zzO`Ium229{?QP|$ zwzAH~dK-t@3Lk;q)mHqqttz*ZyKK~HC->O6SIOPni*_=+om|*XsJVfQZ6|Bm$)oLL zla2drJZR$~8xPoctDS7N@pn7f+b%SFiw&cFI1#aNdwG}#xxMg@zZcxr>Je_-ZLNB? zm&a{9VdJEYQ#PKo@f00m;};uG+jz#t_cr#~c-F>qHa@d4cT4cR9X@NpKNf#r;{_Wp zax3W&8{2K{;7M$pZPGsb>d4$yUIlEt%A9jB^O}vfm5{%#mA|L>enE#*y!~7FfFd73CHc_CN8GITveU-LHa@YjslDvtr0s>|Q>~Iy;fwZi zq`mNOsk?1_ZsQ9&ymoevjjw2Pt?ZXPR6kQckzA8hQm z@gq+elWK?1X1cU-hwzEz`fG{~*yzzB;NOK0au#YH;E&p6>vhZh%HZMF@RZs3o!PR3 z{AuH`jX!vnI|vJ(S7$lGsO}(t@dT-4S!s^dEgj@v8z<<8VZl*GR5o`^@wg(Z50&Pg zDa*atK~CE!a?s8}dj}O9RCG|+K|Lq@UyPL;q#T$IDm$p+AmSkEpsIt~gL2g!obDi- zVx`p_eBD7PDdtzNu~L!;SMq@<7!KNWl!ODXW2n|BRvLG}CMqO#gwY*^3YG)gL5YJJ zDs-stz;`gSqqq(}9FkkzQ8?_UD}uBta3~6EI;f@N*H+;p9fgG>*U>5o2e0p-frC~K z${aLw(8xjFLExaVgC?q$bMSUYY3d;3@bBi~qFCkNG?n~&HIGfD+C)>EJK*fi)V9+) zT?+>-X-OyHy8bgj{!@0)T1o3p;o93e7}ZJcez}O%4h}jxIMcyd4mvsL>|nTq5e~XI z=<1-KgZ>V>Iq2@7mxJC8dgwT`r>A;jMkhHVR=Qd(?Bk%Xw$kkXmdv?Ub&>%N200k) zfHMwMo9V+Ls!0W|ZfIf5VGf??6!slS3muGeFy6svooI}9FE41m-$}+g_`Z{HSmFdl z`sxfN6BR3V4!y_GSk87Z$-xB<&T(+AdiXq!+)=i?Ty(yUPt9~^Y1>&YbU@)H4$3>r zMGht_q2|R7(j!YLq}rtprsxzLnM;`JV48!UUHsx=x`P=`_)JR&7c&`w4vslE?%+xX zS8;U?o^&wF!E6WX9o*sIe-5s8u-3tC4z6)9$H5W@*E^W&VC6O0%R9?_2iH27=iu8( z;X8B}{}X191r8QExQ^Ia-svoh9NgYn9#g*92_KH7aH)f3PWZ^yjSiMO;fLiLc&u6k zEaWUCY`w|B&8oISait>Vs~p^-e04!`tCBT}&sQp?8GNYYb_eTt;yQ;p`Jc}6;>O@k zhtJR8VF!H(fUg8GbnB{9MFLJNDNX>JD9d~A5rt4nHZgnv9 z-GGEk<8-e%c-_Gp4z@XX)4^K~)^w2hP3yy8Kvl2G$!?f8o#-TSM9-wOP9 z2Y(d!pN#6K!)Ffva_~2EPI=}i6U&y&tzG3G2Sk>CxmikXXS*g+cDSxbSp#PB%%rC~;B4NcIL}2_7v0=2n@x1l-Noka z(!)hhH+&B5{qEAsMQ;})T#R(l$3&}daQ4LsEc7PHmu1u`8F8t;&gYZ+e3zqEgjJ#&q+tIql;_TXD85C8?xmt#=02i zV#tc@7#D4O$mG|uLwX3$?|2t;pUbZ6n7?p+cH{bN1<9X5=RA}>)5TdXj?K@WtyR8o z*Y!yD92Z}$$X>NAd%lZFE*|18ySRYc>SC#jWiBpqG1E^L3tTMZa=368^IY89u87_^^jLPo%Isx} zvhx{B*N6J_-gPb(xme=jdKZhiYfoo4{*vWluYD@J>DFxR$Fo~|$d~lb{OocUH@H~m zV!ewS>3J8ox>)1lW^V4*>`~tL93oJ@rCRiF79-3pNmZ{?s9QAjpyca>KC$$9?st5 zV$ZrPOQXNCudm8(bTOuV@q5bcOS3Hp z<>&0qZg;VR`?V#zv|av>ZP}w$@*mOvF1~T`t&3eQK6dd1z2xE(7oWP=?c#G6v0?eo z^bCH!BfF=k%-Wv)yQlcyWm!EuIR7Ps*~MNLU%SX|&))iD@a0FrksaCZ7GyC$+)Y-$ zbMd{4{VslF?73L=bvCgu`-6+WhUCeq^YOmyPuz~S`2%!2UD`d*$4a00I5@=M99P=o zhV0hkS+f@(-Q@GVxXHuK9)5T62ZO=G5D$O4ILz5SaTT6meA;346!U;87kQxqd(~=RN`!|>9_o3h z@1e4XDjsT3axhcXLp2X2%2}=M!S`^meR#7}>>=VI>LI4BrlO%3S4=1-6;q1r^=I9z zRp7P~N741*733BF%%nY3uaV_MyhgKEyd+!GLoE-rJv^Ar*6~o6b{@_=ejqcgm;8Kn z=~?}<^=o98_mT!48hL2!p`nM(TwSX4kH3O#y`+hUrXEiA5>~(KC3bJgc*yq-N!~-? zp^Jxy+L!j}Eu|h>dEt#jGcSC?wz-EE9?t76Ej>KiTR!S7*YuWKdrO(>h+=C+c4?!e zt%r66NqY|+3cRC-P6giC!-3x6?>Th!(9J`44?R2#q%-@-;oj2ILvIg#JoHjY-9AEj z`##dwLq8AwJxo-|j6O0z6_#oBKj9#i+}B5jdKl(ms)uPF)-Ml+d*GYV6FiLYFwzSz zsiQoM@i12TXb;~v56TsJ?=;Tie_+g8n~SK%>UfX;aX3%OL=R_pIMc&f9xnE9NnbhJ z!#N(#_b|!BxgK8XBjEQ|`p3daFvHy z4BCEDXF#rAKbh@;!@bFweq4IwQaNZRfMMXX;_*m&- zm4{nAtoHD+hfjD0xnvK|vX_Uo9&YpSxQ8b^-0oqWhoAe&BV5t&V7(4qaH)zNsL&pAIkZ%}TcLKq+~sAb;4yu71M7+3`^ikEt2tG=>9` zJjtWiU!L;tv{tFf@{ICKe|g@+3m&$4c#|8)cu@K4+@}8WvWHhZyy{`A3OUq-{z81s z!xkl1^_LY&-uSOqe|d}N#lsE{A9#4j!@C~dS3BQRWZ&oj`Le$p=`ZyL$aW8H2gs-a z;g}zK_{hUf57P(8+5z&?0NKUjfyzG*kV*rk=0N$>!y&HD_{zgxcJVNHpje!C zSn&vxzlXmII!BfKqxi2P4LepK9EUq~f~n8LDIQD@&kvHFgXG{KA)#hPAMjDbM@=79 z21_L$rq2hPQJGagd=+l$?x3oVYCfv_DE1Nek?>J>uta0sxYQX+pfh7y(ogTwCtOMNu+ksK0!3SN-OHCNukM@uEGe6&_lrbsoR{tzK)Q;_r< zBJF*2@bN-jyjT|ng`8xhk5N9x_!z75(LUZ9!UxMS?uX09vCJIe3Wm1$9+Cl(cwPU`?$l$Y9F`ySnK09A4i7C_R*O&JcGkSQf+RqWPRp#A3N^Ptm97_ z4VNLqW%}mK&$EL&84}k9clo$mTc-|}dwksMqicC)gOA0-<)#?{OTBR!N8a z!HYg#@-g$0O!E=acZ9s`V=G;~By;u%`E+u?GIxZ$#tmJTdELhwbjS$leRJmN5wc^1 zES(wby&>}!~EeSG8N9Ut%d*v=#{QobJ{@A-J&$MVaA(<8(l85Z&#K0e?{87Uts z?pFLrai`)g#gBb_qJ)~CD)~%@VwL4{A72z&_b>-4|4MOhL78gb`uNVr58Cm2M*c|I z=i}v(a`i~Lb)@VWDdfv12m7foIr!1XPfExSC^<-H79>CW_@%&qWjtudKYaY@V`Lhm z(l|^Z(^MKQ()i2A-##j)fi(W{@h@FHN>2GW>f@M?6Fzp$2oj^@?x_Jc_qdP7qvX+R zf*zyfBvZ#IxoBo)-}vCPkD@dxq;dNwd2y6{bY(!Slt$$=8l=M$R3(k7X{6JbcwdI4 zS{lg$ubxJ+@<>4vO(Uk

    UJ>Hz_H_w^7pl*WA|fk%ZuC4q?vJeEM-*;4*-R{Iq7gv3rt;C#t{vIN@- zrVJ}>dIB>NSf9X#1ZE~MD}f~mEKOjxNX|=OzJNJG=L*$}dz+~R2`rQ#G52#OT_nN9 z39!i+Tvmu(MPo}~g#@`QkWniI*W_|m9s!U*8SVlnoV5w8E2PS|&PKLc0$YT+DIb*p z9Uv2KWh+ck|8Luqrl=hW?4;&N{as@h-9iFi8Ti`3o&@$LaI1ma4D3r_e*$M2C}rTO z1P&zdaRQ$t@HDec;I#x^PvF@E4kq+-?QjCmCBU_XFDCF(0*3@Yp8z+pe1Rs>SuZ30sXQ~>_y+9NApCo52_xmDc zN&hHtSkk`|_*;Ufg#IJ+cml@+a8qR_IU)F@PzJe|4(VxD%dw(=6W}W4Gjt%LRcQl7 z1}-#E*#JKnoNXX&AY-76frJ6e&_Ss*-^U24;vd6(u)j!i{?Lrl8y)jywMtxX3_V1N974HBimKB?f94s4j(~ za18?&7jTIHZUJ3WvSkhwxKx;R3|wyDvVvr70c+&GR~WcTg37>^2H0@iKI@=F@nOe? zxZ1!q1{#aZwFc@NxWT}U2Cg%3y#emN&bzQsqzy#oBT36(Lj#Qr{4PPhB#?8Hp*;^l z6Op`GYKg&H3^WxEF|Dhaf#wDtFz}#(76w`x7-(RS)K4n|-3)X$(Aq#718ohoGtgP0 z+6!fSb!16fstyL+X}bAX&z+>UiFtJ~(6u1RmhC~64D>V5-$2D_s+WN~M62EsBdbcDT#-d3+Of}NL zXqu%|!aY*SqgZ4)1ca6|hNj*@4VtD6gTb)|?ia~%2F6QNzE)W}e!zXmz{3W%8Q5-M zf`LcaMg|rbc+|i|15*u5Gw_&!#|=DTU~-`eCP{{Ta8nsxQzXbv&Ck0GPN$U`m@7;M zXG*GB66CFC8<-;|$2yrXP0PW1{NDwVqm#}6;x@OS}L`{-KUoc zActvJ8lbmaEp(Ms6t|ioXAKKAO@p=42MOp}H?WpEtIY;B3ZMd;@<1pngt1!$Z#BS; z)EL}hV5fms4ZLPxmx0{|4jOn)6y78BfPuYy1PI9OjK=>zJ3B&_I4qW)`1GUYC--W8hr_Z?JkL z_?CgU1!x1N|7@u(`8@;g8~BvTS%hio1JU6l10T{&b=AARvon5d;D}V_ClX7up?aSi z_(FntYa!=LF&_HZZw!2Epk@-6B=Mbr@99O8NF?!tfgcV0ZQvhfXy7MyXG4$vc>Qc( z2={-J;4cRFBMg~b_x?WvzZrS~eCg@>pR7L&{AqxHc50@JZc9FWcs3Xr)BblJh%qvhfb@!q3KMC$)w=ZG?9; zl1L^|K8f>^Fq5#72$Besu#;LPF9|;hN3biDT9MByl| zBr5aeq?xLgL=^!SNfg%xCvkBSC6Y-Ep}a3MmoG)m&8B(9)(Nz_Z?YAMc@Nz|1)UL`@^q5?NXX`%Rg-8D&Eo5b}= zG?1wJNn9tAl<6mGkDIP;5Dt}WDB#8<=13HGZX~m@Xh_|f3TTqV%>r%_T26kHxK;3N zNi-ACJc-R>MfpGOTP4vtiS9}C5FOei(N#d(B-$m>UT}vbItpMdb&^b|VV5L23-j=F zy@-qd6_R!n&JWY|fBHQ|^7bV9B+*OwRJeB%)STVq4&msMCec?gtA)Y-f_Y@modUR5 z@i6_{VgirgNoW!&wrqf_%s3}Qs%fYEhoL@MxXoiT*6k2hbnpMbcd>$LigZ#8#1cI*Dzp9M)tK zdxf(jiQNKr3f(1?ncOi$-8Vz$wof?wh4L2si}0y}%z>nyv!cv1Y@;L&3jc*9UQFV- zBo0aNc~OHhJoJH-*Gs}5EQdkNouOW#g|txLB=Kz$uO{(Y60axmMiQTj*qc(!w~}}} zseg@OSxDaz{819`Ch=Yp?@N$5e~`qM8Cu{&;SiAdF{@pepCs{xfX|ZnoR!~0eUZf1 zauh2<_kCGm3-ztG5KfcdNR z_xdM`SbNm=w}K|W3;2UpBsv_Ge3;c=N&GGMWyLahT*UqrdLoIFN&U`zDv8s=VS_SA z#ZE~kXM}l{DL)PI!C?X>%9%LF#Mvgwn8=#iv=Txs6SfIMFqugKrcjy<%j=j(nMm`R zsazAD3H~(7%NM{T854ntP;N&Z@>N8d2a$?^1za*yH{yj7WQN351YabS23g(2#U?H@QCm1ALTd@FVWOsq zOH4GBOjx~4erX{gaUH<~SDLuo#1$r3A=Hx`WrAlC5nRP;X{YL%`Y}Z7A|;b9jd@Kdl9~G11lp|5t4%lz^L$ zQGmjoOmsH!iHT25bTQG@#N#F=ndoMsyNTgc!$c1gJx%mA(a%IL%Fk52O$?i<+mWxG zx0~o=>Sy$nnfj@Ehl%w9`b*95@TMVb+!^Xl6PzU;Ab6mOK?3eFacHI*ER@^#5f3%> z+soZd%Tr*ejQkJIQNu_R_m~)GV!VlOW~xypMw__T)SZq?H^-Q`&&2(5M{Z3s*2IaK zdPO;~rOgllq!zS_v*pc&y32vKAFi~=2vp#0(<;rZkCrnH> zv4uesQ%p=XvE0N8p8sfKx{0|a=5hYt#7yeRGgc($=JLwt&r;;fHo*nYbA<91G?n=# z7MWPgr+|qnvlMrtUTA{n*)eK~iR)&mWhUCpQcDH1Gm^s~V^`87SkERlm{=`_L_OCD zSR-_;3D!Jy9yCjFcrsy@+DNr$Df)*^ESHJRrhaJ7ou#XYR~Pz!6WdKZZ{h_LJ51~} zalpjWCU%+FZDPOF2G8l+V`8s~uV$&kv-GijEXY0@kL;^ZdbWDX)P9Lp{fvoc*{r61 z0cPw$6VI_Dx6;DYid~87 zYbIW&Nz48Ktgg3Ayv_Ea=P~gPpQqE+yC&X~TiiBVz0c%N=ohnIv-LqU#2?W}X6p+4 znARwFr>f+9X5w=bzcQhTFK7%Vj+pp~#iSZ+5fk5uCbV|e^EZMyY~gGSSGkk(y{Y#c z_(AB8Cb&Cge)IWFv(?X1Z~RK~3l(dw_*neS#P4)#7Ajcy!^EFVW#Y7nqhc_Bo2bV> z4O^(cq!a}Im^fzQIBRLP`ewE|Dd2=q7K9gH!2UIHhMw7iZ{aKpr7V=Okg!nNLXoAH za&m5*k|$Xw{7Ga~4F=B^CI@8<8Wt=IwuPjnr+`cg>~Y~7Rb`Hab%nlaz(Dg~&o|fm22qOE+uQLLfmlO=y8lmY+@HFd=85*ups$hR#uK=BTn3%30u% zVZ1vjFV^I_7RpmAOPekW&S{oM=cw~7kTUa%7Aje&WogfFp@qs8F1Ao&p^AlzEd9P$ z-9lAM&uCSXAUUsf)cMoA*#QYyq8b)zTDZgl2S;n?sQq)aDdrvfr4}x;P+JO8$HL_n zSYFPycM;fQ9QUTyNoi zOD|GwVBrP}y)5*$aHEBW7P?sIYM~J;%0e3pZ7npm(8NM33)SYTn=RZzmAIUBu6lot zYHHzD3%6PLagGj>e_B8@3(eUIb5#qWErl|N){+UuuAQreN!wZIV4lu9+GP8T*dq;%SoM&FsTQVL zcvynuOtA1s0Y7SCqTt60oX0IpD&Qw9Ocp#v=uPwV(&FiY+0ZjsX~LN)?LNx_|3Mf! zPt6tqf_WC^TiDO8I$tedkF&5$B$;-~JhjNeVhJu`!UBKUJhf+@UgW%7I4dlywD5{> zRtaY{jgw|C_{l=5br#ka@CE@Jg>JI&v83H>VT*;W7PeW~Q;^(lVOIg~5U|t2uOd$c zc3WVOfY)9N`wEzOvJ%LA+QKt*JGNdv{;Y+A7XGwwlvX!XJ!j!P3-4PvWZ`)WFIafd z!W$Oeqyod$OBP;cp#&cm8qQbbziQz%3$L@kOYj<@&E~6K0^SnIcPzXuV2m)|70k3# z=Bp1Zd}!f23*TG#hy}OsxrHw*d_oW0O8?{kskoF`X`q?^Yt_=@egzk!_`j~erDgK%`Y$Eb%Y7$t33XNF2%xc67{Rl zV-oedB>Y1tCDRL3r3LCQ3x8WUL))Zb>q{wHFYhlcv_Y+svu*u@Phcao!JSCU*httgY$R>HVl5_WvTUfpc;5V7t;D;M}Z3&GoM z^s#ZDjj=ZFu+i7X-8P2V=*JAD2zRl@7OFcX|3NkeNRXU?0`fkDrK5U-g$@xq)JBtq zTAATCMhJ&R7-{1k8>4KDmeMh8w}rZByd5>aS8g#zC=(7|sP4Bh&c>s*_EgM&yyWwc z&bDmtN-l;aG2ximdE1XR> z!^TV-`)xdBW0sBCw6U>jn~gc_8f;=4t8L7)G2g~AiQ>;J3v4X1vDgOjLh8Iw|KYMk zf=g{IkYK*9wh3NtV}%V0thDjsLdA>nyvrIJ8*FTpY}eXYCxHC*wETryV3Um}ZEUu& zMKaI3ai-lWK?26|Ms)StZR}vtZ0urRsD3Ha?iR35=pLbaZSeOx#^xy#9ysw(*IiqW%O_p2Z2V59jbCm2Px{4gLfPMGHu;|Zr;Ve+yi$_x z+N)R&MlMpk9$Tbb2cCo2LC%5iASF>*2WgSaI0zhFhm_Q=a+nGo5a)xD$dJ!qv4gS_ zEaza+BK-pwug#K*puB_g99-t0wuAGj=R#G%K}7)<2<^!lc5tDC>JBb;P+6GF`62;T z3NqwW6@98Xct$cWaZrQxuvlH{pr!+3tYXt#QUJ9ae6&dYx=4}IJ4K6C9S4^?xXD3d z=Hoy)xZ1%rj&{peI;bmvt#Fm2oi-b*o^Tk;vR^CsdIt>z)OT=QA-3{jb%TQ&9qsWN zN)xc9=&0E`jT~)41f)$I-0Wy;zb)TPLYuPA*^w9M#=TWIY^-{Vbth`!prwO*9E@_% z%0X)fT^)3j9NIX#|8{ZE)np#>Sf2@iMl<70$_LyOhI#cIo9^~qv2QUu5!?ciPqvmMNFFvh`s z4jyI>l7yBs*1`P_#!2u2soU{_e_5=X_(2B`Nu!*#L{~T)?hyx%I(WjtWCs&P{&As< zeN1dAFF8q=#8Vthbuit*3~9}*YQM^k&EgOhwNtZcTo=-AHKcQAiK73#?YK?=nG`SRRNMW6W^$w1B z_{qZt2OH_NTzuzZlY=K6G;`71#byUv9Jnq#7h4@{bMU@{4;*ZFu*1O%4ql{~^rn!9EB3o&VM+>~-{%CaU$Io>mMWfY&G`gQiG0O2k`Kh+vSuc!?;ZT$;5)(jrK(i&M@N6- z{)siu`jk}=q`WnmzdHDzgQE`q5+!RhX9vHtDd~Gz*rob=G%pJCfU{;x)!z>OarAl* za*omYbkviX4~Rb(X6qnm7wb%_+eGsenAwcq!KO+7p4o#Mbg#x;>8-^@eMq0&UV4$n_2CS3+l!hEuNl6HGCH- z7d2eebdhF;F3xjtzKg&`=%Uy~Sy#_tW?e)sVi${->bVzAl5id-=YpGubFP(>y_{1e zznqJ6T=28txkAgk`fD0z1sTQDB`$DL!9`UU)m&6`^(4=QE-DMCLFH;Mb=>xCX$}L>9bg_t4?V^>7)~rJpV_mdy(bh#z7rk7xbJ5;KH_@Sk z&`vHoyXffZMZ&x|X~}NIl^b1LbY-3JwCFzij5cz*yXYZFh^aqUS@d>syNjVN?sn0~ z#T_pCySUTUeY3BNe!M2D-OIE|bH8F@8r1+716>Sqbr)mith%?CsUyqOT`mT@AQ&Q) z`4bOwG2F#HE=IW+;bJ6PK^8_*C6<@HlBdNn^U-3NV|e!t>Rzg}OqE%#E?BOk?sqZH z#bjE(i}5ZVa52%vV=f*Pdzj$j5f={$e%QsKR*Dy`OD$LY*!`&R*(kKY$6YSGqW9FnZ=k}+%nC4=Ri@7eQvo~?)Hy5*9@D%tNE?A%69Mi|Lv#^u6oRU#}RLkXR zo{RbHTrPNM5iNEBTeh|SPBCD)UJ$|^gZU|N2`$#eVHYpESjKjzmv*tu#R?ZIsfLSn zE>_vB3qK>`50JMP`!=E~H@%*X*n4cqc4Zn_X;i z!9{dr(vecV?JjoEAYB}EvD3va7f-o3z|Q4jkBfaS_DjEDL+^FLwPAE_tnGU3^aT67 z<+@pUJ?-Kd8s5pGEy7__viY8KwYz)X#S3C5hv+LhX&=j+UtF$Ubn%kpOi8Y7=EV`pir-l9u!@ve)vC5oPe?f4#j;|vYnrvbFl zYXdl!%fnkga`CZ?FI{});u9C2y7YH3xT8^S!3V3_`$^x4?{it$U1jX$HV1(?6SNr91pICUtIj^;$IhM=o4K0=Hee0 z$6Wl*+Hmowi=!^CT%j9<_*Mbzi46WFH~rhytJ>%&j=MPF;-rgHF8JUhht_5A6fpM9 zsfyF}`4;TALY?KIlm~b?+xxF&OMBW!6$u@`LN`zu4+#&Ja2PZ^{X>fB=|@1)(~ldj z$XX=I*dnuOg+2_?^Wb}^=%JE_l!vs3vL4EL$an}m#FCu7JM@tC5J~W$+>WmDLjgGt z#hxzFpDXlJl?HH*hjTrg=iz)0-bz*8)6ZFgYAdyWqiKD0tcVM`F7Qx6GNgtywhKK} z_E6%XhKDL1E|RF~9=NWus)vRvbs6a>s(HvCNOZA>9xHWjw6~fbF7Z&y!=)bhYXgP1 z%2At?r@Ow)Lv2r6b^Zii+VB+~l!vw++IhIr!&M$`@zB&mT@Upiad0dwN9*Gau+-5M@}O z9rUiYchQ7q>Ry&#mB9~cY_+>R4D+zZ!(I==J&f=$&%=DyCo}Qzh=)f#jPfwr!~Gt{ zdAQfZ7!UV}m9j^0J^cT#iykY?GON^h4-a^Fh_xr22Wh~obbsMRkH;=ELHO*~Tvtry zL@MuLs)uPF9``WG!xLg)EHX7@@1V8V{qUdzj&2rl%J+bK&AFiJjwN zF3o0@n(d+0D&3DL$;Tq!8+p3x0vf!BjUG06Sma@`hZP=HvQTZ+656MSWuEqIOu~06 zK6I9Q`guh2VEeA}u-elvR2#@-i?fWY)Ors*P>-)VcdkI@cZ(U9yWW} z?qP?g*N1GO0h`z+c&i7t3z_`-#@E+2>)uhc8*i z=ISXA2Ryv);SCQ@dw9mft85)E*Z(6E8V|S3#x*1FU7h=h@ z@FT0#S027*@jZO&;X6-1Re$jQ8wYX8@%Lgs6#G%Y86Gd&Q~gZmPru=#osVCc75#&c z>wWy@;diOD%Y6Ld;ZJ%|ALV=;_3#(nvJb<@-yZ()aK^(~K8~?a9!`2VC7z8r(>0x- z*~t5+k-%vW|B9utuyo^mQD;;sAEkX1`GBwYxnd>o;=1>-+ zEBa*0^UC=smgIE%46=#i)#@A{=lZDXqnfY1WqBVJd{p#to)5aL^L<<(fYwe^q*W7C z@=?XdMZSK$ztGq3PL+M_?g;qZnck94j|=&#`?%Og4IedqJ*J==v}uGSraW_*c{ zT0SoIbuVbJTH85&6n!1P(bx7-$H(PT16TQ|>*ET+%Ey(yZufkNIKHdr<7yv#NL}mW z8cMd(i_i1JE;=-Nr24G1m5L787P<4zieEHmI^h&4aR$L7`Q@M?7z zjVGxc7nNt*4fS!ik5N8G%k72<9m%>~t%my;LB*PDFQErbG`8c~Ao)|_y*|eHc-Y4T zwz7}0KF0faz{mYQ=+DRbx(RquRnq()HxK%F$p3Gd%6toE_S#}hs#`&gcD2p>~@%=IzP$21?)ea!atPnR=%%w+%a^{+5e$8p5yD6VLmeEQ{D&v7+UIMq1<$_k0m}9v72<#uSRU{8f$baD#rh_mdSnj z#}@f3d~jN0rH^lq6|M61TRn?*!y2{L$2uR|SouEI``F;?XYnR!k!$IiTC0uH7xy0*E7;953>IXU@IS@hNEgcMEkW->*neW3arugz)IjvdGYP;UHT#}{`c_#t4mbn zZ>LAsC=QPJL(_+n1BWU!hELdWXk9+O_VJmI&wcR4;7fWTnM88dsxRmR*XnF5t<~o7 z4Qt!S4{S0Y-?8|TdHuCo0lqenau~(k|Bm?hNup@3d966k`js{8HmHFPB%!$ zPXA9Y&0{9$@O}I#wbbrd(NXbitS(+071Eory-1JyIN{?YyQ-{wZnIV&X~FB1B<#ld zANIku3MrhO!dWSlN@=f1FIqZ<$JeSNq0E!GObUq1 zQ#hB>ul>bBS((ITMSwZ5mz|qJ`4lRrP$h)}Yt?xvR7jy>3g=7k0!j7pTK!z3!=Xu6 zO5ws3II?C}%1=yPl+r!Dn$W6}GvDjTVdiXzk`!vBaAoSh37MKH)J~xeg;S`N(xar` zjuml$a4E%_tILFP>f`bhjVOUow_H5Q7lM+%>hQ! z%!o7CoWYnB?&FQpx*Er(a6gMCcw7qOQ^*Q_AcY50_%?;_Qg|qZhf`Re!iE$kr0_@z zvs0Lp0uRD|G=(WCOif`T)2>qs*Qv+YaZ-9%%HSknK9Ry?0p#pir|9aZr7(laa0noj z=NZvZXQnWVrYoZcMxDiJq7>$(uq1`0DR4@8ehLeib4tHo@qx8S(!RS+Elz>+AxuJp z;Uj}!SqjTjSi#=M|0vffK4?~^u!dGANmh~a|1b9F^?G?8Rb5A`7R(n91~;a#iH5=6 zB$7|2uq%b#DQuRmx+R6JDeyNmrrpMl++1xJO0Yw~PN7tT*B*XfkQw#8DeOz>cM|q) z{ujxAEUMwKrz&WGK!OQn4{6J5e zMyWJ@OyNih|D%|Nh1)pcGCE^8{&gbyDalX+gere!5=$E3s$TK%LZI>-FQ9Vx`k4 zlSU$qqO{)DlZ{1_<}>kZ=@dM0$4DcYhMR_$hMCrnbt?^tMg;o-JVH%YMR1wP9iv+N$tEX{s8Z2PT zG)kC58V%C8A&r_+@LFkH%FNR;(v-=x%UG@rst%RhplZu~Tk=2OX6o{ShF7Ga(zr5> zs|uWJ(x@xAp3tice7;VwMAxQKzreXJjq3$B*q}T0jcGJY<#+GlIGn}qS)x{eVxwXcCzLW(Hma5qH9n08(%3}#G#*Ujp)?k!u_TR$)0mLP>@?=2@kknvvPC#) zBWm+EmcAR+#55k0yF8x8q%@uo%;uOTU~(E$1WYaPSqakx&nR$arg4OOEHqbN^i|_F zs#zP=+%)E;F`qfNP&BXwY#_PgBB`H^8`X0gb*bOqsQ$-`W8O5Dv%2n3%OuaUH>pGI z)QU7#vMlX&J*-M&bsB5vf;Q+62emdSg0*R^6V7^}8-#8Y%Gk1-)aEp{q_H=ReQ9iE zBc}0MN3~0Cv^|X-w12K9E&TJcQ#8E9#BQ4FCSBWm(%=LU^?abC+MmXOG@ef5DG{U2 zoj0jx1RqM{cn4jIXVW++oacnLlc`0H!P&Skr14@JFQsufjW5#pGL4s|q}(j!Q+Am` zO};ANwKQH&>NCdI1aGQs26QWI|9e zqo=hAE);?Mf3H;}pNoVt!>R(*lZx}G)ibzQ?#P>#WKbi6E^QRAni*UoxK@F4sesFb z)|Mm`yF%{Eg5R2f%HYZjuF9Zp2G?b9y+qX$dacl_Gq^@Tn9mskA^I4ecaK=@6W ziTq%DLk2fy&`_9-GMG@1zezZaGiV~e7fP{K z8MJ1#Nc*NzvqiTI`eblN z2Hi90A(A~ME$_msR|dU>dArahqFdh#`eksh=+-}jJ2MzAu>*t-6Uvef6fj8WT|x(E zFeHPag740N$4BPx^3;>+1Ic-WM3Ff%gL?{ilz`D}h_2e+#$-Tw%5YG8e@0I$jTb8& zC$+(`EiM0n3?7u=Lm4d0U{MASXTaY>CS>qP29IViF@rfG@R-oYGngdc_b1g80%i!E zoWT?UQ-w~?V448lns>?LnZjXkmVntA{h^sbUUP*rFN667nFSeClxHaCDi=$+mSn&K zdD%mmCrx*mlxVro6+&0Cq6D~`6+aAdu3)X?wn^x^j9!LOcDh>6PB&d`$Y7%Y{z}gd z!nruAv4t%z!V>~)%V2v3Hw4;g?8sne2CruDS_ZpB;F%0AJyx_^@E&%q4EANPKciot z4rKIeKVLzg%IEO=Oj&g$a~xM#~p89iynDO0{A^PTq73_if#BB+{+GcS zI_ChtW$=3j$LY*7_#=ZqGx#fmzp2mZA`aI0Pr*@9c=~3&aDtzkIZ^yi2FKWWS8L4i z0y8{G|DVBWN^Vw{pDg-Ul5paSCFMYXlk)_n0u-^XWYktV(ElXnF@$+`fEPDwju9Xk z;QRm=1TX_w0m=s89IqX~36Kd81aJd*fqs)rG1VmH2YPOwFZrCtX({uQX~~oKW!;8> zeqGN7pkmZE3J?d#1^7~K$DtEJvB(pY3vf<=a|8WNFt|s78R)S*RZ9cE4CCS4lNLRm2$~7QAKv z4z8^hsuq>u-e>_X3s5^iodER%Tu1#yNfqdI3s(fXtyzaG+LZyW3Q#xDt8ti5{xep+ z09T7VIoAZZwt%^P-}QnU2<4V09Kv({oYiUy0Tqbs9OWv7U+>h#{kU&G!M`w02gw!2+%Unhm5qA*j6H3Yl|LJa77%yMsW(d zZGd)x9!#}o&Rf*DEvkbA$!WSpbqdf~T5aAI)kQMl_>mK#-6X5-fu7Z*0zCrs6izRp ztO_!37d`t3y(2(hiRu?%pm11({sHb3JU}RaLL`%uW2AQl7#v`TwD`yX_XHR!_->)Y zgbo)vLMT_u&`w5)st*Yr9pGNJqhKm?VvD*j0KfTe-=f9_xIX~FxB#zi(VX!Td?3Js z0?7G#i*C?|1EjZV@JN71r3oemSR>#up^pol6yS*flLJf%FfYLTKo8!h2ACOOR)A>% zrVD2V%~DppaQI9CzWvS)Fqb(r)88NG1Ry2mdG4eOXtV)V1XvkhQGmq(I8C%H&}$f& zkgc;Mz|sJ0L0+6C;DVp!yq%0p+1F@4%w$!7)q#EoqyHgY8(>|4^`bKccnVUJbtM}D zeRTE40Gk95SKX?%1lURiLM#fgjdc>>;t(Yvb_CcNpjxQs5_bjI9pJqH?+4fuU@uD- z;3f8vt!iI@LxKLUe1Cwa0vrg?wzuN-EEN{~j8ICF$*c|rcuo=$lleST33#EvJRIO< z$?$EO_g3`^>ngzOY(5G0*s926k~adpDQR~`b!wg{dW+gdb*RROt@=>rcLH#-^j)Ek zY*ilw_%OgRx~u>n1^76?Pi!U{-pQg*0(=(Wb5;oFPXhe_r9=CIo{GIm+#NYz1$vzO zoy2}E^c$hy((2mk`FX~EFET#_xKLI~9Feqq>*Jy$HV4PTq`w6Cm12Q@E%}WuCBUCF zq}A$oX*f>uZ~%TZz+VCWW^KzsTK|Y*90lve08c9ZA$~&I^t@2}jgtXR1vpJ*0@xv( z5NBvSA&*kP*&!BeRi#4x$(skUln%Ai;5yqsI3OCS-2!ze6JqaHl?;&xVT9T<&@1xd zW}%$GF++^+psY}@C?Ie{cp;(?aR@&|Dnt+>43Q>nt2k(VXRFGD`mK@|-!Ax$m!+7D z{kdj<~&BhM9mQ0LUd<&L(~e< zK12uV5aO~B%|bK}Q9DGP5RF6qhx_HB{^m%xzz6OXAykMfLtMqm=LAlOx*_U?xK66> z>QF!O_<#Mi0#BIWFEZ+oMh&|9GTC)b)tCm7rh59Q$gKX|LA=-)!&?ei3 zdOSiq?--&}h|VFputK=riPObgCM~mDI`N^nky?W;?Ag%}WGV2Iu! zZWm6U5dA~kDfo^MeFadmpMYB1RD*4*)iy;A>7WpIg_s&*T8P0R`fO9J9AXQ* z25n3vw}#jmVwVVP6Xtf7i_YZVBA))nv(+fJJH$STBHlyqA$UPQ9mQ+E1jnB$V*Uq0 zJk8EBST#OVMEb1g%r4Jj9-@~RqF$9=`Fw~MLcAE_r4anzmV91$a9G4%rqK$>Ghbur zLcAeqFOwe4Jxut`>utJ@5L2?4n#H^97a`8e;`}V$5AgvVR~CL2ABOlS#2+F443Qb2 zJ`Qmt#7}IO5T6R?vk=z~P(OtDT)-DX|GiUv8G`gHp+^a)vp|;+(90 zTE$u9ve>m<6$>pVv}{(d(V~N*=V26|1?Q3@OgdhUCN9XLLKeNU=$+MeUNMWSvifAe zN?BZ(Mdd82WKkoFnps?wMb#`WrUC;LuWDITFW@(}YtFaZRf%x^k>DjPeipT}sFTH| z!oRE_Z|qR<4xQxkEXoX2R|>sCD1(YQ?@$E1I<6?Gn?=1WuFm3`EZSz#E{kiksGmiH zEN)=I`D;K{KYXvx>hU1QDXa>vGQBa2hFR^{TW0kGj?-w3vbafb<1B8IgiR#K*qgJs zrGT4eaccqdaoJ2Hn+t7`)y|)rhw!GYvS^*v-+Jor&~@7;tJm7;sOGAD7F|T1{0;&- zX3 zgLkO@0`3$#Ad7(lC_H|L8cZu1u7+hXJc}WM8629$-GWaI(+A4W*r7&baZeVbvKT2B zIrY|*jAj9|ShPb;5IRQaeL^?yP~?vle813fS&SF(fY1kpJ|y&Ep_FH~q>o7O(JUqk zc&rfncovfcKT+UJ7Qp1wvY4L5*I9g%#f&UwX7OScFJ&<+t4|<(l1-n*>@4PFwX>Z| zOU`0N7W1;0FPsHgEXyMAV;3^dEEWrYNft{59NeMa-JzzQDq?bqeZNDkEXc3UVwK?j zr;1MW)vkCA%|lYH6H3l{0UNT|n8hZxX~AQk+@ZE)u{De5v-+{Vjg-AIi``l5$m-ny z?j53jUR$y=tIuQQtvpOnXq3tr3OWtzlY>J^%<05Tiy)Ej!dp2ZtkyqU#Y zS$vVjmsz}>#XIax?0N%K9Ui1UNWGiY8%ng@ske`KUzGenXuqB6!z@TY%Hm@I#GeTG zG>gv)oX@jpw4#JjwD7N3u66n--myFNz7XGL@txRzBEt7s{J^@+;y01`F^iwr2L&Ht zr&xLx6Y}~+IKK+5K1h#W4)s#MXYofC|73BDZYPVQS^Pz}Pv+g)vE(a(lC1U%+h{e8 zXK{iKJVKdBHx0{pGOIn|DSCKX;7+xImD5-KOUJmXB9w}Bu(VKuqDY@PO2BKM zl#T;KU)+KbAsNApU`6mFq$0f=!`nNR9l;^)tG?Z-+z3O4DQf6NTF;Ay=;laAy5olt zKH@=;kv8}s!rwdfsB_M6eGW(*AxE{(MdDl(M<^R%T@LGWC>P-z-Y7;o#<>y7M|dy7 z`w`BIaDIfRBkdUJZ7yK`5iX0gBdQRgVuVU80#)6mryMIs+PiW=7jczHFTcD99pnJSTB4WTt7TvCXw6=`odyS1tvp$>Ooi*R#<%OhM7;f4q|MoXtT z(qCIBuRo#kH=Ia6DHzN%Z;8+}!k`FuMYuJ>Z4r7z=oz6|gyy12*9a|Gb*!9Ls#AoP z5n4&Gb%eG8+6bipe@bc>p?!o7q7^wEC5kgq#4JeXNDoeVb&0@5;{?>9n+SK0^j{%V zuUCZL5&Bag!tD|IM7Us=*7gojhU;hgMd%yp=?h+L8V+#uvUypSJRs6fC}uK{wbxER z4F}VrBJ7IvmfAxj+#O+Zgeeh*$xTPIQ6dbFFe1W8;V|tz0`f<1j1v8c$3(a`p~ULWmv{F z%z^z&wB20LdA)!Q5jG0gRNy};wZXD%5zf{Ee_Mp@1-v5yE08k0`@Or=ZU!U0baroq zr>L9!XSy%Keqpjf8O0ff12k-zYIsIuo{exY!gCQ0MR-#l>8jw7uM3clD{MT8sUF}|BUb(-EwdByU<%t6cPU+m`R8! ze^j?=oxen$;2+8DScK!kIU)30|a!;DcnMp2BjW0Z+; z<-bL|1uw*SYL}iU5tF{UTU`>PR*VLc+odrsi*a>~Yho~}b_~Vpit){ERVT*ftj0a+ z3JH?Ke0Za)Bw;jW@ECb>Qa^`SsMNN_`p8)GySnQ)ITIGK%O zG>I{kO2)W3#w{^=#^@F6Cv4Lgx5a1{<5t#l^Z!nAZyuvXtcN^ZW3-IXDn_RmZDX_+ zX1f^eW3&;@*3(54s`E-#o&SLd@)-YV^xd|F%I0TR>ykJv9&_E5!o8PQ0-L& zWUh-*d9PYuh??}_6&qvleUD&sj4dpC4p-%{HO96WpR+s1*dAj?j1OXb7-MIQU34ac z)ZrMrW0d0yKMUJeJu+JDi9t%vz8L$(KA#f$q6i#_@w9+vggz_upwQ=p9umr|o{#Z@ z;4Am)&BtC6%zep-Uykt#`(upPV!RXUcl+04ybwg*Js~8vLP$7q} zY3=k~Ih4)e+Zf-)NaSGTv|)cwcPCZ!*k1KR4ALKk9ufKz4O_r3LVp!Xng0p+EynKx z7VTAJ{u$$FjK3tee}(=n^dF&Yg<}Ga3q29zq<~XGPYd0?SC0#Losr;KIh5ihoYDe{ za{4TGa?Tc7rVz`7$sEia>>QjN?q617e!>%ZFvo2eGX8=a~Q!J?Nj6S zX(kIbN;H31=xCw$3LPW#KA~f2r2<&7<8l~Zzz^i`px}oJoP3Q<$l;M39?fB*@EmbL%({q@g!-5=U2mgKNBhh=P8;jf^;KK;CYMkpV|#H({y z!`2_E*5>qt0DBfS;fHe06uq}kZOCCGwJM7RWw9xTCv#|2jGKzFIfpGd6cq!-*qXz( z9FFC1oc$t)i#C+Jk;9u*HHV!!?8@Q$ed@U!4hh(u!yW--?#*Fe4rlhM{Xz+z%Hco( zKb^xff}bsL4zkADD2j2&`8=yd@_8Yr*FwA~^rbwWq~iVRQE%n&Qw~4p@OBRG&_3@`@8!6Z`AERWLO;pj zQvsg|{ah$hVU+r^fWH#(bq?PYINu8RjzuVNe#qg+0zM+3>wf(}|AoDt+c@X&D?tvw zJ=kV45Jw57vq9rB#U7d>%*hV z7sD!sU92DUnPNBs++uhFxI3s{3{pO$)51v=W0B0`@g0@?K$uJ$3djnLgvQ0l2`Cmy znX&@P2|cG6=N9-A_v?wH^NKM?K!sxcW_ShFD@Mg)RFdF@#kg1iqbe7pN--{yU{#^j zg;py@{(Un4Vp$^08pWt7;1Z#=i&0C!r9vrrSuys=TPSgzVq7l#d_GqeHe2UdC#&yMdpVjM&af6huK{4LnuLg2DdWYgg z%s$(&SohqYm{l>F6yta?P88$jV%$=US;d%LjHbo7wHQN-|BtEffRdv4zTRao83Q0H zGt<-EGd(@sJ;RCvBbI<-02P%S3?L#oNtCE0K_!R+A|MJ#5=F#B5GCiFb52TITp#fW`sT3;4&2hMXNC z^#vOUa)V;zycF;cF)s)Fcdn99`IQW3mI|-Z$s0LLO{5mpUJsyI0PO?l5J2+)S_IHK zfHncNl!~;_D)7HOFwX+(lC%w=owT(y$8V9sHv;GwKxZ*aNvBL{o+n)b=qgR;DHFQ~ z&?A7s0lXVP&j5M_&@X`g0rU=_PXKQR{MSmq#i9OGF?B488;kt+NcRo+Z>8q@qFKt9 zW)BGXZ_;KODDrpMio6kePylx>_TLNrUI6b0Fd~2t1HL{rhXgP*fMEgf4b@csK;**( z^CYzVk=S9QquF=iqr^V--{v78fHCZ>y!iULqWDCdWYKueegLxq_$Gh}0sk37rkMeJ zCj9dNCUPAGFquOXz;yPpp86tysR4iYn-cK12ujSw{(mTQ-kt(Cy*x1NbR`xdE&nk^2LW0wSdR zjS;zZ7pr*zEMRmkR`Ua3A}RJ^?$2BrqR%XA{lbmn!`xp5DOnQ0QkDj=fnEi$Jb<-~ zmc?p?AjwL``H0-Uixv4Q5w2#(7ppaNOoZz)`c&H}d~*O>glrN`R;1?E0Je*e*=<6o zzaxO1VxIY%#^+Q3ze$U~OE%8|wn%b1fIMfsC5lGQ%RpTU;Ie4`A!B$UfQtb< zzCIhLh=QXBZQ^rvQZ$2rC;S1%18lD;h*Ck^E0X&K?-OLBEM+PkL_j1#K}teGG{LZ-E@%W{ z3W*5va7^V`(0|b=U)7t3wq)aiyfpBFNCZ(eh-yJ3gD69J5Gsh=puZ8Nf+!cn13{Dx z;z5z*?LT?DR(V#G?du^aN(cRYl3N@rRuDfzuo)mm4Q|j=&&_O&C#Ct)!AH=gkR1czF5cPw2F6i&%F9cB|i03n2vFVyY)C!_* z&_BM^4*J*Qbp%H&@vp?EE>UxrsO%iSv_TLJgXj@N&mdk5`iJtDN#wHnCCT#8^GXnn zgg55!2GKHzSA!@#Ks6D3O|Yrp>w?V$n+x)nJ8HI)>YX^MGjdxCXG3j*Xd6VkAlhdn zZwToiSh5&8W(bv8v9na~5=2)a-2^FrQ%Lt9)-CbXdIixth=WVi;2`>Nh-T#uV$qG9 z86DJHl6^afzCu{kFNppbJ|KvJ8U7AiY41M_x#30*Z!*6t25Ixs5`RvIaB6}W8N|>a zh6OR4i)g808WF??!b?e(k`IIMg!8EF{|XSq=pa50Vhrtbs}K4oT|C|TB#5y=j0^gg zete3i(oz*_r${~xVgjdrdM@u>*I4S`!JZhzB#wUwO+uI)#1}zig^(S>lpv-Cu|0?# z42dA72QfE@c|ptw;!8$Cd-X#QGlTewyo;J0#MdIE{F@+VNv|tr`D#q9ma1<>ZI0k~ zL3~edm-;{K4ie-|@*ji#LpVPP^7p&>K`aPjeGnUh_&Mmm<$ekGjUW~V{hv<8FIB$; z@oNx^s53_K|GfB5YKu8dZPX7-)v_R#2eC4URrI{AT0xzq{(Y5CZ}<-stqx+}Qva%R zZ4hgMXj(UyiIQmt%B&0G&!wtt_2kANHU+Uc=${%1M3%}Ia5Cs%{G7Q`)X z??GJWrWC{tZu>$1CNM{a1438%docr#1Hyfy(lY;cD^D9(nlFT$5E3CIL;hs~LbxY{ zQX%9Ip+LyLZBj6VLLvW#4;Mw=uNZ|x{;icFAruu-Opua0gxo23m*CwY6wj2F5K=OP z=a>0Eg)si_4dMO}N{9TPLhcLwZ$)s)2SSL15Dg(1LMQ|+gmB2;pbSAhzYzGNwB5c2PEk}$m#!YeWkFH0$Jcjw6)h0s_e93o0y3!y2)Mgugw9zrwD zT?k7;XwKF{_$-9aLueU7s}Q<{@Fr)un`+H=yZaNg?M6=#0R zAp-;l3Q}{*GXF=qK_LvzSbLZ8nc?q;FeJl=hA>R{JgLGP<|9J>Da5D{J|qcYBqO1h zqMU?CK3Wt$791l;{ZE994Pl&+@q(WUP7tIHkL(jen8e*agsI&BLs-7d|8fT(r5pZr z?iV5d`8twmA^%sB=~9cO|8!F`LijR-nIU`?@{c>;34Sg3t>7%dZvem5$D&0 zur}mBqOgKRgVjpGRf4Mpd9lwOjF;H!LjG>QKIA`Nv_X($qmWI4JG!c^A#4j_e+UO; zS7|)Uf6{e(2s=X983KPX*%iVbA-e_7E%Sdy*-Q6AxFNjwa$j;V*!iU%{(_*Fv~1$HN2vspoT&k!Wwi9g*6n>aF2#k8j5Nt zrlEv}lA0e^JPp1>!=0Lc(sh^SM`LjfcWeH6#h~T>sl`Hh+LMFH(;J=+F;?%@aG!?K z8UmWXc<s3%tDLiy9uh=HGudG?*G5(@;f2L_<`= zgBntre+03_nx`SA!PXGh{F`GOPgjE@JlfrVvYn9@y^+ILm?ktNHI&hitI0Q}HI&u- zH@LFM8to(hS&zs@X}p}~M_qXhX$|ZV(?inP3Yz~=>*Krur9o*RVR}SEMd6hMD`(`7 z3K_FpJ+9#i4bO7$H9V=|DGg6+ct%524r~v9e)-E?HO>E`(2V8&=Y+WN(hU|7pVRQX zh8Hx{(ENYMWt{M!#wr}@nlhWUG|XS_KP+9Fqqj)a(eNfqg)>`ENPP_rGLnWGUKIXP zMzXAvYNVmDhF>)-((tN=CK}$+Fi68|8k%Zot)UI~e+|tvw9wE}W{^|gTnNLMQ^qXE zt(E4VedWEiqpgN^8hUV$HMD12byNqLGQRJNfx#}kp`oL6fxMH3&ceH7BwdAcV|Rpf z&&cU5A3WdcfTNSMCXFiYfYk=fZ9oo_YF$?)%l)RVX>y+ZxS zWwJv3BPgJxeqMV{EIJMMiCj7i#06Ka9+b78kTBUreTkUy&9Hl zSfOE~hD|a=D>bavutviw4oDCG`9S`Zww9*21x?G{pkaMxRG(a-m^hwwS11;duopb) zZPu_wy16wI8{0H&&+r`@c4qi44ZAb^`mLOO8un{Aq~WmUp9vpec=L!^M;&C4OwDb+ z!oQt+MArKm&Ht_EC>6S^V}i#8PY9kAJSF&>Ak}^sa+;CPdF-yvYB;Ci!xgG@Pc?Ie zTChT0&~Q=1Ee*FdT+(n^!wn5LHC&NMrawG|U^oAiarjHa-$MQo{8#X*;5EVPg4F+y z11sah-L+9S-w3zXtT3{}Kp6SM{_f4aD__{}OHSCof;+Ure>Q+?hi|#$r5{&up)d-E zaZAT-9Yw+@N;Mr7brcKZjxbJz@mm;ohH+OI{lgd##@%5Q52H~Sjl(DrM#(T94dbye z?g^t*7-ho94ddQ0?hE7c3Ka?C{xC`lH~9RgkWd(!kf7jyD-<=uVd#=2FS^oCBuu8r zSsKlhT0&xB*h1ohj-V^(2_^)Sf_au7V7n_-I*fzFuVWdP-PO!{M#Zsp7VbCR# z3Sm4f)hh`q!AAri6Za|#uf0-L<_N4*dEKcJ#^Yhs4WnKdPlWMg7|(_Ad>BuO^3!2F zBc!TeHEE08Y`IcB8%FPys=6Sv!&WM0S@eQv)(N9V7&V303Zu5DeIW{YYIK9j^+kc? zMIjBsXqb`Ey_dq6yHdR@_=+I2?Ch&yGzp^@ZHDn$7)`_I7)GZsUYELU!e|>tvoM-V zwuNA;Fj|TaY<<;A)mnrkY`R?-?Ip`zbP%04GMf9OQ*^a+7+u2XA!=O(S+RQ<-Gsj> zcuuTQp4Y*iBD^WWK4H8i*%GV#7T*q|Zy5c;pao_*mDVa%VU-#f#yepw2;=8428A&= zjIYA@I*fP2crT1GVSEzC`!blr!}vhz4hdtZkYR$f_WUX}Lik5vj11$$jGSE_CH&)z zWVDbb;u87TFvf-PMHo}U7%xSih4Hxz#i#7)Dm6jEhW00BEKCZ6p0iP=$($77Q^S}R z#tfM+%BORcWkx2?$uGm0DMHFwWmXv9gz=-;oGtiW#{Rcq%*pUPZ@&-Yhm2(KD)kdv zkt|1YUKkU^f%zg~TMNVZC5)Y6>?%R_B2SoyYh)bQ;(96F5XMGUm!>y`v6(Hd^5=9*rtbDIwhG@S$Wj_Sy-Mwn z5hK|h#-1<^gmEy8y`r-(QaZ&gs34^>9 z^k*1uW|$-$k1hJK^=u8`>>9}-28RKbvQbTa`V@5pN{)=+@a%6(YZ&*T{`X-&WRqp zS``;wQb!3L%+d!U&C<70QgpBG2PzZyfzmnxIy4<&DGKTc38DV#uXFo~KUC9oM07-T zf5r__Fa>Gc(*3>5*8NSAB&PelCdpH9b$B`+&{0-LB4asMM^bnhK|03fILO2Yb)-aC zCya7B%IkP2Q;Q1e|D#_aBhRa@bc~m7R?<;f$7~(n>UdPgV>;UEXs4r!j>mP>(@|f? z6FQ#M@q&&TI-cTOv`|dX>Zqz?&T3UHBY9fLGlDBu`#RNyKd0k)_F8HYYwG?DL#A3n z_@D2!h1AheSI6$v|9htQ_tmO_j)pp3)6rD-Pmf>J@v@FrMC~O(3Yi+|XrlX1`8F1{ zR|P3AcRhy>{jx>=yFIh7>u7vErJ|E8V|K*)pSFqNSp8YaMOGTk`tXbK2|Z zz`)S)E@w(KyXfeuqhqF4Cmo%2++3}g*h)8%zop}C9dGLB&H=oh(?ds39leB8hpD%Y zKBCFeJPBRxtD~Qefuh!5e8?*ukZCI~`;KG>39{CEI^NgunU2qO4AC)E$7mfN>lmhE zxQ-8Xe57Mv3*Wa7qzd~rBIC)(jAhyx#reIS!zQROM#m?N5RtIrSWz1%nCAmEKb7nR zE}WLW@mkk&ChC}^<4YYgbxh{ei^2>YQ*=y~?o5+*X`lMEGhOWaU63)!Bb0xo<7=rq zOUF0=r%_+6rJAGTI~|*KY|-((jvsU^*0Ds#kDQ1pS#x#FlPW)DD$dujK*!HI7K-Hm zx5B{tMI^=7C`RM2Iu>!=UC-$x{w&q8Ovf4>Yei?dgy;$#e7cNoP;I4-RU%w1NDHh; z=hsPglaBRLk;)r{Y!u_nGUOh(m9tgHHXUbmoYS#g#||CGbR6f7p<|bhgE|gzE$Had zQtj7qK*t^(dnL=aL+lg67FkMzY?p*t#`$3#M|ITdq$oL(nPuuk)~FLaAHJ1yQpYKJ zD82YiCgpb>r~gl|oykmk-fJk%>-a;*UpoGlUR=<@=B^08D0oTma;B|6B}-@6#6P0^ zA17#5?!P*&>bRCE<+J+N^TzFZ4wY|kG+L^gQp$x)hqDZ18+hEr6Q+Nqlg~gC1Fsp# zF#rSk4HPg?(?Bf)1q~E3@UQ{?*Lh(BMGV|+ptyme2Fk5bcNzXIE4NO#@G_ zQDFli1AJA!X83mrmW=e@aY`K6L^WKaTCY)t0n(t68uf&MCk=T21S7U?&50)~e1DV+^w{Lb`HldicLebT`n$z+VRbHqg^RF9VAVEH=>FKpz92 zab66(W#DZCLktWx(APje1A`5`YoNb@0R{#dc*pP`p5Y6-h%K7?|8~v)G8<(0uR7WL zn!NVM@LzhF_jQ~18D_Or^R@o#%Z3>kZs21BV+?#?V1yKnG{El=QRhR>etq?k;eTIea*Wl25qG#;8x($E!JG4UA*Ne(is~WxN4?)`zL#SpTK&6Ab^` z4Sbp5Lpw`zIN^)A zzB2H&fo}}V=EU*8oNB9C;x?7}Mi;)2jV~6X^0y+)yM6b)fq4ez8~DM%k4*pN@QWTl z8JNpqujjuQjdl6vs|5yrHt>t#znEwt`L!HAgT&8#Fw0hc6@w)FVAB#hY2dhl69$$U zSZ-jafn5ex7+7gwi-D~MRvB1rV7-A22G$r@Yhay>B)^QqSFX_x$@sPYUEGa^|9PxU zVxO-g;{svnW)7^pJ!zYP?HnI@yER|e=D%EmUz8Ki=d4w`4eT*cIU9!!>@~2@zySjX z#S|xTzu~_JegoC`DwW=T#Y35199yf782ERsI?7cnLMrf|@3_~Uz@$Yldp*iBmd z!oL@t_eljJ*ZV(Qtp;w=hdSzC!+(PGDubc5x@O?IkpBcJ;k$Qk8Mw_AWFllD%S5(` zJ51bZBAMxySTB0mEP*XS&byJuhwgL3_Um z?(lpsdO)i1_19F;OoUB5V4|!E-GpJnG7&TVcSoD-3%~zpBElkm^^*S;NSku!*)|b3 zkuZ@o|Mxu_$AoLbW5?I|YFwCaj8Nq6I#tF*u8FGa{Eswob+feTI`yE5l!=E-RAB3M zRG)RKoQd+Lzd58$@E?l#6;bl4U#W*pC=-=UJZj<*)89-euW0)3ZX&NFl5y*N&h(h+ zhhi1>Vzl27Ip6>Pq=~0Ej1hbtK~)pgI5iR66~WUco-y&Ui7_UgHBsF}Clj4bJZIv0 z6EB*0i37u5*E2DDonoRw1F6-}#OuYt zueTFlHt~vyW+s}OXk?r2!YO@K8zHSZDHHu~`||VLmE=R!?b*Ac=xF-iP3~ag4I$+GXfOuT90Z4-UP?d~Ren&@TvPkQt)eS;*uCEJH{Cts@{!q34AU%Sr#W-%4|ndmP% zH_Bu7s#C#KLOsqArz{JlcmYP_`?S)?fHnB)1 z=ob^eN+>ci=ko*B{ncXjVv_%C-V%}LeF}Lwl{0>>VBk$qRrxJ=6OZw8@RGf2z3&fu zw2n*3#3mE#O>7WP@;-x3Wa(xTTST9ny@;$=Tg5EN4ih^~TrzRl#4Z!NO&l|E+{7Le zd)aFfhfVA=v0wBLa18kkZn4Q3WYY&3fuAdm_7QFf>wQm-G9*NSoSG+iB5mRi6BkUJ zGVz;-7l@!>1VtkL!YmX4YZZ?8&9Nv?pAr`F6X(Su z|68_qM36TfcSle>f))|9jG#mWB_pUnn-Sa-L8%BVb|iv(Bj6@bI)Xq1_eK2G%5=Yw zS7pqD5riYqBM3$O4TnjKU{qhVXT35q`jH4s;eV|6t4A|(TCgLCM^Gk$+z6ZqTq#OM z;AM0YnYye|<7c3jWgCr6Eo95*NNnYu%_`PzHv`hzQLC7WzrHe*^=BaNg-Q zXY=!kJ`Rdtu*io`FEg<^GlH^mNSeg~iC`Jm#q8YKg7XBw zjbKg$-w9{Y_YstvolEjVM)ISOp9JSpbAx}qKVPy7B3QCP{T#tU&ZbmcEcmM+?JSC5 z!v;mNBqLcWi(r#T*3(D?`8KMJ89y(J5BF~LJ=rWe zB$173TLjxVo=JR}#EuAdMsVE02?x6(*iAJHo`pSJjMRzZ%P977vd+6q6QkHq{c7HU z2o7@3jNmZGIf6eTI1<6>!|v}9%&qAirNM0PSOgvU3ZMv1L~v3#v%f{~Od&@l?LHUh}rDsI#tl&A(tg=yEh~OfZUKEX@xD>%_Gn;i>yktm{3REy&2D6A-AQ9Kkyg(&PO;!)&A@qko!qHv?|qR6wux(Sh& zi6R+A-iUQ9=+zfL%SQ3TKiR1$%0=;D6#j7K_vRJKD*t~xNell%hUH;eh~m*G9*g3U zC@M-(JS$%%A%!kv)9uPpj49yFDd-WaMDchOPf96^*!L%d|F}_&E9gCykynl4SDDIZ zL{cM)nnIq9qIwk134ak;oXY2gzaY3;T&fjCoha%?QCoyNq+j)-sGnC$uz_GhK{icK z*dp>fh+K8}i6b#F}F>e<|dj|YQ#l+?)>=;G2DBcv!PJ*2UyF}4d$o&#R-J|Fc z#aklj8AY!s`b5Fe=q-{S(%-_He4DrPdyf|M-j0HU-&c^rfd#z*Q4EaYlPJbU@lF(j zq8Jv%@F)gH@op4D#m;-O5V|7keaSMCxh{r8Q6?)NjgS*RkoXxH#VFAk5ygi>SoBd8 z463}IjuzpVC_WZqif@cY`Zi7^pD}cU-uO)2PotP1oYliY?{nb;3i;#4J!(=Elj*$d zS6@UiMfg;~X&L!+27l`mb!Lj>TlPJQuQH`y3z-$=XF;;QiDI^7FP(SumCX7sitnTT z2Dp|BA&MV`uZZF&PF&RA0J-~>-=yY6LHtEiRQR%tWVw)6HmQ};99v%{WVPTLj^rjq;kqc+N3kJ_jZxf+V#WR5rYJTugrX?; zS?-o7wnlL%io;QC6UiRI?SfR;L2JTyWhA>92AdR%nD+80AoBf!2Lulaej++Ygj4g3 zkfTu?i{iNO6N0}*aWbQGO33U@>USZhGg($YEBu@wv*)AuBf~EUxfsPtY4NgTuL%Ar z_?IAS{Vn7l!G8s>3SJYuF8E&*H-u3CrjX?=ayWyxqsX$5ZTSbUd=~OsC?Gt?0)*Un zzXA_i1uYb^5VD|IC~TpKg%TD@T71d5SJc9t7Vff8%)%WO3KsQtZ&DXFsY098-J($3 zf?L9CT*RAK%*O(yJl49$!hII*w@}K$y%ruQ;tQEh%}7zdw1t3$pjb0ED^_ID#RVy1 zSZqctL@nqR3=5`(Dw`FHXzI-DG%Z*bVxkteU<+ZRtX_Y!ip)woqE8R$YQjR&!U79F zTmC`3jD-(q^I|%eE?Fom!Z$b$79O;avQW-Kc?)$d)U%Mb@Q{TkEIetUf`x}gxv~Xi z@rovEYq6|KB6-9@MIp5R;I(`+ie-^JYT+@u!Gx?S@E*57{C#|dHSkDS_bCg{TBvTJ zs)cG6p3Ye4zgaz#;cskK&slihLT#x|voBbvVSz@-=>xH*1y-pg$ZQ=8%^&gDD0zJg z4J^EBp^1ft7GAW_NG#tp)l1^oE0TR#jF0J&!zy&Fai(<|dCfvo3vDg5v+#OG-qJ!d zwj#A!NW1J26WwSfI;}IBZG_M!OWRxMAXP?hR(T^p>|~*{=nS>c#X?sL11t=*(9Ob| z7J6CeZK1m;`~k0rg_{*U5~iLOh}XwgAoj7)*FrxFZ&`TTLS2G2B zW<}vU76w^(*TQ=i23x39(I3ejg>n{bR;M+>Ix2(a9c8K9K>|z?)>DRReE%tJGxCXI&~!u`t!bG=_B3)Hkwzr?b?; zr%h8|T9_%MZ_^aBUs?Ft!Yq;GA%!gBJ}}$Dw^El2f8jsr?=Alj!1SYqA2NJ-HSebk zpKD>B@cDw1O<#GTgT}JYbW=y{N8S!_6ym?@Q@?;<^tXfWOXRyAIf2K!z(h9WT(i{Xx#e-^~yEh-As&-03SXUrcoub|g7zgIkl z5-}Jtm@$-$;hq@okD+u7rDC{ODmIgGxG#pD$V$q|8ygM85R4%lL*5lfNHjG;p50Ml zN0*cy16`ue#7GR$7!smj3EDBlWBvs~EQY-Ec}L`)per8ooRFu@bd@A2@-l)v-KFP@ zz_KxvXHU2I*J}^P{G((lhH^p}mV2|kbPNy0P$7ngV|ZRPRSb{BP*r$E!6yW1q>_-z zF+3{dv5dTmkjDj!S9yS%PsZ@n|H)EPErzEv`p?Ahtnlg?$#XG$-7ZD77c!C>G1L^! z13l$+VyMe@Z9Hb99tR|bwlTDep+O7{W9WR$Z6o+%46TK{6vN9L-WVFi&?1JGF*J_h z)fismkY0AZEvn?Abk!}Y346Ll%{b;Zjp6ke-u%bybIhf+W@4my48xbEnQaxrv>~at zwy3dNRMRc$qhs!@EsAoc0#~!!$Iu~$b1|Hc;SG*$44W8@F?6Dl7(R_*LJVDE=o-V| z7~bW`{N;9Iv@kYeSbfQTGluRlEZ?Gf#BgYfVyeD4-8+V>Thv=Iyd6UyQM=wF<^JjR zjiH}p--)4r34gFt7^5!cYBZ+BzaHBh!{SU*58j|NDM={zOJ~# z*vA+?h@sY2Mf*%`w<>y7qfhE1u{=74k7F1q6-UKDg|LHG{^Vs|mRLK2mwhHuYN!zjO3Nzu9x%S*d;|2J&D3bt~MJkFER>!v)TujgmGl#&9WyqPD*< zFUN2thAbP|HvZ({Z*Tga82*jnFKLAp|K^g(m$kg0ca@ue3^zrm?icCn(#j1+X{LAI z?@d$x_igHy=+M+{DI&>dBggiab|FF7C}^Y2&FuU(3W#LV&{W=NuxrKs&R1B3MQl9Y zHpN=Ex2a;bKdN^K-YIyOjk|@ggDfg8yxgNK= z1jkqR9{JM^3h(-~$A*~IY=muarkJIIX(M7IZQ~&uQ5%*G*M?^!#ZvR9;89h&$aP@jkA4Ill!IyZC9UdR|~c)+DS?E z@-`^nv0at3aZ==JKx${-R0SIk+o-fdRkWdOFiQU$oO(pat?laW9m?9FD5+$l&JITTU=}+0HCWHY{)kfPLYTyn(s-L#;`3`mRid)^r zb2ggVc-_YHHeRsNQ1olqSXbR+s%xXBaE?+f8?|jT8j@nL)e&LUA*p&Ys`UjM2r`PO z%=Ds-mu$Rj;}zDj!Re;3;uq=0Qn!hX@q5#++W2XQ;&i+wbvN$t_pW9(nsb(IjI_~$ zT|4G>wb9K+OB=0hv}Qz!uoHVEq`i#}LfYB*{pU1C@(szdVn-n#yqzLHxkC{<+Zgkg z+r>uKPNnZuZ`$Z?W2lW`HhS3TX=8wmfi`;CXxuaBEgNssF&lk2BLh-vW~3PdG}2eh z_OsESO%F{yvQzDlChF}}9e1jCYz$(w*m&Q@tG}iO+j!Ro<*^xQ#sI6Y-sK}DLs+y^ zF&LN~p699{<&=yN{Lsc1qVwxcHOj_l8(-U)W#eOZghitBiH)%~CbGqa>2Vxb5q@Ul zQyUX(9PRJh-?LM-9*}x?bn41Z^|>hIIWtK(6(-xrb8L!@sWztBm~LaHjjwFXu%RtX zb3ncn^D;My^SAi%ohHwjX6TejiMpHH}*|;nU zr)`|GabEZt&e3jl)&`qcwp;xn!i$0z1o!V&y%wk0#QELo3O9cn|Je9fivF@eXZ{x6 zdtI7pgP-xP+PEf?>s%TGQw8?;o(!zvEqo_6Y<>Esja%HN;!tti<|2wC7Ka^2b{zTQ z&@a39#<8VsDkqMDaTJOJBFs=2jZBsM+JpfdoLBH!8qtfR4f>Am~lknSiMKl+97HE-#v;7blai>dwm`k zH_8b*^fQh`yObA4nK*LEMV^eK>}5B;*LP{k^z;L9JScKz%W{<3riRw^QX=VG(_4Pk zEiZniDcPeQ5_tu2iI(rH;XM*Z#W)(q@nRg6;{J*8(}I=bcr=d3gg+rzMeuP!s%7^} zJsHPSaU5Elt}4Q6aXh(KHQKAX?p6B>de6l1Y#i04sAe3s*k~Nj$MHfOHAGn8Mn0+) z+mRl=SJ7Z?5!Q{Po{&0%)1|0>91Y@Fv{%hplYVPS+U}U5{!60JB94}Eyd1|XaWsmf zaU6TDxlQAERZ6M$S{zN{2=z<#8J6NnzHuX8&QC#?LhNTelUP5{c9x9kc$y;%}9Y^0d`iZcAMzhbY>}{ez zop(eyD2~&&vY8z$*>~f3FOK))7!t?OOszf7rQQ^sVImnW_(2@wK1{J9@gtFpieq#f zBZcR=@o^ku;+P;3YJL(2TmLl9SHF5=ML14yd>qz3MFpn3hCUPd=YkXCctlFSh+_)Z zNF3kAF;$9Y3r>q;x{w)hd=_XTaV!_j z#DVmWam8bafV|X$M!f5azVwhBaWSnNd|KqyQF&ILRmD+ktbm*d*j$I(?Py3Z*cah z1JX3riWJH^9LJG3PH;Pl00{*2>-Si2%w`fxFhOCq@}7@n0&A*&DHr~ZoLZ*h#CQ}T~g`8STMLaqr? zem#!=gx?UnDR@ipwjgz?Nc@v9(Q`P+@1T@}dmR*TP|!g!2X{Cq(Lu>^nIr+A|#?!a;I z1|<$$2cCo44(d2aI7m8p+`$tL$~ee%P{F~&4jypOe`ESV2Pp@CU3AMjIMzP3eV;1l zpuB^J91Pm$rXB3P=rSFxn<@@(XG;BiD<9>JnxvG2$_^fNK>mn>iVi9X4{IJd@iDQm zbx-;Q!>i(8U)W<>V5%n_Jmug8QD)t$LY@_@Cit|2XYxqMqe6Az&j~X7ypZ$z6nPEd zH3e%47TB-q3Tf=%RR{GP)OYZ+<~4B8(7}ri%>8QmZ)r+iqVu}NwKJjgV!9ib5QsBR8t49J80#gwHR;4>DZHQ;h?!>X_E$93g0Ak+c;<|ZP7{U zvq9=Zv7m2Gv*JjOa6XTz^L{m2G(Q$h98Ona@N`Ozb?~W!2@b|N81LZL z-`T7+jKkg}l{e#`Nz8oiV4{RjpG(=3988ubrtMdY_p2`)5UD@S!E^^}9jtRO!@-vh zesVC^!Au8VIrvekeC=SCgCDpe3TJ)eU^WLf?0x6pTPdC6fRn`mq&0>s@p}h*_N&VI zJZ4Ea;8&!rc@E|~Sn6PzR9xWT7q0ySiedA!gN3quxPoZmS8;n0ofL&7Tzv-=!->i) zUG89ogEi8}m12qwt#+`=!S_x42z=^*qD$1IZ;aCQ4mNP%i2g>=-{fF3cLv?#cy8g? zI@m3xFNVEs4p?i4gY7c)?=(y$FZnL*KFno$0R& z*$_#77X^g;S160}f-VY6wvZqtO*f^B2wzb*MSh2iJ6+uEqPPpj2^S9I=PuzSC0vwr zaj%Q}q{=-m-*e@0Q!SOTHu6aNeix-(1YLxrG>}0KDV67MNzM( zE+Q_XF5)g67nX~di*KbztZTd2l;g1%^opb8x_Gp3R>JjnZ%^E-S=cY4O)9smo62?Z zfD1;^A1zYMmK8qdfTEaq+B+w2OyaRCCe0Kn^4Pc88n_E*^HFTs*=mF1`Movh@rsK^ zE}nPsf{VH?>ba=l`g>q47qwl~6wWM%t`19Y=Od@997dA*F8UP6Y2c!v>mTFt?7t}X zUlM%nT>9mV51S9D#x7oU(ZWSD7foEe=HhkXta$o>A~qFe1_pU^;cR7{beZE z9nR)l7o6Pr;y*)W9z)`sAMFc7^0VNv2C3*lHT-A}t1NP{*u_d0t6VH`vD5{_a+!oB z7X>4v_o&oz#(?gv5M0zD=hWHsY8Pw76kA*?^6F>PT+Zu6NQLzxB-tdhR@g%k51UgUXJNq-M z@1WE@}IeT#%9zLQc9kCFD23-!r8j-Ok5~XCzBWNPWgjE?i<`fTEDzZp{^92D;y)KRxbus0XBXF9T+3LP zRyV~noGJ&^O_AIdyd}s@n@!~Ld>(Q<6!cKY1OGdUfB8LB+?-yK&ttZLhdKw<*t2Qk z;JPV}KP&Q#sHlfx9?E(Cdbz{HogOR?F%NfnxZ6X}L&!sM4<$U@=iz>mkXO>fJswIi zHBB-5#D15^bgzfR#&n*fwCDspbU3K;6u!Kat$7HG1w)W>-NX9_71Q$6>Ii4n72>g7AxXh9g1LeZ2vW1GkOw`agwPoZ%X>(Bc*sKq50yMr z_P~S1!h`Bz58Dqa<>3(_6$Lq56rMk*9_0vkuJDA1Z}z(+k9nvflE(!nZcI}+=yaN; zRXu!n+x^AEuR^MMcv{Fag3o%W?%_G%O+CC$$2`0s*%}^R6jD==MrwJeExe9kUBP;S z^#!TZz(Ygfg%2raU&_c|_V9}EMuLq6UlnX3Nafcub(?u;?%_Soi-#5-?Bi}%58XVp z^w3JOtv$5ov_NU(>8ULJaT=$WaT_|5I(;VlmXJPh>kwuin_)L-!8P2WgA;p_tW!>8SMcuIE6 zy=zp8+4duS94rd&3No7-nHu6@sE1EIOz<$w!*CgdPXs^kFiOY>4N5|Yd-%%3*B&N%nB-xas7+?| zL+T4b66#M8J~box@sOI%Wq8A#;o(aUGles2k4nux<&w-|9C|o;Nd4$xHpA(R`<>vo zg3QkGF#42B!t}j|AEaIK)rZti9`YSlb7jQl3C?g#5?DiVCMsyPFOxJv-~P=vTSvp7F5lG=E%n&wKd8!{6M@Y2>iFz(sLHUGZ?y z!zBs++lN))h`P)T=ZNB*{>jC4MD;qN{_-&Lh?;Xm{mZTUgnQM)H7>VP?y*zunj`AE z@S7g~^KgTfkEr}N-K?XE3Z-tlx46UK^hvf{q&%9yV+rI-ASVGNkUxPtM9!zV3M60^ z$>N1f!36f)?-dex;eq-0woeCDUy2< z2$3XEO0xGRa9;xV3oo5OfaIv+b4o#x%q*0}bgO{>_{>rV?4yX)6kpv=_2oiaI9HDS?SeKZ-gh5MG#? z!O-F?pU&x$K-UDiCGchf-4hs*z=sL+NT6o|gAy2=z~Q5+7l-tlbpHf;C(tK>t4Gya z3G`(&KI+|lOufzcIi{XCrcRdg`Xw;rr&Ob3YCr;|%XRne3Lg7HC$s0Irz9{{bd1`mX$gFGTuqn0EI6)aCh(Ok z;hz%tS_qf(HwpYSuEH$Fc8?rpnPw;OZ31%=_)gaK52E>fMt@c7)Q<_=E|?Q7?eR(J zxgwt@IA3r<0zcDdjuL|>>F*f7Ca@@hVoBVQ#Nq^&Byci;Qwc0hU>S!rfprNi&)8of zq^dZxGJ#bRx~mgdL*6=7w@Zbs#}zlF^$Bc9;6MV*Zj>sU64;!;`kEg1pDmOpuq%Px z32aMXdjdPSBPDR+IKS}d(erT}Yq1g1n1P+N0hh;ZAM$H6{O4E$e^8AgabA{ti)gvq2{q}D z^qooEl|;oPDkX7u62+5nlkg-AN+fY#689(lc`PZCdy*)X#JwV+4@|UEI*C9MktCu? z1Vt^Jgq}nw361(Q)0{pI3mY|(Fq8g+#GEhog=X^x+>%;x!B`TucuO^IBb+1ZI8wwe zB$7z7gGr=BQYMK9k|>)*ZW8Plo#Ek(qLpP-=^wA#bgob*>7OZa#Of!}K=fZqqM;1qi?ZLcIsUM6W2|q1`}50Ek!>|f zqHz+hCeb8`cawN8iPz{x5?zz%#z;t_SrYA%XrDy$Bw8fVI*B%7zhx4wWGHBG-U-Fl zN$6M}X)8m`?oil)Z6(o(Zddc(5ab%9oWs~Ti7pIFSrJ@r{!}K>{r}N)9nem-v&PEJcElessAUMciWp?eBFQg}OscT%7zC__qsUA(L5_fqJoMZu;h z1R~R#{jyIAeN*U{LVw!T*hKR0^Y-qEuBlw|z`_A3Y~L>_bNa%-6b8{L^q>Z(FeHT$ zDU3|vqZB?);j#(mooU;PM-Ds_A(qr^pUuz_X^xUypU*BpRr*XVSejzm>g^4Ll(%CzQ_GcAN zwyLJ4usDS!95T0jHBL`qh9+ie{7xgU&eFv98fR<#A%!0`F-PNEjq_5NpTbWmEJ$Ht z3X7~i3L8@RErr(vIty$}VH3T{!s8Zxr^}~M)I>28n^X8Rg*67&8u*I> zNujoZItI3;@HfMqf$RqUNnsl;B!#0?cM3aF*q6fo6#h+NX9{~#*qg#G)=A6Sol4#_ z{>QLZKkN8@$&-E=2W0sJvh)~}AAr!)S?53s2kB)g98M)0Bi;cyuv|o)@)GY&+vam= zaV&-7DV$H?LJB8z&66pd(&owvbhp!VpI;r`awY}dewNWgw{woZtch_wGA^cYHHB+5 z!V{U7Qn*Y{Z|E>xp&gz|yF*{6QPD#OIU6UK{0zD60eO>LrEoiiYz8Kr_gRu*pzs+# zO=r^$ym3IXyiPrbmvR`$X}~mK8OUWIw}FQZR5XysfVh}e*gz2jd3np;jc1&!o<-RJ|dkbw^m$agLz748V3sDWZeBFy3j${4s`)Aty-*TAN?NwnW^AemTKJ>>`kwt>n9su*yLB$oOH0t2qWziP^= zG}iPC5ceLC3>3V|6tZ6f(n!vzD+4h{x>=q*kQ}8Zk@ujiYT!`=H4M}=l1NS=@L8jp z!C$zF9y9Q`f$|3>(-WGgu8|K5j76+jOUwB}TEg3t2I?C4lA<>7l!1B%1{)Y+puT|y z23|7I#y~>@Pa9}r;8_FDP>=kuF)i!;LRpQdyR(^%4cti2rVh#`2j%!$SxpW6&qzL( zXlCHTjr80r{pJRqqsCYIuOF1e=MA(l(9*yGp7}H|@t`Ep%D_NP@NEB!23i{+!E$0- z1MLj-G|$d%snQN)$gj zeGK$9lGXnEx_8#;r?dSv4$%04#t$_P)Hq1vlzI+t{K&w^28J2<+`v!+pBVVmz-I=2 zeb=gRBaN=X*@UPXX01Dz9O4~rV1$8Dv?2o|8Hf(b!*4n#4$A6H%uXXR))f!#+(M;) zWnhef?+nahcLu&OFrH4z#xpX;(uNI;GeD`*kjMrdoUTC)PBbvdzzhR34NNvL#XxvS zGV%255VfA|hvkfd`;|6{(@S}mH+WzNg zJ#y5HEprXbqk$cg^EEEg_>;y38W(Eh@j2F6tm!56M|O88Sp#%>GV9K+0=;I1fuD_J z3jT#weKzw~11k-z()4PLEbMbgjyjZ_EnH_{y@8_!jv3fMl^NJ>V26Q?uMiWnFUCz&Qiw8QJd3VzX4x z1@@~$$3-0zSW@k11VoW$JnQm*A-dyPL z8z@d9k3O3i63k?A%aqSVb`v>FO$rAy)c;&FnW1{0b&cMTo5z^rE zn8s^TR50N*67@! zuO?rzcqV)^nOKh>mP~<(&;*G{BMDxLb!(hcDx1j^dGT=af%&X@>5rPIX5twWjZ8dd z;&BsCnW$&t2@};#)G$%g#QC}oR{~7gk0d`C%0`%KnW$}|4*NZo%!5ywsB7YAU57z{ ziemt&Z=!*Th9;gilU2bTYq^8`vTQ_qizd|AL=zLwn`mL;Srbi7w7ZbrjB@+IFMUL^ zH42KUxrygY?7iYYazy@*j2)3Y*V@v=C#TY0)Sdox*>7dy1$J~U5lD+8NqB$pR%RO$ zZB2Y&;zPD<;$;(Wkzo_{8vnu*S|855mMykg>2UTTy?EgsW-=ZO6Lh}_%RAzd>^ z*2T1p*C{s>Z)!2_EuMHB%V|^`Y*!QAO!PJJzKQN8dYE|E#Cv8E$tNF?Z&R56X1-&h z{{sK#Ba--14~N3^I*; zbD)VqCWe{#+{9oLLnsPbnu(8Sen&DsHZhcze>5>RYKq98E}@P-V~<~iOswU8 z`)^I~5oR3yksf+A(e;H*ezQM(vr9O^#6;a18+@Z{IK{+N6IV@KGck>RVd7sCJ59_m zG1J7)CVnyTorzf{=9~D*#P_<#A5F~BRy3PFIL7>eE_pOr=#m*eY|f>{9+e#6Jni5d z?*bDGO)NLDLi^?-6N^nOG12^}>~d6c!MxPOG80SBW`3r#6feKxp}wXbOj%+(L!`a6>8_5hU;UD?C zwuH?l&K{M2Fnk@8Jed8bF8oX57L8jql83(;8}HKFOl;S5p6Y^^${tH%_%0LwF-kLv zZu57W*kj_Li9>V{6Z=f;XH;R}>XOW!-Z9Cg1r3#Sp1FRlWAZS~i7vxG`_gfMZo+}I zJ|>TA(Q);~1;E<}{SzjL6|AgNCQh3;qpk6RiHjTsl}=;Z>GJ?Bn>}x0_}JtV#Y-kG zv(1KyYg{pt^?!{ezFOtKdrS^ECa;^gLETv>W8tQWTPBKHC}!cd$*t{VAUTN^(k*0I zfR+4G&?m=a@!^T5P|n#cd_2KfKgFc6<*-0pbHdMMA-9D*Rua(iT42oKR|aE`$$S>_ zTgmiYz(Qe76x3KqBg+>YOQ!E47XBLVlPInkAP@IhxW~f1R&t`agq1`yc4Uoko*V0w zv{1@QA|d;_+}HX2n7rRYSqqsKvMiLl+d@SP4`{l)g$J#~Rv)rZ!NS8<;*XTW#tA;Z zQ|mM?`TUJNK4K*fMXRf1A!Q-5AT1acObf0B&w^zoPkB^5`xO=rACtBPhf+E&%O00S z8#w-P>01aav^y?2Sv-AQzOmB}dGEDMCibE%#1^Vrc+^6#%0fLWImpKfD~>0wRG-x{vY1FeZQ&VxZ&M2$PiKB!Hmi{Zzg$*hjU<|A;#rNX zz+0N>`ejb1J!j#67M|DH7c{oe*ivIFjjTWSb{Y?sOl#@9WTA~N?4YqNhjT0ac&=>i zEWAt!m(F7Q?eE^TsEyN6)15S9uTUwcGkGAE*xADC7XG!clV)b&O$*a4%&_p5g)SC8 zp$si_wb0E%UkmSB=x(8hh4(D$ZB`;WYZ) z8{rTOAJIoF47I@hItKYcZ-m@_;Zg)An7KT~)+QK)iV_~?3FD;C=Fv7w} z3!^N2K`HH#+?vihA;~RMwG;A*FT&2AyqYuPD+^;dkeXSIP9%G+Oe@|9$6EN-!X!GZ zg>e?fTbN*BqLsWZ;qD*D!tF2a9px>R>>zbMlx;JR#pdA-S{4 zU-IEr;Q|W_EiAIIn4>$9?8nw<=WrCPPXRJfddn;<*LwNY!U_vNQ;%bTRtr1Wc+D)@!|@Z6>~X`NLLj}(!gk%`4%)^ENyf+qM?p?# zIlC}6b;h=>>3>|FH!sQc^-EmKq zZE}16jvm=5Ux6LBa6(t0wQ!G-S2Iq^)0&O57S35XqiNnk4#~-R3m3G6$s0|V%@#Z< zFI%|6=p+Dvs}`_kC*AjJgW&W@LZ>cZPK;UVC zXY^ffl*(!-lDVwQsYDJ#PDzey)T!jFq9y{*3bbZB0!;;)3H(psdEHcVf#=xBA=x!O z+qCnU2PY(xR11NY0x!(-d3!5?38&<_Q}RWY2rNG(PxN%Qos#)aCxvYU+6uH6=s>Zb zmRqi-wbRYMEU^A?vVP+f-%+5Gz^ej1Ze=>BWu*?z)2HPt0>@VQB!22*P^7Q(E`d!B zes}Puz*_=yZOpULMWCy|HG%5_-2}P|{2=fnn-X|i;2VLl0`Jha1wIxSD)62_Pk|3< zFao^1p@yu01C_#m@lwd;7@^{=x72<1(u2bKP$p!7t%2WPM(&F zDUH3EOBkKb$dYFg-&roOLg06SKlET}T|bjOfnNnyQsdfmX(X#?Fj{Do7=`-?% zz)gYrHX7KtC2*Tz*+xa1hgy(kBfpITHqvcm*vM`phYc`$Rx+_)%8+p^r;S`T^4iE} zCtKgSZ4^11ME*QBo?Ge))(t)R!?oerNZBxKST=->=g&%$ z)%GQ_rP=e%3kSvN(zen0taNPjJ1a+=l|EyG?KF@-) zGPY6KMl~Cc>5*2kQB@N(gAu3vNA*a1-%PvjdgkLcp0M$xjk+8ln=P15lOqo`Y}B+- z%SLS*b?oE^IyiA`JSz{JmHf$trnR%^P<%dmih??q=&PP?lcE0BS=rFW(>8|M_{7FD zHX7OJX``2o#x|OeXB#irc-96NAtuZcEVQ*CXuqXzf*;+%Y0m+;qVsJ{3q zhyQ%t(MBg5uW;a-{WopAW#d&%zoxOXMqYZIgQ8^4Nz&YWZd>2!Vxzl_9yUmKwb4xz zq|I~w+nRpY#(NZ(re8WId5MW{waVwoAko`K9~&QVXg2!VnA#)beQH*-O$|O=E33bq zykY04e>|Eszy@()QDdNuK{f{47(#w_CRh0*t~`@Q;v+lxd00N>UCPY**iK%xkoeTb zXEw&#_}0cS8=td%8(-QOZexUvkv2wAH6JB==~NtzjXg5nlHjw(Xd7SI7-QpW8*68n zHC|5^jqje5?1jsuZ+P{MaPeG!|5$&Vjqx^S*qCW!f{lqbCfk@|CuUfE*Zl9Ay&nNNWn6?wn{uR#4<2HyVG)Cv; zX&Yy3T%_b}oTXEI>zuQ3UbFPnpMK->@`84A8X*(6Z7*}+X<1inT-5|$YIHg;uW8lu zbpzi8(*|xb_|vZ)-0$EvgTI5k4)QrjbCB*Jw}U)Ra=0 z4jyn&-oe8TDmuwB=|Km(z6!hK$#}>?1qTafnp4JEls0cnmilAOM;v52$a0eHrb-S{ z4#EqPG`GhM2dztH@dc~tBxmm}jY6ZX(b4E?^fcyq%3;mWLF7O=h@B*IvODP{A)?L& zZatY7&-rBRyWKu@RMo+w4qkK6*-7TUY7QDWXsGGO96ave2?y03)NsH6Sx=YObWq#D zxObdd4w_t$UC3<*r;dXsIqJ?1f48BogU>HW(%D~2)}M6G`VMAXNPhg`*9-D#2hTWY z>7W($ND(<`?%+8G9eQLmA(MMEn>zUSf_#>`+u~ooAUO*+<5#BkqI{j~(QF)i!}Y&|w;c3x(Az;5 z2VEV!?cf~;-JB$rc6ZRj0V5KJzv5zICq1T^TxXJa*TH)ZdUCeu;E)prPc}}wy*9z> zNYy)->0px9-BhjO$qt_F=1g&L z=Az7bNfNn`nC4(QoofPLCHP!Ld`E8`>vKIk-@z;gWiQF^^}Vw-QfNPD;zzQiiMe;n z=Q;S|a`Kw{Cr$zMI45}wU&Jd!G8{RlhvJ>JdH+XXsC37IhPV+V|V);?00a|!6`;C2M1aIQu0b}^(A@8 z!C`X6fn1Va59cU7cbR{TC4c!$q>pQwKaqEWq3L`kE3m=Sj1t>3={{SkW}R{16iSHm zjH`#`B?p%sTySualIIrRIRDtC|33?Q#lcnHPHE^fa^#j5oD7kORe z)9p|cTshMc3bK6{MO+khlK?`;;fM;maL4;Jl>(QOXHPa#%tdh*_qfTjw!&q}MB+Xd zC0$4t%0(#`rCmJYBGW|~7x%k((8WV8%DO1$;sF=s-Q*-Hchb1;$LLB9*(~>?xWKO9 z;$asRIj%j4zo$exUj%Rn=WV@hOMq z;!PJlUG#GCmWwVfdboJoMOPQyD4eN&cQ;vYb3c>Q4ejc5vE;Gk9T)Gqcu%W_qu_2Z zkGRlbsX?l;w~Ib52DunayGqaK>*9SE{n#%*X_@QycaxCL*F!rl%Kdcob)so(_Q@NVvd`<0hys=LW?VMri<@5G#B5yc>GGTlgS5g zKB>)i!RKz?_=B7LylTZO$zvu%6Bn+uf%z_eaav@eCp_o0--P7a*z$wtz${&SNPyyTYtzT3qf#;)wi z#Kd%mcz(EZz{NoqCtaL!amdACH#w4VgqHlTf9Zz)G7W6 zy2-iBQdgySRi1Wn#>FKUmtF8}J_Sy@J?r9}9_)FI7hF6x-MOf-!Bt6`YcpCM*(T4| zTwG@a_E6Nr4Hq|EWO(4eTitSTTZfBuFF85JX0v%oh~~X%Ub55057sz3M!f7Ea(F1@ zp|FRkN3(Kz$n7DIm-t#PkKY|BPq4)p4d6oT|R32gvl|59^jd0(a(TU%>az-YT+$rLwUo{Vpd8px`riaHp zJmI0bm&EgO*OFa&_Q{ospX-zhXx)RlEZ6~zxBGIcUZ^6lOF1Nc*^6yip%<5 za(I$NJ)LDFc|Ug&>z?+&zBmIm^6(5bwLSCYYqHNZ+1Nu956^mN>S63P+1lej_hmKn z@IRd;-CUPEr;+VEughC#Wc`*NT50-)yCpArSa?nH(o4FejmEYb+j;owntb_gP0}4b zbn?*KLmv;XczBfp^w7miPBy;gp|gkAwaod$hHrSuu>?M3y{St&z8CV81&80&LpKj^ zQ|Yvg?8ym=?%Dt--X5Bu-dX;xzKfpqo`;?u_%PUu{Z3E4*vKr?x6*t&)z`!O9zLP& zJoKZrc=*7>haLvdX83y}*|SbulXu?Nljc7(4fHU`!(a~&-^$E;Jvk3E#KTAQtRtB$ z`B;~e80ulu-lXI+55qi6_b|gt-YRk|pL>|uJsj>~1kL+E=132dJdC@UIm$z>eVJcq z{8Hm+4_|rU2c%;tIuGAceY%|0zVYzTbxC5JmwX>hVuFY9cdzoZ(1|oZU4h@jvhm5f zizyzOUzbxoOw(C@Ov+0$J$&b3wuc`)ym?)IbY0H!!1HoU-+P#FJt2N18+5~2{&Eis zuFJVp3b*t<{Bd2*^KkOIobTZ$O^{xoiG>~(X=3r+^7I=?C|K%YnZCW0&T@-;g@>Q% zZa3sFR2J>|hU{=duG9qS4{yjd9@aAQ_{imBorm@GK@Z10Y@p41*zRG6hm91thrd1i z!-&TZ?#LVCkC&Ws8Gj>LtN-aG>zV%NGXG+z@i6a(+;~GCyCJuFNWUpd-jsY(!$b8< z+dMcoCHDdT^{|s6&ckjhi<>_r^x~ZDFhK30zyb<8y@GL!Id*Z^3Y{|O9 z!$o?E-sHceO`Tnn4L(3!_Hf0+RWEs%+Bez1#-T0pnTDiiyGaw}6yPJfpEP^hLpC32 zej<~{Zzgkkx}W$FyUXxV?>&d<@RhVXXLNJ;;72R0!^tJLk32qV`Kaw9uaA5_LLZTj z{5}f!DC(n_pZrx&K_7*D6xQui_-vLUD&i*(5f3@ZlCrpudwjS)JRkS^N$5@-)<+2+ zoI~%^Skgx+A4Q5~mG+Z2sw`)E_NKhwPvTfvAMM_9%5gY8%IlI!8Xwg7kj4r=9`;dD z)0rB1<0C%i%}l<+V9N4gj7bimrS4uee3+WHd}Ku8*gDH1pA%D)Uj_$Fn|~YHk~7e8$J% zo3f#wJXb!gk=aH*8vEd3)Fv7^1kR`9v<)o0ne0rmqvw45&rg)thKlgf!cR7w8H8K< zXyt>yfco$)`GSuZeVo53^W2iZ^U>g@Y)wTpbY9Zw!AN(leZ69lH$*s4N1DSN3o<4f{*w+I4TcEd(K0f~P zvBgJUnigf{K0dx%KGer2cj?dS z`fT|#ogJp}bB)7&jL^hLjjS_@4x;HV@0N_F1i6LYn*ZS>P$_1r*W2#eiKu?g=w}f`9b54 z8t3?!s|jA6=VQL6f4W<8BV5|^R#aJ=JJMZJ_7K8LK!!2gH7wEq}+P3v-XLo;{ z<6WUYF88tpNDFY4~Q)4cTxi#j|m{(&yjl3&=kg##5wSocIW}yHha>~L1iUcUCuV%$= zu>j!$_98SK!pH} z47Xf>2LhB2KzY{v$9>|M6F=@g7~luEZ4bJ{E*b8_0f>)itQcV5ZOLq=&R*7ZDu5Bd z4d4YZ16Tp<0LO;8pX6}GL01I)Ho?u8O%Yk>=t~_Bxqg5%ZN0MpxKV&W)1k&qkGV6e z`Q$_fAd<<-0jiJ=P(47^0FM@s)dGGc=RO*MOdgx#vCd;0T{iW2fU|I!CDzabtQnwI zfc=lTw@mlH!m>8$Ek=ts{W@&QaG9PAP*>AWX{@KQ{@tq$G*Nl8^$c4Ja4o>~0F5c< z0Mi4^2=HuxrU5<(@L_;v0h$Ns9N_f;&jt8jfQ|t=1$aI{ivaBdbO_KgK(%bDM>aJi zn|i6V*(w0>1?p52tu?abr2uX2(rp8@yGy^!X7!D;vZ+Pc)Z0s(J=xSN0Z69JT1AM>4!AcEx>>_;rcYyJwT5D zB$(a~@XlTOT}`|fV2i%gJ3yZR{Q~q4&{yBfcGA+-`vH#YW-q3x;^`_gT@B!P(^cbi z^>Vrz7+_Fjo`{I0X(eEB)q z4lpXf7Xc2YtLzzSM1YY2F0OJ4XQZvu=B@GW(k zq1eU#uT9o}CPQ_|P(5}12>~Vsm>OVOfcm9PN{>xVBHI~ia)2ppCqvE8P{j4R{_YG# zxy=mlU4Xv>{1aeSfbRqRLf;H9n|>5vaeyTOehe@tz`_8F0?Z9?BSZ0L4(A7$r=?dE zNjpCUSU^95x+6oDu=gtZ68T&jU|E3W0aj=wHiCKu347$TNlw`Z>Sqe@YjZHv$^feZ z{1#wifYkxk1Xvqj9nF%HQ6+aG)MBXhyb6^kyDFbuZ3wUj>LL_z6Qv#CFKusecGW7o z`h(VzU44*UZKj=PSASBH+12;iRns=%mH=Bh((LN3Z%pF00NVo`4sayEjsXAC*8&^} zurt7}0RJ)IYtEluomkz*>}pSdz1daS9E$4L%fJ%gQubs-IdUWz=1>O%9174ohpLxD zwauXhXAp#mbi%B}nH~SLm%d)f+k0Rn6*`Ig_h50^AJnWQe*UZUwl_fEnV! z5ZOYcg~%VGK#24Z86k3p$Q1%1vWJOF=Fs?k&P2I)Y-x2)l{-Y95P3u7(^vQARM*){ zx+<6}>5HjUE>$o@p%7(4+#e<;Q8+}g5XD0Txm1x5MfHu(==z;gs{n5ZWZQMSt07>R+U2Vu9QYYqp8sf!BI2aG1PXsRrlO#NN(kY z@Hv(cVF-53PQS^m=Hylza;qprsXPfAGQ`Q;iYZqfRXIeJ5Ya>lW<1s&QV`grdl+l9XF@ z%&Yq6O_={u<8vYY7vgzcnI6jW*?HBvys8CzDQzQGp}mLf#*vmiz4}ynNM{H(J{oUAzr&XWCq4g6u7=IX*Qo?35oafC5HD#h&My@ z3DGyiTOqoHcsIm*A-aa>##=(X6Jm5e)jh;_`BaY(!%Lg=vfuKl1NoA%+|XDozv`*m z?-ioACanCbM*gHidyVgh=ojLH5Fdu1b+NoZ*<;dInH`f~4Gb|T#NZG^bcH$k5@Qj= zIQd+kUmeJ=hKBfrW)q`dj88*+MxG_QNDK?{Iq!<_PK4nhMufN?;zo#(Ax4E*5@KnH zFT!LEIXT3X5MOdoA-)PRCd7mg6GL1qCH|;xAAVkZ9pal1V?%sPW1CyyVMLO61A;e4?#ul;t ze)nP_^ScnU7#ya0--nnTqSFKJ+9}@90*d&hv}@fkehe{(y`1xyCQY{IljjhNLM*1I zli>|U`-&o84Z(pdr189B&$?yzn=4+dZ{OT(G|DBGg;*Y9M~HtztO)UQh(AO872=l= zzlK;7Vl54$uUHvkH5J;xUZt~Rd)q9WRzR_29pgZV-#O%AVgmz9Ww9~D+4lZ#nr61@ z8L^2hWeKJ;x4l0osO%2Y<`Da~3KCmFYz?uU*-^%Xd&S=&ZkBUTPPhM|sP7f6n~80- z=Vqc!X_plm%n&<6>P?Dqw+q+dGmScu~x&V@K1;skY3)I6)Tf0Fk6vtT-< ziPIs@+$|Y8Dv@gWvG%MT-h~jCLtLR%P-4_h0d+|edHT6mslHbBvKvO<8^*n{bB%E| zcHVu-y~!97!i(TXxXs`np-hDPBcw%0k5DK=;RqQK5FvMjJQ1=-s9DFZ6xq2VEGlj1 zh>%kgYdZ*L4-`=K_u8%37yYTyiXA4HL@R#P%XmN zVL}yDbK2STR{v4wi3rsr)S&z$e15=qp`fZ2p>~8i5uPORsej~A@o!$UT{FLK1QK_$ zcZm8?5<`NXZleedBJ^HwH`K#HjYs1rqLwAvzj2?=!j?@;kgJM zB6N)KzX;Dqcqu}g2;G)?y(b$jBD9S7Z-$~(gzx%@7b9HwL%a}SO&`&-plTiA(|&@f zdYaRgtbXj@JKSg&A;-&h#gF}$BebWq-x2d(u!${Nr*(?(N`zMM(7n`afBrlON2fV#zhz(p)a+=jv{;=pJG{PqlrZo3RA30=v7GapK z^ZTDR6DtpoFoG76(_H$p7#V>$O6!j5`y#@ZnjWq3D~*HSwR!2A2xB9B8-X$Q(=B3p zZu6^x>P%^|a9ruUJJsH9>lHgyMAtiM6a5ih_j{F{_Z;Kp8f&gAHDKPUko3 zI;XQS!X`~TFw6R#QKEog;hz!yim-$J5@Ab(Z<=~z^Vs`5hAYQd6spGK1&!%^l z<2okJK5Acx@X-;m{T0vbGujLo;Z4?4Nt1Y`UP3@3yF?@*C2~mQlu1Z=L?V|&Zi%uI z2T`LrjAi=b)j5F;CyRbxYi55$&+vDvb62zh! zi%E#DUGEyGFwIy_e%`#U@`lEX0N=&gCv%U-F@wc zB+lm*t#2ApKbu4aiH9XB>cZ;z1WN`j6PXfOk|*v|C5e=TA(4Nm!S#3V9VQbpa$ikCVZBN3NSo4YqNPHu9-7uI~lQ({`+Ex;=L`#WQY)YbvL?emD z5>+K0m3T^`p2V2(Mm32V5;Y|rljuF%cw8fiCnTy%v@az{w_IXW%@minTGT=089p62zv}#DXeL&cdpR#Iq9r zlXzaD=}6I3;yH<5{&SmA`xQiUjgRM%q%Ri{0|$#168H9WD->2W3o8;6mWdZ6UXwxG=*AL-9tzzhdPp3W zI6`Zbct>K1#8QcOwOEEpd@k`GrvQmwl(59d5WXe(C&(=843rq8D-V_^HNd!3GAS%Q$>NfG3Q9+G2b9 zlY;a9r(FDBwkitmGa8}rNDr47LEDp5R{vh$a#B3UEce{NT!Swd4-j5Q0_7hBv$~yBT=2N^93#ir`V(JlN z$10;mPKT?(g%XUt)ry*=7qRzV?qZ4h^Xx~Sx0gvQm-w4PmRKS2Gp|alqv1*XDzQ>x zmBg}g;`xHkf^Eh>^DRzu)hjuxwH~Lf5^ESns@rdtbJt63koZkvBh}O;ZNX(@N?}!a zuT2@&eOqjj_+4TPoIfP~BBANc8voSTb%gl3oftDrY^8nXc9F7cnlZiyWd z|4QtX*de6p?B1W>HDu z%wq9IN73qxAaV1jbW_1na1|Qtv;@anO#EF`*b3|Ghzfz()G!|LPOeBe&=b0 z(F5H6yFAhzi>LubRAYrE3NI+UNCQx4$}VmiEftzk=9yx85%qB{(Ols<3RB^Eg%*nc zQ08`SB=%f$h@_8j=~&xoMPqPnuDW@9YlW8-UQ_5yJq|b8D6~~*r|_~~@V~6kUZJBx zCw5m>bWpgu)n3uWURy*l`wA`Ui1jM#4Dqi#BffgmJDt}d-RoWBb%kt;jTr@;HxzdE zHr`ZtOQDOVyK1~=n$2>iZVK<06eQkOct;^EMtY2Q72Z==sjy0+r$R47EuEg259;NjUQ^vn-aV_Na4y_Z!k-~w@45_ zrWq)VQuu;ar*Nx?8m{ou0PjzxbGEa zEBv7Fqr&Y>yVnQy98K)mZ#OKem@T%*n9ngPETu6k)bDF7pgiBU7b`5Jz^gdR#u|&L z@oe_}x5W}NklhJhwO@TuTrcJ*$OMf6@%zvNtIFMhEO}-)doRq@k8{epmQIVUq%%7uII8TUK#) z_wlzZwKr2Ngt+0o>C}OwVW9-#@?o-&Wa6r?iH6Bzrq;Oc%9LRBnBbq*{ z@z~w+%7+bJJ)yHF=?-_x7wk07X!`8kk{YwE3knzMK@6%YS;1bSDQbfBWd`tzHVGyY z*J;@IxlAS3if@XlB}LUOg^j)J+cb$7TZ*dJV{!hHps`hWPOSUX&WM2+kH>f-M)nvv zVpuUmjGQrY#kfC4*%-NF6;*j-tX}68jFB%!{ul+~dLiBU90u^7ck6jLjQ*}c{aqnIN0ULfv?;eRBUY86xW#dxupDjA~`cTfi#n{tcN z@&7-kj6dd;iP5u|VyZsWE*Im07?oJ^Y7*Zy z(Qv4Ud)nb*J2M8iN3vqLpNJ{VY|(yV4y^CxaOIL#-lNszGlxYrZyE*pPdlJ>e)Zm5;HUG>M?4>Xc41jjG8fOk$H9+qjros zF*X&mpNwJtWF0A{%5FB|$3)#2XI=@Picv2{eO-Zd8fapd(N6S;hQ;_iM%5f<@xxA$n@0Py#&C8)TfJzFr2VuKqcqJ+U+8Sp;);c% zX;irdH&4Eb@lJCwMkBLhV|*K9Dr*+DxxIYtoINha_!tvnOpGx(#*`S7^i}Rw-Pxof zmU|+N8;?w+r_s~Pis>}1>4H05y!2g+Suy6tm>=VN4mrjTF@B6O@SJEqLbQ9>$&+8q zp@MSSe=oI4xMHrRnO&4a{1jtBjP)@##8?<(QH&KaevYv?M#-J_(iqEPEYUQx_ntK} z|FoAgZuGNz6j$3m5lc$Bzc8?@v{tb&#;=-Yc4ds+MLZIp7guX2z~XA1#oXBQ|PLuPv@Nk(o~R@ATp_f&}r;7=O`hVq9h1i?KDvsTikY{2k+;7<(Bp zVr+|XagMzs#=kKbH@0gmv)FcuxjX6mH@yGITX}aEgTQBkg)G^v%lE_>x!GoRe~beh zbsqafjDs-_#W)t@I9+~^bvVWmO^_~pB>m`J`p4R$0QW9VCrD>J$ynFQd$74^m2N-& zgL@{%*%;?&$pxKx%kA^Da55Q#8`|9}B=dC>{({NFV#`qDk{=|!ptB1Jk#ks=_7s5DU#L_iQ!%KKuJlFS&Q- z%*=n@cl%`iJuenSaZ!}o1sN?BMCl;7R4WHjCWx{@aOqv&;42rzV{6q4LF{_gs|^m6 z5Au&g-?%S*6-B8e=)0xRdZVs-e|NQ75Y>a|8br4sY6MX;2s4OS5VeA+9fTT$FNiup zK0>874x&jAb%UrEM8&I0{U90!vFTa0fkabR6^d7$RU3&&viFRyX^>wc(^~L@j?8nO z+B^t~4E>g?3hP|L;}P@<-l?cl@du#=(K3j8g5WPEFU#;ML?8%$y|v(rzMG?RdYtsO z3Sxa{mEVcfgLrSD`eIPM`K|BXAdDcwL68T72nm_`SH=_x;@h%nG>G1x`>Ivax77AC zpfUIy;yBa|DCGm8>PLFc7pc>alep(j!NqTK|ILH&r}`?;`h>8;qyw5N;;z*xVe3$ zb`0W+htz=&s*h&6T74{t$Ae&$p+z;VQxH#x!;_pa?2udP=t_F$AWqcIdupNDucW_A z5E(qEJ{`m}K@1CGco5G9@mvtE1u-Cq=Y!}T#4Buj5HAGrVh}(4qxJ~m_0k1@U!e|b z;eRQJ<|Wks9`^MNVn+iX!^=W?32t7eB#Zf4-BgW3zCJ;`8pOOoN?*Z#f{gYT(&9_+ zz#s-O=OEq)f~k0wfOm)nvy<0&hXgT{vuL-E;qu?=iY99BIZDaT0#(|oZwB#J5ObMH z5F^<0L5vMzTo9vzSWrnHJzhOIMtwVo(Hx^|{&zS8Ldf&U)=K*LAU^y0W-{c&In>= zmVYEsZIv6H@qK`aWQRcUQO5PyH;`=Gvm$X5$ zB1rPbuw34-TNcD}u4Uc_tm0$zlOR?F5eXq0!lyy3<}?oCRuF4gRuIQIlY>|r#OFaA z3gYV^)^RNau_cJD{JHGpJ6X~H&LL$(5F0sdxDtct_@TNvh?AA{dDC(Y#m^AFqHYUf zdl1ov>K=}A5IZ?rX8LvsIel2YcwG7Ipzq5db_X-Jz4#v@mFt!Cy^>^K5MKqcUpR9( zDC7Wlp~^a=XWv$chl4m0#IYbgJ>f63M15|Nax{o0|WAT;CrO9TD(d3xZ!exE{>>HTx%bfSP`WawnA=T(keEe+9umaT&<} z4&onfl_As#;ol%`b2AU2a0vgg31zf9LGWH)?<#7;l4^kvcrB=4DD&?dLynNULf{=G z2q!5LLeUT^hfpPiyF(}zLg^67guvV1#Y36v*d;?KA<^9zawt+MB|2}zl?`Fm2(^3& z6+$Q%!uirF!<5Q;#Sk`(P%DLSpt8QIvVQh^-^F(V7b@$+{67BsP&I^VAyg0HkC^|7 z)!v#R)Cl3{(t%eh`v!jPqf#q`o#z#jx*^mHAvc7UA*^2Et@T{cDUAZikEw-9zxZ-JyYLNh#~PeLO6UX^EWUj07+P)PnfD1 zLM((QL+BhrJcL9D4~oAPf*nFCgmefFTk*Ir8G_4!7~tcT;d)hc-snGF#M5Ah(wc)6 z!u=sc1}gC?`o4~8TlPQ|eR&&SyAbXRfn?`)AF)0Evc2tnKyXkMoj=eIh463)kA%=6 zghxYoECk;08vBX5`@z7vp~{(}>f<3iJ6^eYRp}VQqV{U15S|EOb`_nxXI($>sSvt^ zFeHSbA#@F)TL|4lc!8sKRIPhXVOKmI!ZXZ-qqEQZ9Luu(MK7!5&vR;RP{!5KUJT)- z5PF61N+@%WICB>`gr1xOg;d_ydO3u>zbJbadtc$>H6g68q7M%7VRoIQPYADyLf%(M zzYzKhc};LY);dtgAeR22kItuW`ihoSUk~Ap5JrXYb_l~l7#_l#TqgUyJYF()gm3w9 zg_nQd3ZX!KZG<4nNRGvLg``34ywM?y4`D(G?{Ea``FPoIOek~laID}s?v`T}Mk^lm zy&J+<{=FK)pbvA`jmssU#K!VY@p)xx2-CQ%3=}sq6Kr}2OG8)|!h13Y-WU8Jgbzcw zSw)`_!u$|;?~f-6W-`xf>PK8+Lda)x-TmjCBhk4b%oEaPsgI@wAuQzZaq?8vd2i_B z5Eh62=a$fz+UgIbv?U>a6wgnxJcJeO@DTP%(JMpPD&&(8R@u%^`fd-`8uKx+Mhuz||V1 z^qb*3)>GZa&4**!SKSf9#ii;_;VsJhcX3?C`@RfecL;l!c_|;mw?C>3UpoG;Lf9X| zZ%o21C4_?^oCx8&5Dta#bqLRw_8jM03!%k)^=Js+gm5H;nq^epO-NVOyX;Vov1w2H zZoH-X#;7AdQ@#yBIjXQ$gFWiW5WWxL*AOm*@Iwe&-c(P8a5{t^IeZ`Zc;EAfn%Wtz zdTvncz>2=^RrPZr{KUPEJu^TXR#oSTtXWlc>Xonieqj#m|8DBHRrPfP72caZ$*(wE z@?8qy_YiKgjUim-z8AuuAzbHTFQt0QX;-+uO8Ty{&wc)DY~8=!Kdb7*Hj9)SA>0a~ z_eOONW?C&`ps0bn4V0~>_tex*U-(*AR!bNtX<&kZcMX&>P};!5 z1|Bi^xjmFM;4$DeP|iSk162)FGf=@mMFW)$R59@TE^j3R?W*bDKCLR%^w*lHJ*w$B zA1lMQ`1`C?svD?bpn-vg25K7Y6Mr28Z#({426E2(Y8z;I)i=7DPONL7o`K1WmHPh& zdGo#TFTO?wni^J!RnUw(7WYnXsUqM(hY*8v|_(+;5;gd)2^w5?rtPzyOt) zPYP7mA7IXvwcP4@wdy*_)jzyr?^Cy52@F4{b};a$f#(c7Z{RTlj~nP>psRt7209sd z!oZUTUVqT{NN0^#&&sY)IvbfAz8`E>rv9arFCTb{16@9_ezUI|Yf@c*#=x@%o@QlU zS9uPNXVUoU!|?@F{=NN8XSKV57YqzEFv!4*23|7I%fKrJ!mGXC4ODs<=xJo`q!in& zzRcd9qc9A5)YscU9|Kq7>ODo(fdy4wCwbLCUjzL(**5z68@OCh<#iQulGh9jU>&X~ zxu%cf4H4f3@_@Gce!4Vgnx=*t$>McTrtnU?EGNrYthh<2SYMDKGhd%Y1Wq z+jOf^zOl-!c$tCa1~wY_!oUj7Ndp@={U)lPutNrAt`&b~V3mPSna^!?HJ9^9-x}7T zy56+7U#q84~>ifK(8(1fVe7%qsSG;>l`sdV9H*pmh*kNF&fi0X}g?#^v4%Afq zJV?3K0CAgv?Lx?VeXibrz{|5qysxn{CwI4jJqFGiIA>t5fqe#!u-grMWnjMnp26Ua z<^u)}asjsR9U7KTyo* zg1+bH`N-XczM?DD?>Oz}si!znZz?C5zYy{t4E)ILYlTWqJk7cHsgL1|kO#N>ell?0 zz;6aF8u;13F9v=!aDjW^0q-2I`cpA=RZ~ANHgX01UD3C)mG2UBW3wK z&(~9VLh@QwjVEUwn4(ni`mY)IleLZGL>$)*+~BSlMXf0QGH{a#!?+U0Ep7{(JYmcT z;~xY6a<+%@W*D~({AZv|7;VG2W1v77(QxKv4h6%=3FC|EdTyB4Y5?JC7=^+p97ZFF z773$h7}dj=`<-&P;76rA6~ZVMM)5F8gi$gKD&+)Ag;6?;GJ+Htn5wKqN%EuR!=OT5 zF^o!*VdXHYic&?8Inbfn|KT;nt!5at!l)faoiOT!Q9q2j;=`=+lQ30-Y^sJ?l3y0v z*f@+P(xRqBp^tgMYqiIdxW$KBQLAyLhcm| z3WfxYFv3D2g3N~njXdl%!yv{4<6$I(Sc0~oBbXF)1?is>k``bnay^ON*|x znCDAUI$xyrau~hB7#hawVZ0K?us@W(Y)&yx?=bpE^wlsJs587VTj?j({(`TCF(8bA zVf359zb%y^VGIgmu;iStutg+Pn(k7n)zGyX`WrGF!@|fPm$$+g5yq%6-VWofQl57T zsUJ=7jpX>+IgE}DqhcA)yJ1WWD@^&Rz zL!ZRXAE^AbNtqnRlrXy1(5Hs+K8N6fcUlZ;U2#|;VPIC|XQk#piGEIyT|q1P&r-d7PvQlMUX&t!lMM4cFNN{D zh>Ttq!kKn8jBBz6D@E~V7}vviHiG9OxDm!*VR$0&MsSmxe;5@as2IWD-2AzjM^Gq& zkB<2M4Wob%^4pv|M|}VBS3t=AGs+hg{RPFEll8eP0*d9|_7#qx*VaI>2#O0S5Tf?5&Oj^N{86^6P(>IgCwm3qSI+%SS)YUoWP zSooF7&?th&!YMWp6B|ywnTX8=TL>x<*d2T{sS)@hh(!>Oz#oAY!Q`m_-UtHHx_csE z59CU7*xr^BWqVtRHBXRHU0ThaVTQp7*y>OOMg(DUDUM~C5k!Tjrf14!4buyJi3qF+ z9*W>$)+Yidf;Yw~_eYS7pm0q+9YJd$u3##HhBfuc+X6JTiJ)x+?L;S`lCR$PfYy<8Kw27 zdvgayFo>QJye^)DBN!qi-+>9~!wlcxC~ON16B84XQ+z9e5t7^32u5xDBqPSVnu*TCP6;DZQ0j9_8}lQ@?mm=ej{YMCCv)Ck_MtWA?> zw<;P%hJ5lKO`=m_CNmDCkT+9V9>Gc>D+FuK$)U*biTMBJ_pcW6 zx!@YX&ji;B`mQO=cAapN^+GmeO`Eu=JE_|u*dD>=2zaQH{#&@*t|?muY26XQ&Ioo# zuqT3D;{T-}P4xNaNDfnx|MGp#Ua8?ev9g8~4@7VI`mACzuxl#NaVE7|~ zD_MS3$Th(~#f=Vsar2Mh-w19?hPSx?vx~AtuoULToaz6chy|jVn%oiIac&^L^n%e$ zapb&(Tqug-QIv>+)2VPYvo4B7Q6!3@QQRHPEVuj_MV$_uX2g8R9Yq;Q zOXqxldX|mitT%$N^dfX#!)nhBEmwWXd1=!nz|mvy-_ra zqInc8qEHx}qXwezMBx?gk3tnf-6y1YEuFlvpcX~WRd1q}o*PBWDDH`Z{Ha1a$JN(O^?|d+$*wRG%=QHK`>#br@#F=Ll zycET=!k=S9gmh=NGrhDjydVmDqem1y zqj)Wf@$kGHMK4ZQ;f%f_q)!yRh49666kp9+_1Ze4{Uq97u)Qb)q8OO<85G4UA`Xq> zb^bMF;<|}9q8Jv1V^|XToj)x?+Q+gVqYPR(Mb}0Lip4urb+b3 zF^$3R$%N@qejPRAIk&d{K{WFYnH_7rA95nq)=BspkjG|uW=8Q*6tki@SX;j=VRjTH z>ty)6D5}=KmizUPq_CnG-&WFQeEU#a6Ly7u=Th98*W%k>xw1*p=lxEx9Ml_Y2u8xKHq_ zXy$Al^FJWbgMy46ie^sckQ@=^yR3dx$Tv|O6LLJOe=Fof6mJYtnCfH{-$(I7)_OLI zABCS1Je}3gu*bG${LhK

  • NR_2(#Na>BBZF`-GcNfX2OyFDQTjVh?Py07E(UzQ$|Qx!Ez=(meFV0 z3MMLMeJYvoN|mTr5wWU?YFTS_lXo04t*&KaazbllqOqBo)wNB&a6Y$=iMl5039m2M zP_O~l^)8JLtvC5!(6lBdnwkij2$^VRqPYpb3C-k7o^xB6P)vAC?5U#{^JxpGXkHUO z6HG|1n)rEIM*Ojkexr^aFp+EG9uuuhv^24JlJ>Q&6{)NDo}zu}%gr-!d#5(_ymqe% zT{xp%1G!Wphc$x*eHMtBh?@wTh?t0){Ahw^nwWK1BWeCxVD@BiJnr=`yUMqpX;GRop~Ns_}FYuV4>#~6TMB0G%?CV z9}}-~d`%29(N~fTHSxNTekS^J0?hF+yk=rRmJbv%$i(2RGDOJEy82IxJm+S4zOAcY zsjCk+@g{eE6C=#b580Z6qfoQbM4 zGggL+3o_lC&)LK8nwV%}l2otJf{c&5@P9nn$x}^CGqKjh=O(6`c+bQ_6N^l|Z{h?G(LlY}a zd}3mWiKQl%i}NzUDT^{bC-VEhp1y(;zTW?|WtEB5Cf1nvR6L8%&v^dyQ3e@4Ol&Z*(Zp^}EfZfzs!b*~vt1u~?0WhZQTo=%o=$Wh!#hQn12>ry-r6zTG;xbN zb_^wA_}j!kChm^$*r)n09ZcL617i5k#2pg_W7u0yAG=H;G8BlRR%4AMNAwOS0{PKG z5-l1-;TVbtAF#noH(IHX7nA(?vS^l4GKLwyHY*oH!TNeB;iU!3#85T{{;hJpp3dvK z^eG=hg%~Qvu+!42#!xMWO2QefETl>dwd?DQMt1v*`g-*kYQ*r8rPUO@Rt(fT*4G*uP8wzhEym1UX_(xL{5t|A&6J%%7M1Lg) zPYm7|)EL^ua9<3*7-kMrA~8f`@C(-j12NGw1BXW;V`9YyaX_(ay{Ngx#3j_vnqQ>y)7yf~QB)NP1EPZecL!=t5x&}V#8hAa1HzYbNh7mE0jA3{TZ;Ha- zU;Z4w#ZfqG4RiZQC@9deSN|-t*NF>jbTy|?Mi)pS`5=^ zouburG~x#_d>F$bE}2`(43>UIo5@mQ=+G! z7*#`Its=U5rn2XDa-K z;0D2sf=pieQYPUhiIRjO&9}y|ErvbZWMbGZ`py`33E2@tqXs(NzLevhhumxjsbBT;cmb^B#vkt-^6e%hT?IQh~sz+-^Or* z+ei#2V)!nGpJVui>!pEyGKL>xI3@gh!5;))YM`Hv;Yu>0H)<$!R(t z!)PJD#&98q%Q2p8#BVXoYoK2eY}Gt)k)6;$FVH+d{5^&r8t5J;a3uzsuEp?Y3|ECS zO8vT|q9;WrVLmrwxW)aXAzvblzhn3(hC4LH@ox+*=V=w@YyWYG_vPH?_B&sD@16iT z^@8zCG)FMsjnTW}nI!Zn6i4AW## zI*u}N)QqE69A)Du7supbTD3UJvy_H<#W*SnsStB$N4&}Kn+1wtacoA;%FX6i#X~^<_+R#7)QN0>Pxg+L!E(zGBk>#X&lYsXe=fw zO@s_-s53D7p5WSsI&&j_-B9DvssDG+!LKLi}-PoI=AiiUA=P8|wMdmT|aU za;WFUp~n%7BNWF+`*LbD58N9^(MEdXMmo`8VC5U-l7!=UOcZvw8AmLRhvRr8j(8l2 zIL@#4wvNN1Xyzv4m^fFlqIA)ggq~b^mp}4Y<-X@N=>>oF; zT^vK3YV9Sr`{KA?qSSjV)u=xZ$Ah9gl+`Joisp8R?7Daj*^WtN%Av!H4f&$B>m#(FAhz_N^xKugW^~a z$HF)UvlAvOZ^tn@jv;Jy9L`nk^*G*&V?-QpNOYJW_2F^6ndM!tYE(u_^zv1$#Z_%o z9G~x3n5xS%?VUI##PP21F>#C)GER`z@j{rx#5g9!@qQd1NHr#NFS@Eti(`sJS+S{c z)LyEQOpjyg741E7ppWOCz=zD_iZ&~b*>RYS^%)#)PB4y9W4-4r_0`5Y#V&2~=7@D( z9CPX4CXf2}%QTwiOLBTHieqscJL1?G$H#FjiDPpd>tEBB#<7g^pN)#6YA@e%uIo5f z#jzreBK`oCm78prB5J`=WYg1@^?T zms2q}@QW`nEjK{xS8?nYEBWf7+MzgJZmcmJWs@6gU&nDcs~iz!e`Ecdta6N15`M9< z&LrQ(aWal?ZJe<2eH=fqH!Q5Q@FV9u`zL`_37n4O43~TY_a<;Qj&s}w6DXa)Py9{s zs+Twwx%#+@M=1lgJe@wq8T=Ue<05I%d4@(+Ings&MEVDwHL1ro5PE5#C-$Lb3v zP*@0gj*z<&fDrl=$`V?O2rnvlw;&(DFD_Y?5G*N}pQ=m(WfSlu@Zf(cPxh8epk@NK z5-6WQg#@;3_f|}xN`hxIe3c}sG|?+3K%|Lc)dZ@EwYp#pLF%;DP9U^IWoVi}odoJ8 zP*0SGg7vf31_?|%m~mrhlt5$AnJ3FUvL7z7PH31&Z z_a%^s*trk_gjfz`@m2|SrV z=LEwTcq4&f33MBx^hsbKC(Icy`Kt-^6|tXSf5F!T z%U|>j5OUuaemW0IV6dbbB1mPZkk_dj8lw!u6Bw1XzA5A_!4ZNZ1s7EEy`8{l;qM5J zPhgCYu~~<42|g_5%g=KHd-CvIA}$k$g$XPcLZ3wm z(4U0i;{=unXTqgY=Tql0{jglpu1H{|So7=uX#%Uc?kv=`uqJ`e68JfRUlPbu)U^rh zOW>;nK2Km>0_zi)P~P)J0-HFmhA0~(x-o(8XQke)O32Yah z@0M@fnZVrzRC0zdCCTmt_6VV}mn-ydg=BvM2NL*>(=vgB3GjjXZv;sW3He&^Z~{lN z`cc+=ib@BDVMY0$E>w9raOo&{YznS{>F_TFqlX2=kds3FdDpc1tZ%SKHh`ZhH#gvnVY+k#`^ zJ`49-c;*>3X`zh}S1=`*w$NG#uf;LYjiIe5?JUqrkxz@XxA3UNwD( zd72fl@Viig5bmD%P%#eQ%1$H8s-0C<{|8Z0M=JZDF*92^QY9aHEF* z9SdVEo-N7nF>GcNJ)ewhqK_AG?=l}n29k*uCW*M-uhL<%1&Sn7EzD}7PqQ%H!h0M| zS?pZklSA68qm&OV%&@@PF0nAv!bcVsvahcDW(l&M^Tj$_aE^#`*$)Ghd8}$%9|_Yg zu)rw!B5BlOasF7GDbj7JSn0XU!gA5`{Xem=%EEpd2W)(5VYP*UHU`;PW8pIkQ5&X> zwH7|N@VAA3EUe=ktE29-@Rf!2>@gN(;R_4fE$pzc$--s}+bkSwqOXi;8=L4`EZo}a zXOgXwaMmdwO}kwGogMz27KnQ->=Hu$rI6i%djyYtrCe>I)3o2h0So6W{AA&vg+mrj zSoqGu*A@<2SenlLM(~J*qZV2;)k`Rc-uBm>;!dVN<^Hx)xWz}q!aXZg_o~zix&lW$n z3!_=a^s9vnTus86mTs3U{BGe-3)d}Nw(y6AD;BPDGB?vFHPiLhxyvNCYZh1>%VPMd znSR5+0!!2~L4b=vT zPmm-r%EuA|OeM~24n6O&(aJ{1hGFw$ICLBL+6b~mE%XU3GHquPR&_}WeQ%3Q&Sghx zVfMeGN7z3jwO?E4?4rhs9<%YxrGRb2u@Sf7tDl>&@#-MqT-*(scU17lsK7t=GnkvuRc@A6dO}*OcOrc#)mel z4++rWJyG7b@qrL3eZ2aNtaXA{XAU3PAkGq;%{A3mV|1>Kc{b+TSioJHCE8eMW08$z zHkQ-V#;!vF&cG!$K9-64xi_;sm&)SeyIHsdR@mUw{lvy98!Lr#@^kibCV$Gc)?8n0 zgQ>oIC^vX-?s2camQfp9Y;3i$PS(pt8(-L1Z)1aGd&8TV{M;5caoteGFDjV+) zFbC?}Y;0%6Y<$U0$wnnr-cvo_Azc#8+}9bQAgd2W&p zN;vr0#xL}@@t=)fZCtSN7fZD9n~jU?qG`TAZCn!ahv4smmu*D8S82`1D>km$ph)Ff z)%Un(eoW3C8wH$P;C=_~9o$j%Hm@lc2NyW0>fILw7(MxG zvj-hKtK|_r^3Q_G7n`Bckrfzs+*Pm>70Ji|7pcY z2X)?3n2Jx06-sHN9lYc4{dkxtIgfELLC9Faaa=VH{N+5sX4=+h&UGcHQM;VR?Q$lG zmCsU5aWL6|cd5d_#!humLkgP4%EWT0yzk%x_Mw9f4nA}+!@+6?YdEr;oDLQ{_*k-< zPrH*PvARGY4zgrQ*q=>Bb+{ZF$-{ zsSM9SQQ7F=3kTc9XOrM&2V121Ja@rf<%n!`uubx0KQLz^du)ef!rZ=eu$yxuiAqWA zaj@6H_YQt=u+PC)4!&`4%)x#K2OJ!h{0}-fBxyGd%FEA<__gG}ESfX_b>)bIquD;E ziBptw^0=h^R`7&_@3>}vS5HblBtbKW_@jeU+$$XXDQ>47oa2Viy+Wc>@A01%f0Fau z{2l!6;If#0$@bW<4lX$O&EbFdxWsOW`&ogtG8_3W7Y(UvK zS#dS7tehn7N}^a2#gjl1g_0iM@-J_nT^!lce{nI*n}jOP%-JV| z-A*?xiO#<(fh2O1s2a;@nMA83@{+hGnOR)<3xq!zdJ-esbg63-_wE{X9;bWh@iB>E)rY7#Fd@lp~m zC($d39_-22l%AZ-*Ocuuy@hM3B>BoKV(Kj>>abk2R(_`k{HCf!HKGB z1CrQORI9IRgz$V3O>=~^hsh zmGwz%NMgBgMpq=UQurrHtP=8RGV}00O$@7(SR>+Rf@=k-f6l(ma;Dmt#1~2YnZ$LD zND}d`frCjLN@8;oTawty36sQEN$ls6OkxLjcy10!>|{+8ZC4Usax*Eck@H)qMDpEY zBFXomxG#wd$1+xa+4caJyjPq3MlKz+LfY3!98Tg)5@(Y*l0-wF{%sN`gd9!c8zIL8 zk0%lG>7(DsrO$UsoJ`_0S6>V5`y_tgiYt|OiaSYR?MFdoPJX6P=3B9SJ(*e!gLW>7 zpOU!5HRaRKC-F09o$y}-F9`lBWwD<0VJhN9(I<=YdlHwE_=5{7iL0XLyQ#x+Nf@qi z3L%r~MiPG|akq*>>%u2ud`;x^l|R$(s@S^Aqk zy?_f=zMzX7A$Pfe5Y~!1zmQAhCuUDDR?zoB1wn z2^S?@loDQAu&iJi!4*EeoDh1>FRWE`QOQMh7du*Lm0jem3RDp+Tu38ls4CHFf`>d> z4Hq>fIme}zn;B@XFJfI6^<2z!@sW%AE*h}%F2=iP=%SH}n2WfJ#x9z;$aT@uMN=2e zTzFh~U7nCZ3l|H%^C>Pyf3NVP8zXKl=G5{~IOzstcbBzl$?I{kBgZ`m#@R z!S}bfZ?D$y>j4+UJimUAi&ic|E)3Szh3?{B7eN;tj(O`Ya zgk3~jL|vFJeyHW4{`?=U=s-6*(4Pqt-27ei_3LlDuw6JVUU2cEi=+$J#bYiWcad_D zcG2GDw!O{IHiC<$X5KY-pNsol5Ho+3UDEmv(WpP@^6L-i;Nnpibbi+9PeM-T{IvPjjxIX6=<1@Iizi$>>7t8d$RwRzJSBYIwE&Yde6nTuU~ zEM(%G%qhy(=XgrY^(>y_S>|H7ixnMX!?DNJjWM%_PE&V;vX0Py4dI9D;Hn8IP79StKs6H zi$lyo(+_HT>f=mh82T;tv{~SJ`?}|di=!@Xag%iMjf=z#PqR&V2hZdkbMfv%&v6&u z3OV88yo;Y*eCOh%i|<7|<>EBgtZ+L2$c;$TNzP=Ib3)FtVxrUZlPF~Z`Y%E*y12v< z7k)vIKEHAA3S{#6-Nj`WH?sO4F0Q(`=Hg0LX&KP}%<}6(+6DBdB<){W{U+B-es1S- zr?1W1yvW1Xs@&%M;ZB%BlN9c_D3C(K6dI)vtl=rht6K{_@%f&d6z)m^DHKX!L_n{W zLg5sOq);Y>vZ53fERn+9LW&6%7o@*6Jg;Pymr9{@md_06<%CxfET7dYr1(v@OhJ9d z-SOj0|AI>J{3bVloC_4+~@q)=jPCg;m@|7Q;9 z3p`CzXqLj;DU42mPa!pD9d0Rqy)vk$uq&Yd5YR&@7%4=>fqGa-MDR*Lf4FbP znSq(aQ%I!XrjQb=m4cH^WwS*uWIU6i+?A{6r%Fq-b&B6A%G8{pO$rsndS43nr|?t? zT~cVD!UHKhmcrvHJSd(Ir|?J$4`ov|k|Z5ccr>fD5~Y?D+A)PEMDHY6saIYySAQ~v z&Jul8JYUGwyQa`Bg%?wJDTSv~ct)(x3qC9OoZ#SGeY_;;p27>F%*xf*~-E*yPW(WG|IpDw&hQ z+!W@gupotRpHW-bzEUr%^HQj{!5ib zo5JTzzFOhE^_Aob%mTBar zp{H?AHdU*1=J{DZ%t%i@Dtm7lK{18WsQZh;r)WEV>?yI>Gw^30pHk#i`bZklH12De zxlJ(sbW<}8-qe0dqKS0o?FaiWC`ln!8nzHeuz$yENWS z#?xs$lSWsub`$J-MsdH$<<+XG^)k-Srtw@F z&x`5Om8OjjC=|nuGbUaHej$yohpR89@$XPC$$+2yJ=5r$M!$6CUfauQ^h)EEG(HL;ah^Qr7<9lfy{HQGANBVMI6i=(ikct z^*7RZUHG zuH{4yL>iORn3BfEG`>hr*>BdYJrLj1TkJDHp`sZn$jlr@sR;RH> zl;vrx5W+hh^k-O^#wVhz68to4r6=p~8RwoTyqL-VbQqX~CL*ot#b<*cE5C_zZ?5+c zhdYhUX>4KXqtvZw>=Uw0aJ%3RL0WgFvFraa^&L=B6wm+M-3Jg51r&)27?4}I19opY zw#hl&%+5~O2|G&$1ym4Gk_l0a7{Gv{5=2EYBSy>$W>FACFknE*k|oLSGsXA*@Bd!E zdezm{)z#J2HL1I&68}_?&jfxh@C%xBO!OZ0t4f})EAWlrYXnjamab(4d!g;mw0RS? zj@{W7WBR@V>jmFXN%=vLjhyv@Y!bLx;7ahr+XD)4&+ z{;0s8jHNod>ewo!uWNWi!(SEny8_!Pu${iAVTOhs6?_ej1{xY_*j0hu6kGw{1MBd_OOCdsDH4#SM=aOxT#5@^oo$r}Vdi*uNDx zQh}osSO#W`+Qm2{nm$@OK#QMSHFlx`|5c!dhMF2qR-lT8LJe1LDgL1#_I`_4freh2 zioY(19biQ&!#_}JsH&kF;e`0{4vMh4;HL@PDwJ9p&OTXihK4gWoUWmGdUft;NsMFw80)SI~BpEN!Hrv4-{< z;u@N0XiBjfVj9lXaGr*XG_=&BnO2;;*R3_Q(a=^yJJxzRS)$>klf{%-s=+N+{dOe@FDq9x@5FOr zv{gbw84abOw}zyK4jNJ#l!kJ#o6XH5ih;P_m{5OM|U}oJ@|!zt1bbqngxFWi{N@QDw%* zeVV#zZ2I=p^S>km4LJ>=hP;MLHH?v>!5T&gGDIMmhicebEjCQUaG@+ctqO@FD@#Yw zN>yW{HC!STdIC$wY8WTkDH{Je9kn=th7#m*fma9|ui=&^5kJ#J4Oa`1_*H^T(s0 zhFKbJ*Kh~NMZ;|x{w=}yjnN$8KsP&5{Mg3gJ83ixvo+kUf%Ax8;pqVS{B}=vR7CF4 zKprCFmzB=ZFjvE34NqveU&8|$9?>wLKB?g$YNg>}`eALgvZMOGBYy&}s;1PrDb*pR ztdx3`ax^@yVF4}QwDhu+x;~|*u8cD+)Id11P%WaslzJ+q2$yJhQp58aUf@7SGYiW! zJg4zzyXu#eS}IkZ(eSK>8>*>U)zvK{%ReuO1ny0#T1vH4>P1cj4X1vWhrW6`@B-qTQ^ zqfp2DR7t~68h+OBp@xq%tkLkThL1ITqTzE5UuamRVYP;4<@k)|QjwCMvZz3wA=9v)5uixj zB;6k*by;ylr%3pePHK~e%?#ZgBIbKKspZ1(MJM%(hF>-OqhYUxEu5PgwrSX|;dc#x zFwTo9{^+FsWc2GCX~MKs%zmtsYS~%+&3V^Z`JL4c4LccZHSE^-3#5pXBQm?Q+QUmj zL8QaSoz=^o)#c^br(wT_BN~osIH2L6hQoA7k$FfAvM8DQp|hf8c6C;pszp6w^I?mT|fsU#=s_8gKM*|(zb)2T7 zj?S-6sG*~#j@mlT(4&Em!2<7^%E zb=-(ZPipw2@Jua?RDHdRYN(@;j`MUh)6rN*6CF);oU8LE6p?NZ<7Qy}L%O^Jte69i@8I zg;N5vUDf!mYED&d9##3qZp(Z-E>)4^ApN{@I zp4G8T#{eAzbv&%&5gmhcRM4I}X6Vp#=sL#e7^@?#!_YBY=MGS0$Wxr~bohdpIxHQw z4o62;hpR{5toebSJp2GboQn|ny_?xU_=o7o2@(p->liG^)@?B+vT?P^Q1(UV68b`Z zlpj2$WTYM~L0NxIN%J0sqjZd>{Zs8oxkM1+mkI+BRv)M1Y7t2MG98!exI)Kx9cy|N zPSA0sj!;%FOw@6ej!8PGD%Inf0e-UQ@&h)sz zPFaa}w$$M+PL^Lv##R)L>|4l{8xv#EdZ&AIJRlYC6?h-rFKjmU!c`l4?k z*B7z%2X&rjSa@eF@sN&r!q4tg$b21-O7=+|j|s9w-~)XM9~WeSz=b*%=~&FkySa!< zeJ1oMd_tO_dQ~%#oTqd=Eu2fKRiB9RjAV&$b;NTzp4YKa$B#N*(D|Pre6M4@j+b=2 ztm8u+9|`j-oS0mrBKUG0uj)AYK-(2MUK1C(yl>&_QbZ%u8gJ@&OUK)lt-PmWrH*$v zscR)h8HHSJ^)Br&rY*!j`~9joaKf`6*xGe!f!KiBbv zc+o%8+j3O~kN##~xPId+9beO#PnA4B>-a^-uR6Bq_>F<9S7cQ#AMa0J?{a0^wg${cj!H1fdVG)=nL}7!cCvk;ZNvdvsiw#zkrTqhl}QZ5lPx*r#JZ z4bCp7!7~F7=s2X~ztY4(hKQSz`nobckRGOsK3Vp2-PFH2j*xjng6XIr#{?c1c!CuL z;gKU`C`hACH~#%PS(uIvC*jjB@uGCJyaA*LQZ0?@Y4jAf(}dEgXMzmPHY94LQ7?_N z(l|Yh+G(7T#+DNud1zr>LC#D^--YX>(fQl9r1O26*-f3DMtvzgKOHRtI46zs(&#%g z*+8-l1vV1M(#C=`5!f`1b1UgoJ~)|bmPYe5h%mKCg9|x`@T2wxX)Gv8yfY`!GL4JV zP-%2Zqg5KkRQ1i0L>jR)TBlKxMk#f!mui#d@$!n@dF}18OS`GIX|xl~U+SiMpG>t+ zBc6_qZT$A8ZUrUv35(M|CU6zG=KJy z?2<;lDA6?yE=%~So4TT1f}hlTrqL^n@o7w82O0d+Fw?MT78&jeQKnxS{nNO;YGObd z1JltL^T*$f^8@`L!I^D2s!U5mPa~ZMi;OgW9$B`(o0?f8K_rt#ot_b5r{SbAj#(tK zX}D<&OJjH%G?zzXrjbj-PlL;2Xn*g4M3{~i8!!!}=7JBF;Ts}2R|1?Wy|g4TB8`!0 zjOmsfE5kG@jnQdblIG#z${1C4sSw9hjv(#1erXw-;NdwpEG@fC^r1?Zr*Vbg^fzX& zOk-jiv(mUVjjPg_l*Y6)rl)bW@UZDA?7m7|lg4Cv;7v)UT7M^|ra?DwwkCFzB(4=Z zT%X1bY0NH7T$ctHY;X{7E4VFqsmycu#$688n18ppUfwOxFn6C zb0W&qX)I0S{WQ3A^O-cBO=CqGucfgpjpx#MHI1TGiRaUJAssDVdO3|3>47E5620vH zQDrX)&dAWbyLu&!O|25kg^ipWS4Zies|sHi3GZ-1>1A)E@n#wiuTH#`#@j-t@bM+d zm2~ftB(lt0TD{bE){7(bb{qAma1 zP6^o$OE%D$FSgx7D9k^ku`!Jw+1WHUb0Va%HI1L7Xp6v~1^yzC0)I{8v09}>eiO>? zmGnQ-ID1EQ%qG)cY3vaC-vYN)@@!`as+S`4;a;+*&`z1Sf!k!ysQ-c@4V3CbO53MC-7t?PZfjz+=-Md zGQj8O(+t!wP}PVm%wL?dYZZ;#S2IxE01+ns5s$>023i>?Hc-pJ=>}>WIK#mCQtM2C zXB((5NF9N74b&5aV$U+L=(VWDa||>P;&}oa8fa3<(@2oU2GVsR+cvGFpKD;(TT$I+ zLTO$}Z(-n$U!$I0Ae0LQUL>$(CC|kMXeIK*3?8ko+88J?&{}Y2mpvPaEj3VPAZehj z)M_WNeWirBfkY)ft-I<_iFYzkE_laEN=guA;Gf&dD7Ld?y9n%B$LuVV;494LojO0WD)-zJW&#JVvoS)I&W~{i{-o zdZ=YR)QTSJy&n9_Lx+W&Ljst@c*elX23|4ntbt_)UNrEMf#(c7Z{P*G!Aot;NvWojQxhhnYE4UR>Y+wY zN>wzE7T-UZaq0G2XzhsVL(=dIr{N!=?$@&>I{S18*7J`hk@O-jUYH zNg;FpWKo7%)o)Vsnvpi zD)5;<6KiTDJ{Nlb%|%~u&h}66_U|iBD3SJ!feoLuZPg@kXiM8ad#LXWtToUggYz?3 zXW)AS{~9=AU_IFkY%%bgfgg-$CFD;Af|trR8u*bq&@yk7Y-Vs6C3|ZeE)EC$Z*4HWk(GhGf*dkx)~fdaDq`i6Mgmm&%jAW z@(iZ7PgD_DlmP@O5LlSOeGeyC%2ZV-)daTdsYu~@hNrSMGN_qBtqe}jptxP)%nVYe zC29*iBg0KY31*on%1uOHy6a_d7A;>b(Kv&%Gq|pLqCqC=PJO|dJtu>@5J z3@*-~RR)Pnbe3{)2C)p{8C?5xS?dhiWKhbcGboWpc`jnv{fW1~DdZ`R^V%ibiF#8{ zi}3cMFp+0-N!BgPV9K7n|mdm^!~ zb+T&)-Ke$*TslAD#1s7XQMHryfb%)Hc~a12Y3F zg8>-~WV;!Vs0*wR$gCy^7Z?yvXJAy)Ga1xqlO&O@WoO`J;Ah}ukjXEQ>|H*7@CO|KT!CH3`S;f zG=pOqjLKki25)DuGJ{JpxHN;uGgy$pm<+~dFrD_#fS)z_Rc>4cmu0};Z(W{=KFm$a z;0g-QV1f`QW}@GXvGhvG@*sD`u*9>oD`Yp^W_YIHwk1DGpVY4xFpXl8O##qTLs=Gko4OHxkKQc8QfJ# zpPj+om3ZT!rR>qYoKqRhk>1VCV7?%v-!I4m89Z1?c}S3X0v{Imh(P{~>`_4;6WCUM zQnoOIMH#%1!HbzF8uO#r;!N~u>U9}>DI-hDR~dX=iGL%=nhd@b;XqqjzbObp;MgQ^KW*Vju#8&3wB(Y_cWEUgfp)7O=y zO&BID6Sj$r8SO)1G6i{~XS8jkesASSHfzGA8D-arClqeYAOrWF5avvTCPtVTX-5Ad z$(tBThe2wv=rF{@e@{f)K-l^)6T_u-mh$~1;V2Ge)x=m6;{+LP;t~^=n)q>jg7h&$ ze4l@ssv2c4GjX|zD>!7m6|>__Ob~{<|LJ%Rk2{v$5ng3tl8NihXaf%0z1qYS6H`rG zV}jYq0%;lIeR`{DCayJcor&otCeMj3uT|zIx^7M6daL(&7uR0hVB$s-GfdnhHoTcr zplagE-fBo`Vx|eg8Cw&#&}WJgXRIpYW*P1W=WicxH*p7vCcZLpr-{2vykz2K6SGa+ zZQ^MY?=CC7N8mh8AG)H6`%GN9xC-e^b4<*Y()$HIAdvJ2O*|y{ho5&~_7M~FX>$`# znRwL1W1MRy77If~T|92$)+b9>j7lvqv5+2ew1~KKw1~tf=$}W6X7yIYmv9yfk*&`@ zT12rEjutKDyfg8viDe?~MH6W$dd|f2?1k{ZAPQ3gtFsoXzhYv!iH}TtY~od^__~QV z=;wm7#n%M6?`YAR^lB6DoA^MKeA~oI6Yq#76!oqUUvJRiJ>h@;XwfOld?-z`BW#ou z3j9PEJ{7pi#A;EA>QN;!d}iWvDI)%bAQaACe{JF$HsRnl2Ww1xYa(f*gN^S@tfjYD zm}+4i!=Q<_7TQ@@Z(;*S-$GprKbY8PVjJfvz0|}e6IwMAZIb!tN&u zs_#wiFtL-IMr@ynT_$#$_(!sPIPP1DZ6nUuUZb#zUAM|!6I{u|ESJ-ef4>=B=nt4U zXyOpvueUmE;<$+ug8wV2C78+P+XhlX?)m!m@RkR*gA~hmqOL3<~$;K84n^^d+xBBwVcw-cuXQ7#e``SfS z$TQ-BqANEi&$n>(mE{*%XldaB3l~cDZG+-39f%eN zTWDip)V~EA3ySz8TVkQq!uNZN?ZPT64@b(hw-C4BTJS6+ERp?F79t(fQ5b*{@EFIhaT9VPqf-+Abq%x8YHkn zpeAr&A4R%hA!EU|;D|L$3-3;kkCcj*6*<_7?^E-d#QrOYWi2eZIK@?zMk#y?frU#f zTxua_A+)$y3&SnsIdCTn3Vuiq7A5JNL#$|3QuDd-p%(5qk&4E`!blp^!f4^?Ga=4z zbCl0sUw>_!-6zi&3u7%@Zs7`Arm$$7h082dYZvWpzvr$v6McY#JKn+ss%?RP_*zlD z=#L$#i59p3_3ys1t1L|7aQ9JHQ_r80*I2lVVaJ_{aEIeT0K?^rpm|fJ5ymQ&l$%Nq%YlO;db`a z!kt$1+qD<_sD?kM$aa@x*|pggkG@oY_EC3RxJR_T*TP(SR9{utSKVh}ju6S&u&-iY z?w2AWq&#HdF$<4dm}lW(3y)Y}uY31ZUssDA+gCi_!lM?nYvW8b^#ThEEiAIISekzR z&tku?qW^nql22IpbX$z-E#cTDK$m7;p0=>m!rK;BT6o67vld>n@VbR%7M|lQK3edq zxYqNOCcgIq2c@rKdQp&<1iozH6+xB@oFxnk`>GZ6{Jq8ZO^?4};Y|x~(YKS}l0O>l z#p*HIhn~h|c<<2tI4LZwvhbdTiKXb!4j)^1U%K$ux2X>-e8@rHnEXftuI#HC9g8eu zw~EmpR*MgR#@-1(-EVDQ^|=+f4O?df{>sAF3{5s_+W5x88Vd(49J25&Lx+W5Ec|L= zErY*>A1!R+9B1$snH05w-JcrYXmP1w?6yBsKS*}wsw5Zek+Sv2B-aXV7UrKU{LEo` zwv^NPrFT+XMYe^rz{2kq{-BY!MgG7zK!^X+!dAN0f+`0r{KcugsrYXT+o)1;jOz)v zTi9V?w}m|x#w|)RvhAd=-WlH|kjU#}zXtu!Vma zb!`;cIAY-_eb~m%V+GA8mmjlmlHp}c{MGug;}%X>Aj0&Yh2wn{k^22q6&ua^DIzZ% zEaswa*r;lwx{bOeSi3k$U#ezD(Kyjham6Wp@-#bI*v2?k%f{(8F1FFiMr|8s*r;dY zEE`_6DrefLLkV_tHQ9TxmG_fQMfzD#s)n$u%Buq zZ8fpc)W*nusxb$YeLq-yu8s3-{IRe2A{!^}j5iZ_zK!OBkkUdBF1#duf#4U~k!Ld7 zQYzliPo4Enve-t2v+XJR3p1z4;ffE$EllUL$_htuxu=yQk1q~*vQym1f!Avni#E3Whh|Qw&B>w+Hk3G z-&nmyk^QgwDBkS-C_d}c<2z==0~_#SEdB(#|%<*%)JE%D=^{{we-k zx_p_9Yj259v~fATXk+pUf#U^E5J=*cGMYpfPyXzuuC{RvYuUJt<9NJaGD~etr&#fy zsWw`UkIy}js(MAd-c{v{MR%MNYx+X+dK)*`IQ(bvZKC{*HmW>RO2uZ_xXH#$8z=jz zTWvJyuWlBc*;@peC9vCqWQYE$&UdNXrIkBq#{P9W!#V)F)i>`7KXlzNKO@I*=( z@p=8#Gom>aeyM+S4SLqbKSzqE94&s{#tSx9*m%vxi#A@evE0V1HeMz!G4{j$>J^TD z3DhUa2UjLXG>VYZUvudX-OY zd}iZw#)?64>Oaw3c?$oQ0VEwG-e7=Q zYhxWl&;Z3m18$(XZ2W3ti;azp3}knzlH(RZQ{Oz}Pmj@sY$qxq}^y(hQ*v zYCG6vV>f3j-OR=w4vLL^Huj6O*A7QPey`2-&(TypVB?_BkJ~szWK(pPa)e&Z;d?Ln zufR!H#EDm(5kE=`3{b}eGRx{GXs9PjZyKPgI4E#X%|Uesg$|0GD9H0>pixfr2ENv3%N)M-MgMas!YpBj>_>F~!l>eB&g%lJt684k{LaIu3{4(d3l>!7iNCJyR3 zIExh>)R$TuuaEDFx7w51voIQ2Ry@bSAP$X#hJp}pt7^(2t@Phn3l-OXBA{xWM5G`S^uY<3N(>A_pynLL#%p4q^`4IcP6pTRUj$ zVAg^vZ5)(1cquGxZ^c7JRU#7Y{=ph1oI_T}7kAq&4<-d1% z@#161@Wsia1JsQDktY2d^mn4i6BZ3%7mgJZC%wXf?jY?%8zMAXd!WMB=!U$kQOt1g z^v2?h1Jj9Sy5+zYgmXVOP?6%$VntPmcn*9AgB=WU5ID#=2p!~|=)r2(U(sy)!(I-MDF>nj%@YzGzx}x`S&S+~i=U5U+D^qk|a^u6MBKit-ycg8NgPJA{q; z#MwKhy9Y+|eP$_cc5n;bOq_F;4Azo?YUMz6yMsF%ypY9WHgS#F4 z<=}4z_c*xM!3PdLba0=8ISyWS@QQ=E4(@mGgo7mx9^ha(c+A1$BAf<%h-RceJ9vbX zagd@x)(uqi#WIgNAYSLaWHDi!^lFF3g zd8$gUrVlvWN~~TTq?XbFjQBHRkY^oy+bXt9Ad%-BZl_g5cq4R4JMgCKMb2&qnH%C; z2Pwkk4qkQewu6=8X)7GO?%)jvuQ}jzNW^-QOrK{Ucp;R}mk&`J7A1KS?Wh?oR#e;1`G6 zLRF2AlkVyyk>4Er&M|F|Kg4Gk*=|2vz)4#8Z^54qwsLw_sHIcmV=L4)2iqA5v#6iN z4hK6O{O8~#HnO4`x&w-)Z-P3{&~7e0?v$)X^O)3T_MMXmNI z%%WNr)w9v%z9=A z$QH9WH;ePKXiOnlG|fiSaHytuNxHI0EZm#ot=d#gHOr!T7A>+kKO4ve zzch=s+30H6E{ifw?TO_a%Jx~rvpl9amdHkr6->Ny;Ds+KoO3nRF^g0dmuGQB7AlKQ zS!h}4S#-{#i!|Loi>`un&!R^b-2~^`25QCBGmCy%{1T6p?3G3DEUNyU>LakPKxR4m zg})ZRsHyp-7$DULW}|1KL0N8)Q59KkMN!;nmX@L*i(D244U&y6*=80NMZ6)+ zL~YjfvdGdnN0P3<(K}Ma{cLolqvsG(pD>HTSqu@ed4crspt46?j{g$C0T6 zy1FxqyXe(f{8R?s#?U!uXTkk+cW0yba@Eu7o-CTB)!om>`TVtFOzGS#?$6>05%NG5 z4`%Uj7LR1{5L+*eUTMywWv(n|qx9s&yz=?N$?U=`9u@qtEFRBB@9tDu-O@j{fM)3* z`}+G7pK%s(?o^E}<{-8!C9))oC&`(`)0|Bw3!ag2=OkJxa=2-9VL{QeH1Fo*vMip< z;(5A9IxYJd;lJ8{kE*&PV-pk?x_C;EJpONS0_$_JmdRl#( zR=g<8{XKe-!j7-XMlTaq)8Gu43!*vxnRwS)akwdAHWyP+RYa9}-c#B{-JF;Vk~m z;)pbHRNw$Zu{kE*${x?+1P5qK@ya;Dq*C#J1LxCH)U!jYib|(2kpzG9l zkqfxE{QCH{2Io<%x{K3Xoa3T_iyAI!x~T8s!D7^Mak`5$U7nz&<_PDDhN|u23>Os@ zv1g~p3G29E^seioo{O_wtR_Q7U6@fnv31EFG*r#e@d0&X4PB&;6f|{lE~~gv_-*Xs zkv~$@xrvL|o6*BBpMVHywDVjT+l!jH;1Y{=1KXVM;sO`LTnu+{p^J-LBwciH(bC1m zE?T>2qq}R0<%I3&!gZs_*~>+57kymxr4E_scC??1{_HQA4;2q^xi&_n1rizP zVo)VsA&4eWXD>2}4A%E4!i>wcB8tg$VF_+mQXE0D9LIh!GB6Z-w3W-_yyAhtoWM|E zUf^JXLj(>L$Vg895iUl$xW&aR7o%K^c5xZK$i*ctE@h{V6pV8*Mn-mR^JpB$y3wxN zrQ4z#&Q=Etc@uaAm3J|N9_4~JX%k#bba54{&>GdE4(I#f$E6aVOiNo~GjT;Z$Pw^g%w=Rqibcu)9$4$ximn7%8c-X~MEl!hi=zDf=`zXD_MUe-1c-+MT z8r;Pi7YjLXF5YqRu8YMko^bJui)URN+f}fHU86s@#gm*(Rbx+y&1acvp{bT~{_ZUv zGd-S>C(32)>}f?SWwJl#;&~S@xOmaUODzAu z(q9wg8&k39O&7DDiSJt;zwwM1k+)pDEfnHcJQe4?)_Ir3-*fT4i%(pva`AzS4_$oZ z;$xQ|LnCkJjyztc$jJ)o-RORgGxswWW9OBB?t+n=fqm|r=(7=L zF&}lma`CmyBfcZ$r2E#zcP@T+@rR4GF4i&1x%k<|_b%4E*uX)g-L@o8y|H}n&(uba z&d%cJCYKlgmi*DhCeHNz#qGXLZKnUco8-qA;=j{a&Y_1@-#pQwjitjM{ z-4btoAiC-O)5TU7M>!lW{&MlRi(L%wq8Kc-&Bb;Xyp!)VFt&p_94*}G^7E+bWJMmh zhx~n`ced=#KQ8t%{JzkZt?UzIzrX_m4+=aa@UXyt1(N>=1KqXJlBDAK;z>Q0k$rhZ-JgdZ_E6 zo`+dwsO8~w54BnG=i&!;C(rP3rWb|ofd^A{JbuOF=OHz4YJ8TZ9=Ft49+D>t&h}8B zG9NAFnR}cs=Xhx7p^+C^qk+J0EY;XU6A!IC6nkju;am?FdZ;xmex8Rv_7`6uu$e$+ zn+wvy!})?F_Z5@K^mzZ+MIJU!jWf0MaB(G0IWZ5dJ+$#q!tPYWd8MWU@IjAXc7`{O z-PyhLKC85yhxQ)2c*^j~I4izPer{R`hbH5J*5<{?6rMNx z#~eC?htVD`@!)#!JPh+N+=K5SkkK5<;oDfuqdamRRxM429`YXEw4>W;Zm%5d;lqE6 zhX^Ev-}~6g2oEDYjH2BV(No46TXC{)-yD5s=d;zN9>#dM%EKfNV?B(c=4`^lWug*& zX1lE}_qg9YHepwaaO|qc6(^i3^)OLP%1b|=VF|DHaE*s+JzVEuvWF=irV8hATV451 za^dyy{znUbJXk!Sx!{ZS!4CXf;y z7dh(fs0tYtdw9abGAUi+;Yq2rR3tpb?u!IUds-+7M?E8)toy9UA@ZDu=RLe2^i%vK zz9?BL_KJt)9^Ufswue_etnly#gTrO1*F1c7yy%PLMZ{kh3bVv{>gJpD>Sd+OuJrJZ zhY#o~9^Ump=JzU#$oYO{EiyCvkuVTBC3BUB)r>hlYWnz;ZP7D1p*(y}HV;2}_}Rmk z9=`Ih*26jvUwin*!*?DQU!UrDO=^vYZ#@v{<0w*IxG_Z-zcKatW2x^wtoN|*@zjqV zHc-^#5&sWT@uCG0zR|;vf^1^k;NUJu&0Jbae%AfP!>r~VRr_`*ns?H+b`IN;$Rg9)(H!yXU+c-SR8tg^eZB1@U} zQdJN8Y5d0{{hxj;g14QILmm!$DDY9}<6jR)MA}IY&2LN{^>EC?agoC;J9WYXAuIkT z2=NYW63kZdBPB=9PZjxqkJBVeovZq&=7XigsdIHd>gm)4kp*Z6cC(g`(|rsj+w_v! zKF;vb!AH4|Gkx5>v17tVnU6X?>iVeXbCqoB93KsQoF(|#0_zK8QB^zD&_^R5r9RsF zXzZhjkC>0vKAQSC*T?xjF7RLQeVI*tnc>TXR7W2vAG(jU4<$u?h%_keY=;5O$#a@}}=A+@H z)Z5Eb-D#Z3DW(S;Mf$)iQoU%;@u}WEjy8$H0ypFI_0i8qf2lG^Bo83Wqz3xfv$T{5 zVTF(Pho(9^Db44qwn(Mxy+}#Jhcz+MKO+@QW_{Q`93Rg(>K8{1@sai6`tXGE34?>9 ze8B^OIf0?TyuiT%$=2$j)XZfm3K`~OxQ`J&M*5M?SNa&`W3-P&FQvx&xWvb$J}#Fc zYCA@hpO=m7Jl4lJ$r8VeLa1{lQu_*@uRzt-;i(BydUR|=oG22m5;#fV)dJZfW8f4H zA9cuKWDe7OOs5;K%fJAK^d<8}_E9-X^#T2_u95y&$=?xKVa(K#e-gmRCMdwtCD zF_$W>jNj)YUmhVnq_m7jABda>d<5C(v=*MAGCr&3`FNOy_3|86M z{>esimic(j$16UT)AHqbo~9N#F9;;ti+;4TkDMTF+*910nRdKT< zx72kaPoa9t$J;)B@UhXyN+0j|_{_)WKHl~5o{tZGeB?*x1-SajYcrl7)(7YY2w$6g=%q==)&Dx*9#(^L0|go8c~`6vlc8sIR4zmNI>&IxdY zaf2~DK#c&$818(WWDE}?_dDU^zse?_^3*Gy`rK0m0SW^Y1wg>7nA$JGsQ~$F`>JYy zYErj)fEK>uucjjPs;6oOs1=}2fVu%r7lzsb=`B3o=M2Hm4Dec!O8SbBLtHPwSpm+L zqMRT3;kCZH&5s&t5TIdz3j$mipizLv0h$IlH$W3%=ID@z=^0<07ob^y=2Rx2Uqy9K z4KeqAau?_M!cPq;{GtFY0~7~{u}V2E4$w+UzxSgjhC! z+W_qXI03Q&+6RaS7#LtsfJA_@0I2{fKr%pw03AgFtCR=P6l)cz)8+6V8i7PoItAz) zpv$R-ilQdE3f@0JH$l1!>>;qHz+M7-3#5=f0s0EwPhcO>a6l0GHWU51B7hbk6TlSX z=mF9J3}NPYQ9>9*)@IXIrA%9p8v}KhNOJ>t0Y(HE8Nd$^1Q-%vXn)E z;a?c2!P4JT#vc|$b7y#f4}z$bABAUBfYAXi4KOB%Cio?la_Avci2}z8eO!Q}fvTO0 z4lavM4+}6pz}f)o0!#>SWq^eN76q6X;Hm(31h_N6qySe3xFNue0j>!!nUVuc6Zuov zTsdd~Hqkt%rU$q-z;z7!0ea*V{g(6~r!LF=@8Bl-%nV_^CBUozH%X^va_Fn4ZVvEY zO*JE@2yYE=o3Py;;L)6VIj6qKMZMT0@U8%}13VO9UVys;+!Nsb01pWNy#ntGa6mX| zoH+sJ3h~roTol3!3XfuYFu<8%WW9$2JQCn>;bBMS2Y5^j^{7zD&kl}gTAEoE&4>j- zwCkD3;s8$sc%7U9mIQb*z>C8FRDh=gJR4vc{ZKq}X@F;>n-_#p#crW`F2M8jv2wh? z`GQCX$|U4)5WW=PWfApCfL8;o2(X;%&dA|RsnYTPi;8uGQa2a* z)v4JxtExIXhx$33mqW80&dH%c4oz}sDx3{-k(V|S{5lcdI2W0YR-$6(3Z0k5Q=&*| zp2Gz>T$n=((QxT$>U`m$oljLE50RE~A9!&Nt*A*3u^j9i$k{rFHaT=+qdAo1P?|$o z4#^za=Fl#OxQJr)_PHpkP}Dv7XhzU)6H;`_(>mnPF^5zRV9O%0V}Jd6S( zl_9Z94qbETpThuYx?2uCbLf>r_Z&l0)JGbYoNS_Z4t;Xyn?t`GUX&I|rvV8+&8u$; zqtP6g!=N0D95Ojnr%c0hQ7od8OuWL5 z%3*X48*=y|hf8v}G>7|hcpw*Tj~bK1gdDCEd~6Qma?x(4%W}9}5cg=&6@rjBUXUk` z7ER3IU<2GtL*;N)4wG`YI)`g=n4ZJ6IdDJG*XJ=Q1ZPnJ(UUumZp-2J9PY{C-W=`_ z&e=KKEy$fY+*MhZ8BfFO7N?+y({C_*P9?apP9G=VJ`5flu@Nf=K zc~qqBM?!gD;0FRf6u5<+d9;W; zt8!SK!)NSWrG}ph!zl}Vk;9ictj%Galzt^eYXp9s!~Vg%Oh=FnF?}oa?*yLOXhuKz zUb5>2l4t#@)W#fs%%OcA@jN!=u$dzgVo8Xfa`>5%Aw;_nzvS>MgJ+1dLu|?6H%7}4 zRYUxq!yk0i91i91XAWC)_&bMfoT__^|DrKBM@#j7tRAa2L~YMuM-IDk*v)6vy~SMM zx08OgrMUSJ9%)*yk`Jkw6@z@{O;j`y_C$?+WU(439?^cpA!X?>~BjQ&f#B< zX%7E!T5TyllEZP1;G~kHG|us2t`Inu!+qo8(XxRdDt}x2BwcG`aZwmCR|!!N!Wp72 zH{*pNKX}E75LVle;uno-A*zQsBjn8qP76^Z#OWbwhq!!5^c{g8N@|9v6-LsSUTqOu zzbkpm5cQHQ>8}$;9|h`$s24_WxrwtmuAu(lyXd`c{SfDbh=ph!qCtp;A%F)+j+GOSNk zglIcdjXPR!&d})W=yV7pFgdA;c$x1z;thjhdAOiT8KH~ zFt6=Q%?)us-J46+?~Fe{v2?lV(W(A~{87TgAs%61Ia#nM1oubG5Ai4+;JfIPVx!^e zG3gia$3rZjK=$|DWZU7Y-|%SdgctUxfHF#4{nD z4e@@64?-*p@mz>EL%bE@`4BIJSP|kiY2rn?`jj|#n!FU^gZ{A#79|gcI3yvC8;TDLQfpCid|{QNv>u~q9!>K&9^wRJcphiw z@n49OA*$t3J&!7R6y$+Cs^+6mMjO(Sh56{BP?V1rU^5Ew3m|QB#)!zNPRpZ49d|8_$m7C1F3O{29_^$%taWi7#e%oWNB+q)eT0hT(K?SddE7HXmE`gB z2(@g4`gnvY6`Tvw+UBDJ_DN^(IXFTk@+iw=ULFtUk<6n*9%J$tn@4#b9rMuhNavBF z=~yd|etC3a#~Vc(th(gUS#bL8Q+rcg^XMko?s@Pp@a!-3>5)fI(XE%j-U9nnYFmFK zAG zK@d<;e~S3sF3$eXcTSyqZoPh0_3G8D*F7`cJyE%`kmPS$NWybB8{WQi zsbv&ztE0=>ROS-D6Gf{iqKqH)OD+fEW6nktW)z7il3a)=ELMMf&gQCp7i7OITX@oc z!IqnKvz#b4@Y(q?SuVX~2RrNL=*m2&r=mzlF(`_`QM8VtO%y$&=*1w3qFof7qv*mV zi=smm9i!+J4X&V${PNt@YtQR;aE(#^>T|rmZdJR=U8Cq0MfWIrFr?2s*U=U}YQ!h? zg7e7PXC5z;b+B|+?NZ$Waas`thQzH<>$#~L@_gp52H8|#jGf1NBKz*>!=*X zT*gck%hb^GqF4~c!YB@BWXzA^UAOYw@19>2#bT~q-K-^Clrq6R+w{X8TPAc2)AKCL zqgWNi>L^x3u~Kax`f7Ol;Ha08!RfD2OHVR?W_Uf#3ir=SjPp|^8`z09!L zOgru1$^EVB5XqOe?1*A#6nmrCr-Zwr*d4{5D1No2a6$%Le*XH>;AT#`Xnzz3qBt1E zA@tuX0Xt!NSG9egvy0+Am1=ma2LE5_p@gh!Sl|P0hlZ7TVZastD9Yaja9rsh zRrs;OPZWL{#b?prmOn->PrE0gIH}}cMR6*M(~9qIn|Vf&!2T%CMsbeU|51E<^4arI ze8JGV{tUU6kXi|ub1~?O;dk54uT{fu6!P(e@1wZD_1b`S8}LIEKQa-GK*bUGDT<4X zy-v8%374YynY%KDW+_~b;z|_fZG2(lmng1AvBbbq1J{@jqe#V&j^WoRe&g1T;q8Lj z?@`=f(vIQI7+>O{{lP_Ss{I$mpHci39*+VF{V1 zgc&j1p}H!dFjFBEwriTpCU?b9D29h(csPc_G29(Pkr;}`P%IfL@O7?V8A*90hO#ka$DqYfE`~>Acq)d9G1PuAR6d5sV|YUG3NbvU2<7abJ(qbt zR3n}HWDMWCp)yIK}GsuM&)w@I(0u=um8<|)gYRS8c>%JVVY6A#mJ_DLe_B!<7;(2-eHze$8%jNzpi zUXG!93@u`KD~1{|)Qq7~42@%`Mf+oTm4?MoM~zOK>%~wvhGj`9{Bn4IQeIK=e#y{@ zq|kK@Vt6fvhDum65xSx*Eab@RF;sAZDYG<*p{XOyh@71xEEK+>gl{Trt}x{Y)mk#f zVz6UK#PCiGtzyt)FjW817-Ezw-wtwQwj*@K8b{0+;xQa>gtxfgKf9_G!#PJ-ZjYW+ zZ9Rof46Y(PRH0<}H%I&!?sbKvbqsA{_&~>pI@-q2jy#4BV`v{khZqjh0~fPcI>s++8-iDBt&o-bLh z$O?rk6|PdaTH%@))+)k&%DJ*Wh7B=nRFa+f@=Y;p&gWYc*~;y&$o72s4n>Oh$k?UG zZiRak?p3%?AxGJ-$N}bx*}>cosp`8559jN=r^x$EO@jl6ABo{3ZW$eQbR3QGYbX@d zai@+?V)!(MA7c2C*(Qc#F`S9vYz)U^=>1x5k-KwFC~_k+_hbyGxB(mFo{piJD>EO? z5m$b^8a@}p=P`U8!#6QJJtK6UU2TYb5rgN-AXmPO;j0)1T??-+o6~wkX!f=6w{&&= z-0x$!5W{yd%y(srD|HS;4(*Fvz8pU0%73FmKgDn{hCgHYD~3xk{LHK#ey-PB~M}O6n-3<3Syzb(GP; z*>xEnYJEA(S)cRe4?mdiBRb0JsG#F99p!Wk9T8&l@;X+G2tBF?D^fHiPg*(eC37Cv z@x<2flRBQFsVR9vN5-}APeVhsQZjdc`KYAIx6X?s^d8wm34%A=Pnu=s-ok!@*(oEqe7pigm^)rGc**@`R+5k ztfRUP(NRsui?q2y=mnArp?fQYnjDPWN(no8i58}%`KZv#X(_QkQbR{gJy`T6PR{SY zhHL3~J1xnyFpBExsHbDNjuARu(ebJdms8eJUq=HSZ?Tn**K{=0@rKSX@$kBiMmn16 z{Ij{-;c02C-j|pTT}Qvx64micgWNf-#n7?6wU`Rq-j`FfVs4%3Arf0hLWiUC z3(3%{*TZ9e*XY%xjuWlrq3hvNzl4i4$n|xk=zPYEjXC+DKm=1K67{{dDx#@p&7$(MI0e8~J5;Xy29aeQo9A z*%^cBD8?H#M~9wjE7jY|+47-b^g~;T+?PWfsbdu5P{&FgqjikYF+;~p9b}I#%o0rDL~_H9FSn*vzz`W1WumIyUOqL=Uu+S?y$JJK4bP zzcqZKopjq9;fP#KCZer6w&~cx?ZYK&7c33a*LEFuwHLie&d6WG72C^S+cJyqjqKqB zb-b(NFrBYszm7xnTYGu2y&TZdsl6OzRJRZE26M;{2O?aNW$ooX9q;Qn*j{)jS|L=@ z&Z&^h;g&z5HomWl1(($#9FBGT3m*h1f zB;Tk`F25Z4maDTiObH9C7r6Ckp0e;q9Y5)~Oy}shsN<53pShs3GEZy|l)pNn9XX># zk80buYOCWJH0&20|D4etKd)U?!~Oe_c3sD>j2|Z34pO&X6T{Hx;@leU3J4E)E$XrQoxyA9l7;I(F>tvcj~S)s0!fKSA8F<40 zXT-VCq(E-qEd#v_^fu7az}p5K1FnI0474&}8i*T+DtlrIIU?P{7|;zE^kD~KVLvRC zTLx?c6FLUM1PwSBNvc*0mBgdd40JNknNeXNZJ?bBxz`RAOnLHAFw0BnQ~riPV__M+0jNtTphNfnx^N8CY-N69b@|3=GEyZ&C3@tsRnJZ`x|6KvBnR^Q zIcVUJ;_oUvoG*V*k@ppTz{pp`nN*dXv>lmoppzUm@Uaq}>m>J=3*GD_O^fE1?krT; z*ibvpSXKNSb3(E32?NwQY2Xw$h=DVzAvMo3)l|zR;Y4b8mcx&PK48%VeUViAx54<|rl} zHF4R%6$5vfC}iRn16K|FY2Yt@|6|~~fy|TIuN?ijHoLQI=qz2{Kw%=YNfl#{|x+X;1-iS3r#X`ll$>doQY>mR5I~LH>qr*3P@MTG%j@06>MqZl5EHdb)HYGg z#0w@~GWm8vS=?Rfu8X{Ag5&P#E~mQ7%O(>~ z)Wka`TA65O;tdlMd&rw6T9|mt1TAlFVwvie{p{``;fc8|O`Pf>Z!2W;sEL^Jn{7f@ z&42D8aTA6KlgoM{u!n`sEe2IjDce)>dP@1v!wD1hdj@^FCOi`zO>{Ehn@E{xZSpr+ zoEea3_LQDIC2eAAPg&hl+M2ksHqwr6?xIG19~+6GKc4H8FyFwzmv3G2BGC-tv5JIo?Yy_mYCWrRd=h_m0(D zMyoaAx{Tqty=78wS=L*|n%LD_PV|-uCb)AanV8J|-diTpMSbLvJ~D;T)koreWU3I@SzO)N06(8MegvsLGFOz=?8J~FY7lvo;>YhoT(t&hw%QPvKf?judsMt1j+ zD}DI;HI|upU`XC#?(x2|#6+3C@@!vO%6RT8ulAMYCRWh%>mu>K!tKv}y4u7VjzXWC zSZiV(H>`$TykTY+?(i)>lTWQm0vXn~Civc9`h= zcW5W4&nfhk-F+o$Zm#HU%A#-at4O>nb>dQeG?xruo+rP;gE@g+{m*ss6ffP z%!>Wwu*nCSL*{D z_(}<>xu~BE>6u4szccYY*O$?2;)01EOt6PbCVo_!KPgAi2{iSh@((@3K7Y>dT>m@t zi;1fye&<$g7G{UnO#Dj!%*(v9MdZ42(eZxrb3gfwsY4N}W%QRnP5fnIN*q(;_@9Zt zO+@2}#qp1cn@mA*ycoy7CT=ll$5A?t|4d}W(WOM>o;dD^^C_x;-=#1!j)ICn;l&3c zJanhxBoFo%Vj)#6tnltQvX$`OIPO!DB5{;bq^QDT3fZc79QP~!fWi{_@{)?wQJrw0 zGI2Z<$8&My#qn?)kHk?ij;G@&8%Mb~*7cXC;y7O-@@O2>`^(%C5%ThJwCpbx;z;+G z$KrTgktY;BsgUwP{Uu%^@=1SrCXTE)D#uYJjvx9<%@UDp)gk-Q6v>GrlrPDR<5|Tk zDZJTVs8)P{WGxHPGgadtvfHpCkvN`@gF|d85qWZeNF3ED86e~ZN<5XYeWXc?#o4WoQ;97~nLFty5~;usyr@HqAi zlo3k87#JDH@qzNwz+kP%#4$dO32}^#gH;|Krxxg6b#$TtI)wGeaTn5PJR!mykl#{yMdsBlpnHA_U^ z7!<58acLaO;#jS=DtGJhI994|S11W1lfqR>!Vn!%BCdll|exL+X; zaV-wUaVU=7gM!WSu9^px`S zVGCugU@o^0J))YdtrhftTc^B*3Km|p@DdHM@VJGLgxCJYJ9skdVHG5|~*{B3&$W%h&0u zNU6a>{q7ceSm>!Fy%cUPovEoqJlaP|`YPmmVId_$ z-ih&f|EO?!ezZhBi~P%ccq4R+{cvlKmX4z(!w!OE#%S3vS~6|G#!EI{wo%Z=oi-k| zQQpQ~HVWA&ZsUF%M@LIx8~56{&&J(0?y^PM%eShqx~Wj*}`j zs@jOKm5t}V#UylR84sAnU0eBhk=Hr^O7%tZ}s zq{qvU@iKFK-t6)6IwxzRi5=t|23unrSH?@>39@Cpd@^2|+TdQ`=#NbZ@C`blREY81 z!p2)R&e-6$b}enZZDW{?;Wpl}(aJ_^8*OYvZNzLOZ8$b`8-@+bhHb;N5$AntO+rm4 z$ao`EZGs#qnz!q(kTXFZ$p|NG9KV&fxp-dh2{LtpxJol+!?WSrSUEv9^vioMGkj=* z^z(AlHrT`Y3DVX^JFd0OI~ma4MhAx3MCoLsqYWOtIzc!b%c#e4JM+x)UtWWvd0lJ} zyV~fc2zhrKJ@R=^2FXOBu#b(tHu~Ebz;&D`&lSzQA1lWa`3F^<#W z9w``}z|GPu)NGQpnIwZJ$>L&p6KyP1WalKAVq>a}X$*q`;S-ajZ_T{FCP|UW^5kTh zX=9d+r8bt?nE7sGHWzoYIFn@#%`1`@6h-E7x$`9p6j^9vQNCocjV1Z~`N^`}#tM3# zYfV>7mcqsJmK&ilxAN$J8n&7PO_sGBda|rz+}ilS=Ix!>U}K|=y*BpQ*rcYzh1g@` z@MPI+V~ZkN6>d|wUEvOeI~DFyxLYAxeKA=||CjgMWZBR3GDQy9cw~xPzcai%BTRBo zRS(&CR}o4MEApO=_wyysO_3uuKCjbGDWHt41dB9ni2%qq$zTY zamdh}ET?R6nkQ@=oFXUbhbh5wke{CtEca;}zfK9F>#W)f+z#iM2B*sB3d>EEFKv8f zW3z)T4!*YW4O2l9lEk+*zT>(lFgbzmZCv24PvC_Fez5T)+a_>V0zcWfXyYFnH*H+9 z@w1KJZ2Znd!A;71GF5)%ENDQ5Z2nkqU6HFct|>xc-ICe3FO!GrOqGZ0Yq*qUPn8=~ zxR~{ajXxQXQ{^uk|6?LmeCbr#GgVGbm0zX`rb+oR8UNb2W#c~^uiuybzdLi-m2c)| zBydLpWv5Aj1du@PG$GGSVAtXhNx?*L*~8LkniNW)a00~>xIclr6SyaV4vjL4B!b6t z?oEI{{Ul0-D!!0+A3g9&CP~o*<`oHf)1+7e@6^rXk0}o%P$Gd!2~ zS1J*F7soQbSZ3)2$|Uem0uR%e1o}^tM`&IGPbE+>fpRqRQdX*I_7e#_s(5*Y6%;yxS+@rmi zz)J~O3D^m|oIv#i8Yb|10yPq-nc%6RE>07c zJEqG6(*ttjnJ|$*0&-lI1_`{D2p+)UtY5j7)hL0+3A9M?reD4gATN^_s|hqspkTL9 zGc~p53A~}IZ&IOc?&P*vM7F*7PgYB%P^oDsYr1fnZ*%RGVdSk8i6#(JL|14iG!uw( zS*K;t82$=I1bQaWD}i4h&2$oQ6YvtKHC>Kf%<@&(aKvt0odnVew5Eg+l|aV? zUaX$oHo;qz(P6r@m@apxw29%|_6f9KsO6N+=Fv_G%-wC%;LYXk4wO4o;yB) zE(1c(56zsAz(j`e3}KZxC4s34+(_ULhEoF56WGFVN?=9;GZR>pz~TgEB`}*?i8D%I z;q=@&3CyMD{Ooh3vT5FPGvw z=b=qB@}X>!dZ|#W8L};b?FoF8z|jPDB(O7q_qbo^{{(g?a9DM|hn{bn)pdp(NMNtx z`xH{RpL1^$A~~1<6<7`>@NPb@Js^8}>)cs0Wb!N8%1c=vsJzjmUiOD-)<+WfvUB!# zH?uxY;1gzA3e_|_*4H@MPZPZ79LEwk&MnDsRhH25x-aLRRGia4rO0W8XB3`I;G80# zE6muINi~))I938*DdE@5@QQq+kVn5&311jd7U3Rhl|O?wu)FGldShF++Y$;5P=tOu^_#jhWJFrgWSszb7zari|+x z`ZIyQm=BXEpTz$X_&b3DNn|GRPXad+$VlRjWRR3D*3JD_x#d;@|8daX^6KEcT{GqQ z%wVT?$kIMqnaymBBnl=`IElNHxbtf0?OWM*Cb6(#_^u>cy_E6c9a^CzU&o|*|7G8k z44(fgn+zh#S{=GKiTgNE5=E0>^+AQj6tY@8iTm^U1B#SLqGZ0L6p0(58cS&ZR^77MBi_phC6Sv%l_aVr@vLgj99x;rEETFmoFye^ zNyS+*{inR=lGr~h*nnF`YrXCX=g|pCkg!A)>0BvPEr}O63kMH7crl5Wl6W_X!%4iH zMD--PCeba48cEbl;?*P{M!@VQ;TLB~tt4tE`9M%`W_)9oyplv+#p@}g@S7*Y?Pm!O zHAv#MB(OBpDTz_Dq+t?`lW3B}>q(S(G0X=y8YP2=K^D!D;^VTL(rKLUENPa+8%exL z!)9c+N+Oy>^JEZ>Efl_`u%*Jc6~3d83frE`AjXo2=Sy@&427n`cV`9Z-Aclyx9Pw) zgC;CX-pq8Af}4b=h@V6oMN$f>lUAg461B!<-)_}5iFQe}SMm-?bj;Vh`f3gp{+cD7 zIeoP&yD0LzpV2*u9!bneVr~*w9}M+OqA$bpmAqa_RJ$2w>77KM+nf(a+zj_iqJI(t zk{Fo8q$DOMF(`?_NsLZnOcFy>YPxCRE{XA~O8JB&Cg$^svt^3nQp;pQ*?!Mo7LSeKTBhVrX6x zi;`HJ#QY?978s<57I3R7UUotzC3CN2ElFa15*w0ON}pWGVp*oh@+4L$vNB)3Dv8zk ze2pS&lUSE8VbNqnEgH_6}@sc#iFd?>goyO6{WNv!D{`iaJ0%=%H`osVgJ-jh|zFRG)L z6#lGmP^ZW*4B8|LIVkJ|N%dM17yisE;NW@^zp7;QTM~aH@n;gh(;+1bFn!%n^1XB9 zFD8GcdIxVG%lKPm=6@CbqmYUErXoCgOOgNb)h|)0S8oODRG-P_-l@^dVXu@K?kKBd{s3}2bOX8!(ymysn8=1$~x%gpu2-|4jy%o za*%dV-r*xo$a0YFAXF~$n1dU2L&fIG;|`v1@T3EN3-PqVrxdbUkv2~d5|(Ei*co9G z%|VWX*Xe|L5^|7B&pUih3eP&INprUPhNF!ZLZXHP|v|DDjx2cC(~wRRh}oW%@b#y%$+Co z9c=6pY2e^BMH(vHGfyaNsk*7JsnJRFv&qL2fZDPb}+^PFM)Uh z?c<=YgMJQvUlJPVU=TZxhx$7hpa_MV=gVLRLl}5tWw?W*^JS=mTl1yN0wEu!Bp2q( z2nQn_j8fGG3&dU^)UUKa#;UE+dx2Ca72@e>9L+8g8n1AII#h2&#$*Rm94v6K(7{v( z(;Up<(iGIDJDA~MmVSm|IDH5bY#RhBzg!Lm>mo(vIJJ6Pl3r-ic4 z!CD807E0^)LNCn>-MpAxAevinkvy?THmIJrUCY|Y6mcnQlfowLv$s0f#ysHTJ|Ej1 z?4V;^+;Fjz`_93eE}Fa8?O+c>%f&q|_Bz<-;9CdZIoQvsIXL0qq=SPT*TKhJofX=< z4h}nbk4b;21Ua;O6`Ri{!ZCZ=Q%yvaVL-l*7jr@wtQ34$i2d`ySNJk{s0j-Ks5HBzqRg zc?VxIFVVb( zToiVL`F{MqR$!@A-KpK{;yxGET)g0-h>M~w9&_=yi()Q{yC~)2K^OPCIPr~E!bM3J z4^V%F_Q+DHvQ+pHb?H&kV0#zlyyLX z*s%Tw+GN#3uccCfeHMv)xKzGgDo?n0(nZ*XwM?FJQPIUSF0x$wwN#dUp*`(_$Wm;X zWV_IKbeYsxCOK+SU229n$B^Q=E}m7Sl8efUoHjE!@hXZ}Rrs7j3iA{>H9R-s;&~V1 z1~EK+x%TMCL97m5CNH{p$wfUEuef;G#kq}I4Hq?CRClpxnXv3%CbeAD=G0siS}rv2 z%rdFtV#-Ha_u;wMmdUHDw9s;S)kS?5ja@Wx(ZI!PF4D`TkqfR-gXPjtkuTrVUU$)U zLzv`$Uusm~Q!P!ENw3$9G;{HWi$Tj}#d5jTBD8P0v~cm3i%l*zyJ+d+Z5P8`jBxRe zi&ic=yXfK~>LSLmR2b+k3>Qfkj*IKFGfleM1tXcu8h3GKxs*Dp*)9@XsV(8P>%v*5 zG(H;RG6+A?SbRl1cD_iiFPD^xhn4%aU-xRQU9_R)^utlDy^9Vm#-5C{b8+vAVEb2C zAst=x+pKkRK|b=RMr5_Ci*7FZaDpznyTLB&;i9LD#oM)NE2Ni;-b_I&q{rs)z7e^{ zUXEPX!{q&3^k$EmhSu#xdkX2e+ zx^`rwi%~9SyO`r*w2Lt=IE5+9dn;tDi}5ZdC_YZLqL7g=QB8I-x5EmVt*|Q}e9AzoP-ocRgag~cTF4ns6evYiBD?ZiA zuatG{>R4pGiw!P@t_{~(DJ@qDaia?+x^^pN=t@4bhOI7+xj61(n~Uu(-$8-HE_SHJ z-NRH*54hN+n#^4(yBQK{M`V2*KK`z@&&7Th2b51Z%`GeCAXoO7CN+ZWbV$i5d{2=h zj6E0cD`(OhA1Lyn!t*QTsG8cxEWe=RlYWYRso2#YcYUxoUGGeu?TP>GY%dblLH-&d^(Ef1oCs)mb@8K^O z|8r5rLsgG29Kb)!x*i_zaFg531w0h=!1(7tw_N znd%==^0FS@TO;4D5$crpaA1$dQf93X|6U`Hdw9Zw<{`(!lOCS(@QergxuS=sJust= zdr#vA=jucYoi{;_x zJmh(3;Ndk7VGj`xbv=w(E6;ln57j-?U=JQ1`b2xtLy1Eg9s2?$YoyaQ?IjO~YeZgF z&&c3#iJD{7QiJ-jt0x4z<>AP+V4@H*Ri zhKtVt`nCFT`M=~!SV3TLGAao zL33Jr|2pC23iDFRL)yb`4|_bc_Rz+|1P>EEv}G)L80cY;hxQ&icte7M3nvkb6nGd+6ce&9hp65Bv9OJw5dD(A&eiN3?tPY28QW_MyQZ z`gtH9y-t|@cy3yx$O|VT130hUnIwZf3}G-+`Jgt`!!Qpc&TAt*d{{EXE0*D`dch;2 z2-2toy_zwi($N8W_!W8^3l^7t;XdRTrZT=S}*fF%=fU6+owik zfd>Y5$MrJdtq{pO>t&G#M(>%!+G5UPeVB7x=3%*q4IVanSm9x%hqWHod06G4@&Ro% z_ZKB=g3Lc`eUOgWWbu00w_esWx2zXl8JELy@$kNf54h!3|4(j^Iva%Nbaut<@S%qz9zIgLlGU${MTjg%88a%ReU$O>kdKFbV3UM5$q(ZqB#*GwCMnC$n8UKm`B*wNo5Biy@Y4oA zjo$vMzn+=%gpVhEXg+fM;2Wg&1#_PA`33_#?c*6A{K_%Q$2~8GUf(3nCh50HD9QFQ zO_6UGhC+Vu@%ec_xHl%3`ihWO@=-aTSMgCbpFgKao{z915rrE!1vl7;k29O()+Q;n zSzh$iKxtM|B@HeAM*O@~+%9HA9W>*S1v&)nX@aW$~x;%Y}2QZkF0U>iDR? zS&YrXZ2yXnS6TJZz(=dSu4Q?H*wN=LZm_R>V%$nq5qL0a2Wz|+8KJ|GXak4tZqldQ2G#}I1n~#5d z{)Y}``q=7Yn~zyOX8Ty+W1){nMr6$KG1tdDKllv()mGVo;Mr3CdNrSZJ{Z2QV$LET zi+!y0vC79170irh`g5s|Q$L57`B?5_g^x|22Df?!cbAQlKeo#B-?CQwSnCI0r?clZ zs(*ebyw1mZddbH|)zud6>us{h$7Y6NR$jM1w8x&v%h@KcY?Jsl;XvDc>|k3T*M02t zvCGF%A0PYJ%^(bC^WMlKKKA(7OROAfvyCr-!JuujUsdOClLJ182Ynp!@h;bb8|_5+ z10|&VJ-SPAe&5CF3(@e0s=8xaa0A9iYFYUu{3kv>_3?ur+?q10Wau*=pZhq^u%RNo*{1ghMkdeY2DIkS{sbFgqNTEePZP9k=v|Tb&AdcNGa|+}#Bk}vyJ5#}D z)xF!La0+*)P$q?kQn)7-c(_;!KWvwKQ@Ae$=B^?s6jg+rxq@$1J-uCur*MA?52R2c zg;H!@FFX8O*7(a=C27E=EI%iM$nszcrBmP`7XPoThf~2$r@QJ@$l3N^_9H3qN9VFB zR9}%xQa*(WDO66ON(zsq@OTPOr0}F_^4O_7rbJGP#y^#Umcq>HxfN4JN! z{U6EBP9aN?2ODJb_9{x=s*;_PLWrK(A-O3$o5Jfmq|^?n#FB!&Lwf9x@jIky3eTnR zY6|sf>RVZP^h^pbk*5$z;rrg1&!^clv~C z@~9%!Q>dW`h3C6RYNt>qg?cHxl0u*CaNQKn?T`DgzJr4UVFSqjTjh^3&XFq`A1z!R&H;tQ0}D+M!!cnTK1 z#E?j#Z3>ALk|`YNr+F!K8=`IPsu?@QNx@Blyz5T+ca-L*kV+w)!swl{w1?I@g#|l> zO{h?!o7Rp)q;ROa)+L1oXo z4b&rrV!MRZ-i*mzGBkx@^lA!yQ|L#x?+Q+rLlo(s!hjS8a^gxjNC^k0(0iB6-6gj* z_wSN>?a=TPM$u-5U#ZXtg(FkEBRa&eq-0DAV^bKH!t>KIHk`~DuMY9()D$M<^NET~ zQaD-R6on(UN2V#lex|1|Lv=D!4ME8)RVA5A1D*&iQF~`z3iDI=ZkKc(ps_4q685|FX8w$#i%M@20Sgos`P&L3Ric@4uv}v?n(uBK+QWN4*=`>qS6gR8ZVQaGBz z$Bfd8SpGuILoO;8Be5fpsn_# zI!a0Thq9keI#SM z7VbU@Yo{^0Rc4(u>N2()1-BU0OXHO^|86yK&Z`O=rt!KW_0uT$Y<7b*UQ^Zi`+{?B zBgGr1(fEPv`I$iv^LI;=G@2?&?(bQYzrj%+%$|NQ^ky2wKidZ9$`)$9uI|ftJB@eJ zSjptT{GUcNjk#&eOCy$so<{#P>M{AJVW!b5joxX*)riS7oHVR7Y_4o5^HAyRgp$*M zDpiA<4Ba%^rqM19FJJDbk;>=kG+Ha(M&Z`o!Y1t%?~=wFBZ7;B4yxKQjZTVmR+vzS zx++ecZfSJS=RMNssd%G!@X6)qZt0UozcfA`liN3q3%lj!?%-!TmK*1_0ci|OV^BJ{ zv>uwqurvmzQEHD2Q4(HJP(C~z-1ab8Nk%9fsc=*pqth6p_&9}B9;=i|SjH>i1cejR zn54+`Qkgt7B^`W%o0{Kh8dpR$oS~4z%~WI-mn>g0M-iU==clnCjTLOtI(K0ji_%!0 z4o=OBxyAO#QU-AS-~-MQp3@6zyn%cfm$hl|W*g#XXEUfdCQG|qBeXh=HEA44mo46?$X5}&|`C?rbulzTsu~nsC@-1l)CtcIFDarOUcBD~f zkHq#!w>>g;kL*rk4|Voy?{N=a3++u~UmE*4@s%M~Sq`LeD2;d1xTA62L51t~$YCWp zyGN+DZ;z0?pT@;Ke3@Z@EFUVuZjW+J(>R&N>T0>4r15Dwc%j4zF7X|?pD8@1@Q%H5 zJdHo^$Ym+HH+auO&R#i{#_2T9q;WRQ_az1&PS2(Bc^coO{~uM~0VPGzM!T?=oO8}m zCM6z)qLC*7F>=}&xjQ{sDztS^0&Qp7N;td9QpLvQR{X0G!Ow3aw=BY!2 zahMGa#uP~s=|-b?OlqM2aUsk)H5jJ{qgn*jBRDe{XE|wM{1e7GM#5ke(NI*w1qSmI z!8?O77J-X{acM9v55|?jxXD9fFs^beVmAikI%jyE+A~jGxDq5GdNxm$obP=&dar-* zHurMb3?}am#=XHv(~wU?K@E}lD!+zw4ejQur{=4#%V$Bu_KYA2t$+q%llh8ng)|fv zfAaU|t700;_YaoPyq{ql8IV?7<8AKJ_(y<}8cJy>t)UF-U!uMp7%Z!yoQ5iz_qMIP zhDJj&DhifgkXb?FFHtiZ{*zfr6lPTxg`}#6Y8t9*sG*^380EsKsiBsJPc@9xP+LPC z4Nqx!T0>n8^)$5Q5H!@+&_F|T4J|Y@WStuP8Uh*`YuH=Z*F^e!pYZb2gH&j~++_bC zhZEGi=U_I~kRgN$leA`%oH$?6T58DBkgcJWhMRBuG6kuVx7Ls|K1d6Rs05j8qoLav z9|^I&#=CB!i-xWm9?;NZLa>vD2gRX-U`Ijf4{>PYgAZ%CT{O^HI7KS7M zf6WNKDx3~fXs=6>dfEIf!WyC)Vhl4boZW&7kv3+1fEL$4TsL3o8h?(Cw=}%1!O&o8 za5?iDm^HAA&(dHs*fcy|%SRhHAxM#Ah{o%{!Bg|qP>yRt@C`vKZ*p?xE9%5|G`y?f z1CCe2Fb(f9Y4}{jSPfG&{Gef+#xoofG)&a+rG~FGjAvB;*6M3U z^#Vofm1@n1%_ZMxV3N6^Uos|X_)f!Q4c~If7O3O`MWl@p`<^W>P`@uwKWdn&;U^70 zYhW^Yr|C2e(>2WC*7&(8ZGFC`6iI&3ym#`e7pUJfQ2bSp%I_LZE>P5oe=qAMpu$s9%jw%FKa^9x53|DGN&N(5c6{_ml8V$rs544~? zvQVwputCE{4aK7^Y21AjNw#R%s^PMRD;l=(xYKZ0!x0TTH0;!{Ps4rXooZqDIV2uOyg~Aah7MJh7%f2vBjRj zlROL?Hlgu{VJw(SPIKu?2ATVDzozGS@@u%L;XLE8Lvt!bTJy3&+9jTEWrOjB>Z*oo zJi5a`7}qu2U>Iw-tASZf+>DzVZt+aeaACP*cJ7*nSQ zsS^u?Q80`mVH6FcP#A^7=r%35ZJ}b;qJ@gaWU(-chfy+&Qel(`eUwhfyJn*TWbbM#V5Hh4DZb9m1#_MwKvHhC!dIVN?sFaTxc7Q9X>q zZ~JP6Q9Fzp!fOiBjXJGP81=(w5JufF>Pc4GB1Nku*f8upFS1b>S&}4gefz#9Vfexb zhLI8We%tS7e-|b0J&exm=ZC&7Vehr(Vd0AwsYk*fQm1tlv6~=$9t)#K7*BHGVLTp2fIt4{ z@{RG$Ymr7ydqPAiw5K`wql3M}=oN-J&3kzwQt2c5mPM*x7|(|Bk_^9p7z4t1K|0JV zzM4N5#=tP1598gFt!dNB2Pu-gC_YRM3WLaDz8vO_J-y+-8umWna!Scx6NO1Fj4;EG z&S6Bth=%cT7@vd@3nL!Jn_;{aMk0)47E4WzEhBDL_E0%gYjCaC#Ka3Bg!pe))yI~9q<2}yj z#2~HiVnvZ;co_c0>fy!eBL>W3^`Rh@5u7X0iJyisGK_D+m=MOOFh++lHjHs$j0xj2 zR=Zg7Z4cezVxM!EixtH$!uXOg6ULeuzOPthvHESX`bV6}NyhUn;$p?ziD66%Lg>IG?R!bm?FX*l$G#s0nIxYc#*8rkb>;22pThV#j9IKOj9^Z`_#4)|(cq=671N$nR48^t9l<#p-aR^~J^N_F`4zO<(OP!P#NVVTjfW z{>5EzCXIF0ofQ0fe&F9Q{tF{5f_xFA&G5|)<3t!I!MKo3Rr4)lkc6>K+*Sy#tl?W9#!BI<1X;ss&O;tw8^*dk&X0#1^7zIu zHVNM>xJ7VlUheom)5_KIJ}>VGV`msl?&5hOxx0CkmGSM#^V}c#%^+yc|H zE{H<$B2TTUie%m{f4v!5S9$*MXFr^F9%zgG*Z3+RB>nzu`rP7~xkRz@+hMd?qPh>y zAm`V$ccn%0dqTRrnVvs_^ax5vP$mLIP=Lrku|`lZg3#Guu?QwDQH3HX96^x?x-C(4 z&IaFEqKZcF@)AX(PjT@fDG|Y3QA$ZAtj7!n%0|4af0ZI={YP54h<9y}Rz89XdAyxEH1dSs2VMS(>2z(JV7JgsEyY(wY-UikmL4ZA3sxl&Q)@1Ek zqV6nF!3cy&@VQG>C(h(jwRNd_D1y!rJS-Km&S!-@BG@H@ zu3V7_9*v;8C{IW5Se|E3Aw42^TnO)x%PRm+2!Aqyr?^1!k8rlWyAcE(F56n}Z7xIGOi+N>Vj$l-0@0!D_5%3%2S0ea+PFk+=S_H30 zFj$7HMG%f)PL1HjrQR385hk~1(#T^G#3SCzaUuepu@pg4l6(cB$QUys7%K5*3R1Cz z*n*Cr8$nK9?vM!H$m303On+0j{*p zj9_>KXSZdJ6(spEf{!97x=f7_<>LrGiQv-+MsmE2%w_7OM>0l5Fj{gOE>kS>&@wfK zS&w9pf6j(PWD<8W$FVbaGO2$h(=tKuYe7!M_z1ocK4qDjyG%{wzT;Hn<$lMQS?0|i zZ8GOM*OQ?e!H>eH2~N%PZ#Ub!UGww^_DZRrBlsnPeW>Ki6kcYz@-J7jBOucGuL%B*;2+6ik|G^Q=0^B{18m^#=H`uHK?G|eSR3J` zS}clSNdyN=`de1=|JW^SF=KwY>Q&y~rI?@MQps8t!Ezxh1Xl_&ca@OUg7oiG$}2@% z7Xfj71TQXELzgS^O%ZI3U|R%Zm#fVY#47l=a8c^`f0x|t5$up6YnH3yV)<66-4X1G z;CzJta>CvS_OX=+4n?q^6UB!be;+&`r1}a)-gE_D7SU;iIuXIi2#!Q>lzU;t|L%=* zj7Lz#;Bi6T;^|Zbi52P$&)eKP=P)@;eIU+fc^>BJ6IQ5;5nPfbD;ve-2(IwOG>ZID zJ~jf^BDl?iD1yZ+)czIfdIUEjxEVpAm1@jNUQb5PmHw_T23I_gF?Xf^ZUpx@8`HAV zq8>I`sUBFV`mR**m5RyqC=f-7C`v{#Vx{_Fr793b!6*tvF>fV5G~v=pMN&A5BBGEN zjiQ+FZIWfq@E2R9N=5PK{n^1)e1HW?3+HdrsIWg2%SBN>iV9KhV5}@iQZb53!rS%9 zesq-=z*VBC8b!4zhII8uM0szOsu@MCD7HkgHHz9%)QQ55!il186!oI$7R94c)Q_S; z)O*kQa1;%rXcR>-ii{{4N5TK(`lI-Fl_I$>ipi@~lPG+mlT%!?N(DsU%NC<(7DaXx zt)t%UDVj&oB8ry6c@x)GQ9g9TyCLoMRo+!Z-V&CW#SZk!CQ(s@qG%IE+bBw{_OfWa z11;~@+E9}1#It=A_j4da)dPYZ1Um{+>=fnGa=qM#@|4c3bG4!}Z$#Q7QM79o>=H#+ zP95*0Q8Bn|L|XSK9*bgd6pyzJ_8>;li(l+U(KG6OHTHzyCnx>nPe$=n6y(#*w5LU% zWqQwD>cbiC?(ZMPfGD1cqHh%aqIg!s&)a4)tLJLl0qdiSoT$M&gCOktA-^qylOe;J-vT;g` zd>zI3DB7=46Gf!YH$o;v@$?#%TWXRhi8X3+6yHbjdlWOdoliEI!o`hZY7{?2!T<37 z81deDP9u-v7mEA_vwm8fU_od9N zC{{XgzoPg%ie*tOXCF>9`6r4+LjD!}Pmuat9vZ@{b@0uPVuA35 zf^HQb9Tqe2hWKbpge(>0J8*ufv_e|s$IO*N*q>EVbhzie*m(1D|#aO>UZtW_s@Hm>#ly|`hmIupg&C@w^CF^Y3hoLH;QN3nQx%Tuj0>5#t8 zbE~>eU5cWI@XPEH??SUqwfn5)HI6rmv>5Wma3hLW)~Q?UBtuJlhOAR#rO2Hq?nbdz z_^fs6p5#_O;nh#e9|QQCkQ15dF(me79}zeH>GJM6RVaqSF*JywVGKoLC>lf67^=lk zEQaDSl#ii846TRzO2kk$hH^3Qt$RtqQZbYkQbus%)85?xYOYs%NBVj-%-*omS8!Z< z#TY8bP$h;+G4GH6YQ0+3F3{nS|KIVx_2Yc+zvrtSLyZ{f#85Yeno>`#7-~~|(>Hmv zukKv$UIBx*28r#K`s&5dZHuoy-KP2I@ZLrrlZ|3%97D4hwtu7Ui=jyjff#~Pl`n=B ztSwBCiQLG?yC69u2l&2S$1SgU*a0D~1PS zcqoQW{8F*CrM)GJ3kskiX*|8q}?lCM`uO5q` zM-0z*^*>NEtJ~Z(l11J9%zZM3r(&>Tu=)F+7<$F8w17dhC=G}{iZ@&k!i5LcPhBqiCFRoW5HmDakq8LbMbSpG3o%nJLuf*_b z46ntIiosyKl}LX*hQVw|?qb9wU-z{b!lFcC-aCY7UT!RgxG0G{B^l$hbpKbDA51!K zP-bqy57St1&<5qi;KuM}3}3~N6T^@g-iqPv7~Wv?cJb5RjA5woH#Vqo8@ywG<_7gn z4DZJ9Sqz`YFpQz{b=rF|yw4>Ys@85$AH*;`=G_4Q$OiSHkP(7ZJ`%$F-hV9QlRW*? z7)IvtQ9?$?FeXpQiehXG<6_<``xi0q{R11yzfslPsHpIb$Ja58k6~I2(_{E1h6yoD ziQxwZ-bOVshDkAeOYEM>_mJPkK;`?G_kMD+h`jM&kBy2*g+AIwHEg5$F@~vGM~T4Fngn#|4jyw`pmpJpC#lE!9VFEL>u9K zmZaNXG5jscKY|qh74o0p+!*HN=`6A^#>abkOSw^Sv2i=?knMs8H+ZAi6~pcrzK&yj9DBHV zW9S`6pE&l#u%E|Z9L3_`cdQ3u$RGDU;U0|PPz;B8_{VT5hRfVCF&vBG6wi|w)^bhT zWE|V5j>m9<`bI@NDTF%hObqA6?Q9I^Vo2NM`Lh%&Azl!?$TLtxDpz8-l~?W67_P-| zo#($e+!U<5Ni~;Bx^7apW4IH;UGYzgdlk~|-o?FFm!&bQh$u|bp?Dl6;&>pA4sn!>qf{JC;_$JOp25;_SgW$i2`?j9R&dF; z+2!M?5J%UbzoKB{I4TLDQaO$)!mGwnO-S`P>gMIvh@+*VFWv`N(yUO!K1 zAf#a&jq;S?o78=IeDWqfrV4>Lvg2qSM=*|zI9|LJ%#5RH9L?ewoZsIvj?d<0HIJi3 z9B2DdF>jN~El$FQ z`1@@l75@I5_p9j`_nv+BR2-e+crcEK;@(Yc9vAE^$mGLuJR-bHp3+rFw>TaZ(p~Ve zyxbl_w8`l#+f(=xaXcwx>n26<={Uac>OF(3SKND3!TVY~6Gz`T-ihPgIQqr$Y~1@i zrN_}fjsbDJz$ub|zq&~=?4J`pQ1JOU-hSAB`k}Nzal8~qIF3jhFURo;XMp^}w3Cl{ z_b{Zr8pmsK@3$!AZ_G;{9ETRi`W}8>LZrg?w9z+jFKH z$y<^|!sLQIS$wdbf9>>@?MoV&xAob7U;3Gx&@)6yv#>Mev9ACxph2#$3tR`(%d>+c| z&E5+E?~eFQ924UBBY{5?m>9>TIHq!G;`o+ZmD}?~6E0Kt`!gpqm~+yn#KD1oAIGB2 zYUgG(dv?|jar_tu9hgg;F3UPQjyZA6h~uX?evW&;DE?iL5tPW&J;dN z@DIU11@Eulin)Kq@i%v90<{wOCysyPxE06kIR1-cE~ASFDYrlz^W#_@$C@}6#IZ1r zrEx4{KY2J5^IzMn7RT{RasSSTvr27IOX5hy1D{v%FOOpdS9yzC8OMEF)EAwzI&D$? zx2Vxu)T%gUPt4lTHe)R(GwxmU*&YY4Bdw2PV;q|}t}SXq9NWwJS8P!uOZhj)u`P~4 zf241Tk`L75#g8_{VWNjx%x8 zsN~-t$Kg1R#PQZvb%2q>+PH#S)$d|!wyL9X9E+oQE&s_lj+1Xy1-7ZW+tdl+B})6L zoQmVmGTzlHx}D{&jN>X_WlDL&KOe_M>Ba@=eCuuMscq^Kx79XvS@bJ{>}S*B{%dhu zkK;xh!?&rM4D6bIlJB-DR@Jy))}1)+#!)1Jq6uuc&wnqD{0XEdFn^m$OMsJ^FM(2J z{LDfE1rjKn0LNP}f$iH=p#;C^4{$!4kIlHUO%>m+IzP{Y+g~h!;tB7+EmabHR3b_y zP$q%02{hiWN+n=!_b#}VPN3s<#cOoWZdc_JC@gnN(V~pP{r$IHrk<> z8%Utd4)tK&%qMoJrU^7pphW`B*xRCko_zw1`v$5!6KKhS*UPM5C$mJ|%-46QtOT+X zXqQ0y1X{B*eF8Igs5S|x1VRbCy+f65mRY4y;Hw>~EqnM(VAT#apjY7j1RfCQ&Ixqj zEG6(@0uLo{Y=^qpE6|Bz-vEu>xVJ-*Os|_+aisBq4i)Dj3M5KSP) zg{z$zk>PW;AKK|HifWKqw0>qhff0QJ3BjZwlX?QFJZ=av6R?D^S~|E1Z40`Dd8egbcCnGzV504Mn!2?>^cmofQtfZ;)r3(X}Pu+v+J4;VJR z0v{$YJON{;D%;!ZKf8LVS?0$He3HQD35-qPQx;Ev;ur>J^UP5Rj833jFVC6DaXS^s zX9;k9S?9LifpOf1jL!tdC%{PiGJ&rWc(!-omz`?mPL-^cd3dM#hWocqU;;OVkRN&l z7>Dc_9T=A1Nynxn@PmZextDNT6S zm*#T+?(}Y0%F9jjL?JJ?OD*IHlR(uZpM#0T2`ou?SFTDVu~f)@!DWKW1y>}nGJ#bI ztWID@0y{a71lA_7DS^!itP`INg6jp}D(HQ)vr#z7xvw*~2;Y{cY!%XAmv?n*yYODw zzFk802<{flb=xa^pI~m00|^{V;7|gG6DXAQI)5aAqX}F{;39Xlc%BkGE_gzaZYPD* z3j|Ila3+DXdHOja&7?o)g`Z3ME+uf8`-mG~lq(5b%k#gQKyFpn^OPGxhNXD}zn#Fn z1k$8qcSOIN04roxJ`vN2Lh>ikRvIlJNmf!YiDgfFo-~req8AY?Dp*XAxy6%sZIbt8 zTuD(%36>TtBUmB%Vuxgw`jCXYzPoA^nngR!ILmeLxZ=hkDKfMR{Iu-i0Pq1|{)Q z5}zgUc@i%t@k$adbCY z^hm{YCgVvYl1L?CB)!iF$t0>im7yo`_1rWjn=VOX(oDii!by7HU+~+6Z|0`ijF}P{ zw2yYFDZ3P#7?Q*rNsLJ1<0OW%wh|e`l6WtPH%;lxLTO*QuBgqMZ zH+QRVx#%6e&rOrX|2xih{r^3|_InsC)Uz3>1(A~pF?qc8Le%kaT zW(fZ&Px(2CB0apU-;($}i7iQNO=4yevyxcEPA2h35`QMqZI7Ct>KRT8U{Xf4eV*Kuz5s0~T*_ascN=f)oyoN_&DV-lOBMdn_=nzcCz zB7L?cu|0|XT=yjSul5~D?^5dSBzAH|`exI1i9+&Wk&HdU_j00=nDBV|$vukB2a`CI z#Hl1sCviB5BjR%+i2{4o(Ik#Zvi4rZ%8w_#YqPu(OFYR{n44CZEp?WB<^r@Iu7W#%l*X#)iF~?nvQ%rp3?EOj{G{(bv_&!0Ugj$Ku1L#m2?!;QAkG# z9VK-X)=@-9aUIdUs$vpFbu6A6ET*IPUhhToUR@uPea|#$)Xi5)$47frX&q&R%%2x* zTFh5gM>!pDHw$cz`k5@xhE6uAAV|`(s;{z+Dmv=usH>x@j%qspVC%1`^GATb;1FMR z9aHwI`Fm9j9mHLGRV^L0b?;vBSN1B}%GsIqbkx_;SjT-j8t7=KqY;z))cjvEOYKt? z#(8MY3-S*6O?2$N)a2(oP5SOrBtA)Y+NXj#GIZRp;{hE_bu`n_T8GlnTt^EXnL4th z!!30TKi{O4j-uoItG@Eb_Nhn4pxzgWW2l=Vj{lsbeR0ka$bv&x0yN*se9@Oy&hp&Twf__NH!hLG{KE-pjvkv0J zf<^lHyXyS5(br8X?ZPe&ge&*(_$Fm&|Q(ND+AI$qK7td9OVp4ah$j#qyT_Smlm z=y*;C$GEYYZ{^)419eRPBC~i=@73x>9fNfET6p~DSNtR|Ns=@FDhH)Q=iE-rWEfPv z)8us>9ZoeFEJ&gW3G0Xmi3-L9KNss`w!Yt6wUN4aTmDh|)hHdD zbIuR>Hplmwj-|bPV|9$v@wtv!*PHZg?ITV+-{cD&zwB3Q_AC3};Fk>Y*1nMA8?WOV z9p7^o=$N4MzOtC4<6GGsgBE#r8D$)DdcTwSoXp@E>^rnyRW0D_(DdffO_DMP)GwTY1L{|9;RBun@i*a*9Z<6vZ#q`!SgGSr z9kUsqIu_}eqvJ0g5zT}1b?@t>zd5%$UO%AzktCIWh5RRY`?u_QlFN_(ZyZny@_a@g z@E#q$SjQ614?8KzWs*xzKF5T)%XQS;lSQ&h^bI;T>R7GwdFWodQ(s7<=UT?V583N< ztQW$kDl^I4O**#d*s6n#Zf2bSmc8JB+NNXM0kuQNP958YpE=+?Vtbd4-8>n@ZI2*D z7Abg8)jX*7iNYksgEH;Mxz;)k2|p}&MDVEYeHBhSCWL>9>gswvD!;inX;rBFSEFH`s`g&HZ; zOd*^?B!yZj)K1}%6uP8PCxyBxWTenEg;(Zg*Gr*s3iqY(T+6KbDKto-A>9tDMk(yA z9?V5%&90HrBn6^Bg%=MhpOhVPPz6M!9+VnLnx)V@g*GX)O`$~!EmK%>P_<5>RSI^? ztX~eQtQ5XDs4^u zAqBdTJeXI1=M)|io?FSo(i|NYuFUM3Lbnw9rqC~iM^pIpX7G`gSv@$bPiAya;V~gK z4k;!dPoZZDPo(f<3cXY4LsBREsTBW1RiaighXGA1_^^oe^)BkJ= z15$nuf&-->n|LjS!Cb_aS+v)Mupx3S zh1_H`g;)x2q%bsvxGYB^g=Ah;ddho)no7Zt$>}*ad*~r$ruYX#jHsDGZn5AYWef7_ zU{`cz

    3RYBPSc$Ak zRwk=hVWd1)+ou|v)k)cvwXCRZh208=6?LqrYeltpx~^6<%okVBiWXMaZC zCEKaq&W-gQtdL3M)zOMh^v>kpWEa&d50dL1{T*2?KbHi zD>hgSUeZVU$p9H7Lso<-QkikKaiA50thi;xZ7T*_(Rq|^mleCM7-GdxD~4Gy+=^*d zOqb(xws8bG-incwQKaOfDPzd7R*X}5(mMv}oxtWqD<)AUlT*m4q*n9ZFvE(ORxFdl zjB7fJTwuj)${bR*!(7TdE9R@D&TQ?CY@rp4RI-?|#EPXVX;aj&!itqvY*)!DE7r-0 zY{hCOYgE2g7GsjO3pOy>Om6(%OK$q^a!~a%Y*D_|ifzgt_BHHKzEftw@6_zEVy_jK ztdMQ8&x-w4lzb7JWxn#MvuuYXWnNe@H8K9ZTo7g( zU(%)d%8J*@-%#F?@2u!J+b9K6{K1NkoJ#zY6`$!}$ge8je>3hswG2sY+QP(;No`0* zktDed@;j_ZN*jK%p^Oc&Hl(s4wM~0mMKK%F*pSwSoHpdL$uo(x$}DQy^fqLmXCyPJ zJhKh*i?CE?Ws*(h*(o{5CgZf7m7D%Ena75_lze1U^#WkYHDFDlX5&@7E!y8QAdAR8*!P|*eh$B853)tCu3lvQ5N zhVshOn6%%FD%nuShPpOXwxNm*M%7z`QkAS`Lv>2>x<8JGnrzmxp*H3F@A&oTzmhU? zeM$ox8d4gOja9Ea5ac)IO>Fp`-jr;n@-efGEo}Hx_L^Pp8H<)S{AI&98^+tv%7)f9 zxNY#*Q1EQBHa2vzp{oreC+XU9@^&_~r*yEPqwLL`KhCU93_Fv5%aKznur7zjfhW;wA)mopZ+(a?kU{OhEqqg^LHrSasNGItc z7u?g9aP?a4M~kTkl6h^|;n4eR@Y@hzLC}UlHVn2Q#HN&mZHUmLF zL2MYxd>A>L9LZZTOO1nXSfdz@Cdb$?mLk3K2!jbWOtfLM4OepE+fCM z;|earN>UbPl?|)uYiw9cS!csW)w|w?4a&988_+kYXm)uA0x8VTgAbE(C$`7yfM{PJ}!#f+~rd!8tIAOyB8y?zl z(uPwkyH1|A;gSuPZ8&4YSsTu&5iU^9+wf$uHtUOQ-fgV;75V`F^YkkH8X4iIL2lS^ zlg(S?T^nvw?vOJ1y?AYqdp7*T#cX>-_-o03zFnTrzTmx%M&kyquF_$jjdY!)DYCJjkqLvM#c z)t9Hl*%7aj1Ut$qFK35*kV8h3R|PvRrqxES#NNuPrV7PqM^%+nv!ge+a7{bpj>__R zo2LB@wdl1;3G3KVmtIdL_3db&Ts}6?*p6TA7;48bJASjHi5(U@takivM^igG+R@35 zW_J9+nYOm0Ii(fZg8Y+|1#W4_U-a)=Mw0KBg*FV^+R={Ep6o!%dxVsAruVR;ryYOO zCG0}!YDYJfbf+}rD)+LZzsh@4`qA485M$C2YnsaY}GIMI$tc1*UTl& zlzf?-7df=w@mDap5U*VgR@<@0j(!gGcVMj@>+E=E$9p^0+p)op`*u9AW24mDam9|S zc5Jd^vmK}9Wd9Ji#g46V&bE&~!U4D0vB!?R^zC-+pzI`NM!W3TP4COUw@b2*&4c8A zI}T8Kx7U8GlGhNb5j42UeVj{bmOo82(WIAE!;?_;KZr zaUdx@nM#s7wEIiT98)k!sq&vFsmRn0q*3|p+%e5g#-?{5y8}5K$e{9!luQm}R!J60 zRtK`F#5z=$(}8GSLjea4pVo=wVl%e`c_?|we5CZ|ci>$bgNPLW>_9mMqLRj$%2acpx&zG|_``ut;g}j6q=5s{Rg+%Jf!Y)q zwvGdJ>Gf1npECW1wrd(X&`9Nt9r#uGZw@q}|4ueld7pO`~X;2fYpH!4vcib z=78OSVejLHJK&H_k(e;PRHcMDMyCTVSv8I(BL^MuDEB(xqx;E#%FDcu3po&GGeQoQ zT}BzGY6dx=OQGE)Q(i+D4wbp9-t%wbM%;><^EPgj1EU>SsSZq|jCWuHMZ$>=OrlR#$rM?~TXE7Q^P0|C%q3@#Gs#)xY;ukRa<9wp%Qlb6 zd~$&U3n{O1X;=6q4lH$GvjbTx8|Af3uI=>Yz~T<^dJ z%0}{kKxSxx3IaD+(vG9$nRg;+;@^9yJRjG^&)#6*yq4S2QE3V-+}pq4BLjs zoNypA$Z)`cgIo()g+sDEl^=27DE%0DT;=8Z8cxdb(=g!_lhfoG@~o;k=fHXT1(p0U z$9UO+D-Hy|=)O8|)q!gcJa(W^PVL4o*I9Pgfg7s+rUSQ>-*(^*{ri7L?y3AA%6$hO zP#%(xRBz%O;}Zv-I`A)(R}Q?UJR_fzFC2JDxuyQ!@y3A8xCt0YduI8oGzVooG=BAFBEoJjA)e~3x$#J(B*UD>Umv8)?{)bGbIa|(}}EV+H92U zWDY03-|H{e_uhrN+>|_IUb2!eM()p+--!Zj{!A7mWvL2L3OiAR^8F5e#hobOL}@2} zaYAmGd@T+oohao*pGo@9!xHjs)o!7zbE1qBzdO;?iC8D}PRt7E>NsI=BF+i9OQ2<)ENYUH)N-P>@_QAM z*L9*EC#g?1A{#i-kdn2cc8QQzV>W*!e5r32ZK?Bv9;uG(9Yy#98gi>mBOnORWZ!-<}9n7NVM zjb2XlcA|+3zq`=KiM~#}bK<=d{ha9U#6c$xIWfSAL?=Q{gq<)sVV31_!YSc``2Wo@ zTGaSfip>c-CI1EO2laII3?)zLT}-Nuig!C9^pIXBd=x(!AcLgToSCbOI1zPXffEaz z80f^BPKK#YOmkw86N8-?;>1u6J6?`?ip*{lWw;X~C?m;i>QhXk*&O4~x~FUN2p{If+cQhq70$Ka~CC0oB{~lK!w0N1WPy-Jd#f zRF0Orap#;kFUKC2_P8V=oxDy^PC9W)C8wP@qx>vI?oEBciNIU!P4fojB6-P)%M|Il zA{R0GHI-aALB}EhlcPt#sdsJM_CMx#z?`bnjVhzdTU+Lnj{5ACpg1e)Ed% zUnf304bN2a+=&ndzlcl2Fs%!& z^}1JlPmu}Jxga+ZPfuoWAtObSOfF=mXCbqy{L}Ne94_Q^p|A_6gIq4;cA=09kzxr4 z3mfvd(4@GwJo3uxLO!)T`6&fl_*o?dUAXz1wmOCH$I0PQ#D$_R6my}t3%a?+dM=c3 zp`;6yT&T=RO1V&$Qrd-IC_2(WmT@7Lq9VImN**G@i$pjbD&eeYMmsdF#$}_B> z>MOdiy5W!Wu?oYQq>-%ZLN!%c-Gv&;KgVkCwzb%-P1bRtE+sRcSs=aj*=*oKLrNpE zF)6*jQhsw`{#Nb4Zt6la7dE-D*@Zt`Xzs#z7bdvS!i7I&BfAiFp`{Cdx!`tbA6akZ z!p7;kjxKbP9mJv9sFB-J+L7&D=s*b%{;`goUFhLLPZ$1H^<5}k$!=tKso}lTd%4it zg#oIv52Xe_7T(t-k4^mXJ86GPvH>xPE|}cTM>ZZwMDG1qw9g%i?sEA~B4$&)Tza^bQI zr_@rNcHs>DtPAH{IIr@HE?iK4ZLTqapKFylUSW8Xyh>hk;kv54K}p=F9sIXkxXtDr z@~*16=fd}udf>uC7m~WQqx$)?xJNF$aN(s3k5%Op%2V=R@)`Nuh4_y@KI#3+h0hFM zyYR+^w{#isJ>{JX$^X+f;0Kj|ly?E;zws7WUtIXAl5Z~jM^D0~k_ltn$Tm+qP@~VZ z4GuR_xN+HyD{iE8<0m&FZbaQk+Ml#5C4#>Lb6 z!bkLd&l@thk&)wPawD@FS=798x{+0RHaD`akg$Y#>8X8oTkU8(rP#CL+&{cjHetTDtLXMBju3zq`?t z(v19rY);CUE!;@DUt80^R3gjP%8k};v{6Y%N?Wp>8|^6_RBzfY=tS?VlE2;PLVwP` zBzJeC2ak;|>0^4z5C3ii-1u$Km;Eo@rd zu&LbchC_K57+iEW=~21Y4IkaFk~!UtLFFMg!phediW%s}AUC$TvE7ZqZVYi_wi|QY z80y9_+2#lJvsgUbjmeY|YTA*MQErTOV+?&PIl+x_s%AVTex7k6Ws=I}S@yDaQ{0%! zWEwf0oI%bc)A29%ojT~{aGEO{9EN6_^~>Cle=g5+<4$_Rd~$&s3n`1p#pDulDJhk* z$CtaY!VMW=r5hV4t4K*!yRk<3S~u1yU++fqc}6MN$mD-2-$dE$#umy}mA9?0-{Hni zH;%b++>Kps>~`ab8%O1I?y8Nm$Bp_0;^i3L%OiOox!;Wgl!N3UQfdynv3|B*Bypax zL$!DreA0XU2{~wo>rT3HN;dmEqxj_Q`bV!ToaX6phLrQ-EajXV=T&lna?y=TDv>3* z>c%y>$as+5gX?bGaO1rkx3boI^fzVGxpCKxTW;KTLq4K#d!(^U+KMu}dv5&W#xt(9 z3?jw%S@3{-NJ{-9Hy$g0;>J_u|GH7+mQD&}gFNRTFUXf}yrR4&-;i&~ccj$k$`b$4 zjZbpL_TVQEKD+V7jjwKebEEHhgB&WdqkE>U_#e-{cSrPne${_{ZAjvQFvf$V6!Byp zBv%d(QYgP~G^Fw%wFhZDNb7-pq(MfIE3ll8HM<(qc_0PyfBEzt6;_H>>x-h%`WM9PxoNNJX*RPdl8MUH9-Ws=GsRPn&*K~;`Wi>yXU zZ*>o9&}*vXeRpGRdL6PZSx@y&eO=+TC!wJ%TY-4PYkeaR81;I0QI56m7M@!+Tj77wf*tngr^2Lo;KHV;O5 z4D3m{h&421Gfhr4?=8uNy&pA_~?Gw9W!+Sx;!UKy0BRLRW7V5Bb2Dj zg)&Ixspf0f=OG>pWipH$PL3c)l3I;9evAiWJ(%x7Dx>zh$v6)ts^0OG3FNlyNhf(Q z*@Gz_Ol2~goJLM3H(idKL77R)XtOB0&GB<6bIEz+_ir05@L(aEi^#?fM4|aL5TekUb-5Tbb=xfP!9;~NqAUBf#BZD21$|RdT@?q)tEu_d+ z$~F(St7Hddrw8Tt=%hdA@+Fd}1^Hge-sdq_Ry~n&W3@Go1FI*nHz<4>G5U>#$pQh7+Fk;2h<=8s`G#q6e2K z>HBIw5y^MHuE<5;a@kmZOU9*{5=o;@!*>W|H%byhwi=yFFknW z!2=H-da(R-+#?Ta&Nt>b75mtOG2h~zkRngzbfZ5bpOY_CZ=rK>9p@Wgd+^4Cw;lxM z8_S-KD|}b?POeVN4YTJP#ov1%{NTYyiufnWXYz|&##Mf2No*1?V!X)YMP@IenaU*f zqH;}RMlX_ivHgP~xtC{z7bz$yy+})u&GM5MspzT6G%A1050j^3GrboXDDA3iBt0*Ou&FqSv7ig{7niz^qjpPU=#HWc@wgcoxA-;!RG^P;>L zrMxKZ#V-sEr1a{%C_|4W^(sHIG*)`!yogsxf){0#Pg$VNr2-ey=tV_JC9*PEh5UX; z+^Sww^P)NvnW}~t_up$9p{7b|d9fw8b_B|;gEw8%)$^jh7wgwi81BUg_KqaS zq=*?s8STXw%2-myl-p2G@M5AD)4Z52N9^j@qvhfzv3D{#g`BGDYxP5&Px={NG_@KQ zc=73U>`X6aQN(9^F^4{voJY=Ay>GY2F64xZ$i<|Lv&4&~%9nYuoGvROU8}rU?Zsy= zzId_5i?v={^5U`=>%3U+#YssTV*{6M54lk-=l{Ie~6jGAb2@LC&upcV!sy$yg10FBuBkCr2H`Dh+GFU8>CBK$GkYs@Pw+7 z+Yvl<>rTm`H8|lkd4@de#W{-P=e@W zxaq|cF6}L~%=f*xO~0d(yI$O*|D%%9@x}-AhvXyjvFiQ4S)R%PFLPul_b!m_^IR^E zY`!G-Zs5C;n(B=gZ|Uz;@}Ba+i;pUi8!vpRVU(LEeD&g+tc4GmeYm_b_CGIvqKGH) zAx3#pACf6g?gNyk@X3=tv4vPN>>hAcj9OJ?%*@;{N_VGAM*R4_rc&p0Uv($ zVT>&%)(2-nLqQ*QZPAtRX>T-zd?-vQLP}E9hhp^Nlj zao#?+st?uFRMjape5gsOMc!zjO;yK-x@^`X8~ae7B3%tA4Q0Dg&IGlK)sQaQR84&N z-G{Ib5g(fR(9DM(KJ?^P`oo73)eIedXzoJ`PWYz}Z73~CnfxzGD<4{` z0V+wPn0%0@NK1h%kHrV84>nF~_rXPRkWTWK>_5IY>Soj9gO?)Hrn#*5(*tCX45{9o zoAgm1vW(D=^kI}7`TKPPeHf&A2UCXlFqATk98QiPWqi5ws&KRqlYE%Wa11$?9OuJ$ z$^>#EDfNe*B$+~=<-=^sR3D~MrmLD6l$k!ftEe6D@|weB5jod~d8%?gWdXU+hrNGk zZ-|T8T%u~0QkKb7yt(K~A6EJB*oP-RtoC7z4<~&%B}dV_Bx`+G=fip*?yrfh*GBu- z(gq(IkI>7lYd6Xu9A}dcJABwl-|WK{AKdx0BWEj`*1`hdwe)R z-%IXO`F6RJ|~XM37{g^PVg}qtE&mK78tC+a(v9fc{=IJ$?@}%xyamP9#WPkuODYOYloA(@-y7{BuPO(3i%PsW??_%nf3B2Nh#t- zQA#ngI9Y;}n%`C!N+~Z*`Na<%rHsli^I6+^4sIah$ape=EbGUiMcN`&@S~z1|D`N* zb-2C~yCkeZsq9A;l^7{i{isH%uJRieeNE-H{HQG($B(*98mPRUANA=ac>*@1Ur3^D zlVAP#&5tX7T=k=gAHVxC#gD0eH1(sIA6@CjTb8kahkS)7_6A zehl%;{X)^xk6wPfJE;%((c6zctnv8Kmtyk6OzB7VCkK#;ehlJ0F=TcYCJxf-hm9h+ z-H)C8kAstmOXY6aCj35{)OZ>CNIw}MgZ>}i0}8V#l@UtRkAW%~L>cVItvx@E!(o1m z^+UehCiTPp7@;ah`Z0<=S|wvB<@oKDaej6yrNEC(e$4VC@v(lDA5Z7%XZtaS6V4@>>B6-hGtfP2vyADdxv%KhDTW@l==Vf4VR4^@nAf3^5!b zkIL~(k>t1^CzPM`%xp|LU7{J1Ws zb^w(ExZ%f5Khgw{Hh^2Q0WZgW_T!5mxBa-|$6Y_}`SC^$)Qg6HIKpG8q1-1QkPpd6 za>1;r?TDvrioEdSU**sIcut>rPOEvT@>hPmR_@OhBQtu-*}e1QJw=iaetcB^$&c_Y zgM>23S3lYt<7`&lH@Qr4kR$=52=Mw(CMA=R$w`nht=!&Lm@llfUPAR24xotgqLgA}@c>5e`f=u#44@Rl(&R6sj{N>z7(HF)UM>Iw zJx(R@l!O4ve$T6DW0qIF6$0{Ha_y(_$^ldfAZLZ79Re^05N@RZHGtm&s2b4joGb;^ z0;nE9jR0zL+PZ3lS^?Ci*CD&{+Ep)r`T;ahHH`vjsJujyn8x()_bYC)Oy4AcmH{kU zq5ECcG!3Ac@;@le1870{Q{`v)f7QR(Y!yIjN*l5**^X>a%JR#Ni#rC;DS*xa{2hQJ z04KY;1kfvh-T`!Fvzw~#PU#UqPs;Z_-iO{Vfc^pWrOQ_xWpH^7VAB#nBE>{XZl?UZ zCdNv!k#=$l@5|&0XxGLdDdMJhNN)f>mHR1y0Q{E?QWjEqIDiN}N)99ksosN=bVCCe z7Qm_yR);V=fDy9CgD4xs$N)wKup@w-a-;I7xyyPBP+ z-wxnH02c$e#HQre0=P`SqLQn!yR-i|Ca=r80P~yVEmiaP0^=R!cPaM*c-&I^Md?8R z4+D54O_|qnU9qYObGQIc?XI`m#AOh)F8H%dconW^)QTHHdR{v@=v*(}S3yDrZt=k+XyNz9r`dQD&iW z9yvdV1wkyNFD0dGQ4oviOH|Tep>dh=I#SQEtBAdUoaG>COUZ01hi z62yAWdIPzU{2#fA-26R}KShp<*&4()Hn)>|gV;gYN$w(L?RLw%fbx@l;`aryUyj(& zkI(5HVAnzNP!NYz<DSH;8+3c8Aa;gn#5Z5X6@tz6SAt zH4lS$6vPSn1H~%+;~?}Kw6pA05KrjRd@An(^k*u0PI(c;OO=EcYVTaHIpCWh-csI? z@8!Bg`AB{yKgm_-qqd2*tk&MYzRC3=h-@Kb4`~P0!P$l+l$a2bQj&#`DumSZ)^tlk=I_%p5`%m1m`_C=-_>1bKpX`4B3E zkTZl_A>BCqRbMcKeDwS(DGkfDL{*SqzN)RHu&{7Tx^ z>V6NQX$YYZ!XY#Z;g1kHhR`Xb9eB-IljN?Ug_`!y5L$-hbkmNCR%BbUbqH-JpKAWN z3bhNNJ(CWk)F*vz=p4e|A-FL;~vE7@}HH2=I?qm;A3VKp{g^=~2UYdPE z=o>;mHKvKupBxZEBBg`z$1<2hu!LY`Xd@jV*eNn!ImMjHAIOJ!m3u<)D))uprw7QO z%J(lcMnZ^&FfoKlAq))Ra7O*85MDLa)@V=&gIPI5)ej9}nEVP5!U!fK$+Ub7*nxLYPUPrIK_N zjB`Sm8^SzJE0Zq?VZQPOAuLqBh_X0@Q!8SnY^lnZQI?0Wg0fQOH;?Jpgs?V*f5NyQ z#<~#JhtMjF)?sW2VPgniLij4H5W=PqZijFugv}vr3E^xA=R(*T!Zxnpu@JV0up@*c zZ0;oYle(f5~U$bJe@x zx^@YADF>lSUQ^zX+17TzfYv)>uFj9t*DU8fv{KO%ED&WFmCa$){=ae?96j;!6eMhX2CEDQSy*^$$VktrxYN6CS{Tvybc#; zvt$@WC`HL)WO1?tDfRMi#8S#jQ+^3UrxN+kLScEXt4k;U1k^J$gb_!HS2YQgvShh1 z=4Q~2s|sOMWKt=NI$_kMS0<~3VGN@xy&73FjOvscy~vlCAh3sNd-_)gNIrr8iT_-Za{xHfOU1DbI0}q-7X?vANEz z6|@PXt*loV^TKEsM*A@QVFbeH5Jtx^EMZh$5Zft?MCf~jwdY`VR^$Io=@Ld)N;k4Q z`TconGI-B0dWF%OVV^JtP|hcb=}YMsMt_w^vAh!5G=*WNBs-}sVTV&XE1NdbPCCMH zhT)>SNpBb)$`GFWGNCVwjK{SRf?gH$s3 z`%qyFRf+s}RVs(GIUQ09)G*G! z(Ei&pEsW`E%o&uKVR^LNk9Wh_lsTl_@>CA&`C+V=OLQ0u!dNKlzCnL4yo|v;xcUFQL#CU zEv(r}?ha!cWjiTrv?Gk2^j#{6p4RW7?+s&L82eRzFpLBAhkk8;$?H%UYxw`iqcY!b zhVx-u2;*27$60oQJWHM=Pm!m|Ghwt$rHylr&F^QNY_W@B+>ndLe(kbwDU8eXE96!3 z8hM?Rnyzi)g*W9orjpx~JLFyR9#0J^dl1G$dDD!bO$3j^cpQd40z(8(!gwlI*9bC4 z@NXE;!gwbqa;7qJKbhxY^n0iua3S^um-8hli~TB$*UH~e-pV9=mf!m@KFD4O;}i2V z5qu8gOBg94KaP{Ha-FAtW5Iu95+*UKX60#Z3nybUISH~x#iS`IKar`()a3M5+V)IK z7fDA+A3+96MpEuMBVAb{$Qr?#Y%xU`W|NJOS9?>)9zhN!ImrTKE;4rnc_PRgK|VI6 zIDZ6Vr~Nn*)|ZU=nR!975LuW^FeaB`xvfyq2#Q5eoMDLwbd-{0DN@QxNAQdC*)?Ly zD37HaEmSEkg7^rkMNmD0gb2z;P)?RAPt1sh`a<`0t3Su4J!L2#fw+uTA%cpWu#y_5 zGNnocMoLwcTej7lGKQxW(2h&sLifFBB(=Y9MSI7RF_^)O;taF2Fe>!8b$E_ zi#F?DS^pc^g#4XsO3F~pD2Faf!7hvTo2;3Mg|w13RkI^eD{!#sBwZ1>DIQhxS^f$X z!Hn0j{sHq78wUeFeHNMGHnEMqw=BTvt2Mzx&(i(nIdGr2|O@;o4!YFh-`RkDM!Q}!uk zx5^U=>i0#kUrw$;$TtWFA~+a9l7WaBh(i$^j-YE4-J&=W!O;i`Mo}n=V-XyWAXya2 zqc{=4$p{|Hr8R<65uA=d9zA(Kf-~Iv^5n`Zl(P|>Q^&*k2rfi$ke{AL~+om(6?RKXN5(tX+X0$c|fSc*yV(*)zR1 z_*1#~NAOP0vbDOV7xc5jx=rtO&mwp(8}q&9FCutJe?`6~-;i%fsX6$@Ad|o6ARi+5 zNRi}|ybDC|h0U+BC8OG0@hpQ1<= z#g@GB^1oMklBs;jSDvl;cAG)|v7R=HbWx;_;^;(Oo&V`GMDcmQE;pHxlxC(VGSjn= zS)<4nMRwJjGm0F_Th7(zqRVYvWx_o4yktHyKUskMnUu0>HBdN;B2hGrqFEG0qbL?d zoha%?kujN}coeIr>C2KOq9_^F_DHEHN>hFz4N>SQ(p4skSh`*%RZD3HMjV^*Q6x}` z)zro*kik$citgjq7p@t%28CI8_B9F@6gy#U3rZtYAUZ4MQ!>-qxLx6 zZ>h@Ei)tS#_&tjHQ5=|SkXHjr!zdb28k4`0zmZKysVq58FOPp6^+Eqf6wRaP7)7V3 z+%eM7B8oqwXc@)rMX~a~>59Gd+ZOBpibD3OyjoFOlWn4COKC^8C#9wXrS3XI=P3S; zYM<)q5{1R6|CYIuEO`^FUgjP!#C4CNM-=O$*bqg}D0)RPIf^M!^p2uW6y7L&QS^dblVl}>~^iwjgCS%h8!EkIEp0WDHEcYNSUN^xqZ#lD5gcR zD2l~V$aa`6=U@~wqqtzx6*VZc9zRyEFZ(WjSrp5o5Ruo4C|1%}sbqB&Ym~2z;-Vo=%95Qm z6w74TC~F$U!zdm_u_=npas`g!q+BJU*eX}%D2~fxr>yV z-IP61>{ZE*=W+X^Xwb|cuLG2WBcGEm$d{yay^7*B z{f$cUJ<`96;(ZkPhsA%0qSO_Ar^UvhpW{D9A^b#sCcnrUQ6&Es#ed4De~eE$5XlB& z=s*k`h~xu-fv7eR)dwQQK%^XqVgpfpAbuK%R0EN1AhHic>VZfz5LpM}tWq=+EP)|X~MknWalq!EymP-?q-zkoE--JODTr+_rl-SPj-&F^{7 zd(NEeT+jV{W_EUVX0|5eCcGl$zE8?T&rD_^vyxJf&5G>Gb5M#b*0=v?8u?D2$BMjG z6tzO`wJJB~tv6kl&x)}NEcr>10#+1M{uQMVS=fpqDj#uPSBz6APJT_6Amt{uGUacr zC}oAtin3P7#Z^jM@tqZAtXSv}>D%W&oD-sK|e_@iWC};iOcdPPNRIs9=6_uD&B`d4mDpnl0r@ehxm{e2wh6R=y zGBZ|mwW6C9KUh)AidI&%wxYHbb*yN7-qg~Ha|)idY+yx0D;m)o zThWZtgltMmy_^WyoZdnuFGrZKjx^_3Xpx)WwXs5O75AeRa{IhOCCzf0YFjJXSt0kQ zYfp9{JCdEq&SV!-%JL60cekR46(g+}Wkt`L#-3ITv|^AIz1aMT>`nF|`;t=GkJ8_Y z0V>J7()inb)6Z6%jT_(JH;E6nVu%$YL&;yrVWfn^DI;VFyL8g*{lGNZiq09zI;{BB z3Tcj!HH0#boMgp#igf)(`JJ3##YC0&*sPb{$!t!s!m4tc6?XbhLyS^zth+g553}0} zkF3vDT(ZJzh0ltWR;;qZZ$-e0=~nz45L=W zC~;EqgcZrkr&=*hxhbTZVZ}@OSr^}1@wjFB66|nt=rWsHA~rCMlL5;$hvV)Cta(pSYyR8D~?;S){1pj?30DF z&@y15WxW;K<+&fwF9_&1$fE>w8_7-NW^xO;)rxHtshLvCw1Z>qBxUqnl-=YWaxeLp ztOK3QQXmhvpAY&sdBBQ;ltZNS9;O_z;wWW)XS0NICF&DaoV21}NGHjWyE>6mY@R01 z$ofW+{G1i%m0zG-v|>r>veI?giYrz;x8j8r|5|a?iicJ_vf`Q**R8l=#Z7soCY77f z$lR;Cu}n!*-8#lwR#cm%Yf{B>TlSev%y&qU|E#!6zenCDAE@4qZsTLw`B?E(wpm$Y zPnjk>GU;}hXD+nJiNNKK=}(k0&3UMQX~iom-dgcacGqKdujTbBZG2;eoX$DMH?!qys{0BQD!NqYJ~+ z;m#*x2OBz4I@!>jB4KA6y3o6l-BiA;h^Ys?r%HO+@RM@+`@7yVeIFb8$`g5}m!Y2x z{pkZ#GLSOJCYR>cNx_Y*hVs7|hS)IFhF@$5+&7%bX!_NLVf5kT2vWL6+AvD_Xd6y0 zH+-%iW5ZY*WW;ggcv70b+3>sa6Mf1}vdN`}5s@Xc$vDM^O|$hL(n?CxW`mvXP>GY` zl2ueCtydVm%6$|+8L%Np36Wt^rr9oPjN0J6ZIZ)6Vm1ilHY6y?q$E>qn5KNX4bMtw z#WQV~C99$hp<9O8Hmv-h&r#Jh$A(m2nksEGh|iU6t*U7rIp2mqDGSJjRci9mVLy zRnp9BC?Re~Njtu^<66a}#UW!UJ2q_88SL1zRact+9VuZMiq4L*6urugqYYAQw8O-) z%%mhqc9f%+SINtRhDvr+w&MpoYS~eRPvo})#<*8km2M%ck@6g?Q@$r_kTvbNH!YQP z)wZLK9Zl_MX2;JVW1Bs?x^}Esq^n1Y)TcDCqamdc*_doXN=@22hJB5-#U(RVWt_34 z9j)v*XvZNtTHDdaj_G#%VaJblw6$Z59b@fiCohK`gXBT&=wL@jJ9^2ga#9!TZT#ng zzLVr1b)CsBq%^zQ(T(1n>_PTay=TYkp7lxk$&RegO}*{tLlN&w>1RiOl?4I5~nGNlNc1J4VxG-lW-nkpP}Ob6G+Cri_2M2oymt7cnW3tmjM@>PND{OoL=Te@mB$uYV#?!`gdNE$nJTYT zu_PJ2?GkN9Xsu4Fw;28j>UE?u>)<*v+bB8Pp!3it{qz!S!9@J$9(#q zDp^2TNG`HN4qTVArFJZ{W4#>%W*KFg@0aQ>#*E8lMY2O=CAo@}=4w0E(ASddRDS!h zK}O%eiEJb{k(zneciFMqj(v9Qw`)gq@3CXA9e>%O&Bh{&%unK^ zP7V~$a!^;xVEo&T19sGCYnEL2Vv$8gIc&!fJ3iX+$&RD4#@g|~j)!&}x1(mNvghnL zZ^sEcPTH|3u6yn_muhW3WyfhdL}WN)$65N=R$B9dJR{i>?YM8pKeCT{X+HVE*!79& zk{y@rxFWlP59XVs$iI}UvWHR0bvte-PuiIzHMiKjZO0wTf8mR9mq(wglZ$UZvE!*7&+HIi)xtc-V3HpI%_WnD84NF2^OAf;z9!$0GWuIP z-YI`?#|P!|n@#w9poBo|48~4&-*A zm;=Qf$ioLM;y_Uc@;XrFtvR0qD{t!ZlLbg=7Ife%dLgo~%4^EcVvkMov*ef4%`J)> z8eP*jTx|K;q5bG8KUB(tmUQ4-2Nur2q8TXVKxqfghjAf{@8q!@sNzFaA9N0sb>O)R zFI><&U~s_hgu@A=115Q_CzO%N$tlKsg7>JJ7{}t`1aiprQjc9H{9)B?oE; z%jGCg`OC%kgz{pu1E$}?f z84Y6`u*ocCG>mm%oCD+O(wwu{@|y#{vpIpB?2ucqX_Ycea$rDav&a;cSRLBQbduN| zaLAKYdC&nD-R*$K0k6va4)~NmPoqsUz~(@w<{<~dY(`W~)B$5gqjbd`NI0;+ez{}^ zW;wK97saPCnMO`0{~%|OGi5zIsg=!kU=Bx_OD=R^9z`ZHpYkWUzyZ0WvxG7%a$qsT zC8~0%EU|Z5*9zIb9JuJfKMt&NV6_8V9N6l>yAI}icTH>L#Y%5nORgi=lN-p5q!etT zY<8f)C!I8t8W^`Z@RtMo9N6x_uEmxe%h&$da2ycIXvpXG0NZM z0rH>&hbS`Jhbc#-tkM7Oi*cOE83#_Nnv;}M4xCm=tE7}?>F3DvD!)J}_g%`;Su4wR zVlO#xS+-UO{&nDmL;G9dDho1?)ID_I8vVKhH)Nja|B*6Rw;Z^w{EoIx{_ieAcOAIr zzz54ElKG9=A6x01@K)58 za7HIGIZ@Av`c7naB8wAcoX|Ou)rsN}OK~T@sh2XF6WN{Ul*yFCiQEN^`JKqgW-c-} znTM2`yiVk!ubgd=W&tM(I`I`pEJ79{Wjci^Njr4nMV%=2|24mMY9EbcC?PYTyd>pY zvXm30RsNk59dugpvKzXxPE>H>>SBxD3Avq_!Kq!WPX;5!B<}($Nphl`^72mX>}-~@ zicVB=qOue38W?1#L8;!3Y~Vyg zCw_5am=lehXzWBUCthvWHIWx3rt9Q{9Ch5(iDpieXku>e#E+B~q$DjVt(<7Bk~S2% zz@7BArMDy7lO4#8QvXydkjqJRc0$;N?CL}}N_Vmc*^`tS`IPdLtXh|Ky`88yQf`i^ z>*GXUC;GA3pZwX00hEENW{?wm(wCLu!73R-8R|q+uUYcpPK4Zzxc^B%t;C8~}#9b%u$-;NS=foB#wmRXL)p&_z>I(gQO2CPr6CrxoiDW0HIuT)0 z%A%AQ87C7?eClJCE*YjdF-uiWr~E%fe$tIO=rsNx+a+?#|o%q{{15WI4;`&Kbt0k7S*$g{bu#4PH?r~zT6Mxaa zO08Wda35V{zieWBItQINBn!N;`S}L@VJD8T;4*oXJWU>R;y6XdJ>kSj<)@tT8@~2* z&M-Oa#5pI51W@{#XhC&pRdU1vZGKnH=Veq{5s_Z**Zzvsorwp zw(7k@`A>T+?WB_XPCRg;unR?87+uQnPN&Rn3()>XGNPZ$yxU?zDkWxPPF1CoIc46UGT^<)I ze=@;^G;Dt9LMDoIrF9{l^7NDpE@Y%UtZk5j%=9cSWOX4MJtvu+%t6Wxp`=oVTx{lc zA^6fLO}U3fUKjGYv^!tOke^b(g@Tl?R9?uX{q-ybMO`Q+v+6<>7mB+eYr=OfteUC& z+66gJUxpHtZ^)7^d`l^%dP}FEv&tMZTxhAZxntgUV~k?q!cj z3gpJ1bzJD5##q+{IlM}KJZa!ULl?X*_*`h@LSq*O%IjFf(8PtNE_9^JmoNDfs+kKS z&0T0gY3V{6iiE9PXsujsvhyRoE!mE2uX;Pk+F05sqjYkivkP5Za*tZwPcEEzq!a1t zLN_Mj-CgLRyeFlX3s+X?rK>mV`;dLfeq?`ACN;o?QYUpHgIxGoe4lQx3*%hc9ht?4 zxGN(0=ir~T}B_c#IoC~$s!ka&(h1Vn6iXi>cTS0a@D)S zg*&$mQnuQKH7-1L;h8*f7uLD(j|;EUn%2vD;=*1R{&H!*u55H+J7p8OnUs8s3tN?M zlPOd&O1Oi`PL=PX>?ZfPwBLcHMuvSZ9CqP|3;WsiH+g`R-h-4wE^PTGNt#Dhe#(Vo z%8$!xru?K!`B^NHs`YbOQzZc)3 z{7YVS;hGEAUAUooZ&7Z#V3?!(Tz}hzqARp7)H3|%!d(~cxo}_AKXT!L@`tid8=;N$ zSS3$nk95u?$xJzqW2vq{1??4l>B1|Sz6VARUc2x{)-*RlZoGBjo$Tw}DCNd`7e2^- z*p2LNe01TH3(Gs1)4GwrxmorYDco3dS10#jPw7S~w{}DJFG!KpZh)SK{8Hs|pkO*T zt_-)NCq*()GLo6x$gJ`#l&o&_ENGUpbkFoT+$iYAS8n8VW8o4@E>a}78+nxHrQ{>? zlLg$E;4(^CAvcDm(msU9ts4u|rCG#{qV!@aDelJCZj@m28?vMu;j< zjV^9dKP2I>;&G4feas#zyZd_bqX->8vTapsCa-+5KHg0V#l~6`$%MshT(Vo(Q>_~PZ zrKYnRauR_^H#fSwwL>U}yCK*2?jehDs-eHU;%@E2p1nwspD4ZE=%bRplzuXn#V7>> zIHHU@kTS@PpH(v0jUn`a%O%dr;uaZ80*G3 zy3FSU%6K<^Q_1gcyk26FE*U1eF-hf<-B>xmD4|s)HaF~ahf17oZ5R4^T(=t@m3t{Z zH~cCIxN)bRNh-r`MBLcy#uhiCZp7S}?#3T(#ATM`wl8iZi=;6mjF#R#%3a&4eL$V+ z)^_{T$RARqT+-Mu!;J;9X~?TkzuZi67CD=oL(X+$9%Vi$m4CWXDMeWkx#i*_H{`EC zne1XWmT<~T-B?RmMoQOm+2my*u(`^O)v~Xko91bshx76h}!%NkgzfN{6HxNPnv|0e&E6^|m5 z+AnjJN}GWLDmh3wL>_iSj>neXV{ROG2@e z?c&nXd(VygZak2k&r*vF&m>p=i1L_xLOylld_Cjm%I8d8kS}EqK#{K3Zmc?M5_u<+ zoosmT#s^uXTXlUJ7(cr4N%qekWbq({2V-yQzVx8MQcFs@G*fx-h4R!CkZC-SpG>77 zE$h>fGGcm41`jf-B$EdRR_diIs|VRU2=~>O@*ulMuBNMbaSw8OkjsNYZ008OlX=Lz zq*UhfpzmIjNC74VRsNL+Pv2>|423-?qVl4YVjf%?rjxF(RbGPfjRz%F@~sDQp);u| zt&;CND5G3QDNE`-+9?=PY4X7A!Pj1t@FK~BavqHK;8zdIdr-lH)*iI+prQwrJg6_r z!Gp>k$Q91z6Z@@qRjYVVRhk~{1H24Bcu-Awbq~I$*HB4K57NHU%4DeJL2Z@Sq15%D zo=SdNYH8?^%T^eBy*D-Y$d!1t`!+TvMVe5WlFdBWyIUt=3lF5YCE1FU{}Uzo(Sy}B zOnqd5d(hT{b{@3%AopQ|4BaRl$c`R#Qh8?&x+w4J!L9u|Delgshst}(Ln!}=(%XX% z7xYru&!g?ohIlYxsii+%ngcu-NFSt|M|dz&`6v%& z^-hw4F|z7MJ=!UIzsqb;CX$m#$(z}AQ#`P; z(&mAOB4gP-a42_DT%=pJk@q?&kipBu=YgLRASDlaw7(8T!X89Ch^lA0$b*;%aSswq zW_d8%gJk+t52jJ3lQYOaJlgTPve0Ch$tU&M=XmfZ3+9sZNa>pILGQ`hueA%9EL8cL z4k;IVu*8F<9xRiP`EqhKxq@6t%IK?P<>w7M)~IBytYgaabT@DCU?ZEGJlIOvta`V| zw&~L5VVeir8CK`%*t?3Q+U3D+58it4&VxO&x_WTi1G)OHd_eunqkXYG?7=>Y_bBPEgBKaS_~5}u4?cOc-$`VESCbTEN-~ufUr;1Z?bZHQ5=q14OEN8)PSvFMqFsHH z)N~%D%j89FFYUMlVcWm}TcLQ)XU{tVotul@+`=_0A-t z$WV!4WiK`~HA}N9n-*1BjUr!*r0aWn4KHe{-XAEnymH4eZBlhqUYAnOi~1^QKxybj zjnqb|lxNYH&!vf1eka$SR5Mbfxfd;zx0K~j#3*5wb^124(7cc%mgO=&KYG#D3z2qY zds3Pmyy&RBlNSRrRFbfZ7hPq+?$vekqBljnyB9s^J;`1w|H+HlOD$3$Lmw~tGViB) z`%?yZkz$NN3S<}Yvljs`f?f>vVu%+*z4*los~0vehIujEi{HK4JIDxf3@Oc#UW}rT zR>`kYZ_s{a9jlUYUW`}%n-~4AXrC1)sAQrSljxIGGR2E#qqIG(T_t`m99}rRaH+)O zgoVkOiI~Q zFAQh&BGbM2LtZQ|WW>3o$V|#CS;8urvDb^g zyjaQ^-sHt*FP3?+oXr(ptfQJ@Z z*+Fhqz1zIluKYx4?Zf;|FYb>|vCE6yD&OOU9Oxol`@GoC@QfFKQx1D^#ES#;gXAGn ziZ3j+994e8i(~ZTDv?ukPbxnp%YpuIr}p}uRrxte#)&B|dhw6!Kz#Vthf7{u_Toz) z()w`4i+{aXaLe>bcB&IoT=n9K7f-#o=EZd{Zg_E1o{O5=Eie94ew%WK+%h`lUCKSx zEB`^uY&>A|p%;%-{#bUTC$xVYp2?1Dto{ut@|^O*ihW+bJV ziIUleEGo(BgWPUIx^npBMm$D&ODf_+P9Jjlkei8w1t@uZ$g7fkl>9#Jj9Mv>p`Z_6 zsop}A!anUUlF!pD>eJpyi}_HTBL1}xC6s^T!{M_g2}}7<+NbS0D*LoE6ThRIeJJCD z+`&@@olH}?-UownBgG{AQ!iyQg(M%!adh$WK2%U%(T7UP4~$8f^R2c+u=r5Thw?#G z2%@?V-}|uGk0pN8@S&y;$7Mc!_`!!-J|uid_Mx^9b!3_Q(8GtiKGgG}oe!4#hWb9B zYtqQ9hUSz8J~X5>BBiS_r3u-TZ05u8r+Vp<9Y_lwTKcp-Pb;!DDa|%M{HVOGPdmj} z!jC1*?R^k-@S!866WN*ULUtv)ky81bU-o*}>F{ZH_m)bR4{jflmRUSLgeYFp zM@sJZA)q|S*Fr)W!VDumL@6;ct}5lP_NhMfD`HsU!%`on`7qsw`X>x>WP&W2KYW-W zFXb}JOdn=ZW|M#VFo!aioJUI8e99=46<85`{18tkgg*i^vh&R@!{t)hUGr2 z@L{D7t9%&O$o!X2&XmL&AGZ6j?6pCLwUkXhtfQ<~`3A~HdDWI#K38sLvW47AZu22l z!SuOzhYvd$N^=)ww-0-K*h_Eo$}EF)$vo`ioa`t6CJ*>`KbU2{D>BBwQa<}Vlv3Z-6{EiR*DZfj3*f2@*`#wDQ z+$0~Vn#c0$EVD?#Qy-r3A)b?OeRx56NxmXqlQJ7`d~&Hzoya?tyq67J`A5npnZg#M z)THv`3%~Y-%j8FDKUOZYdY{{YWZklCqpC$wkTS$L)_=E*Hkn=SLC0_Rb=n->+RNzknYFDdJ!GQAl}VKjeIW z35)ts%#Y%JeC>yhRjX`O)2v>VACh*WQEL`eDm# zsNqL_zjm93nruq)gCDi%wN+AwQkSgfhumID${P65(2qtk@Eb=9KN{1UsH7>S8QI(~ z=YHy>vZd;6)Ye)RI=CwX=J2>8+4uf6a8;>R#Q`q2B5{mA})44@43V=!fqA3swbhvdkcBpG*z zA48@0wnLPxfPHHton0t1Nbgc0b&z*FkZTF4-BT|m@6yQdi^|dKKUoPfLusQ!6H98o=y^3>c=u!!vkm^z;ZuU`0>$?PqJ+Ya8kCPO_9I-IH3HXtQ+4aNqB@y{;VJ8 zC`bJ`MmbKNAmueW>BlMhX_cIjr~gs=E_2?m{oHibk86Hh@N2(H*}o~jL-~)qD|@X?+RsGyRqq4JL-G;%ST@g)R`b-4 zXH1^^@rLq(d`Z3{rR=rrc9v|6d+Jc6ts{ zPO+B>=2E@6DR~0uvfLthz5vE9x8x^93Q!6L@KpeX0w~O8QPo={fL^X7DU+dCK>OcZ zM4s2z0h9>f8$QR9q>lWSEEPa$%6FvHmkA)5BbHT(J^%yVsFEUCQknxu3ZPs7Q$`q? z%fgB2$_G#(fQkX_sDNq#R1csMU7D2xsG__o#S*~A<=S!e-?LdefI0!xpw}dSAf=#I z06q5p@5q6=3>%a60;nHA1A0TUQ9wJ2Nk$nF(GD$W!ce4X0L|!ycblatSC45CK+Ax3 z8JSjOYf_qRC_j>I1E~2>EA9|L#{gCZusVQF0dx+)6M$DOqLgyiG((aHK6@#FHO739RWC%qqRZCb<6fb@ySFg808k^e^C4Z1Sr7(LX>a- z35t|OODvNC`}g$&ZWCV;g8JP6=n0PAGC z2;j7=HUX?SYuFIL-?_@~pl>8Mk(X<hO2B|3*fq{xe?H=;VE4**;}0W zZSqb4|4}5r8^Ar~_X8Mq(j?)d03HXBDTvHL$SLqoWd9t*?aijAf&cw(|4bx+7XiEs z;1$D<cm+5Dh->%6S`iJl_(ziFln!W1$}rP=#k5M_eU(aVzhAWE*$Nllp{=FgQz=B6Ob6bX|k<$~Jz_|mKx zM5Q41g|I(_%0W~KB4r4vLZ}*qB?xa2z96c}k3T{53!;Az-v?16i1spLGCxZ!HG^mn zM8lw5V_EkDSt}@~l4(sD>QL&+`k<2fLCD2grK^#wCnk#wEh&wIXrhv)K{Qj|oYEqw z9asOkz7>isWO1uyrHp;@8 zoV1!vN!C!-lIzIzL2OXHO;=bpv3@hTh1^PRBV|(CKZniCyMjpZ(e!r^2ZGp5m*yVI zUh*$;AGtq>a*GX8a4?8NL7ZhM&BH;QpdTTRlE+ln{C49T+1t>i`8LMv`2<0oA(ua^CgmKvn8OiJ+WTIpyvyfRysmT`7?iMYQ zgGo*@7nxhtMi%8|#NyS3gy~5IKpP~M5 zy5b>x9fC*+@*A=w`7J43r9zmw(kN0U1oL#q%P$PBRAh-?-@kt<0`vuz07*c5LULVJ3L5ITm?N#$KAokO@8*Cs1N*N}F6?`QAM z-X3I6vKRSN2-eM7P2UjS$_oFVc`&6P*`FLh4h&%sMaq5-VMm6tB11xuQHGMgki$p` zhlemid9IZfIbd>h2oq!(qOAC@A&ij)zEwAt97jrXyet9bzlYHJxK2X(@G~)lNumFJ zBAQH@B6Ci$k#^N5EjTr5rQ{_!$)=UA=wu~ize72)(sD0^`yspt;iYUN4UBSc;uTTd zgAg9d#+BFfhwA)k`ZNGW(8LUKE^$gFp|QM}n)?&_vDvhB!@I*ejrxl^I;T?p?( z_z=?kL@)El5I%7Q&KX9EFse?|eHq5!{rZ&jROA~ zStuF8$Vkbg^2}j0s%VjdtW2`0JUb;v7=O1iNUv;hxx&aD*0#7jVdM=XAN?ybKUsj3 zf`VbJ>ZYCRSBObrl@|#kv{;)|@i4v)Ll;KbFz&6iOqyya5!MdykZX#56Gq7}M7||U zkmPVO}P6h?1(#lsj9#@1$L zxgFA(>XtrX?0Tl_E00JK?;pkh`ap7!%6|@P$BIkA&@giKvHTjwm@s~kr?b*Bj1(D8 z84<=v$|!QQ>XqH5tQcdts!R%F9A!ND8~Hmqft1RLVL5MCdn1rxau`#XTUD=(Vh_VX z$(Kj_zU&Ue6UN~%j)dV2!xz@R94(XSgb|?s8Aec6(Xf2p(|#G-?$?FG5LOQxB4I@7 zviZj-lE*0tGFe+&3=+zS)54e@#vftK;B+LJ6UI#XES1a-LoNX-U2~btBj>B$8L73y zX%=v<7Ltp|#pDulDY+w4s^wv<2xFyebYbk4&BtI|9mX2=ZY0-|a&qoEicEQZ7#ozI zu8?X|7@Nb`qLS^h4$!x$_fh?gB<>{Q9FFiuv{zBBIOBg%vBrTi7fzA*O7enaI4 zDF?{6o}@!6uf58$@(1(LFpf!5w9=THCTYsg-N(b)5Bn#`ljJG#bQotS(tDP2F09?E zTbdWc_$Q2M$(WvuOJQ6Nqel!qW4IE=zhPvGB6Ad1WitSxE{uhFv>)ri{NG$ zw`7MFLB0rX%UjhV-N!IKg>fg0|H8N%)=oTp6~^Q8mF~%=9mWGD5_sTznwfg}{C<{471Q{dR>Y9=i zNk#c0g47Wpf;1{mNBNRW8^MZE+SmW|sy9Of_df6dFuDIr1eqhq5=2SJ=BFL^h z2PI>9PFCr zQje5^`jiF{G^9Ko^1pws8?)IYf~KmnSp>ttY0x2~EId6j^_&I{X5&W^rG9rSJ5e%VAb7%y=(1)pHcm%oXR+6q! zDj65SX!@_@7?qEu$nhBCDZi1wtKJC|N4m0;BbXAw(Fl%3V2!{guSf)&WjV`{|56jd zj0j$RWpqT~jKCFvI|5Gx@d)1BHG0VqDNSDletJM9!3ahSG)k8YVTKVhO2#56mb%jC z-UO3maw<8EoF2jURTin4DRY=)kguN$BA6A?PCT4Vip+^%uJU;i%vb)WY&DB4Qm`N+(U(;p~&OQI7v7 z|Bm1QDF4bDzRDu`HBMHhd_962^qVTVMY$cp9hE$6 zV!ju_eJ+;NQSA)t2NAr8Aa+&%P!`B_(<4&kaRg74Kcze)pGQ!AwM7bE$_g35YmWPo zl!?5F;H~m^5xiIaLH2|OqZE8nNs1^^MzzOHMT&e8MbD}x5k!$6@^G?@;kB&DWOh|)mE;L!h6Fcp(zS;6jh_J$hdVaNl|>7tFKYQ zAYLwt@(e4G70F6uWm0OYMDayWqsYkBmTEF_SqZk*(_$Zo1(VPppcN8t6Xc@(X%#}LICze0;t)l2a z5pNwu8~TqbX&Xg5M-jmI6bGURG6_Wyk0L=2laVN* z6e){Q4oyrFPp1DtP9>+2)8+Zj)22Ct&6(sZQo=>$wPTp)@EOe|=aKWH_>;1Ll$wPi zuZ<#0qF5Tm-%+etZCMt@@~C#3sx87OZqC)qur4a^_5br#QLLt~QOQ~v_qk5W)-%~a zZX`F6n@K6CQ{T8XifvJB=R@ov<*{}|v6H@w+^zD8{mpynf2m|&6#JFSAu$Iy&j(4F z`9o10rXL}Xs{B|K@@KacoRoc(><3~n#Be%_Gf}*c;zJZ?qc|6Zr$x$VQJjzBLR34z z^}i@CMzur4ugO@eEh7I!af!)gQj#l_f61%bzDp;e6kq2kH{^*^ZjqATrre1_Zq^`8 zd6c_R+~dRDkK#cT59yD{5pM0M*T-~`CzPjA?X-GnK96G52mK3q7S${=yrjH};x*-s z%HLAnMIqN&lCqDoYSOAC9i`DFT?R@|_Fq&A4;jiG|U zl4RGtS)tDtLw=cu1-b%c2`Q$06+@vI3e$^`MM$YEN_nx{R9q!r#~`%X*NEZqYD>~XeNCC+ z7;44v`l+E|42@!_O_ye!80ymNk@Z#HAcm}KEK<-oh9)uXEwxJwO(`v7Xhms8HjkkN zMQR#OMr-9AV`vk@k8HLj+mr3&S-1M%c|9Fs+WjwNL>W58&{>UJ;X#V7^loH#m7Dt* zdd2Wl3=iXY6i4qE`pDGcs2)e(82ZW5i{X3>{bLvq!-5zV#xO93K`}&Qh{f=841;6% zEr#D?7!t#9y+sbs7$wV}{tG#bl&;}1j8Hx@hD&G7{5{fRZpCLn4L^Z}bNi>yu;Jn~@B&Vwg&wMow4xA2G~OK2v0t;dA|L zhI7cdG0daPC#B#|S+>XYB8y^JEH6Yzw_je_7?#TZaDsV9OwPTsER*Gs*SIl;T^Hmj#E>D5jB)%UE0t{KF}#i8vi$hNl{{w^%fB)0c1AIFe6S-WK7 z?Lr3OGlnn8=cI%$WG(WR6M3bQ*OU$a=-$Q9yr4;jFXCvp#_~R<@dNph{6waRBP9!@ zH&q<#ju=H!$Nx7jC~3$q$+U5#Q@!aai_aJ`#gRFVZ{ph0$P&k(HI_ng?NHLJab$}l zdmLxel$9ZG969JYRg#O6JB~amkpqYFDbG(SKo%swio>_YB9ki2>B~bDp%jgy7^S$% zzowLkLv9`+WhLYIHm+Shs8k%$JH~SK(s6tjN0~TuY)Y>&j`Sb?la%JeJ6Q8|t(Y*r;LaZHtKI^8keIHDJRA4iQiJaKsAs2Rr(ag2&% zbR4zfs2#^ZS%z`ciKA{Do#W^dN4+@e$F)8Dk8w1JYriQqCmY7mD6ZWaOcEIy$I*m& zQ?eN;`TX13&)O~6Y#B!@mA9s}kr^naO`$CxLLQ}E9PQ~H;#j#xJD#>9o1Ij%tL)FO zn&fI!z2oRcmuB}kdeD24y;S~F9C917&-H!ckg@ub{mB000J6^z?Kq9&Yb-zW;p8q+ zgX0(y*KR2_l>8-*VU*$IlcL5E6e$=PN1MTB5t-Xx<8Z~{j$=$5V>zjDvS5a&bBNj_K1z$H_QO#Sw@j z7{{DA=Ef0<<5d^))Hvh{TH(0%0ZfJnB}&HPh^st7NhbH4G|4E_;+W2H{~%|OlFy7| zmh#zgeClVGa9$kqqEFqk@g;S7% zt4ywu*H!NgS?A*h>6QNhZ^`4H(cLERkpGc)Q%a3+DL zvVqHLoWQsQp2zV*b_)sAOW>ufQL^7lpm+kW<9HKC{siP0T{%hct?bnkNR`koW&AF# z@jdy0{3z=QMe-C0-zK!59m*!4r<6*dH03+83@HV= z1TJ3JuHj%{QjRo|CelnwK~e%Uc(sS}Oe&BSRd1yPuPIT)P$hw?30OEAGAA`D)e@+# zlJ6-sIL}fb!w(76QoXe)brNXs*d$%`MH1+dK+gmk%3~$4X}!Kf0*w>e#S&Y|>ajsD z(uB>XWHYjP0xc*lNvV-b8B1~N1ln+{AIY|4J5qYvC*&}Gt*m20`|nbQPL$4Mmjt>} zx~bmo3CO|uQr2a)p_e@IOQwMd?W+Dik-f=2WZwk(QKYv&WdPR%X%3P_k$_zNX>bA~ zDB?pXLlgLgGEC*e6L_}JAO$jvWH>5;(Uf0R&6os++|_EvC-7SW>l4_J!0!o6NWhtZ zD}jj#M7QXl^fAb)DEs_LQZr09Ie{q@D=CSMVkaF59N48@H^7~MCxHcAVqP*LQ%k@{ z_mcrKNQOvRq+v?w`?{D)W+xC&Ai-vG0)J4Zs@`do=?U$2t1|iwmCvNiN+8P|Etg?V z0&^M8Bj>BiKNA?bQQP}1Okfei#R;rby-N~Us(e`j%ayN4Xg~gZp7JV&tI0J9tW`DZ zWX>;YH5+9g^-;emfxt=Q`xUz7jg6aS!(40GlE7B3!`l-0TNYgc+Y{K4z)psHNm;{p zC9s>mM@@d^9fv#{b4e4C*vYt=ywUcmt~&7r35Y~a3z693CKzP|H^7s)F{I( z*~cosmcVu8H)Ofd`mER_$LTn*{O<$)f{E>7M8 zWIgBOO7e>GoP0sPls(K{tyqTFOx}=h6UaMT3qQ!~BHx>mktP`*6R0rE{D~Avk&Kkd zS|UTLWPCwSt&$df&0i*?fX|#c884scMAEXEE*a@5l4M9mM&+53adnYF!Yr)MN@gQv z^z4)zWX@#m2PFyfBqMJ!YA2&kGV&$k;XrfAWPD4>FOyA1!DM{JW-+o5DP@HzMUqie zCGw+_DDaw+pA!SKLi$Ws)&w2dc z>w2&Iy5Hyhoij6M&N<(FGiNFCpx6Vu+#xzW;B7-W$&Pi_?+6VPHWV9)3>!=w**}_1cjhjFOBN$BD0qV>}ou zVcDx5@W#88@k%C`e4^wvkM)HrN4ZNsy~V*Bqrd6FTYS(`u1OwDmP`?+i*I}Ij%2FH zvS}VPd&xy%o1ySsai%!SgN9=q9GasgHkWViIy)ELd+NUL!92+a;)kL~WR2H@zen0A z0S|&6-0sI6euO*-dvMT;@4bk45asIXg~N-O2XPO|d2xjo2@jGU?DAl@2PqHI9*le$ zn>@&HNpg!@>-f}zoCkRimUEH5J*WVN_PTr0BXep|B*lN)^I;XNfAd@imN*OLI{5?45 z!M`31tyr|rgP%S4g?|M+*v~_N-gX@D;IM>#(1Y*ghr}PmA4OiXhy_RFM@4pzNq!QK zbBmZ|)$AVQ`jzkO(&AGdoZx#j#&uHsP5fQ_L*&q(9!yBsD6IdBQ)$A};u-O*$kBf! zwlTKz9$vxNRoZKv4sd~c)Cso#M9M|UB@aq?t-PdIN@SM@&6d$roDg1=HO}kpm-pgI zFK+YVb}#;!?yBHL4KE6d+!ejn(avmFNh*0!SyDx;DpnI&Q{9W1i`IH&Nf=%E8-Y&tQW6JcwGw?jQ3*SBKO+)wh3NL^n&u5_`3Lp_@>CA zx4f8k+)kO|#oJzFz2G-~?|3nltHhm-h!?y;;WRHiUhIF&HQkFDUcBqI{(X2)oGH!{ zXNw$~Bbm$9ENT6@d0*XmX7mHehhmpACA^w5XYP~u#ef(TLt@x#{jS6^KC3AI3h3#@ zMJ5R^lJb<87Bgn_%p!Nri##_RFRCndf9b_0FXnr(z>AN(Sm?znFIIc4D_wu=#Zt*9 zB9ldu#o`h#?)KXlE>m~8xI$#Ok{iw$7lmz&7wb&E){9T&pPA%yFIsN3=EJsL;RY`@ zn$a(~iY~J5N3fZziWj@R;OR?Wd-3;G4z}%*EnaN(S_l6#*=B_PjTbvq@U5xeDcQyK zf2y4Ydo(xBa4%O9`FAGSFFD}F7hW3+4teo|7cctok`F(6ahQ7;AL{yW#LKUetQFu& zAC7tP6Zex|oZ|{J%Vt~bKJLZOUi{+4tPTxNZF2l6`BgmO#YxF;A`5=^;t%PK#$m=4ZKQC~2qgb`|^$?q9AF+Z! zn#h9cKGZN?zfsAW#;=iF>%(ee=+wS3mCKsY(uja=-9t>c8Z&9&9>;btEX z_qE+3-YT+tn-8}ezr%+^-#Z!B^WiQZ9`>P=5A}Vx+XuG~_xND*p@^@v$XRo#?dSiB zi+yP1!{(gb?gP6Hk>d2hC2wGohMZg8!J)>g=Oj%eO?_x)lID^YKHg!_!Ge}tF@`s6 zv)J9YP<*cst$etTt57Rbg>S@$Mmw~xvDO8SY9`|yOx z&y2Lb3>o0VK=XbLl050dQ$9TH!(erXn$aPWk~^#m8}9qM^s`(%N1kd^1eyblE*1}(OJ?x~)z_>m6_x#WHL%7>4A z_{3*jh~RS{Zh6GM$cL4Z#Uhg>lBGT@lPov+3QjxJ#R9ff3RjD3d{`^_)Kq@vv;Mbb z86Rbx9&5c18zdV==3n^mrF@gfBR3dUEARZ;hn+s`@`1iZ+$wJKVY}oTafkS=$jZ6{ z?BD$1*vZhkfdPFMcQP7g=*aa?l5!Ou_CUlmEaC(D-4Wb%P|1vK{5d zuKXu6dYros{O-daKK$v!DZZSFPR9ltuZ{4~1s6BNzkDd= zN88S>zkN9E!x?RT7tA(z)`x%O=S=diMsQURn=P zMub?_k8+YLMAnq|qhmccW%=Ubihf+>=Z1i9Yufv+EavYWmHpO5W@`JbKL=IBs(w`S zqq-k8)Mb9XA6NTPQ{8L)xX$F)`Z2$pb$SBZ>YGa4puCnD{i1fs8#VKr#5&^5A|LS< zKW;UCn;$=&EoOM9A9ekR1rQIQo*#Gl@rxh7`cdD{k1H79$3Q=9eiZr9%8&c}=z7>$ z>_-#7wd=5}%f#V_)40oz2F4po8i|cL^SX8xH`TP9yqO=(l=TkNK= zb@ro+@~&pIn;#!*l!t^p;ztiZdiv3e%T33U_4VUX{dmGu z_V?rcG7gRo^5aQA(tc$8c#3apZO3pwp7&d4!#(ZCVEP^h+Ymp7%AXORHTiRrVSej~ zR+jZUWP8DniGIB1$BTZv+Slag@lR(UMpAepM@Cmu;+)SN#|#8E+~l z_`xe+vw&;b>wZl0W4a%2Xia<5tZ#4mG0Bg~>Q3?F9h1N9$5!npIqg(GE|#~BkDB4f zyMFln2=Mv)G0Tq+RX}sUOQE%f(fGtdOu^CAWp`RwdhNg=_ri zKEV2W`l%nE`SH0QyXP0PZIrAN*ZZ+S@_l>z<Y?pr{?hwEAV<%T#PUy!zKfd#0k8)13SF+_-+kbss>{3X!{eC>t&ys`O zVEs766|$7;sQ82Uqj*^4&=EfdZMKdZVLPVqC-J!WvmYlGyE$~i&o47km%F9_e&f#H zk5U1Y4&V=K7vwG(u+9|w(~nbr{H5eyPQJ64Lx1~mTFDua$yv!iew>r^x!un2yy`j0 z1<8NnMegt=B?8vm*zP@G-&5Pk)8)zpfBg?go&eUDFM9V?M^V5!nYTCqdjO8W|9|&vEO7?lk~A=RLrJ3m+B{*c$!tvmXlh2A z1<>4hivSv?t;=7x4B*}XI&pCYaOXK!s{nQc9c|_JiT8`G19(94px8!aJwGC{zFh$A zH6gu201wGKn&jaCPAn?sP?rE2^>gtE)n1aW0d$je7atLOh%D+xWXqy*4(kr8X6eDpa9+vU|s-E2Jln>Z|Sx3Ki{VV7#6_r z00sxFe}vhFNQMURjO1C9KgY+l+gb2@055P|8eyBrRWyK?9o8&y3@uTN=Q! z0KN@iX8_9sSP{U=09JARaXb2_+&tcZS0F!n(6%~&uFLEj0x09QuL)qSm=&~*4@z9-KYt_2;fV}CUL8{Ie@PuUyGdomH=M4(N1C8rf@qKxEb9c>A2IeD}dbr z{1m|P0QPY0<%y8Xt@UAV0Q=PaE`T2-`^5ty%MJ$cz41fbw={7wWcyL!;Q)@9(W8=M z0sI)U3VsgY7q0XDT$cjYC4GJk;2&;KqirVwILZCL!oS4d#Xm$={wX=d`OLGi%l5aD z(*c|@HD|f}s}ymFGd!o+{u{t~36l!}{Ac_kpW$rl>-rKw>&cW9ONph$G9rf{DI0{h zP|R-mAg&BzP!LZBQ6Y$mLEIk19YI_bwC);QGl=Y6C3$DhNF8frd`#KvNiAeu^=iOqx7aXXx3Y^kOs+dazf52B^yUa^(P(ffi}Gom4- zwUP&dcrb`I@^+@CZP2>K_T{;?4-4t;-)+jv@RLi zH)!1#uSXC(VY8=5=_PqIh~6f7OwuQ4-SdtG+(7yTtv&PO;uB*3AO=VViq-U)^Qj=7 z4q`?S?*=hAh|29TB#5CwJiETZq&kjgC_zjLV)$*2=Ykl<=f=0AS`mMn8y>{VLF-4l z=S9j3k{897#1TR3A~qai8yUo?AVvrAiiTblnU9f-4dS`xZg$6+e0&g(W^GI+>JeWP zUl-pH-xT>|-U?#g5;tWsU&TLmwkeXg#dm_3YVv84=|Md8q=RKMgZN~LnskT3x%O_c9pxPO8uvN(2C*-Q@8pNX{o(=f zpvbcCgVvcBlpmD*X!667BSCA&&e3Ch0-FEvAbykZv3?HX7vsMMal-h?AYz^EEco3d ze+2QT{FF)l3W8spvWEY!oettm5NG*X_{(n)7bWM!e?{i!B^Sj1f@u7hb)f8}AWDQ# zGGtA7g;*+t(jk-i2GxcwFbJY*w?vQmbhAm`$)Ndd! z3ZYnH7dh$(!6|o{hTbs(9`QL4iK3S3}KM*Cqp=~vY6r1dPRf9At4M6;h7Mg<-!bM zq{8PyctJ8u94>MpJkQFd)=A=QFDiUV91+6i3HHnRC?#XX(ILDd;m{Zf56PgvDjz3~ z58-?@7sJ;=*5Ti?Lzol7>mj_M?wcVbTe+u(@Rquh#L1WWoqb9OZySF{a%;fG`e`9d z*M#&LA-pS}X_8rd2P-%@G&cm^ql&v7UkLAoFpckpI8S8v1IdS?NA!lQt0!^jp{)*o z2m!w1TODjcZX@!rNg|SH2%mMdiW7YF5H^PJMF=Ub(tDh%xwO03)7+?!+A<+zL&$}Y z4`FEtY5Aae?@e$byC3JWCZ(*gjFXNL(x~;hIz1!J%d9E*IHdAz3M|;?{Ah znBf{d6F!->A$)55Gs)*6tdp!a`3Al_Z#!80WeA%>I2^(ezWX736~cF1APe1Jhpg*1 ze;cw6)Y&3ucWVgSOui$87r%G1fW{L-@tyze-M!L#;3Qe+%LF z5dKhjM*LIc(5VpqlK(B9Hu=?>@T|K3i08zA#q(Tx<7}M#BD*1c8OEkCN`z4|jJLyh zCyY{Iln%ok#yw$_2?Jr=7RK#ilnrBexVTanmBT0(#_<}>*schpyzwi;s35OslB>el zz1_~TDq-vUhIqADQ)KZqe4u*PdCJ!*x!&YANNR<#^_cYy^Ns4> zB-SxCH-~YH@mu*ES~g%M@05K<7)4?0|K&TwV7IPVPh|HlN&PVHHi<2a>>LM&io>vn z;n1{=Mb5+-hD+W+Y-sXE%$r;PakDiEqp9*{Vslf|A`D*ij|IH;UCS`Khw%v8Ap5;x zvlVLm+M$a&Mg~8;}Fdmom7MVOI=_B?P`-QF3m#m@l#ZM^d zFAfM}poICLFluhFQJxNCa2R95c$LpQjGLt#KTDNEuLYU9>)7&%nM^i*!oQMt~gViB{G~X znIp~>-wUJadF%7i2V8Cg8g9DA8IpV$hDXBCEAfTlH%UMe4CBV#b{2%g_^Q8)Eh34E zF)r}7c7_L*@;^Q-2;(EZ?_uzQ+i9)|OWheUE9OLo`7jE`=kt}8DPp*gZ`rBh!V%l@ zFh1r>{>%1>xJYDoaTrUCFAZav{IyAT4z1uKc?+u$eED`;!Q+i{NW+Tw(ki#xLAUgt0A*y)&jgylbT* zvVp>e5j2uC7F$HnM8blml4fG_2zp<1GGucrxhH~_rt;p1bu1Hyb~~K+MR0$_+IzGX z9}piD+lXyN7PO04UzJcEilAcz{UUfgg5B3T9*&^X{^A}H9KYn~Bz6|NM9@{zP3$hR z=8=f??LCDzDeD=r?g7^;f=4Cv-Vr=zypN--59C{*xg-4ugPdf)i(4Q;Ab1t?4 z5e$^`Sa){0t9delry|xqhwbSI1{)s|!BFGRL@;fNRWK}q;SsElVnYZ=q^ZzgcPXyiwd|Y*Pe~qxjA3?w*!3aWf zUaRDCO(cS-l9(7bl~XeIR0L@*+X!#&iHzCamqn0`AQwSi$;T!yL@?j@0)7i*d||}8 zz9{z(Y@bB1$mEMJO9V?z;_cyBE?*JB$_Q4O{8PzlagDf^8~Co$m*@Fe1fMHhCo)W& zDZMd*FCqw^cJ7YgORncTtR2WU$)*T4OTH4n7Pp8j+sfrr%W=7Wdj#K@{mhOCzLoD3 zcbRld$^u+o2uvDCw?dH7Y~RBMHcWF)E^@FF@iG@oQ>dc1V zx>d#-w*C{rIc`C_>?IxU$1fEB8$pX@?(^KwaCdjY_MccfYWc+oE~!f|p`@f(DvJ5* zYz)h&OFn6vNXFwqnUGQQR8EZBg8=?p@*?rsmEl>Kd;X#iPsIoUp!0?vBD{yhy@Bvshq{ z!V!ft3YWqrQ8bk_h@zpSk;ux%QM{yiHdAu1$(u*fA_}*<_lPZ{cvqFYZU84_Yo+`? z@%|_}#jWsz3eE?jcrXe|8?mj(F3)A_5XD1Wwo$wqMShvPV-!82=qZ1gbC7fvyNImm zD(NP67axi8`gO$|;#u~+qIfQ9{q=b?ir!J{y!*$Z=pV%Zd7miyN|^VH;&J0oM8Rw3 zF&wC5usBG3QhZ8$T4Y(fa&~e^6hlq&Occ)=|M7F%Fg=Ii{1YH~K^!T*D83ZM2nnC+ z%UT;Lqm+ymUooR&qShTEI65wh@mzFKd>FMpDo=>w@Ver+qnH@QYf-!&MY3GODI(>K zDBhI6Ws*sf$x&=v=4Js~^LX()QB2i*rbRJZGF{}HXGq=^XNt3;yc4&JLu_-Rn5*zT z@qLl`Jjn+aiak;5(ggFPSP+Fb3SSidC<0NWm2)TXYOT0ZxyixNjZu6NMfVsUiQ&sA zHu1SdQ6h%Td@G~a62;c2_35|Ir}q2mIlqn~zSGwHkaJrU+oL!h#m`ZE6U7eIRNd_O zma~oG#I^PxqWFHJV^8^e~P&bN12 z$7b_XxNbV!xi%KF~V%9;GtnA2_v)ui#*hyr!Ghe&Bt4X@W@R-fPp&l{xjA2a- zYh&mY!=o|09>W_k^kzW}Lt}U*hHlHxLlV8p=vuvF0Sk3%Zaa;`JCCn$pFwyvHF?{$&1BP$L@Ky}($1pF3 zNij_3(irD(>~&6wSzqU}y&J>Z@^?%!RWePSF3yOd#z^bC+?l3kRt&R^&xv8K@%Lhw zzTEn{_=A}Bzjii;9G^)H9(BDjgky-veKGhYEDOXCG#-lK!U-oswrC6~lgA`+F(D>n zSTxxBgqc=1BeFYpn=P;B^GOUF#@Pzyxy_d>;5%iKg)w|=yyjze7BA8yi@5>DuvETG zTq!P(VTFW0k+67`oU%HG^);-?KaJrtZeKC{9>eD`tczi147*}TFSjoGx1RMeY>c7$ z-?j^R+ZM?e{3{^YByJX2@Kp?7%NP4>>~7^^$y-xxlWdRS8_5one;dQB!7di;j$u#C zx{AoxgB*QNIQPbQy$c+Rfxa(>?_$^=!vS@f{2)0fejmdjNyULK4zc|h!(mf-B!*`z z6*2rNX8jQSt4KL6`8kGPBph z?-)+Ua3+Sc>M}ns`6q^RCiz#gX}q1I7h?F&j%LQ2$8oHqgU1fBx#PG;c}wwLQ`3se;d86z ze$BbH_<+a#aASu25t+Y_KNLsDIO6Mz`^B-5JO8+KpVl66@D5F#;^-`) zcae0Bqno6=$sdXH${58g=ov?^miAuaqnEv}ds$@`e3FBjcaMXcl_J|4#tdg%V* z0Fn8?I0hM?wBGr29E0O{EsodY7!t?OI9`flL>$k=tzQ8;aeqGCMR_)k=akTg#W7s| zy!e92U*uYG(ZPb3Ru__oOK9m!O2S{wuGIT*6d zh~r&_Gfm|z$?P~bAGKyaH;zw!wY?X|`*F;RvvIzBryoQTbyj)~FjzkrX^j&vLuZb5w0SJ|?0oT=W7-xfM5I&$1p zXWH^2r68FvE)YKw7sm13WE%@U(HuCFMUutbtRzdtW#V#ig~%IJv3PYHYxtJMaU_nl zT(#=hzvZU1*Zyf7pQ-zK99tyo;#eQY206<%aov`GVUjQ7=)2Imk2%|BuJb1UI*uDw zxEXF$vQ6ABeq(BO#I2i|vSw!-yW-fbeFAq22PAvMy>aZ5d}l`YbL;k7pF9sL`JPL) zo^@iyA$5Ncf8;`5WYx4!IgZBBqNSZTwm8NKc@0mIay*WojsGI~RXoA>daiYy&)?&i zb;5pi0yPu(BaT10|BvG@F0}FXG70=02XCWrK8~Kn?$h!!BEz$B{3AbSl7G1xjJ9r0 zeL?mAi5EpqekqO;36xA&vnnN)PJkDjVV6^pNT6)OdfakiW$}sx%1f?Hpn{}g0#`{` zS-Yj3tdzjy-403>~LsQ8$T(2{htUO<-vPjT2~+z)J~?NT6xLI*91L1ny6u znY_8!LUfDwh%H6yKp;u01X`|ev)ej>2ND>Vz#uJ(2NUSQwYCVzy_e8vC&pX#NsZvu}>dW(;VeMHXLTd8C} z`Qs*eB7y$K2PAkhi}n8(Zz%a>0?#IJag^(+1lVPJI)TCRAto7`z%%mGU9E!WRL@C< zB{1Ch^9j6Q{KW)DHL$bb9wZ~~D8UQgf+t$v;a-b~;vCM_Lv#YqWFl`xqsnUcWUCV3}e9p1*FX$eeMID;=o z@~)|wnZO;JY^<4Wk~!Qu_Boiay_ew8T-L+Q6F)FDA972qQpDV=C&o>~mw;a$5QAdK zjD9)T#rvy9*`01*kU%VfxI7_d6G%!pno1yTJi`rqtc_t#N#5iI$$YMRJnvw-o$aFp z7ApMM)O?b_BIAqs@>jT7wv0h^U;^JK@QcDjB1exU z@Pquv1P)7%ByiM>ZhNQ!YxtemPfCuP{AX^Q#O_6P%OwAQPSd3XO2|u! zrNq)^bi&_G7%!VdIpbGI$|o`SL+fm&ib-6Rv<_*zF^LDCuvbc=W)koAbkHj+sgguh z36p9`R5xBDiL2#fR~B>V8coFsua#UUUN7Dt))H$casE{s%dQ{cx+#g7ZJc$)o5fqi zTa&m=a=XZyJCbN}n}bp>iMx_`Hi_qwsGr2$N%TtM(Ijk1>l0B?62(dDM25MSiuvm7 zN$VrZJxMr{a3b2C@N-w zSu-$+V=LSgwkMN#O8L`fbg*Pd5*14qv7k{=3tlj=+)DSj%C2Ea3{PT85^pC_={iT# zbI#|Jcp(X1R+e=n#T3`@Br-{4)h&oQku~`w#;z!) z%uiy0!jHs-N$Zn8^J^bzNG?iZaT149IFiDWB$g)8JB7zmSeC@{B>qd{BKQA%qm%e4 ziQ`GEN@8^qyST4N+1Dhk-Q zi66=pvFuV3B~oabLbDV~rcf${>r=QPh0-Z&1Fw+6-!p9^R=Uficn20x*vh6*PJV@0 z-sD%NtlxH7P%*`K7L`(X_+MuYky1H@D#oj(P|bLC3BRVe+9WkoxJG`hNv=y_-)}a~ zq*e;GQ*d%M<7IzRSkcXOdkUxiaZ+wdp^lQ9MJBhTaI5j#B$NBu??~ZJO;T61rBF|D zmsnrq4DU|i;%pnGNJ+8D?Gi@{i9=3~@@csAWEzMK#YQPKmT6k)xrJLPOoI?s-6m}Q8n#yjHFIKuANufsyJ=N`%!lPW~dH0KLnsV~PYLq@H z^iARQ6y8XoUkZ<>@JtHNrmUacpGcv93Imvrw(Y&ovF^&Euhv=DQW%)RppWq&!sRdh1~DO!&7)Zg%?u)|AuW8Cy~Eok`XDq zEFUR0D7g9U+2|BrQFlxV<0WIoS49?#OJQn1>w5JQOfpgOS_+#o))#bdrtnq@3sU$f zg-KkiySqL};lmUrbNS!onv%lXDZImlP}VUsg;|`NoZV?DOqb6v$-61*XHyQb%}!yC z$@!hwT={z@d0#S*OY)GlkG-(l;YlHtLX)y~Z_2u4y)OlS3ITak42m2Ir4TkA;X1t1 z%`j$?IM-X_NiI*=Im+3lHS>&^6?0-&)m{$*1CH;^!&Us$O)t za=nrbDQuK5{33;~E)`R_rfp7PhuQAFO5tny7ICY%P24ViBXX)n?VaDIuv6V#DI7HU z?iBW`; z52o>R3cqkqm`3$9Ru((^RVey3g%c^9OyRebbs^0w)A&7wKe#teTc6VTm+{XO&Zh7W z_d?t=>pZN#D8^5xaK<<p{!t z(IJ)<%ZYqSS4hgIF?Wjf`M*NidfIFiC0B`+#L8(@F{4$}*7wFNtC7alX}Hp8kVeh4 z^+~C2OGo`Qu1VwCG_FhIdWE-(H>6QV!m?Uv)Ry09lAF@_{$)3Z*ltea7Uj2^(c99P z-u(Y}47?+aJC)ZJ>zSInBs^u~?lkx`*lcMO881%5ZrmYprmesDEc+;8Z7rOXGgyt<%mp?b2wUMz=J&r}6Lh;vtQi)*0vMz^B0lHO|pdd|2!xb{4ycEa;j>)rv(Fc-@br z(Kn5LY247%*+cA^MlZ>uBJsLxYtJOY;v0hM3WzX*?r;)+EoRVf*y|-|IfF@Z~gKFrzP~@sjZoX*`#;=FB!y z;V5x*8m~y6+3Doat7(i&qq55#N@IK)6VjM{V?&;Pb>k}c#55+SF(nQ9YvSu^ydim0 zd`sl$q%`g%Q+K_%A&re@^oukaJ#2l<*raE;S^P@;TIAE-!iAH@wlubLXO+e-lkZ65 z+cb8jd7P?^WxP)r$;NMY$=xdB!EF1|_>ODKx7L*a_os0{es2@!!L;?y+Arew;vudW zY5sy{<;O(I;WUmIKgwsj%FXa6CC5$vv*h%e;$I~v#FOH0;_u=gA}9Z2yYnyZqSL69 zLFEiCbatIi;|%u+3yW{KWP5mwZF4>Q*);x1qsJ=uIqn>|zfI$Uy5%$YPf{|2QW>k@ zVj7o}&`V@6w}G9)R$8NFGbkfrf(&>)2TD1UT#@0;rmf;Dl~fQbn$fE==#?wxXq61A zW?;*pD1*E2byv%v;b_;58C1_;_9}M`k#cngH8Z#-gKL%CVDjrE*Jm)fgOg>oOkO*K zjVFqk+>}9`jP=R$<_zwX+#=p8-X`8I-XXG*AMfkR>xp-X_08zr8O&d0U6q<|I#0v- zVz}eB^)^QaPCmW)xOP5V88qOM%;91V4Krwz!RRbr$)a%vO)~g8gDn{}&7fHZV>5U) zgXS5u$e>LIZ8LCZa8Cw22LY>WU$1iWSDuzEIBI|IQ`@~6w90_OcAw<_3|gDy0m*|I zoXr)npj`&-Gk76`7c=OP!9yAJ<@3*=W5(L{yNi^EGrX{am2@^qmkhcZ?<`JWKlpOG|sw^l0W@(I@h;{E~neEJi42mG zl*!W>{JhFK?kKDJoX83Dl7cv2T)=fHZv6{0y@KoG3|3~aDg*i_;v#XexI|oSJ zmS?cSc$KqG{-c*!a> zc-)NsEcu1cxssDLCo}jhgDP26&Ej`$Xm_o4pUvQp46b_8@uzr7{7Yo`x8$^VCWBiy z*%|(m!MP0n&EP!O)kN`?S&J7kfaJdnE-Jqymdf&c8LNP;WEP?IPD*K$l*xj(h`Kyl zHj8q~uP~$Kv)1Rj%cB*tsHprZv65KXRGy#OAYP$Gr47z%Sya!WMi$o%aov!$u3}2L zTHTuBHR83TgrnDIF}$yXQcLxmq_*V7EN+t2G5O7s1q4%Wa}VEXtx-!b*GA`rJ-ob7tW(d4nthe_CN9 zKHIgn##uCxG|l23Ni&f{&9i7>+?}<~fMdwkGK+gn-b!*`*1FCohqgZJ;y*PHX3-{# z!C4I9tIMKY7QM2(aE-Oqx6h)?c3T&D2l1gSI!ZYDa2B16ch2I=tc_t;O~R?VNxEn8 zh)H@#dS_yphmPi!1w@c>OSFpEKwC$r$+ z(5K`aeL8Dh)swG&3#%1wc7W=appT&eMW@Ry(D?=8q9<}iZ+t;{k z{kB1?-LGeno$7ici#M69cfOUyR0(}j7L(;u#J5fUP8JJKIax5xB-14`vUt}dGx=Dn z-K?3z6)B7SF59{+-pk_sELLXG;Zw)FEI!C0!$;5JL)L7w1x1hO6&d;@eld_m>Y|Nd zD2uR?NEQiG8ORn?AU;L&g2Uvd9jeie8~bc`cW3q)o#|aeVoN7 zSuE1f;w+X)mYB+=TwO0Vxm>wi;fgGH>3b%t^mCS7jkyL{_+jeW|8(bV}_UZp`5p)!Za9yg7$D z^44|#e_w!~9~a^SydoG05oIkYtSy*acpeqYYI z5g`j6$l<{p+T^Sgy?NuO`m=0z?6p@e?`WIDUw=D0&2Y8Lfov~!$l)Ogla728hc9xV ze=2^K!{?H9BJ=f<4LO`z?PhnwK*yKdd*ndbBvLj@zRKZilWgGvoL|f#wrvWxi{FSl z#BW*id;=Ej=Cb0#;X0DTQSM+1#mB^7#h=9EIs7c)=r4TeA=b=KnB-&*zZw5s(yFSHx54dmRnwVC z+g~~S%@w%3qy2pAf^37YbeztCJR_bJ{}IoL|BC0u3*1YuakKbR4khxqvVaN&l+2@4 z9`QU9d6dqhOdb#B(IyY%Q8th3^SB|8a(P^lx4z`Bn#X&Ci?6%Q!J~=F=dELkt`sZe zQBiW0$h?xIvREaL9d0|rYMKe>Q$3Fw@~cf!Q*w=Xt$1A?yEoccoLKItmB;OQ+>y7w z?Wrx^n8!_$I^xaZE#j>rD{spq$}?3*+wRPxZr(b`|DHVRN$hzzBzKAR#k)mYo>vk7 z{}}nB{mQnij72;HRc1YabK=)nnyF`&BYd`#+}Dc2W+fqna6E6 z+V2%xiR|7dxnFE8K9EO?V-60r&7)l&6Y`jtNBcZ>dfnaf=$=Q1Jhopfeu&{3H(N)^ z!+CU)bQZgq(XM&x^m&%~+)W?JTVLZ3%A-dfJ@a7Fi;GV3sK}%@Yvg@Q(l-zH_cjha zuH*@^zc|3u49r`n)UoEtJf6zq={yGK@roX9NFGD;7$N7QKatobh3l(*OT% z|M@&#Q2t^bFGX~@&S`l}%7fj>B4tV*Z_D2?$y7c=o>tJqJzbN` z5Z@JNinBz{ZMKB#z%Jig8&oku2*PxJUJk1SVjZt{KYYxBtGQ7!LYn#a%E zY=u1jUErRd#{$Vmd3-EkxKP6HFzKJ8`-O@dAjeA`l@9ZpQTQAv=$3~NU!384UWRlHX@lH5d zyd{sVdi{FSl^7vM=Q{?C_?rn_k$>YU7E{5Ob!Gm@V zbH~`B0cC$42b9nc=JCD!kV$@!{Ful7hHe%d$>V4q$GEZQaf++ZkIv&Fm5g0c4p1ASo-B6R!|CTE2jK zbL^Cg1zc6YlLb6gK&1jI7tpeRdkd&iK-B{7DxiJ=)e3mJs&#{mn+vF3K#hX6=eb&} zCDs(LDd1Ykbs}r7m)yYoyo+77+DdK|Zz`aUsjN|O_q@w~O9AaB*lsQ0Hp%TGlRFBy zQ(o63^$KX-%Fdy?3)YSE8Wzx~fO7L}wgTQh<0=x1MSB4biBoimtZ7ideQ($(JV<;0 z8aJmCllV;@C|GwcU_rQm z2-mt%w*T>TCU7%V{~xz~w1_NGQA!jo^E@;2JSsAgQiv8yN!o}|%C3|s6%iF>_bU|& zJ+tro*q4-KEm6rHBBa9qb3S$cuh)5fUhnfc-@BcA?wy%C=bqz}ekxs3hR@0{pSz^& z7t)1NMt)vq-Yg(6Et0vo3~yF<|Lc4yr>qQK8~^+S_{9Nf(E6b=gvA`Rnae&l+x!NP zmmyJxpUUua8Iom4m0?R6w({%`b)?JCH0SwRoGC-L3^{SW3@gg8vJ3@fmr9pOxzuvr zPs*8R0!*vQuvY$RTe?P2^^x-H1YcQyJ#RRgmEfB)439WBNWYbClzu1OBxS(nGS2Sp zCTuG+qgFnU^IUUD5eLxNUIyy-(jTNdq(7Enr+}rqSXVzd34D$57v4;`>AxMj%kXO% z_LP~I)P5_&;WF$M@00GA9*`cCGVBmf{c;C^Uk{FyneVzMq({r}yWp7gxRj-T2tI$` zand@c%J8T7v~~VsGZ<3B;D5?+rVMAxaE^CoF9zg1<-9m{<*gS=%S$VGQPGP^Viuj} z1uR$gnpu8mo^PECyjZcxO^2z97Z+K-su$HPU+gt6WHF$Iw#bdv6x8zK66@3!)bW~1 zW5DHJ)b-*AKX&+0&xyEycZ3< zXynD6UfkuywO*u$my~)qz{@0SfXk~V+rHWcf?~t~Zu02t% zjTd)&@vs-&yk^+ad%Spn)$)sj+*VFIX?y9tUUcxHqnKTW?(^b)@#r-!zSO`)9@Mg2 zyptE5Eq4)gl|IDvzgWV6N4(&3xhK8mkqDu?7mvyz_weE|%a045@M30v^BnIfFM4{> zOH1{YJ}vDn?IYz1pJ9vY>Lm1&(_i|mEq#tPf14?NsAI_sUcBkWTVDJ!xMZLggS;5* z#SkxgoN>M6#YiuPikTfI7%m;*#f#RzJ?DJc@)*G@(otT#YW>k(r0#WbC9lbO-TGq% zZ+HPc0WV&;%k=u| z`-=>^hYW8YNyxq!y)`+ou9pCTpc>Q<@{>>J%YW`eO_=3 zNyhLFaFBN-ABufA0>*}adcuXQc2mWQut8W zhx5cNy3mL7EnncnsLD-gRw`-%UE)J#levpt z>ceF|)c4`4f7jqcUBNZinQkXc^?bNO&XrO+!>d%hT70dvf%UHuG?X^-;ez|k{q{N^ z8vD@1#@r~lUV4KM-<&crH~HX@Q*Ei)DBl@$`rz`Rn-7op;P&D32c7r%aK8^FK9u^< z)Q6jW=0Bi&e7MDjd)GNUQo^l1G_%~?hubW-U~SZNGT?SOEq!R^!yUHtE+1N3zSD%DWS8V zi?pi`4_W_VA9iVx?mj%~!{o!xb35Hv{_OZCRt4A;e8*T^I?DwPq%iB^Wk|Pw!Y(f z&1VK@d%=f+J`D09S*_VHABGDC`!K|Zp<-&FgNvmjlqI|(c+rQKtTR&ZvJZ;}mM~zH zvaj0G(Sk8PGZGO?U-y|GBTQp`c*F9WKD;GfzSO*9HQs0DWq8{({vxIcf{D_1q?4qR zrSJOiX|a=GQ+$}}!yF&ZHZI`|Yg-Gh#x)^i0>M1#C)}doGg~^}haY_AIqE{TVIRJ*{$kdN<)5pYH81hu zOY4;ROb;uXepa#%-D;u-o#lyt(B)H21Pfec*SA{XQJ!`o#yN2YLS&{3bmtW#kbb_8xT- zj`_g90REH`jtl#;ql`_KdSh_p&m;7xX6#Heq6zjgLXaieu^@}t+w|BW_Z zXzj?;;?^2!p;MnZ{a#saBBz@SAZZ`fAKT7jv))nsFqkiS=whWRmE*^$x_(if$Se2G;(;lK9?UY7Zabd(=$qGnZN zSosqi@A~l`Yr~J%+4$wqd|U8_^i4nBvi>;1ct0Nb*}Cj0S6RTpF4 zXOr&cx@x~;u3(BEQ(41)e5fpoW(ubHG2J>d{NUiOEMl4^bGCF2FTJi#n*U?t-|zTH zO8D51dE!s3^QoX+w0MCZ3;l@s5%=SBKQ6h=(<$%q`OWj9FQkk7SS+BkMDV2_W!CZX zC}x_+M1D4;yjeEjN6>PJSA;lXov60Uu!J8;Ki2rMmaW2%2PQiQ=RHgPNQ*PltTZRh zOBq(+8RzV=ieKgjms;+}3ITbgAFC{{_Jc#P(&X-~^K)hmeC@|qcF)~sO1=?qmTs{A zw}Op+d}p0ayw`nhj&X~1whFfSvE4e~`>}g{F=Kw@Ers`)AQ}d-%a5P9GXV?<;AcO6 zVS5XpRRFvF_|=aa0=O}NJ$~%v9Wr1#rn1TH<9%3-aK9f11PA^2-H&5_98#7szX=Ze zal|@DdHbFCUrRpj$Dh{!!;ce|PYO=)#>h!pb)}q^^Oqlg+n9e?OP`pQf0oy*ALRo7 zT~n0>NK-8IE5x+!3W3~d^~%>hmY<#I@iq{UKa04{-B zS|Vj+X#oDbhp;;Dxg~)8dD91jo4z%GX4;wN(%Ymhq#o(*Qbw|O#~lH*4&a#p`UY@k z0C%wo{pxr)U|ybW6F{nkr(*zjD@*4dL0f6N0NM-gwWS@{6k%qRzAs>IoA*lz4+tI% zpi=;y#a*NiNxKHntJQzcyOI}|pMJ{GEr3S?=+2WH0JBU_33>$hFw;03Jm+!26VfMD zlk|HkOXwwdI)L8R>BAMi;$ji^r=PaF;4gQ7!Lw5O&jm0*{JeEu2w>I>nsuo#tq9);%&{CbWGyfL8>gq_0Xx zOUFnV^I8Cv@@6tzPJH%;s`QAyO4%!ek<$a%RM|xuZE2an zYu4;y4A<}1RssP81$07e#^Q)|qJnX!-H8B_0kr8-!g+gn%2ENWu;(!yKt`MmAQwR1 z`bz^SSYG~0`DOpl0i5gm-&50-0j!e0TDr!@tQCywi}eBXBjv{cb_Q@y_2yp(OwW^V z0@(XUiwyyM%dGf2={DB3fTf!Q*kXBW0D&!Tn%k}OeE>gL-obV_-o?^g0sIue=>Yy> zdkdh&90!LF{XKwR_z}QH*xU7M00#x+JzQM8Pr6@vK-$>rV89{qZ_>lkBT^O}4Pf(= zE&|84IuXXJZLt@ba4=u zh^tF$NNY-KNg1oyMwqPhzoWXmjqE7#CZkJjX~TL1jkEp z{Hsrv6bXuha9YO|gj?MAN;f0>YyE(mSPhvHmBQu;`v3+6K`-XkNK$7exCY9%UsQaorm<_j&#V?jqiC1+jQ1bGV`C-@CIvBk zpM#N1@A8Xc!bx~PXg=1NrU<46@qu+d6iky&=U)BcW|(7?V-_1*!813AC4SFrUVQ?x zvqA~|{{``p0{H0WW5K*2J`sE>Wz1*XO2<+H>u@1kZ_Oef8&ARWc@QVRc774WBEe$m z66u#xmX-zK6>neeVAik215&OhCh1$Abt#@=@+hzL2MO#C*367EM@5yF0#=YMcKP2+f3Pv^ z{JB%SJBVNTD?t2{E&W;WOVIRh|93rmsJ<>Cp}+!K?p-WcQCSwvKL9KN@-RLnVw*T>LJt! zp{Dla(hx2a)RJBjLTy1EDO>59j%J51SN2M2U1_}#uCOtWuPa~Q@>L;RZMkRj@(n|1 z6hcu5zic%Bty~+zbs>ZfI39V~JkoC*LK9`LmvVrS8w58>Z;~?D5klpRlfab}hv3xO zTv9sj5K6?Q)@d5Tn>C79bZZFBLg*Yqmk^qVa9ap>h0rF179nty52nxByQrQJZnsX$ z5L$`vkhZq|ogoZsWrFVxq24W?_E(nN8^S#yd_2O@R@zS5UP`mD#M2=JhINz@?hE05 z%MXO`pyf^>?29`Y&^3gILU<;Gz9Bpu!kn>9p9rDW*DgXgWgiKlyMWH4A@mSGW}U}F zILKb0W1Di3CqsBj%l4Gg=_PnNgx=Qa6T0e^m|hFvb?c7}Vfc|^ns3T^OFGV$jt}ANdQ&>VIuk>9M?A?olS3F? z@G$265T>w&e1*5Z!c?`@F=@P(<{O3hFobC#Ob=mj0z(p*5yH$6PDSx&6thB@9m1I~ z&W153gt;Ny9L6nS{4a!$Lf9X|0iOC0=7q2^gzrN5B!o{xh=-5};j<9tvoVLzt4@Ul zAuQxo*4GmZ;q#Dr4RA>a{3C<#MF@-JkQawAX_uS8qAwLtCiO~vQol676WXLH!`NMu zL;8n9_#;tTe}_B5LkocrcGF|A?T!U&L!)l*b#FQ1} zr1=mEf~B@}8PC^!%^0>KWZsEeDP1L9EnOpBD`mjC5PFU^Z?u^Yf)KtA{r7LqH-Zh) zZ$l_P>Sn;E5H^RfHH2;2r7f)3g6IBgoX%@YrtWcWm$@^9T_JoQ!j>7X#{HZ>gh1UP z{V{|Iqn*sMhdCc3{KU#HnAa12<_&g>^Oq2I3&_6;_Jpw4I{QMXHrK(TgCQK^1s=u~ zVf+@t;Shcg;TTVA!f_;Idea+Q@!Y12<5^kA2wWBT0zQe#V{&aMi`MdoHWmq zbH4NfTY6#GyhhE^i^68Yi>hH%3*+K2wiGWD9uUM9U< z%A&eqGioK_$}sAOaU)l*sa~!Mau;?-0e2;Aq#x-Fy44cCqd=|$1Fq(&PTNodPF)fT1VR*uLHjL-OxIK)PVLTc}4<1(-sq0Gb4WmOCcZAV8 zj5~QcsuVG`6WkR>8^PVyzemtEjAgsr|3$gB81F|+pz9*{m5 zMknic4x??>!GNxc=OPb<@vyj?^bzZK52JRqA_hDb#+cqE6X$w*h0W-)k4v8jeWcHX(O1yVmi7rpnt;yhVT`r>1~>hkn z&_ENsBy4^Le#uXnq^nFy@Ctlk_`?W<5ww0-5DJ@dV;II13FD8p21XRS7H@V=I#MnX zMw0C#*A3xSQ*Avx97XC8KHMo z7^{_CBmJ6ZT(D01m2|z7i}2P&{YKdh(r=|3!Tf^99c{^)$ zkCWz(Fn$bUcNo8hu``TaVa%*&rqJCL^6(e^Pdu*L=3&UsVRYM5`b!v-_7?NC>peQB z44Zj%vzwNB_OjW(Te2^V{b3vsALNM^9FqPfJuGG95yAWC+`kKsQCZKt`G@gm7^h{P z44ZM)PKnR`qxHV#WmERo!$M|Z-x{YAqac6U7>0I33#fz& U&Y z2yPd&l(vfCjtE+d?~*d+&WQOvOJHgf!JI0lpTj*7w8^>7Oe|>|LErWU?v0>Bgx#Al zf-$E{ZhyC=V+8j_aDN03MEJbj)Z~Iz&Icpt7QrJCkUL2`OS?$BM(~h;r4Mt@|2B(s zkKoY=`b6-IcBzN-Dd}SoJT7=b${l+$f(`$)AoR3OFTvB&-mKfX<{?#IWd}+7MbKaH zYy{5>o|7_cK*aoZCcI#sfowVNHKjAyIzu8DYI#@$2hW)GzZk(w5quEAhY{2DcVq;w zM=&;G#xQv~f>#9OQ4zc<9&Md5g4ZIL!g&?fIo^oi%?Kt%%om%tq=a`O7-xBW1aDiO zAeb1zu@4*!`|z<6D%0c$-c`|i()XoPq%57vHowAzO^aZ91fhuO$ulE@nLH5@ER2AE zUd)pIPdc0DS1?z4Q-2o&J`xi?j$oenlL$T)d?uYA!P84U40zx*C-r2~{W&)j0pSbj zA}O!Fm4 zASLEc1{N`8l+8+W5#$A&8HYv7B3RD)iQ>{IRz$Eeg5O!a5v+>fsl$#95q!(|H=U~^ zSR){>6|9TkE5Ul}e=YbXVn%pi*v1IH)3yJzbW;T13wW>C9KjaxR_knwV7uj(!SX+d zcSwJ<{>}(?S^i1T`v=D_5$ulO*T{dPe;*X=k?xi5i(tPkJrDtBzTog~hph8k1c${( ztaCJC9#%8vIPa6Z8%MEYV(F~=&FqaQcse3D#rx02Za(X)7&Y)`1g9hTD}uk}pOgM0 zJtJkzS>A;N!7(3!?aEVey4g{Jq?9vABx# zB5BnqstL?|>kEq+Q$30r3a%-oQ!9!~EZ2^j!JKJc7RBXJIHD+u;?dd_>PFEpibhe? zi{i-D&8~Bdla8X@kJCZqi7YypeP1MaYq!bqj)xo=c2eXio2rd z95o+aZKQ;bQM@h6FneDVC)Yafmp&kUP)f6tpjV-| zOB7wBcqob)lO2ym@pu#ui<#{f#Uqxx3m%pBh?@U^81O{&zhBn91y4rtly!PW(M$Za zv|RYV=d^vIct%cNX+J4{hW8ho`pH?hIR->AkSB$`K%*%6tN4YenW(qUUro()z5kfm zh=xQlG>U1gQdQ0{p6e(kM=?B#5mCGt#Y<7V#U`}O!!%MbM*6b!73rubUKKEAbkuZB zA-rat*9Bvvc*8nx3fPx*oM625-;QE}<%v{;pK;DLXI)eNE}kQv zEB&AJBPjzuj$+=w+}p+Mr&{M{QQWi4!!%#8K)NuBrX_Bgi=yn2g72gFA&MnYd>KV1 zifj~RQ7m6mF`+ehqwq!HkD~W7PmrfI>j{Y4taZ>~HY77Fjc^e`Ov=(Y+csx{$a-ot zcP4p5m{*jNrlrFNxN=eCqgWHg+9=i!aTU1r#g1uT7BA&KTu`)3N?6WM0r5)dD(Pxl z%098{qIhkYXMGf3^B&c&_$w*@cm5{IQM)}%-$k*(^0!fJ6!)K6{BP+dR=6$QBG@Y3 z7R7b}zf?1FM-)FsaUhC=QS6Lj7fO(iNpFdj7QgnWOGQQT!Ig;V3whX~TO>k9zi7(*}_N2BEI@3Cky==6wp9r=$3bmrop}as17y=E;qrEQT{|a=h)ta7PU1q9_-GD+YHA z<8d$KaYp=f_Y@K)xV`3oTcP;Uddb zV^}iM{QGmUoa)xE5kpPOwPN5xpDyD^fkKqRK zjnbQ>4qI9j!=8e9vDayxfoDoeVknKFSG4za~SImqQ zcX!M@1AHWgdtzuCLpz!DJH^mme6O^F^*hFJUkvxh@IVatAtg)?s_0+lf=r#|bcvy> zUFxA29=6;qhU&{b4C}5z`lKy=O3=7Z$$4}-z!(O_@NNw6#mt|!gV`EmruWeh zwxZ>pp)tN@Yeu0Q9>Xhw5mGuY#_*DOq;+17VcNh_7BP*A;nf&Mt7uFNV+F6-$k$oJ z-?|z0hIQVInLc%N#%b%^f$=fCEuLVVi7~t*o+O=Y{TD_$-j87lw;n_PVI>^Vg5Pha z#?13%rVj)kO4-4W0n=lcp~#sr%!*;Q_+#lD>0Buz{};nY;vUXoW|`*2@JS4x#_(AT z^J7>P!{Qhg#IP`i&tv#P!Q1=YIO*684F2$i8z#0Ys=DZ=j>|nu>^lElVf!jKd1LVL zJ`hLkIQ%gLVmKPZ?=b{p2*t26hE*|yV~E7CA_hJ|jq+x)&E4g+J03$!%4mnm zis1DHo~l}BrHuKBH|uNX)5|^8xzF0qnsHq5ck$o~CAH$ga2juu+n z!yRbpx;>7Taa`ZEq?PpUIPMU%meRjdaF?`A9HTmv&}6ztPTM%z3EE5P-y6q|%RPkq z;<)F@l858y7RM$I6Bow=aWkOkgVIiM^LVPWl+Z=cRr*le3|C0=^m5PiQ_e@?=&l`p zRN6C+9s(ZtV}i%yctY@`^`GJ?TVYN|FY7!VM{jW->pUaqORZrZl|LKDbF6J{I*tKx zJRisCxar>ZLYyOB-h zS=@X9AoOy%7se51-Nx~`BEN`ZQ5=iorU!UXx%mL>iT{C>H0(bSWYEyCcc-+tRfv4nCkuNz=Sql`$>&edA;8n&6rPR@e;RUF$tF25y?t=#SQ<=4mYwT`swvEpyypl*yW^4Vy2@LCh6zN*OVPjURr z%Q=Bo3H-uS6UQY9)K1{nIQFm^$8jQ#y>WKB!0&Mc9pwW{-TSrp@4vY@pW1;q4#v&I zYKNqR-{LqdK4P7taWet{i;l(d#T3W!xcM5%H1uQiJy7u^D<_U}36wlkaw?8L<6!5C z(^A4;g1@EzNY6;m#=)6@7{KnbRY;gGR237blmNsRCQwCCIf3&83^-qK zK>`C;c$mFN+3M1&(rQu`U7X+~w&uGNQ;h^_TECWH{0dK<1TIbBh6HX*n7;0pC9w5O z>GcU*oLsw*;k-slxFUfoE!R)rD)H6UX^=pllZOXQgdJ;JQZ5Jc^RxhGLSHVLG zY%42fwwv`INg#6AO^0LM^VWLRZ>}D!^WR*LNgq$(2?3oa1y3c=(>lEp_;iJbMST)@ ztDoyc^`d7I`1>W(|G(j#<};#y0?%qcUr1o?nDXb`<)2GnfSl*0xfA9C;+p-gfe8#s zU|bbv?at1EK3|3=FpNv3@V^v>Com#`LJ~`pcrk&OSSLx`o5aWjUQXax0>=}0C4o^1 ztV`f49$EsU6IhVI!UTR;;dyIT`7sH+rY*jnz`F^&m%vzM-$>w1?!1_LGEp!tf$`RP zJAnz7Q*W8J^p3KV5}0iLY&$cf!TSmGN7(-on3BL$@dwhG34ADE>9ho^%@%8UZUURem{O*X68Jd5?jmOWlb1O@5qv8B%*M}8n7Pgw(5#;8^8}VBu!7fn z0*hF6(;SNv2qX{`FG=7_L79}LUV%^QXQh4Vpczs&kw7wmus9-RQB)9<#uHdF+r+1o z%}di#ni)Y>n&TP)yl4s(qAiJM~?Lg ze9bePz>WmINniv0#uYXvz`=aJO_**W4a${lRF=+nf=yC(8{lfU@czT5b+mY!bi0(< z?-MAkRz&zQft?BLO5mpiZu!u~DSG?Z>f4CBH<)m@WCU8#Ka!FK_Q(nrV3Q5#H z?jlsO4g?(C=sdys*1te-VG{S(Z^rnlNmNUk8)^Nd`Qzi_B=|{JQ(RqIBZ(oEimu;X zOutqVmvBQ#)KM6nx=CCrzRWt8^N1#uu!yOi%qyfkjZ9OO9>5O^mc5wgh9quGg1~fB5)N^ZwAlL2q!}xi0adoT z`AD-giKaTzwn;Ou^vy}m+m7yi&9UE-G~K{%O`@5A++1*55-kKC>))QldCMIPXq80i zN)OW=Nwl_nXA*ab+eq)W{yj-_YUpGzx799*)#uFNbV#Bj>o$p@JSd)yB%Vy-sU#jq z;=v>y)2?<(qB9Rai92hUJ5?99oClhH5Gd}NM2D50holcnyGb9Bc9$~X(WDutk--0k zioWzbp2QPLZ28L3PkYjItD|QUy^`pY#4}0r6=KkC*V9S#PNM6t=DKKo*fp)Yvu_gp zlJM3l-#>{9oi4s&!)^(0tn_@k((`N*&m}<^ASFC6cp-^_fl@@T;r>1#=}YFWYn zF8)RmZzfUWeN(+WM{lVP$0aeIXFT9~Tl%haLJ|`N^xxsJTb|5w(cVRq>AfW0xBiqQ zrds|W2|o5`!1N?$XcOKfW+pK!iRQb@Es!&thn&P$9b9vgX3`3#xq|;C@sV{tPGX+r zPXy&Ry1B?_Z24N2FP}2IFp1ns57XyKd?8+BoyCGBNj@<7FQzPs9~JCN!mm9ENE1l} zljgyGC~5i(Glc~amI`9lk8`hHG~J1lY@BmkOsOQ&;*52&+??fn68H2lVat+O&X$wH zLn*9Cazb`AOmRY9tYU-bC7HyTB-SLcHi<(?{FcNz9wTGcIN#`8vYuB;ndgTjcCbaA za(|t~H%V+r;#+06NHK-AN2vV_uzO{2tySM!EJ%_a(7ka6n4`pn#KN98Tg0?|Vt}f;oP1 z@C~V>N%Ii(_oVp&bxcY)p2Q#G6Vj8`KgHJdKlA(OG%vJej?g*hUrA8^mVWlV<18bS zsGP!iDWoQsFPB2al=)aJpF)Kc`pk87x|ls$Oa9^gKZQ>oaxy^>?BY2;#c6Y$m#0uS zg$q)+PzzrAPDzy%E=rj{1glDGrBF>k=VC#1X$@&jZo1ga*m#MuwWW2Wmr7Z5Sqi@% zGXEQLPS|!Ay6UCOt(8C3uSkJR95dmTk8Vrj9!$+owxnAsiuN;o)h zX$nnKxLK>>j`jJ{!-tK0-u2iacZCa@HcO#-3N2Fbq;MOz{t|L7v;Q1MZ2ob_?J2ZO zp-l=u`pVaw0rOJU|tXWJC+PvLCo!S3pi2t(Ry6Z!J)AgYu)Zm5 zE43U8$_R%?DEg~-@a{s$Ku?%+Vaw+t;Am%`zI^XTpPZIO#k@0PB&Q<%W^ zpTavS{ReSPg-KfW!xWBfa86E{H&B?~6}%^XpYHZ8@0%1fB0r!Yf2 z(>k+Km~DAZ3VUl6G3+BA2pdV76ANM`<@TChgCR=RZ%hwdz%^{DHs6xRQ{Gn@!4g>Nix5PX}$MqV1? zW9q<3-IBsqp5hdaa8)U6=Lt$-cM9LLg{1IP3O{q52OK+67(Ld(7m9!6@t$z+lA+RR z^G=lfox(r7cG9Ss#+ei+hDMb%E=uEE3P)FY%B4|0ZEj76|18H}RTrPtW zxH^pnDs7y`HEA?Vqt0pb(4bz}!$I|U!)cVpwP|yYx=vbcwVB(I0Zr1lK8@cuI&P2> zZcO7Q%R}e7iqp93PE#|bY4Aa=GYyy4;Fgw1xhlTl(qy$c-M6H1YZ_0b(KC%^X*5sc zzBKMn zr!+dJIqxSPR&bXzc299EUR2yQjqkQO*}aN$)ONFba_Aw`P&oz{_0cqXr14l93pTm8 zj4S_m8c!(f$uycAFau39hF{}bt@b>%+S4nIr&an=8okr#BYrN8XVU1KM*lRPP2;m^ z<}mxE!FtYYFXp5+eEdHB%ktBG#vh-KFdKU~fT z>5I}nng(d3_~kTS5sXUX)ig$P$L==O%YS3LEi&UzesGcV^)$w&v2&d{>2IX*W*Wm+ zV8jZ%mBzRn8;?FMg1(^Nn;XEYX)~_FgcBP)0|fk2hw;i zjrY?iOLJ0DPI!u`X-rFl{T8^1541lQjdpy2^NSukI^K+2efX&i229{GMDXOVQVbcv1mGL60a z%^dW;H2i67OJlqCHjqXxjl3?;U>YG_8sbPANdYg|s34X`+&T%?5?c&X#^9STFrr`VC{M zH)rs-HfAH6y?9d^n+02>TY1RSoQxd3+C%-G_rR{syYudN12c~94{7Y+8BCkk5Ozv; zr?E@$la&6?f?ue&mNNUR_4lw=E$>UCLtV4NgJ~Q}4IoLu9)C}aBG)Xbn(235t( zR?FaGadqp|$e1x0S;TaS%*!*VZA4#ZYPCe-rw)9HDgtqRhGPpW} z2HFSi#&v>gGH57hWc_P17&EAZ0gdG}kzQ|0Z^$6N+QU*u21OaP%$OlBSeeBcPLy1H zOUAq{=#;uLa0^PL^h+~nD!y5I+Xe^CTeV;_X>;jqQm(Cqz$3jqgZ*(AO>VB0HhPD& z>j2kX8MMh@c?K&ooXrsTWcWM{?`P09gLWAVU{hJ-YM;Rimz&Rpr!u%VgAN(FJtC^q{;NG%;$ItG(Pt8Jh}`9 zW-us&p@*DrXTV>AgEM$BgO@TGqAZ=E84ME-x6X(RetoKhMI$qKIfFN>|B7Ht2BQS8 zT7Pr~kB)aSp6Rs=Ubp_(47RNH{Oi9d^Q{cV+0yYDG+J$znxNg|9!|{Q9q}aTWb411 zF?~W9FeQVj8KiZXA7t<$o9<&JYnM2uWiUMhZ-#HvU`EEgT=TySJ`&87&XUfS&dFe| zfMI)=nSlyF&R~893o@8z{ZBHS`@^h<>9dS^!H}@fI*SFLXYhq}7G>~z7c)R2(~=Cn zw0;?n_i-~GmtRiQ`T;>OgV4W@^&}OytE)) z%6b#9ZESuID>GP?!G&2=$zpW|Yj_E8RT-?!V4cE#$(T8bzRF;G28DIb^%;Df!8bBD zNm;r<@NEVgt@B;R%!S0F&2qL#w@SC!nB|RJ-)o&eNOxrLV+K3LKTCH>xzV3^7HX6b z4zDbxvZKrHj2QsxSLvP%_6q3iFH)e5@*kPR_ zwluzTy~@K*s;(?<&6@77CJ9QUr3@C_Y)fy+f)h3V8`(@|bLnkav=De~L& z*(qy&^4v!jJRqg>pnyY>NC{73k1QVJ8sztq zJ|TTFi>Cyfy}hS^!Mx)=oki~~`pD^P{bvN6(33I!viPB@dHPg+jfX$32W0Vl7H?+p zRu(Vlj1SFX82597V_+781cP}hv*uq*noN8Da177l_0uK%O;qVw&xkBu%;F_Eqophw znZ?VNU&&&W|8P~i}6{^U{z=Fwr!2CW{M|dF_GW@ zv)J3iIYmmCB$zCHH;ebI|9;kV-eAB~IUiX6L%}rZ^ejr(co_5jCdVDy-Iwila~hgC zS^j6A9wj2$5(NmC#@i@D6J%gv~tdj+RZSg^W|J1y--?3dQlGFE^sh_ ztF5M$b3};c3p~|xpw`Htrhr^aaEY|Gv`)_av&N#!bLP|JtqWaEa;Td_y&SH{p%zCA zkzOgSFTF~7wUhx3a_raPA~clKNP4aGIvdkC$Bt4S#$2B>J@apn5^l`lCb2_WWc}hC z+AVW4z@0-$4sYi1Rvx7}PGf{sIjqj%<{WO(4o}SC)*SBtq1?SWbjYDu4$X65C-&QN zxRWdCSrxLa_Kw5_z=zuL*wJ_r6i z#NduO+^0Pm%iYM~ft>k{`brKD=Fo{}Cx<>cbk3nm4o|S6Ho3b>3Ec$`NgvLkoAn>z zVQz3U;88g}q>o7-w=w+g^rZMH>-5Z_m*uBf3Bw&+!!tSaax~NM9Qx+aPuc!CJfFi0 zIXtWEb2er`4&hQ0JkUBr1cRi5bC}fLlnzyPn2q7(Pjf^LFIwlN97bAxIcJ7}V!$X> z(W}zYQZ}|RIrcv>t&Zt+LFlz|ZwTJZVfJe0ThejT@lu*^^C^(!pC7644tFev$vM2s z1-0yZIlQ04k{mc5-IN@r=J0XOJm(yIhx3CRsIzkTP%uqOXL=4ZEYHkgz|Ah2v*pZ@ z&XxYp#(c#3oM~dX+IcyAlEbIk#Ai8tE|@P}AZ5%#0jG!fLa@mCi*q2B%6<(zv2+y{1*;c@NPf&8AsfgE-YEnzw+IF!S0);XNR z5z9w&7=6giuwy(aYdlQHbNEAiLVD8rrv!iIkpIQau)lNoCx=V&sGY~&-R?6vT$IPO zZO*g&2w*Mkc9)Z1Sz2CNA&-iJN>aukkLT}m5}3}Dd43)j*wPCHRk&2orVQZ9t7;R~ zq!;H=T|mD^9yKl3%A0?~Y1YY`>#m`6^%~EmdCrvp!sU6?&7+?9D(Mx{E2RvmpGT&( zi@f<~b+R^Md|)JS%w4`UCQq zTcwBrFUT1v9b`)f^IV*Evy{zdSRR|!xJKpCaII%}9wP)VN?(%FADPF?mS4$ZO*<#e zS9yvjJ4Z_iWAb=S{JM3<3f{t~9S0Sn|TlzwhYzYuT+$;Ejr z$(!F|Uveu|Tw!sU)GPH#{doigK`G-yY^8@B1b+R9@G$e{drnLmmol3WB&8`<*Suny z**tQ*Z{)F$txNT@GmoF|au@Pg$}459XIUO=d1KFGxw0#y^j8X2@nW~mn!I`H!lJM8 zSf9tmf0k~Oex1j60y^L1u|fQ;bvCkP_Hwd_X%nwj`CDx1);u06IQ}i&F7taHvS5de z`B8ALb+cW0{KTEl;}_m}*pPCLM#~+KuJuqi9WDM<4$VD0W$PS-bqVLPSey{NlZuXix#I`Z8l(StN$>V4qy$k45!0&k+;~k@bmIWNo;}7n60d)&Fk;lnA zDi=6>F;4NsadwzIPV-*f-pQW{f91{iJmm^Tnf}h>A30~FXQk()EalfcYWV^x*!YSC zRI-c$*lCji=NFLsr{v-Snw2XeTu{J;a;iw_TqLL}tyaLOwH}%buC7ID6i`!8tAI-i zs4c!!%9uLbdbuJ3(`5xTeZef)t&6iBw_d;v1zb@8vsV^SzksX6jifZM7BrAvQ$Rz( zoScJ2OxG50osDcPXi`97c`1u-ESTH-Ed|r3i*QqcBkrO|W^n-}0{YGZT$bGh@Wn=& zOr_jU>)%{JYMc2d>sGC;nY6i-E5EIP7M48)1kSijEAqm?yU! zO76}A?kb>70e2V7NOVm13hpVOt)QK>y)CU=$1K%B*^UL=XZ`yNC|@vR({Z&A7SO4H z4mFB8Yb#x(ycnw=Xz{RiVE_M09%cO${<}XvBIqvVpT)QQ?Cwzj^)cz=1w0|3^JD=} z70^@JUec$z)B>{zf16OBDWGow(+ikUK)(X|7cjDbmkW5772e-7yL$;g{+=sfKmpIQ zqV~9kN(nC%Fi6QNWu8yv0*+o9mqdCKWJFJYGuk?E)rP z{y&<|0!oUbi^42$(cr<|b#`oV1`X~63xR~-5F|)&cY;fRAVGo$4&su~)Vb%YTd%9Fx@V@Rx@vARd^Urak`~Zhnv8|2bWt)ED_)X}*R?DXwv5iN%3m%u z^hqQBZ^>Adj019ZlCe4&Ym%`?E}TNi{@$=JnJ2=69r%$BfMnoWQ6KI(p|WdBOmo^uKuOooh> z=^0%4xWtnsdnj3YL2JIG!-ON$qscg?e00~laDNZI>sWz%T88S$Mgt?O8 zPL_$`aKi>qGQ7z$kSQEi_>$q57%Tc&5lBW*?p;>Eicm7b+>58u8j}%C#_eR>NyfbE zCK(e(z5>OPwHILH$w*0-@hWj98E5HSqn=B~C4$79PsRns7p3VA*82NhrgKI4SLIsn zrTLPsC*ubFo2vAdTp<0bO3{~xb^l3oYHxUwjJwHLbkrj09^rm69w_HwG9D>@Ea!Kx zPQpsJGJ9OQXUTXj_kY=!ySg-1Z0>Jy2fsFj!%YK-Ezz zQY%?;?6mf7qohPSdMi5L`Tu-6CM&Aalu|PxiCWo;Dun%B%jadQFg<=lDietnR3BQ!AQDomQEuELC&vuk7;I zR#d;DZ$WKoMJqyUY8z@>s>HOD70opZguRybR)}`6q9dUbRh-U*Z>U|YnAO}Qro80R z)rxMi!8di^Q3bvybhqLMD|*N#G22^}_Ohb+_ht!`)W@p54 zC(Kp;JS)uov|efpt+@8Yu*izVR>;uYGNa|8$EFOgj7zLoYQ-`u3$`wTt4Y zT!3=D`z!~k|4=1+i14o!hm~_guAPYnDN6ELj#+Ws3V{>UlT^u`A|zX3B^<475>r+! zZ?!wEaLL};P~8T%6&|@KSn<{huiX5tcxJ_OEBtcv=jPq8A}BY1X=cR?*JKN88^czd zx8l_dLxkBVHAanFks^09@>#0HpRr<0aif5wbJA>P8w4(}hKtlo)XP+<_6p&u75{D3 zNmj;ozRtDRx@gMx+;~&&pFbFH$&r^^tHdz-kb0LYrT473ulRvgd!tHBNsnkgw&IB@ zeJa;ZeXZ!kev1tJdsCnA!itx2aosSzk_9&#UsJaguOa--iuYFJupy@nAFTLj#V0FL z*|eMF%%8PKZHG2$zfxQIED1KGwm}B?O=HtunaM;>ON9;T2M?= z^a0wE1qiqx{ya@6uv38+A*a@kagpi_P# zL2uLEDV8uJH`PRyBWAWCNpWQxs*qe({Y^WhHEgJ9!)zPo*ig#`iwy&97-U0j z8|v8bwGHiU+E0(VT(CL0o(=U04Q%+zhK6K`X=+0wa%1H*k*XGJzd@SOkujNtU!OI$ zutBsXwH38BwT%sJ3GJv7(`L4=16SQ`zizS5($R)aHgvW@#$Nc&hVKdA*wBUWEww9E z0=n5S)MpXsPN#Fj~ixU=67u&Feu#~!tDq+78M!(X@D6cDR_}zweHvDGO z27Q&Zim+N#Ico{GKk3#JHd8mK(v3F!LEfaC2g8k0&lYC4+OSRe+ikGdGDy*&la@bi z*eQ+bq(#y$8+I$+W5Zs>`v`sC=?+NnSl!5>hX$ycaXm48i+UMhnG+_d4A93MLl*>T&3J90C$W2hbf*>Kl}(sq=w@y{`X-0>dq*uJviv9yO4W=T&7PpQvrcushsN?+PwjGH7({zZLl!y6mk z+O&UE-%(T9@t*L3`jIN7p9pDsX>Tbe*tPi7cBCN)r?sPahD3pMcI{mQ>9CsKjtq9K z`)fw3KqfmflfO_-7CW*pl76td?6NO1M6(?uEQTC*#C+NT%xOn1JHE6dw_Q6sk_r&= z*pZizkD6bV%CjtqDadRgYGG;-yEbvQ6cyuIc3d$Rw?njq9VH2+sN%?{WLZ1P+0oXH zc6OAvqk0(;Z4znFec2u$>`I%0V&W=Q~UO5IkjEYTmbQ*4!Fd0f{>AscF|{l#?)v9fR)}YTHrAj-Ga1T|1f+>e*4>js|4$8{6>} zxuJ3z*`e!Tl%ghdnkv7UU7NW>{1$XtQd?15tC%)~Q*X^*%PL}~u6A^@qrDxgow^Qo zdCNoBkt)#1j?Rj|v7?LPZ{_G^t}X%J+3~$ydkdzY9bE?+yW8=D9q$Sn1)S?-Ucb^&q}180fZl^1F3`L5UJ83a^&MC2^(g|a69JOF;AM49Y5PK z*^Vi81Rt12+A+$G(RM6qtbJ1*V@K8!(!X8z$Y&XA$2dF2(-Cum9W(7F0Z9{O70Q=; z+Bd_@Q|;Qgj&V`PJ?C2g}~F_&FWU1G;lJJy#lEu*fo<5z+>%k5Y}UP=8;`O6OIq;xg2YwTD{ z_+6E*BS=p$dC0cGj*Zd?uW1k5{vd3kZl-RrW2-8y)4cL_yY}cqrfJwA*OATeCv~SC zy9m3f;_tCzFIhThN%k*04%qRx9S6BP-LjZ!Of?MQ#9N-crksAuob$SW?KmtKxC6Nz zIAX_9JK}bv*m2A*gLEMvr_7EMcAT{1lw4DGTv<}N-hGpN52@t0R5@m8=GVUSTkTqJ zMw=aWg0RC5C)s6(+YS%er%JtYz0|Qtm?Xa)@}i|c$d0fa@Q+682tz~~o>M2i5r*6_ zMeXP{$0#XAD3aZH+Kw}FXLBH<1840xCwFW+?npg8!+ATd$}Q1r5x!u@MVi8w2$!i> zWPf*S0oUxvU&?r$dV?z2n|9nHON?ayv*WHEGKOj@2kzN%-;OtS^!8gGP@hpBQpJ2^ z$797$2v6;J71vAAbLGDvycAzKuL-Y5=-v|EDgQm;1N9^IlO1E8n54D@hqg(nscEQ^ zP3r*2>8R`0;KNo7zu~2JM>!_Hz z4((k7iCO-yu7N}A8Q#nR;jgF-sg0=(m^mAx`R1I;UzwE*mZKmA; z4*W{aafo*PVcVnyrp-)YdRau$I%)H1s|##&$bd`O#wmP(*joYZ(9oXT(pX5E%ozz`a3ES<^M*9)itDJp={SL@Dx8fgg z;BN;GI?#QS#U`izgEl15KMrK*XFTM{gD)0k7hHk5dI42+Docf%|e_avBZYZ6Xz;55y08?@&Jy}Y`!4xDq~yhFx`(mD=ZqY7LkT%ulf;EM9E zN)1k(1W3A0^M(UARp~9lZR+;w=KmbH>p+foGJH_d=a(o?PsalX-Z}8zfrkz};%3XQ zLfPxbcUUpesFfj4yCQitV8c)wozNd4fzM+ee7wXlX+ zYEAh^|4GiE-;&CyO^_`qfsopXG=#KNsM2&!R9vK!unbOQbYf~(VqJ*4ia1f!iDphTccPdR#hobSL}@2VaKCClGAvl3li3(cI`LzDQ>u@qGEQw^ipow@ zaiXjf<(w!_M^BZa3bJ2{D>t$$Q) zC#sPpTiuBoo`%@iF!`0FIIgg8W9>$#rcZRkb3NIOJhP4Roc{v zf7j|HOipOt@u^xk(b9=lPCW7II`U|=c4Ej>T^p)ETPNBn{+iIhYA#`!#9`97$ocPX(nNG}d;(I5$%b9wm8|uUlPV{i%xlbDtRZ>qU(giF7xNI+K zZ)zVW`V#t4C9=O0x%m)M;(v5vAQv1&9ZVfUmC~Q&T;wqbJbG&w=EQI(MmV)cRXlmB9bQ1nMj@Flz#?wpZzJ)R%uS7PNz!I3~3=|?RnSd zN2ar-A@woKL6)B6bDfyy#8xM^IWgaf1x_qo}_VL;xE9v}3m7-Nn`I)B0NLu5>TE&k!cJ4YS);r<6 zuirr3Nd1E<<|ZdLE8gNno9rerw>z=JiLmUrY)PAhKe-tvo!IHbE+-EBW7+M*-vr@3 zguT>#)cw@Is0W<#u9?gNprwO!{*hK8&60fBiDRF`WDIt~QL5H)=pV~*@(H=yc(uh( zIgu=_tC-R1giTHsSq9{hk1&U9Prm9t*%5+^DvsL;k7BPAS!QUTcar=x1Js}sAr&)l z4x)1OAY zIk^bUb|>T}OwKa#R(-`_@lp3 zidyY5mU5xA3uRmoF6%-iLOE)As`wRLsHj-qz^Ef9x}bN#KsKpTqYK*`7-bPjW*3^g zsU=Xwg{rcrZe(|(nrx>FM_oAPLJb#cy3pGtZ}+2?3l_X>(yT;m+2j z%0LA5T>qa@r9Pp73ttf$QX8q##xBUzE%J%el$A(5&0J`%xP=QX6}NJsHMxy)WCkcX zo?pB0tqWaUXwOx5P{+I@p_2=pmGg}YT@>$0O6cZ7xUTVs?+rONTLivi_Inq)fA*<8 zs6D9?)61p(3KQt-LO(frF6?ljzY7Cg7$;xLUD^YvA6>XO$~fEw8BAuN3xf#4g9$@i z_=zx7`NLe=JERhj|Dih52+AP#01c zQKj^F3-eOBxLo|Y<-)I@p{a2-VL5e$3o8k~snS(0%sQ`qJ(IM?g|+m5cVQjjVWQ@* zCvR}!;1^o<54G$j!e$q?C}%5Sn;gS>28mpk+W4mn2Y8mJ2P`{X*yV!2Zt5QDUg|#T zeyRlg<-*ezNdkYX7IIL4d`LO}x^P(W5yI}73CCSH;lh0v9?&`If7tXr0Pn>fuTyf#53+I`=K)p!4M3tD!a;KXA|F@^F z(Y#H)PQBs6O%-`dc4VLyd56w_%D?NvJ@OVgnE9$dbm5WQW8KK;mLYoZL_Vinc;&*E z)sy5)$Wys$Zt9v8H9vFVx!i(^nkBuE>+~1RY_y>AYZp?vk@U0i4Nvr2>O1Ot>IbTv z`j3Q9F07homaIHTPjG7w9f zgZEkrxZ(d<_fIyZj|GSq@Qh~8|BFrs1>P|sItvE!qtTd$FmsqvOR8XfUkltO)|xg$qlnx zdjOS0twF8qMiqkiRpnDaadp{-TxKyP)udU=4GW<*wT_CE2?grA(Lj!^8{fO}l^YGY z4Xxd18Hq?#2u^M!PY_jX$etzeL7zOQyO}IIZ?~?Kn5ayS0m2(geap z>LfQND}Ra`Cl+a6IH$R_?}6R#YA-2B$IF>+%yMHkD=fB4>nAzKjV=c5f#k`6#~Zr44TR(AUOg-6+i|U^)9v_lFyIKN&VjvtMSAwAqa< zs8WAlS*x7^ye zG$A*_aza0EAvH>kQRTqK-AGYoA{!GnwhaWWAyd$fD3WV3pt^HS=f z9u)H+n+MrF$l-x>Fs{GJlFx&jWXb08;7f9DY98h1^+4tTm4N&n$Rd&ocu_Ha~zV)Dq2Quj5!^=sXJZS1c zGY^{6X-jQEZAq1|R)p5nHXd#0U@_Y<`!%&awF6a(I(jfJk3pcbM;o={8>&Eunue|( zbmN{5_uxB^)}y1h2Ym?Nd(fTm1GNXWCso3FN#z%`ejR=33{rkS5Be(}AfR}lw3eLO z=wy-xdoYClPt>6*W|-`FvPA-#*iFsH7)E+9%7eKc%=2Kh2V*>##!Ve7yVJ)!)q~do zi@-P!#?zTV6=$LclN3)TOz|LZK7$m=BG0BJO=mqbXVfOFdZT!LQ`y)Roi~9{4`#Ws%>Q71(Pr ztd{mXBT3R457v6{y9eu(^9NzQ2OE^L(Su!c3=+IaIhzSvJldby;+Nf|+wQ?W4_w=I zJET!%*8bf2(}SIgcgd%K;yr}D9$fg=EMeuHy8Rw`f~xzAdVu=32L}oNP!CZhW`xar z#Dk+A6!)Tp7sos}?m^gthzBP;I4OJTf!~8?BXG(Ck6id3Bzq8w>LghSHjhk3`G3bj za8g}Vw?~_xS%SMXtS;}mu1jl>7p(HMLBNAbxlBP1q}%QBN2U%lt@QhAZ!)qW_wm$iJ&EgpSF7uCI}!E8-0>JVyC zE!5gnsYm`v7cF5=s86R6wE^`jYD22TRL-i+g3;KECSEl4q8a@bsFr~ig^cK6~3LKo_{UUZdJtkQL3 z_B*Pq>wALSSbBJ|f3Ue9wI{U~Rm|RA^ikZ`ivhXJV)myqK>0sBg6Q+0}^E*g(nio>Jr0LR-QcMD~yqN99*a`;eLp8^XU%dEgv~C4;t{005 z;>`16zTyR5EL6P6i$CX@B|y>=noGS{M)+05ESIA+UyE6(oZq}yMP5x^qx`jAynbhp z$n{=q@M4El&h7ks_BTo+e`ffDx{12ki!B84w|cQn@pdl;#f@U_^kSD63%VMPWYszh z?Dpb-7y0=EXO94 zEc+~y+ysvoUV@M6SET{3HcO6#h2`XWam|bCUPM_#@ejs=`Asni@FK;leeb4(UVQN4qZjSA>eBi&{X`Z>#cYBPsR`nw@j)h)6OaU&>8R;_ z$Uw;GgQRrhw16)-YHk*vya|FS*%LpdtDcR{mg^>&wm!R0dpj%#H77L}^-F4Qss!Zm zL4I)yEC1fe9g z6t%R}FyAO)Wql~;(>@K$`=Ik_19}Tr@S!5jN>p*O)iNfsR8N&K1Hni&QO!Q>S(y~I zav1Jq(x!o{;zQeF#$^?1OfjOm4>f(L<-@Xn5^DHla%b(%Z1HK&9~${kda(9mu(l6% zeA;*Ex>SLBKGav-fbf+M4VAMbXpt*a=74MJLo*-#@L`h=&3$O$!$3JWKD6X9Z{R!+IwGZv(fY&oh>Okn|Lnq~Q_Td|{{Ldu; zvb7g-8oIKEZnEP(d@rRw>?F!vw_>eVC+pvYd;TItiHO!*n11?T6W)*V|1yQ!{*+>4P(9nMJL+SuZ?? z0l)Y#SK62l^L<$1!%80((3ho_`>@c5MLsO1vy8e#l`i$+!?XYYU-m1_Z&zqvQMR?l zZz^UjVU-W7m9vJ>`%3EH3G1lqeb_+QNZnmOA^uwXQnA^GEwV2@9QI+W58LEW`>V%rJAEi?Fz(%Llm`ehB>Ns8UYoI(F*&-M_xZHp3%(B;_RHB1 z8vddlkS0wK=OE!9>LH)@^+U`fa`X2gPJsMZu)S`2csV*KW_VQ$A<(zQv30r4|jcd=94ZHxF@$+ zA0GMeSSo3p@PJi4l;HZ7{i(E*A|v@PN8%G7p2`)MFX8s1|BowjD`2x1lz!ny z7C*B3(SK;tygP<$er>Yj9Dd~VBfB4#kVTTb2${=|Fa0R)*G8U^|N3+LQP8jb=`Sgd zA9>07l#`!Oz>n}p{pXlMbPD@XgiusP7W3ov0fWSpV9io_Nk2*{E=?#yE$c^@kVOJ2 z_)*ahy&o+yB~qmV*8u;i1*JJzYCLcHhu-RyBO>M|(M;dvzVC9jTJ-M38B?zmWrI z*GcL^_?Ft0+Ku|1AKw!srn@xqrCP9T+tXnQz5LRj86*7o*^fSc^z~z?9DG0eN%N2c z!fhBpt(-IUKtFyYC;x1bf!(Brqsa+_{TSlM=p^kYPxm{ie)3~|RinIkHJp)K{z{Oc zS@?$c23U#XTr};5m@$^NQ z<;QG4oLAwxiaCD#;>Y9DcybzZ{g@{WAc8s(%=cq~9|<9(4q>4mi~KSVApQ$ru^&sM zg#=J7fTeyc^W%jdFa7vcE+0RR_;J*a6@KXgid}M!{P@j}Ret>8$0k2&b~7vvSz7ir ztoCD#RCrsrmijw&9aYTrer!;@(T^E5EMji<<4-PoWq7T!&rDnV*y@MCHtKfj4yu@c z5_ZZddt#969zXW_vCohFvLpFSYpNOgm$!)iclee6~9LEY=B^;(ojLfW*Go$I4AD8{O;>U46PRPw6qv@m{K|ex%oRXU9SgCHR%?~?4A{_*$ zA1>v{Yp~*bnDtV9RKFhq74vbFSz^M>p7A3>h*D!JCQeB4%Y1g)CP|WxUT4YYlyjbN zfqId8$&dFVw92pgam_D%AJ>POrGu{U4LUddxJ9^4y+i$vDlvBnht8TF z$Srr9E_l!~XSiA5q1=w>2tW4YiQ=bzJR?6>PRmi|S8@ZCGZ;X*0N(iVR_?|DWDQ{C z9o;+G>ttP8@_Ro%_%&0~N5Us+ssIugkeZr?DluPJbqJuhQ=cw?g?Du6sR9`S$f!6I zA#(s;)?(B}-utGoJK)Gw)$%}tO2m+}U1ZGbT! zH9u9d1qcNLC`2f%{KtFrQh!mdrC0#P2_>i{sZv^sP&$Az%9*)GS3ZCW0aOk^xMBdO z_vn+j7@$^~7ugUF|Q|7iY-7Vde zrpCNAO`QYyMmBq(q0JP-)sUqNS+d^-&{c6a!gti~1L&^&9|D;2UMIo5q|F2{S+W82 z37~HPLjw3IfOBt5{Q}w-_#BtC56Aui?R&+50DdG04-8-sd9ZTiU(TVj>?M=T=`$vP zVFBE7=_Cy&jG+E3&6O}pm5vVJW5^<5Qs>wJ#;MxI6D9;OkuZrGqK>sQ~^C;Gl#t zQpS3koZGl|m{DHtlcz3+0@|~ef2oH9I6@HTXaL6)9}nP!Vi_bbIRI+_z5x6*Cl51r zEpM;|wDAM&R0q`=fQul$I{**as~j00uYZ5z?yd&;st^buDBGMaQBsHy4j@8^Qe)IO zRbs|$wVVmyYyg)6km38z1#muq3jz5{9UW#To!?|>eL>%;g5h9ZbM%zq^=NIbF$udI zz!k<{rCy_oe?5R3l`{9tBV!h=M^p zmb+E}&jWZ7K;b%urvY5us(%)cf7=bG_8D7+EnnxcybRz~02zYF7}Wmvc`avfjv*EK z4f$;V?+D_*Cw!2rgYZfD=2{jhO$Z`27feG|LdZ%LCtDEN$vLPwl|M9Wkw6|pW^&Ml<1&UUMPq`zZi-J zQ7nkUK@pf!sTHUdKl6Q^OgffGHdFOf1Jy`1QDrS_vYC>|m8n&zRaI$`tfm@4)C_8~rAuFN z8AG5}5DkLbU;-AZKy5;uAnGcoUJ&&aH$16LmHt%_4e2yee&ZmTkee#!U^Y{WAX)~| zJBU6(vc(y5JQ6ai9CurlqyBTf*4L7p`4$C7^zqu zMoG+QX2(#+QpW``Ud2oZB0~nFgiQ)!GR-N}*+EQIG1G#WPM)EhnL*4_Jn_D^&2yOj zg*ulyk2*hy1q6v1^rvBQ5KDsiCx}BqEDd5=5W9oe6U47_f`Zr>#2<1hgIF1aalTotW2eD4^`XE}&H%M^xY=$SrjhlklEcJ9W?h0bk zd&8C>dXzQEPg>!vL2RQbygi5=ivJ|+4B~l))KWCLqcL5gX>SlWN*VV{Rk97`O#7rY z+I3s%8V&^UcMu1qy~T_@IvVBAh~D3twZC8Wrc3V({|0e5hqhvi34V%{KP6u%&i0e|7+)Qri&IWNV zi1R_n-0m_7PP?G~LJ+o0iS3(dd@%^oOF>*F2wx#w4dNQXUOTOrH-oqp#3Q+l%e7Y1 za65?oEsQcI&mCsP`HyfnhN~? z#eW&ZEAngV8|81BVUW^y%)Y072;w8*6E#&xt5(vEW`;B&qzxfg7+;2g5YmOPJA^$U zqz@rO2yH`X7edAmGKEkzglZvV4&jTC_ELQ15VC|Y2gLnuPiJSL$ip(M2!wK%l| zRVtAV0Hw&Ksq&t(nB_t!&#azWA%sLiMQSCggz040#%NnovW)iqN0Na>Mye?UGa*UE zH$14nGE-MYjzDdL4EVqHvA%i;4MS)YLX8k=h9IT2LfV^RbHn^2AcWdnwoV9jL#U_f zsUO0ttJ(vQ26VnszOQ#e;}CYXG>j>4XcE$fp_ai7B&=x&%~VWtLJMk3YO4@htI{?h zZ7c#=L?wJqX`ZyHkG%L6@$w6iMnCLNA)Vsp7nSU2A*T(k}$jpF-$Q5FQZ1kK}>M8AKQ? z&51C1l}^Hjs?uSyFN#MHehy(IVU+T-zA%jmVXQQpclvSC*lJpawX8fogb5)`q$&P% z!lV!;6Q)q7Qm0WRrt$nF(HSAkRL(5I>=5QCXHi%4Jhk56LzquqAdi4TSfuIY4b+Vx{6W|xO4v-5 z$SomkC2vzslNY8PivJ|+3}KgYq?_5^5cY-O4Z#<}{t*5O;b;iQLO2k@-y!@P!r>4O zN*j|l8N!QpW>?rE!@XV)TRw&@70wxCUS^M5zqonjBO$Hdn!9TCyf4kVQ@Z0JxI%DC zYdNJm5yDBrDXKWh()JYFLa-}#gy2-X^s;U=60W$=xm%n!*yqCLo z7#YGCInVqdgdXk9ALaDbG_JRsgg=FlDy*3aRDslCq*0t!J_X3>lv6cg$r#4X4Tel% z?LP(ihgarC5y;H!7hz-}h?A9&jha1-9E6;zwCXE!?lAI%u{w-3VdM=XUl@bK7!pSQ zFbagxDvZ`)6b#Fcanuc?UKoYLC=!Nd zPY~`9Mn`fdYG>*-DnM z)G&J6EYqmdsWZZuNf3V)VRjgEl#~6rX-<5$JY!&pIHN&StwN|nl6Fl)p3J&Z~b=ptAb#(LRt zDGg&o7#ro}hT#k2k1#fc@wZ%AbxfPXIJQu?i@Jrnl`7`8uzU(@r8}s9Dt~7f@+3$6 z-E{USe{UH36z>n?FU1E4@?hs6;h!)L5&jM1L>MQ@hp9)xI7&E1J^q;&>I#lCoFY4@ z$;!8eVI$j>(`$>)Np>m69fn77vpsr0IVFtKVFbc>`py&#|G#%@D2y;ULXA>m)HqeT zw#ri@+3_=BTwy(DRn6zZIIs9Z7#9^^3gfck&&ytA_8Rp%^@iLk3Ad=Xsj`+kH*|Ny zxEIE&FkXjoKa6oRk{*QdP|oJeq|#XokK`NpHe;_^rloTXGWGD|FhrkFpN8>_@SH0C zi!fd)9+|oFn=synkvW1dA}E~B@GgvR>Y36+@Lq1A=?ovJ0w2Tpq&QUs2@Fn6mD0uc z4XY{`(nf#?1SF-4AU!z)H6t~XDwWycvqVrkU1IJC@dtN`MlPeA;t`ZkTrz@E5Wg{p@ zr@ZnjL{L$2h8%{(2=ozDj-W~e_y5)#B9KS=rU;A?8NEs`<6DjzWH3jN6hV*o25p*> zWZlSQUDXJxMYK61YDQ2!g1h_mt+OZAh~Ur#-LT!dZ0QYsdK+s+V2NN-=0xctHS~%> zCc3Q~LA?kr$8aTv`VlmU;Fl=oM)6ey4I_w0kP<CiLzh>O(N1q0s|u$6hX5H znn&`5JArfde<=ye`qSu(%iO?X<*jG%d?EV zA~JNRSyFF8A8OwS`YFFZVL${wD(9yZ-QWm@L@++0z3cZ=1VbYj7QyfcW<1m%PM0{j zx%u^0pSn%|4f$b$OuM}M^nd8$5O{pC1!KxTGuirPLTHLG1hBgo*coH z2=+y=KZ2S}5OvvKua z{n`jbf2XdCU_C*c4H0Zq{0AX>T(>2n{o%4Tf^88Tdt>^yf=S+0`8%rH9>M3i4|YWG zr{bLv>>}@0&K}u3#T_HMzalsg!9UWlwe3Ou@}`5_TG`+$osGeW<$h52Zv=-Uuts2$ zD0Fxg7S0 z4Ew3OPrXHz>}|pw>VI;hQ2sqa_mBDqgoo5es`N48Nd!-oBg4kNAit-+RQ{_7UMqeR z!CS@e2=avR1K}g}lPXOWMM6~DT1lx1{;}GqVripzKh`J{J*1B!LlniMC=o@*C^AJ+ zEDBRGW9BHnh(fx&=A&kz=7=IIAsbanvlAYsG36xWqJBxuP0d4<$h?HLXH5B(Qy_|h ziVHndHf2`cL|jQIv|JR#bb5MpEf0lE`JEC>upNaw4_7im4DqMRFyo zPWf^!qy{~+2C9*2qMD=VRL}5vEtTn1iJ~f@8nrsL235jpM$w_I7H?5bZ9<(W>JsWH zzdoUXdW=w7zMUyCcM$s#ZrcpGD;=8C!U5(~Zw1`R{W?hFUiiUMEw{J_eRI4aj zliMh#Z4~XuUsKyFf8cCgM^+;Bbc&+0;%^9DqWG53mD){}%Gk@@S;G%e^oZi=P=hp> z%x4V~KI%91GwkbR=p99$D9Vh}jftXf6tZnUQ3d)%(O>ZZ!jDl5Bn(piV8RgjK$N~% zpY%hOKP-yjIa8vT zN}i^igq4OFR=zY>ndM65X<>*8O;G6u(9>w3~T(6!PYUq!omfQT#?&rTo=|HBs2!RF*JV_IK8> zj=G+@A&QNJKd2J3DT>XC({wX$i(-2e`{g#ZS-(STKe{R1%`&r(z@JgPDJ5~!X3rQC@{fL zHG`r1Gt()uWRnS2s*P%o!a;CSB}O_p>E9dPZ`F%th+2G6_@j6c#Y@@QD1uSkl?(r8 zV@TrVrKhOY(<4llY=jV{#;9>>3iUMgOjPUiBEje6BOrayA86z52JWQ^D*@a z^(j?KpGEOpvAlcrDvH-~pNyeU3~!>^cu;Snco#+DW=qMa<$V+%qR0|M)|mEK`=flc z5rjWUyHcDGLuzuG7}Cb%m!{UgP7-363+=^_^f6?JAtPhTPu6M*9{#Vo*)H*TLB-El>sI{rG0rHfiF1a4HzVaKyFny!; zXMv=KG#kaxn9xMUj7&*r9z%;5R>ZI}hL$n3ieX3$KgG~GhBh(ujG>pD^tHOSG5ioi zj~Lp;@O2FBX^Q`C3>_4AjG+^`vvR(Pp^M_jYjj-|cZ=aW#ox!!UGb!esp>{8|2lOS zDqGTA(#deUy;;;JhOSXd+D|4~W8WD1(d@658bJ7wI#3QKVX!K-eJ~A;VOR`5$1pO6 z;W6z2pwv7fhO^J~wbtllUL;xFs2E1aw0Sva$F%2EW4QS49mcUSjH5H2I+Z$sI*~dl zhRK8}R9RMLQkzDePMtxWsY+)N%4A8L!`1ylog2eE!hGry`4k|?_AHEHk>bTMRD@AX zNlR%ii{V$oaup-T?Y9_K#bAxW7Q^Zo*2u;9yXD^)*2eIA40~eO8^gL7ZeP^NbHc4L ztdDX0H>zCt8)NuG@g~_?@)qSxh+4MAvR`hVmQhjk$pKvI3B|Z<(!P+ z6ggQrWu_(BV{pU}jUgr*AA>6fcMKk$*#}dT!6{OELMtvZV0%pQfIno~53no~K@*UZl#h@3JJCavM^jma8#blYLCV z)f8Nh;f5T;ICjTzGlp9+)QZCr$L$zGJWN6yDGh!$0SSTWHuM|OKNUvo;dOn@=+x+e;gm97J)(pQyk_v3dd1|*`je&Bow0- zkE28!CCO!}vTUh1N-HiyC>*ntBa~Nu1w!CWEs3v0*2R%X&{GXmBUNIyyfr1oAzh#) zNss8timMQ+Qme&Lolt{XlPdAjce-{Qb>f&3$J99L#!)YhZgG4Um(K`G{WzM((ISop z%!>0BpuvY zhd?iCZ)zWEUur+91hfw6>&y86ar_vEfTV$Oc_a1zJUEUaihm+3yl#}$4U1!V93$fR znQIqk9ARV}qm(mRnh<%ca>n%4mK`6*1m#SOW720HgIA+8#GmaG! zHceNycy%eA702v2=ESkAWs;;tar{D_OP#0u`Ee{zypV7;Vv_j9wukw(3~g zzvBqR5safk?&=5Q_$Q7-ar_&{Vc`)vH}weB7RS*zj**X3PsMS9aFQzV-^R2rJju*j zWwV(T$4vm<7phJQ;;S_+l*&%yp{GDvpiRkFXDKq_*ERQ6~7_e zxsdRV@v_MKI6f%;Nca>-suZoZ1ggM)A)QPjBP%KqGvz*`OP7N5DQJ>{rYXpff{ZE9 zr64f{nNpBB1*N%3Ur_U73OXIo zem)eSQ&jl{Q&328;S>}h*NbbBl8P}~oLV9UB~@f8!m2%%GK8|!a;mg^3MweBn1V`* zZ(Y&rQ(#EJftaN>O=AkG5lkw^Oh}?urdCNoRaIK=m99Fu2DK)&*8g}q4``{W_iF>P zK{_HJC{mRsxs%LX%0-4MNRi$I=|#FA(xpj9=^!AzBOL(&k=~?truROAf>fn`@9f|I zd~0Pr>&ZTEGBcSZ7oD7QNGmDtxm(H9!$q~YTHA&?Hq@opBR?fSv7tVt0V(wx8XL8m zrM{iUHZ-xJhYdY#_{@f;w$wZ+9c^gF$~I(kvW42VC8d=Ottka+rA{YV+H$p>9C^y; zWCv1O>ovd^^iC@2OzA>)wV@lOyK2pT*xJj6-dz1g&YWY~mo^OIY9FrlCHs;6$pPd* zQtD;24SC(KY%=yj>KzVId;Z#nq4c7)|L>g-8^+tD zFFcOgFu{h2HmtBg#wh#FhDkR3wNhJX!(_@2

    r$IgON>={C%u&m_NBdGo%OS@hZD z9F@RKDt*|452tv^#XkQ;5-MA@ub&-b-R%@(e1wP71&yJ}6_WZh+hyw-jjDsM4FcFSJ@ zCgOYKuK;}?`K!tYcr__LV8cOfCH|WYhv>hPhgB{!mmRa=xD6LhuaWxYy@ zT(jZ2@*9+!Hr%4zR(Xrny2FNeCtcn~!xv@|rwuM9;%;+x2z%g$G;6< z+cDIRhz(J>%Is)kM@(vLc-M~i>`2&~eJWoWVa)~9dFq&EqBJCD#n}k)Oc=H?wNAfA4~qo6%CDWoigD22&)$RcD>J7l6#DJW*g`}WlTw5)AMk!l&m?I>YKNqef# zX(qe5lpUq*sAk6>3$!wJd_XbC5AFDfB28r}-q;Qq0Z(?)_b1~sJA_TiW_C2Ev>;oO(%Q1OD&(gSmiN87b7az5O)b~3EB zZd*&;wu*PRqlX=X?D)!#o_75Dxn*KoOD{VbuQ58^w)VC|R%Q9pjy}r!+R=~RpBz9A zRIOufTL;S+7>lpVwE7-7c}JC@op(vDHm z8`q9mc8s>8tW*EqjtcutW9;}=cJ)jjYsX|eTtQuY9Fy^OOrS_Ik@B4#lT^}Sn>K~@ zQ%Tuy8f7{;!;YCM|9P7B!FglWb#1mCt0!uU?T|zs1D<2YTsg4$jd`TVe98hl7E%_G zKdRQc?^Kqp{w>U4m)+D#syrWFN zK2h5!XXfw5CUP_Rvz%!Z$+z0EjlNwar;lhdO8hQ64%+dX9hJ(PcgwNbr2S%-IqXs* z%U;Sp`MN3lRepeCdT1Py?`4kW7^QD(po{#@)x+cw@~9ohD91^uIYFuG)KA-S#*T}2 zT(aY=T-vYn^LAv(ZvMlLb9U4otI3lXS%w=G^H;wh7t4dx0~i+*+GRVg$d_V=+m5St zNZ-|Kc3hXc)-Fw+z9|2m<%YD{OpSUQH|;X)ze$!`l-s1u4m-s`I>}U79o=Jx*AAZ@ zemR}?n9{53A6GQG>^24D!{$npC1FR99#TnI{t76M%3lF`TqW|*NRs}iO77Tkm;M*| zx61Fy&GzloOFXdSp&h$D_{D=qc09IYl?$s~cw)y>IYdrmIPtF?|JkwKfgKJ!v*WoP zpE}UcffshXv?JYt$_~7;eN%x0XUG& zfudZ^?!cQ4y!}64qUCTPukxIfTn^->&e2XmLz@MWlOH)Cv79wS} zumkVVi>T!8y3`)tb>Kaf6m#Hx<;5K+q5N zFgsvzq^3iv=)gymN~A_gp5~A#T~YBY>CvgsnV z9jL>kE?JM1{1XT2D{sIzAYmg18p{qH_`!iD4t(Z7KL`3d(A0ru4s>;(n*+_&R_!S* z$d+U)2U=6wkZs9!r0iUV;un7IKnIm{bl?l+ogC;)@1hdlrAmH%+a7~sJ9Hu^yMXpYoewA0=C#k}UP92oV|G|7R%4h(VNYdJX! z8M2I|3?;vDU>IdMIf9g$um99XIWXFRF-*pj-;!g=aimmA=Q!a6u1<8|JC(~-Fqv;a z-oq3JrYfICneM<0mCSVDQYKx>W;rn1f%y(BaA1xDa~-L%tmnxU)K-@PDy9FO3?V3e zHph+A7s?AA*S0#a&4ER7!Z@(lfh7*CXTFq_f>o5C$Yl;Jr>r1Xl2Rkbe6{j54y>iG zBj>HoECsS`aA2dV+2p`x#& zlMd{0q^4ci=fJOWc6m&D<-W06lVraG2OK!=NDV(I9b*s5-KLIp*o<`X-y9GgB7Y|j zJ8*<@lsraCjlWW=N9~RR#wiC*%X|Ayx6Aq9z!SeA%N5F5@(=PHd7ixBz(vX>@-it~ z<;ZUlUUlFalj|zKAup=@mIJrxHkHWS0S<=@P;VT#Z56s5@W`Fbi9Akt9q`F%??Bjr zb54`rfq(-+`RW_%3-9SNN4)e7lg?tdZ(F7FS40ko1CJeuI#Qj*Vh+S93G#0;N&e}; z9m-u&ivOa#x?;LVxv%nn9C)Doq1?T%n56ho9%D~F%M%BlI`FTYPFW3EUQ_-fpOMeW z7vxL%D?pLT7F+d9PGokbHq1h1cj66-Bw3vRJ)26NV8=FMla-sl}x50|hT6CXN}=7h;9{}hDmM?x6~shkt?1<6vLQo)Iel#j?tq((~3yze#X zd3V8=ntD=q!f-;wOj^ivQo_nkRH0W@iS#S1?!?DV1f2*uQNszV6U&`g;Y3X*YB|x& ziRMn!c1q`5xq+KMaiab+ePbWgb)udV?N+48fD*sFG|4|RJ{)4yccOt4FKwnz$%bSj zvN73&{ETc$O0hhf+QNyJPE3uby%V2P zq_u++9qC`F87^ahGxeaw zcygcNqDZ z)=8~S;OazG^BrZ9Q^tBqy{joIpGuK`^(C(8Gn|;|#P?2l#M%^lYW~5Q8s20fzrI=Y z+2kB@E-3}`oS3hC0Y#qvm7}!Ci64117L!ZVky+}*Ps*238jjOeIz&v}*+5FNk+O;0?8MJ1-{Qnp{6|}DZec2X%--&S1xoyAqllw{;=YF()p`dk&e7J8{B^lXO}A!--SMPgBk~aaJYrk721f=fruH zT%cTZLgt8(CRr}aE2`G3lxt30r`%Ba-!G-}6y!;p+w$FIPP37AQdS*KIO#6Zt@3}f z>P3#5d`|eC2sp91upxuY9Id3wr7E9G{>vilL_{up7izc=bt2|OK^F?S5SQa7_f=P_ z^J7wcoA##@cjTV-+%&{zId{)=*9qYx@-Oml@*a7g{D*wt#6ybI2mI#8PCRkqsY+f_ z{&nI%$}{pg`GSZr-yf1*#D!8W zly;%0D>d4%3`O{^3-7s7lN!iUjPkw<#VIAolB%`GUSs`PYZ({1bTnkT7V!^U_|PTu zqFT$66%Y^++_o2+m2sN5}+MS4Xwb-_MfYvw|8N(-_jDS0awTGQL8 zZh**^&H$l(3Tvot1ZSp{sIRO=}Mqdb%L}o0>i{_i~|C z73%;}q&MYDIkuF(WIwV$DK*lIN;r_KgUGL37)%*LeoabEjW^SVxiH*??_K!8g%K`{ zbYY?k-?=c#mFid3{%^l7mC7(-~N6vR)0c9b%h?E-X8n&3n zUpkR3aizMFEp_21iuf`YmMdRDSt%E0Sd*qTF06H7t{d~*SSM$)3;()gSa@uZv%-Zd zE?jkClM9<&IO)PE7k-xej|A$I@xy|}JH#|(r z9*$6sx^RqgoIIgg%f!s5T{z>y<5T88TsZ53bdUWkWZL3y)K|^@og@07? zfbvjokCewMU)@T7D*s35lGd=bMZVByE_!&K8)R113Q9INvQyqv`9CkrIhE(4lsHG4g$tKi_06p}eFUrRb$qQik$@8;%wk zvcs}&$h);?=;hoHmM1Ha72WuVB6%e@H061AX}TMR8gjH@Yi!=y zPw)M%@x9Gj__?{yeXXh+OMW%gcBck#6RF143^%G%B>C8l8p^G1)TGx^$@@=Db=+9A z+K{EL8};a)ko8sGz>QDo4OKGEFq*jWnH!zl=v z^g_RCGGs!iUd1du3mI!ln_IJ{4JpNKDecJiZhWrt4wQ~=e4&!cIn%nh(bbIs@@=}& z&5cWk^zLr-aAR*Cz46aRPd8-x?4o%sC$m@X4VCdat(Ek&Bfx-pJE zUM13R@jEw$&(t5D&^OwwljxJ(nBvA%`uF5CaymJKluc&3v2eE`BFhhM%wj&9oTF;w zn9O%$ft*(!qOEm27fjGyP|Bi^{iB)|@cp_vIaK?04gU z8#~>pAH-$ZMcM7fFO)qh-%Hu&#;=qzt5U@W>Bm&fZV#V z;{=nF#B zYvlF+B?B!t+_R=N5|Zn2 zuOyC(w{iV1z5hnzkz32MJjm-o zkx%s-d-bBr3`^hC`+UoT0v^2QK`~EiM)kKn_++ns#%3+ZRY?j_3VZO5N{V<;l>V+t z-Zq;HR5jk0D`=bPL%u|D4@yuCzsQp?{!~L5=jMRgAJ8l=DDDmhzMe9#o`! zL{?I*A)D3Yf$l*Y588TQcwqM6Qx6(?VDTW`gE}76^`No`RXnKWL2VDDUusnk#%#5I zpF1s+-CE6q3=c%AlOi8`P=jtIYpT4=Q%(A@-g&7Nvs*Ll)_QVqJgDzM0}om^)8`hc z{A!W0GN66&#Ax=hRpxY-KDLcKXzW2VkNj^~H1WV$%>0=LO=X8oE%NM^wS}>>NxF72 zwYL@?wDh2r?8<|~W~=m{J%37nb;ES&mDwNBZ#=Em_JOIL2kku=@4*BQKKG!52LnAA zu> z(udNQ?B_v$$^g|W-AKRkq(=B0=D~2;iJX3>^dTPX-EaMx6dCHlH}nhVG+C7%rXxJ5 zF0RAuDIe)c^*J5o!Dz}D@>_B&IgXT?Hg@Yo55Du@2M=a>aIAzeNp>4Eq))5(WF}KQ zm`agkng`RB&!Eio;Cq!6erBHS!5j}(d9Yf(#A>?qdwq0Vo9n?m59WKYKwiaXUP>+` zWpxqdM{=cKW9+sPfOb*BfrlrOSd_sGHV;7=d!_^{7|Up=_##Vs%PdvL&m z0bUIBN^f`k=D|l^RPy4G2fure-HSK9IPAd@4?-S<<={-zj(Tv-gX zDftNxPI_>PF01D}IIaAQ2WRPjs6>9Umzwh)T=3wc2bY*%Aup?%flKtO%3I9QZ+LJf zN80bDb(g$z4~nnWZjrZ18!4fk;*iTqB|mP}+#ZZtrFlpZFU3dt<@i&As`YdkJt8Nh z2Qm)W6Ea5rO~yS)P?Dt7{OQ3R`d#ubmCJ#W)_We@XYvpEK(#)UUxAfBrpOz6>cPMC z|Hw>UJX1B#J$Rw~r3bH+zm^+XPhDO}mdsvc@uuGP8>C29FF?yz2k|OVUQB3*!l;U2LP)SKI?w&EEtc*7`PMVCvR(_850bN!xk@WSd%&C&cBS<{R9lv8Clux|q@lullSsF0;)Qg6y zrjZwol{fLG##EHDrc9ctytx-Gl((d`B3pY?gZ@c()QV{?Y*gC7|%4;vp+Fp zM8u9>eBs5HUi9&zlN^f1dT(!PxW&$1$k_YxdrB8Cx_VP1I(8$wlRe0uWG_+*WY|Ob ztxAqVUvAsai~e4CWiGRq+Eu$%hEUDP=pn*r{B)iS4HULhe!dUat&F zY)J8bFAjKdMQ$DEwS!*#=EZ3_MOSLl*YA)Qzk5@oS4l6eb?tPK!(JR=B7W41W6F|QwJBlz%!4^A&!UL@rU^1?00s+8Fyrz@r62WFoa zM$zhiF9LF1^f8P+dQk3!rHuAp8K3*~5IsyrNNI{vVqWR8m#R#tTsFBQH!isVy?E+H zc89gXebZmE|3li}q{uzWeexgj0r`-8B;Nu>Dj!@jei>vuYp(z6#eZH*u9DFqr~b?f z31xZi#S7&xDX+-aax(i;HJM3~v;XK>eSi-oeJJHaHXpM4@SYFFe2`(X-t-}d4>^4( z>#$CktmX2dXTXrT5f!1?h!UQke3N4@D?N$#+%ju$$)h zeJJij2_NSCt*^Of?(DEeE~Glk$i!axZ@E9+<42szY3niVbOjaSKW|YG!d&uyi zx-T`&rR+*R?8kIjt>J@}UQ;Ete5g&YqmsHld>7WFxV{e!d|2bdS|2|3p`j0BeE8Of zMm{w5p|cNNd}!js&+|1|+E6}|w?S#9^5&ElKD1OxD<4`bmtOg8>Frd~p7Oa59Vi{i zFUU@$yq3%k)76J=KJ=5fWH-w=15uyW-G|F|vn)O2E2H-!dy`+1eaOC~R1WBB>F>h; z?qneOjSqt;vfHmHgUKO2d`%guTH7tqhS7(sWCUfT52I8v+LwBMSa#Kap*B`d8y`f* zk>h=sK$%ERC%^My5@j+e#Z!EkN}r|@d31J$@|iw-ulxs}{PRAwe_3YxAP)fl&*#e5 z>cf0CE%4zdRkM(?i2RXU?86euQc^Y__ouduzFZ|MC@aZTmBhZ{cJ z^kIV!8|7NdVZP?WCLcEYaNGx()8uDzw_NFzEk10eY$LamQnrJ#(}!IusXWGzd=FQD zBlnW~$Y06*J{+JNB&ELV3zP7W55KGAun$L+ANAoF{eF$q&Sg2_!$}`bF+A@20sQU5Jvp!Z_`#3+KKvusz8?+!c;LfB9}4x#zPeq4NQz@Hk@ZGI6wn_r#^vu5|>O+Rwb^O6$g^dlENHM-FrAYW5rI;V@tE9Le zCFmtpBCnVwN99E`jB(l0%J{K&m;QktA5zMa2hwe{JcxRAiQdTW~q|+;tRa8FmRSnsy8n?~xqdG;Bk0~`ss~=dEMZ#Ks zTyR+Bf6mwTqmCaUbxDzWlu!JqPidg?rqj|J`O(;qZ~PeMM-x9j^UMD$#^-*lo?tZf zqnRK1N~Fs?EJ^uloYv-kwD9BT3#}#Dij>vXls05rvYkIQdy6!+`Bv}XM?XLM`?0^6 z-qDXQ{OIIIXL*UXhAcfPUC6F}bfa`9dyrCdtC-$Pd2h;>WFJ5JQe69VDI2=XIJ3nV z;D@}ZECVTn{P>D8Smi_HoTLv`N#g^S;eI?lrb&R;xWenh)l>`RSVe$1AyQZ5-k z=J+vJzGXjt_hX(P^Zi)q$0|P-$XV*gB7bVO*%hx$J-^j@_0VNxryrR}xY&;+%9r}_ zlk#Ph<>U%KWWX^gUM+|HmFZ_cw)n9|j%W5XS=Lh4k?Z}~pz@7=Y*N0NGNPp}gL-ZC zV~^Z4#%SB*0-UeOvfYmz^qnf%<;QONFDj9N&bE)y_WH5U50PKV{p0~s!h?SNrd&Sh zVLy)eaa^vEYuZt{YZW!m+pHavb9Ias-C(+X-z2jJoRC}G*ZN66!gVuF`BQTroF>nZ zvU*lNJN+DaUgi067?=FG>_@o($_G;WyyC~-e%zBw#*b@$T=(M!Un@r5^utBDMN0i` zKWxhFemLk(l`Pt0k{Y)k9zVPceSU;gtKW}+@}M6wI-C^C680ma@+jrM=~|qUAd{-~ zPs$zgF8P<7&n>7G)sg|^3m|_0?{W1lvM^bIlvjB>fP%^k1z^*331xYQVG*)u0Pm`r?%h)b#kl%@ z0L3XK$ee4kNK+|#X;N0pP(C0(B+CXMQ&dP(g#aoBP%D7i0elodr2w=5(gIl0+GsID zOK#T2zDS*uCTX3oRSl#D{nJS!05ioxrjwP)Dx_4(+`-kjp=_HGKy~`ZWDS*DDK!I- z*OIb20n`nkMF1@Ws251hIx54CRmrMQ?*-92fG-0$9l)6Y`UKE7fCT|844_{C{R0>m!1zFFj_Cp9 zumA>929c6~MHw8x5X#r&Q1Tm6YF1Cygu??Ep^}jSjG~WL$r#GF0gP3NJmG)GX`T?k z!~nhv;9@;X%{Ka^01l4OzL&E?lgWcpF3S|k)BvVYrjs+snWWS-e&6z27X60+W(6QJ zo18<+>Riga0OqSiI(;k(;Ku-V1+Y7S#R1&3>PrGx8o;)6b5^VVljMuFd3&_A0W1q3 zY|&*|PFX>&Bv;A#Oj$!p&BWf8bpgnR>jT(8*+_0BH<6pkpUEu&?A)$P{Wh+OY!6_E z@|~2?H?&^@*b~6-fmC0Zy#ah)OF#6brGDR3kDGmgR9~TA1K3XyKOl#N{u_Bn<#Yc{ z^`ki)z!C1}C@IM?%JBeBP)?GkRIAK_bT)uL0*D0=58zw?(x2jn9I*h-2XKM!|6(9D z3sqI!Dziad3gB`8B3H<(q^w>G;JWfM+p^q}t2MJOiu4j`hEC`I~NB;=A0AWsl^gZMLmI{`cj;Bf$*PNcqtiU;(&a%(!E z|0VwwKoP$ez?3!W7QkPOMh)*c>$p+-7WJ6LakH4@q3F5OLh6M3-5KV(<7DU$|x&_fZ zh&*j9^59(iAWm#DwIExPt;p778?tQ>?I=jg6J89crUWQ{1u=`@+GBD5Pd2AR33k%N$UWv4h&+D%D|J$?(>gJT?}FG6#Ks^d1u;2@xk1d6v+J~ZN)WSym_wgRP9vuWF@rLbl*;de_<=r4 zB{F|>^K!ep z{uIPA)tcj)CY!I|PF4o7iXzEs${N`xWgWR*weERf-W0^fWF{v2U($O~+wlAN^NS!u^y3{%BD-fks!AB$|C33QMpb(HUbMOiyxD7X_M(Vd4fC{#3{<@|Am`OXDDZbGI^6O z#pi>#5JZPR(eY22%MzF5%Z;IR43~qr62y@(j)rkHh-*P?3Sn~y*MqnbMAZW;7 zTR{{E;q4G^%ZCc$-yr@A!XAVph)57o`Mg2tCyubZ?T|^j9v2*^xr103(>egeC*X$K)3J%Jejt>i7^3A`wKAiG=s%uYmG9LENSPrINpcxTjpY zF#n_c0p(#3k5uxQ@+1i9h#|YZu+{YZnDto@&x6Qaz{nrMiy&SGku8MmA&k3deHDas zSorXUF8(@*Obo>{hmb}28rjKA(#pn^7g9SFcl1;PzYs1C>KKE5Z(!)bO>caC=x=^5SmZXHjGOh@W)3??}pHD zlrGDAlw#!jArx162}((_R0!W>O_SmeLaFXKvt}C~hEk*SS2}0eNv<=N4b8w7D8GGA5_w%(~6AzZwjTx|JOq>C}vU;O9<)o z$||W6N{#j}O&K9n51~s4T|@Xdgc>1y5<>kDta30vx6}@yP6#zas3o6wu{PkSd70C? zuBD|%TT9&##=Fh+WD~FXa(j!6d*E@KE$u7~LTD61;}AZTj~T+?c9xzSt$UqTyVKev zBu^TnvmDQMmZl*z3qiJebkb=%h0MBGNePd5W0sjR?ZMP&LQ-a_ZGsC5PF5sJA^Mo`2Lh8v$(cit;uYy zYj>Gsn3p~w^bO&odU`*yKRJMua9{|7=wGSiq0{<7Z~f~KhRT;4O3h9pK0 z7hOdDNG>Lqkn(<(Qhp+*U3^34WM3iovBUaGIk5{FGC#ZcDkiJRH6g5}tRtm$eFz)q z8&x86!T%h>mJk|*@o5-aL)aF=oe=JZuswtwA)F22j}Uf-uq%W;A?yvoG0WH;!Y^|4 zT-Nco%&tD^!VPY1UkC;A){w~>j)d?lT~_zYyH$QLgx{1O3gLJ9VU^TetI2qAM?;XQ zB94V{oN|IZNuDB4lTver65VDx7sB}vu7q$kgbN{D4B=7;m-+T&*r*-tjgiZ&vuv8U zcbBpKmHC>y;%vhif=dp99FP|J4N~ML<(B*vP>GFVmrtz{8UM{4Ldb4}KkWL67L z2;LAxWbsk_WFUkfC8SzAJ<%fEN;Zs!5TnP*1esK=e}+)WWtFnOckLKsEExEI2G z`6CrZ!7%;_;elMmZtab5iVs70&ecccV^Z=bAv{(7ZwUXPzw!`I^kc zJ!cLh3q>kR+%gHXhNY(ovW1bIc^>jjRg)u(oXT^Bkz2VuRVdr$4I`gQ@`v#jy?{zS zby;O7vqE7M4&$9Lnt+xTAJC~dbrlzWqmh{_rlP_Fv2Jn#`|HUg<%S(<{2p- zhP*`CFiLP$l9FMRqL(JikROmAl2Rilvpi{8E{yVFh*Tg&Du(e9y^=~a%BZKQGfKGW zws}xV!yJYsj2dBB!;sle8u%*!>AI5h%8kp)xyY7N%b&3R{myRqh=T~ zZeh!)G2pgYq*fTUnbaXAsY|IxeiBA~mCJ?DFpNgB8pilA8i&y&i~(T`4CBpJ+Gk<3 z3!{A)O(pbd&BDlZ$l5%NI(xMiWJ|IYDPij{+9+=u#@Mec5`G>=hcJ4`Kc5C#vSdmV z%F;26FPMmT3ZpZ<3)xlW-6-AV$P7(w(o^NVaj7edv4r5Iilf#%2#*bkvmcu(*m+^C^ zhA}OS>2kw7rO7fUj2ZNq+{amIQ%<;EEsm`J#h zvMG$sl%G|;Mc#w**DH)2VeAa!w=fQcu`8TdC+xM|2rq=vWxX!!So-iQ+^UC&TzWf({X! z3gdJb6(jg4f-_;94dYoD&%^j5jB{Z`bJEW}MmD8U7H+fIxXK$y* zPWQg5_8^SA*)wE$7{(*zk10>cr(yg{`A@aVh~h88m}xV=mU}`(dhp>@82en-I)_tJ z1Dso~WsV?A1aC)Ba+^t>VS6KzdJrxbnUzEY*(j1{r@R@FXKYesvgC}UMqC%k%_I+* zm&`}zC*L9qkWzd(dq%+s3Pm8p#TO>ukKi4OBt;@9s{CEbdl3{PK&BdHPEE1j|~K5UYcR?6hT$c_~`wi^8-7+qYKu|ax7u;ZTIlk7$ICMEom(ueFD zK|hr@*sb5*sBM_450r!Op)QYu%9EmlBN!6F{0J6A@O1=3BltFgu@T7h+46YmHxabR zZyrX943A)h@{yEL@_tk@hN4Z=$3>8c>oX&%!CS`DCy)|OjNrQnCPgrr$ux2bIaSs4 zJ*!PuK7$h6s_#Fhe;>gQ5s1h#i!z&>6Tw`{Jk=^6?NV{Qa4}g8lu>KywVamP;ex>Xu zrRhKf2kF0&hg6<9Xg)$eEjM<`QSumhJc1LHljJE<_9o*S2+wl$68VRGeX8}moYl%N zMv(t$s#uoG5nNIERmwHFYE&X~L(A|BdB0AVVGwRba9h4U8OP(P*+#KP;82M(0vFw_ z5_vx|Hi9pLd-68!nf$2>CnZ5SA1EPGk}xF_L6j0B~yI~a`jL04tZCuCROt{ zWoW0==n(hm|3vVB@{oK)O6z0F6ZtAtvi7n0Sp?4`sX-OWNAW^#`w`@gB40F>ypsDl zO)C~{Nss8%`1`J;G?t0l<-WYH+z zRy75qD5ShF<((*sP-GAWc{y3$pBDXq0Bb;!D8J@S(%?$1b<0$Ca``IKx( zHj1Kg6iw)#kDU$b!qBs3ZmB_aJqFCHf|0arIQS_$|ASE0~ z8AN_X4km|0@ik>ADV0s!#&G)hC?-TPf<98Uj-rf?VhrV5a;$0{M_E$UEc=;ApAp4( zlu6`datb+>l*(yQOjj=Rz0Rb6PyV3tSy9YZJ|~K~%Cotx3!+#U#f>O#MzJW0AEUSu z#Z@VYVo4MSqBt1E(kQOw(bq(=Hk#^K{ZkanD9gzeOtB2&1wljW@;&2p4=trYCNs;_m6vvgHkTdqVF5xLAr^z#_Rc48m z9sUu;Iqvy9d4ar0O6#R4E-Rm(U%wVb;LIy5L~%Eodi+wJ z-;-&1ljNVO^-dK2OS+W(6-8~gweKY3?; zyei2@*=EzOqJyF}z0+FGhKvEKZh)p(LdgDK(`j?^R4apCF@jmW`oY3~4c#Vkj@ip{BWF3?Ic% zfn`^7%flW<`=xrN7_=Cs+l}_?^bS_N;$2N18_;7gVyGWOgBZ*)SYoIVgS0Mrsx8T8 zmSH^8V-Qx3p$ercDM_^$GU(M+@-by^9kZ2tke$?|)FNxgP)Fr;W2mS66UvjT`lm58 zj3HV>Zz-)>^+xhmXX~MV^i3m;#&XKQZ7`nvJHHIEB^o-%F zW_q_6y2}fdGrGF1RUd2DYa18No8-sMUNPKgW9c1B{Z>0n*Bg9n?1`BB#?UW@@i9z@ zp??emVi+64xR}hvW*Qj7uowdO%<^;aAlY*aB7?~xq^y1&!%+G+DtY6kF`Qe;h9f8= zV;H59(J_pnfBXLvw{?lz`u$7G`WKd0*RAsN=tMa!Ir3CwHit(GSd0vx}>{$zNjFL)lC2 zBc-NkUPE@+WuJC1hTmfF#NdtLkX+#FOc!Ig6vOXw-NkT($!YQ^DFw$U$747_IZ2*U zt#U?5&6ya^GWml%N1i7ykW$mCjDA@T^$(T`6>GHGsa=WTY7EzyNNA&6CvT89W4J}R zO-fD2nAuKusKgnAi|$s*NvqWtgI`W3IbC&qb3t?6s9Ao6fBCy5$RtFD$p{%Gr8p)h zEj^)<8oGW*?tU@kkK?U4{)*x67+%MaDV`b@?_Lc5#PC3_xPW#)mKw!ce#d+m!z21j zDgMJWX`Cj%cs`EdNi6l#rz}q?|H@whl{}Nb0`wOuk)JzX#ZYReNe0lC-&ixpktL2i zapaBTjd<$U>a6k9@2B#cY1yk9=(3uPl0A+$Rgxo)ob+5|Zk1>H)s#;@QFUE@QSEcU zaJa2MwKNLE@pc>^#!)tof^igzqhuVVWZ7vdEU&x7C_#URED}diinP8iL0ZnP?3$bl*sNBKC?Z9Fe{Q2n9JS)89Y0L|hAOF3 z$7mdfY$!{UI6hO}G>&HU=41<%hx!|><7gAd(KwF9(Ke2Dam5 zLmVCBsjf_2;`kztPH}XWv%;^*Bn~p+f^?_a)Wwp^VV=UiPF-2qjqDyrk2re9(Tl6H zhklga=52BbHX6a})B#s~EYeVDsI*udpObf4S54u^t zVK^*~;gk{NcX5oQj3P(JF^2MO9OEft$#JCYGvhzAZ~|8+#vzkC$m%53IysIh%BRLL zP5JbAYPJQb{9ckcHpa0jj#+Wcj$=U_3A;Wgj=6Eni(`HqH7n@7TUfSaSbmtN*LtEA z8)}ttQJS6A7sjzDjvrYso2;ZPj$?^Rmd5cDeVIy@$FV~BcWn*XY86*klWWMeI2^~G7p5(7Y>nfo+qyT7ZE@V&tLM3E9+%G|vOSI+OvHCmc9FZ| z_=U1ZwaO;@;;G?W#x~S{jYGIUjsui~q$Iyl4#n}iN@T#9Hsg&Way&~K`90R-ah#C* zNdh?%I2p&OIJ|NA;y4}0nK-V;aU+fquT5v;xEjYb`MM8kf5dT4PP1}mSi|E0$KiI^0ypn%6(P&4<&DDqgQEj`3c(NIG)5)&!}fl;AtH4boXmH z8*A&*ujF6327BoLkqP#k&-(H|+Nu@+R<30!8Tg639<^i!4CCO%^1jzEA>% zm8W(xK`YADQslb{yr)`=QQjwulO@QK3HXNTvY{-c6DY$_{DTBOq?c7mIZCsfSt=w_ zbHrDvZkBJqQUY26)e^`^AT7a8967R7O~90ZJkK94kftXfG)Qv-7K$Y4l*$QIQHea# zFK6r@ajkkHHRE}`1U^aNW4f%?NWe<3N!B83lXb|tq*Tg&>dOlq)a1E+=`7QL{wdjz zY(zFDrL0K;pD8b%Pj8+;iv&s}Q8I~^3A9RJM*=$&Xq`Zt1jZ#WK7qFKkN*S)CGb@O z?Gy5R8U`dVFo6yU$SCMNWN&?~GKhLdxjge*z92g#(3v7hmjt@fyOG^hzHpV+liSMX zy(qmC_);Z(D1FI(3G}D9%w{RBUCXljGRo9T$zVC7=4hi67?Z$|1nlWXo;UQbuOlVF}B(iPTd)W97pxHuZw>msS5vZU_lXOkhC*3lsP* zfk_EWO<-Cg)n$9KyjzcTN&+it8B^a%liu9&bN@7tb$S9b5|}CH_BB)G>*jM?wBP^H zGT$_RpTOK}rXLbA6h=y9nVrBK<#Q?X5|~f%9J5Nnq6B_SU~K~H5?GwTk_6Ty(DH(H z)+=pkA~pTxO(W$$$v$6c%Mw^lSwXHOSCOkpsX1t*CIFRA@!e}#*C((+c5b%HoRwQV z){S&o-ITy)w5wW0jwf(}$w~4QDf#IH&M438wf@0++2mXT=jj(za#1d4+@G^l{2_)sf)~UYUYkeqZrd)Jh z>m9l7Y}UI8tbSpZ<*x+(R(_9ipZq6*2P&WDwLVJ7Kp)n}q{tIF?dkuL|B=sB>+=L& zD3@1!oj|4}awU;FiOfm-R?#fOUS&z5!cFaj*DC%-62h!WfRc@rBs=BJByv!4s$BMv zCy5q5bKWHKCE@p4|2HgE{vBld^~Zyw*}llup8)gd>SENqmsR+$82D@nI5WllW39lPH%&`DE%5i`McP zlc<=)M@dvl!aZFpoz*y7EnOa*(2|g+AZjFGO(HD`6Ib;ls!$BlOiGz0iFA5pmDD`0 zOI|gJYD_Z7>g30&MkaWwnM5r)CQNFR4ahoVU9ui2d;27b`pO$LGCoz_Fo{O=#$*$f z%iKw_RnsJzF=pgv`?nynF^iKp8t^kc@n~|WCyZi5?@d{ zk)6pdq*TgCT*7WibXQ3aN>8#E**l4QEZcHK>zhRXBnBkWFPRz&Oorr=k(UN0F(`>? z$<)|QUy&n{7)cqN#1M)!eVxQm<=-SRj6Pf?%XgYa(I=3j$uZ=&r0ijA662JQr`U@b zl24?6m&7E>WK}aIiK%oM1Wd|gnaOk!~oizHlV)YQzow`xn0SenF^B)0OL{3(gGNn|^!FXQTRas?@8?8+oo(O0Wv z4W-v~Z5{W&p4>pn%Wb4=A~z@hA5UiiCB@Ob{Y4%ixVt-3GrKdh%c6s8aCdii_Ye|- zh2S3CJ-B-a1QH04;4V8p(>~aD`@aAF>`gp=&wCsl)IcbOv4RfL? z%UYCl?n}Y`6r4)I=@cAD!K4b#6Vx(LUCy6)Fa?KF%<)BsSqXki!4c-8tj8?-aSl%b z=)7ue7Zv#9+Z|_8a5e?EQgE9taH@-@eLF`L|C#4}3NEDJA~QLEXSkGt%a-Lz3a&C= zvn*5#t~39^dV}?*<@;v}vNm_oq5h)k*~dv~MU#^KodSx(9ae(74F9Cy9>aas2bOQv z366&;c$9+NUgYuOaSEQK;8O}dQ`vj&ewu=C3L+_ZMwgj_7i|2%`jYh(D}{W`@FoRs zEz7$Uyl1ZV)=2?qOJS!s1wID96*9mOq*`NHXf{_`Ff^J1Da9P@N0Xf{zvv*4Q=qU# zWhIN20^MSRA;$WV+WAZ7E?=kxpln_5$mvC#7ggfozwv_RDNV(knl%k8d8PFN%;_vk zdWH;MEFG3e0Z21?X@(q6Cf3ZXSy;2OX7eIDLk?C7dFGZQmlthIyS@%L#|q~4BA*wP zyr}F&elH4mQQC_#UfdXxSkQ|?UUT3d4cMdgRS61vQG_kTMZGA-T->sh@S>!}r5Nb= zv}0K>%6U=Vi#~(RIOp%^qM?8lyvViPV`CLw*clwGZZF~)5?GzAE>_y*@bJV$<|NjN zmOa^P4x6L^RlMlG-ciqs`d(D^qM8@gz2+>wJ%%UNEAJ%mu(O62H5qEL)@CK&It+Ea zW`2>gffo(EXz9hBPt_Z-*OW5}w0>)2=5MXNnlLnFZN}Q%ix&Ui_nC)wZ{_Z28qjd0MtrvsGB@XanpcfOpnB>JEvUtteX(o6vgq#oEW4svi+BKAl z!PvxMtOUco7-8{9hEZOOwk-XgdB%G2X>8&+R)X;ieQJ4j{O+O&SZF?($zF5Po7t>W zyqL-`jg{=v8D@Af)3VI+;ya7CjY<68i#h*uda=-pMPB@9`Ofv?CyVEKG2h|^96dVt z&um%Fx|sDBE6ftAJIu>0i*(V9?FuhevSk(PYSuMY7)q{nUaa?GgBQP2E_iXsi;Yx0 zcRFa>$*_ravlm+|`&KWuS-jng9TxvEK9Tm?#m?QVdsz2+vCj&#pW%QP6g>*;nvl5R zq5Bcd0_4SSoYY6Glt0RF%!}g;CsJ5w|{or~$ezxJ^cH9E;Twx{WRB0ooY}HuVaUpwjWxTErrYw+L17A!{ScPIJpQvA8uu zQ`Tmz&3$OW(2}(kD;@2n?rLLkTOZmnw`c9Z+R^gelq2yy;s@qT?CLXT_3!6He}->mqiSc2g50iWt z>ccP}W>5AECw<|fuio?(euNJrDX097QLLj`$M`VThjGjkSSi4G1{wh1cxQ&6?86iv zzV~5{58XX(T9I=q72sU1X{^&(XRwlSrVq22zq2f}8M+m8(?ka}O~DU7^Fu#vKl(7& zho9IvkM(EP`K$|kSja#j7cq32<66w{i)CNp!%~ZDKXR||VWkgSeAw#4Dj!z+u-S*{ z#jDW5plf{i@=ZJqNFZM8!#W=b*0U09@ZneHjjWq2d*$_>{kn7gGf%m#j%_~drwZu9 zcB&m)9klIW*vYz!b+-?D81}MKn0*YClEeoos_Z;u`5yM+H;a$>aFqEN>v7Be;D(d- zJ;}~ftfyJe_;8lt9P4>j3c2x~a@seu~m zq&c<5UUCw=W9NI;53DJyULSl6epU(@U}!nZ8TKLKLzJGfMkO71={`+)D!IdFoS$|i z(BFKD52_Ct{mA6UrQt5khjf0V_k*St)qVId%w_lxqqKVFq3xp&pM3aCC5kPn{r_kG z%FZ}HQdt(-k;13(BQ0BC*=c^!xt%;2{P>1X@p`1|bFgxxlV{0VXJ$XL_>td_0)Axm zBby)1?z>iPbWA>)aO7MIBCXw7(2oj! zs>>+kH&+5J%v!{cq721YOS2aDqXYv5E9plmi`Q21kfn?tW!X}WwY=r)+u*6^a((}! zYfHqn;J(x0N4y`c{b=Jyf*(#lzV)MtA1*)Ke$?=zrXMstLZTnl{qXpaMAtjnRnc$$ z8c$oYAC;IZvsSU}RT--Jacii#Hqhlw3ACmUP0m1rWJbJp*YcybA2g7F{>P_bFm?Q( zdm}C4Q`c`Uh8iL{OLV?6T&)`^yVk{^>TmY#X0`OWp4 zru#92irMQ8@g%y%t}92`LUX+ z(&wbfM;!L&9x5$s{8;P9IzLW?-CI}*)-!CN0>H4*vTyQZv&B@#w)(M+o!kA`W7&83 zv6Fe1W!X(dJ*$fjyO%BdSogCYu)>r(;yCQbZ+_eh;C=u{{5a}I+W^`HaLkY6eq;m5IRcKiJBGp7!imVh6!9|~K7tRdDg zYlIq728orzcl^VgXIo|GCsvJB_rqX_u~L|i4BroSeP;N=`qlD{3m_FofI{|r?jcPR zKw8TJhI9d>XUJgLzhR&si!uk0B>-oDzOEr_0NDb_6+rF)vImeOfED`^at3hpA4gMf zbvk&pR}Px}`{f=_o`Ct|SkVBA1wcQe`~9`=blXM zowWm~6F}Vnwl;DN^SSF;Dcm%G`pgY1OGAc60W`KO-v-cxdBVp8$~fAZ1<;%=Em&K! zwqk9~+J==vZhG!%A3%oyHU#i%038G96u^`KrUuYCfGz<{2w-9WT?6PA!0>?iBSUwp z^>dT@2QXeZdoY{h{{!g7+?%xzYhTuWtQ02u1IGY5!Zass0|OXj@!$Z4Fb}mX!zlfC zI4IZ%vhcqTBLf)4Jle91VHnFgjv`~(=M;5M3V_xhryVC#ejQDq<;Zgsb<Ear_`+R1e-&DybYlRU0ys;RB7n^SbI2AA)A}udEmV-q$_1P5&iN{VCWzk7yd!{} z47&o@&#;?y4=V-U%dn3Q_}oKI+77VgU;u|04qG8#cT1#m9SN8N!;VtHW;o7zf|cwi z12|>z=>X1HytPN-`2c7vS=_(w8v$Gh;9>xmD7kJV?4{4g&piZ}1GvJLtE|^pe`h7% z>jC^>@e!}%W&nk|C;mwVse9rrDz`ThXuBPt=kx#LzZveZ-VNX%%l>AG<3Rxb1~4gz z$wB-Vz{3E_1yMeTM^vH$_!z*a0G8(RUvi{Sb)zYL0wDGV;A0^6GXw$%GK5&emM;zOq`jiNuM~jH zps=c}8mrDqA)8%KXpucWMs;nPgC_0y9Ke?Vat4trh_3;}1#xPsx$P+}_ zAZ8CtMT?T>4Vp`n7Y!mGLw;7W6ksUGS}2IZmc2+2^$#XcfMS-VI7126lB}gzO9xSg zfdbQvOf(x34Wq3Pge{1+L9`1(1Yr-t8H6hcM-cHrBm~j4peuEHH-*fU)w%SYIf|7M zGg#Z{4x&yFb%RI@;@s7Qq#!B=k<3ia>I{`wE3;N%t;$+0i18mB6wJd;f*L{8WUj?p z+p^Qy>v0NGn5J~4L31Q6Z4H8G$lS=XG^St{H({Vt(5T&JK{OA7fVLJvw6wTY5Unk4 z6GXWKX5jWgbO@qP5PgH_7&HePcM76&5Hwiy<_B|hajmK5FxoCbbPa-_8!JI~h90av zS$hT1+wzS*_w);*e-I;r7|GX8E2rbrns5}hxP%zpS1hJ5fi&%eV zUCjCm>k?K9DT=!8EO5+qdRm`!t_Wg#5IcfcNf~s~xr*|LVNDPl8OXRch;=hr4=5DNiZ=b5+Uy!t=;*pAVw(VAt=?i?0N6mHC=wp;galsL6H8M4S5$)*GxhS^o^;7Q<~;3N!wxyX+&! zognT8@lOzQE+&W<=FpS^KPAqNI_^=9M;-Trc)&pXFT;O9JhUv2f_Q8(Eot{Gi046k zp(Zql7eTzFMj&JSC#o+&ybeMNnrn%^$?i<`W73--&1>O!8^k+?_pAZd53DJy-XMGo zepcFr{>Tej910?AaU_VS#WW{Bok-@>DXc217KF}Vu*O&^X%ep^Pt2M*? z*DNlCR3YREA#Vt&Lr4=s<`Af#Hf;!PqeRvvzIU!33SwrUJ`LtzY$j+LBH79E>*4!b`#Zs_*A> z6b_+C2u0aa%CZ+@C>}xyhLV=OMIR^aRhpe;LMUt5%Z0En-c4S#RS3bxcEM_Abyy+e z8R(xuCxa^lcL<4=Z)Jw0|2acQW~gNOZg}mW<5yv4)ex#NRJVNFdOS5Ot{Flti)%B~ zVXYfNJ%;+0FZG-^3ZZcb7bCb7!M7na31LDQ6T@g4LbDL=hwvbT<{`8QVNnP_htM*F zRv`=vVR#6wL!h~Z+lJ6CgpXGpZ9=%V*){HpvppSTg`)>+hY-Hba&)BJ9P6O16GLa# zE+KTa?A;i;Q^XS86l`eL#GWDa3ZZuhH*{wo)?X?_l1Xyv<+tG zkPwD4)NheU#t|Wm44FUcO$nL*0FI)vx6&~>ggN7#(K}A!F>Dzd!Z-%9jAxj@I+1k} z>*NroO*40yN)W?GZ|*Feiy=QhVNPDuu_;-51gbwhA@{cKe5iUeCLO- zfO(;1p?S9ooD}bEu7%`BLvbL ztT$QzWW5!_ZHB*C|7N9-1K&9R;mF?$;pL8m4)dL3+B%yxbCzu9{5OREs3i;|Zx|0l zctn{JLNJ8KAv_7uZ;5yrf@e>{(-5A8@SIw_=820pIa?I1a;|A2O)NI{O5&>!UWech zAry3z@eO5nzA7}w7xCK=-i1Iw+xrkcSe(M(W%Y&dYF7dU2$xJ6z0eg3Asj-^Fsgoa zM<^pg=JaCUgdtJ=rM0@ka1Kb4DM~vXN(d^07Q!b6ot3-{h8Wd%%hKzGhwPt2_+nYU zh7cDvk3*ZioO|B(gw$cA34AU*{txWb?#+})f|K8*4QofX2g zB(94#TNuJ(JA;EYK8ys*PG7FwVXU0%qy-ac3Yx?)Vh24*tQA?4Su3$tW~BgCX!nvX zg6fpQVGIsqNEkIJ8ey~yqgB{kfw2~AqcCbSkfjboUDkSG)VJ&n!f0sm+}+N`7JnN? z6XvF@%~+eWwqT`We%kG99Yz~=_GWDxMi+*5tnFDluu}MrVRW*%GsCBi9QB zv-YsU^bDgH^B;E{6s(VB?;A!xi~BPS2xB0_Aj?kE<_ryESQx{@pmqa{#g)x~5TLh&dm=ea+FrJ3-ER1Pk zOb_F57{5{AFlL5nsZ(qSV^$d7g|Re@WnuiCmLxW?sX( zmUW%wdo{)NYZx2DI21NlV4=UFHigZ9qjs@wX5GTNm315IcGewX>|~(uwCD!u?lAUP zmc3!@vv@zlfiMnQ7W#{-+O`CW{E;w@hH)W`i(!m{^H>fu<=-&=v-lyyBi4^| z<9^?2{*^;Nkx^`)hw&neuVKVR@G^{7VYK)=K@Q_J6{q6~^jC-!#+xwcCy}>dybGI) zB)$(Lz(D*Vj1*=stB=)h`L2862{MOR!)L+GrBK^QNAByQH4rr_ zTCWpyRsw?|7RE=0PnP|27+)-=KSxqUkUD}Q5fqIeO$4-@B5j!?NNX`7NM~{S2r@8# z!=%n3^`bHvgTsV&6+1-UeW)~n~yE|BPhU7khKtNVO9#3 zdUryx2#QBgB7%AilVX1*&@VajO1sG3akpc{19#~N%23^pU}^+qBPbU^rwBSnP(FeR z5qKh~5rHjY&c>V=K~lt=Gg(AnkKkE=I`%s>4c9m!Vz+ z^%)wlHneFfwBPcy;21r&|R5BNz~&H9kDuS$jm#lYuO~BIs>#p9uOg z_p>b9##SE~!MRb@2aK-%?+ec$W^xW@7{WR{Nlf=$euEz1^$ ztr2XqEHsVw&IoozurGrBlmc1ecSo=%g1r$W|B*nW@=nJdUK@Qfe2{U?&Fkq zQ~)YC4@Pi^;V>&%ev9CU#YZDJ#@v@C39sO!BhztCQp1?D>Zu55^c`)dBRFI6S;|)C z^Q;#vyR%>7(tpBjyi{QTH`+$L(_lFTYir{esPa>eE zK7T`J&YX#Kqnwl0Nh_4m@4d7<)AI;kP_>OfiJ;>J_sa-gQ5~o4in(;un+V=g&1z-- zar};o6R)xqV0a(F2Zj{O?v21_v7ef(PYD!0XjwuG;RqrOQC7+FeRn89rPjNEo7R5P zB6yS4d9;m7kAReZTs7#5s=H#WA0zn0K$g!Dd}01-S!l=9QKX5YNEAh*NE-#BC=f-# zDAGldJ_@>!>{0WlVETbN17*j1$2Y7QSu?R_X3fHyl{FhH1*WC7azt_Fxie?f{Oy{y zTnxEc^RVWPA|FG3RtiHa%@v9w&qP<@sQC}|`v2TZ#<}P&JaMnHSk(N{*cmndu`SMA zg0*B6rJ^X!OaW|BlwmH*TF$bUkD`Lb6}lt}i|q`KDB>+k0>g?%&IdOgt|;DLF&F1b zilSl^?W5=rMRF9CqG%k&w^3A%qDmCiqwqvgHEOQooTsF-S`;);YH-0s;)DcejVNkH zG5V#aQ4}*2XRRpaoObQbS+zDD?WKpdIt+EAsApN~N6~<}p=Ehm!Z~z|lMd1(il$Mt zilTKC&7x=?MT;m}MiH*%YLRTNNloiPXKv+M)6Yq3RnzLyZKBk(2U-}q9iNwci|ujH zh%d5G_>SZi#V=7TiK259U84A&f<@6aid*@r^oyc@)Lay`TNK@+<}#_Y^@yS;b1%!% zo1sq>eJx9~@reVX=79eZtONrY22r*$46*D(qZr0K+_KP;tRtfs#m>=DOpIbu6k{yk zu~Ce(cs#=dN{z`bI>ltmK7(OO6jK?du}-&qV`CC$GS9Ls-$kiU*o-Z01y_51h~h^& z%jm?#R5ivV&W)nSMaPbR5{Q3_Vjdfb=QAvbVj;sK%l>l|KaEMG0JN8TT;kFwHa&7| zk75TE-6)nvv4SmR+`zChidB|nbrfqXUdynKbv>!#rd@uud^i3NqS$O%wlHjsVw+`o zrnoC8?wwKWiqevW?&5nL^gVia6nmoB8^u00o{C~W0|ht|#R2AnmgP_shnat~EEER{ zc{GY+mgP9Z3CeoQvP^ZKW!1^yMdC_3GoVOf>U%6={+v6ynMDa9=$-ge4{sfGs9+Q!wuGZl z8ORu6h(;k<7MVebf(B?&0F9lxZq_`kd08nijqxiWp`e875%+G5+zze$+P{oIg!`yRgM-HlaeHJL}*3UWY$U&Dl=4Jt;$-Bl|s^dRy8El zl+ap28ws@})TZl_aOya%YUF8n!%;^vi&^%&~2HeqeR+E79x1`5_#!nYRFP)4#e zWoI)9%^6y-wzR^~C{X`PPns`@%W}BdN@ypcy#%@tno_LhJ9nDTE*dm==&hrZgw7IH zNLVRhK)~IFc9$?kLRSghBy^Y1L&8J}lO*(%%puSNB@B|#i-4yv3 z7d+`+d8SI3CgB$eOC-3iIi^eaQNmmaGuTO%nGCa7zhj-v`n`lX3_q|^$W6aGOTO~Z z$KpLRoIgpJCxL*r`4Sc|FJxWB`ZMcdRthteR(_GNOu}-B769_lp*rPF?A60bN9*^y zb8@q!RT5T9*eqd-gf$Y@O4va4Lc%%;>m|_KLFekY8g_M+Rvk6=x@cyhjS^@&9kOha zaK_=JC)KLG63Mw$!Zryfsa#3ePBq={J|N*BHL9;XJ0yJR=GrM?7X$Hbik`)LCG4|! zzl7`?Jrv+lqWh49|3*2p{OLL@ft-<93gIvxEf4Y9{l6XPFMG5IYA;Ty7109zoy#0uGA8~~mf7;Q&Sp(Oo@t1JO zKw7Vjw(Am(XgI3j4+%FU+?4RAgg3OKgj>{Z^o)N(l{Ce6oB1!+zu9t!^)Bl_toK;& zvp$gUF9-fl!XvgkWao<8adgbbY$2v2)Am%tGqw;vm+*r5rDb^~;kCuI%R340>EH_f zQ}97T3hgW7xeTuapM-%j2FdVC2uQHW5Hf-iLe#X%$RZ;wAwt<9;j4tG1WAG}!H^(J zP$Z}lGzsOJicaZ7>f9nBkI*uT-fhMF{`S&EMNGm+37;fWR#RqO2+v9cDksnX+-++l^S#tMdKYWFUHH;lgr8| zC!@TK3NjwL98`od^bu1B+CSG5r|XNtX~ob{!Y;!h<69X`WW>uzkWpQRM}|{|OGdJc zN;2Fs5@jUGs7RM4#I$~*W}L`1LdB}tqn3=?GU~{vE8|`@QOe<^BN>flsQtvp5u)fsku6}m?Gm#)i;tbeykYjHGR;YX&N8~lXfC6LjJ7h`$!IB~ zm5kOh+Q{hMTlDqX=2s9yPE}skRh+LYetP9uus^=Nj1Dq7%IG9xUSpB7nV1-|%_=V@ z%C<>6lb^4)?`$i&%IGGew~Rh?92q@i^pw#{M*mzQ_hdoYwEwfM-8lQeeBxF^L7CfE zMnCeEF+j$rplNmW0s8XWK5SaL&i)QdwSTSd3k>Eql~#SmdaQr<0nce8H;56EMvZm1u_=O&_>w5W;L_y+!Rr7 zycm~NIO~YTGJcWKpomyPMQC~Qti8$8%80U+MW=1{UP)rPj1^RmWUQ01QpPG7t7WXA z$~8h1{A|mj+2|6gxkT5-;_&Hsy4dwHHpuu@#zu;~&sO+&{F^MIjb^(n#MxS6_QCkB zGsG4dTV-67aY@ED8QbY{sJhA6A!DbEeKPjT*d=2(9YMxknbx}U^k^qqWEU%&i~a|a zMOJY(tFVo;ACPfS#vvJpWzbnVXB8>g#h{wvuim0bYT;U$oYc;KRK_tGr)8Xxaa_g; z87F0&q73aT#`mzlO)uKj5LvzvolAIK9L884~c zDd?i$m5kTaA}J`L;Ejy8)S@a#qu`xPGuc9xp~(0kBZXRc86j%_W%#J&ml2?*Y@nG$ z&9jINee4wTYh}cjEP}2pEF(f^mmyJ@E~3m#k^6i+T}A0yf=Yh(uf{9{u#J04$pz3h2qoAa2Qq^qnzR370BThjo#XKfmZ^JI;^->CqSE@x` zdFZfd6+l5w1-TTYQ;=RkW(8RkWKi&pf{Y3>Dag~u-c+?w+B#DUN@qGkhSwfS^Q;Q8 zDafuMhk{k<%&Vw2MLgYTr)vzi5wBB=MqyiS+Fe0G1%(vkRgh0Xegy>-P$Dc1+9(3$ zx7yQp6O_eSdx~%`dtn7d6cklZOaUcP;hN$@LqWl)wWnxPB~4dTlvGekK}`j<6qKe* zQ{YyRsGzKZatiDU916-SsGz{6Kq!zW3(D?Fk}WZ2dwslG7l*hx**smmf&>Ll1ug}T z2AL^i>mV}r7x@we-C{J=c5bjeNkK&gRTWfIkgTARg31c2DA+yRP6_f$7vVe~Kfx`w zO%-*si63)`>I$gLcofu7K&9yYG&4bt<`TtTdkPP+*H%zRK??;f71UKwPeEe^-zuoD zpn-yh3K}W+JF~c3U-Zi&sF^xcN=!W$PwnmgRHBK3rV5%VXinj6qTj{%yAfMgo5*4l z%cq&;geprb1+5iyP;hLEy^Vsl3fd`XPf;o;ie(W68i+Ny%pCl$oq7CDC#rQ+(237D zw57N#jALSM2Y-VZpD1Ofo5yKgMciMNyvJ)>*+VQ>utLE~swN83hHVt#;;Za!nu?`O z#IW?@2Z!TH6R}poIt3>coKmo!3crFq3ic}aRl!CD+Z1f4q*kz5!4?Hu6~vV`AEgGa zPVQI6j3iycrJCYrx7eXzr-EHnL@DsH6TQf*>`Ug~X(db}G+F@s6D>%twfy zvWpKnM1-P#1A9HrP1P44Kr;Ay!KFzXH}6+MQ#;&RAg6? zLq$#%xm0}YZ7+4Qn%-Ve94MpdW=FYvVqbDz75P-;S5ZL4fuf>se$$J>P%CG6ZJ9^g zCwI0NR#8Mn6%|!g6jf17gW2=q)2&MS_YX6%|!DRk&2RRV1qT zT2`!YEq-|IDWlkq=(dCmB2vkGnMzhsNySKan#wAzZ|I>?N>}QvCz>XSES>GuR8&{d zSjD$0JSu9asHdX7ikd2Fsi>o(u8P_!=o+VZZQoQ9#g8QuH>fD6Kn|WM4j)NwprWCQ zU`5f0)G1znve7dnB~hnJ;>}ol6BSKWv{KPpMKcx6RkTpiQpLL0p3^lFmVdS_EhDzn z6Zxi#aM<>>q$nD*wNcSlMLQK_Pxxfp)JJq0ApV_d){%}XI;mK!;ujU2Rdi7?kuq9E zR~6k<3|28jMRyfFRPLn<8SIdi`Du$^TtzwLd;VMQ@da4+uf+`3_dsr>;Uj;Gx zlP&eww6nL`>1l1Oig7B&tC*nTeqC`nkGQZuzV;eB-AAV67lrDG)5XPP6;o7vuVRjh zsVb(an5klxis>q55TvA`z<<8>&u=q*EJSrqP&3o}EpZS(S&HHa_?F&^bQt>k-T@NwcDd@33TEcucnd}iK zRwge|u~fxwx+oRPR4iAqLB+2sR;XC1VvUNmRLJv+RVr?Gv9D(KZLqg;ig1G1zS6#q z5~s0PuVT|AF@KUErl+rs}Gzmi|{PLf>bTeTM<4s(o`PN>TaPvGxqDUYQ*lbgX%+ja8mc&=;;4#)Dh{bQtl~Gy@%H9x ze(bg9UN4bRwcV{J!h`M3Uz3liIIiM^ij#EeZsPlyVsQ&Gak_a=|2ePdbtb+^8F5C% zSxQ?KmsOloabCp*6&I;Eb+^B!XZRfAiEKM`GMVmu6!RrX;);r^D$c}gzpGf^&wfqC z-}%IVfp%BaM$THNp4cRnWKn-a$q}A|^hKw4ZA)SWw8Zv0~bEs{8 zeQ`Hz^A!{IKG`x47tKqHUrLKi8Zv9hq9Ln>-v)?W-R$pej<)OU&D-1S3>UXQ**1o4 zIW*+dkWWK?4Y@Sr){sX-UJcbJh|%NhR6IPj#NjWtfhVi&ND$M$*a~PUsG*RC!W1lr zI5|Pgre`hL)_Y^}<1&Jl2K{A(y_kmL8XOwpHI&d$QbRcnGwvr35`ZV|{PY7G&UG*s45MFTx-P=U$a!n}~3ImEy( z=H0Wp29Jgb8YXI}p`oUR&KkOCsHLH{hNc>tX{e*2u7-vh8fmDfp}vMTeMAEdR5CMX zG&gr`@ohVMy}F`MJ<(Xhw;GyI9`zFaSJ_{-G|zaXrFcC`G}q8VLt72)G_=&vN<(Wp zl!i0)M25}DN3xi2f|rvVtssVKwlyt9dkq~Z+8R1(_|V<{c13dP9`;nj?Y|7RQy0*U zLH3#}lDlf?reTnV!5X@2=%JyHhQ1nlYUrh*w}wsg;;2w%xExO{e9wBKbj0kQ>ZhT< zh5;G|YM^GneZ;n@q@doyWnLRS2xYf9D4mCB7^-2EhS3^^X&A0ygocrnJK02<;$lEQ z;d$dZT-7Xco~`y=b;TGBV>OJ^FkZu=a+P|e7Izzn0(k_Llh49&ue3;;Q%uq@S;Gnq zD>Y2fFjd1(8s=%3reV5<*&4prFhj#k4YQ~KP~vp3)8j$AH=Z;l%ywYJ1oM4?+U+?S ze$eovhPfK(cAxJ^JU#SMcGE5CscJjWL*)Kyo3CMkhQ%6w(XdbhUG*XjKWiBC#zT)f zeYPdjqYjmAddps-VX1~?8kUom6V&`tr%j75HhNQ|yqo{VlQ%)E(y&^?b`3i;tkJMm z!$wM54eKYC`4Q#{!pPxlUbrai_{qF8M-a9pEVl5kSPDGk>&{7$Fi zKJ(L5{4|`UdfhXgwyO;1G@Pewx*c~x!$l33G_&9Se|_wiIlvXx|5@lbwBvQ^_SbM) z#~B?rG~A?Gqob~lKQ-K zXm~}{Q^Sz5f~sMOT;e5{6MCR}qv5TFcN*T)sYlyeXE5JZoJrzTFY}3ldJ?{0p6u1& z)1YfGH25_HG(8iE=^8p0YP8XhK#Ii2ijW42%4c)p|;_r{3-a*9)9g{(o*plZ;l zf)BK39%JSRMT`OzN;dEKlpQe*A2oc|@P$%fqx}~_phHy^=F1~=q|;GaM;RUIb!5fTf{2~sH41&3OeF-BOJcJIr4u_6z31;6f zeKfgTKvbzIn}!4pNE?bJGF9j=StR5Nk?@Z z9vzi+RMAmYM>QRze@&*_CDqN0wFKP+>2^T(L~06Z=%}fqmX6vwP3mGRI@C^$0KKGB zUk&w))d<+=J-VKb`Z}iRn69INj)ppV>FBMak&ebX+UjVh<69j~bTrq|LdS2VanwjsX99Is(hFKk9j$b<*3pLcT4!%H(|knF)Y~p6nfF|G*mkUDLVFz@bac_t zRYylUMcCF!M`s;W5(>7r)0u88Y%ZE4n_Uxh zbD@l*j)F-#ChM4@V=5Ke%klIrz}C%9)#v;4VuZs{@vUcBXZs8tGj*)jv4P5@j_-8* ztYfi`**d=0@so~uI_A)2Qj+SJtApZ6DMO{S*~w(mZQbmfy4#z*^~~3?K*vHIi*!(_ zqkfVBZ#`?%ihYue&NyO&o%&vW(Xm9wN*$|oEY-1$YMhQ0l)n@b!qeH_bWJjKoKjm# z1)JWcSL;}#W37&L6tUmT9uMm6q&{J4Iv&q7U(@O(h+lPVq%uhn)3Hg%W*s|p?9{PE z$5tKNbZpl_Z3Q(Q)CKgVin&+031+M&Ms2$&3v}$!v6mXp`hr>y>Kmu0M|vI`Nuw3kdDJt#&jH^OoUiGRJ`d~neu(!vf%+hU?dUU&_7MS{q|IujxHvZG`P^T4t@Ic4EIwHg4jvS1qBRuP7ztqj%W}5kM z`$)%QI+u>86rTx#dim&!#;Y-QdS$+pQIuV4Pv~KPq2r~FfR3P!S2|wn_@E<2#~U4Q zb-dH@o?;@~Hh;41dh3~);ApeSPDSxq32}CV-K)c=!>`k_FJ|ja50=#AQd69^ohWcI zKBOb8SixARq(+b1@)XyNHTkUQyWNQps;}=^r_td3}iQu!$3L%=?!Eukl8>61K${C6OqxN zG3_=2>NzAh;BaK~h%5%O8pviK{MJK#JD1;j9>4WWQEg+FB~$--P6N3N;Sk_MKIh@-dTQU-QsG{0p$R%|(Ih_VLCQ5nlA${QG5%Ip~^;}PUc z|IR~?tipiZK!O3M0f%9}V$*ANyn&+cJoFArp94wje)iXsM~qq!Q@T9CDVsy>H(%O z)Z6SjlH9>SM+1Ef^fl1QKxYHp40Jcph4Qqi*ik`rH89WS7-e(N7=uxp?L7?iG-!1~ z^fn+j5i|(l=2|;_i5|MfF1Hh-<3){DqMw2O1_l}!WMF`S1s(0vdfS7JxC`gwX^6tA zVR3^E4538JA}C*ayz|ggYlbApa04R@{9xcm10xNLGBC-&WCNoqcMS70$^-*r4UFRf zA>$3u_YSH)kDxrf(e^WA#1*fNJ}b}{kl6;lH!#Nl4XF6M+CC zsbOHgfu9X5rc2|iSZH7oRg+D2>INUw-27~Ge}kRAZv0|kiGih5KB=6v6q7Rvirb|T z_JwuLk1zDqW@;9((!eSM>kOHy8K*XtpWNbLfs>Djr6IAI%=r5iayq~qqi*s zzjA6U-DQ4FppF;H_e};iQ)%pI+rrv#Y0_3IflHIN8Q9K1yu-jwi+52?v3L)|UIY6q z%YKFf1`b-5k8hF>TjOwkqXNu)ln$6;JH~pP^#nzmlIV6EJ+z-<%W2mCy$hVVz*7US4ZJb%%)snM_Lr>BSzoYjSP@5d+FnsUGQVZ}djlUB-ciYEWY66t zK82lUISg6KeT=8Q{A>&v2rz6r5f`L(vP=A~6>(t$5o!(2rlC_r*_ZYz-6dY3i=tLE zhI}z-26VcL7}CXH7>H5oHL|CP;iG|12EG{hYT&bhtqtw8m0pu(_p&quaWT`9e(nD` zQ^k;)Eo6LgtP*KjIzoduGfWH_V#sd!eiK9H7_zW4BWtD@N;I-d%hF_JXEt`yiD=(e zv(u1Qju>*XSFRWaHHga-LvD6H=Iuzh9jJSlqMx&D9OfBF>GHEM~OzkD7i|#!w}Osxh>Pp=Au!Vkp--z7Z=y^%y)c)L>`L7#djiS~1jSuEScFwVvhs|LFSi zc$=y>?me96d(J-RTtX#9Dh=H0j;8Bo-$)tKh=e8;QIyP*S<)nhlBv+3K?+f%gfuA) zl;+Za%f06DoU`|Nzxz3z-`o4g>$5-K&v!lRSqfYs;uPdgs{jaJg!Sf=Y(|0+UcsKXF|p<4_%*-Zd$xSv4>)J z#c4a;Os6*{(W{;&c#mm7A@YIkne|-QGS~?xm|HZZVRgQNywcEnaCI> zq;Ep{C1g-S26Ofka(6-oB;=m|c-UVXW*oj(`9Q^t1NSLksl5+L$k2ogV|csSj66FU zp0zU~AtP0Oe?rDyEzg9(|;WJt(U33*6` zQxfv9l0SF4k0j*Lggl|e#}wI?GxE6dsfzuEluTg!1x&+@00%ut-E7;n_#86~q6 z4-O96&Q8djgv?FIyo9Vu$U6y{pOEJg@>)V(PssBLS-@FPeJU?h@}lA*#TV2`R%HT6 z@^V5JXZ2rE@@h72OSJfALf%Tq8(E#DN*+>YmMLG(XlQYT7T;D}sYv^Ca$CHckktv< z$PHYDYZTWdmVKb)q)zCE%2~T!$%cef-xZ|UCT{)-`8*+;6Y@z` z=QAarD$>JD!hDgCFB9^$3OO}w%VSGIzRL0jyWDS-yZ08dYHLEaCFDD%ZbD*7i6>=y zLVifdUkUj;5u90mOvrCa$bVAuv*Is`zb5z>s9aY4o{&EhvLhkf7XHlY|Db0a*8Y=_ zo!mbYl1j)f-AVQ)q%tA9l~-iUbFk4w(~LlH^~Yl~zeaJZ< z+Ur$Q2gQy_xgsf@l5%BIzDmm1Nx3R1S0`mAnXb5eRIr4M7C z&h3(vo0D=&Qo1JP`lNJIVfUo;P;!GJU&~Unr}CSU!iV8ECS_6oK)8Hi@KEU1q&(Cw z@3y4yGlpKuS$z58;41X?q};(C>*Vp^=VW&#gNyb7ihYyPFDXBIxpyVy?xgfj3Lm<% zNKIbE_P8o9IX`%ZdrwmM^%u!~Ng0%sN0P#Ktb>y>Bq`&PGCnColQN76c85JW8N84k zo)o@4AEkUmQbsZq8=F&pe=_*Kh~xpaKD;l3y>_|e6OuA9DLv21o1By? z-qg3YC#gO=eNc%U&V48=nWE%j#c0FeTZ>1N@>sU^@uW;u{zO(XP05oE-$nLL6`BO z^GH&TX8AEC#}!W~o=i$2TboppN{W}2_&f_Je|q5m?UXjHl-Sy1NKq7_IDeJFD=sG` z(UeRuFwsCPCGnIDOv!z!kdu-NQ*u#Cs->iQN={K>t(2Uak_FWYYADuB1y5sGJS`=s zr(|8Fc|j`JBKS!L<+W3M*cBA(q$Itm&-MLJUvvl=VUPf0;a3R6;) zk~>vWoRX51+?0}^@6BtH5|p?glIAICk&^Bm@=8-umXeE8(o&0*@bl@9 z_T;h^zlLp<3ciVT6?bWVw$?7Xrld_uE>+$(B^^_8MM^G9$>piw`3A?uqn*~aSL~pe z8FHtTT$vKdaJ@4Q^B`t zJ(PbL=9l*QJyXK(he>FY+w9F+b&KMyDe0Ax+fp*MPpEe)_$WPEJMZ?C+`$Z~oyUWp z)AUg}U!SqIueR!!3O4P#6z^8-pOOJ7Ic>Llj}{*u66|$+uFD>|C9(TW--r)md$3??RKAKdZ_%YrY+j+ zcIT+D^KN&3N}fx}qLjRl;(rt?{dT(xIrUu%7I0amflq^Zf8!7$=sqTuDEKSLqDOski*6nt` z-R)NFcHd%?+!o2*?s9dEqpn#I7<^mRRw_0gT=s5CR;T0xF3gnV3@KZa65bZAP04#) z5fyH?3YP}oS0Uy1Rk$B=wWj2wlx#}LlnQr4N;anC#R_+3lNK!UE`YeE!u>cUpQPka zlNRJ(R=7J<_<2e;b9JO-Yf8S*+OISSUn<|Cn5b~s>g$xyAdhd9oU+H=mXh!2>U%AI zNy+yNls5cH@rRWBsN{k@!955=%D__dXU_N@m*iKDZnryTNZD^psv%{a_qaP!@@Gow zd2+TVf2HJa?w?FWPyR{C&XgQY$+48|O3Ch&>`%!7=1EHSq-6S#vZ|EqRcka@spQT* z?#Mmv)IIJ#Rd{KS`|O(1clNjk*~K3BFbAda-@M1A@Q4cQMw_$hI9G9nn@Wk7k`pO8 znd1NazpZjV`Oi#-9x`r1-l{fDdBM`SfW=DpB2P~2buXm< zm2R_Er5E%Hu_~8E-a2(I$n%85r&r{S)svQ$ZlNbdo|Jmh(vxCON<3-mNi$DgZ_?uW zZgvy(^P0-Q&*q-+U|3pckG(71QI#%>3}Bfjtr!GPF4n3iD}yCd?#aY8rRO$kafv4{ zSGwek*qTcBQcv1a&6BG2~4FR=GSlxFP_xNYq-OxUFgm${W$~}8uVD^4(-f3UZ z-Dpq7crxCT3G|kl``odfjPvA?eJ(8%U*6|V)Z*9s+@1RZ$(nucWKSOQWR53uJ(=Rk z!=60FoTr*6k1`tj-D#er_PLLFGL`wf-+f$*8@D#5@Ci@y_PZ2bw%;AT-+j{KpJR1d zHN%sco;<6XPkXZD+s3mP+x_k{%2}iiHP`7e+mmhk-HQG0JWu9(ve1)7o;;^*tpo1! zbZMnQW%31T|Fi?{3!cydkC!}okt^bW+x~z{PbhhrQ+XgDuX^&DCtrK=4fC1(da_<^ zzTwGIPu}t5T@Brv9{)1DEcfIs4J_wk$N_hSCvSW5`~i2BCo6SA8R16`xSUxkkP}yP zrF-(edb09>`<^Fj)&AxKE+g}|;s>6rQw4_TLyv!;%;iCa4HSCvkyd@ey@>n9L3fiU zA1fhmc+mZftNx(7nX90x^z&@ox*v2Iy)U%*CDZbtyG8j|oGh*S)|0KCRC-dysCx1p z_i8S*{qFakZ1?0BPkv=0dAvCd=JaQE;3vlXU=ZF+0O=l!zj^YzCx5DO2J;VQpoVvc zHlc(8Uvtpqy!_2mfOfG{vBHyGp6ph>^Q3(AjknICe=`yFxj%Nvec1I5yX>Xb5jX!xFeo19`*M*l4Sl)5=dWws3l%qP zYfRqbh}&&s**&V9#~yuY;!9Is@_i}rrP$}sFx^65s7#-We3^9QU!U2eLE_D~zFgu}cE{#}SC?{{I6#hcfG_v>GS8R!zTE4} zKwloB^S<2Y%OGFw_hpnX%*nyN4E1H0FGGAOJr>OSwa45$kGaEr8R5%F_3fOkjUPDX za!_=SLw>-Q(Y{RZWuh-*d>QM@IA6xIyCd$5V{YZ>vL(lY%$Yx|Y}=S1Z6^8hpf8-e z$v(ePcYin*R54@eFh}&TFOT>#!B)$)JGB)j zkr7~cpY!E;Uq0|h^<{-GZ~OADFRN9uQgM~f4<-Xm zo{`^C342+?Jk*oIdp^Hrbe$6}kvcryR~??IKlEk2FQ3uc33r1pzie&1$(N6P+33qh zzFc_1z2t=3?S%VHs}}d1a6jSva>ys#M^3l{TD4&9soNTVb;A9e`-57baQ6v!i!Wa> z8PalpTE6z>8}1TmIWH~WGMK)c@a3d0+kE+sUU9N~`QDf9zWnLSU%vd{%a3%!mtQ#| zZks0phkxeGo(!%TSY!aVk1hMnmmN&GlkV?6zZ-Geopk@8k+EerpLD05bQho0)0{7R zeE!)q`Nx-?zU=a4w=Wg6$x9AZ;F*z}2hZ=79P-x2`+V82q)L(JZl1X)=fRUp@5<6c zz8vM+tSsem*q0+d-%z`UPP!S%F|9hTndT(igfB^M#c4SuEh%3-Zry2#rp4z5m2ksp z8If>5eV{Dui;)f_mn2*>Emm4cc-TrpilPX`?g=-NmT8Hg)7KL2ri2?yOHP`v9^81E zZ$n(VM9bAw!Xnjbq@`wB&Pq$&G~WxjwbF80T24>%Su|e?xNVXyg(S7pGPPBUGt$yM z=?+S|b+mY7K1>OaMxFoTEajHQ-p%a$Q!+(~_5#aXZRhNV@rHX{>z4*fL5wPHtXrS!q$4Pcq$P(ruEK zElIaHEfcmiE=luQpG$eolzUOiZJw4EY5tjRxi~GQT6OTP(v}=@%4Jp)Tc_MsX>rq1 zo|akr?gy|=IuQ1paaX_EGxY_E!U`pYqe84Oq*2hl9sM%>6?~* zX}LZv-O_SPT5e6t4UA`6dZy(@)$frOj)Ly7-(OPhO=)2?c-)-k&8%B@Y*~)yvPhe~ z(!Bq2Z%+%mzKuhe+?>Tb($YIEeHatZWwGl+&F@ss;tvy>-<6iT(=s?ML(hADWio+UYPw?$395?g-^$y&w*w((*uB-bu^5 z3{+aiq-8-`7N%t^XE`lTFo)AJp5aZ)!y2fGinRQol1XWP7aepoIV*oCEmM^9YJ_qg zk7)7Hv^tGy*jZu2Y8P<@M~IrOUv)v>(a6( zEql|lL-qej%T6x;wEUHp2h;A~>EPyWb~^B%#U*KXS6X(fCWY*mM}-#Y0^$K$mHGK2HREbZ_9{U-Qz;|6lVA1Ev-&MM`WXAw@9&CE;vs z#DJr`-rhVa#|`8dsBYjC1H031HLaTaab9(!oW&a2>4XV+E2rf(GRo<|sRp+Fombny z83s->&~{SZ=>}F#%V|W)0 z1NYHdE4x2)rbga91_l`5SLMxH1wX;NSDoRnvG~FBAOo)qG=>@&W?-;^A?ov+M)^%Q z}B@Iy!#D|GBCyfKdNWf4;Y}qDT^A9HbCTu?i-urk2UaA zOM9Gw@oJ5~N9HlVcHSfd4>CCod}m;?j%5myIS56tj(G5;!z0S)7?`W%QKnP(+{X;? zD~`tvOf~R?@@WQUDS4888JNzaedA{g@LPfz24)(#aZ>Qr8NXh5+5kUJ2#9`Z@T}_a zbGX?C4(V5m?025_^@4%-_{xU(7;9m9~oG0fZq-B zph4mW1N`t<275m;$KI+%Hs>&}o*VSY*nY1eJ>A51C6xT2H z1A7eY)oA}=;7%;)z7GX)y}ACqLvCzHF27fOaw9tjC^eqXPBsC;!G1~nP|z5Ow=`l#Z{YF&nM6QWE6X%*Z&%^~LE;NIjY+&MiGgxJu^q=`D*PP(%(~GoG*jF^({3=wW?wDTW@%Q3 z4qR-am5DoS^tR!eC^yl`!j%>-G11z@J0{*W(ZWhQQC6O~+U;z|=& znP{iQ_6)@ggPI*obTq;5uCGuzC7qP~Hq*G;#5KxqF>$Su9*Wl~QnRy(E+)pk*0`(U z^@`mTZ!pna$#J8c2X(05)5MM1_NJ_bo0TlsX54C`7iVE@;1ZA9Ow?2NdYkBDVz`MB zChj!RSM`UO=%?f^6L*`qXuQqo?yr*jObk*oK=B?E_bQ>yfhIQMVv@mG$yrYa-EpME zp(ci9<@0A4BTd|IVv31}O^h<}fL1+dVzh}dCMKGAQr#QNCGfN{PHRcVXDv)nlCeBV z`G}dugfADCEY;zN~eHt~gt^(HoO zu1$QT!p}|cRLf3zY%=k&iBRVP9-o-_G|N9T@$8SK6#h6Ph}f6fkoug#Em{6m*28br z;C2%~nAmD!n~CqTGx)tK)ALMf{b=GR6Th1Hja!fgjW&N)onNwE{mzwcq9WVN4ikTx z_)CkKCV!jwhe_VKfNhy$JC(DzOUZ6UemStm#DR+3z1pxcYmHgApK=qX1R4J)y-34UCi$&xFtYKda9m8x}bBbrt_c+qNJU zU?F4$n-aU=h{DRF7Gf46${j^24Al_DwRnbw91GPfRA+O&UaFYz28!n^USQ!u zC2bd$Qmv8l=0pp*7XNlC8e73$%GoKfkgv7>%lSeJMI6zd++qtQN}5<`ri8+#N=ld8 zEtlIYmRe|Op`6>hg)$2lTX5;WE+Q_ORu-70bRe^haF!WZ?jDq6blPawmnyckaG8=o zUr9T~_KF=8J1Smb1*?E+S6R5)LY0MmD!<0UL<^HFTx;Pv3!N==v2cfl-WIxAxL$R7 zS?Ffr1`9W9kw&^(=%JiWGBYXZsl^*D+@yqwL?J!D#lo%GRvgQ1RSN(f z3&Smpu+Y~+KMVI*xYr8K5uD$XN%!{xpT}4jYyIC9Jx;6WIjhDipJ0JI35yR}m~3IAg^w&e zWMPVhr54__@UVqPEKIjBL-ilEFjWbgJf`Gv3-i_B6V|`ynrS3j^;A}q6&$;uJKd1P-PCcub01GWFvhafHXSVu`Cwpfa zFR75H>BY=*<*!;;qU1Hj*A@S_W4vMgyZ63jVHx*u3u{$jxrG%n_wSyXSMgY_jk%myCs9 zEqr3(Qw!f{lh4$>uatkT>9kq-7Z$#>uthn${ZEbMV<~A zs0z)HJu0cEIa8^;D0?-v--2T!YU6;)4_Y{6;jnVk4tC}v%8yz&rsTMVl#&yQCl#rd zu#i;#(Zmpoo^n51n^t0|!LHi1rQB8w*$^dA3@b(y4{i-sO3X&wMiU!NZRFUfW}|_P z^KDeOaf*%8ZPZrf8j7bX*0fPeNoLbKO*u`?pJAM#{7f5X*{GA1XRg`m+NiIRdWvUf zYZ=LNviw{n=P70`9xkwvYa>r37uvWetJzRVBm3X$)y6jRZIr06K#}_oT`E*wWCxFl zSS;2eH$dhFcd%wQn%n4U<3`GDl-g)x<5JaWX`_`AwklI{u_DLf+9+3kiDGL-j)FG1 z0k*YqnT^gix~Tke8|`g$u+ffbpgv@x(b2{=su0`)*yv;j=dUXjuTo_3Y9$>Hw4e{y z+QI4gI&ISNQJa#kHg3@3^@`mTxmU1?M|UmuP^51+DY-?FwKpr_Dd1Kcy_9orxlKuM z3dq*>v2mx3wjo>=LSGyGRDRILT{iAk{;7@rHU`+3VPmF^du-fmW4w(CHU`?b&&F^Y zBUE#cjUh?~D`s{ouA`wghS|YcHFKppQfo)qc)-T}%IPir9Ibqe{qLU45m7$Y#<;8w zBR|o`BpXlIm}cWal|PcLoowSF(O9AumfLv4#!~y=ix$e?RQX#r zmSy|m(pZt@91C?;X>qNMcWk_CW3?6;c2=#?Bz!Ns&=}|UZG2#3o$72-{4kr_>$SMS z#zq?-F(5yd@&w0=e4gMw)>)>(Pq;a#<pb<-y0~W&lj2H?DWDAE(!&=ISoT-oVCzMNv>jE2>-kG$Pb|)t5c|?D1>4q zC5rFs#aOctnrpEQF@(|(E)JoUN}8`VS}I}JWlA!aBChh*A(X50muNAQ02#M04gLF6 zfl<0Vgmxjk7sA>Q+K12~gqKynV+dD-@IVNoL+BL3mE2uJ=oi9OAzU584Iy+7;hGSx zRpsjy8Jz2sbXKHSU6gcHWMAE~a=OtYgq|Vv3gNa8ZdCbAA>7Q!^8rf(a~8WRgn=R47sB0I+dqT>O702a-cYc2Wun2= z#}nBgt>RSPAHv`ehJ-LQgkcPz%7-gv&exfhGBOnG7#Rzrw3hucyT*htHiTzFm=(gf z5XOh_Xb6vmFd>AAAv~m-lR|h<3Fm9Fjx=M35zAauPtn?kLwH09JL0wLq+L-;d< zze3m$!p0E34`F)QncnXOPkTNKAu~0M-WMT!8Nzp}z+Se5 z@KrWTsr)q;uP)ecDAe5GtZh}YO>tM##x%lA`yqrML-<|o{G|A6*5=Pje#v&qUVh^S zrF+^RA?(QV|7FYHAykG?6~aFu?9{z(R|pj$>Qd(;XY<|(7?aL1# ztx+;0I7gU@^Yuz2BoF}vVHGl?GTT=~i%~^KF>}6%DUU1C0a~jrI7M)VppKx1%4;gp zTV9CPQqJg|DmYC!o18AFt-OowCue4K6f-c)d@63Uwink#RSm6QrvDlf}QE>_Y?;3_FsyhO3JVjD$T zt5eNttNgO8TSO8M1_*JS0f3Y&jE@j5|gm2^?;s(5`? zr<;-+6uT?-5cE`Xqay9!q~vD7ElO@x?3Jy(O|a;V=2T0k|3#JMl(1xRRayh?al#HdOlJQyj1SJy{Cn-LtI9c$Jk|~O`@UY;K zEPqtVV~YG=VoNp#p?*RzIhK3Xx*(CB5=xUcs$Zjfk`}U$Aw6{oMfjIR?!v-*`su^MVC}g$z5F0MGzim9;>v~JBr%|*lRds<@GplPLT4Nzz2eLf=d1XMew0uz2IZ5 z+924d5oqog9MIyy;LorHl0%Az6^|%VcvQ(T#pA)>>VHEhZIH!7sXkS{}ZVv?4$7p@dEN;Ge_>Lc#X`uVx&58=#&rqzR$WG4$&Qe}i@qhDjwifFvo&%h#gbRdC z&Ic|4h5$o>3xSKY>T;kVz;tzia-b2A3*-Tffo4E+1m}W$pa>`i3V=d@NzU2ldSSws z08Id{l%@#QDHjV5F3ijlXaSTWI7e`bTLNXk#Xu_r+g)ax`k+$@*EM~kP3}&Y0Bp#k zEzp`iaNk~6(gwIxU8N^%bs50LPKQ}+2ebz|03FrO8-Xi;P6&2ac1ndSf$l&Lngy;_ zPgr%04&hqhI-oPq1-L=&cLlBo-mEgaF+QyeIXWt{M-GR(76(W_dn!`MT8@_z_Hq+& zvpR5#*4_&A0&W9t2kueH9YAlOA8;4Y2e=dHt9=C?b_wj$8oQvuyMg||00g@|ePD1H z8HSqUWhm|i1_Jj1KMk-40fVV&mX9;b=_i#LOezoKbO4V6j{zfqkpPWM)*;^yi~+_f zAEo#JFj^;$4LO!^z<8P!JP1rcuvbq~|5-Ir)#z$wwbE7YMGt96xvfo6@~{TskxUS( z8a)n71r`E}fG2=yz&x#@*(ZUSOatI4U^=I!Zov$#;y}pR-7|C#m<`MUp4F^i1h~^u zfpMS$Q)n)?%}ymG#QDH;!1K&xZvI)Hxnncgm{$zo3-lj&8F(>U%dsq0{wnYq@QQM# z=m_rrz!G37lL2@G;8}o!Wj1D}=`COxI|5b!%mjv)F8yzs=+E20N?;Z64)89pS}p(A z&Ki}lEvN5&j)LwyhigJI-#EZ)e#0;enA1bhta0R99%;Zp5b zyjAg2#m^K!2Q~v=0O>1AzE#PWToje&7AE1U;;&TlHKS2wexs@Wd8K*X$0g75|E%g* zyiIGr1HK2kbt>7;fK-{3{{Z}`lAnNIRfn}dtK=8ODMi+AoYuPvsr)-ouT#k%+2UWo z-@pmrB=C>6-KV%yahKw5#R|neihC6+6{{2%Hfu@a`;{M1JO~^D4lA;jqd21Sql(8A zk249iA!`#VsjiVs0x7@)d>}_9X@1ceh8;#I43kq(GtUZxk9Ul_3YmUG&n}>lMG3ASJCy0UZj3&ux z+KQyM>YNcqoiNT+-XM(g!#GQMUB!BeXNOTgjB^yZ%Gk@f;b0Y?r?sr23i%O!?-Doo5Q#zjN4R)LuQWM8b&V-`(NAgpWM-iQM#Q|8ODLi zU>oQDKvR9fxKo?-4dd=Gw(bfB)lVgNDRv)J&_9d;VcZkOyQG^#)UCHj7ecU7{-J!CUVw_t@#x;w>Y{@mze64!@-IxtZp?fvgiZd zo}y+SR(vFk4~wj~(!r=74`XT=Ga{H7!4qLj3**-ng&iVzGK{B~y%E%nU^*4TsMNMI z!+1K3&0%~I#xr5e3ggW%-U{PctzE1*JB&GD%nf5+7z7%znJVmR0jDSSDMmpH|pO6V%LsV=%UUr}qXhVfb$uZOWDjHN1h zgOSt#-l=LF^4+?AmxZxBjE_}kh2lEJx5HQ&#;P#h31h8F-VI}Q7;D0K@Bi=N`>Odt z7<7hS(a8^0vObIrVQdWJqcAq9gd_T&KO83YKT-Loik~TduEnXEXc1>i?+tQy4#oK{eJgC8+sp7{7(_ zyVmYf{6ld^7=MQGR~UbX@lO~#|Nr)PtA2&zo-p?QzxJ!b*cZlrE}}3ZkzgM?sG4cT zLtz{a<471s!|+scjG+$WWEcrXevi%F>_ixs@3EQWT%_E@x))hY{$v;_-O8BEwCQWx zr**uB_F_h0MPNq|iXg0#rA3w~K?F>4S_`gcb~GBM7Muv85yVvCRK>VrP6X8=s2;&7 z5!8sFX5|0z>VN*!iXh|3Y1-=a2x>=gMg(;tI8!D6?LE_Dy$H^ZphX0w5!8?1oCpe3 z^V|r|i=a^ixoWdP1m{O^K_pnYlRWc)ZCn_^MG-XQdfd^7W9Pw5J2Un?Hi>}qo*xNL zNt|E)l_4I(iY*EYBPfcXID(Q0nnci){T2u7i0gt^p)hvSM>ISbdxLZ=vQi~*) zMNk&O#SyfMz>T0hf=jd)p7@wcwBI^{HW6GJL0iUrUIATVkm(z{pfz@pF?hKeY^T^h zg2#5{bIEgu=@`Kk5p;^+$_TECU~&WxMR0Wl*FiA2Go%gl!t7#FrF?h!%H2yTpETC~Yu9gA*?;N}Q! zVPDk?Zrz%H8vo1tiV~^~o7t?#%x2%uwrFkW=;FuB@;f5v9l@{&hO@7Q`F$ej7r|Z1 z?^Ns?!T1)!s=Fij<(I;H6-oLl84$reN>-m+MBzZ?_bCoi9IQBmv$igOsPg`=HlgN- z2u4P*b6Mf|2=0$yR0LxqSbc8s0}+glU`zyu*B6CyiweKYA6`&$#ZQF`oMy8wDtYRZ zqHz%{db{YHKJEl zmI%IzU}*$zG9My%H-fjQW|l9DV7X?<2WB}ZdPM{)BluvG`?d7@)7*{UDHn@c#pe^(`?tl!VM9uWm;CXdSCH_2-eZg*8C46Sg(Yfwc{H#A))?8 zhARS+O^P2Y4y)Ial20S}EP~G?*c`zZ5qufJAD=b7VQdrnw%sh>*SDDD#)SpMuOs*- zf&*NkTS~r-U~2?FM(|Sv+qf3Wnrx5YwZ6^1zbXG}Y17}8{K4(ZDrfCqTHHx*Bluf6h5tnG!uBR4 z_YH1F%(co%_C&BZf~pAiajE`kRWkTXo071Kq>WX+pX5_0guF56S?N05%daDr6AN&JIHZRO)X^F^0Z#v z!6^=EIXG3@vUv?BaHgiJ(GCx0_zFF(ldzcSqP8lW;h>I#2Y1_an{L!~P|v~pF?

    $VSlXV+hSWD0Mm@J6_hMx^j@UfEoKW{pZ=bPAt~zUGh`lfu^{y)UWBKg$!xia0KX z%^icZFH$&iNRfPzlT-LUw+^XNht;Ckn??_&vqjjAL~Q zYf_lS@usjKg@q~n$^DYTUn%^}-CaFvP70R~tCC05(!*-^Vf7Dp-w`!8g?TCbo5FvR z?07^CJff(-aYRjuW_)=>&1aoQ6v?V1YEcTyc)Uovi@7gSSV}vr4joaqj;P3YS?~GN z+f>XddsMC9V2`SmDP)fct`gqqs9KxCItFbD`%_q-!iE&Krm!uAjVWwOVG9@fsOooA zZRVCas&wI_M`lp`@u=FK!VYfL6m~Ptp9sEkv(-)>3pZOWII28;RPABbVYN4fD@PTR zup858V&OdUyK?3iF|R0i>A3dd4->6lu5uho!a>hojj zL<%QUIK{)CGsX&2IK#s~g^MX%;*=g!=Xegtz|Tu^W}PgG>=kj{F?IZy;<}_AS63Nw zY%ztqDO^wChV=Xv7nJY(kE_nd)qvwFy$P$dK_oltlB2KV0bmo`ww07=sms>caMQun6+m23X;1}Ye+XyBC-iuTS4HRHCQ zq>6#62I?57YhdCDRm}kP+6Jl{s9~U{fdwZN^;!nDpHSr4H~dWQsS~_-Le(=+-#{Y+ z&z@8b43s#j?mMX(vi~Pl$CIk*H9tvX1HMuL^Q8Lhr1BZ?8weR_V<2E4XrQHmRt7Q* zG&OMaq-xG&h0JCKR-aV0Zun=OR7|#zEav7v<<*&KAlpD|16eF}%}=X(O0_(tdYn?P zoKlJdJf+?|rP>;3XW$_Noei`%@XaZ8zkvq~Ja)#^y<=Mx5A6!MyZ*9{CZ@RB57Ht?#DR|IQF zan{i0Id3?F4MauP1j7a*ocTPT9ztT06&Eag(VrB;vbuqka6@obAFq?P0mneXMbd?9 zAcxUnVTXkw2Hr66m5HxS3^nj3gV01p6K@%K+rU}_>kPcZsWULezz+t78F}48Q6bDkxZ84_mX?(j9S(t^HSGr>OXR`8<=C@F9XvIOy>!2;5W{|Sv7-K3@-YA zHt-XJ|Ezlata|ONBKbx7M)JFXnFjvk4otuU~X!Fg6)I;&Q3dJU{G@bEdstP1DUs_`v@=M-9Y z$iQX;TMXBe>gJGdfZEXZf5k(aU4`kzxoD!X}t8Q3Szdj$1!YQK;Jf+M9x zdd@hf4jVXP;DUjRJSYqt;~p_^#=vm{Ck&i4aEe1?@pFoJSC9oOp7)Yxc?z9Z=M0>e zYCE4-&z<+i@`m6g1D6e4H*mwi6~@x6?5hT@aq~(pkqVuOH$^0p)0lO~z+Il1R|=$?fXQbCqM(UFCeEB!G*(;Wf@*ldBP>{H)Nh+DBY@)x30Vb-L zsA?kHL~9e(OjI`!G?8JVhKZUc8k%TiqLzu;ChD6QaY51Qn5b)_o+SCyo+;8UYyPoh zfVmA!@8LdkFQ~>Q?la*x;V#K)Vq)6`6VenQnRwN#FK;$%0$RSR}3^tth0%SSzAl**(Egnq9Q*(E4zynUpp?y zcK$H_?MbzU2MjfBHqW_@W|zl6^4ojETM`o;K0TL~j#)OzgPm zE$-Ees>~%t?z^NqTvE$w1^Stw_^b&MCUg71+~-UTG?6l4aP2Os=S{p~;#F_9)e9zG zG%?7;OOkw9aQG!YT*6qfoQcm&e9o}!>aA>>D_-kgnD~;b zb43xU)0xPu@g}}uAX#WQlaH$@t(SWoA}4%--ofp#J^lq6Z1_h5VyI4^8{;N^@f~zRV_5J z$ON-Us62U9MI~$4RkhT_&f0+$j6D;}O-#7z-TCmZt7^+tMSZ3Ck8coIV`8m|qb81- zSZ89riCrdko7iAtBV)YhE`-_s$~U!L#L>+9^mv zkw|@yiM=Kcm^dgc?lZBUb6z#TvftGW66teDN*y+FM6$B3c}?uA>%GR295->o#03)< zO`PP(a7~?IRG2tr;hozJm*Cf;D3+()7ipDP`>Wa6@kYbLIX{}yC-LJY6kRwQ!H5W}uLT!WPmj zUe?1k0^;WbAGl1vL(7L2~( zvsznN^Qd<+bP-PyCfoc!VtWhsTX@&PFbfY@=wRVF3j-~5w9v^yFLtSR;6V!yS$NDs z4-1_wJby!VvCx$ZVc`*J$dt-|?-$^di6%8k>IHLQe}%S-5*c zExnpr5qZ>ZUhvCP@ZxN^dIa zT}6D}!V4CX7IX_QS{Nk$nuV7vylmlh3xh4ZV&PTMUlaVWY=AcKrWztOux2`ZbyE?; z79tj+7Gex13kmU`BW@dSs#8J=-|{;1b^Soff@8t8U|29M@a?o^fx2yB%D3Js@cnkJ zTPlZd{w)l(@TLX6C2o65@!j$p&_*Ht?XZu+qY6?j{SXxE=1O&zfZrX)`MZh-*b$Cu3pOK*`!@VUvZe98vkeX2!rB zwM97lMukSQP4u}lvzfco!Y*!q2hAPqwy=k5ZQ~;wdoAqa?Ad5$W50z1Jo;>YQounA zhb-K*aEk{Qj|&UuES$G+)WR_fr!1W2vffe0Eu64$Qu=nRRN#+0iU&KJX4V-CXLn_L zD7n=6a=@$$7A{)2V&STVOJWNHnU}?fgbr)&sG|EbuUWWm;Rfe3Ph=MD?|qrKE!?pH z8wG6Km4azD^4Z>rdQXz4?x?<({rPRA+sJ>{>kpH}DtA>u8-;8Xvr*heVH-tk6t&Uq zu4;N$5nmGLcLYn=C~2dVIIt|Uz80OF4rOhWvr)%JT^r?XRIpLaMs*t%rMAj8s@SMx zW9D78>aIF;SFxTucNLRW>2pstyQgZ{=yFfhvhm41Rnx}6dtN`ydx}Y+$3Ijr(jgvGIES%tq|MeVL5~S&%m6p7Plk&^VL2U&y?B>gS+0r9r77gUfwS z-I0cx+h}3q85@0Vw6xL6#=|xqv5{#b%SL+}_e&qLZ73Td8?7bDs;Z}jh;3}Nwb4#Q z``G~P|7Ja4ql1lyY;=~~jy5{kc+kc#v%S}D+RKeSXC_xH@=h~4kaw}s)y5Mxo|IDE zY;?Ern2ksC+RaJ}^|0}{C_QcTkZuf43k?^--eSXN&!8JZmFm!?4kx6J_HyPN|LOxC%C2v@yuW^Lg#QAf#ZvP`!L!*_Uj*Y~vLh zuW|Hlz>4_iUWb7ivGDAb4<4YS~N!iZ?$J+Q@NWJ{toQ$*a1w%;q6Zu0FzqT>n z#stnx{t)fS`hjQ42ELIb{U-_;E?M7kDW$4kYuXew6Q&ZXsYB+$shVx z>SytC{>&LR)|5;C$;QvN_Z!{I98r3RNIs%>;8z>J+4!A%Q_9W~td}0@nEt;Nd^SBa z+r}IlYi+Ev@t2LiZ7jC2gmY`-UmNpm%(wBM6!d1;hACxvRx`Q4#zIb4dT5b2xD^8A z)Eigw$Wj~2Y^=&FyWGYK8!II_H9a(7p0`IxCY1=R<|u5CQ#lj#)_1*)4K{Y$*kfZO z7tzL68{2Gb<`MLlS8xk!OAj4N5ABlo$=hx0u(8v|t~>{3(T$ddPz8jDdu{BqaY#C_ z-^KyH3h?lkWDuc;@jri(!y-N}$}tbUUPL@Wfyf& z%s~wYHAOG(psa&(4oWyE>7bN@(hkZvcr2gi|5$<0Yf@XIE8fdWc?T67RCZ8B%2sqx z$-%e%1JVATGjUjfP*n%j9P}O#sO}(q-7EF0)If5kOrVy7+722yXv}^(sOz8sm4aS} z>p7_JU`2rtjme`0LMRw&=zz#%`+}kSq*1?vfP*Fue3G2k$P1Xh1w%nmG8{A&Jtd_+ zAr=ggw{XzX!FmT99JF$f>EJyF?>oriEIAn9;5i4a9ViEnIOyUaA-UEf`bc||H2SSZA*oI;_BXS3K1w(>fMDOv0T?e%Jbh=ZtuqyybS%t72i zLORUcW%IH>FBHnf?`sEA;y^SUP|U4?y6wPmFx0`D4qOME$st^q#u+&dW)=#qEEFPt z!$HG^X$K31IG=Ahc-uj+aOhnJHw%T{aX>PRfm%33k(NsyEFAj4!EgsZJNU)HhYmh+ z@U?^S4(=Vw9^qiLgE0<1cJPUVzJ)`dIvD9-l;r02Em1hsBNU|bXAVAh@C75kaOlIr zp|RY6g+t>cnd?dYO9x-cz}FY{7V%i&&^HbyP;oHT!9)j>987lbJxht(@AU)UIk;Om zL{hVeSA=AWgC87_&{Uo{jd4;WG(&K@pj9L^sz`|9Pf``huMU25@SlUZxs`LV9Q-MK zrr<2WlMOOvJDB6(ZwLQy6b_bD572T)@l%n|zmiLZgd)j22lMIXV5ukzxCI>SDH8hZ zY}P{ZBB70^vldI%{MWqKh-D6zJ6PplHKX^rzzPSKi-cB+0||{jYaFZ@ zy-3jzzqi`xU=xoE7x%f?>|hHIIu`|9Y;~~B!5If<9c*{7!@(g3haK#6u*<<-2mAQ` zUn(q zsd5(&cS(}t|%J1=HNQpD(cM!v+@-S-Ewf-L7IzvE)Hg7++l1m6dhDA=J{k6 z3sIzz=Xa4V#@Cx3l1t3ZrE?({gY|t^gNlXRVxi(Lo-5{! zy_Ad6F3P!RRysf{Bc!a0(Zxc$swpb`c4>OCP2vYc{OQ8wGGyEQOiYr7Y$t0c2UPgT^IEv_iK5XxGbGtIH4ttJ!$BII<1il zW|b%&%5`hv!snu!i$`7fT?F_l>!OW|po{UFJ<)XEV9W%4ZvxQKP7Y`}v8%bLi?OZ(Q;vrGmyLiAw2i7A=I*%wG z>L|%hqWn1;-Sti9(J*_c&Mw3M}+*_HM@(rQKUW5FL0@NsCbD`cNdSjc)`Vs zTt^p=yXfQM85ccWJmI33i=66#Ck3B!@ic2|P ztBYsz`q`g7FX8pAw;;(t7tg!+er;Mr6ka^1!yp$gxp>vZYf^BSWWDTSLW$5TqMRuk zc-_Td7f}~67n+N(i-?PN8w6;7i~oh;!L35#E~pS`rkwM-ixeYd2(}M_LD9w398AlB z<-%qZ<)CT~9De!hVu6c=9F&V8F1}$0T)g38sEdzXd?G!0la0CteikE|G5h-!CZXR<})XqKio`esl4= zi*H?g=VF?R>Eb`x#SbK06cJ3zqt5S%CZ%T zKMOBfD#R~9X-rbDQz|sm#a~Z&V|1#ju z1m{WafBZVWRA{a!bQo1CG^13AIN!yJQlX=zLW^81c5#lA?_!CIrEJv2b{ETBEO)Wq z#Rhu1Sm|P|i)y7qt6Z#hu|_y6%wIaR`M94t`RnxpElY>ixW8N+a&g$jE>4|`eJ=L9*dqn^3Jw)dI*%(II>4iq;Z!=5>yRkr z1;ekULq}X3b#cPQNf*bY)N#SpEK)jjM`}3b;YrEoqWHL^c>`pf;lLZgOWKYm4m`LD3XI>IVhfkqEgV6&k_7U&4N@& zN=Vkt@&WSFIVh8Z@;RuGgBxW+Wphw22ShqENh2v+HdHYOm2yxy2f?zTN6UtY6mzqx z<)C^F2IoM_L5&>L%t4nNbj?An9MsN1^PK;~)OSEhQG8!7>_t=*QF6|Cc80LbEL*VT zoO3XtpnwTP1x2U3C-iifZa|VE2q>5XDnU>L5fq7L%!&voK{1P>^4)&(oA3P3sdLY* zSFc{ZdiAP$cDAP*9ph*mN0T^O$I*rk#L+B{mT??v7ilg7wTOd+RT^x4BG_N8L_$Jg z+c-iTH;#xX7sZ4BCa`I$IKXPVICz@1msafxwM68_ade8KdmKIDh{h3%qcjdBIwf)b z?jF0YP|u3y5y38Tbd94dj&AYb^keJUE0n4l1dY6MRn?-Z>KR9`IQquXFOJ?~ir7a; z<%^5_}mu8!lHIBtmJ#yGAO`E_wz zFJzM7Gt%*`s%ml^Q$%vOsw!7a)vKna#xX69o8q`Rj=}9C)8jZ7iX?UxkaHlC>qSVs zEshy+%#UM195ds%Jq|4nJ&sv%+!4p!Jl+}YYU<87<_Nhfj@g`MHFZn1z-_CVVwDPW z>1xZO`vmV5WR(hW;UsISDI<@z8@vivuq)5K2t|)vaj%S%>8v1H@E{^B9PviJIj&*Uo5XXmcd=$rv zal91APG)r+>*LrE$18EX8plT3iDNUfv4(m%j$E13D)`Fo^pKJPt)g4vs8K_)b!!~2 z(cw#rb_i~ZV>=_vEZSZ&Wl9j?q8dTmsPKje$@vA&n{m7q$H6$>iDP#hZ^yAWj(u_T z7v)Jc)E?$T4aMqyMzV%F5XZ?HYC{e6ZVgpf^M5(~ZXEB$@jeftxdqK?{_k4$K|EMl zB|3-V_&AR5<2Vt=Cvkil$JadiB&wgq@kJb8#__q7k)r>VaC+E9zM`SdcdaXgM6 zS4X~$^Ywo?7Ds$XaMuw3i^todNTy3);&)=XvkIS#<5V0!#qqO9m~5xH2Wf=<%)yyB z4CzArO$Ar&UwHV(@p~M9#PNVM{T2rcjkCJ0rus9Ev(n^U5{yU*@mw7L@OaeFRKve< z{Kq(GxI)8uu9}958ZOij-W4mS0U9c3D6gSV3;qkt|7h>7sjN*U7l^{DO(hi4AeArD z@KsG!Ny8-?o-dAEtOY*&TT@-Cp|Xa{G*l6Z-XhrAMeQP2)KcWFYN>9uR8KbZj!M7Z>HPjS>w~ z;MP0J+i7So`fR$Owjvg57*M6CRD;scNkddaOhbu=#c#$sGkUdEw6+>tTTQDSm`&GK zT{Lvn&_hE{4P_d-Y1mj>b=OezQ*b?ESzcRF@^$5+*_DfWaTRvNdTU^nLN-yMpN9S# zG8!xntzn>s$#hb~APs{xOw{-`Net0YwKzIT!)OgdH4M}6dE@AC4I?y+6#w}He}092 zPzZp4)+^50NkkAmhx z)bNr9S3{NwqhX~6PlM0Z*RVvxJPq?TEY#4Vu6nPITA<;6>3+ISu#PO3*Hw!&u!#z+ zF4gdWhKDpP*YF@$xvnBElP=^elLaXuSs}nRF}jq9nmHI&v5_&k>P8JvklA87cHIXu4TuJJ{D+U-ZoqVYwC*wmuPtrsi@ z@ly?-@wC+OpN`Kpe4*h^9e3&YlII>z5*;BOUu!tbgx67C$2S^|X!u#fFB-npa8$!d z4W~35({NnF_w-60;qsjpJm`Z%JSqd75ILXnQM*(0w1yuvoYC-;h98Af?fCJ~E27CJ zR&)5PhTk;&r=dxG^}B{YH2kgMoQ6L&yjxG5)$kXGuBXV^g~-C{Kceuj=v+`g5atwy z4~d-D(7C=U&_T{Fg*u?4rjA-VD(JXCM`azC>8PmVLLC?DsHFeTnTvGLJ(dym)g?ME z6*--!k?Hjn3rQ6nm+PpiqneH@^x!7^giZ_QBflu^>sAR(NLk_IuQX8P!^KGwYMyUa zG)l*49oOoZq+^VZvC?{#j&VB1>$sBBZ%{Hp$3z`Oc43vs!sCkvS5A1fG+o0*ms?@4 z({a6yn{?bP^2s`G&~c-VDN<$Mq#q`qs$-gt=^}iufjZqlQO-hzTXfv2W2TPVb==0R zYp7;00U9cj-00-9L~@59g)&~+qrB*YU#2TP8RYpB9a1AkIF(u|1=v7$+kGnObjI$RyL@WoBTRLJV^ zr0VOKCHlS~?YMH+-vS*=bS%|zzmA1E7UlXfuXyLPXa)4@VXTH}PI#{U8vbTBgxnh@8 z7mAVHI`-<=Cz7{y?9uU5BgI0s{UUs`kvd2Z8>s{NYWp98S-hv?eI3Vi9M|!Ijt_Nw z!NXj~w~f?CIzG|ysg6Soh4ds`c}tL9VwCUKXkOSys_d3+V6CHuj4lzzw0=mMdsWrI z6$aAs^Bh+BT&!va*vgJI4AeAG%Rp@dbqy?QSVV*K#}(Bvc>8eyuhGF^=%@93=9@Yl7DQ2j@s>++IGLcVLFNUmo(HT~a=rilCo12-C&DtzYO z!Io^$RNZ9YW&@i4;C2JE4a^a>S%P;8-XU1hRNW8CKyxHfN8)n z;2OvnungD+K5METZK|qF3byCgJfSdaz%$@;YfLJkJeZyQrs?>e_S3N{&D0A6BgCRh3)?nRlrNQ5@?{1dGVqLnXALYju)@F^18WUDY+$8< zM~vX7L#qTyRx>@CsmaY$yqRK^Lcyuw}v-Zt>6 zfvwW|hTv-kwi|d|_%^|rf0XVJLTeqH2R_$qu67#O#R(e0mp1$|$(sB+zFmTAg#|Az$@R4*`C9SVC zSDzU8lnZU(bCG}1T>T|YIR#pHVQB0t17CANGgz9zVFTY7=#WImB#v;)^Ds%EC=tBj z?x=yEc{Un2X5hGi?+koz1P}6^>=m3~p4SYYHt>UilLo4_P%Nhm{M{l<`H!MTa)#$p z3)R1cBL7LcT-QR?og4X;r)UCI6Zp-*?*{%b@Fx%L1S%wO*1%r|PE`w+OWbVff>b*%ggOO@pjUIvLeDb_%+hF~4Rnu4_w zs4b*&Oa5Cq#!@$ddLkjOpFqRByrBpi2{ulkNnWR^kY))q7t$gxZz-fz0ERC?W zL?q-Yfi4M@B`^_14@@oSn!x*e3iu4JYbzA-z1t+&sRca}=$Syj1p15Gs;LFN66l=> z9@TYbYC)d_`X+Emg(ANF`SGO@3O6l{3`k&L0)rAD{}Dxl6Bv@f{;35`rxmao7t8!* z!>|N~C-@&;H6np)WESKj6Bs4J(Sl z%C}yZ!1Xc;!!=pRlmu=Na${aTRme2K>4G;UaBWM)F1IFdTLNbi_$h%I3Cv6&n}Ci=caBl)y0y^cj!V6YK z?r0spk5Ou=;t3pSsYnc3OTd*-Clg2|kf8%L!)ZZNP?ZD^&Fp+ zeLi`c_+SFd5?GnQsstWl9C(XzmBNP;ST1~pAV;M9bd|y@*A}i$;1L;XEin;1O>2z| zH05yc3`Q23?Rg}y{6qpzCh%PX-!pUxJe|Nh+^PvYlfbhHY)RmiMDT!`=Ms34gbrU> z_xu2{=*@WF;K%i9U;%JVmcyp_Q2 zyrff=w$#}p)x8N!9~xBmGj2_So*b6Qx_MXV9vKvr)05C3a+eDc$yn+ZQOp(JYC^xxPs}o(j_f zv3U|LM9AQ%$$MEfMB^a|DL z9aM{x=)~p7pg{)FBw|T)G11jTNiujd%aA07Cec}VX%dR1B-|y5?n(3z-c_(nu$y3q z8%lZ#>77KMBzg(IyDYY+mFk;Bza$2Vq(47qv{D0-IQ~PFgl1XD2PLs_dN@0;V6dp2 zYo&%IF+7QPl6W_X5lM_p;)Wz{q^slGj1ruf#ONf(2p^lo_#`GIQEySfIFa;OR6t&R zQNf`_1wSk*V6Q8axJsI?7Nq1FA=f4`DKEJ$iR<%xGQ%aj{qu!Xo|?q8B-SPILK4$O zep?bVgxr+G%|dPwyj5`gtHGc%lej&J`;%Ch#H=LlNFtF$GKo8rxGRbKM3ZW>lekCt zoFwiR(q?NxyRCu$Y@N%L&TDc~l*E(JM4}5Cf;WB?G^LVAOLe}W$yHudkWC_!ge4N2 z`z47=O9Ev_BzHFrc+RqygrCGbk>{qs04|`zqEAzcl2|OQYm!)!#L^@lOk!CQYhV3e zoF9-@_M%N%ekh6MB3Y5-OBjRYdsvWf)>xUus$}qr4VKkH9uZ883|HoZj!(2%E1HjS zM+kW$iRY+rvJH(qDUzoIpHAW#AEG~Fa$eV&MC9yt<4Z^9j zm5G<c`}CBiQfyjU=o|Cb7{B3LFF(AvpdP!oR%~jRLZcMgq|i2n#wj!r%@(QP1Y>Jc zsWua2wYd=PzLr8-3AWC+QXUdsltNfY?(~bK&@T1A08*!YUcW;sct1@B>HU|+$0 zg8c;t2=az}PH?brl2IuP$@8H?hB2N(MhK3~w=z(pQy7!N*t}$dkZ~!D&r9g-#1yVf z;VO}|92vek1!hR@455WdDO{Jr4Jq6x3fHGFMaX19zDI^}%cbj7k=!mgErsbR+$8)q zL3)033b&+iE7v-ov9v!!T4xI8GILf6cS!Zl6lSL|CxyH678c~r%oOJ4CHDy7(MtRG z3a4=`1wDn&Q}`kUBZWi?FQo8d3ds~wDJ)E3Q3`2MHdDw58QZkL65kz!!a&ZbvQg}Fpl_@OEYc5OS0pSk{<}&%A6qZYM zg<$Tw!=_a!tQN_$DLj(GqbWQkRSvx-g|#U>Ce>UpA5Y{I_~(R?P~ z`dr@5^C_%L1t(ih^Q9Elr?5v_H>9vp$WFmcDQr$*OA0SbHJ9YH{7MS1amp#YD)Oy@ zl+&y2`K`J`gs-Qttj7O#{Tunf?n>cJX?;sD=f>_7-pENjRI)$H8_$7tIDSVT{krcian-C7 zG#aJB?a69Rp=lb;(rBGVn>3nBM>e$-(t@Vsh-j6U=lp3a)gr-AIym3hC7jpEeR6A; zM*B26&^K{_3OUj#jfrVonMRcQX_TbVIgJ5n3{0am4JAf;rO_pCty>yh^SmsL+($%O z>n_3`Y4j9QS3WLM-dn1D1pB7ZPe^~k)gK0a4oYKi8lyzQ>X0->YT&&JkJbdxa;`NTzXL8gZ#=g1R7o$!G{+Zt$$*D5*5kBFSZf znMOvcmf%Al{4bf^G_q+tD?%>~KaJICJd(z|H0GzVERBcgr?f6gV{sby3tuS6Q5cye zl8_IGWNBWWOVJ0V%5AtjFJGC)iadWf-%2~Hn3FQoM@9IA;F`SV+B60e;Qw>aX5_+)A%Tj&(p!##g2#4_)NNd zoW>{rr|+lvnB?q#A^Pm{rI4=#`FGYgX&g!8q;&i?jiW-oOXJx8F~w1iOEq`2elPq4 zk3sS6lvJs6TF4Li=>3$&&paMY)H3l)8ozQ0Ok85(w={lFF@p;rxrh)_DmpYPtBg%}YY&|E>`c z6YWfNG7&Y=KHu6w2v5FKV@ZeNClO*%rA(_O!P3((+s{W z>Sm(5kTc5*S?y(_w~6OWJa3|piM}Q#n3!mypNak^hL{*ih3^y^t#N(~iwoGKCiEXXbhpp8p6DKKYt;TY! z;o))8m!zxe*pxyVAr}CbA|x4rJmQ6Std~W#U>BlT1uAG2O&M}CJ#4RSj zaSh*U;x-cxv{BEsQS7+0jry{U`nipoY2t#ms&QM@y{)>##GNMYGZ8m&mx##H$P>xP{n>js4>^i9k&vC7116Z1_h zFtNnMQWN)^*lk7@npngI4XMc?MaSp~!@Jl719DGDJz(NN6Dv$SY+{*-hfFLtaVDhZ zh18=VwK=3d4ylSois2nPG~A*{tu)c4NR2E~Hx;QzOgw7hNfS?*Si`9e4?o7`HnEnx zNIh7jUMLFYzC0BnK4IeRB1QhRiDyh4vZHSd4DVVH{kBNalV=&~bfnhc@H!JOm^f|X z2NN%vc*(>;6YrQ7Hi2B^b7bd^m%cdqgqi z)UYtQA5q_$IKjj`TNcY`RUn_Qzl-CsP`j^{O3l6 zKXTnoT$sT{8T@48XYLUb|MC1c@vDhHO#I37pY|iF&0Ue-P3&z{NK(F?Vmh5QLH@Ui zb0+>0eyZEk`W#q=XtcYQ-v8IgMtjoWrDORFPPJ3wL%7eKNlX@PF2j{ z0^zK-Z>OfTQ>k?1;tVQfP&I>U8C;UVp=FWE8C;eLPNz#VV0x2Ok?Q3cY;LEtc4}oi z^=>oM`O~YGu%{eV`m|A7nm-Tu_FnUIwGvtN#Xt zZ)>j_X3!`T+?X^kgT|c2$u=D`D9)fs22C@;zwnx6z<-yw%b>YbTL@C#Qb;So))}-B z(l*~35>k{wSV%;0n_Iw+?K9|*fz@8oEDK2|e)*rljTubMAeKQ%1|u>UnL%gHI)h#r z^v*zK@Z00zZh~Dh=$b*9@SX1zQ2uy(MeHt;9)djuw~M?_27NOalEKgn`iXo%1_Lwb zFPt4ep_*ut4-(abx3TcD>|ri*M~QBP?Itsc~1tKoWYa~Zpa`v#~(VV z3LS&eu%num!SoF7%OIY?O&Q#r!K@7KV3azlTQZm-Hg6TLZp-;524`k)yEF~$7)))N z;GG%VEka7}5;8l3IYJVma8CwvGkC0{+SXAW>ZtDJZW5wppl6WbQi`%610^#^WdlFZyaOOOHA@kYFa0?F@sGRY{}pi(M)wx zFN-yOad@*xmUmLGX0SDb?HRnD!E4gGv6JG{`?tx6tG5(z&>a~Z=%kKyQXK9L;T(>V zH#2xEgLg7`H-p_7yq&?m4EATRCxi2y)Lxz&QAM)+o#>e*;h+n5>yj|v1u#CUNDfN1 zOH{olW4Te4o8$XZof%ahN?<<{JS6zBAWxM~gnTOanc(MwUkHAg!B;}4`L&S48GIw; zh~T5q;C7>9863}Gfra}me3!xZ8FaDG)xwDkPV$(t(9FWA3{LYPwQz}rA2Rrnr?G`{ z7S1qTGdP>UUm5(I!7og$41UkxS8kcIaJRC8>F3+_5hVG8+v0%wIR;+qP!p%L>|9V3#}2w{2_j zUbQF-XTi`FiMMZWDrje+y@k$Vzk`L2B9B=p7812UZ#!Ag3qp(rF&Ens4lzHN)W2l~ zj8CZrCC-1}EzBvDS?FeA8ZB7pZlQ;TQ5Hs9=xL#sh5i->Sm-TI_L1`jg)kxtq zNIPRJjJ0sBg-I61Sr~6&qJ=BP)d`GYLFnGHg6d;R{*0=tEL<(lTqCWQ#Z;r1>KIe> z%_<9DXW@DaH(0pQ!ek3?m4#`1is;u{5TsmR(PY>elc@|^ELfeJEZl6tu#m8Di-lV) z%&~B{h1)F5kbvLC)v@s2{DN5)?vRwb-NJL-!dxRR8O@%&Fm|UEYzOj5KSXC+U>dXO z9t(3V+-u=J3y*XS59=NtBFn*!aSNJ-+heLuw}Orr#TY1^NmxF_NG2_$WL(!mS|Z6z zGr2nDLT*fDELav+#guK~rI>OAX>eyuv6{8uNf%0d3-jpk`L^@LXOa(N>R3!Iw6Ms+ zR~Ejuu-L*93$Ivs)xuH>4_J7XQ?u}(g=H2VxA268hb%0&u$og~u2u`L5PaCewq=o& zRk%{Bf5z0RJb9F9Q$D(uLu3lqh+2&jMdh|7>M`art;+?CJ2TRme3$HO677o&}V0{aBSa`$2b_<&pgr6%>uXFn1?M@53Xy3vf?wUVh zZ;G4)y~UtC6xq#<{CA9nd~b=`YvJ1xwco-%3#{(EKg_ZCL6qbj#^LwaAqyW{c$ZmZ z;e9U9uJ8vIJ`{4UM6vpj@amldPWdNR@WRT^8JW)NQ|^?`iq+3V*sNK}Rh`ur7XJ$$ z{*pP|S&@P~z?7LGAo7Ebd>w=<CBC# zs)7yLXSv7@f`5TvMZpUNxe#o<*hZziW};M8wsDz_(>8vvQN_mPHomZNqHp918&z#2 zY$R<|vr*kfZySAV)UZ+0MzM`fHfq_ZZKI8iwl?b6sB5F4jYc-=*{E*^$7};T*ze!T zcII)~W_2NtpvE?u*l2E}g&kavnsO})Ld|S6C>LB-c;vF$(hkn#Yec`59h{S`1%nfy zAQZAuWFumuoei1|+rbr(yPnool&bbp?O+GzEzd)qHXTK>u2gZqM{UGxbhS}tV{KVM ziH%Ze?QCO5sXAU(KsSbJg~~=38$2_4o_t)Yx-llDs=JLIqI~u0LY`nfZS=Bnkp*{5 z36D^oz|G3SeQor!ajlI>Hu~EbU}L0>Q8os0$?V{oIMfCY;f-CxJkSQ)7-9$4Yo7M( zKFr2&8zbo0MKNk}2#!uZ+Qt|gSK7GB##kHUY>c-tfm0|epq+9`F)X|eaP= z#p-l=s1(C{lZ`p@ndD|sW792maNQx9VPmF^yKUTK<904Ov*n`LY)-sf=nfk^QSY*G zr;XiR!*f*-Qd-vAhw1Pfi6_Zi8~55UY&@dWeKz7YG#m4kq8)xrqB5@ntm+~Ry30j8 zWg~6lIUCR0Fl}UP+;3wcBW%OA!H)#KjhB^jxXRtaS>djY8QsDZdN%0H+e$J1ya>*- zgG=Fj=2byxfsId-FidLgrn7MaGsq$SE z2O2-7gz;Zt<6$NPKT~xHBDuF*XfTYp~dzl;RZQ0#S>Ag1g$+(}F3&pzxS$dELZM<*e z133+t#_w`d%rAIP+%DIskRS6twDA#F#Kvb5pF=i2w(*JZ&$|YZXT+FMi=!Lr`ARN%OkO?3SRvt zz0T2W7xfP#*;SGB=&HtaRRvC9pQW6TnWA4_c%dL1RLJXOx~dBuT;w3-Ano8{2bCNQ zb}+=jB@Qli5OL7XL1hP*IcVyjnS&}0E_YDPL3IbGCxx$Y&>FF-4pwwkFLqT6FNm?) zwlG%1K_dr^9n^HdYAuJa0#~&K>j>5rq_Ccl`VJc8B@G?$4r(^hR1*hZbyb}%i)PEk zh|L|eaL|S}9kg`tM_1K~4$!?aMb2L33u4CfNTOn_d6}Aid9<`lg&Yuz9BjNi8g_7H znIdWLpo4>M4!S$&=%Cm^XR0~qZT?Z#yEP@#ieu3M+aRN?ct!OgWeAM&}=u=%K^RObg1*hWzoJ4 z`Z*ZrV331R-Bf=Ew{%l(H#I;k(>T@EbW;~siEinp==@Lz!yMe?;ARKI9gJ`=$-#9F zMzXtu2@WPY80}yTSGKzv@8F$o>X)UZW4V-7qAcSaoam-VXqHQMsvvfygWD=cuNM8Q z9B|>*Eh)W5gp^+^@h7?7LBsCq1_w7fnCxH*0o;l>df zU))_ycd%+v=`-EcEe>vVFvr2&H0xl7gFBf~J%Sj{WNuW6-tOSnC8ck6SD$xRvmE@^ zUELu_J9jzQUJz^AL(OJ#ULNh&L*3(Gt^=K6ba1bOt9qy{Jye`Fd#L*ycs?x~!f>V5}{94vP5NKdtp?iIwgEGnh*OB^h9 zz$k6*8LT7omblEpLlWLc9W3W&VU!%KcJQzWPxn+8^inGweAH91F!GN$sMjk{Y-c9{LYjmTJI_;o#Uq#ZsuNv4_opC_I%$(X+{lYCE%D*$W`>Nk~ z(k?0GNy5!LVrl8JzCn1;I{3>$Ef=+2{LS-$C$NjlUHs$VU!K@5D!IV{`=5gX7v)@> zm-F_6|DqH!XysjS`y_`&3*F#QWr2_iE-uJRDhjz!@FF)jsHwKTuiD#JUE<m$9vA*iBzKWzxKXnBqE~>ex?gl5%hVrqV{Zy=cFm4SOHQnG~xu&1GxMGat z&VH(ni@GivyJ+HqLhpREo{Rb}7WY#;LL0bf=;E1vYF9tih;E;cvV74mh*eV;&D`LS z`MsZ_GbGJ9Xn#f0%0+7z?H)$^htYe4~r0E-*0Yb>!s| zzNv@L4!y}moq_5W7dJEhXG>Z5TCNTQ)vYoGl9?`Ucj3A4UCeTE2MxMNySUTET`ul* zai5FXF6MA*F8CSL;;DzHZG#7@8go|4SDxKa| zQp*RbG<_JT=xUOirE<}S1J!Hd=Z^!G>B3>E4^%7}7gnCzLaGf?p+U-Zk(H{h!c?2* zV!n&VTs-b#0psjqrHfTA7P?r(?4{3@)b*>28P%bK6yLA0#Klq<54gd5Hy(7cOcZVz zq#hFY0uNmbZ&gIXvcko~B4-#`UG3r#<}JfANb%JeT&zdwWYr=TDsUawx?mVdo?zOz zc!9gj#ZxYxcJUlD^QO{egVeOvMbEh4qC6|OZjd5>-o-i>%j*;|AsG!C|%$D zH(Y$q-Q;4Yi(M}EyEx$DO&4$RgmJNl(_B)#+eK)w>ONR;(^Va;_PUsRDmrVh+UH`z zV0CzM_|1X{n-02o$HhlXA?{+P<+12{F5c%F4OaV4Mw>oZ`~i=PMa3U78pooK4py%Y zR;+&P;u9C2xp=}4e>hlu%Hwf};-IHwxbmH1&y~i$bn%so?_7M(xwts&;#(I-U3?>> zEIJ-NB4l@IblBqJ8&5^+3{l5i+_IRDMNhbV7-q?7?i4Ql;^LDo zPRU6^=cgI1h>;>JJ*^fzNHS zsQ6D8XI)GgqKqLypeQ-V^WVk4T%-GoRV=n_i28g{arctwzW>4n*`Q1LEWQ|`UK*mx zk(_Ar)(};g1+t(fTLb$;RK+YV%;K^vs$_BU`jU&XxHyYSS@d%Yk|(2=WN~R0m9uE2 zVzf|YsA4atTZF+}v8?#=EUw6+dKNXZ==@4S)hw!IF@C6OIaHMmRdbI=XAM=}Q1ux3 zsc6k?;OEK(#kI4jlSSQZ@Jjjy+2D2a^@Q_H@%6KKb*Lg~C=x0(5{1TDbe&c*d0I)c zEShKWRTf`ogFCKUWYH;$XcjG{N=Yjrtp(d;v45y)D?F6N_d``t7GWXe5h3ja+w&@r zmv-Zx{OtmSxdRNcSvyW`i$y zdq{Qr^5EM%mR?!(772MD#$j0SRb*YeFxNUDi(y&*Pyz!*XOJL`3>H&E1czqf&JTWV z%`PLd7?s87EJlhZ$5o8E3iB{?+@iS3a9Y)ET(2LO{&wgxHXGA&c>=(g*Rn!b6)3` zZ1DXmmDzM#7BfVLe5NRnuxVC~3*ISsS2p<4l1+DKaZeUj7IqeM#jBJk+?&OHLgHB@ zWC%^Fx*$6m`6+PpWESm)1>f#68fj55v&iH%8HZf-90@P`x>;oNt@M9h7W1=sJc}o? zSdhj2SuD-s0Z~{exaj|PoL{&&izQj~k;NrG$W13YYXu(?TqU?%7Ggyf4+~i-NKfeG z>MY*+JBZ99oSG<;uVK#Qv*j^HSd!|=ES}2ZjVyL%@w8~Zkj0Bao)LUj@HxTfvsfpD z-|^DmOTss2u_cT3!YSM!qimGwCc&2lx$boA72&T5zA6rH6`UyZ-Im36X`-Fih3pXI zq;_TTW)=ssILN7qaGxyDZf^4|_T+o*{XdbUk^Lg4w>h`p$>LC6^W7}o6aIc)@_~>K zv-l`4;TP#23;!gGPqX+eFaIKo&xPmW`DI?tQ4VME4O7m;Tn|UG_%@5~Uhtpvqgfo| z@#UeehvQj%mqnomc=$ex6Iq`;~`(7M~PEf6oR3RgFi9l>d>%pFHK3gxQ@hrr$G6{hh_REDAiZ z_1j_UpDg~9F8>PtJxqN%BXY%Xb)JXwaFrXPoQLw%AErW-UlFa~;Q|j=c&O^3qK6AT zT;kzU4;Oj3*aKf5U&+JZ;cCiob+k(CgPDQb=5STnL!T)TmMR`D6aK_-m6Kd9)uxxn z*rl3>--oN39<~ox)jibk@Y!(1LQ}Oo)RtO@RI3rHo`?D#+IVQ|p@D~n9-4b- z;o*mw5r(3XhsGY7c<47mHTBTU!*wIn+!4XQ`|He#tRA7Zj!-Ql;hmIbK`T3u-9;rHb7(G%o9;w<>VWgrF`v27N*exSf zCl65%J(h;aJIo3qV2@OtJ(PNQ@_1<(qcoD=3!{sNt{z?+sTj16MylpBBd13yy3x%G z7MF2g#~vPfdg$e$w}-1eT*Fv-=<8tw9p=!Q zxjn))Z8Az7ZW`nA4f8NumWjqoM+HN4of#R$xpS3B#nCxMShZ{W5 z2M$^|TGbt`=+%v~HHt^8p`+Dw>Wo%5aXO0 zEgl`{-0tCJADJiO>3?m_eLfQJV? z=pGCY3q0I2D$J7bUJ=b&g#-P) zH6GS_c+A7&B3vi~F~DM5THL}J93JgoPy zjT_d(2C=i*!xkYM1vd%4EO>sjdPT@K~vm=p`Wdfmeg5xyn(hKF53*t%0l zZs<3K$Hu7LLf+2n?D4Qy_&&k?f(HZ-3ce#qYeUAU_dR^T%{32w=HWvRA2I$umijp4 z;bSI-k89eM|HQ+mJPLe-eSGHOa}VWwl=tz4hc7++=;4fquNWT>-|;Z_aM;5)9=`Q( zl;=N_YG-KL7{wopHC-R#9q;?DjUD46GHEA-H}494{blIleqr(x9!`2V&Ew0%zMdtw zK3-b#Oz0H%;Jip*Co*eS=-lB@VvHjB$-~bc&U*OE!!I6w<(B8tk5RvIgY1d^&Jmvu zk(_<8bogrl>3tydC!|{QXF?6Oht6#cN(;{ANNDNPq1)*H8=>VZ3S0YV>m%eNJyx|5TsXF* z;q#^4CdGc)9(u-)M0~XKajlO@KHB@};G?gPem*+-DE86SN12aKKBAn9kIp_~KGuy@ z6&FM}ku#r$$g6xAD)rID$M0j+?y*Ywc<9>L7h@G$De1--?hEzs(bGqFI}BKB zxcQM@K6?A;L!0B&?rfyR3n7M!ktFZ$V}OqlK1OoNJ_h+1<_9@2c}wV-9ihQKhWHrj zBsXosa8%-0owRkI6o!__)c(%|33Bg`P1fHqFP4 zK6-r|nkq<}&rYkfb0bDQ1Na(?>=m^YU^_i0#7>;^yU9A6}mOLRRvT zvpoNWFA%(6aG{SyLfE?4M^5Ekg*hD+>Yzt68V@T8B;KDPLHiYw^jMISG5Ir@j6 z@$syW=a{SGgL}w>d&T|WHu4vk(xNb0eTgI!*U6GAGHu%9WM_8u6SHNDI ze7wvIoEIgZosGWY<5eHKe7q?}wsLWO?C|lLk8RSC_rtUAb|3u72?=|>;e+?UZ}Fn( z@oFb0n~n0W__uuQ_OX|}TC2DH;Fl>U#s{~`?_pTRtCz;B1LM_Gvm^hJ_&Dg}n2+N= z-r*VI;}ajB`q)^#}w`DZ>p z_i@KD;mPY?TtDcnCV`a73k zUX=Xp3F;3X(d`whe{#9!MM?hlagOKYJT#j3|H%68Xeo;4`-OLrC?En7l%$A0mVHXt z_n=jfEC`ZCa?UyDoWpFGu#W<^xY0RsyB?i8Q>{_{Jh&po%R ztE;QKt9y4c{@aKP+>kX?)NpYlE^#y0P+CJo!^iij;u`Wa6cf(uFZU_1N<(#phG;)k zLIe7R56Dy#EGb2;`h~aUm(jrc^UG-{tMS5Oyq^fK)WTsYuZ5w-?l7pX5?)oqH5w{u znAT5St)a3O#u#;oRW#mQ5#P`+>{>Mqoc)>_s%v2|)X=cKpE}e}5wF#7oyHTw@md=G z?59Xh3Dy<+jWonG)YEXih8wgnwCZcPQ3IcbAa9`ICbp=dAqSzqy1u_+@Z7ASu)pfk zUva+1^jA@_)1*_3*#Zr>uv9~lhFdi>*22JUc3D9~Qw@vyhu-#lFTzkEFSWcNuJQJU zxY1t?o>kCX!yOu0YG|QBX|RVE_T5=@n}*vpJkVdYo>{<$M_9d;#xpAMJ2kY{!Usvn zDda;IZ8W^tUoo|LzD0Wt9W=B}pj`qTHQdEvOn^@vcGA#U!#0kOhPy-eFkZt14P79xK~4W;XSnQdR$LIl3rSPp{KVNUbtkoFXvH1e+>gPbUaejPXjMQ z(*o1S{lkkX*HwrUd3k!Uh9Me8YZ#-UWQF)p4I_jM(=c4aU;Pz@OuT?d9I0UxC$43j zsoa3j&R7k14p8I7rFsLDc}Ed1{Y=y_NyAbN%QQ^ZFh#>`4RctLF{5Dyn}~$YgcpD5 zq1fR?;h9=^J&{GTIQ7K}rwveZHO$knkaHyV*{}H;7HC-9I$rCl_>{atlEn;t!wVV?3BMd#to5Q~U(&*xE0|?PV(Wq7b;egTysDw!Ks9Ti zdW}POM-hjJ_y*@i!_x!RNe=!%bzCgGEBL11TN>UL@{S-4p3uU3JV=K_Vp{o_*pUFggs^OI0g0ugX_!b!ydiaHgFE!AguQYt8q0u09 zI@i|M8qVbSHyXap@oIzA%9io7T-{>fN0FCJpj-k!Y4};gFN||3DwDvk8h+F8yXgF_ z;U6J?2%Z!CQ}8drS%cJh4gYdiPoQ`L|A~-JUes_w`2YEENwSedIF-u=sXQSi1(84r zAy*{86!uX@tdwwOODEuqd%U!I{~&cG-R>T%D5d3vGg~2n=LUsycU2NWe-ryg7kej>lI19w)ykf!~hA9({hqfIV0>PvG^zYV)sQ6Z;0MV(~_|C2&UqEya`D6Zmp)Sc~#j3A9dtgz3%%{uSjK zLsXjtUU?z(t$hL=65+c*Gu;0ZxGNDp^`O0g?)J z;{y^Hn845kh9xkFt<;YXNq`mq9-;;(aP?5tXlSU`cBmSjz=#A!B`{jlMqc)Is2Vg> z%^9j57^+?xs>UQRmZMZZPUEadoRGl81QsT+D1k`{Oio~C0<#jBlEBmiri=5_#2GsL ziP&MS843J7RE=*Ozj~OOoxq#~<|nWq0qQKPAD^4RJjTq8p;t@|hp7(3LN~~%u$XEI zEKguX0!!)eFqIvqmWfwOhlL~X+%UDYULz8Ab0z!II8MGgfi(%NP2j{ZwIP9x30`3V z&8|;?Ux#7hkZK7e5=bSGP9Q0RKzaB21#Ft*_F`VaZ4Khx8^qb1A%kNk!uQ5of5F|`7p60@IS1p2UL*Je0syNmNSW;RN<2@O1)b5_lwmM>+Tj zypag64?dQ_vk4qX;Bm=P@`R8l1@{X+CHQm#&j_JTfgRx`+UF!Y_H6uM0?#LKNU{xw ztCxiwPT+-{{)<9h60AHtyp(x_D^9>w>%l$x`C61dcO?6Zk5DH@T39tB*vX z?Qr!LcLx4zlI)2D-WS4J?IKzBvEsOx+aNQxw_SaR8OLYkeWI9wMjnX6FSMXtzGDL z?Ih}mq^@AST@bZV}Q^y2%!s zB+)F1coI#M@IMSYHDrV;6rI}ziv%feE~G^gO2}=3m#wk%4#~C@Y?Z{FLMUe>v`wO2 z5<`+0D#G?j+>=DNBs%1DIwo;fj&~B$S@3SbE=hFFmGVOWGg{N`N!*tNugKGWk0g5L zN_!>ITX-MAdvo%>LQXUfd)H5R|0K`<{BPt3CNW6(;GBf3gPOyV7@ouk5zZSCUf-v1 zWD=v27%jpHf@1{73Q}QQ661xZa&b5@iAf@vEI37Qs^G7k!bzWz#LOiAPU4>=W+gE@ ziG4{tlEj=O<|dI$B9#R1E1>4QB<3fP9-$T_u}&;3Ok$Cc#eyr6SR!Pp;4;DGf~P<;)qO_Dvq>DtNuCR%J=_?d7s;WV{IHN01YZ<B%@Bz}=>!AR9%r219(Z-T!I{vmiSi9eJ0OZZ;d5=UGN$M$>@|0dBT zg{~?5m&66`V=3I4!o?&mapO(lnp7ADkrYY^AupCfap8G6351kL;fkE3q>#ZQRp}JU zq);{|uPCIP;FW^q1uLX*d2^ust3*;Mg{y^B7OW!3(uFe4)l#UPLY)+<=j1g~sF~x} zrf^-3*Aik$t-8V+q)<=D^*Nmzgw#*rMj@B~D%>Re=A2G`3Jrxv1smn$F(CyhJS0st zPVosxG)sa<83M2p5u22SyvQq zmBO9ETc^-LNE^Yng6#xZx4n=xTf(27Lsp;NB3a|(A0|5UuXCxvb)j7wpB3f)EC zU$93CJ%#)+Qe8Pp^-7_)Wcvux^1VX(rf{E-euCUTSu{ZSz!V0hFjzQ+BU2cX<3oiE z6C5r$La@Q8u=*(Bqf;0oWUS!xvY)per6!~>S0ob!C#5hsg(<>k3QiTIooOjd&+!>4 z^p%*We3l4jr!Xg1%6|y+gwM}O7NoE+#}^4%oWc?zuZx}KDXd80XbNwnurh^JDQrz) zTMDaFSd)UDf|0`76i)Om*qDNr!aCvW1u5Jhgy-QCIY}yor0@Zw6cy6KpMO0t_yKP$=y1fNS`;(MWm=TkV8!r>HNNa08dujK5! zC`MkA?8_;9C3c9f=6riCh0EQi<=0b)j1I^4SPI8eIGw`RDZH7&TPeJs!Urk5Ew$dw z)qO`=Kap#TeK{#b@8u*Prf`aDoa_3I_(zP56h2E~do1<|H>J^vqt#ubl`|!j zGmRRp-s%?pB83{g3%+F2-J)NmU|m^IyKD4J3g4vgM+)as_%?-~?~4CI_eQJlQaGE! z^3m#h!Jhx;l+=X^a}9DyG8+!><%xUa*27 ziz-(tWYJY=R1%#fV-&NM(`aiHFjYxo-xx(wEsg4FT$e_zba;0YUnEi^jhbn^HYU8q z<=QmPj8Wvo+Vpm;swdX!2(LR<)lGv~G*(?N@*C2qFNB{38Dtc(#hcQ&IgLBhXq`rW z8ePV!r@kp{mPW%gqG>crBbG+vH2kruARS&!yM-e#RvmpSzM*4$$yjx38ssDtHc8{j zv8rjB&uWF)cpBfgjTH)#6s6Hzcnd+5li!xc?ZWTKNm{1SN;sQi#Woz1H10~HQyT5W zhqI-lXUas|U-qX{v_l#lg>Qel1*>#Uc0bvo)Hu~giZ0E`t1~VvWx6kofguI5j{>m!o0R zJ;tdS;<;SZ#%z_zI{_y5`Y;L@o zDL5;Q*+S+BQa+b`uM#7fpT+`)bU|UAwJn&gOUD;;;?gkaOgel;Pt);XKrT&VSsKgJ zSdqrcG?Hng(pZ%S-zP9)ywcKGExgNkwI+?V!q;)w$1A4wX>1U_QIJ(AOr$Y?ykcE* zyh^9Bcf4X^mPI*4*Jn;5q`-x?R&oW_)YSjh$)i;%H0unKYi| zS)eo?NMnyk_NDO%-4p(x;6s8B3)Y^XXoTre#=J-#6MS6o2|<=N6P^8OJe89?Eu`xN zbwJ1q>~b2<2|t+Ad0xmN!NX~c7b7o8_O+bO%V``D{z^{rs*rUP)aycy=Hzb(ImUq! zJ8z}&wn)Add`Iw98YhI%=XZsiOyj+rNVrvq!H1>sVO#5eVfL2X`JQhxQXg}!SiYSkj9U~ ze@f#wPGTBAOZFGRUj?gA468H!k;Y#lAwQSKpE-Vul>VK@KO*TU*?)!qCwM{dqTnS# zS{O?;J#=R2L{(fzo(||Jp@Z2nf+SbyC@H*DPEuNkGf|bzNy-ViQn0*^N5tS&((CIc zsd_pp>9|_Q>l0OF9W_NxUPUBTbzCEal4=|=;WcuSA0{de-L;oZ>8K^7wqPB>x`Nax zF-bL#j%TVC44kBz>FC)m7S~azqeusLvlcp(jvj4d%>`#nQsnj8#;A6ijugkC zZEVjZ)l$djlT<4mt9{zg;`|7w)2qpb=^w04_lNG-$a&ofzW3rlgYix*)p*kk(n4)8t zj^R4S=oqWx5Lw@f@RF#}_&d>Udtq2_5h1IHcpSjyH9@rQ-!1 zFY0(j$E#dEMLfR7?^Dzf#*!Xd3tx?UGJfy40+O;*)oa`qbR6Y?{~V{}4IRIZEnqsX zW8~P_F&)=WRU}LlzRewYTmktzI$BRv{idp$BzscFdpbVR@u`mYb$p=XBOM8XLWop`ZW95RP_@(K2`lfWgQEK75*&fw}_RR zrfN)6Ec%U8IWk6aPDbXEj);Ljb^N8{o0f&KY3gqs|8SY;_*ch8uJmc@KOGl@d_JS zI5JH!l{IkR&vELIw{9LIUTNU$$QC3O4P0fQs)1_^RAN*#ja_Y^vVoOt^Tqb*6`{kTjmI+D}(ENplSi+-!hZrhEefMTdjDZ9+jK12F>yV*geH z)tkqrPgl1X;E2)AiJ#()MYwLdYGxpApqGK(1_})n8MxCxYXi;Mgn`=)+(Dm5#FT*{ zLvfpdz3)V|m2r2v>iSFU(dp{kJ5i>V23i?7I$eD!k~Rj9iO|VFX9Ml%A^S2zbujo< zpg47C;nH+<^9`WCe6IN%sX=Ye`vNX|VrkX}#V4;CU24)zTX<&|lxdvt#m@RdO z&Q$vjMn1Z-;0itOOtqqUIp5|}p;}Rk+Jy^5vS6l4lqpzjU_O%APG-@D!K8 zEXCAomU>2tSjwq?jzdBF2EH-yyn#ao-ZgO2z+nR~7dBwoAS&E6?zRtx}z33>{pajh2E(|&tIWGEdalsmRQ#hxX`r0hsCaT_HuXA%s z;e%xg-ZSvNfzJ(m!3ARALj#{mEtZ}#@QK)G#g7bp%%Kw_^n?-1x%*5s4~sw4|I*-> zAB#>K_)6rL1Ndv<92VC4mXm0pn2F*h&Kmp-2hMTpHt>UiA7!9^=St`5UrLQnYqT3E z-oZ#&6LjzQ*{ZyW3MQ^LQQ1UA(Wk?eOk8Dxt&=lm7!Q}*y*xGS>@_B;nV9EbzJux} zYM3Z%qnwSJCayJchlQ3Ft}{`~gk!=rQQJfv6MgBSiMl50nP_VA@i$y=;sz5pnrL8R zNT=vkb5wm3`EwK#vp1Qz*$fYvZ>3O3ff*i3H{>fIOf(V+OJhRX%u(bW{*K)uSrTR& z3vXiLvXGi__RB&BTa*W8amG{(3HUJNv@ny(UKf zP@jV9uZfYjTo2M_Z4*(ez%D(Lb{rGdycxt#M5*BcRq(%{`c-~q6a;fGd$nVQN2wRo2zQiRri|c zBb?dGrSGO5GlQ;H9#+n!P#;3~#lHyGzL4nDsG4bqNmF7wjLT;FNXRad2h)(f&$~N)+ zT=mw$!pD0QvX*DUH*v{C#6s3YVB!T6FPhk7Vl%^|UExlX??%8@6AVSh=jG_#W@0+ z5`F91X!UvO5fhJ^AW2PVM0|n+QX#sZ12s?GGEY5e;_i8B+&snX=6UKF_R++vyvS?f zz&v%p#QXEqK@-ohiE`14!wPOG7p0_IrRZ<-)FG3!ubX(2om!w;%~wZFykX)P`#WDPnXlaW>cD*U)_ir`#2@oj z*#+t?E~N!(@B;NVLwA9ixj?;Z;-raBO?+nJJvwIMLuMDK!~(VUNdArm>H{une%*3` zIwkUt1gY?`kWU0xO^AJN;^G3;b)ovw#24Jb7OKVz!>AHnk`{uT0HuJnSC?qiBB`%uh6aSPQg)Uc3e0T!;dP}xEW3)>f}cNeNs7Ot?u zL+O%&&n*n!Q&-wT84G1Cl(SHQ`h#LjS6V19I^+j?#;Ep>U_}cgS6QeerA@aqWzo6z zu__jbRRwulBl$H}cz35p{?+Sg3E|`-Q6Z(Fi3C=<^~)^6AM)zJ-Psnpucjh+5%mA_~~bB1O{3LQHtu zMQZtp!doodYN4?OW}8}=w@5V+K6sI$gxOhF78Y74ve3eUvS2P!%`JSjNL^Z_9$BPb z6C>KOBAU9*0`Ydinu}E{i_Z>YLIx8vXl4vEeq`|w71Z~LPrb3 zEDX1BmxWFi`dR32p|gd%Ep)YT4?D6roR=;Zx-C|t7pp~!RX0|w8NW})oJHM*^svxV zNH4+Of_((3bFYxTf_x!iMr;nSFwnwa3qv@+*TtV&td1{MgGA?RQ8>R?4Ye@7SV4s) z>ZT=XgoTk7rdvo@FzTUcsgnT1srR&!n~tgynj-SWg2&rR{9-%3tL@$lsm#5JOMVM+J~ zT^6mi`11BVk_{Gav+^|d*8=r7(sJ$%8T-GXbuqkRU6g^cyTmt9zN z?2p1(R~0o}s@Sw`!C@qn3t#Eb(JcrGH-8I(6`r7DqPO&oZ>Zp37wT`J9WDwBzggJE zHEZEX3;Q`r43ZMjk3Wb%Zegc|T@0k9>V6BmEj+*pTB;tbRKT>y0`XxBdxbnG_>f?= z*73_a`z$>4B13V#kh zvG6I^HQi(ItWck^qJ_s-sLw5a)ml;Ftx#{SP+v0IXT-l6PmKmFi~;zgYNWrTT59 zDzi$}U8R1v@CUbo4DQO{oP|HRS7%T;gTE~NZJ}far84-(!g)sK&#@~q_}9XJocdMj z0=K4Bs`n~2d6inbN?qhQuTqz!h^3JXie*AIrs6{KGJud0Ir%5lU!|(AR;4q1qrNJW z3HRrxe~xupt;%LlPO@WGt1B~nqq{0ESt?Y>pkj_+C8SaYPh4ohqAD3w&G0?Xs!ayh zWKb=G#u+rppt`8l$)K)~8X43Sa;+dMUMHkh2DOD`SBGC)V5*nFO&Q#r!Sy1)L9o8y zje-pXsmUt&IUdWPVU9GU%ECv-b+#BiK!l!tNRL5Z+U;S5DrWmWB6wx{zv2eKWZ4 zvP7`I-~hpaf`bGH3sV1w(v61Z{2wM{cm^Ycj1(LtI9hOw;8;O+XPl7ng0wR!gUJ~@ zn88CCOvzws28%LSoWZmVre`oKgV`Bednk{8^=D-8*vUeYnL;Rh@K}pE8N8PlJ#wtY z+zjSr@MxLn;xf_s460U<1sU*S`a;3=YZN&zLodl-cP88?mu9dmgXI~l$Y4hXJ2P0B z!3PDgjTvY{Rtc`oV2zNq8LZ1-z3~29V$@{Xz@YslB#8`?8DujEGDwMzEtnS61&s_$ zAyx(%AzO$3&rXwF%^Z=qf}Wr+NaJj7lkjbVn+3NBZWW}?*R5I*w`Xv<)~-x=v)}!K z|93y${yupRNZ)s@QF}7sLCW3?N|Y!#v_?Ig!9I>;2JdI^2!}C)H!?WJan9iJ3=U;* zID>lUqff}J?Wfur^<;)GC{{&hqEBV;G_7UuYz7B2c%GZmT2*(gI*`G08QgZRg<7i) z{aDz0t+M7|>RPoyN_VYQFNn2QGkB2=tyM2&@Nx!6GJIF3dL@H}|Fxj-_qFP(b?V78 z(bqC~or`@P-ZP z!8fF0_uFF($PY63FoRPWe3ZfO8T`RP%it5PVn$8|pJwn`2480IRR*6^vQ9PRgHhZq z*Q?s=m0BNWPiOFT2H!B8zAt2!*lWEylYvtvPX28M6V|JZ>lOL;8T`P}Td#i2;KvLu zZfWsT20v%`9;eXGFWj1{#+bHrjUN;V`EP8xOZ<&4@pBpcnZX6t;{Kn(-`tD3#Q){~ zpW$nT6w`UpWR<>e7q#si|Bn-~LFI2yRJ)Wx#13EXQN~6w8^vwD(?gZE`TiM|XNQeK z`0x#?gv}SHs4E0Z3YHS2(A=O{i^^<~c%_Z z8-+I7+Gt0KjpjC5*|^h23mb|?E;VaOh3^Y*voU{k!5ubkm+bQ!6@`?Pv0@)?4BrdX zdsIPd8ymka`gNmfV}se(jTo`LjSe=t*yw7bqm8?4+->8zGew=GJ9lcTvyC#Es;?=I z*nJwGja4kY$3{0Bk80t7*qZ8YqlXO=Hbi7!h`nv}u`!2XVB=mJeQk`lF@dvS^Wji6 z$i`qBd@WBu!Ty2+1P9uDo>3J`gzw}TB5sV386PS*%*JpbEWOT*jkGaJbVl14D`bpd ztwiV>(>Te-#o9!vI8AVpjmbGXQ-n+v>@J$qh0m}tQ^+hEvxQ8T()9^7j{|NaX(MH0 z0VCGN8d0EEi)<{jam&BW$QO%niH)T~_DJ>RQo6#%N*k+$uNGvLmlJCFr~(ptzShP% z8|!UskSN=OY2lM1 zA>YrPMA9=hp5+YoEV}r6_;Hg1HeO}~u8cirBZ4e85D# zAo!vnvoEoUq#~ih5mBRs*SHqmjE~l1Be%s~w{g_Q8+Le))^Qtea(S|qBE>ZN!#LAh zHr}yu!p7U8L;3E%3aQMm#w<;$cSV_>k9nUXX5(KQ|H)8%XyaQO-`P0DMLn?SBO4#v z_{8R;7HVUyf=_Ke^`N%ZD)@}kU8~@8!7l`v{nEx)Ieyy4*TT=_B;U|mF>>~vJdXKU z8{gab!N!j^{USIGxP_+FA0njAt*KB> zQrayb{%zwQ8|UrtFqWxZ?K}!ec+7ag#uW}qI=INVtzLA=M#Kp}!Bfl$+sboL+zCgr zt5~BP4oZjug(Fj{loQ5DSttC!Vrdo?6qa$YD5aRl%Q?8xK_;d4rPR_6MLdyG(ZN*? z+B@jrppt{D9TYgY#X)5URUF*p;ARI^9bDt!S_juTsK%534lbk=@64>>VC`3hHL2ez z`dUhnpH8W**}_`l1Kp_SptgfLG?i9$DNL)W>F~#>Wm;YD;06cl(rQ~;)pu~Cg9B;B zA5CHd;ru<#clh?yNJ9rvN3IC;h}GTFlx8P)i#Bq=?*YXGPo~wa4jMaX;XpZfyhZUQ z4vHK!mqBRipqYcXgF=V5Z}C1i#YUm4!gpHmIGx)I6W;@Kn}gdOv~FD4t2NNAka?r^^ zX9xWq3}8hET^#gc6*J;YEa>WlCknbd;UnAkIOyi^hLG_7AKqd3=P$7y4thEu;lL7m zJLu!!Ue3F&?xS2+-AhLMIv{?;S`KdvP&XRt4nqxeFo^y;7)ygr!C=8r4u&`w>R_0I z;SNU7!#@fOiY?ZV%C6^wTS8giLk2sWvd4TSl1@Z6gT>Ne8+EgW+*! z^u@LjVoG>gFxxhoY8&Zgs?PKBSd?K9a@HJV#fT&53AzsUFOQXI6-~8^(0Cxi#irWq zU=u^dR7^{x-7OBbvUjGU8gYk%os3uqPdM1c&ELU84j$$JiUsQI5%K`LR;Pejro9dx zbP%)&IdPwZM?~jQLH6sZc45(DlBNITPdYf`hvX>{?sq^n_Gqaed0HgR+eHsJc+SB) z4o*1yei@#3@QQ<19UO9S*uhJp_KF{Qfk7zTkS@?Bd;PKlXGQD?Tlp@Zl54gVz9u?H z9lXIEqiytc2WMMH*ZYxU4vtIFTMpjjJo=GcVuv_pX~EkvO?C4NY2;l8Cmnpi2o(MI zILqxK@6$8x)X`O?8x4obTyJmi)&q6e`gqYQ&+^U z6U|yKmbMNhm$9ykdem{@NGMW%gNqwQle~VecjOI3coR|5(DtE`hAyHm8o7wMXyzjB zqQFI8OWo?Cv5Q+=%!|h+Tk7z_f+j9c6f4hC4_m6K%Zo=v7fKWn3tfCzvZ#d%<)X;t zc}UgV<*7gQpQVVmxu}n#P8oH(%d=ZNt)y6m23xtf)5RnglU=lS(Z1 z>f#<3?OpJSFjEH?!!nAbql>#-EXb%%F1iRI@9g4k;Z{a5%S6p?F1owu?_z+99xi&i z=;PvEj&|v2FBf|=s<#;LaYgh=6*a{abX~c!)hBvM8-0vzkeCN_? z7i(M|g{ieJHV7eKCuF@Ke|9O^=t7fhLNMuuKgTKIEKR%6bKDRz&{i22wu?<}c$UU- z;R*@ZYg>7&?jq}At*w~d%+`hMw|Q_HK6d)~(W1>Rj@#8bF22cc+kbd4DXxepFp+84Ns1dJpOaxb&h(-#lu|Mbz}Qn z{hfPr;J{P ztE)a2Eas_eJ@pkge-~%C_Fa6<&BRk3+lSvLEag`7hGI)@vDp9T>S0g9~Zy7m_I9ePD1?;?lwQg?yXoz z{8IwvFF}6JVE>FpTnOj63_ZnvO8>g}kL&%NXjd=18}PY@i!O1}J+$z`cq`_G-%rnY z;kUetd&pzfLkSNtkM|$o3J)bcM5;8bB5I{PR1m@{rG=CcEGt;fJZ$i=(Zih{{^554 zJapi&cZjt1z?-_;cxdb4hxUDX`E*^S& z=;NWQhkHEq@X*skH%|@(1bO(tgPOzg3Vl9B^{^K{OV!KcZJZ&w*F#?q13V1$aGw_* z67qPkp9fxljn3;;j; z>cOTPiip!ZO!u(B!$J?`M#N@#nB`%%@R=U0@u6^zhq)f+d#GDA#%yyt!Zgq0Nx29m zOpl(7P`-#G>|uq6#ZsM;B|?^ZSeBC%_-dtxRUX!QSSP~OVwM(YXHAZ??)n_R+=}KQ z;o)-+UwBA*NO^eP!y!(h2i?Oi5BGa8JeVFfd)VZwR=%=4cPZjnL`eBlA{>}i&vFIzh#la>W!3eg{`Y44=R|l=(8{XA9$pAz32%CM z(Zfp~j(Vs%w%}zCM?AbH{O2mMS3JBboJB+K%_IJ>G{o0M_;6N{zv1CnPUk;f8}jhB zhxa{vAi{S9-xWN;Q2C^YRZdFwJ;D1wETrT^52rkQDiUTt^6-i9k39^#H;^6+Oi{E$6Ug+Tr0;dc)weZ1%64-e-!dOjNa_|pr|kX-4bypO*;{LRh8 z!+8;w^6{^biykg{_|L3y7i3bq zSP35o1NB}I-Wga@N=f+eX=&kQ1k3vPHBjY*KixJwu~5NBMIUv2)bnwbk4iq*GHUv` z+DBzSycg&iA60w=L-WY1`gpZxjD)G)dvRhlAJs)ICBkccl-{Ij`Kaxq)+TkGkD^VA z5^56bNNG2bT<_xsA5p1W-^YzU@`X3>aTA?+FV4G?m~QrAeqKZ}Zj&O?PD39{HmS@e z)yPLosuZw0KBldXKP(MV=jbNY#79#fi+n8h(acBOM-Lx8{qUb>p^x@HI?y*C%{iEl zh5tZW_)tD>^D(+v(d|Bd+8qAef3Zp3Ayvp*3Tfrz&YYyRk2b>F<|OTWoZl2)`R(ZA zE+5@|?5iK|SLJj8u#Q4r>ozEzyAEU!@m|hwKCGjC@CH7V~mfn|DWbKALB(hL68;MQ+{!5vX95_ z3p+(l$q4nCD}@_|u|s?A7n` z7x-A{^YdGUjh2Vk)V^;OTjFD>&kYm%eJt~_+=uJK^RdFmN*_rdDIcqRtoE_q#|CQN z8eQXKt&eq_%7Q3*#HMdn6q0m~ML#_i*(f>*ADWMin^pUufO!9A_2Oog_M!X8_^>(D zqQ;7r5Hk#n&`zl>Au?URML9lBoQlx$!e&w5N7lzSAKSTPeEw=+s}E<3+RSbqE!^T` zLZi@!j$72wEo%N2MNb~vqINI{eLUb}kB?nGj%`u&c{hhhII~`}u&uLO)LtJ~Yz>=! z+()Sv(Fc7z#D&u+%JeWpLii&&$)iFZ6FmEBTgv~F>JV&eZ1!586VI3c+tm8 zJ`VVJ&c`7ihq;-E{`0w7owlmc(llFtL4?6p#ZE2Ts$TYS#K$W>p4zI~Y$;-=sKYV& zXse=QulqRa<82@BNUb*n-(=T({`Q44_19KaaohjK^DQ4Y3qRrGT^U#^wB4pSXlGAF zzCT*{zK;*Mjbu?Kiw}LA;?C*gKOZ0Y_}IrcKE9=emeEgqo>sz_!ao)K%*W?KUe29) z_)4;03!WC_Ig>LvLL=Y#ILjIL@v{hdmV?6Yh5z8=M$WM93;zH9nU~1o zqK`}55|2kBSrpHP@?wI&m=W?k;kb-v^N$w`SM(KwKo5l5?7M9PVLKfw+ z;MvzJvv}c^qK{rFB38`esw`?}Q74N^SzMh(&1`s%x3XZhEUF8sl10@lc5PET%f+t| z3CV$Nss_z&56=dFxJ{kgrmoH6Iw`G{ML&_>v|Zh~UDXxgjaf9vq8|Opg2Hz3q8qZ9 zwO!ShY+5vL%Hn2z`7w)zS#+rpqYjPl-L78SuA*5KWI@s>i_f+zrkG?&dUuMS+pZdC z(IkuR_oK)CXqrW{EXr?1g{_EZQON8T#J8X*i{@EO-;5cX!yCq0WKm@ks&0bH;&F1&YqBona z9ibrtmvLGb#D3@#U!KKFcIeEiEN-bD zS(C+D(OI1{wJwYGSsYtkq-C)oi*wZ@iF%RC{%;f=7O{HS+L2Ti=`40<@jw4f<-$-NSiykzJ%W|*zV=X;DKQid$QP@#r`aw%HqK+9+GHzJd1}#jS7zn z*_Xv5LP~azUvBX+4$HDw#~$$~Sa(Y7$(;U-2lAiJ;u*=lkj1m?nvCS(ES}5aAa{WA zvFABiJ5;SD`Alr$P_FK>MX^RTBOLY@StW~?MSdiUR~Yj<)Dt_@t0K8P1)*=Ni(b#- zXclj9BC>clXXkhpZ)Wk9WOwWhn|M2mcO=`eP9C#NC$cD6HXJ&plUcl%#ry2h>@WsC z$l3WYi&Mf!jS0uSXMmRkWP%6N= zEDsQHN$k+bUs?Q<#d*p8Eyy+gFZ;DaUC83s9f~^tG2Yz#@l#?KMS(+IXK^eNpjd$7 z0rCPMK#2fvAIdM^s*oYaDo;#~7u%_>2pIoi_QplA(gDf@xGF%U0A+))N96-l5K>O? z$^e{M$}38igxPk(Ldn$uDhH?<;F>J>|08;`?4bU$@{{SP|_W%O|3=A-YlOnYS1sE)3 z&ypBTHJTp#X=mOrkuW=4h_h3T$VqApkB<&8CcwA=;{%Khu;k7r&AZ2`Tz+PV69Vk$ z8J`$nQULnNiC(-bZ}p(~WU;^zpw6@a(*rCBurR=k05b#3=TOgx&0>`Rb2#I!|W5!1d!F-9iI ziU2DEtO~F?zyksH1X#mW5Wo%K1y~ngeSmZTU7Xw?m=N3;Kohc0W;V$oofZyMN@D)I zB{74g0qg)y04qQyz=!?9J~Htq^@!9O=0=#UIz2XXX3P(e4X`=D7OsNwd6zW(fHH(JB4$*X7>I7U+q-Icd2>lutol4>V z9uDvz9dko@?OkD5uGt$lr*^4F13V^1DsIB#0iFnOCcrlVo(!-*z^7aSee<6R@N|GT z1H2^@`b>Zq0=yXDS-KtIIZj-UIGZ~Z@RUNxnVt{A-_XnQ!vVjW5aX(UNvypR;MD*x z3qQg!uNVGNNp6e0CKB>DguEW$XijqPE_E!&k8}Ai2>0`OwIXi^csIaFDSC&~ozt1K zi)S|Qeh~gDeImjS1V7@8-J70K0doQS~AmHwwSx z@QUW?oc`AV&&r1S-v;=Oo9Cu*hd&$O`v89h_?w}ao2lQ0{21UTZZ*Px;r^d1wX|?9 zev|AwGCO|=KPUL7ptn2J`G;HjCKTU<^CJ8=z<)w61c*rM7bSb?|50__(NYvo_sP2i zNdh7{gMd5x_7QgsyaTzk0PdY6?vr$F;wJMkw<1%4)Z6-9w$9t zPU)i(aH17ZQBcL4aao)=|5~Du3ev(V&RK!SBxc3=JpWTgF%^%iey9{zF{-NXlczq+ z;-8C>DoUxaRU}lDR#8Sp7ZqJqlvPnq#S1E0s3@=U<_~JAsI8)+ib^V;R8d_;WffIa zR8{?#4U5Dw?Qhs^XX}ezOIwV)bS!o>lRjisw~4@t9wW%mN8f zEg_mqg#%xT5I>y|FREy%qJxT#Dq5*%t)jh(msqPpu#Jj#Dqcwl;QrQ&N9Jyi5m@xF>NDtf8t&G9N39Im2|ioPn|QZZOXKNbC@qXw$D zo)80MkJ6KZI6g3A5UV6by`=A=A@oM!V7sIks^W5a-w(r7eBV4m&OhaYZ>t!gVx)?9 z7)2`HlX^ZV6?|94fTUnz-A|K(W9@reR{W7n6(4YXRZLMaPUY=Be8R4&_(;W)r1)6H zFS6;qNdZT^)HL#$it#EYs+gqWVpf(vxKb5CMaLiOh$A{y2@*_IF-^sE6<@0Ooc8FE zFW6;A5VUsu?tJEmA00uHX0R>E+2@FFRD7#KRiUYvsp2~oKdP9`CRE&T#4Hs*NGGt@ zY@%t^;46*O1{Mo4K37%`=5@tSDr&gC8M+FCE&ibk$5RqS~$oxygwP%ujG74nBH zuELTs!(7243MW-KoVFSYX>e6|DsHK`ts=#VtYW*09V+H>3aD74Vy%k#Di$zWRIK3o zPq(;YG5exo!&@1PXmiOR-|E#}u~fw}YT&!Q#e*miT~qB`734fKJcABl zTCL*G!a?Wx$T}74Rczs4skrKj4JtOO*d)g;&GWrS{PK!#VHl1RqST>RUA@rSjAqpt75;30~~ItYC_{Q)e}oSvGz!I$%4Uy>|<#^ zx{jzgs^Ykc6P%AKX#5{Vd_J3QS}nLo);%d3{kvs^rDs%}RdIy|bCpwZUd1K4TEzuv zcJ7q8D0}ydCy1-2#Lv=24O2pCn)X=HARE2Lc$306WYKkMEBimE4XYl!DT~-TZTMBi z9Tg8%q-nUT;x}sM!Y+;Zonz57@&{FU;+`DqyH5u1bMB{nzvU_ye4yfQ760%S#Hy@S zm4daiv+`64vJ3yJFe?Sw5FPl4hFlu*XvnJ}UGp8nl&^6Z8ggs?P!3Cp$tmAs`7}JL zA-{$Vts?Q1U}#Yxg_$j&VPF{_6xQ&Vh7KA!YAB+isD>;J4Kx(fc(WSSHPp~hT*DI@ z%4#U5p@fE#8V;pIX$|x_eYH9zN@@NO5b%xiG8FIxT~S^`1r1d+RFzg$)KE!7Wes)9 z`;o?q|BctplqfVuRMYUJ<_AAt(okE&%X36PLr_D8=C2ZphVbAF z_9diY*c_3mVM3MQggHW;BbLq)d*_HcY)C_WiqZHA!Fn1V&JiW%3i{{r91+p{U~WHG z&HUq)x5cWuiHws zyXT5-*Roz>uQj});mTZ*K2LD;De$Tkp!e9*P8wd*&__dG4XLqm5BJv82F$D7jH zmh%Md=_0M_s`-KEu`cQbhhH)CU%@ZGL_(;Ra zd1BHJ^*-i!WraSI^b<+_b0^sDkM#)h_01-opkbnhNwW0LJTXPXWDNw3(PLTQHTMY%~i)!-)HSip;?-*v;A>to2 z{HQ_Iph@A`8h+A1I`jwMDyG}dM08p7^pEvQN{+!*qHi`Wk7=`G$SR|y7R?64f8cD(y*8#)hBy_ti{vM zcy`%B22746OEfIiuuRsXZ)w}Ox{>7?R%lo$nX5STeM5igx&E_!?R>FT!#WLTHJsD1 zp5xAl(y(8{Mh%-Z?AEYH!)6UzG;G(fLn_&-;n;k!P2#T4rV~@!PMO^$DYL(Kj|}S_ zx-(zoSs?aumFSiAUyIBh;JP#*^Dvhe4F@$;Tp$ifI_cT;Mg2oZxl%0sL_W3gG&zRH(%#uOrTi@oGZ*;Bm)+KoS|A=d6uztBHw_#t z4%wy!;&(17hr(BSg*cAP-eUcs&2_2<$l$M;5l5Tx2 zjhjnZk%!_lmst!d*P)9W#PqIh{O|7ou!VBqn z7K%$Rq|@N}*TV%{q}QYd9q(KZlM|3iN-q={Izl??=%_2JWJ+2~Qi|1<+MbqG>g6yC zv`A+YEQ;{vzm7i}Wj@f+fIif5MaNYgLdVlOzSJ>8M?)RY=;)`Tzm7&a8tdq&qZ2)> zqp6OTI$G&yrsG*1Ep%?7%zRGA2dA>1*HLSszxki%TXF|Za~&_}cy6Kpx(DftY~o&o zxbs5MT1OilujqJHM_V23biAbFWvQyYj>F$)az8xZ0ikAUYjrA{`*wIdGPlhSTPQlP z-CW_--}~F?U(@lrjvhLC>Ucv(XC2*iaOcmPI=bj6J29QRak@&ie4B=?Q{jInBy`vP z?MAe-m+rqs!qkUiIrx)>{uced^o%?kVStW-I!5bwU&kQgCqi%O7%VlgJ418~DJeTb{wST--qbYaMHKtkdz0j&F6u zbyzxP>iCX2bCklOI#fCO>&K^a;0$S! zsUs@ED83f)aVVy9t4}5Y2dMEPVe3ffSfFDe`8pgODY{pOtNRCKd$J;9gT~X^ylc{_ zWUh{RI_5J_7x_WRPVrbFI)w4INXKF>6grm4;bW~O?A@%)kFo`~nJw3`LdQxSt8{+@ z*w96SmhiQ&)iQEu55r@P49h0>BOJ~3j1wJ4bR5;OQRfk|d|-{;IyURrqGJa~WRcja zW1AeH?QHk`Fo%p?qjI{43aNi5O`0B}Np`47MYNKlJjm>CjER$$7$&WE3qlK#yO?qx{ez z?eVm~b^N3A6=OWqk=H;z18D{xF_7CpgSF|o4CGxbKxY5UbORL^i~5Vj_=aL(tw`I& zB9Gzk>*%vs%&it8c+^0C0|g9F;KRkDpe!Z7kb#+t#hk@r_hNB=u_$7osDYrBVas{`^n_1K9?Ifu{|=Eft<$M!8x<*_=;# zv#pXSraaeLiQEe`GSJvSYXfZzG%?WBKyw2x7-(kTSp&}*c;3L;Or>E3<i$lbt$ zJj%t~%BW|R20w*c7ePVCECbA2$O7izvIAD-C-o0}Tu^@RotW9D)y&_PLd*w*tBE27c-o ze0hl|(?x0eATZ3pa0Ble7-isX10xKKH1H1lej_mU-@yD)O25pEc8@EC)0L+yDm`9N z-ZL=T!21TqP;(w-w!T_#5e;V8klC_a|0h4_}IV%0}~B= zV&GE)pV3r0@Xx^R+{(vG#PmVRm)8SUK-pVV=~YUZWMHy^DF&t*_-={#{2k?VJ|&(C zeSbHQzp;{9BKEdWzA!M|z&8fIHSnc@83w*G@HH*(s8pO2>iSn8^-ti+vr6QCU~7{w z!pcmlGTW0bbD6WwM49GrX&m`IiPHg5t3KAutZ!b ztn5uwv=K_vp26L z@m;#a;4U33V=(_77~4|06;|$d48B@a`Eq@z(d)`e1FH;dH?YINY6EKwY&5Wm5pH0e zf%OJ97+||wV&V2T1B|p;k1GTEE0rrN75)lrHn7FORs-AU&r*ufUa>Njqs0`ppYqod z(U}{~ehTj7Vq##Qf&G-c71(WHkAb~hWR{AjODoCz%A&`WjsFBLJ)#^iaL~XZ1Bba} zHC47&R_?V^&U_ynQdjw=UvPO)(W@xO3>-Ib&%hrBP8c|8;EI8(22L3`ZQ#6t3kJ>@ z$W>f9Yv3GXJ6kdS2-F^`oGGK6?WA~(l#2!~G58JqY=Bd~P7~$VClq#YQW0g%uYo6r z1PcxiUNi8Ef!hXtHE`X)4Ffj~+@h1)DVM7%muo9E)`gv40$&aZ=DQzQ)JM5v;I4t+ z4E#-Q`Y?+u-hv44g6^!-2_bhW#EB2z=HhRnf{BVI%9L4LJnY0@)@w++#ZU?+XaY8UAbF6njx$nRX}8>u#Vi zonVJQ7s~HT#l;(eslNuAnRwR3^Cp^`cx;(qFh56owD7UM!HqSP7fiG;@uG>ACI*#L zsJZGg!RY$BhO(!+!u62MHYVDd=xL&tiFPL1o9JxfO%pG1fJ}5U@tTQOOuTBMgNcr^ zcU|i!MFuFDU4vZ)DaG3=*~REnNbUu?ndok! zD?MLM;j|((dMQ2VkcWYCe+G&_474ev^fu9l17~8GiM}TKndnc?o5=MyFC;=@MDXrE zfq^t^nWz#{hOkExGy9f_!8w@gBn{)LGTg-5CPtcghvE86Q7;VDrq39vy*gt`CQ2NXXvoFzC6`C~G#0MN%6N^oZGr2(yvrYVD;v*9uo0!gi znfS!SrzR$wm}25H6XQ)xG%?9U@2|rBmWc`M#WK;LmO}aw{ogN$LBW?AC{s;LGx52J zFDU$Nc=-rratnq0L_?*g7QFCxVA6xY3=?0O_|C-lCcb7DOnhr%CY|#j@KQcy(g)${8lRxf`3D?A26Z1@XCQ>GN zJy0&&zv`$O50lQ}OblgA3oG+E6SI{CCKhu3_6=_OEY!Pi@bedyp2d|los}gfmYUdY zVvmVsCYGDnWMZ?46(&}47MNIT!dWI(nOM!(%gE^dhQjJQmI>l@Cf1wSU}7Ufv}5qv zuYrsf3g61%8aSh#a^hwG@@b2SttNIdm_Jaqnb>Y(hlxt}13#2eI@MK{^$GHtq0k=z za(0>E&veJZ{$jh=#6A82UW(9>abj{2lrygg)nrQd} z2V!RUqKQi!mvrT=#>%|jL0&RdZR4;1S2(679&kZ6am~apChnQ|gTuE!c-_P;6SpP4 zVdAEVZOGVnER97sk@2gEI~+l-bvzal8JCucKbHv>{br)za_)`vDYN$}(>IN$7^NLf z`%|j=i%#q7D>>OW?H|cWi{gd6;H;hfS(CCD#nfhY>*@C!+Bp?2so2_{Mdibhc^ipP2JALX`8yc@+6y!eme$tbEv zQ8J2BQB;bea@7A5R62@s%SE{;%0&HJ3jCv2R)Y8bh?JKCl&KI!MTz-eiPQ{V2jwyb$&8jYOizlEyqMX@e-9ksw=AA?eeS zHk6bGPyZslk;IK9ZIZ)pDnTDB4QUTGBR> zQs#{xeDm7LY| zQfm7mis=&n*VC_}_&SOoSW(vfCW`N)m=(phGCNbo@OL?NS;fl|3}8khU%~rsxtJ}B z)Tn<~=cg!+pGe~^1uY6)@{K4=3I20qRO+N*u_!#*7n>D}hc-vCC5i-b6i(ECEp%fP zn+PZtMJkH*%f(8`pCj?yDCR}M_eSS)Hc7A`iiHwTlKe#yACq`V6icI6CM&Xt0?VUV zA+tA@3uaeQ_^HV1DAq)=Hi}#;#Clns!s{g1a3Hurg3>E|<(Vr)^A-M=FS@M|Tcg~e zjeod&MX^1K9Z{T(;#?Fvqu3S2fhZ0}u{(-AQS6KQXVi>ZA!e-*dujFxu_RBpSf23y zC~9Pc_O9?hKXfRH!}MVkC!*+HDzvRs=tvaTR)|Mdilba4SBhhj^6P;oqlgAWr=mD5 z1!^gw(kr<|9GNS9J*>#=`6w<#aVLtqQCy7TQWQ6$xEaOeD1PR=qlT5@N)%$Hcx9!y z8pU^|Ld3&Yifd6!mdsTv#q}si$)r8L@+fZ8$d!Ty|H|b^@xOL-Yo+*&{)ys#6o1On zdt9_vi9ckQDNLCPtHebm^j8#rb6Hp=X66Y$h$13Ezg52ehf$=(P%?&6F+37Ot{C#h zkS~Vx7!bpnpR>NSBDrJ!yL(J|Vi;mZ2KCAOWR-v9*P}7ykKwTxip2ag&70)8`{YSBuIqyiqEm zuNK6USBq-W@*Ar~^%$OvVd-k|&%^rrSNq1-kT%q0f7gi0YlIR*FoxITcq5LC7(y}h zjGTjbi9jEX>p}hG)oJBVJk~`mPa;W$Cyzf-=owXk08z@O+GW z>3z)foD}$v|MeQtB8C@ZXicl6LJBjrjG>hj8!W3+*jgjnN)Aie&`UAA97ER_y2bEH z46nw}A%>1IP;8adNwH2byhi7*6>rLlug7qEjp!`#8!;T07E&ztT0xmEG1OTrTC5e_ zrNHR5qDKrp*8065rUAWU=o3THIEuy5H->(Us~FbC&_9L&G0ckLhZqLNFeruzF-(l% ztr!N!@IegY7;iCukK7nZhsH20hT#&AmXt+r$M|r^ml-MPJ30J!W87Qr^WT&7i?#pT zTl>Dua(~)b3AlrI(5Uc-F?k2D7}mcQzPBsugHfT>$k698ZdS+Fl!;-}S}~oW`%dVq7`}|* z+*-jjLxP1#f3M&JY2LRnd{5yILo=mjZm0h)2b8<)?{fb!hS@R9i(!5YKgFOj@?Q%( zF=!0bu~`-)uv0*f!HA*oI={ar1=fkEqy#Yu;tZQHS*_RkuXxxoBxJ3mq;v(DZVVoW zV4aw_PNZU(6T{pX%ynYbIzj5IT_?s34KIjcQ4EV?*!xa+p``TK63#Md^XeFu#r(H0 zjLQE?pSScyJ)a#9Kl~+S|rP_6LAgjdidkh<5*vLqW;RGGR`5wao4*jrD zvrB<3F>H@vM+{qIV3uhc1L++f?2KWTWbTh)cTOn{-Xrl|N%!UO%dYqP!deGoIK&Z; zafdvP#qiv;K#?I?<2!_p#!z>?za5&i;joZ+KXfvNQyeu;d4|e}tkWEbCgC%jfa^v5 z{{EKQv$F4_x$`rIi!}aSet~h>LFP5(t9Ix~^j}Zt=STFL#kvEP4 zam0rB+dDu0D0K3@tbB1i8ppoN0pk2|@NFOh8dETiLU9z1`&)>q|FJmsuNOrmB^W+A z>+v{>$NfvSP#jOhQ6i4Yaa4(O|36B_{Y(Awaok-mO2<(qjBtE)i|ofQ8SLG;wZR56p%*;JQ+vzIBH0-vZFKqJDWW~ zRkJdKlF5n+E!p5-?`6m)+U*YWvN|*%CC6nt8Mfs|$&rmVDYt4pXBznn@0EV`|tSn#9rc|I0iZ$8)mo^KmqfqvZy_ zB9s0g(rtria3uU9nQ^p=!>*e3avZP3(K?Pc9J@Gp1>0VFshy;B7kfndlFUBwhyO+9 zS0(NgM+XTyO8VXg|LGX@za~eDm``>($1y98AK1H+p*Q2`5=U2#P8{9i_&APF;^+}a z&p6(WV?-Ri=)*V$#qm}geYp6?F@J;T&!}J@2W67>W6Vgfb%PkdRyK%%l0z^!j?){& zusF2dSwrF&8V5gAcXVLp?G1u-IOBYyAl`5@JTi`V;ussp2XVX`$EY|)$MHVHW}|pd z+F9pNc=4c2X2-o~^8F(Hm=aeN-fMA^zD#!{cGFMDQjtITAHnVllR)HphA6wD6ZD87i}%Q$Al zK|Ebj?l7Tp+Uf7N*(kn=`@_#xaksjw8z18iyB0Dvo#@7Q-Ws1Ow?<@Xd~)io1jJ zHi~@R)A;F}WE?zv#*y?{FXD3eb_EHxtxTU2$K1I8d7b@-vc%5d$zEyeH;M&uER17S z9INA4Bx@~+V`&_VC8nwmcLtZmv0P?j9YQN8e>6z`(T!rI#8gPm8mW10PP@Nv6ooel zifxEvV;pmwnVTAEQzc9TlZ$N74N@70TvUdoZYEWyulWI4V= zSmm1J{2IqEaa@;%-5^IYZ^|rXZpATVlOR~REI4>}I=jHSzs2!;9RJ4gPzuxjdvW|B ztK5&{FUkB2h4XI)l#Aen#1@s9-G?C_aPX%=!>zO|27{#X+fv9rHOWv5FfEaa9T zkECp!)gQHx-$EG+Wi1r2eD6JOp}2*D5*Lz^g{8K~B&FIS5)`#iOoA!0M^8w}k`_uy zP(so+&9W$8TH-xRf{E?^5SO!1-a;)4wJlVzP|-qF3)L)CvOsy-{LHdoWr?du`k#^~ zEmXIl$QCJ6LxQKI=9(7Ln))M7hY;;en zXQ93nXdr1=(ku%R%bz}P?h2B!%725EElY)khI1oiHk4V)u<6DYnpoIrVV8xb7MfWY zZ()LkXDvKup|^!T7M{1z+(JhSoh-ayp@oIE7TQ^O(ZbL3vszhbZK0*a%$l3TicMnl ziJTq046RCaHz47W6_Hqc)3A`(=-9m3et;=&Q|Q zY_E(S7J6}X@{1vbGI~;f-;7~BGg6zyj?JR4g?<*^rhhE-r?ssz2U{3oVSt5!7EV!! z`jbN+S@^`lrxrf8@I%dv_WiTT{LDhUQfThf5Igwo`Yd*KqQ(Dla4fhMCR><7VGBQ6 zm}+5~g|97qW8rfPUs#yIaJ?CsZsAJ~Xz7eGTf|$FL#1y=nDX9;e8q}e#L_K-GT&O5 zX`xEx&@2nzu@@~fzqhb&i)e8>!af#VlSO>DQs~AOF`J9O1=B**!lPS-%28loY!%hE z3XLw>Dw=E+{rhDb7G~d$e0n<)qx}|ai*G04_{7l0iXn^ME}JoIt6*S!u~qz3H6v|9 zR?B9-H!a8p1E>h_LenSt1aA|6k5YzUX#V4 zSu-S?j%7Hlx3Iy&RyuZYHiv1Wg-sSV(|}(i!|p`3F!FCl)@~KY+219RD-%N7ENr*% z`&LnKo7iEYNHuY+Qiyc7g*{x0Y!tGwm!7n6ms8lnehUX^xrOr<4q7;5;iQG4Wit+2 zI70teI3dGqO{LIL3&$)>ER;d37}fEGSv1=koIR*?#?%{;Qx;BJI3w$xl~XMLl+aV# z#JvI8i^^tPuyE1BFBYydybEPqvT&KvZsEzE8Bg@eXxcLKiiN8du34x#EA+&Z8JvLq z%80SIBF(mm8}y8YUoG6RaEmi;o4CymE{^=RA&Zph?3ygb55sB1HZfzH_}#)i3+Xms z;|~k>E&Ofa9}9nSu9XpgF-o_I_>IV&n~?_=zV96B%@_T)iONr9{L9tP#v?W!%HX7` zQERgD49MQJP2{pc%8xa04(7J;{=n?C?INFzJT`XEPRncK<7uI@Ei*4|6OY=+Z==zq z5GP9k8>Bs3W!~266}IshPe`y)-$oG|MQv2IQO!m%8;{#4YonZv;x?aqV(aX*Qa0Wi zoLzRiC}E?djk?>#yeT1u{gz3g(l*N2cx_UM({@mWtl9mu%iCzZT~xGD$wmd+j|WZ` zR;g@b?SSl>8?&m|=(}Bfye@0Zfb17v%zV;DbsLI}pp6jcgm`C;IDW=CqKIm~;6VI?eVMmZmlu+c-Ehy9p&H zhOTZGT;e!QIAvJ+X64XxHlDZ9(nc#A&27A3gK_wx4bI#aHqxtSj9Q;{^q(NJxvFLS zTrH!ujW#yg+1QXraI&{$VC)dTP7E~@)N*%)kNNRH$P8$%^-gN$J|hO>{zV0zm|(;b3fq>XnZ z^IaRGb4o|qcu(T^x0x^J&UinEKgPybi9g8UjI;5w)bp{8Pi&mDaf(4=<1-seZ7kzh z+n8X(vyrkf(Z(bjKiK%u#$+2)Y<#^#d}m{-jcGP!a=yHm{W%B7#ta)@(f`*1)9KZG z%9l2J?+~HE!RPBJxyma>r{LE%)-{ZLYlHY3N%>ejZFca&{P6ob{M+5%+n8nhH|J}A zkWI=DNw+@ZUsTMt@skZzDo@x*ayC5-Xf|}oVT*Ch?gY@N_@8!K$=;<{mDrHxfwSm+8HtJ&G^{-xIj8*4aoxe9d( ztdn#-$8=QaiIx7Hu`XQ$8yV!w)A))?#`|gCjP}po+`>h}#x|}4JH>VzJ8b;*nL^ym z4NYDaA>C=?;@EWJJzV^49Jg_TGyQ5{pN-kmLe#Kxg|gqq0UHEN2PHTp>0wEaNP5)f zTbcip>ATbaNG@HppmnffA?37yxAE-^W$X3OH5&yFD*O3f&-KtRHpcA~1P`|=H*9>jQxM#m zn7yngZnN&h?D;$W!|m_T13Sg}o#L*IKP9*)N9Vrm<{w;UcZnv&!~8_WpLC9m2R8oZ zvX($*0{__f*G9zzDkbpHMq0uTj8X|al0dEm3MEija?%sXCjlhQ{U7G}KMCZO`00lJ zhL%Sq&M#?!9GQX%a32UunI22v@f?1U1d2*rEQg~{PAi^+pOBzL0wpC_Gt@t+o~g9V zmPw$j1mz?xFKGoyDKovTQaK0Lkf4gBRTHQt!IL?q)f0GSvVXc!P04vm(txB&j!ZCt z42gGF@q1A#f!YbQN`QOb>LgG%fkp{5mICz>XdprToVwuzA~`rKfti7HYGBHiOp(CT zIi(E~ct+xGqyFcsCNlfHq)iiOmLvJB1kXuYexq-E^8{Xy*%mo6FDB4Z;?^a6ZQQZb zd89Icq@TVb_wDo{DR*uF>99? zB1$k}81l~?y6irQF1Vb@bR_}G8cM=#WF?WA)FW0$)q~O%CT< z2`V&8`#ynL2`ouqX#zha@FVg5>|_G76Zk0sU5>R%XYLl7q_f@@#Gmf=DK}3V3783g zziu=qLShNTCAK8BbNGn_>>++oISIH_zFT+++}JJh>=CI1mhBdE5}2F7Jc@DklXSkM zUY|5_7E0{@E=aIg(u2E2?-HS939LzAZ34>^SdqZW1Xd+b{Y1F^{cwdnBD_be=Cs-) znC9*euS;Nk0vGp)^b(<7d&GtWHZgMch>cvPrV6Gp6x$=VG9|E$T~4BZ65A8lkwCd5 z-x`XKu+Swv2^&%*4>vKg6uS_KInCXkjy zz9b$^;t~4up}%zGP9j$l`}d0UB#^}Qr|R+>E<9H}wm&kpS}0Evd6W3KTBzpKG*XWH zFMCD)Bnl)^Fo~=yk-|wlmIRw9BuHi=eW`@fYHlBk$Oy(H=6tFX=y6ZDZjo9`fb-aWeZM<1>f_kZ?<;YA< zVoDBfbU;j#`12gj7ZUJ8?bI;*`N&sEe4WIhBo4FJNqn1xlZ2bZ%p|@`!b~EX^l!#~ zpF~Z5MCfW@RuVrjK9iW8#7{}6NxXJI)E}c493#iK{7Lc^DjA= z{`xl%OZpe~JpTRjcqE>L#o3WW@^ghL!7#Y*gCPe*GKmQX1c8@CDv5;*U{3#QfjQKf z^gqv?I3VUGvG0JGm&AN7ywkJ!DJ6bEiOSnd_XC5c%`cW_FG*r4=YA5)+3O^>C9xuj zl~UVANmnJYP6Fy*oy3|X*2?Vgw&_Fm_`gK!Wp+ajlblTwZ}1!P^?V zg1UASkR^;&Ku{Cy~FVaz!?J zRnj%VjN;Y(w|lN9aU+ReleohOPx_y2x-C`RqS!%E_MoVDP`n|3p15AwR|9vG_>Duu zpw<0Tc6WA6U-)i=dooM#XA*xU@rQ%^4jv@&cM@+p=;HVb+CN+s9aMMlZxRoaNOSOr zgJKRIcaY0Lx`VpEXB=GoL}?@`vrQc| zbI{g7I|t7?c+SBK4q7-Elq*>Oka%8#=8}@r@{k~X(LpN*ttGRigYJ?^ej5&f#1wn? zkZ8}|Ie67U2PtVD68Y1EFFSZ8M_Z5dU`L5xm$Z|E*Cb$FYFlLl*! zpqqn*4i>Rp2R$6T?_i9Bou8-mbTG`pa0k5{TskCrJLuz}uj5DcAcv>opq~SN6Rp3b z1Oprll=$R~Y-R^L7$P}C9sGGnkVAfn@@A_xr3wwhjHRyx&zgL#u#%j z!@+kBzIX7IgRdR@*f8T;2mc&bmY-Bs9v0s?$UGBj`9j9U!(yg`zYdEIsxr&L51a*G zDziDtUn>ObepG&RaIJP$u_I#4kIGLp{)ix7XV@GOQ3o*x2K%*4F&&INBJ$5xrmR%r z?C%k=;fSzl##+Uqc}E1ni6bH*g}3U8>%em$j*0~iQk?Hc#assADrJtuC!fzCXC9-P zvAsqqe^j*E8e-{?6H2?IVzI*$jj-Lp4hKseEOW5R!D~`a%R{34-}i^UAMl6^zB|cmE*I%8 zo^(;2r7m*2c)~>q7kOOdby3tsF&ER1iF_^!xG3o2Q5X4L#AwN?teFLaJf&*wF_HI~ z%t9_s91~21C3wt5ksQv0W8!faw+3Wn92do1|2VIb$NdAWS{xT8U6gWB(M2T}-HwaW zF3P$1?zk9pT$FMB%e=BK`pnEEDDR?zi_~$k<+wO=T--k{Dzk|bqN}cJZ%uB4+RW%fN6 zqjPXDuQJxf2QDo7(8V|xAG(;~;wu*)x%k+{Bo~wErBmV)7oWKp?_yW0%uikL*(;x& zjXWhLxIFX>(@qH=Uyt8iN{WhyL~ghcJYmiA6?9L@vV!QE?S-zvl#Fkm#Lxj{@LG4z=wvx)BeTJ z51fEyGx(6J@sRAXn?k(o`H6=0%}`zcSx@iNLZi=53*ChwfhlQJQu1Ri;u7tcb6g)Tf!D;INJ%ya#RvlJeETFjvjPYXVaY%P&po_@=Iltgz;$@6v7pq*XcCo_6N~VF?znu1;X!F7S9@(QcbQFVgS^7Ha zT$9B<@)wH02 zo*9w3<%~Gap*bUtNjm3@ApZG`IOXEBi!)pjM`Th7#Yj8sOJh-|5t-**TyQaAMCJ`f z^@z-iE`D}#h4XY@+9em4C6oL!BQmM&s*7JJa7F}2WM1Qp8<9!O((6);`fqY&J}YiX zYuUN{5esK!XAox{xZ%5aQd6+q{Tgy@-Xn6c*66~ zy)5A&a!!=={IfKfZGTRb_E1I^mGw~0gL+PUcFsT0jG(;CR`5_!3XsDpl|5APP}M^< z53M}3_VA>K>K?K@H1JTvLro8LJk<5@l!t(akcWwNLrd$16c79?T?YH2^V1hTQ%YkNG*C!3%ijc*g7SlB~-4^+aspSO!NZxe}lAfMT655mLq9-6b3hlU=S zcxdY384t_OiN+r8)D1O~3LCeNP%X3n>1^gi z(!vAj)pMeylvGw`9j_Z|J^WQC^u&2V+SNlh4?R8f^3Ywj-a{Hg<+Ss4 zX=-oTZXeklR=KHV_m#>k>)H3)Mh0;7J?xu<{c|wL!&@Huq|i5o!5)Tq@I0hE4D~RK zL+s%L8q++Dmx9ARyvn#_XEyC44%()ZXN7!UQG5d#RCBouUh#n%U%yc6!@G9?W`{(C1(cva$bDn;afJ*J@gfIo)=%! z3Ee{kR6End_mcUY2jje8S|uBr<>3d(r`V4kX6Ilwp?T05;dz1=sS>$ixB6C4(mUIi35ec?QwJc@P4rv?B+v#DK z!~v1H+e3Jhf4_8}hy7f>QYezb0S^c1A`jO*9P)6ObKk=i&%YkNpD*)>hoc^jF#=13 zE_k@eh9o{A=}AdXNqSn+Gm=vHtOVygoR^?+GLy_Z7lhK&|LWx>50^c(8JAh`q9Dzj zqV#XzKP}?Dj$b@n=d|+hz{3sCzZr7N^RN1|vIdCFc~3f|)a>*214 z-(>c8cA-`#`PZ*!liv5x^`d{l@TZ5}Ya@wtLFVX-z72nS_*ZKFhu*#@+>2t zS_+S(kShhGkUIswT*lYO(o?whT;^ZZ{nyR%q>wj-+ZRPamX-`1yD0KW@MsG8B`A;r z-+*Hg({$DUxOt%z3d^FNQ`49&nnJM@o=%}*3Xi8yJcW!DLMc3vLWva0r%)kv!Eb4(>>iY)04@FiJV0dCFh*syZ!j}|9t24x#!laSFfsG zy{hi6>FM_3buapO(btRKY-GvQH|V+-!L0Ac=RLJ3ePYpu{k$mMJmXCURq-^oC$=j6 zGa0G=UJUT!DIcEpVW1a-=+gYIRIdMCyz9jZFTUma@5K-=W_dB&i}$=3N+V|)PGzoG zc;AZ;yci~~qxVJ#87}d|$5%#r@u3&XW@dfFC|c*D!YD6Bd-1UsW7tP8zVPA`FFy5R zf)^9LIC3th*vj;ZEj*ujF;+~C6C5vi>aPa0Fn?wG#?cwy-fh<6aL$)rOk#|AF~tk( zxbn;Q>EEtSudU~#tV!=R!+rK-GwSa;u6*UiG%u!mar(G2!;6_-)HtD#r<_nonw(I+ z_Tn2a=6W&Di=%bYSItc!&JkX?V$=CvEbwCKqpmGzw9t#iUM%tA_{}DZ7&a%A0VkBt zPAKL2Wzgr@E7F#E!GUAd%e|lz_|K!2Uaa!s55}q&-+A#pTkA#Gi`8DN@xt$g;l&SL zto7n2FT66oKYDS#t+L>Ry?VU&n#<<}Ke(oOp;P&U5?zu#>N%y|!@S>4*l2R*-pc!= zj1u%Bz}4eH-u7Cqe@`epLSEcCp}f;xiFgt9;%6=nUc|hJd$Hb&4PGR?NHT^`DC?-O zB)i;6CH|=Dj z=F&IEkaq*yn`&HN9Ui`z^RL6DHi>y;h z$5YCHQ_3-s9JZQLe%y-_TsghC?8QkhPI+;bu4e3=QciO?PAO-&Vw7<$KBf3yaWP4L zUL@`BG`u6S{kzU7MK#WgRkdvVi?0;iQ5?Aj^i>?!4L$gZ??jr3by+~$&a zTH&DFd`@|7vXXNr?;d;M#RF+x?rFOt54}k7A)gP-eN^xfb~&x2`2ZjC`%u7#$9<^j zLqQ)3`A~ZhO8ZdQXTR99sL#HhFXF?1(+UrM=D3&-#eFE@!{?`!ekr*nefE~`veQZ_ zA?2U59}J)y%lJ^%hjKoIPAlboNIRoc@L|Vk<@9N#q7RSxQ00tL$%hVSlzwNF%95m{ zijb;;)dZ{iP(w%-bI&NX*gT*815Hz(eW6mvhx%R9Gko@I>*@;Dqr`_N*my}c5^N|) z9limN*w_b`NYVw{ZM21%H0Xod2agXM&L~ZM{C1ctn|||Q_8DdL8HGubwP%!E9}b*R z_MB==wPrr#`RpG86d#`Sfxr8x^y-<0e3c53N5ch;oBPnh2a}#Gm;Q_oEqxf~!*Cy3 ziEm%>p{Ebe`q0{kHX@tX6?J@= z<-;`E@nMGKQvcD*Y>6z$|Lox^UfPhn%&fcZWw@ZozOR{OBfhebXt z_hE$(i+xz)!%`oXi3JvX)EAOR#!0@FtW`dI=fg^=f;NXqvq>Jce~k}6_~7$F6J?fN z>%)&e{3QBb5wcTF&nj)t+TR(}MdJ6taN7KTejo`*R0jn^K3G14eTew5o^$+R!wqK} zMtz9;knkbq!_dZ!CN*tzq-W!OW9_&1aCRhpSjQkQ*NAUZByR9wqYs;;?9V>?DJB}( z?86q3kZ<*&+Zg+8PTM5+7r|czsr;Le-+lPQk!%;TL-37ujduI6hpU;6LOS;Pu#eMC z!w3!gIdeHleK_sIK_3qJaKeX^J{+d!cQr0m)qacApFSM%;V&Ql_Te8Nj-Gd`U4p}K|| z8qWD}o~xpUavCo9aFNc`kYB?kA1?cF*N1yPT;bIA;f4=4ef(@+?loRS{gHRwXWxsx zuq1cz;@s%s+!c#+Z~1Whk#KQt`<6}iEzZ5eE-cO^q5gdz-&&6p%`W>uEbw}jM?MWq zrfRk|W;GkAq-h{Bi_dEn&`?Z6aSa7E6w**w1BE<_3MrzYaR)oeW5YA)B}7XvkHHlt)gM^!3I2r=66-q?6Iik zNQzf*J+7gqhOQdAX{e>4wuVj`I%}w-p)T96Ax}d+4fQp+HFz{Up`n2Wmxgo=>)WO` z)X<2H*YN#WWznQ2$+OD-v&x0D3P}cCq2aBz=~)_>mH(WrK(#98l#Fvqwq)gM7(Iaq`WO*I@4qG(VxJgcF##{YleDGe<&JVXDpFX;-~&|FMSI;Z$Lr4w6f zcyFp*Q7a8>#?o`Pj{ls}M#FO&uAWocYiO%s>p6u-I}I%L=Q$;>efq$UGCFAJ$k92k z)IG1L=M{eRwu{F9YNbD~;ob8}_wx$*kac;VlWTZE!z&tI)$pQbpQL(dcuBM0>-B}6 z-c!T$3XNXoym+fI$(5RoT-6%&(lDq;V@h75O=@0H25U&$+qk!eH`xW@Z)oTvWa)XO zuLg|H>!-mwuTbr64gEC?pDDf-+LWhZ=s;;MMSvhEW=pXjrOYG<7tL z(=cAc7+M%-Ps7hNd?Nf)7P+8ox?sPUnzt%rH5|TR-@8rFFp(8$n8kTfBI9!nUul@8 z;R_9)-%sc9rG`lwCUaQFrBBf?RYTR18ELJn z>Lula%=CM+Q+8?Ct>Iq{|7qBxVJ};CAmwij`?&aPIH=(evo0wIxQt9mnLRsWXXSJz z53^I374p9{{3-m1;3FaZU+c1Rl%A=a{*Q)ZLMY@x$#D%QxVCeZSe1TK@U-A5!T;oS z^vpV=;jBnnUbbJYf1WGGxh8yBJ&_xpmo(haa8tu&S^c;GUg0|6@M{{bJDjh8yTwrX zD*c{@`xI!frs)zMT(NgbthRM1gTM`_)Dima@T zayrWB_FV&ys*g4PY;8I}#{JS|r96vYwtv@qOt%BIk&g7P{Hh2l>!_lms*WdgdyN`i zqER&+b#)vbY+piG*HJ_Cnf17knu4`-)D}`lkeVx2rq$C?Uk6`n+`3w$1DTEZ##EMS zpksH5Mh$fwuiA+3s^udJjdk!n04_E_2ziE%OyOCAZb6S=wqTARHJb?G=Np>o$kWkL zM<*SM4pp}wHRl!elRBQ#?Z<)I>3CX4a~-X8JgcJx)dEd(e$H*FV{@(aX9R0B&Ny_j zvC%N2wT?DAhFn&j<0#Zn2G+~?wpM!I^o+JT7IsY!)y*Kbr_X0K>L5t_-bQ|M>=}x zctytm9Rqc|Dq--tj@~*pURGYy!JlhM-q6uU$J;utTvqz(NbYG`bZ6r?bsV~^^b_oI ztT82TvDblIlK#B@P z9q;S-fbF@WFv;VyE6Q-mntw&nI^~uL@l($5I{3=smgd{8+~r9qY$r ze4=Blj&V9-SCmf~16P#K7^`!e{+GY$*(=I;I!DJuPKv8a#jEyB>*qSA>-NoTqpQjn zI=<9#vS==kNjfGApW;ZS3i(QKn&7d`O=svlXW7MP>6oWuzK+>C+Fn(@7U4I7b97L% z&sAkEJuj6m5cwh-bj3N*yb7^y{Lmy{c@z zsvNzltfD7%tkLnEZa<0ly&&b}H?Ar_==hNn>YB1v2Ol`$)Gl#N`AHn0-x&UQ?cFld@4J2DMYk>i>ayP=fxqr4yQ`0=hE75u2^MVOv?^LC-AG@11sp3c78_IcKQ(iiL*R5%FKWeg6h4dPt_P8K7sM&>De*4{D zwFOD)u%N^1`B7i^6M_u{8#=jJgVJ4or2FCa!{bM}QBC+(`3%1u6-Q<@%Jd`4kES;i z^5<_T*?zozL&@_)@gv7?ucA!^Nph*?@MeCDxnW<8bGOJyEi z{g`w^>ETB=shYKS7xIGOi-LTw@=H>-Cwt*XFX4R!U-9ErKVEYzzaivx!QO&AxAt*z z8B6_yzv)Qc65j?YLg{56yhUtaE6Ob8tlgqKfd*2r62G4G1QNVetho7 z`{GqzFnqv*^6Bo3yu&R>BonDeB{R{KgNkzY)@u?r5Npg(fCxWfBa#`GH zm^;>w@C}7WmlxAEvprq;F)Z8i1VNGmH|%$&Dfx51@Z(EA_~Noj3>!b@_%Yd!{I55e z;>T1!zVh3fjWhh1>BltT(*;?U@>#-3X8Y|o!jbU!+EL(wJlAh8(F+9U`SDYql=+OM zwf5^o7K(6@Aaxe|vBYoxb!e&JGQs77D+H;-+*N*j=g0S)zkd7^vA=tMAS0a@kQZ(! zeAsf0A2Xh8^n)L3S;WsLksAHv$CRz<1#T+jBwk6T-&Ax41|9e(#{LPz57Up+`!RfI zZorSAA0Mp8u=NP}VfhgcAQ8aqI;mS{xx#)#{D}Gy^MlFs0OEcmXs2Ma_9l{ktfMmx zOfsXHyRuj&F^n2Y|kUJ zv`li`j}v~J@#CzYuWG@%o60G=j@`MbT)(N5yrn#9dHq{o(qmhAcZY%x9xmgPjdWN{>wnBeq z8ekP!1{e|)u4B~(x?E|%A1p}QCxD29R~UHS z;3w+P!9Yg?oeXp~>=?iug+s$4)$S-w?HBE%2ESEJ2za;d1_#pa3<$>Y)H%B8dzyy z6&rI`*>hJpb5}{dr_h@BdV|#l))>$X=mvg}QswU{KMGlEVCRh-w&y2DccPEVjylH zVIaw6fvdfNO$N++%6bDE4E%jhVH>vIQz*H4PuXl>i-E1uuv5o!%G_5P-M5?cvr`M( z_N#&44D2?rhwGSuKNz1K8}2f&-M|h5Z23;M1`csp4eaN1 zXqQJnA2877OfwoeNIzU}z=J;gQ#jkkQgji8e;YW;MbAVf6aN@E#(*?%!9b1M4gNK7 z!oW!b|4H&VTRYYL%6(L}Eq5B+XXHOnir#H@HIzfOxA*6ynCSVryVV0F%>+zz-QBFTY4;_+iJ~To znJ8eQpov}<L!HdSG{?uq2BJQvSgMrMMKKwGu*Tki4XcQl?!6ix6qKjES-)%9$uH z6;%+VoC*~kzVv}o*+dl+t;JMT6V*&KF_CMcIwhv*P*~lO2TEPm^+2JQ>Y1o-g5;%O7jO{gMy(!^6H@*XOW zs_Xht;lWZZOuYNhZtXKBzIdq2lLoNO+q>npl7i2g(4AJbG4Y(#-d3=k(-O9`gNcqN zIQ!+BgVP^>YLZ=e(J^CyxxqB3GTio-Z0UJ=X3^XywggZs09UcQ%?}cV0@0e(tqSEraCiK7Vk{N*H)}M(-8-K;BA+_J#6*)Hn#5ugpL0-5 z%rr5}#Fr)}nV8BcKuJC|)H!dmi76)5m>=b2bwVxfsk`PBI)3Z>e%ze)#BA3Oso~nH70&bwJW8I z=(-cB>W?Pqx|xIAJ`}GFGQ~yg--!XCyGLqBOLnau>jF56rT~Lp3KusKzvaO;1 zZQ>{wf6f%xz3AE3o+IoaJ@BtnJCi3&oHUUZ00KB=;gt( zP&iOw9Bd25lujW@v1yDMGGQx>0Md1he)$+nC zP*eIlEx-C*ezj5nl>?|5KrP9w5$xM{!|0_>*t&& z*{Y^_EkyEE0AFv*S-r2>lFoT80(drn)&Y<|BiK@~mEfy`+-<~E+W^|JM&VpcXqHEN zNp=+MAh;|y?`5f?O90OY&^Lg70dx(ZTL3)+csYOzrBfDNPwgJS3jw?sz!$l8=yvOz zN75s}FTL6lS|Iic;1#j?2FEUd*Mz?wzz1Ug`62EpLVC0Dvfk28A67cV&0fD5z*_;l z8^GWI-VUHYli%hHblOkN0b*^XSQsSy9YLC6ABV6ONxm1rP_fA(?+3t+Ckm*Ukj%No^RMb-T^7Ld09J^+TQ__wgqBwZV2KX-4k6!5)(-)!=DfJwY>lHyQ)>hG zF@VLln{DWAN5W6!QbY?t4ZyD`WVvoSgyuCduC!HW%EK{}I6U0Cog0Y?Ehbm7JFs zxjs4S+9k@n1@~~-31D9U`5(`jeJP7ZUZ|9lz06a3ou|ydnFj+n6u{vC{tVzm04D=D z!YLf!$9Br4RWXh%$)l~S~Mf#DkSToi+kjME5>UkTu905{m?<(>^IvafMH z+?RQsVP8mPlDy7Q*WGthS@w1ScLFFCL}?!DJa+?l5WvF#?ujeza~V&%3h!`zT}Vv{ zB3}@xLEISWqOin8_j4;f$M$D+8}3RA0zu>t^4ov>E-*?45wDojR1fkC#kSM=Lz znv(Q%9GqI0^=`_{TfCqA7AWgM71D34q{9Yt{~EbcqxdUL1YAx z8N@R|vAsjxO}%2GKMKmCX*K8M{`_tpu^I zQcj-mHtRj3H+z^&J(~Iy3s!YE5As{^uBTboK^Nte@Ms~)lZDh)K|C8oryx29(K?7> zm2=t#ajbB9n;=eXPJK=!f5qICw-Y(D+6(CrM8_anZ17OBZk?wKEv)f$3!*#Sa@6&_ zU{^s#)VkGKF9gveh}so%USw-mXT7}1Lp-&}#+QTW6~wzi3=ZOzAYKik(4ow?f_N>6 z*MsO2MBgCJEOSw_H%E4bhdzIUj#}a&??-Pe^5ibgT>O#i&5Aj120=t&^=&cIUvPjR zZ4L}#P!MfvX20V|J{_MkB#8Hd7#T$PsEghn8pH=dXqVmf_h!Ez#MLQT6DsBm3u1T> zBZ8Q}-t$hvQ~kQDR$-NVX>-qqwAm^9Bf(KYj26N;r0|m*vrtiO|Am#)y_lAqXFrP#?lk0Z-aOkL`n!NgIE>Bjv#gh@m&z#2T^3Z zD;&h?Al3vC2qGB74-C|(%Nv9*h_#HUO&%tHmmb9K z!Koxh5MFHwM8aXcH&nj4Wfdy?Sg7;^!cK5Aq4jtZmHgl=;(+j9+EG z{36Kt^_#3?T*^ilR{s#qxrNp3LK@e1?_%SFIL)99VowlzgZMj$qe1*r*1a!?13?@N zVn5xLmwA7khvx!L>O-7LRdfEN(`siO7TkX*i;^Qj{KYU>oyBAMQqMmUKU`@~3ON?U zze4^C;&>2TQ75m+J|U9VS7$KN=$TV8Nf!)roekn#5VwQ46U6x-rsid8d$O+zxe&xf zA(sR%3tkbV+KHdDt_AsaXx!ku*pq!zkdwN5m7H4~?&kJ6g7UlU^#wN<(p$?t8}l;n z1#w>_6h2@O*32f!7eZ6a3?Y9A1wwctga#oL453g6RYIs5Lg5gK zgfQ(JSH%#DhEObok|C4|p?C-#-z7$ON7w5eikKWVYPG! zZSY{o)d-ydx{J!J;>i%63Srh8IgN{`r^jWs2%&WmwG-VXgs?janBdb$a|T{F9pl0{d$T4(hsqNX0t>=EKe+cVGX$$mM6UTkCtvqN|#gjYit z7Q*llUJK#%5Z(@-VcG2RYg=@8{|E7j|gF82opp2oTC%MN6Zaj(fFKEAuMZ<)oi(E zG|LuI=N!!Zn1Q;%Gj^$G3@t}ppGfl45Izfmvu3O$sW46m^(TaoTic$GmB+ch2;obH zB|8$rq!6s-p07gKu{~?D@F{{*1qZIkVD8UbvX6e4H6w&esp&IAsJANfnbyt7ch>W8 zMg5vX8G;dl$;PkEm?OB1fhvTOc_GXXVL=EB>A=12A0N0Evr|rP<&GZeERp0=K{{u7 z2rGntE9mE0AcR#Rd?!ij{}{se!dDBf5&S`LtssYnYCL|Dq&Ebg5KT}Qv=#n#T}rtA zNO%Gv1nJulHiQt8xf2c{LMI5HP%rzH8}?OYRFd%!Vw`9NC7tBBe->7whlhVXL;Tsk;qMr`yfk9!WT_WT;cZy`Kx zp{9l38Ga%A98}uEc8*R6XF@m|!p;zOg>X28KSS6Z!XD1w4W9i{@7@sh(dI%ITXMZ) z_JblS`GF7)a&0+~Ni`1rAct$u9!rvhr<+0H7m*A7DUH^z@jtOqN=JHi^ z(@XzyIuud=3*orqw-a2fgr9OGr#Z83+CD$W85BYZ3neXF;0neC)exLC!hWZ08@|JD+ zp~zE&Gnvmqs>9PPtX!Q%A&>kP3W&U*U?E4Ru!SFLUYzy@))VI*s zf{Oa-RzEuW{Yg?4nch3*#GTj*e+lZDO} zKD_DbXrWZXbMu00e2biKFJyFKuUltv#GkkD{SwcQ*IZoRx>|PhQuu;}7cKOnA1w5s z-&T5hS{PbXeJ?NbC64SS53dbYkIH)4vZF4%GK;4ko*G`YFsn+=%BW{*QMI>)H!K{9 z;I9b!Sm;Z~avECbXW>l?3oR_N@Ro(QEljX5(L#R<11yZPFxtXE3%pSOz``&KgDkvb z;av-ZExgAzuvIs*hA;vTyEy3I?R7KBYw7nbtctmLHOPb4tHbH=<(>~Md}LvSh2g1g z9wS*-#T?!s@G`YQ+_PuBr|c-##}>v|_{_2|=RTpY*4P(#I~RL+PxL9H<*17n54=zx zYhj#)jA}XK1$nDW{<($cS7dy}7_jh#g)ccrdS*?sFj+kIY@aNK=oAZ6EpSO3v)+>t z^3anMPPZ`I!q*mNSoVbFF;mDa3q0pC`HhABneKU(eF-{8IFobf?SC@Pw$7fH8eL~$nZ?iSX05icTzWLk>sn=Dg#|W=C(Uo^JuVpKf{$oCf37geV(_N?I$TUcw^SG@G6*TRpC-a_h6oSw2@!CekUHQlar_F4GVvNsbr z5C+5BLehe1fp^dW3%uFk5ws9;xW%>!j|fH`dCWpwI5!hmq~%5TIu2sg^@|1a^@1A& zHwtdDuvy3!LF#N3^0VMJ3*%#M3g2Akv3+fXdlKN3wzo4FlvUekDj;iz`{cd2P}J2jEF84#%YGI-#C{EP9Txmk@Cc(c zFY_-8e+xM($Yq?ue?@^~alyiW!ddpXg%iS0S~z9lv?D)f;f%x2vZ?hvR6g%WrVL2E z$Ptv}WeYbg+!B7p!c|A-nvm;)H!Q6F({3=2+akGd;f|2Ig7*ZO+hA*I{rzbqDPiOb zqkI?@!r-kAKR-7sox_GE?aOVfH`)DPPu%bPXE@DpJ)2&17>HZzPy!W%mhR~YFI&!E|g zIc)#90jWfH7@jb)C6|rl4F!ccl57%2u8^iq*=AwnIs9m~oF~J0DvY*akUt$p^Dxpj zd!7q}7u%~!r?+r4pAphBj8;OP6>RO~wh4o`x2%+RA}mhdu07)F5Jtzay{qh7|+v7EAsUSgExR(#RwNh7Vjp!yWk69yy)0x0K61N&oEvV$^D}0>NTET z!e4Q8UJc_l;jcTAPbZ}I38QZq4C8)b3|nlkgj&MG8S&d=Id6vT?I2$2yd6gWFyH!x zfnkgYV1eRPY7e8kk7;TB8)GEPZp%kBq8Pg$~VQ4OqHscHBI7;WV&R{5S$stEJt&;kgpjb zhwPa+H;j2<#KTC0F+Yq2lIs;*7{>B2RtR4txL9yW7)ymL6Qq%KZ`&dIZ5V4rvQluB z;CF)G3sPrw7~7WF-Tc9ktPSHw;XgT&JN5JV!q6nCKN5!F7h*U%W*7m72gCNMgf=aa zgasplQAZ~hw$EkjE!Mj4C7K5o5I)}#$hfvVGOR6vqg&k zF1R&}pB-!4g!~f5uR?xvnL~&ynvGvP*C`&jOBougt+mt=ccb1A+&` zIOOPT>6-6I7_DpM9A*5B&-u%d|1E_5`X`KI!v7UK9man`jtkQGi7-w&{FKc7M>U?| zta0S$xL!H@LfGCIq|W6qu7tts=j-CDKV0ssqI1pB>`*j~Cv+;@5=oy3`bKa&j5}f6 z4dWh5MbI>Y`(ZrbS{gysi2W1B!!U|QP%L7f-BJYeMUWcdU;AwdUq)G22zmYp3J5Rg zND2wz9A|Ekh`sWV6pz@`nd@!22ue7bB_k;1@X|ucL{Qd|Jc`)z5may_6(e{|cqPHg zj-1g|ErRM1G>D-0*3=piJRZRl5j%KliVj!82eKO1l4R`&>NsWVMo`b;^&{Z^He1Vr zyn1OEL2#GtXM9^03v~;Ys67p;W zt%bC4QPLk{Wqi*-sAU+;LQkPqVrY+ zZ%42yg6|^eAHjeKW<~5@xOnm!7{Lb-42xh8gL9qd9mnRoLIw*CiQqjUL!I3BBle~f zTf$?w2&Y6aB7%_-d??8=Y^sotA{gbA8ZG2wL7uHXb>yE%@L2?7*(66YLCAP|b(g&| zPjuv*k4%0M!IvVLV(Qumh}>)9p76n{?)VB1e|OL#&^fy!h(_QSn{5*w-jvaxAxSfW zfRLb5V<-a4;b9K0oZopP%o_*(PB*KV8jm0mK{A4M5&Rax?-8sQ{f%6dl&lRAEQ@CG zu8q5hn>fMy*q4r*MPZBJR>7Ym*d~OzzeMn>aQ+&?2>yCc{U!PbSIoe>;v zoAuZ-5BC;GUM=R%zbSK11apqN|BPU-l-=i8+aJLJhaZgKki!p0z+d`kpBTR2`a6Q7 zoIWwU7~_8{aEv~W+TrnU1ph@aRrv7;PH;VmA|r~ETz0tFMo~P9(-EAB;93ONBRCtu zxd<*ra5;kWbjS`De-tX~%ZbosBh1=j)oc3JhB0oBXHQtEeW(4;f zIUTMSQ*Uwo7s(w*em8<@jq_3eK34z{J`^kvMT)eRS^1(!6`tluAS8d3pWXT2j4K#L zAt$$R6h(v=btE%Srj&@HWE5qhC>uqoDC+Oc-gY%*`^0>uqxij;%HZi9b(M>vd=zz~ z{Cb7$v*bR+QvpjYYEmCtRqPK#RsNx zU%Gyjmv(SP@q{C95Jf|WHxg1~qaEIbimTlCYB||a z{-H9pNffzKDkqBd>#|vdb=5DfHWeY4dYa0MLWx3+;>jr5i=5lPT(_T!;%P}X7koB~ z7DAp8Y$@1EkTy?Fu&?V{N6|(k&k445a@$4iA2_JcK_ndoI|+7nbh=Q-*C5bTWl=15_zEH16a18UQqueOl62;ai_C~QU zil4aULz@0QcVDOh?=f5cacKFdK{tZ09zz|G)D)~GSliKgyHUQn z!s`jv|NrC-W8gz0JF4WkV`${a8^_=hp6*C8gk%b4#c;D`HY@cwx!FQ;1e*xv3O0?Q znGinvL47rbCu8UuL$?^7is9)PI>*pO6e8<0n#a&0hG!&6<>z8(>F`!Uo{gckkT#Bd zY*l*|YAeZhF|-%bL9nBv(nth=j-C?+`8G`(ph{?hB4n=)JA5zxf#V| zj~HHx;dmS;;^-N}%M83Yip0??hF4;+V!TPgt1-M5!@L;g$MAX#y<-?1!^bha5ksFC z-i+a`82ZN0Pb~A6kiYE`n^wu;Z9X4|dt2m#W9aX+aDb43f`d35Lf&<9n{P=S62p5j z40R+UguE~Kf#5K~;W6+AoIT|+GKLRD_>tf!LCPx*NF5WyCoy~)!)Gx}IF!a4RiBIw zf1Mc{!}J(t#CT)ETQl3#gcv3Xndn&fJcciXf9Xg@$a#5k3{xD*)EK^U__WynHjrnE zq)^iH`y$UQ;j;z5b~L|L91=Vn!=H})mw!?M z#nr!K_%8;=Hmx1yU4WB&EQWuD=gB>=)qm_oR?hG3+gF&&{(joa2J9I^!YN{}?XB za65)}Q4b{-8G&+Rc!{Tg7_LacYl2q=x$Q#>*M;8@Wb&qvTU=fwI5`3D#Bf)H_Z*%3 zF+6ZM9~4Z9BVXL!ckoI6QG=$5A?tGI8+v%=9?Q#!*g+*NCI(-pq+BGRjM`f?!3#$Kt3IM`hux zy;>Yq99}h!o8q_Xj$~&4)W_qfDal%KJmJV|3#lVmH;#IaynY;$)oFktU$9Ulr1Sbl9?&N+E$CnP@ANNcaKE;tt z74lUa(;Uh4ICyQ(T4u#DJB}aY_$iLBKLe7*jne*b9AIFBI zhYuKJ9?9Ts0)NL}wDlfqmS}hhgl;)z*mG3c+s$R|>8Y z{4S2~g|IQJ<2WJ<7ayxAQ$nSkwQ=wPE$$w8xIu7Z9Ge`S z%|f=svDJ~Zlf~_qIDU)c_c(qPIp-j^Qu%ZLA93uBV_zKG9sM0~>=eGsk?f9RkHc4P zN#)HupAp?3$ALHwI`Y3cp@bh6{8R9VllvE!vTF93=%^$4N64`_{&gh(#qEc{sdF-p zQzHB$fzxrEiKBM{ZzOOwj&pG|NT6W?=i|7*^(~HDjLbML#c@538(d2_c=((CWnPbM zcU=)Axf;hchtC+0R<2|-&f+}>GkHgIJB~YXR7~Kp1n$OhPb`#7*bDppIMRfWKalo3 z6ig9eKEYJMPQ3n4AiwYe2^0~+QUwzzB)qUA*|R0JsPJNf#T|JGAszPEqhBh4(vmDA z$eW|G36v9FUXVH!gz&N6N(t0H?y8(Xm4tmadR%VDs!DFH1gZ(C?v$z_p zt3|@T|0UtkDuK3+{MiIrJG@N-&pCYMpZ2oWE`jzU=^)tA$!*>}UzY@)Pv9jE-*($( z*95d!CLfaNCOX{(Ul4pzu!kTud8bC~nZV1Aq?eFa1Yb?yHAnus5Z>1HNuX~6^Aeb! zKtFaQf%g;mKt}Mb1O_KCB!Rb`mh?|xfD|0)*cp`I?U)^+?>Z8tf9iX}hYE7vmCsSP z*qhCpnqdk1f&38(jFhb53H&iGlaDvgiDiD6z^4g(mf*i`ZEK?hNk%8|vG6gDI7B_UnTgRBmX`DKGVe-d8`p3*Os+HeiZ!4(ew)OC3s0- z$89@VrFpCFPrz_=%mf0$gMz%Zr)D^TNCL40;t510q#1tPG+-|4T3<8!rDdK(0!b;d zPH?N>dch3|Y!tFdaI+xIZei5Pne=CoY!m#&$^A8f-yHsX0>zuyUgfbpfgK{>DcG)} zeZjLkfjtTP-<^9CsJ;$0)?r@)`x7{jz(Iy_68(}ml)&Kx)Fhrv;?D$*Bv3GkLP`9U zz~2enNZ@7yM-%vmYj^_Z5@^8x)h6&?0>=~hSCRuus1r-5%S)&yBzZD{a0&IXCc0lMr4BEpPA#QYNTOmA)sv_pS&t=AIf*L5 zD+%(oJgZ9CM%cotN!wS|Sfe!f@g!=py3%Sb(TtZ;50+A|m$H4%me)<9UJ~hSOcM2z zctUg<5rs5N{%<%QS$?84A2Wt4iRPtkuTB{2ezmlknM76+xk-NZ6z(KOlvbCPR+|X% zB#|wI!W zj?$!O=;0(71`v`eCW5_`wH>y%OH!?sBf*;EcnlQQaaWz>FU z)J{osPGWu;^?7LqUGYg7wTo!dPFFFzs*IW_qrQ;Di%Gna#H&g4NaCd=dP#22B=(n4 zE0s}gh=!x_LW!tNzf0pZzN$R5fEW8iI9*>o>$*8y!c(RF#3O_Sbx@8$85_wJ<`rHK?3 zP{4w{OShq-fTB|DprV3^3J9oJ5KvH&o1Wa7hlMUh0YO1gih$_9bNI5>zgE^>d(NCW zbEYOUlicfUg1ZU9CX{Z1$AME%%Sj*bHzCD7Q%_5?&pcJUrk+NgVe{3~vYYUh1oIsJ z;&4{-+Pn$hNpZg2go7es0qMi{BK(243Fn)*>CEEoo3LXO_HM#H&i|sYi<7^Qg8JHS zX$7X;BhIj^kh6h)+Jv7s;gG29XVW}Y{0m2PeXVhQ?EojD`r1JevX+=No8#~%{K}@U z6LwTy>_|s9;rC4_lSDxhe{cY9!dbEQ=O(b9pBDbtCLG^{Tk319!xJ1Mb+wbywN43V z@NXe>>5Oz6nw?r-`)3o*ZNk4&UH?hrvLn%Rdh$knEtW*tBx)y7CkZ4`E{R%6Fk$&5 zDkO2q*@9|GROF3PTDeLRm6G9rx*&;9>xb=LIT?VW2dT{M1v&%stNUys4r^lU^L5CXe7a=f{g{4u!#^FsnI~Ag%(M)q_;ZC z>1dTi>m=SxVo?%pl4zU6HA!5XM7t!~Cvi~{7bnqy_xfWUyCzYTM8_mLNwBkEpClgN)PrmI&a zaiwq?e35u_V}hK7 zj*UxVd=mF3@jwz2l9(u7-Iv6zXF5(wf+f8-iEpLGsLWvJam6JAdp#(|CyR2|a|MSR zXb*9`Gz^=g_Qu2%_FGn060?(dEQzT}93E3VBZ+D39vc&ni|6YP_na<98Z^|N5D9av zGp?A9J(o5XWTyp+V;B%T+CUr1s| zLyc~Hvm)`LY{VpjB;HQqog_9S@nsV4Cb1-mkCON}iKR)fO_wLJLi*1#cEu!E zMKpN9v9JPHN~u4Tx_w{p1M!MctLRUx%&`+43&s|I!f`F#_;c}XbrNfmm>Da>j{TXm zINe*D#5x%iEDPnYG}OKjWd_&NnT8r`@2e!fPQppTO=2Ub2vN|J*d&EYij#l+6Bd&O zjfR?$gee`>5(PU6x=n-hpS|5n!cQVAQ52@wG*TR=gZNg4>hW!BU(EixxlK^T9)5qp*9^ z4R&?*4YtUhB=#n;p948oW*<{+=}8BEPU5G?Ln{B>P-8-l)&of#6w7ppz3y-lzb5f_ z5~q{+Er}zX?UOi`#8J`tUCPDWX^`^(lmAISlQ@~gxZ?%KC6-<5L=uc*@p*AN>i=Hi z6pftdIC^8^OcH04e60@uihIm-_{rEmVw~PG_+JubbQI{}WJL)_aZCptrngUTOqA8b zu}o54M+F_Kj$$1ZbyU*PTt^Ecdz6mqI%??Q>`_@q6(LmxDXFI8wSm1zYU-$^qrQ#? zI`}(&wMC(hj>Ngpb4u#!sHdaTy~VsJX{e)-9!{`LB$vU*3mOYyNttO=9b-LQiURnitpDh?T{ z6^VqIDni&NOLW9_4An7={_E(bqo0ocI=buVq2odwnk4V3qn8l&-dm(M(%?lpF4oaU zM_(Pi^{|;}nU%m{_4WaujE{}LSobPU!pMDo2<2a7pKk_;5dhB3wLw8yUx zYyL7FAH~XCA@a*5Q}#^SX|g0ST*s93CYl5*zKS>S-4W! z)v|q?dY&X&1At_D^>QyYi^9)us6QHk#^6Xcq=RB>hN^@ zpks>;Uq^})(baLQwUXA6(UI2?P(CXD<3eS`2qmi{$G$WwP90*Yj?KI_D&Oh2yHxpB z=aze@_GJ^*8>4*Bj`vsLmroR4+_iYCj%_;j>o}leyN(??_UPEltj8!jb^OTZOsKmA zA1bTR^02?u-8wE&;xBwrvQNiPk_(l8)^YZ^c-4!Q(bH7sNPdw1Fkc-GHUygDh!l0a831+F*6lP${GB=yKwwhYIz|Q1S<+wGH`*A%7Rp@VxV20B9iI` zQjaM$4BUFFLYp(8)D+HOEd#9@YqgEgJqGI;sBfT+fwl%37-(pqnStg88X2GijSVyr zXIKyhcdu7@HI*oO$fC8NH8IsP@?k(@t+gbfCUx2wXm6m%fMRgd7#$51vaq|9&&wx> zoftbZEOloCUBoeRdc~`&1W8o!oW&_Iz&b1z{Hb40RwgZUGtk|@)y&aA4+A|7TxwvT zfnEkKH270I=x0DPaFKyN29{i)?tHhf=uzcjIa|Ce;|mH085nF}sDWVyevc_b3|wa5as!N|g?r8@>l-S> zD+~;2th}uj)535AhlZ*n4b*F`UTNSe126upj*u)!dbd+)XA}##O}+e&!fOp&XW&i) zcNrLM;Ccf$8MxWN4Wj?Rhy1WKOir(8^Afl47A7=sW{PsVC@@Fnej7Vde}&d69V)tm zHUDVn)!hc}F)+@+cq!Ky@tNfvYk=i?Z(mrt2?iz_xYxjaqQiufq<+@CT1X45llvtV zE98&<3e!$D@Q{Hm2DTb_*uWzOJ~HsJfhh(aH89t}JcD2QW2%8;wUuWLOfxXuz|#h1 za_pql#|Q@23|9K4 zW6v3Qp1t=*^##Ef1z!@RCgm?1c*VdX18*64)xdlMZ_vHQ+H0cox*!cw^XRIg*SjSa zuu2X5)h+R+0ZQ(uk)Sgy$YKL;8(3jrrGd3Z>>UHk4A9kg>DXX}*AgL11-GAxzh{7H znQ%F~=+`llbi?BJ4SZnWLyol#MKr!jN;H2$n4CVafS=H&0o#CMV6}nI418^1qk%PS z?uE+t{ge%1?%2{!S!dvjK;iW{35B1j>jf!UaHf#TUmE!NL**-j|0Gg4zF*I83~a7Y zT%&gJ#J|){29gGJgL@#M^70(S1Q|t}t^v(O4`5+WqUSC z6lV;Schsk5D_-rc4CV~v*>yW8bb#{Gg5u2vzBTZjf$ure2ddR8B)&LPIJKX$^K{`4 z2Ivnn`sBw#;x+@@4b(JI%ft=?I}QA8;Ix5V27WYf(7-ROgq7-U1N-RJA!TCK#2y2C z*)Ofdf>o-?ONRwym*td|={4W35&b?T~@P2L5E@vVaDD<5)KE zhk+v;woSC7V*KtV8ab^oqbHka#|(TkD6wpOcM2JGTr^Kg?k5bq*+g3>`dtSlP8qmj zP$J(%W2R>~lbe8vvz#FfoHOvRfifm4HPt2$RQ}`GY@+?vM7w-^cVdBwn2C-}wSi5w z+nZ|CDQBX*iE1XQo2X!-qKOMkROWLOV@-U~R4Z*7CSTB0JJM9EVxp>v3FEu7j7&?y zs2U<^(@gtxTo|m_Osj38j)@`@iix@=>X~R`qOFPgCK{M%ZlZ;Wh9(-Bc&AdLnTf_G zR#ZqdG0~KdaLu&qUQ_2)Exxgtmj6#7+4)o9?inf-TAG;Iw4^nQa7bw-cy>%;#q7k5 zHI#NH+MDQXqKk&*_0 zP*XM0(*(0CHc?_CZsNDA)ov!bn@E_T!mm{nB0Zr4A2ri@m>{~%v|c7IG@+TeNRsy! zyx7D&wMvLILei~gF|nVC{xohOZs8IW16ac*)|rDJRO&!hbx)$?^?!Vy*9~Al2MwoVYq z`6xJ^{lvt*ChjvaQS=!*DI(;wz{lG2`jkH)mW`?<51J@7W6bek6OT}6;!UP9@u-Ps zOgu~bCZ?Kr!o&>rTl)WvI^D$MLKZYtuIjE_bu>Q9E}FVXdD6sFCT6o-Cc4&Fo|&vn z9g=vO{fch)Oz@h;rd+C!>}#fd*-dGAOqo46@tle0O}u1cu8A}6t1p;%kvT3>c79*P z*q+^$n}#IjnRwa6YbHO_z=HB>g*An*aBf+s@Ost6d=9a0Az$%}@&+N<=r&dVi4mTrTIFFEI!_{YRoCcZYYofD~vjV8V^kv5Srv5CH!a7?)D z=VuCa6Q&8v3~vnvE%zzr{A_c~4pjf>SbW2YBI?xMRmh-c!j~jxA1`FoL*u%qOysL4 zsGl{FGx4p7?Mfr_FWss{-XX&5HuhkPwNK+MRB)*r}ZJgg~Bz_RwBDj@9 zyIV1Z%=hER5<5-oGVv=1tcf2@d|y7X*Tg;(yG`t2iOv??uu3_9`}oPk&n6C<_=S_F zqcUp0iNhU~1A@FKk{@DMSs30i=dUh2Ec|@%h>4>n{xWf#d2LdDH}QvwV%a zi82-{Tc~28zyj}^Wi7x$%mVMrJqwie7Ajh(WZ{|9h2^cVAQdchzCVoO&6k!h zus}`TaG6C_3)L*tvQXPXbt|lv8WwnaCD9j$_t}~j91j93a@WgsocmyV+-vqbg-(1OacFs+3m3yMgn#zrr+!v4@zEReAK(G(vQ z*d=JN*usG3TDet9!a_F-A6xjuLU#*2EZl41J_|i9^s+F@!qs%if@Wc`g&`I$vT(75 z{+!+|^tQs~Pag|?g>cc)&*H1&F)lZ_=HkkND<-Zr23WY%!ayrrj&17~uI9!z*SHQE zWP!oktE!h-xZJ{U3s+jW!U82jEesR#W!qv};JT02sLVy#RdnE7(FhCEs+VwaG|~!J zd|#ATDZIwQwHEHMaHoaqEQ}Tlw^+E|3Rht_TDXbbppJ5bB;n$b!kgJBMwlaw(7jtl z^EM`wv{axz<#$=Q+rn52<1E}m9Z}=riwaE61r#lex4;syq?0U6u)>w&L{Vcb-KPJ< z`z<_R;d$1Q#ji>+nWeBW-NH~!dC0;P3y-pQS*Wv8eZ&H+{9`xomK6OV~ddrp~Z zfk9qRHP;@u@Pvig7Uo!(VPQ={*QYEzZQ)4^K?CKT=GveK6BN$ma5x&9W#Ns2;!Vx9 zZbOyT4U{>R63_rPNS$N07yB6kJn8&mh7Fc+h z9rzygRSWYiyds>zADe5$*ChD5pt4e>rF8#T-ic1E&SCc(feU#d<$(>3(XeG zH11g8)4~;|dTgcQap>(+`Bam(kg>4c!VU{r3poqlTKJA5m+i=jf>Xy>g-271f{$CjSvX>WzffP!#!(BuTR3gu3}++@$5?!eudb=zR#yLH%~&|jGFDb6sIm6p1tlssU6(X89zfo)MQ$GHwC?>(OHku4mDJ*ZJf{nU1_Et+&v{A`MH5=7!T;0Cp0>LVRl?C5z z+AB6PUeyM%*~oYe8#P5<$3`t16VAnJ+c?ug+jBZj1^0CP;thqluVXY-Ph#r}QrN)e zPvsO+zcJmg@xFr(95l7j%*JsWCu}sg(Za?fHm2BUY4fLkFwn*z8?9}$u@SeCu+i2= zI~$#Cbg|LiMhDjI0Og^Fm5xIAEB_2~>yOCm`O?D6rYMCrR2w8+Z4}v1Y+Sg%h#PU- z$KyrLUASVKXKhM}je0FLZUc6+@isRPZS=O$-9`@^J;n0LzAFE3fP0d?XhaA(_xHG4 zc#$1$P97hl_Oa2|2KOPkNyxnV*|@~U02`mKR{9HaPqJOl74Itvk|N+8gAoC8{7ooy8bGg-xI|~*x@e0iL}av zKlc;3%dw#}M#wvD$2CFZa=vfSn}pUZQu*}1fTo|Qi+G0(=!HeRstqK%i>&sVBk zn9sFAYh1Q-{mvkBdBw)7Hs(u4Ov{AK@io@)zyz<$T51byEM%Xz@d2C6#v&U_Y%Jwa z8sGgb8;jZBY(C_NOYhQg-QThCE-PVBf~$B2xzOg)dzp>*Y^<=c(#CQdT};ZTUgsklA4_m-OO1>7)$9x{HEtIyYpF3KF8|lsSZCvV z8$a0i+{PC+zOk{%#(EnYY$C5cf#zce#@9 zcEx|P`P5qYvyJ`iX`PCftW^%!`~xhNUeO<;rPi%V;t)GPN98vgM{FFHw0lmgzuG97 ztMuAYbd){QQvcu}vhlmrWK|{3+Mu;R*>(FXf6?IF5?Z*qfALql;wNpK;xyu*pM$?` zoVHQXK_v%gY@FrrZ>5!Y@Q;l>EwwTZK0lxoOzeJ6g8$n1&jy2MT53&NX$1~q4$3GPxx z^q;kg$s1FxS-9uSJ>g~!nmcIYpsjkba=AxcLForK)+lTz`ha=)w6GBxSj#^;r;4vHLfbI{#^;^3=|YO#Y72daZh z)`r{K8~;(_4iXNSggfE1z>Me#OVmSz+|=Y+!kRCDmSgD2P!4lZ?YyMsF%40JHa!4(dMIvC7U4lZ}VRUsE*m$B;J zRJelUnvpoAUdavP%MNoe+`-iju5oasgR2~jbTEp&f(K*{?ro)UOP0zEa$(5T>-k08 zwGOUxz)jlGPPlsIx~$=raOHTt1Fko3aBz5_!s|vMHwoVC;1(gbMzOaEq0KuT+~weY z*1Ute*+34)IvD3*j04)_GV{PHrPV5BZ1t|=9ZYaAiH zq};-#kVPgw$m%_$JnY~R2a_E<ps37<_r^F8R>tG$H6yaYu;I*=q*6tIfZ|h>SmG&ja4$H#PbeFRK z0_AH5rUT2tM(R7*ykg~UxMoiQ#rZSWN*jP>PQ*CzFR+`I%tu#kCgY{Z# zo&%rFv@1UIr35dMw1W&Qzm=ACkmuNUkYk^39U7s*QU|;?JNV(a!XS+k8TCCStb7Lt z*zuOATR5LM*d{`twOrJ8QO`xsL^0)cT-0^L!$E6DIIC}M7h-)E4Wfh$ z(znJgnz$%*(bYv$7tLI>chNx{Ywn_@i&o-o3pbqqIl;De!DGiZF4~HmMiwn8bn$bpsFOIrI_b>1%@ol>7Z-Guq{szxSKROx!@C3LcGi{ZqS(clC1Jgl zxZquk=cnCVbaye!#cUTnSUMLEy5W~cyQ(pnoBN$xo>adDZ8Q7*1_aXGzpaixo^ zTnv>|!(0q^F;g_pCnqu?jgX9RF_LxIT6?#(rVdW%qIQjo8(dIwt&8hKjq=eh=8W%7 za=qx2-zbD>Y3CLfx4IbTV!VsnT-@&BE*E#ZxP$$qnRcg(bFH;Kt;2Jl^Ah4cF2;&{ zjOb9IVVnQOP7n!|?-er9#U#0Uw$Z3|pNsqHcAL;3pIslIhvT~Q>2$J-hg>}D;t?0q zT|CbBe_U`caVqDuvvJ;K9+lu@Zg_*>E+zL}r@7&MkdyxtE@rrR+6DI~c{_NLI&OHT z`OZfw?~mMs3GA%0+xN2`n-#|F6Oy-!3|$8 zdC|p)5z0$~jIHrtg2IZ`K3&L!@44W*^}=cDN*C|D z_|nB!EbS|YK`r};dtp;i~JXH3ujrHu}2y4~F4$c5B_PO}U#V!{= zy5Zr@9+!WHUbx#0&tk5dmT0Lf>k`UdiK2wZLqEIN@8Xb)!yFDh69-so*2Yq$*S6R} z4%nsPDH4M`QF^b9_A7gGLix=FV=3>tM_G8i`a7o=_EHyTT^!@|%h{fd&IX;V{N>^} zdtG^T+zkG-yLxNq;s!NKPI2(Q7an8%&GwZeo7190wL~oO5640*@vn>jIP}Si7qd1%bm8JOU5o3TwiH1)!zIweG|shfNFsg3q;8?BXx)*d=|=;(z@_%cg;h`s!c!+yQc<_X-a~Jv{2+F%QF7WDmE~H#Q<0%fo07*L(PSY+{6mQ68@LFj9g)j7?B@ zjfVyIB(7tUdlJ{O4o}4yeEgmSaoN7uO{d~Fc(|Emuavma!%ZHz*FC4L_HJA4^;7X% zJlyJmTh`ngC*CG}V_WS`4|jRE&%^y5?)Gqxhlw60c^E^lwBm6d#(Nmc8lIil-c}?2 z*;eCeezkVm1QvWwg5+KgJVWQv{Kqwv!gk?#`U75g(El)dMa2ZkgA$zV;UOWEOqrwd z`2Gn0>{+!2;chu)Syx{S_r(@)^o2xI14mG<>=sxRFWuAwZ zS-l(r9$sOeNyX=Tc+JDB9tM0AW3Y--G|De}ou=3{e$j7vwVPk0+*$IVU&Q2ZdU(sj zV##O`yL3B^xxCFf{4q{{=*GBq+8#f?#KTe#pRrJN)ny*u^YEdERUVdmSmEIVCO=)Y z(!={gYVC>-x+Y#tF7ml+VoddsM6DM5Sdd9RVb72Fr#s?ZSjN*uYuJd*)iUY$T27d2 zV>Q;szVNW#gW^N=vBATa9)9z1#KTwYV;;WaWb0w0hi^D|J@_6rc}RM&JvbiL?k&3-I`RB1p3B&4xgzjTN`*6pn*~X}4kHMho3!cw$cq7oKJF@S2>bko!Fx zV6Wf-iid+9c!0>$=R+L+oD+_y4Dw)csu82vRb|y*B`tG2>fv|JoIYy$_`}075C3}j zk5kaY%Af349!|0M^37on$2nbabhprW$Wpa!g0IW+joiOIobhnh!)Xt*+iARbe!+8% ze>|LH8TZ7=&w529%l5>}_$csE(MKg8F&|}per^^k?*o2#c2myBWqaby_r{-DUsCX} z!k3U~zk&~9wu*9rkIFu(`=~!Vv8_#_ijS&3|1KG{&s6WW(|B~ki(c`fPAwm`eYEt^ z%10d^b$vAQ(bz{lTJX_Oa%|v-uRve9tK{QOy;!JC?KJwyv`zf*ET)-{=013w)YQkT zCySZU!+Yb+pHQgNLgakWy0wosK05m7iOQVttg=>O5y`sFgk3K#I__)+ZU&?)4;$vSumG5Iyf$#A2 z_tAc%^1;?PgFIkj76aKFJ}#H+1_=%p93q-jxWW%lyN3GwxFEDZ-hO)c7W$PwuJUoM zkL#FMCN{#yNT2ge=-w@L6EuFck6WfDnB6sWeoBJxuJe_i(QFIKecZ}=kV5ec?q(l1 z`nbu*z_tm#S;ULyT>A$*cKUeU#|u7^K6D>1 z`gqC5avv*v%=N>gx>tS7XVVN*=Lx>-;}s#b_NWxT=HqoAi+#N9;|-Rvde=97a0h7t z>r==DPnG=ncbw;Ri+sH0gQQ>EVoIp9GD zuTer=PSzU{SrK7JCyN5`Li?Dz4Tk0U+~u+)PRzxX)BECwbH`r*M4 zpIwQEef;W&PqXAq^;`S!0hPg{KK>9n`R_vb^n0HC<>R=I|9q55;e?NqwC3ZiA0Ew| z^6@uoteHlh;QUVyW$AtX(exi5|8kn;qp2XH$f?68RlcrSkV3f>mR3!~QYf1Ogr7eo zqOej2t-MGo2!;~A0-C~ICzK0PsGLHT6so3BCxyBxR7;_H3bj+=167R_YNk+2t`47; z@NtO3_8l}P?9)Nx#V471DgIrE+8~97DI^|H>!&~kKGk$z8@p>)oRUT<+|WV$ITdf3 zLbDXU&SPU9%~NQR!m50@rfZo(s}vs2;*l&`r_d&am1(@6M%xtHrI1S@Pn#)pNa3AS zsNXS#PAOcP!oU}?ua z9x1_5DO?@NuSwzlI{*94uIofNTJU9bak7F;oEp%yuNG3+|Nh#bL@h|EYJiy+P!i*H2OkuLf zrwTsA4v@klk>(U3{HWnkA&*7!4=aROOq1aB6do7yL=^jUg@UJ2cshj_Qg~5>GgEjb zik+3hY~gbv$?|HUwP#cOorJJoJs-*I%qnJWG)ki73AMp=T_)z$&NK(xVbN@JnPa?^uLRP2nStQ}>TWeETm%`^F`H~HNJ}QOv zLN-L2AN&@Mk*_7VNpPd!H-d~!3eg3rdDE|D%oHpM+Jb38N6<~d6XFX}Kb68O9l~Fb zF2$Crsn6G&ZO3Z3=~HbWP*C6uwX4TnhiD@Iwk)QusZEKT_D5!Zt~J zNN~I0ZowUbJ5$&t=Vg>NdA+MpHtW`gqi`l?#j0B#l;Sv=(90 zG@1!%F4!W{Y?;Q0-r+CCw}~Vjcoz`fPOyC>f4Qijqwr3Gog;adG}7WjQ5s4b!_pX@ zhAOd_q%k0k;xtOqh)4Ptr;$jbTN>RX$%Se3hRmbbfG_Dn$ zs{}^~juadvc(vd)g4CbVv*5ZkMyGMTNN$PbH>7c+@S6m0j^tNl3T}<~ZE4&t{EkS{ zYkI-m!sn#%Od9v3F(!?%X^a!$6KRZ3V?r8_M*0)ecrfCVgxo85UmEvE@&`DI&xXI= zIXRL%B;?^V9*HDV(s<*tus=K|lBt5z1g8r=E=UFTZQ=|GKAFZ-LY@|!DL6}zIkwk|)#QC(KkZ)38LCPQw=B2|9wVAk}_oQQ!+t zMUpYUgulp_kziIZCph=nfAAaypU@vZRhB1t_f_Ji;(X>1j;EsY`J42$N$}NcBipNRkxOY!im=$sS$C(_T1 zF8DX%iMC$#2|MrlRmlf)_+``cO54Y8hx5T$Dle z3~ESJXTh3+Ei$N;L2co6GH58Iu3$aE`hv{8fe^k%OWr7h#u+rpps5I(MLHvHFW}WY z1HRl#wU#1pl|kza+C(}XGH5HjT_kCr0k=e`-%%u;BKcjv#JXfqm_gSJibU8g14W1$ z>Db#se~L3G5lK9fCo0ForKlZ1>#ToR@U_d1AlR>|T_l0`JdnYIl4Mi{H)L?5@T&!{5xh2o>x7IJq`~XywjNGaH;Lq)48{n#IfGj=xHW^@ zBzULb?SfRkgSFi#94U82lDjkEmt~ZU70JX%J}!gt!Y4$M>g5Y2Mf_eN_X*yg0e75e zVKPl+@L~opiTvRVrf2YY29IPgMI?MhoNA8>e@t+y;Is_-)($N^k->}%o)zJff)vim z;3?rxN0ONt%)2nupB+i&Wblk|{_+Fm&k28C@P$Z+qj)Y8O7Jbgmos=>$SZ=c3eFd# zk=HWdk3x{V5lI$gurPx+CAdiN{7C1gd{kR3lD9K>N65Q^lrLco>?$%ZZDPmBV1EV&GSD+HGT0gEm_kw+Sdqlez!B~WdXd~`@0F6KGst9+%^)XH zTLklh-)0a9DHWuvn=@FvChQpBMUw9`_(3>#I4R#Me4F6*NM}a|(?*A>c4hEm2D>Bq z9wC=CD%dMzUnKu2gP$YLK7TNSUpOmf!%f{o863{wOa^B&_*Ha{3H}!8AIadTOjEx{ zl0P!&TsQ22y#C}&lELu|PDt$Ef+r)*Qyc1z&%ga>%a6ZqXTo&gd`M(+bmqD2< z3bLU>SwWIm7O%_?>w(w#{#IV1F36&SkcxtpBK`X_s4TpSVAV)oEsF)>NsTOOim;Yo zgDh$bsUuidu$~}ute*{kQ008?4Mo^UuyGbmBAx4{2+gy&G>d^*w8)}m7OlAXlSLwn zZlcykuxl1=vuG#0eHI-e3mcV!juG#aMdyfj5mK1Nm*RO*Bv*u}SrkW-k}Tp8f9{on z?!tQu_7LnT*h}z2K^98O;-ZLOoW&-Y$0+ZUMc+u?FN^-dFNq`rvS1gY+8~kKk;R=^ z49;Rm7MEplc^0>b{0hO5f3f>@iT^6H- z(8Bdu961p7iW^08QzXAx$nlQatwL^#X=skj0iPrisF9W-bU;N;V(v#m$K;CDZB&D%i`ei!j~nlR|KDK7iYe&W$`-uTNYns@dk%X7V9MK zLcx_;yr0FJSuB#^TUjg>vRLqKK^lK2i+3ZwB#Ytvaf5JcB6OSAds!?Oz9Nz=cp`l2 z`#^%Lv-mKQugc;h;U5cr63IUmGN_aGnUFPtYoplal@gyv{0kxL1vju~O4+~8Vq+FL z5q`sNFT~3tDTJO_LUchx(9DK!6fnw;bet?);ma%jZ+`G4n93rZMMiiw(qTfX zmS(Xzi*JQ9_B#%rW8os2*Y_fv*-6`)#kMT&$zeJ(&5)K zkDUz5UM3gzkXkv^&Y?hfEQhi=Act}itd>K0Ar}Zzxk3&VBVH+o@Mkn0EUYY&Dv`Wu z4!X2EqpIgnL*zB1*innazE>xQ#v-XJSTBmLpF;!T4I@dT9Da(dH4$M`!DfQZb9@2d zfBk&)*)pwjXp_U0B5BKpJ6+f#hn_jK%b~ppJLFI-q+<@9gme}x%At#pLP2`iHHRM0 zgxy0Ci5kh5A1_l9@wkvg4&5S2_gwe^HB<5GmBXbXzc2?)$VEByjWjRLp||ipk!0eV zVa@c*p}$BjiR1%>EPcFiU=D+X56{HYcNV{;gn!;>NzpTmS4VzN=pquYr&Ocwbh!FvVo6Qrs8 zb9f-)59TmcD(#^h9v0yvg41%CBIMCX^D!Y)bD-NaGCh(%p2HKuXG9W?4k|pA!_y*} zDL5;Noh@WeEmvWe!gD1-Ka(Fq1PjgtE!z($w zn!}qpEXsv%Zu9Np`J(e$WdHRX-VnY(aA72`)Fbv*4vTa6L=wK8!#g>=FR||mz9+au zaH-%jK|0Bkn&rY*M3R+4Mw{WD$p<-nD8W^NA4NJJbL{sBM>qZCtK*;LuqKBjhqfrJ z75p-XbwWOmQhgz0eGVHU$)s%sUkU#@l5EW38{wNGN%PwZ4B>nYo9Dcya4U+nb8v*a zk)+k1VH^25q(qXAA3l?u&f!cB@jMcFoXz2%99rkm zCXaJD{F_75Je)QK|K(67kJ@>Z{1Y#bQ&c9bnnx^;vUwnqR1#87uzVgBB6&q2{2GF( zF36+u`Ct^Q9Vk;R;??u0A-twwtw{dnw*__bs4KyGg7x#@XEHR%tAR)w=FvzJk&^1l1FjGv;EccZgLT^5~hz_&mQ7La#h7%wu#O*XN<- zagih(B6zXjC4#;4=p&@BAbsd3q`x447KV}m!Y>sZC^$%Pa2^xoH1M)KF3;l%5snfZ zn#Zs_h6^7dc%>k%UBxn1_}}_&WFCY64u{g!5_^r{wUOp^c|15RtnC}}xG|4AMShdu zErK@-et0Cb!0T2C-j>JhLhcZxeA&E$yM*5@cuyoBlgHSIkIREUm_y}>c}&V=B zR>&ebxmcIS=Mp@3ekCh>eLnnze1l-O&KmhwB5%1ayxs8nhNC!-??t#NkE9Si4E9$=^p2>%AOmR?W^Wl3| z4bH^**3;5~Y9R8>9G<0WsqhhV@nm&OCPIu|JOkdHk5i?mYJ9u`dt46>lAl^Bwy=bgx!ocjKNvp!x;9wrV$KgDxlv97p}D1nBZ@jKQ)25TJYz ze&$dv2){Dm&q=8Z!{4N$k?b!q7P%txTA}c&6ySo0R~EuwlBpJ;dVp2m;iK4)9Naa{=lEs2gBjfR_V2w5{a1!)m<%^#e2r&@e#10R00r3eY$}A^^Xk zZW5qrfX;L>K(heN1GEj$E(pKQZV{kmfK~y1uG@>Bink7MXCt*u0I##g&%LR@Z_oK5 zd8hg%?E`cS;KULg0(7mc@*`^s`Q>#d$$}qN7X~=7TTufPQz1Z65PtNn1lZqM`{|1k ze!k5hKld&Pz_f8@(Y3f-7mddGO?S5d-2?Op&@;frVvuh43ZMnJNP-sz7+EDj;oOBP zzl-0HR`@}BZ;9#?>Gut=dcQ)QO9BiC@IZhE16&$lV1Qc#+!kO^fWZMq2e>}KkN}qj zxH`Z!0WJ@4MSxR#l~Dn!)p02)r&iaKSg^(5dKcZO#yBU@c8n=7F{&0i^iX@xS6$4PrXI( z=L>q?9^j4u_XHTjh6r$%cyf1uUm6wD^1nTc`QiaT|9Ndg;n)D<*!pFa4lfpt55g~- zuI{2Siey57i6SAN6yV;7-xuJ1;rn`o`jeSFz|-tt{Qc(ukFe7Qm=<6P8;;&SQTUi3 zzcXr5CBaXVcy7xgY#pOc5AXzQZ%UZg;{k@BRTwoRz>`uNwa0`%^zl>>enmxvSpjAT zcuDe|!{P*ZKEMlX=sjWVvn+Ukx6c;S2tVWEFM%+-7e$$6d2pIaoEv}+^xGExgzqZ> zUJbA@K$}8set_2ktfRHcC9el~Bf$Fs4tCKN1Xvhgc>w;v-J1axv3mqq8sMz}ivzqH zgf9&9=bGOR@D2wHe=Pb_W%(n@$kz(VpSvc};}>NaYlfBCLVJ&+qoelnzWCfO+PW?p z4X)q--xgoV(Yi05@1lJW;6t``fR6&KWxk&(9|!m(z-Iy01mSN9@<*FLWw)ecfXZ0D zqP%)voI>Wsmy;_NYCL3N@N<^yWbqe*>jP|H%?IIo*IxzrS_ofR=Ns(Q;XBx43G+tW_1lytss2U)eT^?iau31;X46tsaZ_o1@Ku3g&Jr0h8Kok z*Jc7_1MCQ}GeC~6{u0|7U|WEEfPgM-kMk*)&yA%)`1H6rz_&ukzZ3F(fFB~smH>yR zCK$Dyty8MI1=Em0LKFy4e)y)w=?$qCF&mmj&aT` zNZeeg4OkxDvsgL&Fq}8L69G!V?O|&#wllotX>g%btVYkCFXtbtPtKVpD5HA z`)`2%I9N(Cr4&mFHU1=2nNk##B36pBr5I9*%SwS#lq*H&QgkUr`BGFUMcdNwmQ=A6 zl}gdD6pc!8L23B7RihL&OHsKryyaElJl``>wG?C8tGud}qIxMVy-n{CRg2B3iB=v;UFGT|({63Dt#--t-T2uP4rjR$&CZ+gzx=O+?)S8u| zxx`YTMJZZFyj3Y$3vUxiW|%QL-%g6qz7!pVP|{IIr&937%3xtBx|X7QDSDKms5HDm ztEDI|4R6qj1nCm*&LyQt@OHK^ydB4xudeXky?lq#trX1=ehk>N6#Oi10LxyAUZuFO z6nRC_O2IGnE)jl_;KilrErhXsg!C;%zev)*6lYhfjM`YJEni>M;yHDolznh129@Id zlJL2LxaWGMZ4c%0Qe07rTbM;DhL&PjDXw9mN-?|?SC(Rw)aO;D;UmNdwpwZU6OrV+ zx&NgU_rm`%^&QYs6wlX$t00P~C`Ld9B<$|X`w~sgIp>^{0Wg6W5L8sM82BlQNX|J4 zf(Rl(ke#?Yv$MMol_01ff+&jLox=A&-#LBi+^(*!uCA)C>0Nj`Vfwjy1pFmT{;nf` zxRQ5+UJ>+(pf4qF&g?B7a6_tJ1oZrUWitju&_9ByxfwrxltEQjLW*L8BN#%5bMFxh z6}JqJ@aNXSKMx$n^vLzyMN>zL&qqZ-%jqS$eNMNW$0K+mf~O;RCW0p;;GOEJ2*%QY zrRlV7oY>FX(f9~>X(5M+N6Vj$fKGT$9K{6VUpPK5>%RF*4nMZslcrvX;I#;UbSQmN z#J|zK7(v+@SuaJ9o2Fil;FSm_NAS?3@D%QaOJ`)f8o{B1IRqWk)RSq7Z=5`wSMWru z@cmzgrbX~3y`kYl4R1vdEm>za-4emuf~N~5b4CO+i}5T0-*?B{2;SkT(eQwVc@exD z!3oA9g7+e}USa&C$A*qjk4Nuq}eGBREL+MzAA-FCy3z!OjRikKnKo*cHL4zXGox3Op3d zGt$(WN@=?zsJuF`NDu6d;L8a1GuGt18rT=XR}pBd0>t-gY3I44Re@5|1Jks?#IFP2 zt`2;|&_r+~f};^s>|Ua(3LTDM!gD1kfA`_Qw~XN7z;UK}Vd(xDfnzKe>557gwhw(5 z!Mtw*1X=`o1iwV^YXn9FW&}wlVFXqLb_8w&@d&ch)#k>bXaq4HA~%iLVUDc{5WkxY zu=~c`fEPg`g1cu0R?P~uPFI_ngo+|K8Nrzd&N84gY#*-){1m~t2+lK1tawubKOPPI+A4iSx=I$7crjgRXY2IslYSwBi!8+& zZr1Qy1eYTCBZ8|D{LVtXGH^M9D+2nz5qLRV;_UXof^_BRX@By#arLc%(i)f&&F2UH zni{x9=G4I7LjMtZJ%WD)kY7SWNzE5vE2ZJ76+VE5aTf!$WLLT>qoJ&Z+ci|saEpd= z8gA22UW1jcZq?9aPGI`fz~UW&U((frL>g1>*{Oa)-l5@64fklMq~R_N6*b(g;k{*n zG8yWT3{~e;VD~S9OG^TiyM*r5kg+y!pN8{i(;j~-&^$v8%TP@62Q@sTp_hi<8Y*k3 zqM@FK`WmWgcvwR^XK8pu!=oB%X{fECnuh#$0yQ-LRzQjB8us2>x`q*0(Jc2d4K+2q zn4y?3laB=6=js{)8bTV*10TrfSriLsHdDN_- z`I8 zeLOeNKtn?fZ8fxGj5IW+W(_UqNexZuqD<9H<6pz8ip_JEUk$LkAeGi{N?=o_YDvu+ z+Gu`Sw$gCq+d#{K=~HI=na1|}@xa#Ef%Y0YYUreaxPyjO#{wT+33S%bMMG?6pgXtR zB=kc(t*eGNy#QM`4M#H-K@SZ*MP{0lM#(c*0(~^})i6QBL=F8k^w;o&h9@-)&@fQL zFb%`GDGh@)4AC%D!!McY(~D`P<_1V7B-2sd^BymhWno@QDRMi z_2C%}&x%Y=UWw;4Jg@ODV*CQ~_2EGJdw~};Owur2!wkkp~9tsIWq!NHM~Z*u*hq8UBeq1rfFbBt^2>guq?$xQ9F@FIw?z? zx)|Uro{qOQ@aP5J56sjsixpnOyBcP5?%cp!4ew~6%p46TPNkj63myJGZThLeyYB~1 ze(2NpG%T4H_&~$^8opoQAJr$b^2wPmhmqhT4GXvh9W!-&tl<+LC>?j{Sg7GsMoq)F z8Ww5zOv6qMpKDl5g&J0CSfk;>s+^_to`w|~mT8Et%Bj;dOgcYHtz=ec_#sPe%u4>1_4I(wxm2wrJR{VTXo8)pNFL$gPpH zO~amQIqWv=6mC-^XGXSKOg*A=mxkRM4$A6ZP)x&D8ul}Ds^#p}@TG=*8g^x?g-yd< zdWT8%Y*lt^&gpD*fJeT1&es~IR`)ft5q!f%HT<2e4r^dLA~@J7%tq!h4aYTH((t>6 z@91#4lzY?=VF)zDHFz3y4Tc6sgR8-0`C@wKsHg^;d(TnLa(q9e=P2SB%V3UTnIK}016n9O>p370C!m3JGk@KU5QyR{(rfE2>;SBRc!%xhp z9Mxx0T29!X(kATdWE&J#KlAu7Y8o!`#D&$Yu=avC_d^G4NqvH<^SLqE6|7iGA+Fu&36;G!zocKVl9~Ulkoz4lXQaV(w`d32<-Pg=k zQb+e(A8@p^4(PaH+fBMJPh3{VEjr%MRk!J&RpoTtDnn1^s@G*Amng5}b{Vap;|?8b zauwUYTz?mgQAHhh>*%bbi;jDARML^FBTvV@I_}d^T}KTa_v?5-M^zmU>v&MdLpmz! zsG`HpRlnw{bG^bP^Hk+Lm64}f_^~qDuroZ6EHIukv*i=xC{1T(F*jy5_v>UeQ^ zPFo%AbhOvefey@9Jcc|h_Z9d%qO~pM`0!|VqPGkDgWOd|Hyw}bc!Ckv(L={j9m90= z)X_`FKplg0^cKy1b@bEGM=%$n)B20+hzC%(PnZrQbIbCa!6Gw6$Fp9kg^Np3;N!)m zI5b@NBXo=uaKbJ%O2=sNJSF#Z3{#SAjHsoyCv`lf<5e9~bd1$8PRDaPp4Ty6$J08V zp?(1!3e>fgIi!q2i)P`W1!`h}nxJE%j+b=2tm6e8vkKHCF3Ob4R`+xYlXCBD1h43r z%*5#JGuc?^NZDOdpr-10L&r27ugOGmUf1zOfjUv3-qi6Hb6W@F^0wpy-AjivZI};d z3;cl2(lJ{{$UvHbIXdR*DAI9K$2&Ua>Da5|OC9g(cu&Vt9m{x{bbP?tuHzH>gfVR& z{*Xzc<9|91vva$7eb|r9)&3+%I>r zn5U^wEny1Du4y@im+M%eW2cVKb*$8}O2;}K+jOkv3DvPyy8YJWgrvpR=Mb-F=-1`k zz#9Z_)UipxW}zJ2B4De~^xW|FV*UZn+}vAE_Y~c&K|)8T#f?!bbO^l z*J0?$C{+7(d_ysAU&q(NXadO@I*#)=>o`iu>N$J{9n@QSxm*=da=0c@OmlKIio|gg@)e+NSvApPDM%jfbr$e}I$FQTr)xl?9 zQb$~eC&`cyN$t+Q zFB&*ht*#=ys)N3w5C0Eb)A6^Ce|3~F@Q?WLx;U0@RCWK8q;N^Y_ck8~Y^4l83hnEv zn+)7+;9djw87O0*EWgh;aHoNeua~;Tz^w*uGf>U|^OJ34T~*%j9eBHe3I-N+2ot|t zSJA`s>-t4|LtS;30UCd|fr%(=`JqAwIRh10T4<9VcxmH)*Z{Ps~)eKZO@SuT* z3{){t)xen5Ih6^zhCf)H!%M=Kox=|sAb!NaqXt&4%Bj6Nr*G3R#Y%3=p;!$Aj~S?C zptgbK&B8oEH4Vhug)epSW$Fks(kvVl5a0&4=1`0Z(JY)!Cm85&V1R*416hV&L)se1 zHjrbWv4JKA!Ul2;6c{KpzyReL$ftjl;zk%L-U?W&tJBQ}>KUkSfX@geG+(I(v}$!u zLj#R&*tRW)hnhBX7Y$bDG&L}vm#ci$+CVb{&Be(r7^8OKmIhevI7-|~_yld}aCs>3 z`QFYzdjlO9CIj6K^f1uLKxYG88OlP{g?^TTz>3jI{a59@T`I73_NXs54C56 z@~TPUZp;1S|EBUEb{{K6=0pQ87l8wMsBc+tQs1|}PL$-sK0jwOe+JRO z{}^!t?--zA@6%U}3+EYlmxocQAC%&Ci;wd6m^Sr%@PUX?k{ka}&d4WX43&RmV1aNx zF6P{@ibIPGe8w!2Q8E`BSSH7r<}ER>RQAP>_)%G=F6tf$7;Q(p+kI2KGE4ep^oo8}YjGw>B94V*WypOzai444MKHgM3u zaRc8O_=Xu`;0X6_@S7#PT~GBZmD^DZF0Q9`)l;vm3Vv(gn1LS_lqNnN2~xnSr%o^d z4hA(Qz^WiY#K6EWeZa2H?26}~qnH8PK*~T7LsmLB$`ZlkG!Qf3@bopvr?AU_uFQM! zXppo_eSf(Yqw*65k_MhBmCIJGzB*~(djqEpoS_*8TGdyl3{0%A2!7=05HPD$E~lRr zduaR|QT0=C_h$pY82Hn`Uj}|PaKXS81AiE}Xux_az3TDc?*?YhPXEooCB`ci>~}0k z%67T9dsV>9&B5dK6-T$#SJw>u%`$GHjER2?T<3$y#PMYCUur%UEM@vZEMemIO@$>* z{;O^w+u3D>T&1+>uhnX8u+^I2O(sZxuCE#_DJ*NEoQWs8=9OunZlT%+{z4BmP&A`F z^_U1-$hAQbhah}nhL$PJGjCNR&JKW?aocFX~c3*7dhv0vW)bl1Lm^i$<^npfdA~QS^{BdjW z1&M-+`{#XKBlVJrmrYDJF@t;)lTEy4;&l_RnwY}S#DY^zBpWGi`JJ9=(>CQPFG%Ja zCZ?G<-yr`@6PFvQ$F>K%917Ok9(>Eh+a^k!2$pM+M*TUvf-_CbGBMZWyJ&;6W$8Ig zbt_n@v2Wye+k?}arW3rwylSlGndsJ79qOI-zKIV^Y%;Og#C#L~GqKFXauXk#_{hW} z6Q7w_VB%vF3r&1#;x{Wedt=_{#_AKv=hqsm7Y3GSmI!X$5d5gIS}YD%h*Y`5R4;T20fpnAmFK3ln=xY%{T)d@<(L-9biqhlz*3D1Eq*zuC`C>|(4p z1li@#ZYI*P;MCIjdzm3egZoV!F!7~{eI}Z0ETog`tu6dYvW|hEJztwBTvm8cocYzB z;JiJ-yJn;xHgSZ-%0g)iM@@Wd;sCLYNG0{D_qz_4O$;O$r87&Fxo`@(!@`peNEJltbR>Y*?mFhNbnT1B_6!FsjAXc zoi*{3i9b#J#q!J4GVwc8%f!z-2qrF=xM<>6=4vWfe`he<)HmkC!}-6NxVo{B)#(z4 z`scN7s?O>8t9AshFqAujfAI7*RRkvvFwN9e*(o1z*G&A)%5UO2>u@sIV`h4t<(P9Y z_%9Fp_FzfNFO}}9U@4dg54xP%RUkm*#46-oTLVr5Bg&JUCAa~S4^=P4Z zH(;q;)FF4mnjovw5DPz zg{LTN;Ry@JTc{^3{2B`qoOArA-tP56j$>`da>g$$jwuPTsD(;2!=2l8yoA-`|c^2Mf?53xGI3SNt!}gO(zi09P zw*(pYuG@q2E&R{I5(`T$d}!e#3!hq8WMKg{uP^-A!Y2&qw?U@&LRqoefi$lB`mFSQ z-O@g@u-NjeC}Xi`0H3+v~=zl^uV5A#qouEEbO&F4j&5r++g=s>MINTEqra^ zpj4Fu%*Kz>`n{Fjb5?rWy}`1p{pS(eH_Ve(etsSiSAT2a7^B%r9Tm#6aNNRo79tij z`mmKcA(Z(r{zxI8K{|6R5@f0zTIR>`(#D|0lWrktAtef<790z%g_z|ROuCUC=9c5E zPTWhkv^FaXH?>j;@yXF>9z$7V;iQE#7S3Au-og(SPFZNWHm^#f{0AH6zY)#*k;ms) zu!s2kw1xY31nGQk;aDs6lZERG@(!&Do@%9jw(tv!jE$RY{A%HXg}l;?zbrB~O51p=wVK#4pJ%P4jZ(I+p>J!&HomogtQNLbH`^#<;|?2l+9+%L1*)8l zTW#E8`wrZ&HjmkRn~m}|D%jZ8T5)%`%Mhy;M=8UqK4y0MT{bG(xYx#gHtrTZ|4b@< zkBy?%s`iS)N;ZNU^Zsb9s zu+h@Sqc*D9$gvT&QQbxj8?|lJvGJIVnl@S=4#szvrWs6WKCNm|$#LJR0N1sVZX?4+ zh`U(j*Vvk7J|8Y=(&arc(?*t!-c8cEk?2AHX_DVYWsA;sZB(v}JR8bJJsbHf{x<5` z{=u2JAuqbIu+aAJy$ldFr`7~Vwo&zMG_cXwMiU!L7L;ztxug7b=j;nMvhm{Q!O3mZ z!qtUMZ8WzruxDB`8^;d?*%-T;Gt(*Aic8xVVq>U{Ha6PY=x(Ej&EL9F?QC?k(aHAn zt-Xy79BQdp`RTg-ZB%C)U2Jr<5pSbd!^<5FcC+~*H~(rIHGg&R=7YhWHhS6UZ({)W zYh&M*yuMUrqmK<^*MC<;-X5#ARlQah(t!hQ43bz67H{OVRc+d;x_~jIr^!?SGnEy)XEa>3_;Txjrvrhi~fhJ=31DG1kU7 z8{@fs`IyY>7N2)a0N$^jrrOQH1FQ3RxqZ&Y^Gp@G&c*~A*VgAvwEc?8kGFiTy z9>$k!yli7?TlEUXZ2zXpHu0_W1#Q*VwrUE8Z0xl0xsBIsyl&$Y8w+i`!Njxiu8sF> zyvg%oW44VsHr}=|-NsBC-?jCR;S3wzDF1AZSsk3|24~s0(pK?-TcMq*(@xFh$+9tz z5oxDR4=Tay4J*m;c8Xo5%KMC+jsHoGeIUs*sh#?eDe4A4vax`3+xd616-x?PG)O`x> z?cW4f@u0O+PCLcVO6;z+vChV38(XMfl79ma#TI|=g?4JAjZMPjXAKsC2ivQyJnuGk z&{r!8`H6VDEO&g8|52S?I-K{ST{d>p9vh~OFKq0wamdDD8+&Q(q2PWS2WSH`jb2@u zM|XWCiS+oE;7z-NU)wmy@HJNb+pBMEG-|K7C_iU~HU){f$`R%U{m(42@vZpw7?VMU zc#eFJt;;)ML$jeXjon~G=mHAt4?a07eRA{sz3r7{!)6t-aneTAM$E?dyGtkND;q9P z3d1V08sEHla4SaJHWuho60`oek`0v3D z9n`H++!jT}DDIA;d=$6K=$%ni5O9ak!yQ!LD``|xqfF>7;hYqm_e4=ix(`HguYmia zxIc<(GFqwQf9s}oR1eB1H8ks}szgyWiu5Qlg!yn3)uN~##Us*vv{-U^$=n)IJQhXm zDC$H}vzT8iihjkKpYEsvQ3Rt1MUfW8>|*}-GNI)i)gI~66`4_FMNtq%VHDY-Cnt)q z0IQ?QjUq3K{9^sTc2wx(TV7RY-6&KP4P>;Q(E36blnGI$Kx7CS3bRWm)g+3hQFM=@ zM-~&f9W0dcLl~FN z|3z?^Foz2@ZVQcyVssQQM)8tx#t3~ripQgPB8n%aJ1&axQ9LDhtkC+!+Mbr~vqGPt zoyGj;gfp(QnjnBSOpM}%Vmv8|86x>|6t6_FG>TO?qL>-QoG9jsz%1sHfWL}uySt0;ig%)z zC;YT7s#O;?w2OMBi+W!;A4c(!fDfXWAI1NonDuaIVHdSaCN7BL<0uwI@fl+m#lk2) z6=CW$yC`ZSU>kouNV-^tmPGMO7j^YtpL6VLa5(N(P%upx?#Q9RVu*Pkbppl4ULMMjCYN3k`EZM3;cF1urkWp;?b+g;VJD0WBj zRTTT9_#%ouQG6*wdxierEjeH+CwR;NjRabu%zN$Yo0C!&Z%aZ3#4V$h<{SuLaZBMKu5Gs?I3;-@Gq zs+FZr3XKZ&qKNTO2zG_Wqv$5fQS;N?R3eIG6e$_XUw|S3vqj+LpM&2=@q=)F6na|d zDHgXX{%K`9Bb+7O)VV0m3;r#Np9NeHN||2-{3`U?qiGif^cYzBhK5Vh{axr~9+sc{ zKwpjGPvMk``L6g&@O7crg#In`AE7MZl=(M`5+YnuC^?^ZQ>BYBVz?=Wo26SuXxSK& z#eTRV;MN!_$vloxP&40j2rAe1`qh~ds+d~0`AQSjYDcTd7S0v_qE?iFxf4EM+I zKnxGYP$P!NVt6Qq$}v0~!y_?N5gF>N8bf|}KhRx-J{m(c8LBRH<0ExBG`73C)F<@O zFNHOQSto`-47FmY9m9c-{b$^pGM6A2L#SBue8(U9w7bfPAv1YgNVo)*E6XAw2e$VWOrh(86?emBi zo%fe(B%EDhPtzEhNw-xD&0}aGxFv1A%ik1ROvJ8qSFL4eU+K_-t9~@w#n3T^PBF9> zeg~oCSLmTS$IvB)?!xIRw42a6J$xTF5!ypI{RH=p@ki}2I)*VZ^o^lk3`1iW7DIoL z85qN$7zPOD^zkxfa129)^R{%!|4hK}7)A`^qj8U6(a$59MLuF`XtGbh9 z=*1Xbis9uLUWwt27^Vqxatu>qm@4?y7$(aUPJc}}uM1ru%wUPon=!l#zEB;CzI zx6oRV9Q&J}c-w`!Qz*MTVsL)-`JWeawr8b(5yPGs20IwyU~ddxvPw9p=wM$AU&Z*P zA1=hOpGh7=G=^9VU&nAThVNoH5yLkz9E#y+4By6ZSaco{x>0O6c7qD%xX{+E{TyJc zTs{?6+;jb9ycbypA7`~6;hZy29cruiVAt4}n zL-K5$`}+E>>olscD29{5ys5W(xVNg`Tm2ZrsTh8W;hgYK$8aWwvoZAO?dQNap#*aT zoR8t>7=EGKd#es_i_ZP|M`Y+CFaI%=bWqB{r5JvX;qMs!iQ%%Sy&A)xFDyV(LFYbdq9`dZqZJ(7F2EnXKXiwKI~}~+N9_`sNFQ~#gL@nlI4E>b z$-%u2YB{Lw;64ZUJE-d5VFwQsYk0`PgMxpR>6IN+k#2fXZpm7??`Gsa;^0x?JSMc7 zgX#`yIJl*+zu#&?8wh2$rpRP<$*YQ!)f+I`}Q=-*DLY zxXE!4c917Sxk9-d`CqpBuRiBH7~5CP>#OQIP!3uSu9zuIMd_k?hP;a3Gt0(xi`u={Zzi*Q*z917gW(QFIGD!-a4^!rC@ZWRi|9tPOm^^=gSQ>L>R^h4*B!j!U}~}aYYx5<4Y{X-4a$Y474zQ| zaI&A8mgQHN=?-Q%m?O-Y4rU3MEwn^`RjL1fCoZSIn(N>l;n#1Q?{A@8=sgGTJ6Psm zxq}ZJ%y;mygHIg%PsAwmk%JE%v=t@XGPl1#hH7ogUnpRagUfrZU>B-weiybU+ zu(Vji@cxSSQ`Kj^d);CkdxWkk_RRkN zs^_DAyuNa<-@zdVhaDVn@U?@341ox*sg<56mj6@0-2>DS2S*)z>)@Ek1O}*P1OD^& z-~sAY!6zI<9C!{A4m1b41KUB=fgw{&2Nu08lADEULSqgb2d;y-gP#Yen+E!7d&>p; z(SfQ^x=9Bq2R}ME<)FyHNeACM_<`qcpc+0<<=*d~<<~@#VDUh8T2>@J!(t`;-2>I- zUxViyoafnhQPRcF4t{ZP*})YDzdE=eQ!WX;$oeCzxH9+rZGPJSEjgDjJm#X7i-a4#dGLSCnp8E|AI%-CItU232)Rge z5hS<}zVkwu)6=Q^uYwF0nJ&f*R>Y)}i$RWyu#0*wwhUIeF7jN|b)iHu-$kK-0-+xc zR-DL2KqXXrqt$oOpjdfB7mb8}Ly{{tblS7o%5Fe?mEU0ie(+|5M~0o`4=$#9J! zs_qb9Pfr&&ru1>q*Tr}jPrLjE75!a|axvP)02c#Y3~@13^m7X32e}w5+Nh_~5H-w2 zt9Dr4E{h5yZ(u)Q%x) ztc&AA)HoN!|6D3~#>KNPUUKoWi|2%SeTbUqV)ljb^DZWc@Tnob!(VVQ$;Fz>;UO2o zFVf%(Vd8s+s#lmxL)8=)Qw2P;7K zx!~w@7vqMiw}-0v7sGE0XR*xMIaJM}87@*Tid@WbG1tWxF7~*1$HhDst6Z#h@ve*a zTzukUp^NujeBk0k7axhE<_rBF_w`#?AF9p`RgZSeS|Cii?qe5Q|1O|0Y~+9HVv&ob zE|$6Y%*A36TjHYT@4msMhbhv3+GjmDOf8ooc2~Hd+HxIz4J(Do(KRmCy4cK63TK^* z4Fc9n%Fz-AZljA$E|_(k80?UhJxpzNvCYLUk=)KGxcHob>zGAh%Ip+e|5BJ7T0Xa3 z)@})Un_+6mFtyjkmo79K<6@tSuUs5;@vV#fE)KZ(#>F8~`?ZUM0yu>_nKL&GILtH? z+sLHCNyB_E9b?=@_=M0wx0L=)zb1st6}Z42q@sM$bSwH8R7^2DYzush<_Kr z-Cbch?U40{$XsPL`z`#GD8J^S%!0JPVw&`C`uP0xHCDhk!eU-X*l6(7T0l zB4<^Kh03#}vc*&QKH48@VLI8;|SX@b**W(ds`nstM-IFubn zj^MD+T%mb!W7+9Yp~L9!Cr5QlMoVtpv9g+D2&G;?Z_-v=>|<+tV}alqLT3t{ z6~}A=bA-+n`i@Y}nkV30q3^}J({=4=$ODUQv>oGk*j z#<8uKvptR-#dxQH&xHp6%=sdYJ#l=V#I7Xv#_=T+EP*8n?2F^8IKJ?($HV?O4#W}i zkmlj*I1a|~R~*;k_=e}5zvmW5B#uK&k~ogUaWsx&!v8i7zIFGt<^_~ts}js4J|4$+ zGWzw7%v*jAX>sUrd>_XTaTsx!akz2BS6vyQ_PRIS% z6JKCf$8jbOzRuWwEaR+9{7L9Jq34DE%zp(I@T*X+OKqgT#c@fNApWIk<_+c*;anB{ zf3R|fv#9x;m+|nnj6WIuI_jqu8Gpy|PaJo9xW~iwIR1^}77yh-l<-i}LmAIEyOf90 zp6`U4J;38XoQ24|NrtF|eClMQ{<5CG3g6Vs?yVkf^KgfUJ4Ld*huZ~kE}cMH!Gr#A z0Re|d+3xaC(F5la(+`zA-0PvLhlf4f=iz?O|NZ33p8s~{2RzIyUGSjizqt94KnC$c zp8tkuf)1@Rst7-CxO&9HqaJE`sO_Pehw2_4^H5VXw5gC*!}H$^dt18y*4GoyXO!!m z$wsjMKzbd@(Ejucit)9u1VInfOpxv&!^4XnUh7$UCcfuKH}-!+qft;cZH$U|cf zO+}cJlp$^6;g1m+6lg|w)#Ph)GdR7ahgKfid1&vUwFf3STU!rpJU{=JBs1-?eq!(l zbnwv8Lub!FH5>}1W$;jR^6<=XMchT^^6j_8-97a1_**3y<)NpCULN{0QXYEC+`b+b z)hcA`Bi;Ejy&pH2%w!-2dKlzksE1)5K0D^W`FgO2Az}=tQ07p@G+H>^!}ITFjF8yT z9vaE+Xb)pN{;@Fse-s|~@PvnP9>#O^df88U7*R3fDG!zAW%BS6j}<<_dzaIn7W|Co zzfbe|dfAlkolH1jZpdE(&>58rJJvAyQub-{co@D0u%%`na5FJ|}xZ+Upy%XnMx_Th?n zIwQM3gJ712*&g2a@PUUp9_D&@*Td&3>x(Tu}*`wER8c@U7z1GoLB# zVS$H_Jv_KG`$N(HkDzQ&RAY4^K%~XYoV7Xhd66DJ$!FQ zr#)GFJ$%Vyl|VM@zlX0pobhm$_20t*RtygY>%WJC9*)Tp-v~Xzvv5B1kYH*%?D22a zOA~ORqhiCi9(IrQ4LB|`-+4G8AmTwQp7lk`Qn#(lpoKO5%rHG9JS06>9&8U$9z73c zen#AbBfu3(&hqclNkb!)SIn7zXGY3Hk%#X+{J=CGlXsGF-;~*HOy0Q)VV>L{S>-B( z*-mlSeARD-Fh@@dli(-62I8&+DkgB=!_OYBdHCDIFCKpN{8vt2rq4ZG^!(r0zvSUJ znaEXQ`(>38>UW-(5sDn=O8ym=3t9at^L&K*Q|#d?e=*#X!e#F8m;Ulf{y!}E36x6U zx`%%mf-CtAw`K6H)+G|YPIgNtfCS1UP&NS$-IT!132Ydlx{Xk@pO$bfZta$Yzu!9( zel;s6^j4v_2`!(%?E*MjLBJiNja{yl`CQK33EY!F)dU_+pi%;S{q6$^Jea_}34i1F zC2)TNkr9f!;}GdX!mpe_l?3Qs8g}G*2KmG^?2!Z>O`ui+wG*f&3)M*Au>`6oK>I07 zC2Tbl;CsEfO>(%?Iq!4L37aE~5639%T@8xuI&W})}zhB9x zhMWY#35-Z!WCFQVn?UCTx+IXFKtTen6KKO-Cr~$mCJ8i6`0ou@2{fQF3DirVzHq3A zOOSH3Q38#{9%4H7y%CBQvNcP90d0{0-QGO$U$|Q)&`S0~4{$nZ+XVP#^L7cePhkEh znFXPYu3JML66hrSjo+5HToHa_FFI$3-{M$wea=Y>B}m=u`60R0uBd7QYpAoIlpwmzHriqIFEX1+uN zs;ZY0sChn%fJ2iLc(r(x%-0flJ%Kq1%uV2p1g0@PDrU@}PyR@MQ}Ejfyv4}Y^KUr3 z$?zI8ot~Eq;Y<;jmB4If6dz1Khj{tq-S3?Q=5b#Md`Q|j<6WM(1UO2a?{SFf6 z`vLU`pVudLKT2Rh0t*xPRF?ZVflrD@X%c0)=pt_RS`IaQmO#1}qE*z%(WMD2W0oc{ zGKu90tVp0l5+##ZnZT+9>;$3-tWID}0y`7lZo3C*pUF42E9 zmcXS1eow&Vxk%vq1b#@slQgE1R00XXNuf-$m(wze#O#x@I?W*S#{^C#@Jj-}CU81| zGu#~=%SzR<6z_+mXIW-PDptkw0)9^T7eC(g$YJBqg#<40tg-mZ5O07KASH(yE+@d$ z`jZ=>ADF!jv;LrS#%5dx8qhTJI&-o`=HDX!kKp;C49?}9@Lw*`ErX+_k|>=- zVG?zdKoU14@n8}UC2?~SWsk%(TLp0XElGdTa!LR0$L?)O-yYug$_wE2 z@{T0`h60t6xHpNrlBhXSeRd>tcM=sjB+)X7qw6v$_R2^_`BpM(@|N`0Nwi6Vpsi4Xc1g4s z+@YAm`*5cuIw$>$XqO~-r|p{b@3A*7w+lzA?n(5Y9O{t-?@k0gxv8-kyuJ6~7Lxvb zZ;%M|6FPuYw!mF9E?2N`q#7vl6k{8l#E>M0a+YZ0MQeBx-9rAYkNCR^*`tyeoy6)S z)+8||iN}-pIEhb^c!E1k;=q38Fbmp9){#}lM^cDK&|C>&kDIz~r z9SgBu1?a zu@tjv@hh*jaz@rAL7Umu3)moZV-lMLY!XGvz3&O6$yTc@`?99ZNz_N&QbE!t#|u*%UM~lQ_kkOu|UQOd^>? zDhVqII|(PrfB!;M3RjFK)yt+gsEV~>?d4EB36E|mlg8^7KbP^dQi2sGH_W$OkrpL! zQXKm|6^>Mm`QW&c--?fnBz~k%PGsv3p#{bxRC5b;+u2Z-< zg{wRoUPj3jN~L`8r*!`kdM$~+1(5$w64#6Ize$u3Ve(m6N~iq8j+9@Z7&2l4o`Qo% z{Ethtliw!YlJc)-52XBOO1TtnP2si_%BTDr<2@qh36@p zLV&wSVSLKZ&rk|!DRfGqa|-DxWTem}g{IV>LRN~u_l`nt&CSeCA)G>P3T+mr=g`_w z>a)e^y?18kr9hf5G?!qMqHx_5R0<76nDX^fs4sZgmh|4ERD)uE%_dnKZ6w{sLRrR} zrO;e(yA)ca&@u%s)Fy>i!fc(w3p=xiP|wcn(TmfG+on*uc9>nNYM(-f6v&|&WOfu` z+S7$$N?~9MgHq_0LiZHrC^NAoSnj) z6kbf>r4;|H9Xa&RH-@Z6Bqkq;RoK<}Ya(ucz=v3e!?} zGll3VMb4k26tx+>vpM~q(Td>h6sD)Zp&2R6Okq|E+vbFGMk}h?TqcVGT}G?9DZG=y z!W2GDVO|RFrZAr;h&IseB{C@Xfq?gA-454sxcc~RrO5v4 zgnJ+D>t}msv|2h}|AIuai)+k1q_M{M(lHy1`;ixNJ))3;dW0WUz*?n}3N{R;Jlz<`*iSQ38{Fp+? zB9tn^sT5A9a3zI5QaF>s*%W?e!f>I+nLnj)UI1U4a!$bDnpyjMW^(9PdZTCN#T0%^ z;erhD*>|;U)+JV|6fO&=@fbxWg(=C2)&5Nj#Ye}qH% ze?`f4J}=7p%TcC8kuO7Bx(F!pZM&lgHwn0<2<3`!a}mmj3?<77xUuxDMYyd9w-=#8 z5%{mD{z65*at5zZ-P=sI+a*7b|)Fd zUTzWciqNbG&5Mv<1m67F>K37($o~?XxKNnHstEOjS-%Jki_l1LgJQA90w{Ka)1(MZ zg|qxXI+-m5w-(w`Xe&`mvSO;6H$ zH+-k^y-yN<5`H=#XM}9I?cE3d%u(zJnE6QN1EMp`i5#;SO zZSuIAlCj*#hsF8Ihm-GJbzT)DN$11O@+*wDI~q~Q^mjh4iTs~z>2)F0VJQBakDEen z2~u)9AOGc}Ko|wXov=Zu<#;T2{*}N!i)c(L`X?Ns+A6-Oc?KnF*S^` zVg92WJQv3EVU!P}LKqK*@lY5Q!`_SY=a;?JT`7#pVcZqQ-CXPLKdw&=;!vB*~;ejwl^;W3%a2Pe&VgdhSVeBnbuU43!QlXyk z+Jbe$$PvQQx_dfiQwuerbiDlDse)W+jh?(Li{nh^39f zXq+uQG~TC#(Ikw=+3hgehtVMnez@5*jFw@v3Zq#V&BOSDpZtdTA*?@xRA?PWn=sl+ z5lb@)ENv&%skt}k?-<6DVLTPa(_wT9qq8WpD5FdxB+rELtjN2B!Ri@PM3yr9LKrWG z(L0PjVedAtYZxzu@p9O^@#CG|D`C7E_TDIYee_xw-8j;rzPH18J&f*Q^yCcA4^Z-k z$lna3hmedg!&&-PR^BUH`c4?{3TG*m`$`CTcl%-V3wt-u{lj>8hi`x&$v`24*psY; zIzz)476w1q9nN_VW3=!Qf+NESv<7eF#)L68jEP}P3S*oUQGbGv@nKJa_hU>M<;h{Z z7seDui_|4jndsdphB2K18OEV7W`yxU7z@H!C_~`=&rB|*eYvy3-mT7T!8wA=ekf#a z81sb84}14WloJ<)u{eyaVSFCO<+Zs>!dTALA$%#-gwX7=FdFUhQGp+jtq5Z+rzVV* zVXO*cb=dpVjA>067Y=(ogCy(1;Aeju*uzJI>qYI;uy@7B=kLZaHi>+57>jx37K=6k!|B8r5n0^#;GK^C~s7B#wZbwIQ&j_9kgNGt!&k1?) zu>U;wt7<{sh4L}khmjD%J9!o*xjA$Rr0A}y zK}*mU#u=hXZZ-?8aLcW%V$ZjJlA~=3 z5${pGji{Q~zgP9P%Bq5yE$coN)m7ZDdK*ylMMy{< zn^w_K#iNq-j>Z)J{cv74NB-qN0O}jw;@wlT|#aqLYdjRPW0+TsxgP zt~P<(qIu&Uum6;ar&W+VBlxT!vt5Kdr{Z}Tc%cG83SU&wRmDpxURLpj>YbEc;j|X; zGj&t(YL>sIB0azpzAlpPDtIBu#7}BirH6_)Rd1K;DL7wtyk08aQ87ftP!;d0=&fQ9 zU7GJ>*!NMrU8ui`zN)uC`U!Gf@Eb}4WFiJ~DvRcEI*5ZgM){PJVLwa-KZ6*{fv8~g z4yTt?ZwF=?DP)w2(L%;ZPk6P?qVZCTClJOYt51;ZM8QcaCJTx8R#^1Dim56Vs930C znu_Tv=BW6Pk^iKBhU&!zx3~|)12a``HPIonD1R|9n?cpwd%2#gVxEfmDoXZI20Wlp zhX-}uw{y?o?zBk7VioIEe5zuJilr*nsb2Kf>Z5$5V!4WsRgf>^bi+@wLd8n))f$;H z?n^YdO89Ek`yLKAJ-!aCWp8UY{)7XU*9{JYpBrvau~Ef#6+75UB6ky)*bly~T+7>i zn^kO)L3xh=)q9BWs|Z{ppR3p=tAjVs+^cso9#rgCaX`f`6}!23xvr_t#jD~gu2!y; z?LK}?$*rEjz{Spn7!Um1iXP(!(+n^Q4|31hm&>n^@oxN^?0nJwVGe}h9YKc(j;c7u zJtu-<5qziOdlkBhsEXq%eo%3di%a!B_Ld*ndbq$z6{k2T;oR*h;c`Bs z;;f2ujKJEBseE3l{H)>^A(T-5tBMO8tVlALQT{_#!DVjyjE$-OOETSb4yT@d{!5(6 zVdkp{tKhvolPV;lLgVU|SoQAzRm42>heYB6R;B(pJ0C)MgYUmtB zsine}rX3Zo>V5ry&ylpaj)Y#lBBfX9Kq34{oxC%s97$8@)4Acc)JHbcO%kW6(Zh1=&p(pFk4BGgig3Sf+`VI zkKld^6S?<@5jy1Fi0787G+Q*Un&5qcnG*;r)`)mRt`)%p5%1e>4@U4%1P@2Ruh7(t z;3?jry`}I&8Qz4C`l^2Ih__MHiGXkY{3ZkUt4AX6MbIXKwh`2eAUA?W5j1A@j(|Vn zZGd^=gg^vAA@v1Af_$^1PachUdmU4Q2pS6KK65eXe=Gte;(d_aG~z`L-+7xv@VKNW zBL6#zFg_Wj)M*w$b5U*~NJ-0xx2d)gY%Ol2kajrab`dZ5Ga=D2f+r*1OWddkIz`Yq zf}xUqDuSmYcrAi%bl?}c{FLFD2>6k~vw~d&nSCyT=Y_u@_@ZFfi1)P$rk8}gEcgnY zCWN(E^g0K%Hn*2xcfmJUH-a~Xza`jHkZP>*wpb=%mg$`c-i@Gl1brf4-}*-|AcDTa zne8WpY6G(th6ouXI9N*ezFFlH$<>8f@#913(gSyKyYRR zvm%%s!JG(|NAPh3A4V`Y;+;K~L@+Oc`4KFNc#C~O#5)x6dlw5M-Y1njXpt|y;9D%E zRN%`aZ%dXkkRn(X!ME3ayxZi{oZI^f24TMM6E2VlRz|RjRg%8d5v+}XAGVUOiJ(;< zg@m6PdBgB~1h4l|{!#tBwYVI?pAopU6Tx2*))d>FPRu;j(5nPLSw}02Uc{XUom*RgS-n%4k z`M3$wz5I;zW(5DqHgYS1+v4Ge3wpg`P_dr{G!)cONW&eP_uc6dnz!FVIJ1Q{6cJuj zu$W+RL2g`BC@K1P3YHQqEm%g7rpjvG3mQoU4HY$SAq@{}xJ$#`8t&0> zujcifW_!KkucCPmi1RmmRW*$6qg2yypXP0|P22jbYu;B%YG`;s^CIVd$)4ZuU6pf0 z57O+Dp>8|9k8EmcsHMTLA)ukQhB_MRY2a7Iax~P{;M2TdV}JN@fVadn@1bzDTYzsg z{Op_Wn7M4!@UD7-8tQ9!RP!#ELYnvSL7sG#-SaB8@!sY6;?_Vc@D~J)WHmJwd`$E9 zNkx#PiH668KOwktmyg2c8d_*@G^91O)X+-9cO06A)*9MqSfF8{hPE2oX&9tou!i;; zI<9+8 z@TP{IQk|MKHLaGPgx1J=X?TaVDhA)xP&O4P(AVn#tv%S+>r7uM>aSsdkbWBeY!sx< zKn?69dp_ur*SFC%14A?n)$qQCsTzi97|!s}FosPp@Qu)LGU^{Ce58i$*ZdR`AO6iZ zR>L?Aljw5|<26jsFj2#hp@DMu_=(N>Ds`uMgxU8*K1Bn0tW$u(Vn6sJhHsjN=^Ex} z_)rvP2+q{-fsopNdexa`F|?-nXA4>*e8nvPTn+Z_+<6)j)%->F=FS&FJ~rxKM7L`o zIiz8UhNawf*=@$ThGiN);S$iWT*Jp2R%uwxMWYS^cNGxCM>f47D&HSE%mX^V~S(eRaquQluyJCw5`<+L!Pd>#|c z?$>ZY!$Gb=G4-t==ZIz*lSEG6VR6V24U9cT%TW!-M8YYcdyiAD;i87$HJo5rYWVB7 z+}}9wbkrdKX~9#1KMAt*NQru9G@KR9a~gipa9;S&TqElOtVNw)MRGyIe9KP>acrqZ ztoY1NxqoQ5q(K+u%Ni&wSh8N2V-)_EAcgr<3;QRR46szy5D~e?t+ix5%85~t7#d<4 z;`E`0lm<)8ni`VQf!5pn>=N~9kiD`w@KTNZ=W|~v)rgi|?k8OAIy&jNs^M>Lo;qsk zxTfJB4K;Ku>8o7Va6>~G9c6X=tKp`G5;`_N;lIT&c*0*qM^PQOh5sj5KuQY=781Ne z5Q2pTS@B)F;Yfyrj^ZL=LliQtJD*!p$DKO=XnAfa9i^p|oJDg_lF z<{l6aJSfPfAJVb7R*;>krK7fvNssuO>!_n6M~9;0zJ5ww9aoA30y=^^9?{{GY&{*h zI{Z48HVnK{F0i|0pg=$6fzu)K`Z_{78t7=KBTom59@W88l8nL^6P2gH3cV)Tjk}5)8J~(Mm^a9c^^b108g<)zMBzdmUZ+ zDUBQEHR`8Ojil!z9(L3*h;8*%nost3*71~%6*^Yxcv{CZI!5RispDDJ)zL%8n>wD; z@w|>#b-bqI1syNy=&Ivo!Fm0Z3qRF=iE^VpIa9SNjmTfoar*VV6IVl&bkosY2MOh` z>&OV-5DA4;>#5@{9sP9-(DAm8UOL{@(ObtmI@n>(1^Z8ALw#gw`qDE-eU9iyCzqt3 zWOwva269|FhUyrm<9I)1u#Q6gl_5H!{S=l~?XTqZSB|u3)TzH`ZFtuBC>^79Ow%!4 z#~2-BbxhXro{n)k#_M1clXOhbK?@V5b=GC0nJ!UCYf~7pV)K12xBd!Cr)D)-eTI$? zbSz?kiEyTl4;ik)XX%*DAxqskGLFQWTY=_(I1n z9hwfEOF+k$I*#Z#D)#s2xOg0gb$lh+uXXIzv5%oxH^`2CBV@ne0Y{zd z5ci5HJ`z5jJ}O)9n2zssoY8Ss$M=le1-|5Q|4ALh<2rs2azgM&!AbY}S;TZo$4??* zmD5tOw3B;I$Isjf{`BYT_(caFDC8G)oEQG9AcYrn{FdcZ_+6@y{GsDgmS5KKr|`eB zl3t~~Lqb@GnyD+uS`4^OSTl-RLda`JQ76kQp7S&xi6STxpI|+~+^mjYNFa)gGWF|65fWj> zPJ<{KM$saQmQgf{qOtV$?(+2>i$aNdOR{McO@urlNXg?-a50iFacwrs%9}@#DdN%Y zqcM4{M2%~fN4~aEw2R`kD7r<_K8g-eybuLXZXKguBtOlu-{S?_lalQu*jezY=>OvR z8PR!Gkjh=6crMGI7sB)Ei&5{e+Le>OH<#(9C|=I;SE6_|%c;ZC*P|%5&-bp3w|f+C z2t@H|m)ydbj^gm5^MgiOw6Su{oJz8~cu5cW-tg3nf_X;DlUKEs<4|Db-}Gj~=L zv!hrT#iA(YL~)`?;PIp0$^648<}$p?*PAEE?P$Ibx?%wxwZMx38ebg6a`F5USz=se zOQZNGyWEz^0;KR`(ODt5Qjim|O33Oc)?_71N93)G@{f?MkQS4(pAN3y;m$GQT4EaFRd(tso?5{8mzlq}8Y#bgEayW`3*?^?NcTs%L zDTv}+6vrjz87DtP!Eoj9Pek#f*gq-8f0E9elD=^UPe;L4-2Td$D2Sy7D4C=6&r$pm z#rY_Hl_hpj^e=Fw$XqjEST_?Jzen+h2ror(Sx75sj-@1jaV$}UCH#sRUJ$BWbWvzg z=!|(zV%d7pD2yml>~IvZDB@A@Ic18GgtSf_x~q6BH_1ixosXL{-*h-|JBq9H!xy>a zjyNREQ3&A_UlBqNFxCGK*P{3*itAC_kX2vA@Rr`cQ4}`NWs2`+6t`r8CfmN-vey0+ zEMR!+uApEcL1ym|0zn1?cf3nGbGf$^HN35ckLKbs(h>$XZ1R^Byi>50V66cP z*A`q`E|fbWP-{l0u4H`%>KWMIHt>i67X4W|lxtw874RDf7-&^GM1xG!C$<@&G&DjX z1CJVLU?5MbuvX6j%1o~aM+Yd43~U^rP}tZ2t( z4F$@0seHN6w<7O7SQ+UL9pQ>FaEW8Ie8&uY$8i}rZQy&+IcXqwdg!=;9}Ju@@S}l( zd+O8FlyV_fZ*(B{vD%?i+&wnrQf+1V&=~_~8CM2Ql?k1bh4YJn^9H!eerAWy@b9LE zel_4XaDf{XCv<@FMtN_oO&P3kxp5KwZr~58{#%J)yYeCTr0+7%|fF8bPpv8<3Yu#NYwDgvb-C$R*Q`z!y zh2G>gSk~J*ZX00#Zy9)htH1UsA9uF@3{d{KsGM7+S^9I)=XnD@^TUXp`k_V`wLwnk?!dykoZXNgG4zjNKn&Yr*dD{c7zV{KKZXS{ z431$)3{zrwKZcK^p`kI1ieYpN!(td7!|&11h!{o+VfUD2$`A@k#>6mIDvp!v_!!c) zLlXo^CJLD(I5~#*gs>GBvF_9uX2mc&hG|lFdJHp!d=SG-A#9q;)FjS{;lmi_WqUGL z6f$Zk>*=sR3u9Om!zVGUi(#>7ek5v3WC%-zXOx#^?Js8&!dD2=&Po#DtFw|dF|5t< zS?#^H*2nnge6cZxPo&tmvITX!pCGRxWX9Wm^T;cyH`V$iRI zzKCHD7hMdyB)d}$?H2N-taPqH>U_;uis3*Ed!=ZfAU7)(F&&KI+ZYbftQz`;aaF7y zgb!E%q6XARezs8`(5Q*UeW1EYD8^tLf(?xDOS^m3_KVrBfr2808;ZNZ- zn9M1OAtt#^4OT2EN(uJ5 z63P_W*{mDGl^Fhs;d%_zxf;XYQbaZCT+4ErW!)Q+{WseR^(nj^!+$a4#qnqy1>z{k z6L=hV#Zf5k9g-R9W#YIa4#bgf`3lETQb-ZOqHz=xQap|lLZ~ypTi&bD5DC+rA}l4P zrQ^IS2(h$m9OdFDANK}ZNw7j3gLf6G829?~LtQ`ROw8ULN0m5g#PL8J_r$&PVfDE8 z__$YiRY3}?#qsZ8<-WLg{vo+vbgB&T9tv#k!ML}V){cYxp*S9nqwUwZH6>e1kdMeM zXLIX_TH8Z`oH**n@kks#Y90#Y4N+K~q@HAR1^saZgaidyT0f4E@QiYUI2y+BMjSoj zXcWiG2XfoS(Jqe0aXc1>5(iK3P2*@Lq)FU+zCSMfi8vPR^f60?=5e$ZVGBV@TE@{T z%c(|58_{R2_HlHGg_JqY6HC;I&b2MF?Xx3pNj z!3>fz-T`cckRgIY1&0X^kAp{)jLyiocR(5?I9hOwV7G30=67Sj-5hS%5_BCCE49^d>IE%zmyQUjei}-cX96! zvNw)tLzI1S>=$w%j&I{QB>bS@H*p-l5~2>%VUZk-EpYbZ_$!X{V&_5} zzX|y@{=Yq(#xKV4M;w>p_+5%N>fWADyevAI&7WC5(emSn#JzKPSWp#YmakDnjXjTp z!b~<6M?8)+=X8jY5TPXthoz=ulX0Yka5YhA3wN?QJTSAOE7h;WaaG9Qf_$}P(e*fP zaLFXR_cfl={^ih01j{6FGmcwv+?H(7geUw@I7xv73W|ihPy%;kIT9$G?Tk9b z5-2X&5`rbOI(H^eN_gq4gtf{FFDJ<0XLY`JR7jv=!n<0jBuG*@;oV@6R7v2T1ny6u zMgsRHyvI<_(jmUzRZVy=YfRM=xG&4AC$MZo?)usO2NHNNfd&chh2o(E9;U(&B{zYZ z3Din>57tK#-s7gWV2()Y2xn2bm=Hzqals}Dw2-?CDm)<)W}8!(z$9)#3ACh766l`58ws>d zpiKf@5_m3wwh6RL;NlSPb&S^w?Gxyn@OIY@2{7AH@JT^tI|*Sa(^CmNEt<~=Qu1s9 z>@CUj32$wZyqv%b3GY$zq994v1YXK=J~F8DN&>HDExeW?3A~<_&|r@Q-b`S40wWUM zhToHJOyHda-b#3{oNo(eUQypo;Lb6=feG)ev$ya*f_(*9)GvYl!UqWQ@kikx(H|^0 zM3B{oCNNAmAEV5U`?3 z?jXY!w3G>LNMMr?@{K~MLqg^|L;J_{4!33;a@4n)jg!k0`R`5^)hlNmbB!Q#CX@^xr!U6pZ)__W`iV~gA!h{73Z4^W>CZxbN#J}|@@oPY zgm)L>^l=FfRsKlevXDy&F!6$g!VJ$(Ak3gLy%U0(K!m%KiRvb_geSS0z~2ez z2}ETeMgl30I)PXM42gIGi3CjgCmKo$@}Tu2EM(@TfGD;?qsQ7IFpO_1MXqKt{MQgoMz zawf`~sAPJt15~acIu#{LQ`D!tvdO>f>M76;b?!D%Mbs#v!o4Ok@~S4PiCJb@biauj ztYzXg6Azep(8OaV6capmJ!GP`i8{g`Hc?Xu=d_mT9mPpyXP$%`n%>E|kziv%&PWpz zkDGYXL?;tZm}qLEg^8A?_qjte6TE1hS3AJjX>Q7vK1gY0dQTjtHbPpP-p0kvsx4>D zM0?ZQz&n`U&hHVqYVMfLb~f>pSbo98(qaI+QkGP221@CO>x4tI&iKM?EpF~x8Ia$}wPZI{47-C|W3HplJ zp)v(*kF`waQVup#iCU|lEfr*(C7;{YT@{oJlEGk>R*@Apvk@JB1 zAqP8HA>jd%4}E@mvcUANqZcvA_k|Xkpxe6+RTi7xX=jNb32)1nnOJV(69#~Zk4>yF zvBtz&dSIxsQiitL#45@1pu*L}LGhlS4&lo$8{+QDch&VKHksa&{ZkVgWP-SvY&5+S zAXf@Iv)S}s;<#<{u6V17&rKXMaoEH*6WdJ;*caNz(V5su7jbGV-xnr!$wu*&IF?U# zj&!$)FS$RA@gCEA*tbgol3qgs9K~LS)*yvXMg}wABKNa1CJvfjFn=Rq$z6#2TamEh z5fevEoDdfsql-*@FPs;ZY@Oqx<>PF^1YcKqoZyp}&iv8DNveq^v!@w6!beZ{-bW}o zW8$nxI1A?(t9)4SzDVZ%Jg2){=vToDg4ChpcN2e@$Vs7Y3YX|5dM1g(N&IQzFV093 zE0V}J5jHVAi4jStCL&zgN&aP5XbcP!rIIL}MAU>~qHl-59ZAGY#7+FejoL)QglQse z!ZopYs6vILiIfRTiYT$AR;I`?@n=(il?Uoy5#_%HuL@Gmy4OUR3e>-0;$IX0nJAFN zO|eGJ+a_*h^_v$BvULhG77B7uP5p(EUMHEh4^@yvVaXOr@=NmnlNU{*SQ2c4)rlpt z@{&UC6r{XN5@nO9o5UkYluM#Kt0Zwx5*0+DvRJ5?1dUV@$*G|VYq8zCBzw0MF?(+k zRYm!sB&sEGUlKJWTV0Snp$;qFFIif9K)OfagHrV8@X*6a)J&q5D9|lANz@k3T6KiP zhbo1KDJ=3OQ7?%`BFs&~FBTq6B9KHdiM*_Z`bmU@vlVumNWanZoU#T10`nL(LPhwLNSLOyj6{LKFkc~;CiU%m)ELoB*LOv7R zDs?{>&MHiAM!mFylNo`m=d9XKKID|;)# z^MaHx{l>-kiH}YuzbI zpF|fO@)(yqeM{$`2{7AvZ6LwjCNDr@CP5@mC1E9DGh3rR6D6KPjruO9BZ&ej6inf2 z();&A=34(h^zGF8e^2)h@2_5v`|@5s34`~ zgwsxW$x@B`NyQW@Nw%`!U7~Zh@G63|bB~aF1*@h|O-O8*!lLRa+%MT0f;9ynNa4X0 z9uiXzi-c``Z`NniY_V1f#M**&QuyF(F0+rM;N$Quz(Tzga#L8B!uk~aDFjk@D}}dH z2&Pb<&Pn0f6kYb2(I<4p(9qtcg^1)$r1WvY zCj=>PDx_Ho&9jmgLRzMm#H~QaAc>&y8c)PlR zJ}JzZ;O{F)(oaZ#b}uU#D5OzS|Bw_$ob%6SHie-n3`=3SNXDfwo+O2lDU1@y=oH2X z={}+$tBhq^k|pmwH!vZEi7C97l}r*cIjjGFnp0AEUxZTyrwP)+bRjbYKMTu1C;Z1!_)f^76b=hHBFLhnDI9I@{nUu*`xH*5a7v1f zr|^T26Isn4>B(CE`>oJVDV!7eX~8pDowGvta7V`gn^?Rx@LLLhrI4S( z#gzB3TeiUedkTM~@ZY_`OM;hEpzu%OGgkU2uU4sXIE8o$i4;_JV{0Iif|deH^%M+| zuu3#rB_Teg)g+-0GJ@RAnpw9uzyqf!>iTgYu4EN!8TNXl9$XMs4RO?@h`h`fU6 zR1~ZvYAj{Z-4?1?XltRJg?lXA%iWkdqE^+ygBBjLP|d=9BB^enh7eY~U&u@QeGiDW ztH*p4K5U_;g}SuX!CyNK#>&_bStM=kGnThwRbugU(;K8qUDr4|&am1&DVI-|l97MfaUWudi&W>VV1 zLQ4zmSaZozjXcv0w#6!KvPPI?QF{v=EIe=F1(A2O(An~0l4F0;0$tI`0=+>$JS9GP z+QKuEeU{TLgqmGMhlGh$USx}XmDdHk(ujqZMYEeAO}%2_RpC^AO~?=9{2AwWms)RF z=pp1y!M6l^3icnaFwy=y7T&e6z`{Zcz1cSl6D>@V&i54@Y4MW5TWkFV2M97d(88cB zA1q{ug`ru=Fd@S&j1WRsu*xV4qb-cd>WmZnV+DV>>>Dp+f|T-imt3l>HQB-kmiMc` z_bg1Yy!HFOg}*B_o@Vi4$IDWmzYm=*!WklAmhzb*nPp+NkU3H`*TT%<%7=nfn`iOo zrJgl5$3(Ko!eR?wSlDG@iG`&WHdxq5NA*)aqTl){AG4D}7-P$&W5u@nDPLh>rNxgM zysk1lm{v<9tPxym;S(X0ud}c|%Rd#uP~2!?lZDL|wpiFEMrh|V3tKIGE?J*wZWvde zayGQx!Vc-iP7AC~v+M?OxAgY#aOI$oFD>km^!Vw|lhb>$pN;+!cSXNHqaSJ~%Zf!hh9^I2O_tTnmM56tU5Dq5lf~e8Kk*$3o9k_y29-n&rtUWC}RG>lSWU{BRsMY03sA zOt-k9IiA98A>{vYPNlS9R;Q4SJA~70Mww=d+9+nDwCy!o+(ro-C2ia(*-X=!cG(A# zQX=oL#%qX8m$k9DrN1110$`(pjfys^+x%95pQ)0KDmL!1c@v1cY}_sK46?M;2!(jB zjcQr_sy1qmP@oT^sdmdw(SZ!mCjpZU=A;{_<+n_a)m4d5mWX!TN zYelkN@RMxmIw5SGRX(+`L9*l8ZJe=jz{WwgYvTtS z-`M!p#!(x`Y#ic5U#)Z4#t|E5-8$cnREY2H$)oV>xxDX0cwwaSJ;UH!9*b`8$SZoi z&Iubo+OS3{KiN3RdB0I;z>Pwu=(=ga!RtH)YBs%5$Rjq+**I_GS26XojpCz}U!>9Z z_T<$VrM#D}({Pk>K}vt)@)@PD>HedX$)l7%7&bQIHWD^2+xSx&qGeY3i;=u1&yZUA zHo`Uv{#%DhwGqj3&4!-kQ6cPPOseqTYSWHsBWWYWf!L^e!;>tNc4>ddD9;bJD3{!m z=i0c!z1P8=4zAkxo7Nl@a&XPYKim*(+_d?8!O2m|4I8Y^7x_SGecBkMhl4jM8S}qUuNk9ofM1PK-geN- zL2n0r9K0j`XCK~`x)~2}h4yvOk3|j!ioCz{Ej~tJ*fadN2@DeXU18><|=UT1>D*koyFqRbB4n&g1U zkfwc3%KHwcI{3iBOh%(v;Hald9~d^|Go)hevC1q7q&W__iP06aMVS-#p%5-H&JOp_ zc@E|~-oKJ3U*LHEeSX`2brw7Pqdj<}QW0OJB1;{7_{(q~l{Y%r~`>_ z1H(a#`#~*lu!F~q^9MnM083zX)eBD(uxc2gIMbvpF~~{8z3iAr}OH6TB$+yCC&DO5IBiE_0tLUEoiV z|CKGJq*IN?sspz}kc27XfT%gpg+v8k9IH@Bug1lGu>q-mB7xoGL)3O9fHB#rOV_?w$Q7ik)=rty!1>x`l_d}-Wp@GrOGG^(U=)4?rn z*J+eYV9%uxR!ft58@}BqPe@kQYzm zy|GG@EkWA3GmTPdR7|7m&|v8_%B1ZOsJ zMzb`Ur{PZ{kVd048mAFVqt${SQ(hYNvpkd`D}s*-X^=)kAv8$M(!|q_2wQP}oVb96R~bX>_ZY(@>eU{o5T(-@e>Aju9+V^|u) z(-@M*&@|$AdVOQckP#e6w*Qp}2PtQajY(r{8j~5ZX^cx_y!dmXxajY3%7io;EDf@s z#7R1(pZ|t zM`=8NtI;xPlw{nUIm9O8l@)X#doE*Sqg|vktI}94nv~GbYo+v)tREPMpQf=PjV)<> z#?4`IaAO*qIFRx=rIvURvROE@OO^$jH_hFe#?00z zrg1>BEIpjY5m6&Qn#LdF6_W4MIG)BmF79>l12=&*uG9Z%{FuhcG}JUAX`D*K+7mpN z#?NW|B%ImPX`B&$ZMtm>8t2paEscw5{3;!|AUJz_u<``uuFYPDe`nKaTu$T9 zG%lq<|I>Sen|RYr9+;qHV(+gs^3w>*z&BRRdA67rkXjmg8fh7RR6J&;kxau#BgSP? zD<{rt5i;xO~DE- zD!Hiag1n;O!D2ZVYUJGIf>=fHZb5d58y$sJT~u>X-$ls9eJ-lIsO_STi~C*Fa8Xmb z%~l?8@sNv(i-R*41Rr$0rw=XgY4xxuES#X!a=qB#7Roh}DPe{wSkGFvt$+1#7rJQs~zG)$?@o_H3i-eq#Z4;IL9fKcl3Qnf~UA)g7W}@<* z46{mJ&a%9mF6)C+UBp%erwNk$J~UW$b?^fhAG=uLVy25(E@r!!<6?=p_d^$R*((t(Hn>Cw(JnG_@3zx@T7vH(~ z-o+&smt7p^)VTQB#V;=ZQ+eJAdQzJBkq&ghPF7eOthOe2%EeFIH`aLkr`5qTqH|X8 zoZwf@bJ)sxnTQK6e&dw6XtF!FyME51NeTnzqKhqSgMYZV`g!nodTf$%Vv^E#Q(kzI z@~4Zx7zQrlF7jQ3>4bGb&4ub>`MO}`$x4L#?Ifk(=Xv!fE2TH)u~c^v6*WVUlA?`r z5-v;^&i~`;JD{Z~g05$0ZlRbZ8bFNbt^{3O@nI_%040hbMifv~Fc1ugC?Gj!BrI*El(Xi zf&aKnIGYQTEHW8V`4SSY&G$DXk8`y)h#r$Ts5F=437qBPY#06s1YG7WPIi$wf$Ry` zE*uv*3cZrz30Q7K^7M+Ezb*$BdHr}}qWM4*bE8e0L$16eTAPnAO2P$~Lpc}ZqS)?* zWT%0q_drwL#pq?p(-lchadB!HKh2HePa&@}T%1`Z=lZJPqQ~asc`nX(QPD*u7nSK! zNu*rWMHM$%{yR1%Yc7o1opQP0JHnfP@s9?itZ9f<$;Qu2Bi^;*^+ zKhUsP-^C3sk0at%%fyR*q;R8)n_M(-abEMp%`WORuFu+rE?D)}K*Qp<+VD0PEnT#7 z(a1$(t!?7s4i`;b+^$7-^!Gs1OnD1MT4?T~T%Y8H57&D&- zGUEps5-KkrWIh;V9(J)yNhb~6V@wqnk1!f8I=iUfGVxIFBtv@Jp%U^ZTy$~qoQvmO zbanBhi|%EfKjq?S7tgp@-Y3a8S3e%_rg0--pol$Gv!{z^HQ>wJVt57X>=ua^T=a7B zii^H3UUbo$tz7g`Wwv6J7>9Ej*MHf?@qbGgnbKlE7yVs~?-SL&N@YL(?JLRWzDo^o zacqz|@4phx!eAFeTzu~03l~FO40Ewe$2i=@2p6xpnBrn&ssA+PVifavuoE;$m-+=segoA8cywNwL*jmCs`Y21hf#>_n7f3tcQ?cN3CJwRSOQq*-DK9Ug4f z3^t4X_-BL7AA=1Qmb+NtVkKwU#TFNDxLECCjf;&gHn|9gCD-!ghl_ED;Uuo3WU#5R ztAxc3TpB|R$!3>dHb}kB96J^#IX_dG)O`Z*ujy_`t`j_Vm@~9iMDO>O$jYfbMp}X z92j%^C0qAP9`2jm+Bdmli22gRb{BR!TD)Jm_}ax07yoceak10IuP%Ob@r{dbUHs(Y zXBXeO_};~C7kga%;DSbeA7XYXVMoOwhL#)5N&Vmn%YAR9VXJ5U(~Vv z4BCPC`MXlJzbQGu)jHJNJJkH{;tvhTUoL+}gzLK{|77rong???yfoC19MW2n!_25w ziNBe&Lk-DwyGs6banwbgp=O?QE{2*c_o(A>l4Dvtu6RPxRZP3^l=zC&43uOP-#=86 zQwu!L!JCh8io4ySAi;`!ROG^UQa15pmK$8j?o2G|o)ptTawav5>0@H0WPHidkk=1fSPGsp2iIxjE5`Ih^NsjjTcoj zkwz;eSEf;mE~QZ?jRt8nOrvfZSEZwUyT0PpX{6G)PI*%C8pUfBe;#J)v5R@B5-nbz z#>lk&Y?H*arU?q23f2uOH)-6MhBqwwxTOAx_)Tea-;<)w&1u|{MpMm< zNDX$gt;T84RFgE{GU9A_qhsB!oW(m-r&QjIaZn4?X^{pSw$$RecO>piqcvxl(~-s_ zX*`-nTdjH^jR(`XJB@Z}+@rnF+xyeFm(!|#((>uIC;IMA9c+t6!;|f`RfjZQ@0w&U z4{7mX#qIM_9Xb2ACn)cvlDCh=JE!rOy4oX+$J2O%Ua7-f(&(DTGs>S-Wwv@+$y2IN z=W(#)uiF!~Vh&wmZFddnTYeOQo^&;h=hApyo6yM@lnhAQY{Fu17Ss4KjlF5~N#o@- zHl(pJ%}wVK z8j+-AwHDVYo|LxNq_H-QPV-Z|sLXU-&y_MVS)pnDO=)cA9+JkVbXa5cb{g-bu_cW& z_N2Omu{XG6hMTQvys6|ZMM}bv$#>IuPeb~VcJzK4A21s=n6=V&)wKPg&IPp7kE7kg z{v^$>TbI0gBK}z#pQrI%8sDe+SI6;X8sBJJ>TFMAM;bfR_)5*v;jd}=q-dBlOKdsZ zFhjo8x!9MFQNrs79no%WvP%b2D&M1X%I5ph_$iIkJe=;~=QMsv<3t*68vD~YkOqVH zPa40b@mm^yrE!>hS{i?(afq|iw*Emi%Y^xpN%(Eate2CVqc)n=Y{&$o+wAV|G>)+C z{M4p-DP{;I|E6&?jsMa(md31kk^Hz?VAW&8qdg?eMVdw-jba*p8bKP_vQcN!n5LE) zYIc!JBhQ7v$ZKjH*qve!xWp_EF%RWDz8b*xq9ozW!sEMh-0{HRGtDRzFUmJ&{>dK7 ztJAZ(L%f^IPJfewhWjbfbrx zJly4@jgJN%8hZG~!?zx8_Hc`b4jwvsxYfgL9`5$gj=}NJ*h32sEj={xFlo4H>Y*7G z-1zMtDs4*L;qi+T@k8IH2Ja||pNQ}7lWgu`<#0pN%EN2NM7;f(K@PLOl6O+4MO5RTkeUhh+Fb{fY@1f=h9$a&8 zkJAoade{T2*n1}rk9ZjGVS9LXzzAj-C5{`?l26`CeVK6)0Swi8k5oW&j zGDO{Aw1+dDJdE)$*275cmrjo68Y$xp&RZj*XpdtY($Nq~BgQaJS39O$(#ZY zGd#@nFvY`EwJ@E_ipxg_{+Am0W`r3Lmh}6tWR{279u{i^=6IN^nXtgaJSNZ1l9NXo z_BCHQi;N-jWFhnC<>VsOykMkRqC?<#C;27IJ*@EXhKH@p84nEmY7c8XaK=~ZK^=t>lHUB($CEvx{NgawfAGcm%Q#_i%OUql)uUK?%`u9dzdxSyzTM7 zXAvuHtu6J85=gl(&>n{+);Kx$b=2;^PMn+2e~C%KO;uVULG@ zJskD$qldj74tn_0!#)o`c{t$VR}KEp9)9t#-$T=PQue6GET=g2aN%08<2IM>H{K3?0DVv>J7%2f4njt>%EbmM#< z)%<8VY}PHVx*z2;^PG|kRDNibVHX$CnGxnv9~b-h>Fbh96iH4S9T~Zd_K(Mz7+0`~ zk9t0?_mS{%rH{HkuJTdKM{OT<)ZywoN-iI57zg%3uWlJ_uJ*xfzgCUpj>nTeh}Wnx zNy?8lSoU(AA1!uHT!}{M1|LRs>Z{LGxY5T=s?*R1x0D7xIO$xfrQ6GWqoehEE8F^L zstp@ykMyJoqc_|%W=MCITw*yib-N!e*gJeYr>!`;W8yM=Kw9YI6pPc|yzF zMq2wIQn{^f{%$l?)7n>kM2Ht__*JX&b2!Gc+AHGJ|6VZ-p4~e zI{N73<6%EK!RVkkcSi}2S%!=@pWYFjt~{c`M}5p5ZFs)1addPp@wf_~@X^JOPI$f; zZMyn+(vJ>6cqa4vX!8_D(Y~5D=TTea9=qlN9Zxx4_VEgn+{Z8S=pm|N776+Tw_*yv-E)~@og z+K=mT4=@v+wD|DA!3L3{((PP4>%<*cHFL*AliP@6erKHgBzUuW`+i85iUk2h7q zW4d8u%v;LYkk{Ml1J6s}^YOlqAARig@qv#Ix$u4L(AtlDeCFeGA0IQN8I3V!n~wTZ zADhRR9b-)IW{JPXm@j;M>0`S#>2thcd)vu{|x#AUy z9AI2Yg5w$&y-)Gri#F>7s2kwA0QCY~72xV1I?+l6e3ig80nYy}wIW@@Z|zxl0}{Y@<5W!&;2cReSnexzn_TL4{&3^r`GrlS~QBC!WgRty`Q=%0I>mm9%o2y zR%dPraBG0uls5{{n7z-jXts$;hA6*X`5lU^Y8s$f5WU>-;%i!q0CO)&v<%QHz?}hF z2dJDul??6*&?dl=080b34RAM`2k04~U4VPo>E8G=0Z;gGA15xrqXF&@@Bjn*H&;52 zZ%sZJ;NbvG#+mj39t!w##W;o0wKv{@l5uAF-gvihrjs@qInJ6hI)KjWVgHH!|XPjZf{NJf=oX`OITNB@mGyje= z&jxrdK>q-*GOz(&2+)UP=k-&(mzsT%i8|g?A8&dGXgEIV;-vr!euWUa z%RJv7?>64_(}9<_Ee?M`fPn$VG6^{^0R{&c5nyD1A#4%=|Hi8{N(>%vW{)?+0t^rE z`gmjg9jD|#<;17}TmFgj8XbUYB-_WEF#!&aH)r3L7_YUH0!$7tf&A}Cb0U}0ZIR|{ z0j6-u==Ph*sXVbf8lN6uMu2Gn|1NPn9B+s-1I!9AJHQ-O$W%^LonWY$m|)oIrU~ZW z31(h^`5bA0g#kW49A6xOwL7XL7IC5{nBfyl`y(mJ=T9)p0xS>kCYN4-6#-TTSQlV@ zfK>th+!w$6w!~^B?@ln}YXYndK=Q)`b9jQ;pb^{5;Ro2rEoFk)#9%f`@TxM=Y+)vB zO}@d!GSQGw*kq#F8lb~O(|w|Oo6{O#dw{P3yc^)X03QeVB*6QcU?0+fiDvjj^MMv; zOf(+__<+TUhFxz9@F|aZe~Nz*;IjY&_QhZMJN~(nX8R*f32VPp9Y*Zy06Vxs1MCUV z;I_oh0N(`omJ9PhoW<_~{u#jd_W^!jtduYQD}M35_^tpuCmIssj{)`ua08^(=AnsZ zUx1$i{2bty07q1~Kfr+ie<)|~zXteCdDp{{GrtGORZWm!k~zqb1~|mcO%(N;-BICW zm7JnTZ_8)Uv1($(N!D*w6Q^eIWx2@O=^31n!I`R4LGdg_R-LV++9X3>F@s8bOa+^74AI5Wg^ki!!)4 zgG(}KoI#TeF3sSw46e(dUIsNYxIBZ}8Pv((iVW^(k?h?fSu2Bh28j%Am}EZN8wsz} zsvhN?)|1S8<(;}2T$RB!8C;ve)fs-JIhD-d`xeRb!V)$od9PKn%OumWypzgcNsA;c zu;KL?l&IRR8Gbt}RX>9pGq{PpXwfJ(>ugv>{RSD_oWU*HZ$rh*u~ez?f7D6p+?GMD zR>?*gygJFS_;K^(?WNsiq8)o{KF+S2X3#8y<|=QI!QDz)Dz;L*Q?a$;U5aegMoHTY zrcW{~@@kjCJ$jLEo@DOR>9}9<0mTOu+bh0Nu{I~G0}~(vF9Sb=P8mFs!G;VrX82J! zI%hCCgE1LAmcip0yqH1n44%kf*ExwU8FW?BqL=fel4mn`E`z6(Kh3aDt+#t>y=Rnk z%b&ft{{`ZAJbt@vwMmOwn5<+H!!@;Djj8os)8d`e>T>l(QqMtv<;j znVG>X6|PjAox%JJ7AT*?@s{b&)A*b`IdXDg28+w&iV7UH%>OC;oYP<-)Hbc2AeZ@J%cS7yph4@8GON& z+soOS!8X--GlRD>csql4GWbZHhj)i~*tf2fjMdpV^=N@?Xh6WGhITnm#8$sa0blm9X} zn8BY~Je0w|O8&~=u#&$Ob64VsCc{69Y))%zdo%+s6FPj1n`Z_mRM}Oe^X!N^X-=8u zNsvJ%gOh(Nshvlb`!?534n1%zu*arZte$L| zDUvkLqJ?t)%7#U{eW{(G@jJ6huuT^Cm3h)u$=zABE0f%#oz7WwP|``Uqayn%{2q<&kt`l9lk9P0lsuNj<7JZjek|#l znS~d!cuslkYKiBw_^?fq zq?bxw%%XP|FDY+QEz#sZ{(LXWc3wA?w_eGjZx;Qs=%2-}S^Sp8t62=l;+-ts&0-)m zvsjwNGHo(Ai`hzsWHB_0VOb1k@Us}31-l!OaI22J8C;pJnlR7GG%bE44}ams;Ge zNT0v{KgDm9Q|Egn-)8ZhlEV)sDf~hCt};9OCmRm%$1HwQPiSgy7W=gJmakJ+{22ea zY!tsJ*{{eY+5YQPINAK3#UC8L?zacC_>*g2`JpWS;$E6V%^VJA@pl%*EUX-kWbu!7 zl+WVdERJUJY>#ACCI4mNW|3BYEQ{k=oXBE%yJ$;kxUYoB%hTFS7QT`|acqZ3hgZ)I z$%>AXqYrk1W<#wlC~`S)ZN_r2b2uZ1Gu25)@zflUgXB;yhm&$RMTN}0Qky5|aP*ma zE8HuY(&?XXS8q4%Kp~oW3L)MZ`D%Oy`ELqD}aQ988&{|Cgzoa%iB%hB-9Pp+yci=Wt67x2o`V#oH7cvys46AiX3Un99k*AFNZsov{h`K!(BPFQQk_UT3sV{cMk1T$X;mq9_9Bc zax1=H$peb4eK3diWxUpZQM4bp8rVL*E?c<}i=7CtLk;7@5PU9Qx;?UF+2x1~AmhSsbQhP!5C3 zBtvo-TE;6>OAIgLBXZGG4V#S4VGMZ=lX4i#(H)In@|qd1WE>|~H%3Nmf;whiGgO$I z!_*w61Q(#4_!1sy>RW$YEs;tJK=s9M&mWt++;;)Bbubl5AA6 zLGf(e_coPjZpq<|9KO;fTXT3bhYxf3NIT-7-pb+a9Ntmo+X^;K(V2Hu`8~z=bNE0B z_heRmtbCi|CyLL$7H!L)=I~h#pQ~A_eVM}-$~h?3QnEdV`TI&pzSdSGJ95}r#=lWA z`Ze<%x1)|pUf<`Ce8wSR^IclY^!PD{z1)%V(UU{z2C^@QpR}W&xqB;N)h|l+D;~(< zS0%qG{+`1hN)9sMN~r%&=j5R>{+AMNs(Q?0mE+c+p8G zA7yXpSJWkD{yz&EjmpLtu)ALcvRmkHEZF^Q8?CVVBG&TEB zw8@{XO-j?dqVh_LDc%&6P^W4h%ng!rRq~$BIE&TtxHON;@~E!z3-YL;%^~$Mt#CS2-mmc^rSuBp$6#PQoVC zF>JfNgx8HqC~26-&3QD+^V@(Wx8(6xv*c}xw<_ii#wjV~*RM-8W*6&HP4ajtut}Qc z(TpyYmut#P^E_Ix3FI)OWge~a=pEvv5O?O$I*&pg#XRoHqfH)r^ZbiFXq(5~d3=^f z<8q01dEAr7h&)E-ac>^?hj67yCjCm}|W0uP2@{%Io^J$>sdx4|%+m$J=?V%wts^>+)F7 zslPwDI*&EXSSQi!fh3D-m0v%_P_iM9jk<8&VCLtsIgc&*=)p1?TD#=ydHzqGsTtxB zDcmB?R(0u3ZNlYtpk4G*`Hl)d&g0!Y-pk|tJU+;y)`Q6p)zqC+OxG!fY9FbPa(eqo z9^3NxR2z0EZ#{`bX~aIyDUIQqnoeZR!}e6b)nFWXTDp z))d3bRgzZp6n(`&F~d_JB{{{sB3p$@T0Wh$Lc~H`9U>XR4&j72H^g}%5JEy!4WrL4 z%Y`^8M3uIv9OC2<B{CP|&zs!39d&2eprREXcF|uNxmP)@ zk@KPg@xc)7m5}eNXstLAqe6!e9kq+j3})*@rx3qAmV87#VX^r^=TWUCe=Nk~A)W}) zCB%adCtnP~AK-Tl@l1$W+^MFTCqq0H;%MvoZKj&1Lv)>L223^GLUa$odr*%M&noGu zNJ-~=@tpGK6<<*7rTC>uP=RLo{p3C&UJj!J-T{zT*eQL8Ntc-P3(-GBvm%-o@hWpK z#LWfVQoz6vgF^fmVsD7SA%=w59OCs5LqiM;F(bsx5W_=^2r-#M3(;e5YGjCUA;yOo z6=HOV=~K-Z#c!sXu}U^gH55(=!E0iONg*mqf)e5pMH-nBVrmFBnZ^|~%}~PH3#OTC zrOfX2u43A#{_E4s8r9EVSAT5?;wjCOw8`!^gxDBjlh!)Zqk()g%^aF$ zwuE>iMCBP~yPDb>;++uhhIo^4m}aU^H*bY_n+timp()~fA>I%1QHYPZFsGXjLVTz; zZ<}uJpKhL^5 z@;_k0ju1P!&_aCA*m9Pqn{Tf!L(7!kIXQ1gL2l=fjv4FTH6=m zCvH0hoL0ckA%5Wo65>RN{UHv7_$$O=Iyv3^%ABEDt^)P>_Yi;RaA=Tn+WAxEB!_go zl(Uz=)vc&FJBQs4ggjIkPP_BSj0WZxolV=*c5LuvtQveEB zJJWonb|^WifRhU-U%)8^9HQndLru;&tInAfAvI4g;EVz;D4<3GXBKc)0o4kqUclJ} zR4AZo0d%Qi0awj3l?!-imZ`+3zSY8Zx|d49TqpzW(6-0zN39Q2~t$=vzR)0-6+X zdjU@t@KgbJ6wtJQjs_@Er3*0bL5{TEI+|Z=PdH$s)Z zfF4SoRivb60l&{NBy@(z>-hp+D68$IBt6HxRMzU10@${X7GKu3Y)A>O{sp{R!0ZC% z6fl6Be*v!*Fr|P&1q?1=EEBSTAqAW?H`*?ULv?`+W0KD`!gzFoTgPU^?SG*StA58YZv#bE8%E zr50!DoYIH61MFp(k5-wnI0sH2f)!Jl90Vn2~rCgr# z%reF0iYpXXDy~wb=hR`pSIjf(3TQCTupyC>cJs`}0ygQjrGU)^yspNn@U$ur$=@ho z_&l>j`CA3NUBG(f{A+Sg9SZxp{({7#X# zfKpG0^kjDdd$bifZ&E)h->b;sQ-{~j1^mWDD&Us__H$hG%mG#4D1Ox91=O2wtYU<`xe$5rjziC#Vl*OAM3Mi8 zNF*$$#TN4;UcQJ^ia4`~vx+#i7~Qx}E8=t|-RDPlPu@?@C`Px!=x%sj{j-axP(-C- zbpIVW-^`mIrG3RBw#+x%=bOXxqlc5KMVwPas)*}~IJb!Nibxc3WfA8WQLTu}i@2hQ z>T1DRU}_d|f!eR3k_#0tQoLC462(guFH_{G**h=x7^lqzkq=ye96NcfB5D_LRS{Pg zQHKL5Mmx`)3k=6j{~6x;3rwe7Dcoy;!aCiThfZ8h#!jBRYdC|?kZwt5wnVDL-_*pQW1TMXj{bHMYJp8 zo+7%d{N5t&Q_{7F`;}0+QxOj+e^9Z#;zNoLD|S%qs7TM*o`OmVm( z$4dt|M{G;vyo@P=M##sO5mt>;$*~1yg1SLZCKfSC`Q$RmYf7dlPAy`ZlIe;w6xoXJ zHM5JD!@aSHPnar2%qwC;5gUt`U&MkUe?V&17O}91MMbPBg3pSJizv6y)LUp)7qLY7 zQpIJ8%N18Bu2fv5c+o<`R?PnvN;rf^7n*ep<3h8(h#3nF$tK#@bbYgkwF}MbMZ8hO zR>pI#*+TagnqL-1TPWQo^3{e9dvEDte7lHuG}<)#E;p7k{=SkAiukZh@=+1q!YH=e ziukmMZ?(J6iqYMZ>y8g0pBMElK=Dh(?TTM1eyzAeai`)pikvmRFMOw4*7u5B&Sxw# zyNlSv{l}8?EcvmBy+s5?WQy2V#7{;1Tg1^KelFsdBK|5yuQ~gmY)LX?r6%Q%W2ae)!5q}qPq=hj zCDkms-jWhas#|h_B}q%Jv80A2Tz6Mkaz_ytTGC*#xk$UdSn(3YOBF9utf_dpBAd|3 zxFzit8yZQdsVfz0Db`l3V@X{l)VWH@)rxfQT1!%v)U#ypVpD2_I@ej!Qw{Rzbk<^1 z-;x{Xo+V8!F_zqD2^ZAumfWPIi6#5z)M=o+q2kSow?Z z_4!c8M>0P4JZ4FqCFXH8c=Hm|m9sX_Ja5ShmOQEaDaEH1pHb|l*j=%QVo$|q6`xaN zOlXI0_p;c{qxI}TOBA*kM(LO5QB(eO~mq@{T3%TH;yaGZQR%-;%xD4J`S< zk`FD}Zpl}cd}PVTmVCk_k#^SCg275dzgaEbZCk}oac`3B!CSfu=% zr4fE@$qq}tv*deK+i6MnpyXRizTxh%)U;e0on26$S^WbSwIzGF;ajqs>$Fh9i$_dd z)K1@}|EosfPnP^_$-kBywd5DBUrUZy@{c74Ea4ONVIAYI%70V*o&L`;e<&VQ{8RCe z;$Mmk2zA)}Z*4MdX;fUlG?HvvYW}l?FAm3vy7L^fEzT4vH(%OTJRg`B~_ zl8mnU$}!1WlC$LWn4A%lJcD4#$uTJ(lY%8hOU_?rc+0k8(RR&?`$H@iC84e8C_+&b z%PF3u$Y%p;o)VK&wfSkWC|zlR_kEh;{=*&V%$V>|K8!Fzcc#Gn#inl2;+U%uCOm2_K!z#HW zCQV~mW70h)Jz}yZCTnBTGbYc*WNb{v#pJn|JRg(6F&Pq*7h=*YCP$ZV<&X{}?lMON1 z7?V$8vMnZ?)RT8(@*Z~pDlagvb9-5CwkUr?ajW8+if<{tt@w^&6zv63wBL`(hcWpm zCd|DL6sxQ-SFSL$#?gHoi=Jwz_9?4Ym@i|po#Bni=P_x$B8tNoG3ly=I$x<*6z+&g z{}twI&5hTzcI685ZA`x7+{NUNn0z0TA7Zj!XKI%sXZE8Ne94ODagXAUihC9JDgLDR zv*Is`90m0`kOMLKRmb(4A|-oQn1eB?UBsW-7sJaZ!$aDNdG!~Eydr9QBqslG_p{|( zTmGfPD@-;fITGdnDIQZiu6RPxRZJ^-ioRl?m{H^&MQiz(guD^ha;7Z>&5e_7DQ`=W zfn8}VJIeEz9p#Lz=qN%_6w4`|q)408WYV6Z4Nte_R9j9{&W~(ps>aF)Ij*y8Iop;h zwp7*H3bs^aaYYm>DpazgI9FCANogzI0eMm3JX_AUrLHYk*-}lLUtvq!mg?lT)KCdq z(awd+FH*c%@e;*L6)#h)sd%{}{b#F$Emzu7n|sdO=vk$fR`D5tZrrspa-fbK1&331 zwJk|oZc>G7Y@srn-)PIVw$Rm-TDXowlSDnm>lI5B>nq-%XcXCdlm>c+Ogjy18K=>> z#g{4?oY&nt1ZwhtV#G>wuPyi4 zGF;C$Xp`~>ZE0`IW41i5ll71-9c}4k%fnjiP&R|l)~Nr8Esxs5S3gb-ug)Arjrt@D zRz}4qZ0TZ4cUyW;$Cf7<;pWMwx&N!HZ>%(5uZ%qB10LniXxnbKuq}^#8#R9jK<<< zF8AA#<18jmQ%)<+tKsVC_8#n;LG?(4Lcu% zM%&RF1chU4DSb)jYx{UxCfYJdt0pLN>z-`OYs&fVaMP;j4WivD6FvFUVO!p?WveYS zY?*1xDqB|DGRv0Pwk)<~i7j*3kdd)vp)K<`m8+uVGv5}z?)6_~rmTtvTPoy-N{j61 zp_j#_8t3Jy2! zIl0jM#o>4WCPLp`j0X`oG%n;;4%Zpd*>pQF9jgzC+~9I*!1RvmL46h&WPpjXBei zvm7bs$VrZz>_n#)j0~eu-ibDxQxs2CJWcU*#WNK7RRQYoqMd8jm^;@*(SB@=sp!by zHKvjx34N&Q$T^Or9J$Vsa~(O)k+>rXN6vSonj zt=;IzO^)!XCb8Bu;ON$x#)=IUZ&tiT@m9s#6dNgW-l@;4i572n`87oE4L~Yt7ws%#rbqOmO5LNA7jxIY*v%2Eiq`e~#F*y3s|HI7o*=Ez)==04Es?brflj0+ak1BRnd`yv}p#E2D z&F^bXS4W<7q`M!P(8*_mN#uQM+= z(#w${jtq6=MMij4w3iNWq&M5nG%u;7kK)UUuPF9a?5EgY@l{27SZZOQBaPOXK}=DV zcUl*j9p(sK8sW%DM|kEo+!4y@#wbTdtE*$^;ksya{8j@UCXRJv98EE3DxB!ZBuCad zvd)poj=bi`5=WLgGR2XpPIN6vKEiYEWs%4JwRBDAIE1l>GVY$kA+_B1$)sC#ufl!TiF>aM3)RcNE`M zWXzdV>~50=lU;x4$VWPTJSd31G{W|EU^{oN&Z-#CIf6 z-{?b{+v9rUIng<7^Yu|j8MXZKdXsY`t6s6|N7kFXBcUS`*Be$993d7JNi0Ogn4%4F zlu!ah50fM(L0(^PDncqjPF7xC@f5{V6;D$&V>DtdNNvb-kmn(FAax<_AooD7f?N%`4bljbgj@r;5pomc zT1X0VJ){Kk+j?^y$!b%NU#D7cSggFkT(!Z}XR8fnN89>0KzI(&ena%0YuJ2wL>eGE z*lY;7nYDbgm}V-jGPgi(Wv3gWck@0Q%tW=*7}5mN3UVjpcE}x&7LZ>zn5K|skmitW z8w@*Iy}^($0;LaNE%`%$rH0Qf`3ry#vHnl5U*E8|%xVef1>cB6S3@{F48rdWD#^_wJj|yLb^i}dQ;J5{B^@?{M7bCFersLFUu9Pf~31oLjO0Qvc(KFQiMollN>( z5tl%gLe@goL6$+5LsmgnGb|mGD>y;mP8fYV{hUpPznmiBZ+W(KjDCc*269Ov`f1O4 z$Ogz}u3yMT2qn~Pel*T&lNR~otf&>_4K0$B)ZG*b-(=V!Z$sXJe4;UAqQ0x-L#{_9 z?<;nN7k1Nl+O4~n}WyGzMw7HjuH_OZxi4*5yt6#k;*XT=?=wjXjpiF@(1J~m(|53l=C7v#5IdVryCMyn#A9bBiwJx3ChVokbfZ$inJFw8vRf2a+b*1 zBK-dLF+>;>IUfCgT;fK5n_qH}Jj7!%RJJmzKpj8&V{ef%FMe-)f=Of{#5NVJkT#FR zEs;wrS_Ovau0&BK6rN}secAitN|qfx^$R5Wcaq4-A{3SrdHyP!2A{8DQLVhlDI#Zx zoGEgu$Wz+(bdl4PKXG@WeC0^3awThVCF|jTqTk3YHi-(tJzPpe>WfqosVs7tNKKI{ zB2`6dh+HVqK+X|4SA?FI`g5K{KJz+XNi~t`N-j{Wr{7V(NQAvyqLPax8tmhn4DnJ8 zU8ysdi(DacmB`hq78gl~T&W6lua*jHi_}rl@U8^EvR+rm&aRK#nb_7kkrZiH$+}jB z*Qgr51JBx&$aPw*C&FP~FVgg&!{!W2-L{DvM2tu?k>(;dirggfD8Jh;(mb{sM0#y9l$2sy72bVUyZ&dU zT|`P}a7dfP@J;3^b>nG8CMw-~MjMihyerW|q^HP>BE3bP6?smpdNC)Jyr5XMP2%55 zQNy1rSylguzZO%A-W~SGGoI+K&`jyU8#g;<>cEpnVBN9M3#yy6PYbCM`WJJe9e>D-5id6 zE*DXo#5N7x^v9D6L>6lEMNA%zDt(}1OO$Wcgjp`p4sc`Z#0ni36;_I@5_#PuR*S6B z#mL_2(pr(-Z4w*{af8T4kzY7)kxe3-MLyz+U@MU=BJYa4C-R2KR*|>V0nX-|B8)lr zoYM8ebbVW7d)vf2x}Zqj7x_TbY~8UKlkh`w9SAw6@)MD5bUkh1VpkTVkRkyhyhUn6%42tFd}03DjA7_O3pdwoO4EU z4*LI0@w@kbuV1}SS65e8S6A1}hM5MI0n2GNunt&38zhof0V`!JIy`Wf;59N48qc|` z7tUsx`vxwzN^Jx#OjetOvI{Y%zeNPL0=IX;4)MSqVeSNWiIUyGm`748BqK3dQ9q5` z4;%na0;hn3z#-r`a6;q{14n^lz!9l(tmhvN*0-x<$b}Med*c~R;=xmd{{W`}W?N>z zGn5A|0hfVu(wF|f$o!wL=Yjxk$wE_tsJjAO1+D`(xItQ_n1qW=QP%)c?zo%4EzXM@ zuyu+7_Af9jk- z20r^4))3L~iiTG;SQ?@l9?{TRgRQ~QaIc1H8e$q;4P`Zy(-7BCaf<Vumc4G&CF zp3rtvR8j+JVWCAd6cs?u9RlvuP%NKQTnlcl*mSpsx27m6EUlrWhEg1NjE`|XPbD5S zB{-Y7jD|^56eY`RsGy;ehRPbq&(d&@hX0N8m(f2O-uc5Hv^!lN_q zAxDF+p^AoF8NKoZpEk#*s;bm5Ri!mNUN(5tsL9k|lU~pXxJd2H|%e^pF)z{EKLsJdSG&H1tWatMq zG!o-E9Oa!dDH`8cLlX^s%BP-~nEvc9pEfkt&_ct*BH2>IL;3ElRw~7*eK0i`x0Q^= z?mtfr?oJ=o&|X6a4Q(_$#u;gNLIck*ZL8rgC-o$KGTnb#LzigkDGlGoQar5o8G3Jf z76X8klI=A9(V`%6M-9(v;JmtOm@-v8r{P5n^Gc>VX?R}43mSO1YQ{9xnZY(y9iOU- zObZO?qT!q0)0L*Fmo$9F6AAzHc^ux$8m1k{dtjP+O+z;g12lZE;dKq&HGHn&3k`2* zcvHjsT>4i2+7bR+8s6qovUPvDhlZXSdTDrOn(8?%@OdCmH}$Tx_R+v#5hWPcjs_tWsH;LkMd8trecm-=BEzXtR8|1T)N9PFG7ctjL#KCSbWx9*nqBzzfsWDlX9U!2UH{ zV#b(;^%~A-I9@xoK|}B9YKMlM8a6VPrmIa1S`Fi-t1XP2-_txrmw2nBwQU*}O;_8Q z#QFrxT^e?4IHBRB1`fAJ!yy5Ch3*r&U&Eb|)Bz1Vz4{;{M^9~^t|)w1S_zJ5xHw%M z)o@Hh5i>=B`h_EPKyL*h@LV8BlSy(O*xYWR;kYe2wx`;T;HDDV~JGlXymMM5YVLL`LO7y9uKMh^0=5TYV)hu{iu zLV?p_A#@+@^Vn8u_`76qGH;_9DnUI)$_pVG0?+R*90HH-r7_RVPdGEs1VwQ&@P1gLZ}r&!%&bpYYS~4 zw2siaA=C@u+wOjund*Mw)S9X43*beEHcz!v4}{Ptga<=tEc_=zXc9ux5FU|gvk;nx z&?1DEQoYv-wjRCxPzVpp60{ONRgurLIPbFqfz}~B8bX^89-pZmBNdr9W(J3_vz6tG znd(VlJ|*<&5S|ghbHmG44m7k6p#zsAgr36h7{aRpc#VEGgy%x&6vFc%Oc~*K4dG_P z8U!zd&{;Sy3VnQ--z9_%Z~8BVz!OL*@G{q(C!ZcmzY+pZD;_aZy%xeRwNu?B(q3mQ zg}{XTMhI_(z;lh?4B`Fk;AD0V%3L>Rrs@^K+aY`^REjF|s`A^>eQ8EcHbQJdw742w%!rJRO(`@M}@>4HtK)|7{50g)l%k%-%fe^od#O zd#UoR7lT6hk-IyDOPrlBIr=yTA?Gd=`CkY_1pF%WH=%=tzBwycuc09f3t@N&JTjPl ze-B|q2;WH4ND&()l$VUr0>;czV?tOsOO0hnj|c)|dCG&arfARtS^1^(Oe!LwIAnzjv0J62jCFrZKCROkJ6!xY<7%7w~6czSV>2PusVcI zV&R$))-psV_!}hQ)Gd=*7s7f*LYY*HYk9S22dAQQnj5)5vjdN9mR?(gvf6c=zdeK< zA)FQtXG-~;@s#xeBTEdAR z4dIw5JSFrv(_IKB#VU$1S5Sr^bFBZ5c$H_DlXFId&k8*!^n3^xxXtr|DbTQPv(@Dg zu7t2y#}XY^L%0?~O2<7qu7_}g8CVap&CL*Qgwc{ClFItu9E zsl)|EtdNe+#6Rr*(O^HML)Q_OCPSzxlz~J6mWC7jh;X=zS&a&|g*rmXjOoFx3qf2* zLNMds(~;CsSVs{ZrF4|mQB=nrI!frcOUIo$icwNDwEZdQJ94%n;1SQnEO$#&Nj=zH zRYf^BT^Su^byU!ir3d@BoR0D$#*D!(3-jmo@<_kV;DA$6N4AchI(q4-q@%Kqr*u56 zBS%NBjt6u!(&6iZqopx{f^3|M@#aIj`?jTWgSiL8>)% zC>_Iv8JeR?&QY~>)X{Ojj`}+4>cRD*o(>)g|NQRsd+#YK;dNh+rW$ZuC)JQc%u%i8 zsF&xc&*rEHbu`xTkdB9S44I>v=xD};)4|*FraI=%Q9I@+-Ws)_<~RJ7Iu>;Iug*~o zzxShaRVy8j=xC$kF&&g?tz*(a|53VYuDWk-upQdWRgdd#F6J`UkJaE(u z^^A_TI=bk1Ne^!3+v(`2<5?Z;>9+|!O9%3$SI^$+IUUdIctJ-eX{Clfult>KjG3!m zWXNTu7R*&U=Bi6`75QCtysYDO9o==jqN8Ai)NAzWJoTy`q!eqODl<=w?X9}$xG~;u zIZwTzV@|Equ(GMQbiAqK^LiCHpX>N(p8A4D4*$QH{A-^2QV*_lJkpvsJUrz3YaQP(M0F7NxST#WDmeT5dmRJm z3LRs0{GekHS5wDO9Y0c`j$atDI%YiN|IFZwWbE0Ow|ZW%Kr37Nzv}o+$6yKRgY#6a zhyHKejuX<)RZR`kF+#^k#+wMR%k_C`l#btZjAlH~SAEi{JLfCvVN=WbioM3^7_VbG zhtn}Z#~(WW(($*BiIlIJnxx}TF5>)P^!Mf~UZ)6tp06hBn4)82yo&QI4QL70<~0_ zB@EnUU>QSK#|j-QndKM^TninmbsW@jNXHr-Yjy18QgTD-Sg&KVjx9Pi=-8-Zljz~L z%~_!8F9>Y-Ykm6Z1!}8~Z92B=*rB6`@Y%F3lG-?3B8~TiR%*A7Jv#Q&OAFLq9s9V6 z+*C7O{${HF3)BedwRM3ypa-|I?0#6s5gliBoYQes$1xozb)3?1oB}%9RjF}ifwBhq z3*{ry%<29=l0#1GI3q@y3l;Z1^^{*2*m<7Yd7-+f{!JaXbVLo<2L9FYACtKO!$5`+q=4b*c}Ef=YX5#)-n0rJ_=qI@_o`^81d zF%UCQ*gz2ju7RFE`3VD_fw+uCZ67RBNdrR`Df+oJGNvz5TNWv%prQuuG*HaI$wlf8 zv8upgMf12=#i`9q^^mddmZpkAOByI;;L;C1zpUT~#?l7L7$|F?oU~Rjz~3#{THZkM z#erK=!oNr8f3N$z-R0*I^0S4ret=(zGZM_(`y5(gr*aLPn;6Wos)4kDLlzEOxYs~6 z120>6#X@xhd302EH~>%Rp@d?G1D=P>23E&|F5TXW)JV z4+<`Lf9j)Yetp3W3^X+GfPn@B{Olis(fRqP5f#=;Ra>kYi%b)tO@&gRnStd41IZQ! zS{iuBz{3WfmeyI5{Z6t;5`EqCZs<%@II|F(9ZyG<3BX;`4aW95!_DnHSiJrJjG{{=Y7%eCF&D;?9br7 zde#!fZyG-}@EK+JsbPsa_`ZtPNqxbc^1I*Pz?TLr-oGtT?o#y)wHa7rV6B1g3=E*1 z21XnB-oQWuKNuLq;9RO`3=6+{`q98o21bY{e>U)ofuXm(n(y1+xPylIzjC9=ec)j3 zAZcQEx{+VLkq$F3JYT;4QZ-WWD51SB7NEcw17i(L6Ar(j>N?mTXJ9;iH99@Pz$62I z8u-Hi`BXbmeD%~)^%rd$;!id(#lYW2@XcG9-vftCHG*p>!6GYzfcmE!m|6*z;Vf^wWOn$s!MWOVu_5Or-oSf~jnWft_6CaEe)F&r-F=z+R~yHn1;< z-c-E{g$@d5zkve=c#p(Lrtl$QvLnClIAY+afnx@a8#rU&EQ8YszUw$`;M!7kQt&B} z|3_?K6Fc&YpfTP3bIjYz6!-gi?#hX2@-N8tzsMMS!*4&(zhvOD0q0krw~-X%(6_C< zX5cz=;4*c?z)ey9eEHNZ17qr@?q3#sHf^G&^JyWnDwA;jVm>qxd`P~HtqQX2iz<12RIkpMjvhs?_COXQMR(_Qc zH<2*mnZe#aH9hFaom<2Vz5y#?20kfj;_J)lJ51bZ2Hz1CGf~_OesOTz;1k)C%M`z_ zyUWDgCQ6!k+Dz4sr%Ib(-Y!LJC;9x`SH?({F@u{@UR=t_9I3Xvi3*}WODH)h0rv>4 zXd+ucrTo^)CUWv|t^k@^)kNCFGbY-axYtBA6SYm$F;QJcsUb8^=v&KzaIMKpfQc;? zQ(rApr1zPqC9S_pYh4rdOgv%YNfY;*sBhvS6AzncU}Dr*zlBILRW>y7fEnb>MnVZ5 z6wsJUHr8)KKa@%}HPMW!CZ?O4Xjdymna)`$ehhDEV(!>rYp}GU!g2niCLR&zw+^c5 z7b6*4s|PN6a9tr zo{0}l^cDQR&=2UDacTY}^pS~=O?=7#7CwJl`NTv&6D5`hYg$$4=hDO~EpNI!_zmbw zE{cgCOblWGoA}1W_l#Sy>RS`vnHa!{OJ9EJaof&ff2Rl1Zxw=zAl3e8;wP##@vDiS zWsQEJHtE8jjlQgvT3;dcn~6!wgFG|X489FuU;co_?!!!e%)|l{3r&nLG19~zCMGhF z#LjU-e>X9jt84~8gpC!>vgPW7U(>Pufd-cG!klosX^NU;;!hLPP0SF^UnVA-m?HRZ zGx#NoU8c&srpb0Yuw2~`Yu{*4W2T8&+|&#|2ILeqn=vfk)zfl!MbL4c2`=A!6L+@%^=#C8+AOzdVH=F99f(MU{fE0in3 zy|9O7uLyo3{BnibZ{mQ7!zPZ1OApFS51AOZLM>wJl)$$~scoEp%*1ht6aMbTMclO_ zSWV`=Qzrf~kr75_7^h8~G4Zd7|F|`p`e#jCG;zrUFL~!US(Q4^XlF7U8eDey>FKhG zy8JW-ZZ8lH z{?Ma^1LqVB2V)fy{BE5Tzvtx5Mo6k0P7i}jiiN|7gfTgcDPdS)M8kL}jEBRp!*If= z7)Ev&u`t{)3Wrf7jCdG)6K_&zxs@srh8G48PprFAJ-#wHgfV?St7sT^gi$h#Qeo`* z*1t21yTa(VQWXn>CtXseco-!_!>cP553=X`d+!c|l;^*f4x@}TmFHZ(^UH=Yri=gf z#msV2UHxAs$EqL#JjggJjFjMegz~s^Dz6kqWvMm~BPWd9FlvUO!tjO3w~XE!MwKwC zhB0`hnntUJrqi_WToysKFsg@9_G3Sf^KG8`tVL=gEezwtN>$=Y`o1t~iINAys2xU~ zFdBr>FpRok@Jz|2H*40DR;newKaBce5KuE|p;hXEFdB&fjpR|44L=F2Z5&1uVKxn; zSr~8iRr{}|$$xEj`p$lS3u$T@M#mn0@l}cu(<+Qd!uW*#45M`zkB0Gb7_WrUCXB~q zAzljO@i3kUqkR}1!g!MWcZ1iWJ`=`MVLUA|M!gx<+ z(JhSE!{{xzdl+vJgzg;lD3M+Dww++GR<+TSSf z_KgAreT2_IdSAc?VSE@yUs=$P!|1$<_bp)eXPc%-2Y%#}eo70&7!<~jG&_th!WbZK z=^w_Iw04!EXTAz!*1JB-w*tNv`b`*XXQXfQzmqP+6#hPpf!suM(=0!P@$)K0@Do88 zL&6vu#xLA=VeEP!HJBT1mHL$vznICu{!OZ_W~9kv>)ZRYhJ`Uaj6cGdDEdc)F`6^F zl{r$Xqr&)I0MFiKVRZ~+FN|?ixIb{q1g_e(tnsp&)~`}k9u3}`Jt>So!?-mv{Z|+~ zG`8F;KHc@-`neg!A3;2VnVfhS7s9w0#_TZW zgs~%xong!kV_q0*=#Vhxhp~X69>%gT7Sgc~*5H|{i@5arvtC@1UL3}fFpjNKnX476 zjJM@stYCIxI7xLS)5YrG-MlQ6VXxKFx5U-Vbz!UzW1C2B2xFswt=!bB)h3}^gl?8F zCX=O!XrKX9zFp)ytya6lX?w%i7sl=|-d`Oo@t%CJKa2z1<6)fS5JS@kg&wBPFpj+F zlhb@u`bZc@ISYxacSfa;OH;!x{(VIh-(!4As;9#^6UIM+d891+vYZX$To~u`nfG+@ zjYVm;l3ohqau~(0X6g}K34`w|{x6J-2(E^4jWM%YUFWI^|3(-$1x#D5D8?qzf5X@$ zATxpj5fqAmI!`Q0pIxmAMvzz%;5V11`L|B;HK8G)&o54sV?+>Hqs$1(uTkMhkOv|W zSP?`8v+6`(N3iEo0pbR;f`yAkaCvyzzfm9&ffqsD2!s zIf7RrxXpi6IJ`HwE$^Sn>mEUm2zo~F1{W)WzH8Mzo&C2WAZ>jy@Asa5uL$0bpiczv zMKElwdMAS30^W^a!CLiZPrrU=pTflNbA8X`5z|+Y4{9B}Onz1bvxPG!g1HgQ z6Fi?QB4GBmJj$H7lC@PdERJAF1REmQ$S{atSp+L1SQWwY2+pokE5xOA9r3Z71vnSt z)e)?TU@e8$sM|}qPC{b6Pftq)dYQv{o(`xT*EBG?hL*dcT$ z_oMXP%_Mdqv)y{Nhv}}fPq06N!^6@?A~+hs0l^1_l6i=L8)R)Baf#vSV-XyerVA1N zMu3x?NWSE$2+j!pCxX*#TAIGyg_MQWbJE&-y*e*oK~JCjixFI+JzU=#1=z%?5nPSn zS_IegGsBGtUd<@T&BgHkalQICg30TZZ=s5X|02k+kZGZSg{TGFLO~0KESOesZ3Q{& zm1YIGoqd@BLROG_*R5B&1yVzr2*M&C5z3C1h1(ZU3Og3=uyChzj0tru#H}DBC9L4K z*%O)+T3Bcip+$wRe~}yV|5iGYicvw6)OALJJEmEwr}qsD+0t z@Y=_8(aOTZf@^G0kSKUT6oLC$a8tD_O#H$ z0*^qwyg`wY)62r!RJbt^Cgo{Fy)FD?;b#kdEIxFTde6cGMN{uv_`t%^ZvKZBKDO|Q z1s;FXml2hj`pCkX%-~FceilBp@U?|+EPQ6+@&0NF&wsR#I+ypkg)b}=+o-B-447Zi z4`=hfvOvs|n4B)2Tj*O0-&+`H;X7#^Ag$|nq#xd>ey|XHAmuY(0tQJFyL1t4ztGzj zez!2%!mk#7voP4g5X$HU`AAXfT7lco77ev9!U~>g8pbJXRKo?Qtl&AOk%C7F4XV;H zS2~WdFgBn6!$vj1!XFk6ink|Pm}FtQwEk(~FN_1wt3*^PAU9EwQjvs_QK*%jd7Pu-w85 z3oC`QTIedqfL?HEq12*C#+rP|Q5)4d!S@vk{J^ro!bS_5ENmA37NH{}|JS;eD=wVr z8x@6j2;RwrW?{F*$3FwHeHQju*vtK1BT#sIzWYV;z-^kD+8W7VxRyLt@Cbv-LS+{@ zE{<6^E{@$3!wCx~nLr#gb8w1rXrYyjM{Jz7aE1YF!?1DI!Z{0_qj)ij^A;{xaHEJv zanZsh=Itm7L~+@|6$>{k+_Z4jLgV%6>lXHHR0P-P9|5dh+o*VY_$>>yH>v-qXOsGu zOWD+~ut{Y^17@2|inL%9g`x;Y5s3zmcxll<#)u*m#h#sM;?Fh(dUWBxCfJN(_$D=H zld^=#W6EO!qET$wr0ggh0cSQTR)6UjoMWDd!i%D16c3(FC!;7FMP3v&q9_tY(I_fM zkrTxoQQR3t*(l0IQ7nq$QIv|J;rVn4p?3*owfx02>D^J36b_G8XSKB8GWjxeMR~!g zd`<-cSu~)TPx*VKS}}@j0hNS4av`r-^PshTGe0+qDp6EApZ4jN=05rCST%}t6!!|h zx=;#KyRAWbv05_<6~(;gRFf#~i=tK(4@i}q+ELVt;{GV=2&Zm7pU1DWwZ2pv3T+^E zlF7nxNgI)KTi|@Uv4G+oR8s-Xgf6c0zyDvC#RL>}SMbSHoK2f|KMdlXu zF5_y8B6uf?j%U*ZmA9w|x2PMJ(p<`Cwx~C@s1Ks}Fp9NNtc#*=6d%b#kB#EvC_drb zqZkrJzbHP9Vn7t%NAXz{pNnnZ2>l|8FQfP>ila^a{!x5G{muNwm(yR<|63FRtD}Ya zZ4}={(X*MqU8)14_#uk_iIPE4{3zh(D1H(ddX@3O?x%MaqK03jwcLgDuL6Ff@)kiT zGVDo*3UiduVM2$~&jLm=fyi*?*1)jeg*jU27@@RhTomJ@m=MJuR2#+oC?-b1p=U-h zD~d@`{K-9N79{7dDE^M3^j0-l1g1tYB??k%o+gws(*=+-LjWU(%-JG8hnszC;FGyh z<#R(BU5XHeL4heqkS#>yyBZ7~~&_@|FTNQiNZ{d@+JDoZ4 zT%hD61Jx)#dY((6hTXQMb5#U-hp7fP86Q6y#bi^93x_i}zKt5@^!wJ5Gf zaYL%~1N+_-%=q~?ivPr_3_Do0fw~?^n*ci4|#ca@l)3&PLE~Z_92kj(fexQXp zHgawFHon`YCK&~**r;mbUK@+HsawtcaoYl!v<(_iTrLXLZ0y>m&TmsSY}B;T(8dEc zl#Tmr)Ui?5MlBhO{;X{WNr1^Gc0T?6bIRPVcI+%v&&K^WK0KGMZ=(UbUrLwSuF~68 zz~4&{-_ zWb&|$G27MM=hCfhJZfXCjd3>G*m%swYc{&sc-+PlHeRsN*~XJLp0d%-Mtd7;oB9j4 ztEX)|W23E&ecP42L(#&E+ttEbc^zzYw87oliN4(txbaz$q1bbr`wm6WdWU-623PRy z=Tzqb>O~t}ZTxSC>SE(1am&ePRo5M=-wyS%jaNA0#q_H-){C~uJAz)X+vslNOB-L= zc*DkGV$Zo{jfy zd}5=YjSuK{8z0&Dm>%A#`ZC^js^@kpChf|XgL?qd4|WFg`qai}HeNiJ?oR{Gr#~0^ zg^izg2L5MZ^iJBT*6dVY)AO95jbCki%Mh~hqm7?z43I8AP|vgK$WHaWR0j(Ecc&U8 zmN$`WJ$FiSmtr3KnR66A{l=!>Yz($B(#9woL%0`qsiE9!0%&~WU23?E5mKeWtWtn+ z{=1FQHu~>Uo16L1HTSt{V{8z#-KE~xrN-Nsz!5b;QjC^MyMhh4(#9$q z`_H9Ui;J|~fk~{cvxB?V4K_A1iUfbt%qQpP%Xyn@+_hV6w!zK*-Oe;`Wx0R1+1PI5 zh>fE*cG%d-0H#{*XpYVuw_ELDkZ%u^SKX}`>g4QYc53bua0&-(9J0Z^e2`max9YJw z(0N!oe!e>}^_Y$0HvW;;6U;~#)2D2toBJni4BxF-C1rPJq0=%E-prg43wg_Z-o^zR zF$b=Li#9IV;OikY2bXPJv2n}Bzg(JT{#6?{xHP-fH5=ENmM^3$T}sc|t=e2j-xU6d z-HNUMaT_`)=md#3(+R@3fD>dJPK^P{ix(G##usuxCsT$cF^Ycfc8C>`~90 zPlp{myGKPGL>yQS?%boQ>``3qCVQ0a1X9gtb4k|dPcI;8KR?*Iu zK3C^H2egoPYxHm}C)oZRuC9Z6biRWJ9NaJ6sj9vcga>1oy&5>65=u5=tAoZeK~C+= zo}h3#O@zZ~aXckrr%*Bm_I;7JGV9JF`v6ip3fG(MTt*1^EtSx-B7#zD7#vWQ8KUMoP* z!9hm{ogKW$c%U~N96OmcVRu$1>2mIBAkhg*c!P0E`x(Oy-g3}GOnTeFfIxS<>z-Ievb1OQ!8J(|Jl7-5#!tH`PKt(xHA4+k?H%yKZ1;d&zLF9&}+Xu4NT za`2~v)Bgkmkx%)_4yKE?Dfv353YaFe@t&+10@|7dDLmW390#i$tadP$dq0-3)WI?b z^BCR^7KkM6StMYg%#poV77J&I(4EnYva>i*H8}sphR|{=%u+_mX2fH0?%ja+Bsue0g;T^)+na^*(SCP4g3z5&+>tLUl zO8)J@I9#Z}AqR(<*mT)Qo~v4)u?dl0+YYsYYr}n*cF1^K_p+6YBve;t0L2LuUa9?bko5t2X+ij4F5X# zPXZ|%Lq-glF%*gguNf*33*2>k76oI$USs)guhN8X2o1%c3s|KETY%m(V?l)6aVBg0 zUPbwcbhLyO#!xwi9FDj<7&<$KN-@++rVt7SrIEQY_%T$CAuaQ&B5TT7 zGlx*%Ug=oG352PkS`5{NL;UCDbj=u44A;C=y%_EjU)7O`vwJP6*5)eg3xcX{zU8ay zrzn4a3@;qdB4`-H12MD;dZAGa55~|ehUPIej-iRz!*LH54zf+t82&sFtRQJBnQFml zCQ}dbDj4g}&#_+P> z&O%=l+C}I~F@CWSc=DAPUX{`pU3b;4Bv<_qmipaX8#zz6hQoyfUjfNo*8VJZ>9QO3sXVptf%q8NrUPQFuPVi+p| z!(tdNU_=Zfxr1VXS4RowccG(&KE5mK>yugI=%^T`$1o#?3BvzND7*X-!^C_%iH^<3 zmG`N?W0)Mn6yZ!2TE2ej=~%`z!MwPz`%J+cWuAapLT3w|6T{pXhV2a&k#v3x6k}N+ zAp2z2VkVFnmT{Zg8B0Zy!A61Gn%Qf$ov|{8RWWRgVUy@w%`G3pTG?V0pgrqiST9X< zKC9f78>Gs`+ALtJq>(LxYwim!g4?)QG3|-p& za3F@Ti-?OO|70GdmnNq#F$tW?IuyfU?o+G4krk>9~aIEp(ll& zis2stY&|XDjL@?&oXh7=J6yA4(bR<)F2+!LQu@_>iu7^}S7Nv-Lua~y0oP)<9>WcZ zSkC=l0XK!-63VIl$K>PUsN9<|qr4T*O?s9H?L_;ldLTck#b{ikzg2$@>(4D7?c( zVK?}#dF?(`#6?jT1pHZ_^z=S;rwjh!rx=~QUln&j4*7#irtX%38g%kYy6C$-tCY~v zLd&=)>!O_CEEjwOU3tM3gi?5;k#SEx&UR5z@G(7uO)QmMe5n^C$aUenSm$EBiz=L~ zi=i%txk$UXmt9Movh(aA-giyAH-anV{7)^t(ZMI9F^f2{jl)DnDZZJPSG zoyn@};z1XUT|QEW`(2Pz-^Bwi8o6lTqM?h0t$Z?PRLLWKra(dGY|!i5b?GK9n!0#% zzpDO-Uv9r@=AxyGhdAr~s=136bX5C*UuVA}c-TcN7tich_jT|~b?`U0_sQf7Cm(hB zOa~r!abJN{8yC;+D@gE!izi*QchSMchi9^$a`80#y7*?lVs+P@srReo4ceD(>!KY8 zYUQ&^+L5dIl+WK-`PRo@SEZk&J=@Z!4i$Xf#S1Q8b@7^u&TjCQ%dz{_OD?uQ;lJpj zi;K+5nJ+)$w>XpT>SEb`#qzR?S2$wH)bp#--`$n!=Hhi1Jzey2aqF(sq5Z0J@l2NYO3=f_;>Ub~w_UtL`#F&vSyj%Y8E@~p=q+M>Wc2r4yeCzTe&JH) z2f{3PK+&+i$I{8J{>Lspaq**zpIr3IU%^2xK9yN~=Hhb~U%2Q`&$#&3MX>|wOBaKS zr@j{a6}ucu*MHpa*3RGbZ-MVz3~=!SC0qL^i>JPqp$F3WuLagtIiN_3KH*O;n4*i$ zmq=Mzg?@JVy8D7dT>K&AFVN$x?0X56TY^lC=Kz(*V%@s`HAqUiaF_LyJV6+Qf zJp(PUhnO*Ttq!{ev#{F&fWhS&dTrDbS(D-v`tI;oN4D9+GOuCc*!ikMj3lH~5=6%j6;H zudiesr;&|Pte$f5kBciVu5!b=IOF2HiwiE!x;Q6YX5|$6;!}TD+2HTE1nhEAG+%ac ziLrDwbHxD_Xuc9CzvkjPL&fEb?C|k#88=+qbTQ+4Rj3$B~HRt~lDwG zM>>vs<2X7!T_Fx0U{E=Zta$L3W*$y(k0`7t)oj68O;T(seWO6=pvsA(iZtcY2?qlw z^LRzlelyZlZ}V?tQMg(h)#E`h)Q%%h1bA$4P2uoQ)O_Ha!lkTI2NfS`s3n-y zp*L#Q5r5Xr_i8->^lgJU8piQ-9M8n@Kpc(YcqopC$yu9zFpeg1G>xONRLQCLUx8+E zF!4TeP_>AoIX!SN_^-=t+ES{o98|61cqES2arBo~;?e^HF_uT;XcNa{aXc=1o)r2- zJjmzFIiydq??J^v;j;xZ+KNDjI3BHBsGZ>UqMWTA<9Jp$TaTqTuS%0LFFhZ}&vE<` z#|v?EW@{W>;^-5{dvUxJN7p#sRG8j&~DE@Jbx7QoeZVHQ^BOQuunDk5Oj? z`9B_9v)+hfP_fkByHan((IbvB1yViZcw3sjebnz2N6R*T)`9dpal9Kx?>P29>i0gA z$tIS6Su#`a$MI1dABzDW#POj38q-(6#WPu-#L+K~A2_dKsZZnhERHYZ_$rRi<2dn@ zKklIVf~!-x5a-SW-aj5(jL7^tj&I`lHjeM&DEf@gd_JvYUaM#P0dagE$3O;iJD-J3 zEVltW)_d9?6vvM;)=xq?=aUF)WVZaf}eo*m&^PqmhC~#qoO_qvQDLp5Q6bF#--&P4USoJ~cm1B*zP#AoLHR z>^?D$NrLT(KC6E-D!6SED4xKSIHtz2I*v7QOp9ZB9E;+?L!C3?!2?9IxFxfKhmU5` z`E^obhx)UHGe;!+V*c8{|U}W1Rl;5O27wc z3nfsaRiHMU2wv7q{Fa~65(o*_g&IOlq47hCGLb|OfmQ-h0d@jK1UL!A1h@%!0w@+2 zkVpg%tFoHR=NC>O>rn788cR`O-jTqa`K^5Bv_t}TCGcDVof5b^fszTdPVmjlD3w6z z1ga%aT}&#IK)D3UCr~yK#NotIJ|EBL>?$OXn}E+z5=bS2cfs95$>01+GX07|vlEy+ zE=^%R>RUO19AS3)HF&KAOO*uf6%L$RuBKT#YzYD^0UwCXwE%>N{548HdaRYBY}yD;K}ZB2^>76#&gzV z{0Rx%IHbs=&ccTSI*Bs91MoLDNCI;%VD1G>NnmOMhdbd&CrnFVI-4qDN=3{_U}geW zisNc=%t~N3wH3w9qL`Dw+yqt@#nkTE^Aeb!z+R89(Z+%V7A7#%!!Qqv5`67E?)6a3 z!;%D+GL?BK`(b*gYrNFWc*pJLs_DYSL+CyudSA?CznghjJdu z)8P5Rq$+rzom9wKQ~5m}X0FPu;-RXCikypwN**eE$n`M!u*#9v&L8E3idQLrqdMsm zP8Ht+Ic(+9q(z(kU0@#VtnML?tsY+VP{Tt_507v<9+ZdsJT&#t%tI{?wLR4JP>=q9 zvdVx5a_TVntN2A8$T`+E=Y9|MJ^oWVw+UzGfwB64hejTcXvt|PRe}cvu&J?!#>IVt z$J$pRZC)?$gT>j+J+$!9(&J$YeA!MA?Q{jb{ji5t9@^B+p<}sN3_N;(et48j5A8j4 z@bH+2$2~ml;TaE+l+TU~j3+#d=vU=Q4^L61X%2S~t5n$5Lpu*#acZ+;mB#hT=CXG5 z@T`aDJ$$(+n?pS3p%XpXD)*BSxmoX+`iTXt^`J^#u6z(bcObNX;0GIKxQoc*4M_Zd{1vsqp}Q}sh>r9fW+AJLO{ zf58rt>GA`$H4_|or%EQ;Rd~8mCF7CCQFFo{Gne%RG-?=Au|K7@N zE988`*3sGDdib?O?)t+j?|4rA_BjI>^Hp-b_fW89Zs&rzr>o`+;y(H@`+r>Vg1J9> z_=&D)P$>IA<)4Mmre8dGrz;as;8(_vND>eBFody}okNAJ4(F12SnFXO_f)$|BN+_@8f8^td0wxLllbcJx-}$YRJxs~RQw2;D zdiJoIAz)^H>nsnm1yebPm?wCl(E0f?3p{M-o5R*c9u_nI3xB!Lr9zi+%l}oGW!>7U z6kFk8rSMk?C1@{srx+~U~r;R_o6uH;SjfZ63vr1%m`urNupd5M?D;4=1js&;<$$s9xiye z$ZWGT=cI>IjGx}Q#IN6-`HzRw9?p0;>*1V-^B#s*@n5^w|EolrSIo9W{Ox;ltRt$B z?O*b6*+WJWnMqvnaMi;N4>y_XT2#5_;W{_+tje!1%Qc7O?2lDyGbrblhkvQOO74Fi zf3v7WKFhVM*=*``HM>9(1(VQ{2qjS{8Jx?)RyL6i?-&SBEqg6^KU+`A5LdI=lzY?< zCy_|POCpkll|(cNJBe5lE)|~4$*q#si)Ip&pG+cWa?ZF< zsuoM4a1uq5C`xV3^6p6DP62Bpxts{c@~&kQ6i=c=GVsY=LhlyktXAHeTQZ4KNjy3u zm!-6TGD$q&w<@dUlc0 zb~&+1_a#v)iTX*bt(;psiAEzb%g1u+CGpC{+&VNsz}6x)j`zzU|9(0-mP4Hll4zL3 z1C&pqNitYCtAF;~jRhV|qOq(ImxgX3p9|EKOVB@?BeqDQWfDsZV_9K5l*GeHgbO25 z7_E|cB#A$h_$!IlbWsvtB+);KHe%}YNxYE6V@W)o#1lz8nMC^}IwbK_5>F@5Hi>pg zJR_20mlvdMOKJo$nOh_C-Tv8cHZDZkF^OcWs?R3zoQNGXD|O;n|BtEffRdt!x+Yz6 z4%0n7Gu_j1NW;$T%o3Jv5d=gOjF?dr6p)}2#RQ5VCJZ2$FrXlUpkPLkU<3t8il`_C za?Tn4+i$-8{_mVR@7#KI>(#4Quc~^&?mU?$jewH4e*||#@L&X^BN!0Dzz9Y}Fp>)q z!QcpnL@<=0h~TaW?iR^jy-sIaZ1o8)5;-h_LUp*3*M7 z$tlnt5VIuH=9mZ`ieN$nk45ls1Y;u@7r}VpKO&MoaKv{G)(F_+XyB+V2kK8xc&GCgSB={X)}>2xba%UIcGPFe`$0rTUJ@ zIU>oQEr7!n05x+(b9vWF?+JLnj5$97SBCpAf{!BjmI)?JA4jk-g3pP|n4b#xOk`o* zzldP5R2PZ-QY6QEuxq6y5iE^hS()bR2)-)A6J?IyNOi|n|N97*N3fO0X#^`G_#uMd zBlshNA0t>9!MX_6N3e?fOZaOUbEEv~2$sBFevN2$?#{4qP!=kGj^LLFe&ucz&IaL7 zw)!mO6uPkbn`qc^Qv`oT@J|H)M(~%AH*-HmK+ga6Wyjw)W~n6jk5_>BKuiq{Zs*}2 z!I=ooMzAx&FZ|$81cxKo9l@Rm_C>Hig1yqWd)G?rReMbSlNsp)5%iAWpzJJeDC)Vz zD31v9cmyXRILa%4NB6dHkJNu8oZv}L>R{$n1gC{Y%tAfOeNU#(MNm!&e|f92g7Qk} zZ6%Qv6jW3Yj$4+H1YC|P(ppVHbp=%gQ@`tz%;C4fGu#?mp0XA@D!4SKugcMPn#PDlipT zN;p$nlyr>#+}kkpjm1;Yq|91MKx2^?Y~wEsp_zi_Qe~=;To|HAK}JD$1(zzwDkxTP zo`QA?atiVaO3SR3C}^diwStzS*_6n><7D5sD2zrM1uO(ztm3u`{IY6LrexFk3fe2U zP(c?39TZ%kpmUk!jsiL<*gra43zjOo^EAj+zDPk=1s5y0L^$V0lrJ0z+QqSMZR6hoxz(5+1Fj73@5sfQ4aauYO%CJt~|DA`633 z|Ac}k6--euRl!rz^sIvC6iig`v{auFNwbAuP7>pj6+Ex}&p;f4#%YSde?h^E3SLn# zt!$K+6uc~MaKwURuSyg7uZg$J2X^O{pRV9d1s}6j!CMMuD43_3-|*q7x~ z1&b9dQSh09h0^r7f<*#&h<(9WO$@W*OVJQK{aASYEtTrmBA1E$O5~n)#oq|{RwSAK z{*hg-V1Rs5u2wSs-zJ_^<-SgYV~1^*~mr(nH; z-xU0=;AaKDDEL*uMy8xRa%^B?pUxIs8aA{-0ki231)GHPm$>n#-~wUPHlJX#f|s`W z?D(&O{}k*{uv5Vn1zQzt6Pq+bYqZaaZ)XCR8Q)cyrh>f+b_@Pc_70gWg+Lupa8SV+ z1!ol;QgE1ufP&)+j))zaIx7B<*d1^lVSiYh9p zp{Bfw3To(8!9u}XVlttkvKq#x&`McNMRgTTR5VplLq$y$F%@wYwN%tr(MUx^MIAL9 zuD*%}D(b4JC)Ksv{LBO4ZlZ>=p$cA4yJfzL3RRSv$f$~Om*+{N{9k@Tg)Xh03PVLw zg{8t)VX7z`-86{p;Si3D=n9z{S};VWMAKL#FLWAjrlPruwkmuTX%#J0l&EN_qDVzX zMP8U$6|`KeBB!FA*r7qX&FK)Z&|At@D%uEWEs~m>gj_1sQGx?nP;tI!&QnonYG20h zAfps)ULZ=k-C4zjDxOsFl!`7YE>bZ-#XuEZRa~s%dKEXQxI{%a6<4UZQbl(amrCEu zWMvBrTG(!vb17F8(LSGxu2RuM#ntNnJiT0_hEFors<=-27N$9AyU#}j@^4hpQ$-&Y zx2d>E#m&OGRmHnIvb|K?qM~qguu3v_1Z8g(zsuU)uA;B-`>W`uV&v!?OX0*LAoC6t z?@Mq7sTi!{K^3E!Zz}FmagT~oD(+S>M8$9wBh>IYhu8X0=Bn5%Jn&G%r5P!iMzDH& zxHR{wxKG9XLTg@j#m9J?h=${Gqm5DVkc#mt9#!$MtnyeDj|kw3k5fV4m`;@B6HHL? zn2N_$JfVWOd>gsbd&?~|pN`2Eo5--Mn5W`B70;-6R>hkt-cs?Lib*P7RPmCE$zt$% z6;lMfdoVwh!919Mq0G0wm*@GSgYsp@R>kWaPQ^48ud1N_HK7r(3ptc@Z@QQ*G*L;- z3>7oUS20`oZ*w6o&(Bi9u}Eg2L1HrJaCFfS)52U8vr0>7_I(xeReYghk%|Q>K2Y(g ziqBMhSmx&^Dn3&2F*DOD=5?YFxj1aK1;CscV(LI%b0B9rSOA_A5|z(s8Os`u}Z}m6=!+=GYwR1 zRk2OQ8Wn3*{390DsaVgfMY*O*3 zioaBBE^8`uA^C6FJ_Ic6{;v@JQ?Z2sl&4DG@@(3!Vuy--D)tLur^r1jcB$Ac$;M1$ z*3}dJ-m=YjK*d27$5otAaY#ik6^B(EQNv8;l{({4xYkEi9OL?SX;bil%9D~Rr^VDM zkxZDQSC{Zvy_$k^D#}GsM?QsNm-5l@XLl=0wL%mX1ym|)9r|FtN)%P2s9C0|CZKv0 zeC=Ntu|^c65!Wi?)Q)1O?CZKw)DvZWk&U8gP{wH(#Ujboh-eBUMx)T8xGIVsQN*H% zN6|WpHc=#^(4%M^MUyCuD3a2}i^7b;io%J)jp9~$l(Nh0SKZ-LGoWiFZ^!?f)v0KB z3Q^xQie~gbisC4mN0E-AD2hxp+=eZp;4YXZLE}c?qzahITom~zT1L@II3-bxlMxG> zajJAF$kHgl?N)fn z)^Uf=S98~?p`QGUqUah$_b4unhRJYo6y2iX)50ZEUGXB6Q21jvc6oZ7uYm2RS3BEgu zAu=_(JybMoDy#^fLWf5&B8rhw+!MvzDCR{mikji+2csA*;NB?i6F}wt0v?EBa{nS$ z$3*c^6jP#@8pXp=jE&;CC?-YW{gfUuFWuz3^dnI`->+y~6ypUvDw3KBQ9KsK<5GP> zZy^C(s z#TnIZ!9l+k@Qn;tu7A;n9sYOX&-Wsivm-;d!>5Oo?E53HfGAc;hOCZajewt+57ojm zYHeBOoQPtb;Pp}b9K|o(J5t>%@>jlxU&h=R#cyT!_bC1lyh-GrBL6CD-7MhmDE=wa z?2`lMzbLkdW^0*#TNK;N@D84kf_If^c1N+N44+MfPe=Qr*e{v`A`gl@RK__h;E2eh zQ5-AN9~W@dHRVs1X)dc;^pkcCx=QUK+P)WmU zW70h}Ktp8>9W-2^p^Ap88X8MeH4Q(^PB+pJ(NJAO4GlFl)Y4F2!}^n%+8XL;sHfq; zH$~T_i|cCm^H6$7-R!(MX;wd(nZD=MbOQ|yHFTbtrk%PwefCl`s2X$)hK8sHO+#Em zvz`9V#+jJLA5Uzt=Du|Cq%1%DN@(Dx$=%;cQzkW-8u~WKcp5AXR5}`50XF@2Gt{tL z{$+8!2AQS1ic(tmA>B1oGJ88_n`mgtAv84CP^2NFA+2Hl;-a~iX5aX@DE&aXg@zYr z6m^_el+{qI;gX%c|4KTiA+Ld;y~q*`Z3MIw*-GOlL7CQqulpxW8cV5$wxS8E0s;-^ z320ZQKVL((UK+6b(O)JhUf$lZKnQE*fspFiOL{8gA9_(Xs4ZjL+Vp z-WvKaH?q0gH1yNZU&HNErKYcdSuf}A;D{P}6z2x9@8sM-4R21$U7yd5-|3%zF-QGi z4R;EGc>Sc@-5R#NkQ<_5D5FtaGEBn=4NJ1QZi|bDYbeR)o|=*yDVlpkPTT3T^*#+B z?DWTxysGGa4G(B|P{U{q4{7{J7X#nRjnT08z1)-UK;Ta9jYIsb;;~GByzW52od6(a8m;a=ulnxz_+F$k$*+WCqx92AcAt%mQUb*+Z)rFD%|mupxd z)gQ4A;l7MZ;DNO=4&o!!`}uc_PJ7Iffk?c4|1O z;gp758g^?qsNs-?JxoOn`+0I|*vD;hWA?3GJ^>|hK|{%MSi=zw$NmrJsL%@h;~GwI zeWlkXk*77B5psnX&T2TPp_z#%!x2=Bp;9ayh=om*Rbr?bL!%fXF;o+B ztr%((#89Km0%^0lWQiQa)!> z3~CH|3`Pvm7_=DTF_0V+kcfdy(x_n}V3kIaF_zl0f^~)J$m%ehfhjZKc|BYKF@51QWDlWEzzxU^!ou?PKU5-~y2y%b1;F=v;Y^CB#&D%Xl_9-2hVEtf5&_*9kUe3vFOA`{7%q?DiZcC%C28s#%`YP1su+5R{^}U6 zDYL-7*9s=5;~xKp7;cQ=4lY&%bTW#c)pyqqq>OL*s*ExRbl)Kv9oP74M4S z?ihx|Ff@i?F?@M-rldjcpW|s2a!k7#@vbRSZAHFd>G=nC(1T zWjP*?;iVW}j^T+Io{ZrsI=LY8Yz)uEFj4T+BB^{v0DYbm!{ivIO7~tPkKwBrz7_&4e-p#EF?=WF zPh`c}i(OWT=7$)5jPb8~as>?~%gPw)JrXYT>KN98QVR3{7?5*V(#tbc^gByII8XS_Y3D}495f< z5P2|$Lopl{Ja2C$mLuG8(J-ai{kY&0+(*$2Eu7?m9K&f*l5;MGGlI`@1Mc;yarXL! z?&ag55ta&ZR1{n(4*tyKXyI2D4VfIJS{&8m$i$J2qedJx?te8b|Fo z>cml3G*mVaP%n=90){7xxmBre7)K+~L_|K{I8;Uj>v1f&Ijm}N#6&|J7myH13q~B= z=`6`OOu?4O_IrIQ+1-s}U-?W?99|r$I9A@AX&gs$0mMxNG>xN~05Yj$NlUfG|IsJE z$rQ(ti{s`vdc~2Cqa==H&t|TTaa<9{ZOw~2#nCwq#_G~IE)+m~ z5qk;l(Kf>>OV>Cq7R@DMkeY5%?H&&|X@PT@XfBVV(KQWG{X+#L*JSECKd;MqP_-K3yHP5lvttHP2p~gOcl7Pt~ zyY$bKFg4CUVZ&>2ydKAk%%y4BSK^4zE+Tj-j+f&|Y^%U(YM)OzO$e`YHKoe#Z^Y4e zpa1^O9PxC%3J?M@jn9nZ?Kl?3@p&Axn67cWAIJPSe(Rf`9mhNYa~SG4<_c~(r2?B+ zTJ+1mCmP~H(}FlY8(kS?p@ z_$iJb;`os#$^Ni)rF0~qsnv0;iStX;p{cdfeVy20)BiQaAvVPEYaAOA_%(rzoHa8! zf!+!H9>*VChy)S|w4G73DUR)N?4X}<{1wOMIR0kJ#WC#u>_2h*8^;#Gx&3~3DgVXM zf4@I&zyIofpPX%6i2eRAf_KKTD~?JDAc2{m7VVCQ@>m>u1nd>LPvm})2Sk!{P{5%$ z4##ms@YR3&@h2U0wM+d0Y7YNkdG!%yr}rizq48bu>>C=TTpqbR*rJ>e?@u%K?3I` zU?h-CpxFW6OyKbYezOFu1TH?{+jJ}eS8&gx`6dE9ktvalMc#3Me-Q){2q>E;@TQ$h zC(t5+q69KhZJR(=z^ns)8+s);mq0!NYDyAlEgE)gnLw)qzB=G4AJLq@i6cV^Bfy)!PB!O<^Cvd5BCt>mc3&9l$Tq#DbO5oG+IcjL? zu{-mBNNbzNa@QnqOM-tslV!P9z;z<87kNVhHwx$}@+OftizL5S0>hRU5zr20p9F48 z;H3m!PT=+g`X=yD0uLw9FTua$#a#*9oxmLl3`k&bg1<6WJTQSl933UQ_GCscDjK^# zed+3=VFNNfqQ!U8?bp&hD;5t)U}yrP61X=3a`-}iSOOjQ7Y$EfL;_=`w-_mM$c?#s z1W+@vXa2qf?oZ%Bc1fT~CO6>m?7|nb4<>BU;J>^4icwXk(1)2LU z&pw^Neb1CUBa$n47@71iodGB=DY)KVzU0cwg{*kqbnAAo4?zH1d&v zk41jM>=LkbN`_6J^FVkww~SkWe+8Dn_p6H*iTqL|tBVs@B6z9D8_# zH6*Wmpr9|>$?oD=wm z$u>N#uB-T`fWH#BF33=`S*oMfrvDYNjjNf!e}dV%MZnes&OD!Hm1Rc)`*~)Hey7M? zB6o}2lfYg9`$Uq@PeTq0K9s;=rs&2dR31ryh4?5fe;Ar2e&CRQB7u_$>~^uo#i;~N zC(zZ##Wv0)aF)ki5;rArE`f47E;ew9f$};k==fU4H##cnsHCH#j!t@*qRkb36F&!`cm^XAJ1;lkE zbhJF|>r&m&KYztx-_&90XrZG>hpofW(M-qcAMz}&4o^o)$Kb<0s}m3Vjde89(NxDX zeMv+*hX>HKEq`8hXojL5kurgczh@a7s)zMamucKH;PDd*pt#z13{5;(d zBPB9c*H-z;J9Fn92}kL5#BZbH#Up;Hj{A@J$HteimHI$Bw$pLGj`MWTKJ^Qa`0I}N z?R9j}aejgD(|Tp|Nq zs$>2S`EDY+>)>P$9Pz2SOvmLquF!F%jvhL$7Kb_6tGGbDOIR2RGU+OP=IGbyxL(Jt zI(qB4L6*Cxj+=Dc$hAHiPLQ0Nb@Y;fZlSVOuK7{^c3z&|(*Iw^mypv($L%`$>bQ;a za1k|Z>L(E+KCvdp$7cG*tQeqU5cA}Y{6MHI)*Sf zI>zgGRL3wK!*x8UW3-MDI!5ZaSI2!^olzzC=;(9QA0?^P`KZrSWU{f`uj8Sk{sWxy z-1Jp_O2{N_43#<_(XsTXPtLpe=1cN4LfS+fPwRMA$8&UScKX+Tc@Ff9j7~gB$7Is{eRc^hKWB%pGdCI?F4RF~xWSM4 z)GX5RB|Ve~leSm_xI|WptsC0qhaU5n>G(>f$tB?E?E9^b?|6V1Xkg%b9m{o;WZ zV>4H?X(`G7a6caR|7Ns*%d^VzuNe8SAUEf?>DaDgw~jrc*&%YL$lsfk?h?RWw;%T( zIqvVJKV0HJ!{MeM_j@)iT|`fg`v-L#)p3mL!V|k&$;spXVI4;VH#p(1A6jx;@EIK> zpU`nqs;8LqC;Zc_9`{?E@bA2>gp&BIj&s6%d~c4*3I-|~sBWN!fi5TfN(L$$c;SS9 zT*<)TuY&sbpYU0&VxX$%s~MOup@f>>T)(D)Su65&47`8BuO+y)$ZuEVsjn;gdLmby z@X2Xtppk(h0~rGm1BwBi!=3b11NV)~#|_-xzhu$lnWzCuO=Qf#zNT4LHx4UF7}$Bj z=ii7K(kp4eG+-I94Ky~;#DHVKHE_d8-!u3lYZ>RH-|?hRu&hc+$^hlalRgbLHPFmJ za{~`e%Fyzplm6V3KHW$gSb5TKVSv@`C;hB}VgnsH)@eUyAaB4o5Ev*i(9%E~1EmI9 z8DJb*8%Uh;U$0hDL1dd#K0#Xp*PQZ4oC*WQh@EGk9qpg;J4gWe=EnI3+6$g?%3t z+{{2-lC*1rHM1V8M49c<#;|33QKxcD_5e_wKMd%)oGZ zxFtgeUa65I7-3+fXo%14&E3mM85qOG6>Ik!Sbk^jL9zLO0UCLCK#p#VHb4s;f|`d7 zu;U}rI#w|C<7BdAk}$!*V+K|mSYzOE15X%u$G~g@Pa1g2z$*r(8JK9`X#-QaM+_uS z`_CAdWMHy^XE_lW{pPZX(B|_7ricUQpY~~=bEJIH0DXH|9C%4ar-wAPp=Sk7|5XF8 ziH9={yl&tPA-rXPP17ZYZ*si`=MFE-Q!*5kGbDyRZq2_fmS>3@_w2}Y>5!d6je)NX ze8X%vFwelp%od5*dj>ub@VUNY5!rSZ3fW8L0KXaFl0H`%E^1Z@G3n z@C~rnchd2D@npei{|5s@u+4z|RK$HSnK- zUzpVf{uU#@GXD+yVPKPZ{+q=1cWGL~Dfi2970w%y`_sT*q702oKsJkS9PuB~6VzFj zWz!a^ZZoh|e4~?8Za1()^qeoNJ9(t^3!OamXOo`>=JxWSn2e<8Ez}$I%R;pxSQ%H!=r;CWp`>CB@s&^o4mK_&pXBaIT*}dtxKe1BC2_d`4#d7Z zr3pwQAcvqw5?9L#UX#T20vPaX1zabR(Wd5xByKEgrT*q5dL{9?i8oB#lEke^?4grM z^iHBr5(|>}Ac@-~hX*AwIEmYn=$k~pBLW#GOf?oVPw5+jqiN0g&PvXu`2_X_6a z$OizH2a@6Qz=KKfTIZ$N{!Dn?Ka|A7NsLe8QBLZNKQ@U+k{Flde;;kZF3YNwj6UPv zRkei72}wN0bxh(3nmz5`F)UQ_uh-|*%{-aJ3unSxnE0tADEXN2OcKvh&prESo@M*F z>~l#>N@8-EW@-}8m*FV__`pEsv$cu|UKGtsN%Yi1;St2*G^3`67uw{>;%C;xA=(lh67~q;;vtWgQ^C8J+c4(848cmJ6g3rqZT!?*1?B|v-(a*#IE^ZR7Otdy}h=)Iq$0W*`IFiKC zB#tF`j>LSp>jd=qjaCTB`1uFgSHfSk9Iy%bTcR z!Z49EQPD&t6Aer>GyxNpP1H6~$3ztqRZY}1QOiU%6BmrjPo9wFvwC&GHAI${52&wo zEPvOw;%mzXoZ8*xgSsZ_nfT;*{>kzIAKmMlm{UGrA*Ydvh>5uLRZOTRG!roseU9hZ zH)@8#DL~5BRCYCaP2gG+*O|D)L^l&x3BS9EO9fnE z;xZFYR0u9-xGDrQD+KJtD&>`;Sths#$wIqEdKJjzTyNqA6Stb^ZQ@1~J-HkvdYK@N z)@~AV!Qd?>=oLG%`iD5#M~1#lm?U%1+sk}ll@B)kO$;aDOpG#dw}~MphME{=Vx)=+*#svK#prnUf=*cFY zH}NWStWq$=#8eY6n|Q^<3)EK%UNrHN3C@fBxs}4{urGU2GfhlU!xCSRrM1^g{8uSp zG^U$))5NzHzO(R_i5bjc3mFSDO}uU5OB0Jt%rfzgiFqd8<0cxKo6R#M=I{5jEo^^| ziFc(sSLE4B0h@*o$-U3b%N>DWzKI3gL?%uS&3z>DLlg2BWHU!0OQvIciSGT#8$_Ic@Tnmr=(;T?=Q0 zQ^i763+GIfvryhb1q-l3KZjqKsc4~+1%iVET2Zo`Mo`%bUFC?3gHk!DW`VMX$m&+; z1FI}GMN>;;ZISF%&q93*2@AS~1{NAxh+5EOxJDKtq*>rJIl5|r_PHY2i%Pgs#4!tT z4*gxWTjelfxyk{Tm2Maok`@|UXkx*%U|Dc1xE5>z-ETB9N4L3%WOA`+$D@-H)szJq zA#Q4g!E9!Q2|)WCrMcj=g+UjUv=IFF$Xw`*g<=c$S-78lE#xg+Vc|*(B^Fv*Xm6o| zg*z$-tt_;$P-@|k%0X)jcdaejHzYr!a?sX7VBtLB_!bsd4t}c~@O`j$!aSdDNR_=# zR}P+7TXcbit`;t~(9uFC3!TMOyO%0lDB$jOd6q5~C@&H@a9`_7EOe9B%Pb7}ps2fr zO9im0)`P5EBZ+mCR=z;FwK&~Ue8-tTP2uM zW|o@0Re~2SykudTg;y=SEc{n2)T|mhL*wKW@M{)cxA2A#sG%K7wvzT1lgh#e7Cz+p z&+TJjj)iwE%#z{WDf8j>At8CTRMS<1xdPs^@VUAen=|~J z?vRDU7LJj?Jzg!~xJN7;xwFS3G-iZ&_q< zVm{;5vEkbAY}B<;&qjS44eanP)@?Mj(a1*BhGrvTL$SjXUKPn3ka+%06<7#jqKw-} zkUT6$a-kGj4KbJ$Y1*)a!$X^+*rIf76sjp3jcv5D(V7-E7B{i^!`4M<8%^ynG96AA zH4}Yvsg56!Yhk0v#_VcA#zxLY-bPlc)D+YC;W+}95*saT4E;AdXjqPR2%?VPMh5k5 z1U5)q;!4#wEVQMmG-U;5-N2ZCq;OcbmVRfy-=MZsT$XsjVIvZ!J1=outh*l47q=o7M%hxYuZn80? zdT_JIUN&yAajT8qHu~As+g1c1>wO zBW?23kF;@*jZrr4wef_FCvDtk<9-{D*ceB?jR$Se)I&B#+vrgv7-M5@jbLPrU~-Ls z`c*Z8hnWC2w$})nmF8I`XFQiF$WIVS&Z7b<*9;!B@whOZngNZpuNgdLW1@|zHeRst zw2f!zn~ljfZm1bNYvVZ^^J)geY6j2L3~HC=Y4dq8m9N`oig>lMX6QrH)5R~^c*(}A zHsZB{mxVJ;yk(bHq`IwUP_b6<)GwJgO7pLY52dw&={CQ;7Ow2aBHt1@m%Gx&Ol~3@ z2gl@Q+n8fxmf-7Z1@CZ`YXy^=l~%bwH>y_fE<;x?MKeRF5 z#sV8n78dotB2VQ9v|lSA_=qchMV=fsePZKNo8KA6LL1-N_}<3nHoma2*v1kYYib3H z7~U1>FS(meqz~2#s8O2cm)cln<7*q=@Jy)I;wv#&Xl0e)TOJ@2a&)qwTrSo1Hh$(U zVB-fHKiXJH%U9&r*jUBZ+QCmeRhs5=wS&uQ2df3MI=FVQR%q))vWZ%ta66H`(};r=irz+1O%ZtKe;1DH}U%v};!SeeGbUgyL9}{4N1oY6rW8MjzqkRhEXRtZsUZFlQvFq^V&FPU`l^s-Z!1qkP8K39dCj4-d zZv$3!P|e|Qng_3Hxf|;QH5~l1aBz1SAV~Y}f)E2d;y{9TD1R z_R4LN5^IeeG%0Ik6A8^7q#fiPOuD&33kQ5aN~aga?sjA8*=Idr4D=togT`ymFmCEO53a1H{Z@u)6T*94&HDv z-9>u`9UT1UV2gtb9CUOr%)xMWlyK4JWo-5HogG~0po@cp&5AFQrmmEAg0UxyE_QH< z6Q1E?ZVP?rCav8aTv}#fO`YI!2Uj?_(!o^@ZgX(EgB}j9c5tJEo(`^YaIF&_us1lk z&Iu3gN5*BYXH2RG#JlQ*)hcyEY1IvGa&W7I-VSbd(2H}d8{FdX$AZIFT41#R`ZypM zQ8#F~IoH=gKL>*y-07gd=xKQX2dW#~;qZ56gH?5dfdY2b4F);E)Cq3~yIyd9yxeZ|2v@qrF=L^|`D=!rRt=?>m> z@R5U$9lYg$#^*SA*TD>KWNr!vvm7wUv$Kj3oAbuf?n z!odOu?=kFtetG@ieet$%$~nCOspVk5g98o@J2=8!UuOT1*q_`mnBOqq1He&n=@^}F7(QJT9t^fN3{E;YC2=?_ z9Zw7GjDvEG!e<+;QRp6{bWS+s+%RJ0UH-Uv8-hwM;G(*V8ZIik;WJWIH=Hj+QN;xV z*rriX&E43k_-%)D#P~UDR^%M5FNGgwIrUT-0^L2Q5DHFjg}g1r1y@bdhq= z*hM235f=#;x(h|RM=4#XZn$3TPJT>Ak27>N!r5`r>Gsk_f#D)4mK_(S8wT7G4>vUm zcvRYg>F~)$;Uk>u!V@wv=iY=!-c7ikwQTok#;h%;f78itQ*8wnKB5ySTy)-{!iG#$8`@JmGTCt~k$~lT7dLRFHWpLK)}CUMW^WRkH%paw=&de#yLgVSy6EHLHWv@Lc+kb|F8aC{ z?BY%r{ao;(?C*jvbLb~u&fMW*0PXyn9Vp81m6TKo_`2pU7k9fD=3=;uA=JA#v^3PS zJKr_s{YyaR2p9Lb7$qG?imOzz-0R~0GHdqW()yB%mj%4y;xz&6GEL_Astdj(WR>N0 zY5FS?yy@aC9xpCFl|yERi#aadburV$+b(7?P&+cS-S8VD@BNd0N2>gq1iv@JFOAG~ zG0(+&E{@xwhF?nQ+$+Pck-YC>zKaDeK5)bDP=((CbMarl@H;0Ti3MU3KISTyYcY3u z(Pu6ey4WlZ%NHa0`c#Cb0l!|4K99lvC##;QMSp&pDw@Dhu_`s+arJQ zpeXyU2)`o2FHZc$dC8YF_`M5$`{Hkz??3dgU+!PV$Hf-G+uiWnBU?qXX`3kd<&Yhs z*(q|DNGi$P>tY{E6YOVkalpm2#(1?cKi|h89=R!8k-}l_S+1sscRU<*ag1k+$M?8# z+{FnO^}O(YIms{o^Fr}Z$-`+EXSj>eqP&OCHmA?JDCZ$usmJGIPL z@Io5P#vvu}kbNgt*+Uf%>)W&;uIizhSg0*c)jibYSWjffU6`-o;iujCk@@1+F3i`W zGexC0y_T!vA*lp)J@maW&sJKf@1cQ*h8`Mua6GskA|4bEhR6Sa8mJzk9ugkzDb8yi zVjkii|B-J%-`Xj`O-j(ER_@VvbFAtf|5uMuWA{U{$KL z)I(bjyHlmrwP5A(*0vU$=b@d4r#wvbaK4B39{SM}4;?&Q;NfZy*LdjYp_7NpJY4Rf zvxf_5-@_$r-Cfkh!$lstdf56^zM~dYo0B`Yy69#tV6~eNx_h{k>(w%^>@K=T3!c-0 z-{!;f09MGJ^~aFq5X>~gJ#>pb-GaEpiQnF$_l5}P;5 za2%qibT1bRha0-P=w{IyQl*_+J@oN#n{?^zfkV?KnYS|mgh@A;S_S1D9tL z13e7#Fp?|iVX%igJq+JPR#w3d1}M_b@_6Su!`A5xrs) z@hDN==iz=2_j+I#j>wrl;Nd|Jqb0-h9ZIO5J~PJ{_B!60F?`s=SPv6CJm&HL-UN?$ z7$=iua5$0i9v-DjyNi0n0+Kn(BW zr)%-c9wrGOe!;_J56^p;;^E}3qNyHcHO+BLZdqM)XDlG$McJVrwamZdq2kwJv|sTs z&BLo6Ui0v#haDH@UKeX`2(C6GO){0!rCOnD{w--;-Yv_%Gd*nDRrI#V*XC3pp6y|d zhh0og5AVu}!9!yu2lX(I5%BOn^WVc_kN?LenD5~u41k=diY%OiVO6aM2{=@RxF5I-sTGri)8fuUMYjd5G{@cOFS&~uv{X%%)?h6zV+~( zhp#1tzLAyMyQlSrSa7T??Ckr!BnB-r<|{n>z>GcKnrrl<*onl$oL|M`NaC>C!=E1h z^03CkS`X`JziaW&Uig=2jM#e4PQWib*=D3$#e)qVel1(0jRJlX`MbzJL~iosY3I{wKXANkL)RUDQBi!xY>Z=|-t=E76Xc zLNo;$0jNrBFApqAnW@5j~xT8Si|P2{&t!B63W6gs95q{4f!T?*%?a9#?$ zAIG*Y;YG<&+H*K@hW~JYz1Z|!Jm@5v3sdMKV|Av5qEedWKy>3Gk*prNW6oIU+&ZYimpdV`=&-m{bXk-iS=rga{@^Fg1c{5q!x7zlzX5@M044yCni@C@okm;!I() zdx>Cr1T$zwMeub5Gb5PAZBav&wp4H=g2fRmiC}L8`)EKSSQf#W2!4oQIb9tu+!Yb5jNlvQoh1TtRz*N_mr^qL zE`rq&e9Lomy+k;J8A=Arvn0N!HCZyCDgH5nwGnKOU`GV&B3MsdiePI58zT5Af=x6y zw0KGeeM$xsN(LLb2?BCn&F`%)8LZu45^v*`aG+#Btsj_a?WBduF}oRd@oA+ zN%$**JGB2ta5sX-5j=_D9-U?c42{|OR8m;vmk_z z6qi2n&Mk$Xgs)5q_N4^*B;=P+Si<>B=IxZAfP{h)3Q3?!o@s98(m}3^PMOj{<h0TlTe=fP+CG631yk7t%;@SmWF_UDvU^UUtGwN zMBnCzWAbn5AYYk4k)TR2C0G(Ps&kN|OE9=66ii3FOxT&yDK?$On`HuB-E2oUqVF*l_b0>p@xJe-@270ROOMW!lh_%D88D6>SVG{ z$pvM?o)0e*)Rgd=gxV77&`@)Ho&IhuDf|MC0;u!!cYe;)Xt!=>EfioO2Can(j?ygZ5Im z=6i7~9VB#=uxP0BiGNY>`lHm9v$#Y$W(+ zowh^5PTE*xV95Ia-7gZc4Z%;Q|e5 zSLas=mnB?ezQjr&fs%iPnc%vFtIXGglf4XXNFb$e4=Lcbgx@&pFA2Xh{3#;;;4q4z zNQ%G1epE+JtxR4Ba4izGP23YF5@LRY??ldrK5Qyp!;g* zlh4oj7TH`fa?2d1J5tEx)_J~Vv2pkN9+lOsW!Sat~wWR#w)y(QyK8MHOg=0-~U3GJV6 z%V;d4rHuDwyd$HDjOH@lqptFv{H~0qa`-CKj5|YnQOQ(~l2nj-PJ34iYQ0=oRVx{- zWwe#iPR0i^+Q|5b3d;CU4&Sa&k$EFLdeKi~+Pdjgn07xp)An-s;@g4dG-sGhGds!X zEMvZm@oH)pno}90WsH&0O-6SapUM~@qlb*1GWyD(QoXp9-ZJ`dKWT!fZ{+(8y;YH* zAIDI#KLd4UAWfN!VKRox7%XE57ynEKo!3yVfhK}@PbA!*iAT`#knsgIH^`ylBPk{& zpgn&S56+E9I4_XGSGut>#>to^V>WeO#snEtWlWPXQO1`tzLGJS>(81JOybVa>nU}N zs-jl`f+;d0QV7#&viQ}1Cc_Moq|VT)_?lMH=jL3V?m05ua2~!`)6~zC>HffA#2kxa z7I1Du-CZbSk&MOE0VQ>bjHPrIO6rSNW>qQhMmo);;2Rk$WNeYKRmMs={M34tjMZ}Z zl>za$bfvszZIJPkjPK~el(9y}4>H!tDBjEYkzR>XDp0^$Is7M3`qqFxQKt{I>0|u$ zROg4`mj$F7Ay0y5~| zW9jpA`uS`6=zgz^LtO1X8T(}%psVsD=OA^PKhGyk1FH5ghaF)(D&s}lu&onv_q)v`Y3g6N^jGJdG1_SvXJnj}@w1FyWL%=l|DHyE{hHPt**h10EbpC{ae;yOqKrp5 zZ32qLShIqGVj%3`V^(h5(kV65#ao8U+erG5? zFPTg_{^Vra)z;s%LTDmXEMINhlX0I$DT+N&Jdp8FMyn`VNAVBs9v>U=DEuh?r7p>M z%udNDN=5NR##0&3WIU(sI*J_8F!%)rWMWRon#7vSnw~WSE27BA(B!&F1xshPGIKHu zYgX25QF>x{SS=l$>n4-tjG~Zmaz&9_aGoggMv;$``B@7_QGg-wx%a=~1cjq0B1#oy zC>BL=h7!W32bxo4N)#qLrK2blMOo%3YdO~PtP~lELSmMMlc<}l2v(!em~~b|_|v3- z%37SXS)C|ck?S$UqFC^UPhp8DQrT%9#miAth@yTJ4cG~ys1ZfYC@Mx#DT>N$(s)uS zI;uobm7OrjP(6xQ7+z(KP14dL>E|(DW9N0&TC9{+JBm7j-(aX4MLpqALvIRh8pT_J z8%EJc@Y@WHS>K7G3B$W0x9M`L8FSizyvN)^sn@toB*iY`%fjiQ~Xp*=%~C^|BH!rDpXc4naYqBHFlMc*j;MbTa4_F(84MK6Zl ztbIi894WOyHnTq`2S@QK%}6$rjsZ~&6g()3by7g)kSK<7-h0!sU&1tODS!b}$ zWStd7z(eshFRD3F%#C7R6!W84!2t_cm#|W83mFzg>5GQ{uG6%Iv6Pd`qF65cZ$uwf zMzJc2)lq!QSzDv{E{gA?*vQE>QT!0aPomV1G=K-J$;&2p4 zqWCjPKN^FhQ5=in*C;MWaeHXG<58T9;uOv7LG45oLw0GWe=umrJ{`ryC@w{DCK|pv z&~cXGXVza>&#|75;sOK3d^;lD@y*t~?CucT`g*H4%)$E5+knYRw{Ts!N)ApmE%|}sWJ7cGB z<~*euqR68luY%`Myoe%;f~*S0oiNiWfP#z)=B(0^6eKH1y``mR&A>{@50dpvN;oEK zWG^#Ams{EiDY&u9$)@0iW@T6Kl7brVB*ojAITYkn=q3t1w}Q?)v|I`zW3?}uTX!XT zcW#kS4dqjiU!hxzQBFYt1;XbQD$SznRQ5E~cP3 z`z2UQvX){^VJ*!{!DVQ9JPnIex63O~6sQVP7Hbg&k^)%?zsrj%IQPI9chNZal1@o_ za=NBKS70dke4Cw94(K6JrUH7vI(>mfY$>o65IC$ZtH&B+rL4GuXL)UcR0S_9XsqBJ z1r-zo3SL)GOF>12ZUDypwZ>}-Dl4d>pt^!r6jW7EjmP#=KYV!ctF4_(H?_aEhVLa_ zWxu9^VkgZS3eL|mS8O+T+@K$mO#b(Yxod@1TR|NfJq2$m^zX*dvnT2)sIQ<*t)#jN zekmV5`>X+1LXe}Py~YV2)Y!a<)lk9D741gUdXc2GN4UPtVTK$uQSh#U&lC((&{RP) zIzbvV1$lQvG$!b?NPoc4_?;e5!zejsXk<6%1k+%sNEm4yAK^#iFp` z3PvcHq~I%B8wy4$^e#HQB95i=Mky${#@O1m!WZm}W~Hn#3dS;zV;#>rLF7)PYb{ea zxpe%{Ieb9XWCha|%up~z!Bh@QzHCjSW%IE`&tn>}P}_Pb-ApEBHylMg<#aD}dRpO@+DpG+MEncnxn+K)jiCCUL=e;e!YdDOhGOJ*9viTiJiK*0z^Lo4{GRC=~od9iwZ9 zwg?4x6#PxS;xW0Q;HH8L3NBJ-j%w#Gn|JfrmlXUeX7)0}6$MuruCZPhxec!+-D3Vt z!S4*WX_QJ^Bjn%@+Cq~PrLSv$D#)GPe6yDImjX)CQM0#pSHV5nH>PS2xYT`Gb^F3) zv#NwiWgjXSJx8N@$a$pTF>P@wqH4HAi;qb6M8Q+qmuT~+iEd;TQ1L=R|J~XTL)>&K z=trLE{|k~-B&$fTB7=&Ti1&sI3|vDN6&V@G$)qB);0qqN1dVQYwmym|_gYRg_?OFI`w9MdX%a zD9u_%MOoo@S(j9vIl?Llze4^bMX;_yW!6;WI;qhyc&zryLeo$|O0C!`92J993|8T) z@Kn@NQCme!MO;O73RB^$*n2#Es*0CYB)B%Z&0t+hSiFLYN-FX{(pn630~Hljygf&w zqeKCd%*raNaBfxBYOM6}1!Ym$S5>@D&d=#oCi-cr$!p^=Jr8Qx}X z%=!*1wcaEx>vOFsLo?RqB6sPiq;~I`y$abaRnSw_=-4d>tyOw{0XnJZtfGyI4>@?( zKI0=5S?ib`RNS^qf{!`bRz*7oa@x~4oG=JFatwui!qDVW_ztbclB6ywx~k}=qC1sp z=MJFNtD>ihUNi;Y8+1?yNFQ$rxi_1ARPC;N-YPgT0f*`zRfsN6sm%6N@n zh>D>qmU4$bQ!z}%Bo$w&7_MT3ijgWtso1r{`dkek6{kuz@!@0E7b-@p^dS{iUo*$3 zn0d#j(9s&FVk|Qyr;O3ax!J**poS0Eo5=bl>&mXye%YL?Vv35nD(0z}s?tA0nW_6T z&`v&$Ms=Y^$8;4l1kY44OGT6Z)@;_VSt&V(7RE-6V7`h4bO|rh7E@KX+;i#lg=+ZB zJ~|eu=)b}s=-p3Sq9XN*)op~kj6PdX@r{ZVDpv8ipHGDU5JbmHl|H@**1Z#6Xvxvw zTbkBW8Xe!M_?|g7I86SiVlDNmF=jW$Iu+|xbg74~^{_$3Pt>A`Pfcu8v59)9W zDz>ONpy8l~ttz&uD5IgQhV9g06_02^&e3<$P^-AA;+l%xbnZpn11b)x*rQ_SE_*NQ zKK3bVKV9!7-1EEaLn{4RuX{|zaTSMEWZz>SQIQf2jxtw@2E->+oK*1(`={7H!=)(r zG%c`9F2Pw9KQmK2m3liGoKtaL#RU}?Rs5=API31VUDRA5X~h{j>1Fn>uu=f^gt~NH z#cwKpSFy2(dqc%d2J&w)+*VPnSQz&GCi@Q>)lK#TIw=)@(FVT9zN6wE1M%M~?h0O7 z)V|+(vVq0dM%91$eMwblF&eBM?j6%+^P{|(dZFWZdTU#UOO8D`DEr`&dr*WmCRfW zR7oBUd6~({Cvx*^D8O8hwGeAzk$ZPgaxsk_o#vL(=%HY4aaMv73?*4V+-sAQ!dzMd zndFqyP+mh94PCWxIYl&7)=))*q(LV0fF0FfX|OdY^g^fM?E|)^!C;_VT|=IOHo>V} z$tK5BfTO|HP(eeW!P5}a5ZB;qpcu+c3r=tiX-=vr__8o7YM|OGu~Lz=FmkGDsHUM2 zg=wg+q5mQKbq%#NyrSV%PS()q?iaVFh8{`o)IQ0tu}NXyCb_jW)Zt_Uj(I~vJx)@5 zU5%ce;8GEatgq3h69Ms?8s6f7hOG11e0{&&Si?IST5I?~LlYV_js9>B-q+An!-i&Z320Z~3xMWTZ9rG_aQrfQg^q4<8Aj;}OKrX{BYluOBJ>=Vz_ zFr9gZh@_ZV8fJ5nihM163ZAE7zJ@g#e$cQ$!$J+;XjnlDUI`YlF4eG@VF_IhNxk+ot)q;N@;V|q zsKT=3_emxw$H}qWN}3~a*0vW8B^A!4FinTsCt1~TQVA%j>(KioQ`5wj4qJz>BcX#z zITWeGW2Tsx4yrt^gHC}Cil@mUP34+j)=`10qJjZC6rUDGT3JUG9UXOiqNA#gYC0P0 zc!!2v$16JO>ZnKk*=N71<24!_ilrVgiqv-7#L{JC@Pxl>CAaUC6RFx2MwwA^pM zcL{z|g8Didu-{O}pj-Bv%x~$Kz`0Z#HPMJGCwN;&IyIoICOY2L(OSm`9N$#OdpcU^ zXeOFyu7f&2MW~gQI^NeoO0`iFq^+2#o;Er@)X`Q)J1+PU>&M(W6{NN(zCCxIs_LMF zI!vVsvENBYXC1?I4A;>`M^_zvb@bEGO-FYfy>#@Z6_V`sVC_i_9kMA&hoT0geb|4T zE18mS9J2fC_*BPW9Yb^s;H*Kc6giOE?UVe!fybDZT8ueq+^YaAK0PJ{HSBCh@4Q&-Js(qot`!6{;XpoP0(I@n~v?YV-$5a z(GW3gVWq6C96;~%cF+*%IHcpSj$Jx->)5a3ZgH0mWk~WK=DoD}lyLVk6Od2G0UAu< zQ1B5QM|B+6aY6^>9%CgxE&imAQ#wx5Rmr8&YDm+xw$AFf^ovIP3oUipm*`!(j*AQz zbaWb=Oir3!((x<%19sa@O1M{bT%&O?u+G4B9XIGwGSJk(O&zyrmorevz-?M`I_~Ru zprih7o8Cpg*lYhz8(K8@gJw;~U$k|UaPQFRFcAOEKmormcJI+LRs%90>iCB?WCPg@ z{Hx;;4R|p(y@AI%p6GbNNpha*c&6hyCvO*XM-EOVla4b*-E;<$3{U`>$wpY5=8A)|rJ44I6udvv5Voy7?IK*>33kevf^8F@sxB@NIY zS=4lC1Eq}cZ!tPj7-;pDF;Lb3{mE92d$Qg4s6}dmV(4!=$$)Gi%FQW!M)c?2!HjNr zBE?l@);pcF~{q%);4X-G8~Xl$Sn2h-G0?mIj$X$~cu z@C;IsW(JxY7;4}%1MeAVVbEWTK}juWNh4{Xn?XNWiB<+$8|Y}@69XR@Xk(zAf%XPI zH1Lsuwg&2FaX&WjPrqc+4q03;i%XiNe{$h0E}4|u!2l)6Cx@~+8R$YC;NZ@*4*MsQ znVSQMDW->ko(B3G_|!lznw>0e9|L_2^k$|c)z;4dHAg@N(;6LMU?9yJ`-8Yw8r11f| z01Z6Jl{jSJn1SQWhYcKISfd3;$t>(rzzG8<4V)OCo1J`KhH*kZtRy`=J2dW-aBC*1 zfJ=vDqGbWMyoq83+z6ZH3cIq2s0qb{YC>mIb-$Vlwl}%JJ@w$mxCaRjK zW}=1(8n+Dv-0CJsUokO$U@`$6ud+kuNLa>3}n8;&{!m!a3qZhWi@5987q~d@p(^h3x;(A zlUtc+Z6aqOx08tvOtdl4fou5C#HvDWTN4!uy96JZ_?Vry3x>&d%gAR_cz2=D*=}M7J9N!ba+itSCia-vYvN~`nu6{=6Z=gZHgUwn z0d~kd#Bh-H&B87@XZ7GH4U~y9Y*JOnO`Kq+GoqN2%oKTw;WRf&$*?SsHf>G6m^f$R zyon1ObKS&66PHX}<>ardmsx3FDqqOG!b~+}J7iyDzM}_}ykX)dUEu88=7!R`N=;C~ zKTP~dSB;A{F8(rchZdWSc{cv0?bpOg3#%;LGjX5h!a@fN4@^8XQQkttg8$t7hqh}I zPw9%F)w{-cWQJe);ZXuV2+*TNtWFe!4Ocs(knVvNR zD_CFR8Zt9yXU)P&WwTny#@xGF_$3h?FImXJPEOX8z5n@nEEKd*h|Rnf@-a|+eue_n znf&3mPK7NLv5+Eii!zj8EoPy(@Y`=oD#=`m^}*x+?m{VTp$t1^S7C3u*N< z6@D`d&6(d5P73$reNKMJ+KRQcg%23ouu^a5mk4iq`N+b@?6hTVCvsmlf{qqGu`txa zXBIkH=xkxIg&`J>&$ha7SRYzBkBzRZ-7Iux=)u~Pm2!Jo=q>nd?pt3j+mE$B>!%h5 zFbrfJ#7cep;uUxHT%CZ9?nW@o!f*=1;RmNhfZOUg~fa>#7itJ6}-&Ca>3tNSRvSXY^=8Mt%b}sve@{}!uPZbS-5Xu zjfEd9{A%GcHDRGmXX_ZZwbsHq3+pXxu&~R*ZZ?0iu$5sW>n7ICtXo*=6xxr{wh7*D zVF&Y0;oN=S*(3O%g}s9JS=i5fKsZY)B@QtkWX&kq3f|Dm%f3a|i;Xq60 zG{YGSXBmEGrM|7=Rdmk6dEs1OxX60R0(G9ku2^XHyZvXK#BUa^a@I8wf8D|j!8aLh zS#%>rxFOJCmUDg={D*}#)wvmY(XNqppp5?9^v%!1^XD zR1~?+4-FHGuC0O z!&yhL&hx^ajAULoLK|h{3+B!<+W3-TlE^*s)R-*FPO&l7 z#xzb&XPw15!^TX86Su>6JF}SyzP2$(aKD=7d>adFyyoC_2McX1vT@$V1sjWPEU|IS z#&H`0U^R^e=8*ly#+`0(A}PFlcple3N8 zHuiAVK@qvv#y;l#tOr=zJ^$~0;2};PwsC~vC~ISpd*ZQq!p5ax+DZ0Lv7Tn7M$a&u zW&PR4FAV2I?)rh+MJj8fu!ABFezkGg#$y{#Y+SK%m6Fx%do)%x&1=NDoZp$R+ql6% z{!NBktha6aCj9o3O^W}6Oa00EmyJ6Nf3x0YrI=-Yc#rFS?$QGr4@KYpvGFhSBi1ej z|GQqE(iZLD#SH5i?Ts|HB0htIbPoRsz?#fTHK(WZQo^!ukde(y4ze<2X3fI7{9qW9 zjhP_36Rs`-I&wJ3$$l;exf${}D8P_c#OHI6UohR(Or;8PvJeey`Ed4&Iw~B?LC8+M;6~V7E)NoK!I1h5^wH(xTu*bn(2X!30;b5$TaSrNoogEx>WT@w$ zzJmr1-gNMmgXRwX?SqD*4^13268ttpW7c;Zc+0|Gy(@B?I%p=i;pn6mf ztsJx#PNJ>Z#=(aUJ`zq_2OkSQJv^x$b9>&E`Z0a~#Zd@TG%E4!#nlW-v^4 zFhw|18KyayE}Y9bteJvmG0bND+QE~0VO#S!xm3i=XIQ|xkadxR#SBYWsYuY!T*kay zINvx}!Msv96-Fmn_snlOxy8YE4!&nz!@AzV4{4FCYgyN^w(c4BY6J66td!j7U=#CZ z;gtNt`mTz-m1?eHZ*#Dnfp~|5oq~5U>~?UzXBfQC!F~sYToiV3z`;QWk7#lo9O639 zJGkKBu!AF%Ti#77a)2Pj>zi{@X?>nRgvL zVCNp|ebz2l!}y2H|FHhcN~S->eBz+hFmv~0Et`v{4xVw=a|an*&_mrQ<^?-+;}6}H zMoBu7U8EO$BA1?#Ije9oF=Td;g<(&fuys04J_=uUv%7f7MGnr&=^~#fm5U)aYaSPQ zgFv%tbjD7ta26ycO+=wt?E z7|ODyUCR;rzkE)<%qqK}=dPJ9qMW3r6$X{=b!E_nA5Cx3Zw*sGjMWyttm~qlizY7K{K`rZ*#IS z>pQG>#{DJTn+$!H^CTPXbnr4B6ixn97rn%U+)cC|jPZzyhbfTf|Zgu7gyNLR`GIV3@&f3Gp zvvpx_d%Nhv&UhDnUG#G?ij$Pp-^CCYLpk{=>j2h)E(VF1!8GiT!_oMRosq&H#xUH) z2;qG0;z1&eobzMY?icKjW*sA9#xjhfi{fS&Lm$jeaKn#hC$fI&ViLnwtdm(OcM8qa zCX=Af9%H(T`7Rc4Ju_U)WSAxDpUvm1g(F6N2c9yhg4dyGC&lRolY=wcE3i$(4d z7fYF!u`Xx*M&v%&XsmLv+QnfPM_hdC;yV|+T~!(>NA%&fac8A5dxg37oVJH+ z-b?F*fd+Ozy$T3E=;9Fbn?1rYr-DaaTySyG#W5GhIqL-LFRUkBoN{rR`3!3$fAU#| zpINWB3hSZc94F7SE~=SyiQy(K?Ecy}b**1rT&9z)YteCq;VSDj7uSV9gGIbF`#BYQjPJS2H=Jh&c`J$x|5D(In*hx8sYcz_q~ z6Gahaw(S_KS+#6oz7~#XXc@D9KuimFjQ(gI3x@8BUhM=+l_nhJ=F2=hKGcQR1eiWRQGU&8+w^b zRbUNRD~ft5d8jOyer&ZWbCSiM0-4q;9*SB4P1dVan`zZxC8+7)HNmfYs3o|zhiwZi z3drFk)%DQW!#f`8iTdk%Xu$j?>szc1MQ$SxZwvOVps5w~;chhX@UDlZ9-47(D-qM& z!+U~TcxcJ|zHkbS3I9HA&B+f~+j#hp;Uf{_G;-Q`Xix3N&^U$;9y)s1>|u+CPds$; zFvi1J;<8p}54}C~p@Ds2(+`tV&0Sf$dFU=`>*1j%b1&g6e3(8y$?D6=As+fM^cT6G zG7RuAkYNz(V39l33WhR&CY)gm!##}f@VSSPocw}yl!zJgr#V{imv!869>#l^=3%-A zuW~pb6FjW7f{Fi&VVLCMD~8FeQ$+4m565{5W_Y-31@k>D@Gw*4&SIGD;cJFDtaC-~ zJP$eSa1||NXSs)OJS<{fEMk^;SSolKL+ge~D}=Mo!%Dg&J**ba8isE@e8=#;@O3-* zLGX_ZYiTp76mD^JtY>F~ho2ZWipWhKP8j!pZiAL$hWy5 zWW6Q)rYGIsJpAtA58>SN@F(+M9`1PfoB6KDZOzkK=TGB4I}e2a&_n4A2^!Bw9v*ur z97B;9o_KgldvXjpV&Mrs^N^Y0xrY}X(#4Pz1K3GsP0yOvVg_a^6-f!J&B)12RA>4y zNk^6#va*?tHM@u(dnKIuoSe)TLoVUxjvBF;h7znLS?}iwKPf8BOb}rx6GK^sa;)V=Zru`L=ZD%sGzKMx$}u#&YpAjRmZBSj zCL(nPgVkiUSZ!7(hD4ok|Cg^C9xdIgMvOHcgHKs8q;fJ~rQDZes35q^m9SJrPF9Mc zdJUJ7Rbr?bLp83Ps;x(U46ktVRn}TD)DXEfV|b1Eb>YmhgWAk>g!4uWbp>BJ9$skm zIoW{q%^2Pixea4zB={#gcqfJ?G$1jYjN#oFn#M3LhVd~pi=lZ8J!9w=Q%Z82Yi30#TsT!_`*W_Jniv_wDCRGOGn!#c3}c0J-wr0kFfoSBF>Hz9%NQob zuquYtF?_{!&W&MS43lG+!pW(uvtpRWFr9S<>r7VaUTq$(*)e=AoH;R=<-%)$j`=Yx z75)N-g{+HWSSu7(Q8I)jFWr!wg5b3996n@Q=r^e0q59r(!rA!>t%@)5?tDYz#Lkt89|u1V6{{ zE1l+;FzlBY&T-lEqJ|3$7h||2oHCcfx9gWVd4=_A4A&U0iqY>_d82%LTe=*!){X2%c4EI>?vr;8TMz{}||B2yWhDWT=SRb=K zVSO6I{T5;C&pAo(B8GJFaLs=`FZ9zbGt$SAHI8g?WMChxl$DVo6KiJHEOAWd?;o>s zGJhNe7+#7a2Sd&{a>bFGIWKD-R;n#hJ8Ujr90wM-}8=~JhsvO6dNm`{idcNv**k)Iu zWRgQa7O`@sQ=Ma8jiW{!zg^T`iQ{q>oqqGbW<2}}qu1l%&l9~y-TTpbXQ$Kmq1JY; zao~tnCyqDb=o&}2IO~)T`{okKyXxSXmhSGR0)@US$$1x&~A83uy;KwmCju~;xjAK+BU&Jv!jtM+dqiMl# zf5yZyxtu%P38*a1^0+uMopcXr_QW{8jAKgLVwF(-}%aV(^Be5lQhV?GbgJWkT0 zB6HkTxAIwSQ5=ioSV{${d*hPVS9TUU!4fLy1UXB3)cW!`zKMswZAHH;vdsy9`D#TR zE8|!d$7=S;8N1Z@R`9~P?)QAAYxu-Vo(O;AZfzXvcvbIhe|a}SksY58r5V;ctynD1(0oZYm^ z{G!p!?&Yk8)56(2-CNrq#{t?*;-Hf~M3){7_)O<;95mhUS9azU^p5g{c}(mQ#~Dtr zo{ZxZ!)cM5aytFbar{ENhmVLKZja~Uct#Tu$N4xe#Bni>OSDwt_&bhYDd_~i#qoO_ z`~NX6$B}QLb0vwLJ+WIGst=sH;3!KLc|5D`)WWMbNPw3LyXVCGKF2*hv z!HYQ3`6%F{ppPUU$vz6dV(0LY-VYy`lF>&d9~u1c(Jk~m9S|&Zy1GGTKYVUZRv+2? z@S#One9+@~=(#OT^0~QvsG(#6!KBjM=>7@-Jr0KB0hGyLCJ5N>Vut=hqU58O8H3fQNl+_KYVJ{ zWj9zcU#qg#cyZ4u&25$O>GQFm!6dD$kMk=WI?6FLD&k2#WFK$&Xy_yAL-A3;N8m&C zq51H9#C+&J3?H_S6IH$9UQptiX?C_uAEXwmueuc+*YV*}aVKPYx=P%~-9gUK`BsAN zCtslXemJL9y&%=c%iOCXue(%Xo0@J#AM58kHGI_cQOQSTA60x*_3;Xwjvua{YJ6Ta zmF?;2R6a;)cxl-4SuPC%)$^K<*L~FYu{J4D%SUY=Z}_NHGn^@Mj=hqo!$UoLg+pdt zA2dGoIG~vqH1P2zclA>*sKig>YUJZ>ADw-4@zL1FJASwUe(a+Ooq~_|e6;Y@ zqM0AQ4AJG8c1<;>S$LrJukEz-@xG4_e6*p+hgvHiTSuF%ncrD$E~ZE1OwvB2`d4W5 zgGC=vhfjpt9c>`A)wK1|j?U3X2OppK;ftMlLK{%o>F6V87n6?LC)`ecxS!J|Io%7o z`sn84Q|ja74y z_rv|O-4bVjkAXB_l(ozlLW_U9GuRKe+|ETkdW9WI>tT|1;A?GJ`owS_BYgC&j(*kg zxsQ=Frxh`?B1ZZ6g669NYE-~zA7gwpPsMww80%x4kC_R~N?^Q?2|lVNP(6W(KE9;Y z=;MNqNj|=!b?##kU4VPF$v$S$!pme$;SFahD_#537^YK;3^Q5PW8wW>vpN22Rw_7$ zVXlvP4D*G*fEM8sg8~-&SmI;5j~zai(ro4rzr0vYqrptc}(VM zz1`uv?wvkPv9rs^ZrXg9kFxIdv5#TDk3$RxSP!yN*}So^=EIykLL=}ZtdNdlK8~|_ zg7u_`Z*jmqE%*$>Ssy<${K9%pn{4Jcj4EKE87tRBQ z+PA}>dHjd@UmuS|?qh~0tWRlP`iFz?!biFU%D<%NN+2nL8dz6A0!7Z6U9=XT)) zR%S|+Pau*&5w4_Y0>u(2&P-L6PM`#HN#T@AAVqNF0^zDIlR#N^%CR257XE1_B_MM$ zHGwFD!K$!QfSQ2Dtg{Zh6P7X)uoAFEOe_J1*=6;F-yjymnSJ3T80f;GN?uN&LIObo z71^vRVk$9IPN0f#I>&-s_rf`PC4pBH=$1hD1ZpHuGl9klypzCd)S3Kd`mBli3B1l+ zi?udu9o9Ek>$28kr6Tmpt5j`+1m5Jf-V!Y~OrR0-+pHh+y@gGfn2|Rx8 zk4a!`0)rA5%+(G_;B!&`&;&kX9>zMHb%e+rg>dnYOkfl{U$Bm5-E$>eIpdfovyNva za{|M}1ilo`qy)Ya+=V|gnUcU%;Y?$gp1=%-w3=rp@O1+JB=Bzna}t=Fz)l+81m-0$ zpVn|6?YjgPBv7=leXx(VJb{IxwnYgnPSC?r!>wisn@bZ|#*q0$Xnw=If^{V;nX4F9 zC-5ypO5-r{`viK_H`ma3riHQol)%~q?r#nQ)+Ml>%?)V*^lNfClQt%>DS^$x*~YLX zfvpVb4~GS}Gw)y>S2uKaC$J}hiwRsxU@xEG!35|xMJa1v0{c0V_yEJM$LS6waG3c> z0w)tVmB3LEb1Z@5%qLh!=ML*X&HM}N8CEjSCh#-!vfg3LIp*^s_d)_UkB0uQ34GVc zx|zT&&brKcC4s9V@*2Z+)*H0C`1+!Px7oRqz;6t{vy%Tu0)Gnri{X5sq`!r8H-USC z?p_DxwVJD5+4Hi)2lvq@D_cD>PYStQM=y>ZHPDpyoV= z1y_wY!+5^uEj5+iaGEt!@fw>ir=mhCJ(C6%MX743s3f>DLzVwy>MVfVX4+=Eo20|c z%$zuDdpBfTX2vixGcz+YGc)rWW@ct)X2yTi$$a-#sZO2gc{GwGS@wEmnY0^l{P(~A zojIAf3~*CCq*!9x9vVNrvH?{L2pAAFAjG7+tO-*hWI6J%Ufnnq=oJm9L=nkO9^O^i ztYttoN_E*=!+@I7KfR2qEq%_)=z0d!H(-eoOO0q?KtluK84=%zMq;xYu-bq%1~f6C zsR6SL$Xq5~GXt6%FvNhN2DC7sr2#z*=*ap=<7%-7CN!BFTuAL%%ssYoaPd8u&eWpxM zSv%W+Ic&}qTb?qHoNvGa170Zq9{WOuiwsyy5$je#+z6V!OeV_>SV3P&u9A7(%=)zk ztTSMz0lN%XFAmyD+WS*AMPF(*7_gCLn+(_@>o*(3&(w0cGTBPmX25pJ4w>(~rrT}6 z9s?d4@W_C@2JAE7vH@2N*l)lAmYp)-psYV?z#;l!@(9_czxvuLreka#H{b;2Bq{P) zdo`yGIAg$BnOrd79Q`~wlvjgal)aZIgQC@kaMgg@GQUQ-Zom!7P4brP6<6qq`a5ji zHQ*lQKKVe_j4!1;HsA@HZwz=!c||^xHP6LfqrW7(@PK(ukI##C-Wu@EfcFM`VEDs; zj})==uLgXgeMwpFAXhb3-v_|NRNNhwB78f=msS(MH$iZfEGOZEmj7T9zOKC(ZdTKI_%v-P2 zrl)6?Nd`(rGLsQ~`MrZIvNx*{*`#MTqMuIP>^Y6d#V|LSpUh)KUP?YPeCOYBQh?2Z zWFhhtFS0E{FG?08i<26%gb^_mvAD`FwR-yG1=_NdSTfFtlCq|h5v8S>^HKL0VU5&6AVK<__IE5PFFv7{Qa-@q4kZ#gLdP$!Veu^0ITfdS) z=^;v(j2KaXS74SmqJj|>ji|)D7Fn6BMphxK8pU@*{;hd+BWf_LNs6VcD5cb<*CFeY z^<;0^jE08v=0>!jG$I?5O^j$tX-1ZpXX%zkv|}R1Z)HSldKK1YZuL6BZe3; z#fYg!3}rr^9A?CD$_OLI$oi2+jG~YJU$R{{R{A(2zO??gRVOfNt9%r#=3Ocok3pT2+$E>f4ZNcJu^;_r3Z%ZylV#A73#7_q{L zl|~#i;*b%mj96{N1|v2au|{m7ed^nfsvXtK8`c`JPL8vlQf^|j_~E=w;-LK*v(t#p zMu_GXQpkUlt>iXxyAeBN@0@GulXsU9yE)VzIr3i0K61Yi2V`Edhi+a5-C-k68*#>n zy8ARo#A9LaG4eQhLe`%&;uJkJQQZRKClt>baZUD~GvYk`0(sGhOGaF#m)@_Q0I$%m zlAg9WAANGUBt?ETxn$8Fl;1`eTya@U$ZEnLaq>4I+N7TU6O-}C_+$bSWI{3#DT>9)Cov(Z3CWnGG9fi3 zxd|yKDarrUr(rXL327Nb?L)J;j3$UL-DhHwS>}IADcMZOZbDg^S2Y4sDBf+iG_NnsO;NH0}dDP}@(6Er52Fd>e445^hh6*z*9 zO+6WFLJNi^WlbqcX%ouGB=k`|+6^WcO)xQ3NV^GUSz|H5O1H_R??=6Z?j&7gfxPO` zW-?!D!Yo<2fHIq$Bc3vpd9ruD2^+4chn$!eGF)WBV%fXI1Sj{4 z=v`*Qa+$B7h$Cc`39C(5!{#OvHk+`PzK&c^ZXh?3VjS_?Qd{WTW%3_oE4fXu*S}Z2 z9VYB#xQkrKHQ8&zJ`-M>@WzA=^`rNjaMOfaCLA!~pb3XeIBdds6E1L;BPN`p93_vD z$H^1qNm8uUwVbi1rJtdkHQ}60y48=qNWVf}A}`C{yWjO!rC+05H{k~5Nh|fS6gaPa zQ(C!g!X1WpO?V>f?@{iX@PP7=d_+Db#q7rtsJ9k*%H}f@p3D3N<)sO)WYYeU_N_SZ z(ijdc*S$00`X+6I%!c&w3ZfK5D~P8czG#+LKg{f#qQsf~aS0SaK^6sB74@Ydp@I|?;fWL^rY9kjlF7*A zq^Jqp(4|z6NB+sDJad+%E&Rr;06Whrs<3_F;Nr+W|>$h zRt0yz~l`iex1Pm1Ulyj8av6r$Iq=CJhxdQcy!dO$D`NO+5v*>2=7uGLJM=_h5Ym z4P-L(P;_JI%@s7EHzk{qc3#aT=4zp!rL1hFptba-Yh&6e;-{sx{S@?9(4Kh*1sxT1 zQqWmJPbOW+9&)a(lx_;T%cNi#_0`|^Q(ePe3VJi|BYXQQ_|ZV^8lYgHf-wrlDj1|- zu!2#n86qo3Di}&1Mh+)O$lm=Y)j_`BR1dJx;y~qbIF7wjWX*WW1ahK+NtDU5H&-h4 z)IF8WX$q!OW{?SZuZh_T=CJ9%7(G|PJOx`7Y-2KC!5Rf?6)aG&P{AUGVzlK77E513 zS*l=}Ox90P*Lek-D;2Dwtd_kKQ>eY`*xXF6CpVBA$xY;u6wzBK|NW)7=5s;Jb_F{W z993{k!A|D;W$!M^ZUuW}vRA=A>4S#E9gu#Ia!A2p$`P68=Eal8*}Np48VXJ-I3;_} zDL5_tjDoY$gFF(>E4aYqqRg`mjk`=A{YL%7;F^N#;#6sd!;BjWZi@4y8PR6kQgB93*9wdz`T`N8Zy{{ky6EPt8MdB2w^K!56Xg3z~gtN<3EZL{#?CJQZi! z?=f!_JY(}YDe@NzUeaHYuVucljPjPVyd&R}VuTNrj|x7?M7)3gD(2#wb3rkEWAi)t zL%~mq$bV6OEBGUmK>QN%%!qGBb~AFAk-&_-Wt0?VG!Q>uVdhJKSzJu66H_8eVloMt zluTwua*C)~8?8%ehH_h*iu0y6BMl|38JQ^Q$n>OGpA2SXl%9FFy5^b9$igHmnN9Y- zAFau0MlLq>X5=z&f%qVF_DOqVUqcpt?S(Y@AMp6v^nX@Zqn3-5eD`}H8 zsmm%(GhAjgG^3FjZZkY))HI`(8D2Ad;vtODR4~JSO)GvD({D!181;D?FeAtjLUNq2 z*d5Z#QOb)!wyB#}{7PU&CY8*nOsPUvC99Fu$r_}X#qHDOwMAQdX=_o zXGVWB2FRMBl!4?RGX_(J$lju5)mM{YW(;RCLgw}|@t#I$M`Y7EM@O$7t{r2>$tdku zGuBPfjAPAsGbT_bnlY6!iJVMMA)n7zAKf(ibaDnclN4RvvdSDY=9+QDilbJ{Gh@CP zsjWz3#R4-Hid|ztT?-bOvDl1s7Noaei5W}HxMIdtGnSdL+>9TuqfVN!!i<$>>@s7w z8LK${Ml&{1R+DSYSW8()ilwhNV}tZ2WtGi;T_#&7Z8I9SQX=9maFp%j4l{OA#5jG+ zDtn|K5~mvJ`zZU(I6yf_mY4THJ1ibGlcS^<=NRR<87E{iv#fH;jMHYEVRA|4XDR2* zI4_e6W?YmW;Z49Uvnl+VS^OxfdeVC*p6_OC;~sw|j$ZK+!2CA((2P5jyW~CcKKXzY zBistApP@Z6<1v#br+%nH&L0;+kDEY|(WI+qWTw=uv z%bFsTqGU0$xCI(Y2~rfty^hgYptrzpLBN7o3*syo=g~JcC?#2AmX)O}C~ZL*3(CsG zK+zZ!BgI52vUlHi_1LgjV70);&~Aa7;vk)*ixidHcc?4xVbg1YPv(Au60~5%uh<$) zLKcK65eq6)%8}*C3S>pH5-G;~IX|Wfy{b&AQL2+MnWJmUycVT4IU{?#dKT2TV21@e zEofjtLkmV(FxrAf7Hr8K-NAy6tZYm+v7o61&FIZ7XhRW8Z(%`8dMmQE%wv9P+e&X| zL3`<^Yeo+?D4i_mWkGKXI?KF^1zn|gv!FY@2ia5Riwx@7yN?BfWzyGze$x9>23RnV zGDzmTIoA*ihRS3ZWw_Yvl#wzQD>lZ0vEr<2!BTOYSg`-QzVrmm91F%!DOb)XHjNb)ZfMx4@69Jnam^STd;t#(1JRFvWw`8Nl|&# zpe(bX#HE-o24$lK%bBkrSCXs9)fTL=U@d(;xsDVgH2tC3AiYw9*i9A)ZYG6n5nc4H zD~`^eYxz zrChV%x&=4rx5=C2EmG8{Y#(=repe>mPx=R9>(z>VVZloa9x{I7K&vBGObMk_K|5o<-96`8HbVntRfvT??( zdDVRsHYzPI>9bpLX{4^06*;WPX@y8~kp;-yR^*}NCG(N_Nm1F_s1&3ZA`6p6WN%T* z`~~XSxHy-qv7&@r^B9Vj)LEgId6GZkE^WG!R+O@$G{aHciDj&?vRT%O6ZiB6Qi#zC z6I~(Aq(%0As;i#cZC2PhuR|`yX@yI=TWlYm7JOFtt*B!~T`K}s1g)rT6<6S>hfqjt z-m@{4tq@-^4wDfp%2CRb708NYB~nywXsQ!)RpGohF0~}eAG-$BP$wP(L}C)ODmd6Z)QbvdJ8f+zm3?6 zUO8>N))aAbfOb~2w_=4AE3N2YMMo<}SuxrQOH^zptNNF9FR{g1={mE%ixpid-AJ*9 z-6=iDo>mOVtezQqThWI}Uvh{Q{V1ZVzo?Nu(27Cy!7@2uREA0)Mj39!2+BzE?;WJa zSTR<-Gq+;C6;D2x##u2<9Nyp6zmmqYY=RXNDU(Q%Po_*Er;52gs+(6#)2)~xYi3$8 zi$0s2BlEddJmRj8GAWr&$^zyKW$z*@7SorIOJ%;yisjOM4`WtYv06MO-)jz8vBrwE zRvfhA)1H`hR%}VGOS~rLKNhdIVuPG(BV`l0S(H)k-c~<9*=of$E4ItZJ(L|*?4;}> zcay_YMdv=O{>ihK&3)v4@&M`9M2njsiQ6&FPOdv_MS%mFYEL!CtT=APVLOi4al(p| z;z?w~NgGaCaoURdHZ-u|j5s{R$;5`NHk`BKycIvJ_-Vxj4tw2-8&+JTi=|(pTqduO zSIKK+w?ff3t+-{y7dCH`Ppo)q#T_f|T5*rbLsE=(pYp)^@9L39Y(6IcUUwvFo>}qQ ziZ@m~mvgADP zXHriNzt~J_LoyqFTk(g@D4TlD2N_MqBjekUfFgQ(DA5U}C$b?iJ&8=_Jc~{)Jsl;5 z4Jl=k%7)a^(@@gd#3#(^Lrc$Q1~Q|p$wbLaK8%gdWMJ8q&EYg1*(%9&B(jjxF z4KC?Zzo_Q~FBj)0eKtIm_h$<*3EB{%gvkgg=JF-gRj{G!S>3Vty6Oxol9kBHWEC5# zQmT=oYpRb(T$)(JhMMAF*sc{*EgNb}uVX`9dOewJNu_USLn9jo*)Z6K#x^vup_dKo z7igQ>(2T?GH0zsFI*TV}UVRH2TH4TxNjtJN*@hG=(3a98r@AujZRo&eN3xTw5x3qJ zLv`VRU2W(_5lMGS4;y;Qdt=mc)R@t!HhBeIB zk!wk@x)P8;^wu-}GVvUj%) zd+2+~zjGasy+>>~DE$!Su-LOaza5qNF&mE4$MgEeQ#PCy&rmx`+HuB)vo^%DBfcHy zY&dVjTN~claKVO)Hr%)2fen{zcz;ek5#6L*Ca;iJ$!j)Tr`#Y#vAFf9sK3R9-X`zZ za96I+JsXl|RS#4#J!JUYhDWmZG35#Q)P`r25qv~1=r74vkA#+2qD$FP+K$e4 zbg`q19cAs}b54C#JH+YQU`N%FTAv+8J4|*ca$X0;Y=?znC2gdg6eC}ZsDF<*?Qk)1 zlOED5Yv$k8`Rxd>8MLE3B}9hF2r0%XXU9+Z-k^dV6=hyY>|#5ruvxl5^m$$zS zcGR$=rX4M1Wi30J&}-XKhf>#$29$baeNtSSC>AHChITY!(wG#9I3Wu*wWFC#n%mKW z-jE-~x1zVUqYb649UUm`NHK4FJM!@AS>YY+=*0Z*J%qd3(anyrc8s&5yB*?8JJ60n zcJ#2Lryadm*`Mq!N9$upUwS{X><4wt2hjh%vWw|$f4vgJBCw4%?LY2N*CwD z(eyDg8JaG7yd4wlSZK#0h7;|WVaH7RByzGHQz%o(Y2$H!b{vvP zmK?gH;z@1C8VA-oa9q6kwbIXM>27w(Te&fb_hPT;~7Qxb30zpU&`dESO3P2w|1m*AY)kj&W`uuLB;42JMh7d zk9Pdwn4jdxzwG#I#}_ug+VO+(jr=Za`e)Psr2oB^Ks>JBc8E}jn4%nrb|9XEpZ|~v z$pj=ENPk4#6kq*&pCltK;^rs#P6Nf|{c#%8Po#T~eFQmY|LkfIqw(ULk+@4&{jTG18fKuHHm zIZ&D-n8`AvLY5^B4j3sWQmo0OVY(X4)oo~Tz{=3(fXe|l-R^)xRyrMMWcs&{JP!C| z?sfdX>m~dS1Z4gwvp(!V#DV?}3~->F1LYlP=RkW0_9rS?!GXFC)N`PstgqxiWe2J_ zP*o;1DAgROE|bH9qiZ@)%YoWV>X0jVrG$70+x|q=cc1~o77jF&b2S!gE?qp>CiJFc zGnqFRM;*U(BgSdTuoc;wY(utnpf|7o_kM`!z@&!*9UTx&F?FJJCc8M$mC{Z2c6UG= zB%(}=-;?w9B72j4$i8Gha$L!H105LTz$6DIJCO5=cCZ7Z9k`iRJA}=lq{xRkFkJcw z2S(CI$)wo;-53ry_V2Ldcyal|1wo?lKBbz*}!>>aq^z(of(Ik4G*!wwvApzS){76*3o0Q*nQyOpwy-0r{* zneTL9m-IV>;>0nzhcoUK$1_DF`yJx$KGV%3Q&t2ynI4_fT_UKCvTy`L(6RDiI;=ol0UODjEforTeGEaBcf$Q`e za;}?{TMpc&+>v=DMY$)o#ys792Oc=^kp7H(L_Q{;IPjDrt~e5tsDIAp3-To?!uE>t zh9m!U;Fkk$9eBs)dk4PAC4O+=BmEQkS>~BCt0(HO4t!(so%|ttjYH#p(-S+@Q~e(Y zqMV4PizX=X$oOOeCsvpEcm7GpB#{%Zx2oqZF(qM=)QM!2QvA0F;0|r;@L3m{s$VZ z6M{M?^psdKjud%GN+~CribMK=W{IMdaiXjfLd0Zn!bmrfipBSI7t`jCPnCR!Yf^@f53^L6Lp=a=R`=1GdQlY6Y-Li4AVt3LMca< zCo7N@ov1_+HNC!>syI=V+oYNkH7M1|zgGj+q>JrVi&EQ(I+PCY)c4Hwo#;GVJ?h#y z(ZGp@PBfDBEhvr2CSv=@ycwmr6Z6xkf98m(C6iW8w5GHn+mfR9>tStsCptLMQ6}9f zoyg8)7qY7p-6&Ous{cF^Qx7Kw4pP0h6MdYR<;QG4`a03ii9}u`_M*QN1Dt5-Mk_Z4 zIx)zJDlSxYVXzZJoOmS;cqfKBF-)8T#epH#xnSIIC#H+N;KT?nYorsSD5IU2ND+%0 zh@9iZT*^Fh zJ}GJzII&RrdX4(zT`UecnJlF&BbSpy+|es#?<&e_C)UVhtrP3$>t!;iVB97rHal_B ziBk->IB`(i7Rj%^68-1IRwuSOv7KFe$Q|TPQq=5nVmE!tBXtLfX|EIenCzD|2b?HU zS=~g3IPzgqEaHe0N9o7NCeb}PVuu}>Phv16OSpvA3E_!`eQ|TLVqfg zq-OPF`R8oDaN;FpFn>tpjT3L3$mK$A7v70okRsl9Cw@5bUToWg`VZoXwl7vpAD#F_ z|4e=%zmnfbQIqqz_NNoSoJiwBT9>+pzqz2KF8pyK%7ti#B2VZ-JbHXG0SVdra*?{H z61k9ACP`cfaXW}SnG4Bfp2CHc^i(oQ?ZT;6JUqmGnHXkqA-(L);6g@vCYfY*!OL%X zXO&4d7qZiHkU3@E{%%wr7xKCg6f5IGJ{R)4P}+quE)-x*F|wenFGMNqLJ>+)@?>^( zZx(k!!)6H=^e)7@5W}XH6a_jL)}&A?af0*3zrsa>bg+Rh5AgIk`2g)WFxXM*@P5p)q9w>8NE5#Lgp=9D9rC2x0Xp87uvee zj?MNibdq@oN=NdrC%QAG3)z(vODQu@*TaRLF0}D$C%Mqeh2AcVaABkieONPy>`V5O zbM<#&0DYiLmaWhZrVo+HP#1>Lhs&hPWc9!v#pVQZG&zPGOO7MQi(`^c`H5_bxz;_3 zp6tRDHm8!aT$m<%r&DIQFjFR9+o^B8X1g$lN&R)|%kF#^7Kq*9!etj0y0FNF?Jn$a zVKHl#yRgEACG@4_GE&U=N^6i@^0qj%eCm$4!{%L5H1E0acgzPec}RKW!ef~{p|puA@yvzi^cUn?@}&!}D6h#k zq!`)C!{!~E?_KyH^N*CcX6jD)LjUE$SK0fG^4*0Wl%M3^75FVq{w_qh)t3X1LZaP> zM~_b?kom?Iu?eLoawDNa;o@H)7q0b0f7IY24VqC$<=8 zN$W-yH?q>xxsl$D3~rn(^zWRR(Tz;(%1qAOl|YP~jh>qn&FqvMZserol6h3KczN8& z>qb5|@-r;tMgdC6v+AG!Vk+oH4_n$dQ;!4qjVa#dIl)vMrk+7aKN&pnKY0_H%t_T6!kUDip32pn>NzvhMnS&HAOR& zbZ z=V_|CQP+)nZV0bNRwrwaHOX3T)TY!SMdhr4CF^sLMx=OL4JZxCQ;DJ*Q<})$rj%xG zG?z&Wx43R!eIwM`jW%K%dQirLwr;d@qV#s7k4*0UQeVXTxzS%H1H@ke(wh~E zH-tW1CPOL1-0Hm(#f&4|80p3+**ngS(eyFoSec8v8jhz=Airi+kNL@NxF(cb<;H5U z6Wy5V#x(ZMc4H1@x*IbnGs#(`{i*sl*IYN|xv`ANd{Tsq-B>_hNG_7O@xFTeFJW`3 z8!dSMvE{ONg&QlSA9@~Lcz!*y@M-Ct6Hm1;n(A$$mF>Q}&R1NzuE{jfL`Cfd||;$ovp_nEZP`#$#?AXY+u++QVm)tBZo6@Za@UP}Zrqo>kKA}be<+jbX63Q;Ct~IK!wt{fc;Ut`H-5YEQaqRI z#I~ED`RT@u%lcPtymsRaXL;+!XUaSBy&UHQ<)a&)Wb&w1>=*i1nS7&scjJdl#Mi@@ zPf&NnA2*^r$nHT755x@+qCH6MQC|zJO13jZmGI`W5&52pEFv&`0lfAhj(Jem5^j@XO z=|L_Ja(j@+gAyLZc#v1t6sF|!Aiqoscu`5vK|;bIOD-t4~!m|Jecgk6b}>+%pTP6pr!{F z53C+|J@9#8<9>Uq$T zQlD(#K|>E3dC=H{=1iK9P07$__1x8rE@X3@wgp|Rp=gS!l?SaoXd}-5%-hS#c9a({ z)v^xsr7xm7Q+kqJ$gX5JvOC#>6m#WCte&oWdC*%XeLUz(?>DBx2;&W1#B+#U=gKmY4wO*;=xi6mN5~{^&Tvz zukc`{2dn67$knoDJbyfKtq1F5@_C5*=f(y$H+ry%vYFf>Yi|6f8QDX#jm@3pb`N&Q z-pMbbc6qSdgFPPXWq8bkeUwA8X1@mq=m*KwCDiplEPIc5aFpJhuY<>Be!_#3(ocDC zT6%D__M8Xj#nJA;D-SMsaM6QX9^Cfek~l>a*Y?~HbH9b|vN)s@l(<3)x$40+>DMVY zJh&;7bSC{B51yXZ{<^Hrd)I?|9^Cif0T=qjgNJhIk387SD}o*~IZ^80XX#Hpc*f*8 z`GTxiOMRrTJ>qg!?Kcm;dk{%o;*AGyJ$T20_vAyV$={7il!#UNkBiSd{^ zS_+F&%%c1dr>e zNa{tzhjKn7^CGzy!@c4+*^$DFlwRcWBDWW*yh!auRxh%7(dS`Q8ZXj%;j}0_-f5~` z(4T6gOXo#;Ic5egGSV~2B(oP;=r#BY+S$Fx;YCg{vbfsZqP|z`Yf)z2)XcOf4=3sJ zc#+pDZh()V7x}!%@5MxObXhN+&514GMT{J?pcjR_D9mONFN#uHHC4A#F^Ltf{bZ85mP3!@h%FBIk?ad}~;TfDG(VWT@p zJNbFL`nQjmoNR_$s4MCA!o#L;uNOY)elIR_n}oawd(qj8E@JO^QO=9TUNm7@c`vGZ zQO%1Aa;}PARFYnqQpF1g-zQY}V&Ur;G1aBiAZwDfyr@m7LyDS|$901Byr|Elfy^6H z8hKGZyIvHCb#BU~bnv2?7tQG{yl5-ep(Uji+1iUXGBLEA8 zi=j-0kz%1D9O=a>a}oTV{AMQzo;#m`yLvRhs9;d@nY&irvF-ffs8j3%yuGSxm0* zVhKg8@KP_9Nnh^8`qt`8-byB`$knoU4dwAZ%{o!$#Re}nGTBaU`ddbB_F@a=@8>OB z>D$QZe97KH-%0Kw#X@&`F?pYQkc(+A!+l=tryL*;l7~o9vtAp0#0$4oIqFqEhC1fO zaW78D-g91@q@N;BlV`}Yq!^*+&Y1JkFHkOeaY-hZy{NTOU72fMT=yc%hiD&ecyZH< zKVG!xtZt}VUVQQ5ch}h4Ufl8GF6Vvh#S<^?(eINF$cN-3Qq0@Xsyr1ZB`@AHc`ozU zlo#Ynar{u$c2E~5rZ;T9_2L~xB;Py6evtmri%;~=GEr~AC(i$De)HnH%zt?Clm3hR zEpuI$*uGZfR>#YLpo{7ye2DQu zh?dlmqN(>GmL4aQeH~*<`B2)2GCq{`!Qq3G!x~5nY4pKFQAn|6%sw>d?GS}qeXudN zlN)&NBbTi7`{0)D@xe>?$z20k?O;ekQD)K*N@eW<~4YWh&ihuU(?`aaZ=Ue||u^q=?t zy=SO#C#sPTy}s(3%bLbMG@&<@Ni!dg@bAzTKD1=m%7->Sw57KuTh@(jN9jzqC&gNI z@S&shPClHHcRcIjLs#bA$nLUcr&a0YLvJ4j_#p1X*2f3KL9MuPnYiOzU)J=KmHjE= zCTRnG>fPZ6$$YR6L!=L-4D(^QOh&L+tk`HD#`v(^haEnQ^t!NF7Bw4v*u-QrxkdK==fhU%+bE-R z8+Q7TF}v=B59O1U#V*Y*A9nk&hrN4!I3(-$QTF?AfO1gg-qh;*pTle(@!=@t7BH*N>T}_g*wM_-kY~wru>uo|C9a^Dddh1cj@056>wtWUu%V^lKm9h!cyrN}&|q`tZ(&KR!hH)f4Y~AHH$@Kad~EPvmFv3;C54 z^&iu#AI^XG;fG9q`tVEoZ*l(Q_erBUcw#@2_z{mDpG-iC5#UEc>52TPdQaWRNtvYf zBaI))WN&gx3O`a(Qpx=KH+@>^nJDS}NKeT?W|X}V9$lH)%tB`M|NGt5?0)3%Bc~s^ z{3yn*+++b#tWq97@=DJ~$xn*k7%fOCL>4BCkVQ##D;?1l_e0}H2_||nM)qp`(9vfM z_;;3z^&?L9mh}Jo-PJOFl=Y*LAC3Jm_+j*;f*%$AF!@nKt8Gvz*6D{rH>+EqQM&u_YKZzw@5yE_G7s+{)Q8@e6b1eK=uaQ;TYbuO zxgI@;&Eb9wmNi2tL;V;=xz7J3ji8StN0Fn+iv!i=j`d@lALE&b<_te3_%V^qN#s;N zCR3)6E`Bk88htvs&aaLmrkQ>WIi$X|o8!k^KRSfaF@$-3%=e>A5M_f{;KxEgY6eg% zfJJ^R_9JxwX#!Z{$5KC@`SIM3WqvI8E&Q zB3a|dTIuWjSWn*|ld*NaBKfy2}db<&ShvgR};)8Y8%#Gz$V zuK97Da^8;%l#8V3y5z@Y`W5o3%*9e}<<{Ns<35MF>4#{llOMOG-|^!v{hmw~RM9?Q z{X@AXk0_7*cp{UhejMaKo?iIzQk-=Ih#$Z!KjPokd}PgQ@{O#2OL<4WCqIbefm`X5 zAD@|gA%FVul_IvrH_CVNhaU}YssB~~C3}BU{`e6UP@ikjq>vFdCHz94Ab|b3b$1`e zfO$ePQ2>c4NdibgNlGRolapeEsNedO^i*WJGwO2F29Pd*0s#~ZAbkKC0>}|SqN$pU z0rehPOKr+|je7gFOq?Zi09oW{St;29$W9So$rNQd1Ni$5tXvFplX=Lz0pz3PC;xsk zw@?5H6s`Ckt}B4T0Tf|Z(E!Q@UsXs@nz zK-^UZhXXhgK-~c91u!mv@d4Bipg{ngw`zt4&`_*!038D8$Qc`xt;A!bG?k+@3!u65 z7L=9&wEJG>?{;V%KpWZHmeMYO_A(KlqIaVABRdDsh0>MmNp=gMJEaFHhE1G5x|j6c z0ra8wl}XJ%>g!;CHU|VSQ09Xug98{MlQiQs8M^6)1u$GDBLWyHeN+IWrH=_foN?2TbPLEI?8%-LjW5o zo5;;%&m0^%fURt93t)Eud+6KA9pp}OS3uk$L_OyB2C$FGA#t{$i16aur~~wafeB0B5D23*bEc@9!gA zl=&sfW%5b@S1H%X>!cV{e35f^H|?ze9tH4NJi2b$+vJ@9?ovc@FM#{>2joMUE0wiR zIL<5bDfx_iPKxng1n^S&{u2CsfOL-T-N7?(H@VHsyN& zKLW@cM3x|a2JkC@)IoKd|CTjLg7_0aR1ne3L5hNSLByvgARh$(9Wx2pOcX?7%DBC1 zo|G;m86`QHB8ZffRI=B1UYjO}M#nX2$#kS>rVk9Gz_9j5LJVy7DV+RYRgAdBZw=9)z@w@ z)nr&Jh~K;)V;xyjH;8)l`Z5uZLew`3qPa{O2hoJyR3^=W7@SLeMz;v!;jrkI%v+JI z$u_dGaKqU4L39YBM-V-O!0(vXM`Ah#A^w%tN!D}@qKovdlx}2qazGr!|LMfClBLx4 zV$wT^J`@r5rSuD;zf1;*?a%+j4Gv;R5F3No6vWUVh6RypbIgh$h6gc1Z1W&ybC!`o zOp)`B3Sx8+V}cmVWTMQ+1uWyA3dzS>UR6Lt5s0&&a#B!N$G(?x060?%cRY9zl z`I;cs($@u1nfF^>&*lbk2#Grai9ZH|*b>CKAkK?Ch^;{!4&q1<+k$w#L|yvcAhy$Y zkRsek*+uRSVvo$falm~+?B^m5kOxUI&Y>Xk@sbANN5!sZevCXWYwCWAI!QkzlhZ+* zk$#r)rBd_-u{X!4>y{>`{$dc9g1F4C8{`%8DtV0*mDm5jrQZzVmdtNc?gVjHCVhtJ z9*E;Ph-@Kb58)B>pF#Wz;&Bj9f_NIlv!MF>^}0*?=j?qO#5>B1AYM{lk*~=&q*#YC zm(;!XK8PWYR?HBMhzJXnji7)L8kYC2iY&<0VG6{qbq=(3`%&Xd!@*z|Rp+N`@8CE1~l9fWJOsPVOrB@Z3 zNP6`UYDoWkr<7W3)()YL%shI*Ubw@hFTgA#@enFbrE5-9qRta`Ds) zp@%3AVPgoJLg*F3;hs^$LKq%G?+}I_*7lJj_YI+62>sa{5W--}KynaS?YH_aYY2TP zxtaGX7!ktA5N3xkCxlVVMcD+(=n%%pWNZlIq>m3_5brWEF@#ABCxUR9qnoI z40$$$bCmPs1@a;(Dj%MXxg5e3u_fzhuZD1&BK%qi*XcLNo8&Fo`#EKaJJRola8LUE z5FSWRP+R*rgeT(68AjqTo`&!&gpVP73gLMO;+;&LyP6(FwJ*5ZFU65BLh)2>qVD21 zA>8M0;|hPvf_LQm5I#^uZa$}rKUMcRgx_MzH`DspYQBUZ_?7%dekXsBKgnO>DLGUv z79;!#Au5dMu)6Exg^`dVJboAnq$7;eJO7=Xn&*v95=PQ6V#64|RClYEE?F31d)XXe zBo8A+7%AmknZrmGM(QxK_tK_em?4a`lyqczSy`!%E+ah?X&$34D~s&SO35b1p`@{> zy*b0k6-Mqb@`O>8d0tsxFpPZC^HU0l_5bmIrj#K~WLeTc8pAlnd*divrvZMdr=T{A*nyjf#sS$?wDw&w2wpiTWxRznG3ZqUK z74PfovY=iV^(hU)Xe#Gz7)B#{W3q|Nr$D_9vsoC;nY196^ZR#2uWMV2b9fly&e(0j zXv?m4;tVh6ZBOYyb|gE6(OLFhIH*3@uHk>*(G%W1j2>b1WI?Ym`pe4Rls;kfrSy~e zI=eDJ`oJ&-g)x}TAz=)qEd2cMb^qxj{fIC|GTa@;s4zx{u^^0vVT=i*%(fWuE!5dz zj16O47~@$sm7G9MBqxz#JttG9gkc!)Z*NXxGM$`3&J1G~Mbtl03N}}gtHW4Dxgf72T@%JyCSx9|8+JWi z$c8XBO5YU5X6YXrmlnPMg|Ss8+bG+^*g@GT^Ic)o2$U4Xd&1Z&c6S(;yJ*gaaW0Jg zVH{xdU>L_KhseXEC_6$q8pbi1e5w#D@)K;HBu|m2!#G3n9n^~gvAFYLT$Sr^fpU?& zL|zW#itN>oi@p}d^)PP89=HZJB&N@rRmk}bB}(Xd_eyFj_~6!o`i8Yf+G<; z4da=3GDc7#g6Cnp2*VVC62Z$bUWE}ag7^`LpPGFwo@gB5O&D*(ct;nD_)K|Eejq=R zpUA{z<9(rgCBKp1Ninauan?`izbL=M_#>032%;nEOF&)zDro?Ir=?`TtTv}|PR2+~AQ?16gTP8&fwhUp{76hUTsh6plJ zM8U7gnk@9J%DBa26%p_Gs{Q+U5P9h;>h&{JZ`II<)u*1SKzzFInhGBPPkF+^aL$;X6R@iXYI zml|^f;)aTr2&@s<*z1YF8-bnfAf2R(bd#~X6OLGxFM$Hc7BKA6p6}KhMV(1-SR&;1$!C`Pf>(xvQhtk&m7EsFg(RB)-bWu6$g{$5ocl z-y*y7aU>t#=VMQP@DGx{mb3QeV_!bLk@$e5`wO&vE5Ub?KK5;O3Q!A$H@ZRzF6?gbvhqs zB%)G07<@DPRlYsL7do5I> z0N0d2;eRDdqHYpK5@r(hlDIR8mPxcqqTOeq`bmsEn0=3wY#?dFB*O_FGuL^C;&bHfrePohNuCnQ0Zq}j>fS(0KA*^L&+#FB_hoG9S@bR@fV5;;k9 zO`=;8xk>c@H`HFP+eTt`^CS?Gwx#_N+*>d@wO+VGf#n?~=pJZcUG!2oFeNU=o9p7%YcIN;*W+p^^@hl)}T47*T+=v*A$^ zkCt?dq+=x=Cn@ExR?eM}#Ka`NOkryZlaiR6#90l$YM7G5)Fc!Ys)}hz+@C~Jfui7n zBpyuS`y_ryVtNuYl6XIfHA&1&;-Ms-PU4v)W+gE@39EO`!XzF}VonkZsM!wBWdbDe zXcCVl(f!WId`TaXL+r9q=608q?eQd@kbsi6`A06S%oy2MhDD#d4?5xdUg^6JBcrt#+}5PPGSo;tCLtFnF}lBY)j(V4*ui5mH_~HX zWMJ{|u1{_?Nd#JXv_*zne#+}7CN$gMJ5G&h>XyXz&-?AE% z$T^V2cM{xY9+a4Tb`K|UBnfhEH;Nri;ux!nf<_9CC-Gwv*OIuN#7{~5oW!3DND?QK z_=S0x#IH%5Ork?)aXN`J5}Zo%H&O&SAAXlzw2~OnAl5E7=eHz&PvQ?2fm+d@Z{^MC zEFM1?UeQ@FD;D1!nNd1=E{V&GVP|ok8CyDfLDGwo+MRPQ6@bH?#g!y~yh2=+ltVX? zxS2$G1r-$h&4ZjoNd=`8{F}soN!&`Jkiwt25LLQ}gKvbhx`;kq#AkJ*+?T=%iYWNK zg2<~NiYh3kfPf7O?kK>;6_hBzgS&{*3QGPME~B8Vf?nY$eJRHi*D~kDE>`LO zDyXEOmV(*}Dl6FBMO0N#jgjmkswlYDMUYcnK@9~pC9`~2L1t4)3BD;W>L{qIpuU0z z3hK!zcPjjzDZdpPNOJnDt^s|qt7s@SQ1ho<#q0c3rhZEW?L7eU@5DF3sS}J(t&fI?8 zL@NcY6+ApAoU4G_m!kw*_G-Cs{+h^7#ly_ZHVS{8QgrPm+A3(rSSjeO;9eyt0^Jp) zzY7zzSI|LnI!a1TCkZ-B+C|c?l6I4nxzR&GPX#l(iRIk{4-1bEvuj;9(MLhPf*+2C zs$Yp*T^gogssc^Hj|zTLpeslzSf*e(msVgXm_+jwm8qfh#Qh660~8FDc#x!HuZJnt@qA>6)U&c-c({TQ z3PveGF=4r2Y@H+VkqVwFB}PmNGo+&xoa-hC#wr-c%=tX~J_X|yOrVCAF=k!)?xOn6 z?1?f18Nf)LoGA*XDww5Uwt{K&qPuuN!Gj9!SMb=e5KnjeYB|%nHH?_tj`xS;&A!!| zln3x3F4rm8pl5pIJgi`jf@c&wt6;8zc?uq-1_cb}e5Ucskw+vZAg5P%u|PV-{C`@( z;}SDgPe`y(!IK4?rzBX!43S{$@fgJhb{8|dizN(K@$hrfm$KL5cJpA%mMS>BI*TSf zuiym*pDOrF!HWu3D0o-FdkS7su#(|b@P>j_3SL(5n!>LMh*uO)`Kyu=Y`zj@BUs;E z?CUNF-c<0Gg0~g0oUT3)Ud_4VBJao`pX)9bjfg}G<&^9p-dC_j!AA-{R`7v>4;8Fa zu%0U-Ovj%e9bT(o$Lnzh|E?aQLyw@0|4%`thiKF@XM=(hzeYacN#`YOba-YD@j?$V z_0jl71)CJ?Qm|X$uf|0;EBHde76qU481@iHdx&d2#FspD)U049r}q@w6l_?t-i zip6@0kv+wRQ`tunIZTPKxNF6uY>O{O_9*yT!G0#Eg1rh@*1nO`KYTR4k7;%@*k~pp ztMPZ-(4OL$9Az3GP;e>{JID$^*Ln)J!x9`(@Vx{-NP4tj^qpRb<5K_Dp5jDL@iRSD zP*FuC6~8Drso;Wwi!7vPBc~LcRq(5V)7-w&IcHdedkTiS%cUsy_cs}VzbGl=|A&G< z72H!dmKYPM-Ag2TiDWNvPC;(@-17>C_Y!k^iAxGDvr4Nds^SXExPpJEQ>M)|F40Te zpsHTtx)NLjna?+Q37}uSf}maP6~v88|EJ)VfhGErPbthZ2mi&84a_7<=A7GLxh3wjIUvMP8%p^@cPlvDZV zU2&qf_@{Spm8qZxcUHXHsZ73#h>EC+sw%3fxJN}371dSLP*GP!J!wNt6}8nMR-N`l zYN>c{Y~(;BQit+=M68cc`-nSL)K_tribitL1}ff3#2Ts?(I;4rczz#ow{(!TrLhFO zGa;tS+?S>*nyF|m=kf~01a6^%S<1N~HK@jHS#>@&b=eS{cWuxM@1VIdEB5%g8BSvACW6p+0;kGE989NM;zOheW6phor-%^bW+io zqn}3FtDp-V)WAaC?a+*lDmaCJHN1<8d=*I*x0*(}s_3SI``BI59+LKyw3nnD>McPZ z6<7NNJI;d8r;uR6Gov&Wx{6{Npdm%qRJ^R>6%~dGQ^i~r^SDzgY!#zbj8WmJaMd8M zhN|#X_$mg0`d z!TEx8M!uM$Vk&R`RS>fR@CZDYFYcFH$?f~NWzKXCsd!ioZdYci!M(~XIr@;?CYHYQ z*CMl3zU2rKo1YNiE#(|3yf0tO=hoi}Kc!-kibqsDDh=j+#bYWKsCZoJSt#ifGM$(| zf8~oOd5)6e(cR(xrK5{gJgo+|A}^_UhAvQyTQDxNga=Kd)^42ySp(4?pD$WZXA^gc&Bi^_`lfSIZCc2uzOX(FNo zS4qZpt%`Nrk&c4bDbkNre9XL6v6&gD;u94c8KQ#rnFKt)JjJ&UGCAyiuHp+7TUBgR z!N@;eBD_V#m(0m{lv~hK33h=8ff>aZZl}#va|pgtu}j5oDt=e7Tg4s~Kd3mW;%gOq zRUDuTD)y=PMh!0g->KNIVu&KXm3cc`32ru6>lj$3E05J76^B(EQSrUXpNAFgKM1jg z(2N%qp=n_z5~F=g#c}$jh%+jFl;8vlzKWkz{4BfmDha28pukDlJ*DEb1P|29J)nq- ziny;-FnU%p34Ud{t0bza;tv&ns<^J=hTOrwR9s@TRh;8_QE@@qOoK1VYRq%TYC{*U zsNhwV{Hv7gB;rjX*JJ_V$>Jfpsp4-Hg*7};KJpK1DXWKyLRzqi+|&P9qF>HpOQ<5L zifYRfwM3jZ9z`_#bv#^D3pDd)i52V)4aGH#&@fU%2@NGR+@qn1hEf_zYiOtiIY!|! z8Y*dlPU5lzQbT!3D@aOyMU7P@5U#ADiiWBhs>vxev>*+5p|4JUzIa3xZ>XZChFWs8 zwuV{XMQA6L*O8pMlGc;-PD$%a+CU5LmncS)?$Xdm!!uup@0Rq$;z(mHI2YtJ)zC~s zR}I}XG}q8VLu(B=8bTVfG(>5PhBIYE;nF$T8p0X~B65`A3soFd1&<61bzDP2LrV?U zRM9GMCnz{9JDL30^#ze!4Q;fba(2*=r$G>x&f&$qEmv%s+fGA76W2@U48ESn?!6k? zOMbp4*zKsHlNJ<>&XRV~_!?6T)xis`4G(I#PYdeRcu6Nn z%I-uBlM3);z6Fwas-)8j`1ecDC?%$An4w{=hIvd&4G(E}Si?&xac@e@(lDFMl*q^~ z>n-sd4FqhTro?;=k7#&Q!|saW-)-5<2i7I#EpMW@xeH_xJ}xPf@CgZc(4Nw;NW&Kz zwrE(a;b{%8Yj}fxX?Rw{3a-w~)bN~!Wg3=iSjxci!MuC$isSo~C{Z!;yoMJvyr`jU zTJX-CH>;OYg7@dIU(5TVY3@o5t2DgIG^-$9*6@mkdn*c3cKIxyl@91@8oEnBCZEOL znjbr zwBT86r-q8%bNCdtTXxCWqXkcA1WVF_bYB6V0^by14t=NLfQI85eq^XM{4XsIYdE6e z5XI7hjjzkT*YJaeW3o};s2r+bh>LQR0u=j6!_OK{OARM9{G#EchEqJqhUj4k3J)^G zOymC)E;Ga#21-sO^EVB@Q>V@^GvW^oe=V;=QUiQ**a?IxTxWh zh9WwOQcS}Y4gYHRj|MCbU1iaJKYWvgNOsA&F2M~AZ$1#KxHfz3^u*s>x@znn4HasK zYtISY(ojf8!>jRUi-wop8!fD3cByFHnUQ*PBkQlm+tv#g(@{!CX&ry=3`55qIx7iE z=)oTsa(>A!sbj{z@btezAJq)+x)MJ(B~(U7MIDuNl-0p*IY|l1>!?tGhph@#)=@>r zJ$Hwz>8Pq>!1tlp!tmqMV~elEPu7mA3&Z`lhidAmrK7cu938cF)X@>rk)@-qj(R%o z*3nqUqthbwZiV-D4&SMxzK#Yuh#Ts-OM>(3BJ4JjnBeI7P}Y>hJvy4`XsYAhPeUcv zgqygLzMCV>bTrqY9L%2hXow%yYN3O)d984^ju*CtB08cv!VgZpYz`;dVMkJrp87 zwjyMnj(5;mnbAc@R~?;nbY|QZMJzY`;=0KGDIu+A7e4?tsYrd%~n^sz+x2 z9DYp40?HRJ{J0K^mFg5OX$pcTbv&ixEgf&`SfpdIj#WBd*73BCXLP)%qme0w)($_b z<2fBmbu5v_k8c~yr;lM=E-|~$OYnk@#|~z*yMlT;M=I6|zocU&<4`Ni zHm7Zrnf8i~*QxXA5R?B^9bY~gdQGP8Jw?NB=y+2H#Tb*J>mxK^wT^dmY|!xuYr^Je zUZKdlbVSGdI(~UL6uDevtpsZ%{XplHJ>av6>9KV>uGR{#XJwF}&pqLfB=}fT4mCU< z{#3_jIyUoM@6O(+W6Ouxn|KnJg_v4jo{SiUBK_9}=kar%qX%Q0!ZNr;7Q-(k-74ue z9or?~=ne^X>i9~6T?PEzI`&BXwWNC`-6!dltx-<=mSv}5c;j=CFH-nU#{nG&bsW;M zDHZS!>o~%LV2Uy+e6QmN9lx_U>p03_HjMqOL=d%g^)bSU~Yzie( zILG3z=sD{mKRN-m}K@U8RZaCxI=cM`C)e7 zHbu!4z8w@UokFP;yke1G#zqR44wF;)l}OnX%B4^~g$gNrnnJQxZp9QTrI1P?oeE-G zIfZx%35l!Fo)oI3P(6hjDcqGpBWYpH6z-IuRtmKxs3Ya;Nm^GLLse|FnXP^b4Wt-3 z4O7rc1b*F}LgN%#q!5xr_oUEFf+kW)Q%PTWFG9)Y5)&NzCzK^+s52s&*(ro2*io=t zRCZ%2T)ZpFDJ^AJNZLwLGFwX}Ig;i|+C~oLrSOZ?(>8^6l5=kgJtSzKLWdMOrqC&c zt_6CyO`TJq*R-cgDtI)e@@{gpdx6aOyJ9_4=p|)(r=UvECxv_lKZP<%gmV=seCOMt zTXJY0K%mp0K#I4%cqj!c1v`bYa*C6JE5UGXv;-8+NZ?DuXkp(J`f*1j zlWPr5VL%E4Q`pxkh|i#cS#>NiB!!_Vd?~%)&@ed^w}O2fA+?Q^hK-VRv>Y9i0ykw_ zZlG#h3iqWjK7|P>OibZHDK<$?oRY%S6ei0l%y|m4O-tc^$@x+Xd}Mn-b{AF(PnUCP z{0zwn4o(WQC4MV~hf|m%1)fe}u4FzbyYu8)^HX?4G9OK00XHRu$7GlK8Qv#SSeQb~ z(!q-7yZzs~4DwTQ?xIw1^cEM$pC}Q2CWU8HSdzkXDXdE2u+$K+`;r`8nZmm-1e{l-hBs1pGlf@EcukHnhObLNf%!7#w3BmJ zS>kQUU!B4`lJjl~Yf|_?;`dT`UygF!V-3O|rm$A>KTcs?3hU+2N0R;6x&p5GDcq22RLG(bo$Y#c*MEG+_2`*TI^?3{RJQta8I=U@|?Oe;i zdILLB*vW!mppJpBQrMNk;53G$u{(u5JmzU+rSWwNdsDcU!gXd~3g4t~I)yVS>}SbJ z;V9FIl|O|8%#FfXhf~q6hnwwddJ>QC-Org0gPBB*dvnTBh zeU5NXTbxbdS1y#o`4oOj;rA5&Na0Ub(esgtg|o_)j*=cNl(qRl=r5-F#R&O(l<)v~! z_?JOWfp!*2qjKf=trQBSgDx>!Vae>@wir1aDwYP)xFa1*FOkOZdePz%vrAl3VuF#j zD3j)sDe9-uAdPZqlux5p8nx4?kVeHcs;9B-&-f#@s6_o~R7vBtC&J{g5mZfsL&Vi2 z|2D3XMol@3Q#e#d%G8wt)WB9x;yVkbP*1}&?n>jHG@7KrS>!a5l6R*;%~ac1Qch_q zLGv_Pq|vOvHm-7e)@>uR(+H=LpGGo`NE*>JI;7DtjaVA-G!EB{i8K=FU@vmh81-|6 zpr!1#N~5&|EW(vbd!yXGEaKQA>y8CuuIT89i&PhNeN!Fg^~u-FO^0*4OL?1xt4~WMh`1K z%!+@zsL0d@LPi>H8eSU2W*U|R#C95v#7xCt=yb?WqkkF$D03(~BWd3>`blthVu;Lv za`kVu$e=X7u;SBdMM*hvXd1&9@HDnFozfVQ#)W73$G#{FsV zD2-(z{TH5;#<(=@OJlrbPDo>78hs0A@!U~{0&MJ(PEKPAt>vcM@!Na~JdnnN>ENW# zOJjN(Gt!uq#_TjMmWs}l{D&kRe>y}C#U7U3Icdz5fJ`2I($8(d(fM*BWgd~EWImS0 zf;1jaD!`DJi>DQoe4$e>#n4(zwkhli)UfE{&yWtV?5k8q3mH zp2pj0tWKlkm)Xy!u~LE;BqirX305#xwW2RE&JAK@u9D1`(|9F~R|_QH;Bk=n^#Ts_ z)>hY9vSR+2P6 zP2(e(W8{1+!3IgMAI<(up2{y6v@|wK<|ZcXZDBb?86I0s{8FCK%4uws$CH4YcxzQ; zM;bfRxSqz1G`>n>R~kR3af0=q_M~wnjqh3i)7Z-`sG9p-8v7(5-k-+nR{R^LL4`QG zY~RWuG7qG2P~t;8fCcimM=AV68b{OkQKr)|X0H`ziZ*W@IW94ePrWPgpJ?RiATp%C zq;WEh^J!d2<5U_A&xFn}tJ650#&7>*vpZ>e_*ddI{!HU9SyY$5k^Or*xJ>*ZDZ$I% zWS^4(sl74qnqgr~@|uM&rg1fmp%+8MmsnDog)d8bMN;zFu1U;m$IUeUPNRf@k_P@s z~!8XD+kpgS!z(8xe* z133onHqh8W$Uv5Xdki!&(9FQjCnJ|0h;Nu3x_%_m)WFdd;f`O0n@c{2TF`h~5Kti7 zK+Hhg;D2%thYdswL=D`uMUBgm$hJ_a!7*n+D8W_iFmX!*?6S3zp#1evu7NfNxJn19 zA|W}rGVd6f`N!oZ4Uz{%0*HJ(gu1O z=p}vWZ6Iktk+_e6deyy28J4V$iOTE!wd{JFp~*$ zJv73=NCOiLygeg4O4>%J#u^wc@ff;uDO}wVJBvof6^z~|!FX<2(Flbn8kl5YGV}K1 z?E9r2f+?~)l{qW{m6Q2^fd}Q>=~9fE8O9kBQ_nXGLbP+XfrkyeXkdkbIR@q$SYY6B z1M>=&dsJ$eZ-DZT7&tgM#<`ElQF5sB2?GlaJZ<0^Dfy&KO^rUUlLpc0_mb z5rARY5pB3Ly34?B9)TH&JqCI|ScII|jKmw;qWic_1`ZoIVqm|4Z@FIv4jFjW5r=EX zzoSWxIACC(BiR0`9q+IsdVNQUqj0S_+j%2U+xGdaO9n0*xWPR#aK*q? z1J{@p3|;Mb>3Z?Aj`#xcB5vSai@Nb++oBA@->m-z{xwj`759G?{m%d$+`2tl$P7Yy zt01t2O-$bzWozwG!2DZ8R43diRRj4$3Btz@FIi7FX>L?qM?bpChD2E(?op}FYbxPcSS$h9d%Y_aiLdT z(S2|9lV;*B6YMrJaW_qB6WiZRWEF~k>WVsh1528iXlkODiQXm-xT2Yf6*EJvOf)yq z!bHeKmWg4dqHz=1CdMrcM@(FH1wmMLmCf13W=5hWVkXLZV$SC5WmR$$Chlt!U62!P zNy~GhoZi|*j)`0oZA^4A(bYtr31OnWi6-yI+M2jpG2BklMs4C*SHky7OlDJ0bdWL~ zB_*emiOv#t@&xC0leoKy9#nfJOb%O5I<>Y)hc@wfH{$FLoe=3`qQ8j&Ch|=rO(-T* z6Bfg6LNlS8SoS{O5}?Cp;r0K;Qzj;5MbnZJ7!qVWG0hX~QqnQe*Thm!xF$|42@!a* z>zl|(Kn^AQnRvZy%smk&9cW?@y}lZK*u-EHLrmOn;sFyw8D0|;OunDQa1$d;j5?k@ z&cwXq*&~T%xA*bvwVoJlVxK3*NDgJjO7OcU?lbxMglx);m*5UxOfoUq#Hv%-Q>4ta z6_JL%pv+XsB!8NeBzTY+Zeo^PZiZyeG;yylX1fWFa>_#{d^vY^!CV^F?Mifx3DUVH zcD@~=Q;(Qbw`x1O~K6~}F;5%GTm{=$|#7~;wM*^ObbP@NC zSMUXqp2rG3W8yi+(8T_8p=X(y^}|be=!S&}mdUxRUk$$Tv786znb7l+z91>PFPDwH zWMZX>Kl|aYepqGVWfQv`>~`>qiC1}QY&5j-8ux|yU}1oTH%z?A9I*IXkx92bB-J~kXBSm+CmZr~-r#HS|OHV<>|MiZaWfQ~uW+vF4(9^NDszCq#9@h?nl zF>%zyF%w^!*lOZC9#RwAOl&vtwTZo)*e+*>iLdA;_kxvVYM7kur4yvPP3&QfYLm0* znaHfRIawEr9&4M!wvP(i=6oaN3HF=#mX`O-+2RXIwyzjHXyUjpsNskNhZvCJ(ZeQg z_~Pl_5l;EuM76d#KbZW#R5=v0wnmPde2a^dCVu4h_00Ln#LqHNCn$NTD7~X=3>w`( zW#Wv9vnC$u5I-#gRW&0fo(}(N;x`k&n+Sg%IbAyOhsiH%=QI^Le@ehlM^8vZ!x?ej z#0BPqg(em*nz+PDYoV-#%OGmJS-mykhx!B~ol|r2VMyx~2(ymwm&;O%s1h z{y!%EHPP&$*h7_~6#JxoPOpq0C}g3q1z5Pl0{tptp_qla8L=ZPT2yj|WCXh$;_er> zuysMAlm+4vl9rToRYp|YlU>?E{mFS>WJEa&_LaBB{|&FjnQ)XH($Gexiqko)&sp@Dd`QVL27EMg_+D=3y)fO$igfObEw?H zY{sf&aQnwwKHhOXOy5^#@g}oqNZ9q_`8%WYEbQ44oo``5-FVrZ(Z>i_SGPqUrz6GU z&uotlL;TjxC=GamxhnpLg%uWFvapgG`itL+$G2?VV{L>=uvaAsYrY`O||f~g%f*%#Mo=$On=d}Xq-2M?C!TvcUSZ~ zriTSGzvaZ;(KEXPRR^hISM(5TlwAFbT~T(wxA237UwHOesd(fq{7lUj{{A(3pt*SH z*XVHzKU(-n>N)>)v__#gDJ_4cnV`&n{lzI}poQNp{6R~&XyN#;7ASC*sj@f9R&{_F zT_paS1yWl0r-i>*=eg+?&RMv(Nc_Bo3$#kQQ$3bTnInY)$;)!lD;BOYKD(oIpUnAr zvFlRu2CE_quZ>DJ{8w|yqBJpxI+71u| zTMET1*hmi$qXvk|HmcaDWuvx@sy5#X1@_mp@xj{ormupqSGVC6jn|Nr+q7;^5Yjqa z+QywW>f1pA)U(m4Q2f_sg6q;qa%eMcqx@Yq8re8t);;w4y_- zmBhk^eImwLtz|dIMy>>HB+ZkQqpU3t4-jo_TyGyM`d+-fjSlq4MrRvCL$R~(#yi@` z$&D==Al@1vs+Ed$EgGBCA*O|5-RP{1J~r}g^sv#>MlTz^ZCq@d*o_#q4Qdf9vN`_W z%drgqM@^r2(uQI~wW0AoaB6(ulGwpeqSW$Ow{9^b7Mt*FOt+D;ajIx+YKhoPFJaoS zYz($BgpSZ!8+~o`v*B_(Z1^@ZHkNLWm3TIG*S9e{9{Z?dtkb|awUN``#sC`wZ4BaO zwMZO{#I`n1oIvbCiCE(|qO= zg-8Bu&767K#xpjawefo>wjnFF4zVRRl7r$#vDkAqCjA@;mmDaT+j!o_N*k+eykO%+ z8!K$Q#JwmL`)yH-^0z{<8d*1F`17wPdu?Gw#~+N8OcWm zisuK4uWanH@wJV;Hg?F3M;kxc_=iQ+ z#?K6njY~Ez+xW%CNgHQuoaM2yu`Va)+iRiIHs(DZ{(Yc$DJNcHkf=XM{K_LgNL;Y- z8*ADi@w=o1e@O7BjlT*w=WLuWz*IsF7a7=vk<1`*#l}_E5a#Vq5%RCuXwW#q<)~Rv za&FjsSq*ln_HWj}L4u9=KW4a%3JxkdDCFR|L87RGVoor(u!ABJ5dUwGfP*_6ly`#V zz8xek4HCs2lyCx7C7s}{H9;xaEiEa#Wh5voX*o$N4i>b5LzNsWcAGo6&8KiP2eER30xcYb&p{hef_7HKegZ2(OP~i~Kk$*JkAVv%k|6YpB86u4A+|CZVG1L-wanRKPnQTuy z8R_nT8vgE;)5Aee2b+cnw&%-7`#8vV;5zUeBpoOYOb3<&)q%z-Lq&=iK1ApaC`>)q zh6r}k4!Ecx1t=368rWbvaCi!a3T0@Zc^2tV;XBAU80=t(gT4;>N%ICux_+qW?_hw$ z{D%%S`>B?K9u1P5&RMw?vU7(zxG+>){VGiS?NC7jc(RxbBOHu$Fv>ya&5_X#$_^7p zFNOzv6=q6|bNE^~IDqdL-*Lk?y!8y!6CU^#>1V2*>i4jy;#goAkw<~w-I2|h*th!gyh`J)c9hKYui#h1&% zU5AOm!^Fvsu?37+1u=7&Sm@wMrb;QX#KBWch6-YlgT)Tkbc~Ii5q{bUz909DgJ&h+ z_rlnvp5?;?0cSnuV5ywGObU?0uYSDX;6(>-IC#^+3I{LAq1PE(2b|0A6RqMIo$qHAQVKHwP{Em6)%@HvMZeB|I02cJ6lm`5WPW!oSDzmwi&xad1v zeCA*y6O~>M558YN`)2mE;eujXwcsl=UpUy}V7r4IbjQI~`t?&}8_gaZu^zQgxJF_E3=26JnVJ&Rv)8WjCS#jgZ&OpIQT`n z@U4S`1^fP;O!xz``0%J6VjP^HW*(9J;|{*(C4kvjCFiJ=IVKAN4_nyTnp+Gw&j+=vxs2dxW^`;EDqRwlS5mt~C^axSEUV5|G2`H6*6ynl3n{mW%gC2zKkZ`0=4g zT^CQ>%1htM+cQGcchSH_#zkKj4JquRwTm1Vja=OABFja#i^eYQanaO8GZ*(Z&1>Rf z$MpCeBgNLU@iQYta~F{V1wQHc{SqAp@`Zhn;nB{`jvaXDI| za-yY+RxUWD)6OupwXBlJb~cPU0rl@(bh#f7oA*m=3E!;=|Wx6!No^Q z!)-?jQhw{Rql>o=#|cQMoQQXE!R0tKrE-GZ?k-LgPV{uq%S8`4kwe}{(VNOg245Ow zmjV<{x=>uCT%=v7au$blm%ncxXrScf|Kc=&$_*E$3)h7w?Xg_gE*v>T&9{ZuoQPAW zF9kS}N@zJ1_H+4Ei>Xx;OAo{bNX^r`CWdnpT?}$Dzfoc^Pr=Xep)Q8VE;-XiieWB_ z*Avf-6z%GY5iZt^6eC^GB(~YN;$vKlby40!1rOugp!h%RVvdXZT#R=y!No)u_cI|m z<;SRMM!xwcZ<342JnaAEO_7vfssz&{-8nS&pd0+F+!-!rx|lBUhNk%Yc+*#h#U65T z=2mF7i&-w%<-gP0*_O*BA;HFS{t+Fa8R> z;O>kLgvDr)9xXcbi;o}8*X-gAssBwE?~E2-juyv9i(8|`YIYeA?t+VVUHmgY_P&cX zF5YudYm8_;Mi^rRnIE|L&;?cfGB`ozePaT(kBt%QU2Jgi3Ac&aD5t+ZMttmI%NX&? z7(se#jQG^WXD&9ns5w^9!cF_bt;Pytte7xXe9j8v;ujYuImN}7bkoIN=FeB5tvqoq zcDlij(rn|#i=!^~ zyZF|{K^KQyd?!`$n~7A#xd&vo^gp4)+=z*9ioi>&|LK4uFugnr4j z{&2ByoESe&P|q9V0^`rImgdF@&dXIMR1(pjV(eaW`4>rCmCP$H2LBkV@>6g%=Qk@! zuSq^#pq`s9{$?@v_=P6?ALmA0GAE9L>f9#?>U(J5A>m>2TcL&??(&f3A=^VE4|jWL;-RUBmiLLq9`5n*(0w9#pBN(B ziu=R{37UCm?%|vJL<Q>mcYL5B&gwK? zJT_jmls3FHAn`*glH(zl_InuXp^b+;54wkx2jQWuhn^mKd1&Y1UJso;bn(#M1F!fU zJ#>+QB-Z{C2g;`keE8DzbI63$KXm1Zm z4~mCAQY_!Y?`6VNep^iSpwW!-;>^4Rm47~7aBkXz;bEwUVIE9+>Y=}f0Um4*j)%S; z`f=$SdFg?Xvp4fx$`lr!2cKR%9M4Glc40wWy+*k2zj;IF#)$`d7{n-1$q2FJTCn=o zx$(iWOF&7QG+bIZ!ox`JdyOzHp{JufjFx3MdGIQc=R7>U0dZ12%=RE$k9m_l{ z_wbR2k3Br^;RO$GczDypiyqeOif0W-yzF6xhnGC8l$=!__U($__$GG8Z?P5=M6Jtt zuXuRX!)qQkoeaNDGls=K85)0bV4~&aydjsf-}3Obhxa*GPFyX;-eq8~RCv9F_`t)59@g=Q4M+?*m$%k~S}#~}>6N@|a}(=%y192H#o!5o9D)rVKJl=} z!`B`@rE4Cxc=%GTwb8@p5^VCYnen`y{oI}iRc$CCNWbv#!J+KJSMs)c*ydp;Bk6$x z+db@HWUl00T^p%9Ao1{oK$xM}B~|VAKql9v0E4iXOb$_&DX^G_%OZTpwpVoMln+(b&hY9)4q4_5mNid-#L7=i!=%KRx{A;i892 z9?p3icNmqq2`GKC1bs?xU)Ym3QYQiznW>nK!mX;*p7>hL79$wTXhDrjJ^Z zLtI;eI+E7)QLli1rw^7C3N-X_mt;2b@x??zOr6wEdgGzUJwBTFaD2Evn)+zwL-=Ux zqq&b3KH@$SK0)9+tQzdZWvF* zydVk5>~<-8q-2irG1>=xp}*vh@iETFeSYw`I+i<|6(yiC6rfWtl}t=zg87)?W2Vnf zo?r@{^6`L=sXS$+6VrTfkGN$Ok}+-{uY+9iK_An(O%nx!#!xWrnd%Qw56eDtqjZ8| zvv?}Ygl9|2{bi#)%=~#i-t_U7kNG|x@$smS$9ydJ@w|@(J|6e+jE`r1oZb?D!pBoS z7Wr7{<4GUy)e@&_i7~YW0bd#|_VKijF6|TJ|HvLWNmNsEM%NLGYKbLs?ouD;8|Oa9 zRQx0Rkx611gU}cy-;Pagocn^07k#|!;}xlMg^wS)#aD8nTH+<9+&eKU=d4u>V;#}C zW&BmCg!a7d%gVh*Z1Tu3&%fV1}+KLJRP66I`%OWd$PE{ zy7<(`XFk5%lY`) z$6g;heC+hG%g1hM-hm6TuXv~@i{Iahkxrc~KB_79HO}3`oS7VeeLk*Djjg%f`WqkL z*AQzai~WrNhoE3ZKQtXZI!r%LN;`JC+ zkskB;Ng@2k#9+Gm_{qmFK2G}hnYCq#I3dmMIYrRHGBpH^KgIIZ7^j))JSJ1blxX~{ zl%cFYjjLo(HN(#@;iiwjef+~hok8gg{^f~ak0ffIK$+>sSQF5wI758Lq&eF&(8FbAAk7=}=`nTuByGeV9`HV^0Q(D_gGFMIwUhsZ2 zRhX4Teg?W6N@k#B@NsUOLo`^;K$ET!ADk*u8Kg6Keo%}C^F{HawIfyrwwyRH11AGF zgMJzG&%n#T&wv7bGssB4_)AU!*JfNf~zAnBCTyhcw z5dq0T9A;)`SAyFlB}x_yfK1PHm>iZYIp>^n5>SGG1pj~_K@cT~pooY_5D)}J$(ir= zgZ|E`bI-3{y^38`JKIy;gDfxldeP4d-Y)LyMRzZHc+t&^Kp*SHu-ujxmG<=X;$tuR zc+txXMj3i@IrMZ9vKO%4Q_4_wY_|Sh4Dj-J8%BCD(2GG{4CdwVS}&*^+DEa%1LsgL zhH>K6P8-f)saczEm!GF@M0}54Quyel^1I`N%|_QML!pf^;Jf*z`hFY1nL)3-Lvx73-9Qwoa(D= z^5RP`e(>V37yt8OvlqL)_=Yphi>+RK%_RV(8ChjNhFBQ;;@ zr;raZBNRq|q|u8LoG?(1dhwGNzep`i{h8|>$}un47)F~{$fQq?uAbwZoSb7_JrBBh zsK0Ro^zx*lRRUXk%8PT-sfuMX89n30SugVYP{44Wi(6js?ip{#weP3I`ze$ADKFJeXO_EOJP@CI-28co`zZ(dDd+oHx9J{okFB5n zw4YMEzw(5eKR0$2xm2X6NL7*SujEjX-e1Y4BD-qc7+hXZY1`k*%UZ_tSD@n4{>rZY z3O#eH$g3isYTd`nqgpNey}y!Q#e@Eedw^0vwQd*|8=&wGVT%DuVHGc^sIKC56-87O zRq?8dvMOFwQH&+fSw(RbFG)EiR0IYnyel|xfYp88oSZd4c}2DEH4ZJ@Go zpz`BD>sIF#HU0WPt5v)!%VyM3!5grdtWg@wX5<~DC@Si**g*;}B5Q9sNNK>Ps?b#! ztU|@xD%z=dS4DV`(nv*970pyMRxxUj(nQ6RiSFftly3$p%~iZ3KCM*zIY>zvthC?| zvHeFK{!N@H6UJp|gT=%AvbicTutQ*mQS4Ho_ZJ=um??n#4{ zjUReGR8i(s8mn8UrZd`Eg;#~D;v*GZI0rhrY5aV!a$vCHlV67%F8BRH!=AUH z-Y{jniU}$vs+gqW!(mF#Vag;)Wl_w+FALbhshlt>zEQD<<)~OSOqs7@fr=R_X3A_? zdL?s~YTbdKtzwRf?}sUKRm@Yt+xUMCQ>Hr77FYJ93|AJaSfpZ|iZ4_wRW0uB=zFNyV3Rewwy{mz&pdNcy_r3QPW)FhV&&P;pwt85Jz;q>5AAqed#fbHIlyo163Y zn)?s2uzdFDtTfs^V`IS5(|laaYAv z71vb!$Caq!9~B&#>ni@0yzNFR3~Vh!*OAKPk;+XKw^ZDgN}0s##WpyGq_gUKD(*{X zA4%Q^q7PN9AE_{v4PXZ!%jIK7ejcg(Gg3+M0Y2pPA=SsD>B#Ow{!z+nqm&#za8Ki& z&nZevE+2CHke5%Ij8tyzNvAQ7&zilBMp>JlI*Q-vz*XJDO|_s8g?!lW!vP-(`|yGf zy?p5HLlGZ}`q12mcYJu!hhjdw;X_Ryiu>@A4;6f<=)BB2Nyev^#-dg7= z^~KDWeqXYj#}@sUpn>k3bC{oOT;rKDdQh9kZk}def01mfwze$TUvdl3vS) z+H8goZ~IWkhc|tw>q9+pW4-jr6jnr6j#BCiu*`-&G!S0&v*p%norkH7d}!=LQy-o+ z_?b45C@XCyec3lkVXs^G(9#FL51J3Hd}!@MCm%Zd(1t!fd?+Qi^Wj~A_eD7%tf;+c z2hsO@V6ilQAR|d;$sHw$joCAp4=ms#AG|)O(z`C=Mt@!fpNt_d3f&mheK33o`4E=u zrVnRj+~^$eA?O3$Dps*ZGU7wj$A=xz)rXi}VA6-UWTZoaL%Q(!_2Omi=0kTMdic;& zTKmyD5678qZ0f^N%CnY#>_Z~!vG&f`7qjtfj$iKVVDoY zeHhFcI9h2wS{cI0Gc?03Jd|^Fw8E+xPBl&&;loHD9;ar|lhJP3GRF8Y*2kC0WK8s7 zoDbv4jnnwt4YM-~-6n7ZMk|C#;x<{7O=Xs8K1}yvz7GpHkwz;sL}&XjQ-GFP0*w!Q z=J+tzhk3T0rHvY`&|#qu%SS7Vd|1pLjaGJ#R@k;BKCoe*h%+0{?2In=;Zq+U2Ehg& zKJ#IP51)$z{a11c3$s{ue6?`r1#XtV#)q{&tm9;p>b~%SRj@P$rf%ez`>=~fAHI~1 zZ};JAAO7dVW*@eQg`Qu@cy9Hf`~YhVw~3v=q8^P_cF1_{6y;>251aH2=Y|jaeE3cp zvsbPTNB&!ha`ag2_fihq%>Hs_(sGbh^G9;!hushP@PiMBxqb07xetH(a73y&=EE;O z9QENRnNb|HpQX$ORTM5jw(7VKzxr^3JJJ|ygumM7vI zLoU5+p1Z$0Qv7%%{8;pf=u=TTOdst?^&^`f+5O1j$LujmUO(VR`>h^^JbvW#BbP*5 zj!|;k_TU(WVbB;QpJd4|+PYC1vlsNEkROHpc)^d2W0W#}6cHf5e(-qoyCV{BZbD!w;t)Es6`F^#qTpl13}N8nA-l}nv8?(5-FY-2q?>if~akA{Byz^?i6mLG5X(a4X+ zehmHBaWADtOSQ(u8IC5j%yw+{V~Zb6{b=S#b3fkkW0D_}{b=DwOFxo+WHI|jXDdHC z`O(>r)_$}ROIy(nqV4>6SAd@F{a7){MR?D)yf5&9A0OJ5j((hI=%x?DM`8?#cJagO zhbrt7HAMY>Xae-t{qR>wdzRPqBVgNuyn>%Pp4r16B+&x9X!t644VYFh^T z(an$Ue)O;{ef{X^M=y!?_M?x$$9AfD(`xz2|2g{Emi__*Lu0 zdyWwp?#Bq*GE!ia=x9IQ7^^(%#aOY76CE!)L3E-Yf9|mwFvX9lek}9z2UDz$PxE7r zIFP3c%E!lRmq}{*5T3*Z)b& z|BYkGIVTJG){lK0JwJYIkSeV0g)Q^*X z{O-q3e*EmmF)ov_%CCOZJMZ|#kK-)7NS$6|m8oNu4PzA=Px$d0SLImc%24!hiX3NdPU~49tGTkE?#%_T!Ep*Zla0 zyE<3*6wh@({`KRAA2z)GRlnXW0y+=;Vo|@NsB;+wSx^W62MZ?0Oj^#rfXE(c2 zHDuF}T|*8HxisX~teJ4|r zmg$U^?B(A5KSyB=FKB3?VS3Zoi)j3Uo`(nE)bOH);-%a#X;{0*QH-o%99(=B_1t#H zqRH+O8eY~=Qo}16Dru;!p%kmuP)M>6>4cal!)fY49^9zSU!>w_OgMEKhiDkOT)r)0} z{>9^B?=&>htmos>GMBfm7dys>6hFTJ>t?@;{mS_I)%BPE+ zif{u_8tV$w(@@{GlpE=2X!Bd_czx&F8ahWZ>D*Y_P5;-2YC zG>q3ULBk9UGc`=qFiFE?4O2Li@w8m4hYXqZ|x^WE{*!8SspXeMD6+keP2 zp9832wuU*Hb@FYlhI!(gHC|zqS?Iq|JQuNQfzzAa%*X?BENAq1osiPveNLShK;h zM$*`9fy{(&$E5DKmCN1qfJm=Eu<{nknNO)KQx@xa8AQ%PLJQy zsb@5tmn?K+7Uunv77Z69FEcW*Mk-S;X}HWWf13G^hQBrIT-Fs0SNW;_^K3gCr4OE< z@Ql_q4ef4a@=Vmy2?{;0i$8y#?uLe&8j9#Bs)LW`+|qDI!(EQp1m(7<&+EFUS)cz4 z=qRY;zJ>=HYV~qF)bLd7OnSr_CH%y;@CBYJx|J(cG@EF4(Hx@CkyA%5VY=lJ$Ss;@ zwEP6Hj(j@ui{O7rbJ=sKfL832DR9@6kOt)@3yLA-T@sf@z zI;yhSLzNObUeQrX$IB8esiXEpg@H+>nf*ggMIDuNl+p33jCF4y!zLY1MSpJ(=dvQA6N09o2QbuH*Pb<-dsv zlL}2zc#qwwWA}Ndi%lJu&gk{BwHZz0;Oj`&k)flOjuw-wn`3Y2)~(>0I)1vE$*5zJ z!f0(tts_b|ZIYs}IvrDVOx00OM|~YZ9U&RF20EJRXr_b5Ya8nLA)oS=j<E4m0pEwchGs{2`6f&lmD5dyid-kO{R9#!GpfXE2VYO z(TNjavUTpavyP9%PTt*8@p8~Ar7@@iK2d%Xs!6MK9fp9ZBf$2&;bBvGM7G@R%>Qm@ zhIK@Ae5|97j;M~9jxA>#J#@r*eU~}hD?CXZmz#JJI)1N~PD_@Kt~$Eu*s#*mov*-K zVI6)TpKG2r_lAdgd+OFnn_i;5b$s@kr|M*-ua15?#&PI$^w%*!#~2--fA1WqV~~!) zI)?CylvL_ZwnD`w={#aFRL3wK!*%Nv3Qu2*&@ocSC>^79@F)w7JnZrFOV$~Wk0x8k zJa~3xtdzNbm4_uy&@oZRWN9Ir$9D2m$s|@iSs~1wtZbUBOw%!4=ToTIpkszifOtxc z&veYxF-ym69dmT-$f=y1tjyIhPsb-ZyycNR>YT4*fsTbb3iM28bdhcu7wcG}W9(7q z-X7_fd!$FN*J5hd4bG)HmT?Swq%Y?PU$6D4STKDDGEL7{AcC*QT#ucqU?V&gAMpe$Im)`({WPA zF&)3?_?2^>mNJ(Aal5sZA7`>^T1vHcpI_r5DHq~)THzxV;;X*!>jaaYK=EUA3J=WlL4 zB|UtO<{Gn{OQ*w49slUK&b_fh#=koL<5tP-@o74v6Q(GC_Q@zY!0r9lMbBH@dCFQJ zaqsH5rz3{}7`V?Vbj|LT z)QoHfzLD~?8(=N8P+3b(1NjWA<+%*xHjsy*tdiHTN~ZDT6onlm=Qpgz@Pl^&1Ix>1 zuFg}tuz?p0d~INdfg%Qq8W?3@w1F256f@AuKx+fV4ZLKas)1?-8a~M^VW5;@9r+`_ zY@qX#%#sFPG4R^G^nr(6)Y1mZ7bY` zb$6}|K0WuEf$9co8K`aGbps9q9=7M9qlN*eftx9cTcQL8msps}kVc+j8PmlfLzMP6 z1Zo<5e!$rz|dZxgMsnCyGJZ^z0c8*JKi5~kom=dM0sbjvw@Ec#0?}2bTQyH z5ImC}F`ydo88}%vGibnXKr;|v=&EE+RdfS}0n@<$KWg#ORO^X}VN;b(U%L1h#iFT7 z$N)8L;K9920y9P>drWj7GLiS4+pr#6=xU(5fv=`2-6Tp2&#d;~oP3(erz3kB zcyiBue5%5usvjE|Xkd_mJ_a9GM?VhBQ#V6@0Xhs2m{iuX4>mBwzz72)ImrzSGcer1 zxKxE9+&zP*n*W`uQ27Mqp$C~X=ACApCLLp7ELV_$6?8VNPf*hh%rKB1^o%z!!N5er zdbo^xX|3y?Nd_hxn8G>9DRnFi+N^UN_Y*T5_;;gDyxfx}S` zA48+hJi~fCZHWPT&Nr}tqspN(uvl{CUf}p7r3M{XRPW0!!Y2lnit{qgnQ6+WT#p7$ zg*@LUJp4n$Cb6!S23AS4HyPGradcR1;By0Oqzim{ZoR--(RHFU&pcv<&5SkBMfPo^nH4gPkC1(*7J3T|}{ZI|AAnlf#g@(V{`nnM2*27WVe z#=uzvpYC&?G;o@`RyWV@texw{uucaJJ(0#F0`*LnY-Or=&hc8zceL;Bxya3v9qj5k zFM5Hwx>-*Y)_1!9;P5=`7b)l znJ90fv~U@=u(0b@6J<@*AMNUV%|(Y$yYvbsDw=Sa*4yyZ!JbMcs+y=~qOyr9Ci+&d zQ@=@$_g}A5X-E2NCaRm(Y^hMCTg0fWg=oCYJ#spsBPj+dJ5MuQDM45qhg}2iT6yr zZ=xQXZKAn}cT6-e(U5I0(bxoE5b>6YmdD(!^4EUb#M{#qBU=qBUn0RbFf=jI)C6Cx z(2RYVt`NMUEtthb8xu`$aICjT@z3BG8$;S7atY=F=7be^H~nxTYEOr4>y*qDj9iEbvk zb4r-t^Y~pwlP35~JwuiN-)+JqzA~bRiJqqQE{nb#&+KVySel96ruEQ%49>CHv4+QgsL>wIpaLydG! zeolA>GB?9@Cf1wSVB!lCToiQXV%cb7lPs1mWd*(Rx@E62&Bf*OKQ_Qwhp^SeS0?tD z*lS`N2gk%NjzIM~Uz^xLOOqTsIir}%QHPCTOITxfN7`-^-$&FFoC($I)c(#rdrdqSanpMAiBG|tYw0Te(0baD;WrZ}nQ^A|pd}xl;Ugz}!toE&dTNhj zepcYLi8BIxoP_ps97)r9dgwftOuh_0yhBe$|1xpO#I-Q~3FESfzd0H~><;1zR}EVg zz^MSPar5W83!qZ~*SYzds1!iu0RA&^gMS(VC>XFlX52J!&%}Kbw@fQ~+eE&Ct~=ad z@1`-_75Hza^1#GH6OXv`#4XQN$N9RhZ71BWVU8zadCDpAi|d1Wu9N^$1IQM@hl-1D z+n{C_Cgc!6067J6iRQLb^8}FB=6nMAMf2QrTDO1#crn0t)Sz$xF9cA8(OJr*5@|K3 zSZ~KIDt+g*j0sOtm^|I*LK8{iWOnd4~`Ph0_OzT<7 z2GiYVo6G3rc{PBt0sNTm>d@9zE`ag@yf!wyLIAN@%E713iV{6v&{eIIr%C`-185Q8 zYj#jgs&)sEMuz~ZOZ4>soB``o*3;sOBLHfR0LIQz2+Lj!XQv8zDt?wO$3?-(9E_p58xf)A@$tM-YS6B0kjL?U8!Qu5bGXY8{xJAq&#%) znq}RfYahV-0elcZhXCFSVEpN{ju%|~WO#O#GB)JtAN70~us+@K4gf#hbq?U80OkfT zFMuuqcmo&`z|a8H0DJ-T4&dVe`~heIBm>CeATO!GDi$7e=m8jZugw4gHU|YlqG8d9 zXq4AZfZ5{#By2WYq0lFeTu+@{1Lzh&_W=Ir?&=Z1z(=lrkDN_9xO)mS+KW>q-9_jV zK;HoR1#sZ66n^vyok(Mu`R;l82QYwhth=XWFVBb`o`C^S2L&)VfSbGA?h|Q@4hvv- z0An}-m>R&y07eBcS{ie7x5HV)J$soo!*?xrKAELF9_ty$0hClaPY7U1LwCv9O1zJI zVgS@hqJ+r-Oc9=HTc!z24`7CEnHj(=n`Z|w$L2EKJo5us5Wubgb_cL9fJFhU4`2i5 zVE{$1Syy?9wBcOX{Yd~z16ao8v&ONU!?@U4qlkz6sW79T1+c>Al>(~*SZ!NA7g!^@ zR&<@{7ozPxb!-e^lhm~{fG-2++1AC{zvB8D@A{wUX3;I8TLU; zqJN2A61^y^S^)ppd_91Fg`1wXF7XY{(f}N%Q*Mdzb^x>guy&z4od5gz zE-w`9<>0HfsSg5p$c;3JQb9Zl;4wF@Ao2w9L^7rZku7Nb`FP6F8|X?2S~}pWBYO}z z#GZOK4MF4#;=)qr3lClYm2)32;m#FAbd+O8Q% zXxjdWr(h7&LO~Q3ctNy?DD6cBUKA}RT3qxc(Go$tEb#7Zh0gKW%IMij=^)AkQCX^c zHHfkTm4YZ2#Oju=ib3lS!T**!$_G(_Ny{A!pUhU++S7g9kAHD4T;oH3(l2 zZw8SWM6)282cZN}H;9HoycI;fAbMVR4z1}`+RxE4h`FoXt%O?#(MF)H zC{x=7@vd-t(GH^T*{Safd?0#aw$dqxCPS?W#-By*9K=UKbYXYeS@jMX?Iw67dZfPF zALNS;(1ZO7LJz{AXZh5k7p+Na%CHAH{q{HmoM3Yl0_~w7UoK}&!iarcq5`oX;31Y?;2jTv2uH{`k1A-VB z#2gM$5QBmk9K@&~Mh7t@h@nA@q}@mz7DU1FRv(84!SgVi-gS=%S_epS?R89g-=%D` z8b2n8u|doZVqJl3r+9s z+i7K2JCct*ZJMeiOu=AWDYuN*H^C_%?`G2=Ng11@Rr%bqEzh zya|T=LEH%9CU>nM4hC^Nh+l&^6vPi4pN6T&X!LosubhVkO1Aa<7{uXgX-9%M8bsG) zPKKWZeirRf-~DTE*DqYH7o4*uI8FrdTM+*S`JzIcs30Z3}RWzF@quE2qVKYK#c*R=Cxy4dU zv~wj_o)Gd1=d(TYhxq13t2Bm!ArulWEc$|I5z(Te^m#FaM}J!-7Z=M*w!K6MFWX#F z;1$tQqNPJ9W2e3!(|SK7@56>fHMS_ZE=Ud*Sj-`!Nd2w3uoAtH$tc>TuZdm9P48? z!W46Cy`yT#$!AFE)*yucK5;Y*;VoX)nU1$ZXfM!6 zw6Q4dO$3^T&`h9t2=55A5N#vcQnZz5Yte4)UCi4ygmw}ozZ*iM)*eEjjHT~~@IeTj zL-;6!5A7ax4563Zi%ua-o1;XIrFG%(h7b+Gzb$puRJR(!<}HrYudLnDN2BD`>=N`4 z3}Mr@1VRW3heX4+Jt9!&K#n^HT~N;Cu33*>pzas6FfiO_3$5}DIrW{2_Y=vNQN*ygqb1C3ZZG((>myR|8&|6=2~Fg z!=D|(oDk;AfXofy@iHerDm4DvF^^L*n}<>A0(;!Pn4>HXVMz$vLfFo!HO6u3oa+-w zT^i!M?690;lD`JS7XqJ#@R`60+rBb{RW`2<;d7hUgs|4;bs_vw+ViZO^&xDq?Hfbb zWb>D-)aK0sTST{p@Rh)xl`fX>wY2R(2!-#a?cgPzqcH3YVVCf3+wx5adxZDemT&o2 zz~=AxS3r2bZJCiwKN!OBtaOHBchU}r@M8#1LUa7spDrqgf zJ7T$O+wTe758;7rdB~ks__1x7crrC5jMOlSgi$n%Y++;%qi`4-KTFLK2LG)t^g<0D zimp1)fiS2!!^kB-&K*V`oAZW|PdLA50oz_spimgd%)u-#gspL?xYyx-&;4Q;#lm=4 zF!iM{>Rxvh@VJXhYJ*Cy{6D%&gz<71pI>*aZ0@Ra-`&4J?NVWs4x>*PeZwdd#;aj8 z2%}*bWy2^JhBFLT80EvLz#7A-7DmM|DoKG=!r1kvwG1nVG38g+s=u7q?s~4il0i%C zm2A}4!Z`3Wg`Z=qi~s9kzTWov4qqdToA<1bF77bW!l)HS?JzuHT&$N`Q+(1zxrb+j z5nJVYL$tf%;*VtIJnpCy#+zZ(3!{D*Jh780&UM3h*QF?7Y(MU9me+lIy}Nt|SMhHh zSLP_wLe3eA>#Z=}4kHpqG>k@JG!CO<7@fjs5=OH}DJ{Zi8Rm|GW??jE%d5He=Be?) zd^h18cKk~xfejv=r$#GYS=p0YhtWo=ZY#>vc5H*q?FBl7@t$pYKa3BAKNKB&(E2Re zIgF3O(8AEe=wf?fuHp@2%RYxH>J#;g(wKJ3(e-qi5k@GC*;+kxwjp8$u}?TSPm)V=ax(!&oEHwW74F3*!r$*N3q|c%yCEB=F_4sOVM?QRK5x0>FKm@24$?dleUNd1+X!9 z(ipxK*cZlk0^i&A{Q?I#TWrgrFy9MpcDDjQ_&8 z!R?6K+GtcBjay;d4#Vt+KtJ3G<8By-yW_|1xEIF#F!CmmFNp`-V8eJVj_Pqd3ga<-b2nU>ut?6Upc5u^zZmU=THcq4)~5wwku*P+2pS8s{3a0;n)m!ai)Ilt zkKmmMTG*+rB4{amrI)qz7+ObA{!i;aEQWRwcsYPMYP=gk`v^MNxjIJhp3Uz^@PY7$ zqPb)oIth2SeLjkyi}2m^R>^7vz6ktc(IYS-&}`3z^jzCN6_rN_5WH_ zqA}69XhM`pwQ|(x8bLQ+@d$=R&|T~o8r12}>3Y`PL!v!Jdx`cI{WyX?0(~Rs7eVg( zDO+m07+Bx{u@B^gpQj8G9W2V|5P{(@yN5?GB7zwa%#2`U1jlQ;{(F>mW4B{e1fwPU z7|}@)j1?FsI$m^w=tNOg$6~3IBbXwVsiMUP{~Yv%s+kez7fWCb)hTJ|X(7ZNCfuDSAqj z<@^!BX`9aooE1G6LGYpVnUmps1Q%?dDKf=-Ts<>Sj zy(apP=p$Gi`8R_9BDle8B;Od`lqA}3MQ~fV+F5HQcD(4i7XkHY1oy@M!1jC?!6Ta= zNAN_r;Q*^}`lm#Z8nrSqWE03Pnj;F>_MCFv>5wOiyiv4`qFogEqR1bGBZ?YP6o{f= z)Y>*nMNvqgm?$lUqj3b7G!SI*Kw;yc$K> zD5{9PoM?H`o==|dbrqthD3(g1l|@$atAe|PT%4rdf^ zL{U?Wt|;6BX||6iige)&+rk@Fye&|nvh|0Lp-B`i#L`r>nP_v-cSPw^eP(J)n_ETETDXnq*srZ?{caTPqsWS) zYZM)#C_KsGi^3npd*btc6dwqD7{x~d%+fK6PQslHE7^e&gsN_4bQm#db$e z;a;L_MsI{9>s_#)EIm*jErJb6gQ%{ z8O7)*#ze6#itSO1jbcLH)HzYijbdCByN0{Qi%y7QVic2vX`C)FS#(MiQw65ksZ+1J z=rcp2GozR#FxyVOv)0jVo_k&t{C9Xo6y*6)ED%^2#Ug>lqRT{=MDdBhQc?OZ9qyto zm*}S)OxwPEp0YBERZ*;#@%bW(^-+8-yhe1bJ#OowSa-piKMWgawCx+Ce9-dwC#Wx@ zc&DD_v)Q(6iDIkpSGJ}6MaS1s?1*A_{?wCE>|`Gq<|&71v3veX$3%Y-?c3(L z|F04~5yfu;tnqHq)Ze2x6~!M>oEGC1(KDhKM9)TXPJsS@3Y?GP+Z)eYcu_2WiC&80 zvcTV>^#8bw^|9n?6xVFaKLXdI_*dXR+kXBB=dCDiM^P?@@-f_r;%=1h?X;%Hy(o?? zbEL$O8p9}8+I>!1SK5Op9tu1XrRA}}lPI3rmXu4*Y%%LP<`&H^nnM(#IYo1c=CAX7 zN6HgJ-Wc-5kYDV~UMR*Nym&qz3dXQnc|M+nV|YRAr;1vZqA~Oz<$5uOVqz>VT1xb# z7)l7dELu|Z6;WpVo%_GdWdvT0p{&5#SFKi6h@lmKz&(bH7%FmnE?P6TQVf-2s1oBZ zYdmk;>jKq8UyGr-Ku7sD#1TV{7@W3eS`03m-7#Exu?`Dl@Q86@o76XAs2M}^7~YAY zRt&Xcc-!``Bk*Pn*M?iY&Wu5cp{||UAclH2*N@?f+wy5BmbXNot(r!{jcv~+0!?FR zW?Q%xn6X6+@5azRhL&P)Wv8}|p^b1`(RTlDUuJz4>JURGvAk#7-xv5Gh7Scg+IH?j z^zR(QM`G#1IhN1*+~SQPm;43y$DqYV zR(yW-`^PXqc%W?=Tt02E%|ir+#xTsb)cDyw!sd}&SvHT3VT{cm&2^3AMS0{JAHxJO zPK;riz$Dveatu?1r;0voWnJ;h<*~oQh{Znmj9pD75r49pT)33V5OaUf1a{BhCM}GpNp;$T`NlC zx){E&d3_9tb#59rN#5er2a_i=oVMtMOmQup@?@V&5maOLVvB zH==uD*c-#Q!q>dkSTWq(<@!!6=Tnm9j~Gr1&~irLYz*fF zwv=c%3 zVu$nHINHb2f!8+cwQq1x<= zBj0u>jVw^(<&%;PQB#!mfI#qBG|nRyE*kR}aYy60y2;r$ju?mNxTAj28u2(1aU`Vy zS)x5fyNY%b?Jn9wbjdhti|8fXTl8bmK5<+MTS@)m=pVbR!FF*S~9;xIjqxdJn6|Cs`_;+QQk$F>*BWle^8 zam=?Z3*uO4^CE%GYh0hiaW999r#|>Pou$IdM3;+xD*Bly-B!f0(&i!k9iPXsCXNen zT#RFF9P8pZ9>=e7d=ba`xb*^`ALG~%$Hq8z#IaLq+!V)Ffo-=_z9a~B7C!@ zwJN`|?c3tmZu8dy4<4lKieq;i2W=&MR@%dke zgAzR?`a>Lt1-`ib{1f<*IF5?tCs7vlv%s-9ei0a4%lZuYWq$XtbIucT>3t?%IyDgrP!Q%jWru@#&Jt5w?*%WLe7ZZBz-N~nOnq;+BU=L56V@fmA(}S<2;>yaC7N3_k0?E}&$K?3<&$WB(E_3c6Ug1( z>iY``6iHx10vi)3n!t+*bWEUA0>u(2oJ)9CI#y=qQ;$ z;Gv^@0_0Z`C?!x@w2bJhqD(EDKslRv(5r&owu%Wm`1Sl=tXAzV|mmS}C!I-+ziv)q{p zC=#tJ+EBEfX#E5l2<)`K(Rhn36iXw~#-c2T2iuxTgPV!6<;?}&5p5ybGJ#eCOWSzp zFtmibO#*GDgm$9uCeU7>LjoV#CBG-|zUT)D++A&byyw_bJ16i_0(}zbn?RQYyqlb1 zUd^waUOTUvfG+`m0-9|J@|xOgBwz{$Y|D{h)|?4RwDeski;5%=O(2#)TuSaPN_!%K zq|I5J8^YaeOJZsUeR?F&Q!Kqidy9T-`^?b7?;3!feE&qZ_r{- zCnqp7fmzbuDWX$FrzJ35V1_6?dB%@ATcYzt=Oi#!V4mo%3D%lgAWT@8z#`$({Ve;E z1U`}IQqh&7%Mw^F@Tur$qANtFb+&RbtV&>Y0-uXmr^REv!y$ zO5n=`P9*RflM>jRz`+C#B~YiQV@m>C6Zncrf%JwsYHv$mdjj+7xz}xSeQlSsS71j1 zI|X*x_T35oaHO>b?XfMT=PTa|?-Tt_^n20$q6b8oC3n#MLjs2-`m5-VoR&XW9Xw+D z98KUS;h#m1+4f%qj?5+_JaFl0>3A4C4sAwI{sMdsRaH=;556r%JC;Rfqa=P z{EVcY6+I`~WpnEJ1UlSsUJxZ*6!_cN zmAeW2D+T^1%DQd{+)Ut>z-`excIxtDY4;MiFVP30k64tQTHs2`W8o*Z<*7hQ5=>&@ zd0p;|ADwp#)ySSij^y)C)DXxinoBgdXr3hEO)a1N%$~%HT~Vwn3MNq~30D@}Sty*u z3rPf%2qjS@iK0ogPNEGxlPH!%S`wZliYM_>5@nMpm&A-0(n=)3cfqC3ae+ z*PbQyb#nlzdkfEvXH*hsbf={&Z9hKyUNxYTB+ewfci8dE)EZQWArUFcDmb4B% z65g>bEd*L7(aN@L$d%SMiFQeJ;KjO<@@^9CH#>OnxP20&c)zMqLXlE+wxHoU4*@&s%=jx2Z;_AWtl?+h9)sxRs=00l9-Uh#3V*a(kR<= zw7?kAv7EO83Ihw>FyPO}A zI4u05=n>I8IiAmrpCtOT=rPe>k~l7~>f`4=CzAM0EG++I62A+d68%H8>M+amY!c^^ zxR%5}V*Hc4kN}g;Cvm~%ivoX%UP|J!ZU3;D)&46Iy(){8(d!buVf*|m@Lv*!+&{l5 z(OaUoMem3*<6SN^n+xS}KTP5g_uecN&9WY8dCcWj(VaI7Pm*|=L`s&mdqb3vnuTn_ z*+p}Rw!LFrvYf)XM01PMm`9-F#gu#k`9%we78IpVA^sH*e!;ff4`sfXg<@H#CYIu& zrL#~*;H4~-5O`U%r06T6r9@fgksQ{?k5?sHF^fNB{QU1!If3$`6|yi|o-C*&(aN?@ zl`K>hu3pBvcCS5S(bq*CqBTV6;LO7O3YKSD7Cc!zV2lx2NY6q>7CL32a~9snLd`6^ zlZ6&psFj7s(;c<5P$$be!_S`ydo#;=!|MKfuD1j-MU^bn6{sg#U$lW}Ls4eo>k;0T zHZ&4#Y`3S0K+`NV6KHPR%T;!_%tEUye3*rf(hUAsGn?Hy3vIH{HVf^a7#1YGlSE(LqZ@Bf=h6pcK62J z-QE4e-QC?GcyPD;w+_62tzLWWciyd6UOm!Xbx}Ji?1^wNagr|8>z198psmr<75ZUY z3_g|n6A@4zq=XU?rbNgqjkKu-C1P+Qjwa%m99Oc|iCCD3MTr=eh~bHtkcf$iXg)(8 z{B3ACOg|zKBNHJqiX2UjAtfA}h;j7sD)DaDCpYRR$&!DKoynO_CZ~{76ETeFd{ZJeE0@~{Y)-0QF+{&D5!<=&I}%Z*v|%58 zC%KE!C*njRUM1qS9Hl?&PbT6H z$FWb;ol3;%M4U;)Stc^R9)k(NCfz&CBtTD*T#}2lu}Do+Js-|Ie zDc$qp$KOK#Frm5XZ9(~yY-z$@lvb)Y`AlP56UKgyEtalK7Zcji+mjtg>FQ`gCwgb{ zZsO!pcx{=-0m_y`4(I)gZVY&%3Oz2}mUlXDx3^bvi3H@d7e~WXlcmQcLA(3Jt z&7_62l826HpHZ~aWpHsPUBqRA+XRmZUM81MBnwh}Cip1&Eg36q$NBgc~y zRLw+6t$2e}PBvkR%BPwzjb7l9Hponq+)@v#O;}^XY!hCOiqD^2zu1I1CVYIYlh<4m z<|&^~SwJo{VUfzK&(x0pC0xO!UXY2P~`4+GV+v%-&eD0+0QoXxP*rWVh{)+oeIAB5r{B2SZ2bB1!(gsUE%G|!uG zfyqS^u2C+j%F8BPpq)2ZjGcwb&kXcopd$9JCTXqhcL*50{__-*uzIn}P zaxJ!2Awv-}^3kQ4U*<*snJlRCLS__JF1xrW2PtMoaWhKLOR4conjxF3yia@2Ep5gx z%;g(0(mXL%J8t!67|bx6VKJlrm$*1H8k;eBrZL`(1hd>@9KZC^mb|7J<;*D0W(887 zds>kq1(nRGOqVB&N>g6$nZ~O0YAUHtsbNODm9bJ#i_1{kj5=o2RZH7|Qje@}#+*k# zuH+4wG%{;`|Kh0>Vd|*#QD|&0P zjmq1~rkJ6va(gBnRNj%&$&Ah_xn?qSF{7&)-OT82MnC2~RBvxePcwQ^I@Q*;b{~3Q z(xcX{Kbr%{L^DhjDV||6v@NN(nqf1;ZbqBBdhd(afXT3yS2l+kPFA|iaGT*#Qw7ZM z(tRrNoAG__GG>rr$c!+h9ltj*(2PN5WU?T$1%u6UA4se>V}lt(%@}6JNHa#sGIUND zZpH{RPR}$JHpTyv7(cFWynMTDv>9W}SZ2m@4k%yp9c$L^F*VMN@n%dgW1<l|1OB{S#`g8H-dhk20TJV8%jnvZLx<; z9?9;5b}BtKCy4#y5)if0QH^#IT@}IbOnK7HzHNmD~a-Phmky`cEp!YSXq`YBtkY zkd~58^`^HV13e@8j>lLQ3$j`eu^?(eHVd*_P}_n!7UZxXrv)V}D9Penlj06i##0_ zIt$9MAi;uIRjIe2NusuQ3@VAUAfA3_tCp9wpd6d!$x0Sfpj0HK;Av{DtTLNbEciZ^ zBvqMIv!J@FtU;-1K`qK7PFUB1dKNfm8GBn$-+~4fbhM!IEbZsFh8Fyxrfo!NY{9P< z{6=qLK~u`_s^+iLG0o_EnrK_BxdkoQ{L_Lql$PXQq!hHWptbUpvy5%&?a20I2i046 zma&rsoh|sANe`8Gv7jrx8`)ju?xNbSCp|6b#iTV?r;i1FE$GL@Vu96y{`3K4A}Ldu zEHKksau7*u7C2-RF|?D9vufMiMfa0#3p^Ar=_94)`>X?O2FZ{GVany|+D0B|!5|B! zSTI$t{}v39)y!FGwL>@5f+a!y7z@&k)D2Uk4Yy!~@{yEL@mJESsAD(|1W(pTB|qjWi~$YsSh3;ttQ5-UvVt52YpRY^H3mh

  • I>>QJmx8Tn8UJ_{70^PH?WA?O=|B1`ZaSn|r>43mja?hyM<`J3+QLbkNAb zRSvFpkV}0ByT%v)aewgutGuy;A_v6|@||FBETCGifl9z_;Ia#gy3yf8@!bboMeTBGvTE&)q8<)dmY^7;C2TCG$waA=YGbc*4O`4yHR;Vwa!s zLz8I^zFyHJwyf!sSu(@HCcAv5gQu0uuV}*JGY-EkDJNko;t{+2SqHy9pZ`<+mUA7< zbMTgfWe(;$c+SBa4wgE2o_SSa^Fo5Bp#@C5P9+OD*n^E0ag8(Vy0~6+@REa<9V~Y6 zs)N@YyyAd=4v|;0bBZh~^WN%pdQxRBVPaI7ygK527Vmwy=-zaKhnc*>;YAv6?kHLA zV1+g|?*+S4Z)sgDnoeV!(CDH;UpL2j4oVaIlBF*1p264!&nfJCNV=w>kJuGm81c ztoy;ij}F?8$lu}MC+1SW;@=#+{%iiv%<8&L>ONNV3+IK+<0X4@iijUaoBYoGC)(r> z#b!>ypAPk&S+`Z*%lWs&3ii^sid=~XPtq$LR5{q^ zV84Tu%2{>5!7*l9sQh47a!AQx#UqMGIrYu*seC-EbHc&NEKev&a+|uSlsY^-2R>)V zfe{UQ4=IwEQCL}SD_PLZIHDVog(kS{BM8AKO+hj z&r*dtQJfjYg5Qd{L!NS0(e_Tob)%>k#kj8nQ}u3b+G$aK{b(>RJkE*YT;=B}Hc&iY z@dCvQ6)#e3sL0u5!`vwHqG%jNeiZF!oIAf_nPOoSMNt$-Q4&Q9mGDBYNfb?^Xci4F z>i7V;c@%^6Niy3~!VA1o)nu`y5wT_|<2ivP) zxjr)?UKYjWQ4G-+B~;)NAX1^d+UcO!QSpi>Iz@41G|i9{W}$d{A?H6n9W3in|!zDEdV4L50m*syi9sj>Uad zjXMc7Sm+M|aX}Odl`PU|zo7V{N?ua_vLb`b;J>1rre2NW zHRZ1>F3HNN_GT1sMd8yz6w7q(wsUe<6)%rsMHFvGu`8vK!i?glD1PRi97UC?{i67{;;&KsrsQ{R z^@rjPmHesvum4#4N9F8&XB4|szFV;o%q_iJ?ghO=IX0Lr;xZvluRop=}J!wRd{k zf-Yrw%NWYk=Ebq#4OAIAC590i^IK!+rNbE*!)@8|_KV?m<#(t~Z^b?;xl?&x#mszhuy@69 zw@Uge4p7Z|l;8XRYTg&aAgvv&@*#Ai(j2OiVJe}u;VNY2jEv!a&Yjj$J|Tt&l#f=; zF^XeVGEVt;#s7IVF@{Mhc~Eh(YCfcV%6~K;jp4Bv=Eg8DhR0)=ssWr6!xJ$~<4&%c z>^)=l$rzqeJJS_sXzfhJr&aQd@>zr$$FLz5TvKh-eA~)Q z=5wRiPj^AVWgPq24Q5-vB_%nuD@nCQKD~7+-87Gc^V%QnO@fc2M5OyiUJ_bN#*k7SPtjLl zTDcJq_S?+7P~VEf*0v#)iy~AKRv!6}epKZ##ke9Z#c{gU)>oUgm7kHdQzwoyRen}HSnqYS@_KQct#VqUoOq5_ovV0W91XPge8me? zm>FI9Ub|r&{VPqrP~h7xp7QeIXdK6NadeI&KaPSpTE*eUgLeUiaa^pVNG%jAj;XLq z;%E{_(>R*N(L9b8>?Mx#YZ-h`dTB-Qz-o4t*^-G-WR=B(SJJ%V<+V4LFt2_Y6Q*c6 z<@#3ck~mtc**0->RKn($#?e;!W$ORs%G)VtZTmPnD9?=OifpS+aa^hLt29Bq=zV_`B$Mtb^i=%5Cr(Pc1-E%GQ+MZ9_=-Ul(bdRG)96jT>F^-4gm=ecLaoilo zy>SeTdR<}mPF)|*U(+9;dIF4s`*+b$O z${}d6F6 zOJ*j6%v-R`;}QBcIgUCX=JRDJbLQbV9*JX49CPD%G>*sOm_>i$cs!1&aXcBvQ)=Xi zIHu`%84dQ!I0O-1RXm-|tIQeH+!5phJDSOe>3lt-E>S`U=xzNXYqpM^BjTfvd2!5V zDypB)#e>(}l=t-Wo{!_jF2Uyt4F1A67RB*`X6%cq$rto=fJo)Val8`e#~%pi;MF)@ zi{rC6K9A#d4eZ)D-j8F62ILK$1#SpSmAo0pTX8IlV|muYcj8!~Rc|Y9qa6Gns?GyS zilY7c3%gw6<%n2u(TjqK%#;OND`HtBp6UIAUPkVhWBa||IeqT=)vc#OS69`{>`wQLI&1!$L;e=pu^{3$yl^R>1j~kB z-iAyY7*wL>QY+g~g&?_AZAe;N zjZoc&JVFhsVdXw*Lrrom>SNT}R&E^|>XPeOPJKeOWZL64G_oPxgA5NE+t9>@UtQSi z!V@+$wPA`26I$mqvzgkOD$tzJ!iJWFR+j%H;VB#T4bGIXHkSXi4Q*|B#)ft_w720G zC-yke!G>pTXzV}}2Rho&NruIaq#d1Y=wibj>4ptmZFo-h85xi^@oqLeZ^PR*ydy(x z!;3Zywc%wOy4%phh5ydbQ9MCMQ&e_bJW5q}la%0h_GFxo_K85Bp8|E`N zb>EPTjNJ6J(1t}eEVf~Z4XbQeZNnFgSx)^@E*6JzDU)AOmsu@-&7{<`g0RwtZwRUS z*VwSuh8;HSv|*i9&lVfLwP8KOzO!K?C$rSB!S?UnOtN-1(cEmq_kQTRmK{ZD>UQ|;C}xMv4!a!=JA8KY8aeH7F~DPon~+*)QkyjArITXC4%Pnen$_q_ zLy{G+BWOoSJ4&TYJEC^;-Y&UtVLKwy3h(Tb;No_q?xQRrMOe199cAo@*%7y!Pi2uQ z@dzs^YqgtdLVf{G8cIF-puAPKf*sj*^C>8~c9h+fwn0hHVOYYBiUhgQuM#2ER%No> zxGHBYwaM;O&5r7J%$MHUk!ME@JO2DKW0oC;9go`4&yN0f)U>0P9Z$+UwBs>5YTMDk zj)r#BVQr~;>RMdSj{5&|zK_#yYKQbqA{#N;*p4Q4Ji)VgPBCYWoMSUPnlrZrwIx;j zR(7mUm@#q+t?g)I#|zAQ+K#q%bR|DyM>{(@+R=&0_I7k2NGX{o&sr=s$i0VRcD9@@ z1ZhQP(Q|fmWAb?`SK?o^qr2VQ-h0sOV@FRyFFSf$Ga)s$egCJ_0P=7t@t%&o675SzeZ`m=?j!AaBZO1!yjFpD? zsxi`zQ4D*Rnp)bU$x_1@tG01;#xpsAEFF-5$#%SF$A@-&MDu++rV##n=EhVzKASWNXt>3+fX)W;1t=9dqrNNB-1~&+O(+vZ5f;t7a9~;A%V8uy2yJmN9bg_J1cOu-=YMc5JreJDI%vgw9k&8?f8Ykd+hktF5lG6pNf~-_F7@T zalcA!AO{$HM2608zH}b6;}D(0R4FCJk6HYO9mg#`K}cPollFgKI{&2kmmN0Z@ z@%Qa`Ap5xkaF{#ZL$1Dj4x};p-_D$$$#e%Y2&p^kCBC2oMd%0@a-guqa=x-p7G+W{ zncV@0ume>ca5~^}AnZWI0k;Dl2mB5M9PnCYRf5j}g^+rxp+=UCRCoOQFa&8a=s?IS zB~PnJ&8VmY#T_W;KzRpBFt?0Do;G8YB$slaG(mRb)E&f+ILyaHl%*M?O3iTx+GUu} zh>#=Gfh>o7JT%8gUSd+3&18-P2|`6`t^<__64QT7dS#2HRFeFtBMSW5(G+(x!BD8j(jpaP;KwFESkx{bvxzTCQ%A0=& zCOhz+1Dzb`>_9&U`m@3=4)i2+b>KNdH|mQHJWqImDrb~hhTR?LK__);y~w>C=2Lz8 zI3U|&Un@QpFu;M=9eBfmfeyUnFke9iIWW|Lml-x#&eV!e)&GhEuUXEkj(^`946~e6 z%y1^hI55J2HywD(fwvtPMe`l%NGo3Y@Gd!Z@Be7amwLvM$2lC}Xa9sAZDQPDh_`{lAsh*#5 z;IspO%K7sB!&wK;SoIWnIx}@@5_!Ra%k*U#UUc9RIrT~;xmTnQ4qT&oUA7Uc1}UC8 zsap=*b|9Y<`JMRN%Dv~n9r8cayVO*R_Z@h^iaSxl36%i> zsE^`qPP}0CwmacP zxta_}UA|scZht3w^V;>H)7Oc9gjBHT044`I@e)CvA~lF0y-mdob>b~2-ge?;Cth*l zRV#P66R$Zj%!$|Oyg~i1TA2nT=)6fy^{UJp>9Ww?k*TsSZ6y77sj0TcI5C#V=}wGu zV!RVmoS5n~pENbWiOEj$v%^FuCNV~aRHl}wtn~Ms=4aCPWtGV~rEbS*I>kcj0#@_B#=9A?U&Z zCl0bmeisfoaoCB!oVek{5hsp1afw+{)iEbdI&q50<4&9){6S4k`_oqBc_;p~_>2>0 zEj~v`O|uK+i&QCo*^0U1#8oG*F`1eJ*R5rB(}`R3(_H2@ew%z>UIhqusN(4bEV?8p@(_P4Lp@7TWC>$<0U4RP(UFg&@tB?ytTqx>7VHqe+kJRVN zVk~QuV7}PdnM?(^TyVRfxS+b=alz|?kGcQtHUiR+sOEysM*XgTKewi`QuTybO3o-o z2)ht*A?iYL7fQJBi1b;0|D9Q-TqrHAuzM0OP=>w)2$!|$Nd?4RDCa_X7cyPQlGa^F zFrb3#|NRX)+x73K(Tc8rA9r8Xg-TXExrEB1mNR*0xgtzBrtV3`{-L=r5J8k}e7x1*+> z{G6IU9b9;pRdtkE!CYDFslUs~R?x+Tt}Z<1LN{jhcHwy!UT~oolT!bSgdWuH)|KkX zWNO4DMz&>XtB(tP>8JWLz=eS>jHL6D3xiyE&4pncx4|yFOyBIk3q#2=EONYJ`L9~z zCNZzOFv5j5U3h~tXE?i&I`Ov{|28$Xv%N!3o#VS!ZKGTmO-{XnjODH(8_PHs#*-&d zCsHR_xswU+QQxP^m``=#0~bDY;UgE;x$vzE(?t1jk2Nk#cVUJLAG^$Z%H&_|^3OYg znJ&z7;S(2T(_ccJL!C>VNBuOV@}FhGeCp@a1=NKuEFwsqiwWP_@_%7DUlNwO@D*Vh zb-9)MwF@iAD=p_67gkxknvnWW=vtTgJs;`3e8XqG%lw|t&n|pN5Z*x8=)xw;*_;9w zejxlv-D2f#bzvKMyXE}k!VZgf5_Y+;n=n4ZkS2a{VUNpv;F5g#N1kpWC%eyu-&}~f z5qF#aCi~rmhc2YKv0o+$3m$ag2th8yA)d=&m-#&e`Pb@E7mm4bTxKBe<-E$U6VyMb zCtWy2I8Buf{7E?Dl3zPAPyZbCJoN(gB2}_3xp0|$#d1pauPCE;jbnJ7`WN+v3pWXp zdy8)2QcU`zgzE6E%`E!S7NQ?R0DC0KgTYfjv-NI=evMWl!BW{$HGp$)+1ivSrCXdK)qr4k!+<4lJOgFOJ zsOv^OH!8T1%>k+CMvgTa3Ag;bSC$l)s$^J1E4j^Y_~g1#*=;^DMUE7r)JLf`sZzEU;W27$H|h|+$S@>J+N$qH12-D7S8~UJTp&@o+w^fa8oABK<20r= zapUaKm?WQYqp2IsXo@4;+>I8@ZRtiUE9^!{-_z^pMkhBq%k}D*C0X))ye@8Zb>lf+U-|xwj8Zo@o@YVf)L6+$ z$kPc)?t$CHlKa;1`EnSNuTA(Lh=ia^xN5#hAQF?3_S8{fFGO0J+YUCvsr?`k*JaB0Yc2W8J(>&7~co3tfYTmrsxV}l!; zc?mYk^5NYylDml$MnKk=sLT^tZa=W~AE{fYTdCXJ*iMj`pWN6%-f20z+}KV2nfePg z^_V_cJHNWI*NuIg&%e2Gh#>y&g#FY5)PvNrz0xK3F!>1eDD@cixEm)3e^4dzq#LI! zKJCVz)Vfjg*jAxPWYi!WZ4R#1Xhm74wQ4SIO6?*QtL|Z@6)jaLbMR z1c|>*_?vpijeiJtt=xOOniBTFavl=WJmwCc&x8B~36o?258y#zFN%0k(1SuAjQ3!I zI35)7pp^$tdQjAZVjd(ssOW*sgYfJMK@UP6*gbGC>GZ(kf!6~UlWuB}LAes?^FZ;y zPe+of2bu@E2SZ0!l4QvqIiiklvqb}paXGSt!yZIDDCkXXa4VRnTwg_5Fi4=OOLoCoDS$h694d5~ODV{nC>2Aj-2WYf>Fa`W}d zspLVf2akDB+k?uMU(JIm7FQ)CJ!o1tAvIL@AkTvuG#|BM439hy*6dGB4{Fg&FJLBD z_Rp?k#XR9bT@UJcP~U?FG#h)+knp$%jR+f0noWF}Z4Ok)KTU2z-w~_Pl+etB<{q>l zOKwXK{%M*WyK0Vu=u;lF_MpE913YNs!P5-uL2XOz?7=f0wDX`nlh0D6YzGf|H#4tP zM-MvD{On}nrQYV1?czaKI?s9Vyaz9kyLs?eWiwZf7wL4THY#qK+bfw>_4J?@&E6jL zA@rs8qb})To@2PDsRL!6c<{0ZFELA;L4?87A=GdGNW9{~s~)_~;@Ld&_PS1VEgOPOJ^A`H~&az5PM`n9J(DfAT~(4lvLC3lF~ZV5ywuZF4%warc>uqF;Hi%p>16$(7^v0=X+Z zSSf4DgI%oW8xPicu+D>3OiKJ}!Ws{Z0!G^c#pl36$qm$v)PV(z8CA`0 zfA7H$9&Gbqy9YlqYb$k&2i^Y8oKV2HT+tl!+wSb2=2&T=?|E?Fg9qe7UURR0NKW(O z&$*TId6D0Xkwvr9y(mCOIKzuX!{q)@LLSyxkmkU=+%YXHNxT&A(XvueFN%4g_{`dD zUf8{u;l;;ZIJ|Ir@u(Lyy>NNqW^V2nc~PAZC~VGcIchLzc=0++rUvSni)LOl_oBX4XG1R?p}=bVw@K}yy)pgFE4s~G1!YC zUi4vPUoZN3F_q(1>`tZrUJRf=zKS{WatvhhB`*dM+WeCVg-V^T{eUXw)Yazrd?ZT=+0{R-Fr8&n8~aQzW_fYniw9nO;>Bz)4ta6d zi#cA*^li%Gi!Z$R(u+^M_{@v>G#7fYNY;)Q(Qf8YERc~OV$Pz7BPZIZ;$p@u zk$Kpn(%6#OqLQ`Li)CIcXVzEL){*S52`ju@#AyrTCkC`m%h}<@PIAwM=6U^0{)Jk2k9o?Xdt^qf&ivJjy)rWX zynSB$M)=)}{xHND>(3LF-~(P9WLaTlRpt@$Y1sz7I4U!r$>Y?MUYzja57~COSM=y$ zwl2ph=8k=kdB%&gReVU69%gXsPV*rjAwO08bRTR_o3BR&e1H!H=@%2zheAFS_Mr$52`I{} z>T}IgJ}X~uWYXn>+XsgaP9Fw@%#oMl;F201t9~z`QF@loa?);BP<_yt)O{#p`FaBoVk-8niHmk56?uiOHvCJG%}lHciCh%z4NB2k1(>VRa=Y@ zrd9`&Inxseas9%f2zEhZnM)~43+p)R2wwLVoM8xR`$@Hk=4 zQ`urRW<63>6Cb`#H3iibGpnBuXMH&5Lw}i0J`D8XB_F=`;RhcE`7l^&@Zocx z`46BWKD_F~YviHSmwkAJ(4GI?7)BoJ!#E#a_u&m6hRfxqImU-K34KbYrGnq`;cYta zP)AbVrH=BM&k`R^6>!zgNR=88FE`$Y4}JJZx*9Jx!H0>2Nz}j>XcrT$bU8+=%GvC2m3CaNSi6U=}6%Cc$`-|fTC zK5X$}E0f!NxKZ5vf36(c>HI|9Av2J$i+X*J8S{$|dwk~C$?7Dse)VCm4@Z1B>cc)C ze)HiFvn2O-9}f6%kjeejr7e=b9WrmDnAtN!^stqsmrOh6!*L%@%T`dR>IonIkhNUU z7+*Q-qz`hO@R;3wKHMZo%q_yHR@r~Eo;yC&@09b84|ipOEUIu%rr+AkVv5Q4={)e^At8;X z`1us%SCFnC!*U8KC_o0apymH{Fh}AGGg(AIQOhs>d8SQ)T`}8oP@UBIvnz<>Qs8FN zLltL0K|@iXDyYb1t|`zJWGSeiz^~xr1F;}gAfU)&bq#@#g0S>(QEo&*Ddt8MytN@u zoZ<>bIO8RlTar3+VQy*0l%YOCElZ72{2)2=3OO62|I!-B@9E6IHik}?DH6x2{K zUBL_mhJr^GysqF41vM4aQqWexGYTG4P+P&%iu^irypAHjQXOwat*fA(g8B*?C}>Vc zvKlIAWbxw)lu{MMY^MySw^*Y6^v3aTEX^w)h^_#*0W>Q7zKq38B-LDmC-9wZ5(wxbpmxF zbrN+lRi?yy3f{L^O4({vORrV!L+MzvjE@vdQ{=}`s_kiCrD8_4N!6;Iu31fre5_!m zg0%|PDVU|;69sb>%u_I1k>_|P=P2eL;wfYZ3zRQpd`f49%&ys4pOG6!v*#=LT)_eb z!V49AO%Ps0Sgc@)<$R&wOY&0cSJY)z?s8cXvnxo!e7`1^F3eoXR(dR`^o@d5GBFlZ zT1{O;mE@N9D}Jk(U#HxlV55TdiuuLe@2H{SkevC94fi7JWH+MMg|PzP?G{faEnfP03R5mn;O?Cx;~ExUJx(f?EnU6*3Oa%lfsD zak`N4w}LwixKqd|QrPepHts37FMGR+bQKR2JXDaTBA<%&i?Xz#$wRfO?b}@K#eT_Y z-ID_bCCe8!GE@{$0Tl&B`y?lJPj(xa9MC-(Tas0?ce0R*Y9A;2_DvR6QAEYme#xTL z%7qPKy9$Sj(kjZRaH?>r2=m>YTZKo3rb1WYRpC>is8CtefPTrUgOV)iuT#sZ#MN~y`6(v-ZR8dNm z=X@F^ha|6UPHF>_Eqf;0FUq>|xp|AzBPzC zy!`4xc@>!|1hS|C6$tWrox}KqYW~VbMXEq06}c8mOcfPXr8YS!71epx>pso8@mbb@ zY_ktry;)DxtZb-wRK*)AhO4NlqLzx5Dq5*{Ohs)K%~-0Ain>y*ibg8xsi?1_fr^GI zx-7{WQ7UWg+$_0p(a*Bx>?z+z$y)WWTw@hYR6L=gsf>n_b;XyJu4Ji7mQBf;(xCi8 zZ&ugBMswEOf+~*=D0emMNfl42=%=E;iq~ zEN_Rbo+^5&=&hoUiVHQfmhY<~Z~O+9$?B_OOHNkr!bbI~Suf>ey*8uD0J$7eT*b>O zUQ#hg#b6afRC#Epkz1?U^uk8DTGc)+Y!t6mZCtHtn+qGS$SJ6JO~o)(o(X9<%2Yg1 z*f?3(P-|7&ejxjGj>e_J=G`A7RJ^HT9-X(OLg_I19Tg*0j8!pC#k(p-sTeJzApz%; zx268`$?r}l-;GwCcsO^=C(iRk2PrUu(XVtF|uD zMZO>*KU}`5!p}=92z;0xI^({?FtQ6-QP4M*f{DW%m;f zP!CcMQ4doi*J8(1^VRAP6(?03C!e6o#{}_DG3+e$H1$vF8LE5^k|xfP&r>f@Wt7C1 z;}VmXRa_y6b5+GPi?0*@qTZn1RB_A7y{+PJi)F3dRdG+|e@|H7wCkSVIvF&uZwX zp{Ryp8geyM)?m|M*AUSV)y$_&IyCq+C>k<@ai<2C2Db(elU}O$U4wDa^X(G0)9I>) zfMz}b#CbKQX=sx_u50iU-igK~8PpKcP$Pd_Di0H~ix`qDuAzj6Yz;XYN@^&jA*SKP zQ|2Q$N^5vTLxFI-j0UMz9LMQ&NtUJAXh&{bLpcrQH9TI#$YSfo4<<7;yihhnK;kRV z40lX?cs#dz5hJ0YqJ|E|Z(ReMn1RWD^h2r-9iN|CZ`zIt>S3^AwEj6^#P+vm> z4Nqujs-Yn}a64cQ-Q#kBG&Gih>Y8Yx;m0nCIYkUnIb@WYX=pC(7M34pkLOLzYay2) z7?%zU3p}aeDGlv3wAavD##zHNye>~`kofgQjQvH77tiLl)gUZRi=GK-@w0QeN7^Jh zXjpqCw){bUQP~GNX?R`+O*8j|&eSd%x)Q{Bj?j%N-}QP?MnJ228%zus4@R)zHu7H%Os3v4C|Cg^=g8K zi9Ce?Q}ZgU$a_!2`x@qH_*BCb4O2DD(D1Q_4>WwJVLB(I+Gd0Z8Fjp@6mDnddwK-A=b7yNO8>ji@=wOMbYv2)XYlCL=^Hg{(ojK1 zwvNpjzLzaUhfT*1GM_b^*Kk3@77bf99Mo_~!!`}uHTsY*Y zv9z5UcF`$Y%y_4&`I02Z&obFg=Pvm&_g4*jW!W-dpN8Kw{7#mbcszcnW;{JRUbC3_ zcLq5QFsp4bEAs|F?!a8vbEHiTsDAJU?pwR|!epmzgZvk&gU29?E`bGf%TgZahtw z=j50ixSmYck)Z>!;p^t8=HzD7uo(q(+&z_dXkem{j>0;M=qRe=*(GM3BfiNKm7`Xv zxVk8@b!DDiheJnk9VK))b+~jWI#eBQ9hC+oJgl~r&1k#SJQuGHADz6y|6VCgM?gnV zhfd#5ZFeFm!66;L3dh5`JV3^H*Jea@)SjDIWi#rp%qyv*>78U5T^{#g zlwymebv#`72ZsG_5)j--w}I@NTPt`M)Tqm|vbo@Jh0lN?iP zFn4_Uf6sT#iDX~9@$-`09_8Y}FLG<^sH3Byj>qLf9Lue%%PssytwenC(nLKSW9&wK z9Sw9y@!O|!WuA0gnfLr7rfw)6Z=&M~9nbkuQja&)(M(p8j_-9e*U>`96dhA_w3Pnn z=%S;mjwf|IrK7EmXLPid+#|6O=VPL6WW=QP^RZXec3H=> z>_r_tb@Y;}a3t1UuA`1u($b{$?&o9PL$TiU`{@wwqoXh3xeI1ie_j4N5U+G4Hh^X) zHGchgY>M^1MFM@rjPvI;QEE z&R)%sX~VXphcdjPGwII~-&tUpv%nl3b9F3`b2${7r{hx{{V&Bnm-!=e=|XHiRiKQ+ z*nU1HJrPbijD@_Ki)3OrjK#X#2vcB*j<+Y}NhP97b$q2`jgGZCmg!ioW3{ZcL$R-Q zY&aUrybxO@%^i=e(6N#r{Ec+`Os>Gb%VvO#uyl2uERFNAZ*{DfYwa*3>pRZ3O)Ry6 zETgeehs-pAx+`<@*Ny+6<44)7{7Cm>i;k^2&gwX)W1EicI`--KO~+3i!t zn8Vmfkjpp8Vf-vhSjVqCqsNcNdew>Vk#RU`p1usuUe4!fb>fozUB`YMr*xdwaX`mG z$9 zQ+A9i<|X#a8^uGhGjbLg`DIwn>$srfwvNAbTx8`pbxb%EyQJf?jw>=yhhs8m*K}MZ z=UbU8&UM*-56Aw}af3y6JB*RXV&dH52+Od)vNHFMj(>FA*YSWccXhO>8<(cbUCh0w z%RR{E(s;;TrTNX(Bqt(0%tuZoGvv*`A4xx|`Q?W{QP7X5AI1GBKV6HN2Vt-(gUW3h89asz&Z{PLT3=`x-{DR?O6(c)o0B7SpH$(V~H zP(t=SKjMCr^P`j>rTsXWmiCArWu)fIF=3gO(hcFVesiyr?!^ewdU@%&A31&`{E$|% zSfm0~k`1(YHn~#4G$~%uk6b@0`>||AZY8QzTU)Zu$Erw|{8&&gE)!VlUzw3!-H$v! zTKmz)j~ad$emvnvQ$HT{qoyBq{HQB6pEvto%a6zW=H!%pLx!=oAF`!LRrUO+FTNj* zIHV2aGO2M{9VgXzL%-ZcZ3whg;*I@iBG>3dER~dXDodc5AI<&p_t^N8ezcI{$78K{ zjRaaUDV>zIKFr83F;DsB7ednnp7x`yAMHhz_%nXUjB4mKWDwf<&G~r}X)<~p{CL)n zjxxxqIe)qkI#E0O(e0wyjjnRBF6PPr%1+YFkLUe(!H*aH=G@Z*OU60i9&%#YXoc*BpC%o^^;2tQ`} zF^kDJI1|Z}sFSJhQQxOZ@D!Pc zetf{>hki`A{Ez&Y=9in7%?d?l(Epg4GCv{Dx8i3L=J+w!a^?{}^~)Ds%t08(sy-(# zpf03J)*?R^`>}+{FZ}pQCbl16TDeOJvsipN`D;u3>PT4CeC3pF;TUH8L zlE-CUk@xuVD`Br6hppUwe*EUg?|$sJoP&NGuvn@+M1HYf6{$*&BTOEp9-~UY3Bn)L zlhjjGi9b#FlX`}FmU_;Q^MngjiCpS5e4poD^5e1}SNyo@$2Hkz11J`N_}BfWKJeo& z!VT)P7n3(-Fa zuotwr5TP)&NB}>w+Y)07z$<0|c4j%K;yVLyS?mtLLte=~C;_Me1Oo`s)TlbO%ICRK z)=v%uAPq@UdLAZ}2_QlcGfF5PKnX%gYAI^z0Maj+CoB3$0A&M+1rQG)hq>hfC{M@^ zAd_&A=OSiS02O#hSuscTt0Evrf?+Z%aszM=s4^^o*8`{=Ko!|`b|$L^P%VJ!0VJ6e z=d#lf%?qGS08i7b5r7fEqXE!vpckQc0D}m9sFKw;fPUou)B)6i zR_;rLd@f_K{X9z*_;l9l-1W z<^=Fg0P_#TKATqM!vIDG@Gg_10+>h`O&voWOO@bpgz*7Pu$-cS_$2aV%XyFRegIPl zQ>hz+(XB_ENeQKwVIoDsms}@OSwfZ=St*UI`abf)Qb5m1=P<2 zSYY`J35x<)Ops+_p2DTvFQxxu6Nds=8o+}~xnBh!gRqRcJb?G`=?xOAv;AfVSCgk{qCn)v*%G|xwRGq((f2Z!J9thwdA=OVQept4k z%ehCW0!ITlMm}yiCkTH~Pf|}&PgDO4;0!?~gA|vsJull)5V0UG1aL8cS(kDz1#l~X z+vLjuTp@^mHGpdtUk~6fi*FEa29Ow%E@6KMa3_G@F6DZH_=g~z5yV}K@5!!CeqcEd z14s*+MdZjw$R9*HL1seAFAxOi6tp4>1yMMNB1{$y!eRNvg0NX^4`S2BWS>e&Cmk2n zO%*d$vzJL9RS7~3LJLA?GD`JRB{&d7(Be=K;UFSGd5(mUs;8XGD9+px)RNRvL6jzx z3E~lg1pltZ`hYL;I;h&+qsjl`ot)C{5?om$k|R_d5AhR@N-g*6D5FZ6G zEr{u|?m{RS!i*q34&tXEb_6j~N(J$C5G#WCB#7BTEDT~%5Oac%AEPhxAoe+7ZV>Yb zVtyLLXXN?R<}O3b1>{~X<4qSe@k6Y{f@eUx{)fSHW7Yx8D}OYB>97^l>4zC zgSfiZk><;4RAkGDGK8Rm}*b~H|AP%Q$4r0Gm zb}wNc^|v5?Cycyj)^>n=kXpoTj@S|M8R}8$G3s&Z3F;rzlhjkx(^M(`XAlbOIcqu6 z&;|042eE5GTqIwTDSgBo;mbi>p>vhm{fybG)WF`LlO8g!_)R&rQ?Xk?+@|?=5ch(( zPrf6s0))F%3I6C|?19B;EdG$m@@^v^lM<7kP{(a#giz&FtUw55{)oxZ%xx43p>PPn z5JDjo3882RS_pawiF2`HAvi;DgBx|LwMP32$Tw8 z&8^%r(zonnX|f~_$C6S|zBN%cgjfji5XyznCItCPVZ$Z~rAbEl5Hdr^3ZX&>RYMT7 z;nm#i5Gsc-ze(alw~-@f8iGJYsz4>_9(k$TkYp7`N^rkZ$z%xCSV{E|^5on@*y=XS zI-4Yn5SoV2EQCixs2Rc^ZewVZM6D1W3!%20O9=HtXb?i(R3Dlo?yz9JkbHwBJyk=) z5TwITFyQeJ8W9>>@l6QZ4rQETd~^9PKjFy`T7+=)P;Sc*T7~4kY_mUe|H>7;)Fkm# z2%@c7RzQX&zbEaP5ZZxHp zAekgud~gUu2t%pjyi9n7`YQD`>M-i-)HkTZLl{AjQg0I8qQ*VO$PnHY4&kei`5|;v z2(t*ILl{FC8^T1wIO=$r_MhiYAlLAiAL`|pB$JI3Ayr~NB1{Wm zy5-CW;bV(uhUB*He{24P=IjvW5av?nQ9q@AMwL3}hwwRh0d*mD5p^+DVwQyPg~eYI zx_OLcAuJDJeF)!$@O20)WC7~&wbYd%tR{Rzt)$0Sh49U(bb&Q=4xCI%@VXH0)r$*! zOSAf=&2hHmQS(-w$R*4UFAv>vsZ4$ zju3XzIT6Axg7^nzy;%Hn2)~4|Cxl-uN6PNCcwY#=S^Rql`z<~ov$S6osp=4&!a`HA6aJz$%Se-~TOr(*feqolyj7Ty)uC^d zzeBha!l>sH|Aa8lV+h=pojflthwuYg_$SiS!^jBZgA&PyA*6*(M>t;?`DqG^Qy>h4 zQ8bKVVf2`iE=R#I3WXtCXyGu55M*DKq#ROY=iDqA0bAJo$MNP@D%ittgdre@li&)& zO*qjfA*KX-!|;X8i>^=w)G!uaOlnj;3_n4fRURW0MmUU05#&Y?37hYfs)SKBjA$6e z!zd9pzkE_5EVtC6WEiEGEKSV}qYOa;9wC&a#;9>>xiHETB&J8fye#r7V-k{-BZtY# z)I=B+r5og2YMndzBxdh0GkDV9`I2E&3!_^Y&xcW6#lg;66c_Xo-?^TyWs zd5?xM`+ml!_cLmSaehwT-Uk`|4&^?^_}bJuVbl$y9=R#CK2>UK5Jp3bA15>lqp{^Q z3F8U!S&t#X&BAETWQ#D`gz7nsI93*7U$hyskTf?@s5ON!f0nX?ZfCm zewNznWUhpDvT{2Ux`fd+jOWPz)&D{&CIW8+FNV>b$sS?69>yDC^bDgHo!(&#PDK`o z_X(pfxu50q4`Tp%AoV5cAS*Y`Yo79uFos&r%Y;{`uTo#54hv&XMga*P9>$0;4$*uw zjJF8iQQr<@hRo+M-U(x581IHLDvYVjl7gcN6R2aTW2xh)IgK!#>f_nX4CB)7f=_5v52rZj4ue%;*u~j+0d7Cl4S9hF}XI3!pbnd31byG zRYP5tTJt}S`0JSbmbyNSRQ(&m*hptn7`wvQEn7qw--q#oRdyTU$1t{7&ekx#dypX& zZnvDD2s@}dsW)etL;5p$Ul_j-_E5$Dm9RIAeXK{E-{|~K-5zu4y2Cgjmz(}c>X|T35hUhx7=K!P>VC#q@;T~x>IG_dwsJX)D`7mK zBW16KaWjltOkNA)I^i!X_Xc6tQu9o2lkZah4&x5tA8KOyzq9KellT88>!EDpJdu1< zsV6@nojS;C6o>%if)UsVg{Tr)m{5dTG=gH5KY=G=XVMXYli;#)-4VGV-CU%;2$TrQ zTfQ1W39@E6I>8@7z;c2Sge(pdA`wI_r+5TU|7q?;a+Hjq6#dfFGFHqZ5tOw!Mu=0( zQJ+XNH-t=b7PUeI*#z-(2#E+P5>i*Kas*W(crJo&5mb#JDSe2bZ3NXKs2)M%2%1EY z7eS2(9*dxM1V#jpMo=??S`oD0ox9#^?Drb-Z%yI*k@%LKx%T4mIuX>3;PD8Gp2_Xd zK2a}X{@=4f1ob137&&fx4f(=nL#eZUV%*8RMhr+*@ItR zdPLAOf>$GWO~x&MfnE^|h+rUxw|4}6tdZ{iLYM9UId>;Fh7FNWvyB9CtAe6f6BapPL2f;EQvsV-cBl6NLUoXVuIvef6@$_*(ZG| z%l7u9J#?o@Wc5q2<#bj=urdNMzm_w~ix*amZz5PFEuKzaCl{2RUmd|3=}fbD>u!m) zEG3V~`ze3Al#+J8i(o?p*Q59=ij5I$ir_>9e?+i3g6|_Z5W&F+eu&`52=>YqIS|_t z!PW?NMzAY_Z4qpb;3uvQ$tt@$*Ze}bVhHbGu>9nx@NTkvVO74g{Ik4ijK+VV?xFrl z9WW(tAHyEGn(sHl?-A@LNDaXvX@?>>95LT&=G&huA6||`a5RE5{S)FyQob#7EP~?^ z^IJ4>Oz2wWWCW+=MDoR#MsYfVKjorCF)xZUQb`2yD9S}~E`swB6pW%!6c-}6DC;PK zn-N@!;IfQK1b@j&*W+@xh1_9xMP|PIh^kDd6R~Tu)hLEQ@}BvoR1W!r#w}TxGGWY} z0e?quCj$9v(on@{)hy9OG5(3*u8f$ka%aW-hG&llNMDZ{p_dFVDQRIsv ze-!CaWJKj2RYQ)i6+@gIZ~wdp?njyP^nh%M;j8JT70b^hV)hS%s=ap+-?P8JF7bDaHy< zJmNDs5XB==l#L=7MM!FhA`-=tQ+cJMh(=MRM7($uC8BVh$n~g3In|J_q{>%1OGeEv zc9x2wj%o;OFB~ruHJ?nlXj!7YY7{IQFI6}mi$W9&bIV7O8O4w&hDMPUMTIDuM$s&a z>?m@gs1?OyQ6!=mR6d>?#s5+D9Y9kQU9=zRNX|%xolUdT6L(;N50)ll0F{i20tU<| z2#6R6VpdQQl_VfZa*!aP0t$$Tq9RHXBcOtah?v7WbNTnxdsS1XPT#(rZ{L}n>F#Y7 zLz5Vq#<0{?i+1E=)5CFrYR;O+(1tnG*2U6__wuT>kd`sDis7Yg`FsrL4-47AMKu+Z zXm+@(c3JA8YN~CF2Rkc9bzp^KxHyI`F?5Qdv&b)sAw4C$AchNLsJJR*Dy~wdGC5QE zT@?t)8u|Spg<07<$EUWsIj}pm&VhfAkg7mOjG! z3SQ3fEvL4<5Hfc7qOir{+*L7L9mBvFu8E<43|kd|<`WE503bJ!<6Eavjii5@EKiAenW1zuw zvD95L+)10vM+FUI9fXe%{G@#(WI-ci+@GRZ=smG$9raTz~w+hsoi1kvu5)kl@3D!&ZfloD)`1kHx?xxa{-CrIVkamDbVh za8{#T9Zgf27>j-gUs*>#9m6v*Orl*~63(V2#PDnklO_0^;PWwVbI^?C^+F6&VwfuO zX@b*P;X>>Tk-QkgOd+!bnQF(`+`Kxv@0lF=91(KsdiYa``5aJIFNOs%yc~piQ&^2 z*2J(jhIKK#8jEgldt+E1!-g0>jNzjgHcInfkKqj=uf=eBO8C(1a8nGMWB7nB{*ptD*MQf;S5-lf4Tj)J?`^97yvh3uxGE{mcPOLO}T zwI_y;V|Zjx$TuYVY%!57C9>wcCGCr0e+*wUVGIZ876yfrp35Ji-!7#Na-i#IlFw*M zblO9ke;&i$u=oqft$JPkC4FY!kk?m2uIm#Xq4SU7CpI~TW6Xqpo^}<(&f~f7=>Mhv zxoN1(pzyeGcJj$VA!AR*@M8?0Tpulg+f%maloWAmX~jIbV}&c?HipIAI`K;kXJZ&? z;BEuIvU)M(4YW4!dklZj@fxUR;LjNTis3v1Wexnzp`>RpP};!1tkRI?B@CQDIDF=- z{C_bxb#;+}AG(hZBSC0;h%NV$(t{z@j^AI%dwCd6?BnG9T?M~$klsEAF zfUtsr%0~2nI&5fI(cpS%UCF@0x|$35su(!7CP&j^Y;^-Q3^X;6Gf>k&Edz}VG-fpn z)HYDhKz##s47^oWbHcJK_+(qxh@NjJUL7_tqGy1H2DsCNq{-lr`=`ib1`Gp%fvkbJ zfrNqghBWs`8YxG1dnFB|BrQ{=g_wdF1C|g~h_!_{g08^@z|rHxledMw0rvmBhl(#5 z+B`Jy-M-v!b#?NJu!({92ZSWqGNqasXekMs8)#uf4yRaxxAu%S8L{mg+*U@k0gXf( zXk(zSfy)iFHPFsLR|A)@TVkrcfsO_`8Cd;du7kn#w3-{uIvY4}EO)UHO($|<1}>A*d(#a5EZxmOcLO~PzW#paJzv! z4Gfd|-(g^=fe-iPXoo`#TzIq;32pDv!6Aji4cx^>T@{Xy44E_KY@l(h$tVN&7y2Xai6VJQkRAI>p@$jExjdP3 zM~#iL8KumksRsteDsALE-wCB3W!;iGh7(N^!E>S5MoY=Xf!S zW6BH%pwtTK*j3VRD-C>HuILVK0i$t>q+8#RQ|#7qMe7W_YG9Lr%~8WK_PyL|9JPMo z1~#ys-Y7_?K|Z5j__~2NXzfFrbGV6HXnqE^a=LvVJ;PJTx$~B^{grxpn}O{H-ZoJ8 z%J2k(_0{frdIvkp2+>95Hazz-|K{7&v6$GggBZVqib7Q`R1- z_NOw@J~ptI&al4bEcnC#@t5x+H`Tbl-e=&cfg#BO)=DNFf8p|HGKc%HfzJ(mLH8)~ zp8X>)U0h#(W#DUr>*zF_K*=}sNF}2mApCJbJZ9iq11H45IQ71xah5JculPO9yS_ed zL>oV^8W7T%{6OANoizUU8=tX188~gALL3$2_}Rc21HaM98$A0cvfH!blWF<7aWrbb zN&{0v!$0W!4g5v7FKXP@$EI=I{}KJNag>YW$@=c`O_jw*3fjpO_{n)MB<#Zf&Ty;Z0c zM~!&o=xW9zFGLAB8?s3T;<8 zJSp9eBM?HzLOE}XP2y-8$73cQH<4rO;z*{EO7mw3TEsD8X!Ck$6vxprjxuQ=jaG5w zuvhobs+hE)l#mj>`)2ZgKEO2Nihr6yX(uy##y5 z(ML#MLF!x{$Ka{qIsGd|*e{N&gj^j*|2PH|GzSXlJ~jOP`AGlTIIfH1dJ*0sI4F)A z;<|eK6}&T!VTD*G=Z~Pf;uuZaYoJHQ zv8#rJx_u#X5na1N`g@j@OHd?=2G3-YRC z@>G75HXxG6<9I^IlY$ckC(w+`M?YPkk|2rMKu?O}**N})- z84erb*ciu@IHtz2ERN-Iyjn#~i(^(Cv*Va9!5M-t3Nm)4WKQx@9CJjtNN{c(3ko{( zgv=Lwd`3v+mxV8+DK^jy@>(3nl7jwHAs>~Gp_KEeHh9GU|{Cd>`V z55@6WL4G)n&kOvn*YjV+@pT+0;`l*?-w1vyctr4M9LIz(pVt@VzANzWg&Y?gJ}*2O z$B)9#3Z4@DIgX!%oEBsbr{{)eg#S{IRBjvn`297G-wKl7g_M~S{uRgHbiWDINZ_A1 z+PC#fCr~DVe}(@iSVXte*5_3sfszGYDuHFw!*gCC1ZpMVi~RfqY74OvsFOh51d;{)dO~7?^%H22Ktth;5@=k| z*)k)_kS}3~MgsAIJdubz7=0y=?961X&hHlom3u&p5V+cB#G z?;xaO0-c1+S(&541%=oP6S%0rFHWF~@UDUvjgIyL^SUg-zeA0x(M_d6G2OW=80=4CA>BruWV-atPk__W|Nf)q{?@@xW=g^XyRDSUxOvLrW4aEc&< zQxlk0;M0Z7NZ>^wGYfLQ?4ssu3BHuToPvC=ka>dh6If7?v+|1)Se(GG3H+A8k_7l} zme=kCmU7BVaCri25?CvIh2Y8rRtb4Ukov0=e2k3V>#j@S)dY4FpPs{4L}k z`hOw+734*t|3F-oN}_ZUsU*@#lo4UoB&sEWB+g5stVk*(QBg=aKD!EGS-qAP*u#~1k=*OBT(ISb?NnDUbu?X706M~-(HzSza)NP43@O4S#=11MQK8X!U zY%IvPB=K5-zb@pBBsLW!o0It9r6|>#B6+JI-0^crV|J(T;NxYN9&Vu|v67MFl z>s(OqlO*0xVmI@Y;2yyb&ne{9NAzI3qMqUPaT0qA@-bV(PYZls68j6Bbvsz#hm!cL zzz-+!x$rLp54Mgn{5r`6{Q3m_=NCDWZ<08YMA68Q*HIzI1iuyhPVjrd^&XN0g%eof*xPR|tjr|^3cf6zOn&@_cV>GtV1Q)rmN-%0#K zr=3Ej6#nHMp`qqgCKZwYSh^7M66Z(?rG%6gJpFQbP9J=6A(FD^)Eeq?DU>hp3Mtf+ zY%3QewS-g=teQeKA=L$I2-XyA@KTij`NC@pGFV4QUBP;S^;6(aCq^|&p>Yab_e9vPzDoD~P?06-zv`h+C3aTLYQ?Lu%5#kDZDg5)m|EwhtNmeiv z+O5x%Z zItuSp(CM7Q1;Q^ZNSZX%U4(ZlNV*ESB!x?bTvm|pTN`#4-lHJtDWsQRtc~g;q;Dbi z@)QqEiW+sLV84R=suX%PQIrozVPFbVQkdINUz5VMDGWRi-N6K|8?V8Po3??_=tL1(CtJ89~oJUoRFDcqI9$P^w=;R%VoJB86H zj1fL6g?kEV?-g>N;QfN-?+RJs*c2X;;5b1_9uP7PT}ViLW!lMOCx<9|dU%U$l|AX%0WbO&c_HVi}deL;0;lC;TCppiNghe7Ok;b{;dJ&cq zA(cy?BaQTVX_QUlWNF2(|9rb%E{%$5R7yu5R?4TN_wW^j^J7HiG^(V*k6ApYrD_`0 z(x{cj`Ds*7qedDx{#lyJ{E)|l_e=_Frg2f9kepvkYNt^*%|)}(+xt3cTy`{Cif}Gi zKOHSFXplxjA&t^#Eacp``bq_CS zs@kW~A&rh{Y;2=CrE!7OWI{95IgP1b=jzIlh8K!(*4nU38eN6=P2&#z|`w6)!jmH;72lov~V<34NPo!~88rPg|`acp2lsWzieS{ za2h`@&IOJ29U>W$#!&V{V@(f0eU?5vjS*>#O=BDfB8`!vcE1#Hw+zs|!bhdCA*1f$ za5s(?zp(=MQD69INis&z=oxX$(U|BCwwuDnW8pZgtOAvR;h?O$6pF7%nq6S zC6Py(G%6{GOK#?q%nm{BY8Wa7h|VDL0Wfu`G?{X?&W- zzBE>(u`-P}(|C(RTv@M5)sKveqnfeW1he6cct;s@@iZ-;-qO&g()fu^$%;2}eU{BhLH%B=6va;KrcHuTX2;oqEei$hMX|I#QjQQkxa6D3TPGyxOm znJ8tVw23k%>c%w_a*-i(D2nT*aor`Z%bHOohtyEzOl(}4qXL^bD6T7-sAQswiK-?} zS6BDPHA|^%;H9KS-Y9TwSVw{7`aCeAmJF=3ggZK95e1|}Lx z5p_-6yCPTL#EQ7CXGRYB(~Wt4v)dWhjZ8E)kuZ@o5i{|_*t}sPZer<%{NuC29_7@R zam~)*=g5?av3Tgaa}#3y@V!VhRTF(B5NX~&ic?{%~yt=3D?AhiOAKkA-;(~ zO6QTSgA$rw(3(hz%}g{m(UhNnO|UsP%#6C4q=kuM6D>{9GjP1dBs9xqFHKMA)d}6& zgf?-ViR(?YG11nu#dAi9YNKk@pnrW#Y=RWjH|8S-w2i zmqC%YTO3|);tCU;mxmJ;g)3hU`-yyJx#$d4Uj0oB5D6cQzfS0Z!ue(A8WYzF--iEb z4l;4KNNzCsLJv2YxY@*Ts=XQ>TO8hEVu-}vYT`B%gH7CSMjrbP>MRO*m%QVjVy@k- zJv?f~P|>{8#4s~jQB28i30*xI9i2MD#0f{;Wx`47ktQ11>QhIJGI0;B$i#gn9+b5A zn;3240ov-Ua12|Q)Z`-UNAAuj24YgF>z@tHB~qj$g_Wxq0FPf9BWd9|!mG|$9*6F-_bWnzJemrd+8@qvkjCKhq#nt08`Voo&9FB2=xXd}Q< zI)NHR%LGRrD@Dn2k#DbAw93RQ!Z(;$ZDNgybtYalqerr}CTjInFMe5yeEr!H>lxKu zebHMndApv`CIXWEJ=N$n;1p*TtFl{)_* z$WEJIvuIc?(czS*xn@u~gP%>Dp|8%MWF{J~UrhXN;tvyNX~QPC1>-mNZHXf8A0Z#w zP5o)&FB9CdQIrA4f*ts`iGNJokyrnUoIUv;o!I$Bv-_ylhjXQx7PIIFYZR5rpj-y! zGbo)wnG95S#m+CFH3;FuY(z0A;JDLs`EWj2t>-3+`8 znrF}=13!ZxgPf$|7_n!vnW!_v44O!WZM_{mdV`!U1g)>WD4)KiiH z84S$ehD>z+^EH|1TxgQ(GPqVaPc%IzxjutIG^CW~A<{q6W@yHTteYeie_2yhJxI2SU z8LZ7a97B@44Sp_~jgMLL(9p)4yb2+nw&o4-r?ZONe zWw1&liv`bBg9(>purz~ZB3v%GQgB5EbH9kXf>)i&MX!i(wIC&HgfNp=GgzO&n{)*k z-oddkgDn#ES_ZFYuvz#Uf|~@HmS@!x&z<+n4nNoGtr={~;FAnK6}9ad>?-KLoxu*_ z?-V3EGk90{xwbR6_cC}tgWVZ?P|(>Ug5reD z;5c2ng(?sT08tqgOkVWFnQzk^Y=M1Hwok2Tvb~ZG+SB77dUI8g|`u8kbTn5LVE_S z=rOXd6+Mh~w9tv3-@*kJx?AXB;X;Y+YT*(g7x6A&p^JrIPFa_gEBa-3Zs|emQVW+! zY&Su!sV;+3T&>M)`4=8NIfxc|OB5wsD6Y#zYnA(mq;5)6|8fggSTKh*ztW1<*7mp1 z&x#gB^Sa8y)xs~AAY)IIExN|SwH6+*Fy6v-7OuB2%ECQX^prBl!YvkVwQz$K-G3>$ zQRFvSxLF7#t4^1=&B9;{cZ%fIyt-Y;5DRx$*wJ0_YTaE8E$Ht(8a@EIevqQxEl+AW0i}RD06GL{XR^MKCKq2`ugvJ<~p8VUmSu z68o$mYxSIv$%5_p0L*Gzm?CMB^DN0SWN66?i$m)Nh;bdx>TZ; zSy*mig@u(CUZF#n;ZdJ|^0i7h_k&Zy>$_4#Yb~s^u-n217GAZmUKH5g4HhI?V zIjQ$r_{74e7WRqcpoK$1_6r^m?3dD?3Heg+uprZZZs7~z-||@gL)KRX`PT*E5er9Y z!%Mtl94`x}g?}sf9q$4{7<*jE3HtwnLs;KM2(fL~1M z5-Q4}>#_A^iUN5h$*poh ze`1ZIY6{gAQa_idCCW8KfxF$ATTO)zB{>ta4s{gjD(qJ{piobtzQT5ew-p*FaEHMy z3b!gWQfREuMxm`jOu98ls9vRuv?%w3sx>)mr_f&E3WX~bIw*8h=%&D* zT%8m;D|Auls_>}P{{n>znU7@4{4bVFcns9)_lg<3L}7!dT`KZX!Y>ofau=2^>Y>nE zp${`Gqk1azlBj8Aqf?}&3-%Ss<$|8Hy`REW3Ii3cQDD=kd9}o{EBY%8P+$}0iu_uI z>m=$X!RrMFap)7JnTpp9BDqoV!(!AqylxiBoL@`arZAXRq40vj?X)_DaS9J83{e=W zaJRxJ(Y#Y(n8I*{-BRcX5$=-G?-I_QA4vl^Pm$cCa4&mOV((M9UlhhFjAs5&V2Oi-Ap z@UV2ITU3&HuK%^fGm^uzG_azQlZ3w}wQ5#hO=dm{ACytNKHFV9MPaJKDuq`RrYTHU zn5!^PVTQts3NsaEN%C`znw}^99;klaSSSIj)MOqtaRYZNvqY*tvSu#P6D zuu&4eQ@ZF?$%=NezF>;4iR8_)MX$4CrCZ(*$+;fbqVT2!w<^3PR?QiAu7^7f;qFtl zO@!>v9SZNzS15d>uv1}gXZ3*~$-4@>guf^FenGxl$o`amC0UwkdlZh*Eq6IjQiY z!XFBMDx9LbJ7t}vd#58+IIW@$wk+sp1#VU2b%sPZh>?kl&+>J`ZYz7jS@B<^YOTkk~T`&c+tU32c>P4vGKT#Cv3pRc{aM) z=x(E|jdC^`+I+18n_oP21sfG@w5g$ZRkBgJz-OE(u0|cL>e}Es6D~xl zZli{cnl@^Qgu>cF&bQGstr=|pRdF2~w=d0IvOHH$qUsAa5M)-=X-saTvmO1Xm|-K% zI@l<-k+6}p;oAsoq->;ZC>yp7(?-UI?jAO7t}G$W%3SMa>V!xf8?KEz($Pm)&j#hZ zdajL>DWp!;MiZ80BeZe(k{r|Cwl>V!AX2lrBxxr2XqsOwHH9s0w6f9Oj=nVI86~l8 zShS>KLgvq$soB;>J5ggD7-XTu4mKFu(MBgBhr6|;@B$kb+PKKZ?6kf_^10Xs|G}+` zjXRsE^=aKz^7(8@?o!E$8D1vsVxB$Ny*7s17-6FqyKZ^d-^RhYVQ(9KZ1iQjY=K{jp>eyxqI zZ{)ADalMU^>+;{v4u6~%-e}_{8@IB~Hg2}@b6P(&FRWl{D%>J!-4^EtbI@%JWm{Nh zTH3;Jh#h^Yq~@E8LROfPtLKHoB>x-dhiOwYco&nidQ#83X$cF$aW<$w%Emo5?zORY zamdP#=5QxHC91c^nU1M4Ff{+phAFwfAe@(T)#%t2*jS^fu zJfv{(=KPn_!#8Yfva#9578~!d4>?#iHki>Dw;eX#viYe(Zx!4o$l!JxZ`&AMQIU@t zoj+#kKiB2|BOjk%IyZdR#xAzq#``uHbIDTbEOB27g@r{kY zJGX58dVbWA{Hl>5am&1rV|UcXG0~)i!S8Jxx515LCv7w?RurC~*P0#vAV|V-WbBWk zbIOj^$NpqT-1Am$+MAmPApusx&s*OOe}K|Gkz|1ORGiIP{+ zLCV27o~C9zQm`B-2TdL19M}#VCz_RkgRG@o_QRUc6aF*%N`jOyD(j$vr9&tBQ^+QQ z6p|C0iGB+Q&4rv3QqF{}9ONBb>fka5tsQ6wogG}@pbcwo>7JJE=%B4|2HQDkFT6uR z(#q1eS-O)0BL774LI)Q)xWoY$TF_8O9nD?rfI8zW-9<=O2Qw^9$-tH2MoV{d(A_~F z2Yu<9zAEnFpqGQ*!h1T{V`&P%7v%FD$>k0PRaA5xS30;tIR9splKM(N(j)ppdNs$z ziEjP<1-Y|zfD>(=9q8a12iMYUDyZum40Uj)gX<+~kb@f>-00vY2R#1ecEM0-@|%U< z;^0;efzrHg6EfJrJ>&8W-XRLq93sS?84hzW+`-)rMmae8N;tydp-dR*L~HzRWS$k& zKlIoY)RgJbB)Z4Jz0Utu2v2x1lH4c3`yGrHGNusA`^C6(Epjm4!GkQ$!7~mfIe6H? zBMzQ$@T7xIlfy?@^tAAC;g1QP-JI`vB=?}w+yFR%2`i|lc^7cNAg`w!%%2sKOjG)G zrJtpFJ6Qj9@iZq|iSe9+7aUA+@H~e@MJp2~yp{h+=}t4kCntwf9dL>7dA8=W&~%Qh z!)Kewv2!eDIhai=^3c}9ODxMlGZ)QW%ylqN8dAx{dM9rSp14$V$Ogf{)Zts~xP78NF5{+-ONn zE_EQj>frFKD7ewVYYw(@a4V~xW!38r-f*zV!N*k;7qRrP^=1brxaU`Jivup9VUSMg zEhgL$k~85p@dG3~IEx+ZcJP6N4=bph4&HabY~Ph2CA&D34oFSdd^kqUf6Y~NF?eAZ{WtN8 zA!94MsN$lk8*Sq%=jui-s=27{qK1o_F6y|b>w>rPS}x9av3Gm^bw_{f=tcY!VV0hV zQq^-&-$g?=S_;DLmJM7Ge|GecRJ8k&Zk)Tc8oP+OFkHl4xGp>w2^UEh85fp|R1~XC z7dcm_g>xYgC0v!n`Ka7z&}}zbmBh77m$}+;af7SJx%!c^%6Bot)lCEg!K~og8Y*U9@r0%|&+? zZC$i;aj}aoF50{3;Nn6T7rE%jZf~zTx#%q9BUf{a86~_faKZI3B<14jgsa!Rnm^Ce zU0qzlw9CTFTwLm+v8S7Rx|^qYTO^;gF1*>(JzVs3aixoXF2;Gfmy13w`m(p(Xld(o zPtT64*wXNF7gxC8Za#AUqB+A(ab#EJ+5wcQE5xQ$k(@WpnZLt;Gg`^ z@9P&$b%%?gF79+OgqDy|#lG(C>tVD97bkr^lCi!X!LIi8$G*OcX6b8Qb9~L%yG3V| zAlr4Hi~C(nb1~h;XcuE#Jn3SBi?Qqq7Z194h}GkGEz3Q$G&i1RALv-1TLijCpdWVe zh>OQu^j{u6>T*4gdL*ORy%V(}f850rE?8&o9lklx?30Nuo^mnS#dB`7cCp6AN*AkKe4A0PxHuYUP7^kqZRFo%vpBAHUh87Liw)5% zh!#KddQ}KJKEP=cP6}#)0^d#%a z`S?9OVQqb!LzC53GHT-qy2P~Vl2AXoIOXCO&PrBNI+NpgTI#tutABREAg?oGiXK)G@ zp{7xBI2w9U-_q5fiH@FS^%ojA-PJ2UptrZ22-jED1diM0!Fh1YTr{9QP(3nzG3r@*Z*?nt3Q@ z4vPL3-J9qZ9>z7%H#gDbG*Pt}}^Kh|;E*`G%aHWT?>?@_a zd*~tL5)YROsnb+n=AoN#DtJwGPbO@t`*`Rpq?d=@LT+fPDZjs|UUoQlxd*PKeW9u5 zlKWSh>V6&uco^v6Dh~`^E!f|~?xs=fk*4|@kzDU#kdSLVTqlIFe>T-Ma{2}d-pr2T zC<}jXd2ZO0kP5dHG@Xt4!5(h+aJPq19`0bnp9^^n7cxX}sNkI*h81EDi_QoM-sNE= z2Q;Ud>cX79$HToIM$^XFt7G!_u?bCDUe3kI65Kx}q;M?9%fkb-md*KrIsNPC{GqAg z{+fzS<0Jh;9v=2E#lut&k9c_0!z2&SQopKt%)=8Np7hX!zXe!CPJdKcP2d1+%s(wS z(Zf?TkNr7Hcti>D8IhB`kkgb;_V9L2zu@6H4=Z!}c|nq%o1!`#&gp3$rhAy>;hJXp z_ne;LVWtPKnSRm3k6ZIKnrS}J@_FXsW||7KMeV+3daj3goQ59OdzjB^msRULeA!Gd z@bI#Sg`OON>tU&fcgv|o9FghaVlR5^nN&?J^RV2*DvpSU6&?ncRVyWjDa|w&wDY|I zA01aq4r@JZZ>Eh+`86KCUzS_dOrNNrDB-MUSsOfT^zenG<+OT@&cVZ*9$xqGhKEfu zm4eav&78=A=6#2AlV1HT4_iI#_3(*@ZOq@pdmi4G-hSJ|PF7g>4o;0K>K);UBRQU8 z^k*}@%Zq+^^3Y)7ZVw-L*yDj~wi&f=W%x3G5irOem>T~2O^&Ow8TB#EH6D>qrJjd8 zeCA=F@cndF&GiA{?7)Lw^t?xMnAX)?f6n>XT$609tOhpM?7%NQeC6S558rtBjveCR z2*<9LV%?5;I7;(qt|vE-meaF(-^xHQZLW_?Lw@vd%EJk|8V@I>M6NTZHL^Iq!}-a> zX%>1gSFMHK)?6QKuK#YXpXwU^;^C}^o<4f{_|?O2ba6f!`S{(7p4|9Cri70_gfsXj z``N?a9{v%@e;$f_{9A~nQ!-oVrSIl-3r*#cK1%s0?W2s3nm%gz0IyoAqK`^G&ht^$ zM>#*TtL~Lm1tH~q^llM7GqdL08o*x}mHlW3L{%SE{K!sdS|eKMY9j2tySTcL8a_B) zRAV=u@1u^7x;|?A(GqtK(1PlU4;%G-H1MO&ukV99DfrWAQVUIdxrJ`*Bj)20KYA-@ z_=x*x;-jgLgpc!QglQk954x13&l4JT%16hyWXiPA86P&Id{{mOO22a%dYN(L84zs@-Nw@Xd#5F8@ln5kBq` zGTg`X;%NWENFR6m_`X<=_c6-H3xT@V$9+D(pQ?L&tPvgZ`+bb@F_v}`s?kwzsEb_n zhEn51^8p{bi=!P(eAV`#&kGNU{9zxD`gk>~9^q%QmU_CRVi6NP^@NWneay(>#VjWH znCSD_9xDPo<>P7gVSqsao}m#+ZM^```k2f~;p1%|&-o~>tk(EA*-}5xI{TR7W2%pr zeJu1b%?E#M&R{~e(dTD$UALuf+EQQIQqS};oBig4e3sx%BA?@9z8`J6nd@Vo%uOoL z3lVuO@S{5y$s!+%eXR7c%EuBP<6G+GK2``>D!7b2Q!ZNJ!JQ^kTSlY9Tjwk6##+(w z>8n|>mU?eX-FkDLlXtC;b?h7;>wRqYvBk#*9~*tV!D&LxVc}~&f1{ydtH>mxBgLvK zzC}s3(z=!AyQV%>ly@}$rVrv)!M6l?Iv*w5g!A3n4j=FM_|eBHA3IqV{kD&NKHl}Q z%g1{@_h9=+ZnD;a2;|Qmc zkAprA`S{YuS9BMv!_Rzt!3okzAC_RBR{C=xJV2hY+@H0xmin4*XMOmMw0c~tsA)G> zRmXgM>*EKGGVO%IR{A>{Dm`9#wYrr)&ic2~Cj?38JfnL=tLUXYPrv_({*YcYK-B<0 z`#3|-9H2~qUwoYP@t=>P0KfY9&Bs4<=`yu{_wlEYKR75=6g|K{t@K}yU z`F^|=*3E0aK)ZZOw0EgQz|-TSr#|wM0kU~b!dQA;1UN51#Q>E8lnqcWz>JFO!n|hG z=CZ1M0Ad9}>XTOv(0qHI*G>6ozZFTf0M!E+0pbB_1gIIHUV!=mY6akZuy%m)dCgn- z`9b78c!OrJ4!Ow5X|xRjBx@+%VqyUr3U3skaS;7k0Oh=Xmss8@5}bN9l^GyIHQ^~i z-lo$+X6CiUgxm5efGvb?0@vlW6Yxc`<}Jw$z#uPf+VTSg?2Q0nfF1!ZZLOOGXd0kh zfc627=5>xa1Sn?HDyU{bbTeumfUj_wXUW#OWdI#Sx4BjU@&Q^0IQvbW&h6c*iiDrB z+DI%F+6K|b6p{`BItI8nK$ifW0(1^=QGfx@g%(T9>HoPz`bqkE@~v&v$^fg_ z*hFs-U_*e70e%eCpIW~b z;Pn8PHCJy0*w;*P4}0}C+HIq^ND}UCf0L%(M)z-{-wLpmgUczTYl5xqp98b9IEyA;6yjf8gL)fNukw zq9sUUzYB1rt^Ogv_W_Qx_nN2^BEO=&B4;W8wbdutZvkqz(?L7kxt%^8fWlt`{KmUL zfHML9X{vq+aNY9US>gTL=>grtQSCJQ|MviYuydM5-}Iktr^n>f$u;5MRHGZuqHGrb zGB?igCAl(L6lGB&i&9yX&SGUd{Z2d0H6$go*wrokN^<*Ca^OfYH)K&fE?=#^E|-mx zSIVMt7Ui?3kcHV^pVwUJ_PSyg-@Tb9sgea(?^Mg8dKRZggjKUqU$Gl&WFsS~C0J9C zK@JC7N>YcCEH2BUTNd@Qe0hjwSv1e0K^6_Ou(NQoXp}|cERtEIvWR72WWhd9WYMR+ z=E9qJ7SS@Ec6vyA{doH*&vX{7+e_`WVm-6SWMPSfLK@ibD{>^v;q~^~&BDuqX>(cl zSp-=$VYV&Q*f;YFnyD-;|E)Z)PzZBwDzRLQL>*e`$L)0sc2O1`vgnva%PcB&Z+U{< zl0~a5@>%e&Ksaz5j@H>|CDQt3xi(p}&Ekjlx*Z$RL4O=7+E{xIM+Z$|rz|>W!4uLh zVH>l!FpDl(bj_ko2fpw`&6TFy@@a{aK8bo*BW) z$cW#S#YnoT_Bwx8*s!C%n|q;AB}DP7$1%#k6d+27?m5rkKut zn;M=tkeivstSmkau`k5zEMCf@N{Ff<=43H9i+x$_&thH{^Rw8T#g;7JFh?b>V{9k= zauy4-Sd_)$ELL#Jb9}RSyQ41ONiWOd^NxCH7Qb}VJd1337N>fIiB5Xxx^NYpe->+L z(w+2b=KNZI4Tr2p$Y767`u0wdK0ir6-bueIrL50l0~NA(jYim6*X^udr=#ekKkTGW zbcz-dypaWQli-F<`b{>iNBB_|%RB40ve=r%wk)>O3uW;htCz+9A?rJ!r6|6q36BCv zN>Y#<3_L-6vpc&x8)oy8GX@k41am?VR4{=7Odx{fAR;J;0f}b8h#)A65)=uFBGCY% zf?rLI&Hw$*cg~zT)z$ajz8$9DzS)`Ck4o?fhqs5-rr`ZuCi$3q*D#B>Dy&p^+rA{&6CN@-Xx6?B3Zsu|=!6D8< z3AQrxDb_x&uD0&B5?)uwcO}?ff}fT1_a)d-f*(roV+oEHyta0hU>8sPw(f5Ajv_hr zJv_l(@4Ne-xc{_uGZL?8>+UVV-WK>p(P+jV?JvRjw(bFrd0Us{peBN!TYfFUnzrsK zme=v$I87z^qXb7d!WN1w94*10+}lg=ZwZc-;I9(=%~Mjn-rd%lCXW2^wyxX5Vxz~^ zeU5e+3uP^w(atSrdAAmD>N%(Wpp~?9D_DT#z0{5~UeQ7&3+>vuSG4n{fL-A7V9d(O zr-}vYRV`GraA!NWy5)6>W>2+qxw>jtsA=J93)fhvWudl(^DVToP{+dQY}dkBmiNK< z3=8!wG_X+DLcj|&6k%h(c-(P9-z+(N>FYawYNZ6RY} z<4TKH#)v5k7211b!6d7GdzY^upq{r-uyC=3ODweI;9KZwp__&F9M9Ut9W8XS(80pM zI>jrt+0HbpGi_dv^Iz;POmdpFw`%dB>cza3;Ak_Ud7I_gB!1`h^yL zUm0idBJLqG{}X##xYWYsoKxj_8Rwpt?z8cJNvY*IAfuVTOh4E!<$?ZVUHVxY5E*76w}wqRel$Fvvocl~(um?kyH> zl~{X{#ZKL3c^B*0Q}Wv_@Ftl%xa35JS{TN~6ZG!Gq0Vms?y}H#x;26w8Db3=|LjGZ zKg2d}v2`zJp;qxI&YH-5!uu_Zw6GxU-M2G)g7u({aVg3u7!i zV&UHQ?)3I9$Md@OE{B?9_?U&qxeuRO%&{Fl(V{ZW!jl#zS(t2LyakTTQx+y@K;}*N z-ZDXDqUG(+9G|D@yVCnizP!CV#llnz)0oU8?|l?sYHiS%W-~3!vasC33hw_Fp0V(f zg_r4T;aLmMTX@03T#e5>j_MRET&MUs75V-m^7-OSk3+P;!iyR@@`WPY>lPV>S49$; z;#Vww0q2eLs}>epc#Uf~Q_QQ5T;W{&T-B^vYVkf$j5}g8e->9-c-_K>7Cz!iV{MAc%p!r&xCHpF(Re{A6s z3+pU=re(0k!lzm%yvWb>z{?$LEwF3k>n&`s_$yub%EISnPB)5tA!JO>)D5S2_p4Lq zl>`>Qv9Q@f^&n0SVvB{X9G?Id1+dM+w_G6sqyqTP!gij30n`fMdkZ@(oUrh(g`F05 zS^UZphb`>3@Pp-j(A{t0N0FboC5r43{=~DXyF~*Yzi^M0NM5~z``z~r$pI+`joxUf z^{a*7RQy}`JNJAGe~SNM;Rw$r$BWjygL_QkUz~*=QYL`1 z0aOm4N&w{o-oG|HDvFd3ph%>G(IHYLR9s2q6ycn3vF}wifK#PZ6IK_piXZz=6R#nx ztNYSx2T&(~W&t!0;Pe2_2%u5G8?L%SlKLcupDFUw4yS=gL!)6@V2$Ab_(2I46Mf0%#S$xyqr~ST_Y$($Q++4laiMP<_SVlO0bCV8zW{m%aA^RS$*gYxmy7fXfD=KpD^$EvxI*1w z8r1s-Fd%^I1Gpi8fvTl=jmXsj?=v=w*Bbr00QfPR%8f?3Ie?qQ{UN#~fLj9?B!yEz z%iB00JG}%rlD7vilmi>U)BuJBa7O^60~iy)odMj%!3prYcnqhq!{Kp{$cO;$4&aLp zE)@nL-YcE|bc_^vz}Sz{@cOqx|raJxzU|6~Jtf=>g0TVe&IYIPA}e z%nM+C0CNI(Rz;3BZRQ5>oCrA|y&*myzyhPZ;1j!ep$In_8oU(1%K;n;;BWx11n_DA zn*#VcfW-m47Qn{=d=kKtfcJ39n*qEPz*6yL!sWsh!j;0;g>MMy!lm+d0Ph6wVF2vi zy8*lx!24YPJDgR*)k2;uRCpA3bcr8O6#0m2vZH%jM|buTYfS*32Jksg!%#8LskI#W zQ1N=5fa`>xnbUAX0DN5H;g0Uij_wx$Yz*K__4g~a#jGX=i+P=d4Sf^9W~Ry&($U=# zz}5hE1h6xJ#yzZU0c@8S`L|NO3xL}-i{A&lXK;94aKGIZ;6LNu$p6F+ije;((o(ob zxT2%`v&dfIdacHN;`_Pb>~#2F|A7Dw2C%oI%cH21`)k0v>QX7_HTqiszX$L~07v9f zE{LPb`L6)}7Wp%PVxN z@V}G2Vh{+TK_{0}#%^99a!L@DgW!d-DnV2WdVf2(9aRl_(?K)-#c9{cJuQeDL4<>d z1W_~S{a?&W4RwR46-2*IZtWoWTvDAN{3oqW58@0dBRYAHT-6KW%pmHs-5^>7aaIrw zgWk2Bra|vdXCqg(S6`FMA%zc z(JAf|MBgA@2xCDQmj`hLKOlv1S{PRbaa9njf>_N74Wd622;wQOiXbmrVMGvjb9REb zCWyg73<=`eAg<$>aJ2++Jtwq6vH#TS4dOQn`PAoxqB6GxajS}hg5G1Zv@Gbk>Dwf- zII5`3?S|heGBk)`LEItEXP+5oz8-_UOUiIz>+_243F2Pyu|eDy#Qi~x4q{BudoX-t z5Dy0NkZMP9PU{yxz|8fm?!ywtARZH$C(Fl!@E=LOu&B&N zDfAjAgC~PHU45Al#6*r~5DS8MI*3U@%nst2ASMSfC5Y)9%t~dZ%4M3+f8dvK_>}Gp zrOIq)ip&x+AJ)zZVlGF!v-iODvqA7F=?^=(&-u9pF<*qwp07ah^Fi-vZjyyTyeNHX z5R16%#g_lDYLGX8d9&u{!>4-5`CK`1ne^pBtPo+}R|fHV5O1jXrjSk3 zlCO7uOU1W?ct?cdyFt7s{+Vpv58{I$KDP0RjSqwPhy!I~p^cA&_#}vSHrm@*!*SM@ zlC!Zk$Sd9`W23Ci+tRQ;i2Xqv2x3DJp9iruh;7{5g4h_u*Fk&}#Fs(*HPPai>6?Q1 zN_c=4V1ii0s_HyAhcYg|c-*WP6GMfD?1AbZdi;2cosI$3)K^$UC zZtUvg;h^{3{jVI}3D(h0-dCc(N%=j9KX?qWsMPN4{u#tEp5T>=Pq0%Wy z#E%R49LK*R{62_P{91l3Pj#6 zLgc@|9H=vG)VC3~5wX$0MnfAx+xt(s5gWD9%0_EOu)V)2JkGY!RJ@t6xzStLILq+9 zoxK}H&QbAPVM}4Ljq^nK^(YO_w|NgCF0fHz|;^}Bumx(l!}wZGd8ju zvD)5H@Jr;pa${lz8*L3=+u7}4qoWNzZNaKeHa~&jej6igbg|LZ#x*vswb6~E=M-OJ zqqmLj;yrBiw9$)LshHDxvBV377und`*`+;?qAu>GHZHSqrH!jp+s8&<8<*Rd%L`mi z@f8wD_$@iV`zGlpWuT3#ZS*&_18i{gSj&TJn+M5tHmiio@!&7+L~@- zj>rt*Od)faWn;GC&v06I+Z3ObGS}$O*_bCj-zXK6#V=?rb?xGv6ffFXWaAARZ%TYg zxY)+aX1%>)<5ltd^_}=@HkPQk)W&ifE5w%x`HIw)A`JUFcjkC8uP1Z+W|90Y8*kfq z$Hv%?y|<^nYvVl`e`sSBSL`DDedD{@_P+U|%?C!gwu}3b_<>5^+hy0-_>>DfgiAwM zYh#^_FF0u2|2Z8^y_++6g=f9(-JZ8Wvq_iF zV`DSV0`6}%w%FKeV~35MHnws4Y|LNiJ>K#ilW$Rc>09ybw)fx$$@eyhywROFs*AhJ z#*a4k*w}4@#UE_%J^_-`S`_~z&uW2t^?rv+);Ktc@}ue%g1h zTo&i?w~c>n?=JmaUEJd$C%DnQWKn5%c5&Gd%7s9)cNSVFy10CBm3Jvr2mv89SYlTZ zRt(`3kxD}9bSG90c{iPs@TjV)Y9a3z_gFkFgc>2Q(F;SU8A7cP0wDxLs2xI`5L$%z z{Uc5f;fxR(h0r*Jx*_mpR32xBP%nh$UAyvy^;OkC*iabn>RC1kp_%b&8uFgr z<)dWOn@jB3)jgXeg!4jZ6~eh8+|boM`ewXk$a~CWR9BY|I~0fb>%GMkTZb^atIOkj zk>y?8HX&RPLW$9>5IEp8Sp1?zv_rV=zPKAgGK3I=gbGJ6hwxws4~1|AR|^L-gd0P=K^^@Ic!G8A4RLU=$1TW|N2Z7*04bCZb|Kf+}b@_s{V zG*`krYfK2Ybh1Wta~})w;sag?VL=E_gfN!*gfJ_FaUt&y^!N~-3gJm{7O$RfO$cFP z2-Dbw5S|WUQV5exEyL1=k6TVL%2XP3b1CweA#qVRx8w3Si?dan6T-70JR{ybT}*v$ z2+wg0rSQG?ROX5EpHuSZIb!MJHHx_~gcnt{RJbUFmqU0({3Ugn_OFJpI0VLA!iI)= z5nc;n>N6hUcYHf}v(#LVFAHIL2rEKZ8S)+%eIo?^WZUZs#oE8Sxo?Ws>hAUB9c~L; zoFVMt%HLtX7sAdEc7?Digw-LuAL4!E_#%XjA$%A@^_Q(rLRb?*>+bGHT;w6dlf@Ld z+KHcXw~@`-5Y~n8nfL}FYuAU6?e3EF7Lv4hBmQLwUxlzGgst5Fx$Sg|ek1#@jTcXI z-Wb0*ghyVp=&~(@Z$sD~;*%7(cDdK+ce3PzUF3sIsLO7@sQVU!Jn*X4MW52Kvnykb@qMujjSg?9wepg|AMjK?WqRFPg;$lH@BRu!)n zMyQ8dJ?vep>Dj~Og$2IYtwxv+O`u&EHN&VC_FgwvJB&JEoF4W*(r+5x=8Q1vhT(+0 zH*MAnYBjJzTzhv3(fb!|1^ooPK_X zFgl8mcM|C=>=Nc3cb-8vQ#*2<(=&`-VGIvrL>L!_aS^ZQG%da{jElp#B#i6B*uwV6X|dC0U`s#xLV{I;k81x%Z3=x zZ}A2b^QJIv=HdzC)-Y}lV`vyxZD~0ujLepngTuHjjJf@+2Y#}NREC5xriXh-%CIo* zRP7yM(0~UW?;_val9p`l?lA5NV{91X!h9qL_l5Cr7^5`;_lGfxmSG&97#|tNGd=hN zdBv~waM$&4>G&Wgv0?E;!oxk>F+5Eg7C*}M$yt*-ZK&{gTvhZUe?nCZ_+%L4!~a{- zg+YBz7|)8ZmWeSS36FVUJTHB|B2Z!1*dvmKVcvs{onh?KS-B{T*TdY7@KP8rYuUUK z#!``2%_>?P#%qQz5t&n=9GBU$FqW&hLb$S2)th0w6~_87HiYqZ81IDfK^Px~@p;8E z?{a6TSG+2W_rmC3ub4;Wp6+V#_l0XJmZ4bY%wigU6voH0|0ImHBJ^Fuo`$idUNJe5 z#_PhER$7+)&vCgE4?`0;YI@mu*?;y1$0Lh1}lgKc4K zm-4NU%6H12WZ~o1_uMK!wRfnBWOo=paIHo#ID#L;*uxzxg0mv{DU6@Ps1ZTU2=<2Y zOBlz(_=~Heaq+$|4uo+qjQuwp1WWr^^rccRg3tR{But<}1l`*dA>ySp?(d=&13jBlB3{DPBB&lg% zmMx2XIX5wKAn zbt7K>J$t(3G-wb(x5j9qPz@t!6hUJ-vV(os+w3fDnnutpg60w2(9<1RRGtcJ$xkR5meDOVk815fM0Pl_M76b9uaf72Var z9uf46;O*LO>pEVKdT|Bzu|7RfjyQf|oOp2rmqu_|1am68mk4`vsnmB_?87M=U|k-; z6(W5jSk}{}!h^L}N+joe^^afxryznGB@T?>+6bu0H$Jz@z;|Kt&HpMI65+ixSQf$Z2!=*5EP@FUOpM@;2=0tvWCWuk zxGRF;5!@ZYJrRu1%Hf*i3S_{~db;s}*1Zwj7s35%k*kH1&Z*})MSOs*NAP$APekxg z1P^OfKf*@)dh7paZFh78V>E!|R326Q$2g~l$}$v}`q&6~vW$=5U{9B1Tm(-_;Y73e zlnKRvPe(8*g4q!~6T##NrbIA3f*BepW->K`X$pQyFPD)y!p#5T#+VtwEWcAty%$0< zhdB{E8^QAtyrAixE1Vy}b26jvJPjt_Ioax#aQVL0f(RBy@Ja-)M(|<;iz0X_f|ny; z)z-RRrzjFxOSsq~cr5}BAdhCfT%I^wKX(_EkM(j_M6fb~EfH*u;PnXJ zh~Tpb)<^JW1aC#KCW23u%-cH6-{tUDD*ukMs(IKOxA!7grL@Uci@YDf2S)i&% zYXC_YWDht02o9_JKXc_ourGrB5&R+>|1@Os+|LhaT^-csz&IS$7kjyfI7eClzeey| z1n>9qmH|22IugNAPGWm3ZjV1BIL1@n!Nm^#ir{blo`{2-gMYaBM|de1j)M~s{L3M7 zP~Slr2W1^pcW|nMt;dSWIjHEMl7sRNiX2pMuy1m>=WXGy>+&_MAhPK5Qyf%wP{qMT zlf%zU3sbM^pqhigu<}LwoK^dr>nD5SX%1>QIKx3*2Yc%l*K|L?2TdI`bG%o)Hkacqn_G@(RrJcXmUU*?XE`9U>RboS>lL?jyq{KCUALIE!Ft8T z4v6Hf9h}ef99Rz8I2ikwMY9VyAm&0=2m?HsgsP!Mmc%$W%jV~`FGx=A7L zD1%N8IJz>Q6cIX+De z+Lt)!?chiXM^m`e!DSAnxR~mqkAuDr1~?e#;BqrB{T*Dv=2{hTj;?fYmGo{?!u^=l zl(09U!^#t{c5sb@mt%M(hHD*MM;^s1QC#ovjy05zq9}?R}P&2?X@6B zIvC~PVF#mS@PP0^p>ObzBGYS(iSVe%BZ}Zhd(5=X_+uSRb@+I)w~WU*c+$am@uwU- zZ6Zt%nJ8o{lSC$S*iBY`p3|j2Bcw7zWTtSIaJFf8j*8C;=L(+_`sqFI-~|WYI{41P z0_h(M8FL|*go8y6Ug88fSkA@673JVn87vhp7QQC*11>4Wm-&2H`IQb{ckrHrRSw>8 z@TT;49lYh>Z3pj^a`AiT;jr>NI6Y2$o@q5O@HEGje}1etmXM4 zgLTIKbBE7yd(*n!C>u;1iy9KZ|A-$ z@p}h59PAYT(ZL=EyNuUv2S50ZI!%6Z_=q|VIXEnFuY+IwTCKo+4)!}ZV0;fMH!mfv z)n6U_=HRG5mWXkE!-={uL1UZ`{<%aVaN+|ME{j)LWlrqyL=+ zP1n?qEO;#`U6MbXmK7Bi;i#UJ5TQM5LB`VF;-;({njWN#U-1$~Qrub>oL7!vwk zP88873Q}TG#G^<>k&YrEg>AW}-K0@`$Bc?OVb<8>RXmwz+bG&a(LRa}QFM&*4FKpG zMJL~;l%*fATNK@+=po(fqZR-|`Oz+n;-V;?hqHh$JM{%j~ zy-cK!8J{bnxH5`?QCuzkDq(+NKVvgMMZc|U#BUT{8^v|p|HW_cZIqaw;Z0J=Z#Gqf zqPQ)}$6fJ26oaD}62(1H+#AL1Q4Eb@xUnB5a%U8G7{zb;E)!>j(eF0OeMY(87k45pgsiON>qmPT?N%8TeYH2VbiiuG?Epbv5 zGozR#J~@ghB2%N77R7Y&8A5uUoWa>ro{M5$6wipyF*eVN%oWmpzQ_wvEQsQHW8){k zFp5P|Ui6JM7cZT(X;t)U6pN#15JSTlUX#8nirri`;!C4g7RB-?Rz&f66kkNKGK$w# z^=TAuh`b%eJ5jtT{+7_6ns>!lNAbSMd%{(v3_ghBqbNR>@}aLQy-&o~l$tfaFKeS% z7sY2$te3%tQZBy1#wfmwVw-f1=pkdihUycg$IQPgp7G8io@!uH}7iV zH&y*E{3D7ZB1erqGx^i-zoPg%ihrUw9>u9KoEF20DE?J#<(Rkgmx-ZBq-+f3M9RlX z?TW+7SCEJpDvDH!;S>?Czoka0io~ihR1>Lw(nbl_Q1NtO%@}H#+S(#@*rLoB^Nbkk z#!xSYGgVdJSkl0^X(S~dLm`I7F*J#xX$;L`h)8cPY#qb-F|>%`tQgLg(o%Si@LZvn z|FH7KhMyNhD{;S-HbxJ|aDjM_Azvbp<@hvW4K&qonp8!hKtyGjK3j^t`d8g2;E}n zZaAa$6z?VU7x~5Fm&Uxm1(%5T7W%V%nRuU4$`vtO8N)UFNFT#hMjxQQ_lu#wQ5bxn z_|-zcEylbqh8tqIF^20)SyI1A#am*yS;YTHbF1&G&xeC!7!t#{7@myb_85l7@IVX? z#xN{~J7ji$40no*5Z)ymF7*3ycMSK$aIcj6g#Pe)wZqDfG?t@G)k8*kMC4)NXyF(k zy&jF>G4aP^7%TFGU!@Ji@Adc?o{C{s46{`=A%@8@Oo?Hlicbrf!=zH@!qgaMNS`L0 zF7&gVY3x~iCWbjNJbzMAqtC`LH-_gV&WmCG$y&3my%56!P4_}oEfT(HRxdMo$z<|s z42xrUJ&rfxc#SSx?Qw+T-tMt9hIKJ~#!fXYUKYdh7*@ovlEyK-AHxSRykXjXFNQZ` zcq@jtrMzQwe{kMak$qVuvf32c1dk76SR>^lA(f9~_{4B}eJZ|I=#S6(7&gT4OAPxY zejdZ-7`DXlg^C-6U&ioN44cHi_ECG^rr7Q+uxzBT#|k?(}tWBA_ae$zW+ z*kzR68e#VFM=5)RT-86t@N*1%Rb;L2xIcyiF_ev?TpR~Ygx_O0WcXo`Ut{>qIC3cd zh~Y>KM`QR?;_(=ciTo|3!Cxkae|#_Pv?omMzanKcn|>PQ<2Wsj8gUfGQ9(L{RpY1_ zN2NGUiKDWVD#puq^rw<7R*R#$s!lZq6l=y&D~?8SG?rL9j=FKwi=&Q;G&o)4j8ZOV z#?e5<`o@M0H7v!O#L+a4v*S2NVl!cjIGT%`%;&85e}7-jjiY6pZ#VLmE|20kTJz1O zahw-ND`P{Qt@yre;<$i%ss9nII0A756~Xpf(RlhJ5Q)QyhUIM=Xwb z9EmvGINHY1E{>#XbHbD`EoAGNII`j=+s&(3@I^J(o>>|D4smo8?_?Av(0f zUND*IamBmSw-Pj8+0 zXK}1IqZhZmOO#(2udm|RDE_7IWzOzREE*d>)Mgd8#IZGwZE<|7;`TVckK?=lwcMfN zPOS&F#lw%VTlx=i{Ald=#PO53KQh0>v5(tq0!VnL*nU<06UPDm35erR9EamL630>L zzY2ek<2OHoRvo?mFg^WKI+efTIOf}^cYhn5jUJEVL>&K0DW^thUnYUFhWnY9PoSuj zQZa!_3Di%ZK?0{FP&t9xrnX7~)e@+#V%5ZdJMF0noF=7~utowkjXiT<6F#!(ItiSf zz!|2tUIKN+{WNHBCS#g8YM4Od1e(a8ktqa*<Ukw74UU;^zDXfI1UfoKA;1VScqIDv?`V-!Y+ zi>DGuizI|@0?Cs$t%@?@d81?#$QkYrMM1^3rq}F6hXk%n;Hm^VCeVp`f^VqvR#Be> zx+c&~ymtcK6X=n^g$Z0FrKhl$83Ece{>2h65&F&f$l6O2xJ6v;i|enfsqM}5NDouCvcDWy$RfBGCbMeQL1`4fd@n$ zG+qyx5gTokF$p{(?)yHTz!M3~OkkG8u?aktzy#)O?4L|vyy0}2C_XuXDG5An^hqWk z<~cQi=|-PsTAv}sZ*g`4&m{1iub7dUlfbi5<{Dq$c%F*$h0hB)Vha;^F@eJg{F=a` z1YSzuOI5v`z$*!SB+g7;P2lwe-bi3^0(5pM65Kme(P^?w@=`` z1l}_G+X=km+narCRRSMKSuK3uuQmPpu++$Wtg25ESd+k~39L_s={7kq($jsM^ zoLn1JzL2ufMEfd%O;i&2CV_pb+AO5yo&>feur+~g34AMYxA40JzE5CB0^3#egVTPe zio48AQDNVIkVyWcX_5RVi9ZYX3V$h8yI;zI1P+SO{*a0JTLQl)(9=aP7k?yhgqx>} zGhFYiKbpWl#{SO)j*0&z{9EYfc|3s=3H+Nt8J9oHh#D@+x+v$OvWqG%%DX61w2Ce& zh(O5r|BYd*qDn4KasS)reX**ssqUhhI6Ka&Qw`_m1V*T-Vr^k9ze^z3E`riaTv!V0jmEI@wu_L9sEe43unZ!` zod!IdQpLCnSH*Fx%qg@P_ey@xBL`Dejc5#o0ANhX6A9OL&#V8g1em&rG ze*QN$Y+{V~I2TX4c*Mn{Dn91o36aN7T53s;HN75h^a&zQnKeJr=uf+t}#cUOyP2m|6;hiMrxOmpZTo=!A7?a*PGS9_)p0G(&PU3kNFSz*1 z#U?(I|yGZ88qTzoG6g^MqJOJnnYnY;ML#X%Q`Tx@o+MFzWFY<02C#SRs}HD23A zz7sOS_abbFoVo3EvCCAk_=AfdUF>o3lZ#(m>~rz6YFV|{h3`V{cXq#v1Er$*;$auR za#UUX)DiBrW-6EbFvLyVyi8GB?ePiRBF;1f-UwVM1Ni;S#tZHU>^Q5-|Y3AFXoy0jwT$sc~Nt~NR z%Oo;MWRoaP;=Cj-NTMW(R>t@IBw8EpySGu1+)5&lL^O$562T;F>5(KtBH>bAe(OxY zF`2}ZNFC6P~}n`{cg_DOU|qOEv4AycAPM{%~*If+iu5v!sz{yxYF>eOl^Oo z3@{3FxH^ezlDJk?*Cla75;rDsy^1Htft|W3iJRp`(LZjL&7dT1OJZ;mLy~wpiAhP^ zp2Sd9J()DTPV$7+GrE9!z3% z5@QtMA>qTSr8_MjN#gM&UqOsVlX#5FV{(`Y`#4s{v>7MjcZ9|9Mt>@a35HKJHj|T> z!d*Iv7o>t#E(hrN#f%qK1pJI5*w0O zBjdF~M)*{Ot*jII%oJJmc@keF@l6t&C2maOt0Xoh@uiA1@X{z{?<-r9*qX$SBzCH5 zTN2wvzD?pgvqDbx@p~yO?lLiV8=D`D!d8At@+X-2d?k)Z+?&J!kzbP7r!n*c?w3e@ zFo{FrhlRfhe--*e_j@URl)HKo|0eNg633+fmBc?H?9tyMjCs723-vN7luvn|6L^$O zp`782Uu1ZN)PFl_r4&v{p>v9_$VTN9s-zG|A(%qd6spO%eu_T|iBrYTNa3^;YNSv{ z#hSv}Lbg@Q#3c87eY#QV%BEflXQuw|?*;Q|kV3;0-{y_RDV&?)JDt!Zg{CRANZ~AI zGCAB#*j!#Lo;)AVmVSEA5;K+zl}N!g{bDF~Kb1mS2ALGHA}1SVZ9av9#J0i?!gj*; zCJxOyrqD?uIo-Ra&@F{KQ@AUI?kV(0;l>nhN}*>8y;8U;g?=eqn8HOVTw%N}PN6q% z`&97~A=A4og+3|tP2qAgJAQmNLBfMJR~lm$`-@+l!ZjiTgad_ixmM(Q;dMf~@bc^p zhBMmDDcq96Fr(a>!eGM(iQFb+v>_t5r!dqg{&+Ix9a2~vp2CO}#-=bX#h+ZqJt>Sz z;Q`g&E4)92`$Xu)m?I7MLp_+n=oH4J@Q~3T7NO-MDLg9vxS55=RHUPSJYkAYrZ7H* znJLUl;i(iRq%d7o6H|CPg{k6`Qka~=6me$aNAOc3@|b2?nPF_0!)$)|SJBVb$2p~x zx#G_W=cO<|h38XvA%z7}4ha{gurh_$Q+QFuMJc?L!pkYVlEN}6ucokAWU25q;SwQp z@RRhLUM_KkkUGUTQg}0k%_(e2;jI+jPGNlt8&Y^jHmg!tE%I&(?}_*U-%sI#6h28| zO$r~T@R9odu`!^H-yF%O64$1%PV3XxKQm*+9C%|h@$(cm$?^+UrSPRV^{+}geen{cR6uwR2JL$WG+f&$K?7tWBliw-sXR_PG-(xKIrtp*a&!xog+Ijo=Kf6K7#CO`6Z80s1Hw}&hg);_CxzoF z)XI7L{0Z5YOQU?6KP!MTX_QU>xBv4_dm8+HUQtmR71FpagX=Ru8Wq!6na1lftCU8U zG`gm7N*a~ZsFFt2G>X$WFO6zxR8ONp8V%DpHI38KsB0qENTXI7wbQ66#s43+j;TFe zgsq=Zs&YGn?_EgAf#7b_9Tq&hiYe(4rz3hnXh+BqqFg%(k+edX^c)|Od37X z=$Xb%Y22JfuQV=9t5E|yDQ;U#HYD$-j`_+c-T(#JIFck}Wzu8{60)-R3z zTr)-)kj6FQ1Jk%#GL2Ct0_}a52UYt}8V`&3 z?vIF1OylV^9uzjnE?Utz}ZjWpimxt~Gp4BkrP z?KFN&V^13I$nv8!K2GCZ@%PeLC9+!hK^pIi_>qYps>l{UNn?%pwlqFXV{IB6)A%xt zbrRR7u_2AmjITd9pQrJKap!|bjOOcKQB32TG&UJ~#%Jy3G`1Lf7Pp#OdVQP5cPegA zV`mz>()d1&9cl0Rrjw(w+t~jg;9czo+p>8vD~Ykj7!T z95fLQnUOr1^RH?C&aXE+e!wH*$Am|Pf0nBKOWg0&adA3U&fo+$|1`>EP&VU*LI&kB zC@)@=@pdPQzE=f_esdKwsHCEAaEjqoM5<;`EraSAoSH#R<8_)yjsJ~FcRrj|Cxg>7 zNN13d%^4Xq%b>Y<-3;nwaHe?u3>s(9B!dPSG|Zrp#L^l1c{VMjGusv!oSQ*QiDzYS zwg~leMCekS!Fd^kG6+j)l|h>fE)Z{>!TBPbQ#MqRft5iZgJ9;rzd?SBwru=?@|8#i zP6qJ|-;s`}YGcNRPYw8ENOUzCNmbD?rJ~ubS%i^0i7;n>e7YK)#qNgpFgCr6a$$zQp7Vbzig9{paFvuxGq_BoPX>LB zJ#)T1gDWz)vebb1E%wWxzsv??aE-{o46Zh2zRk6z;@ptIjSQ8=m08@B!OaoVAo!RKZiKFeTzsmN@|?+b%`Ve~IE_$q@-96EPo-(%coHmjk9P%FY`Iy&xb{x z-OWq{7F!s8mWg(57A>=An?<`UiY2zr;(U?wvS?-O>DwlY3$jRL;bu{ig_T7l3nz;} z7Qrk+S%kB&v;Xsll3qNRjNj9!i53@$2~XN2RZM4*$s%Q{=$p+Vmqk8{f)V{_zN63E zXVD>xi?aN|DRj)DQx@H2+*#OF$WUEG=+e#PN!}xip3)hxR~8qVDnIi}RCSq&&^wDu z4W~gL@xH>#g?>I)WzjE-kF)qBi~d;*$l}Q?#%D1wi>tF3p2dhPuF2xsEN;%?7CBy* z#f>7&^ZG1qC>8A{qqD_Z#RnT@P!_j|``Hf3;`S_tW-%;_JB^KBb%%<6dUu&VvaP$b zxIc@Ls=Y^eukb!CC*OWl7Gtt_B#Q@B^6Ne zbDVMUgFltUge(@(EQ^U*Je|etES||?QWlf5m?7gSCgwDesb;COmFXrL`OGY4sX0HH zIaxfL#R3`l%G@lT%VJ&@^RswC`tu6q*D}J%j*u^u!HdTIWs#*>EX(2*@mI50oW*P6 zv|l1}GQ#pKR%G#R7Vl-TGK<$$`&Jfjh`edMXzz~$BfOo(JEm*CxGIbHv-lv3)urrd z`Jsv*8DlE!!kR2T&7!KVX{^m+T^9SZIFQ9>S*(}+t}HfW@p%^CWU)DmFS6Ju{VO3O zd}#;+ZpwNe;7PtVGq@#-tuok=#Ws=c!f&(qPMP>Q6TdGNXQw#hP~V-!4_W+}#hxsF zkxucaEPiHNrsxOpd$g~V@4+k%W${lI$Fn$`#jjZ$Q|)iY=4ckbXYq%MM}+>g68|(d zzVerfe+&63^h6f_idW2`Ob%spsGu=q4&`zvFYY@Q8J$Il`yXOySt*B8a;Tj9Zv(7S z%B!03s-DBC;-?8~2y2>Jzlqv8)XCv=iD%@{Du>qMb%phEI5UU(IW$nQMGj}>&``XQ zu(7a74oyXx37h9o(_AqlIa^{&Au~TmeIkd^4V-B5ixIlVXNZ*ni zEW-mi1jTJ(NXVvX7RkZMA)4b)5PHR|FrGt7Bq5~k=8zO;yUa5!o)P+SXp_q!pF=@n z+Z@{E(B5R;;eRcCm(Dp{n8QUmbWtrMbQS5AL-!nd1VVqGO%wdf9L&ArRK3XKt&;L0*D*hNV zG_{YLTIM!ZoROc*VSElxsW>Tz$vI3ApP0kbIq$_OH0D7vC5Nf1nvugak?BI#vPIv9 zIFoBb#b$Vk6)tS$ zHR-S9@T&1$Y%G_EEH%YtrWY%6See7?(%%-oA!M{Sb9hVK@9#U}@81)7Do~ zw&buihfRL1@Ec>fS%ibL%_!fCe4FEMWqJ#5yD=c=u_K3_#*$t?i2s$t-#Pr4!=4;| zl5$Y^a}Ik&e#v3K$UY(C(Dy(oekg~-IsBT#ZxWB?_#2&G>pcF<;Scd6Mmd`EUUB0G z@ogCGpB#?oa9SQU@;H&hzd2OViBm>cK98b2%8JvaT>ih+SRoJOafWQD3M}1RE-Cr{e^JpZo zaUM!vy@aGX_5AMWJK~pdS&y-`HF_RAl_Ek zu9V(EyrY?dPWk`#gf7w zgtz8#XC8OuF-XPR@)(@QkUVbBW0(|wI);k-^TihLFyk;hj}du{RPEiu`-HT)N90~( zdB4#aaFqB1!Uv7c;17$B7LLi|kvtwXwU6iVm^j`2G)Va69UB^#$CIiWpT|==8tXk* zeAN{nn|(TuNqM~27OUEN#*?`?3n(dge2ToL<}odg>3Ph^V!@m(I<^Y|i{VR{Z zjl19I3GVh-P72Ps!Tc~k4J@Ni0hJ0krGVO|wz9~n1ynIg)dH#& zP+di~E>mhcCWks9XVgDIJ7`0@{hN zs;#kXZwN&m9Si6r#gEX%*mo_Un|ODlu$5i~Tv))70*)4NQ2`eh@LU1&3b>?z-W<;Y z9x33`0xm1yR(bU)ps&dF1zcXh6$M;vqFq@)fAOn~(oe)6lK}+`ELCKl*Qj`H0oNIO zCVYeVjl%5Y@J$8WEPhMDdlMj)ewVtg9{i^z)0hJdjWS8a3_a!a(HL~!$j!9 z*6%7{cmekmaBl%4q|@f^0vMCT4@gOfQcrb#|n5{{D}g_ii|5@yvUO#2L^enfC(lIf1sY0&7=Y*7cixOsodcUm|eg$ z=`#wLS-^C0zjYs(2FWwhpEb2}l&7EDT!}QBU%>MPzAO=674Sj<3kvw8fHkUJSip(` zRu=GL0gDR!5q9rS&#N4Hk(Y(92>s?>D`2ULG+ScyWd$rR)h;{rx~kqT;GF{AF!pbX zyk#ukE#N&V9~Q7m!OD zY!v$OH<1_ceE~ZP_(u9x;b!3$p&x{;Y%AbfDdgW3u-$Nm+F8J^0`?a0i^Sap{A6l> z5c#oyJtBUzpT+$g_KE*0WaRw?94O$RiiZj~Y;-#MzP}me_y5P#bwEi`HQilyxn#*8 z85DsXz%Vl6E^8x*OzNKLI5SJmIp-ijvVtOrAVEPv#RP(gf{KVJD3U=16G~D^k_ANm z+cjVRhjaSeb6>rB_3G8DR~^`8gLwIBxz2p5JbfwDh1t>#bz4s45CU9RYkK#5H*9SCcL^gmTI+v zs4dOAgQ(-l@AB-V?br3>X|wf$sP9P{2+0xj38r-#2hmiT_X^$@#Qi}$Ae=Uv2=NE; zppf*cDGvnkkVw)-9u6W`nt4IA2%=>W&4S1e;t>%x7vw1AHg6yGBK(;220fitK|CHr zYiXvZ;}jujl7u~?2B8J9IEW=d#Da(iF+sX?!OlT+3Bm}%l%^F#Du{w0>>!*V5}uKy z=R-Pr#5O^+3!;4xZAFI?PTC=ejzM%1=hN#Y{=aWsgXk7S?;!dF(LIPBo=xiT>KSxv zZ!gapNA(S&Ul1dL7#T$WAO-|6IEW#hO9O)#Bo@-cId&-L6(hq%PRZ@Xd{hvlW$ZZ7 z856|VAf6D;xo*G4-{!-_Af60jQV^4acs7XH(lsTBX+ca6VyZMbmOjh~;wfp)3gT%Y zGrit)aEQ-%5)OGTh&e&LC=zzf4PsspF9h+tr$ZsH`O;h}AaI2UnY5R0TM-FzvC zmxEZtg$J=z7c;eAi@;~>@v{~(C%^v?E zh^@k33*$>69Mv_1uY_+C+#bZ&L3|U$4xZ=`8iep|5Icjo5X8kGb_KCJh~I-a8pNKo zg&=+iVz2OhLF^CWKoAF|na%$ZcSzIkg6@BJ%!zoV|GVQuK^zX^M^FA!5I>9l5y4+X z{;P0~<&_@$TkwC@js1Fry~5L;JP?9EgeD;bJpXC)L0J^Z zLm@N`p;-v|GUVY9azn`Tdeaut8S+R7is&>KJM7}cuCz|e5FQI59)cc1s}LR!Au7t8 zqIC$N5W*n@Z}Td>u85~YJ8B482(jBF>3OMXgkXo@gkW;}ZZndeIw6vR5RxIJ#JB&? z1dgRnTTy5iLVF<{Lg*}{qhKe&v?j5OG&!nU2;D>I5kk)pvckv?yW83;gcTvY7DDe3 z`h?Iognl8+3}IFX{bk_r5JrSBAcTR^93(h2guy~+VTh3Q(uR3EGBSiwAxsKkatNbC z7!$(y5GIJ`*bv4EdBU@hUUeELhVZ0kgp%~dS*CR$bwuP`ggdajU6vEdbd=tW+5cbND9fG@f7Z9>jkh637yFE^W`-C49 z+%I_Gw%+f^Wp~m+BOVUn#}Iz=bbboqSC9WJE)aZ;Zg{f zL--?vKSTH{gj3RcUhs4XXF@pZ**xc2_}i0kMYMCllV21ll}jEBM~7DjPVYZyj} zFiM6|HH>N^DHTSUFv^B;hcrvyX04p?%3<6YM)@!*NV8%Xm4u}CD;@kQ-Y8a~^s1|e zQA31xvyAXh0EAInn&h=aLN#7>M0l4csT;;UBB>{s6Gr_o8c1(C6ddA{uJn2vh0!?t zzdO{uVcaKO_lNPIkOu_)f@wdS+{T-R@o*UJMUopvUKp*ycwCyz1e=GEFXWLh6d^Q{ zwnH}_4WmUEEyH+B9Qgk(lGb4a!*Ie#gb|W~;V>eepV2VXF!V5tFf>_OER49ms4f8$wow@urZsJo(#Uyd(Tw z!Bv8*1>Xz1e;lO#!luOc!&n!_z6kb5@Ie^s!^n*wFMUx)Ec81>4#%}eDoc8bAfXL7!(kGc82 zU199zDYkv=O;pI(7smcDehuSD7ze^Q7{+0)i}8_Bd&*}V;$p-2A_=^1(|lj$GdXnTw=jMWL~vIGOrClXRJMF~i`oEjqpryBiJ-CRqXPG? z@rBHs2z-=8a4#buxzsQMdfP|_((<$AGwzGv{s;mQJQM-f@<0Slq?g<;k_QDjiu%Lv zFVr-GhZ(?pH!Ct4xWS?PNX3k15#&cOK7t7mJQ9HtLH7uHM9@5fMH{b^A3y{VECHs0ex{e4`^E zA0v2TO@NwD$kN7%51e{p1W!irZUn0$m=wX}2$n{$EP^Q!OpRb(1TRD|ErRI`yDXDc zWrmEM6>*R1QxQBJaZAliLGBm%Gom?IcUSa?;hP=7bKH8vm(?V94%H$cd0vqE#-V2;Puv-+Uo+Igi`L z%oP#5CX!_dU&Znntg$O2Zaq{gWxN>y>kLl>g>Nxu&g8r;_)Y|A&D9aS7s2NdY>8k^ z1ZyMw6S3I96g`pkzC>Vs1nYPU5MEtUv3y0hWPQlcNqTII;Nu8B6$Qp>*YPZt(@!F9 zb*2BCBKRzVQwiT@2^|S9uH_5a%54#Bk6>#AB`aloDUz=QmkrEfLHn9zB;U7NB;PO@ zPGo&z`*uX|Z3HB|c1Ezv#n;sRZ*;=3q#N$_$6SA<-RpjZ^e zqxdI+YY|*$k#Q7WnNi#j{;%Lo!T$tr31&oHO`1*X7m{X{V76dkK?oKREGoz$C4{)c zqbMo7l;9nLr3K3fmK99TMg8*9tRPrXu##Y9!8--32y(9KQFqn6YDZDS<28lUin@Q> zE8Sa%e5K3pj-qbV{Xfa?iQ)kvbQhzW^Cp+<4#W+sI_&u7M?(4%M@MY|}BD9ot)x4=?@ zf3)^lQP@#9QIIEPctVh4sYbLMr9dQYZj-lh^I3&iebWs3y$#Q zBcm84e6-*g!Lfo*2-0%Vqq!5Jm>5OXcJ5z-doqeiTuU6C;+P!86rL9i|7w^T#WdCg z6^B$zk75Q7po;1$o{Hk>D87#3nRF)NC* z)vA>;UXEgE6f2^5jfoL;pEUk0pV8Cwy%NQby02oB+*f%Dn&d8L*iEcnKU`}b5YnLNX;3J zvQ@gijN+>(s748IuN=kO#CFEkQ8;`@6yHX1o`o@rol)$H;xHZNEPVKnVt*6|qSzC~ zUM?!%y|Hrn`=TJe?I;IX{JHPEkN5O*cfODEj~e(6amSf%V$t{F^Wr36jlM%_2e?EeH7Pt@I~{gV3!M-?7Gf0mS%>E ziSi^y;lEMb6ybk@w*>j_)57v)iorsv`!GPwEEU8Abg&RFo86N(CS1XfutaRrI}(NnTFHCP(?Ad`1No<%P4!f$Syns;uHp6;)KE z-?^%a9m+?E^E6mPMNJh0R18#6OGRxJkE&>)qK=BYR6H!R->t&1d<|7JQc+iRH}oDA z^;Fasd5(&o4EGVefeJnnQh30cnR|ZWeD6z3 z`1%k~@sNsS4}VkDeVZ8hK|VP#S4Ex-Z>Az&#UnIZ(cNfXimb6Yt4am;#W20zmMR{j zCn`)8tyDa&BC0}F(OQgfR7ge8tU2$7QIlp&uxN#hxYw%-`L%q8rNUOx zSw$BWj*5hewkq1ue^E$3ji*!;sNfpgc*2sh1?^?+9aMBw-HOENnC*;1Cs8{qI$c$C zQ_(|3PqENl#cMtMX|u#$DtfEvr=q_M;S*yYAvD#Oc_KDB7ayJ}`O#4ZsTi!{eHH6e z3{f#u#S1Fts~DzYxQZuLOj0pI#Yh!Ts2Hc>wC>~BQ7T5O7$cUsim^gi>u8fN6x^fn zJP|6$DVZR>|3CF)6;o8qV3AibRl24L)^L2>*6EyGc95Pwt->mw@vMs3qA*i%mWpSD z(DFRnM+NFXr(zC6$GFLJ`=X2PH-zU^%o7PY^J;;L7gfBWVx@|ODi*0&s$!Xn#VXR@ zB9_S1S0uqT*G?S^VL=%T=t9;FAxnn2}!Q>&z?ezUaS6n=0NDBX4^v zTBYJ0;qMBjU-4Fp4qslliL|yx#ab0RZC|>|eV}5!ift;kvrwq`NW~T=wu%iZHmdkU z#iug-V`iG^`&c~Zn|0c&O^m;a%_=@;WDK`5^CJn7*Q1Vas|@^7#aG;MIW>H3=`Uoa zF*ZKnnRtvs(Xj!wNJ<&$FmMd??FK-d?)04 zLFU6@6+bfTGz``7lZu~JG}O>Y!!Ig+Wv$atO2ZM>C>8&xxF%cqyNW+l{HfxoieoBR z_K&MLAqM#d#1}ojyPZ_ATKBQ}mx@y=W}3ds%v;rcojjxBtk`*}V#Ya+V$m>s7p3dG ziVH%h#?Lq`(Il5dlK!f5#ml9uG95SQx{4dTO=u{>hZz+&d1f^?1OM~1(CoaT(iMJmfKY6oH`WArr#n*LT@>ZE z%;*SGlG5C7ed%v{4D6wVudRl58hTJcLwgM!WOe+Wz}sj?Mq5J{4V^TsP55~6hTijo zd>+-V)c+u#4s;X$yYr;T;q9fNH}glsKn=xv`TJ<-PoD4VtD&E0(lWnV5Z50IFo4W4 z_A=WCacO6A25Zp_RSHtrfMrjzWVSw!a?GhugKx?#Z*$eX{BH?=D521EPC+~3`@5!Bf)d%8z(uZDd>-s|aS7vpw-5$Ne>nf;!pL&J|O^%@Sz za`+)`bH$8phVQWEKJ9S%KePBVwvO+24Zmvc1LP46RCvE)#%RaK=5NwuMje%8KBnQg zkQ2;=GdbVLlfy}oG%26)7Y{X$n}&-lZW_*L*vK;?Q=er*%ICg83FRE~#PN~Pf%8%} zIpZY_mo;3`aFwOtL>7&6(wB~8@l^i9B^bVIG7IYWPpXni$r`aEnDU zhUqcPh#@nELNVmW@JI|5eBSS0rf(yRM~+%Nb*41OUG3O0!$ zAmkyzT*0O>JS>D`f3JZ&k2i~9cKQFUU5TL}hBngGJcdVOXd%313@IUx3APe^T(ETv zK_MYQJ%+H5h#=>R3Q=Rwgv2~~JO+MfqJkk3)00~<*uou8l87NGe7Qs;{UNBWNCpsv zw2Ps54}bd@I!KddI|}I(L+2Q}2=5w0Zz0`0o$fL85Z=?1^on72FzsVwe&GzXA;w`4GXOg2M!d$1p<3NWrl&j1n?haEu`R9B@AKi5SL7b9@XFJ^2J7 z--t6$#xO~mlfB;W63SGWoff9W&~cET&UwDvtCID3|V zwrA%#A#-Aw>q(v$GEa~L7sT))4`$u$cVbu=!=e~}R^Ru!;9|k@_h(bGB!-t_{84!y z`O7gZl`isSLSBjCRUykg`HC1`6TYf!2G!mW&fgDRDdf!hO9uJw$MI z4DY3zV&VN5*2Pdaj(g(xfSVXYQ0C<9ZA?M6FO9|Hg1r zcxD{`vG~V8n;DcZXu3;m@{22tvrxE>iEmlbn=RNhsT7H$XdI>Dcp|A3izA#=oTO4B zj^d*5mKfpEO2$F=dL@-R;wT+QnK<%vA1_YCi=@fU+;VXc%L`TztQbcnA(ZngH`D3P zII2iqkynkQn(*p^HRA3Ot0_oQOGs_OI)Zlz-W|v6M%hiO`0B+`KaR)ZXcfmBhjJRk zkuQWiM~F|bpFq@_x@^qRq0;94h z$rVXn9L&J^1d5*xu&ae|He1r$QCTDuJ}yfR#nIZcAB>}A zuDcLMCLBj3j%XaJsOfPSLbNzyLZ}l@lR7@rBMBjvpe^V~#Hh^RC*w#_SjSf&*d~s) zLfQ$ok7Ht^Z1(a-*&&YOH#5mQ$I&H@OdEx4bd9519F29{tD}1yJ>qyLj(6ke8Aq=; zro}OxbN!OjTX0|;ed6dVyk8vsg=GE^Xr9QX&Hx4^sgUsBcLv2VIF2E4_uqPk#xW|6 z(QyomV|W}RL`Zp{arVgD_?S4x#^FC3n98J$V_X~q&ju#PF+Pq7aXcBvB(6nfta>!} zrKED9TVCgr0ZvCk2??81WE45=usI`+r{Z`aj`?vs9mh;gw=(d&;4Hz}^jQey&oYIo zxeC0Vi(`(+i&w+kIBr&T<@1>H|7Q0-lKVm2w;+xe<5(d&3*%VC>KgYgk7IEhON74~ z$4f%yi2k|1b6<|*o49W&_a%;3;#i$jIOO~r?sT6Cr;rk!sn_Iiz0MShV`UtV{F_bT zn{mA5@wd~*aAknO|bDTO*&XL2b_kJ=u0Zz~kmJ{S0gCoZLs?2Ka<&BpO_ z9J}M#!&wGq9gbsf+pU*uhz0~|84mST3 z9TN7Qj^m7+uW~xh#&Ir=EFIZ8{*L23vxPC?kF}?i3vpayVUOdYEcsF#m*e2V$EB1j zLaxT~4=b2NgK}EFA#w`Yp$@|=DP*QixCNK7u;_x~?@>5d5O6w@2yH$=x%Ia8pCcxhE zIx2`-MIBXjR1;oFu(FOjg;Wt_=1{-7jv6`|h$l65)Y5T}jz0%Ct*vAD;HG!!xLZdZ z;Z(j)e$ub5j>UtUvX{+LLz>nT{rZATq`CKJ=ZH0*U_-%1I_M!S(AE2N+^^%Rj(>Ew zUOk}WK^;wG3cpCkHp&j@cu2?BI=<1-RL8?QX6SfIN3PDh9(wBNrK6dSd>t_zaUGB7 zP;@-5qqUCaIv&+ArG~Gij&>dWEp)t^k+q?Q@2@&;^D!M&+W4m&%4ww|%XSHcK^eU= zKte~&8a_vGb%X4r2q}N0kndP^-8_)Pc*wcf?5(4ZjuARW>gcPZpU#hg7^0)U zj-4I-19S}3!KKwL#Q!PMMYU-)YC0j^d<{@IX=vb~}MKxua zSgw68^A#ah2S0;6qLy!kj@OyhI$o1xppYrCl3ODN-(qh68R+(R4h=qR`zvO-Q@^WY zm5xtze5&&sHQp10AL>}6V=Z$=n(yoQt)G9Ljt^*gK$ek{{l=|AMI1jDMZ9!2lk573 zYyT_2YlDuB!cm}nEHjd9((##&Z92B=*sSAo9ba*?=K8ltptkDxl7&deueE&pb_Z$~ zDAjHMzMtGJyE53{u}~H@S6F^# z`*eJ#<9nH6zbxdSjsrTll?==Lj{dKaMbCfGaY*MsqvI#ZuOy>VNarkdR8fPe|e1Qh# zd(LGY)r)7$I+Dd5yduMcw+hk7H67P=j59Ib#0};f4~v2025##3kGpT6pMhICG7Q{j z;C=&{1_~J{ZJ>;SDHn3G3=}p11K9@h3zTKk{KO&#oC2k|ff5D=7bryy6f-crKzXG= zd26h{q=Ap3zO@BPDIw4OmP3Ar0b)1RSJpr|12qlQGEm;Y)v@`N3{*DIJmjljprV23 z`J7z^3h_<@RSZ-$P|d);{eco61-6BKe-tRUm<9%F7*K*f^0JzbQ~WbKzqWxo1{xU1 zF>sdwdUB6}dIs2gH)m|4)a3%(C~OAXC@1&kc4(v2H}L%!{~xpReFmOrqck?)JD*F^ zP@0Vl%x|Nxd9TRXwYH7&fC0aOkb$s)2Msi#8+6`4z`)tD{-y>VHt>)vr~Bocoo$p{ z19=7-wpAW6&`i8yaPkezI21V9M#*Talx?dp2(`}VJZhkYflu}aS{rCd(mL-k1FZ~P zIGam8?s87cw#wrMY!1

    • d@k6i=6j-BZd*%rvY5x6^Qxy9J4-#8(6Uo3}(IHPWbA z(5a=Qb{cgGlDbOjrBS~iq5TchXp~0dG>VxbX9vC0 z=#$2Pa_LJCm&=fIN~1G^CgpNLxy&h-0ci|OV`v(~(zvZ$2Bk4LjUj0;S3g!ROka2J z&%9YKUzW@8G`^S;Fq4l+WB&dO`Q)pDmg_U4(F(!?%X}CXT&P`(+7m~)L zF>+=aRFkuU3G@l$uw2eaBR@t4j}eTKTGNBG(l|SfbJF3j9=$e3`0nT8F|v7#oR`M= zY5XxIn3TqaX}mNoxFC%^W8~j45+5rUrO{-pRGAs{9xIomacLS?r*TahQ_{FBjp=F3 zV6U-qc^cEwczR|qRdLZ+d79a8tW>@-n3={EY0OGvb{bcvaa9`LIQe(1JUdoCA1hm~ z49NdSKaZ37kS2|ji?0r@O=BLHHb1kE3gwykX;d69Ouznk zxsLml#*#D^rNJr-uYL5!_1s^scVC8_u|YESs^Eq+ZshSSLCX@{l*Y|z98BX-8Y|LR zna1ukK2Kv6d!_Mwnr|Lqb($Z*aX%xI(VoWIG3X3p)?*& z<3Sp{F!Q9&!lpIj>`LQ|3Br!NOw3x5 z`IOaB@|ngh$^Og3pX%Zb29XE+3&tvY@t9v0%70YymEvB-uNA*h{8sTh#qSmODgKbg zekK16@>3cIbUGr>#T|2kpVRn-`LG0b3Ew8eZ%nx*s8)jCsleo1f{G>hlZP&iznSXw zTpwYIo*ewe$e$oQ=CqAf4)t$3{Mn^LH)hsPkfS`I(}H7Z99MEek&=^XoGS3sX%v-& zYRpu`Ix_>5ph^ionIM%)P`L!WNqc^Ryf`EC>Qw>n=y(@by#&Q2h*NE55aAu{1c_3u z1kCWp#PEKJw?@nE%@`$NhT)xOq6Enjq_~Rl^6ZpSvjjWl1T80qcQPXV>6`^`~?rWJ4)ikhh%8hXmiRX zP(Fb<3CvAECQu=PClY9rK*a2~hy#&^=JRRkjj`Ed`FDS^%juz%^2z@AR>hl!c4DoRSX1iCA{ z#~n&fh4fOew}P8G#T`?>1kNhti%yaVmA7DLIWU1iRD||&u!7Y)%OMIOWvD`iB`{ne zBNQBY=jkYgjHXa^jDuGuMIFP`>1a`8qy2#fQysN7$*;VdJ;C1S3SGk+Ys3;Y> z$~UMQUFDtx_9|qbf~35uko{!r9ZJit^6doPN#F!kIDtb6yh|&Qz~^LOSNUE7A9j^L zb(Qav_*BI30VxXq=nm!M1U^ytrwTsZHP+uR63Ed_vZ!Uc$-@d~^veW}+`*5s$_hWO z;8%C(#noHiB=Btl->G`l>n1yQlY~RN$pziyj|u#g!0!qCk-*Oh{@IFO6F5mb@JF=0 zn`C(Jw}@e1H+kZZ=r`8ukLYMO`DX%uC2%@{GlVM5sRX#Uk8geTXLObv{yn12G%_0IX}FZY-)xH{en{eS0{>7ok{F!Cl?48!?MfmmiT@I~O8c3Fp2W2TuG4TO zktc~83EX7WlE|6FEmo?zEYn@yX3pa>Nq)V%83p_oF7C-I;{N+?+J&eKE^$vb$p9x|1Lp|bK7G?TECaFVc+C^0$H zu}54ZH;JEjL|zgv_mGo&$kjb0k&k-tKVpPQuy*`(o>#9BW|GKeo=G%KqEr&4 zlXy6Znn{#NqAXJ;!F-sEuv`-5$(Ejy{A7^Hn6VX-sHl)i3RYIIih_JvHHm5p=cgI1 zK~^VYKZ7$o!vgC)<6=LeYE(OkT8hKu42g9V=O0zIV>8uFqMmB6`U;ZLAc=-|@J2~A zzJv2ae7#u`t&(V+MDrwCsQg6Vo?%{lNgc2$RuVYF*Au#Nu25_ z$0RW}iO~wr*GuM|6pc%Q0~m(sNsL$cggcapNldzfPflWr!l&M$OjC&2D<1#+H8z@+ z#Ox&IB{4qnVst?g3t7D38NNlx(4&`JlEl&^HYBkz ziDgMFrywP}5x#pxeRORS>ylWX#Dre4S0^5ZjfkHv=693W zoW!;ywkNSAiD?7lZ*5ItM=!}_#F@{NNqo>t?zmGU;!i2un3#Dw$-mJ-gyC6*Jg4CE zNxYzt7w{pQVw~{z;2S2EgJiTSIw=CaVHta12^p^bGd+MWKDEPjDA0+Xi zLiqF}g?y~wCrNyIhyGa-pWnebMq>ZDs=`{N@ ziGPx@_v|mqr$SCEcv-9f5}T`pDeFGC4G??jv7O_@q8Emj-CD zGw_E#5`87p{Ik33ZCsN6B=|4M3Ndb z7N+0-y%qM0z0IVU8Y~U%HFVHmYj8AF)lf}?tHIMCG^9278eUu+MdZe+D9{jU7&tE? z&hThI*|(pZ(NAV+$gp1gRzJC+pWNF|W@{*=;dnn;T0@&v7CbC6(n6M zq=JTucPLLTk1A`ZqQ$PxqvJD7!;e!7Y^MH_ z$k!_)y}zv7UpDP8j}ORHTp88nTZ`i~%{A0hIHUD7G`NE|R7fKYjTO@54!x;DnkmTF zTWDyhVMu@Zn1-j-w_2$vDXrNG3V-4brHzKRckp%!ncrV_)X+&oKMnmgbk@*C!=JxL zy)|^zaHzlRuAv93_E*$R!Ro(9zxJ0sHC*p6d#RK!{uWQN7$xkZD18+yIzSF!(`cBY zVXB5f8U||^u3-eft6?bfA0UTOwAyE~2FQ8?%ZRzeAazVd5Q}`5YV)5i*}k1LQOf(>2V}Fk1tOGc?TP0BnHd*YgaN zsey5tM+U}UZ#z)VQIEzCl=C$#(9ljtdmRfkEYk3;hVL|HB!%_{)G(1JN zYgn#fg@*MSHc&|3h*nY)HLTI%A=WCUACX}Px>mzF4X+K92Zv==4~*Hxoqmt@&1}@L zNy9b`+o?wywrJSO>bH!OeK}BG87K=3lH~_UPGg^>FbtA|S4BHC^c*B74w4J!M=J*L z*bO|Z;Z;^p!*d#**YJ{tmx&CLFHl*OGSUvvMSN(G{B}^RbgyW*JxJ<FzC77g!f*rQ>uhW#4e((vQ3%swri=DexwL&=eui3j4fh65T7 zYIuh-qk&5a?FP%YS+AARxWRJy;CQA_KTM@znRi*#QJJR(%MUbssNqWuM>Kq-;bRS- zYxqI~yNORUe5&Cy5(mrQ2Fqb1GPFVroQ?L|6w!}&n8M#)-Wn`t4apqUa7@Dq4PW#1 zA(`VE8V!+OY3!$Dr6IEW5c&L!Xv~<*HYdY=O`FMu*E0{yk`6#CzduE70QSMSO_noJCbmYB*(L{RN#ZdXuP|4!)T?Qf_4VBEQppFN01Uf<;g>)3wq3dWmEGnXdi*cHQM2ae;n2zEK zc~HR;3YJtb@jo~qN-BiC`N^U3_E4EpQA5Y$L*msvQ$;Nuwn7{QNq2R43ilN(IZTom z=@2?HIB;ltap{VLbZ< zQb%1K^>kFwQBlVuI%?^tq@%KqYRpPU6+U`AVn16|A*Whqh_f55q2nPP59_GO^nE40 z^e2YN^TXtQ!=*D^HW)4k4wtoctQs!s==fx~d~tZ}=ecWk^r()L!zGt=>+5KsqnVE8 zdhGLT$fnWx-zeysrh3xp-9(R<-kR#MPmB)F&qidf50@=;wA9g>9Mj{W!ecsG=}3=| z^!67SA-U4`=8>rJ2>FDLHagns=s6;G=rPP05f^}*>7b*dj{Q2`($PsrXMRP;OdVZx zbk#9Z$0!}$bp8^KemeT==)p|%cu}B_j$S&ZOvv=6%#6-(b&o`HlItLwM##Q8_Kc8R zpBzJcsu8u`I7VDTtArw; zcV@+P$=~Dkm!}42mgrcg#sJg?vjI$pd(e@Vy73TG=YS^iOSC&jX3^rnv2bU348$}Sp&QSx;i zyA?wG4TbDcaIb><6lCu+Xh?=0+5iAE`Rn|qvJ37A8@x6{iI^Lx%(($>D_jJ6k z<0Bm(>-a!N{ZaBmJzgE_H!5C1n>I>LpO|5k_$N9(C4WZ6Vz7HuyomFKjx(b&bR&PG zKni!I z;<3aH9k+GlNZ}@}%9`kwf;3GO?3}51;g|}ND+P9xv=xcI89K>xr;sOwds4`kLf%wt zMrIDp+?~Rd(ecU}-SVqOOLpS8B8+5T?*}j2t;eE*>MJ z6h0UuUr<4$@ItF>;#n#DGDc=n_;-xVRS$9NuG5aYusSL0==@v`1{Ia1O2XjBT*#!DjG#>=r3Z&e+B zaU7+qetNuu6BL}N;G`5Lr?6+doTA`V1sR>Dkm(8@9WT$0m$@d$TDc@|6k?m6E)t*9 zJ2!<@Dcb++d4wq}Nb!&~EM=3WuqegD4KfT%6tY;g#Xak?i%*awl10lYfkiSa6@7(* zr6=V%$jvFdq+Z{W!qybFDV**8 zR0`WuczyzZAI?0fh&vQ~djgMf!!s#7o5FKUK;c*PZ&k|66J&vj@I2e z3hyXhberd=%1)Bew@O|iIRa& znT9WZp28Qblz|rw98Td&YLkK529Bg~G=-}vTub2?b4cN5>U#=bG0k7m*Obf@I!wu& zP>@ahZ3?`N;`6%$_U$r8=a*KPmbi7mT{kh^aq` z>nYrz88qM4BSp3hk;xMU?8V~-M0lpi=62XCP^Z98OUwGo*e(d$B@Us zPm^R`0|nM*7`dkXtO3cl3>=&+%PC5E1%H|>D;l^qSw1jD@*+55yADAkSs~5YF)dqSfVpjv*44j%OZ%vhjrb%y_>}jBv zf!^wAtS^WuVw}Ia)m$W#F%AGRJhuWGr^}bXjk@97k49mlF(3G%%j^nl2Yi zm)obyH>dL~O5B_-pFNsBGF?vQyNWnX6_Ul9Wnj9(XBe1ipzsXo&5+e*#3i4t=yMco zIYZ86?G$|hIY!Ahu*Se51B+W^mKaz{#K6@SnHe)A;W7iu4Xjd>6$);dAy=xz`8sBZ zzc53-H$(mpUu$5Kfz1Zi8CY*%g8?SkXdwSg`5nKgG9+b-fvuE715c?8w<-7}wRoo7 zt{_XoPgk887vO0F-&pE2;P!dt3G&ntY0!e27*G8@IjG!w5Fc$Id;Kn@c-4ZLRH zQv;tF*k#~#18*C6hi1fx|9$>!rrdAf4Fh{rbgzMZ3Yk4qZkj3IRQT&NC8G>)88~2I zf2Hi-X3B%KMYH6Cv*aNInOX8(1MexM?kw4EmVBXU=6x!@fe)!Nbu(X$$o`lTGE07> zqO)d6Qa&+2xM`OB+`tzUKLe+!ynJPN_E7`JRLU>;xmogvf#b8}saf(kUor3_Z5s8$ zz}E)8HSis4I!k_I;C!RZkw%%~vn9VMX3OsljBA$p!N5baOV)enZy4DGWXAs{v5fmS>}v^ zvj#3xmMHLZ2Pz zVB#(lNfVlh+$QpvxZgxU6M0SCZK8mQ4s+!_CVC&vk>3Pcgdv|oO3jt`Dx}WbxTTov zK9zXHTsd#9e85Ce6U9svGEvyXmbo!!if~u_+?WH$=E{6cGQ~}lFj3OPgC;J{mEShZ z+&fQ_`3V!`RpZ7PYo4q!PwFO8CQ6woZNe~Nng~pUCM*-S3D1OYf{7gyu8FUjW}cWQ z2hEd{nr6P{6-!MrGZemYo{UTg6ImuN2ErTj)@~-((pC7kQx%o2N1e>0@ zHJUHWm?&$aiixTw%9-dkUrG}dOq4e#df$gj_ll}uDN!ICdibV|+(^X1#~ zWi=DkP1G=X=ps%iN~=bhON}!Ro2Y3*Um*FdO_j3G&zE@?#7J!ubxd?O(Zj@}ChD4a z%tR{_^-R<^(Zobk6Aer>G|`A*LCh;^U)#Ew@(X151+uY;Neg1RZDyjmiI!B`1(Ge^ z!o<1-k^;cMrwpGgkgZKTZlaxu_9lK`Ag?aq`MS7wp=@KKEg8E|R$nMvE|fhN%JBXBNt?WR8h{7s>+*<%xxo$o-3CPZPaN3^p-@!eb&@ zB>S1@PpMlZ`>4cy$&-cg>+KiG0VW2Tn71g#hb@vvW@Hay!4}DFi+D#fhLOExGUH4P z=POgPiH|ff!UP+abs;}Tu|-sx?#(i@DrJu`F;+#Hk`guE!~_!)6=jNolkPm7Y~s)& z$zCoNE|CqF$n7TjE|Jrh$Sq4`-8z}4 zOuTBwzv@42;u#Y^w90dNR#to5dB4ohC4zBG?1 zggeO`UR7gamxQu!RxFjDY)up2+#~&XUr}dZ zdPEm7qDT6KiLXt3W8zzyLH<~jPYk{u^=>A5-HN`W?%yNYuTJN>5i$CsiJwgT%4|D} z=J`bRv(eA24vpI*Vn$Zhg&Lynh3KS--%LCaW&JO~p0xPWN?y?}th}&f8`6#D_92Oql zSB4ZGmz2xG?h8@3I%4cnncKpXRm69fqdXP}iSMnRo!0_+#b`bY`7IQ;@SufzEgq4L z!WN2HxX;4<79Oy8mLL`{mCrAg1^LBO(R)i}$7|90;_)xT3_mQDMHQV1idpz)X?&2v zN3GNMEt4fIl(e8(&@KEDh=c|H2%NO=LQg|vk%3lW)MVfz5_aOoV=8;N|D(0isA zbxdazacxPFZK3uuxpA;a{vEYnCd*hTYvHpjQNuzx3*{|TvQXKAv@kd=Dp;s!fsKB; zx+s1<+V)Shd9*mRFH^-rRSVTDRJZWu!~v(lmx#OI!9AVpmZ^(=I^(8EG~3k}E<3vDbkw9v>xOAC)# zXl$X0h2|DoupttnsfBsVc)Dn9;c;@TTYBMZ znXh}MlUL(5>bp17) zymjg3-P2o^NhWBLoyC8*%a_gSX`z>eAr}63A82n2{Vepi(8oewi+*NND!-UoN$kE? z46rcJ!XR?h!qQD?GU5Il;)`a&X(L{FCDWsKdN*^vOANK}LQcWlMpzhW;d2XLSQuqt zw1v$UwpbWrVJvfCku07!i}4m_TbN^Ef`y3|rdpV0VZb9|l7-0@rdSwSL5vw9&I}S| z`iT!ZickB9=@w>Km}y}aTe*U`R#QCJI=;R1`aoVqntoukm{U*8C3`I_w6Ms+;p@?S z3k#G~KXooT_HRV<(m9uC*e|`9<*6)|u!NVRt(T+O1;yvh#n4DBx3J2>Y6~m)p~7ON zf~)cf;%h8ixm&Eau))Gw3+q@ZX4ozL!`*@iTW6z%O%`?yOD`*%b$FQ^((RtwuK z?6dGD#hCg_E|I+!c2FJ~il;3+W8o=;EqrMqw~ahDj#xNq;k1P_7LHjsZsA7@KUw&S!f)Xli|2lWMqq0#@in8x zgi%Suj15u~90#LM|#VmiJ1-#$9%7 zKdY~cTcKZ5k=MrEHVhl4jeBh5vr)uGQ5*SfUQB?3HXg81z{Y(x?zi#tC~;=2$oZ(C z5n~D8lH%!h>8O3Wkd4ANf)(-+7`-X&JT7Xi zkSsPsV@Eu3I=U&c*rqxQ@Q_H^Am7Lk;;mOm%Z6NbYi7;dA6jfZTswb9PT!!~N#Xl$d2jYn+MvQgJYJsY)c)Uo613m>&XA^)(F z__?W|>{0dZuPExv;fTJKMB$b4 zg+R2o(ZNPf8@+6Fw9$#h?vw6jqqB{ZS)z-LuFTV{L;iuH z<(nCfln76h7hN}{`JoXuM%q|rW4Vn{6dUGgW0s9EHpbeRY-5UzaW=-=m|$a~jYn5X zc6>b2>cuhQ&}*4VGz(Xw97V;htXL+e+L&fzx{VoZrjBBnP~V*Id`RO z@=m7Fe^Jfr(Vo$9;uSVlQY#CH?KW1~SZ!mYjZHSz*jQ_0osIRBik`7$=6Kcal-7jU zKs$C{T-rHXsS?iV23h zi-{JxVDxBT@!0V6Zayk57~Zhay;XYmN*;$Ll9!_4kBNOY-m>EpW8So}pS*o6z80M2 z{B^K6py=#9%eC#~UAj{j}EXX8T~Z*&vy+qk(p&hP^}zBioe$=AQQSA1mS zV`_a7!AI4SqR8#&GYZo6=&+41si!u+AanYP>>E*u!Rg{<#St4vZ5*?4ob6IV{BbpI zwZF5n>=J_d)wPJYZ<6@h#y2+pv2n%5w>G}B@h9`7wY2erjbAD4Hh#466Ahh>Unp{g z#ILs^4vJ`tPUaRzM~I3AV!QO4jo)qjLGid>JToBOE)wiv2WDk8DAU=x$m1ZdgZvKeb#S+XdmQ}SR^)SHdw6T5oRblK z{)dq7llP{{$u zDwL~}XQOegL^<}N>V=g9Z*7I{5cotV9#?iQFwkdzIL}Cms|vAvYR} z4h}jxXzHMugXRueICz|_bI{VkW2`kBk@OPc?b8uQDPIi}-$jCoOsQj@Z5*_9z_DmM z2lcwd_Ghml3a(AJcaY92IBO>C=;ENOgPsn0Iq2q~yMrDMu5=VsTaJ;~ z9PDeV?aCx8i{1|UIOyx3ADgv;c(Q)1p4Zo>&r4DER7BfI`#I3TAP2)JNDc-&7~){4 zsy+ptQ;&%`1!@T%NXU`N2)2}iQ4U74=_kc{$G(pI3qJa^gZO@5=4D%~aj@3GQx2YXu+G7H2U{F$b+Ey~MhBZ5 zY<6&NmE&`J1(*yODaAGi+Z{Z~k5YLn3Aap^zFL;89FNs2td@;d%O!xIH93y=-P8{f%e$l~84qkRZT+d`N^jaP6w|! z_}IZG4t6t|Hs<%$QDWPt-*@;kT`YkQR1vvLiAAd=NA({% z_=sZ0nQ|^s_fheC2l1(c&m4T?;9CcuJNUxEQ3uBy9H!n;Q0t2$6ukeUZV!rHC578o zkagQu%i|8da&W@I*DUaA=~l_)>X_ycm$bT^2T>+zI=*x8J?)-@UmW~EO@CDU=-?;X z0b6VzA*%KlbI(S#vc=KW@>d5Z9sK6tcLy9qB_B(l2xAp!kV_mo6}{CVJ^xblmxEId z+IeX2;k1J@Y+M%`T%2WtQvF@jc5&Xp1L)5S#xmuP!kULk?M9b9&B+d&Q&|4_di zTq7qbs}BC7RO~Mz2h!z5 zP8Ydc<$~AHbZH+ACqOgl1Zmd>MR}(@vgcuT8`!D7@U{?soXbJ5C;dzP9N#g*=YkDhSRhRv5lw0F_g z#gL0pJJ#`~jGserOiT5lG4G%fFwK~Kna(b{xajX<09)ThHy6EJ^k!u%ita9YxajGk zd(ZUAK4SM8`N`FY4yZnpL?6nMi+(OXTO*rZjXFy)w6CbzRQ$C@vLOb#7{pJz80um$ zYi-1XY7T)ozu;hRn2X`$wu_N2SmxVnB%gBP!0AA8tz;qDU5;^MhsjJAvs{d&Ah{Ut zVuFjQE~c@q=j52^VzSFyDlkb^pE-~Ti7sMY2O-zS-R^XLqDOiLnYmVWD=OG2a2AuV zOxA1{b6hNQvE0R67xP>!bg{_Ad}iy$Ua7azS?7m|o@?dgwQ}8Bx!A=L%68xMQWtzg zJGOhRESJe5^Er%P;bNtW)h^ahTx*L}sxbUk(T;-tpS5?&w$8=R2Q#0ql|}B2M-&@f zY;tkS#cj4SYwF^ti(?dN7u#IC>0-Z&?Jk~l@v@6oT*U^bl3ub4ozuU&_`}7YF8*?His53!Nx_ung6`rC z*Q43p;=vC`)MwcuH1aOau?t}B&PJb57t7_8Q26);ag+v}9Iou4iiff5 zV{TVf>B+Zh3R$&YKBQ{2IU{O%`0_&ZFgbrJdVam68{`oW@2r=7HmB=&c+^7^4^2JP z^-xc}(#S)74-Gst*YV|<-c69in89WAsTxii>Ly-nu}&0ntN#Fp|yt= z9_W^7>ESWHdnMv3!0ECg{|3pfja}s99-i>f#zR}C952{aQKC4zDi7T}boVgP!z2$qJoNN1#KTYzy*%{xFu=n= z4}CoJ_0Z2le{ym|%%9Q?M6=xD>5H+`n8ULs8{{Al1*5FN3U(MF$`=$*4v#&G!#oW4 zFoulvFv7z~52HMc_F`Wd2U;AXQazWfPSXhAwnXhlVw{KZ9wtzVh6@sDcnL?%=bFx$g)4>P=YfoUd7zCm))jXoT91V`?Sg>0dX< z3w_ehdw9Xa9?GzX7d^b>;WZDtJiJWCveEmbcY1i0ZJm{MV}qPuD|S<`hoTRVk6!n% zn|h>@anedd%|Id{opt*>yy@X>inNFQB$8tu4pIjGi#S_x|B0P2ocl0mE)Z~NcZkMh zqkPxHdlZkMv8tBZD1&Y34((&l&xam9Vy!)#_wccYPdt3>;TsR1diacbHc3*J^cVSj zVR&V4hAEewii-I0u&}7gg!yo>^+BKad||YYF+NH%2Oo`mH1?77q4}ujqmmEZN6Lrr zk@jKuFnxGFd>@t%+vnZ5aD8x%j83`In(9kI;{M$%y4FEodva zGBu*SsJ}^4wX=L=e3bD~)t4QOC!lJ}+spQ_BVl zY3O6rCdqjgi40xWrHaY`0K8E-h0 zxF4t4;X+s&OU&IQXZx7L;`x}zJX;7Zmu%l83-*bZOX6K0XCtOuKtXynv(S${-t>j? z^(8)*`q=1Wlh2Eov7CCxy8Bq+W2KK({G1Q2H{EI$_u3EMh`2Z4{Y`Q~eev@qxsE#3 zMyzM8*_xBY)pqIWPo!72iXHo$Ol|hD#m5dGPx;vDW1Eld)F~hT-V?hx*fAY?P%!+r zNeSHg}?Ul?c zETNBGK3?^)(?_&fnz^#;Y?iFu>plo~`*=ekT)bnn!)8f_Tn@!Pvf9VnKHl-M-^W`% z4p4C@Y_}t>2mSA8ca9q$$*4uN2I7#9cYVC)M0{pZfU1$6+6z`S_e)X(GlxEWTr1`%!H#mtW=V%X zmuWZ-@6SX1^9qyqzxept$M-ZKKEClmkHNP-zN7qXmh7QU+%FDpmK>1Kaq%Nnz{k%N z#Z_{L@{@C{PTyw!E@_T4Px|_(PI8Ay08Q_eM zv(&Eu2yo8Fd8%p?ahoz(SX}UNg-z+>BD(+|fBU%1Rwyj~VH@>~SNbR|e`#WWBz6`M z|M|G;<0e~wSB`5wuCoOzi5o1yz2ddf;+xI#fh}n#6n}4)w|v~aMbfLYBN90RaE3x7 zlQRGz@w)=#4xk4}1;`U1Z-9aU9td!EfO`Vm8=yddd;zxB6Z!ed7D*=8tShQ)k+<&? z_XXhUWT(r~{Q;_6j5sCib2Z`$Y@q;!1Ktjd5&?o$xfZ{LRR0>czK%)SS$$ z1Jn*sCqT6T)dM^npk{y?0UiqCc?TUtYjejXS-U60Irt+1I#m(1f_U^!PbsHG6gE;G z4Nx}#=X4DetQVkufHe(r%+Dpb(0?$O-~g4dVG!@>df{NENr0vS+68DIpjm+C0a^!m zJV1*8Edx9jpcSRg5gS^kd7~3$o1*(f>8zcPiV^pUC&;&@vQ2=te8m$VR~8jJr59d{ ze%Kyt8fSCd4*zfjt#1RXxe>!$4x^gBK zDqaFOC&0Xbx7EjbIyV4SX+>|bAi%%>mX2*bs0*R%{Gn&*7i<38QnGGd@n} zsC`?gkJQ$y(Y65G(b2R0 z_~hr?(HjBw1bCB7pyY3rdjoJFu`j^4EyM#k1syURV7x`12eB{oAfb|F+^|GOADP)#sWE zx6geR;By*~La}nKWd66JFIlAF;#h#=0gePXs)RgV?06z!ZriecR{7GvT;ADW`0{l)pb2b`# zCAzjY{o>ZRui<*!tgN^%`-{duz-cNVE$S9YZ#=(F%NFkj>=>K4c-?_EIl!d=e^aim zMHdyM{BzxqgRaW~{t0j;z`tbCR^A38xRT4>imN0Xm~mLhxydz(L4cega)r1-R^Nzj z1-KpHCTr0;t}mSuIYMw%t1>4AH{wON-?vJH;H8|oL*xnL-Gg_9vEI=ck~hTNVZ2fB z%i0`8ivbUaZl|IfTV?(b_lB@TI3WszxGzM>5DC5;qF{)kA&P}~AVi^%cX^{oh+l6+ zpAHrUx5-l5w5H=``}2+M|~>ur-2qQ$N zZBh?oZ{FQq#kO4WV&x%Um?5kXTuvRkO|rDKlgqYAH-s0WOc-AfP3JQ1Qzhz=n-hG6PGh@ote5Tiqk2{Amx2y!XJs4(96ckrKR54}3YVl&%yyQHi6 zU`sJJ#JCXSLrkCu4Huu?6{{iJnzH?yB{=CDyIoEWF(t(G5Hr{ir=zJM%8wG$!g!Zg z)53z;(uY9G%n;mYH!I|pY*DqEV5iCG+z|8Fh}@?UVt$APWL-im4zZBc=emChv548; zj$YM7mzsjxn3se+a!1s>9WlBr#B$XTD?+RcL1Cucaw8e{-x6OFVr__bLL3UQF2wo} zFNSz2#D)+XLp&YgnGl;oUXzXOA)XAeB?JxrR^~%4B}BWoGN~6c*Vm-0RT3O6^Mdgm z>RV5R;0%SnbWR^m77$lNJi2%`#B(8@4?&+N+44e&7272@v(bHBc5wRT5U+&T8)6>| zA7W>S*F)?M@md%=ei?SLjjl%{N@Y<1h`bSEkNOt-O-`Vm$Rp_3VX`;bj`aM8I1plg zh_f5hjsA`Z84iYcJ4D`5f(Zy&Lc(_`HX*(V@ok9rLwpe8(-5E0$V?I+Qc%~YKMwH` zHH*tVlVZOyDW9mP6aJ1q5Aj8aVSkRiSdafJ4P`gJMZHN?=nu?SVC%$Wtd@~=Xi zpy_)y$Jb}{?$Jz@T_=h#so1CK@ku|P*hax4(#s27U@n2yX$Xvw_;!?>ie1TocEkPb7psEXKv4(nLD$; zqU@gb_VimP{f-g#w7I80I_Xc$wWoHT{z6l>Hve?ezffQ!v$&J~c2CITj7{xh+B_}k zNuHMQY)5ldWEjye00yPaQq2;fc-;KaFUOO-Gk!-{z0l z%b>s8j4s#qw2r6sJ#FA=T}~wR#KZy-hRZqPTsG4#VQlDWBTpNW6U ziEESsn|eb2$!y_iOHbQ*+TPPvo;rD|Jk_2&PsUU1De>fc3Ot3LBAWZrBUs|NHN$qk zAw>VMHSGX-)*oK#Df5(jDm)!9z_dHcK4+@1-^zyarTdU?Tb>B&BZGuAp1OG2+EZsw z2cBgwYD$J>r<2Y8nTT|MS8w4*0v7-1&e+0!nbcK6iH z6O*O8f_2O6=GoykhLkYKT~{;RJ?-JCho?O~f_qJ`fj&Vg;Lf%0=yGgfjy&4zuIoOz1HtybM5AaZ6Jqx z8tUl?Pe+3CFCOs#qehnxk1pxci3eu#*LSzd6k;v#nut$%OMsz~Jc=Pp5i%XSAJmSgM!7|F`4uzw98C#ppAjs;Bcjo$u)^ zPiF(z>~Mq=m~#+`*qrNB0HR?qK?n68zSz3}sTkm2=;Q^kEhE$UEyh@r(5BUr>i_&@973lS9`j~)3u&99aA2&hiN~iJaq-TxPP5{ z(u^tD+Hj+%n>^j@=@!rKA_0aO9c(nzUSmok2DxQ|^fphod%6=zUXT*)!)pE=keAOp znJ@eMcX?W_ug#n_rX1zzUQg3K&G0lDq&!XZG|AIgPvbm|_cXz?Lw@9zZkM>A8^@G% zh(y}V98*sAG{w_YSmx=W$VP2J&o2AhrGI8fI&EQl6PEU7dYa?uK2Nhe&Gy7%=t|3& zSwqd-BmKFa=6Ra$X#u7wwtG7Esm-%vO4eJ^Q*ilcO!**{qfNdFUk`hF1a{ky1U-u6 zcv{71Rino}J>lsGPd|Ek5_93{Lr))hdfL-7o?iF#hNoveJ?H5qPcM6V-qZg)z2NCZ zPp|H2*4@Dnz`w`7mXCjoDT&k~I{Fn}d3uc&zxLisZ4BZ3IOsUGB=nJG$2UE_<>_5d z?|FI~gLb$74m>^Bde<+u88T}Q^I5-p-_r-^OBfIy$$*973~xX7^ogghJ$(b&hnP=2 zec|a#PoFUbgr+|f_O8sp)oeUDJGs6BY!fWRcn&u^^zq5>xUwO_g;wp`X| zIivPQD;l*kTHa^{BbHN%R7 zb}-t}sDn{QqfSPi(Hcf;8f|K{nbBHCYa6Z4=SJ%o+kLESw4Sl%<>0X;n!d&HKKAFe zer7|Xjf^%n+Qf*EHhNg%@SzVrJfkO4mbW$s!f(7SjorMnh0!Tv%M}msuO3@&Wi+8> zxScSzG)6u(7*$4rQD~GJWk!)vY?L6Ae|gMLR)fv>2SXxwi9I9iJU1$+*1d(KPmC=e zip_{4eT0hgwNYaPA-6H=?64TLmg!>j-q@0rAajUSfo+YpGuqyWxyPTzmaP8o(ZyP9 ze0x~X)o3T9{ze0gb~f6@XkVjVM!OpAX4J!IPov$9x*2sh+Jgdp4NmD{OPhaFv&q3e zi)BQwG0fk~Xm6u^jCvZob&I(j+)msiW_9q`uRF`U^|iO3QE#IIjQSeAKiqbseT?>p zL<_x>4)mGnB5LjgB*V+vpvmYUBhi8=Y@-fzhc(rx~4XbdJ&KMrRnE zX>^tm{`}$NO8nB7HZ+6sfDKs(bv0*yQ&wjsXp8pEb1 zjWoK|=sKh8omk#%bOYovy2)tJLT{htOxtb#Pk(z|cQm8NaZS0>5uqs{Xf(}ex-0qWG5*bjxIY@QITSyw|MwodS!Wr| zHkxNN-)N4}eMWQPNFN_Jj1g;lwt=i-x0wAru3Ug6>0#QBFPRd&-{rYw0Q(T^04byY z89jpWH+stGX(R#TkMI~hY4q3rX2+e(tifip@pfUIU62HI*W=4AriITKJ!>$eBH++2 zg=}RA2R&sYbIu>$3q~&*y=wHD(Mv`z8@*!m;V6ImUpyR0qHPJXeS2&3QK#T_qc0cc9?+(~kY|XQ`69f0?4EW;^yti#P>jh#m$rOW zzG`2Muin1;`0DJdi?8m!_VBf}uWfwo;A=-$n2E|mPB+{7BHhlV+xxaR=e8?^^0m8f zC!%+Dg?Di&4IMJ6ZO9pBS6`&Nxs=(hZtg84qCgMe^wrB}6XC;-+U4Kc%f9qsEF-$trX8?UfJ!`&yx`8wX$3BFGB#jFvpPI9y&bHFinKL~-o zr}#S6*J&`({nPV2U#I&z!`+_g>s((We6>v|&qA0dlxO=o$7SYT6LDKkut(eVbSath z!Pk9wp-X@Irx@5Xyu{a~=t5_$-&vRWy4=^yRI^fD;p<9Y`v&S2=qg`V`|1{0ysq(e zt*>aS z-;Nd9*v32~jrdo0LedH4^d5%v9$%w;jqx=WkXAMex|(|t=22~<-7Qa8@fqLKT>O`Z zZ#)hX-CW|dOhjdn6HxFq*|#0;RA1A4O+mqzwf-|*Gy86)qxIXF5fe)CeKPaMR%Vv3 zxxVJ1Q>g#CW)7{C=02BFE&2IKtoPS@>`}!Z6Ys@3Qp2V2= zdeqlrzMal`+}9J3WkQL~zi|cYNs@os*E8roG5m*_XPxnRW(h-7Fa&wdiNT2`c){0; zzFze?wn{T5lrQ;u+1D#hTp4CE|HkIWZh7$a>gIJQ*2}!*>ur~L!=-P!6vS8UZ9OYi zj@HS|dyw7NVqbsz`oPzRzP|DGE!N4`$G*P6boe6L=M!HG{`5WtfC+Yi^)p|eW3Nsi z`qwV=F?&zz2sr?J<%@vxg}%Oa8S)IczVo%n*Dt<)_4U24ACUi!<|haFkJyJ*?DWeQ z6Kq#VZ9n_gL1pXuZ@zx_MFF{ldaiAY_1-tL%?#R%>x)ik2M1^ zle12swE{J(o3&laNRvD}8Nqjbr$^fb+CI<*fi?`ZQJ{?j1%bjqn*`c4&=!HV3^XhW zRvYSX7HIRpnoxX$&7t;R-d2G+1@Z!!Ks_e%Uq!1y*cO(zd>*c3XE4Y!W{d*GfyzLw zKuMr9P#)NTNyH5Alq&StEP?*u;qH@FsS;6$Gq97e&&ckM+O=m=(s>f!MH#~Djpl?XzXNT zqZW?|><%^ZPaf-Ig`gD=j}LT0pc4a~6lmQUArC>2Et6!3_&OO-hZtraNKXrNdZ5ce zFwhx+&J1*ZK^HC{V@od<0_o%9^U8j)c=+n=#g0v z=&vc^!ze|d`vW}?=)pj*?P^|J)jZ^&MaMbf2527*^cZ6A8p1QddOQvRd;6z4t$C8S zYne|sFh5N!p9%DApdSNPru1B(=L3Bd=;MGBTJ%DoSE)bHi>{uR1H4wtnwK1}@t3%L z#XUqIUk~&~pm!iepf>|SVOabYLh`Ri_#!-g8yO=w-!~f{%_$RlAB76|e~0ai;NVMx z%!f`$Ivru~+&;k?1o|q_!a$$7)^XjxaO&`RAT|rItCuHVq9Z%o%-4aw3G_o?Cyl>F z_1q`l2U-Lr9|-Z&;3M(&90wu5VI| z3Gih?Yem@^O3JzkX}eI%hgu;Nn;lR+p0p3OVyGYX^HD(bVkMWyp7UhYP^*R7DAdNG zRu9!7)LNm|4%IQ_k1d=QtTjWc;{JtqMloX+A35hp08)N3~lE^#sj3^ZH45& zT-7!mgbG957V7p;QK&f7&`?K&NPI-lJM@Cw$W`JZD(&AvG-wzP&wtugq*}~&1pXn z2{kCxp^jezLLEeHQ0Y(~cn)?CY5EYT*TF&vJdk=YZ9NbYVK~HLM0EFIp$-S0Z7d2b z*CLHahB^w;g*rFXuuw;bIx*Bqp^kCHIo_qmh8iB)aLVICz4u_sR5N*eGfcz@Xu)2# zo|9e4(;$V*oD%9(m$}^8cW|!&I+w>jKw~wvpvM%?EmWb&8>+U5$e29SBAPO z)Ge!<^Fv)2>Y`8=IP8eXLOw4JbqQSX&E=sk4Rx8*6gahs>ww@FL}dO1jDc!l-^--sHvf*p{oCSQ$ig-$##y|!|9=BxT;u5N3}6E$KB}9 z4mBs#L!llHbzi8tj!+LkpHTBdEeLhL!~N1p<$zv>gPwL;$%-qRfKP!yH8#T^(rlf zdcpApC*j3VFNJzJv?CPE?>Rlpi>{v6LcJd9P2}?rt7v=8Ya{INjnMXtbVhH5dK-HZ z1ptPrXH4{7sP{vC8S1N0AB6f4$U}Vwg0tH`3iXMr=i|`2`sgyGqdAN`QuKMKFG6v6 z%T3N#p>pyILwj(<*P*@v;78jS6wuJOp*|kdhOdZ@BRSt=MZrDNQ;~iQ^%GhXX}?H6 zhx#Sd29Y+5^lPZ!Lah{ODBhRKaDCzVS@B4zBeY^3EPtq`ewq;?c=L&D{OYGW&qL^zW{ zxsd12+QYq*EmiaMcO!0NwG+q(8|A_7s*80G=g#3Jkl1C zwu<<_p827p*)rmvLFS01EFHL|woZ|jo?JqCKT;4WiIhePBSn$zj|cz*su(aPmk2F+ zh?7NPCvqOCi0qLsAP6w98*9LnR~4y_v{R&=BhgPak+zAnZKTeTxVtacXTvCp>}Wu@QtY%8`3or9d0(c+y&A_>Jbrisvp-dyG7bPQa4wab+_)3 z_HcRZKjUJ|?|;fgC3{8M8+0N&^Z==zk?k+I_Kk$4!XR+K8WP((QlCgy!H7uvM>-(V ziIGl<)Hl+Bk%mS(B2vFd{UZ&EbZDdjkq&aaJ|xmElgojT4tDhSm$e=Xi~x897z@ue zIMQJt;vgIniSQoc$Iya9AijHeWTc}a4Ucpjm0!{}EYi`Dj&ZMWv|t&%)v=NFk${#I zyddxKkxp=&>K^LizpM(M9O;xu=S4a{(y5V7gIUCLMmjyx8IjJ8#PJAcqD@20SuRDe z$#X%mb11yDd15{5)QyO&`v=o$_ku_lM!F=@rLL`u9E4l@mY5gQ+~ktXWsxqAbfs$! zwZdxQVO{}K+~5v50gP)RT^ng)q)Cyki*$XYk&$kVbOZ7k>E_7#IoOJuoG##np3u)A zSGPp^e0y`xF&5?9BHbQobfhszSEM^5-Gfj?x+}7s3x)4?8KjgR90S4<#=VeqatI^1 znDD2Pv603_8jm8gRnT`fd~!&4KOwSnN)(tJX-cH|krqUn8fjW2l;u8n5ot!GS&?Q( zcAQShnUVD#nGs?phi(x&FvqcsSKn@DR@vLkjWo|ap||DX{gEDs^l+p{B0U%hM--GF zii8V&{%MB35A+{}@`u^TipRlgX84%10Jtcy;|bW^&+gZI8bwA)W5uzajr3fk-!OfV zo(KI%A4d8p(hJCWq&FkI*G-ih=cWQp`HTFmi-UwMcb@=OQufg{)ZVH*#*u9;kZ9O;utiz0oG6^-;+q^}|^ zgnfX@USoDHLyc{056Dd2m*~;Xw!*I?d*0@^k-l?)eG_R&f6EuF3Wqfz`GEQZDvwQD z&kXR}e!}=i`URyv)}8F+dKor)FkJmL5<@mJe_;G0b&Rz}tiLe+U>9qJSbst!?LXSd7zXV)?N`U|!dH&iDp_1B?RGCfl$jo+q)= zSOa1m6f29B$J!;_OW(|wViu4(rx9~F;-Vd-P_+OwkC*>C!%2iY-e{%pM@&z7Hjud`^D-V zt6Qw@a3t1Vv6Zep;AscbBepSYm^JJ?q}UsjWA%)+Z*0e{80Qa-xnw2NE4Ge3)L<}z z=L5=pV(srZ)el@&HwVP(8(W(R6Cu~Ae&)c~_Ifa`zk_-5VLp~^V61~J1n+CRA!&vpKN!F&?pA~2v_n*m(mcX>1dZ99_zSR z$57`{ZO6JNlxN25_*f@!tz=G&ZE!F21TW&@Av<3EDX~tCH6qq|u}+J1I%4U*1@SXt z+x?vh#SXS(7V?B>o(=n4Z9h*g&vm?`9_VvEG>>&jtV?6tn_n2~B18`EOeqmFW(w6YjmtJu9ESwk{`XXE~U}RX(QbxzXT~C(6>BzJo@mz@=b%J0L$1@Ol%#{Fl=EWEM+IU% z6Kg@N`(a{7^H{70unex+haE<2)dY)&T%JuFkHmTuT@DSgH_w@j%;T}1h;4u|pL0DK z+r1u7x!O4J>e*P&#d;;ys}7{+W4!>25p354C4rMQ!Qmmht;Infw~zE+#yTxw$h;Pd z{fuwMdMnoF%b3?)`i4udo>GpTQf_;kU8KIYn|U|Zd$E3x^+&AtV|@_ot5^$TeHiN_ zq&n7Tu|~BwAIBmj{u6qokv_3TpvLE)J4n881vp|0GJfgulz(VS`85g^>!(;h$NDzb zcd>rJUJWpd9JFuYle=R{zIWt>&fNa!DnuB5q4k^mUt_VqgOE8E)_;q|`B4Z1#s0+j z$7+{o`9zB`{%A^~WfJ{^@rT!mjr?y*v_ztB&cOH8l8N9xAF}YxP7P8}pbQsGUpBGg z2LQ_@mX9~LGvM<6Pu>cN$gGlR)kN(RJv%>KF=1=1721^(Et*m;Gu4XCTT{wS?++o% zYKc}))FH83bk|69)`gCX;5VEjN%3+urOf5I#lc^=}Z<%PTM4b{5zQvBw?FN{S zZ?mU7(V^dUtM4ZY66J}CL}8*RQ37ne+xFedR8z~?p#v7|g<*9#O_U{enYeRzds`-I zC2A6Nc1Tr;YCiwbZWjU!2({XB$q_to}^c1pB!q8$?L z2qHbq$K6fWM2Aha$_2r9NwjOC-4k_7v|A#3a%pD%drOE#cgGYU+{4vIhKm~ZO0;*P z{Sx&~v`?a*uJvAtU9|nL%)Sma>OnQ&W1mF(C+hDW9^hzoV4{BRwr}DjoamImN*CCX zAsmZy=LRM^IMGFkE>3g^kR&=j(FutTO{~Tp0VNX+PBa8`5*?29%Yvb#E}ofVd(W9# zezl6>;ZX?-HyRFhiH>%l9+T+UM39c=5OQ{WaKIX5rrd2gcUr&@C~HnB$w60C^KfIcCt z6B12C=2JzfCMBAj=sVOl(Ue3}6TO<~wM5erO;7YlqDSFHqM3>2C7PdTR-)Ms?E6r_ z!S=MGIf*zz9|BT2xXcBxsn&)pNOXUq2NFF9o3a3^qMk@KAnkaw{}2Lml>cxd;xw=r zeEV3U$1x^}o^$g21jJADl*5iso=&u7ck_IA^Nh>T9QK^s=bhfYkm$w4ZeseMD^KPn zm!aBMK>x<_WyfnWJmHYQ*Rf!UK2P)oz$bbu(Fch>O!Ri5cW6D)%R3wF;k$|6gFfBN zS?w(KI3|viJ!@^#%8wF#45q-J*fWc$_7f=9-^vL+6w=ERqD@e`HKvtcI$#zefz!&b z5;w>DxA!$h*ggN2=UcQUS}N7j zsg_N(9QlRbGO0ZeYNu%>@vd|(XaOf8K7E_tF12m|nf9qxOtngCd!Ln3tJ?G(E4y#8 zDu_CjteOf&^>3VNt3Ey#QP7*E#L~-i1&A`*BGs0>g>=I#FFK{_H?6GD z?wjoaCVXpB`K~a_&4J6DIL&RaN|mHKF4gg=(o|WhJyY$KDo<6U+CJ3|smfHXRGm|G zNmaRTAx@L3hD|OonEF}2wxPm{y{%Ji=P;$+ZBn~eciYrDPGoRVD7j;*uBmoQwR@^d zcQreuVuR-{sWr|!yAYi$kRIm5&2it3IjrcPLDpRvwTFF9`CIat#>f_e<43 z)qqq7QO|FdkHAdI;WK;-kLb1zNi`_d5vh)Jtsk1|FeeWv%U~#ZLpdb1vPb6dlq2KX z5S5{>0Ji<8RKrpolj_)1PfxSk0r1?8hLW-27Q6svcq)2xF6enesuO7?)lI2RN_BFo z3sPN}>XcNcraCLt*{M!Tb$Y5ZT@z>`9^Jb~x1EuS-yD1}%?j9?vqEh0IjPP~HNsIC zuAP_ae1znt5<5>Bn&TG?5d5N47xQhZs~qnxNp)GO%N_MDO$9O04p=}#R!W`x1LxJL zt^t5l*QdHR)i2YmDW*0qT#*}GF(N84l{~?txEa=@8lP%Hs*$N~O*IPa!r(Ti2zR8q zGu7>2x49(+=kVO+fVn%>J&riICCE8@4Y&aQ-c+MgjY%~&wSMVJ)5~!V&1q9Ygo*;B z6EXg&X283SW^$@2sitB9_O(DFoa{A5q^CJJr>FY7ztwKi1K15Q)XYvbC)Ek1PAqj_ zs=3&NTuV5+}TEl%}Ns)s=;)d#5_0eB2Zs{c7G z9!vEERiR?T%;WHJOM}DwZa4E3vXSbU)H+~*$MF$s5AdI*@N(w4)Q10I4M<-|^E)-6+Fv-9edf~7U5YxxIP3f~f=KnX zD@L`j@*9`uM4+dqhKo{tj{!kiQvHDOPxVu(mC)AB+w37ci@m+3m%uRpfVN*T5vl%k zz=IdFm%k(Y?aUt-mSHyVgZvTGt>OJU)jz4$&9q*oe^a$(S~1f~nU=`3WTtkRHN2Ep zre!lrPu!=aGA*5n%rY)L885V}CBkxp&vy3gBnGTk)Yy4g5Xe6oI~ z4KjJQA#IpxqfDD;+9K1&v^CPlS=ubqCYd$`oy8Wg|G?wGN%C7}_8=+#cd%7v{S%t# z!f+rH{yCWXnSxA3rZQ8QDaw>&N;Aco?RqSno7+wqTbE__u>Cx9O3 z5i8!xgge2uWlC0=Y6r%uPR6=q+B(zmnNG;GO{Q%#_0H5M({`D*&$MTzy}&)wj+u6W z&Y8Mq+9}h{jv!mk4l%Gtu4mD~xniKSTc+JJb<5N}6MLUw2kObIJu+dqKACQ{o_)AI z901(zooOGJ@0F=%roG+Rje~vmbq_(GUXMZLeo$t4J3F+0rUNn!&NL)b-%JN)IwaGe zO#L$Tcb^P&d>oKz>T;Z$*M@yKC=004|UuMVZ8bE;{DCx>M^Jk!ycj>$AM z(-E15Wg=z_>KzG#GCO{RkN?>v>@dB?Vu#MLnT8`FGweYDRDPVx+j)b@;fa|}%5+Vp zYcrjk>6A?8XSyKMshLj8@HTZeVnZ*G2|IaaW;N&x@`J1=fM_u^!{{B>&YY9!+)N{& zVP@Stqy=_EbKEDkU|;C)x+v4dE<-1B39LNCT%PF)_vF&ddPG_XU)77i}Oc#Tp0AFTT-i6dN%J(v1PbkcV3-@8B zk1{RH^fka_`XtkrnZC;ODO^MRZY#e)^_DQ7JMEzJC6A9Zdq&ChBiPXqW1{~zqx>e* zx0!y-^i!tqGA+WgEpL8+DcB|7E|-6+#gL)!0wx=MvpjvhZ#%~obFGxCL#~dw^+i|Ctx&C+Yn9y2 z9RWY-YPnX=?dXhKE)Gp%?7v2?HFK?%YvGKN4bE%lc7kplfb3v!L?Jb!4D##e+8|eu zE6lZFu8neSnQN%3e$=IWYjV6KC6 z?UZZhT>IqenQNC^yXNYVYtLNkFhBs)+-_G{duF+NZvA{R-E-}c3x|{EvGa3|a*DH8 zuDx?>+W~{;WcJO~D_7rK2g03^{(iao8MV_EDSkXr@BlO*luaPOaM z05q9t`(Z)%p00(2=rXRS=!vrY(O`F zIUE`5YcogWIx^Q$0J+c`mg{IIY;>lu50WxeCo>#A<~k+Usk!z2j?Z;cu9F?jPsnwm z%TO2_%jEN!W7;sqaPzcWr{_8=*V(AUm=Y;EBj@n#HhQizbK8GmI?jRA)5>$5A`o2< z)?9eM=jXa0*FCvL<+?D}MY(Q()VVIsbxE$Pa$TM4(p;D2x+2$=4uH#H+061kgO9!g z4>Pw1%q%B$G}q*su(r7_w+8B3muE0S$9H`$LhPUtT11a+p zbf*7J_W|4Ox$eky=YOx5^tiFS3zvJ5cei`OEj<^v_vRX%YYt{P*O**m!8g~mT;p<$ z&owF6WWaErOmyjg6U+E-G%dNad^b3KxaF$F_B3QwPD z0iX{;G9L%8nPoSA1mFY}yb$lFb3FqE3f)=g*<8=%Y6^8O^n9-WAyI|e6?!4pi`buB zKjeBT*UPy+&h<&IS8}}y{JGxC^%|0JoOuI1a!h&MX*6=qs^43=o!@xd6+rfY=N-pi zT7N&+2f04X)!j{r<0?>q$%>C04L@?ge+oKSvs_>2`W!iVBwReR{L*E529SZF@%PtjRyU_GC3$0aX{lbR30L~Dwm_ppF(B_4LLSdmT3T;`)6q?q~Y*naJA+NAb zAh?{`*QLAL{oO$2I|Lz@;gI=42hJ+9LV2OMP*Nx@_+P4>lcxYSpFF})6lxW!3YCQ& zUvS}6)P+4;6`ui^$d9D)%b1ccFbKfST~9jQ)l>!;5EGL$P0>-h~b+G^kLYLi>Ywp?-x9D8$@m-@b`E3OlVzAI)1PY7Q>!> zq43ldINYV6NnxBczCEhYutMh*I=|4-g^nq7N}*E=9b0I4p%WZ;j&tepg`Mi}_P6)Y zgCXd{yA$2>lXza}phb4X2WnJ)TA|Ymom*%`p)(459^jdU&MK_$N4|T1i`vNPGUL$!D*WUept-vS?-n>dVx{7r>!F2u6nZG~r^n z)JCYzILnZ~9kF!N<_Oqbh3-bzO081r9@;JRZlU)I-Ajvw9x3!_p)rNVq5_4c7aE5o zqb!A{6q?|)W+Fm(gjFT{dAz|%2!k7{aKyw^M>Hn-Xr0>`g=QAIzt97PW)+%U=)OX8 zol-L^d)=01PGQXj8FXP@q4`cPSQW(x@MM9z1)~Q+6QkYTJPbQJT56L%x2c`ELa84s z^mw6{3cUyvww&> zb5p++`W<6lYN=9x6#BE!--Z6c?q%k$LW|u+op`pSSdV|5zOeYV#$?;zUtjZ{ftmn zEbaJZrBci>l3BIXYNd86wR5S}OLZs}mWoPsEVV|djZ1A(YRyuAbusIdY_$+42CU`M zwOtA%>y=u+w7t(pr8X$FVQKfta?4!7e<`1EwivgY@=2+!IL8hcN;_@7MX4=IJDOvJ z_}|0=vn3nNF1=C)NM?osAT4X&>1ceg>u3!EDNAFxi*c!>ROeD%N~NW;Qe~-DDVC2J zn&qVmR|B80r?T_xvT`lfknz8c_%6RGt^I_>Fl*~l+mza&v|_n!scX-)V}$KWJN|-7 z+n3g@MG<<>E_W=2+3)I52En6dm%EhOwbX!82bJ2b)b6GBE!C@3w^H3p?OAFsSD1rV z_9)eZ!d(rUBI&znonhnN?rqP~4k!01?L06U+U4zjrFxe-5SUAQs$`#12RN8H8gBnm zq|71oEp3OwbyyViFRizR*&*0~&qvHI2bMax)UZ-VmpY`>pi+mGI=s}Or3O>gcixcF z&SoIJ^yYv>N6d#998S_0TIz^WN0u5p)IZ9lyduv<`D02k`aZVQaEzOCr;l@p9Pd)B zD?hD9qao2rrA{u@RO(#mlv1aHMN55KI<3^{rM@e*sMHyy&SZ|d)Z9{Ml{&lBZKZB6 zbxx^sOI=m!>QW<0omc9jQWuwY5PE*83mi4biSX~0>i~f@8!j6{`UR)KnkF*@k)KU#8XO#tbBn_WIp>d8`1m3o@O>s!fTkVVO79D|Tp=C?^L z45j{8>cvtol{Urz9bC*`M`7PFZDjcHW%4X)yGCCr#j#O*h2>|3_l;6-f_16SOTAU< zZ4fN=AqJt;yH18E)iS+nUZIE%lTkKRJtpC2$52ZG0apaeNEcFxi zwx#wh{aosoQva4}Yl#SoU(sC5K89{i`I{40Z1ta5R2F3h`~RRmp<%IOF}(vne?gV{ z_+0;uPg(9+qNOEUTDqlWTGqqlbSBuRmX>N+1;$!T?X<6rlhwB4gOB=d}^zuv{kka*o6lXDQ($c0aZP(KFEp67) z<}IZyWi4&d(v~gxEd?!Y)l#RH{oAA0;^&wa1*(OB#yw=D$*ZuXsHMcU!q6jb*#SEm zjRA)a41fN-$4uhW1pbx=wsd++XS8&1ONX>{Y)ivi z8r0IEEe&nyh?Wg+9?Yv1%wa7JX<30>v5(!~1W1QF+KyYz9NE%QEjyofOw0C$!(i4H zZAUxo007sW!VDkqlaFiZ_?Av-*_pi)sI4V9a#BmosgmJZ#`&KoyXWxhR9Esemm(^B zb!JOvwR9=OY3b~i&S~j_mM)~gaR1zv&THxXmPWK}f5!wJ(~ta0jB_U*U&eOg7qxV8 zOP4rSZg8l7#GDe+LH2X!SOK`ar7K#xrp3>&wEkml*vTs$B3HF^b<2)87+KRVkh!j9 zgL5#v*SidGGQ8r|O)cHr($towwRB5MBU`$+rO_?j+R|+;-QzfTdrNn;beF>j_Z7s*u@pY-3 zTbwi?d7z~S0luZj!EsLcP|NzLkGlNBEj{8gJcsZ72KY=hF#8P)o^ZJ1xjjik?JX~! zY3W(0hay*cuBGQ&`m&|3z^kPfT6(9YccDW|FSYb)ORu%`a!aqY?9{}JIhJVP&MY*% zc)g`JT6){n|0aYT3=^KpXedYHp{m|04 zEq&LrXO$B#v4f2VRxYfFE(^e0B6 zuVJqBFRb5vC4(=p=9ZKn7I1*@KM?A7>!mDFX~|0KR$8x;DlJuMrHV8BwRELrDy>kd zeWhjbth$?am6orx^L^!VF2(FKqCsJiH}VV(4rNW5+W1|_eRjHFl}f8t>R4%wN~={` zy%Ll2HyqQ3JA_Dd;O!C?H7L1erL`(M3R|ZVu~j@=+tou=C){U;cuYyHUulC%VWp_j zhLtv|v{j`}l{T)lNu@0+JJGahB__KzbKfGpdFRUQ3+!W zj6c*sxgNRC`V3tvZCzSGujz?G=AZ)Q**gRyv|m*GfB8 z>RahR=v--+N_$q?tJ1EOcB|CA(jJvQ+28D5sl%S88%@jb_dNvc`<|vpWy3r1w~-vE zZGWm&X`f2HEA^?=v(mnm?NfSHBD{f5D9l%6_N#RCN!If3UsCnoqvka&-u+qVm_;tcT4jw8wq|$zuw9)8W_my;Z3~~oo8sY#3Bs_Lf z{wR7_C61Il+|@trQ2)qEM^ze8>AXtA0He~Wl}@X4OvPW@bV8*QEAbz8KpkG$^NWtF zbUcE(&>Og%AtTqxhi{5{xCfG{7+m<7nsuXI7BYb#w>>B34ERl2Ow<&}+>zPQpQl`gI9 zc`SgzIl92cSFDa*0bwg$Rq1Mw+QxeRBl_5Cp&^B@akK@t_j;S_E8S4(rb;)XUvtYF zE8V-Y*?4XVUrs*L9@BkGrID3xh1!kbpO}0Cven%3Zq9$GbZ4cfD?L-`u1a@Tno((H zrF$xksx%%Mptee*D~+u*&JnH4NrrmHP#Zr-o@=M~L1d{vJ;vP=QS6~yK{uzN1 z-9%8RnVbZ#LZY4=Y-mLY9x?Mq0mS%C1hUdQmELtq)T_UbtiD~TIWt1wr_C+-{5{yZ ztFbE6%Y0brqe@>wG%N`!Q0enZUtnaMVt(dCi*q|sQVvY!TL_DsTyUs8;dWuAuPZI8 z^gV)v#5%$F&gH*#I>kfEKR37hp%SNp|L9cgler~7wX6sFf6py{sq`zFRjWs>-zxo% z<*cQ{|ApWO`fas1oAuznO<_bA;rTDquGaFk6_WO~R;bl+UU`l?L>F-)k6y1>TW#gxDz#RvwQjBT zYOPjl^;&DxTC=wHrvo3l40*(Wl+W=w*Q&KnZB=aT+IG;qBIVYu|JK@|)+V(!rOe;n zhBe0#YvbBlKQx+)Xd==N?(#RQ1>=Hw_VhNsMOwD3wNRO1X zjoayEy42dbR@YiPVgCW+%xJq>+t;=?+_u(X|5zY_c86L!*48?4emJ%9pBez%xz;YV zy46;CcdfNst=)l{z1xdyb6oI<&ylO{wTK+UfOETNt-WfUQtQ-Od)L~h)}UI4*6LYn z-&zOO>Q}2*ZBKUUU8_&6{SX_+U;fd#f2{**^+kTZ^#BILMTIZ|kbtLuEogF3t%0=$ z0Q`5}F7wJw53+xVp0=JjxYi*MWU<$8p0#60)Zkh}Y8_Q;7=>#cUh4=bgFIkZoS0GO z#Chd^=9lA$xe$hI`)^HfX57s+aTY6lrE9coGr|y|oo>=RoS|>aB z?{^RXzZe*uR_pXy*VekO))}?VtaU-H3u~QK>+D)1YMobGb97FvbDc8VCABWCb$P8TYF&l`&MWB!D8?t`DGYPTQx#l8lzSa%3Zm)Gmts86IRO?oU?9DaDCu*bvjCuf%Kiy;fwhjXFP~$dNj9%}~ zT6fhNRqNhbch|PxzXx@QZKE*mMM!Uj9Ag?;#E`K9A<7$nEgN+6@now(Et$%9$ zTWeCS$+h07^=7RpHNTG1gS8&QKGd3C>%LlZYt5)Nv)1fdb85}P+RV3H=Er9=M2lDn z&fY{wkfM36-37JouQlJ{LYaDgi3VXA9)N(imS-Mi@p`z{BehJ>=ZP&xEHs7lCcCBw~eOK$9TJP5SwAN>}-mCR~ zt&eJbTD}dr2*aP2(FARxEVT7WZCwIfCOi`~)aGk_QEOqXuWNnj%JcB6T0`gC zmD9HT1d#a)hxiUcu}qIYyFHNt@VSmKR?#`$rZrIz^XuGVE(v!+pkcj)?!p_ z8}qxfMSozHk8J}N8v2ti0CT;c6$#8*zLd@U?F=lHv^83yQP?PIv}7YSTC>qwjh1S( zbffl-R&2CPqh%W{*Qi~i5%aCmas7Knbo2aj`9{-6`71Q`AUGa^0+6rNXyry78g*>6 zN~2X9t=a*f719=ye#tlemxMw>L+w9&c^=YVPB z#;WJ~jW%esVWW*)J?I)lfcr!Z9i7=u1Qx(?)PJ)^n>Xsz$ZNDkV^{sQY_t_qG0YOL3#5(Qb`)Z|B(9oF+Ac1Q;L&HXo53!S7yEdA6w~qlK?bfJ!qkS9oYP3hA9*y>Dv^T_D z#YSrF*@$18y|9I)(msvuJ<;@R#GjGD5z8y(T;s7Ax!RFAeJLE$KSkTO=3+W5@`;2qsqSAj)vXf?diajwisjgD`0 zLZcHK8$rRmF(rX>^Zl)}3V%;-bV{RB-CLLl(}V8|dw!z}8vQxHytvV=$NLN!E^Ks>qb;1JpM?$`7L@4hWsNRxbOkhN z?9ho{`j&|6E#*~>u5NT~qwAb(T;smQGCb1Hc9*n53T%f@4R3@~jV3ml)ad3$x4^7M zqZ^H+=|*=ox*GCcgRSk@1tqu81SNXBv12{Jd%{rSA+ zcB6Nk7JT2Q4c`y(xP3thFkJ6B7=ZA@Mjye`MhhE#jN&xOCksYd4Fy68&tjqV6nj5!M!%Ja68cnfF#vLB#-qihvn2 zW<^CsB}z1)f;nKqM9w*9BnkDWZ(upb7oKH6`A}2-|87hi{}=yB~axZh3VxzWT;CR&?%=6|yZp18)+xe!gj zRJBH{f4dmBnYi6VdlPp`7223+YvK-(igBo)b|z20)~C=m9IfB+poh83#N8r)Fk0O% zOpYKOO>{ER-NfrAI-9uH#8W1^nz+xz{U#n|5!H(I_OF{u-ji(UF^HKhYr!u;SX1sBeq`cf6T?glmv-Sc3VYut zre6MKOdcG})%#DSMR+>Q`K^pEXl5qXvu{#kCcZW?#l%z--%!;iemC)liSJB|F!8gA zktP~_QS`luA5Hv3yE@7EK`0xYZ{;z6{@|T;`NhPqRQUGd-=u>7MEw7W=F`se#YLk` zj5aaO#CU1VF($?m-&n$TV`z#5tj+`z6HV}?1@`wzgbDD|iCKj7m z!k8vz(p{LCZ(^2-*(Tt!?1Rl*lp^E zxIH2;HA86`+;8H5iDM@IF>%nuA$oiE@yE0c95(S6bFQkZ!ys!-jU5q#Im)KI!{D`H zMCxDKJT2sC@d*~#H;=O}qg9cmdl`e&25ZVQD=S&L9ofH5vT(A68Ww6=IK{%L7S6Iz z)xv2ODqA>1qMdH(LtR;S(ix)_X%!1+T6zV53ygd$qVUx$-Mcw_oGqZbP|8UTi>_s% zwuO2YF0k}UR2>U-Eu3rV*8tA3v?Fnbv}yePwE7S@kems_~P0tI7oW{bwy={y*vl3oR}E zhj#wTb!Qu++8F(F)SGCfJk9n^{p*Z3sv7*e&Mg*hweW$34=vng;dVB(#A#!pEoHFK zPJ;ZI50}=Ns=b9fEj(!9Aq#g|xZ6S}3!N==uy79>f`81W-l}S8`P&@+K8WXWvqkQ; zaG#}*N_oHn<+JZj-FOaFK15fPqsA)eT-BGr z{2S8SwET;Wci7_h=^qA;s;`5+E%dR_-@*V3eOc~RMn6k`KX}C$m6iWry~`%f8I|uV z8OY|o${1{6h=oCd`4ce4e2*5zw9gymV-){Q#BcOiBLC7nl*Vk~Q`)?Rk1c#+VVH&C zG~>th-;MZ#Wwz!Q{3UOR?uJbDxy2W{FxtWxR*;gj$59dsUo#1RO=e+)ROcJoq|}{% zq-Wi!aNS#L8bPCmKU(;StuRLYX5nWGBQ5;O$fNa(6Ti?5#%REAndv~-<)0X%c*f%I z7XDz}Pd7#hCE$E!tc7tFW>}a>yX7I97A9GkOdFv0*i$^w`rrFz{EgKV3w$b^YGIlH zS_OYvK75Rt&ffH#9z98CS(t5M0XqftFS?}_&9m^^7&TWY|2N2q<$UV-bPX0+`UOJ% zC~v8S#e%7yC6=Ci-d)F7W?{Ld|Afikg{=_4Ud-SsO2sLqixL-WEUdM#+r}On>*!l( z>NYys*ueM}iftG+HqrUhRoXb+#uf^1;cp8^Se%9J7WPoX7Is*A4|J!6UF-#8^dE;P z316Ukh@$`<(Lw!SyU)UY3kNM6qO-lRvjtz{W{7IAVVHv~jYn zUynS+#;G=jK56i^8M@8WY^}hG85DzO*r;OT92<3QoN41M8`W)`ZKJA<6UVA*HqINX zsQJtJ2Ez7YwmxYM>Z+1a%hsHllxmO8t+tIiwth2*qaOV;>A6g6<5C+9Y@BbSo{fub zTw;S~Br)LyHZHVrk*y~QgUj_w1p)sV#h-z2e%tQ$lKQru12A}*jmvFZVe2Cjcr-i} z#pHBfoSzVs*l1|Ow-MM#*(kNq%tmt?jciM9#b z_{{BU8%=FJ^l&1|&a!T(;zeNEuxz+eL0hO}-T>2h#++D2&O zMjJP=6dPF^Eo@w8BeD_OxW>k{HWE=<-bOh^t!d;WSTQnI%sD9!k1XUv?)lI1g&A#2 z*W0+kMoU}2YzV=yqGb560&L zGVid_&cYs|D00g9DQpp``y%j=@b+Xaf#xNVhZQN_)J{#Scig#^1 zVB;AZ&)Rs<#zQt9qn2zv+&^sN5w@C*F03qnZ8ugi9~vzy#UePmJz?WX8&BEjYU|S$ zxL7pnlM+r6=zlnCqSJd?44V_1=WIN0<0Ts}+jzmoi;{m%_K!M_RqSZ2S2spDQv8aI zS4FEFiCE>=*c|(`4`k5{zG34{8-r~OvC+fETQ>T!Xd7=cLmRzq^bs5GX``1kEA5$X zih3sKYwMH2xj4fhnVh2Zw=uxRAh~F$18tDmnWmiBPxp{cxkNqUaXxy=O-IK+xXSSZ#G8S_(htY zK7Y_y{k&P>7N{-?|GTJ>f>ET=Hpb8bZA_-jbQCbgv3t@tHqc+7GkK#bm8jtf(q0pV zGB@_ADYkxao+epMm0rfRCVqIxb%~iaX4zO}V>R_=V~&j_HkL}SpKD`2otTYz5~LsC z*Ov=zERuW{3zPZtq9Kv0tBqx1>MLxlw6WaQ6JuWVLNtj#MeRIAk#bhO*H~j?Et`_U z)BoGJ>``Mq9U6;s3|60?^=*{oo0#DPI&(G$pE0-6ZPGSs8ar)lx3R<46Jxd=pUYU# z@$XZNxl1%t;UxFk*k_}sgI*5y)9JBGI>pfaBzl$Dh{eSda3hFM{jGM<)EqnK9w*}F5PfJ ziK}@W>#I9@oTcNf>7bUQx5mzK^n-A12V82a!^)QGooKc@6LQ3<>)>2RuLN@IinN}C z3mi0d(8R%o4lZ(Vg@a-Tti{C+E_Kkr!6gprJ9?djoA2CEc&L8SkK71oYFy^vaz}4j zva{2n(L)*zN*tsdl!{ceZ5nMuM^E5cdLswiguT+yFF#No3dZ*3tuhB!Ij|hq4wQqd z9W)nR@mN?sY&LcDvly>tk|)8;vC4En$~+wht^?me;OIvQs)8AMjvhNIbjy`zF43nQ zaM6ruvkoE$_c^%VLF^!LaGQhM9pqS|gXjRL48R+C+?wS!w6-0J96?tjNBt~Pvfu$X|daWk=vgSHOt za&Wh!*Tn8{(9S`72ec4o#S-~kd?$<8rZ`99&qrWgJ&H)=ing+4?B3m!IKWUIC#XtV~$>^rzDR`1v#`)nHBq4kF!%0 z>mctw<)EvBrzL+j@iT1Mng-uKM9lXE_I(Wmuiw<6L(9OXs4qkS^4K*4+ zcVw6kUt*!Xz3SjK2i<9zE%oezi>Rz-opHJy-*nK!(QggCBNoegy~VP|DIWRvHruzo zKKqYrysUL^2Yno@cd&sS#6dp?V;qci@UDaY4nBAAg@XYO20Hl2!N(2;IT-BVJyyZd zYsf4sJ5CL8KuQatsz0Dviqa^|ZR51eLuvMZD85VciGyJdhCBF_n(w3!`s^}JEli3& z6SJo80p|Qhd-XhN8{8l4t`~)ctGo!GLy2S{o&voS=1dZ0*{hz!Ub@uiz*%G zU_ASXgZU07IGE^Qx`P=GCOMewfX_bDXrB(IN^4fk*7!~i1!HID8z3C5W>R1Wa~#Zd zFk9T$qn8)4`6>jUw3LUzQ~%~_ITq3*IauLfk%Pq!mN;1I;FocFp2qmW2PNFmrstts zSSEdwTWr+rN(ZYPtak7xHP*3&7bRIk$K_z1_$BrQYKb}MDeDayY;>@R{ldj5E;c*Z zLeK2rh=Z*(UD}d^eGaxe*x_KeqxaEta$5WEYL|EnP6)LN-BrAYF77|AeC}=S7qdS= z=g<0HX)N({y$;d;JNS!&@kb@%RNFmYIbj`x;&d0) zU7YQL>N>;4nJ&(9QN`6gj*;2=RjGkoQ8icF5~Z#1>a14{7d2hfc2URGuCkU38V~&* z4TD{kwWF2NeKCh~U7Y9Q5*PJdobRHZiwj*`B&jYCQ8_tbwrprRgo|CROlGJ%I|mC6 z2QDsmafOQpE-rKR4qCKduRARqr?!pLzx60~wX3Ho(wrK)NV&M*!vh{lT{Lnr&Bb&V zSGs8I;#n8ZxoF~|%tdP#x45{n(Oh+SOmqNxktMc|^D6lA%uUG3GIySlwhq4Zb8 zjtkd?=jxdo=iWTnv}nBIq9tisl5n>!>mqcKVX7Kh58MV~z1S9X2#JfFi|bw7;DSCs z@8Vh)EnL(XugYCq<7#8z#etQYp+4Cb*Rfvjm9SY^dP^5KNgK6taigpE!n7gXY;d2N z5pEXUGOJr%+~(pwCS-M7v~khi#htF+p>FHq=0}ZoF76QRQGqOo0}2bh%f;O;?s3u4 z1vk_oWYxYyMKP=%4O3YU%79_axW54w2V#S<M<^#h zWWKD3dh6n%p*ZtkylOpOJt~TN%++%VHaF|_q>HC3tk*?XW+hwsobvIB;2BXqi`#Ku z$@4D%QjQN@40Z9MiGA@FN;oIb@7^uZZ2LCJy0#w3HAT*c-7s-8!pD(Ui7+X zm_|;S-*nM~MqWoZ4PEihhmCh=gf0fS80eyxi{38!xai9w#%u3Qlk0zbQ9l>&y6Ern zpRopa&shqqKyOA&Ee&!pn2L4r0TuOk@erxhds1I^3Yr0%j7sAREo?ZB(I2_^*u~E- zM!NXK#V{9NyZA<`Gn}bheD2~?Q4}-x+LnCb>czt^MJKF9izW@f63n|)(YG$Xle9m& z7$M*Xn&OoWzh`yiHAqtGg!Sb*&rgigT2G~Zaq+8*@h&E~_|3)dE=Ic;s+j7m0iqtvDn2D7bkH1XjME_d&2}2n6SacMi)ESWG*(*`McQ4>Pri5adGlXx-&8@EoXbdCb`JQit{08my6vl_PaRX zVvpSAW6nModj(TSmcG!J}dMJ?~o93G5 zOSzIyZPSG^!$zK7oFSm{n|LVmV0y4TT;)M|XzHPvr*|Y7fqN)dv$FMz*eJ}0@#*E7 zdwQ10+-wgHv+@vla78(ur=M%sm6$(YT%l&Dv9yPbNWz`^(9=7`1T?VgTN|;5#6xQj zw|K}=Y!59wTvrk2dZXOKH6rS@k}VsqXJf78>pk4y;U*6^dwTxX(nBi`H+p(Ht-D^~ zMHJ2uu9~370>)v*Z}o7Shr2x7?csJ0Z9KGNtBJPTdfeYCiP2L?NO=;YxZsZo~+dd%%ig)q+-beFl$)31or49Mrin^`?b1$ubH!iok(ag4+ho6rWzv}6;gkJG5+S8|O zaIyV058bJXtUmPlbt#%9UR%ZJK{a~##KSNTZ+m#h!ypfXJ@oX@i`ky4HwAjLSDt6| z^YE^RJ|4JyUHdGfFT2<=4f?YwKP?*I>HQjBJfdh|0rMyyF0Kyo@S%sH9^UitzK0KJ z08Mn?q|YRvJRi{luP{FLuwsJZF>RbS@0pu^Lk!&V*F%RE*_|C%@9=`PO zHH}A(oM0wju@-Vz7%TXVn9#`+)l9w{wy$`EhwoWm3NP>Y{U~>TV(*)%c(w)YmRnb4 z6V)#se)aGNb z()rLK`@7d`$5$)x%b*%fmDe(`myV7J8WBVWx+99_G{kd*Ff5Kc8gG5%Few zSlvk<_0AJ*=CV_?(g#S*xlPYNu9>K~X1K`1Vh?|MSjC2G!?`q;(E)n6w3D$^DC4j2 z^oA5IWFaD*1qqKPD<(H1d;uoZ_RzM?)W{`Z&$UxjxSGQQ61oKC1gT z+s7F`s`yYh>yPz#o$2E&A60$bL%G|?oibW7k4&oO^9*!tv^9Lx^ijvxc2dhnZC{_1 z#DiU$Kcvt8U^isjomka4$46Zs{DCtsPBzZ>QP0OEKI;4WaG48yaJ}Us!58{^C5=oT z*?F;#`4bg4;8^;lJ}&ohg|E+tYT)BCUwd-)JJMnwd>_p4wW$!W+zPWv`6#8FJ{%v7 zd|c_HnUChaK5x3QkE>Ws!A*QUi7NBK^MDAhrWpJ5!9Y!=)?YLz;^FlSnm#Na!_GB2 zbS$~9u0EZFJ7Uy{>%;Sr^O2`WJ^~+EUoWIk<}~Z&WAj8s!6-J{E92{vj|iyA$Vbfh z$BPr8{0}p6ITc7r29{js<62+)E^dIf@bwX^%%uC-`dFOnMKI={sbRGA(aOh-K5p{y zzK;)l-0Y*Zj~9Hr=;Ib2xB9r>#{)iY^Km*G!~*+IQy(#A(yA9wiZBCmwC6F`0H zUzs&B?(%WBkIp{s6`gnR(a}dI!T0#Mez!hBi4&e<6BXw|JVJ#N+Uk=O>3u#(X%7$j zc*w_7KDzpNn3?-{jKv+*zUUDjhx)2VwOi0D#{Ag@Dc^5-+{Y6>o}@MM1MNwQ9*Ivq zZzjgmG{P^7o}-!hc$Q}Kpth@ElJ<=p@t+sTS?EhXUiQ(;M{gh9e7r(weZ1-8RUfbU zcwMZN%d_2m^nB3Z^GKUXir-AJzI+3}hmW^>z0&xOk59i%z3uBSop1X-#mPMTW=|h& z8Z~@$l47urkG?(z`WPf~_Ve+skN!S-Owwa62R=$d2?sETp(P(rQiFXA@%4iIdlLWG zNs6^&p1k-|0sE8qC|H`GrVq$7NMPgme$6phEnk3N3!@v9H6RL_~D ze)93N)R!WSq$Ri1?{bs=CSs4XwYGm3%v!LeMzb&bnCR<~Zmf@S(iz7yLNl#QehbeB zb0(SK>z4)zsBQA6_?YTr5slf$G#}G_%wq?amYv~awy&pNGo_C7W3wbrf;r+4=o9AB zp076g8hSlp0S$g%@j_n@!OVYrbzRLRK9*7;KGyhH=3~bswcN)F$>;D*MJp-He|lX0 zQ|y!Stdd(isGT{i^|8*!dd8ur;#)M08q$-Px0P%Z4Ku}5l+c0Ts`*ze=8kH35z;8;0XZ?X?>Q&M-b zI>;Wuq9>~+ll9IE`G5O3>f@Ny^oY0=md=+7_^`u9|A)@)U@?2yaUVqiP7QEcfD;1b zZ!%5{a8iIuf$l^I^hBDiM#_z|lLLIUqxh5n{LKPwhX387ZB!2QH-oI>837*dXq+DC z{+pYussy@-`~T9lt{R|PfO-KgV739y4p1vVZRW;3#{e}0-SkXF`=>~>JsMA)0Otg# zD{&Y+H^6xT&JVx`d6q?ym@VToNN{0*ivkn}Falg0;F18B1^P^Rk2_h-jQRmC4fOI3 z2VVvo1iJP4gw9VqE)Q@;03P+ui}{oUXc(Xg(#($7NB{6)&Xt_UsgSss)z0!E54v#X|N^U<{@n0Vu zC`<$W9|;P7kMPyi+7EONaBqM|13VVsz5w?Jc!(wx=yzWq2=rpngMs#?9ADlzU;pWX zUWKDZmq3r#9Pb{XF|^S`_T!?KCj&ec(3cudND%~IHEGy2z|#SK9i5_JRO2&(`A|mA z^8sE6@OFTA0=yXDr2wx6crC!oRImKkcl@E^ZUy{`fUOT1-34$p=8XWa2f9=9;yC`M z@Vib{Jp#NHfPk+>k@gJGE5M)tg9G#qaN{#ZUlyv2J^?uYJg18u+4*i#zW_W3^W6ab z0}Kc-kg0Agp}BJKB4GR>0p1HRG{6rZ>B-gm0eFk=q#YFPf?4hgehtXn`Vky8eo|Ow@y)Hu3!TN_%pyN`sx~~4Ya)gYXYnb zkeRC12H?+$$gj^|6bT@6y~HHgD0dl$5$>6)wgfm3;2^ss?MLdeJ-}{u!vN1REnTiK zcL^OdRk5;r1MHLFegPGDq}(Dt#2QUipA0JfE5KpF4DOP@n3-B0cxaCGmWA&PDo?i2c>7EQ7H|i@zyjoY??YT4K~4PX_(X0Noky%#wo%f z^Hc%k6O(zrP8zk-_;^9dsA;Ne%T(Po&Q0T*v5hZGqh9sWYdyurIxmfd)71Gw>!oplfZfv+ znR{xddYo2zNgDMjNg7rfm!{Dmjb@BCU0s&O^~`s8sF}@MY0r#MdAb&fwQEiprmF{+ zUty==q>)J@o7Ps!>bPlmX)s!=>FS~B%1@)mbQK6q3k}owY`P*dN@L=5wQssAPa_tb z2+axQt-OF0)73R;T${%7kw%L&u216z!Pg0$^^MUot!@4up#-f2+$i*>G;S8qI*nTh z(zq>+JJYx;joZ^`lg1rsw37&J(>Q&GZjJ$UQv~fL$Oz={BIj-zi7-1zLNfpFZbymM zNoZ%G_oi{5fcu3$Ae2cS>QVGC8zqfD(ioM-BWXOE#)oMPP2;gN9#7-tG`gknL>koX zb7IC%vMFb%r-air{Xc*Hw18)XJ}Z=yvFDj#amfp5yeKA-nW66bCiPMppMFwA@Jbr5 zrtwZ1J=17ALp?b|y~dVJrB-zjd#=Np9X_uQlA8aSi6~Oa2i8c%FxnxW~$F- zs`qFKGu8V-#|Y^0I;zD?tkG?va(pE6n+!_pWowc9sS)taTPQO#0S&P#os z#uuWZyN{*V9llKCt2FYn)Yn1@zM;%@Qv~0oF(Qrc)A%8cpVJsAwYY1RdZoDJ$23TP z(k`WlfboA}akJF#lJ-|N%`EksP~PG-b(R`Ufz#NR#{M+Mvc1ySl*Z;X#-}kMjTvdo zl%`)hOC6b|CZ;hdjmc?DNn>gn(`mpDl}@9Vn5}r_gVTEXjtHkhORwkdRDAa#g&(j2v$+D>E59Cd7t+M7o8xk}Ad2huo5AD+hXG!CV4IE@8! zRmZ-mztZ@dnmoDWsI<|ubJdW!>Ih9}uB!P`>9I6^nyYyIlg7UV{7U;&QHT>loF3wg z5S2n~pQ}y@acT&JI6haMD3su&5GNNf$Ko3E)M+8EpQqZ)Q)H z6Jq8(wRN64alU#hR>W0eb#4d->&@59^F!1NaY2ZYRZDp>hYLeAov&KdEG4}pMEwxg zhG{SA@7KgksSlj1cDxDr*v=Bt*jy@6K0^LtHmsr9w0c zab<{73Enebk@>=W^~#adXK$y7znZTm%~xe1R?k<5=BqOosH-VMh;9p%#S-5wYZk&@ zpqf(y3)J0x%FIv?E;lVu_bpI%h`|fghy`le0_BD9L*zqH)F4DUatMvSg6V+pKFB9Sg1BER8&F>Rzb8u zJnNmJmLXb&_%X&$F>VZTQ;20DmWO&AyqPq_`ypC~xP_UAxGlspA)XC!dx$n6?ho-m zh_)gBv6*TYg1H@AsP2%=$!QI(7?8(8#6h<1wwkS%!Ek#M>cW2=QWw*Ftm;@luGFL%bS-sk%w3pF5{s z2|-G!cy;KUYF?(n)|5N}Ex;x`0P<{kwJ!`i8LLi7yLKg56#y~r<1^$XE>vFaV7 zPl&$kaf{Wj9a41`>ncyXzw}+U`(pm%C3VYUHIN;IhJAl&dGpj@$$UtNA&b>Ri&eM9 zir|OE>Vps;QZ_~lF*L-{3sRqj_&mf%AwCZAiExI6xbV{yFWwz4oKJ;LU#!UaBE**= zz6&ve^MB!g6XIJ*@^vAHEp91ecAi>9`aRogY7ws=3U^t`kCN~wp$z^K;@1$@k2$wY%?>d~qA})ywyF8TBwie1 zL5PJR7V&vUay#^zqJ+dtLM#nIIT@{)+*%Q0B{>mJkMJie5+cYTox$o5YeH1bpjrlN zL#zw2d#O4#gY_Xc&~s*RVg?&SYzncTRSU5>#Fh{o)HoH~8tMm)eQf0=%BYpvMwiPz zwM6X@O0ZMFE}^?a>?!c~(lVDQM)-b-noe3?a*z%=L{SEZLL3h97fW2CE?cUaEmePq zIAy6iBJ`+G29F8&N9eyH{wwe))d?BgaB>Ns#VTcR?NZfosg{isuosr9flJj%84O#h zP8K?PsX8TtB}-M4-l@|vsGPy+8Jv+p(`BmFGF2sm^PW{_E>mY^aApR~jhQp6XP;FK zmZ|C)oXrRsoS#9B3~FY;N4BZURILnZXK+piU)D%5RhEt z+@3+346bMUW^jw}S;3YW+*H7=1l*XxYs(dH@wz#K)`h!d-YWRE0;l3u+YH)gaAyX0 z6!`55sqV_)?hHB#zeC~fJ%zi>pJjC_@R{4a1$6p`(P3&R~pyu|k>iI056?rzFow8F&KbWH32{DH%*H#GIMI zv;v+kV203<$F30ds}D`jz-00<@LL;)uWJvob03j9;EdVb3Ym9scqnD<<* zgJ)#_XMSg8Q8kNm3-POEQLBKfXK{7`*T|x#;EMLDUEtRdaE{QrLXQlsbY9`^`2y-? zae;sfg8sTI<^z%jG1sI)8`;rIo&W!?Y%Hn1LtqXicyG`(<?w^rf|1y7Iz44C$#y1T&X zAmARM9kc(xZ}wfO?#<#p;omRx(JUSi!0JDk#Y0&EIEzxY$Vo5fpMyq(26g;c!-^c31lC|kLYfWAWe31x=6R;vC5 zJRpmK1w1H=!Ga%b^*^8deimN|=YuRh%wnkEVeHOXd{jvFaTcEluJ@<5Kwh6p@C%`z z3H@AX*`Ml50gOY=*Mh$(aK6pry8<2|fF}K87C&XNE{pY9{G7$eEaqoi}4biki`@MlxL!VNm)!5(6vyPsaZ@D zPG8}CD0HTj#ZedratIp??YGt-l2v5qeZ;-Bs$J z!rgxb{FlY?0*6JMAbD023ZcyB#0Vz|KDod-MZl>-Pm9oKmAL%~RU-Ty;YfrtBb*iC zot8uH<%GGL} zp;!v{&UjrJp-F_Y2#qB^lN?&Du3`n(Xu(tjCcI*eVvwL&gys=45wZ~u+}6;fND-U} z-Wp{^XuC#rU87tEX2zRm85!x_SggYX%liZm3t=mdidiw}>Mqr8LP*9 zxhF!$2$X6NfjQH_+27A6yafsToJRS6!Ay|>Zi?G z_1IeVc!Vb-JVh(rUGhYPH`l7q)~adyOS(oFFA>N;;d1qi)a%&@&qX-8Ry`l#Md7>< zVOA5xD$`D0imcs0V92xB9>7NL8D;SoNK@Op$dA`FT!m}N!i5usOv z-Vxr45Uo>h(+sGqb?WJL>Ya-k_Kft#>x^}3@H+L~I@Kpa-w6F93}Dd`ps7z?>VpU$M))|wClQ85_$b2q_3GGq z_1${K2vgRpZnrnA2v*;qhDBf!g3l;Sgr6e(9N~)yUq%=a;rj?*MfjRczd?N);T!gm z4a(i1b7LmVP}2xqHmEl?s2{{~ex$&ZVS_G?wIdxF;g<*mqayqo;Wx?TcPW>tm@{wv zQ3zIKJDN$PpmA&_dXfmMB20)dF~Wif3nNU5Fge1s2-71>p;fF^b2g}{Ke*v{H*R1}p8Ct!&bj6&{?u!p@M!a=FaUQzfy5t4Bj zf4^|ptcN7RUy|)%!L0S#jXD#y_)$iSki^Kv_$R`@bdNDEit%5BY}mqi&3IV^oiEc8ppvYBT2;BQ~j;G2VQqY-9g2;y2vV zshiZgO{z|ewtdUaiE(t3Vpil|GO%n;ud?%ETo5DPtj>>7bF<=APeAEr#e~e~;ux32 zD2>r5M*SF<#&~+ODvq(VMQMW=mr3xWcgxyuR^(qU!7F0)m7o!$B*v7%WesDbVsMc^ zTU6S0Kw0H}WuIA7b>;4C^N>O!DR#gOWm|Z@!{Hu;l>DKWMX(Rd{II=Mi8Up3#CK1=(^m$ zMZLO3{kBCd+@i8EB33*`i>+$s7Io5Ab*p^;p zzY3neRoxaty;F9=Hnn}Liu#tdWvye}MKg%;ORutaF<$Op);`9ZL1o;7xHHCkgUZOM zvrTn~@oC?(%rJX0w%gPb+f?Tm_r`c4#*;Dbi*bL9E-@a7vGsWBffx_QcqrD> zo2kv!!!dsBQ`T#nVv7)T>|I9iXsn+xAB*wDHZ^IRqO_04Sg}ocP1T6z>ZurAV>Ito zwtt(dyj?vV=SP5^e_83#(pV%Sd35J z(T$tmp*~}0Ihx}2d5n8@=={H+RS(j4NxzQ4ZvJhI?_zwzt|1Zn?ocCQe7!?`AL9pM zGM~w04%U@jy+i#RVyFyR~2%OYpJbDPBy@%i5{P z=iRL_wn-c^x3iz_)OUACeB#|P_OJzG9Eic(_Qu#Jk(rRuDk2|@!E6sp+C%J&I~9YZ zyvtIK(0S5`zkSc5CJFW(H=0woMI~hku97&43OS*qzf*K|f~LZ0 zRzY{E%XcYelHa9F>L&pK6Oy`;gD=rM!8N@UZw10>C#fN-hyLxSt6F-L3W@18}h{(xQT#soL9 z2@*V>;N}Fa6Ld__DZwoXZcWfW!JUcTM!${KPtZm%cS74H_{>IN{FbDQ=SX>yUaP!IKG|Pw+y5rxJX#TRoG2{E53& z*91S@Tl%z63h-=#=MpU3t%kf`#%);wZr8q;pj(1h5^UeCUP|yXrCO}!bV?QNQLiR= zjoNFPdW)J&@H#cKhi_)0)*hAGquxkB>I;5&kLr=&#XX8(&>r=60#XXxD?#rB3;3(I zoThye3{Eg4L0?Lk;N1jAdm87zWDH8sKf%Us#?fxZfCK~C%I|9YdUs>MOylRC#(N3g zPp~e*`UD>&_%Olm3I0ehG{Hv+zG90c_;!!_IKl7)pC)+c(V|Zh3`_W1E%oes#shB| z!{0YPOYnJuFA}WTqYm#;HTJ46*{6CLWqTFN>i3@U4Ktyx68y-teU0xDj7ac(!n4|o zrhQ~=-C+#hWt8t#yLK5rCHOhPTYJ@S?0vr&BNP5K$@qo6?_lbspN&erjbG_ZdK+E# zs&wNbWduPvR+FPRNJQ>@22tUVFrs>p5X9Xx(SH!hVds$OmNpe zwT7-{pPF+ZwVM5IpJHVf>@dh*D|c7-Ha4&w6P%Gll^ixD*qq?+1V<8VNw77+?gV?- z6E_;$66|D^6C8No*v`HzpyN(m95a06bz@Z@qrn1WFU>E(AqvAB;)eSfjUCEs$QJzg zC*#g9jDxJ^K;zPZ#$O4Z7J1sfW~6r+?G717*|`!RhZA%7CqbicjQ6rG*Z zZO2w-v)0Uk^53#YmtH4_g})mgj5XE_(!q0bAUJowIxmOwb9nXx}ih@0es>zk02=QFCMwEwj^p)qoLlxIBmceGJT9O4|39QUtrWe&}9Xr4pk9B2tmawyBu4;U}(S6Ah9 z*SI=|ra5$e+fYI&Hrr+Je)Z#ib>YW+6~D;L!O6juDqA_&IV|0;c(J{_9Q+)zax2JT z-+nc%w~?lj52zD9G{PJh%;a#}*3@%*4AO|TKA>o#Q$8_rIplM=m3MO}&*7RJTIFzK z4%g<;g4NIA2FbSR0af15xQ=o9X_dCjf!1}y0d?;I_1OS}joaokEsd2l|8|2XqG{y>FuN-%;Im-ycwS z=WtIBY=RDSeZ!6E2NcbF?oS3eopZQ1hgWiVHHZ6hxIc$y*tj`7ki&yHJf6c7IXslZ z!xS}#M{{6z?)<(%SJ{Oven9Lv=;FE#HJ;1i`5a!(@x=`F0^fvx+juF5=%9L$^;%)P@s&YNwO&Spp<2jp zlEYemT6J!y7sD%At1-Z|2a0mY>5rw49yBTVjnpBni7x&m5S~*!>2z zNAT4_HS3_-{i)F>hb;%ye+RY3-la9>FffNfG`yb;R)k)6Kn^tzsSEoUgL4>?1G9Q? zq`}tjy343GL<{yo4j;0)ufw(1VQ3B?(JZgUiPz%e96rfmZ#njrV;I|o#!!x%%JFFq zpV5%=n4ZVyeEFaJJZ{S4%N)L9ugn8^e4WELIgHC;d`>@keVfC`9Dd2+I|-6ALcsSz zf1tZ4@P88Uv(QF|^kYTlkoq-;--PqK&~}H^9|CxHR1TvHc#MFt^a*#D^40|QCN>$n zyzrkqq$cGsIfp4ZOl6l5<}{&m>7#O(E_g-`GX=~NI-3nDdo*(-$ZRV%faXhZ5lykc zUnqbp_KORgB?2l|%a;jWp2Ld5-IW9dyo!x3mF08L+8nm!usw%$Ijolm8*=zV?y~fa z!r7F==0e&n0=BY&B+iZ;cINO`4u8|m3vu=f*qy_k0%xy)eRPk_w2}`<@SxB`LJte& zt%^Q=Oj28HF6G2sks3vkIK50*)P0#fR0|d7M+=*T|!0 z0oM{xJC8a7DmIks3O-lpc|y+@S}%_a1XMKlg@WV5>JkBzr+yx{AJ&3#HHq}HJTA{8 zD%`yykE`=&nn$s4j66yNG|Z#1fK(x7send#9zLbD^o-=$q;R)Pz*Tvu0;fS!)hv(Z z68!P7G6ndByOsbu52wI!1$cS%k(^mXkVjgWVIfW?kF4O&Bu<=1lGp1A(+;a#9{D`V z3o)-3aE;Jwg|-lS9lQJ%tqoo`2&ZKptprpk@a8;P=kZ1!Z{~4J9=GQ4U>*-igxm6H zo5vm0XC7_xSW}Sm@58E{MCc@xIky*Zr_j5E-knDW0rv>)DD>>V{wGQ2Jnj_^)83cI z{emA5S|Jtr4@dAuW> zUU~Eu(31`HmtGj`lSkh?KF#AZ;rGj9uz+`k_7^%pC}kU%#~{IXiWo!kcu#`w=kZA) z&IfsXD0ryQj|%*c*>(f9&GQa0zMb!7ec?xih$AUcON%a@zu_%wld2Ev4iaeGGW^id9%L;gTUVlPD=1S%!8LrA> zt$@`+*9fIf{*`>zv32Cdn~lQXB$Vru)&AB7zd4UBd2AKtHlcfkZWp>EkDUS-b5|a_ z1@95s+SB7BuYD5SpT_|KH;5-cl*i#b{>tNT`s#A6wI8|;n3c+b0zOf|NkZ8rx%$cor>Ifb)c&U;e)_g2^wS0K&Ye z5cA@4Tq3xBfz$GY(#y(mxdc@?t`NYwlnN*oYLufyKtrJ^p%q?;F&mZR%5pR=2V0ZD zCgpmMfLB>Lt}5W~UeL{Sbvc@rqggqcm-EDA#N|jND@$k~)E4Rpb%lCD{c`XXIA)TT zAVDY~BQ#r%=>IYG9#B&g@B8-y7rpo1J5To6rS8zXfVjz~ZL*anAiXLeO0|OmiU=yA zBKC#~D2g3LMNkp@7aKN;B1o_AmHYYcdw%E4xz1 z45MNg&3@5CBSddI6CD}D_%l%k8n2FFObpl162r(^5n9%tiH?n7Tnq#TTIe}J@=g>j zcH4X=IwgjwG0cf!ZVc06m>$Dx!^78dcAtsPh@tG+=*$>?KNCH6GTi2DbXE+*&PEB> z#ZV#{nax_Ajb48?x|SNlycib5urP*AXQMa7aAOSfd0~7q%q%R2KnsD72a^{`((bd- z$PJO3Vz@bmJ7c&jhFe(YYLVMTZ;b_ydH;1bdRq(y=c0p`gzt!9X$-es4A(ptZF4TV zEQU)}B825JtcYQ44EM*dGKPk3=9Du!9-qN`)LFNS-0lygx!P(Q61 zA*^A|Z;L#0F1kbP55({=hg=K~#;`7iAJ0Wkor_W*VwEJyEQ~%XN6Efj@K_8r&qp`J zPrSWtO&&2Rn3~$HqYz)uEusMb;F+4Bj(Er64>eq_A z5W@(`zA1*6Vt83nUpgOsh3$Dhx<(Gc=++osjp6ke-e7;lu#GdKPWbToXpN->Y+i;v z=Yw|M&XHLs{ALVgmi<3FJ>TJg7yCysycfg!F?=A|Ti1z{y%62Owf#brp}43I*@hRQ zJH?;yv3Rn~Ph!|5%%{Y8=shuf#>R=^rx-qu;fol)iQ(HA_QvofTgD3hG_)@k{Cnst ziKZ?@$zKa!dm%~(hVNqdfm4HBc_I2eTTFat-yg${3sGh%F5zd+l+vL;WB4nEUt-)$ zJQxog1_xsJjbl}!e~1sq%z+ERUnWakj2?{PPz-;w&KIMcK8LyPT@2>M7gZxiSmCO{ zthwr9^q&~0M>(4$^>_^bF;&N29VcQq8N);!lXRSl;WU>f9i4TYiQz2QMjiEaoQvUn z4CQrH&~YJ#i(J)pl+v-_V)RlBcUOy+&~aJd-iy%!9nV~hzH>2JQV){8xftD2Jz84F z$&1mlI&znyWptFk6m5SgI_OfA(Q-Pj7pSPCl8)*+YUrq}ql%8II;!a?(=4+5Qgr*7 zaJ*#XSe0nAYS9^eqfcFm*3|LVrRWXSqP28EunUoP%&X$)DW%ggqdpTuyqXAF+zuzJbB5!PA9 zR2|dUDLQV|F&@lh z)bV81=sX=a=(s5Mv30^VOQ}?q=mH%JrEwN>43rA|`%UdnoCLJ&7ctQuy@hKfovrTmDDy@Di z9h~(uoN;B;b2^^a@vIDk24z%-GU~mm(HC^QsAFUqHAJF>*=5wrI$qJSjlEn}ZPu|x z$7?!{l~MPUQBRdoTXnosMlrmq<9}s>jwo9-%6@5HR=v(%8yP0N$+@p%r;d*}Wy-3z zb-btJeH}(w^^T5rnZ$8YRxK{8cCeSLMnBN8qpVt2R&6S)zAdXhwRO51r%p>mBu}8;eoQdVs=WNyL(RevEwwzj2PLaRVu}{apthtV_*w;ft z-|F~I$JgwUp`p%0L*MAwIwXMa1rF%=O~(&BDRJH}`m>H71%47`#x>>CFT%fyZoaR8 zB_A0QS~|GkcO8FlX6g8g^_SFxqI5Vca7f2G@ei_aX65-G9Y@81<(JHakL&nPDtU?P zzu3>@%Q-16fFZRS zR9>;F!~29;!+8EQZ3B*hq=A$)zH7iYFsZys7<{{a*fWqIONH4%kM<6y4P*@D3=Eg{ z3GRs-xKWO{vv-)sC6ACKa-F{6(FU$&Q3hri7-L{83pX&?z&Hcfur=7!Qj_rpUwU8g zLx~VOjx}eo6Qz(vD+;CP7?e4J;P71){v0ztF%ZP-caKT>V6J60}pb*^R+*0neW=iobWo1 zfeMPSp1=7YDty?$BdlAc=%Yrk(b&^s+#vcGPhWs;j~jR*&rb?GWgy)!*t_i+$@r}3 zbE14bBVQNxqJd4E-jl62$ z{OItT245lA`85OEI}^dkcw=k1>u*p=r`4eZYI9uC(EiW%8-d{p%dIq|)0E&~r$P@5~L zeFmnPq0cHPMh{g`-x$I3x<48C*1&fLzBllLEOGk{yn1cXzpD%WXP|6F)wH5g71fVy zKzZ9qyrOD%X8{}P7p`mu4sZ$-hK?Kf&%kd6emC%kfjYJEkuyQ2EDqB>#V zq=D07zfe(~GJ+os*bB8P1&26e;4D`#c87ryag>bXf`N-%QYxu}INqBZxn$rnk1{th zYHozl!b+-`35cTr!-z_X#!7Kij-!T&nkK5m zQ8kWx;#d_&wK%HB(K?PcOpT*vJZRxoaWq|8P%Dml@!&KWYR6GWlIq66u%>+xjrHSb z5JyAtVJ=!42{#sPlD9XFqnU7X(H5dDMVXzscr0db8%Mi1hQ)DJ9PQ&MjH7QH{o**N zhqO4l#u1Gp6h~1U;W#4k;QzT@;^-i7dnNU7B}GfeIQS}$PH}V=J1w&+sm+ztu1ZS9 z(JhXFl~u1ey2rWkbcCU296wi5J>ocBN!6&VXbDwT*~+SS9DU-LU0E^QU0L;y2eW%% z9E0K*z;>vtc2riJGW#p5E8-X&$B;N4Srb0V=(h!g%2m`*v0TZvt)gg&#i7TMjUyL_ z5l1|ZL>wM#8;2E#6X)YAA)8qShI?00WCE4Jm83)!<;Rf}&cu-tNXPMX6*awzT2@89 zC%NcfIHZ78-L^6^JdP1@jErMc9P{H?5Xa~^u8w0C$Iqd{F{0z+m>@7Vj&TA^x<+8y zXTf%p6XTd1$CNlG{U0OkQ{$MP_n#I=u`}&6;+QFc%(dcL@wtvI8OI#q>*JUg$K3x@ z+70<~Zp>$7UKT=K7{|?V+#%i_30c&TV{fp_Lp z@5&!*g;-XK-Yr^uF89WP^&m%D9FIwq zJ`ah*!xCN3d0j=(_=rRw72S~ctWz~e3RhK+$MHlQPjXzv@md_)IGn1gr{j1zj#uJ% zCXQ$0crK3TrR105!LMZeb&LO?e<2>cck9JCHpPQK)H7VH7Gd>ntrpoF$Cfy@#_=j= zs2e(ZW$=R-e|urcsX7trn7gB|$MHrSZ^!XY9NWeD%{boTcwQ2wKg;2-F7#ydT{$!@ zjIt(#9dUdR#~*S0$#C}~!e5H+6a7l`Yth%-5Iw((<9m(`GxQ5ju&VkYjvpoUe-hm<`cYNI zBs%}ZIWDQ>pR20Gu;{OG9N+{T7G?NN;CC)-m4fJBTyWy}Cyt|W9Fj9VUNLf5>dCV{ z634l!>Tgj(&1&jjb_Z9FIL^dzJdXe3I2p$&$#{Y*l^wipiyEq?2>qJD7dR^p<;*j$KV77r3gMIC(yNQKFaPxEu#x099ZHTFOKT6D7^S6QYaHhsm?5snQZ9ml03G z(rRi$HC0~9pEN35L7<{&CDF?K6cDH?%4$>-sBYo~sbMV>wM}#|(a}U56Ln3rG||dL zJrng!G&a%1#K+ZC0~5bhQ;ke?ni*+mV#lkGXfuGY;B^Ai9!>aiT?M6+nRWHPgGYSIS}84 z6){m{;y`tEvAPPIs8u5XW?@n%6P-=;GSS;a7rNC@Q4`8UR})v%Pz<>ms+);9HB@&K z4~~u8UqexQn8ADShTj+NX@dGv4b{g)UlT)23>CM2CI*@qB;21TCBTe(Yba*C!bIho zYOskD66I1)up#jY!lNh z%&_2?a80~y;uSM^wliU3mWgXkcqV)kNfRmdvWcel1nCmio4)8f}8ct4$oL8ALDE4D91fT*JO&V-63GH!;D)L=%%t zJl7-Axt1DQOA)R;6;9Vu)XA*Osql2h|O~Ha`5gi6?lToeD}l&P!soA{B(t*aPV?E|7$UlTcBSN&q*S6%?u zQ(8SWuwIb*yNN$coHKFW#GfYqGVvcLG8Y6+5EI8t9Oo3Prw*H#Ur+sQ;)sc(tHTVR z%#8d)=2+#ZsHZkbX)KUT{ivR5Ff+o8CrzA^hCM6gFzM%d>NG1{Pn{`N@gF-ga>2w! z6J;!vwQ$MAWlmuWu)uN(EVQey`qoz^EL5wn7+8*9Urnp8N=Xt^OIu)+z);Qtqm?A7 zyl4f{ilTI@Y@v#9RTgOB*7~YAX?=aQwZ5upp_YYy7W!MLZJ~~ZA`4*)buHAh(A+`` z3-v90USBn|(1YG>iY2El2PscY^HYZgLM?2ir9sRpV_ zLlv>m!Gf~T%|e@os-uOj7NQn9NtBk(7P<)cX{Z?W8Y+I8Fz|@otzfiIZK!%%=wYF! z6?``JvhZy|ln!L}T_3hgL)BM2>Ab$78en0d1usmRJ+D%w1r|AE5l&Cg$Y*h+SPFut`Q(}Bu}(3NupCN3}~#J#%i*K$<)Sbionvw zYFgf($C_zj7E88p*5a!$!q>9DEIexAIt#Nc%wbI|+`?A1aJ|Jp9EIjvSYTnEFrznE zc%reoQKD}(RtqgGvT&1yn=O3ZSkYl|-gAk-KVn?T{d)UGpnN3u#iMp3v*+dmHi&|6c zY~ewHwHEFdV8*#k)H>mZIHWCpH3&*u+eA^B@nNY6d4q+=EPTefV_~C($1S{JVLQ*- z!jl$Ww(yFDrz|{e;YGIOu+TFWp5=6~P|#G}UNQ2Vh3Cb-rHR_pL>+9R=)=&ssoEs= z>)$GPNr29qEs$R=_7~-K>{gEUri$>ISeSR4!0Vz;Q}w2Ww=BG8;eD~ZE&48du&H`S zm~RPVE|##v!Uq;UvhXpdswC|cWh$%33f$E+sNN?QK4oWF*u_(mLsR$Ui=_iSr&Nr5 zVPUU@Uo9N4@TG-)7QVCay@jvD^IOrcEqo)uR~BEa7gU4cLpjP1V*k;?|HOyQwO<;I z4nJA=*}{Ht`^5s=je+(5&BE^%j#)Tv;SURcTKL=I4L# z;Y!#nIInm!b=1PY%w935jN=BC;VH9*|B3Sn3nv98HB+Yq=x~}7s+qc}nPL+$dd|Xm zt|2xI8y75Gv{2qg1sjhwQNXx~u3l-b zYS^f0cI8$VRsosyQpbL)$pjTs5`P zj7M*w$j7EdSX7G^ss+!tg&NaB&2OPv+h}7$F{6#PHrm-Z+(LD>(cVU(%@ql&S}094 zEE*Cm5@piUEfh5((GH?-w@{q~zLKOaHoDq~vh`Z3qLzy7$xyeY>TaWljea)z+vsUy zU`y3Uw3jHOy=|mgDgr}a8`A^^FxAFj8$)aivT;jGwYjCb!p4Iw6**|AmTD-Q&gK@S zh}rmAj(EDI8YW#ysN71mX%$qXS1T2_VcNLb#u#4z+pulyXr)HkaBR3XayBNm3d&5_ z@NFb*kUbl0YP(g?O(`2`F$R_y5o$(KvoZh}9d2U;i=7b}Y2$@ffzP5=YHh2a<3>w; z2xD!GvoXWQOdHqO7;j^$jVoHK2{wLgr6R4>WL86XlIV$6s(x!V#Rii&x~S7^WLm4~ zETpw!g>P%EX4zmbFm+dJbu9-~YjvIIY}QtQNw2h4w9m6~gN--c;P>+zZOpfE)Zu0g zSYTtJjeBjZwu4_I`FrUi8;kAWN9-kb@ZRI4!Z+EtS>P7YTSe(}n~mFr?+`8cx`4)I zHtw`>myP8-cQ#$=&@ZhOi&`NC5>|2!isc>~HI9W>iJdzHG3h?Cjk7k+*;s4iej9(< z_{+uv?0Oqd+jz#tIy?A8d)US!QusqQ)(cc`qYB%oM>&`u(>B_8oK@lk=Rj(snx`Wp z+NkT=s3%ylHtI+)KkI-+bCL|weg&dk2%q7JkPGQ@rI4vU#&9xScR7^QtRUR&NX*oytC*4kG#zP9m=jc;ufY>u9|F4$GA zRY>bMNozkzt9w-t{lUinZ2V&5R~!2|N^Shasb}M28@2dM;lv5SPI)BD*P>9ktvbeu(^j3Zah!|l+z`Wm90PL#*l~Sm^%J4f zGMIla5jn%z-B!(MtH}JueVzl46VSmd2N!Kz;(F+yn}f?dWd{u$G;~nHK}iRd96pQz zI4I?ytb=k6mbX=<9h7nKcw1HWMvXVE)|Lr2OeybxTmMvWP|*Rm#+zhoet~x2Lg71I zwKv+TDh{eTsO6xxgK7?{JE-BHro)Gkv??iWWmjzhw{E#Y+f!P*e5Lk9TUEzFT?h3X z)OXP4+R&D1+S}7Z_rD$G&Sn3#Rn1FADtKBW2aO#RI?x<6akvF7S~+O#pqYc_4q7;9 z>7Y}8ZRr?o-&;{`bGBeYs9$I8x7Wkmu(FMVwhr1kXzv93JPzmXkY@|4EYi4%iDhU( zCvyK62SpA#vJeMh2k~lJ#6brq*uRXUuH=Pa-?x{01Y4JOcF@H^R|ioCdmadOtv#|i zT(+IsUsS}6R5)O`^+tCGJscz)cn*3x=;dIjgDV~McF@Pc00#pd^rd}{*3UtIC)k&b zJKbFBuJtdgach|0Dr4*Jzn_H(L(P2V>@shyx0paJLQcqx0>ai&WCFT zlj7kSn(rX#V62024pI)%4n{Z_=^*1E>mcV~xPzI;f~}LAwNu^NDQ?I1aw&~F;u-Du zr30fKTNm!DI(h98BPNyHGgM!6eqC zgtqqzt>>{qZY#`9XSlJ;R0q=>Om{GYJ)R3KDWffEr}S;XCRsn0)41;mH!{A~!F3#j z4z}=o9n5iXuY=VN<~q3E!L1H%b1=`r4GtDLSnS|N2lKh|J6Om*ZJ?dZg}B0$ifYeH z4ebvXjd!$-CkvN2xXHoI4sPN39xq(Q-MIQ`cib1{E>RDS4RIq#*7J4;cW_=fSm9u) zgJllxbZ{3(S2AQg9vxpd*mCZ_6NMeuMCZ)bwzkk#I=I`xJq}iJbX}#rwkFzUU8rhB zjeEXy@1V6U2zI=>&%qi8PdIqe!CD9RJ9yZ^BMu&L@SuZr4j$rQsHJgRnPHQ)<8`$4 z4qj-dt)8#__IDxM`OakMQ3o3wJmz2{t9QQegKI*MPYpU(k?g``-^A*bv&};3c-0gI65v>Y=gM ze#r!zWw%%z<>rH2R98&ZwmNv#!9E9HIe5*%HU}R%*y-SP2X8odhr`>!b_Z`dd^0oN zCO6bB7irucXxjQvyt(#AMXkp_h3t{{9K7#fhl3Be4y+5!U#M~1a+vL!r(OMcboprQ z(W|wO9DK}q=ioC3pRh^}K6S9$33f^5Hoo&)2fJP0GF%%xD>SjCcE%5V?%)dtdpRtb ztD`nEti9Y$anDU|iP*j<*oN=O@xreieBlUesJ(VE?)!iz2w?^WdS#h z3dObk4t{j-lY^hx)D5*o^R!mS3ip@S_7rJ<4A)*ZwDZ%n0}g(3aL~aa2fsV`!@-{p z{^D4ztbNQzJ`sE-zJ9I7?QSQhweqRZVJ@K#{&w&WTkqdsN1+a!K8J#R0Qph%$c9jS zZRnVT;|_+oxXQ(U4o+~qxoGbOzu%s8aEXh#gHsMpJ2=CW<);$us+~IT z-~tza`m|GwR%)-BOCS`uDB+@xi@GjKx`2x^F3P&-)?SrzQCcA0UX5$77PVJ|axPZ4 zS3BFQ8Up1-D~MKfQAvOfl?AGZRu!%0qPoEI?G+try7*svRm;W6_QBH*wOvpv6b5%O z>ba;dI~FxBRDW>!b@BAzFhfIuMlKq=XyWqahvB9!S_?E2rKP!x7Q!v_mR6FBNp13$ zwgSBU$2%8=F7BTaiMY^Qgj^J{RtF1zZWUgINasQoc7r$Q8ilHZi;gZjx#;X-kc%r^ zba8_lhzwDIuA&V_h80`PMR$qzaxu10(Wi%to_YV}4;S=iJ4`F=BTDEi(9cExyk&rk zfx^s72kKxKS4s&(Tnu%CCq2rCH2xETNeqklp97bhoZ=Z5&$=*N#9hpFalH%Eh2>(n zixDnt7mmxfsUz+3^CIlJNV@ps?M?|7o(tc_1BL1p7UhHq)Q=0*_^A;({3y|kmZUj(&xxAi(V05W#SJbV z=ZQB9-{@k#i+fzGa{XY-M~(9@t})!E*^66h>J&EJg=$s9K$X~ ze_ME9U(tJ-YTYROg{Jr(iNl&=;BDW>IFUo@isnTdIb53;kvX%TaPcHtV5jyJCxwef zA=N9SE*#VnA@v-K<*D(+i_{A)UUcz_i_I=Jxxt^UUgDW@IE57d+jw_KJs(mZht#hj zwZ+BRkb2d{Yc96Bs8OU^7b$AbBIOpTiABM)DEzzG>n`5lDHN&gF18e@Jw=N8mW#Jt zyyN0s7du^i@zdksk2!8#eClGi zi|zktox{oqt6e;WqZ)noxXA7Z-m3ALi)+GaVOXsXtJvP~7cADrmoD~kg5+T4@Rf_N zIYd3Q@$ij{Z&}X-wkPnNi|<|Bm%y3?e&CwmqGwJM;Dh|Ty{}7HS&{-UtJt< z@iUw5vjT=+1h`|uZ!Ug!an!}XF8<(P3oC{rF8*}!mqZV`ILr`MpNG{Uu@Fi}RKrN% z`8QXjI^lmryF}D67suHMvO4|eqTGgPsmeIVSu;aB;ez{_p5#n#pq+AYTHuT*Eoa&L zRkSagY3JSG0RxT!_6Wm8DT;r)E7Lk$kU;4K$|O)CfszRz5j+4;O0?vF;GZ%&D{wMg zHi2>pG)SOf0_78^kO)3~#v)QNfl3KfPoPEul@q9vK-C1QB`_(XZjC5D)>XM$XdO>V zc=pVqnhDfOAXYb2FM-b@s&)c(6F3-A4V?D2a|1y*lr6Mv}%RFfMPoMqoULLC2uXi3!Y@7n&s6y?uy0HGydf+@8Q4 z349v~Pfr97aa~J?1ZHx4)(ACg7MdkM=IG+5#&rqIPGC*~bJ-eBcu^u)nF-e?Fppht zhZ$~2;6~y3dCLNUh3wOgiVlk?n+?!ve0r4>?I+FOvm6+uDdy|5?GZ8p7XqAVfbE-)rz619o6atH?=P) z<~G$rYZJIXfoBqUHh~8ccrbw{6L=~SytU@nZ^G*mcqoC~c5U~NqV+PO9?p-eM-q56 z&l?hWOn9T{6FjoUbS{|pl%%e2=M_`0Lw&r{?#6L^a&Y6AaD;Ozw7 zN#NrIK1tx+1l~*F!vuD6DVR~fjPFZnI}-RHfkoT2|2itZy`)|z^^w>+b_zZV3O5CB z=Gm3NrwQ!gVv@kR55v3J9d~McvkD#f8j#P$e{TX`Ch!Fhy-rJhsh!=Y?MvXJufty_ z@J#|=CGg*g;5{MKZ`txYwC@sl{h8nsB;HAVFFd)EqGf*qKPGT7flE^C!;cmGl)%pk z{K6?9mX)2b!H>DdE$3%b5hu3ZKhc&L?m|xZReZg)a-2_E5${frqC$sS+L@=}}Zt z6rzll5_nG8zRwG#70lN}rYjtwj0GpSB*_ zd06J-P9N<(6ng0GqmK{GL&(D%4|6>fdFaqt4f1e>hp>kTqaHeX=8+=~bG(8oi`?!kUi6FVz{(^>WRFhCAH zkf{%K=|4V9XTF7u%D0vc_Atc51P>EE4E1oOhqQ-`hhZLfZHDE+_T@v z{v*XQN_4b`AH-O;OHhY#VjM4ejfaL}Jjv&&1SWZy>|vINYduWyFxA5h58U~2e%;8G zUDU`fYMO`X9te-Rp?O`@Ob;u&sQKd~&va4OdFc61m=DkV)J4q}ey@va{!jRN5A!^H z>0zIT8$8_T;Rz2Lw32dw5+%m#~Ans)k+F zEzEu@dYgya#qCx$epj`AWtTfVEcLLlt9rew8r4Fgu6$`h(DE1#3RZn?%+QVxewt0BQ!?PY<@vzy$a~_`e@REm@ zJ-p!IMJZtu`#OKD;@2iDlIWln!CN5KMAa4#TRprg&KG3Ym>9iktIGWwy1 zoq7JqLv^KS+~wg@7N~+YX`|F`4-8|K>Zz2i)aM?);0nNzushhe;cjtzT9jMtedXb6 z50^Y#=JmgaZ#fJ+9P#j-hwnZ7;^9{gnC{UZJpAb4C)S@CS#3GrU!)LzyZPA*Uh`X{ zTTp?sN*(at+ zX%9y|{L2PB8U4=-Ue%lKrjBvd>ZWFPQ^z^{x~Yxb)Cno!q#TGfVFk{3IP2j8*JKap zxLkASK3Z~LH?>`=$8-7Qo-Rkasp9QLSZ0Bb5Jv;-jh`G|S@ds<>rX z+ZsM<`l#avO`2HSrIzHa?c)I{kY&EyUG3_w>iVGm-d#2D(U5Dkk3t`fcyu4FecabW zHSy8ZM@t{Ad^GdX+(!#P7%e4xsQNurmma~WV2Jey>N!SqK@Zi&M_V85d_3Pn@qJTN zV_{_c?GepK$VVq1oqZJf2>a;Zqoa=xd#Im!sEAaOJKga0$Y-Re+69psJyjPUU43-( z(cMRs#r6!2rF`@k;Qo({_VCeDviB0D4|k1x;B1)hq9OP7(a(qO!(c8S1N>kY>>+2u z1APnALD#n;GR3FpwCGVH2 z&h&AukL$!Z%g0$c5OucHhc)35d1`a>xvuvyFV9tbsrejxK5p`HvltipSR_zfx5dIs zL|gO||mU)N3tv+rO;0fODgUTd^rTMeF%g1sbe`fJl7At(L^zns{y*|41Qg{1! zjqT~<9v`cG+{-TT@sc0hfWFVi8V*YzFZft1mJL20^Kn0?hK~n*tn=}R*dG#oSdikLK;SEGyXPsCLDZ*UQCwi%8eD2E``l6S5 zR)GAR!1iA1MIW2|;D0NBu<~<)Kc+o3BTRkS$16TI`zYwGw)oh}$0MDynfC;4{;oaQ?X7l5 z^aIfkMR$sRB>J)FC!+MMzy(q7SRtJ+`MAt}Oa>WC zBvD$Rq$os7iLwrKU??NevPqN^prtq|QbVhlM5QEdI8<0UiCRh2PNIrLX{nk-wLDi( zqK0ry(f1c>bYQ3>(MF@@!p-v*HgBsWS|@Q; z60s!OB+)h*{LV8l$@_F@pG3TKQLiM5`bG-bk4bb)LX&7nl=dQla1s##K6OB2r+lgs z=q%bLiLL@s(OFk&LH53pZb@_(3%N%UJ@d>ProE*CtV17xzM}nDLxBPLRJJYaJSd4P zr1FDBhltWXRNzX{VWRq(LOls1iBU<6P6oe~#YNLem`UD54lK5)mxLogiz|>2-PsMk zKr)}2N@7v#|97V&lSDRe&j}0{9g)OHff?t6U((*~t*%aDY7*0u7?T8}V@1a$agD(E zBqj+kX+jbc^UQmTlZB^?Gz0%t&IUz%0>gMd@&z0LKP-F6%7O>qX~r zR0!Od!~y~O%$K1;U|1-|*Jfyo^QlXcxGB#!3-Hu#OXBtHe3SeL|x zzL8}~@HY3VB<_^xU82iHSBTPQWfFJi`JNRC)Jij8aISD$`b88Z>O2uAF;w^z~qO9uc zNxUJvUGz;+_Ais(7Jf&R(RT&j6MbK_SAFfnBz7k8KQ6yXe3ZoZ>Cjg);6E1rM08gY zp9<_w;tK(~?MdRZJb%tXRYRk3uUNj!+xH1DiF4}fB)*Z7zZLyX^n1}CL~ox|K(`;0 z_=#&;3e{8iIf+jH7XF>YKS}(O#IF)PAo`c+Z=$~^@rMAN|4f26wFwLd#dt{ca1uuZ zDvk~@>1Y!Fa!pR5ObW-6IG#iSKc^OH|0M%GCwd}@lS!NsJ|oJc(*j&Q$Y#r_>r=#=;DEYL-?t7tTZQ{^;zc2A*43PV}FjiH`W)d8ZcYOfS}=edtSU(tS| z{ZlyGL!%qRK(P!Gy&{Fd0<;ei;JI_Ly)uPi0#}LB5);rxjT9yp1%I=(QaE_Na8xRI z>c&oipVv+bZVHJM#y8M1qMj(DzCcnml|njif0@7k3+M8d;VF#B^GG)S`9fxA4M(SN zbqa6viHu2MYzpIq8J(2EHNxZbmIg;d9)XG96l(nt9DyyXRf7gK1iG&;P* zLrXcYq_8c8*M&Eyuti|2=&PbE|Fu-`Bocw)jTGJy`*zVc^FD70ye&%ScLm-PeP5J$ zcW?ph6SUP%&ZZP%Y3ONuoWdt5)Jvm&8oN^XG=)9w3o53un~=gEDg2qjXDNK1!jCEN zii>083tr(%@9!1;GCvabrSO&T*P?x|3(=Y3TZw*`!uJ9{h|>PQ6!r^Os2dD9hM)K; zkWc+3g@&4eI=EV^ELughs%W(|steReqqaazQ99R3 z>~Ck8_2M(rA^&#y*k8>0s$=k`5MurlQS68Er1mB8`@L z%QqbhTBpHoWoVN|+dQ{RqrGq;&oqrt8bxVz5KB0Xhyax*Rh*YlY~*!&=QIYSgD(+X z(kR_p>zc+p9keLlXeQ7tjot#?MSF<$6z!D;1J_CV_Yq59(SD-+C6!5ZVBrJh5QEaV zLSV4y5YeG&Tq!UtjjIIcKY&-E^4-CpC5=UCEKb8r!%Aap8spNi({R!lHB8IOdGP^e zu1;B8uz5}U>fVvSjD4k41HKm z;{)OMrm?V`#;{u8zBJYdtQEaq^Z`-&(7$y?Yg|WrC>^Y6>p2GcsE0)#5q(s2gXm+T z8%1kfE~Mv^X*|Wo&tPr_Pp9z=r(^~-GI*9VC5@A5oJ!;QG+sz!ZyH~w@uJM2SJQYc zjZGX&jWo`$m)I;~eZ=gz$6#{!?^?VHaOek!~>Z`mX8SsI@Ud?8wVh<*I=Ck?je zi8S~m?bkAFj->HT8sBm$=o|Siji1x_MfiKsA2?0~n7TiWAJh0L9b8s1%0T!vpZcf3 zfi!;0TYl#XCd?~;I{zhnQ1p=KVNrfZW9r{BLjDouP&q2_ujsKfjtl&kPc6MVdSSSx zZI7N#<4hVC)3}tz*)-0jaXyU;Tng3(pJ==)<78(ba|Phwyv(Jeq*g8yC__O8C4@`n zEf6S`LFv4uOa^81eD|qB<|>~-1+i2Vtt47mw2Ej|(Q2Y4j|W+5W>71Gp&4A6LG29c zWY8mno*C55pk4;uGvHM^f7Gg zuMnkuu)q*eent$-1Rqba40JYcCb$yb+ehP%entjyIp1*^m>F1^;0ssZmYSV`lfkaJ z+6b|@8KeagqMj%{{S1=ADN!!?G-iaeqB+swqD*R%!bmBWC6CHrwD8rUV?@UmTPkXF zxF&<~8BE9oKRGf?&tRhPB+<#DQ$(kV(q~#GSbPXG#4=NKRzCGwf$K7uEx-n$=k*!P z%i!G%-pk;I4BkFgI6s308Qdt$=fLYFG|r2K89blC3mGipAu?E!!A%+5pTPqe+?>HJ z8Qdc+%rbAy;LbeXmci|LzC&QC=rU1$A*KIa87!CR3elCKwBIej>%dh4_vY=ZGq_K9 zO$KWPICJSweJ}&gwI?#Tqnfr(_#x5t89XfTi0ES(JSsrv4eb4L8eyYY9?#oZHx}|_ z22V+8Y5OwxBm*uiyF@?DU^nY8Oyd_Be3s|W1^z7xoc9WUnYVl;MX|K6 zGx#RY-)8Wg@b{uW}ebI}%}G`19ICCZ-&+UD&Y1lncMUZ5}wEsKzFIPX&=z%Gd7EpJxQ zI_9~PK<6yF&zezF6Jh9v$dSl*meijRanVmk1vRItOlKh!2&2kU%pnY!6 z;ue8hv$$R0Hc|eN!c>MkvM9DJ6Z@T6+$FF)id@hUUvv?tk7xPDaSzuEZFXb&uJ`R3Vd_|(0MZMMq zuVzv0nSzh9!Ny8y!7L7OP0OKC4u`WilEuj^PG#|THhAyTh(Y*|1Gta+CyS$5{L8V_M;)U>Ep=R& zKC{;r(0C#nY{1Gu=hIyLxq#N(WNp==K2a;Ta^wH(UlP$7p(IaJPp zTfP?cRTXpm(xle)2zX#$mFlaw4QrJgruJ2IxTUY+3#k~^_f?zws+u{}$)Rozwd7cP z`l{M_sF%Z^eN_X|`l5_p=&PuFDzb47O>*d-LysJq=FlvMb~&`qp?NO&J5TEz+T_qe zxTWa7D@(M>;mo-(Q>*k-EoGabwmC%l1&`|#=Ae;t=#YcePla-Lp`YSI-95sd1^azmQ#&#whoAZ>Zu!BySLQG*7Z|U~ z!4UYpRwR~#o(p#Upq)`FJ*^yUcF-tAy+4qguN5im!<&moz^$l(|@ z9H|`AIeeGH_c>&8$mZ}w4o~Kg%VBs9^K!T$hY@tnVR8;rau}7v(TPQ4a~LNuI)|%s z7?Z>4ev0<0{Z;$_kEt&Kx2bynzkDdOOd<1-a__mrIrm=65M`d{c{qEYJ)B|hbIvv; zq?CkGNQ6k52SY_FMT90wM2VD25m9JTGW8KvA6`0KNUomiPCv{hYK$}i#DjVKOjb${9 zyTe!!#uH&o591#8Y#2+z;2%lu4P$N?4~T^sVbIQff-}RopQVSfr$K;1hS?&YLuDb9 zJQ&7vf9H|V&O>25EC$Kvg)u*j1z|iQl7)hIR|+ucQQ?a+nv1yz)bZs{c2Y~F8jpvu zjNRQyF>LIlmWNTNN?=bXb+VIM8Ajmxz*Av79mdj1fhWb=tHLPN+4u7^)a`XZ2DTFNg7N7+b|rt2ySwcr}bQ5~b_bhOsV;$2+T687c){ z3uAp4Z`0vnYzX7^Fg9|^i!%Sb@Ihzwy_9vSvwD*=E{sidX1Dx)b^MMd>C`+>vy0kH zx96)Z9Ih1u*S++!)v!#=bBPhVeyL zrFB)Gb5#_d?+;^=NFMI0zTjWL!YFJIc($wB+|?h1Cn^WN3gZxcQYr9jS5>B)Iugb= zVbs!ay@qeYI2y*qF#h8-4CDJSeq$Ge@k1EL!Z^Y8DvTewG<8!yg>jrSy_*`|O-<;g z=5fb}9dMN%CrHqDaG+e8p ztmaP>I`-)vivHQ!LzUC~arku)b*_i1sG*XEt4s2))4-Ni)=-6|^i-d>&p%cr@OjHX zRgGV1SE{F~rlGoq8k)Zj)YLGyNnk)v#i<(asoJ*))Yec(LnjTLHPqE`gN9rUc^c|z zsIQ^9h8s0B(9n?9G&Iq`8s6PgE$yiqX?V4#KLML+{xI9!QyuTAnhEC!q@)F#+*1WK z6jTb-?xk+h_$o`Z)IiTqFAYHBY<-by5_7%jBX&{m?0dnvZJoyKpis$JIyx-|@R&~U4Ujv6lZQnzXR zwyC0Hzwf0I9kZBmaQl3YiS}y;diU{XpQ*vp zuvNo04Yr1;h864u4KWRI4Kp;{ry-%iVNEnl)WG%7)sWJV*8G(r$*rf4;-by!c^bxQ z7^m?=V19JGR4moVZ_zXL16(3**Dy)LWGcwuT+m0|q4_KS_!a@;RE^)dQak&oX+rK4 ziH=!|H9RI$X-;2%#&J$96IVR0 zVYvpb7<9|Hrhz~;e=mEcR)GJ8d$zAyso_Ztt28{NVNYMh|06%G;Ta8YXt?Q?R?lj9 zPQyCk&kIucPG9wc@D~MN5`0;3wcr}TwSxR#C$qdF{8ho%1lJ305PV&5qhLv{H-*0? zxJmGB!FL2V3vLm7SFj}4dm6TD_)WuE4LdaK)NowG39cc(WWTRrzlH-EKG5)?#_y-7 zk2LHS^06Q#yM*j0%p?Cq!>4qJhR?X573S6Hr}j$f)xL_U`!sx>$@NrW-WM9a)bJhW zct6E(P{`MUUkM)4a5$6Ny`MV5kt5M>H5|>zONiM|eJ_$91dj>+s9|b9^^@=twa5CY zpEaE3%GO_<)No3}FB-qFpeRRwwY#7CrJp*(nO-gMD~C`rmum&_oQCrn8tG`P<97{3 z{Z%;~<#qg_;ZF^JY51GV7uPopUl-C<14|EJ*+=U{)eN!&#j zUF8;_ql}I$9i{aDIgRqtx^IMpek-f{p1)SdHM*a7xtJOyNfmTd)KObU9UYZ)RMt^L zM@=17bX29VpQ@(&wYp9$?C!5NNM6dTODbzsOXsVz)%6l(DXbU^{inaW7|N@wqrMIj zh8u*`(=nmYk1{mS(J+&G-2l}@M^hcGb+pmZOhV97o2^I^MC~zn$ zDP{fu)mBG49o=>G&~b~-H}R_5bad3wUPlMfxmCxv1N>I+6zrtqp8={1%hl0YIHT1E zs@#F98*4R??{xK*NqR~R>9M{-dgmtLa@#=FPv`qQ`4(cu(LPYeARQZYysl%g zjv+dx=$NWwsP6xXo8fjH!*~h6EILN&{>KQ$>lmeDw2m=4!a7ba&%UreJ2}w*E32kM z*O8LEyi|uz~0!suJ>UdPhB04_;NvN?#&7qg90mcJkPPD<4GN>bUdZwX_6uNmj~xF^%)({>UfSFJ&^DE3+xl@ zGT0|Ca;D4kDzE5xNyp1NUqq=^>u54at<`blU|@~lHG|YTmN-bY8>9vfQprK;RUNO< zdzAv~b<7^5-fisf!W(tGq2mJ`AL@8h$6GqK>e$9nt>c|C`I~iY;ruO||2Cr{Svg2; z9HjOzyEuQ@^?W^=x;jX`C#lS`L&x=l)pki;_g3Cck-wiwW!{f;e5~WBj_-8r(y?2| z=Q{T5_=Hnqu=-TT9!{LWYV=_BnU1{-gVjEruaHu+2dk$Bt2YNLN|Lx-sJ5cMr5&JY#e6CnRy#}7Kn zMNmG1V>*7+@t2OjX<5f{9cOg>s$-k=Qw7Ds`EPk-mVy3H&ivbt<|48-XH28x_%g{T6geI zj2F0Ka2b!FbOir$ZPamD#}(pG^&i)(Vd@f>*^P$7bf5!8vGZUmJgs2o9! zh<|{r5<%4nszp$pWVpI6f_?P^U52Zc!_|8={3Ffi;rv&Te|1?if?5$=&mt-YYD?ZJ zB4^Tq;p&D6>P65@Z6F%{zvx#u2O;uD+I&5_6GLp=pHw;81@K zSIs3aFG4GiP&Y+za|Ej*cq)RH5oAYTMqovd6G0$?ZV_~kAUA@%2s%dmf92#yP!NHN zpmhX6kx*D9BoskmM$&wQ|L>dP2wI7xtwbql6G4X(Nd)a8xJ7t-L3J`f1%_cG)U6`9 zO^}i)BUC5hodvsOo_V2o_0A`e#xH2pJf` zoBuRi(aPtB6EN3?bj%oNq@E zjbIALRRl2+dJ&8j5|1Defg{|FASHx(lMz1P?K_hp&Grf(C#km!ju)Je(Vr;fx{+#9 zMsf#Rm*Fi&syic?7Qq7%JQ%@U5!@|F_eU^2qcbCddoui9A-9e6D{x-~GbK9jtlv|! zgwGb7BS_&e(VQE>;s_p#;GqZ}j$mE{^CMW8(ODqmkqA6do-Oz&yGG>CNc8!$fh7?v zjo^t)u4NG{7yh{5R#97#N&P~iD8o}BK)~C4yh)XT2K1YZ1KFuQVIG zK7tJqyq>8;^-(H&lv=bk&}o$Kt~W)#DT24D&zkJ_oyOOgyc5CZ2)0Nnx8wctfvQoX z6vJJ2`h#%$uB>elychAm$gn+voe{h*duHXZ<8bjz>WGXIFAwYM)iuK8t357WqlRmhH1bS94BBaE7Bjg1@*fiO#PP z{3Z%#BRDTbGvhgt)M%geyGU62A6#$$%Ogp(&-$BdGF=qG+$%X31X;t2lI6b$E=iVF z?Xxbk$x@#U?XyT&w=4st4Ad}C(?DqhFi^ojMFV9Flr{K&y{vKu>U79ri>@(zCtPdz zMcmpxi^$59H$YRYUL^yS4OBBwoz_HB#Xwa9*GVqwpO;*;z(9k{LYuV=TyLO>fu;s( zvmgTv3^X)Q*T4;uvA$qER!Qkf(Akcelu{^K%s#m z1B(nSHc)J!m4Ukq+-*P^Xl=kT;2LOSpsfMJfN7wefm;j=GcephdjlN|^fu6kmJQry zpqBx@!m%SA&OiE%&gpERlfg&b6d&W^BOF}}P{`0#NVk%xfgVD7W>R;1S-CCzpXB-) z=*K(!?8-~oZ`=NV>-rmLRz7FIzu5x}5C<9Iak!0pfHr44unCK#A#V5~?e9B*J;hCeo1Q8M66 zt4ck6eLrvvWK!=q(`vGTDRlUmR#Od36ZxH))R#u9l3ddb++$$KoK|xU+-qQlfiFg@ z2U+ytmiHOx67pB7nTCH;@qPod3_j(eW*c~}x_|DSBhd#0dAE~E=SQm=W7I?Rs)2b1 z<{SR2Q5G6lz|O50xOI$rghO$RiY?6_AaB56>Z1lmj8WsqsK*Q}F|gUd76VHSEHm)B zfsFwO3}hBGUeZIjx!=Y_*-sft?24H?T(}9|*qqbUw%ShxGZ{ypIG)J{Gb|aJPX^GV)Ii9DXF13ZEI+Yha&P zI3W1BAWiKz_(P%p2>ll#`7$HtyBWXYig9b;5Lcv5fy2VT7Ca)zq;G_LD;Rzv>w5z~ z82HJ+aRbMs>&KVP9U4|YvZbNCTf&OSEjZRR>x2xjpADQeaLNE*uIPo;83Vr`WcnD_#qeCA@f$;8bj z+DR6F*ARs~6WJzmOax4SE6EjP5v=69VYQLFfQbUG|0Y5vl!?|R3QZK5{|-CiB2X?SoqmOXA@maylLVs z6J1SoGjX?x=_b0H=wV`{qOXa5^qZ!JnCNd}e^?DL zG0^nyMUeAVa^Hm2AV$M#u<5^K@2wrRqmul~rcxhAhj^Iu9CH4!rrH<2*m zm~c(7CVa2vshmP$`D4XXw}d)q>a}lLvgRohX%n95UxKleu~ISW#}^k(pb<^oVPdj0 zd?L;64BRd_i7wLAQqBMQeu{}ZS*4qDr;1uh6Q-GXT~iEqnY>HvlY30uYhtE}`%TO+ zai59p*97i2^3K-wkB;2Dc#mk7iPXo;&BtpO+0D(&t|U> zrDTlck;DVzL-tI=qn~(HT~y{UX#>LZs2FSPK@w9#%~DO zD0ts5t=_+!P2nc?mx(7VthDfsiOrnI7MfYuV&YvBCuz;ZRukJye9rM{^8T}W&%{pp zlm0g`phga#$lAg2vo-JICOIFN_|U{26Q7y*h%1uH|JX!yZ7V**`R=$Jl3iRbbhX>W zCnEn;kPkvLi7#y5E56;wm8y2mn^&`2>1yk=oC7AlF!7^_pGuAK9g z)aMWfLz$f24RRU{4@|6`cSMZPy~j9lgtOzm6>?PYI}_gv`5}`!bd3K`y%*Z$@Oio8 z970#Kf9CAwsJ@!r+6>IAnzMOTD;oL5#A%aXOvWV>XH5KR;!hKQnfT4bw1TX&oPZ|y zEoRpIyjZ54KZN{FWj#O(bXVIN{?mhho4CNm-vp~Yqmw_h{^j~F%5=r>$vJ$7cHe$L#cIUOx@vM|)bFs}cZR`jya#X?sL-7=EyLTXkn%~E<;=xKrDnfyve zAA4KqlhN#Jp`Y;n7Do2X8DL?cg~4~{3?gQ9hDzQc5?xUyXSjtC7DihbBa)GVqXgf` z^&c5MRMl^O{ok`2#{DMi79tkzw=m0sVZpSJX17|fBumsn%z`bP%D2cP&~XdNj3i;f zvEW)LTPEj@T&zChKTesFRP@Q3QzK`rg>e?9SeR;IyoCvpG)Zvu7)-SALa!W#+lA1R zcSzD?3;U}1-bm`|P7Bj4%w$JT@+*9oDBNe^ZXuLRw{VZ}doz+5LPp8+nS68pZYPja zC1ME|gvs{m@*RN}UJsOu_?6^oWRJyr#k{$yMu=peYk$nkCo&wdcrVenf7HTv7QVOe1D!7t3LAYEIA-C;|C8}2 z?tqedT!gJ&@vWV-aEc3&jgB^cv2dE}gN<4?&RF=>LTMYY@tcLS7XGsEH#5>R7XH1} zzf%4#qJC%55%s6VTRQ3wu9=2jj}e%+o)js2KkZtL58}<#VyDJ=X=uuiV?JqK)tG zZFQZEN;WFnprne8`wUf8c<-Ho6^3H8nvLo<~(n=`2` zg=7oz!Q+6C+)OIp5|D4Bz(&yakI-EG+S4s#vO_isZ4}wqV5p8GvWsnA)hdQoLX==@ z8*PNN&7`&ya*K^aqTD`^)4>Kmw{ffO9}F1nWTUff8_hS?Y)WVj%ceu(A~M@lqi`cDfVU6vKLq1i~-aBS!{B2tr> z4a0_M<6<)3w$Z6g-d(05w?tyL%_EQ6U=2y)k|p$It2+~Uu8l`c|JUB}Hj*3zt@Bo! zDrF;W^K_~hJR4($kIP6{jR`g;+B`9;+igq|hcF|JeB$P_X;W-WwXxF1lQ!%oKi)jeBj(u>EfnQ(nqa_hod>nX0;_?w4pw%g;62#+*#* zEtZ;V;~~!C=6TC)JZxj0jb^3t7u%RGqh)PYe#-J6GhSfh5s{ED6!NIxBEjL7dMuN= z#KzJLUnb;ncKuxc#g!{K#hT|mA;=QRCu9d!*?7vv$$fdV{`M>Xw9Wq!pzPeNnU;Fi z#&b5Fx3ObI9>a?^Ua+|j<}b5U=N@@QtFnlzZLG2J*!eO`&X-whW1WqjKcm;rc*Vx6 z?Bz6^G+wi@o}Nr%S`r&+!hiZVi&1L6Z-boVL(%+5@M9ah zZ0r`!q)%;pBD_SCl07ySbtqM0VV@*@ZR2wx`?<=ovtB4QVNTW;HomlRFjM+hnX(Sq zILwAyil%6U(Ie~*$-c5_(YHdFbTp&?gNn^PLezH%!*Lsba)#PCVdH0x z%%(*rZJg$UFZ`6?FM?EN>aRA=**MQ#z{XiAhz()s48IHhk*P*WF5=%dF4(waQCu5EIcZmA!SYd5 zi2kp4s9aHml?2%lRidaG#dT4?XZuCbKZBCQqIVQ;2K~D(f9(%U9h}EE=kxXpPj`IDb6?TCI5USv21GG13RimJ?H^h;D4RVf ziosEk6x(V@6hosJ7R5hHLeVH@Js%n_oY4_cjErKGL`O%V3mKD14M(A6c+b9}NQN6i zOhGFOTS!M+(IAb-qKHc=2|-GnDEP8Rl9Jh)mces-6qBOxgmYYtjbdDs+lN0OOO}NR z(wvDRVMfaDV5duTauiddm>R{MQOu5FP88FkxGRe3QQRZB?iMU5j@Is#=!_`ti~euL z;IN#@TFEG)OV5`G^6uWn3@#|v`MDbu0Ped`?R&xcH3O*$Gu;4tw`GN}ssr-nL zg;6}3kt`CjSnx5yC2XdxsJu*~j|(mrTp>71QmL>~qEAM#N(d$W>gPQz9(YFZ*(jci z;`u0EV9lfWL|R8jy%@zyoXAh)y&T0(A*-WU6UEvn)3n zw}eVG-xuKrQG6(b!jGc(IKy{IV=4SJianf|QJjq8GZB6n#X%u^qu3{e&Hr4;e!&BR zU$Auhf9w2LQT!l6f6bSHaX5;vg&Yz5M(|s~qk`1@E{gAkcgZSZl%*UKBR_I&6mnef zgdkJxZ6T_)c)945b{1(Mo;WupbEuW9#_bC2|;!h6Om_Hr8o_I0C?}+R46P^URuCkqD5O#hm1C$9!|J)YRb#kwTc~;r*TqmRh6lG6P>tb_ ziUl=9`Oi)HjMmDOa=nn+G1L(*iw)R*+Qrsh#@zIJc+gw%oi*W3<^>|6hoo#BEjMqTE)O`LNQ6j zFz~|=Lu(;zVrVPmQ(IAZOAPH}=n%uLF+^f8Vz@1ajxh|1VQ>tcV(1)0pBVba&?Sbh zG4zO`XAI*HXO*u~n%GT>>&`BYUSbF>E`P#V{gLriixF}SRW@I(w>9?9b6FwgDGm=s|;hE&Y| z@svNA5j_#|t8i2pFZ}ixCJC7!HJlg&KM%)LhC4()MR0P={~AJx{NNG)@H{Psd!)U0 zi2{@E7BW4?W1D|OzgMC&1o`CovQ=3#W4J$tSuxCx`3IQiW0)hUD=0C48Ak7=2vGa={fbJRxLdCiTe} zRtbMf@ac^FnHZiG{#-`FHRpv4e=+v|&upt>*bu|(F|3i+trety)(LqfhF3F^*MzK( zVeWo^pabHVOLko*hbhd304P;yYnSAt(=hYoWB4lev! z@Q5IzpAQJGoSOSr+u+d{zKijJkl^=%KMDRIc#Kv3u;@oYmUWy1RruxBp)U>>{2T+Z z!6Xz#-gKS8BX--|i8wBe~(uTG94J1mP zhC&*}(KsVv-lsMPo5j&Qjsur{JH#8~Xc5Ovaoik7->AxtBd1-E@|L1Qf0jgZB$Yfb zj{G=&U0K*!Bn5G_ibKT_j3X3BVH`zbf%-I3ESzS^IVxJm(I$=#aoie5+c?^Zh4!Lz zONo8S#Zp)wW+AyPj((kk9Yu$hV^P&fBqZyH6n3ExhZO#DKGdCVjAL*dL*ihxXB^?m zq29uK2{Ovihovxk9R1@M5XV4KqrA<5ASEP&1Q{hC8pp6Wj5y3VhR3n|_S_M1j1&d( zQ6j9sGj;&lG;usgl_&Aou@pv2);+Po6oH!nc4&t40+#6LScg1mc9Mj`i(Jpwe;5~6X9aSAJ2Zu21C2xqj5YO$GkY^XC#jZSs=(ogMGbF zIK4;CybO!ucr1>~dzKp6rql);9$eHx4kmurfrJ6rOUx?$yI9`h5Ws$!sxH^t?Le>bb z6{K?2n0h6{XEq4E76*}%+?Zko-e?zmJ&uiWki5ZFT{`Z~INlP;ra0aa@^*(r+IKGc#M;trj*b~QRV(|SqK8)id;U5V0jwyzZIRSqP z?P8O&LnI8l2`qR%-I4h6rA_M6sMYb)J5fz5E|WlqQ@$x0CtjOCxdh55z#^#GF0LwMvM>6u zh&q)MsFFa91ixkP=c+1}t0jEp>k{006iM|2R~W?>vACKE)JoubNn(k$g)nJiT(R66 z5~!De`YX3t0`(L4?7o6^`|=x$@dkno6KEu)!rok#*hG}6(=_4lza-5QxG}+xeipWn zq?QTXB;@72s00cU2qv&3fu#wA5-3bSPau*&Q3AyY z3`}590p@a36$LuWN}oZ&TR>F6y+X* zodmlk&{;?q!3QrEav`E}w*wOqVS0Y|oEgES$695F(L2PE3{YhUM~1RhS{ zkp$Mn)jW~2lsbok^F^6D3)nT63Q4H2Fo8!CSd_qG(LX%5;IRaVOd@jcTb97%3A~lS zrUW>umnZNPr%wVaIMVLReIkLCZ1SOkCllCLuXsz_AaRvQNS;aH*#y=l@QNrum%vL2 zyv#9NCHTC|h!+xgQKFP^g3ut37ONBR>&7D51=sSpF8d(&^j8z$PR;PTkk=AeFJwc4 zYqH|b#iVyO2RE|IHV5Ajd{gkQA%$;~aKa|Amje!vYCkcF-;8WJY6LD33 zU+x}%UGmAk1U^sTOai}hb|-KkffEV*oWK_ee3`(}1ink)pkzG6j$mqBeMMXoWM1Oe z!jFix>09$D`6hvHMR?n=B1*nb;0KOgu8R9|kBOZh1@9i_SByd;!|{ZFQeyNZhv=}P zp&#)Zf9e#+>el>U5;!ec8YUF$%px{i4*r(F?+N^oz*)NeT=1N~O7I0Z>bww2sPkt6 z|0M7)M>|iR3H&XD{DNd5xtPGXL%~aeB>xHFtS=!~6Z{({Zgp^*gHjGkJN&B%YCC{~ zG7c&_sN|rmgKHfB{7~NUOiJ^iBS1&BC?4XK+8V+hYsOsQ42h|<$ zB*Ua?4v1z#5h>>hjdBJ~v|5hel_bPE4(d9{cTnKq1_$*VGW*Lki0!6YuH`LKVCkKWD(?MqkT^tOe4lC?n_m09|4th(LZVtK&VXhty zdODz4jwMF9NAz*f*FirA>uUIykn|@nd;2>W;D8q<18H1l1XmSCIn9SS80ugc$AIjf z!`au*6pU~%QhJkol;f`eJf~?6MzbsjVF%o%OAZ4hTqSe|5qjWE?v^Q~8F*c3v2z{F zaqxh{ms26;;0_0q9mE|ZIEoyMci=ewB}`iEyAF~LN|ufk?K}P|!6k*h^&E^9hjW}T zI>Et2$3I%|kbJx2&p00QCOIgXuq9`|DGsJOxW~c0;&!eNcRK!AZW_(fb;m+?JD4tk z7YID%QbOceWrpK#g7-Uo+p~XAnd$h47RoDrTr^9PW((3S-0vQAFxT-f)gN{6kb{RE zJmO%X<8M`TFNfkh2lE|#lkm^v3mo3CRphKNQ|WCExkU~ZJ9x~&5@`rKtEJpqSnBx4 zFa|Dh%N?w6peI2;KjC1dgH0~pcJU;ALa(}*?BXfblhe&bEf>!?c-FzU4vso_&cX8z z-esK~yx`zP2d_KW=-?#>FFSbE!E2lXM}n(4=II|9W}XpT$F6t4%5)u4NaQ-h<%msQ z@A%hrJeX~8{9_omGb+<{Z?NMWYc8eU~jUBLzFxC+QAXWzdWZ-a(*FCDFMg780XIZ4VSe`MI1BVIr!eeWd~Or{6J?q z_|3stu9;hcKRP(!;AaOvaptxS9+#=dDsg!5zll>$4L zSJrF=PaWMI#WOswvnsf#=%Nz!pDAFpvdd@e{gs@190xoH2^Wy6F0OM?%|&(BzwyPP zRm1h~X;6oyb3wk|MQs<|UG#8K$3tFbWz_$0~bwPG?qzFfoxHgo-Lipcm5$<4^R}Z%=qoPB zZCp-R)y_p**I(@!SS#w#Zyj9R>Y}rYE-r5nsoPw1WCN!abC7>_xv-P#U%b%UUv3U| zb^U`eJG7hYZ;{lY0;4@$^l~xU#TXa8UG#A=%*AjQeO>f(F^DC)=bRZT6Ph05qDv5sGJU3E^HU33trbV`1{?l5QjmHA45?Wi?$ctHmoSYyj6-F7q0k? z^OqUfO`In0eO#1w;kg*+V!R91WGsi}U%Bi@)|rlCnBZcfi`$8D#gRYB#p_jz4>*eR zkf%ioce4GxrMHdXIY&Ln>KzYOcKwB&UB)Re&&7Nfi(NeCVu6cC z*g;$TOX-C!9(DcwVv&pr5?*3+9&!9Ib%~3mE|$Ak;bIxb{Dnf!<;P`CagcL$;(o_@ z^aMM%b8w~W?^86(%X8XU#Vx?a(_H*rtdmjntc&MdyzFANi|1Xuzy>DNOPrXl;(6dj zX#!ipam6}x`?!dU%o?_r)vgw#x4F2H5MOceD)Tyi>t2(FbeEQHaQ(fT;dLP!rH^b^ zz2*9+S>Ds&ZpA&Cx!&Ofp|6q{p2QXx?{X5!UbfZ6HW!y&TygQ9i|sCsxcJ7!4i`IJ zeCA@Wi}zjsSoIOR!^H=#f9T?@{E(eEtcYY67cLi{xcF4mIIg%_a{O>e?BOD|&!6?I zEu;IWz$Uvm=wiQ%12X(*?F(rU=R0RBmFb7CTpSW>hh<*h>niRe^gpZdHD?*`iVp~W z>*A=3(=N`q_|C=mE>3VIaq)wTV=jK=Y!z>FGvX0~YaO$23LJO+rJjL(eUj6va)<|j zUtFB>`%dw+#=V|XfVqBk@tcbaF8*=(LPeZ&@drn&i}S93Yqb6F;O``D{i(|Fz?%Oh z&H0;s{ZY{#Bgplc$Xkp5y12;kCPU>vP6XZnJd?}w410&&&6&kB%vBdzNi;~JVG^a1 zD4oQ0NmNS$Nt8+A+9b*){Y8@cWs`niTqDToL;K~EsE|aZBq}FSG3j55aq?WBK!!%4^8kShj_ za6%DpNczh-v+(BnHu2kd!n^qHz-0N#rE`S=Jb#u~Rd{{~PoM#M<;g%xd%ni_N60MR@N#rGwpG092MM)GS{na~|L`Vp4 z60#b?OXOAU`Ay^`pi zM872ZC($PfUI?(8`m!tk$|YeEzVr_X=Fq%Y6NIVHQ`M)0@ z6G=Gqsyy{q@>EY!qA9_25?&HxlmB}rr{r;+@nVF(JWfbrqVU@@l1WM2A$)R1GDXPL zBwC*Jf2=egD7cGHFedSO66AL$F+GWUlDIdCcRvWdzbb!85;Kw@xlfQ}rjYxSn3a*t zPGXMm2Qrceh0GOvD2a!K%*&+CPhvraKa#{k;g7OWLKX`?CfKxQ9s>*I<6BGFn}hR~ zCGohBV5<;rS$9$nY11yp+VtLRM$w zG_qDQt`mGk@KwRr1gWrI2p<60n8Y933y?yY6y8YUO?o?tO-UT!1W)2^c2MPlZArYB z#LWAP-Vx=^f?MctAE{XY^$zfa-^PQCKQ49A2}cwBTyPKx9NS5%Qufx=UQ z+Jz$WGs4fZ2||8N;x{4d4*6viuMb116iN%H0;6S9xF&^4X;e<*+7!yA@MQ`IQz)N8g_QpQ z(&s5uq(TZGr0`)1l||?XR!O013fHAjErs?Xsh%mNZ3;C~sF^~o6s}KU;?msW6l$kX zCxx680x8r@;f53%r_h80tZJxU3iX97SyGVyPi_O@4F#FnD8>C(kuWqB;f;dLQfMxO z_LW~`twP#_l~4uAYnMyGDNfS6dwFHHz9a>TY;NGQktJi;iVK_ zP9dFwm%`W-#-%VPg$Gg?pTdL`CUq~EMSrGndkWK1xQmh$?qGdV_&lj5r!Xaj*OH3- zuO7uq1S$MIsqXX#p}MYT@!cs*7oGc4xF>~sQ=lg0Gg7!Og_#l!rPM!bgM9?kDOFP82B#|uPKy6pFtY(m@)zgan@f4P)@Kg#O)0!1(s?=oXreUet&Q`nlqwiH@cF4{l6^m`&N(K(q` zJ5t!0LMczZFWAgeT|MES3SXztcU#DRxcc_oZ&PUZeEtuDM+F)Ej+03EptlRYSygZ>g&$M+NhBvS zI>&`v{I{6;Kc{dqg;Oc~lEP^=Fzwr9IFrJKjQ+1F{FdQog`5*SFZjFQAA)}h{w4Ug z)SRaNk?6mIj9yIPKjD`$lFLG_2woM;N`u*{Tsl)92q}|B*^J~G?gGNgWhCX(sF2|m zh0sV9A;Z!bo<`L)u1lj@8r9S2oJN;4cGYTCBaK>VT%ShGwEq+$B|M@KYo~E*8n;RI zIxKffsBRiJq){)8`e`&sqe%3brJ<0PX*3ejSg=VZwP_m7gg4JfZWPiYjhlqroRRZL zlbzu?X#_GnH;p{u`58$;8bRTqjHFNqhf1-KRvEcUqjiS2Nu#asb{WYnLfQ*cP8m;@c!R>OB4m5XyNN@X)Llpq!JdM>1be5^M+kNL3h5`NT#u3C!W}eR2u0tHc!EpDe%%5%buN##*;BFjqw~R<4}7X zCZsWuz8#A;V{v;LlhXLd!@nNxNMkZ}Jk<6uC5@?RRP<22ZuXu0`_eZp?@ePy8q-+% z(Ux}!-c9?5TTU0eCyl3?WWUJwoqkh%Um7#hIGo1UY22U2tTdiWEaSOi~|D zV|f}&(p+hg92}wrhGmje+&G(jMH(wPU_|nSAX8Vd=4rGqo&8K2ZsY8y)5t$tYDDR5 z@-IF0Y#Ke0&D1NyLNBE8Vj8>C_=Me&#>;7JOXIyXR;RHhjg4u%k;d9I)}^sNjSXqM z!me+W{aPAdep>u0jh}6K=xoauP8DlmzizLKa_M4vhNx?@Hyn*U#Q6yuUe1 zijr%GhG^NiTAKJVN24gLub<5*?R=WX-Zb{5u}6%5Cb;oxDJC5r75Y4lgJ}#nR7~al zlJP(qUkIV(%QVW3RU}`fQPQGATq|_H&PUStCXG{R{2~UwP2V4NJn-ymE<7pI>&LX+oDEoxy|IA)4lYLUM^lhAdI*l`F{F}x_N&PjAb7`DU zgI)idNY17~kI_P4tlGb~`1dsaNaN2m{^IyggA$hYcN)YCVw0rH(PHYeIV|YEG%iV( zUE}%vaygAGk9#YwWZHg})})I&eciIOhccc&!r_6@MUAqFjF$Bf{oc2Et%q`=P~PJ= z2SXJ+bRFw=P4kfq=sNk!CHb7#)YU*M~vSi zSl7c19_o3hFVS%x8hB{vp$iN3(8xn$4}~6zJT&pp)I&=T*&dpCXzt;MROn{Ob)$z0 zjj~&K*eyPMVtD8#54V)bu6DF|XX$K4b36n*Ch%4 zG;^$~WrTtrLLNvMrW>JR53M}3qd^bK!^G0rtv$5y@Z?xEdsN687UBfl)Hu7X$A2e< zHjP#7J#_GJn}?1bZuM|rtfJ1@vFeVIp`B+-b@Jd24|VqV!kJK|aq8xAibQLY-OWRH z4`C0QhaMh!dKltisE1yxo`-%O`m?jfDNZqMoa*DDFEz(0mPoAIID3GHfgT2Ve7k0d z(ZL?>{j``9bLr_~`eEugwW@LUFb^X`=Oyx9!7iM3-ewZr|v&l zJjTPp!!1v2EY>|lJS03gO!Z)TusqlvJ{_knr9w^0WH&97#n!R@Q4cW>^aE?ijB$_u za0#(8u7{+Du^w0u*S!-g(LL!hVo}i&GRr{OfB%RRLCQOEODWSM>Bkpki{Mz z%Se_8$sMn#xlH)u9+qcPS9o|L!&eH)t6KUg4^Puk9$u8${fviaIesLS-Sm7$pGz_4 zIL$J=1R~(Zf zIppE6hwr(7Nc3wD-*Do1d{qm&pKH0&4iS%fIEO4+`;N;|1Ak@alFQxvm}EKa;f#kL zGj0D#gvULc5JKgjJ)9JNDkJ%Yb4Tj-=rDif;U>j_^qa?B59d6b_wc8OzeM?W4}W<0 zc}S?Q43Z0{{56?A;UN4wW9@>FndP%Cdic-7O=B@>yt>4BI$kkc5ptQcMxs|eWQ|3s zu_!$j6~?0CSYRw39IvjCTxG^$#dyU~RtQf@%yq3Kl^culLe`B}6jmCG%47c@Q{MqC zMe%(7;DQlUl&peCP#(j3f;>tEQHd&uhysd%q?p~^Njoz;J4?+LDbM@kwVM<{FH>gbG1gN}0 z0u2+m-;4*Mh8q*;ZAv4~+LR)t1hkE=6V*lyw4l z%@b&$;I;&AS3u?+34C2SpP*%e7gkJ6U{V5Kwa#yyz+DO4t+-7BcPb$N$sbCzO`sj` zhiPgezOB6{f%_8Zm_U22-mA1#vSEh=c$a%1FYkW(b4I}vN*_?#Noi-LU6ekk^dY5P zl|G!nBMCg3z+(yYQcgEcEmPP-ad*X3OAbrV;_Bnt$|{?BC-7tfPbq#u>C;M|QTnXX z=af?T`2+$}2v`!zOe#$&HI-UQKTR}r6G$h}FM<9EcnSCkLEHy|otlSgb(qq5+G}J2qY@aKz&Mqm zp3!VoVPf_=X9fovuf52ekib^$J2`q9fo^B& zmb@a5)tL$2U|@Cv3!CPXNy;)ut4Ht8|Nh&$^SRauEKcCX1Xx|bIHZ`;N@wb>>X5%A zfu)RU+Ie3rzxT<8Z<(?zf#nGhe0X0z>BYV?TDWv3+u1jD&_ecV7Uz5+W zA%V>aY|-k*1U4zCFuRCNTNUptmfV)WcEvlC@^S2(hFx0y*OWcQl6w<4bzvS`4CGEQ!djl`@WyRQRNWx&X$^wY4y0$i+aT}A0_Zb z0$(cU;{-lQ;8XVEBTtF=a&R(%&l31Nf##N^KQ5|uu;`xiaEg0Y<-cQgdZ^*)1isNK zyL`>rT@{=CZ31VQk*>;TwW}p(x!r2S`1?eB1Lkl>CGvmLT=7=|e=GP|=`RWVs(`8E zw*-DK#(yaIQz^64KMG1Ffh7J_{GU?x%1fd|GR{jZ<18taMCl|hOyZ&>&eL*!5*H-# zq7~o9uRcHT9R06y{>4d@Nupd5A6vqXWs|r}3k5DoVxuLOCh@u@1Z*XfVwWdzMH1z8 zI93@66|_4+t3*{Rp(O1FEN!*e|(csYqzl4zMkE6zQMu}QQ}qD>OdCh=SncP4RH5|1SD zXcBiP(Kd+=N!*vjx3;uPqJ0u8J}x4@M>+r6!s@-s=p_ob??Nj%IU9O>Z*DLIcNk#eM05|8UB-ID08fbu<(=viz7s}y@e zg`Y~Iw*qpWOroD71mhfeI*DhLPfX79NxYCmAG$G#L=s7k>qXO4n(E3hS7y1AR?shr{z(i@ zVn`ALl33*m%OJI3pwiv0yz9zWt}q6MCNVOJOVctei9cPTs^O||gilNiHk;Y_C`F*%7T>P!y7GF3x`KA)b%47FjV(pgC~ z&@SxNCM|Q4n484BB<8F9BJNXqFD;DNg-Hxd%L3&SFm$PQu~wHTot%z2%eiVvY)@i` zGFK+CDT&Q=LK3T$vnGjO)3PCnwMnc?VtHD2q-DK=!)f_EEgP9GyjazhO1ChowIexO z6&T8AM{;&1vAei+mntE1PZE32F_YM@;GBj7NxYNPZ(*UQOb)BrZ;&ObV|j z`N)ZrNqm;X!6XhP@m><|C-G(yhnc?C7rm>h-ctIG(j!XWR!aX@`lBRAC#5jKQSJ3n z5+5XSEQ#aHLOSR<13u(V^yGw63V)o$Co1r%QgQ}(Lix{=_=16v#9v8#nZ&6ieoW#g z9r3FqPABoTVmj>`E_V`VllYE#PnlG5&L>kn`96ssxGt)buA}CqiYfE63je0`7tYs{ zUz7OUi>LED&r5Yue`xEkp8TD}KTPQkl4I4-Aeq)~r^6dI>+a|$JbSihv=eZhI%RBQwBEyb;rDIdg+ZI;4q zDYQtTrRuz0_1~eG#x&O|#TXl{QfQq*`xNd?p-l>Rsy*$L-j%}LDYR8g&2@u#T$Wn{ z=@7_0DLfvCN1WpCwc>#kI;GGth0!W@e+o+i*`dZ938b?sVc#w(P!BI{RL*MG6dq<@ z3!N-HlER}YOgAyZ#A7LROX0T^eovu$3O!O-lfv2*dZy4T#fL`>w*IHp1g*+Q(~OwPbW(6ruvCey zoX(ke?rFNz7GE(P(mNwT3Yir8rO-cxFokRieN;Z8g({XyVXgvp-=v_g3cQw)0SucI zhG=zA3WIexiqX9sg{#ba0~*gVJcSV{yqLm*6h@{nDuu}@Orfh&7?Z;I6egr_A|qo{ z7^f5YDI=UtsZc70GBJfoR1!)Q%Jrc%3uFHMp-fF-S_-pLm`$IjK+gD3W-6GWlzm?e zWn(CFIE57Er7)kHD3n)2p@koXarr)s2cpdjQ&^-ES&_nGE`18i7^o?5tfeVX3H4Kq zl=7rx640uZDXdCiwMtTe%=5Fdj@vVZk5c$Jg$?YU!Ye7fn!=_OHm9&Hh3zR+$;PV4 z*^*|A)|O)#?sf?<-SOsh~x~nOeEhiD=Ik4%^L|h zKcw(u3csZAYYIOp^Jh9gk`c5al2;=6gffv_kdv!(G58~eKbap)v^DWp3V)|i%|vyR zUo*$Q%*-Y(Gx1*vc_vDkC~cyIiIOJRm-n$S<3U-P<)nTt2IrYL-^9fx%9yyo#Dyj< zGBF`1_iO7@If-(zQ2UlO!7iI}a)}DCFY)VYRXGz^m?&@J)0|wcl#XKG3MML)Jo2a9PQTcOyVtbff>zc?nQO`u!CpLqcsgO+s1!`Uc6Ajg#LK8Qb7}ZBu zC_Jx^Y*xt|O}wh0u?aEJj8iailXkhqL=y!!n>e8|O-=mJN2>IdTXm+T`bt6Hc&4|T zxWhy%6Rk}&?<>tsbm=QC6rXcNOO>Z>G_s9}yC~U5?lj|T_p^QDiS+F&llw|L6Ze>~ zO*kgno4D6RPZPaNbfCLTJZ$0-6CF*SU!jXS@BtG``bsAgolR`(8?Q186~@Ju2TeSr z0>oX5mBqM=g)?bF2pq;}_4CCtekA?X(*RH>eP+?X_(^36n3#oRD z33A3Nhs<#b#&eGpb0(UYq=Q43X9OR1!$TC~rG4U?RUarf4wR2gd}89HiO)>587QA} ziw%_2Kq00iyL@hf^a~S%2MW!YK2Vkql&?&jHgTSX^DTUB;u{lxGDVyC*2EbTznJ*d z#97@?KbZJYC;lC+8Ytf@r4!y6C_gci50sxx5T70>mkp9@2gz?5u{dIB za&#M>93&T5xX{8?7Ou8%k%fybTw$TSg)$b(TDZi*r7HaEAUW5U9WS%uO;^r}w?Cb8 zxrOrv$Lr1*sG!1?EmW~k(TX=zB{hSVoQsXB7Ou47IAq^*Hc+M-RavNMp_YYfXv|=_ z)OM*B5f>? z-f3aGRu2u4wieo3xK}0HSs>>gr6-3-2Md1>k^8htaOqI#sF*VMTc|Nq2s+by7WP=! zYvDl)4_O#$VVH%kG{Ayo!RGxx{XC=KQ45dJ=jr%psGEiE7M`~7jD;TB`nZKBEcCR{ zi=G_%ztj7+L#4MBpBFtzRYRrM(D)o?*id;&nKOsVvkIQ)>RWhDF$Go(jWcS(0@G2- zic?UMp{1E;_fRn{FnEp(6~}_hHMP)JJEoNu4inFUZy~Udu@DvO3>B0ZCfQ=n*J@0T zu{SKX>W*R3&%$7xV1Ek(EDW?T$cituJi{U7VbM7-#KQf<;xiu}zYM357Uo!(Yhk2? zQ5Gh0SuKoKJ>!&)p=X8(%UA_;;CST|Oi+7jB^IU(lZ86UB8$Ju7@N&;IgzCn zmRVS(O{^~Gh+KD_bF(>bX|LUy=}87{n0Rz4ZI&aYT*M5$1EJ@4vl2~@VJS$Y9CrS!HH{?94aBD zo=>nT&v>jg^>=AOljSE!Cg*Gm-aj_jcpV3&xj%P<)*2eG=@mwyk<6Bu4J|>j2ak-6q zY_zv=g^ltyZnV+JMgC z;oI@87ekZ}{B zV+7q5${-tq8K2CJHij^0N5q?A$S4`AnA?rj;WlQC5*BWgkqjFfywVYmW{B$J2CL(2 zjJI*vjj#0+Y)oWWx+riliDuXs>0p$DDK@5Z^&M1m_;Y-iZsVwp4{Xe^G1JBl8#_6W zjoCIf*w|=ej*YoCR@hi+W1fxqHWt}f%m}oxK)rEblq_T<1o62Lui$G(#m9p@ELvh? znT@lfWGQzyNS;HMMT6liNQwvske6-#M z&lrj6=S?;?Gq%^q&ud#4w7zU*)kYib%cGKIJQ~tiWyfBlWtWZJHeO@A(SQ-cTh=`` z_ENycemW|YSI*gQ<7GQOT;dQf>4I`No>?)@U$x^SthDNX!^S}yZ`nA)h|+*LWaCZM zaM%XzWUt|)g;Dgjjdyg*zo+~3U7FoTW{r*&a_=+d-{-_f$KaTa<2L@b@sEuUZJe<2 zwT*9Vd}QNe8z*gi#^gf}@WI*s-;Vy2W{j4PM$6|q#FsWsG21BSmS-N|{{70vccZ1m znE0&bwB{CqZ*82h@so|8xhNFi#?%x?c_uDyz3(-95d5gxxS=@cFE)PV_8cRBFsY7_ z-)#J@)8RzeF@H>aZ}6v$zckTN51F0D$iFuJvvH}z4*`+qpoD`99bDv~q!SNa%0X!- z&UkR*!yM*^^Bg=eM$UI|ffHv@Dq-=*#FUoPq>G(6b(E#TAyUQxa|OXA%4DviKsg7O zJGjz`bITPD$~&m!pt4r!=L!lcI^gjL^-zYiigvH+prRgt4A)>t&Z5`BfP|HD)gT@YOJE-HJfF?PZK1Qx{_#ry#Ik?_IT^*FFINZuH z@t_9hTWr!f8}^Km8yqxH=8X<`A$w;`oZ=cf_)@!2tdRp|OByT=ZlcW&Zg+6A8sEf0 zQwO(bcjiV;fuE8vE8gnhk1_E{R5J%<#>zEghk z9CT92ha7ZPYr8mjP(f;Je0qFtAqI?%^>%ikS{hE9V^jXRNr&_Z;{N(oX!idf7M$R7vO{>mZ|s(U=Fe-=Y4mq6z`-ys;vgC5#77?^#>o%|gB%QIu#Jmn6sQvNhdP)&PS%eT z(%}w9XfJl;@zH1pV;r1v@RftH4#qin!@)rZ;~h+Ju-L&82NNAka^i=|7adGy@^>)9 z!Au8J=~70l1D<%W@L`{iy)>JT&z#yU4(eczgSk2d9*?kl34yk&jeL6`CItuL)Td6q(L zYCS<%SUq3)ymcw#;sO^JYV{%)7c1zhGS5$tXo8e=F@A!u%%32axhUu2Di>F~xZK4R zF8-Y$l~tg;i}xo;MHdxZtm7y{Wd8)I9!Ior<6{&0p|z@Q=i(k0ZQS@y=1v!Pxwu<#TkTF&l;jN_pYGecxYtETI?a;~ z>@tvN3vo8%Z7nwo0gnXPL@#x6(b+{0m!}8l;^ILa=uuVpkc&qYbanBXn)EP@58{q| z#Ae}4A9K;oMRylW!mP6J)R8;1my0J|JjL+tFOR!;Le=)xDlZLWKJDTe7Z!tUl056; zIUOkF;(0nYl!S|<2Gt8LKAaez%y3?OZe?MRn=1UHnq;d6M=2k9_)P7&@Lg*xk#jNBi(p z@SfkrWR6JZOp;(yoYPpCZAkfyKW36l;S!IFeKp<13^z{WbJdMAUCeSZTQRdV_0QoP zRRdEN^FJl$xmd591uho4Sm9!&i$yLLyYWX7%Uvwt4(caMT`XgSPm&LHn$$+)IbUA# zD7MPQYHm!8-ZPVAjc&%PCd*nEtd^K8q>Q@tE*eaZ!6p}*xw%~IcCkf!Z66|AxjVFV zn~Uu(c4&HGpzdU_O^%n9_}R&_$HiU>42ffSpNsu2UUBiNrh)^yFW8iwEHAluS((fs zl;oh~zos1tURN-3vK(aaFf8@;U=H!7b|H9+iD*W_5v6atc*n)Nia%A#ruUeUTpZN^ z`@qEs7azGe=HfWxP?=04+?$LvzEbkBa#;O@9?&x`;yIJ$q-y)j#pf=*aPg&zedFSk zW}eep-8z|Xk;Mlld#g8sZr*WQEe{%7M z%eT((GeiB}{9oKy=2xY^aoow$@NCiVOj&1(h}rb_WciC~E5~on|E*&GFb})<&yBwn znU@CA@q6{eCDJjcq*8V#E|tdK*7SOucnk1 zvSW>O{7p~drxaY9M$I&8DXyJHF9mg!QtY}ku1}+G8u@9|OQTI1ccx*aQ9q5F)3_y# zf;0-#Xp}}cMQ%v*MLRT1<3=65`V^r7H%^fjQ>610d1i{xu%a{?r!jhph<3Rt4K}e# zv3XOZNg7SlXr0ElQ{>h(nx(HjQ>^+)wvTm3z`?pGL=GYtQMtH;oQy+^1^urV7hB`?;nMq|r$` zc24s}#CTjP;ddOan<~wwO4l?VPNRDo!Blxf{m`vg^P_1{`D02uOqHjm#@?W9J<=F4 zReGvU+WENp{0XJKl|HGIPUAv6oyIe1Je$UI>G-wn@*bW~t_(@}C z8mTnQG_q+#X;^94Y525?0g#59#>o=-p3-z0KbOd7wM6Osie>W%_Ls@aq;b4VjQ>y? zsw6qNH2S15GL2Db^i88*n(v8WP#XPJfbt8=m{>d(Tj!O^XGfMPI*V!A zG*u~QF+GhVH|MiZY*rex(^#3tDsI~}=BBYEjiqVKOJjZ-3pfPhs?`4!zDRzl*bj?} z$D;ileX&;Qhh=FVN5|%!vucHoe$EmySEsQ?CD#>OvQ`20Q=S6rbu8jdX>3m8Q?{nD zC5^4rnZ{dbY)fN%8vD}NpT>?fb~2x&!L`_x#%>+!OsRa9J!z1ZDw}s{)BL7QVh)$` zKpHQlaWIWTbZi>0Xn9>FUrl4$EwR{ZS|wOHRY>2^D(z?Mo2q}%E%|$<$}cK>B#onK ze2~W5X`HX4ypzVeT=!e@-z(PhzJhnA$}vWcV%kj2AExo=RQV{46Iwl`!+o4anQ2mO zntYN5=?&B5votNzfR*D z1>Y*I(j=cu77q6v6T&oM`JOve0iE-siV^&h=1aNwFO578zcJ4=$^U~!YU}S>eR`Vw zrGPsBRq(gcf6^d_@}#t+gcsXW(u=pxdrk6#Y0_T#r9GVI;UW(gdpO_21zv3bg&x>S z^Uj%ZOWC}U)1-`tvL1*p^KglWOFd8zWhlu}C_r4!!{yqS^SVNXYj=oSD|o2rp^}Hn z9@=@h$3qnlRVm=1i5Gus=}Hf^Jk<7Zm4~Z6ESx4I&lHUw(Xg6_>K+JKuJKUA!?jx7 zJWXmUU|%-X@i6;L(akjJOcB9#9$ud&*DJHG(tHo~JQyD8YxPE@1xhJj=;4N9+(1D? zwTewFjg(X5p|Ju{dXv(pQ$m3g(}XrO^>C~9YN@oDhub{dPKTc#PmnXZL;2LqsWtb| zLczIdw(`(g6}C~Cwub+R0bsyOlX9&TC_U%T(~aIfOv_mUkvJpOx0@;iFC z-@^kQI(Zo9VZ4XV9=dpVj_KFKgB~8Dq=zRwboKDChaMh!dPsd*_YtL!d3e+V|4Nc& zaMZAyhwdKcL=DeQlMAOy?dj5sQ=2Z7?=oHf+gtSAuXTHS$XinIjK>$J(Xvy)lU|(d zpYrgu0^*}3;@>HHTysQZG4gonUG#zWG>%n#~X9&C>8fs)j0@@FF6E_!Bj z5vz`eC#TC*D~ntP%mw-BV%t0qeldP*d&AH}*25SNV?9J_&zR{l=F_@44}CoJWstXP zSZ787&Fkl(zZYLq1}Gh-bfD5fN(XxwqF|^}N=DOVxZ)AToRJR|?F?Zvk=(>%O1UA%wmPX49tbPsKR zh{1{Ja)@7XDv`hO_Y!kF%=IwO!+donzY<9Q@XF3Yz;g0b(L#oehm{^yd06aWiHGGL zR&Xno{-4ZJ56isx%TP3|`R#=-eP5S;c<^u$m8|x#hHmt*)x%m3>pW~=_3He)cNVSp zu=MAWO@FD|yJQ}#OWNjdr1G};n>=h*@WXUr^=PJH>Ua^CmB#Gwu#>Sj9i66QmxtZl z^`lUE6!v)7%Z=X`?fYV%hy5Nd%;KUf4siOMU4Z!kUiR>chj)Fv=i^lmuQ7gnymC7K zbq{ZN_|d~p9u9gq(XE$G5kswnssk8S;*Y znlt2<8S*}(%fkr|A2C#Bh&-78frn!rj(hmf!^<<`|A`x{lwj@*Y5q*TW3+|)R#+P3FpLDDepHj|O9{3N=tbXI+TMuVEoTYQ_FR0P2 zfVAdJAw60cm+w4SHxzvD;Rg?Y78bBHn<+ng_{Bq0AGiAWmC2v_eO&M3cMpFs{rb4f z$Dbbl;$_H3X&-+x!!zuCl<@H{_x?=zk6}DhUYIFcS{AT+!`;R_WtQ{-KNi?FQ{I~? z1n2oU-^WEhF7|POkMC#7g+3@u0rn*zE#srCwqD}n!dX&N3w3e`3Y7D4xsR$ouJmz* zkMce$tA+|bD*6~cODg$jI!ijulGLnNzHN)f?6`22RPiyXLSyo;@^Q6~Ykbu3QO(D$ zS^TO3sGl}ao`9xa>!YTRDA18)W`ig&;u&pNoi-LbVwH;4=R30X;-BWD}6+1xgd{XkNN24 zqq~nDKA!S1Wm4URRy$Jz3+!ol<>W7Wq9AH6OyhWZ%BrWytnwytOlywd1d$+)0` zK_ySkk&!-VN&h)A#>ZG6FZx*EW1NriK4$os>0^Q)TQZU1?PJy)*)&Hc(}zB$bLpS2 zKb50YFj%JPe2>f#;)c}?HkEp&K80ubnB!xvk8kJ5Y;M@Oa^+n4rjqenJDEpkR*wyy z@1spQgBC9IvB<|mml`X%d_I==xO1*7_py}aGGm#KhI9E%_CjLLixXeL73@*K!V#&5 zepu~ejgPfH*7?}uW3SI|=wO47o!p5&Hu~7)!=EeLe7tn2v6=ghdx7$`ji+xdA75&~ulMqfbH6A)q4XqE z#60=P$HzW`PaCs*!Yx^h@0us|zBWGN?wBW^E3N%R{ZrcU3}eQ}S3XYr_?po>PrjwQ zuBiWw;tm}P$SGI7{^)t~9W$+uGxMZdm-;{WSU6Aq^Ra!N{OIE+A1ezQ|E$bkn9{q} zXO#lKD(5$)zx((@!JkV1Qu?=2O8%qZU!|jJ)Xxj>{yZrW#G{l9fB>ZebgojL)zSfO z`qE(QwSO9{UJ&5I0Nny~4{%X{iv!#eph=Q`DSthF($wQ=5jVN>bbjd}rY4A3Zm z5ukp6f&hg98mRoN7RC+Kc7MU&%?^fc{df~n-!4L zG~nSm?hW`RMr>HK04)Nv3~*b3+XLL8%;x_erOcyhd8+_z0^AwEzujo9wEJzwT>Uxdh?}ifOY|HZWSBJLMG?PD*4Ul%YAA_=Kx&-bPRBRfCq{#EVU^X2IPbLUIu$-=~Z89ZN}4e(rmBlBg;xI)tB zQ-$Bnmjs!;3mbGSU^)LqF#}iuf&iHSb^wRo2++TGp-b~#6c$fGny%I=IbB{9|3#Ub zEDQr=xuzWpK73Kez9>qKO5Q158mP-&i1DED%~dHNZ6GOjkNX=}e_;ofTkqF`lDf zZh(i%H)hj|0Tu-KID=0zSQubYfIkBK8DM4eg2e$21~^0y1XvniSrFeptPiju!14eq zC==j|5{0V+tO@Y%0$CNH{6ZmTEqB&JX>zup)Y*b{iqBOy2G|r}cYr+sHmmcu1=!BD zX6!ALtpQG77@PF)La`R|TZdS7mF!eHYM~JCB37_Bz`g*l1!%fR==1%&=MV4-nG5AW zz&~)zdnv&2h4Rxv*;&5vtK8{}WP0zyGK=Es>2Zax2Y4eur$yo}lCg{AO(wCjILc%m zU~<)h!vWr6fGK`k>3d4w3Gl9hMRN-WT~hF2RPX%&q?xbtk8!vF-v&5C4vp++d=lW( z04LOA%NEH;WG<4Am2wE)xlMh(@MM6`0(?#%2Kb6|=Qas&O6he?8-L!v9_cj;3rN4_ zLM)PRlzzKNN-dU}i)HRN#@PVh(bUuVzX$l933jpk!gX0JKLq$OK(0Dp7WWRS_=A1)|EG=l~i{KrY1&c7mq@)_i1 zP$CmoOJ-0ygYz6&Y)Tb*JkkjVyT|NA0HX~4{_3K6cg0Q;NLC<1Q#q3Hsvpo?uYA9L!As? zaznmqyDo$46;S8ABSyUp46PPqaB(GUo|so(tL#oQ3KieeJ$`m;n8A%1Jet8{88phE zD1*)!bjhG`29iO`3|eJyQwBF@a7PB&RYq>9aZ3ibWkAqGX;Y=QDs85eP35*4w<~VG zME+iFG%x12pmLo>>kQf`^WF^Z%;2sJI!?^nusYU%cLw)pQ(L9&iu+niq`l%sZ^mLB z6yK+`W3kNr3LeOylY(;!AEa+j=Z{_@QZ|mEV?1#bpw5MKV~L!Lke@&NqVz8BENePX>K67@on14Eklz zKZ8LuFM|OY)L$kKFO$?V8JI!!Lq@A*LTVp08f`O%sK>tCWDHd>EQ6uTWW_QWnZc+G z#$_;`fxX7qzf6uVlhGNFj>%xG0xDs(`f;Pf4ucPlTQ(V!GMJpfj0|RGFeQVj8BEJy zdIohi89yzPGRvj;BeBVt__|SZxy;I7b_Vk^crk+}%jMWgV-7=cxy)r?k1Cv( z!RM=umIsZQtBuc(8VfQQxLg)-o9{Ok(znZFPcF`&>4&k*k_^s{E+klGP?!PX46Ww4ss-Z$2B-7{E|0cSMf@w~Me^x9&qQ`+RXacWc{C%Z9&P4w_iV>8`# z(%7Pyv3FJ1f;r1&dj>l)*ptED40cj-xitI0*rkp=v|M&)@a1wTu|lpJS@_pcqx~?x z&yNZ#WIx^Vfzjbe?Dm&4c!hzK!O;v}WdLOGW(J2d`0IV+^$ZR&t86sh$YA>xgQfH~ zgZdBArMgY5HO5;Ryu(epLXL31uaLKOXs$)Mk7Jj=p!A}{G{-PWj z`LlwGE2Uti{HnOsO6j^%{>b1@?u#CI|It4g{LQSWfy%xd<(~|aD}_T-1DAg6O34f3 z97QFh2>Dhmav}PJC>`Rw5I2RmImG!PE(mdDh^s5TA!>bMToJ-OZZugXvtzkcLd@<}Ir=i=fmM>*XYA{hcXfzrA+8H?eTeEIt_e|-3PaQg@$IL^3#+8+ zM&sHL)XZ}Jn8Mm2qEC!j+PzMQ)x!%1uM*l;H$;Aj8$vV)Q7=UA4MzPCYr4t0Rbr@Z zudR}A-!%$C6zW{q<>V@97-GyGqfv;W5I2VSYn4phXOK1yc`n`ff<1x(JaJmAzFrL72VM*ctL4kpu>@py zI_)tXC~u9hi?K#}h9GUVMjl%u%k~((!uV1`&^yGFAsjlEVe`82REQTsBtkqL@~02L zRrA)!vmu@fF?x+~fjFJ#Lu^Xv7-^$a zfHH}-GL}B)=xbzR$T!vj*9xQM((MiVZa3NtE{sFlyrPOg<1#b9=bKi0~;5c5M^u}Xi(TBGhdVfDoj3qqV)Vl1SdwbFcD zT)M0iau{q&7^oq(hS(NjS%~G_8jOGLh=axj-DQQ&h{mi8u}Y`I@L+Xqh;<=0YhZjGX`6@%IjpnIw9R2Vn>L*A@+sX$vLi**VoDJ5P2JoU5tu- z#=3Q~C&cFz?k@kVll>tou9ufWv|TR;LVQ}YfC}rcm!9k8boIUeqwO@b96@0do;Ma zydPr4w%Gn-%t#zM#K{mJhB&r9zLEG?9daVX&+GY`G|Fy}{0;I6cl3sM7yt8y@fnj+ z-^Mo`F&M6&hxj7Im&_I0jZ->w&kaHYSO~rj@lA+-Lj22632`RG4HAcmc zjPDrC8)Wnb{**_YQCTj2%lL^yhxn5^L;MorSI+c+@jDlBgZ##sZjkFfHduHU^aqpn z8wNMXnGG`XBcnPmRZQs{rTWHrHUFdYvnZ8C=`85*78~XGdq#;Y?ptP*%;JfSf-J@j zFU)R~^LH8NW%*+rn5-Qi?NV?-7OOW3%WE6u;w;K!Q9Fk^Ih4)fk}U3x&>_O5SzMOI zge)dzQ7((iv$!FP23cH@Mfoghu}e07eE4LeRLG)Y7L~H7oJHqNa!r=s^@yKIug-!W z8#Sv^ziJj&W^q*(zigC?HpQQ+)Y>G~vhfEi%{EE(EJ*ngK#eS}WtUCyiTAKgQZoxu z;yRp28^cgq^5KH(vba8rx>@9B!D_uM`rm2Hn3P9+j@HkjfNp7%H}OuRkoMnc9Bm!r zhFP?~y>ZhlZp~uOCb=<-Mp+bPv1yYu&f?}QZlT#)CFiCrPR=hNU>AZW+V@e_W^VG9F=bt z3hdl0f47xM)RslH2sC&~7E`l$nF_O*mc{fec4o0Fiy2wW%wl~O8?u;{#q2DWX0eQG zF+7jEU``ev{n_}>>IHMNAf1=Rd<8EmU7&QK(nU%aE2ZQT1s~sMEYI?%a)@HGeOaJqFN%l55OJ;F5+YDBm;!p#wGiBK~_tqAoa6h!d{#9wZe+7aqRxGqA8 zZE}5tx)Hvudt;?-!YSlOXrSPi>+02uU_>BbdGv<*h3p=oQG}uh_id8~5pIl-eywps zr3BAx6Vm?Mq;Z5E9SxS7IJIKjbx;90zsxRd5}|2?=5(f-eQShf5!#okU-r(%v$yeU zRx!R^DZw3-ELESNWdx@|!CevVj?gN?mTkiK2U>F$9Shnhy)(jVyBe~3UY^mG-6IgN zw2ScOHn~UXInMC^>fINiV-#(MZ9=~DdgF6|%!9}Co`}#p!m|;c zi|}NGry@L~-79RDr@3C+rF)k`_F{EH*qGpXZs7>Y2)}hMOeiIjc<7u$Qm!VeRs=i3 z*a+k3q6lt;T!cQVHXXr_5Jdb+W^Cm0uyMLytTq!N8}Y8Yaj1N9&J7o7l?L~X&@aN! z2*V=u*SQQ}*el@BgXq2OGGMz5Q81X(*)HTz&z$YDb-N6YFfziZ2*e{IysJ#Mj*c)! zhv0BOs(ghVGM<)1m=$4mgo)ZZIl>f%N596C7(5K!9Wph-v zVP%9p5%xw{6=8LRjS)6QSVRBpkoIpjUaw$ngmntYoT~f{5f;7Pc=Ha~%vg=EL#taE zmTxv@*%sl6Hya<`A=@K-w?od`DWp3i?252kCE54tox(!lraNU{gjX5f+O$8yfe0@t zewmlZV)^@3m>pk_@J56q5#DB&h;T>+4(rfwD($~hOcj2sxGzVUxl`WZN-2k!9IB%7 zqY*xca3;dp2*)BEkML=PlMz1=z}8ZQD>fB;9O283a)SGUGuj2m*#Mpa;S<5FVEq$@=NZP3OQ8Fp@z0rQhH?$SLINBw^Yud zN)9*e77AC@F6@4F4%OJIl1D2Rblfczpw4TQ6C1o+ZthfgZ4RV0b6E0PUM+26^|~Cc z&tX^}{Bc`h-5l~+`hX|=^>Q$B_&JAPa{RtC3UcU|L;oBKbGRXgE;&4yLxUU|=FmKc z7CGFQ!+_l)v@M4jyQNVMMLDe9Esd2P+AYL4=kV2TX_7-zcBx-@3*Ej)s$EmCyg}iu zIW)`Rwj78*xUTT3J#u>vVL{;?IczE@EZQUY>=A;NIkd{5eGd2L@YEh@%~i|ct{kE> zMjNHI9+bOtXq&@(?2^OAFO6Y)WZoWWm&1-dGNOKAm1^}@HY)6p!+kk)V)woB%^vBP z4yhc>93IZ$ksNyG@MI1> z8x%g8L-!nd`slD<9<87bx%HeUXo-8aR^MUINuc=wT z`aXVD8BgbsAl)a=aA|U&FwFGKboa!bSwKl57!VT(h@fI7=bUrSIp_cO8~gh` zr_MdMUcGwt>eZ{7)ZOF50v}9H(}&O5>O2E7KIHij_aVXPHOWc( z&~c%%Wjg7(4CfWZO>!>w&K~8%Xu7meeZ;{2qsI8anD<|(xHQEY=X~tLsD-LYo$P4~ z)i@uf_RbzJI6;uriOe^bPx9eYmrwR#ipxI}QYa_qOA;UE`0$etU->Z2hZzi)4_|Xr zF!y|zE*^gC!*>)m$zkw+Td1}ybYgyPp(?XTHCUvcdMW#2wd|QpY@QE`RQpA07WaGg zY?AjEsULk9v&dQfxlCOjeq-X%+9LI{55M|wt4_{{lb&CE*!5Dj|E28tJ}g|Mp1Ui1 z*CKUmk@~}jKYjR%zD;giak1)EJv(=?V)@&Lc8gWN#cH7si+tGP!&V;_`>@1^jXrGh zVW|(xd|2hfYHq{DYPk>F7V{Q$e9gX#)k<#a>e(#J#x*`%Sgh9hu-*rHvX=YwrR+=h z<&;|De1Wim!LOc8h0Rs6H~UcT9xr!9$2!^b>g7~8=h^1Nb{`Jcep#PKbqLf(w_Z8y+V)i6?#N_ALKV%VSl}KI6kVAI|%5mU&n)d(RR@_>kep4dJZbWENHQ-tytL zkhx28SuGgN$md5Pzw_>W>2u!ve!!3SOJ>E(W)<+Gpdam*I`5W;pUEujM-e|>S*nWq z5iXfs%nyC3dby{!xSvny#HUN0*#5j!ZCFr z)b=CU5%>6=Px>r;SIj~Qv7R*D@5jA<+{e<{%P*x_sK#H|>-(MWs42|y!{bN1t~c9{ zW_~>6hu6;sS)hR*5BQ-mI2oSzi>royH1YEx5}rnWUL%p!yhT=HA-R>Za{cJ(&-H)j zRSaEmb#9qz>UTaRJ;-1#S1ror5}W(+upfQ=c!>s|&V9t`f?j^K@Z(WG9`oaIKOb9) z=ViDj7kZ>rNI2>MjzJ9)3LQ@@5@SeYtaCEm!G65yM}I#WEmyB{IhLyq%hlVI3$9zPjxATER;U=0 z$B)XDya_*kqmzCy;_2>#U&X4haOyKN>dnStf8J~xoNF9C-n#4RQ=qXpzJH?OB{Fvd#4}Ly}1YfX= zAK&=#r5{uM_-Tcj=Eql5UZLhbz@Lv5$%qwdLF=4#D^!_JbLKwi`PPr`=zt$5R;cOB z?Ujn8$Vx?W?vtFEe$1jBKjt!?+!|S)In2_PisVPBE>@lwR;u?_s(F4q(!leJAHQ;T zEBPob%n&tdE?cSQ)53!uDzo~BAAj<=&{0yyUw-_}q5U}N$3K27VD>UBek}B3ksnL_ ze8esmGmNDb%c|BM;u1g3tWZV0}&N;x?r$l%=eNd76Z}F_B`K_`!~xW4f>rZI^e`f$F7m%}}+qoapbssI$qT=K*#esdWz&i|BPNbUeM87$BSIwZn^z+{IXj0 z(b12?>3B&;U)?#-Rflva{N|P~ z$AjpYj<0n-n;L_4ys5+1k<>9n$50)*j)0E0biA!&q>lG=yhH!jsCRV?*D*|YzSeWT z*}LX_yQcT`H7c}5jnFY^jbinE9Un0MI{Z3juTe|as1J4Q6T;TZYgCD~s@_`Fe60%V z2(ec_^_48WA;f%Fv@>;cSt%~bN=*U>7j)|Nd ztF2Qh9eFw?>i9&*C>^79e5~`Ka~Pw8UD~Zv9|>u+PW4%*MzFe0jngqf$F6m1ypHMX z6n_z0xK3RaGD*j$I=<8~RmWrDlIzu1 zItupnPLt_SnUbmN)wepn;|Z+eZ>|@|(lJ-ZJRLK1{GekN1Epi87~j5LU0$zxmQ;VN zS3l~QBVqrE3AsVl*`PR0VzUj-h(9wKbo{2{cNwwM2KB2 zb^N+P@fW&JH>mX+)X5F%AKv_>W4VqMIu`OY(6L0vQXWSeRke+d&x>_5-l*DdRQ)!p z4>qc04CzMo?MAh5quRbvo!zJkZBi?FXlzpa5pa!;wK^{Fpr8Xf*6VzLBn~rauX;D= z*sNm<&mY}+Z@|Rc#BIJwk!;nmx2|`;jvqHEZnteZw(HnIHLeJa9LwCNW4DeyRMXLG zT2{|+R=Z8=)lDj}Nln_M&X3KaPW^Ma2gCx69AqdqDUu^R@do6aspvheA0-p-T>|k;EIkjmA%(^2MpTRC4i~{?A@%+N}*#l0;n0l?^{%z z03Tq2y92lT;8(%UE69qiiiMHavj$1NcDrhyX?k zc~6kLk2~u_hL@2Kz+_}9di~NA3P6`CEd+!F19+*sqwu1jC2DMq1o&VdN4~t7B7W5D z-+dYvg}eX~uBIJ8Qg}*`L$muRw{^4-ZuyS`7#qMB0el(2II;Xm0Fwe3FMNXQ#zd*6 zhx=6eekM3MfGI-gC+)L*E?v@mY5-qL>sNvlP78ojAo)h{TUY*kcT5jpMgW@w*b=}G z0n7|wK>!OyVO9Wh0{AI_*{=SN0siRV*qQ4}{uVMXfS+B-F9G~2e7-CBjr&*lAFkxj z0RD3M$yT0!gwq*XUc}=ffK>skmbovHrj-FK4PaRS%SD)8qZR+*TofLUYXVpsz=i-e z2CzxB)!U81K1Y8$pB6TuswhsJbwb%7r@Q{b_K9U9AICr#ctQs z*W383ijxofxk&^3?+F|Y;9vlU0yr$=av~gsg=?3d7nP3%a9mo`KCtyf0AEQ)ou)j1 zive7c;m-2-3gAKj=fqEHvU|E$+VW){{$lF7;8l0^uSu24r5{r4Mde%E-2s#hqFfMn zcl$qLuL0d=LMCm&$)8GFaLKktXee&UH#1f_Pd; z`yjq-<=N57(=munLG%pbm9ZI}`Q|?e3TwCaJR@p71iK1$6Qq&uLN;tu#t zQELx{bH#FRPBVxNL2L}759bxcFG2hoMBgC#1@TT0!-9C3;|87UpxzFme-N(*@n#T1 zxMcOS2L$m3SD})3U=Xhb@j6X4&8@mUcgh{_@oj2Q5XFw?k_=`xZdYYH=2DZ_BW1Mr z3=KM;7v2h@?snC5yXv%E4cx9c#JfQZ58`K<-By1@5F>+_5X8hF-V5UWAfiFUg7_ea z4}%B>5emW=guY$rK?H*E2b~WrEaSGTAGWK7+tv2%>il+P1W|N{GJ~*!xO<06-0OUz zQ9IPrJ5)G`2&272^^}ChiZkPIz!Q81B5c=PDm-aQS5>{b+B*rgoe zRu=}bD2Sy&EaRr$ts3uE#Kppw2)5s?mItwd+h@00C%7_*RY9y~;_X%xvaAvLT0v$A zCGVg0u9qr#YPZ@H#O5F#58;Urwgj=2=V1t?L)b>&g18jKW$u?Cb_Q`ch$BqJCFHi?9YN}3gpe=f>_?XTLVmi-nJ;fuD;Pqd5DJG-B!rS7 z=Mz)W5Q2zQ52JA|4ceBVvg3Sn(^ z=MH`H{ks+Mo)F&cs_KNWzm#*^`>oxoE{EHr8t+l<_Nevk)HQL`LR38bWg_A9q%yg#_y15HE$zendFGpq`uZW(U2G zg)m~TviGX#d)1R6vwZNc zNBLolHyGlhKAkX{oZx!FBtv|fC_WA$6+#}5lmlusJsj&D#Z?&M%xm|4b%n;qddGxt-vMXnu_26;nGQLi z#)q(bRmOx6CW_>d1FEa&unRRm4PkN!Uxe`c0rkoUxl=;;EQBZfIc6iG_Bn$rBu8U|K}uqK47Azb4T5yH9h87|XdbzX)$>yCbou@Y@a(9IC?8-RgZ3~~r}LdY;2Ogl!*XQ1v8 z$Nz_pr~(EG8YpC-uz{{e6x9Yv6I;zAs)&K2Vso+xiy0^`Rkr?oM3pj7+CXIkcNr+- z$}1TtYoMHg@&+~>QH72=1CdlPP*Ei0Cy%JRMP9`~Rq5DKs+wRm!Z+!JS_WDe zc+|k%25K9~HJ}XKW1xRto)8K`GCPYK{~l-zHizJW|vq90Y`j;cp1 zsVmxo7%gOs;Q9`^9~&5JV4Q*R1}2Db zzzN6OZta}UJ`+XqiC|FV6i#N8418x`ih<9h>2n5F2wT4}@TKsnuH-8N(_B9Bg!)GK z?_%wH1Je!sAg;3S3~6F0=r*e}rMg)(xfZhx{K!E|d0FNdICnykaJ}Xlm}lT;1HTx~ zqs;#1-aPI7)j*Mxiecpu%72Y#JhpV zLapp(Cso&z&gBOinRO>slc?7^sqUZP-C|&?fo%pROZDfIYW+z?Y}+zX_Nqc}C6b>7_91j4EWJu;~~nV&bVY>g6-)gELOJs>qP&R;Chj&-+eAeZ zl}uDIQPqS|FT2WFRoTQ{)I6)&oK<}VtCnnj-(#YViTh2|H&NF_JrnoRnR9CHS+(}8I(k;URXdw8xsTI%JeTrJ6Imv5Oi=Ej z59d_22`|ezwbYl>=A4>ud0#rGg69--X2Lnu&_p8>51V+zL}L?8Og>Z}51Pmo3(ACM zV(vL-l=bJ-@pCHwc~$+qYG&dg6GP5BMwl(lO>{f&#P-qiill{!M@_Ug(ZiK*vRD-$)sUfu!6%=zQIYHMQ0dG(Zu@jbm4&nw2Eor&#X zZ}AIicrEYKCOVq17$p;(OmsH!u8H9$x|n#zbiP6vW}+*dF)`T0n?3rBdUQ#s%azTx~ zpoqG(2AOFlW?oPMLF!Y}5YCI|Sxn|eXAgzE%s67gHj(7$`8`n+F&;`6RNTbA3yLLS z;)i)RUmn)cI;s+Doi@`rHs_7=S zT~s79xil5M-%iY#Wr7Ad&}`b7m~--?BL2jLH?f?Du!(slem1dyY9@X$@vDj7P5fbE zKK1jwpKs6DJU-_)>ZhE~x%u+Ee~RTAm(<@v{t_&3N&PWC=O5F#aFJvYZN8WL?S!1g zCQelF1}l1(u!;Fx(aWnAS(XWJa!HYQxTL7F(!?qgt4*w7&?)x=g#+{8f>hq#rvzf9~gv6s=iq;{Iv#XONXvr5Yg zE-A*Gq24FXbGZFN7$^q(fH+U#VG~D8oHB9R#8L6;xFEefMuXzj36Y!>WEYyHV`og9 zGjX0tW#X)f%a@#mCSEXc(ZnTL5w0fJk#eU=!b@_^#C0CC7Ajh}Vd5rFJPSoE+!Fg4 z7V=praarA#>K#D_Jiq0nP_xUbfCX4!hOpGWtO{EE$6j>0tT-<&V*krdw2N9OX`z&b zVitxlg~WDp{y(@o#)l z!@^w_s#vII;p$~o)dGXSUL17MWwqzBYFg1tc})woEGN9RE!<597CNa;`xUP!?-fM{ zxH@$$)U)uWg&`L1wQ!$>HWu1ixZgs33ymx^w$SQ|%CwLzqh!h4Y06{a#VcwAO~5KZ(uq3|A1ga!KGJJ6AQT(9=7m^g+o`AvhbjVW)?Kd*=0>FT)(2y+l@Q! zAqi>utE%tBoaPpPwe*s-u<)pbmNKKqEIiKYRmDxsi9ccCNm{$?q$rUk>#AyHp|yZ%g~a<0YSSJev^dRrLC?u?a%J{DfJz*Fdl zB^fVSc-aDvlyQc)uZ4b=vu#;+Tve}#yuU;{J*fd)h&<;MVu)TBPEX#jFi0F@5ZFY? zVCh0Wl(VofmWQN;w=KM5A!Z@YNLqN;f{z(!VYr167Cx|?Jx(7+T6o_A9V35_9Sz5s zG`W0LeQ1HmDCrjHSjd7QZUiKHK?|j?IUAfwOEfK57Qz-HT&8P^;bpSbzow!VNLZLW z3GqB>A!Wf9&W>C@hAz*-Xih{TJjw#kv0m5IM;1Pot--J}2(3yw0jEFXEljZRy@lx( zCR+H!!W0XiNs4meCRzAYdQFxYadzy>(Lbkxg=rSPw(zBeq1T-A@GA>bg|j;5nsaD# zh;P_kLd1^L`JPP^a=x>iQqY|`H>{+l*9yW-cKSdlQ*|FrNIx94@mc{RVT{>6H(L0 z=lt(M0lO{iv9OnG@o@%A+A_(09!(Yw@<6a~%))WTL|PA9I3hL&URU(tsB|PbA(l^C zIOS@l_0u-bS~$m(HjGkXoVRen!fgw8EL^m3$-*_svCD#2Eqr)gT@l{8yR*kjR(H&&t1YQ}YS!@}b0>LybA}fTqfi)y!zdEQ zt?TNp8;Uk5FB*327Z0OEm=8Qu#lmQLgWniCU8uk=PjpA=F#itH$%pD;lnp!QK)Eo= zhd~9dZ-p=_hH;lDR0^Z}4K?hBirr9^g;SZ5D$-gtjA~(gcEjqnxBp7V=(8sahCK!?-t$`@*S+J^B|7*B`MF${BkX85LR7shutRr@f`4fe8h5VGK=>J&!j zFy0JfNEltj&NE?j6|&=|>c*Id(Jzdb!{`ylvthgtM(;453-b@?(KC!*VQkVf^W9Rs z%e&Gob?+@_bQba#!{`&nOJVfoiuf}hx}`dan&Y04Ny)%l>Xk71Ghyg<7_WvgK*k*y zhJK4*UO9Hg-BOqQna}jh9TdhJ(mGhI&AO$Q$yl2NhcZPO(qA&i-d1mi@lF^YiZU$> z3u8nWBg1$%jNxJIyQNM^mut7wd!qAx7$0yJw^X^?iWAActp=qsTisT^F#Pl+j6fJc z(PV3v+s*_B3i@v=GYl(?ufmuXMmUT}7^A`%&GqV$Is3MXO0SsfNnA)m&<-Q%%2Q$F zxqRtuH71M$x7Ft&`6!H!!x$UJxG*M*WPBJCgiH!!qTB0}Fk1C?!o_mm)XYy^dC@zL zw^O)BL^8XNqR*6kA=NJhr-pH;nsal+*J1qjLhd(Ve9O$4m}&UD--YqL=rj;J(;1Lw zax30ZGs5^mhGs`AZnThOv+?SRTd-ZWc51AHfA-EEKXxkn+Vsmhe@;l`P}-yu(i`nZ%W1 zpU$rm;c7w3*9ch~#yTPEUHJwcN?mfPusMt^VeIFMgt0Y@pYEt_VSbLr2Jwxv+Yv_W zP46zTzf+Kzvs=g>LF(*f)(Jm;M_s<74l>|j9OVwm&<=-@KSMhb#w#OoOOEi8SLK0_ zp&eu5WoYa>K0`YpeNTpQDvZ-%oZ-$D$%YK=Y?!ywcFs&JBPVO$q}L-3|6zZJ%9m){YRAszEYkY5M{Y2nqJCIurX z6hYw#ibU{U1n);sG=gFgJQ2Z@5fqQ0L<9{ZXcR%o2uejzErRM1l#ZZG1eIMoWh1B{ zyqsWpSH5kula>{wT1l|t=#0CBR1vHyIObPJtwsbjBe*Yu`y;3o!QBz(2kyEN)D|5o z+#}?4ldL+fq`_}a$9ht|Hv&HWp4IwN%@NFuAWMiRg6s&qbY5Jd8a*MVyEKU40a2?V z!p0FaiJ(~o4~Z~0f(M1DH1^2UB53*_ecI_UKcl%w9*Lku1P=>OyZ66Q9+eqACQXk= zkRGdL1g#?I89}cIT1U_(f@dP=8bR9#o)XQD5wsIRJMD#}eeNLqX+fImwT2Lj`Z^lnfRL`AMCbrQHBT~D)_%O zdPk}w1cwQ}%XtZ*L7HV5837*y#Z>tqf)68@8o^f)_#*H}FfM}e5$K|yh`^2@5J514 zkVvcu!Vwt4X~&Epof71c2x6{0DkQyF@d(muniSy}!IZ0+CuEf1Xu+ZRoD<-q2tJnT zSV2l?Z9)VSBltojp9oHh;8P*#=}#8^nc$QNzLVH~E>&7!4tyzmv&g4K@O1=>BUlo_ zHxYar!Tbn*W3LFl7qz*9(*=KwU`7N#2%pK0{LWwaEJ0rMPW!vZWXzH3PlA*%Lx}UF z`m^9KvXs9H=M8ATb0H#FDAhkB_$z|Hg{PyMp42}gSs+Mj4CW%?>D*fy!7{0CiD0>q z)e)?TV1@9Nf~y1>K(6>&;k2_+$hrvD3)$ex%V#@t*(BA?g6VbKDtuc6+lA~9q$XQ; zN3e%mAchxX*c-t<#xRQSqu3w80dC1C+C_0Nfe56po^Z2-E9T zR5(ZJF*>6}6eXi57e#pymJ%#0SUQR_Lbx3K9q@lUw?Y&ZMV<~g?NoBBRnjDino(30 zUQMvNU`o=gRup$fQCB3j1!j_`|N` zk*M=3#@+O26puymxX7Ord_s^f95miCidIpy7D-z{3fn}%ZAFqkbJ|DwKw7*P#rsh_ z9Yx0|`bN<&icV2O!zipM!Xozx2BPr0 zy>wSU7)409A!rKnC2aQwXDuR8M5FjLipf#LqKHQ^CW?=uNQjypMKb#DYj;W{c~Oj# zfU_?PgELy>Qr z=@V>|$oE9CH;Ts%D)MM8c- z&JB8UIf^SHydK3>x0NGa6VCTkRA#vm#m)b;QgSw79{V?Y3&c<` zhC(stWvg%uMT9VPMPrz-AtN0_HgWY!NE3P47)r)aN~)z}_)^X;%FD!XLSBi;%Smhb z7%Ie2G4^lrP|i0hcg0X8hR0)gB8I9lREy!>8157O>VmcDn~<7sEAw5D<;nh*+`xspeOJS5mWhKF5wx?_tN9u>)Bg6R$QWDG5(`fLoXgme<5hpl61 z6GPh=o)SrWSKdxY=5HAtVt6`+j;=f%oc{Ygonz<{!!xeDyO6Ge-2}@>O7w_1e__CZ zSe}dFd1>k?NJ+04UJ#ykzE2D<#ZWema&h#Hpo82ZQXY7E0- zcsGUt(sxh{=O;MF`@k4pb1lE_ntdb2hg;%JslFvRL~y7eds*_%`Ry3qaV2zSxbT4B zh!{r3@Lmk>$KVsm2d-xGF&Q7aoGI!TuDcQ@b})vJRE-$IuH1~layiF}#QuGWjK=kYJMyvC72iEGj%aKhA}aG^q+j=8Nwywq{hZDPBh00e#(s&!^9Xq zk?JJDk@EhHn}t417ReOB^y&HqH=R^x3r>w;hLEpfm?q?F!S7=DCWdcg|DLPq^!Pr8 z>C&1u#iQc~sm>Ind$YJDOR4+=lZqh83N7!C{Ji{KG=-H(feeNXaibUBAR6~k%Cr~;jx-Eqc^ z=lK{e#84oPf^p|Uf{W7SP7Ie~xE#Zk7_P=}%e8YYh8x1K3#Mm5Yd58u_W8COL&`Ja z$QO6cd6xWfK=}WrMq!~i3dd1Icw$y992ZWb{zM_Q8kWgX`6A>62i#W5K>c+PTnmf z{aTYN`>2jcIAYy6&dGZ=^84a=K;-wwQ9q8%II`ksAQF$D*X@-pBt46q_`lmc{cfaT z9F5|bB#YkoKWZutEskz+bdRHH91q6PGLBYpG>hY*I35+v=7KE*9~OK>Ld4z2Nu{&y zu{a)=Choo`gghxo|2fmv!rR92l#n)pl(&ncz3^w^=n%)#!aK*&QAj628e~aNs*6bY zp@U|-3fJX*LXS9}jbmUOuf_3P9M8w`avZP3(NlE#2=iTTdvW;V(CO{yjQ2(If#8R6_=KcCCkEmO#*q*Sjfdi} z;s{IC5H#cezKe*sIx!(pH$&oX!l#35OKUQYl#sM=R2-w@7{e{hEE4(0af}r*Ns?+@ z924T07{_=K(q}sJiExs1mH4SE;ai2z;`ls{xpB;k;|r007svNPz7(7)_?6(aIKCG0 zjUcaC{gxY{lJor-?N1lsk8#Y1;|Jk0% zqpb*kjpGj?^99-EHzB`^1-?xD8OL7|y}w1iK=7Zq^PZ65TIlw2PX0KSN_A5l%Y>|s zV@({(<5&^LO4p@T?pmY+wN^AY2(F7`y^wAaQrh1r)%3b-7ETYh2-zCPHX#hl_Bdv4 z%-9jf-yb-i#dgQBCyv<({FuPrIQGTCCz(u4V1FD3;^>#a%LyEe<4_!zX#?(LU5(=!PoV_5CvZKE8$1mXXxHC!Gmcw4OB1Lj z)!T6t6LKexIaf0?63CZuNd5#0CQwK?1Pdfkb9^qFSO&GoA{I`dh%^-yq~ugSt+-e# zkwD1=hW(mbDuD_KOze?WTI6(~jF7SklyfEJh3x2(#ny@mRC48&6S&LeRfP0woLxPE z8VP8wyk-LTCU9Q@wGyaPJ?m~klG+K}lfdlx-Z~hHOA zA+vr0nF(Yi;7MQ*vKl0yU(3vvR<9t{a)cDluRS27p(}5cK$RgLDl|zTSALbffflon!sZTJnqi1WdcvQ{7E77 zu$3!moj~*IPRF(hJVjvw>Ov-~?M0zker;!_)B0M0tfv#`n85mnvpPvrXAV&)i=|5f z&$zs+koH$I?Pgg$5_nP8?%4!bWqD4>^9l46(#w^B$SdRgBjM`_yhdSuZAKqh`L!wewLuB|oL_q* zfx!uE$giEsuMvkP@K(Zk7FN&hxx6}b-rL!4Cr|g7{Rw<{GJALeBN7;y zaBdtZ+$g6xG?MoccwZzR2=c;!4-@bSZxwa^&rVMuAl-w43BgbTh7g)H6R?DbT}dQ? zsLNwQ;)0Ixli79xNw+n{$qFBpz-S?35*X{YekA1M1k&BdNp-y2Iw9d)#z2FgBrqv~ zPZOA&z@?Vn>0Ci*Q+Nv3npb_~WJzt4%JhZP9 z_$GmG6IcQ5AhhfJo1V^|?-I^m9DXl2qg&351b#?hW&$sq%`6x2&Pt$R*@iq}?m*)o zvCT=~rv!MrA}=JKn*gtN*p$HL1mjaaCl)YRakqWuoIbSg|$BmYlUqT zu|ZPQcGhB>G@VU1712uAC~2dNjk4@+qk0jow2euVGw5yOB3hdwTF)X{IU7TYXyt8G zun{hzO)jF%E26C_qE)nUtcZ5Ih*rr4k@2izqpFQJMq}`3RHHQ;PmOkdgyM^D4I3M5 zY_y$^Dm87?vT?VK+BWX7(bGmR8+B~dweg6J7B=eHxK}ha8~54#cRV~`qoIxZHZn!- zu~ELLmL-@N;vG7~n^RQFww-@7_X_6NXjxQaX&~fz3>jMWNTG) zqGmDe>T|hNU?J~f;~5)WZFIBId8qd}8{KVuT~e_;E2M|upkf*&p<>$eqDIY$#k3b} z^tLg<#zY%0+UR3Lw-K=Ml8wGxVjDwk^t17@jaO|9u$@1Af5pbr&*t{GF{_wH2fVLj z@&fpQ6i&>1-NqmruL)=M=;6#aY%D9Ly*bp&RX9{k8*GF4rr;vK_bnT5+j!5$`!?RO zF^ti+`6nsf{=;(LwK0P0+b_3pac#H_VtUH8i)&om8Si*MaAWczm!`PZskr8&wc?uJ zMy0pB@!}dWXd`4JX(MIBuwmMW+h{W)*J9GzI9yzd+L%#Xjj=X$W-Z`8(#l~l1huwoEv@dN;wegLO zZ$j=8MPD&fR% zbqTHgTTb$H``+k=DFUB1jlLb|N5 z@%k^$`S3+ajqAReBbL`jOS7*jUOm_l+unebxUa^vr1`vO4vyor))e_ zT03jwH1|F)<}anyDy^Ndv8a^BvaghOj>c_V;7(lW=}OIGnM87a3gD&e>!0ylp{soC zgN>^;##GLEv$RGW{BG8D8#lOEOzhIyC#AKYN^7f2Yji5Nfa!jl_n-pD2eCRJMWQL3MWw{iK0mqOM>sgN+z8_iwiFyNKMLFN+mIL zMmDQuk|>*Wo)l3oiSk0oOF!6%$iEb?ltkqu?n^pH`dvv>NupX3)umcBiB4s-0cEtB zWwhKf&Xp21lBk`;JxSCQ1xjiOxjTuFDAekd%gf{@l+o%WQ8x*adV==~vO2qrc7GBp z%V_nJ$V?(DiT!0Xk4PxI#wnN8NO&!DP7)20cz_O9@T#&}!z3Cd@lq0flW3eo6Z)1! z=Ol8I&SkETCGj{tNkU7aX%Y`IZqbZKl4zF1L!!V7+NsuD_`^x(3UF3gYJHMH`z?}q zRGN5SNxQPz6G=Ro#8XMMOQNO7so6$6X_Z84A+*m6Whrkf)jnl4athmveg_dgE!a_z z7sqm-E=fF-#Pdn?OrmQN-9-60@s{1YyJPhb@~q&nvKq~@wU<<1NTRn83SUe*_kFOb zPm<5ta{h9QoL89lOXB4uK4&^5@k$c?sg{JE#H&dRNa9TyZlHKY{nv%OmUOP;rG-Ia zoaBup21^q;n}#r*l6WhLx04ttI_&#S67LEhCYZj1X1LorB8ixU<-H`{7gHZ3F{P}t zxGWzg;royMKoUW5Y%Fsr34?wA(`vdltt7%Oj|hnhaxLOXB$BYDI!5{?lSm246Qs^4 zA*0mSJ>TXo+;&(0r?T44Bz7gSJBd9>9CPJ+C8~##*e8KMnR9)p$q>J`oO0;jI+j7Cu7o9YLxM6Y{R$a6$S%QpkIP?+a4%gA_g# zK3i6Q?j5f`1>J28q!1Jy5;O#J#yRhQ!YM>j7@xuf5k>_^r4UP3?Z)vG62fgkc1fm? z5}xNuM(oU8QBE5z)iHt}34Sa%HidCQ*q8oKOyQFhesv|2Quro?Z&UbGB$HE^lEP=g zrwV>9_=O-Xe3?SkT~1=Ke3im9SN=73gyzVh_#=g-ZtI^ZEO7Z>Dg5p7e}tTCi-oRa zQ3{J)zC_5ua@sOivRufD6jr*DRh-lbXLf5-SeL>hd1#S`^(kyf0eL8p=Oq8e6po~D zG=)tmY))Z|^xfrJ*qXvN;oDuwjx-TWC&O;xds5h&!am{q1rG`yNa4E7{g6~S;$h}k z(SO(CSPEx(u%~cbT2Ba`6g(w(T9CcYq;P77)9buQuJJr9uU!y+QSg%BWkIT45pq>9 ze|hKZy)OJl3O7@@CH%HvhQ#4c3hC)kGoMKE3pOmT70g4SJk-cT%{&y&Ly{a>!@xl~#YCBXiwh|sSW>W5-v3)JlZUb*EGJlAu!3Mk!4BeTW#P1TS01Ve zuj)#w<)OOpbRO2q!`-x>hXx|7orn8e&3lB@5v(g%FAw($NoV8z!s`oW3TEZOBP2Ty zULj80T7oYnBoBy0bL9<%G|EF`SJEU8xx$qzd9}RORQQ9gq*)#wa(VMSJnVA506m(A z$MP^#B#-Cei99@)hv)O~WFA`Pp^L~{x%%z%(Awo~gtQfWDi7^kd3r%RN}vND4wquuL)5UCFdO8%-bdIHaX`UMFBxD z=KzXiBxiPKcG6B*B}mQ^lpunD1VKP0NJa&WU>1?@PV;-;`JdCL&h6^z>gww1n%Ujn z8A z)FfslF}Sdpmc-?Ugj!h4kYIWew-pve3yT(o#Y`?`VZqin3X9niPcJOyCXq}cmBhNj z;_Jd;6PbGoi*yo364@l)Ny1FRO2SUUNrvz6y;@lCd8Y+W#P2F1N*58CB-|uCZooHH zR=X4t1U?N*qMpRfW~uKcF^>T=GqNZNrA>5x5?3lmAG{h}ki?Tk#6nKLh`5qpeUJS7 zDsjC#a`_tHrAaJHVs8rjQdpkE3a)Po15;R;#464!1*EV#i8cI&B#C25tmQ0{*ptMk zNxYxL`XoL`;zOo|BsM0oNtT{pM)(Lyr-&eB;R~iWC$S}o?MZx`#8!5cP1}+s3D2Z#%FC)YUxrmZ~ zB#F=Sv>le<%%m74Z`p8Ea=u97%RHIa+eMEjae^yLM5C?LI21bodSO|gp#c(aofPV(!as&rOd&^tN|KUOIfW_` zSIy&8OQCuSHDq;&8L2WLN-;%NRY`MGh)NJkp|%7yC9NeXh52fD7J_<`(=vrtDa475 zkeNt9q)=ZrHITHCqzzNxa1>~qLX#AlN@jCO$!sP8AFbRX50Ke9g*GX4N}+QKZByY} z?D>cBlEnm@+DWnYDRjuw&`|=us=iAKT_t`bg>Dk`&Xeh$LJzLBtoBOb)>yZO?vp3; za0-3%FrO6tXddpDLVt+|NP5cygHm`rh4)ifpTb~HFom~L7?Hvg%ptA7Z|7c2;mH)3 zOB)o6K9$1L49H?3ekO%yC4MfC^SlHvP`H?&z)LB-oWd)dcro#6D!e+pRWw?DdgL{U zS$#c)p%M?v=ZXo6c`5kJ(o#u~LNeFeF@>Eee3HVZ6h27d!xT2B!p9V^D<=57 z-$TX3mQ?sw>yJ|5r|GRJY)ipA9S+2D^%Lb)RoR}x$0<1Vl^skks7MD zm^vgrn!*<;oMfzSjeMEHSDa}I$7R#%tq}^Z?v4}xr1qE2XN#Vg%l;FD*E~RjpQ%K>L6t1T5y_EbRg&!GI zdGhS|ljQ#_=~BtR#??vTwi4p^6n0Av>2I7}aY0a~L^#%8Df~^>X}CuVr~FR}H&cjc zxSqnlDcq3S$p24*?cGsN_R6Q>HjS^J3%jsDg4;FRas@eeNY0&FI2NmqY>nJ4IXy~< z0vhhsP)Ngr8t&6jP{RXxdZ_96*W}RP*pZn z(ok8pQebNdapQs5@e-n%hUywtZHv^<@Jk7izoe-AK#VkpeM<@|tY1>78gey6HN-R| zONu=OV>LBA)jn2-R+SXBG}P8WCQoGbmaUimj{jFM7Ux(RPL>p{rG-L6eGLsH{_J|Z zp@v2pT4-pgp|OT08d8N~%``OCu(+h)D6DQTDTteEpf(nASZ+17lJacg^|TFt4ezD4 z)zD6Y_L50{2MPWvDLQHBtf7nit^7$zyK3mBp}U428Xl7z{*2yJf=49nC24OBeezl# z*3dT(7b_(m&BOg9=&xab1ernMFY*KPS_f%(T;joboFN*X$io$`sZZtMr!_ny@w0iH z=QKPo@e7i^DCykCbE*Fo4XB!GFQN8w-I$gsI4YM`O(Xf7&I#a_e4b4WW znUN^)&<J>RGeZ@&p;MnMJ z;-qxf7aG1|TultCUowh@t1tZ-r9yH}a8onmY50!eq~Vl?vl`BE3#U}B@@WlcWK{GY zt@Fv{me9_f#6pSS2gS^C0MRWz|pCk)!#JC9Hw$oO-87HX!ujZUmE_V89Ey1 z_=jnq=}|`o9sg>$!7Q!gK^^~TxT)c89r<-cbmY@R>DNvu`mSN@>xiv?!^gl#a4G%IWA|T9lT;Wpun&S`-+e zPA)CR%=urJ=Di}B(xRe{N;=M!7Ik%0)=@=Au8ydVs?xj~I&ySW(@|aOp?)gi&?`#| z&Q6g`RZ>okoS2T9I%-P}t)g%(9iNmI#D*NVj?UNpgj1`hgL>jR60#RLEJAkdIYDj6 z(RH-Y(Nf1>kHj16;nAHY#HGdkWy0eVO?5PrOycG`cnXEL&8=u>8Nv5xAB;WAr70_TL1!U&LC1?a z-qJBb$4gw|9Q9RFF2Q2;WgSh+idS?rOh!s9QYYr9uj_b&@v}&!*ib1mOw!po>YI{3 zT+$z!M=5i#O=P5w(K^QH7^VO3GZa6mjny$uUOr~(;30(ZIwtCvq~mQ)s$lK}9o@?c zf)~n)$x>{-w3e5fDY80M(rJ=T*D*ta$z{VERF+vfwv`pLb(}6M=5S|~3-8I399@T| zL)T&GFuAg~daVmTJCrLI_H9)+#QXY0EZG!koSV_%GMLk-n&!Xz;p;f5<7*uOw~UUB zTn-)Y=y+GhS{>_j%+oPn$5I{3WQ zV<$sS%6ud##kNV1X%pGbeWZhcmXNaP6CJyB?9P+qpfrR0J(4q8;(Zby)^S9~eu)q0 z_)Nz^i4W=cTh6imlDir6ZuMlv+ENSJ}xoA2_3`aSf{w4I_^#5 zzBJD0ILqXj#%<{^sLtv5PRAu3=Vh-8Ixb4kS^D`K?j~8K{hZxp9anVxrsH>=|BA&A zI)2vii;f@Z#%qkN6 z&Ezk|sNuQ<|Fu>B$ZCq;a_1b0Y!r=)kK z@raCp{CP6>r1=-T&V!jh3RZi5Fc*W2+osVjjrQe5XAZ9vGO7)80Y^AJEp_8 z+jo+5&E=e@%8M>(bWNjM8tIx!;_sZvH*>nD(IbuRMU`O#6w=;lOf4^-NaM*g`bhk+ zqX*`-nzcdC*PX9FKEs73E<1xClyda)eUaTuG2Flh!l2X;<60mhh8Y~24K9xqR z-q9D*I502zw8YOy`mChSrSW_kyUU9Y{-_sO9Hr!oQj)?irSY=FujFxFO=I(2p`M{> z3`=8@jmb9NNaM{kdK>6tV0apDrSVf5Kc_Jwjge_APGd}+{4nNgI+L|L80Q6yj!KWa_k1k?DvyddQv`FksfL*3Mm z_r_`svuaMlg3;Ie7RUM4TEt~K@g|X&?HlrG%aZ(*<>>OdZ_u@t5zP! zFxnf&yfpkY_LYmdX#~Au&sPvZ8d>h9-Z4((oiyG}V__P6@F2h2pU1724!`7|FX^}U zgv`qKsQH^k-jgyETg16n5ClupSeC|N&M}SUoD|n0jXi0sOk-6VAEfc2?6NwI^=WKK zV@(=s(^!`V=l;H=1h-t_R1h1bTiCiuI*LuJD}=tTqC5;_vY)xYugHZNmN48Sz zBT4y|b5>b)rtt~Qs33Mp{w*1*I#WSV`KM{@Wk{rPv`Z|fd+eVI;f=(;H1?-)Pq$d9 z4(gL_BW(ICje}|YSt@!+N{-$e`CL|uR1`R>>36~ziTN{1ncg@r*YTS)zD?tT9EfXuQ3eCSuf1a5rEw{Z z%W2$Nmn%#f6~*^y{2)8h>>tzUUQw`6o|IwmOBz?{0R#6LxW+`C#vKOkH1JzG{Pg{| zq`x!m)JXinMdV{-dZ>TO_4GYs5FyP;D23l4Me?+c6GcvPs_;-)H4BTxXzX9SK zUq(ppk+^`QuYMXSXyASWH4W4<@PL6r2C5mTZs0)!4;d(Jpp1dS28tLcWrWWK<>Nq$ z8sXEGOBmq;sEZjGQb`my!bkWLkYCckuu6iGEM&5jW#198N(RaqC@+;%Fv8=M6(yck zDLe^DI&ums8>nKSs^nvLoDUJDk{U*MOpZl0u!u7?ph!RttGNcEQrq@Q;%W=TjPQu# z$x5QOfjS0S8E9>wu7P?68XIWBb*Uuc2I?DVU?3qi7pN?R5k8xp3Ter$$CWpfO^pmx zt{j@z)Ic-(mQx-V69JU&Ox!RgKtH}IB$sRpJQ7-3+ffw7#FflpROMj04wU<`deSNUgxGC8Rnx+=S`R>m86n+6-0 zY+!vspo(a?R+(a8*QF?*envC4RuR(;%rG#=z+3~LT~IMi znQ34al_Zs+mU6U;n9cpQP$@K5Ng7BoLZ&NQOhq%Ga|cxwX#>Ah5tqJI#w=7i9#__V zAFWzdSoD>F^#(Q=a13M&EHSW@(P+S9s2G@U@PWe!47|hjHPE!G7`R2r(x0Ak(p6?| zQOc*3hpP&ff95C)3|yM0EHv;QEew>?No5fiakH|R31qU;{i0&OqY#X8m1PE&8(3@L z_mr~2z)AzF4J50I=D#Vc3>^4bIeaMEcwlT;Rk6l^_MP(Ir_se##X1A;b1v^G>{a0R zP~k=cn;5+eMFSrg_|U+|26h1EcmwLr_)R{cdR9c4-*F zPDZt^d_spCs5mh8bycyO!oE`d9fkbzePg<->@~2@z+nSN4D6?o1`biiRW6-SKBF7o zQ4TUl-U(+n;yWc@pnT5RRTbCU3hl_}el69!HiAb7f(AU$p1jDZ>^a!i~xaL&N(ChjnC-oOO|S2#zGYv3Cu zy79_o1K%3>jtjwL)hPGxJ9EcX6Z5Kx52^`P-LuMsuas#^l^+cJXy89aY+Curz|RK$ zF>u{Ln`O!`2C_?(zYSbvOd9xAGRcq4P)L81)!z;LA;F({t$#^yxSBZJI`>L7@zWCJ zUrynR=nVtJs4gPQlrq)DO#=~5WN~7{VI`l5+f2X&e~Y2avlkVD`qjmqChjs(+(Zcz zcbmv>;sFzdOx$ClfQj+rmHSL+yA^_#JC%D)w40$cTA~y*aleV4)y1>b1^J^Nk3DGO zArnPR6y*>*6?Pe0T@*IM%T_7*Gti2|(I%N_F%!cZ=2D=fiBcviny6%=w23k%%9%RZXlos<6;D ziiwmmqjT=j3yNYwHPOjLXA`+5q9z)fXksE}qNa(siG+z-CTg3g%jK>v9+;@qq0I}F zJwL}!4Tv$5)RTNR<*Om)Yl<*Y-$Vlw`xhw`ZfK%p4ME99Cb<0{o~f|!c}Ho=fetGz zOtdtys#$I`6ZIA<%}r3Ds3BUJXiZO=Xm6qohfCzPHSur_!9hE9%%!$7&2ou5nCK{t zdAWw50qongf2@m%t|otL#uFyGndok!zli}RdT=>R^fj4R(aS_{6Md*t`hVP}a92*+ z6`fW?boo9y{Q3guA~-0wF|DE&-S{aqnv#^#VdW@4a;K_(vOG(Cj^bB{##B$bmV z!{jrVL!XIq6OE{s`=rVD4&x;gFPnJU#4{#d;51h#&zgA7#Pbr*t05-+pd4tMyR=>| zo3_>vq%X=QYJ0`Rt0rjGP!lxlH50F!ApcYi!QpP!5HxIwl<@9`I zu8E`x+k|5x#cg83Fkza|O}?B$Nt@WQCDdPu@;PEwj<8I4kH)Bn(^-%smakPZCaA|H z-^9D?LY*9lW)RSxtciCRKPFbQ)x-_|OOu7z}_t(?vg zi|B;Y(cHPAlBFh=nOI3z)QfN;%jLXQaFhP3P?)rgB4{eFXlqQYHL=OW2PW1@tJa&? zV4~qV<$bP^9lDDqE!9J(ZIl9Z>Rel*38MHv*6?2=3k4!u^ zS?Q|?Udjn}(D^3LF`b(D#KbNWUzqsP#BLLNOnheIAa|>-d}?B^iG55mUx!x&Uj9~} zQ1+WRzz9(UtNiLr&nkyZd~V_hmw20U*u>m=xs!g4GyjWiN}oVEDkI0csPba*74rbs z!o(>P$4neIae@oCUHN6Ja#DhEjbe;y_C3x0wM{w0UC%^uLLr{6h($_xt>jhdf{BYJ z{xI>UiEm7N%lu>FM-$(fxMbpriSJEZmSu;ubEv$c{k{2rQ{Y^FGVwE4!NhMSeqpMl z-&)77nc*dV!mkSP2}S51E7ufpk1BrWcK$iMEV7k-|1$BniF_7rv+$3J>n3iP_>aMP zQJMFy@-NroU1jtmF&>1t$(g2<%dK-G7GIJWUcv9pDiu`$3%6Ui)52XA?yy1`UO}pV zq%>9qZy|V(!N|1dDR*1wql)rvatm0v*Fq-?oh{sFp`e9a3sDRATX?`iISb`26teK3 zg`yUUSz!)*$ij=NC~RTIgfJO09*S7t{S`rR3neU+vQXN>!F5VWDbG7GHZjF9xs|c7 zR25|DE!6m1sbnF|d#bB(wPS8&E4(+$EKsUhsBS^Api;&{ zofVNB3!7Jmw`8T#%63&8R|OODcO7%Ds$n9HS*S^?EHtuE%R+4n!a{v^v{2VVJqvLQ zOhL?h_vD7(+$y;u!5M81)8JE^ltPBu`jWz&*1+OnxiC{P$2PXm#6l|ztt~XQ(9A+} z3oR_P$rX&iez}5oDJ?DVK4f>Z#F$*sYD;+Q(#Aqt3mq(Uw9t;O)|K`aiU-R4T(LP< zu=+)=_%S!MndP>q=whL(g(odMWucpe?iL1G7-XS`g`O7r^7fu9yEf9xLS~oJ$3kxl z`CH`nJ)-z6av!$Bn-*fyM=kWTFhFt^wT=(jt903`^ydO`h`ph}V-|QnLw=p8c-+Dh z7Ct!~C4aDmAriCNE-J{W^hV@q3(r^>YGIg#XDvKu;Ux<%TX>%Qs9<@~!i1=J!3xiu z?477&qT>Cic*Vl27GAUPI>mTq=8Q5XrL3N)M9(RIoCyoRSAWC8n-)e|7-eC&6&{9p zi^-pQ4unT*rX7qkg}jzSZQIE1)U*k;T;R_S}-h_+^rK7&w^#)a#T268Viw_u<7ksn0_0^ z1UHLrC@%XN;b#ipLSP|l@!>+sp>LyYETu-y41V6tlwy?~?atlkip%@aTa(RQYC?-hx`6VZ#te_rEDd{NRUR73GSYzQM z3)?NMwXn{@2NpiG@IKvQVI#wSvNGs*g=v9w1I1#3V3UQjF~LH-nG>9&RLv?|CD>x2 z!bOD~=96tqAX%l%AIirTc5t&;_|(Eq#*c+v7Irg%q?CdmD&KysYQMqbg zT6pUdh1u^5F7y(G_k__els+{@nWf5c*>r;bpQ*gCM4{Ld^ORE-PFuKO;i82zoSlVp z7S3Dv^N4cW+sea7m6zFfyuuscNfLY`NBPdeB@5qjQ|whnfn#%?-a0s9E6k8TP7R-x#A<&_$+4l>Nbq?mHdGtA zHfq_ZZ6j(UMuQJ3YmY{m5PH@U!)u9}Hb|4TL>(J-ZNzOHs3jKH63iR<4=VNOlY`3H zzm%H?74qxbXkeo;mDp%#qY-^oJN#UErItW#!AmOd6L`IDYNMHr<~A<~n=p`UrX^-r^0excFRMlTzEZ9HP5w~anF9%i++Xk1&+?G;+ZJ1$iA zor^X*7tNUx-l4rzTTHGk`r8;_V~C9>Y&>RTppD15?o*UOHa?lJEU7I%t}VErW0xy~ zZJekr8eEJ2SzA2G7^owh4a(Cto+6&8Jh@!CbB*%BH02ov&*#dvYs&LBUf_55Hr}-H zBG;>qc*W*zDwvaBvhlJ6#Ek0KY`jhZO&P{W_+DY^X0#8rLCW|X&@FewA!Rs2-NrZ@ z<86$vG1A5u=HV03Q8udF2)E2=#`fDvhdSb^I$}Z{F_z&vJ51eVzHMUywMpgg))AB` zHAf*x9ZB z+eq3-*;s31oej-~Zu6rA7T8GJFl=OOxHe21pVkq!jsE3xEgNU+h(GIyf^|iey27!+ z_gXfpD?A&%&F@GG?wtVh$Qf8@*Wj0nejCSi09bZ>0m&yrN+E~Rs-YB|SnzzP=MP^;GOZIx7fl9uO zy*4)3*l6Qp8#~z7#s@aPzr{8iAKGZ)gywCLV6)Ui4#(o?Bn8|S5~iO)*TIq5f63kQ)4^jp2qSKr$B&c=_@o=Y|^OYpsoE7BMWa4gEx zCqLwwM>Br1@v|KCmoU1bSEc41^}>*#+TU#aZsRT|42(Z){AuG~8#kmee{t_iJ%2M@ zm(OkZn@aiXvO7Jws%q|kHg4Lu%>f)loG=DX)D!s}FnDMT*ZOKbak~@7*d3A*+#L`7 ze5b5(#Je5jcW{sFTfhOWB9no43-Hv+eGW(qN_xKot61~_2j><<$$ZEOf5k51pr{l6 z*j?BOf0gE;g1Yi-d@(0H#$Vh)2?r$|lyXp>hB+uLdzF*4jDxZc_@gj;@fYxNaY2PO z2Dgb`>W)=TOieot# zTOiItfi@Bou-eW+dj}mj*h)pu2;f4tjBdMWe$L zqK5-M#cR*yoQVnXZJkjZl3Vf3RLCxnOghj8^B3~=xm-S}tD zAP0{-7%1`5gdk^kB0RY?n4@QM&LjjW&q1xZoWs6PIe5*%>kjUHBKow0XJ~^H{waWA z^PGd{9lYS+MF+1qc-6s64qm3U(<6M`ddWf2rB`yOgomU4PKc({qD6#=3Nh5dFb7*4 zY<2L4gEt*G4l)jgJ9vwEn33t=_rvN42X8x=An`~^M@c$b(lL^bm2{kg@e;6C=o|-= z986`ZcQDz(O(Qmi3nT=amOP+7Da1FG)o<@pU#+T6=Out^Q9u>d)R_)O3c8Uv#Z6?xVr= z#n}4dJqL>&7!ogXK>NvD;$T$2#8SzByr{aezF0xqXb-oigH>{BYaOg}u$o)7kjk<~ zG70w87eflFoa{IC#lQ8%1_vKH*z8~<^OA#N4MeR5p~pUO!e_sqX#`tVB5ZpOyN@Shr)8OmM< z`)E=I4`i_4!2t)~Ga9+A92|6T+QAtIha7w^Qwlf!VFyPXoRB%>D6>jC^$Q1I%8bE8 z@s&&(1jq6K@o_0eaMHoovLn+AQ_3lsf0$U9wRrgCER&mq$_~yu_=b*^k{2Ys=zs}_ z8oqOI$-!lr^mwF)eOXqwiCmGKP3_eF6T;N@ql3R3{O#Z;Y4*%I#Bb6G7_GXME#GMqp)s`ijtuV1gc*a z*4nXS6EnhIN(L%%22C@_%^;cyC(c>Kq-G9RKZBZ?@PfipOM=?Bs*=`~w4S7KNfQ|e z39?giZOIK&`_5w^;fJZav$DNhMfh_uGFo2Hok?Z5J3g){W3fp0 zwe_(G>5>dqXRt;xmu9dmuXVWuD% zqPrN7m7@nUIF!Ne4EAL3X$E^UIFP|-8SJA=2PF1q@JICo3o#1;&%)JfB*JrXjl_*{ z>VQV#^9&Bts~H?+JiMWv$zTKjSRv_G8GI?hjhQN$$0Xi2PCcH%2@Ww%Jt--{*GwQ1 zpO$oJBSGd_sqnoKD)EI3E^?>1$aV2e2H$4zcLx7t@LdLPyqEZ%Au7QoNiR!!Mba6K z#E%*Ll)*Ko+zfusgf~dPaDO!l{|?!pZuF|etdjp*2ES+UC-;v0bCMVcP{F|E~{k4(cQSb}3qqn($ ziw}+@SPC{4ce=RCMIjdty13g7_dAcE7jVOWW966h9yh!+vwE+K`&?9SEDE|X8jJf~ zbZabzHx|SXxLDm-932>Y$VFin2O5i_E{e#G?0bHm+OAiqq?n81E=suQS0ANhYe`A_ z-pt9|u9S9BMpny8TE#^<3D~i`iwY7~%;QvYQCZ@b3WZN0W~u6;n&ecMv__s}js%K} zi)BN}zl%hpE}FS$?jq)*ri)rG$gC&nhx4MfUDTm)V?k!!JZ4;igbU%~57|`TMFSTN zU9d}I$!z4}o+hGv6G7TU^4Zjs`kM%X7A{)4=;5NLi&kXzh_-jp!9{BqZCo6S#G5w} zENy966VXmm=DLn9I?0vo;-a(c^+*#jtVx(y2*x)NUAYP_(oMu|TCBT^6%zDv(VI?o z(ci_MCZdmvzAnl>7<<^ocTL29O+;?nc#*d8N4Q39$ac+SNuE?#x< zJZJYv^aU3$x~Td{l+Qx!w=~hZsd&l7%e4Hk%BKxK+EjdgLVeA}>n?`680KQaSL#p8 z6RnmfRxM9-nI3z?#hWhH&WtfKH!Mr=amVx4t0P>DbTQ7wc$ddQFxth~CF&S@I30Ou zcC5rkb;(whoUxLhb1X5msd(E3nnu|Fu=DL{f zVup)ZE@o5tpvX+F5np7{RD82E?AT(lYMxc+Hx-+jilhtcm`cMm2~sW&lmEF|`q8M) zrJ!-xqz#S>*M;XIBaNim$2O|3E=^QEq53XEh1j;$!Z< z*)ggu+gu#o6x#m@w^H-)iI<$w9v7dw*vp;uzB;72*vHLsK;6%HKCU+UTBTR_>{mxL z7YAJ&a&gwhITxSP;VzE5IN{=mi=!?YZ&1JD#FwgHaHh)=UrP5Dm>nZW*{vRPk!&vZ zZV632>Ede|wlr~y(?6cjwyKOhnsHioS=L;fanb0Mx~sW3@8SY;zKd^}9Aqn}ylI14 z?W=GK-?_Nt;#6~S*+r$V)to0H-_8u@c!dGEU;SRvA0%a!{GVO?!er>7gompxt}%go zxYNV0E`D?IkBjR}%X4GDGwrzeWS{y6R>h8@dX~e_FU#ksQCh~c>&BKU65qK!HGQqyLdwAk(sD$(` z4|jXG-@^kQ@_QKELX=&q-s|BW4`a@%{>nrF4+~F*z~HzZ3VQhEW3}=Ql{yP~c+f*( z4@EpYsN$ilhjKJ#uUf&w>Vb)EC)M&E8m|fsPOVB*^gtWvgi0Rh1Wu%?hiV?IrD_ci z)je>a)hz^Vt}_bk(s!r2uZ2)O;RfB#vCgXmMO%u7bkshzk%wL@6VItCrwSF2s6d^gTzV;EH2^*w2Whlf4%^};uN_4d%m3)3BU0c9Rp zuU)~qjt|wRJUs2;4G(X6c*f%~2E69sbq~*Zc;3VNtJIf0P;AnwF!R6QfyTe+;U#G~ zHEiCbz9Pja`KpHtgCk@zEe!Qgb%Q$03-|BnmV$YE$R>5ThqpXT@Gy~)>|rF8co^ql z-7$3(9lKAxeoU=!SRE~ukC8OpQWRO9;EtxA@sjhl2l`=EOTla~iE~+}e$`U&;!^iR zb*hJH9*%nW!ozeAGd!&Du+qa!53@XEJ-p*#wud>44F(RGQJRwfpCSnOe$hvl@kl~}zb zvBbkt8I7#6aIC9))lIF$=dA=Ib``gnhix7{^03CkS`V8%d_aG4MLevh^F3T?CAib` zwHA-9P84k|HgdUJ3u?%1EjqRqA9~pAVT*^Y9v(X#?s`s>8;Vw)Sdn05z0zK4?@E_(RJ!`B{8c{uCg96fnj{o$N?T7pBZ#TgDH=i7I7tjwCkH}9+G$=Ru1 zkmix|t%vXEB@f?wxWv+0TxO&+(xm3DkaN29wEKM$DKZk`Y7h(E+2RMc)&*? zANhUU%wM_nJU_;}SvJs)u&kN9}hM}h|UXz!zg zkNQ3u_-NsyrH_U_8u@7Kqlu5_+lujRh1FK9lAx)N-`k2(pC_96_@u31X)eLnZAB~k zxt(a^qpgqD{MMzNV5xpM(Yl?ud?>-sXzhITm$;*kPCk12=;dQ*JJH!kHy_=7bn$WS zVB&`wb-McavPGPLtv#g7JMF}bc7oN8L!!NX^zrd9mq}Lp`Z&m@veDA*#g%sAj`pG- z2lDZxkEeVL;Fmu>2KyM|W1x>gJ{Gr#ml_hK@>=c1<37IfV<(O#UfPhLh9`WqYagnr zbR?`k?c*6AFZg)T$Fn}3XfN#c;yFM31M-;m;&~sd+lx=zi?i*;OEj`rO;p0soA9oNVe6;EyhWmKS$J`EL5IG$L zH7x89nla%>Vw8{3KE_D>^dW5^|F;gJU`H|D#{?g*brh95inqC59YxQMf(tQ`aegF0 zFvZ7I$^@7gV49EV47mW60?hC+lX=6(aUZjM%=YoVkM%z0&;}pxFn)X_eWV!qJ~BQu zA3CGahwUTnV@5~8Vo30=#HNqU5`587{3^kHorLSdW7KsLS;jDTM<)?5qB;oz_G0PV zNlfk}C@{~*d>>1EEcLO#$FKcz7y5Wlf|cjvZ=H!R;{NKNyI9gkFRSx92{M=YSk5Kz zvBt*=`sZwXrH@rU_FPl9bP|1X=Hs-FGd{laammM7?lK=2eSG6%Tc!AU9~ZbxPv(AGCw{1l_~&e# z`1>y6TOXX%%-r~0T?ILpeO&SJqmQ3_e9tDvNsV};u7Z@p>{VWh{p{lxAGfOQtH(JJ zcK_AKZ$57L_>bAc#~(iarVKMAxBU6|h;#A3Bp4kH@!oSGz3$^*hTpmP<6Xt|b8&(Z zUByiwkpKulCQI$}@q7Vp3$QC1Pj(GI<1doT+XJx6)~@2N0Cxu{7U2B(c>VzQ1h_xI z0|5#IIMP+z7ocE(pSy~C$>}DlbQ6ubiJsjAInQ?!g#tVnpm2a90T_hUFT@`Tu;D`d z`uTX@3vqHtSuGlXP4zFviw7tXpk#nj0m=j@8=!O$F4lWz!*yXa-tm({x{+V4Nm##~-1-;SyY`kWG`u%eW>IA48pg{mi)(a4)^6o-NFVRh5;G{p{mC8z`1yn0N2jM84nzn&Tk%|1s5W~-~cTHvT>#p~?(Cbte{RPBodR^Ga>RD(q5z8ntPQX(z>)w<1AMYEx`rNG65$_Omj(E~ zr&u0fMS%Rh#L58GdWlsMKaq^L?j=@paV4NUJH8)aeSjSSb_U_M!5cWE`$E97k)aac zg8&}}*c@PcfRDKl+-L!|1^9@)M#lKF{@`AMCx3?Z5*HRJRZ2&Tyd3?%GM_LV1=!6! zUNlObJY5hz81Q(FJwfLR(*S$94eu5EB;7CR0ZBiTl!p-5dWfEvKk9uR;IQ-q zU2#N$qXE83z@HjIXq`nYi*jA~c0F*tYGzSOiq)3Yx)RsP z;-p-`dRfFJp9`9hfEKb>{VW>DYQrp=X3;E*MzY#i(k7CAvOW@%!p&us3&)NvvS=xt zLrj4-S+vcfYZl$IXqQF%ET%Mx?rt3AT6D;wOBR=#L_5m$>Lh7rN!dzIQp43=g7$RJ zqDK}zS@NlzDc#7XUR>_pf}lum@o*M>vv`eO&EkUij=->&@==?vUozaKFy`?EuPGRu6~Lh=q>v87POo)T=&;{i|4X< zK8qK#cuA@q*(CBp7SnqRTF!`Kua~8sSGg7u^%aS^;MYh|F*l23 z7Iqd+7O5<>EYh6s@ftkPaw|{j^nkpG7}@ZGTO~JPW??bmT+aEfx8VB}GFiCU@P)8` z7G4&wOpRCTBdkf$e0{`&eMCU}xl^)e(nrkCVu1wjW-(6!GWmMnh1`#Q#Cy~)!Ho^- z;%xZ(a(<1F>LZp&%<57JmSwR#kF!F8m6EQ?VrZZ68~C+ZtjpqqEI!QQ{VdjJ!;^k| zgCr-lfh#pR${&e%UE7%DBj%J%T=$4VusMq@S?r|Sv)D?HHH&V`;-f5<^${Z{L|NU@ zM{LjHV+PNJ=nn3zKH_R0LHz${x(;Y5il+PIf{I8mf{KW!2yfn-r-Y>eMG#Rkl5@^E z=bUo}1q5YxcH)MaRWU0nW<*6WD`FxC1E7AU|90`ebLP~!T~l4%U0q$%-80+ETW{^e z+dJ_thckVkt9oZA>ULFax~f~cDkdpF4SU%^T@^1TKVYPy8=Pv<&GyV(sSLlDmck|+SL-Hc7r#I!|C?7}3I7-EFsc^0odRZKo$MHi~ zRa%l|;rml+P>NxV+6bx)rKzbef zqMNEDoV~3Ju8*T)92akq-XMI6(U_IvxS49>s1Zk%IBtpKwm5E&qiS4t(2L#lDekw% z;kGQO7RM7zmM+@Uw&0F9c!ox&hxLIfysAr*y;d`h{5a~wQJ0?3O&M_%#c@|01#uLz zs_l!+ILdTar&<*dpBCkJ$5D$ia*_}E1hrWKk!jRj#o|zL@D$T}Qbf=0`s|MSaWsfy za(6}kMxpn{(I}2iadeL3zBn3-!e((aDc1Zz96@(=za*Q+@m6>BeRuW0?&|6u>cKc3 zilccPE#hb!N4q#$vf4d#!&?hzMFB~+k?ey6KO9GUNp_55!>+vf!t5ZNtv%E;J=Fdl zs!JSQ;}{*sm^iw{(Vblo$DlZR#L<(3qGdt9IC{m=TX3H^j`vV)TI(ZLO7>KJg~?+~ zDAu3-(o+o(&c!oW2FEcZj#0uH8pkmDK=Iw-af}e$pr_8uEB&)cwHGszj*Vkn98=<$ zDq=hbX?z?L;^-*y6XQH*N%5LQ3kx3CQzxgzF+Gm?tYn*l8F4J{sbvxL%U zbK{8jRJ`WVMOzgRT;x#yf;bk6&X;>?^Dc>FX&f)d@k$)am_3eE9O*b##IZ7tZE-vn z$ErA1$Mx~Ko8wp$$J#j7)8Ne5qF@~zqo*SHQYgU{y~HKr*dzjU4>BL&fQn;_DA`JP z>QpegOwp~q^l`iQ^itd7*de`^6#94^2?0+CWhHkChzsr7OIfs4FI{=n%xrU`X~*HP z!o3tPHx5s*FEkL^wL(4K%EXb4-!5d#e{{VB{UBHXX zlN65QY#cxHmV})jd#f{|fda&&|MphD#8J7A&d4mkiV^}|=jo_)_&(}F9KXl$2P@WF z2d+OwGS)}6>!XJCQGc-sebnDV3I1Uh_fZ6S30#uUVeQHUN+f^;E=%BYJ~#WQk_lXQ zlXCZU7g6+)?`K^zQp4g0FH36x8qd;&fCs!unV z9A6a@*w(Iq;F<*PyeHNyfd>=F`!w%bmXg5r2~Z*b zu^I`es%CxyMglbxc)hQxQq?5q>%QtjUqw(L0u}n{Bai+XU>4ChEOEPecLKGgGPT$= z`FCbA>m>BAWsQFNM}L&B$Giz#{92wp=$k;l1X?7}GJ!4$bWNaD0<9BxIDz&F zv`OfbGutN6PQagi^LSe3ok3oerg^{i&HJfu9#6>ZkU+--IwincuXqKW1$6W@CZ}5h z-4p1Oz-CGINT6o|y%IPe$=(U1y@EIL3r2YbxAe=a9^{qkmp9)l=%2uV1je(_1O_HB zD1l)K43|0#PM})TydhG`75(ytiUulSStF#B(Fu%UM|%Y$6Bs3+QNKJUDKIvHaS8k@ zttjIcu%P?Af{6)CN?>gQY|G>XrX(;gf%ysi(>HIblsJuD=4(mHPfuWm6g^WYb`&# zXLQka4!{m(G66e*9SJ<1z!UWR>&=}B#1s5kdLA)7FhR5TQ*-($OMI1_!vjqx0XKoS z6L=>9k7FT$=Ms26fgqtbpm;?Iq>6D`Kqi4~F(+i7X7VVOOX$B;Ab3)4J;l})%j`j}Il;H3m!PT&>6uNF)0F4j-^*AghWLucGmeD@6jZzk}TfWLa^ zyYC8q=Xm~S3A~p;)AIVWy}b#%pTNEZK9IWyg?=dXBcc0+Qu1Q~2ZVmRwSb&Y1bT_BwUPS$*UozCp#L+hO^2*|y1P&!|DuL4pe4D_6{`LBnDm<3J;RL=*;CtcxB=m;_ zeq?v|Q`vrsVg(Nr9T7h9Q30*?6fp1c1Ws^Jmnu9d^!}2C#AgyX%MfRwhJ~LK_=RD_ zLOBb+Ch!}>wS^KE&Lwa@fxi;?n-P0w!3DZ*0{=^3_b>UsC-8>=;v=TfaG3FaKb3d8 z(QB^p4@Xl1|1t1Vb4TOH)Ab zS1=k{xW~eS79O&2uZ2bynp$|k!hIGRvq~23x6t>0dRV>ux?VUZY8AeAKEGdoMf`QX z(dXyyEwr%E+Cm!(Evcu_XeA9F@u$|XyMF;?+FEF5;b9ByErc(a z`)@I}y=boPuLx$`Z^ZknxM{r9Uv;w3!$MCBoh@{+(A7dW3*9aKGcn#BJ<%ZGdcRIT zlc1M{-WJAM7-yjmD{NturQeMAv(Vqdr27g+NOFLMAr^*O7-(UTRE(PggDw5w+j(pL z&!=h@ypwmRzZzy?xTQ~B=3Rcw!=DEdjI{8-{`$yko;y9-($D=d7AVYrZy9f4f`t_p zR$7?I;w((JFvG%R3sXdLs>L7t*5RJ;H3Rg6dzytp0S^vPGcC-ru*AYr3$sO-0=)*P z8V&2sk>p$p^NRWN1uU?zu$Z&R!s24QbbCGKojgD-v#{Vq?EL=Natp604OUrLZQ)S{ zaJrL)wH7vUP)Npg7B&c2FZ7@Fb*N+`Wd?G5zO&zsKq&ELax)vGA{jqy^i;dlvRua4fhM zcCi!-o(11R#zNLYz~MPijUQ~L=+y%izZEA=)3t<299qb+9|x+4mLG2NBJ)WLPqB4_ zP4am?ZGp@g1J$z@p0lvq!mAe64^+=vc)`Mpa`&R!%#s|aUXX(L$@*&+ zUbpb3g}3C^9t&?+_-&wif1o-fGNlKpw>j7csTPCOI~HPtbhY2*SP%}2d*9-zu=s&N zgTvFphZeq~wJm%^`&jtg(jUfuY~g@_Pc8Htqz+p6#KO)&YSJLJbdVyT%xCo8nzi`} z{h!^gf-zW^TY0cLv?cG9aF}F$&R94r$)6c}Ei8Ym&aUAmWq6mE^qhs?E&O5Oyog;8 zT5GUsK3K7;e@d3WIHov42P!_BFK6**TVL9lkPDl4}tBym*|yjw1b zu_KDg3nsWaiEEO$E{QLOYbH6@iaaGNj3^?lF`}qa5;r7aCQ+2cjY-^;#O+DkkwoPr zZcge>yfuj`N$eb~swT02u)0MslP?TbM^48M4_4KZxGjm_2di>J^mXm1qUuT9nM8gP z2Eh>3= zAEJ267H##CcxH%FNz@m>TTJr0Cy9GSn3DU3DEb&d<0P8U@-|@O{v?_vu_%efNj#85 zvm^#4F(`=#lXxhJc1b*(MDwJMx~+w_NTU6{`b5^2NxcW#igu>YR5aTp@ops@QQHdt zi3iR0Nz5_o^-5xPslpCPbWEaC5}j#>BwqYZ&wox;Ko@qj$R8e}crknTBzh!q>`+bO zo^p#%QsUl8^hxUDTv&Qv(a<^=EcI7swx(#ONf(B=uurR1!`F-3qpgbS%~KUtp3LFZ%hObne%Aq@0^gN@8Xb zvyzyc#1zTPEK`&CyvUrE#B^Hni<-nUgv0s}&lZc#OJY6^lGKlwxza8^VptaIvp@vM zXL2DstD?!p-I64hCh=+#uO+c8iREl^5--{23fiYs!OA37u_jaW+sV~QtVtqF>I1sh zCiQg4Nx~JdE{XL?Y)E1wC;v(Q9iCw)u{o(HExfiR@rd9@g>DhLwfHW72ThsBlGx7i zlEmY}w}d`H{}&LaNsHyL{V%`7uUc)gnA5ljCq^19)JwuoB9lZmi6E)pIHZzDb5IY} zpL|pusu~SdJ%*||L)EsS>dB$%-J$CHp(;uu$5tfqR1z-~>wKE-oy4?-CwnvdrM zKhMfE)|11x?HIulyWpK$4bI1261%-Dlm>i-VW*4Q%`C%IrD5uIhMgon;+% z!Fx&UO``mS{I`;Lo3|Pit*-!f7Q6BtI=S>Lap7I&`$_#yL2v#iv5%&%ps$OZ59Jom zmijn}14;ay#6JuL*PH*|RPSICpCs{V5}zgUeG)&=4>RWHLce2}67Z$auY`Ur^c$g+ zJS5;-p@)SU!_>XQ6mR{Q#81Mxki-!IWS$XlROqoJju-P!ByqABpAvAIekgj*O7dr+ zzX<(R=x;*L2|X{A`d2?^{$7m#5b!6*X))(7#uL%`ulVgHw(k9XUGx8A{I@ZAm?GXj zOnGCqvz4?_%EsL`YT3Bd#$`5Y*r;jaavP;>JtS|pafOXCHY(bvWaCO3Wo=wze`6esAr>vjg~f)jrun3v(eZ_0~-x(SbNQT zZSdfop{I;{Y@W?!+%-b+K%U79jYc&4LVZ4M69#`957=mCqxlHc)JFdi>QGW2A9}QT z;e)iQjp-v)b1GkEFfXrnA1PSfw}{7fwX)ILMn@Z+Y_ze_)<%099c;9-vG}C zM<`MrYP(de_%RKO5t1Okizo46rfO#xQ!zW@DhO&&C{LW00*+C*z4vgKbcA)m}w3 z-E(#GhT9lnV`;X_G%cKM zV~&lc3yn^H7=MjWJSmGu096{P=F=aV6fRq5kS?O#Y}^r|dWa=9meR?6+~8xGjpa7x zyIA02g^iUqRykPhV3m#4bV3K!9IUai*2YIR_Otmm*3*Y=gf=$V*l6PkHjS;ev6+1| zQf;&Gh>geRnl-w`w%T}9Fq2zsJUG@Q=$6c{JyJbpV>|0lqm5M0Ofes~@yl3q!gzDp zNac)FaT^I6De4@XZ_&p%v~Bn{Y#R;-Z~K^Q5i;%gU(C zlKf``Q~9$to)g@vtS;+Co6kzTVq>?Bm+9nPV^54yO}gcOG$lrSNfmtHH=vhi$M$_C#Io4;<_^jxuu2H^+`vKiMEXB6Mkw z*pmr;k_j_<cVAL2@&cXIEie_IlMwNF!N`+U6z|}&Tr0{hPu6J;wgPR;w zbdZ{69vq`?aPaIHRmnk*nI-`_d@xmZaI=G398`5cwN<1JRp#Xrubg83GDck(8#^`4 ztT0yH=HPY*{T%dnaEF8H4jMaX;^0mPH5}A-P{%<{NBP?qb`gm<`9Oj$?HbE=)JctmWX?1P$ssh&gEBpdo|6Smlk6)pMX6 zuwwOTw`nG=bWfgQ(jKesanOin9A~~bR^97>l;iP>vFbhtq`!_;_d96n;9;87!2=GO zIe5rHa|aJPptr9cZ?c;RKIxg?!a++1Z5*_fhO`pen(~!mrN=3HCR;ZtnLlb;>}0Q4 zI|mFD#yHi%K}QGOX;@y<%}x%wIOs~_9MA8}qQ@z^<&be|$aFpMyE#}oP6gvsPY1mm z^mfpPoYC3={(UO{&2fsk4v$lPB|9-cv>V`Hpo6Inra2hoU@#5nV61~7OwKolIvD2Q z$EoI@)ks==T&}iW=o1mM_*fq|Hiu{S< zhm&X%0kjE?Y^=;Dog$nqVb}+}mELLWE?33}T{seQ}1aqzf z(s>R}k5`O`B_}8*7t&qn2@X~`Sj^`1&R@cY(@`g=q6w<`1hsx@Y#AMFg0?fM?&TY? zQoM);-?A-#jf1rg&N(>mV4Z{Y4xV%Hyn_u6Haf5zBpqy`13P$(!-SQbpqT3s2al3N z>|h(+V}jZ$N%lCIJX?vJ9S$CMu+u@@!KV`xP4t8VQeLMgsD$_lovqqL)n=S|RW&Zdbf za=;L}Z=xa&C+bn~6gdv&4$VJ0Q9bS8?}>_0h1Ph65o3<|tc*>97uX61-#Pf6z2M+w z2m2j-?BEp<*z4eZ2fH1-D#_Pa&u#gy3$8Rtm$FCj8$#c7@RoqLg}x({GVcm_kNqxL z_DS+X>5C7FWiB1AqwYsEZ<81w4F?$f*>DG6iohohJ`-^D0`pS=4JN721#}jjUpe?% zlHWS`#=#-MvHm76O0FEI!D04PpV%0Y|A9{K;JAYmbfih@CkICy9F<&5rY4!&CaGgG z067NfjVB$Pa&X4MSqEQrkL{YIKAoga(w)B`*Gz%5<2l{$rpM zJ@kKq5-#B4QWuxGDCz1)Kq;XFBSoy~QC*oUhUxgQbh5g_MHv@YyST>1l`hJ<`Vo9$ zvMT4Iyo;+`yf9g@jTKzby$N6O5xLvA!r;8tZnRmFT?&9_C zu?17K#pX?n5!Z0hXJP)9DXLW8nBk(*h**KECsa>~%-$)gke2Ko<1_j$7k9g;=R&!t z<)XHWx@_-M#qJ(3*F4!VR>#GWDeB)Ts_s-3bM<6^1C|BVchSH_Ll+&V>X>b#pP*#Sj-mU5s%t*2OS!k`XROx)|>22MR4l%1VxMF<_=#0@vCPFTcCm}) zocz1k;o@-@D_yK|v5A#*vD(ENS5L{-yO=#qt!2+nQCp^|buReS;Nzb2G~V6dVxx!= zv)o5q{e0Z!;xQMGa8kp4MPGGYbe^t!7XbspIOT~|$)RR0A`VP8IYKio zvMwSQITs-nj#Z;YfPf}iGRl0C1{q~OE%YgI118z^q|dr|&c%l=K63Fq$36$0i#;x0 zl!9J%@rsL=Ts$&P_Z@~LcHSL5Z!5c2#bn%XhcU`>Y;?q&F zm#3@N!(++m>TMP@wy3V?dC$c@7bRw>y)NE&@%3~?58=h9Hb=(?F8?J;C-=Mf*u|GF zzH)KE#X%RJx%iy*cl8tSQx3PTv1*;o&i!KaE>@5I@`ZE|*I!)SF!{Ck_F)&_v4K-! z-_Y}2e9M3^Lvhl@tNtXj?F{w3iyvG)4I4N^aTLs%p{hJTG` zBX>mmSP2gY=jHR_!>E*pOFdlX=}zIYOHXyC#;Qy*AL<>8kBnX6p^S%{Jyh{(@TI?zhS9_>F$80xKdmU$t*Lk?!;~%-=Mh_J| z44kQs&oe7|m`Q<|{3VM{R_s~tCQk?O%AS6{d^1!1J5xR1HFk@KsvbDMz0Jd|tYO)D z)jYh^M|&4B={2*|?H=y%P-~Vhj=fgh(|t!=(?h<8hdea*V0b8CRXr#Vg&sddK`jrp zJrsHR3CQa%8g01-yzUkzXFKfNIv(nJh_t45iYY*)`bnwu|!^l}?I}bainstZA+OmejW8p0IFm-l~aif4+ z3Vh6U^z_rMtA|b=KIs^{ce2^pLl?nJzBNl7nx!tx($kL~9{PFc@1duMULFp0jrC?P z&sKds^bu1qXmBvnAdKMy*n=Jhdl=$jkcZ#8#vYn)7R^@W`oy;Nj6FD82U|AzfiAJ( z>`D*&Y4&dUBRz~_g*`m(VKf`=VVQ^J9>#hY=V1n&!NYhD6Ff}yFwMh650gA>n5`y@ z<@?Q6GiNKB-J7kZNReW@-{MFfNmWSCM=6hJ+;rwhhhlNgy&GRsq?l(sj z%~7PS=coyD)Itx7JS_F__ZYp5TI^worz0vc-FV9!Ju9Y8-d*8grH4%{%fl)UtJxQ2 z)jAJrJg`1ERs@ z?|OLI!z&!i9`<>!ydk4Cyr5HdidJIH-f+N&}^O}^ALl^TeUdz z`If`KquFboZuQi8>U$4ANGV4={OI8)`e&CIm!F&G>G;F2Ny;&GRQ&d#k>&}8FM6Yg z3*?Z_QfEAz6%D894BPVOc8mS&;TI3*XuWyrR|$7i63tV;31;-;44KZxyT5z*p4FR~ z{|9?qO5~o;pQ5eYeD$}7e;B2Gl=bm1!@dXjDCz6DUt=#n&&MUcwjPz2@KG>dJvS}J zSX#=*r9MjgxWdO}J|3E{F88%rX3WrS=`&x=n6I<6m>w(RW9B3sb4bhiDDUH1AJ_SM z=b-{M`?y;0#J>60`1%3Cr9JzX%X$4|nHam?$4m27MIRgHt1CO3y~moL&sR74xXH(F zX`D-=vX7ft+Z4=9o?PH9Ou|BvK=EZ0;PB2|XC;j}3E3AnuVu5zQDL$ssq&}ATnC4@; zkJ&!v_?RIIX9=a)Oabi5vg2ZN7O1(to(wE3zB^CAe4z`3vRn!*^7U2^!BTGi`&dsG z^|9QCKQPATulBJ*Y(l(J46@4C3rQxKWsQ%uQVQ`pAKV`%*yv-Eujh5!S&9_2RVZut zh=50hZlSiRx^>%%?>;7)$zk3dJ{}h(oF_0D_mS}Nv5x~jEFVc9ulU%_5`8#6o~5J@ z*M}#nB37POnw+2VkrqzihIm$YlZ!J(y z`FPsbv#(w3dI9WcCOQ8keO|;~f<#ZZ~J)1 z$Ll`!_;}ODTRz_KQPtAX`_KZ_dy2`5aZkQn<9dybLW4QeyIl6DSW(AC%0-3`uN1hpFaNQ<5P}VAIE$g_wl)pFMNFK zlYh$B58u-aeSKrx_de_6XKMEGtB-SxP9pppJ5)CLIU<;a*99NH z%dLyS?MLr2yMGi8;aUE zV<{E`8 z6NJ|_0j@2^l%eE|4f&M<+z=oLkP2{PfSUsJ4$vn+fIE5>P+DPEmVLfO`Y93D7n` zqX72>XcpkXK)()X9N+;FZX!u??ibKB0G~2UJ}DX=3eY^zbGg`!6=qi-pVEYK5x;Q>Ynn9IGj@+GcYq<0ub7q{Y-&ap9qJ510O9vA3!dZR^ZJgv7#O$fk! zJObXD9AHL(nE|E*m>TE>#Wbp2q_|JQo$%?>`vlBBOO(tDFgxIJ2N<_VkvUhG1j`ob z+4y`h5y7H>e+Y#~>9+wMS%W13mIYWIU}>PoHD^A2{;mkHGQb9E@Ubeuy2<960BZ%T z7MfV3URb2o1t487l&qf$;#04Aj7lR=%pR0wg(1CMa7d0dKKiTv6f$@B=P>^SP5r znhuZ&a3R3&0kQ$Y0Q&=c93TpiW6=R#=MV_+6z@(pUk>nefL#He4e(q5ZlXSOQRjG* zQEOq(80WpT;qz>AfESA`{E`4J207Ac@K-ogyT*3Y)!WB-y()m~(>(#+2(XVnGcERJ zfVTp0Ms&NZxfuE14)6|LceZ*rzWR1m&^nJNSK*G)P;)-z}=371{ zrke)>91QSnfWva@lK@`^JStP$?b86C3HV$nIbR5|>E@M^Bw)3<$6g_Yt5Uczg_}~iI)!Ue`q6xS z3fGF*bwYVS2Q@r4N{{r4B0!l+0&WliCR6jw$|>BQ!W}7o5P~Wx@J-4sDO642)|7tv z!siRKS4-hG$-?Sso#OMy7OUzh+?hg+l-?~Tzoy6-Li2@^N%tTvNP%IBpeTjAQusTC ze^R(Rg<2_WNMU0NwNt2*!hjS8rcjraOrc#052sKs#S`%GKnl%LsGmZE6z)mk-V_>A z&s43Ml(V2xOSJMvDKwRG?@MX_Z!ENlP$usez&OKAIacPu6dp>UWeTm>3scPIEU|4- zitQ(2gl|O`%%~og~>=XcwWZ z8{L)Lp53L|4VS1MDgAXyPoV^?K%W%)ru0S=h5My+WG1*;7AE~^&#ab;$VPOi(Q&>Uc zj5imhu!MG-tw-Nt5$mu-ElpwE62)to08a2$rod}lY(q&|> z7eM#p#EHpG6yShLVRs6Tr0{48ehLAHTMAoKa3uRS>Ed__33_-6+amr{6H0FA@ss|-yke3io2DZHM-o)kVxVSkF}E#plo>uvF2|H3J)&*e^2{P)Q(=N zeiU%Dxb&Y=I3k$ua9K%q(=k?KtbS9*PZ3V0@H2agQ8$ItDR9q$d&t~@Ig`TK6bOcP zkCFbG!f&*y=wZ-4m%;@J?8N73)roo$#Orrqaz*fG3jY%aSg}<7C4eD_Zt!mk|It^| z7@0<18keNeD2@BlD3J!zxH*j~X_QQ(R2t>dD4)iqXe4QX7J#?@(Dlhz-fTrat2kYb)5h{ zeWE!7XW2O`~oau{3T?qgomTX%w=ye2X+K|F$%4 zPved>+Vji0H24avx?m>nOzRgk1pAh%nrV>cr(p2C`#k*G-}Zl^YZy!3ST(h zmDbw@#MI9fU+rQ$)DduOsj8RO50?gMG)zMYt}m49R`S`LduZWav3t|{E&s*V@jY_m zG@7K*EsgGJ+@D6%G+L$6I*kXUnGdD)oFxf6n@t<{_7O$B$)ip0=lI2`${J1CzS7zMo-}nO`}&D zz0(++#*j4nq|rBxfpUwlg!-k?KaDN(%@Pw#x-`Lnv|e)&3}U}5Q=D{B=fSOc4=mH0 z6?~cxOJjIif9`dRU$Dp*iKEgOoko;KE{!p1j7?)*8tc;-m&W)sW~VVHjR|QTW2dAs zHI0c<`Xr%LKAG;?R~u>?o3KprIW;ql>1jP7nIV+Zdt%PpXEDo-%R7JH1rHT^l#GoyIh92Lv)EgdV7=azQ0T3`!r6baZ1$wz>H}e zP2pVn_S}%pJ4D=rkS+N=`_0VagfHD;=E@$mSynr?k@~w z0e)pvoT0x8IG@G^`d$`mviO~WD2+oIe4D|aY5XsZVHph1;IB0PPNRMX4KnyAjepa) zF@u{j_>aLqgDWy9lffk!{Y^{h42D$8E0F;*;Dn)M2A5`Vncz}Fe_y7!zT;H?^34A~ zbI0`2$;+n3uFRlp2G?eAT?XYcD4)?QacZkjEP1tntAw%%Y|Ax*%Pm)wygq}98NKOE z%t>!0$$o=Sa=4VJoWac*6l74CL6r<{$>0vjUNxhq!M92E2yT^RwTxaoGI_fsd8i_I8Fb6w-V7RL&^m)Q8Qhma;|w06wY%%L$xSkNfR&l1rv&$B z(6kuyn+I~5N%FyrekaIebLpuTQWF;1GJ{sdw&F*UZ8K<>LC4~|56dlv^gEZU_8D}b z9hNIz>|(Z}lZbWBpi6PP_(HII20bL%R|=vS3+48NDsS>#hsJ+l3XBkVFvt8p0}11%dE^`so-T9EEljs=#>(jyDnF&B)M8B zGjbK|mX3kj@}O=meq!v+;BScxM;Hw< zdaLSa2FEfuE=)#@GZ~yH#wR((1)nbFaASuuXEXS@n8OJCYX-m3Gc!0ZP52{&3mN?) zhV@|$e;3RoSMh&}!2gO{df|zB{|GLT1+w^;kAMvFvN{x>yEX5UtnPhcegQ&NC9^0c zx5{Sq$7z>lL7CEmFU#U`0p#;-`xRM~$!cp;fb_~N_6uZWPW6$aTk$A^QtcO9PoL5%`Eb>sFOuqw&iEj$l|Un?iO5-MWF!lO#wwh z&n#E9L>p_xeylB+IxkzHVpN;ev-*35sj_Iu7R}T~s4tub7lnV+&ABJ5UzBqN#O|O# z<1CtFF_8Am;{L3Tt`B9=Jd38q`X3O`EQ<$=IeaVBB8!$;bk3qn7Ok>qoz)BWj#;!3 zv(PdR3uv1~I|1ClB(uHX4#hHD&anQSviMf!=UqjAw=BA6QDud$e2*-8(vreoFvskb z1!-TQy|d^efE>C_Kf(QrC1We}(w-Uyi=Rx)ViG$vi=kNz%VIe5&R1iy7?B0Pn&`4Z zjm+vmP5Du5(F!$MD0`E5tO!$nTo&U6PblV4U~(2ySacQ(sVa+US*yMSqwp$$1yOLKZ&rg~RXp7jZa<7cI?V2`gVMk554A;d?96 zWmzm2$raM?E3nOls{ZKMJm5c@qL43EeH;a8)e2~Ta zqVtaxYSsk3M?o8MB}lqIi;uJToNkuI0akCG`DqqU_lh-JoqsS3(ockP^}$j;lL%H} zrMhXPS#zcOGK)ql6+c?*v{HSY#Wz_TVxzJ+p2dkQ4rlQlqkR@XNvlV%RNrUugJ4cq z9+o*g^B$q~y2XxWv38|OuT;la+m-6XN=14yi&I(r%u$)e=`1c;rOssatdh@J&d|ThU!uF@a2aaZcRw6}Dq!|w$y0kZfbi$Aj{5dxv!w*9a&{+GpH zS^S;FKUwe-=>JH&#%`raYeQTY;_xc{Gd<3FROqzAePf)VbK@yNw4!{VUpPeT!OzXc?k)h&CZwh1hY*xMPda zz&6G$)xQfKwBKkO>R;?mZJ0-SCfkST5MpSEVIew({0}np4$&t>=MY^&^a#;21S{D! zL^n1k#NrE8YKAE9;EWE5vW-3@kVLhUgb!V2D8>`iDp?*Nq(@ zpwb$3<2EC?)gb+5gE2V75O$VhEc{jf44GoXLyQP9KEwo?ca0huVswZxAx4Ghy2|LY z#9-x*KWmJoC%kQr3$dytm~6gAF*z~Bq!3d=o)u%TKK<6H$!ywg>tLVNQrOA=ZYN8)9CFMQm({`Lx4V#zI;qt2Hd(@cG;%V3NPuUJ_y{ z>kwjfh-D#`hgcC}rS$UY)4Hmplh>&6Ta7hq6qC&8tx?}@HI}S5)`eJ4$q|G*b(QAI4vK-63we7=kZtD$q){$w8H2;KW2yeciaT58##W6 zAVfMuM*Jid;sR^_rEbfiJw`T!&31jMf8`xYM)E(ljVD7q72=r?&xUw9#4ag|KL)>Y ztr}z*^LH4xoi&~d@qCDvSf$sD7ex7;=gb#5aMr5bzZ%c90Fy7XzfKvigrGbD>1!cg z5Ai1zhS(G0jSxSE_$kDjtbd44LVOzHZPp~jz7QXTc$Zza%kW<`-VgC!h`k)1YZVV9 zp~dtM?boVx2h0ycd_--VjDu3#eh&E%2S|4tvE|0nwJO0Z3ypns3!APpUR$d^3-Nh~ zLm|Em@kNL)+2dP`Z&>tN#WDL;h_Bg+yNtH?7jAstyxY>9erl~c9O63$tApkbA?WSj za|E?Sy;qEnPa3l~8TD6alOExCXS59QD-9Cjc!*OWPK)(UFeYr#b{@IMI2nTUr8CCz zt-2LwXyj*&vmt(##u8UwWRU(A;vC&?q45WOi6dy45!-HD;DCDCAZCkxmxx4(h+WpaC?L+B9w`6ZG`J0Tp6Kkgz^z8MBoqk**gQ*sd5pHo{O;>3`$o;+7+*k zFjLC9Cei_cgl*9BMfO=NSS8ajE(Emhff=2UNzF| z)Xj|B>y0+Hs2n!=LjBrncJ`w+RlYdf)MiJUXXdB_a2#q5= z6rnlm^QX~-g+_QF;xs1j{z!N0spDp|2oG*Hu3Tz7NW<1vGdmSB@SeU)wTRF%!koH! zt*Ee3A*<22r8ZP+YFlEg%4s9Ci|}xSE)lv$Xdj_NgmogIhI8l56^ zj=<9%=GnR<_;~6Tp?icL5qd^AJvooXvGfb8j9w9XOAn4-Wi0lLE#H|V)@z^X7omTI zF%iZ_7!YA#gy9iJL>LrdaD=KGjA0R;Y*siV(&s!3jd&Ql(e-PCXJW7ibFn-M&|5}E z7!_f(bSuXiBMB)-?$Jqk<06cYFfGD#+9bk6`p<9Xln9g9rxBiBuXe}s=;{mBD?Vqp ztyfeyHR6Ay>gUc33P+e1VSa>J5oR1UX47Z__O4eCeZc?THRg&}Gj6kUD?MSn|DryQ zgLPXJVR3{fBJ7N?B*M}Nk3@Jh!me}OS^qcQG) z@x>bkPpfD+C6C~j^=f^D4G}id2=vC4#`HJ!Nf)IzsM|IuCO1dOtu&55!ap@Owy>pd z8rvc~#-aDNu{FZq$F(r8>$~J_XJ@g?8Wav&YdkJBZ?Zvk{KSk$NJNOJCxR6r8NrVb zM6e?`5xfX*95xpoHoo3(x^#&RYCwm=0~?KF7Yy=eZBVHQnF!ekY1VU}alC0E>BbHE zWQ>sGv1wtq&>%gvz<4s^|8?S-2v0>gv&QIm#C)1XWHop;!gCQ`U>mIdW-A`LZ z_$egr9m8P5RL6wa_?5 zof{RI$63kujYszyg;CyYp8vq%7UAazzX<vPzBX<@^yMk~jtn8V*&4IaR9=_XYvr-M1cjRM$-40Jc=P$h>EPh#YgxFv_GIV5wi zbGS8!YB@B?;r<+M%i;DM3Ue@XxP!C(O{xYb{5e$5@i*_Ny-79Sq{_z3KARK|aGtzL z<>z4J_?N``kY{I;dS#PZB?3ik$cg;AImB|fD~C@vsk?KiMGZOBkz23VF;8z&mu^-R zTToJ+tz%L{y&O~y^>b*D!@W5)Vud%WhB@4mL+j0IaLkNtR=Y1#gEp%lOR4*EXq z1L}$5d;67#CRG$c5kx>l$i4|u-i(DN9RUGRK}3qE*s)A&))BPfloe1H#;XDoRGn~; z!XG{l-8(_mo}gM!Q0?e;IM{1~dM1L75p;^6a|F*yN1lt|`3N{B{U@mL6I7;uXz2tM zD5Sgz>V*hijG$`-T|{%=1i!QA1ToR)-6QD18HwP{2zo~Fas;nN@LB}DII|P|5q?D~ zva>g);C)Ww zB=rGAMbIyT{t?rK}PaG1#&)UxzeG?dibWADj$l&+nFR&n7h4xX49S{}iQ2u@8=D+Nh%UJtP-A_~z6bRjW8BLXvmf2XK;1W9@x zK|->YAZxLR$>vHIi6iI=QvN?Ro?y0MZqDim)-V{B2iFR&XHYEL|x#svYUMZs@(GX3vT1Bii>UvST)Od86s<+rA&SKK9Cocu6m6sa8GZcFq{7ou+D@>26y>Gw z&qUENif2XGS&*8~Me)42-6<=%HBc`|wo4Q*3h63F>ZSZK?3UH+9z_q~Jq2IR%6moe zittynlGmc>E&TPYgfF6ci?J8QM>_iIcqhv5T_~yJ4&6UsvriNQqZky$dkoieHQtZn z1NNQDQG6yAKFJ9!sT1xS#m7;c|2glIC^OR^T0MzLzT|GuylQLJR^QJ9p7a#VC8Sqt=mYPtwx zQNCu~uSNgkqHwD(3E@^0$^RpCqHv?w8^yjTyeQI9Y>HxY6dCC(Evyyg)lsYwLJ8Yi zCk?I7N;X8XG0U&C$)m!SD0XCfu{DZq!nX_lD!$RZol)$HVs{jKr0%UQ(0=|IYJU_5 zqBtDIkthywxTJT7MD12zsC+bvV^N%n;&it9aj}0Q+wMsr8|S!2r40Uh~uzvH**$fx_ENI835Ku19x zMRXJuVIjfW1q%yanxUw6OTUe7I_}m{ zM#ud+D(Wb!;~pLN>3BS#-OCnd@~yb4^GsDv$H%p`hi59v%j=jI)+z|D4{PKP=%}Ql zs*Zqi8PoLtvCT~VXl@pOFg3V%yq4nV24?Xysi$GzCBCji6)J|64Jst zhRjmSXQ{{77afgtG|};dj(R#8(bd_izK-p)R6`wq%u=`2)f(vVv8Kjs(b?)r9p)oi zt-u@I3na%@1Wxu9nZ=LFVwUmH8nQZQRfSc{C25^IjWP6&N^PyF>qoI2kiyU z$Q+e7#~;8h;@H%>T32q%bNuOeNlbC5d+6w?<4uk{2S-OQ9k1!=t>YC@cvZ(`jqhsl ztBjtbmdsK2)ze<5Z*$Ze9EAEBv+UsMIqGe0{yN^((MQ_iu;k2D9F1Z1wfA(C(6sk; zd|O8=P)n;kSA8JHKa}vG<&SlIq9dXss^e1~pXvCT6TwMrrS%j1O7L?X{e^rX$kH!` zw3_R`vTA@1zQ<}H{hzA_>HaIU221J9PcT%+H##Qkn4)9QE1_?7e5Yf>Ts2I`a2+Fb z^mryXajqJr#m%u#_0H7$5-fam!9Wmr|OudV=iM}N1=J)+<9ucju|>;N)xlVhz5k%%F;2R*}~`OJULu3b(^Q= z>sX*;sg7kj&VCq|mlaAv$PUwj1s5UIm=86!K&|wKl3Z?|#oUf?k z>hN@I*0F`L%>~jT$h1aBhNjvEN6uHPxfc=VtF;Ugt}KqTj*U7t={%fMb!ibKvI;+} z|DLakEl|}LsI5A->DZ-Xw~m7YL)#hZ`*U{c*df_JpAI%$ps3HcXYSFlSI1!;M|AAd zv7a_|p7rM&JfMSL1NsO*sH2mRGQ;!cEKo-o3?GG#u?ewbEl?!+hK5dZJmbMrI!^0& zdv^}`84ewzTF0L{e$?@kj^A|ruH$DNzvwup<5w=Rm$jiE2hQpsUVk-k=&iuQD>cqD zJl+oQ3O!%wE#*myRpkng6SC^|rue9slU~SI6Hv z#@7sF9t`9xRR3{;3I+Jq9=`G9{#pJ3?=*E)$2A?-xl7y?SQf~oWPis%P7JrjP&$UY zi3?S}7z)L3dA9~ZlKe3g$nt_Q@YPxmFI0tNxIKmXeA#iG`|o4DA-G zo(mN%l#JmHDeWs+O74u|t{9f?)rKupR4Wrh*%)#~=bjkujiFKum18{KN|h6=Ab6i( z`I!F}Fc#e(L&X?k3)KTLo)hIaL{6*{;~7n=x**AeLaN5_kdSK93gr)H33-he0$F`c z8>uRu73{S<-lH+gXF#BgBr*#Z%Vt86gDS2v? zl+P4=M&!@Ncrc6VD99qF=VEwXintRp`$7y|Vt6fv-Z8uwL)RF3#&}kVdMSo(qSjrI z7A{Nm9x{nv*RuQvv^JdU$nu?Oel0jkl*h#IeGH?8Q~sS0YBCL7te7PkALCgKs`=I6#26;X zI8&HetR`_t3xy^Nl2AA;hUqbEiD7FDGh&#@S&PBpiilx$42xn|9K)O#=EkrvhU1IX zycp(76U=hb7sxCVX^N9hoN+CWSDl&_3oRSfqmQA`mb z(HL|gF+n3+Y6_uorqtD7QVgcJG?plurR3IpxiNS#WMWt?MI8S-3y0Ez9hRsyF|3VY zeGD6<`nyZiIw7<-*+$0T@GjN&fk^8fOf(HJHp;b}s3TG{be>pfy z72lEZUkr6hXg7L>uElUYhI|GewNp1l^K=RAHp8!SQ?fb2KPsuMUaESO(f(PgAd>tB zXlGYBt&oAj2JSFW%E0Z!WvZBg;s%O{+RpM?Q3I#m&85Lw%M@#sFrbS2_Dg0J?ldss zZmo=gvIg!lP};!V1}aSsQK$7XMSobG4c%k#VH`zIdM)$2aG!zl1~db?1}Yf1-@ro# zsu`$g-~j_w3_NIH(lS-a0DY)z@EIai{0{Bq5?cAq;m01(XuPU{I%TyVAJjIom1XK- z1J&8|a&=v@HKbyIO)OVS?$C%q10e&C8+gJ%O#_b@2(vF@q!!UYT?4gcSU9$HIM2ZI zr8Qb(TWo@DHCe76HIT2Y_L#xD`bB=WMz`gv9yfm(jfV8Og6~@c10O9{^t1Z&VP+c{ zxYpPwO$;*+`x+lx*BLRx7$qc6|qyZnAV#ee+h3G zyhmESZs6bLDt(u)#_XF03RLjPI|kl0Fwnpt1APpx345i{pKtD zSs1{fE~O2tqzyLkwSkcaMj03)I^P)hR>)9xxs3MG3iasn! zGy~HO%#~6~x|G5U12YZGGBBIddLqnd|E-eW`WyrLgWAbr+QTn~=NXu9V1a>!B#m-d zagl+=oK5O53@T|$3@kUW!obR6+ET$~2EH$?G3zI;CIgjMD)J{wY7yaAi)oa^WU(6t zOd+3F(BcN}Ew3dE?EOA(a#_uJBbVf-;#$gp&0&w@i#QwuE+fRmaTA__w1JW)?l6%t zu-X7jVc?{J4eYyteFpY(q77^|u!Aet;7xaGi-D~Mwi)>I zaJcZ#XtJEK>)NzJuL{*5WIuUh>tB*Uj zfr|#t82G`!Sp(+`{K)kfQ9l_N6Hz@Ps&7R7ED{QT;l{pKBl*?9c`nk3y1@N>x3)N< zm>eoZ)NdlW7EyoDZ3BOEljr_#;4f}XQFYnC@S|aN;f|Q=`a;t8QFYzG4Ffj~rs7gMFRG|O3#Cll zY2qsr15DgyqO^$?CR&=f+e8@?wM^8ezKMHGJY=GpiF-|yGf~MzWfRLD4&7&>f{FW0 z#A}7h6QhcxqR9(=>bc>;2Tc4NRij7nLY9ve9tl-3aj{44gC@%B>Y?trwRBaL&FSj) zp1BX3sBZH5fXX#d!$iR3g$t#b7`#4wxmt*6?=RXSo`)X_1xt`6y{ zebwB*bX78@>YHd_qKS#7CK{S(WTLT&@2ZFHy+8L!6JK1==3dgO#T2uRDhC@B$sM#N z{6tK>z9!tv#B(v#+{Da3G-g|wc*;aC6R((PZK92dXH0Z7(UyJO5Z*E(*v^F8E%#}Y z->B7ym}*)gx4nrD^gN~(%&bF&XKB#HOD4LRc-}-O6EB+RYNE4=CqkhYOmyKojj01M zHKAwjtL1Xt9=R7|iV~7R6?3WFT|Dn;;>WYv59hQVCXT+Ad$D%tWfKon$t|!Z{N+QT zS53TT;sX;On&@rfbrWxyc$-mVs5dCD8amc9_f6^>>Ux#XNo*1f+iT6yrYvS5P zjj7L+;Lg?I#Om<-CO-%iQ_DMYKQhtR#Ahb@nfTb`{;ax|&;7*2lhs50D&+3JH}_K$ zf8U$Sx%ixuUOn`Mi7$op=VWOiPITi9;TeWnv_4ES(8M4U2@@9M!Nk`bXA`qb3^6g3 z-83=A#5Zik#7GmPOm2N@7&~sL;U+eh%-w3JD~1|jqLir~Hq~eojF$I{CftWRWN= zHnBuVt+@L3XYHxDT5e*6iKq$P#7YyZOl+?biU^@XcTxK+t|*L|Ft`%g@wnQwCTy}t zakWzTYY*q1j;pJ2l{Ar}f{86AY%ctSN^`3>!O?aYnXFzV#NZayY{U|^W|uR-Wn(|-v# zH{0a5fuFcjnfS%TSw`$0?VKP<6H5`hT8i(RJI`6R)CCj2aW;2rO#IaT!^EF#*Tg@Z zoqah>eBJXU?vQ1Ie+ga|yjAqCi7O_qa!=+5fr(+3BHT<*<+!*;<#?9JL9-3sXqKWnD3<^v!!1OmX0Hk zRP~dpY#jH*(L0XUc??k9OdJ9h;7ADA&w47wQ0I`zYxB+m%L&e#0LZ` z3097yijW5ds|r$Qec`~vaongMQgJ*gqlOz>#xtD zkP5Zps4bf0b>gTiJWntz`0JY*i&FJNkHzt3Qav7r*GD^8)0aHKu{~Ggy{k1E#L+O0 zXXAJ-jz;`;^jnRm;^=W_;K?{T2Lp`-o5ayHj%LD}3no7eu#~BVWLw73N(e1e*gB3j zakPzNbAb87(;B9NEb30rOBcC234Op1}4>{q#{zjnIRO%M{#sN z>c9H7ZyX=T{a>klH|FqR7Lxr9YxB?XPuW&Z__H{!Bvn7b&jp!%=V0EKaeNg=g9I8T zFo5>syxkf`9E0K*9LKCUX2cc@$LP5K9qC)a5rV@6DI6ZhfEU!i zO@nu))JVovN{x!+$iW;IeJ46&1i#Pf7vYQMTWRCtm=wq4I3~pLWJ*osfTvWxRvL?@ za6nROdRBj`kZFP~T4^(~@|khWnI5M8oH*vju_%tkQZ$d9?d<=l!8AXP1tMH1I4tGM zm&CC&j!4$dvN%>|`SLhc2%nQusgzn3$F3LD9;tOcrJ~#iQc4#Er;9S*821q>Qa<)aHw;)rL6Ucsk6Y&2cob)s{H6#_@b%jeJ`i+vE57jx8OqwR7>FD1it-PyV_4H`K313R*S~^k3s|zKGqe~637)26buR06nsRm zmLT{kLk z66l#g(*&A{4jk1yfffn8l)&Y#{#z7VCh(jTwGw}ng1lM%-30n1@D(>_ku;bYI5;)%UIOnYuya!2 z14hO70j3Xye3U?6As=VupCs_9@XrMM34WeHe<5E8e#y;$N$8dxl7R`7cYOalhI0l< zqvV5ye4W6MtYoN=Zx~2Ih6xTA{O5ddL;@p)H!=K>_%4AloXR9#PU8Cn#wKvp!Zi!y z5*VMrL<^HFOdv_%*96WdFe!n_>|g@B5}3kBP9T+loxrpNrYB$~P;`9Gj09#Tuqc7W zTvG|mPGC*~a}(gj7Jl|U?x^P^&7;qbTA09mDSF3I3lg|gRU?_@DA!R-5?GpmE~U!^ zS0u19f#nGtanvP8@jA~cw&jgIm z_IB0A1iIG=Z%SaGRNR`twgk?&s@Isj-X%lZ6NtEKM*=rWgeJS{`Rbu9uG*czo&-)M zP`pfVZvy++%><4nuwNt;9!lVvs}3Y^P$c9O9?q8D${v&K3Blunx0Fu`r}AmKk-!fL z{3w#M9HIn%PT-gSqx?U!tb0!6l#pLY;5Tjp7T&e+djb~|sA=I53x6c|R~JfIxYNR= z1pZ1Op9NUBoZycUT&3IG872q+;ojw`{}T9@%AR6sc`sc!-&+-U_lEfJyqC3AqyKk zMG5h;8NQu9c&cPtRZpv87K&RaVPV0AaGSK^#hLfhs-%TGEdN5y{SDOUw5m5ec$bCJ z79Oxr$->2zl`n+LTevwQxFoICrWLa% z(&|cDmCmU9Erc?vqJ^%Nf`ebnt!$x+h3Xc6si93qJ!qk-g@-Kk&ZvPIH8Z2CS+Fwd zVGD;I2=2TXKAuq{9|#64{GCy`7J_tawbCqf{x%p`tyZ-PHC?Sj7G7GdK3T1ZwJg-O z@RWtt7V222YvD-?jV{tQo8t)8$DS*>QC57)D> zWwrWgwQBp1#_Z3nLk%r7V&B)Or+yFTtWkMuRG|yuCKj4n$gEKNM=VUUu!`f!HEUsp<=>*egagjyRwlSWva>AAwlGH|^8{Hm z*TTg0{th-jD`9q_=r0mnEJ$mVFU|60+y{iOu&~m?!u5&@Oe9eYx&_;U!^z6($AuUc zOd-cg`tBvT&?KAW?vd4`HQHpUE10pcT8Jl@mgZQxMzSR9801;by6d^~NcMkrHgj4n zoM7-<*qYTm$lb=mb_+X1vPW>IgCSHULdaeb?i1WE$aW7{I4q@yNJMzV!m(`W zQ6aQI&EtYJeoDx%7S3BZZQ+cCA1wT6;jGAi68u?^wW$A#1zO{a_}|?BE&OTWFRo&dToR-mR;MW6R0lSyiyKuZ(Rm?> z3Y&bL&PfyyLe7dWCef86nMAiFx{GGrO{(oC)lGDIBtae8q2*plypqJ)6xOBiY7(y{ zu{en(N%T(Q^(00lF*1oalDs&Euag*(#9K)WYM~8EVtfnj?Ihkw;@u?rB=K1i{b)9c z_mk+G#K)pGV?xdcLOvAyh|$|6_{kv_OzT_F|E6I>7AGB$g$yK8X!U zEKmB6jYN{X_=Xk2SJJE1+A6^*n-ux>1wlQDL=qN9k6w)oG8svjSsoV>-K45Lk(Xp> zC1EEqxLfe#gTaq(1RO?1(*J_zCgCMo%!1!jElImo_P0;#-#l z@!l#q857lckQF4@9pPfVHlTz`RC>$4s6M_Xd zt5aMNVuwbkc}95UQ8_;)@pBS?a*Igfmn6<6@drb6vpSc=uSvAotS)f5ZC0!`dUyDI z5_y{y$!}8qcR_l4F^Qg=70njh7ak+ZeFA>!cBe-i5FOZj6(QXqwbDO5<|{uBzOP&kD$ zDU?m&_7v!R$rSELp-2ivQz(}5^($^s#f22wqUvr@B~l=A085FG3U{XbR!G>;UD9r8 z!Mg?7HOlWv;l32gi{#!E$_e2JuxRGaaN8}46H)IeA1kI%J;e*Hcp!yJDZI8tRZgL* zkSZyBwM9Lc@~4{>S;X{^6je*%VIh>TD3F3CO+1pqge@vJg^+j~l^Ay43#_QoI7}ce8N{&4iFQNug<$pA?7x5o{^K)|`T^s#OY4386l-^tO$7*fxcy zvm;-9tLl)#GbvtPMwb*iN_A>JFXUOl=LFjy4tJ7TowIctZdEU)(3LxR3g2v1FQw2e zg_lLSyG(KCt^RZ~^^j~&!CS-ID}`4?^Zl*FXr#9g&d!@Dyp=-V6h2Pj?G)Zg z@uD|ANcl_e-4vGZ3X}Aa?0bSNrG$yrJ{0~@Rx*35`b7ArDSVc~rk0AHQ`3~Dw{KPb zQ}`l8d(R&bc$ zjjf7(;Wok{WyeRQF#48$tzezK;qOuyBU#S-_c9uEeryVNZBye?7`HZ9eVdw?!lV=y zrLZ`K$tg@pVO9#WMR}^=birxTT$62TMhZlxnL=oAj*x|da|P$6Fkc8)%>p4*`(KqM zDJ&J6MheTsJvtv1vOI+qLRO}*Duqb4l(9h_4yi7ZnBc8aQ%o@q<3hM_k}0HwuSvlc zl1?F$g2P%Vcp{-ceYdHHcZa)fQ=_)2)zZ6_x94#mySO*ZRnNB8r?7#6VdGsJ8#%39 zQ#PKku{nh;+>UJAWBb3+wx)2B+e-@DQrMotj+B2<_izeFQrMaDKR%dt3E7>(9wB=L z_X+M7JRo>b@X#&E(;>fZ3JbTXGTYUO6ppbM+tiV5>Nt&WQ-6!R{u_DcX4g5L!jIgG z$^_4Fk3CnT;P1g7Qg~#$BKawWpHuiHg|jIXw-G&C<6H{ArtohH|B3SX6fUOlM+z4t z`v{!HPr$S-9}|KfUi+HZ^L?-c&Y%30+~3RhDoV56XoYbjh$A)gEs zHE)Poj%05Nr;*#TrMC=%*{tN21BGl95lLae+XZha7ZqMikoKw14wkS{QhIuaASI=2 z+$sF7tfaJ%yKR)oO86h;y*A3($g{ymHtw@g-bQVkKY@c4Y}{|7mW}VX`_F4swDF*g zsx}_5QOWinB&lqpijWrD{RcFe8*kWno7H!z*iQAPjX!p(w``Da z+o{M)?^2z1DOTxY<2@Vy+W61L`!+tXvBJhmoB!xrM#b>X+!S+NB2B z7;IyNjgdCKwxOTahO)YiAyRSO7On3wZT~LytqtNZ8#VU(+2N91|6GuKXXoH3u{oOC z)G_V1UFtgLrspXPT{W121_PeRYX+N#aAF^4l{W3i37Tn@X{JR9?cu*F$DbDBoN3&f>` zVu!Uj2uo}%m zDu3S913r?k5ji=P*E7IuY_qZ5M%&$LBX@qAe`BHLa&1$#JFo6mw6oO)2l?Mds@e%{ z2LpI{m_tM(JGp5fWHnK{Z0u$%4G%3!YQ%kpy4sg(v`->o%1_g68$UAqcB?Zsem|sfKq&vo z#?Ll>5etJm2N^S~)@U3J7X51DJmcTSpEmzW|sWEZ% zF4_1??EGWnvN-U!jo*^m{N2jit=Js-Ps@B~uGqNBHR#|q2iI&|=O8$!?cj!un>Oxs zP|iV)gWDVwcTj>^Q_JU|kb}Yw;2=NcOSA$GPV80%9ZrFk8w>AEY0Td4ApSXuI4J7i z-`%RvR&7hS@V$GK+M|j|tp-N8q=P#gzNkwpCIqIs8`+4?C#tpaO*ssyKMi!GtARMY@{NDmi#S2ss^Qs_dZM z9`)ubt*V2E98_~aUeOG*%A3*<&7Rnz)sUuh9RwW&97LA;bu|%EIpko-9#zx9BQgTF zEVnzYO&t{?uj8PugO(0jImmMmc2Lhjeep_(g~uFlH9hKJcK7g3aqMxCKjC22aNj}$ z2MrxGc6d$*8aaINlXf!_UXswBbo}4otjo5VI%wvgg#$J^eUEDH@QBy&El=Wm{JG|c zJ>{UagXbJP@1Tu?w$g3~2TzO5TC278(r!Bkbc2DqOFBjS&p7BP%H+=qp}|fLI!ncu z9lYS6i-VUObaTLpFFNSzpvYeJt29mJ2lpzv-Q7VC2W7VTqsQ>*>EMaIibG9gX)gz_ zh{4ag=P=vb!RrndI9TZ54bF>$5e`N=c+0`t4nB9#-@!W$-gWSigT4;>ICxJY;X?=S z%kX~HOno3ddUmhcvrc=()_&}sQ)G+wv4c+>^m9Prrwq$R>N8QJS4Si&s5yC!_SRnY z1-s+mYtFBOuN(|;Fi7-=?DdCqpwyyfsg?dv4|c%n49lSozH#8~Rl`N{t%G3>=I>P; z87h!mj%kPYsviw)l!MWnG6&NfeCJ?{gNf3G?;VVlKpoGHFV#59;~cD96=p4FudWPF zaPZe&m9Lqag&Ch;i-gQ>(Z% z97GwV`~30Y;_V`Yi`{Twax0LEAMI14_bKjdTsy?x&6Gv6`&7MEVUC{dz;Tdqu-bvk zVRUeApGxyFNkeR5%iW@9GB-I z2ZtS;lxbqn9&vEY!EpyiC6cK?A;Y`ds_+RmYWQ*T=zev|!D-2!anO8dsLy`YdB36q zKRNiB9ZzFT8oxL=%dCfAJe+gzD@VhH=i)r~nGQkzV7cnxf`i{2{LX#A!QWi++%p~j zx+pIL6907ktBaLdXqOl*4lXkin&s4Pq0MWq&2Hvj@cdVld1>)K26hYW3fI?uMMAvh z;5zqz2RFH0xai~}$Hi?fs=KJ+BA*MmxW~o4F7mr5;G(#T5-tk5DCDAu%R2#3n94f> zx4W3RU-1|>o;*3ENiNSUZM-d5(hM9>xy4-kvCcnz@$@8=baAK4$K3GE-oPD#rCeD1 z6|<#X-0kAG{fY+@m2vTQNVVqqd;3*vj4JE;2Mv*wb8(-`n*{Kni}EfixTxsj0T+q7 z{;|gQyXbw)zt5!q-+_F?1C?Cx^d$PjqRK9a*G~qjim;lChh4skH1H6+b3j!+;NRo1 zbz|VhmcR=?1_CZL7mvHV0|B`%f-dU1$a4{LQPagEE^4vq0fEO3sJk}?Ivr58UHo(< zP{+ml2YlywFA5Ky9d|&5T|6`^pjDY`Yu|#Xyc-R zi-s-O08lC)w3>$&vB>^Dw57FUT`tm z#dj{cxOkDBb@73Vt}b43@v4j0Ty%5M-Nnl;db#M~;^$w3>}gMFV$IKidIuE`&fRz| z@QMqbC)s*`px=|ZJjv?(u|RJZZ*j(5ye`Ubxc&)OOm7OIkAG-L+#UK}hUG#PFv5WpLzHq@qGGE>t_{7DhEz@OB zi+?Ucj?$MdzH-578t7u-MBnBB@rPviLDl_ifM@)E?P3VMaxp>%if4P?F*q=kk?dm5 zLG`U5$uJ@JYzdBZG0Fvx&18V_h)y2fxG12AV_baiV!n$7F2=eT$EkEN&Bb_zx{HY} zCb{4tT>~G>VF<+!`p5PjIH)GO;L0MO;)3UUlkhleTAS`-1{a`KOI$2-v7D>*YCs+G4^Lj| zV&A#Im4>;WZw>O4$Q3SDayNJ^ht-)@x!@t>9S=G| z#WCrkQjLT)}Eilgm4BaGmR}LvXE&%`UdM zSm$EBiw$hf#U}0mqjKJ_q49V33k9^khZH|XjXk+rIqWWe;o^EGxZTALcJ^$IGcIe@guhjt`5OsP)yqnsoxIy>Ee=$zoeA%%N&ryiud7@KYCdGEAlIX z|FK_(73G_~T7T9KUvj)&Vk6!vhthkPDiD;6r~;n&hZ2<8_o zAV}e7hZV7qWamx}?VlVf;-RF6J3JKiFy^qLq?iX{alsOTzfTU8@^GhzyF8TkuLW!)DfrA5m1^dqg$&cpn$qdU)DHOAoEYcxzFk{!`KfTcJJ; zw(;=W5k=$eJhb=F!NW5iiXHV!Z)wsvW05AgP99$Mc$Pjodw9V^cMm;0 zbn)<_=U={fi4GrC{5Ac;QPq_SNByP8)Xl?(S>Dt0f4uba@UoEMB7a3VE3$~oc16Q* zZx652LILe+N4(+T-Gb^(53`T@=cB&mfp~k};JY6Bc$ny6l85&^yzgOMf0*0f!xz%-Ko4Jf z_{zfo$5u!3%MtJdEaY@bJ9{?wr514?bF5`_99vo7KxUsy)`jIBI&B;Q7yc4n9W~Vf`1nEeV*xI7Kcts3m;RI z{Cw2Mc^>9-t$Dnu4+}gj^svOkQV)Crl%BuF|8Gnq7e^{ zaF@Hi5Kk~INX-nZKOVkSYmErc?(?(jJgk@O2Ei`R`<6Fz&3f4DVV?-Ma`uI=Xq$)a z!gmPn%*uBOVf8&iE)4kp9`5&W)Wb0m9uPd};gFESg0y)=$fw8DaStav{Fs%W^l(ae zU-9a+@H2uxWOYU!Q$Gp6<@s5D`DXy9(Laq}J)GxWQ7c$0jSF119_~)#O2y#sTs7RE z)3_~-KRo>D;U*_&LGTiTs$%f<4LQWW7!1eMWs$S!Zz2D9_*ck(S@{(qS3O)4a$WF- zV2yV|ta!^>zBG_V$u#arBYzr+j-f(n6i#Dr+fact3a0VTeZl3&6!CW9B*laj5iFVp zR}h88(At*m2yyV)=X;?S(VjLC7(_5>Kc3BHn*zba!wh1b(~BaOGycqh%{ zDS~|L@y#@TKCW&YS8t_J`h?O>_{Su^o5n{R)pCJ8X}rfdDieG^jStfJkh60_4V;r3 zTAVu|ojdqL_2LQDH;s?e_=E~4{5wWIOXJftp1CcAyfBfHerb%5qA%!w8q?C4p2k;c z3}Czs%Ndczz_kAe$>21;PGgYpPs;@7olry47@Ec~8Y~n1M&#xRMb7kX8sr-!J6!A> zI-y3UF)EGGqEE|{()ccoF=>1+64n}@##k==6Kb3wCFHa-A&rS*kZv$LIjcV^5G&(1ZxuP&zkag#!F<sPSx}xI= zrWt-G6;npCBx}=H$315?3a!TaG&ZDhdj>@^*qFv9dX>icG&ZNPC5;1V986g-SB?`Anx3+)h>vs_C#lg8mRj- zD@RG1Yp2pUmd5ckPNZ?`s>{hV{+a?_kU22LS2!*5*G?){VRJu-@gKQ(8R5MClWps) z5MJS_+a-98+X(N)lAGTyaLdj3efceo-?=$R)6D+OPXTs8vX{6$w$T0(UVJJpb2OT3 z-!;o2{*%VPY5d0(#}AGS@@4!>Kv&ba$&hZLT}$J78aIS9%bVqRD;@8e%Mmql3Yj3; z0vS+}UpO@jW>6>tl3O~wM~+?zd+x*0r~fy&^~44%lKUIuf9we%eg@=#arP89bFi>kQgv@N|YxJwQ99x}5UuG&!Zn+et$sPpS49e0WNA9GbV_lwy_& z9i`}5PE*IA%Ts@Q@J~MnD}&cEeCz_RNHDP0t3sZtmvdLW9A=qbm%48Vmamt?m?1K~Et>C$oXV8H z%h|7&Q(G#&&t6E;2ZFqxuzJ0mk1`->P%mfujljnle3HSZ8GM%UuOXbvpkD@`XRtVf zB^mV3;0xM6qo!u?Wd>hm@J$BaaxjZ(0~qHS49;L6XSPw!@l)#WQ>xTy^>qeAG8mdc z;p&=pTK)T6m`CnVzxio3EQ8@0jLG2p3`Vfmr`4zoM$_zRH8O)Kri$wpy(NudooOGRnGWl?40k4`e)R{jDH%>qzs-tqbAdiko-k8 zW~XH^ovV_5o>7Z3h@Rn7Ek0+OmBH)`rm|~i)Epsm1?Ocj|NrrH9Z*sfU3YgcIcJcp z2ncNN^vvu+k7NWy5RfQJ5ET$aOhiGlL_sBk2uco;gC8JidwTNp%=7{hBnXmo&f&lP zJo}$h=bl@yUgcNS)z#hALRJc{5~L1~BMASio&A^37qE`WwySeK6YDdvArp~IL|KMR zY|4Z$6aGwWW?q@N^*nWVroFGSl_h_XTKcTEEfd>C@<%4Wtg(asCrGk`lc|r@5Iw|~=;6H+=1 za@Icf;Yud1ip5^b9r<;9 ztfQBX0y+xnXrQB^jzT&L>!_t8RYwsWMRiovQAtNJ9mRE&)lp98msTjL+tqwY$7g*U z&t|8U((%SQt+bA==d?092A^2T|s8q++lO*yaiC|`$U;CXG?d98+ynvym79+8ai z<6sLYQrWsX(sVd`{<@B9=e41A z?cSlQC&K!I2cKs&($QGQ2ReG{Xu=lI@s5smI-2TerlYlvHaeQ?cvD9U9dEG!UpsPN z(1w+-^J_0hOC7IVu#i0yTB(9uQ5dpbJm z=%nLacFIMqvyQ(nXm>AYM7klX>bTF;Q7&rlv)y!b)A7|sZRbo!(~BCr>HUk^tcyHD z2E-mZHi-8_>ddrT@BBsWBlhyh+T`X%t+$Rox_uLLM8_vO`s!G!W0{VAIzH7gLB~WL z{n-mThUyrmV}Op&bqvxmSjQJS<`qc&k}2!$S^>zJcsijJu|e$?@kj_=8fr%t0e6-?zJ zY*vlb={kPU?P~-j%Pwie3Z+wLu!L+h4vnJr`ENY-jW}>u9e!pzmo?R~NXKFw^K~p> z^$Vx|A}R1dxu02vlBo-&<0*w~kY9EDreleYJ(si<)$A{Sj}%YkWrBolwVeH~ zW0#IUb*$8}O2;OhUm#+&jx{>gv*TFt`Hr3OqD*$s6_Ol$RJ?Jpgr<;c6kG|`f&qspWbkLoz4gRj{At>a%EXN4cvaYDyQ9jDk1 zgA}^ctY$W!kiRA+XK33(&Pf#gvUX9(c^wx-^FRGdBD|a(m%^)@D|B3^oP*Sh_r18O z;}#9ri>hAS=7h|{9K1;J;*O5HI_|LnIUFu)k99m?=gN-mBhFeaQy<`gcoJJc*$%3g(rs>IlZXg zSIgx^Zm<0>o;+R@5t3IhpJ0ALh8FOmpzuQ3lEOlYUa^1QQ&e~{FN$Y}mJm|Xi&8>L zXUl6`(aL&J&Wo45_5@Piiwa(}?up85lS?%#dU5#Yv`T_sY^g(u=Zf~kTc_O>?G-Po zcaQd7N9yvXpPwik7Z z)=Klj;RWB-h&lF(Mic7lMK>=#V!wFN z-HRSx`*g$)y*y>T_JS+g2VV5_V)GR(d__BXMZ15+J_I}eRU3PG@rf6Gz3A;l<*QmB ziAYlWD$laRr(R6-ViMcLi_g3m<%Mxo8^AVaQN1W}F!c*BzVu?C7lXW5`Ee2@UwM(& zl}7iq5K7u!)dqX{Su}=v(MvKNeN`LgwGYmklkFYu#RxAZe4O;H$VYlHUs7BDpMn=- zyf}JQ8|%e)UVB4+oOs6z-ngnUh{6dH#1c-HM85Z8nnl*gb25Ku~W!4!R=oBA>@Bv>=1HbzMHY= zzUY-s+~vieBHt~z$BVr}_IVNZBI3n({hHUL?G*yf{GR z9_e&vx~FGxK*gMN|49ytcU_P4zc^0a>4ybLj?e&v9}~=XU89h7>7At#PtuqTyUkB| z@sAg$CEv4Nob%$0@P7qUw>qm{*Uo!!!Hb6?xhQzWi>qE-5`I~bN&WUt$~8_wx!rd~ za$WchPIp3XN#ooRew#z%jGLPO9#rpM=jE!?&FYGRBpn2R~G-21Yf`O;292Kc~L-XZLBOh{6 zdD*}#l2LU7RSdjppejpc;7HtEtGr4~zv%iesR5N-`Qz@_4Ad}C)4->%sEUCuTU3%- z22w>rUhlk0VVVJlf!a4TRdm|k&?s~na2rTBkiilfs7D3KS~Kw34ZFqa82Iov+xR^O z^3BL-`$hWeEX^u;1s zDY1T~c^DXSQ(MBUZ)y|kx|fP~d=58-D-5iZ95)+SWneW&cW%4BYd8$q#i!jHXmvs; zTqn7ctd}UMGIeh>u*u-BmeUv3b<^#>sckW^m19|Swj21v!0djG;yac98Q8Ef{lHD_ z%1w=A2U{SQ`=d9~|72qtcxK?afjtKH8aQU)Zv*=b>^I;u;5Tqsb!8gxN}4*Yahq*s z^Cu+{4R+#cdwK~-XjCw0AS9&KJ1JpKIJdNjV3pGj^0$j8n+9SA;s(}qP!k3Yass)f zky|3kVwHs)y5_8TOFLxXFP4GR1?yGEHKMTVsDa6C)t_dtVMSb=a4L;=X;m_Mz2XQ%l$n66;gL3&W;I=mDww6aU^ZKylwnmpvNPZs* z2q`F7NU*RVb&5zLB>yEze5mNdq1)O|TJrc-YGj?dppX03GUa6-<~f{IB+4to>HV{``l?8V+;>&= zp&App@2W2Nn&7S5+P2HCTB5_+W%!WlgW^Mrei>;#s6IG-*i}9rX#|O;^j}P^HsPDt;KD>2D%dF(8>%+%FoOjgGceJ1HXbpV0bVqB* ztnX;n9WB>g?ZXe$CO*93!)hPa_|VjcWR`|zd@1EriTn5GY(2yf{_D<3w^ zcJ}n)Z68|u@U9PCd}!lCTOT_5(24WE54}xCJ0D)Xt6eu8N28AR>n58Zh|F&)0HYKKa$wig|XE;;&L zbbKIczKCNetKh>&Ql5{QsgPcREMficoWwpX-WGL->FDc2KOa8z@wgs4{V$2^kufUy z=ThJSQeY}m@`aCwKR8=ma*%(;V(f5!Ey#Kel6Dx(xIPT^VdYz{VLtw@8sXm^Q^4=oO$0lStRuS;KLLjruy)`57T^nH&UC zyVk4zKl&hLt?)mHEWhw|KCJg)gAa+G8Jk6NG{3r0$R@$icghwaOlqqS+kE&f)3seB zBoyutzT1aAKI{~}OYl!YDm=Zb?e$@w4;OtHG&+6151BOe$!f?4osIB94RBaxBzt`@ zeDFyuKS$yP*M`fg->07M?IaKS(6hH%`(=0Gm1@|>!=3CDqAa!#2OcPT;$Jx=l z93+;cmPH*O4ssgt@lbc1WOk?AfBEpY5c0!9j`(m?$gymBkpixq*VN-a4E|oF+9`I^ zx9+nN`j6mg!86(V{|Y((r{kOuR_(kG7qX*|S*~7^7P!m_@Sb)>_*Ea=_cS`T%ncuI zaQaodNoew6d$4lRLM`;o_wds3t4g7*d4!Vi3Sn9U#g@R+%mQ=bSv6@2Ey zqPUYnqq_5j52waDll(~bBgKyr0rgTLR}Md7ot^Mw$;9-XFFUD_({HQg@?%x*43h8n zx%2vw-;V-*J)Wjz3kwSt_oIjqN{R|8=Es?mYS+qkloBE- zDd;PqmiD8JAD55X>*tsJ*m>9{<0mJV7X{4^j~^BMsOU!}KM$!;U-hG^AC>+1^qzf% zdfAUx{22Dkp*>WqNR;+f-PQc4?uXltbU$A6qlO=85>(TV&u^<8ZmX$&449$Tl86(A zsEXfS(){>P{b8Qs@Z&x&!+y-^>!5S`;qu!TBXVAM=ra7M?MJs`w(+m3np{UTht9PX zUiYJ}A5Hvt!;gA?)Mr2Du*V=>11UfwKN)!4?>kW1aEhMPKbyq7t-uB~rKc=zex%d}(e?Qs^=_B}#AMN~T??(qey7=+OFACeg zqaU3mwBU866Pr3JOE z-26qM8eMOZFpEzl$G(F71V0r#F-ZCIp7xpW0qhq)zVPEqKgNmVE5RXt3}y9&4-_0E z$YKu`^4jU7Va#-dVTwd)nGLim}Q;Z=sj$rQISw7W>gZfX@Q>)sNr& zIO4}qj#EFDN>T~IWq$bl@cXgcj}?Bb6yfiFtmF9g^Z0!nnwzmkglh#WOty(o!1Hz+%LBWtl z#|b}9QrIkI(tYg|jViahx!?T{`$EXSqIq8MtRLT8Q_cy0;j~-hg7Aximjo$%bEtCF zk87MF0z5Dc*V*-)=mPc>dXtleJuRbT0Jk~$`;jAnoB`bR%hM0P+NosPAr^JFP$fc>~~Wdp<#u`~mRpo`j(V11J;#2@6SleX}y8 zYjV*5im~ty9ar|Lj_PXh0CM@AB&DRLuLMvffYJe!31IPk?WF+91yEjiS-~Ow>r@C} z|9!1u0F?ruw{Y%^$^pa+XB@k)(fhJ+dY_C|UJdX(IyeGQ1E>~2^#E!GkQ%^i0bD7Z zL02=tpQPBFaT$fl-o39W0Z^VMxlm3avG@bc8GtK*+5yxFz#Tw(02u)=h|w8~j)cmt z2bv~vSs12CIdxu_+SL`TC%9;}eHCaZylDW<0%#<>v0#$`-Uy&eLsdVKbS5de)O|hX6VUP`A2! z+ykv+0G&im{__LvUEvI(8r}aMXzxqPT?6PAK=%N81n^M+9|!P30I|zT#Ujp0k6a`@ z#rvUPT}%1kp{rK_y#we&&4;f12W$y7KM7#Q4M$(L=PadP0B2_^be{@IFO)VQfX@TC z%zg>rivYe1;I{yl1n^Y=Uk9*IN-|JzSODJyFi1GtVKD6>n-2{DYwZ>uE|T#9d>6oo z0KTPR2QVstu_7NWI7ZO9#(n&_Ba8JNq>K|ugC+J1Fd=}60Zb3z2U>nv*Q5X@2QWqW zuQ}9za;sAVn8w0CRKI7+FR3MuIfz@{R4Mr}fS&@G!%+ZrMgTJd_~a9Hb^!OQIS+rS z&I(|~6-NWhNu<2fRdudt&I{nsP=!(Eb2N$MXF*B|-E#aQWm_b;SnyZDe!J|_E){+% zfPVs57Qk|55x~j-G6Ou`5UT=MO@#n<1h6K6wE=7jU~>Ss9%#P@u%2UTy}R&3Z5_v2 z;|!7w94rsDje;bU+|6`s31Djg+X86uP}|ldqvu0y#6xX+0DlB9|DnBy%aa!?9%*sTQ~?|e*t`0c6!<^@o<~}i zaF(B(yZS^b_z$Xw12_`E;gz=K9F>+l7QnDawn@DINc%g0ZYbjR-NJG=x0a8D%n=R2R#t^#-<-iHA^3g9uTKU?{y$C{U=T3U8k>?B|R}i_SY=s2#2<8>c zCzwBo0zniE^2-Q!lbBt?P31Dk3rlE`Ac_W2EQsRbEgwXQAa-P`rGh9OL`mVwA*JFJ zrA!cq@}#{KL}I8qG`FkjBeksXa)P~@JFlm!6QT*=`=U}gh?j%77{a9xUJ0T~ z5M@GmDTG&ps2arIK^zaFS`gKPm>R_QLA(~^`J8ALMDrkON@3E2$OxiV5UD{ZB3W}q zRfE{|S#nws4v~a%rd4>XQSJ=F6$A;LTS(Er9JPa}BWg|9XhIqW(RhyABm8xSKGx{! z3aJ-FeIX5kJbx^m^7fClMxxnRFzKLefo}+JDmeK!dwKR|5G};pEr_>*`0}yVQM@gK zXvO{iAX*3Uj>xA!)-DcE+XS&mNL$w84JRe-f@seMnXYyaHP_2da;DQs(&;StZV+99 zh&?%wo>3 zg7{h@4u7Hz4D$Er>YyM73t`GsnDa!VBN-ONH$i+C1U2a$9>jxQKiE6K$O6FfJ7=Nu=KdbwUv26Pald_oN^ui+4&8?|-Y_ zf1;Ins!a=GdJr3e*cikQLHroRq97Ir@sqUb48il=>|s7r_$usDcN4vzT?;w#O5H5i1L;owg&N65cXrc zAhrjg2jLB3??%TT9Ku2DWWzpp{!ei4D(9{s&y~f#Aoh!7H#Ju|_X_S|IiG5_ca@V- zC?sYEK}W(MBM4s*F%~!oe-HuMWDwCHfCF+c3r3ey2=o0QDLGFFg+nM3Lf#Pah3pH~ zX6SnuhG{CPr@{-i9GG64F?(iQpT8)M2c&T2AUW z7s;D~Ed<{ZY$@1E@NGdxVZ=7V+X~YAj*xc$DTL5LNXP8ZP9ZFlMaa7$^vs>sMeser z_XT$}Q7P{pLXQyEg|I$^4=4}eyAUQwA|HnEaR`^UI6e|@(QWoKsa_%U4xvv7pM)?% zz8T5I$p@gzyzRqN4M2!Px~=Yp?T*5RTtgzuu{S83H9F z6cVY%^nV|%4hms#2qbhvLil^0lVn&3O%AKU7OrnXAPx_q%O%_UZ3rVn7!|_k5XOa2 z|Cu%>1ih?t{vLH~2%TPXk>i>6$}?>|`|+-Gb^Ubmi6Kl1VNnQ+LzpbJ_$h=LAxsg@ zVoVL;d*Rar3wV|3Aug~TKZHR3qhQ^d&Y2<13gPGMShGWz7sC7y=CF>(9W9o-=W-dd z*nQ=cQdoB{VCYr*xx>&?O1EeBDs-Vl{Dm#HLHTi=<5%(iF8G_^62YZ{%LJDTGVY2H zRtjGwxLQzkWULXgHrxBZ752()LkJs1a)6fUc5e#7FW$`|Yzbkj@a=-z1iJ_9a{eLw zeW>4V%noK=pxhd$G4Y!#EknRZjjKR$*)i<9Y}; zI3;`oZy5JOco4!1N%_aMj)x&U3Zca! zrR+GRX3+JRGinG=nb#@hIcs!Bc_y6RMBF)grE<&XND3o4jFd1CMy@cbjZkug?TJ07 zU~Zq1K3OTeO!+FO+IpFiTNDP&Q1XRQ?-!+D7(dKWNb-kKJBL~z3~sfN6bhqo7)8S1 zW;ok_+8(8-@R`pvN=k%ziioR%q+c?O_baBC3ZrxwWkg<9@Fl?w&opY56JB1B-fLyk zD~3@ijLKoW97a_ZDU1L|ZWynI!Hx6@P25$&_M2nB=XUQ_+-3akF%2@RhjIFuRx=Fp z*92>X?Kd&#eRNQn;BqTrq=nHojCaCtgrSC!!AgZOYh*^tADzxHT+D8@;tnG{j91Pp zKkZdm_pI+!@;YH?VKfb+Ss0!$UJs*9OK0OS>N1_pj`(NphHNh3^#vOUK6s|xd#p4H zg9;n^x@-4y|FlJE62=>0xOXTEBTDpzqj?zbF0p&_?J(X9qxk}*MHo58XIN?Ox5DV( z#N9G%ze&=Hx%WzcEADDdi@Kw<;v)GbjNxHS4r59fBUsI-zpW|RG1V-(5(&{=$snH_q6sf z=7cdVjC^s0T{Dx$e8xSUgF*=Tk3xP5V}=mg8-*NVvlw@a{%%KR`EgfTCS zOIgm<&lO5&3}w1FS=pc2CTEm|g1-nZ5?n0EiY$?F!~wfBjCRlMiv``XFqVsaMHnl? zSQWZq&A+Aw|(gO9zq##k3d?s*D@BS+fnlZ|1RVZ_4NBU*fr0! zyWBzoX`@0OKi6)iq>X9r zjE9j3<9K#x=@*(6MphUHWH?j*?=TJuKSX;LayZPB^Xb`cuXV|roYf8 zA8>HAM$6bQSe^>wA2w_Rt0FiZ#+fjBMbJB9Pn-X8kVf!k1ZTrI7sh!h!_6>{zQhIL z7um~UT;^B^;~FRYFfKM!A02Xz^E$4EL85laX!An55e6mqx@7cyp|$FgaXY&%Z%8h8 z#Ctc4d%OgM@gR(cVN{9W)d(Ji@tD(Z1Vtiv62?=`>Jj9Q;8}JGh~Rk`FT|T9sU=5n zzqEZFPZ96<7q%7U5KfXag4bO3ePtez6v&q66_QUde*_yx$W!3#&_Y5sE=Vpaq+|r8 zA}E#}T0DXh*}Pv)JMq#Hl#8Hz1ZA@2FGWyR_~iHOH|Qz|uPj(GTc?tcQnTz%c{zet z#CxKdy^B&+czT4tAwabVsyTY$2gtB6u%?w<2g6L8}Pfj^LdL+DXuoV|F^NBWM#rTan!T zS-DU=ZP^R0y?8rB&{0D57g{HpN6_)EVCM)pUnjZ;%ELiV?!nl1z=ko}@h~SU!)K4PlE0TVKpGMF>VqbAS zi(u%fBwi~AZdV3G@cA7lr_(PZ_$mVJRpi8tj%m{vpU5={CH#(}!9;WP#U|$3^QC;e3EiFf};`CUF$v~p?n_1YdRb4-3yMtCE{_8kqCkp?EC8m7aZq~B>%(7 zpT@??le0kt|3+{8c9B5T#nSWJj{6hVWW~l-G>nK(gmQee$#@s6&Y}3P%*Gc!wWVqsx`2OWm$0 z+@hZ@SSN}MA=Ixer0p8FCZyr-Zch|>S11gs7e)Ojem#WW4xvF54Wo!85KW*_6pf?U z6T{vZnndwN6je=BGto4PW>NT~2t?6bYW-Oh1EP2{iWX746-Dk7N!_F11AUr7%P3k! z@pcrgqi7RF=hMo&O!lDTqw21qV9=)#I`@q>vgp^aKM-(4K(KCuO+mwvQN^crW6dy(LaTH&B)m~A|cdDN4 zO35{L=*zX#R)y30*am~XEN$Vmeo=fXgq)%Mg|Awp(EE85UqrDmieIAmGK#OFd|MTh zm~0dSX+KeniegX{gQMUlGb5rH62;J{J;1*qX`VieCb8PSFJq_cOVfu_ct%M%r{+)b z{CNR$BW;Y{h&w(T>m!|h$ zgyGf zeVjeYs=S^CqX@S#dEsCW4?k#6s1-2<9*Ts87@TTCcC~ga3=p7+*Vpd!!VWQtx>G}-iN{XkH=rc-b6L0o(Z|v@V$wY2=%9a2lyZL# z4<)rt)G+RPEp=8(SnTz=UXCd$uggD=%?-1u7)jkwl>j*iRVx2 zXyT0q?zT*%L~?r*@0e&O@*W2r!QyGnBlc}t2NTN*I_GRwI+@U}I$QTl>uh4WROCGq z@0%ECVvvchGz=48N_O2%^f2+UiC!i?FztEuL(`skdkUww{94EImd=mZZe{E_u(yd3 z_w7mV6BB)eb19Ybp0lqBPLKTrKNajR_?h4U!OsP$_JxVyVmArX`O3uCCSOBJSy42t z$5C~#i6JyU6XV&NbCjVbzA-V}#LSb)!`NT2$2;XCq>$g5_6*EjqmkkrCCI{$HZdlf zj}^j)q2HO9U}B1isV0xVNSbJ3l8MO@%55tq%h{N#(0`VuGyU&POf%7>bcW-9?sw*? zyzWdlv2vWP@RNxdCia@x$5PSeO{_Dq-o$JZb4>hZVu^{lCgz#=*~CH<^EqIB%G2ht4mc^ zy=3OHxPfc8i9KwP@9kNI2lxGa%(dU-zqAlD5jUZm@Jhsp3B!a>c*um`M1aNEtDK$f zoVHL2n)vsCYxH>K2|Tal@PtLJNe<7Z?P}YEBWl9@Pcq)#o=uprOq^n|O=OukVDgV$ zIBw#gi9;ria@=uX9#N|NtNbM`#zs4A;)rm{)2};d#>|ujo=`N6AEq@KubeP((nRa) zj{oFqvs|ZXb;VN7uwW+6tg(mrSrg}Iw-fDtq*{)(b_&5Y%0&~GOf-n0VGNgPPMnlt zs1d_e6W2`SkD)+}U)kUWC*&9q!%Y*nOx!VXmu7z^=}OV$?}sb5Y4$H1v(wdkChl{- z-Ksw3ytG3pT+jJ{6WR>rp9QKw<0=&cpD$4U zQVeBdczKmtp6M)8j{c;Si-DWrlU6ucfKKgH@=7sOj-e`xBxQa%hF5*ct(Tpz#K3}8 zq42&+@~U_TT~+@`OI~@we)qL{j2~$#EI>^bI|enzAGF!kPmLi>h$2YIsK-eT;oBbD zcYH44=`l>3Y`2v=hPf?NUTZR9s4YQ#uOyAm;i(hD%p4vq22Tw1zAji-u%2Lj!F4%2 z3~dxcW9r8+i|hXw-iYDz7`}+1X$;L`=nzB47@EhhKZmDf46R~#Glmv1ycGjK|5Pr! zxS3og%^l6@ep?FgP7LkXhB35>;bXpyJU(M^E_YjYN7;0e_H6u}if@ObMW1xKL2!49 zp>qtM#L$;rEGaOl9x-$gO)9@94=}7PA+z3|+s&Zsadx_$r1;F-(r(>lg+~AxFmW zK~DFe7#`&Cd=tZ9@eUEBd}s{Agtv2Lu(GWVyNAaxB4&Rw|E(a?CqLC7W0a&eI)*Vq z#tM!T9548t-~_>mf-KU3m(r)izz>JNrzONNRX8if@A0S8v|>2fEBz;Fq956J<1=^$ z!pw8-f;l~u&xqO2n@DEIFeir1F>Ij~#V{|1)iJDzVSWq?VleWhEsx>n7$P;)g@RRb zdidmm-d|!^Bogw)LVk_mHz7;1#N>{HXyS7R@{6XXtaZ1@1!*-Ey z=A2t!-4Vmi7O0Gj!Q~cj288a(jlkEqEYb_h!_q^^|NAl?~GEdU>e)uP>lb8u)XAeN$6q0BZ6P% zw3iS}^LPv=I7`QHjr|+LsTfX6jtu=L#`lWt9QiOpuk2(o&ajtbI4cU@=k!o=E{5~s zCBG2EMd6nOFK5fI#O&KEDqN4@hBV-9mR|@T=H80ozXu|$(fKbj?!<6cihXUM^Bx=F zoHFx?gWuOYjNuXcC2mh>k7IbkS_pp{!?PHYXRK9+ zzN&7pltp8cmh`aaWWmiaTJfEMBMHvHaN4OTb%b;qP-NiR-$w zI2>_%VM(V7;cC_uhdYjyW7E^)Xuvj%BO{L5any;UhSRzGBj>rC9!pGj-0ENa=C01eLD_MQrbkHqjMas<7g8{Tai%MF^+e#c{?HP1v_wvEmo+|NxT_r zoaFCHUQDn{9PbIQlgsmd9PM*?NV><-BaUC<{C*H0#L+X3(Q%9swGZR?JkB4L;v?~X z97nG>>Xo<4*;^!i1Y?EMKVj#_K|ynm@wIpd z#_>%YlXH0niFdHz5J6@)RLC&FsWX+McO2CGHam1=oTuEYRd%U+eafgfR$p-Sd8mwy zV_Y0l;+Pu8_&E46+Qc{}#qnJn6XI|_QVxwt|6`Y9%`MwDmdSnGWJ!<<_3z{SiJ@yc z%|j&9;^;ll?xRBq^+y_ia@vA8eu{%$x*0-d#(DE=OJ--w=LnfAI4_R*+42>+JU>e! zOlKi`Z=5+@7nKN*Pwfu}sKvK|PnJ|6bS1I99Q~ zwAHze^&(%xroN-Bjbq3tmG1XA)@5_o9@mCA9&K=39ig;6?${j17DkCI zUMIKbMJ~@i4uM>r{T$;$$aP)?gd5osUmWE{IT%MMjtg;ILB#x{&4$vTPI-+s@ zDg{ekQB5|EmLB7b^n=0|A%5j+v9G9!I4lVzub`+0*}^PU9RJ4gR~(1gfNPaCO_Mik z&LeT0jN?=sN8_OPnBd=n^d1*-;y>XeMZcrG8gl-_21!dlEy%-%$@`yAIvdBiIL^nx z_j23kOMCykn*66TvR3Jo+jA+7%W>R{<5nD3*zB!UDqN@6=eQcjkzwjJHuX+r@O|gF zQOP%?B5zk#KgjK2HQ9`-Cn|U2xX0-?fj1KTKot*YBncEt;30c0&cClBPXdpnou9_> zERH8}H1Da>ot>{dkJ~SSCnu1SurCuY;z$xg&Nr@KKCD2zITOesgvTuGKI(jLf-_eF zo9f$_2D-cwR4{>jLh=h15M=0>+@3~P(1;cD7+@92vWa>keUh9%9f-iz?B1o(nR9O zma9UX3Hz-chR(_DAuidZFt6HDhSw9Qo8Vt=?IzU(J%Ue)xOj+7y#(rWw?Bc#2{aIS z!vv0xwp()kVke(|7C&kCtaoE_^*8M8g{BEKOJG_8(-UZ(z?%ttnn3>qS|spR0`Di# zHG!51v`V0D0`Da7wxr33t?lNrlWmj0#@rq{zEHu}UD_qkA%Ttwv`^r>;wja}+f!Mm z1Ue^hHMi&81QuL&nWD@}bxGK-VZ0|nTvt$`TLRq^_&9-H3G`swCeTxI%$vu)`s|6g zxhx_1Fk#;+enis>Db@0LdME66pXmA~(1)hdTID0%PgslLZjycp%xmgo=poHEs?QSm zB7rXx7?53;&lBhpvggvT68JiS@ho`)0}~jOz_0|qN#Ob>bujCju=h#c$m2P4OZ6{x z4o%=mOZB#;4o_f20;3Wboxs@!_5y~x5Z@;3{gaV`Tv3ycNnrgHbzA~t6WCwPMYmy{ zozAS4Dz{lCBrqv~$q8_qWn#kqFq{XEe3-{Gg@&5IqCB3d3Ghs?UQ?VS^LYNqa&#z^nuoCh!Z>VU13?7Kof=P6Bh;8VSs22laC|eNAoK*G)M& ztN(Mh+M)z%6jB!xRrmEa?!UiPeof%F1eS<|jj$qtrNXJOEP>_1*RFKXyHfZn!8@vZ zwU9M}#p-ALE?KNg;6gq7lD$5Gg!C*=mD!YlHvuDo%?WHtU~7WEX~r(Ls^;7-v34Zz z>|6IA39MMGR-EYkA46w2zxvVUJ838Tons=-KNHxUz@7y5CXktc&R%Ze%G=b%i2K;= z30!8=g`C9pXPu|+q%#(gCGm0gkX+7|bNOlZFPs4mgpN*nLn5b6m;>a~IwWQSu>`(7 zfRP6fXBB8LS(uOoD}k&8lCqGTg#!s3e=fZeUoJ>e88yq)EECS+R$^+k4Ql7(c6Ld_Hl z5S~LYXSO_-1@~Axsf#b1c`f9#(CtwA*#9|p!}l9s*NFJ+;$g(n5mcr#Uo1vsfx%H`1$-+_hh!tZvyeQne;3KR2ssp%%Rs zb{x0&&r>aYS~yLyQ0`kNclDngQqwHd%j$&u6*&6MZVZ+$8zT!t`10y}8_9Sp0!I##{K#!iG`KuPh9) zFqHksE<30!-tHX8mbXAM*h2F!({qe*j;!w*W`VDM@nOL?mc6-6KHTD~4(RihlixXh zYuTSb(v1`{N^rD=F+#>>hmNywd$vNg2^J<=m~CN>g-I5E$m^L-wD>o9`zk+0kYuWm z?=4IdGJTXiY5!>1d*(k`_Pe;e%5Zm`WQK*ABALZzvFz39H#O9TWnFVE%(t+>!aQbl z%sDJ)8lS=aY+>p+h3;1&3oZO2WRc)v!On*LA}e+3uU3{?SZ3jrg?}t8x3I#(E(?EJ zSZQIEWk06bW?{93H5N8n*uw0|KxmG&scR}{rIyQo3zf4QMfo;gIQnVl=FE#+b#UTiZic#&YiTzMGDCd%YFb&a_oc)`8>NV?4e~^ zh*;Q56B?r!76$KhaNlg7G}?aZA5=00bwRI%x;vc|`ZxgRW%vb20z!foLfI0&eH~@l zEEL_O9I+6y(C#laZXqEgPaY>9fLa#*8lnt2qP~*PlVzcGA?E=L2WcBAoiy=38TF7@5{>Q!3%1bd_D24@2r!(!)k3z?6U zCiy&7uG#XbLFKk(zu54YwYG4F5iQ)aaNoiM3tY*x=-|Hbp>ytTm9Gjs6ba4mk&rP? zSGRl~Zs$I=@Qm~PW%ap*7nc17JD*?QJL8(0*M5UNB@4)clEtqrkR!{s@Jd;zoQ0fO z$d!fMS;&)xqFE@Gg}hnFm&H96rBD{~i)LtrL(|g>2rnqe=&7TV3yWG2!2(`|@1*@7 zO;-VJMfHB)V^h-I-8Jvld%(~kC>W@uA_xd73MdMQ5(w(kS46pO61tYt~--eCIpgIdf{_R7o#Nc~QEnvl5X{4Z4nCFF|ttc!f z&hlPV5JE{sA2uY=38yAdVr4lE2EBA ztyZWj$VW_tM{fRZYT(7~hM82b9=aQP)uM?;l6Vq_7fvsFdeO@Zmltj?o}z*m9xt+K z#EX_*Q8mj$him%Vt!ixFOo^rE*HuX_24i#K@7YqUOIye3KQD^W1I z0jIQnUi9~>N9_PFmL#=-UcAl>>6p!HdI6pD>(2R|Z+h_-Q|QHTF9v(@HnVP`HdIV; zZq+-IfkOm2z{=Nb`VRBrT~Q-HrMWj0(BEg0Vi_NJL4zFsW$eZ4x<@g8yqF-SMtj-o zVyqYAy!e>q^@E3VX~uZ*`!Y2eOZ@}Woa06F6E9}RGq{k-T`cQUiN#*&Vnh?Y>W|-= zk6n{k=*84ui_g9If)&g_O#@$gF~y637eOzkdhwMPTfErn#n)a;^J1YFix}LC=@P|U zFJ^c#lNrVI)O62cJIYigJKKvp!_?Z$QBzcs=7{op*Rwgde4ZEc#ks(XGRM@bIG1O# zbu4Dada>GzHC}wjHsZw!FTQ7tZz`Qf3CA)oh|9fdO4!9NF3zN-{0A>qdhvNX*D5a# zZFGJ1iN<#uI@fx!&Wnw_k!G3vEx+E2R+ln1@HW?Kx+YbqU)Cnx^5u-pUKDEJWB>?n6Q09eiq#C#V=|3 zvY9G>4vO=T7l+gGU(-4jud46C<6ivc#cA<9!NT?8q!(uk=*J4^k+B;01RiR+PI>X^ zWfz6_yXTzYCx91TzWjUPXNhd_{MW}h{IF(<1%0XJ^P=_z2g%h8H+@51gxT8|$Ymhn zMbwMGy|^LDF)vb#%Zs=d2``dfP8h?uGZ;KV6@*RaYR7uNbIuAUcK|!*#d$BTuyX#Q zam~dAFBf;H&(DiqHOkNadEQ;^l1M1LEQEvR98$mP#Wk=bnU#WrVTt`=UK!}@}Kmy z507RtAXA=UfZx1F=V>sI+dv5eB@N^;kk?QH{Y4GrGmzgkG#8B@)>MGHfzk%b7$|F~p1+)d zgRf*>*`@-%T}^#}S2VzV*s2<+W}uRR$_BW%+opTYDh6Jd>D+bPNvtl`-h0}!&(%(R+Z$?P&yxoBdy-3&DD z>GAaNbT`n02Jb2P_=pPrvVm8aZ}*)84D=Su{RLk&(8oYu16*~*%{MM&xLy<9Pmn^U znZa9M$avkrKnb#EeCEiKS%VC`!Q9T5GrpB4?@!Lb2HrOCzJU)!=N$v@8EWurh=HL7 zR^G@MX5d}k+O3Qx1=as0&Mo9xY<_qSH?X&ZYG@-Q;D^M~IU|L?|3$_qgL@Nc+>DnB zqgnk7EcjOY*uWUxY*|;yr(HGjyC@lN;1dHwObj*gseuUw?iskx1Q?iP;5P#&418u_ zvVpAzwi)=`z!wI-H86+$zkw+RW*C@hV5)(ySUDwjzCL};OqSG6Gt`?^YO2QZwdstg zpw4URQf-!@{!C8m>YQz;(J1n_$GGU^d(m72%M2_xFwekzreU390ZYg0SjbEptrQlC zlaj>-mI(h&aH(K8x07DH>lMsB1FH;hp~3eCe&D^IfXCtHs)yAE))?4eV55Px2G;Q| zPGCK&lPrtis)WxA>aEXYbBV+z1IBUZW&>M<&=iByckv3fjAFZi9}WC$V84MKtYfUA zEEHyfft{>2M^qi##oH;U@0OgQbIn{O^t(L!L^9ElGiIKWT$u0q#lQgrqwi|R+3*eU zP2iA$!!+wvh4?Gmmw{u<Z4FnB@81SHn1LAyp z;ad|YfbrcsY9Pkivf34AnhUw_SPs5#(>H0rGGL3T57#^1Uz#~Hs2*hJ44gOAo8eV< zIE^wd82Hn`B?A`?WsS4N_`Y#j6gX-8ih)uc)i19?`_-ghdR;ScU2Og(__u-S``kAK zZwlTLye)V~kP3GVaM=aPKkSwbcuZuQcwpcm@5n?kQ+2$L*qNJnLim3MGE8Ke$Ylbi zS`d`mM9v}i_i+!eP(eM9iM%FG7IIqEbMl$ES5W8mRx-PQiGrru*w)^sN}-TgD`LW3 z#8cQ*Z}=ocdKEWO!bBAlRZWyMdAbKGn&9$^(k9B7C}*O)spePn{kg0d;dHeF)w5r{ zt5q=7WItNq3-IHzu4Jldhm}qBw)y)Rt(uAICK{R0Of>Ybc#wshv0Xl&v&NplkuO-(#w;#qO(CYqaQVInJ$(agku+_0DHzf80;(P36j zCljqrv=PnrCidOuG=8)*ad)vZ*~>*|i9-5?bJ~+8j`-XiXtSELqu^75Pn+0!PMfn% zqr9^i+&|4lv(JgaUM5~P@w|yHCSEY{q6mAKc*#Up;bvad`d(zO$ejO0%?Rpls;_VI zZ)SOVnwZf(o8%QHzL5SZi@-#0Q+=)1enpjL*zJD4kUqGO-q!??n_BlX(ci=XG5&_& z>m~*Y8D!$&kJ`~$>R%d6cbaKW)pPM2=OZuUz>PkoU6X2x|eAz>%}gP=zSx%IbCpu;Gvx=+h?=Mm{@LN zg$U=Em~Uc%iMisOXR3k7NFlxPknDvf7MWOT;`DjfViQYDe8(D6NT>5aH2a_9*(Aja z>y3ZoW;LLMPWpat;s@4S6Prw|G_i^nKGilbXTHB*d#-6nR)9n~46S_-c{>{aCSfqf=^HnE=_LWS(73hTeHffRUU~-yS_EABSVyRz3E^g3K@%YpS4>ruzSR=};!8Xr2?x7fhTt)f7!$oZ`5ujkDe-YH9zUV*HYc4c8r)nRR#75a%@$ z*I67swIK;t@+~zw?2qru1++&3~*Re`sYYxiWl;jJx0*S6E;1ffGLD_MxB; zg?z~4!#fdYJ|FV?kk^O#h4rqJTyI#;Cww6CqO*YT{}tBhEbK#_NlsqHd??~WQE~3C z>m;Y}kHUI!ABZJ)`xyR^!K5h59NKBy}{YehYCJa^ug_e$A?NjRQ92s z5A}Vh;zLy*YWYyxhiVK`DOU|2YWh&!hq^l*ys|sHlGoi_rop8RR|@OzJ@nM^sU;Y7 zed^iAM>cWWA$J2G8v4-42hE53mt2J=X7HyUy|R38_|QG9dTd_hold6&4E(OSd|Ygz zeZAa~?L!V%a{18OhsHiM@u9g7EhLtvKIlF)lf>{}F8{FQFCx#5haN7MXekM%*`qaG z%j;yf@nLtRTugIYiK4b>9=Ms&-iIfB=-@*~A71p~B_Ce3JWu(sdby+6x?HV`=ui95 zi8bVx?9LMK8Np`-pA&puu!|t0dx3W(#=H8^&4<3cWm6kmCbPQ_Jg|e0fSS!bJ$&Fv zB|Qau`S7xkR|I z!my`^PD0}oeAuvB75XF}KJy`1M4#-#m&~q+`*R<@@WCpc1=gUfXCBFXoP^E+m2QGHTTeYp=Sn9l*c8Nl~G z{NTd@KMwk_(uY+(^zfsnAFF*><3lk&iu~CL zXpi%e?i9@8q7@#3v&V7%!4`9cPRNUOsWqj*>HR~$f}r7bNr6`a7g%J z!CzJHk$r^r=PKhzeK;m^@~Wnj`oFOnY}QWr@VgLlYMy5Dd@y`4+10SNOj55O{4e44 zf$w;)8S2fjlh?^9a6UFAuk)F2HNOwU0Lxtnc}PfDFd`Ub`z?`0FTRl`Sf$%Klgz#G zPC6}dQeq29u>)-3qLZb0-iHf5T$JMGAQ$&(`O}9hJ~h;Ji7kC#Hm}P}=fs@%HfCS- zVR=#g8av5d8p+kg!kqRS$O4hr2%96Ui+fZVUONsD4Mt;`^TaLh}06>YIOj z_}7O!o3#gQ3x4FEo%v95>5<@n=^V@Ot31r~BbN|z2+8e76WdK^*Ne`!wbi}kqY=N# zL-McvS^+-_`cX&{R)pkNcVXe2Yea>jBH^MK%1iiB(vSM$TS~C1AJzOQ?ME3u%8I0t zAC>(m=SO)zDu{$*;#`bYQ8+tu{ZnU&jjk$>gO^fW^t$<~!B+RH(b(F4)bOLG_}22{ z!Xx+PqWYts)?L>vg#O@c7kUc6<>U*4ddOnpAEqq=_F*h3IK{Ga;?_X)XO|<;RnLbdUtJ z_M@F2`HJa$M{46oTfdq`UuSJLx2d79y&pX7j)dv#=*LrjJnhG~N%fN1$&b!{JfFUc zD#i3?{OJ2eHm_%eJSX_mp6o87^FmtlMJ8K#*R-UYAKlZuQ+8%AW}_cV{aEHl#-of^ z{FuP9_M^8Sulmu4X8riUj}d;n=0`t2hWatgkN$oP@Z)VilD(a;`!UduH~o0ak1Dxy zvWw}1{CL9;lFKD>x)#&>^OT~KuEC=GVKIGei)@CY;BYuANnzx^-Wfaea!5t`qes=uLMb^ z2$?F#M>8c~`!P+N+#rjuh0`VM$&a<%e`quPm?hO_wjT@qYD)9Be$4S>t{?M6ZTbtD ze4(1}hj)czfnU9P%_^qnU+V~HQR`#A4Tc7EqqZ-A34x%jVXxdh)VxWbR` z{rJI;C(f!Cx|UA?k+0$-fR?QccFSu-Lf?1KD4liUT<^yQ)_mb*I=VOcQEz~AV=>*e z)Valvt$u7{X8N()k3GyrQQOI?e$TnXkDury@<<3-xkj=n!?}yqW2Up&KN!LNQC@gu>i;>S_Z@%mx- zamrrG>#IqgT@-L8|&=K@)${Fw4Y7767q{OkNfGA9n{F)zk{kZ4H^|bz9e*7)` zhTu)XTY|R*?+7yN6H`-BM8X3o>Es*Zzs2+iemoT6Bew1UG6T3YG3P(F--&9+ ziCh8oaGBRyarQjKJOShlph5r@1IQOZ{s2k_P)gLE2%vBPMFQB}##11Gf+8$Lo&6sE z5F;{pQ4tmk;LvB8ms@*^2h;!}C*hQ!&50V9$@B44I)JjGRz{G|^pjO{$_3O&W%+;_ zBK+%TjX&Hf1yDJF`T;Zuph^H$1E>{1?EtC;)MoEB0;oyCy+;D-C4^D)AJOCE6&|!x zyN=We;Im&m^#Z6Xu~1>2tV=CjTyGO}HVi-$c_TsVipsz&;r#pO5W-m80eAv@%HWj% zvIEEo;DrEQWFiA-5!dUD7(P;`&PgbPb@pNSa5yIO6yc59v0R9PJh-i)v;FAD`3Lhr;ZUDLdb-fqB z@BrQq-~*O#0HXuwQe59!)-|lSJ|cjT0gMV@P6yXl#r4<2+REa3yFIx+3SdkCV*~g& z0Lp2E3gZHZOmiJR`~RBcp9U}?fa3xDCecl#asXckFo_i=fXO1955H~jR){U05b!aC8m}K)M<~i16UeR z&-!nf>;UElFi+(3S+cV{RN%#5B@0AIzEH>_!Nr101ixc%V`@~07uT2Ze&>0(?coZE zh>4-s$^f`VZyj4x0INiqC-bfjU`+rdyw(PAtGG_GA%KkmY!Bea05-8THS-Ld=h-S` zv*4D1TGvK-krMj00H$Rr!YFnG)D)Nh1@M#Dr{vStIZRJI`N!CMytX@lIwkZy0qhN+ zbqRf60LRiP{5gRA0sIoc0amIK`p){Eqe2b}9uhpvr+^SD9AQD1&`G8X77wY`ae_H1 z2CoNjGJsP7#F*3ocN4{#0L%b<0sIkAzio|x`o19XigV(ST&$DadDS04Ab>C{*d~qh zD>(mwA11*7LIH4&!5~xPms%u%sKmmW%$XHdNp~WEWB`A%3k|>u;O;feW)9HKH5J8K z7VBOo4PFp(E`ak?E9s_?0|X!J(JnH>OXzja$Q%#W>WyCqKZ}SIXSz4hW3J38-5O?;tc@+>+kX~h!lL|#dtwa#^9Y@h1iiwl*;z2bn zhlCfGvvF2!=^)AkQ8vi4-Lv>+QZ9)6?c6u+xyuLf)(GbpKe;Ld)yQD}y&Cr|sT@R= zAnFEDFNmr^R12aG(|<1GdM@Xh_Sw~gsKGQ}aqRgggKZpiFYgANBwIM0Uz~O{31Uzqchevo_q5hVHn|=IC(5qhrcu%&h?YTg3!-}vt%7JB#Mti6 zzZT`RVO&A=;`CAw+>o|i5YGxBZy&^yL39X$V*wq5;29s>BJ3&geLAhvDTvN#{tR!w zR2BpBdQODT2hk-6o|^rF;ERHE@_l1?QCHU>&OdUJa4@<@5dDJ~5Jb=5|IgU(6~xQJ zUr9@P2l1-#K50qcAYM!JenItbil$xZWf&cypd_?LoH1bNF-gZL`VzZNnrsQx$7YkCk1OX@R%m>E>v%d8;g z1Ti;=*+CSonnTIABKLO8eyyH!UJ&z{o|O*r?wWH!P)*2LC`htM$l@TDq$S@;tD)EO zpgLT8We}@^*jZ9v5ybZ*`9bjFP#1l_(Oj#8*cim7pgMbWO%Q8?SjUDuS^eBz&wL)E zZ4ey2!AZV3sP+_M39>iX62w-vtVubatjXTS%*^B2E=clY5Icnbl$QKY$WBIdR-?k6 zAod2~WdjUiUl2bB@kdbo3Ev;YFKn92*TvFu}hEaWc(M1#w#V8NtL+7Zv_4srSp5Wd`A6H47re?(S#JA4DXGXb=H$ z1_eWGbk`hV;VdAkasN+lksS+yyB6?@3rPf#r2X7Zi&gPgjdGr>aW;r^QXwz1m9gWU zqh5_J2GwKe0=w3w&c*$me+K{mJ?c^rC9kO64zEa%tAhM*+~ph3UqSrM?lFXNA>0V! zW)S}d@gRs>?2e9T_oeOJX7|gE=xeQTDV>{~-wom(v*>9zuZE@ce?;fT1ocAxFo;Lu zEFQvtL1cvRL0NC-tk;G&o@Z>V^Sh0q%A!ljimoh3r5D<~O4sSrws zP$r}{gW_??k2ioKDK84OLZ}@=1>qG#s1!ow5V#9Rl@O|i@G#70hxTWS%xWQ251~c~ z4N9vN@*z?)ga;9K$I?1^k4IV^vET~99YWm@>V;5WB(qBE4u%S$VF-;xk|n4K($qjP zIHt7j41vnLYFEngh;L2^jYG&5-g>!u4`~uYyXl!cKet&3O+$EkT8=KrPvH4;9Q|&o zx8If_wBoC87%jtS9YUKB0wDxLXv?r6tPEjQ2<=07lGz)=haq%eafI+j2yce)6s?8O zErjkNbPAz!2+xPmC4^@r4bO(~Tu7}>;w0zC%bNHpJ@F^)1@V0;gsvgH$k@9%cjr~- zT2AZc?D>_mR;H86JwoUi!s{%r5PF61atH$$`&{i@3+MLI`YWsq-JQKdxVFvts>tcp zhZQ5uUlYCuLEG)9*Ryozvb{UCbE7QoiG0RxlIZ3Sn3X?}jj#p8z5CAK;x3 zmP~OC31RL-N3U+qp&<;vEk^$>ZVmH!X5ea&!|-E8NwU$qZH7!ktAkeW?L zn~x`q@$c^F5IzcFI^`iwCczlF{Vzfo8^X8{CNc+N8RJ8U7tQ)aER)pzLHjg>39M0b zH2#j@R6W{ZswPR=K4X;=^0~xCIb-}XgejDda!w85>ky`~;mp&%3aQnROk1CA+G~F~ zzX_?SfU7=qaaWv~tUn?2so6y(t4XN3E-_mBq%sC;L#j-f{jyO-`ocy-vxN`xM zJ=wJ|ghe4Nmf%YSY3H{l&hLaTO-q)AusqFIgz&xa9|Wn)Age=I6T+bo4u`Ndgmoe8 zmBesy^!gAsGw~s85Xr_6HifXl?>;h4J1I?IYY5vy*b%}{A?$17+RoNJBWL?w$B*JX zb;(WP|3cUq!fsaPGO8I~F0Jokmr_QrSw`nhlC`I}_OQ>fwBBX(eIfiz&6SS*(yR_h zq`&ZH%jk>B=m*nn?WZ#OuPm>=YGK!j5RQa!G=yU!`AzV62%$3i%`$q)vU-cMIyL!9 z`FjW_#o#Gs$QJFi@G~smVF9FhG4KCXpm!y(DEEdjMW!V_%W|C;PXF+9lzaL%1S@@~a{6pE=22A^a`&{}JTOq8mc^f8!>b zo2}gvye)V~@NNkAn6?$!_r-bbfQQr4^zu3XQdmj-+j+!-2qAY^t&rucq>L~SRvmI? zSdGr)5@aIzuZBWyqLoK{xeFGZ`NMc3jB;U=52HXBJp&C3hEXUC&Zyy!pu%Ak38Q2f zrNT&F$tW5|@vu7Ef?rIhOF3GPJ24~1WUYlPtj2y93 zD~#G<)Cr?*7!AW{6h=Lf*JlsBM&ndZrib&m8i;Uv(HstHXtWbnUqD%5IKr4+R^Qmu z zmuzN5W#=Ep+A!9I(I$+xVT=u9To~=bXwO0kqhAh4DfdFNX1aSoPKHHoJsjv~-fQKUvq!`BE5N!>T*& z8AhuHZq8Ef7UnRw>i2fP;bBMJLwvavST7-5@yedCHw%u*lhbMYgmJE^`kBd<9etS? zxYmB95&MTRAdDel43*@)9>$wtTr8^(3}cW;)|JV{^`vivak8vVLa(>N7#zmiVZ0-n zlvFLJ=PjqahK2EN7^A}YFpT%Y_&I;(`(b<##_%v$Qrw)43E(IBh%iQmaq6Mx{Cbzs z-1T@{HhPVg7(WiHll49l!i!ivm9lzhdlp4adKdcE;!}yBzyoB@XFs9M+Bu%fVR`!v6 zBhFj(JTtVJr+|wP-F1 zV{sTO!uXzv*{m&L(S)%qjPJyk3A?)6!PSVIGP+zOT}P<``a$?gX5&F^@9hlEAYCP# z&ZV1FLtDe@bWXMC^B~x&uZiL@cJc;18Kfy zk;?GPLp-;hR%QKb7@U{&Nx`fmY!v@E*Bx~n597Bm?n>HDgzF@lP1s5Q)3T zKM3RBFm{wv%V`gn(;u?)yr1!iS#;FFnZv})2y#WRCxN{QAcEWx3`}590(m0H8$s6u zx+Rb=g8UJTkKvOTo`|481n)-iUK9l*C=|hh2o^?AID#S(ycNOVhGEjB%Z*@E1!gRwM;plJj>Bj^=@ z9znARUX(j+9zlx;o)+FRf=A`_b`i9Xpj8B|BWmG%n+TTGaJ7wKNl6c#yyl;9J;}@| zuXhmropqcH)iHvnM3V}15<5lEIf7>*cs7DA5svj|KNnHU>YtB*E9-e38}A`f@`Cub zDz8)LB}qwF(d-sM_lR1dPqiKqwFZCi4z&jV<%pW()}QxMUVkNmLq(juBY2hf^`f&+ zgp*the zky8A(%w@lCM>xcZNfCS&!4T2>D1wifFyX@lS;X%~@SgDDg72s0A4D)h_{g+mR0JQU z`Dh`H3V6l{880|iaGc<BVbC1hXQTo#7&%8NmhvK8&nUTDUf&+UkBmBkoy@C4jvW#FBxZMr4y{pVR|M3jF9Q~T zSsh=pH-dc;{L0*m;O7YT^G+i;C`NvXfMKag`@}9>H%BoJikDrwaO;6?7h(Ld{d6a5{oBLMZ&Kf z1Xcug1c3;G%=QT4tVJ@a8;T&z7Fxy?iKy?pC^OKnb`jxA5nrMb%=QX8zxA>!yH+lA zCRu_H9sK%BMQ}EP3la5YN;Q7Bo@1`Ibe@lZtC^b4SD%&_#rIFaOM?3XF6v)p;ePJ? ziz&?OxyH_4<*qG>a&YebnZovC#t&N z`w{%ZAQkj~Bls_Zj3`bQay{T3u~%UM6>@Q&$<%gk{-(=}B3BfMB6k!;D(c+NdG}9_ ziUmD9CvnEl+E*7ecZsaLVl$s$e!(XMsm8bp39lYSjVKD!NEAgyQc|#36vd+`5k=oE zjt*y3yUUREiKWE1bQEQxC>uq&C@Mu!Ig0X8REVNt6z8`(Jxx9JE9y^H)QNO%GF(-n zs2WAJC|(uGl0O}%T039Qbkj**Gm2VKbcy1HC~Av+EsCrt>O@gDih5DhkK*qWTB9f$ zMA0ycCo|noedheLwsT}fz1xSbnH6>JT}%Z>6wWBxMbSPAR}}6jvZKg};<^29PgIS& z^~{w`PSQAvCQ-DAqGc3KqtK&h7De+Y^8DxV6-DbP+CGxycNY@YF6@`I^}#jig%d)O8Sr}hDPBXPU@b0OncH@L7Uw`V*9=JtHTToOV)LCC}?CZ#2xMKL+eQ*Aw8h=nhsn8H$cBbyVq zrV1hdO32qyOiN3?iDJ6&8EJ_&+cP_gZ=+Zd#rILniDGV4ol>V-keNL%im&E)=10{) z9!FXiFpKuP7YZ&Cq;oN!0#SSy#Zr+h7hIP1Wi_J?oj)+y?K~T!D3;r^Qur!C3Rg$5 zCe7ChSr^56Asfl_!`V;Ruimk%8vGk+(Q8>LS9K{Zn!aGg)_C?$o z#jYs!NAXJ(yQA0>#oj3Pu@uIuhbFHMC3F28h26*XX}`>>rE~Fngq&-T4@7Y=ibImU zR9K!@=^qv+7qC<9XcWhy_){duqxdZfe-wczPOzC@a6G!=_#=wnqd3Wyb>4AG@HFk5 z&!Cgn8Rl~(outqOhc^l%iZkaOW)wb=Q%L714hcpPio)VOo_B=VBVBdWKJSP{5fM&j zRHAzP;;bYfP)R=@#W~^oB=!qYTx7B<>5S_}C7tAw+!1f~ zvXCoLTorPSz29B;b-}*`{}!b1Mie)N-%3kvOV>)Tdr{nHQe!9|!#`}cQDnrB$v5^! zIS<6_L-xa!^?H@{N8ZySkatpBBFW30qvSgdj~_t>odc-6W-A zC@n(H!z`2bEgMs3h*MHQl2J9r4I5E0hDzdWR7Ncas~kfWagvu^ky$;48Zk7Fp+yWe zW2hxwdJMH=s1t)0LskqgSJvysP%no1F&wVzT5{UO!!H`d&@jf`EM3JaI*Gg*iPQ11 z(;-GEX%d4ohE~5iT`{<0@WhZELrx6y>bh@ja*nL5FXV6Ax^7;Lc?*?w5{7Cjb{J7J ziEdXw)#sLCvwcjRUfn8&8I|?cF|>)HZ49d`>vXmg;i1ZURGd%7&>@D7F?DG5QxfV< zWt~T0KP|l67#Hn4BQ^)e@OBK(#_(JW&&SY3gneRoK}gRSCd_ue7{g1<#)_F;W9T9B zZZRDC$<>|3R7Gz*&)ILDdNgz7x|is`Ecl9GZ$TP)HHI&y>C&RuQ z!+S9dk74MB%=ek#s!lFemwl_$1q07Six~= zUk+G*%KM7p>lmiRFj0a}5u6mmXE96`PUDGG=I1edvq}3RhU$~FF9ioz(fRjpYFg*3 zn3|G7bovYE3g@m>I)*;j?0x&46*#h~wKB=EQJ4hQDH%%eoZ9i5Py5VSWq? zV%QhM&oL~FVG$c$4BKOBBHZE_*2b`o^@;{#Dx&XVSelM~Sq#f#SP{ebB3T*3su+Gq z`&JKNweU4*$^NCPLh{fnzN4;>VN(p7W7t50leCS@iYYD;zs7JRhNCexgmjD@i%b*c z|Ig#Xe-q>%X39^-a4Lpq46ztavy@{9#1N$Ll9~|shvb`=tx1R}=#RlC*~>rD%vD}o zdaVEHrhI2_3{dNp@n3yX1UBTT|bn<^<_&0`9 zag>hZK@1OL$cQ5|4sQ1Hh#ljgY@W^fUrZfls&@Hn;>;E2u4^b5M~C6g+;QHT_C#D& zygb6&!kJe{KEeEg#w|wy(cx$XH4DX6=@gEuxdcVxa7}X-jjJt>iV2bwkE2AImyD}v z02G#qqih@%;;0x`|DySy->jmSi=%v8&HSl2S>wcP4yII!qpB!Wj-yH(H>&8IjgwWw zy>zAX$gQT;;^(K(L#aWshI?c$!c zaWs_lGbKFsv{4+~l|_pqD-K5-PUc2cy*Y0rj(2)Hc{Ps1E!-oRotEds!O0|-OT>VdG#e1I03p8#Z_Cg$8DDRiWU-bLlbW-wS9K@HH z;V*eey2sIjiHu`N9Q>`_GmgG-yhej@wH4CKg0BeD**lI`)4WeyZ4gRfzc~8G@h0oc zD(8SWUXQEgt8c_HFs`;t92CdeeQLW}a_)Z{bGW&pmfPWSmzB5TSpTOsn57`3R#lzO z6-S-y1lG({i-6vZjrJdEShI6jE0{$aGFWJDYz;}}JqZQ6%|?6NNI za&kQm+v7)Zd>qFZ(R{tCK0c1I!pEiWqC-`E-wlm_cNdM)IMItc?Mz^mWA07L;Wa6a z&*GRI$LAuMBKSqx_sh8Y2BccR<(?YHS8kimLkeac(+< zZ{z9_xh#%3ad6kW@8aMf-CS1A64~?O_@b&#;e7F0Ah3c%kd{|q~Ec#Yk5y##iU0lw|HSue#Wt#PLcdvRsS)L9m4qvL1#`$&rflLtLo2=aPAa2pD%Z+>br#( ztEM-srtghoUmQQjv7hZL0cQfg#BqQlJiL@jscW7zk=d7C|z?6P}D$X!A90QckgCysxm&&)`0Dy-*$ z@P~0V4}?AKBXR!s7$;~vPdqb$TnSaNkx&nGUb#66AUv-iy(oMlfdUCsNT6Z@1rsQg zP-mZ&PoQuD1M|C!CQvMaBEmVPVR!=+U~e)0woeCnE)lF1WOC@WR{UTwK554 zAFC=|E}?p@vj1v)6t2wj9AB?hN}zHAwG*h5K$Qe~IkIacz^yW?Ce%uNUeyw)F1*+b z?OIV!%>+s}^=#PcsFi?siq@f;UN@nJ)Ca$m-5`N_32@x1KF2$bXhn}|uT@irYcx!# z7mP+sgAl&|WF;_Oyj%&m6L^-XO2Csqb^`4ZXrEAhT~0!c!Z%|M#I(i$3?)SF~SK@wK-P6^f9aPW~; zy|eIV1Q%4(Pma`{PoPTzFDCGEC-)1IfEWFal~N?P(zcKLW!oP84Lo0fB%6sD@5IQu6sAT57AfjQOH2gMr+yqUnf z1m-93Rsw?)_(F8v7JNT}4}`pvz>svMDtU@34%=UL?M#|KNI8>j?abgltwCiDV$_V z0#g(CDuJ)ll37BgCGd@q>4Gx^XA179CiCdH5kvytiiCFNBrsR_yk+XOd_e*W6Ih-0 zU6jCzG+!)aNdn)cB})@nCVYD#_woeJ|EetT`d)-TB(O5Axk?BX)+Detfpx4K3G5W% z2EmO9Y)arbl!eW#-U)0?hh?3ikcTo8w~26j0zW3OL%2~*|LL)2+DWxt!goKGbF=YB z&V32|oWNfR{GGslcK+fOO5gxH{{+s6^H2hZnT7;@6X&mjM-pg!Nsad%6>?03be>wF zQgtGMlOp*&E&sbru2aHKrzM$A1#|H-QHtc|vp^ z3V$T{pJ0Z_GX--A@|ZV<<&|4Vo+R=L$tRd!kTY+oP(XM=!9s!*7EYpw@S=jn1d9un z5G*N3%~C?zXJnR1OUfouSMIk$5*3qZF7irAR8GQ`gj<|dlBkx}uPUTYi_GdmY6#X8 ztd&IVBiU2rUQc3B5^p3iFo~AA8uUkl0#zH3ywla4 zsM_GoBnBt(b`o!~Ag*UV7@`8cBL-*pat{?UMDTy7bA~0cu7^8&h?_V(iT9J3lEl;` zK1gCj5@VAXm&C{uh)zh9-qcqT^|U0uNrJI|Em8BnrYF%NcLS0cNzA*H!;G4l#4J(1T3u(1vy)uS z4U##6a|P*SvRSzElUN`Hx=?UY5`SH(&uej#JFMc}77fS~-5V@RVtEpll=zAyzE9#e z;Xfp?GKp~i_YmJ&Lm+Z zVJ7j1NWAH=X9{I7t_JsW`9u;-%l%0NgjcVjdur&Rw7g~Rj0k&%Bw|SnXx<};yTMNi3>?wWStS;KLsxdE|y%q%;r`@-y!^} zWExFf6Ed)wDwMxP`A!lyM0iu2%-dVyye+sQcZ0hkzn8@QB--T8V8DOa;%ex;ct;PU zE%%C%u1z2#T;7lR6g*+DSS-5W@uZ4UT)>&9@A-{zuEWByqEei!K z6ts}VAQlQ)C~Tpsg=!XxSSV_tyoCxDidiUbp|piE7D`wcTSG4;SW<9a4V{w5ysQQP z7{_ll^l}!q*3ch&5i5#jB|$1vfmqo>m9&JRs#~aGp@D^l7HV3kWr0TOT43WeQ)BMCynfV8iPlf-GkWuc>mr!2TFcr3KC(Aq+_g&YgbEHt<9u!i2) zLQ@O6g(l*pq*P74VNHd+TJW;at){-Prry%R;F|gbk#DZ4|5{V0vyFwe7TQVJ_PmRl zdR!Eqv~aVg-a(M$XtkzKTj*q=mxY%tbhhw}#nax^Z9Z$^ISVgY=xX743ti+cUSt8) z(q9my4mt0LxlPWin}zOaUPHW^*3x@QK>BvArN3gKw}sb5=T#}4*V4JvN7VXScw8LR z?`NUEg#qb8q~z^dD#n2p28o3?B*^3JWswcGFw(*(3vXL^$HEW`LoIw@A!BXUFbnTm z7;a(rot*b9OsJ)kY^|j)sHKy?FY=Qj9AP0|OJ{AlQ%nEQ!e|TMSeS0%BMTo}m}p^= zg)ywLwe?=L^>M5iwe_(UTGrM{#*6$D3!e&^Ao34ttGI}tS(sW|pCZD^7CyJ|h43#0 zm(|v3jD5jj)7Of*+m_};>D3ukNVycqQl7FLSa8qs8iuVVJr)^pd< zS6d)bhj!M=ZIW!Tu+hR5DZWh>Hd_c-2wK>}#%STNg`z`!p;Q)(RoChr&vT$7ZJV6HBT1P)( z;i!cZ7Jj#IEN%8UYrg3GCXz&2|D=V}7S1rcME*FUKP+y1q0;QPU|29M_{4cvLQ$tk zT@?`(c-60~hb)9ywInxM*VUPO5ereqSXZZ$SBzCxNWwx=Dx}5CXJ;bZwvZAst*)vA z=Y{_%NaqD17X_JDmxNrF^w5_HxN6~=h3gjnvhcTs8gu~BB{wbHV&_~>zsuXK ztKSy9V}Tc)m+I=oYW4KS_4I!%{L6x~am2<0_AM5A+URBDk;R1=XlbLBjSL%^HmcdE zZX=fs*eGJ7sEyn<^4Q34;|W`J7kO<|lvbS2R=spN;RVEtz6I05LTO218|*;nRm?_l z8Tku92!m2*V7u^{{B$2zPbx(#A;8_k6DucxX_3*jW==(N$s#xpja zwb9l_JKm;^r);#h@l8GbNgMm>>1?p8>**bAnDulzdE-pU(-If+fs#%(I*TtA==Ge9 z=WV>i%(v0S#$^fhqKy}93!&QM&Uv7XH*LHn!a+9Purac}Y7WHr zr5p!~*H`uRCH3_oHip_5W%FkmhKYQ*jrVQ*SYLnF=Fz=4USHilgMVNnT3_ci(gq_M zA{6srHqPuWf9wvC+mfmYt2oHkR0!Zes>Z%Eo*f zGi}VW@vV(HHr6)KXWQ7{Kt0XLiF6X@3I;_&=K>plHqaMI{ah$syhlnHKWeH`f;8;oKt8+$|jv79McC+S%)LOM6u*v!na zu}2!<7Qr1hw%XX1ZX>L0+gUo|MP9L?{*#UW+1M$PE*5r4!)ek`RZG4G>}5@p^c=MD zGowqlCZ_fmR@#R8fwW~x*s>Vvkd4DO1~*i9#AbEW#xWZ=Y}{mJV8^vK>y(Ytj72z| zCv5yK{G=eWi^4ND{;+Y@#yJ~a8-|UTjW`Rjp>8s7Z3Jxin2infT@6)p3rdEEZSZ9y zB%F50c|}<9(h_Pi78*&|NZPQ{a$CsBhI&eT8R}d^{k)9}HvY2lH~Zd(`b9QO8&_Cx zQUhuK5_{lAs(RBPgV6X@8`o@Hmt?Ts@}iTzOcE8^G}3R`xNW0s3guF&Vcwx-8~=&H zyEg9GxNqYhaXu8J&cA#LNZVmVy&CDm8mShMkwRt)CB;at6df-9l0wlGyrM}b)fj1U2~J)jg%RnnrBWy@ z@-l){{#`vDKtx=c?wNa&{G)5!*$nY@uHCyDYQ)C=@dGp&?<%2 zDYQ$WeF|+-Xq!?c%R(Qish2n6bWML!qTa0O9a5_IqlJ#5M$M-fbuFdVIfZ9Zcs_+L zDLgAe<{lNEOMwB8Xgcu)k-sQmLn0(HcsEJ#kQ9cd&^?77DfCRCR|@@87?8rtDb)b$ zv*(vgdnJY5Likd_XG$O8eFd3aucgp0&DoG&=Z&W@SS$<@d?WRLbiD_Z6h-$w%dksu&RF(L>EC`u3kl_ZiuQ9w{sL~*8P zrhB@3dZwGK_&t61-S^}D`S+YU_dIp$)~#E&ZiTMt-NqvkaD%4KA;RHVf|#jjyBrq5 zqrzvF%n=cOuN>1Nc$s~VU=)iYcs7D3A{ZUP_z0e2{6sKTTr@5M9*x|9`eX#8OvqDf z=BYfYHOW(-j$lFrj`G&LH8x7{Lo7Ne!d&)JcM;NYNC* z9D+~t)Tx3O3ZI=gf)tha9@AsMoI+mwvat zaDD`@i;RDw5JwgH=j{mIi69n1Jc0!gyc@yR2)0GAFoH!K;t1A8@LmLqBls|al@Tlv zA1;j`lINde59F!uN3cwo%Z09>4SBu+eEj)9#E3tN;B21yaRilvDk~CGW>o~MBWN7- zF@-;gU|j^CMeun9pE6>D>iP&ahz34+QHGP6bYsMSawlN=B7)7*9PuVmPC)%zggG#% zei^~`2!4t9d+1jY?1K?%}gX&%Z`?x?gQd!FM zb+Ont0?1*}cM%-oERNuqNFI*ha8Ui8ixSrvsYPLGrk)=n_%VW?r7kP7t>eXdeiA@Q zQ>vVZ;MWLFM!;I9BKRYM-?)A%YAr?mo$gZ9j*4$jL|TkSP-KrLS!$+OA_AQ&UKCeF zVMLH*I7Lx13Nr#Lf{PLVtZPS*VlYSGMc_m*Nbyg<=?KOt>O8@j2tE>UTIA10a4v!~ zB1z$$ib{Guf(s0i`ab4u!!N@8GlIV&xD>(Poc_F6Zlt=39}m< z3ML*A$s8B*qp^MzH%8GQ>hDmEgtF+SC>l~e=!+H6oG5am{vng8u>i`mG>_|i6a}I@ z7=;o=NR)8f3Jdd%kXodnP_k+iO?g+Jqc#)TTqv_t)j|XaS_)tn+Cjq+MR9Kw z_eC*0ipQe3KZ*yUcrc2GqTn4D?HnA%Zy|r?^7`xHC?1JoNEAbv>Z=zx==IggVRcy4 zzd9p__g#-h!K*Ox17USU6eFW}B8t&bJT5Y$qW)o+RVdH1al5d}V=9Hmh(c-@D}Y7g zqj)Nc8BxrP;^`nF z26eK~-r@hhbXpWIOO@%x+SvLlA~rjUIZ@1t{^x;l0Iz_em>0$CQp#QRRjKkC1HO14 zoL`KKT7R>6+~1-<1?TWtfZmXkz``gNMe%tQUqta<6pN#%Un}?1D3(OARPb7%??>^0 zfMr6L3#H@=0qrGSrwejLTBV*Y9YYlIF9tDh9}*9jO^2I~cEDCTdB;tHpwke9YG`y{Wcykn6qSzYs@!2eFi{i^Dwny<5XR(GGH0+3CXB2-k_%-Ze zJTQc!_&tg}QS6Q4XcWhy*vCMP;ycdn?A!xUd>zHNQU33>tZ$+i+&_GfRqEx|uba!# zo!PmSot%07!!1%-hoU$f^?$cI!g-gS`#odT@jo4S^zksWKSc2(7bQ;cD2_+*6Jx1P z?#~<}qp)`0@UQ{l1p~s@m&~2lFMQ(K++Qh^$~nnc3acBC`$_HGg<hnqv!;}9GkcegA``{AD9%UWMsXS?JW}?kj^EQW(zUZ<*jc@h=J8i5(hJh= z#VG#dT$mT8a%%f4ic2C-9Pb;Z27)XN*&1qTxJCmsl+;jJLlq6BG+d#ff`*D3N^2;i zp`3>D8V>T`r=@brYPeGK9Zt>kIhj<&p9twamR{-~Cat9TT{tDb^i|bRO~X|hYLqN7 zX+XF-f##1ItE;K3Xzg6O`pAIr)f#F_Emou}t}Vtp`}jW>*49u*ICVAD({P<&HgsFr z5`IJd!}T@XsNo(B_iAXM;U*33G_=>yP(vdPVGa2jax~;>XrdvY;rp^B8f*N{uV0-_ z5aekHYEU$UG#m}99Er7 z{)Ikn*3d;mR}I}YFy82GMkA|qqy0_}gK%Wo5|Dm`EgEjs&`U#a4Yz5&wfwP? zLrg#eZWj%GH1yTLV5YW(-xM~?SDOw9cgj}>Xt+bVGf2aoqA*kncWD?XnED6hs|?QV zb#w35z=^=b7Vpz=zlLWtJgeaWj;4mkHH^~mpoWJuJgQ;1hKDsgqG6aQ=ad|x;e~v4 zDEpYNK3Xz&zfs66do-zRiI#^7+0bJe-m9BCLc>U!R5zFS?6tnnpU^N`!#EA&HH?v= z87n$DWbELRf*b1oEPG1B(~?!PON{@vkbycu14EQWq|a%1Uc+n+b2Ln(F&ZXon4)1p zzWO3-NySNQy{sRltgU!5hBf+kH$ zv9XzDr zI}UEE+-9wOV+h#C!*qz5b42L(LXQeP^l+H`A30w%L^Ws{e$w!>hLapeI;2{OU+4sp zY~4GTKb8I}P0&bc{$2Q|H2lF?(A)n}o=nO_gwO2XRZGM;*)v(X217%fev{@B9H2hF z%|$Xv4W?AFG}uyfz|3iw$znx{r8Q)@MaED+23LcpAuERL7*1PYr)*xWvV+uRrume`_ca^W%Xd%PdEEW#3%HP%?(AW2hNJsTi(^ z;mR1w#eCP5j^WX2B?!t$wye};2dSZa3>Dq1N-Xlo*y05=h4A;a^H->sKTpI)3KD=*k9oDT;qBd=_awthk z=5?Z$Rj!xn92DZ=)k@qLYgNVxauu zez`;X<&v^`AO^d7399N-twb;eMVbi3Ku$OYGAWZE;|uV<3~AFCn#Ir|hK?fHoCe3x zCI&Tz7BRGxibayF*h)0eIc;P7Lq*@KMS9wcLT0I-!Uy~MmT)+j?Gi&*){3ET4BcYr z9z$;L+*@Pl5kt=yZjRv=;ZVN1c#oyjUlgUcNl`DMy@hh1Z!ZS@V(2e6+#SPbt#Sv% zFfiu7TS5(Y#BisGeKI7>?8e@?cf~MBILscaQG%2P+!w?BF}xPT{1_gHVQ>s{WzZjt z;h`9wis9)P9**IW7#@pZL<~cubVRihkH#=mnjXfL&GO^3rIkZ4T!w>v85zUlA}~6J zez)h2;@B0a6kzl|A^cDK<<7W0cT5apV|X%#aiV#=P->&(a(bh8?t~bgiD6OICrXwbe?b73AZp-h$uv2JnK8T)!;~1N#xP9;W{Ay{e_68Ag?{8_ zao(}rSuxD!xLY}MVhG%xOF+r1`{b$xD(So!UX6jXhKm?m@uyD=Z-^NSV|X)$w_ZLO zM9zMCAchZP_)@YfWB5qGr!jmiV4cuaF|3YZ4JY8H@a&o4wF0^qsKlSJYcs=l6{swt z!u29gupx$xf_!ncIp1t8W)f@Kp>uit)}Eb_w1c!yW;w zyH~(Ip+!m##PGFbzY%&&=s}_1#`x(pzIC5-D2Br^MBive%ydMU-^XxN06BbM`9Z4C zh93n?C{TZn;TNvAF?hl`K@BlzG5i|C$ryeU=I=r`+?LCVOs8V_Lpa0{0kaC!SPXH& zrqDzTx`6izREn)HP>mRp!eMs%sAiU6TPUBEQjB(bpg>K>kl}z9sKiVxIvv9qF3xe3 zkK?S!UyR|;7|sbkFZ6;?HcI7x#c(Nx5^-e3@wafOB)d?3hmRWtYIfY0A?FGKh@+%{ zQbK7MOH0R5qfjj)w5(8OuZ*KXp-NC8j*4;AjiX*1m84d6%EVDQjw*4mA(~y4rB5_t zswRLYR5tO?uBZdxc?MMa9teN$B`$s zZiu742sDo4Mga|qwXxPsaSSX}SB+}cFpfrX5HRHk$Q4VNWphp9APq>@2!e4aafHNp z3Q$j2H0O&+w2GYJg=%3OQwr6laWspgIg8?GLHpzA5JyXzy&$ix&{lD@j^lxmK8L9d zEg#dY2)7e~`$nRpfG$Ei#nHK#KXnvX+BJ@D|Er;A95=@?p|IpLg(Yu^Nkal9np zgE&5nV{#nxN9In6V`?1Jg#T_F3mGSIOpjwm95ds1TllZUF^j@+yiU)@F(-~!<9IEO zxl&rLlHa3wg8$wf?%y+9#3`b02>&gi9j&Z4ea!*N6ybM-zu>acMS_-Epcp*<11>= zbGOoOR@RqsY?FcDSkSf-LxW@L=Iw~%j!}6#2s#{D(0>IJBJGQ#<7pF9mkK_1j-MDa48M(`qj4PL#Oaeq z{6ieyw95Ta%v)Tjjy>bQXG_a}j^md&sOL8Zo(TUM$4SPz_p3Ih7`3s#36ar-8bXtCm~mJPQ8ULD4mHy`q?G4q zjx@7aHxtJhF7 zx6l#^e@(~|nk|&_ltpF@T0MvP)0AE(4p8@ z9TVu3@IMMbW)bb0z$Xc;OZfA;TLRq^=#fCr1a6igo14Hb0vK%WHex3ca`_^Slf_D!IlG}mNi7R~4{W(-JxllP8<|KFsGCN=3@qG6EGyM^A9 zz`Y5Suatcsbtd@#g-S32sgp5J@L&QDB``UGDG5BBz#|DfoxlX@Pk{2n6L>6vp$QC2 z;L!v)NjaBEsm-6TyTfdHL;@qllE)JmEk=%#jz1xoCNVzQ+?WK$7JKYT0po;@PvEIy z{>DP}8EydyJe$CC!ekSEe|!3-KA*tE1YSshU4D`AU}a5WL%aP&jDCJed_piafoTcM zmcGAStYo@)iIOt}%uL{w1ZIgtsExHab6Gk^Y89>X^AdQK!U@bzU}XXyCGdIzZzQlV zfkg?tnZR2zMs(5J(lqU%o$pAC3lex&>?|4@8u?xVi#eL2pG9nIi8ze{OQkRD^)e}4 zE_6i#A24A0&`UcK*eQM4C44qYKF5oc`*rP5Hf8pS!?_4^c_IBKfrANn37k&g+XTK#;5X55 zNGRQMT)^Q3jz}NB7kX5f#{~b7z>kv6E~Y;T_*qJS5qd&6zY0Dnl$wj=f0v?D3H*^j zB!OrGS^{PQRsu08qNJWcTxumQt7`~O3Z<%|sJ5j_I)RjMoXbixg5AqFXA(G@z=Z@Z zGN?x8o)f2?7fk1HOXY_3X99mEP)_%Up4m$YWb1&AzagfLYf#(ET$WF1R+)vs1+e-HJI&RSYg|wll+H7Xk*TJu)+$gkx(3^xZmdNL> z%DpmIM`Im%I)b!8$!?-!(qCBt-Cy_EO}4^Lu|-Aqcl@F*bBWH^QNUg+*_;T4Vqps% zEp;>%+)QY59jcD5A%E_(3uP+$mpS~?X$EjB-9O}z$#Y#>9UXOal0j*wqrL9`<#h+z zDeDsTa}sryY*!s!bkJt@k^F8tx=XDdI&RT%tB#(`>UhA);w0sg#aVWnj$S%?>wZKv zQL;IR!AjZe;O!jr-C=fzz3Zo=KN}SpHabAZARTwpLLGPN7)YP@4AakdNz*ijej~j{ z$GtiZ>o}t0KB@b#jz@IdFZcnWgQ;1T=m#bH5F72`uh>HvMGNx$QRo>Ss$-arM|BL> zv0B6)(=kHFD>`QB7^&lN9WM%>6-Vh9qhqXOpAb4)JV3Qi>KLcvc^wmVjMwp$jtM%R zk%5>~G5cu|rWl=HG`XJD@tpLC90oHx$c63&Dp#`UK#n*)Gl_$)W3uiaq^Ikcp<{}U zsk%SErs;TDf`sG9jxaW;e5URnEFZ1lpYS=jJOj_xF-OM|9ZPl0)iF=UTRPs>@ha=; zctgjV)FujF*Fl{{ryA<#@wiy z=j^+@7w_v>rt?2+_@lpE#|j-E==e|v`_6@$`xpDg_*|*ORyr z9bf6#D#5%&$^Me_RN|1qOm{KN7!^Bo>=cJ^Jz;pTYefUJN5@_r-$`Hg>DbRzNQRzs zfk)E=I==@Q>;EK?3+k_T9=F zX=QO8JFep=9bAxq*71u>gcCY`)A75GUv-?6BAU%eV>+ed58+V%f7ft=s18j>Oh=qy zZ=j5UgbrOA%{E}@Na{EzSyQMd)Z(D%NO9rSk5B!J;(OA0L|^a`PTJSl77O2O9}C?}wr(DFhn7^rBVl7Y$wsu-wh{Ez*YTV7q{ zYZ$o7z|{t78mML9n*X)%a@%N6ZK+a6XkDT8gwm=T4AeK!B88SI+-RVIfq6DwwQ-XO zC?-NC8X9P1AV)Yb`LQtM8fa{wiGhHDbkgr~o`E1Q6Oyf za03Mf3Jvr&aJ#|3Oh+>V?F_Ux(A@C1p_T?(8Bl4A;U9A7QU)9Otqng=nc5isdQQNw zZ%dsOvI#mE=xCsuf$oOCNOqzOn{Jg$+*vrpU4=uy{`N4?Q#x{sF#U$4Ij(8kC2uuw zn*jozsF`|kEZX_Q+Q&d&0|O1*C7gZ+`WqNvfRV#{gF6g=&1bsP0K*`l{AUXrWZ-TC z_ZxUXTD-@=y&}n{3HI(j!JG)JIGDp{V5os%!hFcUBL;ZLWYNRIp-Dpwe-ENDMbnUd zA$XAw1qMbKc-g>o10xMQZeW7J*D!pwqYOM@U^L^cQZ{3oX^eq!yzntF*6_~>wr^F1utrBwE4SZ!_n}IJm>6C0P zZjV@5TrGDP{`rS#r-%{klIjFhxYxiw1K$}qB+UH=zAn;D~|m4gW%h!*`T66rF8$hkrD1+`tI~zZ&?7Lv||XX9K@TTO2PM z&toA02XUYd-mTFp&bZ$VoH9^0i7S)%gZ3Nv)4*Q_q6RdsCk8SSGcf}?7kt5Sp$Vb% zQqq8FASJ_OiRBzkTP8BQK>OK>Bc;SFat(L}&KWpw_=ow^)MMa`RHTtqcvi-UMHdWQ zH2f`$kJUW5vcEjml3wC4NkEoLqD0bH!h|HUlE_Z_%NM)GL}tn4f6k(hTUl2m{YhF{ zXc?jO207)DD4#_2Bx)p4A&H8zgjP+W5|vAwJSpK?S*lbK%8pb^`pZ##zfZ49;%cc? zN0>FmhHI0kC4fq<5mhvd6>BF!h3rLLDXo|EhnU&xL<4dCByLRN;#3fX=3t2B0%AM zX_tU4Hck5L5AAF&%w|b{I*_9#(LyY5nFPPeN|#cGrnX669sM-YYA>)H$&NMu2&Mh zlNg@FV@ceeM4u$?N#b6q)i;R&N!*b{KT+OaDBI!%H8tER?!7CCfdY8;pc9w|N%n4` z6uvKs`;!=&^dHS0NMdjj4|C|PToyf;#6u!hq>wtP}O4lK41@RY|N)VhvlDD?th~m|Mt70QV~KGTgjNaEKd z_9d}DiK9szOX5HhUng-$Cfzql9897}^S7dqng`eR7tilRps20GNgPSyx+K0A+sLH; zAH;7zNnd^xd|W7tiYC#|lKn*}_mq=K{Fa2CgptJWNt}`(jB))hp1)C16=4{g{^>{) zXALzNN2#VionEq;0)5KL`!_`8$XVIQog0B&Jt4H(iTl6laH}m%`BQq zd%`C2*+&zjO%#|YG%?7;-6oofd{3dx=nxaCi54bWnP^Q9$l1Fk9a#K>(bN+q+L&l- zqMej-J>l(8dlS86mUUo{l9 zZZk1JYEhtp0M#{y9 zQ|Z*S5<{rO#G@vL(>bB+EIuZfc){|2+hX9cZqdQ)F{wVnZzYTT$EB@NrhgU59g~+N zV}vt7=vbjonjA-r7yOh^p3-UI(}KAa5IV&iixQve=)%_6Vpt*Z1R;kykTOxi5Vv5n3!u~rioWf%rY@sY-ZPJ z`TwEwOuTC1H52pyUFJ;_Z<$zVVv&irO}t}bfr)obKT2zavj0inGqKp@jS!apyUcPE zD@<&pA545;;zJW_O?+ZvrHPMBd~9OX|JGe?VvUI+%Gu57$?3)^yw1d@lr*uSxb$*K z_Lrmixrr}KZ1aN$n@nsrvBktz=`Tx*WH{FU#oJAMWnzbkom^g${uAgw=^hh%O+-y- zCia=wZ{i0NKbkmT;%gI!OdMtyn>c9VTNB^?yPhK^zBh5y#IgUC;qt{R(;|A@#7`zp zn)uDc&nA8`al*u}=6^~rmn_1+n>c0S4-=7pmx-B(oA6AWHjyx)o3Kr!Oc*ATCQK6+ z*N~8ZC-YD0m`Iz*m~j7BhWqS)<EL>yZS_`!;)cJS$>nvPv;RcKUe)<2Qt-Ndp zH(6+Cp}<0+g+>-~EaX`TTFABdV;`DW2+)3!yqp%1F)OaeoT~EDW-6w}m?_+-YH; zg}eS;{vL~OY~ntPKPCS^d|qV3gBBjLFvh}I3lCd(#KH&*BP|TEFx0|u3y&4o9cJNC z>p$0A+$(vaF5(o?$1RMq@PviY7K%8$|KS70<@8Al<19R5;aLmgEj(r6X$un=od1w4 z;yh>Jc?%OQ?mPbvnW8P}B@2@|L2P8(m||h7g`F05S(s+=iWti+tgtZM!VC*HzgjqH@dI1<*}^XtPKZ2DiM-qVuT@2wf3xtrg;N&(D3-ar z#UiX(h*@wgcoyOo5*92AwgugSVIgV3{9k*X3}w?5MKoo>v5>Zqp${+PUye^(IAh_W zg+DEvwQ$bDc?%c*UH&f%mn{5kp@fa?N;Yp?|4Ct^q>Yv~TG=RN;|d$~ZQN+1w2d-0 zYS_5SMp+wI+NflsvW;>!%G;=5qvF5otYV|8jcPWk|GUi9Hfq|aW23H(S~jk+ajlKo z|1Mw8#&tHXw{gS2%QWESzm0qw1vVPmXk;T`BhN;Tja(azZ8YH_P+n&HCk@(AY=mrt zi)Hu|3=d$J(?U5za>_Kf(bPsW`+rJR8!d|K7U^$oqm7NbZQNs{t&MgzZnbfnjrKM= z*yw7bn~jb(I@#!Kqs#x+z1+g?HhS2&*~Tq4dfNWs@IR$v{5J+Km+WPuw~YZd?yzyY zjXpN|+30WoC!+e={?y~)oU1P5ic`BNy6&_w(8gUh1{F&VGym^WcCU^5Y&>RTgpK=c zJYeGy8$)aiw(+2ihip7-`)B+AE`5*i7gfFpBy=c?Y&>dXIBQ+TzZ{RW@wkn#G{D9v z8&B96ZDY*8%a5}$-o{flp0>ejXTGX;IpxhT&z8@~cs(ohIib(nm}uh#8!y_JEu2X< zUb6ABjp;TfbMdz^)y6d2zgzY-{DaQ0G1JB?HfH_1%pB1?S7?z2#>{Ir_6vu2zKz#y zyutXf@s=<@u<^El#X{c^y1>S}HWu1gWaB;I(8D|j(#d?TZ<+Le#a<%(r8eHTvCPJD z8!Lpv9iMMXuyy|Mk_%M5G!B!jFZ0xeJ z+s2oiwl==9v4hJ?wG#Xdh-!Huywmny(<0_mJRh0)XuQY9UK{&F6>k8joTa>KD7pVx+uG%>NFghQw2h37b2iS)3gg;1ZR3ns z;&FoS@l~B=yYgck+hvybFc)lGwDG5nzeJJ(WK!l5S3lm^a7~aKMS7T55PbB`P5~*D zNug{CB~vJsLg|#>WfonL@}KKF@ANhB2B7F2S_Z(CDU?s4LJH+l|0ybJx?&2IQocRB zUSJhoAn>uhY6{g-sLvl~Q>dOojTEj);o20gO5y4hYKaEwoX6j!_zGyszxrUKMQzni zp-u{QQ>d5nM~yPPljI8n*QIcM3imyL8&duowhS1y#TPT!E-h)0!c8eCDTGpJnBxB& zM&lHkq>z*1X)P<47MfW!kFD_J$%+A570S*_At>6|5Eb&0kfk&xoI-vIO;c!=LP5$O z@xm0Im++w3MM`KnU#n=If+`;4(9jZ=wo0LO3Xi5RJcTwXv`yjR6dp;TT?*|}=$k^n z6gtq_cELU=|4rtOqMtfDrO;Wr+$DvsDL?YNrO;bI_Y``FSWmWF zAFz6HTq^l5%Q4Xga#;O#sY~bZ^>XTGFZ^fx6dn?XQ*1!Wzp=SP=$$DH6hO{h0tN}a zTj)JP@1_3*Q09IC52P@-nDbzY|D42sC5CB&czZ|+Gxqvl9v>?G8YYxkn!!`nV<}8c zVOk0!*qxL=2OsCq_Y6-FJSv4J1dJ9sMkr;*3V2fJIHBWHcq)ab1y4v}q5w)hBj8z~ z&vEz!oE@mJ=mo(q3Y{eMr4%L$;5QfYU+{map`8OSHKzAoPGLGbl0v7YCHTtmOh!}+ zi)GMfvG3RC^5v7?cVM=7drk^-Q<#^+t0}xAoYzvApTg@Yypi(XIpJjj-{s&dG>s}{ zznQ{YDZDLX$9Wp4l+C+w4lA$Y7NqcQ3JX(M#3n>fVWsS*m9m@hg&At7=6jWCNy@+0 z<0*Za$dGf_Su7X4B83l9_%MZ)DQGTYE7tWV)^3P&g@Iya@TIfaeHDg0EZe$GkMRL!rD^+gJ23RNaDx1_L@ zb1H=$TvDRSw3W)X6uu8Gwka%AT`-OQx=+{EO5z5kow4tX$@EtWjt{mdHOb^|BODJ41|N9hze9h7(QV~T$-4_TTY(aezqVuv<;#M^KQ>kQ z!KP9U%1ZXJ>BLOXyriDdXVDmjh(B=v;86gLMyv2r4+J$Y}X8c#VTf4k|l% zR#j>`sN&$rKqWX{ahj@C9aM8r-9d0w;3@~?)DX%~nGj#?;Ptlo1b8^ay0t_@gCh!c z{@qlq?Vyf>x>UY2z*OHsJ;83v&~*;3cfb#cGTq=Hz9B%+a#`?32a#RDz41Up2aO!G zanRO5jsxC$H*?V3L1TyiNC8b9+_zr|I0&T!1rDzHB#+5vm|*7(9_)&_t3 zInd5Qdk1|S^mWj|K}QF@9Q1b3i5?qL_}L-lRtMh9{LVtV2<kPLLwz8CV2lAKSFA?%j)N#zk|DFdOwV?6b0JE#Bgzl2;`4LL9SctWA@mW0=kwsl^tOQ2Le~gg zEA$hg>x6zPl=ABZj4Mz+WAJcVrO`NzFC1)gU^=iIY<954!M6^+bFkIHHV2PYD>&fb zO9$H>>~XM{uB%q?m4h7)cGAMKd3A>?yByr`TwpiHZd-_H53BSkSTjM{=kPHw{McUw zYsUvRf@N4L=^I>LBI{1yF z>_BtyyMu$zh5isqaEg;?fik4IN*ob9rMVj8a^%3Eqt+-1hC#*roy}F9q4Kh_gwFpe zXs!#~`FbeHmGgClz;=*wP%4cp(r~zdIJoHGPX`$XE=Rm<;W?^uaGITJuAZU7Kb0%$ zDr2Vy-k7GmdpvxWp>;gWaX-(lHCLG~2)H8=_)CH+D~;?l;+w;lXxQfP-~3TcvizJD zvsG*7Z~4VP=OFFx0wvQpci#V&W$84^q;XXmSEu=Zu=C5NQ9X^l^8#0J@qjl(ko*QEVVh}KTy$`Se33hk=;-x#eU{JLq>6L6i->xJGRw7yVE-pF9)sbn~kuk3p@)Fh2S8l%WhBQK3$8Uxa}BMl|Z9Rb~_A&qbv z`DwIFqpM`!QdK4j_ei5>8hz5}o5sy)+>%DGGzSlOkYy)%c}f`XiQV}L7{D1sO#q|PdUmX)Yd}%>Dv%@%y4FNcz7BM zn-xAPbW96%`GxRfY0UjRFhb}^p^pn)R8kq8#+Wo_rtu0x>!;w@G$y9;LK;t|F)j_g zWZroCAsKu&ji=IlD;~#>2PbgIsJy8Y8HNjYL5lqOk+~b&|91fR+!nb?LrIa^J)H` zyD*J+(}=WCpB$(3nx!mC^P8>yrtls+nD)U^j&d4*X7E=A%hFiRq0Hc}3|6G^K^he^ zsFcBnX{=;SrtxbUAEohe8egWdo!&@eH4Wwhp2iQ)6s$>OT^gUJv6c#3sMoYqKViqq z=2iVhX?mbwJ)<#=jZ`&EDQKzoYN-xsseVSwTdLg38&uAJr=_}y?&4}QOxfI0-JHf2 zhUMSEIV%Fsmd@Lj#?LL)b1l{TH~BBceU-*{X&g#pM;bf1Vzg3sadvMA?&f4{r4Ce- zJ#^_^p}lGBOJhInv=ydr(l{Xa>mp7hNajJo-xkZPjsy>CCR8d@63G|V(&^hr}yPa_oz##!-DkSQUcR3u;sKl`Hq zOCN5fPHd%GY1oXMqe?1`@e2bEM{Q4-+12fpbQ*(0;Y=D2KNKQ(yOnx6jWcPSrEgoQ z$6KlA(%>%16j>Q0eV{_#MUGt>m$;a;R{x@KEA`3wp`6xg#iefN(S{axG{sf-&Lw+a8(9ZXYgZdwOR(L@qy|Y z)W~4|66Kk-%BdB>ni+qLYG+UQ!yjx*1%b!Q?;l z^V_KPGPo`Sf+t=Ikdk?W6s`I@&>(}GGH8=Q+YFvM8f=(BqYQE~xTTHCY;FdPGiaJY zvkaPK_&=Hurk)J)G8ocE4Q8NZ@M0Tv-u%$sa)qR!4A?r;qBd$l2IMdmX7E)Tb=TGa zF%2Vbogf9TeX#B`?OVCvx&Cqltl{h=(cLR4BFEh8-sl_h+R@T zWY8&thS_<180nY+k7qm^bk3kl23<2abaO$e-vZqQbQ3zWt=c1lo*CTC!TK%0bSryT zj90c*Z!5;V1oReqyU;!v9B8YuNQ;I;LEK^(pe-r@LWa8CyJ za>VJ<4DQR|{tSj^@K^>9WH2~`M>BZ$KIOp-9?HOMs}9ZJVfy??=#dOg{-TtQ23R^o zWUe_8`mw-w+OQ0+Z08T_phAVEBQhA7LG5M1aTz?$5p1W9&R`4!Pw*4;SUYu4JN4;y z>eviFNgQ}GgEz@J8K^Z^Az0r|J=jh)DUiX03|`J)dIryA@N5PzF)%WS3<*BRIOpJI z@O%cn7AX^jmT#{P%2D{W)=3%u^Tt542}-$&N{`tg&Z8+A{?i_1Dm%L=h)o647)b5a z?(Nm`uPHM!m`MXNcq@ZfGFa1Cc|+*O^$KPQn4Q5K0ds}U6Z)#q*M!a&`nph7@3SN{ zw7p8uzI~|OGXXveyq&?~i-EU|z`GeN%-~1{-)FEWgV)b1t63|9twTfaQ6_^W87!6T z$3n?}U%;{qmKSqY2>5`zfPj_7{Ez6L_A09^7@@2ZCP!p#2A^cGD}&t`tjplj3^rx3 zIfL~XY~Yl6KlB+rSv5?sQL>BLt2mMWxnMHCpm2MYU<(yyu$_}didbbE=e6MD?bXxm z)l*jf4jND@MERXuG&-nC2bJ17Ckysuu$Sve2H#|`k1IoEWq)y7)O?_rN#TQ1`W>f+ zfNwc*&M1^WTx<`8S>?Blfuk85%isiOWd=WR`n;5})+?m~p_3W>mVujr$MrvhQyEwp|K0dM=$2$)(o`iWAR;s>RO9RxK!G@; zOR!$dF}T!Z=d;M9!EXh4`LKGYGU~&i&4wz6QyJ{Y4?9BBoML4{nGA02ppto-R&`L% zW^gWp86DI!8NA;?<%Q4ORPcNT7Z@bL@a_)kw?^P%2K>P8)I|vw zSuR2@!Y;C1z(si%6MopZp(-w_3TTvDcrp{H;o>S6*Se_fBEO@0HM4Eh zJ{{GXk|n2>i)#dzJrZJ8xfrhFqMnQE*u=(QT^H@EgelKc1i|$#ZgA12vBCohne|@9(8k5&h6T+V7qoZL!9`~mU0e*g81Cr$PvZ5CDxKKVg(0TbUd;b^ zMWCyT?k;+`AnqoVzfSk$5V+_?OFH@6@hxn3ao{!=w+i^HqtC1mT=aEu zw~KpR^mEbQ#XuK#xftO3=aV~x_Nf;pzEkkaom67#8RUZW))xY#N7m%e9#QbXdgWdh z_qn*=#RD#OTnInp;>+<_TTUs1T|7uHHC0!1QqS#Gc6Cx87J+Cd^$`I)#RniH~$v-*oX7=Uo@o>Z~rP zUhuZdZjjoF zZj<4})`I0OR=D`a#X)h-2QId8m|T45VkPZiAh{UaMcv|J75n>D@KbUo2UZJCmd{%w zV6BT!1W;g|fG={x>qT;d(2YV_@iTU+7=PhnQ!(D`!ac80;GyiitsL~_A%g8LzH+h0 z#a=E8?-b5i7ueyV^~cIinF6~w1YOkKE^f>zWa1~?_p#!8q5WK`YUH23*8j%+0T*9$ z9NXnj(EMAA%I^feWk+6CzISod#dj_axj5|Nh>LYw0@wA-w{BLNUZ4NwEFbf$ug6^c z?&6dSuI)e24-*1E3Oz3LCl@~pApaK^CyMc}0!|A3jdNL3DDVdZpj2MO^?zI-s2>YQ z1!tNRkP~;2a1l9;=xOLK3>Ufw!$Z=A>0*Y5nI0?`HdhZ1s)rOE!nM&uZ4YS|8O}Zz zm*_(mi@T`jx~S*rA{VE*EORuwsAuVf&lS3K?%$yy!SFfGro4g^UDOLMD16aHjjn#J zKP8*rRsEZbzlRDQDtgHBknQ0L52Zc8^QT)W4^MPe>+A}Z^g!CDtD1K*Jg=)-#zR>T z-*#2YdAPSvh?f{wdbk_mInRaGc2&zu5ldU_53tr9yOl~FDtoBnVL;{3O$AC-4bkXD&}0{;ibt6i|Tl&>mk=eV-NK_T<2l?dgUe$c31U! z4{J)R^*v0=1a4rX-Bf}bDPLA?AVs^Y<~8o7*1tE@&_g2+1UW(pZt12r@euGZ@qMMh z^Y0JygoZr?1t>y8LRs2iDF^w87;FQ^~s<{x94QPumQ$=%cz9$I=B=;1EU z->q7CXzQV!ht?k2unXsddF}S2}oD`g~wkG}O@pZ)M5pH+#560PEiBA^My`z|_k_?_&P#o`2vWldAf9 z=qEb+3mqWz4xuc))58zt!vupk${rr}@Q8ua#$n5>OB6CN0SH zyy%}OMV?fz(w!fU$)7}H{wkOv^d%3IJ^#WpEJfr`^)O9}h+pftpHXRcS?@GxII#{Hd-B%E}w)06%E3knA0&41>< z?O{eKb%BR>J-ov;ArkCfEqqINbs>jxMqmj;#ls@O?+GPyv4G{X3gUH#m{kKI-B|C*7% zNhGK53v3p!#lz3PhCkRB_>z;?!%+{%JbdM0hlibGLWfD&=mcet=l`tPerLfh54$~t zHU*wPt&r~Z@ZRnKi}rcgFEYdjJbW$q8=(h3A((u3(? z%xR204T}Nk;i}WP`ZQ7=9Ini#k$oCz4;c@axIXt(T@D=Mhr`4*f#Kaly>@EBr#;m9 zJyhaz?52kc9xi(5`2R8W9new~&)2hiYxXIKAc80;pk(nS9v}^p1(E#7Ip>^n&KWU_ zprC*#B7%T|0YyxEud`@ocJg0**w&=DQXk}BT$V?Ev8|c@bgoZ>$MdZyURhj^_W9ohB#O(UC>BN4 zcE*lk&apaKY;9C05)D2YYD^CeYL$N(z1^CQLMXe}qj^g?#Zir$)J5xQ1icwUeZ**o?cI7B;jPkO%PS@6T`Niu^QH-vX@1Cq% zB??xnUC3QDCHUiq)uL$LF8Id0Mid?QW_!Qp*W|p~nRhSMsU5{FQM8QW_9(KW$cdtE z6!oIWjRrR(ysgNO2KNzpQM|agfOi&kXzHpu1&SmT66;4{qG%Y!tx+^kefE8@9sfsX zUafynQEzh^MR8jc6gE~QX`-ZQ6wQ=0S8Snps9n{p5{M$ukv-l5o5hi=2f7?XFW zN_fvsA2><}2In7iilQ^8sZI2pb_#Va^o^}uly_C^rr2Gvhhk5~UW%MT?-Tibqv#jK z;3$Sf`9Dqa`$sV_imkw3(mH>LC78iaq?faqiG4hD9+licwKSkL3=J zf=~ANoM%K7yt=FRSw3-e6l0{z%RwMUu%;bia^2h531Jy+3#7@@Aah7tDxaW)w%cKvB$!Vs;ewMsXk4H;TDT zgD6(ghbZPpu{4Ue-_E{RJ8wZ0i!_-lr1KUs18e7PVzSR2JUru3C&wc?s6>_K%|<)`X;da@{cV-&wvsJDT0e5K&%^SO6Lu_=l( zhx6`^;`5vGc+ql?R;O*vr|^ExJ&LEJ*vqAlV$GcV5B$6xQ9KmIW|o`t9%gp6H@{wH zwrF*$BIS=n@o0u`Q?fmZ$1;+~qnLJW9@Ta-$Wc7AApZ$wV2QjZmG6$CXM028Q!1o< zkCLH$>tI^;Gf^DjR;h&&>ZkinGz+3olNy`a8K_C};IcC0{9i zt@uq8-zxb|@q0yT{t$(~BbVeneT(7=2fH0yU_Ns@JGjHaFH!u;&FG+#gWs4cQC#Vu zq=So5{1L@v4lZ}_XB2-$k)|moe-w?H=lv7KzfoL@;`Nic1}YInTQQ=TrTEb2 z+0-xQptyrXdsD&*t|j_zs@JcCxk3&8UN(GsNWqUgb4xk6%0XEN*QmU-gMtpGjDxGS zTDF5ZcPh8XW%bVV$}8stU!AX>m3OU!$z$>!a_e5_puB_L9ZUrWl;5EIdIz&R7z!z= z)HtuQgBu;xcW|qNn;cYeP$s`_o&%%{sye9Ypq7K5&)2Eupt_P84mNi%y-L<2-t6GA zYISaLknNz!;81M`k5sJNd2wEj`o^&2I=Jqgx+E-PThz&SP>23IsOz8}Cw?N^P2^QQ zkzI3PHlMA%yD;zI7j+sqFb9`~FD64W7&lcI&o4hLN9bMogF-C=aW!gvRq#5SavrDJsEQc%8Nevd=Kc4*ICIz7G01ICw+eflI+Hc7F%2SIT2)_EPpB2ZJ39b1>Y&5C@mK77V37 z_3M%FobS~$pYNWHa4^!rXa{2)oNJP|{b=@;GqXoI$a^@OuO!{DHhZjtE!ztwIM_I( zV4TAr=hhkT;ExW5gu{(%6q@W{ii712RydgIV48zj42#3xGGo==>{hSl&rovovE0Yr z&z{M7t<9rwj)Ts3zs$kh%$m+~Fh9c=C|Rhu$iZSIOB9zXa`Y+NgProm?R8di z2<{FC_d9&`F}v2w!4>;z2WwPwt%G$AN^~^qwOVFp0r>{bNQHMPQnE?O-45=_NbYs` ze_OKI^nim09qiEV4>|bozP$C@vo|X_7OM9!&xD=XTNFvQDtSclQN?Wzwr5%&Q}Vb2 zcS=3(6#BVS&FEJB~BrJSI=N$*{I{3lC zj}G2*@V}l17=r8LvpyIIpg3X2d6t47D_(mnb6Vj6InW$ z&m4TtX*&4I!C41is1bHKS98mZzkM2%E$3~q@|4!yR6@E_(H|4Q) zb|-Vr!Fk5S;p>0+iHE;~UwPDXIEOzOE7&}@;1>t{8e(%NlP;aZ>cLLtcWwH^!ILNQ zE@~^upDKK>WFC86a_|pN&KSzX@GsA?xdkyUv4f~`M{#MFx|Dkk;tuQ>)|brtu#+Js zoPZ}Cq?Du`gtgVzs->I?p;+J*2{ICifkH|mF=Q#ZEQS(FE>|q3NQL4tT#?~LMy`yZ zWDKQLc$H%5jJ2Y%%EoX_4CP|DHir0(b?EtD8W2u4zP>J}PYG|D%EwS4hU;UvA%==E z)QF*G43%Q2%usYT)nd3YhMQuj5<^v$)ah)tudmy&vzgf0bXZrHNM1dL)aih;ORX4g zjv*(8Tou-i;g%S(V_3#|9;>Z|A#V|UCF)=KN0V!*24C7*$9mAX$ z#>X%rhN&@3i}4$cyop@Xck=kMG5MqzCaZ9YA|+QgsY9F|!wgRRll&6T25K{7m=!~{ zK6#X|6dO@6H->-a)tw&$U*nv|fE>xY_li6s|L=f%Hh*CZi}?Q$3e9%@i-AIu|4-f$ z^>eA>GDS{gxsnx%D`QxtWVPZN#kGpmT&HAx3>%c3w1dA0x+#Xcxpu{*O)p22V=P0Lop8z#jrVskuFBLcsPbF%y}0zU2Kiv5eChLxOg;% zZ87*UST455@K_9Q#c(o)$79$L!*ekljA18V`;TF749{@)6`E%Y%@Z-aS7>%Cl02#8 zDaAdCPseahHTT6p{oF2QzmjKTNEVu_yO;wpwCQ5lcTg8|D2Br^9F5^cu3#7QJT<$R z7h<@tiy>h-q7vG9DTbG0__T{T5yLAn9E;(&HXZF^D10@B*R=JLR;mAb3~$6xysN3& zHL%k}@lEa0t*d!EhIeB4Glsunc$aR+@C^^H7~a<@ob75piQ!ZXAH;Avh7Z-@7rO>N zPwHycbv0*V{Lc}1tgHE0@u|7FT!`Uk`d?@UcQbT`${d&YTMWOe z+nnY_B~<=H$^34C&-ZpSPj)kZ#}L!$AMa)^F{K&6ZieMwB~czMN@$ZpHwI6Y<1r+- za4~S=Y~m297}7CBy9H7GvYRR1J;;iX8!Q}4SV^_o|le zZpyeQ*TdxXFpPgW7uUMD$wd_x*SRR~qLPcs+P8v>8(dU$alH%n?bzeLxs2=)_{qLE zx>%^f2NlVyYR76W-s@qWQ#FoT-NpGH20epbwOrh(6S>(%Z5Ow=$ac}(MGNhi z0vEY1s`oT`E^hB>NbYKNjTNcW z#6{B#Z>D5cPxDky(~`rvXypbe%HXut+1;TEj5a0Ahc+&VZ}v28U9@x2-bDu&{ao~S z(a}XG7d>3`bn#r<3=6G|b}`1q zAs2^TjAin;xKHhjcQL`m5*JHdOms2H#dH@lTugScua}wXVw$Q=alyUGvEJ$xY|<}# znM5x$(*?-_#>&Mk7qeZ=adA~|)3~>puljQp=PA}ud9U7PMsIU}Z?nk7)4k1NwZN@$ zqPJP*V!4a8F4nnN;bNtWW_?WWKIWU=W)+29&CPwxzrD?BH#jubD3~ishi_JXzdCt4o=3)yc zUT7ZC>GN3F>f(_;=J`H>ah|c;nJTJ)zQJ~Wyhyo^+2P`JAG1^O_dbSvH`B(&UKh`B zfAuv_apH`2Ut{{3JubTSHRJl4Ei}T@pwR4dvEL02Z65p2awB&!>~g@xb1n|{HShK{ z2ep+7tUmAJ1s9()6fTaqIO^g<7iXA7E?#o+mWz`vUUu;c4*?f%x;Wm zW&O+toHb+E&yXLWuwSqW=lTWn;-UJHi;uPMC!B(d&y>>v9-hok?mNch3$B+7*M;Ze zD;Hn8_}RrTF1~T`El&~`Ke_mhClWm=G(Wls_YW+y{GgKZ{Y`#_z;`#osReWnQTfe)3*&gU{cY{mnlvh_uY6 zs46(xJ?3Ih|3Dabk)T%|;327F`7SIEDHlbbENK^S^f%x150*RRfuB39dRi3^R}C-` z4_O{;5A?RyfWYU=JhU8Om`ke$n7#wdqyeV5hbuhn^YE;P5+1Jf(9lC8R=b#z9&S=n ziq<@o_Hea_>pYbA@aOT*LXqno*!UN4G5N|oK`OkFxPq@vZ;axe}K8cLq(b@ zG}kMZ8)zzdL14QLG`wc0?4j;JbE8TqWDKi#sOq7bhw2o1sNGYk3^XJ+>!3>pntcNeB{?2)J@8{U&%>Jo%{N-yfu_u$|6)b^1su^sJ?%&*jR%IJ zzE*Gbf-TcPgGM3!$sQC$_%;vIJWSVsH1^QMLsJjUJT&*v+e04@Ef`x59XxdOaJx?P zP7iH8wDQo}!yWWi56?DAn9sZbYdOfYQ-kdlISQRAx>)Mup|gjcD(^SQ6e{WJp^K7P z>Jn4En-_dKclXdk30I%hUKwk54KjT_^z$%ICH*}NASpB>Jq+})Ymgb_VX!vQw;>*e zdKm8E)j@`3m=cD9i^VRV4>BV>{Kat#%_!#8;DC%)Yhx70dZ?_z@oI2_hlz};7aa9d zRYEe^!xWW}^8}^^PI-ohnI1NJxXZ&V53@bY_prdj9PKsF1G~@lf&-K3U6lD;mxUe{ zd06FPwTHzXmgw3o_i)=_vs4qQaIjgXRpvQ`D>7@nQdgF7UgKfZV6$kjS?^)3a@t>~ zY9y3z;1Gj@71`wBZaToU_iztWi&yv_HhXwb=gV2#=kaAuJV4KRVK&%2s42wI@jQRn z<1e<%77sk4Nq8a018^(zr=R(0u-WEeyN4${?Dp`OhLP5Gc?b_Nk1Os_+^NVlVr#`A z=1DL3OkwqDF1q&Gqu6jrpul5iuZL$;(sfAikTW7O=DA?78W*UO3=h{y7)9$r(Ow-}!x=D3HShL|^L ze2977!|5UB4G$-jFf&EQ$R^6-&|k3D=? zq&C=$7;4UV=rlAq<%kUCf}!RU`s3jG2Q~i5sqW`FvG-PmG-&rc09OoV2Q->+OUAI ziFjEYm&Z{oj^c5Yi{siju85;V99PG|h+P>+Nwvuv#!~U%UZb>DuTsu)fJPWnx=}{u zW#hOej<3~cZWeEtxh{_K@gOXfRG~r~730Vo9(24ujvG`+vt@?|LEx6D97p@%!Kc!V z@nD+|8*Zw`Q7w+r30$2(^*Cz8@n9Se#ZfbkT5(K{V@e!1$5A_u=5e%$|J9Ix!j$%`XDj&;M$_TlFFa`jj4%&8N{%;Ba$k%SVe9U5+KjiW&vx5d$z z_8+q-H*pYI8phEm!%t|JCR%OENoC~C;y63p{59OPjN^6{4vM2y9IfN%6-Vzl?ues} z%6rCfXB=(gD2$^^9PK#wI67zSbWqYsv11%`j1GiG1XxTEe`5*XP~sH zNV(n!bB9*@sAk_d`YB;R`o}Rq^#`hiF`h%_Ge(aWouh*u?Ui3aS4`9Dl}fDUN^Q_$!XT<6y@kowg%Q zU*-R1Y_b@(EN(1Q&1Z6SzKs8xm-d zK+6OwCW24Wx(U=HDKwQ5sGPu!3EZUB+KN>at14DgtgcA?8VS_Q@LEc4P6W?3*>p=r zo}ECB^4yFhFM)jJbrcH}i#`x{j5PHVXq3Qh3EY}Mg9P|V#1FDpM;em=FMb*(f;$3| z#tEDqX__U_Jb@<4n<`Ss+XP;C^Zu7^@Z$FN1X^*3E~Z@qtrNj5QX4gLMZkrbLa3CvBPxAHy-^i80j^5F@LNT9#+0g6-}sAQ1hV8tN`3{^5rk}hCBTP-3wUAB#jI4mP;pTLik@2DC{fXdV-2)sY zfrk>e3ClNVh~ z&I1WNS0v}vT7Ppmvwe=L+Vcs#kif6(RcMZ62>FW%FdxFB%_|8UOW@-KK1tx!1YS$v z%>-W}#qk7QPvDINPS8%5|8Dv!jMl(r9$%kK;Ozw7=jaK%lfb+5JP|ziqpRGEIaJnl z;j@s&rmqg`uLP)o3s*o%f7E`ghNS$lRz@C##kk zL{<`ZGBEh9s!_;jT$cRrp%yI{PvVLs$|iA567kWdL=q*FD3!#OYJtxIXz(iK?0a<* zrIW#}MA6WElvE}eJWyh_ToTtNaeWduByk-*>1!&eX89zTt29C#-kCC!D{`zcrg9QD zCQ(T_=ScZY$>8RT9rMNn(dJVcCIb&%o)XoPK{8iYtdT@bC48jMZwhKBaZ3_+Ceb#D zY=*R(sh`BHN#rDvn?zm`y!|go2DhRl`C6?*{r*97dV21zta zqInV~iK$}@OT#1@C2^Zp8!OHqW13`Insg5laF(LRZ;Nl?-uiD$+HH$UQLrnAg$jLCLc(hQBnBjLFo{D+3`}BB689u=ZxVx(7{ci! zF)fLqOx@i%EaQ_Hmc($aj!0sRl95S_QZhP;;$scf;$s3Fo9Q)93564qn5cYG5|jU@ zb&B%qweR#KW+eGDaI8pTrpo6eF;~f~Bxq{3@|>||9&=2tu9maY8OzAk|ATw$|P1Lu`Y@ANvzgZHmy-o)MYIrpcXb{S~n%JQTbhpE3}op z?$+wovF5%c?oZ<3B(|vJ0ft%$$9+)ALyG&gBZXU&cqEA@nY~HAGl^~5x+{t8Nj#Rs z<4h9fttuDUDMF68lSfTv^e2+otsOsA$(|&hWHw zXpCWaiza?JiRZal#+g@=cp-@+NxaN6VVwD8tT~zl@kPad#s-p?c!DXZs0z&$UrXY6 z5);nWs+q#;NxYGSuPJ&Wi8qrtm&Exb-b&(R5@(Y5D2ca|c!ygri6H;?LB`zMK?mHd{(?~F;t=UIL@3NXU>l^RtljM!YL%inXD8pOYy~wfU}4aJB5gntHuYy%Tp+p!VRh5AS#~1 z6)9YuLYWjwq;MsLh32XhN~VH~v{G8FHa_@RWZ}b^(kZ=~)hE?uQ^B!ZE`@7Vcufj? zrcKFpDU?s4LJHTb0u8dX93Pxu{Em`#`iwUfQ>c_eZVXHh59L+93Lbe%Pu9)kN^MKXtZO)RIsdU{c3!WpG~yd zEQRLU+B9RF7O22Na(fD`QaH3bXL<^)Q@A6A!6^($p-l=uk2eESXg0yznL=BdN}+uU z-BpqvZ?2vYlnyC$7f>Sra&XT6niW7QS7V8rhZEL zYcE#m#z5^jD1}F#$YFITy_#Sqr7(Sh8J5EE6h^3IVhW2N&l#z_+XOQzh0!UHj8Pn` z$m+Nhe|r_kSthW%5*lRR$tg@pVX9i7WSWwd6ATMmAD&=lq%bpuSt-m;fmN2JO6H_6 zHzS#+WWM48#f6HC6c?wkL<#%uR12?6Fe_46$;gY`DY7bs)hSF4$&`?+NnvdYU#Ia+ z8tYP6pMsr6Bpp09+>pX!DLkIS#uV;KVN(isr?4f3tts4-!o4)OGiS5nee4*={aoS^ zhL3I@(CUM!z{o?2Bp=ZeRc0?fBz#15`1puTkEU>8g4veBb|pnfwH+z!OyN=r|D>=h zg(p&YA%!C;>`vjy6b@?6KgHGwhUGvCds28hg}vP76V0GCYp8= z1I_)~G*J0-s!ZV_?wtXKx46+#c$Wu7D!A0?rI#pgr$F*fM)H0Nr&9Qe zi^3hcE9V2nvniZbLdl0p&ZO{BM)GkApD6z{Bl%3p=P9h47+mvw!Ni_uzEotD{2LvP zKK!iYTgC5E_+H5mnbseboKrlX!cQ6b1qOCvaOuVJiwb{L{4IswQ@E)74<4Q=^hpMV zgZ`y1{hhJEDgVpBPBdwr+mlQ*g>w^)lR`|1%LD4EoCME6t+FYuELa8U<<8rA``Gq){o2%4w8Hc1xU%T^aPKtwq_H!NU1{`9 zqhA^$(-@UT|1<`qF=&#RG|3E9LOzTnjlpRQNrQ5hq1vU0AATZdxXMTTPwQy<&!aw# z@k+)hj!g$25R^|yV`3Wjrg5LjC#A7k$>cPqq%l=F)#jx!EyJfPnV~pSaaJ0$Gp%#d znEQWxl40NZX)MS{7Ajf9(bHI>e5vA!G?ry_mZz~^JFd(~Rxykd0#j>LvQ}}O;`)rv zhBP*2_+3giDc+sNJxaE!&HK~XH!1iCdn}Cyls}lpLutG=$xzO+S%nX$u|)|bTa`Sb z_^9GG#qEkTOKXp7Ja;J0nPi?wV|N;Fr}0i2Po{$_xBY1xNC&SGK9$CvH26N=(~2Z} z(|AVtKE>ecNF}_EdM=HFX}n7Jn8RrtPUEF?@Jy2B`819)8T7ri7t+C{-H|jto@8i{ zF9*Ju1|M7T-7spttX*DFJVqUT5A%2$ucz^r`u0XTc(IV0Z>DiVP0<1+Mcq$QN3RJl zP6}=w-%aBq8cE~5G~Ur@)2)A%rr541`h-msj>a1vH2{3MM})A&;5pJiIlrt!Hd zuy2vt7ix#SzEYhcJKv`9T^c8SyzS%rG=4~^0 zZ+oSJNYm~8%@Z0sqfIfF38 zwD8f=4>Fcn$5C!)w0+#+qm}>PEpyE&rj5Emg?2vf^wHJ_pM*4=5|pAOXZMaiI{8@U zW4VvcJ_>!z@G;Xz7p|9&aX!ZT=;oulkC8t1PcdDmm>xcQ`{?7NCv{ZP%SV4DeW^di zY@T9<`{<{8Z7Y^A6wN3`O&Fnn~&{& z@Ui;@ozG<84j+&E!Cf}*rg={C9Nwu-yA)a7tzDi}{Ag{ z_nq$0?{!^%P%L^fc3!7;K~KU1)67pkh+L7MncEu7Uw!ft>hAi%Sit9gO{8c|CkS#$F(JwTjKeM`-oVQWl2Kw2bM5l_yL;KBu^=( zefUZ&OSlC>iX>r6zMd9*_=+VAlrzoP8Nxl-ir*AW51t?uv!u8sH(64}k}E7JVF?3R z+7d3@m0XcRQ&I=zi9}wCt$Z$I2{$Rfe!AL{GM1FJO=U|+ZnWg=bi>zQt6D-=v(*`X z|5D8o9?R7&siCB%Vl7K9mb9>>fhF8cJUVW(#87#hX=q6!C8cK=7D^b0#+EeE88x+} z83Q;Y5b~Cp$bd6|Ep_6o-fjuMl4zyMtrhvz+ntuQwWOUT?JZ#fb1U&SkWLnT<;aD9a3#;8N>0!wLO9oof(~@46^s}Tt`HbKifZ5*L z5*~(qEa|I5Ge!BbIs;1&N6#=*XP7~j47OydCDSY!V#!cT##u7nl3|u`la8=tq$R^G z;UnMqGYpZ}Z=)<3!zp(+qb=e7x@(4cVul&3l2>P#zWfP*C7cdNnPkaC<)6(6COFxW zDKtC7BpJz>rp?YA4srd=AYxRWX~`^0ezW9vOJ-X#$C6hqdCii!mdvx{ZcFar;##u6 zk`hD|wd{IDeh)={mn98n1_vx}wMaHua{Ej(en-x|mfUB_lZ=2R_gnG+ zx1J@BGx9S7A0FfiGQu;>L$psm(>$!WMR6+wJ~L>2M5~WlvP}sk+m*0&2e$*ar-pGC zw+}xcEZMDO70u2xk82^>W69H&9O0}j*{l2Ic}w`v;2D~lY*_Yjrpos#9#DKP(|XX7 zLm7Tp7mHn9(A~#1;#`>UFIw`l2I}BU^AbZk(|j<~ykf~QOMaYbF3mJqv&?m~%yCOz zx8yTRKDXozOHNqwfhDIcdDD`&EP0nliX|u2^4pg1NpjJT%idw;%rb|c${}(uaJ}B= zM}WG-(c}6x*@u>#vE*Y*KGE(UX>#&BIC~}viViL-9F1)wB!#JWCGFGI7NOLpsYO6;q07MPJbh1+5`Pb|IIL z*de(hBqc(@0T>AdXZz(L$s#EvxHJwp52byZCE3ctg zQ?ZsJCwp^9YAe4bBVj1!&o=kWHhCe*4@t|A+#ZrTAt?xn2}#3{)D20!klY%Q1|g{* z5+0R|5`E?|wQomov-zaXg+Xf+lG{|RSx8=)Z5oG!`PM|k$XQUKsRrTG*`|3&_^lHs z(jpWbo;;LVg`{;z28U!wNbU$pn~<~(NxP69o-@szq2QyIhwy@3!8@q!LsA%$E+Od< z68@5frDI4sWq4;LyjtrTl5TXVyBQP`@9~`O4Eq$*M|qEs^ihh$7hhU;WUGCng*@i}G$7h;a7Ime7*R?iI1@J4gY zSo%E8OjJ#N?2Ze`cm}_lnV?A0X-=@XlQbp_*VK?q3&}%}&5-FKnGurD!*Vt(Gea_q z&*Ve0R!z-j_mC_I$()ePRSCZco2P{F=QYg2kSx;bN+xp>EQ>?3L?uf@vO>u+#pR0Z z!j4oUvaAZp>i?0i3(0zp9+tIX*$|SAA!!npreV1&B%8Pk!t&~qId_NT9`5CkTnfp( zA-OLk7en$#NbYB#=9u3?@_R@g2+4z-9aB0aZ-?X^Zl#cH3CW?591h9WkUSESCqwd7 zC@}aa6F>?1HYMA+JCr=0kx!gsc4qi4B~OH8cSf>kj@gsp&nkIZaj)VtA=#&7;~c{w zSoVkHfJ&ZIq~u^o9@p0AL-ImMUeCynD0xNksN#zuc}dC3ibpawkFlzf*A$N{evoN> zBP1tO!m-{A$y>@#Dt?#Id6zlB^bW~;A$eb$PAPsAk`I)y?`b6;hUAQrzcPJ4*6JsU zpDKP95}6y!_Y19_SNt+0Uxnmr^lbeo+3S;yK0IYVD_t&IKhu zGoLe(UzIddHD*FlGW@AoLH?JLE^~tnVfCMo{2P)`Si<3;8dYH|Bu+-3?zw8vQ;aJn z6xozik_t&WBk`43VWIO>Kv+c6^~$htM4Gk3GIXwqC}t^Mrg*txF-0mA56cx9UP8&N zxxrj$p;TC|3QOs*TpgB5VW}LJGU_~A%PQeO*XW>hpq!Fx6|W0R`HZ|mSgu!oLq<|D zEUVRL_PQ}FwZn3YHr*7KDoUzmG^>TBdWP3fQZp>Il-!(=7o}5nSn6jaIbq4o@H{2? zVX32}K(TJ7wO&}Zs3*5(Bn`r1ls8mtq7eDmSGtbmce1U zJuI!l(l#vZ!qQqpbVpd)C}BMB4F9*>tLU z&2KZ_Qekvh#)M_8%8PQFcDPx_hh>5aCx&HCSmuUhl2#{Y;x;8LQ!{*8Sf(qVp*T}< zR;G2flD~D(dCV5IGhcCmB1c@PWKmcaD_NqrG%U-)vRwH}MQX0#rkfX}G|MU#mYx@+ zH>>NyvR);x^863W#<0AoL*EsaO<~y`mM6nW~?1bb}H^td_u9&Jo8jo_Jrk`uV_hvig8GGd-No#7uU zITMzTlzgoCiQ=bm%jJ;O^GrG{epmnz zhy@8j9^00)Wu6H`csET2R!N99Bm&8TT&5lOY18Y9>{Zl}`jlLOASPuY*FZ`@KAUH* zR7pulDFnCqS3$0ZTruC2*6PK1!L>T&Wwcs-z9|Q}7E()lT}R|Ef9VgTJc36MEc_wc z4UmeEs*q}sN(e4rZ$fbSS{ZVqlE(8*hxx$+?J8OwsGQa6kQyrK&8x53rl#^K^MlLU zn-N@f*G6#1#COBUb0E2pDUhj3}w4x|9mX@Tj%rZJ{2q!HvcNIeK&;H(e1 z7197=APrSv`TXGJPnHMgo4v{#Lz+N%AJl~iX$I*4=?G~KX#r^mX|JsC!GBL~ zhe3uzMnFbF#%jz*>8g!}jDgHs5X7H_!Xo)N)fuliK{Y4x-w@3=33|qPUFQt zWIkj8WCns=Hk)owHZu`Cf19N^RKIba1DVUQ)I&Z7p~EaB3zeO zb$A!UY-hO}!tNw|4#0O>?uFdPWYc%y?nm(K=mExdLGa+{L9Nniy@D5n!9rL5$X0A^8{o!WGCI$D$j?a`XrGb0| z`B)V`Q2Y>bTFL0lC}*_FBlHuoiOZjV>E}Wsc$Z%;6S-U@ z6};3Vyujz#@AL4NV6BUmn>Rg0`s_WO^1$W#=mBvMP{W|7JwH;PmfsV;JpNEMMfi%eCKrMq+L-%@bdB2#&hA!)P7u+)%X zoA+H5Jo>IFLPE9LBDaX-iR6o9t3r;*_(g_x*m3D1lPmJTBJ+&)sv}ZYI~HVyc%w*8 zWszIiU4+knepqB0DlwUABlVn3^uLJ&k9qmb>hi^=sRU7uH6Im{@NMtdWlFO<#Ij<#ZiuT!&MhaEFLS(hb8j+Q>tj0MC3l)Z|ed@2(judVX z*(mam$Yv%v7f6I|JScLv$UV#@5xPg?_ln#v!Wog@rxNxhrztv2WB`dAV!;ygfXcUu zJR-73=SZDLxs^nAifj|vF7lYJ#p7y!pL#_d4!28JkbJiqd_vVuEiq3rHTzv-UE~cVFDx}DlyGHf_N2($B4us4#+G+P z-sPz!k`#GQ1XoY5gZ7Ws9l`ADsC#E+MnPgE|; z46DS?Mb4_Eyhw%E2rYzf&Cw&mzDQ-n}XJ3RdF?!ItZ7sb$N}w%lNgwcJ#(rK&9zZK-5SWm|5vrR8#SlN}`Rb<2Z| zlfB$f!U*?UZmQX`X}PIkOLbLX>x|`Q_i|Iy7OJsY+m>5wsc%d76(-x399!~i$yepq zmYZB#K3i^B{$6hC*ixYKx{6sVg6=o0F!ku_ia>{wTh(j>RWP=2AQldEn=OrPxx%en00$wIC`U%rlUI0!IqjU1I?rrPqjEjw(PX3KP2 zHrw*BEi)KTTb9|f+?H9k%x0dfGD~ckW6NAy7V28Ow9?G8Wxg$+t~4yaD=yHgtO^3P zNYxgrgw>^5B{8ea3R_m%a<47-*|N%()wZm+WrHniY+0*iohlcuG9%O!d(B#9HrjHR zEl;UrQ^wjoO72!HQoeVU;h^`cTOCaK=xVbsBj2y&S;aS3n*$j+JvpTOsN!M8=M`U2q@5$Se60pwwB;q9 z1FOx;w!C7?F`XI}Smkn%(3#`5yl%@`TfVU64O>pIiBn!`-n8YP)#fASk1cQU>{??^ zYPjB35sgdF*nbw|b%xAWIuGIST-WpaNKo)GS{M9M6Qjr9P^)Qm`*h};>GS`oQ9B26OFG$OSla!W+&MWjCG z6%pR&)QLzzL~^xnUPSVh%+-N5tuuR-)Q!lAb-@-Z@`vQsh%|^u!-zDBh|w-I!d9vg zxv!~nn@U)1tgezYi%9c`w93d^M8sKVZr5tdhAZiv{v~Yilx_^wh?I;kscB0 z$?N}!bcje{M7l(zW2R##uA_#cvv#57-1VkwM0oCXQwd#SRJ$u@6aDEGk=_v*6p?wh z^odAc^>aW(`l(L;h|mqH@lYbR(k=rd!EWlm-VD~E86WBli^%YZOpF8v;E0HfjL6tX z@Buw4BGcEKF%fxfy%`;mHS5h&Bzo`g(Rwp3BI7xWC1wI+l9B(j-b{+f>{AQR6O|lLq_zDKDf&&;b1FHQksnfWI3f>i z2;O9SAtFb(TQjXMMdU^0{E5FAZ7`=Zk`I~BYWZW8d>4`LBk~DT zIwGG%O6=RAH z4_p1)XxD5su1az@24f{?Ga`OOk}9Mm6_K{uL~dot){Q2dCGQV4p)47((JbC*iaJV` z*jYj1MY5!r67sApxhzXA&yph<3#T@k;+atdk|TW=VrADbQ+NMRu>Jq`qQ-?mLqujWewcl{Ctd+p>gzpo1@%u?v5XOl+DZ z&9bCv{25~X`mkdKc21wYKod`3-2R4JAHR&c4l8tR6r2$1yRr_s3;18qV(R2 z2nYyB5kv$FiXy%D-jUu#MJ(8R?;Xo$L8Z$7l)-$U?Yw36M{LjtO*1pj!gn6X-0Qu0mO&E(!FTtR9~HU;Y&C zAyK`A_Dq0XmCW7}B;dxC)T&PccO=kP^jRWl`xP=AkiftMrY0~gfk6q}mB4)oj7?y0 z0z(oQCP|pX&;;%lytmNS?@d<26Br@PkwQlcy+`OMp+Af8y$OtwU}B0^=Kci6CGc

    RR$QuGw1}(cBL8xXE0C_v%tj}CSIri1PrXT{XD<;qeKD01vzciB9Igo zV|8&Rp%$O^y?Vr~#?VUL4KPw0mV=T|bTb2+bMG(>N9Zxaur`hkLtRTQ{nJx99_pbk z3VIbNwF6N*R3c0MLj;9QGyg}&wqnz}vXwB&DcSoZVmVW@$YLi^VX=>HjtbsY9R6Ha0W;JxxL7{0?nA5^kLD`i5=@f*1Y>8p z%gMj_SM00Rk8%WFMzgM|5@ z7#TQ!Ykh1U1)7i|ZH1k_CN@|T+g=~3UPotZ4L0~(V&K)CtOsOK_?{=8wtVKYwD7)D z%b{b`d4F(BQ&B&vz`p>&n#b_ROKZk z#0F(m+F9)5#dcr?MSOq|W{NHxP;xmjljw|{f6YoHNnLh#w2{Nh$uUw;k|Tx$94qe{ zX%rp{Y&$qv)xpgd~*BvqkcSN^?>G%$E1U0MU-zy{Nsl-D9>We>fIK@;@8o&Rh zDN5>*x%~EfNJajgb%8?((!PB?$1g$gx9@AFNEcWJ0ng9@HIf7Tkuflk$eZI2s#=e3 zy*%0?U-8O8vq;NYqB9+X%ERfLtZqK*B(Z62Y>-errr_(Ro3f^|+@%;n?F(;c@Am5T zt@<@+U5HhC?wOM6U$XE|p2UADH6<@6u&6b3qy2-7G?nmCLe*`@E^E~&H>3HCua-5H!R=DNWaYY;qo0_a>El^tCQA`?n4EV`EyAvw~?a4gX!!D|*K2ry9 z3`?H1Jlx)$ckh=I({dM;A zX)z`Vj0F@p=q|le(hal{nQ)os={<5sB(tPuC58YNSm(A3VPYMLPL#nOi9ZH%4*vf1 z`uf6blYke)!zbyNEZd)N1op3sjWL&D@#;#JGCh{xN=lx@*HF#j00qmc#dt6Q*7n~Q z%-Y-HffO#Ld{VRrhkIwbXZ0EaMb^|=DkmcR`xhTkZYNJeP;x^3eeF1aLRIM9s@iKo z)>Io#2c>=H2bx>>L0P3Xbi6B}eV9o%e?u#nL4vT6+Of1L9B8kl4#=Zi-bB3B2yszn zTWfhpjs>@<`nmj~I68&h%n8tx4#T-_pw)H%@<(zZ2j*q$)$-6H&i6uc|u=7R0V8*x{Pe6_s_Dm&L~_gw2ds z?0oh5>s}Nw(y#>Zcx(A=SHhJMx}`l4#nI`~p8___UaP2(d%h_wkUWALfy&7LbZd3j zz#ngEmfmcCdnQarg={q${=8rGl}27FRh2EJgTS)Bsu8LSYUe70`fO)c2R|)n_jXm_ zD+8V^jU`ooA`kbwW{p=Dx0h7_&RhDUyk9N^%SThZFmn8Qq>0)qag}orPDA+V-KQ2E z0OVm!G&wNzwi({+~a0MzM+lcVAxN3D_Hisf`hj;et9t#4`dUHd6Ndlu<& z3^-AHnQyKu*redC{+_E-!-t&r3YMf7<*9t!A$VdFMyweT$g`71G>0Z+GN*F{PItK{-6I;-SYqRp+i$5 z1KCZRGCG50X-dk$SJJ+{cm?UBHR@%a?C`@7B5NPAX?hgzEsg?kO)hVa@2BcE_FZ4e z_#J<&E-v-3EOdkH*`v&I7Z{(%8kCtcRorWWu8xN5-Bq>OoCtDSCQMCvzB?KfQu!^^0*2j^SWHuQg>^m zzLc(GTa^mh-*I z$-?N2x04vN-KVSFs2H{(w(0Fc`>ujb`C+zFkEXDFm2)n8HS=;;Y^|i9SK009|4-Sy z^|f_n>B9didT+W?za6N=xvG1gsj2)!cH^1DQz)Y2TOpk9Nwq){~y+-M<`@ElM?-<%*@Z-4Ow z`m7;g?uWL?p4+kpVhSadbYX8S-EEDJ^m4-^U!Ls0SXb)!i)Uxp(%hi!JM)jSl*`8P znNeWNmR2Hf=eA4LAcZJG_j7bh!yx5<7?Ig^c3Fz3)X#r3w7#=X*D$B3ENLuk(^A6XjhS?wbB+VWV+?H(^~=1Z5!w+h?kAM({o%cw7muc|qJOP3j0 z<0Uk3%$unvepzid?NQIPdhdvUTf-N-Oud~q*2+p7Q&eQ>grULuZfU$xWv!=V|0tM6 zi)>78$M*z|4`>Cpsy#n}ad*#brd`9M>OLJ8lV7rib9@16n#Hf_oY@)>ZspMAcXAAl zG+zC9!?5tWvF(;5{cowR9gUYVOTDrxgZb5lDfRkG50p+*q44#T#E|N}p~6%->Ukw` z7M=+P@yF@q!+iEYd1SxX;9jva&Xjz^Ur0@^&8=5mr^eWlmxml^%_r>S*w%o#0;b%XrB$Ff?J_X%i(xFQ|spvM) zvxZWvt>xMpx}1!YA&Gu*4>u~-eZ2=nONrL`>>}=I!891Z&6;U4nV9W%-O3AtDB7S+ zmYX=?{INaxk@7REL~_E!W?s54veq}0beD~S@DqsnW;!^yNNXLJf2$_8R2Jd2BtTJy zPfuF!dDw+5p)el>hESkA{wiWdX18@Y%=vOQW>&(nu^SuIfr z(ce|ufAUqP!6p>TP-gY3om3_%n9=Fh*5J7C2U>B1G<>lD2YNd^z2TS0G!u|vn?27l zX%A?AS+}ojlW%TeBfv`3>21T({+{MmWeU2SYvjy&>9bBAQS-y z;)bN|7qgaLTgYC$vXaL0paNVyvN`6KsGtADo4Gv&)VQ`0pB#WEt7)A;YNw)Kl{zqk zxDi_-s0QC3NdO11@?&n5@;RLywb)0Zj!6+r7XMcdTi$HWHIHw^3K@(xp)P6j=cOS) zAiP({K}dcnHrx0CJW`D9W!1X?K-04W3VD?h(ud66ZnARV3MPYUtxV&Ne7L<~XE1dT z=WhXS`$_K}lhqR>Hp2RTf$0+6jGJzI;X{qWau^I>Z`U3`F|e9CPg$GJ)F>hyWSQm! zvv#ZL?foY}!%W`BCkf@>Ypqr^gLz|UZ(>&Nua>>IXtq}h@l>Ox&BJm>MpZzPJ{4TI z)MPY9Q7q*ZM$+3m*U^WJ9%sKAZf!qdG+rv(Sblj`$M3kZt4G)44o9-ki`9PyC}KFN zTlOZY zgFx$|Ut}^&IoRZAd?|kxAogVc4q5{pCx1ZDofi<=+Xp4=yaD+IG z5dnuU!kZUU3X^6mx2fC9d2F%vYRlPF7Nfh0A}IwBmQ_k|JR0P}E{)(mUInx0k&}(L zR5vv<*pnAr$bWz zbelBZJYm#8{p>zgVOM6howpRxD$O4ARc-2!99^W)H!{u1i~SuMq>8^)H@73Lb!ke~ z>(0n-boGG6$6W3vNXx~5D%mf)k(P~EOqi>)y1lYbX4EN6O(Y4Kim<-e+0PO2K`~9;v&uzBKv<;3o|GC!(e`o3`PYx`@=*(?{acUDNv3Q|cH;^UuWK z7b9FoZj96mwjE--p3?u{5+3gCKxlN8`C7~oaEw87Y*vfq-+-Y~Ddic8XGyn{T2Zm> zW>VBwOYZw<{&9MKF@B6=2R$6id%iyJx@V@>Vj?v%!JPm}YYU5nN^{m;Qgmm|%QE=b z^hB?`)ioEXc-<+O-ucT4K%nh-HC1rl7roRJ9-t7Tc9x%*!JxC(=wXCbX+gBmN~s?* z*tO#Ofm>Yd9u&~zY^C;8<57oUqs-&>Nv?=(fYiyAzL=Mt`*eXLUl#biC_*|tjb3dZ z3-(4`*2)#`L%y1cZ7^FYEZx+hFUT+XiJL^ATP-hoAZq5ooH-{OJ6)Kf62eAyK{_j}M zbXU%zGuAst_o=+aa7YG9sp)O+Mc_pmKuR6zX$K&%plRtRb>xHX$rT&EJUICOm?+z? zijYPHB7b|9)N?v)$wU%SVgU9QexzgWTKM@r920i=3sH`^wY9DiiN&*tyI{t?cwOHy zVqPBXEnxWd=>A@2|HvvbKr%6aZWuz;j9l zI>1HlbLM-mql4R1;bdnlMQ}8Je56m<142o>f`1IbOsU{>T?&`Ala@eZTW5l{?4=ah zTZmK7FBO(m_AM2=JpRnA-->=PgZ<#QUu7ILlqMS#1(W?sE9AR>`p)Tkemp3>Ft!Hk zU~FormLLa=kYfkQ$w_owHM{t!eSq*Vt-0!rU{1Ed@55K1j4(U84w~(}4oV@L=(ctu zqSQhXD;W^?q0cUS=_PT;;stJ=>~=fdFBS_0R?F!5&sxDQcIm>Lw7JoiPMW8>BW z$^y0H2!WJ}xe|no_1nl9LXlq~ZG-RdV%2mlU9F=>-JMqKA|jdDTmEJ#_>tx}KM{&b z_mmUaj}zf!v-IF->GZh3Lhg-K_)5S>%q9i#7Kqq)doQ;0_PGuWD@*$X(otnF zT2*7)a4ZAD&Ql4?U%8zwy}*lN{rD5XiPFg$ z#9Z!Q``OPT^XuCw>b7M}g*{dHq0(bnJn)J)C;3NeQFTUdbgr_zGN42XI#E_$Ac;)F z(eK@up#d!aZ`r-sdHr6;FLPGUFrLjp7mjo`mK6wUu2#-dwyVHHvgYanX9GJj8I{JJ zfrW_*Ol;grHr{<)io-hw!N<-Ri0+UiKiS6`Z)2!tLnb>SbSFw)TUTup(z*Vw>%tLLx;V$deK5>!Xcyrs4Q0OgHt7d_4mzI1*)c_>q;wAZu2Wq9ke)unY|KoBd#ofB;UyA9LtHpz}e_Sdj- zHHiAhE!__LiVs=h*+ZGOi`^{j7dA2B`^M0hZ2~mekoGH#p4k7(14r!p!RL!8HRf3& zIE2(xRUWFN^B`3}`*;1Lxf!%;=V0zg@{FQrqIFrWFAW}Q;OHz_CsuU%>y&j@3<6@X zf>pD)Ng&T$*L(o4>acO!?r!dGiYKys6J3&llrQ7RAjhfQU#25VWEcBg0@%cLr+7*v zqaGnrFckow&l41Lefe8oqA48ey8HVVB%bkgyF%42f~lvP<{AaXoMPNOsO~SWu4|&oZU_abXHk@g1ZiE zA#RbS*lb3Nb_#~Co3_J0!$pf|jOQO;w|reK9$QVAIu@qQ&lq0%ibMjHEx(7o5U%CY zbRk~+5EnEY@(cYV-WrOZUD~oHzsQN`j;S0U#F#9G__PnbOJL>_wEi?k zRruJvfQ8NB+za(N1LlqO9!n*Ow~D|&aSDI_)#Mjd!Wt?z?`nNhd!2`}^)f|NH#f=y zm5v^i*uWC}B;4gY6{&Hw4sWgiZ0tJWsHM7998VkvuI;0*baO>!C z=Wnw|_9vzl4yT)GEx49@r(Gy8HrY^%1zsw-cFIC!%4vAVf@kS|WNazPQ7UmjNW}@; z$@0(f(<01eW;%o97w8HO!WbcqEHP1SOZ+qVAV(C9IApWdm{xq<i~5z{Qa%fQ@7tdI2epBZ*D&nW`TkhQYwC5-J{P)$b!IT z*9Cf!%6~lnlTPSW6{fM2$ug2GRwVSm;)y2jF=i>VBIO2?Qel+uXdMS!1>AVlUWc8o6UEYcx;^couN<`_NgKQ z<4D?ejI?GD&)h0m1#OehXkVABzU>%2pMRKQ;8~pB@956)te@ZbeE-pv8pNcO(lcFv%6AM)fD?YXCw2TW!Z-8IPfr8tZP;0V@l{B$iWe&*!YV`?w~duMz80hSAT&@a3zlZx zZ0lHZN(u|f7xs_5f)M^%w-$kOF@6v{t9^9OxGfK>S#FS;eA&Yl;YAp9@0pjr$_=?ttN)oOO2TxbG5J+$nbHY^@4CyEm}>EZs4VXI z-Z3LvP3qK&+o-{bG-3!{wgxP6=9%|4*BPSqM5avJ&C$myRTbN|$(S?@V8d+fD|$H% zDQFs@@_o2Q)5lLY=j!Cf>bn=~LGI!woT~~L@8kn<`awuKb1FE_{~$$*xExghNWJoy zUorSIsjGw8>Rl};h<`~y9U3{Eh>1}m!?RBh})XpG%Y2FjgaS}zE&s> z!$j|a{bCJSyeE>a#TMI(2}cCy{@_kWS1lCr;gsp_56ds%QEh)T%de=9_FDh^ zRVkew9{X2<^@D#o<;`kRe~EE`cPz2vtCuGQ3-ew|XVN6TdDZPzLc0oDImxOh3P#N? zYsf1qWVpG~D*|b(jLKK?1{(SK@^$u)@M3(u)!QloRJsE^X5&R`WIHaU z`7KSK*rOu>OBvtK-cE#hMXE+)b2d}9l#S9a!6l7HC17nb^uPc$I zB|o7Ch!!OXF840nv$M(Do15B5Cl;r!mayh5xG|mG1Owm&rjL5{r05OF#|}-lwSdEe zSWLSHJ0`}jN2Ef1wILjcYA{79r%?Ffggp%0>(U`x$v@pg(M!wL6;J$X**YJN7IHkU zig~QuCv92H>?HxvAMexY$J@!(%G2r1qcpW4VQ*z~8rN5kDrQA_D>X%8=kBRPd(f?^ zq_SXSS2r`PtG{~c&iwH$i=Ad63TB_C<+S3^5$fepL6r7(BJ}bSApyko(QfI; z;UO>7{@z@AnfR((#}s#+J(&t>6r<@MNRBT_f1?7Pau4`JeURQn6$79LhDW7esJdh< zyBtue=8Fr8VZt|+%@bpvA2z$MXE_%(-K<RHGO zmFZMF!{m}=G(U3*_Q;g|rA!T38Yx0@F#ydz$xBKbcX@G!Q(_Ov@v!TT5c8s3>vx#Q zc3(Ak+fxSzF=Liq+TqDcP5!($@-GEnyA66s0A%;?k9wM3};m19U&22O7QBTH~F_viX@TD;O6lMPucT9pK<)0Z<@UmSuLMmm;9 zW~^>RKBP_ZK2oX~nqB#7IymMn+g@(b{(SNXgRuH~ZJbJAWZ1Y7k0BTAjt4Ac<(;4X zs=EB{{#Mo(DF(b(wq#C!8OGS8OJD1^C~L_)yzW^ownGVRb*Ic2aEnR7x1JV=fpo6p zW+G58U9Hage(W6P#P;P4$2vQUCK?$@;A1-(wa}DgWWaEV@RPUiSY_U$-cjOF4gE#? zcKhy$WY4Mb^IzmLCQc;VcM%@x7pC4!kdm(9^8i-1OEv6*h{SPQY&o$zB?RVIm_Jo# zx-;|tWVlY5UfxYU%;P{i~)-)F02NPw9&bhN80sw}jdPM!V)XVyqdq9dO1mv)jo6GCVkXKR%Iy%}|bc1IdD zTTBfdHtXc#T|QDF$dZluUBpCc%H1Hp{yrWski&?$x4$p1r%ArLoXn7$%e8Q{GC&CV z;CSVu_^5EP$&s@fm}540`>E(c`JHR+gsXAqSlNB^D8bTldTZIC>r!?#PSAv7st#$= zN2Ee5xoE%q(-t|Nz6W#<)=$^7btM`GeR`?Y+}*{5GZ8`6Oi5v4;m<5;F+ZQo)KsRKN84Wu*zncm=ijp!AP2RM+t?D-0yVG%wMh@5F^^GBY z+QhE&)t@=LndBIo_U;Rw;d`~St9TCR_gFGGpqF(gkp2q;Udc|R>+L!p|SUEiGX`t4;l z0JESpk){<>y}U^Wkw1;Fc6O@l;>TBWO4o_>!j<(aF{Crh(N`k{v~>y*pt?d-MLLe| zP3?s|*+MfUb|w$oQUQRf58Z_dOU0_S+&8;eRLvzGG?!R)-((PMAFYg7%x=n3c)YoK z@5~$SfL*X7opQ!slaf0f?7S<Sll+K=Bm=INv3U zvGgKY6Xj!dC`rEV{v{01$AiSt$^@n`hO2_g4Ub->2htPR71VB`XG`f~A?r$gY(?o}IrJ{IDW?)jBKirS1cF(*3Sw(Nu zeb^azi&68svqxe~U5sO^)`iy-fejIhFJbHMeD-35FP3eo-DInJSB{H)9K`2b@r54V z>XqNNPG`ZNn~(!vI3&k6H?x)DOup85a0tsVLwXve4oytr*v_44?u~u}3vn_8(n%lK z!RU5;o(6^s4;;%a<ra5gM-#W1(|@ zGR#0H5q>A#)RE5uFHu|7a{{0jg5Kx5o5v#IV~e$y;{>K?Q|aOh4K#|#AB%W*b8Gmf zxJc|(BHMRzT&T;eU6gt_isig9@U!G zb@51O3v>DAZg!cJ`nb^djGpIh?u8sNDAQ5NySH|cT1I1wlcrVq%t| zoN{7%@}DdL(xSjCI}dm7A0FE;%KODS3q(R6H?F&Y^1H>vcWci!#tYzLSBs1KV`KDK z*wYwJ7sB~563N!ysGCEm-Jvj44`#3V&P3ljBde^)3i88&Ab(94OcRngpFa{=j^pjv z&!peQ8rh#5N6bWmCjq%!21>QGTiJy*cvr<@cAg0S>2PZw@YijH=wK$2f~_pPwsHH& z6DK~>F`is;EjsV23-7QMs&Hx?;H6QskFnQ#Rk~_s&9Q2w$7Z-kGGQl$okd zqMQ3p)`A&1+)52Nt6gjsAA{Z5R3=(zAU}w$+O(pK-wF;C;X&o(E{4x0I35*{yMEvp zL?4~}&eXWWAb6YYwkBhYjMaOMQx0!AxlC5=bQrH!{Y1~2`&GQ5J7 zewvj$O7Mj^=znr4h$mCJCmezUys~VSrM_7J+?@L_WLspOV0m&e&2c;5%Mzhmo7g{t z&EpXhKTY2}>(^5M9IUy0(0&vf%C9tfjQov`nKVg@+4X~MR8o!G z#YNH+nFS0%x7S97gp-ro!`fw3nJ$#rnv8S5YVGU z?M?da@@BAkgYYsH>@6#nrbmX9=yZ4c5W52Q1>Y;bI2?a+EcfP@`Y=A+e43wK_^A=5 zc;)XF`C4zOOxC-b>-?)t3}J5mW^z4pGxqdUoF!vW$a2bHyqmvATycDJHx3f4(vCbC z2C}R7|AhkT_F>}!IjnuhrXVgq3=R+N*w3(P^WJJkRI@r3p0%WL8RjH^sPKu`Gvht55=)ekOnx-$Hcqo%q1#LAVt>8V5e+hfEqnDj!7#?2YfvVt}jJfN45= zd>H)S@zpzPo3}(=B(!Gs#3!4Y;F{mfmJV~s2{Ox^9MirmE47ZbCa2WijWgBk5-Fz$ z#;$Yk0d}DKqx5<6ts{}1_KExn1_pO%<^EGIc+;zI``tX$lELWy0lLvpDjV6_Ii?cn z1gJSEG_VbPKd0xW5Mg@vW9$w#Iy) zy@yPH`-emSP?mw0fI#r??-i()|G0|xJiU4t6WwkzzWbZ_ucxv?&v`ms;DEd(rlYS{ zI!Auhka-ZHXBC*WO`(s17#*yLLfi>ceHv_idT$pzIGvY}#_mi(E#&Y}G2;LOWk!~* zxM-1B8t*-_lton3Xr!>T^qaf! zEX#XU*W7Ic7DsAR&CjocuN3L6ahI9i$~rlOD-GIgUpfs*C@50@*K%;KG8;~3T3=-Y z?}W*D+}QJa#q|YT5?r8;Sc3n>0YDvf7DjDrE9h->R&banCMR z$K`QC{?)Xpu&_DI&C>yjPPo3D&IgLM5@XSC{xu5nl0zbct2p0dxI>#?FBFVosCPN% z<7V+nD2^gIoy|BnnrcnnCPDfesBW)}s6;K`*bEsWV*AsW=(OGm$O?smwI-c_2$;a~ zfBArr6)pUQ)-F@V^@>H6iTAqOU31B0aK11=WEk_>q;B3i#Dn!)CTYP-pq&VMXuR^! zilOcG694;)OC5oDuUEpOMHgmXU7fo9y86v-sLF1RiV0srkt;-o_AH%FI-o(W?~8Qt zQI^0PQfDuxj*9(M3wPQGw(!0e8d@lls-JqP%d#p~$o=jkU6YOPGTO#Mk2=LnZ;+DMKYHde{9@J zC|Qo2qg6hw7@qNR0jdPf$W+BlFf!&}eF(&x-*_^Vz}C+SVM)GjU3s9IY0<%hKZcb8 zfsFaX;Ex*&BCEV4cAbZmNMyUQ)(<3@_ts_6S5Z@$SHWv5L;WFz-Z2VzQ}mIbAsu%y zez@vm*pypHB~a~85A5v+@bKMbF;+{+s@=4d#r;XP<8MXM+AWiFMFV@JYk{e`ouK&U z^+Xgl@6(Q<_$1MNpe1Yfi2$h!UnVPr=&IR(PIQgdU3DfzyoXq$Hsdu!Z1EgDlZgO* z$-DarE{8-jW%k3VnzyFPBIciI7>z&Ph>}Fh7ppWg*J;nJ4CT#UZ$kDD;oAFZN=FA- zk`~6UIVXAhDx8$_6|!fFif9(uX6ji2zg7ZZ@d--aWt)V!w+I8vW^V4)Yme9%Gml=vbUL1^i#A!AefltdOsv8;WJ0XlJ!Km2z6ecsE8{}3Ul?17{f3Cu zozhY_aUW(yDtE!gB@qBmB262l62Mh6QZ}i%zP9b zEbd7<(!rxkF70JJn(7Z$i*EiAkkA}M$?L)O|0i52Qu2B{XX}$OK~o!Qp;Vmwvg;}2 zcJ^@Z)Eu(+0a)-r_W9>|ni z3!hQ`>S#IW9FNPJcPr6qcfE(7+=v=LSr0uG#4?IlSh)Jp-TN=LM_Y%7D=nF`EmZ8y zM3k`v*fIPqEJwP(o+BfIE+*ti?KQ$Z2;#+f##GMEbpe52CZ@P)&TYYH>LEzKK3u3^ zKP!8|eVRj2I-M0f)ufG9&sN1vKIUyXM6*ZaX%t8OF9rS{g_A+$ep;tvaY1=_2rxl+ zxXmIb(}JxjrbD<+95#;3gaF9!h-b=R@1$@}q#p(k@Yolhk^&I_GC@4E(8mt{nP^HJ zkje=tou54tQztz-YGf+FcwL7QhVq=H=){iFXP2zWgS3OBRC_qJ+y$nW5W}aNSx|?p zm%yPupHHF$Lj@lNeL2E}WnwrR$}nHSw3jLTDHzLgJiASqrz3s2+?C zS06(K_IPTR2NXHKb904PZMs9sst1@SSMni9e!3X{yEH`Y?g)ITzdSk)Sg2%XJemNU zSk^`7TZT^5dJKUqXpP+}rn6h-p_^epO_ETP(1!ww^3v^{c~A1foU8GIitF+R>@wkVWfO;iFK30el;FRq`Z`w;K@&xglCV#DbVUeZa|? z%&x|tz81Sbv1gUN9XoXSKHKsBx&SR+Cv9IJR*D$ur|=gk;o_KDr*o%t z{jo@?@5#dYfof@1G>B+OibJj?2zJT5U#`&W zMgFoI_{3RBxstbnQ{}#B-Sy0s2wMpgN!pIy>lUCNc|i@g_xCK>;6pENq!oO;6m;v} zVi&P5!bcuD-5Ks0?rbmvx{NkE4(PQMQK-@^&_J8@gSYbwe*G5~e4U20D=Wb8`h*Ek zlwj7F*2<#y?*C6erW5B@!WrgD5E6OAoHEy|$BU^17Tq)i@kxME%f z<~c3~Fq@j!ddDcKS}(J%LcY!?~RK~-4ECDI@BmvxgSys0P zBbL&xhF|7daqt+B!-Rg%iQdsz_XDxk>0>fKYV;TVlS8^XDhsWg4f8B#qTM6H)hN(r&UDo1o~q%AbgMIZ@O#!1-@G+2FT$^R+F3+M0H=YQ@l9ay-i)pf3>PwS)Udh=fw;Kh}2U$ z9Ui^uE{2`+uh)4>7ukH>1R-Jdq|6d{4r#%vLgtOFsOAuY`s?MR|2X()GA|>GvY$G| zXhOs}rx*9K&gj|Ak06By&CwU{s}K=lEqY8;UC`N&%qyewL{8p zAR6{@61pDvLLUbwM<;)DKQKIDel;2o62k4a=+bWNERU*3NptVGIex!1%a|MVEqWwc zO@CXFTq=9_`LN%#3tQ($FaeouQIWJyRYK)`=G&{Hy-VI={A*EG)oLz#_j()&)<<2v zKG|36WGtfE{4~C_LE$QUOT9E&7e^;|3ElLT(PQ^zwC%XoQE;;ow$Xm)|LpJg zF9A4&0&NX;Pz;5!9E`a-d17r+Qw51hk}jo2j(KjpxM$Xx#|rC;7Z|j?6IT7*lM`Y7 zpeIXvHHd)9YCke)S|=1%K>rho*1wfpl-d2Kn}KKtjSaDkLn_20+Vkk}zny%zo~o1a z7>ALmT_p-R8fiW}+`eJxA+&|9Js^d`|m?sX0vJq!$moKFCZ*lFnUTwuN>!5RN z8^OkhTQRh5Z!OOJEZAAC%iuABC%+5=$d9be*GYc0?Fh(P)s`ilo3c>)b+oDnOX|(d zL-Awuro;@dtJtaXuwo|vGuYbJxe|@-JZ2Jo9v@mL|aQnzk__!3Bbybada-Oc2- zQ~9dX{XhhyV{f-FJh$3+0cX~+H?ETkT0i6pa@K8=ma375!(Z)phMy~o+0`emEEzOx zvhf3ow8ZpA)yzC>0?Nt@bQo^A$I{R0NQ98NAM?AnskAW_I#@t|LMZGyz%&27cSSa2 zVD_n(;grRfD*mpY^6i(62qK|p(W=2_^@fU!>tp}P$+_TWR>z>RbMypi6mbscZ35o zx1tkFymGh}ld~p@PwquQ7fDdOMYJd;B;%u6B^?1ye`c;sOVs?3o+4kwDUUG4ceg~) zjSejnBw5oCpKj(g`dCQ6aOLcfT+4K@@s%q-+}iDgIrM~o8>pZZ)pi+{k&uKp$#O64 z1pL8ggDE+2jqlSRuapejVJBZN?4e({Xho2gnL^iV47~Qpgk`N^A{$#J>$4gi&A~B% zoD)`-hOqFlWK6V4?@MSUt44;u?2VNZ32aSM@~9lq99+;VBzpKhFQZ=lKL>YqKXB{h z#o)V(@wBy$S&dd3I`Y10+TwjLH_Hud^;&TnuHrhU(Gtg-#JB(NZg3G%ilO~G{ z6}Fw=>+bmD`8e$HDw;DI)Gh31LBG5C%9$Y+5Q~Sy)BEyMUUf(pi#+yy3>#zYOo`>} zjm0Ktr`aA^FbK14%7aR2nxpYlBWsn6M47J(9NV*iv4~j!!@YPBI|2bLm|#%ZB1|Kb ze|$H7muY&k;e97|6VUH6-)*bXOm74u(?mSLa@HZbj-C?I3Zu&n;_&R5H!L^k{&Zee z3lYfw4UW78WhXB1N>buykVG9q6f=;xK-I7S6Hi~zaqkf6CI}ucq$YlDpSBZhaH*`i zbG+S!7k2I*TvCE5zSKp|@}6A)FXp#k&`X6P4`vl{g>2vuFHsN=$Dgk_j!V&{KgO3r zWrLI1RYEimQ1Dz)-65RWc!=hfK!4OOmD8G0th7WsFW%4k^`&a-~ ziOcKm3+XDywFbaqRJEv2Z<>j0C1Gw!rOyhIBYM|^IhYi+KvmXG4hvgSIpg3x3D#hA z1^=-X+@`?d->jda;%g0u=NJk~mf4kz8Fs^181MJ_oth>JZmafk2TjcUBmnwv3To7{ z8*#Mxbi|$l6&nFM1uQ`jQ4{;mN8PdaIZvG-@E4zh+J&Um)Kd7o6Q=Yq_7@M4*-e z0J(nw&L&Uzfb3HN;n!e^HB(Uz1X#Z|Uab=zj4naP)ui=zue|+{4{}GE#Z;jFD6? zyq7os0-iIAs^xshB6(Y!$p9TPTiH0kQD4Yebw!v2i{M z+gXNZTkMGA&`G0nK*Pn_;_S!F6F^LaXmQM{SsLlif5rs6M^5iIGH!}23>4MDhGf2t z*aoqS86=ic4VHpaE;%er1fJ>iG8ja#h;DBw1H#rmPCt%fbCtL1kC0+TC@xQ=rcanx z9>ScfiEmv>TYr25fDOtC!Sk`pUL2hqsv?^FjqTy;;qIVQ7K0+49nT%Z7p*1Hwy@By zk;1z*S}RShPj=o}`o)YVutKRx`&h|`{j3-* zQ|DhW`IG&C7ARAIcflII&X3@L@$gQ=cGlEG<6xw9Sfb*b zmgXQ4L#Y&^%Foq9BwX3(^#tIJf>`!spf^a zfpZlf)I=4aXo)jX$EY`LNIw#k?G69rf|g)+58qh4jG&*a?_hw%#zs77w?5 z6@sF*m%VF07vbvtSXrlsF#*J+2D_zz*H4&re7)J_PfNN6PnJdCD3l<^!D{|Lk3;!& z?WZw{XTFWM4;KhZ6SyN1RfXxQgVl`Z@|1cU>T6D1ZX*5mBkV8_bj%U zDl?YSHYI0-mx_6ofK>u=%+Th>7<9qm{2+x7knG9HlsoAKZ}+3w|$M`TWlVyHBZ-q_peGvy*)vCf-&&Ya+b}%bU&r;$E zcSUe$TvxK>Ij0cH%Hs`n6YDd-EGc2ym!&N+8O4&NawXuLG-QJtMVk= zAK+~;s?=Bd1S_S(Y7%^LSDMZ@!%1U{F7>_gFVEZy+`)bf~7zwa&MX%MN2TyjCKy#LWX?c>qpAsVu6%2=mk; z3H*%;gNd~aHo(ccJS#DnY(>9oQ^AoUS0=(Ggr*e1?wARaIywo$RG7=vU@3YD%`0 zYA}hGTonn=R?eDyvxcLT)M8JzjpAjPBELu|{2TdJ2p?Aczxy`=r+e@;cpirP}itW{G=^3v$x~7 zq}3riSh<>W%Vxb(UCHC!(Zr2U=B(X8HNO zcIThBBU{Shdwq-hzxaWYX(Fz}Yf&AgIc92g^#_-;>8rizz2-lt`J%X;e#@}g3%I1`pdb@gAPQFlJf&}N%N!5T$^}qiLMp`0+-4ZVj znr+7||Bo-1cWUNd+)W;4q}k#&LS)wdHDy{xN_KQpMt~xWMY)&g;2#l@NhciqLon_R zQ=%T6lsKy`CjP>VtUI2cW3DLc@!d~vJIsJp0ut$?ws;}>jy-U0gpmr-!VqSr!#Fu))|IfKt9^S}euCoria$tRxIj;D2j^(N`NSXRAN zcP1Rv+n3Qu#=Nx0dohvv-uYTB3EqW}3(4Jc!2stJ2NJ|tp4eAaOl;_MC!#1kN=DRc%?+dRj+P4k<&p`vIdF9T-eV=cZu8h)|vX&w!&JDi7|$GKG%(y%@krLd3k$K2aNk>J5rkw)N6{I{rp8* z4$|U9nmpudNH+hErLBudWd-C@j4|a1$5+tvkfDafj$ov;ag-mbKf(6n)=*IuXDNPE zH&iD(&)1ZaIDK(*^B#Arp7v)d!p5j3qq-Z$`)aS`H)6+!AhO_|G6+CX^bi3p69RizK+d6JZLu-|@t2n-jq*jqnH&{SVf0soiEZ=`vTSnBEa zhS~}H`Rr&bvm>>J)?G{IxR*O65JZmBrp=o3a_e(tPh<8UUW_HKZBw(`!R;h9^CdIBw7y1PIMmDn$Qu;^e7r}1X zuyTQXlHx=0J{-JH7#@ zPSm0Hn3S1N{v9r=m%{r7+I+n`ZO*#G!hP6~CX7H^Yx15gZ)9aUpA7J4!jeVsA777` z{!_dBcse=Gh}twQ?1eAg1_-vbsL${t{_J1;=!=P469LPr>(V!RIUFcl^g{ABKIXyR zULxS7B_~4P#>@SK-Gdize9`x3gHQXrWDk!Xrav17ww z%BFAn`z(q%w;sezy~ELPd$)9h?ZRY>wGh+4E-7P92!nh-e8ndnFD1S6aOGyDgOMoA z_-!8;(V`;dL!jVFY^FxtlG*Dk9^Y_=mWJ?rP96;I|Dne~>5mvN!VvAOQkLiDPiD|x zt-*3bUqE?+eJ?0HNN;E5_TWI-%p7$I4c>=um>A-_l8oJXNVD=@ZIfl}j`ivBYmt?% zF?a7}Qzjhh=Yni)hxaH%1f39%kwupF=PGZ*{1aK2r#VRJJXxe|Q7Fh=hW@XE*KdfR zt(L}Z1feUAhTEmsb8GN8%8S60ei)dY!JE7c4cR1r)(9>lF6`E4UnEA`hO>&0P97JkrGGNUkp_5l5O zo@f(R@74C+Nb!-B;3}6Za+Sc8Jtw%(ABfII?L|%LD&Tc~qgK`Y4Lo;sr4qdOK|kZD z-40mbq|bV9_B6?Gl;^j-&43Q~%$yY};O*2je<2t&*brhtXgMuPv_Erm)UNl%4qyyTpED#6Q{yUX$s!g?=3abx1t#%)n6Yf z?K2v5^I8|)Ak?);P^|3l5IRWkDd%_@)G;@|aMg$ZJy!;{-_i!3=)ZkZSb*CKkjdlO z*h=i$bB?x8Q`lu`$Y~x7>7hMRoq931EV&d`{`w1?Bcd?Hk);aVRgWvi?NRu%Jg!rZ zhc_j!$weE-{@c0m#jg7cvAM{?4d@dJ{B5dLB|#w=%XjljHDU`>fn%%?+)#rgB4WW_ zUuurEeJ!J>+Q-xbF2Dh+t}PC-=@S#}D>cXE))z7eGINLjiL8{cCeOvxH<&$@rD)gUnuX0Wp&j zBW`l&xHxAvmY9+lUY}6l? zneA((^rwN9=-&KlZcnzF#e#d^03eD9@oTERY^|vK^S%cTe${})KuN|1bl%fXaS+l> zZ1s1}`QMF6A`~Z~!GBw`TlI2mnPK@xi-WJe5#}wSL&X$JcaLO6{`tC`cIZciKT28L z9{w&ZtP+Vigu4ore0Rll>1Itv6ac{e6tJ!{>qHDN`t-sl5_4B?^D7* z!d`wC==r&xlV*y-o;3zFsEsoF@?*IGw%ci~C|Zg%nEs@JA5#`PMJMI7$A=R*i|il1 zmi5`At$%5;FN6+&j|H<|_;`J>=T_fK<-8;dtewV!ZJ()a2iG4xmXk&6wj;;Yp{Co% zhZ3m{R4{(#$rdkF7I^_8-x%RQ|2 z;l{?RrnP#hkN_r;d^OP23g>@(fzWU@@Gp3>piL)S?p{iuNNmC*^>_M-jWH&&N^8mT z-xeJEb@1Kjvm#ryqePK?b?3`DAMB}Xc=d3ZydWw4J%`rwe%a#4rz9+U!f5_k1F zpWHQpo4LtdGB@(a)>o&i*Q?^fmo2A;{orl0kxp*!)L;ED*0Dr!M#?PolLXTPvW=C& z-~+i)s9<7s*;PmLlrr^M8p=`yttTj7LXxc@+C#N5R4C=!4d0rO$3Dg=jHjCE`?J9b zkgcZo#FVKw&e*fwqpJ_|a}3go@JWl0D0_(8-Z|Sovvo#?!=4x7RmvzipE7Zba&wQx zDY(;pT7#aDv0x)B@;eJ}#kY!_;@zDFKA05-Q4-LK)axb@uL0elR$r@{$vI%lmE9se zv1B`!f>n8%_c6BTq3Bw2QALXUFD9n@U3Xz=1jOLUlbO+?yl~&))zwOOVUGyJy!Q~! z)bp|4+thHs=#@yQhJ#aH+E@4UQ_DkI#RBIbSC=JeN2sLAV5oUwk3|)8o$m<28PtO0 z{Yuvs(`@@~K%(${} zy`8>-LRCDXJ1LJ>qZWu!_p|mY<>iIlQP(&DO8<28;z6R6?3mMQ>8~KmvkX4r*EqB7KuO4IrK(FA{ZvSKf2I3Q-4~I)e5#IA&%d~%=2AU{ zS-~r+;24r1^l1FJKY6DD6$P|X-OlHO811XZ==)DyW!wkc85LsJ>hT zt!?!|vV>Zs^Vv!e|L`g3%(BZdRN6UpQxLH`0s+TN(m-27 zdp(t3&YYGWt9Na*$MAYw1P#FNr}hwKz1u@%G88_0yYVP8*e%t95<@r}eD_A~z&%dT z-xnX+bs;I%(>>+=bqcs_5!~G`q-cvM*b-5xaqOT?NtcKTr|ur-Z(a&qU0kNb$nde$ z$GAd(Ls~K(=uPosv!~qPKwq_*N43JlREx7ypS1gEhwFEAuz6Czn)I!yMN*IL53+t5 z>&+Bkk=!SS?0)I*w49XH-K?f^AoK_QJS!v3O1`%P>zNDxaWFg@ZS4I`R07tWzVN5<=a@q)MjKMQ2zkrc~)ON?}&wAQD zkUi9r&K4V-9;7>kr3_W!<}zXOBN=$(aDCpSu%M7&QVLAX&>RPIuZ+NwXmH_4mx!ia z8xjUa%EUEu)BuVx>J*1^$MH&TmV078dA(C2<6}j}mSR+qn^=@`->E*BGtO+wW5-&Y5+pZ;b}i}fPM(!fkc zqf0{KGsV+%$2u0f*k0K=7^OC`7;wgpN)*a0u9j#9OJd2TVeL3JwYgT0n=X4^oQxoa~aW&0UqMqu;+}!wV2lava)HQGP_yDkw4=f&GDtblVW)>#{j!afyAvmh zodJDo`)|D3LMlLR?G41NQXgLGNt{_@H()TZkDS(X1xlN2sjMD4JjGr@P`~arzJKxo zn8lQ4b@kjLa1*a8Rq^=nmE_65gUBl=Q?e{d1g6nHWgaA5B+{%iM`BMu{fIk+I5K>U z_-4%xey{!1cm~iKCC|oj!@`^UHNlbJ?o) z&Hk_xnX%G|r}wsX(H^%p%BIv}44t$zvch+PJ?t z)Nw#i_qo8OriBH$DA}m2hD}Tk+m>{xY5dQmSZo~Z9xt!fLVOiCY)MKGWQ;gFv>@>9 z#1=b1sFhnbevDJxnpmnO4hnxt1z6e>?VY4y6_q*uaKkb=oXh+M!ylA(D0aJJdVDc1 zB%Y4`QWy1~;n%mcd{128{(V?z=Gh$hUyJ`)Zp&M(w&rb5W-?dqO}tokXf_XYo6as<}Q3!D{Vk_Ue36b4|tPQKTdTVsET$ z7xw)U#NMQx7|6fyBEcNuJ&V6t^ny`pS;XF4z!EaqC~$9JZ4%S;ajyk}kF>80whim{u(-U4al9?)*!#R||1Ria1db16!Xs5%yAhRmQ)uF#I8U zMM~t%O=_Env&zCD^q@p4*0@`vH0$2i>>oQuCkWf+tQ5y3pelpJ69rHQFAqk?;!rfi ztPzg;nPUITb4A^{2M-`!73O3Jr~N|+=?;fYfyG@J?Wv6EbUj$H2*XO-V>5kbRRALk zV>xF210Tf2ZTsg98C*3PRE)Ha#i!(TA;eo`0L{{)CDSxIFjIot$nu~H(oIbT?i6mZ z@rqcgQx39bV8>DfKjTUqywjs<8F3Gr<=Nm5k&q)4`gh25cK~4p+%kyNS&6h8UkB;g zy19wg$WdgDAWk9cw2HWGeStl{&>Rim{p&tltXDVf`v>Ix7`pSG9M$ndxxXyrSB!bi zT$L}u!uk!DeNO)D(N$ksb2;u5tVA@7y}&8GuxYl5Wh!@!Twjv+KLV+1YqGWn7srj0 zy7dR;&(}Gxcn#3F^bNz_pNRQda(ZZhgt{nOY87J6Qhtg&{O}Gro&CApNYJio8DeLE`jr z0|wpbb-(^`eZZKOU-h@Bu+?k^Ngyj z4tyyD^CM_0p}hG$&%9F}-6D0$RC;lM=;ud-iTk4~IOX5oGFQ-)SZ^-1d*SEy+BMP| z0p9k|lXu8TxRwM5|BaaL=eO|S$nDC9@vwmg`dTggVG^aS2wmI|edJ)koLRzl1> z!9`m!@}uuImdE#ct+ZiaaJW=Xs)$4qcD#<-)GOP1&d%bobEoVIgl8|5d#>^S7EZtJ zT8zYn`jhbP1eW_8OY>?A=68@1_)yK*i^qK-Ijg)PDitAH`aG1lNf6% z{6a$)MXHg(et*uYft-Ds8Ph$_T1{WfANBUp4hZKX5$f7YbOw?c=PL3{SoSDw|FU_4 zJ&+Hr_*o{f;6a1$T*21k0hPbw-BI7{mUZH|Jus*O7^={Q|;Tn97p(fOC zZ~k<{ym-9Q(d2XSl9#p+-A00xE>x`5UrD_fvE<64djp|_K@_*+R`e1JwwN*1tE611 ziT{NHAh_|}A)eGKnXnR&aBPn)xtcJ}hYOx!dqaK=vpaaqdi1RdOUK^lr!|u?c!6us zuTUSsUL1YgC#0zVYSlWf9pzD2NKQ9fXbX)#wlqDW=5Pv8r&XMx>`iWCP2}_vRoVwn zIBQ>=yvU1w6SuvjRI1I}NLkusa^3a|J2(i7=iO_dLcoZhNh4}Pw>uSiCDbmy_y2H} z*A8Fe80G)g+@TvwAfZC4x?!=H8sakQ?5%I+ z(193KJE(xHP-YE9m+Y@DRP4>sF$OOf5QHF&zi@Dv*>-NG^qNlG0}cVoj9)!e+rIn! zaC~Xg6+-wk%rR(49J9&wVIiM)0s%qy-_#foSqITXC;ep!0y~C*^X;z{Df%}zr>K&p zT-EW)o~UQTH`QiBO zF}jygsoswy+9g&0o~KQ4^;T2|(JSla!?SR&ss+|IUfaq!1sNmF%EtLGt*Yx6U`Ri# zfU^StUX#yyK9#0;CgWAfkQ{6h9yfpRZZf%A`*$@FS$n*_LL5|Mb$&*$cV^X6{?f_& zIS_-hS=NDoRu%egrj%>lcxPdPl>lqhVND}^dj6ss8k~>%0#}^lKLYF&P>$mpB6{^YssnK|8-LgoeM;=T9 z7ZgSRbh4{Y@iRHEq|WO#dd98w@nsQN3PB|+ng3%eeeILI+M+rR_EvViI^|FM1m}7; zRXerBKA5j0rg9L|@l}zP1+m4RwzNmLhC1(^&v} zldDw6jPX<0P-SS1rQpWEEe7ULxO&D=8jasR4t7%Nt;P-y6|yUB2p|$H>Fw-tH3rES zrtBZ<+b{OFw_b4;Uk!J+UX6CP0c&q|U!`8&9~*zf!r9)@QRHB6+rKP*mgk~Gse2y3 z@p{^F-*xN(6%Th;H`S!RLK|2p(k2GF9T|_vUO3`MU#D4ONg}mf z2>$H$!Fh@dYE&Vfk@QIKELNRvNuu3>-@Ax?l>{t=XRP(T&FywdJu^)f{$Oc5O`=u` zTycsZtC5b&u4Qn>;)M~EYJ(@7`G2!3sz^$t-wSVE{n>4!?j#B=#&4!GirIXejxTRMLwCx~6aiy))c#L<<3~d8WG#@` zGv^gsYckI(SM{HUgMnG^$ECbgl{>OpVFfN)}l>2Q&ePj8PFX7TCU+^*OKzqisA(Hcul6{g~XS zoxADH)k-`}wD zpEW;a*&(?wkB7IYLcK(E5L&p7CW`;%W~xOn0RDwZ6d(f#&%vnv;Mjd_8aaAzVZvay zbK>IY?!&UH6%|7*FhWmn9zAmrhbTyY_``y^v4M`Zk3&FE(U$y*1;2N;EB}At$h!^K z;yJf>>2Ne*3a4RBzZ~1dv54rMsteG73lW&CjF~u6qNw9ZJC+OQ7?_qCBk-UQJ_F{X zPSG4Dwgn@LRcx@r=hu?ZuhQ0&BVSchZg0&t^bAdD-g?0D+G-M9h>c~$L8QD^)+deK z;uarwW9h6Ntw^m+5vjIHPhqKNf=wJxa56cBsg+heq8Z5FFUOO2-nqy@=E26zpk(KZ zfn!U&e!ZJb*P#Q3v^E$WNDflxyZ396W(1d8*1%sC(H8%-M1Lo?kG89+Z;RoXt(i_! zw15Ix%53W}0GuqbGH0Nxva*)aIqL%M1#lfyh}>z3Oo`PNs*&ot6yQP=p~Htc-vYQT z+$>D{IKCDe5=FcCEDUWW3s%rjJ@d};FJ`sq%L_fZbxM0NL4>NDw?dalez!f|?Uw9> z%OU_eb)wB3?>Rcg8#Dwg>79a;4uZ6(x=Q6Y2|QJ=$$|joq6vveb_0;4S?E4(ev|kM zi|dO!{~B*P_x3GYGXG16uPh1Lq)eZt2H{Q&mX&*<_0GPB=<~Chts(Zkh@6Or1pwe0K`WB*YmMY zy0>i`PBfQ!ukR_fj&sOg-oQ95fPR&yEUK7{tom-(pF4T+_PaeRbtNf;)5l^lF3`VX zQ+_4rl`oNX6F_R^G?eJRwv>P;b83j$*M`U_D6g5bn~?L@--w_(?njgIuGy6RDM}(% zabjWszwX4R`Ej!t-$&HvY<{oi$*nNi!Nt2w-EZOEpy}K*`Tx>6VEL}{)z4~P7i~N( zcVuJyP_~9;fVM1^rOwc;?$H<}(kc8Sr41^v;hTg7nc5I6(!w6-5H2v6$)mftSau7~T6J`@{|J&ae zz5H*!Pl?Na_j{7a1;h8Z?OnuP5CEmb+ZJ_%`eB%(c(5@qXb(d#LIDa#yl$z7X3pEi z$q4cpYh-4{>J9XVLMB0ay{X~q_VX0qh&%U5K#tt0$rwwwwyE)`6gnc6X49)rF>w|? zVjTjr-#xY<_Y9L+AlkANEFDLeKYCpjt9y^MXJ$s1{<;lu?S+?;Uhy9io6J6GKY>vO zLVQbz-+S#Yvd{A>zn^x2eH;|`ehm-18(aML7Dhmj~8#Xc>j z8)~J4+eXhE|H)R(-sgB124pew?MtHjq@+UE|5X+(PTWany7YUm987VZK{6m?&DySu zHARMG&N&QuSCA*!ULFl6FAlp|*b-%cd`Bxfj^GSiHxT}yiw%^*_e{w!0EisdskMr$nqprGXrA%0_>^9%StX9S@$N-hOmC^W8o`J) zkNo7Q(i-_ck2zw@?r%sXA+tnm} z5xe1=WI_3(%%z@F@!iSJ-=E6*U&704hk>za_e^L?_f(wAky$ojbAl2xX`Tuk2sbT)@?*{` z>$7?z$prm21aefky(_cZx1N{~w)0wICJuagL3VUj$8pJ9w~hacT#G?MVpF_)poS&^ zOJGdylqRNY8$Yg>`Lg)M;3_&inRZK1nW#|opijS4g^U#x+9KyFwJU2Bf0|sXegZ~H2#R6TN>&LvZfR@=^5g2k+{twylYcEt|5<(_ zNW#8nqH5a6kvr>|R%>xB)tMTeAmV}W4~`BGlIxrE!GK_~4>x5+SGFi=8$(;cIO|`a z%Kf?zdHKbG$b@04OzkWR@ zpvXdE>zh!U%_6p;x=XD+b;YT@7jY^crveJj)y>tX`N}~5x+Cek;a}W-xKUSwlQ5c} zJ8ZPbtQ9fM)1v>MZyQPtpoZ_U!U#W?JrldLp)SG@j;E=lzM(^ubhWqJKr>}%B}r{z zrQJ(a7e#)`V|K3|C|zRWgnRI6ayhR%GtMM(ywyM4UU_kJaFRqjhCd@_6tCcxMuOT*0*P}iBf>}PtHDo4qGLt=FNtXic-jga?`hemM zz3kA*B0hj0!RYS?K!YV5;a@StQ%UN1aZ^k6g{6By`~ubki!@@I^;oMxS%5U6Svpg7 zdw2A?ywGnl8O;30hz)+AoB-;x)keq$%p-XtE&>4x^A$-^*aX!QP|W}|hEZV)07F{x zx{_mGeJD$q5dCShNy(hr9??!MVX1Fd^Jzi++HxtHcC7+Te%adK4fWLdLJ=7xql_-}_2f-)GK*+GtI0JDf6VUgm_KI764UoUxuZ4s*DM+t@3f_`dH}={I2Bp7N7$7TVREh z?f2Uxom8@z=#ab^CTm;JpTOV{`IIo3Z3grjn!oB(GB_lK3n)8 zGY0l2|CF%a@j~(zGKs>;EnTvk$=-H0ap5a&$r(ng;!(jQbJ9FIxZW!jy#Hh)QNSP- z2fOC`(5H)v-^m$3pduCyR^twz)f8l72QwaDjc;?JmnDB1VGhsFN#Bl@$-DX?Z7ry+ zC2c>-jz>u#6*I4zpOHn1QdZNDD{o!LcQ&T;yb{$APmT^WYiO#WG&$HSAawQ!8>Q~#sE=OIhNbI}%XZRT z!fTslqe#1Gh9Y9gIENFzWSWoD5)DH0ZhZCVSbPtJ`pnjYuxVwKRXETLOx)^G2Pb01uqk`bnZ$&Rkig#J;3wCWf`=#hG)N!{o8YsuaLSaOyKKfu`R zLMIGX{y00`m3^+QxB5}I?09tWoaa@>nDX7w?*qw@tHr1G^2rwGtB=%~DMfH=f%MUR zp2K}D`LPT1&GzJN5QH)YJ4$X6UV}_b#8Nt-qh-0C`Lxl1!20H$q*xYg^GbXLEbf|W*0Yvpm#;pzgUbT2In9*O< zr=~}9=A_WydTrl{BEqs9gNc=Wb#tdMZYN_xa68@pW4J;$H5-Ob7P|^Rko3ygZ9>9$ zKu8X0vAD|)K*8Y@?h$nD$Nm)DGmfMAc(dB3WqfOD-IUJ@z!aytd<;2ZF70e|KZlaV z4ojCgMC|@k1qV}zy-S!#D2j(8BdInUsdKnqv z@ZIHr#+cuhk&rP2R*50RMH9AjP5p-3E>*Huyo=A7%rE4>#QEz=O0{1Bc9=;!UA1QV zX*|=e{cjICI%Axpd)4XF*GY`Nt3cdRw?&QO%-zgqU{>!bH!H`s6#jXqL}vbiW8^@1 zRcG{&i@d0DPsIP`u5ae=7v&EcwMHVhLsb}Y?1+WH zO(nR(Dyu3yPZ#mPsn0R}G#x*#l+=S2`I!v1>`rKfgSs>SJYJNwSlp?bbG@%hGLbsE zna^y8n#>oL`<55E*i9L&oQ*Gr@?X89+crQR%A00qY>ek;i2uF5ZYPV0=x`I?g3fwZjyH$SipYCkj|ARm8F|(=d`XVWRJO^9pt-^FEl1AIrW`u zf$swr)@pIo{XkJdQsGz|?1g9N1W!tQMW+_@z2(cFk*+_ohwg()vk%*nkg&{!EXi3; zMifu@oOkyUZ>ClP1gu$1J%ThP!*w`&n_%z4n-IWd`Rk8&S1W24NVNV!)RoNKsZG{S zkqFCoFkPJeA?;AGn>q~6saFl1ldCh=O(P-a7NsB>lOe@=>84X#g&pk;ckeWB=~xno+lro z61C?Eqhlu4dk3uRTOk4iLkFvH;5Y>`vW%9m_Cs`I5v$3&Qhi``Kap3M7`+P|Q+o2_ zp+>65yg;c^QZNZ8zHcac^e4O3!^-2Vh4^!^xS9xwr z?UU+GqN_sCE9(@}ZBMT#;JguSMIrEOVsTqQPlY(0UVqdX>YK8Zu% z7s23~P#`J=8QGuURNbj36Asu@;atfMAXT&&Y!aP%=A}}4$e?03!o}N%3VR)-Ng%i4 zSHav27oR%&RQ)p!SvxwkC2MARRuSFP< zyClzgdRjA>+YKh8+94HRcv4F`BSyLvDf@UE(o8J^>{BNtvwVy}-W40NfbEtEPYJjT zkJLgv-SYhX*gdMZ1EJrX>}{3He!=%9xh&`U^nGMfd3l(8v11}mlr5RQKtq~LYHfbEwhg0~f-!<)gz@NgSfZqXWY@5SD69uFh?!Nevhau+^a zMx>yx;2B5vzg473H1_GjF3qE}E0cCzqb6E5H6OZR6HCO7^p5S4%`H-~s5_he#IInR z?44xkf8x_QCyLUZY?tSY`so++@fzphjF#!Nyv>oFW3Bj^T!*(3PZmdWX;d<&AfA@? zvYXC@Bi9X3O01jg5*vEhH7Lfy&H9Hxxqd^clT#WQ*dAajl;yI+bdZqKFN#SgY{u?^Ij(Wm#rMh=u|?` z(qRfqL<7C5{`)aJON)te7CH|07c-fA==Q>9R%KX*Y{9yyi9qjVs&fGW!OnXnV;cV< z5PBE;T+>cPkVN`q`ogr&yK!SkvVdb9ea?aG7D&;_-v+ZF^wrhq-(B;CIx%tAqE+nc z-tXz(NEjx25!iIklIA9rMDrd7a0ksFMR-T!k5>|=>~^h2`5xf;8ffEqrF5Y8L9O7#hnZ#0e$*}a(q<^QNQnVJJ^nth2Y zTgR^sj&^dY))38O@|Wf_PGdhSB2gTw`Fn8<0F=0Cr>d%`NG(hxjt8plraLmdq(;if zBFh?1ZJ5kzc2E7GiXy-K;=#5#FNf@UZ=g&2t)JI071;8_qoc57mt=t}_KOlW9X#2= z$=hPTbYjrGfBZSsECj`g0yQJD8^K;+w_3)cNJ&w5H5Fct?^IXnB_bjQn$=x>k!&=5 zaQSGeoZin$udhWb%5Jfc71*8e;(Fj`abgxPW5dE9A@LVHNg_xG(i_bc-W7?Uxo8e; z%8{bPmih_T*Pf~{Lxg0VII-M>e1mCz4EmZrBLVMnF#6T$AE*F0%&%k+lwHydSAAS2 zS*v`|*0h|l#V^G>xu2;pyeo}naC|h};IF+H96Z;9_26(fI*4W?r23``O#T%0mB4kKT)V2s4fX%0>|A;qNxJm> zR}wJLQwmlz3}iq*84LDT*brixOo~tSZ&NGrSmhZTJTmUJShO!Z5t? z%FlaFL}XG@x4*&6*WDtMnUN9a`kou95!p$we2Ir z7t5DeG-^pn{WI1ZB)q|K3C8KSYS5f?_MC zhD)ODBUil+3$s21NS-$X4%`a2Bj(? zWm@#y_>ndR6@+NZDOx}aZrPt&HKUZ31$z&VDNY)titfnQJPn_OU}tIGQ?(#_n2CbX z9_JlRF#^fnCyrye0VUx!sOnpT382wB4U?%&K0<43QknJ*kcsED#f#GKtw`)gn5l`^_Bf*;VhqwjjXUE0oPOswwIU-xR@}`#@+~JJ*uW@`!6mMMqcD zB|=2Sx0m!%^tygt{$S_h<10>UeccA_RSgHV?!|Ym#5({J73D(0ra47#qbZz4lWY5qt_? z9?(bJM;HQh-~>kmD7bwOB=QU4{(B%|emb-Z6mO;k5;I~JsVcsGd{5%WM1IB?(Hg35 z+A4k}qQ%P>dyBlb={Aw}dvqo?wC6wvOj1)ip_1E6ESUHns?O6~Hu6HOL1Cow_%uW~ z<+bSDQNcg@N_UjtUCM_LS)sSqu{&%}H6g$Y;1>J5=MJ4Cl3&05Dr9T)=j?R>94zkys z`b>&^JRY<<_TPFa!JWOVIm%B-e@lH8cp=c;3_k!uR$e4&_hLprJj?~Q-H|YxoBH@< z^Xaxnddj#R4Fz6hXXxj?j~D!cnG|1kA4i37nNnoww*FAwtS~N|nh-UDgD%Oukj&Cc z?rQWNb`zEYr4w_U37J>U8;}_O5koy@v`X>u#b_SHT8PlIf$I3(ML7{RGW%Adrs5)e zQ7J*SFPT}m1Y!m9lZuu%2Gg^I_xs9JKb$C$%>ER_K$6DhM6TVp|i2j5r&wz@IxYdffbMQU*m>=W+?e4 zzgjGzfSS~e^E&*kciCBrH0~)$aYBH}m7e7N)VkQd3y{A@#di%fPrD#2XS^bDoyS*f z_6AsnkG+W$A|lMT2ulpFMxiWGS;fdS4Q|@4CB{F>a+XEexZfZv0~+; ztWF1XS2XN`tY%=8v2r`&6O-L+Yqa}f2k)Zc$WTYbenVUnUGn3Shh0FynkJd%OUE}x z6QK4K5L?~E#6@V1O6=@Ff)k+`FJH_?X%ya=SFOi;J!W58XXHiT26`n0IN2TH zr`n0I5#x4oD>pwZIBb5fN0}-&*vyO0@NF~Fl;j*L3Sk2i;r(D^R0FP}6Kx3&#$@bB zJ;{?6>O_d7qxfA8gw0)Mk-cnzLFSPLe8}m5XCy1I+F5h(Eio%7_e6Yqf0K@DelW-$7(7FkJ`T>PlAhby(lFC(IaBm%=_&Ob?$eBSK$#vG6$9t z9HTHNc!CkC660{6Y8f=r$_^jz)>x7idAP^INR1_JjKfXvlZY^jcb1O_a4lu$xZ>N> zvUD>ugHcn%a!n{WG&WU-o@SfH1=;>g{0XAxNq{m!W-fidmEWp3m%kx%GBGO59Bq60 z5bl}U-)d-$68^V=2l;R!6a`2yRm>D72y0u&RBaNY_WG4xLK#$VN)0rXoD3(WrPVzL zkb;m{q1o{cJeO_YHdx@&IUD4qv|YSR z(iPqkjZ*h|Z+k-;J21su3p!okp(OIO?meY)G}7uQqmoJ|Ef6XYE}}c7m(wm|JoN`t zL@tRvqv@dx%#o{Z01jw}1+7Di_w+l$h?voT(9JY>-E@&5j!4y>aurBa*rqYw4I&$i zI~Q}BX~yU_7!rCz)i-i@t+#|9BWsDh@N>< ztPf%_BJ1WVtRNsG)5r$8Bg|qbxn@nsh%8jyZ}w3|SV%TvIZ`Z)xjNyV2ZK@X$*4Ar z@kqI}Ys5IF?coNalLv$3V(qm$qb4YEIw+OZyqg@cf74z+d@Q+z$X#*J0?;c3$Y&XJhIO$YHmo)Q_F5|UlxZ(lOn~C z2!INg{DGRF9uu@gd#UIktQfs!NkisO6QLoMTiA_-C)i>@B5(|TLA5V{7r;~Z91tcf z9n*%D3})gbUO#-DggK4pY$C>Eh0k;% z(@B5N&W?(Ff~sg|a#g676_CliM=VMqsRh(B!)kj}qn ztvU@O|;Y%amDs;vPc z0aIBaEzsuCl+=Bx%;t1};edUKlVE=1%gk>@TF$e$|LC{Bynt$Wt))aE3S@3 zxwxRjUk?Byp%}Nk+VJuAY3N&Ca-S5H`5p3QuB<8|5DzsSR3mZP-N=1oQqE#S7=SoDx4=^%;K0cLdI1}xgXdxoo6lJH( zm3)H4di$i_(l7!~Wc%&n;>ck@$8*T2u$wfAmCH{OXQT_EW+K1Hq4}y)M-$#llQIBY=PnEd@#b~A0Np-4MdB>La&JK zSnd$>ClqX#bsRPqDzcG(2v3;?gx%n*8|4x5XzZCg%o^k#?S!aQp1T*buhFss@N#ts z`JSEafM_l0FNO_S8`&rIhhP$>#b{B%0cLT;Ek|XjyeDRs9$`IHf|;dY)xC$Alv=7n zo|@>YF0*@??W?rctXcG1y!uFrBv?SH+yqdcr{$KMioat+RkU*?4eUm`M|FkoWvyL5 zf*30?6FvkU#F+?AoL(QLk4vVMndCi3myMb?AR1yNfM5?)YG%_1@A_V|n#fZN@F-6r ztApGo()t{+X5aKO-E#e)WM`9GtdwN0j}~|W_XEt41oLJk@pxp%;gjQT*ArjOee$$W z((;VRkqaXk0=1K1j0qrEFVT#eaQtyP;lyr3UukzKNmzboXM=~0Ncf&TlD6Omt_&an zANAg}+lC7MCbnRHqQaP@tO@A?50Ezz1sM*XdN~p|I)IpTN57V|0}!xY^8f+N_4-1$ z*Xa{-K+=zZbOABsAzV^ZSB}cjVCz#{z$~i<7+{K?u&1; z=CspoYXam!XEY{Vc{*wp+|vzdW;3&){fUgE8htvMP$&RWpe!WXm7r|Zfm12NAzB_c zAIyxr0O>xTDbC>;!tP@$l&+HRs55BGGf=dAEGB|XV-hk0e(x@cUT#m-w44i>Bs>^R zbw?KzhprjX2`E9oujmVgeI;r~LBp7&k?OFY*)6|AdxRYBOR{64$MRfqX)g(D^P<=r zD6r>O8qrdg8Q-32aB!y9(SUFrvKF)y5QA{iSw6xRaS6ukHni$tr_I)A6P1SN@=Fl5 z69jhSN|bgBXj~B^@gdri!_J*>`AG(j8N<36pAQ4*uNiSntVl`w4NlXRE5YB}6u-GDf)>j{A z&B=igM+dm6_WG3mOV*1?7=uR=cz-k@qJNg5yG{~oVFqB?6D$RGRyK~BCW~gJB!#Fe>t_9u+9&FYyaN^30C8tW&?9fz?JkPwI6d|a(3SA;`$fUw=AdPK1bCZH|-hZe$C8RB$ zAvr-AakL|?9}WY#?_*^L;R(tlukv95JTfW-fO|RuiGgrYv*_Y;XP6&kaQDC)v;KL! zf*2eZ;3S-6qd~9WW9=Lii8VeMH7k?EKF13}EX8nvQ~_Rs0fIFt5LX&k0UUyGB%uOP zo2nxBah~yni~Iy+BuNl)xI_1(kf?d|Qmy3}DMHpZh}gZ^Zvl`Fyr!N2Z)HZ=AUBi{ z{hutyyK;C%ZbY77;G)yU3p(KgSQK}8Y-u&USxXbHj1I^4oJ8Xx?GIrAOGNK4)J(wt zn=jO>A(;?)@o~tj#OffnfB*nmOAKV3#p*?0AT`?JnqDtIn1QK*|!T-os)KBnMv4*IV$52u+8DYO-+OU@h=j+>knA zh0>6jM%WtbN>*4H02oqN^ol@7c$MN=C_iZyk($0GosWpxhIU>EMC)(EcHA?Bu7Wk_ zjRwxku*)xBut$(jkPp2%N>gtlZnU+g1!CZNLk6nNR>AhPtae>O1riM~7I)TrjQ8QQ zcc5MrxcLyJ8u7 zwczEDXrxxt?ZquP8ae754aStlElMp0!D}~FV%2eP$ZkZhAl{3tM%eG9^Qky5qK$;l zX^A}F<`(~v4#BcQwiiE1b9U_`qecc?(HoFSVzOgLu2mE*w4x=xX;w0c9Jm9g&^fO( zQ8JOrj*VSZ=tJO;SdyMWdx%}GLt^mK_27fPr0@gyx7DH6EFqcXYjK)QY8}5~8$^mn zLrH4kbB%8qY@XJuDlxi`ElX)t^axTBrB1s8WyB1NexE*%3@AV@ld2Y8WEcNl7W_WC zf&^DWE|59ICF2h&WucOA)w2!{0IPg$Zj)@9liStzrP9>^Loq_G z+*t!Tgxl!B&>!$%vMR9$wp@KMSqxO7NU~2MxtR@=Ol#PsA(=`qXG%;B5Omrx92H(f z_a%^oH3Z1iU!pam{f}vfEe@!qE@D?gkFgNQ<1rI&+mfJq zfqs?;#c!joukLk5`y;YUf0i@)ov)XxpVldqMbU~G3{JO87P2CnoLxOzijV@xme{`- z55uwp!GY53k*ZrDz~x5^)|zxC-6Go#)kDV67%L}3anFjIEF_}xdIj-i>7xjg|vN6hh!okkCjG4UK2hMz_v%& zwD&{^F`$&@45FumC}gJTHW5iGbl>6`*cYswu#~4+UvIdhZbj+vTde8}EZv60=q1#e zNCfSM1BD0%2MWH6*Oc)~A$8@7pGaT_NFaD1E^!kRH--&(yj_B4 za~HN*F$Rv|sM8gYF>Q94noUlh9zlyUMF7hCJ^e$HszMo)iwkRuL#g?oVPpsp5~;U5 za&AI!09$H-{)sM?vk#1ob9O|3&--W-bITwb=!XNOENytOVh~v*Z*GU`P=;2ab27IN zr5%2>58Kj%N$EP@K7AzKCj)R1tBz@jfw zvxYsr=sa=&jIB&JDOoxWZtpl+g8m{0^1pk*S(f_o5K!zw^H0YY>f^KgL z5GV#Hp`!ET?*!$lq(MM4!%T@MiXnIHb-2I$Az~CdXC2C=m`$jTdf zUEiqzmf3(r`ahbjqdYl&xyM~yRtTEc=?}=1`bOZw5%(Z%5MWxZ#hYO=VE1&sX_u4} z_`7b2>qFAwUOE;0U!jE&1%r>6jRyG&d{a;y$x+GHtpn69B11@>#`eVOeBrvtScGIq zqoCEQ8oj6M94igl23n%ADJ~i1<-#hXAL3t&KZw1O_HOP>)QAqSFNWXy6%4rL=wWiC(OhyVlQM}f9H2asQ{M902nuEDZRIiRuaIVucArau zJuvVvn?PP1SQZ3js)WARSiDFRy6U4YL2H}|w=8&42qF4bX|m(_x*`Dr`=ABXS}M$X zufZAtqCi>E0pM2Bjcyt*A*pCvHHlOMG5nccHBTOa)C=rNgx{zaYOI7>dX2 zF^Y!LXiPUct5dIBS^06KOe)|c2}#o25O^Wea)fZXmqAbqI-rDcJ%LZv<{B%zOeuo)R_YUx zpNtL?r}8*iyx-VSKqPO)qfE8YpAJIL*t zMJnQZ9StKDI00}huGacrKq#Uv#*`!w`;DRNP<6x4%$>fp1^DVqm$ zf{k2!CapS1LNeBsER~WY3fKqnX45as|p-8X;msu`lq*SpDl410OA+UcD z36}4L&Yyk7pwi2Q<`M2?vn)!HPw~QUr(|$1xzIuniJIEF0gJF@I(BHP1(cidkV}ki0XEwe)1hOgAg;<5W2<@|+Bt?L> zaWuJ?ki8(bS!NwE*m@E@fy_r}+RO2*T&5T`P&(^Wl{qpDoIyc2!?uWHE*XH~eVCAK zQj_FIM~Z;P!4Sq6x1g_-SNs8tfy{pKEP`_&R^{$@!kCu zb`aV+lKF7!gwVQa@O%MW1wa9rbY|r>LZ}jh(S*WxW+%QgI3~6COezb64qS^64g;`RuL+yrCTOJ|qx(g{W{RwW*+tF?2y9zz%UT&ICE$6D55lPs z?K8^|)EZ+-#!_tf@SLlVdKdKVxiin3^kt)%wNSTOE}^I;8#51f zrU*k4RboV1N@Y(P^|8QMj!LSxc_5Ed+w&|uhHnDFbjwQ(c#i}Z@QASaLUyT1 zLDpe~v@y+#774~mDG>3zr#{9Wt63HR2z1xhnu2!c8v%yU%E`%yKX^Iv0Y>W8h+%Y~ zu0*qI$?2fechW|X+lUJ?B**s*zx#;@#UUq+nm}@B<&XpjV$+x}ohzLSL9Qsw22RIt zFZ$3dxzWjg5b(r`^22@$!EjG?{mb-$S&#B6Xx9mJK5Wp z!i#DA0ne-C!FGn8XlR#;h{3+tVxi5G0o`3kgS@TU0)9@15mCNn!B@dcMRZ6X>;j0k z5t8&MkmAV$500e9jc;&4(Q_k)f#S3OqTE7!jX)?kR(OF1SkOD`A=(nobFu^>Rnq?| zUa^&v@#H&TzR_=!N;m^ z;8@8fyD#sob$xgX02a0KiFiLKL-LxF5(DlbMJ)xp6$2m`r!2rI8fiQQsYjWqC?l4w z%H49<5q3gj+{#X{rI3Jtbr0NZW&9|6!U5#duu5>4J%J;tngh?pU9w&f0iSR~Q6q^* z3k-^Tb{$`mDRGu3<}8Zt#xPJ#oMT2xbpT1Q7r}M8iB443Re(M_nY=z;!^4 zSr}GFT5re@#Rcor(JQIhqo$9fGbGWjE@5Wek*ZHm88>k_gLsHI)gY;()sG8>QGym{ zffWH#28fj=M+cwsFN9ur9bj371QAC;3{lkgYYJc4u`?e7*n(&sCLcMQ#Fx=DTgfbn zMR0c1E}?>u9XI8S;od--OA(dZF|ZJ1(wuY-byG|iIE3CaWU}GE$fiqI;w_-$Z4l!a z&sb?m!PR$yBXtuQ+Aju#;z$z<_s134lc*Dv30AF6_0-y>uX#MaAI7$YH?3G!7t<4u zYZoe})70qdW>#0bx-sW30tw+sAc`pJj{KDn1C0=DdKy3`CP+@VLn5$~cvmY!1b8I^ ztWh2QHn^n3R2lg+XoXKGk--9`{REUNmH%ST1QrjZ3cOb=Y2ttX5Zw?y2P%2{M&Fac z4vc>JO}Q9e#?IYp5@Q=cAsZ8)9Kd7t0Ju;3niW)WeI+eXHEdTspEM*62N+WirH+NH z7?+5Sz40kZ$_Nr}saX&4UM(`3Y)7d}F#+;+nYR`%H~Qy4<0QmR1p_-N)Q|^5=mxMwAYz z5enDS1B9di@3t_jfpEO5h+{!1D?O6N!y3tbz@9?}Y;G=82ar-}7~95Ub27#h`Q0it zwr$kIsMsNGurr!8JDj08 z?fZnHiS2CZT4GM18au@)vc?2y|FC^9{*UL(Xub|<=w?gsoUO2V1-1|oH*b&G*gTG+>5bH8ze=AOG z1M@=fOJ46zV==LiJS!_@8IV4&@*r>%`~y*K;Bcr16+(L@h%ixA^`&x1p&axIH1p`F zn;55_*j7-I8sg^ zvCQ8UY+qa3}bqp0r4JwyF-&nay`XY9mPM(ShG6Bd(xx^}F(MDzZ zm4iLS^e&nwYgXnggKe^aJ}CtAxTNinvx5R6V@ z5baK@_=JV2N{o=^5bRC#l_G9Li=?Hf29n`W$>%M}pKglBsif996sUnZh&#G4y76x= zMzWU3_9Vq(z+nMGr>xQ_m{f7N%WDv--&HsW%ZV^UP8R~8OqC~kA$+==>HvBiQ2*aK zO`p;G6E({bF8>ywq+(-VJEpu!H&l4>cNu=Pk1Gi$fIYS=16IAIq{Z>&aXH(i;&OGV z&ddkOO8z33M&WPzGVuyB+Ul){;;M0&$Zw;MrW*#9$2c96M(siq)E=j)NgXYUX08AX z$q6JvU@EO}Q#G`Y1m=B%@NX^jV^tewN5@Bi`9f$dtP>TKJ7|)uS#Cf#SEv`KYfXOP z2pZ?vu?WrXVKn|;_Jk!otDRvbd$6Fm2mPGh0jAHFROd~~M`jHt3PI{4`OZKklpI(y zdw9bwfPkpnN4+4SSLLS&g1g6xAn@e)i(=}jk2dzvUnLoW>2V~-D1Ggl91Bh1@dzQN z6(|G_syqqUC|2QWA2FVxsmO8|C<=QS4@3c5^NRG&7-4(aw6&*-U8aX11H4}@hVmA( z1djr9ir9aF8>pgca(sYr&}y;D)SXQ0xVM%5MX1Xl0}_jFlF?RO98X#ETCF)m7&=%L z>_l%TUP;J@{pnNV{3io!D1(H{V=+|y$wF-KZ@~LkauKisZM?eP9P|$hs&^tfcpPfUxs1aZr-f^pgjJ}pp_>T_46Y13r@ zL7A$oQgsn+Ji#T5ZUG&hH@Uf(B-9CDI}Hv2gd<9 z(D>LFpW(A(?khBV)@6>HUx}ox#4@b;k2-GUnRdm3dYR#uzK9*~Ok!%+}NF}$q z0*@93IBt&)wgnwu@jSd3;for<6&Qx#I~LHe`9xgA=VH`hsmbCH3{@8>;Re)CDyaBb zxb#n2U1n6ZUSSwqF=Hqe+r^KGm=R}@yySP5{JWE-&}dh$7Y9Jtvgs&>pdkU?7sO%EjT$bUU0cuVcplIMSO<0c5nPb4@KNfj z%U0o2UqdAG6~29Jid>ZP=JYtLL(kF(BGDZ!Kdm?~SHpa!^v@md$dR?H)aw(=yOr>Ar2jf4Y!z;ED@&Zm2!xNk{KJZa_ z`+Y9;P=%L*w4#d*J+kKOk_HMe?pLD2cm77|Oo=Ce$dKfWah^(NIE`V^0bJf~z#6f| z?U#&Iw}d>>ch)o`O})7jUE;gp*q0YJcPM;H^cH#ytzYivKHS}IN5up612hQ3!mmUM zz66{@B^4oFJmRz~AThjeuXPy7B`Kncpw#wONRjxLxh|;NCqx0PMaP-dcW|w*l0#Yt z0If{AOZKvM2J|;TF#Vvt!6zeK>z$`k0pDJfB6gZ^b0E-F75m|a*yx}&T1MpOxf!QQ zSC(>QOhcs*BC3*JQ;}sN(L2S?8G4FZHB7;1E9kx8kZKhW8O1=DR*1=;yuqoW;+Uke zVS)|Gf~Xq9Sbuq~bXMKt5+FIOv573z*5l3nMkH$nH}uKps*&QBgaEK%uyKq5(GTdX z3zCs!_*~TBRZLhQxE@OfNBC{Y0P}lY1A1rJrVAfK?AV&R*;AQ3)G2fze8$l>I1b%AQ66z>j$7~NXYWY|ughZJKQ$D3PA#jn&DUojq3Q5Tg2edm2r zRpQn~*n@~mKr+Iuq3t6~SF_bK=!qgN+Y`MX*XySLmg~tW`G>FHMQb4Zj^+z>jXFl> zUd46s($%^GqtUe?9S=AOyE)eTGA8%MUtytEIe2;%4AlD4(j!2&;L&Z`BAuC2p=rx4 zIestR{^doXD6}YMbpFGyLW3AcV|#5*O2>;X5C8ujk=5S*gGWliEAG(|mg>u!_7`uZ zL%M~<1J$Ih6Z52f7KI8`D3%P2p>EtO__;Qi5kPM!?{sFCH|cd!^&qsLneGK_ODUB@ zPr!|qR^)OCmAnrnGqz)?Zb>qi1xw+(TRFkA!(<8xm4UHY1yHGKESUr?$6Cw-_NzR| z8%h$n4f#)uFgan25m9o^k#M6>hlHdO1LJo6^VSpRP7+$-Xl`Zwjww?RW{Y#dv{m8o z(3!m#lhFlQP|9JLsw9^f&y)@qd;qk{CM1Dbl2bHduwZe9j=j~WH^iWe;8Tw}f^M3? zG9%%c+p$@SS2StvO~+((yGU(GJD6L70yP7e>ol!}>3zy9VliPJ2zCoa>m<4TEtre> zh&``a=9XyK+t4D##;#i@8E@@IEC!cN{WUB>R3+}VzI}>gvmytuTCet}DZjAQAcV+C-4OM!h`Q81B#BoZKXMTIGz-z;s zF4~85u>ku_g(~soF?>;Qz14$IDpD`lmEgTFnPfj}^@dtM2{6PRB49K| z-E#W0#bnuE7LY)UjM>JrZ0R}GEz%gEG8n5@=e-~V&1j)r!jQHm{k%{2VehLY8X>B7 zNu0vWgu1+pRuLHHd$=T4M^a!?knqq}t-rD!C^coSY_PJm8+7vDr->AbetU;Mpk1C5 zBzg6S$kssa@aSAsz-f0hEdfQtEQLY;tYCD<5p^6>r3A!o`?kYk7&YRelyaP3K$y~h zdpeFopZwmA5e=38l(AJT+lcb(nh#Pa};ynl!nNvVMBJXkFm#E zw0UmGyjP(y!>*fS-INBTboywio1Whi63RQ_uMZ%183R78QH6cY%-HOBqOGS@D=0Kw z^;r$03;Yv=(dRrgFyyJwMsqqokFAaT0q_>%h~$6_!5KsPH~F)O#52l%`iCsKuS;1b z!J#M&$ybJ~?+IGIV*$d#7(=uaSw`+a^^od#mkbPd< zU~GMd<-E)1t1w#fS1my&zKe25*x2?TBZ6Jv3J-t0?dZi{jb6pK1MQh1m?iQ8@_ z4s4(K;aty7U{B@;DkkpqKk*6O;P;i=$Tt|*<7wOXLz87lHPg^^YdL~zi(#g|h?lDe zry8SZQ;EX#aqWY#hssf6zpk@j@PU^_Su{z_~$#L{D*zcUBcE&2Kbs`YSh z@U+o5KP%J>Sk~^7c(mH&g9MKAK+$x0P&;TSn4J%I!~-cNpQ(xU4bq-&NYlXxXe4VO2@YNXZngGxui#hX z7W+`y4 zvTCSND{nvJ8By8d_tLAQf|T(-9u_UC-W&yCk`uF|C!MfZZcILTbKuL91xjy*Ze!9q z$_+F@e83~U4k7q9(0paI_h~;+Tlc}Lc)iGHrA;uRY^UDLZ z9JWBQ_H+di1_VT}8>8?1sBA<@;omAL4k4nXIo}fs-&tAsXdCB;v_#1y@e$t5`?PY` zUXrZZ)4k~80NdaF2a(>ZyW08ig@&FO_C^yzU3Jir#Md8KW-zuB6@LRXoDL2S2!7i4 znq4tIIS=WBVhEx_EqM1iH*Avx*iQyCjHVEU6PHGJ;1ZKOhy~DKB5RPU${0nC`{y+t zN4|iBlnZ)4EgKI%{c_3+*f2PZd~i<-sPnunS-Ff@$P86%B>cs`piV8R%r2=NRDkDiI*o*)fE)EUmI_k_$)7F@&&V!uL~zJJ?3Z zEwby?XqblKog&^qpV_U5~;8{@ty)-VB1-UD=Xb;i&yKk2y=9&EWkD&jfiK_<%x&Chmw5Ms$6nPjiVYCtOEx!nIwNj|4VCa=g z8JNr&w`utslI`V($*ffsarnS*LGsmt0g3B}AjHXymv9JQ?$aZ{M@HEPKrYHL&~Dn_ z%0@x>V2T1sKQ>lh8f{SC8~-(o$%MsGZ#p#{gbP9D;oyvVyr7SzY7Q|se&CA(|6Y)` zPcYZm-16D-gJ|v}IxqrTW{{zw@S6;YQyku0e~1|SkLe|v9lP|U2^{M55amb}Z1p5e zly29{O$dp_8qq{22tZ8|dFbKIz)L%=(Lg3$xZ%6dETZ$rv}goPJ%Cw4?PJNB}hj(i$XYbwF7*QtQsInd_N@&5q_4hK3mxhHJtE_eF(Hm zGJG~=RO0Q%zE!b2B45Wj=);K4N5Wd#(`KQ_u+;+kok#;(3>Qk&LFx*>C!`Aaa(`oA zYo6z%FWJhA0WKJ!MNbZAKEqk?``|o`9~Jf4R`t$Vv{b{Q@$%@9r4xw^AMpz2vmcmiJb#=q&Yrv+zZH00U(ROu3v#%7*o5zJ zotunz4V#Q))oiUpBeC@RRqhPt4M5 z$m6-SFDOjOCKyvr#mZ34oB7CEfYZVe!6B(V3N{DGtNf0VyGBFE+6*vRsUMWSig7jN zTks9S#GavyTsm=%=ua5_rvEGx0-=GUsd@b$7@xy<;dyYJQ5RTn10eQBoz|HI01R-S!t2t;v4%BL9KcuXk#DP0%SkFoz(lHWCB~{6=-xfpfNs1&B=k}3G z;g?3+fKYJQCFwLYFK}*FHd=4cBnIUxeS>9pT|CF zk0nE?eaCFnP;TooVMr4nQ;x2r;nJF%Z`R?S_Kc5M7@!%0R^2&Q7Zyo`bQJJ5nZm2a z{dX5dN=)EDIUCL|J7mxsZ4Idh3zG@tn1My2q4{u<(YCx}%7NX-)@m@zCAv?RQyi1A zv>8OUb@A&@m=Jn^ETD>xy5ezzNimm?q{HI#9Wd|4_5aO<*HlXg#gNY#+a zGz@RSG_6rB={U}+Af<;w=9;nAq$l2rMgw^#N{CGm3O(OJ+_(1`|4LN>S{zMjqJ_&!>Iw}%T;3; ztxSl5LM1RB0R@vJJ$`43IJ)BBh^Z+q9j!{|WN;khEcJ5mSQbG}yyQ1o`_F~uekL$2 zQWRklh@c>kfH@)r39W=j5v#h46%kOOWD$gtUygR1V|OulTAiXh{nQw>-PCx4pfBi1 z6V2QpVn_vos&fOoA!3;3eC5#MzP6czc*`fmM84Us%dda&ys%aCC5{ha*4r{_Z>4S6 z7#R8dL42q(A10Y3^Fpn(f0m2e@FPe9=Ef|L7_=q41N(7*BI|4BgRe_n*<>ar+Zw-< z&j$2n*Cy*C_7|`1>hbO&1m)KDQ$oBL11{CWF5o)gvuNDO7MTaD~2LMfp9IKo3`5Rj)3PXwo$-*%!>#hP{a5ooOcM7s3v_s$IijpdoVh#=zai zXK}atNpHwu!--OQy$9{7Ds;WtXAy{7Ci#I_nHa?Zhr9`qp-pX^s$6nxI1sLAyC{E; zb8HQKi|Oa&_M4Ug{s599|INin%+0j#6e8@L<>&wG@Hd|+Q;5U=GUzrwe`h}%d-{+7 zFXa!k`F#)=9S#JS44p_V8|0q+4Y7ki7Deb3YY!9X^PH9rvI8fu}RpqI8g#(xSIQAO6)~6Z0b3OtZj1*tkjYp^tB+&k}o#Ahc zFbXtbw7T+s!w!5#J4}um`k59@ z9O!MP%$SSCEOHM0!9bCG0vK^c&PJdAcs;(}!SHtj`y3&Ma3F6=NSe zy&=aF<3_Y7OiWw@{oa3s3UsVZMM2PR(K1CraKPq!cIhD$U><-j!qY_UI1Sy}R5S5T zVqAxthV}O#DD8G(F4# zf^8XG%LP(eAX3Q&7o8OS^BibzFdf<(QBtN<(eco8h=LLmMxg*DiAM84Zy0yZ{V@<{ zwi_=Ep_2b&04Uk@LMy4eN2qi+KZqD>U|B-jlxjwS(~@fl0SMj6n}^xWg*h@DGkCRm zWXg=kBv@U6jM)afwm-DP1on^+pry`^_<)=?HBK0#W*cL*SldSIs1vQ6gU5DX_vNXciMo2e9CISOM*E5FQsM*JO9&*zvv zCymTQ7B$NXH;2uc(iU@)@UiY@ZKiFM-~dX>+kY0@>Q}L?5ida~x9GkOkI>su+blOP z;y#Z5zCp@$hQkI?sjnnmMWLZ~g{SR_jMQ2o9ez{HizRapadkiggmKB(-}x;mkU9P) zAsEY6yqYs-BMO+`!L1MSF%f|=&XZMqGnWgHfuilf;dz5Bcjgkw%98{WTsAU&tPe2c zWw5u$oRVFj#&01KZ+|lbFl+az_*cBfJ|Xp6g*!8%7}#Kb6S(PglH}G0Ext=-?)|O7Vq5HQ^~#DyKMups z;4t{LD08>0Y_q7LgoR538n%U;j2!4!o*tuIqP+qH!RDe^Fe4_P<55!#la;h>yiRoa z4qgZBRDFB&Yq8Y&9nT2oSZP(HpHPQ2O^T_M4$c3z;tm9Zc+rAjRGz&G{k~)^)jdgP$qGv-TTl3`umYP|{6s?3CW)C~=SKFQ{pUyB;l(K!GjxEykLAVpC zSI?)8L-4Bqg=*CU_SNALyIp54wxdUZ?aF*2Jve|@nj77pCVtmwm9q|`aiaQAd5~vv zY;y!nqCyXO(pa=MUWy)(ZBx`As85AvH~nA(gJkr``2Ze_kPmH;AJ&AB!v&y?0u!dp zfahMjl&QeX5VYq)ShgU>GEws)a=o zAWrl&8xc^mf5F34C)qr;H=*Fe?1svWN6)B-H~lLd%_dBNn~;Od_8PsxXaAKV{<8mB zwbJuglYdT7#)1tsY*Bqb@_gzl6FZSiWIU1wA|;rdxGGdZg;)tuYD_8Q7dWurj%`M> zhW}=ph)PHr>jU;3n?Z?2_7|1^(X4Fw8Od?YmtV<<2n_v^yPvE8{soi)>r_CT-2sD* z>8HGq{q;t{TyqMd{f3vGvXRiS#4pik6qOjP7>G$l! zXaGiDbWalANN?OdRzD{>3>zLH2&!lY{y`mAbDUA2p11%`X#whoH1g+jsO^ytATqyq8Jmi12o6`4EboFC_iH5E)_{Q!{r&0OIthLdO5q^3r zsl%y0^XGF79kj%&jaKxq*#tP&PDt!TChdJANJ?KE-qG(o>wA*UYK+2W-;Bz+cohLB@zu=tuvgsu{ZT5Nu9&?OlwF8c_?TAFgqReV_3O`*%{ghdjldN zNstd0IK|2Nwyguj)7LzlKPhP75QbQ?jOrt!L>m&_XG{QeSxDbYdD5{133=Q2e&?I{ zBU{3qFip^C&BP78w!q~v3hHG2dEo8@VN$;utD&sc|%}f}RD`3k}0zUwiCFDm= zOWR~?^U92rb*&#@b^YT%pgIL)kipOoOsx%vixfkWi2%3CKW3 z6TWEk0jB!uNa_41{NvY3XOiLyXM7&hF{T&+Psj3O;b21so$#p8*2WD$j3smg-LTGO zcq5j((+M7T&5B2@X=E2=__rLH`IPF)MU`gBl87RKqqMsDD951|iy0NfpKx&PXD^sA-zY4lKbHko8cCpBA%rW80!@DW5xUtSz?vvc^9 zq7Rw}=&YaB3N*rfC^R!Om#z57N)L{grqyF%h%kH!$;ncx>|E9 z)64&-lV1;)4hEy5Js4!Y^SqC{XJ1g4 zB+JfbT}l36EyE+U=vpg=O3FLb*uITmd}85<+GWFUG!+eI*gK#J@`u$@8W>MKXW_Q+ z9p&)5tmwx>#6<#&iE`CJ0?hpcumI`A?4BDMs%sF+1-kmTTrG0xDiKqg{e7Se0D-Ry z4pooPT4@Za2*N$}4-lTQbQw26>kQYi8Q{fnd!Vo{@dVNh1ZzbX@V>e`U z*NBu@9zNZR0op*4HTq&JzBj0PrI~~eHb?rYxO3Q@+OYX8*dZI9PRy>+`2fu0V0`N2 zgIUQ zdD1}*)#1g<(!-?Z#*>E75QGSVUjP(T!7Yu>ZK}QJ-DGzmA0t$%H4~(R#U{||n%6lTbxy&JYO0!s{_>UUfqKdF+5u(EU4i>zwfi@{Qta9pXyEpfFzS>Y%&IpbmK)Wa5)fq=Th?_EDu`$$N}TSA({BXHY3rcw-_a_Buzj zQ+7Fsd4g8e(02My)$~FGu>XN$OwNF}k~i+5OVxmRZBf@0D7ceL%MX0S`kE-XP3h-(L^ z;T&(X{!xEhp4s}9zooSAtaRl@kd zlS4YT$x4c4(6R=fzLZ65L)xppulG7c(x@0rk+x|3RXZ!%Q<3Cc33eJp7~G25rXX1m z&xggpI_L&Lw9OhpS(yzCg79y(f$5uqBQ>VXGAk;Q562>nWTSL_&Mc$FxR&mPRKmZ_ zS|Dah;kAt=)PobK_NI#%#Yg3m^@C*FwgcYENMQWfO?DYqI)#7MxK(asO1p;-OIihMpiVmx%7APK0FFhE$8GGK1LhE zJSz&T>D597+QQI!9ze-d)*K_{%@oj}FzmU`Q6p&PB;ZNuWa#Ef`m z-G$@uZ3Hg{OskUQ;(pT4vF@PM$PtPK9I0U;T#;p@ zvTHAceFg4CN%3oVb3^Wd=#*?Ny!G-&xupLGLOe(}>vI9|@Zhn{#d^{nI)uaCk#Pr> zWeNI`U|z`!s7DaQKSF=4k`*bN!Wu8iTdFPuHwB08xV(XHs6=0va3zDWH(z0w?BO?4 zg;77Hcru6o4rJ@BTsEvM_BCk3v zC;q zhlQH}H8ICF_Zz<@wkEgFnslG5S+9Dmo-f1!bO|HU<_i@0Hsz6Ojkwq30ev$$%2fy` zZ^wx8EspAa`DYZZ_A%fN#>TQ-uNQ`6RRmk{7u^Viu&(G+564fH@WQA`m6%TG!l2LG zNFky?wKVDs7m*~1K&wDk!wHL#r^8DL_lTtRRBU3}!v_w7X@`*!96)y1X~JZ$Gpdys zX)+jLT^c07=btq|(ce$~<3_4%)_w+Kw&LF8?_kXeb)L}z5(gny6afg&1}RsfKst!q z6+hH-Cs89p3lp1I)_QY;BD_N%TB{nsfU%M{EZW%mZC1!P@dM6Qs=`S(cdqe9*Y?( zcCFoJcdoGk7?Q*azmV94Bgz5-(V%rO8BA8UN&nZ;dM;^LQ|wWT_=^;!`@*~UMkJ&x zR}oCwI&5A}+p~{EL;PF7ETaS+-5AsZ@rbH z#aPr(q?%&FkK3xWZttR!a3BU4u9vG78i)3^NUV@S26bsrd9OdJX@L6bdDEl;-l*3P z6@Kzo`=q4y4;jzl{W+-E!((;5V5$e7S%KF==TZY91u(G9M6nN%aGEFYByB~>>#b!I zxu=YX9=>0*=9_oF=@<8!4`~CAQ?$VA0K;APvIWg!8CQI4$=omrVPrMkyaeBC&q}>R&KOcxNA&;6fydx)-ML2clmuYbGwEa%!^+`F za1O?spJ>!C6{B-+=sU<`Kt-jjNbm}ERmNdfe6k^Cd`!a|B}`C#Mc07Def&qunl0j*wYr08o4I);7`JO0yb?ao5Qev8#v%QR z!y^(s^6EEw8w$+jW<1Q%?8JbG#eGH+vplB}1Z1r-G#VEd9AmuhalcW@N%6ykNp(DX zZ`B+Pz*-m*_rlVu@>FV>a1B~ z39chFN9<-byDnFb7Sy~ZoJA-V3{>|BMrg1?h(eu`v!{3vB*Ql8k$^ny1u;#Jf~FpN z^*0h4MGVRc{W9a$bv0=KKE@ps9}5;@L)y@P4MPKMdY`RVU+^GPpv@jlS3hWB#aP*U z$D%5WSqH-mEyXb0Tm?tR1QT*paukZl!h;%p>%dDDWdX%~#4cFIhCX`p-?ai=PSuDU z?Cloe60#sL)K_muGpHjoqt8i@4DgvY3D--^g#F;1)sqGBDyP@W{J|25J}Ta4Z7p>M zHAgAD;cG=^(HKhg0%77->Q@C+th`BH*vM6TM7<3e26fXzuK{83r2@lb3rgCl+nIt} zkJN1jgQjK@%J6l&i$S~C5zoIm;PW zeN<2?L28Ee=? zWS13(c#nF3(l<%Ops#6P>7C5IWaTeh{+%_hY3v82PRVay?vFG7G4d>r`Y2cQzFV45qH zUjQ3LSa%>1l2VE6U$nK@eO|VW=$Vx^0RdTv){ukfvVt4_PNE}9ntLTilwDKzLD>bs z;|Nlu%O1BbLY1S}jyQgc(&vBQBvW2Fme~A8FHwbND?`9`j&cxyr1>r4`bRB-rZ5@y z$L-wYO_U?GLqY9;Hy;syr_nc?=zv?SZrf5&j1dLx-ec0`H3LLZsP%vxsRtM+W8~FO z{>KIpn|Bkro_V0n^7cj565xFdywl#dl7xb~Q9wfywzBxSXrP#RNsfpp*?7UAD%p(O zUdfo<1+0X;x$?DIH)E^NOuuH__F5q5)p_htfMb`ZkZE2A(YFXeqI zQXuH2R@mX~ssG^t!_2T*%5QWw46?M^Bv?Z^K*c9o{ZQzFGki+ooVp1xj&aZ%lFH4U z@Fnp8iqn{JA{3n0*#;HGC*NSWducVrLEj?$b`-_-2r9i=*~&RbSi>s_vf#1=7}eHH z{k(bHKmdkajWGr^1_)KGIAne4RArk5Zyq3JSm41`%&=~fU~rR;f`7HRy};Ck;4LV% zOfm%74LPGHikVCd>rtk+fJgARR5*5u(JT~3rnuFZ^EG445i8BMEb5>b>dT|RM%|0? z;Q@Cfb>t&yS-}nafH5Q!WxYXO7icncIyIce_&{>Wr?`4vQtZyXKQp~w4q zn@ETPX(U@dSQMDiByTh6fA~;*LSDb_&)$>huruDV#hH~_-!wEDFazanm&&+`z9XcE zOQgISLN}F3Ejq#rh+9QCtXyohsr&d5Jm3@w+mQoraYZu1Ftl$=A|+yM(z%s@`vN0l zP{N-;D?e*bWY7wd$vgvQU1-Lp`EA@B#1%YNMz%ZqP~eFkU>}me_3eO5PsYI_e4LbdmyI9 z_D4>t9LrlACEKejh1k5qZJh*d3|&mguZe=VkxYzv zpY6W+jg#}D*=($23m5^SI9a)VNo|Rq-+xy#*m$M0&31qLoeL<=qhCCCf_S9fm*heQ z=K3olM2xEbS9U_!f+*5$p~RMLMSpn#n1cE&K&4QsMfQ;z_zSupfD9$!?06m(X?uMb=C}_fZKM}1NXZkMM2`xC6;Wz#T8|iA!e%T zJ+hYOn{QY>JVfV)jRlT=rjN~l1=dbx0AC7f9FrkSE|p@6QDmhRz5sz^7iaHwf6KEG zkOUPd6na4?hl7)8cUVjm0>gk2JYY%lice_ba1FWP3X*-mz78s*pl%Co3u`njp4UHk zsV4f$f$&a^(r{kGgQr|2g5ej_hq<2VAVFZ^)+j+pGb1ubrV;sqHDiP-W>Ap>6`91) z&>>S?MtuSyn921*StXAto6lZWot&l}Z4C|SNcf->-vKavORq3+lG-OKjifl}f*=s* zuq|!ZU?2;?8h(f~h!X4Vw091%#wWFN1-N7Rr*wF;%VfUpe$0Q{{rz=&&~B5ueljJ) zP^-bI1&~W|3eUx}F9@oFFw()Z7y->&08LOqrj{RUD=amk2R9agLVYsjj**XAmSHcv zBFWwCQQU?xzMlp5LJ;j&j;RQg3?^+xIrLKNuMog=yT9F*v2woyY|W@=21Q|8=pd*m zfhF@WTPt;2p>@$bBkA9#_hCf?gTY9POOFawZ0f7_#VYz^VQ#`iSY33cGY}6|po*0R z7lB(KtvapN_EGSS`T~*TZ9*4qhA@62h-;*r9sObVvUJt{f%QwQGOTP=HF72V0nP1dz!; zG09M-T+M<;dRSu64&ep*9!siAOGbmwW-7Z52PDU$43?R18L=`;;D}j`aktg}Kq1zf zwIEmcuR0@G8AZff+{9xUvoCLIm8RHL-epjC@CHq@z%A(ZOm6yUJqtkM0G#3 z99+5}bL(rfxkY9IT4)f#ytj-#GiJW-lRdHzn$L8VCvM%k%7&)r2(zj;7?ca-L9|3$ zhyj}d6YV-wxU7uq4*)?M=jw;@)W#t>in0#&?jg$?l+En|x4w=>IOCK|!C4+Da15am z?r7d#!a9Th!R9D9X&8Y!ZZu;-?4=kUMhS+%=lN~dn$t!%BHA*fo!D>5pCB;^eOiUO zury?QK)?Zt41PX|7!gO(w9|wqyqaE?i@VJ|+WVQ1;&sVyktWR*rPwz42+~}9wNq9v za*74}u_3p;oeGom%jud{4MbsRgM52+#Z+{@m0Lm%BfLwca}675Q? z#3}-%sQpcjh*Vnnonc2V3&O5?U|W1K*BUAGL;6qY5?nMQP^0@(kBLooj$DSGje|)IT*4UJgrOy8IC_I#gJQJn9Ybs<+v6b zkEh|SQ9Ef)K@ccp;NQAeqPqggV2N#(oEAD|z7CBXDkn)4=C&F+X7a|J8@32~A5je` zKNu=W;7++OM7}Qwd5yaSx9DJ9bb3 zJ1i$+@fsSao_ZxM^<^L9wFjHntOt27* zL6Dd*Fd7Dy<~Pj+CKEXjwm46XV4`S89|0We1Q5EGSB!-LYth9^wt{I>*+qedu|BeYx8E!%S{x%TzLMP9 zoRdT&m5WY(ot==mkbUS0o1sDF5V#ceF~7aGC42-wf%}4%A)ReP>!~WHwY3VSPa8K` zgVZEmD@}xAM}X;6L9@1T{d9HMd7UF@lldk18b6{Tf-I_=dv8><&B+HTis^wEGple} zyNsrG43*YpmCQ<85E+Dxrf&bIcpo-sL$2yvbSQkcX)e|F%fd`&w{F0in!7jiET*K zK!_ccH?*(fYKieK(O_=yure;7MIOIzT_e^XR%%-dazRrc8u04oW)mPj6s%&#lMqs6 z5C#Z#`*3u7vg*J+7aF?uNOH=|74AWV47g9N+5hftJ28)gJ>!lLiD7ZJEXXp8SB6D`v1=DdB>Hx`iE*p@Iq`uw$MOP0>QE z2me@aB1UJ3Iu?wG09Wy^ju^CFa1cu!oey8D6^uMWpq<}U}%<3P#r-KEk_JV(N z{2=MY*zY)=A_Mf~o^;7?sr9$Dth*cxb!shF-kP(2T+UWB6l<> zD3QdatY-MB(a)%r%{`A`?+x3$pWPAC$S!tByIT^w(KyCb^oqBd%~S#za<)kdbNI(^}Kw%)j`oV*n>F) z!%NhV8EwiSp_?s+&?N>XdAdd+4F4vge6V5FU;Kts%r`IY;CQ6&XBqc0-KhUV>6oxmgL5Uydrg^(lZ$!CMzpNS*RQsb~? ziG-H;A?Yp1hxjbUGm+pmS5_QqQKN?kUr9WpgHmZ$HWL)GPwTf3O~o03GE(4kv*jvpY5G=cvdfH0mmrLAz*{ z4W`?L!bEmg29==y=zuvV!IK&AfDy3D=03su|quD-9o zE;9Tmi=N{!_kN-1I6(N^hr)6>_T%{_^&f-FKY7UI&WiuD@2J(1r){&`_;-1+FpwgM zes{i=v&2#N=(Ndi$j8=^G_d26Qw3KiBUQ&w{^;DYO2z6X@OQEkrTQTgRAHJkL_yh4 z>ovpb%caQ}{7dCYJ(QOZ*y7-H2lM6SSEfZ+*bQU`Km;=l*%o*ui9ZZleE5a>RVzPx z#UN23pH`WOG5A1tH4F7{Z~jXX)!v=_Qxm2ZAQp=ef;4Be=C_<9vx`N)&#{y!M%U|@77(! z2#GZljLPY?iL_?WLx~N;UXp?=r;$09V0!c~iR(brV%QnRjb`*&?OI)=t_Gq(rRK|P`D1l88B8^%kp*nl5} zLDE#{qu`OA$d`M~p0F3<>wV~tj;?L86NiJ(p9i#`Xm>t;R@jQ4lLwd4@w&yABP!8) znVC7-H0+fSV-UB5Ar)|HK_=nV{~&EYJ^}F4-m)_UXJjw6=%LN1&}~$rv~$LrYp0%Fifc3N#&R|BB_8eg7|%ji-kVl!1ka3^Gf*61aHLq;e8AT z98t`rgpm4bo69qK^|bL%$qpN8w4c5XHv>qdilulv4Tr}YB}uSN!S(~DPLo$tV=#8< zXwYvn$9G((RYdBDj2MyRGxEpg31Qf0oB}g~qt(e0?2AqM9zXswsDDf;v zZd)ulTg@$4-pug>stvEPAKn|9c1?02s@m-uqZER&qcJ^AWH^sGMry#rh9-Gpdq4yo z!uP4ga3ka%Dc{MVzCGJ#@JltTI8(O<@-5qI zg$ahr;=N3Tm*(9V%V3~okb1IkAIY*t7s@`C>0COW!W`W1jAQDy$;l-{KCvAgE0LQg z#knw-KoGcTpU{V))KTk?Utms+N%5zNtSGPbUn|L03>6X9CgQrB(l>D`efcQ~4l%~| zPH?4CJ@NW5Rl>Pe(kT-Df1_N5*XC91_J{#I>_K~Q-0A9&5P&UpkFLEDdxyN1H6<^J zjUa=r2Xc&?o(=w&-^M_J!wy3RN7-?Wqo-&CCgrw_XlnwjMml)-?wB4@QtNtOY+YCP zwZ&q24A4p%jfl38JVAk3i+lYMg(VE9tZ0*=+9W?UM9zoom>!f+#-Kgw98THp<3Xp- zP@g*O168ZMs+)mzBn8Q(JOC0Mqk45urhd@S{~^nf({RknvRT zQkccX^qUbSt3smhiA&eZBHnPcg_waS=|tk;q|UbPD}K;RB6}=RdXFB!Z<8nOG?W(xvtGgiQ|n zfaaqS$i?OspC1`@jL2I2E8+^h1Yp3w_z-TsTHLv)w`Q572AmQ*&c=keTUm!=a-9bi z5fPsWpA!bxpy!+jBf|^L_({7~37TEt)#9`u zS5DLBO_T#B_@bGlBzlX zUyz-hh`|S7;4Bm$BWvyWjnK=sC(0v7+;FtD_{T$QdY9! z$M78OyeQR|Yz;?%#@K^FWtAu2PCY)4vx6=fNqs4AUCyw|x+lZDXBUxJ+ldW$Opq?T zhkh04(+(tV1qV+4Rj)D>E6IyT&q(X5RVK6VryL$k5VZQuPB840t#?e0B92q3aq!Oa_EAs+D7vQ!E0%U~Q& zQ7OIrnWcvK0kK%KBHB>=Z^DYi&ZZHnESa9>h8C+lWrFw&bL)~%mX1!^f3?a@l2)TMLBmoZl0;9omDnviSM=0FN9z<#$VTTl#OxX*Q|xqLQbch< zCCV_qHAsHWT39E!A;T>kJPi*6>VKiNplx&MyQG;;5FXQYF3Gc(wj z@oXqdev?hrT|@(JDmP%8bh(OH4rZHL@t-0NIYBkg3$B(ky6duyUj0rW+CLv>L z-vMYHsC{)GmG#Fo$3t=v!UR#-uhr4leghSO9(gnqB@*Za#7}5X2npW&kNX)AJO?HN z)1ZuK+gJtmF~L-AnLti}@_SK3lo|#H-J<8ouj#nN>J{-|2-E>>>E6ZS&jl4c>&?7o z(g?QC88j~tf$~prC~t)CM}}cC0EC*Q2MfDWy`5gke1j-=c8PqPf%ab#%{1+LJYNHJ zR$t?YcMxohodDaYSh|usF6gS&A$iE2kQvuT_-rv5?O^Ca0*X}ETg2pWV4`CS%!d_1 zWVl??bR%+SfDW{m!D#z0ytVsH@fxN|+PFtheI}vsWh9e%pcYn#AT@8E-%=n^8LPX3!jF@Fup5$TMbCS5 zIBL5+ZQ?KGjC1c*6H6YA`9zRhSzn(e_58;t#s#FTQ^KJv6hNV^5Np)>S>3Is}vpvm;nH zu?LLnOI&=S(8MSqb+XQ>{ft7MFp{$HYzp!7m(!kB)JDt*y?dt|fhPb?Tnq{uw+`MH z<%JJb>UI1V#<-*6a20DfDlq=g5z=~Dy^SZ9s5dl4z(p2xia`AFkA#vp8e`6+d&U(1ao&2Jya49H3h(eqs2!w zVlq0C1K$%;G^96>;f1m#DFAO7v~yl_zR)?JpaGb_7`O0cMqqn1{*QYJJhGF~{Fd*V zJD3u9?%~J$D6OUv7|B_r;*fCB6e|aIik7mRJl(+Vr^2Rfs^5cpxLkk&(*{JM{Lmo= zo*x)C;hJ%Y_M7amf_9uE(n^>ZKnX7`jHC@P4Y1>$kePA}d9Fz>e@dl+Dv^RUAp75p zDLJh2Gn^R%_+)oY5=deB9$L<=_+T>DX&Xg{4X}a z9dKphz+mBiL>utZM)W_c>*qR+rdLPkVEi3*m>O`}Iqag*NA&E<4j30R$X=26gKZjo zZ>5NI2Pd#d+#fd~@KS1HG0NZ$)Hnh z_=w@fh;PxSS?j}+dB~e`5q1G-hB5l|SQ20n_ny~RNj=^rm&Og00z3c;#DyPcqe2EQ z7gZsHU@wtTh>NE8a_glD7zkWYBf)pr)*MBcbz%5PXT%SHomd*wael* zQUo{h0NCPrbIC5bdoc$YyB*X% z02T5FEyhA<5}cmGTp&Io9D;Z*8TuON*K0{2m{plH)n{VU^tJ2}^}|S4NJbhf=$v3q z&_x0LLjtc4zsirrCblFh-%aYQbS*?VJVjAS{Pu?13hqXqp7xHoo?8;Cj|3L6QoF5v*o+>@~e`rI2GbCgc2dj9rTm!nbB#RPaM$RXwL0E9$2;K$BA5Lz=7dEm2 zhzjB+)&6mn2fDEle@H(>sn-5#st%zVIK+RIBv+Cm6j>AV9Bn9C6?Cy&0?m2o_2S#|RZo)(O@F_b20QH>_D$3pTSn6d$QT(P%0 zB)*(z9?|KNZ&&8Gf_|v`TR*b=^_6(Y8ZmHspUIXHk)gLkmp(U?+c4a9{A*T{TBK3Y z4LXY>w(-C*=0P2{IIgnuPECA-NPsf`8z8lzbd6QU_Lt^k6Lu_l$-fnlf;cEKJ{$n-r|J6z&tW<1iW z8)QRhi})1u098zx)#fCoq9PkC6ToY%EPbAcs!g>0;aK> zQ*59J&U^erMURiSbf-)82C9j{NRm zHBBNy_%rRvAB1^p>8x>|YtIX8E6)K2MJwk|)&fXflCioY_>Uglz*84K{w%$n{v&XK z)m`HaM9I5Wd+CQ39z!809#VTuwng|n8l@BL&l)t2jz<-bUBFNnf&i}d5EI)vH&`Hw zdQv2ybqRb#v)74_8sLwjax84RYNb63f+$e1dXi%v&uD%Sv5$UI^m9dbX5GWDrba1e zMpG{Vh^qIXbsdy}UfNQzLX1AnWcKJoVdCFG(<}C>#<=QLsJBTKX$>F;A+&FVKL&OF zTcpM5<@YN7QB<%bJ4-JtNd-k^=p4a4LB9%NAbR9MsYnuIFtk0TIV9!=t$LtJ)Lu9M zweL9spa?*A6D@At<8ZT3y~WkiC>cNeU;hCBMv|BR`uCZR&S`MLWZt?&oo+bq9zB$V z^VgB9R?rSfQ_<}djUOy4q#I>c3RYwJ16w?L`fgP zn~HR|fv+J3iXmh{n20wF26{84>cJUDxbaAmkxk%Jo8U*Vt@FTW&9@vOQjjSJ&Ry-0 zptJ2=+oh1If$X-R>9jItFe3`;G{3x>{YrnuT0u@y1vI}Gu#hLv3;`?h8xi9t_4EqU z9E!@@$eHp71B6CGS!lfG=yWH)a9|sPcP{hEqw-4W zvD8E$aoI`!v|xT^plsL;NpVOyBZQ5O=ADJ8SO}tUn?iHx!0pb}4^~1Zr&Y6M;6sA$ zLgDHUFluIalh!Q|@VWMg%_sw+0bS~#af{UM*?i5=l~5&0w**tW&i{ zrgDR>@F;=f1p3{!Jp}ZOiayVC+n9Qfg}3u5m}wj@)kM~rr$DFD>~eBNi8}>yoE~4G zKpWpefQSq$780@9g~m;8@v5sHyQcThL(Y&l3ZU|Pg%KX@=~5c^S1_41Gk1ofzzi1p zW*tLM6<}+CjIwzch``v}TbxIs8CKs>hnAf(0)T#2j~mtkqujZ4TV98{xiA1Lbw}dY zLfdD5w(8_XAYUU-0##Jlg59A@#J~&+RE-#?MGVs{Ws}sjjIbnxt${{6c$Q!LN3ikfeMiwCS$1z^%TKSMPHIBbQR)Os`Fd;Rd-&x z5+L%L1ZLtgWJQsr1@fIY?~u5RPzS|iOsU{95JziBT^*=n2N6m2=YlzKGc}!{kksrM z6^l%cQ_l!K-J^1IV|t?R%tE*BUx+s|v0~AnT?)N9v+uuBS3xIWdRJg2l4Gyu;~$bj zRs}YK<|KVCs5_tTQqrsTC&2|3YF<_zgSoWJE+pvu&6XOaskaoi^CNuI8-vY?jrNTkbY)IL^ zeGJ(U%&+)_tp37qS#^CZQy=p)fM=~0Vn))|j%aU<(G!GC*pUaHh0j`ZMAb20RA3T(dNAg;UqW}DER0f!x>rY(*3N^sYUf zVvR9u1M&pq)~mh44w(hk?kR?{TWv>D{8DP8O27Gtz47#P>2vVJN2|NJpl+1c=uDIA z&*6vEyACu-9lM_D2i_sHA9rG`bPne}p0 z9LnBmy+qY*xsH$rj#is8O-{g(#%QHl2SvM!HE3)qiJXR@_jUe1q6&szBqT;V6^_OJ zVRZpvPbdO`Pd9hGd49^z9XF2wkg)yoO>cymvx3q|-8S2Qu08n;+784KE=iE~86LF! z=XjrVeW~`2J0ke<@+`<&#CQq(oQ|oUR2v#tlt_Xs8VS=BMj*JMf-5yRi$?A&CUL0* zf;PVbmoeX6@1{wC^&SKILL+AI#B@3>+;Wirovm1pJ-bN`}(9? z*@Rx^LU|PzO%P=*a;Ig6GvjB#e8J!e?dNCgnMI2Y88OD90w)cXFjso3D{59c%-^6O ziEbM+Zx+Qsu4<-`uuKB1EirF>wxaXsBBP{=#FAlcWGkL?JbgOB@=Pj*Rm(A#SBb zCXX=yl6zA~;(#0ANwoFpG-cdD^;B|3k++#DXLB0gPODpvv=47Uo{W}6oq1J$O2aCTaVZtRWDLBM3 zDN>yx;IMxT<}OAmfp=-K_>N-RZ%&=GtY_lBt1&6uph)dvI)+lhBZ&eZZXIsvfI_*- zI&7FohKfO+Oy2r$Fmkf`g>FX->nXD}QBctTo+`IUM8mlfPu1_=vGNt-45{a^2waz5 z&d`-dbH`$WH-?<0f|9r|o~>5gVDbQE0A|xlES?F^I1H6e`Wv!~8$vKMCV&J&L|i7N zRiZv}NepDy{t|6UxUFMJZRHfrV*7Nct2u=C$xk4s*cp@#i-f)D^s0b-$`4p)o6TDz zVutb3=UJtEv~zvBoAPpZGT>Nm2s>g&;61!cp}s9x9-CkD|WXk$O={g0pS`_RRh*E!cMdZ-wZS@?4X8;iQ!ehljt? z#;j!B*!T~`S1y(btB41W(<|CQm*7^Z_^xDKv4F&t*!HJDsQ{{osmfGmo?s|EN)+ft zU}06V!~^35l!|5FVoJxw6(fiuj~D z3NEdlH+xNc`OY4^dr6|RhrJi64O_gIKTWO)C8Pzrg)~hT5?4n#!&lNvb#5UUFp-K#Hz^u5T5HLka`-?3g>WHdg>DQS ze%tWc7}l!(ynOL^CoG4=zNO)Ub`0h|->{MbLER0mMCqkaVd0jcZQ*d3upzk(0hfrg{Df_=vp1q8WxpMXsDwM2PA(qVqsWolq^n_ zq2>gMrL7vF+PTEvk|Q-2JUgWPF?mXHRojrv^gnLV#f2bTAXJ7JE;t!Toof5!f3tKk#sX=sa}6DAwk196_ueU>+C_b} zj)uU3IwkT0=7}Jm-sM>E@n6Y=-`{h@R9raGvUyJ15KJrd8c7COy)g5L)-wfqn_ofw z$=!&xvci^_CuIHyFo+})72l?-u*RX7(kCb#O)}C*LZUVrl-aQ#N8hn)Wp$|r62-(l z#`{89h_>p0MDTd1oofCcZT$tchW-vGiZkEnDeto;V*>j2gF@rH%?vPWR4PokvFFHa z(bzCH*_QM~A!`Ba>9Qvuh7k|HKY=cLqO5*gJU8Jo8-U9ppeu=Cwl~ZtvMeZuK_qcCMb@4tdP5FfzHJH1vN zZfekozJ)=JIUUMr;CA%(gdP=Zgn{#n6bl8YwxPuC`x@wgf1?8R^>vVrhKbBmjq{nXz9d^9>eN!1qaZRa*Km}Ee-0Zx{(qJi)Lh#2t{VBuMpaE675G*xnRbbMNH(0lHBzC3f zy>2iv)c2HFI>%QZ%8a+;EA0KZ6aXwV;P0XzyiR%8dYz~7qwXh=F(SF_?!WU$BCE{? zrOg($Ij5_d+{AR>q}9l?(fws{rJ{|7Wq?Rk0;vxX4PHnVi!`Rro|HDtt>^+t3}iIE zK5Pz@m$ei$U|mco$tjw)jMdlAdyU0J6(hT_*GTGQz14!%+tZ+5##N{@llDOlNj9n{ ze$+OW;a60qoi?#gHTqkJ5za^EDai!|@p;g$dh=va-`RNIm+Zq(9qUr7H899{(w9s? zTn|EP9rQ5@cBhI-&$hBpyQ~kF6uox-#{%l0cKOZv$!^fe z0hKM>Ty{8Hps!-fC%RB$nK1f}8O%587zPRJk-(7@ktX>N8e^%k)Q17X1WDRn|6MOp zihAt;g`B{T0dqu4h{hweaAS@1yLDsfi)Yxh$pMZ4JMt%J+9pg7gJ0dzXhc ze#LmYs7~!>@c4(4j0B7N^&=X;n72Yp5~8=AuGPbaEtAV6rF{N^)g87*DL!3s^dKxx z=&jo5bz=g~ zHQSPhSxQ;#N}omMXyy}d&NUDcC4voK+HkT&?tauPMAMbVC_}<4k4};0e zS3%EJGP=h@qN~Pv)^q}?1$U;*C-E!TF4F%YLl#$B&WJ2u%ymi~l&+)PFqDp&+GpUN z|LU)SrGO%MJMED!XlnDN;YX!^f*1yZIZ@`2)=7}S`NOs?qA zJfbzpSx#-D01(^MqQ641YnjvTavW|9>4X>~23NSsOinoeJ6?Z}<_(p^`@ee!O{ub! zJCEYvH!2iRf$={T6>>1Zc|P@Rfr!b@^5+SS&uD^&h;?I7g!NvZQNlIYz4VVP-%mki zBqxQ$=__D{{p+nHi?1T|IZI9bw&uieiNCVM%mN6ad>9UdP4v2&Gau+A$1?I3u7f{N zj?}KnB%zaAy|1f*ptj*<@ONepMCvbc)g1DgXhULWIKs!|E*XCo75HMs~aQG6gQ2`7NKqnJr-8Kkh=HBvZ`H?I=HL8TE6H52VA880>B;)u_20pPft65!rT%x24Bo(r z!g;H?!6+;jZm2+=AOXe;+PNKj?^b@!a2##8F}EahnDw@+wC!t=d(z=7e+I7L{0 z7*N9Z_vHQTsEbvb0ThzIX=VTq-J$s@96?IdwXJn73=HYk2IIsTl{E#-qjOvsO!+U^ zk2xm5P5?E@HnoAdZw)-mH(9dg2z_QghA<=9r_a^w19U2@kr*!WmpT=e!gb_J+StOb zp+A-l<3QaCQUsvKre9U>7c9sj5ID60(F(x91)s0zG^sGq+T5IALeP0#DMyk)^LSy1 zhS()ENDcq4H9jJ`f28zQ@^A{$=5_Q4xXbtr z3|TT7`Q5}}a0s=9S=~^L5$MYk?Zr#a!aPHTM+H+%Mt;O;AtE8Uz~ik>epHs-84^ofVp|1sMrzqI`MA&X~z1q_Yf6imTF8A9u8 zC^x{R3U|*5cw4*ulF__&j4DTO{K~KBy;<5mz7jGi5mlptzVWmW|Jd;8_%6JawW0JA zFy(17Z^0W_1^{YzZ8}Dk6r{~^V_XJFx)dsqIQw0*+adh!Y$8BwGUjdX;I#pgcWL?` zkr?FK>h0|CMBD~q7mKGf=j@*!BzMH^60OHlNMgwY&+>wj>Xp0%lyNdJ>mh$gbWZdc zGGhFrX@Iwfg58Y#j#?~EPcxW2@-afqZ8~B*`|3+|4vbHnt4T)h zw4jF};ReO7^%B`KB@;~c94xCI`cw<#z^Lab&SEAOpVNx|3|ELUNSwUhcrhl`a+g(U zx;v75h4>HPQ|?~QHZ-THv1l?NxL7o&j41k%+r($D&bgO0gL}hteM~4nDPq!a3aUFGfOfF@-pK?*cHSwl#T4th^|8tBB0HXaGQi z>_+;Swkt$?L76Ztws*Z>9j?hvstHKW>4sSwz77iYf?^R3n@sE$wG_T2P+0+_sW9;H zqU2ri4no8#^uUO?%^`OQ7z<8&ukqqBR4_pLU$JHbrp-HfeZzcKI<;%4WSc9o?vF}E z5Rjo-0Rv2RhU*~}JCvZc*olD5^VO4bkres)fJz)^$9W;&Ku(KQ?=^QgUF+t-GWv@8 zzC-~w-XwjwL<3m!WCXxW274li4-S>r;21Oy&rxeX8Tf;W#tbV2HcW4xiHfS zP_GF!qc# zvvmA`8SHr1Zp=Z+{59*m@zE+Kto}Bhs>=&@PBKAx5-L;$)l#96z;GgAx=NN(j<5JMcnlcL2&gD^?{g5#<9O{}|!uKW8xQpH%Nc{0qi35Jk+ zSH*)FXG;=nCc%aeZBDX+RklDb231Jz?Ea4R(JB1_PvQG&dZSdt+$Qo4s3Oi4%H;=) zvA|;P-@hQ3V;EjEq&(T{nBBL7Qx?g|PeJn|6mg;82t0=c!=iUACxWy%k9^2~m5436 zM;r18ZyO(Lyxdk0l*pn2i@XEK8U$NqUYEO|wl=FnVEpzj?cA);T#YKP}3vw z+5^fK*43i0WYHj{aXliFSPUtZPK^?N(_b1!{Equ&EmvwpBW#XGBp_D_ksjZtJzNij zxaK0E)w1dclr4sY=4%GslH^{}d+da&KdwL;PLmemB|xL4;a;-R@Ps;tO$lZAq^vv$ zVPI(1fn7#jw$5QmDP-86s#3rb4?zIVWiQ+QM3*Nib3LEDNnv&{$O*~H(vDENv79Kh zcW32T6A)*cCK`o^`o^& zm5Nh6@pDEf-Uob0YsQF%(VW17RoW*#(1m?6ihM#g2w`xcWc0@AQ;CAjJFN2qm{_Gh zF_IFbeb7D3YuJUFkEvHld{&Ng>?-qupG!t8r990H37*|MGRM|bJ*!dEQ+6EX0Rx$! zcl<4(SqdUxZ8yIytS8}Th0VzLlAzKdxNnCA#+)HtdvAQt#p5wX~eH4xN^%FfrVxe`6%rVpWr+j@221p0Xv@Sb$Dx11YLqr(*S$?IQjLr zMG;5044Wc@Sf>hdc=UxMMCOR}JXRjJS+Hrk=8*7ZQkcZlf9WTf+D<-h*H1~A*hrQb zpHE`Y@@nS{`#@5>B_}Rit?L_;`?th^=YVZ zieiM(DsXoWO9nRuEKmJgCI=rJP7#t~P8l#E8?_e+wcvT=C89SD_$lPnZ-9*ob2Eub zX^i5>#MyZ5Wxg=8&s@kzfJQuM2Tv#}SB^jhC!ryvcndbrp6@W0hX8jlbi0^9ZY965 z83=Vo1G+{q@D{{2J=)>uqe7?-5scw;zTuPS`!WZ$>v zG!>byyyj5mPf=|reW&+RKKn8I>WPs+SsUjn(2xofi{-2Iku!*6pJileW-7KUz)lK( zcrLMR%#AweikF9(Spfl+DMtgFNP2^j2S(^kTE&+lSxo*zfgLu#>pOw9JuE{BHvS!I z5|kbFlazYP^odEalE=wW|OD_g93I7DuI3zA+33`y9d<38Nxz5RY+K!5DcvvNSx9-rJ}e#5jjL84R#Kz zLOWqjx(eT>pc`}YUznaq$b)3XcbuM6txrzvE%B<`pi#^ABE_80XG?;DBn`1n4i41e z9hod8@!TAtgkDKiV*NmtVnpZ=sPr1!M(c}q2BaJ>HTJZSGg3Dyp?JDe$BL+j-ZQxl zRQ-EQ7p{#|B(fAom&7bNfcfNx#H>}6XUfS^XV?c9{|yY&xrjwv!$r={C8=%49L_%ORia)0}L;a+3$VlP%MOKS?V8-`sswodviC%n0L@rh+ zR*qHz`;=DA0dvA~zK@%S!|&h2OK|uAP+sC^rspVOcGw!?st+2K##dVAwT~O|Q=UNq z$@ps5H>IcStK9&rA!ax#R{D`Y_J?(*540eW_;Z@ckqBQsky%V?s)k`50UtF%3@H#=Z)_jRW|qvK5yICnJz$x7}RNv*M9OR5JV)#SFctt z!haJsD|oFkyQ!Qj0#JeMHr|e^S91z7X~=1!J86`0cdRpt1*E^*bjKec{{Hu)8}Pg+5WI@DPZ#r z7SDONZ5yv<&}svLSgCtgyz;Bdg;nW_a7IsS>xCujk1lqNp;v5Xjn*_yT#R@`)=Z^GaQurVVVM==lbzXtwuFQe3W+{#VsU*i?WPxnI)H`+I>VNQGPV-`622 zN$>o>fzl3#2ADw=cog)+!`BDQbXVegDkTQ_t(0ks{oAVH6+j89%t1)_dle0K+Ej6+ z6H{R(U9LMub7@2InAj14LQX$rJ86ipxm2$(5N!g}iiAv*zuCnl6Eq`STi6ZI-*zoE zXe`Jmyga_z`f{9Asc0dqk;=3t zRXJE2=yW(25Cv!i86J?RxmorB?iY%VIT)(E^`@}px=ikmC`;)uN&+W7n20U+{xuy~ z_`7;UfTCOYs9p>XyDm*YvM*qyVPqB@kJIU+2>PNYKuW;SQ}1$wz}D&??sf?&i6 zS*HSPS}?x1^9)%uuQOEzfZ{$XWY{M#N7dAMQ6m!QD^x5f?0_^(^omD7og+aAD%`B9 zAklXDcY)&K&){evVR1Me<$;v70WgW90S~ZRXtrUHj50Z}IFcD>Xky^SGfSI)!68XpjaT{w>jiqoB;6L1!$v* z%2&0GmUvE&X~abvlSvQ;njzKEp&>0t*y;N~OZ6cRAH(ys4S?sc;#nXK*6mkphk)K` zeB_3j;8ScQrB94#-U#Zz+=X}mv=l}sAi^d%1>RIU(bS%@k&WlsugIWpUWk!phor183?>0uHa&pnV8r0g9jb;2YiJDO-rq0PB&E*JBbYEf!hzg7=*Eo<}Vhz%TCU+?q( zQDhN&K7jvnL8O6*%&N>MXa)bOx$itjY*m7>z4%-gcWrs3(jG2YGxvbAM7Xkqb% zWEQ;p2AzE9v#1`z#bDXu=NjvV(I+e*zg3%iQ3Jf<;x(qzU@^VzWKm-En zca>#x7}h08Bl1RUju6g+jD=ZqB4ioUnqu<~8yw(b^x7=0M48FU&}zct2ohOEyOdw8 zsGzk^3G)HqIVDpSLc?%dBmfeEqKbkgAeOBVq( z)Cpuj!~tWCaaH402)U77O6z4s7$J=Til9GC6_zd~gW3=CpZ7l!Ch<{oQbS3{U@X5e zfzwJAS)rYfeh~H)&jAYXjxk-v3){wh2xQVk2=gkV8F1%}{D^BRypfvyFo(-4eGz(_ zkEd=-g=3IDON#}-X~7)Ty7o@16@<%*^!SPf2%oEy6y2;eUMh-yv~CKmQ;OYxA&2^? z6OGip|B>uN)#7E=_XzrrY)%suhF@XgNFlp<`rqSQG11Ko=b++2+8ZOQ zQ+Gn7ef1>IHQlluH6zwZ%~A-*A%!~la1&I#*Q#$@H3=kkfr~w!1Dz>+Kt%*;L=|5M zUlPX}Qf95gx2_oL8ip^>v8jsqg=pvtqxmhdFHBixVpnM3j&n;ivE29%22VO!FeZ5U zUU6u0gCay2i~%*xQyIUS9TS)k8?w{7ApB;9|L;+OUr6}6cz`<$77u2=F-Rc|F$2P| zHLc9$9MX-p0Vd_KvXT1cFUI#H&5i$0IUPDQ^5sNxB~#h&u%ziRj{DVf5gqTr^44HT znAwJ`mpT;*zR~s(nC1-GThX}Sg3R!s%~da}4v*EghJKM1+Eut#hHLPH2z?0OX4ZbP zzHQ5eJqiywe+?REe>rG;jRyGzpc1pY3U_wRYQvHNCqtu2onSbiCh`_DG@Kj#-+_v* z8E%{-rR3KBCw_@G-&69i>Rta^oMcK2;oTkCZ_sC?JNw3wQCdk0z-NCola2%rXeR=U zzY;&$KPVFeB;__c``KacK`$zn^{ya%y6ZxKDBk+)vI9!nkg;Z8L`xugIb6IL)U39! zVO+6e_X~WyLL{Yl9$4O-CapBvC%6JU*oFmhm$qRTG(Lx<3&Q2iF>G=!xxwnuY1mca z)0Wv5P9%=3abfuM!&71`VIL)K#n7M+LzBX}=$Jx&giwZMec-A_>Uwh(@=PUL3{CWQ z$h|m3v*g!0vI(%LG4dj=&=D;80H?$%>?MID2*-hn$w}F%1AO}D)KxigDzd=GyoJc{XMDFySOWlmMZDd0k;Wkb zM>Kk8I7xmdVTiM77BHe)zx+n{!u~rRCYETM z`Q)-o{(Fd0rcDv{B<)0=vJc@#3JZr!fTYHQ^yb1?jHih>EKw7s+tsaN5V$=6NWR%D z$QjgOwJkNJI!w1C{(=EpeAQBNu{$JxM%q->jAPIw53fZ8 z!yFI`c;PLICa73G&+(8iFhySr3mUr^|5%f|#qX!VT{>b!iMtA+Kg_0b(!Rlhr>aK5 z8GDRmw-(;|&p}zgNOsz&-Kcp+YxEWKX~h zCSwB8uz3myPbg{cS+}P{LgXJ@GnP15ooWyWHge6x)!H*)PQc8@Y<+?-#(DhM-Dy6g z3EOP3`VV%&)S0_ngfdFTq&4*~`tB#Fup*hbio|qam#FmowIxy|WHq48BIR7VH*G8$ zZhJ~tR~ep8#3E2gXgkVt8K_NUFil5>CsNZ!XWf08vD3DN#%58OSTHnrmT5Us*HOm= zV#ddBw)@?0#4+O6;wLoR5_P)wU%mwFbkrq7P1aE&B{P*%R3Qt~7A4jYpVn=UR~SQU z(yyjf5fBy0+oR(-@Jq%Hbserlu2mDp|T-=hy-?9Do@xKD{!D zPm-RU9)pO9wnG}~j8<<9UB*T&K=KPqf;)`&XeLZ@q{6GP{n)!GGAV0b`A#c1)EUZM zN0b(U;lv4(qh<}xQr=0~h@p`c*D9pOmNGH8i;Ou>l;tZ@J4vUXbow;vAdhT7T9CS_ zEc>rsAt;ErQ^ccKLydFyd~%#a|_VO3KsZ7l$owto@I?s zL742qPXIzRP)&M~UorPRo&-^rcy-dq9{kT5e-6QAt7ZlpLrrwGzsnvM6geA`6Uu=TK8dEQ+TRCliFTpcZ`-Haevy(h_?C zL91f_aWuiYGs5;;P{H64Bg*Z-{+Wtjd!m{M{32&=3icfj555VH$ECu;KeO4JCLG;V zE^h*vLa#nDk%%t~9GGW0(BLVF!w_1qK~$zjQUdNH^&LNHm=3y6R7T{{$JF0if8rnb z(6f1128KVOgvE67pbYriA>c*cCukWJIorr3m}-54Sd=E}N?X7Kxj$v$(TMqt3 z-h~7u*?I3A%rroox15^x7Tf&<0u=l4b^@@YU;+w44WG?OwxwElj`bZMOczAIj)DDQ zoigS&_`@55aF727bG1<;CKV#EN^u=h7Dm5Fa1l)z-{b}$`w%+W<7&TSB9Ya`zv{Fa zbZn(U;}mz6{F{uX?8B+en6`mmT7=*>TWX8z?XcZH8zN1*jV^LLN_^I$lu--SeL@W< zq4{KB`%$Yg2O(TUFSQ>38dZ^wGmZuCz}8Jahl?(hgNQubB|-28tw62ie;l74yC@^4 z%D%xTEWy*EzRFV-cu)|oG#J^_9eML1ehA z8A)PaC`^rdQ2t#eXEHM1>3sc>u$j7%He~{Z@tXGjL}8F3Y9IHvV-{JN5*!s0^_y#I zTOmYAj+LyLg&@ruNu%w^Y!GAOl7dV6Nu9D8l&Gmz=wMgEb<%e_ZvH3eYSKA`vKoyu z{Zug!+SZ|Y!|Mp9ZRF-;yVJ&p1ne=Zz)8lwjjC8)T*@;El}Xr3PBmGrVMBBHbOJ$_ zeLd8dWT@icbpagk$Q0lX z3}h-!p#3^y#+xcnVq@{zHIBskWa``slUs$Az3~JqQmhgy z&KB!F;3tIPA%Q~q&-U{5p+4(6yzmIsRO85`t7X;bh16d=n^IrlxC^lu;>YJ!pbRwP z9BG3y-%o**ead8Y5t#2vSoW)kr-7-PlK4!zn0C0?_bpno>O)2llO$w5t-TM8jO$0Y zy~i=*(#O|uO;X4oX!fXPHo0Tv^6NYj8lD(=G(mf!Z)yAR+-eABh3(+db@A%rb+M5( z(y-u->FGat z(|}vxp(JEwUP~beQVvSaYH9xGtLTk4>Zv2&cFZVuk~W!Z)mG@=*SueG@ZQgx*k&=b}W#)PY`J$UO00 zD9JvNFJ*&y!+S`WcV|Dx^O8=9pAd`P1p_1NJw!=km`94&p+5hYbZ%if62bWa>^LJC z%|PZwHYa47X9Qnw^GfU&ZuRTvf+HZ=4u5P7C;+WPKP6_z{129!%@=7}0LSdUQuZ>b z$#59^pYYadlnRr7yvEPFHNDo*TU8bxD*D&}VL500$-ThT^(8x#O8bBbstlE6$JUjt*s z7?8EAkxN&z`4y7G;{=LG6~u|H9*Y!?up8XY)O zBII}?Rv^VU)ykzxN>g*_`VGuzD1!m>#pl2Yj#`bcCdJ&qEUepL)fL=_>jA&^s1ydR9bU1SUMW}H?u)GZ96GcPTP!Ps7BO>hI@GX81BR^!C+gv zx?uqd{d*gLH`|vgR+j~*E5G9KdL>025)(G)t0>(l`4z-X^dDgi$+K<;p;*lSpwWIH zhREKGJm!ndi*MGk9iV;9U6G=mp(K3B4N!kgI-`WAx1IXsVLX;pkbrs2hcM^QLD@m#Ku3` z%5aS+c;93n_4p%mc-CoIM2$tAbXwo-8SYUq;!pm&!7h^3s#Fy3PKy?(ZXIzGn8|+I zp`e6so5j?3Z$9e?!-c2pQh&|q*H;@o&<6yrWQYf9$4XLvq@0B9@3crT!NVY6d~~oz zq$f_)iv?YW5~nCA4t(LINP><65@tN=P2c#Mrwsmg4B4lk>gngi5}WjzB>)k;eLG;6 zBt@7sE(q03B^*w@1I$^(kk*N$4~A{-9;*RFK>0EVT?!0f_}uC+p03hv9hTdJ;Rk1t zSp?MyI)`}Z6bBKxe7d4f1(JB}p~8%|zFBx2ypreNuyGmoFRPE~5>=+>JosZm`+#!WJi4GD zyvNrPUSt|wKC2J(+Xd3`KukNyXKgk17_6r14iLL{|0Z`YE;6)*5q0tc>&8*0SXR6* z;3j>|V*rY8@>f-LdP5^@Wv`vFI(DK{41K&FFI1yTA?_XmA2DhLhsBwCr2O5ra}Vlx z*_zzm(KK~3_dv!2jb5ns+-Nw(jTzh;2Ste!^-dayCoU*NMZKq4&f3>GX>gCzQH%dg zJi!8Y=r+0IZ=f`GdQH2S1&teWHQrN`U>XQx+URg>Sp=ue{&~}XN#C+BZ66@QFqtp? zCra%BVx@F4sF32M(4nQKGBgFoKf(BkE(`CY)3)wAJD$TsTr-iJ_!_!J@!3rC(Vj4V z%z-aP6RbDmP%-E2?3%`v)+J02#zymo*xuipwNeU)v^rVkKZyt=@+db?vJDZ(Mt;@$ z*;qHodeRn{K}u4nOAhi^&Z_S@LZ(I23IkoekXdU72nLCsI$j!kl{jn>0K)_}mGQT> z`Th&^LngFPnZ!7WwFar56{l}JV5+JY`RX6uiG2A7XP!?VsKnOKyJ^Ce@4h{C-WxDq+gU$0Z932CTu3Kwy5FtWz^m^HMt=Y0fySE* z<5)WuBC=^(N4I7OWV>qAC7n8CKE{>nIM!!*=x*Qx)rcaO;uqhOEP5mWk;|N+O;*fK zdmT=aC=KvR5RZclq;qoovJbV;on6 zH#ExH?EF}eAM0ZFp+b!l=nMOwLpO25Dr4shu`%7g;VQ_qheb^qrh1iM2kKNG5kgjc zzW^jaX$8-zs}AuW0Bwp_xYy849cJ-pux0T2`gbq+10B16&km7Z!=?HwV9{IxlewGy zyry%+3#^;FyrBE3EhqF>7>w_|^AkKswg^|w31wf2o5x?sKzUy0_j4ABXBn0kr4IqgoPsDDSb2yIEc1Z28Q%XJEj(upcz zZ1DV*0&`{;kP@a5;EHl`+P1-!lxqe`^u1ZP^STOqYu|`RY3cUCHXYSCOnPi&orinq zSL$&@V~Fyl&_NFEM9&iuk?wB&Lp0_&&Ml%yKVF1Z4;@N|*F=cA4jl~{)kyN4cT>&< zErc?AqDFYf5>0PJIOOg9diVhXp!!{rK+Ys}t@3?nO18jy^nUd69%vt@-o2c4OiYL7IN zgI)q8JbzbkQ{7O^pgDx+=uqJ8kGAEC`Z9@xjFfy|*ilZZLa7 zfW)O?K%hz5^t-y6FYX`5jHkNIUl-3WxuIPBEU3!F#ftq<;!k(B2@TnV2K1ajDWL;2 zgKQ+M0zFqk0#U!>Y1<#^-%dhoHhrGVnQKmgs8J|WF_pv`W5mwm3+UH`*6Tc|vy-+R zC5dnSGffab$?Ukwp^wFVcBfMa)d`(?|7066M=;U&@gsZMnr@jZOd}I@4t>tyJ-)C<#RMXkkmEF~K4XB(*e|d)`cGRMa0Ifat6yr$ zjZnE!Cq(0$9-fmh$tl`}V8!ZpKMF#|T$$%Iq6#BmIPQDGE%s)*LE(i`bc?4;%*rO# z;vrNBH`6Z7UPC-!j?&2I`Qm>3j6{V>{b(^hv3qN?6%oj(@X_>!kzY7hG!i%hc`$OY zcMya9_W^R7V^IKeHmCi6)xLIcAlx@WOEp=Ev>)>N}(T%;v z@m6n0i!38;I+lj^m&d5jNA;fO?F_OI41nYooxDo~s8I{b1khPB&(4%uDWGf8k@)6=KbK9WNRERgG(EU)Nn zbiarb*x(!->DrhvLaNO!46i~(euh%HN4XmqJgNokqpzltbK<*Q9jEwdYCER`G2cGV zdyrM7f&5O&?K91h_l%3M5X%PtC&A7KkaY7*9hV5w>#X+aA(aj34J|r3)?a9j2Oc)3 zDLZl)xwXN9dPL=Bo%Y3^5cXvv(9Fj1Ke5f)L1hMV0J=ARK(hxsof zagLwNknw*dG$M?fq(LY|)n#ZGiB~92RD<6EmvV(mHhw7={1T@s*kJ_F_>e<+TB&u- z#+jRvw*hO(359OyJB%eIfJ3GE_&R?4;Ufv_CfeCCO27Y|)>}$N)@ZhHR_$dVT9K5@ zEnEndL_2yG#&l=du&aCKB;d4G?=9~zx<|rH07#w%m(o6cTr6LfD~ch=75^N)3iG8Q z7sUBj^ZV5^`U|Q5GBeHbJb8UVw4LN2#nB@i#Kk!KmcL9SKPJ%H*1}0!^&SiX(u@#+ zPRqVF^SPii%S(=A539q`Xc-j^;~CK7Rl%Lg0|w26O=s4zMWP>ZX`rV5*&$nc1PK?P z<^uQgfhHT$jVYf4Es>R)VgoOMY{M6s zAtCR+s@7?dLUwJE#<0qc@THUX-DXA?;SOm|XduYAT?_OcQcDN**klI_aGT-)eilZO zme(sn@)JY_b0MYMB;EN~zDK#l{9WHw?l&ic-sNaQcsSH>4( zJRDveDlq$r?(}4f;_Gz-A)>(<(Q#TsgyI$$afHiO2U#J_<5ePW1*3V}+i29djikayMc$nOD(#<$UVjX4t&a{K_wlF)@ARgK%vF-5E+ zEFudmxgBciH*6fPfW(IZ78FsOzXwsth;O84&ZI`fFd{yV?S#t}HciJ#b253g=wKYI zpo-ZS<{jbgvmuFu)aW9}TZ0{u(My{JTmZr!j|LMwN+wNy!+j-ti%ki0qY1iGGhR4G zEUm!>R+$sC{(zFAZbb1PWrj#k{=iniuxD1>Gjj{;_*mv;X(R_7LFmFZ#)P`Sx#(jRFLi(e zbA5JcSGk}4Tw%n<^-FMK^wlv#XO-#cR#dH{Ix9$TkQ$q)`cS!gwnBZ zYC_2`O7v(3gG>sLm2jw#Hk@3;m_VAS2Q~EYG{Y=wK4MPU;ul$a1+Yvb4xq)xIS)fh zse|s5O#3Blz;CcH{N#y*a>z_;`P)&X6!!b*rz#L&wX#%a=$t&Nqb<%)HYVXh{l) zP@C?%ROaV$jb%(CEHR3}k5f7mx?aluQcH>Yx@Ri5|<pi1Z`x2Qy9f2p@sLaYJ;6#}J6g znYR)@)04LM(fGZ|4~&|el}9P$^+-}pD0_|B%N9>t*=rVr8vYw@?0~+Vx?}pB=L=@1 z-aQ}@nag)?Ay)Au?mNcf@QG&Y(-)?xEbbV|m@z~S%`E@1oio)2A4mHHPEPZ{w^Ly7 zZNb%;KgA;zC;Men&&<+=cYyUDPU$TAXep!=%PfSg>nu!9jDT*=qX6sDzfKX4XK8+9 zib@=9EB&=y;?Mz!Q|~AJ>TLe{vUpwM^qs9p!;JXp-p4OUM|)?Eor|T1*)m%oCG6X; zV+FQ|Fep$p&+kF$@Em%YOvXR5qj^5^FYF$OAi8kd-PS6r{zP=}GiG(j>ykjWaV%z` zGl5;*NqI^ro+Dw0@TlJ7kLNTkM+7TakCfKNhyt)N=y8gULI|{KCQcZMfH*;1N&C6E zqR;q+1Su{6sa^!cx@N-(#)lyZbR9JtSru@fr;8EH&k-e2%p^+o_)Bb%ECWuT&`i5Q zdi$B*o6(E^gtiiaoYV5ze~$ZyjdYUF$taQO%DSsNA$u}2U^#7dV#Gg{CQ7b917`@T zlXucy&|U@ivOwxEu23$L^Xicvj42FEUhTOU&MKsfqUGiUBjJXX(0`O$Ra@a2gJXse zup#k_bwNBuj69hW!?8AtE>X=ejg26~H+j@Y$%|Z9iBW8{Qctn7wVy~xeU@_>`P4pr zg}OlRdcW@pBV1tE=~L+xbezg@smt+uY-E&llmF5+V`?D_$htS$M)t^7`L{ZB^yDq` zZl+U$wK-vzV7}9Qj`A66yp=(f<2PHMu0E@Z{Jt;ZjCJ}H~ls9#j-O5?LvNR9hJ(9u}^DYrgax;+6>XIt5s zB2jdCK~{Abg1q%OCIz&DH<5C`Im6<=n=CA|3xgBKwiJMnOSbA?F6mJ~0yP$2fbD zx+P`_K^3G8NuD8PC--Iw-_E8mz%@^H-q+SK85KCF5^F}Thy4*^GNBSlA_a@eMve9n zNdSn758$*=|SY_{Jh?;4DXdZC1m2P!BJ3U zf@lAdSq_d=96WhTRqXsxX?9*tS_VLTw{J9P7X6u_CG=Ces`rNtEcyJI=&+jbe8x52 zMWJglpTB||!NlyTt&ODN`hf!}$ew4DC-p~u@hoiDIoQnrVTzpv6tF z7yZkLk?_R_k?RXiilAJH?(v-aOFn}{ z(b+`(#+i*LRww%#Kpj2rR`!;AwcBnIi#s$CqVQ&RQ`hZT5lcV9`Odh2WE zt`lYwym(2Q8%2<%MvyawW-eAnZ5Ot+{GR1YMFD=Jex2Kn8pE7cFSkao1&v`f0^kCB zH^`=bX8dp9MI~3GV0KeV6cq;@aAl4i3glr|!{9Zf51DoBTdgQ2BmIFAP*a z--DS51{G{v2qjJKK&1WT$jNud01WA0`D0ts34R=kN}>OO8jedrDV#pJV5A+YiX4o{ z5fr4OoJ@0`|D)1hO>;`z3}e5;*d8o!I;3_f$)I;{q72qZrpyG4pm>;g4!BgFhbGJ= zt~k8NCSpefD%@FpfZZwk(iHpQZ(;)}T(b=f+w8X*%n!tcaXwRTZ`5{rZ9Qs8=l z;0kOT-89T^3~&Zxjx@`&54h6a$vRotOxh8Nqf-3a=mAJP!(lx%ZWyQ4OuAX)&q%&c zZy-#(mY?}V>)}{6!dQHb)OUTRLyvSzOFca=pVntn1ZLKj>w){ov)I)u1_wc4KeQzJ zwOyW3HhBs*HSitLcs&3GI>G6~YUbU*R?mEWpvv$&%m$&XJ#$JSkL7z8DiVglcuSq&?uxGugBY@}%%hg~ZM_ z-BMNrVP$6FLuTy!jIJTX46n!22W+vMrOXCk99S6>eq`LwiIxozLL$Vc)|6*U&J$fSmyh8<7UAVQYAy(34rzZI z+fziMVOZhIgh^l|8m5J>n&*u`w!_rxK-%GDH<(*`rHc@b;^pCG&XwT(k}fB9qiq6! z^tduRl<;Bg{eWIVsUi7~Xasl8Bvj2zTHS-8;0Bvm9{@7A0Um+V&cX>}Pvc4bo&~-5 z8B7OOKHkJH)ys}d_k??dThs@pK{OQ33#vrckk@@NaE8f4{g#~^{wBh2ijB;}7BnIj zMxyIecHi-^v?ztJNxU)iA=L4Sz{A;N#EUUocFzP}_EG3Ji3*j<1P3c`_~meBUK%z7 zxdk`5h~vn$d(X4uy^J;3$@)hghSp}363Ca`5`Y^|kON{_RB|soXrh1HZ9P;tGgzpet(n?BV z;=^G$kjN%}o$Mw*K!QEk0+=ldMf@d-gFE5z!?M!Sm+u%f2cI2Ba2SZG!0w zQj3HT37f%B2#i30ay}*$$x&h2ij0;c9hzBfW97K%OcmmBo1c8a3duSYNmTn61HOqw zAb=|l>;r*<<+6*vy$}i?<2Uo~oUYh-Ewks9^D=Ehkc`FrRh?iQE(uiW79ETnWH&q- zaRj1dFunp%Q5jd-Guf2{*kG<{r8>tPKnaW6+}Pq5WQ7q29oZxZozcv#n zDRRXvLYOu_`VOsyj=+Ukpq^ZsF^^G|v0&#cB#loPNs?+WY`lC~u>c);n-2f4y;oYW ziw5U5NHj%7gju?4h@Y(|ah64^iDL*cTnZ4*UC!}=1m<}z-{DN^mIO2L(Q*!Yke`j) zybz-Zk#J5yAC-J@KDCh)k^u&cPE-`V{YhJwh2@JMWfwjlq3RI)`YX6L;uYg5WQ*|{ zD1->33bm^jDpV>zMX`t9E33NGXeffhlsL+Nx_wJp+HYj zmL9OBqC}v?sh~tp(~z!YOfOdH^Xxj9Ap~Z09e@!gKLkahofkkbtX)o%p*qNWx+5!+ zpJKaE0bEy`+#oB#@XDAWwMM`QlNQe}&l)cOaY0#WE5CV3fBB?YmNYA?)duMn0d}Y( z4$i-aJfn+v>bqbR2U&=d6`Fmb0l!Q$ocMrJ-V_;+oF#>3fVRE^$`SlAUIO0e`jN)h zqFV5eZBQSqfR}d+z{31D;C{5U#D-=j9)FJ_l^6=lO5H3;@QS-Vt^&o!V6r7s%R>4eGuUUc!HCRSUSB z%PW(H&F)zzvSQh850v$pfqxcuI0AQu91RO1<3h?!mJ8<}PJl_+sDRqZc}q~FXa*pI z4TXSls$_Exg$g$k6xE*M>zPeYrMWf5KOv!k1H>U5j^?BXC%5PYneM=5014*&-|-_i zUsz)vFg2@(L?}!wIcA$8lt|PQiNT+GZUBMRfPec#it?*)mz+b?W>}-rcR1*vhND^d zI`Kbfd=`>&;ZDa#3CMw_Hu^6GWi%+))kKM6`x59b?E#XLQjb9CMpz}kK*m~Sh>e6|ILa}Ws>LIulWJ!fj4a^)n@CPEDO~(pM0bDxGIu0FaL7Ryre1OK4XqELEWUX8oYq5B3exW;s@Rpd3@Q2a@H*ZR2!i z9vF{dfl+dgAU4p+BBbVizuq!0e0nx=6Brv*^^p^f%v>H$#61*OWwm39Hn#jmcZf`Bxu>)ca(6#$D`aOd2PqiDi6X=-Y#l*!{-=6Bdin7vWwc8@9VGy>>7z){InJcVr{Cmt zkeFcm(CunTcFGw`m$L$}eLTr{l=WK|G44G}j$u+v^7Ju2k`T^@f2oa*k zVg&%&g zVom1AQCUDZ#fv8`O$y(ek?q6Jih_GE!@hn^vmKEh2@fcw< zyheqW>0MAe-dUgvK|ys;7=IjQXMro2SCW0}8$|7p@W4#)%q@;=in$W{P}vcoc+yM| zT-Z9hR6xG}#9`qr6*pr`z(w6gYLVq9{1ziB=+L%%-$B}g1VG4CyY%W%-<=>|fUVp@ zwv!QY@;sYeKh1suy?M>2j1t9`<@qS59pqU%NAO-th!-{kwI-$j6bDM43$fJKtDKst zuy*2EeCr~|IGh9sjUO%negf}ur3r{xg;6RkqS;y~rivw0)U_xyNzg{Pv*B@Jj$=!TCQ@9B5i&mj z8x!x@RVYv9`Wf>D_My_^5W=SUflNe-j_72}NGLpr9%(DmZFk6Y5FFP4WnVenT>#7k zSX*>1Ego&6R%Iy|ZLQS^x@_DCL?N)ETP~ylS>+*tI-HQKPDo}>X%-slc8n`yu?J$x zq#`tTPu@$SFnkxBn#TPqT@Z{fv$D}T(-+N1tfQ@2A3VtaHPjNQ&G5GYCJN@eXE8KQ z_&Z%$Uiixk;z+Z>FTkY{BvK^F7edcba7aX=Kxbq3D`8ZGT%(Tho6P z-_F8<&Q)^qbBbTl-J-QL^lA&BN|S(+8qE`Sc3?YM5g2GJQx*EJC^u-Hn{$d%nCB3p z6zn}Q8UmUWQh<=>y7dj=s};${@{@Trjs$}bhP!l;uVj|M{xS%F)Gy~`h0Uper-=<3 zqhGHms#x6%_I0=-_WnByM)4W&34|Fdvp?Oh@CF2$51d$g`8mOn6ipCDabJr~L=xtf zXjlOPm&gi_vMb=ie;};*2~-P{rA#8bDVKRm>Bi?UNA6$zqRy(XKv~Gl;S=+2GeC7s zNL{scsSxolTw}z#%S($ugn)%@Ney#rTZ1hwB?u&-5eV0~)P?C$I+aeIsHx1Si9C@X z7`tVXkuc|HgX@0wKoDedEt3q7{&fyHbM6^8LT;~Ji`w(-Lrtbm0$vfe9o8e#<9&B!hBji z=`atr#Uqnf)lva<#$F_6ea4-?kc6ck71zY9d{d_wynu1em8l33hLO?wHr6{D3gM5Q zIVW$XXhsOyVKQ=EGFfm_Ai|J5$1UAQX}4xeV9TV3SJ*lf7*O*%23XOz1hOG6kX@gV zi%0Fw2~hYJaH#S1-B>1dPP^c&q{vG$pHmBzJ;PIwk^xuac6aN^sA?qmV^t z{4^kTMmp;*o8sP26&8sZKz4QjsaOgI;0O|5Ko|lRO~hLiy}KAiXzS2sc`ynjNian4 zZ4wB!uhQSK0da_kAcwOKKOlNZ+>9!MfnPzPU8o!;2*xK?UKIb1S|g1(B$vu^EwQNh zA|9?rmRCBD73`^GQ&3AuG~6QD{Po%P0n#WYqg-|qg6E7WzNcepS_L%>qQV^^U-}N> z34Ejl03MmmLs_Srj6z|P_8Kf~B+EStivk;tfDAX*{@S?-$fRiK;mU}c*AU)Cq_nZ@ zp_3rQcnz-KF`<2eVwf#D9{j$NKnU6yRfk782tSjIBuo~qvE7&13M2s57sj^ZlboE`v%c7Y7$rm6I3R0>$ZMw=HN`JWm#JAL+EM|&DM%JOJeOawB zx};A@D0wW*DV!fe{k>owqWVw-;XgSObb)+9%C}|Xsi6#i^30bCNUQiQHLf~VUdlY`0=hBSt|(RD-@=#YO0Z?y9tcz6DO zOjKtKGMkStDC^z|wa1SYZ;I9cLWINfC!0fWMWu>3=m5aRBEBxP)SrciAwTOP?*3P9DR66&^Fnlu@7H#?i$ ztKlinC-ed{o#DljA+Y@?GNKK)28WS_9lt!H+qE?qN123BAFsS_+%ee|HEzK+Dz~nd z`++|L-;=9B=sQ(fE=X#&>L-eXe)xg8a}T}^r$6GNcF@1LcEmBNy|c6|@<$)D=K|dA zWJCQaHk{i_DhU9fF(3u&*%^q22N7~WC#<^_rV;cM8~&MEGXn$NEIqJLh~G{f{eu zMrT^RRuTpNBZYfVxuQ9;5Yfr3KFiI#6nVK_E`4rFRMr&Id!h0-=DX zGN^bEB7{jZXJE35P|Bl%4$W>PRH;3H75sR>kt(urtGf7#|5Y-NST+in$G__6p)g=z zF6>Z+>gj-t<484jO@3ZHN7eFy?!d$#VG+YzJb)CM+7|^A&mpcHZ3GceiLcDn_3*39 zJT47hU@qN+fe-=W1#pIgv6f7Vu*LHQ^0=)hbNt!iWitIRYssj9FTKdd!U$t6V=RcS zIB75TrQ-r-`%`W$ETVUVqzfSc(2txYnkCQ1cQ-mL%m`HL5+k?i+4mXlA&jbmsH(Jl zmEwc3f0J0u14+1-#a3bNDn>y|T18OuWbelCtQt0DJG=d^#pH^kLCX^eQ=0~yA~++> zhDt`d0*B)Z!yJSlMu-g_5U{CX@81YcMlp@RIjZvV+7d(%LjOAh5C;`=(P*O@H4B`N zY-P4*uVTHf7x7m*18NoW#kdWpr9wRRjAhN9g`H7pIugbXoyL2l(X9v7Qq87+X8~4- z0CSPtLL%bit8)|s6$x9$a=I@nwWU=L@~kks0uJueo?y+~xH&>u)hg=1Ln|!)UF=^N zfPxlT!dLPZ&-i<|(iHy+b_hd9UF<{`C~zvZFlMUQLp%jIlR-lW2^kh{ z8KK|1nD~dN6fr2f2&O!lG05^i>1)9mt3GH#vm;VWIbC0fsTfv&T{mOX5Cm7uxi(c4 z!F9QmJFgBcUPA8_?_PkcWy=OgyPDCyV#C^q=|yf5=p%v&ug;RfYk@}mh23mh;9HL- zNbS+625yZRq!R6ttstYJa~s~|k0x?(DUqt{e}mC5;x_(9D1{N!lbZ>Z_O>}I1x0Ja zLk$2@$2bGrr8h)W#OXI|L!!D1Oqd9Nh8m;{blujHj==aF^ev`0P>!#*&d%D`bs6hfY>x) z81yd7zJ{kWK#i38c?btck z*d-4qSax6nmUk-K6O9n#7D5>j%OoOhA~pN!x3pg>Zv8rCUf{lmJJi#W>tr98*pLoT z)+s#EbironXOtR}+6EMQa0(tXNIpn*C)@#T`k4qE?@m2Tz%Wu>Kzu3Xqjd0} zMB9Tyj>yGq{M1W~_CN&Ey*qyZ9vKKUDbUhgQAoi#eQQ^{eaa);D-w*@TVcMJ?ej2Y z3?U?W!-^noAlEH|TmiihzvRI!^`6nqA;JdC5_^zie9hu5Ae!jd%bJiMYIsTr{9N|~ zT1M4k1lzRP5a{@edPL_2e+;os;h*rm1D%K|%7=(+48L^$I8ydV<~&GlA@VtUS{9KNP${T!7{MRxrYPT3Yz)oW!+RmD;|MxXHtV&^fB9=J06k+fqXsbgq zMUi=Vk40A(4w=$Vw>GWL&l+g4I9+2)_%hF7Ql-FY5t3H(R9LCpbIW5FTqhQ7`_f*? z8lWYl0^&(yFAA3hX(|8XF^^e*SV%yaX9wIn8VshTn^8#&MmsS{-cV7B6d_!Q3aHrc zw6QgjNiqd9mhPO<2u*IvoL*EoxR|>zS8&{*By3nm zo8wzjLpJB)){Is(CLZG5J;-q7ZroU8!r(Ssa)a`ODr8N&K=2c)*8q5h z==5eYYBEKGR5~|S?VmYZ&vlvA%vbRT38-3Y~sxKQ|+D^b6!5GA72#%{!o1RHB16XZS@S-9kjAW%&Dw?>mt4N6u;IvK= zRS6aZgD!{p3(di|toEI;jalqZUqZ%!f1y~b&9g)9ARsOG1(=~yRZSqJWj2fwH^O3A zy-$f&hs zv+jxqBFztQng5fos7cy?@)h9;|JheCmypfv@k$CTVMhT+C=^lcnW(bTpL-pkow=G} zRo@nB(#(s$PoF@k=%}U2g1M$&+00TuegMctLNIKXHYR}i@Wj`}0{^weH=sp*#=+{W z@wK6>3vqZt572-B7enEy`JWs6w$Ajd6)_9L(s*e=Mu9SVlfMM5*@bX=e=)bO7MHD?WEEQpMpOioh&qc18> zT2r;i65KK&!$_wS=^af7b*nEH`=?4v*#n#?B!4CtQGfOf)(;EP*?auV{}z~cfomwt zg`Eep+sBA8;V%SBCQr-R*F>8{JBhkd8k zz;ztyw+J;Q+_rh~`l|JsK7XMt44Dry`*`Yp!*+bA2Ve^*Yi`mVe;k>D#E1x#?r1_1 zf#~~_;`0`pBoYd@|GDCnmoHIYo4Qn)`j@QA&0)|HO%2~ya|>$FrZTuO7Gm5Oz%(I@ zMz{HAG*ON2Sw6)GXyUiO*r6T|XD2-AgO@%Wzf8xNs_C(Um*SA*#OG-hQ_E=$F)tS+ zHHN)TrC%NBm~dBvQUO5(TEQ{IG=b!jm{WP2LUDx|zG-d97^hc4+4RPA0_cP7Zn+IF zxpNB)p^fco$Yof8IGtpSTt$k6im;YBtud@+m>P>Dgo!7_Twbmz349$1d`8y}g$Y1A zsc|eF+Q51+Cr!P8JXOt94azz!0AObP|IhbO%BLI)1P^O@NF8>=AB2VLswA-J0O@5< zoE*^m64*#R%U4S(5g={|0s^|)dNzeYgFy<5NdsTQ$rX|v3}-9RJZO!A97pc3Z`dhG zbU0mO^BiPKs=OLrr$$A8#=VY&b=YCbF^7Lj!agvbta3MNt$OnOEsnq$3c*zq%EzkDwK zDG2LBXl9q(E+UJh*%kZ&0vBxu6cV5flL9&r&8$UbnZ@u8HKBj72qJCaOX?QXgf?s% zF4RX*lPW8egWxdkodEQKt1h6E*?syO#)at0x}^H|#1)`2>(VL~4=D%aQjkgLa>dEO z&CVFs7hhpKNorMibsyaW$s(JMs0U=d+!PGo`C-kr)M*cQigE+jz+4w`J;vW85yllE zxpShsg2NPxMq4WMK|5)5z#QwwLU;6r00|W$B5tm!o}(0&D})DeyFCbrh?gp8DTG`B zC%OQ_2$i`E=J>PoN05+*boL1QgJ!<4YqP6+xP|y$;EG7tM5U&xDzg(Qn4*8gR(Fe9 zGis=etUgL%H$|DHudS&iE7<;W>H;W7FaW87)TXf6b$dT41OmM$M%u z74$U6445qLzL%El2=iv}K3N8#w)G_y#;X#7w~r7fbOO`}j~{NkO3-jyAn@=a#PS5P zoPZbEz(C&m6cNV}X)G8$iK78V>f{RptB6)(r(zSYg}~fJqP-`I@Dh(nk7i{>E+{^R zpbth*D3Ab&hSa{v5iQvzz9EerQP$yw*i-5b*LU zu{^y2%u(M%-(g=#zuy@DPKGL&v*ub)Wu_(ln=xX<=8G>PcmevIf<%(cxu_0(k_$%? z=ogDO*QH2h@oseKzmKI-tpLoP0=Sm?kpDPt&r558<+9i(MsH8DVTcv|>i;+ub)a7_ zl8PLt9p?7p>UKsdfg!5ho+e=j$Dg_Wl|Ij)c=dzS(<`S~Xp{d&D3ON#)YLeM$cAU{ zu*z@WpJ69-ZDCT48?AoBc!JU{c_|TW z?(isf;6N_Yvf`6Hh%SQS`t}}O?tV6F?iJSy(O!SEu)ikv3;U5 zZ~t=f!F)_|UxY8<$M!r5z136IK)8aSYiAzM1aQ-Sc-iiNADg{INaJ9s(8RxMo5UO^ zHWIRdEuYQbFW)4EL8ZoL>NC3aF(v!OA2rQu!#k%0t%p%~9gbuooO)0ceFklI66qF~0+khRj$=>)W z5Mi*Hm7!@eN6@7-a%c`^n_<`a-6t>SCAerli_5HPi*IRfXBDAHCw;*c^y(-tUbEZM zgAYaz$J?6Qy*rP=B8fcj5}=`VB$#f!dZQKL=tK94fZB;NT5$XV?om3QMmazF9e?}z zJ3S%T%**$&PtkAHB?-3<>NCGsW_deb0AnK&cd2f(+@nbuqmYBe1x)hWDevFC-|l7` zVvbeb@3Cs_`ZT4(62S#{Y)XpNyr<069U5dSj(8||Qdj{Pl92jButM-{R9J{z(%zaR z_xsYc7x%IPEeC1BvxCKyOj?8KY2;$X#*5EPM{^}z;XKRL`-?BteW?yhrzzE&BOo!F z_!`xZr{N)C%d;=bVRo>5miOWa?oSWOe7bS!Ng%4%M>i)yKe!Se`rzZ6vL3yXbe#r+ zdi+Zoa=pSj@BO0~P;cXoq1N}|B!?gIxx#a6q!g8>S$a72=B)NFDc$&H^D`amgNd|F`I>WU|4Xf9d94uLQ_rwJHLCefLlAc3 zJ!T}0Go+;ozQyj=vq@__vO_$%uyO5RVZ|Q^ z(tv{wd7hEby6#1inos3ResZt-qKRtCo?i?7&=R)Yu;PhsjZ0cjB z7~|)LU;eB>{8HXsBA%PSsKq12bQ)^$5vI-I`-`3JfCT&q2*4qLYxSeu z|GV}=mJ}C`Z_|AK;sZ};E=8^dk)*ga6sbevaD>>J!`dJ+DV=Slg56T2C%c*koz4*G z$|q$WshjhNtHRvcgUc3``8&4NvjrEm4?TMQPK(H0d5bI6I|cf4)_W)Ba8W#{NQF(| zml&l$MWGTPD_jny0_DBIHwW7?8~|^4aIdQz%HKwRJlV=zv0`or3D9T;WuA?nOh$Fa zssiaM6AmI=horyn(ceZ?e7V|An@J~y?b zE8&~#FYSaTDmHM#yYrlYmV(u`EW0N*E2HOfw)$G&yoUUOb1`14XRMCB@b~C*lMvV@ zOI_=HE&);}b^b~n3FSN*zOas5 zqbH}!8=cF;f-jVquyA#M6lKLLJ}mg)Zz&9(?QOD-Ny%OC3F>oV@MB~tAPA0+*o(5k z$81PX{d0|8$Pth4_F$;9de6Hf@On*$wzMvO!tsakm8`G(Txs)08)m z(`K3@?k8<5c;oqRu1gENHkrLX&TqU()(*K9O4nRSMJOkIda&O@)%B~Qiu=En>tOVh z#VC}tBY~QNiT-*h$j?#)aA~Z7jvw7C(9+iAU~V@Bzm-aMih0=nUSR0z;-Dl9OUmzR zG?A~qs*DZJLGskbG65~<;!w^DMUJ$mn&6)^#wN$Ok8S%~BNTegOracKzRQ};GOSXR z++G8f2~4;6e0*9)cV(qD4=5&8D$p#(lXz-($VdhN!UbGz1XLBgL9WpI^8PDUCo&gQ2dOP)cL^q~;XxE~_L_~K1TLhD6` zKbgJKEKBUNP8TLRTvabVRtZHB{mYNNf#W@zKpOj(Z};OdY60T;?xv_T$MU&po$X@E zKPk!N{+%3ulJLrntqkw5tf+uWu)#I@TlwGhz44`g?M|4Zllk-XK>fN2m-h;utE1}R z2Js$>hQm{;QA?v{e#s{$er4H%Yp@E+g&C8n3|(z<+3cvsW$%vvqTn^UnM0eFT~wEER->&t zgRl5{`h5E5i`|mgZFSHid7a(0Fk#yWL2^WzYb(ew_3HeOPYvR{oSt>p1+O*ppc|h+ z1X||H0qDwHqw>?F3?=pEnNux~I_%%+bFH>B$>r5GZ{{-9u)*Tyg+16lbTX2Pz|KDL zW->8Z&EU_j|Ji@E4$c5u9v5c0fa}II?MUqd_58Hc_|=**%WeK6eE86EsqavUpYf@h z0LjdyAX(BoGrKs~0;$lTe+^c+e)IMkzded3N#B)0qiVtc1x7!Xk}Kea)4w_0pJ)7s zr=XG2&IQW4UuekCpr^aj?dj%g)lgYu9yRcNYiELzRvF;O7q#_+OF>YYfXO!j`i%3t zqq_|8-Lr)L`9>xMG*r+9y@J`1gqHlgAts3_`NXCC=lYC|Np{svrKRF#g{#@^p`$Z9 zI=gGKYpqVflVV*DH7RxMha%V-&GHDp2W6o)o-S{$Qis$@|6th>JgtHpS-72&qY}?y zOpn$BKTGTF#xhOA7TJh8xsQuy)sfl-^vVo@ z)7o9umQ3?nv~NQsc@TOJMRiR8U=X0zE^}n-?$H`8*PXbq_}AxHoM{I;W*T6+V3E?M zqmyS!UgB$9re9atQUDDT8>2~_3ap1Jy|JJ)IuzFgfP?+<2oyQn(qXEflrBvvM&2SP zV#KdjuiM9F0p01vOeg+0n0M#b!`&5%65_oBKF;Y}+m9x(y?dQp7fCEvNV{rZ84RWA zyK&}V1urR`4>aYKu~1AFm8L)`C-g#;cfsS$Ashm19pbLEiuxW0rECO4epC#R@x2H5 z1JB{GGlA+?bL6pV3sXEwym8epX(P4Bz0akX%D1-paMM?l{fKeo!~o}@dc3y$?y@D~ z?98b$d9)xVRr_iq&VGLV&C>3>h@4o0jUTTcl&~h!O~*99e*8cU$87xE>{qXrh>suM zyrWU5oXc;2MqMOhuz7d0k!mOKX=;9q32TU*Sv?Ed2N_hZ7d@C8y{sO%(rnsuRP4M| zAvdKNh1RQK@|a{uR)ud#-p5lK*K#khB{$X!^XrQZ)98cd7ky02>L z%{xFxr`V#-DN?rb>Eg~6zfSeo)z#&->0;e{^v2lLr^J`4AzfLl!lo$rLwf?t^|-O4 zXRqRmp+l&t*n6jz^onud#YT0TzL-eDy9In|Ua@n`qwr&0bHm?@_-opWsw3stHv1Z` zT!EvW$3Fn?oCtgWemQu*+K;D&kn6qEPjP&L+T5;L3{;82>*A$Rdh$gUP+jXKb$@nu z-#kwq!%;{wCV$DBxE4bwY5DYKc`5U@b?`?nPiX^^cka9#Z_Gv;>uqkpM`)%XQ3v%I z|0BS5IDl6mB%i7HW7L-)Vv!qyNN-v*KMi=Bf9!F_WW3 zIwqHsI^;V4iKIkO%sot?5Y_rrh~oD?H%y?|*G z&*-M~Xe_}35*QmJe9!bgumteGP;T9^H;6-{*X*|&FvEH#8_VsWdWqfja##732n()6 zt4I3ltk}i8cXNzech^PvTIjhFeEi(W{!4#hi1_vEJH|NL+mpYptG5%tt6K6zzp?|B z!#o7kzg6()f|gD%1Y?cjq&Mrf`iu@}Bho3X2rJ+#_4d<1zm+7d3meD+LOD3tF}K5f zY|Dv?_2yl1pa`El+U}OG;i!eWQ5)I^Eoi7ljSR)PYyUJ@7&c!gb0&Lxx^-|cz;}8> z#{9VOtb~)TJX8l46nbv zH@!;l&$2hAtw;Oo`(>P2fk_J;xHEFWdf_7H{05an6eB6kN}E`RN0s2j#Xc+d3ypnm zn&@ADIcaq`+&C{I9KsK8RkpCm_?x>YzW$lX4N#FhZ(36{o@ znC`L%D)7s_U{+sTy?Tdk>+W;>QXciGL{xRl4NIe$)iyPc(_c|VE~B%tJCmtAjc&lh z=D$8Uy}7$sb`lNtNtdo|0uz%~;O&C=_fVV!+re$ z!-~T*KfQW~265~WPvCUcslZ15+53(nQRjE_>DM1Ag`s%N{4?>V` zd5KabvM|D|w_e93!pu**2TKED$L4J*loK(Phb!+Dj7j?F2WFs)iD|Tb%Tvh}4X-Cx z(H;kD{u`fw@uDR<_@Rfe`p1KN-n;KA&{;?QNhw+6l=c3!!458eyfZF|jC#V;I%RbA zsr0KngaC_R!WgmVi>lV-?g;9*jC*yl3elvu&(}x~0w6c#hrUWi!moKUk6f6Agi<7M@DAaMBcDe8dOQ|frZNeu?zl&#;b$yy5(#%uHSw3$3^wm+_Y#e6Cb$fK zsQ}D{+UV`U{k3Pno3mph&%IZD4!XNI`ji&QtvcvF zR-@?5OdOebDgy_oIxfYem~A9qHrIVAkn7OhXd&OwuPMNlgP&lZS+zzVvkN->~xd9 z2^t(H27FS$^f*UhA%_<{NT=LW73NRGUVDUFhogBvgp>zCO5Dh z>}>{BzF#k0KJ6rsiRK~a2joaoM zp;Nz{pTI(13buUL%`lm$feqb) zunU_;Ew9oKjfd z4bzIR&76n`UaQ{1t3;AXV%@8N4GLkQ%5(P|R8#_HZEp$S_Xit2`Kx;cdduQD{%$S;_7iL_!VS*7|s_R|qv)8OxX@A=;`3e6Z28@p{-3xXP3L&DUVa zgQru4wy&!=^3Q})MfBUZ=zgtdhNxdEyOEbxA$eNJPKgd0$2dz=-dk~wf9lb|6rZvI zV91h}No}5yFZR^T+S@sm z6u4!&?^Vuncli9IL>=jc+B%uv@_xew#QvguIX{JO*1mcx`|gmm$h+gzJzeq1NJ8U9 z4<4P)2?k!=g&?EbvWrQTlvp(n3C)kmsILNuX36HK>fcOUkbNlE?JdO5vbA{51<&SX zQ3LUfq1G2(SheOk!U ztg~0tC0w0e>+1|nN3IjEynP`#Te{_c@Ph|IfXI~pUxX!LBl*^XOOpDuy=-w;D#qaP z5s3tfcb*Kqm9`#S*qDeG6#NV^4C0BN`JV#r~;)BS^|quBv) zg5BR6?`}Vvl1=kyPv#Ua3Q99!_d(6dt$agtdemdhm zpEnWnD!sv!sE4jVRV2qODyt4a69W-^M&0i8w(M5{JJ;mNuHkjfeW*Ssd@Zzlh;tJ9 zalB}?qE!$8{Ge9;chQpY5VJrUNa|>Jv^L&-?ja~F;1=ieQtZiyfrl-2CQX%CfA9E$ zY<}oMGH)BjTJBSx#U+f(qklE$BAdgfDWX~4Go@1Hq9vIgSJt2Puz;r+q7-JAHoVV| zHF*4RyVYZj-*Lw#i4EDf{hd1jNDd6$zec5AJX zaSFC}d!ZsJt+BSn=@gBc^#tr&AnlWaWA(>g=;3J{Hkgc=e<^ycHYSel&^|oCOT{b= z6LWCec9k4ga`DPbiQ!l=KHI9_Sb_!c@eQ zlKXY(Z|gXeljiQiaBkC{y1L67bc|lB^5L%htv>j$!-6iJtU^%K!#1p4~&zpsxeY6whs^k{0ah29XT zqKSlS@a@&I-c$xp-1|T4rMhEV3@usKMnJ`y#s<)t?UGwnFo-18#Z7#qpam`TBLRg5+B1VhN)ooWuoM6J zV#;&(LCqQ@TLw9QI>8y(-k9u;_)z=Mz=M%Q`E<9eDkc6)b01<_+iwhxTs6T0M^Aw! zGuamfk-`@T2Wd!lFrE63ViMvn@iRC+k{yS}Z+H(c`hgTV%_WE)6$mIu58=*%5Oq~5 zp`+A1=OpX}uG_Y7Ykg}Xn=gYtPV1BP7Q-Yal8w7M#`i1Lt_8e|Vc$5GiRpJ2`ppNJ zeex&@5Z5yXCFXt*BXDdY#~;*d7m_yV8;XEUNCrX-V*5|$CeIAcYI*^JM;K^o!W~$e zfnv+52*pvX6bvTa@zf4kv+-apve2T5sEY(;^$r+Nbj+M2c|#h zEx2-?Ep_=>QUr~2i?qos99M}OOM7!U8cPB8mm^|U) zUX*=VgYHA6QE=af#vc^@{DF;iDrGH7V;uVf;{ja zZw01>x7~x8&J<-?W1nKC_Ejwz(i*MS`Lra;oes;npNCqK`(B5yS@^@P{Q&nTRh!tzC%%`h7J1Y}tQK*`c`boLqS|6Kkd8-Egm2CXBNB#sd**VGcx6O75^|M-P&R zX^>@F)3%eZ?H4;?Mfbm)XRPIl=hCV}G@6`B% z?M1zr&piM10hly+M=>u&o&NQgnw{|z0yg4bfpGHO!uejNO)g(=-cv#pKie{)QgWNfc{JA|K>V%8ip?-(Z6tG(?_Lk^m41H0+E+FL?j${6m4 zlj*E{18}bi!18^Up#(DlSw_3#0$T;n0vC;{_*i!4|FXF+Q|dVP-1Vqwe5elw=t-bom+A2 zynEXB%;tv|^PqgnDuhXzgX*aX+!6y+ktXeV={n}U+mt+l`r5dbmH~=}7?!h~D4;Br z4i31QJFICF;|e*7yM5p!CYY-P*Wd0ZTiM2TugqFSAiT;+=38>$4qoq?h8_0zi`itf z_hM~(Yxb0PQ0^hHyw4Rnfn2xlT?DZzNZ&{aorC~_L+5GGLp4oIo%yU%8siC!P(IK; z_Sc;->)1Fpc)J{RFZNyi85XbD?T5cwC@4R0RSyu<|3@C+*Hm-;*jFhqKH3jm)mVZg z_0Eo@+Kca4fYF$kswfHaBSFCUS;~`Smn$G$_a_cxU_vNV;<-V;=5N#(xDHUZiFA@> z>x!A%*cFw@5_3{P;qfQp2!D8kof{VH-$v8VH;}|u;|&hOZ;mn3c3477GCXvR|sO-mD~4W&S)G|XP??QLV(HfNEL@zB=yLPQDPP5#@&O&Ahqm(99!PCGZP zjmz??&f>0OW){9WY)Qkkzi|%t$KWtY{3nyy0gmDJsDVB7QSvgKQ6ylG$HI;t!A+|F@z%;)BY+(`zCL+UY!RP`AZ(pczQ)jTk6YlN75{-b;dJ=w?)0UNJx-A+ z^R*gvJHz1xjSa7<4)qL*(P1?5l>~V5grPYU)Lg`Ch*98GZ9OT};}R4K#-DEK5$n@b zma7zAdph$UaZY?U1PfsFNgj9Y;+Pfadc@~?NQzt??%W*il|MW#UHIn)H*leP|Gorr zz<;Vj!z)cw3!j|@kZx$$PR*uz2p(-ocqgLm*$lVOCu$*#a2kTG0B~LL^uegDzpKxm zk)mr`;~hZ%Yk-{`R*N;X;VsWjaHcvl{`JLqJySfVd(_EkGt+Ev+NF~oloQ&dJ{V)g zg2J`k77JSWG6`C55cmSR1y&z^Ar8aZ_6zF5bmUj#{YkGdI3dCc^%_NC_YL#ER=^A{ z`;jQV181KYolF_6h15RXFQIptutqM6f_Cg9CX2QK%B?lFczC7F^$$4{H$F>_Q#?&LR#6Yr32ng7y|}K zIr~-!4xapDIg^@fmhNtE--=mSko=ezC@vISaU1Qb#6hEUH9pm#!uRU-0qhK_K_`Paat%bb&)tfZWM@c~4H&1DKE= zxu^10#WA+tDLd~)IIRqw)y(tE;enwii80iK5n^u~Tem#>RDBWC=w$*1v;kH>DVnI7 zxF>$&ptXX?3hN}usaXYUeJNEs>n~;p@YDU-s7X3t>^c-j;Mv1CU5$C}d@jYNG}E8c z>CXSDcS0qEzI;@gN-sAo@!@`jw)kY~HmgdMo77aA^{&ZAYH}LCWTxZD+10x{N7lyE z`1js72|ZNd4~a`bY?Fo`04cSlOBK@CGWA49|9JC{P&mm8^H}1OQVKvas!)c3-5#WE zo|9du@24Cg*doGVm(8+UUnMqj9}8!nd` zI*2}=%T+XivhJFY#CHIM>yAxQcpkNYr134(sBsZ0wqCDYD=#nFMRv(ha33TOMDN7r*Vh za33XJ(SW%W>_PkBokZ$$lL&K697)(koHAK9UYD2I+S|M~83Yp18cZu=mTwi9g!2xa z;{IlW^UnI#wC%&8lNEVxTE%w5JaEIs#5<+{JTL8;bVV08bQ2l2bTmk2tFKjga1WRr zwEaU`yOypTDt;)`5A$^MFGRDB5YYYnDx&r)QH%I2{)z(GyiN^(|Ixtp4CVBsRZ?XG zQdp$i4;+;962WtbLzB_niDSW!dhJzII#klD{tTh z%+HqEF*SOr?-V%nO;B*tFmc1K+n z>0kX&+Q91;ilGgQj;vykdoCKAsq~8G%8Z#r+~V}^6=9j|Se9-A)oBUA%Z7OKo*67{1fmVxs*Pbj)f;T@^E&MzNhiyB|DrfBq59 z#ZH%!AaWWG`14Ff;3^$9abj8NqUzqC0VQ^A>%Nv=nt?A*GEz}q-V#R5fS zCpjE$aqAtr{q*8`vJq2$1TW%4By09=d0vlG($>2r+0~n*ymWKeBpb#T@G$QuL6~#F zQ)t=DO{^=Cgu%MJl$3}fC}NWx?BJH#Wa%CbD@4LDhP~H@hTat|y9pw+VB}A>C6f@_ zJ>d-#wGe(f$!@(a&9W%KV|x9w&1`sis}b0}$5;T(bAVs1Q1H+$ki8|L>M`VQo{9FG z9P27Wp?xH1TmkMr{HfJ;t8Wmt1hNcJ>bXD-pq3`h;9XkC4@nk5Sv);{wtSO1(e6Dd zbI#ia9ko1(p6foq%_a3ZPo0AGyW%WOQN_IrqTRkzi6hEZ$@VB&2ids38?^9FX?Ono z%y{Z-o zFbn7Ibi~U`9v7!g61Ej;6T?P}hJDekxLaCVR`P-ay&S$DM!XWFGj88`qk+2BT4ccK6DOl$uBhP;cHqKm+mDW2{{kf9<#;-D-4S zO%lD^#MTPgGhZ3q-wO^YOGBzr32-{@HX}qqyiMSAf|!;?L^{1X$

    {(ojRg!x~C!D5K#44G(H4 zt12z0p}dB%10u28;R+f;Q$+tMf~#>VYPeq!aI15Q(PWCKq@l8gDjKS4cu13{H;#NM z%nx&)OcC5kxEdK23pX7U`T0(`x`stlWT^vFL`@BkXm~#^O{_zS7?70^9~B;fT6R7 zE*j1c3F#U>$QQOBkbnDX8c4vqth)U)VQH{6BsHWoI2v5)RzqBar}5Ob@Q`W3r&?Z% z_M9fa1_o^Sf{dS(*a;0+rip0J@WyF^BfYeSt{Ps_@UkY~O-rY^U3 zlq!9Nx@{wRXy~b-yTVtTE?P~@*GmJ(6}>eKo-SHU7v6O7`-mvvSE*YKzi9YXLqFP^ zhEW*I8hDAnd zT-El!r#4qSeyU-##t-foui-NdV>EoJ;VTWFYx0oXe>+CLpjB%ar-4Hz7T^7NAp$K` z?O$v1bk6+zE9!Rm8x31`=h(fa#=g_=y@nq(OwjNHZ8#d~MtZfNrTgBTpV+#r@W8WK z%zxIf_uUB7CtaeyY4}~kJPq?T{Gs7b4b!M$I*5k9G)&PjRm0yJCaH$(ogx0A4OpSc zB$y$_%@E&ph!SA!bRPyE0yhgrW+>uW8fI%a$bZ8%%)G0Ii!+4ySAOfCqcB`%JXZmW z>qHl5Sg2u{hUFAq!(t6fsev+)djE>pzha4o_x{Rm^=H2K{}mkY@OvEVT0!3&8d|Mk zrDC#*(clBQP?`A}4H-{jEqm>iFu!ar{#X2`VS|PWIx6bes9_T=Q^Qpan>B3Fa7@E- zDpSKY4ZAh$(Xd^^4m#J+&^L9ZaaMa(DtV`dT`CdIm?`$EdJnLf8un?pStPulHD*MZ z<`#<{Vlez5a#+I=^1qn1rBh^g*U(WKo-67c&f*NDvpC~~hLal3YB+cs^qML7ndTBL+>ExEDVWnxIj?d}!*vb$brjHXgM2jP z(E%M_4-MU7U>_d}>G*P{xUKlyQ8}HFzd=nqpLLIpdv)Z~k*y=Ijtm|3XNic8OkFA= ztRqXu?3uF1x6Tx2W{Qki(g(T6I5AB2Eb-bbF>aP9sH2dMqB@GHf`xVD=!oi=F-w;1 z^O=146}pVWMRYke%EZU(eL9NkD5aycjuNV1Nu9&sFstCX^XF!X%Ckiog)gVWoh|sk zSXo{EHAahCyEdb|j%#Z(2;8sZ0UgijXsP2t9hG!EuHy+Em32I%<6#{&byU$&RY!Fl ze-8^))4}caxH6gEAsWk%wl!2OE7YvQBRXp7cvMGi9iwLp{*Fz`B^R?EQ#Aa`d+uy; zXr9zS9UXObG}O^Zmoe~39rdU{9l1s3<&8e2gBwp>n=KlsvRq-vQjJNh<7pkw=xC~g z%$wBXec5H9rw+Z zm2&AtN-=q2u6RMmi#odN=%J$4W<@pdk|G$S=wDIr7zOuKaBm%aMO`~r^wPnc zJem6FI5Sr){VC@)9sP7nH!#CMe;u#0_YG7sxX%>^>R7MiKU#~9K{~$E@x6{Wbqv<= ziH=Woyrtu99UtlVSjRg$-qrD*j`!IpwQ=PU5#g6OS{JM1`^X16Slx$omU*J$JTXMa zP#q(6jM6bo$8a4#fQd1B5yFKH>W z&@q-wMufPx6^S{roirx;-#jr+$AEev2H3CY!aBayF{!&@n;BPjoaLf9d#H$1gg5)A2jodsT+ekM@RtrJG!g=9@1q zq4j*xW4`!<6@?>zs{B%s=-)af>6oHps*YPrWbgk&P2S9!ta{|^{{Q*@#Q8$YjBxNU zg9cCI)UiazOdYdy%+)bZ5%0{DL#)|4R?HW37-u*vF{3=yZoZC%RGRu$yFgJ^yFbjT z7wMc9kg;N^j%9RG9jkOKX8;dJ_~ymvu|mhm6gSL_o|rFI>sX`X{^8O33&dK&ccNt$ zh;<4GFA&^zfR`IsR>w^?M8_r_o5^3tQ5{=!Y}L768TRYgrenK~ojP{u$iFY^h3nxR zI>OnqX*_WGY_UkE1!A|3J=D)lIj8Z;0k>mvKk?#1aaqR|9px8_`U^$XRXNqyMLE9ZN6G7o+YKE~$p~M^ zhA$Mib==V*3=}aCGLXkW#6Ug+FmR87uz@TCW;FW8LUFHwyaqB1WEyy?a3uRe&gzBI zGS8^|eABS?dYEgl2@siWprC<52J#yyV1S<;_p2Yc3NI25FA{|fxl7D|hr&4qq6X?L zl6*RT9PP456g5!HKq&*I4cup-xPcM|N*cI-WO&EW@POOlQujoKbGVnSB zf`KXqsv2l-a9cT4Gf>??Jp=U()G+X{fyWIzVW6ggM-0?9@R%XPZ@DfJzOvOa@F>H} zV!`9*PQ4LMmdRwO@7YBT59%0l=9BA2>MDBveoLQv(!lqNWqY48(7?cR23i_uXrPgS zW)#&xV*^bLG&Qi|R2CO7^FP6}H>FCs4I>*x;AsODhee)cM|6)oW5{24h-_hi2M;Y? zEZ01=GSJ#U8v~1~fJ1^EC8Wz7TP)fdXlLNpc{#KSzMpb#xr2d@23|1mqJd5ZIvel} z1O~dW%M9oS3!eG%%4 zB2O2H3^eeDf$!KI1_l{;)4&J=BMl5T@Ros(418?hZ5rXS(0i&yZ1p<^-ZfCZ5_q0V zban=}dVb%)2L?Vgz+be+E)@kjMfr(ph=HL7hN)7lh%MSSC+Fv0k>LiYb6&O_7aC>Y z69Z!nj5F}5fzgWia|53#fT!?qzo0ROJXn){npFAaQaV7!5^3=};rmpOfH z;NE3Y1K*I_hv72I1S{QAG|UB}d`{I}CVnvRqk&1Zs|6Vo4E$u^cLRT@ihfr4F9td& z4!^2P7XM8F%?d^TWOp0*%fR0X!(|fON{9zJy}3*O)WeT2aV4i{bhWr+}<0^+?iwrC_u!O9Xw1=08yvxOMdWwM^26h@)Npqz~7}#iFwShGT)*4vH2sSj# zl>q!&N`T{#^|Zax@(cKX2B>PzFmsLKCdR-D;VlNX8rZDh%F6}Ez}sjHi{*p9-Ey&= zRxvHgy=9p1Vp#)64IDGDho;CFVucRVMA@9-kpqgue#TEd(r3B&d$~Ah;1J_jQhb>= z$}c?*-EKT}qTbwg#<)4PWQMRs7FJdTQ{k}#1p(ZfVfQ%*jl)ZMMC#783|X_MbXK;Q+H zzo>Fvb~Evkf?rnoD|hkT6~LF2UWy6r?F4@?f>> z)+)g-p~cpSZ%vFh@w-m52l%zPG4q6(-CfGtz9F^sJ(h_=Y-EF)8fLX*(T;tQ4T(FFxSL96E$o+ zY-7HO1++8^zJ-M*7BS#h2wPZeVu{IJc5&F`rn^{XVv~u@CYGC6VPdt3HA;Y$Dq5~$ z?Roy^vq#p5wITdra&#alphuQ?Az7XTlvB8Msz(6trIv z6F7A>N=5NNZE`qb;;4x$jF60?v5_@dWVlu?vgLo=Y}z#w*G<5}Jr-`5xM|`R z1HLIgKyb2xWQ;{je1qf1qdO)-7V=nlHHc=d6BXA<<=ksY;=C3zEG!=_?Y7}M8Ca}! zatx4VA!4D1g@-NVvyg3}l!ek3@>?ii;XVt+Efgd$B2?Hyjs?yR6|%rzHIFWhMlA>n zMJ&14;Na1$sv|?^MuyBXk)jrgS>OQ>Jb$O}Ix%CNU~%>W7tEKi@YiWcs-P{EQz{IwDi*3Lf_vACY6_@s$#4DDHf8dWRMWyE78+YEVQ=J+``iqp0V((BIDaum-S-cdeOqdb8O3c*;9ir=J24)!UvSW!oL<~T8Oi_h2a)PSV&r&F~+OxL@L%oR|_v& zc*VjC7GAW_&B9A8#Yt(k2)XOEtVjP7Gxlb!7#QyVpXhF(hlO4idRrLzpXh1H#Q=-` z6NQduUEUn&V`1liV)KRw=fwJ2X!Cl6$b1__KMVaWylG*uh1V_cbeK0RaQpoM3@JZH zf9@U`XrU&LcmG{ZfDEDuZIGIL%fj0hKCtkig?B8xOR+Zye%X1?!W8b#u|d4Al$;Bb zp7S#wk@9HPPzxVh7-GpOk*YUj;M5TKLYw_qkoaQH-aR zF38}Ic-%6G;{Cwh$uAh1GA?EPNOLM6+xWAEUo8A>VG{k(!fzISx9|r8#aD8*Ka2O< zDE?%}Z4?vlS`?k}zpU_ImfRkMz&{oyTbOQPhQ*a~5qi)ROAb4yTA0Ry??le_knf&b zHp=R{L?ih($@$V*7G_)AfgD#Y%&{=n!a)m%EX=bo-@+OTYb`8b@VBs(4X15H!;9E2 zAA}cM=(sf0dTFTECb5J*xJj~IuI!mMv&zB>3oDhVtv89T>h5ZFIY7bdEUdS%%ffE< zjw-c*k?Ml%_kC+~HqtgmhBhhs&GhKfku54Gu+_pg1#iEL*+FAdFg=0JiG7EUomA}2b_L|}B^$Qhd7Cb4ysI8Pc2mn>YiaC4I=cOXk_78h0RuQ!ncjMkf_ za(H~?HMWc4(ME9_H%M$DuZ;{Fx7bq*^)_HjkK>#Y*Ad;Z5VFxrm1Ta9jeBkRd~ez^ zAKydAZWi2ywex|TOdDYvSvDdz>f9UcoFgAJvo?!-ww%2$U?aLkWZTGZ%OJdVv*0P% z*Eh>Q9}C(jWJ}#L6}FM1;OJe9P(Trt7gc#Nl~c(jY?QQ7(Z>BYO4%rFqnwTMtbIuM z_qiEmY`ObZSsUC<_wg-)InAtsjV@cn)OPad6Hb{vVB)ogk8ZY3ocKWIK=DKokzL)EukGzSL~Gi3#KtZgyKU66@u-d0Z49tcn?l-X zZ{v9zkK1^{#xpjarEE6p+Gt>-p^YbP)Kir{Wy_DtT&TmCQ=ctTTPm^Y3R^`ZHf>|5 ziH)W<8rx{ORq&D5qh6?)4L%&7R>hmM;kEJBW;x3`d}9XRbXwSW&PFR6t!??9NIdhF zs!th|+E7llEn8a~@mHd+Y!&Tn4BaY!1mGq}9c*;8k+hMr(aA<<8sF!9%yMkFHUiSy@N95)luteWOh++%8>5d%IeEEq ztF*?rVw z3Op>t)9biB@3`%P^CUdp=p!nYp0z`KY-5NmKTNOKE{<=PGIKh8m<{HHN7@)=;}a!h zxg8S2^w8ZyS?sOrh#_%3hvC%uex-;!ydD z45U+STz)Ie6@Y}NQ3to@@<~lfH|sQhh5_FU1F|++t&bL zmR&$~sb9tx*;uG<^;YH=imT6mkP0Q#l|5Uhix3U zal*zCTW$<>l*JhjPiFC?MeeoIyL5!}+eLPZlaz!3&BhtVtKH(qKAD`D+CD0BmUcKe zazTl4&c=DV$!@XrXwJ3#QU2CY%WK`A=e> zPLYax#EZUsEo!t!6m?L{K?w&X9l7X~5$rxiS=^DEwX*8B%128nOlb#eUy1BnAmu6J zpsa)R9x;Thx{JJILA@PLB{9aN$i6~dGEh&qKb*XqE9|{u zNK`JT=OgtAM}F$9!5{$ zCJvf9Xy%}~BUgw~?6G^r^u6L~2iy0G#-Bt>tL322IJmr5ZcXr1fk^V%U*rsePi!eR8(*g?-|`vH99Nc;12Gz;w{TK}QFg1KmL<2Q+eucXprX?4XN- zxA%!3_lb@Bq%AdnHNt&U`C~F+%Yp5{ap1D+_ls3|BaiME{0!ka@Esg35s5nplo&Aw zoZIKB=9=F`yY3ew_lx3tqy|##EC;XCoE&s@@PdP$4thCw(Lpx{-5vCBaHDwSB?m7n zGsu0{W5HJ(OxrKz*|A^nZ-R2gBQz2wu1oLjppS#|`$b;|uQ}*PojWLfKoWE7%bE&^ zKZ5?W%usanikyKC-f-}NgAW}Ha_}bG>);&<&^q5>CA@w>@VJDx6#UEq@vZ{65zvwY z;ynlNJNP~s?Rh|acR+Akn2#KM>|mIK;SPpSEkh&Io(v789>NhW*W7SGU?c#F>V;!7uaMHmz2VXc?;9#MH zFCBd4;136XI{4bbHx7Ps@Uw$&9gL?`4t{X(orBXSWI+C>oSd79KR(Q%)g2PE9Ly&EpxpW7 z@Ig`Zkl>~Yb1Q+*DUOrp(;fN=u1V(37>gV%cCgjKHU~=_EOoGkzVBd}gXIoZI9TbR z?;-K^A(8vZc$M-y#*@tZB4oRo1cziT>lhRGYZxtx5$Uja;jq}C^uQ)>qVYTEe^`8U zSTNu0U<(y{Sa3Ng6X%(?JJ`V}NAq^D)4?vf%&^d2Rs4FX=xznJ+6F<%X!OVszf2W& zkwb%@EcYRq)*_Sp;jAbv?X!RH$dZpD#mLr`1J_b6io0^-;*u_S20i!UD4}E^FsB)) zOuk2yR+us>?{!3!cTs_5UDS3_(Z&5Ps=KJ+;sF;Ax~S@+nrc)f7Z16ZbvcV`k1G>% zU4CGyqL_TAw$z|tl=Cz7CHG;4e}u(Dp_&R_(>c<-s#H`hSAId@dQ>!FTaJp3N9E=@oZ+YQvPYhA@hszmi?J?RxOmRRt1e!1(b7dL7hPSv;G(sQ zHZDvTmW#G7+PUcDqO*&SD@WV2`)F4OvYvP4%Lr31R^ejAQQ3);kIIP!p8Vd$h2}zc zu|?qx1#l)m-!W11n6TM!7Xh{5%1P05>8R_<2@ucaq193|T=vGiL!D?`85qA-r(7gl zB-ue~dp$;P0-cVDw4&!2=0z9XT=aI)$Hhx7UUt#lMGtD=c9_GtR}@+9sJo|&+dU&Z zeTE~1N;Sj1TyX6Q0oKSM-&avGlJqzx`nl*&2`QV4*C{~J@Ea}$xftMLpd#y#9U*c^ zKdJLK6=txDp~vLh=39!MA82?8*Sjv>bMc9bPhGsvZgnxt#c@#kqaY7x$@WYk&2!GW!`m6jArn6F@`!fBz{6xEQ@vV#TE`D(Fql>j_6)4Mo=c3qg z@jXpR$ZcO}~&G?J|7pX{%_ zIlmqkj3?aRgWtiq^BehaS;aqWpo^LGBNtO#Om#8C#lJ47%xPpYS5Avfcd_!gtcW?^ z#isX{Ln8_>+r=Cg^Ia@Z_H*&L+*fC=i+Qg6fvC(0QRjqMNHadc&mTEd+GMr7Z3&}+ zi)}8pyIAI8IX#Gtr9NHo7uVGcJI`XJi&d`NI)Dp_Up*nlo)BD9#2VMRSnpz!i_NOW z1=}Vhfzq-??tmq%{lpo>E;cDdN? zV!w+6N>_Va^c@h{OZPu1I-kwiN2fa}n7Wgn0W5nVHZbS9Ch)AI>D;ssOSeL zir7iSp>J(Tcp&c%5b`8;HMxZvWVi#skt z9xl1KOeMIuLBURnH5rjBF0Qg&r^GcE-1YSFQ-Y5bo&|r?#Vy8jb%-H99E=|ky3M-& zi?lx_nCI~T4|zRgcxcm1{+Pg-%zHc>;ZhBiQxBOQ!XApM-T1RSE{PWr58X~l74erA z#wf!1JrwXDJQVTdyacDX3wkKzp|FP>53fBaZF|fq5%s`jfxpfT5&rPEXi-n@C~}{N z@_$P&D8{zG5S@8SZ2vfW!k|b=52ZZR_VAd8(jLlqc)-Jh9?E(s=b@s9`#l^uCI2Oq zl6c5-T2$~*>$DV%Dd(Q(>`;VvD|x8wp_+&49v<@KbF=ShG48ae;-RW1W0!wgeg&(t zHm8Os$M7{hJmTSDwsD5w`K`<+j0`m>8L8#rQ3`xoY&$J(oE9a{h{vf74^Me$;GvF( zx*neNP*3rE`i$VG1kR8!Q3ei>>U;P^9l+GklSkV(^6-oi>UKuT&*0qHLlX~8*%2+G z-<%N(&Ilg*@HA;W^zqP_MLe|dV0y4TJm;aMhxQ(x_t45iYgJ<#%4W+6SU%qwJ5TNc)U!pjgNKeDG*5n=Az3F+o^;>Ylb^KCpAnp!>cTEND*>IIcr(lJz*P3E z)Tiyi@sRd-iX2=I9&7Xv_ptj)j_+a98TszEaYQ6g-2S^At$S7^JS06iB<^rlymVHK zI4e>fn3LNJ9$xhDvWHj5r(h<_c4I}w!Y_H?P`T%`Q7*9Ln|OECgq|LHc$j-uesSJ^ zR`l}Fn-+UcE^4ZHPI7yd2Ik>C5AS>E=b^ucK_1@p@VY10_YU;%2FCTb&pDjfE?ee)8}$ZNS5?iUVgJdY>0N8yEP^!|xsr zo|n(Qzs`$4sDYs&hOd>1+h5e4hv^<>cyd@c$-_S$CR5-xVJ;uSdt%SV$P^D#J-Hex zySB`yF)odhW4wQ9iXP^$*XVS&vSzVcFUVEIv+1N4q^Qg}K}WT$6p?vKs*;~4gTp1y za~{sqHGGuwalyky5BYp#`?%!cGDEkIdwg8+a8(t&$&S7g_69__f9W+3*FD_uz!f$0 z8nWUpowq#P_Hc*YbWwzSZ;kFbyUxX`ng1mAIZH^T?l z!Df>F6S)+Ym@FSxM?@k%(w77W4EcQ&@F9E@@xjwi3i>GIqp&acd8TXR_%h7$#|=K& z2VN3UAIypIO%(M}%*TB`>Zl2y;yz0FSb0g5_Q4&bOZq6~%g8{OlKiMj4L_Ju#s^oB zl0$hP6@1k4@u-iAKJNEX%|~?~53sn8%03?QQAyQK;xZ3KIkR2*5xJ@U$xGsqvH7a_ z;9GxHpMNAtd6;VWsOjU$+IZN9_dr&u%c99;u|0p}5g(j@eX0v;`*_U96BJmn&E0(9 zaUa)Tl4_~TvOXI4Xz0tYLiK!}DJJUs(u4R|e9D*0sICr^D`YrxQvSziBOi@@46BYN zKANi3^|C0|GWwB{=V>3$_*l>v3;W_(A1!>e?2cC5@f-mkAHRYjub`EW)?}N+@g&;# zXiIxw*Z4U9P3HGp#-@Pw>z!-&LvZ+wZa)4A1Q5<0T*6ee_Vsmwj%69eITvdPUT# zp8ZFcEaQsk>7$pA-ah*Hc)dcTLWA&AQ}e%lMerAiU#|!rDEYG%e$7WeA0PPm&_{og z`55HmP1Zgza{%ql#~W16)A^sQkbmJ7@m;O(mMbF9RWX=mb5*?U;~gJwvG1-5{i>+^ zOrCey>Z{^Cc8wYS_^SBrs(4?C_gD?t%O6qsKF0X?+{X|fLw$^-DrmP?#V{Yw^~oGF zG5>HMBNT@8OuY4pk57H%za~ceIDSs;VVALCSw+*bMv z1=Oq_u2(qQyC%Nz@vV;)WbR|UkMDf^>tm*m?|uB><8K@d?u5~-xPlWO-E+eu)+K(Z^pj$TpEpZ6oDsWfQ1* zIr5K>X+Ea=nCxSUkFkl&e%HiQ+QT)m=9*xh?^^!M9oaJ&7T(O}ll?-e&@3ObeJu8| z#K#;TbA2rGk#k*ics^_YH8Ib}d|J4VwTJSL@1MO;0hg}{!c$@e)-TUr>$+%rT`cvn z%tzGAZoM*l!ho#Dq6L=IY_3aJ^ zRsMIbi%HkTvg=}lkBy{><*(aT2Ddu}vbV5be#z!>b%(BtTi3;QhC6zSkApsTl7FZ0 z9v^!t_6@Pi$8M!A!Yo_$hIr^O1fH!|QK|6KsA*IUXB-L!46Xd0ORXR8DU_>*Jh)&#U}`kBdG+;qXIsLYL?) z41je)ykt(|YYap_UW=n&95<)|A6;X3A%Km@oa zz`X(T2PhCAZ-9&dnE}ECT7{bB4V7ye>fbDs6(ABIUx4fY_pOs3C7Dn@+^Jfab3{yA z*Jl(AP$)p*0676xH4IIhpOL3*xLwuoXDXlgP&lh`s7QdK0ZIla6`&Yd1t>vb%7)*Z zoxvY%eq57LJixyVWxbqFK3XkYIsoC74MQuMg;)#YXSo3713VVs@c1?ZPI^moHhl>k)()Cll!ApaV>(=t>oK=lA5tECbP zlAgph13cO^M8O^j@K%#htpGlc08@GG0LR*9viK7L>ICQ#KnqYez>@(Q2WX<`>jikf zd8mE>DuD&b_9@lO1_2rdXry2(Z;182-Zu|xY0B;>AMU`$2527O=>X3JXcM4qfM)}= z2+%S>E7dOQkRQsQ3$VQM|1`g)QHZ15)`1-B@>aV5?E~bpZMHr`ZyI`D73Ay$#ptLS z+erz)8au0chc*i70UpU4vI98kmZ8YZTsZ?QU6av0Z^%`BkqD3s;3=MdfFM9D0RO)u z^SDCdt2~6O&yuZ6DLw=8hAuS=r2}+T3>&Y@SlBq!Ex=0w<^-4<;N<|X1Q-+G^8nog z^awDRY7EdbK(7D;1JD3^D^{-t=&bbCM_u++IgRZ#1@sHhUjeVHe1OV}H<6N%!yD?7 zvJDEbwPEN@#fts-c7S&R3=1$kz`LsBhA27TQ{DZ3fDhE=hwAd<03QWty*7hhFt2we zJD1HN|DgePHW|oQ=G$HaKW?q2#G^7}s$FLy4!T?9)Q z=m@Yxaia{&6tGm~^vdN*q!kpSQHW838laL_2iTwpXwPeCii&1kfc1e~$+o;{=)VAN zMyO!9FzGi2*c4!MfGq*`1=vqZ2(T@{E_Ppl?E!WK*r}TQ_S_7{t_lx@8MspS$+GNU zTG5^WdsP*AH)Le2l~L zQZYFf;Cz5n3O*g+On|crX4|P%IuQY;3jsngxb`m%}!h~b_Xx8_8?819WBZw#3+ zgkzZ2SgQB+^5KjanA6T_u30e|GnW+4L(8YxXUC8~h5|7ZWT{5~laqHzM)PLzLKL`c zn4vNngNWgY7_1E$MPeu#!~HQl5JRyT?u(&x3}s>{9z%(kjN7GDUNVLiO+sYLx>zYg zB~?*2hH^2KkD)>g4>p%~NzeFJQ59j0*BeWEQ8D~r43%PdIEI=rRF2`H7^=lkJ%%bV zR8_>anulnRRm(~7SfpO-Pz@z50e(WF*pI|eD~88ncwEsx8bj@vd@vb5=dg>rJS5$m zmnBO7ukCeWs2jtRG1QBpX-q!;>c{X@42@Lr1~H6p9%>lFjXWq_J#3XMu;RCDa%dbw zlNdTy3=gUnW~}BKe)6Q2o{r%e7UV6(>e(3DQHM=KEn@OP_FPOpuv*5@Du&jIKQG&; zUSM&;ZAn~FHtqNg(OwZhfA?;u7&^z`#o))#MU}Nx!!-r#F&HtJ3bs_vUZ9*zZ89X_ zC?&Wt`LrSv<}{BWhFA>o7}x|Rk|knDD$7YJWLlNtElYLTi!pSI;b07hVt6Trmt*)j zhF@ZMC5G-XjEG@m3_W7#8N;9$-i)DF484^wugB0w0k5e>v7)}}^3@pXsD}dE-cMor zvtET6pe_fhob+!ffVT$6@Ky{T#PFfQydA^)iYGa|qkwl~c<(L~S~c-p-u98|4jSIj z7(TvBKSUwPoM~7L!<9Y>voA))@JS3`$MB6pej39#)q|r|+0RryCWg;r@_EE6n8qsP zPu1nno@?{pD)>hll>%7TcQJe)!w+`_W?9`KVz5}!#^=hj^VEu{-$|U3bS)rgaFedg_+wpG(|Op4)U+k+f>Gi z7^bT#W~g4~Ejkq2K2w>;EOuox8K_q`3eAn7ZcBto>FD*A>im-H73)l8|`DM)J8G z!yRRTEFOv@Ph3V4!VDL@dv6?@*5%>&DsLP!P8H0EBQq{zGT|_Z%Z3Ti7xKlC9Y@hP zip7y%aUhezaTHK6!*#(p3dO-uA7SP>ib+)EB90<_Ny#gPA;aQ~@NpR}OU6-3RZ(0q zDG`?*K?0JMj!R!IA4eH=iT0;;RLhGIhG!*MVtpISWYRBea%`b6fOeoCiHi$(zPeUy(J4BVI22loB=9*vPhF9F5{=tn|RUO;jxe*xqJwG>_wH z-YpkqV$+^c7?yfgF(k5O9IfK;;_%~W9Y>ouy2PQy(N^(!o^`3}+QreHJ$QGdM7yG> z9Tk&Kih#^J$B}Cox>B7%{gjjbn^i4rD%gs{j>AzfZ@H=<0j4~a!$BOeI9`t96*iO2 zsT5{PDdI#NNrfR9k!ebDU$|==FU0Ypf*aiwFU8SK!IXqAFU0&&BHTTW9&r$O^)4Cl zJ>%#VM{gxOZ&6Wwlq7v=P8Gt*n}Ygb%;_J;>v7CXU{(SH;usi5g#;=l@J1Yi;#eQY ze{sAS$6)f0MeP9Ph;OZX6%SF(i)n;+#y*^I=?uh4)oOw7?IPdE~~8 zkK$lJ%YDQQjbpSDY*-wfn}vtRF(QtUaZIZm{zPFY+bG3^m`@dkfK)zDKZ#>Z9G}NA zR+&w1D_8|@eHq7Bar{apGzxtk$2Y7ZE+4qxDh?zN|7DDiw5pX2yN!7R?eONIm(mVZ-X|E@|AIWdmE==gE`tEBxqj!AL+6UWucVR|Ul%PJ-- zd8Vj>Q`yEirmNztks|~WTxaBuV^$pV<5)oB%m~e9bXuE18(=<1!E@u7r)+~5*1Ir{ zMNHA~>NpmwuIG#Yia3_Uu{4flaa@=v_u5*niV&tGyj;odP;T;7Iz-=L@imGGfwfAc zb+lVGdfC9{GY)$8kW3P0T@6HEHNpM;QDmd>j|!IL1IUFJp4cd}maV<8hpbPrf9IgTp|Nkv_yU~$}5Y)NpP^FMLiRPylhmZB%n zp>LjCz1>lsP7E)Rz%BoIyDUh1c8IFdlV1o9^2bAc&C0htMe)m;|JQUK>9`3lxn zJwvk`;WCOzX_eFC%HEZ&Tmt12IH}@WsnWPVfd>-kl|b(V9!#K80*w=Bl0fAI z9!lWJ1nMPFB_X}(;RI?X@L7{k)dcudt(L&WMxp8n)KKzMU~+pzRrh!TPb5%F!H*_T zTNNk4V+uon?}p3|O~_%YlR#ZXK$vpYPvEJ9d}Y|&B*Zr|V)*9XAc2MnG)kaF<#6u1 zA@ineI2k6;F@fd@JgwwulfW}do)!rVUZ3%-YW0#fa&C%>eJ+8P3A9Qek`dzF)~X=~ z*T|7WTSeJU<)mz%!1D=gD<|!ld8Y(ACy+=WsR+6x!1r8R!CC@(0)~Q3g|`$;0=Dsk za$zR{Hvvzz-A^D$fJn0C-B z32-WMG%Zlo!l&&R#j3&ajByEkk>Kxpn3%wq34E2ncL{t?2U(ZFioT|a@>PO1c3=2g z)r#>7<}G4=AV#V5m%DyM8=IhP=_iH%Ss5qw$@FUizbWMJDktU-B?Dh<3ICPA)C8uf zTYo1oDIqrr|0jXT3PX6xU4X>7@N^{))jNYWuVA*6?VX*#9GXfJu_WeFCyWwF6ii}% z0t*s2n!vFH7ACMLfvvRC1QsW-B!QI)tV&=hbM??!k-##=bGfRQwNRO?nhjrl7qea| zb4>zkRovjMbqYf<{!?W)B(Rb3Uo~@!%E@H2D$XGUxzTiUId4y3M*=$&*pj~VTHzkpol)?Na>66lUZYd#eCvZn`U{K=S5XqFc5=IjDD9U?P!MqB7tV)=no5jOP z=- z(WLBI5*JU(_*0D4CFK)`F!K@$E~#?Lmg_ZT)MbSv$||6o%FC;qML2K6yke3&Z{UF> z9!#Q7lThwU4JTFTl|(+2MD-+UBvB=aWSdY`ic~RNEh)P%mzZjKm^!&H{HRhw%_JUC z0A;9^#FNdX(sD->k0L&3_63>!G(UW1*BA zD@k-u;>9GoCFK*Jj{~Ncl6YC&CCpjY9!c~};~-QpDVw@Hkr7)eY> z;=3e&PrwhpCl&JR8(iN$P~r!U-nnk@Kl~5iJc0wOI;Gr*$m3OCyBi(hEU1uASU+9!6XhPaYTtqJdK3X9#+Nq-hEU7 zxvD;q#K|ODzJOLQ;8YT)=}leXcg2|`&NAktQ7eseNt|b2q_8=K3rSogO$vSrmy)=g zgq{Kyvt6MVB=KkpwNtp3#C5tu3Pn=5k;Kg;3Zzglg>yH>Ek+V8J2QpbN!&>yltP{q z?oAfBjqH;cqjGrcf+}$|*dQ!hI$Od)YgluDs=3guI%kOHMDlS0`P$|<;bn+Qc>o(mA4dpDz9hy}^# z0rGDfW_mD%N(%n?mf&TT6wY4AUpgXqrN^6dq4u%!A=4QmB(c-4r)3&8(loQwn%8g?b7oI6a$q zrUofAqVNjYP~|gk3F52P&BMHj!fd@InzOnTx}>0`@JtHNrqCgUjw!TA;kguArO;X_ zii+L0G=Iw!n6tfYQfNy>eVDI(3hfj@&TXlO%Ss#1(?V{GCb^i8!ktn$GA7iSqE42} zLfBd7hi4Dkl-;AXT;jq*%8V3D8e6-tmBLRVkDJ1y?ZURo9hLtk@({y3U|lJ!O<`&2 zLUHz53dPu{pb-Xyq>~<6j(er@h$-pGbh=g z6y8kXofO_pVQ>m>rSP`m!@FdgOG)BfhVP~DehMF`;<11apLfz=2z z?NPv9dY=N;{~eO}+u|StOA04wHZyY$sr)c~O#w$$eoW;*JSYiHrf@0+kw%d;PN#5& zF*yx?OP;d~+9_P60)NUp&)`p&X&br3o{AQT56il!fbft!yd?fIjqtP3l@!(=4)gL_ z3fCF`Q@EMJofJZ8++x^I$>U|Y0Ub{eWB6hskS7hK<+;`Oq~$(`Bw(WZ6GI?x8X0M1 zrV&mfe;NhS7 z>n?$48eCLHfIos2O`~*L#{6Pw+?Pi2G)kmVG7YV6HYYF_)G5Fx(`2N@p|mDR11wek?d z#K&3HG^(ZXFg1Tm@bPyK^^-;ob(u@R;x(xpg`r{}O`~=i1JW3n#$#zbo<_ek`lsD}ZDT(`a-T{;+MRiGrKn#WYJ} z@~n*JX*{hk&_yLVeC;JGwf-o=mudA3fY&0S2}G}_&T+o$oof;-&BbWEd@f;->E zbV(zZiIIkxM(B=6reUSIpchUWZdxw;+^ZfR4^|ETe^h-5xJ}jn{<$yi+2`JKE-u?V zPbHb6fy$U6nJ%Ivl<7(PT=bQbI)oGNw$0ltzgpDKsbzRPuZG=XCu0 zKhJvJ=Ut!mS<`0?d+)W^UVAiqX%u5vYu0pFanDx*IV9=-O5mDT0%M~nT^_tOA9{Nf z(I_;rk`=|eq5fVtJ&LOLM~o;;A>!ND^i}%&s7aR zP`qYgxYm;JLs86#;;|?mk76eKVHDM-6!U|}M;J>gPQrryb*?HM3EkQQmERo{tUo?H zCyKdIEQn$uJ7H^O9t%@F@MIKEL@_uUjs(>C5|^ZXK)ru>@Tn*kv0wr9X|_>7b^DdX z$onYE0&2^q%Hk-VqkW=yJ&Na}SQ5ocQM??*3sEek@H*wiDE2ogS{qP53aHDXST2d5 z2&gR5xo;xn3)HX2Dl4LRl?~BGX;`4HWPQc8E%0?#-Vtm!Ah;@u)lqDsougP2#T!v< zjN+5&!GQ(p+9=ku;R@7sQFQC4&@ETPvkKG=w5p`AOmK4)Z$+^!itSOn9Yvb~%GU+z zb0v{2QEX+;`NQuIbXyD59Z|f)x#(DM_U6dDQrexIE1*_@UmlV(1A^~Gu_ub(IN?O` zeiR=>@l6y*qu3k8hpcZDUvRpB`cV}7qWGM%5K9}yr{X?~f^M*+W(!V*`XbcDZIsZS z@PQ}}M)747hoU?#xa61q!TsYRy*ev@ZI67#E*HgNsE4Ig+o3Mp5IhI`>Drz_r#h;wgHI&ovM;~QJ zKjp6|{$@Wcr=I1A)-b%B`VR{hMdxzrtf9qpJKhQRezCMb^Lr*qc?}gbgftXsxU-yE zs3E93BAP{e(qls*6?mQ^-wuAqM_Zw5Z&+P)JhsEYp9{2riM}t zRWwxB{LR>N2L-EYxU4K#O@pdoR8dKd@+z@ad38_IlA!Y zDwk{Ei6SJIiuW?XmMtS!h@3%<2L`UxaFvE0n*ZQ)wHU37U?)KqzO#mXQjD%5>87E( zhHC^Xe(c|q(~5aIJ;`8U||Uqv1LY{WSE~{L36&Um<)B;&rOatUx_JWeApO z7^Gpah9R0S;dPByI)*lo$0$lp%?=FHFl=B^_o%{a>kS%iWG4~Hd$R%~h1{fJgb=FT zoDUi$Wbdp1g=1KL7F+i}IvA_rR(3z#|J>j<4YzA}T*E9{Ps3~cWkX-(F%6mqU4x;) z)Nlv8nFdRPts%o&R8VKMQ5+3vji*pXVjAd;Ye;BF3Qr0CRNhykeTc5+KWWl+ZKE`+ zpk_6AV$X3J#tZ3KL8YVeqh^r%uJ7XHulbK`cWbyu!@a`ij4GI@VUmUiHB8qqS;Kv7 zQw>uoY*{d7ZeUuUf+_4LP5keUAJ8yO19579g^m&;gC1hpG|bfSu!Nr1c|^mbB4L#C z%8bH$#m|>S7;(0SXEiL=Fh{bOD>zT^2@UgwJgMO+4U04^(6CS>%LfEj4G1v$(;CQ0 zo)I~PIq!2Cp4YHh!&@4bXn29Hl`>S^Qq1xyO-Afu? z&hvp4ROOTKN)5!-k%Cv*jv8KP>u6Z7VS|R%8rEn$&=_kq9%4{1eO7>Y|EvJrI=1qF zA`&8d=0@>u((tAb_C3mTI=pv%Tf-I(Jq@2|*s5V0Tc?S#hd3&@T?1DVvK7=F8s6b- zqhTja+FRMJVgF+Ry3ZdA?9x!_q9R(A_#Q3URH4GCAw}KI2H|IOTZM@VSN~8opu5EN3eCrG`TqzR+-h#y{uZSI`}leswGz z{7S=N&A(aY-Rb(We?z}!|6dxR@Ti7wHJs4!y@u~J91}UyJT6g~EY+9@6QuA5@t&j& zxdbGf_q_~y|HJUl8h&B)bWr)s&%LNegg3OmY50>fDqF3I@;hgH4X4=z%L4SC5h01W zr-b;ohI1MMy03Xw!#@(53!Q$mIEIx6TW)DhJE>q4pS--|wXsiNpG2Ns0{ ziv)`W!#W~DN(3wEs3?TW(<-RM%Hn;gf?7pKRUN91YC4+eXsV;Sjv6}Z>ZqrqrjGVU z!=G31Z$Ee!R7*!~9d&dJ=^3E6)58T%G{c`2)T#q~qt(~ZKu1H}A5)EVG#26y&z=D~ zl4g`JK^>RsxKQ`MQfaRHor<3$G5SS1TIje~M@t>8b+pm3VQzqrD#TX0|IG4uPo=Gn zOLUO5W0|*B|IXyM zsU=tI=%k~wl!3+Qs-sJu^QXg?z2pwU?0II<6JcNARl40}Se? zqrZ-*3C+X+9Rqd$Hu!l1Wx9XI+sHs;1A}x7rX_V;&xkrs=@_bGn2slPEYNX-jvIB{ zq2o>+!*$%m)O2V%Mz9L(13Jd)7^!0v<%Q}P9d}PG@*0OmvkHYO-7V5jNQSfw(=t;F z)mwGkrsH<@u0nOj`tadkNn%K-Z@b6?GsC(LLq}XkLdTXu)zra{Xkt1n8gN3y*5T;* zcB*f;9}Cq=LG_}b%4<_nM@q+dW>hiQF{q|>WOaBtTpbzRUxA!)Vbu)-irDU-m6qH# zIuzbqI!*`i?1jN-Iy8B#a+i(?Iv&(9o#m(HbxhH5zm9u#@P`o-bxhKE>Px|@A^x*T z+xg)!L3J{_@YfJ z>Uda+`lyc2K8QS`V_#6^w{Kg5{*{R9bzDZCrDL{^IXdR*m>5z{1XWd0`T5wQY_Ri+ z(s??b(6MesaK4U{p#sJt|9)?Hp^m3?Y}c_v$08k1>v&nm3LVercvi;?I+k*9l~Wh9 zUdiAR9rLa%d5%LsQJ)uNI+=Td&29-V)3KawdTjx3asQW&yhz(}!M1heC8jVjL`Th) zI$qJSmc`IPwO2V0=y;ty{G!N!-Qm89x=P0yY5LWIlrR>5fAEG5BKdj_D;;m@*v$T* zsQjvHBm2y$@Z9doCRV(=GEq_A(($&A`VWM+vNuW!TXb}tT0DKRfB(N(QMWO=$luZN zu8yyC9M-W@$1WWo>G)X3ZXNIGcwff{I{1kkTVxMS+DEDIad3O9g1yYKr}C4c^7-P> zd@wtwJRA5gS7TmAn3mpf9^XEmosMH-B}Vx?q|Obg zZ-mqr-wX3ZuOFBiC#Y!fXB~T+DlLlCpIGMhB_~C{XOW)^zjNI1zVfS%-#AYixUseJ zyN*9}ls8bpz-bPFzW!a%MQ?=9==f8|UpoHQQD6XuziM=rBe6=!InMKv=I|o*naTbT z3m81Ay@Z603grxc!aq?dNM2}QeKV!V@DCRX8c+;`47@$Ki0;7b0G}dBiVcJfL=2P| zsBECr@Yj*Jwo}pYKOtmNl?-s@hbHn@ehjDvsu`#%YUO(>ToGcus!OId1anJ6j9AM+ zZNs0g>lnVN8w#&0SWmFNU<1L5jr@Py@PySS2J}|S5Chj6XlkIDfeQ>=Xkeg$gM*8j z8@R~8Wd<%c(89pQ23i_u#Y$ZnsnSN_qIaCP{RWqn6h1w%3~dawHE@XmE^1vW*v>$E zrrAc}Un;I$;$H>mDsu_QKnKc4M|v9QXy8hzAPaw$fvXMhDX*J>PD04L2FSkt?Brz!Dq(J zeUwgRfdL|?m&GXK{BMBweuD)`zVBBs)bJmaZZa^!z@D<;Fu@zxwWJ{^8E)XIxw4kh zO1YW+#K7$aMj9Ap_;bZ*!7+lj2yzMZe+I_VP~zRcGC)Vo<~;*Z1Db&;2JUAA8UC$W z(m=|9VZbzC8L$n+*)i^q(3xBU5*`zz1#(M62`LzbX#=i-M~c)yX*gpbYhZ$byA5~- z#u>Q7z@03B;lD8AV&GjxDhaU(pZaG7?lSxpLiQF4?=f(%fyoB$6Xl5pCP^rjsX#|U z$F)JmWh|O^D)Tk)sDTFzOq23FC^*BwbRiE3PPzEs>;6n8$ckSaW@^O83_Nb&X#>v~ z{;Q%{2Id)fLilV0bJ!xnw-%`koq4)=zJVu2@|55L!G#7s69wx0S)?u!VZCCtOR@Un z{;<)h;8_EU*-YZ4T`c^KMQ|a)GEx# z#B&k#sX;|m?eNqVN_7)8Ow=|}$3#sN*DeUJi>U8M)LJGwr9*T~xvq(NCK{TUxGcms z0`*NaFhSDmCjSKiUx*NoMbt*7f5jnbYNDBm<|ZyOae;}i$11$TywJqHK}C1J8Cf+# z374oXO#ddfm5J68>tex{f-OqaHbOeo4P9cQt?=Gaza;HUTvg&%pZIQ>a+!(CO~xX#4Ytc!`>45DP9(%Hn=61AI&&)X?o1iP9Tvpzs? zcN5o`=wTvRqV^PAa&Ls3u2eNnSns7u{%LxQUxgf3b*;%S6=SoXM$= z-kVK~G%?D=XqMl^ttM_^vDv52iQ7dd7eqDPgkeIrU|29s z{9YD#-^2$dEEBc~$3)D;S`+I`#7!hj%rG&NbvKdXl-0_&bJ~P!;!YEHF{uGX8NqRa zSwYXlW3s%!(D5RmlWPL zvD5Tlx9wut))&5KVz+oH887d`_K0`!3(8&-A9DJ#P-NjF6Cayc^LlB4g-=X;YT_3Y zr%Zgt$$_KT#FsRYiTx(NFmZsRsiK-(5n=knDyrPdGGL3pp@mDq?1Yma4<0h{m5IZg zVN86_Y23sSj*G!Xbl;lzM)*+^bi4s6gK=O{Il=OR6$A?f85FdjO0s>XzR{Ygq8z@c{2> zIfc@~wJkKYz`3rDg}N5%S*UNJp@l{k8d$i6Gt#WUnc4m?)rR*kIz2nk*g_Kvpu&ae`;?1>S&C4qFu+Y=O7@CExV_`&Z|Hgi}h29pfwa`b*b)AL2mOuG3RzC~< zEex@6y@dgm-vi4m46-m#`0mF3a|)louA3DY%oK!EI8;J!kkp1*;IG6^R#f>!#sqJ) z{5KLQ@o&OYX0U{F%);XqW?7ico>NUJdo41ilFGMHT;-m_bSkL}EzGqr z&%zUIf`0yN|0H{?8IgV^JwDF>amn?i^;i$zweqx1%cP;F+u#!W-!e$F^ zS$NgLYZlhA6)e1NVU>k9EUdM_H?~Z3A2YIWwvxI=kdnHU{g=yJSJ{7ic!LEV>bQ}% zEmFf}%Fwn-=gR6P3vV*jJ-xE}WMy@ih20kRF?|c~S=d9PabjoNeG-1(!cUde4=j9ESv`42m{+d7 z7Cz))l;og=FD>wO zFfV+EIBS)v@0lUKcJEQDe#KT>8YbaVPt}^?BbNUzn=dY{QuSL4-|^C8qu9nV3&$<| zO%qu-Vc~lVe^@we;Rg#pTKLuSA7mz#syBC3ezI`V!p|0dv2aRq_pcX~{DqYHrD~%e z{L{~Vvv6O(qTi|TVwmft#51D#7vm1C!dv}6Ep!@MK*CZjUmE_$!Z{0tHi9++HeQ=r zTwnt>-Y8YSC{@eZ_-#$3f{g=1!{u#%LjLjk@T_-&eC{CUDxzXza<(*NFNrxDu(Mz33<%a zpeic2cJNNPk&VVSn%HP+W3-K1Y&5fRfsJl9x-&Z)&26-|ajA`qY_zb^+D03e{A|^W zZM3w}N_b1TedRrBjqP5!-E_IzGx zW4iE8BB!v6kj|`QUZ<;#byd`VdK6z{qlb+_HU``1X``2o>umJ3{UP7m2D?31HLtbN z$HvE1)FE>s$Ex_Y?PsIE?Z2}aXycqnC>&s;W>r75Ol-BZf6>)d)gd;nw=vwtO*V$w z7-r)J8#mhE&M4mD^KQRBH=E545cxPj9AV>T8zXIuVlnteUY-c3IhYS?vh$W?3=^rU z^3@w#;eVV=dMRTi$9H-ux7r}G3{e}J?Y}=QcA(oZY|OGT+lFbwvXQWnD$$?ht-wUNXO`O8Erw z-p%1KwwPYJdqpx)aFUJfBAjC5eipTv@`#P8tX&g@ZibBqY)rH9phzAPoG!=_n$zKP z6Uj^)58M80dU8sb&Z9OSvw5I*0r}&3GRMYT8y~S*ZOpUrgpF4@LTwzsIyj%En-_Y@ z#*?G6fGrg4Rs!H#YWdUB2-n4O9Wq&P> z{B0XsY;2?1ZU4%}OBf?=6;1`}(|dh9utOxgqUHL-P8+*8$=G<$#$Fq_^}0PaKFIU; zg;1YCIsTzY#vAy=#-}z;v1&Fxv$4;{Asb)W_~nJ*=fshrFKl#B)%}83)Gj$7_B<%~ zr6BK7X*yn#4s*t9ANk3~*EWvW_{PRjww;X=Homp-9cO;qUm#+8aR~7Fh}S#Lt2F8N zHh!RGM2BlfRA4CO3?(@!lkLxfzX)>f<(uUTI~Dw9<4;b8Y_eCvzuWjj%5z$fMLNSd z@YKI6kbm1KaQt_aXKnn$ndf-m9LIheCE)nTn{Z}I0te+Bo(7Bx4ipC=2ZauTg4_#w zv#REHhmtV;BFEn~y5SoCW|ESygNTC?2NfM$>!6Q=N)9SJxY$8U2c-_GIB4jgk%OuZ zR2IfT4adK8sODg5J!N?3NcB~v+)7l_K`jS$9MpA?TSDZPo7xU;@9bZrd1m19bCG%u z>N{xQ_!n_*XJv1sBX8`WiGvGRFb7Q?G;^R`7v@DLsj6!~h&(98Ztj4WY?i!*gNq#O z<#B=|iofUEqCNgYRx1as9bDz$Y6oo`v~|$l!KDr^ar~=cJDQ@I|MP;Ss=8HG`L8iv z;xBV>g@XZsJjx4;Y)_lUh$GFl#%?td+F=8hNogH*{aE*g54!Sz% z=77tOHLLlL(rv4$m6}9&bzrRaeUu&!dO7G#1;@Wf>M$@s9Cs?nWxaW)LVK>jbv*pj z!L1H%bI^~uJGjBYjSdDl80g@E76n5clsOpWV6cPzcLw>s;K64jJY4bGYU+*E)FHHL zHT8O_8p$xnUku^u;v*L*!yVk@V3dQ=j{o-X(?OvT4sNEw%apsyLa#j-9O+=e)bNXc z2d-+b+~Qz+Br?Xqqt*O3r2liUshZ0D3}YRC`@{#;)Y~0I9e57Lu|+ufJ8&GtBwxdU z<-ithI{1TjSXamwpbLj9yzAp|VC%;nxDGN75)P7%zr8T!AT5M^`fr7FB)mzW{YQnA zEc;${Kb`Ro?r?CggNY8fSbe91yBthlpRBI#tY6Z#x_Y;Rd)QqM7LKj1^7d(>#G2$_ zvNZJl4(@X>#Q|4Vxdgp&ZeaDSf8A8J;|S&H>godyh|FucgNGa}b+F9A3GAC-}S|y-S3=AXqdlu-w6m4vsrG;b773&`Soq4$9x(3VLr8w{(m`}#(6vRse{iP>|yK(t_kgT@P*j(fZ##F zF9iqF&Zs1U;s(nDB) zA03>#M)}FXNe4d*|Al>62<4}Q{OX|iE%fa6c&N}$V zLA@^nh~b=rK+KOz9ZHxWc|l%6Z#n8*qcF5EhF}a=#c*{DN(`YGYQ|72=2xmHhRQL_ z-W)0xZ&)xQSRzYgNVrVWB>NJhvf*39oZ!^I|Z-?k5PTU;I z;YBgDkRVDJrDY7QVrU&hn;0&Q;j$S21W|HiQ|R|ip|*@zUA-iRc0$_c5|pvutO<3Cp>qsfB$2MnaZ*5E z6QaENqyVwI$ghc^M+}rRR!@=i66`H_tzaL)izfy8#n7MiP2j==2E;HhhOhX;zBtNa z7{r!}qco1eF${@ec?>VcaD5Czd6aa(UppE`)2%OjCWdEYxPirsVR#HT#V{_0@iB~` zcU!4NY^mHF!^jv$#V}g()nd3s$QWV_Z(i>=&Da=rl;O4*Zjbq&vELfQIxWBhxB2J0 z>aD7DSzaYd!^*!TbcxF-h7dD`$E7@W3{DKO7&^@fq+&?N5NDL@i|7(Ul7b9%MJFp| z%ZQMLq}&rp=Q#mJxg&-bowhNolrIH_2bis%?+aSYGJu#6*UMTm|2d<;v3pWPIo_k|d0*HD+n@JYR* z#by5S??+{?&Py@89K)6vwn~>+A^27dD`R*?_^UCjWrN1>THZ>p$FNHH>bzu43~vah zxo8Kv^+GnsutCbdF$R z$FNgEKNZ|1xI2dTV%QVI`{Laz*?quXEkD^|HBUScqWdt0k7zDdKL&a!KTkf3VP6cN zOY|=V_X~a@ctG%=p#S$wS()eG=nlv5bqqho@KX#&nESF~y5li?ljlcc_*VFLg2x2e zQdB!3{CmM4{u6pKhM!|N8^b>_{1U?{+PuDUI)-0`kpID{CeMG5A-N)ua}TZvF!W3e ze@f_If`5ww<-G%K*_;Ui~GHs6c&w|Bs@o&^7?T!h@)W~jpAr35gQ9qnTa$JPEGQhg!AEr zaa#&NN2$=|EW}W;n&3R zH3C$o>md?Wfd=d)#%DTx;7C^R2UG)n$`ZeCJy9PfQDKb7$l*C z1&0V;FE~_iSRA?NjB;Zf!{h#U{Wry7#$m-VB95Em7#YW?IL5|tYaFBFc<4~*Sk^y6 zmhP4~#>BB{eKGm}B<|+j0rJ~~M+I+>BUHbLI?eQ|8e3eis>fkS&_q$T<8b2WnNpZ+ zERIwS)r}()M_hP9Fe#W4Obap>YO=D~IPQt#-Z(s|(YQFq$8kp-cg8V6BzMK}^lZO- zJUct!jxS=YyG5RhJ~56-aZG2u;+P!AeG>FQ98==BKaQ#5WnQe;zoiw<)TT)l9u%Za zX2dZwjz{BoOrkt2_z3&V?m*5aM80+gDh8FJ)yt%cQZZU>*2PuU3zBSzW25j*dC8k`Y|ity;&@y57QwA~`8FZj1$PL(Bls?DxIMsRnGx~5 zIQGP`FOJVS4CDAfbUqbqdsBcXrSFaV=cRub$47Cr7RkqPd?E_;G6lNN#LEUE-ycWL zo0A`mr=>5#dq6@8bAY$obTciT8LMC!`xt z&K!RfA<56;{YgrDQiLq_FL`oGh|owI_}`9}yd zElBwJmP`1DLbGv^@F#Z8@a08PL6AX(2?P^R5(p(wlt8__yf}ec!ovwf5-3TaVgjm2 zDkV@^NU318a)IZz7S=BpsFFZcksNxVm?;M%O0@*4i=;*ZHHA=KeTVNzYUd?&gwz#$ zX=k8*Ufv*qh6yxc$rEU|rI@a10!@T7I=#(AlZ4*p30#!G#3Uvq(ISD1=_N^`Wdf~O zuO#Xx(K>-PEJ+fzl4zU2B?30#`MWeHrK!0ZI(BydFn9TK=T zf!h-3n81|@3{0RbfvXa@I)PpZ^iH5t0-Y1+Ch4dTg_%^Be41Soc&mm=N%sV<5n+!6 zdJ5sIM#{bFzCPWxBJ7typ9HQG-dAv+MDMcIKa0LUp8`bqvj_(zFgStX3EU*YAqfl< za=qYC!BL?IBi%27`uF(lA39k0$V#2p<=m z#m>{jw|w`X{q~)kz`O+3C9pn$ClZ*Sz{?4&NZ`o?7Kr{5!G#GtE#xV|MS}Y!muC`q zHi5+nJSW2E16m_pF@Af!kigOemPycyg3ARNRKK?RQl59Jt*#WlTJROYR}*+G zf!Bqv5@f7$e}~U5FD0Q{lfWB!`C1_(YpWX)*qFf11a^sJQvz=%uqA;v#k;w+vRTMm zf_F(#wTV$)B(PV=dkO3j^1dKr{ZU)}Q257! z9|^7+;`h=|@;aXisZ&SYm%!%<>`&l}1ine&XaWZ~91{MnNN(`vdgGV$@`Zi^hZ3Oo zE5XBp?~d{JMKJV80-HvKcUc8HE)IX2zz+%h$QoT7{w{%ILXHcb5TyKjA;FhRe-d&k zfnSB36#QB6mjrTZ)c;K+rv-l({DYHK9hE_JXGHR+;9r76>Zt!D{3To-XAw-|Tmpe4 z3X=X=vONX`D2MQJg5?D(B*7pm6ej(M^-2qrq<=m}D2bvZiYZK@x@blOD<)AXi4x)4 z1}fi{1u7?T%i#z~6%m#S{%}*l@v=Zw;VS1_9t0%FjF?M}BsNrxkT)7r{CFLub`o`x zsGGze%?j2k5hBg|!);1~BpN2sEQt$}Xp}_bB$_7uYgrS~{4%e`C{MR4c(ZT8g(9ay z^L$d&p}Uxqe-c^}xN z%jmf*t`jmKiM|r0UlRQ#aVq58z$D5G7BmbZx^*_J_REQGl{z-lnPc7%r0jK zTZofHEH8-*NhFa>A|*VXL^cU83A>K!3T8x3?>HfMByp#Z@e<0EslZS=k_i%Yx8Oa3 zRJb>Z2R`*1ZgLX$CH>EtA8>t~lEk(Ywx@7^5>u&@#Iz)SO5$V^4<<34t@Bsa*-1Q< z1P_y;nwlS#au z#Hu6~B*9;CElT2P_Kkyu3zK+C2>Ic51v}Ll~2xzOOsfZ#B$Ljz9@up#v0Kl_;L~}l31CLk`A@h;n{9LU)!Dc<|N;UJjcJISz0N_lQ<#5V}du81-?(> z2jM?TI@F=?e40PA6H?xq|6akVBz{fe<`hPz@LLkUC($H@rYZc9#OWjgDHNn|CW$|j z_$!IOc`K`j>OU80a<%eR9Tj!eH`*&_Id}E(zc%`Z^FQbCjuE;Z{6H*)aw$|v`I~9W z3zAe!p+cS)rVtdab5NTFd0 z)x}#wu%=)wK`Pfyp^osnc}cw#>I=_p^lc=(vEafo{}>!P=G82P3sSf)g}y0Vm_qXu zI;GG#g^N;Xk;0`ZT$aMcDYQ(XO$u$LY^?-a3zi=k_+xHyzJzjy z(ve@D!WAi8nZi{PtAk+26#f|y_Fkqi(Vl)^wEWrDe43>H2_FqaN<946l3 zf;Xgaqmc9Eyh*$x1X=M>DU43xkrWmbA-SY-SrG4#-0#e1`roYYPGM3ClSSbk!Fwf_iK5KB?n_~c$RFm+pTg7>rl;_b zNFGRGS_%&eKc8lf%n%_MT6dq@bw^80mVO9#WQ+O$bms6ON!rT-Vu>kC= zR&ZVl^HX?I_!EN12L=`hS(w68Df~DvKu690l?BF@1#T_#`7D8w{!ii66kbbVWy=2+fbJC` z+%ZD_dJ3!a@>PsJz!%c3$@8@-tV>}%2hM!Iw{J+HNiXGz{=tpXviu--6KyCXXmbiY z2ZP@UzQqP@rM#WO79m?x;1`Abc#y&!DZG=yn`vxLf%f5mszRV%Lbw~PFg!e0-CPYRO! zoWd`8ekz4uh5sfvt*%Oi)13S{1+`bIr12-^oY}b7E{(raIGaLY+V|4^BXWrMTnd4_ zyg*3q*pPB*loxLW!Q2@mj2lct$?J!N6s7+?cqE*cM}(B5Q8A55!Yd1w3Nrm%7FE+w z)2Nn4^)wo$(I|}?Y5$hywVq0ywEuI=nu4_iYo~GJ8NUlHsjJpagIF((`a&8A=7P96 zoM#>I%htwezge54(KPK}ZpeujrqMhNI}Im|i_&P3#^l}w7E6^z%QQx$adR52(rBH= zpfm=j(I$>`WYZ{kGI+vz#SsLwxGr{(>Qf~fF0Yydf`I_hY9A&${v#hL{C{bTO=Fbs(K!kC z|EDn~&v{w7HP5v)ZWDgHU{vsA(|^A=*TriHnrY;Ux~s0rkLfs4VrfiFV^SLNG!khf z(@3Q;A?*(?x^x;|p1VRaX=Kxw-!m|)XMmq$j1%GbH10^_&NOnuyO`P~3VF`mEjst) z)45loGx5o3+?U1^^rkT-jr-GhOmwCSPEX?@ArDAu(}X`LahdxJ@jfERq-KiF!}*jS z6*<)y^f*hE#%z(y6`Yfgl~b4}#ir(yX)H)%X&TGYSeV9BqV`-Gi-ar|d^(M1gs^JQ z3SlCwETdEMJV#2t?v%WcPkDJ7FQ&07jn!$qB(YYcu~Nv(`7$$+S11u7`Kux)c|9*- zMr(vK!=HdMI=_jjz)P)KiZL^67)gew)U3X@p%wT%O^ByRmlWF{%#+Frn5MASX>J|0;{p7!<@mm__ zn7)hOIb=A)r*W2z*hD!k_-7htgiyjKpuaeSjSG^q7B$KO)yw>e^dB(@y|v?!0vF|7 zRB!3XNSfanaO8GZ*b#w0CiViwj*ecX1Ijs;6>8V}-8% z&e)Ch{QZjG*9y0Aaj}b*E?T+%p#g1Nv~~TB#H|H+3g{&+xO12;XGsRpjF-B&%*Ev{ z_)#0bd_3IFziMCM`lpU}aM97ll`hJL6s;_44tnXhExf;r z0W_?Ou`UKOQx`*AT<>C#>z@{K^{4_O-C&md`v|>5T?}(E%Ef4E_6okbK70f1IjHDH z7sFlLB-R+=;${|dT#!Z>DF&g5=%o?Zsm|67^CRe6Tn(Lpu&08;9M!N38aACUsN2#=)CB5QkJ(cGTI<9|*788sM@?a3^ zq+Fz3OmK0x3zu;R7TwW5GR{TDMb^cX*8-GyA}{xcLO$Nb9WMB-EST9(S?8#X=XeT+DVcpTgdOIqaM+=DB=Z z>W>jha>#j%GZ?)j#3x0W{3#cUMDuBpoR32CjL4sLvDn3P!kI!Y5r!@i$qO!)3R%Xw za}~(Ni!NRg33Xl;lHpnk`v6ygTz}n+gh8)K(0aj6T$pmPO89C)Dy$LmhTvKk>x5j9 zU-R6+`9UO`Tz{$UP2sfFW+5!(78hGxyl@Ye-h*u}wzDUXL)kd&aPbann#JQ;{)PrS zU3giH%VHPDg^S)9T${mrF7~+Sl=1&w@jh!*OR11SVFn+#*z4j$7axhRd93fhh6;O;zt)>yEx+F zTNmHC_{POiP7V@_m~)JN%*Aoe11`SLhn`QFI_$2*pEyQboO1E2i=Xp({UT*JpAM7y zjnjyWKSUuX&m~1Z>rCK`i$A5Zf4TVE#aZF!Tm-~8|A=?X1qB5eKqTb^DWTEczMvpS zXdilm87LWCCJLbpiZW=IL3{C1p*VwZ29XR(GN_k9{R}E*WRlN7&7e{Sl`|+63CmnX z2uql&X|)WhXHYwXIvLcEpqd%f%J_CW?^r4FoaO6g{%r^f8)VQhgBBTFoI#@u8fVZf zg9{`sLz`sKG~-VWIhznK%%HhMzew=EK}^4;!|$l#F-*n$HyD9d1mB*-X(G8mn~Eg1|J z$&d`L&tPZP3ljuCS>B7>VHXk-SXgyf1%1(GqePX^fxybQ)> zaBBum2C)oo%i#754Aw#n7|lS-K$kYkH7JdobCxLBg6Er?I`Iq=8Mq=(W{?t+&Ub_J znoJ}kLAhkdWiUR2i5W~1;T;)F$l&e_?#$pWkx)Mu_a5=yn~$3l5+`SHUj`3kFfD^A z8Qd>9PW?}hI-m7}8BCYx59Ryq`L4w#n<=(>STHx5Xt75#cuXYZkF%|X&(2_ukhy|S z2+ou4k!yna(yWZKFoUNgbbY?_ERy0qoxw91Je$Gd3|zV&ysp@gq+D98DP<&ft>_KF#2Z3=U-QSqA$u_&kIClFs?O za;HxUnDW;d9LeBYiB9h~V!fmJ-kwYFy9|!y%b81=Hu*k--!u3_ zEcS!okAgpCa8d|$e$L<*;im+D75ps&I)+xLub$4}Oa_-^(Jt#t{^S%rNGTNlR|bEJ z+Sv^L$>5xDmarh}Pt*ZHc206+Q7((}BB_w|=bRq({e>@LFbgG%P!>g5)XJiE7R6bF zv#60p%`BX$}8OG-+RAOUnNnq z_^ZBJO_0xh)tPU_ASE}NVLsof4OD$WxK0*zvuK({v#kI5f71qPy)3S4pw`c#K^6_O zXe6a=l11Yz>;@_w)2GXk8%KvP$YN3h^`b0VWWf`wE)@OdSv(<{7mJr~%v)#CQg|yt zE`hFDA8eDwD-G1Pg47{zpT(tFT%X0zEH2C9@+^90(JPB9vgnXS$1JYQBEC7y`{6we zRQ^%rDw=CaxN8Y&q`a??eyqiS5WRE*L^3dovMdG(ADqPyA=MZ8Z^v>tEQ=dhW?D5F zzA+1)3o(WkV1cu^DT@&zp>R|dH|P0C*1cjXcn3%Q|-1a zZqMTT9{=i7qGw@9sGWtGPm^*+wDG#%8vv^b_?2}aBh6D!X zHZ#o1Vm7w>@nDH{nL%SL3- z(^>zCV{sPG33(=qXNBfu`tFJPr}Ud!V3EI#H)&tg>;tFzdi#f~i2WbsB8YqMC#wr-%Z z&-3fQ$ipFi47fgvx3YLUiw#+9%wiMgjfU!Gj+BNf$(!OOCn0W;5@a8{@Jz2cZA~jTZ(&mGT-s4jMJ4x0*R&-lKm5#)FI@0ahf)7}*F~vr^ z2)o4KVa0p1_%I6+x{tE>p`l9hX%?SlaU_dxve=i!=UME};tNh$jZ_{}&m;7c>q-x> ziAO63v;K4R;F9najnpr*IK&xJO8a#dv+73<=WR<)$I>3n;#&^4EPi9fYnOb-$#A6d z1Dhs`<4ivuIw4WM{|{35V-`PUaZ-f8WO2A>fbQok`ZfA@W;-Q8k6xlIJrpcG6YRG$ z{5#XH8vH}>wBYD);IAzH<}B?Y?D^M%zq|R*{%5oJhx4{#LhYSiEvjB-8}y=`R2YTfA=cFkA@vO&&(%xm8yg_V2lw~!ZzO03 z9#?*whub}9>}E?NTxz3m&$&R<^AFhh;5LQRm+tvfH072DTdK^3AV5@hrm-8WEQvxk>GEcEb{hvgn#^stBx+F0Rz(Gm|& zb4Yr4mW}K2^vK}zg1ugY2X>Hf-h9*%ivHqPH6cHF}W8I^~*|Hs1*9?p3P zjKhyiuq?nX{i_H5DdQ)0?19Qj4?hd}Mevj$#Or@`7=|IFuWQ^5gv7t(;!CF3s^+VVrNA0Y@XOOW`;K$Kn6T zdJkwPs_%O|Z-dDsf#mUcSBmuBd+)vX4kDl;f`TA|z|3T3GMQ8aq*sw5O;Dj zY#(BLjDALnUN0{oV43 zq@?;X8Zd9j*eIztmeC~1o60E1XL>DIX`R$t%4n73L)f5=jJB+_OX}@qOpe%Ru$^Rd zmT_Cf9ToTTy1U2-$k1eTmC=nR`d8`dDQ9;XJ!Fi|FYQ0&{Qj7;r;J`Q-j&f?#(Oe` z$oNdg$#ULvh1`8)Oh4vqT*TE^Mn7_!BChutKVYQjhcfyn`A0GaF#niwAmbp$PZ-Jm zQznBMr$2BO%;X;`V+{FZOV=2^nK$%#$%+##b`N$(SW$wv6#ICdim7V;YU>Cg;~OCd%|+&fXr! z6%jM0`zO(i$e2QB`_uiqiij&LPM7hrh#1q@{ZGqmGi1!BAY-A7Wiq~}zQ|Z4W3h}SGCnRUUd{HQmMd6P zNH;uRRPxR$DwfI^^~&?nBFAzWD`c#Zu~x>htyzAM(X>L^`@;33jFmEeDJoXUSj`Bx##@go>VD|YdbAW89Qk|q@}$?I(FOn{%tAsy7cZ1fAwObQ!z23nAj_0 zpNvB?ey98YGJcb>U&a9$cWbA9cf>iim{_?Y^;*5O>&3)D8E^7ra~8K-cv!{}@>Ln9 zXum2hj?(HYF2aRe$7CF*IX!L<>V3@x)_pQpXWxW9l)Qs7pQM?qc% z9tB1+(gTDg07G94#Sw*74u^&R&c{ z!P^RQD|kmi4$g>@;$j(hP6ZE32nx9r%nkdAtbdSNv7~5GQtZv{%BLW|f|3eKDJYorb{@Q!48U2Ao7`lp;WH|Q^7C=pDR!ls5DgSq;C%rC; zQXo<>-SxvW=iNmqbo5-TV2OgI3YIB2G)d}0o7E|&k;7g3xwpzS=k;{=_X?IPSfStt z1wSg-rC_&$l?qlV_*ua(3O=djO(`Q5{3NYbu!h!b8L?KuIt9PK$@UXBbv3VN0iUzZV6-*zo4BQ`16tYDjh?FzOi_N`0mJ{_>OD!5Zd_{-Y{W1F!3hQX6#Po4va543s&t2g&|0CKfXe4P~irD`?@vnj>wEG3p zp7LCbE^iOrGnxe^FBH6_OTV*L zRm{2S&!QqLHQw!dONCQ~ONFG`M~B_zg@<)FV}|18q|4>$m!3YKitH-VRS@^9NL7(d zMH)vlkg`ycQ1P~kTq<&_$e|+hZ4ZTi>w8L^_30IZ<83^YWqwV@(wl zer(_-rH+caDw?Zkp`zPNsj1&pPepwd4OBFwF;~$ppSzJtZ+iQF8{x~q;uBJuu-=rh z86%AwS+;y6<*FbOE2O;7ovl^0p~k4_uc9s4sOYSsi;DItI;iNVqLYgE(%f{C+_R*& z_Dt!;RcXjcXTRFsiWNjxYK)5RDtf5sRY91g+<)JYD);uMm-Y8l(MQF>DN-*L?t@+m z@6zBfe~+&H@bzOUrpFL{-F+Jgy><nF5#S|tJRD7*sBJ)WqC{QY$91>EP%F!8&(-^0#*jPbiq!OWKADri#P3w`|L&aRO zQL#qFw<_kT_^-ic>n8sR#*>Vv7*8|KsVG)e6f<1jiPc=^RFqlZJFnt`ii;{P zag>xROfEB0Gf26r;u;Uswu<&9e1o=q6}MFUN&A4`RR-S9sq}dT=aq`0?e`Lq=xzU9 z+Wb{K3*f&1JY}U3FP!&P{H5Z7iiaw02XH5Vzg0X^u_AyU0{DjphZaHrBLetW#S>at z0SpY_DHWpPeJbRY_dnWyXeSJySO70nyrjK1fb0RhQZc)BnkN8n0IyZNQQ-*SaYZ2o zaDBNig%OMt&BP=#<68kZle#NldkYy*a8q@a1Q9CMB_T@ySpz6tNsReM@&(`zVC1xv z)BxPY(z0=OX@xHl@RNOd03v{V0pw@>?ErEI@J;|Z0>~La@fE&Y0W{*0iT`@u&XOkp zDwYU^yj&(l3$R#-3n@sAeCeIG);6F}IDiS?NJRqpIHQ~ZN(9g{fK~yN4B+8WCxvNCkFJ>OBJJ$-EciyGgxw0PiJvp8)zMdB5a1d=Rkj3sLxxN&f&o3P3-U zGJvM6ikAo_HEiMfwuHa;apxd%?=#XT0el+3-~fgM@L9nA03`r5 zfT?f1p@4nr5(ps3M59&(U<9zgl6a@G`179gdL`jtVg^9bfrA~C%i_G@03u9Ci3Sj3 zUZb+0=-2?h3gG^9-@*XK1u#BY(s=Z3dNk56Tmkt&I@2J6Vkt>1@6S_tae32=Ci&anL2-Z3bpDx zZrdWp#pE*qEM>kdfbRoX&b)tRF|V>9<4ue|2Cy=KD*;@kl^($A04@b^nWnF(YfS*h zd0N*7ur7d~0$3lwZ>($xU}FGV0@xbBzD16oX-9hF*%ZK$MUG!sAwtS#HYUC;fb9Y7 z4q#6JI|A4lz%I^0c`1-V2GWG?rR)Lx${9(dLMV^{1xno?zyU7*U;u}yx&RIZ@H^N0 zzh*}RIF>Ad3ZaaIbPaVPfRnT_&Pq8I!07-;ITN72$+gK@#&e7mJv=JQg(Sbogl@#q zng7pqT(5Jw?^hPrXcr3L7CBD1hCDS)z)_l*QG!SDHw3Kc~&=cV{sj#dZ4Ie7vM?(zYLfsUf6+ zt}frumZ+hm28V_e4bYHDLv9W4XvnPLEe#$GUJXtSE)9|fw}v6rU9D<-OH=H zMx^-X)l1!0FExvXtQvA?$f;pPQMXS+{DO1e1*cy_s)lSDn$>V+*O1O6jj_!Ir(i-! zZ)+%i-bsY;t&7erHC(x<0T-QARI{7Tr5BueH00G#NJC)_`84F$P(VXL4PRAv6}jjv zUc*H;?qcqn7o6>?yY`c)p{RypRIG--tGRAhcO59|K32`O=Dd@(jt?$68((ym(okB% zCmKH0P)0*p4GlFk(ojxAc?~r*)YMQxLq!dhG*l*~iWpc$XjKGV+*SKkqHD=28s=3I zRW*BKsm55H@wY1W(Z804+8XL>XrQ5vhFdIVt}5zk=(iwkfB)2a8VHH+c;c;JRnTST zoT{R+h9(+1Yv`h(DUFYYwi?=LXs)4!hSnO|XlSX?pBDOaXYuZ>Dq3-kY}%X_cT1HCVC%~`jEF&7kR4NN$+d;K*K-{ zgEZVf=>Jf|N91GGMR>Nl>~iQP2H_W*=onFzy=TCq7EUXbpyj zAkAhD*YTGA`h$F9H2W@-tU=MBG7nJiH0T=WE7BA)?l@&&mUX^Ke>%I3$P(S=vowTh zb~GH&5YZ5&UTB!9Ax4g^VZ4S3)C>({$pbZvqapIT`sQ~dkk;*-^X<%jx;=HZk!xse z@7Ee8YM4gt)G$f24=Y1_?q~VklQr!9OPaz+WGZ>xk`yBJgO^hid}V);==U|VG|blU zy@ur)=4kjv!%_{)G|biT?!V3z)x|sw-%@8wc_|G0-Z5Xp0u2i_d`B5wuI<&uB68jO zuEmUP>br<9VNTOQ{3YE8sxErAO`~0Cg@zwAY}c@ZCZdu%OAS%3hWJs#N)4+ttk$qb z!_OLi(Xdv-It}YJY@m_3F43(gy501XW+M#(DPz433LAM$D7s0*W(`|4Y|}s@S#Dut zN+SFJcjt<9x-8vE148RMlYbYv`U$D*V8?C^d#I0t9U0MmJmbGI(xm^!q)v+WpoT-V zYw37PN1D&ox`y~&!(k0aG#u4%Tf-d<$21(*a7Dva4JW7#8qRCDK>eDV_Pm38U=4AK zc0~P9nv(AIh24MF6n8b;)9^&YQ(8M3{?hPR z!@soOp7lK-_p9Z4sNq#jQLvWicG~&3hDRFyp=Ep8{=;*+SRkxYOI)nyUFmbRswJLj z_)o)2%A(;pZ5?&oBd$BkX3A}b$E1mb=#SnoN?wn?%a7W+rG54{zs)3 zwd~!%r^Bx!r;c1YQgvjb8PSnlho~(o-m;BL*0#<3jlAhP8q^j8Y73!*@NLE%y1kuJ zG`Eg-bQIB1R7V~iv~jH+p0;s^lvhVS9r<+>(DCK4Y=x*LPCR{)QjnvI3%N<8P*?|T zFYDg&-t3?HRdu>MA?DQu92*wT?D4$hVxk?>IMI@io=a_PDPZV{^t9 zI$APm#dxi@AcJQcr8ni=Z7J!FRQ{3Fjym#4YOkXM4{1k6YFmW`jxIX7>iAU0U>)6b zbl35ojy}}*!tT*GrN4@}dg$n><9R7JgY_==f?$>ifjE zNPR2#KcHG@tX4|>b$ra^BgV=790Rxklr)ePA|%q_ys9mR-1PhFh#@*Y(=kQIR2|>e zb``B7hUyqbV^v3duHy?GBXkVsC@IvDku>8vPTZBo=@_MBw2q(-lX{^;)}iUR>vd63 zbf`K4IwltOlJUTK(xkf*k@Q9`U5BBgOC3S??J1ntAcb^TI$}EFI>I_4I-*SMEE}Z3 zbp#Qrny_pKcS6Tl>OQrBpPLX;b)*xH*D*oI*Ho#FN!-Y_E|>2k$GLm94e`m`9^#7! z`KM8(bp$I*@YM;99^*T1_*hJ0Ku~EmF)v3LwNdxK% ze--!7w2118Ul=L6C8z(!1MkSXVq9JNo-elRIH2PoEh`;6b?nu#kCevlU9>{$ijV*F zEvzecQ>W^RJzVc5Zbt9TzF&3wtpHy=@tcnI^Bns*m7<4q{I27aj?;9~TTdL;aa6~+ zThbBoD+hkcX7A+3bR4JY;4Dq+iIX}ANvA;M3@tt3I;Z2&(bTi#rF_t&!{~V(7j#_I zafvftW*k#b%&sTa*AtJpgln{g>Ug5#sg6H%+@OKg@wbkfI&RS(rQFQkK*gk7!tQJf@vc$D#V- zR(*j6qU#`Ejs|w#BK7Uc$)c2QS_2I7MrX-yi4E)B$M z+KbA0-&&k;}>eoNOSn8JKa)Gx3C!Mtg5F z7ln1Hj{1*1L-YC58VdPmUk(E~4dgM9*Fcemc8?k~6uAuKHtfT}JB-~}zj0jZdCU2r zjJrxYfeM4rlHul!+)WnptF<`2Fe*I zZ(wM1S4lbw7${BsZ6wNY6=j)IjTA_%U|{%n65WNUcg|VSKqYEqBXLAdyDr;D(y9ik z8E9;viGk_{Y8a?%pq_!625K3oZJ-Y6jYQW*;^y~K&fk3VEBo73a?=mY*Z95l4Ky&& z&_E*t|IU|wFXP%j*EjySpNcJcP5PvfaF+HqHPFmJ7Xw`lG&j(~KpO*X4FunIUmNak zN%cPQv@$T^s7{nHMc8zQtF)~6zxOvSSqbh0T*FE1062=-e+9h zNE~Y<=#7HMjYNOiqvlEFTKGSrF>m1?U?5jxL1d7DPYmoZu+zY&1_m3LYv5Z0LkxUo z;0psIXm$(?Gw?Z$zk!u`?7KbE27BYJ&{))O;Ch+Y)$JeeNCRIQ&RwMYIwtNQ(_rUq5``a`tYlneU^SC9$<(z>)*1LIsa)DEZQycp zJ#ijf=ljLLCIg!dY$0stE_BaRRq{?a;oM4&w?rDzRPnmpXQlG<~mc!9V^3hP}%jWNbfG zI&9#GfujbFkuSaWls)5o{EtL0LQpMpnu>dc(>fPUJ!#;Sfj<6`^+{#!`CEUdC7`SWTZv&4E+@r#qitC zLjxsqf%IR7`5!kG(;B*^W@5%#|Gx&F&`ujfY7kEiJTvegZTkkEy1aDB-wW=KYS|0t z1?`8;#IQo{mj+%Lcuh9t1qF8yZwxqsb~J?%jP(3HQxKV%zZHZt2v^dElB6KWn2>JjF(ZiVLHh<*OUe6b5a~gPAl?olM-Y{Rs1iiZ zAaVt9cW!E>AaVyW{G2CW5cz|A2nZri5Y@A}@&>WswEZUlo$9#?1W_=E5BI&3Ux|zt)+~%d5i<;*>)X1tqR12a>5KXCsAZi3rH;DF> z8bmEFt!{H6FR<^-)DEH!E7bnOE!>3lf~X%vk80Vd4Gn^57{vJVc2gS#(Kv`L3(}|} z<-F(9=Au~;&4cI?MAsl%1ko~x)picf;L)k1h%+HEM)QuJzRmpnL#Awhf=#Lys&Ac8?WD(D@?_+=2E zGZ`Ml7eS0*K9X_$G6$Ja*s{zqDu~fRj0r*xBEYE%Bc-Y|s%)8oS`d0t$;fL45n|)X zL0B~PL5vOJD^?;w#F#{rrBNaAAQH(EGRhoBlNiKAwwb_5U;mGNMlF+AA^VJGPvPiP z#%YYCH>>HUo4PY;MbIluEyXPAQA;tKaSr1*jB^>k4PqXX`HTw~7czdwNO>1ASscWY zq_Q*!avn-r9>j_u8imm~j30vdF^Ik)^b28S5UYY%Z(@Uq)j_NY;x%m-L98Vg3gQ(_ z;t1&{G6>>m5XWfB(xeTv?r03RIyVOKGb_I^Zf4v>9@X1k3tKo!_FI|sTJ6{##Eu|# z264nA?G2(^NZJ*&ze>|Zl6D8Nhjs}e{bER2ue!-#Ul6|r@mmo4gE$bxFFw!VAnF}W zyDLivgE$n#=5*ih?EFM1P>n}u|0$MT9+0)SA|0oFX`hqAr65i)Kbcfc1#vpb&jfKc z$JSe)h{jTnXYTNAJ+a#pGHL*OQii1aTwDZ<5b5|C8}{QeWCq+zaA9 zN1rhM6~yCY>VqI2GXFcNJYw<>K$wWO9^-WMxW)n}RdaIat%Y@T}%YmdAKUWldBvacH>o?{KM{iHauv-RmS?p2%>i0^^-U zUgD%zHgR>OgUF{_omF|DXsoI+scxc%iJHu7nW$}IQyvec64o(MHyNcQQW}_OXrhye z&L$dhtJ;`oYoampCX7uPo0(`%HandyOtfaDB}ZE^r@ky`MW4gAchT5t`)#^*thZ>ZgCq0}xWy4pj8FHLka(cQ$-UCz%;^f1xW#78E^!O_dK*I*q(>Tlv*6TMBm zXQGdZ_o;d1?DLtvCi&G!wcBgB!n)s|%W#YGP$;VUkGxPqWZk zP?%sM%sj#vH4!rrH}QImG}gpdRJ)039lS$Y3sT0hPPxV>331ZD=DZV=Wll0Nnfa8Y zGOx9mW@5UD875}Z>e%C)Z(^2-Tdl<$6Ti?Y+&=GYZfApi-utTbjfuImRNIJeO?ny9 zLt!4L5^4Lnw7|rG&E9_3-QSt?&ZM-fiL{6uz{C=oWfRM27TSnaCcbC#10yNRX%+YzOT^CU%+FO*6PX{eTJjchEg1_L|sdqJMiY z9Wn@MPAUAF(O(n$nUsIeL8)s-Ne4}2@WUpK&>}T)&BRd?$4uPK=P9<%OBGFMBaU;4W&anLbg2^Gcjgne2ej`_v|kONzAi`?0w$NoU(XA@G>tqLCO+BM#;Vq{2`=< zkS&B_ArucGErjf3nJyI!Aw5JNH_x6ggd(G)#chQM;q4G|gwSjT z(K2$Cwjxgmgn1bc%&_+#isld5=LT6#M*+5+wkM6sFT}MJW-P*3G=$N;9AkPpN`z1{ zgo+_l3ZWEd`Ad;1gitz!GF(*I5XyycuC1Ug?$zbACaP3E1i~5rxrZClo*x~RL!gi4 zRSBUglM<^P)k3HqLfsJRg)rrarv_u~5Na|Zr50C2ghHJVUe9x6@cJP%451O5H3;F$ zu6FjuA&i`#PBzp*QV5%c&^&}*A^RBJf{{q45L$*XcaWnMb>yYgI)o=Lq&AFg87bN> zg!arkgwQdB*a-(^q(Di8okQrtrFCWO#@L;)2V+l0b)T1v-(}vL3we*rB(YBj88+{S z@IeS?ES$CQVF>+0_&tQfA$&4c`Y42FJDod27{KJ?5C(=Yh>}8>POcKdry&fcVnc|B zFeHS}LeN7nLKqstun=Tve5X*lB-j3iPRNkbRHD4OCBln_)-8p9|j z%_!qH104a5YK$3WQg+gVte7E$lGRxughPnX1Qn1dkXeR3VU%r1OmMD=AxsKkEQukE zOO`x=$#}+$ykCbv6;XBylS7!Aw49REslaJm9huDxVHTZ%hp;My*&)mcVR1$h&3Fh4 zLRiSzzh#`y?U~1%@@7=`9Y+^2QjMf%)V?Hyr7SKB;rkGlC;Lmauiz?vWc-0`G6sjT zujWRs4`D+HYeHDdHtUk(KxRK>G;g3|BU}DVoB#i$ZsO9mvd!iYw){`4wuP`gnRiE$ zP-AFU*~MGR?hy8nKWuTX+~M3C!af?79nN1v_$`F}%qe;(gagbECKWI2H@J9%LhHyKC8zI~b;TGFuw1?`-D2nh-2zNQ@FD~s~2>1VgmJc{7 zBNySL5FUr{ZwUXePK8jh86`gn;VEslN#$7x|FKO*>WdIwhVY6upAZUKxUenlO$ZJP z*)617_&BGOV!_3PIGAK&%xvK;3r-7@=X*Un>_7$-Bnxf}9t&OzSuFT1q_TZhHufeSZ$ibWnp=d6~+!o$plE*?mCV3eXTta>e1uXhf zr-$q*gw}ftStyiKDr}*MMgKcw-!U#~p_ql@7D`wsW8u(KH-(Z+N;8(CU5gIrPu+o8 z4#KiY8`3LSsAxf_!O1D<l*0}p6lx@SEeo|R z)Ui<4LVL<(p&sX@?2Vb!x6pt|L&iqQ)V=LQ6AMi(G)pQiEi_N^7EJzWCt6u(ZJ`ZE z+gfPHWYv7Hx4ob$DAfB}>d4~976w}AWTCT#E*834=xyOWPU>c%hlQTZyE86W;-$R3 zEWFF1-v2ADz35}1FO8Um{+!g$!uu9JurQQurY0?ywHF_8Q3DvMw3!p__8et{L1b@X z7$<#V;ZqBPnGa$7%tA_s|7*XiqxW+bzqByQ!f*>;aCC%)kxZz}{2fFEwjXU_jDfkg??F z{nBF=j#^Tj=Hf(J(@~y;g?^)@jU7bFIO!|u$X4e#M)D})Ut5@HVVMQGaGOMn$ig=k z=31CyVXB2$7M}a1X%?nim|rKR@c2{@gwy?B(b_ z#({$z`;(SOEgWEekns@X?~I2Tk1$e}jB<`yIL^um#*>Vv7*8`&T~z5g3+FA|A+Ol# zykOa9Uljf%=Re`NXyFoh?+M3c@|JzxD;BPj!@QKPS-8Q3_;m}52RZ&=q>QB8v~Y{d zA)TTm-sUJ3c-O)`8aJ-%iG`;Y{<84E!b1yxTlS|j|7Cn+;W3Gy;~xw3{YUy*C4Idy z12aBt`OLz949ATt{ z5$a!h9?ZVj_dX+ZHvS6u!Hc1 zktK{-aft$z;|s$dw*QaF-BGmZD28?v*}_N*W5PHodzhZjW>06HrIU9lJR%Ijw;98$ zv*!xi8*-5_iiVLpjCVMiCyatjC@C+Kd|~8gvPQ~YAV~@(Z3c^yR^R%$S>$-EY0ZN|+V1=&-m8%8}=h}WkPX5NsI3L&vc7)`1DQ6P$D zVKk?a4`W0aEy8FS#(*$Broj)Rbr?Ou=o!YBYu#Kvr7!!sZ zh7!iQFn$Wdoa$A>m=wn3Falv{Vd!BP_HapGg%J#6n_r5A5#{+c8AFT~W0;X_D3B+_ z!kBo~9cQFyB8;&~P9FsSqLX)Am>zX`#)px&lbFExH5o7=g|bWuV`>=l!&nf;G%kEL z<8($cm=VUzB%eh#j{iH;o5SKaVftOXy+*!G+RS5OY)M-f#&@(*#!73#*s(u-Q5fHc zu{?~$_D~?Q zmaC%!$Llm{eHe8D_ONUTV*~3O!}vLjU&45QlD%*?he3yrO(g2l&D@^7AV#vT^Qi~<$)E0<5={xE)HPC7+1%qaVzFs_Ah zo&1d*<1lS&Tb)P3I2y(=n(-rP=NONNae~Q7#pz5XQqW?r`)j zBkA{;+z(@5C-E0^B7cYRi21WH{t07s4(Ul4|FZHpNhmMrBtB&WiV`P<_W2iKcq7OX z!OJiboy4m!UWf4}3`Ydc2wV}2*_M{Vn28aLcZ%D3<_O;6C=LEDWMA7!^!QRb)JaGY z5V{#Xj1M}AtPwmvpI$wJ8WH#+@JEo!N>N5i$`(Od1lc*79zouuE+TlFc@D;$jJX(d zGrq%^hmp#;>y`-fMUbDB0*nP23o#aEEW((Ps~Gd*j3pRLMo=n((#$I|mSHT*SdOtg zV+F>Haw;*e%vgo7Dq}Uq44aw}4EoD<*IE(mI^-l?n}*sgO&{&46G7qep8R{#>POIk zhNyrPjG$ozjUxCgf}s(N%;jkuLC*+!F>k`yG=gSKD7AS6Eh1^c$wHxbN@;9C;+I(PK4pFr*EX)_VFOoIR6^KZxQUL zLEf5nAcCV29E;#!gnr58qHrjJ-;?}s1V@;gT?8c^kKjZEmm;_v!N~|tMQ}EPa}l`n zd*~E&)0f##M{tH4KdXy4*hQR=;L47)I%l%K+ZY!jxJWzL&a{hN1O*~jBDfmCy$J3{ zaE*4h;nK|rZbfiCf2ghxi%0lUsg~YqG13Y&V zA^a=a?@lruSUpkO=Y3Ilnb74%mJCAKV-lTo`J?dfa_-LVp+%7vMfNEAML~b6OlJ=1 zQB;YdY7`=hx1;t2a*im9G07Q4E+)C7D8PhL-(ix6F>e(4m@F@a{8Z*4`x>?&D}@*- zT9`?ZD2gT(GA6xv6eXf48AYk2UY<$mD9SJ?o7BrO$tb)6^NLYaVp2J2L#Z_2hw0&O z6xE~l1=0O)yfvbz8AYuqYDe+)GpSP)b)xurk+%Uy>oTWky(sEOu{*m&oUmaO*IiPh zC>lr6B#Nd{w4?%~$p5ST{D_j8u|e}FS}@61GCPS?yNcFP93J6m7e(oVX>Fny-ZFbz z#%1^2?W6YA-64vOQTVpGdUX|(zV;Ayj-pExU86WqS}O2cTCXU&Q6WP;-J|FcMNb;u zagLt{*>!Ua1=wL_$-Q{Q7BYJ6vLwUoT6#c z2*%-z75QP`7t#NF(l;`SFS(neICTv3(aBVqqf`Rr3Phn%FUX(sdq~lvFgevo78~R! zS%#waDeW|sZy@huAF@1P9`zhqy zD87y2J8s6jDCS48Ac}?5&Te8a2Qnt&>~2RXbx{Q%h6dTF6qu3n97IKCc(l1eLqS;yN9y`cE*LM_%Z{;LX=;Dr|gga<&iQ;$iz$kXn ziiqM6Z4NJ_J&cs=Ad|g}`xt*^{Ecxx{#WHQ9O#`AM(Q}-bCSu;om5pMD2TS-MWjXQP9!<6;JfDDE^D$dDOmX z*{r*G5yk!j_9}kKsiY8pO$+&kyY~b8?^sh}Knx$nFd&9ZF=URRP7Gg6^S%{>Glmi| zl#Ia@gA{{^;q4gQF?iS@Ee0Dv3p6D9Tl2 zG$X^fcrq_#DHTKM7^)=g%fwJV$;-x2?thwEA%==vRHYayvkkSJiY26Ss>V<)hUy%x z8AB~LsF56p+N@_-k}>6~%LesgsL!N941JkU3meAJD2B!yZ4yJ97~00rG=@tDoXuir z&U%X&9{Z%0%!#z(R3fceC(Cv*w2z@{4BcYrz^R?tn36hjv{MX!9dS^!OH!vO)!sdZ zcVigtlZf}=q@FSKieWx0gcN$m@E+R`@544^-;c@rj2|$5m`v)QEb!wP2F4JL;c|*& zPz;|?cP4s*F?<@sU~+~%PC15suiQh(p7O@y= zh+$NW{##5MNt0eTJB2UVfXHYjV;ISJOmRtx*)Na~S7QjopvAC0Aq~2prpI8g8F31c z?!x3K8HYHF#Tbqu!i0_*loU&r9H+@;K9=#T7{em<2_N|7*=quN4p(A#L#Y;_s1Ak z#&Bo1gZL`SLWhj*f(oZVWG!d>iE$kx>10W`o}(LL*qF>k**DP~(adtv7RH^7TN$@8 zZjWIH4af<{N$y%kUAs7GcMN-C*vp(sqlQuVm7`~RImq$=a~h3fF&t!mi1ByE!;D8_ zILd^opuwSBG)l)~I6)nc;S_hDlyfnhPVzG`oK12X3Q9d60}T<8OXR~bG>D^N99Lqv z8pD4yH8EVH{b#fDSa(5qJ%&HX6JoeYJ9!Kb$%lFRsGav?_>=i<8f0$O-DKPDF`*7p z3(4}Yr2aP(5}#2UV)%!nk7IbsEhPP4R-Q0Y2WeyoX}Bo7h~Xt|>2bUj$7iLbSJd*- zSzgng^SK>;!%Dc6#%~?Ill78FG?k+<$r}gZNlKHr?Nm(}o5k_*aoel~k3Si-jH6W? zt>b7DN831h#PMEdZysH0M?>*#_AYU>k7I(%(;<$I+?Y;rbY?=kAGMi6!AdD)*)@)C zadhWg8Q70U7lTEVX_ElRrjz}C)^5>WoqlM5@P(_p)k0TLB z&7NXx9ACvTE{-Xaq}`j-#?wUa_0mJJNi_Izd>zNcWS{}>*V8`x`n{WHa@@XfAU-vY zX>m;FQC$_s>NsY^F_WXS7?;H{JB~SVe8bU&j5GyvnS9GQk8wWZ0>(kZJ!JD8^F@q{ z8J93FWeoNd-!mc0K2%-1t+VBE;~ zGb5G!3zJQZ1xjEmll|l*acpD0J&qkrb~5gbV;2+3yE~3O%zxYCr0728za~?EV=}F$ zI2gyFIL>nP_hjnHI1a~ggri5}IF{6pXOWIGKf$=Rr=XH4oQmUg(&kJYl!e4|ahzwe z>sK#@3vv3Tp{-N66vt)eSCY!rIIbo6bta*$-WyDAGTut2{>kJv;~mDkakQ)HpknXG z@mCxV;&@0qNy0wKq&4+7?M?}lOW;u)|HSb)jx0l@lmw7K<4MxL39_fA%#)1YLr8%mhDhBKSo)dNE`jz5bV#5h86@nZ zYNrG`bLc{K)wiz)DG(XRoKh)D8M|}#9to@-@1SU}1l~=ccLMJvFf)N!3G_*zZvsjJ zY6ATdct3&95*V7m2UJ1=A0;q=i|S9~z=VqZt(W*Xfq@AOPGCp^gQ%UH`e_0iUfR#x z$$$tUaSEho;IITfPvFZ0MkO$uW;}tB35-bQB|>Hy87VL28lAux7G<`fiYR21Ni_x% z&}cy=Fg5`_0fWXNfp7xB1WYyyaeF8Wm6p+d$`wfk{}W zfp7jlvc3dtrt*J(+<49Vj>P-E#}b7$SqqVnC`kyR>}&RY-w8#$XJ*csnKN_doS7k# zLb4^YZ`l=6p+!kWS(7bGzx#Zq)Ajvd|Lc0L`?{a|`8=OzJ-JwLw4!=XGB z@#9`U4(H(r>#1U`>YT)Wna2lXP(;PiJbabsC|~n<@^G9>is?JsNjZ~; z6M6VH58vhC`#k)bhZ4ddCn}^@?@JAlbiFhjy=ksuZmYtOwdAOK|OL?f@S-C2BIS*Ha{3+P8v%(~Xzuf4x zJX{w}C2hkZZsy^K>)C&c|B>f2Z|C6-Cu+BxyPS9#IT=?nW1W>9ofVIYd@7(Kzluy1 zS*p_;1q2HT7F3a;V(Vu<-w_YdD9T_&_Y2msLXrv8LdYg0%$s>-m)GJR(&`#nUS4s<_ix;RT9% zQc#&LO1GlUxHnMotcoToUR1%yCmO0~q~hiBS>F}Pq5&Txd`|42=lsmhYApDIih5lX zM&HaR+*HL&Dw?TCZ14>|=xMH^g^IQ++R=%Mma21Q;}t<(Hfg1zweU7`9Q|K(Q(u*W zewyiR-$fbH-1nM_3nAx$4fZ5wOGg!*RCHF+MTMavs-mlkZYrPZ#~>BmRXp)iW^chB zf;|O$2{P$*Ax-@r@;)m1x_Un${Z$Nbm5E)H!77HR(D(Res~D;VQ-p zAE9ETkWqr;RE$nbiJ_S_FKWXMVz}ZbB>BUcE#olRfS(gKt=DV-t}FS zpbAYzSmo^!=qh*@CZytc7lna@QIZmky`z51{i};ozN->bVX9cF;zJd+rhEC$U0j95 zsmLLg0eW9Wl7*_6uVMk`?LJTOHNLqj=1J;1Dj4OcF)-;}5y{_Eu~2MiMuSD7r?W8i z0}&UiSRy(Nn0J|qk5sG{h0lC;=;T>0e1(dYDt-%iC^D?#@v(T^o{jcZS($F0nD zDn3=QUIjUyFl^dY*}!?F;-ZR;oVVLDHmTUGVhh(3&TSQ6so2J$sp#FIVyBAjDyFve zg^uL%ui0nf`Rc)p&sFSFv0KF+Ib`;#*vDDXRT(nQnXda)9AMH;U%0Dt{&0}%d{>2m z{0r8EI~Uc$Ar*&dmYH=##g{^U-j&Tj;*+jL3AEme*yCQ^(U9Omwi`M9O|n4rQ)iJYbvfwU)@mgM_16#lm$ z#m0{oDnBCYHWwu>AmhDvRs6$--}HL?m^0Fw6mesRkAQQnV~C=U|-c+HRYemv~QBYrgV zqq!fCN@`6%p7f)FACLKQtd3`29Zy9+D*3U-=dJ8V1E05=A63MXN>xAps^j>l{M?WI2(#ek@ehg)M{pccMS3i3A(bJD^5^c2A)7_6ITRkMb{CM4u zK7RD|qqlSsdx>>pAYobk{21WJK*`u&knJ7hl2dg&?9#!0q{%QphWjzqk2m}n;m1fn zCi*eSk5PV%mMmih#|W|l9504(5*;tdahxFIn;y!^eoPUaHKD@Bl1%esx*u=*FGyQmzCyip0Hk8Z5;3;DDx*BB{GD>VOVrlEL{gf zvPb=hNgtXLO~`zU3%3MqL5^Lkt)8SGyQNF#ia1Y@-rn(JzRMT*v7(;mU8xf1>LNeh z=b;@y{s2DkJNMXk7 z_*DX&c+a=WkE5G1RttX2LGPxl8s}Z>$2!0B+Vu`UKJ{b0A6xy{CdvjsZtTd|B)HM< ztT}()^ltWJizwu+H)qgbyBOE+?;&SMzrnpz#QA(K)NS2vA$$DT>ndI0IUxKCKMn~w z=*Q zPW0W|G8ldk1Co=jNaIs}{OrfCl62bDe~~E7{xkl~4@PN!){o!)_`{ELe*DQ}*^l#n zT=3(P9~>Zti#(j`dD5KZva6H-<;PWt-VnSdcwOwd@X~U`58GRc-MgWBZNCc1!z#Bkj0R8|10c43m zjR0x};0vH|0QUsYcx+aY0PYQ7b~lCB^NR*hjLrjiIDl;W51?!S{kCM}2A~MJPq26Z zC54m_9F@;Qn^M9_M&$F94xmf`_XnI-Fgy?dZ5YUzTF$jBFXX`hC^F+C0X!;7HNgr2 zR1)%-APp)Cp>gE^s)%#)s%|RzwWtpM5w&>?`@0R(@{tRFzMjgRCh ziPjN(I)J)D>IpLShl8GH0%#DxvjH>=;Cc2~02}XS^1-u40X)avzLKf0_f5^s;)@b5 z1kfaaR|2@(O?feZrUA4hpY45#y_b{KJb)Gf9PFkv3t-A5=by#P(gdF8f8WhH`Qfe7 zRsrYY9<#KTjO1+sXdA$FueY5TzZSr&5@=tuyK?MKcF#uW7(k~0H`4L?+WI;N&?SJu z0SpPCYXB1#`+5Y>Q`~kF>@K*ruBR6rvZKT;&3Xr%OP75DD8JG}!q8WeMt4{G2QVN2 zl8y^<2Z}gIkWp4+XaK|5q5w{HSB7&a0~p831TZpy>D`sl0gMsjQG!$$#=3PNf2Ff$ zQFmoR0FwgP-CZG{D3+`SQzr*7vzv33b!q@_1Tc+0#cWOhGdQ0Em=!?L^}ajZmA3*Q z&J?6QIqUW|C$@NFl!2BkA};_{YD)vwnMX}f4h>5zH4bZuLVCd2?js}^4j>YMAv`J= z4yrFtl-0Okhp4G*Y|8S^+ICA_Nw*pu?T!y>k4%nx8e0L^+R z?*_0;ie4DNdjTv8;C;5Vhr$=QJ_ulO0O4kZ>$J;V!eRY1cd1x5isWqi)Z4L#@}WdY zJ`%EAa76$sC9r`!rKhXa0el?5ngBit;BWv(#Q)j=wgs@Hm2X`Dp9ZjA@@@*Ceuu0L z!Z!+5&T@Kka{yZcD6-o*QQRu}@UAH5$>Eb`+XL7Uz|H_Z3t(3O`z7^k>73mG>K0TD*^1Q^+_h<2NAYp%gDGrZHukt?* z54W!ZAbuS{`q8r1n)jG=@^Qfv?DHPZNj1ZFqGSfLP6qH}0Bu5O8^TW<{Qw&2cuvR9 z0i0&H2eBxKUjq1*rEJL<_8T@p9f<0h|lqd;k|j zxhi;3@RHzVL1y_gfGaNlD*)!Dcukb+f;R+j3jQrfGuqr1<2!d z{6fz3P$(9ZdS(a~3c?#irto_OvjlyDETXWGdx9w9D)dlPI7zV}(ly~pNN&*SnFoT- z35gIu zIF=2BKkKIQfxyA%a~lOgWa&Sj&uwxsmyaDb4#G1z_XWYSCA>|8;Kx}z2hk;nmx5@< zhUa>l2hlEwSA%FlGRpgM5G{jf#kTZR7}^BUI*3;!$_}UUa!;l0|3qI4qJ0o+v%DYm zREG9c_!M*p>5yPgrDG7Cf*@gFt-1!$O_Bx%(LLzwgV8sLenIpIq9HfwT}pS^N=ShWXN0}Iqgk}#s#e)YVLHL@Y2c)3v-j~d^WI` zk_uw3@OiHCP7w2jFAyBxOL-kcukufRvi#Cq_-<#3Lf;c6X#|4>mLdds4d?)04SN}oCNx>hvg1Nf$cGA6G zzFYlE5WfcTtcHdfehcCZXQPIq8qNmsdl0vSxWl8Pm-0stmxK5-h;tltQFtPBft|2D z<6;n(q@EAIt}swxxDv#*Ag*&Q#%*x| ziBAJ<81B(fSa^wbzO+(AqAawShHMQ_XsE6sM?XY?=O@8^Sbh&1|pS5 zG(4)IiiWBhDrk62LnRIDF8X2KiuBW4VY`Tx#T5y2Rnwd^Plm^(;j|>@32hAxHKj%M zH0LzWjl?1ZmJfvakt_G(1PH zp*y=*Lt_o?G`yD;O<8$4uWlv^i(vC#)||Z!TWV+} zB6({mtBr=XlJtsTx+mXR;$z_HG4sBrp_AsEUANcJK|@E$mF_5}vLRi2E1fkEy9jm_ zq@NxddUCupjMUJJeW+ou6x~}x9}WFA4A9V5ys-!R$pjQA(9xnq+9K|fXmGK+`4WosR(J)rSIM>@g$@k9+%HN2r=l7`7L#8cej z7QXKMQqbo#wNbAcq=Z4fO zwoAiD((2_JR&a7|&sfP4>!b0W?2cER7aKq3EZvj6o`XK!dE#r0=Dg?liH2=n?^+G( zG<+)AcUC~Gj)&p~4I4FV(y&>>XOgrOBJ;(F%y8cv_d z{DJGq*et$nO{CbQqSHk`aiNgD`dPy-Ja_}nOG&4Br1W>zv0ue`vDThMQ=H|3#x;t| zuZ}-7oYQb!!wn7RB|CFn(QrY-MGcoUT-NZX6wQL@Cx2)0}HH zj5-b3?7UrdlQkD_e`~lUljkhIVENr3+TwuQAkHY z9pCp>7+9!RN2ZR#I_}YtrK57l;}b&rbluWB!bmO2>Wrzum&p zbNF|OZ-MDhbQIT7g5Gvyl+>LuVtOXJeo!O-a7h<(#O^HJ__}I68-ve zCiwv20|f`^_@Iw6Sojd(G#JJK-Iy_4#|RxGb&S$6ofAg!j@I!-A7#9b2^^!MSz~mJ z)iI7q4|?02&AjqO)(8K1C+e8QIh^Ud0zX;$hkx7oGTjs%Q+50$?R`VXG)ZEVp;%vq z_A_);>#Mve$k&j$!vO0rOUK(Bh|%8JI^JjXbj;C_r$g1@*TFxMDc#vFHK4=L5!DgY zq3O;}LG0CTeHC3th?Vcl_wNvq63H2u8q;Cw+_OC=DSBM+y}pXY*{fsVp^OA)@<`_! zY7C6>uMo*x&iRtwc{<+FF<-|59ZL>oFVyj_j&po#Y_ymEt%wD?c;4ecZ1gP>wn@m{f^!2uonT)tn5pm>l!0V00E^O# zspF_js%Jv@ibJNOZpfKqAEkWX=(xpiC__%<_J(;}kFQ z2>(IHNg>pK)bW$c**{hKWOl0R^xiCUa)K@tpNJ7iv)4YG^xU4&G zf}hjzV_)Swf4R7I$Y9 z6p|rWNbvc4y_rI?1bu>q1?g?UArJ9hiIxqaXb8nZ$d+jF5K4rQBRto&SA=XX;N&VP zytH5`!TSWcc{NkZ2)|$Ofe`BSbN3kjClg_KX)oXyWo0g)|NQ`_?l(G!vzH2rXQjmxZ(p zp_Qw&4&fD-^PS~(A-u|QF;L9FYaz4`VMho%L(U()4k649Ij0jHL+B(*XQ}fWA#@3$ zt0>(<7#_li5W2G(A@mfHc?X5iOZe*{^cK=5g#JSM3icD+w9S`3{~sXHfgudt>?ngJ zIz(`&;4s1TbI~J((`{IK2#a-ZS~o0vn=F1*K|)l&vI7#r_2>0tmNz}>RrVH zxf<4musVc~Ls%2SCn2n5YS6R!Xcm8b8NTnQ5UWpi9^m;@I;3ALm(yuO2pioQxJk%n z!7U+db@go_Y!}YTb7FrM!mbb|hA}CO-68B7>-{Z+Ga>8=VK1X0><{5U2nR#X_KaM> zx%pCRYew_7zRyEwb32nw_#%WuAygjkJsiS`5WWrJNXWTH%3=C4grock2*J}|`C9N; z2;T^yLIdJ)sXxhgA&lRg{Ua~+hnzQzz8CyKQcrRg$!kQMC#T3mIL!sNzjCZy*3CWH zZ&pHRi1!zE;}Gw!A++q|Avqhu?_7JsC=$jWtYItPxe(5aH}VT1Tnyov5?TD`cqxR- zAzTmPMhK1jD}{f_{4<0rA-p#@_b;*Mvo}{mxW?*9ou^FAYA`g5;!XBR*g1;-4&fHZ zy}xohg#2L?2s`{v2zU7tAi5`vd|@E$OkE~1q{;sNO2IJJs$PZ+A=Jq!dc$~#`+tTp zw1qD#jBkp2ePQ%k>nkiy8Xn9hzc-AcVYCXPbr{9M$PVMVFke+bPT08~@<k08^N+qv825+qKp17icuCRGwrIgBcEr*6NO!zz*Q|28Z(UD<{5;9tFjNn*7+Kdx2UT{Jf4JJA}4owbY3J3zg{M=AA4|=hl|fdUZBn0gVSF0KdQrFpZ4$CUaHHT_ zzlZu};adc^hMm9s6zOU^=X}8Fx1C{p7RIhH3a;=S3ga+;1%&Sr+$*>*jQwF85dOK~ zK|yAjzQ^;$|L`MWe90-A>n#*<93Bnh=P*u(@fGJe7qKvoN$O8w91r6}7~hBSLm1zR zXzuZR$EmW%!|Z9#Cnfr$_-870rZS1-R2XUHmoR<}<3<=a!}yJhSQr<>xD>`&@%cv> z=fe2iHD>nzJe&{Xg7}XOQ0VY-7=KFiS{PTt_$!R7Zmn1%%SwlI-LAV;`a6tUVpbr6 z+Z;8n^U`pd-4$>DNNT!JPsHgN7KaG(3;*Bx6pSFl%}bq@-Uu?qj66$-Pq47yJ%Tfz z^A(MtSOj_mp$M`g$cf;!2--)GD+c8S=|PF0cmyRRS~7w%LQ1)*_eD@z_^)R&Xv}bb z1P{2WWg{pj{KRsn^B;`hp$Hz1;E@RGNAOGpk48`-f~pZz6SK!6s4S#n1eJtvrj3+F z5vxQ%oqisV;E4#H7G6Dq8WGfrpmxOhm8>Z?Pe$-xE@pX3lIn;(b(+x$^|}$%bH%iM zg9x6D;H3zfiQX`R=ObtwK_l_NjL(UGk{4X%MIlY3MCuGpMM)RbT=>g^EnK~21g(U( zj^I@xtjsGBv=QD`u$^Gq34Nxk*CB$wQn8K^bc&#J1a_{shagFp2)eqwn~?4_+v8yp zLr+n93BE4aTd_0*)Z35XaqgQ^Kel{ zu=yO#Rz8Y!NE{>jWWli!jEi8r@Cgx26a(5!5+$9B*8y0`DG@OH)Ck@XZ`=ZIn%J-h znEGY}Z$+R*Kyjw%c@d})%!=S`v7a5m9MS27ZqqgKi<0&eh#=@DIeoIn!$1<2-i}0I zMDXPbXNE*0&O`F6B3KqT6`9EhcwSekXU@t23ct3K zis1US%()RLuQ_CX1PdZq9Kn(Z-et9qW-W~1Jt1Q&Ix}{W@b`)HJxu*Tq9mg|SxY1M zFoG2vi*W8T!H*(X9>IOx9fgF*z|XZ4SF#^|c21r@j$lm$7bCb7!6y-{jo@4aKVHmU z7s00y9F5?s2-ZiiA%fiz?1^Aw1e+q*&NfD{If5+_Y^8k{&*sryA{`R9F=@1yfzh49 zKZ{_Om@z4Blg_d?f_)Ku5y7Dd_D66af`bu!E;h9M&sEwujfW#R!ftm9O_!B6{yKth zs7LTq1jiyc9>I4Jd@mI^5y7`^(dmlO+Ygd-Qt&@NB&Q;0F1C`5SU%|h^ z)uOzC$_Ao8 zzJ=|KU?-(bdMG<7?Ie{YzG`6CK!v2efexHwGDA8V=wzU?M7s)hF~C4G8gvuhU7{4J z@ak4i!@0)A-QIc|=wskZ14j+?HPDY{1`GrJX|N)5ynzV@1{fG<;2YC7$iNr_V+|ZR zojKUR5CcOE>|NszDWiqbIuG>$fp>XYTyk6(+oT_Na0OS?n6GEEsEyM5G3I%elrcs zGEnPMc50BqYrJn8@EZsin9b~Qx&9+n$}^w}SuMAXf(F_SQo;t9OJlnRDY}7>;cS38 zynRly!&%nGY#JK68oZ^AZ;j5VQE9XNO&uIg{NQo?{!YnTX z32!HHBHbFKoH1~gi`Zc0;tCJL9|q2`GJj^)9ju&}To(*y+r#wpsFw^}<{>8fH3QcT zToL}4;MKJK5od9@Vc@2LTT)L}^>0Zcp-4=VyN2^%6+?ljL;jJdM|i#{ASAyaQ`-$z z3JT9~l|oT?g=Y%VfM$iGxF?GHqt5It5_NtNas}@dEGk$`kV)B5MqIf!ry5gZu6zRYuW+5kGpfPjR z7n^4U8$`het*JMP;<+fAM)8t(<__L0==mrbNAW@wO+ z)R)DWycK&XidX2WOjesHB7>cufYF1Mwo$Z;;#C>J_EB_*;x*yisGOtOQTlm#?cDuh z--$^=8s5(B5=GZ2y0O!4=XQ^xR}?)Y^pq?V8CV3PB)y~P6Gh)B`bp~dtX>oYqDVxM zjACH)-{XB`6oZ5h791itRB)K!aKRCRTq5pl@r;UMbQEJmnGnT9A!7x{362*m)Za5H zipf!^QTRFTQG9m9Gu=&^D&&nQrjhJ*7EIdDh~mvC-il&o6mLf{+cjp=tSE@Itg+WK zCyG2S8aJG$eHisIqwqi!MikK~g3PtjJkG8t=0~wWl%-L;E98AaW?2};doEuj#PPN<;{)M~ zqgdjmUf<*4BK)C5mqqcBt1nNJy`EJ<)Y z-5{A<1$uiqC~G%YPXUi$V`a#6vo7+TdsuUq$hC6yHc!v*xVfu_%s5aUzOu zCF6I39AXYM^QQ5KC{9N4qfG2GQJjt9rzkd+_cELk^0VOSD1LGEUxoZ8*r}oCcged| z{{H+C#knZXM{yyFJ5k(a?`_V$7{!$+{t~lGT!@75;QCX@yb8D~uC7OML&!CDX%|nr z4mYE?C1!t162({rXIZ|@IV0qsC_FI~jyWPz^Tm)6L!lTDLw*qp#85Eiv?y7@sZ838 z=#3#$^t2xuWX0eUg`Af6#84!Ldt)dXL$>R`Sj?##v!{KML#-HU$M6Kpt)5doh8i*FyNyh}G+3z_!;>*IsEN!W3Zo3PVR$MAa=x=eUPm%A zS~mt>wyGysUy#vfVt6zwhvZqQTf-O{#qeAV&&SX35sOWM+3@O8o7f_()03UVO&akj{@Nj@Nk zfuau*9PHZAV3_dHg2Q7NA%yzM5f~|aR1D;FGDf1@mSk)UYvG$5!;~1N#&GLK=7U2NzHOKNY0h-XMOQO~aN4{X!&@=Tbag$3S;F6rVYZMt zF$CPyJRz!}Uyv{S28C#X=@*bg!dXft-eo)nV^|);@Xh%=k$YE&S>GWF`6?c& zF?=iv4~I`;SRugnupgjo>jimHl=?__wa|osh*FeLn~}DL#J`Y##T~p5uE;M(t<8 z(}KTn0$5RF8>& zq)?irQ`2S?^PB%F1x*xiIn6Tuhi96|GEqzvpNYaI?sZe|F;T<>?dd9w^juU@|0^q7 zqB&y5(uCCrWwY z?6l8jI+slOzRV-^X`)sfwd1H@a!)6$G_lG=MH7`wOf~U_>3pNMvWa#kUNuq0L{$^j zOgwHn_YHZa;t3PgP1H3}Pn_2ftZkwun>^h+eyH-K31TflR_`ejby%X9G5WNL6+@ll zqP~e|Of)g^B0Zb%wJG$=m)Xyoc-BNi6OBx??Bby~`c}qs!kLB9#wK1c@pZy^Q|6Uq z&hp7wO-;OH;$_;fbGGI3WvCX-3pX>-+ypnVVQ9hrZ(f+>o1w~_@!nP@TAO%9>eI%= zl8f2zm3MyQ+OiJAoQe@&Go4j*w23h$+MDQLq9b{!tWG96(`}i;mzVgunCQyBGBL=_Ao*0DcDO;Px^YB=wqUD|cbI*ZG?6kfR~k+~^W5y|)cGbBn0QyjMJC=CvQY3n^WXcqA4rsWKQyt}WP6N_`!npnrK=F(*1Qxoe= zd`9G#UwBw8^f7GaK`Qp-n?z*ZEhe^d{#Qos7g;rCdbe?OhAG=k>@cy@#POEiLHl!v z8|vlkGO?SvHfHZJ@vVvPOzbtW&%}Nc2TXiv;;4y(CO$WDnDcg1Mr4@sg^AU}l;zu; zKct7)hcZ`>n9f6Y3=4+iD-+AFXCD(J`P$^wNJn8{mgB-t2r^3XdlNsHIBnt=9wV2t z`P>V?xN*|Nk1Tyt#!n_ru~t$F?SGaYV|3C^->+P~FJ=C2;y2TIf9L06${7>Hvw}4K zgNwh3^Cm8sxMbq8iHnk*yufgUf$x;jjO0(zNf^D##h-oE*m(uxx``Y7X^0~;j+Pobjz{8nFph_$sx%I0o^+P~ z_@k}|Di!0XB+;sZmE)))gt`99SWOfbN9BpQbBV8d9Q$4`QX}qco={WpNx@E83YDkg zs1wJOIIj%j={V}f(Jzkvanxfc$I&s4PH{XFM}s)p#?da0XX9uXM>F~y>un_XqTq9a z&kHsdq`?buG!Z`GR1TvIP2+gUO-+l_XwN{0uL^JP zDz6El&eRU#KW*7Lj@}}6iKA;A-Qwsj-g-%`dbo9?^PX-gtl{e}@8kOK>-rxM$3Wp@ z;}|4lSRBK}ez4#W!J%#&M~Dr5juJ9bkj0G_voV59P1k%}9OG#a$3)TDgh_4<$tO!* zTJn&2gYzVgpzvvNOqa>CcSP=tIL>k_={VksV`kjh)?@8AIo}4nv*LI=j@faH8LrF` zRO84K!kI~t!S6=3IP^Hai{tw^LUDxS*b>LqI3jTvaV(1CeR_@~7I&^B&l5BSlY((U zOVExZ5y$VBbDe9>f+^AG3by~s^NtXv&KI&Ej(3GDboKY*I8?+-gAd|ZEaHYZmc+4C z_}Vx=jAL0GpSboP#j!GuRdFnLl@)Bx@PD7RULD7pI2srBGJGtAp3{U#zRu0{X&mc? zr=Nmm(#AM8iL%+X;S*)lxAAaeCF9sG`i?ku#_?GkyCk|Vj=D7MH zj+1c|vyg2$js1~}KpZ#X_$iK4ar_*|X)(SW$1idG8pnBw((*SUzYCrbJe%hIl|O`> z6Kv?#`9d5QMY$wM59ws;Eff@zVWE(a^t1h53me?|kY&LqNz=Y^27=)p3q?dB zzt_T<;Yv|KMsq~J&q8Snxxy8};;wxOAtf!8a+Q1|lrk=V#KQd+9*}5R!3PD)Stu_g z-9;?uA&EY0{d?d%YN3KCk6EZ9gfuusAD+`3qvCdyl3&WMC%IH6RdCH8O!-yZXo!qU_-(B z+nlowhUeHodH$`j=r0J;CyQVzF`Y`@%tCWXC8yZJ<+N#Kp|$0_^553RD;C;V_}0RA z7TQ{9XE`r=TNYjw`*9Y=i{)z;+Or`RI$G#tp}&Oz7CO_uozmNKo%7P?#L zC3$-Y_O$Tm2!)>#%kAvcko#$T(>aE!ek5QMkq5aOtGAEzZsG=m7aSmZwT^+=`<0ivmciF_(mZe zzA4IE7EX)*S(dXS`r8&}TbN@Z&w^^fZ}G!_-X1?^=8jZW$>q)GM=Ak!+DNBLLGhru zQGU@QWFc%JBD!HAX2G-&Ww&=x#?0{M6wivYwj-5IBNc8(Ll5Ri#kP>JkhGApFwb)S zsm+z_B>daLK=O`-`4$#fc-O*q3p*?VjF1N74!fFd2i@{0@t0W^|0ZYFKMhqg0AM~XC8uoA(oX^Ty zXW>&0sD&*S*7K0DJsT`+Q8d`NlH50Y2h=Dg@wZwc3IeMVZVg~7WP=!EB5<1IU8Z!2+NSI?jd6lg z{c!d%9)np~#|3Ft`Brvz>zwZ`{J^8$b}kyQ+fQ2f#lo*LC_h^GiEd*)ULZYX;b-Be z1q*KVQ2&h!AXgsS`KNG}i;{)EE!?v32fNO~bqif4dAVWQwUNqs3l}V0lqOuVaG5_e zqm(B`DSvVm8l_ydaLvLM3x8S8_x|pj%pNt$nQZAtjMC2<@yon7B>PQHr(LM({WZKAYqkxTqHZp7!5}ipb#VnLV z!jL9Eewv$QJFA&b@R8Au%{?}rZsp+}OnyD&rO`@J8#y*|Z4|SSZ94}bKO#x&J6chs zH%bb!TZ#)QA;^rSTz$6cDP!Y)8;{zkVB-OC@{kRBC@Z|2jq)}g6rL`E*;xet20kp} zBVtVDF&h;{sU(%52ii0BgWKN9w)1@@lBzbU*?8Q>6E+%3yQ<4Kzz-u2dy z32?KlGqt!WVl5lBZCn_wJjI6FsB5G67^RMlMq`w7`Eu&nsBhz0@$-z01~z!>nHe{< zc94M?i6h1+jl||T!RG}V3%(%83efCD8%)gX3&5=Q{V4tXX8~Hui4;+NW*Llx6$5q{yTTD(b0CkIMB&PR~y}gcec?* zh&e`KQg<8Um-_m!V{P;h&S*~?y;u_)y+xUL&_j`7nvi}r21z}s^tUlUYz7LZ4X6*6 z=nz&_NILHb8zXH@wlT%VDBD>B*Nsue2pKKNJHlgajI%+#?Mptssx#ik1e=ctW=*t_ z?Ha}i0H2jCbbV#BZzwGp#1 z&&E48OdD}l)keyOWg}~>lCaTyrkBKa2{{!8Ds#mqojTvf0vn5MEV1#fjfFNA*?3=a zJuy~!k286!!oZBg4e_{DEaZd}3oQ`=2v}9h<8@@$+z3a9vizjfo10wp1SO{ok#xm3+|In zrWrSHVG<9A&pGZkzP0h4jYBpL+xW)DF&js0d}-q=8(&Mtqnv?bo%eL;$|2o6^q=;? z=y4k-Z0D?)oIV+t#OU`nez0*;l2|B}SGb{sMCppk&o)l8=3|vBHh!`3tBtcZewRve zSD)W(OdsoPdw7P2*n(X0KWvza+5T)u2vmzpr?hUl!`Eg@8HyGi71=|5cj6Syyd(g~+C^CggxK%oSXa9#+? zFZlEpUx5UO1ryF9PjB7?G84#7ASZ#W1bhi_7od9+D4f7O^fOi|k^pN+WBO#2f!=6S zR7xo($USEmauX;nQ6+)oVrL^7`Y(|{Nr`f|oKgvAM;+?)RwjY_6R4U%wFDkWplkw< zN#1e^luzIh;SVP8kdSKQ99MV7Di2GPgq5NAXaW^n1Ny9(KqZM*rjwPPD$-5xejNq9l8RsyvXc#3`1TNyJ>sgrO{ut}I&H-UNy z)KB0U;xzAT2{cIHe0gt^1YS(w*#sIUoX@p1O5phfv~ddga|w*noNuqJ8mBZ);05V? za@INT_spgVyp%w*1aAM9%S)!s6KIh@uU$Fq5_ma*mcrX4&?WgrF{Y&64?B*k9T1@Ca^~e?UX?01bP(qY|bszzD>Sv33O*ybMs`1 z3G@^`jviRg1coG>&B=Qw&?kWb2@Fg)+YuOtvic^_s8+5$$J;M~{s|oJR(MPI!o)!d z@PlQ1-gPj&RmfW1M(H})%N+@ZvbV>0hb1taeZJ2#B7xBfj7eam==`rSD&c&*nAebL zR;;sUYyw1beqw`l8!xq*kif(QCJCRMz?1~03Ln4A^F{*1oTa`gyPStQ$frxv48b=O zcq;*J5zHipnF(jF;8_X0Erfg!znheRnt(0#wDAiG3I-C0i(Bei0(t_W1j4RmEP)88 zvF0@dX%iLV@9Lpw3Xcm~38ck@n>Q&WB{-MM?5T`-g6{~<7p$gv7bfst0w)sqHi1P6 zyq~~sjwWYX0*fUte=(N`StZCiEEV#h;Iafha`oj2tPsA^Rk(NY>I6PcU=634?cDL) zF60wV`vle{@F^F6&Y}diB(Q;tzoc$T{JXDmdiP^yDb1h{FA#$crXXED0qEe#GIyJa2Z=`E*Y0)xMmh z^MgVqH;Lm{GS8gOES^LOc5i{4l1a>zrz*3u_P)cQ7MVaNkqphRR!0KSE>kE z_IYN<4Vg=h0ZvZtkiD8m7 zJc$vKi#k1w6i&h`OJkB4o5Y+H@=_R=#P}p`C2>262}w+phObOwQWBGsNG6d=VoDNI zlhBh0CGkcQ(~?k=*!!4wdJ>7T-nTgMBsxQicvJA$2q$S4r?eY=JBisW)Qz&GX&a(n z{Lnrislg<)|1qN;mZ-_YM=Y7w5E2zVmPD1#9{PzVL1d~Wx}A3Grqa*cBo-#|p44`p z;5%YDUvPooyMlLL!J;JIXK%PAejv_S&|)!IBKlIdM3%cu9DXFJ%LP{mrmM6niPb#+ zPhw3HUnFrTiBFQwr<^}aVpkGtlUSF;r%9|&I!{ycA^;y$-jKxRB(@~6F^Ns0r;$lp zlh`K84mW9g(s{U=f!TLT5(%GVW^e3fE4F0pO=6D_DpM1=6OQKYOJaW#2RQCWa}OrL zb>nm4Bx&Vv5=VIWCvhQ(FFA*~<|J_%7K73JF`zDwfA zBz{WbdrAFhg0d`G_y^%R4RcN=L0n%X>-+@eR1$xPPX04XoS>W*{6+BBBz_Y@{Y(;P zh5s&CdZI${oaC)I(W%MBBrYW}ccOAr#LGMYXW=T3risd*f>)CGOUTHH3dL*5f1hZ& zF64$FPuS?;Z}CH)cX&8+qmM1V;wjt}xBn#JNjd*s`6yJr6p%vx6bhtpXQFa%%5hjQ z<;=s(6fz`QNYE?D)J(Nd_cPg9Dfm(-oWjzHO7yqvdr~MOxlTz#rp)pdO*v1UaV;&D zLUsx{DddU)Ju4}co#eEafusaIr%)<|`%-9~!Ye71PN7W7`HuYag7>FTC55WOA7I`T z$_X!@!Xqg>D*QpghXfyHiw-(ppRXX%$|=0RH{&tk6$P18Nl4nPdtq<26do7l*%Y2g zp?V5+Qg}Lr8Y$FF;VDU?6J}(1GKFRPGinLemLx{+%IDPUrqE@7Mtu=a?9HghKhb+L znEFf#4N|zeFN3KJbaG^ir(p_>Qg}{`FCOwxN&9as$_s)`Qg~4albQ;7Nw8T8%~NP0 z{N)tCS>|*XLrWnng2j=yNue#fJ%!#WtXu0CFtkhIRoDKt6xyfIA%%`9bV`AJ)r(Eo zm(f`ax~9Oba=Hkz75sdBw-makoNv=J^hlwn%W1}Lr1L(Kv0n=PQ&3~RzA2>JH6Vq7 zDa=e^mKY35VNwc{Qy84W5K;b*sVf1use0eXtFCkJmEqpI6P1t*DMAQIL=>XTQ$>VE znM&qsp64ODXP^ zr6LS1!Ykr07vU?l=P;U5xVaG`+{9}|7%4uAmjJtlC*;rE(aL&VNO7FV_##XYVf=|j zm{f$H21JtUp1y%?bN>$%4Llp+uriir&}T?JtmUre6k)Cu z@_8cjg$slWg^PrXg(&V=T7+dqSYCt`MR>mmT%_p@ogIN91dFgzd{q(NEJ9HcTt)B} z!B>Pu?^#ca%p&ai)9Gd!>2=Yb{An!5%v~wr2~AnAv>pwvA+lhiZFj!{(D7mk1;-)p40b^e40DQ7{r4` zIHYKYwMR$AKM)>a4=ln*;wQ%#rNNP=p^v&a*@EuogNl6yc&2u73D)k+m=)#b0bf^LNGhy9k$y@JA6Y zajaXL{r+_PDWAWJ@J6Ad_?qnC+UzS*xGlKwk2p7dwFuY59WE<)G2z$KEnZywIv1`N z$#Nmb1r}#k2^X9a$+JbM=ZciH^@)X!(l&47LK*S0!aNu9T_|9Cx^SNhja|6Wg>o*` zaG@sO|97Fh3sqdW-GvG+-0Z?_E>v>i7MHazx4KZ#Wi=_A%eOk4yViJZcKtQkm0j2} z9g#u@tHjE%5vsayhYQtQsIHAp9%5w`6*}gMkdG*I-04Cs=DN_pg}Yq1+hs+l>%vE? zvunFh$Ax>u`(Ji`vet^p?J}#L3-w)~LY;|i%V0ANRxaG{ zLNjHxaDkP1K)g9SlIpXg(D9(lI(CfTQe@F(CwGuRT5H!xxW$K6>R6$pt&YVbEQg{NHT=t3tKdZ@_bEhn zOf>GoAQy(H>BtAm^FX144fvcmEAt}vi*<0}RVgpK@QMq=#E05-9xjs+Ml!xQcjUij zd`-$27sk3UTKsh(+cs14aW0IP!U$|hb{mpOb|bS6g)UH^EFbozDQfDe!f6txyD&p0 z3(j;QnV~(=sxiH^_x#DbCIxG-hB&4}egxzDY$PyQpy0A>qR!CVc&h0Yn8!oJL zVU?|LD{sn&xkWq+Y@MENjZPe(JT7=`?sLI!^MFXug^);C7_oDsF2rme7fHB~w3U<# zY4O#zvPPssf2?z1y$c`saKwkVU3kZZxEl#KHn{LEM+_6WrZt)EMjmtyj9dtQqH~iA zo7vioa9z$;mv!m<(1mR-Y-jIsVW$hvyrSp7F6?$$*Q0|jYewQdF6?*VfD3!+z;%xJ z7l0?P)}VY(3dQ&3&p*GJw<8Y8;jr)nA^nfItlJ}W{)j_LI{T=~9ut0S$2l%?LikUW zf=^vI>B46&e6C&iQ}_krxNuhdOW{|%3W#twPiKhm8yC*l`nN1H)Ve3k^u5H3E}Rqj z!S?x4Vr^QYxF)qNr6&+-_QnqB3zk)2b%!FfGDFrJ8tkTd859 zrud!0TEe@8cblj!Qs;k=@88xlQQySVCi-ay?=|s=X}xgXK-kcl-0pRcN0CtA2ZR>L?`jbP5ivoy3zfF%+5lZ zT}*Tp?*a9YAF|FBg zcN9ALlFTp@!%h6YCyTS-GCerlIm*PVCPp1Bm}TNM(|W6Iyom`WMw@t@eP*07M#0C5 zGyXW4BrV1nd@FmRi76(gn${cIlS~w{hT?njOE6KKW@5UD875|$|G!WOmkV*Oa%7hI zAeqf(|1q0)9p`X=$Nl?%cAkm(JXqS?LK7?O?Ji1&pZZ2!?^qKIR;3O(nO$1B?O>E#GY$C*iQpw2_ zHxV`wky$j@F=wzNDjwtcE0aD66G;;(6KQ3wHSv~-)#7XHf|+RROuQ{+y^ztU6W?L? zuH;vbHp_OwX zlyzIvtCn!X=|&kh@~Y*}S)7yYMy?wr-B#or_rH@D@oIj9+q$Ng65d@br?gEdvSKWo zmx*?hGvAE@al=;PA7#5 zaX4+wD$i+qo4c*admnV8g&Qs1_;FS4oPV+(a$~{T+*WS1cH?0;+HhNLbZ~hsSHW(Tz!N6e@R$9cQxbJXK1j!ZQ?VrZBU= zv+Ug2Ze*0XZp?FIKKs?qtT){#;-Pd~SHp#FYngyWZY<_;bYrO-D|H-~F`651xUH9U zR|rY^T+3!6$%w1uNls6f8>Sl}x3$UxpRK#u!8YY5O6Pmr@Us7maQcJ+q2G<)ds$;b zP-bRDfUq0q#~BgDj0$5yx&>+==|;+psa{O;BJIX%c6bjOc(BHewQk(xu@>xmi=Az0 z?%!@)c4M6z>)m*pd*{Y4ZtDr)1~=YyT*ZV}RXs~c-Hzv~WL z+2_Vio9`0YE!^YAURy6d-g>cQzZ(anyeE9$jmpxAhou~MN#EnncTvATD@tGTEZU4{R_||Rx#`waGFF9h^`YDlC7Y%cY09EgLC5zJ_otWgS$Pb?ZNu} zd38Lf%bq{MxW@ygoC%hHJrC-8&_jHbkk57-dT`!@pFGxc-bNnW=Rso+nt0IEgE1bA z_27OFnt3qLgJ(T>z=P%DC!hTbg9u{xoK{398 zz-x`eL3~8wqr!H|s_$?-=0Qgfda=1Y=;XoU%Izk6LfA#v*@H}wt}-(*yK~n(=qV+W zo6-A7dD`~u>%o&AJjJF^HRwaq&x8JQc*cVPBAML(;tZ1bf^e`0Lqu5iIg#gubbir; zmw1R}4)b8R2SaVoS8SgV9*p$hHCrDg@~T~*%oay`@VfN>sxi)k@g5{SNO>^9gNYu@ z^I*OQlRPN&V3wRGdoaa=M!T|R2&W3CdoWGp{A|qKWnIDPz?#pr+ik` zV4(-gJXo&ci=;0WXC;@&Bw1?Le1!*Zc;NBC>%mIpzUe`c$SQkVE}5nWZo3q_L}njZ zE1w5`4acev>d9=t97j;*k*sK4vMMkyJSTi>FMZr6@%Rn|5kvvzo} z)84O44Jq#NV7~_kO9-Q^ydx_t8@U04- z5pEMQ;CDK3B#d)T_=Ax9@}mfK?)U``Yn!sldXeYF&mLUl_*P)8alqSFzj*Mg2fumn zy9Y}q7!EIrdGUw%B@h1OxpOJ+FAbYlJ^0&$%N|^j_>TuQYg@x99hl-14B|Cq(E(m7 zT1hXC<>VLl;yRhvdyy@YgPaOUBQNgr;&HEa@2jyFO<3(sSr0M( z&a9?hw2*nf7tOqQz>D4!4JKwam&1cXniN}#^Uf!WxALO3S5M`LN^NAe6+R+-RM<|~ zUf4nSn2>QgigfaVpHa|!!i&sY>z%#mVsDp^HoAM!gN>Zd9_2+(wMjoO`g_q!ytl9q z_nMX8ob{v^PkHgQ*Lv584V9UZFT*SDgdBctPY@F9vxr*oz@vJTK)r zA$|B=6_H|wyy(SC%6i$0S8Si5BJ>$%E14jSHc|@9QhC*j*Sr|5+OlHfy?C7)t&1_j zvi&et2WT93R=FvEwL?6+R*_u_yT zv%TP#6mc&SUd-`gt{3yXnD52POuKE)THwVZb++F5`3u>4`T0Dui+MVDvDAxYUc8~B zu-uE}K^e*yZvBI!zRHU?*%@^2y2uNc7p50(ueFw6$P17BeL}C0eQEAc zaE)ER*TR4oK@oC(_7(P8OVmZ=85Q1E9Wn0v%3RJFlJr{hCN-*oci7sevQzvQ;Kgd5 zL0+u&T9YY_n(cT?WSx*olaghK>%Dl}R%S2C+2FONxqjD+jb3b0x7p^!b}u%I^EBDw z#a5fMQ|-{9;p=LwU=b;nv=c_j!hT zamb6qUVOk^_TqvUN4URUeCEaHtdbW;S5dUR>jdw9Qf6XN^$~ABy<^AIk4{tXQ4P#0jY~b5dO=hljUWf7MI);PjzC zac@?(4>>;E=tDUla;20NGOMHyH;9+AmC_<*g#30mPbA;YE%3n*|99~(R>Oz8eW>k2 z1?ji>P)X!wA8rx3RajA&`L4XOcr_vGP=(d@@x!;Qs#5L{r%t81lo~$N^x;k)YVma5 zVSU8Gbe9jT9?kvw%Dava_xRAshsS-W>q9*s9`K>L5A_w{J|7zUaIX&yeAXId4TTl8 z9$BM|!yu!H2qWJw(o~qqZD#vF=tB!19`>P)a$5>p2_LfkTZ=F_L$&qc5g*$7(7^|W zdenz@wi|P)WZWK;*ik+dSwrei_|Vyhr8?^FOuc;QD~H}b z^bujS%!Zy6A!p>LZQjo=`-~3*d>H7%v&t&;VUQ1leHiA$a4AE4cv0jzyX^BmykPU8 z#T_q+zx_Q%7-^a ziiFH{u}`jWkg$|no*wpLk>)ELKIJkipn5WX&y>qSp>^FSzU9L@DVzn1x2H05VQrAI zN%*dCqp*Qyq1pUDe5()JWN!Cimk+yr*dcT0|M+l2dwkd{g`5*=W#a6Y!k;t;eAaKI z_k4I?g#4fnhirb>hmo*;`F!ZZM?P!}Vp9-DeK^KF4ImZ3$37hA(exwi#|a-kVRQLW z)sIho)^E9QefUldc+!W@eE8glFSOlE3w-IrR~$xmW}TwXI|Vg*Q(7MWBB>{v;X$tvJZdx z!0QW5A_HFW;pRN&RpCEu&uw`$nPxX}d^5>ejQcy$;8#EJqxj~$`??eq_oG|4(j?dW zado1>l;uYWn|H08&xPc&{mAhn*N>8Z+~7wAKOT9_S;}v%T#)BSz8|Hvn`Qhc>&N_B z$V@)Qx6umx_&zsh@v(y0lMKU;n$*KPvk1 z%a**lTk>x6Tko;28|yqY$!e}jepL3OiXS1FR7mddqnaP>{ap7J)%~d9x2|^;G`Rk`ohR=6T(k8(Nu7Ku$)$B%pbsOz`xk~Q_?e!umNQawNF`*E-M zxk*L?*2IsWzRGIkM`J(u0sDPI5{ga4NoY3n;{iWf_|ejjf=7+!JhEk+5BkxwX?~sZ z`Q*Iw&*S@$AFWikx`hVk7HI9q!+vWXxi)NGKOXht-MNmotQZ&Od&yvGr(B*RR1=e-r#FZ(gnk2!wK_2U&khOt-d%l&L?-f%xg_%Yg#*O^rv zFKx^nskT~lNA@T`h_Cwbng}^(B=~1#{unY{aE408-A?xqsR}JAFGs3b}ja%AI-liIq+1; zdrw(t`r-D&J|n$-^8aG=omve2N$8kU6ek7zP{dh+t#jfSYYI`5o`>{rRtMXaV~Zb~#54cAw(?||Z0wShj6E`&xIT4Gib80n}SiabmJj{;KngAKz*R zfA`}%jzw?fUgRJ-$NGBfEC)b8&hhATeDLEu2M|AQE9b-?)_=fBMfn$0aM*O`Ew!yD z;6KZBohkUmkH3)fs~^8fxn+vM7Z2K8uuA>m$0c3@=%B32Lh66BKR;u=RmF5g;y->+ zr0ED)SS$bpxYD=d!xktWz;yw%30Tw0@xRaY0aOa0asXKYlnB5XKz0D-0=OxFoB(nI z$Pb_(fRX{+5J2ew$^@)`Or-*7cGyAEaf(4?DjPtavM#RAoiN2n+PV?Ijne7U9G^#YhAvw_UU0W=Aq zp?ISJ?h|RP2&{9{0PYXq!2nvYO_cRO0L}l$hug~8p4;uPqh)}Pc<`{YxW!fhw6=Lv zo4d|qH3GBR2JlD#kLnn;3!r@f)A!~b`Z}Adb9M-z)L3U*XU<~*bPQOJ_&Ws=W5rvY>epnCud16UM5j{thAOUw?S7n`v|Zr=c&WZwu_H)r|? zKbmj-_IoOTrvrFBfH48|3s^7dy+910Ka0y85WpZ7%+KdVXJ7!&D$$MR-~fgMtc%fe z5}%hprdh9x(}6`^3gBgxweE@K=MN3wl>mkXFg$=!0lXT(2p-&>Su8R#VBI#!aC$Pm z768*|#mp#-IW~ZCDl*y58Xv%f048cH++3l^Bq7VPAVr3q62MgMwfJ!?N%J~5-;MuW0chQ2Je+qJHPqSv9Sgd_t8o(0Pp;I0U5|;(A zJb)Deyb*vufIt8%6>U`jZ}L!1Gv?2A7BMR?XV5g`jcJA}05br00G`te$Hw5r5 z8zF#A0lXi;!2o!1+$`L~o*BT_0Ja6NofQjUm-HR%oFeqhTxWL&tP6L>%$;uR4Pc)f z_6KkvfcNZD^kD=hl0yL;4p?86eipz70UY5k`~Z#z@L>QS1#pZf3rBk)FYEN@@v1o8 zph$j#1q1jrfRj24=)hbeQ>G5w1S5YgWTSn_(@Hx#Wsk4bS?A zolU13X9D^>j&^nLF-ep8-gemL}>-#9m}#J zWrE-@Tiznh3nD*=0*Q=VPP!4qjZ)~7`GlES<%6gY#LfJ_Hr=QcMCBlE34(6`-Wo*3 zAU>UL+!h3<-`Oz18NTKmG}>7u2>ySm5kyUex;==hLF-+GJA$Yd1iuieF1+_l-lYBo zG)q5iO$>Ye4CBrq9_V4LdDVHB_T_G2?I7v|aZeC+gJ>8;qaXsibL$0huLyblAhsQG zkT5j}VuxO6xsO!};=v$V1kogjrgCmB&-;UD#tq4nMKWdoi@@S7gLo*2hl6M%|5ib? zmh*o;By8%oK|B(~qxRPS%VmTPK|B^jH)d6FX5NDCsHW(|!?ZK&aUsbQL3CELv$ea3 zbQQAYyQ^%EAbPS9(hkO9>J>z9>EwObhBkjv#j16L(_!!oFhC#9JY6p>Nyma<~ zNkJ3_v2=zpRXCab^Gd-KaS|qGO_NDy@|i)*3L>Jmoy`gau`-BNLC!CYc|k0pXAtw1 zyD*4FA`7^`TJw=@xHyPP;*3UdnH*LKmkTqV%zeZ5d^3omAcD$u1!0Q#gK!7o3BntM z&o0RLnc&0>3D{Ygu%RHrw!%$B#bZL6@gNf7nX;)M(m|}YkKKkK)`+jQmA8UeXY=(U zZwucEf~y{67Cv~FBSupPm!;So#FijZA*4gt%5KAh9M0uek3n3p_46V>sSTM$pP!|WJdo@B zl{({#_s(_x9t3aK*P8?KKZE!yh%zCR4dL$~E(g(ROICIWoL~J4$MX<4W6VE6Tn*w{ z(E38Kc*vT4#SyZ2F(C;;@OL&y*dO@Ip~9A|>qE#2Sr>v5A!{UY3OND(fq9Oc5OPD- zR!R!PJG01d5HBSxZ9C+JkRQUWAyf>ZAOs_1EpT>I2)+9_NSJO6p`1i=E__x#gbE>$ z)amQESzBiXZV{n!TL_gxxSMqjVQ-J@$|2klLN)O!A>1yvszT~4NFQQ#@fso2l>ePF z@8a&r%(#)0)Cu995SoeCWxI(q4xxSs_lD3&W&>eE;prXLuVQYC={_l$?NV$KLQ^UC z3kMh_DLxQF^AH{kp+yL-q_-44B%}l1#A709EhXu&;TLPl@yt_Tn)T>0{^i6?yW1Vm>XU zpRhkG9KwJQ28Qr#$eMNkxex}4kPl(*x$MD0nye4E`@9NfrsaPzWX-Sml17G?g+oJl zh23VlF)W1fAxsEaFV+qZVMGWcdC)oePYC0fra4~?;k6J(vsZkS$22B{*KNLjhA~$B z{TT+cZq2j0_rwq;g%DAHF66dCaD`xoFeQYkAuO9|%nxB&2-8`49fcVo%nV^x2(xYS z*$m_A45RE!qy9`|P6%CR8cZW*8uR2&!mTU_VPOc1LRcKaiV)riVMz!}89#*OA(U^P zy?>_h%%5dNtKB?1Fw59D%Q!O2 zn$^u6LNJ6-2%ZqUA^3Rm@AP7*IAnd0<(O^7Y4CV{<`8y#l18&cy1Mz^ZzbEp(u;pyyu&o~r;RBl=;Z;EVBU`!F*m2C}ABS*U{DiH1BJx`) z=Sf@nOyqOn7wrGG{#6L4#Gh8pzYgIWnP)=yLF8N8^E;8VA$%`#&eo^uqpcrho)`Wk zyb!|Aw$H^7hGpXK$oegWf298|{KNLSB=V>5FJ1*~{c;FbY@YeN>#EFaAvnU;@ntF| zf-s7Qaa|bKhmjRV35gRMJH|A2(1(~IIbr06Q5eSLFiM6oqmuKnFgk{DLl~vPC>=(b zFzyMXZWzXz+_GW(ye+FBjJ&Y54p)BIx)M=eJEFh{Gj0YK3uA80EvL5XQ}6 zR12ee7`G_5qVQHBqcv!qf1AxKg;80&itu(@uPSm!7!zk3EK+BmgUD1vdd)EW(y81f zWr}j|4x_frIzr~Mc)c*{hphp*Ss46C=U(A`VKfk-(om#P82p@vW@B4#5=K*--!H-s zd>#m+c^D6d(ISjT6_$}(hS55Vhr@WtR$3_|eXIuFWhC;vG<5ysZi&dy=$4?BN%bqS+u7~R6?9>$YlJQYTdFnWgZ*(*7H!uX)C zkvrbmD~#S@>(jRPXB+-W&a<A#!F%JXH(2E281z?6%eP% z>OC9ApfH}Z#lc|=Q4Q(yZ~YyPsu!}K4}U()B!&nu@n=ClnSri8Uz`Db5g<*!R2Ye^z7`#zK;^8jzFUb78^@kA% zBNj$HjG!v;>l`B-M#$!Dy@)tT)D{zL{JGX$xO5mv@szMfRsr?Z9Q@_U_v=_{ZP<(j37@O2S+rro`=gnbkVONyMCss@>!U)z| zKGK0VVp_f+Z2w3 z@nIMrM{zugkJ$Nn-bK+OienVR7#+du5$jkV=V%i_^@#P<^#sS9boM7Y0{o)KYu zu6@so;EOQ64C9|Lu7>dyyJ&mk58){uP4>4iz6s-}FfN3_mxa!R@m&~a!}wNas?ZX@ z596H7^I`lT@}scLT!Xnx&&@Tst{KVC(n&6gESzin62`A#{3i2vVPThlOYNO&urimz z;8y+&>`x3G4^nxwIg z_&pKSji6ox^&_}9f(8*Zl+NiHr}wq~4-)_5jg`flU5|=1iJ)l&_eanyf(N8LEX+(1 z**t;=BWNL|WdyB681SJ8GT+{kw~qY#^)7iEIkXi%62a0v4#r_qkDF(7h~TjZUW(vl z9gdD{&-T{yrcM!SC8ozCcp`$%5p;=QNCeN(dAQLvf~O*QI)ZKybdR7%1U)0T`~8AG z5%h{!FK{yT7CF={hn!+xInd|Hi1nQ*NxumCN32hD`9bb85e$f6a0I7Pj)4&z9Oh&i z6v4CNtS8Owy&S|p7vT3{)?|RsNAM!+wk!9A2u{|v78*D*#d*100dMZLOy>@bfH*RO zS44&hhYLq&H}BLpkMtQ8!K>2AUlZY!2xB4`%gz>s5yiL&#z(Lqf`t)GPyWV?Cjp9l;#=%oS3Z zCo(^R@8rBFg2fSh9lNjx{s=#sHqMhpHV5p>Y5@w~vSO1UlmiWd9Hbt;be7*4P2;PZcgE$Ljs`su; z)@QTGPT>~eR^he?wu{hbhY0Jy;!L|_?q=tavM*viu>OdHPXzmwbs&QGMBb0!1CfKm zLlGRd+lO%&@Q8Hs57jtSj!8Kw{8)J0_BkQ)iSSe5v0jePL_QaOA^b9euh`Yu{=FOw zcv@}98fJF<47>dmXKvJbAM9Ipg9y$>@O=bVc$$yOITt~R`Nl61{2IXz5&Rgz`3V2G z8GoNF*i}^QC-u(@Jn=$aD9XyD!i#L4&GSY0 z@AAedo}X`2ilTB9<-~6imKRot;^ruB5vSX&Q3U22Buo`0-XIX8;pz9=8O0}+oNJ?aD~gAr)=#@uQM8WY;V9Zf z@f>IT{Rwa2#%F{xMRGv}Y zSiQkf3=khEO@B%}k=5M{B{3sJln#h96QY|fwyviuk4 z+;}o?X%x$%_~CWua^cD-R)|n}gMIsuRVDIO65kY3bVXrC;f`YE0;5bVr#A`@Yf{UZ zF*BTB4EY&>Ct4JtD8f-BRlP{mnn;tESNiOP%-qezIqTL-rsbucT%lXr$Qtx~In ztjrq5tYP(~by2L3;xIcy6mLiIP80{D*2GyGqIfrob%l_ zt~eLd7R|iGxuH1a)HWXFLdW)~H5b#4D0W7%i`_tTqwR}gw|KS-d!pDYAG*=pFa3a! z%6rOsU&!1;JexE(7w4Ed!k_(|he}!8^oQ&}nwg4|Tpf*C^NAgc;%n9C1WR!cOQ3ZE zpGI*qir#VbiQ_YM+NWda7sKaKd=bT$QG6A}uTlIK#VL;P>FghPa8G5QW~eB>iCW(X zpJU79IM496$JCr}qxde0vmDCO+5C*_dk&}bt^P(%+_AtozC4%zZhnm7JU6;I>nGs_ z;mpSHjN-2-{*K}@N5V~6*Trx}gxnFs zKQ_NAaxIF?!;4}H0wFz%$8cKDCa#YmD~1v=IAbVni`g;c#!xbboY=pQKllrr>4q3e zNg>Y^XYevHl#L-zW%FbIZjL$~=yqca>26XN_j;1sF400Vt7ovOU!yC z)G>y~V|XHlPTX9s^Mw7th@0rF4bjJHu}xWBW9Sw`ca`lS>@Dmm>?LPbrcVrgr93Ho zDrP;sVuZ|&_mAP37*@sbChHl)z?jw5hsW@241;1A7PBUR8mxlc;`1UygwF}nO|8~@ zLHtGGOTw3hLxryh`9TU#8NOu5Z+}L_Ffzsk$8$%;@M?@p(qME9i(^<4!&e&5Uyor- z3}a&$$5Vp?atz~H&y86VWTr0V-999ri&#zMsr^*`q!j z5yMQI&l2GbQFBD*3g`V#?t&N=vI|WrSj3pm7R-Fi*=Vlg-1+RKstGHzoM+`q$1<50 zJ&qM3yav4yv#vxddE)4O`=S_JG1QA&CpCXknlWsRVOtDt?#p#Ko*29__}C!(a@WW3 zb`1U)0x<+*2*r?$Ar(Vdk)ttqrZ^)!C8y;u-Sws;CM7OR2=f*i^hvXACpg!}uy0rH zYL#6hgd_L6U>+73h*v!7s z30q>g_(2ZSneHXF$FPIvavYW7*crnv4iPb2h+%gOdpO?4@CExb>kz}o+BzfekKtep zhh!dz;k_8%XRn)O9oY;XX4A#6zn5{8y;N==#_*8{9jHG)>tFw4F_32p9*^Nf44^y^7n~FRAY^eW=VR7yHhv@U(n8~Bwo(k)apc7D3&#`olNheX&?}z%TMU;t z)W`6%^JMESBYOFk*=~h|W0Z%&c6RaoiloEpglsN2xe&QmN8$l#!1SN7*>?#0!*_ z9|wywCZ7~D2sz{27)LqjnXn7@I?CHyuMkISuY=01wo*~#x!qYAg;&qYaoiI}-8ibS z3vro%II6~RM;z7SxGRpk8N8LVdK`DgtpiP7BaWI9H%9Vl){@SLWz4M|w-#g}sS`(q zhn+7EE8wfVyw%CcTli@JQ}3;LJOS&+aW8i&j)rkGileh4Q0J^@_r=jTjwW$5jpN}s z+OYl&aDN;R#?c~8C|rYuEK6{bdRG) z+*(qkrxfl8c`xw;-&-xyH;yOc_$rQ5aXb~r({bye&*yRUi=%%WZ^ltX=Qsw$txsYb z)v%^L85p;4Y#h(VF-Ux{@DKFU9e)_)uZ9Mb?xrOvB)lY zBjb3@_8%3;tKuDO&(U$b9>*AoTmXn=pH$YkIL5~@A&!Z0Op0S+9E;*8l-sm8ri)CD zV~WUBAg7{{)XPU^(DJbZC1P}Y3A)PD~DDT|f0LbxQ3rMBlX zk>$e4i;Oo!Rti@MxkeQ?#E)n=$sVWQam8WA;f})-hgY5XlQ?{F_<0JjR&fO42*$BG zjx}+FcaarRQ_Z;fM%?a5qbW!y4+dmK9?X3X7j?1|%J z`R|QmpU4Ms>=$92_vCy)Nb~(T4#siFj(=FhwaA#f$g0ngI6jQyqc}3PIx4~n9J8a* z=eYO@A+s3s(>QM2Q*cse0f*(!7)1XHzhH-1nrk$5e98V_-O1tlG|!71Cm*j@PvGk~ zzKP>Z+YGtnm9d&c*SA_|I`%6!|fZ^CCaRaUqW0d$L%N>Fq_v zFVZi?@n;;r#_=16P$_>1AMRz)?Z6@nnf{97vh=^>SUJEFiC5zI&%73gBVm0|#(yrw z64t0#GJzWsKmt8?{eoUlq){nr9?%V**1K8y8K0 z9SOXoSGCEjC9LewIl1U1nMPFU;OR_YKu^>!&-^gwH2O* z_a-p4(8=^r0u2&qm_VZh?n|Jh>e)D9tyX`30?iU=l0ehMzw6gW7F(;{KafCkIXo!j z`tpX>nr|U~Ac2=zDuK=k4ANe75%x{s$ppG4&`oA{VNYQX z;cZPEy+qg!y+!&6hwQc97I=y~EAwe#KOy!0A}mWjKzv{V&)T_+FxcipM4n6Fd65@{ zFWR|h2OC4hM3%En3}+}1g6`{T#*?G%oLer>$64Xun*`Bjd?QX+qt~%unvn7NFRpbA%n9#h#YEzE?$VOZR08P)b|kPffz{I2C-An&8sXXm-m?AIiJVo; zcf>a*utDTq+h=0}n{4i0Vr;Sb)&#cMe0u`xv=_Ui9I^G?B6||po4`Kt{RzA$a)4*z z0joC>-oP9<{C2&FH=L9ZtFZ6a0kv}sYYwY+nf!`ANT@HT;DKb>X;jaY#mRKT*%OXfx zL);Z{l7B?53a=&LNTQe=sxCE{=ulkdbwZlgi)0C7ha66kY+;U&KDkMh6zA|rv$U<> zl0=y#%F4`3qMWVgCs8172yYY~nQ7JYCfldHNQESB7U`*dq{FQ;D++HDR!X9>NEIP{ zZcpO+4c1Fy)okS+k?O)4Nz@d%)6T7x#9cPOJBivhuaiVWwMpG1>LpP>iF=jRE{O&r z&4mqZ|3)JB2^%NT#MYaN+%Ie!66v{IWT9}8aB&h#?A)bEEE6wOPg`N@ZzQqO=Bq^BOd>PPnlb}+t~&{j zxYt&EBK{lh~cK{8LG!llUNsBT1}Q*48ApC9x)nwMo2X zm)elTI`Q?k@^%vMi1VV%I85)#+$h|X#AbH9i`GE8MM{Qm7vG=64w0Qn?6PX|?|X^+ zMD_^x3ON+~HyRv}@*ewu$U)&D;bGzJ!ViU?CUH{aqa==s922rWA185K{DiH1lEf+< z5$1kIQTpe?FKnMLMZOZA;+bgcO%G;$BYwtKz7_dScs7aeMWTxTV-n{%UZs$g!cWq# z2)W%0N&K9|#Uy@_a!L5Bo%@@}@4`QX&2+f`OyV!w=WkvG#53yxFy=opuL`dv;YeBS zTucZd&EhFsC%#EFERljUg<2`xl|pt3Im)Va3p;-zKNNJwJLn*XM;X#><-$JCNaH=k&t;O4<@UX}N{S2UI z+Y}y=LO$z|qkYPHUd+2s&!uqxLUc&su@pL{&?$v~y5|f`;n@@(PvMCaI;YSjg=bRM z8zWs))@oA&_%UzFn%AOR3f)uak%I4&yq?^VAq9QJdkK4|G`H|4d41UvM&~@qAbMK* z$5P|z6#Au596e>y&=<3#HQ8XpY|NLg=ZkqqKN(YHKms1$Z*NVKA!a7@7uLH!accg3(zH5sc z**Eq%cm(ONC50V!sjVq&6W?wtblYk3T`BAq-(xGx-Iv0Co;9^f9!TNCl=am3J(=$d zsUH+MBs`qL2ey8MU3YI59X?9oD0?iIQhm+3cXuph-KG3Eh2trl5dS2F&qb(zn!-u( z&xCE3SvL~DNa0JFU#0Mk?RiS%G*3*CZt|ov$#*H7&bu)i|HBzRp;f#-cQSO5s8ZKkEefJB79oeH~Xg4)DZJqiY&hQ@GOBStgCLXNEBDqkzTe7;JFK$*kxFS) zPNQxb_0p)4wnn5o)2Nl^x0a}y#vN%?OQWXr>S@$SqftZ4=V~Z>z~(&8c1XUotaVT6 zt~3r_%C4P89Xa2fM(zT9b2gjeJ<9rGzU4rypT@muJdj57G#aGQFpc|Fq){5j=c92N zP13ke%EZli)kj&uN6$c0DQk6fnu$|)Pqk)rVJU8n2`=ERF7I^hl#;+Ij`CKkJ!BuQYng?32b*B7KE)cryL(ONLKN z=_ky*xi=t_$P@K7$BR+1WgM4b*@}DN8&Pi)$rY)R96d|82^1!yN zxoONxW4^5~5V>3~pNVdZ)7C@^zBK$ION2|)SSGSuxI*}baHVjS@J(TnkU?B&nBs0B z*Ch3%t>sO5l&-Q8oPNwH)loCct`y(nnp}YJdI>OBbl}y6C{LH zZgQs5NT;!y2O^rkhG$Uw+@tMtpWmFjR{X6rK3-<56OybKd0WWI(l_wj9N~O7jg4t+ zB96-E>{46P*vww)&)t&7Z_A90T1c96Pi<3Wwx_K*sdfl=3a7Tr<)F7GjYDZ1{y(z5 z16YdcdwOZ`vAjookCk8`s34$%D2O0PG9Vy9BrD-3NDw7R5GAP~iUi3yM=`KD&4$@s zGAJPCh+smDh$6{J3BLX2X^nU&VfvOMD_~z3HR^70jKn! z$j7}rheSTyfsaHE@4yj}_k>47Ga_*49x@Gs%tJ8)Kn|J~4K!V(XW>HH3?UgEi+ zaW1M+^v@2syeQ>Gz8A&3fEQPIkw=tEaW807Ldf%j9igO?b$hL|C`H;7cv0Gma$b~| zSVj@bdU0PL7Y&HCtl&kV^dcd{GT9MqgDbtL;zd<2DtS>^MQjNTh#a&5i*S_}S4$zM z-hYv$S5s+CVRc~*$KE!(!HZg6^!H+b7qz{((TfMY$eefA@uJHMsOv>NFM7RTDK~jh z_kx>b`|g69Wpj(Lz84L=xYdh>UbOb2jTg6hal04Iy=dV@BQF|zaiNa*QCC|p?ve6<@LrCm7x#f}XdcGl79($$NHyqJE$-A&kA_^`0Mu!k2tMQGE@3sy(M z)JI}p;Uiu=>e%%2qTf-=W}p{*dTxi;+63W$UOeW-ATI`c@jMkK-udapP%nmgF+|xa z{jEohhI{dZ7n8i!{ca|`5)Uo$jP`;!M%kwwkxPP!S*8hI zO!VSeFP>4UtuxefDrJ^W^DzR+WH0y+%M>qa+=Qu|+*?XbV;7z;`f!QoMJ}XzrC;+} z&rM9HZyomxFW!z9yrh^jy?EJ+SG<_TG2d9gKfynnfmgklI@d9m1w^f$vbFP3?++>50gjo(YTms*WHf40;LFV?8u zm0qm!f)D1bcCh|Z53?PYde*WfOFip^^x}QI8##AgY?0$8VftY_S1Et17jJNNjnCia z#p~=^rTpzY3Vtj6;{`WIfY~?MLUvXz3{|WK>cs&s4srm!hSu!!HLYSgyKJ90VXwQikySA51>)>-JV zl*zie_dPF;dhtHTSq5LL<(z^Kz4*wBk0l-xe&WTa?8slGKI61{@r9SqycDv=%5$vR zzvTRStuKlTmwJj{WqqUIXRG}pbiO>C2g1gso^Ki4ixB}l8Nl~m{NTlvepK?~q=xP~ zAFlV|N3ZqB;VI!yUi|FEFJAo0^Ro~6KK$mz?_O)WpU>KPPIHA%b6@b{BB$?E;U8X{ z@#0S}{_^6i7w0&z2MYgI%l9tzTqftGa1dC^C%i6k%zY^Cv(Baec;ON$COoCNF5$x! zK0GwsT7h}eOZwpUfiL-K(*?oht`Xz&ZKOeg4^@4*%7@ZEl=0z<1{KTtQ0POE59O3C zFQi_<$Ghf=_}-+7KK?U~%0AxiSahZ0^G26SKHQ`K*@>g;TDQJb@ma`h!!kw7UT|OS z!!q9l4bptamjQ40-RNaSh#qw(|^ORcVso_ISMPsX&y}^fCK8*EQC!g9r+~~sq z9|rnR$A`K;%=xO+BR$i?87ZSwDO^~5A}U$yUf#+4e+6X54ZZPH_!B3 z=4t4|Z9d%YLn9xKO?Nk8?aMrkeYit}oK-WC-08#2WgglP?{ZodT;^%+Lkl17X5W{2 zT1qEjElhN5!+L#q(1&-IdG2AQKC~C-+cxeKX~$8W=Dyz%A8-imJNVF1S(Z{~qGcx^ zI{VPY$=YH!A0GChkI#Aq2UB;E-ahmY=_zDmdZ|f#1qV6bxzSfT30)r50QM917jisb z9fe$x`+q(R@nNXX;*SXj`7l`IaUu2Srh;MOBZR|+PY7+BCs~&dBYhast;|Jdy=E9d+DF&g7M)+pLIL^bRY7Lmzp6?@{+Q){)!K?eAw#4Hbz@q z@Tw2y zsl%7~u-xG*d?@>y(}xU? zCLiA9g7hKe!&^SQ?ZfD@Zl4cq4BJNI9YU{k{{7+i;ZRvOZ35EC!#+fKnD5Use27Y1 zSJoZ(A?6q`$SCfgzCSPFLy~8bLoU8ofhpw!G0io<3N2P4%bE3IzYhoGxYLJE_U7&J zVVB5mAwyAQ+UvtUpY@Z6oFd6Vu79@8#~szJW>aan$|8q-IO4;5Tu!U3fJc3JUu|F! zdqIT_Bl(D@f{(XgVG z@Z$=Jc|y0aq;SEy0wx;g`%&OWX+O&Nt-aFOxz)iey=l zaaMRd;v`HotL#S=KdJ_BRRC4}xXO<={dmidy*IkA_M@F25BPD7AJ}IF49QY zSa^pYO+@Y#HWkvcnIGL0xw(`Uj()dDOFvqPv=+7zwiVtZWQ2SDxXBJHC;~`}`3%dw!?c?eu(qH(nkny|w(Zk_AMS2N)3;PKB`tgVe z?H~1{pSV3@1H=ak|0g^>3ao38IPC}f@wlUNu7~+CT-oVx8J20RpF7uEi-a{2Cx}0zrA38xQGCvi$$m`nW0Fd3->Kp( zeL-ZJAJ6}%^hGBE4QBZ9k{>huc-fD|ek}3h6~}jx$Sglz6`3uZBb+Ow`#e8hbNGBe z7Kkr&6nkN?sY|6SQ@!+}vfPgq5?2aWIje}JtNmEx$67zusc4IEy^y6FL^k@d$x$|o z*pszYe48Jyi)&HHkUBcbMJwh7q_v3&cpDTM%NXNq> z@A&bqqZ|^kn{>pF_ZK5{5a#3{wea8@T?zyJ35We`*A^w>Y|WMx}?&7gf6wYm=MC^!VM301BK^j&ND=q5vueP%eP-0aTDuD6}2zMaXFOjCfRZrLdB)vam|PI(TD^ zadiOK1n@+_`X+yE0M!C$6hPwus>`fa0JQ_CAUf(D}n|cA%5wGhM zQM^gj-5kIz66*^a3LDsF0oVaHope2hbsarU5hy;I06g z2hcWvdsNgSfL0=R3mL7Yh#kCj0BsbO4Yto+_Xcpk4DS1nSv$w~fxy3OtfRcT2_F=8 z3ZQcUT>}3eS&Y_I{2?K;_7V4R0Nn%V5kODJvbRVtx!Y!p^N3>7WpDtG2GCD7{Ur_z zV1NkCXm2Hv$Ap7~cBPNYYe)b?0~i*7eXtLg$b*`}FLkjZJQcvm0PYB)Nf4s~7#%?W z^QCSJS_@!I0FwgN-^9F-@^k=W0~i;;cvbOSfG;_*{?V8az%x=N3ZE6We8&2FW$y|P z-)lWNfGGh?4PaUTkpQ9rJkQk?fHz?6RQ_TB(*xKRK*v$;8Ejj?x<0ckfS*@*W(F`P zfVly@9Kb7F+bcb@0+_A%uLi(Gg|+bSc>WbWPx`_D7ICfaE_f|~`6A>CM89h~m)#}$!6E^yQ0*&)tA(oq|L*3tM%lH(bwajty~qaPM&Tym zX5p3qwmR;7{N(ijwsX(|c$3G}O3$+^J#PgtFIKRvdC}W!p{r=!on>~gzee6uE*H^9 z%gJtk0D%C4oQPjbh1ACb06q+0R{*;MNbw%d09qc%`{a;| zx2Nvmkd}7u4PYOm={M2-01k*BQqh!@M8e3Ac_TXDuAB?I2XW~eR)3z@JoO<)#v@CX8an!p8;Gt%Aq^O_@hYq3X9M`#F4B)ghGNnA04@Y@Q96h5k{b4pkV8rX1W`PQYl65o zh!R0u5wu3HLJ)aDlnkP55aoh!2T>}B0u`||pV`AMdypBSbP#1!MA814Sw3jBhlw^! zB!xi~$)=);Dh1&Q;>w^kApEgux4&`_Ra9Cv2+j)=9j}sdwUB1jf~X!u-5}}(Q6q?& zLDUZ7#vrZ>T1$oVc!OeIAGBg}aB2muU#twpie6j={*tXj-xAi3P%1YCadQy$gJ=-M z>=Le9f|d(=!BCu$TZ7h&H&j6Dr}zFm4k>@s^Ne(R&^j+QVl6@IS}{{Sm+Q_Tng;Pt z5UvoK1#uT!W#s)GMDrk81o5M?cL&ijh)F?A4x&{Mt%K+lMDHNl1kpB#u0cE$#63aW z8^nV_bPD3WAnp(1fgsv*I)=Ee+v{qlI2Px9HG5qo9i$9C>+VRh*G0mj&OvmMPQ|_h z$0pr^=x*zL{?{?+5kyb<($bFHCy2g00|zlWh)05WG>G9c?#GS?F(`<^$_^0zFNlF6 z|F(+zzcb5v_qraJ&agv+7-EZR_OSohKM}-;AfA-+)PMAm;&zk9h>s0oTo6x-Uw%u{ z_#pVe+B0m@S@#4MslQYvN`F@PoN%VMU`h~EgNSn0f|wS>^9r>=_(Bk`av22iVi41% z%m`v89mQV?qMdE?OSMiXhemu~wxkgIE>BYRBfXnO*g|AlA$5a!Y8iF^Ek;Yz|^e5Z)ksL2M0T z8;_tM-U{ONAhrkb1`lVa864ru?r%HY-0`2VEcGiJ3?d{FkUJg2%92DJM>}j>`ko;6 z24Mt|2qMWNG>BXfJ5`hpBIEd)B6b_H|KYpDcRO|22K$28AH)Yie5ld`LA=XjJcxtJ zz9VFN{@UX@?C|$Qj26}2n8W-Z-E*i3?ERkObBH|;D!21AynH_ zP%ea`koASFJnwqqrJ)eAD?LnwB2<1`>8Th3(IdQ4X3SO&p-KqH_PVNua7_r;hHzB~ zKbFkj>MyuD1R^;J4XTAuT?(_dSTlqbXWZ9?aD50jh~FrzC9Ex^LD^KvI^uPO%u>8L zWIfZ@E`$d{xFv-8Av9p^y*y2M8V}*t5E_PXTL`y@tgSq`rDmfL8mrCR-|dbNnuM%f z2JQ^~yWIeJE$$bf?>2XZ&^&}IUvak$p+yLH%d1Vux|xCR4QR=tT@_n}zHJsGJt2HQyNKytk^6-A3r|e1*gk}TyvQGd$K&Q7lpR9osNfF@Z|r3Kf~dZ? zuyY7qLe>j*x`yzOin@iYxBT@8;b9KoKkgE{3cE`uq24ouULo|BO`j0@h45$yeU)YD zBO+AD2O9pL^JRZVHPEZI#LKqsd{#rFc7^bzsw@J<5 z;t_u$gb^V;8NyQ`>#F_>A&d-R6jxD^dvXY)xjsu*d^&`&A&d!G|HiUwvsZb>so4{@ z7fcixAHoEYXM~IO-t1>7ZZBYZE`&+qQxCeBy>Uswln|zdKr&58^1KLdj$#{LR7<7{ z`CkKD`%(xqLwK2Y@l|xc62hzyUKQ`s%r!fNIU)Es)XiKhog2dH5Y}))LwGHO`5`Re z(GkM(5Eh28NM1`qSRBIHIr+^8SOJ+xn3k%P`U)O*;;V$zSxTLRxHg1!A#4lb^$^yF zupxvkGTW$9M%(1rlW$hh?q;s7B9|*=sO=%V5yG3&-{RPc*lpMmg7^Pxp!DExBf*~&M+sM1DzX{=qnDw&pZ{_}-aMH<&JTWdmZoQPA zcZHn_;inMJE6&d$>y8wrzeD)N;lJ_>DgJv1f2#C!2!A-GXGH!C;V+T1Lf&_6$2rI2 zS9hLV2;pJ~mqPd_1ip9Zj<9vMcZE?VjIv=A3j<;6#=qiWD$h0IXI6Qx4ui-+yEcp-^Q>mD zlxEds@bEm;R4vyDuMb;a2yYP964n+{thCxwCycsb)C*g4_hrMPMq%6}esdVNgi$|? z2Fl(R#;qbWYZ$g(yhg&r$tB*dBKwi>#$hndDj1RI)u?Nj0eJae6=+o?Pb~Mp`yas)>V$dnIdjf^y+F)=P(`$TRV_;30t?+c9q#7 zxzMbevb;mJM;JZB=od!+FnWd2JB+?zJQ7A98T_!?!#k53>czj0hOM`H^3|O!$5`+7 z77$d{DXN`wxbQmvgC>SNQ6=uh(bX*wY!(h>6OOgr7J|m>> zoZg;A8ww_cF*%GiVXO^fN*GhacrA?iVN46-c`l4FUJ2s`Hbb8jGgz1SbVuPw#!KQe zg%kA&LgQJCFXdI?Y$0{qV6L+BgtoFkd_@=wIgep1cI=mmED^Gk5Nj8XV6mAM*v!ibjIaS=XEsWR0*dE3kVR*yvNq7$#-1=bly@KC z0rj%`Nag&!VeI4DTjSZV#RBG=MEtyuScMencyYdr6UaYza|OWzCQXc*sz@k1Ez zhw(ueU+}OE<3pZj*xF*Q&%*dPj8C`%i&@{Dh@bKhOXb=4?ivr3&!v!j6~?hJzESq; zFlck!F=i>fPJ}@hl5fNKPDQMOS>nksehlNcFn$l?l!|^1cX`V6F9l zL)X2o63UX-E9cG=FXl3hE1h++SyZBAQn}xSTP(NaQf;5QWNDmLmts)Jb zY@-O8uk|#Mabxj2gtVl7r}U;m`x-@a@sV2jEh4x(f|e1qieQBF))ADxqNsla8&8yK z6G7VuzMAU3CxT89bdKQO2=0sE{s_*F%I9s^?IUO>&g=sb1gg17Iz-Shg5hgD4@Rs{ z#wlw(+;b@D9vw5j^a0TK0@syEF8Tpicz7*s$^Wf#oiy z+Uq=hBX~4|ei4vA!WwrLl5|*S#ivd(Kw~wK(IR*(fe zwqsaqpAy%DnwGnKO;Ef2@MNl}vvpxd8 zh33*6_fzXU8^kw8uqlGg;@gBY*b>23hp+A8q4K)2t)}D62;PcdUj+Ljcsqg}5u_q$ zak`W@0$&8-2qMb*g#iwG6V!PW!3aW9>@4l0%Er0aZ2kW&O+=84SdO%0B1uPJMv#dh z8^InK=OWk{!LA5)YY^)=sKj>o7 zHxYar!FLgSAHk1ysqmz*->82h*v6-Lh)Lo9M?XibkI`Qu_%(vxBKSRm(^9UC;*SW< zL{KJ*vQhjQ!CyQNM=j&C5&Rtiq9`84xd_fja4CX+Sak{4g$ORn{X_{D6BQ=9xa3$Y zih1j-4|*06nMy>F7ez^xULmyXMM?=TTT(BOQd&q~J90T?D++r7;wZ1~!9!2N5?wV0NP{Dm2 z4fYmZAGOYeH$+h@il%?NYe#Wo6m_Dg8^x_rG>l@$I#0bQZjRy>@tcHn*?1f3M?q|$ z2sEQRkp?Vfy3LL}#MLN@#!=i6MUyCoNAW}ycd{AtS6Q9KmIfG7q=(JhLHqv$8g?!vyp9#Qm+qE{5Xqo7xxDCk(Q*otEZVeJg~ zh+6V!)M_>j`YUVKMdg1A^_Y+%+c_wT!BIRO#gHh5Mlnpm>BvNT#<%&1D4vXBjU1nf zVq_H4qnHuJs3=BLuZ<~DjEUmuD4tP`Y{^&|kB?%U29*gQ9Kv5YMB(p zWQ_^?a=AMsQ{_7?iswaM5WXm6G{$5vUW#I76bqtQ7{$v`yu#x}2D8+X*-^}i;#F~0 z#D=jAbY$?ks*%~(WItbM*S<)6X%x$%SS-FoXxC`t@+elQ@hhWP6~$^rW2;yN=Yn-H z6fM_kE=V?T(MC}iLs1NyqSzd@zTxD@uqBGEJSXsouI%0x#p_WVjN+Xrwny;>kDw^x zQR|1#n?ipSZ;8Ck!yyWk8X zk&GfGg)vR8F^Ah>GmaNacdBTQaF=kmkd}L+*eAYUctCBt+`M6nFOgk^>0gyn@5gtV-v_?{T9jA2gJ zdY5md7%IomDTdB5REeQ#%zAvIT?|*ntgl|z#Bi<1)pDd#Er#kb+|D+{P$Pz#G29qK z9mbF0`WR}*@X133H^gw^!2+gQBF}kUBfT!_Boyn$P%no1F*JzbrWkIH@ev`{EkY8e z%a*ss&@hJE6y$OQmf8l5W4I%RmNB%7p-BvPDnj!ZnyL-WVz^6+-4eTM25Aw)-7!Am zWYt1sqCx8z+Qx8?Dr%!rTfaAk`(n6XirqFE+vEWaRC{3uVMifH@4=XL|368Wn00BT zTMQ4!tbb>^#;n)rKNQ0oueo|w%D-!pyE{8L-Q6pO9x;qv@97!Cwwtl^f7V6I-ZAuv zp>GV2#4wP9&vEWh!0nPpt|)jkhJG>hk70l&g$nJNNFL*C?kVK6qJv`?6vKBqi;kL! zJAW+oxQyR=+ch+XVKEGk@#-jQq){`C5ivX&Lo$I>0#C8CF??a*O9P`~7#+iW!+LUd zObk!64F>8M7#qVldwCcb&pyVmB#xzVJQKr2PDC6{<9IfPpH>xkWAJenxHD7?lVg|? z!-g0(s%UBqD@ABFEr#b~ctP10V|XQoS>n@$Gh%p2WTuezFN^Tj@mC#XQ4F)Wq+^&X zWr3s5i{UkPfj!!vM@Qb5Zj*&E>+W|di@Agjq6=*f#Bfj%-cgp89951O z34NIksq}CRM?~HeQs)R0KT!6o7(NvFD29)D@W$|I3|~t5EQZh75#IK%ET0#+{Kx>S zV5JOlEQYURI3B}^7`~6;2Z`Ur@T~|9*i^28@08_@B`0k?hM!~jQAMZJc=nV%`Xz>6 zd7R3Ij=#lV_mrJtC>k)-nHc_z!5v4bIR1*^tc**<@pla8Vz?N?r5MihWWv5U<6z&1 z!w3}ZzW*aHR~*GOiD0w?dBufXY`oFsia7G(R?F$dR8nSkGxFmo8@KLRDu|=Bblw$1 zn=*0hnHSboE{^hX^wnKS72+tAjeSQD%{*~j8OQY!E5)rw))cQCN0m6L#&J~~)#9ig z$JMIknmDc%p)c>eBC-mS8mwY}9-GZhkx;)*aX1L})Z7q9Eh)8yG`LY6Wbf)qsTaph zaoj9^Ya9*ZxFwGI%5uIMh;Yg(WeaYL<90Q*iNr>6+z|(t2V*u?OcEwe78eXjvpDXG zW3-H$$I&8=N8)%ij=SS%8Ang)t%MK8(MhDWuuU9oMed2?-Z<_Pe?WM@uwC3*6|BOZ zk@j(Ph@+#5?6Zn}M0Ad$TO1F^(M3gFg%1gNINPo59!C!;%yOc6nj+~XrMIw;@Pz5= zE5gH*2K~fG#L+*F0dWkB^NR!q$MLxI$Ap98))df@i3jPBIEKbCERNxEFl!$Xb{l9w z@&w09E1dkvIG$3FkwPk?;?~1HG#C@d({YTIK1(<*j`1QB;&>^Jnfw%pV=CQHd{lQw<3<372RvZSH`hQWVMi`=Qd)k3}~}XWPKbPL^cYGnz>lCC629e-lB$h z9NXB=z zn-~V-2*$1b1i6_Yvo_(IkRx&ITkrYGlTRMy!l>=uxZY#Lk%;4)IKGV|$$@3x<2V{e zIu0|Ay>wA`GI8YM*eRZk!`{P`TdD4fV|N^T9EBU6vdB*RxsbTV;&|7N;BwLaVBFe+ zm4kCg;^8=s$d@8Z>1da}AIAq=7;$_a$A@uzB;!wH`LRudRO<$M z+Ap`$ZtZVz{O+`h3e%Z5{*2>X9Orrdm-|_s{6%aRMz9lGbs>(6aa{UO1Uo)0iy44{ zat6v9C~lyHfl>zY4P0R$&p=57Zo}$@U8&tcA`_JY1Emd=F;Ld9nq-@CaL6xX1p|c! zDjBG3pvXW)10DlcDyBUhb|@Pep^Aa32Cg!2wPM;~?Pzwrw7J$mHN*O8z%2-?8>nHR zroo>cxWPaz1Fto6@j-09h5mX2r;b|>W%E{NUS+LqSgV4{I}1_Qz}ej{-tcpiVZDmK z9^1y}QXAlA1GgBcZ=ivJ+pL&*&%fZlRivQ-a=v<<|ASwV@4nqYBLj^M++pBx149fn zF>t4W&IY;|XlkIDfqMet_B`5@Th@)2D%w|*g!81pn>iN zddRY;(bdh*P88T2?^=Vt)ez3=DEg2Qq?z$CR}VF4s=u!A_5c8W?8a zSp&}*7;fMRe#18~T3#cBPYIv=Pn?nBj5fx=(*`CeJ61SOX!m-&`0k#in0>~;MAgXd zFw6E#GBDY|O9o~dm?Fz*oKTUePTO8E@S=g~24*k#z>vi)=8kNo1qY>|ByAo5e}C@X*`fAz=jm zFaNrM?FQb^)W2Rkh6u?k8+0%>(-Io z2Da66M+`&_#0G^ndDp{vrL~#`OLuQjtz^xGH{Fon?RKWzBX{2=gfrl z*?PjjHwNB3;^MDwHuzfue`q|vGptgk@A)ZU;3VT8EA^v+Uksd16rSRFxP8G-viw>2 z(+un4-rNnIUk&_b;CKGcU2eTq^)&0s(5V1?C=OwJm>?IR$C#;u7mP%NAzgD8nKu>-G z1qqZ+pp3FbLh5A`C?{S%feHys80aZXfQd!q#EOokN90PUh<8P{-BZZwswOZjf#C^U zmB7^rT$8}H3EYxE{e*SrWVHlpiI7)ktHf(M%5@1`FMflga7$%c)>ih$1nM|?U6FbT z+$3_daAEh7G;WZ<{)Dy5!|e$)N?4yhylm1qfjbgtlR(=9nj~;% z0<98goj_A|C!W_Vfx8mm76#XSRdIz*dl?AEz0;ecy1g~lG&CLxv6^p zYu;>Wd}082*ve>tUr?M+d>9O9Gt-8 zPU#Slp`6f-)*m`gBrqa@=XvZTtPk8L6Bw1iXz`~K7%8%Ag;g|0oa9-NrxO?}GEO+2 z%PfIs9Gi&=yyxtg=9T+%Dw-smESzGkWGgb$G!gz;KV^>l#RO(1@Nxp=(-WAXq2r(I zFY)*ql|Oceix=KsN#G4@eDY=`@M;3H6PT00(gc|(zyobDR?{qjb#h!Qq{zDH z#jxw8Fw2-56WEl%X3oAMvq^TnM5fmr%k3gm=tY}16L>3ux4DYcwQvGn5q2|>fY0H6 z5frz+Xa&VX|4}01QDH2BI6E$$;E;ZuM=!qZha{bVnZV&BjwF#uAe%riX}!rdm%vW0 zu_XE>u}f#veLNM+a`QB`JApk?$oGm2;p>2Sh$V0^fp-$fOQK{F?tMdD&bNUJ!as*F`QW z_3NJm+GQ-4MTcBSS|i3(LZrBmouYDu_;Mc6Nt8-|0g&8aE_SD~X$vxJ8cqym_lM2<@4*(Z0}HKZyqNrRA+jG~|LTZCzJnV%r+2sA&?-7-3&t<0S4# zqDj(v(2SQ3nC?vKxy7>XyOL<0M5`oPC($B_yOU^{{P&7wNnQclZ(ZHxr3PY~q;)-w zmj&7?IIr;Vg1{5}RhY#6QhEv7CDA#FE=fF)MEfKbrbbqX1Tl2Id|75iyr5y=vpvpi1p6`cW)e)#CRU6iwcG( z!R!-Bj7Z{1@u!j)$@P%3HhCN+WvpmUs*IciTN8n^I!E$;ey;%I5ml>OI>wqS*?1vNB;9kel-FK(~BY_+84Z( z#LOgCC$YvV&3jp0Ta?5rNpR=ZSxM_Y-dB^D%>n7-nZx)ZkaTJM0}yU~*>k-t)WmGIm^>qW0@@Y*ESt6%Hn zNadT2o()NCOkz_K7dCp{PGUzAo0Hg*#MUIXu_K#2ZzM75>Y~1jimD7KdR>m&xuP~% z|M#)<%_QEE*?{@^%&y$z@$$f*oxe0#;FGam7!b0QUL2DU$3KZk644}LN$gW;+?lVP zB8D)LM3RR_5@}^~NgSI8Q#>Q&Y-Sl`Q31*8S_8WreYeOS;a(wq_a|{6Y5hJr$oUd^ zN677E?Kj6BaGjs`K6bQur{5k9dry&@hFMdH5u8bqd#{@M#jC zC2=x|ACuq(gwK=sI*H>v+?4&2%XN(VD7(C z2jP1=T&H+UCGk%Zt`vUeqS8KhXOj3u{8!;`j{dvI=_LMe6mE_8r}$rva#rMT_S#X- zi(E+JqN7~mA*Oxhilu-Q3R5Ubp?C@AheZ=DOB%~&-)uMjrDj^7|neZQ>c`JvB^_8g{mU+ zdZLO5eXkN>=~1`)+7zm#P%DMn43a{P6l$h$U5amfvhF13?VUt!yEbE@yU{fF^(hc< zNa2y0)+*(XrW;eZDTVGYxa*{>ClQ$Hrch6u8$mM5UpF_Wa5!FYi?F_$-9UJto9DI^ zZcpLf6z)q|>w%NrD22u;+>t_)6yC_>wMgO4lr`5Qv`2GO@n%Abccsu=oRiM%-6^z8 zp;Zd4CALkWjbq76QufNZM+&!$r2YLVv`e8&3SCopz_Dzf`ge_WaFmWB4+=X8I}7cA z52dU{+be}`5*hYkk?twq@#2c$4Cg*P(=|Kou8 z3Pz{!SPFwuSTM{pm?JjPGhF;};gA%Dim-H83cnBYknk0tPoyv+g=bQQOiyxzQy7`T zC@H7(1$9EYB8&R@tbOaorZ6srRVl1aVLaD>kvBDkX(AJZ&v05(cvk$m6efvyM_HDW z#Yv{5U@Ol%%90dcVQPI%W$BA4OqV_*g_ly8Nj-%{QeH`6Rtob{crArjQ<$B?T(05s zZYDa;kx0U<&F8bfDJ+x?6&BHpr8X{>VrQ48uuR$I!WF`yFIg@t9lj=owJGdMVRs7a zQdrMkq~J?oLkb(UR^Qg_Y)awv6t=TR$-K=eY)QdCyJGL+MO#zYmI4XW-Id&5@)Lo_ z_{IXh&XoMk6o_vL`Qz8MxnKvI+Sa<1!P`)2<4+-wLXanoT1AaEdv>M}Ql;S(B3uk9 z#8OD6kV+w*Lb1)BQ5A}8G&q|TiV{NpC{CwfrjSh`m$H5%(6wD~Xv;zz=dg+I-6eU`#)%L~3u;ky(*7yp8TlfqZxEIN_GF^7LG zay(@{E5stEZye?O6klSGUYkAtq;OIOzo&3Ig&$KmrR-0_U-&5?a=qzdkY7{y&B@wf z|4@*>Q#dDbCWSv!_)DDCG5%TANOE2x$%Pasl3WyC67m5tDon04ilu=xil;4`D}*E^ zMCh28M#(hXPS*Bf+X~WXGv8e$jjCysPNPg3V>f%s3M&fBrBPm_g0N6XnnWNX;e$2dKy=!t%rcF5t3Y+#=998NpG+9MoOk$Ue|SLT%X2g z8GN3>4QbR$;}a8~ny8)Tzf`DfqKb(+Y3s}CgK2b1TMzu!O`~2KH>Ir?^WL1snc41p z)3_y#`e`&sVqv8n>s>D2*m*+$r%yFY5!YaT<3hOP9xbdzz-vERDOR z+?7W2G+KyX^PKfPlQtwwBy=Y-wUR+=4yj06;XOhIq``e@aC^1;S@q&_?Sv!`q|siy zgRrBJZ)#;x=QO&cVWg2rqiY%ur7Q}!|8FySEK;4~f=VT2)R3>9B7&UylxX}Gda@GhV@;3b=}V5yi)l<3pW!HWXJ;z=GN&VrS>n{~qB)M`e37}rdBWEmn+1-|!Za3% ze{j@l$N?dIqNv4rXTi?1Xnn3zKG}TPGe6Rja{yt z%I*@UzE|1(!hJ%Dx4B%z13Zrzc?X5>2){Txp_`X}xHjzuB*zV*P5XYT_!>S|@c)Ty0ukV3=+&(f^?98WY!= z*k0HAe6MC&SY22{SkuIHBG(IPPXqea;-`S(+~`EBBeHxp>Y2F7#LXsdF)`D`%O>iZ zXkcQ7$(O?vut~R?eBl_{n`mg_HWRm-Xk_9}6PexCiy*4Bwy?2@P4DF0VWNo%X1V_Y z^`<78nYhbDa}#Y$v^CMf#NGTDYVB$*vzEeEruBac|8eMC&;3&kH{UNocLuq~#C<02 zH?5tx@0BHg!n9M?j&J>zv+;y5`{d`1S(nV2LpQTVLT?%HHdtBL1LOp!R1gD-Na(EWmm7fnq6 zk8YRR1}~ZT)@S`=!mrA&usRc~O{_8TDp$fh&m0qTIlmL#vrUxAS!OFYd*+$2pW%AV z#C#J}7MNIMVzKx_A+NG75m{;DX3tU+%SVw>;Y$OUO)a2sqkF|?Dbq4v(;)8gAqylx_5BFb5d=WXYVo7iFE z4P~jkDe@K%pPAOLX|J+=69EyQFxD7Bk&ub7qtKW-kuUM%W8g8?qVMhG%ZueFOe9Sl zm2rwEe>VFi&$}i}j-H8)Q$1yO7k<6jlQpr+#BLKgj#%d+rky6Jlk73E*TjAk2c+2g zKJfhk&lEQ3m4S zvoRSg$lwbTU-ArNxKRCLnBk0#ET7&6p#ic@Ujcj-TySaQz&tB~Xu5!#UdCVuX)#ZQ~~L-yoUSm~e2 zlAm?-zZINC7ff6*0SY9t;N2@JfCxaVBeog(`Ba)k>G!ovN!7U>7GiWHn zmNXE#RmlGbZ*%n9MGB6%8fS2ac#{n7%%G__|8s06a#se;GvG#t4Ao+;yF~`Aq?6yB zK}+%VDs3%(%UpMx43_GN*LyO!H-q~!xIcpzGI%k=zijY82BR|=lR^6oI%F_HUL7-d zFoR(k>@IM3%Aj)weKU9@gDx3#l|k8?J{i>A~-x>s4BBL*`FiKjCNi^MZ9GKh#rGl(gI9mK|jijqP* zPAUVNm>FcGXEWF-k`uCO8tf9cgY0$2^N7g44E8(90g;0lyd(0iqaPAEEaXer-gES$ z8NBcC4@5o`ekA-@_(=wzif|knZt;AP!IwPSXK_4>uQJwsI1gm4CsU45w6ZwCb5Rzx zviOE4f1X8YnaTT3mcM22dj{W&|G@L4_Ub*E!H-gCc1q-@41RW$Uo!aB;S-|;r^Wx~ z36SgA(a(tdDf~-#mZ$DAZU#KBY%#Urf;h#CBA0~!2wgJhy2aYE7FiTmwuF$%6(Zb7 zx?~paEJ|gOFXh@S3Pj3gQ7((p;$?*6v{P;QEGlGCRSM%2id-oy5>^y?g#EX8Dv4AU zRuR&Rp{{cH)gsqqVY^gQwz_b^7EcY4nps>YLf`8}dS}ba~8K`aiddOCyTlc zuP1U-7Fi7f?dxaJB#S$qUB*YUcy)-YRdqL&ellQoKo$eV|Chz!EFLG98EpnRgl0ps80NSPRi!jw8ZMEw zJekE)Sv;S`3t5cJVpJ9rvUnzo(OHa<%{a&FX=Uj<)=|jE|A$Xhy_012tnfLfl#QP( zJ|&B(Sxj?!MBVP`i&?ys#Y}lk7tRoN9O`;Gi&to$#q6y0U6+;4ayn@H&XMJ7!ns+@ z6QS8(4Xt6Huj~RL?HAi5i`7{y$zo|1Y{N3Ojbyp9Br8N#%9z8rCX2P4=q%z{tjl73 z7QQU}S!~E+V-~Mxu|11+y|5{Z%~@>8f^BBibYvS?=~gM*9GyjPWbsxOZ)fqQEZHx* z>`k#!XrF@meF}7`zwXqTL1W*21 z+@3?DoVBqRLw%dI-dO%!7T;&_Ll!4_7R@0)haa;zmBk)D#goHNS^S*Exh&3S@k`da z%`%=SymG4h*DQX^;`gj|q2o`rjpVele+bWH!L4H{KFar7|?m$LXrgxn>)n2=j^We?^R&w*G%c!e-8$1N1CTMl?F#htS* z$neTZK@O#JsF}lc>}d{VbGRmlYjY@U1z};1FDgOB94@?J*)Vye zUtC_YQVx}KsFK5^$@%-nxrtSCAYr;HhpWZyqH3(s$g7@14Uv9Bt%kMQUNCB7!No0} z>vOmvhnsR}aI6&DP%DRe;*P?E74`Srm8sZdtEcN$4>|7%;VUC<&RGx1 z^2ym-a;VRaOmjEL;Z~6cw4+wT95-CH_UGcwy+rQv);Nbpa(Fa{J922kkxAvt}UVQ>zQ z=P+F&ZHDCVbPi*c9V#3q94>r9I3kB9b9hR8WDcWq){SBG9hI}*=FK!l3JLXbGJ8%q zUN}McjBsKO&&rE0^tRI^>5Mj6WQuUAaGLOW&Y;MPLR#|HEaD7hUlPs~zASu2I4g%& zbC{j8?)aLM!#s)fnwzuUVNUW|4)Z0l*=z}wg^tal92Sc&ag?PZM^dikIjqQGWe%%& zWbL#Dd36qJ7&C`sIjqfL9oKUXnH>I)s_%eyqWZpmZv(IMs5gKhqJTtfQ{aJZ!ejWWRgq?z4zXG`}Uj|KmTjpwb#D;o_p@O^}WnY zCchWqk0Q(|!rUVKS%kleFrx@Fi|}_5CKh2Tmll7mtO%2fFh!g*s(&L%y#b!ir*U9q zxX5WRODty>{S)w;@>^Q<=VM+G<`-dE5tbKWK@k=fVQ~?bNKY3P`QLnGT@D%_U0YfN zZH_-CsX^e=fb_hAqf~@dMgFgVG22SqlB|zstSv%O5xgQKix4bAs0fiFL}gSpcA*Gi zo)z3{BYdAm5m<#4*$^iyHD4C@W|99mTwH=@*BAi%o+yGX%f=~!%P}#sQtO9Hh-4jI ziTx%i+K{R%_{<3Z>BNV|Vl%sz9-OT_QpRGN7^Ggdzq1ItijWxug4kVzJv`6Z!6NJ} z!oDILD8fOBc7Hm~)R-J9@}Ku(goniyU)|5=_c+eSig3IL=ZbK?2q%hgl4eCXTZB_G z7hFGlNbj^%N%f-r2ymzwBtyMWgo{PE!~<3ohQ}ui87&9uN)fI}7+3#Omm`o7{AY@b z1yMYRGC`D;#a1GS+#vFT$O=#QsiMs`sYKKoVdzCKYqI9 zBbV$QXPj+S4dR9%ss(Xl5RHRq62whGR1c!Qc&-sdO(AuIxH*Vhf~X@|I=NN4P%G#U zJF{FTwS)fhAZJR&Ur&s=oNf!^_8=NawqX#Bg1AHYor0;~abV=ESWA8#psDC>g19G$ zWYOL-J;=Ujr3*vFn+tN%3o48*{yCB*J z(LwkFL3B!&b`-*qc`&U^lukV?*+&E)4WhGk425Km=eTP5vOq%^QQrX zr-I>J%nV{y5VM1r6U3Sz)&?;*$XEYiK@bar{_m>Ll4-uw;;1ePVzKPvWkD5G$l~rQoU{R?F^SV5z2yM2`vv1w(=wI~#-{JR)cY5tdnCT_&!7CK4-% zSP=0b65Q`WYzo2_dry!CP7rRIvm?nM)=74~;0D3eFOtxBbJ}u85L<%SD%ovZlR{E0 z(wLSz)0VqrRZ!d$#NHtG1+hPf6G5B|@?npEPMae_4hkL;JS@n0IVyw>j|n+0$SI?8 zDu_#xJ(dYfsK*+!K$@`xC8LSE+{}w9mjaCf#J2atKvIxGRKkjZ)W# zP&I@`Av6x*h7hWSP&b5nA>0_kP4pZ>tq`h*P$PtzA>17D?*XN52JueNEg}D|5N{Gu zVb*_rWr!EFeO^b9*_2s*A-9LnK*((&|BaWdbw>zyl8e|-u;Nhvo)pus@(*^C5SoXe zUGX17Z5s0bOK(Oe4Y7KXZ`MMpv=pSbR??%^A>188n-K1i?EQipCuZI&Aa6w_^yMIPxL%o@_%dlp%5Mp;gJv?4dK}ko(rLK z2wg&WDuky)cr3)bTIN(irp@EYff?_ZVQ{_Z9G zb-~_(`IFVbdHHXIFd_t!H$!+!$lHSNhR{z)e?c0&BV>T!zz_xr87z30xEdn-J;C=w z_<##f_%K0w7%Jo=!H)$$34vcnV$pEPekz#qN%6A~MvC&eAeApd_)_>+Y31t>Mx{Bu zeHX&_A>8&taW0P^LimxJ?x|uOpDOlKh_`z%prF{mf?~gfFgk>VyRm3Dehpzv2(ve0 z&PI$4;WrL)9651}3t@Z+OTt(h#)J@l=cX{w#K0dR{29VN4f{3x6~f;kjMea)hKV6e z;xf?iyoSjkOyM5UaI=P~Axz_FYp9`NdI&Q@m^Z6jXo{K{!Yqc(ZOGO`m=nV05VnN) z)kVw;!Q=`IVSWe;7()n487+rmch0t73qL-WwMZs<#ng<&To{wpyOY(j5SE9qHiV)O zR&e{5%w8G7DlsEp9m0gkY7L!q$o{QyZm?GN(#dMwWOZe-3WlI_-Y4XQxU;wp59O#S zs!p-epC(HiqSu+Cs6@n-7ebQTJOnF*SO{@Oi&72`x3!u1^YRj0lOdd5mqp%dOWt(k zveXrud#0$;O>@^V+G!aZLs&1~x=v9WLiluw|JivHhi+U>hr6~}l!nP3h^Y}{m zH^;Y!u$yC;kw12d+7ZG|sY||#BQJG-Y?HeuguR@U5DM1iH2PmgDjg6HT^r=n&*2b` z@SN08M#Iq%jxlBp#WWn}vDQ2LbO>icI3fI`;3+{Ct(cd=71@N%lq!HwlSU@xNDl=xFYVDJp-e zGKQ79g}R2$8oFqxK2^1zs$N)MvX+M08tQ1MtD&BTdo};iW~#5DiH4>cZqsnPhz$fA z3f`fi$5eHvAdMTPYc&=!a;j=3q@{+tgf!RCB3(rLR>DczXlSkBZpo$$i1$b~v!s(MtAI=MU5U)7IkI5O2A zsK+&QxIg0w!6!95B^93*?B8d8aousi=|S%qJz8~jYk zaT>;Jh-rvxn4sZzp70tbY4}6KpFH_B{Hd7I|X-X z*e!(mjkloZO!e(dwRooD);Pco#p*h?>o}z0FegjLL>)(X_-m-7<2oJ3WEPq`S><#b z*Kk6^NluoA;yOy`I4zzp2%Zr^>3g#_&s05sD&${P%u=OwgbwG7zLZr)M_EZdib`2qv&vIXWHBin0UZ@|zBJNT zMrCCX$LuH-xFeS%P+7-wPF8&#RdighqpHpy7sJi7R81W(_06DhH61tVxJgHK9kj0@ zPF7Vao$^ChFZRu#ezWMe=(tr#Ey3D4>IkW;qn?navlOc^c}sE=7qf2Dal4KNI_}VM zr;Y(S2I^?YZt8fJf$3om?HP+xK~FzDY{Pw?c3_OKW&+^p*{8XIy#6>p3*z%cuaL@w=snUNQaW3CRmW>O`s#Q?N3V3<-a1|vo{F%~|E=|=j<Ja0A4ztYj*o?WBAAMV z4*&H`K0?PxDgEp}HlGVmS$?JCYaPGn7_DQJj&F4QB&FY`ZGI5)osRF*N-B&WC7a?u zr}?is#^@NQW4w;BY5U(~d8C>nP7wWf9e@01{8N7Zl%l`V`Xn8bbxhYWLpJyn9aD8o z)6r>`e>C-)J2R2aEQf+PI zJT@ss{_x(Cn{;f}u|>zet~pFgp3ER_l`Q!V9XoYo7|1lROUG^gLkbWX>4Zj&9k7X(Qz3b~}?vW_dliCgNFV-fxTFk6kAt(MGI zFi^}uj)7bQ#SN4&kYym-!0TO0?w_p+=P3TKNc-k<)UswJ2NV?M8OS$KV4$RdH|F?n zl=@|knls0@S+uMqvCu#%1Emd=F;LdvZ%tyzsjPAa${YMqOH?+X3=ayDW;VEiUIOh4bUK^za|9pRc`}*4BRb{bb;0 z1G5awHt-8qvH^X*n#7gUCHq$n?9!~?4UCcOSi#=}Svtd^&iu{63waH;Xn1(V_(vX>iJVPIeJY^Ie4hAvPf zYYeRA(lrp|K~yt$>H_~`d%X=AKOM`8lNZkoaR(L8)dY2eKPT#oVFM8ZrwyFpMmAs> zIBDP%cQG3+m3`Mj_54B==iV`38*mKlWxEDkZc+nV4Qw+|b)iZcyshaI4$C@;cD;cO zLQ*32O$IiLvPFa%Pg!0k>Oxg!k!rh04PNAv8H?1; zMe2%yt2{GJG&6C{K!(Xzh~Q2WnI>SOz(h$C#Y}&(wOy==n|Qcmc7?_2jm4^j$sglT zSthcD^~zo*onCjK(PRehI;l>>I9%|M zDC7^D7`jA}j1eSx)I?_~T_(!oCY~_ytjV_?`Tn02eA>iQLRjnI)49(G&+K2YWr=#; zL|4haB=~}f7lkzImfdAx*^}b4n<(YJ%BI5}CVFytn0V8~%O>CTt(aaDgI7$vDuiaW zKhExD;&qen-&Va%^fA%bgn4Hni#iJ;FHqI zn}R>2i+(im$~iw;W3KP*7qJ{;VyubLCN8$l_*E1ZEqko+HxuJb{LZ=P?$6qI6BDGA zci+Z}+j*bmQ~!foV3t21>z4YP@o%oEMQS3~;Zns^ahaN8VycNnCKhuYE>rIe%b8~K zm9T2iGBw=4!H2F>=F zcs`^)45|Gl4wyJ-;t)^WFiM7T*u)VNmrYzTan!^y6X#5v=VX~UVdA8TQ(R8VRoMo4 z!R7wIo;LaT3Sa-F-d*8m&n;IqSE#d`amns)mv@27#>6G*;M5h$T%iuEP=S@I&PsKa zhrfxeFtWqQ2qQBLgi$QaciQ-_2Ch`IRw{d?Djw$h7F73D>hMZcf)TD%jUUL%2_rX* zyfE^^7_~}GT&0RusjI8hzUT4+tNrTFtyYC$lnSG27&nAbI*c-51j48gM%ggRg;72X z73TLP)wI>>^lDXdjjFdswO^w?TBD|~Q5D0e#CF5DK8)+aShYsgS*v=iRp-~J%3fBVQ%aFXU>vhvoA17@2r?g^t^812KjH_V@qQ>BL$>>(`vq4> zRK+#bA&ke^S^;I!p?oY^ow2;;-Bf48E7t|~gbMyI$ddDFAI zu0GS%$6QliF*1zL!~WZtM{_+3`BCso!LJ0r z791t`jUes674n_n_hI}XWHy6|XEFUG*`LGsC5)i1y55t)^s9(09V29H7{8^JaYDxP zE^u1;J&Zrn{7)f&g|XwNyp;cmVN4Qnau`#DOck6N#xx-`n;ymt;pK-EFgr{5Y{5}q z`^sKj@xSY~8D%(k3&L0!#-cD5bITj5y`gIK%X`&OZEBTFT~HcnsAXX+=XQ=_brdVY zSQ$q1C|X3ZDvZ_KP!TkYU`-fn!?+s8wJ?g<_b}pNB*F-Vp@m_E5ewr!H&^F2pQ^%! z`qNNG7-kqGOyMvh!lQzHwiQskV5qOU=aw?qL#sAdG`T z_J*-9ZL>cN8qkdCP#8xPORA@|0WRN&f^^rvy(6o(bb@80Umv6r{m9pRgS zRVl%o2p6Zy70eUNkDx$ENx{MhA4^cQ*(F#yf-({0L{wR+UOl49MNnS2ilBm!Km@a< zm1GmVzC=#Ki*NTwRNsgnNtFn$kDzJ|UJJQDF zjUs3qfr=s!MUx1cveywTi=bHq%_I0dfMi)w2k0i;mqDAWXRc^`y*fxQ@aS-r#WZ#fe5x_mh31< z(n&~OR6QKQBN4n9!AlW58bN3JkE&-P=n}zW5u6;CP3MnC@B|~t&v;6D*Y|A3lR_Ft z6%C#i&ZcSktWU>ghg5$h0($5f!OKF(Q#~TS zDh90hnh*{`?+E%t@RnG~6aod-xkpn0;Jw*AiM&a8L^oyXs1WyliOOa$i1Op=& z6v5yKhDY#e1n<&Y1P7vOn0R|r;)=*JCis0v{+P24EIWcML6VZ2c z&!C6vEj1#7&m#CSf}cbmDW1O){9KeTBKVS{x-P4hrHEfgFiNuDNa=Ti-wM*<_YwTS zUYyS9W+}d}iS`tKj$n)!{332gNARn7*x5aUiGhuc;I|0IMKE3rSZjh9uDp$rPFEzascs$ixUHagKUs;A{@lIhqUE_2o?%oB)C{`iQt)be&ov|Si!?2itMPrvsOm1jf**^RzG`98R~@yu1Y)?1usP~A*L=1zapGl zhRU@FGNQF=$MNwTy4LVQTl#8pIh2N4^ZjGXra2C-C zTOnbp8%5)|sux9lA-4%qxjl*oX?};0JNe&BzibvY=HVYj(WL_xjPk8YcqxjfqIf!ru2H-Y#WPXt>R!k{;(XfV*(jc)L5}}Pndx~M zy46MgzwV#fYND<9m_#>mZ8K2FpeTQT z)<0_AP3uFVcu#mW#~+OkqZk^+*eHIB;-e@&j^d{%{{-L@HXX(AC_as1+11>Rj(W{e z!yL8LQ6r-MZNX6-97la7I8yL)!7l{AjN&UHUklQ*a&NyQ-$e0kI+E|A_&&{lh~mdI z=lS+a6r-c~HHtCP*0urJ*BsT_Rj;_}J6El6)oxdfi(-6~zc7x8QA~*9_bC31;;$$& zJk`Kce{e!Q^|_~Jd;X1G*Hc3tF4^Z=`AJbsj$%<1i=#N}sVPy+;(sqmH8qN9Ts%=6 z-Bd6mikVTYub)HSr&T5~MP_q*Ce<7s6xXuaCDmLBc%I;V!3BZ~1!=(kKABWYxI2(n zV?fSQ?#BT+%c58=gnUI5D~0#^-7i`bvNEaSQ6!?Uqi`guElG7Xsh;oT&xOlDaI(0w zJSj>FQm+xkhA1{haVm<_QEZB0a}>wZt8_~gx3BZNwpEmEQEZQ5M-)4wI3^x;MX@`I zL&CY9_lVhnDE123$BoGW7Y}qoaxjY5q=xFY(wbc>gxI4{Zt@k|dFC3{H>=q**3v0aVgniOSN$h7?Z2n#*eDcYpkEny+c zLKzEXEo58Bu~1;4q=j4yc^2|5e`gI{r+6J>{`dZn@?OLD>(u6H8HE-~StxD6Sf@%3 z_fLsk>(sS%>W1~IoQ3ihs#>_gg0c{>P{H#50js~>e=_Zr_39gv^{S$Xl?1P|P+17g zs#y5i&AMKY*=iPUw9woFV`lay3+tv7)ZL(}Tc}~7riGg=G_%lQOy(^XZnbcyg@)p) zmW2iqe{BnOEYuZV-@IonJVyUeexwnh)y<;+s^@@p2+##jp?9^Y^mnAYavd~!c zCW1``kBSXTGd8FPHu&~;S!l(M$51VX))wxz@VkXSEVQw3k5u`=!o8M%r{Fsa-&?rP z;%yz(*24W3+F59Cp$8|3-Lde1g=Z{0YoVisP8J@u(AfeX+j!8z!$KYsq;leh>_>!; zb+VZ4V&O5#K5gM~3ln}SeA2>G7M>8X`w> z3pOZXD*L8|w?yY(Uh4fVyklXAh4(}pU}2Dj!4_CFP>>bhW!KhaF`IJb|F^tBy>H<| z3qvLB4+N=yBsR>_fNAdrHO#_r>B83*KD98y!k3c$%)&?uUkLwP@Fk8$opRl-lcl~U z>-t|az7l=#-}x;^W0df31iuwj8~ydrRIu|#|D*1Y7JibVpDplEYB8$d7Ym~;{Aytg z*YMiheu>{-YNxOq(h=O>jCl%O*8LkVUh^|7^iIf^!Au z3CAjnSLyGbp!u*AYr3(G|0zb@4Ow@EFxu)@M2?p6ycEv(|%Zb7rK+QJ&1`4)oQ zM=P_}G6vf}PsslzH27?j(s`sE7e%}(c*(+*wB_ZrajIe}n;8RQ{1Aj}X{%Ta#bdr_ zI;24f5y{yQ#T?1z$B-LCo^aZviV9*V8AD+VrD7;8MbuL%Rh`J5mW!c$3@YaLdfO%y z5JG-k3>9Mj-;|1il>}2W#nQ@RRz>i7!KyL;H{w}zV+=RN@JS5AVyGTNjTm~y@UjF@ zGltt^Xdtd`j`=ftOANOPsTD(QA$4M?C#0^pO-)CAQEn6DG%?)~^KXdXC$8?~8UAc` zL*b2LXdFY67@G1_7bRn}Y9{2a7@Eh>A_gk#2vf_n0rghGsoWhy8?m`3hI{{GKpR$R z8^irEv=iPrhAuIFWJU+cJ`lr0LOKd|5`0jQ6))cIf1rCugr#B<5#Dc`=5UVt6iw=f#FaU1K1=AXw)&e}l6wJ#-W0e++W7 z>K;Q6ChB>R|ejVVMq+G#_(DUL!I2;mgNrFta`=#JL9j%(3_>3Ri7C83V9=j zw`1rR!<&*dHmkR2xmnSse+=)$Fi3P}2gEQi%@8k|;|Z1ErD9=1hI*rMKx z;r(<^KZxN&;X~8PM=^dd_eZ|Ad|n2KP7sK~4@L!Y>TvsuS6i%DZ#d6yg{{z|= zF%)f4OkWE5Du%Dq%BUE=5&o@UxhVxS`yqxOW7reJ-WW!Gm(LgB{uIN{G5iw4=osdS z=U-#~Ee58^F^myDHm&?7WSrpm7(d|qmcOS<{}A%0;9r7&3r-ZABv^c_nj&PXAgfP{ zVS1X+5Hd4{S!rc<40D9f6}*0{f6rom3=3jd7{ekS8Zp>0ERJDG48a&eF)Wo{tcYP{ z49j9z9>e@H8B82H;;I-{$FL@bwf|RVX%PpCJF8PR6SGaWj^RoShhjJ!!;u({#&9}@ zGg5RchLb|*>Uaz%gx|LHpOfTNT4Cwg7|zFVA%=5eld`0KF@{TN4_&q@CW=f~MJyJ_ zwRCAl+#j(_LBzpUQpUyOC?TS;F(WJfkGI@7^5SUe;4TOGaTLU{G=XIal#HV=j?;0R ziKA2;rQ>)vjv;ZBiKA>Bcg4{vj&kCyX&lYsC?AK4BOnS}zdeo$ajs!hisQOCYTH>g z;;0-)=JcFuaa{+i&JM}^qF!Nr z4niDHY*XY+)gSjSb2X4q?}+2hbj%IoXe7L`V3V}|{5gNoHjkqP2TH_OxA}u#wpHev z+thd4RO>kIj-ziJZ^Y3ij(g&`H;((___<>?ul&r|rkrhRn^b8V$Nh1%i=(~x=^jUi zI39@Og*c9P%4X^q$Kwn&j!tnr7{^0#JRJ8oPUkotN!vUs?ZpEgtIPt-9xaa;LCBm6345;UyI}Q zIC{s?OR{CQ`$LrCeMGr+yP~*lzW;&rO;O$wd|R-eV1L1P1P8=1FpfdO2dD9?4gO~Q z?f0Db;&?xfa2%01K8W*oY%wp6`Ed-5-qi5XW!A#|hGmPKdw9@h5j&cFrHt z78P=)zeG%#O_VB=;+QNXu*0uARXEACIHt!jBaWGI%!*^K=(7dqh)>$^%;$$4dP}vw zAdZD`Ea4%*oxVsl-{FtOqBu@%&RZPEA2qVO=4LOG(Hpiy&EBDw$FU-gm2s>RF%-vY zA*{6~j+dnR+O$#>M^JdmMiWjOJq|;-nJ(@AWJWX&D~`Q!?2987M?8)VacmTW%{x>= z2wSm*IB~dfcyT1t`Z^&ey7-H2z3@w8OK#$5Z&Af}`p-0Oj$=z4Tcv1s9D9Upi}U3+ z{vv1EA!MiEF2Tz?6cdYRPuw5JfjCZbaN_=T#e;F&zSF;QbtsN1I~CL6IF6+G(KwC? zKQ4GeaLV>A=BuTJCb9)*i{s?j@DW&%VA785Lbq2%UFwltiud$C-KFX#c*!006Sytme<)tP%O6{Q+r=N}1nx-S&IF#nHMfDF z)1ef%K*IzaI!T~W0*w>?zg|rQTPDy{NHf9af=@LoXpsPsW=wY_&`R{yf>iDn!pFJq z5x4gW(*J!z+6vyEKszDr)1@7RJdi*~A)V6tgF+q>e3*ZlujbNK=LEVW@OlEh6L>6v z#}nw8z{?3dk-(D)bWflMBTSD^h283D;m-&@EBG9{pTLS1nOzfjDS>VYypTYj*YIKj z(M1JJ9JK$@GL@EQU6Ntsb)j0jRfpaFkiL?@s|mc8KriBM#h(|XIB>V((;ED2MgIE- z1$`3eo51`879{XS0&gZTIDvN=WKw;-TfHS@>TdOR0>pj^^cV7uAe8|L3=}>{kWUFx z)OM>OTq+3!_Nw<1ct3#;xPTM*g^M|Xp$UAHz~>2kk-*0czEt+7f+U|LFf7f7CvaxB z%H88X`Z7Yq&jd#bR@%_^sfm1is-Ybt=WWWxC}OzZ1Q&c>6*4j|u#g zz|X?F>``w>(XR=N5#{d$#tQjekRE;$GA@Df2~0@f6S1d0LC7Bo{ORxg+`rQH(LHKn znomk#aspE%J5_L+;327-u~+fml^F@lrS=~w?COj?}ZsH#= zOtxel!9x;iGJ$motY`eZ`uBO}2A*9BWZ1~GvHiw89(0=$*qp!?sd9qh?N(cbZ%bf% z0y`4enZTh04kxfHf!$KHKY=|$_6Zj3Q+v~dF{JnbQ4aF_+~<$j5y>7CJSvznJ1#s` zi%p-D08S-vTF4o}vw|!=$G-x?F9==~yd-#8@QUD7!E1u7#UlbX_;=xpef~YiVm6A~ zC}HE~eTu2PjVzW*HpfPRjgmHUC7UOhpSE1wrI7Z8Hp+-nDy^5c(OO)UO)KSWyd;Ve z<+G|etXR=TC7b{GqmIq{m8fjvM%!NrRcu^uqpFP?Y)sjwBKs8YR`A5wx=&^8_y3$# z6Ei+Qp4^&olkn;`Y6z(*c(dRwg0~9R63i*(`>$)Go{eTUnu}Q9#%(q)Li$BF?N<$i zuobSohC8$Fpz->wJ8d+y(PqDDWMf>(+{QL$j~Df@r-ogNgGeu`0i*{o5Bp@vo@Zy@ggV7#>V~Xc^faVFEw+z+F+u>A=*;8 z?A3=e76x*=**Gf-`N&o|S(o#B*m%Xpt6V>q^Lq-uENK6b`I?Ph!rzqOU$@c6MqeAf zZT`|?;k3Dhj|Z|dMrRiLDU;+4>MILpm&tz1#@jZ||B~6yMt>Xc*tny0c8i&XWo8!k z3iy9PXf}|m=ztnzqwWF4Q-b`-1L~s#ig%@l*mzIY`TI6L5b~kmFu|cVJ`(b=;3tBd z_vr`JaN(b(l@V!!&ux5RW2=pAHomm+m5s$Vme}~(#wZ(8ZA`QAjg4=mkCScx)cVdw z`NF(g4yx~MJUAui2OB@y_{l~dzsYOkcN;%*x^0ZM!C@S0BXL0eYGVw?YH!Z**E4P? z?UUcc;W!)PZA@&L%VjyQcK()AIe*xQe4jJX#v~hm+Sq+SHECG-FB^Z`AYrXL+E`{|y^RevmfKii`v>ew8#@mA=M0~sdGN99RW|mH z&RuO|jg7T7ill2{8$ltOU`UWb79LW%4Z{Wrvu0Z7lROa{QOR01Y#Wa7n2k8cP||Hu zrR5>za#tQwNgM0L#*-|)F{Lb7y3xia8=Gxx;VwI*dLL3{0)<~5@{h_%;)j3NwzDHP zuGz?Nu+zpa8z*d>Kf>i}8A63;H-00vY2h|-k zcF^0)s^Q?-Gg-GYLI*V+-0a{M2R)9e+79YCxK%2?cU0AKKxA|L-eO$`^&QkM%&jL# zg`DZOboLGhcRFb3ppk=~WwYPAm^J38;{H8dJO8tLvgaOEUl*2Y;-IMmw|aInhi{@l z3kOB5OW8+Na!*cC+noJJ6>GI}(3)el4u$J*w}Ung9(3`Li+eco4$e6^@8CWMZ5?cI zu+hQ&4%#^w=U}{p_6|BY_{G6!2M;*tC>^PJUUi}qhyTZBee2*M2M;^w=b*oXM;tur z;3Ws$9CUWjg~RCJX$Oxvc-+Ag4xV&S<(PWln0n)w`u3Pwd`#^*w;or|a10&3 zc>~Y0mE-ES<7)YF~ z>6Cg?kl9;Lsi#k=5vSDLQ|cWD0~~zfV3>n}Y{kL*4nA-&mrbl>IcN?(a_})1>KS#%8TCIVKGbwZ{dGpg&!}@})Nn3u2VXe& z(!mG^pE(%m;ByBR&#Go;)iY;Rud`~zS-;lOv+B@U^_7FK9gK4Djf32C>Yj6|`#II` zociLNns81f&Z*1i6ldx?nXm5!e{k@lgP$DyELoPWnV31;@sXF;esy@&RJA{^#yI{J zzp;WOzX@T{1jm1vjSsH;F6*J!dG&{bKOOuf*=Y`@JNR4pM8Qdd40y7GDZ-};vLeM9 z4rV$CJBVR_3Jpo5Tu zAmL>*WTYzK~mm{d>I zrDfbf;y;#DT*?Q}B9X{)Y-43>h$hsWutuiUw(sQxh!HzWF>ENsL z{)JXf%^n9w92}L3dmZc(GW)#R@8E#&gMx<~98MRpluZ!%V8AgEkMl@5uTBV_6lC_4 zgVSk##=%+P=gun@U2t%bCya|i7ndAd<~nqd=i-Wks}8R50C)Wrm5Pw|{8kaM@&%RY z`VGNFF(JhTsg!V$B|JN=#uZ#YIyW&0JjXqNg*l6Y9uUipg7m|>ox~>td)UPz9Hk_xCGn_>&Mw~b@VGUUSh)6jrC76sAaT$@WQ?_I2?_+JI(nxp><}KNtO7eBz7axeo>J;huBNrdL_}s-8E2bxEOoKK z#X=X0Tr74m@`C#9f|`Fp?Yy9JFRI!X)w37X7Z=qs7t39&aIumVFREh~Ri#U+?IqRc zk{WwSIhXtsZ;gw!E({l@iy{|67n%#*#kEVS?q&7BWfgMK{jwT%S^afct-7p^URIe` zRMmj)WtCudtK~vanQvf4*oTjml3F+5!lbYmJv80 z$iBaDTi$1U5pqW0FeAwb91)~`+{FnOCtaL!5y%V#n&dRh47AS-Z2LLy^~}KcnSrI5 zfio`7x;W?Jyo*vEN_)8A;-V~x91oXVT$V}C^l-(+RR-_*Ti}{3Z!QC_fq#*U1Rjcc zDDI(zhb#}--v3|5EM=lS6G^UzJSolhP*O;NcuqMi6eVR@#zR>T*LkSy`5wx72zaRA zp}g3r|5(z#qK8W2hf$@LH?fLTyvaj#57&FB>fr{dRn5bVVw?($RZ_L+r-m5Z?4hRj z&t^<@^A>SMgW4YIczDS}HxG3^)br5E!-F2`OT~KyZ}V`wkOm$aduZa}4i9&VLT?Q{ zG!o9%Qvo#f(9FYK9$Jas+(QcwEz|b@hDXxc!`&X*c(~{Pc9wqF-;}reJhb(2zf^xf zu$_nYX>T3UBxT%Dvg8kWIG7oDOz>gBM+7N8>Y=mnE@`DS0@NS(@PvmaJv`;%X%8<* z=`$Xl71Gtib3&dMY$8><3bHQ67e%KH69@Kx(xW~ex=Xf)hn_-S_VAhz+Pos*TWkg-t_R6hqpZp@G#IrKbcc@wtsr|-;s(`mhdCbRdid1C2oDoH{O;j1@%gQX z?>vn3@VSRC#O+rezV`5?M3Rc1ILgB}V*jtgw!Zi9gNL6z{NmxqwEa)%*ix3GJ^bq7 zHxJ{)V2p>c((BZwpbh<`EUAna8+POmaWdJ%6c2xT_{+oJQZz|$qF}0Gs_s+|(?p!f z^Iz)DkStx%;NMned6@m5Ud;0_-@`f&>pd*+u+W3JgoJw#KTe#D?F_9 zuuSSM7felS3Rg*6tJ6`X8fADzY0Hol1=AsELQ)&V^bi&^$3w(J)I&nDmWP;!xLE!> zJ}J+sM(wn7SBU2!DTM8&Ja6!@(ZeYZr#)=)u-U@_u5b@qJZ$x_%foID+dORdu*1X7 zv^UnJe>zDeX7_m5>tUaV{W7pA1LD7gmWMnXW~d%ccsL?4AN6o7J<+uMH>#8AHUF>w zGakRhfy^Y3#5oV=dD?rp%=14zN*B{rQhu&@xa#4WhYVTssYw3yma-|9MDZlDlgLT_ zv${$ok(K=CDE@aCSt~bfz(FoZqGXa^BtZpQF3sYzD@=t+OhKSj5~YQZml0AniE?SB zybvYG*M?L~`fu1fK+9qQemS6064xdDr!Fgt+bT)$RcY6YQdN*`4JngxV-hzd;U$qw zqIwcFk{FT1XGzpd;^ri7N#fQdS{C#7HPfJbb8CsW@%e$?Nz_iFP7-yKsFy^CBpyhj zeiFCQK8d@MxIKvmNi<5LaT4nwZ-@q-NrG)L-JTnGK8dbL^hly-5-%k2BBM&8 zJF~fg&vOGWB{4ZSurW8#EeT@B_IXEh110kU4f6tz<^^6(;*}(NCGk3|`KhQKk@I-##!~8&>B>E=tM$*5rK2-2cL1y1d;_W2*Nw$9y9}0OV z2|koKAc=vJ9hAh7wEf^D-c5oJE2f@Wd`~RjPnUimS=8CrN$*4a0?hD)@QJ zf9~Knd@yHZ5}zmWMH2kNiKgk0$a)WGC#v>)__EQP+)BIm(0lK__uh;2-lTUB z1W~YofY?Alu~AeI5fwyHK@n^qf+&(H$)rp&$)zaRD2n*s^W=@o-}kL`)?WMU^PK1O zlVmb;=5qFvK3vLDPxXoe~WUDpV>aA?`f)9GODv_g(Wvdr`AhMTU@nM?}uln#BXK#+$?!!(WX6C3J zKD?Wg(>+HK@1N>kS>2YSzRyt^xvEaC+U>&|KDW~i~ za!h^r%7>49_}GV|K78iGVIPk8@QDwfa-@o?T}9Q&qN;E)Rlb-SS*DH<;;Lu~)v|>8-iIH2IOoHUoa!aisuJpr60XhB66$;j^=k>`$x|A; z+J}oAJ0A>AU?2P(S#B(Os%M_!h3*M?iox<>X`Y*xA?QQMhp-P3A8a3D%yLIYq>N|Z zjdU$5Ey|U6G4tuia~&Vz+#5?5NpNR4mHXw(#ds%4fe#m?Gs)?STij(Ie)8dG+157a zsVht^;<;0Ex6`X)`HK&~`tX|%zx(hHha*q@A^KlFtQenhjUNF%+~6u3?78W~pPX77 zJU4HrF_3J}Dn$L3*#9kfTaeBxob;q=C?o~Z4+At5)^J#wd57ppo-W*@!7GG$GlXOc zW(j5s2J%!94MjD4qvMp0Vj7BTFf^DNN@&Q_FkZt14fz@$g~LbfKFX3aD-*U%!R z&>_Vnk|h1K*3d=_+G=PgBw1)OmAs>dt{S@WUjRw%EZ9XbY13Up4-Eq}4Ajt5^xhi! zXy}!)p;=!I{WSDXDgXbP4AO9yhQVTxZ1NBdLp2Oz-%1Z8F`1Evz_VfuB%?KqkzC_6 zFj^sBF^m<3gvZa)Y@&uq8Ww6;q+v3XBz1}g{!_-(cKNE$yBSki`Fu4^lBNsJ5S%GE zOT%m-b2QA;FkkpwLEa5TCrQ45eJIg;G%VKef`%70@DI2p9GBWft0;A^hNT*oX}C}F zZq~3|!~Ghbl4#pOX%A>vp<$&4tB?0;@9YOPJfvZ*hIJYq*6@gi$26?b@Tdl7glCn8 z)wIu7E`KzK$gnwIeJBdO9r5KcP<&j&dJRu#IG3-U)Iehfa$+oBJ+0vx4I88m8wJ^- zJLloq6yL;F^p^Xk4ySJs@j1cgHEiWV$alAzT&0>Rm%PMjZ{)wM;S~+rG;G&!T*K!Y zc4*kC;Uf(nYj{<|YZ~6s@UDi}HSE%`SHoKzZl3(F;SCLYIB)xTcvCu0%TFGd|E8o; z+$TwIYwnHrv`^kSPqJUb0S)hK_&~#ZVti1L8JUZLNBy&UheZ64TZcsdha!F|NLNRs zb)TfN9~JVMhGVH*$tr!J;Y$stG<+)tUkRSj@U>*8A38tD?M1_X>u_4k&T9Bx!x`bU z{7!6=ZTvyQj~dQ%uu`eX;(Qu34SK2$bk2+nO!aFBa02V-rNhz?)X-K(I~^enVGUJv zRMXuDBqJIQRZx85*wzr$5aTS;aHo!R9dQi_jqjbo9~ufYT+r~dhASE_YPh7~vWB0y z0V?&7Qg7Uoc|a*mshdibEvb5xR97|pqTyE!zj1n(R8N*v@0V2PN~%JoRP|D-b15~p zl)9$jx`taC{?>3q!%Yo;a^`TVmr@^d4ojbY$qr)KNr7Q5{)2vUTL> z$kp+78D*AHD66WMRXxh8MP=27vT8?JRZK^59VK++={QzaMaruDa;ix=HMN}DR8AG| zpSi!BDygHCj`BJx=qRnDjE=H8%IWy7oVrm?RVc6Ol~;Yrt4GSKSIWC}tEi)rj>nmTIfsI8-pj;1=A z>8Puto+LFAtgoY?5E?fSQnI3AV6?GBo1{{cX3cf9N+~ULv`lfPwodUjDWC0ibkNaJ zMoJBxUKV`m**bazARD%ef1yI>E&M=H8sMSAP#qhq&@H+1yX z(ND+gI(F&kuj9HW>yL_xCyfu#F;K@K9e3$iqT^m2gLMqiF;T}P9YZ--6&1rs9m9kV z7aSqT?q$*_9iw%O(J@xXc%A3hxmm{PpiR<%$mqW~nOw(g9dksSqGP&_89Juwn5H9X zNn>UwpD8x8QrVNKb9KxUWs#2gQqTe&3sZTMbxT^_qhqmHCcRNys$-ds$91gNai5Om zT$MUj>9}9V13Dhm@sN%cl7+2U`5&LjwmhukkyPrxK54mHTD?Z_F{u*8wK~?NdV@tX zJfY)B9nb67s^cjgPwRMA$0i-m=-8lRW6GFib$r1~56QM{*0Dv$bDR<)(oa%n7Ai03 zcu~g=9XmyTNyp1vrzuz4beyfIwx_a?Gtl#^l9$e`*dyHxDq2%J- zyhnt5B>1u5VI89;x}S8PaKY+0%CQb*Gkl@rGvUVsk8^TXQq(_}=%PyMOC4Wvwu?yp zYaQo=bII`Fkz$oqtIFzI9jDoo2A(%?hMR_t_69l_ILo!Kqq>0_27X{h9Y5;0bj95X zc~srN%I;2bUWbo6o(`SM%E+%^z|diGS2O?vejNcFSJ+JM|2l#?5;_XF|LX|raJaqe zi0GJASw(g5bjl5tmCZpH&oOEE9^q#yE2pyZR8c&f^Ma0xtcH%uV$iCJT3bc!sG`2C zqIkmRPda|q5v$_X?bGMedUp5zqT^Q`H+0<8@tb71#+A-3x2pP``%hK%2Ul5DwWF#! zSykPvs>)SUt*fa&b^N8{wvKi~p z3DP)u{6b9wO${_N@MA4i%Rp@dbqv%s(0Y}(v0y#H`UV;ZxmrsxG&ImC6{RIZ6H)RH zWaZX&Yr@-un;U3hpz+!CnzdC+1H@L$BBYHVm9|3KrOY}S=wzUqf$q|}&IY;|=xU&4 zZN(1)zT$!3ocXJ8Ty53EKu-gM4BTa4b#3)_ZAHD8f!>m_k6>THeu8IftNxt%wbcNL z4orz$FM|!d+r+K&5CcOE3^Op?z!`kU)R;PIX&rT}j=EGwP2ix{RTBmI_uSnErWlxRV1@y6yL)^8RQ7pY_0P7n zX{^cJnfx_6t*+WxSAA4hU8t*O8<=C@9s`RF%r!92zIPof|ta_?WJ-4 zw0deoJ+(-hv(9#Zq%1LTuYsiomKiuyPetmfLiJUd`l@SvHMzcexxPA4U)^uu0R!s{ zJkEJ*V5Naa4XiTopn-=BJZ#_*13%YS-Uh0D12v|BT00_pX#=;={SDM=1CJS4V_>a; zQw`MR2Flw|HEgJ6HdN0vR0kR=qoG=F;0Xg83~c0_H}I5!rwu$~pl~DAv5^|rNIlp{ zz28V(ZKR4eR^1w_XANvJu-U*C0}~soWsTJ)C zcb9?PDNeIJ!rv4;c!#?s?la(vWPd3>-!{;;Mb0~%Fb4J;IAGvo1BVS%%5)dwdj<{~ zcwh1!GVr0nGdEm4nfj6NrGwnlQJ6$LB6w8rh0}#T5%MXUdD?y0>N5k!3>+8n3&GC? z)0(;ik>uW{>ML$RP1VK_AXCJLFDvOU{tBEtlP7Z#*=hmbo3 z(@l7U@KcycnI^JK)H6}vM7D_>6XB++reLm#QYK29C}N_hiDD*-i>^$RFp+1X%qUO3 zC|S)EIWsa8zROe6L=92;5>1pfQOQJQ6XnFXyom~uogQdEyqlL;(ZrHwZuTlBsxrG6 zFj`G)s+)NJ!vFlUAV!~SrfNx2ZNWN%bp@Gg?fML20~1X}X_(R*327|YM9>-Jmfp-n zbBVSPY$-_nO0AqWCfb_lV4|Z59(vr)#Ia_oy@~gRW%B*1PBWF?Ty-+h*~9=715NPp ze;yXv#dKFRclfRpdEA8Q{^il#bcd{miJm5UndohzkBR;wwrZ~WnqcT>VnTCwy-*=C z@b~*;&D9_iyPK=IChjs3^>_!H7-C|miD4#Yn3!o|xQP)aCYhLQVx);tCdP~9XcJ>h zj1zu;$F#8~h*v*$FPf!!y-6~`#6&hQBcD+kklZcyQ%y|cR1sdKRT|5kt6_osc%LqQ zsLbNDS?#_ua*i})b}CAde4dHC*(YGrH154)YM)d#KBh1LpfRE0L`SreN~ylUb#j<|^}e5QMucjc!_hbjhfI#rGJ;c)x-;?`^s8|^=;J0ZIr)_D%@5zZL7AK*luEniJh!i zTQ#YzTHjW^*H&q5)t&8B*LG?}JN3GWT_*OLc#Cy5@rH>#Cf;PmcIuOM>U=x(Pdin$ zz3R|j4QsDvwpaU1ylvtg6YsJb?bYG-%5JaF!EIX04r+J@wY7tK&%{9!Mi6EY@0<95 zjkU1B!XXnMa)$eH+>eh;d~D)~A8)PCI!t2X5kDUF;}a8~a?1HJ%a5ZbJ~Lr+hA@|j z<0c~PYWc^Rw*`J~;tLaBn)u4ZDbc?+al*t&6W?$TIh)U08IysWcNH=)`mKr6CeD~V z<_G~3mWi__zBl1Bp_%x>#5of`nmEsmMeYIPZHgauQ2q{zcTnH%pelD%I-6#~G~qYF zJ21O-RJNIlSGwumzn84@;~f!=TK{kZSWpPgNXA@V*P5i=r6{C`@TU9@*`B7i8RQIEXAGQ6c zBhi|EKDqzD8vg62uHWs7dZ}6^+emC6S?IH2Dv3oj5s}lTsUOY!XzoV~KL-0T#E+JK zwDO~?AKmEl9YiP3lAC5pXh!VpN04D#bH(V2yc@Do z87Vl%k5PV%{=d1#{>LXvoFJ(a1?h8As(~zJiXT(`m@buMiPQeCA1X7%n7L;AF~^Su zek}B3t{?OKnD2KNI2R_(NO(&yJDi+J42%5W4a4_HcCM+#ek}3hUO$%lvCNN^es`_i zCm!w>zFas(x_Uqqk`;dU0Sbx_ibC>`9}lNQW?ALOYCoRz<0(HL^J9&lXK>+hKi2xe z)k+WCZJ3KU+_Fln&w4+ekSg&bo2l%ar~P=wk3)WZ=yz|r-r)b=ezlQ4Z{$Dg$0k2E z`?1B3H~rY_$8&x>@5gIW+pVmLAFueajd%_(iukf0FG-XNi(p8S?UK6Fj~$YltlO*q z;jjC#OKf%v?h$+=RiA(TyyeHce(d*SpBPYoTgW?N$>;%z9!#aaCnQ;i_l19uvgEG# zkslxXahR*a{NFv{98hj+9LG=ObAc}u`;PL*zn|J>EvG}j_ z@BQvEo{at=;yFKl^y562z`{c3)?{jaG+0o`=f@wDz1{Ej>V6o0P&fUsgpm8`L3reg z;*17UddQD(Qco$iAJx}-Xfw8#cV9=vV-_5K3ixrPqe=)C2r_y>$VERc3Avoo`4i>} zJH(GW0=P5aR{Iw}4%GDC=BI!kzj6PUR#3mmIt#xhcwO*DD)r?r+@Du}O7t&37`-LE z@wecTPYV4bNoi69Eei>OVBr9+c62}b(*wxq6#i~uqN$dYJY0NJz& zptwY7kQ+cT;Y9){Dx_;C#lR#+lcYq-fMULI6+lTLr36chWf{RqlD&KY6$0oRK)(Pg z22d%0`T;ZupmG3J0;m@NI;*MyyxmEC&9VaE3%RNZt}C5eBY;pR#ZXg7tpI8ZsUwZ8 zE6Ddmu$c_>!_Y8*-U0LppiuxNI;+M3Gzp+-0JR>=W@sBgGvUnzTL`ucpj7~^185V# zKZ89<%cRdFZzpE$1v?0K6zn9}Ie;!gXxue`Zo<2#lpX=}6y7W4oJG{lbAP!n-)y+x~O%6 z_Xco(fTzY`sYIzS6LMbw%To$Z_@urffJXyZ6~M{>9t_~2RO%xEJS;qEM$2S$bpUHc ze=KFWCV)t$_g@2&$0ccf08a>c@;{c(1h6510|C4jz{UWc4Pbi!I|A4gz~%s64B({z zwgm8809yliA%N#OaD6@9ySV=c-E+&s_sa3VMV@f7ZdNvxmjif(b?%t6Er8iw+}>bV z*G28@q9`)#4B)i@UKg8J12`i3t^jri@NNM61E8fL;u~VKCxADF>=k@Vkbd@Y5ed)j zs@@5JNRee#>#ACHb;~^%!21Cx3neXl5Wt}TP6u!%fDbvNI2i)?RtE0lfP1R&7XciW z=n=tB1V0r#8o*}(91GyML_Zg7)2L99_uZeF$+rf48NkS{is36EUkjcPJQ=_@LZ*uW z56k6cvE*Ut%>G>f1p!0{A_EA{L5T_#=R8+=?yt1LArBH|WhmAq%v; z8NjUo{tn>J0RG}^@2ZN{^_n+}licR+Avr~tK!WPmkc*Nly7D{~QxzmDo zNH$Yx^K(~~%t#Mj%k`Pem}w!)Lbm0)&9RVcxrH)`)nFEy6%&V4@+=e=UP6$@$)@E? zl-WyJC~cv>g$5SNSnkE@vKGooDj&lyZ@E`6YIajSx~U2lDvDl7u!e=o7OGhIe5;o~ zx~qy`9T>+d?1FnT65*76w?DYhj*+fffc? zm|$U|g}W>awlK=VXbVFu47D)A!bl6tyQ^VrW`^3^-7RRiIN8!&on-XxOuM_f(Or$P zFxJ923*$MjdZ-pX)Z89wQxEk;4|T1Fs@zlc?WrbNm~3IXg&Fi9}{l~(G7Cy6Z%)&?F@TlO&7OsoW!&37j7CsU3sUXXG zr@8xiN{7d}cqPjhf@+XzGe`{|UVDGLVl9$KMP(FyejyM;ID$e2{P9;AvXlCr$l;A^1m$HvcQJlmQLUV_?tV! zV8ynxD_HXtgH@p*5X2op+!;jSpexdzxOuSKwDcf6L3l+kQNp`_u-lOEV0A-CRuI`i zck`(lL{1R7K@<<7L=Z)SV9`Z`C?*+;4^ef8s2)Sqv>~p~yr4S@`9Ua2eQ<~>DNe2( zNoNg92`?>3&t-xr8$>yYmKUrTM1@r9jv=a25S1lbMRX=nWX5ViRA)6tr!AY|Zt1mt zOsf?{?I2zWVp|Y(f~XtBgRDRh^@6A$#LOUO1<@eL<4@5th*sjWQ4km2bQ{<>h__$P zY7)d-N7I`!X`!c?U~|D1VodSa5XFL82Qj)0M%4jVVw)h^2GK5v_Ca(=ng!7@h)zM= z6~tgsItS4+h+aW-38HHd-Gb;IM31EL;dFC|VqhJTdha0m1ko>u{z3Fj+0dQ_NgNQw zz#s;RlFX9KOB@o!&>+SJF)oNxbH(N!!FfSkAEM?5-40|}5X3^^ zi&9F5q3Wjxyo-Za62!f9GE^-U{Fr|z40Zczc@X!DtCc}K5X5sLu3+gkJUpL2)TBh^ z_1;;C<3T(c#Ht|H1hH1~KC(G$br6pQd6DyfzYV7h%;NagsKp1*-ATo; zK8TG$JS+B32tFCaQ$ai}{Fxv&2%+W0p^71yYf}&}i@sTwz{F+VEvzI5?&l1K=Y!ZP z{DqYAVh}G0|0hyW%QYPd0NuXGI-%IVY7t!_+}u{15WnU7QHw1M&Y^ z5XXWz6vT%T{U`{o<)r<`q8tw5h!BdOa1c}csE`$H(vA!HO3M0N_!qL)z7*`x&+UKK zf6*{?GKg=2I1|KoL7WQW+n_rZr&*bquFXROv(^lAJLk+WbvB6agM24K8tYFbI!qNF zu6_{b=LCNgJRgKlh$g5DCdbzwL?DRtC_GVEK?J!^MsQ~Yp&-JnKnQ0;hy-DC>_T`x zglG^kZYCi#2*C*=&Mh&7A|WJ#DBxBZLQV)5g6>ap{!Y;%=@)~z6vX8qev(4(2;t`- zt_1OS5VwQ48pJO_{2Ih>LGZP7d#%hdYm3#`T)gIR^*a|x5I2JOLo!mi#;+E`-G+}H zu5NPQ3*uG~f2KqxC2f+*KS890Q2u&m;SlCrEfVOQyK%TG6vBW{av?}R-(+|^rHkGf za=R`)1P|+WCEXiBW(XtSEkvHdyczB)$dV)~jPjNhDh%%pS4Bf87DCMs_(J*OA(RN= z=5SSHgvt}2p)5nTXaADCri0x3_D>I26+-xFZ+_(vDhi=e zDFh-#hAJXf6|5#$U9g5A&1y+~ChyO$Ek)D`p{|g6g49_`!w?#UFf@c=Av6x5NeDwE zl?`bsq)iCTLTDaBix9Gr#n38*mXbu?VpkeNYe}Lvc4ONR+J(?QgbpEe451&RZ9Sbr z=*-H5&?CeHd~%zQQ2Et7T|(%}ZmH(!CfHxZo*~={dwJGbpAf2bDAFs0-a^QE$)Yc7 z*wMqVdnNjF_@o-?t%?o|VNeLQqnUgxh2gFc26MWW@jNg>5jTubyoG+a7;g!=KXyih z@ZJbDGK5hfj1FN;2(vlFAwK)*sd&OOHiU5@j1OT#2$PvBgo%=L{e*`GlZ3AtmQ6lI zILUM&Q$v_05weh3RfSQ5g$A?*DvjZdj8 z3}I0S_t4z76?elCo=~*pFkA<)%#Ao?EIX=(N z(#FR_SRcYOA#4zXCsmc??PsFAiYgl9w86atH&|1nY%mbh6w z&@H!xjFD<<2rq>2SqR5Mcrk>RLf9R`8zHbx?TojvxAoT(v7x;N0dcHNI6pwn|IZFK+!f&!j$AsOa z-?=ot&i^ZfKSHS9%gb<$6EDSY2)P-;pDAVLz_eQ-{2jvW5dPtw97e4$(!wYdhJTdG z6og=U7=?vUzaxx0Q@rf*d{2sdg=7d;UYVa2Mz-*rFe-;pC5+rKiiA;AL?uXX#lk2q zyhIpzLh{34U=p1ZOA0R)M(Hrh2&Y&fX%I%aFv^QPtMqTiijrDMka|@i)diWi+JEX_ zgLRwYmQq_%8-&qNNS!e1rtIqpsV`W-o)4pO7~R6?9!8Tenu^|8uvr)_gfthVTkqHD zErqudY%SO(mD*NFyD-{^(IL!p=G|5^bP~dvGcejkuxl#y?)@1(!ssc{L1FX?qqp#W zf_=j1E5x4Qwkzp@q<jWN*J@lm=ng-Fs6kuJ&YM)_kU+j+EJqw zH!I%VO1@;Yni7siep_nS$VG3v2u?jx2f z#<&;N-yEY>hVft+Z-?+QPjF-cBC5&xhY!Bm25qE^KGmKqf><;5q zQC<^diF8POJ&dHQHzc}8ke!_D5aM3pZ>4nh62+=x)w^Nr593-G*TXmv#(QCW6voFK zf_VNxj`CRd0hXR))%%>HW7P+OhuAbBe2W}K_WaXh)!{IXgz<^A_h=ZO3Helzk0cxm z<9HbHFcM*W9>y181j7i0@nslaamQwH9EdPZgmET}?^ww&z6s-K>x|Q3oZ^&TkVgJ( z(s^rltj}Lbr${`@N%B_O_hI}XX5{}3=fm)Edh>(eO1c(?9)=NyDOu=^mPschG$01p zjpBz7R|E+kn)rn2pS2-4<87&pT}1cf8+XT+zMbN-ZWA^%IrEy2ITxE;nn z-2cUl?-ZaxA>kCs_l{NR<5cZ&?(n5Y;E5p3Mj;#C2r?qr5y8#~G9$=}U_=BXBgl>* zCxZSF42U2%f+7)=iJ)u*MI-1lPVpm{FW4<6{)05`D=CN<~mQ zg1O@q&&*`t0i@-`rqkE?Eh8u&L4^n^Mo>w_#t~GGph^UFCCUm{ji7b}>&K~T5mXnk zhG0#>#a-Nc4r_@4NgW}(rKR=6pne1mB4`*vBT1qq11-NB^S|HwO(JM2N;ARcg5M1H zw1|L6%T^Jzj-X8hZ6of!*ExcA5wwrE=dJN!$qo@0d6y<{*X$?;odk!<3sZ<)BIp`H zw+OmN(1RT)_Vm*;f?g5ymT1z|zt}f|ekq-n)a&q_!VwITy750m{(JK1xtzNq7#zX3 zmqnOf-w<{<@h#pPdOMT-WIS!#;frWOpxeA!8sAW zxdW5QB|1}ZN(57dOcR_Q!PbUuPcqDiATE7QK1)((OKP%{=ZZ2fg84%DhVBkcu`q%~ z5!}Nb7_S)ai(s+vB`M|J2$rV!G9fd5NM9bo{SiEn(pN>WB7&6>JQ%@4B0ehka0HJC z;oTZZ|C4|8l1wU`wOaJYB3L7JrnpuVk`BBrGlC}~crt>gI9tZ6{o@t8nmc@8y!)5s z(-Axq!G;KaAMgGF_kxg(5j-2grU*7mlu28KY>D8x2%e9)?-!=Xz$lT?7rB(`dKq34 z@^S>P2-zmMJ(Y?H>eUEdf* zvt%GS62T{29TA+0;M0ivxx+v5j&hmLcGuKr5gZfocm!XtEx+Y|E=aRvSzku*l_-pU z9l?oYYD)QTg1b%qIzjQ429h%od>6qF5u9T`@F{=@zL)xxo~XJ_RDq+#$4pc|MsPlY zATQ%Y-1ks0myeTePqrqg3mSr^pkI&%0U=fd3nwZ@!{V7Qw=IYu!h$?mwqR5+Cg=#p z1!<7r{`O)n2@Aa-*)K+LDT2!p{1m~@5!{U6&j_w?PvGcB@J9r{MDVLvasy;8>c9Ob zdM$$M5ip734bf?1_DX9iMf?@PElIsCNqU zvoYVs0^2=7f>|op${asgUF_jqC~lWeR*P)hV`H&IAGGn1jU_hjwXxL3G7;|=X}d=putiBEdDzBkNhN>8#-qYl3HFo63aCFO(KR;K3h68QdK*vJ zc+tj7HlCZTp0uG$uRdktX&cYj_++wT;D_=C8yjsrYh#m$&)e>IgUvR!NR-BmJ|~=n z(XBRK5GRZ>&`FJhS-hxzTl{acv7HmZhQ*a=W2X(%hMz;<*Ym24-JD2wt9B=IUbFE! zr{Bq(U4kT)?pANu*kj{O8+&bhZR3QEw`}aQafGEy)84jm(8l{V-m&p6mxhf4Hr|t@ z#w*?HDka+Hk|a5!AK3WN#z$gsh-+u#|4y{{*hbRkuq1Vy>*}A{IBMgVjpM0Qil1@O ztt>>hpL26)o6GPe$H)e~F*WJrs}w&eHfL;nXX6_YPuciZywUP>%8VHq&e}L<<3|y{ z7yKbr?s*$N8-|FQAnkRjNwQFSOBVgNtFVno z%7bkqDm<1_93gQV2_gIMcGsQ%ZpC}{NG@_8yPAH<#$_8nasB?D{xc_ojbAuXOM9+x z@%HkpG1GtLB4R@>dH=HUyUjDEJl7?<@sjrsiC*IbyX2j*-Fw5vO^%nxQ~a`*_^0Ug z2W8x{@wbiJHvZubA9Y=&MNudUL{T`3-t9egFMID#_xyOsJE4?^{uz?w&M1mD^w5_Jc<%g6cZku;-&J> z-6}7N>QU5)B0ma7RTL$KloG5USUQR_Ldpu36FgMQTRsXRb1_sDv65irD5^wJRd}^1 z7-;bI`W#}-C}y6_ZxeN=Q!T;TQPhc|ZWQ&RXdz1dC>pRgu6dhAdHkvSO}?S%jiP8A zMHAr^TQ@318xn?QQ8X7lOYT^s(lUxxqO=zLH&D6dj`I7)7Tj`bN<&iq4YM zEsE|@bP-NJU4;~%qIyKplcOWiq}VG81}4$0PZTYMjGdzTM=?OmhD0$iia}A_C6+X% zB{7+Ou;k^1-=R?qOBp16j*Mbd6yu^8FIh%MF(!(!GH}6OZimy)nHt%n8oJG&AU5-& zm?-^xaa;DJC?->kVhWw~%3+up#kxj0Q=@o&Y4$Y1>4Gx^*G*CNt9xffL7Xi(M{usB zQrsp@TNuTnD4vO8LlpN!u{erHrD)b+iI95*lhs=)d|4Ft33<3h?(!(^7ydvLD}=0! z;$a~VM)8o4!&B5%DT_WI;q2AYt4?(ryDEy+V(^&Y8o{-K>jWQ4tOicJz_&DpmUllWW|&qr}b40pz`HHsIacsYt!qIgkkUiy#a zzgf0L@kbQbqS!72v?Ge0QM?+(YZCpLeHg{AD87&4hbVSO@kSIMMe%VId&JvYQS6K2 zP2qb5>3LJHw6~*pCyEca#G-gNiv3X>l+*)JyvK_D;qKwhq;tkkRa5rle74y0eiUn_ zDw5d~vvxV@ABz1Ju{j*Yktn{5;;Se=iQ>~Jjz{r%6dz7iN5$;3D0H!;+hd~Csh3@5 zz31js^#ym5X)3dgx85}MbrdI}_$G=|QJjq8K;_JZ)6}~Sb9%S&j+&;btjo$Pn)_`O zr@28L$UYOrcTt?B*);WSi5&iK_`@`Hb(%Y%=h!(>*il5II3I;CieMC>C^S|h3O{$M z_SqFnWams*2mZ`6qA(>?o$lrhB>SOqro}}!UH!Vvb9$$Hx#>G6CmcmY0y&k5le1z` zT#Vx0#a<_hcoc~!(g&p#u$1DtotJwyOi8;S-da46)4FN)r6|rg8O(K=t7&r9Pf-k+ zt{$1LxK&<}(Yz}7i{P(pF;i;WW{bp@pp>f7Bc@@ zT3XEAr3=N}*$BbHf;q?Bu}+V{6GOuo8j0xT&L2aT@C-rb&5pUJ6O@aAN>0q(b#ujM z5y7H@#bPKPLx~vjVkjL$nHcg#FDXbTDuxfF$)!?CGFmnUCjD!`DwU6+LJSpSs1!qG z@_2R~!773^1*-~H6Ra*+LvYb`5AACSuN`wg6d0{5(RzaQ1se!5iN!UJp-Bv_VrU&h z(^TD>31MpUl+q%Gmcngm1uM*cVBlS>?P6#j!yxuj3>{+V7(=%hy2sobTsy_kMY@q4 z*jfD3CqviR|Mmy+9x?Qap?3^D#gbb`vgiB6Fi@0}`_uXg=@&!)RDA}dDw8xG9K(

    • sKOYYw|>+j1GPSG8^N!ezs%p@wn-{X z)Z7QyGv%UG3yNawRQz6}6++&q^V0ypr9HbtFO?!&5+4#?HF||%Lws7Cx|tktFdSdQ zJ=A3suk5FxK2L{#F1l3)ad^@euqx&mvK_+wc7G>V&UQHO_T0GdybFrhgP$VTYDx~* zrix?FzF-ch7ZqI$XJ@~jO3-((TRYrcE+^O(qdh6>wW*#01AF4UCCit!NNSv&2HS?= zyU^BSmdr7D+4s;@ab2ZohRD7m>s@hni&xbQ2QMA*Ln*RR=CaG&Dq`xH?RczH_j>)D zm-tRMIaCaBb*SLYG@Co}g#|2HMzM66NoXykp9WeH1DXuHGpb`}>4i;{!MQ^0C+7eEs-&_)(Eh565Y4zMEYR zws!x5sPFcZ)X+U=$1lDwU&oahvEj){H<@-=JymX`qzEG_vCqWAo&hxqXO~GspR$bV z4^v1+HF|lnI%l^^Hx(coi-!2~&!;wS9lNa*bTYpW-ma`U-@BbCm5nR>jdXSI`OJEh zu_b;wvm3Nc&@}c06TQZc6nE6x1bg=A{>-{5aLz_>7;Qf|i>MCR=uZnYAy`hzz4;70 zM*&nxU^GfjkL)2d>%iw9%kI*2k*cXG^Hm3}X-+|}fYG@Mx{edvrFv(p^WqOHo`!XH znxvma1e9Eb#nHQraMKF8cFQu?KUR(OEzsI(2I#wE81%C2Nl0fih7Ow-LoXG#ozppV zHh?b~o}#>rs>ys?c!8yIK?aW7x&MOsIGJg!Yiz2@T5a(g3>!nvWfEG^ zR5wkQ$`sG73ZzRtHYBUEA2`tFn?CpRiMCyGK~iYHKxI@Ai?2chctHgOd)3yaK0iyd ze*bNnt!`~dROxf^i2K&vgKJOQ35Cc=mQ1AFZTlym?uQty7=y7n`4x;|Ye7L&Am%5f z?Z^xPZ;`FbnzdDhIl| zBh!WgjM+FQD>RHXeN+BVb`wi`h*PJGgnEOSwX94%>~NrS&jlWUyT+?rNYr@B&B6Qn zR6Tc7!>S6qIKHT=;kXUafX1KkM!c=P$9NGYXXBIfK ziA#Bqi%P6>I;!%o0TtZlE(jT6J*`U-VgW;Uv=gOgxDU(KSLsnXX2UpkP@_Y1TE^j9 zS$?rcvfSlKF{@tv^?xfmhacglENh>~_P=%M^-Kj`!ts5~*y!RyZhwnOm8?k<4D0UG zsOX8*VB=H!iin#~Z-QA%4pQ=3Zn0R8y?}}*S7?nOpze{~qYui;krDxX8>-NM$rN^`;pi1-_llGU+p*dC1PB@?ECl5yzMm@Zp z2FiaExAj|DJAut?omDT@x$*2uj^KJ`-C*i;?V#5& ze2~~V57{XtNoFC~_}bsPYp%SS122*>DK)U{0MMcHVvx^_|Md%jAPgeWJ-==;{xOTW zXx|~xLB$hmpnG?iUK5XvME;YteN_YbMO_!@d^8pI{=B?Ok?7N=ItI)yH!GZy(Z9zG z;-NX~QVt_~{$L(#UV-lSj2T%HSKWfojv1*wFFfY;32e6g&iX&&7XK+IZjwGOkR4e0 zSuWtFZsfZ#nn!l8LMGTOYUK%eDGSo9W4M`yc zmX462W>e8@q{gdL#HahI`VwyBFX!*x_-7Q4h7v=(>zZqf0>8cnO)3WSY+H_kU z(1vqr7B*BJ<(n$7$O{1swxyMAPc|A}#^|J5F(LhoLB_DQlzac1#nOpa6%wWgjM)0$ z(Of&7UDm0gC8FcCb6?G&dxs9{hfDWcYc&YAzzQP)n_{l~x295r>?#|E^76cHZR*Kd zZ_sA+B6j87A{aeI&>PgOc_G!-_|*D(LtmvbyH{I zvMVugB>m2LG^tScWkYbc#BzOL*0RlpajxrCTT7+I9&Ew@`7Y!8c4iiQT`*{F zxO_WX)nT%{W)t8jgX>n18$AN6bV}JI$0;z^4&!|u1?eQ(P&_6pCE?ZkfXHnI81yB0P8{f%4Oa6%%w;`;@ zA-KK%YM8hnD%^ums4(TkPQYLv&8R!mK};ocQp2EE#pASwx_g*z$^r=t%CE847J*F6 z@c6yUO4g?4zxiRCzi>CnSP>y=+IdO5o_xov2BPNRKdL-iL&{EFH;CIRA?L72)ErwB zTl!^1$8R&M{W@xR!_ulP;x#URRarhM-@up%!|8iW=t~69Ux~J&aQ863rk{F4TYLvg zU#irNSLn<*32x)01*rl~1vy(0B{SBmAux<`2i)e(#F zmiLKw2RRl&(mx%bKG5n%u&Dlqj!&9)_QXeI-yc%r_RyhCN*<|ruvD~p6O@Q;W^;t zc<4Sq_VBTe7FwWT=96@8!a&-}Cg8Pv!&9wDnpcXN6yxnTqMQXU4HK6*MLgiW?zp<$ zLVmbT+^rAV;ty7x3kn%AwkWRsu1-Bl+^v_!d_)^_?KY>&=fBXtUdR1-c5m)QtmCMs z5>6d%s!Fzmde7SGcm8(aX`3ALLiMhA^GwX4Ud`X3zcH|HW2n5LOU*;FYpw;n4Q;qn zlZS^?3{Ay@L9NogZ8p}&ld-B>?aF6DqFZ?3uwCN?j)a|}pGPO8<(1z?6vSg?crkm2 zZpwNsf6$z)9UeP_L>#U;vNR*Qe@?z9V2x{J|tbrtHB#PYC1 z?`kZ+=7kI4|F7EftJV)Jrlx4VQ)%w3{qaapc=_Ni(SK)8ntMX?xmM(b?z}ZXwG{-% zNkg9QvEM2Eu}l#Ko3@-uu^4H=OX3B!FLe9G%@zkL>L+vsb*}kebrl`hi_++a+pPHT zXt@0A;i~Vy`aGU{AP4ZRdx~4x;a$$MO(~7y=2#^t+YW80apV{$*p+q}RV*09>#^yL zy8igo`8=AnM8Z7nVhNb-G+xXVqhi`Q7dhM*n1U(hAmHj9HEP?{gA`D&s&|S@$&}k8 z&GeN4_6yV&m+Tnk6)DT&n-~f#I+^3_DBEn;b4Yb~L`;l0F#MH@S%9fVyRQ4|+3yg9 zjg_rQW#l_=L%l{TVpRe$!#n%g{Ydbb+iY;B?o!`9e z%STEtwvJ5boM_`9gU;$h4LUN~wEe=-)F(IB4|;R+*o0fvF>a zAP~_@mduHN$tb2iqp%f(a?mWJ8xk+ZXD{8^9p&gZh><&xb47hbW{auOJaf>aHHEC5 zA5uzs8M@So!AnZWtCXVJSOImpm3BkgUe>9cn#?(ku zg`90XR!eDR-wdyQ(#;N;z|E&|=FyBZG1~;G;hy#ZXmD*CeBA)g9H{ci#n+pEoA}sN zYk)qB!tU`lALLiC-tEh+IL91M&ygqh_IrW5dqRp~J{fAK{QbNOZzerEG953$s#}&X zvYqjA4j%=38r;QwaLR^H$@|HrD+!e?IQ)kX*%p%$!_yO{jsh;NJC{dZJBF{5{dbj+ z$rp5i%MZQX4E&6C?kfLi^Quq^GS+=1@9etGf1~uL@vgPok$9pQW;JeSV60L@45w_o^AQnXCoh(1U5S5ikv=XYT(o1zc;!smD zQ7m}?c3Az3{m$c`mYtz-0j1BZ7>XtDPK|wkTdbefd=*WKkxto`aXGa z$K5EJX>gB&!Yi=T7q4rcY7j_wstW-$GH6!*Pi^6c`%MpoY&czi2qx*MnIjxsii{>j z`IIfo3fw5=Y;qFmh%bUFK-WI&QKw>cg8Ai6|HOEHRG!EcfQRsOzH(tv*83Q+O_}Ww zJ1w(vZRoZH7&WSCw^7`i(&iC;av;)W#=+vuGan3FFf+_rAMC+;O{%1e{Aoarqv;}! zlIIVQ);rFc7uYwqA4D%4?n+?~Es^IU6Xy7b+tiUMK3`WzIW^Y@)Okw5RjGRn-<@yz z1d0fm9R!u3_D*8^BiBEyO{N`I!b#`&RKOmoIxY2@gy*gyA31nOb=&w_CF+HZcqrU8 z`0&b<~9rL~Nt~`{i0!&)X!ZmX+L9@Hu9;aVk$3G6kZ%n)T|3rM}O?zxqS0#VY zh>GQGCUY}V9QQMsB-ldO_yi`Kw(ty`fceVX{{M8SoM$sD7gyUgB^)?X zgZtcOx#KeKtyhZ;Ug&YTVtVOS=@=}aHDG1rNR@I}C*of});MKf4vxOX=}H%dz)-(S z26DElrzlL4h`_o<=?2M@R=bhi*!i3t7$L@Vu0KCn{mo|Se|rN-p9t5F;VCyUeDe*} zE3@UF3#ZMUf2uGiEnX9DxP-a5_dH;S1?J(-dUGAy;8^Y}f8;+*vmVgaPQ!sXeU2^) zEv50;M((nY4n@n#sdq}3Mb4=A_+In4y6apOxYOJ2-MM{%J-6hp>@5x#7DAj%M)N%y zUeeSt>z~u~>&{LkZq}uoJk3hOSQe%VKmj@~dBxPsSz@kvdb7oagoyHrlDk=QaxcOL z>}iAc_llEYy?-J{oU}4ytPL%tBMHJ*#RsYvSv-#c(-Mf$fM;7`)iD;^kC9tyf84*% z34zfO*U?T7TbdJwiC{apkw@cE=Mx zBkP@c;_eMN&Ur{2#mf^2fqHeiSVj46qYXuRaaZ_O9Dl>TTHEOGSFY~14CLLqzvte# zr6YPLk)X_c6c{8a=<4np=V#;UPem6L8iuO%TXIziTCBgIWVMrdv>`6f>Q?-qJ(RNR zS%?x^mC-QiJX&$G&{aTas>XOw?fBDz;mQ+EDS~lCVqKGAvjup6#Y1@u!sw~Rx?6!9 z@7qyEMRz|c*7txSaV7g%@SVW*EH~{c^GSIATJRoNVt>@#Bn~RJQ@$%!(;SnL3LO^j zRN@a=)kgQ!kPoY!B;Gy-4l^HS=O4C7hwe&^5;5i0&^*H$yk=E!vWmj{R9BQhdu0el zVO3015+4LYcle6dg!*_+$?0jq@kgqS0 zW%Ky>MLQ9tRKs2K+4 zwQO4^xAUYLpnSxEve}tyQM0Je#4nETKlGS+H2LLD>5XuPBI`U@=tcql%NUwCW6NcEysHsfT?0;3srl(DE&pT-ft zth}Pn$Kb5nnp+ilp|V7w1nE>{2%ZGCDB3PHx|0vF3k|Hv3vJ3Z^0|{)bioMZ(-WI0 z4l5zi0eNT-!LrM(EPnNk51d+R?)Ca)&Fmh{0rI`{vSLrVd8zyw;lBKqh~Y-m{_dvi z75TIFZ-X*O{19QZw4pkq%E4n}@Fp2U0kXbM83R$rcNy5t+<8zE>pj_PyiENXEIhQAg;@i!wI+R-0A5(?oemw{Mb*gAI1@5in(m_i$PQk zMvAKe(st>ERg^Nchn}@uVYl)otKX?4hK8qbqNwcS#pDOaZZ`vm3gbk=Ve}$tdxP_o#}>8bmNrrmTPuqTZu1* zB=8Tws|8Qw7hvN8wjfl?>ebTldQ)+8)R6nu-<2$14?YW1JLkUijrsRloa#SU#^dat zTRM_Rh#2!)$)G6lk*({a{aKRa+;mKSlwM=nY^L66&x*pBr(MA%myRBn&{li;3n6+I zqFYczd_Lg7X|C-5clI`sn-@90D=}n1Ia*DW#nLk={{NUkY`#<_FKSkd?iue}U2Ztn{sp#s z-HfCJzjSsY6T1?hmg3cK9^$&GtvfLKUG)p+(hfGSUdTj^BlNPUZB zbyGWJn`*D1bd!E{7~gNEr<#1y&ywEiSFE4d52oIfUtd@=6t1%kO}u@FewR8e#SUDR z-!R8l+GMV)VRQvrjCRMRvNSREe3J24T?L^jdWzC66>|OIu+|Q~=@_})c}O;Qmi(xk z9CuH(^585dbNa?va5S6|Sz&(r>(6mXqU%v;ue^LUXX;wwM+L9#7sv01`LW{NWuWqG z3EXeS;_@1!sQIXwLdgRk3un96-3)t`p8Vp?#&S?;>(=GyPn!+8Xffo-_*9tA#NTBV z!~DfOq8`=H&?OxR#M&OIxBm3=j`~ySEDxb43X1~rz*!WtV8Od;Qyu-eO-o+5ljt8M zI+Bzmx+R%fB?N>m2AG$BnPE**lbTPo)em=9JDo<-aPGYe=G6X84|LEp!PYZx(lBz9yOB_;*UDr01dNW3lYCx_rhAmbT6UG zv;V!iGjXi}{5auF3@=Z%(c7FwFe`R6qp|fj`ZFdP z^>StPFMmXb<&sK|*XFy3{AGs;(2sJgteS*BtrRt4a%2YdIx!|DVT&?(A9YkHT=1~= zs5?oe?Ul7v*x!5!JCcrpmry)i@u990PU7H}#&gLjk0(HauXu+}SZgfgE5u69u<#vw zZUx`CMOcqp$Hgd+Bf4s(Q)$G0`ZC^)3~&rxX2@9V$cw3_m8;)f1~vOeoY5Tg&fP;` z(3F{It|g|~=fv7}y`RShwPrS-7g?3G_*lZ=GJb$Kp5dG z>enxFEx0}PHyThnrD0Sjj62C8K1u(AWRH&!Wcas?B67wQZQ8AGfA;^)Q_Qon*D_&A{13b+xsfJ^nwt*A-j zv$>OwKJ&rCOr+XU!4hX3?YeD2rl8co5rxmPlMptE;fv#xV-aD98?%b%SFiZdSo{kf{PCTN}T_nYvwL6q(${Nt(e6Lyj)Voo^|JT-4>**B-EiYZB zI(5Gl-;!@P;Aq~tDAbW?I`^OS^5P8l9zaT~6_S4ZPUk-0}VoUDMok@S%2 zB3IRjSd0qe|MQ|{SDEdUBA!F(!7Cy`*<#Do%f$D)r8Ya8XOMeDWuabaAnh!9UJlv^ z7MyI7Wx(+L;XI7ie0w7M)v87CGcA-QLhtbG76(7de`l1?KWxzQgZZ#iVA9SXudokCO z)sQ#sKMwfMbGPn~jeIkS(a)&5OV2_E`kBEXdS5zqF81y_jW*5jfztCR@4Nbf$i`-+ zh-B>^T6$@m5ry#)F5^GN$WoUKk=KhNA|UI&D2%KI)9U5$ZDcP8^0)a-LetD%652dn z)O2_nO-k7@ds_kt{NcgL=LHoO5udQ?tjrvGyxUWw?YvMLeIog^hKH)Z>AzAXcu2`0_nK_pU}!a1}f3L6FUBQZsS;NEY0K zlaYLeY1K{aGctDz*0HlL+1AuRrrYwjs~=8>1KkaJop$vR_{@J>jYZKy>WKzmbLINt zm6XF_-%@398+&!5N{YYqtm@m^wa{@B^#1(fZFig>HI|6o8=vn9STk#K*y|742X-mh zg>3Q*fzHhDS6O+X60KI8*o9~E`%~$Bq!Rm+_}c@%xGO?>;Y=$D`Xts#nto!E^>&gy zOM3RAt)h_58&5?axuqY&T4;;+I)`^vo7P?(_)xxu2H3_U5PHCBuS6VlyaFpufrNL- zl0dG10td!~hR6r~kbrN;s1hVMUL-(nbF29;s6X7(RmaBh$Gw`_qW;l0hHZ|8c?a=3 zlP;=TegEzEVCC5uc~zS{{^6WqPsz8N+FidfZ7A2<18LU&zn2%O8{^o`h#re(8NA-P3iZE<1{dZgg6&UWWR4N+F2Tw z>4m5dBWwCojFGTi88bM!{a`e{3kT&lJM5-gE#MHcsjT42#g4zeOX;8%IpZ9|Aa;Ko zTHS3%FAJ1}nY#kDxy0NQN5=<=DYsWCc}(m2jp9^LJ}vj0w)oKp4t~z^e;F=IWZELw zZUxpN$SdTGvL8;0~?VV~8A!L>X>(KpH_eTM-4Is*0zu zz6CjFD1P>5elF-v9sQpXBfY4Rc&UiUG%?YRge4=Ij8Bik6tv^;0oJEnX!1SDz-W0sLErf3WhVZ%7Vcs2m z^3e7!ZTBIj8o-(EYj;S^5~4eapH`3p`R4;OJ%Ks>i-@3C#AQKEik{JAN!2&`TfKMi zvfyGqJuz#2k|#kW7&ieTnO3;INj+HS98*lKa26S4*vf8 zR!|r=72py}X~|cwJS(={$Lp=5T}-yOjjw|BsP1rg;=PTYqn*iT zrwV4n>b$MIN2AE|!NpDIA@xVLt`5JPBpL)aTDn6PNkmKywb|ag#gw3GbS9JaQrrx6 z6m7`6S3c*bCUQT1WVN*@qB@l!LrlpdvVztqO7AcYaTh8eAP#ZGH? zZLGC7+RXR%4c0otK)UG@Hv*88Teu@o0`6cFtkSctBq1q~E!HFEpp>~)f2l2ti*Xxy z=3xi8Ox;M`{C#FoPIv9}K?axJXU}qaLa4;Oh)#D_>(=}TTSZI3kEXx7jKca6;)5;F zyfd(R(OJH-rfP%S^aQ@-@+BSY;U})(BmmJ{0>kQ*2>i{DR+on`gbHmVHB9|v zx|i|`fz#I!iDzkk!YYv3IyTQ#*7_Jk=o2?|{DLTEx!d^6@bYAT*yGjYQ#13KZMDBL z@&0{l40(dDNe!cMFUx=Hkx)mZ=nyR2;YSds$Y#Ck)*0`wGiAue(#Epu&HihfB{wCP zb5pv${iGMnY@`;or44%%7AYW)ZO zv=r>1TlOom|5jjDz~+|4&mkqDDSza`D*tua)b z&WKAQ0aL^VTi!o_Hkx}rUce)1C!GIVTd@ph7mQgl-ef&ArSLey8R27By|IyO|D^i+ zeO*z><%^RlHSxNlaLd86=T)DcpGD(fY{Q}IJ)?#vw@X`Hg#|GFNH&TX{js4QKLp5! zFsZ5GrJ~OSWx72wF7(We#8u(;_kLpVgb$ar-2owAJR4wNn*5ewpX?j%V{lE(O{|N4 zfU4x@^oLu16t-T|xr*QBU-mF=~p!rY9JGs7updB5}DH`aX~>YK31h-Fu_G0Nuh%YCbK9gJMmu%M`S`1r|T@7&F5&pkK`sukYLh;!+ z_l^6zJqv?vkmF<_=3NHe4x4tmVSwKEZcJ*G;z)T z&JCrnD@{j0j&!-T#e)lYQ!;^_o!z$L`lK-eDo{o4>{ClMAC(uL+1qBB4ZZW$?l`kR z(w4bNJw%dJH$8+WvEmPT zm$Jp#h}+?H!pmx~L3Os+t8jo8M%4I3I#?=oeu2l&@wY(Lk_+P%oRJo|b9r=VZ#hdI zo@eUy()^i6%J+lA>}J8JNbXb@uhA@939lHiA%)ePPAD>6^l>Pt39nIUKBJ^%BZ18c zuAD&fNejF{`hwlB`#*y0ujIyw>)|ovm3XTjRg+;r(j>(w?CCwWL~i82V7yz9|8CXg zed{Mb1efB1N+gwpFU7UNq0E0y>KnMj{dK#)Xr@okvQOJ zL0S37Om{t&+w8%kuCPMBs_p+rJ8kT2BxB!Z#ykpb!Hy-}89h6%Sgy=3uI}ZDFeS)q z5pRirSBGxos?SzB*kH5Ch zJmwQ=DPw1Bd5ewB!~R)GHk)(kmqG`>>HR&?M+#Q>lB{0OD$~UY#9fMzyXmTNL=Jkm z6p42w{`;KL6luC26^nK9vrfe#QV-iUG7T7L+mf4(**8CHwckQZnziY@@;~LhcGWNR zQ%IX{ET~z@uDmFOGPi0Oaoq#`Va9x(7G9m!GpVPn+jH9~O!u9KXJURn>cXHhzcOus zejFVi9c3r@;8_&`#A2vLpYNRb?xywFR#KLU3ZKYS7$1sm8S z#l+ftL8uPk%U<--=>_NorGykn@7hG?bBppXMdU8yw%|r`i2GH@Rg2nSWNo7L=`Vmq zNfB#)5z8?#7)tOh({t`mPBQ}HP1(cV9W+kj-&_qIJ5FZT?U~rk4?Vc6Wp!|&NywCv z|H#wa2lK3B-gA6pf!Ik9j!E@9o31+i_hHMem(k^7)`1U#RXIGyOODOIgN>a&oIz%l zdJS|f2QcaDSbKA(n1kP6M}BhuMYv!jID|VSkfsPF@kz-R2__Q`Y)kk^5fcMF@JD$3 zdzRD6;TrJ^lz%2^wx615H-K(0`}}4N7~~fV>eQWgmN>M%8QRVn+;1=$O0eobaBkh} zy9IhnR}<=LIQhJM&_lfxe0}!ul1Hwf74wJBylOIeK(NB7_Za@Uf7}?z@IUnPR~31r zW5VKXQ{m)QupW}(d*ol=bTXa9BxDX_(qaEtmLhOvjj!v>QI>`EyJWH6z01wPcE=yS zb8_YvEW2ov&x8rB??atEgPi-9sJYb?(wTsa_QbHbti-FsGa}{I{Qq0A17qf>fi#4F z&;I<$$yCzskiQ+&*EuVmFq8^cQfBvg(JEmhZcll$#6IRn4GVivU5|e~P11WIjkA@t zni>l;^J;wBec305o3}(3I~mNoM)Wp^Eg1eLbpb{PBJWkK2PWWE>g?=`_IH0uy_h!f z(QELG^pyAdr&0Q;R&E!5eqUv1U~-Lf@_%S)0!3KOVxFtwd)Oq|DCshhQ&H(f7=IaV zR7>7+>puPSW5ySNb7c&uIR*%S-oa_AWt$tcqab_fL)J~x-YY2-cCL-d=T}YsP5oq> z)C>${c3byoQs4TJHGip%XTAbP0bbiqZ1QAPEN@KLF8)-o01acW&}}(xq@w_MU0gb( zSAc7IoTB(}%dK%G=R)}axpMC7ZFJC%sQRI2-4&?CAfTuhK6c;n%qPoM@R(YDAp?V)DD6ZicufLu<{k0vn^t4no%0X)Pp;Bfnzoy*d68L}Q#< z+vEhT!g(qrZ{#{~Dvu3w^5?F8X=wqDUy`yt2udG|6b;BBL3<3$s3Q9a-02BP?7*oq zEzJFtE9z{Jn_(1Tb(g+_yZ|5n%Aw)}&5Ue@GL-nF)lBb0U?q$J*SOYy0VP1ueQ^>=FK z^9*#+W(a!!q3ynTk@L>9M9?gzcfQHIJdWS9ew%Cf>x+(NoO-5y{a&s?syx}PVAU<90rE-q-4FLUR&h6h52YN-uchZFHPX-2wHDn;ymW${yDXu6nuAp6fNiinQr4=hK4S;xy%_|D%;RYw=a z#z3}+1b(ofPtB{q2=i8*{IC@|eK_!q?HIF9;cFSuW#)6H0kp-){vgYIK1Hrm0VXsK z!uH+CpGD^~G#hSy*9+FqW9IYK~ z7UlntSDQebSlJh#a+#HPL4|_4=%sP&jO+6Z-dzXzipTUFc;k%^av`4_n;2|cz>t}O znAK#Cl8TILYRy6pXHvII!Cb>3TBIr_F|DGo@F@%y#wMprOAVAy+rlN9Q<3#mgBv%( z5BEeLh`n^o-SCCRQ)#O(C?Pmdd@8Bf6w<{bC(|jk+{%*(HR5hR3!qpv5`BO?7@! zeY5oWFNhi^l^`+L^b!Hxk5|01uS&%%sMOfmBlZ<(6Caom>_~{iSW_!mu3?MkMrnzq z>lJSud8XR9-~W!2ZO-1Kb*ReaK%1V7)?t7AxJ65uN4by;y!}gfDfN2T;JU>t4yBog z=-BqBF>wJl(^q17-GPEA;{oz9!hK!^xJ)L2)=&Wp(;F51`_IJ`dYS;{7N|JvGBvz* z=gJ%Q4l7VI_G^;T0#8{*60p-D^eAXC4~3P1_H2W$ErQXpAEwiqR-yKKUUJ``)D zhPbp&Fxs7TJ(@f%xUF7i3AUHlzod|?yY6OQ^Y(SimoxrtXfHvTfy)AC3|>@8m@G7V zxsk{=(BrW^JXb!s$ll9azs)}#vXH~G0npqOfDlkKt~H{oj;6a$HhXI#X<9?e2Sa6?iif;c|t~a*0S$C z&CumuJ({_bZH8RN*1?$|wHZETOf9FSKn(056hA4nafjV4FIaXDc3#Q|Qh2;;Um?lcd08q?HpaY&#Vnn@4*l_$C8Ji{?=`i_5(syJgpw8589_{a%(KItQWRNcuG zyzyRvN30!~Ntb+V-AD2@^b@DIJU7x@%}9tak|1A94;-lmI5x@~O)HS!TiBLOLK|NU z(>IMOXJkq9Ya1YWJ za^69H9GmNHjS(0vCcHE&W2`tnis~-TrtbZW7WK`3<`^QS!76aHxvq)sU`%!??t^xj zGe4?~>d&qnb`qqngHB&_m6&|Yat;M>i7)mV)lcoMcG=G@ErBVm9}^Fv*lU_f?ULS* zPe{JFXZtkN8~g(DyL{zvS6TI&D*4AnmXXdrUi>poy}}I$XdX>z+yP zbrsUMK=0u#J=*lhUt^{zzNx)<{2dKzq@DjYdM$g6tpLV^Ys)i(>dVPDR`%aiJ1Os$nVJ`gQ;8 zUlk$zSB!3p6twDj=sBhCKXD^Yx;6NkYC=)S_xQnVf%Tr21J=lR7I$zed1M0B`M?&=iBN&U zSeF6Ku}5$pLa>z#x%)%h_4?sJ#rW_P;Y67I>7AsR6?;b1>kHsK6!sv^fu2m$mU;=pOu2a2zp2F@c6eZo`Bz|KDfiaKY|51JG z&|3Wx&}3OnWE%68wHAQ+@jopIu0>&5+08ox=7W0`XkP{ie`z=yah7mrI`51EQX|Py zRI!Jzl8aGZ)%G`N#YK9Ib{HpXMJd~tFIw@$B$;!uMS(Z1;5noras~=Iep=^a!2upD z7spQV;tHR-LItUzK0_R8_e>mfW)YGjXPEES(SxOCB$XZ?vS_EZG9%a%0iDzM;JJr# zOXbzk(Grp)`^x%ulswZ)$h9O1n>Pto#*>8-dUOi}_hQG_ChpV)XE){{gXjNa?>obq z+O|bewy;H!t%!6`kuD;=7ezsk-a7(PL+?ExB1ly!N^e5wkzPYUno<&42t^3JcL;$1 z$y@Am&%I~gbAH@^=e_T~`DcBZnQN`N#+;*%IR>jU#viu0(r;4wP|uySP z>#jApT*Q#t9O7Ch+}MRf{%#wcP$~5s`_M;WjaM#*F#o1spKYgC1*v`S<@s=AJD?l zWj!De;KGmEq_kFQz_VazavFu$0xD>#4{@E6@-XPO1lP)re}W7%P#xH|;;xP8@qKFN z&$-r=Nq?H)TI))*bhT?0GTC#X+W%c|f4X8%mC@;any=^C^D=_#%!h-Tte|BZzLUph z6G~;r9V!omi7ZZcI>tXO^ER3}Z$DqAE$DndH>UG?UANA)S|48hl(lRs&w1j})IKK& z2(Up-YQJJ9KVmNEyjmeeCKspNq;l_Qr&xQY5V!erq+%*nhCq0gZar1JQ;=J!l_~cJ zNL8{zdrzR}iTvO&kyl6(whHyE=6+^28+7?uB;;E4?~QDztWdS=v)d+a8gCZ5ba_ zZgTu!eFZ8QQjZh0E&kE?F>PwK)vMem>!koX^Q}1UD8Jsq`czkMJ?k+ui>-6Va@zYF^ANKx;w)y!M7pC8xz!^?%$sP~%{G;YEs zuCi+ploxyFdv!cu6LBHL4M;pHtlaXhn{Zk2kHugYVDX~ucABwPlhdIglv5gi52e|y zMIAuo&e!B_KvlOa@`gx04CSa6c;8CTGvO`P|2Us{r1F;76i6N8 zd8W#EerXoupE8XYjQO_QKP7jRhYBt+m+LAhz<3gt9bD@cFu*kQ%;%I*8Od+*I2?XV z<07jK5%$Q1rOqRd>Cu<&6$GJfn8)lbv% zHEIDZw7JX+yBLpTll6yPznTV1SJuKBf< zblyytm`%nyU|>UrDPyOKwL@u=occ#hB$!JKiI26ObTua%Ek0COQ7+;DuiQLeTuz}i z>N~2?4T#5bxKxA)=O)R=PAKX z_4IrJzBGaKJnHV!l`vJC`pIqa$*3K6N=Kuc^)eg2&?nK^(l2aMO-x*4GNzWlr1Z7l z39juvUFH^Q?(}Sa_4`E(U=U81(t|&(Y<(e8S9e0!aRS`-g3?`f<`+VveeOw#lzy3x z_ZXp@6ch3>E#t9DaQfEDWwLia;Z@IiN;8b^@SWU<8WN!U z7~o0UM zV^xZtQz(%1tau{ANl}AgeeDMnHg~%^P(2m!14f-+0J7#?{hC+iOJ&Ny%z&R!IH0tnmPBo6Es0uF`Q--h+k7_ zDO*X639`U(gBipx+!um>bmY-QtX(&r7kuhMQ!m;gBYT`x*wpoGYaA{H>X5EoDMwmp zL@4%v%%m zcIwj;DXFis5h7&!bm%dR2OYNFi)IK?e}09%8&~rSvAI`2v3zn2S``rzw)xg~*#TMk zF+FSD0Nn4+^lJa=(0H)`#a_dU$?C6t0_F->Wg1bbZYf7*yDQJlN*DJ;z3pq)=0obMn|w2cC(+Xp@g>u> zOME!KWs9H6dQD}CM@I+m(r=@C14fdqr@HH4zEMvvm*{B))KpSptgo9`O$Rg4r4}*X z`fhS&Ud{?-Ao|S&e=c_LKct{99txKUDWWlp#Yz@8PjP7=z%yM2?H%uaKo38})5EnC z^xp5|?8Kb&m3W!=-qWW)C|Gs0D-Pte{tVu4yC>mu63MjjG6Z&CiArDIO%6r7SUfro zk(#I32psTP2yK+5kBh5R@9sL%`MIYu!4~cI8B^b}l^GM-&LHx&zBhKOE!L#}s0qMX z&X*ZeO7GR1y3NBrsF?2;GO-A7z=#@fcd}fhL%WQCk>sLjpb!UwkI_e=45zc7{ricFp>AQp>5go`z z$xYJ5z+n~h60DYH|6>Uc`pNWNr?ZgoNS>ngqG%q3;fMvq{NC8}%^SNLV!8{ELVNtz zISQOuO0#PwP;t6^F<Nty%;pgTHFKR za8Cq}sKC%(x*mPsOd8c`Rm+mg`RkDA`_s4P5D;~8G5)b-(+%f9f5RIgq}C!L?k!~W zag%Gk9?81n5Y-_A&h_*IaNdp?Yw>dZgV81Dv3aDFq=(&8qxU{g;{xWM@|mqAk*i2D zi}XBbY9V(=K0Z-s{O{7W>vN977V9>ZqPyX_d*XGa=9; zX@}W%d4Zb7)eb9unQRWh(L1`vbiZZT`c%oZZ#ETW!qk_$RJXPWxs(raOoN#fX&D(+ z@@!GtJ54E0CE};AG;!L*zL9<)lp!}aF_@q5G?G$>m?a`<7HsU@9p5<upC{ zw1+EkZ8LJKL<4g-=9MU~P=~Q8ard)B3d(~+(gku{KipT0(|eXJsi&`7)a0)!_DC5G zwl4c_tcr`!@Z0Y7@o9Z)ml#YGaE^X=g<<2BT0u0!RH&g^E5gw(&tztFd2}R7`4&V? zPnSrB%JjM6T34VWj2-h2ctyA#=b$Bc{*+UiF%~22kw-&%AAS2X zEf`JOWH;tVx%y%l7G`Y9&I%^Jp>-yVkT-g(^_hs8SDUndM~4O*NJY%Qj3Bniu! zh7FXiN?v*Euvm1nn_suMq+}#+s`4kK{${vRyut9{gE)s)dC89?<0DbmG`6Jjbe8Lw z1QnHs?v+1q%CeKH(x@I9%P!ZA7|P0aN7PStnvv<5wBiV+V;_ z5JE4M<;>1?3$$aKIGVzLBGk<$cYF|6Ui!I&Yq-i`Ybgy5JAYHl_Gq=vN3dQTWg;ke zZSi3SbMVwW5;jbMlhl*Jv6hkCgvs0N@uKm(TM7-J4Zqr#@3Xg1$v~ol7PgB`RsU2` z*clYJ^7OjwrFI5s$4?b6v&wF=R9nTJuMOVSW8u?oJW$-kn^Vx!a;Kk@xmZuhp`E7c zp;X}__qQ2UP87?&;~AZiGu9=tc1&no{3zFfn3y;F+{B`s{Kxzr$7e4zQ0OuG1-X2D zHG*bx7F5G_9tl!?Q|X$0yMVy*X6R8l+ANd!r~r1{BsyH^UT*SsIz8; zlS+$g)-8X1p$fO<{3ZVuX}1$=lXvx&nQwW={wr(l?Du;>UgFmHcU?RZvRVfr_?kPW z)Q;HyJRn@M3-(RN* zjIMq0zpO9d_U+pl)lL6BX?a_z=0D|x4n?nP>F6j#*!>-Xf4`c)r}(D~=Ph@x{(JiL z6VlSsJoSAe^;pKg`VuRjOk6>gh|QdmDLMA`yMhp%uX-+aNGPu&thcUw3?qxzKC!X& za_Z~}X1gsFoZ^zsP~Mv5B2w0mD#Yo7IGJxiO~oG{<2?dX67`KIk-ZeK?e@sXrF_#LM1+AOxh$PuX%g`;cP{Y7=fC;hiXn) zKS9gsSr*)uw0)yUwOycd6)F+*>MI$ndsOU~F%Cb1_znJigF zUoKTBF=o<5lH0{^564@3uPAdL%lE7Y4vG`#mby;(Ww5IrEyXm-eT;$-wo7U>3Os4T(=Swzr@4%jZhfFNkz(+&v%dLVomUv{!lFJZ5g{rdV z913A@+^|_jUe9vN=b+kJqWc|~X6EwRudh4B9g^RCK{19~E%7d>btF|ux0rlz_?b+n zXUFYqCN^~GA@h40ex=OPUDM25G!Ycxal6 z2nvIZ#?PX~Wf~dFa*`JAm-LDFr{(@j?9NKCjpJRp~NIt5L~_zPzbVj8Dj4=nv1fAfg1e$yqWBesl+I1lY6?-s&&@#=B&} zI?~^+?|K1i=@P2)vH7laU3;*+vRIZ_1!8y@^H6VW4M--tD=@%di#5pAm&1J$O}@gl z-Aq(E=n*4B@R*)Pn*$-j2uN5!EzfuQC{bO< zQ%p#yO)84wOO?C^L8k^wJD|+7xR$H+~t{z<=Bn zc{nb{SWPmiOH970M37Nx7n3dPv8`EfV49}m4JcKoDSAY3O7vj(`i*f}lwB$vuRdyq zi58HIu659<$Y%wZ%Ma+ZVfy94az{WlS zFX&7>y@m%vU9>F~EU;VF*quA5$<}#io6MB&E-h&Gi3!cLd{ZH}8z=8v994ZpPk5}1 zKW%=jz8ULz!~i^kRtZ+O^H_t7oXfKCWmWZ02$TbnX_KH;T3uJqt2i)W-;LH@++=Nd zFi02lJxOrnV@=TN>=Wy<6?d<=l(e6SOYTh@k3L;g|7d#do*Nx_<%bx717|o8RX4x< z>+6gBQl}oDC8>ZcgSjELBfwlS`Ek=}wa#!T277jb1QV{6HfQqGdJd5Ha_^M>tPj%3 zPtWpjUJ=SMzrwmRG*luVr_ACkqxj8`G33+&e;$~+?yuLUbmtB<@Cgw+8Q8li@I;x- zj8G|PkWOgT1)F^=1P3*!Z;UyQ+DUopZc9D;sPJYK!Px|SDG6}zY-|JzNSw)0QBei_UEJ?_Z8m52%oj{WZ48q&oIX`LIw)pbO<3Yg^K%Rrj3K4T z92Jz^EW*pUg7zjaqsTQza4Q-~10w31MkO+=J6gq0X{4Mpo|+NMc?{Bram9HUdv=km zW&q2c^REufx2N6ID@1|M@(E{%Q@nlo%@`Lx&4gTm==B}Qx0YQ$p?@)A> z`K1u9^xQ%IVD^jWBmgBhot(0`2_A77ZS;)5lkoKHg+rNKvkgH#Q#pBSJ5|l8;)jis z$2fl7@joE0!E%7<8_w&MQHcDK%Lo*b(K)FwWF#CG`slw9D8_B1yg+j$AJYLSHsUm- zqLNj?I4|?eyR`sN<32}&PPvy`+_Q_do6%4mb^oswCu6rMrFNd<)jOkm#8xASc$n;t zz!RM_-}M1G;?J9yQ~?w9RHytN2e(k&x^o#AVFkXvg_9d@ipzFDUQO?gr7t6?-I znVLawxIP*Q+)2e)c808()IfI2@KkZy_F~hPXh8T-N&=4uG3Q3zJ7U=mAm{y&(XcO= zY43Kpe*56#TmFY*>-|;^ZW$cvX+`e^x{;33Uv=FT^! z_+k}g=c?qY)6+9_DH6Rp?Y#VAK^XKdaz{MF72YSDgLE$kW3R|yJMZ%uzdk#kmjJ3! znb}OcUn@GH%QVOusp3149O9q6NlZx4)ilek8f&ds34u?De+5Wcn@zsKmw8+MLF662 zLE(Bw4ztk@P!Znx(#f)D!9d$;&P2KZPW#Cu5;ix)U=`f9s9|iVxm6m?63Fgx#t!lTJAs+>DGrzpb)rWDVh%jwJwa6w2TUJRU}v)9%v5a?$b6ZE#`5ho0@U;UhAJ5cm`c!)Mif z7Hxiki7?zd+_u4^c4l;Zy5zeU1Wfwn*^+pF3|0}1N+?UshdujRN8g83DoWGlf6GGg zoH?du1zIs8Iyneb%!4*gEXChDs?``_7 zUwfW>8A3+x3k$c!1hhsH@ujmP!6jw;BOgH4!fgZxVE4@4S{IOCsGx_mePYIMCTi4J z!in z7*q4Th_;*kPQm#3>(!5>qkSb0v@;qjOn|y@uE9!RfpGL(wHKyrjwM@G@YSXW0~(?$ zB|BZDAuGDD>^=FRRqq6KQw6_Gim#ZWR*Oz{&>xjD%f;{cu0iBl&Cs1)4&ReDgf|!M zCd~~C&q!&aVFwUAdK45Z?)|1vHBLuic}3DNz?71$5R~ElDeX@Rwfe;oV0zlYAuZ;Y z5^dLxDp%g$zE;29;T%ztpgLGq88S&YvO1sREA^AsiqJ0L9mS~8i&2x&|! zbWQQhK7kqvdt&Wa?|8b$BQicO;%<-TKk_|mm1BERi?O5={KjlkE48EBXawhze-fNN z@LK-Ob}-)Ie6vy_x-Q^C;QOp!>mh4eh-!|d8>@%jkCVrgsWbhW5)a`XFM~sSHH{7+ z*-X=AG_J1tmN0=Ivvh&pF?4KgIK6@@LgiD&8>#gcP3xWFllgApV=Ht}#f;z%F}x&R zL`UD<_)@EOXB-uP;?iY-J1sALgK?K+jux%cq{gDqy!D_p51f>^)OzPn!BbFZ`NUAB z##dXJBf$N8X3l=a} zc*!|9R}>C2rjH-2PJOJ_?2w0V$`DAP2W5uUvD;5R_*{ANmRqzt$fBH~^i9qCzwL{t zdGDB7CxhBiPIcnpfX}n&S`o$H9E&D%3y{(f8!2^%Hm(in%HE`EpURMvW=bBH1!?#5 zcAAg(SnXQvTfduu~^st$d3I^t=8r6}Uvgx%<^4b=_4j)`R=O z(JXi*1iK6KU8|5<*$C^&8ngE8`}r4U=d+R~Dx;O!ivXP7~*E2HVEDpNCCZ zkOt}bHc%MkS1(D|G*(FF9ExKg=k#5hVU;T;Hh|OaGf>p7;h@bjV+9=x_K*yu;3he1 zyUwTEBfUdURM(M*izCR@T>1)f39{^0?EUFWbS_BSV23RD_SbJ(Lq|%YcPjA7=6=Do zqFX-=Qu}_o12dABNN4`p+kRCg+WpXR?wE{^a9~R#_Ka&OmspxTEr&UODsPjbe}<%3 zsuQndEespxP4eDdeSwbt_#kHS*E=H;9V@GZ^tf>L>;Re-r{Q%uc-~4#2ibpwg#8qKnWGgu_BV{cJ?Fj zwwIRMq8`Z&efV=(#Nm!h&;USf>es8)c&i<97OG8VLL7C;LQqF?FP&Czx_eB-Z}s{f zdKB?5w9IJu7ikar;C)Rt#BND{lpGWXxU%7^drJYvLDsWk6cfqSU4 z;v$wX%hM4wl9n0_R61@^FeOevmyFL|Bg&q9SVq36V%af+u3xqeYdIhGXYIO3mTr1G zxr;}%`jOKRgNx^($B2}=dwv}H9UD*0Hl4K3VZ*tIVDACx>HYcnO_WG)JPpImZ@JV9 z_Mb_O1hc;s&0S4fTnjWC&93lKeR(aI21t#wnfGmjb#O#Owve3QkmmilRA8nm$l0P< z7b#P%YqVT*!8s|CLDOZl#cyrJC`F5PD`niaOIPQzWEV;s_Tq;Jl_*R~1JE=XBY z?Tu-ovfAyixR6>K0H`U1Wuil|j6m*&YGf_jIT;<=+yJT2{TW}-rAY&@9Z(9DD_Z&mHi+RMwPM2?9T6sOiyBHA{?{dBu zK{-|HHFRHQ@32b0MCtRIU-8MLK|9~AY$+CEsqeS@kbaL}OOBmHIiVX-9BE?OS%~5F z1pa5*KJN$x`LcKdnAJYUpgnpN;n<7R+D#f=Fh8C{^ zdWpPLOTDo*r#G%A!djI$yWK-z$PBEy{DCuo& z6%2U#tY;rCElYfoes^88wAhRDZ{j?SZPme!`C!_cfRh`U#gPQ(3aiPW5+B}x9-eM# z1Cz{hvq&b`uiMKTQ74j*zbo`-l>Q1{2E|$_P6V31x**B3y*ft|R_FU`oQJ>Uq_fi> z_SY+cD0bz*kHsBdn@C(q?wz!OzkrTw#Us7>^f%Mip(*R1;lj&-$qT8VW-*2_%zOerB9ek$DXj&?5;DWBgdB(;+R!d(#sc6fH+t6Fxzoxrm zT!>n}>vCTt=!cOWdc}UEXUw`KGd4VIOKRY^_ax76>})@$0v5qb_iIHnLOP0Tq>u*m z%gRjT!mgCUoj)064pG&4b25G>eCI*_RN1S_6&b#%?GS3q;5ml#pVB1z??)+rjQn_V5LYPL5vB`bQP0zH;S_(lppq7)3eX=rF^gXx*2)T_sX6C2}#5LZwXN!Flzy) zjmq^c#tPV6l<`NGPI=jz<;!DD>w(^%7Vv>F8E*n;D$W!2Y3VX=jtCF9b7KZ03@c+U zD?Tr=C=kF{IC~&DAM5V?Vn0O@=Gaio2B(34w-tvFI)qzxo@|XLLNoZqcn)^mm+YK} zn|Fc=-w1VkWbE-b@je>Fe=AlY7Xw%P8d0rwQ$Zd7)7HVl*kB$W=^UA6!NVa823?`k{WKc>5~og;n0-D1EOT4I z2*@ylj24{R|0@`8HDWiJ2-YRXrB!Z7;lHa^J=S;)23K7UG$cKw%W)Twsa@$~T4HcN z>@HVq30w>nj63%0N`vvp(dIOq$c>d*stvhB_E`Q1u>NT7XPqe+sA?Zu&B%-?@J{#C zqY*S0g2w4rgS{81S@PRCTLtF{m$xQco}W_0c)fz$Btnm01ojP#2eq;^iS)9I?)aTy zK=w%iw&02k(&n0<_#i|D^JL9FbFk02^p7vaU;>1${sbVaZAG+nXuvQ=|UBLB2sz{YvvtJ+!?LETZ)Blan?LM;R9>GfEB z-7Q(0&4HmKwMUH%k5(LsOUw88tP$baYcfK0%&A3F9M|gt0-pZKu^gV{i!}AH1ZSBP z{o-S+wE=&OzOh-EogQ?$5MJ{5fMh#J(=#v7i1bTUjn~k%fRU*70P`h}?NQ%vR%D;o zOUo|Pymqc@<<&{ouNYJcjBSGgHg4kU_&n1$#W#AQAyn(0LUuWE#|Ug%t4@q3jL<=2 zgTT$0ZsA86c4o{bEtkoIjB|vRB_;xwc?!!9nzlxZDUgNVI7i4lfBT^0jr9*RM%UDNjozIZ^LMMr|Zm&B0<7;Ln^l6D248T(7kZ!7WwLVwnd9X z=);ABsrsdoyljDZaKH=V%C@-oGB-Z}M0uRh4b^P|m5h(wr~Bb?B$(KQ`lZ#k7H|JF z-GpT1eOvyB1DJKqk7!>Fsrl(LHan45exJ4j4&{WwK?nBrfLM|+6S5_q>%`)BJ}R)C z!?3hdHBY?DCJH|gI9DpI^e3MOvo2IqNf$QXVxt*5c$`>)P|&U^BGxgCy4*6ibN8n_s!r^4^g+c~u7MJ5gFhbS4isbAoAJI5EhZ98s0907|VJ;{tP$pvR=cb{|26!hE~FffgIRT5KaMf-O8 zIFv2>ZYKj&00W%pBJ2ry@8nPWs@Ey0sm1y8&t1_6Ec?MvK=F|d%W%1}q_98T4kQ)| zokU=oe{VUbnrwi?@Rt^fzW*;AmH(>m!g=Y5SpV-XUlQokf8o)Ld29EV*8o4v|5aZp z@Bsr7rOjq34~?w6FLd>PZ1PjvjVmmrrJny>dAAMZUG)6`*NT%V?VE-Vuz>!&*&u~2 zczzSApl&x|0X!^}m!=XR<|MQ7PJn46ly{m~@0fsE+U5tJ#Gp{_|F`?E14c(j0pBum zBM@_%1x))Vm{5qi2p}*uI?_F?g~wBt)W9zUc>^9Rz+_0$7B&u;mPrhnAcSKo04x@S zecIB}g(mj7lUiD^&3`~hBwcV5DgigblxQ~u*^Df|{L;7l>s ztaBRR`3>4P87~Ce8=c)3zlNv%S1xj=Ry>eCHG~2^e`&Mc|Bpum7#=xAk&vL^%FmwY z{>PX7?~8KypRVD5-?8QOGgW}EiMFrNbH%HuNpZ;=tIrC^AK!cj$dAwhLavqnw0|G* z%LKj{3JbnHSPemulML$l&iF(A3uhllleXFPs`{CGG-w*pB>(xe4-J8kbML-}t49XF z3eBoKzrc19@jn5r>O*)dS_7q&D3 z>vveh$5qv;|6b{vMCahlN(k4$3wS7Ru>Vt)`?juU|5O~D1p55n)Q8G1EL_e&O+R{> z@^EOf7PK{ef%yQYyX|F4`KrIXLCaH`H@r?t(s28h?@kTeg+HLTU>tWZOR|gZpK@v;FW^)}>iN8xCpKk_s(im=5|+l11C=73-D5O$Y2H5-(cdeqaoLWzdPo z=|+qH!9U#s{L9oNG&j)`@Yf(KpdWe>qzx#9z}+V+-3Pmsws{cO89H@*{+ z^et3fan$ge&SqF2;Pz7G`p1E8SML4~MXG-#X8l|Ha#C4jVWas5-vSOmSY z!0pDK^>rqme`1rn#>^EL828skd+o0q=;B{LzP~Yte;oP$`vACq2;(j`IVQ zQd9d*z%VoW^l!V^7(HU6ZtJ)P{#D^n|7b7~$&U(r1jyvWr1ZUpjk@pVn?mzJ;dX$%ny2 z2z+!nxw~l*h$2iKsa%rb3nnP@HF&4F5EBY|-A?Rkx{jUEEk&#t@6TC5)$`xa-;ub5 zp;*tKf={Q3>zUB_;<5D=GnHEG0C5aV#1S302o-98Mcwv%3r;kF2M0pbjnA75l8*=r zU~Dtod2q&~)Zp6I$zMp~AgoD$uF*a`rf>V3hV4|S99NDsuyfH!(@&dh!YeEMtHfWD zPe%h?UKSFP8swpq%{%CMJ~_=6So2kYV4L13@qy=KU~uG&a}4~s?=SK8zAO%{0$8cJ z!DIyww_8~&cG^S)VSBCvlu{e(g||XwmeH{qC|Gq5*B~C^q62=BPVh|?Wn9pF_4Si2 zrow?OK#DL>JQpPjtE$;T22px9+<$U%$yr$g4WUo%m9?^c7s-R4{Ha3dR%;S16uQvt zj+-{@TeO0uUuHumzVaVA>9|x*^hAkO#G^&fh*7cmr?+1bb$Jmf8*K*JJi#M(Y?g2T zjMaBiu%gL!EB};8EwUdpr{Y~)B?=uX3* zNUJv{?yII@3o~5;P2t%x!vP~-UsnDBkl|O7K_Lsfq6Ogn#yZjM5od}7`r>irOzECM zRqV}$Q#qfL5R(S0gJpoez2gd%@@27?BILG_RClNcuft$u5z%w9_U76 zKq~<|#Jalt(KfA`+)gFAaufY%!ywAV{IDt{OJ&$|1Cb5L1fL^~nN`3_JKz+4A##Jc z#AHdkcinzEAAFXhMEOlh)SfH)9t#73n92&0RpB1YvTo7aP5jS0_y=!Pw0c3tDvsr) zw%EUtiU=;{?K3I=Y_6{3!%OomAAYi9>=*cu7GQ~?=|??` z-aPnCHP~T5)A_Rk&brd&wcIOW+`~Gd`l;nL#Pe|dm71dlpfJSQ>#$a#_5(Gfw~`zx zoml;B?I`903lO>FI(OdW@Fg3S&kWe)8jX!!67~39YG&%f0Fk;ax#T4PW|PB6J7Nx> z;_pLi!4CBgq7W zMuLC*84}4~$;ujN6_Z-PO5oC~3@&G3c0Xo2N00O+yTY8!c&{Q? zq=>FDdh6j-^rz*BO%s^X3UwCl5ef&#<+06)5JLDu*2tsfG?o>+44~^hRL06xY58_? zXQ|rwDNNfGQ;3FK>%!;W$IWn@lrvuWY4xJz=eMgaYF|WJeZ%%(`Zg<9eOq&gL9ZQ~ zKNa)VwUmG@jybn#;ORN1#9gWLyYWeONI(qP#d>(`7{jvbQ0@ycV)`sTrGsaD1KBd_ zTi3$W9dRWE0hqEsoHr>U!MG`v=x;3f?zy8ZBebQ2iUi!0&JP&_gbUKHRdF)-4Pt5D zVzm~xN@zrLRYBdqX&O|Jrq7_};S!I!yTCj2GQx43oWOE&Y{iMKA3@d(kmYsRyRofv zk$6NshtzyrHL91$qvrZ(=I()Zt~36rjEG#tgqnWAQ-%G2#al zvIn!7z^}&1aXCl&-xoGM$T}`|VX$Q_Qr@~$AcHH@PuK8ZOwD6OXrLA?FCASAM@80i zIj^zS%!TfCr{qNtaZ=HsovUVS`n__RUq{BK#*%DXirEt+2alK(7s?;S*)Q`+E;k;Zq&m#`aU z!9!8Xz-;qEj*qF5S3M{SKz|aG!AV-zQEnnD90i71V?exwBi8k8Mk^XCc$ooYy~D%| zAy5-bj)1C@>!0fb*`Fb@*?sR{iwkV~#@<1Keaq3)Wm9rrvwxiU{1tObP zuCQ{=z>#V-pQxOeI&Ae4pUXmglGiX#N@5Vz`w(`L&F>gq34KhRzSHPiH~+MsSv9lw zU>Lj2I^)G8m5>3+mJ3O|zeQS`ee${he4b6&{TZ^FbtQ3f96l~AU1-GaU`?#SN7yCX zZp(Fi!e+A06fSb5FPxnZIpf{d7~`MWTVwET;4{s{H(Ls3DM4lE8@&AkHMc$&BuTAg zh)qn~_QD38&+2c)&FI)7=t~*RAx%$d^daimTIHyT2QQw`zUtyv4XhQIkXTIDsFeb4 zNb-Xd4%X7kct^~QBTg17-WvoZFm?=Bk!swyu>pS9m^`M8khp+!n_B{p4>H}MviBN1mx zM)rmNU3#7jMwXi24$&{MB4Z~G6+)g+YQ;sX_gIe{v2m5{VERGE88416$=Uua0J|28 z!dMgss|mXwv^%>bj`z}$-}c}UiU^DP_hzoriw7i5&#RA*amTU(wCLo(ejZ5{=(|kk zy*9Q4;gE5o;o(aPteN4QEg6egRKZr;iUlz=@ty0gp&)WcoqibSqFb@JDMk%WlX!a4 zre@_Fxo!Ps4Ct_l^{u(R{(NiqBM%eu>V6rWtFY@8NbX4GYJ%*( zpF%w+!)d{*s@!S@Aonf8?P;6mz2Dt*z9VjJ)NTK6`0bC8#ZP~vj(@|^sVoNatZG{& ze-k2`pJ*JJD}I;BUfvX7g=eL0S2FjL&Z8PL4bRJ<;|=n;`@V zxI&S6M`FK8qJ7#rXKzK*^|}=G&6`H*z7HAtI(WY$upSni`75>^=^Jrgoi8oz)-FR< z!b{(#uS?tkrk__h*DLVghoxPyyeik7cyweY`&e(_b^b?T&>(H}tA!b_ByL~hWz)-| zz?e0ew{rLVVi|l=qV|5Y{k*nUmVLH3*vX{beWyg9IW9qq$EBjJ*iT|Jc023~@j(aT z*)uq&#QPzSaeALtzoUdO$8jSo%4QeY-$N`5wcQR?nc`oMu5Yq8e+Yc$aD6rMi6T+~ zZ<742`a`vA_${B5M|T1Q=wyMLhD#RYe5 z(`w#Ly<*)Pxyh2H5DHrQXq;b>sqsAp43D_tS=cr*qSLCDT2115&UwdSWuTy{CMsAj z6?1?x+?x`4&0h9>c0ySy+YiZh71_K5*8c zc)29%OW%)E_iOrR)|Zym^|E_BDVAIDkH)$Ro&+jn4rJtA?*#8XdYVo3G_*<8A@C_? zBC6Br;M|D!k;@-}FZQ;`It_xYS50rti#P`6T{9iEg+&pj_m%VTF|<#!u+`$5Wh<+U zZ~oxNeoo}AWUqA0evur9YDMpO4nZo3{-svgzx`&}E~o#h&vNZYrKZf$%dS1@=<$O* z#;S!%$6~znepA`g&7bSYTp4<3i|qB3wKe+CoE3$=ZCVaW}94 zLZZ+4)eFu;{8j^ccd)+o#9B?|62!S*i$e3R#%xlXCSv>0bdQ^(yDv&Hv0*yz{6|%|E@D*-WaJ z5~DlVN znRuD|JS1g*$IutD9%ftJJM8{IzwwLxVxk5E(e^iY7v@E0@^SC)u!xhTlQt=>Oj2Y# zBE<393l+pSak_PJStf=7j-aM_g@=MCdNZFt9`0TKP2DuKzIFV~SK*Uu>o)!l%H#Wc z+Wo0?QM70~UEO=4Z2a4-egq`%%|OKoy-A^A&j)i)<@o#c4W2X$C^u5{#e$TmD^;ea z6j%a+|@GL z;_*`=?B-r1QvWxduA@%y=_B)?Gt2&SJL&z0SJly9BgliYMqDlL&jeW03?CK*KZ01I z7+v2N-=caeEqXacab`eZ(;^nz6IEi7>3CD=ST*ZwT^OJHds~YfbbR^uH=N;>hYNf( zr_TcKD4U??%2!DLI3AXKt;^@2t4zA{`ONUlI)qEVy9CJw?NfQ6*YaCv-h;B+8+UfS ziuUo34GaB95G?UM-C%& z#Eso~YMtGAIbNKNdD?g(xHXDf<6&Egwc3Nm7hY($Hd5~*X;ZzS_u@`+CHnX8AXjo! zTd`?gOP0J|M*+Vj9BN&jkP9Zt+(<2n&zB0@NDR9q;KGT$%i z9fYmye(@!J;qm?ZP3cjd3w?c+bGy%TI^qJs)JC0vVOA#&-o31bOP?9KI0T zC@s!RA}c=-Oe->WUgpTuQGor;w4K$=q9HKFH;{ATXnx z?7MSP#!IvLs`ppyZ!#N})*GcgWmpKfu# z=lUpi4{!SPwLk8y^VIAe(QkgvnWQhd@JZI=4atN*NK4*)d~@O!aiidIUk&#pZGtr6 zu%mZ-C1viY7|JL=Fm$Ge8{Q0@&F&uXxXO;x0=QxEHG*7E|5SHe%cZPTC3;n|><;j} zkbaYBltv}32BRSzEu%1<5alk6id$>38f?VU5z_=vcxM>|#m15G=g8lH@5KXfjLN*$ zn{o;}v41QK?F8M9YENs5QcN|1%6{C)K&%me7MP}&|9aW6I-UK&gfIBPDH~PvlGE?$ zu_YtbU+}2r*R|e1A0cC4syjRx6T)7dV?)v4O@m@P9;LqirYpQX*XJ~LZ zjxabIBxMi+BvGS7nyQbka=u2rBakL0dVLuRNnN;oX z3}18&8kLF*2n7w(Ad7`s9^~j2FL$CGPB$Y|G#1C*b&t{t`d}?noo(+Kqo#XBj(>@i z*QS$sE#zwB6WH2VZ8=BYUj+Ik`fYgGB|7E$gBr${y!4P>y<()c#FbdN%<6%@LlYFn zpC6rYk+POBZRU??`GYH8W+n5X?%oScKN2FahoNM%j_Oe*+T~tTzy14jM7~v$(ek1Q z`OTW79-VT=>koNc$JkU5g)0ef3`!tEZp6_zDU>0v4*a|d;Y{kd?k1MuN5JBA@?VT) zo*yFmM&oL9*Q=lxj7gHVg{XPg$q+t1PF`>-^ft5Q0fG?HuMcYPWM|7-x}{Prh`5$| zF;0^Xy{_(vU%~?RMHdj&+V>2~M{1TagDm-7D{)NF*-#uj&0)OT2^l-8n2CB;Pu} zIv!O^ugBkr{Zh!IN`%m>dFwN%M-+;VKAqWHcNMaSQCC+nEpo^=hD`9T*>y&HvhL=a zeq!cQLNHck3bd;-NSrU*8SGLb(}+{1Bn*dWcC& zGO9PA!k3xH8RE`(pEVVZ(9*x!OvC7zOm;!r6~Fm%+4qg>FtjNI| z`V?6!Inh=5XbMi&x|^4>UQZAD@@90mk zZ=zDqH{N=%Pshs@3ej)o9;(vlJcSJ0#&^H?yhSaRC<5wZqp;nsDC zhKgS0fI7f{F>rbfw6ZjATJkP+If$ zP~;;-oM``ZaUfHTUAz<$vYdU>EbADac^>tCWByVLuT&|_8FnO9OnV{%&p3iO2ijfo zXKPj1K7$C6A!(yo))7S=+*(EE&cU}3+7K?0NTyIpVA5Ce#tKyGsKbw79Q}=EqDe5Y zLrYxLdK9?m9Yhs_BoR}knk}=+0RxFq{672S6DHz;Pqj06GwYMjS_%|+x^gi+3-bq8 z+PlkR>~%6`xs67D<$I6h#S+xPvS1=1l&r#x`dg(u$CUyUkZdTU-yP8K&B=VWYp6@_ zC>isR+p|hEcAeDFiyJf5SXVIX1u46e8(UnjJqZB7q>k$AGr!eKs4pL}81}}ep zDcpHPAGQp~B7a4?7{5-4d8(=+!P^&+_#l9Yufnohy~*Gbb9W*n=Eo>Idb;}|yEJ~_ zDxrc%d53TI{O(gM#NE=DW##wH#;2k#z*eAHl2Xqni#BKkoFY=iLU9G0+^&T4I584| zRBLs5f1vhI_o!6D3nQdslM${a5)o-ctL}VzhQ$22q)kMSRlpc~BmIU|a1Xp4W^0?} zu5~=z0YLN9VXWSRV{TXY-mMEJ2TOb{!9Tw^4r-D-;`PYI^U#(wKlu}KpX6^D%_icR3V>eMo>l#j{XQL)8rX+8z39K(Kg-ZzqiRT<@=NZz@?qb!> zvyg^)5qy*#e)-GPlRxC}T35Jk;^?v)QOWO@-w0mK`C5=p(Tp*J@+EVWrZS$Xj^yCW3>tZ^ZH1R z125v=^Ba@RAy0&aWQs&{=1c5Nw;qwuD}uX68p>Cwk}-W|r2XbML1vq4&r?DEFCi~1 z?Lp$Ly`4AhI6J^)o{=1(TI}qK4gayK z-{n`mruC3`MyvL=ww_UIsAVfcGikCi_feDS%Z=Ad5&88L`lhq%?Qc)9ozY_4YU-1c zRf>c{Dzhv4P%O6BVcA~8$;@>xMBP3_OG+DCHQi>+vL1wQPz$e(NzdSV#W9=CW_PxS{;PjadksB2$pj^Mu0R0%({SR+sSlBsM5<=E$-+Vow&81~= zOMGSsN$|k%;h@}p?%b;k zxaRk24CX;K`GX9OQbv@x93nuFVdBgw%M;6gr$e}m&|b>vWAcys*v&Q(Dg1&`J`$)W zQ`HjQDCwPdJ_T8adaE?9r@Vm^HcVk-RdnNjONe^#0|B|G<$G35JU#8OUrZFRYVZKw zpDq1ff9eRLi-^AR&~AK)sOw@S``l* z7~4*QrU^$Tjdt*V-k%OnBLyNFR~hsUIvw%0`Ozq0x%I>P2;hM-7q`c{$o7^q5=DoZ^`FxPXTF`TRE~h%MuK(UVyK zRh1nbFP!krs-BsH>`&jDX#|TWBo76k0*z>Cl5T#UyLDu&JT0QI`^^Ozo-rf(W*fki z#S8h%{yVGMt9T~MLY>{UqRH<-n!DsOPh@`}OJV7HN&#G2REsMo`pI0=2P;APu7v9Pj-WAf8^rra0*mG--%N@A_Njzbl;}=<9AUbt9xPI)5lUkb_SWJPMkZh_?Z{EC9lntmmVp}&xzzgk?j{I z5%R?`9{te*xdGj-VdWWYttQkh^oxxh?KB()FVx4$j1LziO*_rT8R5Xd`BmjSGNrhr z>78HC4_A;El}EP8EyU(iPZQAIb}Vx}y)Z z*w7v64jAp0?+iY%E1}AehBuPhBK06r%ebNFf=o&g@!LI08Yhi8@jPRv5UbhKCEzaEbxSUw7Hf60Kog3j9&DSy-ev93!r%hlF%v1Tn!0u}u z3>*H!;lTsrhCA7tb>tI_x%pOb*an3kD!>~?s&5Z>6*wZ@#F;)YLEKd@cI5}~4p0_G zZ${l5CX9fYRwl?fnyE1w)G;TxMSd6E4-NH?%lFJ-xHIB(sxFDY{V6}7x+6fOE2y5n zc(~0*6D;x?)I{1`B;JK7F5Qh%_-g4>a~Lzbz1*1iEVxi}LKtQdpXlb}sFcC+7#Xnp z7D}T-)I&H#tfewQc0O#vcssV&9R}mbcm3leJKo;5G{RcX{Ny}C6ik{vyPuL{Zegdx zyiMqYAIYQ{e`8Sbws{5Ok-cB{Ve9KZHJ2Rv8;xIx%N~2)f$tV;$t}AdPtM`8&Bk8S z=df)2rEK1w!7KOY@oWx<&Umfu+;6`I8~?%6eCiroXSiH$;z*n@TAZ5&x_MdcfiB-B zb)knNd(FgFi-7lwOkV%UbadUqo(h`%Ii;BZw)t{g6{iXxZfL9r{HYu`vSTlDQTH7e zbV3*Q(+fHh&zzFW9Bi`z!U?07>`_h>Zm+%bs5@Od!gIjE1W}um^_oyF-0wK_`X4U# zVxMO=PU$>u_y~17ba6e8gV2E0sM2A;<{w-28?9;se(fLaztc%>4%?SD@yoqLJ^w*$#Y5pn=Kwj&PMh6cgp-pCwy72 zTZaSLOG3-rF8~T8z(EMUzX3H&83xazAUj+%IK=Rmgml9K>ZfQb<8|3aAqQ^LTOQn> z4*dniw`_|{VM1y#(APihkqH~Wg`r{YDeFJx?5xy9&({C)u_}vE<|N%T#uYw0K)*eg zy9__T%=9G{rJ9h$WJO&@(6VMcsu3vV8P=+Z#*&d_u=9wwh8+Dx+AyqDvdJMRf?&@M z2|v_il!ZOz_7v%sgQw_XFBJdTS3=O${Cdt+U7U4(bCjM1ar+Nv@~+}bMI@0Y z;2*%EA9W9mHjB<;yFBD4%SP=51y%VF_s?R6?g1E={l4D@iT-NOc7cyA=WtDSD>PY> zHBDuATPF_WDSOrr%*|B)H5;_^;;9Id83I*V3vt$Oe6OIGCR658q8 zVY2=)^BLaI=&=4WL41cn`xdmiXp~5T|RDw4q|4`Pya|`^U1u67rGI@#vMEGs$!IfTL^{`up4lr z>7#BwXtf)|&gh^FG>Cu!!jWpQCZoXqdPhTr&;~o<9vyjhu7i7%)whLwGm~TQmJ{te zL?v#$E>Eh}F}e7{UR{Nnh(~yyn^!n9-I?85-0TqAwVr*8fr%ka|hyklyxZ2Hpf#U%Vljl2+8Z1nrprv&TW)1G+8YqQxlMWz8G?Z+Js z&(C*Ato*rFc8wMXu*xPEi_Nv6j_~rK=Rej;PV-Q@OUC6^VtSy9fVDHavj)SWj~fW) zprq4$eI22GGg54<3vhWSZD%}fB7Dipe)vm%H2^!Jcq{xsle|wmr z-ScQSMu#$!J5ldil*g&pqSt0mjZ3C`om7V=qmnjKHb8 z4&}^}?Xo&k@GI5H?u0PjOnXr!F8J_BlVnc`L^nDhi3*+? zU*m5!*ESKsRDrEILC%&Y`L2iB+Hq~~B00Rvph@mp@$jI|ll9a3bQLek=k<%P3lS$a zYRZ$-YK`^u=+}Mg|InbzlwY0q-hY%FZHh_xGq1f?&aNt}>p5`d09~3&{OGuP)tcvFY9#Q6NbxRQ$m70#ei*Fx<0wI^ z1tBx0&7l68H|!UAHEI}9Szg9t1QLWF_T%n<#Kg8s(NIfiNx`8>s)afEGTvcg8ICAj z1AH~wp@7b@!_z>jh~%v(x7Wz;w$#kX4G$7M6eH3<+Js(WJ!NgV-~7u7<}>cT-`PX8 z$Yiw{`*bs(c_M%_b8;4>G=%eYJrBg--`?EZa2Xf$FAt{@k^#^#e!?Z-J3Qg{{eUB6 zt=-X*=9Ky?h$hR&L3jvXO}wdV@T^&gw--ByDSWy(bX~1p6w=TWE zq-RXIVa8wx&SDYM%@PEV`zngf7~M3_t^HW~Iy31(Emja+Q%#q%=JFmir&sQ3f>9=w z#X8Of?UwPV=?#|THAOl{=oaaYLi3r>AdD#V(+x)QDbB|2RtA1=hIFFnVko@R zu}d6nv98%>Qc#b$cNXVqv`{U!JqCQN{cUzLB0d3iO+;tMBuAaDPwdx9)MUOVavd)- zFda|^nBQv=2c0Z#fhGuz7SV^p*J1aQxKRMWJ<~KE@LE}-ak1#Z9gaYQL|EmCzVO6D zWaq`Ec+a&_Za{HtK0tiwF}wQ8Bsu}7DRB7F4E@&LZEc3jb{Zcw+Dir>L9IMv9lrC< z-(0ph6pgp4x%U}+_v@F^0-yT#G=5=y2diK9dD5&iLw3W>sQdaiNKb8@vr6$+az7yK zTwo~WXG`RG|1Lmz3eCHE5&;g6A|7ndU&>U(%#wEIupQ%JKv`y`nyV{K*G~qb;gZ1+2(F=rXVQ3>0h6l;h*Ne@^3<_!;M)V}W(mo05o$j!HHWPIs#sbB~l8ebF z!`Sv<0QEx7mj_=<`)Atglhk4E0S7#EbQS$XvYV9W`6hj#Z4GhsYDQT(8BFXvHbc3Hj`iCO&XV2Ja$l02as`LAase;^ zHuMzRBNRaCVR+7}FH)+MvR|d)d=E{H1}x3i^0wTsePbQL1!)MZpNG*~178!q1z)c> z(v$eFe_)&lxG(i2BNn3V37OyJyatz~0BVlTmT6xXLYxS%Vyb^4iH(GijZjv2y1c~^ z1ooeuF&%@%vKAzMHF4=Iq~tjdgk4!ysJFkBh0?Pf_Mi794rVXQmjqf7GJm41T*_s5bsFK?wgx^TGighaK(*s1hK!N0hehQ#yHNWsJNt=MbrN5Y59%Db-WcmpQJ zlm3OuX(gMqHOSj&>>IRc8;!#2%ZIC(W@r2a6^cM2!b=}&b zhZH041fv6C*mkc%x2zwP;;C-d8c(MTUhn8dfS-j+I3y!cv3H18VkxeY*3mDo+qE$E z0)63eDf9)Mu&xM2hOY}*!u&YBqaUriwk4sCq?kXMpi%?tdaxyzdgBDm1O^~dXdGZ0 z1Ap}FAI?oIJy+dGcythWPQB4m`%mG(5-p~~@LnNZ-52yq4dAWMl0tC!bXRP0RYWLt z|7ppuNFpLxnPgqpU4*{M+@bh~bzs-V(`)%j8-DLUAYV`Tx@BH5bIRlTIqGemXH+l& z;XgvRiyIdJL4#@V`fMav@%)R}36X1)oycdK<=)2n@T-6V9~zltYk9{8scu7{#`Ubq z!0$@m%Og97wN{6}9LgD?M#_!l%1y_%nC#A4{58J;`+Qz=QlL!T>BD^ufRSh5XcAk0 zwcLi{R3I@MoKvayP=mhQ?{uH;ZsJQSD4?nKFbfT0{7wlZAmDF|?q{&pSgR(bQpkdu z3k1;{WRI-I=z?=}D_mDHZJmYRN0(9W`YBrr2SYmHMNji6DQ(r$?qiVrr7JP&+|oEH zedEfSI?=8xfOlncnV`!R0kZuU*1KJiUBD_Pdb>72xOw<=o5ZDL?j+0>_7+x&iM>ZQ62RaLMFHoi0p&n36+>UPSCMqUVFVDzib}1N{zz-Be=v~h7 ztk;u$dC4XncM)K)Agunmj%b4<6$cI2o9pY;HxKDs4bV+_#2!Ri^_r(XxFYLUwzm?m z4J!=y`N;rNZwPS4Q&Be2tM+lRjvTqPUKc)|a#k$JKvNZN?}?eQN)%Bw>-}>ylx#l> zZ_JXu`Z>ZrN=D>6nvkw#jQM;$gwwoJ1n4XIJ_YMxo1}Evb7}fq3DdNcW;0oSJa(tM z4|bCIGR%-=TeXkPKGvoa@KeVd+2G~n7D&4Ki5GW{*bbIxPMtd2b8SyteClWJtmkvebPf%W7=89BYYcw~zWnKr> z@G6m(ixZ|ldZGrjr@mQc>W7BLDzj$xD&y0LjUF)_NK{l*wC%YNo%jvc9cyZfx4K}y z>h?~(pvi)lvw1(3VsXtFJM)T8jYCe>H&=ABGykX_&Fh(q>*2XtOF|3Y^4AUtx%6ZNPP46k9|CjE#ula< zhUytr8k>+FtGt;x-|QeYt}AaoK6JT+MUq)57%>!k>H9u$Vswip2=`FS3ak z0`uV0g%O8Gm0$YDPv3O;XEfCOXuT(&C{v7dsURt!$t#kr5(K>`iItLgdZ{_@cUhvz zZYI8(N(kLr!(xH4oKX)cSDV;qY|nFaRaeaW*+ivYm##r|wptpW-#)_|7lUY8$GzfB zWf`=csSv3zZ@;c)tWzxhG}Q{faIbVIFo*EP41zyO4%J_7VCVd_)Jy+`zU*fMXN_wA z40n5>SZ)j3hh-iq&6n>wF0aULE~qSS=BJu5Pjv|WHhz{7!w%h~54j1V8aH96n{}zXw zI8=n_RSC-<%+2)itk#=cUU$56-wwvD;p^8kLSv?R4pd#p$L8lN)eg?bmQ;vj zr;RlBOD`kT*B%9cOCWW99Y!<1x5G-&5w5-^jv;?I|*4}`cA2cp*ktb zNDJG@Fk_7>osaFNo3D@C7>=}uT{f;;#1#^mRmRz<8|$iSsV6n#+vw;}jemJu&dIdU zi*9R)`P-wVgj#9)AAuDe?@mV>4L!u_+EjF?82pnt>i zi)W?I&kp`p zL(9r~{1J~i#m5U7sC~97eG{XU9uOI;{r=iH#X#Z}Hx+5r($tZ~*7VOwUPaI8NjA5M zgwf;_!)xuePrrl<8&2CASOC>ajcyvN!?6}sa#QnASZGnEMIBPUzYCePYN zOwWYmV)kd#PF>Pf;tvze-jbwu9c_OS0~}ldnY?_z6)bOZ3hT%5%)UrezjV4 zs)^g-37i!>yW%TycWkuy@#+DES9_8lML?&#$lc~VLaZeOT3}ASWYq%(-Ih#9LJn`S5Ks!6^W9;DRtMv%0A(g?w1WZ7piIKNEaT2pXuohHH63 zfttd_ceXL5iZ+5jE#F^S`pHSmw5m~B>`2luOt08>(!;b1pcF6YDL(A+!;R)1y>mZF zM;a}=IBvAmM@JD(4MM7aX?*uAbc2D@TGBn@&1(F~XN0c3_tgT>nE3YcJFYPK)7bPv-yOWml9KtaewFus#nPIhZmQkhHn zc*w!~?wDF>4^wXZ#UB$1;rr!(`uq1wSkt6A0yL?aD6ZZsdMvc#X) z(D$p;n@L{?`u~_!L03AB?CMNxU@HCT(})(Dmu?A#@Sd<65&=^uU6HuLn(rRrQyKnQ zugwx^OtqA8LFmz&&ud*2Qe~J)WZ=&kSE#q=@2ZI9r9Ev4b}%PX9uZ=p8jt#i%$0S! zWzBwQdQc^PX1!n2WA<8)$d!a$W%ThF{}g1<>FhPY>VCM{V143mM3L|ZvgDr8TGmiL zL-Ip(>_h2395Ckmnp3;E>oQS(l>jp_VbuOlsLgTkE(Kdfb2uu}c-!}kuZ8=2 zE2V<=Hqo8!#m|a5MZ;p>%-oD`T&dK!rtC_NJ|`ZgQ%G@Foeq!<;Cp39{w-|FYn!%+ z%g@q9aA`b+-TF%nG5?{4jRk}L)pIrVf76Zv#IPrh;|(fGc$^v@$)B2iI9v&k3oLS% zN%G;c+S9veb=-ud!3w5m8T=zrtD%1tfz|4ALc#gwvE3$0yw^2I2=DNq_2=^wf-q4b zCXki&*^jQ>M7MsI)u?W1rtI#n7^$>5tVyA|YEj<&6Vk_D#UjMU+-IB+NVi5{%0*&N z{fRx#>_r?8b% z2ORo#Xk}JMDE9N##Q<5NSb8+9cTS8TjZ~F*UMuTyBa$`95wXGSXKaD2oWOBz zFmx`Q%?uTj(=mOJ8<<1(&1#GhkS9C$6~CLlM5>68XUB9N?|g>=&Rqly!LD$KJ=WZm0Sp+Uk&pE zaWwrY`)#`P!rYf`G7p^5*cxQL@|J=TAJSW>7&!5ZPzMs(rhsRly7TH=-OG7bj@m7d zR)uc$2C%U2;V=5FTC6WU&5caX@dr*$U!wLCO9=y44ZE)q-!yr5p;(wkh~wYpy9d7@ zeHM$CaHgphGpjDH*$bv}A1QajL`28k9?R7Fwp7J46zTJ+Dns8Ji&!VO`c-ZJL}O;b-~6zES<`rbhsO*P2Ei8~ zL-{N@kodaAwdS(@Y!!8Ik8UKnNzNn}l^ZWIe?%_UNhWd}!a{JJhU|wEgUW@QFZ^Rt zL?3mW?=C8uaAuchCs5tNv0JVGp9l;aTDF>fF?eS3P0vV8#n(f9(A9>iBcRK`Bv)$S zA0}OSh~g8-<*0*r$TNiLiaQ&ZWpthdt3Oz(&MLA|^WcfWfgtyKKPho54KUozB}yoX zVQF`Uzp{daPx>Wnfig@#}pixY&iBDo5wIlq_n~8*n zRIPdprkQ5Hkm@}aGiR}!}mIz9b?l2hQ+rWnBBdT zFQOPAKd-Nr5R}Nm)I;wA^c3vI0ZeeNvB1CNubi}$t&GV_bmIoU>IZUN1v~1Nv4ei4 z2++BE5x0h`Xf*@*y_R?U$!w>nh~p-|MN^oO9%_V+R%i91Uf2zwmolmU_O&*KrnNXH z&5TKWsBBDb)`ADzwIRz@`s27uiJ4Ko2mncn^#K~ss@-J6X{?81SeL67k5^nK0;R*n zO#%x#Rmx&^f#x`SyDmT)W={{_g|Tm8O*D@5A_y}M;Wk->z~~_Q`|=I?(u-?1hcuL0 zs%r~xOzmjRnQ7IwKWpXch5DyJ)`%XRD-DG5PS=zw^lIN)P!G|oYAyS$DU4+-EFN~Z zHkO`TEqCwkU)DIBv9i*_ISuiums3)9rV@5(TOtqC+f9ZR*ZzoDW^;e4G(Q~hgoE7a z!||5STB!xxj>kQE>$d$iRB!K{MQ0yHP?`^^o|c`UyDt0Xd)`@&95)1j*Zk`#l{f7G(MRI3rSs%T&*T->!GYHIy>s1@osYY<#Lg}%)$VLsTY!QldnJOre1Um&w!ZIeciPd z-Ph+0;8moNhncohgOgK#XR253Z#q#~Uv}fJ$lh>y9((0_D_Z{S;0Aq_$4fx9$$X3) zbT2Yr_nXSrM0!bifaBM5ozTa6Rj>Ed*$r;%(+2Nu@IGytk7$4JThScSWtj#wI_}5?p{d z(QT}kCCQ!R1~db&0`q$}+MC-6+rZbD#xW5#5GvRgZtLDEC!L0tVm{`GyD{Dl^zy#G ztBw13<54P-_Z~D@zL{yG-Sbj6_dZjVk_0Fq9%Vtz4->>|K{oBmq{`)z3(DbP;2oik zy9N3InG^C_KtSxnBDwcYr_4qgoQ37~l@=)Wq(MqxACURJT5ugzo3$^_WJCzH=dgk<0LEz_@fH# z>s#l(lAO?Kae4~NEzoph7+BVlisA$pp~1=nKe#Q)d=X-BC0B9OVjEr+C}`-Sbz7(< z_4~+Ysf7vupn9z*%8OZ?p>oo#{L=IBV~H|ZXx^r;E!-&s_#68YU?=7{vR0_<&MEj` zc8vQWfmA>})OI(!uV7o>;X>$`*e%GkrMnz+1*dR#FW6XbY&3cDTayn-?_6zFGsG@q zUQv%uFdXy}vNe6QJ6&8E*U~sIMB5n~y`}-nx?TI>(tNSu*oP+x=m%DZcwBUHT_pao z@iJ~P19-@2J4%K|Bo|&pSRgE-Q?MOfp(y~C2Omj053!oglgr*Y4-X7Z8i_5Iw>WQO zOvuMvZ2gEsMc6LQ**5p^riuOon+gB4(>uXEV)E@FZ}xjF-h4BxwI74%@_a-K<-6Hn z*L8$Gr&BD!yW9NBQ|sR%=zpsLH0r%O99a0FZ(<8Ya27rBvfZ+j_4k};7N==O*yeJe z7t10-eP|lm#I&?M_^6z%a=5%r!pZW4&3}gdYtxoyh!8eZFp{p9=YB`KfgmRVuVP+1~QRw{_&} zLpaM$>y^I!UGhzf8tq*aXY`Ha)a)!<$2S6361v!`hMq@^t;cx0HIda?YEO-EXKK~=MWloF?& zT{Hr8q$s(fd6=OY&eiPt?L?cd-b`QpubYIEys|6@MQ);EazJD>9-#-VU|!N%Qx_*Li^e?Jts zOET=#8_)KO_0b}y=;2rT=0Ol7Upm+9W#nR$5CUC5J%9To@B8{n#^P+{gt<6Ul_%lb zaec8LS}YiDRvaDhB@vWUAy{ts-1$N<=}_1z^DN3Y+%Ce2E;OoaI6mEUU@yp7LAbKf z5^}OAKZhi_KZ!kbU&ry>8o=gKeOaNI5aKer+1IvIUs6JAr4u#pNkyd{27c7<=obEc z>LfRLcfEn_qj=oBo~FVpm(Wjrl56>4wOs4|dLchrjzehjIz)MqB0 zI+LU?k|rd-zV!?Ky5n8>_pfA#RcVyaK)QXA3EwXELy|@XwAWVe08NlcNJK?JqhWG# zOY6UbYqt9aHM=y0+XHJ&Z#5^X5&OLJfc~19j?1R7#-zE|hxK@SIR$(Typ*d!U0YfB ze81R+?1_~AT^8aq)%Z<50pyDBaWH>8r7y(#^|n6+3`%$B+cU!4-tts)$60B7#(v?p zNFY5Nc<1h8%#)&Pa+7F}J-&L|6ZSzAZ&A5Ic9|;y^fQ#aG~%?~=vO~x!kLFF9FZb( z2^G<^NMw$5Xm61#K6LXOHaHn+1de%z*K)S;$u~f<X|~GQ|KjL%-$qtt0h%@7oaCqlHtn^9xCq>m5C)NM z3fs4MATL(^a8U)mM1#Gz9v(TguA93J@0Uo-*A=q#-Z2PbqUSz=507WwRi2*&AxI-h zYMN-yP1~qZ^bCs>>prMe0LV8?c+d))+YbWsr@I&NLf`u6XxjX>!o#db$jV_Tgck z5n-X|{5NgxE8C^Qzc~(7QgQz0Db2dgZ@jO6)9i2qvTWup{{Gn+(OLStAj%8eP3TJL zEY#%vM=L2c+DiS8&VTt#V}#EN|1U@WXQ$-1@m8v@*|SlT6l|2U?jHm%7y7?<^WPhn zA`*0H|4mbgAMAk+%fD${+W&t#WnEoQPw)T!!z302BpWo=ng$GLL_Yd0s1`f z|H~r)eKhH1YqW67OFdF+eW?G%#Qd*e_BF$E|F?+Bqdv)+fxdvZV5sy<@!kg^uloc) zZuKklo4F(h;Rq2GT{qs+zWNhJi3roB4b>nNb?U!{Wx6skF_G%k85#ja zo2_*?=w~VYcR(ZOYdbNlEp{RDw|eEJn|Ctlq!|L!aDUt4o*!o17|D0j^?*ep*#iEM{l zb31GTCD3#t)Q-lb4!u-mJM1^iDg5LR$N}Y(FA@17k-t*sCdS0BINKj@N)6(w`Fu1q zeqxe5^_KdOVV&ikg$?Y$;pl+m_)Pv<9J!m=wu?6?*<-;?Em(_o^zoHC%lS@r%8|am zV57N5IK{cDG^wyx^Dn+cEF<@wK6RmWZXVvQQl8Zxf#<`W-DbLz^kL8lD2Y=Q#qXQm zS4`RuB~X3Ya%EUx`zF-aYz7-L%F10SEQe}jGhnMn%m#1*l=W|x@PCF(%z=2aY%>!w zRUS95){pJ}>up2b3qz}iNbkojl^GVL@VO zkVg36#l+B*0!69YI07}ohOka#Pnl0F`JKN*+PCBDWQ&340*d4LPv2hVhR=Uh)cv^@{?W68pTEt_ zqPzASnRF1v|FwW3i2p&-0;X@StI30__i^{OVfuYs@^)m6km*4OSH(bELz!p2>P5nN zmG7(1!cg&Q!)L(USlP2r<+-@i-MORGLB0R{xGEMd$?!(ChS7Y?&_klbVqB*gHn~QH z!)TfH@r2oq$2udPop(~*Z(QC6DdbZc#QAt`4?dp}KA zvBC*qM#JT!y7X4KSZ#sV&BvZ`-s{CjmCztr_9RuqqBS*R<%%c%mfKp^_EBIr7&C|* zPNohkmEv`$uoiD{uQ2jhWt0%2NP0@VeXkru942{a*#9CQcUeXVN=|Rvgu!{phV20A z2bL6Wlz4K=_#aH${TM1QujN0PJbpfYGTFZ}A9GaqWl+=(*H&hhaxS`VXJd|$Bt70m zLn>*=KHk9nJsN7XRQ@{;JK!+j{bM?BM*RYOpU(zLZE5aO96J1kj%%UAUCE`j8vR1( zFezbU1$9|hekhY1h+YEkCuf*)enzoOk&%WL9EX?i8AY_I934ZVDZOw|~!TMXAqHD~8YO+l@&HQl0Z| zYs%rOft~4@k67eJsUpY)`czClPPs#kZK6HOM_)=AJ!rtog(^x)JG1>`HXSOxK7P#Z8O%lmWnL&r3C zsq;LiGbch&?(H4A(;-XWNI8^2Tn?_^mY&?AjsCky&s#nC6LsQJewp#}Ckzk>Y-wpB z<>p@4u^d4IE_^VRXnd0Guoenap+ZiVS|k#YlQcKkR> zC1fF5p6^dYW^x)v4IhQh-$}bT#+P1JX!HgzowwSiE}^A|S)aK)F*A5+Mt;Z$5j}f* zHeI-A5V=OAdcvvk?JdyF&t{_S-5+~{}I(rdQ9}{arD?}b*cX; zS2l%xDVLnlpo@8SE24ABvjMGe$3Rz_MG%sZTo>blztrx-5)G=5EWK4T*0)}5H|k zU=zaY8o2H0h`0kuN6u`(W6)?_&ca8XK5)y0;B$=1B2 z+#f;=pY$fecGMz`Qyvo^hFQDp>W=E}<1cJLejWzBBNN^{(1$U=$cMIRu|f${$_)jMJ%$dkKOfyuN9yGV2;<6DW*gOx#@S$Y9mancw_{> zxwy;vK|-hs*vy^skzko2(F-p7pz9_lqEPntlAX1OhE#O@Gg*TbXJ3^KaNpA1+6H}m z;!O!s%{CltcPUS|YBvQaU-QvX`@Rdk=zk8u^Avi+3Bk{8uitF554?+}=ZX;ePe-uO zeg?83!%<0q9#T5jL}t@gI?yC{Ngz|6tGohXJyVGk2c*%koO@F#Sm5Dhc2uG$WrLNF zyO68Z#0bzfx_A+>7|n{>r)QX2?saY|t9wkXG2?0(#f0oD z0}9n=-qm#*m1-*XS30VC+ftNj&1-J@X12FM`81M76zXa^l>YC|=Vy>`=Zgh;-Fe^^V zsoLDq25%JNG4qGI^DlN4djWYnw7&DfN0Zx%7$xA%Y4e9V+Xpy4CD5@5L^i0t^*zQh zjC}}T5sK)^C$G)|C75CQ{e^>9z9|3Cc_ri5$meVTx`d*NWTlxoRt4I6{?Yjb~g#2HK`cZsjH) zL%k-{G}l`7y+dUW4#TUANTMQpib0Y+&zr$`r9YH z#i~c(J2A>oZN7mg$<+)Y^3MDyYAj%BiEN`gb~4=N&hEC_%Vv=8%KaS?ST50eJgZqF z(2uzsAAi&BxZvI?qed6LhrRkPOjV;@lB9x$IsS$9M$w)uGWdnOu^Parnygk`*J7(B z?ZtYsG`l(fN1C&-HK3rX*XrAKPAXs4GVTYTTIAHo^dMD!)ApeXnF}4_&ny0@^xr@f ztgp&qgZ=RyzonL(zP7aWTCM*`GUG)_TpGq|i$$RCR~g)uuBh(1x81JfSVZsI2LGMs z@V~9_6KPp;KY<}Q8n4$=^32GB#DQsf{mblzz)sKkcR4?ezLxA-!obmeLX0*g6)Ft0 z#HSt@o6h+O@D?_T^dR6zg$c*$k0Xr3Wo~d#1rb*L+>5!x`luec`t#T8spX8hygvxh z@6Jo9`4t-CLG$sP97bgRk#>|6sfzxUVM0J=r<$s&a_xxe+ft$~R<{1`jaD?yY!Lke zkYNPb`6vuP{gNe?9syU!HGk1oo~HCw;{+aKHx8V$fKQ*2(hB22#zp_p7QL1r zNebKo8et8xnsle~<@%2USSj5y)8^0ka>@Rv?E!veL>#M4KC<*2Q<#$Kc{u#i2y`2L zvni=T6=$!iF7KKEmN)55vAb@3zi$dgWBSu`nnrl|o$F6uy1#WCz_Ewmr7F*hUH!T> zD(BhtW=|P+Of{tnZfUBQ+=rO`?Km;+HRg6K#sJll@dkw2R!p=XAD585(_vuhBmG2W zPG`-BCP8lDbMz@%i3_$|MmP{hq1IWPoYpi(F)!#GR9f@ua-P(L$vUF?Xmr~ZfcWcC zghZy<_2BIt9+izF6>@Ku;he43!)x^2o*QsJ*voM{^{`VnR?dv-E+6-|ZUk&q-ib5* zkj5wc&PUT=V`)BFi&(DgIYyk*#qgf*FBiq9Fn(LAuJ@@7S&k?>XMNnBm)mWGDz94D zPq(}mDVR^Q_qT_?qN()^PITARPKrsHFIo6H)CJlmy%Vwf@(3@j>U6wG09HNr6wFWb z&fXTOc=GsHN0}uXTsoS}2}k>3e-4k16^8XLq=c`#UEgp~aE?AX#juhb2_QpM^8enN zY7cRp-5(DMAOTyl7dJP|82mC(jj=UgP+lFAdJ=9K=cB7wswE{o41mRsyrk|(M8N%I zZnVQIUE{fe&8@gyT42qcJWDj9qQ)#4&D#3giZ7;W*&rAO{+bP6⪪>-NPBFC5n+ zzH1;q?v7)5q9`!jIyI7XrZ@+Qjx9#06r?|J{DO5IdRfZfCilZ|yU}UPMQjl1R5OVy z3%ohXN22*Y^4xB!oOYruqC1>nL{F6StJwLv!PLnUZT^Ut&fLLr`KSKxcnry&pGauL7rVWNVG^P zW*OeA558kYEt#SErXy}6@(W5PMYFWU5?(n0=eV8O#kV(EF*ACDolo$}xtMuSOJq=p z`?S05MZM8}kN3rRgbTfumS#b#If4og3q2p5Rc`eTOpPt%wcWxiTH4g)+IEI`yn6{HYfp_=sAfrK$eyh=w*j+P(Dh_CSeayRx`7h<13! zb@qiD&fSO~v@EWF!**;xk>Q{pY`iZ5*lzWr!YWdl3)`YF@U_Z&F<$cF>$}0eN-+E4 z*sx2q8FTz?0)K?ByEc)pQvroL+#`4J6Fj%#|7}oDn-(uB^7he-+9h)jr z-Mr$csQ<(a?#7#%M}DDw?6Xs+-OM z!?8JM-#@kbV3>+bJcN2Bd2Rc*L`*t-M|1T=0p80g6|>C+<_*R3M5dMwds1R8aVF2V z?)+NDxa}tIPio%x#rp5V7b5>Z%{13#81B2DE;k-dL#jj$3tL(qk`lU<*OQSNewLp` z2B5{vm+}*Hli$bTFS~r<4hq!C+ORt)1X#r=AsagvGJg^#Hv{D4glQ08S+3y&2mmg1 zRmZxFSh{4P%)OoSc6mlOEnnP-P1uN2;&A}BrjKSbamB7gXn5^G7!atzo_@q)>s`g4 zHmSIHCZhVAnrJ!=&0Y->raA#jGnCDDjMNe9i6zt*D)i?WrW@%rCskMITT+ z-QZaJWGaS(YzvO)W)FTPdc#WI_84?8%4312q)dUWvo-{ftpDIEnDWai=ZA$E=!#LV zKs9|p*_0TVMn#%K>eYPS&YxUfoUNF_l+9pTyx;BCRUlx}Zfbo@epb97n(P^(H=LDZ!Q+37=TQNXn29{^f1a50MX?LB=z6QvH zm`g?PBkm8iZ4+wkrt{98*Pv#O?b^ZjUJUY;ad?dZm$O~9QQ&qq0KuZ(E^^Y&atit;VmK#JnO~S-(NL|0}abolZPXTSlpW@zt$$ zN0vi|ON>+4OVJNJFIrV>gt4|2;&>!xEx)iubr z1nVJ5hfVK-6p=?R@iFztrkTa2hZV$<|4`1#;UTjWkEDdxQq))v)+CWi6?VMNHUY?2syBo;ciLV7ixeGgJAz~k#DMw}Yf zC(tc7=q9bBgg=x%x)skm~fBZE6Nfz?cmS>-Dh}6KxzVvd3kkOG%5fTU-Xx z-cZ{@>}4ku`2KZqpi~A`p!4{ksT;`9){^Ee^K*U;j`}uIjFHKyP8i0jI|jL!gb~Pz zWYhbbxY(A1E9U4xT-;N(GB*KK6+rH2(3^irhW8o*SX7i zO0gOq%LLWcxt{goB}@zL?Auf=yVNkd#$g^+-eiL+R-{)w6fr=pmGn!wj;dBr7Xw_4 ztQu`SapNHv-O+QHFW!)j5F!{Wt>(Kk(fa?qOVlEB$|e+&L0L@ldPkp@edA|-ZO8l%@%F1mW~ z&4j2CcaU;vvGQk7D$dO;B)S)yW0q{_7o!>fEom|AAhE^)+}2Tgat?>y!Xo0zfi<`f zA_&=Lw!13LFVFLR9g1f7!u`?ynL#@mivG-c=h(6ax^Bm2y@`agEy8A(l3LP-4UcL^ zVFr>!lzOmP}!RE`1O^^M+(d8$=_Tq8f7qJxGy9T`!Bne zzwnIu)g53pt&iV1m89sE0QFImFrj^lqOk+~0g?wf0T2CS(IRP*Ky@G#C!j1t=1 z$eJ9L)bl?O=_g)l&%CI{x>Uxx&Wh_y>pv-pTWpB$oP9@m*oUk76zzq!zdR!Q&^k&o zJtv2S9Ilo(+AZ!Ca3m2^Z^aQAY^uS_*9{JELba73;rJg1=}tiw;~mvv_6;W8y?&Em{87wyjKJFDGzfe~{KFTHfxy@Q#~txUsKl7K=G?$>@La z|9x1J(X~@SO*J8fpo4#OK6^AzSxbsXZEg+P8ub+xl5D>OikUK=6j!x9a=bp5P2N5$ z&tN*hTnAWDn8C?Jn23S2L;U4)Z{LAsrAbmDIT!*XNk1UyIZL)1+l~D;8{M~N^5g2{AvHJ#xV582@*@euaCbgoI;TKlUHpHReHc^YRh!|Q&u zd3Xu~BDu{~O+1}keiaAeQ(rZJt8M6&!C6`z3fnz4E)G%j^f5SK0l zZ5vA~y3hA2w*6Us6WSv>MhBhfr4AeSN&V5{7m55^aiB(UA0j<4$2iQAG~_sAs`E}* z#U9gV5YyO*st4yb#NE~khIRRsgd{t(r5A7|3}@+l{J-bw%VAYPbg)ZzpK$Mw(ntvy zXx&d&3_-t$^H~==JiC}6cGrx6DmPFc5!y;|Cf>3rmh~e>owBc|zJyWthDgrOm7`vF zo~jFel8K`C-mb^&^P&tvx}jUmo7mPga1|Kgm{Eo>RFT1T4#fXTs!;BQ7ogz^=B##sXh$1JjMew+Q|k;swMMV?8>m{ za-WzxIXCjbLp{TbxzKm$z|ivAo8Rv$Za3RxBrDzVEAWcYj-K)&|8XY#Up_%KJ)>5N}@6jZ;GZ-nXy6>SuPqh$P`iz3;luwP0?=iQ6gs zi39}B|6CXy6|(b2rbab-msk3sC-bXsw7RZ#7g%u{bW7NWX$4?Vt#*5omx?c26g3r* z>PX7>A@UY#iOZ2ttwt4I)ZO^=y^;3KUa`YA1jD>dVwFbSzbnbk{j3!>u#-WhNb(F| zfpR+*Mo~%wcwwFgBOIs1Q}F|^&%9dHPLFO%K6fAx|1I?NPed7qw?%;j*cyVaTa@Tt z1jPoQ%mmfEFe3-%t>C&BaDJk~N~F;P--@!kmj?J4r`-HJ(*S~TNR`?>7Q{PkWjwF5-VBj~7G8Oo2OSdx461?U5v#2mi_ml|3DB!H=lcb66(J`I0=u-c z`p8VgrEiN-y-hE4C)PmNZ;IVhBVteBtjf8wF$^`s)|#?OE6Fui<}`MXxa z9ot#L^44jjn{9ztc2ryh2@AE~^FfbWs(dy*>>naiC(Vq=!%5JttW3oU*xkO@7M)=(^%Xk8%6-0B`c3Os_5$;O|9H%I;sG7KESxU zlGYPLjWrGK?6c+iXea6G6;-9^whp~*EJYJCU|oWC&+rp z(EmNU<=EcehB0Qzc@sd2#eNX12S7=;6dB2i;x=Q}Wq$lf%ILSkT&!amDf@;gmS2f2s-eOm}ni_HKOi7?n6zT+X7cj!+Ha0EP%>*lGZP*cW*z3K{Ijk>0 zJ|*GV0WQOJf=eC{V7Ac=Xh3G1=lAGfWFrXE$G$>!RbfC^cfR72mXWq<(WO`3Yu}ph zqTY{65-i6c(b5$+OqiB*r>m<9I@&iFM!RHNWtEt}MeKOq%kLQKB~weh+HM|gC$eE1~D zsN$C9n< z*0z2n__=%7N4g5(2`9ZCLR|P$jLiDiCn~kJy(VQf5k{{qGMi-Jwo8{sDb-A?Av8ZS zg#_c7R_@1XhnF{=C48?QlJ!Y}GzsDg7@u(jR zo9AoI;FY>^a5xG0imxeKT{Plj3a`;{^%c8m1LQ>Dy59vESkN!x zE+Py+Ux1q&N^p8_1am6S&T}mAiJwJ3lU?yS4ZFYPQi~_*=yvjG*Zw*|51|1AMD#(o zY%r|btjNKYgC7-*AWugpbItGj>^9VRSH__vf3rKyYdzx`^If$lea4RpAI6L_@If@ z0xEqDr72f#Wwk$UIzjY(Khj;v-*th$!? z<7kTS=eo<~X|b=k=`=PrHka~{9?K3)h>oUw+x`c)hw|TH*goX3h)y$td?r<@ia!-{ zfp3f@V2Ix;E-t>A5U@SMh;=!?B|T4wj;P5O2DQL18x60hfA*y-oitbr57vkNc-RX< z45~U4`89IDunj=wW|M$P`Y2Alz<$a?x4YdtvoX{8{{bHseuQ*`M)?Qh9Ym!-)Jxu6~{jqMmNw|8!Rj?yhv_{=_myMGi0DF`7!oCP08Qag@69`b@o2jhrD5VNjgnLOhuRDhW4LBp9>Qr)&J{{LtdGvz4EEN>O{m$&>02R zj7lNF2d)9nJYwa%&}lO7MEnG%LtKNp(xNq-H4yeLvXWNy)8;#ra=Nf$X-1LYAwX#a zr1F@WTYmEdnl4LZ9+~K9ufBqZZkoBN-_w#aq}G|&M5k7o8JPHfXISw=-d<+mec-(; zBs|jkZJbc>5kr{uY4=h`H9k!Uek6K|$ER_4vws=sGheD7x4c<#`@c`vXqtpuhu*7| z-_vWs!3@R$d(DbAIKI}_2FCCG3w17@ZbUwOuOSf5S?=YuXyTU`Ly^3`pfdFi;gerC z0Gg8RL7gY={-IL^7M7kLQQS0kWhoY@Di;b*J9O_Xc6g~^;;}|aG<9YVks@=ujVk5( zkQSFmalqdPP<+=;NU|(M)C8Ac@%;^{?j_E7_8FCik6_=;=HmPXuY&0iUms8E_IZ)9 zxI~k=_m4zO2h-y^%~yknSOZHnxbI3rj`{U5&WzJKwQuP z_gs4a#-h0mwHHt3uY8=r^z$lRbD3!WcpIgcR+kFt+QN|L=tTedv=AQ6O#if0ZSC&G zrp9}2VR~=+dnC`csNM+yUT^Cx;sGHXzxi%pR(#j!Nb1no+;crK-Rv%fsVgd{M0y2} z7kAz11JZ-i`~%qm`>Z)jx{Uj<+A*(g>8Sf&2n$cef0JYel%B%_f`=bg;M2oG56RR^ z$BbUi$lfQ?;AVar=YO4CPTp-;fNYFpofTv-Ok&03Jj`D=wq4!l_(u ztxb%*PD%|Bm6J`fl6gV|%bJ|5do-^pDfKQ~SE~;NmC`q+E$L5cqjrhpqRhmnj)5qHL{f;=}m4hI7FF)6FTA{E=U3CvV8^Gc!_wRcy13h-T+-Deh< zG5zlsaLX$zM>sm8qoWDrjDnI=i2(zRQPkG*jIbnRFu{8D#Tn00Kh z)#(?KZgt#vK2LxcJmE$sCPlYi$WIbA)^mC^zFzi z0gI-{Gg0%KBB-&V;VAb~-HK7L8L+#kpyZiRT6UUGupVxSuN^Crv)+yE&LDbz(^P}- zx6f;?`SqWVy7$iSCt(e)nZ&H+B(`e9e@N)18fcW!LfDx;;fBJ|WWvM+hK^wgSwreT7 z#gRT{EgALA6v+W`#jr*tUUNZc@-nBlX{f(`e=W11J6gwLiP*CFubxWDEUl(%VDJW< zy^CUhnGhbtD@j>$_DghSU1ohzN{O1{z1$|+rrOEH)@fS`~p5f&<>FUe{T6^Wn(Ki!a^w3e^NKacih?RE9;w&uh_m6m_6GGk*`&H6QVi zjU<7Os1DP2@uUN8Q_U@WP6z314G#f1nCOUF)d(dS3Vze^I8>H_9A;jODN$t-w@nnh z9i?my@^)?xG)C&fzMkpF!evJs<3XvdO6G!77VUa4_QS;!N$r2EhjT; zs(IN$&tg7OOKe}Rm3{XM20g(a#pl6=)X+j$BYQcDHOuXbTQcu^9s2!;ejfKOg<^iL zGm0#I3pU<%KOkUVfjIP&S80Cp)dL1mnl(aUn1U75zO$ibb~wnNk;H2AOv(d&GB7^` z3u4xBYm*EeI%Tzxmz+{xBz?Icus9)2*NG5(LsEj?hDUvxvwNHNY$pD3x~ zlh?o!v6Z6PS=UMoA4LpP!BRK)4Za*d-^jHEzKB=L)SHobzB#-r_p9IfxJa@jD;EO^ zyXNS**DP8x@z$@R_wTjmySt~blAk6Otho`Z_nwGI&KOqoz7r)Qf*3Kr`B1(aeXtMK zafIbd{9&n@UV%^6d7A_?(4e5R_4p+*qDQdV{@#Q#v?6RR59ECP<4jDyVS&DSI?#I| zdC};B@sUOiaJw&HhXYOK;FkuM_y7SadWyUGc%poejLU5$zZtz8c&0+Zj$QW(-_+%4`ts?^bIvO@qWp{mSr~~`mq1k6kI{YJ*xcOQ5400$$IsCk zAI#o-KQ*@{0d}FBi?goAtylbhD|NK3afaKg)27D62Aj*W43_eDbBv?N9d4)m7OKJZ z%q-(meV59l?o>G4gsd$hjS z_=>$*8Uo;cqQYFYTrxZen}O7kzJq$?-Hd*%UMv-!C^x4$4u?W~>yUzcip0N{)ve2` zhPy9O?~|6`;#1=n>J5#*=mdv(O=PHczuvyCLJ{JMUN>OTC2GK#m}>DaCe=ePgHrD0 zptj&%iSAKs1gE1MK$x^*HlXCHpV+62%q5{g04tFDInL!;eMwg3kIR?+HPI3Xa10Q| z--=L=o42^^U$U>%g4<2e5m!Wu&jPhTV{uNCu4W5`vfvde)BFj3)j;aO(70{87_SgJ z9;%#+-x9kTGyjmJAsPGh9<=_}W0cpZc1%l++a6nA=8w}X`G&t?i|GQ8^a!uItv-Kk zo`Kw0Y8Is%`#fB_G0X&*hkUS@``Bep+LPT6bROnBrHz2rxU9P8o-4IiP~oo=8a96gQOoMY0& zl?;hVw|z>a)U|}q?fz4zPEPRPs3@oP=2H>ceIWu~ubX@f-m}%T{O)ymYcx}QGw+#= z*~^^wPmcKY0TJLu64D^x{23*l^{Gp><~Z{@tt7|IUU!P>sb4l*KdR(u;Zp$8TVHWn ze^%{5rnO|r(WQ5=_6_~5niq)cye_V}s5gr>{)Udp1_=S*q8So0q`QzmAiwpiKa4me zxDbyI^-^>_&f;U&Xw2m0dIilWzNO+vZ@`-mP3`j;lGZT#% zF7*w3c}Rp*H=w6gwepo`ov681^ z2OzS*OAvaw zRt^&x3xpI8XLtQJuX#?!U+R&k77`)rPNPfCt(>LbDne&EWtk9NrDSo9;ai_<3~`?4Sn%p~Y#n z`Hm%@x=ALT0KfkD{2h|@&l)RTQR$-VS6IP|v5_LY0@>W}!tOo}y?`g#p3~^_^XO!4 z?Y~P^Kq=P)(t_wY@IpV2D5R(+FK76UAo}9;zA)$DY zKrycGDZ`^M%JwFZ64JF9~*zV7LXoEz}l`v8oxZwG~U2Bj4j9WZ_Ihx@LJ zrr13T0Z=4-*kf$ccqW01>Zy< zhe%|2N7bH*ubu}eSoOSE0h@UibGAfyEOE1@MEPTS!2w%ohK|ZX)N9rvfq90jsr^{> zGMcxU1$tf226<=saADq>>nMA8Mi&Jb)U|jady_E<`^u*L-_v^J8j8dRv#gz2zQWjs z{p=E4Gq@Yu3|T_&y6$~6rXsjX9PUkG$(Cm&?c~-bI(`Qc0=punfQl3}Nxd3HevKu+ zRm9cfVoPL?T)r&0lPuwf?VkY*y5a4gPWgL|zY5#rT@+-yk0Gp2OLGoh+B?-J6=>+u z4YH&KngJO`W!_%Rcl;5;!)s+&Efg1vIRft?`*9eUi~XFR1e=9%HY}ghf{nGToXC!Y zBnx1v>;`iXuMbPZZ=}8Z4oKVqSvW$ZW6`XERrZ%6>niLSZY-wWwC=CO;}XxIX+(2b#F{6 zf>I_Y;2v$)N1FYUFo6^L~wBSMIVU#Wsa;40o2mNWdv+zUjBbnqfw&I zGZcnn>T1)_ej^|lU8I&^r74-WY=R6ElvFi?-AbwXTsR$5Nyg8Tt!1UQz)y~W)@FuCRllh& zy%W*Pf*nuJNx9&iRs{UQoLEj6KG|LA?_(E|JD!%@ulP!t^cc4)m1jpt{S3fΠ28 zsK*MF2csyHS>Ooqd*q*9&pDNw6z|q>8W$@gnpvSe3RQ_s>&_9cv4`FxbOl%s^hU~m zpi=eFT=akduO&%2zM!`Qf;pLC?G&gH!yHL-XWFrK;K4(hM8}+BT0U@z@YcZxFK0hS zpqEOmRl?9H{)B*YKy@%JM+11yotIUgrvr~2B`t3qBpe$z?$T&>OTedksC+SfKtxh} zq6{%`gpND3$6xtb^^eR~7SJ%JpXHI3?`0n>yiS;m+SmLtki9!cJWCBhD>}>WFui;7 zRQ5oo$X!(=bnY`)`SuA2C0|RzBo`i%AUZiAL?S-ALtJ?P$;Ux6t@2sEB$1-wATE#>#j z_5rf@788cD63+VnclI%RX~&h+ErB2~eQz|aM6QetI7*V6pT8OniT6w8=bMe2a@kiQ zb1N@JOmThQ*ySUt*3%6!FFFK!L=7p}!j7W!4pv|o-7p@CaRl;f6CDAtLQf|CSQ{)V zbjI`LTAp2r?I)OsF{Al5clshnoplVFQX*bDNe}~l{7Yraubo$LJ1-aM8x-nUU&z?h z%KAu&17N+N4C1IZo}^6IV8=ut0Thd9duq0>&ZECD{^AH8I}7F^B0ixI{#KI%5I1jN zSk01~|Bg_L?7YYzicC)Fx{hEWS=CBFJ4@G-zZTTdCbYa5meKSrcbhTx!{Rn-qjZf| z#b*bK#kgY~Q{FV)h-0SIEJW`e8YXWS)La3F+XZX)W@}G0Ol@7=44br_4EKc{1b_F_ z_h7pV8AP;8OkHJEUBiz`7_?M2Ly#@SISNUU_lRhO^%7BIao4CC5~n^RbGt@nXTA8D z2n%xV7f&noYp&Y@iEE2B7A0!=V`Fz@$kD=zE^mZjbCfV++O!sL=hRe@0GsuqJI-5i zO{jz1R^slhn}JiNk|yuDqQD_PY+By?J%~iW_to#Wbn@P(?fm@p8nvS1@ZAwZ5GZ2z zj;=jHk0-*IP-{z{)7TiJpw3de!p|cTFNf-hMU~av3MMr{`bZ+#$sxYx3(5h*M|+7e zS=pXH%SK=c+}|zG?6TI99ey{B;s2q66AhkyK4*&d9j<7-C2G6h43o|R(jPzXB327ZqSd$2FENX9u$|# zCqIEsrWMm2^X7{ysGOs=jRLC1m@1sd__+^|!2Ry-lC^B5JWpKwNQ3VFGfII?7_suj zA4zGR_S<5B8dGLNV-3;;5zwoFnP*s-7%RPHD|5o+A;sBd-O2W^2KHN*LGt1l#z%El z$apz{O0>K-7y{v4WJTQ4tjSg3>DSsGz<~+n`XbKO-kiokInz$9eAM zc$Z>L{2ld0lf%={n``hN*ZRBUXRQF3TK`>VH=uVpxUQD>d$P7l@^$tN!# z8HDB}hy~Uch0Bk>Z#l3iVH;z%UhrG5fDux*c*hfnBDDTt@Aju1mTvSSR0C^xSdw%LHLd&8CLBc?Wk3RJ~M`IQG)X+GR) z{iD$iNz?sU))VQRg&5P-4l2%14YMoy0!oQyg3Ft!W7jOWiMDdx`nfj@ef4wi*on@H z{~hVl!Q90AED4eNoqA{Cz7h%Tg^s*-A>RZs3Tb3_eR`3{)p$h0;^i{UCL*N6!TFk_ zLKPhe=$I+uVh_leBX~2(T$X;-Vp4u)TEva8qbEJ2xQ*5aLHDBDC6@xM5aWPexUhGM zn>@e4L`tAN?e-Okc@KlduEfgoqIal=Cy1W(g`QV@HSR_8PpTiNT#M;<9pS@)eng*{e|*ZOLa# zG1yuk!LkamIze=i3NzgJSi?C&43)AbCW{%Aw9`Z)?(?CyY1_00dm^E|iTp7F zH|O@X%#<1~zF>>3YNoN5y^czE<1(D_`$S!zNDnvvibdvMq!#X++nf#ZoUckOa zDwEZjp+bT}@IE=GSyx})xOJEkqX0tJil$9)kSV2RyIwlR7yYsN6vjVN^QCnon)NUU z6@@33Rlm+_iOSJ$``C<^AYwF9vSo9M(uZS>JkBSC&gS;X8Vy6}uDyqDpE!OISHc5& z`gej(cwMihryMwixPEZ;Q0MB(Q;hA{Ptq1d@wEU2w2B}K2JJKr1au4p2zc@1!De_f4Y zxD5<(k3dOdIgmQN#nL93&S|*=fI`$qR&J?hC9wBT^4#9-O`rvYs4t$%rQT;2N#rCy z6#Z7#&4CC@d@3&GWm>jjdB?qvGD57nVlzq2**F1OJGCHZlsbs%J_T_9^5Mh-zm14r z*#2;CZacra659)f9>D|GDw0#kN%Zw2k4#7iswXrT_Od!a?ac0Pe#|&22A?coImkU) zVvTZdI-AduJ{slvP>^{!QT3soM3Lz(cBs8t!e^H5Ghx4vOm6Lnh6t7a)@;z=(@VyK z(jh@Nsel|9u!h_<&6fU|B;}BX=G5^FqK|3_mFMWW8sni>VFWj{z9N<1AKNzHV6m-( zpzI#RmdpGq)FAij^)*eKP<=jC|KCv=%oXo+|J*Q%F{gweI$Ef=b|JR3i5S;}+RdsP zx(TXT@)}&ce`QNQTKze<_Gwjq643G*S%v*N1~*%t@c|uV5F7KuUsN;rUcTl6Bu@Vc zom^#!1y{8YBqsFsN7=&X3HbcLxD_Sgg46YyA2?SQXqfa_Ll6H}>BgccI=rx=8@%Zt| zp|Y8v{r1nfZl`9Ec4z8W zdUmI!Bwren`;?v+g58Bk&RW}{ispJ+bmQjiPZzc>#~vqj)jWnf7gS$0LjW)fe6=fx zL>}6MwP)dxO1~Z)K1LEUChMn!IyGXq3X(JpC_{RNNhMH67WFpc6^?tH;xqTHB zS3D-ZXRnr??9&M}%Tdkc=qMHN6NFJ_oO9`u=RSb1~YZ~WuCbB6l|OOZQIgM9J} zPEQ4yEGv|=q)QHQIs35+qkW7EcnOYFuI(yn3!i@F@5paq*x9` z*n8ZJ^U;29o84_hhF&0+!$HYy$mxZ$@XwQ9;H=R{7Ei{+4Im4}f>dkBH zBN!=Bt_EwUdF^$o)B$9NW`s(?enYo67e%E{k7iG$$m^#;Z_UVf`c0zcuPyvv&*|D; ze4P$;Re$d%_zF2|L}U<*8E@`1E}S}yrRIF?Yu_B1X&+BNU3#O>6dZfn)@~Qp_9kap zS&{!*Z?#BJRNE#}YnI?)nKJnl%@_3~QOuRD@RClpWl>%{o&`yKY)`gg6XW*5H`>x?jCTDQyBQa4ttBxoJz#*+BKay8AY zaD}Ij^^R_w_t+V%i4g9d_NhcmKBK^?qzUlu-OEJz6ar-I`xA;pD(YOW?c45t18Dhe zHG!&L^!S~$`sFlCQ=1>JE9EqNN=<(s?S`l&F5AmBG>Ow5Qnkxlc)o>y1`sP6bFD6b zq|&_Pn_u{Awr&_mkJyjtBGTAg#;uG}>_xW+XWsp*?US|}LyhA@j}bT^4N2EL1qd+0 z5|uKjc2+e?heoNl(8}_bgsNJ=i%(tcyd{d5E*qSDVzcLESlv+<&L@lj#rS~I9h3w^ zxkop?jwr5bHK&02tG~Rq=3NGs@M{luTn{nSK$rEcE}_JyMw^^iMVw7gJrKX&)>Y5r zz!krhD4w{8m8))kLf(1umPp)6G9G{^Qpo(YrEIgCniaU45ls4RH@r%!;LGZ%ZT9|X z9`(kOZbv$mhob=LBguJA?0S3VL3Q8)l+zW-9q(M1+XquO{=Vc3uXa7}k7ZUgJH($< z?mZfj%bZW^)cOcoH>?gul{QlORe6BF{EmC#4`!6pphtOy2*gaS!ej_bTwR7+Ej*(y zsmjibGF(0{F;_m*3^#Z0n=rR5L1$*=F0Sa12*`YjuPV>=U!9?o!wegcb`UQiE36YBF&Iu)8()Mza8D! ziw4|s)e(3GrK!toeOBev@T9+;RWUv?WV6q%`!~Vt*Sr`F={+E}2gejjq}(9Tg_3DCOEIE@O$cjaS$Fvk~wq zF!?vl8AHZk@mQgyvD`L8@2=K~je6j;P8V|49J^-8>)jqSyr}HF!eq+n*Gmfwn zn94tDODKKtd1^=~a6x13&u5vzAlEH4sh{vUjca`=GTVZykKsr>3Tf9iP}L{;M2 zO|uy09QkeGd=tj|N?u;m|DNovNIn~v+pA4Ypl!L>f7x&nTJW{?iHns|ZXyE#m#u#l zXL@hK{&H9|H(s9Uq{&O)1`ugl+FirLQFuaflw&U2HYG6Xu;O^6uaycXgs3qlYD2d- zxv|}*?bUHC^YsUeg1}MN6wQo#qc_NTW6$;9bLw_mbw0F-``8(EB`D8NoWaM4Q zySS~Xh^eJIY7McB4C}4F8E!;UFXFQN6_$zr^o7fO^ok(KT>-AA%M~a>I3ckGVJN5G zB*4pm14f=qwrBjp_T)`*N#~voo49O69#;KvoN^&jU}e#*?g-uS^F)RDska$2Wvz63 z0Dn1Z-=6GOL)${0$uQAN_j$Hp(Qc55vJ99+y>$9ecg!Ix>bdfG;J{eN7|cBB;labE z!mDBT0>YbNjK#`hlg7!G2xX6y6zO*}8&Q!R#QIpX7DtiQ|h3u`~}xMg!}V+8!51y_ZvF^pC}_`LX2CbzFTjci8_ zJ`&k$XBcv@ZTvpHEpcUakNl)nj*Sf>awPMR&C4ty4Pjc5Ex8{|G(#1j7B z=}K3z@wG?nnNtzWu+rHYqDN&W8W1bQD%6%!Qqmc0sIOm@$x@jpt9$pJGkX3pdNzSA zKREm=3T$kxkNK&rq5eCy{&8=b_wOvW)<5q5zu_IGe;mgA_yhk+t>=DQJ^il?*6#to^7SoGDc4>u$43eTGSu$8*8o1pZq?6p7< zu*aX46E((7)~LAK$qkzOr@x!8==FI={%QVfQG7q_oJCJG9LUc@ zsM+)zaya|UQ$O3|ab-;)Y&`PORqfKJr=V-O{93?zn zJB;XV(H%|wii&X+ zaQ6tP`Po=&bxf>P$27U6A zN`fK$MsV*QcfPxQM{U__=aoCwOU4!{!WQKp;t)8B>A;>1m)k}u24A9bdDTzZNtBss)c$zbQR2V^<^73HBgj6J z2>CoIA5ba~bQ+Xg{6Gh;IxL&9Mk_PvW~Yz@kpv~O6%=i!hk#&!X}aFn2jzI2Bv)+H z-r-A`P^S+*cF@?!^zI?w?Z^+CTW5R`G9hXKF888*nud}mQ0@x7;Uw!0Z}A9nft-KY z>=no6C?jjWZeW9Q3m$M5H(@blhcX(;o>$YhU3qHga5*>RhqPL!t0Kncs!*9Z>d@{G zpmHc`<*T=KSmb1}axOkA1H4;&t^M=oYr0fdn0n4wjDopeS?}nDpK>Pr#tJk>)yq>n zy&AkTrQa}bf9EbVKu+4^k1K6;2K;&z07g1L?HDU;>U$Y?lmc||NQAq4%Ka)lli*PnYMLu(BiRb~lyX1XN zQ$|Bid=N-Md7_W!6*wq4X$k1%E<^rar74nd)pD1c(a@Kg?%+xADHPnh6W`paIm@^4 z=GU_aNc{qkBxJH@4MbVDGOw4{D(SQ%d0wab#EbI5gpU;%XPjBNZ(belQ~!P)8eP4@(R=esKdN)e zcypiQ3x%=tbhk2jDPA@hM_Cq{?3X>M_H*X7sXVUga0E6`*db(UGQ?O%N#YNpNrl+PzYz1{p2Y zrG^y-k%$ct26Wj6%uDW*#R-&|_YZ___nsV7`<}GroQ8sYOKg#!jxAz&)11qx>D|B^ zQ>EV|(@7_j`=jA#XiMheQ(!#_Hc@f=fEpY@sY(#SC`yrQ&hg~;| zyx0v>!~?7{m;Z2%irJ)r?1KqYZu0J%5-z}cdNR1+3|3u`tf#eqN=bLuq@ceGXqjzp zCwG~0+@m*{Y(hVMA9<2XdB*u(vFZJnO6zIjc;DG-TP#drM8@xUlDKDhW>>8HI1G8w zg1Q{mDn{7*tr4+=KUn&uU=-qa!IT95om8e^^q{BwVbMu4L%+3VnZAf&zyBc@gG(y4 zcL!{NFt6S~I^EyWsvTYJg%@js4KLp z=j3=W%6?S5-*R|dY*-UkeSTqr zBNe%nEA-}F~>86G}m8qT1FXA@ju zdDbs0E32nbIx*Fa$~MOZP1{?*l&>$HY;VxH`=#4OdI$k6D%LdFO?mt1uF$cex&BWr zdgimRkiijG-}skiy4b6LgLw{Deg$jED?oRTiBfI_su`UjZgntwe|_O~&3AwCb1u8I zSs{V)5gl=>z?Hiq@s$dTk1K#rmzt4*MRz{RhkWQ)Ff{E7py59e8$HKU^=2*CrjIo5 zdbR*49%stN`j35! zd3vg$wkFkbIi=iP1CW|p^;p+$gO<8!fNj(1U^YHJzB1^aLCL2-gOY!`wQEALZhDzt zyFBcnW}j-Cy1d6|03*h6mGrj*pRD&9moy&3Q~TFpEdu@^cqr~Z>w#*$#CNZ#w>K+& zjTUS^FZEka(KU~E@L5TaYCrWk9S>|i`CFvPnOQQI^FH71@sA8gTjVS}IT$*QD9GO^ zGCwD~?B-1wepEDiVE}4aS#)`SmN_Z6?51l0%8%%&As&FImI`!htRtCF`-JzEoym6D z5uw=lfMHc;%H~#aYp7CIDd{HgsV%*!%fQGqr9x0j2;miM09e=XJoXJgyno$$f$+$t zJ2z`=ONYUn1v|<(EHi>#o4ixFMtXa(elf;tjq|-1(kem<)C)2U?a7#TyCZoxJnmp6 z(;k{AsRl7B*EYsZ*tORpQq(qb5CP1MgXRH};P=tw%%b#~dt>VZlrh3!S+Qb5p+Q!m zOJXd4g;a3^vNyQjlX*j6cryzP!*@6OejTx!6}2Q9HLN{@Cs6zKG^TRzo!1anDQ-qD zo3Jt+s(3Z;j`8dhJ{bGxH`e^Xkg-W*;_Vh%Iq4AhO{FNs1qKx1b^LQ0d50@wJM(DMp*#o zM%mg1jyyo8Vr_>&>8ajBRN~rOyB);7r+Eva1-RWy7;DJ4k2zonQv0#8j3 zRGfd|tqNe?@;zR&nQ88ZUH2$=!CP4xy;?!1ef zoO$mSu2n~?4=?8JZj{Ef`B%IA^uA7uv%IhV5422T!@ojw6>cSyZ?iL5M4G^L{J zlP(%qfO6Lrx`CCo*6lM!))(E1K_u3yjOrT9n^|gXQFj2k#5?PtXle6RA=<{nH_;R0 zwk2@wV_q6LAvZ(PBlRqmB&klTB2;u``aT&na2XnkD6lbm;#BFZRTCQLZY0Fa^W zWf~J;=Z41YrBZ5GRTsakz6Za|$|(lxGy3}N2?e8D1Lts!kexj{FBgw_@5Z14@}j7* zrEujFVtz}wsS(NsRlp%VG{BWW5!0~9*2&8&&=3T6EZ&XY=w3fsZR^WRglLH~}*T zG1_-{Z|Vpt3(4Djut$Ul3zW!}s`G15^$}t#&wqHJT_G)Ns-CRV@GL{RO@;(1Wajao zp30N(E32{R-9yW^`MWV96BlGJs2#r}z!B|T)Io7#Z7oU5Epp#kO_;elWvlx~0KEC7 zk@0u4;B@tqT0$}>5M`iI>@OszqRv_GPJpmo=Ab_5dN+7&e#uVaW&p|1Am;M5fUEi( zTE3K_!TKlOBNIC34^IiG>U_9@zk^WXM0o+FvXmw#1rw6|j#S}6`}+4mz`1M*X1#IH zyp34hT-q$~j`x<^wJ9-#4^~aMV5bJpFR!FZBDOkjk~AAcXF3{Op>2k5Ie(}j z@7C)uj=_Z%%!G>0I)-Ii^yA{QW7`c$qc(p3H7WnEeggfweiYE3i9{6xkdR(&zZKV9Q!Ro zW<$b|E@*QN$3xb;w=o!L{TyPWrUKYvvEt*gw9NLvAuh(BA{>h7JbCMT;L;h zCSC9OW;0YUAj2u5mXdKx*>I7guM%ZnjIlZvMZ0u_6;Qr+!M{1IH5e+a>m^5a(ablp zTasRKa(o1J#lGN?eB9)j3Ss4h6Pe(Z#m{0?Z-a~i_N~x+VT6~ogoGid<|1F0Z&Ha| z4vf)U;}A4#B$i;C8}*apK&is{T@l1b zkaVt~bvrMSitffSdW{WDaN**mgp1=s*AqHaDeQnf>k7M2_k_)%EYoz}b2Q<6>=Rqm zNMeQu_!I3nLwpgulPJ&5*O&^3AAW(3^BF^YE|6G*VSQkEu0}-L!g=`7QeEG1YA5K| z28E9rnX;PFap`cL98-kWtIWNZC&Qb}#ho5+{oZ<3ed=9tmA3HG)dbOWT+uH}b&Q=^ z&4fZNo_zAK_^=2}O<*BnLD4_sTS!wnkIe20urHlG+r15t%3-t=>o@KK=UU9V1#WOM zkmWCmg}E_Uf_`uWrm`WVJU)&puH)^}UfPaV`ao9>Dh74Hsa<_BF{b+ZvALR~kSKN4 z!nQNL`}?a!>aqPi6llh4FHD$n@P}SSx`-J$sCpwDeJPBtd+>tq=kUE@WpyzZ8OlEO zzaYgDO0h2fm&W1f9zZhawYF`Dw>RrFJ$$)ZB0}vJyGj9I zH>u#e_K7|@a>J3h-M2S{?>?^5z>0M?HkbqAq>$*%QeRt4QyN0T?3g65!4*ZbhTzYC zy{sT?W1yrb;wKDq-=SZ#Q_T+UO3e>W&T^NR0Di#NyXNd8Lq{=Rf?ib~1(gK7M(s2i z_;oablxThWo5}+oR8Q4|b?gM=^(BLZWa+5E(BR1aa$GDkLu#~r3>^6p4E-Prl2rR)-}LhyKlBU84osXP)Sy-gSW zl5vM)HdZMe=Ps2hAqVNJI}vuIi8$!p=W^Cpdf&0E$nRxHdZMsL#y-b4Xx63*mX+mw zB6Dw50C+3Zttl+4IH`yC{K4%TA1Yg92pFbo|F(<`Tvg1PLv{5@lO0+x@M~#Lnpe#B zZ~2veKqRtuQpxV=8eG;r7dTqKpO}c8sMR|l_%Fn*O8^N7W1oetEB~?o{6}o7+}Drg z)|`m>3b`dY&swy0rjk;ZrA_|&p^F`UQx{O9dny1w9LRsGpBJFin{WN;PCuXf=t6D! zsE9;FfpNXl_khqXU!PZf2rqb8vF!5!LzTCM4l`f;Oy^pCX45c-aZiIs^9;=PUaa!S znezzy5?KjL1@HE0=hO?PK1sX26ej>_T{1-(&gZe35+C*Y&On&kBB6d1`l;{`^vD(y^>TqfDEe`#x_0;(gL0 zVL97LXMyhhh1^>U=2{D*zIV!nZXwq!UT8g@&N)U9(1AbN1D zZrpL&-QBSCnX3>wRSbCONIAc(m!a45E__eqILm}Em#Ia-{oPqCu2>eXN+!YuNgEKu zU0H$cyzNByB&?Xs*CuoVz{*}0?z|Bu=2h130jBp`+0wMuy1gbcOWM=qeCctrn?V?7 z@Iqpx@>IlttzN(q+ACu%PF(c-BZ`>^$WEVKPP!)2#qfPFy^ zn{RMt%)w;6lk%+jI^b%dc!!QbYLlytWFxN$-U-cVhXY%-E?z#eH8m%JbFEaVFA#A(kn0`fjxu(MChtZYGh^-u!4>aW~M6TT{@dWA=p9 zEe(K*U(gFetkzb2b@;{Y184WjQjvu8bK4vosL!{_0}!v-<*o>_`dhQI#`M?EdN*5y z`<>W-c>J;YLWr-H6tp;w@`!QPomf-eJ^P-%S-;I;2x&jxIGg7b=EeoWn3!F-LUrT>IOf~bU8QD4>1|iL;hff~+Yj$pZ z@MGM0vlf9*lh;f8HTKK&4YOI*W8H?!w5@R$ z;s2@N{hb}Ka^$-JZ9 zQmej7`EY22HgJh7+2NYJ#5#N_G|UPaLn6A>jCbKOVUR2thsm((+gbX zAb=psY{F!ABu`9yF}@o@)v48&-AuGHx-~NMP5Q3#`_ZB^?J~$u`YVQr-)grZOLB*X z{7NjsBCU*&vUlw%*t|n&sW)jU_S!`p1RIRJ<(kv$?LOuQy4fT!HDaG_{GI&)NoCAbV{C041FA> zva%C@X@dFW12n$2RJ}H1$P4z<+SyKX{ersW^t@Kd|%q2Tm=53NMYwQ4?zrsbpUKnn?~@FQ3YmYDsv_M$;Rh!sRtx%hAT=X$6_^ z!i|G`VxkkQFs)NP>~>2i?zAIh0K`l|8tHK7io(XO<~jJr%!}~zGfVDxGQVY8HL^!q zPZ4t;W*PAxkfj+`&MLXtXPf#Nf$kmtE=FP6e6uE4h2GcS&+*sP{{XGc2U`2BriNTx zxcs1=mBc_(@#3>Ks6~2``e{6COOIz!Gp@eV#a8XPGWoMgGL_Lq>~_FH#?sq+AMYHv zHcZUK<1JJi%Q*esOyO&rBQ%B5wfzK2ot-rct#H8N5?l6cTix0c461z88s3E&Xam_JBFY_VZ&>XxF(g^=6Si zN0q)9+N9a34T(>yen(=Z9m^(1Ww#2c_q$$IVP1ueZM)UBt`B8y)iUqkn5wlzwbvz0 z4AOA5Y)4%LVS451d?R)4BicD4&9Iek;vjY_&-(Q%Xjyh`e{km0!)UGWEJ?-D(XvQ$#l*@vcEg?6z7_ zYFAIaN53A<{cGXGp-9cfxo!W#qvnZ0MYyVC zL3D%(1@vR@$qr?jook^qbL-oKK<_!CZRrl8y$kZTApddh2qM3Xi(O*W5@66A}SX;uy`aDs8A#Wlh@_gTA+;SJ?Gyn5?Ex859WOD_=l*EsMn+e25yjoVwJNcncxxd1-_e7qlnCp(d`PX`3E@cGGmL*s> z(08lgWG7hEz%t>*mA;@Z>rj!Fxqx{)GT1A%KEP^<%C7s$Hw?AZ)IsU%&;`OmjphQz z4`YKaL7Za260GzAcoH3S!pl2M(0tk=k1qjXN@RG5Kv7?3>&2HYL*fl=kwWSX#+@E{ zTjSym)(*R7z1UOpo864hQ&R7dw>iweEvIb;VfFDnX&^9D->O&)15JRGZwCG%6pk7Z z7jFn4aauWp0?zWQ>6|*CotTJ7)nXk8B02J?50E`g?vK%XSAIX?z*x`h7|$?f(K`4c z>8=4kq0nr`r!lem@r@3?KW5&&a`DX=U~WcRZ6hAlJFpas7QLVtL~DQ;sbaM8QC?Q8 z5x-(N`2A5_11%=}2LCy_&Abx2@SljYu`XeR>i3#G75^_QTdQwWMcw(s=8!AHYGsTVjo%URG16abRJ{GA28V6>Ba4RNbC z+WKT^+k9L;d3ZVBcyl+ry~B5}fa^ogR*UL=z3ia;XO|w&>Qq-%cOwa^61uVxvUX-~ zF*zzN>NT(@N*3h`o0-PiUhwK^Cq%h=ZY4I{iA{MP8`#@K5e<7!eh=>@q)LB19U{}c zU8&`_x+;tCaK~?-GK5y?If#uTRmgnje z%WPzax14630LwyN2S+1bQZ)`^f=g=+5d@9 z`BBQo=LaC|@5EE_f53w%d5|y{Os_pswd(|6`08SZ`VMmLIx7AEudu3@8|Q5ZSTvQg zZMZF$A^o$RSeqXpn7>o3#s7Vt>iVIj26{S%|}FAuI<`fuV57t5SB{0~>) xpIy>SGVyHLm;X=tG~i7BcL*7qCeI@C*!^qri00y`{2w*w+&BCkb@#!u{{i&8_@)2= literal 0 HcmV?d00001 diff --git a/docs/images/otel-zipkin-demo.png b/docs/images/otel-zipkin-demo.png new file mode 100644 index 0000000000000000000000000000000000000000..a3af04e466c8717c01ea4286ba360acedd76fe76 GIT binary patch literal 133964 zcmdSA_dnbH`#!8il@`6|w5rug?bdAUE~SLltgV+lLNA2cExOf;9g+^j3K}CdQyoT( zsM(0omPEw}iP0c(zjA%<&-;D4JUl$Y zW~SGzd3c06czAe&4jush!t*q%0r1*`T4ZceuL-riQ)~08C*UaHs**9s_i&1`awYE!RyKU zpM~ub)SOG=`TqAfor?Lt^Ld0FS|HW==7PhhSuE!Kp^y6qZLl+hJ*A!ZOGK=D@1Dv| zlN;#2cN#k864sC1+g@~F>&(Q49h2Gr&@GqkxEYwicG-+OjNb3G>^`@MoyjQ zIrQ;ECfjK<=6kqSOu}pJw78xB|9qRhd)x+X?dQ|e z)iV1$^!+zO`uD0G1pgCU#t1=idE2y?$5kr+fB(zTx!3ZPeHkDm5 z^fnxA1qi|bgWX}&p6$wq+0<=2p3gc!>@n8SMr}b&l$?#c_NnMa3EDqJ!CA`+lW) z(H<1gvV=81hBRW$!Fw-tN!5kFJABc_IizjlA#ZKQ;NE~9-9_|ON(Y~Z9J6KEQg8Iy zzZ>8qp~{&@Tixu=ll*9!l8 zJC7vtcP0a;UK_hvhf-0C{`Qh~=^C?nysbKR?WKE_llT8@$df6U#)*n%aaZoU3m)-# zNG5WROcpq@W}UVL2!%~gNXS?BzGdL^VCe0V8K}rMV)CD^=))ghy#Hn*Dcr*Q?`fTU z0h}oJt;RI~UYOWb7soRZGr$F?Qj7h0$a3uAG1_C`S#9&eFnZkPUywGrD)Gb5DMH#5 zH|7*LTBB^2fSwOuG^uzm`tZ%kTRe?t4j$rJ#|qZ@^gG#ZZM7!s%_pd;J?J<@P^=6e z*fiYxGfT?)fE2Id1~XXz0cKJc1))R@=oJS{7!UPNSZ#ww29un zQ*lVL8b}Zf;HySC_o4#X$N__`N!s6;YeC*Stw0-@@9jve63Hk&VjM>~m^mCZ4?Voa@ zP;Z`Co|-{!)}!q(e{p7w_B=`9!;qH7b0UX{5`k5Bv?u)DVYjAZavji+Lb{5 z<~|OOnhJQx4HGmqpe8fDZkt#}WWrXY-D~y8yU_i$m+pN^Rs;=?bQG_Z<+je9-$=Ok z1G^^`|K}$KIP_=~Ny)yDx>Yn27tf(bkGJf$zY#T<5epJ&O$Af)us!mK5l^IY`JbBj zjY^8I(T<~mkE7sQnb7Vt-oVwX?9zYZZ2n}*$vbZS+s)n{5Xyxgyfqm{WZ)8ZaCU=o zlIY;f5l#(fyQZ2selozkmKaObs8q6Qd3;NQ2*jKk0r*T(bf4J2S%8$DIw zj(Obc1NND&vv6BYJh9#~8@t*e&?_3hniODoG68_zv}|94MaPXn>@*_>mxTy!E|-z` zushZcY{!vnz1sjZx$iB{>|taiTrqgKOLio{NF3O_8S|X^ggxJ;ZCYjJJ(Ug-VsOi{ zJwHPSNDhWLXjSZ!38BE@7mN4T|2D4$kI^E$*PH?|cBK~iSc^A(vuQ?ddw;r&assQH zN@YGX-k!g!@^9jon}2Gwd(Up{m}mLu_!ySe;fEOys?R~pb7t5pk(E#4wueWQMCz*y zh;d()-0qC#o@>pH{yc&%9j)U(bUaIM<-@xQ-)?n!r52%dpk&zhRM{9McY9(sRj-;x zpDR&|^B?_l>uO^8RuF1FYygbjo#C+E$8#o}azl2eINR#qDZPX2}mM^K0Ylh|jL&Ku;gJRSTRS>0@GUef!^In{Af&$w1v+|qs-`g7o=u4zJO867M zT9pp@6WKFiAUMdXI#p|8@h-dFQKp_xkHGNc?BF>&*tJf{aUdQ*Qbv1gX*n&3whxAA2Uf*M@h*!g0&$#?m?vdg zBDwg;=I*I;A9W|IPyCzVfsF|3S^*ic%vb}F?KbfMgKz-FWL(WZy15BEEO0I3J}mLa z0w0&|Kg`Jb;b}v>zq5=>%ja2QWF1ImG!6e4Fg0VZ2pIk8U}V?CmI!rFRiT)l7=541 zvrG;*L)jgA_D%)noS!@C7>q88sGwca>kp%8<98`)4w080Qxq2G7>7STIezb^0}U7X z{od0G%kz)MlQV2i0GBACRp_%XA{gq5nU=C9jE-WoNttVRKN zdw79n*I7MpK#zjWV8!fvvM+wl7>^Wc^KvEFh4Q4N*2kvj%+s6ZkpY(-ROAmX<|uMO zW<4?aili?pE@Db&)8(J9$Ly5e@Giu&dfjsZYuXy)y?vYbLueOm=$Bmthe{}8j&(kE zltll&3z*e7fKw>fB(N7N4;T&UI$bUHKQi~eOQ!NuX~Kp>g54eq#c4tkUW|`4$*1H* z4~$$v-+Rd2Hlv{yap4jMX1$5;x#S*ojV<3h95c;CQY0Qi=L{HbRS(EeoNK~Rs$;zovMZTfrfeh5HyfXgxuA< z(p)^LXZBG81W`KsgQN&D1QO3yx>I4_qi%CIMkZs)*QiBCBOH8cXZ5L(%VTrh$Ch=m zp@FZ`V&~*Wp&B_jP0EymN0XYMIPSRe;12fM%3MWdb%l`r6S*2tU zA?t^|WdNvYYz_$`s6<;|xtOrG8}OiQW6U|a2#Rf0cey$M5)gL9Ps+2@De|=DpV+ioD z?KaxlbPOHiWT3ZPKU`7k@0R;I(COv!@q^NY7-|^x#V3>MC$Sxe+y=GI>8DfRrR#cA z6S63|{>6DhX9U=B<@o)ebH#rE%ze{r5GoUPDBI;qLDGCMGX|hFcAyNwm7yJOzNO_{ zTn;S>5z>94iu{U@HKVu_rO0*1G_MM4Sr znZC|rt^Vc5p<-DVof-w3VC$@Tlsmq;PRf+B)y&=`=k~xs4zrAHbG5em=(xs^DXMQR z7SkKE43sOQD#KwVo{fn7`JkHsalqS>-<)RuzL_M#+`>J1&`|^MEv=e z4q;pXepQL;e$poNO%cCrwB0ex_PKoWF*Y79IIT^tEmZcAQ3VPv^^ob-02g<4QH9lkkh**mszD9Jd~Si^8a`xb)b!OX z=bF$S6C5Tr65H6ThHssWW%j!oIlpr>L%<h9p`ram`d@I0YzP5#_W&AFl5RN1Zn#l7yTux z4jp6w6IVzZP+!)@*mG7zIk&SL(E1>X0gyO3P8{For32@^gF&d+P&<30yKEKwh)T&n zrCC#PoShjpcNW2c#?f~qFaWaMU16c*eT_52+2YuFKYBGr(aYN=?&Z*5q^s9Dw9)MB ziay+<W8-oP2{~aywb|q`4A5(tsUR6XV zj_~gR_*TUkc9oEi0U+INRHwK~ms~%R5S|&jTi@5V+(@>^1na=k{YSSq$ssk3-xP>+ zD;n5ZZDIsbKlZ#-^#{P_F8~CbuGjcC;`m3@&g8s(jai%(?Qd=c;-C`X+kzsdvze!S z3-3TRBqf7C+=Jcx*&4anI?pP9+RZPstWty??Hg$-oz_NOg7sy*RK^z8)daG4%UftQ z4eRY*G5NX$rg1^-pMl~VSD_R@Ybn^e)%(l8r_GKgC2GQca;LyYx{sw4?azaBSGa1Ml5TGuv*>xE4EmdN z2JJ`-x-5Rw+*n?(G5E^&LgP7&`qO;t8_4|lutB(esQC58qqJ8*r9OMC=E03)9|Cec zZbn>PmZX_pxpGx;$_t(Q+Ee=%_|G$aAKxNjm`IAQ3OrVa^d~a#Cww}y(i6ekVh{G0 zc`hA3_Gb5huG#PV^$h?{LOl;C?)x?->$q6YkO4n4HwBTO@x_T4tPfUrl#mR)9K8{l zyk841%<(jkdn^*a(jRo`Rq&2dUt^=naZ5!0fS^5aoD&%hUG_X@~^Ku z-)UYoFiz%P6^AtK?UesC`0*hyPdq(l#<@t}tGPeCU<-0YXVDnvKgW0RaTxfGdBS37 zUp*Gzvke!YJgN&j^b(U2YK`1bTr}P^DrzpwqHYZ;f+pk|q%_!j)He<0_pZBxBIHyS z-5Ws}(8#L^yxHP}WNe)bb*s=bbMuGa*yz!NI^;)VvjwfH_~$_}3}=EmZJoqy)(6pZ z=QTkj44!SF)0GX@?%j$9s*Z7vqdgVPYSRRbzuHy9FDk=>+_9M7w&`R;BZa#?n#_r@ z86QJuLkFr7h*OkU8x_C5jg;!u40&Vi<&2E#*}M$m^#2o9I=aC0jwy(Jj;>BfjDWJr)0g7E9;&Ur@9?1x~>URRR}XLVH@vvUfy<&XYDa%^0)Y6tY^p& znt_c-e(1X_ckgJ-qU|CBih23l%Dp%8hH2aWtGW2u*y%`c_Q$CG_XIDpx5x3- ziB^ZLXpb4rv@!2C3BSNETsm!MMfTTS*gn*g8cB+{fn)rloQLs{bhKbc6qqYDXR>1H zg8QkFIWzt^#zGKUtk$B)j3$K$Wwbijh$5OPBmQ1wMDt)ol|KnRW+uApS zax)jK~D?)k{aDCdcrbqIXH2TawVYFwvYn#GUcwf-fyR5_DQ++Xo zz-(f46YDB6SEpQe*ydt3B@do+G+Ikwxao$CjbFhJr%#Wf+)5GSb8R*!Pk?2Kq09CC zM0KkNS|G7+Qs;biNnKjKvcrBV$xyG@YHea|d<2 zGF#k=lLmQ7u!>54$l>vP5yPR-Mo^RD<P8B?AwoU{te$Y|BRLB`+k&%O=X+K7 z$NMAGDFqY+F`F_~H5-L;Ig(B6ED@4){aSW&`mQ`ew|gYRM=y67I=p(jF-iesC4Hk250U<- za^xTR2l-G>B#N<{px zE<4Q|Z1gn!k!8e3xfuq6SP8T^n^e?RAXRTTAScSu;nSxk$(j4-Zx?REN22B~pWXNi z!$f!&d6V265X5O0&2(K_X-TK0SV~a)%Mo#{-YO$UVgYg5v?#Q*r1$H^WouDnbVaKJ zZITfs*4Y<{q^k~{4Pd%bq8tbMV@hDZMxfdoCahgnP!aY3YqGy6*v1|1?=9WGGZ&{( zROQQZkC*JxtFNhXtS%q#+0kSU#m<+@1++iy3zUfJiPpA1?>iQYW3?lm+kSD=pUeGEakNE) zx(s6L=IE{9Y33pKKUa@+N<7O57S!&j;p`GQOVKdvJ=Az)0Y@3Wx&ch?d&WTWw2g5W5ezzBI`-WM6i#>aq^Fb&? z8>i5{?_T^n48CDk4P*yi=++E1-g|Bp`*x!9{Ox?Q-`rL{?=aO%;mI~hY|rA1b^I17 zIF12FDZB4Xj90Lr(`xs&gT!sh^5!W_N?QRubI+@pbX@**_9vY3J1OPTi}Yf+WksSz ze`5vgbjB8;QITIWDmbw|st*G`3$ktsP#^9!RAA;iYf+-|w~~W7bk1IlZf$T*RCD2x zIoXzP&3&__h+xIjoIhQ?IzU%4Kv$4&{vUIVP;Wy04coHANo%i(4(W`vTFUqMtv=B zJL5ROjg5(Nv(y*2AU5aEQ?@e2*9!mmx@R7VY}`lMo5N);+sbjw-0%OE^!OBN zzx8<<+LXe#{9JXot-kki-WUaQD-vX2!Dgi(bYvYJt4kToFgZUY6r|&SUSr=kKEB}+ z7tb3FCtF&b5+UqaU|>Y4&_92rEGw*d@|?G{f>Ow+gL#RgjNo4-$`>hm{)2wSTEA%ZSkwjupzpJ-F`?4o!zO;Euw1Xxelf_uYi@iW z;|VH`KZk#pQ6^d(!ir~*C7+E*mIlEGOe$fmL6Ty-y?f;ffdks-URijxWN(igMo+(O zE9nVVZ%cL<{&0s-Rj0z?HaJI%imT5E8_Y!(K?7`%Gb4ZD8dLKN%~x#4M{K;@3p&4x z1qYSFvCNURVpa7G`2}koax*&ss-=OtL|Niim|CLw_A+(s=Y27W*^s#K_B3v?w2KRx z)?lVbSr}N*?l9uZuXTr8JHWSFlvV-=&mr z-zLUi6(juxwcnJL9{X&G{n=**xr%(JB8d$O+JOt-84kGH667J?EKw#Edv0|k`M?C_ zoSq(P&+>W>n(vmF$!~L9k!gfqzuB?28t0dI$iC0_VTgg-B9^&0z8&$83pKs_*0_^$ ze1MqyH7R*#8(e3k}7V=TOE`@ra;Qgl0v_WS`zCK|2-KmBB85Xl)K+Qh1`gi+Is}652 zy{YY?Iw%1AytJjTSQ|eR0WS5gZtvelK#kE4pyNBbx`!@I${J@sPoR(V*v_;K(; zFaR<41AB`|G9?e+C>%ArXLdDp`BCR#bb6aYtJ%FY3qIlb6{dTc*o3r-n=d@3Pz!V1uQ z*>W`@(=8c4kAA;ln4rirq4Yw%KX$rwRi6J^zhQ-u+(r~)e`D;^S&Lyx1wqm2=hVsx?+q4`>VI`ST~(Uao#)ZB=N;na;N(<}jxmH+hcjj){fnd!r| z8gg@O>$O@XrWq_zUr-oEHlfbR3B-Ske}6^fu=xHLM?+yPVhg~y{abB~zU3bUa#ixI z*b8Ehoes;QU%%!;eogXBb5EmQ?`4p>qkSAdXJ=xX^5wOl3q`Tf^2!g>4u|#@soy>c zLxmP|dV!Yv!`{Lxby|A%Dw^)U6O6fZxu_lGlJR}{)6tw{z7}?TSR(mo;v8SI4Nqgn z@(uBdzHKt!1-%}-z^T&gg}J#8`DhC?OStq1TH#0c^JtsZZ)R>NR?qrb{@YW*(z#{&5g0HgG$w!m#IH6M-e#kSamYR;J9 z=sKvDZ|(S=V^8|m;;C)q8ycie>N%q{5>O zL-=KEA(^-K)ozW!?+HazL%9aQ5WNxOH+S`Ua!TD{hwD7rSR?von{U3i+fYe+Nlg?j zkln32rOc6fSv=i}sCvpWWERcqWb%ZE%0Y^vI?;RWh*s^Ux>!0(#u}}8+}luK8c73?PTO6 zq1r`aCE}#LF2#qp+=x$%NoorH0B>z~Rw67rB);MY-|4xsY~1|w=wXU1o@^JEA!{Ed zi%Oa|`D6h3qa;us_ZWYc2`)^ku5aDS!L^n&3wHq`gl+HrI9702OJd=NIAH!+BSUt+ z=`tO9e{y^)o$T5M%r%t(!JP+eBcf8d7tr~AXcl8~>1|_g(cy@Ev{oWl7cknc{y05D zJaMd&heNB`tBC!V8u*vN zuKVjCkF0=F-0Uhm4vGpb9FofQjv4N|CKORHV>1on7c8Q_TVU)!sc4w)a_ALP9IGe9 zh>YmQ1{la&bXaQ?vX%o8S*+g?LD{ST#nX&dPA*&PS@X_GBb3r zF&m7Jor%_h#T@Eg9y%MMC?lr19LO0v*+V2p|1=ds3{{vbHWWB7198pMrhs|I{&fOh z_7s_Z{4)dJUjKwG;lCuW!oc_m`j^W1$hx`<->EnEggg$=iHU~c#W`xts>f8w-im$-+!47rOw;W?63Ib;iP_&mJ zO|fq9bPt+p3k;)jue7jrqdG{C8o%Uux{_v4hYHGG_1H}CKck0dk1;mey*NXd_%p*n zZLiUksn zP`~=V9Ieu8wSuQw*~=kxjdb{{2f;d1nC#YX>92efYk9vxy9(f4?TJ!J*~Yda;U3D} zDw4WASH5sXf}+9@x0wZxbNGh$Cleuln&hUvW;~mW$0QmmIf<+k9N!H6G39Ls|07>j;L>vi7?-7t{v zMkEafUn%cUWm-Cg2%-|ljtXs#QWQ6Q;>D_gq4HEk{DBp&8fa=OIhLs5(^vM?FMEH| z*o<-DKFH#ll~6$F*-3|7_)aO$*^WP!Z-#?%w}pI6giaSI`P)1jv;g6sQ+4u}Evu0$ znx`ST4`ad@`K*O-=YpTzp@BKBRGh-mg;Me*e`;k@y6kXoM8ojB|8fCczSpx@bu3_1 z8F$oB>&%Y~^-PowzbQr~&Nr^-eHSoht+?7Y*>U#7oO0T~5BLe3%?2fLJNIRZfE!Ai(s4bq&2#ZT9o;R@fl>OKS@o!r=4BXj-{6976!`7#paU1t zbMQe)Vt;mky>Q2n)njG<=KIVpRmbi&*8k%f%5n@aG*sXBIoTAU`!WkYU;U(9e5o=p z5gir3gQ3Zho3oyS`W}qjxtZ;m3ik2mHS|}O-_VB?nIvE#7D@6&UhRm5;sG?dXtVQe zUkFZbMhp8YMB+$~FBF<5H{@qs3U6K;xu!GYS==zZ^pZIRQl5gIN-cgg(sE-ge@Pr` zxl6{gosU_wpCZz0yu;lzNB)L^y!- zsK9vo_8crK4rH|ZQ#7}!L9_R!$PWbX`Wr%o;^P~fKWUu1$h8z-Tb1EPneKTH)t_Zj zA4Rv?4k*#5W^Rat#4S2kDz&<=y>PGvs5q*@?acSWJmF$kP;@UP*WGPP1#DtwTCEV| z;mCsMJo=J+`Dy4c-IFYt?H$zvj6%1ptMA6rFMZBkejs#m*!mW_HdyF}*b~c_rxkYT zm6_ar{z=KuJ)~Y76p$Hgd)z9|q^tpBk!6wq-a>;R&{l2_Pst7Ob{ z#W?H`7wKN)LT_&xb)8O#9rZIGeqcho7r_<7Bt&&@F1ymB9ga0Z@-7LR)Q>-xpCmcF ze1pNF{8Z1~C3$fs9NHoq-}P^5!{#AMZRH_=;}TZKiwQ()xr3}?CWb32@u639 zmJ=E`1jnd3R|VBi$1J_4Ktp1jqe#7O_IrR1Dkk6gP6|IMl0w)j-N5&`S2q)vQ?U5$ z@dWmG1?P0=4K<2d79QyO|iLn}=iv^S%^5nd>CTlv(Tizx zJyUNXqQNgXkO3%1!#++~#WUb%LQY_pX(2n=d!WW~Peng)$4B51DG_onr7D}yO%}gxVyo$1=>C>Z#lDA)80D|D-@83rs78%4u zjA}LW-_t0}@sMnyFi5_rHj9h38=ToID+Bo+0fe7J2d#o}Q|>QuO`n~@F0I+1wnr*d zU&BYFVFCOwP04Iir5ZpZC0ao&w71*|`+Cg5R)t#Xa&be-8QNgSMy;W3jx?U(IrN#y zy$GYy>cdzXcW@LP#IZISUBY99Z(VMH^T~(ZxkghJnBY#fYusHcbiXdmh{e9*3mHCQ zudXjR#}zD4uASb#J!%cT+Ptm;J4iyC&`u9E5T?9sZXPS&BK`eRrDD$|CG&Praq8QK z4&=A27Df4UMN7u#s`B-=eDODvEtF#OHU83HI88z9DOw+UH-A~VTedUfzk@LDlFUH z-6_QE;!(BuwU?D+HgW>cfAxUkEtA$4aE$Kf&R0u3?+7g;ff2cyt8X2OU^nA`N*h!L z&NBi;l$D%~^A0R6khUWdP<_>G3%rAIz7@LE{#~5CSbrp6HfSzSmj5strbOPV2XuLA z!ameuT!U8snDZx1%vTYIRD~UceSAniU57awv}1jj>=K9IY{6oi&w9BPybdw62{b1a z&4s}-iQ~#!u_xFN-y437alEYd1A$TT(^Yc0Zqfe#%3Gzw3L_@`N81%2>t+l_+Q@Qk zH7P1n`)dX1C5vhY$rD0B1aI+&ud=*#fYj?S8aI1WBF=PBfdW?8F`YdUH!580{YkzR zZW1F_xO_}u)~v~ckkvRD+PlwnsZiG1rv36XOo$61tKK^kK`{rM9lmeJ1kwIJt74)} zE=@U2!%PnoU=sC#w9{P8-13PbF({4muMFvgQA)9<@wbsP#aH0LV8r_iOaz&+b-wF3 zgl*IQt`zy+jwYQcN7&Qe2x7^EzPXXuO>#JYLC=2EpeZTDh6pESHp7W=D`9qVQL2h& zCnIE;1;o)`7JzNv%!U2t?>VRWYP;AHcB66ckmpq1p$_@td}HUG>@18J zVLJ^#`b(0@1WOuDPRh?$*64br7>Fx5K1zSpLD%S+$`F{KtBo8`YZPZhOUR%uE%_7Lyz0 zQRRYB>ZvwE_t%UyaNiz!$v5KZHzZE15tTdi9FkwMxv!C_$X58EZL znCU!isMC}HH>Qro@q5_pWmel9iO6-0D1Um(u5sLNf9*Gk#Qwm}tE67j9TZSumZ;R1 zo^KAO+|KBX8G2|;n6ws1ZzhZgZY7SX?_>pXwaGvZvrZdL?k&K!u2pFrRN^@#Cx@}u z{@FH?y#y#5?KsBu+Ns~NUfx_mP8^;GPdQOmtP+zUNDz60Ni@Q9g-4_JTSo2`yTpAM zI^rU}(jR|LxNrUZMi`fH6S!nlxZ?a2rKG00(6p?9HO&C)P5G;D3_zs4HZO4<0~^w% z$g?wni)#eGTT>C@)&shQ?BCfAZjQo{L*rQB7-Dk9PL-yrc1cdnUCkcJM)OnVOsykP z<2tZd!Ec+NS7=yYEZvwLqVe~Q@#e@Su3aMfeiI-=j(|dRXLod0rJjvd z{)ONjvc%%Md)yLms_q%;bjV3XfucC+`=zjl?LvHEXRe70^=Zf8rXni00Ue+`hiG=k zQd>OrOWE2*VchFg*GpgvXOjS%`O+R#OvjQ z3I;u6I!rsYx-Np>^qa-Hhni>qtGoY^B&rIKOb3I_9!62Pl3!1VA3)kM@t^z6Jmr{~ z@VV|-U%l@#u|PEmx$=Mt>T>?vbn!L3Z^j)EyU9pAM;2Nu2Rd#6a@h zb()qVR>bl`3r6^To2V=I<9e849=E`M{LFq|@LtKMyST6k4(-^AceIGLJ)mA;&~^sG zY=U8cooa-0YNkN8ibpvmCHcUx$IaqkZ&cjosoSoRG~I&ja?RG9!)9`n5sWb0E872C z17ZX}*SIQpthCx-LocKG`B-#jJ1uvLhFyeXgH^%cnZVmBoezG>Ji2SQu#N*vQ={;m`O^%mFYGBx*q z2kL!1*U4nZF4EjEBymcom21pj))&g0*I@hBK5L=hH6#dUgr+m(3V_UVk1u zI{(aTpM8$!;ge;T#1s1uD1i>gEq|yB+y0goZ~HjB6T4&qC>+P5%UWC%CNKUGIMxX{eZrxJ?3F5>3yiDTOxl^0FK$XS#0XILXYkRTyqz4W{ZL8lY17`Mj89!s z>pqUuFv^SV1Xgas!et|WGwq$KJ}Z%eoo2DLM~jPz$aYN!`YRnr(K;k3eaeNMe>LN% z4DLkg+yk}8#r=)4i}Cw6F`&MTpFzXJ-fYPDIRAA)^V0M(w)T#~g>JKmI^mv>a+q#@ z+OBE=d_5?}dUe>)D1)v>E-Q5L)k}Bg5kB`Ce7D@#Ke5TNnk28|a8M^SC7(zh?}=3{ z3@C-q&(Af*v95P6176S3ug>{yLLvpP*`@?6QT=5Qih%^0$Mc6EXWSZFimIQjcme!! zx~2){-adQu2h6E6-()yCdhCr4LWGOg?OBHopW`8Se~<@Az^6b7J-@jGNR!FCjV1-O z;~nexjYp!f9v@u^`A=zFxhvs(t_!waxkgRF0lfL$vy!o>Z{%I(U%ss5&bkE#Oih)? z$!BN7{$X&PN}-caXd=ayFAn5dY9AsTdLe-6vC z$&O0rHse`aK<`oUB%o-B50hL?_OW)zocAHkMJc_^TIBX(Os9eZrEfVI#?4C3+#M~7 zX!dj^l%uv<=k0{UHH9rE0coLCfXm9;m#R(^N6Z?1Nx52)p3v-nnv(7z;n4d|642ll zMu<2CBdV5TG5a4?fZAMg`MZ>H%MSTem!DRJX6+&Dvu$dSo~f4j zHx@c4ro1E^Yv9g)Mvaof82qwNJJ8L1P|>hm~iot|Ihw4?HKSkcpRPFLD=T_+(!ymu_!Q4Um|j~li! zYLj6m7yf`XpNH<3im2&FkBj{)6oXrFPzp3ek2o44&~>$&fv<8*B&TvAaZ2>j;OgF3;L`G=Pt zM}r^qMJQiEZNd?6VjGY8aGP3=(GL+Vc>(r_0Z6K@lS;w=lcpMS@67Fquz_4 zR}1v|D(ls}BoZ~CI<`})78ILJ8J@HRroo}Qlq{QyL*lo-%h%7|q~2plcGDX-ye@PU9O!h%fpTq548{uILC3fou`p*&eaO z+ktYNUiE-aHT}C@;PWRD9A9vwE>M@C>ifuOIIBNGzE`%3(nQc24lK=H{+#cNY_d40 zO)i&01G>!}Gkz=TJ9vFJBC)PYGzw)=X_xBEBq3&}V%?*r0a>nNzo$@g!Kcb4UhHA# zn&4npwcPP}D5|SUhm_zYBlj2_g`ygWJ%m)QL++giz~*A~0m+BZ?D5jT{eLN33nuhw zRJU0uocP|@PJ9Y@n5*{<{G?UJV~mz5(-_zxcJ}j|NL2K+{Es2`s5pYHdjH5F+*4Ow zvs1U*-(@At=a841MMXW=O$sTw^JFQ^Y4IKw(;e}4SUSfBiQ@S?5X=Gu=yzb{qGsSI+FuB$ ztIf)cF6LivfU27x?W7GT9lP1*(70TFsC(0pV?}yERbi8mzAYh9<^ zIq160s1U-u4G2L=*G(SV>W{~f+)4*DBNNQ0ZoB1LSmHh|c+6MA>lF){OO#Q{v&u<* zHdGxlhfl(0e01b}q|?AMV{(Lq7I~ZD&*s8tt>kQX{6!3#s^M#B1ImRdpBWkPzDZjX z?;e;po3g_#-@x+w7neJR)EWA)yQ4Gd3QW{SF$>8+Mg^n2i)LR={)P3=*6P)miOlh& z4XPV06l`eChOOPI= ztrhh_jHOCfetA+58|q7%|L~J*-K1T*sBRMIu9Mk$-Mm(C`&`p>^K5W#5}Iq(+8F$v zEBq}GD3k&OCRO#O3ePpH-5YcL5tbn zlCqPiN2TU|R3fCL&d=#&-Jc*RtK3IFEEn8I@wnu0YyP@i+Nptk4uOHsuVvU*G2H}V zCW&_b6Gj3rNmj)VK>|_WBl-))@SMiI+vg|hOiIh3rcAE>k{DveGJlOG&yHyB_HeB}kNzS_k%HLDEwai!K~J3UtM z)&_XHcpE{A4~G=n-dY+LuWra8>X+PDD@^|A0c`a%gO;vB;!airSj&0bw8Kjt67rn! zghX&(%o1Q)wyQ)7f_*+@%xkHbhQogZT58)|%uGzR0P$-=cpCF-HVH4f!)^SEwz^wy zSiWFxTY#9O5)b>IhdGt_AzSq446rGoZ)N&-&+!#3J6KlN#rYY%56)dEPJc@p+GHG+zQ`BTC55V#>w;zNi>`Fq$%n2P)>LGtawuYs zFDta`&6ql>FM)76>{|p9-cl!gUY{4^wmp<2s!L zP~^y;_AOt6mVn|6@_tB5NQqwNOxqcG!^M3AO@sH zN`TOU4aS0u3Pieyf|QU@LL?AEQPG5=l!O2Q5knxMR|zC}b{s|Lf1l?*=YFnp-W^_e z4MXxPyRN;~cYT%=rAE=2vy>YCsKayLrj*z3h&Pp_e=;AG5-&QDi`Hw4%*r=`OZ+mV zt2F4JMf1wbs3sWXo)HGy)V9A7?3u&m2c2U6!P%!lHa9JP@25-f;Y6kK@*?{g#u7RZ*%XU1C(W!% zY4@R^1EJmgSL)H{nmw)H=p+smU+%*%{^y6hTM5Ig1*kNOJyl zOA?aCD5|oD&X9{9<^i|9#!|mZ*)I6LF1iX~D9V8iV)_$@<3U2B?~J4W#B_ug#=ZIX z3(-}paqk$9E{liYY=nN{!#bLSrP<@xQZK*NOH|I;qQaT2@}=+k{3(?7X3TSo$Ed=p z&V~erqAwmO8SDT?UIl_lQ4(eb{wFd*Wds zam$~k5bgd5BcUkYn{Q00{VekNhySz&?dR=+R_@vI8?`*}amG;}T7F&mTG`5-W9IO1 zD@4Rx`L?cI!EF6gmv#2^M@nJ(EiHVfqrG$=J0~Nfr7Gi1EG`DsoytWYt1HCT5WQDb zkn7369Q|aovob2o2yW!gHDG=E?GJ|&7C(u{ZmF2)OmvzoQJY06Wr*Br)K>6C9H|#e_NL>$~WXprQN}XGXi8khG3!@zx-g|or zc4g%r%E8yFOk^GPPCoZjq29WPlck_{Dy%Ah(gton)11XVE4%k2h7NQpYYr)^luj|w zUKieM;9+>i6r74L;kf!>=HZr~70tfco3QHwq{8{wy^NjpBdy9VQ@8h!c@4euE<{*qT5|j(} zcXen!%~Ygn#v470R_cdpl6B?YE-P3b-fZ6|N?I@MN4R7W*$QurobnS|G90b?+dGg? zqnE)h;m~RPF4=W2;(&c@zPcX`8#$CKxu0qzvBW}7M6&e@c|~SAgIk`A?UVThCYRQK z^iq`h{NA~nDS43~7TRa%COll6#KU`#yoQwKyzOmOUQae-olN zLmO*JKjbu+z29z6*Q;dD4I#Kd$o-xz!Nhv^1ADqoz2L&sBkZ>-Tt=^n$+@Rj5FVw! z#}0UEdIK*e*PfTWl%}Ttd0tH{470`e^c^fRT1PxT?^%vPCI-%D8P>wouTp`Fm(_q|wehYG)>Q_It-HM;+w4k0K-V8+|7~+D zsL>LVy!o25WZP3j>MqMW`D>EcqC}rU7oE01$G*cmGHG@_&yW*NW2rrX4Pg%*ckSDd z)^k4e;n1A%^!A!8h&5sYp|+;=&E|4iuwUej z`tL)4(il9)y4N+kL%Oo{lHWK#79~P|iQWiT9o-P3D}ozPMHbgM*jvNRJOStDAnM)9}$ZOMt7;jo0e(YR^qVlSW~4oA0WNUsc>7N-m~>3a*YJYF%*zS$<02`tl#c>TomY_s8x-&l~9E-B|d=npd2S39rlG|Vk{Um zwn>Qv8KO3rS{Fp8HGk+n#75y5j{065WK~R$hmxzn0Pa^30g>!qTyf)PotFb7nF6nA zIDoHoVwfmEe(4n28;L+XfkP>tA-)pYwzou?l`L?Si#A;U8Z9E4{8VrB`NQ?O?O*ya zrVjc3j?0CGq`;|HG9o-vhe?!=1a%xFy&~jmyB_*E2Clmk z5}lJcB4=_;_UGY~#ts18aDEO2Mvby4dA+kgt6Bl;_et`;*Pd;U)jiV#PA~}<_d!JQ zOajNUuoHkYP_}auWTBvQP((+vI5KdffNVV@obm>tht5G5+S$gi{`PFH4k^E2;tV9D z?%F!*C_32jZA52w-VOjF0yF6t&Sc-(jU**oJJhGW@=Aq8(|?+Di83LnQmD@j;Tv2( z2S!d7*pdnWv_gLQgBS~JV9x=DP4wJJowp_HhWJKPw=6I4v0<;23k?1&m4YLwjuaCq z!wVJ6ke+FvHlOGeIs)v}QMjzs5>fHID@6IK2o13-sOfhWaNOn-6QV}lSL15`GIcv! zp|eJ!dV|33t|Y~E<{O00VxQ8K-}Y#UE@xf zenX?xPEUgL^x~hg?!jcBkpW0i#+_8WrNgy#uGQ^ZR+wyi53Xtl*`3*PJ0mpUDJLN@ z?{oKe?P**2K<(#e`|TjF_5T59e0dy5?Eyd}`sY8vzyCd|P1>V575{u()WctXwx#I? zdCY||U}){%)srT?~62_R-E-yvqfSAaV_NyJzys^M{9g_w$iq5xvOi3s|ZwF=@6op)rQ zV8+QJN*aRnJrLO+kZ=iFbf+>AP7Q{^(+V8k zweM7ckS@M|avTOG1Pg$RQ~;?4jvUU8;|OPsR={GQ%feg!f4bk7k!$EFA}4I?(Z-NZyjEOJ9mqZ2bxT@N%}ad# z+D5e>XSwTzVDH`9ZuFtwg_iX4^=X@ZwFH2?wRL5<1C!<^_m>zy2b3SLeYNjQ*NuyX z$*$PSp`Ab8%;tsQ81DUAXpVTj&7l8_f%X6Xqs5-C%e(t;T%37S?7dE#Pv{N2^L?6t z1LqU1$?gLDx-JleO{KXiHl=9(3n+Q6edi6ov58-9G`n{;XXxAh*a+u3cSgt426DG{ zDL@==x=mC~{A-xMzM%jvE&ft_Pgg<2hpS>gw)1vP2NP`kyg(dG=)eEtd3w8x`6%np zcsZSc`zPgoL|D2ujr{Vr^UiC|IM=KH{*u)@ym4Vs>6sMVm4RbFHo)t|`75IjW96e} z&;9#<3mpE+m;|h@@7zM*VDmuy^wJ^>plWXZxPU4Zb|if7+;^Hkj>+0bI)E-kgp2>{ z>gn_Ee5%CnY%5#>nK)m69xHz5Zz?A~Uw!BoK7Rd%TFUq4w)20vC5CnS&^A|=!pg9} z`=aLKh9^JOo}Jwqwl#L0o$mJs-kWQ+$?fqVggEj`;O^lgkk{%f58?V}`N_==aZ5b; zqp0o%45lH9FBLOozS4W!ll@oGX;Vzzs`UkqllT!CaOK7C&u2ojeTUyM&eetRcbxi+ zC$k}kjK1I3g!WQW&oG1wFP~o%+^*D-+UU>EkXyAq>xS#eF44N|Pv*~0gAiphkU~|< zeFKuZw;n7kIuCGmnCZkkgJ&X2$6VJ{AE}B8qlyrEKhjcH*cwC`)t^uel79r1!)A#c z+Fl4IaISfZQ$_a`W+^+loqAV-?g-#F#NqiPb~8iG%78m@Qbb>)h(LeAvVe9pccty= zX&BgQlw|$N&)I`0DOU(-*t1su*idU06qu8x-t2FCCrQCAJw?+q8Nf{F?mXH~ol_{y z-q}3U!E?f;xI#)Lss_W8uRYZrL5-*SWL8FP9k#5+jXc2{J1mJ^oF8StKwKHvw$;Fv zMvF*+a;sy{YzVoLjuI?dL$npwIr^3yPXV!g{PnM!drZl}J)M<7>|_!C!7F1SGh*Cc zNPwI7KAtNX(O?D(r_%0FJA=lH1yVQzU!5ra^gMg~JS&)Z)6G#{?Bg_5U0t-Rbdmv; zEKx$c>#?_1#G&?>5Qg#4_(u>bw5x5p^)l#`T2ZF}CMl6~$u+@n zeslEKr+J*W568*U&mNo-Tr@L@<;S}~ zh}Y)|;@3U2+;v^O7103aqimIHmM>hhmksQ<1Gdm8got^H->|V^A4YezXdrNYSFQc2 z_8(Ip^3LZxJwtEeGN)GTi4{aU0d#u;LW4I?6+O!B~9&FxGd;7tdMTPNo zaZ*JU2-+7k0)*zDkYpAJBhc`dX@;(opgE2f|0<4Id7{Epy@_1O>NEvcn%rS3H`RYW z1DsJ-+1&LFbs(5vh<=1_W@vv@=b*@fH>{tg75Ow1#WrPjD14pRhxUml;zPY|O=ZT( z1t*8}B19?j7Xh{~X@r zy6;kzl^<#wJZ`;gwBKQD$|1L7a~r6RWyKP(sCD2N_{~6!eI}lcAWG=g-fr`~p6a&+ zGMKfp8Xo%9{CSa<6HTvp1aiV;DdagKqQh$!gk<@B>OYu2WFLzM2+L%!a@!okLI%?| zkDl45KbKVb&ruQL`l+1OkV~G^{shU%?x}baBJR4p<=XDN(i#5=n~-GjZ%Z2FuKY3F zpc!|w-7`^y!x0vi8t?I*gkpX&$V6J zZuejI<1zrLt#c5VB?XNvjA0Rj*VSz(Sn{DffoD1^q$8~DgZUZH40v{P)k!q(!entx zZIwIoJvC-wgEg=uPd`Usa^TElm~vki{?}Ck4!Nq+(ilX0VFUFyzZi!AovW60g#VF) zgebR(Np(Fl1D5j_LlsyhFkqxOr;2+Khm+UoE{&EIHi~dB;WxI{g^M)+x1(Hp`q{&& z1GI;C%7b}b1N{f?WD2Lw*9f?!!`-?7zZ$mV0`)iQrK!@l8s6}&+Nq8IYAoIj*N6)~ zhswmS*bLAc<&+cTgPpd{K9#?NK9_8bZ*r)|#nZlRZx!wE- zw;){QdJ>FIRB=Q&&aZr~b{IV5AL8y6p*IsCo`>x0L(ENaWB^WlUJPR*x@G4 z)*?C2=2UCLd*wsQ6nCEmU{WRB+$fVQqB;U^&5NRia#TTP<2&Fq@}xdJeaG^$4U}Y- zex#&`$SHu;-w>w;zc={W{&#iwohYet0Z%#)>SPF4VIXEkVC`O3R2x~0ZAFR^My`iJ zk}`CPj(R1*s+VOaRt*_mNQf$3lU0Mzy}aNDV)eVCKU#8)T#xfUtg70iyc96c@U%?; z2S)f@7qt)Y5tF|};5nl)Ya|Z=;}H0Hs|lIkW@^B1dZ zvpa#fsboC$Aw@Z>Bx>4pnS=`pgznw|Wp*rqs?G zs@f`rBzK|4)bRB}HU5ro1_!nMUYf7nO{f&eJ7xHG>&a?O2 zHmXexyC=}2AnsIf7J@DybpB>T?gD>`itR(J@R&Wn5Uwt59C@V^@K(PLE>|RQjK<01 z*tmM^*p}F+i91==l1xu_xS3LdK>^@3kBXdj+!}$zP$k6uK6t=pZ+JvBbKw#&3%_0? zmgCpjgV|NSR5ADNO;2c#dEvreaWX~@hO6)HzwR|)?Sm7+i(!>1xRG+=#9JOu{_7Vv z9k0)?f=_h-k&@$h4S9L?i4Ro?^`dlnVM0v_sy}1N5@v+BXpML4f|-dxFT9BWTcC2c zDxvp0(1=ZRnq-IwRS4jJj2Iuu%W@$p*4llijn7tt#wYY?VwXSH`%o04Kle<(mFE{P ze*$;G7Qd)Tk6@~@KBoC&>#;k~hepYf?7P!sw(~i;u&_V)97SrxGi$q;t@|+*a^b_- zUvSL~0D=F4u7<5H02)O9IUzi9P^wn9#ZI6S*l~Y(vptv1#wPsB*~W`<87u zR+|TBdP3$CfMvJ~)m_Odzk@BT$MGvsg1s!dZQoe|IV;1l1-jhrzrKy5QhVyOD_)$W zkQgqK@~ooWxF7EsHRLeU-WkP|1Ne{`&cTI#YA!!HkO#QX2*287mV zFNln*N(%0B2{CJr-b|BbVWS8}nXnhLczYUbXaBhsaSg|^3fS>mr4x)^m@QA%fxM1w z(Vr4aCx-_nB2Ts%5+W=9bAwU^eiXahJ3~MJGYDL(N3ep3$8+?5b~WXCWBGFUm+=kg zv`d&Q^vP{THc}Fn4pC7(Ga-d>ypYegj4?~Gp29U!2e7F|C32j`!36ZpjdE&)-T=qN zW_hdLy^y18fGOA{=VtR1KUqy$WQ?-*) zJyve3>)+}HoBr6Ra(zM7Wj*zB%Fu^kUZzLlUP)%QFCpBpD~mS+HC%c<&EE)j1Y%N; z*6FuVIx1F$S5Hz{o>}K=BK@@9VWZ~z$<=P{S_Oie3%yPPejGZvurT}mOx>E09X9iW zqh;tw#+P;INOCoZ&mI(c9yr;{mq8H|@Q|#(40Y7nIVj98oK`Yd zttvUkr6h=vFXvo2zdTLtNws-EKcGKWx>PEh@MvdJuOc872J=UCh0E`yYVUb^WgyA{ z&mB2TJFilE`TJ2lysf4OVG%B9olplYKA0JP`NNh1KG;f>8ijLLS!M7rx5Zg5^sJE} z)tcOr7wE&4*{yP6p-5<9@3l(S5{7%saUr{1?SOI3P-Y-1 zLoDk>UoI)a(0zW+|_VD&y!bQ=npqv>>#ur%ra&Z1K+2|6?m$+9AQl>W0e#Iqjc7z zvSM{Q-K{lW7H%u>?-$f(QX5ScTrOBFj~%U|Qg<|Lc+`@inU@~YGC?J$N3cKcFL~K9 zVyP@fdywj#auimvQxx54no*T?1=*`p3|=`wvmK8xeJLFi35r}RLI66>~d z@$RMD_K z4?h?OVUs{`Pyv8>G~Hw8(TVT%LBd<^#_PqoszdWlaL<}Z3-_O?h9_Iw1gm_yAINCi zc3d%eEVCwvLH7SW_@y~Bdz3KsAUT2xhNNenGjx52+(X9lJa=usi8LMM5Vv_ImGzkI>!R(f#ZN%%mZ_`v?>wQ5-_#_+ z2LoPs^)tDhk8U_hf#4R{xD7mUe{|WBd7YgG@wqo_fm80?!8hRmtWR?n8yD3$nCmt( z*}N?roHMU$3@C9EZ=IAkcwB6p;nJQ@jreN49WC4;TWq^vH~>aAhM2@CN6-&E8B&WH|n^yLc?O)2-?JIGH~b`1(QLs!HCdE{hkwO|h8lrhEDH z#1Vo=iczIE8Bx+m%|YBDQC|po(-`FmCDU!qF98)TgDS8_`Q>F$gLIs>XgP$nVpvt| zO$S1nHXPwR&nduhx_z*q@PR)Vay!og3ITgai~lylQ|=4Y!u>?6e*a=ipeTilp9exJ_LJ>V0^#%$ZJ&sRl8r7u?+Tpeh8iwOZ%v>U`M3h+R6} zey7+ucWGL^6)V&~OmC`OI^Dj@7rnSs%gQrR$JgkYT-ejz$o9*J+wBPl9O6_IE&GWk zcb+tazB|#(cCr%$F1Z@BwOFk)oW5IDl)Jk*f&kxc@N)j4QqKuUDeih(Ei*O8$;2kl+>Rk)k{`%b`4Kx z0cz~&xxVY-bTv!yb%gcT#DF&!aQsC~Fp~L(L*FQaivU->FZ|Dh0_^6=vnL)uXD4d zm9S{7LnXchsv7HYerN3l`!X}foLkif=Z7Tsgc>XicsQrn(U5^T_0-N;KbP}0!Cke) zLCN%UWbXqsl^(wmr0!)}Gz%JnT~h>es}!VCsk+uEMX96-A@6nIjJs)UuD?bOSZ>aT zgtyqh^1N4n8{P4dS}>5xI;vB?DB4rUWnTzf9@3yQeeTDH_GkCjt^Ef%QZic^ll}8G zSgnGuA!*!k>ckA`>#52$*c@yP4BdSx<2hpEE-p*6Bd~Dk7!vpObbOYx)rlF8xvy)* z?!y@`To^*#o@6i6*b}u@l#bJgiOu|>x|5umR|*{oq|0+&EbHC0Tl<+al%HFH9`pqx zQA1ZeyHO@N4O{(uSLlF=sY_2Y-!@s8#y^^0L$c0IGz{%2+*SVS0WI?D@|jcV5g-C0 zM_JOK$|X@FTznLXeR+qODE;`g&dPZ)#${pBgf*nAgPzEm=T6sHsRJ2l&dF92*4?0D zWn1IwOP4>!IwliFEB2kLEUgl@^iUSdzydyyyu`JYU@nV|tJ^|@V2jIA7V24g6D{Gs z{l!M?=|F*Df-PTKC*4Nd84=LxE|oabN-lSDj)#@^qEHKni}g3M6^U^(-S0L2{*sS@ z63v+>J>y`qSHF*hf1M@Uoi|cD*~0Q&(HBh@_%oCRPvf&g>Ti{DOS%GuP=6KArjfj) z)~zD~E|s8`<~U@#rZ91b{`h&xR0oMo?PDx~o|FECR%f4hBE01I+~7~s??^I9(kOl0 zc-0*=G;3RvYCqgreOsu!-WUZuGD5lf4#q}KiS85>RT+L32`qF+nI@&6w7Eh9m!YPb z>PT)y_}}N+ZNp|nd(zT+ES7FG=4Dy9^g6TV8g4ZX7q}UWjcw5%dJz4$by6oJ{&|nu zuF|D#ma6JZM4B6-$4tJjc`?t-fq%NaDH3yNp;gs$dA?}+?MBYuBLzOm86lu2e=nP$ z*~mNZ^xpNttFZi~>G~bpGa?wzSe`+gqeCy}D1uf-#U}XMMibch-exiT9J4h01RF zr5KOFDfJ2I8Xt<&ELz8CEW??;uYI-|9?|E|+F#|bS>)d{!lhfurjjG-GA&a*hJ22v zMKF*oS-R0#&I@;jKS8w0IYt%`V_9?*hdafmG1 zEm?p2zEa2jKbTiPPwkfKh?1sSWpy`-jbH95g*{Ai{Cu=hKp~O?`u8HZ_-93B^LL3@ zd2Z1;1v+WLFwC8)le$fPphboueX~G4`jChQ9wD!rBt1J)FOhO z6X73t5$1iG6B)?uKn~_6yBc?>M!Zhrz@2fI$PbaTN^3a0_7SZNVzuJeH@>^ovVT?y zHX}jHj{{YkBv4=w7g1Yls?$-HyF;8rR%feoRorf|-IGpbzQiHvJza}qm|V%1d^)-n z>Oin_v{BLw>3z2AaPLdXVi2`CL3Jd9_`aR;$8JYm=d$W~mRRzjOG$+8Wvb#eLeH2! zsp+|KTYc4pim^-E(v38EC8rEKx50uR@{LgrIWW)YAn z6(cPyyrYHvw6IbBpp0_}^MSwy%#)yGg`0UvwsZ7%qaA)!|8~xWu|cWCG!ONW-O~P5 z<&mKw?dPv3wR?HP=fm%17`*;n5NYg)Qn`-s*; z8_5;x8nR|K5doG`;tf}9h9+TLb{)alp$63;ZT`1K&&9au*m&+$n*}JexRPK|r*M~d zjS1`rJB`o#WPP3Qb%pZUu8iR(pRr>KuF2Tt0w=nkd^B6r&Wn=@{@ zW(`4&`bl2~MH5zisL=5IW4(=iwOPnP`6xjyj90KDy1FSP3aL9aG)t(ebPBfJjZ+28 zi-jl~q_wGODfJOCK-X8OnswQJzORyXS0KxE$_7g=CGec4Wuc0|plZUYqEKwdk~ZVg zLn8djmK(qvGogxnBMHc3uUV+ZT|s7s9#>-ZES1kl-`E;+GwJ$@<$S1kdGTHZ#XOX0 z>tE&RQaLCPqcWvh)Mw;ez`7e&Zoun$02zjkM?DVTRpi+e=4}sraN)z^D59W3W8rG< z;=A_&i*R*y87+CAP9<2Y=jgiu8v)pUp`LaC%e^`)7Qtr7e-_TkehqSJFtM94yNL@S5~ny#sWwS~ik{7l<>`kxuB zzu2ABVPr&-)N-eQB_svXOWAsJe~OHBVWYAs>fEpv9h3L_JO70NZDzQq?$olbDck2` zcv>R4JLrY#ROyplK!{=@nE|FvB}+uIXMkmcN(J=>3QSR;X-!H%eY6WRhiUtl5B{@S zeqAA4ofv^RbCeM@zcO+;j;t!bD1cKyl(2C6s&Em8>?fek_09C>B{f(sdsTjjC3m#S zz2JwYo^vVXY6E|YAdLSZPiJ~uMHt{>+7-ZWraFdjH-}U&woQZ6u!@eY>Ql7}%0U=M zkDHWH(fwjH#sA?PWmXB%o_j~N8fCFKZrQ5r+0oDtxQJwV60~&K@~c9fZHjihvxGPliXbYFB}1ZQYb+SdEA`>k3&&)Ksa37rj5kBDxD@mE9A zu#V)w?fx~7BR#!L>k1Ri2~4o&;pHwhEj580i3JJfR$HfYhz0~;n{)yX<`3g?ym|~- zm6TVk4-OtRQ3PgrwRh`oPBx4gMvr1W01mvk6O3k=#CCswe-`;nN=ZWtOepEr2tu&c zk(?f~azAOhC6K>nBek9g>v|^VXg5yw^w(u4u#?MUK4bGxlRhEG#)-v|i-~2FTQdDN#Wn2v8p6{+w;ilb{M0s`Ke1dBiFzTyQu9O$!$T^o zy?ze;7!I6=O~dcbA98;W%6d3U9{CUhDr{8qI;BJuaaY(wtup_(;;cB?B?Fm` zMve;RsTV{g(KG@+zAWVwfDn|lf=c`GnGOGp)I)uqJg#MWbiiCSYrkrwWJer% zfg4D#&Ry4(Epk8DWOw`51oIYIw;ikc9kPDE%z4dv?CEPikL2uRsmo-XGeRK^Gc)H` zd{?c-ascDr&k0Zgl?5FsBF4HDCJdCl2?6Yz=<}j75}oe<#ee16%M&@v=X;`OfRjVJ z-!&t!E4pfaM+|>z9eqRX{F5cPva!)jC<|J%A7TnW^?4RldKMZOc;u}TwU zzv+Tfgnwm#C`&ps&pFW9a4jy9#8QRlJ6wtv6<7S}l_)Wc1t=ZfKxb)WRRc&(Xp!)h zCv@HSITf7Xzwknv=NBl4YVClY@#|_ZTix#*WtH_u*KQpKuKHra7==svG{?S<$N!?Gl(kCZ$3~MTnP*RL;^v(jodvkEI6kl zpQR`&-~`g1&qsp-B{qAyXf%5e>Yv~M=Wx+bCGZmCO1ixf{aeIq6*i#J*I!F?)2#Ek!N$L zob3Hu>`0=m#w5xy0=NuGN)M?#A9FRX>iG1I@oHegHCBts7#m$M-Z-o!Z{Uh{gBiCN zEsb&l`lA*wauH0R>vmi~D6G}jzDt;sv^l(|>*rtB>Km;@7L}`9KyM?}yu)ddMTH%tjy+4LpYE6KBi|c_L zb-6uV0guH4a?_3kThfso5zB?oAYubtp+yFu5GV^M^^`VlQ+X~Y4-70( zk)uE%e*q1EYR^UGEW`UKJTOP-3j3->Wtc^EokX+mODX1fE!qK)V-!C30u;@)ZuN1v z>F39{{wBJv4WmQ(p;qkP4tpJEPL7p&h8|ZGR*w8K8&(ya5)Ew86gnu@cK9~!ld(h4 zuS|_!MN0R%7eE(glYslpZo)N8q=LHrQ{9OfgcgweY5&nRbmNJ5y}~jN)SeR6ShgM9 zlIVxxhtb0)AH?`b1}a!)I*EkyH{F27lUrxG8aI+k#~XbMRC^x79aWdU_Dsh9>$QQ* zDn~cv6k7UrusCt(>2HcMBU@t4(E^1-RT|#cFuJv;C$*e;?X227uT>Sm7JNVU;p?Du zH2`rFk#?E%1_(TW7-qE%Kr*Fbi;%w8Fql8Oa(!YQ*Wi#$$~2xJS9|!6E``a|MvwxG zYo2*RUh_2y8#8rc!?t1AG2HBL+})cJHji$wdk=)4H5Ef8S{r)Sx&U!$=EH$`dXb8Q zlqy{t^ojW_sQ0@2%-_*Z7i@m*8myB4V1xfin{9X)oAN9Gt3xo;AN;0GkNdIfIk!>4m2WTSDO`HrW6}a<~z3G z)pBgc8dg3~+qG}4zD4lH;EIrp*BBM&yw<*g_HX;kdP}DAAqQU+#K!20O3AHd2&L>p zKfSU`g3E}WKcGNsS!uZP2JHLlHW&vKQBSQl1j9IA@3mbQGlv^PlzCsix)sA1FNY^Q z!IRaSXTAvIzlg%tIG?<#`2Elw`_$^P;vg-fIvf}sB1xEE+TpVg70e61%n;7c$pjB) zpRa^sS8G;H+%wRVL zl=S;j$lLk{O`53Rzf|uA5<{DWuaExD=ZnHE^3axpJ`#_bBMS~m;V#0e+KIcpd1CH4 z@!AD)pe{3QT2zINkE_14n@ZgFMd1dn7AC5ZW7r4klskNrFg|8KE!Ic$z3;dxWwYAT z>$oiN4z^X1gAibo{jt= zM8rYS?TdWu*)iE^xX+ESjfShgDMC3vYQIl zb@}h<62+UmHfV!&E4ON1Jv5m+j(pn7AHFd?`NaD6V<05Hg|kQn2OJdsIE*_-JJ4f* zXgCN-Q>&vZtgQkk1WEn1vR<1e09oRIs3`r`QJJ!fM@j|zi%2bc+{Ae8?&rkMYqx*b zZo8g!$XP#PNx$JL(n>ws(`AtRbN<@5BA3&_%~haS9tZjHr&`y2M;~3`z63Rk-*H7{ z$v3-QTQ>i!l>mC8yKS?t4@7&tEXa%*{XQkuV{XYFPQYO56oykb`%2$1|2!uWjn1%J zv9I?Z=n;g+SfqaNmXp3>-i4U{^cGYzSF+w-Azqtndb9$+wQC50Nr2o{U)la^ALCz3 zwDkvr?Q8x{tBxKFmLiBR5YH3A8dwY}ivLT;-1etr zYNJ9|HwcOlJzi)*(&)ETAyHluWuV)BSY?qJ5S7}`-!&s0Z&tBx5_Ri>EU;u%q2|8b=nmlBGAL%a5LGkZF|xDX5YgDbPp#v z$1FN9Ph6M3$IfG)8HT^xq*F)Vq~m;eaMk)8d=j1Z&WHQi1}xVnM*?(bR{k?hPSUw%cB26^ncVmX4@^e$-S>)^Lx-IZq|6 zrDX11IS7KP-mTxe?*B7G`2T4e{P<2Wzr*{?Ws)}vgS{$eQ>m2rAoN{FR2ha!(+pA7 zTL>}nS=-SS$HnmV|jGXHT z4=t0id=D3;v@t8m=*4IlJD#ro(6&&hFB}i#vOJTl$PpHm0aKGrbkyT&uZ21E^24i@ zBX)ntd0Hrn^&~k>`V}@N0YSW+8{qvCONyfkH5bb#moZ?ncdEmC^eljvmP- zeUp^wrsm8IwXeM&($&+92a{NsxG^idQ#iv?t*9QisgCEfAPWqqn3AJET!4^nZ8W!N zMP;&%vnJga)Gf>PyT@No&w&0A9E!@CP9=~_eT7eBPqESZYWjKUi20i=3L`WT2^%YY zZ=;{coM&Q3HG^^#ZyLjwS@&6{!{&Q;jOGSY#`)!lCLru!Cv3LrtM>Sdyy_A^J zF18)!=MWS1eXJl^^>8^Wi<+l9T&DXK32S>IE42MoU%jqouoE?-QEru-2eLA#yk|vZ zMpG%@e<_ilg-6&|VRW&I4$1tZNCtm*a7 zh1aL??ll)$UU)Hdkf1g*MZ9shtp)FuJOv>IfZ18ds__J4b;YRh7lHL~xaw}tLgv9a zADu#WK=*@%meLf1=NIa{VSz3>QE#t7Bf@h_UikQx5_+ABc>`$5?@<09y6gwCrVQV= zK{i$F(!drevdz84X(@{JLWiZ_%%nBAwz}ZnxSh|GPlW@fH>&ZaMrC+m74@dDJrbLc zJXeT>=OT|ScF-+>W~SgY$ct(z3ZK2WvY6gAm!_*eRCKa!$ug{RLX5m(72kYF{iFoq z;BS2rtra?2N7|PII}>Uy)C3Jwm(Guiq4)M7F6+8Z7*gaS49X0a7*&Z9+xi>?!F9j~ z+2{c(kT|2f?wnuXFV4Q2u&3-s+2ak^853%7J=clSM$Ihe%qr%3*vFkd=*EdfMCIq$ zDhknY!m+}ItonO+&vBMm9uyRX9ITyAHPk*RU3h;XiEC+0Zc=kZd&=Qp_Jo}TyVV%z zl68uew)zrz?yqSAHgf(WvM0x2h9Q<{n9HFx6C5zXJWy}S21DMRW< zo>tH4I->Dx<~gsB#1q2@x002-#O71<{qcw2F&H^4;zmnV9kuZuL1$c|3|`BvN-&O9LCxKrqYkyh z)kFL7mwGWW%hl;+p9g)XujwSwNAd49+OrIz2-Br#@^jzPu$mU$*gDpD`112Kl(nv~ zaWPSo3To@UFIAl@E)8Mu7O_g|5xkFr!f2P4EM~Su4<33Uvnoti#adBrsI@9;N>LRy zKZX11R9#?JIuj@RvN;()GS`0v1$CJ+3-9OQVbk z6pew6qsED4(P4qQ1H!0+$jL#da^CV3O#}6IV={4RsIcHDM;xBXfq|&=3rN*SoCSqX(VR*_h(&A2Hpy zV{1ZRptG)`VQaVtBbwxWAq`KZS@!!)4OUObf#9%4L8rE*ef4?+hIgU5*T7t9P>aJd zvEtX+a?j+@<(UE2ZfqZB&}S87*iU+!s?EX|m)JY^q2@GOPz>l^AaFeJcZAnFISE$%7gNDU`)3Y)GS95J>roBG(}gu$0wUJ!IB>M zcE2dI5hhq(1c%jF5E!_Q2gklZK<`L)gp=@2kyEcg9LPUks5yU^_xoFK;CPmWLqj6Q zm8p*X5f^kh8K(Ya#uL}9sP?vp$Lc`%dECBD2M(klM4zf)L`=vP8)e6d>E6<}A8X2r zE3;L+HqE~eY|ug-m;o&)93u>Oo#)~Vj$mu>D2KYSNnMWGs;-htebwCL*(OrS;IfVL zYTR{vw*rhz5SkzxmFJauEG-`oj|UF!XD3>b`S`%zlSXz%i28h1DQ`(E=KTZrr@NF{ zkCYlMbYoY?ezQjnhe1Xq_S)|yAf57p>dR-(UX&kPeb>-jIdE^=$33|7VL$>&0pSk- zofnD<*$>jd>z9Ifgbm;Q)op!+$||SNq=(ej)~c#e(G<#Q(UEn3I{+HCa2`vjq$d z`RbhBaJ~eqO}RxK&7XR`|LOpKL4D#g8Z1vI4eoD(taxNqC1n>s&k?tR-%3QeGURVmi>a1oWb^UTip^SbWazx7&hG4Vf=1hr#k!oc)DCr zEOT1ditREi;jB&WxpOARkZ9+wM)0oVbm|zldq(uV%QBk0o590puED%!u)QC3hB=B! z+Q+-w)%Bf}vu0|yPG^lEYph+X?NRYhe#&d8`QR)oU(GLOKiqZ1q(!dy+#t3?Vh8e| zN{ux=6){(***$Y_0f0g*)&||X)RNSs`%pJjgMD_$>Go~h(f*YPNz8$1z=N=34($-7 z9AVTgL895)W|>$mkV2dzWxV{(JL^=VF#XbBYKz@?4Xxw-eJ{?T!WT3rhGQh3BbP!7 zwFJlDsnURleZH)>}qRth^ zUp-dr8GWuny}Snk`Ex_i_@$QYO+gm077S!oa%CU<>o?$vFGlzfWfef=qc*=`t=q}F z+uiWyGDOAhTSpXkXbk1Z8ds-mF(LI>K9)iM=*kf z)O=z{ZhYTW?11d;9oy;<_LL&hanosQKyErbO zKJJDunu%3l+Y0b-?sb0FK{vBgTET`bos&PCbX21fY*ZH_i{%+Pep%IXihkNX4S)bY zB~v{Jf&8_0Xcr~jbVp5)GGst@c|tBk_N(J!^FUuXS2YTxvDs+7$To@Vc3<@;F*$h~ zcOG!DOA#9(q=4DsbIK6?ut`@5d81yrh>Piuf*xpUT^xn!Vdt#J!q_o=QBj53@W>Nf z8fHea^{{t)Rs}bn9Q`Dy(X3OoKP&&eXU{{2i-#je_v`s3c=DX}XWL%0=h#fF*Afj~ zE=Ztuex^j|MfzVmkD4@e-a$WS$$2-92p^E}`b>W~*L>&VXvx*|{H{Ni%BP+g@;>2a z@o<#wTc}=pbW{HxQswwMQubPB-Kg>wLL;a5+?mfG_l$)h<3fCy&)HC<71j@Ry49HE zB++9)ooBtJ)Oe+;%{Ncq9UzV>=XtfZ?C$QIeW2~XSk~8zcUC98a4F34?g&|MYYjiu znSNIpG2j}Jnz<|7iYxepEORgJn0-HHIuu~H1nql1hT2_>wdCiXNOwzM3O)TISxom# z`Jm5+h7&2R159i z^QtT)c7);>{T!|sTvX+X9Sq9#L>-Cfmn3!nFRHFPp6Y-9Ye=*cm091usR+rIRYG>+ z*jtXAV{`07$tXg@Ja+b(*0GLJX7)VCI1WkXu@4T8@%wbY_uj|-^^bgfj)Twp{eG?I zSlYFaMnf~_w789+yL-GD{;>nULuwxzj2ZJWF@3WA@$u#!pdNy}r5;;;^pjQD@4rnl z`vx#258pFA) zM?t@ zZDAwVFa2ou&e+km2!82NR&OuuzWIjIT`1{Fi|@VXfn)wTu-(d5r>9-|aBufa#8Ig= z%lV9aTAOxXyy@gH9eWfof6OE&^GUJXYNw_Q^~7?>s!knk`xx&v2~A^*;F4PY_7tuR zzXU879IMFKWUs5F>eMaoo;{x~sX2W|dr)bAo`Kky>EXB1yJ?cniP~}d+i7V{TylOj zbK$ikVBai%QM@r@P6r|Xndv^$jg7Pw*-WtzQ3Q>!v*QFWuG$m_$)_uANFp}`#0M6zfHq;$N#sh_^-p1^0g-`=YO|9fK-#EZUgg# z3fE&#S+*^i4sO4Qz4NJ<2avr_85K`Mx6%@AD#m4Q~Lk+%>Y6Qf8Brg<+JFxO9c>PcImx&8m|_!%Zn zX<~ofQq<~91CxOXuJY=|P~K-QuGL0H$X8bRU~Mi;e@^#D^rmdJU_iN*NaaCo@SM?s z{3JD8>F>$-qAq_`!9cWCkMs`FblyUcZXQ=H#Ike(_a6ZUtg$tv94dEBQ&)Idus`fz_v2?~g{Kp>ET?PW5VMZ8BIoME3q<_7aW zVEmc7Hj2*|MpD$2+;Kg_=V*(>j1b-gWVk9b0`3s{tLNdZv7x;P1AKIpVQEcEK-48) z`*5R#Ji(s&NoiMNZ))y7aocjH2tu~FJxZ?`oOLzw^7=xO*DqRZjhzwS^S!R8CXx`R zYn%cXg|%~ny4cDqYJwEcECO8T=ZgQ<2v81Ksh&fVfl1|94f93b5#M8*NzY_6Hitcf zfY=)VFoTx^m0yaH=YRqr50C>H=3_@pHAPZCYl-xKys5GzmQC3C6&)yP`9M9Eryn3Q z8w+JI0QlCzw>Kw9JITq{T3T8b09E}`D{(0)5?9DWu{XbUQl%CE?sNZ0i9LXDgKNEI zxlq9$qdQBJXzLob4xx;RbV~&Q?+yjrO=^}(JIi5IqvbKYmNg*TE8);_h3d8KzdMtJ zDc)wjYLNwiDo*Wpb?^TvROSI`#=&CSrlk_5Q(PgU$KfisM-GQ(hf3`ln3kI5iT82O zb)!U?pv`xEw4*%vOi?w=yx-O72J}}cURi>n8Mf)QVGo;QG(O*w)M^27m*)xM4BSZv zL$}OIn(F^m(*N_Y;X~Gz?I#YFfvxwsbB65^6ExYWs~pTXwb%=93{x`3Sz#PA{9D=7 z_Kp`vu)bTN5R66ZcfJ~-O>CKq6%UhFY;UC$c~pAM>AH**f8TS~VIn;skM?D&FnHGB z0DuJVF|8&f5aA!Hr!La6W>c z51XU4?)82Be1(zGpPScPwIub=Px{&*CC~w@7RN`4&bCO$J*+^k7kpW20~al|^hGh3 zqq~Oxh9WcsM~D0o&y$3A^R;IV%eC<_!Z)o_UB1w6PL{?R`B=_Pl-Eo*Xjkin%TNF> zN~ey>vFZJ=O~pIi&u7yB3meJ8qJuq{(wG5iX?s}E;0K;>dst{VL&Vp?jk9aB%b{VV z$)a)vMUv*i@GW_YJB~0CcIDw@-5j%k^%+$vU%?{(^26T#cFhaWz$M1qcuD4OWN?E* zY46^gNgw6n_WHsz6oMNH@>I_sD1dc24s>ZdOz8hg(JM0x{81WKfaJV^i<W~JuwYn1$p)ye zyAxK`pE(T+Z8Y_U?M^^P7Y$W(s@clENGgtfOhPVy|;x_91&A1tK}-Qr(IFD)w1ZAxk}w+wj-u;T`Q>qp2n$ z#9hjF(`UGT`K6HmlbR?aDWTjCw8u$;bN;ik!Unr}ma|2iRKk_jZ5fReIuRwyb*5)) zuq5lz6i?=ukD(B~h86M2vamz0z#?#oMSh%+=1Bqt%!;e9V>>}xLYHdd_#$CZKZa5T zQ@$ySlO4Rg%HX)wuG&TliBaR03@O#o(OI^f(My%madL7($orSJ#__wIV;Ar{Tuv5K zk)H6&5vl%t8CnBGY&~+N+i*cg8sXkVfyB?HrW#M zXcc-on0LcIspAOW$6c#^kNB1R`N}?uvXX@P^_?d#CZ;T7!6)$^y?|1SRY!TnAa!mj zXqkdbdA0BYzXu8qx#F$OCgYe{LK}LcSgs0+inr8TQNBj}GVKT+A?gi(P5o`*Y6p4W z(V>lR9a1cbc*3Ut)dgBTP%w)u?Wetu(bVsGD``e>C;&0{aQV0nM%>X#n0~-b&?3?t z@0LZn6fDP>&Gc#;w?oP}nuTEB?T9Yp`RVok_4NkkBx0ciIa{W8Viw&o`~m%!q?+mX zl0#X}&B1jix4M;m{ZCxzpU||+;F&@{jfBY{PC-Yb(78)-3g-k7>6i`U05ejs3^uap zC>HllD$M4RllH5jFm*<%=tnMO{R%f=Kjsr?G7x47go&cZZ%>)h33793Ufuu|^{(PX zVCzm&!@epY>OP5<`fC^fXhJK2Klja%V0P3FR6M>c%Y>tIv0O^JpKmf<3cs64h>c#D zwR72YBCl@vz$ETiw)@Z}C$O=epv_lx7L29_zp07-tg(S74ioXty}i=C+8l`_q-`Xj zExIzDKw~X|@-$$pyDk<|OESD`SN;ZQ&+1&!1LQffi}53juqPI6*k7yNojg=>-^f^v z7G+pHP&At%`10Rt;6TJENkI0udzjqce)%#+UClfklddf`Gr@~|l!k}T<4Zv?O1+?z zYQ?Kb`7Lzt=JO9(3%x|h!ogqM%UPoaaj#m=qpmAQljNtC&vku@&rXp>B%06Y zNp53H7Z-yPAG=~fp?k8p^hlaPFrty*;1I;z z5nl`ua=PaHC9&-xL3;i}>Ym>?{tVtzHGwn#QT)X@y0EG?`qv%sE8A{4;_m>uPT6w2 z3!5j$M3~r7$@4AnAR;+0Du&z8!yNHht<@)pE+(VqVb9Z1MF5KDc){+a0CQA=f>M}f z*QK0>SmpzdAPA`GsFRNM>J=;Trl?^oOP`yTz1W}qk`t~)f>5HuHA}!VFGjy|D1;Fi zb5(pb!HV^NL6Vh!0=dI-VE@bH{7D8n1HNra386d)gzswC3l6!IP)&NKjXQe7a?H+vJvrh)AyMMz75DSt`M?sTNywI{F9at4Ak*?W}rw z`>EXg5a1hBp>E-6ml<-8ylOW2d{BVkqWzwBXjb(Iql3&yLU#%j1QO)Nes2(x?P}y8 z&tXpW19$Ycd|+2PI6lkT+RvasI&c?-*ew^8T)0S z^jRu`uM@Np_R^t8RDTOnfH=VFnOk1RV2#@MwY#h2O-C}lGhVva4jlStNPjC5!1yUXo53mQVv0L@ z1t4S6mlNXC=IV^h=wYNCn8HMvVcuwVMMS9m?3Isv7p%1Qn` z_IxGfi~8)#+p%7+Dz-)?ofi1h6gY*xy&w8IW=BA5RLO(xx9i(gvbLJYZg2{^r8yBm z)rE4((p#>Q_iGvyK2-Z@l)MNWQL=9X&%Ze;6;gH+Ht5Igp`NTWQ7i2qpAL{y#7i#Z z$+-cCzw&ka&?K|>2Q|CdZ}4B#tV|C4um(@B3}U1&YII5M0@}!9bh+eWTRXe2_1k!y z)6UuyAjFc=*5%dZb%OZ{eVKff;9ws?>%03Y= z6$UI-VAM^($3vG$B$}1jgou8CsXw_8D8)H5TgGeLj|HhSH>!kKk1qidrc zD7Z+_Bf$TsIKwTmO`8EI;YMznCd0rJu4uQnsrKI6%BRUx#<<;^aO&)8IzrdEUkHo~~k_Wi!-< zhcEHNfznml7`PfBwt%QKI>wj%8Qt13{{R35notMP#^M-%?C7b$00p3P3cy?64~(J5 z7%PUbz+^F1=IgQVP$$Wy0V$P?>*l}Wn^%N{mN3RsOQwRQHFAsZDa8J`fceEA;=TK+ zrJ#jPtze&~I+Rhkcp0dE>*Y>UwGK8?ToP6FUG&*_I;W&a2kD&erlT?BpGEs^{W9)D z;MG8s3i9zTeaOdRZcM+3nMTF*IShod3D;J*!B`$$|5DiQQ&!}JlO7pWHBiB)<%_vi z@J#0>=eBngCzk0G&rNx!JhJlQ94D^xX~j+BYs+{LzHSkfbvfEltNA9$p|>$+>xGpm zVz)I)GJ1PF>ZEPvuqN4R0hlNYb1DeTd|n}w;^LLyomff1lzon0Z!)|s^DzEPV%7*Y zwI`M%;P<`Nj4uI|j*RnSS+0W0q82}wO>s{8E{4w12fp`D>-)A9yj|IzR^Mly8^!$m z1$e3EA;|Ab_P_JCNHRNtoiAY=kq_g`a>FB{@y_6H!88dG^?8B}qC|C%3 zc*3k=T^K$O_pxEAfKqV$&sVy^2&hD0&$8KOt`N;Z76mdjzFdO#n;@-aBMl*XU+O))$6pLXAG9d(if%ZCn%20aQx;%&^*A0%>2V`!c zUr$)&k-NQz{YVbU;SoCDL_Us;n4|+8SEENaZ{D=INctcicYU@Rj8Hxv?)-LPS@9vz zYE6eF()s<^A4neST6t2W2u^9BrLW$Vlmr2~NX4^*2`Rl93W4ap>CD5;JIj*|4Rv-H zR!zi>99BKWqkY;QWAex~W;K>I1JReCQjijt5-GYrkFtR#PRipRf#uliCDlG$%LeLl zv*qW>uQ8?*2|~t@xt?^AoOstpvP+{pI5e?-m&J}xe3cybjJ`r4AC9Kj%mQ;%TV{Wq zJ~}Y6DsELL=qVi-iX>@mZEdBKQr3YSo*2;Oe2d_-yy!s|zv&`=fjvtqGsmrtfpaUH z(5@N@v+v&9WVY(|>Xw=}=Vb3X?_kctlooXQJD;%&1SXAIFL~mio0|;f) z$@QEi!lkcUEuO+AudG?ia_Uy?P;i-n+=hVl>v*JjyxnoYWtGuf$E^oP8Tui^#zPhrt4$+pn?npYo0Dg`$+snW71PVGEe=Lr<_StUi>ff_!z z{iLJx>6l!Lhr<)YgSiuRo2k2d{rjqB^}&SNOYJ8DI`NuXs~rQ&9N5>7N1AjxC63gq zYv{(Pa>{uapC8R%*m@~txItu4YwEYoLHRPJkj1mqJIS#gE4}PKLMG$a>Cy5yUxE<~ z=@}G@?bwxu4{w%-{PajT@(G-KJ`b3~?)=IdTX8ziX!~o%5+3Utl#F)R)4*~b9QxNe zhz``}#{}%pRg(Z-o=$c*9Ll+nxe{Q}Yfk-9W~Fnn5-z3~Pc^0`$j*r*90l7m0*2mH z{x+*Kq#q8(NgNqll8*e1omO}!6SfjV%&~1&D``dwhl{; z#wigQA$zwO;)grmt%F7+Lb>SP=Z1rKba>(~q zmVqSrZ=iSbBG8?lmt^&MaG^Xj7k=(E;x)3U+3CqUpm^F_G;Tm1(LxU6z+K7N8eatP zxT|I71K1i7HaV={5ad735eP+ijbvPZj=DL>sk>IB>gRE4wZQxcr8L#OgtaUKkg`ix zOwCB15%2uT2BDu zClQJYdHDI=m`ij(lNj?#Guu~_d+84yqVUeM)%hExqnz+g2a>q1ut07wAgQw1X*0`w zL+(Rl&ZxOqVs}6+ zZ!%Rqn0RISvfAFk$ONhzZ;B@Yoiztb^7`U?gQc|$f`t%Q6M^fh5=z;ZG7ry-2)#_? z$E`x_)gZO24;M+ZR-Bh#ee%LrzJ6k{qK%)sE9(Brtfq2whZ@0TIXm49)u)}=mZT4L zO6FU$3DP|>rg;!ftKR2AAW`$wu@fHm=k+Vw3ZCXo*csbk+d+G^oZ#E zljycf8R`}d88~uC8OorFo`#|sZpM)wkxGw(EC@jt5Phpn6Md^Y{FAt9WAEDOOU7M& zhJ${#=~jy`-jkr2RsmyC-xl-lP2o^0H3rf*JCz@gC?6YHLDoeKIs{s8f3j_gFg*rh z=aQg_5yf@#1_8J1qkgYm1xMimR(phCTJ|1!@(>(;se4}=4>AxVo%|cfDUWo@?XK`#Sf8`}w|0*SSi_WTIix=bOZcX0gIknQmi z@I2}eap5)l+lx!V>uMZ0B8 z2Z;AhMKv_KZp$UZ<gg?r4x#YGpxfBGCcJjZBjOA5QUyXFwY!bzHvX zg_28_9yemCZ_?huqMlvWJ$?Vmv|He_3zW~fm+C{qRU#LVnd3#wBr$MO8qNpHTSL8| zg&)sVETH7vrca=AWgb0TNO9fQ@r7vgdke*n2{qNDBKb_R7Lqas`I_bD2DlA(+$Ogs zOb;~G=Le-WqpE%GdJ_^wtX53z+*F4)tW7otKc$$6LN_R7{$6`VO1|4^V5L9BZPN{cG!tw3eeVgVBleJ*lm}W=Drq z4~A$G#HHZp;`7@F#m}TuSyB@r{i_(?@q3%8^t$!!(y?DWn)rZmZ>Mx2W#N%Z>w%i9 z@|8)!*2b{kiz=5jVLiaEc0XRMm|dILp9F6{d8aLg+c8|`;BAb+14sb3WP+^@eO*s} zJ&cQ+8}s0mFUY*RG+f0y)n35V#OStOlVPl6g4J8GsWzJg^X}T9 z$Ik{OgNp@g@{gn3>QXP}r-)pcty>zM7VdOzjL+x76y06yMXR%SZNhs5K2Z5z{_!6N zHVJDxz`M1un9D?61M`6o^PeDXN%k@vZ*IM3JwWshJ(y#fRoG>D3Gb1a{;+LRR@4X0 zUvLeSqH)QU4^B+T-Y%BuQ5U1NTnep43Opep9lLE78syLkJ^H@Q=|V==8-8+6Lb#PDXw@G2wy%`!X%H5hIm#Llax@aULCN zX}w)Rmtn?M#5j_2C5tYaX2PJGC2ZY?kDnj&pB=r#vKS*1vyY^V_j6X0yOjCP#9sQf z-hNrAEtCs`yk}$-gVMcMU-{8?2P`0TPuaFL z+rBkWC}olNU^$s5H{@=)g%;F!q2wXquSJ(L5_iPhmG2uixu&2}PjpWYaBsqeOlq_M z4YA>NF)SZW8A|`ATcAw=vCGx%)+j^!(QUGOZ#bR?ACCN7Owm9pZ-@z( zsxj=^DfCyTQ>7*gyOb}xCB%A(T za$gQ>1s8+9swD8tiS&szAK@T%Z0L_U?Dj1MsEZ5!IJy<+B0hrcuJ&GSmF%<=EZsYv zm>In1#MqoYIK}pDPyARntygK%%&4rZ|3^?pJ_2KVybDMo9n)b(f!{{8+0mbIrUgLT zIu^ca0uFrG1x@Yq$a;YB?*Zt5n8oJ&DCc5jVO`g{bETJGGwYrYvx$rRbR9{q7~E5h zll)JiMvo>X);s}_VupjP4K?hz+BYBHQ=!#Xp+MRcNrq^Acl@lNlNluMJ-W*1wb#^Uz zPV1l3?6EEt&UMq)9 zSPve}+?l>|+f-OdOaqa&0#{mz;%M7G3}=VBYp?N5_F)c{I5!V=ev9^e%KL>pH&zFK zYh)yBw2ry%`C-|lC$SZh@VjRqjLHULsOechJlp3{7yU-D{+FS+Rg#6Xv`UFvrd64z z|KQe^*!RX4_L7GX!u9;39CdH34VNH0+rcQ0(6`*)n*=NguJS= zPf)7rVym!%wJFrdK4aQV6Z#A*bE>V^#p)(NecSP^2s7zZXP;))XeYcdc)tmNREz=w zY6b=d(5^E&$|R*LP-JsG(0c@Wgfuabt*&&}=v-AL?~1-sO_R&U!$ zUIYE1t0Iz*H4Qk1GOOLJdLP)Dve%v^GFBVhD2Oe4j<;*z2*ij+g1 zl-Bn;0x&o;f)56PK%o6!taDg~bHBRHbS6#y&k20B`JN(awRFJLL-Sd?ehWVdIaFWe zRF!^P5PAKb(l44J-X*nySKPUO?2eFOP+4Uv500}svKg`;Zz$W^9N{B|cEKUwmb}+5 z6tGm;usc69s;9F>4s!?AUG)yKb+O3yr2ggl6|Bd4r9Jx7^dqn3Vk=CB zUxaSgElrEGF>%#4PJb#djrSd8iMMjQ9xUCa3VBBN<2iGDVP)q^v+25~wuXU`Z4rdz zyv_+OGDU})vQDgqZVw^X_*V@Ntf-@p&o+D1q1f@dmo$Qi2Yc$t>TxF+zhm62zS>R% zft6KymmQKl-B;tlDh=x=W+=b3lH!I#L+WqZN*Po*5fnXY!)EWL+@Ii z%H#_!Nu;`;#%H!+NhH(ksh5^~x;Nys^Gow^(4Y`-8g9`cWMLBC+!-dRvqdbiZ-W3z zJw|s)VUGZ97h~Ge%bn+5`Tie0ZT6ri;^)0hvAR7h&vpHUy zuZd#)?t>8w1Q1U`&Q6I3(boHRCe$uNPf2Z)N@)1_^W=+#qE{d_4C_i)%WtqLZW7LV z(n^(x?p5aSy_K?i7Jl<3`zx4S`mxD^qcs4uZr&@sUwJbG%>97q^Y(pA3~^_DnyhrI z?7XE&(&1X9(){~78PDzQbAX9JxBc+}8CW=%^Pg32ar%44GsoL^ryZjcrmuQ>A9&t4 ze5ceTCnn?b&Y-c`&>;aZeRp{i#B6QOC6u6~V4#|9l_o#G(hyyW2{E3VJZiox=KD!- z;Dp5!^7IQ8o%b7Mj`#fcU+ExHFkjWFGh-o_Et#wDf-dYEw>b`eU+I{SwaC-U%<5FT zBXkgZnJ6Wt4h$0iS*?2>I;EqPURwQ42x=#QO7tBq5jttATZF#kdHEggR?lG!A)se}6XR?U%b z54*X|v>&harT&^T3h4vqtIKV-%(v5*1Ds=ol-<2wr}^6jN3CT;-x}=(&u?zn?=_vF z)J?|0%#wvN5y90W?&7NN@ z+hnl&D8bmO2ryK|8-w8h9Eq%gKG9wqtfyV^-T0i(WIcTOjhO-S(EWn-JW+T%@>i7ef{Ldpz$# z-!#=vPhk@}S6QHKT0re)xMjWFav@ra=ykPlzhye;@su(u7T)5Qr&#rZ8_6lyjiY8@ z#|c~@O9XDSJ?Wk-;psWbVU%n@vv!w3H&QNP0x{6t(!g20CH~zHUG<%|6Rs7r;!4Q=b=&8eH#8-R4;FrHViAk5{e1bC-6O$F-W;7C zrTga|eKTb=BdnOuOgnPSixB3DTfuxx_=A{hN$+<;%DMx{ecVc(~mG*#P;I>;@T4f;?ZWMO7*+V4;UVcjOOVjjNHhaeL^X zp7Os8|2}&3;?2t%!p#tkyy}AHcK_iG#gLS~r&xnA!XOMqaNJ!|nEkG55vuz@< z8|oj{)KYZ-Genu;FkXu5szw-VyU%dmp)zAuy5ag-9Sb+MZhOoMlo@m7s)hR-aBl|h zS{*ZY{YCbT|`!sO2SM@a&kIPG3;L1F@?>ukD8t}LQpr9Ix+%dHeea4utpQxK1+~1M0D+AkeOS2vuQ(jtIw8_+yOWxh7 zAq|IHnL38_*NIA1<&5XAPG?N=-S1;$TlxB{AT=gyhmgfwNYR)Lwf9@&+uKp-whgrU zqZ6qTo?&urR}P*u6wx+usz*rwLHV2u_lJ9hGU@VMT_(3JrAb}{EvnU8?FN;M|K2s7 z_;Ty!i9qeFo;Jg4=dQfoV!aY}&L}}54U$(!QIF+QKprsYQ~)mtaXGhoe+jS_DmS0l z-AVJ(ZHtn$oZ@#AFmV=~N4R4b&QCsA?JWmRu<`AW&N4xuS2~3i7~%Z}VeNOslj1Q= zkr&Jpobm?VoDJD$M3qAHg=`-FCqa_f<#<{N^a?@h&ZJ-f9VLvU`;1f+I|ah1_Vih%X%4 zJkB9%i4w-G4kf~1NWTZ_*Vzd}_uYqujxxshf;skUmiQx8BfpmzRjQhX=ON7-%pX;{ z^mQOx%#u^ShKUTHvW)iJI?eHKSolTBvEKpZ&m7Ek9_jnfT)4aS7xh?b$g^^d8UNc5 z`Bw@LZkVM*4PEe;C8dQ`JxWT99{ja-u^_&@+NZc!L+hxo)3sGplW3{x(?V{2!f`OC zMVb$$l^75&_}ilqGRES(Q-+z4&tBEMWm-oW;J7p8eESg|Wm|RLtAii_QgPPM!91*& zHriD;K}N& zr}6Bb_fKn}Kj**nOMR3GS?G8U$*t(va(-JWdt2mH_NO?qlDxFZPB}ra#B$4rU+lZKHODA0*-=-I4Lj^a05WjOm^F=Y^(s z?)=3QRJ%)}0V?83LmCmD=ANWBP-vVTt9{(m+Jbg%Cd;}DP3+d%qCbW8v zpIS%JFSe9TW9eMU1T)_WV=OY+0uScb2#42)stg_cwK6*_OTG>tqf}8> z2kLyXLtE7zd5`dq#|WmT;xwrNPHCQ;FGsUW`^sg9Ulm!t5t}wsKW#~B6P#(4X9PIp zAh~rd+Nkq_x=xiz0YY0Vca2x{pu}-Ym)Kjv$Rj6g2c}m^-~Wj76?r{q!r$i^F~W+96NVtLTj)iwjLVgiES{Zh16S+DL$$rP5hAI!D#Qm zZ0U~yK>z|LvW`O^ModQ}EuM*v?K@XF>r`9d@FcszWHR!$T(K^lQ*@wac-dy*Q`6X- zSw4YNgy_>tSywuI1GZR#-+g(tw{JYtM5_SSLW2#vS&q@)({J)BW-aR}X6?36(OZ69 z`xNf2Gmka{iM%v)A8zIsw**~kRX#~+=ZwqQZOhe`BxsFBXZ_(LVa(`l%RTt*J6o7X zL1j9p*oqK8Ee#C5Si!f5uaBAV(~|vT{av$)Ggv($$|!VT*%QI=H&%n(Q~(e>T7-l? z5Ez+9WjP7DAoy?XqyYelsAyWoD89VhBmqpI0nFH<`g$v1ZfR<~kuUdyRcy^4?n0&&M$K`oqD@!(64q^*FPJ;JS&BBRJzzUkdDCy^Y_T zNoZz2IF?NGbv#ca)YtPe~Dvx46_O z7o*i*%PhOin`6~&DN^1NBM~C8%bKkj(g{snCV7-k7A>lG8cK*7EDUZC`|L|)j98_w z7TQF?hnpzgJSW=!UCOKC7hy>Tx{mWIgNGtY)syBpMl`i;Kx)Lr_l^Ms3lB{foF6yRCi8L5B0tKo zeg8T_;-2}8?kce{mzhH_`Lb@|S5OaeW}^3wh+dgNK@KN6y-OuY~Iy%bbMCfC-NhVmh9$58OwEW-yALbSI}{KFjsW`7kg!aTJIv+HeKd z-VxFfwCAB&O^|R`rc~VpMQ2)|Kj>#{lOQv?Iz}r^Tb|1<%XdpXa&=au(~xzd27``C zh5cPVc8SQu-}e^ouNs6d(&l&;OFBfK1w4skzWGk$MNco=@8a02BA~$SE!M#Skck;) zPmOUPK|%%Se=04|=|eNPFb6U#tu1CUD8gH9C7$88*ZW{&U-OwdeY)179zB~%vU0vP z&(3bfEm!WA-J&SFDmatS1sZtJdlS6%*Gw?o%+jk{vSxP7joQ}Ixuv_vLkS8$7(eD? zb8t%#TKp@kM*Qd$44D+L&~0WD`D9o)_;0_v=g|hEqS9uMN9|+!W(LuS61kuLjU&|0zcI^XX`qPH z_@q2cAd=9X)$5HrU-P8m(*1p zNuNyTz}63_ePLbXvDgFS@!AYlM@DExeeX#o_r+_!cUh|DGWTzs6h?OI8rd=~&6GrJTlAQHbzePW@RLo?Cjls=d>pALS9u{zP zI8B~YR0_#hc8_&@H2!k34zKp;4DY2Ks{cPH#b)BJ=U5e>5R4(Sx70l}{xS=YD|35> zYY>M1gZC3m>Y#a$^;WjLm~y_;D*&{qYybq-`H~xsT8y7I)+x3heNwASRvpYKlRypa z-&Io0qoU-jt(SCD4IB)_L9QZ-vF3#dD9^DIR=k~8#K5^&8wq*zqZ>c>Y_g<*zg$w`U>8P$WJY%48dbL~%b$A4LzX&=qwz*Bx zct(ATcB}{DFK%9jPb$r=(Z9sPy=~%{>mDgG4{WQ|b*xldC;0R!$dvW0f)*O`1Sibz zV!o^mgCd{Pac@itu#xIQ@K5kNSB6DNiRyAu-!~n&W%d7>@f+apw5>s}6mf63{%IZ_ zl@ARjqoN$=OgIb(V~12|JVQutx{V`XJMvhD$G5zhqk~*hU9moSGBE-^Bbe89_-1xu z^S1123MLSkA4eO_A5yhPO`yjyXP~wGbUDfvB@nM~0PEdgNK%~Nt;Ezw&xr_Klsl}j zF8b@1ay)HKM3|Ap4=r+}Ur!8ZIAp98u|1$O)!a82FwdaxJyO80``5v2l0~ZJRHecD z%9D~BKkdWTg7<@V_SA%NG<4gXWrlyCnuWZT0q&U*Wb7Owz-exc{AP>3s7_C2E16C( z24$y;;`!ISc8CrLrD4M&-uwmnVdY8+=g+MRE<-1z$MZlL3L8CbN%IlzLZheF`_=hP z-?SWVcDn_a85EY^5on&XelKYuaLVp@iY4KrG{{beX|VD>m|wzH&5P;Ts*8*S|>MQGw9{P|f~Ga9(%2UF)# z7m;ei0K9n)kea}3*-diG8H{THsMJR#xuim^~X^w&Y@PH?BiWK!nxNsYCxiXRdU?iPbsLL8_=)fUjM464rfbq#N1zJ4qmup#P*S-57t6BCB=TbrCClgxi zFml$T_u^e9=vl1+-!m)5Ez=Wo7?bUfoZ}K!bIFMB>a}{+FRMbB2E!iK^)B3s7d6$U;HcCR(E5QR z3jp+OUJg zsm*BaviffMF3&&M$dzpYra<}RtVPwU{vp}+6Y9Wp0;IarbU~@S^*T6Rmgl@sEhM?G zswfoNSO%_3*_s13M;3B4fB!`B)I(}_*pKdQ=VS;@;0M&I7j4hJxea7NfHveWw&TT2 z?rdK#J2!ZuvVWeMF{2zGRm+3e>c0V7r)0?xgfgW70-#<(QDOP_)zHl9Z{`IpWlw6~ z4Pg!oPg047fDJqy*6huZlpnMoI|&7Jzod@YK+8wB$o$kc4uW^nLC8?LLDMRv?vB8?qhRKq zU{FM77+w37#JDnQ!E?gUd0AB8vfZ}00ddIivgBhuYtRe!af!#O>;jU<46O0J8Oe~W z{Jnet1@Dj8P5FsRNh-R*1z=FaZ=YCjxotANHr3=Qmu{5T4{#Js+A;yT`N7~#lWZd% zN$L-8vfGo|*=m7n&Wa6xNY{U)Pb7DY4bT1lqkTXsF_jV*Ejvi|Pu461QxI% z%idW+-?{R?;`}pAFU%@j8@BXK$JZaEz`)321Pm>Sy`AD6S^(Hm9rEoOV2$*LKYhBQA!RY2RtDP8R{vJ&_^0O4M@2`H)eX*)* z)vBuX)KgXWbKe))T>B$)iWK(zQLshxJF-RoUlXt63)#1w z>z^N5*;p&HyQ`VIur1HP>4ZEyW3ZZmMSAO1#>(D~l{J{BkR+7SeNTSj`qo_Rf#Gk& zyNY~XkFQBGUGYLJyu@pY^G&@GLSt8tmU*)w&lA@>WxlVOXYgfF2sNT!L&I{km)tVa zyg1-|?&i6YZCF}q!Sr)-KT$97(+fVerKHo>lgOhl9amc!f!%#!m$7*n=qJ8i2bNdM z1PVgZ+dL94Nd54mZ)6;p389Ja&7!1I>^ux8XkRBr<|JgUscFPe3V4l1=HAk&Q3Rip z`)-&&PCDGRbC)ecQEp~$_TBGwtC3u0F*8oGQXjII*-uq33)ZkQN<>6r0tWB?KpB7^ z!c}>aV6N-OMXQ?!Gep;H=I+JzuF=$LyRKCecnYwTZa8N)~Z{C{_t_NLJ$T~Tz z=CqTuVH~&IMFUVwy`nMz&|V6khSu?}Uvf@y+YOyJLh1*%aa-R^IB{(C^2^&`Q<;)64rwhZP0VAMi?n zfZSZw+q|~O94$`@Fb3KQa4pXFM!_Ocq?;Q=2T3`Q~=apOpWKWxGAXN>2l6mvUBO=XjSW zF5&OfM4+xnw{q7#(e;}QdOoF_UODREOBa8R8&YqYE33z2V(5Ut z_7%&;UkF+RW&nyjYrR)Zm6R6k#6hxGK)-lpR z#4#Sn7hl=9Ah-WHGfU1RAjGMqwN+cMBfcY!Lf|n{EH#h`2X?1-+iQ+G9kp`z|-uBt1(A2eR)aqI5f4Z87P+{_>*)`_?;%4H-J<%ZY1fzN&$! zsmsz{v9W5=&jL(upa70s9UuuyI3uJMNV!@JZQya%{`k-R zs2mARdouB-s>pn|{zFji%j^KKoUC5akRY#wkyA;52SjH?tMNRv%@eg6WKMMK5mY~w zoJ{}@MpF*Es=@^Wxw-@+1uL)p5cUu87_s@;T0qxDSO8=$sGG;LA2=&mzQz`O#wMVA z8H_=!^;f#06eghU0CAYmd><5)%#ag^l?kTe@3E4>?Ey%I(VmzXdn}%90<=SrLNrex z0Zt$bXjg)tsd< z?``nMN03nV=v9#ZUz7MC{a>xi z)usPc`ltW5SeLyq=!OHaWlg~6bRMqo^6^qK(?7-zDGVZxcwbnp2-+ybU z;Q6D%X6!!${f{v~Z+rx6I$`;G@}y`Haoq?`ybi!FWdAy~{LIOe;KQp4+`3@{a2UrV z?COsh|6^kQC@SI6#f*lJS*_jHTSMrEgy-SrzdZxnI%N>&)~ciY?E^p_@Siz=DcNuT zt?^hO1~%b8Inusuzcs`NFe0K6lKe*hT|o`$uz%zvMC+7WdyD0hTYJ+U$S)`}a?J*%yGez_01w zsNw$QZvWG{?2i)vYuN^TA+Mt?<(gphS9{EP6n{L!&re0?EB`|W?F28<5Zm`g{mI{6 z-S3g;=YTdFXa?=q&cnfU=T7mtD)^D7GUxsx+Bb>6IDbIVirzm9PF?HfY0UjdY|XiU z%Zy?Dchv3gRak~)r?5(B(mTB|^h~Ysh1k*k;pP06Awjnquk7I9F&Yg{Q@~x#Al~t9 zu{XxQEz^E4VtT%BjHPfU1bbQvhfgvUOAkY|5cIX+y4kO}j@Clyty0{bXk>`Vf$4vQ z_{~l0jg|VoF?xty_OCbH)3fu>sk_k-z(s%tNaKj&Fm$c@fHcQ&cnS-ixC3nDe@WBd za2aBddX2nSmr>$#zN$2LM{KX-W?4ejg;xz+y1_#z5J}>< zAwB%cDn%S3Fn88QrHA^pCTSYOpI}ues-;WKFLPeilh}&RZw&pHIf_;x*fr;8yS;Fo z^fePPJyc*C|G+OdLi5PxPaQC90$*-tC%ORm|NUa|-hI2PJ7jY`DMG)F8}C9;>Qc9l zY0!Nx-n(5+a9N?0az*j?XY&0{&K!Z{{kB?z@>zofk_PQx)tL;ab6SnBRf^7K6MqkN zL;xWT3^3+8zt((u&}IHR2}Ho_s0i%T2by069kpUs?^9S%zk&f=cyBqoR_Ew!H$2ur zM=VWA?u)U2==7g=2EO@<%M%}jD~S~&vzF6tl${Vs7wIGy9KKflTp7akm7E#P6QN~J z;`{5Ebn2Y%lAr8)bj*DzLh1X1#BYCKA8oc~Y9HbHV;gjI6LywMm zE>F???q8>p9Nw#~+Mx8_C&=RA{Wbdx*HxwBLVe8OYwTCUs^SG9VZHzROY}DUEVh4U zE-i@VF;IsyrHWt+#FF?CyuL(lxkTVE`f>y72*}j}=PzmI(Q#=(({O&x9i`yNSSkzm`DWz0g3QViX;2`b~`un*j-8mxyXqA3#6KEfA_#!0m z-ry2C(|zD2*aF2k*~I%3{B2efH#jP>XezO)=kx6WUeS~_^lz8Ge<$VqL2=<;20YKT zBJo#O6Eza_k3v%)MP_MyRpr65O#uEDeYer&11M==@ zxwRWryp11-t%JO<@6Z{X0s%OPzfA*mGo7i<-8sio*ss{06iwi`5N`+1q5V2kmx(48 z`nv>ntQw1fCuqME|N8pZQT0PZuhe3`-}eWxA3^wKQvk*vYv$0i>i?dFo_hB> zRX_nYIUzvO_Lt;)AudL6WpVU(Xbc5@{N)Pp^~6tv@`o^B{NDNhz0l8c7{I0npCq;J zuRm!ct>R7b1b)&e@dwoMw+yfDeKx_k28_aMg!I4s#FzB-86`3G-+J!1MO&SC2|%g) zm-LAEdp3INFN^G}tN-n4|Jg?W+ZWS`62Kmem{p~cmQ1Ki{xyTK@wgda@4~KuxB2sZ znLU8!K&u&8W3lv}3|vK6Tl$8_>+J6`KJ+PvR_fTxzIwpCvR2Bwd&(Wj#e$%vd#xQ0 zzPz*|3om_~uzSeX}G(PcFQ#I4Q%VS-jO z;JhR4x($zP2`>3wu>ek+FZ#54=|C=01}{?7rkaaY*Q%869divVQV<%jlc#;p@%Z=K zNM`$YTjjGV&m=f8gwn$M5RZT$U2Xt@lGn$`~8yF$E`?8nrF3|#PJ{IS!bTwUFu(`_N4|it5N_D`bO19oBpahkpw!s*!y)Gj} zMie6^(Y^~Cy0u-f67Vu~^vWalx^D8Wm(vBQlQ@I`FZew? z;JrQPWK`cK@>1D+TDb@0Pj{bbQ$h?Oy{O0D=%h!v?m|m=*n`@F8LX8V!%o~;pp1$458d0jQ z5@?*8yt{w%R1obX1)y-EV6N$y43)`bUaL?6A03p#T3G7YNcopXa+VJX1*y%Rfm`8t{McbEh);_u7pb<9s`@BM2Uy&891}UdzIf}+-NHCqaL9hO9w1wr_ z_9W!Y**~sU0d1L|owKkqlwB~%B&^wS{)X|ZS`|FJh$V%#T(5G~yI$NF^ssL%Gm9-S z)?y{Gil~*(>lROyu}EQI)j~Tu}k6e2r3575r9Uw}}Uty_~AR*sY9zM0CiJ zO=Lz;6v#+72%P94K?7E_Cg)w}8t32F1xuh+Hejo%E z^9f*#wam`U+nSNK(Mf`cCe?pWGIXv#-0rJ_P1%J~S=1Y2C8c`hiS{5YkB4AUt+Hfh zNK{kpWt9}n<>alWcKp!Rt5hy?#gZ&;6nABrez&NefY@x*K>pN$d#L)3LTr+=8Yji* zT}gq;u@#$-cM3*s+i~aI4$PWZuL_p?l)kT5w?+eT%=1o~5;H&e(DpuJV=NiqT3Mu7 zuo@W}ARJ;mM0kKNcq&Z{c>G7{e6({<;1Vvd0~3j=C7hK$XCK0qebK^=d~iEWY~15^ z?+JiUHrXU3QnBix_XkzUvu;dnfu1qjqvZXKsXPzo^)>WfLF>)PNyj&RyR}28F=wR4 z*r1wueKzmmhEH^*%cx9f8LXOv!(2kMMOmJRSinnWgj}H@4tL4dJp`8-!nTe#`Jvf&hOp+^(OzK z1A{hvA9P1p0!HoWYT{9P%cvH zST;GLAkAE;EztK_*dvb4F*lRo1mW85%?Iow@ChB@y!Uy)&2{@W3ul;D4?zc8fqJ@~ zj{`rTl#?|cJDK(XeK!NZdpK;WDO5i+VBjU7IZZPM&r_pwhMN9v}<%3D|*JcC~>gfy{tl!Fbclo17frO!r*9 zYNRE2juWL(cU)tr3!L>uut1D!jj=rGf~)A2EnPKojU~dIr}kgOsvn)B4<4@kK0Bn) z1hB}LMhN@ONc!$0n1nB5LdhWi6eHKsAIrxqjH)-#}*XPh?5|S826RG{E5($%x z+VgMGKJHgUIf^v*0QeF|&-eMsr>NW^(FQAgq^f#z8rM*0SN|;USnWVVnL6Z>S1R2+ z)_2o(h`lJ;?cCU=c+nuW?8CY}Nh3HeZ(QhMdXA!w3vvyhb!0CC1p+|u2r-aGd9w)0 zeu!_QY_eI=CbwfZ-!fEmh~<>dE^s^Xh|Dm^asEhQ&A_)QbF~Ujt)6$h_qKqTF%5U5 z2@Q@e%dv76E*(T|x2fKykO0)J5vwX&RVPhVak@bYdgK}LP&N!MtWlXQZv(eFbFYw1 z+Wr^{&{->V(OGY4x=f z4!QUdvZfwaM3>Jf%ye?>IQUqCXBZHmu8?=>@L#$LoWtHV)EP<((;k!g~ zb$Z)bfG?vQcaw8@c})a}UI-b-W$!8H_}Fo-86F2$r?>Aoy(DL`$%nq)_q)!ZJE+*blRJJn7OwO;s=d<2!qr)A{eW$Rciy4DeeyhF|X4+Spi^ zX@_98BpQry2aed^Vc}?3J<|-NPA<1VwH-Var%3kNc{d?+L)XdDGpKA~8qIkEb?jO( z;+POrdca?r%v44pXXRMXrvhv@ua{>wYykt|KH$_bCR7Xbo|@2BE=`T_=gXW(gu_s* zyGbBD11s>X63rYi2%ZHx&>jbqPb~{au}5-GKThTUX()bN844f!8?rU!njg9grw|&< z5Z%*cjtyj7rDxtZkBhFjvu@uT>V-e2K^s0BX!^PFOM`4cVBsqHdb_@UirJ~2o5d{m zu>LEW`r(&ImbhfNmMYV7Nnd-%g=HqC%O0Owe_E924F~y;8mqwrFRh|zSf$@R=iWG2 zbHMI4>O#zCm=sP)hq84S!z!E~Gb+27_r9+&tx(}8LLI$p_*Ot!+5SfB>cA!0rVI zur594cdr|_v8zd#`9a$Z5>y=5x1wv*xu?9Zse8I1ifD7DU50Zd;za z0gwr>0HsSiV!6nswO)sPCMHeaT{r7zXfhUfUCzhfuEXz;#i6urwxG+SJdmIAK?hQy zf=5om#wU?m$&Ns>3zysIC9?d4TRf*h=XEVzrDIoHoX_phomX?+KKp_aSZC=(FAHoK zw;CT+_7URC6zA=r`mbc=P?bx`D?E!_|@G`OP=`-6-HFUZhxJ1U)K(_-tzOO+2ee+Z!Pp zw+G!i8@!)JG<%hsSeFImW3=_h*3Xj!Y_r1Fe?Y~POh!Q?2JFL|IJ$D6v!AY$1>idE zg~kX7+QNU>Ma6(L#~sucSk6OEymMKkdp2#i^#Jyb^~9QyBmPq@E@6txx9KP-(!@>Kw{-dIGs4 z&x=?MTh#7bW^hK4f4?Ktt60Wcx3bA6zb0syTMoeFdZdRy>RD-3vDH51=bHRI!op{R z-m~m2EHM_^w!DRGs@{wE3X~x2cK!v}a-WCb)a{hbX?vC1+-4sqRFeIR>e2Fhf#5eF zo(6GnxOv#?{Ytu#C2!(r#8Lhgf9Hbri;Z*!mfB&(GFddV%f0845^9#Op9p-o@nLLZ zkFOwzNIMh3s(-%?+0B38;a{q^x2OrMPqE0a)~77q2n?9!^f`OsX|5Oh@}lwcoQsRt ziRH|{Of+{HIV3`~+_h`X5?7Ih>63-p=9~p-)p{_WvS(HN3_7V@os9B7GFDbPy4cm) z)5{$;ijxD2%Ak^9jRY3sTf$t*xmgbT15{;4(sq7B<;x^+9EY=Kw@GSG%5tkI%{3f{ znh+dQ1m&>IVs!@BmsYJAeU#AA>k2WS^0i_|J2*Ks_PM*!{mss2^B*h>*(xh|jtu9S zLi}NJyODwuj_V1rg{vAk&9j^89d{C3qs-t~J5x|X zv0*>)9^7x!qHW>awx)jkVFr_PtRjjPs#3ipmp5dHEj8OJH2+0R&RyyQxZKL$1#wGr zjwC7O?g4oI%Qg6TolecuJGOX}?ZU5~)T+R{1Q~Us@=of2uzUOv4dldO2h~1g@FW^T zMkW5xnF8$Gc^)-EeP>Cq!Q>k7!GH~3p;Yt7w=}Pz z{oHl?acO)r5w%&SUi~Wn)wcTIr?~idl z+xw3tUFLtRGRA24C9jXnD#iIrz$uI|V9qdI_99n4Yv4jaCW!@MGte_pQ*NpdY(@J} zy@{wlf{R1nhOS`^D)yDjE24SqRRb&k+q)!itjb*H@Eg&*7LKYxR6CgVqTYf1Cw)^J z>hvhs0iHL4X}efKARC@dQrc+hKM~?}iP`c4 z-#*lKzxr~BYzg$p{HX{qs;2E6;JW%V*8toKS^*hQ^EQo%l(T(lUesU_JXAH zAayV}B#E%QrcylDMChy8h4$p5$69Y#IqXZ!0Ubnb(xb23#K*0IJYz5(_8~ECsC;Ue zugjORR@+vCAIfb*$&PStH#cjga6X+#wK*QgwDa>%ae!C_-3RX%`LlEn9$v7aCKL%b z!MoyWM$W=uZ<#DEbF(~`P|=>LX-$TVo<8atT==P;>k_I24K#ygbe{ult#4;g<Cdj{i0F(6SA~@Ksc&`sO`UvcPjZa+c0|!?~g16;Wg3`8xbkjlzcZ7Wv=j{W`L|2o!}| zA%FE+B&gxpeob}N;s`RMLwNHuzYyRfX1<{yn-a>i!GX(+5iRHWe^wuxe zx@+&fVChaTmLH10)*`8+c6r$`Xc0%c#A2Gp+uy(FIT1s@%Y&)lT{LSwjiCGyLOR-_LE@69eqTdcbIH7>McT_CG!^Z60*SPP#_qH3Z>GW zoRgri(SekAU7#x!mX+t8vzfgrs_S+XIUefwEu3N^Rpl8L;^WPo2SJ96eX_@6r;6D) zvx~H*Gurt-Kgt{gkCtCKRc^CWbP(`r(07e5lxRqJSQwjdwRu*9z z9fJ5NZ@N$#VXzP}#$7&FK?$CSa$0{ISg#0TRDOu~%9|_V=*K&efy;sa`-u>a!B4r3 z%`JVR32pdUENO(7YN{-4o<{n>!)$X4T`hP?vKg!USGGtIlQ1KDS)Gy>mU=b!#aPvw zHx>{0g@*NbB4z9DC}ekRvPL`F$>iq&@b-f0n}AYC;feQm)7AtV4M(pvXWnEk=j-y( z8<~^N*1%Q=II}bz&EK3Muc}ygG|73KzA}!8!Ls7;2{*CwtQotSR5iaL$~#LwHk{G2 zb^KoB5U*z2eQusXFzn?8zCv7Fo>kr{>H*mqo6K{G@Dy8cPrF)Q2V*%hFsb6413YE_ zVJDdjo2GZq)qE85*~jY)nPaDI>832(@rp9YdGB=P$Xzq$2@Z>XlreRO=Cr6WpJ+nf z_UcE+-He-gL2|G~{i))4@kg)yisJc3GoOmepMJqMJmf7$4JQT!XoERe zR1V5+#MuX)i`wYMkx#{w6yaLWg54)~V`vyySPC=-Bp_w`b_N3-H%%{9W3|8L==*&9 zVjpLH`QzJ)R>2O(WqpM;9Q+)JLlU`>7Vns`$-uIn&CKz$>%4EC(N)uf5EkR+KHl5KDu3TiSq6g1e-1&_e9vJ1y8r;WY-#)kzwG znc2vbY1tvNETj>CWn6Nu`Y}xvV*5LOm1{(fgJ~($`Z;*}JWdVGj=3z51Q2(I7bQiw}}hYk5e&sDI1Cv34_ z7_3d9ENAUFDw-Q@dBq~&ccM>exS6_DE=)Keqq|X}uhxlf`qEcp8G(-HNo$6xpyMo! zV)}#i2CkG2Kv%pfr#y5^CSUrl+8x&-OSMur1^#FfLVNU@j5Kns*sHsGe9}Pl@}N7; zAb0W2HL%E|Hji4@S>Dr%Ybf`y8f87B;g-FNPsWdRXEdVh5`(p&^y@{?Lz^!XJ6DDLcs+s;ax9J-B zc86xIO3TV~7q@N`)zZmwN=9p)bTDrw;*8X*lz&&TSJ`q1%SOilh9CI!x%#tja9+;6 z0_^nAI!$d`2d2&=IHvW^pvqOb=QBm-(M)C|KHNUJyhg{aJ)g@-(=86qrU=?e;U7}N^wt_}>}X?fz){>LCxmI1OX*nQ&M#L~ zTPCQy7g=KFZAqGYi=uu2#ERjQspSt<$B8f`ng_4*l1jq0!0G)u!XfwThrhcQ$x>C= zyvP;wsqT+=a_0Xsc+8dsoa807C_a4AT}=RE!F7_~p(fJjDolQ5O_UDwa2mmH2q$QV zkVlyb*%5LPfuHPi;eHCg6GAPR)+=_}MJaZ^r|OPKZVjP0TVWs3K zk?1nD2)}uwaSd2|s@d4Up}nkJKq!>2MHyt6gMdaz?F!lo=ztm%0K$R@%j`rm0s!P> z)xhgNQ^R{U)|mU|uWF!ZXhy5rBvDsU6OG%yz|qlCD7+*zfs)bCn6Q31nD^D^`u7W0 zHtAns*8YTaVqSx`$t5AQ8=9E)6;-^=OUXWy-jDzQ&ASXBrb`2^L@Sc^vjMU_?Z3f< zhzs;;Tr2_f{1q;S_vLqD$ZbIB6c91zf!yY?cmXsY{uF#>3QLjUpWwa!?|Q8NcYyBx ziO&4*7W-{x1^)h*#83V&SQlesh{Gp+W70f?gcB}vk-Gr0vx*xaEzwCe0!0ea`Q9a4>`Yy z6m_Z!G|rX1S&03puAer!&5c8=4-m;a(QIj93Y9@rCDs!8HEfw_vFY|wEYC}u;tlg9 z#)2#)W^l<;M=p9D^#hDz_$P1e9Bw$ycG)j>3HG|j?(PWpK9%HQrpCNi?(G69=y4d; zF7Z~7rzXm+ zydiDC1vy)|+>;>aUr@kNB@8{`$=GR*c&IwxOHA^&lxSydYImL8Cw(8XzCW<#+Js4w z1Fbl1F)&Bn9RsG*kAQx>;ofrJD?s$PMmb%2<|`g&gs`$V(g4n;RWI3J-AkOmL8rd0 z;e_9G^KWI7jGD(*7GFRL4NOLrnv>x_GLIm@>5M^1@LkQc3nLtLg09wifdPesLykA#ZDHY6KH2C0A_o;#+VLV`c&B@S}@U)E(b*5|U08Hq~P57A^z})u52XX)ek*^|qsX8D%73Zw`5wkoZ>~;aHppuR8&N}?sGtBOX0~FY5bBUCN?03iFoq5h zHnC}AgRPP)u>@`ItqgqXAX3ee{|tKi>%;S?4Ds;gK_v$@qQ8U&v}wBLQen9A^E)qx zhMQJMpXM!Cm5C^rn==6#gPzAzD`$YX3Psbz1Px$P0^-XQblqm&I$VwO@0Ygc(Y`>; zn+c%hu*gL^k)xdM5s`Q>tbSa~w&K+i_s^EZnjY&JIGRnK`aV&am_3-fgw2kh*Y~8@ z$(wY|7w+sIWKs0^pFPWigA`UwJ)W;zUSCxSJo};*Kv}+(2j9A%=(7$d(&hgj{OXw` zyvSzC8CD4Nrv>xBl^axld=Y_^0h;IOyMK0KnuHTIS9eg^dlJ5#i zZZc2`G36;A?O_c*t2@c;y=xW5^`#I=#ZtVTLpOW>Z1AqAvzK!44w1}#W7|g}gGNiF z<_nGmF_T*F5@=L<_dgV^)_>Y{82vGd2w5H0Flla6L9M?OaUI)2GU_^HQ0EzN8IJ39 z7O{Ob|8bCh&Zy8UYw6)@$mYRDdv`9f$-FdwjOdo}elp~ds2E0HlgUu(65*kZq~tu8 z>J4M_tTb7uF7 zO?z9!*Y(AYmbjr~d>Ny{D#1`Xub|b2Vb+1AnP6WZye1{Pq>xX~IU)=|2)%`b0=>9a z>`Y51)xev5MZ<`o_rb?U5G_pnq2PWrgEy0R-icO3&%2j%?0^yKwz|rn2W8g6L23eetGGEg(VPZE>%=mi9DP$PK5Ufea`JG;hFNetV@8W?ncMQQ*l%; z-}`un8w;=@t$>*TBDpE{malJcq66?`zUXLXP~SU;8i0FnK`|ooR|C=$M>uHH{&iKO zB5kou=)0^Vm=8b!O?10x2%z73nWaZ)W0(WN@kRSVC;hn` zJSa{n#HvWd=45sN&Rg}B(*r|Q335c_U`)2>^oam8Tb|jVfn3ms&oCJ%Ry%b4sp)fC z^#*J4^UBr6CWkai9Vs+*=t__##SUW8u$eHgWX#}QzlQq#r45f2{Ip9fz6-)Z6!CBl zZgIIRK_jj~{0r6c8<@QX5|bPQzFEE6QxycJCy4qo^ni0KG<6F*>2q%kzS;-fQ;R~_ zYxnE^6SIEnuJ_&2LpPis z^$9vt66m~F?oX+Ansu5Z%$HMWiUVyl)&M6*7PjIOr&Psa+?c)A0zrj?P0#}c8orB* z=OW>i#cfAQd_yx6-D}(O9o)hN^h~t&Kn*w(8!;tp#APRtUPl%Y=H?-cWK8Jn zu%P7>4ENCT>L0Am#LpcW>JTQK+uSs^ts|@K(8CY&K4o*Lfcnl&<)BJ)vEHtl(|Wc= za>uBzdp$W1(P-iIVN!g)Vj z9KWo0LP9hVN$>->1q>2)5zuJo$2DI&JoLunGi@9-PQ&LHQs^WkpWjM{E3dqhm$0>e z{C>lkXjL;@-N0)s0JeGB#M7UU|Jq277m2Ztle~I%H#?-aQ+X>6y`bexa@r9C_fT%B zofbVv_L-C!!qE+gWBycpk5)O2y!XH=qP~P?U(wG^PiC!H=7j3eXs-l3gXYl&i}(zo z#?zpFlFQc(Gm&A?{?85A*K7eSs*~wSQm5|Q`Qw3^hm)lZ#8fW4&mFm6KojfL)f%*L zo<0?Rb?hX`*(;tEQ?bNVY_)PtzCqXH1J1h(u>7T=9jbC$JQ*9eGO5+m$DOb@wFPrD=E9|{L%gCHJ$psuSR+D@?#)W`jD0?J zJPWq@#XAd}#2oQOP8DTF8awxuFy$A=?>r1vNY|nFF&=x1%Yg}vNq3d=yx%O39}yCa zA!Zi3IT#I6CGOUI?uWe zg%V7{!s`vsc-VA5za1AbJ*(<1Z2amI-4>$9S z6Q!tD`KDmJh)Mo6F%1uELFe0aHY%qKcHUl^CoaPEk5jW$_T28>3t~4Q?F+?tS~SQB zhzQ9%fBx>|eNfPHTQ7=lKL95lFT1oATqoTLZw1z>e z^aZTP*H6Clg99-($AW^s^Rf$Q=Y6~8XZ!Arezt#)K7Tjf=8kaS=e)(c(L{ayDQi#8 zJ*ku@Hecriyvg?LR!RDuQ&~hiuYa|W`;od(1sS?w?y#MU$W1fsW}Q4! zL^p;v=tFCm=e33CtjfF>{GTW_P9H<{2uxO zhZtxd;sYn^YD9V>fV5weT`d42ZTl*$8T#gQpV&M%i$|B>QFv@O$RuW#l2T-pmZ{c*<=j)TP4nk&29QXvQP z9M<^`3uvo6A=Zv{QMy762{6`g;kiDqi^;y6EY@sq4OB5B&-f<2byoQ(?jEkZ>^gbp z#4%_kIb-J&_!U_SPP}|LSX+&6e`mFO=!OrjQ)GIAlN{|Wqz$-jLl$p~ z=O3S)RK8t?dN@2h%X-67SDvhM-3#ue?N2j{>gJy_+jjLNSVwGI34O$^GUxMS>J$Ym zGA%H&&9%{@Bz`WcO0w&U3HSS_rjw6+2`*XV4lslFBJYyAPgNKydaFFVuZQ|3mSQg)X4gaoFij`>&`ZH0m#UPfEaukbHbG z8%y4E2OnRe=twx13~s>Me3I2LF#NhYv?H?7T2kPN6uc0@fhXbi#X+~;ZmJ1=7;DV= zB|qQ0>E#EadmvS8Xz;lG0qnl1NJFz9u zSnqoE*r;6JBT4IhGjXXAdNCM)oU*}S(&@|SqV>bDDfARm^?`*zh~o0C#%L3qhe-#r zK5Qt(UDi4GQ_4s-hm(-`sL{^%i&A4xv^dx)c?*que^|DZXh*ka_^@n!LfCc~Y1j<| zyX`|)upwUbwnGnzj0Ie-W4p36^)(&?$6dloclA>TOe)4*iIb`AdG+%Ijw7EF%ufcb zF~!f7lQZ7kGhZ!Jr(PlJI9-)1uSdk&N=}o>+7U%#%}OWsduGgh8Q4Ot^tz-Rbz?R9 z+$ERJ#d!C!t#~eUZ2@sxWM9c}VwY%cbIVY7&ix@ro!Y8Mp~S1BI=5M+OMe-&_lLuV z=Xt{G*w3;1wp~lMM(A21^nwLf7?|C;XiNPHS~HOty0`u13JF{Dv6EWY3PFBa4vMa# zw4DX(&fX5rDTEGCI34A7ZsLG{b9v1|Z+G=B?Kra^9A2Y*pM|A(=E$7x;Z$mJ0HkXG z*gz@)R)*BqVcFYX4g%oHn4=>A?hPDt?0tmRVcYz0xvV_6pc) zWol+Mz96d!iKr^gVVA`NI13j)riGU>jkk?r;UYV**vq|iVRw+s%D}$wFz6$PObf}+ z#AVRR4XT3%oK)dRaw^Ewr_$PV2z#7-^S6wBA7-0oKv0+er1CjNC43iiw7WJk^pG)UmSZDb=Js?mu*n{_N&+vwye4 zuJu!nUMfOwCele4Teg4ZTlSgn2D! z->{-K2t12c_NiaCPgUO3;*3nI&C;sRDO6bNa9!uj58a~>deA?jIfY*Ce} zgWH!LmZQ{!R?!}aREcsF=3;N`3yuJ-i>#dW&9SZq!By`soSmz04zw(Fj^q@2x2+Uo z4K>HkCtM1~NJ#o#8NoDq3m0cveW=zw^jq4^4v&kxynV7TTl?idtP%7d*En%l3s~DT zLY(VG<_n zUguAQ4EU0@Ap=fI6+(@^3q~DZx`rRKJvUWhhC`hfLl+{|p!b^LL|ixHq7t>w7Y} z6e1@v=T9M%t9g+z8O_IZbbd!mNl#b%8E`5^uw0ZIvJ0CZBu+i7GXiZF-*LF*bv8IH zt%nh!MOPLV8kpJBbQ~iuRKf0}%CmsNKCi{OZc+Xo*>`tC^{^e-D{G*4 zUaa3XxCr4^Vd{}#C$K*2cRzj1d!3vT2UN2=8^8*kFDKeKRX9@FTr(5vEwU%Pw{}?3 zry5=7IE*JVc4v4RUSon`Cm!KcJ*HodjeSbC!BEt33+~ z&_ebpv~E};I5u4`Mt#LoDX&g6m^^$bt_RB+3cXJ`9r_lO9NZ{3G;@$J@*$d(^mEKn z)ZU%;cC1>B6RxD^q|F%|8+U3eT7u@thlZ2#$KK9fx?_cQB+E6ycnghW64NaWqSr=yo@l7=v#HJt5*Dr9K*yp8>S^2P~*D8bx z`sa%G+_%CE2JbD!o=u`i;u^GbyCJANXLNT1Ee@SkmixVtcS9wbO}!DLqS3RY$vSV$RnC z<4pc#jmoF4Asq7Mm+3b#A&8V$ZDNBysgo?fZAswzG+*NG2Q06SYC z>MuTctdA)N@j`H4xaWhMU*W)W9$szv@EP^CF&@v$(|Ww5!+#4YS{#y%p=PWTdeLy7 z2;yxJ1PAjzvgAjX9QCS|A;fua&qH7@cOOm{Z9GwmIa1v)ndY@xWbR0dh*C@6$Nql+ z>Od90F`w(OrqFrJXuEd7lufwKZZRI)Bg{F54@XXVBDBW$bPRQd_=ld`F z&}?VEI~vOI%Gy#nNGFJCHFddJ)V89Qt29rWq;l;s{!gW4^XD9_et8pW?A^dVQHM=0 zr(;b)DJrEhF)tU1yx#0CMZvS{Q2Mc>^|nhXS83TA_FJwSHFCL%@2_)o1KqOBkC;EL zl+P=xk+ZqZJkGxBf@zmjK5MPkJ88)_H%Qa>Rw349bB?d_tgc^^ujUyZzyN{jVD z%$wMzHXvtp4mKTfJazV#q5tF%<)+%PYBV@#BC+)!HA+o86GGtMt9B-PT2Z$-2kF-H zt?r99yd;(D+x0fWnO$;olUb{6tgja9lf&idOjnci`yu_E90)(rtd$M@-;bVy{md!R z{HnBXd})KU{#$HA*5B!9*YR}|>clz_>Sy;xYwMv+()uR$?H2R(wFxyL~G`mwf-X}VCqvk>K?JUl|M=&lf6 zXd@yT=Gy9OA%5C1H5lW*tLPP46c4jjn4F~@U3AijocKA2UYT!ky+JyEm(GQgZcmUO zrnGgw+;Uhv_!^5j@kP=Zd_QzGqC#A!h)qY)Hlz7`yRlk2C(ek)j2Ii&4bGCzh7zRS zHUqIznUqx3n}f8C)zUn_AkNpLkzQ{5JlvQYi&=A$vSu7m_f0Rs!<>&(Te1X}x?e8?mz@kdRRX zgS~PwIJw5qU*?)N0}(8m)wF9gF1|sJMN3y<)q`^oa+Qm1By_Z+RXu<3zv@b*$Ck@H z)nm(cG<{`#%%x~;tdk$e3$fK2!G#wiWcDH?uUdsAb3@?mY7-6}%{V64DCC2H2}5`! z*Wc+o(X2ekg#b*r(!qx=^HxH{sK%H5KL6=Hw)MMX0U{>Z3!Qdrm5%XclP5TwCr@u> z>R|k`Pv^@68-Eu%w1-Hq@PLCy8sXuou2bzzXm-50+R)E!Lm2OkYt-}Ry2B=$=Q^#2 ztL56jL=f0Vxwxws%yri-0D(GDLUpLB8R`@T5%tTsP{ggyMe!RukgT){-%IEI?bs~e zv+zRXb*|NhPBdsPyaY4mFUF(U*;w)O8MxYoOsQ=AG{pRN1s=`J$3jQVn16E;U#Y#L z`9Q$yvpBpS^`OPd)u7lnkTWw`e`HCS1|tR38buf6+7Oq!*TO*PzxFky^9@x zT7#6-_1J4`zG+BxI;*5>axiX|{#+d-Z65zr1`U&_?fY^?gG>TG1bR%`X1TIByW6%}%S zC{q3>4Uw10F9yb3#(-~R95S>rez<#@jjtsjdQ}A+-e!FL5hT4}l!`b;8Aridq{T)e zWnm=7sc#Xrv*!GAF4DKDOUo}3aoX}w->-yvMR0j85?(a+4kx<@A$fJ0R02W^%AU%G z!Kwz5w(?9Y&r?nxy%w&;3klL0hHBg`ww#|`oF>tyAe1dvX2R>}V!kC0wx|25e3X9MaH2>pZF_h%ww`67ggs}k*X*!su6 zp{CC_Ai7|BX9EgF6NB)?^!dqHm8s5K`Z6r~nIGB@ZAIZm?&Oz|y(&S0wD0s7Ht$)tSr%(PNP2=nPfSVQ|`LRs(`!kSymr}z^ zyKw_Hye#I^17W{dh74^UA4@=#d{w6vd$xb*xYkZ9t$PcxZcCjs-%9N?%hJ2QciAt( z|4cgTj|K*jVmO zsFd~}d&ISxNnu#DJOi2Hv!ct)kUpQ@U@$0cn<+6NKTCV=` zH^A^(dG97dPgLV?uawH$t6ckxMfu3<{jCAg^qH{d)eUw7h=Sc^I3XBH3sz02{?y)D z)m;;f&yD_e1Cl*;q5iEL6ud8PZdz?`nX9_Xbypt#X6$*1qxHbw@QT*lq~-dm?nlB! zd8y0O)XyMk*FWkYu3Nj6enqO7-jooD}w()QTNRuqSbKM{9 zZv&!9QBj|g-I}PxzU$RJ@_Ll8BEw>tL}R+#e5-?X_%-P_pKU{R?0@0-g}XHgq-*QeXDK{OpKt%D)+=OAP-j-7~z zXh=04-mdf<%0%qUgkGUV@i1$`%vne%us&z*yTV73kX;{u2(fGwHIL#!=T=_oSvJ&`UA8o%{j+W%}!vdbYCSibMH$cyWpfd_sJVeBH!LmyFz<7Ufb|j5PV$l2k59 z(OAAsi^mS04(WJTu4!{}Fam5fwXYc;jObrPA!L#`F6x8t+MwN|AM5TYROtavHOE-< zm93*+>0IMu`6$$8ji4UaM`O`#A@J+t|4 zz{hVcv(D2F&(Yiesja0Z^tt%@yKTsP5O%j-zSh$8P9X|+)uUBAckSvx)BaNAy&=xA zrSlExd@ay2UpvU_u8*HmD?n3aof^C*qLHHWL_I2AOGRuuA9`yFY%p;*!lia&k?-!KQH60y04(sCVTpuBY5vm z*?3j_sE(h3#kWs`b$<8a(7Ui$C%)5&_3MkVxA8l3jj*S`I*5%guE!2>{NcY4u@0IH z`0oEouztJrM*kSZ-Z{zPu}yFPi&t|t;`r5f;i1)kKz@F{)a4@U*E5xXZ^K3u|9%Z# ze)Bjc-Ms=?IpW`?ZtW9zK%VxKsN1j$Mym=rzk0tIFTXFHV~n4Mg)6d!lS;X}>JU0c?sdVXxcRnwmEI4kP}Ad7_EJpwcO?aT`0y9K?tOf7xJJGw;~5?-*CspW zx*Kt~_=jCJIBZ=ero-~NJUk;1>?lZ2L^Q%M1WQiY3b>&>CR#~kQ%9z#-oox z+Dp5!J2wuYXhF*$+^4A8SO#NA9C9mnqhNI+=0%F>)yu)#9dE3~JoVmEOWt-=^}0_s z4v~+pMWXs1dYID<(sWzn;`fwT&<(f?gfhgk^FU-r_fgJ@Ih||jWH_|k3 zFGjLj#x2E<;HCE*+^LcZuq84B#f4eQI3njEakaS7rA=oWDxOI~wl)v<=VJFe1<25r zhx-2AmAQyhzti|a5;Dte+)$jFh!-*=mHw78JdtB@lj{ouo=7W_mZ-#Q9v*wxsEanP&HwwZ+_n{T>(_F1wT${ive;aIX{0j5v#gq!+n z>ULQGq883kYZ0kKL({-+_Ba-Z1rLe7&{>Z3+|6cn7D}FUX6`=>K)#!=;hcR zY~3L)*^8S5OA!4tKX|A&KHM(xLCE|Ekv!W$B-QHk@eu*=)K2U!bc3gVIO3NqLWned zB8d9GHGQpZ)kW>?Xb+6Wl9({~jaO&j!m;p+&|{8TQ;6wEE5aT~z=9imFjkw#@qy6K z(@Rq?IaY_JUg0}CzOBLk$~RX4zuECfm>UA0OS-?;=Y|D{zb`}{Z__*FFxnii^xbo# z$%*!8fvgxepopW(Tf%!WWw0) zn{sYrrO!tp{ufcoe7EmGlcW8vwB9HD%3>Vy_eV*?<|tw1BL)~8)Pn30k${Bx7UeU> z69F@&VRtF(mFaDRo$_(4=^y2gw>GhiEtaX^c9~SR(Ru`4?uUS@TG85L@;Xpgu@%+g z!;|!g|K*$>h9>LmYwe54Mx_{_5 zX}X{-E06B&L)*6GSGIohJQ1Rowkh%5(!S+y73#i8S_ilOrBYr8J#_zx1=kN~;)sao ztY|?)t#**;1zkcGO11FmXP@A}&H|)FiSs$>eC??OJYutD5Z8(80EyYsIQ0P-H%b}i z?x#n}Z(@`ehm0^zOhdu?WauWU=eDE9A?V)6@R(d<3Q$tr_b_gY^u>{xr6@>>M1b~y zhPyQ0=nP~fDd(##rAGOoma|7XXMg2sl!@XGNkQ)VG|Zbi4%!*L`(;6x_jmzv9~Ni7 zA|Twe7TntXIm&tXk`$!P4Z=8!OBU`EBaxDsf=Itm=>Dw{jgDIL>7^4@Z>?8unnh;e zh4gs{x~zNT?&Ex+OUlJst=wL#wJNt-6g`zKe_lK!`}%Wn2)#=EyeRXz87O`u#lbm! z_vdk^v_2N5K<{r+E)#V~eCc(pU8t;=Wf|*HHK?`tcE~L#$o#If`_R{beA}*;Sui{u z<`qUu$9-zAEhkN=6XzP&`@!B}Xutd*juHiLcyx)DN7R-z2EEmf{^|Hu`$iup+~Njlg0?IMH+jz-NJL;Imrg;_P3c|%8p$v3X_@U`{ciF#yMd}q-MB|UDeX?*X^ zz*_aDV|PHe5oOOmq1?2SmPK6VlbF|QS-3-Y*J8DdYq9w~J9WXDc45;tr8n|UUC$ux zS>_WNf&g1j?v3}uG_@9%>gJ)l&Es>I9$~gFT6hE_{0_Co)BO$jybmeZrcbMtfZpUN zL|NY?kh#H67lG;OtDd@0|9`uc&j;$ExA}R=Wg!TYn~DSW9S}9A4vnyzr`fm>c_k)j zPc(XjA!MqJJAmUol^`4H(QZ*|p(E{|8kHJ=q>_oy`PsaI<}vlBn0~o80w%lR`*s@( z#X;>srbBAEPMCwJo9vgXUR&*UvGuDjaphz`cwQfZ>+F1o+XQL7Rr{O&X@99q zUl`T11{KYOFz9D0%eC&~dOJ6Xrek4bAZ&fy=Vy9E$seyn%|8aP-JEFe4&Ph4d^!>y zNyd`Ji!j}CyZQPc_Ed@a^+41e5%9CMO^fyZr(w!Xtz)}UXRGxi!ND^0yl%R(-L&sP zy^YT|9ja1pa0fc6MaqI$FXWq%6Cx09XM6Rz{-*qo9wpy}n|M zAEw`;?8y38n@tl;HPV-OOoyZEJAL1eo{RlVJL-($rncm!D1`glP7b(Dis;@3s%m=Q zDDIHT*R zcUfH?V181({%adspV&9eRUQIp-~ASLA8AF+mcJ?M;Dji|-(`EBKtx2tO*2lm>7bk9 zCD)Ku@OTVDweYEQE;r6U63OdJy90+$<)fnC&5BE=F2?*@dY@g73k-!$?bkmrUp;@c z23K`jQZ>`ZAYPe&hCZe6^RJ7**vN=eg7E` z`AW>8^{7xEa_vEyXsy1+9{gfZu&Wfsg=-NbDtU5QBN|Ns(1rLyzi_6Vb8~kDh2F0A zf7e{6l423hBVfB|COR#$7spN z=6CzPM%dSiCbfZ-U~fCeq{BoIG z>1+SC2~9`8M7vcuchJ|}%RJTav-Evmoy+ndB3GSkvpy=SMNw8dUfNPWcs2eLoonCJ zVdMJs*ehyU9X}HfEa+WRt4qE)j=H)dIAZf;;v~M4jx~=Qw_jcT=`S15@cC!3{gxJd zAwGY?-qUJdVejS=c^*Q46^mQ?9O6|>y8UJZ_By@17?b>!`zg}c@gFzYh}T|rg?g_@ znv!p9PvdtdPMT}CwKO_#A)d)tffc`9XydzSD2xe;$MZRhakG4Sb{rpU%E6P%;xPY? zDBOB)5*|}Sv94xfD>LTf)?06N(#^+{yVMU@JNY%V=cBIa>p7#>)zB_&96M=Mg{#jL z+$fLEh{HW@+#E)Y+T~N*wTuo!^({SpFls@y`FH1KZ3hA z84F+H*x!|l{XUcJH-9c@O~v736PkvkGS~o2xYAav$_=Bn&EY4WgH&6OsQE;_`xzPt zKdtswYi&+1|@ma}d~cL%?jm`!e8GT zKvMLUAmup3n)^l2&L)E=ny)$x9_f4i?VPTw)Y@~mEysNc=_oSPqOol-;vE5qc}ZF)-q?-Yx%QXEI8W`& zvS+z9e!NRL=bt)L95UK54m!QT}v9hX%0@-}Vz| zRt`(yBe$nMTy>%8AM#Nsf~9ldp<#mQh;(dse?rezIn-7^lJ8N%1*RSLT16STT8&$= zK{~ee2wfx{?+#V@o+A^&a94z~Zr7CLpkP-Wn!i<#_kZX@YeP8-UM@wQhll;^3`43F z)qh!ooXz`CFRkA_Ladn?Sdk!FtY}8{TX|SpScxW^VTZw5cRk^Gz0x<755p7D;PKTz zi%-rniEU#Xw!_El90)>oaxc->;e=xkOs>ykj9 ztJS`qMqi}Gg8guX))I(I#^dU1l+f&vEidEAytlBo?l?|z=W)(mdVM^ee{(bb`1HfL zduA}qOTMWFm1-#Vj;I(s_U9T{MN3DJYY;3yYkC+5O%}(VpVnZvcqz^I6pQWs>Oh@b z(`##GjZ*Wg>=+Kq8Q5?HU)!IZ0};{i#Skpn>?sG@y;-AMbn-gEcLk;%r-ip$fHb{FCXT0IzU1#p=JBn$g$W zMq`8j1B>L4opdr^w+EXF*C8uC4Xb~jhtjw9q2^e-&6-Ms>i}VI85&ARYUW!22{)2&U6I+#D2uGCyVvsGDq91wN^B1vs_hxber?4 zcF&fo&964$w4GVDr}ZB-@@K<-;$yp}Syi9+qvv8j^R4uqYOm9P!+38sh+YHB%34ME z;PZNM(BOkWUq{<<-}hbJ&AfVuEW3S|cwitun*;mJ^F+uU3lSoUuU%Sqr9XamEI`Dh zv$mrqBBHa!KNK_7K%$}EQF|p$T;lHFym1JPyGZ&q9$p$vYU?v7Lc$H#%1!s$?jn%- zp7PGxZ@cflj?*WrHS|j3swhHw(p*H`a2;mc9*fkh5*QA(3~JD$v#kv+4MtQMN|2wG zis;{FtN+qdON)AC=o)YP4`52VL$p1aKmSu-#}D&L|2k1?+p*!Oa&2NTocc~arV+zUp#cB~Q`{!$~&d~LtK2A zaU^j=z#Yk0B)3M>j=HxCuqGo-Ip0c6L)I$>GtLVK;-TNfV21C-qUr+K z=u5B0v^$sK(Iqo5UV87rzZPScHjXSXZkJ5pxG!HTJXQ2NPSn2fgqW;XkW0PjaVxjyn-$@+bw-M{t ztU^k1A|8F_W%=RJy5sh0x1}LB$`ez<@5aMV=Axvc9GhRy#nX?*m=x4TG@M7tLRYQy#_mOPt--@`Bej zYVUAxaVQcWPca941+Rrq;<35*Zn+qdWAo;eMfak1L(9sPiB4|h0KUH6b>r9#@9KTK zYvt|bdvu!5!yJWWyIBT?8@{k##i;Mx6g;NhXj6nD<-hGU-Pp}nH(zP05VcreZdEpi z3@DOs>UkmgPMx_1p!3s}@O03ewn!>!w+h=%xtLx%*$O-LTe{{{M?abyrNL%5QuaeT zOb05l>Gd3BiJMlBrz3s!8sxlEh|;$zvG0frHzR{R9fVjV9-ivWFWaHXU?%~>ahIu$ z3mrRc4y>Bq=^1S7*_B%~)9;CpdskpZydEJ}b$?I$7xmb;yA*|MS0nA&0&K16IiFpf z16u3*WbBk+9t81T0>spFVnkV9 zI+E^*kgsuEcf$>sF)JFeNvX)pD}m8wh@=Ha|E~6)4MTCz@ol^Mz?hQTzKGSFJW5P80;vX+{0V>Uq#j5eT#Q zaNT7g2oG1*Q&UBq`I^_@ue%=b(2_adcAT|!oQMXKJ3{Y{Q}0VuVAsbyilve1yF(kX zX4R`oaMk-(EPixxKLfCmuj=s8ex>(T{Y?1Vxt)8(bUpNPrKk-s96TZqlYRa%Hp(w2 zK|kAGh;=mlXXl!=6*4#=z4r7~yv=#=}`f*!*@0o`3LW`M9>#@Fae} z%|Q%y>^NL{>7`D(ad01{zTetd5A%Be^*{Sq?`&%;K397ujPG4j>!sIBRPvw?wJ;Q_LT4ITaeoPpGr5^ekfYmSv zORgID4V-h!{hA;IS!O#g9-=q=Rq!?`lD#^Qs^1vaDUEH(&S%^^Ebl zk8+`;{AOaool0-Z>$^~8@fEf2ZC08~^oqw!-H?>}2=b-ln>g+5&?3s7m$(>08}B)= zn_?G^Ha`U%a^EVY2|A};JVG3Wd8yBA-fTH#Lix+9k@M%R*z>VTsnycM8v&Dp5q8@G zEJ|30)Tfp}t6SQx8Yef;+FR97Y5+WJggI+^R*l(9+X?j!`Q-lAs5=(k!BJTB+f~R+ zUxDQKXhi7(;jNAA>pD~x=3vvI?s{3=Mydbkp~o_t>!^+HHZ`oKYZYMg%XVz?&PLo#d;xYN42y+sCZ z8%Am(?V_>fZK%UuYZS6}w5oYP>sBI~Of~X3T!`ObAB9TXMw^dqJ;ymZgR=-^o@hUN zwPcPNt4`ndj$5`k*@`dKUhn_sXg(|)tAjxfbx6mxudlZ8z~)Ni?2z9He7pgx)nSDP zy3dK-#;T>)ak^L2!Is+pX`VWVEwfk~%<+5phhf2e$w-yYuU28jgVMQnu(y2v+Vxcv zl-1A4!`g$Ydz}vsnBed{+Q%1l65vvwVAxUaiJbZ+i8`x3JqVMSfo~3@W|#Pf*$D2g z%Sv@Aru@57UG2^~QFH7m9RB!C`St7|Mqr8P$A=+UGV5;uR>L4Hxx#z{XGCg&;i*SZ zWbq(yOYtLkV%xcSGPv{Gfu7KL!PjZ(%|87^`^&QPU=GrsvaHF~h|E#c zzS?Wa<1%yDu=(WqR41$(#%h7juasuKZR=d=Ag8T7e~twfxi$+q>+`Vnkocl;xKdr8M0pRzEO#B1=1KY+aD70}W_Jd|x!BKK;$fbT zCMQAe?i;|tJ!(N}ZB%L<3ZHU~OV7CU#n?-1M}ol`xX>!t8%^e-V+tb{B^c`W86!ZjNF|E z@X2SNVej^06u*>#l>6r)a;h&nzq8$fjF*=>UmrG_AKp#(a zLwdl>wX~YxqmNHnZmXk*mC;vB z!nEl#5%bGO@l4(yu=*is8OZ-)RYNWffmVF*;xZ)Ndn=Z0aV63^22-wA?=pYbim#Qv zA#gQryzOSWuXSS;jHl#Y7kmR_rTRqO%{m0zJc*rx;BayDUWvm;r4fI25OS<_!Ht+= zBQxuHoz9}>*w1nJL-FEn+<2XhHxm(!a16ncU403_YU~AJMU!Ymg82rHq}kC$d|3-x z`u1?tkZRoWG@jU~+!6{}l7hskqOS#I8BfFTg*@0wD3YyfWU=mg)zG5)T$*>a*PiB< z?pr;<4g#t6T?BXYiSVarap7)P%kfXuKEU1GP93w~8Ik|r%FQr9kCcbiq-}LJ(hF*x z)*LiWcRS+bz7~|cXH?!_U4iw7M2`+}`XJGBo~uXAKkQ$qZ#`D8+yv`W)7zf7@+ZnA z{r37M`@y8HCe&A{{XJX>KXr9(`l!L&%-oOPSor)zt%=e2Ili=ab4e;UQ%yUX8|rb< zC4H$A%VN3Im>iaC>pyDLCOL!Qt=+uqFrltWxhorR+XCoCZ7sI$$ed_42Wai9?$L~Y zPhDs-9aMU+_k+z=@Qn>h@Y5E#e3ahcpZN5xM%1omRBtRq-b-27`l+oiaD&IBFobD8 zKVP+(!=D~L{!n7Ddr;GG7V34G;Exb_o2*3LKe}K#yhje?`h*7~pig(oeBc-C!uI;L zw7ni{h3V5TG4@jNeh*Cei5mQ^szJlIO7Gz5!sl|zzz2c8{kete%sJT4xLpaK>y_S` z!zKs8VQt*%I45fKd+UO{2fnV3+8?H}5Y9ClXig7OG-5a!>^^R{mN zZ~ni#?2E9ys*fqy&U%!sNC5y*Vc)|t3Fyh7p-f1mpD^Ja6+P0q9#cc~8u>#+36 z6zKhJhn^c7EFX^T=KF79N+7jm4{Gh6h;*X%!y>i6r|!>hhf%&(V24RsXWvtL^#P8m zpz0$xt%ZViblE=y8z4{kOi}8q6vvbHj+#1}8kA!#kLmEcN*<*6x*j#+5{@naK0}ep zbMrxfdX80d!2a~%l-g2+By7T2j7dts`*ryP5l6lLQf z&7NKIZ1ug@FTyHySo{s$U*I<38cdh_9Gz!NWv8y+fdLcx6d)ex_`5ze$miHASC`wr zR?t;%zTPl>vR~iM;|IhOp4vHD{V|6RcQ#AghfJKKX*Jaj`nr1>r`1q{$N%# zt{CS%9&PVcp}wUEdp>q>XX20%6>6_;ihAvgXxLK%u+MCk>wm?xpFe?Ri$Zb5V5C1T zyF#su#)!Hjj+*p8jw9-A!|^^>NK>KqU*V_rA4G$rr`9@;pnkv78+xT$b?voxAwNIg zVfW~K<*m4BF|yTR4^2Ny)zY7=!&`q^gEi^v@Sd$__Aa~_SBL%w{zE+$J$dq^!OKPP)EN0LVedyJ#o3xHzcn9**&;h+$L!)#QHziz?B^AsoFR3 z+9q*?>WRA-MB-{?a4*+Pj+Flz|M58v*L@)OhyVK&Tq^fjG1nY>9Ic<4a8PWsGlMb3 z=9`I#MmC0E$?T?^ZbD3qQUhau0419ZVuVL+w&swX#G6Bwo3G&!~v<@@d3Mv%s_V;xpLn}fVpD`B$NeE10B zF*#Jdxl{>5g~{g4wbqaKpj^H;G##On`*Q2bV!1dfSBvHDp_`6C?RrmFSN9DeTQ#7_ zT2WoO+l7E!JIZ$(ZQda2IN_hhM^BaCToo`x=ySY@~0eauOC%GUMnUSxfr^JA*W@VYZFerleEFf#^MQ0;t(}h>j8NJy>8Z22 z1cho1xqW6)_9ZW_hus|P(J~}mI|H+0W09`4R^#rD@0$#$s%}L7UkrAxS+v3YeCj&%F8|&nAfj&QE=(4d0xL!Rrm!{9|IZ0)?+){)%*9-JJoAJQ0@DEmw!7c3t8xog2ziC!J^SL$i%@mR4gqwjL9G(=q+JK2F^L$M5Ft zjfT{Ajd)oO zzykjBAHqYkCSlMjfW2%QZvL6l`>tUZ8tmNG`)c1-Y?U9XnFRd}7B?!dod&&pJ^Ba? zJN81WG`*+OXxOn8ax3n*6*o^kOCi>Qk_!1$jdZNtbP)er)nF&!dJ-qqiABq&sQGSy!o~p?S@PT#rT_X|MFS#c}C42A4Arb z&m9I~PnotND{Z~}kfW!5DenE5{gmpZQ-TpL{XKm61AI^;LcO8T**#~_YL2bI!T&uh z-{TGaY4F)S{~;neOBjNs9<(5Ae*>@@EeOj1EcG%~k2v)PPRr|?QQ@F%-o|Z($XEN% ztwxl+@HEPl1S}G>Q=pSha@=oOif3chu;#|6k-cRwW3c%s+~#0>hf1)%RPB$QiO_yt zV-31_zB!bfU$EJ6kk_;wg~e+B)cMfaxTz^_Qf0oN*7OpYg^YVeO)I{LS&?RbYBc+) zeA_oo&D;@sONHZ>wt2(zYFb0_MkLx1FFSMh)H_PnbF5!-GngAnJsP$w4?gZ8?b4=3GLdw zgm0Tsv!eioJM7mN>gFGXMG^9C1k{w|Aa6@Gn!fG68PRpZgngS|LC!l(z}F^RbbT=V zdK`&3FP~xQl3@JDJxZ+5w4)G(yXw%a)v(#sfu;kSut94I{GR_nur`mbGA|dkTzAw+ z<5$b|hc2`>RH9H@?j9kS6B!8e?HP{=@K-~g^*c79yrC6cTDeNo)_P+JJ4KXK*4JUxpo+j&^ZX7YX9a?-5WV5*j0~K?M%PNdgXzTx#0-x zYxzj0>Y=xWD>tw{-hd68_rau1pQNj!74^F|V59s*xexR=26UH?^x5h2qm@wTv2x`7 zp%9f;Wz<|(j)Ip&O_uFw?(joMpt6qlmli^8e@DGxI3Wc7{W;{4){DF3?ajvadP>Z* zv@VKmO)8o2yTX+4p>X+hEKt|irg!qN?)A#<$gOdf(g8B$bKuH(;`# zvW^bAu?UQugAg(DBL)=yxg2%P+K-3T@50%3tP&gEP{R3scPv1dc|CW7&#ep83*mJr z-B9U52%m_E&MjZee>g=sr#qB`q{W#iJEWyCJJEKi4C!&v%EORe^RPB`o_aoaeh9ib zS()EMnMltlL#=k5qq7aQTQZUG>ufZ7IVcf#clEsdC_ep%b;?ybpH9z$d>KV5``GzO z$ggTdr*>0M`i}aF93q;oWV^@o+{7j7PigUU#-NqAGVe zo{+CC1R>>a9bCP%AZn;pF6~rF=lD6OvKp_kG!wDXG%43nYzac#<&eEti|^dSr#}&tqFEqT{n+XlOIHJkxo!3i(U#!*aPbA1};%JQ0zD+SL7(m>_D> zk<=WQ&L5QC!Dn%fURh9pO$VCLp`NRBG}plJr$UsA5Ti#p?$TKvflJ4z|B#PD5$HQK zN1=jzY(7)mIu++6c_`dH*ynl!(|sIYhfS{(Naw@ty{@0gXX=5`_>W*4=dmZn!;mYn zQgrXwzZTLz7RT{*oA64Zbe?@uU6Z=nVS2w5c}}h)v>zx`rcLU~d$qDV!10fthA{Pf zv+^&}dS-E+-1Th}s<&v%)(`soqinWpVtPj{yOo8gcKN|d*NhGR4=j?GtqF$L3b0i= zA2zRh*4Ig-bF>9LwvRzxcfbBptt~eI{yt)wh-i4RIA*Apj>{HX9=Axxu?+@f$44Vo zeqbpSDXS9^$_y-x1g9IYqjU%4pV+Hs;?~Kh(NI^1I!E1cs~dAC_TuHlL?nuCi&}fS z*~JK*yBIUXb>W7Mc=^Q=y!Y8xIIUeb@B9jN+h0a@-d=ec{O8AFW{;b9lQ8qXg%GjW zlU3`H{XaW!Q2Kr?Fnao%BiQ@bb!v!rJZ3Dp3!x*WR?5+VxOM(Cx%bGHm+|tpgE;<8 zcNF&YNon3T6r)5wJ`08ZCbf178ak8jM)I$e_R?xz{~hMX{thp^Q3>Ox$MMZK-^ktZ zPd~uUSD!@Oub;$D@eEYZVl2LGNF%T^&zY%s`oU0mq7^%zi^F|S6k=zsG+o-UCr;s; z<2BN>J%;=4dsdz{&(OtqI%SsQfUZ|CbU&5;e)tC75J~dMI;aha*fb?bG*!`x5B7?) zY){;H?aC=$P z4^yU0kv~K92aRWy3aA~h5|J%ybF>7&=Ttkdk zR2mAh6A@%}r=@Lw4iaK4Z+P_n&Xz4nn6XT$4K?MB&ycJ>(W@{b=h|pwi{3leV(&{1 zZo*aP;M#lScS65zFLLMhd}rgvBt)br-{TcqfSs!&yKfAgs6hJd32HNddaSL?#k`5~ zzx0D;84ICEDJekmO;&|-)PVG5Nhp$QTMb3p)>0()2&DF5-qD7NRkM&#tlXIjy+0Q( zJg$fDDEVc#9^dJOc`t3n+B>br`kfKkG1178pZe@QU9|<#nERBnM1y`)iqeNeZ8n#v zs73yqxyY2p6?CT_#l1;Xx(3ctP&*@qzFO$szp#+Hb+;30nfZrE{#Rw0sViiLX=pqEWUsG%qV=h z%XYJL9{%C@&zLy~?AJ}cR@9W_q0mkZi=H>>5%RqOgc@M~IE!p128Q69Y!{l| zEkwbVI*Vmz$pZm*#3OE|WfOsp*Oi_+P`{%H8{Vn6Gk(eC(-Hm41(@#LvsAmJauET& zdb=O=#B^!fo%C5AO7}}sDox8O%V{x}YXHJ$dZ2n&wasbpynX@VV#44vMjfCsm)qoU zM0r%B+-Bg`6T$Q2@Qa`IUMF1B1=Fqq6u#}CeB}8|z=E5+dwoaOu}T#FaVzTVe;Ak) zhJ@G!R@+rymZ7E<`wFtu+A)E^m{cU(Wbc_nn!&l0d` zexNiK*R<}3viZ?_NTEMJCjdtql6_FdxUZu!a_`PeG>7prf55Dac(6L?=j}xAh&JRmcvHMUF+edi`z-_9khM ztV(Y=l#ireW}?Dg*$W}kIrBQ{oVmv}iB1@E6Oi*sq4r`H}-&d%5U zW-dX(9hMJrcIz$&`|Hs_#*b6dG5wzlu=S9=vqnGZ+;8liRa9I}+V6qj76=yHB}hon z;K40ukfw2W2=49<2~Kc#ZCrx{CqUCUB*ER?&d$s^^UXW+-kkfdE_y9kt9S2R^;GSu zNB+MA=R@IZh-2BlyR&9}(3Z0M|b zztpoLu~pAkH18eqVW*{6`l`*^mw)3nB&uq?`k?>zaZj=kTRmmW5C6uAZGb_nrc1ke zDGc(+JF_!D?(SiWhP~jEV=9PXF658mD~zRCBF^eVudwB5$zMs^xZIA@%7hkGNcqqS zO#|2y>o_65qef^2}qHmG??Q9=LzU$612eI+7Zy~oQU1LfF73RvP4Ee5g;c#H^Kcz;A!K*)yNhf}uK$6~7Vb^Z$rafOP zO>#4qtN!VNg>J9#&9jtU(1$atb8J2{0g#Y163)WU_+9OIa`;RRXEu2)iEnWD5hME2 zo?S)|m*h(zH0+xLe*eAZqpt%yEJ=QAR^#e4 z^m9f=#!}>Y>RaPCp63?PB;4pkI-f-26n{K^F4?%MX=#_ZiBL>j3?b5Ea?7h|=xQ8} zGnL(9fdO*I=F80`h3<~Ijw8i|f_P5m{WRRwm;~zTB^-%VPV+XSpP$v}eNxjJ)^cdT zOatUSxw5bJ?b#4&zL_R~(yNxcISf3K56tdwrGw?nsWtdTS<2&wi-!F_SI|iWyM?K^ zloE%NDsz5W!@03|tqLVo8JI0NSxxqLw)Id;r1nz}?01XI*{_$W#qN$IHK;BCawK+y z;>ARjt*#YFuh3be(y;Brq@QP@e$9@K-Z)9k$7oDd z+RG6$4Ll2lY&XKl&E>IFw}K}txRp%a6Vc$#iWR|( zeMbmjbUsu)?BlqdeDN>u?1 zub3gl%4nhdsp0VV|$^e4;U0WAp}2 zGJAdKeOCf-EX_l_M-8VtSxT0Q)l;xGf+_DyK>gGX?_0w0HZyAk+IMHaqeId}qZ`YO zyLcD4#xB9Pwyg`!vheUQ_A5j(P)7xKle8GPikyn-IAOC6J*EwU zij1J^4Pu!?aX5|r@(JdySRK^?=ZjAg@{8U1&%vvL z_JOkZI2TQgtHR2SXC|!awzYzg1Nnu={32)ewcOc|BHfHcI96{QZpOSnz0<~kj$!xF z4mYC_IIv9ScH+oMNIc^{OvcAQS_)W#zS|aWu<~uk$%zvE?bJWlCe%a;KS%kDU7{$( z$R1Gi_BCfp{H!uePw$4}O2|kHRkj zf2n(Q_mco_InzOAWI6B|Jq#YyL!K+!Ki5(YM_lWQ}$TJTwLA{0)#nn`Hx=g%8$J7R+(QmE|-e^^zzD6>$QJGtxNof`c zo7HOFdi!&XQkZ5g#RNK!xTuoYhf_F|w#=PQ9{P@ESPwkXDf6Euk(G;2&z|N`8|{(l zk~PV%`e_PkRDhs&g2$<7fO8rsOE;&EpFR89=WSyr%&7IY`TK?s_rPrwE?H|m$k>xgvpr)IY}j*l^WbCrqMv`Gj358CRym@`zm?vBI#mAo z0NG#y-Q$*`zYHZG*UlrBVN*#c&duA$<_%1DXK9P_x1qSD7X}~cA}Q`giuY)Z4~8RU zY(Uj_hYIJ>cs>7Rfhc1CLfnn(1Yu-@JIjV68`hEGfk^%Ffyw|)w=ji{hr+e{mx76% zBrN-g1|ckuLWFTuJ_yexCnQSzu384&v)?ay-aP}I+<$Q|iG!c}^$R`t@s!x4m~G%& zHj)^>8pqk`^ZwE8uw#h_pyxHL*6PRgAnUS1?XW} zD*1ZBl<>q5DgpO*!2J3W>tFiQ)9`12@G2y{#3X;*LW zr5%G7Ouu2pzXoC^UAvsNtpjZ(WW^9wStPnrxP$}}a838bWH2yaImOfQ)}u(69ZL0d z2rWE(N-!m6G(NcH!GHa_4sYFAEkjn{Do{N$UbvnEZGHng3!K>bG5Z!FOZUY>c|_m% z6$dUwcJ)#LhHP&#?~6%YbA_hypu8I?NT`0b1pbj+(D({pPAOt7=SN_>!{nz888|np zWzDQArd7$diXvuShCCuIeTk&!9RG#&oL@kvtZ+(L)4H2FkJ@Ajzd_EpI1p;Szn`O`?D zrULGl_dvSAT`YIci;L&hf%JJmNS%FCsEO2T6%>U(0v5j)%Z(d*f3l)#A|d;1qNMkt zb3Ev4P(|ZULvA<>cQ)@A^0vqZNbK8`zL=gD>XHk+gPPV72VGHb-ZDQc^omNrCAEA_ zStykVnK~A&8e6YZrmJ3MVUOdAA_4Wa4=ITkGq0vu)51joLEsN6&uUO5hyA|KV|Jq- zPQOUFB)!nrKCQh^LvMIh?Rf?`e07YYO?HhW_%XVt{J9UnL0>OI=G08Z!uTsvs@Ny# z(mRsfy)a#D;{XA9WiKo_AepuOb7hH>@-wYH2gqbC+S;4sKlL!NG`DZ}N(B7ncB-WTu})&Zvi{Nd zi~qyCCRMNzn;GW*x$CnSV8cXH zVtbzxv-t)b6Eb)kl?r5`E5%72^V#skkG}w3@m$f|xsC_?HbTgVtU3Yo{G{CIUpab? z9kGWCudbIMm?JcEGK>HdAk)~EK&FctUQ*Rwr-yMcyx}DL2=H%*uvB99uT#8F_I;;^ zyDRpfJwav9i_>|nGMYA891}iHSvjW}A2P)cLy(scQLI2qw)j-b0D>WU2^%Za_AorPum zfPl-uh=29d-tRTwkBj;;^|A8J!D=v;BOKvzn|RoJWB~6l{+9B3wM1=Iuj|Bq&N&B- zd{ftrh(CQ#`Eg5(4-O*^M`F1fjum(?tY>RtZ#gwAPm8t_=+@P^^FCUmZGT`SDVLA$ z{D9U?Lx<#$(0dUXPl{ld7G%(nf2vChp2?LsUz@$yp?JAlz*#r10*G_}lgwf9@(=!E zoP*u{hD7B;k3cTV56x5>U^XvA4{9YvfNzk*Ues-EA+dG`Zl5}{&x}LZnfJTAZ%ncu9cI)r5goB&uCEWB{>|P;DH5<+A zu^oHIa@W_(lw@iazxz`Od9&b44Bv}vR0`h%R6IZ@(ZiCAhH^|YavZ~=^u4PMVpWDW zTUCd~E`xqpxRorBVFu$JJ?}H&lfw9+0l*W&(AV0MEV6Mz zkbe2L3rqcz)xm}Nhj3z^#%{JE@Z8adlFbxEK@m_;L6fMimRlyb%RH={2qCLCm!xe2 zKf;OmrF_F#kJBS%){~KT)e}A~>_Tgjq;ko4NfD7K$&a~prz^r^2OKC&B$;1qhEdP0 zE-pEDd{>7@g^h{cpAvvLcyVa#B!N_r0LDOL)mp0^nr(Y@|Lhh*8l`K6tk~mJdQj4f zxEi!}?myU--ogG{nb#{3%YZ0B+s81tLL*Q&3tX$fT6}UFk^sgu4xb9SaI{D0cu$_P z!9=Xko7yC$Jj#yCXWA;@EtH34m1EL;Y`T9=y*#JgKmhXcAb%iY4^*2jOXgfeb>-dt z3ZoqLlXTl0C3bdk8Cu?%E~ZYR1hAzvexczyGZ72GZao+C8OaQF0YHuc#08*|&C=LXbcT1P&Oof3-|3?wBzvN?a^x z2$7C|DITQw(O0LUo*T@_!3|E{ygTYjspocnbaZm+l_b&){=Y1rm)utPuj3mrMu5%z zi%-|bhE5(4r+Ar6O&IL$%7+qKmVUNLlp~+VHG!EJJ`V4OxSSoe>?L0d$TfND`m1tQ zj1uKG^--O)AnadT@H$Rpz_H#aMu?Yy*Q)JhFsCA$IN<(Dx1pWtKg^#I26~J{t^!RX zPbinh;$h(<^PlVgrH!Nfnf%8(e2*{OW7;HqF8+yQ09K%65T4B{uqXiBAcg;?;RLNu zMGY7%ff_x4J)Seq-_UiqP$l4CUQ6_!C=ZITsR67)ZXeE{iT#(RBBJZwgXDO9F?^Ep zbN9*Z)oWME%EytLsIfY{S$G;ASbql!D$%zIA*l?CbM~!mx^Gd$nNQ2l4q z$wMM$dlu7p>v#PNmNFY*uRazHW&`&4 z*Tzo?+Olo%j!CY>&6P9+J3wE?t3%-m)*z5?NQzDl(Gp!Zz~R zRIU%FV)Ry8>#qFaowXnFe>2BaL7O&+BfyQ6PX^Y|+~59jYb$I<8Pa$eKX{O=um+{j zVTKU63c~dU%uiO?_4o2ZfGjms1hYqu)lY`aPe=0me~+b#JuHp1 z67PnD&6u{1o5q-yA2*aBb9=V#9oMNv?gv~Levjs4gf9TpDkfY3=vZ?mplLpUV{{8- zZbn=@ueJU+!RM+uVEI9E&YRopX**LlpSJFLs2`;t2flTFzZZTn&K9II0 z%+LScUIoq%=zjwc<1%6G{emg?`0i8Mi^)$t|7}XRnd*&ViThHD(h^)cf433>w?&Kn zH&+J!|MyGh|9%1Jfq!fN+e`n}8UJfb|K1t@Ya0LF8?@tp(1y1u3w|rNvt6xG@AruO zB(Hj(i=;k99*(AQZtw1XZksMv5@#0qkj5eTI2sNByjb)(O4yNq-b#X8^ic(&DeI{_ znMs55x#xQ+!eJ${a(=vc!Tp%(m!bLwRAN;a!B_OVBA7%oe9f0xHZ7X} z2(o$(J@7zYs$8bLxQFDStN)>{u_JDaeTeoq}Niu8mxBuCo@Qt!#IaCiF&j^;x~A z%@3rztIM&UZ8Hq-YveLrT^?xjsZ3|%Z`JMU#i}h8Oj%u`Y#ilY`NA89k#&xK9*Tr5Lb)6S#6;$ z7RO)StXbtjDQ%}b#fs4UymrLJk?0c73Dnx6Z!GV@ZqBKt*>N|nBZEfZyW#nEt(~Rp znC(^=_&o&3<8(IGG28zWZVd(W-q-+uh)k5DSSe(4P0|VIo%*kumN=pvtb2 z=#Kf&CsPF*0h9Mbp$c<$E30=j=i@S?af*HSGOImWtGB15u0=>vmXw|IHRJ?~P@kak zE|z3uYrzh#JR3{IWP7K_#hE&KG|uFRjur~*t97Fl_2FaqovY4|9Qa*r|87>m$@N!n z*juyFm(dhLBzAUoj=WY-rhfq~0pkKrbm++s5?gq{k?EZF$D^dsuE1TwBp+T`< zc6j_yKT=tek!f5ZT9OfcCcw)jhOt|Y$uum}y-%8-VD}?*5eU+ZZ1vG}Gy_2ZE{(fy zZh5z2Q;i}hf25&nI4J4C%1UpDRn*gCHm*kB_f642eT%UvjWV%JW#U@k>+w_*^vjS8 zkX#(UB z4o0?+CR7SZ`8m)Q~IbqRIHu{XLGzQFu^pEqGt^ z^P8&y)PiK#m2nr1Ery>5qAWZ1I2fjt8TWw?Zm*0-tpn$eoOb-YvEM3cegkQatA6l`KxW{&*R=}i=^<<`2MnB|J{` zaW`ohN^reg?WKnF%SHpf{aCdXbx_68scdLqCuw4pKCk20Xlr*4znPhExZ`4PZkjQ^ z(?3&D%Nx+Qi-m$ojT~H9?xf0N9aw$*Rga1FDN2eWGd9%^dSKj zJ|5*9j!9hfcCHb7re%w<2B+xre$zTMI(ch@@ju21$ZIftcy z-Uw2Sk(BIH+pw>@h#(2ajW(jczrv1H!Z3FfJs2Ay70VaCU%>z>w_Q+*>sv=keRaSo z(8VElrXJ40woUOll+B)wM#f`C;)VT5|;ous(Qe#(jQzBv6%a z%da=DXP65(5}*&dY5R+Bg$whaP7zcM$CWUH%uf`sg2!!bRE@axt-PO%SBujDo6k1p z8VX-rSiOYVyK+#pk3F{=9&!4v<-gs=Y%(4#**Vzd4kTD)XG=zRsbBYVFj=wtM-V2m zW#+;h89R!lJSX~3ML-t+FCam*X_{hmAXaXWi;7VhDY+{}ACLFN3r@?kym>Jv#9_ez zXOOP4SkLt7RNLGvE5HlfkCF(oJR%z?z;37QF zP)!uxr`vZe!VNW7J&_P~d!ypYBVI$e7-DyUjsG2a@S%4l*LyVc%d2WyhrQ=iw8Ne) zvG0WthNe1S*T0-tA^qV*{u!25moy1_eYDpe4+2FrXn(btl*StLUPoKccor4;7-k@# zl0*E>L-QgP~3T{tXU!$IVC;Fn{3+QFD`vudyzCtqDuIxOLAgIGLPN3~#M77jzqH-v^XI}qIb)Gp@oxV0jI3pY>b&M;9wIIa)tFr+H!>~nfqWacv-p?s@bc#)_5TY zr;+D(U%LViGW;!AaQ|9$$Ntr~*XFi5t1l3r^x#3VBh>o|K%w?F<4Hl~&y9Zg@SAG< zlGV`9!6|pQUVGvRLz;)F;2V z%Hb-0#`=3@_tn?R!Bx=P3-M@&l3m^>v`Z9eH zc*jMb_P5Wp$Rvv=vJJA&*)&BwjI&2Gc`y@le*5ByWPp-aDToK;|JdLJehua$nBvhb zKs1mv5ZZ9qgR6Lh-MVT@rGO=?5l&JZRul3tz&3C7NqvFWWD&IrJ!PlHS+b5qs=EL7 zbmi{2ha|43G8f@Sp7vAk{R;eC{Z7T9z+YkA+wHwLtdnukiv>)qt-K(g8N^-zsfM!Z z&|*S0O^Z_KyL-WJz6ybzkGy3*@6X&6Uns1-{w8T<|6F=crReh8?1-<^rZ4;(zr_L1 zww{^*tJ39Xwug8}Gvz%DivyD5(s>K3r&swwWUdu|YE+-~LHkqfn|KBt!gU%zw%~Sz zjPhF*4o2qqw9nNax@H9hZ`wQ_%3jUT+e+k zBrD@!f7LhP+FSroui6Wgof@j;%Ls3}6x3&IiT@BV>}bgK`00o? zX|#Mis-nC4WMlGrWsHLwHBkeP;L^P*g;^WT`wUKeu*IN6VKkeO^mds zy?F^%xOJCP^!e9?@KvVLBgYcp1VKd~S7bu{d`#Ct$BfuVKD#DuT2~ySP@6dTh(wIc#YUY>!b$qveGHf8lxpx|@%rMp9>fQHtM?G4-A)$zk-*lXf=TT5 zca~|q7C3|uMSp5(3L%s0DA#xD{*E6FtF_IzePIv82re6muje3~NFox^1JP`+MPY zUEvA){GgikdrZ%FSP|1YSYPD!T&>_;k65K58^#wf1KLW))B^I<(S$|>$`RG|=fG(| zltoQ<0$Ma2vhM{o%=4PmuuYoc`KTUxuPzJF?WC@}%txhc+8ds5_R7jz`WvOx+LL4H z&V*%l&7^28)rE)4GAnaq-jyMVT=XcWRLUcB2@!&=44K9xth~8s8ct+%`-Ezznj@7b z4a}ce@I{iG35FQ%np$;{cRmpoUC#W@?-D?3yxU38s38@I`k2$^NoB1?JFMppuJUPR zhlslQwo5PY6WnTxABYT65fi<%TG6x>2323qzlmRc^O1n3tN48Pa9UvgdoYd1k@?(% z)Z0kPxc!?p4$xX{k9&Yl=Lw44Lu8%>aOY6L-`Ko5lC9oPhPcb#R{y>~B-T?Kb!&i0>PS_emR9 zPUZa9pmTGKn$j}l3w>usJ?%KC!Gtzxd_6x#$Pw=a_6atl9Xu*D?PHCF1xf3=ow+!g zs(nVlw&^@mX_@A;1h$fDW>MFFP@V%O4ZC4P3G!3%>Y!+HcD@qaa{=1O(+1=u<4qI_hNfl%WCp^*e#Fj9UC+P>7wCIV_F zEiSXZg8Xk*odTqLDutI}dTVsio5Hv~V2y@q$T|hHSmV-p3mpfBrBf#B_oH2vI*xCG zA{V>Te}rPzL+D1c2%^4Pp}gg`6jv8P@bN#3&zzO0Bs9%=Y`&DGMs=8SWPZ)sfB5ZX zG52gE88>@rR)DR!q8il`5(FkuEm80=EQ*yyawXGONMvvouso>y0&O)Qc!@4%QT45x z8NyT)i)XT%9c55WHnq>BVdrduxSCnHnk}Kp> zlTY$W07z|AWWd~wIKC-=jrg}yUK8wz_{3J0!M^g_cA^cM*US?HwbL-tNxS-4h z-euagc$Gg{Pa8CEr)CYWp#(9cg>`dGJ}JQK=dxxGBFalSW7Uil$jCqMcMX*8AJ~@K zZtD>eBHxn2H1x|41v+pD*LQW!c|dDBo3STOA8RgSI_9*$hNi~*KAKr|a?>#S#;PjL zERYmGR?&_1WAXTE;)^#Nk#+z5Bp5!|pyqkG2BhkoD&JW{)cBUK4j4`Ix@HPSkkj1!vSor^>UcCu1cf*+jab2+<2 z;NHd+Gxd}tbFjwAi}|Y4@7>Z_QRb(7nrU5KLaB-IR`a=An=l z*0<%D#8LA#YnO(ObtGVtCV190Pe5vm3xsU%p7yMb`(4>g-JTl8u-{J@^POa%;_()@xh|C4)>7kczaG zRWMQuiSS{Wk;suSq5w_;0!qKjEHZj`CwEU$qy2akO#N`V0b(l6`r z<)(rfa$BC{!X|;|wO-}r!UmH50k5HUzG_x7@-NUj4rc%Y*xH_ zY0rA8@8peY28>;kD72>RH`)V2^-ZN!nt?^~ywT*9y6b&HWNtfK!0L61$4mT~2)& zj*|UHeF=6+o$xh&#l_*XlZKL4sx&D_n+PVUBfQ9#><0sfHl^N$7bAxxJa6I7peqZl z`HH>%G1=Cl4Uc%!nU!p10)DY+o82{dMPu$eNG@rAw$$d3b!;R{T^>(K8rw5Pd~*gP zy@EO4^Kflle{zBPH%ggwYaiz~f98NF+lwNuWS60b7gKI!{2!bj7eePF%JLXT?_xam zT36LrWSj1y#;Ns%fC}MIr5@wSWj2%2f^%C=R2?> zT^{2G^dNJtv)yPf(N9(2Ei<+9LKG#Lc#*;V(`@QDGR@|E!!}5UD3+dmp79UutrVdJ zIp=Ja9e(eSJt3^LTah`N*!!$1z4tGA8_TlplFRRLD-=1)GG}2n#E%r7kijS0GPUt3 zlA2>#LDyoQ+$xKn$*%H_*Da_-^9l#pCfSzh&Z?ikn2Yee``^O6_bg)d%as_5rD!v$?Q0 zYNg`U`oWTJh;!HDwa0C?@S7i$^|;kxJzsy_HX^HQLp1{?L0lp)vl<&?YgbZzuV{it zZl)MsGC#k}O8)h&7jGG>?K%9kD?VX)PmTa(Z#|l5hcznMMwCanQ-Ywn&oT;+c-ks= zPEi^9MOB0BVes8M_G>-TU^uTEmM-Ps2WRGX-O|e+EZ7smDd9PKM=sLc9TP?eFD~Sn zBMr7SE1hGQymoP&uyS+b*!$bd6MgH&=?8h(;~?(8+<=@yo>=j1dye>`*KrFX8YSEs zV8=pNK&AB;ShAPx4gOY%;S3-Xp5vyPZ$jHhL{xe-yH-2XI81b`d(GriIXlC#UkwnVXcRIIl?#LlLTbP61lLx`U?Zcy?TSc{+tE1|)7b>m zDemdc9X`Hw=MhlJ%tps2ZWV{V-s3XTtO5@tyaMV98m#*|jaA$#>n^@mrpS|GR$D>P zr2#lC@sGs{1!tW&+nURei#MPdoh998#S)0?O-J1eYHZHTVl7%sE0AYeV5X)*OrdrS@U7tSu?R{R#*|uh%xfjt9ushMP^hq-<%%D?JSYYzRjGiTVi6nYuO+q1g1yq>lZv1*qSqYofYyB~~5#c`sf7~gE8SrSg`$=0$Ku24fbT4OSk3`s* zL~!PD#rvmUK4tsEGaNEOKxPEdI;@o9E>SOdd4K!t^IP~-9`S>xX6&M0>4D_GE87H0 zkmy$Ss0N)Kn2acXsD@YV2H*8zLWoZgDik!+3ke}VlRDyq=g&SGe)>Vz!uf|}nS~p5 z{u>?I6mGWqB_WBWb0lxb@eBO?|7FWEzRJ(h@25KDxR7K&{4u6oflOju>+7Z;6cocG zA2HwvsNsZIpNNSaxtpwgZyQx;joL6|1T&!p9v&(qhNokj|8cWAR#93_?#My>!g!23 zG%##T$j-+DCySVEU>Y^_CqEXk+FEGO58ut{_j)^c*?evFB}r&uUcPKS(-o3q4IFrI z1fnNEvd-x{3ASQ(s>vC+>j?Bj3rM#oy|Hh>TKI8%TI#KbY{hTbN1LFW(_{YmvYE^ycJ$g zn!)=-1s?ST1&X>+Siqg3b^%ITWTONDjT+Mh3ji#zVj9K_@c!o~EISE;$|Z!L84{Y9IwTp>Z?6 zI-GNEKphK|f!0-y_(e$Gb_xTLC@ECFhVKy8Npz`weB-8`**E*l2H%EyhUp3*K(92{ zMjoN=t~}n0vAG!yJX}yKtni86n5WHVEw9y5L!XM7DRNPaHKYN!ANJd<%uw z8FKOG5+WJz2o;jqU#nW#oTrCXWF|3$q zFCasT1c<^7icH}&QUaG|&TJ4-?ivLHU&z&pBl>DGre}B@bx}17Jo2a2dUx=>AwD}> zBoCvcPga0Vva+=es zGjII}`-oHAUa!PYD(4y8?A$fdUw>)E2g%*&P+(HI3-WalATy&3Q&lVZV#^ID+EmiP z#%)nk)(OHc#LA~)04sw{Eo||Jauf}Ox4T2@HX4+S z-D;NF)KiB%QaMkaEAObH1BzVsn&n5;mVb>cc^?FxDF@b~0LdCVoMOi9M^;PE$Xa8~ zIuawuu`Vf?B)ViyHFz{hb`Tc0(fA=oeBh|TY?mdT&yUcIeMBNcG!0qYlHs%2ivOGr zZ98ERl~x8M_cRmtM#*&KPOqBYI>B*dUT>)5?YK_)q4GoMPOWQZCe?*0f5E-5Jl1|w zPKkS4&}vc-$%Mfq?Wl(O65#++=z>-;`QA~d)1dEv8d={TBTH^#gnlhG);+K&n@8y# z5L@r4LoU~>>Kpz(UF)fUjsDnHMK803H(s)UuM-Wv72O zvv^BmEF&mX_BJrjRZVX$IQ-%P9}u%@@OL;MXBh8H&{3l6U;O1 zIUR%~D(^KEJMT`!`Gyi!Qc$e2&*Wa;{*XY1wp!Ij79aP4Ph2v-w#Dwwt;J!-h;LGN=l{x1+ z){!+-FQYwY0-!TLfD3AH3HsAOSvXO1bBKUirKoxo`}vNxvbQ~)V%d?S`r;!Q-960= z+3!g2_V?H}Z4@WgeN{1Fr}KpH={CY9QuJFm^Ix29(Pyxt>gqi?C0i_YCNDO;(v#Zo zEDs{D;FBb0lPI4{sLA?cO4aklFd^=D z3&l8%yaQ=&LO~a#47Se+Mb)bd+_%XeD6W@dv!%-)2)sTGw*LfzXyWuQ@iHIAbvJE& z1qWwrE1vGgsc-)pEuqQ7ji3gRfL~V_R&r}6T#Z^)u&_#csAKJtrW+EoTztj%-@)|^ zR?t9+mtW8x!v(qPc%)eyuIDGEjoz;`BXULxA--L%j*UATH$z{RO3QHgZ();@llB;&<5E6CG3dXrxdvk zFLU!}i@?$W&rsDi*P&=cdiZIp{U#37ksn)c96@EO6)#OMvctYYQmz3T9=tuqj(nFhvKn3Ml!tMo z)Sa4F4^9({9);_oS)GoH?ZEpQ_x)!s{V8$ta8#Nb-6sD5?6 zcq3*)~tt)*{nAxOe0J;VNT3b3W~8)Z6W#^X9{6o_)@Vd7AWBjZZ%5T&?Z$ zUy{X=%35Z|oR0MMH?di>D-4^QXS(0US>7&f$jL2aGOD@zdr}>@goyX6R*+|lV*vt=sF9HYdvxW5Brg|rY z@To@i$#AXazHvoud>!|AdgIw=}86C`RE$OFOt14{M zg&hH5IH(RFxo)|=ZO&!8sl#?{QORSwkXsF_`mv;$HTmGesRFjxHBI@qPMg=hPH!fXfkW;MrH>YhB#)M#=1M9tE{tE~6br*+^7)3rru zb@YcsmipTIPyJ6zNdGbeI5nGK1BV-(xylJ5TP}5d((bBh|@a2K6o?~y@5c^6&HSuPjV;&y`9EHxOV3u_&aix?}7O*Es`;f(%fdWe$C z7{Vpn>=7kNk>S-+SpcUzX#N5v_hnP?#4z;aplG>6tD6cIa78)YjXUkcvZjz(o`z>s zx$+upw`q~0h|h_$TRwa-*52fyw4fx==nL%jevk*r3h<8h?EPIDcDr}I?$fU zZLcTKb^B}Gc`j(!~0dek)Y|e{MS4Ipk&IX~4 zPwxDj8V(1;oLO288>N!VT!Qjx--Tu^E7Co_kN@U7e#AIrJ7L3hQ8XwJV)`BT^-Jwn`V5b%nK_K-;-Rz~s;owqnl=h)$)-Py8sWV>C*4il*L&L(J5=!2u=m^HOny#qm4L2=!6<0!n;w`AFp~D!LNGDrM zmFAlFg?k;FzPF|;Wph?`$5Ni#s8rB+Kl;dNRTg{W=f^2h%-T&yTM*`?e@ctVG`;%E zq`n3w^(kMg($fi|hW$agHZ2C4mEOA|@eGAF|J|~goB&IEwcSaKBJ%FXr1aCS>b;Au z*FVhfCiv^CFs=|&u`SJ2;JeX(?yXNWOiefGg3ETei*(J(O0=veDu+{8JhXptt8zB^ z99C9oy$?^U<&u>peQvSHxai0NLH_h}WI{on1lka6$hN8tu3pNap>4Wz9l5iESRq!> zUEQQe+FV>>ol3B1H(gR<^B+IDV-cG(ua$n$CbpMRY3jQSSMG(iGz};|)`g?DkQVR3 ze0#ZU`iwn|^Z8t3v{}Xx)s*N69LT&c8F?5M{N{$%ep1kT1`cNDr3gjw1{tT_KfB9=?6|U}c;+yZmyPhir7F_~nVa=fy_XzbxvBun2 z%dbcl8d3!`y6xyExW~5NL9p@LJJetYuYZ#)6=5BvnK_dtRak7J*(#kv+hb;WyI!|{ zt386~z3`o7@@irHCj*$B?S+OSo5i9?#hEXN(xt<&?lU_13v8xeLQe3KnCit$Otx(drWP`4BcJ5TyCXcU*Y4r=)6c+g20)zMXWxhhj}jJ;Wy4^3K8FrVIZX zGfFw;$FkxexIFn)Y0X9Zm8JqOIq$jo!@XKFWIW<2Bj@C(g*|dxNcO1f=2MoxUc`-B znc5ZXG-gMaP*Nwzm9oR&w&Y^DcEzcxxvssuDz_{|olB@*^lZz$N?2rfVAu7i`6O~h zN6S6@1bD&hlJH9ON?}f4BMIZq6jjblb4IgXYvyjHVZVmyKbhs7;Tq3OT#>MqAG8=q zhr}?eqhs|@g7~%VQyWDf)#bSb1WI9jdO#AvYCR1`9AT(M|t_uBHsf~;pYBM&yB;ITj z%EtG7FtOFC;8oCv|RAe`7x_aWVNELJ+|5?e#_s>CA90NcBDA7e7Q;QDR2_ML{jaM zxeQSq!TTW5xXiW-TD4_vsI)sUHfksqo?Ud(u*&Wt09gwqUN^2Rev;EaTCH5xRiHOE| zM2g%JI|QE92TlOFpARC(fBc6Yr&X*(v2 za^@cY$q@4FNT}@XlR1JtIVH?T2qVJYF1rd%i5&(na(9I2_W?2xZus1~q_lC@83er@rBFwLWR;>=~UAe);BcFDTj(fSRAg*leVzx*`H4ybHS`4lg3>hqS>iqmq{(V zND8TH+h|3K9ex|S6Bz7w0*bKtuC zTD&rNEtZ=kdyO<6*_2?le(P7h)jgvZFptL?V4Isw(OF*5Q-{iJ^Go*Y>)HJ)9*}t= zB_l6r_V%U1l^RYXtI`-{SN%YYzUO!xo~P62i`$FG>Wxu0`|U|{!o9vuEIF{cByaz< zL`->K+3K^y@Sj=c(~zE3D@BGKB3wQy4 z1!c3ujm;?^J8iT*1K*n*UM%cH zT9x{zcS?#jkO`2&gKSRXlGcIu5qo-?iCF1O#?C+$IkaxarK}8t-^IDfwQ9K}M*3i@ z`eS|3OoP`1b@{T?NnD)rcV+WZ9Y$WO6_&Gx$@!BhaG4fE;+KU0axYnS( zTLeE=p?6HXXI*$GP|(|Uxns>a0=wQ+iKJYbdg9<&UBfR?igGjyDq7{0U{B3ak$_TR zbw0WFbC=|filf~g$4G*|e&%hNyDEgFzkTC}q}e97^akrB*u=TxHkP7Xz`jEdmhSv> z`uW9xR}^Hig86rqCHVLol}Hl5lEsO*?((txlO>QsPlZ=CW_=Z?Lc()`$9rwskvHGn z)7s_twW^xhx=mzuOa6e_i@}))w><1=^+U`-D!W;OL#ti$7E<{nIFp}ZHZ%sdKyo$n zV0`3!DZ*l#0hFC;jwx}FE}s~(xjR+xZ(uyyc=_ZYE50>c+y)LCB{7lzhrIU;Xlh&f zhfzdD4`M@)AaK-!D2S*u0Rcq?rMFN*Q;?QW1wscKqDWEcy%R{GhYq0#h(IDG2_zH| zB$AL&6CfeUKlgdwd+z2_--2^A3ph?a)`@ z%yLoO_qLxwDJZRPcM9K>`FW1AA#RV@gZHwT7-bRA@Ae657kfeFi)9*q`}X7zTF24v z8e?lHD!XOn9OK&79@b(k)mog{Izxwh6^vY2i;f)%aeAOUUf4z_(DG^PGt#2y0WHgd zJ7GC`S!=$t`~@gbjOq12?`?mOG>BM8dYSG0$_cqD4)0co59?M&%~m(@1lC?QyI-RX^+Dv1JL$kna3GwFx&-@r9DtnHfXLGjHeIDP6aAobn+<-On)Hq%^WBnH<)Sql!s@Z6Z(uqEr@Z zy0vp-=1dG}_=5P(AuPicNzKr)L^qy*xok6_AC%Fz2O4f@50H41PA9b&nh@(7^5FKM zC3Z@T_tzOUu|N4K(>Nh?wW6uWZ!1dIc$4RfCL?0X3K+HUNh0~Xu5rwaYbBpy~rdD)?g@uJx%X2p&QpiM=)nHatCkrGbB&0qLuyOnq)gYTg9$g|G ztor-S6NNWVj@m?Dur=iVsML9?2KtIUR6!#QG1%xB-;oMmpMex^)54;OLKd%4o8QnQ_YYcfBw+X%e^-a$R4g!~W+-ofSI6Ar`C1lIDZkx%ALJ=gs0H;x?7X&Y?& zp2rM9bSO`BJ=4;=2IlJ#!zhNy8yqjULEF!x); z-6ffeKc^;w@L!=xu#lW+xW^Iu0T~-dRF0};&g884EtlNC8c6n5Y>5ie8t`-WH_Jrq_*=WMc3matY;{rX$n)Od6CvFA9gqOkPm1cmeUcjOG{Ik+B!xKuqELe){ z-ymt|1yL|j(@;6Y$a@qQSl#LLx;z?&S~VK)?d1H_nq>wYIsO8bd%GDGbfHQ&@B4eJ z@djo+sFDRm#I|xezS5!7)Lm9mRPfxY2W32Y>EN-hGvf?FXjrnx?B-B-@&MwdD-Af3 z_ucY@O_MdWb7{BiXxbB)@lx6ED~s-W{ry2^jn!KL2aXKVjRNd$#SHkST1 zcRgY*s=q*2u%?mEvmZ^wHDi!xCKukXZX{~jk@q;+E_v{rlL+u_*jtr7h_y3$@KiQu z^=~(IA7_;bui@!egyg9++u`}GRfGP*O?(S}w zRpn(YsQ^W^2&g#+Mq5z|m2vqbB}E0JlP&JCVO zq5m#AG<6{3RF$JZ#t~O>fz;`;KQ;IL@6QD8_TA%ecapj_>355cM6{0Guj%B>hi$2e z-W~kK({<5d<=BXGt1M$S1qu;666n1Vd6Aff40M=)+31dhEN4XU{~1R>C;FcW81Eds zy0UC=tb1woD7L|GP8;crc8XxGm;-^?OE-5DPYb!rfn$sZxw+mN(gK$+-cNMBu5xz)Yf(V0@PR(SF z%%e2gqpCW!*D6h7>TTx84*vYR#RdWQ(t?afF1ONI_5hvmOb~t*c-d9<-;=Ef`dnlrAn==zKhs#z0=aL0dk-jsn%k;KYNM~1QXUz_K%p&tH zf!>~6K=8;p%g2Yh%KQ!6G{xqqpPru^hak>F1#@^ycMb{YTqZQJ%YcmN<>G#me?Qag z=80EA2C`r8?04D~l+9mTo#Qgq_Sf81ud7yMYt&b(nF`EphhK|d1=9utX`OXzPxsdd zTvv~nt{o_-lNwiT4>`NfRzL^H+;LA1ER+0a1qEKni(IhX`L$b%%U_XprX8tqj@~T` zJ99UzwpxiDzA2(LX&JD4-L<;6N}x?4ZB66FP_IO_$6wXFq1JhjYws_2At-$F_)LKIQwb zy%@qs#jULWb{S|$iNl-iJJTiBE48{3Q2qCRNG{;dkJ$ULe?{6_E5$MDin{vL9l;+K zwbgB(t$7k8V{knjI6EifZ)|EK;x*)4Xz~8NApkpi{@1MWc zmGY_&qgbaM9`Gj@eqA*RpHs|E`E*r*#Q`5-xtc~+XO z{=dWgO#1I(;*VcDQWIl^l5P9>oo||w@9b}Gh^*GZs@SEzBG5yY&IvTP|1V)y1FvU# z2>kf=BsoIn|GjvNpLlTq_8}XA41F%Oy5@%<;ra_{jsMv|KL1~{es}!ZUR{g>!${zI z@|Z(hncYEw>#<`ArvGa23s4^V_ggLSqUXe`hx_)rj_j?SCbupUh0M%vl<&Jcc=P(d zw<7@oAwEC;Ly`Y!+>O0|_{{&^B_MX}!v8H(1O%*Zzj^Y{lm7R1v-#uyUk7tI#|3|O z3SX81XBXFMjofii?^#fW)CKQ3M;crrW`@Nc8P7Y#`e1s8k&0Y|BwF;eeD7A@epBw1=!&UaQ{U>chMFztH z{K{p(ZdENHLqkPr^N1xF=DUmRh_auU9o~R??Fmy=popmEnc@GC!2c?rlxvsHmN!SR z=j z(O>_JwZ0W|#synv_pR9sKxhnW3FVLc&*jGF%@@*5`P(qRKtARNQ&~mcR1y@nB+sWP z!@!bak}pxE3KNG&W5`bvKwq==;$d%rD>}U@b>IZuAg74Vo%)j_(|5&Zl@ z52N>b!0$b{DOl6L9;*~QCaxiNruz5n-qHWOT|X=?9yt0#Uw)-(UwkJ9w0M4kS$35^ zyuW8+x2iUrQhOr4t>~?itmY=7F3&muVK$a;M7?P%qA6mo7IIl2wF9^i98%9R3FO&S zgW|^JD$L0`zmpfppirwQwTT!FM~_^Oc#pxQ;BPfjufcOw^FA|tnQR`r6>S}?i`2th zmNYf;_gJ!#cN$%9JFVvV3gqaDy$wawlXIc*WK&|yS_Q)vP&BFt|D<{9AD-!w@yG3M zlF@23dHnVq8S?U9I*6r-Nz(RcekYr*>DcVwomE#~@5U%7E{;C0c5i#egD*2zNq%VD z;$X^%{B>PyZT9mF$4{G?_=FsUSl;Ty$Ih9FJH^?rj8AK_w{FsaO%6wA4Xs->;eWLO z$y!l3WSAsiGnINLr}DMEjpuCc14ic7=T=;;I}KPd;IzK`iH*LzTvmlYr2$Xfj)Zsj zd#$8uiUEu@8X>uttJmteEA<+U;KX!vz1d)x+0%op22^(8% zUAN>9Hcel}eG5pO#$7=z9#(}8_DKxC5^W}m@(ap?0d7h@LF+HwEJJW?Kcp||sD^E? zu4GuF(ZCxH$F=sZY8_v&evC>U*~Hf_-=Qmt`@iN$Wf8epSq2eEUVa5k_--i*X`CIT zppC~FD~P*K@q5LH1tq+?_LOr};aq1!&oFj?q@TVLREFT*^~+l+*B`z^Zr_1&o?U1s zWg;ia(6|q7R>0?DrH@;gM6lTT^N7O2zdTwgFnI2u4PTiGiIINd6mat`_0#$S4i+Eu z%B(7|bc7 zd(Jo}f_Ja^4Pp#zh_wJ<)|x{%Cn>AQCVZ-?B4nHGtnOQ&0;Bsv+hVAxJG%vpYFacb z%4uao=J>2$I_c=Ffwo)iylr4Oyw{#TAuTP52!|+oa8@}Dgs@wW^;L}~&JN~Ghe>goJfF0s;~_GhY#nVYx7%TPaAzyv zg*4s!npkU+#EefM=8z#~*Dq-4Ys5ZQzs1DO>HK0j$wMuGoaB-3-|W!GLKCt@b;{C3 zkV%-S(g}3G=Z6ktJ|l;_X(NJPjdtGAv-7e>b3KY72Prn1=fg>Vs|?32^}x zdTS#GI&PC}N^b{;KZzB$U9iJ+L$|tfb+UHDR1$THe)lhBKKt9VIylM${2$np zatD24k%#QsRuhcY=}P;y7j)D?14j>gkeu+&GAM6a0HLsxtr1UG*G;~2ntVX&sOPEb z#}E|8v)}~`2^3LDI9I%my;Df7Qr$EtAs*M-u-BoAR+Vdv28gfc)W#15I{&6+`y7G< zu0U!iLFbBh&R|YCJ>}?oz7T%rE^S{TBqQ9lbZX4~bN}49x|#s^=n-p_#%R36Q^vB^ zsC&6i+Qee5IVIq=a2F8~ZHd3W8FyOC^HqM%jV~es5&LUY*;*h~D|RQoHtY76H_=*S zX>0iBWx2sT7{0i=pBY4Q^3n5pC)`B|icd$U{W#!d6Ip9Rcfqeyk2gnyCX7EVMLx2j zko!csfUW(NEy7o%iRbxy38pK zYJM*OY0n9~pQidk6~7_%Z|ep(R63P(G277q)r8} z6okrxO`edSP`=B1Agc4EBc>e`%gPl^FZ`xrJa^uVP!&6KM5pWK9Z2$+N#?l|wfko0 zn3}jspCs!0ziC(hMo{5QA8T|Udur7{1yDwJ1o<+++s&^y;$s1w;k@UK*(^=xC=9eG z$s<5WZ7py*sfZ9tB#WzjH_kp&KKb@ z>xrR#Rj&VNasqB6WU~Dai;5Cvld=_R#i;DE!o(K2-)p*=%piVNO!cMfI3srj5`R-0 zJNO0|6Wv;wlrl1G&0>mWZ@==GdM2qUFGNVNwp#xDFiC?JUhx#=?G}yFJL(*U2X5ci z;t@o*9%fI~fQyx%*h)9iYJ(fkAT*a|HFTPjG(`EwMg`9K()6*9psi_j$yayt!sMb3 zG-ivdR`Wehh$JNYZuJzKI~_E_zV15gligXAkzGb$@S^s9qzO8W2FDlh#KN5Eu z$KLl#4_Kl?$!C_EV&vTVf@DHr%h8_^9a+Bhdc92Tp&bgMS;8n;ic}_QV0O3GKJG2- zsaoB!t7SFc5Cukrl$6Vw?6B{{axFnJ(l=;0u>RO+iE4RVb_(%;CQ{Ghgh)(|aK%A-i5ZvNuFnjPxljHf3 za*zu)M+|fbvJ#(8a>6NN+0k`I`gJR30oI{IH^rxLB8QgD%idD}n$-!Mz%3S)-gwQ9 zU7qe2P~c18$#4*5EslG!y~OqC~_Fh2cB z?u&L<*@!(?cE~qAK>id<$`YJ?8>>-uXhhvvK`&%m`d4FzFaB#pKRi%DtvMGO!@X&; z>PvzvF~cm&V#67t$BR*K-l&*=jSZsNZojz<9MbLxDo?M@DS4nUz7bX4LsL<}sdp)` z?NNRn`=QIkCM`3RturHdI|>_-42JY;M74V-Y|dg@+I40mSK%njIj5M9e%#SxeeKwr zV0ya~;DSN{AR^}8H<&`O4=V5*al2S`lC-fsN<=YZP#*Q{2FbOR2~-a3cEK@Rm{4#yX^2HBP_4a`g6UCSl>S{e}c zbi2}*l>DPLpcPLXm=4a|RvRL%&MnUho3s^XAMu$UV~L(F;MTJCJ}e$^Q+Lf~M3SfC z6>ynM&EVE4jeH0%msEMb;MkZ4hARaA)jnzv?Ca)Nc?Oy;7)@^MxQJ7ZZp>CiQ1{$y zju<=Q_2p^5MwofEP1P2TIQn|@kB|Nr2K*zwi3d6bn<207d)1)DlAqX%_?WV?zUoJlE>bg z562>{h3k{rHnmT65P-7_zCNbH_sNZV3YxI^ncL{cUa?m0Gn;q@kZHr#+61^<|6~Ps zHVSPt$<03Whthw*g)4?kY*&{|dX*xVTj~@kfA6YE&r)GyjIt#*I+gPF!)b(uF@G2; z#76O<`h0=6q&>KUi4tw-zv|6y=N@wK_k|#l{+FyEnGq3rYO#7pK}AM6S5~Py^lSLH$7?C|7TVbg3d3h{%U2 zWW;w!#N4<=!&2UIcB6mW^ffP)hm1czsTES> z)uQ_N)}H;67Q)rd=20GZ*a*44;@W``|FPm)wUy@QwR_$2SfgG8Da(3()YW5l|Crar9yK=F(h4 zufzSKr)uyt(ly;Ek=4WrecD>AmpW9FLTcUiH)+IwjI)J*!pr&LsQ%@-V? z?IFslV%%W-J<_BkvdkAR95{oAD^2+99sYHmn_|t0YGAGez6PJm(Fb$Rm>#Zzy^@o} zt&0)lmrLyE3LB=EJ+W;~gDLxLkV*UG9+J;iHfqst-Rt&CWqKu?Oy7Gvkatr7;04yd z@^t=M6nKBkyktJZ`R2}I1o4Jn@iBE*;x(F4=%~Y?OE{+9cH_pk$G9RHt*xnB1q?qH z>a+VFIBt;IJMq&es?)V1U#FujOZ0rZEcsG<&*u$<#@y=VV^NLi1=@D9BbjHc>R)HK z8l#^lbyobnsxi#w1r{getb)2fiNY+qUR9D)YnhGH{EaJ;rytb-`W5%w^f5d}W8`|+ z!(W-V9jOkp!F=M=vTUq9r;m0M<3=0xn53+jW7DZaxav55wS;n^9jkR-o9kqy%brw_)uu5LPkpK*?#GPimo|Q@3FTQo! z6i)82OU(68Ziu0t0=m4?3d_wcArt&m+1Ab@8mt2<_N12&s8NBXm)Ow3(=Njv<&d`B zzbXxyQEvs36er{hP8$tEea=JE4jEsBS!@0pgzvUa{`z2LS5(B6%cu&JU+MHukqTW9 zmdR;>>}=896{c^@?v4Oeu^L>=Ui%ncTNdkoidg9U;^P|MssHn>)6qv!d_EV)exb|Iy-o}9_w+n)Lk)T$@n$y+isjV zKBCMBhnVrztj1+C`p)`#R-MKH>|?Xd)uEUSospJ7S0PxnIu%h;N}stj6!u zgZ=33TcW74uJ<2derT1mA-}SH(*}ztvP;)A%A>sVJ8h|CYieal@Y-*6**961EmeEJ zO0nm2er<3i3VuOhkQtbXJbA~0_8jU>G#LaN32b zqZ#P>65Qcn%YMQQ)VpxP)#yJ#5_iM+zDmREoHyvgN?HP@ZSY;Yhx-Rl-1-}3(deSP zhER09;UTS|jDEG{eT1mXq^l!mCh=jw=J`yCboiMv?b_gJfyw353Ni9UM!J~;OvS^^ z`C@H%E_}Ix3;0lT=3`h-jMhZO<)^-4wt2Ww#iNy3tY3!=7^SLJ@D#G@k7Jte+HdtC z--=u5&#!Fb4ESqT^ zrV0DQQl$Yn^2&T!I@U67FHQ^V7Iwep+_^v_>P3{-Pvl0(;@1g*mlwPSr*o!{FUh+$ zd>I}JHjqtXiJHxx#CJ6?LC$prFOUOdX>b!X-UpdE{p~gBGU(?AJX?G2VX~q~`<@!v z2=`t0bZZPdB>a9e!_Qw_h;KCPqs>y^X!*<|oyX+2vEP5&$HDTh!p=^P!2EikEcg0? zg`WYoV3W*F`19956eK6?ndF#n%#{4VQw7Z@J!k+C{-H?@4%cs}%+1~`Q>{L7ymaJ} z-iR)|ZKU4WYx7K#-CfG5Y){GULrw|xNt^);!j~c5?AobfAkBq++y*v1)Hk}`@(c%v zlbcSty~nIc&v6gaj3nlwaXq+6A5L?wDc~(SCN+hXC=3EhKb@mr$@$@sV?Eoo+@!yM zu0NWPOYuFt$z$yZt4Eh8>F>pq$Ew{(Lm~;eM9m?u-85FJN%$*7kwPFm&sP$b#shb( zPCSvhCK5V&m6|I%<@|0dk$Cb-MTbVWJx%%VVdvwhcigF_L5bpy#u|$T?#gVX(o)yk z20KJF8dzk~lw?l3IM5L4Xfq`8hO%``^60b{G0-16)p-|iS5W#siJK>3{GzU`Ct{If zefqh5u5RAyfPPxzt|_Lycu`%Ec|b$)c`tg1t4b8%sg7tln@V0?>@dNMUrm7=JC>Y6 zPC+T(VxE0IoxGxqJSnw}`84}6+`9imIbfE5?rU)6pv~%U)qjMLK&m|d9KquCXJwhz zH*xSK&IRtu@-*~^HUm) z(Jz;T+Ji&lwI_XHBx`W-vCgvd9b%yRG*+Lkhjp!^y+EA^fq+d{w@?f93r}OE3Ba3_>DB`J z&Y-liYIGHM=gF&R{MR>ff^sfA#Jv$E*c&{>1K7z|5_NNPVIfUnzEtnk=!DkboQicF z=W0T~B0+kASJ*~kUDcXteJ>2M1Bnub^$CY^rM#9a-vaHrXFsR*WiVHRiL2)qzJVs5 zr7B@nZ1bp@-zvSFJ?)AHCQD*AmDXBv)czrD%SqY36Z}9WFDKHNsb}3gu6m$# zejgkkuZDEd*ag$3DZ-To-A@BR$JuqQ+>7>t{nBO*d)_E-LiZgiyad+F13qe9f&_>2 z9p!??Y9X840UYk7!GW_75x;!sAC>@}(%G-mF`-3|RD3)eX(0^bFYb^ZK6NhI z^fHs*ws-PODBx_F$Xj7IlclPvw&^IxSk2D-rh%5dVvfrpe}JX>w}O>|3OzG98>W zufvFKnl+ZF=bv^12c9qu*(!i%q4VMMquNbO(MsbZ z?vCfN`pC28yq&Q|AY=57Tkfqgjl@D&aInupsLCqZL~sCUN%EYFpc5u=87t__B`>VD zC8*IFAs(h$g7>qM@9}Y$%z|=!>!+h~KiG zdSL%FODFk*W2YxOrQrK`^=zp*?@wq*iVi-hBrdq$GMs3Qj18aRwntkJ?a@w&Yo}-c zO1S)JI?LRA#fEUVCx%RVko*B_-%6%dt{sI`p4T=u)#~zrt%Q)^g3R zK2^WPP32eJ6gC{WC6n5y{@C~JEen*!7j@*v$=jAsH342!vijz?@sNCjau&aK!R{P- z|9FEo(KTJpbjssf4DUZNE>_pxJX!AzSwsj6K2iZ?ze#Z}I&yVT!D7g&L2nvo_Y@9<(G{L!Q92TifjDK5aiz~2o`A;FHO z<6H6u#y!Jrxg%!X`{7UH+nTD2b2FY%e=uMB-arCVS+f!zS`w2ziWV~jYp+5)MC=>;nynkS`r958{#yeZRaUPUD!*BriV2fTwze7RG0ArdRN4H5 zWf0%=iO)?9%fC&yR?n52hpj69UJQm_GJ2u~uPnbzGDkF?L%dL+GgcFac z{*MI^_ED-p)1+S8vGfP*A>cK#_*-n+`=iJU*s_?VRCKE6)pTc;C9lXxNlWTVb8rwU zeJ`RopEvNA)|T#BEk5$8TA<9at&AlG2j_I+Jnrj8%6&=Cz@GJr3uLc-1D)P2WZZV3 zQJOjVQITosw~;>|4T<#Fk!FUJk5ZuPqDaDU9CDLRK9#4=Hi_uLsGKGem4_yrqFlc@ zzqJDYRK5Pv38%$-#pi7;X|XGL*GzwnX2XD!nfQpjgC=*%_MxZBs$|ZMW5RnXgT+p| zW=Ho`S{qxAGNw<29m$N_indpf$k~Oe@two3x3VO?_Y8xh)+_>LhR>BMYUh;|!XDbZ z?$BtixrciHN^1^>DPvWRIpD76pR*kS&KitQL5H_r2S+tri}`EZ1E{+Ca65Qcl4I7U zEeSkC4w=V)wR0UyJ(!;^UAR@11+m>lIEr!;k}=)lqG7q z9XTL>r{|a|D@4EJvNhVq+W*%zw@5elGrbZb2d8g7zH} zO*dZV2FWN&l-q%=*)3X(C%DZ6o`NuhUZP$W3sT$S6ue+;m*EnRe_>)bhfY_+(J?{jpO zeU?!rnd70c`N1O#QkoM4Kph1Aickx3{xk!a)2>RBlV|Te^}r9rZD&7~HA*Zwq=~Ex z)@~wtm&wT?njv=Ikgswp6MV|wk4@FwRPzV2?fCIcVIArCOlzDt9<%Hq+~3e}KR>Xh z9Hw?|xnVEZcr?;9g7@$If3Se&KQgWSvJ`KX<5lY6On-$xtK zv4@YXTQ%errR4jss7T^!@<`WoDv5#Lty)BA6<^&`g7S9dQr2;n(XV=6N)nrTBb?qi ztXiijTrmmmp|p}6F^@xx=306+8{<^Nr`X9?znKCYN&c_A{)M&ScbC7`Cb6xX?5=5x zMZcC45}z0X0+!{*?*v+9taJbPM=ExSE!=u|@a5-6W*br|S30f(?{nc#+yHFVJ=Zq< zY%`(^-aYkg(2eCc!!*{9YA~W-yrc0}-y6f;32wgmMm|#ftGZs zyFm&LsR&mS)@0Yyh^EMifjdOMYOf7^KpfgGj!Xub>!zGLm-lK`TTgr zh;&dKI=&mlk4(BwYkx|Zu_xbFuzx4}qZo1Lf`l`TC29k|c)teERcW_$Md#qmV zFFIS)DQ=^dmVhnyDj?~4<>exjEoYP}xPSIR7^l91RqYcgInOf(PBy^*CakoEX)Iek zNQXTzv4DEUyhM|5+{U(Hl?an_&c@7xl7WI)^8O?*6q~0v-}mRZRZEWeOjz4)uRc;Z zo;EhZNlreR6Lf7b=J9yp+meYsZ04D<;Mi={Ahs-dGERmnJ=Am$Am*KcX>6?SmW*!1 zp8RR)#dPS8D3_s4*AFg!r@|mB-YRPn^kl2?om1jFwv7k(mR_`;0e))o_t0jU`4-V0 z#rF3N4oZ=|#|9ZPR|LVE>WaGA9SCMLn-K!@Vaih1?$Bx_Dj{oxEE(K;8z>(zRMDa4 z(zI^c3&unk2g|Q{CQo*)Ie(c#Ib_(32}v;F9#s6dnUqmLbaazNk5EWsX^ZLbE8vRvz~yM zwa=o~@>kp5EMv?A;)CQA-KmqThrr*$Kcm%6kK&~R;U59-t)?q9jh)3B+{f>!-<$*m zTMekEFB@>~^!cXtK+1A7@7o*&pKK2Iw`;v=q>}pzZeW%g5{VA*mXG88DVth3n zW)tGg=b{4{I|?^_ZD~DD$j7Ofh`0=eMWu1p1=+ER&EQo4X`!bma0oKe>QAQ`!(C`w& zhX#3NjsqwTi}<>q-!+rzJlV8o_daeW@7OU3{##j2p*PaC->Qit=GW_kLN0}HrsB@- z=AKew5LqMi-P2aiGY5xJ7_2$SqX);V3z=gy=F`2B9-C!DyoW^qX9t$5jSm653f(hG z3+MCVZxq0%WShQ{*NUwyP%`UUr!b zM%PF4OI8g6<&#$c$Z*a#BR~{BaHNl2P$0ui_l7_dliGI3?NwH*?>TM2JSH>TWX?Cn zfF$_#+$F#&Mlim^r`srxA=+!AM#vu1s`)c`vgfeN`bKUpO5|BJ@*M+X_@j z9+eSo7yayu=rrTWO@~*~xNR@&Q%jLX>vj!JbO1dI+#*b7%-!P-O3X2=c(K7hS1EQM_^O;2 zm{=(XG!7;*%=dc#Wyj}_P2QWCsCkYIJSU{~yUIL7=v{Y}@%PzkV^VrLOvO1H@}7@F^e%Z5`CGeqxh+q|;MwL_ z0E>X>_4PzpM9F5_J>jG$yygdcw5x~dmTFp$5RO?oDmI5FgfnuADj~6^5mN;T7UXx7 zvDjV%lPPNFqxmDEW@0xMN>L(sE{ftk8?*HX2N88NmPlwsC5^!Qy{s>=`GI7If;Iph z%v}w)+sl;{*jW{WOABZ1*`6H(Sm&`d%*`XnXIgHnWGL3Fg>#GVc;Hrh5hK4HFu1?T z7)8FuHMH87F^AW8g;-6C_^a#h{NkB4kiQj`XrFH*LgpeLNK1!UT3$HO5v0#+!DyQ% z##nTS$Ep*;nD5=PQH!`cq}=q|2IDE{AVJ_g>ljqD*+Pu(YIWO+q`9%t6?MlP9X3Bx zL62*l>$a0$8u6V(uHG(aMt8pa`^KkBM`sRR$Iy!m40g=yFqzgiC=DaPir|#^&ZI_g zhl&${IM|X~f^XTfL@M^FM7aA%``EVW*F}aKj?OI zM5AJ>v0;-zZIqF9`ckv(@2~GmeCxwc;UMWiOWm;!Flk%F(8H|9XCLEh$HO2_1C6qv*&!?il_pcYj|yi0Jj+=8AjGy&pVD9l z!#^AGUS-g#uNX>w}G1n`sFp|KG0 zfqoR48nET6u=}JmpV!{twcN`J9sNs-%QcdbHdburo`N&h$DZQZrsM8PBFV6bhP|zX*8;;o4 z*}z4PWNSVe$DeV!$Z*L}G$ImjX0Mem^ES1qP0u{aBIaCKdOE958KVt0`XK8KkfeIB z!BmUabub$d{cRGVQjjn@USED@WzJ%<7L>+}m|a+Omr2)1MgareMaHQGF$m6Xqb3^> z;my0fDU4jV-0GVu*wi(;#QLWSKLo<5nAROYoed0}i zq7Ren9Q8Nt7=&c0SYR}g!-mLdVly`r>ykR5j)vh^y#7yl=N`^v-v{uCQucIGNYXmI zDI+}@$zcvfJtXFkLz(Fj!$OfcH6$KIDCaN~62s)ovc(m>4s)JkY&q@0Mv*y;?Y()P z()(P`AMbm;f4=uW+qGT$UEkmD{$Ahv+I@dNpWlKEtYj?e={nKRm$S?02m5i?Y*^^^vy zslA1#XW0|3lJ-Xd?UHTceErK&hfm)b#*y3;%3GWXI|sotCH~|n3m4veU5qDBYI+`> zR^C?9vu46Tc;0oGbt8CTwB&t0;@RMPhT&Kz<|T*z$c%*Q!Y~-&P<^g#h^#=svE19O zo3|K1de#3qHk>%-I6dC#oz89?rmSyMAA8dH9C7JIL~m9i(2GekperHUTC0<`kMGu9 zhiWY2SR`QxkiN0}$yVN*@Pl9C8nC-!J$6CAM7LpT^+NSCl|~xhOdV2i$SG`hN3FhV zIU{`f(qyjipqyd90dnO=O;W`_9CNQGE9v*z`WFO0d?>bm|CpgA(kmXeEOL*{o0%1C zk^B5`AM7IWtA~4J;07$xjYr;=AZb9eECeN{pZ&hl2|NU!8#z^jnMkZT5Vgq0e3FFtMUERb+5g(4k(o<4XgY& z-(e;5`?9jKc{WwW^CazTgZR`*fCg=ym(tj~7xvzyHL^8q}G#6udieBMq zD-IA?TQtwh3-6q^HgS1RP|b*Lu7B*sc^w`I1pZlHSI7M4ocNkRuHH5~SJ{;#soHU4=$NeDFi2|)LLKf-|q5HanSyYMl= z1amX12u^jEd(zqK$JH(;56(flhjr01(5FSi6|znGXVKH`oZ{SpWb(bL@<3PR;Db;< zyHfR%mIagBT?c#Y%T0SvcVagXvRLBO8gZ98^%Av#fbW9(dzVH$!vo#iZw>ha>{h{` z@F~NQThh%%2X&;)xjlnJ&mCsGUAl`37krFPRv2~P1qS(c1YHT*BM%LEj}*p-r{#4b zhWP0G-`-!UidQM%M}|vhm_$e3ar1XqCt+}s=6mb2+tKf>A`fa_$UK~!b$RBIDR6}z zaKs@TY33D}i5yuqOj+Ia1zM2D>upl-;*?_qt4Ls%dOPQ8fJJL+oY0#uJKpRP0_^#4 zcpR~_yx)ANv#2<(#1bQl5`*M`pyb_U0l46Ky690AL(^tpkQ>}qlRSr=c!TsD{Nvmi z!*5}OK#4*}t<1Mi&QiODQI2YCMlt{=%v!-0I7fO4(# zXxN$a`Hu%a+_T_Lc$rfrBNfYV^|!OnwdpjE4UsRAUI{0!=C zmN|T!+M;MWZLK%7#~BAPq`e5~SRLKGR!D`C6?3 z_`I?Du7y=FxKbLoHD=lMRk7zsEN9Z*AizJ__Qo_1iOu(97K|IHo~AvT$zBq7#7aIQ zRfHWQ+?wvI-kMxPYY__aNGRv1)=>Cy_o&pVUaf|f(}HJ>^DNhznv76cs#h#ho`XKy zKh1+T%g9lA-XgD`j;6ad$L9EQx&az%x0)t`q-S1;a z-hw1ixLnY@2&i(E_cda-f{P)yE&sO(G0>gy%DZE=zeav%vNJ}m=ytT#4l??|rdw6%0}! zu8x{GH!n@=qRq**2_xoYb<@Yj7QZ2blV2 zvrFbS@EmUYI1mOG& zq_8T10`JBhqAyFRzq&>Vc)AP*75>Djw2axT$e>Emb?Th6o4~onXZS79Eai?JyCAKO zRchOE%AK>|i1OwvpiyCInBr5*#Gz{ClsrttAhiStuy6D!{4kQ0WKrdKgXVVjqXrnH z<;L+r{|zkfGtM`m@kplG26@-Z@&+p0iBfKrwHksMZ~J!KpCN=h0iyo*bWlpMvS$;7}AW1#JCM?&V$} zg?=Bv5WVuu%3TM0-fq#hF8R~eu(3ME;o3*i6V@=nA&!gN~%A%&JtK+M^kQ=U`1v*gZ9R``h!de9=Q@-Z+{_RUJE{?*CnbKcnuN>2 z;X})=?-myY+T4YBGT&5O8?_+ZSZ8@#t%fVNBaM|oV0P^DtGV+j80LURH&1El>FKF9 zuUh$VhG6~N)cE*pvmB$zX(9!?&4%PEY{zD@0=|5(71w5*k>p5-aU&vdguy8qLH$AB zbRlqyV=$h=VrrmlG|X;RVg+nOo;ZUL9*HiSN)$0m1A}m=Wg%<7Z0W2x+L+_Mm3-3* z5Ur>P(&@XFr2iDH+zH8H@3856Akvlz?>`zLcT{NF7dQ?6DC2ZZwvdq`42CZs62_)4 z&B^aRLR>|iW1WF=BqT^pmXQaQQ;QxBl~dZ60v>!>tgnZxD^^6;6)QHr(La^8k0-mf@+^6R(&Ch@u z4RnIJY&x<-b!@kKUo6w>#HT75cyA7R1W-bxX^e^k!R}8--%uRERO_PhyK-$ms z@rQ!TmN{X}4!Q>DL?R#jc |name: nginx| sb + sb --> |hello nginx!| sa + end + + subgraph otel + otc["Otel Collector"] + end + + subgraph observability + tempo["Tempo"] + grafana["Grafana"] + backend["Jaeger"] + zipkin["Zipkin"] + end + + subgraph ingress-nginx + ngx[nginx] + end + + subgraph ngx[nginx] + ng[nginx] + om[OpenTelemetry module] + end + + subgraph Node + app + otel + observability + ingress-nginx + om --> |otlp-gRPC| otc --> |jaeger| backend + otc --> |zipkin| zipkin + otc --> |otlp-gRPC| tempo --> grafana + sa --> |otlp-gRPC| otc + sb --> |otlp-gRPC| otc + start --> ng --> sa + end +``` + +To install the example and collectors run: + +1. Enable Ingress addon with: + + ```yaml + opentelemetry: + enabled: true + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9 + containerSecurityContext: + allowPrivilegeEscalation: false + ``` + +2. Enable OpenTelemetry and set the otlp-collector-host: + + ```yaml + $ echo ' + apiVersion: v1 + kind: ConfigMap + data: + enable-opentelemetry: "true" + opentelemetry-config: "/etc/nginx/opentelemetry.toml" + opentelemetry-operation-name: "HTTP $request_method $service_name $uri" + opentelemetry-trust-incoming-span: "true" + otlp-collector-host: "otel-coll-collector.otel.svc" + otlp-collector-port: "4317" + otel-max-queuesize: "2048" + otel-schedule-delay-millis: "5000" + otel-max-export-batch-size: "512" + otel-service-name: "nginx-proxy" # Opentelemetry resource name + otel-sampler: "AlwaysOn" # Also: AlwaysOff, TraceIdRatioBased + otel-sampler-ratio: "1.0" + otel-sampler-parent-based: "false" + metadata: + name: ingress-nginx-controller + namespace: ingress-nginx + ' | kubectl replace -f - + ``` + +4. Deploy otel-collector, grafana and Jaeger backend: + + ```bash + # add helm charts needed for grafana and OpenTelemetry collector + helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts + helm repo add grafana https://grafana.github.io/helm-charts + helm repo update + # deply cert-manager needed for OpenTelemetry collector operator + kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml + # create observability namespace + kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/namespace.yaml + # install OpenTelemetry collector operator + helm upgrade --install otel-collector-operator -n otel --create-namespace open-telemetry/opentelemetry-operator + # deploy OpenTelemetry collector + kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/collector.yaml + # deploy Jaeger all-in-one + kubectl apply -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.37.0/jaeger-operator.yaml -n observability + kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/jaeger.yaml -n observability + # deploy zipkin + kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/zipkin.yaml -n observability + # deploy tempo and grafana + helm upgrade --install tempo grafana/tempo --create-namespace -n observability + helm upgrade -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/grafana/grafana-values.yaml --install grafana grafana/grafana --create-namespace -n observability + ``` + +3. Build and deploy demo app: + + ```bash + # build images + make images + + # deploy demo app: + make deploy-app + ``` + +5. Make a few requests to the Service: + + ```bash + kubectl port-forward --namespace=ingress-nginx service/ingress-nginx-controller 8090:80 + curl http://esigo.dev:8090/hello/nginx + + + StatusCode : 200 + StatusDescription : OK + Content : {"v":"hello nginx!"} + + RawContent : HTTP/1.1 200 OK + Connection: keep-alive + Content-Length: 21 + Content-Type: text/plain; charset=utf-8 + Date: Mon, 10 Oct 2022 17:43:33 GMT + + {"v":"hello nginx!"} + + Forms : {} + Headers : {[Connection, keep-alive], [Content-Length, 21], [Content-Type, text/plain; charset=utf-8], [Date, + Mon, 10 Oct 2022 17:43:33 GMT]} + Images : {} + InputFields : {} + Links : {} + ParsedHtml : System.__ComObject + RawContentLength : 21 + ``` + +6. View the Grafana UI: + + ```bash + kubectl port-forward --namespace=observability service/grafana 3000:80 + ``` + In the Grafana interface we can see the details: + ![grafana screenshot](../../images/otel-grafana-demo.png "grafana screenshot") + +7. View the Jaeger UI: + + ```bash + kubectl port-forward --namespace=observability service/jaeger-all-in-one-query 16686:16686 + ``` + In the Jaeger interface we can see the details: + ![Jaeger screenshot](../../images/otel-jaeger-demo.png "Jaeger screenshot") + +8. View the Zipkin UI: + + ```bash + kubectl port-forward --namespace=observability service/zipkin 9411:9411 + ``` + In the Zipkin interface we can see the details: + ![zipkin screenshot](../../images/otel-zipkin-demo.png "zipkin screenshot") diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 14415a4f7..6a9e7367c 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -20,6 +20,7 @@ import ( "github.com/imdario/mergo" "k8s.io/ingress-nginx/internal/ingress/annotations/canary" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" + "k8s.io/ingress-nginx/internal/ingress/annotations/opentelemetry" "k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl" "k8s.io/ingress-nginx/internal/ingress/annotations/sslcipher" "k8s.io/ingress-nginx/internal/ingress/annotations/streamsnippet" @@ -94,6 +95,7 @@ type Ingress struct { EnableGlobalAuth bool HTTP2PushPreload bool Opentracing opentracing.Config + Opentelemetry opentelemetry.Config Proxy proxy.Config ProxySSL proxyssl.Config RateLimit ratelimit.Config @@ -145,6 +147,7 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "EnableGlobalAuth": authreqglobal.NewParser(cfg), "HTTP2PushPreload": http2pushpreload.NewParser(cfg), "Opentracing": opentracing.NewParser(cfg), + "Opentelemetry": opentelemetry.NewParser(cfg), "Proxy": proxy.NewParser(cfg), "ProxySSL": proxyssl.NewParser(cfg), "RateLimit": ratelimit.NewParser(cfg), diff --git a/internal/ingress/annotations/opentelemetry/main.go b/internal/ingress/annotations/opentelemetry/main.go new file mode 100644 index 000000000..7dd292322 --- /dev/null +++ b/internal/ingress/annotations/opentelemetry/main.go @@ -0,0 +1,101 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package opentelemetry + +import ( + networking "k8s.io/api/networking/v1" + + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/resolver" +) + +type opentelemetry struct { + r resolver.Resolver +} + +// Config contains the configuration to be used in the Ingress +type Config struct { + Enabled bool `json:"enabled"` + Set bool `json:"set"` + TrustEnabled bool `json:"trust-enabled"` + TrustSet bool `json:"trust-set"` + OperationName string `json:"operation-name"` +} + +// Equal tests for equality between two Config types +func (bd1 *Config) Equal(bd2 *Config) bool { + + if bd1.Set != bd2.Set { + return false + } + + if bd1.Enabled != bd2.Enabled { + return false + } + + if bd1.TrustSet != bd2.TrustSet { + return false + } + + if bd1.TrustEnabled != bd2.TrustEnabled { + return false + } + + if bd1.OperationName != bd2.OperationName { + return false + } + + return true +} + +// NewParser creates a new serviceUpstream annotation parser +func NewParser(r resolver.Resolver) parser.IngressAnnotation { + return opentelemetry{r} +} + +// Parse parses the annotations to look for opentelemetry configurations +func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) { + cfg := Config{} + enabled, err := parser.GetBoolAnnotation("enable-opentelemetry", ing) + if err != nil { + return &cfg, nil + } + cfg.Set = true + cfg.Enabled = enabled + if !enabled { + return &cfg, nil + } + + trustEnabled, err := parser.GetBoolAnnotation("opentelemetry-trust-incoming-span", ing) + if err != nil { + operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing) + if err != nil { + return &cfg, nil + } + cfg.OperationName = operationName + return &cfg, nil + } + + cfg.TrustSet = true + cfg.TrustEnabled = trustEnabled + operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing) + if err != nil { + return &cfg, nil + } + cfg.OperationName = operationName + return &cfg, nil +} diff --git a/internal/ingress/annotations/opentelemetry/main_test.go b/internal/ingress/annotations/opentelemetry/main_test.go new file mode 100644 index 000000000..619108fa6 --- /dev/null +++ b/internal/ingress/annotations/opentelemetry/main_test.go @@ -0,0 +1,170 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package opentelemetry + +import ( + "testing" + + api "k8s.io/api/core/v1" + networking "k8s.io/api/networking/v1" + meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/ingress-nginx/internal/ingress/annotations/parser" + "k8s.io/ingress-nginx/internal/ingress/resolver" +) + +func buildIngress() *networking.Ingress { + defaultBackend := networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: "default-backend", + Port: networking.ServiceBackendPort{ + Number: 80, + }, + }, + } + + return &networking.Ingress{ + ObjectMeta: meta_v1.ObjectMeta{ + Name: "foo", + Namespace: api.NamespaceDefault, + }, + Spec: networking.IngressSpec{ + DefaultBackend: &networking.IngressBackend{ + Service: &networking.IngressServiceBackend{ + Name: "default-backend", + Port: networking.ServiceBackendPort{ + Number: 80, + }, + }, + }, + Rules: []networking.IngressRule{ + { + Host: "foo.bar.com", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/foo", + Backend: defaultBackend, + }, + }, + }, + }, + }, + }, + }, + } +} + +func TestIngressAnnotationOpentelemetrySetTrue(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "true" + ing.SetAnnotations(data) + + val, _ := NewParser(&resolver.Mock{}).Parse(ing) + openTelemetry, ok := val.(*Config) + if !ok { + t.Errorf("expected a Config type") + } + + if !openTelemetry.Enabled { + t.Errorf("expected annotation value to be true, got false") + } + + if !openTelemetry.Set { + t.Errorf("expected annotation value to be true, got false") + } + + if openTelemetry.TrustSet { + t.Errorf("expected annotation value to be false, got true") + } +} + +func TestIngressAnnotationOpentelemetrySetFalse(t *testing.T) { + ing := buildIngress() + + // Test with explicitly set to false + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "false" + ing.SetAnnotations(data) + + val, _ := NewParser(&resolver.Mock{}).Parse(ing) + openTelemetry, ok := val.(*Config) + if !ok { + t.Errorf("expected a Config type") + } + + if openTelemetry.Enabled { + t.Errorf("expected annotation value to be false, got true") + } + + if !openTelemetry.Set { + t.Errorf("expected annotation value to be true, got false") + } +} + +func TestIngressAnnotationOpentelemetryTrustSetTrue(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + opName := "foo-op" + data[parser.GetAnnotationWithPrefix("enable-opentelemetry")] = "true" + data[parser.GetAnnotationWithPrefix("opentelemetry-trust-incoming-span")] = "true" + data[parser.GetAnnotationWithPrefix("opentelemetry-operation-name")] = opName + ing.SetAnnotations(data) + + val, _ := NewParser(&resolver.Mock{}).Parse(ing) + openTelemetry, ok := val.(*Config) + if !ok { + t.Errorf("expected a Config type") + } + + if !openTelemetry.Enabled { + t.Errorf("expected annotation value to be true, got false") + } + + if !openTelemetry.Set { + t.Errorf("expected annotation value to be true, got false") + } + + if !openTelemetry.TrustEnabled { + t.Errorf("expected annotation value to be true, got false") + } + + if !openTelemetry.TrustSet { + t.Errorf("expected annotation value to be true, got false") + } + + if openTelemetry.OperationName != opName { + t.Errorf("expected annotation value to be %v, got %v", opName, openTelemetry.OperationName) + } +} + +func TestIngressAnnotationOpentelemetryUnset(t *testing.T) { + ing := buildIngress() + + // Test with no annotation specified + data := map[string]string{} + ing.SetAnnotations(data) + + val, _ := NewParser(&resolver.Mock{}).Parse(ing) + _, ok := val.(*Config) + if !ok { + t.Errorf("expected a Config type") + } +} diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index 5786b6776..da37ea3c9 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -568,6 +568,54 @@ type Configuration struct { // Default: true OpentracingTrustIncomingSpan bool `json:"opentracing-trust-incoming-span"` + // EnableOpentelemetry enables the nginx Opentelemetry extension + // By default this is disabled + EnableOpentelemetry bool `json:"enable-opentelemetry"` + + // OpentelemetryConfig sets the opentelemetry config file + // Default: /etc/nginx/opentelemetry.toml + OpentelemetryConfig string `json:"opentelemetry-config"` + + // OpentelemetryOperationName specifies a custom name for the server span + OpentelemetryOperationName string `json:"opentelemetry-operation-name"` + + // OpentelemetryTrustIncomingSpan sets whether or not to trust incoming trace spans + // If false, incoming span headers will be rejected + // Default: true + OpentelemetryTrustIncomingSpan bool `json:"opentelemetry-trust-incoming-span"` + + // OtlpCollectorHost specifies the host to use when uploading traces + OtlpCollectorHost string `json:"otlp-collector-host"` + + // OtlpCollectorPort specifies the port to use when uploading traces + // Default: 4317 + OtlpCollectorPort string `json:"otlp-collector-port"` + + // OtelServiceName specifies the service name to use for any traces created + // Default: nginx + OtelServiceName string `json:"otel-service-name"` + + // OtelSampler specifies the sampler to use for any traces created + // Default: AlwaysOff + OtelSampler string `json:"otel-sampler"` + + // OtelSamplerRatio specifies the sampler ratio to use for any traces created + // Default: 0.01 + OtelSamplerRatio float32 `json:"otel-sampler-ratio"` + + //OtelSamplerParentBased specifies the parent based sampler to be use for any traces created + // Default: false + OtelSamplerParentBased bool `json:"otel-sampler-parent-based"` + + // MaxQueueSize specifies the max queue size for uploading traces + OtelMaxQueueSize int32 `json:"otel-max-queuesize"` + + // ScheduleDelayMillis specifies the max delay between uploading traces + OtelScheduleDelayMillis int32 `json:"otel-schedule-delay-millis"` + + // MaxExportBatchSize specifies the max export batch size to used when uploading traces + OtelMaxExportBatchSize int32 `json:"otel-max-export-batch-size"` + // ZipkinCollectorHost specifies the host to use when uploading traces ZipkinCollectorHost string `json:"zipkin-collector-host"` @@ -917,6 +965,13 @@ func NewDefault() Configuration { BindAddressIpv4: defBindAddress, BindAddressIpv6: defBindAddress, OpentracingTrustIncomingSpan: true, + OpentelemetryTrustIncomingSpan: true, + OpentelemetryConfig: "/etc/nginx/opentelemetry.toml", + OtlpCollectorPort: "4317", + OtelServiceName: "nginx", + OtelSampler: "AlwaysOff", + OtelSamplerRatio: 0.01, + OtelSamplerParentBased: false, ZipkinCollectorPort: 9411, ZipkinServiceName: "nginx", ZipkinSampleRate: 1.0, diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 20f8c8687..5d94605b5 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -1444,6 +1444,7 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) loc.EnableGlobalAuth = anns.EnableGlobalAuth loc.HTTP2PushPreload = anns.HTTP2PushPreload loc.Opentracing = anns.Opentracing + loc.Opentelemetry = anns.Opentelemetry loc.Proxy = anns.Proxy loc.ProxySSL = anns.ProxySSL loc.RateLimit = anns.RateLimit diff --git a/internal/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go index 5575009ea..80693db5c 100644 --- a/internal/ingress/controller/nginx.go +++ b/internal/ingress/controller/nginx.go @@ -673,6 +673,11 @@ func (n *NGINXController) OnUpdate(ingressCfg ingress.Configuration) error { return err } + err = createOpentelemetryCfg(cfg) + if err != nil { + return err + } + err = n.testTemplate(content) if err != nil { return err @@ -1056,6 +1061,29 @@ const datadogTmpl = `{ "dd.priority.sampling": {{ .DatadogPrioritySampling }} }` +const otelTmpl = ` +exporter = "otlp" +processor = "batch" + +[exporters.otlp] +# Alternatively the OTEL_EXPORTER_OTLP_ENDPOINT environment variable can also be used. +host = "{{ .OtlpCollectorHost }}" +port = {{ .OtlpCollectorPort }} + +[processors.batch] +max_queue_size = {{ .OtelMaxQueueSize }} +schedule_delay_millis = {{ .OtelScheduleDelayMillis }} +max_export_batch_size = {{ .OtelMaxExportBatchSize }} + +[service] +name = "{{ .OtelServiceName }}" # Opentelemetry resource name + +[sampler] +name = "{{ .OtelSampler }}" # Also: AlwaysOff, TraceIdRatioBased +ratio = {{ .OtelSamplerRatio }} +parent_based = {{ .OtelSamplerParentBased }} +` + func createOpentracingCfg(cfg ngx_config.Configuration) error { var tmpl *template.Template var err error @@ -1091,6 +1119,21 @@ func createOpentracingCfg(cfg ngx_config.Configuration) error { return os.WriteFile("/etc/nginx/opentracing.json", []byte(expanded), file.ReadWriteByUser) } +func createOpentelemetryCfg(cfg ngx_config.Configuration) error { + + tmpl, err := template.New("otel").Parse(otelTmpl) + if err != nil { + return err + } + tmplBuf := bytes.NewBuffer(make([]byte, 0)) + err = tmpl.Execute(tmplBuf, cfg) + if err != nil { + return err + } + + return os.WriteFile(cfg.OpentelemetryConfig, tmplBuf.Bytes(), file.ReadWriteByUser) +} + func cleanTempNginxCfg() error { var files []string diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index f3283a782..9dc9fb3b8 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -265,6 +265,7 @@ var ( "buildAuthSignURL": buildAuthSignURL, "buildAuthSignURLLocation": buildAuthSignURLLocation, "buildOpentracing": buildOpentracing, + "buildOpentelemetry": buildOpentelemetry, "proxySetHeader": proxySetHeader, "buildInfluxDB": buildInfluxDB, "enforceRegexModifier": enforceRegexModifier, @@ -274,7 +275,9 @@ var ( "buildHTTPListener": buildHTTPListener, "buildHTTPSListener": buildHTTPSListener, "buildOpentracingForLocation": buildOpentracingForLocation, + "buildOpentelemetryForLocation": buildOpentelemetryForLocation, "shouldLoadOpentracingModule": shouldLoadOpentracingModule, + "shouldLoadOpentelemetryModule": shouldLoadOpentelemetryModule, "buildModSecurityForLocation": buildModSecurityForLocation, "buildMirrorLocations": buildMirrorLocations, "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, @@ -1239,6 +1242,33 @@ func buildOpentracing(c interface{}, s interface{}) string { return buf.String() } +func buildOpentelemetry(c interface{}, s interface{}) string { + cfg, ok := c.(config.Configuration) + if !ok { + klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) + return "" + } + + servers, ok := s.([]*ingress.Server) + if !ok { + klog.Errorf("expected an '[]*ingress.Server' type but %T was returned", s) + return "" + } + + if !shouldLoadOpentelemetryModule(cfg, servers) { + return "" + } + + buf := bytes.NewBufferString("") + + buf.WriteString("\r\n") + + if cfg.OpentelemetryOperationName != "" { + buf.WriteString(fmt.Sprintf("opentelemetry_operation_name \"%s\";\n", cfg.OpentelemetryOperationName)) + } + return buf.String() +} + // buildInfluxDB produces the single line configuration // needed by the InfluxDB module to send request's metrics // for the current resource @@ -1360,6 +1390,13 @@ func opentracingPropagateContext(location *ingress.Location) string { return "opentracing_propagate_context;" } +func opentelemetryPropagateContext(location *ingress.Location) string { + if location == nil { + return "" + } + return "opentelemetry_propagate;" +} + // shouldLoadModSecurityModule determines whether or not the ModSecurity module needs to be loaded. // First, it checks if `enable-modsecurity` is set in the ConfigMap. If it is not, it iterates over all locations to // check if ModSecurity is enabled by the annotation `nginx.ingress.kubernetes.io/enable-modsecurity`. @@ -1575,6 +1612,36 @@ func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location * return opc } +func buildOpentelemetryForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string { + isOTEnabledInLoc := location.Opentelemetry.Enabled + isOTSetInLoc := location.Opentelemetry.Set + + if isOTEnabled { + if isOTSetInLoc && !isOTEnabledInLoc { + return "opentelemetry off;" + } + } else if !isOTSetInLoc || !isOTEnabledInLoc { + return "" + } + + opc := opentelemetryPropagateContext(location) + if opc != "" { + opc = fmt.Sprintf("opentelemetry on;\n%v", opc) + } + + if location.Opentelemetry.OperationName != "" { + opc = opc + "\nopentelemetry_operation_name " + location.Opentelemetry.OperationName + ";" + } + + if (!isOTTrustSet && !location.Opentelemetry.TrustSet) || + (location.Opentelemetry.TrustSet && !location.Opentelemetry.TrustEnabled) { + opc = opc + "\nopentelemetry_trust_incoming_spans off;" + } else { + opc = opc + "\nopentelemetry_trust_incoming_spans on;" + } + return opc +} + // shouldLoadOpentracingModule determines whether or not the Opentracing module needs to be loaded. // First, it checks if `enable-opentracing` is set in the ConfigMap. If it is not, it iterates over all locations to // check if Opentracing is enabled by the annotation `nginx.ingress.kubernetes.io/enable-opentracing`. @@ -1606,6 +1673,35 @@ func shouldLoadOpentracingModule(c interface{}, s interface{}) bool { return false } +// shouldLoadOpentelemetryModule determines whether or not the Opentelemetry module needs to be loaded. +// It checks if `enable-opentelemetry` is set in the ConfigMap. +func shouldLoadOpentelemetryModule(c interface{}, s interface{}) bool { + cfg, ok := c.(config.Configuration) + if !ok { + klog.Errorf("expected a 'config.Configuration' type but %T was returned", c) + return false + } + + servers, ok := s.([]*ingress.Server) + if !ok { + klog.Errorf("expected an '[]*ingress.Server' type but %T was returned", s) + return false + } + + if cfg.EnableOpentelemetry { + return true + } + + for _, server := range servers { + for _, location := range server.Locations { + if location.Opentelemetry.Enabled { + return true + } + } + } + return false +} + func buildModSecurityForLocation(cfg config.Configuration, location *ingress.Location) string { isMSEnabledInLoc := location.ModSecurity.Enable isMSEnableSetInLoc := location.ModSecurity.EnableSet diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index cb1ebd1b7..343da506b 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -37,6 +37,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/authreq" "k8s.io/ingress-nginx/internal/ingress/annotations/influxdb" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" + "k8s.io/ingress-nginx/internal/ingress/annotations/opentelemetry" "k8s.io/ingress-nginx/internal/ingress/annotations/opentracing" "k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/rewrite" @@ -1150,6 +1151,26 @@ func TestOpentracingPropagateContext(t *testing.T) { } } +func TestOpentelemetryPropagateContext(t *testing.T) { + tests := map[*ingress.Location]string{ + {BackendProtocol: "HTTP"}: "opentelemetry_propagate;", + {BackendProtocol: "HTTPS"}: "opentelemetry_propagate;", + {BackendProtocol: "AUTO_HTTP"}: "opentelemetry_propagate;", + {BackendProtocol: "GRPC"}: "opentelemetry_propagate;", + {BackendProtocol: "GRPCS"}: "opentelemetry_propagate;", + {BackendProtocol: "AJP"}: "opentelemetry_propagate;", + {BackendProtocol: "FCGI"}: "opentelemetry_propagate;", + nil: "", + } + + for loc, expectedDirective := range tests { + actualDirective := opentelemetryPropagateContext(loc) + if actualDirective != expectedDirective { + t.Errorf("Expected %v but returned %v", expectedDirective, actualDirective) + } + } +} + func TestGetIngressInformation(t *testing.T) { testcases := map[string]struct { @@ -1723,6 +1744,37 @@ func TestBuildOpenTracing(t *testing.T) { } +func TestBuildOpenTelemetry(t *testing.T) { + invalidType := &ingress.Ingress{} + expected := "" + actual := buildOpentelemetry(invalidType, []*ingress.Server{}) + + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + cfgNoHost := config.Configuration{ + EnableOpentelemetry: true, + } + expected = "\r\n" + actual = buildOpentelemetry(cfgNoHost, []*ingress.Server{}) + + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + cfgOpenTelemetry := config.Configuration{ + EnableOpentelemetry: true, + OpentelemetryOperationName: "my-operation-name", + } + expected = "\r\n" + expected += "opentelemetry_operation_name \"my-operation-name\";\n" + actual = buildOpentelemetry(cfgOpenTelemetry, []*ingress.Server{}) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } +} + func TestEnforceRegexModifier(t *testing.T) { invalidType := &ingress.Ingress{} expected := false @@ -1903,6 +1955,107 @@ func TestShouldLoadOpentracingModule(t *testing.T) { } } +func TestOpentelemetryForLocation(t *testing.T) { + trueVal := true + falseVal := false + + loadOT := `opentelemetry on; +opentelemetry_propagate; +opentelemetry_trust_incoming_spans on;` + loadOTUntrustedSpan := `opentelemetry on; +opentelemetry_propagate; +opentelemetry_trust_incoming_spans off;` + testCases := []struct { + description string + globalOT bool + isSetInLoc bool + isOTInLoc *bool + globalTrust bool + isTrustSetInLoc bool + isTrustInLoc *bool + expected string + }{ + {"globally enabled, without annotation", true, false, nil, true, false, nil, loadOT}, + {"globally enabled and enabled in location", true, true, &trueVal, true, false, nil, loadOT}, + {"globally disabled and not enabled in location", false, false, nil, true, false, nil, ""}, + {"globally disabled but enabled in location", false, true, &trueVal, true, false, nil, loadOT}, + {"globally trusted, not trusted in location", true, false, nil, true, true, &falseVal, loadOTUntrustedSpan}, + {"not globally trusted, trust set in location", true, false, nil, false, true, &trueVal, loadOT}, + {"not globally trusted, trust not set in location", true, false, nil, false, false, nil, loadOTUntrustedSpan}, + } + + for _, testCase := range testCases { + il := &ingress.Location{ + Opentelemetry: opentelemetry.Config{Set: testCase.isSetInLoc, TrustSet: testCase.isTrustSetInLoc}, + } + if il.Opentelemetry.Set { + il.Opentelemetry.Enabled = *testCase.isOTInLoc + } + if il.Opentelemetry.TrustSet { + il.Opentelemetry.TrustEnabled = *testCase.isTrustInLoc + } + + actual := buildOpentelemetryForLocation(testCase.globalOT, testCase.globalTrust, il) + + if testCase.expected != actual { + t.Errorf("%v: expected '%v' but returned '%v'", testCase.description, testCase.expected, actual) + } + } +} + +func TestShouldLoadOpentelemetryModule(t *testing.T) { + // ### Invalid argument type tests ### + // The first tests should return false. + expected := false + + invalidType := &ingress.Ingress{} + actual := shouldLoadOpentelemetryModule(config.Configuration{}, invalidType) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + actual = shouldLoadOpentelemetryModule(invalidType, []*ingress.Server{}) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + // ### Functional tests ### + actual = shouldLoadOpentelemetryModule(config.Configuration{}, []*ingress.Server{}) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + // All further tests should return true. + expected = true + + configuration := config.Configuration{EnableOpentelemetry: true} + actual = shouldLoadOpentelemetryModule(configuration, []*ingress.Server{}) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + servers := []*ingress.Server{ + { + Locations: []*ingress.Location{ + { + Opentelemetry: opentelemetry.Config{ + Enabled: true, + }, + }, + }, + }, + } + actual = shouldLoadOpentelemetryModule(config.Configuration{}, servers) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } + + actual = shouldLoadOpentelemetryModule(configuration, servers) + if expected != actual { + t.Errorf("Expected '%v' but returned '%v'", expected, actual) + } +} + func TestModSecurityForLocation(t *testing.T) { loadModule := `modsecurity on; ` diff --git a/mkdocs.yml b/mkdocs.yml index c76a640f6..62c0ccf48 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -101,6 +101,7 @@ nav: - Third party addons: - ModSecurity Web Application Firewall: "user-guide/third-party-addons/modsecurity.md" - OpenTracing: "user-guide/third-party-addons/opentracing.md" + - OpenTelemetry: "user-guide/third-party-addons/opentelemetry.md" - Examples: - Introduction: "examples/index.md" - Prerequisites: "examples/PREREQUISITES.md" diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index 9395683ec..08a2f7575 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -35,6 +35,7 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/log" "k8s.io/ingress-nginx/internal/ingress/annotations/mirror" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" + "k8s.io/ingress-nginx/internal/ingress/annotations/opentelemetry" "k8s.io/ingress-nginx/internal/ingress/annotations/opentracing" "k8s.io/ingress-nginx/internal/ingress/annotations/proxy" "k8s.io/ingress-nginx/internal/ingress/annotations/proxyssl" @@ -360,6 +361,9 @@ type Location struct { // Opentracing allows the global opentracing setting to be overridden for a location // +optional Opentracing opentracing.Config `json:"opentracing"` + // Opentelemetry allows the global opentelemetry setting to be overridden for a location + // +optional + Opentelemetry opentelemetry.Config `json:"opentelemetry"` } // SSLPassthroughBackend describes a SSL upstream server configured diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index 2485f8a7b..8a54f3758 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -464,6 +464,10 @@ func (l1 *Location) Equal(l2 *Location) bool { return false } + if !l1.Opentelemetry.Equal(&l2.Opentelemetry) { + return false + } + if !l1.Mirror.Equal(&l2.Mirror) { return false } diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl old mode 100755 new mode 100644 index 958397dd5..014c8cc2a --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -37,6 +37,10 @@ load_module /etc/nginx/modules/ngx_http_modsecurity_module.so; load_module /etc/nginx/modules/ngx_http_opentracing_module.so; {{ end }} +{{ if (shouldLoadOpentelemetryModule $cfg $servers) }} +load_module /modules_mount/etc/nginx/modules/otel/otel_ngx_module.so; +{{ end }} + daemon off; worker_processes {{ $cfg.WorkerProcesses }}; @@ -64,6 +68,10 @@ events { } http { + {{ if (shouldLoadOpentelemetryModule $cfg $servers) }} + opentelemetry_config {{ $cfg.OpentelemetryConfig }}; + {{ end }} + lua_package_path "/etc/nginx/lua/?.lua;;"; {{ buildLuaSharedDictionaries $cfg $servers }} @@ -322,6 +330,7 @@ http { limit_conn_status {{ $cfg.LimitConnStatusCode }}; {{ buildOpentracing $cfg $servers }} + {{ buildOpentelemetry $cfg $servers }} include /etc/nginx/mime.types; default_type {{ $cfg.DefaultType }}; @@ -695,6 +704,9 @@ http { opentracing off; {{ end }} + {{ if $cfg.EnableOpentelemetry }} + opentelemetry off; + {{ end }} location {{ $healthzURI }} { return 200; } @@ -1063,6 +1075,11 @@ stream { opentracing_propagate_context; {{ end }} + {{ if (or $all.Cfg.EnableOpentelemetry $location.Opentelemetry.Enabled) }} + opentelemetry on; + opentelemetry_propagate; + {{ end }} + access_log off; # Ensure that modsecurity will not run on an internal location as this is not accessible from outside @@ -1204,6 +1221,7 @@ stream { set $global_rate_limit_exceeding n; {{ buildOpentracingForLocation $all.Cfg.EnableOpentracing $all.Cfg.OpentracingTrustIncomingSpan $location }} + {{ buildOpentelemetryForLocation $all.Cfg.EnableOpentelemetry $all.Cfg.OpentelemetryTrustIncomingSpan $location }} {{ if $location.Mirror.Source }} mirror {{ $location.Mirror.Source }}; @@ -1520,6 +1538,10 @@ stream { opentracing off; {{ end }} + {{ if $all.Cfg.EnableOpentelemetry }} + opentelemetry off; + {{ end }} + access_log off; return 200; } @@ -1531,6 +1553,10 @@ stream { opentracing off; {{ end }} + {{ if $all.Cfg.EnableOpentelemetry }} + opentelemetry off; + {{ end }} + {{ range $v := $all.NginxStatusIpv4Whitelist }} allow {{ $v }}; {{ end }} diff --git a/test/e2e/framework/exec.go b/test/e2e/framework/exec.go index 0284e768c..d91d36551 100644 --- a/test/e2e/framework/exec.go +++ b/test/e2e/framework/exec.go @@ -21,6 +21,7 @@ import ( "encoding/json" "fmt" "io" + "os" "os/exec" "regexp" "strconv" @@ -111,7 +112,11 @@ func (f *Framework) NamespaceContent() (string, error) { // newIngressController deploys a new NGINX Ingress controller in a namespace func (f *Framework) newIngressController(namespace string, namespaceOverlay string) error { // Creates an nginx deployment - cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay) + isChroot, ok := os.LookupEnv("IS_CHROOT") + if !ok { + isChroot = "false" + } + cmd := exec.Command("./wait-for-nginx.sh", namespace, namespaceOverlay, isChroot) out, err := cmd.CombinedOutput() if err != nil { return fmt.Errorf("unexpected error waiting for ingress controller deployment: %v.\nLogs:\n%v", err, string(out)) diff --git a/test/e2e/run-e2e-suite.sh b/test/e2e/run-e2e-suite.sh index b1de8bf9a..a3bf589cd 100755 --- a/test/e2e/run-e2e-suite.sh +++ b/test/e2e/run-e2e-suite.sh @@ -76,6 +76,7 @@ kubectl run --rm \ --restart=Never \ --env="E2E_NODES=${E2E_NODES}" \ --env="FOCUS=${FOCUS}" \ + --env="IS_CHROOT=${IS_CHROOT:-false}"\ --env="E2E_CHECK_LEAKS=${E2E_CHECK_LEAKS}" \ --env="NGINX_BASE_IMAGE=${NGINX_BASE_IMAGE}" \ --overrides='{ "apiVersion": "v1", "spec":{"serviceAccountName": "ingress-nginx-e2e"}}' \ diff --git a/test/e2e/settings/opentelemetry.go b/test/e2e/settings/opentelemetry.go new file mode 100644 index 000000000..92d202cb3 --- /dev/null +++ b/test/e2e/settings/opentelemetry.go @@ -0,0 +1,119 @@ +/* +Copyright 2022 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package settings + +import ( + "strings" + + "github.com/onsi/ginkgo/v2" + + "k8s.io/ingress-nginx/test/e2e/framework" +) + +const ( + enableOpentelemetry = "enable-opentelemetry" + opentelemetryTrustIncomingSpan = "opentelemetry-trust-incoming-span" + + opentelemetryOperationName = "opentelemetry-operation-name" + opentelemetryLocationOperationName = "opentelemetry-location-operation-name" + opentelemetryConfig = "opentelemetry-config" + opentelemetryConfigPath = "/etc/nginx/opentelemetry.toml" +) + +var _ = framework.IngressNginxDescribe("Configure Opentelemetry", func() { + f := framework.NewDefaultFramework("enable-opentelemetry") + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + }) + + ginkgo.AfterEach(func() { + }) + + ginkgo.It("should not exists opentelemetry directive", func() { + config := map[string]string{} + config[enableOpentelemetry] = "false" + f.SetNginxConfigMapData(config) + + f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) + + f.WaitForNginxConfiguration( + func(cfg string) bool { + return !strings.Contains(cfg, "opentelemetry on") + }) + }) + + ginkgo.It("should exists opentelemetry directive when is enabled", func() { + config := map[string]string{} + config[enableOpentelemetry] = "true" + config[opentelemetryConfig] = opentelemetryConfigPath + f.SetNginxConfigMapData(config) + + f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) + + f.WaitForNginxConfiguration( + func(cfg string) bool { + return strings.Contains(cfg, "opentelemetry on") + }) + }) + + ginkgo.It("should include opentelemetry_trust_incoming_spans on directive when enabled", func() { + config := map[string]string{} + config[enableOpentelemetry] = "true" + config[opentelemetryConfig] = opentelemetryConfigPath + config[opentelemetryTrustIncomingSpan] = "true" + f.SetNginxConfigMapData(config) + + f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) + + f.WaitForNginxConfiguration( + func(cfg string) bool { + return strings.Contains(cfg, "opentelemetry_trust_incoming_spans on") + }) + }) + + ginkgo.It("should not exists opentelemetry_operation_name directive when is empty", func() { + config := map[string]string{} + config[enableOpentelemetry] = "true" + config[opentelemetryConfig] = opentelemetryConfigPath + config[opentelemetryOperationName] = "" + f.SetNginxConfigMapData(config) + + f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) + + f.WaitForNginxConfiguration( + func(cfg string) bool { + return !strings.Contains(cfg, "opentelemetry_operation_name") + }) + }) + + ginkgo.It("should exists opentelemetry_operation_name directive when is configured", func() { + config := map[string]string{} + config[enableOpentelemetry] = "true" + config[opentelemetryConfig] = opentelemetryConfigPath + config[opentelemetryOperationName] = "HTTP $request_method $uri" + f.SetNginxConfigMapData(config) + + f.EnsureIngress(framework.NewSingleIngress(enableOpentelemetry, "/", enableOpentelemetry, f.Namespace, "http-svc", 80, nil)) + + f.WaitForNginxConfiguration( + func(cfg string) bool { + return strings.Contains(cfg, `opentelemetry_operation_name "HTTP $request_method $uri"`) + }) + }) + +}) diff --git a/test/e2e/wait-for-nginx.sh b/test/e2e/wait-for-nginx.sh index 190f71e6d..153d348c2 100755 --- a/test/e2e/wait-for-nginx.sh +++ b/test/e2e/wait-for-nginx.sh @@ -23,6 +23,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" export NAMESPACE=$1 export NAMESPACE_OVERLAY=$2 +export IS_CHROOT=$3 echo "deploying NGINX Ingress controller in namespace $NAMESPACE" @@ -46,6 +47,16 @@ metadata: EOF +OTEL_MODULE=$(cat < Date: Wed, 22 Mar 2023 18:50:22 -0700 Subject: [PATCH 104/822] Update exposing-tcp-udp-services.md (#9777) --- docs/user-guide/exposing-tcp-udp-services.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/user-guide/exposing-tcp-udp-services.md b/docs/user-guide/exposing-tcp-udp-services.md index 6b595ffae..63293f0e5 100644 --- a/docs/user-guide/exposing-tcp-udp-services.md +++ b/docs/user-guide/exposing-tcp-udp-services.md @@ -63,3 +63,9 @@ spec: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx ``` +Then, the configmap should be added into ingress controller's deployment args. +``` + args: + - /nginx-ingress-controller + - --tcp-services-configmap=ingress-nginx/tcp-services +``` From 72ff21ed9e26cb969052c753633049ba8a87ecf9 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 22 Mar 2023 23:26:22 -0400 Subject: [PATCH 105/822] kick off 1.7.0 build (#9775) Signed-off-by: James Strong --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index 9dc820555..b13f0e3bc 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.6.4 +v1.7.0 From 7865825cf018624bef7a76fb8481e39dcd2032bc Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 24 Mar 2023 09:45:31 -0400 Subject: [PATCH 106/822] release notes v1.7.0 Signed-off-by: James Strong --- README.md | 1 + TAG | 2 +- changelog/Changelog-1.7.0.md | 78 + charts/ingress-nginx/Chart.yaml | 22 +- charts/ingress-nginx/README.md | 8 +- .../changelog/Changelog-4.6.0.md | 24 + charts/ingress-nginx/values.yaml | 1652 ++++++++--------- deploy/static/provider/aws/deploy.yaml | 44 +- .../aws/nlb-with-tls-termination/deploy.yaml | 44 +- deploy/static/provider/baremetal/deploy.yaml | 44 +- deploy/static/provider/cloud/deploy.yaml | 44 +- deploy/static/provider/do/deploy.yaml | 44 +- deploy/static/provider/exoscale/deploy.yaml | 44 +- deploy/static/provider/kind/deploy.yaml | 44 +- deploy/static/provider/scw/deploy.yaml | 44 +- docs/e2e-tests.md | 277 +-- docs/user-guide/exposing-tcp-udp-services.md | 6 + magefiles/release.go | 2 +- 18 files changed, 1283 insertions(+), 1141 deletions(-) create mode 100644 changelog/Changelog-1.7.0.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.6.0.md diff --git a/README.md b/README.md index 855c47418..f3f68366e 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | |-----------------------|------------------------------|----------------|---------------| +| v1.7.0 | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | | v1.6.4 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | | v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | diff --git a/TAG b/TAG index 9dc820555..b13f0e3bc 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.6.4 +v1.7.0 diff --git a/changelog/Changelog-1.7.0.md b/changelog/Changelog-1.7.0.md new file mode 100644 index 000000000..6a938c5f5 --- /dev/null +++ b/changelog/Changelog-1.7.0.md @@ -0,0 +1,78 @@ +# Changelog + +### 1.7.0 +Images: + + * registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.7.0@sha256:e84ef3b44c8efeefd8b0aa08770a886bfea1f04c53b61b4ba9a7204e9f1a7edc + +### All Changes: + +* kick off 1.7.0 build (#9775) +* Update exposing-tcp-udp-services.md (#9777) +* feat: OpenTelemetry module integration (#9062) +* drop k8s 1.23 support (#9772) +* Fix canary-weight-total annotation ignored in rule backends (#9729) +* fix: controller psp's volume config (#9740) +* Fix several Helm YAML issues with extraModules and extraInitContainers (#9709) +* docs(helm): fix value key in readme for enabling certManager (#9640) +* updated digest and sha for e2e-test-echo (#9760) +* updated digest and sha for e2e-test-fastcgi-helloserver (#9759) +* updated digest and sha for opentelemetry (#9758) +* updated digest and sha for e2e-test-cfssl (#9757) +* updated kube-webhook-certgen digest and tags (#9756) +* updated nginx-error digest and tags (#9755) +* added upgrade ginkgo documentation for contributors (#9753) +* changes Makefile of echo folder to trigger code-build (#9754) +* Chart: Drop `controller.headers`, rework DH param secret. (#9659) +* updated NGINX_BASE image with latest tag (#9747) +* Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732) +* bumped ginkgo to v2.9.0 (#9722) +* HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731) +* update to golang 1.20 (#9690) +* Indent values.yaml using 2 instead of 4 spaces (#9656) +* fix some comments (#9688) +* migrate mitchellh/hashstructure to v2 (#9651) +* changed v1.6.3 to v1.6.4 on deploy docs (#9647) +* controller: Don't panic when ready condition in a endpointslice is missing (#9550) +* Rework Ginkgo usage (#9522) +* code clean for fsnotify (#9571) +* Optimize the document for readability (#9551) +* sets.String is deprecated: use generic Set instead. new ways: s1 := Set[string]{} s2 := New[string]() (#9589) +* Adjust the import package order and use http library variables (#9587) +* Optimize the judgment mode to remove redundant transformations (#9588) +* Fix rewrite example (#9633) +* remove tests and regex path checks (#9626) +* Fix incorrect annotation name in upstream hashing configuration (#9617) +* Release docs for Controller v1.6.3 and Helm v4.5.0 (#9614) + +### Dependencies updates: +* Bump aquasecurity/trivy-action from 0.8.0 to 0.9.2 (#9767) +* Bump k8s.io/component-base from 0.26.2 to 0.26.3 (#9764) +* Bump actions/dependency-review-action from 3.0.3 to 3.0.4 (#9766) +* Bump actions/add-to-project from 0.4.0 to 0.4.1 (#9765) +* Bump actions/dependency-review-action from 3.0.2 to 3.0.3 (#9727) +* Bump github.com/prometheus/common from 0.41.0 to 0.42.0 (#9724) +* Bump golang.org/x/crypto from 0.6.0 to 0.7.0 (#9723) +* Bump actions/download-artifact from 3.0.1 to 3.0.2 (#9721) +* Bump goreleaser/goreleaser-action from 4.1.0 to 4.2.0 (#9718) +* Bump actions/upload-artifact from 3.1.1 to 3.1.2 (#9717) +* Bump docker/setup-buildx-action from 2.2.1 to 2.5.0 (#9719) +* Bump helm/chart-releaser-action from 1.4.1 to 1.5.0 (#9720) +* Bump github.com/onsi/ginkgo/v2 from 2.6.1 to 2.9.0 (#9695) +* Bump k8s.io/klog/v2 from 2.90.0 to 2.90.1 (#9694) +* Bump golang.org/x/crypto in /magefiles (#9691) +* Bump k8s.io/component-base from 0.26.1 to 0.26.2 (#9696) +* Bump github.com/prometheus/common from 0.40.0 to 0.41.0 (#9698) +* Bump sigs.k8s.io/controller-runtime from 0.14.2 to 0.14.5 (#9697) +* Bump golang.org/x/net in /magefiles (#9692) +* Bump golang.org/x/sys in /images/custom-error-pages/rootfs (#9671) +* Bump github.com/stretchr/testify from 1.8.1 to 1.8.2 (#9675) +* Bump github.com/prometheus/common from 0.39.0 to 0.40.0 (#9653) +* Bump golang.org/x/net from 0.6.0 to 0.7.0 (#9646) +* Bump golang.org/x/net in /images/kube-webhook-certgen/rootfs (#9645) +* Bump google.golang.org/grpc from 1.52.3 to 1.53.0 (#9610) +* Bump github.com/prometheus/client_golang (#9630) +* Bump golang.org/x/crypto from 0.5.0 to 0.6.0 (#9609) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.6.3...controller-controller-v1.7.0 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 21779e195..130fe06fd 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,13 +1,21 @@ annotations: artifacthub.io/changes: | - - "add lint on chart before release (#9570)" - - "ci: remove setup-helm step (#9404)" - - "feat(helm): Optionally use cert-manager instead admission patch (#9279)" - - "run helm release on main only and when the chart/value changes only (#9290)" - - "Update Ingress-Nginx version controller-v1.6.4" + - "Upgrade alpine 3.17.2" + - "Upgrade golang 1.20" + - "Drop testing/support for Kubernetes 1.23" + - "docs(helm): fix value key in readme for enabling certManager (#9640)" + - "Update Ingress-Nginx version controller-v1.7.0" + - "feat: OpenTelemetry module integration (#9062)" + - "canary-weight-total annotation ignored in rule backends (#9729)" + - "fix controller psp's volume config (#9740)" + - "Fix several Helm YAML issues with extraModules and extraInitContainers (#9709)" + - "Chart: Drop `controller.headers`, rework DH param secret. (#9659)" + - "Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732)" + - "HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731)" + - "Fix incorrect annotation name in upstream hashing configuration (#9617)" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.6.4 +appVersion: 4.6.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -24,4 +32,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.5.2 +version: 4.5.4 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 9659df139..dcd5af57e 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.5.2](https://img.shields.io/badge/Version-4.5.2-informational?style=flat-square) ![AppVersion: 1.6.4](https://img.shields.io/badge/AppVersion-1.6.4-informational?style=flat-square) +![Version: 4.5.4](https://img.shields.io/badge/Version-4.5.4-informational?style=flat-square) ![AppVersion: 4.6.0](https://img.shields.io/badge/AppVersion-4.6.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -333,13 +333,13 @@ Kubernetes: `>=1.20.0-0` | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f"` | | -| controller.image.digestChroot | string | `"sha256:0de01e2c316c3ca7847ca13b32d077af7910d07f21a4a82f81061839764f8f81"` | | +| controller.image.digest | string | `"sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7"` | | +| controller.image.digestChroot | string | `"sha256:e84ef3b44c8efeefd8b0aa08770a886bfea1f04c53b61b4ba9a7204e9f1a7edc"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.6.4"` | | +| controller.image.tag | string | `"v1.7.0"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.6.0.md b/charts/ingress-nginx/changelog/Changelog-4.6.0.md new file mode 100644 index 000000000..469aaba8c --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.6.0.md @@ -0,0 +1,24 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.5.3 + +* docs(helm): fix value key in readme for enabling certManager (#9640) +* Upgrade alpine 3.17.2 +* Upgrade golang 1.20 +* Drop testing/support for Kubernetes 1.23 +* docs(helm): fix value key in readme for enabling certManager (#9640) +* Update Ingress-Nginx version controller-v1.7.0 +* feat: OpenTelemetry module integration (#9062) +* canary-weight-total annotation ignored in rule backends (#9729) +* fix controller psp's volume config (#9740) +* Fix several Helm YAML issues with extraModules and extraInitContainers (#9709) +* Chart: Drop `controller.headers`, rework DH param secret. (#9659) +* Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732) +* HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731) +* Fix incorrect annotation name in upstream hashing configuration (#9617) + +* Update Ingress-Nginx version controller-v1.7.0 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.5.2...helm-chart-4.6.0 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 1a538f810..6627bf220 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -14,148 +14,541 @@ commonLabels: {} # myLabel: aakkmd controller: - name: controller - image: - ## Keep false as default for now! - chroot: false - registry: registry.k8s.io - image: ingress-nginx/controller - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "v1.6.4" - digest: sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f - digestChroot: sha256:0de01e2c316c3ca7847ca13b32d077af7910d07f21a4a82f81061839764f8f81 - pullPolicy: IfNotPresent - # www-data -> uid 101 - runAsUser: 101 - allowPrivilegeEscalation: true - # -- Use an existing PSP instead of creating one - existingPsp: "" - # -- Configures the controller container name - containerName: controller - # -- Configures the ports that the nginx-controller listens on - containerPort: - http: 80 - https: 443 - # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ - config: {} - # -- Annotations to be added to the controller config configuration configmap. - configAnnotations: {} - # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers - proxySetHeaders: {} - # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers - addHeaders: {} - # -- Optionally customize the pod dnsConfig. - dnsConfig: {} - # -- Optionally customize the pod hostname. - hostname: {} - # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. - # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller - # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. - dnsPolicy: ClusterFirst - # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network - # Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply - reportNodeInternalIp: false - # -- Process Ingress objects without ingressClass annotation/ingressClassName field - # Overrides value for --watch-ingress-without-class flag of the controller binary - # Defaults to false - watchIngressWithoutClass: false - # -- Process IngressClass per name (additionally as per spec.controller). - ingressClassByName: false - # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" - # Defaults to false - enableTopologyAwareRouting: false - # -- This configuration defines if Ingress Controller should allow users to set - # their own *-snippet annotations, otherwise this is forbidden / dropped - # when users add those annotations. - # Global snippets in ConfigMap are still respected - allowSnippetAnnotations: true - # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), - # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 - # is merged - hostNetwork: false - ## Use host ports 80 and 443 - ## Disabled by default - hostPort: - # -- Enable 'hostPort' or not - enabled: false - ports: - # -- 'hostPort' http port - http: 80 - # -- 'hostPort' https port - https: 443 - # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' - electionID: "" - ## This section refers to the creation of the IngressClass resource - ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 - ingressClassResource: - # -- Name of the ingressClass - name: nginx - # -- Is this ingressClass enabled or not - enabled: true - # -- Is this the default ingressClass for the cluster - default: false - # -- Controller-value of the controller that is processing this ingressClass - controllerValue: "k8s.io/ingress-nginx" - # -- Parameters is a link to a custom resource containing additional - # configuration for the controller. This is optional if the controller - # does not require extra parameters. - parameters: {} - # -- For backwards compatibility with ingress.class annotation, use ingressClass. - # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation - ingressClass: nginx - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value + name: controller + image: + ## Keep false as default for now! + chroot: false + registry: registry.k8s.io + image: ingress-nginx/controller + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "v1.7.0" + digest: sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + digestChroot: sha256:e84ef3b44c8efeefd8b0aa08770a886bfea1f04c53b61b4ba9a7204e9f1a7edc + pullPolicy: IfNotPresent + # www-data -> uid 101 + runAsUser: 101 + allowPrivilegeEscalation: true + # -- Use an existing PSP instead of creating one + existingPsp: "" + # -- Configures the controller container name + containerName: controller + # -- Configures the ports that the nginx-controller listens on + containerPort: + http: 80 + https: 443 + # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ + config: {} + # -- Annotations to be added to the controller config configuration configmap. + configAnnotations: {} + # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers + proxySetHeaders: {} + # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers + addHeaders: {} + # -- Optionally customize the pod dnsConfig. + dnsConfig: {} + # -- Optionally customize the pod hostname. + hostname: {} + # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. + # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller + # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. + dnsPolicy: ClusterFirst + # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network + # Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + reportNodeInternalIp: false + # -- Process Ingress objects without ingressClass annotation/ingressClassName field + # Overrides value for --watch-ingress-without-class flag of the controller binary + # Defaults to false + watchIngressWithoutClass: false + # -- Process IngressClass per name (additionally as per spec.controller). + ingressClassByName: false + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" + # Defaults to false + enableTopologyAwareRouting: false + # -- This configuration defines if Ingress Controller should allow users to set + # their own *-snippet annotations, otherwise this is forbidden / dropped + # when users add those annotations. + # Global snippets in ConfigMap are still respected + allowSnippetAnnotations: true + # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), + # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 + # is merged + hostNetwork: false + ## Use host ports 80 and 443 + ## Disabled by default + hostPort: + # -- Enable 'hostPort' or not + enabled: false + ports: + # -- 'hostPort' http port + http: 80 + # -- 'hostPort' https port + https: 443 + # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' + electionID: "" + ## This section refers to the creation of the IngressClass resource + ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 + ingressClassResource: + # -- Name of the ingressClass + name: nginx + # -- Is this ingressClass enabled or not + enabled: true + # -- Is this the default ingressClass for the cluster + default: false + # -- Controller-value of the controller that is processing this ingressClass + controllerValue: "k8s.io/ingress-nginx" + # -- Parameters is a link to a custom resource containing additional + # configuration for the controller. This is optional if the controller + # does not require extra parameters. + parameters: {} + # -- For backwards compatibility with ingress.class annotation, use ingressClass. + # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation + ingressClass: nginx + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value - # -- Security Context policies for controller pods - podSecurityContext: {} - # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls - sysctls: {} - # sysctls: - # "net.core.somaxconn": "8192" + # -- Security Context policies for controller pods + podSecurityContext: {} + # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls + sysctls: {} + # sysctls: + # "net.core.somaxconn": "8192" - # -- Allows customization of the source of the IP address or FQDN to report - # in the ingress status field. By default, it reads the information provided - # by the service. If disable, the status field reports the IP address of the - # node or nodes where an ingress controller pod is running. - publishService: - # -- Enable 'publishService' or not - enabled: true - # -- Allows overriding of the publish service to bind to - # Must be / - pathOverride: "" - # Limit the scope of the controller to a specific namespace - scope: - # -- Enable 'scope' or not - enabled: false - # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) - namespace: "" - # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels - # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. - namespaceSelector: "" - # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) + # -- Allows customization of the source of the IP address or FQDN to report + # in the ingress status field. By default, it reads the information provided + # by the service. If disable, the status field reports the IP address of the + # node or nodes where an ingress controller pod is running. + publishService: + # -- Enable 'publishService' or not + enabled: true + # -- Allows overriding of the publish service to bind to + # Must be / + pathOverride: "" + # Limit the scope of the controller to a specific namespace + scope: + # -- Enable 'scope' or not + enabled: false + # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) + namespace: "" + # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels + # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. + namespaceSelector: "" + # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + tcp: + # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) configMapNamespace: "" - tcp: - # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - # -- Annotations to be added to the tcp config configmap - annotations: {} - udp: - # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) - configMapNamespace: "" - # -- Annotations to be added to the udp config configmap - annotations: {} - # -- Maxmind license key to download GeoLite2 Databases. - ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases - maxmindLicenseKey: "" - # -- Additional command line arguments to pass to nginx-ingress-controller - # E.g. to specify the default SSL certificate you can use - extraArgs: {} - ## extraArgs: - ## default-ssl-certificate: "/" + # -- Annotations to be added to the tcp config configmap + annotations: {} + udp: + # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the udp config configmap + annotations: {} + # -- Maxmind license key to download GeoLite2 Databases. + ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases + maxmindLicenseKey: "" + # -- Additional command line arguments to pass to nginx-ingress-controller + # E.g. to specify the default SSL certificate you can use + extraArgs: {} + ## extraArgs: + ## default-ssl-certificate: "/" + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + + # -- Use a `DaemonSet` or `Deployment` + kind: Deployment + # -- Annotations to be added to the controller Deployment or DaemonSet + ## + annotations: {} + # keel.sh/pollSchedule: "@every 60m" + + # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels + ## + labels: {} + # keel.sh/policy: patch + # keel.sh/trigger: poll + + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + # # An example of preferred pod anti-affinity, weight is in the range 1-100 + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - weight: 100 + # podAffinityTerm: + # labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: kubernetes.io/hostname + + # # An example of required pod anti-affinity + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: "kubernetes.io/hostname" + + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + topologySpreadConstraints: [] + # - maxSkew: 1 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: DoNotSchedule + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: ingress-nginx-internal + + # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready + ## wait up to five minutes for the drain of connections + ## + terminationGracePeriodSeconds: 300 + # -- Node labels for controller pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: + kubernetes.io/os: linux + ## Liveness and readiness probe values + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## + ## startupProbe: + ## httpGet: + ## # should match container.healthCheckPath + ## path: "/healthz" + ## port: 10254 + ## scheme: HTTP + ## initialDelaySeconds: 5 + ## periodSeconds: 5 + ## timeoutSeconds: 2 + ## successThreshold: 1 + ## failureThreshold: 5 + livenessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + # -- Path of the health check endpoint. All requests received on the port defined by + # the healthz-port parameter are forwarded internally to this path. + healthCheckPath: "/healthz" + # -- Address to bind the health check endpoint. + # It is better to set this option to the internal node address + # if the ingress nginx controller is running in the `hostNetwork: true` mode. + healthCheckHost: "" + # -- Annotations to be added to controller pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Define either 'minAvailable' or 'maxUnavailable', never both. + # maxUnavailable: 1 + + ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes + ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 + ## Ideally, there should be no limits. + ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ + resources: + ## limits: + ## cpu: 100m + ## memory: 90Mi + requests: + cpu: 100m + memory: 90Mi + # Mutually exclusive with keda autoscaling + autoscaling: + apiVersion: autoscaling/v2 + enabled: false + annotations: {} + minReplicas: 1 + maxReplicas: 11 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + autoscalingTemplate: [] + # Custom or additional autoscaling metrics + # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics + # - type: Pods + # pods: + # metric: + # name: nginx_ingress_controller_nginx_process_requests_total + # target: + # type: AverageValue + # averageValue: 10000m + + # Mutually exclusive with hpa autoscaling + keda: + apiVersion: "keda.sh/v1alpha1" + ## apiVersion changes with keda 1.x vs 2.x + ## 2.x = keda.sh/v1alpha1 + ## 1.x = keda.k8s.io/v1alpha1 + enabled: false + minReplicas: 1 + maxReplicas: 11 + pollingInterval: 30 + cooldownPeriod: 300 + restoreToOriginalReplicaCount: false + scaledObject: + annotations: {} + # Custom annotations for ScaledObject resource + # annotations: + # key: value + triggers: [] + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + + # -- Enable mimalloc as a drop-in replacement for malloc. + ## ref: https://github.com/microsoft/mimalloc + ## + enableMimalloc: true + ## Override NGINX template + customTemplate: + configMapName: "" + configMapKey: "" + service: + enabled: true + # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were + # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http + # It allows choosing the protocol for each backend specified in the Kubernetes service. + # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 + # Will be ignored for Kubernetes versions older than 1.20 + ## + appProtocol: true + annotations: {} + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the controller services are available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + loadBalancerSourceRanges: [] + enableHttp: true + enableHttps: true + ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + + ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + # sessionAffinity: "" + + ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, + ## the service controller allocates a port from your cluster’s NodePort range. + ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 + + # -- Represents the dual-stack-ness requested or required by this Service. Possible values are + # SingleStack, PreferDualStack or RequireDualStack. + # The ipFamilies and clusterIPs fields depend on the value of this field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilyPolicy: "SingleStack" + # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically + # based on cluster configuration and the ipFamilyPolicy field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilies: + - IPv4 + ports: + http: 80 + https: 443 + targetPorts: + http: http + https: https + type: LoadBalancer + ## type: NodePort + ## nodePorts: + ## http: 32080 + ## https: 32443 + ## tcp: + ## 8080: 32808 + nodePorts: + http: "" + https: "" + tcp: {} + udp: {} + external: + enabled: true + internal: + # -- Enables an additional internal load balancer (besides the external one). + enabled: false + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. + annotations: {} + # loadBalancerIP: "" + + # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. + loadBalancerSourceRanges: [] + ## Set external traffic policy to: "Local" to preserve source IP on + ## providers supporting it + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + # shareProcessNamespace enables process namespace sharing within the pod. + # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. + shareProcessNamespace: false + # -- Additional containers to be added to the controller pod. + # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. + extraContainers: [] + # - name: my-sidecar + # image: nginx:latest + # - name: lemonldap-ng-controller + # image: lemonldapng/lemonldap-ng-controller:0.2.0 + # args: + # - /lemonldap-ng-controller + # - --alsologtostderr + # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration + # env: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + # - name: POD_NAMESPACE + # valueFrom: + # fieldRef: + # fieldPath: metadata.namespace + # volumeMounts: + # - name: copy-portal-skins + # mountPath: /srv/var/lib/lemonldap-ng/portal/skins + + # -- Additional volumeMounts to the controller main container. + extraVolumeMounts: [] + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + # -- Additional volumes to the controller pod. + extraVolumes: [] + # - name: copy-portal-skins + # emptyDir: {} + + # -- Containers, which are run before the app containers are started. + extraInitContainers: [] + # - name: init-myservice + # image: busybox + # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] + + # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module + extraModules: [] + # - name: mytestmodule + # image: registry.k8s.io/ingress-nginx/mytestmodule + # containerSecurityContext: + # allowPrivilegeEscalation: false + # + # The image must contain a `/usr/local/bin/init_module.sh` executable, which + # will be executed as initContainers, to move its config files within the + # mounted volume. + + opentelemetry: + enabled: false + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f + containerSecurityContext: + allowPrivilegeEscalation: false + admissionWebhooks: + annotations: {} + # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". + + ## Additional annotations to the admission webhooks. + ## These annotations will be added to the ValidatingWebhookConfiguration and + ## the Jobs Spec of the admission webhooks. + enabled: true # -- Additional environment variables to set extraEnvs: [] # extraEnvs: @@ -164,707 +557,314 @@ controller: # secretKeyRef: # key: FOO # name: secret-resource - - # -- Use a `DaemonSet` or `Deployment` - kind: Deployment - # -- Annotations to be added to the controller Deployment or DaemonSet - ## - annotations: {} - # keel.sh/pollSchedule: "@every 60m" - - # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels - ## + # -- Admission Webhook failure policy to use + failurePolicy: Fail + # timeoutSeconds: 10 + port: 8443 + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + namespaceSelector: {} + objectSelector: {} + # -- Labels to be added to admission webhooks labels: {} - # keel.sh/policy: patch - # keel.sh/trigger: poll - - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - # -- Affinity and anti-affinity rules for server scheduling to nodes - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity - ## - affinity: {} - # # An example of preferred pod anti-affinity, weight is in the range 1-100 - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - weight: 100 - # podAffinityTerm: - # labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - ingress-nginx - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - ingress-nginx - # - key: app.kubernetes.io/component - # operator: In - # values: - # - controller - # topologyKey: kubernetes.io/hostname - - # # An example of required pod anti-affinity - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchExpressions: - # - key: app.kubernetes.io/name - # operator: In - # values: - # - ingress-nginx - # - key: app.kubernetes.io/instance - # operator: In - # values: - # - ingress-nginx - # - key: app.kubernetes.io/component - # operator: In - # values: - # - controller - # topologyKey: "kubernetes.io/hostname" - - # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ - ## - topologySpreadConstraints: [] - # - maxSkew: 1 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: DoNotSchedule - # labelSelector: - # matchLabels: - # app.kubernetes.io/instance: ingress-nginx-internal - - # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready - ## wait up to five minutes for the drain of connections - ## - terminationGracePeriodSeconds: 300 - # -- Node labels for controller pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: - kubernetes.io/os: linux - ## Liveness and readiness probe values - ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes - ## - ## startupProbe: - ## httpGet: - ## # should match container.healthCheckPath - ## path: "/healthz" - ## port: 10254 - ## scheme: HTTP - ## initialDelaySeconds: 5 - ## periodSeconds: 5 - ## timeoutSeconds: 2 - ## successThreshold: 1 - ## failureThreshold: 5 - livenessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 5 - readinessProbe: - httpGet: - # should match container.healthCheckPath - path: "/healthz" - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 3 - # -- Path of the health check endpoint. All requests received on the port defined by - # the healthz-port parameter are forwarded internally to this path. - healthCheckPath: "/healthz" - # -- Address to bind the health check endpoint. - # It is better to set this option to the internal node address - # if the ingress nginx controller is running in the `hostNetwork: true` mode. - healthCheckHost: "" - # -- Annotations to be added to controller pods - ## - podAnnotations: {} - replicaCount: 1 - # -- Define either 'minAvailable' or 'maxUnavailable', never both. - minAvailable: 1 - # -- Define either 'minAvailable' or 'maxUnavailable', never both. - # maxUnavailable: 1 - - ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes - ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 - ## Ideally, there should be no limits. - ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ - resources: - ## limits: - ## cpu: 100m - ## memory: 90Mi - requests: - cpu: 100m - memory: 90Mi - # Mutually exclusive with keda autoscaling - autoscaling: - apiVersion: autoscaling/v2 - enabled: false - annotations: {} - minReplicas: 1 - maxReplicas: 11 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - autoscalingTemplate: [] - # Custom or additional autoscaling metrics - # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics - # - type: Pods - # pods: - # metric: - # name: nginx_ingress_controller_nginx_process_requests_total - # target: - # type: AverageValue - # averageValue: 10000m - - # Mutually exclusive with hpa autoscaling - keda: - apiVersion: "keda.sh/v1alpha1" - ## apiVersion changes with keda 1.x vs 2.x - ## 2.x = keda.sh/v1alpha1 - ## 1.x = keda.k8s.io/v1alpha1 - enabled: false - minReplicas: 1 - maxReplicas: 11 - pollingInterval: 30 - cooldownPeriod: 300 - restoreToOriginalReplicaCount: false - scaledObject: - annotations: {} - # Custom annotations for ScaledObject resource - # annotations: - # key: value - triggers: [] - # - type: prometheus - # metadata: - # serverAddress: http://:9090 - # metricName: http_requests_total - # threshold: '100' - # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) - - behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 - - # -- Enable mimalloc as a drop-in replacement for malloc. - ## ref: https://github.com/microsoft/mimalloc - ## - enableMimalloc: true - ## Override NGINX template - customTemplate: - configMapName: "" - configMapKey: "" + # -- Use an existing PSP instead of creating one + existingPsp: "" + networkPolicyEnabled: false service: - enabled: true - # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were - # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http - # It allows choosing the protocol for each backend specified in the Kubernetes service. - # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 - # Will be ignored for Kubernetes versions older than 1.20 - ## - appProtocol: true - annotations: {} - labels: {} - # clusterIP: "" + annotations: {} + # clusterIP: "" + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 443 + type: ClusterIP + createSecretJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + patchWebhookJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + patch: + enabled: true + image: + registry: registry.k8s.io + image: ingress-nginx/kube-webhook-certgen + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: v20230312-helm-chart-4.5.2-28-g66a760794 + digest: sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + pullPolicy: IfNotPresent + # -- Provide a priority class name to the webhook patching job + ## + priorityClassName: "" + podAnnotations: {} + nodeSelector: + kubernetes.io/os: linux + tolerations: [] + # -- Labels to be added to patch job resources + labels: {} + securityContext: + runAsNonRoot: true + runAsUser: 2000 + fsGroup: 2000 + # Use certmanager to generate webhook certs + certManager: + enabled: false + # self-signed root certificate + rootCert: + # default to be 5y + duration: "" + admissionCert: + # default to be 1y + duration: "" + # issuerRef: + # name: "issuer" + # kind: "ClusterIssuer" + metrics: + port: 10254 + portName: metrics + # if this port is changed, change healthz-port: in extraArgs: accordingly + enabled: false + service: + annotations: {} + # prometheus.io/scrape: "true" + # prometheus.io/port: "10254" + # -- Labels to be added to the metrics service resource + labels: {} + # clusterIP: "" - # -- List of IP addresses at which the controller services are available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer - loadBalancerIP: "" - loadBalancerSourceRanges: [] - enableHttp: true - enableHttps: true - ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. - ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer - # externalTrafficPolicy: "" - - ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". - ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - # sessionAffinity: "" - - ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, - ## the service controller allocates a port from your cluster’s NodePort range. - ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - # healthCheckNodePort: 0 - - # -- Represents the dual-stack-ness requested or required by this Service. Possible values are - # SingleStack, PreferDualStack or RequireDualStack. - # The ipFamilies and clusterIPs fields depend on the value of this field. - ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ - ipFamilyPolicy: "SingleStack" - # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically - # based on cluster configuration and the ipFamilyPolicy field. - ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ - ipFamilies: - - IPv4 - ports: - http: 80 - https: 443 - targetPorts: - http: http - https: https - type: LoadBalancer - ## type: NodePort - ## nodePorts: - ## http: 32080 - ## https: 32443 - ## tcp: - ## 8080: 32808 - nodePorts: - http: "" - https: "" - tcp: {} - udp: {} - external: - enabled: true - internal: - # -- Enables an additional internal load balancer (besides the external one). - enabled: false - # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. - annotations: {} - # loadBalancerIP: "" - - # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. - loadBalancerSourceRanges: [] - ## Set external traffic policy to: "Local" to preserve source IP on - ## providers supporting it - ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer - # externalTrafficPolicy: "" - # shareProcessNamespace enables process namespace sharing within the pod. - # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. - shareProcessNamespace: false - # -- Additional containers to be added to the controller pod. - # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. - extraContainers: [] - # - name: my-sidecar - # image: nginx:latest - # - name: lemonldap-ng-controller - # image: lemonldapng/lemonldap-ng-controller:0.2.0 - # args: - # - /lemonldap-ng-controller - # - --alsologtostderr - # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration - # env: - # - name: POD_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.name - # - name: POD_NAMESPACE - # valueFrom: - # fieldRef: - # fieldPath: metadata.namespace - # volumeMounts: - # - name: copy-portal-skins - # mountPath: /srv/var/lib/lemonldap-ng/portal/skins - - # -- Additional volumeMounts to the controller main container. - extraVolumeMounts: [] - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - # -- Additional volumes to the controller pod. - extraVolumes: [] - # - name: copy-portal-skins - # emptyDir: {} - - # -- Containers, which are run before the app containers are started. - extraInitContainers: [] - # - name: init-myservice - # image: busybox - # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] - - # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module - extraModules: [] - # - name: mytestmodule - # image: registry.k8s.io/ingress-nginx/mytestmodule - # containerSecurityContext: - # allowPrivilegeEscalation: false - # - # The image must contain a `/usr/local/bin/init_module.sh` executable, which - # will be executed as initContainers, to move its config files within the - # mounted volume. - - opentelemetry: - enabled: false - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f - containerSecurityContext: - allowPrivilegeEscalation: false - admissionWebhooks: - annotations: {} - # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". - - ## Additional annotations to the admission webhooks. - ## These annotations will be added to the ValidatingWebhookConfiguration and - ## the Jobs Spec of the admission webhooks. - enabled: true - # -- Additional environment variables to set - extraEnvs: [] - # extraEnvs: - # - name: FOO - # valueFrom: - # secretKeyRef: - # key: FOO - # name: secret-resource - # -- Admission Webhook failure policy to use - failurePolicy: Fail - # timeoutSeconds: 10 - port: 8443 - certificate: "/usr/local/certificates/cert" - key: "/usr/local/certificates/key" - namespaceSelector: {} - objectSelector: {} - # -- Labels to be added to admission webhooks - labels: {} - # -- Use an existing PSP instead of creating one - existingPsp: "" - networkPolicyEnabled: false - service: - annotations: {} - # clusterIP: "" - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 443 - type: ClusterIP - createSecretJob: - securityContext: - allowPrivilegeEscalation: false - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - patchWebhookJob: - securityContext: - allowPrivilegeEscalation: false - resources: {} - patch: - enabled: true - image: - registry: registry.k8s.io - image: ingress-nginx/kube-webhook-certgen - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: v20230312-helm-chart-4.5.2-28-g66a760794 - digest: sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f - pullPolicy: IfNotPresent - # -- Provide a priority class name to the webhook patching job - ## - priorityClassName: "" - podAnnotations: {} - nodeSelector: - kubernetes.io/os: linux - tolerations: [] - # -- Labels to be added to patch job resources - labels: {} - securityContext: - runAsNonRoot: true - runAsUser: 2000 - fsGroup: 2000 - # Use certmanager to generate webhook certs - certManager: - enabled: false - # self-signed root certificate - rootCert: - # default to be 5y - duration: "" - admissionCert: - # default to be 1y - duration: "" - # issuerRef: - # name: "issuer" - # kind: "ClusterIssuer" - metrics: - port: 10254 - portName: metrics - # if this port is changed, change healthz-port: in extraArgs: accordingly - enabled: false - service: - annotations: {} - # prometheus.io/scrape: "true" - # prometheus.io/port: "10254" - # -- Labels to be added to the metrics service resource - labels: {} - # clusterIP: "" - - # -- List of IP addresses at which the stats-exporter service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 10254 - type: ClusterIP - # externalTrafficPolicy: "" - # nodePort: "" - serviceMonitor: - enabled: false - additionalLabels: {} - ## The label to use to retrieve the job name from. - ## jobLabel: "app.kubernetes.io/name" - namespace: "" - namespaceSelector: {} - ## Default: scrape .Release.Namespace only - ## To scrape all, use the following: - ## namespaceSelector: - ## any: true - scrapeInterval: 30s - # honorLabels: true - targetLabels: [] - relabelings: [] - metricRelabelings: [] - prometheusRule: - enabled: false - additionalLabels: {} - # namespace: "" - rules: [] - # # These are just examples rules, please adapt them to your needs - # - alert: NGINXConfigFailed - # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: bad ingress config - nginx config test failed - # summary: uninstall the latest ingress changes to allow config reloads to resume - # - alert: NGINXCertificateExpiry - # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 - # for: 1s - # labels: - # severity: critical - # annotations: - # description: ssl certificate(s) will expire in less then a week - # summary: renew expiring certificates to avoid downtime - # - alert: NGINXTooMany500s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 5XXs - # summary: More than 5% of all requests returned 5XX, this requires your attention - # - alert: NGINXTooMany400s - # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 - # for: 1m - # labels: - # severity: warning - # annotations: - # description: Too many 4XXs - # summary: More than 5% of all requests returned 4XX, this requires your attention - # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: - # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds - # to 300, allowing the draining of connections up to five minutes. - # If the active connections end before that, the pod will terminate gracefully at that time. - # To effectively take advantage of this feature, the Configmap feature - # worker-shutdown-timeout new value is 240s instead of 10s. - ## - lifecycle: - preStop: - exec: - command: - - /wait-shutdown - priorityClassName: "" + # -- List of IP addresses at which the stats-exporter service is available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 10254 + type: ClusterIP + # externalTrafficPolicy: "" + # nodePort: "" + serviceMonitor: + enabled: false + additionalLabels: {} + ## The label to use to retrieve the job name from. + ## jobLabel: "app.kubernetes.io/name" + namespace: "" + namespaceSelector: {} + ## Default: scrape .Release.Namespace only + ## To scrape all, use the following: + ## namespaceSelector: + ## any: true + scrapeInterval: 30s + # honorLabels: true + targetLabels: [] + relabelings: [] + metricRelabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + # namespace: "" + rules: [] + # # These are just examples rules, please adapt them to your needs + # - alert: NGINXConfigFailed + # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: bad ingress config - nginx config test failed + # summary: uninstall the latest ingress changes to allow config reloads to resume + # - alert: NGINXCertificateExpiry + # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: ssl certificate(s) will expire in less then a week + # summary: renew expiring certificates to avoid downtime + # - alert: NGINXTooMany500s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 5XXs + # summary: More than 5% of all requests returned 5XX, this requires your attention + # - alert: NGINXTooMany400s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 4XXs + # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: + # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds + # to 300, allowing the draining of connections up to five minutes. + # If the active connections end before that, the pod will terminate gracefully at that time. + # To effectively take advantage of this feature, the Configmap feature + # worker-shutdown-timeout new value is 240s instead of 10s. + ## + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + priorityClassName: "" # -- Rollback limit ## revisionHistoryLimit: 10 ## Default 404 backend ## defaultBackend: - ## - enabled: false - name: defaultbackend - image: - registry: registry.k8s.io - image: defaultbackend-amd64 - ## for backwards compatibility consider setting the full image url via the repository value below - ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail - ## repository: - tag: "1.5" - pullPolicy: IfNotPresent - # nobody user -> uid 65534 - runAsUser: 65534 - runAsNonRoot: true - readOnlyRootFilesystem: true - allowPrivilegeEscalation: false - # -- Use an existing PSP instead of creating one - existingPsp: "" - extraArgs: {} - serviceAccount: - create: true - name: "" - automountServiceAccountToken: true - # -- Additional environment variables to set for defaultBackend pods - extraEnvs: [] - port: 8080 - ## Readiness and liveness probes for default backend - ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ - ## - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 30 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 5 - readinessProbe: - failureThreshold: 6 - initialDelaySeconds: 0 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 5 - # -- The update strategy to apply to the Deployment or DaemonSet - ## - updateStrategy: {} - # rollingUpdate: - # maxUnavailable: 1 - # type: RollingUpdate - - # -- `minReadySeconds` to avoid killing pods before we are ready - ## - minReadySeconds: 0 - # -- Node tolerations for server scheduling to nodes with taints - ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - ## - tolerations: [] - # - key: "key" - # operator: "Equal|Exists" - # value: "value" - # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" - - affinity: {} - # -- Security Context policies for controller pods - # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for - # notes on enabling and using sysctls - ## - podSecurityContext: {} - # -- Security Context policies for controller main container. - # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for - # notes on enabling and using sysctls - ## - containerSecurityContext: {} - # -- Labels to add to the pod container metadata - podLabels: {} - # key: value - - # -- Node labels for default backend pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: - kubernetes.io/os: linux - # -- Annotations to be added to default backend pods - ## - podAnnotations: {} - replicaCount: 1 - minAvailable: 1 - resources: {} - # limits: - # cpu: 10m - # memory: 20Mi - # requests: - # cpu: 10m - # memory: 20Mi - - extraVolumeMounts: [] - ## Additional volumeMounts to the default backend container. - # - name: copy-portal-skins - # mountPath: /var/lib/lemonldap-ng/portal/skins - - extraVolumes: [] - ## Additional volumes to the default backend pod. - # - name: copy-portal-skins - # emptyDir: {} - - autoscaling: - apiVersion: autoscaling/v2 - annotations: {} - enabled: false - minReplicas: 1 - maxReplicas: 2 - targetCPUUtilizationPercentage: 50 - targetMemoryUtilizationPercentage: 50 - service: - annotations: {} - # clusterIP: "" - - # -- List of IP addresses at which the default backend service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # loadBalancerIP: "" - loadBalancerSourceRanges: [] - servicePort: 80 - type: ClusterIP - priorityClassName: "" - # -- Labels to be added to the default backend resources - labels: {} -## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 -rbac: - create: true - scope: false -## If true, create & use Pod Security Policy resources -## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -podSecurityPolicy: - enabled: false -serviceAccount: + ## + enabled: false + name: defaultbackend + image: + registry: registry.k8s.io + image: defaultbackend-amd64 + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: "1.5" + pullPolicy: IfNotPresent + # nobody user -> uid 65534 + runAsUser: 65534 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + # -- Use an existing PSP instead of creating one + existingPsp: "" + extraArgs: {} + serviceAccount: create: true name: "" automountServiceAccountToken: true - # -- Annotations for the controller service account + # -- Additional environment variables to set for defaultBackend pods + extraEnvs: [] + port: 8080 + ## Readiness and liveness probes for default backend + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ + ## + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + affinity: {} + # -- Security Context policies for controller pods + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + podSecurityContext: {} + # -- Security Context policies for controller main container. + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + containerSecurityContext: {} + # -- Labels to add to the pod container metadata + podLabels: {} + # key: value + + # -- Node labels for default backend pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: + kubernetes.io/os: linux + # -- Annotations to be added to default backend pods + ## + podAnnotations: {} + replicaCount: 1 + minAvailable: 1 + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + + extraVolumeMounts: [] + ## Additional volumeMounts to the default backend container. + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + extraVolumes: [] + ## Additional volumes to the default backend pod. + # - name: copy-portal-skins + # emptyDir: {} + + autoscaling: + apiVersion: autoscaling/v2 annotations: {} + enabled: false + minReplicas: 1 + maxReplicas: 2 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + service: + annotations: {} + # clusterIP: "" + + # -- List of IP addresses at which the default backend service is available + ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 80 + type: ClusterIP + priorityClassName: "" + # -- Labels to be added to the default backend resources + labels: {} +## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 +rbac: + create: true + scope: false +## If true, create & use Pod Security Policy resources +## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +podSecurityPolicy: + enabled: false +serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Annotations for the controller service account + annotations: {} # -- Optional array of imagePullSecrets containing private registry credentials ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ imagePullSecrets: [] diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index bf4ffce19..c1d595c3a 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,6 +417,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -440,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -512,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -523,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -559,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -570,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -608,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -621,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index 0b58831a3..ed6275a0b 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -426,6 +426,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -449,7 +451,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +526,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +537,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +573,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +584,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +635,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index d141e8ca6..595088a0c 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -412,6 +412,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -434,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -506,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -517,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -553,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -564,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -602,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -615,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 97c22739b..0540ff1cb 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -413,6 +413,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -436,7 +438,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -508,7 +510,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -519,7 +521,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -555,7 +557,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -566,7 +568,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -604,7 +606,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -617,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index 5b7c86670..ae6ae1f8f 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -416,6 +416,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -439,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -511,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -522,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -558,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -569,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -607,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -620,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index c8236ef20..a387fa928 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -422,6 +422,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -445,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -517,7 +519,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -528,7 +530,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -564,7 +566,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -575,7 +577,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -613,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -626,7 +628,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index a8fd055c9..a77a08ae9 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -416,6 +416,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -440,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -522,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -533,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -569,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -580,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -618,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -631,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index 1f04b9b9e..ab9142ce2 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -416,6 +416,8 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.7.0 spec: containers: - args: @@ -439,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.6.4@sha256:15be4666c53052484dd2992efacf2f50ea77a78ae8aa21ccd91af6baaa7ea22f + image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -511,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -522,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-create spec: containers: @@ -558,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -569,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission-patch spec: containers: @@ -607,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: nginx spec: controller: k8s.io/ingress-nginx @@ -620,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.6.4 + app.kubernetes.io/version: 1.7.0 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 9f66e3991..22a76dc7a 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -7,34 +7,19 @@ Do not try to edit it manually. -### [[Serial] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L35) +### [[Admission] admission controller](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L35) -- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L48) -- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L75) -- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L92) -- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L113) -- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L130) -- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L141) -- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L155) -- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L169) -- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L185) -- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L201) -- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L212) - -### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) - -- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) -- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) -- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) -- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) -- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) -- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) -- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) -- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) -- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) -- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) -- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) -- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) +- [reject ingress with global-rate-limit annotations when memcached is not configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L43) +- [should not allow overlaps of host and paths without canary annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L70) +- [should allow overlaps of host and paths with canary annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L87) +- [should block ingress with invalid path](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L108) +- [should return an error if there is an error validating the ingress definition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L125) +- [should return an error if there is an invalid value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L136) +- [should return an error if there is a forbidden value in some annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L150) +- [should not return an error if the Ingress V1 definition is valid with Ingress Class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L164) +- [should not return an error if the Ingress V1 definition is valid with IngressClass annotation](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L180) +- [should return an error if the Ingress V1 definition contains invalid annotations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L196) +- [should not return an error for an invalid Ingress when it has unknown class](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/admission/admission.go#L207) ### [affinitymode](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinitymode.go#L31) @@ -71,33 +56,6 @@ Do not try to edit it manually. - [should set backend protocol to '' and use fastcgi_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L94) - [should set backend protocol to '' and use ajp_pass](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/backendprotocol.go#L109) -### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) - -- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) -- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) -- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) -- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) -- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) -- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) -- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) -- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) -- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) -- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) -- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) -- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) -- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) -- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) -- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L836) -- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L864) -- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L888) -- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L916) -- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L973) -- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1031) - ### [client-body-buffer-size](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L28) - [should set client_body_buffer_size to 1000](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/clientbodybuffersize.go#L35) @@ -151,13 +109,6 @@ Do not try to edit it manually. - [disable-http-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L53) - [disable-stream-access-log set access_log off](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/disableaccesslog.go#L71) -### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L31) - -- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L38) -- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L55) -- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L72) -- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L105) - ### [force-ssl-redirect](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L27) - [should redirect to https](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/forcesslredirect.go#L34) @@ -209,6 +160,21 @@ Do not try to edit it manually. - [should set mirror-target to https://test.env.com/$request_uri](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L51) - [should disable mirror-request-body](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/mirror.go#L67) +### [modsecurity owasp](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L28) + +- [should enable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L35) +- [should enable modsecurity with transaction ID and OWASP rules](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L53) +- [should disable modsecurity](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L74) +- [should enable modsecurity with snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L91) +- [should enable modsecurity without using 'modsecurity on;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L110) +- [should disable modsecurity using 'modsecurity off;'](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L132) +- [should enable modsecurity with snippet and block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L153) +- [should enable modsecurity globally and with modsecurity-snippet block requests](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L189) +- [should enable modsecurity when enable-owasp-modsecurity-crs is set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L225) +- [should enable modsecurity through the config map](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L264) +- [should enable modsecurity through the config map but ignore snippet as disabled by admin](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L305) +- [should disable default modsecurity conf setting when modsecurity-snippet is specified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/modsecurity/modsecurity.go#L347) + ### [preserve-trailing-slash](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L27) - [should allow preservation of trailing slashes](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/preservetrailingslash.go#L34) @@ -285,6 +251,11 @@ Do not try to edit it manually. - [should set the X-Forwarded-Prefix to the annotation value](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L35) - [should not add X-Forwarded-Prefix if the annotation value is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/xforwardedprefix.go#L57) +### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) + +- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) +- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) + ### [affinity session-cookie-name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L35) - [should set sticky cookie SERVERID](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/affinity.go#L42) @@ -311,6 +282,13 @@ Do not try to edit it manually. - [should fail to use longest match for documented warning](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L158) - [should allow for custom rewrite parameters](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/rewrite.go#L190) +### [backend-protocol - FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L30) + +- [should use fastcgi_pass in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L37) +- [should add fastcgi_index in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L54) +- [should add fastcgi_param in the configuration file](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L71) +- [should return OK for service with backend protocol FastCGI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/fastcgi.go#L102) + ### [auth-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L39) - [should return status code 200 when no authentication is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L46) @@ -347,10 +325,33 @@ Do not try to edit it manually. - [should return 503 (location was denied)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L879) - [should add error to the config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/auth.go#L887) -### [denylist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L28) +### [canary-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L36) -- [only deny explicitly denied IPs, allow all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L35) -- [only allow explicitly allowed IPs, deny all others](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipdenylist.go#L86) +- [should response with a 200 status from the mainline upstream when requests are made to the mainline ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L48) +- [should return 404 status for requests to the canary if no matching ingress is found](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L80) +- [should return the correct status codes when endpoints are unavailable](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L107) +- [should route requests to the correct upstream if mainline ingress is created before the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L161) +- [should route requests to the correct upstream if mainline ingress is created after the canary ingress](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L206) +- [should route requests to the correct upstream if the mainline ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L250) +- [should route requests to the correct upstream if the canary ingress is modified](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L307) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L372) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L426) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L490) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L532) +- [should routes to mainline upstream when the given Regex causes error](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L566) +- [should route requests to the correct upstream](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L604) +- [respects always and never values](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L643) +- [should route requests only to mainline if canary weight is 0](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L705) +- [should route requests only to canary if canary weight is 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L743) +- [should route requests only to canary if canary weight is equal to canary weight total](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L775) +- [should route requests split between mainline and canary if canary weight is 50](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L808) +- [should route requests split between mainline and canary if canary weight is 100 and weight total is 200](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L834) +- [should not use canary as a catch-all server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L863) +- [should not use canary with domain as a server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L891) +- [does not crash when canary ingress has multiple paths to the same non-matching backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L915) +- [always routes traffic to canary if first request was affinitized to canary (default behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L943) +- [always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1000) +- [routes traffic to either mainline or canary backend (legacy behavior)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/canary.go#L1058) ### [Debug CLI](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/dbg/main.go#L29) @@ -376,30 +377,21 @@ Do not try to edit it manually. - [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) +- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) +### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L35) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) - -### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L190) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L206) -- [ [MemoryLeak]](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L207) +- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L43) ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/grpc_fortune_teller.go#L) @@ -445,14 +437,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/httpexpect/request.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/logs.go#L) @@ -465,13 +449,41 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/test_context.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) + +### [[Setting] ](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L194) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/framework.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/metrics.go#L) + ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/deployment.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/util.go#L) +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/exec.go#L) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/fastcgi_helloserver.go#L) ### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/gracefulshutdown/grace_period.go#L32) @@ -546,6 +558,12 @@ Do not try to edit it manually. - [handles endpoints only changes consistently (down scaling of replicas vs. empty service)](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L125) - [handles an annotation change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/lua/dynamic_configuration.go#L171) +### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) + +- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) +- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) +- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) + ### [[Security] request smuggling](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L32) - [should not return body content from error_page](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/security/request_smuggling.go#L39) @@ -570,14 +588,6 @@ Do not try to edit it manually. - [should return 404 when backend service is nil](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/servicebackend/service_nil_backend.go#L38) -### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) - -- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) - -### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) - -- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) - ### [access-log](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L27) - [use the default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/access_log.go#L32) @@ -597,10 +607,6 @@ Do not try to edit it manually. - [ condition](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/brotli.go#L39) -### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) - -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) - ### [add-headers](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L30) - [Add a custom header](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/custom_header.go#L40) @@ -730,26 +736,24 @@ Do not try to edit it manually. - [should add value of main-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/main_snippet.go#L31) +### [[Security] modsecurity-snippet](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L27) + +- [should add value of modsecurity-snippet setting to nginx config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/modsecurity/modsecurity_snippet.go#L30) + ### [enable-multi-accept](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L27) - [should be enabled by default](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L31) - [should be enabled when set to true](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L39) - [should be disabled when set to false](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/multi_accept.go#L49) -### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) - -- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L70) - -### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) - -- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) -- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) -- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) - ### [Add no tls redirect locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L28) - [Check no tls redirect locations config](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_tls_redirect_locations.go#L31) +### [OCSP](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L42) + +- [should enable OCSP and contain stapling information in the connection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ocsp/ocsp.go#L49) + ### [Configure OpenTracing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L48) - [should not exists opentracing directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentracing.go#L58) @@ -858,11 +862,33 @@ Do not try to edit it manually. - [should set gzip_min_length to 100](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L78) - [should set gzip_types to application/javascript](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/gzip.go#L89) +### [Configmap change](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L29) + +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/configmap_change.go#L36) + +### [[Flag] watch namespace selector](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L30) + +- [should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/namespace_selector.go#L63) + ### [With enable-ssl-passthrough enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L36) - [should enable ssl-passthrough-proxy-port on a different port](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L56) - [should pass unknown traffic to default backend and handle known traffic](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/ssl_passthrough.go#L79) +### [[Security] no-auth-locations](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L33) + +- [should return status code 401 when accessing '/' unauthentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L54) +- [should return status code 200 when accessing '/' authentication](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L68) +- [should return status code 200 when accessing '/noauth' unauthenticated](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/no_auth_locations.go#L82) + +### [Configure Opentelemetry](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L37) + +- [should not exists opentelemetry directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L47) +- [should exists opentelemetry directive when is enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L60) +- [should include opentelemetry_trust_incoming_spans on directive when enabled](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L74) +- [should not exists opentelemetry_operation_name directive when is empty](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L89) +- [should exists opentelemetry_operation_name directive when is configured](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/settings/opentelemetry.go#L104) + ### [[SSL] redirect to HTTPS](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L29) - [should redirect from HTTP to HTTPS when secret is missing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/ssl/http_redirect.go#L36) @@ -876,25 +902,8 @@ Do not try to edit it manually. - [should update status field after client-go reconnection](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/status/update.go#L43) -### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L37) +### [[TCP] tcp-services](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L38) -- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L40) -- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L98) - -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -### [[Endpointslices] long service name](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L29) - -- [should return 200 when service name has max allowed number of characters 63](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/longname.go#L38) - -### [[TopologyHints] topology aware routing](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L36) - -- [should return 200 when service has topology hints](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/endpointslices/topology.go#L50) - -### [nginx-configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L99) - -- [start nginx with default configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L102) -- [fails when using alias directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L115) -- [fails when using root directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/nginx/nginx.go#L124) \ No newline at end of file +- [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) +- [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file diff --git a/docs/user-guide/exposing-tcp-udp-services.md b/docs/user-guide/exposing-tcp-udp-services.md index 6b595ffae..63293f0e5 100644 --- a/docs/user-guide/exposing-tcp-udp-services.md +++ b/docs/user-guide/exposing-tcp-udp-services.md @@ -63,3 +63,9 @@ spec: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx ``` +Then, the configmap should be added into ingress controller's deployment args. +``` + args: + - /nginx-ingress-controller + - --tcp-services-configmap=ingress-nginx/tcp-services +``` diff --git a/magefiles/release.go b/magefiles/release.go index 3c715bc07..aeaafc3d2 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -50,7 +50,7 @@ var INGRESS_REGISTRY = "registry.k8s.io" //Co var KUSTOMIZE_INSTALL_VERSION = "sigs.k8s.io/kustomize/kustomize/v4@v4.5.4" //static deploys needs kustomize to generate the template // ingress-nginx releases start with a TAG then a cloudbuild, then a promotion through a PR, this the location of that PR -var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml" +var IMAGES_YAML = "https://raw.githubusercontent.com/kubernetes/k8s.io/main/registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml" var ctx = context.Background() // Context used for GitHub Client const INDEX_DOCS = "docs/deploy/index.md" //index.md has a version of the controller and needs to updated From 81cf94ea482c364e306ca27e4219ac61c0eca56b Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 24 Mar 2023 13:27:00 -0400 Subject: [PATCH 107/822] release 1.7.0 chart 4.6.0 Signed-off-by: James Strong --- charts/ingress-nginx/Chart.yaml | 4 ++-- charts/ingress-nginx/README.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index 130fe06fd..bad5e2a8c 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -15,7 +15,7 @@ annotations: - "Fix incorrect annotation name in upstream hashing configuration (#9617)" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 4.6.0 +appVersion: 1.7.0 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -32,4 +32,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.5.4 +version: 4.6.0 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index dcd5af57e..cb3848634 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.5.4](https://img.shields.io/badge/Version-4.5.4-informational?style=flat-square) ![AppVersion: 4.6.0](https://img.shields.io/badge/AppVersion-4.6.0-informational?style=flat-square) +![Version: 4.6.0](https://img.shields.io/badge/Version-4.6.0-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. From c84ae78bdfabb1f93bf0e87cdff34c75c744b8df Mon Sep 17 00:00:00 2001 From: Mohammad Yasir <74600745+Yasir761@users.noreply.github.com> Date: Mon, 27 Mar 2023 19:44:30 +0530 Subject: [PATCH 108/822] The Ingress-Nginx project recently released version 1.7.0 of the controller, but the deployment documentation still referenced version 1.6.4. This commit updates the documentation to reference the latest version, ensuring that users have access to the most up-to-date information. Fixes#9787 (#9788) --- docs/deploy/index.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/deploy/index.md b/docs/deploy/index.md index 49340e2f5..f6ba17a09 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml ``` A @@ -357,7 +357,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.4/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), From e4a11295abc4bfd72990ebf7d7b25b6ecfe17cca Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Thu, 30 Mar 2023 11:48:58 -0500 Subject: [PATCH 109/822] file parsing for Cgroup2 --- pkg/util/runtime/cpu_linux.go | 52 +++++++++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 2 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index cfc49d924..a69a4432c 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -43,8 +43,16 @@ func NumCPU() int { return cpus } - cpuQuota := readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") - cpuPeriod := readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") + cgroupVersion := getCgroupVersion(); + cpuQuota := -1; + cpuPeriod := -1; + + if cgroupVersion == 1 { + cpuQuota := readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") + cpuPeriod := readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") + } else if cgroupVersion == 2 { + cpuQuota, cpuPeriod := readCgroup2FileToInt64Tuple(cgroupPath, "cpu.max") + } if cpuQuota == -1 || cpuPeriod == -1 { return cpus @@ -53,6 +61,46 @@ func NumCPU() int { return int(math.Ceil(float64(cpuQuota) / float64(cpuPeriod))) } +func getCgroupVersion() int64 { + // TODO: detect version + return 2; +} + +func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { + contents, err := os.ReadFile(filepath.Join(cgroupPath, cgroupFile)) + + if err != nil { + return -1, -1; + } + + // file contents looks like: $MAX $PERIOD + // $MAX can have value "max" indicating no limit + + values := strings.Fields(string(contents)); + + if values[0] == "max" { + return -1, -1; + } + + cpuQuota, err := strconv.ParseInt(values[0], 10, 64); + + if err != nil { + return -1, -1; + } + + if len(values) == 1 { + return cpuQuota, 1; + } + + cpuPeriod, err := strconv.ParseInt(values[1], 10, 64); + + if err != nil { + return -1, -1; + } + + return cpuQuota, cpuPeriod; +} + func readCgroupFileToInt64(cgroupPath, cgroupFile string) int64 { contents, err := os.ReadFile(filepath.Join(cgroupPath, cgroupFile)) if err != nil { From 221e85f6f2e11455cdeeb5b2d4cfd93b51b575c1 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Fri, 31 Mar 2023 00:36:12 -0500 Subject: [PATCH 110/822] added version detecting --- pkg/util/runtime/cpu_linux.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index a69a4432c..431691a7e 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -62,8 +62,12 @@ func NumCPU() int { } func getCgroupVersion() int64 { - // TODO: detect version - return 2; + // /sys/fs/cgroup/cgroup.controllers will not exist with cgroupsv1 + if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); err == nil { + return 2; + } else { + return 1; + } } func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { @@ -75,6 +79,7 @@ func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { // file contents looks like: $MAX $PERIOD // $MAX can have value "max" indicating no limit + // it is possible for $PERIOD to be unset values := strings.Fields(string(contents)); From 3ae35a045dc0d103c6d6511ffa516ebddb11ac14 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Fri, 31 Mar 2023 00:52:14 -0500 Subject: [PATCH 111/822] ran gofmt --- pkg/util/runtime/cpu_linux.go | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index 431691a7e..7f46a6dd1 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -43,16 +43,16 @@ func NumCPU() int { return cpus } - cgroupVersion := getCgroupVersion(); - cpuQuota := -1; - cpuPeriod := -1; + cgroupVersion := getCgroupVersion() + cpuQuota := -1 + cpuPeriod := -1 - if cgroupVersion == 1 { + if cgroupVersion == 1 { cpuQuota := readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") cpuPeriod := readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") } else if cgroupVersion == 2 { cpuQuota, cpuPeriod := readCgroup2FileToInt64Tuple(cgroupPath, "cpu.max") - } + } if cpuQuota == -1 || cpuPeriod == -1 { return cpus @@ -64,9 +64,9 @@ func NumCPU() int { func getCgroupVersion() int64 { // /sys/fs/cgroup/cgroup.controllers will not exist with cgroupsv1 if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); err == nil { - return 2; + return 2 } else { - return 1; + return 1 } } @@ -74,36 +74,36 @@ func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { contents, err := os.ReadFile(filepath.Join(cgroupPath, cgroupFile)) if err != nil { - return -1, -1; + return -1, -1 } // file contents looks like: $MAX $PERIOD // $MAX can have value "max" indicating no limit // it is possible for $PERIOD to be unset - values := strings.Fields(string(contents)); + values := strings.Fields(string(contents)) if values[0] == "max" { - return -1, -1; + return -1, -1 } - cpuQuota, err := strconv.ParseInt(values[0], 10, 64); + cpuQuota, err := strconv.ParseInt(values[0], 10, 64) - if err != nil { - return -1, -1; + if err != nil { + return -1, -1 } if len(values) == 1 { - return cpuQuota, 1; + return cpuQuota, 1 } - cpuPeriod, err := strconv.ParseInt(values[1], 10, 64); + cpuPeriod, err := strconv.ParseInt(values[1], 10, 64) if err != nil { - return -1, -1; + return -1, -1 } - return cpuQuota, cpuPeriod; + return cpuQuota, cpuPeriod } func readCgroupFileToInt64(cgroupPath, cgroupFile string) int64 { From 7f6472617bf086712d995418e2e4df98e2ee4682 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Fri, 31 Mar 2023 00:53:34 -0500 Subject: [PATCH 112/822] declarations to assignments --- pkg/util/runtime/cpu_linux.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index 7f46a6dd1..d6ea87ad6 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -48,10 +48,10 @@ func NumCPU() int { cpuPeriod := -1 if cgroupVersion == 1 { - cpuQuota := readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") - cpuPeriod := readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") + cpuQuota = readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") + cpuPeriod = readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") } else if cgroupVersion == 2 { - cpuQuota, cpuPeriod := readCgroup2FileToInt64Tuple(cgroupPath, "cpu.max") + cpuQuota, cpuPeriod = readCgroup2FileToInt64Tuple(cgroupPath, "cpu.max") } if cpuQuota == -1 || cpuPeriod == -1 { From a080ea1f29bf1b48b5cfe8cdda2f0278c185f487 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Fri, 31 Mar 2023 00:58:43 -0500 Subject: [PATCH 113/822] correct types --- pkg/util/runtime/cpu_linux.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index d6ea87ad6..5228c93a2 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -44,8 +44,8 @@ func NumCPU() int { } cgroupVersion := getCgroupVersion() - cpuQuota := -1 - cpuPeriod := -1 + cpuQuota := int64(-1) + cpuPeriod := int64(-1) if cgroupVersion == 1 { cpuQuota = readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") From ddde3b0d607744b7b3cee968be539bc901782164 Mon Sep 17 00:00:00 2001 From: sarab Date: Sun, 2 Apr 2023 03:03:12 +0530 Subject: [PATCH 114/822] Switched from N1 to E2 machine --- images/ext-auth-example-authsvc/cloudbuild.yaml | 2 +- images/go-grpc-greeter-server/cloudbuild.yaml | 2 +- images/httpbin/cloudbuild.yaml | 2 +- images/nginx/cloudbuild.yaml | 2 +- images/opentelemetry/cloudbuild.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/images/ext-auth-example-authsvc/cloudbuild.yaml b/images/ext-auth-example-authsvc/cloudbuild.yaml index fbd5d7b63..d77c9fc19 100644 --- a/images/ext-auth-example-authsvc/cloudbuild.yaml +++ b/images/ext-auth-example-authsvc/cloudbuild.yaml @@ -2,7 +2,7 @@ timeout: 1200s options: substitution_option: ALLOW_LOOSE # job builds a multi-arch docker image for amd64,arm,arm64 and s390x. - machineType: N1_HIGHCPU_8 + machineType: E2_HIGHCPU_8 steps: - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 entrypoint: bash diff --git a/images/go-grpc-greeter-server/cloudbuild.yaml b/images/go-grpc-greeter-server/cloudbuild.yaml index f4d6cc6d4..834c0cb85 100644 --- a/images/go-grpc-greeter-server/cloudbuild.yaml +++ b/images/go-grpc-greeter-server/cloudbuild.yaml @@ -2,7 +2,7 @@ timeout: 1200s options: substitution_option: ALLOW_LOOSE # job builds a multi-arch docker image for amd64,arm,arm64 and s390x. - machineType: N1_HIGHCPU_8 + machineType: E2_HIGHCPU_8 steps: - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 entrypoint: bash diff --git a/images/httpbin/cloudbuild.yaml b/images/httpbin/cloudbuild.yaml index 03f269b6e..9f2658b7b 100644 --- a/images/httpbin/cloudbuild.yaml +++ b/images/httpbin/cloudbuild.yaml @@ -2,7 +2,7 @@ timeout: 1200s options: substitution_option: ALLOW_LOOSE # job builds a multi-arch docker image for amd64,arm,arm64 and s390x. - machineType: N1_HIGHCPU_8 + machineType: E2_HIGHCPU_8 steps: - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 entrypoint: bash diff --git a/images/nginx/cloudbuild.yaml b/images/nginx/cloudbuild.yaml index fb9a51225..b3d7b1507 100644 --- a/images/nginx/cloudbuild.yaml +++ b/images/nginx/cloudbuild.yaml @@ -2,7 +2,7 @@ timeout: 10800s options: substitution_option: ALLOW_LOOSE # job builds a multi-arch docker image for amd64,arm,arm64 and s390x. - machineType: N1_HIGHCPU_32 + machineType: E2_HIGHCPU_32 steps: - name: 'gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90' entrypoint: bash diff --git a/images/opentelemetry/cloudbuild.yaml b/images/opentelemetry/cloudbuild.yaml index e2aa5a2b2..0096c0f44 100644 --- a/images/opentelemetry/cloudbuild.yaml +++ b/images/opentelemetry/cloudbuild.yaml @@ -2,7 +2,7 @@ timeout: 10800s options: substitution_option: ALLOW_LOOSE # job builds a multi-arch docker image for amd64,arm,arm64 and s390x. - machineType: N1_HIGHCPU_32 + machineType: E2_HIGHCPU_32 steps: - name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20211118-2f2d816b90 entrypoint: bash From 3b46b85451e2f1c70a873e02639f654dd43bbe7f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:41:54 -0700 Subject: [PATCH 115/822] Bump sigs.k8s.io/controller-runtime from 0.14.5 to 0.14.6 (#9822) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.14.5 to 0.14.6. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes-sigs/controller-runtime/compare/v0.14.5...v0.14.6) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f351bae17..f65660dd0 100644 --- a/go.mod +++ b/go.mod @@ -40,7 +40,7 @@ require ( k8s.io/component-base v0.26.3 k8s.io/klog/v2 v2.90.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 - sigs.k8s.io/controller-runtime v0.14.5 + sigs.k8s.io/controller-runtime v0.14.6 sigs.k8s.io/mdtoc v1.1.0 ) diff --git a/go.sum b/go.sum index 00918fc47..e7db50a63 100644 --- a/go.sum +++ b/go.sum @@ -771,8 +771,8 @@ pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732/go.mod h1:lpvCfhqEHNJSSpG5R rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= -sigs.k8s.io/controller-runtime v0.14.5 h1:6xaWFqzT5KuAQ9ufgUaj1G/+C4Y1GRkhrxl+BJ9i+5s= -sigs.k8s.io/controller-runtime v0.14.5/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= +sigs.k8s.io/controller-runtime v0.14.6 h1:oxstGVvXGNnMvY7TAESYk+lzr6S3V5VFxQ6d92KcwQA= +sigs.k8s.io/controller-runtime v0.14.6/go.mod h1:WqIdsAY6JBsjfc/CqO0CORmNtoCtE4S6qbPc9s68h+0= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k= sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= sigs.k8s.io/kustomize/api v0.12.1 h1:7YM7gW3kYBwtKvoY216ZzY+8hM+lV53LUayghNRJ0vM= From ff048d86b09b91ea3c4c85a556a09ac4a4714637 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:43:57 -0700 Subject: [PATCH 116/822] Bump google.golang.org/grpc from 1.53.0 to 1.54.0 (#9794) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.53.0 to 1.54.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.53.0...v1.54.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f65660dd0..383754428 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.7.0 - google.golang.org/grpc v1.53.0 + google.golang.org/grpc v1.54.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 diff --git a/go.sum b/go.sum index e7db50a63..e78672fa9 100644 --- a/go.sum +++ b/go.sum @@ -683,8 +683,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.53.0 h1:LAv2ds7cmFV/XTS3XG1NneeENYrXGmorPxsBbptIjNc= -google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw= +google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag= +google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 8249be4e29c2f781654665bb86057616737fa327 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:45:53 -0700 Subject: [PATCH 117/822] Bump github.com/imdario/mergo from 0.3.13 to 0.3.15 (#9795) Bumps [github.com/imdario/mergo](https://github.com/imdario/mergo) from 0.3.13 to 0.3.15. - [Release notes](https://github.com/imdario/mergo/releases) - [Commits](https://github.com/imdario/mergo/compare/v0.3.13...v0.3.15) --- updated-dependencies: - dependency-name: github.com/imdario/mergo dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 383754428..5331a7bbe 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a github.com/eapache/channels v1.1.0 github.com/fsnotify/fsnotify v1.6.0 - github.com/imdario/mergo v0.3.13 + github.com/imdario/mergo v0.3.15 github.com/json-iterator/go v1.1.12 github.com/kylelemons/godebug v1.1.0 github.com/mitchellh/go-ps v1.0.0 diff --git a/go.sum b/go.sum index e78672fa9..48d90af46 100644 --- a/go.sum +++ b/go.sum @@ -204,8 +204,8 @@ github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= -github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk= -github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg= +github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM= +github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc= github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= @@ -731,7 +731,6 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= From 0169ed5c873355c705557e2dc3e4aa664330844b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:47:54 -0700 Subject: [PATCH 118/822] Bump actions/setup-go from 3.5.0 to 4.0.0 (#9796) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3.5.0 to 4.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/6edd4406fa81c3da01a34fa6f6343087c207a568...4d34df0c2316fe8122ab82dc22947d607c0c91f9) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 12 ++++++------ .github/workflows/plugin.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c2c108638..83c9fcd18 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -86,7 +86,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true @@ -105,7 +105,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true @@ -124,7 +124,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true @@ -145,7 +145,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true @@ -211,7 +211,7 @@ jobs: uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 - name: Setup Go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true @@ -483,7 +483,7 @@ jobs: - name: Set up Go id: go if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: '1.20' check-latest: true diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 87ba6aca9..bc646da87 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -22,7 +22,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 + uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 with: go-version: 1.20 check-latest: true From 1684070ca915406c79f31a5afba96e66a0fd4eb6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:49:53 -0700 Subject: [PATCH 119/822] Bump rajatjindal/krew-release-bot from 0.0.43 to 0.0.46 (#9797) Bumps [rajatjindal/krew-release-bot](https://github.com/rajatjindal/krew-release-bot) from 0.0.43 to 0.0.46. - [Release notes](https://github.com/rajatjindal/krew-release-bot/releases) - [Changelog](https://github.com/rajatjindal/krew-release-bot/blob/main/.goreleaser.yml) - [Commits](https://github.com/rajatjindal/krew-release-bot/compare/92da038bbf995803124a8e50ebd438b2f37bbbb0...df3eb197549e3568be8b4767eec31c5e8e8e6ad8) --- updated-dependencies: - dependency-name: rajatjindal/krew-release-bot dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/plugin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index bc646da87..03a7a9bac 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -36,6 +36,6 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Update new version in krew-index - uses: rajatjindal/krew-release-bot@92da038bbf995803124a8e50ebd438b2f37bbbb0 # v0.0.43 + uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46 with: krew_template_file: cmd/plugin/krew.yaml From c40a13714bf6cd265171e8eaf03d66c745063f90 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:51:54 -0700 Subject: [PATCH 120/822] Bump actions/stale from 7.0.0 to 8.0.0 (#9799) Bumps [actions/stale](https://github.com/actions/stale) from 7.0.0 to 8.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/6f05e4244c9a0b2ed3401882b05d701dd0a7289b...1160a2240286f5da8ec72b1c0816ce2481aabf84) --- updated-dependencies: - dependency-name: actions/stale dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/stale.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 8a172d370..b038f522b 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - - uses: actions/stale@6f05e4244c9a0b2ed3401882b05d701dd0a7289b # v7.0.0 + - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8.0.0 with: stale-issue-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack." stale-pr-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack." From 0800f30dcb2dd791e8850948909ff22965915b0f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:53:53 -0700 Subject: [PATCH 121/822] Bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 (#9806) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.4 to 1.1.5. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.5/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.4...v1.1.5) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5331a7bbe..24c319bc7 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 github.com/onsi/ginkgo/v2 v2.9.0 - github.com/opencontainers/runc v1.1.4 + github.com/opencontainers/runc v1.1.5 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 diff --git a/go.sum b/go.sum index 48d90af46..8ee1dc453 100644 --- a/go.sum +++ b/go.sum @@ -294,8 +294,8 @@ github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxm github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754= -github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= -github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= +github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs= +github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI= From 5806b5800328c2b8f45808cc4fb32f4f4913c13d Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Tue, 4 Apr 2023 14:55:53 +0200 Subject: [PATCH 122/822] Values: Fix indention of commented values. (#9812) --- charts/ingress-nginx/values.yaml | 36 ++++++++++++++++---------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 6627bf220..c2e8cdcd7 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -375,26 +375,26 @@ controller: # annotations: # key: value triggers: [] - # - type: prometheus - # metadata: - # serverAddress: http://:9090 - # metricName: http_requests_total - # threshold: '100' - # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) behavior: {} - # scaleDown: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 1 - # periodSeconds: 180 - # scaleUp: - # stabilizationWindowSeconds: 300 - # policies: - # - type: Pods - # value: 2 - # periodSeconds: 60 + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 # -- Enable mimalloc as a drop-in replacement for malloc. ## ref: https://github.com/microsoft/mimalloc From 149374d9cd82eafab67019398c082563840f1f49 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 05:57:54 -0700 Subject: [PATCH 123/822] Bump ossf/scorecard-action from 2.1.2 to 2.1.3 (#9823) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.1.2 to 2.1.3. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/e38b1902ae4f44df626f11ba0734b14fb91f8f86...80e868c13c90f172d68d1f4501dee99e2479f7af) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecards.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 529cc7c28..608d10bcb 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 + uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3 with: results_file: results.sarif results_format: sarif From c76179c04e880b9ec16e6a4a2c47c1fc54e71cc7 Mon Sep 17 00:00:00 2001 From: viq Date: Tue, 4 Apr 2023 16:45:56 +0200 Subject: [PATCH 124/822] ISO 8601 date format (#9682) Adjust the tag to be in sortable format, compatible with ISO 8601. --- images/cfssl/Makefile | 2 +- images/custom-error-pages/Makefile | 2 +- images/fastcgi-helloserver/Makefile | 2 +- images/go-grpc-greeter-server/Makefile | 2 +- images/httpbin/Makefile | 2 +- images/kube-webhook-certgen/Makefile | 2 +- images/opentelemetry/Makefile | 2 +- images/test-runner/Makefile | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/images/cfssl/Makefile b/images/cfssl/Makefile index b1909abe3..1521d2c78 100644 --- a/images/cfssl/Makefile +++ b/images/cfssl/Makefile @@ -18,7 +18,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-cfssl diff --git a/images/custom-error-pages/Makefile b/images/custom-error-pages/Makefile index 7564b813d..b014beabe 100644 --- a/images/custom-error-pages/Makefile +++ b/images/custom-error-pages/Makefile @@ -20,7 +20,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/nginx-errors diff --git a/images/fastcgi-helloserver/Makefile b/images/fastcgi-helloserver/Makefile index c1b54703f..6c5a3647a 100644 --- a/images/fastcgi-helloserver/Makefile +++ b/images/fastcgi-helloserver/Makefile @@ -20,7 +20,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-fastcgi-helloserver diff --git a/images/go-grpc-greeter-server/Makefile b/images/go-grpc-greeter-server/Makefile index 523b83bfb..e6b6efae6 100644 --- a/images/go-grpc-greeter-server/Makefile +++ b/images/go-grpc-greeter-server/Makefile @@ -18,7 +18,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/go-grpc-greeter-server diff --git a/images/httpbin/Makefile b/images/httpbin/Makefile index ac363dfa8..5d92ffcb5 100644 --- a/images/httpbin/Makefile +++ b/images/httpbin/Makefile @@ -18,7 +18,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-httpbin diff --git a/images/kube-webhook-certgen/Makefile b/images/kube-webhook-certgen/Makefile index f1d3edc5b..1716bc07e 100644 --- a/images/kube-webhook-certgen/Makefile +++ b/images/kube-webhook-certgen/Makefile @@ -19,7 +19,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/kube-webhook-certgen diff --git a/images/opentelemetry/Makefile b/images/opentelemetry/Makefile index 20fb7ec63..695dcf632 100644 --- a/images/opentelemetry/Makefile +++ b/images/opentelemetry/Makefile @@ -21,7 +21,7 @@ DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh # 0.0.0 shouldn't clobber any released builds -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= gcr.io/k8s-staging-ingress-nginx IMAGE = $(REGISTRY)/opentelemetry diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index a8c3a4560..729f27415 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -18,7 +18,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-runner From 5d4827af0cfb6242ca69395f4d033f700510f557 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Apr 2023 08:05:54 -0700 Subject: [PATCH 125/822] Bump actions/checkout from 3.4.0 to 3.5.0 (#9798) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/24cb9080177205b6e8c946b17badbe402adc938f...8f4b7f84864484a7bf31766abe9204da3cbe65b3) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 22 +++++++++++----------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 83c9fcd18..b810a3aba 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -39,7 +39,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -65,7 +65,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Run Gosec Security Scanner uses: securego/gosec@a459eb0ba387d9bd083d5c2e2354dbeef2465038 # v2.15.0 @@ -82,7 +82,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Set up Go id: go @@ -101,7 +101,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Set up Go id: go @@ -120,7 +120,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Set up Go id: go @@ -141,7 +141,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Set up Go id: go @@ -208,7 +208,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Setup Go uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 @@ -288,7 +288,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -342,7 +342,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -391,7 +391,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -464,7 +464,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index 46a587ded..e18f71a20 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: 'Dependency Review' uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e # v3.0.4 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 3ab49ef10..5a0f6bb7b 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index 4e7fde34f..e3fa2d779 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index dd31420bf..4b7e000a5 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index 03a7a9bac..c56535223 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 608d10bcb..b0ce14f51 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index 9649140ec..aae43d03c 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0 + uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - shell: bash id: test From 522683813a200fb06342a035db49963b1e76aa26 Mon Sep 17 00:00:00 2001 From: Saumya <76432998+SaumyaBhushan@users.noreply.github.com> Date: Wed, 5 Apr 2023 17:35:41 +0530 Subject: [PATCH 126/822] updated NGINX_BASE image in project (#9829) --- NGINX_BASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NGINX_BASE b/NGINX_BASE index bf23fa5a7..5f1751bbf 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:66a760794f91809bcd897cbdb45435653d73fd92@sha256:86c1581e69dc92d107f8edd36724890ea682a3afda8c1fb1ba41aabc7bc0128d \ No newline at end of file +registry.k8s.io/ingress-nginx/nginx:91057c439cf07ffb62887b8a8bda66ce3cbe39ca@sha256:3b650123c755392f8c0eb9a356b12716327106e624ab5f5b43bc25ab130978fb \ No newline at end of file From 26d83d1b2058cc9c23657b4e97b9e5a6d5fe9871 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 6 Apr 2023 13:25:48 -0400 Subject: [PATCH 127/822] update all container tags with date and sha, upgrade all containers (#9834) Signed-off-by: James Strong --- .github/workflows/ci.yaml | 1 + hack/verify-chart-lint.sh | 2 +- images/cfssl/cloudbuild.yaml | 1 - images/cfssl/rootfs/Dockerfile | 5 +- images/custom-error-pages/cloudbuild.yaml | 1 - images/custom-error-pages/rootfs/Dockerfile | 4 +- images/echo/Makefile | 2 +- images/echo/cloudbuild.yaml | 1 - images/echo/rootfs/Dockerfile | 2 +- .../ext-auth-example-authsvc/cloudbuild.yaml | 1 - images/fastcgi-helloserver/cloudbuild.yaml | 1 - images/go-grpc-greeter-server/cloudbuild.yaml | 1 - images/httpbin/cloudbuild.yaml | 1 - images/httpbin/rootfs/Dockerfile | 2 +- images/kube-webhook-certgen/cloudbuild.yaml | 1 - images/nginx/Makefile | 2 +- images/nginx/cloudbuild.yaml | 1 - images/nginx/rootfs/Dockerfile | 2 +- images/opentelemetry/cloudbuild.yaml | 1 - images/test-runner/Makefile | 45 ++++++++--- images/test-runner/cloudbuild.yaml | 2 +- images/test-runner/rootfs/Dockerfile | 74 +++++++++---------- test/e2e-image/Dockerfile | 3 +- test/e2e-image/Makefile | 2 +- 24 files changed, 90 insertions(+), 68 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b810a3aba..6323c65be 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -22,6 +22,7 @@ on: required: false type: boolean + permissions: contents: read diff --git a/hack/verify-chart-lint.sh b/hack/verify-chart-lint.sh index 2d59dadce..9ece681e0 100755 --- a/hack/verify-chart-lint.sh +++ b/hack/verify-chart-lint.sh @@ -20,5 +20,5 @@ set -o pipefail KUBE_ROOT="$( cd "$(dirname "$0")../" >/dev/null 2>&1 ; pwd -P )" # TODO: This is a temporary workaround while we don't update Helm Chart test -curl https://raw.githubusercontent.com/helm/chart-testing/v3.7.0/etc/chart_schema.yaml -o /tmp/chart_schema.yaml +curl https://raw.githubusercontent.com/helm/chart-testing/v3.8.0/etc/chart_schema.yaml -o /tmp/chart_schema.yaml ct lint --charts ${KUBE_ROOT}/charts/ingress-nginx --validate-maintainers=false --chart-yaml-schema=/tmp/chart_schema.yaml diff --git a/images/cfssl/cloudbuild.yaml b/images/cfssl/cloudbuild.yaml index 5fb9e0c96..3f0abee99 100644 --- a/images/cfssl/cloudbuild.yaml +++ b/images/cfssl/cloudbuild.yaml @@ -6,7 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/cfssl/rootfs/Dockerfile b/images/cfssl/rootfs/Dockerfile index 7841e189c..a50c715ea 100644 --- a/images/cfssl/rootfs/Dockerfile +++ b/images/cfssl/rootfs/Dockerfile @@ -14,8 +14,11 @@ FROM alpine:3.17.2 + RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories -RUN apk add --no-cache \ +RUN apk update \ + && apk upgrade && \ + apk add --no-cache \ bash \ cfssl@testing diff --git a/images/custom-error-pages/cloudbuild.yaml b/images/custom-error-pages/cloudbuild.yaml index 8c96d289c..3490bd73b 100644 --- a/images/custom-error-pages/cloudbuild.yaml +++ b/images/custom-error-pages/cloudbuild.yaml @@ -6,7 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/custom-error-pages/rootfs/Dockerfile b/images/custom-error-pages/rootfs/Dockerfile index 942228eac..b34bb6977 100755 --- a/images/custom-error-pages/rootfs/Dockerfile +++ b/images/custom-error-pages/rootfs/Dockerfile @@ -13,7 +13,9 @@ # limitations under the License. FROM golang:1.20.1-alpine3.17 as builder -RUN apk add git + +RUN apk update \ + && apk upgrade && apk add git WORKDIR /go/src/k8s.io/ingress-nginx/images/custom-error-pages diff --git a/images/echo/Makefile b/images/echo/Makefile index 0ab1c945f..5dc546a8b 100644 --- a/images/echo/Makefile +++ b/images/echo/Makefile @@ -18,7 +18,7 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v1.0.0 +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-echo diff --git a/images/echo/cloudbuild.yaml b/images/echo/cloudbuild.yaml index 8349b5a7f..8f59b6727 100644 --- a/images/echo/cloudbuild.yaml +++ b/images/echo/cloudbuild.yaml @@ -6,7 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/echo/rootfs/Dockerfile b/images/echo/rootfs/Dockerfile index 4c9b6ab55..c4ab26561 100644 --- a/images/echo/rootfs/Dockerfile +++ b/images/echo/rootfs/Dockerfile @@ -2,7 +2,7 @@ ARG BASE_IMAGE FROM ${BASE_IMAGE} -RUN apk add -U perl curl make unzip +RUN apk update && apk upgrade && apk add -U --no-cache perl curl make unzip ARG LUAROCKS_VERSION ARG LUAROCKS_SHA diff --git a/images/ext-auth-example-authsvc/cloudbuild.yaml b/images/ext-auth-example-authsvc/cloudbuild.yaml index d77c9fc19..8de32fdc9 100644 --- a/images/ext-auth-example-authsvc/cloudbuild.yaml +++ b/images/ext-auth-example-authsvc/cloudbuild.yaml @@ -8,7 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/fastcgi-helloserver/cloudbuild.yaml b/images/fastcgi-helloserver/cloudbuild.yaml index cb4ac2e94..92f4be017 100644 --- a/images/fastcgi-helloserver/cloudbuild.yaml +++ b/images/fastcgi-helloserver/cloudbuild.yaml @@ -6,7 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/go-grpc-greeter-server/cloudbuild.yaml b/images/go-grpc-greeter-server/cloudbuild.yaml index 834c0cb85..d618c5e6f 100644 --- a/images/go-grpc-greeter-server/cloudbuild.yaml +++ b/images/go-grpc-greeter-server/cloudbuild.yaml @@ -8,7 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/httpbin/cloudbuild.yaml b/images/httpbin/cloudbuild.yaml index 9f2658b7b..ffd8c9974 100644 --- a/images/httpbin/cloudbuild.yaml +++ b/images/httpbin/cloudbuild.yaml @@ -8,7 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/httpbin/rootfs/Dockerfile b/images/httpbin/rootfs/Dockerfile index 0e490be74..a05f6872f 100644 --- a/images/httpbin/rootfs/Dockerfile +++ b/images/httpbin/rootfs/Dockerfile @@ -17,7 +17,7 @@ FROM alpine:3.17.2 ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 -RUN apk update \ +RUN apk upgrade && apk update \ && apk add --no-cache \ python3 python3-dev \ musl-dev gcc g++ make \ diff --git a/images/kube-webhook-certgen/cloudbuild.yaml b/images/kube-webhook-certgen/cloudbuild.yaml index 127dee6eb..ef938ef6a 100644 --- a/images/kube-webhook-certgen/cloudbuild.yaml +++ b/images/kube-webhook-certgen/cloudbuild.yaml @@ -21,7 +21,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/nginx/Makefile b/images/nginx/Makefile index 438d0cfe1..053f1e5e8 100644 --- a/images/nginx/Makefile +++ b/images/nginx/Makefile @@ -21,7 +21,7 @@ DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh # 0.0.0 shouldn't clobber any released builds -TAG ?= 0.0 +TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) REGISTRY ?= gcr.io/k8s-staging-ingress-nginx IMAGE = $(REGISTRY)/nginx diff --git a/images/nginx/cloudbuild.yaml b/images/nginx/cloudbuild.yaml index b3d7b1507..003209d77 100644 --- a/images/nginx/cloudbuild.yaml +++ b/images/nginx/cloudbuild.yaml @@ -9,7 +9,6 @@ steps: env: - DOCKER_CLI_EXPERIMENTAL=enabled - BASE_REF=$_PULL_BASE_REF - - TAG=$_PULL_BASE_SHA - REGISTRY=gcr.io/k8s-staging-ingress-nginx - HOME=/root args: diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index 3279af5d5..a968eb1b3 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -17,7 +17,7 @@ COPY . / RUN apk update \ && apk upgrade \ - && apk add -U bash \ + && apk add -U bash --no-cache \ && /build.sh # Use a multi-stage build diff --git a/images/opentelemetry/cloudbuild.yaml b/images/opentelemetry/cloudbuild.yaml index 0096c0f44..82b75e6e6 100644 --- a/images/opentelemetry/cloudbuild.yaml +++ b/images/opentelemetry/cloudbuild.yaml @@ -8,7 +8,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 729f27415..289270e26 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -30,27 +30,52 @@ export DOCKER_CLI_EXPERIMENTAL=enabled # build with buildx PLATFORMS?=linux/amd64,linux/arm64 -OUTPUT= +OUTPUT?= PROGRESS=plain -build: ensure-buildx - docker buildx build \ - --platform=${PLATFORMS} $(OUTPUT) \ - --progress=$(PROGRESS) \ +image: + echo "Building docker image ($(ARCH))..." + docker build \ + ${PLATFORM_FLAG} ${PLATFORM} \ + --no-cache \ --pull \ - --build-arg BASE_IMAGE=$(NGINX_BASE_IMAGE) \ + --push \ + --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ --build-arg GOLANG_VERSION=1.20.1 \ --build-arg ETCD_VERSION=3.4.3-0 \ - --build-arg K8S_RELEASE=v1.24.2 \ + --build-arg K8S_RELEASE=v1.26.0 \ --build-arg RESTY_CLI_VERSION=0.27 \ --build-arg RESTY_CLI_SHA=e5f4f3128af49ba5c4d039d0554e5ae91bbe05866f60eccfa96d3653274bff90 \ --build-arg LUAROCKS_VERSION=3.8.0 \ --build-arg LUAROCKS_SHA=ab6612ca9ab87c6984871d2712d05525775e8b50172701a0a1cabddf76de2be7 \ - --build-arg CHART_TESTING_VERSION=3.7.0 \ + --build-arg CHART_TESTING_VERSION=3.8.0 \ --build-arg YAML_LINT_VERSION=1.27.1 \ --build-arg YAMALE_VERSION=4.0.4 \ - --build-arg HELM_VERSION=v3.9.0 \ - -t $(IMAGE):$(TAG) rootfs + --build-arg HELM_VERSION=3.11.2 \ + --build-arg GINKGO_VERSION=2.9.0 \ + --build-arg GOLINT_VERSION=latest \ + -t ${IMAGE}:${TAG} rootfs + +build: ensure-buildx + docker buildx build \ + --platform=${PLATFORMS} ${OUTPUT} \ + --progress=${PROGRESS} \ + --pull \ + --build-arg BASE_IMAGE=${NGINX_BASE_IMAGE} \ + --build-arg GOLANG_VERSION=1.20.1 \ + --build-arg ETCD_VERSION=3.4.3-0 \ + --build-arg K8S_RELEASE=v1.26.0 \ + --build-arg RESTY_CLI_VERSION=0.27 \ + --build-arg RESTY_CLI_SHA=e5f4f3128af49ba5c4d039d0554e5ae91bbe05866f60eccfa96d3653274bff90 \ + --build-arg LUAROCKS_VERSION=3.8.0 \ + --build-arg LUAROCKS_SHA=ab6612ca9ab87c6984871d2712d05525775e8b50172701a0a1cabddf76de2be7 \ + --build-arg CHART_TESTING_VERSION=3.8.0 \ + --build-arg YAML_LINT_VERSION=1.27.1 \ + --build-arg YAMALE_VERSION=4.0.4 \ + --build-arg HELM_VERSION=3.11.2 \ + --build-arg GINKGO_VERSION=2.9.0 \ + --build-arg GOLINT_VERSION=latest \ + -t ${IMAGE}:${TAG} rootfs # push the cross built image push: OUTPUT=--push diff --git a/images/test-runner/cloudbuild.yaml b/images/test-runner/cloudbuild.yaml index b1f32d6a2..ff4667b0c 100644 --- a/images/test-runner/cloudbuild.yaml +++ b/images/test-runner/cloudbuild.yaml @@ -6,7 +6,6 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled - - TAG=$_GIT_TAG - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx @@ -20,3 +19,4 @@ steps: substitutions: _GIT_TAG: "12345" _PULL_BASE_REF: "master" + _PULL_BASE_SHA: '12345' \ No newline at end of file diff --git a/images/test-runner/rootfs/Dockerfile b/images/test-runner/rootfs/Dockerfile index 7872b7a2b..0b691a7d2 100644 --- a/images/test-runner/rootfs/Dockerfile +++ b/images/test-runner/rootfs/Dockerfile @@ -11,7 +11,6 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. - ARG BASE_IMAGE ARG GOLANG_VERSION ARG ETCD_VERSION @@ -21,6 +20,20 @@ FROM registry.k8s.io/etcd:${ETCD_VERSION} as etcd FROM ${BASE_IMAGE} +ARG RESTY_CLI_VERSION +ARG RESTY_CLI_SHA +ARG LUAROCKS_VERSION +ARG LUAROCKS_SHA +ARG TARGETARCH +ARG K8S_RELEASE +ARG CHART_TESTING_VERSION +ARG HELM_VERSION +ARG YAMALE_VERSION +ARG YAML_LINT_VERSION +ARG GINKGO_VERSION +ARG GOLINT_VERSION + + RUN set -eux; \ if [ -e /etc/nsswitch.conf ]; then \ grep '^hosts: files dns' /etc/nsswitch.conf; \ @@ -28,13 +41,16 @@ RUN set -eux; \ echo 'hosts: files dns' > /etc/nsswitch.conf; \ fi - COPY --from=GO /usr/local/go /usr/local/go +ENV GOPATH /go +ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH +RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH" + COPY --from=etcd /usr/local/bin/etcd /usr/local/bin/etcd -RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories +RUN echo "@testing https://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories -RUN apk add --no-cache \ +RUN apk update && apk upgrade && apk add --no-cache \ bash \ ca-certificates \ wget \ @@ -48,19 +64,15 @@ RUN apk add --no-cache \ py-pip \ unzip \ openssl \ - cfssl@testing + cfssl@testing \ + curl \ + tzdata \ + libc6-compat -ENV GOPATH /go -ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH +RUN go install -v github.com/onsi/ginkgo/v2/ginkgo@v${GINKGO_VERSION} \ + && go install golang.org/x/lint/golint@${GOLINT_VERSION} -RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH" - -RUN go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 && go install golang.org/x/lint/golint@latest - -ARG RESTY_CLI_VERSION -ARG RESTY_CLI_SHA - -RUN wget -O /tmp/resty_cli.tgz \ +RUN wget -qO /tmp/resty_cli.tgz \ https://github.com/openresty/resty-cli/archive/v${RESTY_CLI_VERSION}.tar.gz \ && echo "${RESTY_CLI_SHA} */tmp/resty_cli.tgz" | sha256sum -c - \ && tar -C /tmp -xzf /tmp/resty_cli.tgz \ @@ -68,10 +80,7 @@ RUN wget -O /tmp/resty_cli.tgz \ && resty -V \ && rm -rf /tmp/* -ARG LUAROCKS_VERSION -ARG LUAROCKS_SHA - -RUN wget -O /tmp/luarocks.tgz \ +RUN wget -qO /tmp/luarocks.tgz \ https://github.com/luarocks/luarocks/archive/v${LUAROCKS_VERSION}.tar.gz \ && echo "${LUAROCKS_SHA} */tmp/luarocks.tgz" | sha256sum -c - \ && tar -C /tmp -xzf /tmp/luarocks.tgz \ @@ -82,48 +91,39 @@ RUN wget -O /tmp/luarocks.tgz \ RUN luarocks install busted \ && luarocks install luacheck -ARG TARGETARCH - -ARG K8S_RELEASE - -RUN wget -O /usr/local/bin/kubectl \ +RUN wget -qO /usr/local/bin/kubectl \ https://storage.googleapis.com/kubernetes-release/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kubectl \ && chmod +x /usr/local/bin/kubectl -RUN wget -O /usr/local/bin/kube-apiserver \ +RUN wget -qO /usr/local/bin/kube-apiserver \ https://storage.googleapis.com/kubernetes-release/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kube-apiserver \ && chmod +x /usr/local/bin/kube-apiserver -ARG CHART_TESTING_VERSION - -RUN wget -O /tmp/ct-${CHART_TESTING_VERSION}-linux-amd64.tar.gz \ - https://github.com/helm/chart-testing/releases/download/v${CHART_TESTING_VERSION}/chart-testing_${CHART_TESTING_VERSION}_linux_amd64.tar.gz \ +RUN wget -qO /tmp/ct-${CHART_TESTING_VERSION}-linux-${TARGETARCH}.tar.gz \ + https://github.com/helm/chart-testing/releases/download/v${CHART_TESTING_VERSION}/chart-testing_${CHART_TESTING_VERSION}_linux_${TARGETARCH}.tar.gz \ && mkdir -p /tmp/ct-download \ - && tar xzvf /tmp/ct-${CHART_TESTING_VERSION}-linux-amd64.tar.gz -C /tmp/ct-download \ - && rm /tmp/ct-${CHART_TESTING_VERSION}-linux-amd64.tar.gz \ + && tar xzvf /tmp/ct-${CHART_TESTING_VERSION}-linux-${TARGETARCH}.tar.gz -C /tmp/ct-download \ + && rm /tmp/ct-${CHART_TESTING_VERSION}-linux-${TARGETARCH}.tar.gz \ && cp /tmp/ct-download/ct /usr/local/bin \ && mkdir -p /etc/ct \ && cp -R /tmp/ct-download/etc/* /etc/ct \ && rm -rf /tmp/* -RUN wget -O /usr/local/bin/lj-releng \ +RUN wget -qO /usr/local/bin/lj-releng \ https://raw.githubusercontent.com/openresty/openresty-devel-utils/master/lj-releng \ && chmod +x /usr/local/bin/lj-releng -ARG HELM_VERSION -RUN wget -O /tmp/helm.tgz \ - https://get.helm.sh/helm-${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \ +RUN wget -qO /tmp/helm.tgz \ + https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz \ && tar -C /tmp -xzf /tmp/helm.tgz \ && cp /tmp/linux*/helm /usr/local/bin \ && rm -rf /tmp/* # Install a YAML Linter -ARG YAML_LINT_VERSION RUN pip install "yamllint==$YAML_LINT_VERSION" # Install Yamale YAML schema validator -ARG YAMALE_VERSION RUN pip install "yamale==$YAMALE_VERSION" WORKDIR $GOPATH diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index 09ce36cc5..11abc26b4 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -3,7 +3,8 @@ FROM ${E2E_BASE_IMAGE} AS BASE FROM alpine:3.17.2 -RUN apk add -U --no-cache \ +RUN apk update \ + && apk upgrade && apk add -U --no-cache \ ca-certificates \ bash \ curl \ diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index 001146f65..011396531 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE="registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035" image: echo "..entered Makefile in /test/e2e-image" From 24e0e29386be3ba03249758dcd730360ad6ed97d Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 7 Apr 2023 10:42:37 -0400 Subject: [PATCH 128/822] add short sha to gcloud build and makefiles Signed-off-by: James Strong --- images/cfssl/Makefile | 6 +++++- images/cfssl/cloudbuild.yaml | 1 + images/custom-error-pages/Makefile | 4 +++- images/custom-error-pages/cloudbuild.yaml | 1 + images/echo/Makefile | 4 +++- images/echo/cloudbuild.yaml | 1 + images/ext-auth-example-authsvc/cloudbuild.yaml | 1 + images/fastcgi-helloserver/Makefile | 4 +++- images/fastcgi-helloserver/cloudbuild.yaml | 1 + images/go-grpc-greeter-server/Makefile | 4 +++- images/go-grpc-greeter-server/cloudbuild.yaml | 1 + images/httpbin/Makefile | 4 +++- images/httpbin/cloudbuild.yaml | 1 + images/kube-webhook-certgen/Makefile | 4 +++- images/kube-webhook-certgen/cloudbuild.yaml | 1 + images/nginx/Makefile | 4 +++- images/nginx/cloudbuild.yaml | 1 + images/opentelemetry/Makefile | 4 +++- images/opentelemetry/cloudbuild.yaml | 1 + images/test-runner/Makefile | 4 +++- images/test-runner/cloudbuild.yaml | 1 + 21 files changed, 43 insertions(+), 10 deletions(-) diff --git a/images/cfssl/Makefile b/images/cfssl/Makefile index 1521d2c78..8d8e597a4 100644 --- a/images/cfssl/Makefile +++ b/images/cfssl/Makefile @@ -18,9 +18,13 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local + + IMAGE = $(REGISTRY)/e2e-test-cfssl # required to enable buildx diff --git a/images/cfssl/cloudbuild.yaml b/images/cfssl/cloudbuild.yaml index 3f0abee99..4976a3f67 100644 --- a/images/cfssl/cloudbuild.yaml +++ b/images/cfssl/cloudbuild.yaml @@ -6,6 +6,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/custom-error-pages/Makefile b/images/custom-error-pages/Makefile index b014beabe..810736cca 100644 --- a/images/custom-error-pages/Makefile +++ b/images/custom-error-pages/Makefile @@ -20,7 +20,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/nginx-errors diff --git a/images/custom-error-pages/cloudbuild.yaml b/images/custom-error-pages/cloudbuild.yaml index 3490bd73b..e38d4bcdc 100644 --- a/images/custom-error-pages/cloudbuild.yaml +++ b/images/custom-error-pages/cloudbuild.yaml @@ -6,6 +6,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/echo/Makefile b/images/echo/Makefile index 5dc546a8b..a213df5d3 100644 --- a/images/echo/Makefile +++ b/images/echo/Makefile @@ -18,7 +18,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-echo diff --git a/images/echo/cloudbuild.yaml b/images/echo/cloudbuild.yaml index 8f59b6727..f07be825a 100644 --- a/images/echo/cloudbuild.yaml +++ b/images/echo/cloudbuild.yaml @@ -6,6 +6,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/ext-auth-example-authsvc/cloudbuild.yaml b/images/ext-auth-example-authsvc/cloudbuild.yaml index 8de32fdc9..c5bb5db6a 100644 --- a/images/ext-auth-example-authsvc/cloudbuild.yaml +++ b/images/ext-auth-example-authsvc/cloudbuild.yaml @@ -8,6 +8,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/fastcgi-helloserver/Makefile b/images/fastcgi-helloserver/Makefile index 6c5a3647a..4d277a19d 100644 --- a/images/fastcgi-helloserver/Makefile +++ b/images/fastcgi-helloserver/Makefile @@ -20,7 +20,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-fastcgi-helloserver diff --git a/images/fastcgi-helloserver/cloudbuild.yaml b/images/fastcgi-helloserver/cloudbuild.yaml index 92f4be017..a4c9d5eff 100644 --- a/images/fastcgi-helloserver/cloudbuild.yaml +++ b/images/fastcgi-helloserver/cloudbuild.yaml @@ -6,6 +6,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/go-grpc-greeter-server/Makefile b/images/go-grpc-greeter-server/Makefile index e6b6efae6..e221ecfea 100644 --- a/images/go-grpc-greeter-server/Makefile +++ b/images/go-grpc-greeter-server/Makefile @@ -18,7 +18,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/go-grpc-greeter-server diff --git a/images/go-grpc-greeter-server/cloudbuild.yaml b/images/go-grpc-greeter-server/cloudbuild.yaml index d618c5e6f..6f32bcf50 100644 --- a/images/go-grpc-greeter-server/cloudbuild.yaml +++ b/images/go-grpc-greeter-server/cloudbuild.yaml @@ -8,6 +8,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/httpbin/Makefile b/images/httpbin/Makefile index 5d92ffcb5..a2ba07400 100644 --- a/images/httpbin/Makefile +++ b/images/httpbin/Makefile @@ -18,7 +18,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-httpbin diff --git a/images/httpbin/cloudbuild.yaml b/images/httpbin/cloudbuild.yaml index ffd8c9974..e9df202b8 100644 --- a/images/httpbin/cloudbuild.yaml +++ b/images/httpbin/cloudbuild.yaml @@ -8,6 +8,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/kube-webhook-certgen/Makefile b/images/kube-webhook-certgen/Makefile index 1716bc07e..cd014c7c3 100644 --- a/images/kube-webhook-certgen/Makefile +++ b/images/kube-webhook-certgen/Makefile @@ -19,7 +19,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/kube-webhook-certgen diff --git a/images/kube-webhook-certgen/cloudbuild.yaml b/images/kube-webhook-certgen/cloudbuild.yaml index ef938ef6a..bf0bd3ce1 100644 --- a/images/kube-webhook-certgen/cloudbuild.yaml +++ b/images/kube-webhook-certgen/cloudbuild.yaml @@ -21,6 +21,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/nginx/Makefile b/images/nginx/Makefile index 053f1e5e8..b54a7739b 100644 --- a/images/nginx/Makefile +++ b/images/nginx/Makefile @@ -21,7 +21,9 @@ DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh # 0.0.0 shouldn't clobber any released builds -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= gcr.io/k8s-staging-ingress-nginx IMAGE = $(REGISTRY)/nginx diff --git a/images/nginx/cloudbuild.yaml b/images/nginx/cloudbuild.yaml index 003209d77..c581700dd 100644 --- a/images/nginx/cloudbuild.yaml +++ b/images/nginx/cloudbuild.yaml @@ -8,6 +8,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx - HOME=/root diff --git a/images/opentelemetry/Makefile b/images/opentelemetry/Makefile index 695dcf632..07a66beed 100644 --- a/images/opentelemetry/Makefile +++ b/images/opentelemetry/Makefile @@ -21,7 +21,9 @@ DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh # 0.0.0 shouldn't clobber any released builds -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= gcr.io/k8s-staging-ingress-nginx IMAGE = $(REGISTRY)/opentelemetry diff --git a/images/opentelemetry/cloudbuild.yaml b/images/opentelemetry/cloudbuild.yaml index 82b75e6e6..9556ccba9 100644 --- a/images/opentelemetry/cloudbuild.yaml +++ b/images/opentelemetry/cloudbuild.yaml @@ -8,6 +8,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 289270e26..562625cff 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -18,7 +18,9 @@ SHELL=/bin/bash -o pipefail -o errexit DIR:=$(strip $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))) INIT_BUILDX=$(DIR)/../../hack/init-buildx.sh -TAG ?=v$(shell date +%Y%m%d)-$(shell git rev-parse --short HEAD) +SHORT_SHA ?=$(shell git rev-parse --short HEAD) +TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) + REGISTRY ?= local IMAGE = $(REGISTRY)/e2e-test-runner diff --git a/images/test-runner/cloudbuild.yaml b/images/test-runner/cloudbuild.yaml index ff4667b0c..761ea7f28 100644 --- a/images/test-runner/cloudbuild.yaml +++ b/images/test-runner/cloudbuild.yaml @@ -6,6 +6,7 @@ steps: entrypoint: bash env: - DOCKER_CLI_EXPERIMENTAL=enabled + - SHORT_SHA=$SHORT_SHA - BASE_REF=$_PULL_BASE_REF - REGISTRY=gcr.io/k8s-staging-ingress-nginx # default cloudbuild has HOME=/builder/home and docker buildx is in /root/.docker/cli-plugins/docker-buildx From 7fcafff04617528619950b1cef190a3b424e4f2b Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Fri, 7 Apr 2023 17:39:15 +0200 Subject: [PATCH 129/822] Chart: Improve `README.md`. (#9831) --- charts/ingress-nginx/README.md | 28 ++------------------------- charts/ingress-nginx/README.md.gotmpl | 27 +------------------------- 2 files changed, 3 insertions(+), 52 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index cb3848634..44b553ece 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -8,10 +8,9 @@ To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.c This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. -## Prerequisites +## Requirements -- Chart version 3.x.x: Kubernetes v1.16+ -- Chart version 4.x.x and above: Kubernetes v1.19+ +Kubernetes: `>=1.20.0-0` ## Get Repo Info @@ -52,10 +51,6 @@ helm upgrade [RELEASE_NAME] [CHART] --install _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ -### Upgrading With Zero Downtime in Production - -By default the ingress-nginx controller has service interruptions whenever it's pods are restarted or redeployed. In order to fix that, see the excellent blog post by Lindsay Landry from Codecademy: [Kubernetes: Nginx and Zero Downtime in Production](https://medium.com/codecademy-engineering/kubernetes-nginx-and-zero-downtime-in-production-2c910c6a5ed8). - ### Migrating from stable/nginx-ingress There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: @@ -66,7 +61,6 @@ There are two main ways to migrate a release from `stable/nginx-ingress` to `ing 1. Redirect your DNS traffic from the old controller to the new controller 1. Log traffic from both controllers during this changeover 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it - 1. For details on all of these steps see [Upgrading With Zero Downtime in Production](#upgrading-with-zero-downtime-in-production) Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. @@ -126,19 +120,6 @@ controller: service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' ``` -### AWS route53-mapper - -To configure the LoadBalancer service with the [route53-mapper addon](https://github.com/kubernetes/kops/blob/be63d4f1a7a46daaf1c4c482527328236850f111/addons/route53-mapper/README.md), add the `domainName` annotation and `dns` label: - -```yaml -controller: - service: - labels: - dns: "route53" - annotations: - domainName: "kubernetes-example.com" -``` - ### Additional Internal Load Balancer This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. @@ -244,10 +225,6 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13 As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. -## Requirements - -Kubernetes: `>=1.20.0-0` - ## Values | Key | Type | Default | Description | @@ -522,4 +499,3 @@ Kubernetes: `>=1.20.0-0` | serviceAccount.name | string | `""` | | | tcp | object | `{}` | TCP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | | udp | object | `{}` | UDP service key-value pairs # Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md # | - diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index 99a2a62cb..238166277 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -7,10 +7,7 @@ To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.c This chart bootstraps an ingress-nginx deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. -## Prerequisites - -- Chart version 3.x.x: Kubernetes v1.16+ -- Chart version 4.x.x and above: Kubernetes v1.19+ +{{ template "chart.requirementsSection" . }} ## Get Repo Info @@ -51,10 +48,6 @@ helm upgrade [RELEASE_NAME] [CHART] --install _See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ -### Upgrading With Zero Downtime in Production - -By default the ingress-nginx controller has service interruptions whenever it's pods are restarted or redeployed. In order to fix that, see the excellent blog post by Lindsay Landry from Codecademy: [Kubernetes: Nginx and Zero Downtime in Production](https://medium.com/codecademy-engineering/kubernetes-nginx-and-zero-downtime-in-production-2c910c6a5ed8). - ### Migrating from stable/nginx-ingress There are two main ways to migrate a release from `stable/nginx-ingress` to `ingress-nginx/ingress-nginx` chart: @@ -65,7 +58,6 @@ There are two main ways to migrate a release from `stable/nginx-ingress` to `ing 1. Redirect your DNS traffic from the old controller to the new controller 1. Log traffic from both controllers during this changeover 1. [Uninstall](#uninstall-chart) the old controller once traffic has fully drained from it - 1. For details on all of these steps see [Upgrading With Zero Downtime in Production](#upgrading-with-zero-downtime-in-production) Note that there are some different and upgraded configurations between the two charts, described by Rimas Mocevicius from JFrog in the "Upgrading to ingress-nginx Helm chart" section of [Migrating from Helm chart nginx-ingress to ingress-nginx](https://rimusz.net/migrating-to-ingress-nginx). As the `ingress-nginx/ingress-nginx` chart continues to update, you will want to check current differences by running [helm configuration](#configuration) commands on both charts. @@ -125,19 +117,6 @@ controller: service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600' ``` -### AWS route53-mapper - -To configure the LoadBalancer service with the [route53-mapper addon](https://github.com/kubernetes/kops/blob/be63d4f1a7a46daaf1c4c482527328236850f111/addons/route53-mapper/README.md), add the `domainName` annotation and `dns` label: - -```yaml -controller: - service: - labels: - dns: "route53" - annotations: - domainName: "kubernetes-example.com" -``` - ### Additional Internal Load Balancer This setup is useful when you need both external and internal load balancers but don't want to have multiple ingress controllers and multiple ingress objects per application. @@ -243,8 +222,4 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13 As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered. -{{ template "chart.requirementsSection" . }} - {{ template "chart.valuesSection" . }} - -{{ template "helm-docs.versionFooter" . }} From 4e8d0b5836096426393340273260b9000cd1e151 Mon Sep 17 00:00:00 2001 From: Marco Cadetg Date: Tue, 11 Apr 2023 10:01:18 +0200 Subject: [PATCH 130/822] Exclude socket metrics (#9770) * exclude creation and exporting of socket metrics via flag * make exclude metric naming more consistent * fix connect time metric update * add documentation * e2e test * improve creation of metric mapping --- cmd/dataplane/main.go | 2 +- cmd/nginx/main.go | 2 +- docs/user-guide/cli-arguments.md | 1 + internal/ingress/controller/controller.go | 9 +- internal/ingress/metric/collectors/socket.go | 219 +++++++++++------- .../ingress/metric/collectors/socket_test.go | 116 +++++++++- internal/ingress/metric/main.go | 4 +- pkg/flags/flags.go | 10 +- test/e2e/e2e.go | 1 + test/e2e/metrics/metrics.go | 94 ++++++++ 10 files changed, 362 insertions(+), 96 deletions(-) create mode 100644 test/e2e/metrics/metrics.go diff --git a/cmd/dataplane/main.go b/cmd/dataplane/main.go index 0ab978429..6fd559e4d 100644 --- a/cmd/dataplane/main.go +++ b/cmd/dataplane/main.go @@ -70,7 +70,7 @@ func main() { mc := metric.NewDummyCollector() if conf.EnableMetrics { // TODO: Ingress class is not a part of dataplane anymore - mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets) + mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.ExcludeSocketMetrics) if err != nil { klog.Fatalf("Error creating prometheus collector: %v", err) } diff --git a/cmd/nginx/main.go b/cmd/nginx/main.go index 9f0973ec9..48dd933dc 100644 --- a/cmd/nginx/main.go +++ b/cmd/nginx/main.go @@ -133,7 +133,7 @@ func main() { mc := metric.NewDummyCollector() if conf.EnableMetrics { - mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets) + mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.ExcludeSocketMetrics) if err != nil { klog.Fatalf("Error creating prometheus collector: %v", err) } diff --git a/docs/user-guide/cli-arguments.md b/docs/user-guide/cli-arguments.md index febc6f762..59e52957d 100644 --- a/docs/user-guide/cli-arguments.md +++ b/docs/user-guide/cli-arguments.md @@ -25,6 +25,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment | `--enable-ssl-chain-completion` | Autocomplete SSL certificate chains with missing intermediate CA certificates. Certificates uploaded to Kubernetes must have the "Authority Information Access" X.509 v3 extension for this to succeed. (default false)| | `--enable-ssl-passthrough` | Enable SSL Passthrough. (default false) | | `--enable-topology-aware-routing` | Enable topology aware hints feature, needs service object annotation service.kubernetes.io/topology-aware-hints sets to auto. (default false) | +| `--exclude-socket-metrics` | Set of socket request metrics to exclude which won't be exported nor being calculated. The possible socket request metrics to exclude are documented in the monitoring guide e.g. 'nginx_ingress_controller_request_duration_seconds,nginx_ingress_controller_response_size'| | `--health-check-path` | URL path of the health check endpoint. Configured inside the NGINX status server. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. (default "/healthz") | | `--health-check-timeout` | Time limit, in seconds, for a probe to health-check-path to succeed. (default 10) | | `--healthz-port` | Port to use for the healthz endpoint. (default 10254) | diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 5d94605b5..17142a478 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -102,10 +102,11 @@ type Configuration struct { EnableProfiling bool - EnableMetrics bool - MetricsPerHost bool - MetricsBuckets *collectors.HistogramBuckets - ReportStatusClasses bool + EnableMetrics bool + MetricsPerHost bool + MetricsBuckets *collectors.HistogramBuckets + ReportStatusClasses bool + ExcludeSocketMetrics []string FakeCertificate *ingress.SSLCert diff --git a/internal/ingress/metric/collectors/socket.go b/internal/ingress/metric/collectors/socket.go index 23048d5d6..508cc6bc8 100644 --- a/internal/ingress/metric/collectors/socket.go +++ b/internal/ingress/metric/collectors/socket.go @@ -21,6 +21,7 @@ import ( "io" "net" "os" + "strings" "syscall" jsoniter "github.com/json-iterator/go" @@ -60,6 +61,8 @@ type HistogramBuckets struct { SizeBuckets []float64 } +type metricMapping map[string]prometheus.Collector + // SocketCollector stores prometheus metrics and ingress meta-data type SocketCollector struct { prometheus.Collector @@ -78,7 +81,7 @@ type SocketCollector struct { listener net.Listener - metricMapping map[string]interface{} + metricMapping metricMapping hosts sets.Set[string] @@ -106,7 +109,7 @@ var defObjectives = map[float64]float64{0.5: 0.05, 0.9: 0.01, 0.99: 0.001} // NewSocketCollector creates a new SocketCollector instance using // the ingress watch namespace and class used by the controller -func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStatusClasses bool, buckets HistogramBuckets) (*SocketCollector, error) { +func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStatusClasses bool, buckets HistogramBuckets, excludeMetrics []string) (*SocketCollector, error) { socket := "/tmp/nginx/prometheus-nginx.socket" // unix sockets must be unlink()ed before being used _ = syscall.Unlink(socket) @@ -132,13 +135,23 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat requestTags = append(requestTags, "host") } + em := make(map[string]struct{}, len(excludeMetrics)) + for _, m := range excludeMetrics { + // remove potential nginx_ingress_controller prefix from the metric name + // TBD: how to handle fully qualified histogram metrics e.g. _buckets and _sum. Should we just remove the suffix and remove the histogram metric or ignore it? + em[strings.TrimPrefix(m, "nginx_ingress_controller_")] = struct{}{} + } + + // create metric mapping with only the metrics that are not excluded + mm := make(metricMapping) + sc := &SocketCollector{ listener: listener, metricsPerHost: metricsPerHost, reportStatusClasses: reportStatusClasses, - connectTime: prometheus.NewHistogramVec( + connectTime: histogramMetric( prometheus.HistogramOpts{ Name: "connect_duration_seconds", Help: "The time spent on establishing a connection with the upstream server", @@ -147,8 +160,11 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Buckets: buckets.TimeBuckets, }, requestTags, + em, + mm, ), - headerTime: prometheus.NewHistogramVec( + + headerTime: histogramMetric( prometheus.HistogramOpts{ Name: "header_duration_seconds", Help: "The time spent on receiving first header from the upstream server", @@ -157,8 +173,10 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Buckets: buckets.TimeBuckets, }, requestTags, + em, + mm, ), - responseTime: prometheus.NewHistogramVec( + responseTime: histogramMetric( prometheus.HistogramOpts{ Name: "response_duration_seconds", Help: "The time spent on receiving the response from the upstream server", @@ -167,8 +185,11 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Buckets: buckets.TimeBuckets, }, requestTags, + em, + mm, ), - requestTime: prometheus.NewHistogramVec( + + requestTime: histogramMetric( prometheus.HistogramOpts{ Name: "request_duration_seconds", Help: "The request processing time in milliseconds", @@ -177,9 +198,11 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Buckets: buckets.TimeBuckets, }, requestTags, + em, + mm, ), - responseLength: prometheus.NewHistogramVec( + responseLength: histogramMetric( prometheus.HistogramOpts{ Name: "response_size", Help: "The response length (including request line, header, and request body)", @@ -188,19 +211,24 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Buckets: buckets.LengthBuckets, }, requestTags, + em, + mm, ), - requestLength: prometheus.NewHistogramVec( + + requestLength: histogramMetric( prometheus.HistogramOpts{ Name: "request_size", Help: "The request length (including request line, header, and request body)", Namespace: PrometheusNamespace, - Buckets: buckets.LengthBuckets, ConstLabels: constLabels, + Buckets: buckets.LengthBuckets, }, requestTags, + em, + mm, ), - requests: prometheus.NewCounterVec( + requests: counterMetric( prometheus.CounterOpts{ Name: "requests", Help: "The total number of client requests", @@ -208,9 +236,11 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ConstLabels: constLabels, }, requestTags, + em, + mm, ), - bytesSent: prometheus.NewHistogramVec( + bytesSent: histogramMetric( prometheus.HistogramOpts{ Name: "bytes_sent", Help: "DEPRECATED The number of bytes sent to a client", @@ -219,9 +249,11 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat ConstLabels: constLabels, }, requestTags, + em, + mm, ), - upstreamLatency: prometheus.NewSummaryVec( + upstreamLatency: summaryMetric( prometheus.SummaryOpts{ Name: "ingress_upstream_latency_seconds", Help: "DEPRECATED Upstream service latency per Ingress", @@ -230,28 +262,59 @@ func NewSocketCollector(pod, namespace, class string, metricsPerHost, reportStat Objectives: defObjectives, }, []string{"ingress", "namespace", "service", "canary"}, + em, + mm, ), } - sc.metricMapping = map[string]interface{}{ - prometheus.BuildFQName(PrometheusNamespace, "", "requests"): sc.requests, - - prometheus.BuildFQName(PrometheusNamespace, "", "connect_duration_seconds"): sc.connectTime, - prometheus.BuildFQName(PrometheusNamespace, "", "header_duration_seconds"): sc.headerTime, - prometheus.BuildFQName(PrometheusNamespace, "", "response_duration_seconds"): sc.responseTime, - prometheus.BuildFQName(PrometheusNamespace, "", "request_duration_seconds"): sc.requestTime, - - prometheus.BuildFQName(PrometheusNamespace, "", "request_size"): sc.requestLength, - prometheus.BuildFQName(PrometheusNamespace, "", "response_size"): sc.responseLength, - - prometheus.BuildFQName(PrometheusNamespace, "", "bytes_sent"): sc.bytesSent, - - prometheus.BuildFQName(PrometheusNamespace, "", "ingress_upstream_latency_seconds"): sc.upstreamLatency, - } - + sc.metricMapping = mm return sc, nil } +func containsMetric(excludeMetrics map[string]struct{}, name string) bool { + if _, ok := excludeMetrics[name]; ok { + klog.V(3).InfoS("Skipping metric", "metric", name) + return true + } + return false +} + +func summaryMetric(opts prometheus.SummaryOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.SummaryVec { + if containsMetric(excludeMetrics, opts.Name) { + return nil + } + m := prometheus.NewSummaryVec( + opts, + requestTags, + ) + metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m + return m +} + +func counterMetric(opts prometheus.CounterOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.CounterVec { + if containsMetric(excludeMetrics, opts.Name) { + return nil + } + m := prometheus.NewCounterVec( + opts, + requestTags, + ) + metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m + return m +} + +func histogramMetric(opts prometheus.HistogramOpts, requestTags []string, excludeMetrics map[string]struct{}, metricMapping metricMapping) *prometheus.HistogramVec { + if containsMetric(excludeMetrics, opts.Name) { + return nil + } + m := prometheus.NewHistogramVec( + opts, + requestTags, + ) + metricMapping[prometheus.BuildFQName(PrometheusNamespace, "", opts.Name)] = m + return m +} + func (sc *SocketCollector) handleMessage(msg []byte) { klog.V(5).InfoS("Metric", "message", string(msg)) @@ -305,30 +368,36 @@ func (sc *SocketCollector) handleMessage(msg []byte) { "canary": stats.Canary, } - requestsMetric, err := sc.requests.GetMetricWith(collectorLabels) - if err != nil { - klog.ErrorS(err, "Error fetching requests metric") - } else { - requestsMetric.Inc() + if sc.requests != nil { + requestsMetric, err := sc.requests.GetMetricWith(collectorLabels) + if err != nil { + klog.ErrorS(err, "Error fetching requests metric") + } else { + requestsMetric.Inc() + } } if stats.Latency != -1 { - connectTimeMetric, err := sc.connectTime.GetMetricWith(requestLabels) - if err != nil { - klog.ErrorS(err, "Error fetching connect time metric") - } else { - connectTimeMetric.Observe(stats.Latency) + if sc.connectTime != nil { + connectTimeMetric, err := sc.connectTime.GetMetricWith(requestLabels) + if err != nil { + klog.ErrorS(err, "Error fetching connect time metric") + } else { + connectTimeMetric.Observe(stats.Latency) + } } - latencyMetric, err := sc.upstreamLatency.GetMetricWith(latencyLabels) - if err != nil { - klog.ErrorS(err, "Error fetching latency metric") - } else { - latencyMetric.Observe(stats.Latency) + if sc.upstreamLatency != nil { + latencyMetric, err := sc.upstreamLatency.GetMetricWith(latencyLabels) + if err != nil { + klog.ErrorS(err, "Error fetching latency metric") + } else { + latencyMetric.Observe(stats.Latency) + } } } - if stats.HeaderTime != -1 { + if stats.HeaderTime != -1 && sc.headerTime != nil { headerTimeMetric, err := sc.headerTime.GetMetricWith(requestLabels) if err != nil { klog.ErrorS(err, "Error fetching header time metric") @@ -337,7 +406,7 @@ func (sc *SocketCollector) handleMessage(msg []byte) { } } - if stats.RequestTime != -1 { + if stats.RequestTime != -1 && sc.requestTime != nil { requestTimeMetric, err := sc.requestTime.GetMetricWith(requestLabels) if err != nil { klog.ErrorS(err, "Error fetching request duration metric") @@ -346,7 +415,7 @@ func (sc *SocketCollector) handleMessage(msg []byte) { } } - if stats.RequestLength != -1 { + if stats.RequestLength != -1 && sc.requestLength != nil { requestLengthMetric, err := sc.requestLength.GetMetricWith(requestLabels) if err != nil { klog.ErrorS(err, "Error fetching request length metric") @@ -355,7 +424,7 @@ func (sc *SocketCollector) handleMessage(msg []byte) { } } - if stats.ResponseTime != -1 { + if stats.ResponseTime != -1 && sc.responseTime != nil { responseTimeMetric, err := sc.responseTime.GetMetricWith(requestLabels) if err != nil { klog.ErrorS(err, "Error fetching upstream response time metric") @@ -365,18 +434,22 @@ func (sc *SocketCollector) handleMessage(msg []byte) { } if stats.ResponseLength != -1 { - bytesSentMetric, err := sc.bytesSent.GetMetricWith(requestLabels) - if err != nil { - klog.ErrorS(err, "Error fetching bytes sent metric") - } else { - bytesSentMetric.Observe(stats.ResponseLength) + if sc.bytesSent != nil { + bytesSentMetric, err := sc.bytesSent.GetMetricWith(requestLabels) + if err != nil { + klog.ErrorS(err, "Error fetching bytes sent metric") + } else { + bytesSentMetric.Observe(stats.ResponseLength) + } } - responseSizeMetric, err := sc.responseLength.GetMetricWith(requestLabels) - if err != nil { - klog.ErrorS(err, "Error fetching bytes sent metric") - } else { - responseSizeMetric.Observe(stats.ResponseLength) + if sc.responseLength != nil { + responseSizeMetric, err := sc.responseLength.GetMetricWith(requestLabels) + if err != nil { + klog.ErrorS(err, "Error fetching bytes sent metric") + } else { + responseSizeMetric.Observe(stats.ResponseLength) + } } } } @@ -471,36 +544,16 @@ func (sc *SocketCollector) RemoveMetrics(ingresses []string, registry prometheus // Describe implements prometheus.Collector func (sc SocketCollector) Describe(ch chan<- *prometheus.Desc) { - sc.connectTime.Describe(ch) - sc.headerTime.Describe(ch) - sc.responseTime.Describe(ch) - sc.requestTime.Describe(ch) - - sc.requestLength.Describe(ch) - sc.responseLength.Describe(ch) - - sc.requests.Describe(ch) - - sc.upstreamLatency.Describe(ch) - - sc.bytesSent.Describe(ch) + for _, metric := range sc.metricMapping { + metric.Describe(ch) + } } // Collect implements the prometheus.Collector interface. func (sc SocketCollector) Collect(ch chan<- prometheus.Metric) { - sc.connectTime.Collect(ch) - sc.headerTime.Collect(ch) - sc.responseTime.Collect(ch) - sc.requestTime.Collect(ch) - - sc.requestLength.Collect(ch) - sc.responseLength.Collect(ch) - - sc.requests.Collect(ch) - - sc.upstreamLatency.Collect(ch) - - sc.bytesSent.Collect(ch) + for _, metric := range sc.metricMapping { + metric.Collect(ch) + } } // SetHosts sets the hostnames that are being served by the ingress controller diff --git a/internal/ingress/metric/collectors/socket_test.go b/internal/ingress/metric/collectors/socket_test.go index 4bebc7600..fe442aba0 100644 --- a/internal/ingress/metric/collectors/socket_test.go +++ b/internal/ingress/metric/collectors/socket_test.go @@ -84,6 +84,7 @@ func TestCollector(t *testing.T) { data []string metrics []string useStatusClasses bool + excludeMetrics []string wantBefore string removeIngresses []string wantAfter string @@ -470,13 +471,126 @@ func TestCollector(t *testing.T) { wantAfter: ` `, }, + { + name: "basic exclude metrics test", + data: []string{`[{ + "host":"testshop.com", + "status":"200", + "bytesSent":150.0, + "method":"GET", + "path":"/admin", + "requestLength":300.0, + "requestTime":60.0, + "upstreamLatency":1.0, + "upstreamHeaderTime":5.0, + "upstreamName":"test-upstream", + "upstreamIP":"1.1.1.1:8080", + "upstreamResponseTime":200, + "upstreamStatus":"220", + "namespace":"test-app-production", + "ingress":"web-yml", + "service":"test-app", + "canary":"" + }]`}, + excludeMetrics: []string{"nginx_ingress_controller_connect_duration_seconds"}, + metrics: []string{"nginx_ingress_controller_connect_duration_seconds", "nginx_ingress_controller_response_duration_seconds"}, + useStatusClasses: true, + wantBefore: ` + # HELP nginx_ingress_controller_response_duration_seconds The time spent on receiving the response from the upstream server + # TYPE nginx_ingress_controller_response_duration_seconds histogram + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.005"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.01"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.025"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.05"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.1"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.25"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="1"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="2.5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="10"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="+Inf"} 1 + nginx_ingress_controller_response_duration_seconds_sum{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 200 + nginx_ingress_controller_response_duration_seconds_count{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 1 + `, + }, + { + name: "remove metrics with the short metric name", + data: []string{`[{ + "host":"testshop.com", + "status":"200", + "bytesSent":150.0, + "method":"GET", + "path":"/admin", + "requestLength":300.0, + "requestTime":60.0, + "upstreamLatency":1.0, + "upstreamHeaderTime":5.0, + "upstreamName":"test-upstream", + "upstreamIP":"1.1.1.1:8080", + "upstreamResponseTime":200, + "upstreamStatus":"220", + "namespace":"test-app-production", + "ingress":"web-yml", + "service":"test-app", + "canary":"" + }]`}, + excludeMetrics: []string{"response_duration_seconds"}, + metrics: []string{"nginx_ingress_controller_response_duration_seconds"}, + useStatusClasses: true, + wantBefore: ` + `, + }, + { + name: "exclude metrics make sure to only remove exactly matched metrics", + data: []string{`[{ + "host":"testshop.com", + "status":"200", + "bytesSent":150.0, + "method":"GET", + "path":"/admin", + "requestLength":300.0, + "requestTime":60.0, + "upstreamLatency":1.0, + "upstreamHeaderTime":5.0, + "upstreamName":"test-upstream", + "upstreamIP":"1.1.1.1:8080", + "upstreamResponseTime":200, + "upstreamStatus":"220", + "namespace":"test-app-production", + "ingress":"web-yml", + "service":"test-app", + "canary":"" + }]`}, + excludeMetrics: []string{"response_duration_seconds2", "test.*", "nginx_ingress_.*", "response_duration_secon"}, + metrics: []string{"nginx_ingress_controller_response_duration_seconds"}, + useStatusClasses: true, + wantBefore: ` + # HELP nginx_ingress_controller_response_duration_seconds The time spent on receiving the response from the upstream server + # TYPE nginx_ingress_controller_response_duration_seconds histogram + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.005"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.01"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.025"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.05"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.1"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.25"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="0.5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="1"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="2.5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="5"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="10"} 0 + nginx_ingress_controller_response_duration_seconds_bucket{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx",le="+Inf"} 1 + nginx_ingress_controller_response_duration_seconds_sum{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 200 + nginx_ingress_controller_response_duration_seconds_count{canary="",controller_class="ingress",controller_namespace="default",controller_pod="pod",host="testshop.com",ingress="web-yml",method="GET",namespace="test-app-production",path="/admin",service="test-app",status="2xx"} 1 + `, + }, } for _, c := range cases { t.Run(c.name, func(t *testing.T) { registry := prometheus.NewPedanticRegistry() - sc, err := NewSocketCollector("pod", "default", "ingress", true, c.useStatusClasses, buckets) + sc, err := NewSocketCollector("pod", "default", "ingress", true, c.useStatusClasses, buckets, c.excludeMetrics) if err != nil { t.Errorf("%v: unexpected error creating new SocketCollector: %v", c.name, err) } diff --git a/internal/ingress/metric/main.go b/internal/ingress/metric/main.go index cac86e889..b2f721f62 100644 --- a/internal/ingress/metric/main.go +++ b/internal/ingress/metric/main.go @@ -71,7 +71,7 @@ type collector struct { } // NewCollector creates a new metric collector the for ingress controller -func NewCollector(metricsPerHost, reportStatusClasses bool, registry *prometheus.Registry, ingressclass string, buckets collectors.HistogramBuckets) (Collector, error) { +func NewCollector(metricsPerHost, reportStatusClasses bool, registry *prometheus.Registry, ingressclass string, buckets collectors.HistogramBuckets, excludedSocketMetrics []string) (Collector, error) { podNamespace := os.Getenv("POD_NAMESPACE") if podNamespace == "" { podNamespace = "default" @@ -89,7 +89,7 @@ func NewCollector(metricsPerHost, reportStatusClasses bool, registry *prometheus return nil, err } - s, err := collectors.NewSocketCollector(podName, podNamespace, ingressclass, metricsPerHost, reportStatusClasses, buckets) + s, err := collectors.NewSocketCollector(podName, podNamespace, ingressclass, metricsPerHost, reportStatusClasses, buckets, excludedSocketMetrics) if err != nil { return nil, err } diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go index 911ab775c..370510380 100644 --- a/pkg/flags/flags.go +++ b/pkg/flags/flags.go @@ -171,10 +171,11 @@ Requires the update-status parameter.`) reportStatusClasses = flags.Bool("report-status-classes", false, `Use status classes (2xx, 3xx, 4xx and 5xx) instead of status codes in metrics.`) - timeBuckets = flags.Float64Slice("time-buckets", prometheus.DefBuckets, "Set of buckets which will be used for prometheus histogram metrics such as RequestTime, ResponseTime.") - lengthBuckets = flags.Float64Slice("length-buckets", prometheus.LinearBuckets(10, 10, 10), "Set of buckets which will be used for prometheus histogram metrics such as RequestLength, ResponseLength.") - sizeBuckets = flags.Float64Slice("size-buckets", prometheus.ExponentialBuckets(10, 10, 7), "Set of buckets which will be used for prometheus histogram metrics such as BytesSent.") - monitorMaxBatchSize = flags.Int("monitor-max-batch-size", 10000, "Max batch size of NGINX metrics.") + timeBuckets = flags.Float64Slice("time-buckets", prometheus.DefBuckets, "Set of buckets which will be used for prometheus histogram metrics such as RequestTime, ResponseTime.") + lengthBuckets = flags.Float64Slice("length-buckets", prometheus.LinearBuckets(10, 10, 10), "Set of buckets which will be used for prometheus histogram metrics such as RequestLength, ResponseLength.") + sizeBuckets = flags.Float64Slice("size-buckets", prometheus.ExponentialBuckets(10, 10, 7), "Set of buckets which will be used for prometheus histogram metrics such as BytesSent.") + excludeSocketMetrics = flags.StringSlice("exclude-socket-metrics", []string{}, "et of socket request metrics to exclude which won't be exported nor being calculated. E.g. 'nginx_ingress_controller_success,nginx_ingress_controller_header_duration_seconds'.") + monitorMaxBatchSize = flags.Int("monitor-max-batch-size", 10000, "Max batch size of NGINX metrics.") httpPort = flags.Int("http-port", 80, `Port to use for servicing HTTP traffic.`) httpsPort = flags.Int("https-port", 443, `Port to use for servicing HTTPS traffic.`) @@ -328,6 +329,7 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g MetricsPerHost: *metricsPerHost, MetricsBuckets: histogramBuckets, ReportStatusClasses: *reportStatusClasses, + ExcludeSocketMetrics: *excludeSocketMetrics, MonitorMaxBatchSize: *monitorMaxBatchSize, DisableServiceExternalName: *disableServiceExternalName, EnableSSLPassthrough: *enableSSLPassthrough, diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 57b047230..614dd166a 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -40,6 +40,7 @@ import ( _ "k8s.io/ingress-nginx/test/e2e/leaks" _ "k8s.io/ingress-nginx/test/e2e/loadbalance" _ "k8s.io/ingress-nginx/test/e2e/lua" + _ "k8s.io/ingress-nginx/test/e2e/metrics" _ "k8s.io/ingress-nginx/test/e2e/nginx" _ "k8s.io/ingress-nginx/test/e2e/security" _ "k8s.io/ingress-nginx/test/e2e/servicebackend" diff --git a/test/e2e/metrics/metrics.go b/test/e2e/metrics/metrics.go new file mode 100644 index 000000000..907b53732 --- /dev/null +++ b/test/e2e/metrics/metrics.go @@ -0,0 +1,94 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package defaultbackend + +import ( + "context" + "fmt" + "net/http" + "strings" + "time" + + "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" + appsv1 "k8s.io/api/apps/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "k8s.io/ingress-nginx/test/e2e/framework" +) + +const waitForMetrics = 2 * time.Second + +var _ = framework.IngressNginxDescribe("[metrics] exported prometheus metrics", func() { + f := framework.NewDefaultFramework("metrics") + host := "foo.com" + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, nil)) + f.WaitForNginxServer(host, + func(server string) bool { + return strings.Contains(server, fmt.Sprintf("server_name %s ;", host)) && + strings.Contains(server, "proxy_pass http://upstream_balancer;") + }) + }) + + ginkgo.It("exclude socket request metrics are absent", func() { + err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { + args := deployment.Spec.Template.Spec.Containers[0].Args + args = append(args, "--exclude-socket-metrics=nginx_ingress_controller_request_size,nginx_ingress_controller_header_duration_seconds") + deployment.Spec.Template.Spec.Containers[0].Args = args + _, err := f.KubeClientSet.AppsV1().Deployments(f.Namespace).Update(context.TODO(), deployment, metav1.UpdateOptions{}) + return err + }) + assert.Nil(ginkgo.GinkgoT(), err, "updating deployment") + + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusOK) + time.Sleep(waitForMetrics) + + ip := f.GetNginxPodIP() + mf, err := f.GetMetric("nginx_ingress_controller_request_size", ip) + assert.ErrorContains(ginkgo.GinkgoT(), err, "nginx_ingress_controller_request_size") + assert.Nil(ginkgo.GinkgoT(), mf) + }) + ginkgo.It("exclude socket request metrics are present", func() { + err := f.UpdateIngressControllerDeployment(func(deployment *appsv1.Deployment) error { + args := deployment.Spec.Template.Spec.Containers[0].Args + args = append(args, "--exclude-socket-metrics=non_existing_metric_does_not_affect_existing_metrics") + deployment.Spec.Template.Spec.Containers[0].Args = args + _, err := f.KubeClientSet.AppsV1().Deployments(f.Namespace).Update(context.TODO(), deployment, metav1.UpdateOptions{}) + return err + }) + assert.Nil(ginkgo.GinkgoT(), err, "updating deployment") + + f.HTTPTestClient(). + GET("/"). + WithHeader("Host", host). + Expect(). + Status(http.StatusOK) + time.Sleep(waitForMetrics) + + ip := f.GetNginxPodIP() + mf, err := f.GetMetric("nginx_ingress_controller_request_size", ip) + assert.Nil(ginkgo.GinkgoT(), err) + assert.NotNil(ginkgo.GinkgoT(), mf) + }) +}) From f35dae9b1117a6e0da532702bb4978ea8547175f Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Apr 2023 16:09:39 -0500 Subject: [PATCH 131/822] added test boilerplate --- test/e2e/e2e.go | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index 57b047230..a671e8793 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -29,26 +29,27 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" // tests to run - _ "k8s.io/ingress-nginx/test/e2e/admission" - _ "k8s.io/ingress-nginx/test/e2e/annotations" - _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" - _ "k8s.io/ingress-nginx/test/e2e/dbg" - _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" - _ "k8s.io/ingress-nginx/test/e2e/endpointslices" - _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" - _ "k8s.io/ingress-nginx/test/e2e/ingress" - _ "k8s.io/ingress-nginx/test/e2e/leaks" - _ "k8s.io/ingress-nginx/test/e2e/loadbalance" - _ "k8s.io/ingress-nginx/test/e2e/lua" - _ "k8s.io/ingress-nginx/test/e2e/nginx" - _ "k8s.io/ingress-nginx/test/e2e/security" - _ "k8s.io/ingress-nginx/test/e2e/servicebackend" - _ "k8s.io/ingress-nginx/test/e2e/settings" - _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" - _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" - _ "k8s.io/ingress-nginx/test/e2e/ssl" - _ "k8s.io/ingress-nginx/test/e2e/status" - _ "k8s.io/ingress-nginx/test/e2e/tcpudp" + // _ "k8s.io/ingress-nginx/test/e2e/admission" + // _ "k8s.io/ingress-nginx/test/e2e/annotations" + // _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/cgroups" + // _ "k8s.io/ingress-nginx/test/e2e/dbg" + // _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" + // _ "k8s.io/ingress-nginx/test/e2e/endpointslices" + // _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" + // _ "k8s.io/ingress-nginx/test/e2e/ingress" + // _ "k8s.io/ingress-nginx/test/e2e/leaks" + // _ "k8s.io/ingress-nginx/test/e2e/loadbalance" + // _ "k8s.io/ingress-nginx/test/e2e/lua" + // _ "k8s.io/ingress-nginx/test/e2e/nginx" + // _ "k8s.io/ingress-nginx/test/e2e/security" + // _ "k8s.io/ingress-nginx/test/e2e/servicebackend" + // _ "k8s.io/ingress-nginx/test/e2e/settings" + // _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" + // _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" + // _ "k8s.io/ingress-nginx/test/e2e/ssl" + // _ "k8s.io/ingress-nginx/test/e2e/status" + // _ "k8s.io/ingress-nginx/test/e2e/tcpudp" ) // RunE2ETests checks configuration parameters (specified through flags) and then runs From dad8086cb2b992c37736e2645aaabd0a36129735 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Apr 2023 16:09:58 -0500 Subject: [PATCH 132/822] added test boilerplate --- test/e2e/cgroups/cgroups.go | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 test/e2e/cgroups/cgroups.go diff --git a/test/e2e/cgroups/cgroups.go b/test/e2e/cgroups/cgroups.go new file mode 100644 index 000000000..ec9628bd5 --- /dev/null +++ b/test/e2e/cgroups/cgroups.go @@ -0,0 +1,36 @@ +/* +Copyright 2020 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package cgroups + +import ( + "github.com/onsi/ginkgo/v2" + + "k8s.io/ingress-nginx/test/e2e/framework" +) + +var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { + f := framework.NewDefaultFramework("cgroups") + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + f.NewSlowEchoDeployment() + }) + + ginkgo.It("run this test properly", func() { + + }) +}) From d3e75b056f77be54e01bdb18675f1bb46caece31 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 16 Apr 2023 14:10:42 -0700 Subject: [PATCH 133/822] Bump actions/add-to-project from 0.4.1 to 0.5.0 (#9840) Bumps [actions/add-to-project](https://github.com/actions/add-to-project) from 0.4.1 to 0.5.0. - [Release notes](https://github.com/actions/add-to-project/releases) - [Commits](https://github.com/actions/add-to-project/compare/4756e6330fe1e0a736690d3cfd9f11c9399c2ed4...31b3f3ccdc584546fc445612dec3f38ff5edb41c) --- updated-dependencies: - dependency-name: actions/add-to-project dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/project.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index 35d6d3e5c..95537e16c 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -13,7 +13,7 @@ jobs: repository-projects: write issues: write steps: - - uses: actions/add-to-project@4756e6330fe1e0a736690d3cfd9f11c9399c2ed4 # v0.4.1 + - uses: actions/add-to-project@31b3f3ccdc584546fc445612dec3f38ff5edb41c # v0.5.0 with: project-url: https://github.com/orgs/kubernetes/projects/104 github-token: ${{ secrets.PROJECT_WRITER }} From 7c4ac85a48c8d55417f33648dab87641a7105b7e Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Sun, 16 Apr 2023 16:11:05 -0500 Subject: [PATCH 134/822] more boilerplate --- test/e2e/cgroups/cgroups.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/test/e2e/cgroups/cgroups.go b/test/e2e/cgroups/cgroups.go index ec9628bd5..98148db8d 100644 --- a/test/e2e/cgroups/cgroups.go +++ b/test/e2e/cgroups/cgroups.go @@ -30,7 +30,15 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { f.NewSlowEchoDeployment() }) - ginkgo.It("run this test properly", func() { + ginkgo.It("detects number of CPUs properly in cgroups v1", func() { + + }) + + ginkgo.It("detects number of CPUs properly in cgroups v2", func() { + + }) + + ginkgo.It("detects cgroups version", func() { }) }) From 165d0573618c5bcd42962de100b75666c6fe15b3 Mon Sep 17 00:00:00 2001 From: Sridhar Nandigam Date: Sun, 16 Apr 2023 16:39:51 -0500 Subject: [PATCH 135/822] added a thing --- test/e2e/cgroups/cgroups.go | 7 +- test/junitreports/report-e2e-test-suite.xml | 1311 +++++++++++++++++++ 2 files changed, 1316 insertions(+), 2 deletions(-) create mode 100644 test/junitreports/report-e2e-test-suite.xml diff --git a/test/e2e/cgroups/cgroups.go b/test/e2e/cgroups/cgroups.go index 98148db8d..34d6c037a 100644 --- a/test/e2e/cgroups/cgroups.go +++ b/test/e2e/cgroups/cgroups.go @@ -18,8 +18,11 @@ package cgroups import ( "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" "k8s.io/ingress-nginx/test/e2e/framework" + + "k8s.io/ingress-nginx/pkg/util/runtime" ) var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { @@ -31,11 +34,11 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { }) ginkgo.It("detects number of CPUs properly in cgroups v1", func() { - + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) }) ginkgo.It("detects number of CPUs properly in cgroups v2", func() { - + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) }) ginkgo.It("detects cgroups version", func() { diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml new file mode 100644 index 000000000..fc919bad2 --- /dev/null +++ b/test/junitreports/report-e2e-test-suite.xml @@ -0,0 +1,1311 @@ + + + + + + + + + + + + + + + + + + + + + + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:40.576 (2m21.32s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:40.576 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:44.629 (4.053s) > Enter [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:44.629 < Exit [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:54.768 (10.139s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.768 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.976 (208ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:54.976 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:01.906 (6.93s) > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:01.906 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:12.967 (11.06s) > Enter [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:07:12.967 < Exit [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:09:21.17 (2m8.203s) > Enter [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.17 < Exit [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.399 (229ms) + + + > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:21.4 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:28.324 (6.924s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:28.324 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:39.376 (11.052s) > Enter [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:39.376 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:54 @ 04/04/23 18:09:56.563 STEP: ensuring that first entry in X-Forwarded-Host is used as the best host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:75 @ 04/04/23 18:09:56.572 < Exit [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:56.578 (17.202s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.578 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.789 (211ms) + + + > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:56.79 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.662 (6.873s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:03.662 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:07.688 (4.026s) > Enter [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:07.688 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:65 @ 04/04/23 18:10:07.688 STEP: sending request to www should redirect to domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:91 @ 04/04/23 18:10:22.913 STEP: sending request to domain should not redirect to www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:103 @ 04/04/23 18:10:22.941 < Exit [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:22.969 (15.281s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:22.969 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:23.209 (240ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:23.21 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.083 (7.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:31.083 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:35.101 (4.018s) > Enter [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:35.101 < Exit [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:45.308 (10.206s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.308 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.524 (217ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:45.525 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:52.399 (6.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:52.399 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:56.446 (4.048s) > Enter [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:10:56.446 < Exit [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:11:06.571 (10.124s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.571 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.765 (195ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.765 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.684 (6.918s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:13.684 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:17.714 (4.03s) > Enter [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:17.714 < Exit [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:27.946 (10.232s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:27.946 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:28.167 (220ms) + + + > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:28.167 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:36.071 (7.904s) > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:36.071 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:38.106 (2.035s) > Enter [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:11:38.106 < Exit [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:12:00.307 (22.201s) > Enter [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.307 < Exit [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.53 (223ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:00.531 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:07.492 (6.961s) > Enter [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:07.492 < Exit [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:24.818 (17.326s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:24.818 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:25.032 (214ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:25.033 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:32.425 (7.392s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:32.425 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:36.448 (4.023s) > Enter [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:36.448 < Exit [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:46.572 (10.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.572 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.787 (215ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:46.788 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:54.215 (7.427s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:54.215 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:02.279 (8.064s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:02.279 STEP: routing requests to the canary upstream when header pattern is matched - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:514 @ 04/04/23 18:13:19.503 STEP: routing requests to the mainline upstream when header failed to match header value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:523 @ 04/04/23 18:13:19.508 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:19.51 (17.231s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.51 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.813 (303ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:19.813 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:26.704 (6.89s) > Enter [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:26.704 < Exit [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:29.872 (3.169s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:29.872 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:30.073 (201ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:30.073 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.948 (7.874s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:37.948 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:41.967 (4.019s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:13:41.967 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:14:07.32 (25.353s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.32 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.487 (167ms) + + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:07.487 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.369 (6.882s) > Enter [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.369 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:107 @ 04/04/23 18:14:14.37 < Exit [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.37 (1ms) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.37 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.561 (191ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.561 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:21.468 (6.907s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:21.468 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:29.526 (8.058s) > Enter [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:14:29.526 STEP: routing requests to the canary upstream when cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:667 @ 04/04/23 18:14:46.664 STEP: routing requests to the mainline upstream when cookie is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:678 @ 04/04/23 18:14:54.864 STEP: routing requests to the mainline upstream when cookie is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:689 @ 04/04/23 18:15:04.858 < Exit [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:15:14.862 (45.336s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:14.862 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:15.079 (218ms) + + + > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:15.08 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.972 (7.892s) > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:22.972 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:26.998 (4.026s) > Enter [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:26.998 < Exit [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:37.18 (10.182s) > Enter [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.18 < Exit [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.392 (212ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:37.392 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:44.321 (6.929s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:44.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:50.372 (6.051s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:15:50.372 < Exit [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:16:15.956 (25.584s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:15.956 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:16.151 (195ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:16.152 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:25.575 (9.424s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:25.576 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:29.621 (4.045s) > Enter [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:29.621 STEP: setting enable-rewrite-log annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:38 @ 04/04/23 18:16:29.621 < Exit [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:42.864 (13.243s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:42.864 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:43.089 (224ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:43.089 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.483 (7.394s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:50.483 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:54.502 (4.019s) > Enter [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:16:54.502 < Exit [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:17:09.564 (15.063s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.564 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.781 (217ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:09.782 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:16.68 (6.899s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:16.68 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:20.71 (4.03s) > Enter [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:20.71 < Exit [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:50.976 (30.266s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:50.976 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:51.176 (200ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 (0s) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:51.177 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.072 (7.895s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:59.072 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:18:13.271 (14.199s) > Enter [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:13.271 < Exit [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:23.585 (10.314s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.585 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.805 (219ms) + + + > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:23.805 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:30.696 (6.891s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:30.696 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:34.717 (4.021s) > Enter [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:34.717 < Exit [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:57.987 (23.27s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:57.987 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:58.194 (208ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:58.195 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:08.072 (9.877s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:08.072 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:12.096 (4.024s) > Enter [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:12.096 < Exit [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:29.486 (17.39s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:29.486 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:30 (514ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 (0s) + + + > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:30.007 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:37.929 (7.922s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:37.929 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:41.957 (4.027s) > Enter [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:41.957 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:39 @ 04/04/23 18:19:41.957 STEP: sending request to www.fromtowwwredirect.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:55 @ 04/04/23 18:19:52.111 < Exit [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:52.114 (10.157s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.114 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.309 (195ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:52.309 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.222 (6.912s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:19:59.222 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:20:03.271 (4.049s) > Enter [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:03.271 < Exit [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:10.739 (7.468s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:10.739 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:11.546 (807ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:11.548 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.355 (8.808s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:20.355 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:28.54 (8.185s) > Enter [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:20:28.54 < Exit [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:21:23.965 (55.425s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:23.965 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:24.188 (223ms) + + + > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:24.188 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:32.093 (7.904s) > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:32.093 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:36.116 (4.023s) > Enter [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:21:36.116 STEP: turning on proxy_intercept_errors directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:59 @ 04/04/23 18:21:46.348 STEP: configuring error_page directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:62 @ 04/04/23 18:21:46.348 STEP: creating error locations - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:67 @ 04/04/23 18:21:46.348 STEP: updating configuration when only custom-http-error value changes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:72 @ 04/04/23 18:21:46.349 STEP: ignoring duplicate values (503 in this case) per server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:90 @ 04/04/23 18:21:50.55 STEP: using the custom default-backend from annotation for upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:102 @ 04/04/23 18:22:00.715 < Exit [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:22:08.9 (32.784s) > Enter [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:08.9 < Exit [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.112 (212ms) + + + > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.112 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.003 (7.891s) > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:17.003 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:21.032 (4.029s) > Enter [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:21.032 < Exit [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:31.159 (10.126s) > Enter [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.159 < Exit [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.365 (206ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:31.366 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:38.253 (6.887s) > Enter [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:38.253 < Exit [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:48.533 (10.28s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.533 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.75 (218ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:48.751 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:55.631 (6.88s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:55.631 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:59.653 (4.022s) > Enter [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:22:59.653 < Exit [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:23:08.743 (9.09s) > Enter [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:08.743 < Exit [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:18.9 (10.157s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:18.9 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.087 (187ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.087 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.019 (7.931s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.019 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.042 (4.023s) > Enter [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:31.042 < Exit [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:41.252 (10.21s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.252 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.433 (181ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:41.433 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:48.317 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:48.317 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:52.34 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:23:52.34 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:24:11.665 (19.325s) > Enter [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:11.665 < Exit [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:16.916 (5.251s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.295 (379ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.296 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:24.725 (7.429s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:24.725 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:28.761 (4.036s) > Enter [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:28.761 < Exit [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:45.952 (17.19s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:45.952 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:46.145 (194ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:46.146 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:54.048 (7.903s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:54.048 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:58.076 (4.028s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:24:58.076 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:03.11 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:13.321 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:23.483 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:33.694 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:25:48.897 (50.821s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.897 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.908 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:48.908 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:49.135 (227ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:49.135 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:56.988 (7.853s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:25:56.988 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:26:08.04 (11.052s) > Enter [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:08.04 < Exit [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:18.223 (10.184s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.223 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.414 (191ms) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:18.415 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.316 (6.901s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:25.316 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:29.352 (4.036s) > Enter [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:29.352 < Exit [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:46.584 (17.231s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.584 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.805 (221ms) + + + > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.805 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.714 (6.909s) > Enter [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:26:53.714 < Exit [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:27:03.859 (10.145s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.859 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:04.058 (199ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:04.058 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:22.496 (2m18.438s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:22.496 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:26.527 (4.032s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:26.527 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:40.697 (14.169s) > Enter [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:29:40.697 < Exit [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:30:03.916 (23.219s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:03.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:04.131 (215ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:04.131 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:12.003 (7.871s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:12.003 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:16.028 (4.025s) > Enter [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:16.028 < Exit [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:26.487 (10.459s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.487 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.704 (217ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:26.704 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:33.592 (6.888s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:33.592 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:44.636 (11.044s) > Enter [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:44.636 < Exit [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:54.792 (10.156s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.792 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.971 (179ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:54.971 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:56.98 (2.008s) > Enter [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:30:56.98 < Exit [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:31:57.006 (1m0.027s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.006 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.009 (3ms) + + + > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:57.009 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:03.889 (6.88s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:03.889 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:07.917 (4.028s) > Enter [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:07.917 < Exit [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:23.139 (15.222s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.139 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.334 (195ms) + + + > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:23.334 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:30.222 (6.888s) > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:30.222 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:34.249 (4.027s) > Enter [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:34.249 < Exit [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:41.274 (7.025s) > Enter [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.274 < Exit [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.496 (222ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:41.497 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:48.376 (6.879s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:48.376 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:52.403 (4.027s) > Enter [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:32:52.403 < Exit [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:33:00.451 (8.048s) > Enter [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:00.451 < Exit [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:24.697 (24.246s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.697 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.873 (176ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.873 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:32.238 (7.364s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:32.238 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:42.291 (10.053s) > Enter [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:42.291 < Exit [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:59.526 (17.235s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.526 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.709 (183ms) + + + > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:59.71 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.602 (6.893s) > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:06.602 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:10.627 (4.025s) > Enter [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:10.627 < Exit [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:27.807 (17.179s) > Enter [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:27.807 < Exit [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:28.007 (200ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:28.007 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:35.896 (7.889s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:35.896 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:39.916 (4.02s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:34:39.916 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:34:57.039 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:35:05.187 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:35:05.197 (25.281s) > Enter [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:05.197 STEP: serving the default certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:204 @ 04/04/23 18:35:10.227 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:214 @ 04/04/23 18:35:10.293 < Exit [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:10.293 (5.095s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.293 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.501 (209ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:10.502 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:17.387 (6.885s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:17.387 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:21.413 (4.026s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:21.413 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:42.607 (21.195s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.607 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.616 (9ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.832 (216ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.832 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:49.737 (6.905s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:49.737 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:54.76 (5.023s) > Enter [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:35:54.76 < Exit [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:36:04.978 (10.218s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:04.978 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:05.161 (183ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.162 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:13.068 (7.906s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:13.068 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:17.096 (4.027s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:17.096 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:36:34.288 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:36:42.473 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:42.5 (25.405s) > Enter [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:42.5 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:163 @ 04/04/23 18:36:47.607 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:169 @ 04/04/23 18:36:50.731 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:180 @ 04/04/23 18:36:53.763 < Exit [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:53.763 (11.263s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.763 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.98 (217ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:53.981 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:00.852 (6.872s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:00.852 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:13.899 (13.046s) > Enter [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:13.899 < Exit [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:27.067 (13.169s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.067 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.254 (186ms) + + + > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:27.254 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:35.134 (7.88s) > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:35.134 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:39.153 (4.019s) > Enter [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:37:39.153 < Exit [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:38:10.344 (31.191s) > Enter [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.344 < Exit [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.535 (191ms) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:10.535 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:17.414 (6.879s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:17.414 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:21.437 (4.023s) > Enter [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:21.437 < Exit [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:38.614 (17.177s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.614 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.835 (221ms) + + + > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:38.836 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:45.698 (6.862s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:45.698 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:49.734 (4.036s) > Enter [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:49.734 < Exit [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:59.959 (10.225s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:59.959 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:00.179 (220ms) + + + + > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.179 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:08.619 (8.44s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:08.619 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:12.644 (4.025s) > Enter [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.644 [SKIPPED] GeoIP test are temporarily disabled In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:71 @ 04/04/23 18:39:12.645 < Exit [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.645 (1ms) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.645 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.862 (217ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:12.863 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:19.76 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:19.76 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:23.829 (4.069s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:23.829 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:33.03 (9.2s) > Enter [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:33.03 < Exit [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:43.259 (10.229s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.259 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.444 (186ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:43.445 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:50.328 (6.883s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:50.328 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:58.361 (8.034s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:40:08.534 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:40:18.725 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:40:28.928 (30.567s) > Enter [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:28.928 STEP: Adding a global-auth-response-headers to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:228 @ 04/04/23 18:40:28.928 < Exit [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:39.119 (10.19s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.119 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.335 (216ms) + + + > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.335 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:46.231 (6.896s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:46.231 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:48.266 (2.035s) > Enter [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:40:48.266 < Exit [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:41:05.463 (17.198s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.463 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.678 (215ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:24.95 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:57.132 (32.182s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:41:57.132 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:05.196 (8.064s) > Enter [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:05.196 < Exit [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:08.558 (3.362s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.558 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.881 (323ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:08.881 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:27.269 (18.388s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:27.269 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:35.33 (8.061s) > Enter [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.33 < Exit [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.482 (152ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.482 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.681 (199ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:35.681 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:54.33 (18.649s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:54.33 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 21:18:55.121 (10.056s) > Enter [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:55.121 < Exit [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:58.366 (3.245s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.367 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.612 (246ms) + + + > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:18:58.613 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:05.487 (6.875s) > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:05.487 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:09.523 (4.036s) > Enter [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:09.523 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:53 @ 04/04/23 21:19:19.701 < Exit [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:19.839 (10.316s) > Enter [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:19.839 < Exit [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:20.061 (222ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:20.061 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:17:57.17 (30.737s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:17:57.17 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:18:05.234 (8.065s) > Enter [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:05.234 < Exit [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:08.53 (3.296s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.53 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.765 (235ms) + + + > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:08.766 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:22.642 (13.877s) > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:22.642 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:48.76 (26.118s) > Enter [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:48.76 < Exit [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:55.044 (6.284s) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.044 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.29 (246ms) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.29 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.293 (3ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:55.294 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:12.977 (17.683s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:12.977 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:21.048 (8.072s) > Enter [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.048 < Exit [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.18 (132ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.18 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.377 (197ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:21.377 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:52.511 (31.134s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:52.511 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:00.575 (8.064s) > Enter [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:00.575 STEP: rejects ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:52 @ 04/04/23 22:20:00.575 STEP: accepts ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:57 @ 04/04/23 22:20:00.587 < Exit [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:10.885 (10.31s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:10.885 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:11.143 (257ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:11.143 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:29.584 (18.441s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:29.584 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:37.66 (8.076s) > Enter [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:37.66 < Exit [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:44.7 (7.04s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.7 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.899 (199ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:44.899 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:03.976 (19.078s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:03.976 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:12.046 (8.07s) > Enter [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:12.046 < Exit [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:19.079 (7.033s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.079 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.337 (258ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:19.337 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:37.731 (18.394s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:37.731 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:45.791 (8.06s) > Enter [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.791 < Exit [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.852 (61ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:45.852 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:46.057 (205ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:46.057 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:04.907 (18.85s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:04.907 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:12.968 (8.061s) > Enter [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:12.968 < Exit [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:18.358 (5.39s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.358 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.592 (234ms) + + + > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:18.592 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:47.015 (28.422s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:47.015 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:55.073 (8.059s) > Enter [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:55.073 < Exit [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:58.439 (3.366s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.439 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.64 (201ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.251 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.76 (7.509s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:26.76 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:38.808 (12.048s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:04:38.808 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:04:55.931 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:05:04.12 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:05:04.15 (25.342s) > Enter [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.15 < Exit [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.174 (24ms) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.174 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.407 (234ms) + + + > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.408 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.385 (6.978s) > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:11.385 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:15.42 (4.034s) > Enter [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:15.42 < Exit [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:22.428 (7.008s) > Enter [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.428 < Exit [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.626 (198ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:22.626 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:29.568 (6.942s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:29.568 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:33.606 (4.037s) > Enter [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:33.606 < Exit [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:43.732 (10.127s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.732 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.917 (184ms) + + + > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:43.917 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:51.802 (7.885s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:51.802 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:55.831 (4.029s) > Enter [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:05:55.831 < Exit [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:06:05.978 (10.147s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:05.978 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:06.188 (210ms) + + + > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:06.189 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:14.133 (7.945s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:14.133 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:18.165 (4.031s) > Enter [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:18.165 < Exit [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:35.378 (17.213s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.378 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.637 (259ms) + + + > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:35.637 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:42.521 (6.884s) > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:42.521 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:46.54 (4.019s) > Enter [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:06:46.54 < Exit [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:07:17.039 (30.499s) > Enter [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.039 < Exit [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.22 (180ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:17.22 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:24.225 (7.005s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:24.225 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:26.256 (2.031s) > Enter [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:26.256 < Exit [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:36.45 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.45 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.633 (183ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:36.633 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:43.537 (6.903s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:43.537 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:51.596 (8.059s) > Enter [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:07:51.596 < Exit [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:08:08.813 (17.217s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:08.813 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:09.063 (249ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:09.063 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:16.959 (7.896s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:16.959 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:25.017 (8.058s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:08:35.191 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:08:45.372 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:55.507 (30.491s) > Enter [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:08:55.507 STEP: Adding a global-auth-cache-key to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:163 @ 04/04/23 18:08:55.507 < Exit [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:09:12.69 (17.183s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.69 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.914 (224ms) + + + > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:12.915 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:19.799 (6.884s) > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:19.799 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:23.825 (4.026s) > Enter [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:23.825 < Exit [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:41.065 (17.24s) > Enter [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.065 < Exit [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.299 (233ms) + + + > Enter [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:41.299 < Exit [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:49.196 (7.896s) > Enter [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:09:49.196 < Exit [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:10:01.416 (12.22s) > Enter [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.416 < Exit [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.602 (187ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:01.603 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:08.48 (6.877s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:08.48 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:12.502 (4.022s) > Enter [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:12.502 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:69 @ 04/04/23 18:10:12.502 STEP: making a request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:78 @ 04/04/23 18:10:22.752 STEP: creating an ingress definition with the rewrite-target annotation set on the "/" location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:88 @ 04/04/23 18:10:22.759 STEP: making a second request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:102 @ 04/04/23 18:10:32.852 < Exit [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:32.86 (20.358s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:32.86 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:33.04 (180ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:33.04 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:40.925 (7.885s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:40.925 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:44.945 (4.02s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:44.945 Apr 4 18:10:54.109: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:56.109 (11.164s) > Enter [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:10:56.109 < Exit [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:11:06.315 (10.206s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.315 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.527 (212ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.528 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.431 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:13.431 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:21.479 (8.048s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:21.479 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:49.732 (28.253s) > Enter [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:49.732 < Exit [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:56.743 (7.011s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.743 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.926 (183ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.926 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:03.815 (6.889s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:03.815 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:11.862 (8.047s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:11.862 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:40.103 (28.241s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.103 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.112 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.112 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.334 (222ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:40.335 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.184 (6.849s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.184 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.214 (4.031s) > Enter [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:51.214 < Exit [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:58.232 (7.018s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.232 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.436 (203ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.436 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:05.332 (6.896s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:05.332 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:09.361 (4.029s) > Enter [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:09.361 < Exit [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:21.468 (12.107s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.468 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.639 (171ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.639 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.514 (7.875s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:29.514 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:33.537 (4.023s) > Enter [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:33.537 < Exit [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:47.331 (13.794s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.331 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.532 (202ms) + + + > Enter [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:47.533 < Exit [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:54.43 (6.897s) > Enter [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:13:54.43 < Exit [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:14:10.603 (16.173s) > Enter [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.603 < Exit [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.797 (195ms) + + + > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.798 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.742 (6.944s) > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:17.742 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:21.766 (4.024s) > Enter [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:21.766 < Exit [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:31.914 (10.148s) > Enter [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:31.914 < Exit [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.125 (211ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.125 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.045 (7.92s) > Enter [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:40.045 < Exit [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:50.345 (10.299s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.345 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.661 (317ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.662 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.86 (7.198s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:57.86 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:15:01.901 (4.041s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:01.901 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:16.075 (14.174s) > Enter [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:16.075 < Exit [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:39.289 (23.214s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.289 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.523 (234ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:39.523 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:46.413 (6.89s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:46.413 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:05.358 (18.945s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:05.358 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:08.518 (3.16s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.518 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.699 (180ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:08.699 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:15.641 (6.942s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:15.641 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:26.725 (11.084s) > Enter [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:16:26.725 < Exit [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:17:59.041 (1m32.316s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.041 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.27 (229ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.27 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.156 (7.885s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:07.156 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:19.212 (12.057s) > Enter [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:19.212 < Exit [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:39.618 (20.406s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.618 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.83 (212ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.831 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.716 (6.885s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:46.716 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:50.744 (4.028s) > Enter [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:18:50.744 < Exit [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:19:00.902 (10.159s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:00.902 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:01.091 (189ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:01.092 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:09.007 (7.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:09.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:17.081 (8.074s) > Enter [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:17.081 < Exit [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:24.105 (7.024s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.388 (283ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:24.389 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.748 (2m19.359s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:43.748 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:57.954 (14.206s) > Enter [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:21:57.954 < Exit [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:22:20.304 (22.351s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.304 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.502 (198ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:20.503 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:27.369 (6.866s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:27.369 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:31.399 (4.03s) > Enter [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:31.399 < Exit [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:41.545 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.545 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.748 (203ms) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.748 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:58.304 (2m16.556s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:24:58.304 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:25:07.351 (9.047s) > Enter [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:07.351 < Exit [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:17.463 (10.112s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.463 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.721 (257ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:17.721 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36 (2m18.279s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:40.022 (4.023s) > Enter [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:40.022 < Exit [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:50.223 (10.201s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.224 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.413 (190ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.414 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.312 (13.898s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:04.312 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:11.43 (7.118s) > Enter [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:11.43 Apr 4 18:28:24.664: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not forwarded-headers < Exit [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:29.799 (18.368s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:29.799 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:30.029 (230ms) + + + > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:30.03 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:36.888 (6.859s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:36.888 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:40.919 (4.03s) > Enter [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:40.919 < Exit [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:51.095 (10.176s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.095 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.273 (178ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:51.273 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:59.672 (8.399s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:28:59.672 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:07.713 (8.041s) > Enter [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:07.713 STEP: routing requests destined for the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:351 @ 04/04/23 18:29:32.166 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:360 @ 04/04/23 18:29:32.169 < Exit [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:32.172 (24.459s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.172 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.356 (184ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:32.356 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:39.249 (6.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:39.249 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:43.271 (4.022s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:43.271 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:57.423 (14.152s) > Enter [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:29:57.423 < Exit [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:30:20.684 (23.26s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.684 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.873 (189ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:20.873 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:27.823 (6.95s) > Enter [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:27.823 < Exit [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:49.071 (21.248s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.071 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.267 (196ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:49.267 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:56.179 (6.912s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:30:56.179 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:31:00.207 (4.028s) > Enter [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:00.207 < Exit [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:10.334 (10.127s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.334 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.562 (228ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:10.562 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:17.468 (6.905s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:17.468 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:21.488 (4.02s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:21.488 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:35.745 (14.257s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:35.745 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:46.949 (11.204s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:46.949 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:47.158 (209ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:47.158 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.054 (7.895s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:55.054 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:59.086 (4.032s) > Enter [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:31:59.086 < Exit [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:32:06.117 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.117 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.335 (217ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:06.335 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:13.216 (6.881s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:13.216 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:30.126 (16.91s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:30.126 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:34.111 (3.985s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.111 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.285 (174ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:34.285 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.164 (7.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:42.164 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:46.19 (4.026s) > Enter [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:46.19 < Exit [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:53.221 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.221 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.428 (207ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:53.428 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.295 (6.867s) > Enter [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:00.295 < Exit [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:17.519 (17.224s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.519 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.698 (178ms) + + + > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:17.698 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.578 (6.881s) > Enter [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:24.578 < Exit [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:34.73 (10.152s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.73 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.905 (175ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:34.906 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:44.808 (9.902s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:44.808 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:55.842 (11.034s) > Enter [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:33:55.842 < Exit [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:34:05.994 (10.152s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:05.994 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.258 (264ms) + + + + + + > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.259 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:14.168 (7.909s) > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:14.168 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:25.207 (11.04s) > Enter [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:25.207 < Exit [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:36.4 (11.193s) > Enter [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.4 < Exit [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.599 (199ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:36.6 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:44.48 (7.88s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.48 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:48.503 (4.024s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:34:48.503 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:35:02.728 (14.224s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.728 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.742 (15ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.742 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.951 (209ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:02.951 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:09.829 (6.877s) > Enter [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:09.829 < Exit [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:30.35 (20.521s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.35 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.552 (202ms) + + + > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:30.552 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:37.481 (6.929s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:37.481 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:48.587 (11.106s) > Enter [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:35:48.587 < Exit [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:36:17.402 (28.814s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.402 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.602 (201ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.603 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:24.47 (6.867s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:24.47 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:35.523 (11.052s) > Enter [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:35.523 < Exit [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:45.69 (10.167s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.69 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.908 (218ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.908 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.807 (6.899s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:52.807 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:56.83 (4.024s) > Enter [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:36:56.83 < Exit [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:37:10.803 (13.972s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.803 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.971 (169ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.972 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.855 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:17.855 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:21.879 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:21.879 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:43.087 (21.209s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.087 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.095 (8ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.095 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.321 (225ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:43.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:50.242 (6.92s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:50.242 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:58.297 (8.055s) > Enter [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:37:58.297 < Exit [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:38:15.503 (17.206s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.503 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.723 (220ms) + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.724 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:22.643 (6.92s) > Enter [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:22.643 STEP: basic HTTP GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.644 STEP: basic HTTP GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.657 STEP: basic HTTPS GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.667 STEP: basic HTTPS GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.695 STEP: basic HTTP POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.708 STEP: basic HTTP POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.712 STEP: basic HTTPS POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.052 STEP: basic HTTPS POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.468 STEP: basic HTTP GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.852 STEP: basic HTTP GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.25 STEP: basic HTTPS GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.647 STEP: basic HTTPS GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.07 STEP: basic HTTP POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.469 STEP: basic HTTP POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.847 STEP: basic HTTPS POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.252 STEP: basic HTTPS POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.65 < Exit [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:32.067 (9.424s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.067 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.276 (208ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:32.276 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:40.184 (7.908s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:40.184 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:48.25 (8.066s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:38:58.421 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:39:08.584 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:18.813 (30.563s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:18.813 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 04/04/23 18:39:18.813 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 04/04/23 18:39:29.026 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 04/04/23 18:39:29.042 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:29.049 (10.236s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.049 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.257 (208ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.257 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:37.143 (7.885s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:37.143 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:39.168 (2.025s) > Enter [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:39.168 < Exit [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:56.292 (17.124s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.292 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.478 (186ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:56.478 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.36 (6.881s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:03.36 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:14.407 (11.047s) > Enter [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:14.407 < Exit [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:24.598 (10.191s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.598 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.819 (221ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:24.819 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.201 (14.382s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:39.201 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:46.467 (7.266s) > Enter [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:46.467 < Exit [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:56.662 (10.195s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.662 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.852 (191ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.258 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.76 (8.502s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:27.76 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:39.782 (12.022s) > Enter [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:39.782 < Exit [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:49.993 (10.211s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.993 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:50.223 (229ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:50.223 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:58.145 (7.922s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:04:58.145 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:05:02.17 (4.025s) > Enter [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:02.17 < Exit [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:19.394 (17.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.394 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.624 (230ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:19.625 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:26.544 (6.92s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:26.544 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:30.589 (4.045s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:30.589 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:58.841 (28.251s) > Enter [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:05:58.841 < Exit [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:06:22.065 (23.224s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.065 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.266 (201ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:22.267 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:29.196 (6.929s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:29.196 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:40.24 (11.044s) > Enter [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:40.24 < Exit [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:50.425 (10.185s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.425 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.601 (177ms) + + + > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.602 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.545 (6.943s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:06:57.545 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:07:01.588 (4.043s) > Enter [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:01.588 < Exit [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:11.685 (10.097s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.685 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.883 (198ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.883 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:18.774 (6.89s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:18.774 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:22.815 (4.041s) > Enter [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:22.815 < Exit [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:29.864 (7.049s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:29.864 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:30.072 (208ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:30.072 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:48.992 (2m18.92s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:48.992 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:53.047 (4.055s) > Enter [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:09:53.047 < Exit [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:10:03.229 (10.182s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.229 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.446 (217ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.446 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:10.362 (6.916s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:10.362 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:14.4 (4.038s) > Enter [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:14.4 < Exit [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:24.616 (10.216s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.82 (204ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:24.821 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.7 (6.879s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:31.7 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:42.759 (11.059s) > Enter [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:10:42.759 < Exit [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:12:14.993 (1m32.235s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:14.993 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:15.384 (390ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:15.384 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:22.265 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:22.265 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:24.285 (2.02s) > Enter [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:24.285 < Exit [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:34.441 (10.156s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.441 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.624 (183ms) + + + > Enter [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:34.624 < Exit [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:41.556 (6.931s) > Enter [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:12:41.556 < Exit [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:13:01.842 (20.286s) > Enter [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.842 < Exit [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:02.025 (183ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.025 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:09.923 (7.898s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:09.923 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:13.962 (4.038s) > Enter [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:13.962 < Exit [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:20.977 (7.016s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:20.977 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.159 (181ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.159 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.044 (7.885s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:29.044 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:40.088 (11.044s) > Enter [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:40.088 < Exit [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:50.23 (10.141s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.23 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.426 (197ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:50.427 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.36 (6.933s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:57.36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:01.385 (4.026s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:01.385 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:06.428 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:16.618 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:26.768 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:36.897 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:52.087 (50.702s) > Enter [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:14:52.087 STEP: logging into server thisHost /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:821 @ 04/04/23 18:14:52.087 STEP: receiving an internal server error without cache on thisHost location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:833 @ 04/04/23 18:14:59.113 < Exit [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:15:59.128 (1m7.041s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.128 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.362 (234ms) + + + > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.363 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.334 (6.971s) > Enter [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:06.334 < Exit [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:20.803 (14.469s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.803 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:21.76 (957ms) + + + > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:21.77 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.035 (9.266s) > Enter [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:31.035 STEP: setting permanent-redirect annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:34 @ 04/04/23 18:16:31.036 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:52 @ 04/04/23 18:16:41.175 < Exit [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:41.182 (10.147s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.182 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.409 (227ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.409 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:57.856 (2m16.447s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:57.856 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:19:09.919 (12.063s) > Enter [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:09.919 < Exit [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:20.272 (10.353s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.272 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.675 (403ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:20.677 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.892 (8.215s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:28.892 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:32.924 (4.032s) > Enter [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:32.924 < Exit [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:43.863 (10.939s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:43.863 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:44.064 (200ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:44.064 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.434 (9.37s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:53.434 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:55.451 (2.017s) > Enter [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:19:55.451 < Exit [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:20:12.863 (17.412s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.863 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.699 (836ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 (0s) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.7 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:22.723 (9.023s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:22.723 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:26.762 (4.038s) > Enter [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:26.762 < Exit [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:36.907 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:36.907 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:37.137 (230ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:37.137 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:45.044 (7.907s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:45.044 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:49.07 (4.026s) > Enter [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:20:49.07 < Exit [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:21:06.287 (17.217s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.287 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.513 (226ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 (0s) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:06.513 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:13.397 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:13.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:15.42 (2.023s) > Enter [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:15.42 < Exit [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:26.454 (11.034s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.454 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.651 (198ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.652 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:33.515 (6.863s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:33.515 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:43.707 (10.192s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.707 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.924 (216ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.924 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:50.816 (6.892s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:50.816 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:54.851 (4.035s) > Enter [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:21:54.851 < Exit [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:22:01.873 (7.022s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:01.873 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:02.061 (188ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:02.061 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.943 (7.882s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:09.943 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:20.994 (11.051s) > Enter [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:20.994 < Exit [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:34.191 (13.197s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.191 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.407 (216ms) + + + > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:34.407 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.334 (6.927s) > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:41.334 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:45.355 (4.021s) > Enter [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:22:45.355 STEP: Checking exact request to / - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:63 @ 04/04/23 18:23:02.535 STEP: Checking prefix request to /bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:76 @ 04/04/23 18:23:02.543 STEP: Checking exact request to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:109 @ 04/04/23 18:23:19.72 STEP: Checking prefix request to /foo/bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:122 @ 04/04/23 18:23:19.723 STEP: Checking prefix request to /foobar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:134 @ 04/04/23 18:23:19.724 < Exit [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:23:19.726 (34.371s) > Enter [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.726 < Exit [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.917 (190ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.917 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.858 (7.94s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.858 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.884 (4.027s) > Enter [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:31.884 < Exit [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:42.035 (10.15s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.035 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.253 (218ms) + + + > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:42.254 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.152 (7.898s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:50.152 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:59.193 (9.041s) > Enter [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:23:59.193 < Exit [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:24:16.594 (17.4s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.594 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.994 (401ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:16.995 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.428 (8.433s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:25.428 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:33.475 (8.047s) > Enter [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:24:33.475 < Exit [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:25:28.827 (55.352s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:28.827 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:29.073 (245ms) + + + > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:29.073 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:35.955 (6.882s) > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:35.955 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:39.976 (4.021s) > Enter [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:39.976 < Exit [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:50.116 (10.14s) > Enter [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.116 < Exit [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.35 (233ms) + + + > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:50.35 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:57.262 (6.911s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:25:57.262 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:26:08.325 (11.063s) > Enter [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:08.325 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:54 @ 04/04/23 18:26:25.541 < Exit [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:25.551 (17.226s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.551 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.758 (207ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.758 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:32.641 (6.883s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:32.641 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:36.668 (4.026s) > Enter [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:36.668 < Exit [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:46.879 (10.212s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.879 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.059 (180ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.06 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.958 (6.898s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:53.958 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:57.986 (4.028s) > Enter [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:26:57.986 < Exit [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:27:27.257 (29.271s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.257 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.443 (186ms) + + + > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:27.443 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:34.37 (6.927s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:34.37 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:38.399 (4.029s) > Enter [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:27:38.399 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:115 @ 04/04/23 18:27:55.604 STEP: sending request from an implicitly denied IP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:123 @ 04/04/23 18:27:55.61 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:131 @ 04/04/23 18:27:55.616 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:139 @ 04/04/23 18:27:55.623 < Exit [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:28:02.653 (24.254s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.653 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.902 (249ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:02.903 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:09.803 (6.9s) > Enter [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:09.803 < Exit [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:20.04 (10.238s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.041 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.276 (236ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:20.277 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:28.169 (7.892s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:28.169 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:30.185 (2.016s) > Enter [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:30.185 < Exit [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:40.334 (10.15s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.334 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.52 (185ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:40.52 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:47.397 (6.877s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:47.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:51.425 (4.028s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:28:51.425 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:05.527 (14.103s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.527 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.539 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.539 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.766 (227ms) + + + > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:05.767 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:12.664 (6.897s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:12.664 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:16.693 (4.029s) > Enter [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:16.693 < Exit [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:33.899 (17.207s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:33.899 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:34.123 (224ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:34.124 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:42.012 (7.888s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:42.012 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:46.039 (4.027s) > Enter [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:46.039 < Exit [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:56.186 (10.147s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.186 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.375 (189ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.375 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:03.267 (6.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:03.267 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:07.298 (4.031s) > Enter [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:07.298 < Exit [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:17.47 (10.172s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.47 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.686 (215ms) + + + > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.686 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.008 (2m17.322s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:35.008 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:39.033 (4.025s) > Enter [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:39.033 < Exit [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:52.207 (13.174s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.207 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.41 (203ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:52.41 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:59.312 (6.902s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:32:59.312 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:33:03.343 (4.031s) > Enter [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:03.343 < Exit [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:13.571 (10.227s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.571 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.79 (220ms) + + + > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:13.791 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:20.666 (6.876s) > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:20.666 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:24.686 (4.02s) > Enter [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:33:24.686 STEP: running cfssl gencert -initca ca_csr.json | cfssljson -bare ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:31.697 STEP: running cfssl gencert -ca ca.pem -ca-key ca-key.pem -config=cfssl_config.json -profile=intermediate intermediate_ca_csr.json | cfssljson -bare intermediate_ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.042 STEP: running cfssl gencert -ca intermediate_ca.pem -ca-key intermediate_ca-key.pem -config=cfssl_config.json -profile=ocsp ocsp_csr.json | cfssljson -bare ocsp - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.211 STEP: running cfssl serve -db-config=db-config.json -ca-key=intermediate_ca-key.pem -ca=intermediate_ca.pem -config=cfssl_config.json -responder=ocsp.pem -responder-key=ocsp-key.pem - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:228 @ 04/04/23 18:33:32.385 STEP: running cfssl gencert -remote=localhost -profile=server leaf_csr.json | cfssljson -bare leaf - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:238 @ 04/04/23 18:33:37.385 STEP: running cfssl ocsprefresh -ca intermediate_ca.pem -responder=ocsp.pem -responder-key=ocsp-key.pem -db-config=db-config.json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:252 @ 04/04/23 18:33:37.548 < Exit [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:34:06.016 (41.33s) > Enter [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.016 < Exit [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.329 (312ms) + + + > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.329 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:13.238 (6.909s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:13.238 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:17.265 (4.027s) > Enter [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:17.265 < Exit [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:33.244 (15.979s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.244 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.413 (169ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:33.413 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:40.3 (6.887s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:40.3 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.318 (4.018s) > Enter [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:44.318 < Exit [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:54.489 (10.171s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.489 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.674 (185ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:54.674 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:01.542 (6.868s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:01.542 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:15.829 (14.287s) > Enter [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:15.829 < Exit [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:42.1 (26.271s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.1 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.298 (198ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.298 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:50.176 (7.878s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:50.176 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:54.197 (4.021s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:35:54.197 Apr 4 18:36:03.338: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:36:05.327 (11.13s) > Enter [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:05.327 < Exit [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:15.512 (10.185s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.512 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.744 (233ms) + + + > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:15.745 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:23.617 (7.872s) > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:23.617 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:27.64 (4.023s) > Enter [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:27.64 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:48 @ 04/04/23 18:36:37.807 < Exit [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:37.815 (10.175s) > Enter [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:37.815 < Exit [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:38.05 (235ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:38.05 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.936 (7.886s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:45.936 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:47.961 (2.026s) > Enter [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:47.961 < Exit [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:58.079 (10.118s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.079 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.306 (226ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:58.306 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:16.416 (2m18.11s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:16.416 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:20.463 (4.047s) > Enter [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:20.463 < Exit [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:49.668 (29.205s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.668 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.888 (220ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:49.888 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:57.8 (7.912s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:57.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:40:01.823 (4.023s) > Enter [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:01.823 Apr 4 18:40:10.971: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:12.979 (11.155s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:12.979 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:13.188 (209ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:13.188 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:21.087 (7.899s) > Enter [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:21.087 < Exit [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:31.585 (10.498s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.585 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.773 (188ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.773 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:38.672 (6.898s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:38.672 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:42.706 (4.034s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:42.706 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:56.901 (14.195s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.901 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.912 (10ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.912 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.097 (186ms) + + + I0404 18:04:54.427675 25 request.go:690] Waited for 1.19834838s due to client-side throttling, not priority and fairness, request: GET:https://10.96.0.1:443/api/v1/namespaces/e2e-tests-limit-connections-1680631459257336272-jn44f/services/nginx-ingress-controller + > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.817 (7.56s) > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:26.817 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:38.845 (12.028s) > Enter [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:04:38.845 < Exit [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:05:03.259 (24.414s) > Enter [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.259 < Exit [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.482 (224ms) + + + > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:03.483 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:10.366 (6.883s) > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:10.366 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:14.405 (4.039s) > Enter [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:14.405 < Exit [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:41.807 (27.402s) > Enter [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:41.807 < Exit [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:42.078 (271ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:42.079 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:50.08 (8.002s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:50.08 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:54.108 (4.028s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:05:54.108 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:06:21.53 (27.422s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.53 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.804 (274ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.804 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.705 (6.901s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:28.705 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:32.732 (4.027s) > Enter [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:32.732 < Exit [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:39.756 (7.024s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.756 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.957 (201ms) + + + > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:39.958 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:47.864 (7.907s) > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:47.864 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:51.912 (4.047s) > Enter [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:06:51.912 < Exit [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:07:02.086 (10.175s) > Enter [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.086 < Exit [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.297 (211ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:02.297 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:10.188 (7.891s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:10.188 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:14.226 (4.037s) > Enter [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:14.226 < Exit [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:25.018 (10.792s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.018 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.219 (201ms) + + + > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:25.22 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:33.104 (7.884s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:33.104 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:35.129 (2.025s) > Enter [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:35.129 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:61 @ 04/04/23 18:07:52.29 STEP: sending request from an explicitly denied IP address - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:69 @ 04/04/23 18:07:52.298 STEP: sending request from an implicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:77 @ 04/04/23 18:07:52.304 < Exit [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:59.326 (24.197s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.326 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.52 (194ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.52 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:06.412 (6.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:06.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:14.461 (8.049s) > Enter [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:14.461 < Exit [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:31.701 (17.24s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.701 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.909 (208ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:31.909 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:39.801 (7.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:39.801 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:43.836 (4.035s) > Enter [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:43.836 < Exit [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:54.106 (10.269s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.106 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.318 (212ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:54.318 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:01.207 (6.889s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:01.207 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:09.264 (8.058s) > Enter [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:09.264 STEP: routing requests to the mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:591 @ 04/04/23 18:09:26.43 < Exit [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:26.434 (17.169s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.434 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.658 (224ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:26.658 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:33.593 (6.935s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:33.593 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:37.637 (4.044s) > Enter [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:09:37.637 < Exit [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:10:02.989 (25.352s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:02.989 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.188 (199ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.189 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.089 (7.901s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:11.09 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:19.123 (8.033s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:10:29.295 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:10:39.491 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:49.631 (30.509s) > Enter [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:49.631 STEP: Adding a global-auth-method to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:202 @ 04/04/23 18:10:49.631 < Exit [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:59.844 (10.213s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:59.844 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:00.053 (208ms) + + + > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:00.053 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:17.888 (2m17.835s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:17.888 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:21.926 (4.038s) > Enter [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:21.926 < Exit [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:39.103 (17.177s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.103 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.316 (214ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:39.317 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:46.2 (6.883s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:46.2 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:51.228 (5.028s) > Enter [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:13:51.228 < Exit [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:14:01.351 (10.123s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.351 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.572 (222ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:01.573 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:08.451 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:08.451 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:12.484 (4.033s) > Enter [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:12.484 < Exit [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:22.62 (10.136s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.62 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.8 (179ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:22.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:29.697 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:29.697 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:33.724 (4.026s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:33.724 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:43.071 (9.347s) > Enter [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:43.071 < Exit [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:50.277 (7.207s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.277 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.564 (287ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.566 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.791 (7.225s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:57.791 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:15:01.819 (4.028s) > Enter [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:01.819 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:94 @ 04/04/23 18:15:18.959 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:101 @ 04/04/23 18:15:21.991 < Exit [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:22.003 (20.184s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.003 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.173 (170ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.173 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:30.052 (7.879s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:30.052 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:32.076 (2.024s) > Enter [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:32.076 < Exit [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:42.292 (10.217s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.292 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.533 (240ms) + + + > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:42.533 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:49.463 (6.93s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:49.463 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:08.363 (18.9s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:08.363 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:11.514 (3.151s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.514 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.73 (216ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:11.73 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:18.612 (6.881s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:18.612 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:28.726 (10.115s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:16:38.887 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:16:49.114 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:59.322 (30.595s) > Enter [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:87 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:94 @ 04/04/23 18:16:59.333 < Exit [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.342 (20ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.342 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.57 (229ms) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:59.571 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:06.433 (6.862s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:06.433 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:18.505 (12.072s) > Enter [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:18.505 < Exit [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:28.675 (10.171s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.675 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.85 (174ms) + + + > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:28.85 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:37.72 (8.87s) > Enter [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:37.72 < Exit [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:40.919 (3.199s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:40.919 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:41.126 (207ms) + + + > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:41.126 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:49.014 (7.887s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:49.014 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:53.032 (4.018s) > Enter [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:17:53.032 Apr 4 18:18:09.269: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:18:11.272 (18.241s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.272 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.48 (208ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:11.48 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:18.335 (6.854s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:18.335 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:22.355 (4.02s) > Enter [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:22.355 < Exit [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:32.501 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.501 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.736 (236ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:32.737 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.632 (6.895s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:39.632 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:50.669 (11.037s) > Enter [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:18:50.669 < Exit [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:20:22.888 (1m32.219s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:22.888 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:23.276 (388ms) + + + > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:23.277 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:31.164 (7.887s) > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:31.164 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:33.226 (2.062s) > Enter [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:33.226 < Exit [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:43.402 (10.176s) > Enter [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.402 < Exit [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.603 (201ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:43.603 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:50.486 (6.883s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:50.486 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:54.514 (4.028s) > Enter [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:20:54.514 < Exit [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:21:04.738 (10.224s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.738 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.947 (209ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.947 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:11.835 (6.888s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:11.835 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:15.853 (4.017s) > Enter [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:15.853 < Exit [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:26.03 (10.178s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.03 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.226 (196ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.227 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.123 (7.896s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:34.123 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:38.158 (4.035s) > Enter [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:38.158 < Exit [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:48.595 (10.437s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.595 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.793 (198ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:48.794 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:50.797 (2.003s) > Enter [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:50.797 < Exit [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:59.838 (9.042s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.839 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.841 (3ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:59.842 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.232 (7.39s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:07.232 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:11.252 (4.02s) > Enter [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:11.252 < Exit [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:21.435 (10.182s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.435 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.724 (289ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.725 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:29.212 (7.488s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:29.212 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:33.245 (4.033s) > Enter [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:33.245 < Exit [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:40.278 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.278 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.502 (224ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:40.502 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:47.367 (6.865s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:47.368 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:51.389 (4.021s) > Enter [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:22:51.389 < Exit [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:23:06.598 (15.209s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.598 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.803 (205ms) + + + > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:06.804 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:13.683 (6.879s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:13.683 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:17.702 (4.019s) > Enter [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:17.702 < Exit [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:50.157 (32.455s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.157 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.365 (209ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.366 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:57.248 (6.882s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:23:57.248 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:24:06.308 (9.06s) > Enter [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:06.308 < Exit [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:16.602 (10.294s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.602 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.016 (414ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.016 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.558 (8.541s) > Enter [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:25.558 < Exit [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:42.749 (17.191s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.749 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.994 (245ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.994 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.859 (6.865s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:49.859 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:55.885 (6.025s) > Enter [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:24:55.885 < Exit [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:25:13.047 (17.162s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.047 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.223 (176ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 (0s) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:13.223 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:21.122 (7.899s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:21.122 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:27.151 (6.029s) > Enter [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:27.151 < Exit [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:34.17 (7.019s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.17 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.371 (201ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:34.371 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:41.275 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:41.275 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:49.318 (8.044s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:25:59.469 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:26:09.647 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:26:19.839 (30.521s) > Enter [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:19.839 STEP: Adding a global-auth-snippet to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:254 @ 04/04/23 18:26:19.839 < Exit [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:29.995 (10.156s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.995 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:30.195 (200ms) + + + > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:30.195 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:37.066 (6.871s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:37.066 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:41.082 (4.015s) > Enter [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:41.082 < Exit [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:51.227 (10.145s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.227 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.453 (226ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:51.453 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:58.324 (6.87s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:26:58.324 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:02.348 (4.024s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:02.348 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:07.377 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:17.563 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:27.77 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:37.89 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:53.085 (50.737s) > Enter [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:27:53.085 STEP: receiving an internal server error without cache on location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:811 @ 04/04/23 18:28:00.105 < Exit [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:29:00.109 (1m7.024s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.109 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.314 (205ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:00.314 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:08.193 (7.878s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:08.193 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:10.222 (2.029s) > Enter [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:10.222 < Exit [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:20.442 (10.22s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.442 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.65 (208ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:20.651 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:27.592 (6.941s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:27.592 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:35.635 (8.044s) > Enter [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:35.635 < Exit [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:52.866 (17.23s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:52.866 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:53.101 (235ms) + + + > Enter [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:53.101 < Exit [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:00.998 (7.896s) > Enter [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:00.998 < Exit [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:11.215 (10.217s) > Enter [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.215 < Exit [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.436 (221ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:11.436 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:18.304 (6.868s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:18.304 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:22.331 (4.027s) > Enter [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:22.331 < Exit [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:39.546 (17.216s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.546 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.763 (217ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 (0s) + + + > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.763 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.146 (7.383s) > Enter [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:30:47.146 < Exit [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:32:47.648 (2m0.502s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.648 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.827 (179ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:47.827 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:04.512 (2m16.685s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:04.512 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:08.555 (4.042s) > Enter [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:08.555 < Exit [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:25.764 (17.209s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.764 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.96 (196ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.96 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:33.883 (7.923s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:33.883 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:37.911 (4.028s) > Enter [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:37.911 < Exit [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:57.93 (20.019s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:57.93 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:58.103 (173ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 (0s) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:58.104 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.96 (7.857s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:05.96 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:14.017 (8.056s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:36:24.203 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:36:34.361 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:44.521 (30.504s) > Enter [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:44.521 STEP: Adding a global-auth-signin to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:215 @ 04/04/23 18:36:44.521 < Exit [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:54.694 (10.173s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.694 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.922 (228ms) + + + > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.922 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:02.365 (7.443s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:02.365 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:08.389 (6.023s) > Enter [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:08.389 < Exit [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:25.61 (17.222s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.611 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.869 (258ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.869 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:32.759 (6.89s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:32.759 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:36.785 (4.026s) > Enter [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:36.785 < Exit [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:56.815 (20.03s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:56.815 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.041 (227ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 (0s) + + + > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.042 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.9 (7.858s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:04.9 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:15.932 (11.032s) > Enter [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:15.932 < Exit [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:26.137 (10.204s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.137 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.471 (334ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:26.471 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:33.322 (6.851s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:33.322 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:37.351 (4.029s) > Enter [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:38:37.351 < Exit [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:39:02.787 (25.436s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:02.787 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:03.018 (231ms) + + + > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:03.025 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:11.02 (7.995s) > Enter [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:11.02 < Exit [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:21.316 (10.296s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.316 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.504 (188ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.504 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.492 (7.988s) > Enter [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:29.492 < Exit [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:46.643 (17.151s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.643 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.835 (192ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:46.835 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:53.72 (6.885s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:39:53.72 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:01.768 (8.048s) > Enter [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:01.768 < Exit [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:57.335 (55.567s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.335 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.533 (198ms) + + + > Enter [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.249 < Exit [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.794 (7.545s) > Enter [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:04:26.794 Apr 4 18:04:26.794: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=0' Apr 4 18:04:49.019: INFO: waiting for leader election and initial status update Apr 4 18:05:29.033: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=42431' < Exit [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:05:39.069 (1m12.275s) > Enter [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.069 < Exit [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.293 (225ms) + + + > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.294 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.218 (6.925s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:46.218 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:50.239 (4.02s) > Enter [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:05:50.239 < Exit [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:06:00.422 (10.184s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.422 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.649 (227ms) + + + > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:00.649 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:07.542 (6.893s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:07.542 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:11.569 (4.027s) > Enter [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:11.569 < Exit [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:21.772 (10.203s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.772 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.963 (191ms) + + + > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.964 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.888 (6.924s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:28.888 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:39.938 (11.05s) > Enter [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:39.938 < Exit [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:50.151 (10.213s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.151 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.374 (223ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.375 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.307 (6.932s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:06:57.307 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:05.355 (8.048s) > Enter [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:05.355 STEP: routing requests destined for the mainline ingress to the maineline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:185 @ 04/04/23 18:07:22.519 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:195 @ 04/04/23 18:07:22.526 < Exit [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:22.534 (17.179s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.534 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.759 (225ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:22.759 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:29.671 (6.912s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:29.671 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:40.702 (11.031s) > Enter [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:40.702 < Exit [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:50.922 (10.22s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:50.922 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:51.164 (242ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:51.164 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.041 (7.877s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:07:59.041 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:08:03.067 (4.025s) > Enter [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:03.067 < Exit [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:20.253 (17.187s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.253 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.455 (201ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:20.455 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:27.83 (7.375s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:27.83 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:38.87 (11.04s) > Enter [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:38.87 < Exit [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:52.098 (13.228s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.098 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.323 (225ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:52.323 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:59.233 (6.909s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:59.233 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:09:03.258 (4.025s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:03.258 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:17.471 (14.213s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.471 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.477 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.477 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.663 (186ms) + + + > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:17.664 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:24.618 (6.955s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:24.618 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:37.752 (13.134s) > Enter [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:37.752 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:90 @ 04/04/23 18:09:44.916 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:96 @ 04/04/23 18:09:48.094 < Exit [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:50.119 (12.367s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.119 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.349 (230ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:50.349 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:57.22 (6.871s) > Enter [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:09:57.22 < Exit [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:10:11.466 (14.247s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.466 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.655 (189ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.655 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:18.528 (6.872s) > Enter [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:18.528 < Exit [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:28.683 (10.155s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.683 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.876 (193ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:28.876 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:35.756 (6.88s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:35.756 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:39.781 (4.025s) > Enter [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:39.781 < Exit [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:56.965 (17.184s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:56.965 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:57.186 (221ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 (0s) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:57.186 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:05.078 (7.892s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:05.078 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:09.104 (4.027s) > Enter [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:09.104 < Exit [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:22.32 (13.216s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.32 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.585 (265ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:22.585 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:29.564 (6.979s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:29.564 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:33.585 (4.021s) > Enter [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:33.585 < Exit [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:43.812 (10.227s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:43.812 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:44.056 (244ms) + + + > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:44.057 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:52.078 (8.021s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:52.078 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:54.141 (2.063s) > Enter [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:11:54.141 < Exit [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:12:23.359 (29.218s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.359 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.53 (171ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:23.53 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:30.423 (6.893s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:30.423 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:34.455 (4.032s) > Enter [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:34.455 < Exit [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:44.621 (10.166s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.621 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.832 (211ms) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:44.833 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:52.267 (7.434s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.267 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.272 (5ms) > Enter [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:52.272 < Exit [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:55.617 (3.345s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.617 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.87 (253ms) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:55.871 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.782 (6.911s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:02.782 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:06.807 (4.025s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:06.807 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:13:23.944 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:13:32.097 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:32.106 (25.299s) > Enter [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:32.106 < Exit [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:37.112 (5.005s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.112 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.281 (169ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.281 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:45.19 (7.908s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:45.19 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:49.209 (4.019s) > Enter [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:13:49.209 < Exit [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:14:06.443 (17.233s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.443 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.621 (178ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 (0s) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:06.621 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:13.543 (6.921s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:13.543 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:17.569 (4.026s) > Enter [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:17.569 < Exit [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:33.037 (15.469s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.037 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.234 (196ms) + + + > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:33.234 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:35.237 (2.003s) > Enter [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:14:35.237 < Exit [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:15:35.27 (1m0.034s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.27 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.272 (2ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:35.273 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:43.177 (7.905s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:43.177 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:45.196 (2.019s) > Enter [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:15:45.196 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:161 @ 04/04/23 18:15:45.196 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:165 @ 04/04/23 18:15:52.212 STEP: check that '/foo/bar/bar' does not match the longest exact path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:179 @ 04/04/23 18:16:02.371 < Exit [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:16:02.374 (17.178s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.374 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.58 (206ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:02.581 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:12.465 (9.885s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:12.465 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:16.495 (4.03s) > Enter [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:16.495 < Exit [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:33.975 (17.48s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:33.975 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:34.598 (623ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 (0s) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:34.603 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.474 (6.871s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:41.474 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:43.493 (2.019s) > Enter [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:16:43.493 < Exit [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:17:00.623 (17.13s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.623 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.822 (199ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:00.823 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:07.712 (6.89s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:07.712 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:18.751 (11.038s) > Enter [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:18.751 < Exit [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:28.957 (10.206s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.957 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:29.194 (237ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:29.195 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:39.14 (9.946s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:39.14 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:50.186 (11.045s) > Enter [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:17:50.186 < Exit [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:18:00.312 (10.127s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.312 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.496 (184ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:00.496 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.399 (6.903s) > Enter [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:07.399 < Exit [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:24.593 (17.194s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.593 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.792 (199ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:24.793 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:31.73 (6.937s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:31.73 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:35.753 (4.023s) > Enter [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:35.753 < Exit [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:45.94 (10.187s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:45.94 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:46.161 (221ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.161 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.022 (7.861s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:54.022 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:58.047 (4.025s) > Enter [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:18:58.047 < Exit [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:19:05.106 (7.059s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.106 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.287 (181ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:05.287 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:13.171 (7.884s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:13.171 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:17.198 (4.027s) > Enter [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:17.198 < Exit [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:34.328 (17.129s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.328 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.564 (236ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.564 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:42.455 (7.891s) > Enter [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:42.455 < Exit [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:52.995 (10.54s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.995 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:53.197 (202ms) + + + + > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.198 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.144 (6.946s) > Enter [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:90 @ 04/04/23 18:20:00.144 < Exit [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.144 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.767 (622ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.767 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:09.884 (9.117s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:09.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:13.952 (4.068s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:13.952 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:28.231 (14.28s) > Enter [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:28.231 < Exit [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:32.452 (4.22s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.452 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.657 (205ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:32.657 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:39.572 (6.914s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:39.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:43.594 (4.022s) > Enter [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:20:43.594 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:114 @ 04/04/23 18:20:43.594 STEP: creating an ingress definition with the use-regex amd rewrite-target annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:123 @ 04/04/23 18:20:53.786 STEP: ensuring '/foo' matches '~* ^/foo' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:137 @ 04/04/23 18:21:03.945 STEP: ensuring '/foo/bar' matches '~* ^/foo.+' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:147 @ 04/04/23 18:21:03.953 < Exit [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:21:03.959 (20.365s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:03.959 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.173 (214ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.173 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:12.085 (7.912s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:12.085 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:16.104 (4.019s) > Enter [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:16.104 < Exit [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:27.134 (11.029s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.134 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.321 (187ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:27.321 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.238 (6.917s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:34.238 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:38.265 (4.026s) > Enter [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:38.265 < Exit [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:48.462 (10.197s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.462 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.677 (215ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:48.677 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:55.595 (6.918s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:55.595 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:59.616 (4.02s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:21:59.616 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:22:09.78 (10.165s) > Enter [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.78 < Exit [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.787 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.787 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:10.018 (231ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:10.018 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.91 (7.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:17.91 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:21.937 (4.027s) > Enter [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:21.937 < Exit [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:32.141 (10.205s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.141 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.312 (170ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.312 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:39.246 (6.934s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:39.246 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:43.274 (4.028s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:43.274 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:50.32 (7.047s) > Enter [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:22:50.32 < Exit [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:23:00.536 (10.216s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.536 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.771 (235ms) + + + > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:00.772 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:07.648 (6.876s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:07.648 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:18.858 (11.21s) > Enter [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:18.858 < Exit [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:30.073 (11.215s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.073 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.267 (194ms) + + + > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:30.267 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:37.168 (6.901s) > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:37.168 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:41.193 (4.024s) > Enter [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:41.193 < Exit [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:51.36 (10.167s) > Enter [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.36 < Exit [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.551 (192ms) + + + > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:51.552 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:58.412 (6.86s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:23:58.412 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:24:02.44 (4.027s) > Enter [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:02.44 Apr 4 18:24:11.771: INFO: Connecting to github.com (140.82.113.4:443) Connecting to github.com (140.82.113.4:443) Connecting to raw.githubusercontent.com (185.199.108.133:443) saving to '/etc/nginx/geoip/GeoLite2-Country.mmdb' GeoLite2-Country.mmd 100%!|(MISSING)********************************| 17952 0:00:00 ETA '/etc/nginx/geoip/GeoLite2-Country.mmdb' saved < Exit [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:22.088 (19.648s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.088 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.674 (586ms) + + + > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.675 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.572 (7.897s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:30.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:34.603 (4.031s) > Enter [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:34.603 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:193 @ 04/04/23 18:24:34.603 STEP: check that '/foo/bar/bar' redirects to custom rewrite - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:206 @ 04/04/23 18:24:44.755 < Exit [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:44.757 (10.154s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.757 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.959 (202ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:44.96 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:53.864 (8.905s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:24:53.864 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:25:04.899 (11.035s) > Enter [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:04.899 < Exit [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:15.061 (10.162s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.061 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.316 (255ms) + + + > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:15.316 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:39.846 (24.53s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:39.846 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:47.041 (7.195s) > Enter [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:47.041 < Exit [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:59.374 (12.333s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.374 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.585 (211ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:59.585 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:06.445 (6.86s) > Enter [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:06.445 < Exit [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:20.681 (14.236s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.681 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.877 (196ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:20.877 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:27.751 (6.874s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:27.751 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:31.787 (4.036s) > Enter [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:31.787 < Exit [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:38.82 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:38.82 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:39.022 (203ms) + + + > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:39.023 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.929 (7.906s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:46.929 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:50.949 (4.02s) > Enter [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:26:50.949 < Exit [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:27:08.052 (17.103s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.052 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.24 (188ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:08.24 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:16.131 (7.891s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:16.131 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:27.187 (11.056s) > Enter [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:27.187 < Exit [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:37.411 (10.224s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.411 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.656 (245ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:37.657 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:44.535 (6.879s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:44.535 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:48.555 (4.02s) > Enter [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:48.555 < Exit [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:58.71 (10.155s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.71 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.954 (244ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:58.955 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:06.864 (7.909s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:06.864 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:10.897 (4.033s) > Enter [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:10.897 < Exit [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:17.933 (7.036s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:17.933 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:18.142 (209ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:18.142 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:26.105 (7.963s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:26.105 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:28.133 (2.028s) > Enter [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:28:28.133 < Exit [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:29:01.214 (33.081s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.214 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.431 (217ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:01.431 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:19.232 (2m17.801s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:19.232 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:23.279 (4.047s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:23.279 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:33.459 (10.18s) > Enter [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:33.459 < Exit [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:36.583 (3.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.583 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.807 (224ms) + + + > Enter [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:36.808 < Exit [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:43.735 (6.927s) > Enter [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX IP address - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:30 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX catch all server - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:45 @ 04/04/23 18:31:48.771 < Exit [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:48.798 (5.063s) > Enter [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:48.798 < Exit [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:49.002 (204ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:49.002 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.884 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:55.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:59.898 (4.014s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:31:59.898 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:04.919 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:15.067 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:25.279 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:35.453 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:32:50.643 (50.746s) > Enter [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:50.643 < Exit [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:57.666 (7.022s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.666 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.876 (210ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:57.876 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:04.793 (6.917s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:04.793 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:08.814 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:08.814 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:19.338 (10.524s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.338 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.552 (213ms) + + + > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:19.552 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:26.442 (6.89s) > Enter [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:26.442 < Exit [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:29.606 (3.164s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.606 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.78 (174ms) + + + > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.78 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.668 (6.887s) > Enter [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:36.668 < Exit [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:54.927 (18.259s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:54.927 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:55.127 (200ms) + + + > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:55.128 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:03.016 (7.888s) > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:03.016 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:07.036 (4.021s) > Enter [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:07.036 < Exit [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:24.255 (17.219s) > Enter [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.255 < Exit [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.485 (230ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:24.485 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:31.385 (6.9s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:31.385 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:35.427 (4.042s) > Enter [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:35.427 < Exit [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:45.603 (10.176s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.603 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.78 (178ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.781 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:52.66 (6.879s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:52.66 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:56.689 (4.029s) > Enter [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:34:56.689 < Exit [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:35:13.844 (17.155s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:13.844 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:14.078 (234ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 (0s) + + + > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:14.078 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:22.011 (7.933s) > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:22.011 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:38.056 (16.045s) > Enter [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:38.056 < Exit [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:59.417 (21.362s) > Enter [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.417 < Exit [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.632 (215ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:59.632 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:06.509 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:06.509 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:10.532 (4.023s) > Enter [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:10.532 < Exit [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:30.574 (20.042s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.574 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.81 (237ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 (0s) + + + > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:30.811 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:37.689 (6.878s) > Enter [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:37.689 < Exit [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:51.912 (14.223s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:51.912 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:52.088 (176ms) + + + > Enter [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.088 < Exit [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:59.999 (7.911s) > Enter [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:36:59.999 < Exit [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:37:10.187 (10.188s) > Enter [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.187 < Exit [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.413 (225ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.413 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.279 (6.866s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:17.279 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:21.337 (4.058s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:21.337 STEP: routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:557 @ 04/04/23 18:37:38.545 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:38.552 (17.215s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.552 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.772 (219ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:38.772 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:45.664 (6.892s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:45.664 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:49.681 (4.017s) > Enter [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:37:49.681 < Exit [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:38:15.087 (25.406s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.087 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.266 (179ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.266 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:23.144 (7.877s) > Enter [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:23.144 < Exit [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:39.406 (16.262s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.406 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.613 (207ms) + + + > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:39.613 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:46.507 (6.894s) > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:46.507 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:50.531 (4.023s) > Enter [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:38:50.531 STEP: regenerating the correct configuration after update - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:65 @ 04/04/23 18:39:12.735 < Exit [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:39:23.972 (33.441s) > Enter [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:23.972 < Exit [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:24.525 (553ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:24.526 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:32.928 (8.402s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:32.928 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:36.954 (4.026s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:39:36.954 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:40:09.289 (32.335s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.289 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.487 (198ms) + + + > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:09.487 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:16.38 (6.893s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:16.38 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:20.419 (4.039s) > Enter [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:20.419 < Exit [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:30.626 (10.207s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.626 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.822 (196ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:30.822 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:37.735 (6.913s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:37.735 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:41.759 (4.024s) > Enter [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:41.759 < Exit [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:58.984 (17.225s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:58.984 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:59.238 (254ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.257 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.759 (7.502s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:26.759 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:38.804 (12.045s) > Enter [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:38.804 < Exit [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:49.017 (10.213s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.017 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.223 (207ms) + + + > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:49.225 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:57.104 (7.879s) > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:04:57.104 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:05:01.132 (4.029s) > Enter [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:01.132 STEP: setting an ingress with a nil backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:39 @ 04/04/23 18:05:01.132 < Exit [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:18.375 (17.242s) > Enter [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.375 < Exit [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.574 (200ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:18.575 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:25.47 (6.895s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:25.47 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:29.501 (4.031s) > Enter [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:29.501 < Exit [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:39.685 (10.184s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.685 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.886 (201ms) + + + > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.886 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.798 (6.912s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:46.798 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:57.853 (11.055s) > Enter [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:05:57.853 < Exit [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:06:08.065 (10.213s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.065 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.304 (239ms) + + + > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:08.304 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:15.196 (6.891s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:15.196 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:19.22 (4.024s) > Enter [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:19.22 < Exit [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:36.431 (17.211s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.431 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.678 (246ms) + + + > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:36.678 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:43.562 (6.884s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:43.562 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:47.588 (4.026s) > Enter [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:06:47.588 < Exit [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:07:04.782 (17.194s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.782 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.961 (179ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:04.961 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:12.853 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:12.853 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:20.912 (8.059s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:20.912 STEP: routing requests to the canary upstream when header is set to 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:451 @ 04/04/23 18:07:38.088 STEP: routing requests to the mainline upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:460 @ 04/04/23 18:07:38.092 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:469 @ 04/04/23 18:07:38.097 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:478 @ 04/04/23 18:07:38.101 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:38.105 (17.192s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.312 (208ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.313 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.57 (7.258s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:45.57 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:49.597 (4.027s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:07:49.597 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:08:17.835 (28.238s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:17.835 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:29.028 (11.193s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.028 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.254 (225ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:29.254 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:37.146 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:37.146 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:45.193 (8.047s) > Enter [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:08:45.193 STEP: routing requests destined for the mainline ingress to the mainelin upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:231 @ 04/04/23 18:09:02.324 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:240 @ 04/04/23 18:09:02.332 < Exit [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:09:02.337 (17.144s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.337 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.545 (208ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:02.545 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:09.432 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:09.432 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:13.454 (4.022s) > Enter [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:13.454 < Exit [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:23.682 (10.227s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.682 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.867 (185ms) + + + > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:23.867 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:41.632 (2m17.765s) > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:41.632 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:45.686 (4.054s) > Enter [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:11:45.686 STEP: generating correct defaults - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:43 @ 04/04/23 18:11:52.711 STEP: applying customizations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:61 @ 04/04/23 18:11:55.865 < Exit [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:12:06.074 (20.388s) > Enter [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.074 < Exit [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.248 (175ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:06.248 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:13.645 (7.397s) > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:13.645 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:24.689 (11.044s) > Enter [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:24.689 Apr 4 18:12:39.085: INFO: Request distribution: map[echo-7b6bf466cc-4gqhv:16 echo-7b6bf466cc-kbjqx:9 echo-7b6bf466cc-scqj9:5] < Exit [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:39.085 (14.396s) > Enter [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.085 < Exit [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.295 (210ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:39.295 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.18 (7.884s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.18 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.204 (4.024s) > Enter [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:12:51.204 < Exit [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:13:01.392 (10.189s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.392 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.572 (180ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:01.573 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:08.45 (6.878s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:08.45 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:16.493 (8.042s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:16.493 < Exit [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:42.089 (25.596s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.089 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.311 (222ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:42.312 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.227 (6.915s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:49.227 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:14:00.268 (11.041s) > Enter [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:00.268 < Exit [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:10.406 (10.138s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.406 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.583 (177ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.584 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.985 (7.402s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:17.985 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:22.015 (4.03s) > Enter [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:22.015 < Exit [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:32.238 (10.222s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.238 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.409 (172ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.41 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.329 (7.92s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:40.329 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:51.355 (11.026s) > Enter [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:14:51.356 < Exit [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:15:01.513 (10.157s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.513 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.717 (204ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.717 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:08.628 (6.911s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:08.628 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:12.654 (4.026s) > Enter [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:12.654 < Exit [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:22.863 (10.21s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.863 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:23.117 (253ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:23.117 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:31.017 (7.9s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:31.017 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:35.052 (4.035s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:35.052 STEP: routing requests to the canary upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:395 @ 04/04/23 18:15:52.235 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:404 @ 04/04/23 18:15:52.237 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:414 @ 04/04/23 18:15:52.239 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:52.24 (17.188s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.24 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.427 (187ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:52.428 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.303 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:59.303 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:16:03.326 (4.022s) > Enter [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:03.326 < Exit [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:20.959 (17.634s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.959 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:22.171 (1.211s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 (0s) + + + > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:22.172 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.372 (9.2s) > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:31.372 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:35.41 (4.038s) > Enter [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:35.41 < Exit [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:49.822 (14.412s) > Enter [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:49.822 < Exit [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:50.037 (215ms) + + + > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.037 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:57.908 (7.87s) > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:16:57.908 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:17:01.931 (4.024s) > Enter [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:01.931 < Exit [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:24.158 (22.227s) > Enter [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.158 < Exit [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.349 (191ms) + + + > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:24.35 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:31.239 (6.889s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:31.239 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:39.264 (8.025s) > Enter [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:17:39.264 < Exit [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:18:09.666 (30.402s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.666 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.903 (237ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:09.904 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:16.786 (6.882s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:16.786 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:20.804 (4.018s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:20.804 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:35.029 (14.226s) > Enter [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:35.029 < Exit [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:41.107 (6.078s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.107 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.32 (212ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:41.32 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:49.195 (7.875s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:49.195 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:53.217 (4.022s) > Enter [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:18:53.217 < Exit [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:19:04.077 (10.86s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.077 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.257 (181ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:04.258 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:12.153 (7.895s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:12.153 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:16.174 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:16.174 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:27.319 (11.146s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.32 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.668 (348ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:27.668 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.827 (7.159s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:34.827 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:38.85 (4.023s) > Enter [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:38.85 < Exit [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:49.066 (10.216s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.066 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.312 (246ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:49.312 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:57.192 (7.879s) > Enter [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:19:57.192 < Exit [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:20:12.695 (15.504s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.695 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.536 (840ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.536 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.628 (7.092s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:20.628 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:28.704 (8.077s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:20:38.882 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:20:49.057 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:59.272 (30.567s) > Enter [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:20:59.272 STEP: Adding a global-auth-request-redirect to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:242 @ 04/04/23 18:20:59.272 < Exit [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:21:09.45 (10.178s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.45 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.625 (175ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:09.625 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:16.495 (6.87s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:16.495 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:20.516 (4.021s) > Enter [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:20.516 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:113 @ 04/04/23 18:21:37.731 STEP: checking if the Service Cluster IP and Port are not used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:120 @ 04/04/23 18:21:37.737 < Exit [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:37.9 (17.384s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:37.9 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:38.126 (226ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:38.126 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:46.024 (7.897s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:46.024 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:50.044 (4.02s) > Enter [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:21:50.044 < Exit [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:22:00.233 (10.189s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.233 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.414 (181ms) + + + > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:00.414 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.306 (6.892s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:07.306 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:18.341 (11.035s) > Enter [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:18.341 < Exit [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:21.446 (3.105s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.446 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.733 (287ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.733 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:39.876 (2m18.143s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:39.876 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:47.956 (8.08s) > Enter [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:24:47.956 STEP: routing requests destined fro the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:288 @ 04/04/23 18:25:09.571 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:297 @ 04/04/23 18:25:09.578 < Exit [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:25:09.586 (21.629s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.586 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.787 (201ms) + + + > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:09.787 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:16.668 (6.881s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:16.668 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:24.696 (8.028s) > Enter [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:24.696 < Exit [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:55.101 (30.405s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.101 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.343 (242ms) + + + > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:55.344 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:02.277 (6.934s) > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:02.277 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:06.299 (4.021s) > Enter [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:06.299 < Exit [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:19.516 (13.217s) > Enter [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.516 < Exit [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.717 (201ms) + + + > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:19.718 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:26.668 (6.951s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:26.668 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:30.695 (4.027s) > Enter [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:26:30.695 < Exit [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:27:02.982 (32.287s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:02.982 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.156 (175ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:03.157 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:11.021 (7.864s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:11.021 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:15.049 (4.028s) > Enter [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:15.049 < Exit [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:25.315 (10.266s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.315 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.546 (231ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:25.547 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:32.464 (6.917s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:32.464 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:36.484 (4.02s) > Enter [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:36.484 < Exit [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:43.52 (7.037s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.52 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.695 (175ms) + + + > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:43.696 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.592 (6.896s) > Enter [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:27:50.592 < Exit [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:28:00.821 (10.229s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:00.821 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:01.043 (221ms) + + + > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:01.043 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:08.918 (7.875s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:08.918 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:12.942 (4.024s) > Enter [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:12.942 < Exit [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:31.293 (18.352s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.293 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.512 (218ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:31.512 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:38.394 (6.882s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:38.394 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:46.454 (8.06s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:28:56.618 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:29:06.764 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:29:16.991 (30.537s) > Enter [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:16.991 STEP: Adding an ingress rule for /bar with annotation enable-global-auth = false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:128 @ 04/04/23 18:29:16.991 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:140 @ 04/04/23 18:29:21.174 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:147 @ 04/04/23 18:29:21.184 < Exit [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:21.191 (4.2s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.191 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.411 (220ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:21.411 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:28.853 (7.441s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:28.853 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:43.082 (14.23s) > Enter [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:43.082 < Exit [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:49.435 (6.352s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.435 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.619 (185ms) + + + > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:49.62 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.496 (6.875s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:29:56.496 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:30:00.515 (4.019s) > Enter [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:00.515 < Exit [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:17.68 (17.166s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.68 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.86 (179ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.86 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:24.767 (6.907s) > Enter [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:24.767 < Exit [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:38.985 (14.218s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:38.985 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.203 (218ms) + + + > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.204 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.098 (7.895s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:47.098 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:51.122 (4.023s) > Enter [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:30:51.122 < Exit [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:31:01.391 (10.269s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.391 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.582 (191ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:01.582 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:08.498 (6.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:08.498 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:16.564 (8.066s) > Enter [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:16.564 < Exit [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:33.8 (17.236s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:33.8 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:34.042 (242ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:34.042 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:40.946 (6.904s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:40.946 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:44.981 (4.035s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:44.981 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:53 @ 04/04/23 18:31:55.094 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:60 @ 04/04/23 18:31:55.098 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:55.252 (10.271s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.252 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.492 (240ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.493 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:02.366 (6.874s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:02.366 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:06.394 (4.028s) > Enter [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:06.394 < Exit [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:35.569 (29.175s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.569 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.753 (184ms) + + + + > Enter [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.753 < Exit [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.66 (6.907s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.66 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:53 @ 04/04/23 18:32:42.661 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.661 (1ms) > Enter [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.661 < Exit [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.858 (197ms) + + + > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.858 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:49.722 (6.864s) > Enter [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:49.722 STEP: setting permanent-redirect-code annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:62 @ 04/04/23 18:32:49.722 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:82 @ 04/04/23 18:32:59.899 < Exit [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:59.901 (10.18s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:59.901 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:00.105 (203ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.105 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:07.991 (7.886s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:07.991 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:19.06 (11.069s) > Enter [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:19.06 < Exit [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:29.206 (10.146s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.206 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.433 (227ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.433 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.312 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:36.312 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:42.335 (6.023s) > Enter [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:42.335 < Exit [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:49.381 (7.046s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.381 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.571 (190ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:49.571 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:56.527 (6.956s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:33:56.527 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:00.557 (4.03s) > Enter [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:00.557 < Exit [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:22.694 (22.137s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.694 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.91 (216ms) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:22.91 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:29.807 (6.897s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.807 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.814 (6ms) > Enter [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:29.814 < Exit [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:36.97 (7.156s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.97 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:37.169 (200ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:37.17 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.073 (7.903s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:45.073 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:49.091 (4.018s) > Enter [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:34:49.091 < Exit [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:35:18.316 (29.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.316 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.518 (202ms) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:18.518 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.408 (6.889s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:25.408 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:36.46 (11.052s) > Enter [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:36.46 < Exit [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:39.652 (3.192s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.652 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.91 (258ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:39.91 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:46.843 (6.933s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:46.843 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:50.861 (4.018s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:50.861 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:58.882 (8.021s) > Enter [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:35:58.882 < Exit [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:36:09.027 (10.145s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.027 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.241 (213ms) + + + > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:09.241 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.143 (7.901s) > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:17.143 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:21.166 (4.023s) > Enter [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:21.166 < Exit [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:31.412 (10.246s) > Enter [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:31.412 < Exit [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:32.055 (644ms) + + + > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:32.057 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:39.923 (7.865s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:39.923 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:43.949 (4.026s) > Enter [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:43.949 < Exit [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:54.141 (10.192s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.141 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.342 (200ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.342 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:01.212 (6.87s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:01.212 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:07.231 (6.019s) > Enter [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:07.231 < Exit [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:17.855 (10.625s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:17.855 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:18.076 (221ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:18.076 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.984 (7.907s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:25.984 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:30.003 (4.019s) > Enter [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:30.003 < Exit [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:40.203 (10.201s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.203 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.453 (250ms) + + + > Enter [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:40.453 < Exit [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:47.317 (6.864s) > Enter [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:47.317 < Exit [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:57.514 (10.197s) > Enter [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.514 < Exit [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.725 (211ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.725 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.608 (6.883s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:04.608 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:08.636 (4.028s) > Enter [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:08.636 < Exit [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:20.58 (11.945s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.58 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.761 (181ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:20.762 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:27.757 (6.995s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:27.757 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:31.784 (4.027s) > Enter [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:31.784 < Exit [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:41.901 (10.118s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:41.901 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:42.108 (207ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:42.108 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:50.04 (7.932s) > Enter [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:50.04 < Exit [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:53.238 (3.198s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.238 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.443 (205ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:53.443 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.319 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:00.319 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:04.344 (4.026s) > Enter [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:04.344 < Exit [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:21.438 (17.094s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.438 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.668 (229ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 (0s) + + + > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.67 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.901 (8.232s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:29.901 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:40.966 (11.065s) > Enter [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:40.966 < Exit [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:55.23 (14.264s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.23 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.411 (181ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:55.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.291 (7.88s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:03.291 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:11.34 (8.049s) > Enter [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:11.34 < Exit [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:31.758 (20.417s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.758 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.95 (192ms) + + + > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.951 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.859 (7.909s) > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:39.859 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:47.913 (8.054s) > Enter [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:40:47.913 < Exit [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:41:01.214 (13.301s) > Enter [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.214 < Exit [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.409 (195ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.796 (8.54s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:27.796 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:39.83 (12.034s) > Enter [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:39.83 < Exit [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:46.871 (7.041s) > Enter [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:04:46.871 < Exit [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:05:04.134 (17.262s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.134 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.398 (264ms) + + + > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.398 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.399 (7.001s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:11.399 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:15.426 (4.027s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:15.426 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:82 @ 04/04/23 18:05:32.603 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:89 @ 04/04/23 18:05:32.612 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:32.783 (17.357s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.783 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.966 (182ms) + + + > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:32.966 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:40.858 (7.892s) > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:40.858 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:52.924 (12.066s) > Enter [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:05:52.924 < Exit [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:06:13.273 (20.349s) > Enter [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.273 < Exit [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.49 (217ms) + + + > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:13.49 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:20.419 (6.929s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:20.419 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:24.447 (4.029s) > Enter [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:24.447 < Exit [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:41.792 (17.345s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.792 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.98 (187ms) + + + > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:41.98 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:49.854 (7.874s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:06:49.854 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:07:00.907 (11.052s) > Enter [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:00.907 < Exit [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:11.072 (10.166s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.073 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.276 (203ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.277 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:19.172 (7.895s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:19.172 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:28.212 (9.04s) > Enter [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:28.212 < Exit [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:38.38 (10.168s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.38 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.612 (232ms) + + + > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.613 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.664 (7.051s) > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:45.664 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:49.689 (4.025s) > Enter [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:07:49.689 < Exit [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:08:07.048 (17.358s) > Enter [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.048 < Exit [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.227 (180ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:07.228 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:25.86 (2m18.633s) > Enter [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:25.86 < Exit [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:44.166 (18.305s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.166 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.384 (218ms) + + + > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:44.385 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:51.27 (6.885s) > Enter [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:10:51.27 STEP: checking the service is updated to use eu.httpbin.org - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:304 @ 04/04/23 18:11:06.958 < Exit [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:11:07.097 (15.827s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.097 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.302 (205ms) + + + > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:07.302 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:15.212 (7.91s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:15.212 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:19.237 (4.025s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:19.237 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:30.15 (10.913s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.15 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.361 (211ms) + + + > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:30.361 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:37.259 (6.898s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:37.259 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:39.287 (2.028s) > Enter [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:39.287 < Exit [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:49.482 (10.195s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.482 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.703 (222ms) + + + > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:49.704 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.672 (6.968s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:11:56.672 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:12:07.713 (11.041s) > Enter [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:07.713 < Exit [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:17.909 (10.196s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:17.909 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:18.149 (239ms) + + + > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:18.149 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:26.102 (7.953s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:26.102 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:34.143 (8.041s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:34.143 STEP: routing requests to the canary upstream when header value does not match and cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:630 @ 04/04/23 18:12:51.301 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:51.309 (17.166s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.309 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.494 (185ms) + + + > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:51.494 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.391 (6.897s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:12:58.391 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:13:02.411 (4.02s) > Enter [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:02.411 < Exit [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:31.674 (29.262s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.674 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.873 (199ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:31.874 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:38.753 (6.879s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:38.753 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:48.95 (10.197s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:48.95 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:49.177 (226ms) + + + + > Enter [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.177 < Exit [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.081 (7.904s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.081 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:56 @ 04/04/23 18:13:57.084 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.084 (2ms) > Enter [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.084 < Exit [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.316 (232ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.316 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:04.203 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:04.203 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:08.231 (4.028s) > Enter [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:08.231 < Exit [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:30.484 (22.253s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.484 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.708 (223ms) + + + > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:30.708 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:37.628 (6.92s) > Enter [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:14:37.628 < Exit [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:15:00.832 (23.203s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:00.832 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.031 (199ms) + + + > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.031 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:07.953 (6.922s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:07.953 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:11.978 (4.025s) > Enter [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:11.978 < Exit [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:26.888 (14.91s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:26.888 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:27.083 (195ms) + + + > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:27.083 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:34.978 (7.895s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:34.978 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:39.01 (4.032s) > Enter [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:39.01 < Exit [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:59.042 (20.032s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.042 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.301 (259ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 (0s) + + + > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.302 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.324 (7.022s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:06.324 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:10.352 (4.028s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:10.352 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:16:28.235 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:16:36.64 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:36.649 (26.297s) > Enter [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:36.649 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:229 @ 04/04/23 18:16:41.653 < Exit [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:41.686 (5.038s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.686 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.905 (219ms) + + + > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.905 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:48.792 (6.887s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:48.792 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:59.851 (11.059s) > Enter [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:16:59.851 < Exit [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:17:17.088 (17.237s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.088 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.268 (179ms) + + + > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:17.268 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:25.143 (7.875s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:25.143 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:39.338 (14.195s) > Enter [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:39.338 < Exit [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:45.709 (6.371s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.709 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.895 (186ms) + + + > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:45.896 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:52.77 (6.874s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:17:52.77 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:18:00.824 (8.054s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:00.824 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:29.039 (28.216s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.039 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.048 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.048 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.27 (222ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:29.27 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:36.638 (7.367s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:36.638 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:40.656 (4.018s) > Enter [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:40.656 < Exit [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:47.695 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.695 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.919 (224ms) + + + > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:47.919 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.793 (6.873s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:54.793 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:58.818 (4.026s) > Enter [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:18:58.818 < Exit [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:19:28.082 (29.263s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.082 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.561 (479ms) + + + > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.561 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:36.485 (7.924s) > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:36.485 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:40.514 (4.029s) > Enter [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:40.514 < Exit [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:50.715 (10.201s) > Enter [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.715 < Exit [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.928 (213ms) + + + > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:50.928 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.376 (8.447s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:19:59.376 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:03.412 (4.036s) > Enter [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:03.412 < Exit [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:13.859 (10.448s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.859 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:15.468 (1.608s) + + + > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:15.468 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.896 (2m17.428s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.896 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.905 (9ms) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:32.905 STEP: setting up a first deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:171 @ 04/04/23 18:22:32.905 STEP: updating the tcp service to a second deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:196 @ 04/04/23 18:22:40.099 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:50.31 (17.405s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.31 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.534 (224ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:50.534 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:57.402 (6.868s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:57.402 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:23:01.417 (4.015s) > Enter [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:01.417 < Exit [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:08.429 (7.012s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.429 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.611 (182ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:08.611 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:15.499 (6.888s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:15.499 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:19.526 (4.026s) > Enter [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:19.526 < Exit [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:29.716 (10.19s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.716 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.948 (233ms) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:29.949 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:36.837 (6.888s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:36.837 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:40.864 (4.027s) > Enter [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:40.864 < Exit [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:51.976 (11.112s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.976 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:52.182 (206ms) + + + > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:52.183 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:00.596 (8.414s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:00.596 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:04.625 (4.028s) > Enter [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:04.625 < Exit [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:21.864 (17.239s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:21.864 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.288 (424ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 (0s) + + + > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.289 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.179 (7.89s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:30.179 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:32.201 (2.022s) > Enter [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:32.201 < Exit [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:42.391 (10.19s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.391 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.559 (169ms) + + + > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.559 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.462 (6.902s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:49.462 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:55.483 (6.021s) > Enter [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:24:55.483 < Exit [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:25:05.677 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.677 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.892 (215ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:05.892 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:12.767 (6.875s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:12.767 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:22.853 (10.086s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:22.853 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:23.038 (186ms) + + + > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:23.039 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:30.928 (7.889s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:30.928 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:34.955 (4.027s) > Enter [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:34.955 < Exit [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:45.122 (10.167s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.122 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.378 (256ms) + + + > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:45.378 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:52.259 (6.88s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:52.259 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:56.284 (4.026s) > Enter [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:25:56.284 < Exit [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:26:05.326 (9.041s) > Enter [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:05.326 < Exit [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:29.579 (24.254s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.579 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.795 (215ms) + + + > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:29.795 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:36.671 (6.876s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:36.671 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:40.694 (4.023s) > Enter [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:40.694 < Exit [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:47.715 (7.021s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.715 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.897 (182ms) + + + > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.898 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:54.79 (6.892s) > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:54.79 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:58.813 (4.023s) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:26:58.813 STEP: adding a whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:42 @ 04/04/23 18:27:05.828 STEP: changing error-log-level - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:61 @ 04/04/23 18:27:16.071 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:27:29.359 (30.546s) > Enter [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.359 < Exit [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.558 (198ms) + + + > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:29.558 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36.431 (6.873s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:36.431 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:47.466 (11.035s) > Enter [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:47.466 < Exit [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:57.638 (10.172s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.638 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.835 (197ms) + + + > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:57.835 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.708 (6.873s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:04.708 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:20.208 (15.5s) > Enter [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:20.208 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:68 @ 04/04/23 18:28:27.228 STEP: making sure new ingress is responding - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:74 @ 04/04/23 18:28:30.423 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:76 @ 04/04/23 18:28:30.423 < Exit [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:32.435 (12.227s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.435 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.615 (181ms) + + + > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:32.616 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:39.497 (6.882s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:39.497 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:49.668 (10.171s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.669 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.884 (215ms) + + + > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:49.884 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:56.783 (6.899s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:28:56.783 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:00.81 (4.027s) > Enter [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:00.81 < Exit [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:10.998 (10.189s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:10.998 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:11.21 (212ms) + + + > Enter [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:11.211 < Exit [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:19.1 (7.89s) > Enter [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:29:19.1 < Exit [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:30:30.168 (1m11.068s) > Enter [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.168 < Exit [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.345 (177ms) + + + > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:30.345 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:37.278 (6.932s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:37.278 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:41.303 (4.025s) > Enter [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:41.303 < Exit [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:51.481 (10.178s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.481 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.683 (202ms) + + + > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:51.684 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:58.618 (6.934s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:30:58.618 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:31:09.663 (11.045s) > Enter [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:31:09.663 Automatically polling progress: [Setting] use-proxy-protocol should enable PROXY Protocol for TCP (Spec Runtime: 3m17.98s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 In [It] (Node Runtime: 3m0.001s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 Spec Goroutine goroutine 2932 [IO wait, 3 minutes] internal/poll.runtime_pollWait(0x7f9e883a91b8, 0x72) /usr/local/go/src/runtime/netpoll.go:306 internal/poll.(*pollDesc).wait(0xc0000de300?, 0xc00098a926?, 0x0) /usr/local/go/src/internal/poll/fd_poll_runtime.go:84 internal/poll.(*pollDesc).waitRead(...) /usr/local/go/src/internal/poll/fd_poll_runtime.go:89 internal/poll.(*FD).Read(0xc0000de300, {0xc00098a926, 0x15a, 0x15a}) /usr/local/go/src/internal/poll/fd_unix.go:167 net.(*netFD).Read(0xc0000de300, {0xc00098a926?, 0x453656?, 0x380?}) /usr/local/go/src/net/fd_posix.go:55 net.(*conn).Read(0xc000516660, {0xc00098a926?, 0x19913c0?, 0xc00098a700?}) /usr/local/go/src/net/net.go:183 io.ReadAll({0x1f62de0, 0xc000516660}) /usr/local/go/src/io/io.go:701 > k8s.io/ingress-nginx/test/e2e/settings.glob..func38.5() /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:211 github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0xa0558e, 0xc000300a80}) /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3() /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:850 < Exit [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:41:24.726 (10m15.064s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.726 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.943 (217ms) + + + \ No newline at end of file From 6778c3ec44280fb6c5184aee570a94dac5951fa5 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 16 Apr 2023 21:22:43 -0300 Subject: [PATCH 136/822] Remove deprecated annotation secure-upstream (#9862) --- internal/ingress/annotations/annotations.go | 3 - .../annotations/secureupstream/main.go | 48 ------ .../annotations/secureupstream/main_test.go | 162 ------------------ 3 files changed, 213 deletions(-) delete mode 100644 internal/ingress/annotations/secureupstream/main.go delete mode 100644 internal/ingress/annotations/secureupstream/main_test.go diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 6a9e7367c..974b9ce16 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -58,7 +58,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/redirect" "k8s.io/ingress-nginx/internal/ingress/annotations/rewrite" "k8s.io/ingress-nginx/internal/ingress/annotations/satisfy" - "k8s.io/ingress-nginx/internal/ingress/annotations/secureupstream" "k8s.io/ingress-nginx/internal/ingress/annotations/serversnippet" "k8s.io/ingress-nginx/internal/ingress/annotations/serviceupstream" "k8s.io/ingress-nginx/internal/ingress/annotations/sessionaffinity" @@ -103,7 +102,6 @@ type Ingress struct { Redirect redirect.Config Rewrite rewrite.Config Satisfy string - SecureUpstream secureupstream.Config ServerSnippet string ServiceUpstream bool SessionAffinity sessionaffinity.Config @@ -155,7 +153,6 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "Redirect": redirect.NewParser(cfg), "Rewrite": rewrite.NewParser(cfg), "Satisfy": satisfy.NewParser(cfg), - "SecureUpstream": secureupstream.NewParser(cfg), "ServerSnippet": serversnippet.NewParser(cfg), "ServiceUpstream": serviceupstream.NewParser(cfg), "SessionAffinity": sessionaffinity.NewParser(cfg), diff --git a/internal/ingress/annotations/secureupstream/main.go b/internal/ingress/annotations/secureupstream/main.go deleted file mode 100644 index ebaea2058..000000000 --- a/internal/ingress/annotations/secureupstream/main.go +++ /dev/null @@ -1,48 +0,0 @@ -/* -Copyright 2016 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package secureupstream - -import ( - networking "k8s.io/api/networking/v1" - "k8s.io/klog/v2" - - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -// Config describes SSL backend configuration -type Config struct { - CACert resolver.AuthSSLCert `json:"caCert"` -} - -type su struct { - r resolver.Resolver -} - -// NewParser creates a new secure upstream annotation parser -func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return su{r} -} - -// Parse parses the annotations contained in the ingress -// rule used to indicate if the upstream servers should use SSL -func (a su) Parse(ing *networking.Ingress) (secure interface{}, err error) { - if ca, _ := parser.GetStringAnnotation("secure-verify-ca-secret", ing); ca != "" { - klog.Warningf("NOTE! secure-verify-ca-secret is not supported anymore. Please use proxy-ssl-secret instead") - } - return -} diff --git a/internal/ingress/annotations/secureupstream/main_test.go b/internal/ingress/annotations/secureupstream/main_test.go deleted file mode 100644 index 7546cb5cf..000000000 --- a/internal/ingress/annotations/secureupstream/main_test.go +++ /dev/null @@ -1,162 +0,0 @@ -/* -Copyright 2016 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package secureupstream - -import ( - "fmt" - "testing" - - api "k8s.io/api/core/v1" - networking "k8s.io/api/networking/v1" - meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -func buildIngress() *networking.Ingress { - defaultBackend := networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "default-backend", - Port: networking.ServiceBackendPort{ - Number: 80, - }, - }, - } - - return &networking.Ingress{ - ObjectMeta: meta_v1.ObjectMeta{ - Name: "foo", - Namespace: api.NamespaceDefault, - }, - Spec: networking.IngressSpec{ - DefaultBackend: &networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "default-backend", - Port: networking.ServiceBackendPort{ - Number: 80, - }, - }, - }, - Rules: []networking.IngressRule{ - { - Host: "foo.bar.com", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/foo", - Backend: defaultBackend, - }, - }, - }, - }, - }, - }, - }, - } -} - -type mockCfg struct { - resolver.Mock - certs map[string]resolver.AuthSSLCert -} - -func (cfg mockCfg) GetAuthCertificate(secret string) (*resolver.AuthSSLCert, error) { - if cert, ok := cfg.certs[secret]; ok { - return &cert, nil - } - return nil, fmt.Errorf("secret not found: %v", secret) -} - -func TestNoCA(t *testing.T) { - ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTPS" - ing.SetAnnotations(data) - - _, err := NewParser(mockCfg{ - certs: map[string]resolver.AuthSSLCert{ - "default/secure-verify-ca": {}, - }, - }).Parse(ing) - if err != nil { - t.Errorf("Unexpected error on ingress: %v", err) - } -} - -func TestAnnotations(t *testing.T) { - ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTPS" - data[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "secure-verify-ca" - ing.SetAnnotations(data) - - _, err := NewParser(mockCfg{ - certs: map[string]resolver.AuthSSLCert{ - "default/secure-verify-ca": {}, - }, - }).Parse(ing) - if err != nil { - t.Errorf("Unexpected error on ingress: %v", err) - } -} - -func TestSecretNotFound(t *testing.T) { - ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTPS" - data[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "secure-verify-ca" - ing.SetAnnotations(data) - _, err := NewParser(mockCfg{}).Parse(ing) - if err != nil { - t.Error("Expected secret not found error on ingress") - } -} - -func TestSecretOnNonSecure(t *testing.T) { - ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTP" - data[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "secure-verify-ca" - ing.SetAnnotations(data) - _, err := NewParser(mockCfg{ - certs: map[string]resolver.AuthSSLCert{ - "default/secure-verify-ca": {}, - }, - }).Parse(ing) - if err != nil { - t.Error("Expected CA secret on non secure backend error on ingress") - } -} - -func TestUnsupportedAnnotation(t *testing.T) { - ing := buildIngress() - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("backend-protocol")] = "HTTPS" - data[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "secure-verify-ca" - ing.SetAnnotations(data) - - _, err := NewParser(mockCfg{ - certs: map[string]resolver.AuthSSLCert{ - "default/secure-verify-ca": {}, - }, - }).Parse(ing) - if err != nil { - t.Errorf("Unexpected error on ingress: %v", err) - } -} From 297036e1690ae6dee602bae8b49bb015855141eb Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 16 Apr 2023 21:26:43 -0300 Subject: [PATCH 137/822] Deprecate and remove influxdb feature (#9861) --- docs/e2e-tests.md | 8 - .../nginx-configuration/annotations.md | 28 --- images/nginx/rootfs/build.sh | 6 - internal/ingress/annotations/annotations.go | 3 - internal/ingress/annotations/influxdb/main.go | 101 ---------- .../ingress/annotations/influxdb/main_test.go | 138 ------------- internal/ingress/controller/controller.go | 1 - .../ingress/controller/template/template.go | 45 ----- .../controller/template/template_test.go | 25 --- pkg/apis/ingress/types.go | 4 - pkg/apis/ingress/types_equals.go | 4 - rootfs/etc/nginx/template/nginx.tmpl | 6 - test/e2e/annotations/influxdb.go | 186 ------------------ test/e2e/framework/influxdb.go | 141 ------------- 14 files changed, 696 deletions(-) delete mode 100644 internal/ingress/annotations/influxdb/main.go delete mode 100644 internal/ingress/annotations/influxdb/main_test.go delete mode 100644 test/e2e/annotations/influxdb.go delete mode 100644 test/e2e/framework/influxdb.go diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index 22a76dc7a..ed3e77f67 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -133,10 +133,6 @@ Do not try to edit it manually. - [enable the http2-push-preload directive](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/http2pushpreload.go#L34) -### [influxdb-*](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/influxdb.go#L39) - -- [should send the request metric to the influxdb server](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/influxdb.go#L48) - ### [whitelist-source-range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L27) - [should set valid ip whitelist range](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/annotations/ipwhitelist.go#L34) @@ -461,10 +457,6 @@ Do not try to edit it manually. - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/healthz.go#L) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/influxdb.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/framework/k8s.go#L) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index dac39f752..3b463eea7 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -123,11 +123,6 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz |[nginx.ingress.kubernetes.io/opentracing-trust-incoming-span](#opentracing-trust-incoming-span)|"true" or "false"| |[nginx.ingress.kubernetes.io/enable-opentelemetry](#enable-opentelemetry)|"true" or "false"| |[nginx.ingress.kubernetes.io/opentelemetry-trust-incoming-span](#opentelemetry-trust-incoming-spans)|"true" or "false"| -|[nginx.ingress.kubernetes.io/enable-influxdb](#influxdb)|"true" or "false"| -|[nginx.ingress.kubernetes.io/influxdb-measurement](#influxdb)|string| -|[nginx.ingress.kubernetes.io/influxdb-port](#influxdb)|string| -|[nginx.ingress.kubernetes.io/influxdb-host](#influxdb)|string| -|[nginx.ingress.kubernetes.io/influxdb-server-name](#influxdb)|string| |[nginx.ingress.kubernetes.io/use-regex](#use-regex)|bool| |[nginx.ingress.kubernetes.io/enable-modsecurity](#modsecurity)|bool| |[nginx.ingress.kubernetes.io/enable-owasp-core-rules](#modsecurity)|bool| @@ -896,29 +891,6 @@ nginx.ingress.kubernetes.io/modsecurity-snippet: | Include /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf ``` -### InfluxDB - -Using `influxdb-*` annotations we can monitor requests passing through a Location by sending them to an InfluxDB backend exposing the UDP socket -using the [nginx-influxdb-module](https://github.com/influxdata/nginx-influxdb-module/). - -```yaml -nginx.ingress.kubernetes.io/enable-influxdb: "true" -nginx.ingress.kubernetes.io/influxdb-measurement: "nginx-reqs" -nginx.ingress.kubernetes.io/influxdb-port: "8089" -nginx.ingress.kubernetes.io/influxdb-host: "127.0.0.1" -nginx.ingress.kubernetes.io/influxdb-server-name: "nginx-ingress" -``` - -For the `influxdb-host` parameter you have two options: - -- Use an InfluxDB server configured with the [UDP protocol](https://docs.influxdata.com/influxdb/v1.5/supported_protocols/udp/) enabled. -- Deploy Telegraf as a sidecar proxy to the Ingress controller configured to listen UDP with the [socket listener input](https://github.com/influxdata/telegraf/tree/release-1.6/plugins/inputs/socket_listener) and to write using -anyone of the [outputs plugins](https://github.com/influxdata/telegraf/tree/release-1.7/plugins/outputs) like InfluxDB, Apache Kafka, -Prometheus, etc.. (recommended) - -It's important to remember that there's no DNS resolver at this stage so you will have to configure -an ip address to `nginx.ingress.kubernetes.io/influxdb-host`. If you deploy Influx or Telegraf as sidecar (another container in the same pod) this becomes straightforward since you can directly use `127.0.0.1`. - ### Backend Protocol Using `backend-protocol` annotations is possible to indicate how NGINX should communicate with the backend service. (Replaces `secure-backends` in older versions) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index 8023575c0..44c7b20f8 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -77,8 +77,6 @@ export LUA_UPSTREAM_VERSION=8aa93ead98ba2060d4efd594ae33a35d153589bf # Check for recent changes: https://github.com/openresty/lua-cjson/compare/2.1.0.10...openresty:master export LUA_CJSON_VERSION=2.1.0.10 -export NGINX_INFLUXDB_VERSION=5b09391cb7b9a889687c0aa67964c06a2d933e8b - # Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/3.3...master export GEOIP2_VERSION=a26c6beed77e81553686852dceb6c7fdacc5970d @@ -270,9 +268,6 @@ fi get_src 586f92166018cc27080d34e17c59d68219b85af745edf3cc9fe41403fc9b4ac6 \ "https://github.com/DataDog/dd-opentracing-cpp/archive/v$DATADOG_CPP_VERSION.tar.gz" -get_src 1af5a5632dc8b00ae103d51b7bf225de3a7f0df82f5c6a401996c080106e600e \ - "https://github.com/influxdata/nginx-influxdb-module/archive/$NGINX_INFLUXDB_VERSION.tar.gz" - get_src 4c1933434572226942c65b2f2b26c8a536ab76aa771a3c7f6c2629faa764976b \ "https://github.com/leev/ngx_http_geoip2_module/archive/$GEOIP2_VERSION.tar.gz" @@ -640,7 +635,6 @@ WITH_MODULES=" \ --add-module=$BUILD_PATH/lua-upstream-nginx-module-$LUA_UPSTREAM_VERSION \ --add-module=$BUILD_PATH/nginx_ajp_module-${NGINX_AJP_VERSION} \ --add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest-$NGINX_DIGEST_AUTH \ - --add-dynamic-module=$BUILD_PATH/nginx-influxdb-module-$NGINX_INFLUXDB_VERSION \ --add-dynamic-module=$BUILD_PATH/nginx-opentracing-$NGINX_OPENTRACING_VERSION/opentracing \ --add-dynamic-module=$BUILD_PATH/ModSecurity-nginx-$MODSECURITY_VERSION \ --add-dynamic-module=$BUILD_PATH/ngx_http_geoip2_module-${GEOIP2_VERSION} \ diff --git a/internal/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go index 974b9ce16..5bb2bf5e6 100644 --- a/internal/ingress/annotations/annotations.go +++ b/internal/ingress/annotations/annotations.go @@ -44,7 +44,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" "k8s.io/ingress-nginx/internal/ingress/annotations/http2pushpreload" - "k8s.io/ingress-nginx/internal/ingress/annotations/influxdb" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" "k8s.io/ingress-nginx/internal/ingress/annotations/loadbalancing" @@ -115,7 +114,6 @@ type Ingress struct { XForwardedPrefix string SSLCipher sslcipher.Config Logs log.Config - InfluxDB influxdb.Config ModSecurity modsecurity.Config Mirror mirror.Config StreamSnippet string @@ -166,7 +164,6 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor { "XForwardedPrefix": xforwardedprefix.NewParser(cfg), "SSLCipher": sslcipher.NewParser(cfg), "Logs": log.NewParser(cfg), - "InfluxDB": influxdb.NewParser(cfg), "BackendProtocol": backendprotocol.NewParser(cfg), "ModSecurity": modsecurity.NewParser(cfg), "Mirror": mirror.NewParser(cfg), diff --git a/internal/ingress/annotations/influxdb/main.go b/internal/ingress/annotations/influxdb/main.go deleted file mode 100644 index 1aee91f33..000000000 --- a/internal/ingress/annotations/influxdb/main.go +++ /dev/null @@ -1,101 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package influxdb - -import ( - networking "k8s.io/api/networking/v1" - - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -type influxdb struct { - r resolver.Resolver -} - -// Config contains the IfluxDB configuration to be used in the Ingress -type Config struct { - InfluxDBEnabled bool `json:"influxDBEnabled"` - InfluxDBMeasurement string `json:"influxDBMeasurement"` - InfluxDBPort string `json:"influxDBPort"` - InfluxDBHost string `json:"influxDBHost"` - InfluxDBServerName string `json:"influxDBServerName"` -} - -// NewParser creates a new InfluxDB annotation parser -func NewParser(r resolver.Resolver) parser.IngressAnnotation { - return influxdb{r} -} - -// Parse parses the annotations to look for InfluxDB configurations -func (c influxdb) Parse(ing *networking.Ingress) (interface{}, error) { - var err error - config := &Config{} - - config.InfluxDBEnabled, err = parser.GetBoolAnnotation("enable-influxdb", ing) - if err != nil { - config.InfluxDBEnabled = false - } - - config.InfluxDBMeasurement, err = parser.GetStringAnnotation("influxdb-measurement", ing) - if err != nil { - config.InfluxDBMeasurement = "default" - } - - config.InfluxDBPort, err = parser.GetStringAnnotation("influxdb-port", ing) - if err != nil { - // This is not the default 8086 port but the port usually used to expose - // influxdb in UDP, the module uses UDP to talk to influx via the line protocol. - config.InfluxDBPort = "8089" - } - - config.InfluxDBHost, err = parser.GetStringAnnotation("influxdb-host", ing) - if err != nil { - config.InfluxDBHost = "127.0.0.1" - } - - config.InfluxDBServerName, err = parser.GetStringAnnotation("influxdb-server-name", ing) - if err != nil { - config.InfluxDBServerName = "nginx-ingress" - } - - return config, nil -} - -// Equal tests for equality between two Config types -func (e1 *Config) Equal(e2 *Config) bool { - if e1 == e2 { - return true - } - if e1 == nil || e2 == nil { - return false - } - if e1.InfluxDBEnabled != e2.InfluxDBEnabled { - return false - } - if e1.InfluxDBPort != e2.InfluxDBPort { - return false - } - if e1.InfluxDBHost != e2.InfluxDBHost { - return false - } - if e1.InfluxDBServerName != e2.InfluxDBServerName { - return false - } - - return true -} diff --git a/internal/ingress/annotations/influxdb/main_test.go b/internal/ingress/annotations/influxdb/main_test.go deleted file mode 100644 index 13d681509..000000000 --- a/internal/ingress/annotations/influxdb/main_test.go +++ /dev/null @@ -1,138 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package influxdb - -import ( - "testing" - - api "k8s.io/api/core/v1" - networking "k8s.io/api/networking/v1" - meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/resolver" -) - -func buildIngress() *networking.Ingress { - defaultBackend := networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "default-backend", - Port: networking.ServiceBackendPort{ - Number: 80, - }, - }, - } - - return &networking.Ingress{ - ObjectMeta: meta_v1.ObjectMeta{ - Name: "foo", - Namespace: api.NamespaceDefault, - }, - Spec: networking.IngressSpec{ - DefaultBackend: &networking.IngressBackend{ - Service: &networking.IngressServiceBackend{ - Name: "default-backend", - Port: networking.ServiceBackendPort{ - Number: 80, - }, - }, - }, - Rules: []networking.IngressRule{ - { - Host: "foo.bar.com", - IngressRuleValue: networking.IngressRuleValue{ - HTTP: &networking.HTTPIngressRuleValue{ - Paths: []networking.HTTPIngressPath{ - { - Path: "/foo", - Backend: defaultBackend, - }, - }, - }, - }, - }, - }, - }, - } -} - -func TestIngressInvalidInfluxDB(t *testing.T) { - ing := buildIngress() - - influx, _ := NewParser(&resolver.Mock{}).Parse(ing) - nginxInflux, ok := influx.(*Config) - if !ok { - t.Errorf("expected a Config type") - } - - if nginxInflux.InfluxDBEnabled == true { - t.Errorf("expected influxdb enabled but returned %v", nginxInflux.InfluxDBEnabled) - } - - if nginxInflux.InfluxDBMeasurement != "default" { - t.Errorf("expected measurement name not found. Found %v", nginxInflux.InfluxDBMeasurement) - } - - if nginxInflux.InfluxDBPort != "8089" { - t.Errorf("expected port not found. Found %v", nginxInflux.InfluxDBPort) - } - - if nginxInflux.InfluxDBHost != "127.0.0.1" { - t.Errorf("expected host not found. Found %v", nginxInflux.InfluxDBHost) - } - - if nginxInflux.InfluxDBServerName != "nginx-ingress" { - t.Errorf("expected server name not found. Found %v", nginxInflux.InfluxDBServerName) - } -} - -func TestIngressInfluxDB(t *testing.T) { - ing := buildIngress() - - data := map[string]string{} - data[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" - data[parser.GetAnnotationWithPrefix("influxdb-measurement")] = "nginxmeasures" - data[parser.GetAnnotationWithPrefix("influxdb-port")] = "9091" - data[parser.GetAnnotationWithPrefix("influxdb-host")] = "10.99.0.13" - data[parser.GetAnnotationWithPrefix("influxdb-server-name")] = "nginx-test-1" - ing.SetAnnotations(data) - - influx, _ := NewParser(&resolver.Mock{}).Parse(ing) - nginxInflux, ok := influx.(*Config) - if !ok { - t.Errorf("expected a Config type") - } - - if !nginxInflux.InfluxDBEnabled { - t.Errorf("expected influxdb enabled but returned %v", nginxInflux.InfluxDBEnabled) - } - - if nginxInflux.InfluxDBMeasurement != "nginxmeasures" { - t.Errorf("expected measurement name not found. Found %v", nginxInflux.InfluxDBMeasurement) - } - - if nginxInflux.InfluxDBPort != "9091" { - t.Errorf("expected port not found. Found %v", nginxInflux.InfluxDBPort) - } - - if nginxInflux.InfluxDBHost != "10.99.0.13" { - t.Errorf("expected host not found. Found %v", nginxInflux.InfluxDBHost) - } - - if nginxInflux.InfluxDBServerName != "nginx-test-1" { - t.Errorf("expected server name not found. Found %v", nginxInflux.InfluxDBServerName) - } -} diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 17142a478..80b5b587b 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -1460,7 +1460,6 @@ func locationApplyAnnotations(loc *ingress.Location, anns *annotations.Ingress) loc.UsePortInRedirects = anns.UsePortInRedirects loc.Connection = anns.Connection loc.Logs = anns.Logs - loc.InfluxDB = anns.InfluxDB loc.DefaultBackend = anns.DefaultBackend loc.BackendProtocol = anns.BackendProtocol loc.FastCGI = anns.FastCGI diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go index 9dc9fb3b8..6aadab48e 100644 --- a/internal/ingress/controller/template/template.go +++ b/internal/ingress/controller/template/template.go @@ -40,7 +40,6 @@ import ( "k8s.io/apimachinery/pkg/util/sets" "k8s.io/klog/v2" - "k8s.io/ingress-nginx/internal/ingress/annotations/influxdb" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" "k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit" "k8s.io/ingress-nginx/internal/ingress/controller/config" @@ -267,7 +266,6 @@ var ( "buildOpentracing": buildOpentracing, "buildOpentelemetry": buildOpentelemetry, "proxySetHeader": proxySetHeader, - "buildInfluxDB": buildInfluxDB, "enforceRegexModifier": enforceRegexModifier, "buildCustomErrorDeps": buildCustomErrorDeps, "buildCustomErrorLocationsPerServer": buildCustomErrorLocationsPerServer, @@ -281,7 +279,6 @@ var ( "buildModSecurityForLocation": buildModSecurityForLocation, "buildMirrorLocations": buildMirrorLocations, "shouldLoadAuthDigestModule": shouldLoadAuthDigestModule, - "shouldLoadInfluxDBModule": shouldLoadInfluxDBModule, "buildServerName": buildServerName, "buildCorsOriginRegex": buildCorsOriginRegex, } @@ -1269,29 +1266,6 @@ func buildOpentelemetry(c interface{}, s interface{}) string { return buf.String() } -// buildInfluxDB produces the single line configuration -// needed by the InfluxDB module to send request's metrics -// for the current resource -func buildInfluxDB(input interface{}) string { - cfg, ok := input.(influxdb.Config) - if !ok { - klog.Errorf("expected an 'influxdb.Config' type but %T was returned", input) - return "" - } - - if !cfg.InfluxDBEnabled { - return "" - } - - return fmt.Sprintf( - "influxdb server_name=%s host=%s port=%s measurement=%s enabled=true;", - cfg.InfluxDBServerName, - cfg.InfluxDBHost, - cfg.InfluxDBPort, - cfg.InfluxDBMeasurement, - ) -} - func proxySetHeader(loc interface{}) string { location, ok := loc.(*ingress.Location) if !ok { @@ -1797,25 +1771,6 @@ func shouldLoadAuthDigestModule(s interface{}) bool { return false } -// shouldLoadInfluxDBModule determines whether or not the ngx_http_auth_digest_module module needs to be loaded. -func shouldLoadInfluxDBModule(s interface{}) bool { - servers, ok := s.([]*ingress.Server) - if !ok { - klog.Errorf("expected an '[]*ingress.Server' type but %T was returned", s) - return false - } - - for _, server := range servers { - for _, location := range server.Locations { - if location.InfluxDB.InfluxDBEnabled { - return true - } - } - } - - return false -} - // buildServerName ensures wildcard hostnames are valid func buildServerName(hostname string) string { if !strings.HasPrefix(hostname, "*") { diff --git a/internal/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go index 343da506b..1980d7e52 100644 --- a/internal/ingress/controller/template/template_test.go +++ b/internal/ingress/controller/template/template_test.go @@ -35,7 +35,6 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/internal/ingress/annotations/authreq" - "k8s.io/ingress-nginx/internal/ingress/annotations/influxdb" "k8s.io/ingress-nginx/internal/ingress/annotations/modsecurity" "k8s.io/ingress-nginx/internal/ingress/annotations/opentelemetry" "k8s.io/ingress-nginx/internal/ingress/annotations/opentracing" @@ -1640,30 +1639,6 @@ func TestProxySetHeader(t *testing.T) { } } -func TestBuildInfluxDB(t *testing.T) { - invalidType := &ingress.Ingress{} - expected := "" - actual := buildInfluxDB(invalidType) - - if expected != actual { - t.Errorf("Expected '%v' but returned '%v'", expected, actual) - } - - cfg := influxdb.Config{ - InfluxDBEnabled: true, - InfluxDBServerName: "ok.com", - InfluxDBHost: "host.com", - InfluxDBPort: "5252", - InfluxDBMeasurement: "ok", - } - expected = "influxdb server_name=ok.com host=host.com port=5252 measurement=ok enabled=true;" - actual = buildInfluxDB(cfg) - - if expected != actual { - t.Errorf("Expected '%v' but returned '%v'", expected, actual) - } -} - func TestBuildOpenTracing(t *testing.T) { invalidType := &ingress.Ingress{} expected := "" diff --git a/pkg/apis/ingress/types.go b/pkg/apis/ingress/types.go index 08a2f7575..e50666c18 100644 --- a/pkg/apis/ingress/types.go +++ b/pkg/apis/ingress/types.go @@ -29,7 +29,6 @@ import ( "k8s.io/ingress-nginx/internal/ingress/annotations/cors" "k8s.io/ingress-nginx/internal/ingress/annotations/fastcgi" "k8s.io/ingress-nginx/internal/ingress/annotations/globalratelimit" - "k8s.io/ingress-nginx/internal/ingress/annotations/influxdb" "k8s.io/ingress-nginx/internal/ingress/annotations/ipdenylist" "k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist" "k8s.io/ingress-nginx/internal/ingress/annotations/log" @@ -338,9 +337,6 @@ type Location struct { // Logs allows to enable or disable the nginx logs // By default access logs are enabled and rewrite logs are disabled Logs log.Config `json:"logs,omitempty"` - // InfluxDB allows to monitor the incoming request by sending them to an influxdb database - // +optional - InfluxDB influxdb.Config `json:"influxDB,omitempty"` // BackendProtocol indicates which protocol should be used to communicate with the service // By default this is HTTP BackendProtocol string `json:"backend-protocol"` diff --git a/pkg/apis/ingress/types_equals.go b/pkg/apis/ingress/types_equals.go index 8a54f3758..84b1a186a 100644 --- a/pkg/apis/ingress/types_equals.go +++ b/pkg/apis/ingress/types_equals.go @@ -431,10 +431,6 @@ func (l1 *Location) Equal(l2 *Location) bool { return false } - if !(&l1.InfluxDB).Equal(&l2.InfluxDB) { - return false - } - if l1.BackendProtocol != l2.BackendProtocol { return false } diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index 014c8cc2a..a49989f30 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -21,10 +21,6 @@ load_module /etc/nginx/modules/ngx_http_brotli_filter_module.so; load_module /etc/nginx/modules/ngx_http_brotli_static_module.so; {{ end }} -{{ if (shouldLoadInfluxDBModule $servers) }} -load_module /etc/nginx/modules/ngx_http_influxdb_module.so; -{{ end }} - {{ if (shouldLoadAuthDigestModule $servers) }} load_module /etc/nginx/modules/ngx_http_auth_digest_module.so; {{ end }} @@ -1366,8 +1362,6 @@ stream { {{ range $limit := $limits }} {{ $limit }}{{ end }} - {{ buildInfluxDB $location.InfluxDB }} - {{ if isValidByteSize $location.Proxy.BodySize true }} client_max_body_size {{ $location.Proxy.BodySize }}; {{ end }} diff --git a/test/e2e/annotations/influxdb.go b/test/e2e/annotations/influxdb.go deleted file mode 100644 index 7a52730cf..000000000 --- a/test/e2e/annotations/influxdb.go +++ /dev/null @@ -1,186 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package annotations - -import ( - "bytes" - "context" - "fmt" - "net/http" - "os/exec" - "strings" - "time" - - jsoniter "github.com/json-iterator/go" - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/util/intstr" - "k8s.io/apimachinery/pkg/util/wait" - - "k8s.io/ingress-nginx/test/e2e/framework" -) - -var _ = framework.DescribeAnnotation("influxdb-*", func() { - f := framework.NewDefaultFramework("influxdb") - - ginkgo.BeforeEach(func() { - f.NewInfluxDBDeployment() - f.NewEchoDeployment() - }) - - ginkgo.Context("when influxdb is enabled", func() { - ginkgo.It("should send the request metric to the influxdb server", func() { - ifs := createInfluxDBService(f) - - // Ingress configured with InfluxDB annotations - host := "influxdb.e2e.local" - createInfluxDBIngress( - f, - host, - framework.EchoService, - 80, - map[string]string{ - "nginx.ingress.kubernetes.io/enable-influxdb": "true", - "nginx.ingress.kubernetes.io/influxdb-host": ifs.Spec.ClusterIP, - "nginx.ingress.kubernetes.io/influxdb-port": "8089", - "nginx.ingress.kubernetes.io/influxdb-measurement": "requests", - "nginx.ingress.kubernetes.io/influxdb-servername": "e2e-nginx-srv", - }, - ) - - // Do a request to the echo server ingress that sends metrics - // to the InfluxDB backend. - f.HTTPTestClient(). - GET("/"). - WithHeader("Host", host). - Expect(). - Status(http.StatusOK) - - framework.Sleep(10 * time.Second) - - var measurements string - var err error - - err = wait.Poll(time.Second, time.Minute, func() (bool, error) { - measurements, err = extractInfluxDBMeasurements(f) - if err != nil { - return false, nil - } - return true, nil - }) - assert.Nil(ginkgo.GinkgoT(), err) - - var results map[string][]map[string]interface{} - _ = jsoniter.ConfigCompatibleWithStandardLibrary.Unmarshal([]byte(measurements), &results) - - assert.NotEqual(ginkgo.GinkgoT(), len(measurements), 0) - for _, elem := range results["results"] { - assert.NotEqual(ginkgo.GinkgoT(), len(elem), 0) - } - }) - }) -}) - -func createInfluxDBService(f *framework.Framework) *corev1.Service { - service := &corev1.Service{ - ObjectMeta: metav1.ObjectMeta{ - Name: "influxdb", - Namespace: f.Namespace, - }, - Spec: corev1.ServiceSpec{Ports: []corev1.ServicePort{ - { - Name: "udp", - Port: 8089, - TargetPort: intstr.FromInt(8089), - Protocol: "UDP", - }, - }, - Selector: map[string]string{ - "app": "influxdb", - }, - }, - } - - return f.EnsureService(service) -} - -func createInfluxDBIngress(f *framework.Framework, host, service string, port int, annotations map[string]string) { - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, service, port, annotations) - f.EnsureIngress(ing) - - f.WaitForNginxServer(host, - func(server string) bool { - return strings.Contains(server, fmt.Sprintf("server_name %v", host)) - }) -} - -func extractInfluxDBMeasurements(f *framework.Framework) (string, error) { - l, err := f.KubeClientSet.CoreV1().Pods(f.Namespace).List(context.TODO(), metav1.ListOptions{ - LabelSelector: "app=influxdb", - }) - if err != nil { - return "", err - } - - if len(l.Items) == 0 { - return "", err - } - - cmd := "influx -database 'nginx' -execute 'select * from requests' -format 'json' -pretty" - - var pod *corev1.Pod - for _, p := range l.Items { - pod = &p - break - } - - if pod == nil { - return "", fmt.Errorf("no influxdb pods found") - } - - o, err := execInfluxDBCommand(pod, cmd) - if err != nil { - return "", err - } - - return o, nil -} - -func execInfluxDBCommand(pod *corev1.Pod, command string) (string, error) { - var ( - execOut bytes.Buffer - execErr bytes.Buffer - ) - - cmd := exec.Command("/bin/bash", "-c", fmt.Sprintf("%v exec --namespace %s %s -- %s", framework.KubectlPath, pod.Namespace, pod.Name, command)) - cmd.Stdout = &execOut - cmd.Stderr = &execErr - - err := cmd.Run() - - if execErr.Len() > 0 { - return "", fmt.Errorf("stderr: %v", execErr.String()) - } - - if err != nil { - return "", fmt.Errorf("could not execute '%s %s': %v", cmd.Path, cmd.Args, err) - } - - return execOut.String(), nil -} diff --git a/test/e2e/framework/influxdb.go b/test/e2e/framework/influxdb.go deleted file mode 100644 index 43a5702e6..000000000 --- a/test/e2e/framework/influxdb.go +++ /dev/null @@ -1,141 +0,0 @@ -/* -Copyright 2018 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package framework - -import ( - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - appsv1 "k8s.io/api/apps/v1" - corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/fields" -) - -const influxConfig = ` -reporting-disabled = true -bind-address = "0.0.0.0:8088" - -[meta] - dir = "/var/lib/influxdb/meta" - retention-autocreate = true - logging-enabled = true - -[data] - dir = "/var/lib/influxdb/data" - index-version = "inmem" - wal-dir = "/var/lib/influxdb/wal" - wal-fsync-delay = "0s" - query-log-enabled = true - cache-max-memory-size = 1073741824 - cache-snapshot-memory-size = 26214400 - cache-snapshot-write-cold-duration = "10m0s" - compact-full-write-cold-duration = "4h0m0s" - max-series-per-database = 1000000 - max-values-per-tag = 100000 - max-concurrent-compactions = 0 - trace-logging-enabled = false - -[[udp]] - enabled = true - bind-address = ":8089" - database = "nginx" -` - -// NewInfluxDBDeployment creates an InfluxDB server configured to reply -// on 8086/tcp and 8089/udp -func (f *Framework) NewInfluxDBDeployment() { - configuration := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: "influxdb-config", - Namespace: f.Namespace, - }, - Data: map[string]string{ - "influxd.conf": influxConfig, - }, - } - - f.EnsureConfigMap(configuration) - - deployment := &appsv1.Deployment{ - ObjectMeta: metav1.ObjectMeta{ - Name: "influxdb", - Namespace: f.Namespace, - }, - Spec: appsv1.DeploymentSpec{ - Replicas: NewInt32(1), - Selector: &metav1.LabelSelector{ - MatchLabels: map[string]string{ - "app": "influxdb", - }, - }, - Template: corev1.PodTemplateSpec{ - ObjectMeta: metav1.ObjectMeta{ - Labels: map[string]string{ - "app": "influxdb", - }, - }, - Spec: corev1.PodSpec{ - TerminationGracePeriodSeconds: NewInt64(0), - Volumes: []corev1.Volume{ - { - Name: "influxdb-config", - VolumeSource: corev1.VolumeSource{ - ConfigMap: &corev1.ConfigMapVolumeSource{ - LocalObjectReference: corev1.LocalObjectReference{ - Name: "influxdb-config", - }, - }, - }, - }, - }, - Containers: []corev1.Container{ - { - Name: "influxdb", - Image: "docker.io/influxdb:1.5", - Env: []corev1.EnvVar{}, - Command: []string{"influxd", "-config", "/influxdb-config/influxd.conf"}, - VolumeMounts: []corev1.VolumeMount{ - { - Name: "influxdb-config", - ReadOnly: true, - MountPath: "/influxdb-config", - }, - }, - Ports: []corev1.ContainerPort{ - { - Name: "http", - ContainerPort: 8086, - }, - { - Name: "udp", - ContainerPort: 8089, - }, - }, - }, - }, - }, - }, - }, - } - - d := f.EnsureDeployment(deployment) - - err := waitForPodsReady(f.KubeClientSet, DefaultTimeout, 1, f.Namespace, metav1.ListOptions{ - LabelSelector: fields.SelectorFromSet(fields.Set(d.Spec.Template.ObjectMeta.Labels)).String(), - }) - assert.Nil(ginkgo.GinkgoT(), err, "waiting for influxdb pod to become ready") -} From 11419a68373d3b1edf98e1812ed91e6097b3c6b4 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sun, 16 Apr 2023 21:32:43 -0300 Subject: [PATCH 138/822] Fastcgi configmap should be on the same namespace of ingress (#9863) --- internal/ingress/annotations/fastcgi/main.go | 6 ++-- .../ingress/annotations/fastcgi/main_test.go | 30 +++++++++++++++---- 2 files changed, 28 insertions(+), 8 deletions(-) diff --git a/internal/ingress/annotations/fastcgi/main.go b/internal/ingress/annotations/fastcgi/main.go index b32b85997..84bac4109 100644 --- a/internal/ingress/annotations/fastcgi/main.go +++ b/internal/ingress/annotations/fastcgi/main.go @@ -88,11 +88,11 @@ func (a fastcgi) Parse(ing *networking.Ingress) (interface{}, error) { } } - if cmns == "" { - cmns = ing.Namespace + if cmns != "" && cmns != ing.Namespace { + return fcgiConfig, fmt.Errorf("different namespace is not supported on fast_cgi param configmap") } - cm = fmt.Sprintf("%v/%v", cmns, cmn) + cm = fmt.Sprintf("%v/%v", ing.Namespace, cmn) cmap, err := a.r.GetConfigMap(cm) if err != nil { return fcgiConfig, ing_errors.LocationDenied{ diff --git a/internal/ingress/annotations/fastcgi/main_test.go b/internal/ingress/annotations/fastcgi/main_test.go index 26d85e7ce..35c5bbc12 100644 --- a/internal/ingress/annotations/fastcgi/main_test.go +++ b/internal/ingress/annotations/fastcgi/main_test.go @@ -17,13 +17,14 @@ limitations under the License. package fastcgi import ( + "fmt" "testing" api "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/tools/cache" "k8s.io/ingress-nginx/internal/ingress/annotations/parser" - "k8s.io/ingress-nginx/internal/ingress/errors" "k8s.io/ingress-nginx/internal/ingress/resolver" ) @@ -51,14 +52,19 @@ type mockConfigMap struct { } func (m mockConfigMap) GetConfigMap(name string) (*api.ConfigMap, error) { - if name != "default/demo-configmap" { - return nil, errors.Errorf("there is no configmap with name %v", name) + if name != "default/demo-configmap" && name != "otherns/demo-configmap" { + return nil, fmt.Errorf("there is no configmap with name %v", name) + } + + cmns, cmn, err := cache.SplitMetaNamespaceKey(name) + if err != nil { + return nil, fmt.Errorf("invalid configmap name") } return &api.ConfigMap{ ObjectMeta: meta_v1.ObjectMeta{ - Namespace: api.NamespaceDefault, - Name: "demo-secret", + Namespace: cmns, + Name: cmn, }, Data: map[string]string{"REDIRECT_STATUS": "200", "SERVER_NAME": "$server_name"}, }, nil @@ -210,6 +216,20 @@ func TestParseFastCGIParamsConfigMapAnnotationWithNS(t *testing.T) { } } +func TestParseFastCGIParamsConfigMapAnnotationWithDifferentNS(t *testing.T) { + ing := buildIngress() + + data := map[string]string{} + data[parser.GetAnnotationWithPrefix("fastcgi-params-configmap")] = "otherns/demo-configmap" + ing.SetAnnotations(data) + + _, err := NewParser(&mockConfigMap{}).Parse(ing) + if err == nil { + t.Errorf("Different namespace configmap should return an error") + } + +} + func TestConfigEquality(t *testing.T) { var nilConfig *Config From 89b8aff3976ba1128c4133b94cb24b3366d4e1b1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Apr 2023 01:48:43 -0700 Subject: [PATCH 139/822] Bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (#9839) Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.6.1 to 1.7.0. - [Release notes](https://github.com/spf13/cobra/releases) - [Commits](https://github.com/spf13/cobra/compare/v1.6.1...v1.7.0) --- updated-dependencies: - dependency-name: github.com/spf13/cobra dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 24c319bc7..210afb10a 100644 --- a/go.mod +++ b/go.mod @@ -20,7 +20,7 @@ require ( github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 github.com/prometheus/common v0.42.0 - github.com/spf13/cobra v1.6.1 + github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 github.com/yudai/gojsondiff v1.0.0 @@ -76,7 +76,7 @@ require ( github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.3.0 // indirect github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect - github.com/inconshreveable/mousetrap v1.0.1 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect github.com/mailru/easyjson v0.7.6 // indirect diff --git a/go.sum b/go.sum index 8ee1dc453..36403c1d0 100644 --- a/go.sum +++ b/go.sum @@ -206,8 +206,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1: github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM= github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= -github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc= -github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= @@ -349,8 +349,8 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE= github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= -github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA= -github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY= +github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= +github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= From e09e40af1ad33cf748ee92502f61ec2b6f741b96 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Apr 2023 01:56:43 -0700 Subject: [PATCH 140/822] Bump golang.org/x/crypto from 0.7.0 to 0.8.0 (#9838) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.7.0 to 0.8.0. - [Release notes](https://github.com/golang/crypto/releases) - [Commits](https://github.com/golang/crypto/compare/v0.7.0...v0.8.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 210afb10a..4779437d7 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.2 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.7.0 + golang.org/x/crypto v0.8.0 google.golang.org/grpc v1.54.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -101,11 +101,11 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.8.0 // indirect - golang.org/x/net v0.8.0 // indirect + golang.org/x/net v0.9.0 // indirect golang.org/x/oauth2 v0.5.0 // indirect - golang.org/x/sys v0.6.0 // indirect - golang.org/x/term v0.6.0 // indirect - golang.org/x/text v0.8.0 // indirect + golang.org/x/sys v0.7.0 // indirect + golang.org/x/term v0.7.0 // indirect + golang.org/x/text v0.9.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index 36403c1d0..f0aef6bc6 100644 --- a/go.sum +++ b/go.sum @@ -407,8 +407,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A= -golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= +golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ= +golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -475,8 +475,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.8.0 h1:Zrh2ngAOFYneWTAIAPethzeaQLuHwhuBkuV6ZiRnUaQ= -golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= +golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= +golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -546,19 +546,19 @@ golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= +golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.6.0 h1:clScbb1cHjoCkyRbWwBEUZ5H/tIFu5TAXIqaZD0Gcjw= -golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= +golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ= +golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68= -golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= +golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From 91a89bcc0c1f63045de37e5dd8a4f7b6a3a85788 Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Thu, 20 Apr 2023 10:45:13 +0200 Subject: [PATCH 141/822] README: Update `external-dns` link. (#9866) --- charts/ingress-nginx/README.md | 2 +- charts/ingress-nginx/README.md.gotmpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 44b553ece..b7c97939d 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -94,7 +94,7 @@ Previous versions of this chart had a `controller.stats.*` configuration block, ### ExternalDNS Service Configuration -Add an [ExternalDNS](https://github.com/kubernetes-incubator/external-dns) annotation to the LoadBalancer service: +Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: ```yaml controller: diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index 238166277..b3d35b6e7 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -91,7 +91,7 @@ Previous versions of this chart had a `controller.stats.*` configuration block, ### ExternalDNS Service Configuration -Add an [ExternalDNS](https://github.com/kubernetes-incubator/external-dns) annotation to the LoadBalancer service: +Add an [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) annotation to the LoadBalancer service: ```yaml controller: From 94a3264f1e09e2857c224ef28f5c7f043c72bac6 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 20 Apr 2023 07:52:59 -0400 Subject: [PATCH 142/822] add puerco and cpanato as approvers Signed-off-by: James Strong --- OWNERS_ALIASES | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 49806abdb..33c986f57 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -14,24 +14,27 @@ aliases: - ElvinEfendi - rikatz - strongjz + - cpanato + - puerco - tao12345666333 ingress-nginx-reviewers: - ElvinEfendi - rikatz - strongjz + - puerco + - cpanato - tao12345666333 ingress-nginx-helm-maintainers: - - ChiefAlexander - cpanato + - strongjz ingress-nginx-helm-reviewers: - - ChiefAlexander - cpanato + - strongjz ingress-nginx-docs-maintainers: - - IamNoah1 - longwuyuan - tao12345666333 From ec5b4b4fd06cc590f929ca6b63d5a9013d49765b Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 21 Apr 2023 03:33:10 +0200 Subject: [PATCH 143/822] Update k8s versions (#9879) * increase wait on web cert setup Signed-off-by: James Strong * add cmctl to check its working Signed-off-by: James Strong * fix wait cmd and update default k8s version Signed-off-by: James Strong * update the kubectl test commands Signed-off-by: James Strong * README: Update `external-dns` link. (#9866) * add puerco and cpanato as approvers Signed-off-by: James Strong * update k8s versions for testing and remove cache deletion Signed-off-by: James Strong * upgrade default to 1.26 for testing Signed-off-by: James Strong --------- Signed-off-by: James Strong Co-authored-by: Marco Ebert --- .github/workflows/ci.yaml | 28 +++++++--------------------- build/dev-env.sh | 2 +- test/e2e/run-chart-test.sh | 13 ++++++++++--- test/e2e/run-kind-e2e.sh | 2 +- 4 files changed, 19 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 6323c65be..65e8cacff 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -193,7 +193,7 @@ jobs: with: name: docker.tar.gz path: docker.tar.gz - + retention-days: 5 helm: name: Helm chart runs-on: ubuntu-latest @@ -205,7 +205,7 @@ jobs: strategy: matrix: - k8s: [v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.12, v1.25.8, v1.26.3] steps: - name: Checkout @@ -255,11 +255,6 @@ jobs: run: | kind create cluster --image=kindest/node:${{ matrix.k8s }} - - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 - with: - name: docker.tar.gz - failOnError: false - - name: Load images from cache run: | echo "loading docker images..." @@ -285,7 +280,7 @@ jobs: strategy: matrix: - k8s: [v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.12, v1.25.8, v1.26.3] steps: - name: Checkout @@ -301,11 +296,6 @@ jobs: run: | kind create cluster --image=kindest/node:${{ matrix.k8s }} --config test/e2e/kind.yaml - - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 - with: - name: docker.tar.gz - failOnError: false - - name: Load images from cache run: | echo "loading docker images..." @@ -327,6 +317,7 @@ jobs: name: e2e-test-reports-${{ matrix.k8s }} path: 'test/junitreports/report*.xml' + kubernetes-chroot: name: Kubernetes chroot runs-on: ubuntu-latest @@ -338,7 +329,7 @@ jobs: strategy: matrix: - k8s: [v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.12, v1.25.8, v1.26.3] steps: @@ -355,11 +346,6 @@ jobs: run: | kind create cluster --image=kindest/node:${{ matrix.k8s }} --config test/e2e/kind.yaml - - uses: geekyeggo/delete-artifact@54ab544f12cdb7b71613a16a2b5a37a9ade990af # v2.0.0 - with: - name: docker.tar.gz - failOnError: false - - name: Load images from cache run: | echo "loading docker images..." @@ -375,7 +361,7 @@ jobs: kind get kubeconfig > $HOME/.kube/kind-config-kind make kind-e2e-test - - name: Uplaod e2e junit-reports + - name: Upload e2e junit-reports uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 if: success() || failure() with: @@ -461,7 +447,7 @@ jobs: strategy: matrix: - k8s: [v1.24.7, v1.25.3, v1.26.0] + k8s: [v1.24.12, v1.25.8, v1.26.3] steps: - name: Checkout diff --git a/build/dev-env.sh b/build/dev-env.sh index 09609367a..3d21b7e15 100755 --- a/build/dev-env.sh +++ b/build/dev-env.sh @@ -62,7 +62,7 @@ echo "[dev-env] building image" make build image docker tag "${REGISTRY}/controller:${TAG}" "${DEV_IMAGE}" -export K8S_VERSION=${K8S_VERSION:-v1.25.2@sha256:9be91e9e9cdf116809841fc77ebdb8845443c4c72fe5218f3ae9eb57fdb4bace} +export K8S_VERSION=${K8S_VERSION:-v1.26.3@sha256:61b92f38dff6ccc29969e7aa154d34e38b89443af1a2c14e6cfbd2df6419c66f} KIND_CLUSTER_NAME="ingress-nginx-dev" diff --git a/test/e2e/run-chart-test.sh b/test/e2e/run-chart-test.sh index 813e296cf..6efa63eb2 100755 --- a/test/e2e/run-chart-test.sh +++ b/test/e2e/run-chart-test.sh @@ -62,7 +62,7 @@ export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/kind-config-$KIND_CLUSTER_NAME}" if [ "${SKIP_CLUSTER_CREATION:-false}" = "false" ]; then echo "[dev-env] creating Kubernetes cluster with kind" - export K8S_VERSION=${K8S_VERSION:-v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6} + export K8S_VERSION=${K8S_VERSION:-v1.26.3@sha256:61b92f38dff6ccc29969e7aa154d34e38b89443af1a2c14e6cfbd2df6419c66f} kind create cluster \ --verbosity=${KIND_LOG_LEVEL} \ @@ -91,9 +91,16 @@ echo "[dev-env] copying docker images to cluster..." kind load docker-image --name="${KIND_CLUSTER_NAME}" --nodes=${KIND_WORKERS} ${REGISTRY}/controller:${TAG} if [ "${SKIP_CERT_MANAGER_CREATION:-false}" = "false" ]; then + curl -fsSL -o cmctl.tar.gz https://github.com/cert-manager/cert-manager/releases/download/v1.11.1/cmctl-linux-amd64.tar.gz + tar xzf cmctl.tar.gz + chmod +x cmctl + ./cmctl help echo "[dev-env] apply cert-manager ..." - kubectl apply --wait -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.0/cert-manager.yaml - sleep 10 + kubectl apply --wait -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml + kubectl wait --timeout=30s --for=condition=available deployment/cert-manager -n cert-manager + kubectl get validatingwebhookconfigurations cert-manager-webhook -ojson | jq '.webhooks[].clientConfig' + kubectl get endpoints -n cert-manager cert-manager-webhook + ./cmctl check api --wait=2m fi echo "[dev-env] running helm chart e2e tests..." diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index d3ea18b6d..fe7550360 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -63,7 +63,7 @@ echo "Running e2e with nginx base image ${NGINX_BASE_IMAGE}" if [ "${SKIP_CLUSTER_CREATION}" = "false" ]; then echo "[dev-env] creating Kubernetes cluster with kind" - export K8S_VERSION=${K8S_VERSION:-v1.25.2@sha256:9be91e9e9cdf116809841fc77ebdb8845443c4c72fe5218f3ae9eb57fdb4bace} + export K8S_VERSION=${K8S_VERSION:-v1.26.3@sha256:61b92f38dff6ccc29969e7aa154d34e38b89443af1a2c14e6cfbd2df6419c66f} # delete the cluster if it exists if kind get clusters | grep "${KIND_CLUSTER_NAME}"; then From 156273bf394a56ce3014a1fbeab1512b8f2456a5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 22 Apr 2023 02:21:12 -0700 Subject: [PATCH 144/822] Bump actions/checkout from 3.5.0 to 3.5.2 (#9870) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.5.0 to 3.5.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8f4b7f84864484a7bf31766abe9204da3cbe65b3...8e5e7e5ab8b370d6c329ec480221332ada57f0ab) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 22 +++++++++++----------- .github/workflows/depreview.yaml | 2 +- .github/workflows/docs.yaml | 4 ++-- .github/workflows/helm.yaml | 4 ++-- .github/workflows/perftest.yaml | 2 +- .github/workflows/plugin.yaml | 2 +- .github/workflows/scorecards.yml | 2 +- .github/workflows/vulnerability-scans.yaml | 4 ++-- 8 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 65e8cacff..edef01915 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -40,7 +40,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -66,7 +66,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Run Gosec Security Scanner uses: securego/gosec@a459eb0ba387d9bd083d5c2e2354dbeef2465038 # v2.15.0 @@ -83,7 +83,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Set up Go id: go @@ -102,7 +102,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Set up Go id: go @@ -121,7 +121,7 @@ jobs: (needs.changes.outputs.go == 'true') steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Set up Go id: go @@ -142,7 +142,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Set up Go id: go @@ -209,7 +209,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Setup Go uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 @@ -284,7 +284,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -334,7 +334,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: cache uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -378,7 +378,7 @@ jobs: PLATFORMS: linux/amd64,linux/arm64 steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images @@ -451,7 +451,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter-images diff --git a/.github/workflows/depreview.yaml b/.github/workflows/depreview.yaml index e18f71a20..de9243f16 100644 --- a/.github/workflows/depreview.yaml +++ b/.github/workflows/depreview.yaml @@ -9,6 +9,6 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Checkout Repository' - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: 'Dependency Review' uses: actions/dependency-review-action@f46c48ed6d4f1227fb2d9ea62bf6bcbed315589e # v3.0.4 diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 5a0f6bb7b..1a2ceaa83 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1 id: filter @@ -47,7 +47,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Deploy uses: ./.github/actions/mkdocs diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml index e3fa2d779..2a82fa124 100644 --- a/.github/workflows/helm.yaml +++ b/.github/workflows/helm.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Run Artifact Hub lint run: | @@ -61,7 +61,7 @@ jobs: steps: - name: Checkout master - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 with: # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896 fetch-depth: 0 diff --git a/.github/workflows/perftest.yaml b/.github/workflows/perftest.yaml index 4b7e000a5..9e87bf1b2 100644 --- a/.github/workflows/perftest.yaml +++ b/.github/workflows/perftest.yaml @@ -19,7 +19,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Install K6 run: | diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index c56535223..f77c59937 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 with: fetch-depth: 0 diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index b0ce14f51..72acf608a 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -27,7 +27,7 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 with: persist-credentials: false diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index aae43d03c..acd5a13f8 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -22,7 +22,7 @@ jobs: versions: ${{ steps.version.outputs.TAGS }} steps: - name: Checkout code - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 with: fetch-depth: 0 @@ -52,7 +52,7 @@ jobs: versions: ${{ fromJSON(needs.version.outputs.versions) }} steps: - name: Checkout code - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 + uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - shell: bash id: test From 4053896179643e235534b145d68bbad6fc4b5b1c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Apr 2023 04:11:02 -0700 Subject: [PATCH 145/822] Bump github.com/opencontainers/runc from 1.1.5 to 1.1.6 (#9867) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.5 to 1.1.6. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.6/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.5...v1.1.6) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 25 ++----------------------- 2 files changed, 3 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index 4779437d7..1cc9a00dd 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 github.com/onsi/ginkgo/v2 v2.9.0 - github.com/opencontainers/runc v1.1.5 + github.com/opencontainers/runc v1.1.6 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.14.0 github.com/prometheus/client_model v0.3.0 diff --git a/go.sum b/go.sum index f0aef6bc6..b3c9af550 100644 --- a/go.sum +++ b/go.sum @@ -52,17 +52,13 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E= github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= -github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= -github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U= github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI= github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= -github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI= @@ -70,7 +66,6 @@ github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxG github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= github.com/eapache/channels v1.1.0 h1:F1taHcn7/F0i8DYqKXJnyhJcVpp2kgFcNePxXtnyu4k= github.com/eapache/channels v1.1.0/go.mod h1:jMm2qB5Ubtg9zLd+inMZd2/NUvXgzmWXsDaLyQIGfH0= @@ -86,7 +81,6 @@ github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= -github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= @@ -271,7 +265,6 @@ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4= github.com/moul/pb v0.0.0-20220425114252-bca18df4138c h1:1STmblv9zmHLDpru4dbnf1PNL6wrrZNf7yBH+SfQU+s= github.com/moul/pb v0.0.0-20220425114252-bca18df4138c/go.mod h1:jE2HT8eoucYyUPBFJMreiVlC3KPHkDMtN8wn+ef7Y64= -github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= @@ -294,11 +287,10 @@ github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxm github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754= -github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs= -github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= +github.com/opencontainers/runc v1.1.6 h1:XbhB8IfG/EsnhNvZtNdLB0GBw92GYEFvKlhaJk9jUgA= +github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= -github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI= github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= @@ -338,12 +330,9 @@ github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFR github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= -github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= -github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= @@ -370,11 +359,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww= github.com/urfave/cli v1.17.1-0.20160602030128-01a33823596e/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA= -github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0= -github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE= -github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU= github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk= github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= github.com/yudai/gojsondiff v1.0.0 h1:27cbfqXLVEJ1o8I6v3y9lg8Ydm53EKqHXAOMxEGlCOA= @@ -472,7 +457,6 @@ golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= @@ -506,7 +490,6 @@ golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -514,7 +497,6 @@ golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20191002063906-3421d5a6bb1c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -541,9 +523,7 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= @@ -699,7 +679,6 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= From 23a2b2473e2de0261c6d5faad82cc03d49cffb45 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Apr 2023 05:53:02 -0700 Subject: [PATCH 146/822] Bump aquasecurity/trivy-action from 0.9.2 to 0.10.0 (#9888) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.9.2 to 0.10.0. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/1f0aa582c8c8f5f7639610d6d38baddfea4fdcee...e5f43133f6e8736992c9f3c1b3296e24b37e17f2) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/vulnerability-scans.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/vulnerability-scans.yaml b/.github/workflows/vulnerability-scans.yaml index acd5a13f8..069c9f974 100644 --- a/.github/workflows/vulnerability-scans.yaml +++ b/.github/workflows/vulnerability-scans.yaml @@ -60,7 +60,7 @@ jobs: - name: Scan image with AquaSec/Trivy id: scan - uses: aquasecurity/trivy-action@1f0aa582c8c8f5f7639610d6d38baddfea4fdcee # v0.9.2 + uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # v0.10.0 with: image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }} format: 'sarif' From 9d9ff90eddcb8d514ecceb78b432e75f02a9b917 Mon Sep 17 00:00:00 2001 From: Elvin Efendi Date: Mon, 24 Apr 2023 08:55:02 -0400 Subject: [PATCH 147/822] I have not been able to fulfill my maintainer responsibilities for a while already, making it official now. (#9883) * I have not been able to fulfill my maintainer responsibilities for a while already, making it official now. * Make ElvinEfendi emeritus approver --- OWNERS | 1 + OWNERS_ALIASES | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/OWNERS b/OWNERS index 71f3328f1..da1da1b2e 100644 --- a/OWNERS +++ b/OWNERS @@ -9,3 +9,4 @@ reviewers: emeritus_approvers: - aledbf # 2020-04-02 - bowei # 2022-10-12 +- ElvinEfendi # 2023-04-23 diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 33c986f57..cd9001dd2 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -11,7 +11,6 @@ aliases: - strongjz ingress-nginx-maintainers: - - ElvinEfendi - rikatz - strongjz - cpanato @@ -19,7 +18,6 @@ aliases: - tao12345666333 ingress-nginx-reviewers: - - ElvinEfendi - rikatz - strongjz - puerco From d7ba103515fe6449d6c88a5d726827a8387faa41 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Apr 2023 07:03:04 -0700 Subject: [PATCH 148/822] Bump github.com/prometheus/client_golang from 1.14.0 to 1.15.0 (#9868) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.14.0 to 1.15.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.14.0...v1.15.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 13 +++++++------ 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 1cc9a00dd..75b0e8e1f 100644 --- a/go.mod +++ b/go.mod @@ -17,7 +17,7 @@ require ( github.com/onsi/ginkgo/v2 v2.9.0 github.com/opencontainers/runc v1.1.6 github.com/pmezard/go-difflib v1.0.0 - github.com/prometheus/client_golang v1.14.0 + github.com/prometheus/client_golang v1.15.0 github.com/prometheus/client_model v0.3.0 github.com/prometheus/common v0.42.0 github.com/spf13/cobra v1.7.0 @@ -66,7 +66,7 @@ require ( github.com/godbus/dbus/v5 v5.0.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect - github.com/golang/protobuf v1.5.2 // indirect + github.com/golang/protobuf v1.5.3 // indirect github.com/gomarkdown/markdown v0.0.0-20210514010506-3b9f47219fe7 // indirect github.com/google/btree v1.0.1 // indirect github.com/google/gnostic v0.5.7-v3refs // indirect @@ -110,7 +110,7 @@ require ( golang.org/x/tools v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect - google.golang.org/protobuf v1.28.1 // indirect + google.golang.org/protobuf v1.30.0 // indirect gopkg.in/go-playground/assert.v1 v1.2.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v2 v2.4.0 // indirect diff --git a/go.sum b/go.sum index b3c9af550..49a716752 100644 --- a/go.sum +++ b/go.sum @@ -148,8 +148,9 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= -github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/gomarkdown/markdown v0.0.0-20210514010506-3b9f47219fe7 h1:oKYOfNR7Hp6XpZ4JqolL5u642Js5Z0n7psPVl+S5heo= github.com/gomarkdown/markdown v0.0.0-20210514010506-3b9f47219fe7/go.mod h1:aii0r/K0ZnHv7G0KF7xy1v0A7s2Ljrb5byB7MO5p6TU= github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= @@ -223,8 +224,8 @@ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFB github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= -github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0= github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -304,8 +305,8 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= -github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw= -github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y= +github.com/prometheus/client_golang v1.15.0 h1:5fCgGYogn0hFdhyhLbw7hEsWxufKtY9klyvdNfFlFhM= +github.com/prometheus/client_golang v1.15.0/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= @@ -679,8 +680,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w= -google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng= +google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 01d2646538242a6409be3b8cf1b29d7b92c090f0 Mon Sep 17 00:00:00 2001 From: plynch-magnolia Date: Mon, 24 Apr 2023 11:33:02 -0400 Subject: [PATCH 149/822] Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803) --- charts/ingress-nginx/templates/default-backend-hpa.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/charts/ingress-nginx/templates/default-backend-hpa.yaml b/charts/ingress-nginx/templates/default-backend-hpa.yaml index f9ae0b276..924125f07 100644 --- a/charts/ingress-nginx/templates/default-backend-hpa.yaml +++ b/charts/ingress-nginx/templates/default-backend-hpa.yaml @@ -22,12 +22,16 @@ spec: - type: Resource resource: name: cpu - targetAverageUtilization: {{ . }} + target: + type: Utilization + averageUtilization: {{ . }} {{- end }} {{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }} - type: Resource resource: name: memory - targetAverageUtilization: {{ . }} + target: + type: Utilization + averageUtilization: {{ . }} {{- end }} {{- end }} From 405a5aa44c828d151c62d914e68cd39954370152 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Mon, 24 Apr 2023 11:33:50 -0500 Subject: [PATCH 150/822] add some e2e tests (unfinished) + fix findMountPoint bug --- pkg/util/runtime/cpu_linux.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index 5228c93a2..4d755f4c5 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -38,7 +38,6 @@ import ( func NumCPU() int { cpus := runtime.NumCPU() - cgroupPath, err := libcontainercgroups.FindCgroupMountpoint("", "cpu") if err != nil { return cpus } @@ -48,10 +47,11 @@ func NumCPU() int { cpuPeriod := int64(-1) if cgroupVersion == 1 { + cgroupPath, err := libcontainercgroups.FindCgroupMountpoint("", "cpu") cpuQuota = readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") cpuPeriod = readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") } else if cgroupVersion == 2 { - cpuQuota, cpuPeriod = readCgroup2FileToInt64Tuple(cgroupPath, "cpu.max") + cpuQuota, cpuPeriod = readCgroup2FileToInt64Tuple("cpu.max") } if cpuQuota == -1 || cpuPeriod == -1 { @@ -71,7 +71,7 @@ func getCgroupVersion() int64 { } func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { - contents, err := os.ReadFile(filepath.Join(cgroupPath, cgroupFile)) + contents, err := os.ReadFile(filepath.Join("/sys/fs/cgroup/", cgroupFile)) if err != nil { return -1, -1 From aa9a87621742343c8188cc7f89be234e9f956e8f Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Mon, 24 Apr 2023 11:34:21 -0500 Subject: [PATCH 151/822] typo --- pkg/util/runtime/cpu_linux.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index 4d755f4c5..b4d6997b9 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -70,7 +70,7 @@ func getCgroupVersion() int64 { } } -func readCgroup2FileToInt64Tuple(cgroupPath, cgroupFile string) (int64, int64) { +func readCgroup2FileToInt64Tuple(cgroupFile string) (int64, int64) { contents, err := os.ReadFile(filepath.Join("/sys/fs/cgroup/", cgroupFile)) if err != nil { From fa44f2f7cd4ee49864fceddfbe517d9918d85c1d Mon Sep 17 00:00:00 2001 From: Carlos Tadeu Panato Junior Date: Tue, 25 Apr 2023 15:12:17 +0200 Subject: [PATCH 152/822] update k8s.io dependecies to v0.26.4 (#9893) Signed-off-by: cpanato --- go.mod | 16 ++++++++-------- go.sum | 32 ++++++++++++++++---------------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index 75b0e8e1f..54929c1a7 100644 --- a/go.mod +++ b/go.mod @@ -30,14 +30,14 @@ require ( google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 - k8s.io/api v0.26.3 - k8s.io/apiextensions-apiserver v0.26.1 - k8s.io/apimachinery v0.26.3 - k8s.io/apiserver v0.26.1 - k8s.io/cli-runtime v0.26.0 - k8s.io/client-go v0.26.3 - k8s.io/code-generator v0.26.1 - k8s.io/component-base v0.26.3 + k8s.io/api v0.26.4 + k8s.io/apiextensions-apiserver v0.26.4 + k8s.io/apimachinery v0.26.4 + k8s.io/apiserver v0.26.4 + k8s.io/cli-runtime v0.26.4 + k8s.io/client-go v0.26.4 + k8s.io/code-generator v0.26.4 + k8s.io/component-base v0.26.4 k8s.io/klog/v2 v2.90.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.6 diff --git a/go.sum b/go.sum index 49a716752..4d2b69333 100644 --- a/go.sum +++ b/go.sum @@ -720,22 +720,22 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= -k8s.io/api v0.26.3 h1:emf74GIQMTik01Aum9dPP0gAypL8JTLl/lHa4V9RFSU= -k8s.io/api v0.26.3/go.mod h1:PXsqwPMXBSBcL1lJ9CYDKy7kIReUydukS5JiRlxC3qE= -k8s.io/apiextensions-apiserver v0.26.1 h1:cB8h1SRk6e/+i3NOrQgSFij1B2S0Y0wDoNl66bn8RMI= -k8s.io/apiextensions-apiserver v0.26.1/go.mod h1:AptjOSXDGuE0JICx/Em15PaoO7buLwTs0dGleIHixSM= -k8s.io/apimachinery v0.26.3 h1:dQx6PNETJ7nODU3XPtrwkfuubs6w7sX0M8n61zHIV/k= -k8s.io/apimachinery v0.26.3/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= -k8s.io/apiserver v0.26.1 h1:6vmnAqCDO194SVCPU3MU8NcDgSqsUA62tBUSWrFXhsc= -k8s.io/apiserver v0.26.1/go.mod h1:wr75z634Cv+sifswE9HlAo5FQ7UoUauIICRlOE+5dCg= -k8s.io/cli-runtime v0.26.0 h1:aQHa1SyUhpqxAw1fY21x2z2OS5RLtMJOCj7tN4oq8mw= -k8s.io/cli-runtime v0.26.0/go.mod h1:o+4KmwHzO/UK0wepE1qpRk6l3o60/txUZ1fEXWGIKTY= -k8s.io/client-go v0.26.3 h1:k1UY+KXfkxV2ScEL3gilKcF7761xkYsSD6BC9szIu8s= -k8s.io/client-go v0.26.3/go.mod h1:ZPNu9lm8/dbRIPAgteN30RSXea6vrCpFvq+MateTUuQ= -k8s.io/code-generator v0.26.1 h1:dusFDsnNSKlMFYhzIM0jAO1OlnTN5WYwQQ+Ai12IIlo= -k8s.io/code-generator v0.26.1/go.mod h1:OMoJ5Dqx1wgaQzKgc+ZWaZPfGjdRq/Y3WubFrZmeI3I= -k8s.io/component-base v0.26.3 h1:oC0WMK/ggcbGDTkdcqefI4wIZRYdK3JySx9/HADpV0g= -k8s.io/component-base v0.26.3/go.mod h1:5kj1kZYwSC6ZstHJN7oHBqcJC6yyn41eR+Sqa/mQc8E= +k8s.io/api v0.26.4 h1:qSG2PmtcD23BkYiWfoYAcak870eF/hE7NNYBYavTT94= +k8s.io/api v0.26.4/go.mod h1:WwKEXU3R1rgCZ77AYa7DFksd9/BAIKyOmRlbVxgvjCk= +k8s.io/apiextensions-apiserver v0.26.4 h1:9D2RTxYGxrG5uYg6D7QZRcykXvavBvcA59j5kTaedQI= +k8s.io/apiextensions-apiserver v0.26.4/go.mod h1:cd4uGFGIgzEqUghWpRsr9KE8j2KNTjY8Ji8pnMMazyw= +k8s.io/apimachinery v0.26.4 h1:rZccKdBLg9vP6J09JD+z8Yr99Ce8gk3Lbi9TCx05Jzs= +k8s.io/apimachinery v0.26.4/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I= +k8s.io/apiserver v0.26.4 h1:3Oq4mnJv0mzVX7BR/Nod+8KjlELf/3Ljvu9ZWDyLUoA= +k8s.io/apiserver v0.26.4/go.mod h1:yAY3O1vBM4/0OIGAGeWcdfzQvgdwJ188VirLcuSAVnw= +k8s.io/cli-runtime v0.26.4 h1:MgSU871KDzBDX7V9GtuqS6Ai9lhQCHgRzkurnXOWtZ0= +k8s.io/cli-runtime v0.26.4/go.mod h1:MjJ2DXMChw2zcG0/agzm17xwKpfVxOfuoCdfY9iOCOE= +k8s.io/client-go v0.26.4 h1:/7P/IbGBuT73A+G97trf44NTPSNqvuBREpOfdLbHvD4= +k8s.io/client-go v0.26.4/go.mod h1:6qOItWm3EwxJdl/8p5t7FWtWUOwyMdA8N9ekbW4idpI= +k8s.io/code-generator v0.26.4 h1:zgDD0qX13p/jtrAoYRRiYeQ5ibnriwmo2cMkMZAtJxc= +k8s.io/code-generator v0.26.4/go.mod h1:ryaiIKwfxEJEaywEzx3dhWOydpVctKYbqLajJf0O8dI= +k8s.io/component-base v0.26.4 h1:Bg2xzyXNKL3eAuiTEu3XE198d6z22ENgFgGQv2GGOUk= +k8s.io/component-base v0.26.4/go.mod h1:lTuWL1Xz/a4e80gmIC3YZG2JCO4xNwtKWHJWeJmsq20= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= From 3714c2c426885e8b4730cefc6b04d3d997102bec Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Tue, 25 Apr 2023 10:19:07 -0500 Subject: [PATCH 153/822] move error check --- pkg/util/runtime/cpu_linux.go | 7 +++---- test/e2e/cgroups/cgroups.go | 19 +++++++++++++++---- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index b4d6997b9..c72f47f01 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -38,16 +38,15 @@ import ( func NumCPU() int { cpus := runtime.NumCPU() - if err != nil { - return cpus - } - cgroupVersion := getCgroupVersion() cpuQuota := int64(-1) cpuPeriod := int64(-1) if cgroupVersion == 1 { cgroupPath, err := libcontainercgroups.FindCgroupMountpoint("", "cpu") + if err != nil { + return cpus + } cpuQuota = readCgroupFileToInt64(cgroupPath, "cpu.cfs_quota_us") cpuPeriod = readCgroupFileToInt64(cgroupPath, "cpu.cfs_period_us") } else if cgroupVersion == 2 { diff --git a/test/e2e/cgroups/cgroups.go b/test/e2e/cgroups/cgroups.go index 34d6c037a..4ee6bf927 100644 --- a/test/e2e/cgroups/cgroups.go +++ b/test/e2e/cgroups/cgroups.go @@ -17,6 +17,9 @@ limitations under the License. package cgroups import ( + "log" + "os" + "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -33,15 +36,23 @@ var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { f.NewSlowEchoDeployment() }) + ginkgo.It("detects cgroups version v1", func() { + assert.Equal(ginkgo.GinkgoT(), runtime.getCgroupVersion(), 1) + }) + ginkgo.It("detects number of CPUs properly in cgroups v1", func() { assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) }) + ginkgo.It("detects cgroups version v2", func() { + // create cgroups2 files + if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { + log.Fatal(err) + } + + }) + ginkgo.It("detects number of CPUs properly in cgroups v2", func() { assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) }) - - ginkgo.It("detects cgroups version", func() { - - }) }) From 6d96e111c8e15081c36bf0448745cb3eb73b1cb4 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Tue, 25 Apr 2023 19:24:34 -0500 Subject: [PATCH 154/822] try to figure out testing flags --- Makefile | 2 +- pkg/util/runtime/cpu_linux.go | 4 +++ pkg/util/runtime/cpu_notlinux.go | 4 +++ test/e2e/cgroups/cgroups.go | 58 -------------------------------- 4 files changed, 9 insertions(+), 59 deletions(-) delete mode 100644 test/e2e/cgroups/cgroups.go diff --git a/Makefile b/Makefile index 6037ac39d..357ef9827 100644 --- a/Makefile +++ b/Makefile @@ -167,7 +167,7 @@ kind-e2e-chart-tests: ## Run helm chart e2e tests e2e-test-binary: ## Build binary for e2e tests. @build/run-in-docker.sh \ MAC_OS=$(MAC_OS) \ - ginkgo build ./test/e2e + ginkgo build ./test/e2e -tags linux .PHONY: print-e2e-suite print-e2e-suite: e2e-test-binary ## Prints information about the suite of e2e tests. diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index c72f47f01..e5e8db40a 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -60,6 +60,10 @@ func NumCPU() int { return int(math.Ceil(float64(cpuQuota) / float64(cpuPeriod))) } +func IsCgroupAvaliable() bool { + return true +} + func getCgroupVersion() int64 { // /sys/fs/cgroup/cgroup.controllers will not exist with cgroupsv1 if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); err == nil { diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 2a1b48252..3c4c6718b 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -27,3 +27,7 @@ import ( func NumCPU() int { return runtime.NumCPU() } + +func IsCgroupAvaliable() bool { + return false +} diff --git a/test/e2e/cgroups/cgroups.go b/test/e2e/cgroups/cgroups.go deleted file mode 100644 index 4ee6bf927..000000000 --- a/test/e2e/cgroups/cgroups.go +++ /dev/null @@ -1,58 +0,0 @@ -/* -Copyright 2020 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package cgroups - -import ( - "log" - "os" - - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - - "k8s.io/ingress-nginx/test/e2e/framework" - - "k8s.io/ingress-nginx/pkg/util/runtime" -) - -var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { - f := framework.NewDefaultFramework("cgroups") - - ginkgo.BeforeEach(func() { - f.NewEchoDeployment() - f.NewSlowEchoDeployment() - }) - - ginkgo.It("detects cgroups version v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.getCgroupVersion(), 1) - }) - - ginkgo.It("detects number of CPUs properly in cgroups v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) - }) - - ginkgo.It("detects cgroups version v2", func() { - // create cgroups2 files - if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { - log.Fatal(err) - } - - }) - - ginkgo.It("detects number of CPUs properly in cgroups v2", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) - }) -}) From 475adf734ad9f1d85ece1d344a2b2636de7b4fa4 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Tue, 25 Apr 2023 19:32:59 -0500 Subject: [PATCH 155/822] add files --- test/e2e/cgroups/cgroups_linux.go | 65 ++++++++++++++++++++++++++++ test/e2e/cgroups/cgroups_notlinux.go | 42 ++++++++++++++++++ 2 files changed, 107 insertions(+) create mode 100644 test/e2e/cgroups/cgroups_linux.go create mode 100644 test/e2e/cgroups/cgroups_notlinux.go diff --git a/test/e2e/cgroups/cgroups_linux.go b/test/e2e/cgroups/cgroups_linux.go new file mode 100644 index 000000000..18b3f837b --- /dev/null +++ b/test/e2e/cgroups/cgroups_linux.go @@ -0,0 +1,65 @@ +//go:build linux +// +build linux + +/* +Copyright 2020 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package cgroups + +import ( + "log" + "os" + + "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" + + "k8s.io/ingress-nginx/test/e2e/framework" + + "k8s.io/ingress-nginx/pkg/util/runtime" +) + +var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { + f := framework.NewDefaultFramework("cgroups") + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + f.NewSlowEchoDeployment() + }) + + ginkgo.It("detects if cgroups is avaliable", func() { + assert.Equal(ginkgo.GinkgoT(), runtime.IsCgroupAvaliable(), 1) + }) + + ginkgo.It("detects cgroups version v1", func() { + assert.Equal(ginkgo.GinkgoT(), runtime.readCgroupFileToInt64(), 1) + }) + + ginkgo.It("detects number of CPUs properly in cgroups v1", func() { + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) + }) + + ginkgo.It("detects cgroups version v2", func() { + // create cgroups2 files + if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { + log.Fatal(err) + } + + }) + + ginkgo.It("detects number of CPUs properly in cgroups v2", func() { + assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) + }) +}) diff --git a/test/e2e/cgroups/cgroups_notlinux.go b/test/e2e/cgroups/cgroups_notlinux.go new file mode 100644 index 000000000..483db52cc --- /dev/null +++ b/test/e2e/cgroups/cgroups_notlinux.go @@ -0,0 +1,42 @@ +//go:build !linux +// +build !linux + +/* +Copyright 2020 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package cgroups + +import ( + "github.com/onsi/ginkgo/v2" + "github.com/stretchr/testify/assert" + + "k8s.io/ingress-nginx/test/e2e/framework" + + "k8s.io/ingress-nginx/pkg/util/runtime" +) + +var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { + f := framework.NewDefaultFramework("cgroups") + + ginkgo.BeforeEach(func() { + f.NewEchoDeployment() + f.NewSlowEchoDeployment() + }) + + ginkgo.It("detects cgroups is not avaliable", func() { + assert.True(ginkgo.GinkgoT(), !runtime.IsCgroupAvaliable()) + }) +}) From 82d8cded6123da44860a4b143c07bb9a30ae3cc3 Mon Sep 17 00:00:00 2001 From: tzssangglass Date: Mon, 1 May 2023 19:22:18 +0800 Subject: [PATCH 156/822] ensure make lua-test runs locally (#9902) --- Makefile | 1 - test/test-lua.sh | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 6037ac39d..fc40a39bb 100644 --- a/Makefile +++ b/Makefile @@ -147,7 +147,6 @@ test: ## Run go unit tests. .PHONY: lua-test lua-test: ## Run lua unit tests. @build/run-in-docker.sh \ - BUSTED_ARGS=$(BUSTED_ARGS) \ MAC_OS=$(MAC_OS) \ test/test-lua.sh diff --git a/test/test-lua.sh b/test/test-lua.sh index 9c8149eac..fc60023f8 100755 --- a/test/test-lua.sh +++ b/test/test-lua.sh @@ -41,7 +41,7 @@ SHDICT_ARGS=( ) if [ $# -eq 0 ]; then - resty "${SHDICT_ARGS[@]}" ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test + resty "${SHDICT_ARGS[@]}" ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test ${BUSTED_ARGS} else - resty "${SHDICT_ARGS[@]}" $@ + resty "${SHDICT_ARGS[@]}" $@ ${BUSTED_ARGS} fi From 97a1a6d616b1bea4edd1404cbbdcf4b759be26f7 Mon Sep 17 00:00:00 2001 From: Ron Nabuurs Date: Mon, 1 May 2023 13:24:17 +0200 Subject: [PATCH 157/822] Fix typo in OpenTelemetry (#9903) I've noticed a small typo, which I've fixed. --- docs/user-guide/third-party-addons/opentelemetry.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/third-party-addons/opentelemetry.md b/docs/user-guide/third-party-addons/opentelemetry.md index d966dff1f..7aeea541c 100644 --- a/docs/user-guide/third-party-addons/opentelemetry.md +++ b/docs/user-guide/third-party-addons/opentelemetry.md @@ -27,7 +27,7 @@ We must also set the host to use when uploading traces: ```yaml otlp-collector-host: "otel-coll-collector.otel.svc" ``` -NOTE: While the option is called `otlp-collector-host`, you will need to point this to any backend that recieves otlp-grpc. +NOTE: While the option is called `otlp-collector-host`, you will need to point this to any backend that receives otlp-grpc. Next you will need to deploy a distributed telemetry system which uses OpenTelemetry. [opentelemetry-collector](https://github.com/open-telemetry/opentelemetry-collector), [Jaeger](https://www.jaegertracing.io/) From ae989d7722bcdc626986a4f8afd69d97eacb471d Mon Sep 17 00:00:00 2001 From: Jacob Henner Date: Mon, 1 May 2023 07:32:18 -0400 Subject: [PATCH 158/822] Add support for --container flag (#9703) Add support for --container flag, which sets an explicit container name for exec operations. Defaults to `controller`. Signed-off-by: Jacob Henner --- cmd/plugin/commands/backends/backends.go | 9 +++++---- cmd/plugin/commands/certs/certs.go | 9 +++++---- cmd/plugin/commands/conf/conf.go | 9 +++++---- cmd/plugin/commands/exec/exec.go | 10 ++++++---- cmd/plugin/commands/general/general.go | 9 +++++---- cmd/plugin/commands/logs/logs.go | 9 +++++---- cmd/plugin/commands/ssh/ssh.go | 9 +++++---- cmd/plugin/kubectl/kubectl.go | 4 ++-- cmd/plugin/util/util.go | 8 ++++++++ docs/kubectl-plugin.md | 2 +- 10 files changed, 47 insertions(+), 31 deletions(-) diff --git a/cmd/plugin/commands/backends/backends.go b/cmd/plugin/commands/backends/backends.go index 341c62a9c..afc98e4d6 100644 --- a/cmd/plugin/commands/backends/backends.go +++ b/cmd/plugin/commands/backends/backends.go @@ -30,7 +30,7 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "backends", Short: "Inspect the dynamic backend information of an ingress-nginx instance", @@ -47,7 +47,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return fmt.Errorf("--list and --backend cannot both be specified") } - util.PrintError(backends(flags, *pod, *deployment, *selector, backend, onlyList)) + util.PrintError(backends(flags, *pod, *deployment, *selector, *container, backend, onlyList)) return nil }, } @@ -55,6 +55,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) cmd.Flags().String("backend", "", "Output only the information for the given backend") cmd.Flags().Bool("list", false, "Output a newline-separated list of backend names") @@ -62,7 +63,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return cmd } -func backends(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, backend string, onlyList bool) error { +func backends(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, backend string, onlyList bool) error { var command []string if onlyList { command = []string{"/dbg", "backends", "list"} @@ -77,7 +78,7 @@ func backends(flags *genericclioptions.ConfigFlags, podName string, deployment s return err } - out, err := kubectl.PodExecString(flags, &pod, command) + out, err := kubectl.PodExecString(flags, &pod, container, command) if err != nil { return err } diff --git a/cmd/plugin/commands/certs/certs.go b/cmd/plugin/commands/certs/certs.go index 07fd08ad3..88b721ee3 100644 --- a/cmd/plugin/commands/certs/certs.go +++ b/cmd/plugin/commands/certs/certs.go @@ -30,7 +30,7 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "certs", Short: "Output the certificate data stored in an ingress-nginx pod", @@ -40,7 +40,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return err } - util.PrintError(certs(flags, *pod, *deployment, *selector, host)) + util.PrintError(certs(flags, *pod, *deployment, *selector, *container, host)) return nil }, } @@ -50,11 +50,12 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) return cmd } -func certs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, host string) error { +func certs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, host string) error { command := []string{"/dbg", "certs", "get", host} pod, err := request.ChoosePod(flags, podName, deployment, selector) @@ -62,7 +63,7 @@ func certs(flags *genericclioptions.ConfigFlags, podName string, deployment stri return err } - out, err := kubectl.PodExecString(flags, &pod, command) + out, err := kubectl.PodExecString(flags, &pod, container, command) if err != nil { return err } diff --git a/cmd/plugin/commands/conf/conf.go b/cmd/plugin/commands/conf/conf.go index 5caa2a649..a7f03a062 100644 --- a/cmd/plugin/commands/conf/conf.go +++ b/cmd/plugin/commands/conf/conf.go @@ -32,7 +32,7 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "conf", Short: "Inspect the generated nginx.conf", @@ -42,7 +42,7 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { return err } - util.PrintError(conf(flags, host, *pod, *deployment, *selector)) + util.PrintError(conf(flags, host, *pod, *deployment, *selector, *container)) return nil }, } @@ -50,17 +50,18 @@ func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) return cmd } -func conf(flags *genericclioptions.ConfigFlags, host string, podName string, deployment string, selector string) error { +func conf(flags *genericclioptions.ConfigFlags, host string, podName string, deployment string, selector string, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err } - nginxConf, err := kubectl.PodExecString(flags, &pod, []string{"/dbg", "conf"}) + nginxConf, err := kubectl.PodExecString(flags, &pod, container, []string{"/dbg", "conf"}) if err != nil { return err } diff --git a/cmd/plugin/commands/exec/exec.go b/cmd/plugin/commands/exec/exec.go index 5f1a31913..f06aaeb23 100644 --- a/cmd/plugin/commands/exec/exec.go +++ b/cmd/plugin/commands/exec/exec.go @@ -29,19 +29,21 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { opts := execFlags{} - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "exec", Short: "Execute a command inside an ingress-nginx pod", RunE: func(cmd *cobra.Command, args []string) error { - util.PrintError(exec(flags, *pod, *deployment, *selector, args, opts)) + util.PrintError(exec(flags, *pod, *deployment, *selector, *container, args, opts)) return nil }, } pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) + cmd.Flags().BoolVarP(&opts.TTY, "tty", "t", false, "Stdin is a TTY") cmd.Flags().BoolVarP(&opts.Stdin, "stdin", "i", false, "Pass stdin to the container") @@ -53,7 +55,7 @@ type execFlags struct { Stdin bool } -func exec(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, cmd []string, opts execFlags) error { +func exec(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, cmd []string, opts execFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err @@ -67,7 +69,7 @@ func exec(flags *genericclioptions.ConfigFlags, podName string, deployment strin args = append(args, "-i") } - args = append(args, []string{"-n", pod.Namespace, pod.Name, "--"}...) + args = append(args, []string{"-n", pod.Namespace, "-c", container, pod.Name, "--"}...) args = append(args, cmd...) return kubectl.Exec(flags, args) } diff --git a/cmd/plugin/commands/general/general.go b/cmd/plugin/commands/general/general.go index 44e02ca88..fa6c1301f 100644 --- a/cmd/plugin/commands/general/general.go +++ b/cmd/plugin/commands/general/general.go @@ -30,29 +30,30 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "general", Short: "Inspect the other dynamic ingress-nginx information", RunE: func(cmd *cobra.Command, args []string) error { - util.PrintError(general(flags, *pod, *deployment, *selector)) + util.PrintError(general(flags, *pod, *deployment, *selector, *container)) return nil }, } pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) return cmd } -func general(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string) error { +func general(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err } - out, err := kubectl.PodExecString(flags, &pod, []string{"/dbg", "general"}) + out, err := kubectl.PodExecString(flags, &pod, container, []string{"/dbg", "general"}) if err != nil { return err } diff --git a/cmd/plugin/commands/logs/logs.go b/cmd/plugin/commands/logs/logs.go index 55cd008dc..56f4fc640 100644 --- a/cmd/plugin/commands/logs/logs.go +++ b/cmd/plugin/commands/logs/logs.go @@ -31,19 +31,20 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { o := logsFlags{} - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "logs", Short: "Get the kubernetes logs for an ingress-nginx pod", RunE: func(cmd *cobra.Command, args []string) error { - util.PrintError(logs(flags, *pod, *deployment, *selector, o)) + util.PrintError(logs(flags, *pod, *deployment, *selector, *container, o)) return nil }, } pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) cmd.Flags().BoolVarP(&o.Follow, "follow", "f", o.Follow, "Specify if the logs should be streamed.") cmd.Flags().BoolVar(&o.Timestamps, "timestamps", o.Timestamps, "Include timestamps on each line in the log output") @@ -94,13 +95,13 @@ func (o *logsFlags) toStrings() []string { return r } -func logs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, opts logsFlags) error { +func logs(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string, opts logsFlags) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err } - cmd := []string{"logs", "-n", pod.Namespace, pod.Name} + cmd := []string{"logs", "-n", pod.Namespace, "-c", container, pod.Name} cmd = append(cmd, opts.toStrings()...) return kubectl.Exec(flags, cmd) } diff --git a/cmd/plugin/commands/ssh/ssh.go b/cmd/plugin/commands/ssh/ssh.go index 5e8b49fac..fe1b3e9fe 100644 --- a/cmd/plugin/commands/ssh/ssh.go +++ b/cmd/plugin/commands/ssh/ssh.go @@ -28,27 +28,28 @@ import ( // CreateCommand creates and returns this cobra subcommand func CreateCommand(flags *genericclioptions.ConfigFlags) *cobra.Command { - var pod, deployment, selector *string + var pod, deployment, selector, container *string cmd := &cobra.Command{ Use: "ssh", Short: "ssh into a running ingress-nginx pod", RunE: func(cmd *cobra.Command, args []string) error { - util.PrintError(ssh(flags, *pod, *deployment, *selector)) + util.PrintError(ssh(flags, *pod, *deployment, *selector, *container)) return nil }, } pod = util.AddPodFlag(cmd) deployment = util.AddDeploymentFlag(cmd) selector = util.AddSelectorFlag(cmd) + container = util.AddContainerFlag(cmd) return cmd } -func ssh(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string) error { +func ssh(flags *genericclioptions.ConfigFlags, podName string, deployment string, selector string, container string) error { pod, err := request.ChoosePod(flags, podName, deployment, selector) if err != nil { return err } - return kubectl.Exec(flags, []string{"exec", "-it", "-n", pod.Namespace, pod.Name, "--", "/bin/bash"}) + return kubectl.Exec(flags, []string{"exec", "-it", "-n", pod.Namespace, "-c", container, pod.Name, "--", "/bin/bash"}) } diff --git a/cmd/plugin/kubectl/kubectl.go b/cmd/plugin/kubectl/kubectl.go index c11ba5b77..3f31a2104 100644 --- a/cmd/plugin/kubectl/kubectl.go +++ b/cmd/plugin/kubectl/kubectl.go @@ -31,8 +31,8 @@ import ( // PodExecString takes a pod and a command, uses kubectl exec to run the command in the pod // and returns stdout as a string -func PodExecString(flags *genericclioptions.ConfigFlags, pod *apiv1.Pod, args []string) (string, error) { - args = append([]string{"exec", "-n", pod.Namespace, pod.Name}, args...) +func PodExecString(flags *genericclioptions.ConfigFlags, pod *apiv1.Pod, container string, args []string) (string, error) { + args = append([]string{"exec", "-n", pod.Namespace, "-c", container, pod.Name}, args...) return ExecToString(flags, args) } diff --git a/cmd/plugin/util/util.go b/cmd/plugin/util/util.go index cc9882009..e1910140d 100644 --- a/cmd/plugin/util/util.go +++ b/cmd/plugin/util/util.go @@ -31,6 +31,7 @@ import ( const ( DefaultIngressDeploymentName = "ingress-nginx-controller" DefaultIngressServiceName = "ingress-nginx-controller" + DefaultIngressContainerName = "controller" ) // IssuePrefix is the github url that we can append an issue number to to link to it @@ -127,6 +128,13 @@ func AddSelectorFlag(cmd *cobra.Command) *string { return &v } +// AddContainerFlag adds a --container flag to a cobra command +func AddContainerFlag(cmd *cobra.Command) *string { + v := "" + cmd.Flags().StringVar(&v, "container", DefaultIngressContainerName, "The name of the ingress-nginx controller container") + return &v +} + // GetNamespace takes a set of kubectl flag values and returns the namespace we should be operating in func GetNamespace(flags *genericclioptions.ConfigFlags) string { namespace, _, err := flags.ToRawKubeConfigLoader().Namespace() diff --git a/docs/kubectl-plugin.md b/docs/kubectl-plugin.md index 2b6381f6f..9e5a5dcc6 100644 --- a/docs/kubectl-plugin.md +++ b/docs/kubectl-plugin.md @@ -68,7 +68,7 @@ Use "ingress-nginx [command] --help" for more information about a command. ## Common Flags - Every subcommand supports the basic `kubectl` configuration flags like `--namespace`, `--context`, `--client-key` and so on. -- Subcommands that act on a particular `ingress-nginx` pod (`backends`, `certs`, `conf`, `exec`, `general`, `logs`, `ssh`), support the `--deployment ` and `--pod ` flags to select either a pod from a deployment with the given name, or a pod with the given name. The `--deployment` flag defaults to `ingress-nginx-controller`. +- Subcommands that act on a particular `ingress-nginx` pod (`backends`, `certs`, `conf`, `exec`, `general`, `logs`, `ssh`), support the `--deployment `, `--pod `, and `--container ` flags to select either a pod from a deployment with the given name, or a pod with the given name (and the given container name). The `--deployment` flag defaults to `ingress-nginx-controller`, and the `--container` flag defaults to `controller`. - Subcommands that inspect resources (`ingresses`, `lint`) support the `--all-namespaces` flag, which causes them to inspect resources in every namespace. ## Subcommands From d8f54420a47582fd128ec3a85d1f67a2eb983b01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan-Otto=20Kr=C3=B6pke?= Date: Mon, 1 May 2023 17:18:19 +0200 Subject: [PATCH 159/822] [helm] Support custom port configuration for internal service (#9846) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jan-Otto Kröpke --- charts/ingress-nginx/README.md | 2 ++ .../ci/deployment-internal-lb-values.yaml | 6 ++++++ .../templates/controller-service-internal.yaml | 8 ++++---- charts/ingress-nginx/values.yaml | 11 +++++++++++ 4 files changed, 23 insertions(+), 4 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index b7c97939d..70a2ea688 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -406,6 +406,8 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. | | controller.service.internal.enabled | bool | `false` | Enables an additional internal load balancer (besides the external one). | | controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. | +| controller.service.internal.ports | object | `{}` | Custom port mapping for internal service | +| controller.service.internal.targetPorts | object | `{}` | Custom target port mapping for internal service | | controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ | | controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack-ness requested or required by this Service. Possible values are SingleStack, PreferDualStack or RequireDualStack. The ipFamilies and clusterIPs fields depend on the value of this field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ | | controller.service.labels | object | `{}` | | diff --git a/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml b/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml index fd8df8de5..663ccb9d1 100644 --- a/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml +++ b/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml @@ -11,3 +11,9 @@ controller: enabled: true annotations: service.beta.kubernetes.io/aws-load-balancer-internal: "true" + ports: + http: 443 + https: 80 + targetPorts: + http: 443 + https: 80 diff --git a/charts/ingress-nginx/templates/controller-service-internal.yaml b/charts/ingress-nginx/templates/controller-service-internal.yaml index aae3e155e..87146b746 100644 --- a/charts/ingress-nginx/templates/controller-service-internal.yaml +++ b/charts/ingress-nginx/templates/controller-service-internal.yaml @@ -29,9 +29,9 @@ spec: {{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }} {{- if .Values.controller.service.enableHttp }} - name: http - port: {{ .Values.controller.service.ports.http }} + port: {{ .Values.controller.service.internal.ports.http | default .Values.controller.service.ports.http }} protocol: TCP - targetPort: {{ .Values.controller.service.targetPorts.http }} + targetPort: {{ .Values.controller.service.internal.targetPorts.http | default .Values.controller.service.targetPorts.http }} {{- if semverCompare ">=1.20" .Capabilities.KubeVersion.Version }} appProtocol: http {{- end }} @@ -41,9 +41,9 @@ spec: {{- end }} {{- if .Values.controller.service.enableHttps }} - name: https - port: {{ .Values.controller.service.ports.https }} + port: {{ .Values.controller.service.internal.ports.https | default .Values.controller.service.ports.https }} protocol: TCP - targetPort: {{ .Values.controller.service.targetPorts.https }} + targetPort: {{ .Values.controller.service.internal.targetPorts.https | default .Values.controller.service.targetPorts.https }} {{- if semverCompare ">=1.20" .Capabilities.KubeVersion.Version }} appProtocol: https {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index c2e8cdcd7..611c384f0 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -482,6 +482,17 @@ controller: ## providers supporting it ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer # externalTrafficPolicy: "" + + # -- Custom port mapping for internal service + ports: {} + # http: 80 + # https: 443 + + # -- Custom target port mapping for internal service + targetPorts: {} + # http: http + # https: https + # shareProcessNamespace enables process namespace sharing within the pod. # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. shareProcessNamespace: false From 914c5cf295a78ff2d85e656e82c36b9681a5fae0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 1 May 2023 10:58:19 -0700 Subject: [PATCH 160/822] Bump github.com/opencontainers/runc from 1.1.6 to 1.1.7 (#9912) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.6 to 1.1.7. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.7/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.6...v1.1.7) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 54929c1a7..9de23ba1a 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 github.com/onsi/ginkgo/v2 v2.9.0 - github.com/opencontainers/runc v1.1.6 + github.com/opencontainers/runc v1.1.7 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.15.0 github.com/prometheus/client_model v0.3.0 diff --git a/go.sum b/go.sum index 4d2b69333..da99bd248 100644 --- a/go.sum +++ b/go.sum @@ -288,8 +288,8 @@ github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxm github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754= -github.com/opencontainers/runc v1.1.6 h1:XbhB8IfG/EsnhNvZtNdLB0GBw92GYEFvKlhaJk9jUgA= -github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= +github.com/opencontainers/runc v1.1.7 h1:y2EZDS8sNng4Ksf0GUYNhKbTShZJPJg1FiXJNH/uoCk= +github.com/opencontainers/runc v1.1.7/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= From 4328bed66326a8a2eec84e5676e84b001ccf4b36 Mon Sep 17 00:00:00 2001 From: Jeff Spahr Date: Mon, 1 May 2023 18:42:11 -0400 Subject: [PATCH 161/822] Update dependabot to watch docker images (#9600) * Update dependabot to watch docker images * Change to only /images on dependabot scan --------- Co-authored-by: Ricardo Katz --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 28a5e5580..5ad21ca95 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,3 +17,11 @@ updates: - "area/dependency" - "release-note-none" - "ok-to-test" + - package-ecosystem: "docker" + directory: "/images" + schedule: + interval: "weekly" + labels: + - "area/dependency" + - "release-note-none" + - "ok-to-test" From f48b03be54031491e78472bcf3aa026a81e1ffd3 Mon Sep 17 00:00:00 2001 From: James Strong Date: Wed, 3 May 2023 14:20:14 -0400 Subject: [PATCH 162/822] Update TAG - 1.7.1 (#9922) start build 1.7.1 --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index b13f0e3bc..668c7899c 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.7.0 +v1.7.1 From 6d91c2a54c6e54c987078f6e01868385e3308ee6 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Fri, 5 May 2023 14:27:13 +0200 Subject: [PATCH 163/822] chore: create httpbun image (#9926) Signed-off-by: Spazzy --- .github/workflows/ci.yaml | 8 +++--- images/README.md | 3 ++- images/{httpbin => httpbun}/Makefile | 2 +- images/{httpbin => httpbun}/cloudbuild.yaml | 2 +- images/{httpbin => httpbun}/rootfs/Dockerfile | 26 ++++++++++--------- 5 files changed, 22 insertions(+), 19 deletions(-) rename images/{httpbin => httpbun}/Makefile (97%) rename images/{httpbin => httpbun}/cloudbuild.yaml (94%) rename images/{httpbin => httpbun}/rootfs/Dockerfile (61%) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index edef01915..66d89393c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -395,8 +395,8 @@ jobs: - 'images/echo/**' go-grpc-greeter-server: - 'images/go-grpc-greeter-server/**' - httpbin: - - 'images/httpbin/**' + httpbun: + - 'images/httpbun/**' kube-webhook-certgen: - 'images/kube-webhook-certgen/**' ext-auth-example-authsvc: @@ -422,10 +422,10 @@ jobs: if: ${{ steps.filter-images.outputs.go-grpc-greeter-server == 'true' }} run: | cd images/go-grpc-greeter-server && make build - - name: httpbin image build + - name: httpbun image build if: ${{ steps.filter-images.outputs.httpbin == 'true' }} run: | - cd images/httpbin && make build + cd images/httpbun && make build - name: kube-webhook-certgen image build if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} run: | diff --git a/images/README.md b/images/README.md index 13f6bfc3c..cdcb9574b 100644 --- a/images/README.md +++ b/images/README.md @@ -17,6 +17,7 @@ custom-error-pages | Example of Custom error pages for the NGINX Ingress control e2e | Image to run e2e tests fastcgi-helloserver | FastCGI application for e2e tests grpc-fortune-teller | grpc server application for the nginx-ingress grpc example -httpbin | A simple HTTP Request & Response Service for e2e tests +httpbun | A simple HTTP Request & Response Service for e2e tests +httpbin | [Removed] we are no longer maintaining the httpbin image due to project being unmaintained nginx | NGINX base image using [alpine linux](https://www.alpinelinux.org) cfssl | Image to run cfssl commands diff --git a/images/httpbin/Makefile b/images/httpbun/Makefile similarity index 97% rename from images/httpbin/Makefile rename to images/httpbun/Makefile index a2ba07400..bcb8c7be2 100644 --- a/images/httpbin/Makefile +++ b/images/httpbun/Makefile @@ -23,7 +23,7 @@ TAG ?=v$(shell date +%Y%m%d)-$(SHORT_SHA) REGISTRY ?= local -IMAGE = $(REGISTRY)/e2e-test-httpbin +IMAGE = $(REGISTRY)/e2e-test-httpbun # required to enable buildx export DOCKER_CLI_EXPERIMENTAL=enabled diff --git a/images/httpbin/cloudbuild.yaml b/images/httpbun/cloudbuild.yaml similarity index 94% rename from images/httpbin/cloudbuild.yaml rename to images/httpbun/cloudbuild.yaml index e9df202b8..9e3af5935 100644 --- a/images/httpbin/cloudbuild.yaml +++ b/images/httpbun/cloudbuild.yaml @@ -18,7 +18,7 @@ steps: - -c - | gcloud auth configure-docker \ - && cd images/httpbin && make push + && cd images/httpbun && make push substitutions: _GIT_TAG: "12345" _PULL_BASE_REF: "master" diff --git a/images/httpbin/rootfs/Dockerfile b/images/httpbun/rootfs/Dockerfile similarity index 61% rename from images/httpbin/rootfs/Dockerfile rename to images/httpbun/rootfs/Dockerfile index a05f6872f..a1775d303 100644 --- a/images/httpbin/rootfs/Dockerfile +++ b/images/httpbun/rootfs/Dockerfile @@ -12,21 +12,23 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.2 +FROM golang:1.20 AS builder ENV LC_ALL=C.UTF-8 ENV LANG=C.UTF-8 +ENV HTTPBUN_COMMIT=a6b387c438b664322734250e426b6966966c2fe4 -RUN apk upgrade && apk update \ - && apk add --no-cache \ - python3 python3-dev \ - musl-dev gcc g++ make \ - libffi libffi-dev libstdc++ \ - py3-gevent py3-gunicorn py3-wheel \ - py3-pip \ - && pip3 install httpbin \ - && apk del python3-dev musl-dev gcc g++ make libffi-dev +RUN git clone https://github.com/sharat87/httpbun.git +WORKDIR httpbun +RUN git checkout $HTTPBUN_COMMIT +RUN CGO_ENABLED=0 GOOS=linux go build \ + -installsuffix cgo \ + -trimpath \ + -o bin/httpbun . + +FROM scratch +COPY --from=builder /go/httpbun/bin/httpbun httpbun +ENV HTTPBUN_BIND=0.0.0.0:80 EXPOSE 80 - -CMD ["gunicorn", "-b", "0.0.0.0:80", "httpbin:app", "-k", "gevent"] +ENTRYPOINT ["/httpbun"] From 3d733279944440ae781a95d216ecc13bec824d6f Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 5 May 2023 08:45:13 -0400 Subject: [PATCH 164/822] release controller 1.7.1 and chart 4.6.1 (#9929) * release controller 1.7.1 and chart 4.6.1 Signed-off-by: James Strong * fix typo Signed-off-by: James Strong * fix ah lint errors Signed-off-by: James Strong --------- Signed-off-by: James Strong --- .github/workflows/ci.yaml | 8 +-- README.md | 41 ++++++++------- changelog/Changelog-1.7.1.md | 52 +++++++++++++++++++ charts/ingress-nginx/Chart.yaml | 20 ++----- charts/ingress-nginx/README.md | 8 +-- .../changelog/Changelog-4.6.1.md | 11 ++++ charts/ingress-nginx/values.yaml | 8 ++- deploy/static/provider/aws/deploy.yaml | 44 ++++++++-------- .../aws/nlb-with-tls-termination/deploy.yaml | 44 ++++++++-------- deploy/static/provider/baremetal/deploy.yaml | 44 ++++++++-------- deploy/static/provider/cloud/deploy.yaml | 44 ++++++++-------- deploy/static/provider/do/deploy.yaml | 44 ++++++++-------- deploy/static/provider/exoscale/deploy.yaml | 44 ++++++++-------- deploy/static/provider/kind/deploy.yaml | 44 ++++++++-------- deploy/static/provider/scw/deploy.yaml | 44 ++++++++-------- docs/deploy/index.md | 20 +++---- docs/e2e-tests.md | 15 ++++-- 17 files changed, 296 insertions(+), 239 deletions(-) create mode 100644 changelog/Changelog-1.7.1.md create mode 100644 charts/ingress-nginx/changelog/Changelog-4.6.1.md diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 66d89393c..77232aa88 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -205,7 +205,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3] + k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] steps: - name: Checkout @@ -280,7 +280,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3] + k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] steps: - name: Checkout @@ -329,7 +329,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3] + k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] steps: @@ -447,7 +447,7 @@ jobs: strategy: matrix: - k8s: [v1.24.12, v1.25.8, v1.26.3] + k8s: [v1.24.12, v1.25.8, v1.26.3,v1.27.1] steps: - name: Checkout diff --git a/README.md b/README.md index f3f68366e..86f95cb9b 100644 --- a/README.md +++ b/README.md @@ -34,27 +34,28 @@ For detailed changes on the `ingress-nginx` helm chart, please check the followi ### Supported Versions table Supported versions for the ingress-nginx project mean that we have completed E2E tests, and they are passing for -the versions listed. Ingress-Nginx versions may work on older versions but the project does not make that guarantee. +the versions listed. Ingress-Nginx versions may work on older versions but the project does not make that guarantee. -| Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | -|-----------------------|------------------------------|----------------|---------------| -| v1.7.0 | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | -| v1.6.4 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | -| v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | -| v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | -| v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | -| v1.3.0 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.0 | 1.19.10† | -| v1.2.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.6 | 1.19.10† | -| v1.1.3 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.4 | 1.19.10† | -| v1.1.2 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | -| v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 | +| | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version | +|:-----:|------------------------|------------------------------|----------------|---------------|--------------------| +| 🔄 | **v1.7.1** | 1.27,1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | +| 🔄 | **v1.7.0** | 1.26, 1.25, 1.24 | 3.17.2 | 1.21.6 | 4.6.* | +| 🔄 | **v1.6.4** | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 | 4.5.* | +| 🔄| **v1.5.1** | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 | 4.4.* | +| | v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† | 4.3.0 | +| | v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† | 4.2.5 | +| | v1.3.0 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.0 | 1.19.10† | 4.2.3 | +| | v1.2.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.6 | 1.19.10† | 4.1.4 | +| | v1.1.3 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.4 | 1.19.10† | 4.0.19 | +| | v1.1.2 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.18 | +| | v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.17 | +| | v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.13 | +| | v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.9 | +| | v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.6 | +| | v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.5 | +| | v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.3 | +| | v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† | 4.0.2 | +| | v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 | 4.0.1 | † _This build is diff --git a/changelog/Changelog-1.7.1.md b/changelog/Changelog-1.7.1.md new file mode 100644 index 000000000..4921dea15 --- /dev/null +++ b/changelog/Changelog-1.7.1.md @@ -0,0 +1,52 @@ +# Changelog + +### 1.7.1 +Images: + + * registry.k8s.io/controller:controller-v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + * registry.k8s.io/controller-chroot:controller-v1.7.1@sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988 + +### All Changes: + +* Update TAG - 1.7.1 (#9922) +* Update dependabot to watch docker images (#9600) +* [helm] Support custom port configuration for internal service (#9846) +* Add support for --container flag (#9703) +* Fix typo in OpenTelemetry (#9903) +* ensure make lua-test runs locally (#9902) +* update k8s.io dependecies to v0.26.4 (#9893) +* Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803) +* I have not been able to fulfill my maintainer responsibilities for a while already, making it official now. (#9883) +* Update k8s versions (#9879) +* README: Update `external-dns` link. (#9866) +* Fastcgi configmap should be on the same namespace of ingress (#9863) +* Deprecate and remove influxdb feature (#9861) +* Remove deprecated annotation secure-upstream (#9862) +* Exclude socket metrics (#9770) +* Chart: Improve `README.md`. (#9831) +* update all container tags with date and sha, upgrade all containers (#9834) +* updated NGINX_BASE image in project (#9829) +* ISO 8601 date format (#9682) +* Values: Fix indention of commented values. (#9812) +* The Ingress-Nginx project recently released version 1.7.0 of the controller, but the deployment documentation still referenced version 1.6.4. This commit updates the documentation to reference the latest version, ensuring that users have access to the most up-to-date information. Fixes#9787 (#9788) + +### Dependencies updates: +* Bump github.com/opencontainers/runc from 1.1.6 to 1.1.7 (#9912) +* Bump github.com/prometheus/client_golang from 1.14.0 to 1.15.0 (#9868) +* Bump aquasecurity/trivy-action from 0.9.2 to 0.10.0 (#9888) +* Bump github.com/opencontainers/runc from 1.1.5 to 1.1.6 (#9867) +* Bump actions/checkout from 3.5.0 to 3.5.2 (#9870) +* Bump golang.org/x/crypto from 0.7.0 to 0.8.0 (#9838) +* Bump github.com/spf13/cobra from 1.6.1 to 1.7.0 (#9839) +* Bump actions/add-to-project from 0.4.1 to 0.5.0 (#9840) +* Bump actions/checkout from 3.4.0 to 3.5.0 (#9798) +* Bump ossf/scorecard-action from 2.1.2 to 2.1.3 (#9823) +* Bump github.com/opencontainers/runc from 1.1.4 to 1.1.5 (#9806) +* Bump actions/stale from 7.0.0 to 8.0.0 (#9799) +* Bump rajatjindal/krew-release-bot from 0.0.43 to 0.0.46 (#9797) +* Bump actions/setup-go from 3.5.0 to 4.0.0 (#9796) +* Bump github.com/imdario/mergo from 0.3.13 to 0.3.15 (#9795) +* Bump google.golang.org/grpc from 1.53.0 to 1.54.0 (#9794) +* Bump sigs.k8s.io/controller-runtime from 0.14.5 to 0.14.6 (#9822) + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.7.0...controller-controller-v1.7.1 diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml index bad5e2a8c..81ebfc875 100644 --- a/charts/ingress-nginx/Chart.yaml +++ b/charts/ingress-nginx/Chart.yaml @@ -1,21 +1,11 @@ annotations: artifacthub.io/changes: | - - "Upgrade alpine 3.17.2" - - "Upgrade golang 1.20" - - "Drop testing/support for Kubernetes 1.23" - - "docs(helm): fix value key in readme for enabling certManager (#9640)" - - "Update Ingress-Nginx version controller-v1.7.0" - - "feat: OpenTelemetry module integration (#9062)" - - "canary-weight-total annotation ignored in rule backends (#9729)" - - "fix controller psp's volume config (#9740)" - - "Fix several Helm YAML issues with extraModules and extraInitContainers (#9709)" - - "Chart: Drop `controller.headers`, rework DH param secret. (#9659)" - - "Deployment/DaemonSet: Label pods using `ingress-nginx.labels`. (#9732)" - - "HPA: autoscaling/v2beta1 deprecated, bump apiVersion to v2 for defaultBackend (#9731)" - - "Fix incorrect annotation name in upstream hashing configuration (#9617)" + - "[helm] Support custom port configuration for internal service (#9846)" + - "Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803)" + - "Update Ingress-Nginx version controller-v1.7.1" artifacthub.io/prerelease: "false" apiVersion: v2 -appVersion: 1.7.0 +appVersion: 1.7.1 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer engine: gotpl @@ -32,4 +22,4 @@ maintainers: name: ingress-nginx sources: - https://github.com/kubernetes/ingress-nginx -version: 4.6.0 +version: 4.6.1 diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 70a2ea688..108a5091e 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -2,7 +2,7 @@ [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer -![Version: 4.6.0](https://img.shields.io/badge/Version-4.6.0-informational?style=flat-square) ![AppVersion: 1.7.0](https://img.shields.io/badge/AppVersion-1.7.0-informational?style=flat-square) +![Version: 4.6.1](https://img.shields.io/badge/Version-4.6.1-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square) To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources. @@ -310,13 +310,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.hostname | object | `{}` | Optionally customize the pod hostname. | | controller.image.allowPrivilegeEscalation | bool | `true` | | | controller.image.chroot | bool | `false` | | -| controller.image.digest | string | `"sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7"` | | -| controller.image.digestChroot | string | `"sha256:e84ef3b44c8efeefd8b0aa08770a886bfea1f04c53b61b4ba9a7204e9f1a7edc"` | | +| controller.image.digest | string | `"sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407"` | | +| controller.image.digestChroot | string | `"sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988"` | | | controller.image.image | string | `"ingress-nginx/controller"` | | | controller.image.pullPolicy | string | `"IfNotPresent"` | | | controller.image.registry | string | `"registry.k8s.io"` | | | controller.image.runAsUser | int | `101` | | -| controller.image.tag | string | `"v1.7.0"` | | +| controller.image.tag | string | `"v1.7.1"` | | | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation | | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). | | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass | diff --git a/charts/ingress-nginx/changelog/Changelog-4.6.1.md b/charts/ingress-nginx/changelog/Changelog-4.6.1.md new file mode 100644 index 000000000..57d99b8db --- /dev/null +++ b/charts/ingress-nginx/changelog/Changelog-4.6.1.md @@ -0,0 +1,11 @@ +# Changelog + +This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org). + +### 4.6.1 + +* [helm] Support custom port configuration for internal service (#9846) +* Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803) +* Update Ingress-Nginx version controller-v1.7.1 + +**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.0...helm-chart-4.6.1 diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 611c384f0..551fb0449 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -23,9 +23,9 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: "v1.7.0" - digest: sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 - digestChroot: sha256:e84ef3b44c8efeefd8b0aa08770a886bfea1f04c53b61b4ba9a7204e9f1a7edc + tag: "v1.7.1" + digest: sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + digestChroot: sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988 pullPolicy: IfNotPresent # www-data -> uid 101 runAsUser: 101 @@ -395,7 +395,6 @@ controller: # - type: Pods # value: 2 # periodSeconds: 60 - # -- Enable mimalloc as a drop-in replacement for malloc. ## ref: https://github.com/microsoft/mimalloc ## @@ -492,7 +491,6 @@ controller: targetPorts: {} # http: http # https: https - # shareProcessNamespace enables process namespace sharing within the pod. # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. shareProcessNamespace: false diff --git a/deploy/static/provider/aws/deploy.yaml b/deploy/static/provider/aws/deploy.yaml index c1d595c3a..41006c016 100644 --- a/deploy/static/provider/aws/deploy.yaml +++ b/deploy/static/provider/aws/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -344,7 +344,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -377,7 +377,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -400,7 +400,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -418,7 +418,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -514,7 +514,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -525,7 +525,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -561,7 +561,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -572,7 +572,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -610,7 +610,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -623,7 +623,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml index ed6275a0b..4e4f9ca9b 100644 --- a/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml +++ b/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -335,7 +335,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -353,7 +353,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -386,7 +386,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -409,7 +409,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -427,7 +427,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -451,7 +451,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -526,7 +526,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -537,7 +537,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -573,7 +573,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -584,7 +584,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -635,7 +635,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/baremetal/deploy.yaml b/deploy/static/provider/baremetal/deploy.yaml index 595088a0c..3f015f001 100644 --- a/deploy/static/provider/baremetal/deploy.yaml +++ b/deploy/static/provider/baremetal/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -413,7 +413,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -436,7 +436,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -508,7 +508,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -519,7 +519,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -555,7 +555,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -566,7 +566,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -604,7 +604,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -617,7 +617,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/cloud/deploy.yaml b/deploy/static/provider/cloud/deploy.yaml index 0540ff1cb..a914aca5e 100644 --- a/deploy/static/provider/cloud/deploy.yaml +++ b/deploy/static/provider/cloud/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -373,7 +373,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -396,7 +396,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -414,7 +414,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -438,7 +438,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -510,7 +510,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -521,7 +521,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -557,7 +557,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -568,7 +568,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -606,7 +606,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -619,7 +619,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/do/deploy.yaml b/deploy/static/provider/do/deploy.yaml index ae6ae1f8f..676ae1229 100644 --- a/deploy/static/provider/do/deploy.yaml +++ b/deploy/static/provider/do/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/exoscale/deploy.yaml b/deploy/static/provider/exoscale/deploy.yaml index a387fa928..e9d3522f0 100644 --- a/deploy/static/provider/exoscale/deploy.yaml +++ b/deploy/static/provider/exoscale/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -349,7 +349,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -382,7 +382,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -405,7 +405,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -423,7 +423,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -447,7 +447,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -519,7 +519,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -530,7 +530,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -566,7 +566,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -577,7 +577,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -615,7 +615,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -628,7 +628,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/kind/deploy.yaml b/deploy/static/provider/kind/deploy.yaml index a77a08ae9..6a327b97f 100644 --- a/deploy/static/provider/kind/deploy.yaml +++ b/deploy/static/provider/kind/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -328,7 +328,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -340,7 +340,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -372,7 +372,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -395,7 +395,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -442,7 +442,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -524,7 +524,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -535,7 +535,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -571,7 +571,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -582,7 +582,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -620,7 +620,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -633,7 +633,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/deploy/static/provider/scw/deploy.yaml b/deploy/static/provider/scw/deploy.yaml index ab9142ce2..389e2a920 100644 --- a/deploy/static/provider/scw/deploy.yaml +++ b/deploy/static/provider/scw/deploy.yaml @@ -15,7 +15,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx --- @@ -27,7 +27,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -39,7 +39,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -129,7 +129,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -148,7 +148,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx rules: - apiGroups: @@ -230,7 +230,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission rules: - apiGroups: @@ -249,7 +249,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -269,7 +269,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -288,7 +288,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -307,7 +307,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -329,7 +329,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -343,7 +343,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -376,7 +376,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -399,7 +399,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -417,7 +417,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 spec: containers: - args: @@ -441,7 +441,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.0@sha256:7612338342a1e7b8090bef78f2a04fffcadd548ccaabe8a47bf7758ff549a5f7 + image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -513,7 +513,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -524,7 +524,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-create spec: containers: @@ -560,7 +560,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -571,7 +571,7 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission-patch spec: containers: @@ -609,7 +609,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -622,7 +622,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.0 + app.kubernetes.io/version: 1.7.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: diff --git a/docs/deploy/index.md b/docs/deploy/index.md index f6ba17a09..e9418bdfc 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n **If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml ``` !!! info @@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress control ##### Network Load Balancer (NLB) ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/deploy.yaml ``` ##### TLS termination in AWS Load Balancer (NLB) @@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB. -1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template +1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template ```console - wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml + wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml ``` 2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster: @@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this: ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml ``` !!! warning @@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to #### Azure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml ``` More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller). @@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be #### Digital Ocean ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/do/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/do/deploy.yaml ``` - By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data. @@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont #### Scaleway ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/scw/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/scw/deploy.yaml ``` #### Exoscale @@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale #### Oracle Cloud Infrastructure ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/cloud/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/cloud/deploy.yaml ``` A @@ -357,7 +357,7 @@ For quick testing, you can use a This should work on almost every cluster, but it will typically use a port in the range 30000-32767. ```console -kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.0/deploy/static/provider/baremetal/deploy.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.7.1/deploy/static/provider/baremetal/deploy.yaml ``` For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), diff --git a/docs/e2e-tests.md b/docs/e2e-tests.md index ed3e77f67..9b3c5f2ff 100644 --- a/docs/e2e-tests.md +++ b/docs/e2e-tests.md @@ -373,10 +373,6 @@ Do not try to edit it manually. - [should apply the annotation to the default backend](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/defaultbackend/with_hosts.go#L38) -### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - -- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) - ### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) - [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e_test.go#L) @@ -898,4 +894,13 @@ Do not try to edit it manually. - [should expose a TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L46) - [should expose an ExternalName TCP service](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L80) -- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) \ No newline at end of file +- [should reload after an update in the configuration](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/tcpudp/tcp.go#L169) + +### [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +- [](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/e2e.go#L) + +### [[metrics] exported prometheus metrics](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L36) + +- [exclude socket request metrics are absent](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L50) +- [exclude socket request metrics are present](https://github.com/kubernetes/ingress-nginx/tree/main/test/e2e/metrics/metrics.go#L72) \ No newline at end of file From c3a22a219ac2826901bd6426e3fdf25519e53a64 Mon Sep 17 00:00:00 2001 From: James Strong Date: Fri, 5 May 2023 09:52:39 -0400 Subject: [PATCH 165/822] fix controller tag in release Signed-off-by: James Strong --- changelog/Changelog-1.7.1.md | 4 ++-- magefiles/helm.go | 2 +- magefiles/release.go | 12 +++++++----- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/changelog/Changelog-1.7.1.md b/changelog/Changelog-1.7.1.md index 4921dea15..9b8422c7e 100644 --- a/changelog/Changelog-1.7.1.md +++ b/changelog/Changelog-1.7.1.md @@ -3,8 +3,8 @@ ### 1.7.1 Images: - * registry.k8s.io/controller:controller-v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 - * registry.k8s.io/controller-chroot:controller-v1.7.1@sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988 + * registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + * registry.k8s.io/ingress-nginx/controller-chroot:v1.7.1@sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988 ### All Changes: diff --git a/magefiles/helm.go b/magefiles/helm.go index d56cbed78..585a93413 100644 --- a/magefiles/helm.go +++ b/magefiles/helm.go @@ -104,7 +104,7 @@ func updateChartReleaseNotes(releasesNotes []string) { CheckIfError(err, "HELM Could not Load Chart to update release notes %s", HelmChartPath) var releaseNoteString string for i := range releasesNotes { - releaseNoteString = fmt.Sprintf("%s - %s\n", releaseNoteString, releasesNotes[i]) + releaseNoteString = fmt.Sprintf("%s - \"%s\"\n", releaseNoteString, releasesNotes[i]) } Info("HELM Release note string %s", releaseNoteString) chart.Annotations["artifacthub.io/changes"] = releaseNoteString diff --git a/magefiles/release.go b/magefiles/release.go index aeaafc3d2..c02b88cfd 100644 --- a/magefiles/release.go +++ b/magefiles/release.go @@ -356,15 +356,17 @@ func makeReleaseNotes(newVersion string) (*ReleaseNote, error) { c1 := ControllerImage{ Digest: controllerDigest, Registry: INGRESS_REGISTRY, - Name: "controller", - Tag: newReleaseNotes.NewControllerVersion, + Name: "ingress-nginx/controller", + Tag: fmt.Sprintf("v%s", newReleaseNotes.Version), } + c2 := ControllerImage{ Digest: controllerChrootDigest, Registry: INGRESS_REGISTRY, - Name: "controller-chroot", - Tag: newReleaseNotes.NewControllerVersion, + Name: "ingress-nginx/controller-chroot", + Tag: fmt.Sprintf("v%s", newReleaseNotes.Version), } + newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c1) newReleaseNotes.ControllerImages = append(newReleaseNotes.ControllerImages, c2) Debug("New Release Controller Images %s %s", newReleaseNotes.ControllerImages[0].Digest, newReleaseNotes.ControllerImages[1].Digest) @@ -413,7 +415,7 @@ func (r ReleaseNote) helmTemplate() { Debug("ChangeLog Templates %s", string(changelogTemplate)) t := template.Must(template.New("changelog").Parse(string(changelogTemplate))) // create a new file - file, err := os.Create(fmt.Sprintf("charts/ingress-nginx/changelog/Changelog-%s.md", r.Version)) + file, err := os.Create(fmt.Sprintf("charts/ingress-nginx/changelog/Changelog-%s.md", r.NewHelmChartVersion)) if err != nil { ErrorF("Could not create changelog file %s", err) } From 788b3606b19df563cc9d45341561f5fdd5f98c12 Mon Sep 17 00:00:00 2001 From: guessi Date: Sat, 6 May 2023 00:31:13 +0800 Subject: [PATCH 166/822] Keep project name display aligned (#9920) --- deploy/grafana/dashboards/README.md | 2 +- docs/deploy/baremetal.md | 28 +++++++++---------- docs/deploy/hardening-guide.md | 2 +- docs/deploy/index.md | 14 +++++----- docs/developer-guide/code-overview.md | 2 +- docs/developer-guide/getting-started.md | 4 +-- docs/examples/affinity/cookie/README.md | 2 +- .../customization/custom-errors/README.md | 4 +-- .../customization/custom-headers/README.md | 4 +-- .../customization/ssl-dh-param/README.md | 2 +- docs/examples/tls-termination/README.md | 2 +- docs/how-it-works.md | 2 +- docs/user-guide/cli-arguments.md | 2 +- docs/user-guide/external-articles.md | 2 +- docs/user-guide/miscellaneous.md | 4 +-- docs/user-guide/monitoring.md | 10 +++---- docs/user-guide/multiple-ingress.md | 4 +-- .../nginx-configuration/annotations.md | 2 +- .../third-party-addons/opentelemetry.md | 2 +- .../third-party-addons/opentracing.md | 2 +- images/README.md | 2 +- images/custom-error-pages/README.md | 2 +- mkdocs.yml | 2 +- 23 files changed, 51 insertions(+), 51 deletions(-) diff --git a/deploy/grafana/dashboards/README.md b/deploy/grafana/dashboards/README.md index 26195583b..e16180c3b 100644 --- a/deploy/grafana/dashboards/README.md +++ b/deploy/grafana/dashboards/README.md @@ -4,7 +4,7 @@ Ingress-nginx supports a rich collection of prometheus metrics. If you have pro This folder contains two dashboards that you can import. -## 1. NGINX Ingress Controller +## 1. Ingress-Nginx Controller ![Dashboard](screenshot.png) diff --git a/docs/deploy/baremetal.md b/docs/deploy/baremetal.md index 7d8076147..f5ff54174 100644 --- a/docs/deploy/baremetal.md +++ b/docs/deploy/baremetal.md @@ -1,14 +1,14 @@ # Bare-metal considerations In traditional *cloud* environments, where network load balancers are available on-demand, a single Kubernetes manifest -suffices to provide a single point of contact to the NGINX Ingress controller to external clients and, indirectly, to +suffices to provide a single point of contact to the Ingress-Nginx Controller to external clients and, indirectly, to any application running inside the cluster. *Bare-metal* environments lack this commodity, requiring a slightly different setup to offer the same kind of access to external consumers. ![Cloud environment](../images/baremetal/cloud_overview.jpg) ![Bare-metal environment](../images/baremetal/baremetal_overview.jpg) -The rest of this document describes a few recommended approaches to deploying the NGINX Ingress controller inside a +The rest of this document describes a few recommended approaches to deploying the Ingress-Nginx Controller inside a Kubernetes cluster running on bare-metal. ## A pure software solution: MetalLB @@ -30,7 +30,7 @@ the traffic for the `ingress-nginx` Service IP. See [Traffic policies][metallb-t yourself by reading the official documentation thoroughly. MetalLB can be deployed either with a simple Kubernetes manifest or with Helm. The rest of this example assumes MetalLB -was deployed following the [Installation][metallb-install] instructions, and that the NGINX Ingress controller was installed +was deployed following the [Installation][metallb-install] instructions, and that the Ingress-Nginx Controller was installed using the steps described in the [quickstart section of the installation guide][install-quickstart]. MetalLB requires a pool of IP addresses in order to be able to take ownership of the `ingress-nginx` Service. This pool @@ -164,7 +164,7 @@ field of the `ingress-nginx` Service spec to `Local` ([example][preserve-ip]). !!! warning This setting effectively **drops packets** sent to Kubernetes nodes which are not running any instance of the NGINX Ingress controller. Consider [assigning NGINX Pods to specific nodes][pod-assign] in order to control on what nodes - the NGINX Ingress controller should be scheduled or not scheduled. + the Ingress-Nginx Controller should be scheduled or not scheduled. !!! example In a Kubernetes cluster composed of 3 nodes (the external IP is added as an example, in most bare-metal environments @@ -193,7 +193,7 @@ field of the `ingress-nginx` Service spec to `Local` ([example][preserve-ip]). * **Ingress status** -Because NodePort Services do not get a LoadBalancerIP assigned by definition, the NGINX Ingress controller **does not +Because NodePort Services do not get a LoadBalancerIP assigned by definition, the Ingress-Nginx Controller **does not update the status of Ingress objects it manages**. ```console @@ -202,12 +202,12 @@ NAME HOSTS ADDRESS PORTS test-ingress myapp.example.com 80 ``` -Despite the fact there is no load balancer providing a public IP address to the NGINX Ingress controller, it is possible +Despite the fact there is no load balancer providing a public IP address to the Ingress-Nginx Controller, it is possible to force the status update of all managed Ingress objects by setting the `externalIPs` field of the `ingress-nginx` Service. !!! warning - There is more to setting `externalIPs` than just enabling the NGINX Ingress controller to update the status of + There is more to setting `externalIPs` than just enabling the Ingress-Nginx Controller to update the status of Ingress objects. Please read about this option in the [Services][external-ips] page of official Kubernetes documentation as well as the section about [External IPs](#external-ips) in this document for more information. @@ -268,11 +268,11 @@ for generating redirect URLs that take into account the URL used by external cli In a setup where there is no external load balancer available but using NodePorts is not an option, one can configure `ingress-nginx` Pods to use the network of the host they run on instead of a dedicated network namespace. The benefit of -this approach is that the NGINX Ingress controller can bind ports 80 and 443 directly to Kubernetes nodes' network +this approach is that the Ingress-Nginx Controller can bind ports 80 and 443 directly to Kubernetes nodes' network interfaces, without the extra network translation imposed by NodePort Services. !!! note - This approach does not leverage any Service object to expose the NGINX Ingress controller. If the `ingress-nginx` + This approach does not leverage any Service object to expose the Ingress-Nginx Controller. If the `ingress-nginx` Service exists in the target cluster, it is **recommended to delete it**. This can be achieved by enabling the `hostNetwork` option in the Pods' spec. @@ -284,7 +284,7 @@ template: ``` !!! danger "Security considerations" - Enabling this option **exposes every system daemon to the NGINX Ingress controller** on any network interface, + Enabling this option **exposes every system daemon to the Ingress-Nginx Controller** on any network interface, including the host's loopback. Please evaluate the impact this may have on the security of your system carefully. !!! example @@ -299,7 +299,7 @@ template: ingress-nginx-controller-5b4cf5fc6-lzrls 1/1 Running 203.0.113.2 host-2 ``` -One major limitation of this deployment approach is that only **a single NGINX Ingress controller Pod** may be scheduled +One major limitation of this deployment approach is that only **a single Ingress-Nginx Controller Pod** may be scheduled on each cluster node, because binding the same port multiple times on the same network interface is technically impossible. Pods that are unschedulable due to such situation fail with the following event: @@ -312,7 +312,7 @@ Events: Warning FailedScheduling default-scheduler 0/3 nodes are available: 3 node(s) didn't have free ports for the requested pod ports. ``` -One way to ensure only schedulable Pods are created is to deploy the NGINX Ingress controller as a *DaemonSet* instead +One way to ensure only schedulable Pods are created is to deploy the Ingress-Nginx Controller as a *DaemonSet* instead of a traditional Deployment. !!! info @@ -334,7 +334,7 @@ expected to resolve internal names for any reason. * **Ingress status** -Because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default +Because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default `--publish-service` flag used in standard cloud setups **does not apply** and the status of all Ingress objects remains blank. @@ -346,7 +346,7 @@ test-ingress myapp.example.com 80 Instead, and because bare-metal nodes usually don't have an ExternalIP, one has to enable the [`--report-node-internal-ip-address`][cli-args] flag, which sets the status of all Ingress objects to the internal IP -address of all nodes running the NGINX Ingress controller. +address of all nodes running the Ingress-Nginx Controller. !!! example Given a `ingress-nginx-controller` DaemonSet composed of 2 replicas diff --git a/docs/deploy/hardening-guide.md b/docs/deploy/hardening-guide.md index d428bc3aa..cfbdb1466 100644 --- a/docs/deploy/hardening-guide.md +++ b/docs/deploy/hardening-guide.md @@ -94,7 +94,7 @@ This guide refers to chapters in the CIS Benchmark. For full explanation you sho | __5 Request Filtering and Restrictions__||| | | ||| | | __5.1 Access Control__||| | -| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses (Not Scored)| OK/ACTION NEEDED | Depends on use case, geo ip module is compiled into nginx ingress controller, there are several ways to use it | If needed set IP restrictions via annotations or work with config snippets (be careful with lets-encrypt-http-challenge!) | +| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses (Not Scored)| OK/ACTION NEEDED | Depends on use case, geo ip module is compiled into Ingress-Nginx Controller, there are several ways to use it | If needed set IP restrictions via annotations or work with config snippets (be careful with lets-encrypt-http-challenge!) | | 5.1.2 Ensure only whitelisted HTTP methods are allowed (Not Scored) | OK/ACTION NEEDED | Depends on use case| If required it can be set via config snippet| | ||| | | __5.2 Request Limits__||| | diff --git a/docs/deploy/index.md b/docs/deploy/index.md index e9418bdfc..e33ee5dbe 100644 --- a/docs/deploy/index.md +++ b/docs/deploy/index.md @@ -1,6 +1,6 @@ # Installation Guide -There are multiple ways to install the NGINX ingress controller: +There are multiple ways to install the Ingress-Nginx Controller: - with [Helm](https://helm.sh), using the project repository chart; - with `kubectl apply`, using YAML manifests; @@ -192,9 +192,9 @@ doesn't work, you might have to fall back to the `kubectl port-forward` method d Rancher Desktop provides Kubernetes and Container Management on the desktop. Kubernetes is enabled by default in Rancher Desktop. -Rancher Desktop uses K3s under the hood, which in turn uses Traefik as the default ingress controller for the Kubernetes cluster. To use NGINX ingress controller in place of the default Traefik, disable Traefik from Preference > Kubernetes menu. +Rancher Desktop uses K3s under the hood, which in turn uses Traefik as the default ingress controller for the Kubernetes cluster. To use Ingress-Nginx Controller in place of the default Traefik, disable Traefik from Preference > Kubernetes menu. -Once traefik is disabled, the NGINX ingress controller can be installed on Rancher Desktop using the default [quick start](#quick-start) instructions. Follow the instructions described in the [local testing section](#local-testing) to try a sample. +Once traefik is disabled, the Ingress-Nginx Controller can be installed on Rancher Desktop using the default [quick start](#quick-start) instructions. Follow the instructions described in the [local testing section](#local-testing) to try a sample. ### Cloud deployments @@ -214,7 +214,7 @@ options of various cloud providers. #### AWS -In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress controller behind a Service of `Type=LoadBalancer`. +In AWS, we use a Network load balancer (NLB) to expose the Ingress-Nginx Controller behind a Service of `Type=LoadBalancer`. !!! info The provided templates illustrate the setup for legacy in-tree service load balancer for AWS NLB. @@ -419,14 +419,14 @@ Here is how these Ingress versions are supported in Kubernetes: - from Kubernetes 1.19 to 1.21, both `v1beta1` and `v1` Ingress resources are supported - in Kubernetes 1.22 and above, only `v1` Ingress resources are supported -And here is how these Ingress versions are supported in NGINX Ingress Controller: +And here is how these Ingress versions are supported in Ingress-Nginx Controller: - before version 1.0, only `v1beta1` Ingress resources are supported - in version 1.0 and above, only `v1` Ingress resources are As a result, if you're running Kubernetes 1.19 or later, you should be able to use the latest version of the NGINX Ingress Controller; but if you're using an old version of Kubernetes (1.18 or earlier) you will have to use version 0.X -of the NGINX Ingress Controller (e.g. version 0.49). +of the Ingress-Nginx Controller (e.g. version 0.49). -The Helm chart of the NGINX Ingress Controller switched to version 1 in version 4 of the chart. In other words, if +The Helm chart of the Ingress-Nginx Controller switched to version 1 in version 4 of the chart. In other words, if you're running Kubernetes 1.19 or earlier, you should use version 3.X of the chart (this can be done by adding `--version='<4'` to the `helm install` command ). diff --git a/docs/developer-guide/code-overview.md b/docs/developer-guide/code-overview.md index a26083c6a..8e872211d 100644 --- a/docs/developer-guide/code-overview.md +++ b/docs/developer-guide/code-overview.md @@ -53,7 +53,7 @@ This code can be found in [internal/file](https://github.com/kubernetes/ingress- #### Ingress functions -Contains all the logics from NGINX Ingress Controller, with some examples being: +Contains all the logics from Ingress-Nginx Controller, with some examples being: * Expected Golang structures that will be used in templates and other parts of the code - [internal/ingress/types.go](https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/types.go). * supported annotations and its parsing logics - [internal/ingress/annotations](https://github.com/kubernetes/ingress-nginx/tree/main/internal/ingress/annotations). diff --git a/docs/developer-guide/getting-started.md b/docs/developer-guide/getting-started.md index 9f4be8fcc..4b7ed46f0 100644 --- a/docs/developer-guide/getting-started.md +++ b/docs/developer-guide/getting-started.md @@ -1,6 +1,6 @@ - Developing for NGINX Ingress Controller + Developing for Ingress-Nginx Controller -This document explains how to get started with developing for NGINX Ingress controller. +This document explains how to get started with developing for Ingress-Nginx Controller. For the really new contributors, who want to contribute to the INGRESS-NGINX project, but need help with understanding some basic concepts, that are needed to work with the Kubernetes ingress resource, here is a link to the [New Contributors Guide](https://github.com/kubernetes/ingress-nginx/blob/main/NEW_CONTRIBUTOR.md). diff --git a/docs/examples/affinity/cookie/README.md b/docs/examples/affinity/cookie/README.md index 1920d132b..e66503dd7 100644 --- a/docs/examples/affinity/cookie/README.md +++ b/docs/examples/affinity/cookie/README.md @@ -67,7 +67,7 @@ Accept-Ranges: bytes ``` In the example above, you can see that the response contains a `Set-Cookie` header with the settings we have defined. -This cookie is created by the NGINX Ingress Controller, it contains a randomly generated key corresponding to the upstream used for that request (selected using [consistent hashing][consistent-hashing]) and has an `Expires` directive. +This cookie is created by the Ingress-Nginx Controller, it contains a randomly generated key corresponding to the upstream used for that request (selected using [consistent hashing][consistent-hashing]) and has an `Expires` directive. If a client sends a cookie that doesn't correspond to an upstream, NGINX selects an upstream and creates a corresponding cookie. If the backend pool grows NGINX will keep sending the requests through the same server of the first request, even if it's overloaded. diff --git a/docs/examples/customization/custom-errors/README.md b/docs/examples/customization/custom-errors/README.md index a137fd6dc..a7c9545b0 100644 --- a/docs/examples/customization/custom-errors/README.md +++ b/docs/examples/customization/custom-errors/README.md @@ -29,7 +29,7 @@ service/nginx-errors ClusterIP 10.0.0.12 80/TCP 10s ## Ingress controller configuration -If you do not already have an instance of the NGINX Ingress controller running, deploy it according to the +If you do not already have an instance of the Ingress-Nginx Controller running, deploy it according to the [deployment guide][deploy], then follow these steps: 1. Edit the `ingress-nginx-controller` Deployment and set the value of the `--default-backend-service` flag to the name of the @@ -37,7 +37,7 @@ If you do not already have an instance of the NGINX Ingress controller running, 2. Edit the `ingress-nginx-controller` ConfigMap and create the key `custom-http-errors` with a value of `404,503`. -3. Take note of the IP address assigned to the NGINX Ingress controller Service. +3. Take note of the IP address assigned to the Ingress-Nginx Controller Service. ``` $ kubectl get svc ingress-nginx NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE diff --git a/docs/examples/customization/custom-headers/README.md b/docs/examples/customization/custom-headers/README.md index 499bfc386..0da12582f 100644 --- a/docs/examples/customization/custom-headers/README.md +++ b/docs/examples/customization/custom-headers/README.md @@ -10,7 +10,7 @@ To work around this limitation, perform a rolling restart of the deployment. ## Example -This example demonstrates configuration of the nginx ingress controller via +This example demonstrates configuration of the Ingress-Nginx Controller via a ConfigMap to pass a custom list of headers to the upstream server. @@ -26,7 +26,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/customization/custom-headers/configmap.yaml ``` -The nginx ingress controller will read the `ingress-nginx/ingress-nginx-controller` ConfigMap, find the `proxy-set-headers` key, read HTTP headers from the `ingress-nginx/custom-headers` ConfigMap, and include those HTTP headers in all requests flowing from nginx to the backends. +The Ingress-Nginx Controller will read the `ingress-nginx/ingress-nginx-controller` ConfigMap, find the `proxy-set-headers` key, read HTTP headers from the `ingress-nginx/custom-headers` ConfigMap, and include those HTTP headers in all requests flowing from nginx to the backends. The above example was for passing a custom list of headers to the upstream server. diff --git a/docs/examples/customization/ssl-dh-param/README.md b/docs/examples/customization/ssl-dh-param/README.md index 2eae67ce2..fcd80757b 100644 --- a/docs/examples/customization/ssl-dh-param/README.md +++ b/docs/examples/customization/ssl-dh-param/README.md @@ -1,6 +1,6 @@ # Custom DH parameters for perfect forward secrecy -This example aims to demonstrate the deployment of an nginx ingress controller and +This example aims to demonstrate the deployment of an Ingress-Nginx Controller and use a ConfigMap to configure a custom Diffie-Hellman parameters file to help with "Perfect Forward Secrecy". diff --git a/docs/examples/tls-termination/README.md b/docs/examples/tls-termination/README.md index bd68ddc67..25139b381 100644 --- a/docs/examples/tls-termination/README.md +++ b/docs/examples/tls-termination/README.md @@ -1,6 +1,6 @@ # TLS termination -This example demonstrates how to terminate TLS through the nginx Ingress controller. +This example demonstrates how to terminate TLS through the Ingress-Nginx Controller. ## Prerequisites diff --git a/docs/how-it-works.md b/docs/how-it-works.md index 894a504dc..161803210 100644 --- a/docs/how-it-works.md +++ b/docs/how-it-works.md @@ -60,7 +60,7 @@ In a relatively big cluster with frequently deploying apps this feature saves si Because the ingress controller works using the [synchronization loop pattern](https://coreos.com/kubernetes/docs/latest/replication-controller.html#the-reconciliation-loop-in-detail), it is applying the configuration for all matching objects. In case some Ingress objects have a broken configuration, for example a syntax error in the `nginx.ingress.kubernetes.io/configuration-snippet` annotation, the generated configuration becomes invalid, does not reload and hence no more ingresses will be taken into account. -To prevent this situation to happen, the nginx ingress controller optionally exposes a [validating admission webhook server][8] to ensure the validity of incoming ingress objects. +To prevent this situation to happen, the Ingress-Nginx Controller optionally exposes a [validating admission webhook server][8] to ensure the validity of incoming ingress objects. This webhook appends the incoming ingress objects to the list of ingresses, generates the configuration and calls nginx to ensure the configuration has no syntax errors. [0]: https://github.com/openresty/lua-nginx-module/pull/1259 diff --git a/docs/user-guide/cli-arguments.md b/docs/user-guide/cli-arguments.md index 59e52957d..bc0894a52 100644 --- a/docs/user-guide/cli-arguments.md +++ b/docs/user-guide/cli-arguments.md @@ -68,7 +68,7 @@ They are set in the container spec of the `ingress-nginx-controller` Deployment | `--validating-webhook` | The address to start an admission controller on to validate incoming ingresses. Takes the form ":port". If not provided, no admission controller is started. | | `--validating-webhook-certificate` | The path of the validating webhook certificate PEM. | | `--validating-webhook-key` | The path of the validating webhook key PEM. | -| `--version` | Show release information about the NGINX Ingress controller and exit. | +| `--version` | Show release information about the Ingress-Nginx Controller and exit. | | `--watch-ingress-without-class` | Define if Ingress Controller should also watch for Ingresses without an IngressClass or the annotation specified. (default false) | | `--watch-namespace` | Namespace the controller watches for updates to Kubernetes objects. This includes Ingresses, Services and all configuration resources. All namespaces are watched if this parameter is left empty. | | `--watch-namespace-selector` | The controller will watch namespaces whose labels match the given selector. This flag only takes effective when `--watch-namespace` is empty. | diff --git a/docs/user-guide/external-articles.md b/docs/user-guide/external-articles.md index d9fd828b8..27a3f4447 100644 --- a/docs/user-guide/external-articles.md +++ b/docs/user-guide/external-articles.md @@ -2,5 +2,5 @@ - [Pain(less) NGINX Ingress](http://danielfm.me/posts/painless-nginx-ingress.html) - [Accessing Kubernetes Pods from Outside of the Cluster](http://alesnosek.com/blog/2017/02/14/accessing-kubernetes-pods-from-outside-of-the-cluster) -- [Kubernetes - Redirect HTTP to HTTPS with ELB and the nginx ingress controller](https://dev.to/tomhoule/kubernetes---redirect-http-to-https-with-elb-and-the-nginx-ingress-controller) +- [Kubernetes - Redirect HTTP to HTTPS with ELB and the Ingress-Nginx Controller](https://dev.to/tomhoule/kubernetes---redirect-http-to-https-with-elb-and-the-nginx-ingress-controller) - [Configure Nginx Ingress Controller for TLS termination on Kubernetes on Azure](https://blogs.technet.microsoft.com/livedevopsinjapan/2017/02/28/configure-nginx-ingress-controller-for-tls-termination-on-kubernetes-on-azure-2/) diff --git a/docs/user-guide/miscellaneous.md b/docs/user-guide/miscellaneous.md index d9b32d36f..e7d1ac59c 100644 --- a/docs/user-guide/miscellaneous.md +++ b/docs/user-guide/miscellaneous.md @@ -32,7 +32,7 @@ The default value of these settings is `60 seconds`. A more adequate value to support websockets is a value higher than one hour (`3600`). !!! Important - If the NGINX ingress controller is exposed with a service `type=LoadBalancer` make sure the protocol between the loadbalancer and NGINX is TCP. + If the Ingress-Nginx Controller is exposed with a service `type=LoadBalancer` make sure the protocol between the loadbalancer and NGINX is TCP. ## Optimizing TLS Time To First Byte (TTTFB) @@ -52,4 +52,4 @@ The previous behavior can be restored using `retry-non-idempotent=true` in the c ## Why endpoints and not services -The NGINX ingress controller does not use [Services](http://kubernetes.io/docs/user-guide/services) to route traffic to the pods. Instead it uses the Endpoints API in order to bypass [kube-proxy](http://kubernetes.io/docs/admin/kube-proxy/) to allow NGINX features like session affinity and custom load balancing algorithms. It also removes some overhead, such as conntrack entries for iptables DNAT. +The Ingress-Nginx Controller does not use [Services](http://kubernetes.io/docs/user-guide/services) to route traffic to the pods. Instead it uses the Endpoints API in order to bypass [kube-proxy](http://kubernetes.io/docs/admin/kube-proxy/) to allow NGINX features like session affinity and custom load balancing algorithms. It also removes some overhead, such as conntrack entries for iptables DNAT. diff --git a/docs/user-guide/monitoring.md b/docs/user-guide/monitoring.md index 281207866..1e30e556f 100644 --- a/docs/user-guide/monitoring.md +++ b/docs/user-guide/monitoring.md @@ -6,14 +6,14 @@ Two different methods to install and configure Prometheus and Grafana are descri ## Prometheus and Grafana installation using Pod Annotations -This tutorial will show you how to install [Prometheus](https://prometheus.io/) and [Grafana](https://grafana.com/) for scraping the metrics of the NGINX Ingress controller. +This tutorial will show you how to install [Prometheus](https://prometheus.io/) and [Grafana](https://grafana.com/) for scraping the metrics of the Ingress-Nginx Controller. !!! important This example uses `emptyDir` volumes for Prometheus and Grafana. This means once the pod gets terminated you will lose all the data. ### Before You Begin -- The NGINX Ingress controller should already be deployed according to the deployment instructions [here](../deploy/index.md). +- The Ingress-Nginx Controller should already be deployed according to the deployment instructions [here](../deploy/index.md). - The controller should be configured for exporting metrics. This requires 3 configurations to the controller. These configurations are : 1. controller.metrics.enabled=true @@ -184,9 +184,9 @@ According to the above example, this URL will be http://10.192.0.3:31086 ## Prometheus and Grafana installation using Service Monitors This document assumes you're using helm and using the kube-prometheus-stack package to install Prometheus and Grafana. -### Verify NGINX Ingress controller is installed +### Verify Ingress-Nginx Controller is installed -- The NGINX Ingress controller should already be deployed according to the deployment instructions [here](../deploy/index.md). +- The Ingress-Nginx Controller should already be deployed according to the deployment instructions [here](../deploy/index.md). - To check if Ingress controller is deployed, ``` @@ -214,7 +214,7 @@ This document assumes you're using helm and using the kube-prometheus-stack pack - If prometheus is not installed, then you can install from [here](https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack) -### Re-configure NGINX Ingress controller +### Re-configure Ingress-Nginx Controller - The Ingress NGINX controller needs to be reconfigured for exporting metrics. This requires 3 additional configurations to the controller. These configurations are : ``` diff --git a/docs/user-guide/multiple-ingress.md b/docs/user-guide/multiple-ingress.md index 6a9457a9c..fca93ee65 100644 --- a/docs/user-guide/multiple-ingress.md +++ b/docs/user-guide/multiple-ingress.md @@ -111,7 +111,7 @@ spec: then setting the corresponding `kubernetes.io/ingress.class: "internal-nginx"` annotation on your Ingresses. -To reiterate, setting the annotation to any value which does not match a valid ingress class will force the NGINX Ingress controller to ignore your Ingress. -If you are only running a single NGINX ingress controller, this can be achieved by setting the annotation to any value except "nginx" or an empty string. +To reiterate, setting the annotation to any value which does not match a valid ingress class will force the Ingress-Nginx Controller to ignore your Ingress. +If you are only running a single Ingress-Nginx Controller, this can be achieved by setting the annotation to any value except "nginx" or an empty string. Do this if you wish to use one of the other Ingress controllers at the same time as the NGINX controller. diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index 3b463eea7..328f13a17 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -598,7 +598,7 @@ the User guide. ### Service Upstream -By default the NGINX ingress controller uses a list of all endpoints (Pod IP/port) in the NGINX upstream configuration. +By default the Ingress-Nginx Controller uses a list of all endpoints (Pod IP/port) in the NGINX upstream configuration. The `nginx.ingress.kubernetes.io/service-upstream` annotation disables that behavior and instead uses a single upstream in NGINX, the service's Cluster IP and port. diff --git a/docs/user-guide/third-party-addons/opentelemetry.md b/docs/user-guide/third-party-addons/opentelemetry.md index 7aeea541c..1b9b6536e 100644 --- a/docs/user-guide/third-party-addons/opentelemetry.md +++ b/docs/user-guide/third-party-addons/opentelemetry.md @@ -2,7 +2,7 @@ Enables requests served by NGINX for distributed telemetry via The OpenTelemetry Project. -Using the third party module [opentelemetry-cpp-contrib/nginx](https://github.com/open-telemetry/opentelemetry-cpp-contrib/tree/main/instrumentation/nginx) the NGINX ingress controller can configure NGINX to enable [OpenTelemetry](http://opentelemetry.io) instrumentation. +Using the third party module [opentelemetry-cpp-contrib/nginx](https://github.com/open-telemetry/opentelemetry-cpp-contrib/tree/main/instrumentation/nginx) the Ingress-Nginx Controller can configure NGINX to enable [OpenTelemetry](http://opentelemetry.io) instrumentation. By default this feature is disabled. ## Usage diff --git a/docs/user-guide/third-party-addons/opentracing.md b/docs/user-guide/third-party-addons/opentracing.md index 6ed0f195e..f5ec59faf 100644 --- a/docs/user-guide/third-party-addons/opentracing.md +++ b/docs/user-guide/third-party-addons/opentracing.md @@ -2,7 +2,7 @@ Enables requests served by NGINX for distributed tracing via The OpenTracing Project. -Using the third party module [opentracing-contrib/nginx-opentracing](https://github.com/opentracing-contrib/nginx-opentracing) the NGINX ingress controller can configure NGINX to enable [OpenTracing](http://opentracing.io) instrumentation. +Using the third party module [opentracing-contrib/nginx-opentracing](https://github.com/opentracing-contrib/nginx-opentracing) the Ingress-Nginx Controller can configure NGINX to enable [OpenTracing](http://opentracing.io) instrumentation. By default this feature is disabled. ## Usage diff --git a/images/README.md b/images/README.md index cdcb9574b..e7e5f71a6 100644 --- a/images/README.md +++ b/images/README.md @@ -13,7 +13,7 @@ Directory | Purpose ------------ | ------------- -custom-error-pages | Example of Custom error pages for the NGINX Ingress controller +custom-error-pages | Example of Custom error pages for the Ingress-Nginx Controller e2e | Image to run e2e tests fastcgi-helloserver | FastCGI application for e2e tests grpc-fortune-teller | grpc server application for the nginx-ingress grpc example diff --git a/images/custom-error-pages/README.md b/images/custom-error-pages/README.md index 88983591f..cd6df3e0a 100644 --- a/images/custom-error-pages/README.md +++ b/images/custom-error-pages/README.md @@ -1,3 +1,3 @@ # custom-error-pages -Example of Custom error pages for the NGINX Ingress controller +Example of Custom error pages for the Ingress-Nginx Controller diff --git a/mkdocs.yml b/mkdocs.yml index 62c0ccf48..39eab9ef0 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -1,4 +1,4 @@ -site_name: NGINX Ingress Controller +site_name: Ingress-Nginx Controller repo_name: "kubernetes/ingress-nginx" repo_url: https://github.com/kubernetes/ingress-nginx site_url: https://kubernetes.github.io/ingress-nginx From 8ab8803dcc71a6a0cab99bfe13969dce1808aa44 Mon Sep 17 00:00:00 2001 From: guessi Date: Sat, 6 May 2023 09:23:16 +0800 Subject: [PATCH 167/822] Update charts/* to keep project name display aligned (#9931) --- charts/ingress-nginx/README.md | 14 +++++++------- charts/ingress-nginx/README.md.gotmpl | 8 ++++---- charts/ingress-nginx/values.yaml | 6 +++--- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 108a5091e..2c2dd2f37 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -79,14 +79,14 @@ else it would make it impossible to evacuate a node. See [gh issue #7127](https: ### Prometheus Metrics -The Nginx ingress controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. +The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) ### ingress-nginx nginx\_status page/stats server -Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in nginx ingress controller: +Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: - In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed - In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. @@ -193,7 +193,7 @@ Optionally you can set `controller.service.loadBalancerIP` if you need a static ### Ingress Admission Webhooks -With nginx-ingress-controller version 0.25+, the nginx ingress controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. +With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. **This feature is enabled by default since 0.31.0.** With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) @@ -202,7 +202,7 @@ With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fi A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. 1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. -2. The ingress nginx controller pod is configured to use a TLS proxy container, which will load that certificate. +2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. 3. Validating and Mutating webhook configurations are created in the cluster. 4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations @@ -294,14 +294,14 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # | | controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" Defaults to false | | controller.existingPsp | string | `""` | Use an existing PSP instead of creating one | -| controller.extraArgs | object | `{}` | Additional command line arguments to pass to nginx-ingress-controller E.g. to specify the default SSL certificate you can use | +| controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use | | controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. | | controller.extraEnvs | list | `[]` | Additional environment variables to set | | controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. | | controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module | | controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. | | controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. | -| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the ingress nginx controller is running in the `hostNetwork: true` mode. | +| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. | | controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. | | controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged | | controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not | @@ -390,7 +390,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.readinessProbe.successThreshold | int | `1` | | | controller.readinessProbe.timeoutSeconds | int | `1` | | | controller.replicaCount | int | `1` | | -| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply | +| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply | | controller.resources.requests.cpu | string | `"100m"` | | | controller.resources.requests.memory | string | `"90Mi"` | | | controller.scope.enabled | bool | `false` | Enable 'scope' or not | diff --git a/charts/ingress-nginx/README.md.gotmpl b/charts/ingress-nginx/README.md.gotmpl index b3d35b6e7..4a35a40b3 100644 --- a/charts/ingress-nginx/README.md.gotmpl +++ b/charts/ingress-nginx/README.md.gotmpl @@ -76,14 +76,14 @@ else it would make it impossible to evacuate a node. See [gh issue #7127](https: ### Prometheus Metrics -The Nginx ingress controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. +The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`. You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`. Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`) ### ingress-nginx nginx\_status page/stats server -Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in nginx ingress controller: +Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller: - In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed - In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost. @@ -190,7 +190,7 @@ Optionally you can set `controller.service.loadBalancerIP` if you need a static ### Ingress Admission Webhooks -With nginx-ingress-controller version 0.25+, the nginx ingress controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. +With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster. **This feature is enabled by default since 0.31.0.** With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521) @@ -199,7 +199,7 @@ With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fi A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks. 1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits. -2. The ingress nginx controller pod is configured to use a TLS proxy container, which will load that certificate. +2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate. 3. Validating and Mutating webhook configurations are created in the cluster. 4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 551fb0449..3a9629d63 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -55,7 +55,7 @@ controller: # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. dnsPolicy: ClusterFirst # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network - # Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply reportNodeInternalIp: false # -- Process Ingress objects without ingressClass annotation/ingressClassName field # Overrides value for --watch-ingress-without-class flag of the controller binary @@ -150,7 +150,7 @@ controller: # -- Maxmind license key to download GeoLite2 Databases. ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases maxmindLicenseKey: "" - # -- Additional command line arguments to pass to nginx-ingress-controller + # -- Additional command line arguments to pass to Ingress-Nginx Controller # E.g. to specify the default SSL certificate you can use extraArgs: {} ## extraArgs: @@ -302,7 +302,7 @@ controller: healthCheckPath: "/healthz" # -- Address to bind the health check endpoint. # It is better to set this option to the internal node address - # if the ingress nginx controller is running in the `hostNetwork: true` mode. + # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. healthCheckHost: "" # -- Annotations to be added to controller pods ## From 57d94569a4dfecc8deb76bdc21ad288c1ed424a5 Mon Sep 17 00:00:00 2001 From: Ian De Bie Date: Sun, 7 May 2023 02:17:16 -0500 Subject: [PATCH 168/822] Update annotations.md (#9933) add the missing quotes --- docs/user-guide/nginx-configuration/annotations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/nginx-configuration/annotations.md b/docs/user-guide/nginx-configuration/annotations.md index 328f13a17..b515a9f3b 100755 --- a/docs/user-guide/nginx-configuration/annotations.md +++ b/docs/user-guide/nginx-configuration/annotations.md @@ -22,7 +22,7 @@ You can add these Kubernetes annotations to specific Ingress objects to customiz |[nginx.ingress.kubernetes.io/auth-realm](#authentication)|string| |[nginx.ingress.kubernetes.io/auth-secret](#authentication)|string| |[nginx.ingress.kubernetes.io/auth-secret-type](#authentication)|string| -|[nginx.ingress.kubernetes.io/auth-type](#authentication)|basic or digest| +|[nginx.ingress.kubernetes.io/auth-type](#authentication)|"basic" or "digest"| |[nginx.ingress.kubernetes.io/auth-tls-secret](#client-certificate-authentication)|string| |[nginx.ingress.kubernetes.io/auth-tls-verify-depth](#client-certificate-authentication)|number| |[nginx.ingress.kubernetes.io/auth-tls-verify-client](#client-certificate-authentication)|string| From 2794129e9296cf59de89cf7efbd1eebc7cf44349 Mon Sep 17 00:00:00 2001 From: Alexander Stanko Date: Tue, 9 May 2023 05:42:52 +0700 Subject: [PATCH 169/822] Add geoname id value into $geoip2_*_geoname_id variables (#9527) --- rootfs/etc/nginx/template/nginx.tmpl | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/rootfs/etc/nginx/template/nginx.tmpl b/rootfs/etc/nginx/template/nginx.tmpl index a49989f30..9b3a47de3 100644 --- a/rootfs/etc/nginx/template/nginx.tmpl +++ b/rootfs/etc/nginx/template/nginx.tmpl @@ -188,8 +188,10 @@ http { geoip2 /etc/nginx/geoip/GeoLite2-Country.mmdb { $geoip2_country_code source=$remote_addr country iso_code; $geoip2_country_name source=$remote_addr country names en; + $geoip2_country_geoname_id source=$remote_addr country geoname_id; $geoip2_continent_code source=$remote_addr continent code; $geoip2_continent_name source=$remote_addr continent names en; + $geoip2_continent_geoname_id source=$remote_addr continent geoname_id; } {{ end }} @@ -197,8 +199,10 @@ http { geoip2 /etc/nginx/geoip/GeoIP2-Country.mmdb { $geoip2_country_code source=$remote_addr country iso_code; $geoip2_country_name source=$remote_addr country names en; + $geoip2_country_geoname_id source=$remote_addr country geoname_id; $geoip2_continent_code source=$remote_addr continent code; $geoip2_continent_name source=$remote_addr continent names en; + $geoip2_continent_geoname_id source=$remote_addr continent geoname_id; } {{ end }} @@ -206,7 +210,9 @@ http { geoip2 /etc/nginx/geoip/GeoLite2-City.mmdb { $geoip2_city_country_code source=$remote_addr country iso_code; $geoip2_city_country_name source=$remote_addr country names en; + $geoip2_city_country_geoname_id source=$remote_addr country geoname_id; $geoip2_city source=$remote_addr city names en; + $geoip2_city_geoname_id source=$remote_addr city geoname_id; $geoip2_postal_code source=$remote_addr postal code; $geoip2_dma_code source=$remote_addr location metro_code; $geoip2_latitude source=$remote_addr location latitude; @@ -214,8 +220,10 @@ http { $geoip2_time_zone source=$remote_addr location time_zone; $geoip2_region_code source=$remote_addr subdivisions 0 iso_code; $geoip2_region_name source=$remote_addr subdivisions 0 names en; + $geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id; $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code; $geoip2_subregion_name source=$remote_addr subdivisions 1 names en; + $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id; } {{ end }} @@ -223,7 +231,9 @@ http { geoip2 /etc/nginx/geoip/GeoIP2-City.mmdb { $geoip2_city_country_code source=$remote_addr country iso_code; $geoip2_city_country_name source=$remote_addr country names en; + $geoip2_city_country_geoname_id source=$remote_addr country geoname_id; $geoip2_city source=$remote_addr city names en; + $geoip2_city_geoname_id source=$remote_addr city geoname_id; $geoip2_postal_code source=$remote_addr postal code; $geoip2_dma_code source=$remote_addr location metro_code; $geoip2_latitude source=$remote_addr location latitude; @@ -231,8 +241,10 @@ http { $geoip2_time_zone source=$remote_addr location time_zone; $geoip2_region_code source=$remote_addr subdivisions 0 iso_code; $geoip2_region_name source=$remote_addr subdivisions 0 names en; + $geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id; $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code; $geoip2_subregion_name source=$remote_addr subdivisions 1 names en; + $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id; } {{ end }} From eec43519fa7b6c933d4f0b6501851bd3ea9e460e Mon Sep 17 00:00:00 2001 From: Kundan Kumar Date: Wed, 10 May 2023 10:32:59 +0530 Subject: [PATCH 170/822] image_update (#9942) --- .../customization/custom-errors/custom-default-backend.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/examples/customization/custom-errors/custom-default-backend.yaml b/docs/examples/customization/custom-errors/custom-default-backend.yaml index 5fc5c55e4..2af64896f 100644 --- a/docs/examples/customization/custom-errors/custom-default-backend.yaml +++ b/docs/examples/customization/custom-errors/custom-default-backend.yaml @@ -36,7 +36,7 @@ spec: spec: containers: - name: nginx-error-server - image: registry.k8s.io/ingress-nginx/nginx-errors:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:332be6ff8c4e93e8845963932f98839dfd52ae49829c29e06475368a3e4fbd9e + image: registry.k8s.io/ingress-nginx/nginx-errors:v20230404-helm-chart-4.6.0-11-gc76179c04@sha256:aabd7a001f6a0a07ed6ea8f6da87e928bfa8f971eba2bef708f3e8504fc5cc9b ports: - containerPort: 8080 # Setting the environment variable DEBUG we can see the headers sent From 0bdb64373c48660192dc87fe17989ab574422932 Mon Sep 17 00:00:00 2001 From: Brendan Kamp Date: Wed, 10 May 2023 16:43:02 +0200 Subject: [PATCH 171/822] chore: update httpbin to httpbun (#9919) Signed-off-by: Spazzy --- test/data/config.json | 6 +- test/e2e/annotations/auth.go | 45 +++---- test/e2e/annotations/grpc.go | 10 +- test/e2e/annotations/satisfy.go | 10 +- test/e2e/framework/deployment.go | 103 ++++++++++++++-- test/e2e/security/request_smuggling.go | 7 +- .../servicebackend/service_externalname.go | 115 +++++++++--------- test/e2e/settings/brotli.go | 4 +- .../settings/disable_service_external_name.go | 8 +- test/e2e/settings/global_external_auth.go | 12 +- test/e2e/settings/listen_nondefault_ports.go | 10 +- test/k6/smoketest.js | 2 +- 12 files changed, 215 insertions(+), 117 deletions(-) diff --git a/test/data/config.json b/test/data/config.json index 5d8a88cbe..d51e1c40b 100644 --- a/test/data/config.json +++ b/test/data/config.json @@ -413,7 +413,7 @@ "secured": false }, "externalAuth": { - "url": "https://httpbin.org/basic-auth/user/passwd", + "url": "https://httpbun.com/basic-auth/user/passwd", "method": "", "sendBody": false }, @@ -59354,7 +59354,7 @@ "secured": false }, "externalAuth": { - "url": "https://httpbin.org/basic-auth/user/passwd", + "url": "https://httpbun.com/basic-auth/user/passwd", "method": "", "sendBody": false }, @@ -60272,4 +60272,4 @@ "failTimeout": 0 }] }] -} \ No newline at end of file +} diff --git a/test/e2e/annotations/auth.go b/test/e2e/annotations/auth.go index e3d0bcb2e..4ca034825 100644 --- a/test/e2e/annotations/auth.go +++ b/test/e2e/annotations/auth.go @@ -19,13 +19,14 @@ package annotations import ( "context" "fmt" - "golang.org/x/crypto/bcrypt" "net/http" "net/url" "regexp" "strings" "time" + "golang.org/x/crypto/bcrypt" + "github.com/onsi/ginkgo/v2" "github.com/stretchr/testify/assert" @@ -389,10 +390,10 @@ http { assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } @@ -456,21 +457,21 @@ http { var ing *networking.Ingress ginkgo.BeforeEach(func() { - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } @@ -649,20 +650,20 @@ http { var ing *networking.Ingress ginkgo.BeforeEach(func() { - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() - var httpbinIP string + var httpbunIP string - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) - httpbinIP = e.Subsets[0].Addresses[0].IP + httpbunIP = e.Subsets[0].Addresses[0].IP annotations = map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", "nginx.ingress.kubernetes.io/auth-signin-redirect-param": "orig", } @@ -728,23 +729,23 @@ http { barPath := "/bar" ginkgo.BeforeEach(func() { - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep(1 * time.Second) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", "nginx.ingress.kubernetes.io/auth-cache-key": "fixed", "nginx.ingress.kubernetes.io/auth-cache-duration": "200 201 401 30m", @@ -777,7 +778,7 @@ http { Expect(). Status(http.StatusOK) - err := f.DeleteDeployment(framework.HTTPBinService) + err := f.DeleteDeployment(framework.HTTPBunService) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() @@ -797,7 +798,7 @@ http { Expect(). Status(http.StatusOK) - err := f.DeleteDeployment(framework.HTTPBinService) + err := f.DeleteDeployment(framework.HTTPBunService) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() @@ -826,7 +827,7 @@ http { Expect(). Status(http.StatusOK) - err := f.DeleteDeployment(framework.HTTPBinService) + err := f.DeleteDeployment(framework.HTTPBunService) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() diff --git a/test/e2e/annotations/grpc.go b/test/e2e/annotations/grpc.go index 39349e701..046191b21 100644 --- a/test/e2e/annotations/grpc.go +++ b/test/e2e/annotations/grpc.go @@ -125,7 +125,7 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { ginkgo.It("authorization metadata should be overwritten by external auth response headers", func() { f.NewGRPCBinDeployment() - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() host := "echo" @@ -149,19 +149,19 @@ var _ = framework.DescribeAnnotation("backend-protocol - GRPC", func() { } f.EnsureService(svc) - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/response-headers?authorization=foo", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/response-headers?authorization=foo", httpbunIP), "nginx.ingress.kubernetes.io/auth-response-headers": "Authorization", "nginx.ingress.kubernetes.io/backend-protocol": "GRPC", } diff --git a/test/e2e/annotations/satisfy.go b/test/e2e/annotations/satisfy.go index e75464a9d..758ad21a4 100644 --- a/test/e2e/annotations/satisfy.go +++ b/test/e2e/annotations/satisfy.go @@ -85,15 +85,15 @@ var _ = framework.DescribeAnnotation("satisfy", func() { host := "auth" // setup external auth - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP // create basic auth secret at ingress s := f.EnsureSecret(buildSecret("uname", "pwd", "basic-secret", f.Namespace)) @@ -105,7 +105,7 @@ var _ = framework.DescribeAnnotation("satisfy", func() { "nginx.ingress.kubernetes.io/auth-realm": "test basic auth", // annotations for external auth - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", // set satisfy any diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 4627a8892..06dfa0c5e 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -19,6 +19,7 @@ package framework import ( "context" "errors" + "fmt" "os" "time" @@ -36,14 +37,18 @@ const EchoService = "echo" // SlowEchoService name of the deployment for the echo app const SlowEchoService = "slow-echo" -// HTTPBinService name of the deployment for the httpbin app -const HTTPBinService = "httpbin" +// HTTPBunService name of the deployment for the httpbun app +const HTTPBunService = "httpbun" + +// NipService name of external service using nip.io +const NIPService = "external-nip" type deploymentOptions struct { namespace string name string replicas int svcAnnotations map[string]string + image string } // WithDeploymentNamespace allows configuring the deployment's namespace @@ -82,18 +87,26 @@ func WithName(n string) func(*deploymentOptions) { } } +// WithImage allows configuring the image for the deployments +func WithImage(i string) func(*deploymentOptions) { + return func(o *deploymentOptions) { + o.image = i + } +} + // NewEchoDeployment creates a new single replica deployment of the echo server image in a particular namespace func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { options := &deploymentOptions{ namespace: f.Namespace, name: EchoService, replicas: 1, + image: "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a", } for _, o := range opts { o(options) } - deployment := newDeployment(options.name, options.namespace, "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a", 80, int32(options.replicas), + deployment := newDeployment(options.name, options.namespace, options.image, 80, int32(options.replicas), nil, nil, nil, []corev1.VolumeMount{}, []corev1.Volume{}, @@ -129,6 +142,85 @@ func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { assert.Nil(ginkgo.GinkgoT(), err, "waiting for endpoints to become ready") } +// BuildNipHost used to generate a nip host for DNS resolving +func BuildNIPHost(ip string) string { + return fmt.Sprintf("%s.nip.io", ip) +} + +// BuildNIPExternalNameService used to generate a service pointing to nip.io to +// help resolve to an IP address +func BuildNIPExternalNameService(f *Framework, ip, portName string) *corev1.Service { + return &corev1.Service{ + ObjectMeta: metav1.ObjectMeta{ + Name: NIPService, + Namespace: f.Namespace, + }, + Spec: corev1.ServiceSpec{ + ExternalName: BuildNIPHost(ip), + Type: corev1.ServiceTypeExternalName, + Ports: []corev1.ServicePort{ + { + Name: portName, + Port: 80, + TargetPort: intstr.FromInt(80), + Protocol: "TCP", + }, + }, + }, + } +} + +// NewHttpbunDeployment creates a new single replica deployment of the httpbun +// server image in a particular namespace we return the ip for testing purposes +func (f *Framework) NewHttpbunDeployment(opts ...func(*deploymentOptions)) string { + options := &deploymentOptions{ + namespace: f.Namespace, + name: HTTPBunService, + replicas: 1, + image: "registry.k8s.io/ingress-nginx/e2e-test-httpbun:v20230505-v0.0.1", + } + for _, o := range opts { + o(options) + } + + deployment := newDeployment(options.name, options.namespace, options.image, 80, int32(options.replicas), + nil, nil, nil, + []corev1.VolumeMount{}, + []corev1.Volume{}, + true, + ) + + f.EnsureDeployment(deployment) + + service := &corev1.Service{ + ObjectMeta: metav1.ObjectMeta{ + Name: options.name, + Namespace: options.namespace, + Annotations: options.svcAnnotations, + }, + Spec: corev1.ServiceSpec{ + Ports: []corev1.ServicePort{ + { + Name: "http", + Port: 80, + TargetPort: intstr.FromInt(80), + Protocol: corev1.ProtocolTCP, + }, + }, + Selector: map[string]string{ + "app": options.name, + }, + }, + } + + s := f.EnsureService(service) + + err := WaitForEndpoints(f.KubeClientSet, DefaultTimeout, options.name, options.namespace, options.replicas) + assert.Nil(ginkgo.GinkgoT(), err, "waiting for endpoints to become ready") + + return s.Spec.ClusterIPs[0] +} + // NewSlowEchoDeployment creates a new deployment of the slow echo server image in a particular namespace. func (f *Framework) NewSlowEchoDeployment() { cfg := `# @@ -418,11 +510,6 @@ func newDeployment(name, namespace, image string, port int32, replicas int32, co return d } -// NewHttpbinDeployment creates a new single replica deployment of the httpbin image in a particular namespace. -func (f *Framework) NewHttpbinDeployment() { - f.NewDeployment(HTTPBinService, "registry.k8s.io/ingress-nginx/e2e-test-httpbin@sha256:c6372ef57a775b95f18e19d4c735a9819f2e7bb4641e5e3f27287d831dfeb7e8", 80, 1) -} - func (f *Framework) NewDeployment(name, image string, port int32, replicas int32) { f.NewDeploymentWithOpts(name, image, port, replicas, nil, nil, nil, nil, nil, true) } diff --git a/test/e2e/security/request_smuggling.go b/test/e2e/security/request_smuggling.go index 9891480dc..786a7a397 100644 --- a/test/e2e/security/request_smuggling.go +++ b/test/e2e/security/request_smuggling.go @@ -50,9 +50,12 @@ server { f.UpdateNginxConfigMapData("http-snippet", snippet) + //TODO: currently using a self hosted HTTPBun instance results in a 499, we + //should move away from using httpbun.com once we have the httpbun + //deployment as part of the framework ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, map[string]string{ - "nginx.ingress.kubernetes.io/auth-signin": "https://httpbin.org/uuid", - "nginx.ingress.kubernetes.io/auth-url": "https://httpbin.org/basic-auth/user/passwd", + "nginx.ingress.kubernetes.io/auth-signin": "https://httpbun.com/bearer/d4bcba7a-0def-4a31-91a7-47e420adf44b", + "nginx.ingress.kubernetes.io/auth-url": "https://httpbun.com/basic-auth/user/passwd", }) f.EnsureIngress(ing) diff --git a/test/e2e/servicebackend/service_externalname.go b/test/e2e/servicebackend/service_externalname.go index 0d121c671..2fd6cd080 100644 --- a/test/e2e/servicebackend/service_externalname.go +++ b/test/e2e/servicebackend/service_externalname.go @@ -29,44 +29,21 @@ import ( corev1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/util/intstr" "k8s.io/ingress-nginx/internal/nginx" "k8s.io/ingress-nginx/test/e2e/framework" ) -func buildHTTPBinExternalNameService(f *framework.Framework, portName string) *corev1.Service { - return &corev1.Service{ - ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBinService, - Namespace: f.Namespace, - }, - Spec: corev1.ServiceSpec{ - ExternalName: "httpbin.org", - Type: corev1.ServiceTypeExternalName, - Ports: []corev1.ServicePort{ - { - Name: portName, - Port: 80, - TargetPort: intstr.FromInt(80), - Protocol: "TCP", - }, - }, - }, - } -} - var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f := framework.NewDefaultFramework("type-externalname") ginkgo.It("works with external name set to incomplete fqdn", func() { f.NewEchoDeployment() - host := "echo" svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBinService, + Name: framework.HTTPBunService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ @@ -77,7 +54,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, nil) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -93,15 +70,19 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName without a port defined", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBinService, + Name: framework.NIPService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: "httpbin.org", + ExternalName: framework.BuildNIPHost(ip), Type: corev1.ServiceTypeExternalName, }, } @@ -109,9 +90,9 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": "httpbin.org", + "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, annotations) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -127,15 +108,19 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName with a port defined", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" - svc := buildHTTPBinExternalNameService(f, host) + svc := framework.BuildNIPExternalNameService(f, ip, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": "httpbin.org", + "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, annotations) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -155,7 +140,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBinService, + Name: framework.HTTPBunService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ @@ -166,7 +151,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, nil) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -182,18 +167,22 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using a port name", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" - svc := buildHTTPBinExternalNameService(f, host) + svc := framework.BuildNIPExternalNameService(f, ip, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": "httpbin.org", + "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, annotations) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) namedBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ - Name: framework.HTTPBinService, + Name: framework.NIPService, Port: networking.ServiceBackendPort{ Name: host, }, @@ -215,22 +204,26 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should return 200 for service type=ExternalName using FQDN with trailing dot", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" svc := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ - Name: framework.HTTPBinService, + Name: framework.NIPService, Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: "httpbin.org.", + ExternalName: framework.BuildNIPHost(ip), Type: corev1.ServiceTypeExternalName, }, } f.EnsureService(svc) - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, nil) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -246,18 +239,23 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { }) ginkgo.It("should update the external name after a service update", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" - svc := buildHTTPBinExternalNameService(f, host) + svc := framework.BuildNIPExternalNameService(f, ip, host) f.EnsureService(svc) annotations := map[string]string{ - "nginx.ingress.kubernetes.io/upstream-vhost": "httpbin.org", + "nginx.ingress.kubernetes.io/upstream-vhost": framework.BuildNIPHost(ip), } - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, annotations) + + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, annotations) namedBackend := networking.IngressBackend{ Service: &networking.IngressServiceBackend{ - Name: framework.HTTPBinService, + Name: framework.NIPService, Port: networking.ServiceBackendPort{ Name: host, }, @@ -281,13 +279,15 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains(ginkgo.GinkgoT(), body, `"X-Forwarded-Host": "echo"`) - svc, err := f.KubeClientSet.CoreV1().Services(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining httpbin service") + svc, err := f.KubeClientSet.CoreV1().Services(f.Namespace).Get(context.TODO(), framework.NIPService, metav1.GetOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error obtaining external service") - svc.Spec.ExternalName = "eu.httpbin.org" + ip = f.NewHttpbunDeployment(framework.WithDeploymentName("eu-server")) + + svc.Spec.ExternalName = framework.BuildNIPHost(ip) _, err = f.KubeClientSet.CoreV1().Services(f.Namespace).Update(context.Background(), svc, metav1.UpdateOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating httpbin service") + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error updating external service") framework.Sleep() @@ -301,18 +301,22 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { assert.Contains(ginkgo.GinkgoT(), body, `"X-Forwarded-Host": "echo"`) - ginkgo.By("checking the service is updated to use eu.httpbin.org") + ginkgo.By("checking the service is updated to use new host") curlCmd := fmt.Sprintf("curl --fail --silent http://localhost:%v/configuration/backends", nginx.StatusPort) output, err := f.ExecIngressPod(curlCmd) assert.Nil(ginkgo.GinkgoT(), err) - assert.Contains(ginkgo.GinkgoT(), output, `{"address":"eu.httpbin.org"`) + assert.Contains(ginkgo.GinkgoT(), output, fmt.Sprintf("{\"address\":\"%s\"", framework.BuildNIPHost(ip))) }) ginkgo.It("should sync ingress on external name service addition/deletion", func() { + // This is a workaround so we only depend on a self hosted instance of + // httpbun + ip := f.NewHttpbunDeployment() + host := "echo" // Create the Ingress first - ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, nil) + ing := framework.NewSingleIngress(host, "/", host, f.Namespace, framework.NIPService, 80, nil) f.EnsureIngress(ing) f.WaitForNginxServer(host, @@ -328,7 +332,7 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Status(http.StatusServiceUnavailable) // Now create the service - svc := buildHTTPBinExternalNameService(f, host) + svc := framework.BuildNIPExternalNameService(f, ip, host) f.EnsureService(svc) framework.Sleep() @@ -341,9 +345,8 @@ var _ = framework.IngressNginxDescribe("[Service] Type ExternalName", func() { Status(http.StatusOK) // And back to 503 after deleting the service - - err := f.KubeClientSet.CoreV1().Services(f.Namespace).Delete(context.TODO(), framework.HTTPBinService, metav1.DeleteOptions{}) - assert.Nil(ginkgo.GinkgoT(), err, "unexpected error deleting httpbin service") + err := f.KubeClientSet.CoreV1().Services(f.Namespace).Delete(context.TODO(), framework.NIPService, metav1.DeleteOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "unexpected error deleting external service") framework.Sleep() diff --git a/test/e2e/settings/brotli.go b/test/e2e/settings/brotli.go index a07eb6c09..a13678f66 100644 --- a/test/e2e/settings/brotli.go +++ b/test/e2e/settings/brotli.go @@ -33,7 +33,7 @@ var _ = framework.IngressNginxDescribe("brotli", func() { host := "brotli" ginkgo.BeforeEach(func() { - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() }) ginkgo.It("should only compress responses that meet the `brotli-min-length` condition", func() { @@ -43,7 +43,7 @@ var _ = framework.IngressNginxDescribe("brotli", func() { f.UpdateNginxConfigMapData("brotli-types", contentEncoding) f.UpdateNginxConfigMapData("brotli-min-length", strconv.Itoa(brotliMinLength)) - f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBinService, 80, nil)) + f.EnsureIngress(framework.NewSingleIngress(host, "/", host, f.Namespace, framework.HTTPBunService, 80, nil)) f.WaitForNginxConfiguration( func(server string) bool { diff --git a/test/e2e/settings/disable_service_external_name.go b/test/e2e/settings/disable_service_external_name.go index a24cfebde..7f03e5355 100644 --- a/test/e2e/settings/disable_service_external_name.go +++ b/test/e2e/settings/disable_service_external_name.go @@ -50,17 +50,21 @@ var _ = framework.IngressNginxDescribe("[Flag] disable-service-external-name", f }) ginkgo.It("should ignore services of external-name type", func() { - nonexternalhost := "echo-svc.com" externalhost := "echo-external-svc.com" + + ip := f.NewHttpbunDeployment() + svc := framework.BuildNIPExternalNameService(f, ip, "echo") + f.EnsureService(svc) + svcexternal := &corev1.Service{ ObjectMeta: metav1.ObjectMeta{ Name: "external", Namespace: f.Namespace, }, Spec: corev1.ServiceSpec{ - ExternalName: "httpbin.org", + ExternalName: framework.BuildNIPHost(ip), Type: corev1.ServiceTypeExternalName, }, } diff --git a/test/e2e/settings/global_external_auth.go b/test/e2e/settings/global_external_auth.go index c70b5a9b1..c5964299f 100644 --- a/test/e2e/settings/global_external_auth.go +++ b/test/e2e/settings/global_external_auth.go @@ -50,13 +50,13 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { ginkgo.BeforeEach(func() { f.NewEchoDeployment() - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() }) ginkgo.Context("when global external authentication is configured", func() { ginkgo.BeforeEach(func() { - globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/401", framework.HTTPBinService, f.Namespace) + globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/401", framework.HTTPBunService, f.Namespace) ginkgo.By("Adding an ingress rule for /foo") fooIng := framework.NewSingleIngress("foo-ingress", fooPath, host, f.Namespace, echoServiceName, 80, nil) @@ -158,7 +158,7 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { globalExternalAuthCacheKey := "foo" globalExternalAuthCacheDurationSetting := "global-auth-cache-duration" globalExternalAuthCacheDuration := "200 201 401 30m" - globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/200", framework.HTTPBinService, f.Namespace) + globalExternalAuthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:80/status/200", framework.HTTPBunService, f.Namespace) ginkgo.By("Adding a global-auth-cache-key to configMap") f.SetNginxConfigMapData(map[string]string{ @@ -182,7 +182,7 @@ var _ = framework.DescribeSetting("[Security] global-auth-url", func() { Expect(). Status(http.StatusOK) - err := f.DeleteDeployment(framework.HTTPBinService) + err := f.DeleteDeployment(framework.HTTPBunService) assert.Nil(ginkgo.GinkgoT(), err) framework.Sleep() @@ -307,9 +307,9 @@ http { assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP - f.UpdateNginxConfigMapData(globalExternalAuthURLSetting, fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbinIP)) + f.UpdateNginxConfigMapData(globalExternalAuthURLSetting, fmt.Sprintf("http://%s/cookies/set/alma/armud", httpbunIP)) ing1 = framework.NewSingleIngress(host, "/", host, f.Namespace, "http-cookie-with-error", 80, nil) f.EnsureIngress(ing1) diff --git a/test/e2e/settings/listen_nondefault_ports.go b/test/e2e/settings/listen_nondefault_ports.go index 61a128040..8b5d22f6e 100644 --- a/test/e2e/settings/listen_nondefault_ports.go +++ b/test/e2e/settings/listen_nondefault_ports.go @@ -98,21 +98,21 @@ var _ = framework.IngressNginxDescribe("[Flag] custom HTTP and HTTPS ports", fun ginkgo.Context("when external authentication is configured", func() { ginkgo.It("should set the X-Forwarded-Port header to 443", func() { - f.NewHttpbinDeployment() + f.NewHttpbunDeployment() - err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1) + err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBunService, f.Namespace, 1) assert.Nil(ginkgo.GinkgoT(), err) - e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{}) + e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBunService, metav1.GetOptions{}) assert.Nil(ginkgo.GinkgoT(), err) assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets), 1, "expected at least one endpoint") assert.GreaterOrEqual(ginkgo.GinkgoT(), len(e.Subsets[0].Addresses), 1, "expected at least one address ready in the endpoint") - httpbinIP := e.Subsets[0].Addresses[0].IP + httpbunIP := e.Subsets[0].Addresses[0].IP annotations := map[string]string{ - "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP), + "nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbunIP), "nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start", } diff --git a/test/k6/smoketest.js b/test/k6/smoketest.js index b5ab577a9..8fe9e950a 100644 --- a/test/k6/smoketest.js +++ b/test/k6/smoketest.js @@ -27,7 +27,7 @@ export default function () { const params = { headers: {'host': 'test.ingress-nginx-controller.ga'}, }; - // httpbin.org documents these requests + // httpbun.com documents these requests const req1 = { method: 'GET', url: 'http://test.ingress-nginx-controller.ga/ip', From f18826b73ef5ad78eca74befeb9f0f521f5bfc61 Mon Sep 17 00:00:00 2001 From: vkanelov <81570499+vkanelov@users.noreply.github.com> Date: Thu, 11 May 2023 00:39:14 +0300 Subject: [PATCH 172/822] add option for annotations in PodDisruptionBudget (#9843) add option for annotations in PodDisruptionBudget --- .../templates/controller-poddisruptionbudget.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml b/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml index 899d3cc5d..230307cd7 100644 --- a/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml +++ b/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml @@ -10,6 +10,9 @@ metadata: {{- end }} name: {{ include "ingress-nginx.controller.fullname" . }} namespace: {{ .Release.Namespace }} + {{- if .Values.controller.annotations }} + annotations: {{ toYaml .Values.controller.annotations | nindent 4 }} + {{- end }} spec: selector: matchLabels: From 3b3cf8b331f221969a2bd89a24a502507583f87b Mon Sep 17 00:00:00 2001 From: Apoorva Kulkarni Date: Thu, 11 May 2023 08:39:03 -0700 Subject: [PATCH 173/822] Use dl.k8s.io instead of hardcoded GCS URIs (#9946) --- .github/workflows/ci.yaml | 2 +- images/test-runner/rootfs/Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 77232aa88..19d39ab70 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -167,7 +167,7 @@ jobs: run: | sudo apt-get -qq update || true sudo apt-get install -y pigz - curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.25.5/bin/linux/amd64/kubectl + curl -LO https://dl.k8s.io/release/v1.25.5/bin/linux/amd64/kubectl chmod +x ./kubectl sudo mv ./kubectl /usr/local/bin/kubectl diff --git a/images/test-runner/rootfs/Dockerfile b/images/test-runner/rootfs/Dockerfile index 0b691a7d2..8574f8752 100644 --- a/images/test-runner/rootfs/Dockerfile +++ b/images/test-runner/rootfs/Dockerfile @@ -92,11 +92,11 @@ RUN luarocks install busted \ && luarocks install luacheck RUN wget -qO /usr/local/bin/kubectl \ - https://storage.googleapis.com/kubernetes-release/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kubectl \ + https://dl.k8s.io/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kubectl \ && chmod +x /usr/local/bin/kubectl RUN wget -qO /usr/local/bin/kube-apiserver \ - https://storage.googleapis.com/kubernetes-release/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kube-apiserver \ + https://dl.k8s.io/release/${K8S_RELEASE}/bin/linux/${TARGETARCH}/kube-apiserver \ && chmod +x /usr/local/bin/kube-apiserver RUN wget -qO /tmp/ct-${CHART_TESTING_VERSION}-linux-${TARGETARCH}.tar.gz \ From 06612e6ffd044171e33b5e8315b9605eb8730c55 Mon Sep 17 00:00:00 2001 From: Marco Ebert Date: Thu, 11 May 2023 18:37:03 +0200 Subject: [PATCH 174/822] HPA: Use capabilites & align manifests. (#9521) --- charts/ingress-nginx/README.md | 2 - .../templates/controller-hpa.yaml | 27 +++++------- .../templates/default-backend-hpa.yaml | 41 ++++++++++--------- charts/ingress-nginx/values.yaml | 2 - 4 files changed, 33 insertions(+), 39 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 2c2dd2f37..d79ad38cd 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -273,7 +273,6 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.allowSnippetAnnotations | bool | `true` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected | | controller.annotations | object | `{}` | Annotations to be added to the controller Deployment or DaemonSet # | | controller.autoscaling.annotations | object | `{}` | | -| controller.autoscaling.apiVersion | string | `"autoscaling/v2"` | | | controller.autoscaling.behavior | object | `{}` | | | controller.autoscaling.enabled | bool | `false` | | | controller.autoscaling.maxReplicas | int | `11` | | @@ -435,7 +434,6 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false | | defaultBackend.affinity | object | `{}` | | | defaultBackend.autoscaling.annotations | object | `{}` | | -| defaultBackend.autoscaling.apiVersion | string | `"autoscaling/v2"` | | | defaultBackend.autoscaling.enabled | bool | `false` | | | defaultBackend.autoscaling.maxReplicas | int | `2` | | | defaultBackend.autoscaling.minReplicas | int | `1` | | diff --git a/charts/ingress-nginx/templates/controller-hpa.yaml b/charts/ingress-nginx/templates/controller-hpa.yaml index d1e78bdfc..96a91f533 100644 --- a/charts/ingress-nginx/templates/controller-hpa.yaml +++ b/charts/ingress-nginx/templates/controller-hpa.yaml @@ -1,12 +1,9 @@ -{{- if and .Values.controller.autoscaling.enabled (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) -}} -{{- if not .Values.controller.keda.enabled }} - -apiVersion: {{ .Values.controller.autoscaling.apiVersion }} +{{- if and (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}} +apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} kind: HorizontalPodAutoscaler metadata: - annotations: {{- with .Values.controller.autoscaling.annotations }} - {{- toYaml . | trimSuffix "\n" | nindent 4 }} + annotations: {{ toYaml . | nindent 4 }} {{- end }} labels: {{- include "ingress-nginx.labels" . | nindent 4 }} @@ -24,14 +21,6 @@ spec: minReplicas: {{ .Values.controller.autoscaling.minReplicas }} maxReplicas: {{ .Values.controller.autoscaling.maxReplicas }} metrics: - {{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: {{ . }} - {{- end }} {{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }} - type: Resource resource: @@ -40,6 +29,14 @@ spec: type: Utilization averageUtilization: {{ . }} {{- end }} + {{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} {{- with .Values.controller.autoscalingTemplate }} {{- toYaml . | nindent 2 }} {{- end }} @@ -48,5 +45,3 @@ spec: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} -{{- end }} - diff --git a/charts/ingress-nginx/templates/default-backend-hpa.yaml b/charts/ingress-nginx/templates/default-backend-hpa.yaml index 924125f07..faaf4fa75 100644 --- a/charts/ingress-nginx/templates/default-backend-hpa.yaml +++ b/charts/ingress-nginx/templates/default-backend-hpa.yaml @@ -1,37 +1,40 @@ {{- if and .Values.defaultBackend.enabled .Values.defaultBackend.autoscaling.enabled }} -apiVersion: {{ .Values.defaultBackend.autoscaling.apiVersion }} +apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }} kind: HorizontalPodAutoscaler metadata: + {{- with .Values.defaultBackend.autoscaling.annotations }} + annotations: {{ toYaml . | nindent 4 }} + {{- end }} labels: {{- include "ingress-nginx.labels" . | nindent 4 }} app.kubernetes.io/component: default-backend {{- with .Values.defaultBackend.labels }} {{- toYaml . | nindent 4 }} {{- end }} - name: {{ template "ingress-nginx.defaultBackend.fullname" . }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} namespace: {{ .Release.Namespace }} spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment - name: {{ template "ingress-nginx.defaultBackend.fullname" . }} + name: {{ include "ingress-nginx.defaultBackend.fullname" . }} minReplicas: {{ .Values.defaultBackend.autoscaling.minReplicas }} maxReplicas: {{ .Values.defaultBackend.autoscaling.maxReplicas }} metrics: -{{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ . }} -{{- end }} -{{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: {{ . }} -{{- end }} + {{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} + {{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} {{- end }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index 3a9629d63..a398b0503 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -326,7 +326,6 @@ controller: memory: 90Mi # Mutually exclusive with keda autoscaling autoscaling: - apiVersion: autoscaling/v2 enabled: false annotations: {} minReplicas: 1 @@ -838,7 +837,6 @@ defaultBackend: # emptyDir: {} autoscaling: - apiVersion: autoscaling/v2 annotations: {} enabled: false minReplicas: 1 From 98780d7eb85cb38a599637f5f02f45fef2906cd6 Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 11 May 2023 15:45:05 -0400 Subject: [PATCH 175/822] Update feature_request.md (#9951) --- .github/ISSUE_TEMPLATE/feature_request.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 0e892d626..406a7ad0a 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -7,16 +7,6 @@ assignees: '' --- - - From 55e37c6feaff0badaea6b04636e93494d899201f Mon Sep 17 00:00:00 2001 From: James Strong Date: Thu, 11 May 2023 15:47:05 -0400 Subject: [PATCH 176/822] Update PULL_REQUEST_TEMPLATE.md (#9952) --- .github/PULL_REQUEST_TEMPLATE.md | 34 +------------------------------- 1 file changed, 1 insertion(+), 33 deletions(-) diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index e3781887a..c1c815678 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,5 +1,6 @@ + ## What this PR does / why we need it: @@ -33,36 +34,3 @@ fixes # - [ ] I've read the [CONTRIBUTION](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md) guide - [ ] I have added unit and/or e2e tests to cover my changes. - [ ] All new and existing tests passed. -- [ ] Added Release Notes. - -## Does my pull request need a release note? -Any user-visible or operator-visible change qualifies for a release note. This could be a: - -- CLI change -- API change -- UI change -- configuration schema change -- behavioral change -- change in non-functional attributes such as efficiency or availability, availability of a new platform -- a warning about a deprecation -- fix of a previous Known Issue -- fix of a vulnerability (CVE) - -No release notes are required for changes to the following: - -- Tests -- Build infrastructure -- Fixes for unreleased bugs - -For more tips on writing good release notes, check out the [Release Notes Handbook](https://github.com/kubernetes/sig-release/tree/master/release-team/role-handbooks/release-notes) - - -```release-note -PLACE RELEASE NOTES HERE -``` From c5dad5e46116382ef8ec02a648e9c48d0ef1ea19 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Thu, 11 May 2023 21:03:12 -0400 Subject: [PATCH 177/822] removed e2e tests for cgroups2 and associated functions --- pkg/util/runtime/cpu_linux.go | 4 -- pkg/util/runtime/cpu_notlinux.go | 6 +-- test/e2e/cgroups/cgroups_linux.go | 65 ---------------------------- test/e2e/cgroups/cgroups_notlinux.go | 42 ------------------ test/e2e/e2e.go | 41 +++++++++--------- 5 files changed, 21 insertions(+), 137 deletions(-) delete mode 100644 test/e2e/cgroups/cgroups_linux.go delete mode 100644 test/e2e/cgroups/cgroups_notlinux.go diff --git a/pkg/util/runtime/cpu_linux.go b/pkg/util/runtime/cpu_linux.go index e5e8db40a..c72f47f01 100644 --- a/pkg/util/runtime/cpu_linux.go +++ b/pkg/util/runtime/cpu_linux.go @@ -60,10 +60,6 @@ func NumCPU() int { return int(math.Ceil(float64(cpuQuota) / float64(cpuPeriod))) } -func IsCgroupAvaliable() bool { - return true -} - func getCgroupVersion() int64 { // /sys/fs/cgroup/cgroup.controllers will not exist with cgroupsv1 if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); err == nil { diff --git a/pkg/util/runtime/cpu_notlinux.go b/pkg/util/runtime/cpu_notlinux.go index 3c4c6718b..0441af957 100644 --- a/pkg/util/runtime/cpu_notlinux.go +++ b/pkg/util/runtime/cpu_notlinux.go @@ -26,8 +26,4 @@ import ( // NumCPU ... func NumCPU() int { return runtime.NumCPU() -} - -func IsCgroupAvaliable() bool { - return false -} +} \ No newline at end of file diff --git a/test/e2e/cgroups/cgroups_linux.go b/test/e2e/cgroups/cgroups_linux.go deleted file mode 100644 index 18b3f837b..000000000 --- a/test/e2e/cgroups/cgroups_linux.go +++ /dev/null @@ -1,65 +0,0 @@ -//go:build linux -// +build linux - -/* -Copyright 2020 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package cgroups - -import ( - "log" - "os" - - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - - "k8s.io/ingress-nginx/test/e2e/framework" - - "k8s.io/ingress-nginx/pkg/util/runtime" -) - -var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { - f := framework.NewDefaultFramework("cgroups") - - ginkgo.BeforeEach(func() { - f.NewEchoDeployment() - f.NewSlowEchoDeployment() - }) - - ginkgo.It("detects if cgroups is avaliable", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.IsCgroupAvaliable(), 1) - }) - - ginkgo.It("detects cgroups version v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.readCgroupFileToInt64(), 1) - }) - - ginkgo.It("detects number of CPUs properly in cgroups v1", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) - }) - - ginkgo.It("detects cgroups version v2", func() { - // create cgroups2 files - if err := os.MkdirAll("a/b/c/d", os.ModePerm); err != nil { - log.Fatal(err) - } - - }) - - ginkgo.It("detects number of CPUs properly in cgroups v2", func() { - assert.Equal(ginkgo.GinkgoT(), runtime.NumCPU(), -1) - }) -}) diff --git a/test/e2e/cgroups/cgroups_notlinux.go b/test/e2e/cgroups/cgroups_notlinux.go deleted file mode 100644 index 483db52cc..000000000 --- a/test/e2e/cgroups/cgroups_notlinux.go +++ /dev/null @@ -1,42 +0,0 @@ -//go:build !linux -// +build !linux - -/* -Copyright 2020 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package cgroups - -import ( - "github.com/onsi/ginkgo/v2" - "github.com/stretchr/testify/assert" - - "k8s.io/ingress-nginx/test/e2e/framework" - - "k8s.io/ingress-nginx/pkg/util/runtime" -) - -var _ = framework.IngressNginxDescribeSerial("[CGroups] cgroups", func() { - f := framework.NewDefaultFramework("cgroups") - - ginkgo.BeforeEach(func() { - f.NewEchoDeployment() - f.NewSlowEchoDeployment() - }) - - ginkgo.It("detects cgroups is not avaliable", func() { - assert.True(ginkgo.GinkgoT(), !runtime.IsCgroupAvaliable()) - }) -}) diff --git a/test/e2e/e2e.go b/test/e2e/e2e.go index a671e8793..57b047230 100644 --- a/test/e2e/e2e.go +++ b/test/e2e/e2e.go @@ -29,27 +29,26 @@ import ( "k8s.io/ingress-nginx/test/e2e/framework" // tests to run - // _ "k8s.io/ingress-nginx/test/e2e/admission" - // _ "k8s.io/ingress-nginx/test/e2e/annotations" - // _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" - _ "k8s.io/ingress-nginx/test/e2e/cgroups" - // _ "k8s.io/ingress-nginx/test/e2e/dbg" - // _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" - // _ "k8s.io/ingress-nginx/test/e2e/endpointslices" - // _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" - // _ "k8s.io/ingress-nginx/test/e2e/ingress" - // _ "k8s.io/ingress-nginx/test/e2e/leaks" - // _ "k8s.io/ingress-nginx/test/e2e/loadbalance" - // _ "k8s.io/ingress-nginx/test/e2e/lua" - // _ "k8s.io/ingress-nginx/test/e2e/nginx" - // _ "k8s.io/ingress-nginx/test/e2e/security" - // _ "k8s.io/ingress-nginx/test/e2e/servicebackend" - // _ "k8s.io/ingress-nginx/test/e2e/settings" - // _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" - // _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" - // _ "k8s.io/ingress-nginx/test/e2e/ssl" - // _ "k8s.io/ingress-nginx/test/e2e/status" - // _ "k8s.io/ingress-nginx/test/e2e/tcpudp" + _ "k8s.io/ingress-nginx/test/e2e/admission" + _ "k8s.io/ingress-nginx/test/e2e/annotations" + _ "k8s.io/ingress-nginx/test/e2e/annotations/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/dbg" + _ "k8s.io/ingress-nginx/test/e2e/defaultbackend" + _ "k8s.io/ingress-nginx/test/e2e/endpointslices" + _ "k8s.io/ingress-nginx/test/e2e/gracefulshutdown" + _ "k8s.io/ingress-nginx/test/e2e/ingress" + _ "k8s.io/ingress-nginx/test/e2e/leaks" + _ "k8s.io/ingress-nginx/test/e2e/loadbalance" + _ "k8s.io/ingress-nginx/test/e2e/lua" + _ "k8s.io/ingress-nginx/test/e2e/nginx" + _ "k8s.io/ingress-nginx/test/e2e/security" + _ "k8s.io/ingress-nginx/test/e2e/servicebackend" + _ "k8s.io/ingress-nginx/test/e2e/settings" + _ "k8s.io/ingress-nginx/test/e2e/settings/modsecurity" + _ "k8s.io/ingress-nginx/test/e2e/settings/ocsp" + _ "k8s.io/ingress-nginx/test/e2e/ssl" + _ "k8s.io/ingress-nginx/test/e2e/status" + _ "k8s.io/ingress-nginx/test/e2e/tcpudp" ) // RunE2ETests checks configuration parameters (specified through flags) and then runs From a8028a576f3174e9063f55ccc96c5345bf0357b1 Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Thu, 11 May 2023 21:04:21 -0400 Subject: [PATCH 178/822] remove test report --- test/junitreports/report-e2e-test-suite.xml | 1311 ------------------- 1 file changed, 1311 deletions(-) delete mode 100644 test/junitreports/report-e2e-test-suite.xml diff --git a/test/junitreports/report-e2e-test-suite.xml b/test/junitreports/report-e2e-test-suite.xml deleted file mode 100644 index fc919bad2..000000000 --- a/test/junitreports/report-e2e-test-suite.xml +++ /dev/null @@ -1,1311 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:40.576 (2m21.32s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:40.576 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:44.629 (4.053s) > Enter [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:44.629 < Exit [It] should set cors methods to only allow POST, GET - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:62 @ 04/04/23 18:06:54.768 (10.139s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.768 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:54.976 (208ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:54.976 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:01.906 (6.93s) > Enter [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:01.906 < Exit [BeforeEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:34 @ 04/04/23 18:07:12.967 (11.06s) > Enter [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:07:12.967 < Exit [It] should evenly distribute requests with round-robin (default algorithm) - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/round_robin.go:39 @ 04/04/23 18:09:21.17 (2m8.203s) > Enter [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.17 < Exit [AfterEach] [Setting] [Load Balancer] round-robin - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:21.399 (229ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:21.4 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:28.324 (6.924s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:28.324 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:09:39.376 (11.052s) > Enter [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:39.376 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:54 @ 04/04/23 18:09:56.563 STEP: ensuring that first entry in X-Forwarded-Host is used as the best host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:75 @ 04/04/23 18:09:56.572 < Exit [It] should trust X-Forwarded headers when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:40 @ 04/04/23 18:09:56.578 (17.202s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.578 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:56.789 (211ms) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:56.79 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.662 (6.873s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:03.662 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:10:07.688 (4.026s) > Enter [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:07.688 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:65 @ 04/04/23 18:10:07.688 STEP: sending request to www should redirect to domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:91 @ 04/04/23 18:10:22.913 STEP: sending request to domain should not redirect to www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:103 @ 04/04/23 18:10:22.941 < Exit [It] should redirect from www HTTPS to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:64 @ 04/04/23 18:10:22.969 (15.281s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:22.969 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:23.209 (240ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:23.21 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.083 (7.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:31.083 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:35.101 (4.018s) > Enter [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:35.101 < Exit [It] should set secure in cookie with provided true annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:412 @ 04/04/23 18:10:45.308 (10.206s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.308 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:45.524 (217ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:45.525 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:52.399 (6.874s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:52.399 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:10:56.446 (4.048s) > Enter [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:10:56.446 < Exit [It] should not set cookie without domain annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:248 @ 04/04/23 18:11:06.571 (10.124s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.571 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.765 (195ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.765 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.684 (6.918s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:13.684 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:17.714 (4.03s) > Enter [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:17.714 < Exit [It] should set sticky cookie without host - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:352 @ 04/04/23 18:11:27.946 (10.232s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:27.946 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:28.167 (220ms) - - - > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:28.167 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:36.071 (7.904s) > Enter [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:36.071 < Exit [BeforeEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:35 @ 04/04/23 18:11:38.106 (2.035s) > Enter [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:11:38.106 < Exit [It] should not return body content from error_page - /go/src/k8s.io/ingress-nginx/test/e2e/security/request_smuggling.go:39 @ 04/04/23 18:12:00.307 (22.201s) > Enter [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.307 < Exit [AfterEach] [Security] request smuggling - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:00.53 (223ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:00.531 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:07.492 (6.961s) > Enter [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:07.492 < Exit [It] should use grpc_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:43 @ 04/04/23 18:12:24.818 (17.326s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:24.818 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:25.032 (214ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:25.033 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:32.425 (7.392s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:32.425 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:36.448 (4.023s) > Enter [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:36.448 < Exit [It] should return status code 401 when authentication is configured with invalid content and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:227 @ 04/04/23 18:12:46.572 (10.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.572 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:46.787 (215ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:46.788 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:54.215 (7.427s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:54.215 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:02.279 (8.064s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:02.279 STEP: routing requests to the canary upstream when header pattern is matched - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:514 @ 04/04/23 18:13:19.503 STEP: routing requests to the mainline upstream when header failed to match header value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:523 @ 04/04/23 18:13:19.508 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:490 @ 04/04/23 18:13:19.51 (17.231s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.51 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:19.813 (303ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:19.813 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:26.704 (6.89s) > Enter [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:26.704 < Exit [It] should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:31 @ 04/04/23 18:13:29.872 (3.169s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:29.872 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:30.073 (201ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:30.073 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.948 (7.874s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:37.948 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:13:41.967 (4.019s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:13:41.967 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a custom blocklist config in place and allow others to pass - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:133 @ 04/04/23 18:14:07.32 (25.353s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.32 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:07.487 (167ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:07.487 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.369 (6.882s) > Enter [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.369 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:107 @ 04/04/23 18:14:14.37 < Exit [It] disables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:105 @ 04/04/23 18:14:14.37 (1ms) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.37 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:14.561 (191ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:14.561 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:21.468 (6.907s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:21.468 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:14:29.526 (8.058s) > Enter [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:14:29.526 STEP: routing requests to the canary upstream when cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:667 @ 04/04/23 18:14:46.664 STEP: routing requests to the mainline upstream when cookie is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:678 @ 04/04/23 18:14:54.864 STEP: routing requests to the mainline upstream when cookie is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:689 @ 04/04/23 18:15:04.858 < Exit [It] respects always and never values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:643 @ 04/04/23 18:15:14.862 (45.336s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:14.862 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:15.079 (218ms) - - - > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:15.08 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.972 (7.892s) > Enter [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:22.972 < Exit [BeforeEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:32 @ 04/04/23 18:15:26.998 (4.026s) > Enter [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:26.998 < Exit [It] should use a custom default backend as upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/default_backend.go:37 @ 04/04/23 18:15:37.18 (10.182s) > Enter [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.18 < Exit [AfterEach] [Annotations] default-backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:37.392 (212ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:37.392 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:44.321 (6.929s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:44.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:50.372 (6.051s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:15:50.372 < Exit [It] always routes traffic to canary if first request was affinitized to canary (explicit sticky behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1000 @ 04/04/23 18:16:15.956 (25.584s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:15.956 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:16.151 (195ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:16.152 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:25.575 (9.424s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:25.576 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:16:29.621 (4.045s) > Enter [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:29.621 STEP: setting enable-rewrite-log annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:38 @ 04/04/23 18:16:29.621 < Exit [It] should write rewrite logs - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:37 @ 04/04/23 18:16:42.864 (13.243s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:42.864 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:43.089 (224ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:43.089 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.483 (7.394s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:50.483 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:16:54.502 (4.019s) > Enter [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:16:54.502 < Exit [It] should set sslClientCertificate, sslVerifyClient and sslVerifyDepth with auth-tls-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:36 @ 04/04/23 18:17:09.564 (15.063s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.564 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:09.781 (217ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:09.782 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:16.68 (6.899s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:16.68 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:17:20.71 (4.03s) > Enter [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:20.71 < Exit [It] should propagate the w3c header when configured with jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:197 @ 04/04/23 18:17:50.976 (30.266s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:50.976 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:51.176 (200ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:17:51.176 (0s) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:51.177 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.072 (7.895s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:59.072 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:18:13.271 (14.199s) > Enter [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:13.271 < Exit [It] handles endpoints only changes - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:62 @ 04/04/23 18:18:23.585 (10.314s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.585 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:23.805 (219ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:23.805 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:30.696 (6.891s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:30.696 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:18:34.717 (4.021s) > Enter [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:34.717 < Exit [It] should not appear references to secret updates not used in ingress rules - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:40 @ 04/04/23 18:18:57.987 (23.27s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:57.987 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:58.194 (208ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:58.195 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:08.072 (9.877s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:08.072 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:12.096 (4.024s) > Enter [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:12.096 < Exit [It] should include opentelemetry_trust_incoming_spans on directive when enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:74 @ 04/04/23 18:19:29.486 (17.39s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:29.486 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:30 (514ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:19:30 (0s) - - - > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:30.007 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:37.929 (7.922s) > Enter [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:37.929 < Exit [BeforeEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:34 @ 04/04/23 18:19:41.957 (4.027s) > Enter [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:41.957 STEP: setting up server for redirect from www - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:39 @ 04/04/23 18:19:41.957 STEP: sending request to www.fromtowwwredirect.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:55 @ 04/04/23 18:19:52.111 < Exit [It] should redirect from www HTTP to HTTP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fromtowwwredirect.go:38 @ 04/04/23 18:19:52.114 (10.157s) > Enter [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.114 < Exit [AfterEach] [Annotations] from-to-www-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.309 (195ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:52.309 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.222 (6.912s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:19:59.222 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:20:03.271 (4.049s) > Enter [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:03.271 < Exit [It] should produce valid JSON for /dbg general - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:85 @ 04/04/23 18:20:10.739 (7.468s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:10.739 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:11.546 (807ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:11.548 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.355 (8.808s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:20.355 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:20:28.54 (8.185s) > Enter [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:20:28.54 < Exit [It] should route requests split between mainline and canary if canary weight is 50 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:808 @ 04/04/23 18:21:23.965 (55.425s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:23.965 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:24.188 (223ms) - - - > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:24.188 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:32.093 (7.904s) > Enter [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:32.093 < Exit [BeforeEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:37 @ 04/04/23 18:21:36.116 (4.023s) > Enter [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:21:36.116 STEP: turning on proxy_intercept_errors directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:59 @ 04/04/23 18:21:46.348 STEP: configuring error_page directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:62 @ 04/04/23 18:21:46.348 STEP: creating error locations - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:67 @ 04/04/23 18:21:46.348 STEP: updating configuration when only custom-http-error value changes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:72 @ 04/04/23 18:21:46.349 STEP: ignoring duplicate values (503 in this case) per server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:90 @ 04/04/23 18:21:50.55 STEP: using the custom default-backend from annotation for upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:102 @ 04/04/23 18:22:00.715 < Exit [It] configures Nginx correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/customhttperrors.go:41 @ 04/04/23 18:22:08.9 (32.784s) > Enter [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:08.9 < Exit [AfterEach] [Annotations] custom-http-errors - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.112 (212ms) - - - > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.112 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.003 (7.891s) > Enter [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:17.003 < Exit [BeforeEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:32 @ 04/04/23 18:22:21.032 (4.029s) > Enter [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:21.032 < Exit [It] set connection header to keep-alive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/connection.go:36 @ 04/04/23 18:22:31.159 (10.126s) > Enter [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.159 < Exit [AfterEach] [Annotations] connection-proxy-header - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:31.365 (206ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:31.366 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:38.253 (6.887s) > Enter [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:38.253 < Exit [It] should return 200 for service type=ExternalName using FQDN with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:217 @ 04/04/23 18:22:48.533 (10.28s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.533 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:48.75 (218ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:48.751 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:55.631 (6.88s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:55.631 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:22:59.653 (4.022s) > Enter [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:22:59.653 < Exit [BeforeEach] should configure TLS protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:47 @ 04/04/23 18:23:08.743 (9.09s) > Enter [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:08.743 < Exit [It] setting cipher suite - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:65 @ 04/04/23 18:23:18.9 (10.157s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:18.9 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.087 (187ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.087 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.019 (7.931s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.019 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.042 (4.023s) > Enter [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:31.042 < Exit [It] should not set client_body_buffer_size to invalid 1b - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:145 @ 04/04/23 18:23:41.252 (10.21s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.252 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:41.433 (181ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:41.433 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:48.317 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:48.317 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:52.34 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:23:52.34 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:24:11.665 (19.325s) > Enter [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:11.665 < Exit [It] user with annotated ingress retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:433 @ 04/04/23 18:24:16.916 (5.251s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.295 (379ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.296 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:24.725 (7.429s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:24.725 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:24:28.761 (4.036s) > Enter [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:28.761 < Exit [It] should accept both Ingresses with default IngressClassName and IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:132 @ 04/04/23 18:24:45.952 (17.19s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:45.952 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:46.145 (194ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:46.146 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:54.048 (7.903s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:54.048 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:58.076 (4.028s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:24:58.076 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:03.11 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:13.321 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:25:23.483 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:25:33.694 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:25:48.897 (50.821s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.897 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:849 @ 04/04/23 18:25:48.908 (11ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:48.908 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:49.135 (227ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:49.135 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:56.988 (7.853s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:25:56.988 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:26:08.04 (11.052s) > Enter [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:08.04 < Exit [It] should enable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:63 @ 04/04/23 18:26:18.223 (10.184s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.223 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:18.414 (191ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:18.415 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.316 (6.901s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:25.316 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:26:29.352 (4.036s) > Enter [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:29.352 < Exit [It] disable-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:35 @ 04/04/23 18:26:46.584 (17.231s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.584 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.805 (221ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.805 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.714 (6.909s) > Enter [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:26:53.714 < Exit [It] should return 503 when backend service does not exist - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:36 @ 04/04/23 18:27:03.859 (10.145s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.859 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:04.058 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:04.058 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:22.496 (2m18.438s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:22.496 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:26.527 (4.032s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:26.527 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:40.697 (14.169s) > Enter [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:29:40.697 < Exit [It] should not create additional upstream block when host part of auth-url contains a variable - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:570 @ 04/04/23 18:30:03.916 (23.219s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:03.916 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:04.131 (215ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:04.131 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:12.003 (7.871s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:12.003 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:30:16.028 (4.025s) > Enter [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:16.028 < Exit [It] should return 403 using auth-tls-match-cn with no matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:266 @ 04/04/23 18:30:26.487 (10.459s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.487 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:26.704 (217ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:26.704 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:33.592 (6.888s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:33.592 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:30:44.636 (11.044s) > Enter [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:44.636 < Exit [It] should set variables-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:88 @ 04/04/23 18:30:54.792 (10.156s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.792 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:54.971 (179ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:54.971 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:30:56.98 (2.008s) > Enter [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:30:56.98 < Exit [It] fails when using alias directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:115 @ 04/04/23 18:31:57.006 (1m0.027s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.006 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:31:57.009 (3ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:57.009 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:03.889 (6.88s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:03.889 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:32:07.917 (4.028s) > Enter [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:07.917 < Exit [It] should add value of stream-snippet to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:41 @ 04/04/23 18:32:23.139 (15.222s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.139 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:23.334 (195ms) - - - > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:23.334 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:30.222 (6.888s) > Enter [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:30.222 < Exit [BeforeEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:30 @ 04/04/23 18:32:34.249 (4.027s) > Enter [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:34.249 < Exit [It] should redirect to https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/forcesslredirect.go:34 @ 04/04/23 18:32:41.274 (7.025s) > Enter [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.274 < Exit [AfterEach] [Annotations] force-ssl-redirect - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:41.496 (222ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:41.497 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:48.376 (6.879s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:48.376 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:32:52.403 (4.027s) > Enter [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:32:52.403 < Exit [BeforeEach] With specific ingress-class flags - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:392 @ 04/04/23 18:33:00.451 (8.048s) > Enter [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:00.451 < Exit [It] should ignore Ingress with no class and accept the correctly configured Ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:413 @ 04/04/23 18:33:24.697 (24.246s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.697 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:24.873 (176ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.873 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:32.238 (7.364s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:32.238 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:33:42.291 (10.053s) > Enter [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:42.291 < Exit [It] should route requests only to canary if canary weight is 100 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:743 @ 04/04/23 18:33:59.526 (17.235s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.526 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:59.709 (183ms) - - - > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:59.71 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.602 (6.893s) > Enter [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:06.602 < Exit [BeforeEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:31 @ 04/04/23 18:34:10.627 (4.025s) > Enter [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:10.627 < Exit [It] should exist a x-hello-world header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/plugins.go:35 @ 04/04/23 18:34:27.807 (17.179s) > Enter [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:27.807 < Exit [AfterEach] plugins - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:28.007 (200ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:28.007 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:35.896 (7.889s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:35.896 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:34:39.916 (4.02s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:34:39.916 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:34:57.039 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:35:05.187 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:35:05.197 (25.281s) > Enter [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:05.197 STEP: serving the default certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:204 @ 04/04/23 18:35:10.227 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:214 @ 04/04/23 18:35:10.293 < Exit [It] falls back to using default certificate when secret gets deleted without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:185 @ 04/04/23 18:35:10.293 (5.095s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.293 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:10.501 (209ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:10.502 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:17.387 (6.885s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:17.387 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:35:21.413 (4.026s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:21.413 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:35:42.607 (21.195s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.607 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:411 @ 04/04/23 18:35:42.616 (9ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.832 (216ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.832 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:49.737 (6.905s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:49.737 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:35:54.76 (5.023s) > Enter [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:35:54.76 < Exit [It] should use fastcgi_pass in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:37 @ 04/04/23 18:36:04.978 (10.218s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:04.978 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:05.161 (183ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.162 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:13.068 (7.906s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:13.068 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:36:17.096 (4.027s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:17.096 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:36:34.288 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:36:42.473 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:36:42.5 (25.405s) > Enter [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:42.5 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:163 @ 04/04/23 18:36:47.607 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:169 @ 04/04/23 18:36:50.731 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:180 @ 04/04/23 18:36:53.763 < Exit [It] picks up the updated certificate without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:149 @ 04/04/23 18:36:53.763 (11.263s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.763 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:53.98 (217ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:53.981 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:00.852 (6.872s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:00.852 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:37:13.899 (13.046s) > Enter [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:13.899 < Exit [It] log-format default escape - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:105 @ 04/04/23 18:37:27.067 (13.169s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.067 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:27.254 (186ms) - - - > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:27.254 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:35.134 (7.88s) > Enter [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:35.134 < Exit [BeforeEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:35 @ 04/04/23 18:37:39.153 (4.019s) > Enter [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:37:39.153 < Exit [It] should only compress responses that meet the `brotli-min-length` condition - /go/src/k8s.io/ingress-nginx/test/e2e/settings/brotli.go:39 @ 04/04/23 18:38:10.344 (31.191s) > Enter [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.344 < Exit [AfterEach] brotli - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:10.535 (191ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:10.535 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:17.414 (6.879s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:17.414 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:38:21.437 (4.023s) > Enter [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:21.437 < Exit [It] disable-http-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:53 @ 04/04/23 18:38:38.614 (17.177s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.614 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:38.835 (221ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:38.836 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:45.698 (6.862s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:45.698 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:38:49.734 (4.036s) > Enter [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:49.734 < Exit [It] set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:34 @ 04/04/23 18:38:59.959 (10.225s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:59.959 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:00.179 (220ms) - - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.179 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:08.619 (8.44s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:08.619 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:39:12.644 (4.025s) > Enter [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.644 [SKIPPED] GeoIP test are temporarily disabled In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:71 @ 04/04/23 18:39:12.645 < Exit [It] should only allow requests from specific countries - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:70 @ 04/04/23 18:39:12.645 (1ms) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.645 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:12.862 (217ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:12.863 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:19.76 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:19.76 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:23.829 (4.069s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:23.829 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:39:33.03 (9.2s) > Enter [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:33.03 < Exit [It] setting includeSubDomains parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:127 @ 04/04/23 18:39:43.259 (10.229s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.259 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:43.444 (186ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:43.445 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:50.328 (6.883s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:50.328 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:39:58.361 (8.034s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:39:58.361 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:40:08.534 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:40:18.725 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:40:28.928 (30.567s) > Enter [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:28.928 STEP: Adding a global-auth-response-headers to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:228 @ 04/04/23 18:40:28.928 < Exit [It] should add auth headers when global-auth-response-headers is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:223 @ 04/04/23 18:40:39.119 (10.19s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.119 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:39.335 (216ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.335 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:46.231 (6.896s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:46.231 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:40:48.266 (2.035s) > Enter [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:40:48.266 < Exit [It] should not set invalid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:52 @ 04/04/23 18:41:05.463 (17.198s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.463 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:05.678 (215ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:24.95 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:41:57.132 (32.182s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:41:57.132 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:05.196 (8.064s) > Enter [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:05.196 < Exit [It] should not return an error if the Ingress V1 definition is valid with IngressClass annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:180 @ 04/04/23 18:42:08.558 (3.362s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.558 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:08.881 (323ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:08.881 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:27.269 (18.388s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:27.269 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:35.33 (8.061s) > Enter [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.33 < Exit [It] should return an error if the Ingress V1 definition contains invalid annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:196 @ 04/04/23 18:42:35.482 (152ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.482 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:42:35.681 (199ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:35.681 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:42:54.33 (18.649s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 18:42:54.33 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 21:18:55.121 (10.056s) > Enter [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:55.121 < Exit [It] should not allow overlaps of host and paths without canary annotations - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:70 @ 04/04/23 21:18:58.366 (3.245s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.367 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:18:58.612 (246ms) - - - > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:18:58.613 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:05.487 (6.875s) > Enter [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:05.487 < Exit [BeforeEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:39 @ 04/04/23 21:19:09.523 (4.036s) > Enter [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:09.523 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:53 @ 04/04/23 21:19:19.701 < Exit [It] should return 200 when service has topology hints - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/topology.go:43 @ 04/04/23 21:19:19.839 (10.316s) > Enter [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:19.839 < Exit [AfterEach] [TopologyHints] topology aware routing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 21:19:20.061 (222ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 21:19:20.061 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:17:57.17 (30.737s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:17:57.17 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:18:05.234 (8.065s) > Enter [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:05.234 < Exit [It] should block ingress with invalid path - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:108 @ 04/04/23 22:18:08.53 (3.296s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.53 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:08.765 (235ms) - - - > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:08.766 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:22.642 (13.877s) > Enter [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:22.642 < Exit [BeforeEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:51 @ 04/04/23 22:18:48.76 (26.118s) > Enter [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:48.76 < Exit [It] should ingore Ingress of namespace without label foo=bar and accept those of namespace with label foo=bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:63 @ 04/04/23 22:18:55.044 (6.284s) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.044 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:18:55.29 (246ms) > Enter [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.29 < Exit [AfterEach] [Flag] watch namespace selector - /go/src/k8s.io/ingress-nginx/test/e2e/settings/namespace_selector.go:56 @ 04/04/23 22:18:55.293 (3ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:18:55.294 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:12.977 (17.683s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:12.977 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:21.048 (8.072s) > Enter [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.048 < Exit [It] should not return an error for an invalid Ingress when it has unknown class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:207 @ 04/04/23 22:19:21.18 (132ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.18 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:19:21.377 (197ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:21.377 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:19:52.511 (31.134s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:19:52.511 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:00.575 (8.064s) > Enter [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:00.575 STEP: rejects ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:52 @ 04/04/23 22:20:00.575 STEP: accepts ingress when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:57 @ 04/04/23 22:20:00.587 < Exit [It] reject ingress with global-rate-limit annotations when memcached is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:43 @ 04/04/23 22:20:10.885 (10.31s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:10.885 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:11.143 (257ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:11.143 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:29.584 (18.441s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:29.584 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:20:37.66 (8.076s) > Enter [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:37.66 < Exit [It] should return an error if there is an invalid value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:136 @ 04/04/23 22:20:44.7 (7.04s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.7 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:20:44.899 (199ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:20:44.899 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:03.976 (19.078s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:03.976 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:12.046 (8.07s) > Enter [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:12.046 < Exit [It] should return an error if there is a forbidden value in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:150 @ 04/04/23 22:21:19.079 (7.033s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.079 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:19.337 (258ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:19.337 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:37.731 (18.394s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:37.731 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:21:45.791 (8.06s) > Enter [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.791 < Exit [It] should return an error if there is an error validating the ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:125 @ 04/04/23 22:21:45.852 (61ms) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:45.852 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:21:46.057 (205ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:21:46.057 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:04.907 (18.85s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:04.907 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:12.968 (8.061s) > Enter [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:12.968 < Exit [It] should not return an error if the Ingress V1 definition is valid with Ingress Class - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:164 @ 04/04/23 22:22:18.358 (5.39s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.358 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:18.592 (234ms) - - - > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:18.592 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 22:22:47.015 (28.422s) > Enter [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:47.015 < Exit [BeforeEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:38 @ 04/04/23 22:22:55.073 (8.059s) > Enter [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:55.073 < Exit [It] should allow overlaps of host and paths with canary annotation - /go/src/k8s.io/ingress-nginx/test/e2e/admission/admission.go:87 @ 04/04/23 22:22:58.439 (3.366s) > Enter [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.439 < Exit [AfterEach] [Admission] admission controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 22:22:58.64 (201ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.251 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.76 (7.509s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:26.76 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:04:38.808 (12.048s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:04:38.808 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:04:55.931 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:05:04.12 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:05:04.15 (25.342s) > Enter [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.15 < Exit [It] supports requests with domain with trailing dot - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:145 @ 04/04/23 18:05:04.174 (24ms) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.174 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.407 (234ms) - - - > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.408 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.385 (6.978s) > Enter [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:11.385 < Exit [BeforeEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:30 @ 04/04/23 18:05:15.42 (4.034s) > Enter [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:15.42 < Exit [It] should allow preservation of trailing slashes - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/preservetrailingslash.go:34 @ 04/04/23 18:05:22.428 (7.008s) > Enter [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.428 < Exit [AfterEach] [Annotations] preserve-trailing-slash - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:22.626 (198ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:22.626 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:29.568 (6.942s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:29.568 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:05:33.606 (4.037s) > Enter [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:33.606 < Exit [It] should set valid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:115 @ 04/04/23 18:05:43.732 (10.127s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.732 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:43.917 (184ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:43.917 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:51.802 (7.885s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:51.802 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:05:55.831 (4.029s) > Enter [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:05:55.831 < Exit [It] should exist a proxy_host using the upstream-vhost annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:57 @ 04/04/23 18:06:05.978 (10.147s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:05.978 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:06.188 (210ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:06.189 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:14.133 (7.945s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:14.133 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:06:18.165 (4.031s) > Enter [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:18.165 < Exit [It] should not exists Server header in the response - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:38 @ 04/04/23 18:06:35.378 (17.213s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.378 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:35.637 (259ms) - - - > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:35.637 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:42.521 (6.884s) > Enter [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:42.521 < Exit [BeforeEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:32 @ 04/04/23 18:06:46.54 (4.019s) > Enter [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:06:46.54 < Exit [It] Check limit-rate config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/limit_rate.go:36 @ 04/04/23 18:07:17.039 (30.499s) > Enter [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.039 < Exit [AfterEach] [Setting] Configmap - limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:17.22 (180ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:17.22 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:24.225 (7.005s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:24.225 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:07:26.256 (2.031s) > Enter [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:26.256 < Exit [It] does not set the path to / on the generated cookie if there's more than one rule referring to the same backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:121 @ 04/04/23 18:07:36.45 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.45 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:36.633 (183ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:36.633 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:43.537 (6.903s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:43.537 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:51.596 (8.059s) > Enter [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:07:51.596 < Exit [It] should response with a 200 status from the mainline upstream when requests are made to the mainline ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:48 @ 04/04/23 18:08:08.813 (17.217s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:08.813 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:09.063 (249ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:09.063 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:16.959 (7.896s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:16.959 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:08:25.017 (8.058s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:08:25.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:08:35.191 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:08:45.372 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:08:55.507 (30.491s) > Enter [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:08:55.507 STEP: Adding a global-auth-cache-key to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:163 @ 04/04/23 18:08:55.507 < Exit [It] should still return status code 200 after auth backend is deleted using cache - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:155 @ 04/04/23 18:09:12.69 (17.183s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.69 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:12.914 (224ms) - - - > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:12.915 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:19.799 (6.884s) > Enter [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:19.799 < Exit [BeforeEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:30 @ 04/04/23 18:09:23.825 (4.026s) > Enter [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:23.825 < Exit [It] should drop whole ingress if one path matches invalid regex - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/deep_inspection.go:34 @ 04/04/23 18:09:41.065 (17.24s) > Enter [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.065 < Exit [AfterEach] [Ingress] DeepInspection - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:41.299 (233ms) - - - > Enter [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:41.299 < Exit [BeforeEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:49.196 (7.896s) > Enter [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:09:49.196 < Exit [It] configures lua shared dicts - /go/src/k8s.io/ingress-nginx/test/e2e/settings/lua_shared_dicts.go:29 @ 04/04/23 18:10:01.416 (12.22s) > Enter [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.416 < Exit [AfterEach] [Setting] [Lua] lua-shared-dicts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:01.602 (187ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:01.603 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:08.48 (6.877s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:08.48 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:10:12.502 (4.022s) > Enter [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:12.502 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:69 @ 04/04/23 18:10:12.502 STEP: making a request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:78 @ 04/04/23 18:10:22.752 STEP: creating an ingress definition with the rewrite-target annotation set on the "/" location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:88 @ 04/04/23 18:10:22.759 STEP: making a second request to the non-rewritten location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:102 @ 04/04/23 18:10:32.852 < Exit [It] should use correct longest path match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:66 @ 04/04/23 18:10:32.86 (20.358s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:32.86 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:33.04 (180ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:33.04 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:40.925 (7.885s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:40.925 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:10:44.945 (4.02s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:44.945 Apr 4 18:10:54.109: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:10:56.109 (11.164s) > Enter [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:10:56.109 < Exit [It] setting max-age parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:111 @ 04/04/23 18:11:06.315 (10.206s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.315 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:06.527 (212ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:06.528 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:13.431 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:13.431 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:11:21.479 (8.048s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:21.479 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:11:49.732 (28.253s) > Enter [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:49.732 < Exit [It] user with global-auth-always-set-cookie key in configmap retains cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:348 @ 04/04/23 18:11:56.743 (7.011s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.743 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:56.926 (183ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.926 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:03.815 (6.889s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:03.815 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:12:11.862 (8.047s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:11.862 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:12:40.103 (28.241s) > Enter [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.103 < Exit [It] user retains cookie by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:326 @ 04/04/23 18:12:40.112 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.112 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:40.334 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:40.335 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.184 (6.849s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.184 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.214 (4.031s) > Enter [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:51.214 < Exit [It] should not allow - portless origin with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:515 @ 04/04/23 18:12:58.232 (7.018s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.232 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:58.436 (203ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.436 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:05.332 (6.896s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:05.332 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:09.361 (4.029s) > Enter [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:09.361 < Exit [It] should return status code 200 when authentication is configured with a map and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:199 @ 04/04/23 18:13:21.468 (12.107s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.468 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.639 (171ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.639 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.514 (7.875s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:29.514 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:13:33.537 (4.023s) > Enter [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:33.537 < Exit [It] should pass URL-encoded certificate to upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:161 @ 04/04/23 18:13:47.331 (13.794s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.331 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:47.532 (202ms) - - - > Enter [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:47.533 < Exit [BeforeEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:54.43 (6.897s) > Enter [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:13:54.43 < Exit [It] uses custom default backend that returns 200 as status code - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/custom_default_backend.go:36 @ 04/04/23 18:14:10.603 (16.173s) > Enter [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.603 < Exit [AfterEach] [Default Backend] custom service - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.797 (195ms) - - - > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.798 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.742 (6.944s) > Enter [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:17.742 < Exit [BeforeEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:30 @ 04/04/23 18:14:21.766 (4.024s) > Enter [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:21.766 < Exit [It] should set valid ip whitelist range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipwhitelist.go:34 @ 04/04/23 18:14:31.914 (10.148s) > Enter [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:31.914 < Exit [AfterEach] [Annotations] whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.125 (211ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.125 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.045 (7.92s) > Enter [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:40.045 < Exit [It] should return 200 for service type=ExternalName using a port name - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:184 @ 04/04/23 18:14:50.345 (10.299s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.345 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.661 (317ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.662 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.86 (7.198s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:57.86 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:15:01.901 (4.041s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:01.901 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:15:16.075 (14.174s) > Enter [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:16.075 < Exit [It] should not create additional upstream block when auth-keepalive is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:552 @ 04/04/23 18:15:39.289 (23.214s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.289 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:39.523 (234ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:39.523 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:46.413 (6.89s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:46.413 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:05.358 (18.945s) > Enter [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:05.358 < Exit [It] should return status code 401 when accessing '/' unauthentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:54 @ 04/04/23 18:16:08.518 (3.16s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.518 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:08.699 (180ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:08.699 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:15.641 (6.942s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:15.641 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:16:26.725 (11.084s) > Enter [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:16:26.725 < Exit [It] should enable PROXY Protocol for HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:112 @ 04/04/23 18:17:59.041 (1m32.316s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.041 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:59.27 (229ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:59.27 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.156 (7.885s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:07.156 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:19.212 (12.057s) > Enter [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:19.212 < Exit [It] should ignore catch all Ingress with backend - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:50 @ 04/04/23 18:18:39.618 (20.406s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.618 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:39.83 (212ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.831 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.716 (6.885s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:46.716 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:50.744 (4.028s) > Enter [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:18:50.744 < Exit [It] should allow headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:137 @ 04/04/23 18:19:00.902 (10.159s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:00.902 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:01.091 (189ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:01.092 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:09.007 (7.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:09.007 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:19:17.081 (8.074s) > Enter [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:17.081 < Exit [It] should return 404 status for requests to the canary if no matching ingress is found - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:80 @ 04/04/23 18:19:24.105 (7.024s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:24.388 (283ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:24.389 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.748 (2m19.359s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:43.748 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:21:57.954 (14.206s) > Enter [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:21:57.954 < Exit [It] handles endpoints only changes (down scaling of replicas) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:87 @ 04/04/23 18:22:20.304 (22.351s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.304 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:20.502 (198ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:20.503 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:27.369 (6.866s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:27.369 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:31.399 (4.03s) > Enter [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:31.399 < Exit [It] should not set proxy client-max-body-size to incorrect value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:100 @ 04/04/23 18:22:41.545 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.545 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:41.748 (203ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.748 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:58.304 (2m16.556s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:24:58.304 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:25:07.351 (9.047s) > Enter [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:07.351 < Exit [It] reuse port should be disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:44 @ 04/04/23 18:25:17.463 (10.112s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.463 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:17.721 (257ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:17.721 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36 (2m18.279s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:40.022 (4.023s) > Enter [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:40.022 < Exit [It] should set snippet "proxy_set_header My-Custom-Header 42;" when external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:266 @ 04/04/23 18:27:50.223 (10.201s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.224 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:50.413 (190ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.414 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.312 (13.898s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:04.312 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:28:11.43 (7.118s) > Enter [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:11.43 Apr 4 18:28:24.664: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not forwarded-headers < Exit [It] should set the X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:100 @ 04/04/23 18:28:29.799 (18.368s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:29.799 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:30.029 (230ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:30.03 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:36.888 (6.859s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:36.888 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:28:40.919 (4.03s) > Enter [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:40.919 < Exit [It] set snippet "more_set_headers "Foo1: Bar1";" in all locations" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:35 @ 04/04/23 18:28:51.095 (10.176s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.095 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:51.273 (178ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:51.273 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:59.672 (8.399s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:28:59.672 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:07.713 (8.041s) > Enter [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:07.713 STEP: routing requests destined for the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:351 @ 04/04/23 18:29:32.166 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:360 @ 04/04/23 18:29:32.169 < Exit [It] should route requests to the correct upstream if the canary ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:307 @ 04/04/23 18:29:32.172 (24.459s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.172 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:32.356 (184ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:32.356 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:39.249 (6.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:39.249 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:29:43.271 (4.022s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:43.271 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:57.423 (14.152s) > Enter [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:29:57.423 < Exit [It] should not create additional upstream block when auth-keepalive is negative - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:590 @ 04/04/23 18:30:20.684 (23.26s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.684 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:20.873 (189ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:20.873 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:27.823 (6.95s) > Enter [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:27.823 < Exit [It] should create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:53 @ 04/04/23 18:30:49.071 (21.248s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.071 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:49.267 (196ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:49.267 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:56.179 (6.912s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:30:56.179 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:31:00.207 (4.028s) > Enter [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:00.207 < Exit [It] should set client_body_buffer_size to 1K - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:57 @ 04/04/23 18:31:10.334 (10.127s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.334 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:10.562 (228ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:10.562 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:17.468 (6.905s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:17.468 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:21.488 (4.02s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:21.488 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:31:35.745 (14.257s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:35.745 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:505 @ 04/04/23 18:31:46.949 (11.204s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:46.949 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:47.158 (209ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:47.158 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.054 (7.895s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:55.054 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:31:59.086 (4.032s) > Enter [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:31:59.086 < Exit [It] should allow origin for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:110 @ 04/04/23 18:32:06.117 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.117 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:06.335 (217ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:06.335 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:13.216 (6.881s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:13.216 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:32:30.126 (16.91s) > Enter [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:30.126 < Exit [It] should return status code 200 when accessing '/' authentication - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:68 @ 04/04/23 18:32:34.111 (3.985s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.111 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:34.285 (174ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:34.285 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.164 (7.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:42.164 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:32:46.19 (4.026s) > Enter [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:46.19 < Exit [It] should not allow - single origin without port and origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:405 @ 04/04/23 18:32:53.221 (7.031s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.221 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:53.428 (207ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:53.428 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.295 (6.867s) > Enter [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:00.295 < Exit [It] should set gzip_min_length to 100 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:78 @ 04/04/23 18:33:17.519 (17.224s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.519 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:17.698 (178ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:17.698 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:24.578 (6.881s) > Enter [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:24.578 < Exit [It] should have worker_rlimit_nofile option and be independent on amount of worker processes - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:38 @ 04/04/23 18:33:34.73 (10.152s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.73 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:34.905 (175ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:34.906 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:44.808 (9.902s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:44.808 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:33:55.842 (11.034s) > Enter [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:33:55.842 < Exit [It] should set keepalive time to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:77 @ 04/04/23 18:34:05.994 (10.152s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:05.994 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.258 (264ms) - - - - - - > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.259 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:14.168 (7.909s) > Enter [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:14.168 < Exit [BeforeEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:35 @ 04/04/23 18:34:25.207 (11.04s) > Enter [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:25.207 < Exit [It] should shutdown in less than 60 secons without pending connections - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/shutdown.go:40 @ 04/04/23 18:34:36.4 (11.193s) > Enter [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.4 < Exit [AfterEach] [Shutdown] ingress controller - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.599 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:36.6 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:44.48 (7.88s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.48 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:48.503 (4.024s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:34:48.503 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:35:02.728 (14.224s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.728 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:678 @ 04/04/23 18:35:02.742 (15ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.742 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:02.951 (209ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:02.951 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:09.829 (6.877s) > Enter [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:09.829 < Exit [It] should sync ingress on external name service addition/deletion - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:311 @ 04/04/23 18:35:30.35 (20.521s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.35 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:30.552 (202ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:30.552 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:37.481 (6.929s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:37.481 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:35:48.587 (11.106s) > Enter [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:35:48.587 < Exit [It] should pass unknown traffic to default backend and handle known traffic - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:79 @ 04/04/23 18:36:17.402 (28.814s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.402 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:17.602 (201ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.603 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:24.47 (6.867s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:24.47 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:36:35.523 (11.052s) > Enter [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:35.523 < Exit [It] should enable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:47 @ 04/04/23 18:36:45.69 (10.167s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.69 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:45.908 (218ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.908 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.807 (6.899s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:52.807 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:36:56.83 (4.024s) > Enter [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:36:56.83 < Exit [It] should 302 redirect to error page instead of 400 when auth-tls-error-page is set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:114 @ 04/04/23 18:37:10.803 (13.972s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.803 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.971 (169ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.972 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.855 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:17.855 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:37:21.879 (4.023s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:21.879 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:383 @ 04/04/23 18:37:43.087 (21.209s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.087 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:422 @ 04/04/23 18:37:43.095 (8ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.095 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:43.321 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:43.321 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:50.242 (6.92s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:50.242 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:58.297 (8.055s) > Enter [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:37:58.297 < Exit [It] should not use canary as a catch-all server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:863 @ 04/04/23 18:38:15.503 (17.206s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.503 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.723 (220ms) - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.724 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:22.643 (6.92s) > Enter [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:22.643 STEP: basic HTTP GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.644 STEP: basic HTTP GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.657 STEP: basic HTTPS GET request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.667 STEP: basic HTTPS GET request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.695 STEP: basic HTTP POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.708 STEP: basic HTTP POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:27.712 STEP: basic HTTPS POST request without host to path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.052 STEP: basic HTTPS POST request without host to path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.468 STEP: basic HTTP GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:28.852 STEP: basic HTTP GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.25 STEP: basic HTTPS GET request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:29.647 STEP: basic HTTPS GET request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.07 STEP: basic HTTP POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.469 STEP: basic HTTP POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:30.847 STEP: basic HTTPS POST request to host foo.bar.com and path / should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.252 STEP: basic HTTPS POST request to host foo.bar.com and path /demo should return 404 - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:66 @ 04/04/23 18:38:31.65 < Exit [It] should return 404 sending requests when only a default backend is running - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:33 @ 04/04/23 18:38:32.067 (9.424s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.067 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:32.276 (208ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:32.276 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:40.184 (7.908s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:40.184 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:38:48.25 (8.066s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:38:48.25 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:38:58.421 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:39:08.584 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:39:18.813 (30.563s) > Enter [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:18.813 STEP: Adding a no-auth-locations for /bar to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:104 @ 04/04/23 18:39:18.813 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:111 @ 04/04/23 18:39:29.026 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:118 @ 04/04/23 18:39:29.042 < Exit [It] should return status code 200 when request whitelisted (via no-auth-locations) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:102 @ 04/04/23 18:39:29.049 (10.236s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.049 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:29.257 (208ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.257 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:37.143 (7.885s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:37.143 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:39:39.168 (2.025s) > Enter [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:39.168 < Exit [It] should return status code 200 for hosts defined in two ingresses, different path with one alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:87 @ 04/04/23 18:39:56.292 (17.124s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.292 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:56.478 (186ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:56.478 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.36 (6.881s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:03.36 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:40:14.407 (11.047s) > Enter [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:14.407 < Exit [It] should set keepalive_timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:40 @ 04/04/23 18:40:24.598 (10.191s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.598 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:24.819 (221ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:24.819 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.201 (14.382s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:39.201 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:40:46.467 (7.266s) > Enter [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:46.467 < Exit [It] should set X-Forwarded-Port headers accordingly when listening on a non-default HTTP port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:48 @ 04/04/23 18:40:56.662 (10.195s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.662 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.852 (191ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.258 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.76 (8.502s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:27.76 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:04:39.782 (12.022s) > Enter [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:39.782 < Exit [It] should set backend protocol to grpc:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:64 @ 04/04/23 18:04:49.993 (10.211s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.993 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:50.223 (229ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:50.223 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:58.145 (7.922s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:04:58.145 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:05:02.17 (4.025s) > Enter [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:02.17 < Exit [It] should enable modsecurity without using 'modsecurity on;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:110 @ 04/04/23 18:05:19.394 (17.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.394 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:19.624 (230ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:19.625 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:26.544 (6.92s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:26.544 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:05:30.589 (4.045s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:30.589 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:05:58.841 (28.251s) > Enter [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:05:58.841 < Exit [It] should create additional upstream block when auth-keepalive is set with HTTP/1.x - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:623 @ 04/04/23 18:06:22.065 (23.224s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.065 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:22.266 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:22.267 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:29.196 (6.929s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:29.196 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:06:40.24 (11.044s) > Enter [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:40.24 < Exit [It] should block User-Agents defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:55 @ 04/04/23 18:06:50.425 (10.185s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.425 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.601 (177ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.602 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.545 (6.943s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:06:57.545 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:07:01.588 (4.043s) > Enter [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:01.588 < Exit [It] should set the X-Forwarded-Prefix to the annotation value - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:35 @ 04/04/23 18:07:11.685 (10.097s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.685 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.883 (198ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.883 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:18.774 (6.89s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:18.774 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:07:22.815 (4.041s) > Enter [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:22.815 < Exit [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:535 @ 04/04/23 18:07:29.864 (7.049s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:29.864 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:30.072 (208ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:30.072 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:48.992 (2m18.92s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:48.992 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:09:53.047 (4.055s) > Enter [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:09:53.047 < Exit [It] should set mirror-target to http://localhost/mirror - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:36 @ 04/04/23 18:10:03.229 (10.182s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.229 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.446 (217ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.446 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:10.362 (6.916s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:10.362 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:10:14.4 (4.038s) > Enter [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:14.4 < Exit [It] should return status code 200 when no authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:46 @ 04/04/23 18:10:24.616 (10.216s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.616 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:24.82 (204ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:24.821 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:31.7 (6.879s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:31.7 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:10:42.759 (11.059s) > Enter [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:10:42.759 < Exit [It] should respect port passed by the PROXY Protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:46 @ 04/04/23 18:12:14.993 (1m32.235s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:14.993 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:15.384 (390ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:15.384 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:22.265 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:22.265 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:12:24.285 (2.02s) > Enter [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:24.285 < Exit [It] should return status code 503 when authentication is configured with an invalid secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:65 @ 04/04/23 18:12:34.441 (10.156s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.441 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:34.624 (183ms) - - - > Enter [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:34.624 < Exit [BeforeEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:41.556 (6.931s) > Enter [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:12:41.556 < Exit [It] Check no tls redirect locations config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_tls_redirect_locations.go:31 @ 04/04/23 18:13:01.842 (20.286s) > Enter [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.842 < Exit [AfterEach] [Setting] Add no tls redirect locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:02.025 (183ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.025 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:09.923 (7.898s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:09.923 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:13:13.962 (4.038s) > Enter [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:13.962 < Exit [It] should not allow - single origin with port and origin without port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:386 @ 04/04/23 18:13:20.977 (7.016s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:20.977 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:21.159 (181ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:21.159 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:29.044 (7.885s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:29.044 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:40.088 (11.044s) > Enter [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:40.088 < Exit [It] should disable the log-format-escape-json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:55 @ 04/04/23 18:13:50.23 (10.141s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.23 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:50.426 (197ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:50.427 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.36 (6.933s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:13:57.36 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:14:01.385 (4.026s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:01.385 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:06.428 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:16.618 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:14:26.768 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:14:36.897 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:14:52.087 (50.702s) > Enter [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:14:52.087 STEP: logging into server thisHost /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:821 @ 04/04/23 18:14:52.087 STEP: receiving an internal server error without cache on thisHost location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:833 @ 04/04/23 18:14:59.113 < Exit [It] should deny login for different servers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:820 @ 04/04/23 18:15:59.128 (1m7.041s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.128 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.362 (234ms) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.363 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.334 (6.971s) > Enter [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:06.334 < Exit [It] should set ingress details variables for ingresses with host without IngressRuleValue, only Backend - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:55 @ 04/04/23 18:16:20.803 (14.469s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.803 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:21.76 (957ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:21.77 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.035 (9.266s) > Enter [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:31.035 STEP: setting permanent-redirect annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:34 @ 04/04/23 18:16:31.036 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:52 @ 04/04/23 18:16:41.175 < Exit [It] should respond with a standard redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:33 @ 04/04/23 18:16:41.182 (10.147s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.182 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.409 (227ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.409 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:57.856 (2m16.447s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:18:57.856 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:19:09.919 (12.063s) > Enter [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:09.919 < Exit [It] should allow Ingress with rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:123 @ 04/04/23 18:19:20.272 (10.353s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.272 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:20.675 (403ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:20.677 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.892 (8.215s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:28.892 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:19:32.924 (4.032s) > Enter [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:32.924 < Exit [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:324 @ 04/04/23 18:19:43.863 (10.939s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:43.863 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:44.064 (200ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:44.064 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.434 (9.37s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:53.434 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:19:55.451 (2.017s) > Enter [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:19:55.451 < Exit [It] should exists opentelemetry directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:60 @ 04/04/23 18:20:12.863 (17.412s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.863 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.699 (836ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:20:13.699 (0s) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.7 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:22.723 (9.023s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:22.723 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:26.762 (4.038s) > Enter [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:26.762 < Exit [It] should not set invalid proxy timeouts - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:136 @ 04/04/23 18:20:36.907 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:36.907 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:37.137 (230ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:37.137 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:45.044 (7.907s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:45.044 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:20:49.07 (4.026s) > Enter [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:20:49.07 < Exit [It] should not exists opentelemetry directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:47 @ 04/04/23 18:21:06.287 (17.217s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.287 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:06.513 (226ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:21:06.513 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:06.513 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:13.397 (6.884s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:13.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:15.42 (2.023s) > Enter [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:15.42 < Exit [It] should return status code 401 and cors headers when authentication and cors is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:144 @ 04/04/23 18:21:26.454 (11.034s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.454 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.651 (198ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.652 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:33.515 (6.863s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:33.515 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:80 @ 04/04/23 18:21:43.707 (10.192s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.707 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:43.924 (216ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:43.924 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:50.816 (6.892s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:50.816 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:21:54.851 (4.035s) > Enter [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:21:54.851 < Exit [It] should allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:169 @ 04/04/23 18:22:01.873 (7.022s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:01.873 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:02.061 (188ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:02.061 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:09.943 (7.882s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:09.943 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:20.994 (11.051s) > Enter [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:20.994 < Exit [It] log-format-escape-json enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:82 @ 04/04/23 18:22:34.191 (13.197s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.191 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:34.407 (216ms) - - - > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:34.407 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:41.334 (6.927s) > Enter [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:41.334 < Exit [BeforeEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:33 @ 04/04/23 18:22:45.355 (4.021s) > Enter [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:22:45.355 STEP: Checking exact request to / - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:63 @ 04/04/23 18:23:02.535 STEP: Checking prefix request to /bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:76 @ 04/04/23 18:23:02.543 STEP: Checking exact request to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:109 @ 04/04/23 18:23:19.72 STEP: Checking prefix request to /foo/bar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:122 @ 04/04/23 18:23:19.723 STEP: Checking prefix request to /foobar - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:134 @ 04/04/23 18:23:19.724 < Exit [It] should choose the correct location - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_mixed.go:39 @ 04/04/23 18:23:19.726 (34.371s) > Enter [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.726 < Exit [AfterEach] [Ingress] [PathType] mix Exact and Prefix paths - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:19.917 (190ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:19.917 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:27.858 (7.94s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:27.858 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:23:31.884 (4.027s) > Enter [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:31.884 < Exit [It] should set client_body_buffer_size to 1m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:101 @ 04/04/23 18:23:42.035 (10.15s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.035 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:42.253 (218ms) - - - > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:42.254 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.152 (7.898s) > Enter [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:50.152 < Exit [BeforeEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:35 @ 04/04/23 18:23:59.193 (9.041s) > Enter [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:23:59.193 < Exit [It] should not trust X-Forwarded headers when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/forwarded_headers.go:92 @ 04/04/23 18:24:16.594 (17.4s) > Enter [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.594 < Exit [AfterEach] [Setting] use-forwarded-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.994 (401ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:16.995 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.428 (8.433s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:25.428 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:33.475 (8.047s) > Enter [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:24:33.475 < Exit [It] should route requests split between mainline and canary if canary weight is 100 and weight total is 200 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:834 @ 04/04/23 18:25:28.827 (55.352s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:28.827 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:29.073 (245ms) - - - > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:29.073 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:35.955 (6.882s) > Enter [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:35.955 < Exit [BeforeEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:30 @ 04/04/23 18:25:39.976 (4.021s) > Enter [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:39.976 < Exit [It] enable the http2-push-preload directive - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/http2pushpreload.go:34 @ 04/04/23 18:25:50.116 (10.14s) > Enter [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.116 < Exit [AfterEach] [Annotations] http2-push-preload - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:50.35 (233ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:50.35 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:57.262 (6.911s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:25:57.262 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:26:08.325 (11.063s) > Enter [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:08.325 STEP: ensuring single values are parsed correctly - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:54 @ 04/04/23 18:26:25.541 < Exit [It] trusts X-Forwarded-For header only when setting is true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:40 @ 04/04/23 18:26:25.551 (17.226s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.551 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:25.758 (207ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:25.758 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:32.641 (6.883s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:32.641 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:36.668 (4.026s) > Enter [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:36.668 < Exit [It] should disable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:74 @ 04/04/23 18:26:46.879 (10.212s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:46.879 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.059 (180ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.06 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:53.958 (6.898s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:53.958 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:26:57.986 (4.028s) > Enter [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:26:57.986 < Exit [It] should enable modsecurity through the config map but ignore snippet as disabled by admin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:305 @ 04/04/23 18:27:27.257 (29.271s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.257 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:27.443 (186ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:27.443 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:34.37 (6.927s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:34.37 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:27:38.399 (4.029s) > Enter [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:27:38.399 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:115 @ 04/04/23 18:27:55.604 STEP: sending request from an implicitly denied IP - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:123 @ 04/04/23 18:27:55.61 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:131 @ 04/04/23 18:27:55.616 STEP: sending request from an explicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:139 @ 04/04/23 18:27:55.623 < Exit [It] only allow explicitly allowed IPs, deny all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:86 @ 04/04/23 18:28:02.653 (24.254s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.653 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:02.902 (249ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:02.903 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:09.803 (6.9s) > Enter [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:09.803 < Exit [It] should be disabled when set to false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:49 @ 04/04/23 18:28:20.04 (10.238s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.041 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:20.276 (236ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:20.277 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:28.169 (7.892s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:28.169 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:28:30.185 (2.016s) > Enter [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:30.185 < Exit [It] should set backend protocol to grpcs:// and use grpc_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:79 @ 04/04/23 18:28:40.334 (10.15s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.334 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:40.52 (185ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:40.52 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:47.397 (6.877s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:47.397 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:28:51.425 (4.028s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:28:51.425 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:29:05.527 (14.103s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.527 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:494 @ 04/04/23 18:29:05.539 (12ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.539 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:05.766 (227ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:05.767 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:12.664 (6.897s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:12.664 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:29:16.693 (4.029s) > Enter [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:16.693 < Exit [It] should set valid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:36 @ 04/04/23 18:29:33.899 (17.207s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:33.899 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:34.123 (224ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:34.124 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:42.012 (7.888s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:42.012 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:46.039 (4.027s) > Enter [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:46.039 < Exit [It] should enable modsecurity with transaction ID and OWASP rules - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:53 @ 04/04/23 18:29:56.186 (10.147s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.186 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:56.375 (189ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.375 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:03.267 (6.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:03.267 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:30:07.298 (4.031s) > Enter [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:07.298 < Exit [It] should change the default proxy HTTP version - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:233 @ 04/04/23 18:30:17.47 (10.172s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.47 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.686 (215ms) - - - > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.686 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.008 (2m17.322s) > Enter [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:35.008 < Exit [BeforeEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:36 @ 04/04/23 18:32:39.033 (4.025s) > Enter [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:39.033 < Exit [It] should return the fake SSL certificate if the secret is invalid - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/secret_update.go:82 @ 04/04/23 18:32:52.207 (13.174s) > Enter [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.207 < Exit [AfterEach] [SSL] secret update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:52.41 (203ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:52.41 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:59.312 (6.902s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:32:59.312 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:33:03.343 (4.031s) > Enter [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:03.343 < Exit [It] should set client_body_buffer_size to 1000 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:35 @ 04/04/23 18:33:13.571 (10.227s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.571 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:13.79 (220ms) - - - > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:13.791 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:20.666 (6.876s) > Enter [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:20.666 < Exit [BeforeEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:45 @ 04/04/23 18:33:24.686 (4.02s) > Enter [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:33:24.686 STEP: running cfssl gencert -initca ca_csr.json | cfssljson -bare ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:31.697 STEP: running cfssl gencert -ca ca.pem -ca-key ca-key.pem -config=cfssl_config.json -profile=intermediate intermediate_ca_csr.json | cfssljson -bare intermediate_ca - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.042 STEP: running cfssl gencert -ca intermediate_ca.pem -ca-key intermediate_ca-key.pem -config=cfssl_config.json -profile=ocsp ocsp_csr.json | cfssljson -bare ocsp - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:216 @ 04/04/23 18:33:32.211 STEP: running cfssl serve -db-config=db-config.json -ca-key=intermediate_ca-key.pem -ca=intermediate_ca.pem -config=cfssl_config.json -responder=ocsp.pem -responder-key=ocsp-key.pem - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:228 @ 04/04/23 18:33:32.385 STEP: running cfssl gencert -remote=localhost -profile=server leaf_csr.json | cfssljson -bare leaf - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:238 @ 04/04/23 18:33:37.385 STEP: running cfssl ocsprefresh -ca intermediate_ca.pem -responder=ocsp.pem -responder-key=ocsp-key.pem -db-config=db-config.json - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:252 @ 04/04/23 18:33:37.548 < Exit [It] should enable OCSP and contain stapling information in the connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ocsp/ocsp.go:49 @ 04/04/23 18:34:06.016 (41.33s) > Enter [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.016 < Exit [AfterEach] [Setting] OCSP - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:06.329 (312ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:06.329 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:13.238 (6.909s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:13.238 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:34:17.265 (4.027s) > Enter [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:17.265 < Exit [It] should allow multiple auth with satisfy any - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:84 @ 04/04/23 18:34:33.244 (15.979s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.244 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:33.413 (169ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:33.413 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:40.3 (6.887s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:40.3 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:34:44.318 (4.018s) > Enter [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:44.318 < Exit [It] should not set snippet "proxy_set_header My-Custom-Header 42;" when external auth is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:284 @ 04/04/23 18:34:54.489 (10.171s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.489 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:54.674 (185ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:54.674 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:01.542 (6.868s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:01.542 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:35:15.829 (14.287s) > Enter [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:15.829 < Exit [It] handles endpoints only changes consistently (down scaling of replicas vs. empty service) - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:125 @ 04/04/23 18:35:42.1 (26.271s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.1 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:42.298 (198ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:42.298 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:50.176 (7.878s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:50.176 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:35:54.197 (4.021s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:35:54.197 Apr 4 18:36:03.338: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:36:05.327 (11.13s) > Enter [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:05.327 < Exit [It] setting preload parameter - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:146 @ 04/04/23 18:36:15.512 (10.185s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.512 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:15.744 (233ms) - - - > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:15.745 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:23.617 (7.872s) > Enter [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:23.617 < Exit [BeforeEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:34 @ 04/04/23 18:36:27.64 (4.023s) > Enter [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:27.64 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:48 @ 04/04/23 18:36:37.807 < Exit [It] should return 200 when service name has max allowed number of characters 63 - /go/src/k8s.io/ingress-nginx/test/e2e/endpointslices/longname.go:38 @ 04/04/23 18:36:37.815 (10.175s) > Enter [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:37.815 < Exit [AfterEach] [Endpointslices] long service name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:38.05 (235ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:38.05 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:45.936 (7.886s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:45.936 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:36:47.961 (2.026s) > Enter [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:47.961 < Exit [It] should add fastcgi_index in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:54 @ 04/04/23 18:36:58.079 (10.118s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.079 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:58.306 (226ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:58.306 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:16.416 (2m18.11s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:16.416 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:39:20.463 (4.047s) > Enter [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:20.463 < Exit [It] should enable modsecurity globally and with modsecurity-snippet block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:189 @ 04/04/23 18:39:49.668 (29.205s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.668 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:49.888 (220ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:49.888 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:57.8 (7.912s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:39:57.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:40:01.823 (4.023s) > Enter [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:01.823 Apr 4 18:40:10.971: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:187 @ 04/04/23 18:40:12.979 (11.155s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:12.979 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:13.188 (209ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:13.188 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:21.087 (7.899s) > Enter [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:21.087 < Exit [It] should return 200 for service type=ExternalName with a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:129 @ 04/04/23 18:40:31.585 (10.498s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.585 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.773 (188ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.773 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:38.672 (6.898s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:38.672 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:40:42.706 (4.034s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:42.706 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:40:56.901 (14.195s) > Enter [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.901 < Exit [It] should redirect to signin url when not signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:687 @ 04/04/23 18:40:56.912 (10ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:56.912 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.097 (186ms) - - - I0404 18:04:54.427675 25 request.go:690] Waited for 1.19834838s due to client-side throttling, not priority and fairness, request: GET:https://10.96.0.1:443/api/v1/namespaces/e2e-tests-limit-connections-1680631459257336272-jn44f/services/nginx-ingress-controller - > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.817 (7.56s) > Enter [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:26.817 < Exit [BeforeEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:34 @ 04/04/23 18:04:38.845 (12.028s) > Enter [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:04:38.845 < Exit [It] should limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitconnections.go:38 @ 04/04/23 18:05:03.259 (24.414s) > Enter [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.259 < Exit [AfterEach] [Annotations] Annotation - limit-connections - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:03.482 (224ms) - - - > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:03.483 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:10.366 (6.883s) > Enter [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:10.366 < Exit [BeforeEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:33 @ 04/04/23 18:05:14.405 (4.039s) > Enter [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:14.405 < Exit [It] should choose exact location for /exact - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_exact.go:37 @ 04/04/23 18:05:41.807 (27.402s) > Enter [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:41.807 < Exit [AfterEach] [Ingress] [PathType] exact - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:42.078 (271ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:42.079 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:50.08 (8.002s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:50.08 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:05:54.108 (4.028s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:05:54.108 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is an invalid character in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:36 @ 04/04/23 18:06:21.53 (27.422s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.53 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.804 (274ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.804 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.705 (6.901s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:28.705 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:06:32.732 (4.027s) > Enter [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:32.732 < Exit [It] should not break functionality - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:267 @ 04/04/23 18:06:39.756 (7.024s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.756 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:39.957 (201ms) - - - > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:39.958 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:47.864 (7.907s) > Enter [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:47.864 < Exit [BeforeEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:31 @ 04/04/23 18:06:51.912 (4.047s) > Enter [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:06:51.912 < Exit [It] should redirect to /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/approot.go:35 @ 04/04/23 18:07:02.086 (10.175s) > Enter [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.086 < Exit [AfterEach] [Annotations] app-root - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:02.297 (211ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:02.297 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:10.188 (7.891s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:10.188 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:07:14.226 (4.037s) > Enter [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:14.226 < Exit [It] should return 200 using auth-tls-match-cn with matching CN from client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:295 @ 04/04/23 18:07:25.018 (10.792s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.018 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:25.219 (201ms) - - - > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:25.22 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:33.104 (7.884s) > Enter [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:33.104 < Exit [BeforeEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:31 @ 04/04/23 18:07:35.129 (2.025s) > Enter [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:35.129 STEP: sending request from an explicitly denied IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:61 @ 04/04/23 18:07:52.29 STEP: sending request from an explicitly denied IP address - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:69 @ 04/04/23 18:07:52.298 STEP: sending request from an implicitly allowed IP range - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:77 @ 04/04/23 18:07:52.304 < Exit [It] only deny explicitly denied IPs, allow all others - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/ipdenylist.go:35 @ 04/04/23 18:07:59.326 (24.197s) > Enter [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.326 < Exit [AfterEach] [Annotations] denylist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:59.52 (194ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.52 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:06.412 (6.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:06.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:14.461 (8.049s) > Enter [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:14.461 < Exit [It] should not use canary with domain as a server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:891 @ 04/04/23 18:08:31.701 (17.24s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.701 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:31.909 (208ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:31.909 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:39.801 (7.892s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:39.801 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:43.836 (4.035s) > Enter [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:43.836 < Exit [It] should set "proxy_set_header 'My-Custom-Header' '42';" when auth-headers are set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:301 @ 04/04/23 18:08:54.106 (10.269s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.106 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:54.318 (212ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:54.318 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:01.207 (6.889s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:01.207 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:09:09.264 (8.058s) > Enter [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:09.264 STEP: routing requests to the mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:591 @ 04/04/23 18:09:26.43 < Exit [It] should routes to mainline upstream when the given Regex causes error - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:566 @ 04/04/23 18:09:26.434 (17.169s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.434 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:26.658 (224ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:26.658 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:33.593 (6.935s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:33.593 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:09:37.637 (4.044s) > Enter [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:09:37.637 < Exit [It] should delete Ingress when class is removed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:192 @ 04/04/23 18:10:02.989 (25.352s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:02.989 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:03.188 (199ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:03.189 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.089 (7.901s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:11.09 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:10:19.123 (8.033s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:10:19.123 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:10:29.295 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:10:39.491 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:10:49.631 (30.509s) > Enter [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:49.631 STEP: Adding a global-auth-method to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:202 @ 04/04/23 18:10:49.631 < Exit [It] should proxy_method method when global-auth-method is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:197 @ 04/04/23 18:10:59.844 (10.213s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:59.844 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:00.053 (208ms) - - - > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:00.053 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:17.888 (2m17.835s) > Enter [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:17.888 < Exit [BeforeEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:32 @ 04/04/23 18:13:21.926 (4.038s) > Enter [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:21.926 < Exit [It] should not set invalid proxy timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_connect_timeout.go:52 @ 04/04/23 18:13:39.103 (17.177s) > Enter [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.103 < Exit [AfterEach] [Setting] proxy-connect-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:39.316 (214ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:39.317 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:46.2 (6.883s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:46.2 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:13:51.228 (5.028s) > Enter [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:13:51.228 < Exit [It] should add fastcgi_param in the configuration file - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:71 @ 04/04/23 18:14:01.351 (10.123s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.351 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:01.572 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:01.573 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:08.451 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:08.451 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:14:12.484 (4.033s) > Enter [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:12.484 < Exit [It] should enable cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:35 @ 04/04/23 18:14:22.62 (10.136s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.62 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:22.8 (179ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:22.8 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:29.697 (6.897s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:29.697 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:14:33.724 (4.026s) > Enter [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:33.724 < Exit [BeforeEach] should configure HSTS policy header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:100 @ 04/04/23 18:14:43.071 (9.347s) > Enter [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:43.071 < Exit [It] overriding what's set from the upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:166 @ 04/04/23 18:14:50.277 (7.207s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.277 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:50.564 (287ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:50.566 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:57.791 (7.225s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:57.791 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:15:01.819 (4.028s) > Enter [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:01.819 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:94 @ 04/04/23 18:15:18.959 STEP: skipping Nginx reload - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:101 @ 04/04/23 18:15:21.991 < Exit [It] picks up the previously missing secret for a given ingress without reloading - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:70 @ 04/04/23 18:15:22.003 (20.184s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.003 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.173 (170ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:22.173 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:30.052 (7.879s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:30.052 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:15:32.076 (2.024s) > Enter [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:32.076 < Exit [It] should disable cors allow credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:94 @ 04/04/23 18:15:42.292 (10.217s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.292 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:42.533 (240ms) - - - > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:42.533 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:49.463 (6.93s) > Enter [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:15:49.463 < Exit [BeforeEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:43 @ 04/04/23 18:16:08.363 (18.9s) > Enter [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:08.363 < Exit [It] should return status code 200 when accessing '/noauth' unauthenticated - /go/src/k8s.io/ingress-nginx/test/e2e/settings/no_auth_locations.go:82 @ 04/04/23 18:16:11.514 (3.151s) > Enter [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.514 < Exit [AfterEach] [Setting] [Security] no-auth-locations - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:11.73 (216ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:11.73 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:18.612 (6.881s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:18.612 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:16:28.726 (10.115s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:16:28.726 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:16:38.887 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:16:49.114 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:16:59.322 (30.595s) > Enter [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:87 @ 04/04/23 18:16:59.322 STEP: Sending a request to protected service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:94 @ 04/04/23 18:16:59.333 < Exit [It] should return status code 401 when request any protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:85 @ 04/04/23 18:16:59.342 (20ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.342 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:59.57 (229ms) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:59.571 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:06.433 (6.862s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:06.433 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:17:18.505 (12.072s) > Enter [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:18.505 < Exit [It] should ignore catch all Ingress with backend and rules - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:69 @ 04/04/23 18:17:28.675 (10.171s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.675 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.85 (174ms) - - - > Enter [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:28.85 < Exit [BeforeEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:37.72 (8.87s) > Enter [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:37.72 < Exit [It] should have worker_rlimit_nofile option - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_options.go:31 @ 04/04/23 18:17:40.919 (3.199s) > Enter [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:40.919 < Exit [AfterEach] global-options - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:41.126 (207ms) - - - > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:41.126 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:49.014 (7.887s) > Enter [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:49.014 < Exit [BeforeEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:35 @ 04/04/23 18:17:53.032 (4.018s) > Enter [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:17:53.032 Apr 4 18:18:09.269: INFO: Unexpected TLS error: tls: failed to verify certificate: x509: certificate is valid for ingress.local, not settings-tls < Exit [It] should not use ports or X-Forwarded-Host during the HTTP to HTTPS redirection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/tls.go:205 @ 04/04/23 18:18:11.272 (18.241s) > Enter [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.272 < Exit [AfterEach] [Setting] [SSL] TLS protocols, ciphers and headers) - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:11.48 (208ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:11.48 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:18.335 (6.854s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:18.335 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:18:22.355 (4.02s) > Enter [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:22.355 < Exit [It] should build proxy next upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:194 @ 04/04/23 18:18:32.501 (10.146s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.501 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:32.736 (236ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:32.737 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:39.632 (6.895s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:39.632 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:18:50.669 (11.037s) > Enter [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:18:50.669 < Exit [It] should respect proto passed by the PROXY Protocol server port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:79 @ 04/04/23 18:20:22.888 (1m32.219s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:22.888 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:23.276 (388ms) - - - > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:23.277 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:31.164 (7.887s) > Enter [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:31.164 < Exit [BeforeEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:31 @ 04/04/23 18:20:33.226 (2.062s) > Enter [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:33.226 < Exit [It] should change ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/sslciphers.go:35 @ 04/04/23 18:20:43.402 (10.176s) > Enter [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.402 < Exit [AfterEach] [Annotations] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:43.603 (201ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:43.603 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:50.486 (6.883s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:50.486 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:20:54.514 (4.028s) > Enter [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:20:54.514 < Exit [It] should set client_body_buffer_size to 1k - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:79 @ 04/04/23 18:21:04.738 (10.224s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.738 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.947 (209ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.947 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:11.835 (6.888s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:11.835 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:21:15.853 (4.017s) > Enter [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:15.853 < Exit [It] should turn off proxy-request-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:179 @ 04/04/23 18:21:26.03 (10.178s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.03 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:26.226 (196ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:26.227 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.123 (7.896s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:34.123 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:21:38.158 (4.035s) > Enter [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:38.158 < Exit [It] should get information for a specific backend server - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:56 @ 04/04/23 18:21:48.595 (10.437s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.595 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.793 (198ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:48.794 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:21:50.797 (2.003s) > Enter [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:50.797 < Exit [It] start nginx with default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:102 @ 04/04/23 18:21:59.838 (9.042s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.839 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:21:59.841 (3ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:59.842 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.232 (7.39s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:07.232 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:11.252 (4.02s) > Enter [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:11.252 < Exit [It] should set cors max-age - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:78 @ 04/04/23 18:22:21.435 (10.182s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.435 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.724 (289ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.725 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:29.212 (7.488s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:29.212 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:33.245 (4.033s) > Enter [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:33.245 < Exit [It] should allow - matching origin+port with wildcard origin - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:488 @ 04/04/23 18:22:40.278 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.278 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:40.502 (224ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:40.502 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:47.367 (6.865s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:47.368 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:22:51.389 (4.021s) > Enter [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:22:51.389 < Exit [It] should change cookie name on ingress definition change - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:64 @ 04/04/23 18:23:06.598 (15.209s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.598 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:06.803 (205ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:06.804 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:13.683 (6.879s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:13.683 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:23:17.702 (4.019s) > Enter [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:17.702 < Exit [It] should add value of server-snippet setting to all ingress config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:35 @ 04/04/23 18:23:50.157 (32.455s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.157 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:50.365 (209ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:50.366 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:57.248 (6.882s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:23:57.248 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:24:06.308 (9.06s) > Enter [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:06.308 < Exit [It] should block Referers defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:88 @ 04/04/23 18:24:16.602 (10.294s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:16.602 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:17.016 (414ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:17.016 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:25.558 (8.541s) > Enter [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:25.558 < Exit [It] should set gzip_types to application/javascript - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:89 @ 04/04/23 18:24:42.749 (17.191s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.749 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.994 (245ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.994 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.859 (6.865s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:49.859 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:24:55.885 (6.025s) > Enter [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:24:55.885 < Exit [It] should exists opentracing_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:115 @ 04/04/23 18:25:13.047 (17.162s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.047 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:13.223 (176ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:25:13.223 (0s) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:13.223 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:21.122 (7.899s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:21.122 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:25:27.151 (6.029s) > Enter [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:27.151 < Exit [It] should not allow - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:196 @ 04/04/23 18:25:34.17 (7.019s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.17 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:34.371 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:34.371 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:41.275 (6.904s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:41.275 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:25:49.318 (8.044s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:25:49.318 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:25:59.469 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:26:09.647 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:26:19.839 (30.521s) > Enter [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:19.839 STEP: Adding a global-auth-snippet to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:254 @ 04/04/23 18:26:19.839 < Exit [It] should set snippet when global external auth is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:250 @ 04/04/23 18:26:29.995 (10.156s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.995 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:30.195 (200ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:30.195 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:37.066 (6.871s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:37.066 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:26:41.082 (4.015s) > Enter [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:41.082 < Exit [It] add valid directives to server via server snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:35 @ 04/04/23 18:26:51.227 (10.145s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.227 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:51.453 (226ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:51.453 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:58.324 (6.87s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:26:58.324 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:27:02.348 (4.024s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:02.348 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:07.377 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:17.563 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:27:27.77 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:27:37.89 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:27:53.085 (50.737s) > Enter [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:27:53.085 STEP: receiving an internal server error without cache on location /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:811 @ 04/04/23 18:28:00.105 < Exit [It] should deny login for different location on same server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:792 @ 04/04/23 18:29:00.109 (1m7.024s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.109 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:00.314 (205ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:00.314 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:08.193 (7.878s) > Enter [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:08.193 < Exit [BeforeEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:33 @ 04/04/23 18:29:10.222 (2.029s) > Enter [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:10.222 < Exit [It] should return OK for service with backend protocol FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/fastcgi.go:102 @ 04/04/23 18:29:20.442 (10.22s) > Enter [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.442 < Exit [AfterEach] [Annotations] backend-protocol - FastCGI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:20.65 (208ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:20.651 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:27.592 (6.941s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:27.592 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:29:35.635 (8.044s) > Enter [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:35.635 < Exit [It] should route requests only to canary if canary weight is equal to canary weight total - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:775 @ 04/04/23 18:29:52.866 (17.23s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:52.866 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:53.101 (235ms) - - - > Enter [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:53.101 < Exit [BeforeEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:00.998 (7.896s) > Enter [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:00.998 < Exit [It] should add value of modsecurity-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/modsecurity/modsecurity_snippet.go:30 @ 04/04/23 18:30:11.215 (10.217s) > Enter [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.215 < Exit [AfterEach] [Setting] [Security] modsecurity-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:11.436 (221ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:11.436 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:18.304 (6.868s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:18.304 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:30:22.331 (4.027s) > Enter [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:22.331 < Exit [It] should exists opentracing directive when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:71 @ 04/04/23 18:30:39.546 (17.216s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.546 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.763 (217ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:30:39.763 (0s) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.763 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.146 (7.383s) > Enter [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:30:47.146 < Exit [It] Check persistent affinity mode - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:67 @ 04/04/23 18:32:47.648 (2m0.502s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.648 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:47.827 (179ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:47.827 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:04.512 (2m16.685s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:04.512 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:08.555 (4.042s) > Enter [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:08.555 < Exit [It] should ignore Ingress with a different class annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:68 @ 04/04/23 18:35:25.764 (17.209s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.764 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:25.96 (196ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.96 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:33.883 (7.923s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:33.883 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:35:37.911 (4.028s) > Enter [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:37.911 < Exit [It] should enable opentracing using jaeger - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:172 @ 04/04/23 18:35:57.93 (20.019s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:57.93 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:58.103 (173ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:58.103 (0s) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:58.104 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:05.96 (7.857s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:05.96 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:36:14.017 (8.056s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:36:14.017 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:36:24.203 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:36:34.361 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:36:44.521 (30.504s) > Enter [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:44.521 STEP: Adding a global-auth-signin to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:215 @ 04/04/23 18:36:44.521 < Exit [It] should add custom error page when global-auth-signin url is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:210 @ 04/04/23 18:36:54.694 (10.173s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.694 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.922 (228ms) - - - > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.922 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:02.365 (7.443s) > Enter [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:02.365 < Exit [BeforeEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:31 @ 04/04/23 18:37:08.389 (6.023s) > Enter [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:08.389 < Exit [It] disable-stream-access-log set access_log off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/disableaccesslog.go:71 @ 04/04/23 18:37:25.61 (17.222s) > Enter [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.611 < Exit [AfterEach] [Annotations] disable-access-log disable-http-access-log disable-stream-access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:25.869 (258ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.869 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:32.759 (6.89s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:32.759 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:37:36.785 (4.026s) > Enter [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:36.785 < Exit [It] should enable opentracing using jaeger with sampler host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:184 @ 04/04/23 18:37:56.815 (20.03s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:56.815 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.041 (227ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:37:57.041 (0s) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.042 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.9 (7.858s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:04.9 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:38:15.932 (11.032s) > Enter [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:15.932 < Exit [It] Add a custom header - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:40 @ 04/04/23 18:38:26.137 (10.204s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.137 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:26.471 (334ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:26.471 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:33.322 (6.851s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:33.322 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:38:37.351 (4.029s) > Enter [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:38:37.351 < Exit [It] should serve Ingress when class is updated between annotation and ingressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:323 @ 04/04/23 18:39:02.787 (25.436s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:02.787 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:03.018 (231ms) - - - > Enter [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:03.025 < Exit [BeforeEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:11.02 (7.995s) > Enter [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:11.02 < Exit [It] should return 503 when all backend service endpoints are unavailable - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_backend.go:54 @ 04/04/23 18:39:21.316 (10.296s) > Enter [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.316 < Exit [AfterEach] [Service] backend status code 503 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.504 (188ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.504 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.492 (7.988s) > Enter [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:29.492 < Exit [It] should set gzip_disable to msie6 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:67 @ 04/04/23 18:39:46.643 (17.151s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.643 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:46.835 (192ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:46.835 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:53.72 (6.885s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:39:53.72 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:01.768 (8.048s) > Enter [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:01.768 < Exit [It] routes traffic to either mainline or canary backend (legacy behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:1058 @ 04/04/23 18:40:57.335 (55.567s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.335 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:57.533 (198ms) - - - > Enter [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.249 < Exit [BeforeEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.794 (7.545s) > Enter [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:04:26.794 Apr 4 18:04:26.794: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=0' Apr 4 18:04:49.019: INFO: waiting for leader election and initial status update Apr 4 18:05:29.033: INFO: Asynchronously running '/bin/bash -c /usr/local/bin/kubectl proxy --accept-hosts=.* --address=0.0.0.0 --port=42431' < Exit [It] should update status field after client-go reconnection - /go/src/k8s.io/ingress-nginx/test/e2e/status/update.go:43 @ 04/04/23 18:05:39.069 (1m12.275s) > Enter [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.069 < Exit [AfterEach] [Status] status update - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.293 (225ms) - - - > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.294 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.218 (6.925s) > Enter [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:46.218 < Exit [BeforeEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:31 @ 04/04/23 18:05:50.239 (4.02s) > Enter [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:05:50.239 < Exit [It] should set client_body_buffer_size to 1M - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/clientbodybuffersize.go:123 @ 04/04/23 18:06:00.422 (10.184s) > Enter [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.422 < Exit [AfterEach] [Annotations] client-body-buffer-size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:00.649 (227ms) - - - > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:00.649 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:07.542 (6.893s) > Enter [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:07.542 < Exit [BeforeEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:32 @ 04/04/23 18:06:11.569 (4.027s) > Enter [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:11.569 < Exit [It] should exist a proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_host.go:36 @ 04/04/23 18:06:21.772 (10.203s) > Enter [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.772 < Exit [AfterEach] Dynamic $proxy_host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:21.963 (191ms) - - - > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:21.964 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:28.888 (6.924s) > Enter [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:28.888 < Exit [BeforeEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:34 @ 04/04/23 18:06:39.938 (11.05s) > Enter [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:39.938 < Exit [It] Add multiple custom headers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/custom_header.go:65 @ 04/04/23 18:06:50.151 (10.213s) > Enter [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.151 < Exit [AfterEach] [Setting] add-headers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:50.374 (223ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:50.375 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:57.307 (6.932s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:06:57.307 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:05.355 (8.048s) > Enter [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:05.355 STEP: routing requests destined for the mainline ingress to the maineline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:185 @ 04/04/23 18:07:22.519 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:195 @ 04/04/23 18:07:22.526 < Exit [It] should route requests to the correct upstream if mainline ingress is created before the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:161 @ 04/04/23 18:07:22.534 (17.179s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.534 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:22.759 (225ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:22.759 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:29.671 (6.912s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:29.671 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:40.702 (11.031s) > Enter [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:40.702 < Exit [It] should set proxy-headers-hash-max-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:68 @ 04/04/23 18:07:50.922 (10.22s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:50.922 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:51.164 (242ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:51.164 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:59.041 (7.877s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:07:59.041 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:08:03.067 (4.025s) > Enter [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:03.067 < Exit [It] should ignore Ingress with different controller class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:104 @ 04/04/23 18:08:20.253 (17.187s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.253 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:20.455 (201ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:20.455 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:27.83 (7.375s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:27.83 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:08:38.87 (11.04s) > Enter [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:38.87 < Exit [It] log-format-escape-none enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:128 @ 04/04/23 18:08:52.098 (13.228s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.098 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:52.323 (225ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:52.323 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:59.233 (6.909s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:08:59.233 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:09:03.258 (4.025s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:03.258 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:09:17.471 (14.213s) > Enter [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.471 < Exit [It] should return status code 200 when signed in - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:485 @ 04/04/23 18:09:17.477 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.477 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:17.663 (186ms) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:17.664 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:24.618 (6.955s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:24.618 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:09:37.752 (13.134s) > Enter [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:37.752 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:90 @ 04/04/23 18:09:44.916 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:96 @ 04/04/23 18:09:48.094 < Exit [It] uses default ssl certificate for host based ingress when configured certificate does not match host - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:80 @ 04/04/23 18:09:50.119 (12.367s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.119 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:50.349 (230ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:50.349 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:57.22 (6.871s) > Enter [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:09:57.22 < Exit [It] should return OK for service with backend protocol GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:68 @ 04/04/23 18:10:11.466 (14.247s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.466 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:11.655 (189ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:11.655 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:18.528 (6.872s) > Enter [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:18.528 < Exit [It] should be enabled with default settings - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:39 @ 04/04/23 18:10:28.683 (10.155s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.683 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:28.876 (193ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:28.876 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:35.756 (6.88s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:35.756 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:10:39.781 (4.025s) > Enter [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:39.781 < Exit [It] should include opentracing_trust_incoming_span off directive when disabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:85 @ 04/04/23 18:10:56.965 (17.184s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:56.965 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:57.186 (221ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:10:57.186 (0s) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:57.186 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:05.078 (7.892s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:05.078 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:11:09.104 (4.027s) > Enter [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:09.104 < Exit [It] should warn user when use-regex is true and session-cookie-path is not set - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:294 @ 04/04/23 18:11:22.32 (13.216s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.32 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:22.585 (265ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:22.585 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:29.564 (6.979s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:29.564 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:11:33.585 (4.021s) > Enter [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:33.585 < Exit [It] should set backend protocol to '' and use ajp_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:109 @ 04/04/23 18:11:43.812 (10.227s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:43.812 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:44.056 (244ms) - - - > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:44.057 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:52.078 (8.021s) > Enter [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:52.078 < Exit [BeforeEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:37 @ 04/04/23 18:11:54.141 (2.063s) > Enter [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:11:54.141 < Exit [It] should add stream-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/streamsnippet.go:85 @ 04/04/23 18:12:23.359 (29.218s) > Enter [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.359 < Exit [AfterEach] [Setting] stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:23.53 (171ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:23.53 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:30.423 (6.893s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:30.423 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:12:34.455 (4.032s) > Enter [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:34.455 < Exit [It] should not set secure in cookie with provided false annotation on http - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:435 @ 04/04/23 18:12:44.621 (10.166s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.621 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:44.832 (211ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:44.833 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:52.267 (7.434s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.267 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:12:52.272 (5ms) > Enter [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:52.272 < Exit [It] should expose an ExternalName TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:80 @ 04/04/23 18:12:55.617 (3.345s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.617 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:55.87 (253ms) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:55.871 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:02.782 (6.911s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:02.782 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:13:06.807 (4.025s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:06.807 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:13:23.944 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:13:32.097 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:13:32.106 (25.299s) > Enter [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:32.106 < Exit [It] removes HTTPS configuration when we delete TLS spec - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:233 @ 04/04/23 18:13:37.112 (5.005s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.112 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:37.281 (169ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:37.281 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:45.19 (7.908s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:45.19 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:13:49.209 (4.019s) > Enter [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:13:49.209 < Exit [It] should not exists opentracing_location_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:130 @ 04/04/23 18:14:06.443 (17.233s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.443 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:06.621 (178ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:14:06.621 (0s) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:06.621 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:13.543 (6.921s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:13.543 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:14:17.569 (4.026s) > Enter [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:17.569 < Exit [It] picks up the certificate when we add TLS spec to existing ingress - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:45 @ 04/04/23 18:14:33.037 (15.469s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.037 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:33.234 (196ms) - - - > Enter [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:33.234 < Exit [BeforeEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:98 @ 04/04/23 18:14:35.237 (2.003s) > Enter [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:14:35.237 < Exit [It] fails when using root directive - /go/src/k8s.io/ingress-nginx/test/e2e/nginx/nginx.go:124 @ 04/04/23 18:15:35.27 (1m0.034s) > Enter [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.27 < Exit [AfterEach] [Setting] nginx-configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:99 @ 04/04/23 18:15:35.272 (2ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:35.273 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:43.177 (7.905s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:43.177 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:15:45.196 (2.019s) > Enter [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:15:45.196 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:161 @ 04/04/23 18:15:45.196 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:165 @ 04/04/23 18:15:52.212 STEP: check that '/foo/bar/bar' does not match the longest exact path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:179 @ 04/04/23 18:16:02.371 < Exit [It] should fail to use longest match for documented warning - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:158 @ 04/04/23 18:16:02.374 (17.178s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.374 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:02.58 (206ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:02.581 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:12.465 (9.885s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:12.465 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:16:16.495 (4.03s) > Enter [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:16.495 < Exit [It] should not exists opentelemetry_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:89 @ 04/04/23 18:16:33.975 (17.48s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:33.975 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:34.598 (623ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:16:34.598 (0s) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:34.603 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.474 (6.871s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:41.474 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:16:43.493 (2.019s) > Enter [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:16:43.493 < Exit [It] should disable modsecurity using 'modsecurity off;' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:132 @ 04/04/23 18:17:00.623 (17.13s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.623 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:00.822 (199ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:00.823 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:07.712 (6.89s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:07.712 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:18.751 (11.038s) > Enter [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:18.751 < Exit [It] should set the request count to upstream server through one keep alive connection - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:86 @ 04/04/23 18:17:28.957 (10.206s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:28.957 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:29.194 (237ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:29.195 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:39.14 (9.946s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:39.14 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:17:50.186 (11.045s) > Enter [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:17:50.186 < Exit [It] should set keepalive_requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:48 @ 04/04/23 18:18:00.312 (10.127s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.312 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:00.496 (184ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:00.496 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:07.399 (6.903s) > Enter [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:07.399 < Exit [It] should set gzip_comp_level to 4 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:56 @ 04/04/23 18:18:24.593 (17.194s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.593 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:24.792 (199ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:24.793 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:31.73 (6.937s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:31.73 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:18:35.753 (4.023s) > Enter [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:35.753 < Exit [It] should set sticky cookie SERVERID - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:42 @ 04/04/23 18:18:45.94 (10.187s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:45.94 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:46.161 (221ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:46.161 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.022 (7.861s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:54.022 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:58.047 (4.025s) > Enter [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:18:58.047 < Exit [It] should allow - missing origins (should allow all origins) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:571 @ 04/04/23 18:19:05.106 (7.059s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.106 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:05.287 (181ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:05.287 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:13.171 (7.884s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:13.171 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:19:17.198 (4.027s) > Enter [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:17.198 < Exit [It] should not set affinity across all server locations when using separate ingresses - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:320 @ 04/04/23 18:19:34.328 (17.129s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.328 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:34.564 (236ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.564 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:42.455 (7.891s) > Enter [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:42.455 < Exit [It] should return 200 for service type=ExternalName without a port defined - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:95 @ 04/04/23 18:19:52.995 (10.54s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:52.995 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:53.197 (202ms) - - - - > Enter [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:53.198 < Exit [BeforeEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.144 (6.946s) > Enter [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 [SKIPPED] enable-access-log-for-default-backend In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:90 @ 04/04/23 18:20:00.144 < Exit [It] enables access logging for default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/default_backend.go:88 @ 04/04/23 18:20:00.144 (0s) > Enter [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.144 < Exit [AfterEach] [Default Backend] - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:00.767 (622ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:00.767 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:09.884 (9.117s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:09.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:20:13.952 (4.068s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:13.952 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:20:28.231 (14.28s) > Enter [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:28.231 < Exit [It] should overwrite Foo header with auth response - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:529 @ 04/04/23 18:20:32.452 (4.22s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.452 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:32.657 (205ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:32.657 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:39.572 (6.914s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:39.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:20:43.594 (4.022s) > Enter [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:20:43.594 STEP: creating a regular ingress definition - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:114 @ 04/04/23 18:20:43.594 STEP: creating an ingress definition with the use-regex amd rewrite-target annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:123 @ 04/04/23 18:20:53.786 STEP: ensuring '/foo' matches '~* ^/foo' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:137 @ 04/04/23 18:21:03.945 STEP: ensuring '/foo/bar' matches '~* ^/foo.+' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:147 @ 04/04/23 18:21:03.953 < Exit [It] should use ~* location modifier if regex annotation is present - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:111 @ 04/04/23 18:21:03.959 (20.365s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:03.959 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:04.173 (214ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:04.173 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:12.085 (7.912s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:12.085 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:16.104 (4.019s) > Enter [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:16.104 < Exit [It] should return status code 401 when authentication is configured but Authorization header is not configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:89 @ 04/04/23 18:21:27.134 (11.029s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.134 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:27.321 (187ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:27.321 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:34.238 (6.917s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:34.238 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:21:38.265 (4.026s) > Enter [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:38.265 < Exit [It] should disable mirror-request-body - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:67 @ 04/04/23 18:21:48.462 (10.197s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.462 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:48.677 (215ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:48.677 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:55.595 (6.918s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:55.595 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:21:59.616 (4.02s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:21:59.616 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:22:09.78 (10.165s) > Enter [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.78 < Exit [It] should return 503 (location was denied) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:879 @ 04/04/23 18:22:09.787 (6ms) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:09.787 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:10.018 (231ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:10.018 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:17.91 (7.892s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:17.91 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:22:21.937 (4.027s) > Enter [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:21.937 < Exit [It] should setup proxy cookies - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:215 @ 04/04/23 18:22:32.141 (10.205s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.141 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:32.312 (170ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.312 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:39.246 (6.934s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:39.246 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:22:43.274 (4.028s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:43.274 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:22:50.32 (7.047s) > Enter [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:22:50.32 < Exit [It] should ignore Ingress with only IngressClassName - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:652 @ 04/04/23 18:23:00.536 (10.216s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.536 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:00.771 (235ms) - - - > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:00.772 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:07.648 (6.876s) > Enter [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:07.648 < Exit [BeforeEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:39 @ 04/04/23 18:23:18.858 (11.21s) > Enter [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:18.858 < Exit [It] should enable ssl-passthrough-proxy-port on a different port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_passthrough.go:56 @ 04/04/23 18:23:30.073 (11.215s) > Enter [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.073 < Exit [AfterEach] [Flag] enable-ssl-passthrough - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:30.267 (194ms) - - - > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:30.267 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:37.168 (6.901s) > Enter [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:37.168 < Exit [BeforeEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:34 @ 04/04/23 18:23:41.193 (4.024s) > Enter [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:41.193 < Exit [It] should apply the annotation to the default backend - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/with_hosts.go:38 @ 04/04/23 18:23:51.36 (10.167s) > Enter [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.36 < Exit [AfterEach] [Default Backend] change default settings - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.551 (192ms) - - - > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:51.552 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:58.412 (6.86s) > Enter [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:23:58.412 < Exit [BeforeEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:42 @ 04/04/23 18:24:02.44 (4.027s) > Enter [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:02.44 Apr 4 18:24:11.771: INFO: Connecting to github.com (140.82.113.4:443) Connecting to github.com (140.82.113.4:443) Connecting to raw.githubusercontent.com (185.199.108.133:443) saving to '/etc/nginx/geoip/GeoLite2-Country.mmdb' GeoLite2-Country.mmd 100%!|(MISSING)********************************| 17952 0:00:00 ETA '/etc/nginx/geoip/GeoLite2-Country.mmdb' saved < Exit [It] should include geoip2 line in config when enabled and db file exists - /go/src/k8s.io/ingress-nginx/test/e2e/settings/geoip2.go:46 @ 04/04/23 18:24:22.088 (19.648s) > Enter [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.088 < Exit [AfterEach] [Setting] Geoip2 - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.674 (586ms) - - - > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.675 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.572 (7.897s) > Enter [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:30.572 < Exit [BeforeEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:33 @ 04/04/23 18:24:34.603 (4.031s) > Enter [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:34.603 STEP: creating an ingress definition with the use-regex annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:193 @ 04/04/23 18:24:34.603 STEP: check that '/foo/bar/bar' redirects to custom rewrite - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:206 @ 04/04/23 18:24:44.755 < Exit [It] should allow for custom rewrite parameters - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/rewrite.go:190 @ 04/04/23 18:24:44.757 (10.154s) > Enter [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.757 < Exit [AfterEach] [Annotations] rewrite-target use-regex enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:44.959 (202ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:44.96 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:53.864 (8.905s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:24:53.864 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:25:04.899 (11.035s) > Enter [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:04.899 < Exit [It] should set server_names_hash_bucket_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:40 @ 04/04/23 18:25:15.061 (10.162s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.061 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:15.316 (255ms) - - - > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:15.316 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:39.846 (24.53s) > Enter [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:39.846 < Exit [BeforeEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:38 @ 04/04/23 18:25:47.041 (7.195s) > Enter [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:47.041 < Exit [It] should set X-Forwarded-Port header to 443 - /go/src/k8s.io/ingress-nginx/test/e2e/settings/listen_nondefault_ports.go:70 @ 04/04/23 18:25:59.374 (12.333s) > Enter [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.374 < Exit [AfterEach] [Flag] custom HTTP and HTTPS ports - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:59.585 (211ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:59.585 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:06.445 (6.86s) > Enter [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:06.445 < Exit [It] should create sync events (default) - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:35 @ 04/04/23 18:26:20.681 (14.236s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.681 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:20.877 (196ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:20.877 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:27.751 (6.874s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:27.751 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:31.787 (4.036s) > Enter [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:31.787 < Exit [It] should not allow - unmatching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:468 @ 04/04/23 18:26:38.82 (7.032s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:38.82 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:39.022 (203ms) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:39.023 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:46.929 (7.906s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:46.929 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:26:50.949 (4.02s) > Enter [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:26:50.949 < Exit [It] should not set invalid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:52 @ 04/04/23 18:27:08.052 (17.103s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.052 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:08.24 (188ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:08.24 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:16.131 (7.891s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:16.131 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:27.187 (11.056s) > Enter [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:27.187 < Exit [It] should set server_names_hash_max_size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:48 @ 04/04/23 18:27:37.411 (10.224s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.411 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:37.656 (245ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:37.657 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:44.535 (6.879s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:44.535 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:27:48.555 (4.02s) > Enter [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:48.555 < Exit [It] should set proxy client-max-body-size to 8m - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:85 @ 04/04/23 18:27:58.71 (10.155s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.71 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:58.954 (244ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:58.955 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:06.864 (7.909s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:06.864 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:28:10.897 (4.033s) > Enter [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:10.897 < Exit [It] should not break functionality with extra domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:314 @ 04/04/23 18:28:17.933 (7.036s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:17.933 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:18.142 (209ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:18.142 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:26.105 (7.963s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:26.105 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:28:28.133 (2.028s) > Enter [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:28:28.133 < Exit [It] proxy-ssl-location-only flag should change the nginx config server part - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:150 @ 04/04/23 18:29:01.214 (33.081s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.214 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:01.431 (217ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:01.431 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:19.232 (2m17.801s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:19.232 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:23.279 (4.047s) > Enter [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:23.279 < Exit [BeforeEach] with invalid auth-url should deny whole location - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:866 @ 04/04/23 18:31:33.459 (10.18s) > Enter [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:33.459 < Exit [It] should add error to the config - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:887 @ 04/04/23 18:31:36.583 (3.124s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.583 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:36.807 (224ms) - - - > Enter [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:36.808 < Exit [BeforeEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:43.735 (6.927s) > Enter [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX IP address - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:30 @ 04/04/23 18:31:43.735 STEP: checking SSL Certificate using the NGINX catch all server - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:45 @ 04/04/23 18:31:48.771 < Exit [It] should return a self generated SSL certificate - /go/src/k8s.io/ingress-nginx/test/e2e/defaultbackend/ssl.go:29 @ 04/04/23 18:31:48.798 (5.063s) > Enter [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:48.798 < Exit [AfterEach] [Default Backend] SSL - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:49.002 (204ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:49.002 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.884 (6.881s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:55.884 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:31:59.898 (4.014s) > Enter [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:31:59.898 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:04.919 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:15.067 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:754 @ 04/04/23 18:32:25.279 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:761 @ 04/04/23 18:32:35.453 < Exit [BeforeEach] when external authentication with caching is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:730 @ 04/04/23 18:32:50.643 (50.746s) > Enter [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:50.643 < Exit [It] should return status code 200 when signed in after auth backend is deleted - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:772 @ 04/04/23 18:32:57.666 (7.022s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.666 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:57.876 (210ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:57.876 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:04.793 (6.917s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:04.793 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:33:08.814 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:08.814 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-protocols - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:122 @ 04/04/23 18:33:19.338 (10.524s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.338 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:19.552 (213ms) - - - > Enter [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:19.552 < Exit [BeforeEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:26.442 (6.89s) > Enter [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:26.442 < Exit [It] should be disabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/gzip.go:32 @ 04/04/23 18:33:29.606 (3.164s) > Enter [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.606 < Exit [AfterEach] [Setting] gzip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.78 (174ms) - - - > Enter [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.78 < Exit [BeforeEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.668 (6.887s) > Enter [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:36.668 < Exit [It] Balanced affinity mode should balance - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinitymode.go:34 @ 04/04/23 18:33:54.927 (18.259s) > Enter [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:54.927 < Exit [AfterEach] [Annotations] affinitymode - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:55.127 (200ms) - - - > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:55.128 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:03.016 (7.888s) > Enter [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:03.016 < Exit [BeforeEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:32 @ 04/04/23 18:34:07.036 (4.021s) > Enter [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:07.036 < Exit [It] should build proxy next upstream using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_next_upstream.go:36 @ 04/04/23 18:34:24.255 (17.219s) > Enter [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.255 < Exit [AfterEach] [Setting] proxy-next-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:24.485 (230ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:24.485 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:31.385 (6.9s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:31.385 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:34:35.427 (4.042s) > Enter [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:35.427 < Exit [It] should set proxy_redirect to off - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:36 @ 04/04/23 18:34:45.603 (10.176s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.603 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:45.78 (178ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.781 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:52.66 (6.879s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:52.66 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:34:56.689 (4.029s) > Enter [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:34:56.689 < Exit [It] should not exists opentracing_operation_name directive when is empty - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:100 @ 04/04/23 18:35:13.844 (17.155s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:13.844 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:14.078 (234ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:35:14.078 (0s) - - - > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:14.078 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:22.011 (7.933s) > Enter [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:22.011 < Exit [BeforeEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:42 @ 04/04/23 18:35:38.056 (16.045s) > Enter [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:38.056 < Exit [It] should send the request metric to the influxdb server - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/influxdb.go:48 @ 04/04/23 18:35:59.417 (21.362s) > Enter [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.417 < Exit [AfterEach] [Annotations] influxdb-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:59.632 (215ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:59.632 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:06.509 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:06.509 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:36:10.532 (4.023s) > Enter [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:10.532 < Exit [It] should enable opentracing using datadog - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:241 @ 04/04/23 18:36:30.574 (20.042s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.574 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:30.81 (237ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:36:30.81 (0s) - - - > Enter [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:30.811 < Exit [BeforeEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:37.689 (6.878s) > Enter [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:37.689 < Exit [It] should set ingress details variables for ingresses without a host - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/without_host.go:34 @ 04/04/23 18:36:51.912 (14.223s) > Enter [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:51.912 < Exit [AfterEach] [Ingress] definition without host - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:52.088 (176ms) - - - > Enter [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:52.088 < Exit [BeforeEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:59.999 (7.911s) > Enter [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:36:59.999 < Exit [It] should add value of main-snippet setting to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/main_snippet.go:31 @ 04/04/23 18:37:10.187 (10.188s) > Enter [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.187 < Exit [AfterEach] [Setting] main-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:10.413 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:10.413 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:17.279 (6.866s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:17.279 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:37:21.337 (4.058s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:21.337 STEP: routing requests to the mainline upstream when header is set to 'DoCananry' and header-value is 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:557 @ 04/04/23 18:37:38.545 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:532 @ 04/04/23 18:37:38.552 (17.215s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.552 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:38.772 (219ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:38.772 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:45.664 (6.892s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:45.664 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:37:49.681 (4.017s) > Enter [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:37:49.681 < Exit [It] should serve Ingress when class is added - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:257 @ 04/04/23 18:38:15.087 (25.406s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.087 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:15.266 (179ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:15.266 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:23.144 (7.877s) > Enter [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:23.144 < Exit [It] should return OK for service with backend protocol GRPCS - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:199 @ 04/04/23 18:38:39.406 (16.262s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.406 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:39.613 (207ms) - - - > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:39.613 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:46.507 (6.894s) > Enter [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:46.507 < Exit [BeforeEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:34 @ 04/04/23 18:38:50.531 (4.023s) > Enter [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:38:50.531 STEP: regenerating the correct configuration after update - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:65 @ 04/04/23 18:39:12.735 < Exit [It] generates correct configuration - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:38 @ 04/04/23 18:39:23.972 (33.441s) > Enter [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:23.972 < Exit [AfterEach] [Annotations] annotation-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:24.525 (553ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:24.526 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:32.928 (8.402s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:32.928 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:39:36.954 (4.026s) > Enter [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:39:36.954 < Exit [It] [BAD_ANNOTATIONS] should drop an ingress if there is a forbidden word in some annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:67 @ 04/04/23 18:40:09.289 (32.335s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.289 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:09.487 (198ms) - - - > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:09.487 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:16.38 (6.893s) > Enter [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:16.38 < Exit [BeforeEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:31 @ 04/04/23 18:40:20.419 (4.039s) > Enter [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:20.419 < Exit [It] should not add X-Forwarded-Prefix if the annotation value is empty - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/xforwardedprefix.go:57 @ 04/04/23 18:40:30.626 (10.207s) > Enter [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.626 < Exit [AfterEach] [Annotations] x-forwarded-prefix - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:30.822 (196ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:30.822 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:37.735 (6.913s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:37.735 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:40:41.759 (4.024s) > Enter [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:41.759 < Exit [It] should ignore Ingress without IngressClass configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:164 @ 04/04/23 18:40:58.984 (17.225s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:58.984 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:59.238 (254ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.257 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:26.759 (7.502s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:26.759 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:04:38.804 (12.045s) > Enter [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:38.804 < Exit [It] should set cookie with domain - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:225 @ 04/04/23 18:04:49.017 (10.213s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.017 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:04:49.223 (207ms) - - - > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:49.225 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:57.104 (7.879s) > Enter [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:04:57.104 < Exit [BeforeEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:34 @ 04/04/23 18:05:01.132 (4.029s) > Enter [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:01.132 STEP: setting an ingress with a nil backend - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:39 @ 04/04/23 18:05:01.132 < Exit [It] should return 404 when backend service is nil - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_nil_backend.go:38 @ 04/04/23 18:05:18.375 (17.242s) > Enter [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.375 < Exit [AfterEach] [Service] Nil Service Backend - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:18.574 (200ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:18.575 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:25.47 (6.895s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:25.47 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:05:29.501 (4.031s) > Enter [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:29.501 < Exit [It] should set the path to /something on the generated cookie - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:99 @ 04/04/23 18:05:39.685 (10.184s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.685 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:39.886 (201ms) - - - > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:39.886 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:46.798 (6.912s) > Enter [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:46.798 < Exit [BeforeEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:33 @ 04/04/23 18:05:57.853 (11.055s) > Enter [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:05:57.853 < Exit [It] should block CIDRs defined in the ConfigMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_access_block.go:38 @ 04/04/23 18:06:08.065 (10.213s) > Enter [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.065 < Exit [AfterEach] [Setting] [Security] block-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:08.304 (239ms) - - - > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:08.304 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:15.196 (6.891s) > Enter [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:15.196 < Exit [BeforeEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:32 @ 04/04/23 18:06:19.22 (4.024s) > Enter [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:19.22 < Exit [It] should set valid proxy read timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_read_timeout.go:36 @ 04/04/23 18:06:36.431 (17.211s) > Enter [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.431 < Exit [AfterEach] [Setting] proxy-read-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:36.678 (246ms) - - - > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:36.678 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:43.562 (6.884s) > Enter [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:43.562 < Exit [BeforeEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:32 @ 04/04/23 18:06:47.588 (4.026s) > Enter [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:06:47.588 < Exit [It] should set valid proxy send timeouts using configmap values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_send_timeout.go:36 @ 04/04/23 18:07:04.782 (17.194s) > Enter [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.782 < Exit [AfterEach] [Setting] proxy-send-timeout - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:04.961 (179ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:04.961 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:12.853 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:12.853 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:07:20.912 (8.059s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:20.912 STEP: routing requests to the canary upstream when header is set to 'DoCanary' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:451 @ 04/04/23 18:07:38.088 STEP: routing requests to the mainline upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:460 @ 04/04/23 18:07:38.092 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:469 @ 04/04/23 18:07:38.097 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:478 @ 04/04/23 18:07:38.101 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:426 @ 04/04/23 18:07:38.105 (17.192s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.105 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.312 (208ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.313 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.57 (7.258s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:45.57 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:07:49.597 (4.027s) > Enter [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:07:49.597 < Exit [BeforeEach] when external authentication is configured with a custom redirect param - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:651 @ 04/04/23 18:08:17.835 (28.238s) > Enter [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:17.835 < Exit [It] keeps processing new ingresses even if one of the existing ingresses is misconfigured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:698 @ 04/04/23 18:08:29.028 (11.193s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.028 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:29.254 (225ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:29.254 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:37.146 (7.892s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:37.146 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:08:45.193 (8.047s) > Enter [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:08:45.193 STEP: routing requests destined for the mainline ingress to the mainelin upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:231 @ 04/04/23 18:09:02.324 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:240 @ 04/04/23 18:09:02.332 < Exit [It] should route requests to the correct upstream if mainline ingress is created after the canary ingress - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:206 @ 04/04/23 18:09:02.337 (17.144s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.337 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:02.545 (208ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:02.545 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:09.432 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:09.432 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:09:13.454 (4.022s) > Enter [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:13.454 < Exit [It] should enable modsecurity with snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:91 @ 04/04/23 18:09:23.682 (10.227s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.682 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:09:23.867 (185ms) - - - > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:09:23.867 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:41.632 (2m17.765s) > Enter [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:41.632 < Exit [BeforeEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:34 @ 04/04/23 18:11:45.686 (4.054s) > Enter [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:11:45.686 STEP: generating correct defaults - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:43 @ 04/04/23 18:11:52.711 STEP: applying customizations - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:61 @ 04/04/23 18:11:55.865 < Exit [It] generates correct NGINX configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/globalratelimit.go:38 @ 04/04/23 18:12:06.074 (20.388s) > Enter [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.074 < Exit [AfterEach] [Setting] settings-global-rate-limit - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:06.248 (175ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:06.248 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:13.645 (7.397s) > Enter [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:13.645 < Exit [BeforeEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:34 @ 04/04/23 18:12:24.689 (11.044s) > Enter [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:24.689 Apr 4 18:12:39.085: INFO: Request distribution: map[echo-7b6bf466cc-4gqhv:16 echo-7b6bf466cc-kbjqx:9 echo-7b6bf466cc-scqj9:5] < Exit [It] does not fail requests - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/ewma.go:42 @ 04/04/23 18:12:39.085 (14.396s) > Enter [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.085 < Exit [AfterEach] [Setting] [Load Balancer] EWMA - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:39.295 (210ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:39.295 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:47.18 (7.884s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:47.18 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:12:51.204 (4.024s) > Enter [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:12:51.204 < Exit [It] should expose headers for cors - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:153 @ 04/04/23 18:13:01.392 (10.189s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.392 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:01.572 (180ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:01.573 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:08.45 (6.878s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:08.45 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:13:16.493 (8.042s) > Enter [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:16.493 < Exit [It] always routes traffic to canary if first request was affinitized to canary (default behavior) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:943 @ 04/04/23 18:13:42.089 (25.596s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.089 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:42.311 (222ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:42.312 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.227 (6.915s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:13:49.227 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:14:00.268 (11.041s) > Enter [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:00.268 < Exit [It] should disable the log-format-escape-none - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:71 @ 04/04/23 18:14:10.406 (10.138s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.406 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:10.583 (177ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:10.584 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:17.985 (7.402s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:17.985 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:14:22.015 (4.03s) > Enter [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:22.015 < Exit [It] should set proxy_redirect to default - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:52 @ 04/04/23 18:14:32.238 (10.222s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.238 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:32.409 (172ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:32.41 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:40.329 (7.92s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:40.329 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:14:51.355 (11.026s) > Enter [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:14:51.356 < Exit [It] should set keepalive connection to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:59 @ 04/04/23 18:15:01.513 (10.157s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.513 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.717 (204ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.717 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:08.628 (6.911s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:08.628 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:15:12.654 (4.026s) > Enter [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:12.654 < Exit [It] should set backend protocol to https:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:34 @ 04/04/23 18:15:22.863 (10.21s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:22.863 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:23.117 (253ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:23.117 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:31.017 (7.9s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:31.017 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:15:35.052 (4.035s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:35.052 STEP: routing requests to the canary upstream when header is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:395 @ 04/04/23 18:15:52.235 STEP: routing requests to the mainline upstream when header is set to 'never' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:404 @ 04/04/23 18:15:52.237 STEP: routing requests to the mainline upstream when header is set to anything else - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:414 @ 04/04/23 18:15:52.239 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:372 @ 04/04/23 18:15:52.24 (17.188s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.24 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:52.427 (187ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:52.428 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.303 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:59.303 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:16:03.326 (4.022s) > Enter [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:03.326 < Exit [It] should exists opentracing_location_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:145 @ 04/04/23 18:16:20.959 (17.634s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:20.959 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:22.171 (1.211s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:16:22.171 (0s) - - - > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:22.172 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:31.372 (9.2s) > Enter [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:31.372 < Exit [BeforeEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:33 @ 04/04/23 18:16:35.41 (4.038s) > Enter [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:35.41 < Exit [It] Check limit-rate annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/limitrate.go:37 @ 04/04/23 18:16:49.822 (14.412s) > Enter [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:49.822 < Exit [AfterEach] [Annotations] limit-rate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:50.037 (215ms) - - - > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:50.037 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:57.908 (7.87s) > Enter [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:16:57.908 < Exit [BeforeEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:38 @ 04/04/23 18:17:01.931 (4.024s) > Enter [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:01.931 < Exit [It] should add value of stream-snippet via config map to nginx config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/stream_snippet.go:42 @ 04/04/23 18:17:24.158 (22.227s) > Enter [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.158 < Exit [AfterEach] [Setting] configmap stream-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:24.349 (191ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:24.35 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:31.239 (6.889s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:31.239 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:17:39.264 (8.025s) > Enter [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:17:39.264 < Exit [It] should connect to the same pod - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:83 @ 04/04/23 18:18:09.666 (30.402s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.666 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:09.903 (237ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:09.904 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:16.786 (6.882s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:16.786 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:18:20.804 (4.018s) > Enter [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:20.804 < Exit [BeforeEach] when external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:458 @ 04/04/23 18:18:35.029 (14.226s) > Enter [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:35.029 < Exit [It] should not create additional upstream block when auth-keepalive is set with HTTP/2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:609 @ 04/04/23 18:18:41.107 (6.078s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.107 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:41.32 (212ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:41.32 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:49.195 (7.875s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:49.195 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:18:53.217 (4.022s) > Enter [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:18:53.217 < Exit [It] should set valid proxy-ssl-secret - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:37 @ 04/04/23 18:19:04.077 (10.86s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.077 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:04.257 (181ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:04.258 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:12.153 (7.895s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:12.153 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:19:16.174 (4.021s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:16.174 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:94 @ 04/04/23 18:19:27.319 (11.146s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.32 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:27.668 (348ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:27.668 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:34.827 (7.159s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:34.827 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:19:38.85 (4.023s) > Enter [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:38.85 < Exit [It] should set backend protocol to '' and use fastcgi_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:94 @ 04/04/23 18:19:49.066 (10.216s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.066 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:49.312 (246ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:49.312 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:57.192 (7.879s) > Enter [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:19:57.192 < Exit [It] should return status 502 for service type=ExternalName with an invalid host - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:153 @ 04/04/23 18:20:12.695 (15.504s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:12.695 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.536 (840ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:13.536 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:20.628 (7.092s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:20.628 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:20:28.704 (8.077s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:20:28.704 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:20:38.882 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:20:49.057 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:20:59.272 (30.567s) > Enter [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:20:59.272 STEP: Adding a global-auth-request-redirect to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:242 @ 04/04/23 18:20:59.272 < Exit [It] should set request-redirect when global-auth-request-redirect is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:237 @ 04/04/23 18:21:09.45 (10.178s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.45 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:09.625 (175ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:09.625 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:16.495 (6.87s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:16.495 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:21:20.516 (4.021s) > Enter [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:20.516 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:113 @ 04/04/23 18:21:37.731 STEP: checking if the Service Cluster IP and Port are not used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:120 @ 04/04/23 18:21:37.737 < Exit [It] should not use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:99 @ 04/04/23 18:21:37.9 (17.384s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:37.9 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:21:38.126 (226ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:38.126 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:21:46.024 (7.897s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:46.024 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:21:50.044 (4.02s) > Enter [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:21:50.044 < Exit [It] should return status code 200 for host 'foo' and 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:62 @ 04/04/23 18:22:00.233 (10.189s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.233 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:00.414 (181ms) - - - > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:00.414 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:07.306 (6.892s) > Enter [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:07.306 < Exit [BeforeEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:33 @ 04/04/23 18:22:18.341 (11.035s) > Enter [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:18.341 < Exit [It] should not configure log-format escape by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/log-format.go:40 @ 04/04/23 18:22:21.446 (3.105s) > Enter [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.446 < Exit [AfterEach] [Setting] log-format-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:21.733 (287ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:21.733 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:39.876 (2m18.143s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:39.876 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:24:47.956 (8.08s) > Enter [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:24:47.956 STEP: routing requests destined fro the mainline ingress to the mainline upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:288 @ 04/04/23 18:25:09.571 STEP: routing requests destined for the canary ingress to the canary upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:297 @ 04/04/23 18:25:09.578 < Exit [It] should route requests to the correct upstream if the mainline ingress is modified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:250 @ 04/04/23 18:25:09.586 (21.629s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.586 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:09.787 (201ms) - - - > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:09.787 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:16.668 (6.881s) > Enter [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:16.668 < Exit [BeforeEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:79 @ 04/04/23 18:25:24.696 (8.028s) > Enter [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:24.696 < Exit [It] should connect to the same subset of pods - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamhashby.go:92 @ 04/04/23 18:25:55.101 (30.405s) > Enter [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.101 < Exit [AfterEach] [Annotations] upstream-hash-by-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:55.343 (242ms) - - - > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:55.344 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:02.277 (6.934s) > Enter [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:02.277 < Exit [BeforeEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:32 @ 04/04/23 18:26:06.299 (4.021s) > Enter [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:06.299 < Exit [It] should redirect from HTTP to HTTPS when secret is missing - /go/src/k8s.io/ingress-nginx/test/e2e/ssl/http_redirect.go:36 @ 04/04/23 18:26:19.516 (13.217s) > Enter [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.516 < Exit [AfterEach] [SSL] redirect to HTTPS - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:19.717 (201ms) - - - > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:19.718 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:26.668 (6.951s) > Enter [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:26.668 < Exit [BeforeEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:31 @ 04/04/23 18:26:30.695 (4.027s) > Enter [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:26:30.695 < Exit [It] should add global server-snippet and drop annotations per admin config - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_snippet.go:92 @ 04/04/23 18:27:02.982 (32.287s) > Enter [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:02.982 < Exit [AfterEach] [Setting] configmap server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:03.156 (175ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:03.157 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:11.021 (7.864s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:11.021 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:27:15.049 (4.028s) > Enter [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:15.049 < Exit [It] should set cookie with expires - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:194 @ 04/04/23 18:27:25.315 (10.266s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.315 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:25.546 (231ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:25.547 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:32.464 (6.917s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:32.464 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:27:36.484 (4.02s) > Enter [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:36.484 < Exit [It] should allow - matching origin with wildcard origin (2 subdomains) - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:425 @ 04/04/23 18:27:43.52 (7.037s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.52 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:43.695 (175ms) - - - > Enter [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:43.696 < Exit [BeforeEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:50.592 (6.896s) > Enter [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:27:50.592 < Exit [It] should be enabled when set to true - /go/src/k8s.io/ingress-nginx/test/e2e/settings/multi_accept.go:39 @ 04/04/23 18:28:00.821 (10.229s) > Enter [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:00.821 < Exit [AfterEach] [Setting] enable-multi-accept - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:01.043 (221ms) - - - > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:01.043 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:08.918 (7.875s) > Enter [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:08.918 < Exit [BeforeEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:32 @ 04/04/23 18:28:12.942 (4.024s) > Enter [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:12.942 < Exit [It] [BAD_ANNOTATIONS] should allow an ingress if there is a default blocklist config in place - /go/src/k8s.io/ingress-nginx/test/e2e/settings/badannotationvalues.go:102 @ 04/04/23 18:28:31.293 (18.352s) > Enter [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.293 < Exit [AfterEach] [Annotations] Bad annotation values - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:31.512 (218ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:31.512 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:38.394 (6.882s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:38.394 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:28:46.454 (8.06s) > Enter [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:61 @ 04/04/23 18:28:46.454 STEP: Adding an ingress rule for /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:69 @ 04/04/23 18:28:56.618 STEP: Adding a global-auth-url to configMap - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:77 @ 04/04/23 18:29:06.764 < Exit [BeforeEach] when global external authentication is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:58 @ 04/04/23 18:29:16.991 (30.537s) > Enter [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:16.991 STEP: Adding an ingress rule for /bar with annotation enable-global-auth = false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:128 @ 04/04/23 18:29:16.991 STEP: Sending a request to protected service /foo - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:140 @ 04/04/23 18:29:21.174 STEP: Sending a request to whitelisted service /bar - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:147 @ 04/04/23 18:29:21.184 < Exit [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:126 @ 04/04/23 18:29:21.191 (4.2s) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.191 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:21.411 (220ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:21.411 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:28.853 (7.441s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:28.853 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:29:43.082 (14.23s) > Enter [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:43.082 < Exit [It] handles an annotation change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:171 @ 04/04/23 18:29:49.435 (6.352s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.435 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:49.619 (185ms) - - - > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:49.62 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:56.496 (6.875s) > Enter [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:29:56.496 < Exit [BeforeEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:34 @ 04/04/23 18:30:00.515 (4.019s) > Enter [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:00.515 < Exit [It] should exists Server header in the response when is enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/server_tokens.go:50 @ 04/04/23 18:30:17.68 (17.166s) > Enter [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.68 < Exit [AfterEach] [Setting] server-tokens - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:17.86 (179ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:17.86 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:24.767 (6.907s) > Enter [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:24.767 < Exit [It] works with external name set to incomplete fqdn - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:62 @ 04/04/23 18:30:38.985 (14.218s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:38.985 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:39.203 (218ms) - - - > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:39.204 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:47.098 (7.895s) > Enter [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:47.098 < Exit [BeforeEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:33 @ 04/04/23 18:30:51.122 (4.023s) > Enter [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:30:51.122 < Exit [It] should list the backend servers - /go/src/k8s.io/ingress-nginx/test/e2e/dbg/main.go:37 @ 04/04/23 18:31:01.391 (10.269s) > Enter [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.391 < Exit [AfterEach] Debug CLI - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:01.582 (191ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:01.582 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:08.498 (6.915s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:08.498 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:31:16.564 (8.066s) > Enter [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:16.564 < Exit [It] does not crash when canary ingress has multiple paths to the same non-matching backend - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:915 @ 04/04/23 18:31:33.8 (17.236s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:33.8 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:34.042 (242ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:34.042 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:40.946 (6.904s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:40.946 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:31:44.981 (4.035s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:44.981 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:53 @ 04/04/23 18:31:55.094 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:60 @ 04/04/23 18:31:55.098 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:41 @ 04/04/23 18:31:55.252 (10.271s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.252 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:31:55.492 (240ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:31:55.493 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:02.366 (6.874s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:02.366 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:32:06.394 (4.028s) > Enter [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:06.394 < Exit [It] should enable modsecurity when enable-owasp-modsecurity-crs is set to true - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:225 @ 04/04/23 18:32:35.569 (29.175s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.569 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:35.753 (184ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:35.753 < Exit [BeforeEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.66 (6.907s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.66 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:53 @ 04/04/23 18:32:42.661 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy_volumes.go:40 @ 04/04/23 18:32:42.661 (1ms) > Enter [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.661 < Exit [AfterEach] [Security] Pod Security Policies with volumes - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:42.858 (197ms) - - - > Enter [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:42.858 < Exit [BeforeEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:32:49.722 (6.864s) > Enter [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:49.722 STEP: setting permanent-redirect-code annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:62 @ 04/04/23 18:32:49.722 STEP: sending request to redirected URL path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:82 @ 04/04/23 18:32:59.899 < Exit [It] should respond with a custom redirect code - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/redirect.go:61 @ 04/04/23 18:32:59.901 (10.18s) > Enter [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:32:59.901 < Exit [AfterEach] [Annotations] permanent-redirect permanent-redirect-code - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:00.105 (203ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:00.105 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:07.991 (7.886s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:07.991 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:33:19.06 (11.069s) > Enter [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:19.06 < Exit [It] should set proxy-headers-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:60 @ 04/04/23 18:33:29.206 (10.146s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.206 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:29.433 (227ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:29.433 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:36.312 (6.878s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:36.312 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:33:42.335 (6.023s) > Enter [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:42.335 < Exit [It] should allow correct origins - single origin for multiple cors values - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:216 @ 04/04/23 18:33:49.381 (7.046s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.381 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:33:49.571 (190ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:49.571 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:33:56.527 (6.956s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:33:56.527 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:00.557 (4.03s) > Enter [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:00.557 < Exit [It] should disable default modsecurity conf setting when modsecurity-snippet is specified - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:347 @ 04/04/23 18:34:22.694 (22.137s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.694 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:22.91 (216ms) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:22.91 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:29.807 (6.897s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.807 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:34:29.814 (6ms) > Enter [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:29.814 < Exit [It] should expose a TCP service - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:46 @ 04/04/23 18:34:36.97 (7.156s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:36.97 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:34:37.169 (200ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:37.17 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:34:45.073 (7.903s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:45.073 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:34:49.091 (4.018s) > Enter [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:34:49.091 < Exit [It] should enable modsecurity through the config map - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:264 @ 04/04/23 18:35:18.316 (29.225s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.316 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:18.518 (202ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:18.518 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:25.408 (6.889s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:25.408 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:35:36.46 (11.052s) > Enter [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:36.46 < Exit [It] reuse port should be enabled by default - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:38 @ 04/04/23 18:35:39.652 (3.192s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.652 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:35:39.91 (258ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:39.91 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:35:46.843 (6.933s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:46.843 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:35:50.861 (4.018s) > Enter [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:50.861 < Exit [BeforeEach] Without IngressClass Cluster scoped Permission - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:587 @ 04/04/23 18:35:58.882 (8.021s) > Enter [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:35:58.882 < Exit [It] should watch Ingress with correct annotation - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:631 @ 04/04/23 18:36:09.027 (10.145s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.027 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:09.241 (213ms) - - - > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:09.241 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:17.143 (7.901s) > Enter [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:17.143 < Exit [BeforeEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:31 @ 04/04/23 18:36:21.166 (4.023s) > Enter [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:21.166 < Exit [It] should return 404 when prefix /aaa does not match request /aaaccc - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/pathtype_prefix.go:35 @ 04/04/23 18:36:31.412 (10.246s) > Enter [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:31.412 < Exit [AfterEach] [Ingress] [PathType] prefix checks - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:32.055 (644ms) - - - > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:32.057 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:39.923 (7.865s) > Enter [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:39.923 < Exit [BeforeEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:32 @ 04/04/23 18:36:43.949 (4.026s) > Enter [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:43.949 < Exit [It] should set mirror-target to https://test.env.com/$request_uri - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/mirror.go:51 @ 04/04/23 18:36:54.141 (10.192s) > Enter [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.141 < Exit [AfterEach] [Annotations] mirror-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:36:54.342 (200ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:36:54.342 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:01.212 (6.87s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:01.212 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:37:07.231 (6.019s) > Enter [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:07.231 < Exit [It] should set valid auth-tls-secret, sslVerify to off, and sslVerifyDepth to 2 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:84 @ 04/04/23 18:37:17.855 (10.625s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:17.855 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:18.076 (221ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:18.076 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:25.984 (7.907s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:25.984 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:37:30.003 (4.019s) > Enter [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:30.003 < Exit [It] should work with use-regex annotation and session-cookie-path - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:270 @ 04/04/23 18:37:40.203 (10.201s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.203 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:40.453 (250ms) - - - > Enter [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:40.453 < Exit [BeforeEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:47.317 (6.864s) > Enter [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:47.317 < Exit [It] Add ssl ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ssl_ciphers.go:31 @ 04/04/23 18:37:57.514 (10.197s) > Enter [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.514 < Exit [AfterEach] [Setting] ssl-ciphers - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:37:57.725 (211ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:37:57.725 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:04.608 (6.883s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:04.608 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:38:08.636 (4.028s) > Enter [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:08.636 < Exit [It] should return status code 200 when authentication is configured and Authorization header is sent - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:172 @ 04/04/23 18:38:20.58 (11.945s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.58 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:20.761 (181ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:20.762 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:27.757 (6.995s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:27.757 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:38:31.784 (4.027s) > Enter [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:31.784 < Exit [It] should set proxy_redirect to hello.com goodbye.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:68 @ 04/04/23 18:38:41.901 (10.118s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:41.901 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:42.108 (207ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:42.108 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:50.04 (7.932s) > Enter [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:50.04 < Exit [It] use the default configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:32 @ 04/04/23 18:38:53.238 (3.198s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.238 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:38:53.443 (205ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:38:53.443 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:00.319 (6.876s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:00.319 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:39:04.344 (4.026s) > Enter [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:04.344 < Exit [It] should not exists opentracing directive - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:58 @ 04/04/23 18:39:21.438 (17.094s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.438 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:21.668 (229ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:39:21.668 (0s) - - - > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:21.67 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:29.901 (8.232s) > Enter [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:29.901 < Exit [BeforeEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:36 @ 04/04/23 18:39:40.966 (11.065s) > Enter [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:40.966 < Exit [It] should delete Ingress updated to catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_catch_all.go:81 @ 04/04/23 18:39:55.23 (14.264s) > Enter [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.23 < Exit [AfterEach] [Flag] disable-catch-all - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:39:55.411 (181ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:39:55.412 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:03.291 (7.88s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:03.291 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:40:11.34 (8.049s) > Enter [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:11.34 < Exit [It] should route requests only to mainline if canary weight is 0 - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:705 @ 04/04/23 18:40:31.758 (20.417s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.758 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:40:31.95 (192ms) - - - > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:31.951 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:40:39.859 (7.909s) > Enter [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:39.859 < Exit [BeforeEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:33 @ 04/04/23 18:40:47.913 (8.054s) > Enter [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:40:47.913 < Exit [It] should set the correct $service_name NGINX variable - /go/src/k8s.io/ingress-nginx/test/e2e/ingress/multiple_rules.go:38 @ 04/04/23 18:41:01.214 (13.301s) > Enter [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.214 < Exit [AfterEach] single ingress - multiple hosts - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:01.409 (195ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:19.256 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:04:27.796 (8.54s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:27.796 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:04:39.83 (12.034s) > Enter [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:39.83 < Exit [BeforeEach] With watch-ingress-without-class flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:462 @ 04/04/23 18:04:46.871 (7.041s) > Enter [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:04:46.871 < Exit [It] should watch Ingress with no class and ignore ingress with a different class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:482 @ 04/04/23 18:05:04.134 (17.262s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.134 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:04.398 (264ms) - - - > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:04.398 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:11.399 (7.001s) > Enter [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:11.399 < Exit [BeforeEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:36 @ 04/04/23 18:05:15.426 (4.027s) > Enter [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:15.426 STEP: checking if the service is reached - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:82 @ 04/04/23 18:05:32.603 STEP: checking if the Service Cluster IP and Port are used - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:89 @ 04/04/23 18:05:32.612 < Exit [It] should use the Service Cluster IP and Port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serviceupstream.go:70 @ 04/04/23 18:05:32.783 (17.357s) > Enter [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.783 < Exit [AfterEach] [Annotations] service-upstream - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:05:32.966 (182ms) - - - > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:32.966 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:05:40.858 (7.892s) > Enter [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:40.858 < Exit [BeforeEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:38 @ 04/04/23 18:05:52.924 (12.066s) > Enter [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:05:52.924 < Exit [It] should ignore services of external-name type - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_service_external_name.go:52 @ 04/04/23 18:06:13.273 (20.349s) > Enter [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.273 < Exit [AfterEach] [Flag] disable-service-external-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:13.49 (217ms) - - - > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:13.49 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:20.419 (6.929s) > Enter [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:20.419 < Exit [BeforeEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:38 @ 04/04/23 18:06:24.447 (4.029s) > Enter [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:24.447 < Exit [It] should configure satisfy directive correctly - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/satisfy.go:42 @ 04/04/23 18:06:41.792 (17.345s) > Enter [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.792 < Exit [AfterEach] [Annotations] satisfy - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:06:41.98 (187ms) - - - > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:41.98 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:06:49.854 (7.874s) > Enter [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:06:49.854 < Exit [BeforeEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:33 @ 04/04/23 18:07:00.907 (11.052s) > Enter [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:00.907 < Exit [It] should set keep alive connection timeout to upstream server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/keep-alive.go:68 @ 04/04/23 18:07:11.072 (10.166s) > Enter [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.073 < Exit [AfterEach] [Setting] keep-alive keep-alive-requests - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:11.276 (203ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:11.277 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:19.172 (7.895s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:19.172 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:07:28.212 (9.04s) > Enter [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:28.212 < Exit [It] should set vmap-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:100 @ 04/04/23 18:07:38.38 (10.168s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.38 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:07:38.612 (232ms) - - - > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:38.613 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:07:45.664 (7.051s) > Enter [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:45.664 < Exit [BeforeEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:31 @ 04/04/23 18:07:49.689 (4.025s) > Enter [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:07:49.689 < Exit [It] should apply the configmap load-balance setting - /go/src/k8s.io/ingress-nginx/test/e2e/loadbalance/configmap.go:35 @ 04/04/23 18:08:07.048 (17.358s) > Enter [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.048 < Exit [AfterEach] [Setting] [Load Balancer] load-balance - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:08:07.227 (180ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:08:07.228 < Exit [BeforeEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:25.86 (2m18.633s) > Enter [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:25.86 < Exit [It] authorization metadata should be overwritten by external auth response headers - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/grpc.go:126 @ 04/04/23 18:10:44.166 (18.305s) > Enter [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.166 < Exit [AfterEach] [Annotations] backend-protocol - GRPC - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:10:44.384 (218ms) - - - > Enter [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:44.385 < Exit [BeforeEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:10:51.27 (6.885s) > Enter [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:10:51.27 STEP: checking the service is updated to use eu.httpbin.org - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:304 @ 04/04/23 18:11:06.958 < Exit [It] should update the external name after a service update - /go/src/k8s.io/ingress-nginx/test/e2e/servicebackend/service_externalname.go:248 @ 04/04/23 18:11:07.097 (15.827s) > Enter [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.097 < Exit [AfterEach] [Service] Type ExternalName - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:07.302 (205ms) - - - > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:07.302 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:15.212 (7.91s) > Enter [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:15.212 < Exit [BeforeEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:33 @ 04/04/23 18:11:19.237 (4.025s) > Enter [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:19.237 < Exit [It] should set valid proxy-ssl-secret, proxy-ssl-verify to on, proxy-ssl-verify-depth to 2, and proxy-ssl-server-name to on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxyssl.go:64 @ 04/04/23 18:11:30.15 (10.913s) > Enter [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.15 < Exit [AfterEach] [Annotations] proxy-ssl-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:30.361 (211ms) - - - > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:30.361 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:37.259 (6.898s) > Enter [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:37.259 < Exit [BeforeEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:30 @ 04/04/23 18:11:39.287 (2.028s) > Enter [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:39.287 < Exit [It] set rewrite_log on - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/log.go:49 @ 04/04/23 18:11:49.482 (10.195s) > Enter [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.482 < Exit [AfterEach] [Annotations] enable-access-log enable-rewrite-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:11:49.703 (222ms) - - - > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:49.704 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:11:56.672 (6.968s) > Enter [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:11:56.672 < Exit [BeforeEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:32 @ 04/04/23 18:12:07.713 (11.041s) > Enter [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:07.713 < Exit [It] reuse port should be enabled - /go/src/k8s.io/ingress-nginx/test/e2e/settings/reuse-port.go:52 @ 04/04/23 18:12:17.909 (10.196s) > Enter [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:17.909 < Exit [AfterEach] [Setting] reuse-port - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:18.149 (239ms) - - - > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:18.149 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:26.102 (7.953s) > Enter [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:26.102 < Exit [BeforeEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:39 @ 04/04/23 18:12:34.143 (8.041s) > Enter [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:34.143 STEP: routing requests to the canary upstream when header value does not match and cookie is set to 'always' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:630 @ 04/04/23 18:12:51.301 < Exit [It] should route requests to the correct upstream - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/canary.go:604 @ 04/04/23 18:12:51.309 (17.166s) > Enter [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.309 < Exit [AfterEach] [Annotations] canary-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:12:51.494 (185ms) - - - > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:51.494 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:12:58.391 (6.897s) > Enter [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:12:58.391 < Exit [BeforeEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:31 @ 04/04/23 18:13:02.411 (4.02s) > Enter [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:02.411 < Exit [It] drops server snippet if disabled by the administrator - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/serversnippet.go:61 @ 04/04/23 18:13:31.674 (29.262s) > Enter [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.674 < Exit [AfterEach] [Annotations] server-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:31.873 (199ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:31.874 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:38.753 (6.879s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:38.753 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:67 @ 04/04/23 18:13:48.95 (10.197s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:48.95 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:49.177 (226ms) - - - - > Enter [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:49.177 < Exit [BeforeEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.081 (7.904s) > Enter [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.081 [SKIPPED] PSP not supported in this version In [It] at: /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:56 @ 04/04/23 18:13:57.084 < Exit [It] should be running with a Pod Security Policy - /go/src/k8s.io/ingress-nginx/test/e2e/settings/pod_security_policy.go:44 @ 04/04/23 18:13:57.084 (2ms) > Enter [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.084 < Exit [AfterEach] [Security] Pod Security Policies - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:13:57.316 (232ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:13:57.316 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:04.203 (6.887s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:04.203 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:14:08.231 (4.028s) > Enter [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:08.231 < Exit [It] should enable modsecurity with snippet and block requests - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:153 @ 04/04/23 18:14:30.484 (22.253s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.484 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:14:30.708 (223ms) - - - > Enter [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:30.708 < Exit [BeforeEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:14:37.628 (6.92s) > Enter [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:14:37.628 < Exit [It] should not create sync events - /go/src/k8s.io/ingress-nginx/test/e2e/settings/disable_sync_events.go:80 @ 04/04/23 18:15:00.832 (23.203s) > Enter [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:00.832 < Exit [AfterEach] [Flag] disable-sync-events - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:01.031 (199ms) - - - > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:01.031 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:07.953 (6.922s) > Enter [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:07.953 < Exit [BeforeEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:32 @ 04/04/23 18:15:11.978 (4.025s) > Enter [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:11.978 < Exit [It] should validate auth-tls-verify-client - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/authtls.go:206 @ 04/04/23 18:15:26.888 (14.91s) > Enter [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:26.888 < Exit [AfterEach] [Annotations] auth-tls-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:27.083 (195ms) - - - > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:27.083 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:34.978 (7.895s) > Enter [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:34.978 < Exit [BeforeEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:51 @ 04/04/23 18:15:39.01 (4.032s) > Enter [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:39.01 < Exit [It] should enable opentracing using zipkin - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:160 @ 04/04/23 18:15:59.042 (20.032s) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.042 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:15:59.301 (259ms) > Enter [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 < Exit [AfterEach] Configure OpenTracing - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentracing.go:55 @ 04/04/23 18:15:59.301 (0s) - - - > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:15:59.302 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:06.324 (7.022s) > Enter [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:06.324 < Exit [BeforeEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:41 @ 04/04/23 18:16:10.352 (4.028s) > Enter [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:10.352 STEP: configuring certificate_by_lua and skipping Nginx configuration of the new certificate - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:128 @ 04/04/23 18:16:28.235 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:136 @ 04/04/23 18:16:36.64 < Exit [BeforeEach] given an ingress with TLS correctly configured - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:113 @ 04/04/23 18:16:36.649 (26.297s) > Enter [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:36.649 STEP: serving the configured certificate on HTTPS endpoint - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:229 @ 04/04/23 18:16:41.653 < Exit [It] picks up a non-certificate only change - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_certificates.go:218 @ 04/04/23 18:16:41.686 (5.038s) > Enter [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.686 < Exit [AfterEach] [Lua] dynamic certificates - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:16:41.905 (219ms) - - - > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:41.905 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:16:48.792 (6.887s) > Enter [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:48.792 < Exit [BeforeEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:35 @ 04/04/23 18:16:59.851 (11.059s) > Enter [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:16:59.851 < Exit [It] should not trust X-Forwarded-For header when setting is false - /go/src/k8s.io/ingress-nginx/test/e2e/settings/enable_real_ip.go:78 @ 04/04/23 18:17:17.088 (17.237s) > Enter [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.088 < Exit [AfterEach] [Setting] enable-real-ip - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:17.268 (179ms) - - - > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:17.268 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:25.143 (7.875s) > Enter [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:25.143 < Exit [BeforeEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:45 @ 04/04/23 18:17:39.338 (14.195s) > Enter [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:39.338 < Exit [It] configures balancer Lua middleware correctly - /go/src/k8s.io/ingress-nginx/test/e2e/lua/dynamic_configuration.go:50 @ 04/04/23 18:17:45.709 (6.371s) > Enter [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.709 < Exit [AfterEach] [Lua] dynamic configuration - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:17:45.895 (186ms) - - - > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:45.896 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:17:52.77 (6.874s) > Enter [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:17:52.77 < Exit [BeforeEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:51 @ 04/04/23 18:18:00.824 (8.054s) > Enter [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:00.824 < Exit [BeforeEach] cookie set by external authentication server - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:301 @ 04/04/23 18:18:29.039 (28.216s) > Enter [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.039 < Exit [It] user does not retain cookie if upstream returns error status code - /go/src/k8s.io/ingress-nginx/test/e2e/settings/global_external_auth.go:337 @ 04/04/23 18:18:29.048 (9ms) > Enter [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.048 < Exit [AfterEach] [Setting] [Security] global-auth-url - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:29.27 (222ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:29.27 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:36.638 (7.367s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:36.638 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:18:40.656 (4.018s) > Enter [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:40.656 < Exit [It] should allow - single origin with required port - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:358 @ 04/04/23 18:18:47.695 (7.04s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.695 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:18:47.919 (224ms) - - - > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:47.919 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:18:54.793 (6.873s) > Enter [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:54.793 < Exit [BeforeEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:31 @ 04/04/23 18:18:58.818 (4.026s) > Enter [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:18:58.818 < Exit [It] drops snippet "more_set_headers "Foo1: Bar1";" in all locations if disabled by admin" - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/snippet.go:58 @ 04/04/23 18:19:28.082 (29.263s) > Enter [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.082 < Exit [AfterEach] [Annotations] configuration-snippet - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:28.561 (479ms) - - - > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:28.561 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:36.485 (7.924s) > Enter [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:36.485 < Exit [BeforeEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:30 @ 04/04/23 18:19:40.514 (4.029s) > Enter [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:40.514 < Exit [It] set host to upstreamvhost.bar.com - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/upstreamvhost.go:34 @ 04/04/23 18:19:50.715 (10.201s) > Enter [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.715 < Exit [AfterEach] [Annotations] upstream-vhost - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:19:50.928 (213ms) - - - > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:50.928 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:19:59.376 (8.447s) > Enter [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:19:59.376 < Exit [BeforeEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:32 @ 04/04/23 18:20:03.412 (4.036s) > Enter [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:03.412 < Exit [It] should turn on proxy-buffering - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/proxy.go:157 @ 04/04/23 18:20:13.859 (10.448s) > Enter [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:13.859 < Exit [AfterEach] [Annotations] proxy-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:20:15.468 (1.608s) - - - > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:20:15.468 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:32.896 (2m17.428s) > Enter [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.896 < Exit [BeforeEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:42 @ 04/04/23 18:22:32.905 (9ms) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:32.905 STEP: setting up a first deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:171 @ 04/04/23 18:22:32.905 STEP: updating the tcp service to a second deployment - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:196 @ 04/04/23 18:22:40.099 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/tcpudp/tcp.go:169 @ 04/04/23 18:22:50.31 (17.405s) > Enter [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.31 < Exit [AfterEach] [TCP] tcp-services - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:22:50.534 (224ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:50.534 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:22:57.402 (6.868s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:22:57.402 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:23:01.417 (4.015s) > Enter [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:01.417 < Exit [It] should not break functionality - without `*` - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:291 @ 04/04/23 18:23:08.429 (7.012s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.429 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:08.611 (182ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:08.611 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:15.499 (6.888s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:15.499 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:23:19.526 (4.026s) > Enter [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:19.526 < Exit [It] should set secure in cookie with provided false annotation on https - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:458 @ 04/04/23 18:23:29.716 (10.19s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.716 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:29.948 (233ms) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:29.949 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:36.837 (6.888s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:36.837 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:23:40.864 (4.027s) > Enter [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:40.864 < Exit [It] should return status code 401 when authentication is configured and Authorization header is sent with invalid credentials - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:116 @ 04/04/23 18:23:51.976 (11.112s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:51.976 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:23:52.182 (206ms) - - - > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:23:52.183 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:00.596 (8.414s) > Enter [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:00.596 < Exit [BeforeEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:40 @ 04/04/23 18:24:04.625 (4.028s) > Enter [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:04.625 < Exit [It] should exists opentelemetry_operation_name directive when is configured - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:104 @ 04/04/23 18:24:21.864 (17.239s) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:21.864 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:22.288 (424ms) > Enter [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 < Exit [AfterEach] Configure Opentelemetry - /go/src/k8s.io/ingress-nginx/test/e2e/settings/opentelemetry.go:44 @ 04/04/23 18:24:22.288 (0s) - - - > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:22.289 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:30.179 (7.89s) > Enter [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:30.179 < Exit [BeforeEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:42 @ 04/04/23 18:24:32.201 (2.022s) > Enter [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:32.201 < Exit [It] should set cache_key when external auth cache is configured - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/auth.go:322 @ 04/04/23 18:24:42.391 (10.19s) > Enter [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.391 < Exit [AfterEach] [Annotations] auth-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:24:42.559 (169ms) - - - > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:42.559 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:24:49.462 (6.902s) > Enter [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:49.462 < Exit [BeforeEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:38 @ 04/04/23 18:24:55.483 (6.021s) > Enter [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:24:55.483 < Exit [It] should work with server-alias annotation - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/affinity.go:372 @ 04/04/23 18:25:05.677 (10.194s) > Enter [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.677 < Exit [AfterEach] [Annotations] affinity session-cookie-name - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:05.892 (215ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:05.892 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:12.767 (6.875s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:12.767 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:54 @ 04/04/23 18:25:22.853 (10.086s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:22.853 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:23.038 (186ms) - - - > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:23.039 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:30.928 (7.889s) > Enter [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:30.928 < Exit [BeforeEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:30 @ 04/04/23 18:25:34.955 (4.027s) > Enter [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:34.955 < Exit [It] should set backend protocol to $scheme:// and use proxy_pass - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/backendprotocol.go:49 @ 04/04/23 18:25:45.122 (10.167s) > Enter [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.122 < Exit [AfterEach] [Annotations] backend-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:25:45.378 (256ms) - - - > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:45.378 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:25:52.259 (6.88s) > Enter [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:52.259 < Exit [BeforeEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:47 @ 04/04/23 18:25:56.284 (4.026s) > Enter [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:25:56.284 < Exit [BeforeEach] With ingress-class-by-name flag - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:518 @ 04/04/23 18:26:05.326 (9.041s) > Enter [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:05.326 < Exit [It] should watch Ingress that uses the class name even if spec is different - /go/src/k8s.io/ingress-nginx/test/e2e/settings/ingress_class.go:539 @ 04/04/23 18:26:29.579 (24.254s) > Enter [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.579 < Exit [AfterEach] [Flag] ingress-class - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:29.795 (215ms) - - - > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:29.795 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:36.671 (6.876s) > Enter [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:36.671 < Exit [BeforeEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:31 @ 04/04/23 18:26:40.694 (4.023s) > Enter [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:40.694 < Exit [It] should not match - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/cors.go:338 @ 04/04/23 18:26:47.715 (7.021s) > Enter [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.715 < Exit [AfterEach] [Annotations] cors-* - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:26:47.897 (182ms) - - - > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:47.898 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:26:54.79 (6.892s) > Enter [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:54.79 < Exit [BeforeEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:32 @ 04/04/23 18:26:58.813 (4.023s) > Enter [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:26:58.813 STEP: adding a whitelist-source-range - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:42 @ 04/04/23 18:27:05.828 STEP: changing error-log-level - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:61 @ 04/04/23 18:27:16.071 < Exit [It] should reload after an update in the configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/configmap_change.go:36 @ 04/04/23 18:27:29.359 (30.546s) > Enter [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.359 < Exit [AfterEach] [Setting] Configmap change - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:29.558 (198ms) - - - > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:29.558 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:36.431 (6.873s) > Enter [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:36.431 < Exit [BeforeEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:32 @ 04/04/23 18:27:47.466 (11.035s) > Enter [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:47.466 < Exit [It] should set variables-hash-bucket-size - /go/src/k8s.io/ingress-nginx/test/e2e/settings/hash-size.go:80 @ 04/04/23 18:27:57.638 (10.172s) > Enter [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.638 < Exit [AfterEach] [Setting] hash size - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:27:57.835 (197ms) - - - > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:27:57.835 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:04.708 (6.873s) > Enter [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:04.708 < Exit [BeforeEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:40 @ 04/04/23 18:28:20.208 (15.5s) > Enter [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:20.208 STEP: making sure new ingress is deployed - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:68 @ 04/04/23 18:28:27.228 STEP: making sure new ingress is responding - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:74 @ 04/04/23 18:28:30.423 STEP: making sure the configured default ssl certificate is being used - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:76 @ 04/04/23 18:28:30.423 < Exit [It] uses default ssl certificate for catch-all ingress - /go/src/k8s.io/ingress-nginx/test/e2e/settings/default_ssl_certificate.go:64 @ 04/04/23 18:28:32.435 (12.227s) > Enter [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.435 < Exit [AfterEach] [SSL] [Flag] default-ssl-certificate - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:32.615 (181ms) - - - > Enter [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:32.616 < Exit [BeforeEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:39.497 (6.882s) > Enter [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:39.497 < Exit [It] use the specified configuration - /go/src/k8s.io/ingress-nginx/test/e2e/settings/access_log.go:42 @ 04/04/23 18:28:49.668 (10.171s) > Enter [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.669 < Exit [AfterEach] [Setting] access-log - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:28:49.884 (215ms) - - - > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:49.884 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:28:56.783 (6.899s) > Enter [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:28:56.783 < Exit [BeforeEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:31 @ 04/04/23 18:29:00.81 (4.027s) > Enter [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:00.81 < Exit [It] should enable modsecurity - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/modsecurity/modsecurity.go:35 @ 04/04/23 18:29:10.998 (10.189s) > Enter [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:10.998 < Exit [AfterEach] [Annotations] modsecurity owasp - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:29:11.21 (212ms) - - - > Enter [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:11.211 < Exit [BeforeEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:29:19.1 (7.89s) > Enter [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:29:19.1 < Exit [It] /healthz should return status code 500 during shutdown grace period - /go/src/k8s.io/ingress-nginx/test/e2e/gracefulshutdown/grace_period.go:35 @ 04/04/23 18:30:30.168 (1m11.068s) > Enter [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.168 < Exit [AfterEach] [Shutdown] Grace period shutdown - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:30.345 (177ms) - - - > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:30.345 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:37.278 (6.932s) > Enter [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:37.278 < Exit [BeforeEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:32 @ 04/04/23 18:30:41.303 (4.025s) > Enter [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:41.303 < Exit [It] should return status code 200 for host 'foo' and 404 for 'bar' - /go/src/k8s.io/ingress-nginx/test/e2e/annotations/alias.go:36 @ 04/04/23 18:30:51.481 (10.178s) > Enter [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.481 < Exit [AfterEach] [Annotations] server-alias - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:30:51.683 (202ms) - - - > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:51.684 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:83 @ 04/04/23 18:30:58.618 (6.934s) > Enter [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:30:58.618 < Exit [BeforeEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:41 @ 04/04/23 18:31:09.663 (11.045s) > Enter [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:31:09.663 Automatically polling progress: [Setting] use-proxy-protocol should enable PROXY Protocol for TCP (Spec Runtime: 3m17.98s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 In [It] (Node Runtime: 3m0.001s) /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 Spec Goroutine goroutine 2932 [IO wait, 3 minutes] internal/poll.runtime_pollWait(0x7f9e883a91b8, 0x72) /usr/local/go/src/runtime/netpoll.go:306 internal/poll.(*pollDesc).wait(0xc0000de300?, 0xc00098a926?, 0x0) /usr/local/go/src/internal/poll/fd_poll_runtime.go:84 internal/poll.(*pollDesc).waitRead(...) /usr/local/go/src/internal/poll/fd_poll_runtime.go:89 internal/poll.(*FD).Read(0xc0000de300, {0xc00098a926, 0x15a, 0x15a}) /usr/local/go/src/internal/poll/fd_unix.go:167 net.(*netFD).Read(0xc0000de300, {0xc00098a926?, 0x453656?, 0x380?}) /usr/local/go/src/net/fd_posix.go:55 net.(*conn).Read(0xc000516660, {0xc00098a926?, 0x19913c0?, 0xc00098a700?}) /usr/local/go/src/net/net.go:183 io.ReadAll({0x1f62de0, 0xc000516660}) /usr/local/go/src/io/io.go:701 > k8s.io/ingress-nginx/test/e2e/settings.glob..func38.5() /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:211 github.com/onsi/ginkgo/v2/internal.extractBodyFunction.func3({0xa0558e, 0xc000300a80}) /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/node.go:463 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode.func3() /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:863 github.com/onsi/ginkgo/v2/internal.(*Suite).runNode /go/src/k8s.io/ingress-nginx/.modcache/github.com/onsi/ginkgo/v2@v2.9.0/internal/suite.go:850 < Exit [It] should enable PROXY Protocol for TCP - /go/src/k8s.io/ingress-nginx/test/e2e/settings/proxy_protocol.go:155 @ 04/04/23 18:41:24.726 (10m15.064s) > Enter [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.726 < Exit [AfterEach] [Setting] use-proxy-protocol - /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:84 @ 04/04/23 18:41:24.943 (217ms) - - - \ No newline at end of file From ad1fb03f002d6378a9293e08c2c9163030f9287c Mon Sep 17 00:00:00 2001 From: Nicholas Orlowsky Date: Thu, 11 May 2023 21:06:52 -0400 Subject: [PATCH 179/822] remove linux tag --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 357ef9827..6037ac39d 100644 --- a/Makefile +++ b/Makefile @@ -167,7 +167,7 @@ kind-e2e-chart-tests: ## Run helm chart e2e tests e2e-test-binary: ## Build binary for e2e tests. @build/run-in-docker.sh \ MAC_OS=$(MAC_OS) \ - ginkgo build ./test/e2e -tags linux + ginkgo build ./test/e2e .PHONY: print-e2e-suite print-e2e-suite: e2e-test-binary ## Prints information about the suite of e2e tests. From bbf70c2a96999cc08194e31ea18d8baf5079aba7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 08:24:30 -0700 Subject: [PATCH 180/822] Bump google.golang.org/grpc from 1.54.0 to 1.55.0 (#9936) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.54.0 to 1.55.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.54.0...v1.55.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 9de23ba1a..0a03e522b 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,7 @@ require ( github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a golang.org/x/crypto v0.8.0 - google.golang.org/grpc v1.54.0 + google.golang.org/grpc v1.55.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 gopkg.in/mcuadros/go-syslog.v2 v2.3.0 @@ -102,14 +102,14 @@ require ( go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.8.0 // indirect golang.org/x/net v0.9.0 // indirect - golang.org/x/oauth2 v0.5.0 // indirect + golang.org/x/oauth2 v0.6.0 // indirect golang.org/x/sys v0.7.0 // indirect golang.org/x/term v0.7.0 // indirect golang.org/x/text v0.9.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.6.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect + google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect google.golang.org/protobuf v1.30.0 // indirect gopkg.in/go-playground/assert.v1 v1.2.1 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go.sum b/go.sum index da99bd248..e602f477b 100644 --- a/go.sum +++ b/go.sum @@ -468,8 +468,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.5.0 h1:HuArIo48skDwlrvM3sEdHXElYslAMsf3KwRkkW4MC4s= -golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I= +golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw= +golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -650,8 +650,8 @@ google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6D google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= -google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f h1:BWUVssLB0HVOSY78gIdvk1dTVYtT1y8SBWtPYuTJ/6w= -google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM= +google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 h1:DdoeryqhaXp1LtT/emMP1BRJPHHKFi5akj/nbx/zNTA= +google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= @@ -664,8 +664,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= -google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag= -google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g= +google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag= +google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 h1:pPsdyuBif+uoyUoL19yuj/TCfUPsmpJHJZhWQ98JGLU= google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7/go.mod h1:8pQa1yxxkh+EsxUK8/455D5MSbv3vgmEJqKCH3y17mI= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= From 0dd1cf74600a49ccb5b416da5f3fe7b96ef40d06 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 19 May 2023 08:26:30 -0700 Subject: [PATCH 181/822] Bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 (#9937) Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.3.0 to 0.4.0. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](https://github.com/prometheus/client_model/compare/v0.3.0...v0.4.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0a03e522b..58b647b40 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/opencontainers/runc v1.1.7 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.15.0 - github.com/prometheus/client_model v0.3.0 + github.com/prometheus/client_model v0.4.0 github.com/prometheus/common v0.42.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 diff --git a/go.sum b/go.sum index e602f477b..908b21594 100644 --- a/go.sum +++ b/go.sum @@ -311,8 +311,8 @@ github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1: github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4= -github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w= +github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY= +github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= From c540b584745ac47b45f859c5db52e6b7a612a9c6 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Sat, 20 May 2023 08:58:18 -0300 Subject: [PATCH 182/822] Validate path types (#9967) * Validate path types * Fix the year of header * Update internal/ingress/controller/config/config.go Co-authored-by: Jintao Zhang --------- Co-authored-by: Jintao Zhang --- .../nginx-configuration/configmap.md | 15 ++ internal/ingress/controller/config/config.go | 7 + internal/ingress/controller/controller.go | 9 + internal/ingress/inspector/inspector.go | 29 +++ internal/ingress/inspector/inspector_test.go | 191 ++++++++++++++++++ internal/ingress/inspector/rules.go | 8 + test/e2e/admission/admission.go | 37 ++++ 7 files changed, 296 insertions(+) create mode 100644 internal/ingress/inspector/inspector_test.go diff --git a/docs/user-guide/nginx-configuration/configmap.md b/docs/user-guide/nginx-configuration/configmap.md index ccb115a0f..782b9bc92 100644 --- a/docs/user-guide/nginx-configuration/configmap.md +++ b/docs/user-guide/nginx-configuration/configmap.md @@ -229,6 +229,7 @@ The following table shows a configuration option's name, type, and the default v |[service-upstream](#service-upstream)|bool|"false"| |[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"| |[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"| +|[strict-validate-path-type](#strict-validate-path-type)|bool|"false" (v1.7.x)| ## add-headers @@ -1379,3 +1380,17 @@ _**default:**_ "" _References:_ [http://nginx.org/en/docs/ngx_core_module.html#debug_connection](http://nginx.org/en/docs/ngx_core_module.html#debug_connection) + +## strict-validate-path-type +Ingress objects contains a field called pathType that defines the proxy behavior. It can be `Exact`, `Prefix` and `ImplementationSpecific`. + +When pathType is configured as `Exact` or `Prefix`, there should be a more strict validation, allowing only paths starting with "/" and +containing only alphanumeric characters and "-", "_" and additional "/". + +When this option is enabled, the validation will happen on the Admission Webhook, making any Ingress not using pathType `ImplementationSpecific` +and containing invalid characters to be denied. + +This means that Ingress objects that rely on paths containing regex characters should use `ImplementationSpecific` pathType. + +The cluster admin should establish validation rules using mechanisms like [Open Policy Agent](https://www.openpolicyagent.org/) to +validate that only authorized users can use `ImplementationSpecific` pathType and that only the authorized characters can be used. diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index da37ea3c9..fafb76ce5 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -830,6 +830,12 @@ type Configuration struct { // http://nginx.org/en/docs/ngx_core_module.html#debug_connection // Default: "" DebugConnections []string `json:"debug-connections"` + + // StrictValidatePathType enable the strict validation of Ingress Paths + // It enforces that pathType of type Exact or Prefix should start with / and contain only + // alphanumeric chars, "-", "_", "/".In case of additional characters, + // like used on Rewrite configurations the user should use pathType as ImplementationSpecific + StrictValidatePathType bool `json:"strict-validate-path-type"` } // NewDefault returns the default nginx configuration @@ -1002,6 +1008,7 @@ func NewDefault() Configuration { GlobalRateLimitMemcachedPoolSize: 50, GlobalRateLimitStatucCode: 429, DebugConnections: []string{}, + StrictValidatePathType: false, // TODO: This will be true in future releases } if klog.V(5).Enabled() { diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 80b5b587b..49e8aa0bb 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -270,11 +270,13 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { if !ing.DeletionTimestamp.IsZero() { return nil } + if n.cfg.DeepInspector { if err := inspector.DeepInspect(ing); err != nil { return fmt.Errorf("invalid object: %w", err) } } + // Do not attempt to validate an ingress that's not meant to be controlled by the current instance of the controller. if ingressClass, err := n.store.GetIngressClass(ing, n.cfg.IngressClassConfiguration); ingressClass == "" { klog.Warningf("ignoring ingress %v in %v based on annotation %v: %v", ing.Name, ing.ObjectMeta.Namespace, ingressClass, err) @@ -293,6 +295,13 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { cfg := n.store.GetBackendConfiguration() cfg.Resolver = n.resolver + // Adds the pathType Validation + if cfg.StrictValidatePathType { + if err := inspector.ValidatePathType(ing); err != nil { + return fmt.Errorf("ingress contains invalid paths: %w", err) + } + } + var arrayBadWords []string if cfg.AnnotationValueWordBlocklist != "" { diff --git a/internal/ingress/inspector/inspector.go b/internal/ingress/inspector/inspector.go index e7b6c2f10..23b57e538 100644 --- a/internal/ingress/inspector/inspector.go +++ b/internal/ingress/inspector/inspector.go @@ -17,6 +17,9 @@ limitations under the License. package inspector import ( + "errors" + "fmt" + corev1 "k8s.io/api/core/v1" networking "k8s.io/api/networking/v1" "k8s.io/klog/v2" @@ -36,3 +39,29 @@ func DeepInspect(obj interface{}) error { return nil } } + +var ( + implSpecific = networking.PathTypeImplementationSpecific +) + +func ValidatePathType(ing *networking.Ingress) error { + if ing == nil { + return fmt.Errorf("received null ingress") + } + var err error + for _, rule := range ing.Spec.Rules { + if rule.HTTP != nil { + for _, path := range rule.HTTP.Paths { + if path.Path == "" { + continue + } + if path.PathType == nil || *path.PathType != implSpecific { + if isValid := validPathType.MatchString(path.Path); !isValid { + err = errors.Join(err, fmt.Errorf("path %s cannot be used with pathType %s", path.Path, string(*path.PathType))) + } + } + } + } + } + return err +} diff --git a/internal/ingress/inspector/inspector_test.go b/internal/ingress/inspector/inspector_test.go new file mode 100644 index 000000000..36b029cff --- /dev/null +++ b/internal/ingress/inspector/inspector_test.go @@ -0,0 +1,191 @@ +/* +Copyright 2023 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package inspector + +import ( + "errors" + "fmt" + "testing" + + networking "k8s.io/api/networking/v1" +) + +var ( + exact = networking.PathTypeExact + prefix = networking.PathTypePrefix +) + +var ( + validIngress = &networking.Ingress{ + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/test", + }, + { + PathType: &prefix, + Path: "/xpto/ab0/x_ss-9", + }, + { + PathType: &exact, + Path: "/bla/", + }, + }, + }, + }, + }, + }, + }, + } + + emptyIngress = &networking.Ingress{ + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + PathType: &exact, + }, + }, + }, + }, + }, + }, + }, + } + + invalidIngress = &networking.Ingress{ + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + PathType: &exact, + Path: "/foo.+", + }, + { + PathType: &exact, + Path: "xpto/lala", + }, + { + PathType: &exact, + Path: "/xpto/lala", + }, + { + PathType: &prefix, + Path: "/foo/bar/[a-z]{3}", + }, + { + PathType: &prefix, + Path: "/lala/xp\ntest", + }, + }, + }, + }, + }, + }, + }, + } + + validImplSpecific = &networking.Ingress{ + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + PathType: &implSpecific, + Path: "/foo.+", + }, + { + PathType: &implSpecific, + Path: "xpto/lala", + }, + }, + }, + }, + }, + }, + }, + } +) + +var aErr = func(s, pathType string) error { + return fmt.Errorf("path %s cannot be used with pathType %s", s, pathType) +} + +func TestValidatePathType(t *testing.T) { + tests := []struct { + name string + ing *networking.Ingress + wantErr bool + err error + }{ + { + name: "nil should return an error", + ing: nil, + wantErr: true, + err: fmt.Errorf("received null ingress"), + }, + { + name: "valid should not return an error", + ing: validIngress, + wantErr: false, + }, + { + name: "empty should not return an error", + ing: emptyIngress, + wantErr: false, + }, + { + name: "empty should not return an error", + ing: validImplSpecific, + wantErr: false, + }, + { + name: "invalid should return multiple errors", + ing: invalidIngress, + wantErr: true, + err: errors.Join( + aErr("/foo.+", "Exact"), + aErr("xpto/lala", "Exact"), + aErr("/foo/bar/[a-z]{3}", "Prefix"), + aErr("/lala/xp\ntest", "Prefix"), + ), + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := ValidatePathType(tt.ing) + if (err != nil) != tt.wantErr { + t.Errorf("ValidatePathType() error = %v, wantErr %v", err, tt.wantErr) + } + if (err != nil && tt.err != nil) && tt.err.Error() != err.Error() { + t.Errorf("received invalid error: want = %v, expected %v", tt.err, err) + } + }) + } +} diff --git a/internal/ingress/inspector/rules.go b/internal/ingress/inspector/rules.go index ab573b7fe..c9714e680 100644 --- a/internal/ingress/inspector/rules.go +++ b/internal/ingress/inspector/rules.go @@ -28,6 +28,14 @@ var ( invalidSecretsDir = regexp.MustCompile(`/var/run/secrets`) invalidByLuaDirective = regexp.MustCompile(`.*_by_lua.*`) + // validPathType enforces alphanumeric, -, _ and / characters. + // The field (?i) turns this regex case insensitive + // The remaining regex says that the string must start with a "/" (^/) + // the group [[:alnum:]\_\-\/]* says that any amount of characters (A-Za-z0-9), _, - and / + // are accepted until the end of the line + // Nothing else is accepted. + validPathType = regexp.MustCompile(`(?i)^/[[:alnum:]\_\-\/]*$`) + invalidRegex = []regexp.Regexp{} ) diff --git a/test/e2e/admission/admission.go b/test/e2e/admission/admission.go index 4a4e31980..0ee8248b0 100644 --- a/test/e2e/admission/admission.go +++ b/test/e2e/admission/admission.go @@ -30,6 +30,8 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/ingress-nginx/test/e2e/framework" + + networking "k8s.io/api/networking/v1" ) var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", func() { @@ -161,6 +163,41 @@ var _ = framework.IngressNginxDescribeSerial("[Admission] admission controller", assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid annotation value should return an error") }) + ginkgo.It("should return an error if there is an invalid path and wrong pathType is set", func() { + host := "path-validation" + var ( + exactPathType = networking.PathTypeExact + prefixPathType = networking.PathTypePrefix + implSpecific = networking.PathTypeImplementationSpecific + ) + + f.UpdateNginxConfigMapData("strict-validate-path-type", "true") + + invalidPath := framework.NewSingleIngress("first-ingress", "/foo/bar/[a-z]{3}", host, f.Namespace, framework.EchoService, 80, nil) + invalidPath.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &exactPathType + + _, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), invalidPath, metav1.CreateOptions{}) + assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid path value should return an error") + + invalidPath.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &prefixPathType + _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), invalidPath, metav1.CreateOptions{}) + assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid path value should return an error") + + annotations := map[string]string{ + "nginx.ingress.kubernetes.io/use-regex": "true", + "nginx.ingress.kubernetes.io/rewrite-target": "/new/backend", + } + pathSpecific := framework.NewSingleIngress("pathspec-ingress", "/foo/bar/[a-z]{3}", host, f.Namespace, framework.EchoService, 80, annotations) + pathSpecific.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &implSpecific + _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), pathSpecific, metav1.CreateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with arbitrary path and implSpecific value should not return an error") + + validPath := framework.NewSingleIngress("second-ingress", "/bloblo", host, f.Namespace, framework.EchoService, 80, nil) + _, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), validPath, metav1.CreateOptions{}) + assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with valid path should not return an error") + + }) + ginkgo.It("should not return an error if the Ingress V1 definition is valid with Ingress Class", func() { out, err := createIngress(f.Namespace, validV1Ingress) assert.Equal(ginkgo.GinkgoT(), "ingress.networking.k8s.io/extensions created\n", out) From 0cb3dcfd5c313305bf36924c300572dbd7f07fc1 Mon Sep 17 00:00:00 2001 From: hongzhouzi <36416216+hongzhouzi@users.noreply.github.com> Date: Sun, 21 May 2023 06:26:18 +0800 Subject: [PATCH 183/822] fix: avoid builds and tests for changes to markdown (#9962) --- .github/workflows/ci.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 19d39ab70..862a0604a 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -7,6 +7,7 @@ on: paths-ignore: - 'docs/**' - 'deploy/**' + - '**.md' push: branches: @@ -14,6 +15,7 @@ on: paths-ignore: - 'docs/**' - 'deploy/**' + - '**.md' workflow_dispatch: inputs: From 4d57ddb5faf9c0899a0b11ca7a15777c2cc5dba8 Mon Sep 17 00:00:00 2001 From: fergusean Date: Sun, 21 May 2023 07:08:20 -0400 Subject: [PATCH 184/822] Correct annotations in monitoring docs (#9976) --- docs/user-guide/monitoring.md | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/docs/user-guide/monitoring.md b/docs/user-guide/monitoring.md index 1e30e556f..28608e850 100644 --- a/docs/user-guide/monitoring.md +++ b/docs/user-guide/monitoring.md @@ -39,10 +39,9 @@ This tutorial will show you how to install [Prometheus](https://prometheus.io/) controller: metrics: enabled: true - service: - annotations: - prometheus.io/port: "10254" - prometheus.io/scrape: "true" + podAnnotations: + prometheus.io/port: "10254" + prometheus.io/scrape: "true" .. ``` - If you are **not using helm**, you will have to edit your manifests like this: @@ -50,10 +49,6 @@ This tutorial will show you how to install [Prometheus](https://prometheus.io/) ``` apiVersion: v1 kind: Service - metadata: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "10254" .. spec: ports: @@ -67,16 +62,20 @@ This tutorial will show you how to install [Prometheus](https://prometheus.io/) ``` apiVersion: v1 kind: Deployment - metadata: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "10254" .. spec: - ports: - - name: prometheus - containerPort: 10254 - .. + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "10254" + spec: + containers: + - name: controller + ports: + - name: prometheus + containerPort: 10254 + .. ``` From ac9a50751e98f3ef5f42102a61721b8c44b6426f Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Sun, 21 May 2023 19:04:19 +0200 Subject: [PATCH 185/822] OpenTelemetry default config (#9978) --- internal/ingress/controller/config/config.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/internal/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go index fafb76ce5..ad4bebde0 100644 --- a/internal/ingress/controller/config/config.go +++ b/internal/ingress/controller/config/config.go @@ -596,7 +596,7 @@ type Configuration struct { OtelServiceName string `json:"otel-service-name"` // OtelSampler specifies the sampler to use for any traces created - // Default: AlwaysOff + // Default: AlwaysOn OtelSampler string `json:"otel-sampler"` // OtelSamplerRatio specifies the sampler ratio to use for any traces created @@ -604,16 +604,19 @@ type Configuration struct { OtelSamplerRatio float32 `json:"otel-sampler-ratio"` //OtelSamplerParentBased specifies the parent based sampler to be use for any traces created - // Default: false + // Default: true OtelSamplerParentBased bool `json:"otel-sampler-parent-based"` // MaxQueueSize specifies the max queue size for uploading traces + // Default: 2048 OtelMaxQueueSize int32 `json:"otel-max-queuesize"` // ScheduleDelayMillis specifies the max delay between uploading traces + // Default: 5000 OtelScheduleDelayMillis int32 `json:"otel-schedule-delay-millis"` // MaxExportBatchSize specifies the max export batch size to used when uploading traces + // Default: 512 OtelMaxExportBatchSize int32 `json:"otel-max-export-batch-size"` // ZipkinCollectorHost specifies the host to use when uploading traces @@ -975,9 +978,12 @@ func NewDefault() Configuration { OpentelemetryConfig: "/etc/nginx/opentelemetry.toml", OtlpCollectorPort: "4317", OtelServiceName: "nginx", - OtelSampler: "AlwaysOff", + OtelSampler: "AlwaysOn", OtelSamplerRatio: 0.01, - OtelSamplerParentBased: false, + OtelSamplerParentBased: true, + OtelScheduleDelayMillis: 5000, + OtelMaxExportBatchSize: 512, + OtelMaxQueueSize: 2048, ZipkinCollectorPort: 9411, ZipkinServiceName: "nginx", ZipkinSampleRate: 1.0, From e3fb63fc141900f162c1fcea13da9001b2f5fbf8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 May 2023 05:02:31 -0700 Subject: [PATCH 186/822] Bump github.com/prometheus/common from 0.42.0 to 0.43.0 (#9981) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.42.0 to 0.43.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](https://github.com/prometheus/common/compare/v0.42.0...v0.43.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 14 +++++++------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index 58b647b40..97ad2c9e2 100644 --- a/go.mod +++ b/go.mod @@ -17,9 +17,9 @@ require ( github.com/onsi/ginkgo/v2 v2.9.0 github.com/opencontainers/runc v1.1.7 github.com/pmezard/go-difflib v1.0.0 - github.com/prometheus/client_golang v1.15.0 + github.com/prometheus/client_golang v1.15.1 github.com/prometheus/client_model v0.4.0 - github.com/prometheus/common v0.42.0 + github.com/prometheus/common v0.43.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 @@ -102,7 +102,7 @@ require ( go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.8.0 // indirect golang.org/x/net v0.9.0 // indirect - golang.org/x/oauth2 v0.6.0 // indirect + golang.org/x/oauth2 v0.7.0 // indirect golang.org/x/sys v0.7.0 // indirect golang.org/x/term v0.7.0 // indirect golang.org/x/text v0.9.0 // indirect diff --git a/go.sum b/go.sum index 908b21594..cc9b44d6b 100644 --- a/go.sum +++ b/go.sum @@ -305,8 +305,8 @@ github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXP github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= -github.com/prometheus/client_golang v1.15.0 h1:5fCgGYogn0hFdhyhLbw7hEsWxufKtY9klyvdNfFlFhM= -github.com/prometheus/client_golang v1.15.0/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= +github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI= +github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= @@ -317,8 +317,8 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= -github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM= -github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc= +github.com/prometheus/common v0.43.0 h1:iq+BVjvYLei5f27wiuNiB1DN6DYQkp1c8Bx0Vykh5us= +github.com/prometheus/common v0.43.0/go.mod h1:NCvr5cQIh3Y/gy73/RdVtC9r8xxrxwJnB+2lB3BxrFc= github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= @@ -329,8 +329,8 @@ github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJf github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc= -github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8= github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE= +github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= @@ -468,8 +468,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw= -golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= +golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g= +golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= From 3fc10b8374788ace736891f32a47c22b6d29b549 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 May 2023 05:04:31 -0700 Subject: [PATCH 187/822] Bump securego/gosec from 2.15.0 to 2.16.0 (#9983) Bumps [securego/gosec](https://github.com/securego/gosec) from 2.15.0 to 2.16.0. - [Release notes](https://github.com/securego/gosec/releases) - [Changelog](https://github.com/securego/gosec/blob/master/.goreleaser.yml) - [Commits](https://github.com/securego/gosec/compare/a459eb0ba387d9bd083d5c2e2354dbeef2465038...c5ea1b7bdd9efc3792e513258853552b0ae31e06) --- updated-dependencies: - dependency-name: securego/gosec dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 862a0604a..9049a8579 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -71,7 +71,7 @@ jobs: uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Run Gosec Security Scanner - uses: securego/gosec@a459eb0ba387d9bd083d5c2e2354dbeef2465038 # v2.15.0 + uses: securego/gosec@c5ea1b7bdd9efc3792e513258853552b0ae31e06 # v2.16.0 with: # G601 for zz_generated.deepcopy.go # G306 TODO: Expect WriteFile permissions to be 0600 or less From 270571b8ccbdf3fcfe148d2935690cafc86fec6f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 May 2023 05:28:30 -0700 Subject: [PATCH 188/822] Bump actions/setup-go from 4.0.0 to 4.0.1 (#9984) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/4d34df0c2316fe8122ab82dc22947d607c0c91f9...fac708d6674e30b6ba41289acaab6d4b75aa0753) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yaml | 12 ++++++------ .github/workflows/plugin.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9049a8579..18be42906 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -89,7 +89,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true @@ -108,7 +108,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true @@ -127,7 +127,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true @@ -148,7 +148,7 @@ jobs: - name: Set up Go id: go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true @@ -214,7 +214,7 @@ jobs: uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Setup Go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true @@ -472,7 +472,7 @@ jobs: - name: Set up Go id: go if: ${{ steps.filter-images.outputs.kube-webhook-certgen == 'true' }} - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: '1.20' check-latest: true diff --git a/.github/workflows/plugin.yaml b/.github/workflows/plugin.yaml index f77c59937..c5c6fc2b1 100644 --- a/.github/workflows/plugin.yaml +++ b/.github/workflows/plugin.yaml @@ -22,7 +22,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0 + uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 with: go-version: 1.20 check-latest: true From 214ab50820d80201cd233661ed0657b3343dffb7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 May 2023 06:12:31 -0700 Subject: [PATCH 189/822] Bump golang.org/x/crypto from 0.8.0 to 0.9.0 (#9982) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.8.0 to 0.9.0. - [Commits](https://github.com/golang/crypto/compare/v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 97ad2c9e2..fa303b4f3 100644 --- a/go.mod +++ b/go.mod @@ -25,7 +25,7 @@ require ( github.com/stretchr/testify v1.8.2 github.com/yudai/gojsondiff v1.0.0 github.com/zakjan/cert-chain-resolver v0.0.0-20211122211144-c6b0b792af9a - golang.org/x/crypto v0.8.0 + golang.org/x/crypto v0.9.0 google.golang.org/grpc v1.55.0 google.golang.org/grpc/examples v0.0.0-20221220003428-4f16fbe410f7 gopkg.in/go-playground/pool.v3 v3.1.1 @@ -101,10 +101,10 @@ require ( github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.8.0 // indirect - golang.org/x/net v0.9.0 // indirect + golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.7.0 // indirect - golang.org/x/sys v0.7.0 // indirect - golang.org/x/term v0.7.0 // indirect + golang.org/x/sys v0.8.0 // indirect + golang.org/x/term v0.8.0 // indirect golang.org/x/text v0.9.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/tools v0.6.0 // indirect diff --git a/go.sum b/go.sum index cc9b44d6b..d41cfa734 100644 --- a/go.sum +++ b/go.sum @@ -393,8 +393,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.8.0 h1:pd9TJtTueMTVQXzk8E2XESSMQDj/U7OUu0PqJqPXQjQ= -golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE= +golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g= +golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -460,8 +460,8 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= -golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= +golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M= +golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -527,11 +527,11 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= -golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= +golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.7.0 h1:BEvjmm5fURWqcfbSKTdpkDXYBrUS1c0m8agp14W48vQ= -golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= +golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols= +golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= From 8c7981bfa21c6dab551ed1f4c48db217b5d852ca Mon Sep 17 00:00:00 2001 From: Federico Cuello Date: Mon, 22 May 2023 16:42:34 +0200 Subject: [PATCH 190/822] helm: Fix opentelemetry module installation for daemonset (#9792) * fix: opentelemetry module for controller-daemonset * fix: Align controller-daemonset with controller-deployment * Fix typo in github/workflows/ci --- .github/workflows/ci.yaml | 2 +- .../templates/controller-daemonset.yaml | 16 +++++++++------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 18be42906..4d443f8d5 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -312,7 +312,7 @@ jobs: kind get kubeconfig > $HOME/.kube/kind-config-kind make kind-e2e-test - - name: Uplaod e2e junit-reports + - name: Upload e2e junit-reports uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 if: success() || failure() with: diff --git a/charts/ingress-nginx/templates/controller-daemonset.yaml b/charts/ingress-nginx/templates/controller-daemonset.yaml index bce21a7d6..82abe7564 100644 --- a/charts/ingress-nginx/templates/controller-daemonset.yaml +++ b/charts/ingress-nginx/templates/controller-daemonset.yaml @@ -53,12 +53,12 @@ spec: imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }} {{- end }} {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} + priorityClassName: {{ .Values.controller.priorityClassName | quote }} {{- end }} {{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }} securityContext: {{- end }} - {{- if .Values.controller.podSecurityContext }} + {{- if .Values.controller.podSecurityContext }} {{- toYaml .Values.controller.podSecurityContext | nindent 8 }} {{- end }} {{- if .Values.controller.sysctls }} @@ -143,11 +143,15 @@ spec: hostPort: {{ $key }} {{- end }} {{- end }} - {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }} + {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }} volumeMounts: - {{- if .Values.controller.extraModules }} + {{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }} - name: modules + {{ if .Values.controller.image.chroot }} + mountPath: /chroot/modules_mount + {{ else }} mountPath: /modules_mount + {{ end }} {{- end }} {{- if .Values.controller.customTemplate.configMapName }} - mountPath: /etc/nginx/template @@ -169,9 +173,7 @@ spec: {{- if .Values.controller.extraContainers }} {{ toYaml .Values.controller.extraContainers | nindent 8 }} {{- end }} - - - {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }} + {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }} initContainers: {{- if .Values.controller.extraInitContainers }} {{ toYaml .Values.controller.extraInitContainers | nindent 8 }} From 24cd56d27c60b550ee103bff1ccbef980f614c7e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 May 2023 07:50:35 -0700 Subject: [PATCH 191/822] Bump github.com/onsi/ginkgo/v2 from 2.9.0 to 2.9.5 (#9980) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.9.0 to 2.9.5. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.9.0...v2.9.5) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 21 +++++++++++---------- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index fa303b4f3..cebf8df5d 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/mitchellh/mapstructure v1.5.0 github.com/moul/pb v0.0.0-20220425114252-bca18df4138c github.com/ncabatoff/process-exporter v0.7.10 - github.com/onsi/ginkgo/v2 v2.9.0 + github.com/onsi/ginkgo/v2 v2.9.5 github.com/opencontainers/runc v1.1.7 github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.15.1 @@ -58,11 +58,11 @@ require ( github.com/evanphx/json-patch/v5 v5.6.0 // indirect github.com/fullsailor/pkcs7 v0.0.0-20160414161337-2585af45975b // indirect github.com/go-errors/errors v1.0.1 // indirect - github.com/go-logr/logr v1.2.3 // indirect + github.com/go-logr/logr v1.2.4 // indirect github.com/go-openapi/jsonpointer v0.19.5 // indirect github.com/go-openapi/jsonreference v0.20.0 // indirect github.com/go-openapi/swag v0.19.14 // indirect - github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect + github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect github.com/godbus/dbus/v5 v5.0.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect @@ -100,14 +100,14 @@ require ( github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect github.com/yudai/pp v2.0.1+incompatible // indirect go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect - golang.org/x/mod v0.8.0 // indirect + golang.org/x/mod v0.10.0 // indirect golang.org/x/net v0.10.0 // indirect golang.org/x/oauth2 v0.7.0 // indirect golang.org/x/sys v0.8.0 // indirect golang.org/x/term v0.8.0 // indirect golang.org/x/text v0.9.0 // indirect golang.org/x/time v0.3.0 // indirect - golang.org/x/tools v0.6.0 // indirect + golang.org/x/tools v0.9.1 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 // indirect google.golang.org/protobuf v1.30.0 // indirect diff --git a/go.sum b/go.sum index d41cfa734..91749fc4b 100644 --- a/go.sum +++ b/go.sum @@ -100,8 +100,8 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= -github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= +github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/zapr v1.2.3 h1:a9vnzlIBPQBBkeaR9IuMUfmVOrQlkoC4YfPoFkX3T7A= github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg= github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY= @@ -112,8 +112,9 @@ github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh github.com/go-openapi/swag v0.19.14 h1:gm3vOOXfiuw5i9p5N9xJvfjvuofpyvLA9Wr6QfK5Fng= github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= -github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I= github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/godbus/dbus/v5 v5.0.6 h1:mkgN1ofwASrYnJ5W6U/BxG15eXXXjirgZc7CLqkcaro= github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= @@ -283,11 +284,11 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= -github.com/onsi/ginkgo/v2 v2.9.0 h1:Tugw2BKlNHTMfG+CheOITkYvk4LAh6MFOvikhGVnhE8= -github.com/onsi/ginkgo/v2 v2.9.0/go.mod h1:4xkjoL/tZv4SMWeww56BU5kAt19mVB47gTWxmrTcxyk= +github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q= +github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k= github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= -github.com/onsi/gomega v1.27.1 h1:rfztXRbg6nv/5f+Raen9RcGoSecHIFgBBLQK3Wdj754= +github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= github.com/opencontainers/runc v1.1.7 h1:y2EZDS8sNng4Ksf0GUYNhKbTShZJPJg1FiXJNH/uoCk= github.com/opencontainers/runc v1.1.7/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 h1:3snG66yBm59tKhhSPQrQ/0bCrv1LQbKt40LnUPiUxdc= @@ -425,8 +426,8 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.8.0 h1:LUYupSeNrTNCGzR/hVBk2NHZO4hXcVaW1k4Qx7rjPx8= -golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= +golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -589,8 +590,8 @@ golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM= -golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo= +golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 5bc7dc8a6a516f4cedb8f44d37119f60c86c7175 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Mon, 22 May 2023 23:22:58 +0530 Subject: [PATCH 192/822] bumped ginkgo to v2.9.5 (#9985) --- build/run-in-docker.sh | 2 +- images/test-runner/Makefile | 4 ++-- test/e2e/run-chart-test.sh | 2 +- test/e2e/run-kind-e2e.sh | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 3a6aeb43d..90cd7217e 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -87,7 +87,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then echo "..reached DIND check TRUE block, inside run-in-docker.sh" echo "FLAGS=$FLAGS" #go env - go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 + go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 find / -type f -name ginkgo 2>/dev/null which ginkgo /bin/bash -c "${FLAGS}" diff --git a/images/test-runner/Makefile b/images/test-runner/Makefile index 562625cff..a004ad932 100644 --- a/images/test-runner/Makefile +++ b/images/test-runner/Makefile @@ -54,7 +54,7 @@ image: --build-arg YAML_LINT_VERSION=1.27.1 \ --build-arg YAMALE_VERSION=4.0.4 \ --build-arg HELM_VERSION=3.11.2 \ - --build-arg GINKGO_VERSION=2.9.0 \ + --build-arg GINKGO_VERSION=2.9.5 \ --build-arg GOLINT_VERSION=latest \ -t ${IMAGE}:${TAG} rootfs @@ -75,7 +75,7 @@ build: ensure-buildx --build-arg YAML_LINT_VERSION=1.27.1 \ --build-arg YAMALE_VERSION=4.0.4 \ --build-arg HELM_VERSION=3.11.2 \ - --build-arg GINKGO_VERSION=2.9.0 \ + --build-arg GINKGO_VERSION=2.9.5 \ --build-arg GOLINT_VERSION=latest \ -t ${IMAGE}:${TAG} rootfs diff --git a/test/e2e/run-chart-test.sh b/test/e2e/run-chart-test.sh index 6efa63eb2..6df4fb1e7 100755 --- a/test/e2e/run-chart-test.sh +++ b/test/e2e/run-chart-test.sh @@ -78,7 +78,7 @@ fi if [ "${SKIP_IMAGE_CREATION:-false}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 fi echo "[dev-env] building image" make -C ${DIR}/../../ clean-image build image diff --git a/test/e2e/run-kind-e2e.sh b/test/e2e/run-kind-e2e.sh index fe7550360..e6e4e086b 100755 --- a/test/e2e/run-kind-e2e.sh +++ b/test/e2e/run-kind-e2e.sh @@ -95,7 +95,7 @@ fi if [ "${SKIP_E2E_IMAGE_CREATION}" = "false" ]; then if ! command -v ginkgo &> /dev/null; then - go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.0 + go install github.com/onsi/ginkgo/v2/ginkgo@v2.9.5 fi echo "[dev-env] .. done building controller images" From 8d9210fd3874343c82e397de220679bfd282ba18 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Tue, 23 May 2023 16:14:27 +0530 Subject: [PATCH 193/822] updated testrunner image tag+sha (#9987) --- build/run-in-docker.sh | 2 +- test/e2e-image/Makefile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index 90cd7217e..fe9906e0d 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230522@sha256:a3deb0444d53b3f3b2d73acec8be2c3330d28d2df1ef09d0b9d7dbecdee706fb} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index 011396531..4106290e6 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230314-helm-chart-4.5.2-32-g520384b11@sha256:754c62f9a5efd1ee515ee908ecc16c0c4d1dda96a8cc8019667182a55f3a9035" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230522@sha256:a3deb0444d53b3f3b2d73acec8be2c3330d28d2df1ef09d0b9d7dbecdee706fb" image: echo "..entered Makefile in /test/e2e-image" From 897783557a178dc09b6cd7ec25d9719c556ee3b9 Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 25 May 2023 11:18:52 -0300 Subject: [PATCH 194/822] Add OPA examples on pathType restrictions (#9992) --- docs/examples/openpolicyagent/README.md | 25 ++++++++++++ docs/examples/openpolicyagent/rule.yaml | 14 +++++++ docs/examples/openpolicyagent/template.yaml | 40 +++++++++++++++++++ .../tests/should-allow-ns-except.yaml | 18 +++++++++ .../openpolicyagent/tests/should-allow.yaml | 17 ++++++++ .../openpolicyagent/tests/should-deny.yaml | 17 ++++++++ mkdocs.yml | 1 + 7 files changed, 132 insertions(+) create mode 100644 docs/examples/openpolicyagent/README.md create mode 100644 docs/examples/openpolicyagent/rule.yaml create mode 100644 docs/examples/openpolicyagent/template.yaml create mode 100644 docs/examples/openpolicyagent/tests/should-allow-ns-except.yaml create mode 100644 docs/examples/openpolicyagent/tests/should-allow.yaml create mode 100644 docs/examples/openpolicyagent/tests/should-deny.yaml diff --git a/docs/examples/openpolicyagent/README.md b/docs/examples/openpolicyagent/README.md new file mode 100644 index 000000000..2d653a90c --- /dev/null +++ b/docs/examples/openpolicyagent/README.md @@ -0,0 +1,25 @@ +# OpenPolicyAgent and pathType enforcing + +Ingress API allows users to specify different [pathType](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types) +on Ingress object. + +While pathType `Exact` and `Prefix` should allow only a small set of characters, pathType `ImplementationSpecific` +allows any characters, as it may contain regexes, variables and other features that may be specific of the Ingress +Controller being used. + +This means that the Ingress Admins (the persona who deployed the Ingress Controller) should trust the users +allowed to use `pathType: ImplementationSpecific`, as this may allow arbitrary configuration, and this +configuration may end on the proxy (aka Nginx) configuration. + +## Example +The example in this repo uses [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/) to block the usage of `pathType: ImplementationSpecific`, +allowing just a specific list of namespaces to use it. + +It is recommended that the admin modifies this rules to enforce a specific set of characters when the usage of ImplementationSpecific +is allowed, or in ways that best suits their needs. + +First, the `ConstraintTemplate` from [template.yaml](template.yaml) will define a rule that validates if the Ingress object +is being created on an excempted namespace, and case not, will validate its pathType. + +Then, the rule `K8sBlockIngressPathType` contained in [rule.yaml](rule.yaml) will define the parameters: what kind of +object should be verified (Ingress), what are the excempted namespaces, and what kinds of pathType are blocked. diff --git a/docs/examples/openpolicyagent/rule.yaml b/docs/examples/openpolicyagent/rule.yaml new file mode 100644 index 000000000..fce305241 --- /dev/null +++ b/docs/examples/openpolicyagent/rule.yaml @@ -0,0 +1,14 @@ +apiVersion: constraints.gatekeeper.sh/v1beta1 +kind: K8sBlockIngressPathType +metadata: + name: implspecificisblocked +spec: + match: + kinds: + - apiGroups: ["networking.k8s.io"] + kinds: ["Ingress"] + parameters: + namespacesExceptions: + - "privileged" + blockedTypes: + - "ImplementationSpecific" diff --git a/docs/examples/openpolicyagent/template.yaml b/docs/examples/openpolicyagent/template.yaml new file mode 100644 index 000000000..ed2a6ba1c --- /dev/null +++ b/docs/examples/openpolicyagent/template.yaml @@ -0,0 +1,40 @@ +apiVersion: templates.gatekeeper.sh/v1 +kind: ConstraintTemplate +metadata: + name: k8sblockingresspathtype + annotations: + metadata.gatekeeper.sh/title: "Block a pathType usage" + description: >- + Users should not be able to use specific pathTypes +spec: + crd: + spec: + names: + kind: K8sBlockIngressPathType + validation: + openAPIV3Schema: + type: object + properties: + blockedTypes: + type: array + items: + type: string + namespacesExceptions: + type: array + items: + type: string + targets: + - target: admission.k8s.gatekeeper.sh + rego: | + package K8sBlockIngressPathType + + violation[{"msg": msg}] { + input.review.kind.kind == "Ingress" + ns := input.review.object.metadata.namespace + excemptNS := [good | excempts = input.parameters.namespacesExceptions[_] ; good = excempts == ns] + not any(excemptNS) + pathType := object.get(input.review.object.spec.rules[_].http.paths[_], "pathType", "") + blockedPath := [blocked | blockedTypes = input.parameters.blockedTypes[_] ; blocked = blockedTypes == pathType] + any(blockedPath) + msg := sprintf("pathType '%v' is not allowed in this namespace", [pathType]) + } diff --git a/docs/examples/openpolicyagent/tests/should-allow-ns-except.yaml b/docs/examples/openpolicyagent/tests/should-allow-ns-except.yaml new file mode 100644 index 000000000..974e83555 --- /dev/null +++ b/docs/examples/openpolicyagent/tests/should-allow-ns-except.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + creationTimestamp: null + name: simple + namespace: privileged +spec: + rules: + - host: foo1.com + http: + paths: + - backend: + service: + name: svc1 + port: + number: 8080 + path: /bar + pathType: ImplementationSpecific diff --git a/docs/examples/openpolicyagent/tests/should-allow.yaml b/docs/examples/openpolicyagent/tests/should-allow.yaml new file mode 100644 index 000000000..854aff14c --- /dev/null +++ b/docs/examples/openpolicyagent/tests/should-allow.yaml @@ -0,0 +1,17 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + creationTimestamp: null + name: simple +spec: + rules: + - host: foo.com + http: + paths: + - backend: + service: + name: svc1 + port: + number: 8080 + path: /bar + pathType: Exact diff --git a/docs/examples/openpolicyagent/tests/should-deny.yaml b/docs/examples/openpolicyagent/tests/should-deny.yaml new file mode 100644 index 000000000..b732fdc89 --- /dev/null +++ b/docs/examples/openpolicyagent/tests/should-deny.yaml @@ -0,0 +1,17 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + creationTimestamp: null + name: simple +spec: + rules: + - host: foo2.com + http: + paths: + - backend: + service: + name: svc1 + port: + number: 8080 + path: /bar + pathType: ImplementationSpecific diff --git a/mkdocs.yml b/mkdocs.yml index 39eab9ef0..380b1b67a 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -126,6 +126,7 @@ nav: - Static IPs: "examples/static-ip/README.md" - TLS termination: "examples/tls-termination/README.md" - Pod Security Policy (PSP): "examples/psp/README.md" + - Open Policy Agent rules: "examples/openpolicyagent/README.md" - Developer Guide: - Getting Started: "developer-guide/getting-started.md" - Code Overview: "developer-guide/code-overview.md" From 1282345be2952f497c7f1387ef5fc9658fe95a1d Mon Sep 17 00:00:00 2001 From: Ricardo Katz Date: Thu, 25 May 2023 11:56:52 -0300 Subject: [PATCH 195/822] Admission warning (#9975) * Add warning feature in admission code * Apply suggestions from code review Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com> * Add deprecation and validation path notice --------- Co-authored-by: Josh Soref <2119212+jsoref@users.noreply.github.com> --- internal/admission/controller/main.go | 10 ++ internal/admission/controller/main_test.go | 12 ++ internal/ingress/controller/controller.go | 48 ++++++++ .../ingress/controller/controller_test.go | 107 ++++++++++++++++++ 4 files changed, 177 insertions(+) diff --git a/internal/admission/controller/main.go b/internal/admission/controller/main.go index 645f298b4..f59bf2091 100644 --- a/internal/admission/controller/main.go +++ b/internal/admission/controller/main.go @@ -33,6 +33,7 @@ import ( // contains invalid instructions type Checker interface { CheckIngress(ing *networking.Ingress) error + CheckWarning(ing *networking.Ingress) ([]string, error) } // IngressAdmission implements the AdmissionController interface @@ -85,6 +86,15 @@ func (ia *IngressAdmission) HandleAdmission(obj runtime.Object) (runtime.Object, return review, nil } + // Adds the warnings regardless of operation being allowed or not + warning, err := ia.Checker.CheckWarning(&ingress) + if err != nil { + klog.ErrorS(err, "failed to get ingress warnings") + } + if len(warning) > 0 { + status.Warnings = warning + } + if err := ia.Checker.CheckIngress(&ingress); err != nil { klog.ErrorS(err, "invalid ingress configuration", "ingress", fmt.Sprintf("%v/%v", review.Request.Namespace, review.Request.Name)) status.Allowed = false diff --git a/internal/admission/controller/main_test.go b/internal/admission/controller/main_test.go index 7cc3cd7b4..0a547d4be 100644 --- a/internal/admission/controller/main_test.go +++ b/internal/admission/controller/main_test.go @@ -38,6 +38,11 @@ func (ftc failTestChecker) CheckIngress(ing *networking.Ingress) error { return nil } +func (ftc failTestChecker) CheckWarning(ing *networking.Ingress) ([]string, error) { + ftc.t.Error("checker should not be called") + return nil, nil +} + type testChecker struct { t *testing.T err error @@ -50,6 +55,13 @@ func (tc testChecker) CheckIngress(ing *networking.Ingress) error { return tc.err } +func (tc testChecker) CheckWarning(ing *networking.Ingress) ([]string, error) { + if ing.ObjectMeta.Name != testIngressName { + tc.t.Errorf("CheckWarning should be called with %v ingress, but got %v", testIngressName, ing.ObjectMeta.Name) + } + return nil, tc.err +} + func TestHandleAdmission(t *testing.T) { adm := &IngressAdmission{ Checker: failTestChecker{t: t}, diff --git a/internal/ingress/controller/controller.go b/internal/ingress/controller/controller.go index 49e8aa0bb..20de63fd1 100644 --- a/internal/ingress/controller/controller.go +++ b/internal/ingress/controller/controller.go @@ -256,6 +256,54 @@ func (n *NGINXController) syncIngress(interface{}) error { return nil } +// GetWarnings returns a list of warnings an Ingress gets when being created. +// The warnings are going to be used in an admission webhook, and they represent +// a list of messages that users need to be aware (like deprecation notices) +// when creating a new ingress object +func (n *NGINXController) CheckWarning(ing *networking.Ingress) ([]string, error) { + warnings := make([]string, 0) + + var deprecatedAnnotations = sets.NewString() + deprecatedAnnotations.Insert( + "enable-influxdb", + "influxdb-measurement", + "influxdb-port", + "influxdb-host", + "influxdb-server-name", + "secure-verify-ca-secret", + "fastcgi-params-configmap", + "fastcgi-index", + ) + + // Skip checks if the ingress is marked as deleted + if !ing.DeletionTimestamp.IsZero() { + return warnings, nil + } + + anns := ing.GetAnnotations() + for k := range anns { + trimmedkey := strings.TrimPrefix(k, parser.AnnotationsPrefix+"/") + if deprecatedAnnotations.Has(trimmedkey) { + warnings = append(warnings, fmt.Sprintf("annotation %s is deprecated", k)) + } + } + + // Add each validation as a single warning + // rikatz: I know this is somehow a duplicated code from CheckIngress, but my goal was to deliver fast warning on this behavior. We + // can and should, tho, simplify this in the near future + if err := inspector.ValidatePathType(ing); err != nil { + if errs, is := err.(interface{ Unwrap() []error }); is { + for _, errW := range errs.Unwrap() { + warnings = append(warnings, errW.Error()) + } + } else { + warnings = append(warnings, err.Error()) + } + } + + return warnings, nil +} + // CheckIngress returns an error in case the provided ingress, when added // to the current configuration, generates an invalid configuration func (n *NGINXController) CheckIngress(ing *networking.Ingress) error { diff --git a/internal/ingress/controller/controller_test.go b/internal/ingress/controller/controller_test.go index 8cca10385..06e1e8db0 100644 --- a/internal/ingress/controller/controller_test.go +++ b/internal/ingress/controller/controller_test.go @@ -352,6 +352,113 @@ func TestCheckIngress(t *testing.T) { }) } +func TestCheckWarning(t *testing.T) { + + // Ensure no panic with wrong arguments + var nginx = &NGINXController{} + + nginx.t = fakeTemplate{} + nginx.store = fakeIngressStore{ + ingresses: []*ingress.Ingress{}, + } + + ing := &networking.Ingress{ + ObjectMeta: metav1.ObjectMeta{ + Name: "test-ingress-warning", + Namespace: "user-namespace", + Annotations: map[string]string{}, + }, + Spec: networking.IngressSpec{ + Rules: []networking.IngressRule{ + { + Host: "example.com", + }, + }, + }, + } + t.Run("when a deprecated annotation is used a warning should be returned", func(t *testing.T) { + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" + defer func() { + ing.ObjectMeta.Annotations = map[string]string{} + }() + + warnings, err := nginx.CheckWarning(ing) + if err != nil { + t.Errorf("no error should be returned, but %s was returned", err) + } + if len(warnings) != 1 { + t.Errorf("expected 1 warning to occur but %d occured", len(warnings)) + } else { + t.Logf("got warning %s correctly", warnings[0]) + } + }) + + t.Run("When an invalid pathType is used, a warning should be returned", func(t *testing.T) { + + rules := ing.Spec.DeepCopy().Rules + ing.Spec.Rules = []networking.IngressRule{ + { + Host: "example.com", + IngressRuleValue: networking.IngressRuleValue{ + HTTP: &networking.HTTPIngressRuleValue{ + Paths: []networking.HTTPIngressPath{ + { + Path: "/xpto{$2}", + PathType: &pathTypePrefix, + }, + { + Path: "/ok", + PathType: &pathTypeExact, + }, + }, + }, + }, + }, + } + defer func() { + ing.Spec.Rules = rules + }() + + warnings, err := nginx.CheckWarning(ing) + if err != nil { + t.Errorf("no error should be returned, but %s was returned", err) + } + if len(warnings) != 1 { + t.Errorf("expected 1 warning to occur but %d occured", len(warnings)) + } else { + t.Logf("got warnings %v correctly", warnings) + } + + t.Run("adding invalid annotations increases the warning count", func(t *testing.T) { + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("enable-influxdb")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("secure-verify-ca-secret")] = "true" + ing.ObjectMeta.Annotations[parser.GetAnnotationWithPrefix("fastcgi-index")] = "blabla" + defer func() { + ing.ObjectMeta.Annotations = map[string]string{} + }() + warnings, err := nginx.CheckWarning(ing) + if err != nil { + t.Errorf("no error should be returned, but %s was returned", err) + } + if len(warnings) != 4 { + t.Errorf("expected 4 warning to occur but %d occured", len(warnings)) + } else { + t.Logf("got warnings %v correctly", warnings) + } + }) + }) + + t.Run("When the ingress is marked as deleted", func(t *testing.T) { + ing.DeletionTimestamp = &metav1.Time{ + Time: time.Now(), + } + + if warnings, err := nginx.CheckWarning(ing); err != nil || len(warnings) != 0 { + t.Errorf("when the ingress is marked as deleted, no warning should be returned") + } + }) +} + func TestMergeAlternativeBackends(t *testing.T) { testCases := map[string]struct { ingress *ingress.Ingress From 61ae861e81618be3acc1aeed2a8193618434a124 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 May 2023 09:08:51 -0700 Subject: [PATCH 196/822] Bump k8s.io/klog/v2 from 2.90.1 to 2.100.1 (#9913) Bumps [k8s.io/klog/v2](https://github.com/kubernetes/klog) from 2.90.1 to 2.100.1. - [Release notes](https://github.com/kubernetes/klog/releases) - [Changelog](https://github.com/kubernetes/klog/blob/main/RELEASE.md) - [Commits](https://github.com/kubernetes/klog/compare/v2.90.1...v2.100.1) --- updated-dependencies: - dependency-name: k8s.io/klog/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index cebf8df5d..c44d2f207 100644 --- a/go.mod +++ b/go.mod @@ -38,7 +38,7 @@ require ( k8s.io/client-go v0.26.4 k8s.io/code-generator v0.26.4 k8s.io/component-base v0.26.4 - k8s.io/klog/v2 v2.90.1 + k8s.io/klog/v2 v2.100.1 pault.ag/go/sniff v0.0.0-20200207005214-cf7e4d167732 sigs.k8s.io/controller-runtime v0.14.6 sigs.k8s.io/mdtoc v1.1.0 diff --git a/go.sum b/go.sum index 91749fc4b..c2e02777b 100644 --- a/go.sum +++ b/go.sum @@ -740,8 +740,8 @@ k8s.io/component-base v0.26.4/go.mod h1:lTuWL1Xz/a4e80gmIC3YZG2JCO4xNwtKWHJWeJms k8s.io/gengo v0.0.0-20220902162205-c0856e24416d h1:U9tB195lKdzwqicbJvyJeOXV7Klv+wNAWENRnXEGi08= k8s.io/gengo v0.0.0-20220902162205-c0856e24416d/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E= k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y= -k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw= -k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= +k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280 h1:+70TFaan3hfJzs+7VK2o+OGxg8HsuBr/5f6tVAjDu6E= k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4= k8s.io/utils v0.0.0-20221128185143-99ec85e7a448 h1:KTgPnR10d5zhztWptI952TNtt/4u5h3IzDXkdIMuo2Y= From df0be089d233b4294dee40be53f9d0f6ace2752a Mon Sep 17 00:00:00 2001 From: Peter Jakubis Date: Thu, 25 May 2023 19:26:53 +0200 Subject: [PATCH 197/822] PodDisruptionBudget spec logic update (#9904) Signed-off-by: Peter Jakubis --- charts/ingress-nginx/README.md | 2 +- .../templates/controller-poddisruptionbudget.yaml | 2 +- charts/ingress-nginx/values.yaml | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index d79ad38cd..4d4d6ba6f 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -365,7 +365,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.metrics.serviceMonitor.relabelings | list | `[]` | | | controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` | | | controller.metrics.serviceMonitor.targetLabels | list | `[]` | | -| controller.minAvailable | int | `1` | Define either 'minAvailable' or 'maxUnavailable', never both. | +| controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. | | controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # | | controller.name | string | `"controller"` | | | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # | diff --git a/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml b/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml index 230307cd7..91be5801f 100644 --- a/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml +++ b/charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml @@ -18,7 +18,7 @@ spec: matchLabels: {{- include "ingress-nginx.selectorLabels" . | nindent 6 }} app.kubernetes.io/component: controller - {{- if .Values.controller.minAvailable }} + {{- if and .Values.controller.minAvailable (not (hasKey .Values.controller "maxUnavailable")) }} minAvailable: {{ .Values.controller.minAvailable }} {{- else if .Values.controller.maxUnavailable }} maxUnavailable: {{ .Values.controller.maxUnavailable }} diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index a398b0503..e0b38c5a7 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -308,9 +308,10 @@ controller: ## podAnnotations: {} replicaCount: 1 - # -- Define either 'minAvailable' or 'maxUnavailable', never both. + # -- Minimum available pods set in PodDisruptionBudget. + # Define either 'minAvailable' or 'maxUnavailable', never both. minAvailable: 1 - # -- Define either 'minAvailable' or 'maxUnavailable', never both. + # -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. # maxUnavailable: 1 ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes From 4cf439118ffc1e9455d8ceae1e3c3439fc979dd9 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Sat, 27 May 2023 01:26:56 +0530 Subject: [PATCH 198/822] openssl CVE fix (#9996) --- NGINX_BASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NGINX_BASE b/NGINX_BASE index 5f1751bbf..ebe355582 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:91057c439cf07ffb62887b8a8bda66ce3cbe39ca@sha256:3b650123c755392f8c0eb9a356b12716327106e624ab5f5b43bc25ab130978fb \ No newline at end of file +registry.k8s.io/ingress-nginx/nginx:v20230526@sha256:b05566e432d85a7681feb7ef93fda8385d53712478737b39e617c993c86c5e65 From c2e1f34cbefe95014540b3fb833fbe9580339cc7 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Sat, 27 May 2023 08:54:49 +0800 Subject: [PATCH 199/822] images: upgrade to Alpine 3.18 (#9997) Alpine Linux 3.18 was released https://alpinelinux.org/posts/Alpine-3.18.0-released.html Signed-off-by: Jintao Zhang --- docs/examples/customization/sysctl/patch.json | 2 +- images/cfssl/rootfs/Dockerfile | 2 +- images/nginx/rootfs/Dockerfile | 4 ++-- images/opentelemetry/rootfs/Dockerfile | 4 ++-- rootfs/Dockerfile-chroot | 2 +- test/e2e-image/Dockerfile | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/examples/customization/sysctl/patch.json b/docs/examples/customization/sysctl/patch.json index 3f736197b..e87c9affa 100644 --- a/docs/examples/customization/sysctl/patch.json +++ b/docs/examples/customization/sysctl/patch.json @@ -4,7 +4,7 @@ "spec": { "initContainers": [{ "name": "sysctl", - "image": "alpine:3.17.0", + "image": "alpine:3.18", "securityContext": { "privileged": true }, diff --git a/images/cfssl/rootfs/Dockerfile b/images/cfssl/rootfs/Dockerfile index a50c715ea..e8d6c617a 100644 --- a/images/cfssl/rootfs/Dockerfile +++ b/images/cfssl/rootfs/Dockerfile @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.2 +FROM alpine:3.18.0 RUN echo "@testing http://nl.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories diff --git a/images/nginx/rootfs/Dockerfile b/images/nginx/rootfs/Dockerfile index a968eb1b3..9b4abf244 100644 --- a/images/nginx/rootfs/Dockerfile +++ b/images/nginx/rootfs/Dockerfile @@ -11,7 +11,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. -FROM alpine:3.17.2 as builder +FROM alpine:3.18.0 as builder COPY . / @@ -21,7 +21,7 @@ RUN apk update \ && /build.sh # Use a multi-stage build -FROM alpine:3.17.2 +FROM alpine:3.18.0 ENV PATH=$PATH:/usr/local/luajit/bin:/usr/local/nginx/sbin:/usr/local/nginx/bin diff --git a/images/opentelemetry/rootfs/Dockerfile b/images/opentelemetry/rootfs/Dockerfile index 33f5bcb36..69d82cda2 100644 --- a/images/opentelemetry/rootfs/Dockerfile +++ b/images/opentelemetry/rootfs/Dockerfile @@ -13,7 +13,7 @@ # limitations under the License. -FROM alpine:3.17.2 as base +FROM alpine:3.18.0 as base RUN mkdir -p /opt/third_party/install COPY . /opt/third_party/ @@ -39,7 +39,7 @@ COPY --from=grpc /opt/third_party/install/ /usr COPY --from=otel-cpp /opt/third_party/install/ /usr RUN bash /opt/third_party/build.sh -n -FROM alpine:3.17.2 as final +FROM alpine:3.18.0 as final COPY --from=base /opt/third_party/init_module.sh /usr/local/bin/init_module.sh COPY --from=nginx /etc/nginx/modules /etc/nginx/modules COPY --from=nginx /opt/third_party/install/lib /etc/nginx/modules diff --git a/rootfs/Dockerfile-chroot b/rootfs/Dockerfile-chroot index 7ab8584a7..a4123fe87 100644 --- a/rootfs/Dockerfile-chroot +++ b/rootfs/Dockerfile-chroot @@ -23,7 +23,7 @@ RUN apk update \ && apk upgrade \ && /chroot.sh -FROM alpine:3.17.2 +FROM alpine:3.18.0 ARG TARGETARCH ARG VERSION diff --git a/test/e2e-image/Dockerfile b/test/e2e-image/Dockerfile index 11abc26b4..97986ec95 100644 --- a/test/e2e-image/Dockerfile +++ b/test/e2e-image/Dockerfile @@ -1,7 +1,7 @@ ARG E2E_BASE_IMAGE FROM ${E2E_BASE_IMAGE} AS BASE -FROM alpine:3.17.2 +FROM alpine:3.18.0 RUN apk update \ && apk upgrade && apk add -U --no-cache \ From 9398c7e747bc74d2ec78be2b4d92ed7dddbb63df Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Sat, 27 May 2023 12:44:52 +0530 Subject: [PATCH 200/822] change to alpine318 baseimage (#10000) --- NGINX_BASE | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NGINX_BASE b/NGINX_BASE index ebe355582..02a35039a 100644 --- a/NGINX_BASE +++ b/NGINX_BASE @@ -1 +1 @@ -registry.k8s.io/ingress-nginx/nginx:v20230526@sha256:b05566e432d85a7681feb7ef93fda8385d53712478737b39e617c993c86c5e65 +registry.k8s.io/ingress-nginx/nginx:v20230527@sha256:cf77c71aa6e4284925ca2233ddf871b5823eaa3ee000347ae25096b07fb52c57 From f7ea0b152b9139e895f2da7629953e0cb5f59d84 Mon Sep 17 00:00:00 2001 From: Long Wu Yuan Date: Sat, 27 May 2023 20:16:51 +0530 Subject: [PATCH 201/822] changed tagsha to recent builds (#10001) --- build/run-in-docker.sh | 2 +- charts/ingress-nginx/README.md | 6 +++--- charts/ingress-nginx/values.yaml | 6 +++--- .../custom-errors/custom-default-backend.helm.values.yaml | 2 +- .../customization/custom-errors/custom-default-backend.yaml | 2 +- .../customization/external-auth-headers/echo-service.yaml | 2 +- docs/user-guide/third-party-addons/opentelemetry.md | 2 +- test/e2e-image/Makefile | 2 +- test/e2e/framework/deployment.go | 2 +- test/e2e/settings/ocsp/ocsp.go | 2 +- 10 files changed, 14 insertions(+), 14 deletions(-) diff --git a/build/run-in-docker.sh b/build/run-in-docker.sh index fe9906e0d..d2d6fcdd9 100755 --- a/build/run-in-docker.sh +++ b/build/run-in-docker.sh @@ -44,7 +44,7 @@ function cleanup { } trap cleanup EXIT -E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230522@sha256:a3deb0444d53b3f3b2d73acec8be2c3330d28d2df1ef09d0b9d7dbecdee706fb} +E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20230527@sha256:a98ce8ab90f16bdd8539b168a4d000f366afa4eec23a220b3ce39698c5769bfd} if [[ "$RUNTIME" == podman ]]; then # Podman does not support both tag and digest diff --git a/charts/ingress-nginx/README.md b/charts/ingress-nginx/README.md index 4d4d6ba6f..391eb4159 100644 --- a/charts/ingress-nginx/README.md +++ b/charts/ingress-nginx/README.md @@ -248,11 +248,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.admissionWebhooks.networkPolicyEnabled | bool | `false` | | | controller.admissionWebhooks.objectSelector | object | `{}` | | | controller.admissionWebhooks.patch.enabled | bool | `true` | | -| controller.admissionWebhooks.patch.image.digest | string | `"sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f"` | | +| controller.admissionWebhooks.patch.image.digest | string | `"sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"` | | | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | | | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | | | controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | | -| controller.admissionWebhooks.patch.image.tag | string | `"v20230312-helm-chart-4.5.2-28-g66a760794"` | | +| controller.admissionWebhooks.patch.image.tag | string | `"v20230407"` | | | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources | | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | | | controller.admissionWebhooks.patch.podAnnotations | object | `{}` | | @@ -371,7 +371,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # | | controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | | | controller.opentelemetry.enabled | bool | `false` | | -| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f"` | | +| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0"` | | | controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # | | controller.podLabels | object | `{}` | Labels to add to the pod container metadata | | controller.podSecurityContext | object | `{}` | Security Context policies for controller pods | diff --git a/charts/ingress-nginx/values.yaml b/charts/ingress-nginx/values.yaml index e0b38c5a7..962567e07 100644 --- a/charts/ingress-nginx/values.yaml +++ b/charts/ingress-nginx/values.yaml @@ -547,7 +547,7 @@ controller: opentelemetry: enabled: false - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0 containerSecurityContext: allowPrivilegeEscalation: false admissionWebhooks: @@ -609,8 +609,8 @@ controller: ## for backwards compatibility consider setting the full image url via the repository value below ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail ## repository: - tag: v20230312-helm-chart-4.5.2-28-g66a760794 - digest: sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + tag: v20230407 + digest: sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b pullPolicy: IfNotPresent # -- Provide a priority class name to the webhook patching job ## diff --git a/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml b/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml index 807da71a4..708a93831 100644 --- a/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml +++ b/docs/examples/customization/custom-errors/custom-default-backend.helm.values.yaml @@ -6,7 +6,7 @@ defaultBackend: image: registry: registry.k8s.io image: ingress-nginx/nginx-errors - tag: "v20230312-helm-chart-4.5.2-28-g66a760794@sha256:332be6ff8c4e93e8845963932f98839dfd52ae49829c29e06475368a3e4fbd9e" + tag: "v20230505@sha256:3600dcd1bbd0d05959bb01af4b272714e94d22d24a64e91838e7183c80e53f7f" extraVolumes: - name: custom-error-pages configMap: diff --git a/docs/examples/customization/custom-errors/custom-default-backend.yaml b/docs/examples/customization/custom-errors/custom-default-backend.yaml index 2af64896f..e606c5b62 100644 --- a/docs/examples/customization/custom-errors/custom-default-backend.yaml +++ b/docs/examples/customization/custom-errors/custom-default-backend.yaml @@ -36,7 +36,7 @@ spec: spec: containers: - name: nginx-error-server - image: registry.k8s.io/ingress-nginx/nginx-errors:v20230404-helm-chart-4.6.0-11-gc76179c04@sha256:aabd7a001f6a0a07ed6ea8f6da87e928bfa8f971eba2bef708f3e8504fc5cc9b + image: registry.k8s.io/ingress-nginx/nginx-errors:v20230505@sha256:3600dcd1bbd0d05959bb01af4b272714e94d22d24a64e91838e7183c80e53f7f ports: - containerPort: 8080 # Setting the environment variable DEBUG we can see the headers sent diff --git a/docs/examples/customization/external-auth-headers/echo-service.yaml b/docs/examples/customization/external-auth-headers/echo-service.yaml index 57df4d628..fc4461cd8 100644 --- a/docs/examples/customization/external-auth-headers/echo-service.yaml +++ b/docs/examples/customization/external-auth-headers/echo-service.yaml @@ -18,7 +18,7 @@ spec: terminationGracePeriodSeconds: 60 containers: - name: echo-service - image: registry.k8s.io/ingress-nginx/e2e-test-echo:v20230318-helm-chart-4.5.2-44-gfec1dbe3a@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a + image: registry.k8s.io/ingress-nginx/e2e-test-echo:v20230527@sha256:6fc5aa2994c86575975bb20a5203651207029a0d28e3f491d8a127d08baadab4 ports: - containerPort: 8080 resources: diff --git a/docs/user-guide/third-party-addons/opentelemetry.md b/docs/user-guide/third-party-addons/opentelemetry.md index 1b9b6536e..1e276939e 100644 --- a/docs/user-guide/third-party-addons/opentelemetry.md +++ b/docs/user-guide/third-party-addons/opentelemetry.md @@ -140,7 +140,7 @@ To install the example and collectors run: ```yaml opentelemetry: enabled: true - image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9 + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0 containerSecurityContext: allowPrivilegeEscalation: false ``` diff --git a/test/e2e-image/Makefile b/test/e2e-image/Makefile index 4106290e6..f74ea8c74 100644 --- a/test/e2e-image/Makefile +++ b/test/e2e-image/Makefile @@ -1,6 +1,6 @@ DIR:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) -E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230522@sha256:a3deb0444d53b3f3b2d73acec8be2c3330d28d2df1ef09d0b9d7dbecdee706fb" +E2E_BASE_IMAGE ?= "registry.k8s.io/ingress-nginx/e2e-test-runner:v20230527@sha256:a98ce8ab90f16bdd8539b168a4d000f366afa4eec23a220b3ce39698c5769bfd" image: echo "..entered Makefile in /test/e2e-image" diff --git a/test/e2e/framework/deployment.go b/test/e2e/framework/deployment.go index 06dfa0c5e..565b8f4ac 100644 --- a/test/e2e/framework/deployment.go +++ b/test/e2e/framework/deployment.go @@ -100,7 +100,7 @@ func (f *Framework) NewEchoDeployment(opts ...func(*deploymentOptions)) { namespace: f.Namespace, name: EchoService, replicas: 1, - image: "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:4938d1d91a2b7d19454460a8c1b010b89f6ff92d2987fd889ac3e8fc3b70d91a", + image: "registry.k8s.io/ingress-nginx/e2e-test-echo@sha256:6fc5aa2994c86575975bb20a5203651207029a0d28e3f491d8a127d08baadab4", } for _, o := range opts { o(options) diff --git a/test/e2e/settings/ocsp/ocsp.go b/test/e2e/settings/ocsp/ocsp.go index 483013f59..ea444444b 100644 --- a/test/e2e/settings/ocsp/ocsp.go +++ b/test/e2e/settings/ocsp/ocsp.go @@ -290,7 +290,7 @@ func ocspserveDeployment(namespace string) (*appsv1.Deployment, *corev1.Service) Containers: []corev1.Container{ { Name: name, - Image: "registry.k8s.io/ingress-nginx/e2e-test-cfssl@sha256:d02c1e18f573449966999fc850f1fed3d37621bf77797562cbe77ebdb06a66ea", + Image: "registry.k8s.io/ingress-nginx/e2e-test-cfssl@sha256:adaa118c179c41cb33fb567004a1f0c71b8fce6bc13263efa63d42dddd5b4346", Command: []string{ "/bin/bash", "-c", From 40957d43ccaf13b380887d8dee8abe709e01a303 Mon Sep 17 00:00:00 2001 From: longwuyuan Date: Fri, 26 May 2023 23:58:19 +0530 Subject: [PATCH 202/822] add faq section in docs --- docs/faq.md | 33 ++++++++++++++ docs/index.md | 7 +-- docs/user-guide/retaining-client-ipaddress.md | 44 +++++++++++++++++++ mkdocs.yml | 1 + 4 files changed, 79 insertions(+), 6 deletions(-) create mode 100644 docs/faq.md create mode 100644 docs/user-guide/retaining-client-ipaddress.md diff --git a/docs/faq.md b/docs/faq.md new file mode 100644 index 000000000..253378c65 --- /dev/null +++ b/docs/faq.md @@ -0,0 +1,33 @@ + +# FAQ + +## Retaining Client IPAddress + +Please read [Retain Client IPAddress Guide here](./user-guide/retaining-client-ipaddress.md). + +## Kubernetes v1.22 Migration + +If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), and you plan to upgrade your Kubernetes version to K8S 1.22 or above, then please read [the migration guide here](./user-guide/k8s-122-migration.md). + +## Validation Of __`path`__ + +- For improving security and also following desired standards on Kubernetes API spec, the next release, scheduled for v1.8.0, will include a new & optional feature of validating the value for the key `ingress.spec.rules.http.paths.path` . + +- This behavior will be disabled by default on the 1.8.0 release and enabled by default on the next breaking change release, set for 2.0.0. + +- When "`ingress.spec.rules.http.pathType=Exact`" or "`pathType=Prefix`", this validation will limit the characters accepted on the field "`ingress.spec.rules.http.paths.path`", to "`alphanumeric characters`", and `"/," "_," "-."` Also, in this case, the path should start with `"/."` + +- When the ingress resource path contains other characters (like on rewrite configurations), the pathType value should be "`ImplementationSpecific`". + +- API Spec on pathType is documented [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types) + +- When this option is enabled, the validation will happen on the Admission Webhook. So if any new ingress object contains characters other than "`alphanumeric characters`", and `"/," "_," "-."` , in the `path` field, but is not using `pathType` value as `ImplementationSpecific`, then the ingress object will be denied admission. + +- The cluster admin should establish validation rules using mechanisms like "`Open Policy Agent`", to validate that only authorized users can use ImplementationSpecific pathType and that only the authorized characters can be used. [The configmap value is here](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type) + +- A complete example of an Openpolicyagent gatekeeper rule is available [here](https://kubernetes.github.io/ingress-nginx/examples/openpolicyagent/) + +- If you have any issues or concerns, please do one of the following: + - Open a GitHub issue + - Comment in our Dev Slack Channel + - Open a thread in our Google Group ingress-nginx-dev@kubernetes.io diff --git a/docs/index.md b/docs/index.md index bcf4a4018..0a0f488cf 100644 --- a/docs/index.md +++ b/docs/index.md @@ -6,12 +6,7 @@ It is built around the [Kubernetes Ingress resource](https://kubernetes.io/docs/ You can learn more about using [Ingress](http://kubernetes.io/docs/user-guide/ingress/) in the official [Kubernetes documentation](https://docs.k8s.io). -## Getting Started +# Getting Started See [Deployment](./deploy/) for a whirlwind tour that will get you started. - -# FAQ - Kubernetes 1.22 Migration - -If you are using Ingress objects in your cluster (running Kubernetes older than v1.22), -and you plan to upgrade to Kubernetes v1.22, please read [the migration guide here](./user-guide/k8s-122-migration.md). diff --git a/docs/user-guide/retaining-client-ipaddress.md b/docs/user-guide/retaining-client-ipaddress.md new file mode 100644 index 000000000..237bd3004 --- /dev/null +++ b/docs/user-guide/retaining-client-ipaddress.md @@ -0,0 +1,44 @@ + +## Retaining Client IPAddress + +Please read this https://kubernetes.github.io/ingress-nginx/user-guide/miscellaneous/#source-ip-address , to get details of retaining the client IPAddress. + +### Using proxy-protocol + +Please read this https://kubernetes.github.io/ingress-nginx/user-guide/miscellaneous/#proxy-protocol , to use proxy-protocol for retaining client IPAddress + + +### Using the K8S spec service.spec.externalTrafficPolicy + +``` +% kubectl explain service.spec.externalTrafficPolicy +KIND: Service +VERSION: v1 + +FIELD: externalTrafficPolicy + +DESCRIPTION: + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will + configure the service in a way that assumes that external load balancers + will take care of balancing the service traffic between nodes, and so each + node will deliver traffic only to the node-local endpoints of the service, + without masquerading the client source IP. (Traffic mistakenly sent to a + node with no endpoints will be dropped.) The default value, "Cluster", uses + the standard behavior of routing to all endpoints evenly (possibly modified + by topology and other features). Note that traffic sent to an External IP or + LoadBalancer IP from within the cluster will always get "Cluster" semantics, + but clients sending to a NodePort from within the cluster may need to take + traffic policy into account when picking a node. + + Possible enum values: + - `"Cluster"` routes traffic to all endpoints. + - `"Local"` preserves the source IP of the traffic by routing only to + endpoints on the same node as the traffic was received on (dropping the + traffic if there are no local endpoints). + +``` + + +- Setting the field `externalTrafficPolicy`, in the ingress-controller service, to a value of `Local` retains the client's ipaddress, within the scope explained above diff --git a/mkdocs.yml b/mkdocs.yml index 380b1b67a..992c04d45 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -130,3 +130,4 @@ nav: - Developer Guide: - Getting Started: "developer-guide/getting-started.md" - Code Overview: "developer-guide/code-overview.md" + - FAQ: "faq.md" From 0e94cc1b234c62fbc3a37ba1b991c2accb5e6959 Mon Sep 17 00:00:00 2001 From: Jintao Zhang Date: Mon, 29 May 2023 19:35:25 +0800 Subject: [PATCH 203/822] chore: start v1.8.0 release process Signed-off-by: Jintao Zhang --- TAG | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/TAG b/TAG index 668c7899c..ba103d909 100644 --- a/TAG +++ b/TAG @@ -1,2 +1,2 @@ -v1.7.1 +v1.8.0 From 53254647bc4e908dd3e046a56d3274565e1b011a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 29 May 2023 07:03:43 -0700 Subject: [PATCH 204/822] Bump github.com/prometheus/common from 0.43.0 to 0.44.0 (#10007) Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.43.0 to 0.44.0. - [Release notes](https://github.com/prometheus/common/releases) - [Commits](https://github.com/prometheus/common/compare/v0.43.0...v0.44.0) --- updated-dependencies: - dependency-name: github.com/prometheus/common dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index c44d2f207..721a3c16b 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/pmezard/go-difflib v1.0.0 github.com/prometheus/client_golang v1.15.1 github.com/prometheus/client_model v0.4.0 - github.com/prometheus/common v0.43.0 + github.com/prometheus/common v0.44.0 github.com/spf13/cobra v1.7.0 github.com/spf13/pflag v1.0.5 github.com/stretchr/testify v1.8.2 @@ -102,7 +102,7 @@ require ( go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect golang.org/x/mod v0.10.0 // indirect golang.org/x/net v0.10.0 // indirect - golang.org/x/oauth2 v0.7.0 // indirect + golang.org/x/oauth2 v0.8.0 // indirect golang.org/x/sys v0.8.0 // indirect golang.org/x/term v0.8.0 // indirect golang.org/x/text v0.9.0 // indirect diff --git a/go.sum b/go.sum index c2e02777b..003ad5fb8 100644 --- a/go.sum +++ b/go.sum @@ -318,8 +318,8 @@ github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y8 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= github.com/prometheus/common v0.29.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= -github.com/prometheus/common v0.43.0 h1:iq+BVjvYLei5f27wiuNiB1DN6DYQkp1c8Bx0Vykh5us= -github.com/prometheus/common v0.43.0/go.mod h1:NCvr5cQIh3Y/gy73/RdVtC9r8xxrxwJnB+2lB3BxrFc= +github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY= +github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY= github.com/prometheus/exporter-toolkit v0.7.0/go.mod h1:ZUBIj498ePooX9t/2xtDjeQYwvRpiPP2lh5u4iblj2g= github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= @@ -469,8 +469,8 @@ golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4Iltr golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= -golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g= -golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4= +golang.org/x/oauth2 v0.8.0 h1:6dkIjl3j3LtZ/O3sTgZTMsLKSftL/B8Zgq4huOIIUu8= +golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= From 1240361855d3b4679379f66eb0c437014cd5e5fb Mon Sep 17 00:00:00 2001 From: Ehsan Saei <71217171+esigo@users.noreply.github.com> Date: Mon, 29 May 2023 19:33:44 +0200 Subject: [PATCH 205/822] Add legacy to OpenTelemetry migration doc (#10011) --- .../third-party-addons/opentelemetry.md | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/docs/user-guide/third-party-addons/opentelemetry.md b/docs/user-guide/third-party-addons/opentelemetry.md index 1e276939e..d735fca4f 100644 --- a/docs/user-guide/third-party-addons/opentelemetry.md +++ b/docs/user-guide/third-party-addons/opentelemetry.md @@ -5,6 +5,18 @@ Enables requests served by NGINX for distributed telemetry via The OpenTelemetry Using the third party module [opentelemetry-cpp-contrib/nginx](https://github.com/open-telemetry/opentelemetry-cpp-contrib/tree/main/instrumentation/nginx) the Ingress-Nginx Controller can configure NGINX to enable [OpenTelemetry](http://opentelemetry.io) instrumentation. By default this feature is disabled. +Check out this demo showcasing OpenTelemetry in Ingress NGINX. The video provides an overview and +practical demonstration of how OpenTelemetry can be utilized in Ingress NGINX for observability +and monitoring purposes. + +